* [gentoo-commits] proj/hardened-patchset:master commit in: 2.6.32/
@ 2011-12-27 2:29 Anthony G. Basile
0 siblings, 0 replies; 13+ messages in thread
From: Anthony G. Basile @ 2011-12-27 2:29 UTC (permalink / raw
To: gentoo-commits
commit: 3c1c918b40f8170dfd158b6bee73fb4fe26e29a6
Author: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Tue Dec 27 02:28:53 2011 +0000
Commit: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Tue Dec 27 02:28:53 2011 +0000
URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-patchset.git;a=commit;h=3c1c918b
Add patch to bump to 2.6.32.51
---
2.6.32/0000_README | 4 +
2.6.32/1050_linux-2.6.32.51.patch | 588 +++++++++++++++++++++++++++++++++++++
2 files changed, 592 insertions(+), 0 deletions(-)
diff --git a/2.6.32/0000_README b/2.6.32/0000_README
index 22c2947..c414b52 100644
--- a/2.6.32/0000_README
+++ b/2.6.32/0000_README
@@ -3,6 +3,10 @@ README
Individual Patch Descriptions:
-----------------------------------------------------------------------------
+Patch: 1050_linux-2.6.32.51.patch
+From: http://www.kernel.org
+Desc: Linux 2.6.32.51
+
Patch: 4420_grsecurity-2.2.2-2.6.32.51-201112222105.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/2.6.32/1050_linux-2.6.32.51.patch b/2.6.32/1050_linux-2.6.32.51.patch
new file mode 100644
index 0000000..e328bd5
--- /dev/null
+++ b/2.6.32/1050_linux-2.6.32.51.patch
@@ -0,0 +1,588 @@
+diff --git a/Makefile b/Makefile
+index f38986c..1c640ea 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ VERSION = 2
+ PATCHLEVEL = 6
+ SUBLEVEL = 32
+-EXTRAVERSION = .50
++EXTRAVERSION = .51
+ NAME = Man-Eating Seals of Antiquity
+
+ # *DOCUMENTATION*
+diff --git a/arch/arm/mach-davinci/board-dm646x-evm.c b/arch/arm/mach-davinci/board-dm646x-evm.c
+index 24e0e13..6b25227 100644
+--- a/arch/arm/mach-davinci/board-dm646x-evm.c
++++ b/arch/arm/mach-davinci/board-dm646x-evm.c
+@@ -502,7 +502,7 @@ static int setup_vpif_input_channel_mode(int mux_mode)
+ int val;
+ u32 value;
+
+- if (!vpif_vsclkdis_reg || !cpld_client)
++ if (!vpif_vidclkctl_reg || !cpld_client)
+ return -ENXIO;
+
+ val = i2c_smbus_read_byte(cpld_client);
+@@ -510,7 +510,7 @@ static int setup_vpif_input_channel_mode(int mux_mode)
+ return val;
+
+ spin_lock_irqsave(&vpif_reg_lock, flags);
+- value = __raw_readl(vpif_vsclkdis_reg);
++ value = __raw_readl(vpif_vidclkctl_reg);
+ if (mux_mode) {
+ val &= VPIF_INPUT_TWO_CHANNEL;
+ value |= VIDCH1CLK;
+@@ -518,7 +518,7 @@ static int setup_vpif_input_channel_mode(int mux_mode)
+ val |= VPIF_INPUT_ONE_CHANNEL;
+ value &= ~VIDCH1CLK;
+ }
+- __raw_writel(value, vpif_vsclkdis_reg);
++ __raw_writel(value, vpif_vidclkctl_reg);
+ spin_unlock_irqrestore(&vpif_reg_lock, flags);
+
+ err = i2c_smbus_write_byte(cpld_client, val);
+diff --git a/arch/x86/oprofile/backtrace.c b/arch/x86/oprofile/backtrace.c
+index 044897b..829edf0 100644
+--- a/arch/x86/oprofile/backtrace.c
++++ b/arch/x86/oprofile/backtrace.c
+@@ -11,6 +11,8 @@
+ #include <linux/oprofile.h>
+ #include <linux/sched.h>
+ #include <linux/mm.h>
++#include <linux/highmem.h>
++
+ #include <asm/ptrace.h>
+ #include <asm/uaccess.h>
+ #include <asm/stacktrace.h>
+@@ -47,6 +49,42 @@ static struct stacktrace_ops backtrace_ops = {
+ .address = backtrace_address,
+ };
+
++/* from arch/x86/kernel/cpu/perf_event.c: */
++
++/*
++ * best effort, GUP based copy_from_user() that assumes IRQ or NMI context
++ */
++static unsigned long
++copy_from_user_nmi(void *to, const void __user *from, unsigned long n)
++{
++ unsigned long offset, addr = (unsigned long)from;
++ unsigned long size, len = 0;
++ struct page *page;
++ void *map;
++ int ret;
++
++ do {
++ ret = __get_user_pages_fast(addr, 1, 0, &page);
++ if (!ret)
++ break;
++
++ offset = addr & (PAGE_SIZE - 1);
++ size = min(PAGE_SIZE - offset, n - len);
++
++ map = kmap_atomic(page, KM_USER0);
++ memcpy(to, map+offset, size);
++ kunmap_atomic(map, KM_USER0);
++ put_page(page);
++
++ len += size;
++ to += size;
++ addr += size;
++
++ } while (len < n);
++
++ return len;
++}
++
+ struct frame_head {
+ struct frame_head *bp;
+ unsigned long ret;
+@@ -54,12 +92,12 @@ struct frame_head {
+
+ static struct frame_head *dump_user_backtrace(struct frame_head *head)
+ {
++ /* Also check accessibility of one struct frame_head beyond: */
+ struct frame_head bufhead[2];
++ unsigned long bytes;
+
+- /* Also check accessibility of one struct frame_head beyond */
+- if (!access_ok(VERIFY_READ, head, sizeof(bufhead)))
+- return NULL;
+- if (__copy_from_user_inatomic(bufhead, head, sizeof(bufhead)))
++ bytes = copy_from_user_nmi(bufhead, head, sizeof(bufhead));
++ if (bytes != sizeof(bufhead))
+ return NULL;
+
+ oprofile_add_trace(bufhead[0].ret);
+diff --git a/arch/x86/oprofile/nmi_int.c b/arch/x86/oprofile/nmi_int.c
+index ca6b336..8f0e49b 100644
+--- a/arch/x86/oprofile/nmi_int.c
++++ b/arch/x86/oprofile/nmi_int.c
+@@ -750,12 +750,12 @@ int __init op_nmi_init(struct oprofile_operations *ops)
+
+ void op_nmi_exit(void)
+ {
+- if (using_nmi) {
+- exit_sysfs();
++ if (!using_nmi)
++ return;
++ exit_sysfs();
+ #ifdef CONFIG_SMP
+- unregister_cpu_notifier(&oprofile_cpu_nb);
++ unregister_cpu_notifier(&oprofile_cpu_nb);
+ #endif
+- }
+ if (model->exit)
+ model->exit();
+ }
+diff --git a/drivers/oprofile/buffer_sync.c b/drivers/oprofile/buffer_sync.c
+index 5c4df24..334ccd6 100644
+--- a/drivers/oprofile/buffer_sync.c
++++ b/drivers/oprofile/buffer_sync.c
+@@ -140,6 +140,13 @@ static struct notifier_block module_load_nb = {
+ .notifier_call = module_load_notify,
+ };
+
++static void free_all_tasks(void)
++{
++ /* make sure we don't leak task structs */
++ process_task_mortuary();
++ process_task_mortuary();
++}
++
+ int sync_start(void)
+ {
+ int err;
+@@ -147,8 +154,6 @@ int sync_start(void)
+ if (!zalloc_cpumask_var(&marked_cpus, GFP_KERNEL))
+ return -ENOMEM;
+
+- mutex_lock(&buffer_mutex);
+-
+ err = task_handoff_register(&task_free_nb);
+ if (err)
+ goto out1;
+@@ -165,7 +170,6 @@ int sync_start(void)
+ start_cpu_work();
+
+ out:
+- mutex_unlock(&buffer_mutex);
+ return err;
+ out4:
+ profile_event_unregister(PROFILE_MUNMAP, &munmap_nb);
+@@ -173,6 +177,7 @@ out3:
+ profile_event_unregister(PROFILE_TASK_EXIT, &task_exit_nb);
+ out2:
+ task_handoff_unregister(&task_free_nb);
++ free_all_tasks();
+ out1:
+ free_cpumask_var(marked_cpus);
+ goto out;
+@@ -181,20 +186,16 @@ out1:
+
+ void sync_stop(void)
+ {
+- /* flush buffers */
+- mutex_lock(&buffer_mutex);
+ end_cpu_work();
+ unregister_module_notifier(&module_load_nb);
+ profile_event_unregister(PROFILE_MUNMAP, &munmap_nb);
+ profile_event_unregister(PROFILE_TASK_EXIT, &task_exit_nb);
+ task_handoff_unregister(&task_free_nb);
+- mutex_unlock(&buffer_mutex);
+- flush_scheduled_work();
++ barrier(); /* do all of the above first */
+
+- /* make sure we don't leak task structs */
+- process_task_mortuary();
+- process_task_mortuary();
++ flush_scheduled_work();
+
++ free_all_tasks();
+ free_cpumask_var(marked_cpus);
+ }
+
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 9d3d8cf..cec9bff 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1528,6 +1528,16 @@ static struct usb_device_id acm_ids[] = {
+ },
+ { USB_DEVICE(0x22b8, 0x6425), /* Motorola MOTOMAGX phones */
+ },
++ /* Motorola H24 HSPA module: */
++ { USB_DEVICE(0x22b8, 0x2d91) }, /* modem */
++ { USB_DEVICE(0x22b8, 0x2d92) }, /* modem + diagnostics */
++ { USB_DEVICE(0x22b8, 0x2d93) }, /* modem + AT port */
++ { USB_DEVICE(0x22b8, 0x2d95) }, /* modem + AT port + diagnostics */
++ { USB_DEVICE(0x22b8, 0x2d96) }, /* modem + NMEA */
++ { USB_DEVICE(0x22b8, 0x2d97) }, /* modem + diagnostics + NMEA */
++ { USB_DEVICE(0x22b8, 0x2d99) }, /* modem + AT port + NMEA */
++ { USB_DEVICE(0x22b8, 0x2d9a) }, /* modem + AT port + diagnostics + NMEA */
++
+ { USB_DEVICE(0x0572, 0x1329), /* Hummingbird huc56s (Conexant) */
+ .driver_info = NO_UNION_NORMAL, /* union descriptor misplaced on
+ data interface instead of
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 8572c79..72ba88f 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -3228,7 +3228,7 @@ static int ext4_da_write_end(struct file *file,
+ */
+
+ new_i_size = pos + copied;
+- if (new_i_size > EXT4_I(inode)->i_disksize) {
++ if (copied && new_i_size > EXT4_I(inode)->i_disksize) {
+ if (ext4_da_should_update_i_disksize(page, end)) {
+ down_write(&EXT4_I(inode)->i_data_sem);
+ if (new_i_size > EXT4_I(inode)->i_disksize) {
+diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c
+index 052f214..0609e71 100644
+--- a/fs/hfs/btree.c
++++ b/fs/hfs/btree.c
+@@ -45,11 +45,26 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id, btree_keycmp ke
+ case HFS_EXT_CNID:
+ hfs_inode_read_fork(tree->inode, mdb->drXTExtRec, mdb->drXTFlSize,
+ mdb->drXTFlSize, be32_to_cpu(mdb->drXTClpSiz));
++ if (HFS_I(tree->inode)->alloc_blocks >
++ HFS_I(tree->inode)->first_blocks) {
++ printk(KERN_ERR "hfs: invalid btree extent records\n");
++ unlock_new_inode(tree->inode);
++ goto free_inode;
++ }
++
+ tree->inode->i_mapping->a_ops = &hfs_btree_aops;
+ break;
+ case HFS_CAT_CNID:
+ hfs_inode_read_fork(tree->inode, mdb->drCTExtRec, mdb->drCTFlSize,
+ mdb->drCTFlSize, be32_to_cpu(mdb->drCTClpSiz));
++
++ if (!HFS_I(tree->inode)->first_blocks) {
++ printk(KERN_ERR "hfs: invalid btree extent records "
++ "(0 size).\n");
++ unlock_new_inode(tree->inode);
++ goto free_inode;
++ }
++
+ tree->inode->i_mapping->a_ops = &hfs_btree_aops;
+ break;
+ default:
+@@ -58,11 +73,6 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id, btree_keycmp ke
+ }
+ unlock_new_inode(tree->inode);
+
+- if (!HFS_I(tree->inode)->first_blocks) {
+- printk(KERN_ERR "hfs: invalid btree extent records (0 size).\n");
+- goto free_inode;
+- }
+-
+ mapping = tree->inode->i_mapping;
+ page = read_mapping_page(mapping, 0, NULL);
+ if (IS_ERR(page))
+diff --git a/fs/jbd/journal.c b/fs/jbd/journal.c
+index 45905ff..70713d5 100644
+--- a/fs/jbd/journal.c
++++ b/fs/jbd/journal.c
+@@ -1070,6 +1070,14 @@ static int journal_get_superblock(journal_t *journal)
+ goto out;
+ }
+
++ if (be32_to_cpu(sb->s_first) == 0 ||
++ be32_to_cpu(sb->s_first) >= journal->j_maxlen) {
++ printk(KERN_WARNING
++ "JBD: Invalid start block of journal: %u\n",
++ be32_to_cpu(sb->s_first));
++ goto out;
++ }
++
+ return 0;
+
+ out:
+diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
+index 17af879..c00de9c 100644
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -1183,6 +1183,14 @@ static int journal_get_superblock(journal_t *journal)
+ goto out;
+ }
+
++ if (be32_to_cpu(sb->s_first) == 0 ||
++ be32_to_cpu(sb->s_first) >= journal->j_maxlen) {
++ printk(KERN_WARNING
++ "JBD2: Invalid start block of journal: %u\n",
++ be32_to_cpu(sb->s_first));
++ goto out;
++ }
++
+ return 0;
+
+ out:
+diff --git a/include/linux/log2.h b/include/linux/log2.h
+index 25b8086..fd7ff3d 100644
+--- a/include/linux/log2.h
++++ b/include/linux/log2.h
+@@ -185,7 +185,6 @@ unsigned long __rounddown_pow_of_two(unsigned long n)
+ #define rounddown_pow_of_two(n) \
+ ( \
+ __builtin_constant_p(n) ? ( \
+- (n == 1) ? 0 : \
+ (1UL << ilog2(n))) : \
+ __rounddown_pow_of_two(n) \
+ )
+diff --git a/kernel/taskstats.c b/kernel/taskstats.c
+index b080920..a4ef542 100644
+--- a/kernel/taskstats.c
++++ b/kernel/taskstats.c
+@@ -592,6 +592,7 @@ static struct genl_ops taskstats_ops = {
+ .cmd = TASKSTATS_CMD_GET,
+ .doit = taskstats_user_cmd,
+ .policy = taskstats_cmd_get_policy,
++ .flags = GENL_ADMIN_PERM,
+ };
+
+ static struct genl_ops cgroupstats_ops = {
+diff --git a/mm/percpu.c b/mm/percpu.c
+index 3bfd6e2..c90614a 100644
+--- a/mm/percpu.c
++++ b/mm/percpu.c
+@@ -110,9 +110,9 @@ static int pcpu_atom_size __read_mostly;
+ static int pcpu_nr_slots __read_mostly;
+ static size_t pcpu_chunk_struct_size __read_mostly;
+
+-/* cpus with the lowest and highest unit numbers */
+-static unsigned int pcpu_first_unit_cpu __read_mostly;
+-static unsigned int pcpu_last_unit_cpu __read_mostly;
++/* cpus with the lowest and highest unit addresses */
++static unsigned int pcpu_low_unit_cpu __read_mostly;
++static unsigned int pcpu_high_unit_cpu __read_mostly;
+
+ /* the address of the first chunk which starts with the kernel static area */
+ void *pcpu_base_addr __read_mostly;
+@@ -746,8 +746,8 @@ static void pcpu_pre_unmap_flush(struct pcpu_chunk *chunk,
+ int page_start, int page_end)
+ {
+ flush_cache_vunmap(
+- pcpu_chunk_addr(chunk, pcpu_first_unit_cpu, page_start),
+- pcpu_chunk_addr(chunk, pcpu_last_unit_cpu, page_end));
++ pcpu_chunk_addr(chunk, pcpu_low_unit_cpu, page_start),
++ pcpu_chunk_addr(chunk, pcpu_high_unit_cpu, page_end));
+ }
+
+ static void __pcpu_unmap_pages(unsigned long addr, int nr_pages)
+@@ -809,8 +809,8 @@ static void pcpu_post_unmap_tlb_flush(struct pcpu_chunk *chunk,
+ int page_start, int page_end)
+ {
+ flush_tlb_kernel_range(
+- pcpu_chunk_addr(chunk, pcpu_first_unit_cpu, page_start),
+- pcpu_chunk_addr(chunk, pcpu_last_unit_cpu, page_end));
++ pcpu_chunk_addr(chunk, pcpu_low_unit_cpu, page_start),
++ pcpu_chunk_addr(chunk, pcpu_high_unit_cpu, page_end));
+ }
+
+ static int __pcpu_map_pages(unsigned long addr, struct page **pages,
+@@ -887,8 +887,8 @@ static void pcpu_post_map_flush(struct pcpu_chunk *chunk,
+ int page_start, int page_end)
+ {
+ flush_cache_vmap(
+- pcpu_chunk_addr(chunk, pcpu_first_unit_cpu, page_start),
+- pcpu_chunk_addr(chunk, pcpu_last_unit_cpu, page_end));
++ pcpu_chunk_addr(chunk, pcpu_low_unit_cpu, page_start),
++ pcpu_chunk_addr(chunk, pcpu_high_unit_cpu, page_end));
+ }
+
+ /**
+@@ -1680,7 +1680,9 @@ int __init pcpu_setup_first_chunk(const struct pcpu_alloc_info *ai,
+
+ for (cpu = 0; cpu < nr_cpu_ids; cpu++)
+ unit_map[cpu] = UINT_MAX;
+- pcpu_first_unit_cpu = NR_CPUS;
++
++ pcpu_low_unit_cpu = NR_CPUS;
++ pcpu_high_unit_cpu = NR_CPUS;
+
+ for (group = 0, unit = 0; group < ai->nr_groups; group++, unit += i) {
+ const struct pcpu_group_info *gi = &ai->groups[group];
+@@ -1700,9 +1702,13 @@ int __init pcpu_setup_first_chunk(const struct pcpu_alloc_info *ai,
+ unit_map[cpu] = unit + i;
+ unit_off[cpu] = gi->base_offset + i * ai->unit_size;
+
+- if (pcpu_first_unit_cpu == NR_CPUS)
+- pcpu_first_unit_cpu = cpu;
+- pcpu_last_unit_cpu = cpu;
++ /* determine low/high unit_cpu */
++ if (pcpu_low_unit_cpu == NR_CPUS ||
++ unit_off[cpu] < unit_off[pcpu_low_unit_cpu])
++ pcpu_low_unit_cpu = cpu;
++ if (pcpu_high_unit_cpu == NR_CPUS ||
++ unit_off[cpu] > unit_off[pcpu_high_unit_cpu])
++ pcpu_high_unit_cpu = cpu;
+ }
+ }
+ pcpu_nr_units = unit;
+diff --git a/mm/util.c b/mm/util.c
+index b377ce4..e48b493 100644
+--- a/mm/util.c
++++ b/mm/util.c
+@@ -233,6 +233,19 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
+ }
+ #endif
+
++/*
++ * Like get_user_pages_fast() except its IRQ-safe in that it won't fall
++ * back to the regular GUP.
++ * If the architecture not support this fucntion, simply return with no
++ * page pinned
++ */
++int __attribute__((weak)) __get_user_pages_fast(unsigned long start,
++ int nr_pages, int write, struct page **pages)
++{
++ return 0;
++}
++EXPORT_SYMBOL_GPL(__get_user_pages_fast);
++
+ /**
+ * get_user_pages_fast() - pin user pages in memory
+ * @start: starting user address
+diff --git a/net/xfrm/xfrm_algo.c b/net/xfrm/xfrm_algo.c
+index faf54c6..9bd850a 100644
+--- a/net/xfrm/xfrm_algo.c
++++ b/net/xfrm/xfrm_algo.c
+@@ -411,8 +411,8 @@ static struct xfrm_algo_desc ealg_list[] = {
+ .desc = {
+ .sadb_alg_id = SADB_X_EALG_AESCTR,
+ .sadb_alg_ivlen = 8,
+- .sadb_alg_minbits = 128,
+- .sadb_alg_maxbits = 256
++ .sadb_alg_minbits = 160,
++ .sadb_alg_maxbits = 288
+ }
+ },
+ };
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index ba44dc0..6419095 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -432,6 +432,8 @@ static int alc_mux_enum_put(struct snd_kcontrol *kcontrol,
+ imux = &spec->input_mux[mux_idx];
+ if (!imux->num_items && mux_idx > 0)
+ imux = &spec->input_mux[0];
++ if (!imux->num_items)
++ return 0;
+
+ type = get_wcaps_type(get_wcaps(codec, nid));
+ if (type == AC_WID_AUD_MIX) {
+diff --git a/sound/pci/sis7019.c b/sound/pci/sis7019.c
+index 1a5ff06..b11ee62 100644
+--- a/sound/pci/sis7019.c
++++ b/sound/pci/sis7019.c
+@@ -40,6 +40,7 @@ MODULE_SUPPORTED_DEVICE("{{SiS,SiS7019 Audio Accelerator}}");
+ static int index = SNDRV_DEFAULT_IDX1; /* Index 0-MAX */
+ static char *id = SNDRV_DEFAULT_STR1; /* ID for this card */
+ static int enable = 1;
++static int codecs = 1;
+
+ module_param(index, int, 0444);
+ MODULE_PARM_DESC(index, "Index value for SiS7019 Audio Accelerator.");
+@@ -47,6 +48,8 @@ module_param(id, charp, 0444);
+ MODULE_PARM_DESC(id, "ID string for SiS7019 Audio Accelerator.");
+ module_param(enable, bool, 0444);
+ MODULE_PARM_DESC(enable, "Enable SiS7019 Audio Accelerator.");
++module_param(codecs, int, 0444);
++MODULE_PARM_DESC(codecs, "Set bit to indicate that codec number is expected to be present (default 1)");
+
+ static struct pci_device_id snd_sis7019_ids[] = {
+ { PCI_DEVICE(PCI_VENDOR_ID_SI, 0x7019) },
+@@ -139,6 +142,9 @@ struct sis7019 {
+ dma_addr_t silence_dma_addr;
+ };
+
++/* These values are also used by the module param 'codecs' to indicate
++ * which codecs should be present.
++ */
+ #define SIS_PRIMARY_CODEC_PRESENT 0x0001
+ #define SIS_SECONDARY_CODEC_PRESENT 0x0002
+ #define SIS_TERTIARY_CODEC_PRESENT 0x0004
+@@ -1075,6 +1081,7 @@ static int sis_chip_init(struct sis7019 *sis)
+ {
+ unsigned long io = sis->ioport;
+ void __iomem *ioaddr = sis->ioaddr;
++ unsigned long timeout;
+ u16 status;
+ int count;
+ int i;
+@@ -1101,21 +1108,45 @@ static int sis_chip_init(struct sis7019 *sis)
+ while ((inw(io + SIS_AC97_STATUS) & SIS_AC97_STATUS_BUSY) && --count)
+ udelay(1);
+
++ /* Command complete, we can let go of the semaphore now.
++ */
++ outl(SIS_AC97_SEMA_RELEASE, io + SIS_AC97_SEMA);
++ if (!count)
++ return -EIO;
++
+ /* Now that we've finished the reset, find out what's attached.
++ * There are some codec/board combinations that take an extremely
++ * long time to come up. 350+ ms has been observed in the field,
++ * so we'll give them up to 500ms.
+ */
+- status = inl(io + SIS_AC97_STATUS);
+- if (status & SIS_AC97_STATUS_CODEC_READY)
+- sis->codecs_present |= SIS_PRIMARY_CODEC_PRESENT;
+- if (status & SIS_AC97_STATUS_CODEC2_READY)
+- sis->codecs_present |= SIS_SECONDARY_CODEC_PRESENT;
+- if (status & SIS_AC97_STATUS_CODEC3_READY)
+- sis->codecs_present |= SIS_TERTIARY_CODEC_PRESENT;
+-
+- /* All done, let go of the semaphore, and check for errors
++ sis->codecs_present = 0;
++ timeout = msecs_to_jiffies(500) + jiffies;
++ while (time_before_eq(jiffies, timeout)) {
++ status = inl(io + SIS_AC97_STATUS);
++ if (status & SIS_AC97_STATUS_CODEC_READY)
++ sis->codecs_present |= SIS_PRIMARY_CODEC_PRESENT;
++ if (status & SIS_AC97_STATUS_CODEC2_READY)
++ sis->codecs_present |= SIS_SECONDARY_CODEC_PRESENT;
++ if (status & SIS_AC97_STATUS_CODEC3_READY)
++ sis->codecs_present |= SIS_TERTIARY_CODEC_PRESENT;
++
++ if (sis->codecs_present == codecs)
++ break;
++
++ msleep(1);
++ }
++
++ /* All done, check for errors.
+ */
+- outl(SIS_AC97_SEMA_RELEASE, io + SIS_AC97_SEMA);
+- if (!sis->codecs_present || !count)
++ if (!sis->codecs_present) {
++ printk(KERN_ERR "sis7019: could not find any codecs\n");
+ return -EIO;
++ }
++
++ if (sis->codecs_present != codecs) {
++ printk(KERN_WARNING "sis7019: missing codecs, found %0x, expected %0x\n",
++ sis->codecs_present, codecs);
++ }
+
+ /* Let the hardware know that the audio driver is alive,
+ * and enable PCM slots on the AC-link for L/R playback (3 & 4) and
+@@ -1387,6 +1418,17 @@ static int __devinit snd_sis7019_probe(struct pci_dev *pci,
+ if (!enable)
+ goto error_out;
+
++ /* The user can specify which codecs should be present so that we
++ * can wait for them to show up if they are slow to recover from
++ * the AC97 cold reset. We default to a single codec, the primary.
++ *
++ * We assume that SIS_PRIMARY_*_PRESENT matches bits 0-2.
++ */
++ codecs &= SIS_PRIMARY_CODEC_PRESENT | SIS_SECONDARY_CODEC_PRESENT |
++ SIS_TERTIARY_CODEC_PRESENT;
++ if (!codecs)
++ codecs = SIS_PRIMARY_CODEC_PRESENT;
++
+ rc = snd_card_create(index, id, THIS_MODULE, sizeof(*sis), &card);
+ if (rc < 0)
+ goto error_out;
^ permalink raw reply related [flat|nested] 13+ messages in thread* [gentoo-commits] proj/hardened-patchset:master commit in: 2.6.32/
@ 2014-03-31 11:35 Anthony G. Basile
0 siblings, 0 replies; 13+ messages in thread
From: Anthony G. Basile @ 2014-03-31 11:35 UTC (permalink / raw
To: gentoo-commits
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=UTF-8, Size: 4979701 bytes --]
commit: e81901297493e6abd3a430cc31993c349ed5cf49
Author: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Mon Mar 31 11:35:36 2014 +0000
Commit: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Mon Mar 31 11:35:36 2014 +0000
URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-patchset.git;a=commit;h=e8190129
2.6.32: EOF both kernel and grsec upstream
---
2.6.32/0000_README | 80 -
2.6.32/1052_linux-2.6.32.53.patch | 200 -
2.6.32/1053_linux-2.6.32.54.patch | 492 -
2.6.32/1054_linux-2.6.32.55.patch | 931 -
2.6.32/1055_linux-2.6.32.56.patch | 716 -
2.6.32/1056_linux-2.6.32.57.patch | 612 -
2.6.32/1057_linux-2.6.32.58.patch | 1280 -
2.6.32/1058_linux-2.6.32.59.patch | 404 -
2.6.32/1059_linux-2.6.32.60.patch | 7740 --
2.6.32/1060_linux-2.6.32.61.patch | 7137 -
...0_grsecurity-2.9.1-2.6.32.61-201312262018.patch | 129872 ------------------
2.6.32/4430_grsec-remove-localversion-grsec.patch | 9 -
2.6.32/4435_grsec-mute-warnings.patch | 42 -
2.6.32/4440_grsec-remove-protected-paths.patch | 19 -
2.6.32/4450_grsec-kconfig-default-gids.patch | 111 -
2.6.32/4465_selinux-avc_audit-log-curr_ip.patch | 73 -
2.6.32/4470_disable-compat_vdso.patch | 46 -
2.6.32/4475_emutramp_default_on.patch | 21 -
2.6.32/4480_check_ssp_fix.patch | 17 -
19 files changed, 149802 deletions(-)
diff --git a/2.6.32/0000_README b/2.6.32/0000_README
deleted file mode 100644
index 88db1be..0000000
--- a/2.6.32/0000_README
+++ /dev/null
@@ -1,80 +0,0 @@
-README
------------------------------------------------------------------------------
-Individual Patch Descriptions:
------------------------------------------------------------------------------
-Patch: 1052_linux-2.6.32.53.patch
-From: http://www.kernel.org
-Desc: Linux 2.6.32.53
-
-Patch: 1053_linux-2.6.32.54.patch
-From: http://www.kernel.org
-Desc: Linux 2.6.32.54
-
-Patch: 1054_linux-2.6.32.55.patch
-From: http://www.kernel.org
-Desc: Linux 2.6.32.55
-
-Patch: 1055_linux-2.6.32.56.patch
-From: http://www.kernel.org
-Desc: Linux 2.6.32.56
-
-Patch: 1056_linux-2.6.32.57.patch
-From: http://www.kernel.org
-Desc: Linux 2.6.32.57
-
-Patch: 1057_linux-2.6.32.58.patch
-From: http://www.kernel.org
-Desc: Linux 2.6.32.58
-
-Patch: 1058_linux-2.6.32.59.patch
-From: http://www.kernel.org
-Desc: Linux 2.6.32.59
-
-Patch: 1059_linux-2.6.32.60.patch
-From: http://www.kernel.org
-Desc: Linux 2.6.32.60
-
-Patch: 1060_linux-2.6.32.61.patch
-From: http://www.kernel.org
-Desc: Linux 2.6.32.61
-
-Patch: 4420_grsecurity-2.9.1-2.6.32.61-201312262018.patch
-From: http://www.grsecurity.net
-Desc: hardened-sources base patch from upstream grsecurity
-
-Patch: 4430_grsec-remove-localversion-grsec.patch
-From: Kerin Millar <kerframil@gmail.com>
-Desc: Removes grsecurity's localversion-grsec file
-
-Patch: 4435_grsec-mute-warnings.patch
-From: Alexander Gabert <gaberta@fh-trier.de>
- Gordon Malm <gengor@gentoo.org>
-Desc: Removes verbose compile warning settings from grsecurity, restores
- mainline Linux kernel behavior
-
-Patch: 4440_grsec-remove-protected-paths.patch
-From: Anthony G. Basile <blueness@gentoo.org>
-Desc: Removes chmod statements from grsecurity/Makefile
-
-Patch: 4450_grsec-kconfig-default-gids.patch
-From: Kerin Millar <kerframil@gmail.com>
-Desc: Sets sane(r) default GIDs on various grsecurity group-dependent
- features
-
-Patch: 4465_selinux-avc_audit-log-curr_ip.patch
-From: Gordon Malm <gengor@gentoo.org>
- Anthony G. Basile <blueness@gentoo.org>
-Desc: Configurable option to add src IP address to SELinux log messages
-
-Patch: 4470_disable-compat_vdso.patch
-From: Gordon Malm <gengor@gentoo.org>
- Kerin Millar <kerframil@gmail.com>
-Desc: Disables VDSO_COMPAT operation completely
-
-Patch: 4475_emutramp_default_on.patch
-From: Anthony G. Basile <blueness@gentoo.org>
-Desc: Set PAX_EMUTRAMP default on for libffi, bugs #329499 and #457194
-
-Patch: 4480_check_ssp_fix.patch
-From: Magnus Granberg <zorry@gentoo.org>
-Desc: Fixes kernel check script for ssp
diff --git a/2.6.32/1052_linux-2.6.32.53.patch b/2.6.32/1052_linux-2.6.32.53.patch
deleted file mode 100644
index 4e00776..0000000
--- a/2.6.32/1052_linux-2.6.32.53.patch
+++ /dev/null
@@ -1,200 +0,0 @@
-diff --git a/arch/arm/plat-mxc/pwm.c b/arch/arm/plat-mxc/pwm.c
-index 5cdbd60..1640486 100644
---- a/arch/arm/plat-mxc/pwm.c
-+++ b/arch/arm/plat-mxc/pwm.c
-@@ -31,6 +31,9 @@
- #define MX3_PWMSAR 0x0C /* PWM Sample Register */
- #define MX3_PWMPR 0x10 /* PWM Period Register */
- #define MX3_PWMCR_PRESCALER(x) (((x - 1) & 0xFFF) << 4)
-+#define MX3_PWMCR_DOZEEN (1 << 24)
-+#define MX3_PWMCR_WAITEN (1 << 23)
-+#define MX3_PWMCR_DBGEN (1 << 22)
- #define MX3_PWMCR_CLKSRC_IPG_HIGH (2 << 16)
- #define MX3_PWMCR_CLKSRC_IPG (1 << 16)
- #define MX3_PWMCR_EN (1 << 0)
-@@ -73,10 +76,21 @@ int pwm_config(struct pwm_device *pwm, int duty_ns, int period_ns)
- do_div(c, period_ns);
- duty_cycles = c;
-
-+ /*
-+ * according to imx pwm RM, the real period value should be
-+ * PERIOD value in PWMPR plus 2.
-+ */
-+ if (period_cycles > 2)
-+ period_cycles -= 2;
-+ else
-+ period_cycles = 0;
-+
- writel(duty_cycles, pwm->mmio_base + MX3_PWMSAR);
- writel(period_cycles, pwm->mmio_base + MX3_PWMPR);
-
-- cr = MX3_PWMCR_PRESCALER(prescale) | MX3_PWMCR_EN;
-+ cr = MX3_PWMCR_PRESCALER(prescale) |
-+ MX3_PWMCR_DOZEEN | MX3_PWMCR_WAITEN |
-+ MX3_PWMCR_DBGEN | MX3_PWMCR_EN;
-
- if (cpu_is_mx25())
- cr |= MX3_PWMCR_CLKSRC_IPG;
-diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
-index 1c9fba6..e5c77d8 100644
---- a/block/cfq-iosched.c
-+++ b/block/cfq-iosched.c
-@@ -1981,7 +1981,7 @@ static int cfq_cic_link(struct cfq_data *cfqd, struct io_context *ioc,
- }
- }
-
-- if (ret)
-+ if (ret && ret != -EEXIST)
- printk(KERN_ERR "cfq: cic link failed!\n");
-
- return ret;
-@@ -1997,6 +1997,7 @@ cfq_get_io_context(struct cfq_data *cfqd, gfp_t gfp_mask)
- {
- struct io_context *ioc = NULL;
- struct cfq_io_context *cic;
-+ int ret;
-
- might_sleep_if(gfp_mask & __GFP_WAIT);
-
-@@ -2004,6 +2005,7 @@ cfq_get_io_context(struct cfq_data *cfqd, gfp_t gfp_mask)
- if (!ioc)
- return NULL;
-
-+retry:
- cic = cfq_cic_lookup(cfqd, ioc);
- if (cic)
- goto out;
-@@ -2012,7 +2014,12 @@ cfq_get_io_context(struct cfq_data *cfqd, gfp_t gfp_mask)
- if (cic == NULL)
- goto err;
-
-- if (cfq_cic_link(cfqd, ioc, cic, gfp_mask))
-+ ret = cfq_cic_link(cfqd, ioc, cic, gfp_mask);
-+ if (ret == -EEXIST) {
-+ /* someone has linked cic to ioc already */
-+ cfq_cic_free(cic);
-+ goto retry;
-+ } else if (ret)
- goto err_free;
-
- out:
-diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
-index 705a589..68d800f 100644
---- a/drivers/mmc/host/mmci.c
-+++ b/drivers/mmc/host/mmci.c
-@@ -232,8 +232,12 @@ mmci_cmd_irq(struct mmci_host *host, struct mmc_command *cmd,
- }
-
- if (!cmd->data || cmd->error) {
-- if (host->data)
-+ if (host->data) {
-+ /* Terminate the DMA transfer */
-+ if (dma_inprogress(host))
-+ mmci_dma_data_error(host);
- mmci_stop_data(host);
-+ }
- mmci_request_end(host, cmd->mrq);
- } else if (!(cmd->data->flags & MMC_DATA_READ)) {
- mmci_start_data(host, cmd->data);
-diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
-index 54e716a..31be89b 100644
---- a/drivers/net/wireless/ath/ath9k/main.c
-+++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -2472,6 +2472,9 @@ static void ath9k_sta_notify(struct ieee80211_hw *hw,
- struct ath_wiphy *aphy = hw->priv;
- struct ath_softc *sc = aphy->sc;
-
-+ if (!(sc->sc_flags & SC_OP_TXAGGR))
-+ return;
-+
- switch (cmd) {
- case STA_NOTIFY_ADD:
- ath_node_attach(sc, sta);
-diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
-index cb972b6..11253d9 100644
---- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
-+++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
-@@ -3145,7 +3145,7 @@ _scsih_smart_predicted_fault(struct MPT2SAS_ADAPTER *ioc, u16 handle)
- /* insert into event log */
- sz = offsetof(Mpi2EventNotificationReply_t, EventData) +
- sizeof(Mpi2EventDataSasDeviceStatusChange_t);
-- event_reply = kzalloc(sz, GFP_KERNEL);
-+ event_reply = kzalloc(sz, GFP_ATOMIC);
- if (!event_reply) {
- printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n",
- ioc->name, __FILE__, __LINE__, __func__);
-diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
-index 0b91907..2a9f54a 100644
---- a/drivers/watchdog/hpwdt.c
-+++ b/drivers/watchdog/hpwdt.c
-@@ -220,6 +220,7 @@ static int __devinit cru_detect(unsigned long map_entry,
-
- cmn_regs.u1.reax = CRU_BIOS_SIGNATURE_VALUE;
-
-+ set_memory_x((unsigned long)bios32_entrypoint, (2 * PAGE_SIZE));
- asminline_call(&cmn_regs, bios32_entrypoint);
-
- if (cmn_regs.u1.ral != 0) {
-@@ -237,8 +238,10 @@ static int __devinit cru_detect(unsigned long map_entry,
- if ((physical_bios_base + physical_bios_offset)) {
- cru_rom_addr =
- ioremap(cru_physical_address, cru_length);
-- if (cru_rom_addr)
-+ if (cru_rom_addr) {
-+ set_memory_x((unsigned long)cru_rom_addr, cru_length);
- retval = 0;
-+ }
- }
-
- printk(KERN_DEBUG "hpwdt: CRU Base Address: 0x%lx\n",
-diff --git a/kernel/hung_task.c b/kernel/hung_task.c
-index d4e84174..07187ae 100644
---- a/kernel/hung_task.c
-+++ b/kernel/hung_task.c
-@@ -74,11 +74,17 @@ static void check_hung_task(struct task_struct *t, unsigned long timeout)
-
- /*
- * Ensure the task is not frozen.
-- * Also, when a freshly created task is scheduled once, changes
-- * its state to TASK_UNINTERRUPTIBLE without having ever been
-- * switched out once, it musn't be checked.
-+ * Also, skip vfork and any other user process that freezer should skip.
- */
-- if (unlikely(t->flags & PF_FROZEN || !switch_count))
-+ if (unlikely(t->flags & (PF_FROZEN | PF_FREEZER_SKIP)))
-+ return;
-+
-+ /*
-+ * When a freshly created task is scheduled once, changes its state to
-+ * TASK_UNINTERRUPTIBLE without having ever been switched out once, it
-+ * musn't be checked.
-+ */
-+ if (unlikely(!switch_count))
- return;
-
- if (switch_count != t->last_switch_count) {
-diff --git a/mm/filemap.c b/mm/filemap.c
-index 9e0826e..a1fe378 100644
---- a/mm/filemap.c
-+++ b/mm/filemap.c
-@@ -1675,7 +1675,7 @@ repeat:
- page = __page_cache_alloc(gfp | __GFP_COLD);
- if (!page)
- return ERR_PTR(-ENOMEM);
-- err = add_to_page_cache_lru(page, mapping, index, GFP_KERNEL);
-+ err = add_to_page_cache_lru(page, mapping, index, gfp);
- if (unlikely(err)) {
- page_cache_release(page);
- if (err == -EEXIST)
-@@ -1772,10 +1772,7 @@ static struct page *wait_on_page_read(struct page *page)
- * @gfp: the page allocator flags to use if allocating
- *
- * This is the same as "read_mapping_page(mapping, index, NULL)", but with
-- * any new page allocations done using the specified allocation flags. Note
-- * that the Radix tree operations will still use GFP_KERNEL, so you can't
-- * expect to do this atomically or anything like that - but you can pass in
-- * other page requirements.
-+ * any new page allocations done using the specified allocation flags.
- *
- * If the page does not get brought uptodate, return -EIO.
- */
diff --git a/2.6.32/1053_linux-2.6.32.54.patch b/2.6.32/1053_linux-2.6.32.54.patch
deleted file mode 100644
index a66d8e8..0000000
--- a/2.6.32/1053_linux-2.6.32.54.patch
+++ /dev/null
@@ -1,492 +0,0 @@
-diff --git a/Documentation/HOWTO b/Documentation/HOWTO
-index 8495fc9..cb0863e 100644
---- a/Documentation/HOWTO
-+++ b/Documentation/HOWTO
-@@ -275,8 +275,8 @@ versions.
- If no 2.6.x.y kernel is available, then the highest numbered 2.6.x
- kernel is the current stable kernel.
-
--2.6.x.y are maintained by the "stable" team <stable@kernel.org>, and are
--released as needs dictate. The normal release period is approximately
-+2.6.x.y are maintained by the "stable" team <stable@vger.kernel.org>, and
-+are released as needs dictate. The normal release period is approximately
- two weeks, but it can be longer if there are no pressing problems. A
- security-related problem, instead, can cause a release to happen almost
- instantly.
-diff --git a/Documentation/development-process/5.Posting b/Documentation/development-process/5.Posting
-index f622c1e..73c36ac 100644
---- a/Documentation/development-process/5.Posting
-+++ b/Documentation/development-process/5.Posting
-@@ -267,10 +267,10 @@ copies should go to:
- the linux-kernel list.
-
- - If you are fixing a bug, think about whether the fix should go into the
-- next stable update. If so, stable@kernel.org should get a copy of the
-- patch. Also add a "Cc: stable@kernel.org" to the tags within the patch
-- itself; that will cause the stable team to get a notification when your
-- fix goes into the mainline.
-+ next stable update. If so, stable@vger.kernel.org should get a copy of
-+ the patch. Also add a "Cc: stable@vger.kernel.org" to the tags within
-+ the patch itself; that will cause the stable team to get a notification
-+ when your fix goes into the mainline.
-
- When selecting recipients for a patch, it is good to have an idea of who
- you think will eventually accept the patch and get it merged. While it
-diff --git a/Documentation/usb/usbmon.txt b/Documentation/usb/usbmon.txt
-index 66f92d1..40818ff 100644
---- a/Documentation/usb/usbmon.txt
-+++ b/Documentation/usb/usbmon.txt
-@@ -43,10 +43,11 @@ This allows to filter away annoying devices that talk continuously.
-
- 2. Find which bus connects to the desired device
-
--Run "cat /proc/bus/usb/devices", and find the T-line which corresponds to
--the device. Usually you do it by looking for the vendor string. If you have
--many similar devices, unplug one and compare two /proc/bus/usb/devices outputs.
--The T-line will have a bus number. Example:
-+Run "cat /sys/kernel/debug/usb/devices", and find the T-line which corresponds
-+to the device. Usually you do it by looking for the vendor string. If you have
-+many similar devices, unplug one and compare the two
-+/sys/kernel/debug/usb/devices outputs. The T-line will have a bus number.
-+Example:
-
- T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0
- D: Ver= 1.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1
-@@ -54,7 +55,10 @@ P: Vendor=0557 ProdID=2004 Rev= 1.00
- S: Manufacturer=ATEN
- S: Product=UC100KM V2.00
-
--Bus=03 means it's bus 3.
-+"Bus=03" means it's bus 3. Alternatively, you can look at the output from
-+"lsusb" and get the bus number from the appropriate line. Example:
-+
-+Bus 003 Device 002: ID 0557:2004 ATEN UC100KM V2.00
-
- 3. Start 'cat'
-
-diff --git a/MAINTAINERS b/MAINTAINERS
-index ea3302f..613da5d 100644
---- a/MAINTAINERS
-+++ b/MAINTAINERS
-@@ -5010,7 +5010,7 @@ F: arch/alpha/kernel/srm_env.c
-
- STABLE BRANCH
- M: Greg Kroah-Hartman <greg@kroah.com>
--L: stable@kernel.org
-+L: stable@vger.kernel.org
- S: Maintained
-
- STAGING SUBSYSTEM
-diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
-index e0e6570..f6872f9 100644
---- a/drivers/base/firmware_class.c
-+++ b/drivers/base/firmware_class.c
-@@ -161,13 +161,13 @@ static ssize_t firmware_loading_store(struct device *dev,
- int loading = simple_strtol(buf, NULL, 10);
- int i;
-
-+ mutex_lock(&fw_lock);
-+
-+ if (!fw_priv->fw)
-+ goto out;
-+
- switch (loading) {
- case 1:
-- mutex_lock(&fw_lock);
-- if (!fw_priv->fw) {
-- mutex_unlock(&fw_lock);
-- break;
-- }
- firmware_free_data(fw_priv->fw);
- memset(fw_priv->fw, 0, sizeof(struct firmware));
- /* If the pages are not owned by 'struct firmware' */
-@@ -178,7 +178,6 @@ static ssize_t firmware_loading_store(struct device *dev,
- fw_priv->page_array_size = 0;
- fw_priv->nr_pages = 0;
- set_bit(FW_STATUS_LOADING, &fw_priv->status);
-- mutex_unlock(&fw_lock);
- break;
- case 0:
- if (test_bit(FW_STATUS_LOADING, &fw_priv->status)) {
-@@ -209,7 +208,8 @@ static ssize_t firmware_loading_store(struct device *dev,
- fw_load_abort(fw_priv);
- break;
- }
--
-+out:
-+ mutex_unlock(&fw_lock);
- return count;
- }
-
-diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
-index 73123486..e794b39 100644
---- a/drivers/net/usb/asix.c
-+++ b/drivers/net/usb/asix.c
-@@ -339,7 +339,7 @@ static int asix_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
-
- skb_pull(skb, (size + 1) & 0xfffe);
-
-- if (skb->len == 0)
-+ if (skb->len < sizeof(header))
- break;
-
- head = (u8 *) skb->data;
-@@ -1522,6 +1522,10 @@ static const struct usb_device_id products [] = {
- // ASIX 88772a
- USB_DEVICE(0x0db0, 0xa877),
- .driver_info = (unsigned long) &ax88772_info,
-+}, {
-+ // Asus USB Ethernet Adapter
-+ USB_DEVICE (0x0b95, 0x7e2b),
-+ .driver_info = (unsigned long) &ax88772_info,
- },
- { }, // END
- };
-diff --git a/drivers/scsi/device_handler/scsi_dh.c b/drivers/scsi/device_handler/scsi_dh.c
-index bfec4fa..2d04d61 100644
---- a/drivers/scsi/device_handler/scsi_dh.c
-+++ b/drivers/scsi/device_handler/scsi_dh.c
-@@ -432,7 +432,12 @@ int scsi_dh_activate(struct request_queue *q)
-
- spin_lock_irqsave(q->queue_lock, flags);
- sdev = q->queuedata;
-- if (sdev && sdev->scsi_dh_data)
-+ if (!sdev) {
-+ spin_unlock_irqrestore(q->queue_lock, flags);
-+ return SCSI_DH_NOSYS;
-+ }
-+
-+ if (sdev->scsi_dh_data)
- scsi_dh = sdev->scsi_dh_data->scsi_dh;
- if (!scsi_dh || !get_device(&sdev->sdev_gendev))
- err = SCSI_DH_NOSYS;
-diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
-index cec9bff..653f853 100644
---- a/drivers/usb/class/cdc-acm.c
-+++ b/drivers/usb/class/cdc-acm.c
-@@ -1264,6 +1264,8 @@ made_compressed_probe:
- i = device_create_file(&intf->dev, &dev_attr_wCountryCodes);
- if (i < 0) {
- kfree(acm->country_codes);
-+ acm->country_codes = NULL;
-+ acm->country_code_size = 0;
- goto skip_countries;
- }
-
-@@ -1272,6 +1274,8 @@ made_compressed_probe:
- if (i < 0) {
- device_remove_file(&intf->dev, &dev_attr_wCountryCodes);
- kfree(acm->country_codes);
-+ acm->country_codes = NULL;
-+ acm->country_code_size = 0;
- goto skip_countries;
- }
- }
-diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
-index e163df9..4923702 100644
---- a/drivers/usb/core/quirks.c
-+++ b/drivers/usb/core/quirks.c
-@@ -114,9 +114,12 @@ static const struct usb_device_id usb_quirk_list[] = {
- { USB_DEVICE(0x06a3, 0x0006), .driver_info =
- USB_QUIRK_CONFIG_INTF_STRINGS },
-
-- /* Guillemot Webcam Hercules Dualpix Exchange*/
-+ /* Guillemot Webcam Hercules Dualpix Exchange (2nd ID) */
- { USB_DEVICE(0x06f8, 0x0804), .driver_info = USB_QUIRK_RESET_RESUME },
-
-+ /* Guillemot Webcam Hercules Dualpix Exchange*/
-+ { USB_DEVICE(0x06f8, 0x3005), .driver_info = USB_QUIRK_RESET_RESUME },
-+
- /* M-Systems Flash Disk Pioneers */
- { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
-
-diff --git a/drivers/usb/misc/isight_firmware.c b/drivers/usb/misc/isight_firmware.c
-index b897f65..6199f12 100644
---- a/drivers/usb/misc/isight_firmware.c
-+++ b/drivers/usb/misc/isight_firmware.c
-@@ -54,8 +54,9 @@ static int isight_firmware_load(struct usb_interface *intf,
-
- ptr = firmware->data;
-
-+ buf[0] = 0x01;
- if (usb_control_msg
-- (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, "\1", 1,
-+ (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, buf, 1,
- 300) != 1) {
- printk(KERN_ERR
- "Failed to initialise isight firmware loader\n");
-@@ -99,8 +100,9 @@ static int isight_firmware_load(struct usb_interface *intf,
- }
- }
-
-+ buf[0] = 0x00;
- if (usb_control_msg
-- (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, "\0", 1,
-+ (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, buf, 1,
- 300) != 1) {
- printk(KERN_ERR "isight firmware loading completion failed\n");
- ret = -ENODEV;
-diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
-index f77908b..8dcaf42 100644
---- a/drivers/usb/serial/cp210x.c
-+++ b/drivers/usb/serial/cp210x.c
-@@ -94,6 +94,7 @@ static struct usb_device_id id_table [] = {
- { USB_DEVICE(0x10C4, 0x818B) }, /* AVIT Research USB to TTL */
- { USB_DEVICE(0x10C4, 0x819F) }, /* MJS USB Toslink Switcher */
- { USB_DEVICE(0x10C4, 0x81A6) }, /* ThinkOptics WavIt */
-+ { USB_DEVICE(0x10C4, 0x81A9) }, /* Multiplex RC Interface */
- { USB_DEVICE(0x10C4, 0x81AC) }, /* MSD Dash Hawk */
- { USB_DEVICE(0x10C4, 0x81AD) }, /* INSYS USB Modem */
- { USB_DEVICE(0x10C4, 0x81C8) }, /* Lipowsky Industrie Elektronik GmbH, Baby-JTAG */
-diff --git a/drivers/usb/serial/omninet.c b/drivers/usb/serial/omninet.c
-index 0622650..c116bd9 100644
---- a/drivers/usb/serial/omninet.c
-+++ b/drivers/usb/serial/omninet.c
-@@ -317,7 +317,7 @@ static int omninet_write_room(struct tty_struct *tty)
- int room = 0; /* Default: no room */
-
- /* FIXME: no consistent locking for write_urb_busy */
-- if (wport->write_urb_busy)
-+ if (!wport->write_urb_busy)
- room = wport->bulk_out_size - OMNINET_HEADERLEN;
-
- dbg("%s - returns %d", __func__, room);
-diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
-index 33197fa..6ce1095 100644
---- a/drivers/usb/storage/usb.c
-+++ b/drivers/usb/storage/usb.c
-@@ -1025,6 +1025,7 @@ static struct usb_driver usb_storage_driver = {
- .post_reset = usb_stor_post_reset,
- .id_table = usb_storage_usb_ids,
- .soft_unbind = 1,
-+ .no_dynamic_id = 1,
- };
-
- static int __init usb_stor_init(void)
-diff --git a/drivers/video/offb.c b/drivers/video/offb.c
-index b043ac8..dbc8274 100644
---- a/drivers/video/offb.c
-+++ b/drivers/video/offb.c
-@@ -100,36 +100,32 @@ static int offb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
- u_int transp, struct fb_info *info)
- {
- struct offb_par *par = (struct offb_par *) info->par;
-- int i, depth;
-- u32 *pal = info->pseudo_palette;
--
-- depth = info->var.bits_per_pixel;
-- if (depth == 16)
-- depth = (info->var.green.length == 5) ? 15 : 16;
--
-- if (regno > 255 ||
-- (depth == 16 && regno > 63) ||
-- (depth == 15 && regno > 31))
-- return 1;
--
-- if (regno < 16) {
-- switch (depth) {
-- case 15:
-- pal[regno] = (regno << 10) | (regno << 5) | regno;
-- break;
-- case 16:
-- pal[regno] = (regno << 11) | (regno << 5) | regno;
-- break;
-- case 24:
-- pal[regno] = (regno << 16) | (regno << 8) | regno;
-- break;
-- case 32:
-- i = (regno << 8) | regno;
-- pal[regno] = (i << 16) | i;
-- break;
-+
-+ if (info->fix.visual == FB_VISUAL_TRUECOLOR) {
-+ u32 *pal = info->pseudo_palette;
-+ u32 cr = red >> (16 - info->var.red.length);
-+ u32 cg = green >> (16 - info->var.green.length);
-+ u32 cb = blue >> (16 - info->var.blue.length);
-+ u32 value;
-+
-+ if (regno >= 16)
-+ return -EINVAL;
-+
-+ value = (cr << info->var.red.offset) |
-+ (cg << info->var.green.offset) |
-+ (cb << info->var.blue.offset);
-+ if (info->var.transp.length > 0) {
-+ u32 mask = (1 << info->var.transp.length) - 1;
-+ mask <<= info->var.transp.offset;
-+ value |= mask;
- }
-+ pal[regno] = value;
-+ return 0;
- }
-
-+ if (regno > 255)
-+ return -EINVAL;
-+
- red >>= 8;
- green >>= 8;
- blue >>= 8;
-@@ -381,7 +377,7 @@ static void __init offb_init_fb(const char *name, const char *full_name,
- int pitch, unsigned long address,
- int foreign_endian, struct device_node *dp)
- {
-- unsigned long res_size = pitch * height * (depth + 7) / 8;
-+ unsigned long res_size = pitch * height;
- struct offb_par *par = &default_par;
- unsigned long res_start = address;
- struct fb_fix_screeninfo *fix;
-diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
-index f0ad05f..7cb1285 100644
---- a/fs/reiserfs/super.c
-+++ b/fs/reiserfs/super.c
-@@ -445,16 +445,20 @@ int remove_save_link(struct inode *inode, int truncate)
- static void reiserfs_kill_sb(struct super_block *s)
- {
- if (REISERFS_SB(s)) {
-- if (REISERFS_SB(s)->xattr_root) {
-- d_invalidate(REISERFS_SB(s)->xattr_root);
-- dput(REISERFS_SB(s)->xattr_root);
-- REISERFS_SB(s)->xattr_root = NULL;
-- }
-- if (REISERFS_SB(s)->priv_root) {
-- d_invalidate(REISERFS_SB(s)->priv_root);
-- dput(REISERFS_SB(s)->priv_root);
-- REISERFS_SB(s)->priv_root = NULL;
-- }
-+ /*
-+ * Force any pending inode evictions to occur now. Any
-+ * inodes to be removed that have extended attributes
-+ * associated with them need to clean them up before
-+ * we can release the extended attribute root dentries.
-+ * shrink_dcache_for_umount will BUG if we don't release
-+ * those before it's called so ->put_super is too late.
-+ */
-+ shrink_dcache_sb(s);
-+
-+ dput(REISERFS_SB(s)->xattr_root);
-+ REISERFS_SB(s)->xattr_root = NULL;
-+ dput(REISERFS_SB(s)->priv_root);
-+ REISERFS_SB(s)->priv_root = NULL;
- }
-
- kill_block_super(s);
-@@ -1149,7 +1153,8 @@ static void handle_quota_files(struct super_block *s, char **qf_names,
- kfree(REISERFS_SB(s)->s_qf_names[i]);
- REISERFS_SB(s)->s_qf_names[i] = qf_names[i];
- }
-- REISERFS_SB(s)->s_jquota_fmt = *qfmt;
-+ if (*qfmt)
-+ REISERFS_SB(s)->s_jquota_fmt = *qfmt;
- }
- #endif
-
-diff --git a/fs/xfs/linux-2.6/xfs_acl.c b/fs/xfs/linux-2.6/xfs_acl.c
-index 4c7b145..ad60d61 100644
---- a/fs/xfs/linux-2.6/xfs_acl.c
-+++ b/fs/xfs/linux-2.6/xfs_acl.c
-@@ -37,9 +37,11 @@ xfs_acl_from_disk(struct xfs_acl *aclp)
- struct posix_acl_entry *acl_e;
- struct posix_acl *acl;
- struct xfs_acl_entry *ace;
-- int count, i;
-+ unsigned int count, i;
-
- count = be32_to_cpu(aclp->acl_cnt);
-+ if (count > XFS_ACL_MAX_ENTRIES)
-+ return ERR_PTR(-EFSCORRUPTED);
-
- acl = posix_acl_alloc(count, GFP_KERNEL);
- if (!acl)
-diff --git a/kernel/cpu.c b/kernel/cpu.c
-index 7e8b6ac..3f2f04f 100644
---- a/kernel/cpu.c
-+++ b/kernel/cpu.c
-@@ -14,6 +14,7 @@
- #include <linux/kthread.h>
- #include <linux/stop_machine.h>
- #include <linux/mutex.h>
-+#include <linux/suspend.h>
-
- #ifdef CONFIG_SMP
- /* Serializes the updates to cpu_online_mask, cpu_present_mask */
-@@ -442,6 +443,79 @@ static int alloc_frozen_cpus(void)
- return 0;
- }
- core_initcall(alloc_frozen_cpus);
-+
-+/*
-+ * Prevent regular CPU hotplug from racing with the freezer, by disabling CPU
-+ * hotplug when tasks are about to be frozen. Also, don't allow the freezer
-+ * to continue until any currently running CPU hotplug operation gets
-+ * completed.
-+ * To modify the 'cpu_hotplug_disabled' flag, we need to acquire the
-+ * 'cpu_add_remove_lock'. And this same lock is also taken by the regular
-+ * CPU hotplug path and released only after it is complete. Thus, we
-+ * (and hence the freezer) will block here until any currently running CPU
-+ * hotplug operation gets completed.
-+ */
-+void cpu_hotplug_disable_before_freeze(void)
-+{
-+ cpu_maps_update_begin();
-+ cpu_hotplug_disabled = 1;
-+ cpu_maps_update_done();
-+}
-+
-+
-+/*
-+ * When tasks have been thawed, re-enable regular CPU hotplug (which had been
-+ * disabled while beginning to freeze tasks).
-+ */
-+void cpu_hotplug_enable_after_thaw(void)
-+{
-+ cpu_maps_update_begin();
-+ cpu_hotplug_disabled = 0;
-+ cpu_maps_update_done();
-+}
-+
-+/*
-+ * When callbacks for CPU hotplug notifications are being executed, we must
-+ * ensure that the state of the system with respect to the tasks being frozen
-+ * or not, as reported by the notification, remains unchanged *throughout the
-+ * duration* of the execution of the callbacks.
-+ * Hence we need to prevent the freezer from racing with regular CPU hotplug.
-+ *
-+ * This synchronization is implemented by mutually excluding regular CPU
-+ * hotplug and Suspend/Hibernate call paths by hooking onto the Suspend/
-+ * Hibernate notifications.
-+ */
-+static int
-+cpu_hotplug_pm_callback(struct notifier_block *nb,
-+ unsigned long action, void *ptr)
-+{
-+ switch (action) {
-+
-+ case PM_SUSPEND_PREPARE:
-+ case PM_HIBERNATION_PREPARE:
-+ cpu_hotplug_disable_before_freeze();
-+ break;
-+
-+ case PM_POST_SUSPEND:
-+ case PM_POST_HIBERNATION:
-+ cpu_hotplug_enable_after_thaw();
-+ break;
-+
-+ default:
-+ return NOTIFY_DONE;
-+ }
-+
-+ return NOTIFY_OK;
-+}
-+
-+
-+int cpu_hotplug_pm_sync_init(void)
-+{
-+ pm_notifier(cpu_hotplug_pm_callback, 0);
-+ return 0;
-+}
-+core_initcall(cpu_hotplug_pm_sync_init);
-+
- #endif /* CONFIG_PM_SLEEP_SMP */
-
- /**
diff --git a/2.6.32/1054_linux-2.6.32.55.patch b/2.6.32/1054_linux-2.6.32.55.patch
deleted file mode 100644
index 1831a06..0000000
--- a/2.6.32/1054_linux-2.6.32.55.patch
+++ /dev/null
@@ -1,931 +0,0 @@
-diff --git a/arch/score/kernel/entry.S b/arch/score/kernel/entry.S
-index 577abba..83bb960 100644
---- a/arch/score/kernel/entry.S
-+++ b/arch/score/kernel/entry.S
-@@ -408,7 +408,7 @@ ENTRY(handle_sys)
- sw r9, [r0, PT_EPC]
-
- cmpi.c r27, __NR_syscalls # check syscall number
-- bgtu illegal_syscall
-+ bgeu illegal_syscall
-
- slli r8, r27, 2 # get syscall routine
- la r11, sys_call_table
-diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
-index c8191de..c9e57af 100644
---- a/arch/x86/mm/mmap.c
-+++ b/arch/x86/mm/mmap.c
-@@ -87,9 +87,9 @@ static unsigned long mmap_rnd(void)
- */
- if (current->flags & PF_RANDOMIZE) {
- if (mmap_is_ia32())
-- rnd = (long)get_random_int() % (1<<8);
-+ rnd = get_random_int() % (1<<8);
- else
-- rnd = (long)(get_random_int() % (1<<28));
-+ rnd = get_random_int() % (1<<28);
- }
- return rnd << PAGE_SHIFT;
- }
-diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
-index 1d5a780..114ee29 100644
---- a/block/scsi_ioctl.c
-+++ b/block/scsi_ioctl.c
-@@ -689,6 +689,13 @@ int scsi_cmd_ioctl(struct request_queue *q, struct gendisk *bd_disk, fmode_t mod
- }
- EXPORT_SYMBOL(scsi_cmd_ioctl);
-
-+int scsi_cmd_blk_ioctl(struct block_device *bd, fmode_t mode,
-+ unsigned int cmd, void __user *arg)
-+{
-+ return scsi_cmd_ioctl(bd->bd_disk->queue, bd->bd_disk, mode, cmd, arg);
-+}
-+EXPORT_SYMBOL(scsi_cmd_blk_ioctl);
-+
- int __init blk_scsi_ioctl_init(void)
- {
- blk_set_cmd_filter_defaults(&blk_default_cmd_filter);
-diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
-index ca9c548..68b90d9 100644
---- a/drivers/block/cciss.c
-+++ b/drivers/block/cciss.c
-@@ -1583,7 +1583,7 @@ static int cciss_ioctl(struct block_device *bdev, fmode_t mode,
- return status;
- }
-
-- /* scsi_cmd_ioctl handles these, below, though some are not */
-+ /* scsi_cmd_blk_ioctl handles these, below, though some are not */
- /* very meaningful for cciss. SG_IO is the main one people want. */
-
- case SG_GET_VERSION_NUM:
-@@ -1594,9 +1594,9 @@ static int cciss_ioctl(struct block_device *bdev, fmode_t mode,
- case SG_EMULATED_HOST:
- case SG_IO:
- case SCSI_IOCTL_SEND_COMMAND:
-- return scsi_cmd_ioctl(disk->queue, disk, mode, cmd, argp);
-+ return scsi_cmd_blk_ioctl(bdev, mode, cmd, argp);
-
-- /* scsi_cmd_ioctl would normally handle these, below, but */
-+ /* scsi_cmd_blk_ioctl would normally handle these, below, but */
- /* they aren't a good fit for cciss, as CD-ROMs are */
- /* not supported, and we don't have any bus/target/lun */
- /* which we present to the kernel. */
-diff --git a/drivers/block/ub.c b/drivers/block/ub.c
-index c739b20..c6ac1b2 100644
---- a/drivers/block/ub.c
-+++ b/drivers/block/ub.c
-@@ -1726,10 +1726,9 @@ static int ub_bd_release(struct gendisk *disk, fmode_t mode)
- static int ub_bd_ioctl(struct block_device *bdev, fmode_t mode,
- unsigned int cmd, unsigned long arg)
- {
-- struct gendisk *disk = bdev->bd_disk;
- void __user *usermem = (void __user *) arg;
-
-- return scsi_cmd_ioctl(disk->queue, disk, mode, cmd, usermem);
-+ return scsi_cmd_blk_ioctl(bdev, mode, cmd, usermem);
- }
-
- /*
-diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
-index 51042f0ba7..44d019b 100644
---- a/drivers/block/virtio_blk.c
-+++ b/drivers/block/virtio_blk.c
-@@ -200,8 +200,8 @@ static int virtblk_ioctl(struct block_device *bdev, fmode_t mode,
- if (!virtio_has_feature(vblk->vdev, VIRTIO_BLK_F_SCSI))
- return -ENOTTY;
-
-- return scsi_cmd_ioctl(disk->queue, disk, mode, cmd,
-- (void __user *)data);
-+ return scsi_cmd_blk_ioctl(bdev, mode, cmd,
-+ (void __user *)data);
- }
-
- /* We provide getgeo only to please some old bootloader/partitioning tools */
-diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
-index 614da5b..59cccc9 100644
---- a/drivers/cdrom/cdrom.c
-+++ b/drivers/cdrom/cdrom.c
-@@ -2684,12 +2684,11 @@ int cdrom_ioctl(struct cdrom_device_info *cdi, struct block_device *bdev,
- {
- void __user *argp = (void __user *)arg;
- int ret;
-- struct gendisk *disk = bdev->bd_disk;
-
- /*
- * Try the generic SCSI command ioctl's first.
- */
-- ret = scsi_cmd_ioctl(disk->queue, disk, mode, cmd, argp);
-+ ret = scsi_cmd_blk_ioctl(bdev, mode, cmd, argp);
- if (ret != -ENOTTY)
- return ret;
-
-diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
-index f3f1415..11f8069 100644
---- a/drivers/hid/hid-core.c
-+++ b/drivers/hid/hid-core.c
-@@ -350,7 +350,7 @@ static int hid_parser_global(struct hid_parser *parser, struct hid_item *item)
-
- case HID_GLOBAL_ITEM_TAG_REPORT_SIZE:
- parser->global.report_size = item_udata(item);
-- if (parser->global.report_size > 32) {
-+ if (parser->global.report_size > 96) {
- dbg_hid("invalid report_size %d\n",
- parser->global.report_size);
- return -1;
-diff --git a/drivers/i2c/busses/i2c-ali1535.c b/drivers/i2c/busses/i2c-ali1535.c
-index d108450..3f8f63f 100644
---- a/drivers/i2c/busses/i2c-ali1535.c
-+++ b/drivers/i2c/busses/i2c-ali1535.c
-@@ -140,7 +140,7 @@ static unsigned short ali1535_smba;
- defined to make the transition easier. */
- static int ali1535_setup(struct pci_dev *dev)
- {
-- int retval = -ENODEV;
-+ int retval;
- unsigned char temp;
-
- /* Check the following things:
-@@ -155,6 +155,7 @@ static int ali1535_setup(struct pci_dev *dev)
- if (ali1535_smba == 0) {
- dev_warn(&dev->dev,
- "ALI1535_smb region uninitialized - upgrade BIOS?\n");
-+ retval = -ENODEV;
- goto exit;
- }
-
-@@ -167,6 +168,7 @@ static int ali1535_setup(struct pci_dev *dev)
- ali1535_driver.name)) {
- dev_err(&dev->dev, "ALI1535_smb region 0x%x already in use!\n",
- ali1535_smba);
-+ retval = -EBUSY;
- goto exit;
- }
-
-@@ -174,6 +176,7 @@ static int ali1535_setup(struct pci_dev *dev)
- pci_read_config_byte(dev, SMBCFG, &temp);
- if ((temp & ALI1535_SMBIO_EN) == 0) {
- dev_err(&dev->dev, "SMB device not enabled - upgrade BIOS?\n");
-+ retval = -ENODEV;
- goto exit_free;
- }
-
-@@ -181,6 +184,7 @@ static int ali1535_setup(struct pci_dev *dev)
- pci_read_config_byte(dev, SMBHSTCFG, &temp);
- if ((temp & 1) == 0) {
- dev_err(&dev->dev, "SMBus controller not enabled - upgrade BIOS?\n");
-+ retval = -ENODEV;
- goto exit_free;
- }
-
-@@ -198,12 +202,11 @@ static int ali1535_setup(struct pci_dev *dev)
- dev_dbg(&dev->dev, "SMBREV = 0x%X\n", temp);
- dev_dbg(&dev->dev, "ALI1535_smba = 0x%X\n", ali1535_smba);
-
-- retval = 0;
--exit:
-- return retval;
-+ return 0;
-
- exit_free:
- release_region(ali1535_smba, ALI1535_SMB_IOSIZE);
-+exit:
- return retval;
- }
-
-diff --git a/drivers/i2c/busses/i2c-nforce2.c b/drivers/i2c/busses/i2c-nforce2.c
-index ec11d1c..e90b0eb 100644
---- a/drivers/i2c/busses/i2c-nforce2.c
-+++ b/drivers/i2c/busses/i2c-nforce2.c
-@@ -355,7 +355,7 @@ static int __devinit nforce2_probe_smb (struct pci_dev *dev, int bar,
- error = acpi_check_region(smbus->base, smbus->size,
- nforce2_driver.name);
- if (error)
-- return -1;
-+ return error;
-
- if (!request_region(smbus->base, smbus->size, nforce2_driver.name)) {
- dev_err(&smbus->adapter.dev, "Error requesting region %02x .. %02X for %s\n",
-diff --git a/drivers/i2c/busses/i2c-sis5595.c b/drivers/i2c/busses/i2c-sis5595.c
-index 139f0c7..29256b3 100644
---- a/drivers/i2c/busses/i2c-sis5595.c
-+++ b/drivers/i2c/busses/i2c-sis5595.c
-@@ -147,7 +147,7 @@ static int sis5595_setup(struct pci_dev *SIS5595_dev)
- u16 a;
- u8 val;
- int *i;
-- int retval = -ENODEV;
-+ int retval;
-
- /* Look for imposters */
- for (i = blacklist; *i != 0; i++) {
-@@ -223,7 +223,7 @@ static int sis5595_setup(struct pci_dev *SIS5595_dev)
-
- error:
- release_region(sis5595_base + SMB_INDEX, 2);
-- return retval;
-+ return -ENODEV;
- }
-
- static int sis5595_transaction(struct i2c_adapter *adap)
-diff --git a/drivers/i2c/busses/i2c-sis630.c b/drivers/i2c/busses/i2c-sis630.c
-index 70ca41e..e2d9fc1 100644
---- a/drivers/i2c/busses/i2c-sis630.c
-+++ b/drivers/i2c/busses/i2c-sis630.c
-@@ -393,7 +393,7 @@ static int sis630_setup(struct pci_dev *sis630_dev)
- {
- unsigned char b;
- struct pci_dev *dummy = NULL;
-- int retval = -ENODEV, i;
-+ int retval, i;
-
- /* check for supported SiS devices */
- for (i=0; supported[i] > 0 ; i++) {
-@@ -418,18 +418,21 @@ static int sis630_setup(struct pci_dev *sis630_dev)
- */
- if (pci_read_config_byte(sis630_dev, SIS630_BIOS_CTL_REG,&b)) {
- dev_err(&sis630_dev->dev, "Error: Can't read bios ctl reg\n");
-+ retval = -ENODEV;
- goto exit;
- }
- /* if ACPI already enabled , do nothing */
- if (!(b & 0x80) &&
- pci_write_config_byte(sis630_dev, SIS630_BIOS_CTL_REG, b | 0x80)) {
- dev_err(&sis630_dev->dev, "Error: Can't enable ACPI\n");
-+ retval = -ENODEV;
- goto exit;
- }
-
- /* Determine the ACPI base address */
- if (pci_read_config_word(sis630_dev,SIS630_ACPI_BASE_REG,&acpi_base)) {
- dev_err(&sis630_dev->dev, "Error: Can't determine ACPI base address\n");
-+ retval = -ENODEV;
- goto exit;
- }
-
-@@ -445,6 +448,7 @@ static int sis630_setup(struct pci_dev *sis630_dev)
- sis630_driver.name)) {
- dev_err(&sis630_dev->dev, "SMBus registers 0x%04x-0x%04x already "
- "in use!\n", acpi_base + SMB_STS, acpi_base + SMB_SAA);
-+ retval = -EBUSY;
- goto exit;
- }
-
-diff --git a/drivers/i2c/busses/i2c-viapro.c b/drivers/i2c/busses/i2c-viapro.c
-index e4b1543..067757b 100644
---- a/drivers/i2c/busses/i2c-viapro.c
-+++ b/drivers/i2c/busses/i2c-viapro.c
-@@ -330,7 +330,7 @@ static int __devinit vt596_probe(struct pci_dev *pdev,
- const struct pci_device_id *id)
- {
- unsigned char temp;
-- int error = -ENODEV;
-+ int error;
-
- /* Determine the address of the SMBus areas */
- if (force_addr) {
-@@ -396,6 +396,7 @@ found:
- dev_err(&pdev->dev, "SMBUS: Error: Host SMBus "
- "controller not enabled! - upgrade BIOS or "
- "use force=1\n");
-+ error = -ENODEV;
- goto release_region;
- }
- }
-@@ -428,9 +429,11 @@ found:
- "SMBus Via Pro adapter at %04x", vt596_smba);
-
- vt596_pdev = pci_dev_get(pdev);
-- if (i2c_add_adapter(&vt596_adapter)) {
-+ error = i2c_add_adapter(&vt596_adapter);
-+ if (error) {
- pci_dev_put(vt596_pdev);
- vt596_pdev = NULL;
-+ goto release_region;
- }
-
- /* Always return failure here. This is to allow other drivers to bind
-diff --git a/drivers/ide/ide-floppy_ioctl.c b/drivers/ide/ide-floppy_ioctl.c
-index 9c22882..05f024c 100644
---- a/drivers/ide/ide-floppy_ioctl.c
-+++ b/drivers/ide/ide-floppy_ioctl.c
-@@ -287,8 +287,7 @@ int ide_floppy_ioctl(ide_drive_t *drive, struct block_device *bdev,
- * and CDROM_SEND_PACKET (legacy) ioctls
- */
- if (cmd != CDROM_SEND_PACKET && cmd != SCSI_IOCTL_SEND_COMMAND)
-- err = scsi_cmd_ioctl(bdev->bd_disk->queue, bdev->bd_disk,
-- mode, cmd, argp);
-+ err = scsi_cmd_blk_ioctl(bdev, mode, cmd, argp);
-
- if (err == -ENOTTY)
- err = generic_ide_ioctl(drive, bdev, cmd, arg);
-diff --git a/drivers/media/video/v4l2-ioctl.c b/drivers/media/video/v4l2-ioctl.c
-index 265bfb5..d7332c7 100644
---- a/drivers/media/video/v4l2-ioctl.c
-+++ b/drivers/media/video/v4l2-ioctl.c
-@@ -414,6 +414,9 @@ video_usercopy(struct file *file, unsigned int cmd, unsigned long arg,
- p->error_idx = p->count;
- user_ptr = (void __user *)p->controls;
- if (p->count) {
-+ err = -EINVAL;
-+ if (p->count > V4L2_CID_MAX_CTRLS)
-+ goto out_ext_ctrl;
- ctrls_size = sizeof(struct v4l2_ext_control) * p->count;
- /* Note: v4l2_ext_controls fits in sbuf[] so mbuf is still NULL. */
- mbuf = kmalloc(ctrls_size, GFP_KERNEL);
-@@ -1912,6 +1915,9 @@ long video_ioctl2(struct file *file,
- p->error_idx = p->count;
- user_ptr = (void __user *)p->controls;
- if (p->count) {
-+ err = -EINVAL;
-+ if (p->count > V4L2_CID_MAX_CTRLS)
-+ goto out_ext_ctrl;
- ctrls_size = sizeof(struct v4l2_ext_control) * p->count;
- /* Note: v4l2_ext_controls fits in sbuf[] so mbuf is still NULL. */
- mbuf = kmalloc(ctrls_size, GFP_KERNEL);
-diff --git a/drivers/mtd/ubi/cdev.c b/drivers/mtd/ubi/cdev.c
-index 111ea41..1d11e86 100644
---- a/drivers/mtd/ubi/cdev.c
-+++ b/drivers/mtd/ubi/cdev.c
-@@ -628,6 +628,9 @@ static int verify_mkvol_req(const struct ubi_device *ubi,
- if (req->alignment != 1 && n)
- goto bad;
-
-+ if (!req->name[0] || !req->name_len)
-+ goto bad;
-+
- if (req->name_len > UBI_VOL_NAME_MAX) {
- err = -ENAMETOOLONG;
- goto bad;
-diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
-index 600c722..ca42c00 100644
---- a/drivers/mtd/ubi/wl.c
-+++ b/drivers/mtd/ubi/wl.c
-@@ -1036,7 +1036,6 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
-
- ubi_err("failed to erase PEB %d, error %d", pnum, err);
- kfree(wl_wrk);
-- kmem_cache_free(ubi_wl_entry_slab, e);
-
- if (err == -EINTR || err == -ENOMEM || err == -EAGAIN ||
- err == -EBUSY) {
-@@ -1049,14 +1048,16 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
- goto out_ro;
- }
- return err;
-- } else if (err != -EIO) {
-+ }
-+
-+ kmem_cache_free(ubi_wl_entry_slab, e);
-+ if (err != -EIO)
- /*
- * If this is not %-EIO, we have no idea what to do. Scheduling
- * this physical eraseblock for erasure again would cause
- * errors again and again. Well, lets switch to R/O mode.
- */
- goto out_ro;
-- }
-
- /* It is %-EIO, the PEB went bad */
-
-diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
-index 0fb1d05..ab05ac1 100644
---- a/drivers/pci/msi.c
-+++ b/drivers/pci/msi.c
-@@ -863,5 +863,15 @@ EXPORT_SYMBOL(pci_msi_enabled);
-
- void pci_msi_init_pci_dev(struct pci_dev *dev)
- {
-+ int pos;
- INIT_LIST_HEAD(&dev->msi_list);
-+
-+ /* Disable the msi hardware to avoid screaming interrupts
-+ * during boot. This is the power on reset default so
-+ * usually this should be a noop.
-+ */
-+ pos = pci_find_capability(dev, PCI_CAP_ID_MSI);
-+ if (pos)
-+ msi_set_enable(dev, pos, 0);
-+ msix_set_enable(dev, 0);
- }
-diff --git a/drivers/pnp/quirks.c b/drivers/pnp/quirks.c
-index 8473fe5..eb39d26 100644
---- a/drivers/pnp/quirks.c
-+++ b/drivers/pnp/quirks.c
-@@ -300,6 +300,45 @@ static void quirk_system_pci_resources(struct pnp_dev *dev)
- }
- }
-
-+#ifdef CONFIG_AMD_NB
-+
-+#include <asm/amd_nb.h>
-+
-+static void quirk_amd_mmconfig_area(struct pnp_dev *dev)
-+{
-+ resource_size_t start, end;
-+ struct pnp_resource *pnp_res;
-+ struct resource *res;
-+ struct resource mmconfig_res, *mmconfig;
-+
-+ mmconfig = amd_get_mmconfig_range(&mmconfig_res);
-+ if (!mmconfig)
-+ return;
-+
-+ list_for_each_entry(pnp_res, &dev->resources, list) {
-+ res = &pnp_res->res;
-+ if (res->end < mmconfig->start || res->start > mmconfig->end ||
-+ (res->start == mmconfig->start && res->end == mmconfig->end))
-+ continue;
-+
-+ dev_info(&dev->dev, FW_BUG
-+ "%pR covers only part of AMD MMCONFIG area %pR; adding more reservations\n",
-+ res, mmconfig);
-+ if (mmconfig->start < res->start) {
-+ start = mmconfig->start;
-+ end = res->start - 1;
-+ pnp_add_mem_resource(dev, start, end, 0);
-+ }
-+ if (mmconfig->end > res->end) {
-+ start = res->end + 1;
-+ end = mmconfig->end;
-+ pnp_add_mem_resource(dev, start, end, 0);
-+ }
-+ break;
-+ }
-+}
-+#endif
-+
- /*
- * PnP Quirks
- * Cards or devices that need some tweaking due to incomplete resource info
-@@ -327,6 +366,9 @@ static struct pnp_fixup pnp_fixups[] = {
- /* PnP resources that might overlap PCI BARs */
- {"PNP0c01", quirk_system_pci_resources},
- {"PNP0c02", quirk_system_pci_resources},
-+#ifdef CONFIG_AMD_NB
-+ {"PNP0c01", quirk_amd_mmconfig_area},
-+#endif
- {""}
- };
-
-diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
-index 568d363..2dd1b73 100644
---- a/drivers/scsi/sd.c
-+++ b/drivers/scsi/sd.c
-@@ -838,7 +838,7 @@ static int sd_ioctl(struct block_device *bdev, fmode_t mode,
- case SCSI_IOCTL_GET_BUS_NUMBER:
- return scsi_ioctl(sdp, cmd, p);
- default:
-- error = scsi_cmd_ioctl(disk->queue, disk, mode, cmd, p);
-+ error = scsi_cmd_blk_ioctl(bdev, mode, cmd, p);
- if (error != -ENOTTY)
- return error;
- }
-diff --git a/drivers/scsi/sym53c8xx_2/sym_glue.c b/drivers/scsi/sym53c8xx_2/sym_glue.c
-index 45374d6..c19ca5e 100644
---- a/drivers/scsi/sym53c8xx_2/sym_glue.c
-+++ b/drivers/scsi/sym53c8xx_2/sym_glue.c
-@@ -837,6 +837,10 @@ static void sym53c8xx_slave_destroy(struct scsi_device *sdev)
- struct sym_lcb *lp = sym_lp(tp, sdev->lun);
- unsigned long flags;
-
-+ /* if slave_alloc returned before allocating a sym_lcb, return */
-+ if (!lp)
-+ return;
-+
- spin_lock_irqsave(np->s.host->host_lock, flags);
-
- if (lp->busy_itlq || lp->busy_itl) {
-diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
-index 3e564bf..696ca75f 100644
---- a/drivers/usb/class/cdc-wdm.c
-+++ b/drivers/usb/class/cdc-wdm.c
-@@ -277,7 +277,7 @@ static void cleanup(struct wdm_device *desc)
- desc->sbuf,
- desc->validity->transfer_dma);
- usb_buffer_free(interface_to_usbdev(desc->intf),
-- desc->wMaxCommand,
-+ desc->bMaxPacketSize0,
- desc->inbuf,
- desc->response->transfer_dma);
- kfree(desc->orq);
-@@ -314,7 +314,7 @@ static ssize_t wdm_write
- if (r < 0)
- goto outnp;
-
-- if (!file->f_flags && O_NONBLOCK)
-+ if (!(file->f_flags & O_NONBLOCK))
- r = wait_event_interruptible(desc->wait, !test_bit(WDM_IN_USE,
- &desc->flags));
- else
-diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c
-index 7b547f5..54226d2 100644
---- a/drivers/xen/xenbus/xenbus_xs.c
-+++ b/drivers/xen/xenbus/xenbus_xs.c
-@@ -766,6 +766,12 @@ static int process_msg(void)
- goto out;
- }
-
-+ if (msg->hdr.len > XENSTORE_PAYLOAD_MAX) {
-+ kfree(msg);
-+ err = -EINVAL;
-+ goto out;
-+ }
-+
- body = kmalloc(msg->hdr.len + 1, GFP_NOIO | __GFP_HIGH);
- if (body == NULL) {
- kfree(msg);
-diff --git a/fs/ext4/super.c b/fs/ext4/super.c
-index f27e045..f1e7077 100644
---- a/fs/ext4/super.c
-+++ b/fs/ext4/super.c
-@@ -1705,17 +1705,16 @@ static int ext4_fill_flex_info(struct super_block *sb)
- struct ext4_group_desc *gdp = NULL;
- ext4_group_t flex_group_count;
- ext4_group_t flex_group;
-- int groups_per_flex = 0;
-+ unsigned int groups_per_flex = 0;
- size_t size;
- int i;
-
- sbi->s_log_groups_per_flex = sbi->s_es->s_log_groups_per_flex;
-- groups_per_flex = 1 << sbi->s_log_groups_per_flex;
--
-- if (groups_per_flex < 2) {
-+ if (sbi->s_log_groups_per_flex < 1 || sbi->s_log_groups_per_flex > 31) {
- sbi->s_log_groups_per_flex = 0;
- return 1;
- }
-+ groups_per_flex = 1 << sbi->s_log_groups_per_flex;
-
- /* We allocate both existing and potentially added groups */
- flex_group_count = ((sbi->s_groups_count + groups_per_flex - 1) +
-diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
-index c1c9e03..50836b1 100644
---- a/fs/nfsd/export.c
-+++ b/fs/nfsd/export.c
-@@ -106,7 +106,7 @@ static int expkey_parse(struct cache_detail *cd, char *mesg, int mlen)
- struct svc_expkey key;
- struct svc_expkey *ek = NULL;
-
-- if (mesg[mlen-1] != '\n')
-+ if (mlen < 1 || mesg[mlen-1] != '\n')
- return -EINVAL;
- mesg[mlen-1] = 0;
-
-diff --git a/fs/proc/uptime.c b/fs/proc/uptime.c
-index 766b1d4..29166ec 100644
---- a/fs/proc/uptime.c
-+++ b/fs/proc/uptime.c
-@@ -11,15 +11,20 @@ static int uptime_proc_show(struct seq_file *m, void *v)
- {
- struct timespec uptime;
- struct timespec idle;
-+ cputime64_t idletime;
-+ u64 nsec;
-+ u32 rem;
- int i;
-- cputime_t idletime = cputime_zero;
-
-+ idletime = 0;
- for_each_possible_cpu(i)
- idletime = cputime64_add(idletime, kstat_cpu(i).cpustat.idle);
-
- do_posix_clock_monotonic_gettime(&uptime);
- monotonic_to_bootbased(&uptime);
-- cputime_to_timespec(idletime, &idle);
-+ nsec = cputime64_to_jiffies64(idletime) * TICK_NSEC;
-+ idle.tv_sec = div_u64_rem(nsec, NSEC_PER_SEC, &rem);
-+ idle.tv_nsec = rem;
- seq_printf(m, "%lu.%02lu %lu.%02lu\n",
- (unsigned long) uptime.tv_sec,
- (uptime.tv_nsec / (NSEC_PER_SEC / 100)),
-diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
-index a06bfab..63070ad 100644
---- a/include/linux/blkdev.h
-+++ b/include/linux/blkdev.h
-@@ -777,6 +777,8 @@ extern void blk_plug_device(struct request_queue *);
- extern void blk_plug_device_unlocked(struct request_queue *);
- extern int blk_remove_plug(struct request_queue *);
- extern void blk_recount_segments(struct request_queue *, struct bio *);
-+extern int scsi_cmd_blk_ioctl(struct block_device *, fmode_t,
-+ unsigned int, void __user *);
- extern int scsi_cmd_ioctl(struct request_queue *, struct gendisk *, fmode_t,
- unsigned int, void __user *);
- extern int sg_scsi_ioctl(struct request_queue *, struct gendisk *, fmode_t,
-diff --git a/include/linux/kernel.h b/include/linux/kernel.h
-index f4e3184..1221fe4 100644
---- a/include/linux/kernel.h
-+++ b/include/linux/kernel.h
-@@ -407,6 +407,50 @@ static inline char *pack_hex_byte(char *buf, u8 byte)
- #endif
-
- /*
-+ * ratelimited messages with local ratelimit_state,
-+ * no local ratelimit_state used in the !PRINTK case
-+ */
-+#ifdef CONFIG_PRINTK
-+#define printk_ratelimited(fmt, ...) ({ \
-+ static struct ratelimit_state _rs = { \
-+ .interval = DEFAULT_RATELIMIT_INTERVAL, \
-+ .burst = DEFAULT_RATELIMIT_BURST, \
-+ }; \
-+ \
-+ if (!__ratelimit(&_rs)) \
-+ printk(fmt, ##__VA_ARGS__); \
-+})
-+#else
-+/* No effect, but we still get type checking even in the !PRINTK case: */
-+#define printk_ratelimited printk
-+#endif
-+
-+#define pr_emerg_ratelimited(fmt, ...) \
-+ printk_ratelimited(KERN_EMERG pr_fmt(fmt), ##__VA_ARGS__)
-+#define pr_alert_ratelimited(fmt, ...) \
-+ printk_ratelimited(KERN_ALERT pr_fmt(fmt), ##__VA_ARGS__)
-+#define pr_crit_ratelimited(fmt, ...) \
-+ printk_ratelimited(KERN_CRIT pr_fmt(fmt), ##__VA_ARGS__)
-+#define pr_err_ratelimited(fmt, ...) \
-+ printk_ratelimited(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__)
-+#define pr_warning_ratelimited(fmt, ...) \
-+ printk_ratelimited(KERN_WARNING pr_fmt(fmt), ##__VA_ARGS__)
-+#define pr_notice_ratelimited(fmt, ...) \
-+ printk_ratelimited(KERN_NOTICE pr_fmt(fmt), ##__VA_ARGS__)
-+#define pr_info_ratelimited(fmt, ...) \
-+ printk_ratelimited(KERN_INFO pr_fmt(fmt), ##__VA_ARGS__)
-+/* no pr_cont_ratelimited, don't do that... */
-+/* If you are writing a driver, please use dev_dbg instead */
-+#if defined(DEBUG)
-+#define pr_debug_ratelimited(fmt, ...) \
-+ printk_ratelimited(KERN_DEBUG pr_fmt(fmt), ##__VA_ARGS__)
-+#else
-+#define pr_debug_ratelimited(fmt, ...) \
-+ ({ if (0) printk_ratelimited(KERN_DEBUG pr_fmt(fmt), \
-+ ##__VA_ARGS__); 0; })
-+#endif
-+
-+/*
- * General tracing related utility functions - trace_printk(),
- * tracing_on/tracing_off and tracing_start()/tracing_stop
- *
-diff --git a/include/linux/pci_regs.h b/include/linux/pci_regs.h
-index dd0bed4..015184b 100644
---- a/include/linux/pci_regs.h
-+++ b/include/linux/pci_regs.h
-@@ -377,7 +377,7 @@
- #define PCI_EXP_TYPE_DOWNSTREAM 0x6 /* Downstream Port */
- #define PCI_EXP_TYPE_PCI_BRIDGE 0x7 /* PCI/PCI-X Bridge */
- #define PCI_EXP_TYPE_RC_END 0x9 /* Root Complex Integrated Endpoint */
--#define PCI_EXP_TYPE_RC_EC 0x10 /* Root Complex Event Collector */
-+#define PCI_EXP_TYPE_RC_EC 0xa /* Root Complex Event Collector */
- #define PCI_EXP_FLAGS_SLOT 0x0100 /* Slot implemented */
- #define PCI_EXP_FLAGS_IRQ 0x3e00 /* Interrupt message number */
- #define PCI_EXP_DEVCAP 4 /* Device capabilities */
-diff --git a/include/linux/sunrpc/svcsock.h b/include/linux/sunrpc/svcsock.h
-index 1b353a7..da2e7df 100644
---- a/include/linux/sunrpc/svcsock.h
-+++ b/include/linux/sunrpc/svcsock.h
-@@ -34,7 +34,7 @@ struct svc_sock {
- /*
- * Function prototypes.
- */
--void svc_close_all(struct list_head *);
-+void svc_close_all(struct svc_serv *);
- int svc_recv(struct svc_rqst *, long);
- int svc_send(struct svc_rqst *);
- void svc_drop(struct svc_rqst *);
-diff --git a/include/linux/videodev2.h b/include/linux/videodev2.h
-index b59e78c..9e2088c 100644
---- a/include/linux/videodev2.h
-+++ b/include/linux/videodev2.h
-@@ -858,6 +858,7 @@ struct v4l2_querymenu {
- #define V4L2_CTRL_FLAG_NEXT_CTRL 0x80000000
-
- /* User-class control IDs defined by V4L2 */
-+#define V4L2_CID_MAX_CTRLS 1024
- #define V4L2_CID_BASE (V4L2_CTRL_CLASS_USER | 0x900)
- #define V4L2_CID_USER_BASE V4L2_CID_BASE
- /* IDs reserved for driver specific controls */
-diff --git a/include/xen/interface/io/xs_wire.h b/include/xen/interface/io/xs_wire.h
-index 99fcffb..454ee26 100644
---- a/include/xen/interface/io/xs_wire.h
-+++ b/include/xen/interface/io/xs_wire.h
-@@ -84,4 +84,7 @@ struct xenstore_domain_interface {
- XENSTORE_RING_IDX rsp_cons, rsp_prod;
- };
-
-+/* Violating this is very bad. See docs/misc/xenstore.txt. */
-+#define XENSTORE_PAYLOAD_MAX 4096
-+
- #endif /* _XS_WIRE_H */
-diff --git a/kernel/kprobes.c b/kernel/kprobes.c
-index 5240d75..176d825 100644
---- a/kernel/kprobes.c
-+++ b/kernel/kprobes.c
-@@ -466,6 +466,7 @@ void __kprobes kprobe_flush_task(struct task_struct *tk)
- /* Early boot. kretprobe_table_locks not yet initialized. */
- return;
-
-+ INIT_HLIST_HEAD(&empty_rp);
- hash = hash_ptr(tk, KPROBE_HASH_BITS);
- head = &kretprobe_inst_table[hash];
- kretprobe_table_lock(hash, &flags);
-@@ -474,7 +475,6 @@ void __kprobes kprobe_flush_task(struct task_struct *tk)
- recycle_rp_inst(ri, &empty_rp);
- }
- kretprobe_table_unlock(hash, &flags);
-- INIT_HLIST_HEAD(&empty_rp);
- hlist_for_each_entry_safe(ri, node, tmp, &empty_rp, hlist) {
- hlist_del(&ri->hlist);
- kfree(ri);
-diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
-index 952f206..3d98b6e 100644
---- a/net/sunrpc/svc.c
-+++ b/net/sunrpc/svc.c
-@@ -166,6 +166,7 @@ svc_pool_map_alloc_arrays(struct svc_pool_map *m, unsigned int maxpools)
-
- fail_free:
- kfree(m->to_pool);
-+ m->to_pool = NULL;
- fail:
- return -ENOMEM;
- }
-@@ -286,7 +287,9 @@ svc_pool_map_put(void)
- if (!--m->count) {
- m->mode = SVC_POOL_DEFAULT;
- kfree(m->to_pool);
-+ m->to_pool = NULL;
- kfree(m->pool_to);
-+ m->pool_to = NULL;
- m->npools = 0;
- }
-
-@@ -472,16 +475,11 @@ svc_destroy(struct svc_serv *serv)
-
- del_timer_sync(&serv->sv_temptimer);
-
-- svc_close_all(&serv->sv_tempsocks);
-+ svc_close_all(serv);
-
- if (serv->sv_shutdown)
- serv->sv_shutdown(serv);
-
-- svc_close_all(&serv->sv_permsocks);
--
-- BUG_ON(!list_empty(&serv->sv_permsocks));
-- BUG_ON(!list_empty(&serv->sv_tempsocks));
--
- cache_clean_deferred(serv);
-
- if (svc_serv_is_pooled(serv))
-diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
-index cc1fb36..314320a 100644
---- a/net/sunrpc/svc_xprt.c
-+++ b/net/sunrpc/svc_xprt.c
-@@ -927,7 +927,7 @@ void svc_close_xprt(struct svc_xprt *xprt)
- }
- EXPORT_SYMBOL_GPL(svc_close_xprt);
-
--void svc_close_all(struct list_head *xprt_list)
-+static void svc_close_list(struct list_head *xprt_list)
- {
- struct svc_xprt *xprt;
- struct svc_xprt *tmp;
-@@ -945,6 +945,15 @@ void svc_close_all(struct list_head *xprt_list)
- }
- }
-
-+void svc_close_all(struct svc_serv *serv)
-+{
-+ svc_close_list(&serv->sv_tempsocks);
-+ svc_close_list(&serv->sv_permsocks);
-+ BUG_ON(!list_empty(&serv->sv_permsocks));
-+ BUG_ON(!list_empty(&serv->sv_tempsocks));
-+
-+}
-+
- /*
- * Handle defer and revisit of requests
- */
-diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
-index 3cd58b6..852bf85 100644
---- a/security/integrity/ima/ima_api.c
-+++ b/security/integrity/ima/ima_api.c
-@@ -183,8 +183,8 @@ void ima_store_measurement(struct ima_iint_cache *iint, struct file *file,
- strncpy(entry->template.file_name, filename, IMA_EVENT_NAME_LEN_MAX);
-
- result = ima_store_template(entry, violation, inode);
-- if (!result)
-+ if (!result || result == -EEXIST)
- iint->flags |= IMA_MEASURED;
-- else
-+ if (result < 0)
- kfree(entry);
- }
-diff --git a/security/integrity/ima/ima_queue.c b/security/integrity/ima/ima_queue.c
-index a0880e9..e19316d 100644
---- a/security/integrity/ima/ima_queue.c
-+++ b/security/integrity/ima/ima_queue.c
-@@ -113,6 +113,7 @@ int ima_add_template_entry(struct ima_template_entry *entry, int violation,
- memcpy(digest, entry->digest, sizeof digest);
- if (ima_lookup_digest_entry(digest)) {
- audit_cause = "hash_exists";
-+ result = -EEXIST;
- goto out;
- }
- }
-diff --git a/sound/pci/hda/hda_local.h b/sound/pci/hda/hda_local.h
-index 5f1dcc5..f8ac43a 100644
---- a/sound/pci/hda/hda_local.h
-+++ b/sound/pci/hda/hda_local.h
-@@ -408,7 +408,12 @@ static inline u32 get_wcaps(struct hda_codec *codec, hda_nid_t nid)
- }
-
- /* get the widget type from widget capability bits */
--#define get_wcaps_type(wcaps) (((wcaps) & AC_WCAP_TYPE) >> AC_WCAP_TYPE_SHIFT)
-+static inline int get_wcaps_type(unsigned int wcaps)
-+{
-+ if (!wcaps)
-+ return -1; /* invalid type */
-+ return (wcaps & AC_WCAP_TYPE) >> AC_WCAP_TYPE_SHIFT;
-+}
-
- static inline unsigned int get_wcaps_channels(u32 wcaps)
- {
-diff --git a/sound/pci/hda/hda_proc.c b/sound/pci/hda/hda_proc.c
-index 95f24e4..2b3d859 100644
---- a/sound/pci/hda/hda_proc.c
-+++ b/sound/pci/hda/hda_proc.c
-@@ -39,6 +39,8 @@ static const char *get_wid_type_name(unsigned int wid_value)
- [AC_WID_BEEP] = "Beep Generator Widget",
- [AC_WID_VENDOR] = "Vendor Defined Widget",
- };
-+ if (wid_value == -1)
-+ return "UNKNOWN Widget";
- wid_value &= 0xf;
- if (names[wid_value])
- return names[wid_value];
-diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
-index 01da10b..2fcd70d 100644
---- a/sound/pci/hda/patch_sigmatel.c
-+++ b/sound/pci/hda/patch_sigmatel.c
-@@ -1598,7 +1598,7 @@ static struct snd_pci_quirk stac92hd73xx_cfg_tbl[] = {
- SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x02bd,
- "Dell Studio 1557", STAC_DELL_M6_DMIC),
- SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x02fe,
-- "Dell Studio XPS 1645", STAC_DELL_M6_BOTH),
-+ "Dell Studio XPS 1645", STAC_DELL_M6_DMIC),
- SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0413,
- "Dell Studio 1558", STAC_DELL_M6_DMIC),
- {} /* terminator */
-diff --git a/sound/pci/ice1712/amp.c b/sound/pci/ice1712/amp.c
-index 6da21a2..95873b5 100644
---- a/sound/pci/ice1712/amp.c
-+++ b/sound/pci/ice1712/amp.c
-@@ -69,8 +69,11 @@ static int __devinit snd_vt1724_amp_init(struct snd_ice1712 *ice)
-
- static int __devinit snd_vt1724_amp_add_controls(struct snd_ice1712 *ice)
- {
-- /* we use pins 39 and 41 of the VT1616 for left and right read outputs */
-- snd_ac97_write_cache(ice->ac97, 0x5a, snd_ac97_read(ice->ac97, 0x5a) & ~0x8000);
-+ if (ice->ac97)
-+ /* we use pins 39 and 41 of the VT1616 for left and right
-+ read outputs */
-+ snd_ac97_write_cache(ice->ac97, 0x5a,
-+ snd_ac97_read(ice->ac97, 0x5a) & ~0x8000);
- return 0;
- }
-
-diff --git a/sound/usb/usx2y/usb_stream.c b/sound/usb/usx2y/usb_stream.c
-index 12ae034..dafcf79 100644
---- a/sound/usb/usx2y/usb_stream.c
-+++ b/sound/usb/usx2y/usb_stream.c
-@@ -673,7 +673,7 @@ dotry:
- inurb->transfer_buffer_length =
- inurb->number_of_packets *
- inurb->iso_frame_desc[0].length;
-- preempt_disable();
-+
- if (u == 0) {
- int now;
- struct usb_device *dev = inurb->dev;
-@@ -685,19 +685,17 @@ dotry:
- }
- err = usb_submit_urb(inurb, GFP_ATOMIC);
- if (err < 0) {
-- preempt_enable();
- snd_printk(KERN_ERR"usb_submit_urb(sk->inurb[%i])"
- " returned %i\n", u, err);
- return err;
- }
- err = usb_submit_urb(outurb, GFP_ATOMIC);
- if (err < 0) {
-- preempt_enable();
- snd_printk(KERN_ERR"usb_submit_urb(sk->outurb[%i])"
- " returned %i\n", u, err);
- return err;
- }
-- preempt_enable();
-+
- if (inurb->start_frame != outurb->start_frame) {
- snd_printd(KERN_DEBUG
- "u[%i] start_frames differ in:%u out:%u\n",
diff --git a/2.6.32/1055_linux-2.6.32.56.patch b/2.6.32/1055_linux-2.6.32.56.patch
deleted file mode 100644
index 53aba88..0000000
--- a/2.6.32/1055_linux-2.6.32.56.patch
+++ /dev/null
@@ -1,716 +0,0 @@
-diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
-index 114ee29..2be0a97 100644
---- a/block/scsi_ioctl.c
-+++ b/block/scsi_ioctl.c
-@@ -24,6 +24,7 @@
- #include <linux/capability.h>
- #include <linux/completion.h>
- #include <linux/cdrom.h>
-+#include <linux/ratelimit.h>
- #include <linux/slab.h>
- #include <linux/times.h>
- #include <asm/uaccess.h>
-@@ -689,9 +690,53 @@ int scsi_cmd_ioctl(struct request_queue *q, struct gendisk *bd_disk, fmode_t mod
- }
- EXPORT_SYMBOL(scsi_cmd_ioctl);
-
-+int scsi_verify_blk_ioctl(struct block_device *bd, unsigned int cmd)
-+{
-+ if (bd && bd == bd->bd_contains)
-+ return 0;
-+
-+ /* Actually none of these is particularly useful on a partition,
-+ * but they are safe.
-+ */
-+ switch (cmd) {
-+ case SCSI_IOCTL_GET_IDLUN:
-+ case SCSI_IOCTL_GET_BUS_NUMBER:
-+ case SCSI_IOCTL_GET_PCI:
-+ case SCSI_IOCTL_PROBE_HOST:
-+ case SG_GET_VERSION_NUM:
-+ case SG_SET_TIMEOUT:
-+ case SG_GET_TIMEOUT:
-+ case SG_GET_RESERVED_SIZE:
-+ case SG_SET_RESERVED_SIZE:
-+ case SG_EMULATED_HOST:
-+ return 0;
-+ case CDROM_GET_CAPABILITY:
-+ /* Keep this until we remove the printk below. udev sends it
-+ * and we do not want to spam dmesg about it. CD-ROMs do
-+ * not have partitions, so we get here only for disks.
-+ */
-+ return -ENOTTY;
-+ default:
-+ break;
-+ }
-+
-+ /* In particular, rule out all resets and host-specific ioctls. */
-+ printk_ratelimited(KERN_WARNING
-+ "%s: sending ioctl %x to a partition!\n", current->comm, cmd);
-+
-+ return capable(CAP_SYS_RAWIO) ? 0 : -ENOTTY;
-+}
-+EXPORT_SYMBOL(scsi_verify_blk_ioctl);
-+
- int scsi_cmd_blk_ioctl(struct block_device *bd, fmode_t mode,
- unsigned int cmd, void __user *arg)
- {
-+ int ret;
-+
-+ ret = scsi_verify_blk_ioctl(bd, cmd);
-+ if (ret < 0)
-+ return ret;
-+
- return scsi_cmd_ioctl(bd->bd_disk->queue, bd->bd_disk, mode, cmd, arg);
- }
- EXPORT_SYMBOL(scsi_cmd_blk_ioctl);
-diff --git a/crypto/sha512_generic.c b/crypto/sha512_generic.c
-index 9ed9f60..88f160b 100644
---- a/crypto/sha512_generic.c
-+++ b/crypto/sha512_generic.c
-@@ -21,8 +21,6 @@
- #include <linux/percpu.h>
- #include <asm/byteorder.h>
-
--static DEFINE_PER_CPU(u64[80], msg_schedule);
--
- static inline u64 Ch(u64 x, u64 y, u64 z)
- {
- return z ^ (x & (y ^ z));
-@@ -80,7 +78,7 @@ static inline void LOAD_OP(int I, u64 *W, const u8 *input)
-
- static inline void BLEND_OP(int I, u64 *W)
- {
-- W[I] = s1(W[I-2]) + W[I-7] + s0(W[I-15]) + W[I-16];
-+ W[I % 16] += s1(W[(I-2) % 16]) + W[(I-7) % 16] + s0(W[(I-15) % 16]);
- }
-
- static void
-@@ -89,38 +87,48 @@ sha512_transform(u64 *state, const u8 *input)
- u64 a, b, c, d, e, f, g, h, t1, t2;
-
- int i;
-- u64 *W = get_cpu_var(msg_schedule);
-+ u64 W[16];
-
- /* load the input */
- for (i = 0; i < 16; i++)
- LOAD_OP(i, W, input);
-
-- for (i = 16; i < 80; i++) {
-- BLEND_OP(i, W);
-- }
--
- /* load the state into our registers */
- a=state[0]; b=state[1]; c=state[2]; d=state[3];
- e=state[4]; f=state[5]; g=state[6]; h=state[7];
-
-- /* now iterate */
-- for (i=0; i<80; i+=8) {
-- t1 = h + e1(e) + Ch(e,f,g) + sha512_K[i ] + W[i ];
-- t2 = e0(a) + Maj(a,b,c); d+=t1; h=t1+t2;
-- t1 = g + e1(d) + Ch(d,e,f) + sha512_K[i+1] + W[i+1];
-- t2 = e0(h) + Maj(h,a,b); c+=t1; g=t1+t2;
-- t1 = f + e1(c) + Ch(c,d,e) + sha512_K[i+2] + W[i+2];
-- t2 = e0(g) + Maj(g,h,a); b+=t1; f=t1+t2;
-- t1 = e + e1(b) + Ch(b,c,d) + sha512_K[i+3] + W[i+3];
-- t2 = e0(f) + Maj(f,g,h); a+=t1; e=t1+t2;
-- t1 = d + e1(a) + Ch(a,b,c) + sha512_K[i+4] + W[i+4];
-- t2 = e0(e) + Maj(e,f,g); h+=t1; d=t1+t2;
-- t1 = c + e1(h) + Ch(h,a,b) + sha512_K[i+5] + W[i+5];
-- t2 = e0(d) + Maj(d,e,f); g+=t1; c=t1+t2;
-- t1 = b + e1(g) + Ch(g,h,a) + sha512_K[i+6] + W[i+6];
-- t2 = e0(c) + Maj(c,d,e); f+=t1; b=t1+t2;
-- t1 = a + e1(f) + Ch(f,g,h) + sha512_K[i+7] + W[i+7];
-- t2 = e0(b) + Maj(b,c,d); e+=t1; a=t1+t2;
-+#define SHA512_0_15(i, a, b, c, d, e, f, g, h) \
-+ t1 = h + e1(e) + Ch(e, f, g) + sha512_K[i] + W[i]; \
-+ t2 = e0(a) + Maj(a, b, c); \
-+ d += t1; \
-+ h = t1 + t2
-+
-+#define SHA512_16_79(i, a, b, c, d, e, f, g, h) \
-+ BLEND_OP(i, W); \
-+ t1 = h + e1(e) + Ch(e, f, g) + sha512_K[i] + W[(i)%16]; \
-+ t2 = e0(a) + Maj(a, b, c); \
-+ d += t1; \
-+ h = t1 + t2
-+
-+ for (i = 0; i < 16; i += 8) {
-+ SHA512_0_15(i, a, b, c, d, e, f, g, h);
-+ SHA512_0_15(i + 1, h, a, b, c, d, e, f, g);
-+ SHA512_0_15(i + 2, g, h, a, b, c, d, e, f);
-+ SHA512_0_15(i + 3, f, g, h, a, b, c, d, e);
-+ SHA512_0_15(i + 4, e, f, g, h, a, b, c, d);
-+ SHA512_0_15(i + 5, d, e, f, g, h, a, b, c);
-+ SHA512_0_15(i + 6, c, d, e, f, g, h, a, b);
-+ SHA512_0_15(i + 7, b, c, d, e, f, g, h, a);
-+ }
-+ for (i = 16; i < 80; i += 8) {
-+ SHA512_16_79(i, a, b, c, d, e, f, g, h);
-+ SHA512_16_79(i + 1, h, a, b, c, d, e, f, g);
-+ SHA512_16_79(i + 2, g, h, a, b, c, d, e, f);
-+ SHA512_16_79(i + 3, f, g, h, a, b, c, d, e);
-+ SHA512_16_79(i + 4, e, f, g, h, a, b, c, d);
-+ SHA512_16_79(i + 5, d, e, f, g, h, a, b, c);
-+ SHA512_16_79(i + 6, c, d, e, f, g, h, a, b);
-+ SHA512_16_79(i + 7, b, c, d, e, f, g, h, a);
- }
-
- state[0] += a; state[1] += b; state[2] += c; state[3] += d;
-@@ -128,8 +136,6 @@ sha512_transform(u64 *state, const u8 *input)
-
- /* erase our data */
- a = b = c = d = e = f = g = h = t1 = t2 = 0;
-- memset(W, 0, sizeof(__get_cpu_var(msg_schedule)));
-- put_cpu_var(msg_schedule);
- }
-
- static int
-diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
-index 932b5aa..d676d49 100644
---- a/drivers/gpu/drm/drm_auth.c
-+++ b/drivers/gpu/drm/drm_auth.c
-@@ -102,7 +102,7 @@ static int drm_add_magic(struct drm_master *master, struct drm_file *priv,
- * Searches and unlinks the entry in drm_device::magiclist with the magic
- * number hash key, while holding the drm_device::struct_mutex lock.
- */
--static int drm_remove_magic(struct drm_master *master, drm_magic_t magic)
-+int drm_remove_magic(struct drm_master *master, drm_magic_t magic)
- {
- struct drm_magic_entry *pt;
- struct drm_hash_item *hash;
-@@ -137,6 +137,8 @@ static int drm_remove_magic(struct drm_master *master, drm_magic_t magic)
- * If there is a magic number in drm_file::magic then use it, otherwise
- * searches an unique non-zero magic number and add it associating it with \p
- * file_priv.
-+ * This ioctl needs protection by the drm_global_mutex, which protects
-+ * struct drm_file::magic and struct drm_magic_entry::priv.
- */
- int drm_getmagic(struct drm_device *dev, void *data, struct drm_file *file_priv)
- {
-@@ -174,6 +176,8 @@ int drm_getmagic(struct drm_device *dev, void *data, struct drm_file *file_priv)
- * \return zero if authentication successed, or a negative number otherwise.
- *
- * Checks if \p file_priv is associated with the magic number passed in \arg.
-+ * This ioctl needs protection by the drm_global_mutex, which protects
-+ * struct drm_file::magic and struct drm_magic_entry::priv.
- */
- int drm_authmagic(struct drm_device *dev, void *data,
- struct drm_file *file_priv)
-diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c
-index ba14553..519161e 100644
---- a/drivers/gpu/drm/drm_fops.c
-+++ b/drivers/gpu/drm/drm_fops.c
-@@ -449,6 +449,11 @@ int drm_release(struct inode *inode, struct file *filp)
- (long)old_encode_dev(file_priv->minor->device),
- dev->open_count);
-
-+ /* Release any auth tokens that might point to this file_priv,
-+ (do that under the drm_global_mutex) */
-+ if (file_priv->magic)
-+ (void) drm_remove_magic(file_priv->master, file_priv->magic);
-+
- /* if the master has gone away we can't do anything with the lock */
- if (file_priv->minor->master)
- drm_master_release(dev, filp);
-diff --git a/drivers/hwmon/f71805f.c b/drivers/hwmon/f71805f.c
-index 525a00b..15645ab 100644
---- a/drivers/hwmon/f71805f.c
-+++ b/drivers/hwmon/f71805f.c
-@@ -281,11 +281,11 @@ static inline long temp_from_reg(u8 reg)
-
- static inline u8 temp_to_reg(long val)
- {
-- if (val < 0)
-- val = 0;
-- else if (val > 1000 * 0xff)
-- val = 0xff;
-- return ((val + 500) / 1000);
-+ if (val <= 0)
-+ return 0;
-+ if (val >= 1000 * 0xff)
-+ return 0xff;
-+ return (val + 500) / 1000;
- }
-
- /*
-diff --git a/drivers/hwmon/sht15.c b/drivers/hwmon/sht15.c
-index 2040507..740785e 100644
---- a/drivers/hwmon/sht15.c
-+++ b/drivers/hwmon/sht15.c
-@@ -515,7 +515,7 @@ static int sht15_invalidate_voltage(struct notifier_block *nb,
-
- static int __devinit sht15_probe(struct platform_device *pdev)
- {
-- int ret = 0;
-+ int ret;
- struct sht15_data *data = kzalloc(sizeof(*data), GFP_KERNEL);
-
- if (!data) {
-@@ -532,6 +532,7 @@ static int __devinit sht15_probe(struct platform_device *pdev)
- init_waitqueue_head(&data->wait_queue);
-
- if (pdev->dev.platform_data == NULL) {
-+ ret = -EINVAL;
- dev_err(&pdev->dev, "no platform data supplied");
- goto err_free_data;
- }
-diff --git a/drivers/md/dm-linear.c b/drivers/md/dm-linear.c
-index 82f7d6e..7ab302d 100644
---- a/drivers/md/dm-linear.c
-+++ b/drivers/md/dm-linear.c
-@@ -116,7 +116,17 @@ static int linear_ioctl(struct dm_target *ti, unsigned int cmd,
- unsigned long arg)
- {
- struct linear_c *lc = (struct linear_c *) ti->private;
-- return __blkdev_driver_ioctl(lc->dev->bdev, lc->dev->mode, cmd, arg);
-+ struct dm_dev *dev = lc->dev;
-+ int r = 0;
-+
-+ /*
-+ * Only pass ioctls through if the device sizes match exactly.
-+ */
-+ if (lc->start ||
-+ ti->len != i_size_read(dev->bdev->bd_inode) >> SECTOR_SHIFT)
-+ r = scsi_verify_blk_ioctl(NULL, cmd);
-+
-+ return r ? : __blkdev_driver_ioctl(dev->bdev, dev->mode, cmd, arg);
- }
-
- static int linear_merge(struct dm_target *ti, struct bvec_merge_data *bvm,
-diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
-index b03cd39..4ec5fe2 100644
---- a/drivers/md/dm-mpath.c
-+++ b/drivers/md/dm-mpath.c
-@@ -1464,6 +1464,12 @@ static int multipath_ioctl(struct dm_target *ti, unsigned int cmd,
-
- spin_unlock_irqrestore(&m->lock, flags);
-
-+ /*
-+ * Only pass ioctls through if the device sizes match exactly.
-+ */
-+ if (!r && ti->len != i_size_read(bdev->bd_inode) >> SECTOR_SHIFT)
-+ r = scsi_verify_blk_ioctl(NULL, cmd);
-+
- return r ? : __blkdev_driver_ioctl(bdev, mode, cmd, arg);
- }
-
-diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
-index 68d800f..705a589 100644
---- a/drivers/mmc/host/mmci.c
-+++ b/drivers/mmc/host/mmci.c
-@@ -232,12 +232,8 @@ mmci_cmd_irq(struct mmci_host *host, struct mmc_command *cmd,
- }
-
- if (!cmd->data || cmd->error) {
-- if (host->data) {
-- /* Terminate the DMA transfer */
-- if (dma_inprogress(host))
-- mmci_dma_data_error(host);
-+ if (host->data)
- mmci_stop_data(host);
-- }
- mmci_request_end(host, cmd->mrq);
- } else if (!(cmd->data->flags & MMC_DATA_READ)) {
- mmci_start_data(host, cmd->data);
-diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
-index 2dd1b73..a5b55fe 100644
---- a/drivers/scsi/sd.c
-+++ b/drivers/scsi/sd.c
-@@ -817,6 +817,10 @@ static int sd_ioctl(struct block_device *bdev, fmode_t mode,
- SCSI_LOG_IOCTL(1, printk("sd_ioctl: disk=%s, cmd=0x%x\n",
- disk->disk_name, cmd));
-
-+ error = scsi_verify_blk_ioctl(bdev, cmd);
-+ if (error < 0)
-+ return error;
-+
- /*
- * If we are in the middle of error recovery, don't let anyone
- * else try and use this device. Also, if error recovery fails, it
-@@ -996,6 +1000,11 @@ static int sd_compat_ioctl(struct block_device *bdev, fmode_t mode,
- unsigned int cmd, unsigned long arg)
- {
- struct scsi_device *sdev = scsi_disk(bdev->bd_disk)->device;
-+ int ret;
-+
-+ ret = scsi_verify_blk_ioctl(bdev, cmd);
-+ if (ret < 0)
-+ return -ENOIOCTLCMD;
-
- /*
- * If we are in the middle of error recovery, don't let anyone
-@@ -1007,8 +1016,6 @@ static int sd_compat_ioctl(struct block_device *bdev, fmode_t mode,
- return -ENODEV;
-
- if (sdev->host->hostt->compat_ioctl) {
-- int ret;
--
- ret = sdev->host->hostt->compat_ioctl(sdev, cmd, (void __user *)arg);
-
- return ret;
-diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
-index 696ca75f..d71514b 100644
---- a/drivers/usb/class/cdc-wdm.c
-+++ b/drivers/usb/class/cdc-wdm.c
-@@ -458,7 +458,9 @@ retry:
- for (i = 0; i < desc->length - cntr; i++)
- desc->ubuf[i] = desc->ubuf[i + cntr];
-
-+ spin_lock_irq(&desc->iuspin);
- desc->length -= cntr;
-+ spin_unlock_irq(&desc->iuspin);
- /* in case we had outstanding data */
- if (!desc->length)
- clear_bit(WDM_READ, &desc->flags);
-diff --git a/drivers/usb/misc/usbsevseg.c b/drivers/usb/misc/usbsevseg.c
-index cd8726c..6bc0bf3 100644
---- a/drivers/usb/misc/usbsevseg.c
-+++ b/drivers/usb/misc/usbsevseg.c
-@@ -24,7 +24,7 @@
-
- #define VENDOR_ID 0x0fc5
- #define PRODUCT_ID 0x1227
--#define MAXLEN 6
-+#define MAXLEN 8
-
- /* table of devices that work with this driver */
- static struct usb_device_id id_table[] = {
-diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
-index 8dcaf42..bb16725 100644
---- a/drivers/usb/serial/cp210x.c
-+++ b/drivers/usb/serial/cp210x.c
-@@ -140,6 +140,7 @@ static struct usb_device_id id_table [] = {
- { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
- { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
- { USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */
-+ { USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */
- { USB_DEVICE(0x413C, 0x9500) }, /* DW700 GPS USB interface */
- { } /* Terminating Entry */
- };
-@@ -360,8 +361,8 @@ static inline int cp210x_set_config_single(struct usb_serial_port *port,
- * Quantises the baud rate as per AN205 Table 1
- */
- static unsigned int cp210x_quantise_baudrate(unsigned int baud) {
-- if (baud <= 56) baud = 0;
-- else if (baud <= 300) baud = 300;
-+ if (baud <= 300)
-+ baud = 300;
- else if (baud <= 600) baud = 600;
- else if (baud <= 1200) baud = 1200;
- else if (baud <= 1800) baud = 1800;
-diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
-index 5ce2cb9..85d630e 100644
---- a/drivers/usb/serial/ftdi_sio.c
-+++ b/drivers/usb/serial/ftdi_sio.c
-@@ -798,6 +798,7 @@ static struct usb_device_id id_table_combined [] = {
- .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
- { USB_DEVICE(ADI_VID, ADI_GNICEPLUS_PID),
- .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-+ { USB_DEVICE(HORNBY_VID, HORNBY_ELITE_PID) },
- { USB_DEVICE(JETI_VID, JETI_SPC1201_PID) },
- { USB_DEVICE(MARVELL_VID, MARVELL_SHEEVAPLUG_PID),
- .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-@@ -806,6 +807,8 @@ static struct usb_device_id id_table_combined [] = {
- { USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) },
- { USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID),
- .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-+ { USB_DEVICE(FTDI_VID, TI_XDS100V2_PID),
-+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
- { USB_DEVICE(FTDI_VID, HAMEG_HO820_PID) },
- { USB_DEVICE(FTDI_VID, HAMEG_HO720_PID) },
- { USB_DEVICE(FTDI_VID, HAMEG_HO730_PID) },
-@@ -842,6 +845,7 @@ static struct usb_device_id id_table_combined [] = {
- .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
- { USB_DEVICE(ST_VID, ST_STMCLT1030_PID),
- .driver_info = (kernel_ulong_t)&ftdi_stmclite_quirk },
-+ { USB_DEVICE(FTDI_VID, FTDI_RF_R106) },
- { }, /* Optional parameter entry */
- { } /* Terminating entry */
- };
-@@ -1351,8 +1355,7 @@ static int set_serial_info(struct tty_struct *tty,
- goto check_and_exit;
- }
-
-- if ((new_serial.baud_base != priv->baud_base) &&
-- (new_serial.baud_base < 9600)) {
-+ if (new_serial.baud_base != priv->baud_base) {
- unlock_kernel();
- return -EINVAL;
- }
-@@ -1865,6 +1868,7 @@ static int ftdi_submit_read_urb(struct usb_serial_port *port, gfp_t mem_flags)
-
- static int ftdi_open(struct tty_struct *tty, struct usb_serial_port *port)
- { /* ftdi_open */
-+ struct ktermios dummy;
- struct usb_device *dev = port->serial->dev;
- struct ftdi_private *priv = usb_get_serial_port_data(port);
- unsigned long flags;
-@@ -1892,8 +1896,10 @@ static int ftdi_open(struct tty_struct *tty, struct usb_serial_port *port)
- This is same behaviour as serial.c/rs_open() - Kuba */
-
- /* ftdi_set_termios will send usb control messages */
-- if (tty)
-- ftdi_set_termios(tty, port, tty->termios);
-+ if (tty) {
-+ memset(&dummy, 0, sizeof(dummy));
-+ ftdi_set_termios(tty, port, &dummy);
-+ }
-
- /* Not throttled */
- spin_lock_irqsave(&port->lock, flags);
-diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
-index 8ce1bcb..212fc41 100644
---- a/drivers/usb/serial/ftdi_sio_ids.h
-+++ b/drivers/usb/serial/ftdi_sio_ids.h
-@@ -38,6 +38,13 @@
- /* www.candapter.com Ewert Energy Systems CANdapter device */
- #define FTDI_CANDAPTER_PID 0x9F80 /* Product Id */
-
-+/*
-+ * Texas Instruments XDS100v2 JTAG / BeagleBone A3
-+ * http://processors.wiki.ti.com/index.php/XDS100
-+ * http://beagleboard.org/bone
-+ */
-+#define TI_XDS100V2_PID 0xa6d0
-+
- #define FTDI_NXTCAM_PID 0xABB8 /* NXTCam for Mindstorms NXT */
-
- /* US Interface Navigator (http://www.usinterface.com/) */
-@@ -524,6 +531,12 @@
- #define ADI_GNICEPLUS_PID 0xF001
-
- /*
-+ * Hornby Elite
-+ */
-+#define HORNBY_VID 0x04D8
-+#define HORNBY_ELITE_PID 0x000A
-+
-+/*
- * RATOC REX-USB60F
- */
- #define RATOC_VENDOR_ID 0x0584
-@@ -1173,3 +1186,9 @@
- */
- /* TagTracer MIFARE*/
- #define FTDI_ZEITCONTROL_TAGTRACE_MIFARE_PID 0xF7C0
-+
-+/*
-+ * Rainforest Automation
-+ */
-+/* ZigBee controller */
-+#define FTDI_RF_R106 0x8A28
-diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
-index fbdbac5..14d51e6 100644
---- a/drivers/usb/serial/io_ti.c
-+++ b/drivers/usb/serial/io_ti.c
-@@ -2664,15 +2664,7 @@ cleanup:
-
- static void edge_disconnect(struct usb_serial *serial)
- {
-- int i;
-- struct edgeport_port *edge_port;
--
- dbg("%s", __func__);
--
-- for (i = 0; i < serial->num_ports; ++i) {
-- edge_port = usb_get_serial_port_data(serial->port[i]);
-- edge_remove_sysfs_attrs(edge_port->port);
-- }
- }
-
- static void edge_release(struct usb_serial *serial)
-@@ -2927,6 +2919,7 @@ static struct usb_serial_driver edgeport_1port_device = {
- .disconnect = edge_disconnect,
- .release = edge_release,
- .port_probe = edge_create_sysfs_attrs,
-+ .port_remove = edge_remove_sysfs_attrs,
- .ioctl = edge_ioctl,
- .set_termios = edge_set_termios,
- .tiocmget = edge_tiocmget,
-@@ -2957,6 +2950,7 @@ static struct usb_serial_driver edgeport_2port_device = {
- .disconnect = edge_disconnect,
- .release = edge_release,
- .port_probe = edge_create_sysfs_attrs,
-+ .port_remove = edge_remove_sysfs_attrs,
- .ioctl = edge_ioctl,
- .set_termios = edge_set_termios,
- .tiocmget = edge_tiocmget,
-diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
-index 443947f..7a5f1ac 100644
---- a/fs/ecryptfs/crypto.c
-+++ b/fs/ecryptfs/crypto.c
-@@ -1609,7 +1609,8 @@ int ecryptfs_read_metadata(struct dentry *ecryptfs_dentry)
- rc = ecryptfs_read_xattr_region(page_virt, ecryptfs_inode);
- if (rc) {
- printk(KERN_DEBUG "Valid eCryptfs headers not found in "
-- "file header region or xattr region\n");
-+ "file header region or xattr region, inode %lu\n",
-+ ecryptfs_inode->i_ino);
- rc = -EINVAL;
- goto out;
- }
-@@ -1618,7 +1619,8 @@ int ecryptfs_read_metadata(struct dentry *ecryptfs_dentry)
- ECRYPTFS_DONT_VALIDATE_HEADER_SIZE);
- if (rc) {
- printk(KERN_DEBUG "Valid eCryptfs headers not found in "
-- "file xattr region either\n");
-+ "file xattr region either, inode %lu\n",
-+ ecryptfs_inode->i_ino);
- rc = -EINVAL;
- }
- if (crypt_stat->mount_crypt_stat->flags
-@@ -1629,7 +1631,8 @@ int ecryptfs_read_metadata(struct dentry *ecryptfs_dentry)
- "crypto metadata only in the extended attribute "
- "region, but eCryptfs was mounted without "
- "xattr support enabled. eCryptfs will not treat "
-- "this like an encrypted file.\n");
-+ "this like an encrypted file, inode %lu\n",
-+ ecryptfs_inode->i_ino);
- rc = -EINVAL;
- }
- }
-diff --git a/fs/ecryptfs/miscdev.c b/fs/ecryptfs/miscdev.c
-index 4ec8f61..c4b0bc5 100644
---- a/fs/ecryptfs/miscdev.c
-+++ b/fs/ecryptfs/miscdev.c
-@@ -408,11 +408,47 @@ ecryptfs_miscdev_write(struct file *file, const char __user *buf,
- ssize_t sz = 0;
- char *data;
- uid_t euid = current_euid();
-+ unsigned char packet_size_peek[3];
- int rc;
-
-- if (count == 0)
-+ if (count == 0) {
- goto out;
-+ } else if (count == (1 + 4)) {
-+ /* Likely a harmless MSG_HELO or MSG_QUIT - no packet length */
-+ goto memdup;
-+ } else if (count < (1 + 4 + 1)
-+ || count > (1 + 4 + 2 + sizeof(struct ecryptfs_message) + 4
-+ + ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES)) {
-+ printk(KERN_WARNING "%s: Acceptable packet size range is "
-+ "[%d-%lu], but amount of data written is [%zu].",
-+ __func__, (1 + 4 + 1),
-+ (1 + 4 + 2 + sizeof(struct ecryptfs_message) + 4
-+ + ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES), count);
-+ return -EINVAL;
-+ }
-+
-+ if (copy_from_user(packet_size_peek, (buf + 1 + 4),
-+ sizeof(packet_size_peek))) {
-+ printk(KERN_WARNING "%s: Error while inspecting packet size\n",
-+ __func__);
-+ return -EFAULT;
-+ }
-+
-+ rc = ecryptfs_parse_packet_length(packet_size_peek, &packet_size,
-+ &packet_size_length);
-+ if (rc) {
-+ printk(KERN_WARNING "%s: Error parsing packet length; "
-+ "rc = [%d]\n", __func__, rc);
-+ return rc;
-+ }
-+
-+ if ((1 + 4 + packet_size_length + packet_size) != count) {
-+ printk(KERN_WARNING "%s: Invalid packet size [%zu]\n", __func__,
-+ packet_size);
-+ return -EINVAL;
-+ }
-
-+memdup:
- data = memdup_user(buf, count);
- if (IS_ERR(data)) {
- printk(KERN_ERR "%s: memdup_user returned error [%ld]\n",
-@@ -434,23 +470,7 @@ ecryptfs_miscdev_write(struct file *file, const char __user *buf,
- }
- memcpy(&counter_nbo, &data[i], 4);
- seq = be32_to_cpu(counter_nbo);
-- i += 4;
-- rc = ecryptfs_parse_packet_length(&data[i], &packet_size,
-- &packet_size_length);
-- if (rc) {
-- printk(KERN_WARNING "%s: Error parsing packet length; "
-- "rc = [%d]\n", __func__, rc);
-- goto out_free;
-- }
-- i += packet_size_length;
-- if ((1 + 4 + packet_size_length + packet_size) != count) {
-- printk(KERN_WARNING "%s: (1 + packet_size_length([%zd])"
-- " + packet_size([%zd]))([%zd]) != "
-- "count([%zd]). Invalid packet format.\n",
-- __func__, packet_size_length, packet_size,
-- (1 + packet_size_length + packet_size), count);
-- goto out_free;
-- }
-+ i += 4 + packet_size_length;
- rc = ecryptfs_miscdev_response(&data[i], packet_size,
- euid, current_user_ns(),
- task_pid(current), seq);
-diff --git a/fs/ecryptfs/read_write.c b/fs/ecryptfs/read_write.c
-index 0cc4faf..6b78546 100644
---- a/fs/ecryptfs/read_write.c
-+++ b/fs/ecryptfs/read_write.c
-@@ -136,6 +136,11 @@ int ecryptfs_write(struct file *ecryptfs_file, char *data, loff_t offset,
- size_t num_bytes = (PAGE_CACHE_SIZE - start_offset_in_page);
- size_t total_remaining_bytes = ((offset + size) - pos);
-
-+ if (fatal_signal_pending(current)) {
-+ rc = -EINTR;
-+ break;
-+ }
-+
- if (num_bytes > total_remaining_bytes)
- num_bytes = total_remaining_bytes;
- if (pos < offset) {
-@@ -197,15 +202,19 @@ int ecryptfs_write(struct file *ecryptfs_file, char *data, loff_t offset,
- }
- pos += num_bytes;
- }
-- if ((offset + size) > ecryptfs_file_size) {
-- i_size_write(ecryptfs_inode, (offset + size));
-+ if (pos > ecryptfs_file_size) {
-+ i_size_write(ecryptfs_inode, pos);
- if (crypt_stat->flags & ECRYPTFS_ENCRYPTED) {
-- rc = ecryptfs_write_inode_size_to_metadata(
-+ int rc2;
-+
-+ rc2 = ecryptfs_write_inode_size_to_metadata(
- ecryptfs_inode);
-- if (rc) {
-+ if (rc2) {
- printk(KERN_ERR "Problem with "
- "ecryptfs_write_inode_size_to_metadata; "
-- "rc = [%d]\n", rc);
-+ "rc = [%d]\n", rc2);
-+ if (!rc)
-+ rc = rc2;
- goto out;
- }
- }
-diff --git a/include/drm/drmP.h b/include/drm/drmP.h
-index 66713c6..ebab6a6 100644
---- a/include/drm/drmP.h
-+++ b/include/drm/drmP.h
-@@ -1221,6 +1221,7 @@ extern int drm_getmagic(struct drm_device *dev, void *data,
- struct drm_file *file_priv);
- extern int drm_authmagic(struct drm_device *dev, void *data,
- struct drm_file *file_priv);
-+extern int drm_remove_magic(struct drm_master *master, drm_magic_t magic);
-
- /* Cache management (drm_cache.c) */
- void drm_clflush_pages(struct page *pages[], unsigned long num_pages);
-diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
-index 63070ad..5eb6cb0 100644
---- a/include/linux/blkdev.h
-+++ b/include/linux/blkdev.h
-@@ -777,6 +777,7 @@ extern void blk_plug_device(struct request_queue *);
- extern void blk_plug_device_unlocked(struct request_queue *);
- extern int blk_remove_plug(struct request_queue *);
- extern void blk_recount_segments(struct request_queue *, struct bio *);
-+extern int scsi_verify_blk_ioctl(struct block_device *, unsigned int);
- extern int scsi_cmd_blk_ioctl(struct block_device *, fmode_t,
- unsigned int, void __user *);
- extern int scsi_cmd_ioctl(struct request_queue *, struct gendisk *, fmode_t,
diff --git a/2.6.32/1056_linux-2.6.32.57.patch b/2.6.32/1056_linux-2.6.32.57.patch
deleted file mode 100644
index b2075af..0000000
--- a/2.6.32/1056_linux-2.6.32.57.patch
+++ /dev/null
@@ -1,612 +0,0 @@
-diff --git a/drivers/gpu/drm/i915/intel_tv.c b/drivers/gpu/drm/i915/intel_tv.c
-index 5b28b4e..d156b25 100644
---- a/drivers/gpu/drm/i915/intel_tv.c
-+++ b/drivers/gpu/drm/i915/intel_tv.c
-@@ -415,7 +415,7 @@ static const struct tv_mode tv_modes[] = {
- {
- .name = "NTSC-M",
- .clock = 108000,
-- .refresh = 29970,
-+ .refresh = 59940,
- .oversample = TV_OVERSAMPLE_8X,
- .component_only = 0,
- /* 525 Lines, 60 Fields, 15.734KHz line, Sub-Carrier 3.580MHz */
-@@ -458,7 +458,7 @@ static const struct tv_mode tv_modes[] = {
- {
- .name = "NTSC-443",
- .clock = 108000,
-- .refresh = 29970,
-+ .refresh = 59940,
- .oversample = TV_OVERSAMPLE_8X,
- .component_only = 0,
- /* 525 Lines, 60 Fields, 15.734KHz line, Sub-Carrier 4.43MHz */
-@@ -500,7 +500,7 @@ static const struct tv_mode tv_modes[] = {
- {
- .name = "NTSC-J",
- .clock = 108000,
-- .refresh = 29970,
-+ .refresh = 59940,
- .oversample = TV_OVERSAMPLE_8X,
- .component_only = 0,
-
-@@ -543,7 +543,7 @@ static const struct tv_mode tv_modes[] = {
- {
- .name = "PAL-M",
- .clock = 108000,
-- .refresh = 29970,
-+ .refresh = 59940,
- .oversample = TV_OVERSAMPLE_8X,
- .component_only = 0,
-
-@@ -587,7 +587,7 @@ static const struct tv_mode tv_modes[] = {
- /* 625 Lines, 50 Fields, 15.625KHz line, Sub-Carrier 4.434MHz */
- .name = "PAL-N",
- .clock = 108000,
-- .refresh = 25000,
-+ .refresh = 50000,
- .oversample = TV_OVERSAMPLE_8X,
- .component_only = 0,
-
-@@ -632,7 +632,7 @@ static const struct tv_mode tv_modes[] = {
- /* 625 Lines, 50 Fields, 15.625KHz line, Sub-Carrier 4.434MHz */
- .name = "PAL",
- .clock = 108000,
-- .refresh = 25000,
-+ .refresh = 50000,
- .oversample = TV_OVERSAMPLE_8X,
- .component_only = 0,
-
-@@ -819,7 +819,7 @@ static const struct tv_mode tv_modes[] = {
- {
- .name = "1080i@50Hz",
- .clock = 148800,
-- .refresh = 25000,
-+ .refresh = 50000,
- .oversample = TV_OVERSAMPLE_2X,
- .component_only = 1,
-
-@@ -845,7 +845,7 @@ static const struct tv_mode tv_modes[] = {
- {
- .name = "1080i@60Hz",
- .clock = 148800,
-- .refresh = 30000,
-+ .refresh = 60000,
- .oversample = TV_OVERSAMPLE_2X,
- .component_only = 1,
-
-diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
-index 19e68ab..c0206dc 100644
---- a/drivers/infiniband/hw/mlx4/mad.c
-+++ b/drivers/infiniband/hw/mlx4/mad.c
-@@ -252,12 +252,9 @@ int mlx4_ib_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
- return IB_MAD_RESULT_SUCCESS;
-
- /*
-- * Don't process SMInfo queries or vendor-specific
-- * MADs -- the SMA can't handle them.
-+ * Don't process SMInfo queries -- the SMA can't handle them.
- */
-- if (in_mad->mad_hdr.attr_id == IB_SMP_ATTR_SM_INFO ||
-- ((in_mad->mad_hdr.attr_id & IB_SMP_ATTR_VENDOR_MASK) ==
-- IB_SMP_ATTR_VENDOR_MASK))
-+ if (in_mad->mad_hdr.attr_id == IB_SMP_ATTR_SM_INFO)
- return IB_MAD_RESULT_SUCCESS;
- } else if (in_mad->mad_hdr.mgmt_class == IB_MGMT_CLASS_PERF_MGMT ||
- in_mad->mad_hdr.mgmt_class == MLX4_IB_VENDOR_CLASS1 ||
-diff --git a/drivers/misc/cb710/core.c b/drivers/misc/cb710/core.c
-index b14eab0..e43777e 100644
---- a/drivers/misc/cb710/core.c
-+++ b/drivers/misc/cb710/core.c
-@@ -244,6 +244,7 @@ static int __devinit cb710_probe(struct pci_dev *pdev,
- if (err)
- return err;
-
-+ spin_lock_init(&chip->irq_lock);
- chip->pdev = pdev;
- chip->iobase = pcim_iomap_table(pdev)[0];
-
-diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c
-index 99010d4..b9b37ff 100644
---- a/drivers/staging/android/binder.c
-+++ b/drivers/staging/android/binder.c
-@@ -36,6 +36,7 @@
-
- static DEFINE_MUTEX(binder_lock);
- static DEFINE_MUTEX(binder_deferred_lock);
-+static DEFINE_MUTEX(binder_mmap_lock);
-
- static HLIST_HEAD(binder_procs);
- static HLIST_HEAD(binder_deferred_list);
-@@ -614,6 +615,11 @@ static int binder_update_page_range(struct binder_proc *proc, int allocate,
- if (mm) {
- down_write(&mm->mmap_sem);
- vma = proc->vma;
-+ if (vma && mm != vma->vm_mm) {
-+ pr_err("binder: %d: vma mm and task mm mismatch\n",
-+ proc->pid);
-+ vma = NULL;
-+ }
- }
-
- if (allocate == 0)
-@@ -2741,7 +2747,6 @@ static void binder_vma_open(struct vm_area_struct *vma)
- proc->pid, vma->vm_start, vma->vm_end,
- (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags,
- (unsigned long)pgprot_val(vma->vm_page_prot));
-- dump_stack();
- }
-
- static void binder_vma_close(struct vm_area_struct *vma)
-@@ -2785,6 +2790,7 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
- }
- vma->vm_flags = (vma->vm_flags | VM_DONTCOPY) & ~VM_MAYWRITE;
-
-+ mutex_lock(&binder_mmap_lock);
- if (proc->buffer) {
- ret = -EBUSY;
- failure_string = "already mapped";
-@@ -2799,6 +2805,7 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
- }
- proc->buffer = area->addr;
- proc->user_buffer_offset = vma->vm_start - (uintptr_t)proc->buffer;
-+ mutex_unlock(&binder_mmap_lock);
-
- #ifdef CONFIG_CPU_CACHE_VIPT
- if (cache_is_vipt_aliasing()) {
-@@ -2831,7 +2838,7 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
- binder_insert_free_buffer(proc, buffer);
- proc->free_async_space = proc->buffer_size / 2;
- barrier();
-- proc->files = get_files_struct(current);
-+ proc->files = get_files_struct(proc->tsk);
- proc->vma = vma;
-
- /*printk(KERN_INFO "binder_mmap: %d %lx-%lx maps %p\n",
-@@ -2842,10 +2849,12 @@ err_alloc_small_buf_failed:
- kfree(proc->pages);
- proc->pages = NULL;
- err_alloc_pages_failed:
-+ mutex_lock(&binder_mmap_lock);
- vfree(proc->buffer);
- proc->buffer = NULL;
- err_get_vm_area_failed:
- err_already_mapped:
-+ mutex_unlock(&binder_mmap_lock);
- err_bad_arg:
- printk(KERN_ERR "binder_mmap: %d %lx-%lx %s failed %d\n",
- proc->pid, vma->vm_start, vma->vm_end, failure_string, ret);
-diff --git a/drivers/staging/asus_oled/asus_oled.c b/drivers/staging/asus_oled/asus_oled.c
-index 8a05725..ea99f05 100644
---- a/drivers/staging/asus_oled/asus_oled.c
-+++ b/drivers/staging/asus_oled/asus_oled.c
-@@ -349,7 +349,14 @@ static void send_data(struct asus_oled_dev *odev)
-
- static int append_values(struct asus_oled_dev *odev, uint8_t val, size_t count)
- {
-- while (count-- > 0 && val) {
-+ odev->last_val = val;
-+
-+ if (val == 0) {
-+ odev->buf_offs += count;
-+ return 0;
-+ }
-+
-+ while (count-- > 0) {
- size_t x = odev->buf_offs % odev->width;
- size_t y = odev->buf_offs / odev->width;
- size_t i;
-@@ -400,7 +407,6 @@ static int append_values(struct asus_oled_dev *odev, uint8_t val, size_t count)
- ;
- }
-
-- odev->last_val = val;
- odev->buf_offs++;
- }
-
-diff --git a/drivers/usb/gadget/f_loopback.c b/drivers/usb/gadget/f_loopback.c
-index 6cb29d3..8b4dbfc 100644
---- a/drivers/usb/gadget/f_loopback.c
-+++ b/drivers/usb/gadget/f_loopback.c
-@@ -373,7 +373,7 @@ int __init loopback_add(struct usb_composite_dev *cdev, bool autoresume)
-
- /* support autoresume for remote wakeup testing */
- if (autoresume)
-- sourcesink_driver.bmAttributes |= USB_CONFIG_ATT_WAKEUP;
-+ loopback_driver.bmAttributes |= USB_CONFIG_ATT_WAKEUP;
-
- /* support OTG systems */
- if (gadget_is_otg(cdev->gadget)) {
-diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
-index eae8b18..8213f79 100644
---- a/drivers/usb/host/pci-quirks.c
-+++ b/drivers/usb/host/pci-quirks.c
-@@ -498,6 +498,12 @@ hc_init:
-
- static void __devinit quirk_usb_early_handoff(struct pci_dev *pdev)
- {
-+ /* Skip Netlogic mips SoC's internal PCI USB controller.
-+ * This device does not need/support EHCI/OHCI handoff
-+ */
-+ if (pdev->vendor == 0x184e) /* vendor Netlogic */
-+ return;
-+
- if (pdev->class == PCI_CLASS_SERIAL_USB_UHCI)
- quirk_usb_handoff_uhci(pdev);
- else if (pdev->class == PCI_CLASS_SERIAL_USB_OHCI)
-diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
-index 85d630e..0a1ccaa 100644
---- a/drivers/usb/serial/ftdi_sio.c
-+++ b/drivers/usb/serial/ftdi_sio.c
-@@ -840,6 +840,7 @@ static struct usb_device_id id_table_combined [] = {
- { USB_DEVICE(FTDI_VID, FTDI_SCIENCESCOPE_LOGBOOKML_PID) },
- { USB_DEVICE(FTDI_VID, FTDI_SCIENCESCOPE_LS_LOGBOOK_PID) },
- { USB_DEVICE(FTDI_VID, FTDI_SCIENCESCOPE_HS_LOGBOOK_PID) },
-+ { USB_DEVICE(FTDI_VID, FTDI_CINTERION_MC55I_PID) },
- { USB_DEVICE(FTDI_VID, FTDI_DOTEC_PID) },
- { USB_DEVICE(QIHARDWARE_VID, MILKYMISTONE_JTAGSERIAL_PID),
- .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
-index 212fc41..7bc0abd 100644
---- a/drivers/usb/serial/ftdi_sio_ids.h
-+++ b/drivers/usb/serial/ftdi_sio_ids.h
-@@ -1192,3 +1192,10 @@
- */
- /* ZigBee controller */
- #define FTDI_RF_R106 0x8A28
-+
-+/*
-+ * Product: HCP HIT GPRS modem
-+ * Manufacturer: HCP d.o.o.
-+ * ATI command output: Cinterion MC55i
-+ */
-+#define FTDI_CINTERION_MC55I_PID 0xA951
-diff --git a/drivers/video/atmel_lcdfb.c b/drivers/video/atmel_lcdfb.c
-index d5e8010..8c5e432 100644
---- a/drivers/video/atmel_lcdfb.c
-+++ b/drivers/video/atmel_lcdfb.c
-@@ -1052,7 +1052,7 @@ static int atmel_lcdfb_suspend(struct platform_device *pdev, pm_message_t mesg)
- */
- lcdc_writel(sinfo, ATMEL_LCDC_IDR, ~0UL);
-
-- sinfo->saved_lcdcon = lcdc_readl(sinfo, ATMEL_LCDC_CONTRAST_VAL);
-+ sinfo->saved_lcdcon = lcdc_readl(sinfo, ATMEL_LCDC_CONTRAST_CTR);
- lcdc_writel(sinfo, ATMEL_LCDC_CONTRAST_CTR, 0);
- if (sinfo->atmel_lcdfb_power_control)
- sinfo->atmel_lcdfb_power_control(0);
-diff --git a/fs/ecryptfs/read_write.c b/fs/ecryptfs/read_write.c
-index 6b78546..0404659 100644
---- a/fs/ecryptfs/read_write.c
-+++ b/fs/ecryptfs/read_write.c
-@@ -134,7 +134,7 @@ int ecryptfs_write(struct file *ecryptfs_file, char *data, loff_t offset,
- pgoff_t ecryptfs_page_idx = (pos >> PAGE_CACHE_SHIFT);
- size_t start_offset_in_page = (pos & ~PAGE_CACHE_MASK);
- size_t num_bytes = (PAGE_CACHE_SIZE - start_offset_in_page);
-- size_t total_remaining_bytes = ((offset + size) - pos);
-+ loff_t total_remaining_bytes = ((offset + size) - pos);
-
- if (fatal_signal_pending(current)) {
- rc = -EINTR;
-@@ -145,7 +145,7 @@ int ecryptfs_write(struct file *ecryptfs_file, char *data, loff_t offset,
- num_bytes = total_remaining_bytes;
- if (pos < offset) {
- /* remaining zeros to write, up to destination offset */
-- size_t total_remaining_zeros = (offset - pos);
-+ loff_t total_remaining_zeros = (offset - pos);
-
- if (num_bytes > total_remaining_zeros)
- num_bytes = total_remaining_zeros;
-diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
-index eb4421b..3c759df 100644
---- a/fs/nfs/nfs4proc.c
-+++ b/fs/nfs/nfs4proc.c
-@@ -1067,6 +1067,7 @@ static int nfs4_open_recover(struct nfs4_opendata *opendata, struct nfs4_state *
- clear_bit(NFS_DELEGATED_STATE, &state->flags);
- smp_rmb();
- if (state->n_rdwr != 0) {
-+ clear_bit(NFS_O_RDWR_STATE, &state->flags);
- ret = nfs4_open_recover_helper(opendata, FMODE_READ|FMODE_WRITE, &newstate);
- if (ret != 0)
- return ret;
-@@ -1074,6 +1075,7 @@ static int nfs4_open_recover(struct nfs4_opendata *opendata, struct nfs4_state *
- return -ESTALE;
- }
- if (state->n_wronly != 0) {
-+ clear_bit(NFS_O_WRONLY_STATE, &state->flags);
- ret = nfs4_open_recover_helper(opendata, FMODE_WRITE, &newstate);
- if (ret != 0)
- return ret;
-@@ -1081,6 +1083,7 @@ static int nfs4_open_recover(struct nfs4_opendata *opendata, struct nfs4_state *
- return -ESTALE;
- }
- if (state->n_rdonly != 0) {
-+ clear_bit(NFS_O_RDONLY_STATE, &state->flags);
- ret = nfs4_open_recover_helper(opendata, FMODE_READ, &newstate);
- if (ret != 0)
- return ret;
-@@ -1490,7 +1493,7 @@ static int _nfs4_open_expired(struct nfs_open_context *ctx, struct nfs4_state *s
- return ret;
- }
-
--static inline int nfs4_do_open_expired(struct nfs_open_context *ctx, struct nfs4_state *state)
-+static int nfs4_do_open_expired(struct nfs_open_context *ctx, struct nfs4_state *state)
- {
- struct nfs_server *server = NFS_SERVER(state->inode);
- struct nfs4_exception exception = { };
-@@ -1498,10 +1501,16 @@ static inline int nfs4_do_open_expired(struct nfs_open_context *ctx, struct nfs4
-
- do {
- err = _nfs4_open_expired(ctx, state);
-- if (err != -NFS4ERR_DELAY)
-- break;
-- nfs4_handle_exception(server, err, &exception);
-+ switch (err) {
-+ default:
-+ goto out;
-+ case -NFS4ERR_GRACE:
-+ case -NFS4ERR_DELAY:
-+ nfs4_handle_exception(server, err, &exception);
-+ err = 0;
-+ }
- } while (exception.retry);
-+out:
- return err;
- }
-
-@@ -4111,10 +4120,16 @@ static int nfs4_lock_expired(struct nfs4_state *state, struct file_lock *request
- if (test_bit(NFS_DELEGATED_STATE, &state->flags) != 0)
- return 0;
- err = _nfs4_do_setlk(state, F_SETLK, request, 0);
-- if (err != -NFS4ERR_DELAY)
-- break;
-- nfs4_handle_exception(server, err, &exception);
-+ switch (err) {
-+ default:
-+ goto out;
-+ case -NFS4ERR_GRACE:
-+ case -NFS4ERR_DELAY:
-+ nfs4_handle_exception(server, err, &exception);
-+ err = 0;
-+ }
- } while (exception.retry);
-+out:
- return err;
- }
-
-diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
-index 2fd5287..2a7f163 100644
---- a/fs/nfs/nfs4state.c
-+++ b/fs/nfs/nfs4state.c
-@@ -1051,15 +1051,19 @@ static void nfs4_state_end_reclaim_nograce(struct nfs_client *clp)
- clear_bit(NFS4CLNT_RECLAIM_NOGRACE, &clp->cl_state);
- }
-
--static void nfs4_recovery_handle_error(struct nfs_client *clp, int error)
-+static int nfs4_recovery_handle_error(struct nfs_client *clp, int error)
- {
- switch (error) {
- case -NFS4ERR_CB_PATH_DOWN:
- nfs_handle_cb_pathdown(clp);
-- break;
-+ return 0;
-+ case -NFS4ERR_NO_GRACE:
-+ nfs4_state_end_reclaim_reboot(clp);
-+ return 0;
- case -NFS4ERR_STALE_CLIENTID:
- case -NFS4ERR_LEASE_MOVED:
- set_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state);
-+ nfs4_state_end_reclaim_reboot(clp);
- nfs4_state_start_reclaim_reboot(clp);
- break;
- case -NFS4ERR_EXPIRED:
-@@ -1074,6 +1078,7 @@ static void nfs4_recovery_handle_error(struct nfs_client *clp, int error)
- case -NFS4ERR_SEQ_MISORDERED:
- set_bit(NFS4CLNT_SESSION_SETUP, &clp->cl_state);
- }
-+ return error;
- }
-
- static int nfs4_do_reclaim(struct nfs_client *clp, const struct nfs4_state_recovery_ops *ops)
-@@ -1093,8 +1098,7 @@ restart:
- if (status < 0) {
- set_bit(ops->owner_flag_bit, &sp->so_flags);
- nfs4_put_state_owner(sp);
-- nfs4_recovery_handle_error(clp, status);
-- return status;
-+ return nfs4_recovery_handle_error(clp, status);
- }
- nfs4_put_state_owner(sp);
- goto restart;
-@@ -1124,8 +1128,7 @@ static int nfs4_check_lease(struct nfs_client *clp)
- status = ops->renew_lease(clp, cred);
- put_rpccred(cred);
- out:
-- nfs4_recovery_handle_error(clp, status);
-- return status;
-+ return nfs4_recovery_handle_error(clp, status);
- }
-
- static int nfs4_reclaim_lease(struct nfs_client *clp)
-@@ -1263,7 +1266,7 @@ static void nfs4_state_manager(struct nfs_client *clp)
- }
- }
- /* First recover reboot state... */
-- if (test_and_clear_bit(NFS4CLNT_RECLAIM_REBOOT, &clp->cl_state)) {
-+ if (test_bit(NFS4CLNT_RECLAIM_REBOOT, &clp->cl_state)) {
- status = nfs4_do_reclaim(clp,
- nfs4_reboot_recovery_ops[clp->cl_minorversion]);
- if (status == -NFS4ERR_STALE_CLIENTID)
-@@ -1309,8 +1312,6 @@ static void nfs4_state_manager(struct nfs_client *clp)
- out_error:
- printk(KERN_WARNING "Error: state manager failed on NFSv4 server %s"
- " with error %d\n", clp->cl_hostname, -status);
-- if (test_bit(NFS4CLNT_RECLAIM_REBOOT, &clp->cl_state))
-- nfs4_state_end_reclaim_reboot(clp);
- nfs4_clear_state_manager_bit(clp);
- }
-
-diff --git a/fs/udf/super.c b/fs/udf/super.c
-index 1e4543c..ee6b3af 100644
---- a/fs/udf/super.c
-+++ b/fs/udf/super.c
-@@ -1791,6 +1791,12 @@ static void udf_open_lvid(struct super_block *sb)
- le16_to_cpu(lvid->descTag.descCRCLength)));
-
- lvid->descTag.tagChecksum = udf_tag_checksum(&lvid->descTag);
-+ /*
-+ * We set buffer uptodate unconditionally here to avoid spurious
-+ * warnings from mark_buffer_dirty() when previous EIO has marked
-+ * the buffer as !uptodate
-+ */
-+ set_buffer_uptodate(bh);
- mark_buffer_dirty(bh);
- sbi->s_lvid_dirty = 0;
- }
-diff --git a/include/net/sock.h b/include/net/sock.h
-index 9f96394..78adf52 100644
---- a/include/net/sock.h
-+++ b/include/net/sock.h
-@@ -1354,20 +1354,7 @@ extern void sk_stop_timer(struct sock *sk, struct timer_list* timer);
-
- extern int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
-
--static inline int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
--{
-- /* Cast skb->rcvbuf to unsigned... It's pointless, but reduces
-- number of warnings when compiling with -W --ANK
-- */
-- if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
-- (unsigned)sk->sk_rcvbuf)
-- return -ENOMEM;
-- skb_set_owner_r(skb, sk);
-- skb_queue_tail(&sk->sk_error_queue, skb);
-- if (!sock_flag(sk, SOCK_DEAD))
-- sk->sk_data_ready(sk, skb->len);
-- return 0;
--}
-+extern int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb);
-
- /*
- * Recover an error report and clear atomically
-diff --git a/mm/filemap_xip.c b/mm/filemap_xip.c
-index 1888b2d..e395030 100644
---- a/mm/filemap_xip.c
-+++ b/mm/filemap_xip.c
-@@ -262,7 +262,12 @@ found:
- xip_pfn);
- if (err == -ENOMEM)
- return VM_FAULT_OOM;
-- BUG_ON(err);
-+ /*
-+ * err == -EBUSY is fine, we've raced against another thread
-+ * that faulted-in the same page
-+ */
-+ if (err != -EBUSY)
-+ BUG_ON(err);
- return VM_FAULT_NOPAGE;
- } else {
- int err, ret = VM_FAULT_OOM;
-diff --git a/net/core/skbuff.c b/net/core/skbuff.c
-index a807f8c..025f924 100644
---- a/net/core/skbuff.c
-+++ b/net/core/skbuff.c
-@@ -2977,6 +2977,34 @@ int skb_cow_data(struct sk_buff *skb, int tailbits, struct sk_buff **trailer)
- }
- EXPORT_SYMBOL_GPL(skb_cow_data);
-
-+static void sock_rmem_free(struct sk_buff *skb)
-+{
-+ struct sock *sk = skb->sk;
-+
-+ atomic_sub(skb->truesize, &sk->sk_rmem_alloc);
-+}
-+
-+/*
-+ * Note: We dont mem charge error packets (no sk_forward_alloc changes)
-+ */
-+int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
-+{
-+ if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
-+ (unsigned)sk->sk_rcvbuf)
-+ return -ENOMEM;
-+
-+ skb_orphan(skb);
-+ skb->sk = sk;
-+ skb->destructor = sock_rmem_free;
-+ atomic_add(skb->truesize, &sk->sk_rmem_alloc);
-+
-+ skb_queue_tail(&sk->sk_error_queue, skb);
-+ if (!sock_flag(sk, SOCK_DEAD))
-+ sk->sk_data_ready(sk, skb->len);
-+ return 0;
-+}
-+EXPORT_SYMBOL(sock_queue_err_skb);
-+
- void skb_tstamp_tx(struct sk_buff *orig_skb,
- struct skb_shared_hwtstamps *hwtstamps)
- {
-@@ -3008,7 +3036,9 @@ void skb_tstamp_tx(struct sk_buff *orig_skb,
- memset(serr, 0, sizeof(*serr));
- serr->ee.ee_errno = ENOMSG;
- serr->ee.ee_origin = SO_EE_ORIGIN_TIMESTAMPING;
-+
- err = sock_queue_err_skb(sk, skb);
-+
- if (err)
- kfree_skb(skb);
- }
-diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
-index 0ac8833..8e28770 100644
---- a/net/ipv4/udp.c
-+++ b/net/ipv4/udp.c
-@@ -440,9 +440,9 @@ void __udp4_lib_err(struct sk_buff *skb, u32 info, struct udp_table *udptable)
- if (!inet->recverr) {
- if (!harderr || sk->sk_state != TCP_ESTABLISHED)
- goto out;
-- } else {
-+ } else
- ip_icmp_error(sk, skb, err, uh->dest, info, (u8 *)(uh+1));
-- }
-+
- sk->sk_err = err;
- sk->sk_error_report(sk);
- out:
-diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
-index 683c99d..d37f07c 100644
---- a/net/sunrpc/xprtsock.c
-+++ b/net/sunrpc/xprtsock.c
-@@ -563,8 +563,6 @@ static int xs_udp_send_request(struct rpc_task *task)
- /* Still some bytes left; set up for a retry later. */
- status = -EAGAIN;
- }
-- if (!transport->sock)
-- goto out;
-
- switch (status) {
- case -ENOTSOCK:
-@@ -584,7 +582,7 @@ static int xs_udp_send_request(struct rpc_task *task)
- * prompts ECONNREFUSED. */
- clear_bit(SOCK_ASYNC_NOSPACE, &transport->sock->flags);
- }
--out:
-+
- return status;
- }
-
-@@ -666,8 +664,6 @@ static int xs_tcp_send_request(struct rpc_task *task)
- status = -EAGAIN;
- break;
- }
-- if (!transport->sock)
-- goto out;
-
- switch (status) {
- case -ENOTSOCK:
-@@ -687,7 +683,7 @@ static int xs_tcp_send_request(struct rpc_task *task)
- case -ENOTCONN:
- clear_bit(SOCK_ASYNC_NOSPACE, &transport->sock->flags);
- }
--out:
-+
- return status;
- }
-
diff --git a/2.6.32/1057_linux-2.6.32.58.patch b/2.6.32/1057_linux-2.6.32.58.patch
deleted file mode 100644
index 5945acc..0000000
--- a/2.6.32/1057_linux-2.6.32.58.patch
+++ /dev/null
@@ -1,1280 +0,0 @@
-diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h
-index eea4947..9cc3fe5 100644
---- a/arch/arm/include/asm/assembler.h
-+++ b/arch/arm/include/asm/assembler.h
-@@ -133,6 +133,11 @@
- disable_irq
- .endm
-
-+ .macro save_and_disable_irqs_notrace, oldcpsr
-+ mrs \oldcpsr, cpsr
-+ disable_irq_notrace
-+ .endm
-+
- /*
- * Restore interrupt state previously stored in a register. We don't
- * guarantee that this will preserve the flags.
-diff --git a/arch/arm/mm/cache-v7.S b/arch/arm/mm/cache-v7.S
-index e1bd975..632b626 100644
---- a/arch/arm/mm/cache-v7.S
-+++ b/arch/arm/mm/cache-v7.S
-@@ -39,9 +39,15 @@ loop1:
- and r1, r1, #7 @ mask of the bits for current cache only
- cmp r1, #2 @ see what cache we have at this level
- blt skip @ skip if no cache, or just i-cache
-+#ifdef CONFIG_PREEMPT
-+ save_and_disable_irqs_notrace r9 @ make cssr&csidr read atomic
-+#endif
- mcr p15, 2, r10, c0, c0, 0 @ select current cache level in cssr
- isb @ isb to sych the new cssr&csidr
- mrc p15, 1, r1, c0, c0, 0 @ read the new csidr
-+#ifdef CONFIG_PREEMPT
-+ restore_irqs_notrace r9
-+#endif
- and r2, r1, #7 @ extract the length of the cache lines
- add r2, r2, #4 @ add 4 (line length offset)
- ldr r4, =0x3ff
-diff --git a/arch/s390/include/asm/compat.h b/arch/s390/include/asm/compat.h
-index 0c940d3..82c882c 100644
---- a/arch/s390/include/asm/compat.h
-+++ b/arch/s390/include/asm/compat.h
-@@ -171,13 +171,6 @@ static inline int is_compat_task(void)
- return test_thread_flag(TIF_31BIT);
- }
-
--#else
--
--static inline int is_compat_task(void)
--{
-- return 0;
--}
--
- #endif
-
- static inline void __user *arch_compat_alloc_user_space(long len)
-diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
-index 5417eb5..cea2855 100644
---- a/arch/s390/kernel/process.c
-+++ b/arch/s390/kernel/process.c
-@@ -32,7 +32,6 @@
- #include <linux/kernel_stat.h>
- #include <linux/syscalls.h>
- #include <linux/compat.h>
--#include <asm/compat.h>
- #include <asm/uaccess.h>
- #include <asm/pgtable.h>
- #include <asm/system.h>
-diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
-index 08f8838..170e7af 100644
---- a/arch/s390/kernel/ptrace.c
-+++ b/arch/s390/kernel/ptrace.c
-@@ -36,8 +36,8 @@
- #include <linux/regset.h>
- #include <linux/tracehook.h>
- #include <linux/seccomp.h>
-+#include <linux/compat.h>
- #include <trace/syscall.h>
--#include <asm/compat.h>
- #include <asm/segment.h>
- #include <asm/page.h>
- #include <asm/pgtable.h>
-diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
-index 061479f..0b2573a 100644
---- a/arch/s390/kernel/setup.c
-+++ b/arch/s390/kernel/setup.c
-@@ -43,6 +43,7 @@
- #include <linux/reboot.h>
- #include <linux/topology.h>
- #include <linux/ftrace.h>
-+#include <linux/compat.h>
-
- #include <asm/ipl.h>
- #include <asm/uaccess.h>
-@@ -56,7 +57,6 @@
- #include <asm/ptrace.h>
- #include <asm/sections.h>
- #include <asm/ebcdic.h>
--#include <asm/compat.h>
- #include <asm/kvm_virtio.h>
-
- long psw_kernel_bits = (PSW_BASE_BITS | PSW_MASK_DAT | PSW_ASC_PRIMARY |
-diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
-index f4558cc..0ab74ae 100644
---- a/arch/s390/mm/mmap.c
-+++ b/arch/s390/mm/mmap.c
-@@ -27,8 +27,8 @@
- #include <linux/personality.h>
- #include <linux/mm.h>
- #include <linux/module.h>
-+#include <linux/compat.h>
- #include <asm/pgalloc.h>
--#include <asm/compat.h>
-
- /*
- * Top of mmap area (just below the process stack).
-diff --git a/crypto/sha512_generic.c b/crypto/sha512_generic.c
-index 88f160b..107f6f7 100644
---- a/crypto/sha512_generic.c
-+++ b/crypto/sha512_generic.c
-@@ -31,11 +31,6 @@ static inline u64 Maj(u64 x, u64 y, u64 z)
- return (x & y) | (z & (x | y));
- }
-
--static inline u64 RORu64(u64 x, u64 y)
--{
-- return (x >> y) | (x << (64 - y));
--}
--
- static const u64 sha512_K[80] = {
- 0x428a2f98d728ae22ULL, 0x7137449123ef65cdULL, 0xb5c0fbcfec4d3b2fULL,
- 0xe9b5dba58189dbbcULL, 0x3956c25bf348b538ULL, 0x59f111f1b605d019ULL,
-@@ -66,10 +61,10 @@ static const u64 sha512_K[80] = {
- 0x5fcb6fab3ad6faecULL, 0x6c44198c4a475817ULL,
- };
-
--#define e0(x) (RORu64(x,28) ^ RORu64(x,34) ^ RORu64(x,39))
--#define e1(x) (RORu64(x,14) ^ RORu64(x,18) ^ RORu64(x,41))
--#define s0(x) (RORu64(x, 1) ^ RORu64(x, 8) ^ (x >> 7))
--#define s1(x) (RORu64(x,19) ^ RORu64(x,61) ^ (x >> 6))
-+#define e0(x) (ror64(x,28) ^ ror64(x,34) ^ ror64(x,39))
-+#define e1(x) (ror64(x,14) ^ ror64(x,18) ^ ror64(x,41))
-+#define s0(x) (ror64(x, 1) ^ ror64(x, 8) ^ (x >> 7))
-+#define s1(x) (ror64(x,19) ^ ror64(x,61) ^ (x >> 6))
-
- static inline void LOAD_OP(int I, u64 *W, const u8 *input)
- {
-@@ -78,7 +73,7 @@ static inline void LOAD_OP(int I, u64 *W, const u8 *input)
-
- static inline void BLEND_OP(int I, u64 *W)
- {
-- W[I % 16] += s1(W[(I-2) % 16]) + W[(I-7) % 16] + s0(W[(I-15) % 16]);
-+ W[I & 15] += s1(W[(I-2) & 15]) + W[(I-7) & 15] + s0(W[(I-15) & 15]);
- }
-
- static void
-@@ -89,46 +84,42 @@ sha512_transform(u64 *state, const u8 *input)
- int i;
- u64 W[16];
-
-- /* load the input */
-- for (i = 0; i < 16; i++)
-- LOAD_OP(i, W, input);
--
- /* load the state into our registers */
- a=state[0]; b=state[1]; c=state[2]; d=state[3];
- e=state[4]; f=state[5]; g=state[6]; h=state[7];
-
--#define SHA512_0_15(i, a, b, c, d, e, f, g, h) \
-- t1 = h + e1(e) + Ch(e, f, g) + sha512_K[i] + W[i]; \
-- t2 = e0(a) + Maj(a, b, c); \
-- d += t1; \
-- h = t1 + t2
--
--#define SHA512_16_79(i, a, b, c, d, e, f, g, h) \
-- BLEND_OP(i, W); \
-- t1 = h + e1(e) + Ch(e, f, g) + sha512_K[i] + W[(i)%16]; \
-- t2 = e0(a) + Maj(a, b, c); \
-- d += t1; \
-- h = t1 + t2
--
-- for (i = 0; i < 16; i += 8) {
-- SHA512_0_15(i, a, b, c, d, e, f, g, h);
-- SHA512_0_15(i + 1, h, a, b, c, d, e, f, g);
-- SHA512_0_15(i + 2, g, h, a, b, c, d, e, f);
-- SHA512_0_15(i + 3, f, g, h, a, b, c, d, e);
-- SHA512_0_15(i + 4, e, f, g, h, a, b, c, d);
-- SHA512_0_15(i + 5, d, e, f, g, h, a, b, c);
-- SHA512_0_15(i + 6, c, d, e, f, g, h, a, b);
-- SHA512_0_15(i + 7, b, c, d, e, f, g, h, a);
-- }
-- for (i = 16; i < 80; i += 8) {
-- SHA512_16_79(i, a, b, c, d, e, f, g, h);
-- SHA512_16_79(i + 1, h, a, b, c, d, e, f, g);
-- SHA512_16_79(i + 2, g, h, a, b, c, d, e, f);
-- SHA512_16_79(i + 3, f, g, h, a, b, c, d, e);
-- SHA512_16_79(i + 4, e, f, g, h, a, b, c, d);
-- SHA512_16_79(i + 5, d, e, f, g, h, a, b, c);
-- SHA512_16_79(i + 6, c, d, e, f, g, h, a, b);
-- SHA512_16_79(i + 7, b, c, d, e, f, g, h, a);
-+ /* now iterate */
-+ for (i=0; i<80; i+=8) {
-+ if (!(i & 8)) {
-+ int j;
-+
-+ if (i < 16) {
-+ /* load the input */
-+ for (j = 0; j < 16; j++)
-+ LOAD_OP(i + j, W, input);
-+ } else {
-+ for (j = 0; j < 16; j++) {
-+ BLEND_OP(i + j, W);
-+ }
-+ }
-+ }
-+
-+ t1 = h + e1(e) + Ch(e,f,g) + sha512_K[i ] + W[(i & 15)];
-+ t2 = e0(a) + Maj(a,b,c); d+=t1; h=t1+t2;
-+ t1 = g + e1(d) + Ch(d,e,f) + sha512_K[i+1] + W[(i & 15) + 1];
-+ t2 = e0(h) + Maj(h,a,b); c+=t1; g=t1+t2;
-+ t1 = f + e1(c) + Ch(c,d,e) + sha512_K[i+2] + W[(i & 15) + 2];
-+ t2 = e0(g) + Maj(g,h,a); b+=t1; f=t1+t2;
-+ t1 = e + e1(b) + Ch(b,c,d) + sha512_K[i+3] + W[(i & 15) + 3];
-+ t2 = e0(f) + Maj(f,g,h); a+=t1; e=t1+t2;
-+ t1 = d + e1(a) + Ch(a,b,c) + sha512_K[i+4] + W[(i & 15) + 4];
-+ t2 = e0(e) + Maj(e,f,g); h+=t1; d=t1+t2;
-+ t1 = c + e1(h) + Ch(h,a,b) + sha512_K[i+5] + W[(i & 15) + 5];
-+ t2 = e0(d) + Maj(d,e,f); g+=t1; c=t1+t2;
-+ t1 = b + e1(g) + Ch(g,h,a) + sha512_K[i+6] + W[(i & 15) + 6];
-+ t2 = e0(c) + Maj(c,d,e); f+=t1; b=t1+t2;
-+ t1 = a + e1(f) + Ch(f,g,h) + sha512_K[i+7] + W[(i & 15) + 7];
-+ t2 = e0(b) + Maj(b,c,d); e+=t1; a=t1+t2;
- }
-
- state[0] += a; state[1] += b; state[2] += c; state[3] += d;
-diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
-index f6872f9..9589b7f 100644
---- a/drivers/base/firmware_class.c
-+++ b/drivers/base/firmware_class.c
-@@ -493,8 +493,7 @@ _request_firmware(const struct firmware **firmware_p, const char *name,
- if (!firmware) {
- dev_err(device, "%s: kmalloc(struct firmware) failed\n",
- __func__);
-- retval = -ENOMEM;
-- goto out;
-+ return -ENOMEM;
- }
-
- for (builtin = __start_builtin_fw; builtin != __end_builtin_fw;
-@@ -508,6 +507,14 @@ _request_firmware(const struct firmware **firmware_p, const char *name,
- return 0;
- }
-
-+ read_lock_usermodehelper();
-+
-+ if (WARN_ON(usermodehelper_is_disabled())) {
-+ dev_err(device, "firmware: %s will not be loaded\n", name);
-+ retval = -EBUSY;
-+ goto out;
-+ }
-+
- if (uevent)
- dev_info(device, "firmware: requesting %s\n", name);
-
-@@ -545,6 +552,7 @@ error_kfree_fw:
- kfree(firmware);
- *firmware_p = NULL;
- out:
-+ read_unlock_usermodehelper();
- return retval;
- }
-
-diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
-index 59cccc9..a4592ec 100644
---- a/drivers/cdrom/cdrom.c
-+++ b/drivers/cdrom/cdrom.c
-@@ -2057,11 +2057,6 @@ static int cdrom_read_cdda_old(struct cdrom_device_info *cdi, __u8 __user *ubuf,
- if (!nr)
- return -ENOMEM;
-
-- if (!access_ok(VERIFY_WRITE, ubuf, nframes * CD_FRAMESIZE_RAW)) {
-- ret = -EFAULT;
-- goto out;
-- }
--
- cgc.data_direction = CGC_DATA_READ;
- while (nframes > 0) {
- if (nr > nframes)
-@@ -2070,7 +2065,7 @@ static int cdrom_read_cdda_old(struct cdrom_device_info *cdi, __u8 __user *ubuf,
- ret = cdrom_read_block(cdi, &cgc, lba, nr, 1, CD_FRAMESIZE_RAW);
- if (ret)
- break;
-- if (__copy_to_user(ubuf, cgc.buffer, CD_FRAMESIZE_RAW * nr)) {
-+ if (copy_to_user(ubuf, cgc.buffer, CD_FRAMESIZE_RAW * nr)) {
- ret = -EFAULT;
- break;
- }
-@@ -2078,7 +2073,6 @@ static int cdrom_read_cdda_old(struct cdrom_device_info *cdi, __u8 __user *ubuf,
- nframes -= nr;
- lba += nr;
- }
--out:
- kfree(cgc.buffer);
- return ret;
- }
-diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
-index 96b39fc..6476022 100644
---- a/drivers/gpu/drm/i915/intel_lvds.c
-+++ b/drivers/gpu/drm/i915/intel_lvds.c
-@@ -892,6 +892,14 @@ static const struct dmi_system_id intel_no_lvds[] = {
- },
- {
- .callback = intel_no_lvds_dmi_callback,
-+ .ident = "AOpen i45GMx-I",
-+ .matches = {
-+ DMI_MATCH(DMI_BOARD_VENDOR, "AOpen"),
-+ DMI_MATCH(DMI_BOARD_NAME, "i45GMx-I"),
-+ },
-+ },
-+ {
-+ .callback = intel_no_lvds_dmi_callback,
- .ident = "Aopen i945GTt-VFA",
- .matches = {
- DMI_MATCH(DMI_PRODUCT_VERSION, "AO00001JW"),
-diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
-index c9e93ea..a2ae151 100644
---- a/drivers/gpu/drm/radeon/r100.c
-+++ b/drivers/gpu/drm/radeon/r100.c
-@@ -218,9 +218,7 @@ int r100_irq_process(struct radeon_device *rdev)
- WREG32(RADEON_AIC_CNTL, msi_rearm | RS400_MSI_REARM);
- break;
- default:
-- msi_rearm = RREG32(RADEON_MSI_REARM_EN) & ~RV370_MSI_REARM_EN;
-- WREG32(RADEON_MSI_REARM_EN, msi_rearm);
-- WREG32(RADEON_MSI_REARM_EN, msi_rearm | RV370_MSI_REARM_EN);
-+ WREG32(RADEON_MSI_REARM_EN, RV370_MSI_REARM_EN);
- break;
- }
- }
-diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
-index 1700297..52b7799 100644
---- a/drivers/gpu/drm/radeon/rs600.c
-+++ b/drivers/gpu/drm/radeon/rs600.c
-@@ -270,9 +270,7 @@ int rs600_irq_process(struct radeon_device *rdev)
- WREG32(RADEON_BUS_CNTL, msi_rearm | RS600_MSI_REARM);
- break;
- default:
-- msi_rearm = RREG32(RADEON_MSI_REARM_EN) & ~RV370_MSI_REARM_EN;
-- WREG32(RADEON_MSI_REARM_EN, msi_rearm);
-- WREG32(RADEON_MSI_REARM_EN, msi_rearm | RV370_MSI_REARM_EN);
-+ WREG32(RADEON_MSI_REARM_EN, RV370_MSI_REARM_EN);
- break;
- }
- }
-diff --git a/drivers/hwmon/f75375s.c b/drivers/hwmon/f75375s.c
-index afebc34..9ae1bae 100644
---- a/drivers/hwmon/f75375s.c
-+++ b/drivers/hwmon/f75375s.c
-@@ -159,7 +159,7 @@ static inline void f75375_write8(struct i2c_client *client, u8 reg,
- static inline void f75375_write16(struct i2c_client *client, u8 reg,
- u16 value)
- {
-- int err = i2c_smbus_write_byte_data(client, reg, (value << 8));
-+ int err = i2c_smbus_write_byte_data(client, reg, (value >> 8));
- if (err)
- return;
- i2c_smbus_write_byte_data(client, reg + 1, (value & 0xFF));
-@@ -311,7 +311,7 @@ static int set_pwm_enable_direct(struct i2c_client *client, int nr, int val)
- fanmode |= (3 << FAN_CTRL_MODE(nr));
- break;
- case 2: /* AUTOMATIC*/
-- fanmode |= (2 << FAN_CTRL_MODE(nr));
-+ fanmode |= (1 << FAN_CTRL_MODE(nr));
- break;
- case 3: /* fan speed */
- break;
-diff --git a/drivers/media/video/hdpvr/hdpvr-video.c b/drivers/media/video/hdpvr/hdpvr-video.c
-index 2eb9dc2..09f0ee0 100644
---- a/drivers/media/video/hdpvr/hdpvr-video.c
-+++ b/drivers/media/video/hdpvr/hdpvr-video.c
-@@ -279,12 +279,13 @@ static int hdpvr_start_streaming(struct hdpvr_device *dev)
-
- hdpvr_config_call(dev, CTRL_START_STREAMING_VALUE, 0x00);
-
-+ dev->status = STATUS_STREAMING;
-+
- INIT_WORK(&dev->worker, hdpvr_transmit_buffers);
- queue_work(dev->workqueue, &dev->worker);
-
- v4l2_dbg(MSG_BUFFER, hdpvr_debug, &dev->v4l2_dev,
- "streaming started\n");
-- dev->status = STATUS_STREAMING;
-
- return 0;
- }
-diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
-index 4460e00..ee23d4e 100644
---- a/drivers/s390/block/dasd_eckd.c
-+++ b/drivers/s390/block/dasd_eckd.c
-@@ -19,6 +19,7 @@
- #include <linux/bio.h>
- #include <linux/module.h>
- #include <linux/init.h>
-+#include <linux/compat.h>
-
- #include <asm/debug.h>
- #include <asm/idals.h>
-diff --git a/drivers/s390/block/dasd_ioctl.c b/drivers/s390/block/dasd_ioctl.c
-index a5354b8..0400e7c 100644
---- a/drivers/s390/block/dasd_ioctl.c
-+++ b/drivers/s390/block/dasd_ioctl.c
-@@ -13,6 +13,7 @@
- #define KMSG_COMPONENT "dasd"
-
- #include <linux/interrupt.h>
-+#include <linux/compat.h>
- #include <linux/major.h>
- #include <linux/fs.h>
- #include <linux/blkpg.h>
-diff --git a/drivers/s390/char/fs3270.c b/drivers/s390/char/fs3270.c
-index 097d384..8d1d18c 100644
---- a/drivers/s390/char/fs3270.c
-+++ b/drivers/s390/char/fs3270.c
-@@ -14,6 +14,7 @@
- #include <linux/list.h>
- #include <linux/types.h>
- #include <linux/smp_lock.h>
-+#include <linux/compat.h>
-
- #include <asm/ccwdev.h>
- #include <asm/cio.h>
-diff --git a/drivers/s390/char/vmcp.c b/drivers/s390/char/vmcp.c
-index a6087ce..99cc483 100644
---- a/drivers/s390/char/vmcp.c
-+++ b/drivers/s390/char/vmcp.c
-@@ -16,6 +16,7 @@
-
- #include <linux/fs.h>
- #include <linux/init.h>
-+#include <linux/compat.h>
- #include <linux/kernel.h>
- #include <linux/miscdevice.h>
- #include <linux/module.h>
-diff --git a/drivers/s390/cio/chsc_sch.c b/drivers/s390/cio/chsc_sch.c
-index cc5144b..d0b03bc 100644
---- a/drivers/s390/cio/chsc_sch.c
-+++ b/drivers/s390/cio/chsc_sch.c
-@@ -11,6 +11,7 @@
- #include <linux/module.h>
- #include <linux/uaccess.h>
- #include <linux/miscdevice.h>
-+#include <linux/compat.h>
-
- #include <asm/cio.h>
- #include <asm/chsc.h>
-diff --git a/drivers/s390/scsi/zfcp_cfdc.c b/drivers/s390/scsi/zfcp_cfdc.c
-index ef681df..2e37ac9 100644
---- a/drivers/s390/scsi/zfcp_cfdc.c
-+++ b/drivers/s390/scsi/zfcp_cfdc.c
-@@ -12,6 +12,7 @@
-
- #include <linux/types.h>
- #include <linux/miscdevice.h>
-+#include <linux/compat.h>
- #include <asm/ccwdev.h>
- #include "zfcp_def.h"
- #include "zfcp_ext.h"
-diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c
-index 3e250ca..1549eea 100644
---- a/drivers/scsi/3w-9xxx.c
-+++ b/drivers/scsi/3w-9xxx.c
-@@ -76,6 +76,7 @@
- Fix bug in twa_get_param() on 4GB+.
- Use pci_resource_len() for ioremap().
- 2.26.02.012 - Add power management support.
-+ 2.26.02.013 - Fix bug in twa_load_sgl().
- */
-
- #include <linux/module.h>
-@@ -100,7 +101,7 @@
- #include "3w-9xxx.h"
-
- /* Globals */
--#define TW_DRIVER_VERSION "2.26.02.012"
-+#define TW_DRIVER_VERSION "2.26.02.013"
- static TW_Device_Extension *twa_device_extension_list[TW_MAX_SLOT];
- static unsigned int twa_device_extension_count;
- static int twa_major = -1;
-@@ -1378,10 +1379,12 @@ static void twa_load_sgl(TW_Device_Extension *tw_dev, TW_Command_Full *full_comm
- newcommand = &full_command_packet->command.newcommand;
- newcommand->request_id__lunl =
- cpu_to_le16(TW_REQ_LUN_IN(TW_LUN_OUT(newcommand->request_id__lunl), request_id));
-- newcommand->sg_list[0].address = TW_CPU_TO_SGL(dma_handle + sizeof(TW_Ioctl_Buf_Apache) - 1);
-- newcommand->sg_list[0].length = cpu_to_le32(length);
-+ if (length) {
-+ newcommand->sg_list[0].address = TW_CPU_TO_SGL(dma_handle + sizeof(TW_Ioctl_Buf_Apache) - 1);
-+ newcommand->sg_list[0].length = cpu_to_le32(length);
-+ }
- newcommand->sgl_entries__lunh =
-- cpu_to_le16(TW_REQ_LUN_IN(TW_LUN_OUT(newcommand->sgl_entries__lunh), 1));
-+ cpu_to_le16(TW_REQ_LUN_IN(TW_LUN_OUT(newcommand->sgl_entries__lunh), length ? 1 : 0));
- } else {
- oldcommand = &full_command_packet->command.oldcommand;
- oldcommand->request_id = request_id;
-diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
-index 8213f79..0ff157a 100644
---- a/drivers/usb/host/pci-quirks.c
-+++ b/drivers/usb/host/pci-quirks.c
-@@ -503,7 +503,17 @@ static void __devinit quirk_usb_early_handoff(struct pci_dev *pdev)
- */
- if (pdev->vendor == 0x184e) /* vendor Netlogic */
- return;
-+ if (pdev->class != PCI_CLASS_SERIAL_USB_UHCI &&
-+ pdev->class != PCI_CLASS_SERIAL_USB_OHCI &&
-+ pdev->class != PCI_CLASS_SERIAL_USB_EHCI &&
-+ pdev->class != PCI_CLASS_SERIAL_USB_XHCI)
-+ return;
-
-+ if (pci_enable_device(pdev) < 0) {
-+ dev_warn(&pdev->dev, "Can't enable PCI device, "
-+ "BIOS handoff failed.\n");
-+ return;
-+ }
- if (pdev->class == PCI_CLASS_SERIAL_USB_UHCI)
- quirk_usb_handoff_uhci(pdev);
- else if (pdev->class == PCI_CLASS_SERIAL_USB_OHCI)
-@@ -512,5 +522,6 @@ static void __devinit quirk_usb_early_handoff(struct pci_dev *pdev)
- quirk_usb_disable_ehci(pdev);
- else if (pdev->class == PCI_CLASS_SERIAL_USB_XHCI)
- quirk_usb_handoff_xhci(pdev);
-+ pci_disable_device(pdev);
- }
- DECLARE_PCI_FIXUP_FINAL(PCI_ANY_ID, PCI_ANY_ID, quirk_usb_early_handoff);
-diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
-index a2f2f79..8c29073 100644
---- a/drivers/usb/host/xhci-mem.c
-+++ b/drivers/usb/host/xhci-mem.c
-@@ -472,26 +472,42 @@ static unsigned int xhci_parse_exponent_interval(struct usb_device *udev,
- }
-
- /*
-- * Convert bInterval expressed in frames (in 1-255 range) to exponent of
-+ * Convert bInterval expressed in microframes (in 1-255 range) to exponent of
- * microframes, rounded down to nearest power of 2.
- */
--static unsigned int xhci_parse_frame_interval(struct usb_device *udev,
-- struct usb_host_endpoint *ep)
-+static unsigned int xhci_microframes_to_exponent(struct usb_device *udev,
-+ struct usb_host_endpoint *ep, unsigned int desc_interval,
-+ unsigned int min_exponent, unsigned int max_exponent)
- {
- unsigned int interval;
-
-- interval = fls(8 * ep->desc.bInterval) - 1;
-- interval = clamp_val(interval, 3, 10);
-- if ((1 << interval) != 8 * ep->desc.bInterval)
-+ interval = fls(desc_interval) - 1;
-+ interval = clamp_val(interval, min_exponent, max_exponent);
-+ if ((1 << interval) != desc_interval)
- dev_warn(&udev->dev,
- "ep %#x - rounding interval to %d microframes, ep desc says %d microframes\n",
- ep->desc.bEndpointAddress,
- 1 << interval,
-- 8 * ep->desc.bInterval);
-+ desc_interval);
-
- return interval;
- }
-
-+static unsigned int xhci_parse_microframe_interval(struct usb_device *udev,
-+ struct usb_host_endpoint *ep)
-+{
-+ return xhci_microframes_to_exponent(udev, ep,
-+ ep->desc.bInterval, 0, 15);
-+}
-+
-+
-+static unsigned int xhci_parse_frame_interval(struct usb_device *udev,
-+ struct usb_host_endpoint *ep)
-+{
-+ return xhci_microframes_to_exponent(udev, ep,
-+ ep->desc.bInterval * 8, 3, 10);
-+}
-+
- /* Return the polling or NAK interval.
- *
- * The polling interval is expressed in "microframes". If xHCI's Interval field
-@@ -510,7 +526,7 @@ static inline unsigned int xhci_get_endpoint_interval(struct usb_device *udev,
- /* Max NAK rate */
- if (usb_endpoint_xfer_control(&ep->desc) ||
- usb_endpoint_xfer_bulk(&ep->desc)) {
-- interval = ep->desc.bInterval;
-+ interval = xhci_parse_microframe_interval(udev, ep);
- break;
- }
- /* Fall through - SS and HS isoc/int have same decoding */
-diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
-index bb16725..feb96e9 100644
---- a/drivers/usb/serial/cp210x.c
-+++ b/drivers/usb/serial/cp210x.c
-@@ -136,6 +136,8 @@ static struct usb_device_id id_table [] = {
- { USB_DEVICE(0x16DC, 0x0011) }, /* W-IE-NE-R Plein & Baus GmbH RCM Remote Control for MARATON Power Supply */
- { USB_DEVICE(0x16DC, 0x0012) }, /* W-IE-NE-R Plein & Baus GmbH MPOD Multi Channel Power Supply */
- { USB_DEVICE(0x16DC, 0x0015) }, /* W-IE-NE-R Plein & Baus GmbH CML Control, Monitoring and Data Logger */
-+ { USB_DEVICE(0x17A8, 0x0001) }, /* Kamstrup Optical Eye/3-wire */
-+ { USB_DEVICE(0x17A8, 0x0005) }, /* Kamstrup M-Bus Master MultiPort 250D */
- { USB_DEVICE(0x17F4, 0xAAAA) }, /* Wavesense Jazz blood glucose meter */
- { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
- { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
-diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h
-index 8f7cdde..5d8d9a0 100644
---- a/fs/autofs4/autofs_i.h
-+++ b/fs/autofs4/autofs_i.h
-@@ -125,6 +125,7 @@ struct autofs_sb_info {
- int sub_version;
- int min_proto;
- int max_proto;
-+ int compat_daemon;
- unsigned long exp_timeout;
- unsigned int type;
- int reghost_enabled;
-diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c
-index 00bf8fc..5bb5a2a 100644
---- a/fs/autofs4/dev-ioctl.c
-+++ b/fs/autofs4/dev-ioctl.c
-@@ -389,6 +389,7 @@ static int autofs_dev_ioctl_setpipefd(struct file *fp,
- sbi->pipefd = pipefd;
- sbi->pipe = pipe;
- sbi->catatonic = 0;
-+ sbi->compat_daemon = is_compat_task();
- }
- out:
- mutex_unlock(&sbi->wq_mutex);
-diff --git a/fs/autofs4/inode.c b/fs/autofs4/inode.c
-index 69c8142..0ca145a 100644
---- a/fs/autofs4/inode.c
-+++ b/fs/autofs4/inode.c
-@@ -19,6 +19,7 @@
- #include <linux/parser.h>
- #include <linux/bitops.h>
- #include <linux/magic.h>
-+#include <linux/compat.h>
- #include "autofs_i.h"
- #include <linux/module.h>
-
-@@ -341,6 +342,7 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent)
- set_autofs_type_indirect(&sbi->type);
- sbi->min_proto = 0;
- sbi->max_proto = 0;
-+ sbi->compat_daemon = is_compat_task();
- mutex_init(&sbi->wq_mutex);
- spin_lock_init(&sbi->fs_lock);
- sbi->queues = NULL;
-diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
-index 2341375..136a0d6 100644
---- a/fs/autofs4/waitq.c
-+++ b/fs/autofs4/waitq.c
-@@ -90,7 +90,24 @@ static int autofs4_write(struct file *file, const void *addr, int bytes)
-
- return (bytes > 0);
- }
--
-+
-+/*
-+ * The autofs_v5 packet was misdesigned.
-+ *
-+ * The packets are identical on x86-32 and x86-64, but have different
-+ * alignment. Which means that 'sizeof()' will give different results.
-+ * Fix it up for the case of running 32-bit user mode on a 64-bit kernel.
-+ */
-+static noinline size_t autofs_v5_packet_size(struct autofs_sb_info *sbi)
-+{
-+ size_t pktsz = sizeof(struct autofs_v5_packet);
-+#if defined(CONFIG_X86_64) && defined(CONFIG_COMPAT)
-+ if (sbi->compat_daemon > 0)
-+ pktsz -= 4;
-+#endif
-+ return pktsz;
-+}
-+
- static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
- struct autofs_wait_queue *wq,
- int type)
-@@ -147,8 +164,7 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
- {
- struct autofs_v5_packet *packet = &pkt.v5_pkt.v5_packet;
-
-- pktsz = sizeof(*packet);
--
-+ pktsz = autofs_v5_packet_size(sbi);
- packet->wait_queue_token = wq->wait_queue_token;
- packet->len = wq->name.len;
- memcpy(packet->name, wq->name.name, wq->name.len);
-diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
-index 4e25328..3015389 100644
---- a/fs/ecryptfs/file.c
-+++ b/fs/ecryptfs/file.c
-@@ -323,11 +323,11 @@ ecryptfs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
-
- const struct file_operations ecryptfs_dir_fops = {
- .readdir = ecryptfs_readdir,
-+ .read = generic_read_dir,
- .unlocked_ioctl = ecryptfs_unlocked_ioctl,
- #ifdef CONFIG_COMPAT
- .compat_ioctl = ecryptfs_compat_ioctl,
- #endif
-- .mmap = generic_file_mmap,
- .open = ecryptfs_open,
- .flush = ecryptfs_flush,
- .release = ecryptfs_release,
-diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
-index 88ba4d4..4434e8f 100644
---- a/fs/ecryptfs/inode.c
-+++ b/fs/ecryptfs/inode.c
-@@ -575,8 +575,8 @@ static int ecryptfs_rmdir(struct inode *dir, struct dentry *dentry)
- dget(lower_dentry);
- rc = vfs_rmdir(lower_dir_dentry->d_inode, lower_dentry);
- dput(lower_dentry);
-- if (!rc)
-- d_delete(lower_dentry);
-+ if (!rc && dentry->d_inode)
-+ clear_nlink(dentry->d_inode);
- fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode);
- dir->i_nlink = lower_dir_dentry->d_inode->i_nlink;
- unlock_dir(lower_dir_dentry);
-@@ -758,18 +758,23 @@ upper_size_to_lower_size(struct ecryptfs_crypt_stat *crypt_stat,
- }
-
- /**
-- * ecryptfs_truncate
-+ * truncate_upper
- * @dentry: The ecryptfs layer dentry
-- * @new_length: The length to expand the file to
-+ * @ia: Address of the ecryptfs inode's attributes
-+ * @lower_ia: Address of the lower inode's attributes
- *
- * Function to handle truncations modifying the size of the file. Note
- * that the file sizes are interpolated. When expanding, we are simply
-- * writing strings of 0's out. When truncating, we need to modify the
-- * underlying file size according to the page index interpolations.
-+ * writing strings of 0's out. When truncating, we truncate the upper
-+ * inode and update the lower_ia according to the page index
-+ * interpolations. If ATTR_SIZE is set in lower_ia->ia_valid upon return,
-+ * the caller must use lower_ia in a call to notify_change() to perform
-+ * the truncation of the lower inode.
- *
- * Returns zero on success; non-zero otherwise
- */
--int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
-+static int truncate_upper(struct dentry *dentry, struct iattr *ia,
-+ struct iattr *lower_ia)
- {
- int rc = 0;
- struct inode *inode = dentry->d_inode;
-@@ -780,8 +785,10 @@ int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
- loff_t lower_size_before_truncate;
- loff_t lower_size_after_truncate;
-
-- if (unlikely((new_length == i_size)))
-+ if (unlikely((ia->ia_size == i_size))) {
-+ lower_ia->ia_valid &= ~ATTR_SIZE;
- goto out;
-+ }
- crypt_stat = &ecryptfs_inode_to_private(dentry->d_inode)->crypt_stat;
- /* Set up a fake ecryptfs file, this is used to interface with
- * the file in the underlying filesystem so that the
-@@ -801,28 +808,30 @@ int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
- &fake_ecryptfs_file,
- ecryptfs_inode_to_private(dentry->d_inode)->lower_file);
- /* Switch on growing or shrinking file */
-- if (new_length > i_size) {
-+ if (ia->ia_size > i_size) {
- char zero[] = { 0x00 };
-
-+ lower_ia->ia_valid &= ~ATTR_SIZE;
- /* Write a single 0 at the last position of the file;
- * this triggers code that will fill in 0's throughout
- * the intermediate portion of the previous end of the
- * file and the new and of the file */
- rc = ecryptfs_write(&fake_ecryptfs_file, zero,
-- (new_length - 1), 1);
-- } else { /* new_length < i_size_read(inode) */
-- /* We're chopping off all the pages down do the page
-- * in which new_length is located. Fill in the end of
-- * that page from (new_length & ~PAGE_CACHE_MASK) to
-+ (ia->ia_size - 1), 1);
-+ } else { /* ia->ia_size < i_size_read(inode) */
-+ /* We're chopping off all the pages down to the page
-+ * in which ia->ia_size is located. Fill in the end of
-+ * that page from (ia->ia_size & ~PAGE_CACHE_MASK) to
- * PAGE_CACHE_SIZE with zeros. */
- size_t num_zeros = (PAGE_CACHE_SIZE
-- - (new_length & ~PAGE_CACHE_MASK));
-+ - (ia->ia_size & ~PAGE_CACHE_MASK));
-
- if (!(crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
-- rc = vmtruncate(inode, new_length);
-+ rc = vmtruncate(inode, ia->ia_size);
- if (rc)
- goto out_free;
-- rc = vmtruncate(lower_dentry->d_inode, new_length);
-+ lower_ia->ia_size = ia->ia_size;
-+ lower_ia->ia_valid |= ATTR_SIZE;
- goto out_free;
- }
- if (num_zeros) {
-@@ -834,7 +843,7 @@ int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
- goto out_free;
- }
- rc = ecryptfs_write(&fake_ecryptfs_file, zeros_virt,
-- new_length, num_zeros);
-+ ia->ia_size, num_zeros);
- kfree(zeros_virt);
- if (rc) {
- printk(KERN_ERR "Error attempting to zero out "
-@@ -843,7 +852,7 @@ int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
- goto out_free;
- }
- }
-- vmtruncate(inode, new_length);
-+ vmtruncate(inode, ia->ia_size);
- rc = ecryptfs_write_inode_size_to_metadata(inode);
- if (rc) {
- printk(KERN_ERR "Problem with "
-@@ -856,10 +865,12 @@ int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
- lower_size_before_truncate =
- upper_size_to_lower_size(crypt_stat, i_size);
- lower_size_after_truncate =
-- upper_size_to_lower_size(crypt_stat, new_length);
-- if (lower_size_after_truncate < lower_size_before_truncate)
-- vmtruncate(lower_dentry->d_inode,
-- lower_size_after_truncate);
-+ upper_size_to_lower_size(crypt_stat, ia->ia_size);
-+ if (lower_size_after_truncate < lower_size_before_truncate) {
-+ lower_ia->ia_size = lower_size_after_truncate;
-+ lower_ia->ia_valid |= ATTR_SIZE;
-+ } else
-+ lower_ia->ia_valid &= ~ATTR_SIZE;
- }
- out_free:
- if (ecryptfs_file_to_private(&fake_ecryptfs_file))
-@@ -869,6 +880,33 @@ out:
- return rc;
- }
-
-+/**
-+ * ecryptfs_truncate
-+ * @dentry: The ecryptfs layer dentry
-+ * @new_length: The length to expand the file to
-+ *
-+ * Simple function that handles the truncation of an eCryptfs inode and
-+ * its corresponding lower inode.
-+ *
-+ * Returns zero on success; non-zero otherwise
-+ */
-+int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
-+{
-+ struct iattr ia = { .ia_valid = ATTR_SIZE, .ia_size = new_length };
-+ struct iattr lower_ia = { .ia_valid = 0 };
-+ int rc;
-+
-+ rc = truncate_upper(dentry, &ia, &lower_ia);
-+ if (!rc && lower_ia.ia_valid & ATTR_SIZE) {
-+ struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
-+
-+ mutex_lock(&lower_dentry->d_inode->i_mutex);
-+ rc = notify_change(lower_dentry, &lower_ia);
-+ mutex_unlock(&lower_dentry->d_inode->i_mutex);
-+ }
-+ return rc;
-+}
-+
- static int
- ecryptfs_permission(struct inode *inode, int mask)
- {
-@@ -891,6 +929,7 @@ static int ecryptfs_setattr(struct dentry *dentry, struct iattr *ia)
- {
- int rc = 0;
- struct dentry *lower_dentry;
-+ struct iattr lower_ia;
- struct inode *inode;
- struct inode *lower_inode;
- struct ecryptfs_crypt_stat *crypt_stat;
-@@ -929,15 +968,11 @@ static int ecryptfs_setattr(struct dentry *dentry, struct iattr *ia)
- }
- }
- mutex_unlock(&crypt_stat->cs_mutex);
-+ memcpy(&lower_ia, ia, sizeof(lower_ia));
-+ if (ia->ia_valid & ATTR_FILE)
-+ lower_ia.ia_file = ecryptfs_file_to_lower(ia->ia_file);
- if (ia->ia_valid & ATTR_SIZE) {
-- ecryptfs_printk(KERN_DEBUG,
-- "ia->ia_valid = [0x%x] ATTR_SIZE" " = [0x%x]\n",
-- ia->ia_valid, ATTR_SIZE);
-- rc = ecryptfs_truncate(dentry, ia->ia_size);
-- /* ecryptfs_truncate handles resizing of the lower file */
-- ia->ia_valid &= ~ATTR_SIZE;
-- ecryptfs_printk(KERN_DEBUG, "ia->ia_valid = [%x]\n",
-- ia->ia_valid);
-+ rc = truncate_upper(dentry, ia, &lower_ia);
- if (rc < 0)
- goto out;
- }
-@@ -946,11 +981,11 @@ static int ecryptfs_setattr(struct dentry *dentry, struct iattr *ia)
- * mode change is for clearing setuid/setgid bits. Allow lower fs
- * to interpret this in its own way.
- */
-- if (ia->ia_valid & (ATTR_KILL_SUID | ATTR_KILL_SGID))
-- ia->ia_valid &= ~ATTR_MODE;
-+ if (lower_ia.ia_valid & (ATTR_KILL_SUID | ATTR_KILL_SGID))
-+ lower_ia.ia_valid &= ~ATTR_MODE;
-
- mutex_lock(&lower_dentry->d_inode->i_mutex);
-- rc = notify_change(lower_dentry, ia);
-+ rc = notify_change(lower_dentry, &lower_ia);
- mutex_unlock(&lower_dentry->d_inode->i_mutex);
- out:
- fsstack_copy_attr_all(inode, lower_inode, NULL);
-diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c
-index c6ac85d..e2f18ad 100644
---- a/fs/ecryptfs/main.c
-+++ b/fs/ecryptfs/main.c
-@@ -212,7 +212,8 @@ enum { ecryptfs_opt_sig, ecryptfs_opt_ecryptfs_sig,
- ecryptfs_opt_passthrough, ecryptfs_opt_xattr_metadata,
- ecryptfs_opt_encrypted_view, ecryptfs_opt_fnek_sig,
- ecryptfs_opt_fn_cipher, ecryptfs_opt_fn_cipher_key_bytes,
-- ecryptfs_opt_unlink_sigs, ecryptfs_opt_err };
-+ ecryptfs_opt_unlink_sigs, ecryptfs_opt_check_dev_ruid,
-+ ecryptfs_opt_err };
-
- static const match_table_t tokens = {
- {ecryptfs_opt_sig, "sig=%s"},
-@@ -227,6 +228,7 @@ static const match_table_t tokens = {
- {ecryptfs_opt_fn_cipher, "ecryptfs_fn_cipher=%s"},
- {ecryptfs_opt_fn_cipher_key_bytes, "ecryptfs_fn_key_bytes=%u"},
- {ecryptfs_opt_unlink_sigs, "ecryptfs_unlink_sigs"},
-+ {ecryptfs_opt_check_dev_ruid, "ecryptfs_check_dev_ruid"},
- {ecryptfs_opt_err, NULL}
- };
-
-@@ -270,6 +272,7 @@ static void ecryptfs_init_mount_crypt_stat(
- * ecryptfs_parse_options
- * @sb: The ecryptfs super block
- * @options: The options pased to the kernel
-+ * @check_ruid: set to 1 if device uid should be checked against the ruid
- *
- * Parse mount options:
- * debug=N - ecryptfs_verbosity level for debug output
-@@ -285,7 +288,8 @@ static void ecryptfs_init_mount_crypt_stat(
- *
- * Returns zero on success; non-zero on error
- */
--static int ecryptfs_parse_options(struct super_block *sb, char *options)
-+static int ecryptfs_parse_options(struct super_block *sb, char *options,
-+ uid_t *check_ruid)
- {
- char *p;
- int rc = 0;
-@@ -310,6 +314,8 @@ static int ecryptfs_parse_options(struct super_block *sb, char *options)
- char *cipher_key_bytes_src;
- char *fn_cipher_key_bytes_src;
-
-+ *check_ruid = 0;
-+
- if (!options) {
- rc = -EINVAL;
- goto out;
-@@ -410,6 +416,9 @@ static int ecryptfs_parse_options(struct super_block *sb, char *options)
- case ecryptfs_opt_unlink_sigs:
- mount_crypt_stat->flags |= ECRYPTFS_UNLINK_SIGS;
- break;
-+ case ecryptfs_opt_check_dev_ruid:
-+ *check_ruid = 1;
-+ break;
- case ecryptfs_opt_err:
- default:
- printk(KERN_WARNING
-@@ -487,6 +496,7 @@ out:
- }
-
- struct kmem_cache *ecryptfs_sb_info_cache;
-+static struct file_system_type ecryptfs_fs_type;
-
- /**
- * ecryptfs_fill_super
-@@ -551,7 +561,8 @@ out:
- * ecryptfs_interpose to create our initial inode and super block
- * struct.
- */
--static int ecryptfs_read_super(struct super_block *sb, const char *dev_name)
-+static int ecryptfs_read_super(struct super_block *sb, const char *dev_name,
-+ uid_t check_ruid)
- {
- struct path path;
- int rc;
-@@ -561,6 +572,22 @@ static int ecryptfs_read_super(struct super_block *sb, const char *dev_name)
- ecryptfs_printk(KERN_WARNING, "path_lookup() failed\n");
- goto out;
- }
-+ if (path.dentry->d_sb->s_type == &ecryptfs_fs_type) {
-+ rc = -EINVAL;
-+ printk(KERN_ERR "Mount on filesystem of type "
-+ "eCryptfs explicitly disallowed due to "
-+ "known incompatibilities\n");
-+ goto out_free;
-+ }
-+
-+ if (check_ruid && path.dentry->d_inode->i_uid != current_uid()) {
-+ rc = -EPERM;
-+ printk(KERN_ERR "Mount of device (uid: %d) not owned by "
-+ "requested user (uid: %d)\n",
-+ path.dentry->d_inode->i_uid, current_uid());
-+ goto out_free;
-+ }
-+
- ecryptfs_set_superblock_lower(sb, path.dentry->d_sb);
- sb->s_maxbytes = path.dentry->d_sb->s_maxbytes;
- sb->s_blocksize = path.dentry->d_sb->s_blocksize;
-@@ -599,6 +626,7 @@ static int ecryptfs_get_sb(struct file_system_type *fs_type, int flags,
- {
- int rc;
- struct super_block *sb;
-+ uid_t check_ruid;
-
- rc = get_sb_nodev(fs_type, flags, raw_data, ecryptfs_fill_super, mnt);
- if (rc < 0) {
-@@ -606,12 +634,12 @@ static int ecryptfs_get_sb(struct file_system_type *fs_type, int flags,
- goto out;
- }
- sb = mnt->mnt_sb;
-- rc = ecryptfs_parse_options(sb, raw_data);
-+ rc = ecryptfs_parse_options(sb, raw_data, &check_ruid);
- if (rc) {
- printk(KERN_ERR "Error parsing options; rc = [%d]\n", rc);
- goto out_abort;
- }
-- rc = ecryptfs_read_super(sb, dev_name);
-+ rc = ecryptfs_read_super(sb, dev_name, check_ruid);
- if (rc) {
- printk(KERN_ERR "Reading sb failed; rc = [%d]\n", rc);
- goto out_abort;
-diff --git a/include/linux/bitops.h b/include/linux/bitops.h
-index c05a29c..56835a7 100644
---- a/include/linux/bitops.h
-+++ b/include/linux/bitops.h
-@@ -46,6 +46,26 @@ static inline unsigned long hweight_long(unsigned long w)
- }
-
- /**
-+ * rol64 - rotate a 64-bit value left
-+ * @word: value to rotate
-+ * @shift: bits to roll
-+ */
-+static inline __u64 rol64(__u64 word, unsigned int shift)
-+{
-+ return (word << shift) | (word >> (64 - shift));
-+}
-+
-+/**
-+ * ror64 - rotate a 64-bit value right
-+ * @word: value to rotate
-+ * @shift: bits to roll
-+ */
-+static inline __u64 ror64(__u64 word, unsigned int shift)
-+{
-+ return (word >> shift) | (word << (64 - shift));
-+}
-+
-+/**
- * rol32 - rotate a 32-bit value left
- * @word: value to rotate
- * @shift: bits to roll
-diff --git a/include/linux/compat.h b/include/linux/compat.h
-index cab23f2..510266f 100644
---- a/include/linux/compat.h
-+++ b/include/linux/compat.h
-@@ -311,5 +311,9 @@ asmlinkage long compat_sys_openat(unsigned int dfd, const char __user *filename,
-
- extern void __user *compat_alloc_user_space(unsigned long len);
-
-+#else
-+
-+#define is_compat_task() (0)
-+
- #endif /* CONFIG_COMPAT */
- #endif /* _LINUX_COMPAT_H */
-diff --git a/include/linux/kernel.h b/include/linux/kernel.h
-index 1221fe4..9acb92d 100644
---- a/include/linux/kernel.h
-+++ b/include/linux/kernel.h
-@@ -411,14 +411,13 @@ static inline char *pack_hex_byte(char *buf, u8 byte)
- * no local ratelimit_state used in the !PRINTK case
- */
- #ifdef CONFIG_PRINTK
--#define printk_ratelimited(fmt, ...) ({ \
-- static struct ratelimit_state _rs = { \
-- .interval = DEFAULT_RATELIMIT_INTERVAL, \
-- .burst = DEFAULT_RATELIMIT_BURST, \
-- }; \
-- \
-- if (!__ratelimit(&_rs)) \
-- printk(fmt, ##__VA_ARGS__); \
-+#define printk_ratelimited(fmt, ...) ({ \
-+ static DEFINE_RATELIMIT_STATE(_rs, \
-+ DEFAULT_RATELIMIT_INTERVAL, \
-+ DEFAULT_RATELIMIT_BURST); \
-+ \
-+ if (__ratelimit(&_rs)) \
-+ printk(fmt, ##__VA_ARGS__); \
- })
- #else
- /* No effect, but we still get type checking even in the !PRINTK case: */
-diff --git a/include/linux/kmod.h b/include/linux/kmod.h
-index 384ca8b..0546fe7 100644
---- a/include/linux/kmod.h
-+++ b/include/linux/kmod.h
-@@ -104,7 +104,16 @@ struct file;
- extern int call_usermodehelper_pipe(char *path, char *argv[], char *envp[],
- struct file **filp);
-
-+#ifdef CONFIG_PM_SLEEP
- extern int usermodehelper_disable(void);
- extern void usermodehelper_enable(void);
-+extern bool usermodehelper_is_disabled(void);
-+extern void read_lock_usermodehelper(void);
-+extern void read_unlock_usermodehelper(void);
-+#else
-+static inline bool usermodehelper_is_disabled(void) { return false; }
-+static inline void read_lock_usermodehelper(void) {}
-+static inline void read_unlock_usermodehelper(void) {}
-+#endif
-
- #endif /* __LINUX_KMOD_H__ */
-diff --git a/include/linux/proportions.h b/include/linux/proportions.h
-index cf793bb..22653d7 100644
---- a/include/linux/proportions.h
-+++ b/include/linux/proportions.h
-@@ -81,7 +81,11 @@ void prop_inc_percpu(struct prop_descriptor *pd, struct prop_local_percpu *pl)
- * Limit the time part in order to ensure there are some bits left for the
- * cycle counter and fraction multiply.
- */
-+#if BITS_PER_LONG == 32
- #define PROP_MAX_SHIFT (3*BITS_PER_LONG/4)
-+#else
-+#define PROP_MAX_SHIFT (BITS_PER_LONG/2)
-+#endif
-
- #define PROP_FRAC_SHIFT (BITS_PER_LONG - PROP_MAX_SHIFT - 1)
- #define PROP_FRAC_BASE (1UL << PROP_FRAC_SHIFT)
-diff --git a/kernel/kmod.c b/kernel/kmod.c
-index d206078..a061472 100644
---- a/kernel/kmod.c
-+++ b/kernel/kmod.c
-@@ -35,6 +35,7 @@
- #include <linux/resource.h>
- #include <linux/notifier.h>
- #include <linux/suspend.h>
-+#include <linux/rwsem.h>
- #include <asm/uaccess.h>
-
- #include <trace/events/module.h>
-@@ -43,6 +44,8 @@ extern int max_threads;
-
- static struct workqueue_struct *khelper_wq;
-
-+static DECLARE_RWSEM(umhelper_sem);
-+
- #ifdef CONFIG_MODULES
-
- /*
-@@ -286,6 +289,7 @@ static void __call_usermodehelper(struct work_struct *work)
- * If set, call_usermodehelper_exec() will exit immediately returning -EBUSY
- * (used for preventing user land processes from being created after the user
- * land has been frozen during a system-wide hibernation or suspend operation).
-+ * Should always be manipulated under umhelper_sem acquired for write.
- */
- static int usermodehelper_disabled;
-
-@@ -304,6 +308,18 @@ static DECLARE_WAIT_QUEUE_HEAD(running_helpers_waitq);
- */
- #define RUNNING_HELPERS_TIMEOUT (5 * HZ)
-
-+void read_lock_usermodehelper(void)
-+{
-+ down_read(&umhelper_sem);
-+}
-+EXPORT_SYMBOL_GPL(read_lock_usermodehelper);
-+
-+void read_unlock_usermodehelper(void)
-+{
-+ up_read(&umhelper_sem);
-+}
-+EXPORT_SYMBOL_GPL(read_unlock_usermodehelper);
-+
- /**
- * usermodehelper_disable - prevent new helpers from being started
- */
-@@ -311,8 +327,10 @@ int usermodehelper_disable(void)
- {
- long retval;
-
-+ down_write(&umhelper_sem);
- usermodehelper_disabled = 1;
-- smp_mb();
-+ up_write(&umhelper_sem);
-+
- /*
- * From now on call_usermodehelper_exec() won't start any new
- * helpers, so it is sufficient if running_helpers turns out to
-@@ -325,7 +343,9 @@ int usermodehelper_disable(void)
- if (retval)
- return 0;
-
-+ down_write(&umhelper_sem);
- usermodehelper_disabled = 0;
-+ up_write(&umhelper_sem);
- return -EAGAIN;
- }
-
-@@ -334,8 +354,19 @@ int usermodehelper_disable(void)
- */
- void usermodehelper_enable(void)
- {
-+ down_write(&umhelper_sem);
- usermodehelper_disabled = 0;
-+ up_write(&umhelper_sem);
-+}
-+
-+/**
-+ * usermodehelper_is_disabled - check if new helpers are allowed to be started
-+ */
-+bool usermodehelper_is_disabled(void)
-+{
-+ return usermodehelper_disabled;
- }
-+EXPORT_SYMBOL_GPL(usermodehelper_is_disabled);
-
- static void helper_lock(void)
- {
-diff --git a/kernel/relay.c b/kernel/relay.c
-index 760c262..bf343f5 100644
---- a/kernel/relay.c
-+++ b/kernel/relay.c
-@@ -171,10 +171,14 @@ depopulate:
- */
- static struct rchan_buf *relay_create_buf(struct rchan *chan)
- {
-- struct rchan_buf *buf = kzalloc(sizeof(struct rchan_buf), GFP_KERNEL);
-- if (!buf)
-+ struct rchan_buf *buf;
-+
-+ if (chan->n_subbufs > UINT_MAX / sizeof(size_t *))
- return NULL;
-
-+ buf = kzalloc(sizeof(struct rchan_buf), GFP_KERNEL);
-+ if (!buf)
-+ return NULL;
- buf->padding = kmalloc(chan->n_subbufs * sizeof(size_t *), GFP_KERNEL);
- if (!buf->padding)
- goto free_buf;
-@@ -581,6 +585,8 @@ struct rchan *relay_open(const char *base_filename,
-
- if (!(subbuf_size && n_subbufs))
- return NULL;
-+ if (subbuf_size > UINT_MAX / n_subbufs)
-+ return NULL;
-
- chan = kzalloc(sizeof(struct rchan), GFP_KERNEL);
- if (!chan)
-diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
-index 38499c4..759f96f 100644
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -2363,7 +2363,7 @@ static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
- index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn)
- % tid_agg_rx->buf_size;
- if (!tid_agg_rx->reorder_buf[index] &&
-- tid_agg_rx->stored_mpdu_num > 1) {
-+ tid_agg_rx->stored_mpdu_num) {
- /*
- * No buffers ready to be released, but check whether any
- * frames in the reorder buffer have timed out.
diff --git a/2.6.32/1058_linux-2.6.32.59.patch b/2.6.32/1058_linux-2.6.32.59.patch
deleted file mode 100644
index 9a17e49..0000000
--- a/2.6.32/1058_linux-2.6.32.59.patch
+++ /dev/null
@@ -1,404 +0,0 @@
-diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig
-index 1ee596c..20fc9c5 100644
---- a/arch/ia64/Kconfig
-+++ b/arch/ia64/Kconfig
-@@ -502,23 +502,6 @@ config ARCH_PROC_KCORE_TEXT
- def_bool y
- depends on PROC_KCORE
-
--config IA32_SUPPORT
-- bool "Support for Linux/x86 binaries"
-- help
-- IA-64 processors can execute IA-32 (X86) instructions. By
-- saying Y here, the kernel will include IA-32 system call
-- emulation support which makes it possible to transparently
-- run IA-32 Linux binaries on an IA-64 Linux system.
-- If in doubt, say Y.
--
--config COMPAT
-- bool
-- depends on IA32_SUPPORT
-- default y
--
--config COMPAT_FOR_U64_ALIGNMENT
-- def_bool COMPAT
--
- config IA64_MCA_RECOVERY
- tristate "MCA recovery from errors other than TLB."
-
-diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
-index 43c0aca..aca7fff 100644
---- a/arch/s390/Kconfig
-+++ b/arch/s390/Kconfig
-@@ -188,6 +188,9 @@ config SYSVIPC_COMPAT
- depends on COMPAT && SYSVIPC
- default y
-
-+config KEYS_COMPAT
-+ def_bool y if COMPAT && KEYS
-+
- config AUDIT_ARCH
- bool
- default y
-diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
-index 0b2573a..358e545 100644
---- a/arch/s390/kernel/setup.c
-+++ b/arch/s390/kernel/setup.c
-@@ -57,6 +57,7 @@
- #include <asm/ptrace.h>
- #include <asm/sections.h>
- #include <asm/ebcdic.h>
-+#include <asm/compat.h>
- #include <asm/kvm_virtio.h>
-
- long psw_kernel_bits = (PSW_BASE_BITS | PSW_MASK_DAT | PSW_ASC_PRIMARY |
-diff --git a/block/bsg.c b/block/bsg.c
-index 7154a7a..e3e3241 100644
---- a/block/bsg.c
-+++ b/block/bsg.c
-@@ -977,7 +977,8 @@ void bsg_unregister_queue(struct request_queue *q)
-
- mutex_lock(&bsg_mutex);
- idr_remove(&bsg_minor_idr, bcd->minor);
-- sysfs_remove_link(&q->kobj, "bsg");
-+ if (q->kobj.sd)
-+ sysfs_remove_link(&q->kobj, "bsg");
- device_unregister(bcd->class_dev);
- bcd->class_dev = NULL;
- kref_put(&bcd->ref, bsg_kref_release_function);
-diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
-index a2e8977..605d92e 100644
---- a/drivers/block/xen-blkfront.c
-+++ b/drivers/block/xen-blkfront.c
-@@ -942,11 +942,11 @@ static void blkfront_closing(struct xenbus_device *dev)
- /* Flush gnttab callback work. Must be done with no locks held. */
- flush_scheduled_work();
-
-+ del_gendisk(info->gd);
-+
- blk_cleanup_queue(info->rq);
- info->rq = NULL;
-
-- del_gendisk(info->gd);
--
- out:
- xenbus_frontend_closed(dev);
- }
-diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
-index ca5ca5a..da33dce 100644
---- a/drivers/net/usb/usbnet.c
-+++ b/drivers/net/usb/usbnet.c
-@@ -584,6 +584,7 @@ static int unlink_urbs (struct usbnet *dev, struct sk_buff_head *q)
- entry = (struct skb_data *) skb->cb;
- urb = entry->urb;
-
-+ spin_unlock_irqrestore(&q->lock, flags);
- // during some PM-driven resume scenarios,
- // these (async) unlinks complete immediately
- retval = usb_unlink_urb (urb);
-@@ -591,6 +592,7 @@ static int unlink_urbs (struct usbnet *dev, struct sk_buff_head *q)
- devdbg (dev, "unlink urb err, %d", retval);
- else
- count++;
-+ spin_lock_irqsave(&q->lock, flags);
- }
- spin_unlock_irqrestore (&q->lock, flags);
- return count;
-diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
-index 2a9f54a..1f6bb28 100644
---- a/drivers/watchdog/hpwdt.c
-+++ b/drivers/watchdog/hpwdt.c
-@@ -220,7 +220,7 @@ static int __devinit cru_detect(unsigned long map_entry,
-
- cmn_regs.u1.reax = CRU_BIOS_SIGNATURE_VALUE;
-
-- set_memory_x((unsigned long)bios32_entrypoint, (2 * PAGE_SIZE));
-+ set_memory_x((unsigned long)bios32_map, 2);
- asminline_call(&cmn_regs, bios32_entrypoint);
-
- if (cmn_regs.u1.ral != 0) {
-@@ -239,7 +239,8 @@ static int __devinit cru_detect(unsigned long map_entry,
- cru_rom_addr =
- ioremap(cru_physical_address, cru_length);
- if (cru_rom_addr) {
-- set_memory_x((unsigned long)cru_rom_addr, cru_length);
-+ set_memory_x((unsigned long)cru_rom_addr & PAGE_MASK,
-+ (cru_length + PAGE_SIZE - 1) >> PAGE_SHIFT);
- retval = 0;
- }
- }
-diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
-index 1ed37ba..a64fde6 100644
---- a/fs/binfmt_elf.c
-+++ b/fs/binfmt_elf.c
-@@ -1452,7 +1452,7 @@ static int fill_thread_core_info(struct elf_thread_core_info *t,
- for (i = 1; i < view->n; ++i) {
- const struct user_regset *regset = &view->regsets[i];
- do_thread_regset_writeback(t->task, regset);
-- if (regset->core_note_type &&
-+ if (regset->core_note_type && regset->get &&
- (!regset->active || regset->active(t->task, regset))) {
- int ret;
- size_t size = regset->n * regset->size;
-diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
-index c3d6182..7c863b5 100644
---- a/fs/cifs/dir.c
-+++ b/fs/cifs/dir.c
-@@ -691,10 +691,26 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
- * If either that or op not supported returned, follow
- * the normal lookup.
- */
-- if ((rc == 0) || (rc == -ENOENT))
-+ switch (rc) {
-+ case 0:
-+ /*
-+ * The server may allow us to open things like
-+ * FIFOs, but the client isn't set up to deal
-+ * with that. If it's not a regular file, just
-+ * close it and proceed as if it were a normal
-+ * lookup.
-+ */
-+ if (newInode && !S_ISREG(newInode->i_mode)) {
-+ CIFSSMBClose(xid, pTcon, fileHandle);
-+ break;
-+ }
-+ case -ENOENT:
- posix_open = true;
-- else if ((rc == -EINVAL) || (rc != -EOPNOTSUPP))
-+ case -EOPNOTSUPP:
-+ break;
-+ default:
- pTcon->broken_posix_open = true;
-+ }
- }
- if (!posix_open)
- rc = cifs_get_inode_info_unix(&newInode, full_path,
-diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
-index 7a5f1ac..7e164bb 100644
---- a/fs/ecryptfs/crypto.c
-+++ b/fs/ecryptfs/crypto.c
-@@ -1455,6 +1455,25 @@ static void set_default_header_data(struct ecryptfs_crypt_stat *crypt_stat)
- ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE;
- }
-
-+void ecryptfs_i_size_init(const char *page_virt, struct inode *inode)
-+{
-+ struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
-+ struct ecryptfs_crypt_stat *crypt_stat;
-+ u64 file_size;
-+
-+ crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
-+ mount_crypt_stat =
-+ &ecryptfs_superblock_to_private(inode->i_sb)->mount_crypt_stat;
-+ if (mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED) {
-+ file_size = i_size_read(ecryptfs_inode_to_lower(inode));
-+ if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR)
-+ file_size += crypt_stat->num_header_bytes_at_front;
-+ } else
-+ file_size = get_unaligned_be64(page_virt);
-+ i_size_write(inode, (loff_t)file_size);
-+ crypt_stat->flags |= ECRYPTFS_I_SIZE_INITIALIZED;
-+}
-+
- /**
- * ecryptfs_read_headers_virt
- * @page_virt: The virtual address into which to read the headers
-@@ -1485,6 +1504,8 @@ static int ecryptfs_read_headers_virt(char *page_virt,
- rc = -EINVAL;
- goto out;
- }
-+ if (!(crypt_stat->flags & ECRYPTFS_I_SIZE_INITIALIZED))
-+ ecryptfs_i_size_init(page_virt, ecryptfs_dentry->d_inode);
- offset += MAGIC_ECRYPTFS_MARKER_SIZE_BYTES;
- rc = ecryptfs_process_flags(crypt_stat, (page_virt + offset),
- &bytes_read);
-diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h
-index 542f625..9685315 100644
---- a/fs/ecryptfs/ecryptfs_kernel.h
-+++ b/fs/ecryptfs/ecryptfs_kernel.h
-@@ -270,6 +270,7 @@ struct ecryptfs_crypt_stat {
- #define ECRYPTFS_ENCFN_USE_MOUNT_FNEK 0x00001000
- #define ECRYPTFS_ENCFN_USE_FEK 0x00002000
- #define ECRYPTFS_UNLINK_SIGS 0x00004000
-+#define ECRYPTFS_I_SIZE_INITIALIZED 0x00008000
- u32 flags;
- unsigned int file_version;
- size_t iv_bytes;
-@@ -619,6 +620,7 @@ struct ecryptfs_open_req {
- int ecryptfs_interpose(struct dentry *hidden_dentry,
- struct dentry *this_dentry, struct super_block *sb,
- u32 flags);
-+void ecryptfs_i_size_init(const char *page_virt, struct inode *inode);
- int ecryptfs_lookup_and_interpose_lower(struct dentry *ecryptfs_dentry,
- struct dentry *lower_dentry,
- struct inode *ecryptfs_dir_inode,
-diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
-index 3015389..502b09f 100644
---- a/fs/ecryptfs/file.c
-+++ b/fs/ecryptfs/file.c
-@@ -237,7 +237,8 @@ static int ecryptfs_open(struct inode *inode, struct file *file)
- goto out_free;
- }
- rc = 0;
-- crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
-+ crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
-+ | ECRYPTFS_ENCRYPTED);
- mutex_unlock(&crypt_stat->cs_mutex);
- goto out;
- }
-diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
-index 4434e8f..90a6087 100644
---- a/fs/ecryptfs/inode.c
-+++ b/fs/ecryptfs/inode.c
-@@ -256,10 +256,8 @@ int ecryptfs_lookup_and_interpose_lower(struct dentry *ecryptfs_dentry,
- struct dentry *lower_dir_dentry;
- struct vfsmount *lower_mnt;
- struct inode *lower_inode;
-- struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
- struct ecryptfs_crypt_stat *crypt_stat;
- char *page_virt = NULL;
-- u64 file_size;
- int rc = 0;
-
- lower_dir_dentry = lower_dentry->d_parent;
-@@ -334,18 +332,7 @@ int ecryptfs_lookup_and_interpose_lower(struct dentry *ecryptfs_dentry,
- }
- crypt_stat->flags |= ECRYPTFS_METADATA_IN_XATTR;
- }
-- mount_crypt_stat = &ecryptfs_superblock_to_private(
-- ecryptfs_dentry->d_sb)->mount_crypt_stat;
-- if (mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED) {
-- if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR)
-- file_size = (crypt_stat->num_header_bytes_at_front
-- + i_size_read(lower_dentry->d_inode));
-- else
-- file_size = i_size_read(lower_dentry->d_inode);
-- } else {
-- file_size = get_unaligned_be64(page_virt);
-- }
-- i_size_write(ecryptfs_dentry->d_inode, (loff_t)file_size);
-+ ecryptfs_i_size_init(page_virt, ecryptfs_dentry->d_inode);
- out_free_kmem:
- kmem_cache_free(ecryptfs_header_cache_2, page_virt);
- goto out;
-@@ -964,7 +951,8 @@ static int ecryptfs_setattr(struct dentry *dentry, struct iattr *ia)
- goto out;
- }
- rc = 0;
-- crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
-+ crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
-+ | ECRYPTFS_ENCRYPTED);
- }
- }
- mutex_unlock(&crypt_stat->cs_mutex);
-diff --git a/include/linux/backing-dev.h b/include/linux/backing-dev.h
-index b449e73..61e43a6 100644
---- a/include/linux/backing-dev.h
-+++ b/include/linux/backing-dev.h
-@@ -105,6 +105,7 @@ void bdi_start_writeback(struct backing_dev_info *bdi, struct super_block *sb,
- long nr_pages);
- int bdi_writeback_task(struct bdi_writeback *wb);
- int bdi_has_dirty_io(struct backing_dev_info *bdi);
-+void bdi_arm_supers_timer(void);
-
- extern spinlock_t bdi_lock;
- extern struct list_head bdi_list;
-diff --git a/include/linux/regset.h b/include/linux/regset.h
-index 8abee65..686f373 100644
---- a/include/linux/regset.h
-+++ b/include/linux/regset.h
-@@ -335,8 +335,11 @@ static inline int copy_regset_to_user(struct task_struct *target,
- {
- const struct user_regset *regset = &view->regsets[setno];
-
-+ if (!regset->get)
-+ return -EOPNOTSUPP;
-+
- if (!access_ok(VERIFY_WRITE, data, size))
-- return -EIO;
-+ return -EFAULT;
-
- return regset->get(target, regset, offset, size, NULL, data);
- }
-@@ -358,8 +361,11 @@ static inline int copy_regset_from_user(struct task_struct *target,
- {
- const struct user_regset *regset = &view->regsets[setno];
-
-+ if (!regset->set)
-+ return -EOPNOTSUPP;
-+
- if (!access_ok(VERIFY_READ, data, size))
-- return -EIO;
-+ return -EFAULT;
-
- return regset->set(target, regset, offset, size, NULL, data);
- }
-diff --git a/mm/backing-dev.c b/mm/backing-dev.c
-index 67a33a5..d824401 100644
---- a/mm/backing-dev.c
-+++ b/mm/backing-dev.c
-@@ -41,7 +41,6 @@ static struct timer_list sync_supers_timer;
-
- static int bdi_sync_supers(void *);
- static void sync_supers_timer_fn(unsigned long);
--static void arm_supers_timer(void);
-
- static void bdi_add_default_flusher_task(struct backing_dev_info *bdi);
-
-@@ -242,7 +241,7 @@ static int __init default_bdi_init(void)
-
- init_timer(&sync_supers_timer);
- setup_timer(&sync_supers_timer, sync_supers_timer_fn, 0);
-- arm_supers_timer();
-+ bdi_arm_supers_timer();
-
- err = bdi_init(&default_backing_dev_info);
- if (!err)
-@@ -364,10 +363,13 @@ static int bdi_sync_supers(void *unused)
- return 0;
- }
-
--static void arm_supers_timer(void)
-+void bdi_arm_supers_timer(void)
- {
- unsigned long next;
-
-+ if (!dirty_writeback_interval)
-+ return;
-+
- next = msecs_to_jiffies(dirty_writeback_interval * 10) + jiffies;
- mod_timer(&sync_supers_timer, round_jiffies_up(next));
- }
-@@ -375,7 +377,7 @@ static void arm_supers_timer(void)
- static void sync_supers_timer_fn(unsigned long unused)
- {
- wake_up_process(sync_supers_tsk);
-- arm_supers_timer();
-+ bdi_arm_supers_timer();
- }
-
- static int bdi_forker_task(void *ptr)
-@@ -418,7 +420,10 @@ static int bdi_forker_task(void *ptr)
-
- spin_unlock_bh(&bdi_lock);
- wait = msecs_to_jiffies(dirty_writeback_interval * 10);
-- schedule_timeout(wait);
-+ if (wait)
-+ schedule_timeout(wait);
-+ else
-+ schedule();
- try_to_freeze();
- continue;
- }
-diff --git a/mm/page-writeback.c b/mm/page-writeback.c
-index 2c5d792..52f71ae 100644
---- a/mm/page-writeback.c
-+++ b/mm/page-writeback.c
-@@ -694,6 +694,7 @@ int dirty_writeback_centisecs_handler(ctl_table *table, int write,
- void __user *buffer, size_t *length, loff_t *ppos)
- {
- proc_dointvec(table, write, buffer, length, ppos);
-+ bdi_arm_supers_timer();
- return 0;
- }
-
diff --git a/2.6.32/1059_linux-2.6.32.60.patch b/2.6.32/1059_linux-2.6.32.60.patch
deleted file mode 100644
index 5f975dd..0000000
--- a/2.6.32/1059_linux-2.6.32.60.patch
+++ /dev/null
@@ -1,7740 +0,0 @@
-diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
-index c840e7d..14c7fb0 100644
---- a/Documentation/kernel-parameters.txt
-+++ b/Documentation/kernel-parameters.txt
-@@ -1725,6 +1725,11 @@ and is between 256 and 4096 characters. It is defined in the file
-
- noresidual [PPC] Don't use residual data on PReP machines.
-
-+ nordrand [X86] Disable the direct use of the RDRAND
-+ instruction even if it is supported by the
-+ processor. RDRAND is still available to user
-+ space applications.
-+
- noresume [SWSUSP] Disables resume and restores original swap
- space.
-
-diff --git a/Documentation/stable_kernel_rules.txt b/Documentation/stable_kernel_rules.txt
-index e6e482f..3c9d7ac 100644
---- a/Documentation/stable_kernel_rules.txt
-+++ b/Documentation/stable_kernel_rules.txt
-@@ -12,6 +12,12 @@ Rules on what kind of patches are accepted, and which ones are not, into the
- marked CONFIG_BROKEN), an oops, a hang, data corruption, a real
- security issue, or some "oh, that's not good" issue. In short, something
- critical.
-+ - Serious issues as reported by a user of a distribution kernel may also
-+ be considered if they fix a notable performance or interactivity issue.
-+ As these fixes are not as obvious and have a higher risk of a subtle
-+ regression they should only be submitted by a distribution kernel
-+ maintainer and include an addendum linking to a bugzilla entry if it
-+ exists and additional information on the user-visible impact.
- - New device IDs and quirks are also accepted.
- - No "theoretical race condition" issues, unless an explanation of how the
- race can be exploited is also provided.
-diff --git a/MAINTAINERS b/MAINTAINERS
-index 613da5d..334258c 100644
---- a/MAINTAINERS
-+++ b/MAINTAINERS
-@@ -4379,7 +4379,7 @@ F: Documentation/blockdev/ramdisk.txt
- F: drivers/block/brd.c
-
- RANDOM NUMBER DRIVER
--M: Matt Mackall <mpm@selenic.com>
-+M: Theodore Ts'o" <tytso@mit.edu>
- S: Maintained
- F: drivers/char/random.c
-
-diff --git a/arch/arm/kernel/sys_arm.c b/arch/arm/kernel/sys_arm.c
-index ae4027b..2dd070f 100644
---- a/arch/arm/kernel/sys_arm.c
-+++ b/arch/arm/kernel/sys_arm.c
-@@ -240,7 +240,7 @@ int kernel_execve(const char *filename, char *const argv[], char *const envp[])
- "Ir" (THREAD_START_SP - sizeof(regs)),
- "r" (®s),
- "Ir" (sizeof(regs))
-- : "r0", "r1", "r2", "r3", "ip", "lr", "memory");
-+ : "r0", "r1", "r2", "r3", "r8", "r9", "ip", "lr", "memory");
-
- out:
- return ret;
-diff --git a/arch/ia64/include/asm/unistd.h b/arch/ia64/include/asm/unistd.h
-index 5a5347f..08a0e5c 100644
---- a/arch/ia64/include/asm/unistd.h
-+++ b/arch/ia64/include/asm/unistd.h
-@@ -311,11 +311,12 @@
- #define __NR_preadv 1319
- #define __NR_pwritev 1320
- #define __NR_rt_tgsigqueueinfo 1321
-+#define __NR_accept4 1334
-
- #ifdef __KERNEL__
-
-
--#define NR_syscalls 298 /* length of syscall table */
-+#define NR_syscalls 311 /* length of syscall table */
-
- /*
- * The following defines stop scripts/checksyscalls.sh from complaining about
-diff --git a/arch/ia64/kernel/entry.S b/arch/ia64/kernel/entry.S
-index d0e7d37..e3be543 100644
---- a/arch/ia64/kernel/entry.S
-+++ b/arch/ia64/kernel/entry.S
-@@ -1806,6 +1806,19 @@ sys_call_table:
- data8 sys_preadv
- data8 sys_pwritev // 1320
- data8 sys_rt_tgsigqueueinfo
-+ data8 sys_ni_syscall
-+ data8 sys_ni_syscall
-+ data8 sys_ni_syscall
-+ data8 sys_ni_syscall // 1325
-+ data8 sys_ni_syscall
-+ data8 sys_ni_syscall
-+ data8 sys_ni_syscall
-+ data8 sys_ni_syscall
-+ data8 sys_ni_syscall // 1330
-+ data8 sys_ni_syscall
-+ data8 sys_ni_syscall
-+ data8 sys_ni_syscall
-+ data8 sys_accept4
-
- .org sys_call_table + 8*NR_syscalls // guard against failures to increase NR_syscalls
- #endif /* __IA64_ASM_PARAVIRTUALIZED_NATIVE */
-diff --git a/arch/ia64/kernel/irq_ia64.c b/arch/ia64/kernel/irq_ia64.c
-index dd9d7b5..463b8a7 100644
---- a/arch/ia64/kernel/irq_ia64.c
-+++ b/arch/ia64/kernel/irq_ia64.c
-@@ -24,7 +24,6 @@
- #include <linux/kernel_stat.h>
- #include <linux/slab.h>
- #include <linux/ptrace.h>
--#include <linux/random.h> /* for rand_initialize_irq() */
- #include <linux/signal.h>
- #include <linux/smp.h>
- #include <linux/threads.h>
-diff --git a/arch/ia64/kvm/kvm-ia64.c b/arch/ia64/kvm/kvm-ia64.c
-index 2eb6365..0edba06 100644
---- a/arch/ia64/kvm/kvm-ia64.c
-+++ b/arch/ia64/kvm/kvm-ia64.c
-@@ -1185,6 +1185,11 @@ out:
-
- #define PALE_RESET_ENTRY 0x80000000ffffffb0UL
-
-+bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu)
-+{
-+ return irqchip_in_kernel(vcpu->kvm) == (vcpu->arch.apic != NULL);
-+}
-+
- int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
- {
- struct kvm_vcpu *v;
-diff --git a/arch/mips/include/asm/thread_info.h b/arch/mips/include/asm/thread_info.h
-index 845da21..0e50757 100644
---- a/arch/mips/include/asm/thread_info.h
-+++ b/arch/mips/include/asm/thread_info.h
-@@ -60,6 +60,8 @@ struct thread_info {
- register struct thread_info *__current_thread_info __asm__("$28");
- #define current_thread_info() __current_thread_info
-
-+#endif /* !__ASSEMBLY__ */
-+
- /* thread information allocation */
- #if defined(CONFIG_PAGE_SIZE_4KB) && defined(CONFIG_32BIT)
- #define THREAD_SIZE_ORDER (1)
-@@ -93,8 +95,6 @@ register struct thread_info *__current_thread_info __asm__("$28");
-
- #define free_thread_info(info) kfree(info)
-
--#endif /* !__ASSEMBLY__ */
--
- #define PREEMPT_ACTIVE 0x10000000
-
- /*
-diff --git a/arch/mips/kernel/vmlinux.lds.S b/arch/mips/kernel/vmlinux.lds.S
-index 162b299..d5c95d6 100644
---- a/arch/mips/kernel/vmlinux.lds.S
-+++ b/arch/mips/kernel/vmlinux.lds.S
-@@ -1,5 +1,6 @@
- #include <asm/asm-offsets.h>
- #include <asm/page.h>
-+#include <asm/thread_info.h>
- #include <asm-generic/vmlinux.lds.h>
-
- #undef mips
-@@ -70,7 +71,7 @@ SECTIONS
- .data : { /* Data */
- . = . + DATAOFFSET; /* for CONFIG_MAPPED_KERNEL */
-
-- INIT_TASK_DATA(PAGE_SIZE)
-+ INIT_TASK_DATA(THREAD_SIZE)
- NOSAVE_DATA
- CACHELINE_ALIGNED_DATA(1 << CONFIG_MIPS_L1_CACHE_SHIFT)
- DATA_DATA
-diff --git a/arch/parisc/include/asm/atomic.h b/arch/parisc/include/asm/atomic.h
-index 8bc9e96..6ee459d 100644
---- a/arch/parisc/include/asm/atomic.h
-+++ b/arch/parisc/include/asm/atomic.h
-@@ -248,7 +248,7 @@ static __inline__ int atomic_add_unless(atomic_t *v, int a, int u)
-
- #define atomic_sub_and_test(i,v) (atomic_sub_return((i),(v)) == 0)
-
--#define ATOMIC_INIT(i) ((atomic_t) { (i) })
-+#define ATOMIC_INIT(i) { (i) }
-
- #define smp_mb__before_atomic_dec() smp_mb()
- #define smp_mb__after_atomic_dec() smp_mb()
-@@ -257,7 +257,7 @@ static __inline__ int atomic_add_unless(atomic_t *v, int a, int u)
-
- #ifdef CONFIG_64BIT
-
--#define ATOMIC64_INIT(i) ((atomic64_t) { (i) })
-+#define ATOMIC64_INIT(i) { (i) }
-
- static __inline__ int
- __atomic64_add_return(s64 i, atomic64_t *v)
-diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
-index 32a7c30..6ce44dd 100644
---- a/arch/powerpc/include/asm/reg.h
-+++ b/arch/powerpc/include/asm/reg.h
-@@ -870,7 +870,8 @@
- /* Macros for setting and retrieving special purpose registers */
- #ifndef __ASSEMBLY__
- #define mfmsr() ({unsigned long rval; \
-- asm volatile("mfmsr %0" : "=r" (rval)); rval;})
-+ asm volatile("mfmsr %0" : "=r" (rval) : \
-+ : "memory"); rval;})
- #ifdef CONFIG_PPC64
- #define __mtmsrd(v, l) asm volatile("mtmsrd %0," __stringify(l) \
- : : "r" (v) : "memory")
-diff --git a/arch/powerpc/kernel/ftrace.c b/arch/powerpc/kernel/ftrace.c
-index ce1f3e4..eda40d2 100644
---- a/arch/powerpc/kernel/ftrace.c
-+++ b/arch/powerpc/kernel/ftrace.c
-@@ -244,9 +244,9 @@ __ftrace_make_nop(struct module *mod,
-
- /*
- * On PPC32 the trampoline looks like:
-- * 0x3d, 0x60, 0x00, 0x00 lis r11,sym@ha
-- * 0x39, 0x6b, 0x00, 0x00 addi r11,r11,sym@l
-- * 0x7d, 0x69, 0x03, 0xa6 mtctr r11
-+ * 0x3d, 0x80, 0x00, 0x00 lis r12,sym@ha
-+ * 0x39, 0x8c, 0x00, 0x00 addi r12,r12,sym@l
-+ * 0x7d, 0x89, 0x03, 0xa6 mtctr r12
- * 0x4e, 0x80, 0x04, 0x20 bctr
- */
-
-@@ -261,9 +261,9 @@ __ftrace_make_nop(struct module *mod,
- pr_devel(" %08x %08x ", jmp[0], jmp[1]);
-
- /* verify that this is what we expect it to be */
-- if (((jmp[0] & 0xffff0000) != 0x3d600000) ||
-- ((jmp[1] & 0xffff0000) != 0x396b0000) ||
-- (jmp[2] != 0x7d6903a6) ||
-+ if (((jmp[0] & 0xffff0000) != 0x3d800000) ||
-+ ((jmp[1] & 0xffff0000) != 0x398c0000) ||
-+ (jmp[2] != 0x7d8903a6) ||
- (jmp[3] != 0x4e800420)) {
- printk(KERN_ERR "Not a trampoline\n");
- return -EINVAL;
-diff --git a/arch/powerpc/kernel/module_32.c b/arch/powerpc/kernel/module_32.c
-index f832773..449a7e0 100644
---- a/arch/powerpc/kernel/module_32.c
-+++ b/arch/powerpc/kernel/module_32.c
-@@ -187,8 +187,8 @@ int apply_relocate(Elf32_Shdr *sechdrs,
-
- static inline int entry_matches(struct ppc_plt_entry *entry, Elf32_Addr val)
- {
-- if (entry->jump[0] == 0x3d600000 + ((val + 0x8000) >> 16)
-- && entry->jump[1] == 0x396b0000 + (val & 0xffff))
-+ if (entry->jump[0] == 0x3d800000 + ((val + 0x8000) >> 16)
-+ && entry->jump[1] == 0x398c0000 + (val & 0xffff))
- return 1;
- return 0;
- }
-@@ -215,10 +215,9 @@ static uint32_t do_plt_call(void *location,
- entry++;
- }
-
-- /* Stolen from Paul Mackerras as well... */
-- entry->jump[0] = 0x3d600000+((val+0x8000)>>16); /* lis r11,sym@ha */
-- entry->jump[1] = 0x396b0000 + (val&0xffff); /* addi r11,r11,sym@l*/
-- entry->jump[2] = 0x7d6903a6; /* mtctr r11 */
-+ entry->jump[0] = 0x3d800000+((val+0x8000)>>16); /* lis r12,sym@ha */
-+ entry->jump[1] = 0x398c0000 + (val&0xffff); /* addi r12,r12,sym@l*/
-+ entry->jump[2] = 0x7d8903a6; /* mtctr r12 */
- entry->jump[3] = 0x4e800420; /* bctr */
-
- DEBUGP("Initialized plt for 0x%x at %p\n", val, entry);
-diff --git a/arch/powerpc/platforms/powermac/smp.c b/arch/powerpc/platforms/powermac/smp.c
-index b40c22d..7f66d0c 100644
---- a/arch/powerpc/platforms/powermac/smp.c
-+++ b/arch/powerpc/platforms/powermac/smp.c
-@@ -402,7 +402,7 @@ static struct irqaction psurge_irqaction = {
-
- static void __init smp_psurge_setup_cpu(int cpu_nr)
- {
-- if (cpu_nr != 0)
-+ if (cpu_nr != 0 || !psurge_start)
- return;
-
- /* reset the entry point so if we get another intr we won't
-diff --git a/arch/sparc/Makefile b/arch/sparc/Makefile
-index 113225b..0538555 100644
---- a/arch/sparc/Makefile
-+++ b/arch/sparc/Makefile
-@@ -31,7 +31,7 @@ UTS_MACHINE := sparc
-
- #KBUILD_CFLAGS += -g -pipe -fcall-used-g5 -fcall-used-g7
- KBUILD_CFLAGS += -m32 -pipe -mno-fpu -fcall-used-g5 -fcall-used-g7
--KBUILD_AFLAGS += -m32
-+KBUILD_AFLAGS += -m32 -Wa,-Av8
-
- #LDFLAGS_vmlinux = -N -Ttext 0xf0004000
- # Since 2.5.40, the first stage is left not btfix-ed.
-diff --git a/arch/sparc/kernel/ds.c b/arch/sparc/kernel/ds.c
-index 4a700f4..6a831bd 100644
---- a/arch/sparc/kernel/ds.c
-+++ b/arch/sparc/kernel/ds.c
-@@ -1242,4 +1242,4 @@ static int __init ds_init(void)
- return vio_register_driver(&ds_driver);
- }
-
--subsys_initcall(ds_init);
-+fs_initcall(ds_init);
-diff --git a/arch/sparc/kernel/rtrap_64.S b/arch/sparc/kernel/rtrap_64.S
-index fd3cee4..cc4b1ff 100644
---- a/arch/sparc/kernel/rtrap_64.S
-+++ b/arch/sparc/kernel/rtrap_64.S
-@@ -20,11 +20,6 @@
-
- .text
- .align 32
--__handle_softirq:
-- call do_softirq
-- nop
-- ba,a,pt %xcc, __handle_softirq_continue
-- nop
- __handle_preemption:
- call schedule
- wrpr %g0, RTRAP_PSTATE, %pstate
-@@ -159,9 +154,7 @@ rtrap:
- cmp %l1, 0
-
- /* mm/ultra.S:xcall_report_regs KNOWS about this load. */
-- bne,pn %icc, __handle_softirq
- ldx [%sp + PTREGS_OFF + PT_V9_TSTATE], %l1
--__handle_softirq_continue:
- rtrap_xcall:
- sethi %hi(0xf << 20), %l4
- and %l1, %l4, %l4
-diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
-index 73ae02a..aa889d6 100644
---- a/arch/x86/Kconfig
-+++ b/arch/x86/Kconfig
-@@ -1428,6 +1428,15 @@ config ARCH_USES_PG_UNCACHED
- def_bool y
- depends on X86_PAT
-
-+config ARCH_RANDOM
-+ def_bool y
-+ prompt "x86 architectural random number generator" if EXPERT
-+ ---help---
-+ Enable the x86 architectural RDRAND instruction
-+ (Intel Bull Mountain technology) to generate random numbers.
-+ If supported, this is a high bandwidth, cryptographically
-+ secure hardware random number generator.
-+
- config EFI
- bool "EFI runtime service support"
- depends on ACPI
-diff --git a/arch/x86/include/asm/archrandom.h b/arch/x86/include/asm/archrandom.h
-new file mode 100644
-index 0000000..0d9ec77
---- /dev/null
-+++ b/arch/x86/include/asm/archrandom.h
-@@ -0,0 +1,75 @@
-+/*
-+ * This file is part of the Linux kernel.
-+ *
-+ * Copyright (c) 2011, Intel Corporation
-+ * Authors: Fenghua Yu <fenghua.yu@intel.com>,
-+ * H. Peter Anvin <hpa@linux.intel.com>
-+ *
-+ * This program is free software; you can redistribute it and/or modify it
-+ * under the terms and conditions of the GNU General Public License,
-+ * version 2, as published by the Free Software Foundation.
-+ *
-+ * This program is distributed in the hope it will be useful, but WITHOUT
-+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
-+ * more details.
-+ *
-+ * You should have received a copy of the GNU General Public License along with
-+ * this program; if not, write to the Free Software Foundation, Inc.,
-+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-+ *
-+ */
-+
-+#ifndef ASM_X86_ARCHRANDOM_H
-+#define ASM_X86_ARCHRANDOM_H
-+
-+#include <asm/processor.h>
-+#include <asm/cpufeature.h>
-+#include <asm/alternative.h>
-+#include <asm/nops.h>
-+
-+#define RDRAND_RETRY_LOOPS 10
-+
-+#define RDRAND_INT ".byte 0x0f,0xc7,0xf0"
-+#ifdef CONFIG_X86_64
-+# define RDRAND_LONG ".byte 0x48,0x0f,0xc7,0xf0"
-+#else
-+# define RDRAND_LONG RDRAND_INT
-+#endif
-+
-+#ifdef CONFIG_ARCH_RANDOM
-+
-+#define GET_RANDOM(name, type, rdrand, nop) \
-+static inline int name(type *v) \
-+{ \
-+ int ok; \
-+ alternative_io("movl $0, %0\n\t" \
-+ nop, \
-+ "\n1: " rdrand "\n\t" \
-+ "jc 2f\n\t" \
-+ "decl %0\n\t" \
-+ "jnz 1b\n\t" \
-+ "2:", \
-+ X86_FEATURE_RDRAND, \
-+ ASM_OUTPUT2("=r" (ok), "=a" (*v)), \
-+ "0" (RDRAND_RETRY_LOOPS)); \
-+ return ok; \
-+}
-+
-+#ifdef CONFIG_X86_64
-+
-+GET_RANDOM(arch_get_random_long, unsigned long, RDRAND_LONG, ASM_NOP5);
-+GET_RANDOM(arch_get_random_int, unsigned int, RDRAND_INT, ASM_NOP4);
-+
-+#else
-+
-+GET_RANDOM(arch_get_random_long, unsigned long, RDRAND_LONG, ASM_NOP3);
-+GET_RANDOM(arch_get_random_int, unsigned int, RDRAND_INT, ASM_NOP3);
-+
-+#endif /* CONFIG_X86_64 */
-+
-+#endif /* CONFIG_ARCH_RANDOM */
-+
-+extern void x86_init_rdrand(struct cpuinfo_x86 *c);
-+
-+#endif /* ASM_X86_ARCHRANDOM_H */
-diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
-index 1efb1fa..27929b8 100644
---- a/arch/x86/include/asm/cpufeature.h
-+++ b/arch/x86/include/asm/cpufeature.h
-@@ -124,6 +124,8 @@
- #define X86_FEATURE_XSAVE (4*32+26) /* XSAVE/XRSTOR/XSETBV/XGETBV */
- #define X86_FEATURE_OSXSAVE (4*32+27) /* "" XSAVE enabled in the OS */
- #define X86_FEATURE_AVX (4*32+28) /* Advanced Vector Extensions */
-+#define X86_FEATURE_F16C (4*32+29) /* 16-bit fp conversions */
-+#define X86_FEATURE_RDRAND (4*32+30) /* The RDRAND instruction */
- #define X86_FEATURE_HYPERVISOR (4*32+31) /* Running on a hypervisor */
-
- /* VIA/Cyrix/Centaur-defined CPU features, CPUID level 0xC0000001, word 5 */
-diff --git a/arch/x86/include/asm/k8.h b/arch/x86/include/asm/k8.h
-index f0746f4..41845d2 100644
---- a/arch/x86/include/asm/k8.h
-+++ b/arch/x86/include/asm/k8.h
-@@ -1,11 +1,13 @@
- #ifndef _ASM_X86_K8_H
- #define _ASM_X86_K8_H
-
-+#include <linux/ioport.h>
- #include <linux/pci.h>
-
- extern struct pci_device_id k8_nb_ids[];
-
- extern int early_is_k8_nb(u32 value);
-+extern struct resource *amd_get_mmconfig_range(struct resource *res);
- extern struct pci_dev **k8_northbridges;
- extern int num_k8_northbridges;
- extern int cache_k8_northbridges(void);
-diff --git a/arch/x86/include/asm/kvm_emulate.h b/arch/x86/include/asm/kvm_emulate.h
-index 5ed59ec..cc44e3d 100644
---- a/arch/x86/include/asm/kvm_emulate.h
-+++ b/arch/x86/include/asm/kvm_emulate.h
-@@ -109,6 +109,8 @@ struct x86_emulate_ops {
- unsigned int bytes,
- struct kvm_vcpu *vcpu);
-
-+ bool (*get_cpuid)(struct x86_emulate_ctxt *ctxt,
-+ u32 *eax, u32 *ebx, u32 *ecx, u32 *edx);
- };
-
- /* Type, address-of, and value of an instruction's operand. */
-@@ -190,6 +192,19 @@ struct x86_emulate_ctxt {
- #define X86EMUL_MODE_HOST X86EMUL_MODE_PROT64
- #endif
-
-+/* CPUID vendors */
-+#define X86EMUL_CPUID_VENDOR_AuthenticAMD_ebx 0x68747541
-+#define X86EMUL_CPUID_VENDOR_AuthenticAMD_ecx 0x444d4163
-+#define X86EMUL_CPUID_VENDOR_AuthenticAMD_edx 0x69746e65
-+
-+#define X86EMUL_CPUID_VENDOR_AMDisbetterI_ebx 0x69444d41
-+#define X86EMUL_CPUID_VENDOR_AMDisbetterI_ecx 0x21726574
-+#define X86EMUL_CPUID_VENDOR_AMDisbetterI_edx 0x74656273
-+
-+#define X86EMUL_CPUID_VENDOR_GenuineIntel_ebx 0x756e6547
-+#define X86EMUL_CPUID_VENDOR_GenuineIntel_ecx 0x6c65746e
-+#define X86EMUL_CPUID_VENDOR_GenuineIntel_edx 0x49656e69
-+
- int x86_decode_insn(struct x86_emulate_ctxt *ctxt,
- struct x86_emulate_ops *ops);
- int x86_emulate_insn(struct x86_emulate_ctxt *ctxt,
-diff --git a/arch/x86/include/asm/timer.h b/arch/x86/include/asm/timer.h
-index b93a9aa..18e1ca7 100644
---- a/arch/x86/include/asm/timer.h
-+++ b/arch/x86/include/asm/timer.h
-@@ -63,14 +63,10 @@ DECLARE_PER_CPU(unsigned long long, cyc2ns_offset);
-
- static inline unsigned long long __cycles_2_ns(unsigned long long cyc)
- {
-- unsigned long long quot;
-- unsigned long long rem;
- int cpu = smp_processor_id();
- unsigned long long ns = per_cpu(cyc2ns_offset, cpu);
-- quot = (cyc >> CYC2NS_SCALE_FACTOR);
-- rem = cyc & ((1ULL << CYC2NS_SCALE_FACTOR) - 1);
-- ns += quot * per_cpu(cyc2ns, cpu) +
-- ((rem * per_cpu(cyc2ns, cpu)) >> CYC2NS_SCALE_FACTOR);
-+ ns += mult_frac(cyc, per_cpu(cyc2ns, cpu),
-+ (1UL << CYC2NS_SCALE_FACTOR));
- return ns;
- }
-
-diff --git a/arch/x86/kernel/cpu/Makefile b/arch/x86/kernel/cpu/Makefile
-index ff502cc..1f537a2 100644
---- a/arch/x86/kernel/cpu/Makefile
-+++ b/arch/x86/kernel/cpu/Makefile
-@@ -14,6 +14,7 @@ CFLAGS_common.o := $(nostackp)
- obj-y := intel_cacheinfo.o addon_cpuid_features.o
- obj-y += proc.o capflags.o powerflags.o common.o
- obj-y += vmware.o hypervisor.o sched.o
-+obj-y += rdrand.o
-
- obj-$(CONFIG_X86_32) += bugs.o cmpxchg.o
- obj-$(CONFIG_X86_64) += bugs_64.o
-diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
-index 4e34d10..ba1a1dd 100644
---- a/arch/x86/kernel/cpu/common.c
-+++ b/arch/x86/kernel/cpu/common.c
-@@ -15,6 +15,7 @@
- #include <asm/stackprotector.h>
- #include <asm/perf_event.h>
- #include <asm/mmu_context.h>
-+#include <asm/archrandom.h>
- #include <asm/hypervisor.h>
- #include <asm/processor.h>
- #include <asm/sections.h>
-@@ -815,6 +816,7 @@ static void __cpuinit identify_cpu(struct cpuinfo_x86 *c)
- #endif
-
- init_hypervisor(c);
-+ x86_init_rdrand(c);
-
- /*
- * Clear/Set all flags overriden by options, need do it
-diff --git a/arch/x86/kernel/cpu/rdrand.c b/arch/x86/kernel/cpu/rdrand.c
-new file mode 100644
-index 0000000..feca286
---- /dev/null
-+++ b/arch/x86/kernel/cpu/rdrand.c
-@@ -0,0 +1,73 @@
-+/*
-+ * This file is part of the Linux kernel.
-+ *
-+ * Copyright (c) 2011, Intel Corporation
-+ * Authors: Fenghua Yu <fenghua.yu@intel.com>,
-+ * H. Peter Anvin <hpa@linux.intel.com>
-+ *
-+ * This program is free software; you can redistribute it and/or modify it
-+ * under the terms and conditions of the GNU General Public License,
-+ * version 2, as published by the Free Software Foundation.
-+ *
-+ * This program is distributed in the hope it will be useful, but WITHOUT
-+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
-+ * more details.
-+ *
-+ * You should have received a copy of the GNU General Public License along with
-+ * this program; if not, write to the Free Software Foundation, Inc.,
-+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-+ *
-+ */
-+
-+#include <asm/processor.h>
-+#include <asm/archrandom.h>
-+#include <asm/sections.h>
-+
-+static int __init x86_rdrand_setup(char *s)
-+{
-+ setup_clear_cpu_cap(X86_FEATURE_RDRAND);
-+ return 1;
-+}
-+__setup("nordrand", x86_rdrand_setup);
-+
-+/* We can't use arch_get_random_long() here since alternatives haven't run */
-+static inline int rdrand_long(unsigned long *v)
-+{
-+ int ok;
-+ asm volatile("1: " RDRAND_LONG "\n\t"
-+ "jc 2f\n\t"
-+ "decl %0\n\t"
-+ "jnz 1b\n\t"
-+ "2:"
-+ : "=r" (ok), "=a" (*v)
-+ : "0" (RDRAND_RETRY_LOOPS));
-+ return ok;
-+}
-+
-+/*
-+ * Force a reseed cycle; we are architecturally guaranteed a reseed
-+ * after no more than 512 128-bit chunks of random data. This also
-+ * acts as a test of the CPU capability.
-+ */
-+#define RESEED_LOOP ((512*128)/sizeof(unsigned long))
-+
-+void __cpuinit x86_init_rdrand(struct cpuinfo_x86 *c)
-+{
-+#ifdef CONFIG_ARCH_RANDOM
-+ unsigned long tmp;
-+ int i, count, ok;
-+
-+ if (!cpu_has(c, X86_FEATURE_RDRAND))
-+ return; /* Nothing to do */
-+
-+ for (count = i = 0; i < RESEED_LOOP; i++) {
-+ ok = rdrand_long(&tmp);
-+ if (ok)
-+ count++;
-+ }
-+
-+ if (count != RESEED_LOOP)
-+ clear_cpu_cap(c, X86_FEATURE_RDRAND);
-+#endif
-+}
-diff --git a/arch/x86/kernel/k8.c b/arch/x86/kernel/k8.c
-index 9b89546..2831a32 100644
---- a/arch/x86/kernel/k8.c
-+++ b/arch/x86/kernel/k8.c
-@@ -87,6 +87,37 @@ int __init early_is_k8_nb(u32 device)
- return 0;
- }
-
-+struct resource *amd_get_mmconfig_range(struct resource *res)
-+{
-+ u32 address;
-+ u64 base, msr;
-+ unsigned segn_busn_bits;
-+
-+ if (boot_cpu_data.x86_vendor != X86_VENDOR_AMD)
-+ return NULL;
-+
-+ /* assume all cpus from fam10h have mmconfig */
-+ if (boot_cpu_data.x86 < 0x10)
-+ return NULL;
-+
-+ address = MSR_FAM10H_MMIO_CONF_BASE;
-+ rdmsrl(address, msr);
-+
-+ /* mmconfig is not enabled */
-+ if (!(msr & FAM10H_MMIO_CONF_ENABLE))
-+ return NULL;
-+
-+ base = msr & (FAM10H_MMIO_CONF_BASE_MASK<<FAM10H_MMIO_CONF_BASE_SHIFT);
-+
-+ segn_busn_bits = (msr >> FAM10H_MMIO_CONF_BUSRANGE_SHIFT) &
-+ FAM10H_MMIO_CONF_BUSRANGE_MASK;
-+
-+ res->flags = IORESOURCE_MEM;
-+ res->start = base;
-+ res->end = base + (1ULL<<(segn_busn_bits + 20)) - 1;
-+ return res;
-+}
-+
- void k8_flush_garts(void)
- {
- int flushed, i;
-diff --git a/arch/x86/kernel/tls.c b/arch/x86/kernel/tls.c
-index 6bb7b85..bcfec2d 100644
---- a/arch/x86/kernel/tls.c
-+++ b/arch/x86/kernel/tls.c
-@@ -163,7 +163,7 @@ int regset_tls_get(struct task_struct *target, const struct user_regset *regset,
- {
- const struct desc_struct *tls;
-
-- if (pos > GDT_ENTRY_TLS_ENTRIES * sizeof(struct user_desc) ||
-+ if (pos >= GDT_ENTRY_TLS_ENTRIES * sizeof(struct user_desc) ||
- (pos % sizeof(struct user_desc)) != 0 ||
- (count % sizeof(struct user_desc)) != 0)
- return -EINVAL;
-@@ -198,7 +198,7 @@ int regset_tls_set(struct task_struct *target, const struct user_regset *regset,
- struct user_desc infobuf[GDT_ENTRY_TLS_ENTRIES];
- const struct user_desc *info;
-
-- if (pos > GDT_ENTRY_TLS_ENTRIES * sizeof(struct user_desc) ||
-+ if (pos >= GDT_ENTRY_TLS_ENTRIES * sizeof(struct user_desc) ||
- (pos % sizeof(struct user_desc)) != 0 ||
- (count % sizeof(struct user_desc)) != 0)
- return -EINVAL;
-diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
-index bc07543..9972276 100644
---- a/arch/x86/kernel/tsc.c
-+++ b/arch/x86/kernel/tsc.c
-@@ -623,7 +623,8 @@ static void set_cyc2ns_scale(unsigned long cpu_khz, int cpu)
-
- if (cpu_khz) {
- *scale = (NSEC_PER_MSEC << CYC2NS_SCALE_FACTOR)/cpu_khz;
-- *offset = ns_now - (tsc_now * *scale >> CYC2NS_SCALE_FACTOR);
-+ *offset = ns_now - mult_frac(tsc_now, *scale,
-+ (1UL << CYC2NS_SCALE_FACTOR));
- }
-
- sched_clock_idle_wakeup_event(0);
-diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
-index 1350e43..aa2d905 100644
---- a/arch/x86/kvm/emulate.c
-+++ b/arch/x86/kvm/emulate.c
-@@ -1495,20 +1495,73 @@ setup_syscalls_segments(struct x86_emulate_ctxt *ctxt,
- ss->present = 1;
- }
-
-+static bool em_syscall_is_enabled(struct x86_emulate_ctxt *ctxt,
-+ struct x86_emulate_ops *ops)
-+{
-+ u32 eax, ebx, ecx, edx;
-+
-+ /*
-+ * syscall should always be enabled in longmode - so only become
-+ * vendor specific (cpuid) if other modes are active...
-+ */
-+ if (ctxt->mode == X86EMUL_MODE_PROT64)
-+ return true;
-+
-+ eax = 0x00000000;
-+ ecx = 0x00000000;
-+ if (ops->get_cpuid(ctxt, &eax, &ebx, &ecx, &edx)) {
-+ /*
-+ * Intel ("GenuineIntel")
-+ * remark: Intel CPUs only support "syscall" in 64bit
-+ * longmode. Also an 64bit guest with a
-+ * 32bit compat-app running will #UD !! While this
-+ * behaviour can be fixed (by emulating) into AMD
-+ * response - CPUs of AMD can't behave like Intel.
-+ */
-+ if (ebx == X86EMUL_CPUID_VENDOR_GenuineIntel_ebx &&
-+ ecx == X86EMUL_CPUID_VENDOR_GenuineIntel_ecx &&
-+ edx == X86EMUL_CPUID_VENDOR_GenuineIntel_edx)
-+ return false;
-+
-+ /* AMD ("AuthenticAMD") */
-+ if (ebx == X86EMUL_CPUID_VENDOR_AuthenticAMD_ebx &&
-+ ecx == X86EMUL_CPUID_VENDOR_AuthenticAMD_ecx &&
-+ edx == X86EMUL_CPUID_VENDOR_AuthenticAMD_edx)
-+ return true;
-+
-+ /* AMD ("AMDisbetter!") */
-+ if (ebx == X86EMUL_CPUID_VENDOR_AMDisbetterI_ebx &&
-+ ecx == X86EMUL_CPUID_VENDOR_AMDisbetterI_ecx &&
-+ edx == X86EMUL_CPUID_VENDOR_AMDisbetterI_edx)
-+ return true;
-+ }
-+
-+ /* default: (not Intel, not AMD), apply Intel's stricter rules... */
-+ return false;
-+}
-+
- static int
--emulate_syscall(struct x86_emulate_ctxt *ctxt)
-+emulate_syscall(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
- {
- struct decode_cache *c = &ctxt->decode;
- struct kvm_segment cs, ss;
- u64 msr_data;
-+ u64 efer = 0;
-
- /* syscall is not available in real mode */
- if (c->lock_prefix || ctxt->mode == X86EMUL_MODE_REAL
- || ctxt->mode == X86EMUL_MODE_VM86)
- return -1;
-
-+ if (!(em_syscall_is_enabled(ctxt, ops)))
-+ return -1;
-+
-+ kvm_x86_ops->get_msr(ctxt->vcpu, MSR_EFER, &efer);
- setup_syscalls_segments(ctxt, &cs, &ss);
-
-+ if (!(efer & EFER_SCE))
-+ return -1;
-+
- kvm_x86_ops->get_msr(ctxt->vcpu, MSR_STAR, &msr_data);
- msr_data >>= 32;
- cs.selector = (u16)(msr_data & 0xfffc);
-@@ -2342,7 +2395,7 @@ twobyte_insn:
- }
- break;
- case 0x05: /* syscall */
-- if (emulate_syscall(ctxt) == -1)
-+ if (emulate_syscall(ctxt, ops) == -1)
- goto cannot_emulate;
- else
- goto writeback;
-diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
-index 88ad162..7e361b4 100644
---- a/arch/x86/kvm/i8254.c
-+++ b/arch/x86/kvm/i8254.c
-@@ -277,11 +277,15 @@ static struct kvm_timer_ops kpit_ops = {
- .is_periodic = kpit_is_periodic,
- };
-
--static void create_pit_timer(struct kvm_kpit_state *ps, u32 val, int is_period)
-+static void create_pit_timer(struct kvm *kvm, u32 val, int is_period)
- {
-+ struct kvm_kpit_state *ps = &kvm->arch.vpit->pit_state;
- struct kvm_timer *pt = &ps->pit_timer;
- s64 interval;
-
-+ if (!irqchip_in_kernel(kvm))
-+ return;
-+
- interval = muldiv64(val, NSEC_PER_SEC, KVM_PIT_FREQ);
-
- pr_debug("pit: create pit timer, interval is %llu nsec\n", interval);
-@@ -333,13 +337,13 @@ static void pit_load_count(struct kvm *kvm, int channel, u32 val)
- /* FIXME: enhance mode 4 precision */
- case 4:
- if (!(ps->flags & KVM_PIT_FLAGS_HPET_LEGACY)) {
-- create_pit_timer(ps, val, 0);
-+ create_pit_timer(kvm, val, 0);
- }
- break;
- case 2:
- case 3:
- if (!(ps->flags & KVM_PIT_FLAGS_HPET_LEGACY)){
-- create_pit_timer(ps, val, 1);
-+ create_pit_timer(kvm, val, 1);
- }
- break;
- default:
-diff --git a/arch/x86/kvm/irq.h b/arch/x86/kvm/irq.h
-index 7d6058a..85a8721 100644
---- a/arch/x86/kvm/irq.h
-+++ b/arch/x86/kvm/irq.h
-@@ -85,7 +85,11 @@ static inline struct kvm_pic *pic_irqchip(struct kvm *kvm)
-
- static inline int irqchip_in_kernel(struct kvm *kvm)
- {
-- return pic_irqchip(kvm) != NULL;
-+ int ret;
-+
-+ ret = (pic_irqchip(kvm) != NULL);
-+ smp_rmb();
-+ return ret;
- }
-
- void kvm_pic_reset(struct kvm_kpic_state *s);
-diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index df1cefb..271fddf 100644
---- a/arch/x86/kvm/x86.c
-+++ b/arch/x86/kvm/x86.c
-@@ -2273,25 +2273,42 @@ long kvm_arch_vm_ioctl(struct file *filp,
- if (r)
- goto out;
- break;
-- case KVM_CREATE_IRQCHIP:
-+ case KVM_CREATE_IRQCHIP: {
-+ struct kvm_pic *vpic;
-+
-+ mutex_lock(&kvm->lock);
-+ r = -EEXIST;
-+ if (kvm->arch.vpic)
-+ goto create_irqchip_unlock;
-+ r = -EINVAL;
-+ if (atomic_read(&kvm->online_vcpus))
-+ goto create_irqchip_unlock;
- r = -ENOMEM;
-- kvm->arch.vpic = kvm_create_pic(kvm);
-- if (kvm->arch.vpic) {
-+ vpic = kvm_create_pic(kvm);
-+ if (vpic) {
- r = kvm_ioapic_init(kvm);
- if (r) {
-- kfree(kvm->arch.vpic);
-- kvm->arch.vpic = NULL;
-- goto out;
-+ kfree(vpic);
-+ goto create_irqchip_unlock;
- }
- } else
-- goto out;
-+ goto create_irqchip_unlock;
-+ smp_wmb();
-+ kvm->arch.vpic = vpic;
-+ smp_wmb();
- r = kvm_setup_default_irq_routing(kvm);
- if (r) {
-+ mutex_lock(&kvm->irq_lock);
- kfree(kvm->arch.vpic);
- kfree(kvm->arch.vioapic);
-- goto out;
-+ kvm->arch.vpic = NULL;
-+ kvm->arch.vioapic = NULL;
-+ mutex_unlock(&kvm->irq_lock);
- }
-+ create_irqchip_unlock:
-+ mutex_unlock(&kvm->lock);
- break;
-+ }
- case KVM_CREATE_PIT:
- u.pit_config.flags = KVM_PIT_SPEAKER_DUMMY;
- goto create_pit;
-@@ -2871,12 +2888,35 @@ void kvm_report_emulation_failure(struct kvm_vcpu *vcpu, const char *context)
- }
- EXPORT_SYMBOL_GPL(kvm_report_emulation_failure);
-
-+static bool emulator_get_cpuid(struct x86_emulate_ctxt *ctxt,
-+ u32 *eax, u32 *ebx, u32 *ecx, u32 *edx)
-+{
-+ struct kvm_cpuid_entry2 *cpuid = NULL;
-+
-+ if (eax && ecx)
-+ cpuid = kvm_find_cpuid_entry(ctxt->vcpu,
-+ *eax, *ecx);
-+
-+ if (cpuid) {
-+ *eax = cpuid->eax;
-+ *ecx = cpuid->ecx;
-+ if (ebx)
-+ *ebx = cpuid->ebx;
-+ if (edx)
-+ *edx = cpuid->edx;
-+ return true;
-+ }
-+
-+ return false;
-+}
-+
- static struct x86_emulate_ops emulate_ops = {
- .read_std = kvm_read_guest_virt_system,
- .fetch = kvm_fetch_guest_virt,
- .read_emulated = emulator_read_emulated,
- .write_emulated = emulator_write_emulated,
- .cmpxchg_emulated = emulator_cmpxchg_emulated,
-+ .get_cpuid = emulator_get_cpuid,
- };
-
- static void cache_all_regs(struct kvm_vcpu *vcpu)
-@@ -4990,6 +5030,11 @@ void kvm_arch_check_processor_compat(void *rtn)
- kvm_x86_ops->check_processor_compatibility(rtn);
- }
-
-+bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu)
-+{
-+ return irqchip_in_kernel(vcpu->kvm) == (vcpu->arch.apic != NULL);
-+}
-+
- int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
- {
- struct page *page;
-diff --git a/arch/x86/lib/delay.c b/arch/x86/lib/delay.c
-index ff485d3..b6372ce 100644
---- a/arch/x86/lib/delay.c
-+++ b/arch/x86/lib/delay.c
-@@ -48,9 +48,9 @@ static void delay_loop(unsigned long loops)
- }
-
- /* TSC based delay: */
--static void delay_tsc(unsigned long loops)
-+static void delay_tsc(unsigned long __loops)
- {
-- unsigned long bclock, now;
-+ u32 bclock, now, loops = __loops;
- int cpu;
-
- preempt_disable();
-diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
-index 8ac0d76..249ad57 100644
---- a/arch/x86/mm/fault.c
-+++ b/arch/x86/mm/fault.c
-@@ -223,15 +223,14 @@ void vmalloc_sync_all(void)
- address >= TASK_SIZE && address < FIXADDR_TOP;
- address += PMD_SIZE) {
-
-- unsigned long flags;
- struct page *page;
-
-- spin_lock_irqsave(&pgd_lock, flags);
-+ spin_lock(&pgd_lock);
- list_for_each_entry(page, &pgd_list, lru) {
- if (!vmalloc_sync_one(page_address(page), address))
- break;
- }
-- spin_unlock_irqrestore(&pgd_lock, flags);
-+ spin_unlock(&pgd_lock);
- }
- }
-
-@@ -331,13 +330,12 @@ void vmalloc_sync_all(void)
- address += PGDIR_SIZE) {
-
- const pgd_t *pgd_ref = pgd_offset_k(address);
-- unsigned long flags;
- struct page *page;
-
- if (pgd_none(*pgd_ref))
- continue;
-
-- spin_lock_irqsave(&pgd_lock, flags);
-+ spin_lock(&pgd_lock);
- list_for_each_entry(page, &pgd_list, lru) {
- pgd_t *pgd;
- pgd = (pgd_t *)page_address(page) + pgd_index(address);
-@@ -346,7 +344,7 @@ void vmalloc_sync_all(void)
- else
- BUG_ON(pgd_page_vaddr(*pgd) != pgd_page_vaddr(*pgd_ref));
- }
-- spin_unlock_irqrestore(&pgd_lock, flags);
-+ spin_unlock(&pgd_lock);
- }
- }
-
-diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
-index dd38bfb..6d44087 100644
---- a/arch/x86/mm/pageattr.c
-+++ b/arch/x86/mm/pageattr.c
-@@ -56,12 +56,10 @@ static unsigned long direct_pages_count[PG_LEVEL_NUM];
-
- void update_page_count(int level, unsigned long pages)
- {
-- unsigned long flags;
--
- /* Protect against CPA */
-- spin_lock_irqsave(&pgd_lock, flags);
-+ spin_lock(&pgd_lock);
- direct_pages_count[level] += pages;
-- spin_unlock_irqrestore(&pgd_lock, flags);
-+ spin_unlock(&pgd_lock);
- }
-
- static void split_page_count(int level)
-@@ -354,7 +352,7 @@ static int
- try_preserve_large_page(pte_t *kpte, unsigned long address,
- struct cpa_data *cpa)
- {
-- unsigned long nextpage_addr, numpages, pmask, psize, flags, addr, pfn;
-+ unsigned long nextpage_addr, numpages, pmask, psize, addr, pfn;
- pte_t new_pte, old_pte, *tmp;
- pgprot_t old_prot, new_prot;
- int i, do_split = 1;
-@@ -363,7 +361,7 @@ try_preserve_large_page(pte_t *kpte, unsigned long address,
- if (cpa->force_split)
- return 1;
-
-- spin_lock_irqsave(&pgd_lock, flags);
-+ spin_lock(&pgd_lock);
- /*
- * Check for races, another CPU might have split this page
- * up already:
-@@ -458,14 +456,14 @@ try_preserve_large_page(pte_t *kpte, unsigned long address,
- }
-
- out_unlock:
-- spin_unlock_irqrestore(&pgd_lock, flags);
-+ spin_unlock(&pgd_lock);
-
- return do_split;
- }
-
- static int split_large_page(pte_t *kpte, unsigned long address)
- {
-- unsigned long flags, pfn, pfninc = 1;
-+ unsigned long pfn, pfninc = 1;
- unsigned int i, level;
- pte_t *pbase, *tmp;
- pgprot_t ref_prot;
-@@ -479,7 +477,7 @@ static int split_large_page(pte_t *kpte, unsigned long address)
- if (!base)
- return -ENOMEM;
-
-- spin_lock_irqsave(&pgd_lock, flags);
-+ spin_lock(&pgd_lock);
- /*
- * Check for races, another CPU might have split this page
- * up for us already:
-@@ -551,7 +549,7 @@ out_unlock:
- */
- if (base)
- __free_page(base);
-- spin_unlock_irqrestore(&pgd_lock, flags);
-+ spin_unlock(&pgd_lock);
-
- return 0;
- }
-diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
-index e0e6fad..cb7cfc8 100644
---- a/arch/x86/mm/pgtable.c
-+++ b/arch/x86/mm/pgtable.c
-@@ -110,14 +110,12 @@ static void pgd_ctor(pgd_t *pgd)
-
- static void pgd_dtor(pgd_t *pgd)
- {
-- unsigned long flags; /* can be called from interrupt context */
--
- if (SHARED_KERNEL_PMD)
- return;
-
-- spin_lock_irqsave(&pgd_lock, flags);
-+ spin_lock(&pgd_lock);
- pgd_list_del(pgd);
-- spin_unlock_irqrestore(&pgd_lock, flags);
-+ spin_unlock(&pgd_lock);
- }
-
- /*
-@@ -248,7 +246,6 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
- {
- pgd_t *pgd;
- pmd_t *pmds[PREALLOCATED_PMDS];
-- unsigned long flags;
-
- pgd = (pgd_t *)__get_free_page(PGALLOC_GFP);
-
-@@ -268,12 +265,12 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
- * respect to anything walking the pgd_list, so that they
- * never see a partially populated pgd.
- */
-- spin_lock_irqsave(&pgd_lock, flags);
-+ spin_lock(&pgd_lock);
-
- pgd_ctor(pgd);
- pgd_prepopulate_pmd(mm, pgd, pmds);
-
-- spin_unlock_irqrestore(&pgd_lock, flags);
-+ spin_unlock(&pgd_lock);
-
- return pgd;
-
-diff --git a/arch/x86/oprofile/backtrace.c b/arch/x86/oprofile/backtrace.c
-index 829edf0..b50a280 100644
---- a/arch/x86/oprofile/backtrace.c
-+++ b/arch/x86/oprofile/backtrace.c
-@@ -71,9 +71,9 @@ copy_from_user_nmi(void *to, const void __user *from, unsigned long n)
- offset = addr & (PAGE_SIZE - 1);
- size = min(PAGE_SIZE - offset, n - len);
-
-- map = kmap_atomic(page, KM_USER0);
-+ map = kmap_atomic(page, KM_NMI);
- memcpy(to, map+offset, size);
-- kunmap_atomic(map, KM_USER0);
-+ kunmap_atomic(map, KM_NMI);
- put_page(page);
-
- len += size;
-diff --git a/arch/x86/pci/amd_bus.c b/arch/x86/pci/amd_bus.c
-index 572ee97..aae9931 100644
---- a/arch/x86/pci/amd_bus.c
-+++ b/arch/x86/pci/amd_bus.c
-@@ -3,6 +3,7 @@
- #include <linux/topology.h>
- #include <linux/cpu.h>
- #include <asm/pci_x86.h>
-+#include <asm/k8.h>
-
- #ifdef CONFIG_X86_64
- #include <asm/pci-direct.h>
-@@ -190,34 +191,6 @@ static struct pci_hostbridge_probe pci_probes[] __initdata = {
- { 0, 0x18, PCI_VENDOR_ID_AMD, 0x1300 },
- };
-
--static u64 __initdata fam10h_mmconf_start;
--static u64 __initdata fam10h_mmconf_end;
--static void __init get_pci_mmcfg_amd_fam10h_range(void)
--{
-- u32 address;
-- u64 base, msr;
-- unsigned segn_busn_bits;
--
-- /* assume all cpus from fam10h have mmconf */
-- if (boot_cpu_data.x86 < 0x10)
-- return;
--
-- address = MSR_FAM10H_MMIO_CONF_BASE;
-- rdmsrl(address, msr);
--
-- /* mmconfig is not enable */
-- if (!(msr & FAM10H_MMIO_CONF_ENABLE))
-- return;
--
-- base = msr & (FAM10H_MMIO_CONF_BASE_MASK<<FAM10H_MMIO_CONF_BASE_SHIFT);
--
-- segn_busn_bits = (msr >> FAM10H_MMIO_CONF_BUSRANGE_SHIFT) &
-- FAM10H_MMIO_CONF_BUSRANGE_MASK;
--
-- fam10h_mmconf_start = base;
-- fam10h_mmconf_end = base + (1ULL<<(segn_busn_bits + 20)) - 1;
--}
--
- /**
- * early_fill_mp_bus_to_node()
- * called before pcibios_scan_root and pci_scan_bus
-@@ -243,6 +216,9 @@ static int __init early_fill_mp_bus_info(void)
- struct res_range range[RANGE_NUM];
- u64 val;
- u32 address;
-+ struct resource fam10h_mmconf_res, *fam10h_mmconf;
-+ u64 fam10h_mmconf_start;
-+ u64 fam10h_mmconf_end;
-
- if (!early_pci_allowed())
- return -1;
-@@ -367,11 +343,16 @@ static int __init early_fill_mp_bus_info(void)
- update_range(range, 0, end - 1);
-
- /* get mmconfig */
-- get_pci_mmcfg_amd_fam10h_range();
-+ fam10h_mmconf = amd_get_mmconfig_range(&fam10h_mmconf_res);
- /* need to take out mmconf range */
-- if (fam10h_mmconf_end) {
-- printk(KERN_DEBUG "Fam 10h mmconf [%llx, %llx]\n", fam10h_mmconf_start, fam10h_mmconf_end);
-+ if (fam10h_mmconf) {
-+ printk(KERN_DEBUG "Fam 10h mmconf %pR\n", fam10h_mmconf);
-+ fam10h_mmconf_start = fam10h_mmconf->start;
-+ fam10h_mmconf_end = fam10h_mmconf->end;
- update_range(range, fam10h_mmconf_start, fam10h_mmconf_end);
-+ } else {
-+ fam10h_mmconf_start = 0;
-+ fam10h_mmconf_end = 0;
- }
-
- /* mmio resource */
-diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
-index 0087b00..d52f895 100644
---- a/arch/x86/xen/enlighten.c
-+++ b/arch/x86/xen/enlighten.c
-@@ -945,7 +945,10 @@ static const struct pv_cpu_ops xen_cpu_ops __initdata = {
- .wbinvd = native_wbinvd,
-
- .read_msr = native_read_msr_safe,
-+ .rdmsr_regs = native_rdmsr_safe_regs,
- .write_msr = xen_write_msr_safe,
-+ .wrmsr_regs = native_wrmsr_safe_regs,
-+
- .read_tsc = native_read_tsc,
- .read_pmc = native_read_pmc,
-
-diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
-index 3f90a2c..8f4452c 100644
---- a/arch/x86/xen/mmu.c
-+++ b/arch/x86/xen/mmu.c
-@@ -987,10 +987,9 @@ static void xen_pgd_pin(struct mm_struct *mm)
- */
- void xen_mm_pin_all(void)
- {
-- unsigned long flags;
- struct page *page;
-
-- spin_lock_irqsave(&pgd_lock, flags);
-+ spin_lock(&pgd_lock);
-
- list_for_each_entry(page, &pgd_list, lru) {
- if (!PagePinned(page)) {
-@@ -999,7 +998,7 @@ void xen_mm_pin_all(void)
- }
- }
-
-- spin_unlock_irqrestore(&pgd_lock, flags);
-+ spin_unlock(&pgd_lock);
- }
-
- /*
-@@ -1100,10 +1099,9 @@ static void xen_pgd_unpin(struct mm_struct *mm)
- */
- void xen_mm_unpin_all(void)
- {
-- unsigned long flags;
- struct page *page;
-
-- spin_lock_irqsave(&pgd_lock, flags);
-+ spin_lock(&pgd_lock);
-
- list_for_each_entry(page, &pgd_list, lru) {
- if (PageSavePinned(page)) {
-@@ -1113,7 +1111,7 @@ void xen_mm_unpin_all(void)
- }
- }
-
-- spin_unlock_irqrestore(&pgd_lock, flags);
-+ spin_unlock(&pgd_lock);
- }
-
- void xen_activate_mm(struct mm_struct *prev, struct mm_struct *next)
-diff --git a/arch/x86/xen/xen-asm.S b/arch/x86/xen/xen-asm.S
-index 79d7362..3e45aa0 100644
---- a/arch/x86/xen/xen-asm.S
-+++ b/arch/x86/xen/xen-asm.S
-@@ -96,7 +96,7 @@ ENTRY(xen_restore_fl_direct)
-
- /* check for unmasked and pending */
- cmpw $0x0001, PER_CPU_VAR(xen_vcpu_info) + XEN_vcpu_info_pending
-- jz 1f
-+ jnz 1f
- 2: call check_events
- 1:
- ENDPATCH(xen_restore_fl_direct)
-diff --git a/block/blk-ioc.c b/block/blk-ioc.c
-index d4ed600..cbdabb0 100644
---- a/block/blk-ioc.c
-+++ b/block/blk-ioc.c
-@@ -66,22 +66,22 @@ static void cfq_exit(struct io_context *ioc)
- }
-
- /* Called by the exitting task */
--void exit_io_context(void)
-+void exit_io_context(struct task_struct *task)
- {
- struct io_context *ioc;
-
-- task_lock(current);
-- ioc = current->io_context;
-- current->io_context = NULL;
-- task_unlock(current);
-+ task_lock(task);
-+ ioc = task->io_context;
-+ task->io_context = NULL;
-+ task_unlock(task);
-
- if (atomic_dec_and_test(&ioc->nr_tasks)) {
- if (ioc->aic && ioc->aic->exit)
- ioc->aic->exit(ioc->aic);
- cfq_exit(ioc);
-
-- put_io_context(ioc);
- }
-+ put_io_context(ioc);
- }
-
- struct io_context *alloc_io_context(gfp_t gfp_flags, int node)
-diff --git a/crypto/sha512_generic.c b/crypto/sha512_generic.c
-index 107f6f7..dd30f40 100644
---- a/crypto/sha512_generic.c
-+++ b/crypto/sha512_generic.c
-@@ -174,7 +174,7 @@ sha512_update(struct shash_desc *desc, const u8 *data, unsigned int len)
- index = sctx->count[0] & 0x7f;
-
- /* Update number of bytes */
-- if (!(sctx->count[0] += len))
-+ if ((sctx->count[0] += len) < len)
- sctx->count[1]++;
-
- part_len = 128 - index;
-diff --git a/drivers/acpi/ac.c b/drivers/acpi/ac.c
-index b6ed60b..bc3f918 100644
---- a/drivers/acpi/ac.c
-+++ b/drivers/acpi/ac.c
-@@ -287,7 +287,9 @@ static int acpi_ac_add(struct acpi_device *device)
- ac->charger.properties = ac_props;
- ac->charger.num_properties = ARRAY_SIZE(ac_props);
- ac->charger.get_property = get_ac_property;
-- power_supply_register(&ac->device->dev, &ac->charger);
-+ result = power_supply_register(&ac->device->dev, &ac->charger);
-+ if (result)
-+ goto end;
- #endif
-
- printk(KERN_INFO PREFIX "%s [%s] (%s)\n",
-diff --git a/drivers/block/cciss_scsi.c b/drivers/block/cciss_scsi.c
-index 3315268..ad8e592 100644
---- a/drivers/block/cciss_scsi.c
-+++ b/drivers/block/cciss_scsi.c
-@@ -747,17 +747,7 @@ complete_scsi_command( CommandList_struct *cp, int timeout, __u32 tag)
- {
- case CMD_TARGET_STATUS:
- /* Pass it up to the upper layers... */
-- if( ei->ScsiStatus)
-- {
--#if 0
-- printk(KERN_WARNING "cciss: cmd %p "
-- "has SCSI Status = %x\n",
-- cp,
-- ei->ScsiStatus);
--#endif
-- cmd->result |= (ei->ScsiStatus < 1);
-- }
-- else { /* scsi status is zero??? How??? */
-+ if (!ei->ScsiStatus) {
-
- /* Ordinarily, this case should never happen, but there is a bug
- in some released firmware revisions that allows it to happen
-diff --git a/drivers/block/sx8.c b/drivers/block/sx8.c
-index a7c4184..bcbfc20 100644
---- a/drivers/block/sx8.c
-+++ b/drivers/block/sx8.c
-@@ -1116,7 +1116,7 @@ static inline void carm_handle_resp(struct carm_host *host,
- break;
- case MISC_GET_FW_VER: {
- struct carm_fw_ver *ver = (struct carm_fw_ver *)
-- mem + sizeof(struct carm_msg_get_fw_ver);
-+ (mem + sizeof(struct carm_msg_get_fw_ver));
- if (!error) {
- host->fw_ver = le32_to_cpu(ver->version);
- host->flags |= (ver->features & FL_FW_VER_MASK);
-diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
-index 75185a6..a562761 100644
---- a/drivers/bluetooth/btusb.c
-+++ b/drivers/bluetooth/btusb.c
-@@ -470,15 +470,10 @@ static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags)
-
- pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress);
-
-- urb->dev = data->udev;
-- urb->pipe = pipe;
-- urb->context = hdev;
-- urb->complete = btusb_isoc_complete;
-- urb->interval = data->isoc_rx_ep->bInterval;
-+ usb_fill_int_urb(urb, data->udev, pipe, buf, size, btusb_isoc_complete,
-+ hdev, data->isoc_rx_ep->bInterval);
-
- urb->transfer_flags = URB_FREE_BUFFER | URB_ISO_ASAP;
-- urb->transfer_buffer = buf;
-- urb->transfer_buffer_length = size;
-
- __fill_isoc_descriptor(urb, size,
- le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize));
-diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
-index e3d4eda..d68e2f5 100644
---- a/drivers/bluetooth/hci_ldisc.c
-+++ b/drivers/bluetooth/hci_ldisc.c
-@@ -312,9 +312,11 @@ static void hci_uart_tty_close(struct tty_struct *tty)
- hci_uart_close(hdev);
-
- if (test_and_clear_bit(HCI_UART_PROTO_SET, &hu->flags)) {
-+ if (hdev) {
-+ hci_unregister_dev(hdev);
-+ hci_free_dev(hdev);
-+ }
- hu->proto->close(hu);
-- hci_unregister_dev(hdev);
-- hci_free_dev(hdev);
- }
- }
- }
-diff --git a/drivers/char/random.c b/drivers/char/random.c
-index 3a19e2d..446b20a 100644
---- a/drivers/char/random.c
-+++ b/drivers/char/random.c
-@@ -125,20 +125,32 @@
- * The current exported interfaces for gathering environmental noise
- * from the devices are:
- *
-+ * void add_device_randomness(const void *buf, unsigned int size);
- * void add_input_randomness(unsigned int type, unsigned int code,
- * unsigned int value);
-- * void add_interrupt_randomness(int irq);
-+ * void add_interrupt_randomness(int irq, int irq_flags);
-+ * void add_disk_randomness(struct gendisk *disk);
-+ *
-+ * add_device_randomness() is for adding data to the random pool that
-+ * is likely to differ between two devices (or possibly even per boot).
-+ * This would be things like MAC addresses or serial numbers, or the
-+ * read-out of the RTC. This does *not* add any actual entropy to the
-+ * pool, but it initializes the pool to different values for devices
-+ * that might otherwise be identical and have very little entropy
-+ * available to them (particularly common in the embedded world).
- *
- * add_input_randomness() uses the input layer interrupt timing, as well as
- * the event type information from the hardware.
- *
-- * add_interrupt_randomness() uses the inter-interrupt timing as random
-- * inputs to the entropy pool. Note that not all interrupts are good
-- * sources of randomness! For example, the timer interrupts is not a
-- * good choice, because the periodicity of the interrupts is too
-- * regular, and hence predictable to an attacker. Disk interrupts are
-- * a better measure, since the timing of the disk interrupts are more
-- * unpredictable.
-+ * add_interrupt_randomness() uses the interrupt timing as random
-+ * inputs to the entropy pool. Using the cycle counters and the irq source
-+ * as inputs, it feeds the randomness roughly once a second.
-+ *
-+ * add_disk_randomness() uses what amounts to the seek time of block
-+ * layer request events, on a per-disk_devt basis, as input to the
-+ * entropy pool. Note that high-speed solid state drives with very low
-+ * seek times do not make for good sources of entropy, as their seek
-+ * times are usually fairly consistent.
- *
- * All of these routines try to estimate how many bits of randomness a
- * particular randomness source. They do this by keeping track of the
-@@ -241,6 +253,8 @@
- #include <linux/percpu.h>
- #include <linux/cryptohash.h>
- #include <linux/fips.h>
-+#include <linux/ptrace.h>
-+#include <linux/kmemcheck.h>
-
- #ifdef CONFIG_GENERIC_HARDIRQS
- # include <linux/irq.h>
-@@ -249,6 +263,7 @@
- #include <asm/processor.h>
- #include <asm/uaccess.h>
- #include <asm/irq.h>
-+#include <asm/irq_regs.h>
- #include <asm/io.h>
-
- /*
-@@ -257,6 +272,9 @@
- #define INPUT_POOL_WORDS 128
- #define OUTPUT_POOL_WORDS 32
- #define SEC_XFER_SIZE 512
-+#define EXTRACT_SIZE 10
-+
-+#define LONGS(x) (((x) + sizeof(unsigned long) - 1)/sizeof(unsigned long))
-
- /*
- * The minimum number of bits of entropy before we wake up a read on
-@@ -406,15 +424,17 @@ struct entropy_store {
- struct poolinfo *poolinfo;
- __u32 *pool;
- const char *name;
-- int limit;
- struct entropy_store *pull;
-+ int limit;
-
- /* read-write data: */
- spinlock_t lock;
- unsigned add_ptr;
-+ unsigned input_rotate;
- int entropy_count;
-- int input_rotate;
-- __u8 *last_data;
-+ int entropy_total;
-+ unsigned int initialized:1;
-+ __u8 last_data[EXTRACT_SIZE];
- };
-
- static __u32 input_pool_data[INPUT_POOL_WORDS];
-@@ -446,6 +466,10 @@ static struct entropy_store nonblocking_pool = {
- .pool = nonblocking_pool_data
- };
-
-+static __u32 const twist_table[8] = {
-+ 0x00000000, 0x3b6e20c8, 0x76dc4190, 0x4db26158,
-+ 0xedb88320, 0xd6d6a3e8, 0x9b64c2b0, 0xa00ae278 };
-+
- /*
- * This function adds bytes into the entropy "pool". It does not
- * update the entropy estimate. The caller should call
-@@ -456,29 +480,24 @@ static struct entropy_store nonblocking_pool = {
- * it's cheap to do so and helps slightly in the expected case where
- * the entropy is concentrated in the low-order bits.
- */
--static void mix_pool_bytes_extract(struct entropy_store *r, const void *in,
-- int nbytes, __u8 out[64])
-+static void __mix_pool_bytes(struct entropy_store *r, const void *in,
-+ int nbytes, __u8 out[64])
- {
-- static __u32 const twist_table[8] = {
-- 0x00000000, 0x3b6e20c8, 0x76dc4190, 0x4db26158,
-- 0xedb88320, 0xd6d6a3e8, 0x9b64c2b0, 0xa00ae278 };
- unsigned long i, j, tap1, tap2, tap3, tap4, tap5;
- int input_rotate;
- int wordmask = r->poolinfo->poolwords - 1;
- const char *bytes = in;
- __u32 w;
-- unsigned long flags;
-
-- /* Taps are constant, so we can load them without holding r->lock. */
- tap1 = r->poolinfo->tap1;
- tap2 = r->poolinfo->tap2;
- tap3 = r->poolinfo->tap3;
- tap4 = r->poolinfo->tap4;
- tap5 = r->poolinfo->tap5;
-
-- spin_lock_irqsave(&r->lock, flags);
-- input_rotate = r->input_rotate;
-- i = r->add_ptr;
-+ smp_rmb();
-+ input_rotate = ACCESS_ONCE(r->input_rotate);
-+ i = ACCESS_ONCE(r->add_ptr);
-
- /* mix one byte at a time to simplify size handling and churn faster */
- while (nbytes--) {
-@@ -505,19 +524,53 @@ static void mix_pool_bytes_extract(struct entropy_store *r, const void *in,
- input_rotate += i ? 7 : 14;
- }
-
-- r->input_rotate = input_rotate;
-- r->add_ptr = i;
-+ ACCESS_ONCE(r->input_rotate) = input_rotate;
-+ ACCESS_ONCE(r->add_ptr) = i;
-+ smp_wmb();
-
- if (out)
- for (j = 0; j < 16; j++)
- ((__u32 *)out)[j] = r->pool[(i - j) & wordmask];
-+}
-
-+static void mix_pool_bytes(struct entropy_store *r, const void *in,
-+ int nbytes, __u8 out[64])
-+{
-+ unsigned long flags;
-+
-+ spin_lock_irqsave(&r->lock, flags);
-+ __mix_pool_bytes(r, in, nbytes, out);
- spin_unlock_irqrestore(&r->lock, flags);
- }
-
--static void mix_pool_bytes(struct entropy_store *r, const void *in, int bytes)
-+struct fast_pool {
-+ __u32 pool[4];
-+ unsigned long last;
-+ unsigned short count;
-+ unsigned char rotate;
-+ unsigned char last_timer_intr;
-+};
-+
-+/*
-+ * This is a fast mixing routine used by the interrupt randomness
-+ * collector. It's hardcoded for an 128 bit pool and assumes that any
-+ * locks that might be needed are taken by the caller.
-+ */
-+static void fast_mix(struct fast_pool *f, const void *in, int nbytes)
- {
-- mix_pool_bytes_extract(r, in, bytes, NULL);
-+ const char *bytes = in;
-+ __u32 w;
-+ unsigned i = f->count;
-+ unsigned input_rotate = f->rotate;
-+
-+ while (nbytes--) {
-+ w = rol32(*bytes++, input_rotate & 31) ^ f->pool[i & 3] ^
-+ f->pool[(i + 1) & 3];
-+ f->pool[i & 3] = (w >> 3) ^ twist_table[w & 7];
-+ input_rotate += (i++ & 3) ? 7 : 14;
-+ }
-+ f->count = i;
-+ f->rotate = input_rotate;
- }
-
- /*
-@@ -525,30 +578,34 @@ static void mix_pool_bytes(struct entropy_store *r, const void *in, int bytes)
- */
- static void credit_entropy_bits(struct entropy_store *r, int nbits)
- {
-- unsigned long flags;
-- int entropy_count;
-+ int entropy_count, orig;
-
- if (!nbits)
- return;
-
-- spin_lock_irqsave(&r->lock, flags);
--
- DEBUG_ENT("added %d entropy credits to %s\n", nbits, r->name);
-- entropy_count = r->entropy_count;
-+retry:
-+ entropy_count = orig = ACCESS_ONCE(r->entropy_count);
- entropy_count += nbits;
- if (entropy_count < 0) {
- DEBUG_ENT("negative entropy/overflow\n");
- entropy_count = 0;
- } else if (entropy_count > r->poolinfo->POOLBITS)
- entropy_count = r->poolinfo->POOLBITS;
-- r->entropy_count = entropy_count;
-+ if (cmpxchg(&r->entropy_count, orig, entropy_count) != orig)
-+ goto retry;
-+
-+ if (!r->initialized && nbits > 0) {
-+ r->entropy_total += nbits;
-+ if (r->entropy_total > 128)
-+ r->initialized = 1;
-+ }
-
- /* should we wake readers? */
- if (r == &input_pool && entropy_count >= random_read_wakeup_thresh) {
- wake_up_interruptible(&random_read_wait);
- kill_fasync(&fasync, SIGIO, POLL_IN);
- }
-- spin_unlock_irqrestore(&r->lock, flags);
- }
-
- /*********************************************************************
-@@ -564,42 +621,24 @@ struct timer_rand_state {
- unsigned dont_count_entropy:1;
- };
-
--#ifndef CONFIG_GENERIC_HARDIRQS
--
--static struct timer_rand_state *irq_timer_state[NR_IRQS];
--
--static struct timer_rand_state *get_timer_rand_state(unsigned int irq)
--{
-- return irq_timer_state[irq];
--}
--
--static void set_timer_rand_state(unsigned int irq,
-- struct timer_rand_state *state)
--{
-- irq_timer_state[irq] = state;
--}
--
--#else
--
--static struct timer_rand_state *get_timer_rand_state(unsigned int irq)
--{
-- struct irq_desc *desc;
--
-- desc = irq_to_desc(irq);
--
-- return desc->timer_rand_state;
--}
--
--static void set_timer_rand_state(unsigned int irq,
-- struct timer_rand_state *state)
-+/*
-+ * Add device- or boot-specific data to the input and nonblocking
-+ * pools to help initialize them to unique values.
-+ *
-+ * None of this adds any entropy, it is meant to avoid the
-+ * problem of the nonblocking pool having similar initial state
-+ * across largely identical devices.
-+ */
-+void add_device_randomness(const void *buf, unsigned int size)
- {
-- struct irq_desc *desc;
--
-- desc = irq_to_desc(irq);
-+ unsigned long time = get_cycles() ^ jiffies;
-
-- desc->timer_rand_state = state;
-+ mix_pool_bytes(&input_pool, buf, size, NULL);
-+ mix_pool_bytes(&input_pool, &time, sizeof(time), NULL);
-+ mix_pool_bytes(&nonblocking_pool, buf, size, NULL);
-+ mix_pool_bytes(&nonblocking_pool, &time, sizeof(time), NULL);
- }
--#endif
-+EXPORT_SYMBOL(add_device_randomness);
-
- static struct timer_rand_state input_timer_state;
-
-@@ -616,8 +655,8 @@ static struct timer_rand_state input_timer_state;
- static void add_timer_randomness(struct timer_rand_state *state, unsigned num)
- {
- struct {
-- cycles_t cycles;
- long jiffies;
-+ unsigned cycles;
- unsigned num;
- } sample;
- long delta, delta2, delta3;
-@@ -631,7 +670,7 @@ static void add_timer_randomness(struct timer_rand_state *state, unsigned num)
- sample.jiffies = jiffies;
- sample.cycles = get_cycles();
- sample.num = num;
-- mix_pool_bytes(&input_pool, &sample, sizeof(sample));
-+ mix_pool_bytes(&input_pool, &sample, sizeof(sample), NULL);
-
- /*
- * Calculate number of bits of randomness we probably added.
-@@ -688,17 +727,48 @@ void add_input_randomness(unsigned int type, unsigned int code,
- }
- EXPORT_SYMBOL_GPL(add_input_randomness);
-
--void add_interrupt_randomness(int irq)
-+static DEFINE_PER_CPU(struct fast_pool, irq_randomness);
-+
-+void add_interrupt_randomness(int irq, int irq_flags)
- {
-- struct timer_rand_state *state;
-+ struct entropy_store *r;
-+ struct fast_pool *fast_pool = &__get_cpu_var(irq_randomness);
-+ struct pt_regs *regs = get_irq_regs();
-+ unsigned long now = jiffies;
-+ __u32 input[4], cycles = get_cycles();
-+
-+ input[0] = cycles ^ jiffies;
-+ input[1] = irq;
-+ if (regs) {
-+ __u64 ip = instruction_pointer(regs);
-+ input[2] = ip;
-+ input[3] = ip >> 32;
-+ }
-
-- state = get_timer_rand_state(irq);
-+ fast_mix(fast_pool, input, sizeof(input));
-
-- if (state == NULL)
-+ if ((fast_pool->count & 1023) &&
-+ !time_after(now, fast_pool->last + HZ))
- return;
-
-- DEBUG_ENT("irq event %d\n", irq);
-- add_timer_randomness(state, 0x100 + irq);
-+ fast_pool->last = now;
-+
-+ r = nonblocking_pool.initialized ? &input_pool : &nonblocking_pool;
-+ __mix_pool_bytes(r, &fast_pool->pool, sizeof(fast_pool->pool), NULL);
-+ /*
-+ * If we don't have a valid cycle counter, and we see
-+ * back-to-back timer interrupts, then skip giving credit for
-+ * any entropy.
-+ */
-+ if (cycles == 0) {
-+ if (irq_flags & __IRQF_TIMER) {
-+ if (fast_pool->last_timer_intr)
-+ return;
-+ fast_pool->last_timer_intr = 1;
-+ } else
-+ fast_pool->last_timer_intr = 0;
-+ }
-+ credit_entropy_bits(r, 1);
- }
-
- #ifdef CONFIG_BLOCK
-@@ -714,8 +784,6 @@ void add_disk_randomness(struct gendisk *disk)
- }
- #endif
-
--#define EXTRACT_SIZE 10
--
- /*********************************************************************
- *
- * Entropy extraction routines
-@@ -732,7 +800,7 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
- */
- static void xfer_secondary_pool(struct entropy_store *r, size_t nbytes)
- {
-- __u32 tmp[OUTPUT_POOL_WORDS];
-+ __u32 tmp[OUTPUT_POOL_WORDS];
-
- if (r->pull && r->entropy_count < nbytes * 8 &&
- r->entropy_count < r->poolinfo->POOLBITS) {
-@@ -751,7 +819,7 @@ static void xfer_secondary_pool(struct entropy_store *r, size_t nbytes)
-
- bytes = extract_entropy(r->pull, tmp, bytes,
- random_read_wakeup_thresh / 8, rsvd);
-- mix_pool_bytes(r, tmp, bytes);
-+ mix_pool_bytes(r, tmp, bytes, NULL);
- credit_entropy_bits(r, bytes*8);
- }
- }
-@@ -810,13 +878,19 @@ static size_t account(struct entropy_store *r, size_t nbytes, int min,
- static void extract_buf(struct entropy_store *r, __u8 *out)
- {
- int i;
-- __u32 hash[5], workspace[SHA_WORKSPACE_WORDS];
-+ union {
-+ __u32 w[5];
-+ unsigned long l[LONGS(EXTRACT_SIZE)];
-+ } hash;
-+ __u32 workspace[SHA_WORKSPACE_WORDS];
- __u8 extract[64];
-+ unsigned long flags;
-
- /* Generate a hash across the pool, 16 words (512 bits) at a time */
-- sha_init(hash);
-+ sha_init(hash.w);
-+ spin_lock_irqsave(&r->lock, flags);
- for (i = 0; i < r->poolinfo->poolwords; i += 16)
-- sha_transform(hash, (__u8 *)(r->pool + i), workspace);
-+ sha_transform(hash.w, (__u8 *)(r->pool + i), workspace);
-
- /*
- * We mix the hash back into the pool to prevent backtracking
-@@ -827,13 +901,14 @@ static void extract_buf(struct entropy_store *r, __u8 *out)
- * brute-forcing the feedback as hard as brute-forcing the
- * hash.
- */
-- mix_pool_bytes_extract(r, hash, sizeof(hash), extract);
-+ __mix_pool_bytes(r, hash.w, sizeof(hash.w), extract);
-+ spin_unlock_irqrestore(&r->lock, flags);
-
- /*
- * To avoid duplicates, we atomically extract a portion of the
- * pool while mixing, and hash one final time.
- */
-- sha_transform(hash, extract, workspace);
-+ sha_transform(hash.w, extract, workspace);
- memset(extract, 0, sizeof(extract));
- memset(workspace, 0, sizeof(workspace));
-
-@@ -842,19 +917,30 @@ static void extract_buf(struct entropy_store *r, __u8 *out)
- * pattern, we fold it in half. Thus, we always feed back
- * twice as much data as we output.
- */
-- hash[0] ^= hash[3];
-- hash[1] ^= hash[4];
-- hash[2] ^= rol32(hash[2], 16);
-- memcpy(out, hash, EXTRACT_SIZE);
-- memset(hash, 0, sizeof(hash));
-+ hash.w[0] ^= hash.w[3];
-+ hash.w[1] ^= hash.w[4];
-+ hash.w[2] ^= rol32(hash.w[2], 16);
-+
-+ /*
-+ * If we have a architectural hardware random number
-+ * generator, mix that in, too.
-+ */
-+ for (i = 0; i < LONGS(EXTRACT_SIZE); i++) {
-+ unsigned long v;
-+ if (!arch_get_random_long(&v))
-+ break;
-+ hash.l[i] ^= v;
-+ }
-+
-+ memcpy(out, &hash, EXTRACT_SIZE);
-+ memset(&hash, 0, sizeof(hash));
- }
-
- static ssize_t extract_entropy(struct entropy_store *r, void *buf,
-- size_t nbytes, int min, int reserved)
-+ size_t nbytes, int min, int reserved)
- {
- ssize_t ret = 0, i;
- __u8 tmp[EXTRACT_SIZE];
-- unsigned long flags;
-
- xfer_secondary_pool(r, nbytes);
- nbytes = account(r, nbytes, min, reserved);
-@@ -862,7 +948,9 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
- while (nbytes) {
- extract_buf(r, tmp);
-
-- if (r->last_data) {
-+ if (fips_enabled) {
-+ unsigned long flags;
-+
- spin_lock_irqsave(&r->lock, flags);
- if (!memcmp(tmp, r->last_data, EXTRACT_SIZE))
- panic("Hardware RNG duplicated output!\n");
-@@ -921,8 +1009,9 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf,
-
- /*
- * This function is the exported kernel interface. It returns some
-- * number of good random numbers, suitable for seeding TCP sequence
-- * numbers, etc.
-+ * number of good random numbers, suitable for key generation, seeding
-+ * TCP sequence numbers, etc. It does not use the hw random number
-+ * generator, if available; use get_random_bytes_arch() for that.
- */
- void get_random_bytes(void *buf, int nbytes)
- {
-@@ -931,6 +1020,38 @@ void get_random_bytes(void *buf, int nbytes)
- EXPORT_SYMBOL(get_random_bytes);
-
- /*
-+ * This function will use the architecture-specific hardware random
-+ * number generator if it is available. The arch-specific hw RNG will
-+ * almost certainly be faster than what we can do in software, but it
-+ * is impossible to verify that it is implemented securely (as
-+ * opposed, to, say, the AES encryption of a sequence number using a
-+ * key known by the NSA). So it's useful if we need the speed, but
-+ * only if we're willing to trust the hardware manufacturer not to
-+ * have put in a back door.
-+ */
-+void get_random_bytes_arch(void *buf, int nbytes)
-+{
-+ char *p = buf;
-+
-+ while (nbytes) {
-+ unsigned long v;
-+ int chunk = min(nbytes, (int)sizeof(unsigned long));
-+
-+ if (!arch_get_random_long(&v))
-+ break;
-+
-+ memcpy(p, &v, chunk);
-+ p += chunk;
-+ nbytes -= chunk;
-+ }
-+
-+ if (nbytes)
-+ extract_entropy(&nonblocking_pool, p, nbytes, 0, 0);
-+}
-+EXPORT_SYMBOL(get_random_bytes_arch);
-+
-+
-+/*
- * init_std_data - initialize pool with system data
- *
- * @r: pool to initialize
-@@ -941,21 +1062,31 @@ EXPORT_SYMBOL(get_random_bytes);
- */
- static void init_std_data(struct entropy_store *r)
- {
-- ktime_t now;
-- unsigned long flags;
-+ int i;
-+ ktime_t now = ktime_get_real();
-+ unsigned long rv;
-
-- spin_lock_irqsave(&r->lock, flags);
- r->entropy_count = 0;
-- spin_unlock_irqrestore(&r->lock, flags);
--
-- now = ktime_get_real();
-- mix_pool_bytes(r, &now, sizeof(now));
-- mix_pool_bytes(r, utsname(), sizeof(*(utsname())));
-- /* Enable continuous test in fips mode */
-- if (fips_enabled)
-- r->last_data = kmalloc(EXTRACT_SIZE, GFP_KERNEL);
-+ r->entropy_total = 0;
-+ mix_pool_bytes(r, &now, sizeof(now), NULL);
-+ for (i = r->poolinfo->POOLBYTES; i > 0; i -= sizeof(rv)) {
-+ if (!arch_get_random_long(&rv))
-+ break;
-+ mix_pool_bytes(r, &rv, sizeof(rv), NULL);
-+ }
-+ mix_pool_bytes(r, utsname(), sizeof(*(utsname())), NULL);
- }
-
-+/*
-+ * Note that setup_arch() may call add_device_randomness()
-+ * long before we get here. This allows seeding of the pools
-+ * with some platform dependent data very early in the boot
-+ * process. But it limits our options here. We must use
-+ * statically allocated structures that already have all
-+ * initializations complete at compile time. We should also
-+ * take care not to overwrite the precious per platform data
-+ * we were given.
-+ */
- static int rand_initialize(void)
- {
- init_std_data(&input_pool);
-@@ -965,24 +1096,6 @@ static int rand_initialize(void)
- }
- module_init(rand_initialize);
-
--void rand_initialize_irq(int irq)
--{
-- struct timer_rand_state *state;
--
-- state = get_timer_rand_state(irq);
--
-- if (state)
-- return;
--
-- /*
-- * If kzalloc returns null, we just won't use that entropy
-- * source.
-- */
-- state = kzalloc(sizeof(struct timer_rand_state), GFP_KERNEL);
-- if (state)
-- set_timer_rand_state(irq, state);
--}
--
- #ifdef CONFIG_BLOCK
- void rand_initialize_disk(struct gendisk *disk)
- {
-@@ -1090,7 +1203,7 @@ write_pool(struct entropy_store *r, const char __user *buffer, size_t count)
- count -= bytes;
- p += bytes;
-
-- mix_pool_bytes(r, buf, bytes);
-+ mix_pool_bytes(r, buf, bytes, NULL);
- cond_resched();
- }
-
-@@ -1231,10 +1344,15 @@ static int proc_do_uuid(ctl_table *table, int write,
- uuid = table->data;
- if (!uuid) {
- uuid = tmp_uuid;
-- uuid[8] = 0;
-- }
-- if (uuid[8] == 0)
- generate_random_uuid(uuid);
-+ } else {
-+ static DEFINE_SPINLOCK(bootid_spinlock);
-+
-+ spin_lock(&bootid_spinlock);
-+ if (!uuid[8])
-+ generate_random_uuid(uuid);
-+ spin_unlock(&bootid_spinlock);
-+ }
-
- sprintf(buf, "%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-"
- "%02x%02x%02x%02x%02x%02x",
-@@ -1357,9 +1475,14 @@ late_initcall(random_int_secret_init);
- DEFINE_PER_CPU(__u32 [MD5_DIGEST_WORDS], get_random_int_hash);
- unsigned int get_random_int(void)
- {
-- __u32 *hash = get_cpu_var(get_random_int_hash);
-+ __u32 *hash;
- unsigned int ret;
-
-+ if (arch_get_random_int(&ret))
-+ return ret;
-+
-+ hash = get_cpu_var(get_random_int_hash);
-+
- hash[0] += current->pid + jiffies + get_cycles();
- md5_transform(hash, random_int_secret);
- ret = hash[0];
-diff --git a/drivers/char/tty_audit.c b/drivers/char/tty_audit.c
-index ac16fbe..dd4691a 100644
---- a/drivers/char/tty_audit.c
-+++ b/drivers/char/tty_audit.c
-@@ -94,8 +94,10 @@ static void tty_audit_buf_push(struct task_struct *tsk, uid_t loginuid,
- {
- if (buf->valid == 0)
- return;
-- if (audit_enabled == 0)
-+ if (audit_enabled == 0) {
-+ buf->valid = 0;
- return;
-+ }
- tty_audit_log("tty", tsk, loginuid, sessionid, buf->major, buf->minor,
- buf->data, buf->valid);
- buf->valid = 0;
-diff --git a/drivers/dma/ioat/dma_v2.c b/drivers/dma/ioat/dma_v2.c
-index 5cc37af..d1be371 100644
---- a/drivers/dma/ioat/dma_v2.c
-+++ b/drivers/dma/ioat/dma_v2.c
-@@ -51,48 +51,40 @@ MODULE_PARM_DESC(ioat_ring_max_alloc_order,
-
- void __ioat2_issue_pending(struct ioat2_dma_chan *ioat)
- {
-- void * __iomem reg_base = ioat->base.reg_base;
-+ struct ioat_chan_common *chan = &ioat->base;
-
-- ioat->pending = 0;
- ioat->dmacount += ioat2_ring_pending(ioat);
- ioat->issued = ioat->head;
- /* make descriptor updates globally visible before notifying channel */
- wmb();
-- writew(ioat->dmacount, reg_base + IOAT_CHAN_DMACOUNT_OFFSET);
-- dev_dbg(to_dev(&ioat->base),
-+ writew(ioat->dmacount, chan->reg_base + IOAT_CHAN_DMACOUNT_OFFSET);
-+ dev_dbg(to_dev(chan),
- "%s: head: %#x tail: %#x issued: %#x count: %#x\n",
- __func__, ioat->head, ioat->tail, ioat->issued, ioat->dmacount);
- }
-
--void ioat2_issue_pending(struct dma_chan *chan)
-+void ioat2_issue_pending(struct dma_chan *c)
- {
-- struct ioat2_dma_chan *ioat = to_ioat2_chan(chan);
-+ struct ioat2_dma_chan *ioat = to_ioat2_chan(c);
-
-- spin_lock_bh(&ioat->ring_lock);
-- if (ioat->pending == 1)
-+ if (ioat2_ring_pending(ioat)) {
-+ spin_lock_bh(&ioat->ring_lock);
- __ioat2_issue_pending(ioat);
-- spin_unlock_bh(&ioat->ring_lock);
-+ spin_unlock_bh(&ioat->ring_lock);
-+ }
- }
-
- /**
- * ioat2_update_pending - log pending descriptors
- * @ioat: ioat2+ channel
- *
-- * set pending to '1' unless pending is already set to '2', pending == 2
-- * indicates that submission is temporarily blocked due to an in-flight
-- * reset. If we are already above the ioat_pending_level threshold then
-- * just issue pending.
-- *
-- * called with ring_lock held
-+ * Check if the number of unsubmitted descriptors has exceeded the
-+ * watermark. Called with ring_lock held
- */
- static void ioat2_update_pending(struct ioat2_dma_chan *ioat)
- {
-- if (unlikely(ioat->pending == 2))
-- return;
-- else if (ioat2_ring_pending(ioat) > ioat_pending_level)
-+ if (ioat2_ring_pending(ioat) > ioat_pending_level)
- __ioat2_issue_pending(ioat);
-- else
-- ioat->pending = 1;
- }
-
- static void __ioat2_start_null_desc(struct ioat2_dma_chan *ioat)
-@@ -546,7 +538,6 @@ int ioat2_alloc_chan_resources(struct dma_chan *c)
- ioat->head = 0;
- ioat->issued = 0;
- ioat->tail = 0;
-- ioat->pending = 0;
- ioat->alloc_order = order;
- spin_unlock_bh(&ioat->ring_lock);
-
-@@ -815,7 +806,6 @@ void ioat2_free_chan_resources(struct dma_chan *c)
-
- chan->last_completion = 0;
- chan->completion_dma = 0;
-- ioat->pending = 0;
- ioat->dmacount = 0;
- }
-
-diff --git a/drivers/dma/ioat/dma_v2.h b/drivers/dma/ioat/dma_v2.h
-index 3afad8d..d211335 100644
---- a/drivers/dma/ioat/dma_v2.h
-+++ b/drivers/dma/ioat/dma_v2.h
-@@ -47,7 +47,6 @@ extern int ioat_ring_alloc_order;
- * @head: allocated index
- * @issued: hardware notification point
- * @tail: cleanup index
-- * @pending: lock free indicator for issued != head
- * @dmacount: identical to 'head' except for occasionally resetting to zero
- * @alloc_order: log2 of the number of allocated descriptors
- * @ring: software ring buffer implementation of hardware ring
-@@ -61,7 +60,6 @@ struct ioat2_dma_chan {
- u16 tail;
- u16 dmacount;
- u16 alloc_order;
-- int pending;
- struct ioat_ring_ent **ring;
- spinlock_t ring_lock;
- };
-diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
-index 3a2ccb0..10a4246 100644
---- a/drivers/firmware/dmi_scan.c
-+++ b/drivers/firmware/dmi_scan.c
-@@ -6,6 +6,7 @@
- #include <linux/efi.h>
- #include <linux/bootmem.h>
- #include <linux/slab.h>
-+#include <linux/random.h>
- #include <asm/dmi.h>
-
- /*
-@@ -111,6 +112,8 @@ static int __init dmi_walk_early(void (*decode)(const struct dmi_header *,
-
- dmi_table(buf, dmi_len, dmi_num, decode, NULL);
-
-+ add_device_randomness(buf, dmi_len);
-+
- dmi_iounmap(buf, dmi_len);
- return 0;
- }
-diff --git a/drivers/firmware/pcdp.c b/drivers/firmware/pcdp.c
-index 51e0e2d..a330492 100644
---- a/drivers/firmware/pcdp.c
-+++ b/drivers/firmware/pcdp.c
-@@ -95,7 +95,7 @@ efi_setup_pcdp_console(char *cmdline)
- if (efi.hcdp == EFI_INVALID_TABLE_ADDR)
- return -ENODEV;
-
-- pcdp = ioremap(efi.hcdp, 4096);
-+ pcdp = early_ioremap(efi.hcdp, 4096);
- printk(KERN_INFO "PCDP: v%d at 0x%lx\n", pcdp->rev, efi.hcdp);
-
- if (strstr(cmdline, "console=hcdp")) {
-@@ -131,6 +131,6 @@ efi_setup_pcdp_console(char *cmdline)
- }
-
- out:
-- iounmap(pcdp);
-+ early_iounmap(pcdp, 4096);
- return rc;
- }
-diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index 79cc437..25b3e90 100644
---- a/drivers/gpu/drm/i915/intel_display.c
-+++ b/drivers/gpu/drm/i915/intel_display.c
-@@ -4355,17 +4355,18 @@ static void intel_init_display(struct drm_device *dev)
- dev_priv->display.update_wm = g4x_update_wm;
- else if (IS_I965G(dev))
- dev_priv->display.update_wm = i965_update_wm;
-- else if (IS_I9XX(dev) || IS_MOBILE(dev)) {
-+ else if (IS_I9XX(dev)) {
- dev_priv->display.update_wm = i9xx_update_wm;
- dev_priv->display.get_fifo_size = i9xx_get_fifo_size;
-+ } else if (IS_I85X(dev)) {
-+ dev_priv->display.update_wm = i9xx_update_wm;
-+ dev_priv->display.get_fifo_size = i85x_get_fifo_size;
- } else {
-- if (IS_I85X(dev))
-- dev_priv->display.get_fifo_size = i85x_get_fifo_size;
-- else if (IS_845G(dev))
-+ dev_priv->display.update_wm = i830_update_wm;
-+ if (IS_845G(dev))
- dev_priv->display.get_fifo_size = i845_get_fifo_size;
- else
- dev_priv->display.get_fifo_size = i830_get_fifo_size;
-- dev_priv->display.update_wm = i830_update_wm;
- }
- }
-
-diff --git a/drivers/mfd/wm831x-otp.c b/drivers/mfd/wm831x-otp.c
-index f742745..b90f3e0 100644
---- a/drivers/mfd/wm831x-otp.c
-+++ b/drivers/mfd/wm831x-otp.c
-@@ -18,6 +18,7 @@
- #include <linux/bcd.h>
- #include <linux/delay.h>
- #include <linux/mfd/core.h>
-+#include <linux/random.h>
-
- #include <linux/mfd/wm831x/core.h>
- #include <linux/mfd/wm831x/otp.h>
-@@ -66,6 +67,7 @@ static DEVICE_ATTR(unique_id, 0444, wm831x_unique_id_show, NULL);
-
- int wm831x_otp_init(struct wm831x *wm831x)
- {
-+ char uuid[WM831X_UNIQUE_ID_LEN];
- int ret;
-
- ret = device_create_file(wm831x->dev, &dev_attr_unique_id);
-@@ -73,6 +75,12 @@ int wm831x_otp_init(struct wm831x *wm831x)
- dev_err(wm831x->dev, "Unique ID attribute not created: %d\n",
- ret);
-
-+ ret = wm831x_unique_id_read(wm831x, uuid);
-+ if (ret == 0)
-+ add_device_randomness(uuid, sizeof(uuid));
-+ else
-+ dev_err(wm831x->dev, "Failed to read UUID: %d\n", ret);
-+
- return ret;
- }
-
-diff --git a/drivers/mtd/nand/cafe_nand.c b/drivers/mtd/nand/cafe_nand.c
-index c828d9a..97b9c7b 100644
---- a/drivers/mtd/nand/cafe_nand.c
-+++ b/drivers/mtd/nand/cafe_nand.c
-@@ -103,7 +103,7 @@ static const char *part_probes[] = { "cmdlinepart", "RedBoot", NULL };
- static int cafe_device_ready(struct mtd_info *mtd)
- {
- struct cafe_priv *cafe = mtd->priv;
-- int result = !!(cafe_readl(cafe, NAND_STATUS) | 0x40000000);
-+ int result = !!(cafe_readl(cafe, NAND_STATUS) & 0x40000000);
- uint32_t irqs = cafe_readl(cafe, NAND_IRQ);
-
- cafe_writel(cafe, irqs, NAND_IRQ);
-diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c
-index 403bfb6..adc862f 100644
---- a/drivers/net/atlx/atl1.c
-+++ b/drivers/net/atlx/atl1.c
-@@ -2478,7 +2478,7 @@ static irqreturn_t atl1_intr(int irq, void *data)
- "pcie phy link down %x\n", status);
- if (netif_running(adapter->netdev)) { /* reset MAC */
- iowrite32(0, adapter->hw.hw_addr + REG_IMR);
-- schedule_work(&adapter->pcie_dma_to_rst_task);
-+ schedule_work(&adapter->reset_dev_task);
- return IRQ_HANDLED;
- }
- }
-@@ -2490,7 +2490,7 @@ static irqreturn_t atl1_intr(int irq, void *data)
- "pcie DMA r/w error (status = 0x%x)\n",
- status);
- iowrite32(0, adapter->hw.hw_addr + REG_IMR);
-- schedule_work(&adapter->pcie_dma_to_rst_task);
-+ schedule_work(&adapter->reset_dev_task);
- return IRQ_HANDLED;
- }
-
-@@ -2635,10 +2635,10 @@ static void atl1_down(struct atl1_adapter *adapter)
- atl1_clean_rx_ring(adapter);
- }
-
--static void atl1_tx_timeout_task(struct work_struct *work)
-+static void atl1_reset_dev_task(struct work_struct *work)
- {
- struct atl1_adapter *adapter =
-- container_of(work, struct atl1_adapter, tx_timeout_task);
-+ container_of(work, struct atl1_adapter, reset_dev_task);
- struct net_device *netdev = adapter->netdev;
-
- netif_device_detach(netdev);
-@@ -3050,12 +3050,10 @@ static int __devinit atl1_probe(struct pci_dev *pdev,
- (unsigned long)adapter);
- adapter->phy_timer_pending = false;
-
-- INIT_WORK(&adapter->tx_timeout_task, atl1_tx_timeout_task);
-+ INIT_WORK(&adapter->reset_dev_task, atl1_reset_dev_task);
-
- INIT_WORK(&adapter->link_chg_task, atlx_link_chg_task);
-
-- INIT_WORK(&adapter->pcie_dma_to_rst_task, atl1_tx_timeout_task);
--
- err = register_netdev(netdev);
- if (err)
- goto err_common;
-diff --git a/drivers/net/atlx/atl1.h b/drivers/net/atlx/atl1.h
-index 146372f..0494e514 100644
---- a/drivers/net/atlx/atl1.h
-+++ b/drivers/net/atlx/atl1.h
-@@ -762,9 +762,8 @@ struct atl1_adapter {
- u16 link_speed;
- u16 link_duplex;
- spinlock_t lock;
-- struct work_struct tx_timeout_task;
-+ struct work_struct reset_dev_task;
- struct work_struct link_chg_task;
-- struct work_struct pcie_dma_to_rst_task;
-
- struct timer_list phy_config_timer;
- bool phy_timer_pending;
-diff --git a/drivers/net/atlx/atlx.c b/drivers/net/atlx/atlx.c
-index 3dc0142..ce09b95 100644
---- a/drivers/net/atlx/atlx.c
-+++ b/drivers/net/atlx/atlx.c
-@@ -189,7 +189,7 @@ static void atlx_tx_timeout(struct net_device *netdev)
- {
- struct atlx_adapter *adapter = netdev_priv(netdev);
- /* Do the reset outside of interrupt context */
-- schedule_work(&adapter->tx_timeout_task);
-+ schedule_work(&adapter->reset_dev_task);
- }
-
- /*
-diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
-index 223990d..05308e6 100644
---- a/drivers/net/bonding/bond_3ad.c
-+++ b/drivers/net/bonding/bond_3ad.c
-@@ -1471,8 +1471,11 @@ static struct aggregator *ad_agg_selection_test(struct aggregator *best,
-
- static int agg_device_up(const struct aggregator *agg)
- {
-- return (netif_running(agg->slave->dev) &&
-- netif_carrier_ok(agg->slave->dev));
-+ struct port *port = agg->lag_ports;
-+ if (!port)
-+ return 0;
-+ return (netif_running(port->slave->dev) &&
-+ netif_carrier_ok(port->slave->dev));
- }
-
- /**
-diff --git a/drivers/net/dl2k.c b/drivers/net/dl2k.c
-index 7fa7a90..c2f9313 100644
---- a/drivers/net/dl2k.c
-+++ b/drivers/net/dl2k.c
-@@ -1279,55 +1279,21 @@ rio_ioctl (struct net_device *dev, struct ifreq *rq, int cmd)
- {
- int phy_addr;
- struct netdev_private *np = netdev_priv(dev);
-- struct mii_data *miidata = (struct mii_data *) &rq->ifr_ifru;
--
-- struct netdev_desc *desc;
-- int i;
-+ struct mii_ioctl_data *miidata = if_mii(rq);
-
- phy_addr = np->phy_addr;
- switch (cmd) {
-- case SIOCDEVPRIVATE:
-- break;
--
-- case SIOCDEVPRIVATE + 1:
-- miidata->out_value = mii_read (dev, phy_addr, miidata->reg_num);
-+ case SIOCGMIIPHY:
-+ miidata->phy_id = phy_addr;
- break;
-- case SIOCDEVPRIVATE + 2:
-- mii_write (dev, phy_addr, miidata->reg_num, miidata->in_value);
-+ case SIOCGMIIREG:
-+ miidata->val_out = mii_read (dev, phy_addr, miidata->reg_num);
- break;
-- case SIOCDEVPRIVATE + 3:
-- break;
-- case SIOCDEVPRIVATE + 4:
-- break;
-- case SIOCDEVPRIVATE + 5:
-- netif_stop_queue (dev);
-+ case SIOCSMIIREG:
-+ if (!capable(CAP_NET_ADMIN))
-+ return -EPERM;
-+ mii_write (dev, phy_addr, miidata->reg_num, miidata->val_in);
- break;
-- case SIOCDEVPRIVATE + 6:
-- netif_wake_queue (dev);
-- break;
-- case SIOCDEVPRIVATE + 7:
-- printk
-- ("tx_full=%x cur_tx=%lx old_tx=%lx cur_rx=%lx old_rx=%lx\n",
-- netif_queue_stopped(dev), np->cur_tx, np->old_tx, np->cur_rx,
-- np->old_rx);
-- break;
-- case SIOCDEVPRIVATE + 8:
-- printk("TX ring:\n");
-- for (i = 0; i < TX_RING_SIZE; i++) {
-- desc = &np->tx_ring[i];
-- printk
-- ("%02x:cur:%08x next:%08x status:%08x frag1:%08x frag0:%08x",
-- i,
-- (u32) (np->tx_ring_dma + i * sizeof (*desc)),
-- (u32)le64_to_cpu(desc->next_desc),
-- (u32)le64_to_cpu(desc->status),
-- (u32)(le64_to_cpu(desc->fraginfo) >> 32),
-- (u32)le64_to_cpu(desc->fraginfo));
-- printk ("\n");
-- }
-- printk ("\n");
-- break;
--
- default:
- return -EOPNOTSUPP;
- }
-@@ -1448,7 +1414,7 @@ mii_wait_link (struct net_device *dev, int wait)
-
- do {
- bmsr = mii_read (dev, phy_addr, MII_BMSR);
-- if (bmsr & MII_BMSR_LINK_STATUS)
-+ if (bmsr & BMSR_LSTATUS)
- return 0;
- mdelay (1);
- } while (--wait > 0);
-@@ -1469,60 +1435,60 @@ mii_get_media (struct net_device *dev)
-
- bmsr = mii_read (dev, phy_addr, MII_BMSR);
- if (np->an_enable) {
-- if (!(bmsr & MII_BMSR_AN_COMPLETE)) {
-+ if (!(bmsr & BMSR_ANEGCOMPLETE)) {
- /* Auto-Negotiation not completed */
- return -1;
- }
-- negotiate = mii_read (dev, phy_addr, MII_ANAR) &
-- mii_read (dev, phy_addr, MII_ANLPAR);
-- mscr = mii_read (dev, phy_addr, MII_MSCR);
-- mssr = mii_read (dev, phy_addr, MII_MSSR);
-- if (mscr & MII_MSCR_1000BT_FD && mssr & MII_MSSR_LP_1000BT_FD) {
-+ negotiate = mii_read (dev, phy_addr, MII_ADVERTISE) &
-+ mii_read (dev, phy_addr, MII_LPA);
-+ mscr = mii_read (dev, phy_addr, MII_CTRL1000);
-+ mssr = mii_read (dev, phy_addr, MII_STAT1000);
-+ if (mscr & ADVERTISE_1000FULL && mssr & LPA_1000FULL) {
- np->speed = 1000;
- np->full_duplex = 1;
- printk (KERN_INFO "Auto 1000 Mbps, Full duplex\n");
-- } else if (mscr & MII_MSCR_1000BT_HD && mssr & MII_MSSR_LP_1000BT_HD) {
-+ } else if (mscr & ADVERTISE_1000HALF && mssr & LPA_1000HALF) {
- np->speed = 1000;
- np->full_duplex = 0;
- printk (KERN_INFO "Auto 1000 Mbps, Half duplex\n");
-- } else if (negotiate & MII_ANAR_100BX_FD) {
-+ } else if (negotiate & ADVERTISE_100FULL) {
- np->speed = 100;
- np->full_duplex = 1;
- printk (KERN_INFO "Auto 100 Mbps, Full duplex\n");
-- } else if (negotiate & MII_ANAR_100BX_HD) {
-+ } else if (negotiate & ADVERTISE_100HALF) {
- np->speed = 100;
- np->full_duplex = 0;
- printk (KERN_INFO "Auto 100 Mbps, Half duplex\n");
-- } else if (negotiate & MII_ANAR_10BT_FD) {
-+ } else if (negotiate & ADVERTISE_10FULL) {
- np->speed = 10;
- np->full_duplex = 1;
- printk (KERN_INFO "Auto 10 Mbps, Full duplex\n");
-- } else if (negotiate & MII_ANAR_10BT_HD) {
-+ } else if (negotiate & ADVERTISE_10HALF) {
- np->speed = 10;
- np->full_duplex = 0;
- printk (KERN_INFO "Auto 10 Mbps, Half duplex\n");
- }
-- if (negotiate & MII_ANAR_PAUSE) {
-+ if (negotiate & ADVERTISE_PAUSE_CAP) {
- np->tx_flow &= 1;
- np->rx_flow &= 1;
-- } else if (negotiate & MII_ANAR_ASYMMETRIC) {
-+ } else if (negotiate & ADVERTISE_PAUSE_ASYM) {
- np->tx_flow = 0;
- np->rx_flow &= 1;
- }
- /* else tx_flow, rx_flow = user select */
- } else {
- __u16 bmcr = mii_read (dev, phy_addr, MII_BMCR);
-- switch (bmcr & (MII_BMCR_SPEED_100 | MII_BMCR_SPEED_1000)) {
-- case MII_BMCR_SPEED_1000:
-+ switch (bmcr & (BMCR_SPEED100 | BMCR_SPEED1000)) {
-+ case BMCR_SPEED1000:
- printk (KERN_INFO "Operating at 1000 Mbps, ");
- break;
-- case MII_BMCR_SPEED_100:
-+ case BMCR_SPEED100:
- printk (KERN_INFO "Operating at 100 Mbps, ");
- break;
- case 0:
- printk (KERN_INFO "Operating at 10 Mbps, ");
- }
-- if (bmcr & MII_BMCR_DUPLEX_MODE) {
-+ if (bmcr & BMCR_FULLDPLX) {
- printk (KERN_CONT "Full duplex\n");
- } else {
- printk (KERN_CONT "Half duplex\n");
-@@ -1556,24 +1522,22 @@ mii_set_media (struct net_device *dev)
- if (np->an_enable) {
- /* Advertise capabilities */
- bmsr = mii_read (dev, phy_addr, MII_BMSR);
-- anar = mii_read (dev, phy_addr, MII_ANAR) &
-- ~MII_ANAR_100BX_FD &
-- ~MII_ANAR_100BX_HD &
-- ~MII_ANAR_100BT4 &
-- ~MII_ANAR_10BT_FD &
-- ~MII_ANAR_10BT_HD;
-- if (bmsr & MII_BMSR_100BX_FD)
-- anar |= MII_ANAR_100BX_FD;
-- if (bmsr & MII_BMSR_100BX_HD)
-- anar |= MII_ANAR_100BX_HD;
-- if (bmsr & MII_BMSR_100BT4)
-- anar |= MII_ANAR_100BT4;
-- if (bmsr & MII_BMSR_10BT_FD)
-- anar |= MII_ANAR_10BT_FD;
-- if (bmsr & MII_BMSR_10BT_HD)
-- anar |= MII_ANAR_10BT_HD;
-- anar |= MII_ANAR_PAUSE | MII_ANAR_ASYMMETRIC;
-- mii_write (dev, phy_addr, MII_ANAR, anar);
-+ anar = mii_read (dev, phy_addr, MII_ADVERTISE) &
-+ ~(ADVERTISE_100FULL | ADVERTISE_10FULL |
-+ ADVERTISE_100HALF | ADVERTISE_10HALF |
-+ ADVERTISE_100BASE4);
-+ if (bmsr & BMSR_100FULL)
-+ anar |= ADVERTISE_100FULL;
-+ if (bmsr & BMSR_100HALF)
-+ anar |= ADVERTISE_100HALF;
-+ if (bmsr & BMSR_100BASE4)
-+ anar |= ADVERTISE_100BASE4;
-+ if (bmsr & BMSR_10FULL)
-+ anar |= ADVERTISE_10FULL;
-+ if (bmsr & BMSR_10HALF)
-+ anar |= ADVERTISE_10HALF;
-+ anar |= ADVERTISE_PAUSE_CAP | ADVERTISE_PAUSE_ASYM;
-+ mii_write (dev, phy_addr, MII_ADVERTISE, anar);
-
- /* Enable Auto crossover */
- pscr = mii_read (dev, phy_addr, MII_PHY_SCR);
-@@ -1581,8 +1545,8 @@ mii_set_media (struct net_device *dev)
- mii_write (dev, phy_addr, MII_PHY_SCR, pscr);
-
- /* Soft reset PHY */
-- mii_write (dev, phy_addr, MII_BMCR, MII_BMCR_RESET);
-- bmcr = MII_BMCR_AN_ENABLE | MII_BMCR_RESTART_AN | MII_BMCR_RESET;
-+ mii_write (dev, phy_addr, MII_BMCR, BMCR_RESET);
-+ bmcr = BMCR_ANENABLE | BMCR_ANRESTART | BMCR_RESET;
- mii_write (dev, phy_addr, MII_BMCR, bmcr);
- mdelay(1);
- } else {
-@@ -1594,7 +1558,7 @@ mii_set_media (struct net_device *dev)
-
- /* 2) PHY Reset */
- bmcr = mii_read (dev, phy_addr, MII_BMCR);
-- bmcr |= MII_BMCR_RESET;
-+ bmcr |= BMCR_RESET;
- mii_write (dev, phy_addr, MII_BMCR, bmcr);
-
- /* 3) Power Down */
-@@ -1603,25 +1567,25 @@ mii_set_media (struct net_device *dev)
- mdelay (100); /* wait a certain time */
-
- /* 4) Advertise nothing */
-- mii_write (dev, phy_addr, MII_ANAR, 0);
-+ mii_write (dev, phy_addr, MII_ADVERTISE, 0);
-
- /* 5) Set media and Power Up */
-- bmcr = MII_BMCR_POWER_DOWN;
-+ bmcr = BMCR_PDOWN;
- if (np->speed == 100) {
-- bmcr |= MII_BMCR_SPEED_100;
-+ bmcr |= BMCR_SPEED100;
- printk (KERN_INFO "Manual 100 Mbps, ");
- } else if (np->speed == 10) {
- printk (KERN_INFO "Manual 10 Mbps, ");
- }
- if (np->full_duplex) {
-- bmcr |= MII_BMCR_DUPLEX_MODE;
-+ bmcr |= BMCR_FULLDPLX;
- printk (KERN_CONT "Full duplex\n");
- } else {
- printk (KERN_CONT "Half duplex\n");
- }
- #if 0
- /* Set 1000BaseT Master/Slave setting */
-- mscr = mii_read (dev, phy_addr, MII_MSCR);
-+ mscr = mii_read (dev, phy_addr, MII_CTRL1000);
- mscr |= MII_MSCR_CFG_ENABLE;
- mscr &= ~MII_MSCR_CFG_VALUE = 0;
- #endif
-@@ -1644,7 +1608,7 @@ mii_get_media_pcs (struct net_device *dev)
-
- bmsr = mii_read (dev, phy_addr, PCS_BMSR);
- if (np->an_enable) {
-- if (!(bmsr & MII_BMSR_AN_COMPLETE)) {
-+ if (!(bmsr & BMSR_ANEGCOMPLETE)) {
- /* Auto-Negotiation not completed */
- return -1;
- }
-@@ -1669,7 +1633,7 @@ mii_get_media_pcs (struct net_device *dev)
- } else {
- __u16 bmcr = mii_read (dev, phy_addr, PCS_BMCR);
- printk (KERN_INFO "Operating at 1000 Mbps, ");
-- if (bmcr & MII_BMCR_DUPLEX_MODE) {
-+ if (bmcr & BMCR_FULLDPLX) {
- printk (KERN_CONT "Full duplex\n");
- } else {
- printk (KERN_CONT "Half duplex\n");
-@@ -1702,7 +1666,7 @@ mii_set_media_pcs (struct net_device *dev)
- if (np->an_enable) {
- /* Advertise capabilities */
- esr = mii_read (dev, phy_addr, PCS_ESR);
-- anar = mii_read (dev, phy_addr, MII_ANAR) &
-+ anar = mii_read (dev, phy_addr, MII_ADVERTISE) &
- ~PCS_ANAR_HALF_DUPLEX &
- ~PCS_ANAR_FULL_DUPLEX;
- if (esr & (MII_ESR_1000BT_HD | MII_ESR_1000BX_HD))
-@@ -1710,22 +1674,21 @@ mii_set_media_pcs (struct net_device *dev)
- if (esr & (MII_ESR_1000BT_FD | MII_ESR_1000BX_FD))
- anar |= PCS_ANAR_FULL_DUPLEX;
- anar |= PCS_ANAR_PAUSE | PCS_ANAR_ASYMMETRIC;
-- mii_write (dev, phy_addr, MII_ANAR, anar);
-+ mii_write (dev, phy_addr, MII_ADVERTISE, anar);
-
- /* Soft reset PHY */
-- mii_write (dev, phy_addr, MII_BMCR, MII_BMCR_RESET);
-- bmcr = MII_BMCR_AN_ENABLE | MII_BMCR_RESTART_AN |
-- MII_BMCR_RESET;
-+ mii_write (dev, phy_addr, MII_BMCR, BMCR_RESET);
-+ bmcr = BMCR_ANENABLE | BMCR_ANRESTART | BMCR_RESET;
- mii_write (dev, phy_addr, MII_BMCR, bmcr);
- mdelay(1);
- } else {
- /* Force speed setting */
- /* PHY Reset */
-- bmcr = MII_BMCR_RESET;
-+ bmcr = BMCR_RESET;
- mii_write (dev, phy_addr, MII_BMCR, bmcr);
- mdelay(10);
- if (np->full_duplex) {
-- bmcr = MII_BMCR_DUPLEX_MODE;
-+ bmcr = BMCR_FULLDPLX;
- printk (KERN_INFO "Manual full duplex\n");
- } else {
- bmcr = 0;
-@@ -1735,7 +1698,7 @@ mii_set_media_pcs (struct net_device *dev)
- mdelay(10);
-
- /* Advertise nothing */
-- mii_write (dev, phy_addr, MII_ANAR, 0);
-+ mii_write (dev, phy_addr, MII_ADVERTISE, 0);
- }
- return 0;
- }
-diff --git a/drivers/net/dl2k.h b/drivers/net/dl2k.h
-index 266ec87..cde8ecd 100644
---- a/drivers/net/dl2k.h
-+++ b/drivers/net/dl2k.h
-@@ -28,6 +28,7 @@
- #include <linux/init.h>
- #include <linux/crc32.h>
- #include <linux/ethtool.h>
-+#include <linux/mii.h>
- #include <linux/bitops.h>
- #include <asm/processor.h> /* Processor type for cache alignment. */
- #include <asm/io.h>
-@@ -271,20 +272,9 @@ enum RFS_bits {
- #define MII_RESET_TIME_OUT 10000
- /* MII register */
- enum _mii_reg {
-- MII_BMCR = 0,
-- MII_BMSR = 1,
-- MII_PHY_ID1 = 2,
-- MII_PHY_ID2 = 3,
-- MII_ANAR = 4,
-- MII_ANLPAR = 5,
-- MII_ANER = 6,
-- MII_ANNPT = 7,
-- MII_ANLPRNP = 8,
-- MII_MSCR = 9,
-- MII_MSSR = 10,
-- MII_ESR = 15,
- MII_PHY_SCR = 16,
- };
-+
- /* PCS register */
- enum _pcs_reg {
- PCS_BMCR = 0,
-@@ -297,102 +287,6 @@ enum _pcs_reg {
- PCS_ESR = 15,
- };
-
--/* Basic Mode Control Register */
--enum _mii_bmcr {
-- MII_BMCR_RESET = 0x8000,
-- MII_BMCR_LOOP_BACK = 0x4000,
-- MII_BMCR_SPEED_LSB = 0x2000,
-- MII_BMCR_AN_ENABLE = 0x1000,
-- MII_BMCR_POWER_DOWN = 0x0800,
-- MII_BMCR_ISOLATE = 0x0400,
-- MII_BMCR_RESTART_AN = 0x0200,
-- MII_BMCR_DUPLEX_MODE = 0x0100,
-- MII_BMCR_COL_TEST = 0x0080,
-- MII_BMCR_SPEED_MSB = 0x0040,
-- MII_BMCR_SPEED_RESERVED = 0x003f,
-- MII_BMCR_SPEED_10 = 0,
-- MII_BMCR_SPEED_100 = MII_BMCR_SPEED_LSB,
-- MII_BMCR_SPEED_1000 = MII_BMCR_SPEED_MSB,
--};
--
--/* Basic Mode Status Register */
--enum _mii_bmsr {
-- MII_BMSR_100BT4 = 0x8000,
-- MII_BMSR_100BX_FD = 0x4000,
-- MII_BMSR_100BX_HD = 0x2000,
-- MII_BMSR_10BT_FD = 0x1000,
-- MII_BMSR_10BT_HD = 0x0800,
-- MII_BMSR_100BT2_FD = 0x0400,
-- MII_BMSR_100BT2_HD = 0x0200,
-- MII_BMSR_EXT_STATUS = 0x0100,
-- MII_BMSR_PREAMBLE_SUPP = 0x0040,
-- MII_BMSR_AN_COMPLETE = 0x0020,
-- MII_BMSR_REMOTE_FAULT = 0x0010,
-- MII_BMSR_AN_ABILITY = 0x0008,
-- MII_BMSR_LINK_STATUS = 0x0004,
-- MII_BMSR_JABBER_DETECT = 0x0002,
-- MII_BMSR_EXT_CAP = 0x0001,
--};
--
--/* ANAR */
--enum _mii_anar {
-- MII_ANAR_NEXT_PAGE = 0x8000,
-- MII_ANAR_REMOTE_FAULT = 0x4000,
-- MII_ANAR_ASYMMETRIC = 0x0800,
-- MII_ANAR_PAUSE = 0x0400,
-- MII_ANAR_100BT4 = 0x0200,
-- MII_ANAR_100BX_FD = 0x0100,
-- MII_ANAR_100BX_HD = 0x0080,
-- MII_ANAR_10BT_FD = 0x0020,
-- MII_ANAR_10BT_HD = 0x0010,
-- MII_ANAR_SELECTOR = 0x001f,
-- MII_IEEE8023_CSMACD = 0x0001,
--};
--
--/* ANLPAR */
--enum _mii_anlpar {
-- MII_ANLPAR_NEXT_PAGE = MII_ANAR_NEXT_PAGE,
-- MII_ANLPAR_REMOTE_FAULT = MII_ANAR_REMOTE_FAULT,
-- MII_ANLPAR_ASYMMETRIC = MII_ANAR_ASYMMETRIC,
-- MII_ANLPAR_PAUSE = MII_ANAR_PAUSE,
-- MII_ANLPAR_100BT4 = MII_ANAR_100BT4,
-- MII_ANLPAR_100BX_FD = MII_ANAR_100BX_FD,
-- MII_ANLPAR_100BX_HD = MII_ANAR_100BX_HD,
-- MII_ANLPAR_10BT_FD = MII_ANAR_10BT_FD,
-- MII_ANLPAR_10BT_HD = MII_ANAR_10BT_HD,
-- MII_ANLPAR_SELECTOR = MII_ANAR_SELECTOR,
--};
--
--/* Auto-Negotiation Expansion Register */
--enum _mii_aner {
-- MII_ANER_PAR_DETECT_FAULT = 0x0010,
-- MII_ANER_LP_NEXTPAGABLE = 0x0008,
-- MII_ANER_NETXTPAGABLE = 0x0004,
-- MII_ANER_PAGE_RECEIVED = 0x0002,
-- MII_ANER_LP_NEGOTIABLE = 0x0001,
--};
--
--/* MASTER-SLAVE Control Register */
--enum _mii_mscr {
-- MII_MSCR_TEST_MODE = 0xe000,
-- MII_MSCR_CFG_ENABLE = 0x1000,
-- MII_MSCR_CFG_VALUE = 0x0800,
-- MII_MSCR_PORT_VALUE = 0x0400,
-- MII_MSCR_1000BT_FD = 0x0200,
-- MII_MSCR_1000BT_HD = 0X0100,
--};
--
--/* MASTER-SLAVE Status Register */
--enum _mii_mssr {
-- MII_MSSR_CFG_FAULT = 0x8000,
-- MII_MSSR_CFG_RES = 0x4000,
-- MII_MSSR_LOCAL_RCV_STATUS = 0x2000,
-- MII_MSSR_REMOTE_RCVR = 0x1000,
-- MII_MSSR_LP_1000BT_FD = 0x0800,
-- MII_MSSR_LP_1000BT_HD = 0x0400,
-- MII_MSSR_IDLE_ERR_COUNT = 0x00ff,
--};
--
- /* IEEE Extened Status Register */
- enum _mii_esr {
- MII_ESR_1000BX_FD = 0x8000,
-@@ -471,13 +365,6 @@ struct ioctl_data {
- char *data;
- };
-
--struct mii_data {
-- __u16 reserved;
-- __u16 reg_num;
-- __u16 in_value;
-- __u16 out_value;
--};
--
- /* The Rx and Tx buffer descriptors. */
- struct netdev_desc {
- __le64 next_desc;
-diff --git a/drivers/net/ks8851_mll.c b/drivers/net/ks8851_mll.c
-index c0ceebc..4e3a69c 100644
---- a/drivers/net/ks8851_mll.c
-+++ b/drivers/net/ks8851_mll.c
-@@ -35,7 +35,7 @@
- #define DRV_NAME "ks8851_mll"
-
- static u8 KS_DEFAULT_MAC_ADDRESS[] = { 0x00, 0x10, 0xA1, 0x86, 0x95, 0x11 };
--#define MAX_RECV_FRAMES 32
-+#define MAX_RECV_FRAMES 255
- #define MAX_BUF_SIZE 2048
- #define TX_BUF_SIZE 2000
- #define RX_BUF_SIZE 2000
-diff --git a/drivers/net/netxen/netxen_nic.h b/drivers/net/netxen/netxen_nic.h
-index e52af5b..50d2af8 100644
---- a/drivers/net/netxen/netxen_nic.h
-+++ b/drivers/net/netxen/netxen_nic.h
-@@ -700,7 +700,8 @@ struct netxen_recv_context {
- #define NX_CDRP_CMD_READ_PEXQ_PARAMETERS 0x0000001c
- #define NX_CDRP_CMD_GET_LIC_CAPABILITIES 0x0000001d
- #define NX_CDRP_CMD_READ_MAX_LRO_PER_BOARD 0x0000001e
--#define NX_CDRP_CMD_MAX 0x0000001f
-+#define NX_CDRP_CMD_CONFIG_GBE_PORT 0x0000001f
-+#define NX_CDRP_CMD_MAX 0x00000020
-
- #define NX_RCODE_SUCCESS 0
- #define NX_RCODE_NO_HOST_MEM 1
-@@ -1015,6 +1016,7 @@ typedef struct {
- #define NX_FW_CAPABILITY_BDG (1 << 8)
- #define NX_FW_CAPABILITY_FVLANTX (1 << 9)
- #define NX_FW_CAPABILITY_HW_LRO (1 << 10)
-+#define NX_FW_CAPABILITY_GBE_LINK_CFG (1 << 11)
-
- /* module types */
- #define LINKEVENT_MODULE_NOT_PRESENT 1
-@@ -1323,6 +1325,9 @@ int netxen_config_ipaddr(struct netxen_adapter *adapter, u32 ip, int cmd);
- int netxen_linkevent_request(struct netxen_adapter *adapter, int enable);
- void netxen_advert_link_change(struct netxen_adapter *adapter, int linkup);
-
-+int nx_fw_cmd_set_gbe_port(struct netxen_adapter *adapter,
-+ u32 speed, u32 duplex, u32 autoneg);
-+
- int nx_fw_cmd_set_mtu(struct netxen_adapter *adapter, int mtu);
- int netxen_nic_change_mtu(struct net_device *netdev, int new_mtu);
- int netxen_config_hw_lro(struct netxen_adapter *adapter, int enable);
-diff --git a/drivers/net/netxen/netxen_nic_ctx.c b/drivers/net/netxen/netxen_nic_ctx.c
-index 9cb8f68..f48cdb2 100644
---- a/drivers/net/netxen/netxen_nic_ctx.c
-+++ b/drivers/net/netxen/netxen_nic_ctx.c
-@@ -112,6 +112,21 @@ nx_fw_cmd_set_mtu(struct netxen_adapter *adapter, int mtu)
- return 0;
- }
-
-+int
-+nx_fw_cmd_set_gbe_port(struct netxen_adapter *adapter,
-+ u32 speed, u32 duplex, u32 autoneg)
-+{
-+
-+ return netxen_issue_cmd(adapter,
-+ adapter->ahw.pci_func,
-+ NXHAL_VERSION,
-+ speed,
-+ duplex,
-+ autoneg,
-+ NX_CDRP_CMD_CONFIG_GBE_PORT);
-+
-+}
-+
- static int
- nx_fw_cmd_create_rx_ctx(struct netxen_adapter *adapter)
- {
-diff --git a/drivers/net/netxen/netxen_nic_ethtool.c b/drivers/net/netxen/netxen_nic_ethtool.c
-index 714f387..7e34840 100644
---- a/drivers/net/netxen/netxen_nic_ethtool.c
-+++ b/drivers/net/netxen/netxen_nic_ethtool.c
-@@ -216,7 +216,6 @@ skip:
- check_sfp_module = netif_running(dev) &&
- adapter->has_link_events;
- } else {
-- ecmd->autoneg = AUTONEG_ENABLE;
- ecmd->supported |= (SUPPORTED_TP |SUPPORTED_Autoneg);
- ecmd->advertising |=
- (ADVERTISED_TP | ADVERTISED_Autoneg);
-@@ -254,53 +253,24 @@ static int
- netxen_nic_set_settings(struct net_device *dev, struct ethtool_cmd *ecmd)
- {
- struct netxen_adapter *adapter = netdev_priv(dev);
-- __u32 status;
-+ int ret;
-
-- /* read which mode */
-- if (adapter->ahw.port_type == NETXEN_NIC_GBE) {
-- /* autonegotiation */
-- if (adapter->phy_write
-- && adapter->phy_write(adapter,
-- NETXEN_NIU_GB_MII_MGMT_ADDR_AUTONEG,
-- ecmd->autoneg) != 0)
-- return -EIO;
-- else
-- adapter->link_autoneg = ecmd->autoneg;
-+ if (adapter->ahw.port_type != NETXEN_NIC_GBE)
-+ return -EOPNOTSUPP;
-
-- if (adapter->phy_read
-- && adapter->phy_read(adapter,
-- NETXEN_NIU_GB_MII_MGMT_ADDR_PHY_STATUS,
-- &status) != 0)
-- return -EIO;
-+ if (!(adapter->capabilities & NX_FW_CAPABILITY_GBE_LINK_CFG))
-+ return -EOPNOTSUPP;
-
-- /* speed */
-- switch (ecmd->speed) {
-- case SPEED_10:
-- netxen_set_phy_speed(status, 0);
-- break;
-- case SPEED_100:
-- netxen_set_phy_speed(status, 1);
-- break;
-- case SPEED_1000:
-- netxen_set_phy_speed(status, 2);
-- break;
-- }
-- /* set duplex mode */
-- if (ecmd->duplex == DUPLEX_HALF)
-- netxen_clear_phy_duplex(status);
-- if (ecmd->duplex == DUPLEX_FULL)
-- netxen_set_phy_duplex(status);
-- if (adapter->phy_write
-- && adapter->phy_write(adapter,
-- NETXEN_NIU_GB_MII_MGMT_ADDR_PHY_STATUS,
-- *((int *)&status)) != 0)
-- return -EIO;
-- else {
-- adapter->link_speed = ecmd->speed;
-- adapter->link_duplex = ecmd->duplex;
-- }
-- } else
-+ ret = nx_fw_cmd_set_gbe_port(adapter, ecmd->speed, ecmd->duplex,
-+ ecmd->autoneg);
-+ if (ret == NX_RCODE_NOT_SUPPORTED)
- return -EOPNOTSUPP;
-+ else if (ret)
-+ return -EIO;
-+
-+ adapter->link_speed = ecmd->speed;
-+ adapter->link_duplex = ecmd->duplex;
-+ adapter->link_autoneg = ecmd->autoneg;
-
- if (!netif_running(dev))
- return 0;
-diff --git a/drivers/net/tun.c b/drivers/net/tun.c
-index 0f77aca..894ad84 100644
---- a/drivers/net/tun.c
-+++ b/drivers/net/tun.c
-@@ -1121,10 +1121,12 @@ static long tun_chr_ioctl(struct file *file, unsigned int cmd,
- int sndbuf;
- int ret;
-
-- if (cmd == TUNSETIFF || _IOC_TYPE(cmd) == 0x89)
-+ if (cmd == TUNSETIFF || _IOC_TYPE(cmd) == 0x89) {
- if (copy_from_user(&ifr, argp, sizeof ifr))
- return -EFAULT;
--
-+ } else {
-+ memset(&ifr, 0, sizeof(ifr));
-+ }
- if (cmd == TUNGETFEATURES) {
- /* Currently this just means: "what IFF flags are valid?".
- * This is needed because we never checked for invalid flags on
-diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c
-index e391ef9..fd8e335 100644
---- a/drivers/net/usb/kaweth.c
-+++ b/drivers/net/usb/kaweth.c
-@@ -1325,7 +1325,7 @@ static int kaweth_internal_control_msg(struct usb_device *usb_dev,
- int retv;
- int length = 0; /* shut up GCC */
-
-- urb = usb_alloc_urb(0, GFP_NOIO);
-+ urb = usb_alloc_urb(0, GFP_ATOMIC);
- if (!urb)
- return -ENOMEM;
-
-diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
-index da33dce..07f69ee 100644
---- a/drivers/net/usb/usbnet.c
-+++ b/drivers/net/usb/usbnet.c
-@@ -584,6 +584,14 @@ static int unlink_urbs (struct usbnet *dev, struct sk_buff_head *q)
- entry = (struct skb_data *) skb->cb;
- urb = entry->urb;
-
-+ /*
-+ * Get reference count of the URB to avoid it to be
-+ * freed during usb_unlink_urb, which may trigger
-+ * use-after-free problem inside usb_unlink_urb since
-+ * usb_unlink_urb is always racing with .complete
-+ * handler(include defer_bh).
-+ */
-+ usb_get_urb(urb);
- spin_unlock_irqrestore(&q->lock, flags);
- // during some PM-driven resume scenarios,
- // these (async) unlinks complete immediately
-@@ -592,6 +600,7 @@ static int unlink_urbs (struct usbnet *dev, struct sk_buff_head *q)
- devdbg (dev, "unlink urb err, %d", retval);
- else
- count++;
-+ usb_put_urb(urb);
- spin_lock_irqsave(&q->lock, flags);
- }
- spin_unlock_irqrestore (&q->lock, flags);
-@@ -989,7 +998,6 @@ static void tx_complete (struct urb *urb)
- }
- }
-
-- urb->dev = NULL;
- entry->state = tx_done;
- defer_bh(dev, skb, &dev->txq);
- }
-diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
-index 1e42381..d0959af 100644
---- a/drivers/pci/quirks.c
-+++ b/drivers/pci/quirks.c
-@@ -2550,6 +2550,40 @@ static void __devinit fixup_ti816x_class(struct pci_dev* dev)
- }
- DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_TI, 0xb800, fixup_ti816x_class);
-
-+/*
-+ * Some BIOS implementations leave the Intel GPU interrupts enabled,
-+ * even though no one is handling them (f.e. i915 driver is never loaded).
-+ * Additionally the interrupt destination is not set up properly
-+ * and the interrupt ends up -somewhere-.
-+ *
-+ * These spurious interrupts are "sticky" and the kernel disables
-+ * the (shared) interrupt line after 100.000+ generated interrupts.
-+ *
-+ * Fix it by disabling the still enabled interrupts.
-+ * This resolves crashes often seen on monitor unplug.
-+ */
-+#define I915_DEIER_REG 0x4400c
-+static void __devinit disable_igfx_irq(struct pci_dev *dev)
-+{
-+ void __iomem *regs = pci_iomap(dev, 0, 0);
-+ if (regs == NULL) {
-+ dev_warn(&dev->dev, "igfx quirk: Can't iomap PCI device\n");
-+ return;
-+ }
-+
-+ /* Check if any interrupt line is still enabled */
-+ if (readl(regs + I915_DEIER_REG) != 0) {
-+ dev_warn(&dev->dev, "BIOS left Intel GPU interrupts enabled; "
-+ "disabling\n");
-+
-+ writel(0, regs + I915_DEIER_REG);
-+ }
-+
-+ pci_iounmap(dev, regs);
-+}
-+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0102, disable_igfx_irq);
-+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x010a, disable_igfx_irq);
-+
- static void pci_do_fixups(struct pci_dev *dev, struct pci_fixup *f,
- struct pci_fixup *end)
- {
-diff --git a/drivers/pnp/quirks.c b/drivers/pnp/quirks.c
-index eb39d26..253996c 100644
---- a/drivers/pnp/quirks.c
-+++ b/drivers/pnp/quirks.c
-@@ -300,9 +300,9 @@ static void quirk_system_pci_resources(struct pnp_dev *dev)
- }
- }
-
--#ifdef CONFIG_AMD_NB
-+#ifdef CONFIG_K8_NB
-
--#include <asm/amd_nb.h>
-+#include <asm/k8.h>
-
- static void quirk_amd_mmconfig_area(struct pnp_dev *dev)
- {
-@@ -366,7 +366,7 @@ static struct pnp_fixup pnp_fixups[] = {
- /* PnP resources that might overlap PCI BARs */
- {"PNP0c01", quirk_system_pci_resources},
- {"PNP0c02", quirk_system_pci_resources},
--#ifdef CONFIG_AMD_NB
-+#ifdef CONFIG_K8_NB
- {"PNP0c01", quirk_amd_mmconfig_area},
- #endif
- {""}
-diff --git a/drivers/rtc/rtc-wm831x.c b/drivers/rtc/rtc-wm831x.c
-index 79795cd..daefe66 100644
---- a/drivers/rtc/rtc-wm831x.c
-+++ b/drivers/rtc/rtc-wm831x.c
-@@ -23,7 +23,7 @@
- #include <linux/mfd/wm831x/core.h>
- #include <linux/delay.h>
- #include <linux/platform_device.h>
--
-+#include <linux/random.h>
-
- /*
- * R16416 (0x4020) - RTC Write Counter
-@@ -95,6 +95,26 @@ struct wm831x_rtc {
- unsigned int alarm_enabled:1;
- };
-
-+static void wm831x_rtc_add_randomness(struct wm831x *wm831x)
-+{
-+ int ret;
-+ u16 reg;
-+
-+ /*
-+ * The write counter contains a pseudo-random number which is
-+ * regenerated every time we set the RTC so it should be a
-+ * useful per-system source of entropy.
-+ */
-+ ret = wm831x_reg_read(wm831x, WM831X_RTC_WRITE_COUNTER);
-+ if (ret >= 0) {
-+ reg = ret;
-+ add_device_randomness(®, sizeof(reg));
-+ } else {
-+ dev_warn(wm831x->dev, "Failed to read RTC write counter: %d\n",
-+ ret);
-+ }
-+}
-+
- /*
- * Read current time and date in RTC
- */
-@@ -464,6 +484,8 @@ static int wm831x_rtc_probe(struct platform_device *pdev)
- alm_irq, ret);
- }
-
-+ wm831x_rtc_add_randomness(wm831x);
-+
- return 0;
-
- err:
-diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
-index b10ee2a..1bdfde1 100644
---- a/drivers/scsi/libsas/sas_expander.c
-+++ b/drivers/scsi/libsas/sas_expander.c
-@@ -754,7 +754,7 @@ static struct domain_device *sas_ex_discover_end_dev(
- }
-
- /* See if this phy is part of a wide port */
--static int sas_ex_join_wide_port(struct domain_device *parent, int phy_id)
-+static bool sas_ex_join_wide_port(struct domain_device *parent, int phy_id)
- {
- struct ex_phy *phy = &parent->ex_dev.ex_phy[phy_id];
- int i;
-@@ -770,11 +770,11 @@ static int sas_ex_join_wide_port(struct domain_device *parent, int phy_id)
- sas_port_add_phy(ephy->port, phy->phy);
- phy->port = ephy->port;
- phy->phy_state = PHY_DEVICE_DISCOVERED;
-- return 0;
-+ return true;
- }
- }
-
-- return -ENODEV;
-+ return false;
- }
-
- static struct domain_device *sas_ex_discover_expander(
-@@ -912,8 +912,7 @@ static int sas_ex_discover_dev(struct domain_device *dev, int phy_id)
- return res;
- }
-
-- res = sas_ex_join_wide_port(dev, phy_id);
-- if (!res) {
-+ if (sas_ex_join_wide_port(dev, phy_id)) {
- SAS_DPRINTK("Attaching ex phy%d to wide port %016llx\n",
- phy_id, SAS_ADDR(ex_phy->attached_sas_addr));
- return res;
-@@ -958,8 +957,7 @@ static int sas_ex_discover_dev(struct domain_device *dev, int phy_id)
- if (SAS_ADDR(ex->ex_phy[i].attached_sas_addr) ==
- SAS_ADDR(child->sas_addr)) {
- ex->ex_phy[i].phy_state= PHY_DEVICE_DISCOVERED;
-- res = sas_ex_join_wide_port(dev, i);
-- if (!res)
-+ if (sas_ex_join_wide_port(dev, i))
- SAS_DPRINTK("Attaching ex phy%d to wide port %016llx\n",
- i, SAS_ADDR(ex->ex_phy[i].attached_sas_addr));
-
-@@ -1812,32 +1810,20 @@ static int sas_discover_new(struct domain_device *dev, int phy_id)
- {
- struct ex_phy *ex_phy = &dev->ex_dev.ex_phy[phy_id];
- struct domain_device *child;
-- bool found = false;
-- int res, i;
-+ int res;
-
- SAS_DPRINTK("ex %016llx phy%d new device attached\n",
- SAS_ADDR(dev->sas_addr), phy_id);
- res = sas_ex_phy_discover(dev, phy_id);
- if (res)
-- goto out;
-- /* to support the wide port inserted */
-- for (i = 0; i < dev->ex_dev.num_phys; i++) {
-- struct ex_phy *ex_phy_temp = &dev->ex_dev.ex_phy[i];
-- if (i == phy_id)
-- continue;
-- if (SAS_ADDR(ex_phy_temp->attached_sas_addr) ==
-- SAS_ADDR(ex_phy->attached_sas_addr)) {
-- found = true;
-- break;
-- }
-- }
-- if (found) {
-- sas_ex_join_wide_port(dev, phy_id);
-+ return res;
-+
-+ if (sas_ex_join_wide_port(dev, phy_id))
- return 0;
-- }
-+
- res = sas_ex_discover_devices(dev, phy_id);
-- if (!res)
-- goto out;
-+ if (res)
-+ return res;
- list_for_each_entry(child, &dev->ex_dev.children, siblings) {
- if (SAS_ADDR(child->sas_addr) ==
- SAS_ADDR(ex_phy->attached_sas_addr)) {
-@@ -1847,7 +1833,6 @@ static int sas_discover_new(struct domain_device *dev, int phy_id)
- break;
- }
- }
--out:
- return res;
- }
-
-@@ -1946,9 +1931,7 @@ int sas_ex_revalidate_domain(struct domain_device *port_dev)
- struct domain_device *dev = NULL;
-
- res = sas_find_bcast_dev(port_dev, &dev);
-- if (res)
-- goto out;
-- if (dev) {
-+ while (res == 0 && dev) {
- struct expander_device *ex = &dev->ex_dev;
- int i = 0, phy_id;
-
-@@ -1960,8 +1943,10 @@ int sas_ex_revalidate_domain(struct domain_device *port_dev)
- res = sas_rediscover(dev, phy_id);
- i = phy_id + 1;
- } while (i < ex->num_phys);
-+
-+ dev = NULL;
-+ res = sas_find_bcast_dev(port_dev, &dev);
- }
--out:
- return res;
- }
-
-diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
-index 573921d..3890793 100644
---- a/drivers/scsi/scsi_error.c
-+++ b/drivers/scsi/scsi_error.c
-@@ -1550,6 +1550,20 @@ static void scsi_restart_operations(struct Scsi_Host *shost)
- * requests are started.
- */
- scsi_run_host_queues(shost);
-+
-+ /*
-+ * if eh is active and host_eh_scheduled is pending we need to re-run
-+ * recovery. we do this check after scsi_run_host_queues() to allow
-+ * everything pent up since the last eh run a chance to make forward
-+ * progress before we sync again. Either we'll immediately re-run
-+ * recovery or scsi_device_unbusy() will wake us again when these
-+ * pending commands complete.
-+ */
-+ spin_lock_irqsave(shost->host_lock, flags);
-+ if (shost->host_eh_scheduled)
-+ if (scsi_host_set_state(shost, SHOST_RECOVERY))
-+ WARN_ON(scsi_host_set_state(shost, SHOST_CANCEL_RECOVERY));
-+ spin_unlock_irqrestore(shost->host_lock, flags);
- }
-
- /**
-diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
-index 8df12522..e28f9b0 100644
---- a/drivers/scsi/scsi_lib.c
-+++ b/drivers/scsi/scsi_lib.c
-@@ -482,15 +482,26 @@ static void scsi_run_queue(struct request_queue *q)
- */
- static void scsi_requeue_command(struct request_queue *q, struct scsi_cmnd *cmd)
- {
-+ struct scsi_device *sdev = cmd->device;
- struct request *req = cmd->request;
- unsigned long flags;
-
-+ /*
-+ * We need to hold a reference on the device to avoid the queue being
-+ * killed after the unlock and before scsi_run_queue is invoked which
-+ * may happen because scsi_unprep_request() puts the command which
-+ * releases its reference on the device.
-+ */
-+ get_device(&sdev->sdev_gendev);
-+
- spin_lock_irqsave(q->queue_lock, flags);
- scsi_unprep_request(req);
- blk_requeue_request(q, req);
- spin_unlock_irqrestore(q->queue_lock, flags);
-
- scsi_run_queue(q);
-+
-+ put_device(&sdev->sdev_gendev);
- }
-
- void scsi_next_command(struct scsi_cmnd *cmd)
-diff --git a/drivers/scsi/scsi_priv.h b/drivers/scsi/scsi_priv.h
-index 1fbf7c7..11c0085 100644
---- a/drivers/scsi/scsi_priv.h
-+++ b/drivers/scsi/scsi_priv.h
-@@ -107,6 +107,7 @@ extern void scsi_exit_procfs(void);
- #endif /* CONFIG_PROC_FS */
-
- /* scsi_scan.c */
-+extern int scsi_complete_async_scans(void);
- extern int scsi_scan_host_selected(struct Scsi_Host *, unsigned int,
- unsigned int, unsigned int, int);
- extern void scsi_forget_host(struct Scsi_Host *);
-diff --git a/drivers/scsi/scsi_wait_scan.c b/drivers/scsi/scsi_wait_scan.c
-index 74708fc..5c22bda 100644
---- a/drivers/scsi/scsi_wait_scan.c
-+++ b/drivers/scsi/scsi_wait_scan.c
-@@ -13,6 +13,7 @@
- #include <linux/module.h>
- #include <linux/device.h>
- #include <scsi/scsi_scan.h>
-+#include "scsi_priv.h"
-
- static int __init wait_scan_init(void)
- {
-diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
-index 653f853..8ad9dfb 100644
---- a/drivers/usb/class/cdc-acm.c
-+++ b/drivers/usb/class/cdc-acm.c
-@@ -1120,7 +1120,8 @@ skip_normal_probe:
- }
-
-
-- if (data_interface->cur_altsetting->desc.bNumEndpoints < 2)
-+ if (data_interface->cur_altsetting->desc.bNumEndpoints < 2 ||
-+ control_interface->cur_altsetting->desc.bNumEndpoints == 0)
- return -EINVAL;
-
- epctrl = &control_interface->cur_altsetting->endpoint[0].desc;
-diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
-index d71514b..37f2899 100644
---- a/drivers/usb/class/cdc-wdm.c
-+++ b/drivers/usb/class/cdc-wdm.c
-@@ -441,6 +441,8 @@ retry:
- goto retry;
- }
- if (!desc->reslength) { /* zero length read */
-+ dev_dbg(&desc->intf->dev, "%s: zero length - clearing WDM_READ\n", __func__);
-+ clear_bit(WDM_READ, &desc->flags);
- spin_unlock_irq(&desc->iuspin);
- goto retry;
- }
-diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
-index df1e873..48742ff 100644
---- a/drivers/usb/core/devio.c
-+++ b/drivers/usb/core/devio.c
-@@ -1454,10 +1454,14 @@ static int processcompl_compat(struct async *as, void __user * __user *arg)
- void __user *addr = as->userurb;
- unsigned int i;
-
-- if (as->userbuffer && urb->actual_length)
-- if (copy_to_user(as->userbuffer, urb->transfer_buffer,
-- urb->actual_length))
-+ if (as->userbuffer && urb->actual_length) {
-+ if (urb->number_of_packets > 0) /* Isochronous */
-+ i = urb->transfer_buffer_length;
-+ else /* Non-Isoc */
-+ i = urb->actual_length;
-+ if (copy_to_user(as->userbuffer, urb->transfer_buffer, i))
- return -EFAULT;
-+ }
- if (put_user(as->status, &userurb->status))
- return -EFAULT;
- if (put_user(urb->actual_length, &userurb->actual_length))
-diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
-index 2b428fc..02aad50 100644
---- a/drivers/usb/core/hub.c
-+++ b/drivers/usb/core/hub.c
-@@ -23,6 +23,7 @@
- #include <linux/mutex.h>
- #include <linux/freezer.h>
- #include <linux/usb/quirks.h>
-+#include <linux/random.h>
-
- #include <asm/uaccess.h>
- #include <asm/byteorder.h>
-@@ -458,10 +459,8 @@ hub_clear_tt_buffer (struct usb_device *hdev, u16 devinfo, u16 tt)
- * talking to TTs must queue control transfers (not just bulk and iso), so
- * both can talk to the same hub concurrently.
- */
--static void hub_tt_work(struct work_struct *work)
-+void _hub_tt_work(struct usb_hub *hub)
- {
-- struct usb_hub *hub =
-- container_of(work, struct usb_hub, tt.clear_work);
- unsigned long flags;
- int limit = 100;
-
-@@ -496,6 +495,14 @@ static void hub_tt_work(struct work_struct *work)
- spin_unlock_irqrestore (&hub->tt.lock, flags);
- }
-
-+void hub_tt_work(struct work_struct *work)
-+{
-+ struct usb_hub *hub =
-+ container_of(work, struct usb_hub, tt.clear_work);
-+
-+ _hub_tt_work(hub);
-+}
-+
- /**
- * usb_hub_clear_tt_buffer - clear control/bulk TT state in high speed hub
- * @urb: an URB associated with the failed or incomplete split transaction
-@@ -543,7 +550,20 @@ int usb_hub_clear_tt_buffer(struct urb *urb)
- /* tell keventd to clear state for this TT */
- spin_lock_irqsave (&tt->lock, flags);
- list_add_tail (&clear->clear_list, &tt->clear_list);
-- schedule_work(&tt->clear_work);
-+ /* don't schedule on kevent if we're running on keventd (e.g.,
-+ * in hid_reset we can get here on kevent) unless on >=2.6.36
-+ */
-+ if (!current_is_keventd())
-+ /* put it on keventd */
-+ schedule_work(&tt->clear_work);
-+ else {
-+ /* let khubd do it */
-+ struct usb_hub *hub =
-+ container_of(&tt->clear_work, struct usb_hub,
-+ tt.clear_work);
-+ kick_khubd(hub);
-+ }
-+
- spin_unlock_irqrestore (&tt->lock, flags);
- return 0;
- }
-@@ -1812,6 +1832,14 @@ int usb_new_device(struct usb_device *udev)
- /* Tell the world! */
- announce_device(udev);
-
-+ if (udev->serial)
-+ add_device_randomness(udev->serial, strlen(udev->serial));
-+ if (udev->product)
-+ add_device_randomness(udev->product, strlen(udev->product));
-+ if (udev->manufacturer)
-+ add_device_randomness(udev->manufacturer,
-+ strlen(udev->manufacturer));
-+
- /* Register the device. The device driver is responsible
- * for configuring the device and invoking the add-device
- * notifier chain (used by usbfs and possibly others).
-@@ -3274,6 +3302,10 @@ static void hub_events(void)
- if (hub->quiescing)
- goto loop_autopm;
-
-+ /* _hub_tt_work usually run on keventd */
-+ if (!list_empty(&hub->tt.clear_list))
-+ _hub_tt_work(hub);
-+
- if (hub->error) {
- dev_dbg (hub_dev, "resetting for error %d\n",
- hub->error);
-diff --git a/drivers/usb/early/ehci-dbgp.c b/drivers/usb/early/ehci-dbgp.c
-index 1206a26..7565f55 100644
---- a/drivers/usb/early/ehci-dbgp.c
-+++ b/drivers/usb/early/ehci-dbgp.c
-@@ -449,7 +449,7 @@ static int dbgp_ehci_startup(void)
- writel(FLAG_CF, &ehci_regs->configured_flag);
-
- /* Wait until the controller is no longer halted */
-- loop = 10;
-+ loop = 1000;
- do {
- status = readl(&ehci_regs->status);
- if (!(status & STS_HALT))
-diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
-index 0ff157a..981b604 100644
---- a/drivers/usb/host/pci-quirks.c
-+++ b/drivers/usb/host/pci-quirks.c
-@@ -458,9 +458,13 @@ static void __devinit quirk_usb_handoff_xhci(struct pci_dev *pdev)
- }
- }
-
-- /* Disable any BIOS SMIs */
-- writel(XHCI_LEGACY_DISABLE_SMI,
-- base + ext_cap_offset + XHCI_LEGACY_CONTROL_OFFSET);
-+ val = readl(base + ext_cap_offset + XHCI_LEGACY_CONTROL_OFFSET);
-+ /* Mask off (turn off) any enabled SMIs */
-+ val &= XHCI_LEGACY_DISABLE_SMI;
-+ /* Mask all SMI events bits, RW1C */
-+ val |= XHCI_LEGACY_SMI_EVENTS;
-+ /* Disable any BIOS SMIs and clear all SMI events*/
-+ writel(val, base + ext_cap_offset + XHCI_LEGACY_CONTROL_OFFSET);
-
- hc_init:
- op_reg_base = base + XHCI_HC_LENGTH(readl(base));
-diff --git a/drivers/usb/host/xhci-ext-caps.h b/drivers/usb/host/xhci-ext-caps.h
-index 78c4eda..e2acc97 100644
---- a/drivers/usb/host/xhci-ext-caps.h
-+++ b/drivers/usb/host/xhci-ext-caps.h
-@@ -62,8 +62,9 @@
- /* USB Legacy Support Control and Status Register - section 7.1.2 */
- /* Add this offset, plus the value of xECP in HCCPARAMS to the base address */
- #define XHCI_LEGACY_CONTROL_OFFSET (0x04)
--/* bits 1:2, 5:12, and 17:19 need to be preserved; bits 21:28 should be zero */
--#define XHCI_LEGACY_DISABLE_SMI ((0x3 << 1) + (0xff << 5) + (0x7 << 17))
-+/* bits 1:3, 5:12, and 17:19 need to be preserved; bits 21:28 should be zero */
-+#define XHCI_LEGACY_DISABLE_SMI ((0x7 << 1) + (0xff << 5) + (0x7 << 17))
-+#define XHCI_LEGACY_SMI_EVENTS (0x7 << 29)
-
- /* command register values to disable interrupts and halt the HC */
- /* start/stop HC execution - do not write unless HC is halted*/
-diff --git a/drivers/usb/host/xhci-hcd.c b/drivers/usb/host/xhci-hcd.c
-index 56661a2..0641633 100644
---- a/drivers/usb/host/xhci-hcd.c
-+++ b/drivers/usb/host/xhci-hcd.c
-@@ -150,7 +150,7 @@ int xhci_reset(struct xhci_hcd *xhci)
- xhci_to_hcd(xhci)->state = HC_STATE_HALT;
-
- ret = handshake(xhci, &xhci->op_regs->command,
-- CMD_RESET, 0, 250 * 1000);
-+ CMD_RESET, 0, 10 * 1000 * 1000);
- if (ret)
- return ret;
-
-diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
-index 8c29073..776fd43 100644
---- a/drivers/usb/host/xhci-mem.c
-+++ b/drivers/usb/host/xhci-mem.c
-@@ -934,11 +934,6 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
- int i;
-
- /* Free the Event Ring Segment Table and the actual Event Ring */
-- if (xhci->ir_set) {
-- xhci_writel(xhci, 0, &xhci->ir_set->erst_size);
-- xhci_write_64(xhci, 0, &xhci->ir_set->erst_base);
-- xhci_write_64(xhci, 0, &xhci->ir_set->erst_dequeue);
-- }
- size = sizeof(struct xhci_erst_entry)*(xhci->erst.num_entries);
- if (xhci->erst.entries)
- pci_free_consistent(pdev, size,
-@@ -950,7 +945,7 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
- xhci->event_ring = NULL;
- xhci_dbg(xhci, "Freed event ring\n");
-
-- xhci_write_64(xhci, 0, &xhci->op_regs->cmd_ring);
-+ xhci->cmd_ring_reserved_trbs = 0;
- if (xhci->cmd_ring)
- xhci_ring_free(xhci, xhci->cmd_ring);
- xhci->cmd_ring = NULL;
-@@ -969,7 +964,6 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
- xhci->device_pool = NULL;
- xhci_dbg(xhci, "Freed device context pool\n");
-
-- xhci_write_64(xhci, 0, &xhci->op_regs->dcbaa_ptr);
- if (xhci->dcbaa)
- pci_free_consistent(pdev, sizeof(*xhci->dcbaa),
- xhci->dcbaa, xhci->dcbaa->dma);
-@@ -1146,6 +1140,8 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
-
- fail:
- xhci_warn(xhci, "Couldn't initialize memory\n");
-+ xhci_halt(xhci);
-+ xhci_reset(xhci);
- xhci_mem_cleanup(xhci);
- return -ENOMEM;
- }
-diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
-index 0a1ccaa..c374beb 100644
---- a/drivers/usb/serial/ftdi_sio.c
-+++ b/drivers/usb/serial/ftdi_sio.c
-@@ -1784,7 +1784,8 @@ static int ftdi_8u2232c_probe(struct usb_serial *serial)
-
- dbg("%s", __func__);
-
-- if (strcmp(udev->manufacturer, "CALAO Systems") == 0)
-+ if ((udev->manufacturer) &&
-+ (strcmp(udev->manufacturer, "CALAO Systems") == 0))
- return ftdi_jtag_probe(serial);
-
- return 0;
-diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
-index 9fdcee2..61829b8 100644
---- a/drivers/usb/serial/mos7840.c
-+++ b/drivers/usb/serial/mos7840.c
-@@ -1181,9 +1181,12 @@ static int mos7840_chars_in_buffer(struct tty_struct *tty)
- }
-
- spin_lock_irqsave(&mos7840_port->pool_lock, flags);
-- for (i = 0; i < NUM_URBS; ++i)
-- if (mos7840_port->busy[i])
-- chars += URB_TRANSFER_BUFFER_SIZE;
-+ for (i = 0; i < NUM_URBS; ++i) {
-+ if (mos7840_port->busy[i]) {
-+ struct urb *urb = mos7840_port->write_urb_pool[i];
-+ chars += urb->transfer_buffer_length;
-+ }
-+ }
- spin_unlock_irqrestore(&mos7840_port->pool_lock, flags);
- dbg("%s - returns %d", __func__, chars);
- return chars;
-diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
-index f23f3b4..5429bc5 100644
---- a/drivers/usb/serial/usb-serial.c
-+++ b/drivers/usb/serial/usb-serial.c
-@@ -1083,6 +1083,12 @@ int usb_serial_probe(struct usb_interface *interface,
- serial->attached = 1;
- }
-
-+ /* Avoid race with tty_open and serial_install by setting the
-+ * disconnected flag and not clearing it until all ports have been
-+ * registered.
-+ */
-+ serial->disconnected = 1;
-+
- if (get_free_serial(serial, num_ports, &minor) == NULL) {
- dev_err(&interface->dev, "No more free serial devices\n");
- goto probe_error;
-@@ -1105,6 +1111,8 @@ int usb_serial_probe(struct usb_interface *interface,
- }
- }
-
-+ serial->disconnected = 0;
-+
- usb_serial_console_init(debug, minor);
-
- exit:
-diff --git a/drivers/video/uvesafb.c b/drivers/video/uvesafb.c
-index 54fbb29..6623a2e 100644
---- a/drivers/video/uvesafb.c
-+++ b/drivers/video/uvesafb.c
-@@ -814,8 +814,15 @@ static int __devinit uvesafb_vbe_init(struct fb_info *info)
- par->pmi_setpal = pmi_setpal;
- par->ypan = ypan;
-
-- if (par->pmi_setpal || par->ypan)
-- uvesafb_vbe_getpmi(task, par);
-+ if (par->pmi_setpal || par->ypan) {
-+ if (__supported_pte_mask & _PAGE_NX) {
-+ par->pmi_setpal = par->ypan = 0;
-+ printk(KERN_WARNING "uvesafb: NX protection is actively."
-+ "We have better not to use the PMI.\n");
-+ } else {
-+ uvesafb_vbe_getpmi(task, par);
-+ }
-+ }
- #else
- /* The protected mode interface is not available on non-x86. */
- par->pmi_setpal = par->ypan = 0;
-diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c
-index c0861e7..8aac2d6 100644
---- a/fs/btrfs/async-thread.c
-+++ b/fs/btrfs/async-thread.c
-@@ -211,10 +211,17 @@ static noinline int run_ordered_completions(struct btrfs_workers *workers,
-
- work->ordered_func(work);
-
-- /* now take the lock again and call the freeing code */
-+ /* now take the lock again and drop our item from the list */
- spin_lock(&workers->order_lock);
- list_del(&work->order_list);
-+ spin_unlock(&workers->order_lock);
-+
-+ /*
-+ * we don't want to call the ordered free functions
-+ * with the lock held though
-+ */
- work->ordered_free(work);
-+ spin_lock(&workers->order_lock);
- }
-
- spin_unlock(&workers->order_lock);
-diff --git a/fs/compat.c b/fs/compat.c
-index d1e2411..46b93d1 100644
---- a/fs/compat.c
-+++ b/fs/compat.c
-@@ -1208,11 +1208,14 @@ compat_sys_readv(unsigned long fd, const struct compat_iovec __user *vec,
- struct file *file;
- int fput_needed;
- ssize_t ret;
-+ loff_t pos;
-
- file = fget_light(fd, &fput_needed);
- if (!file)
- return -EBADF;
-- ret = compat_readv(file, vec, vlen, &file->f_pos);
-+ pos = file->f_pos;
-+ ret = compat_readv(file, vec, vlen, &pos);
-+ file->f_pos = pos;
- fput_light(file, fput_needed);
- return ret;
- }
-@@ -1265,11 +1268,14 @@ compat_sys_writev(unsigned long fd, const struct compat_iovec __user *vec,
- struct file *file;
- int fput_needed;
- ssize_t ret;
-+ loff_t pos;
-
- file = fget_light(fd, &fput_needed);
- if (!file)
- return -EBADF;
-- ret = compat_writev(file, vec, vlen, &file->f_pos);
-+ pos = file->f_pos;
-+ ret = compat_writev(file, vec, vlen, &pos);
-+ file->f_pos = pos;
- fput_light(file, fput_needed);
- return ret;
- }
-diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
-index 90a6087..3c1dbc0 100644
---- a/fs/ecryptfs/inode.c
-+++ b/fs/ecryptfs/inode.c
-@@ -777,6 +777,9 @@ static int truncate_upper(struct dentry *dentry, struct iattr *ia,
- goto out;
- }
- crypt_stat = &ecryptfs_inode_to_private(dentry->d_inode)->crypt_stat;
-+ if (crypt_stat->flags & ECRYPTFS_NEW_FILE)
-+ crypt_stat->flags &= ~(ECRYPTFS_NEW_FILE);
-+
- /* Set up a fake ecryptfs file, this is used to interface with
- * the file in the underlying filesystem so that the
- * truncation has an effect there as well. */
-@@ -1035,6 +1038,8 @@ ecryptfs_setxattr(struct dentry *dentry, const char *name, const void *value,
- rc = lower_dentry->d_inode->i_op->setxattr(lower_dentry, name, value,
- size, flags);
- mutex_unlock(&lower_dentry->d_inode->i_mutex);
-+ if (!rc)
-+ fsstack_copy_attr_all(dentry->d_inode, lower_dentry->d_inode, NULL);
- out:
- return rc;
- }
-diff --git a/fs/ecryptfs/kthread.c b/fs/ecryptfs/kthread.c
-index e14cf7e..5ffc900 100644
---- a/fs/ecryptfs/kthread.c
-+++ b/fs/ecryptfs/kthread.c
-@@ -148,7 +148,7 @@ int ecryptfs_privileged_open(struct file **lower_file,
- (*lower_file) = dentry_open(lower_dentry, lower_mnt, flags, cred);
- if (!IS_ERR(*lower_file))
- goto out;
-- if (flags & O_RDONLY) {
-+ if ((flags & O_ACCMODE) == O_RDONLY) {
- rc = PTR_ERR((*lower_file));
- goto out;
- }
-diff --git a/fs/eventpoll.c b/fs/eventpoll.c
-index f539204..ff57421 100644
---- a/fs/eventpoll.c
-+++ b/fs/eventpoll.c
-@@ -200,6 +200,12 @@ struct eventpoll {
-
- /* The user that created the eventpoll descriptor */
- struct user_struct *user;
-+
-+ struct file *file;
-+
-+ /* used to optimize loop detection check */
-+ int visited;
-+ struct list_head visited_list_link;
- };
-
- /* Wait structure used by the poll hooks */
-@@ -258,6 +264,15 @@ static struct kmem_cache *epi_cache __read_mostly;
- /* Slab cache used to allocate "struct eppoll_entry" */
- static struct kmem_cache *pwq_cache __read_mostly;
-
-+/* Visited nodes during ep_loop_check(), so we can unset them when we finish */
-+static LIST_HEAD(visited_list);
-+
-+/*
-+ * List of files with newly added links, where we may need to limit the number
-+ * of emanating paths. Protected by the epmutex.
-+ */
-+static LIST_HEAD(tfile_check_list);
-+
- #ifdef CONFIG_SYSCTL
-
- #include <linux/sysctl.h>
-@@ -277,6 +292,12 @@ ctl_table epoll_table[] = {
- };
- #endif /* CONFIG_SYSCTL */
-
-+static const struct file_operations eventpoll_fops;
-+
-+static inline int is_file_epoll(struct file *f)
-+{
-+ return f->f_op == &eventpoll_fops;
-+}
-
- /* Setup the structure that is used as key for the RB tree */
- static inline void ep_set_ffd(struct epoll_filefd *ffd,
-@@ -300,6 +321,11 @@ static inline int ep_is_linked(struct list_head *p)
- return !list_empty(p);
- }
-
-+static inline struct eppoll_entry *ep_pwq_from_wait(wait_queue_t *p)
-+{
-+ return container_of(p, struct eppoll_entry, wait);
-+}
-+
- /* Get the "struct epitem" from a wait queue pointer */
- static inline struct epitem *ep_item_from_wait(wait_queue_t *p)
- {
-@@ -434,6 +460,18 @@ static void ep_poll_safewake(wait_queue_head_t *wq)
- put_cpu();
- }
-
-+static void ep_remove_wait_queue(struct eppoll_entry *pwq)
-+{
-+ wait_queue_head_t *whead;
-+
-+ rcu_read_lock();
-+ /* If it is cleared by POLLFREE, it should be rcu-safe */
-+ whead = rcu_dereference(pwq->whead);
-+ if (whead)
-+ remove_wait_queue(whead, &pwq->wait);
-+ rcu_read_unlock();
-+}
-+
- /*
- * This function unregisters poll callbacks from the associated file
- * descriptor. Must be called with "mtx" held (or "epmutex" if called from
-@@ -448,7 +486,7 @@ static void ep_unregister_pollwait(struct eventpoll *ep, struct epitem *epi)
- pwq = list_first_entry(lsthead, struct eppoll_entry, llink);
-
- list_del(&pwq->llink);
-- remove_wait_queue(pwq->whead, &pwq->wait);
-+ ep_remove_wait_queue(pwq);
- kmem_cache_free(pwq_cache, pwq);
- }
- }
-@@ -698,12 +736,6 @@ static const struct file_operations eventpoll_fops = {
- .poll = ep_eventpoll_poll
- };
-
--/* Fast test to see if the file is an evenpoll file */
--static inline int is_file_epoll(struct file *f)
--{
-- return f->f_op == &eventpoll_fops;
--}
--
- /*
- * This is called from eventpoll_release() to unlink files from the eventpoll
- * interface. We need to have this facility to cleanup correctly files that are
-@@ -814,6 +846,17 @@ static int ep_poll_callback(wait_queue_t *wait, unsigned mode, int sync, void *k
- struct epitem *epi = ep_item_from_wait(wait);
- struct eventpoll *ep = epi->ep;
-
-+ if ((unsigned long)key & POLLFREE) {
-+ ep_pwq_from_wait(wait)->whead = NULL;
-+ /*
-+ * whead = NULL above can race with ep_remove_wait_queue()
-+ * which can do another remove_wait_queue() after us, so we
-+ * can't use __remove_wait_queue(). whead->lock is held by
-+ * the caller.
-+ */
-+ list_del_init(&wait->task_list);
-+ }
-+
- spin_lock_irqsave(&ep->lock, flags);
-
- /*
-@@ -913,6 +956,103 @@ static void ep_rbtree_insert(struct eventpoll *ep, struct epitem *epi)
- rb_insert_color(&epi->rbn, &ep->rbr);
- }
-
-+
-+
-+#define PATH_ARR_SIZE 5
-+/*
-+ * These are the number paths of length 1 to 5, that we are allowing to emanate
-+ * from a single file of interest. For example, we allow 1000 paths of length
-+ * 1, to emanate from each file of interest. This essentially represents the
-+ * potential wakeup paths, which need to be limited in order to avoid massive
-+ * uncontrolled wakeup storms. The common use case should be a single ep which
-+ * is connected to n file sources. In this case each file source has 1 path
-+ * of length 1. Thus, the numbers below should be more than sufficient. These
-+ * path limits are enforced during an EPOLL_CTL_ADD operation, since a modify
-+ * and delete can't add additional paths. Protected by the epmutex.
-+ */
-+static const int path_limits[PATH_ARR_SIZE] = { 1000, 500, 100, 50, 10 };
-+static int path_count[PATH_ARR_SIZE];
-+
-+static int path_count_inc(int nests)
-+{
-+ /* Allow an arbitrary number of depth 1 paths */
-+ if (nests == 0)
-+ return 0;
-+
-+ if (++path_count[nests] > path_limits[nests])
-+ return -1;
-+ return 0;
-+}
-+
-+static void path_count_init(void)
-+{
-+ int i;
-+
-+ for (i = 0; i < PATH_ARR_SIZE; i++)
-+ path_count[i] = 0;
-+}
-+
-+static int reverse_path_check_proc(void *priv, void *cookie, int call_nests)
-+{
-+ int error = 0;
-+ struct file *file = priv;
-+ struct file *child_file;
-+ struct epitem *epi;
-+
-+ list_for_each_entry(epi, &file->f_ep_links, fllink) {
-+ child_file = epi->ep->file;
-+ if (is_file_epoll(child_file)) {
-+ if (list_empty(&child_file->f_ep_links)) {
-+ if (path_count_inc(call_nests)) {
-+ error = -1;
-+ break;
-+ }
-+ } else {
-+ error = ep_call_nested(&poll_loop_ncalls,
-+ EP_MAX_NESTS,
-+ reverse_path_check_proc,
-+ child_file, child_file,
-+ current);
-+ }
-+ if (error != 0)
-+ break;
-+ } else {
-+ printk(KERN_ERR "reverse_path_check_proc: "
-+ "file is not an ep!\n");
-+ }
-+ }
-+ return error;
-+}
-+
-+/**
-+ * reverse_path_check - The tfile_check_list is list of file *, which have
-+ * links that are proposed to be newly added. We need to
-+ * make sure that those added links don't add too many
-+ * paths such that we will spend all our time waking up
-+ * eventpoll objects.
-+ *
-+ * Returns: Returns zero if the proposed links don't create too many paths,
-+ * -1 otherwise.
-+ */
-+static int reverse_path_check(void)
-+{
-+ int length = 0;
-+ int error = 0;
-+ struct file *current_file;
-+
-+ /* let's call this for all tfiles */
-+ list_for_each_entry(current_file, &tfile_check_list, f_tfile_llink) {
-+ length++;
-+ path_count_init();
-+ error = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
-+ reverse_path_check_proc, current_file,
-+ current_file, current);
-+ if (error)
-+ break;
-+ }
-+ return error;
-+}
-+
- /*
- * Must be called with "mtx" held.
- */
-@@ -973,6 +1113,11 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event,
- */
- ep_rbtree_insert(ep, epi);
-
-+ /* now check if we've created too many backpaths */
-+ error = -EINVAL;
-+ if (reverse_path_check())
-+ goto error_remove_epi;
-+
- /* We have to drop the new item inside our item list to keep track of it */
- spin_lock_irqsave(&ep->lock, flags);
-
-@@ -997,6 +1142,14 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event,
-
- return 0;
-
-+error_remove_epi:
-+ spin_lock(&tfile->f_lock);
-+ if (ep_is_linked(&epi->fllink))
-+ list_del_init(&epi->fllink);
-+ spin_unlock(&tfile->f_lock);
-+
-+ rb_erase(&epi->rbn, &ep->rbr);
-+
- error_unregister:
- ep_unregister_pollwait(ep, epi);
-
-@@ -1223,18 +1376,36 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests)
- int error = 0;
- struct file *file = priv;
- struct eventpoll *ep = file->private_data;
-+ struct eventpoll *ep_tovisit;
- struct rb_node *rbp;
- struct epitem *epi;
-
- mutex_lock_nested(&ep->mtx, call_nests + 1);
-+ ep->visited = 1;
-+ list_add(&ep->visited_list_link, &visited_list);
- for (rbp = rb_first(&ep->rbr); rbp; rbp = rb_next(rbp)) {
- epi = rb_entry(rbp, struct epitem, rbn);
- if (unlikely(is_file_epoll(epi->ffd.file))) {
-+ ep_tovisit = epi->ffd.file->private_data;
-+ if (ep_tovisit->visited)
-+ continue;
- error = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
-- ep_loop_check_proc, epi->ffd.file,
-- epi->ffd.file->private_data, current);
-+ ep_loop_check_proc, epi->ffd.file,
-+ ep_tovisit, current);
- if (error != 0)
- break;
-+ } else {
-+ /*
-+ * If we've reached a file that is not associated with
-+ * an ep, then we need to check if the newly added
-+ * links are going to add too many wakeup paths. We do
-+ * this by adding it to the tfile_check_list, if it's
-+ * not already there, and calling reverse_path_check()
-+ * during ep_insert().
-+ */
-+ if (list_empty(&epi->ffd.file->f_tfile_llink))
-+ list_add(&epi->ffd.file->f_tfile_llink,
-+ &tfile_check_list);
- }
- }
- mutex_unlock(&ep->mtx);
-@@ -1255,8 +1426,31 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests)
- */
- static int ep_loop_check(struct eventpoll *ep, struct file *file)
- {
-- return ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
-+ int ret;
-+ struct eventpoll *ep_cur, *ep_next;
-+
-+ ret = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
- ep_loop_check_proc, file, ep, current);
-+ /* clear visited list */
-+ list_for_each_entry_safe(ep_cur, ep_next, &visited_list,
-+ visited_list_link) {
-+ ep_cur->visited = 0;
-+ list_del(&ep_cur->visited_list_link);
-+ }
-+ return ret;
-+}
-+
-+static void clear_tfile_check_list(void)
-+{
-+ struct file *file;
-+
-+ /* first clear the tfile_check_list */
-+ while (!list_empty(&tfile_check_list)) {
-+ file = list_first_entry(&tfile_check_list, struct file,
-+ f_tfile_llink);
-+ list_del_init(&file->f_tfile_llink);
-+ }
-+ INIT_LIST_HEAD(&tfile_check_list);
- }
-
- /*
-@@ -1264,8 +1458,9 @@ static int ep_loop_check(struct eventpoll *ep, struct file *file)
- */
- SYSCALL_DEFINE1(epoll_create1, int, flags)
- {
-- int error;
-+ int error, fd;
- struct eventpoll *ep = NULL;
-+ struct file *file;
-
- /* Check the EPOLL_* constant for consistency. */
- BUILD_BUG_ON(EPOLL_CLOEXEC != O_CLOEXEC);
-@@ -1282,11 +1477,25 @@ SYSCALL_DEFINE1(epoll_create1, int, flags)
- * Creates all the items needed to setup an eventpoll file. That is,
- * a file structure and a free file descriptor.
- */
-- error = anon_inode_getfd("[eventpoll]", &eventpoll_fops, ep,
-- flags & O_CLOEXEC);
-- if (error < 0)
-- ep_free(ep);
--
-+ fd = get_unused_fd_flags(O_RDWR | (flags & O_CLOEXEC));
-+ if (fd < 0) {
-+ error = fd;
-+ goto out_free_ep;
-+ }
-+ file = anon_inode_getfile("[eventpoll]", &eventpoll_fops, ep,
-+ O_RDWR | (flags & O_CLOEXEC));
-+ if (IS_ERR(file)) {
-+ error = PTR_ERR(file);
-+ goto out_free_fd;
-+ }
-+ fd_install(fd, file);
-+ ep->file = file;
-+ return fd;
-+
-+out_free_fd:
-+ put_unused_fd(fd);
-+out_free_ep:
-+ ep_free(ep);
- return error;
- }
-
-@@ -1352,21 +1561,29 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
- /*
- * When we insert an epoll file descriptor, inside another epoll file
- * descriptor, there is the change of creating closed loops, which are
-- * better be handled here, than in more critical paths.
-+ * better be handled here, than in more critical paths. While we are
-+ * checking for loops we also determine the list of files reachable
-+ * and hang them on the tfile_check_list, so we can check that we
-+ * haven't created too many possible wakeup paths.
- *
-- * We hold epmutex across the loop check and the insert in this case, in
-- * order to prevent two separate inserts from racing and each doing the
-- * insert "at the same time" such that ep_loop_check passes on both
-- * before either one does the insert, thereby creating a cycle.
-+ * We need to hold the epmutex across both ep_insert and ep_remove
-+ * b/c we want to make sure we are looking at a coherent view of
-+ * epoll network.
- */
-- if (unlikely(is_file_epoll(tfile) && op == EPOLL_CTL_ADD)) {
-+ if (op == EPOLL_CTL_ADD || op == EPOLL_CTL_DEL) {
- mutex_lock(&epmutex);
- did_lock_epmutex = 1;
-- error = -ELOOP;
-- if (ep_loop_check(ep, tfile) != 0)
-- goto error_tgt_fput;
- }
--
-+ if (op == EPOLL_CTL_ADD) {
-+ if (is_file_epoll(tfile)) {
-+ error = -ELOOP;
-+ if (ep_loop_check(ep, tfile) != 0) {
-+ clear_tfile_check_list();
-+ goto error_tgt_fput;
-+ }
-+ } else
-+ list_add(&tfile->f_tfile_llink, &tfile_check_list);
-+ }
-
- mutex_lock_nested(&ep->mtx, 0);
-
-@@ -1385,6 +1602,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
- error = ep_insert(ep, &epds, tfile, fd);
- } else
- error = -EEXIST;
-+ clear_tfile_check_list();
- break;
- case EPOLL_CTL_DEL:
- if (epi)
-@@ -1403,7 +1621,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
- mutex_unlock(&ep->mtx);
-
- error_tgt_fput:
-- if (unlikely(did_lock_epmutex))
-+ if (did_lock_epmutex)
- mutex_unlock(&epmutex);
-
- fput(tfile);
-diff --git a/fs/ext3/ialloc.c b/fs/ext3/ialloc.c
-index b399912..108f4fc 100644
---- a/fs/ext3/ialloc.c
-+++ b/fs/ext3/ialloc.c
-@@ -575,8 +575,12 @@ got:
- if (IS_DIRSYNC(inode))
- handle->h_sync = 1;
- if (insert_inode_locked(inode) < 0) {
-- err = -EINVAL;
-- goto fail_drop;
-+ /*
-+ * Likely a bitmap corruption causing inode to be allocated
-+ * twice.
-+ */
-+ err = -EIO;
-+ goto fail;
- }
- spin_lock(&sbi->s_next_gen_lock);
- inode->i_generation = sbi->s_next_generation++;
-diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
-index f9d6937..3191a30 100644
---- a/fs/ext3/inode.c
-+++ b/fs/ext3/inode.c
-@@ -2948,6 +2948,8 @@ static int ext3_do_update_inode(handle_t *handle,
- struct ext3_inode_info *ei = EXT3_I(inode);
- struct buffer_head *bh = iloc->bh;
- int err = 0, rc, block;
-+ int need_datasync = 0;
-+ __le32 disksize;
-
- again:
- /* we can't allow multiple procs in here at once, its a bit racey */
-@@ -2985,7 +2987,11 @@ again:
- raw_inode->i_gid_high = 0;
- }
- raw_inode->i_links_count = cpu_to_le16(inode->i_nlink);
-- raw_inode->i_size = cpu_to_le32(ei->i_disksize);
-+ disksize = cpu_to_le32(ei->i_disksize);
-+ if (disksize != raw_inode->i_size) {
-+ need_datasync = 1;
-+ raw_inode->i_size = disksize;
-+ }
- raw_inode->i_atime = cpu_to_le32(inode->i_atime.tv_sec);
- raw_inode->i_ctime = cpu_to_le32(inode->i_ctime.tv_sec);
- raw_inode->i_mtime = cpu_to_le32(inode->i_mtime.tv_sec);
-@@ -3001,8 +3007,11 @@ again:
- if (!S_ISREG(inode->i_mode)) {
- raw_inode->i_dir_acl = cpu_to_le32(ei->i_dir_acl);
- } else {
-- raw_inode->i_size_high =
-- cpu_to_le32(ei->i_disksize >> 32);
-+ disksize = cpu_to_le32(ei->i_disksize >> 32);
-+ if (disksize != raw_inode->i_size_high) {
-+ raw_inode->i_size_high = disksize;
-+ need_datasync = 1;
-+ }
- if (ei->i_disksize > 0x7fffffffULL) {
- struct super_block *sb = inode->i_sb;
- if (!EXT3_HAS_RO_COMPAT_FEATURE(sb,
-@@ -3055,6 +3064,8 @@ again:
- ei->i_state &= ~EXT3_STATE_NEW;
-
- atomic_set(&ei->i_sync_tid, handle->h_transaction->t_tid);
-+ if (need_datasync)
-+ atomic_set(&ei->i_datasync_tid, handle->h_transaction->t_tid);
- out_brelse:
- brelse (bh);
- ext3_std_error(inode->i_sb, err);
-diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
-index 93f7999..b4402c8 100644
---- a/fs/ext4/extents.c
-+++ b/fs/ext4/extents.c
-@@ -358,6 +358,8 @@ static int ext4_valid_extent(struct inode *inode, struct ext4_extent *ext)
- ext4_fsblk_t block = ext_pblock(ext);
- int len = ext4_ext_get_actual_len(ext);
-
-+ if (len == 0)
-+ return 0;
- return ext4_data_block_valid(EXT4_SB(inode->i_sb), block, len);
- }
-
-diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
-index 55a93f5..29d9055 100644
---- a/fs/ext4/ialloc.c
-+++ b/fs/ext4/ialloc.c
-@@ -1015,8 +1015,12 @@ got:
- if (IS_DIRSYNC(inode))
- ext4_handle_sync(handle);
- if (insert_inode_locked(inode) < 0) {
-- err = -EINVAL;
-- goto fail_drop;
-+ /*
-+ * Likely a bitmap corruption causing inode to be allocated
-+ * twice.
-+ */
-+ err = -EIO;
-+ goto fail;
- }
- spin_lock(&sbi->s_next_gen_lock);
- inode->i_generation = sbi->s_next_generation++;
-diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
-index 72ba88f..efe6363 100644
---- a/fs/ext4/inode.c
-+++ b/fs/ext4/inode.c
-@@ -1112,6 +1112,15 @@ void ext4_da_update_reserve_space(struct inode *inode,
- used = ei->i_reserved_data_blocks;
- }
-
-+ if (unlikely(ei->i_allocated_meta_blocks > ei->i_reserved_meta_blocks)) {
-+ ext4_msg(inode->i_sb, KERN_NOTICE, "%s: ino %lu, allocated %d "
-+ "with only %d reserved metadata blocks\n", __func__,
-+ inode->i_ino, ei->i_allocated_meta_blocks,
-+ ei->i_reserved_meta_blocks);
-+ WARN_ON(1);
-+ ei->i_allocated_meta_blocks = ei->i_reserved_meta_blocks;
-+ }
-+
- /* Update per-inode reservations */
- ei->i_reserved_data_blocks -= used;
- used += ei->i_allocated_meta_blocks;
-diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
-index 4787ae6..b359543 100644
---- a/fs/fuse/dir.c
-+++ b/fs/fuse/dir.c
-@@ -855,6 +855,7 @@ int fuse_update_attributes(struct inode *inode, struct kstat *stat,
- if (stat) {
- generic_fillattr(inode, stat);
- stat->mode = fi->orig_i_mode;
-+ stat->ino = fi->orig_ino;
- }
- }
-
-diff --git a/fs/fuse/file.c b/fs/fuse/file.c
-index f6104a95..102d582 100644
---- a/fs/fuse/file.c
-+++ b/fs/fuse/file.c
-@@ -1664,7 +1664,7 @@ static int fuse_verify_ioctl_iov(struct iovec *iov, size_t count)
- size_t n;
- u32 max = FUSE_MAX_PAGES_PER_REQ << PAGE_SHIFT;
-
-- for (n = 0; n < count; n++) {
-+ for (n = 0; n < count; n++, iov++) {
- if (iov->iov_len > (size_t) max)
- return -ENOMEM;
- max -= iov->iov_len;
-diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
-index e6d614d..829acee 100644
---- a/fs/fuse/fuse_i.h
-+++ b/fs/fuse/fuse_i.h
-@@ -76,6 +76,9 @@ struct fuse_inode {
- preserve the original mode */
- mode_t orig_i_mode;
-
-+ /** 64 bit inode number */
-+ u64 orig_ino;
-+
- /** Version of last attribute change */
- u64 attr_version;
-
-diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
-index 1a822ce..c95186c 100644
---- a/fs/fuse/inode.c
-+++ b/fs/fuse/inode.c
-@@ -86,6 +86,7 @@ static struct inode *fuse_alloc_inode(struct super_block *sb)
- fi->nlookup = 0;
- fi->attr_version = 0;
- fi->writectr = 0;
-+ fi->orig_ino = 0;
- INIT_LIST_HEAD(&fi->write_files);
- INIT_LIST_HEAD(&fi->queued_writes);
- INIT_LIST_HEAD(&fi->writepages);
-@@ -140,6 +141,18 @@ static int fuse_remount_fs(struct super_block *sb, int *flags, char *data)
- return 0;
- }
-
-+/*
-+ * ino_t is 32-bits on 32-bit arch. We have to squash the 64-bit value down
-+ * so that it will fit.
-+ */
-+static ino_t fuse_squash_ino(u64 ino64)
-+{
-+ ino_t ino = (ino_t) ino64;
-+ if (sizeof(ino_t) < sizeof(u64))
-+ ino ^= ino64 >> (sizeof(u64) - sizeof(ino_t)) * 8;
-+ return ino;
-+}
-+
- void fuse_change_attributes_common(struct inode *inode, struct fuse_attr *attr,
- u64 attr_valid)
- {
-@@ -149,7 +162,7 @@ void fuse_change_attributes_common(struct inode *inode, struct fuse_attr *attr,
- fi->attr_version = ++fc->attr_version;
- fi->i_time = attr_valid;
-
-- inode->i_ino = attr->ino;
-+ inode->i_ino = fuse_squash_ino(attr->ino);
- inode->i_mode = (inode->i_mode & S_IFMT) | (attr->mode & 07777);
- inode->i_nlink = attr->nlink;
- inode->i_uid = attr->uid;
-@@ -175,6 +188,8 @@ void fuse_change_attributes_common(struct inode *inode, struct fuse_attr *attr,
- fi->orig_i_mode = inode->i_mode;
- if (!(fc->flags & FUSE_DEFAULT_PERMISSIONS))
- inode->i_mode &= ~S_ISVTX;
-+
-+ fi->orig_ino = attr->ino;
- }
-
- void fuse_change_attributes(struct inode *inode, struct fuse_attr *attr,
-diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c
-index f6874ac..a0786c6 100644
---- a/fs/hfsplus/catalog.c
-+++ b/fs/hfsplus/catalog.c
-@@ -329,6 +329,10 @@ int hfsplus_rename_cat(u32 cnid,
- err = hfs_brec_find(&src_fd);
- if (err)
- goto out;
-+ if (src_fd.entrylength > sizeof(entry) || src_fd.entrylength < 0) {
-+ err = -EIO;
-+ goto out;
-+ }
-
- hfs_bnode_read(src_fd.bnode, &entry, src_fd.entryoffset,
- src_fd.entrylength);
-diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c
-index 5f40236..f4300ff7 100644
---- a/fs/hfsplus/dir.c
-+++ b/fs/hfsplus/dir.c
-@@ -138,6 +138,11 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir)
- filp->f_pos++;
- /* fall through */
- case 1:
-+ if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
-+ err = -EIO;
-+ goto out;
-+ }
-+
- hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength);
- if (be16_to_cpu(entry.type) != HFSPLUS_FOLDER_THREAD) {
- printk(KERN_ERR "hfs: bad catalog folder thread\n");
-@@ -168,6 +173,12 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir)
- err = -EIO;
- goto out;
- }
-+
-+ if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
-+ err = -EIO;
-+ goto out;
-+ }
-+
- hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength);
- type = be16_to_cpu(entry.type);
- len = HFSPLUS_MAX_STRLEN;
-diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
-index 87a1258..2179de8 100644
---- a/fs/hugetlbfs/inode.c
-+++ b/fs/hugetlbfs/inode.c
-@@ -601,9 +601,15 @@ static int hugetlbfs_statfs(struct dentry *dentry, struct kstatfs *buf)
- spin_lock(&sbinfo->stat_lock);
- /* If no limits set, just report 0 for max/free/used
- * blocks, like simple_statfs() */
-- if (sbinfo->max_blocks >= 0) {
-- buf->f_blocks = sbinfo->max_blocks;
-- buf->f_bavail = buf->f_bfree = sbinfo->free_blocks;
-+ if (sbinfo->spool) {
-+ long free_pages;
-+
-+ spin_lock(&sbinfo->spool->lock);
-+ buf->f_blocks = sbinfo->spool->max_hpages;
-+ free_pages = sbinfo->spool->max_hpages
-+ - sbinfo->spool->used_hpages;
-+ buf->f_bavail = buf->f_bfree = free_pages;
-+ spin_unlock(&sbinfo->spool->lock);
- buf->f_files = sbinfo->max_inodes;
- buf->f_ffree = sbinfo->free_inodes;
- }
-@@ -619,6 +625,10 @@ static void hugetlbfs_put_super(struct super_block *sb)
-
- if (sbi) {
- sb->s_fs_info = NULL;
-+
-+ if (sbi->spool)
-+ hugepage_put_subpool(sbi->spool);
-+
- kfree(sbi);
- }
- }
-@@ -842,10 +852,14 @@ hugetlbfs_fill_super(struct super_block *sb, void *data, int silent)
- sb->s_fs_info = sbinfo;
- sbinfo->hstate = config.hstate;
- spin_lock_init(&sbinfo->stat_lock);
-- sbinfo->max_blocks = config.nr_blocks;
-- sbinfo->free_blocks = config.nr_blocks;
- sbinfo->max_inodes = config.nr_inodes;
- sbinfo->free_inodes = config.nr_inodes;
-+ sbinfo->spool = NULL;
-+ if (config.nr_blocks != -1) {
-+ sbinfo->spool = hugepage_new_subpool(config.nr_blocks);
-+ if (!sbinfo->spool)
-+ goto out_free;
-+ }
- sb->s_maxbytes = MAX_LFS_FILESIZE;
- sb->s_blocksize = huge_page_size(config.hstate);
- sb->s_blocksize_bits = huge_page_shift(config.hstate);
-@@ -865,38 +879,12 @@ hugetlbfs_fill_super(struct super_block *sb, void *data, int silent)
- sb->s_root = root;
- return 0;
- out_free:
-+ if (sbinfo->spool)
-+ kfree(sbinfo->spool);
- kfree(sbinfo);
- return -ENOMEM;
- }
-
--int hugetlb_get_quota(struct address_space *mapping, long delta)
--{
-- int ret = 0;
-- struct hugetlbfs_sb_info *sbinfo = HUGETLBFS_SB(mapping->host->i_sb);
--
-- if (sbinfo->free_blocks > -1) {
-- spin_lock(&sbinfo->stat_lock);
-- if (sbinfo->free_blocks - delta >= 0)
-- sbinfo->free_blocks -= delta;
-- else
-- ret = -ENOMEM;
-- spin_unlock(&sbinfo->stat_lock);
-- }
--
-- return ret;
--}
--
--void hugetlb_put_quota(struct address_space *mapping, long delta)
--{
-- struct hugetlbfs_sb_info *sbinfo = HUGETLBFS_SB(mapping->host->i_sb);
--
-- if (sbinfo->free_blocks > -1) {
-- spin_lock(&sbinfo->stat_lock);
-- sbinfo->free_blocks += delta;
-- spin_unlock(&sbinfo->stat_lock);
-- }
--}
--
- static int hugetlbfs_get_sb(struct file_system_type *fs_type,
- int flags, const char *dev_name, void *data, struct vfsmount *mnt)
- {
-diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
-index a051270..5c156ad 100644
---- a/fs/jbd2/transaction.c
-+++ b/fs/jbd2/transaction.c
-@@ -1822,6 +1822,8 @@ zap_buffer_unlocked:
- clear_buffer_mapped(bh);
- clear_buffer_req(bh);
- clear_buffer_new(bh);
-+ clear_buffer_delay(bh);
-+ clear_buffer_unwritten(bh);
- bh->b_bdev = NULL;
- return may_free;
- }
-diff --git a/fs/locks.c b/fs/locks.c
-index a8794f2..fde92d1 100644
---- a/fs/locks.c
-+++ b/fs/locks.c
-@@ -291,7 +291,7 @@ static int flock_make_lock(struct file *filp, struct file_lock **lock,
- return 0;
- }
-
--static int assign_type(struct file_lock *fl, int type)
-+static int assign_type(struct file_lock *fl, long type)
- {
- switch (type) {
- case F_RDLCK:
-@@ -444,7 +444,7 @@ static const struct lock_manager_operations lease_manager_ops = {
- /*
- * Initialize a lease, use the default lock manager operations
- */
--static int lease_init(struct file *filp, int type, struct file_lock *fl)
-+static int lease_init(struct file *filp, long type, struct file_lock *fl)
- {
- if (assign_type(fl, type) != 0)
- return -EINVAL;
-@@ -462,7 +462,7 @@ static int lease_init(struct file *filp, int type, struct file_lock *fl)
- }
-
- /* Allocate a file_lock initialised to this type of lease */
--static struct file_lock *lease_alloc(struct file *filp, int type)
-+static struct file_lock *lease_alloc(struct file *filp, long type)
- {
- struct file_lock *fl = locks_alloc_lock();
- int error = -ENOMEM;
-diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c
-index 3f8881d..59d9304 100644
---- a/fs/nfs/nfs3proc.c
-+++ b/fs/nfs/nfs3proc.c
-@@ -66,7 +66,7 @@ do_proc_get_root(struct rpc_clnt *client, struct nfs_fh *fhandle,
- nfs_fattr_init(info->fattr);
- status = rpc_call_sync(client, &msg, 0);
- dprintk("%s: reply fsinfo: %d\n", __func__, status);
-- if (!(info->fattr->valid & NFS_ATTR_FATTR)) {
-+ if (status == 0 && !(info->fattr->valid & NFS_ATTR_FATTR)) {
- msg.rpc_proc = &nfs3_procedures[NFS3PROC_GETATTR];
- msg.rpc_resp = info->fattr;
- status = rpc_call_sync(client, &msg, 0);
-diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
-index 3c759df..21c7190 100644
---- a/fs/nfs/nfs4proc.c
-+++ b/fs/nfs/nfs4proc.c
-@@ -1586,6 +1586,7 @@ static int _nfs4_do_open(struct inode *dir, struct path *path, fmode_t fmode, in
- goto err_opendata_put;
- if (server->caps & NFS_CAP_POSIX_LOCK)
- set_bit(NFS_STATE_POSIX_LOCKS, &state->flags);
-+ nfs_revalidate_inode(server, state->inode);
- nfs4_opendata_put(opendata);
- nfs4_put_state_owner(sp);
- *res = state;
-diff --git a/fs/nfs/super.c b/fs/nfs/super.c
-index c346808..9a3f15b 100644
---- a/fs/nfs/super.c
-+++ b/fs/nfs/super.c
-@@ -2934,4 +2934,6 @@ out:
- return error;
- }
-
-+MODULE_ALIAS("nfs4");
-+
- #endif /* CONFIG_NFS_V4 */
-diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
-index 4a82a96..6d27757 100644
---- a/fs/nfsd/nfs4xdr.c
-+++ b/fs/nfsd/nfs4xdr.c
-@@ -1955,7 +1955,7 @@ out_acl:
- if (bmval0 & FATTR4_WORD0_CASE_INSENSITIVE) {
- if ((buflen -= 4) < 0)
- goto out_resource;
-- WRITE32(1);
-+ WRITE32(0);
- }
- if (bmval0 & FATTR4_WORD0_CASE_PRESERVING) {
- if ((buflen -= 4) < 0)
-diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
-index ad391a8..149a8a1 100644
---- a/fs/nilfs2/the_nilfs.c
-+++ b/fs/nilfs2/the_nilfs.c
-@@ -478,6 +478,7 @@ static int nilfs_load_super_block(struct the_nilfs *nilfs,
- brelse(sbh[1]);
- sbh[1] = NULL;
- sbp[1] = NULL;
-+ valid[1] = 0;
- swp = 0;
- }
- if (!valid[swp]) {
-diff --git a/fs/signalfd.c b/fs/signalfd.c
-index d98bea8..02c25d7 100644
---- a/fs/signalfd.c
-+++ b/fs/signalfd.c
-@@ -29,6 +29,21 @@
- #include <linux/signalfd.h>
- #include <linux/syscalls.h>
-
-+void signalfd_cleanup(struct sighand_struct *sighand)
-+{
-+ wait_queue_head_t *wqh = &sighand->signalfd_wqh;
-+ /*
-+ * The lockless check can race with remove_wait_queue() in progress,
-+ * but in this case its caller should run under rcu_read_lock() and
-+ * sighand_cachep is SLAB_DESTROY_BY_RCU, we can safely return.
-+ */
-+ if (likely(!waitqueue_active(wqh)))
-+ return;
-+
-+ /* wait_queue_t->func(POLLFREE) should do remove_wait_queue() */
-+ wake_up_poll(wqh, POLLHUP | POLLFREE);
-+}
-+
- struct signalfd_ctx {
- sigset_t sigmask;
- };
-diff --git a/fs/udf/file.c b/fs/udf/file.c
-index b80cbd7..78bdef3 100644
---- a/fs/udf/file.c
-+++ b/fs/udf/file.c
-@@ -40,20 +40,24 @@
- #include "udf_i.h"
- #include "udf_sb.h"
-
--static int udf_adinicb_readpage(struct file *file, struct page *page)
-+static void __udf_adinicb_readpage(struct page *page)
- {
- struct inode *inode = page->mapping->host;
- char *kaddr;
- struct udf_inode_info *iinfo = UDF_I(inode);
-
-- BUG_ON(!PageLocked(page));
--
- kaddr = kmap(page);
-- memset(kaddr, 0, PAGE_CACHE_SIZE);
- memcpy(kaddr, iinfo->i_ext.i_data + iinfo->i_lenEAttr, inode->i_size);
-+ memset(kaddr + inode->i_size, 0, PAGE_CACHE_SIZE - inode->i_size);
- flush_dcache_page(page);
- SetPageUptodate(page);
- kunmap(page);
-+}
-+
-+static int udf_adinicb_readpage(struct file *file, struct page *page)
-+{
-+ BUG_ON(!PageLocked(page));
-+ __udf_adinicb_readpage(page);
- unlock_page(page);
-
- return 0;
-@@ -78,6 +82,25 @@ static int udf_adinicb_writepage(struct page *page,
- return 0;
- }
-
-+static int udf_adinicb_write_begin(struct file *file,
-+ struct address_space *mapping, loff_t pos,
-+ unsigned len, unsigned flags, struct page **pagep,
-+ void **fsdata)
-+{
-+ struct page *page;
-+
-+ if (WARN_ON_ONCE(pos >= PAGE_CACHE_SIZE))
-+ return -EIO;
-+ page = grab_cache_page_write_begin(mapping, 0, flags);
-+ if (!page)
-+ return -ENOMEM;
-+ *pagep = page;
-+
-+ if (!PageUptodate(page) && len != PAGE_CACHE_SIZE)
-+ __udf_adinicb_readpage(page);
-+ return 0;
-+}
-+
- static int udf_adinicb_write_end(struct file *file,
- struct address_space *mapping,
- loff_t pos, unsigned len, unsigned copied,
-@@ -100,8 +123,8 @@ const struct address_space_operations udf_adinicb_aops = {
- .readpage = udf_adinicb_readpage,
- .writepage = udf_adinicb_writepage,
- .sync_page = block_sync_page,
-- .write_begin = simple_write_begin,
-- .write_end = udf_adinicb_write_end,
-+ .write_begin = udf_adinicb_write_begin,
-+ .write_end = udf_adinicb_write_end,
- };
-
- static ssize_t udf_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
-diff --git a/fs/udf/super.c b/fs/udf/super.c
-index ee6b3af..0045ebc 100644
---- a/fs/udf/super.c
-+++ b/fs/udf/super.c
-@@ -57,6 +57,7 @@
- #include <linux/seq_file.h>
- #include <linux/bitmap.h>
- #include <linux/crc-itu-t.h>
-+#include <linux/log2.h>
- #include <asm/byteorder.h>
-
- #include "udf_sb.h"
-@@ -1239,16 +1240,65 @@ out_bh:
- return ret;
- }
-
-+static int udf_load_sparable_map(struct super_block *sb,
-+ struct udf_part_map *map,
-+ struct sparablePartitionMap *spm)
-+{
-+ uint32_t loc;
-+ uint16_t ident;
-+ struct sparingTable *st;
-+ struct udf_sparing_data *sdata = &map->s_type_specific.s_sparing;
-+ int i;
-+ struct buffer_head *bh;
-+
-+ map->s_partition_type = UDF_SPARABLE_MAP15;
-+ sdata->s_packet_len = le16_to_cpu(spm->packetLength);
-+ if (!is_power_of_2(sdata->s_packet_len)) {
-+ udf_error(sb, __func__, "error loading logical volume descriptor: "
-+ "Invalid packet length %u\n",
-+ (unsigned)sdata->s_packet_len);
-+ return -EIO;
-+ }
-+ if (spm->numSparingTables > 4) {
-+ udf_error(sb, __func__, "error loading logical volume descriptor: "
-+ "Too many sparing tables (%d)\n",
-+ (int)spm->numSparingTables);
-+ return -EIO;
-+ }
-+
-+ for (i = 0; i < spm->numSparingTables; i++) {
-+ loc = le32_to_cpu(spm->locSparingTable[i]);
-+ bh = udf_read_tagged(sb, loc, loc, &ident);
-+ if (!bh)
-+ continue;
-+
-+ st = (struct sparingTable *)bh->b_data;
-+ if (ident != 0 ||
-+ strncmp(st->sparingIdent.ident, UDF_ID_SPARING,
-+ strlen(UDF_ID_SPARING)) ||
-+ sizeof(*st) + le16_to_cpu(st->reallocationTableLen) >
-+ sb->s_blocksize) {
-+ brelse(bh);
-+ continue;
-+ }
-+
-+ sdata->s_spar_map[i] = bh;
-+ }
-+ map->s_partition_func = udf_get_pblock_spar15;
-+ return 0;
-+}
-+
- static int udf_load_logicalvol(struct super_block *sb, sector_t block,
- struct kernel_lb_addr *fileset)
- {
- struct logicalVolDesc *lvd;
-- int i, j, offset;
-+ int i, offset;
- uint8_t type;
- struct udf_sb_info *sbi = UDF_SB(sb);
- struct genericPartitionMap *gpm;
- uint16_t ident;
- struct buffer_head *bh;
-+ unsigned int table_len;
- int ret = 0;
-
- bh = udf_read_tagged(sb, block, block, &ident);
-@@ -1257,6 +1307,15 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block,
- BUG_ON(ident != TAG_IDENT_LVD);
- lvd = (struct logicalVolDesc *)bh->b_data;
-
-+ table_len = le32_to_cpu(lvd->mapTableLength);
-+ if (table_len > sb->s_blocksize - sizeof(*lvd)) {
-+ udf_error(sb, __func__, "error loading logical volume descriptor: "
-+ "Partition table too long (%u > %lu)\n", table_len,
-+ sb->s_blocksize - sizeof(*lvd));
-+ ret = 1;
-+ goto out_bh;
-+ }
-+
- i = udf_sb_alloc_partition_maps(sb, le32_to_cpu(lvd->numPartitionMaps));
- if (i != 0) {
- ret = i;
-@@ -1264,7 +1323,7 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block,
- }
-
- for (i = 0, offset = 0;
-- i < sbi->s_partitions && offset < le32_to_cpu(lvd->mapTableLength);
-+ i < sbi->s_partitions && offset < table_len;
- i++, offset += gpm->partitionMapLength) {
- struct udf_part_map *map = &sbi->s_partmaps[i];
- gpm = (struct genericPartitionMap *)
-@@ -1299,38 +1358,11 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block,
- } else if (!strncmp(upm2->partIdent.ident,
- UDF_ID_SPARABLE,
- strlen(UDF_ID_SPARABLE))) {
-- uint32_t loc;
-- struct sparingTable *st;
-- struct sparablePartitionMap *spm =
-- (struct sparablePartitionMap *)gpm;
--
-- map->s_partition_type = UDF_SPARABLE_MAP15;
-- map->s_type_specific.s_sparing.s_packet_len =
-- le16_to_cpu(spm->packetLength);
-- for (j = 0; j < spm->numSparingTables; j++) {
-- struct buffer_head *bh2;
--
-- loc = le32_to_cpu(
-- spm->locSparingTable[j]);
-- bh2 = udf_read_tagged(sb, loc, loc,
-- &ident);
-- map->s_type_specific.s_sparing.
-- s_spar_map[j] = bh2;
--
-- if (bh2 == NULL)
-- continue;
--
-- st = (struct sparingTable *)bh2->b_data;
-- if (ident != 0 || strncmp(
-- st->sparingIdent.ident,
-- UDF_ID_SPARING,
-- strlen(UDF_ID_SPARING))) {
-- brelse(bh2);
-- map->s_type_specific.s_sparing.
-- s_spar_map[j] = NULL;
-- }
-+ if (udf_load_sparable_map(sb, map,
-+ (struct sparablePartitionMap *)gpm) < 0) {
-+ ret = 1;
-+ goto out_bh;
- }
-- map->s_partition_func = udf_get_pblock_spar15;
- } else if (!strncmp(upm2->partIdent.ident,
- UDF_ID_METADATA,
- strlen(UDF_ID_METADATA))) {
-diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
-index 844a99b..bae2c99 100644
---- a/fs/xfs/xfs_log_recover.c
-+++ b/fs/xfs/xfs_log_recover.c
-@@ -3298,37 +3298,26 @@ xlog_recover_process_iunlinks(
- */
- continue;
- }
-+ /*
-+ * Unlock the buffer so that it can be acquired in the normal
-+ * course of the transaction to truncate and free each inode.
-+ * Because we are not racing with anyone else here for the AGI
-+ * buffer, we don't even need to hold it locked to read the
-+ * initial unlinked bucket entries out of the buffer. We keep
-+ * buffer reference though, so that it stays pinned in memory
-+ * while we need the buffer.
-+ */
- agi = XFS_BUF_TO_AGI(agibp);
-+ xfs_buf_unlock(agibp);
-
- for (bucket = 0; bucket < XFS_AGI_UNLINKED_BUCKETS; bucket++) {
- agino = be32_to_cpu(agi->agi_unlinked[bucket]);
- while (agino != NULLAGINO) {
-- /*
-- * Release the agi buffer so that it can
-- * be acquired in the normal course of the
-- * transaction to truncate and free the inode.
-- */
-- xfs_buf_relse(agibp);
--
- agino = xlog_recover_process_one_iunlink(mp,
- agno, agino, bucket);
--
-- /*
-- * Reacquire the agibuffer and continue around
-- * the loop. This should never fail as we know
-- * the buffer was good earlier on.
-- */
-- error = xfs_read_agi(mp, NULL, agno, &agibp);
-- ASSERT(error == 0);
-- agi = XFS_BUF_TO_AGI(agibp);
- }
- }
--
-- /*
-- * Release the buffer for the current agi so we can
-- * go on to the next one.
-- */
-- xfs_buf_relse(agibp);
-+ xfs_buf_rele(agibp);
- }
-
- mp->m_dmevmask = mp_dmevmask;
-diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
-index 8f32f50..1a07e03 100644
---- a/fs/xfs/xfs_vnodeops.c
-+++ b/fs/xfs/xfs_vnodeops.c
-@@ -554,7 +554,7 @@ xfs_readlink(
- char *link)
- {
- xfs_mount_t *mp = ip->i_mount;
-- int pathlen;
-+ xfs_fsize_t pathlen;
- int error = 0;
-
- xfs_itrace_entry(ip);
-@@ -564,13 +564,21 @@ xfs_readlink(
-
- xfs_ilock(ip, XFS_ILOCK_SHARED);
-
-- ASSERT((ip->i_d.di_mode & S_IFMT) == S_IFLNK);
-- ASSERT(ip->i_d.di_size <= MAXPATHLEN);
--
- pathlen = ip->i_d.di_size;
- if (!pathlen)
- goto out;
-
-+ if (pathlen < 0 || pathlen > MAXPATHLEN) {
-+ xfs_fs_cmn_err(CE_ALERT, mp,
-+ "%s: inode (%llu) bad symlink length (%lld)",
-+ __func__, (unsigned long long) ip->i_ino,
-+ (long long) pathlen);
-+ ASSERT(0);
-+ error = XFS_ERROR(EFSCORRUPTED);
-+ goto out;
-+ }
-+
-+
- if (ip->i_df.if_flags & XFS_IFINLINE) {
- memcpy(link, ip->i_df.if_u1.if_data, pathlen);
- link[pathlen] = '\0';
-diff --git a/include/asm-generic/poll.h b/include/asm-generic/poll.h
-index 44bce83..9ce7f44 100644
---- a/include/asm-generic/poll.h
-+++ b/include/asm-generic/poll.h
-@@ -28,6 +28,8 @@
- #define POLLRDHUP 0x2000
- #endif
-
-+#define POLLFREE 0x4000 /* currently only for epoll */
-+
- struct pollfd {
- int fd;
- short events;
-diff --git a/include/linux/eventpoll.h b/include/linux/eventpoll.h
-index f6856a5..ca399c5 100644
---- a/include/linux/eventpoll.h
-+++ b/include/linux/eventpoll.h
-@@ -61,6 +61,7 @@ struct file;
- static inline void eventpoll_init_file(struct file *file)
- {
- INIT_LIST_HEAD(&file->f_ep_links);
-+ INIT_LIST_HEAD(&file->f_tfile_llink);
- }
-
-
-diff --git a/include/linux/fs.h b/include/linux/fs.h
-index 1b9a47a..860cb6d 100644
---- a/include/linux/fs.h
-+++ b/include/linux/fs.h
-@@ -941,6 +941,7 @@ struct file {
- #ifdef CONFIG_EPOLL
- /* Used by fs/eventpoll.c to link all the hooks to this file */
- struct list_head f_ep_links;
-+ struct list_head f_tfile_llink;
- #endif /* #ifdef CONFIG_EPOLL */
- struct address_space *f_mapping;
- #ifdef CONFIG_DEBUG_WRITECOUNT
-diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h
-index 040b679..b4f0b3f 100644
---- a/include/linux/hrtimer.h
-+++ b/include/linux/hrtimer.h
-@@ -159,6 +159,7 @@ struct hrtimer_clock_base {
- * and timers
- * @clock_base: array of clock bases for this cpu
- * @curr_timer: the timer which is executing a callback right now
-+ * @clock_was_set: Indicates that clock was set from irq context.
- * @expires_next: absolute time of the next event which was scheduled
- * via clock_set_next_event()
- * @hres_active: State of high resolution mode
-@@ -171,6 +172,7 @@ struct hrtimer_clock_base {
- struct hrtimer_cpu_base {
- spinlock_t lock;
- struct hrtimer_clock_base clock_base[HRTIMER_MAX_CLOCK_BASES];
-+ unsigned int clock_was_set;
- #ifdef CONFIG_HIGH_RES_TIMERS
- ktime_t expires_next;
- int hres_active;
-@@ -280,6 +282,8 @@ extern void hrtimer_peek_ahead_timers(void);
- # define MONOTONIC_RES_NSEC HIGH_RES_NSEC
- # define KTIME_MONOTONIC_RES KTIME_HIGH_RES
-
-+extern void clock_was_set_delayed(void);
-+
- #else
-
- # define MONOTONIC_RES_NSEC LOW_RES_NSEC
-@@ -308,11 +312,14 @@ static inline int hrtimer_is_hres_active(struct hrtimer *timer)
- {
- return 0;
- }
-+
-+static inline void clock_was_set_delayed(void) { }
-+
- #endif
-
- extern ktime_t ktime_get(void);
- extern ktime_t ktime_get_real(void);
--
-+extern ktime_t ktime_get_update_offsets(ktime_t *offs_real);
-
- DECLARE_PER_CPU(struct tick_device, tick_cpu_device);
-
-diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
-index 41a59af..6b3feef 100644
---- a/include/linux/hugetlb.h
-+++ b/include/linux/hugetlb.h
-@@ -12,6 +12,15 @@ struct user_struct;
- #include <linux/shm.h>
- #include <asm/tlbflush.h>
-
-+struct hugepage_subpool {
-+ spinlock_t lock;
-+ long count;
-+ long max_hpages, used_hpages;
-+};
-+
-+struct hugepage_subpool *hugepage_new_subpool(long nr_blocks);
-+void hugepage_put_subpool(struct hugepage_subpool *spool);
-+
- int PageHuge(struct page *page);
-
- static inline int is_vm_hugetlb_page(struct vm_area_struct *vma)
-@@ -138,12 +147,11 @@ struct hugetlbfs_config {
- };
-
- struct hugetlbfs_sb_info {
-- long max_blocks; /* blocks allowed */
-- long free_blocks; /* blocks free */
- long max_inodes; /* inodes allowed */
- long free_inodes; /* inodes free */
- spinlock_t stat_lock;
- struct hstate *hstate;
-+ struct hugepage_subpool *spool;
- };
-
-
-@@ -166,8 +174,6 @@ extern const struct file_operations hugetlbfs_file_operations;
- extern const struct vm_operations_struct hugetlb_vm_ops;
- struct file *hugetlb_file_setup(const char *name, size_t size, int acct,
- struct user_struct **user, int creat_flags);
--int hugetlb_get_quota(struct address_space *mapping, long delta);
--void hugetlb_put_quota(struct address_space *mapping, long delta);
-
- static inline int is_file_hugepages(struct file *file)
- {
-diff --git a/include/linux/iocontext.h b/include/linux/iocontext.h
-index eb73632..19abfc1 100644
---- a/include/linux/iocontext.h
-+++ b/include/linux/iocontext.h
-@@ -94,14 +94,15 @@ static inline struct io_context *ioc_task_link(struct io_context *ioc)
- return NULL;
- }
-
-+struct task_struct;
- #ifdef CONFIG_BLOCK
- int put_io_context(struct io_context *ioc);
--void exit_io_context(void);
-+void exit_io_context(struct task_struct *task);
- struct io_context *get_io_context(gfp_t gfp_flags, int node);
- struct io_context *alloc_io_context(gfp_t gfp_flags, int node);
- void copy_io_context(struct io_context **pdst, struct io_context **psrc);
- #else
--static inline void exit_io_context(void)
-+static inline void exit_io_context(struct task_struct *task)
- {
- }
-
-diff --git a/include/linux/irq.h b/include/linux/irq.h
-index 9e5f45a..2333710 100644
---- a/include/linux/irq.h
-+++ b/include/linux/irq.h
-@@ -174,7 +174,6 @@ struct irq_2_iommu;
- */
- struct irq_desc {
- unsigned int irq;
-- struct timer_rand_state *timer_rand_state;
- unsigned int *kstat_irqs;
- #ifdef CONFIG_INTR_REMAP
- struct irq_2_iommu *irq_2_iommu;
-diff --git a/include/linux/kernel.h b/include/linux/kernel.h
-index 9acb92d..3526cd4 100644
---- a/include/linux/kernel.h
-+++ b/include/linux/kernel.h
-@@ -55,6 +55,19 @@ extern const char linux_proc_banner[];
- } \
- )
-
-+/*
-+ * Multiplies an integer by a fraction, while avoiding unnecessary
-+ * overflow or loss of precision.
-+ */
-+#define mult_frac(x, numer, denom)( \
-+{ \
-+ typeof(x) quot = (x) / (denom); \
-+ typeof(x) rem = (x) % (denom); \
-+ (quot * (numer)) + ((rem * (numer)) / (denom)); \
-+} \
-+)
-+
-+
- #define _RET_IP_ (unsigned long)__builtin_return_address(0)
- #define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
-
-diff --git a/include/linux/ktime.h b/include/linux/ktime.h
-index ce59832..ecdf64e 100644
---- a/include/linux/ktime.h
-+++ b/include/linux/ktime.h
-@@ -58,13 +58,6 @@ union ktime {
-
- typedef union ktime ktime_t; /* Kill this */
-
--#define KTIME_MAX ((s64)~((u64)1 << 63))
--#if (BITS_PER_LONG == 64)
--# define KTIME_SEC_MAX (KTIME_MAX / NSEC_PER_SEC)
--#else
--# define KTIME_SEC_MAX LONG_MAX
--#endif
--
- /*
- * ktime_t definitions when using the 64-bit scalar representation:
- */
-diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
-index c728a50..8bfed57 100644
---- a/include/linux/kvm_host.h
-+++ b/include/linux/kvm_host.h
-@@ -556,5 +556,12 @@ static inline bool kvm_vcpu_is_bsp(struct kvm_vcpu *vcpu)
- {
- return vcpu->kvm->bsp_vcpu_id == vcpu->vcpu_id;
- }
-+
-+bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu);
-+
-+#else
-+
-+static inline bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu) { return true; }
-+
- #endif
- #endif
-diff --git a/include/linux/random.h b/include/linux/random.h
-index 2948046..1864957 100644
---- a/include/linux/random.h
-+++ b/include/linux/random.h
-@@ -44,13 +44,13 @@ struct rand_pool_info {
-
- #ifdef __KERNEL__
-
--extern void rand_initialize_irq(int irq);
--
-+extern void add_device_randomness(const void *, unsigned int);
- extern void add_input_randomness(unsigned int type, unsigned int code,
- unsigned int value);
--extern void add_interrupt_randomness(int irq);
-+extern void add_interrupt_randomness(int irq, int irq_flags);
-
- extern void get_random_bytes(void *buf, int nbytes);
-+extern void get_random_bytes_arch(void *buf, int nbytes);
- void generate_random_uuid(unsigned char uuid_out[16]);
-
- #ifndef MODULE
-@@ -63,6 +63,19 @@ unsigned long randomize_range(unsigned long start, unsigned long end, unsigned l
- u32 random32(void);
- void srandom32(u32 seed);
-
-+#ifdef CONFIG_ARCH_RANDOM
-+# include <asm/archrandom.h>
-+#else
-+static inline int arch_get_random_long(unsigned long *v)
-+{
-+ return 0;
-+}
-+static inline int arch_get_random_int(unsigned int *v)
-+{
-+ return 0;
-+}
-+#endif
-+
- #endif /* __KERNEL___ */
-
- #endif /* _LINUX_RANDOM_H */
-diff --git a/include/linux/signalfd.h b/include/linux/signalfd.h
-index b363b91..ed9b65e 100644
---- a/include/linux/signalfd.h
-+++ b/include/linux/signalfd.h
-@@ -60,13 +60,16 @@ static inline void signalfd_notify(struct task_struct *tsk, int sig)
- wake_up(&tsk->sighand->signalfd_wqh);
- }
-
-+extern void signalfd_cleanup(struct sighand_struct *sighand);
-+
- #else /* CONFIG_SIGNALFD */
-
- static inline void signalfd_notify(struct task_struct *tsk, int sig) { }
-
-+static inline void signalfd_cleanup(struct sighand_struct *sighand) { }
-+
- #endif /* CONFIG_SIGNALFD */
-
- #endif /* __KERNEL__ */
-
- #endif /* _LINUX_SIGNALFD_H */
--
-diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
-index bcdd660..4e647bb 100644
---- a/include/linux/skbuff.h
-+++ b/include/linux/skbuff.h
-@@ -1312,6 +1312,16 @@ static inline void skb_set_mac_header(struct sk_buff *skb, const int offset)
- }
- #endif /* NET_SKBUFF_DATA_USES_OFFSET */
-
-+static inline void skb_mac_header_rebuild(struct sk_buff *skb)
-+{
-+ if (skb_mac_header_was_set(skb)) {
-+ const unsigned char *old_mac = skb_mac_header(skb);
-+
-+ skb_set_mac_header(skb, -skb->mac_len);
-+ memmove(skb_mac_header(skb), old_mac, skb->mac_len);
-+ }
-+}
-+
- static inline int skb_transport_offset(const struct sk_buff *skb)
- {
- return skb_transport_header(skb) - skb->data;
-diff --git a/include/linux/time.h b/include/linux/time.h
-index 6e026e4..bc93987 100644
---- a/include/linux/time.h
-+++ b/include/linux/time.h
-@@ -91,11 +91,36 @@ static inline struct timespec timespec_sub(struct timespec lhs,
- return ts_delta;
- }
-
-+#define KTIME_MAX ((s64)~((u64)1 << 63))
-+#if (BITS_PER_LONG == 64)
-+# define KTIME_SEC_MAX (KTIME_MAX / NSEC_PER_SEC)
-+#else
-+# define KTIME_SEC_MAX LONG_MAX
-+#endif
-+
- /*
- * Returns true if the timespec is norm, false if denorm:
- */
--#define timespec_valid(ts) \
-- (((ts)->tv_sec >= 0) && (((unsigned long) (ts)->tv_nsec) < NSEC_PER_SEC))
-+static inline bool timespec_valid(const struct timespec *ts)
-+{
-+ /* Dates before 1970 are bogus */
-+ if (ts->tv_sec < 0)
-+ return false;
-+ /* Can't have more nanoseconds then a second */
-+ if ((unsigned long)ts->tv_nsec >= NSEC_PER_SEC)
-+ return false;
-+ return true;
-+}
-+
-+static inline bool timespec_valid_strict(const struct timespec *ts)
-+{
-+ if (!timespec_valid(ts))
-+ return false;
-+ /* Disallow values that could overflow ktime_t */
-+ if ((unsigned long long)ts->tv_sec >= KTIME_SEC_MAX)
-+ return false;
-+ return true;
-+}
-
- extern struct timespec xtime;
- extern struct timespec wall_to_monotonic;
-diff --git a/include/linux/timex.h b/include/linux/timex.h
-index e6967d1..3b587b4 100644
---- a/include/linux/timex.h
-+++ b/include/linux/timex.h
-@@ -271,7 +271,7 @@ static inline int ntp_synced(void)
- /* Returns how long ticks are at present, in ns / 2^NTP_SCALE_SHIFT. */
- extern u64 tick_length;
-
--extern void second_overflow(void);
-+extern int second_overflow(unsigned long secs);
- extern void update_ntp_one_tick(void);
- extern int do_adjtimex(struct timex *);
-
-diff --git a/include/net/rose.h b/include/net/rose.h
-index 5ba9f02..555dd19 100644
---- a/include/net/rose.h
-+++ b/include/net/rose.h
-@@ -14,6 +14,12 @@
-
- #define ROSE_MIN_LEN 3
-
-+#define ROSE_CALL_REQ_ADDR_LEN_OFF 3
-+#define ROSE_CALL_REQ_ADDR_LEN_VAL 0xAA /* each address is 10 digits */
-+#define ROSE_CALL_REQ_DEST_ADDR_OFF 4
-+#define ROSE_CALL_REQ_SRC_ADDR_OFF 9
-+#define ROSE_CALL_REQ_FACILITIES_OFF 14
-+
- #define ROSE_GFI 0x10
- #define ROSE_Q_BIT 0x80
- #define ROSE_D_BIT 0x40
-@@ -214,7 +220,7 @@ extern void rose_requeue_frames(struct sock *);
- extern int rose_validate_nr(struct sock *, unsigned short);
- extern void rose_write_internal(struct sock *, int);
- extern int rose_decode(struct sk_buff *, int *, int *, int *, int *, int *);
--extern int rose_parse_facilities(unsigned char *, struct rose_facilities_struct *);
-+extern int rose_parse_facilities(unsigned char *, unsigned int, struct rose_facilities_struct *);
- extern void rose_disconnect(struct sock *, int, int, int);
-
- /* rose_timer.c */
-diff --git a/kernel/cred.c b/kernel/cred.c
-index 0b5b5fc..9c06d10 100644
---- a/kernel/cred.c
-+++ b/kernel/cred.c
-@@ -443,6 +443,8 @@ int copy_creds(struct task_struct *p, unsigned long clone_flags)
-
- mutex_init(&p->cred_guard_mutex);
-
-+ p->replacement_session_keyring = NULL;
-+
- if (
- #ifdef CONFIG_KEYS
- !p->cred->thread_keyring &&
-diff --git a/kernel/exit.c b/kernel/exit.c
-index 0f8fae3..a2a1659 100644
---- a/kernel/exit.c
-+++ b/kernel/exit.c
-@@ -1020,7 +1020,7 @@ NORET_TYPE void do_exit(long code)
- tsk->flags |= PF_EXITPIDONE;
-
- if (tsk->io_context)
-- exit_io_context();
-+ exit_io_context(tsk);
-
- if (tsk->splice_pipe)
- __free_pipe_info(tsk->splice_pipe);
-diff --git a/kernel/fork.c b/kernel/fork.c
-index 4bde56f..c28f804 100644
---- a/kernel/fork.c
-+++ b/kernel/fork.c
-@@ -64,6 +64,7 @@
- #include <linux/magic.h>
- #include <linux/perf_event.h>
- #include <linux/posix-timers.h>
-+#include <linux/signalfd.h>
-
- #include <asm/pgtable.h>
- #include <asm/pgalloc.h>
-@@ -815,8 +816,10 @@ static int copy_sighand(unsigned long clone_flags, struct task_struct *tsk)
-
- void __cleanup_sighand(struct sighand_struct *sighand)
- {
-- if (atomic_dec_and_test(&sighand->count))
-+ if (atomic_dec_and_test(&sighand->count)) {
-+ signalfd_cleanup(sighand);
- kmem_cache_free(sighand_cachep, sighand);
-+ }
- }
-
-
-@@ -1299,7 +1302,8 @@ bad_fork_free_pid:
- if (pid != &init_struct_pid)
- free_pid(pid);
- bad_fork_cleanup_io:
-- put_io_context(p->io_context);
-+ if (p->io_context)
-+ exit_io_context(p);
- bad_fork_cleanup_namespaces:
- exit_task_namespaces(p);
- bad_fork_cleanup_mm:
-diff --git a/kernel/futex.c b/kernel/futex.c
-index fb98c9f..9c5ffe1 100644
---- a/kernel/futex.c
-+++ b/kernel/futex.c
-@@ -264,17 +264,29 @@ again:
-
- page = compound_head(page);
- lock_page(page);
-+
-+ /*
-+ * If page->mapping is NULL, then it cannot be a PageAnon
-+ * page; but it might be the ZERO_PAGE or in the gate area or
-+ * in a special mapping (all cases which we are happy to fail);
-+ * or it may have been a good file page when get_user_pages_fast
-+ * found it, but truncated or holepunched or subjected to
-+ * invalidate_complete_page2 before we got the page lock (also
-+ * cases which we are happy to fail). And we hold a reference,
-+ * so refcount care in invalidate_complete_page's remove_mapping
-+ * prevents drop_caches from setting mapping to NULL beneath us.
-+ *
-+ * The case we do have to guard against is when memory pressure made
-+ * shmem_writepage move it from filecache to swapcache beneath us:
-+ * an unlikely race, but we do need to retry for page->mapping.
-+ */
- if (!page->mapping) {
-+ int shmem_swizzled = PageSwapCache(page);
- unlock_page(page);
- put_page(page);
-- /*
-- * ZERO_PAGE pages don't have a mapping. Avoid a busy loop
-- * trying to find one. RW mapping would have COW'd (and thus
-- * have a mapping) so this page is RO and won't ever change.
-- */
-- if ((page == ZERO_PAGE(address)))
-- return -EFAULT;
-- goto again;
-+ if (shmem_swizzled)
-+ goto again;
-+ return -EFAULT;
- }
-
- /*
-@@ -2192,11 +2204,11 @@ int handle_early_requeue_pi_wakeup(struct futex_hash_bucket *hb,
- * @uaddr2: the pi futex we will take prior to returning to user-space
- *
- * The caller will wait on uaddr and will be requeued by futex_requeue() to
-- * uaddr2 which must be PI aware. Normal wakeup will wake on uaddr2 and
-- * complete the acquisition of the rt_mutex prior to returning to userspace.
-- * This ensures the rt_mutex maintains an owner when it has waiters; without
-- * one, the pi logic wouldn't know which task to boost/deboost, if there was a
-- * need to.
-+ * uaddr2 which must be PI aware and unique from uaddr. Normal wakeup will wake
-+ * on uaddr2 and complete the acquisition of the rt_mutex prior to returning to
-+ * userspace. This ensures the rt_mutex maintains an owner when it has waiters;
-+ * without one, the pi logic would not know which task to boost/deboost, if
-+ * there was a need to.
- *
- * We call schedule in futex_wait_queue_me() when we enqueue and return there
- * via the following:
-@@ -2233,6 +2245,9 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, int fshared,
- struct futex_q q;
- int res, ret;
-
-+ if (uaddr == uaddr2)
-+ return -EINVAL;
-+
- if (!bitset)
- return -EINVAL;
-
-@@ -2306,7 +2321,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, int fshared,
- * signal. futex_unlock_pi() will not destroy the lock_ptr nor
- * the pi_state.
- */
-- WARN_ON(!&q.pi_state);
-+ WARN_ON(!q.pi_state);
- pi_mutex = &q.pi_state->pi_mutex;
- ret = rt_mutex_finish_proxy_lock(pi_mutex, to, &rt_waiter, 1);
- debug_rt_mutex_free_waiter(&rt_waiter);
-@@ -2333,7 +2348,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, int fshared,
- * fault, unlock the rt_mutex and return the fault to userspace.
- */
- if (ret == -EFAULT) {
-- if (rt_mutex_owner(pi_mutex) == current)
-+ if (pi_mutex && rt_mutex_owner(pi_mutex) == current)
- rt_mutex_unlock(pi_mutex);
- } else if (ret == -EINTR) {
- /*
-diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
-index a6e9d00..2818422 100644
---- a/kernel/hrtimer.c
-+++ b/kernel/hrtimer.c
-@@ -603,6 +603,12 @@ static int hrtimer_reprogram(struct hrtimer *timer,
- return res;
- }
-
-+static inline ktime_t hrtimer_update_base(struct hrtimer_cpu_base *base)
-+{
-+ ktime_t *offs_real = &base->clock_base[CLOCK_REALTIME].offset;
-+
-+ return ktime_get_update_offsets(offs_real);
-+}
-
- /*
- * Retrigger next event is called after clock was set
-@@ -612,26 +618,15 @@ static int hrtimer_reprogram(struct hrtimer *timer,
- static void retrigger_next_event(void *arg)
- {
- struct hrtimer_cpu_base *base;
-- struct timespec realtime_offset;
-- unsigned long seq;
-
- if (!hrtimer_hres_active())
- return;
-
-- do {
-- seq = read_seqbegin(&xtime_lock);
-- set_normalized_timespec(&realtime_offset,
-- -wall_to_monotonic.tv_sec,
-- -wall_to_monotonic.tv_nsec);
-- } while (read_seqretry(&xtime_lock, seq));
--
- base = &__get_cpu_var(hrtimer_bases);
-
- /* Adjust CLOCK_REALTIME offset */
- spin_lock(&base->lock);
-- base->clock_base[CLOCK_REALTIME].offset =
-- timespec_to_ktime(realtime_offset);
--
-+ hrtimer_update_base(base);
- hrtimer_force_reprogram(base, 0);
- spin_unlock(&base->lock);
- }
-@@ -731,13 +726,25 @@ static int hrtimer_switch_to_hres(void)
- base->clock_base[CLOCK_MONOTONIC].resolution = KTIME_HIGH_RES;
-
- tick_setup_sched_timer();
--
- /* "Retrigger" the interrupt to get things going */
- retrigger_next_event(NULL);
- local_irq_restore(flags);
- return 1;
- }
-
-+/*
-+ * Called from timekeeping code to reprogramm the hrtimer interrupt
-+ * device. If called from the timer interrupt context we defer it to
-+ * softirq context.
-+ */
-+void clock_was_set_delayed(void)
-+{
-+ struct hrtimer_cpu_base *cpu_base = &__get_cpu_var(hrtimer_bases);
-+
-+ cpu_base->clock_was_set = 1;
-+ __raise_softirq_irqoff(HRTIMER_SOFTIRQ);
-+}
-+
- #else
-
- static inline int hrtimer_hres_active(void) { return 0; }
-@@ -1250,11 +1257,10 @@ void hrtimer_interrupt(struct clock_event_device *dev)
- cpu_base->nr_events++;
- dev->next_event.tv64 = KTIME_MAX;
-
-- entry_time = now = ktime_get();
-+ spin_lock(&cpu_base->lock);
-+ entry_time = now = hrtimer_update_base(cpu_base);
- retry:
- expires_next.tv64 = KTIME_MAX;
--
-- spin_lock(&cpu_base->lock);
- /*
- * We set expires_next to KTIME_MAX here with cpu_base->lock
- * held to prevent that a timer is enqueued in our queue via
-@@ -1328,8 +1334,12 @@ retry:
- * We need to prevent that we loop forever in the hrtimer
- * interrupt routine. We give it 3 attempts to avoid
- * overreacting on some spurious event.
-+ *
-+ * Acquire base lock for updating the offsets and retrieving
-+ * the current time.
- */
-- now = ktime_get();
-+ spin_lock(&cpu_base->lock);
-+ now = hrtimer_update_base(cpu_base);
- cpu_base->nr_retries++;
- if (++retries < 3)
- goto retry;
-@@ -1341,6 +1351,7 @@ retry:
- */
- cpu_base->nr_hangs++;
- cpu_base->hang_detected = 1;
-+ spin_unlock(&cpu_base->lock);
- delta = ktime_sub(now, entry_time);
- if (delta.tv64 > cpu_base->max_hang_time.tv64)
- cpu_base->max_hang_time = delta;
-@@ -1393,6 +1404,13 @@ void hrtimer_peek_ahead_timers(void)
-
- static void run_hrtimer_softirq(struct softirq_action *h)
- {
-+ struct hrtimer_cpu_base *cpu_base = &__get_cpu_var(hrtimer_bases);
-+
-+ if (cpu_base->clock_was_set) {
-+ cpu_base->clock_was_set = 0;
-+ clock_was_set();
-+ }
-+
- hrtimer_peek_ahead_timers();
- }
-
-diff --git a/kernel/irq/handle.c b/kernel/irq/handle.c
-index 17c71bb..27fd0a6 100644
---- a/kernel/irq/handle.c
-+++ b/kernel/irq/handle.c
-@@ -370,7 +370,7 @@ static void warn_no_thread(unsigned int irq, struct irqaction *action)
- irqreturn_t handle_IRQ_event(unsigned int irq, struct irqaction *action)
- {
- irqreturn_t ret, retval = IRQ_NONE;
-- unsigned int status = 0;
-+ unsigned int flags = 0;
-
- if (!(action->flags & IRQF_DISABLED))
- local_irq_enable_in_hardirq();
-@@ -413,7 +413,7 @@ irqreturn_t handle_IRQ_event(unsigned int irq, struct irqaction *action)
-
- /* Fall through to add to randomness */
- case IRQ_HANDLED:
-- status |= action->flags;
-+ flags |= action->flags;
- break;
-
- default:
-@@ -424,8 +424,7 @@ irqreturn_t handle_IRQ_event(unsigned int irq, struct irqaction *action)
- action = action->next;
- } while (action);
-
-- if (status & IRQF_SAMPLE_RANDOM)
-- add_interrupt_randomness(irq);
-+ add_interrupt_randomness(irq, flags);
- local_irq_disable();
-
- return retval;
-diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
-index 315705c..5dd29f3 100644
---- a/kernel/irq/manage.c
-+++ b/kernel/irq/manage.c
-@@ -633,22 +633,6 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
-
- if (desc->chip == &no_irq_chip)
- return -ENOSYS;
-- /*
-- * Some drivers like serial.c use request_irq() heavily,
-- * so we have to be careful not to interfere with a
-- * running system.
-- */
-- if (new->flags & IRQF_SAMPLE_RANDOM) {
-- /*
-- * This function might sleep, we want to call it first,
-- * outside of the atomic block.
-- * Yes, this might clear the entropy pool if the wrong
-- * driver is attempted to be loaded, without actually
-- * installing a new handler, but is this really a problem,
-- * only the sysadmin is able to do this.
-- */
-- rand_initialize_irq(irq);
-- }
-
- /* Oneshot interrupts are not allowed with shared */
- if ((new->flags & IRQF_ONESHOT) && (new->flags & IRQF_SHARED))
-@@ -1021,7 +1005,6 @@ EXPORT_SYMBOL(free_irq);
- *
- * IRQF_SHARED Interrupt is shared
- * IRQF_DISABLED Disable local interrupts while processing
-- * IRQF_SAMPLE_RANDOM The interrupt can be used for entropy
- * IRQF_TRIGGER_* Specify active edge(s) or level
- *
- */
-diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
-index cd9a40b..fd6e5f2 100644
---- a/kernel/sched_fair.c
-+++ b/kernel/sched_fair.c
-@@ -862,6 +862,9 @@ check_preempt_tick(struct cfs_rq *cfs_rq, struct sched_entity *curr)
- struct sched_entity *se = __pick_next_entity(cfs_rq);
- s64 delta = curr->vruntime - se->vruntime;
-
-+ if (delta < 0)
-+ return;
-+
- if (delta > ideal_runtime)
- resched_task(rq_of(cfs_rq)->curr);
- }
-diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
-index 4800f93..264928c 100644
---- a/kernel/time/ntp.c
-+++ b/kernel/time/ntp.c
-@@ -28,8 +28,6 @@ unsigned long tick_nsec;
- u64 tick_length;
- static u64 tick_length_base;
-
--static struct hrtimer leap_timer;
--
- #define MAX_TICKADJ 500LL /* usecs */
- #define MAX_TICKADJ_SCALED \
- (((MAX_TICKADJ * NSEC_PER_USEC) << NTP_SCALE_SHIFT) / NTP_INTERVAL_FREQ)
-@@ -108,7 +106,7 @@ static inline s64 ntp_update_offset_fll(s64 offset64, long secs)
- {
- time_status &= ~STA_MODE;
-
-- if (secs < MINSEC)
-+ if ((s32)secs < MINSEC)
- return 0;
-
- if (!(time_status & STA_FLL) && (secs <= MAXSEC))
-@@ -180,60 +178,64 @@ void ntp_clear(void)
- }
-
- /*
-- * Leap second processing. If in leap-insert state at the end of the
-- * day, the system clock is set back one second; if in leap-delete
-- * state, the system clock is set ahead one second.
-+ * this routine handles the overflow of the microsecond field
-+ *
-+ * The tricky bits of code to handle the accurate clock support
-+ * were provided by Dave Mills (Mills@UDEL.EDU) of NTP fame.
-+ * They were originally developed for SUN and DEC kernels.
-+ * All the kudos should go to Dave for this stuff.
-+ *
-+ * Also handles leap second processing, and returns leap offset
- */
--static enum hrtimer_restart ntp_leap_second(struct hrtimer *timer)
-+int second_overflow(unsigned long secs)
- {
-- enum hrtimer_restart res = HRTIMER_NORESTART;
--
-- write_seqlock(&xtime_lock);
-+ int leap = 0;
-+ s64 delta;
-
-+ /*
-+ * Leap second processing. If in leap-insert state at the end of the
-+ * day, the system clock is set back one second; if in leap-delete
-+ * state, the system clock is set ahead one second.
-+ */
- switch (time_state) {
- case TIME_OK:
-+ if (time_status & STA_INS)
-+ time_state = TIME_INS;
-+ else if (time_status & STA_DEL)
-+ time_state = TIME_DEL;
- break;
- case TIME_INS:
-- timekeeping_leap_insert(-1);
-- time_state = TIME_OOP;
-- printk(KERN_NOTICE
-- "Clock: inserting leap second 23:59:60 UTC\n");
-- hrtimer_add_expires_ns(&leap_timer, NSEC_PER_SEC);
-- res = HRTIMER_RESTART;
-+ if (!(time_status & STA_INS))
-+ time_state = TIME_OK;
-+ else if (secs % 86400 == 0) {
-+ leap = -1;
-+ time_state = TIME_OOP;
-+ time_tai++;
-+ printk(KERN_NOTICE
-+ "Clock: inserting leap second 23:59:60 UTC\n");
-+ }
- break;
- case TIME_DEL:
-- timekeeping_leap_insert(1);
-- time_tai--;
-- time_state = TIME_WAIT;
-- printk(KERN_NOTICE
-- "Clock: deleting leap second 23:59:59 UTC\n");
-+ if (!(time_status & STA_DEL))
-+ time_state = TIME_OK;
-+ else if ((secs + 1) % 86400 == 0) {
-+ leap = 1;
-+ time_tai--;
-+ time_state = TIME_WAIT;
-+ printk(KERN_NOTICE
-+ "Clock: deleting leap second 23:59:59 UTC\n");
-+ }
- break;
- case TIME_OOP:
-- time_tai++;
- time_state = TIME_WAIT;
-- /* fall through */
-+ break;
-+
- case TIME_WAIT:
- if (!(time_status & (STA_INS | STA_DEL)))
- time_state = TIME_OK;
- break;
- }
-
-- write_sequnlock(&xtime_lock);
--
-- return res;
--}
--
--/*
-- * this routine handles the overflow of the microsecond field
-- *
-- * The tricky bits of code to handle the accurate clock support
-- * were provided by Dave Mills (Mills@UDEL.EDU) of NTP fame.
-- * They were originally developed for SUN and DEC kernels.
-- * All the kudos should go to Dave for this stuff.
-- */
--void second_overflow(void)
--{
-- s64 delta;
-
- /* Bump the maxerror field */
- time_maxerror += MAXFREQ / NSEC_PER_USEC;
-@@ -253,23 +255,25 @@ void second_overflow(void)
- tick_length += delta;
-
- if (!time_adjust)
-- return;
-+ goto out;
-
- if (time_adjust > MAX_TICKADJ) {
- time_adjust -= MAX_TICKADJ;
- tick_length += MAX_TICKADJ_SCALED;
-- return;
-+ goto out;
- }
-
- if (time_adjust < -MAX_TICKADJ) {
- time_adjust += MAX_TICKADJ;
- tick_length -= MAX_TICKADJ_SCALED;
-- return;
-+ goto out;
- }
-
- tick_length += (s64)(time_adjust * NSEC_PER_USEC / NTP_INTERVAL_FREQ)
- << NTP_SCALE_SHIFT;
- time_adjust = 0;
-+out:
-+ return leap;
- }
-
- #ifdef CONFIG_GENERIC_CMOS_UPDATE
-@@ -331,27 +335,6 @@ static void notify_cmos_timer(void)
- static inline void notify_cmos_timer(void) { }
- #endif
-
--/*
-- * Start the leap seconds timer:
-- */
--static inline void ntp_start_leap_timer(struct timespec *ts)
--{
-- long now = ts->tv_sec;
--
-- if (time_status & STA_INS) {
-- time_state = TIME_INS;
-- now += 86400 - now % 86400;
-- hrtimer_start(&leap_timer, ktime_set(now, 0), HRTIMER_MODE_ABS);
--
-- return;
-- }
--
-- if (time_status & STA_DEL) {
-- time_state = TIME_DEL;
-- now += 86400 - (now + 1) % 86400;
-- hrtimer_start(&leap_timer, ktime_set(now, 0), HRTIMER_MODE_ABS);
-- }
--}
-
- /*
- * Propagate a new txc->status value into the NTP state:
-@@ -374,22 +357,6 @@ static inline void process_adj_status(struct timex *txc, struct timespec *ts)
- time_status &= STA_RONLY;
- time_status |= txc->status & ~STA_RONLY;
-
-- switch (time_state) {
-- case TIME_OK:
-- ntp_start_leap_timer(ts);
-- break;
-- case TIME_INS:
-- case TIME_DEL:
-- time_state = TIME_OK;
-- ntp_start_leap_timer(ts);
-- case TIME_WAIT:
-- if (!(time_status & (STA_INS | STA_DEL)))
-- time_state = TIME_OK;
-- break;
-- case TIME_OOP:
-- hrtimer_restart(&leap_timer);
-- break;
-- }
- }
- /*
- * Called with the xtime lock held, so we can access and modify
-@@ -469,9 +436,6 @@ int do_adjtimex(struct timex *txc)
- (txc->tick < 900000/USER_HZ ||
- txc->tick > 1100000/USER_HZ))
- return -EINVAL;
--
-- if (txc->modes & ADJ_STATUS && time_state != TIME_OK)
-- hrtimer_cancel(&leap_timer);
- }
-
- getnstimeofday(&ts);
-@@ -549,6 +513,4 @@ __setup("ntp_tick_adj=", ntp_tick_adj_setup);
- void __init ntp_init(void)
- {
- ntp_clear();
-- hrtimer_init(&leap_timer, CLOCK_REALTIME, HRTIMER_MODE_ABS);
-- leap_timer.function = ntp_leap_second;
- }
-diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
-index 4a71cff..3d35af3 100644
---- a/kernel/time/timekeeping.c
-+++ b/kernel/time/timekeeping.c
-@@ -161,11 +161,39 @@ struct timespec xtime __attribute__ ((aligned (16)));
- struct timespec wall_to_monotonic __attribute__ ((aligned (16)));
- static struct timespec total_sleep_time;
-
-+/* Offset clock monotonic -> clock realtime */
-+static ktime_t offs_real;
-+
-+/* Offset clock monotonic -> clock boottime */
-+static ktime_t offs_boot;
-+
- /*
- * The raw monotonic time for the CLOCK_MONOTONIC_RAW posix clock.
- */
- struct timespec raw_time;
-
-+/* must hold write on xtime_lock */
-+static void update_rt_offset(void)
-+{
-+ struct timespec tmp, *wtm = &wall_to_monotonic;
-+
-+ set_normalized_timespec(&tmp, -wtm->tv_sec, -wtm->tv_nsec);
-+ offs_real = timespec_to_ktime(tmp);
-+}
-+
-+/* must hold write on xtime_lock */
-+static void timekeeping_update(bool clearntp)
-+{
-+ if (clearntp) {
-+ timekeeper.ntp_error = 0;
-+ ntp_clear();
-+ }
-+ update_rt_offset();
-+ update_vsyscall(&xtime, timekeeper.clock, timekeeper.mult);
-+}
-+
-+
-+
- /* flag for if timekeeping is suspended */
- int __read_mostly timekeeping_suspended;
-
-@@ -183,14 +211,6 @@ void update_xtime_cache(u64 nsec)
- ACCESS_ONCE(xtime_cache) = ts;
- }
-
--/* must hold xtime_lock */
--void timekeeping_leap_insert(int leapsecond)
--{
-- xtime.tv_sec += leapsecond;
-- wall_to_monotonic.tv_sec -= leapsecond;
-- update_vsyscall(&xtime, timekeeper.clock, timekeeper.mult);
--}
--
- #ifdef CONFIG_GENERIC_TIME
-
- /**
-@@ -334,7 +354,7 @@ int do_settimeofday(struct timespec *tv)
- struct timespec ts_delta;
- unsigned long flags;
-
-- if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC)
-+ if (!timespec_valid_strict(tv))
- return -EINVAL;
-
- write_seqlock_irqsave(&xtime_lock, flags);
-@@ -349,10 +369,7 @@ int do_settimeofday(struct timespec *tv)
-
- update_xtime_cache(0);
-
-- timekeeper.ntp_error = 0;
-- ntp_clear();
--
-- update_vsyscall(&xtime, timekeeper.clock, timekeeper.mult);
-+ timekeeping_update(true);
-
- write_sequnlock_irqrestore(&xtime_lock, flags);
-
-@@ -553,7 +570,20 @@ void __init timekeeping_init(void)
- struct timespec now, boot;
-
- read_persistent_clock(&now);
-+ if (!timespec_valid_strict(&now)) {
-+ printk("WARNING: Persistent clock returned invalid value!\n"
-+ " Check your CMOS/BIOS settings.\n");
-+ now.tv_sec = 0;
-+ now.tv_nsec = 0;
-+ }
-+
- read_boot_clock(&boot);
-+ if (!timespec_valid_strict(&boot)) {
-+ printk("WARNING: Boot clock returned invalid value!\n"
-+ " Check your CMOS/BIOS settings.\n");
-+ boot.tv_sec = 0;
-+ boot.tv_nsec = 0;
-+ }
-
- write_seqlock_irqsave(&xtime_lock, flags);
-
-@@ -575,6 +605,7 @@ void __init timekeeping_init(void)
- set_normalized_timespec(&wall_to_monotonic,
- -boot.tv_sec, -boot.tv_nsec);
- update_xtime_cache(0);
-+ update_rt_offset();
- total_sleep_time.tv_sec = 0;
- total_sleep_time.tv_nsec = 0;
- write_sequnlock_irqrestore(&xtime_lock, flags);
-@@ -583,6 +614,12 @@ void __init timekeeping_init(void)
- /* time in seconds when suspend began */
- static struct timespec timekeeping_suspend_time;
-
-+static void update_sleep_time(struct timespec t)
-+{
-+ total_sleep_time = t;
-+ offs_boot = timespec_to_ktime(t);
-+}
-+
- /**
- * timekeeping_resume - Resumes the generic timekeeping subsystem.
- * @dev: unused
-@@ -606,13 +643,14 @@ static int timekeeping_resume(struct sys_device *dev)
- ts = timespec_sub(ts, timekeeping_suspend_time);
- xtime = timespec_add_safe(xtime, ts);
- wall_to_monotonic = timespec_sub(wall_to_monotonic, ts);
-- total_sleep_time = timespec_add_safe(total_sleep_time, ts);
-+ update_sleep_time(timespec_add_safe(total_sleep_time, ts));
- }
- update_xtime_cache(0);
- /* re-base the last cycle value */
- timekeeper.clock->cycle_last = timekeeper.clock->read(timekeeper.clock);
- timekeeper.ntp_error = 0;
- timekeeping_suspended = 0;
-+ timekeeping_update(false);
- write_sequnlock_irqrestore(&xtime_lock, flags);
-
- touch_softlockup_watchdog();
-@@ -769,6 +807,10 @@ void update_wall_time(void)
- #else
- offset = timekeeper.cycle_interval;
- #endif
-+ /* Check if there's really nothing to do */
-+ if (offset < timekeeper.cycle_interval)
-+ return;
-+
- timekeeper.xtime_nsec = (s64)xtime.tv_nsec << timekeeper.shift;
-
- /* normally this loop will run just once, however in the
-@@ -783,9 +825,14 @@ void update_wall_time(void)
-
- timekeeper.xtime_nsec += timekeeper.xtime_interval;
- if (timekeeper.xtime_nsec >= nsecps) {
-+ int leap;
- timekeeper.xtime_nsec -= nsecps;
- xtime.tv_sec++;
-- second_overflow();
-+ leap = second_overflow(xtime.tv_sec);
-+ xtime.tv_sec += leap;
-+ wall_to_monotonic.tv_sec -= leap;
-+ if (leap)
-+ clock_was_set_delayed();
- }
-
- raw_time.tv_nsec += timekeeper.raw_interval;
-@@ -837,8 +884,7 @@ void update_wall_time(void)
- nsecs = clocksource_cyc2ns(offset, timekeeper.mult, timekeeper.shift);
- update_xtime_cache(nsecs);
-
-- /* check to see if there is a new clocksource to use */
-- update_vsyscall(&xtime, timekeeper.clock, timekeeper.mult);
-+ timekeeping_update(false);
- }
-
- /**
-@@ -915,3 +961,35 @@ struct timespec get_monotonic_coarse(void)
- now.tv_nsec + mono.tv_nsec);
- return now;
- }
-+
-+#ifdef CONFIG_HIGH_RES_TIMERS
-+/**
-+ * ktime_get_update_offsets - hrtimer helper
-+ * @real: pointer to storage for monotonic -> realtime offset
-+ *
-+ * Returns current monotonic time and updates the offsets
-+ * Called from hrtimer_interupt() or retrigger_next_event()
-+ */
-+ktime_t ktime_get_update_offsets(ktime_t *real)
-+{
-+ ktime_t now;
-+ unsigned int seq;
-+ u64 secs, nsecs;
-+
-+ do {
-+ seq = read_seqbegin(&xtime_lock);
-+
-+ secs = xtime.tv_sec;
-+ nsecs = xtime.tv_nsec;
-+ nsecs += timekeeping_get_ns();
-+ /* If arch requires, add in gettimeoffset() */
-+ nsecs += arch_gettimeoffset();
-+
-+ *real = offs_real;
-+ } while (read_seqretry(&xtime_lock, seq));
-+
-+ now = ktime_add_ns(ktime_set(secs, 0), nsecs);
-+ now = ktime_sub(now, *real);
-+ return now;
-+}
-+#endif
-diff --git a/kernel/workqueue.c b/kernel/workqueue.c
-index 67e526b..b617e0c 100644
---- a/kernel/workqueue.c
-+++ b/kernel/workqueue.c
-@@ -772,6 +772,7 @@ int current_is_keventd(void)
- return ret;
-
- }
-+EXPORT_SYMBOL_GPL(current_is_keventd);
-
- static struct cpu_workqueue_struct *
- init_cpu_workqueue(struct workqueue_struct *wq, int cpu)
-diff --git a/mm/hugetlb.c b/mm/hugetlb.c
-index 5e1e508..20f9240 100644
---- a/mm/hugetlb.c
-+++ b/mm/hugetlb.c
-@@ -49,6 +49,84 @@ static unsigned long __initdata default_hstate_size;
- */
- static DEFINE_SPINLOCK(hugetlb_lock);
-
-+static inline void unlock_or_release_subpool(struct hugepage_subpool *spool)
-+{
-+ bool free = (spool->count == 0) && (spool->used_hpages == 0);
-+
-+ spin_unlock(&spool->lock);
-+
-+ /* If no pages are used, and no other handles to the subpool
-+ * remain, free the subpool the subpool remain */
-+ if (free)
-+ kfree(spool);
-+}
-+
-+struct hugepage_subpool *hugepage_new_subpool(long nr_blocks)
-+{
-+ struct hugepage_subpool *spool;
-+
-+ spool = kmalloc(sizeof(*spool), GFP_KERNEL);
-+ if (!spool)
-+ return NULL;
-+
-+ spin_lock_init(&spool->lock);
-+ spool->count = 1;
-+ spool->max_hpages = nr_blocks;
-+ spool->used_hpages = 0;
-+
-+ return spool;
-+}
-+
-+void hugepage_put_subpool(struct hugepage_subpool *spool)
-+{
-+ spin_lock(&spool->lock);
-+ BUG_ON(!spool->count);
-+ spool->count--;
-+ unlock_or_release_subpool(spool);
-+}
-+
-+static int hugepage_subpool_get_pages(struct hugepage_subpool *spool,
-+ long delta)
-+{
-+ int ret = 0;
-+
-+ if (!spool)
-+ return 0;
-+
-+ spin_lock(&spool->lock);
-+ if ((spool->used_hpages + delta) <= spool->max_hpages) {
-+ spool->used_hpages += delta;
-+ } else {
-+ ret = -ENOMEM;
-+ }
-+ spin_unlock(&spool->lock);
-+
-+ return ret;
-+}
-+
-+static void hugepage_subpool_put_pages(struct hugepage_subpool *spool,
-+ long delta)
-+{
-+ if (!spool)
-+ return;
-+
-+ spin_lock(&spool->lock);
-+ spool->used_hpages -= delta;
-+ /* If hugetlbfs_put_super couldn't free spool due to
-+ * an outstanding quota reference, free it now. */
-+ unlock_or_release_subpool(spool);
-+}
-+
-+static inline struct hugepage_subpool *subpool_inode(struct inode *inode)
-+{
-+ return HUGETLBFS_SB(inode->i_sb)->spool;
-+}
-+
-+static inline struct hugepage_subpool *subpool_vma(struct vm_area_struct *vma)
-+{
-+ return subpool_inode(vma->vm_file->f_dentry->d_inode);
-+}
-+
- /*
- * Region tracking -- allows tracking of reservations and instantiated pages
- * across the pages in a mapping.
-@@ -541,9 +619,9 @@ static void free_huge_page(struct page *page)
- */
- struct hstate *h = page_hstate(page);
- int nid = page_to_nid(page);
-- struct address_space *mapping;
-+ struct hugepage_subpool *spool =
-+ (struct hugepage_subpool *)page_private(page);
-
-- mapping = (struct address_space *) page_private(page);
- set_page_private(page, 0);
- page->mapping = NULL;
- BUG_ON(page_count(page));
-@@ -558,8 +636,7 @@ static void free_huge_page(struct page *page)
- enqueue_huge_page(h, page);
- }
- spin_unlock(&hugetlb_lock);
-- if (mapping)
-- hugetlb_put_quota(mapping, 1);
-+ hugepage_subpool_put_pages(spool, 1);
- }
-
- static void prep_new_huge_page(struct hstate *h, struct page *page, int nid)
-@@ -927,11 +1004,12 @@ static void return_unused_surplus_pages(struct hstate *h,
- /*
- * Determine if the huge page at addr within the vma has an associated
- * reservation. Where it does not we will need to logically increase
-- * reservation and actually increase quota before an allocation can occur.
-- * Where any new reservation would be required the reservation change is
-- * prepared, but not committed. Once the page has been quota'd allocated
-- * an instantiated the change should be committed via vma_commit_reservation.
-- * No action is required on failure.
-+ * reservation and actually increase subpool usage before an allocation
-+ * can occur. Where any new reservation would be required the
-+ * reservation change is prepared, but not committed. Once the page
-+ * has been allocated from the subpool and instantiated the change should
-+ * be committed via vma_commit_reservation. No action is required on
-+ * failure.
- */
- static long vma_needs_reservation(struct hstate *h,
- struct vm_area_struct *vma, unsigned long addr)
-@@ -980,24 +1058,24 @@ static void vma_commit_reservation(struct hstate *h,
- static struct page *alloc_huge_page(struct vm_area_struct *vma,
- unsigned long addr, int avoid_reserve)
- {
-+ struct hugepage_subpool *spool = subpool_vma(vma);
- struct hstate *h = hstate_vma(vma);
- struct page *page;
-- struct address_space *mapping = vma->vm_file->f_mapping;
-- struct inode *inode = mapping->host;
- long chg;
-
- /*
-- * Processes that did not create the mapping will have no reserves and
-- * will not have accounted against quota. Check that the quota can be
-- * made before satisfying the allocation
-- * MAP_NORESERVE mappings may also need pages and quota allocated
-- * if no reserve mapping overlaps.
-+ * Processes that did not create the mapping will have no
-+ * reserves and will not have accounted against subpool
-+ * limit. Check that the subpool limit can be made before
-+ * satisfying the allocation MAP_NORESERVE mappings may also
-+ * need pages and subpool limit allocated allocated if no reserve
-+ * mapping overlaps.
- */
- chg = vma_needs_reservation(h, vma, addr);
- if (chg < 0)
- return ERR_PTR(-VM_FAULT_OOM);
- if (chg)
-- if (hugetlb_get_quota(inode->i_mapping, chg))
-+ if (hugepage_subpool_get_pages(spool, chg))
- return ERR_PTR(-VM_FAULT_SIGBUS);
-
- spin_lock(&hugetlb_lock);
-@@ -1007,13 +1085,13 @@ static struct page *alloc_huge_page(struct vm_area_struct *vma,
- if (!page) {
- page = alloc_buddy_huge_page(h, vma, addr);
- if (!page) {
-- hugetlb_put_quota(inode->i_mapping, chg);
-+ hugepage_subpool_put_pages(spool, chg);
- return ERR_PTR(-VM_FAULT_SIGBUS);
- }
- }
-
- set_page_refcounted(page);
-- set_page_private(page, (unsigned long) mapping);
-+ set_page_private(page, (unsigned long)spool);
-
- vma_commit_reservation(h, vma, addr);
-
-@@ -1698,6 +1776,7 @@ static void hugetlb_vm_op_close(struct vm_area_struct *vma)
- {
- struct hstate *h = hstate_vma(vma);
- struct resv_map *reservations = vma_resv_map(vma);
-+ struct hugepage_subpool *spool = subpool_vma(vma);
- unsigned long reserve;
- unsigned long start;
- unsigned long end;
-@@ -1713,7 +1792,7 @@ static void hugetlb_vm_op_close(struct vm_area_struct *vma)
-
- if (reserve) {
- hugetlb_acct_memory(h, -reserve);
-- hugetlb_put_quota(vma->vm_file->f_mapping, reserve);
-+ hugepage_subpool_put_pages(spool, reserve);
- }
- }
- }
-@@ -1910,7 +1989,7 @@ static int unmap_ref_private(struct mm_struct *mm, struct vm_area_struct *vma,
- address = address & huge_page_mask(h);
- pgoff = ((address - vma->vm_start) >> PAGE_SHIFT)
- + (vma->vm_pgoff >> PAGE_SHIFT);
-- mapping = (struct address_space *)page_private(page);
-+ mapping = vma->vm_file->f_dentry->d_inode->i_mapping;
-
- vma_prio_tree_foreach(iter_vma, &iter, &mapping->i_mmap, pgoff, pgoff) {
- /* Do not unmap the current VMA */
-@@ -2364,11 +2443,12 @@ int hugetlb_reserve_pages(struct inode *inode,
- {
- long ret, chg;
- struct hstate *h = hstate_inode(inode);
-+ struct hugepage_subpool *spool = subpool_inode(inode);
-
- /*
- * Only apply hugepage reservation if asked. At fault time, an
- * attempt will be made for VM_NORESERVE to allocate a page
-- * and filesystem quota without using reserves
-+ * without using reserves
- */
- if (acctflag & VM_NORESERVE)
- return 0;
-@@ -2395,17 +2475,17 @@ int hugetlb_reserve_pages(struct inode *inode,
- if (chg < 0)
- return chg;
-
-- /* There must be enough filesystem quota for the mapping */
-- if (hugetlb_get_quota(inode->i_mapping, chg))
-+ /* There must be enough pages in the subpool for the mapping */
-+ if (hugepage_subpool_get_pages(spool, chg))
- return -ENOSPC;
-
- /*
- * Check enough hugepages are available for the reservation.
-- * Hand back the quota if there are not
-+ * Hand the pages back to the subpool if there are not
- */
- ret = hugetlb_acct_memory(h, chg);
- if (ret < 0) {
-- hugetlb_put_quota(inode->i_mapping, chg);
-+ hugepage_subpool_put_pages(spool, chg);
- return ret;
- }
-
-@@ -2429,11 +2509,12 @@ void hugetlb_unreserve_pages(struct inode *inode, long offset, long freed)
- {
- struct hstate *h = hstate_inode(inode);
- long chg = region_truncate(&inode->i_mapping->private_list, offset);
-+ struct hugepage_subpool *spool = subpool_inode(inode);
-
- spin_lock(&inode->i_lock);
- inode->i_blocks -= (blocks_per_huge_page(h) * freed);
- spin_unlock(&inode->i_lock);
-
-- hugetlb_put_quota(inode->i_mapping, (chg - freed));
-+ hugepage_subpool_put_pages(spool, (chg - freed));
- hugetlb_acct_memory(h, -(chg - freed));
- }
-diff --git a/mm/madvise.c b/mm/madvise.c
-index 35b1479..e405c5f 100644
---- a/mm/madvise.c
-+++ b/mm/madvise.c
-@@ -12,6 +12,7 @@
- #include <linux/hugetlb.h>
- #include <linux/sched.h>
- #include <linux/ksm.h>
-+#include <linux/file.h>
-
- /*
- * Any behaviour which results in changes to the vma->vm_flags needs to
-@@ -190,14 +191,16 @@ static long madvise_remove(struct vm_area_struct *vma,
- struct address_space *mapping;
- loff_t offset, endoff;
- int error;
-+ struct file *f;
-
- *prev = NULL; /* tell sys_madvise we drop mmap_sem */
-
- if (vma->vm_flags & (VM_LOCKED|VM_NONLINEAR|VM_HUGETLB))
- return -EINVAL;
-
-- if (!vma->vm_file || !vma->vm_file->f_mapping
-- || !vma->vm_file->f_mapping->host) {
-+ f = vma->vm_file;
-+
-+ if (!f || !f->f_mapping || !f->f_mapping->host) {
- return -EINVAL;
- }
-
-@@ -211,9 +214,16 @@ static long madvise_remove(struct vm_area_struct *vma,
- endoff = (loff_t)(end - vma->vm_start - 1)
- + ((loff_t)vma->vm_pgoff << PAGE_SHIFT);
-
-- /* vmtruncate_range needs to take i_mutex and i_alloc_sem */
-+ /*
-+ * vmtruncate_range may need to take i_mutex and i_alloc_sem.
-+ * We need to explicitly grab a reference because the vma (and
-+ * hence the vma's reference to the file) can go away as soon as
-+ * we drop mmap_sem.
-+ */
-+ get_file(f);
- up_read(¤t->mm->mmap_sem);
- error = vmtruncate_range(mapping->host, offset, endoff);
-+ fput(f);
- down_read(¤t->mm->mmap_sem);
- return error;
- }
-diff --git a/mm/mempolicy.c b/mm/mempolicy.c
-index 3c6e3e2..a6563fb 100644
---- a/mm/mempolicy.c
-+++ b/mm/mempolicy.c
-@@ -2259,7 +2259,7 @@ int mpol_to_str(char *buffer, int maxlen, struct mempolicy *pol, int no_context)
- break;
-
- default:
-- BUG();
-+ return -EINVAL;
- }
-
- l = strlen(policy_types[mode]);
-diff --git a/mm/mmu_notifier.c b/mm/mmu_notifier.c
-index 7e33f2c..8aa875c 100644
---- a/mm/mmu_notifier.c
-+++ b/mm/mmu_notifier.c
-@@ -32,6 +32,24 @@
- void __mmu_notifier_release(struct mm_struct *mm)
- {
- struct mmu_notifier *mn;
-+ struct hlist_node *n;
-+
-+ /*
-+ * RCU here will block mmu_notifier_unregister until
-+ * ->release returns.
-+ */
-+ rcu_read_lock();
-+ hlist_for_each_entry_rcu(mn, n, &mm->mmu_notifier_mm->list, hlist)
-+ /*
-+ * if ->release runs before mmu_notifier_unregister it
-+ * must be handled as it's the only way for the driver
-+ * to flush all existing sptes and stop the driver
-+ * from establishing any more sptes before all the
-+ * pages in the mm are freed.
-+ */
-+ if (mn->ops->release)
-+ mn->ops->release(mn, mm);
-+ rcu_read_unlock();
-
- spin_lock(&mm->mmu_notifier_mm->lock);
- while (unlikely(!hlist_empty(&mm->mmu_notifier_mm->list))) {
-@@ -45,23 +63,6 @@ void __mmu_notifier_release(struct mm_struct *mm)
- * mmu_notifier_unregister to return.
- */
- hlist_del_init_rcu(&mn->hlist);
-- /*
-- * RCU here will block mmu_notifier_unregister until
-- * ->release returns.
-- */
-- rcu_read_lock();
-- spin_unlock(&mm->mmu_notifier_mm->lock);
-- /*
-- * if ->release runs before mmu_notifier_unregister it
-- * must be handled as it's the only way for the driver
-- * to flush all existing sptes and stop the driver
-- * from establishing any more sptes before all the
-- * pages in the mm are freed.
-- */
-- if (mn->ops->release)
-- mn->ops->release(mn, mm);
-- rcu_read_unlock();
-- spin_lock(&mm->mmu_notifier_mm->lock);
- }
- spin_unlock(&mm->mmu_notifier_mm->lock);
-
-@@ -263,16 +264,13 @@ void mmu_notifier_unregister(struct mmu_notifier *mn, struct mm_struct *mm)
- {
- BUG_ON(atomic_read(&mm->mm_count) <= 0);
-
-- spin_lock(&mm->mmu_notifier_mm->lock);
- if (!hlist_unhashed(&mn->hlist)) {
-- hlist_del_rcu(&mn->hlist);
--
- /*
- * RCU here will force exit_mmap to wait ->release to finish
- * before freeing the pages.
- */
- rcu_read_lock();
-- spin_unlock(&mm->mmu_notifier_mm->lock);
-+
- /*
- * exit_mmap will block in mmu_notifier_release to
- * guarantee ->release is called before freeing the
-@@ -281,8 +279,11 @@ void mmu_notifier_unregister(struct mmu_notifier *mn, struct mm_struct *mm)
- if (mn->ops->release)
- mn->ops->release(mn, mm);
- rcu_read_unlock();
-- } else
-+
-+ spin_lock(&mm->mmu_notifier_mm->lock);
-+ hlist_del_rcu(&mn->hlist);
- spin_unlock(&mm->mmu_notifier_mm->lock);
-+ }
-
- /*
- * Wait any running method to finish, of course including
-diff --git a/net/core/dev.c b/net/core/dev.c
-index 84a0705..46e2a29 100644
---- a/net/core/dev.c
-+++ b/net/core/dev.c
-@@ -1133,6 +1133,7 @@ int dev_open(struct net_device *dev)
- /*
- * ... and announce new interface.
- */
-+ add_device_randomness(dev->dev_addr, dev->addr_len);
- call_netdevice_notifiers(NETDEV_UP, dev);
- }
-
-@@ -4268,6 +4269,7 @@ int dev_set_mac_address(struct net_device *dev, struct sockaddr *sa)
- err = ops->ndo_set_mac_address(dev, sa);
- if (!err)
- call_netdevice_notifiers(NETDEV_CHANGEADDR, dev);
-+ add_device_randomness(dev->dev_addr, dev->addr_len);
- return err;
- }
- EXPORT_SYMBOL(dev_set_mac_address);
-@@ -4871,6 +4873,7 @@ int register_netdevice(struct net_device *dev)
- dev_init_scheduler(dev);
- dev_hold(dev);
- list_netdevice(dev);
-+ add_device_randomness(dev->dev_addr, dev->addr_len);
-
- /* Notify protocols, that a new device appeared. */
- ret = call_netdevice_notifiers(NETDEV_REGISTER, dev);
-diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
-index d4fd895..9d70042 100644
---- a/net/core/rtnetlink.c
-+++ b/net/core/rtnetlink.c
-@@ -817,6 +817,7 @@ static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
- goto errout;
- send_addr_notify = 1;
- modified = 1;
-+ add_device_randomness(dev->dev_addr, dev->addr_len);
- }
-
- if (tb[IFLA_MTU]) {
-diff --git a/net/core/skbuff.c b/net/core/skbuff.c
-index 025f924..72ff527 100644
---- a/net/core/skbuff.c
-+++ b/net/core/skbuff.c
-@@ -2989,6 +2989,8 @@ static void sock_rmem_free(struct sk_buff *skb)
- */
- int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
- {
-+ int len = skb->len;
-+
- if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
- (unsigned)sk->sk_rcvbuf)
- return -ENOMEM;
-@@ -3000,7 +3002,7 @@ int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
-
- skb_queue_tail(&sk->sk_error_queue, skb);
- if (!sock_flag(sk, SOCK_DEAD))
-- sk->sk_data_ready(sk, skb->len);
-+ sk->sk_data_ready(sk, len);
- return 0;
- }
- EXPORT_SYMBOL(sock_queue_err_skb);
-diff --git a/net/core/sock.c b/net/core/sock.c
-index 6605e75..4538a34 100644
---- a/net/core/sock.c
-+++ b/net/core/sock.c
-@@ -1391,6 +1391,11 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
- gfp_t gfp_mask;
- long timeo;
- int err;
-+ int npages = (data_len + (PAGE_SIZE - 1)) >> PAGE_SHIFT;
-+
-+ err = -EMSGSIZE;
-+ if (npages > MAX_SKB_FRAGS)
-+ goto failure;
-
- gfp_mask = sk->sk_allocation;
- if (gfp_mask & __GFP_WAIT)
-@@ -1409,14 +1414,12 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
- if (atomic_read(&sk->sk_wmem_alloc) < sk->sk_sndbuf) {
- skb = alloc_skb(header_len, gfp_mask);
- if (skb) {
-- int npages;
- int i;
-
- /* No pages, we're done... */
- if (!data_len)
- break;
-
-- npages = (data_len + (PAGE_SIZE - 1)) >> PAGE_SHIFT;
- skb->truesize += data_len;
- skb_shinfo(skb)->nr_frags = npages;
- for (i = 0; i < npages; i++) {
-diff --git a/net/dccp/ccid.h b/net/dccp/ccid.h
-index facedd2..ab260b0 100644
---- a/net/dccp/ccid.h
-+++ b/net/dccp/ccid.h
-@@ -214,7 +214,7 @@ static inline int ccid_hc_rx_getsockopt(struct ccid *ccid, struct sock *sk,
- u32 __user *optval, int __user *optlen)
- {
- int rc = -ENOPROTOOPT;
-- if (ccid->ccid_ops->ccid_hc_rx_getsockopt != NULL)
-+ if (ccid != NULL && ccid->ccid_ops->ccid_hc_rx_getsockopt != NULL)
- rc = ccid->ccid_ops->ccid_hc_rx_getsockopt(sk, optname, len,
- optval, optlen);
- return rc;
-@@ -225,7 +225,7 @@ static inline int ccid_hc_tx_getsockopt(struct ccid *ccid, struct sock *sk,
- u32 __user *optval, int __user *optlen)
- {
- int rc = -ENOPROTOOPT;
-- if (ccid->ccid_ops->ccid_hc_tx_getsockopt != NULL)
-+ if (ccid != NULL && ccid->ccid_ops->ccid_hc_tx_getsockopt != NULL)
- rc = ccid->ccid_ops->ccid_hc_tx_getsockopt(sk, optname, len,
- optval, optlen);
- return rc;
-diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
-index 039cc1f..10f8f8d 100644
---- a/net/ipv4/cipso_ipv4.c
-+++ b/net/ipv4/cipso_ipv4.c
-@@ -1726,8 +1726,10 @@ int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option)
- case CIPSO_V4_TAG_LOCAL:
- /* This is a non-standard tag that we only allow for
- * local connections, so if the incoming interface is
-- * not the loopback device drop the packet. */
-- if (!(skb->dev->flags & IFF_LOOPBACK)) {
-+ * not the loopback device drop the packet. Further,
-+ * there is no legitimate reason for setting this from
-+ * userspace so reject it if skb is NULL. */
-+ if (skb == NULL || !(skb->dev->flags & IFF_LOOPBACK)) {
- err_offset = opt_iter;
- goto validate_return_locked;
- }
-diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
-index f095659..b9644d8 100644
---- a/net/ipv4/tcp.c
-+++ b/net/ipv4/tcp.c
-@@ -838,8 +838,7 @@ new_segment:
- wait_for_sndbuf:
- set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
- wait_for_memory:
-- if (copied)
-- tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
-+ tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
-
- if ((err = sk_stream_wait_memory(sk, &timeo)) != 0)
- goto do_error;
-diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
-index ce1ce82..db755c4 100644
---- a/net/ipv4/tcp_input.c
-+++ b/net/ipv4/tcp_input.c
-@@ -5239,7 +5239,9 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
- if (tp->copied_seq == tp->rcv_nxt &&
- len - tcp_header_len <= tp->ucopy.len) {
- #ifdef CONFIG_NET_DMA
-- if (tcp_dma_try_early_copy(sk, skb, tcp_header_len)) {
-+ if (tp->ucopy.task == current &&
-+ sock_owned_by_user(sk) &&
-+ tcp_dma_try_early_copy(sk, skb, tcp_header_len)) {
- copied_early = 1;
- eaten = 1;
- }
-@@ -5632,6 +5634,8 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
- goto discard;
-
- if (th->syn) {
-+ if (th->fin)
-+ goto discard;
- if (icsk->icsk_af_ops->conn_request(sk, skb) < 0)
- return 1;
-
-diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
-index 6fc7961..6a4e832 100644
---- a/net/ipv4/tcp_ipv4.c
-+++ b/net/ipv4/tcp_ipv4.c
-@@ -406,6 +406,9 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
- !icsk->icsk_backoff)
- break;
-
-+ if (sock_owned_by_user(sk))
-+ break;
-+
- icsk->icsk_backoff--;
- inet_csk(sk)->icsk_rto = __tcp_set_rto(tp) <<
- icsk->icsk_backoff;
-@@ -420,11 +423,6 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
- if (remaining) {
- inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
- remaining, TCP_RTO_MAX);
-- } else if (sock_owned_by_user(sk)) {
-- /* RTO revert clocked out retransmission,
-- * but socket is locked. Will defer. */
-- inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
-- HZ/20, TCP_RTO_MAX);
- } else {
- /* RTO revert clocked out retransmission.
- * Will retransmit now */
-diff --git a/net/ipv4/xfrm4_mode_beet.c b/net/ipv4/xfrm4_mode_beet.c
-index 6341818..e3db3f9 100644
---- a/net/ipv4/xfrm4_mode_beet.c
-+++ b/net/ipv4/xfrm4_mode_beet.c
-@@ -110,10 +110,7 @@ static int xfrm4_beet_input(struct xfrm_state *x, struct sk_buff *skb)
-
- skb_push(skb, sizeof(*iph));
- skb_reset_network_header(skb);
--
-- memmove(skb->data - skb->mac_len, skb_mac_header(skb),
-- skb->mac_len);
-- skb_set_mac_header(skb, -skb->mac_len);
-+ skb_mac_header_rebuild(skb);
-
- xfrm4_beet_make_header(skb);
-
-diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c
-index 3444f3b..5d1d1fd 100644
---- a/net/ipv4/xfrm4_mode_tunnel.c
-+++ b/net/ipv4/xfrm4_mode_tunnel.c
-@@ -65,7 +65,6 @@ static int xfrm4_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
-
- static int xfrm4_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
- {
-- const unsigned char *old_mac;
- int err = -EINVAL;
-
- if (XFRM_MODE_SKB_CB(skb)->protocol != IPPROTO_IPIP)
-@@ -83,10 +82,9 @@ static int xfrm4_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
- if (!(x->props.flags & XFRM_STATE_NOECN))
- ipip_ecn_decapsulate(skb);
-
-- old_mac = skb_mac_header(skb);
-- skb_set_mac_header(skb, -skb->mac_len);
-- memmove(skb_mac_header(skb), old_mac, skb->mac_len);
- skb_reset_network_header(skb);
-+ skb_mac_header_rebuild(skb);
-+
- err = 0;
-
- out:
-diff --git a/net/ipv6/xfrm6_mode_beet.c b/net/ipv6/xfrm6_mode_beet.c
-index bbd48b1..6cc7a45 100644
---- a/net/ipv6/xfrm6_mode_beet.c
-+++ b/net/ipv6/xfrm6_mode_beet.c
-@@ -82,7 +82,6 @@ static int xfrm6_beet_output(struct xfrm_state *x, struct sk_buff *skb)
- static int xfrm6_beet_input(struct xfrm_state *x, struct sk_buff *skb)
- {
- struct ipv6hdr *ip6h;
-- const unsigned char *old_mac;
- int size = sizeof(struct ipv6hdr);
- int err;
-
-@@ -92,10 +91,7 @@ static int xfrm6_beet_input(struct xfrm_state *x, struct sk_buff *skb)
-
- __skb_push(skb, size);
- skb_reset_network_header(skb);
--
-- old_mac = skb_mac_header(skb);
-- skb_set_mac_header(skb, -skb->mac_len);
-- memmove(skb_mac_header(skb), old_mac, skb->mac_len);
-+ skb_mac_header_rebuild(skb);
-
- xfrm6_beet_make_header(skb);
-
-diff --git a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c
-index 3927832..672c0da 100644
---- a/net/ipv6/xfrm6_mode_tunnel.c
-+++ b/net/ipv6/xfrm6_mode_tunnel.c
-@@ -61,7 +61,6 @@ static int xfrm6_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
- static int xfrm6_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
- {
- int err = -EINVAL;
-- const unsigned char *old_mac;
-
- if (XFRM_MODE_SKB_CB(skb)->protocol != IPPROTO_IPV6)
- goto out;
-@@ -78,10 +77,9 @@ static int xfrm6_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
- if (!(x->props.flags & XFRM_STATE_NOECN))
- ipip6_ecn_decapsulate(skb);
-
-- old_mac = skb_mac_header(skb);
-- skb_set_mac_header(skb, -skb->mac_len);
-- memmove(skb_mac_header(skb), old_mac, skb->mac_len);
- skb_reset_network_header(skb);
-+ skb_mac_header_rebuild(skb);
-+
- err = 0;
-
- out:
-diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
-index 5a7dcdf..fc91ff6 100644
---- a/net/netlink/af_netlink.c
-+++ b/net/netlink/af_netlink.c
-@@ -821,12 +821,19 @@ int netlink_attachskb(struct sock *sk, struct sk_buff *skb,
- return 0;
- }
-
--int netlink_sendskb(struct sock *sk, struct sk_buff *skb)
-+static int __netlink_sendskb(struct sock *sk, struct sk_buff *skb)
- {
- int len = skb->len;
-
- skb_queue_tail(&sk->sk_receive_queue, skb);
- sk->sk_data_ready(sk, len);
-+ return len;
-+}
-+
-+int netlink_sendskb(struct sock *sk, struct sk_buff *skb)
-+{
-+ int len = __netlink_sendskb(sk, skb);
-+
- sock_put(sk);
- return len;
- }
-@@ -951,8 +958,7 @@ static inline int netlink_broadcast_deliver(struct sock *sk,
- if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf &&
- !test_bit(0, &nlk->state)) {
- skb_set_owner_r(skb, sk);
-- skb_queue_tail(&sk->sk_receive_queue, skb);
-- sk->sk_data_ready(sk, skb->len);
-+ __netlink_sendskb(sk, skb);
- return atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf;
- }
- return -1;
-@@ -1665,10 +1671,8 @@ static int netlink_dump(struct sock *sk)
-
- if (sk_filter(sk, skb))
- kfree_skb(skb);
-- else {
-- skb_queue_tail(&sk->sk_receive_queue, skb);
-- sk->sk_data_ready(sk, skb->len);
-- }
-+ else
-+ __netlink_sendskb(sk, skb);
- return 0;
- }
-
-@@ -1680,10 +1684,8 @@ static int netlink_dump(struct sock *sk)
-
- if (sk_filter(sk, skb))
- kfree_skb(skb);
-- else {
-- skb_queue_tail(&sk->sk_receive_queue, skb);
-- sk->sk_data_ready(sk, skb->len);
-- }
-+ else
-+ __netlink_sendskb(sk, skb);
-
- if (cb->done)
- cb->done(cb);
-diff --git a/net/phonet/pep.c b/net/phonet/pep.c
-index 9cdd35e..7481d70 100644
---- a/net/phonet/pep.c
-+++ b/net/phonet/pep.c
-@@ -851,6 +851,9 @@ static int pep_sendmsg(struct kiocb *iocb, struct sock *sk,
- int flags = msg->msg_flags;
- int err, done;
-
-+ if (len > 65535)
-+ return -EMSGSIZE;
-+
- if (msg->msg_flags & MSG_OOB || !(msg->msg_flags & MSG_EOR))
- return -EOPNOTSUPP;
-
-diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
-index 7d188bc..523efbb 100644
---- a/net/rose/af_rose.c
-+++ b/net/rose/af_rose.c
-@@ -983,7 +983,7 @@ int rose_rx_call_request(struct sk_buff *skb, struct net_device *dev, struct ros
- struct sock *make;
- struct rose_sock *make_rose;
- struct rose_facilities_struct facilities;
-- int n, len;
-+ int n;
-
- skb->sk = NULL; /* Initially we don't know who it's for */
-
-@@ -992,9 +992,9 @@ int rose_rx_call_request(struct sk_buff *skb, struct net_device *dev, struct ros
- */
- memset(&facilities, 0x00, sizeof(struct rose_facilities_struct));
-
-- len = (((skb->data[3] >> 4) & 0x0F) + 1) >> 1;
-- len += (((skb->data[3] >> 0) & 0x0F) + 1) >> 1;
-- if (!rose_parse_facilities(skb->data + len + 4, &facilities)) {
-+ if (!rose_parse_facilities(skb->data + ROSE_CALL_REQ_FACILITIES_OFF,
-+ skb->len - ROSE_CALL_REQ_FACILITIES_OFF,
-+ &facilities)) {
- rose_transmit_clear_request(neigh, lci, ROSE_INVALID_FACILITY, 76);
- return 0;
- }
-diff --git a/net/rose/rose_loopback.c b/net/rose/rose_loopback.c
-index 114df6e..37965b8 100644
---- a/net/rose/rose_loopback.c
-+++ b/net/rose/rose_loopback.c
-@@ -72,9 +72,20 @@ static void rose_loopback_timer(unsigned long param)
- unsigned int lci_i, lci_o;
-
- while ((skb = skb_dequeue(&loopback_queue)) != NULL) {
-+ if (skb->len < ROSE_MIN_LEN) {
-+ kfree_skb(skb);
-+ continue;
-+ }
- lci_i = ((skb->data[0] << 8) & 0xF00) + ((skb->data[1] << 0) & 0x0FF);
- frametype = skb->data[2];
-- dest = (rose_address *)(skb->data + 4);
-+ if (frametype == ROSE_CALL_REQUEST &&
-+ (skb->len <= ROSE_CALL_REQ_FACILITIES_OFF ||
-+ skb->data[ROSE_CALL_REQ_ADDR_LEN_OFF] !=
-+ ROSE_CALL_REQ_ADDR_LEN_VAL)) {
-+ kfree_skb(skb);
-+ continue;
-+ }
-+ dest = (rose_address *)(skb->data + ROSE_CALL_REQ_DEST_ADDR_OFF);
- lci_o = 0xFFF - lci_i;
-
- skb_reset_transport_header(skb);
-diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
-index 08230fa..1646b25 100644
---- a/net/rose/rose_route.c
-+++ b/net/rose/rose_route.c
-@@ -852,7 +852,7 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25)
- unsigned int lci, new_lci;
- unsigned char cause, diagnostic;
- struct net_device *dev;
-- int len, res = 0;
-+ int res = 0;
- char buf[11];
-
- #if 0
-@@ -860,10 +860,17 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25)
- return res;
- #endif
-
-+ if (skb->len < ROSE_MIN_LEN)
-+ return res;
- frametype = skb->data[2];
- lci = ((skb->data[0] << 8) & 0xF00) + ((skb->data[1] << 0) & 0x0FF);
-- src_addr = (rose_address *)(skb->data + 9);
-- dest_addr = (rose_address *)(skb->data + 4);
-+ if (frametype == ROSE_CALL_REQUEST &&
-+ (skb->len <= ROSE_CALL_REQ_FACILITIES_OFF ||
-+ skb->data[ROSE_CALL_REQ_ADDR_LEN_OFF] !=
-+ ROSE_CALL_REQ_ADDR_LEN_VAL))
-+ return res;
-+ src_addr = (rose_address *)(skb->data + ROSE_CALL_REQ_SRC_ADDR_OFF);
-+ dest_addr = (rose_address *)(skb->data + ROSE_CALL_REQ_DEST_ADDR_OFF);
-
- spin_lock_bh(&rose_neigh_list_lock);
- spin_lock_bh(&rose_route_list_lock);
-@@ -1001,12 +1008,11 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25)
- goto out;
- }
-
-- len = (((skb->data[3] >> 4) & 0x0F) + 1) >> 1;
-- len += (((skb->data[3] >> 0) & 0x0F) + 1) >> 1;
--
- memset(&facilities, 0x00, sizeof(struct rose_facilities_struct));
-
-- if (!rose_parse_facilities(skb->data + len + 4, &facilities)) {
-+ if (!rose_parse_facilities(skb->data + ROSE_CALL_REQ_FACILITIES_OFF,
-+ skb->len - ROSE_CALL_REQ_FACILITIES_OFF,
-+ &facilities)) {
- rose_transmit_clear_request(rose_neigh, lci, ROSE_INVALID_FACILITY, 76);
- goto out;
- }
-diff --git a/net/rose/rose_subr.c b/net/rose/rose_subr.c
-index 07bca7d..32e5c9f 100644
---- a/net/rose/rose_subr.c
-+++ b/net/rose/rose_subr.c
-@@ -141,7 +141,7 @@ void rose_write_internal(struct sock *sk, int frametype)
- *dptr++ = ROSE_GFI | lci1;
- *dptr++ = lci2;
- *dptr++ = frametype;
-- *dptr++ = 0xAA;
-+ *dptr++ = ROSE_CALL_REQ_ADDR_LEN_VAL;
- memcpy(dptr, &rose->dest_addr, ROSE_ADDR_LEN);
- dptr += ROSE_ADDR_LEN;
- memcpy(dptr, &rose->source_addr, ROSE_ADDR_LEN);
-@@ -245,12 +245,16 @@ static int rose_parse_national(unsigned char *p, struct rose_facilities_struct *
- do {
- switch (*p & 0xC0) {
- case 0x00:
-+ if (len < 2)
-+ return -1;
- p += 2;
- n += 2;
- len -= 2;
- break;
-
- case 0x40:
-+ if (len < 3)
-+ return -1;
- if (*p == FAC_NATIONAL_RAND)
- facilities->rand = ((p[1] << 8) & 0xFF00) + ((p[2] << 0) & 0x00FF);
- p += 3;
-@@ -259,32 +263,48 @@ static int rose_parse_national(unsigned char *p, struct rose_facilities_struct *
- break;
-
- case 0x80:
-+ if (len < 4)
-+ return -1;
- p += 4;
- n += 4;
- len -= 4;
- break;
-
- case 0xC0:
-+ if (len < 2)
-+ return -1;
- l = p[1];
-+ if (len < 2 + l)
-+ return -1;
- if (*p == FAC_NATIONAL_DEST_DIGI) {
- if (!fac_national_digis_received) {
-+ if (l < AX25_ADDR_LEN)
-+ return -1;
- memcpy(&facilities->source_digis[0], p + 2, AX25_ADDR_LEN);
- facilities->source_ndigis = 1;
- }
- }
- else if (*p == FAC_NATIONAL_SRC_DIGI) {
- if (!fac_national_digis_received) {
-+ if (l < AX25_ADDR_LEN)
-+ return -1;
- memcpy(&facilities->dest_digis[0], p + 2, AX25_ADDR_LEN);
- facilities->dest_ndigis = 1;
- }
- }
- else if (*p == FAC_NATIONAL_FAIL_CALL) {
-+ if (l < AX25_ADDR_LEN)
-+ return -1;
- memcpy(&facilities->fail_call, p + 2, AX25_ADDR_LEN);
- }
- else if (*p == FAC_NATIONAL_FAIL_ADD) {
-+ if (l < 1 + ROSE_ADDR_LEN)
-+ return -1;
- memcpy(&facilities->fail_addr, p + 3, ROSE_ADDR_LEN);
- }
- else if (*p == FAC_NATIONAL_DIGIS) {
-+ if (l % AX25_ADDR_LEN)
-+ return -1;
- fac_national_digis_received = 1;
- facilities->source_ndigis = 0;
- facilities->dest_ndigis = 0;
-@@ -318,24 +338,32 @@ static int rose_parse_ccitt(unsigned char *p, struct rose_facilities_struct *fac
- do {
- switch (*p & 0xC0) {
- case 0x00:
-+ if (len < 2)
-+ return -1;
- p += 2;
- n += 2;
- len -= 2;
- break;
-
- case 0x40:
-+ if (len < 3)
-+ return -1;
- p += 3;
- n += 3;
- len -= 3;
- break;
-
- case 0x80:
-+ if (len < 4)
-+ return -1;
- p += 4;
- n += 4;
- len -= 4;
- break;
-
- case 0xC0:
-+ if (len < 2)
-+ return -1;
- l = p[1];
-
- /* Prevent overflows*/
-@@ -364,49 +392,44 @@ static int rose_parse_ccitt(unsigned char *p, struct rose_facilities_struct *fac
- return n;
- }
-
--int rose_parse_facilities(unsigned char *p,
-+int rose_parse_facilities(unsigned char *p, unsigned packet_len,
- struct rose_facilities_struct *facilities)
- {
- int facilities_len, len;
-
- facilities_len = *p++;
-
-- if (facilities_len == 0)
-+ if (facilities_len == 0 || (unsigned)facilities_len > packet_len)
- return 0;
-
-- while (facilities_len > 0) {
-- if (*p == 0x00) {
-- facilities_len--;
-- p++;
--
-- switch (*p) {
-- case FAC_NATIONAL: /* National */
-- len = rose_parse_national(p + 1, facilities, facilities_len - 1);
-- if (len < 0)
-- return 0;
-- facilities_len -= len + 1;
-- p += len + 1;
-- break;
--
-- case FAC_CCITT: /* CCITT */
-- len = rose_parse_ccitt(p + 1, facilities, facilities_len - 1);
-- if (len < 0)
-- return 0;
-- facilities_len -= len + 1;
-- p += len + 1;
-- break;
--
-- default:
-- printk(KERN_DEBUG "ROSE: rose_parse_facilities - unknown facilities family %02X\n", *p);
-- facilities_len--;
-- p++;
-- break;
-- }
-- } else
-- break; /* Error in facilities format */
-+ while (facilities_len >= 3 && *p == 0x00) {
-+ facilities_len--;
-+ p++;
-+
-+ switch (*p) {
-+ case FAC_NATIONAL: /* National */
-+ len = rose_parse_national(p + 1, facilities, facilities_len - 1);
-+ break;
-+
-+ case FAC_CCITT: /* CCITT */
-+ len = rose_parse_ccitt(p + 1, facilities, facilities_len - 1);
-+ break;
-+
-+ default:
-+ printk(KERN_DEBUG "ROSE: rose_parse_facilities - unknown facilities family %02X\n", *p);
-+ len = 1;
-+ break;
-+ }
-+
-+ if (len < 0)
-+ return 0;
-+ if (WARN_ON(len >= facilities_len))
-+ return 0;
-+ facilities_len -= len + 1;
-+ p += len + 1;
- }
-
-- return 1;
-+ return facilities_len == 0;
- }
-
- static int rose_create_facilities(unsigned char *buffer, struct rose_sock *rose)
-diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c
-index 40408d5..bf98414 100644
---- a/net/sched/sch_gred.c
-+++ b/net/sched/sch_gred.c
-@@ -544,11 +544,8 @@ static int gred_dump(struct Qdisc *sch, struct sk_buff *skb)
- opt.packets = q->packetsin;
- opt.bytesin = q->bytesin;
-
-- if (gred_wred_mode(table)) {
-- q->parms.qidlestart =
-- table->tab[table->def]->parms.qidlestart;
-- q->parms.qavg = table->tab[table->def]->parms.qavg;
-- }
-+ if (gred_wred_mode(table))
-+ gred_load_wred_set(table, q);
-
- opt.qave = red_calc_qavg(&q->parms, q->parms.qavg);
-
-diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
-index 2b88295..0ae345a 100644
---- a/net/sched/sch_netem.c
-+++ b/net/sched/sch_netem.c
-@@ -199,12 +199,10 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
- * do it now in software before we mangle it.
- */
- if (q->corrupt && q->corrupt >= get_crandom(&q->corrupt_cor)) {
-- if (!(skb = skb_unshare(skb, GFP_ATOMIC))
-- || (skb->ip_summed == CHECKSUM_PARTIAL
-- && skb_checksum_help(skb))) {
-- sch->qstats.drops++;
-- return NET_XMIT_DROP;
-- }
-+ if (!(skb = skb_unshare(skb, GFP_ATOMIC)) ||
-+ (skb->ip_summed == CHECKSUM_PARTIAL &&
-+ skb_checksum_help(skb)))
-+ return qdisc_drop(skb, sch);
-
- skb->data[net_random() % skb_headlen(skb)] ^= 1<<(net_random() % 8);
- }
-diff --git a/net/sctp/input.c b/net/sctp/input.c
-index 254afea..e8e73f1 100644
---- a/net/sctp/input.c
-+++ b/net/sctp/input.c
-@@ -739,15 +739,12 @@ static void __sctp_unhash_endpoint(struct sctp_endpoint *ep)
-
- epb = &ep->base;
-
-- if (hlist_unhashed(&epb->node))
-- return;
--
- epb->hashent = sctp_ep_hashfn(epb->bind_addr.port);
-
- head = &sctp_ep_hashtable[epb->hashent];
-
- sctp_write_lock(&head->lock);
-- __hlist_del(&epb->node);
-+ hlist_del_init(&epb->node);
- sctp_write_unlock(&head->lock);
- }
-
-@@ -828,7 +825,7 @@ static void __sctp_unhash_established(struct sctp_association *asoc)
- head = &sctp_assoc_hashtable[epb->hashent];
-
- sctp_write_lock(&head->lock);
-- __hlist_del(&epb->node);
-+ hlist_del_init(&epb->node);
- sctp_write_unlock(&head->lock);
- }
-
-diff --git a/net/sctp/socket.c b/net/sctp/socket.c
-index 3a95fcb..1f9843e 100644
---- a/net/sctp/socket.c
-+++ b/net/sctp/socket.c
-@@ -1142,8 +1142,14 @@ out_free:
- SCTP_DEBUG_PRINTK("About to exit __sctp_connect() free asoc: %p"
- " kaddrs: %p err: %d\n",
- asoc, kaddrs, err);
-- if (asoc)
-+ if (asoc) {
-+ /* sctp_primitive_ASSOCIATE may have added this association
-+ * To the hash table, try to unhash it, just in case, its a noop
-+ * if it wasn't hashed so we're safe
-+ */
-+ sctp_unhash_established(asoc);
- sctp_association_free(asoc);
-+ }
- return err;
- }
-
-@@ -1851,8 +1857,10 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
- goto out_unlock;
-
- out_free:
-- if (new_asoc)
-+ if (new_asoc) {
-+ sctp_unhash_established(asoc);
- sctp_association_free(asoc);
-+ }
- out_unlock:
- sctp_release_sock(sk);
-
-diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
-index 25f7801..e3fea46 100644
---- a/net/sunrpc/cache.c
-+++ b/net/sunrpc/cache.c
-@@ -719,6 +719,8 @@ static ssize_t cache_do_downcall(char *kaddr, const char __user *buf,
- {
- ssize_t ret;
-
-+ if (count == 0)
-+ return -EINVAL;
- if (copy_from_user(kaddr, buf, count))
- return -EFAULT;
- kaddr[count] = '\0';
-diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
-index ac94477..9b3941d 100644
---- a/net/sunrpc/sched.c
-+++ b/net/sunrpc/sched.c
-@@ -485,14 +485,18 @@ EXPORT_SYMBOL_GPL(rpc_wake_up_next);
- */
- void rpc_wake_up(struct rpc_wait_queue *queue)
- {
-- struct rpc_task *task, *next;
- struct list_head *head;
-
- spin_lock_bh(&queue->lock);
- head = &queue->tasks[queue->maxpriority];
- for (;;) {
-- list_for_each_entry_safe(task, next, head, u.tk_wait.list)
-+ while (!list_empty(head)) {
-+ struct rpc_task *task;
-+ task = list_first_entry(head,
-+ struct rpc_task,
-+ u.tk_wait.list);
- rpc_wake_up_task_queue_locked(queue, task);
-+ }
- if (head == &queue->tasks[0])
- break;
- head--;
-@@ -510,13 +514,16 @@ EXPORT_SYMBOL_GPL(rpc_wake_up);
- */
- void rpc_wake_up_status(struct rpc_wait_queue *queue, int status)
- {
-- struct rpc_task *task, *next;
- struct list_head *head;
-
- spin_lock_bh(&queue->lock);
- head = &queue->tasks[queue->maxpriority];
- for (;;) {
-- list_for_each_entry_safe(task, next, head, u.tk_wait.list) {
-+ while (!list_empty(head)) {
-+ struct rpc_task *task;
-+ task = list_first_entry(head,
-+ struct rpc_task,
-+ u.tk_wait.list);
- task->tk_status = status;
- rpc_wake_up_task_queue_locked(queue, task);
- }
-diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
-index 314320a..8d72660 100644
---- a/net/sunrpc/svc_xprt.c
-+++ b/net/sunrpc/svc_xprt.c
-@@ -304,7 +304,6 @@ static void svc_thread_dequeue(struct svc_pool *pool, struct svc_rqst *rqstp)
- */
- void svc_xprt_enqueue(struct svc_xprt *xprt)
- {
-- struct svc_serv *serv = xprt->xpt_server;
- struct svc_pool *pool;
- struct svc_rqst *rqstp;
- int cpu;
-@@ -381,8 +380,6 @@ void svc_xprt_enqueue(struct svc_xprt *xprt)
- rqstp, rqstp->rq_xprt);
- rqstp->rq_xprt = xprt;
- svc_xprt_get(xprt);
-- rqstp->rq_reserved = serv->sv_max_mesg;
-- atomic_add(rqstp->rq_reserved, &xprt->xpt_reserved);
- rqstp->rq_waking = 1;
- pool->sp_nwaking++;
- pool->sp_stats.threads_woken++;
-@@ -667,8 +664,6 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
- if (xprt) {
- rqstp->rq_xprt = xprt;
- svc_xprt_get(xprt);
-- rqstp->rq_reserved = serv->sv_max_mesg;
-- atomic_add(rqstp->rq_reserved, &xprt->xpt_reserved);
- } else {
- /* No data pending. Go to sleep */
- svc_thread_enqueue(pool, rqstp);
-@@ -758,6 +753,8 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
- } else
- len = xprt->xpt_ops->xpo_recvfrom(rqstp);
- dprintk("svc: got len=%d\n", len);
-+ rqstp->rq_reserved = serv->sv_max_mesg;
-+ atomic_add(rqstp->rq_reserved, &xprt->xpt_reserved);
- }
-
- /* No data, incomplete (TCP) read, or accept() */
-@@ -811,7 +808,8 @@ int svc_send(struct svc_rqst *rqstp)
-
- /* Grab mutex to serialize outgoing data. */
- mutex_lock(&xprt->xpt_mutex);
-- if (test_bit(XPT_DEAD, &xprt->xpt_flags))
-+ if (test_bit(XPT_DEAD, &xprt->xpt_flags)
-+ || test_bit(XPT_CLOSE, &xprt->xpt_flags))
- len = -ENOTCONN;
- else
- len = xprt->xpt_ops->xpo_sendto(rqstp);
-diff --git a/net/wanrouter/wanmain.c b/net/wanrouter/wanmain.c
-index 258daa8..0d8380a 100644
---- a/net/wanrouter/wanmain.c
-+++ b/net/wanrouter/wanmain.c
-@@ -603,36 +603,31 @@ static int wanrouter_device_new_if(struct wan_device *wandev,
- * successfully, add it to the interface list.
- */
-
-- if (dev->name == NULL) {
-- err = -EINVAL;
-- } else {
-+#ifdef WANDEBUG
-+ printk(KERN_INFO "%s: registering interface %s...\n",
-+ wanrouter_modname, dev->name);
-+#endif
-
-- #ifdef WANDEBUG
-- printk(KERN_INFO "%s: registering interface %s...\n",
-- wanrouter_modname, dev->name);
-- #endif
--
-- err = register_netdev(dev);
-- if (!err) {
-- struct net_device *slave = NULL;
-- unsigned long smp_flags=0;
--
-- lock_adapter_irq(&wandev->lock, &smp_flags);
--
-- if (wandev->dev == NULL) {
-- wandev->dev = dev;
-- } else {
-- for (slave=wandev->dev;
-- DEV_TO_SLAVE(slave);
-- slave = DEV_TO_SLAVE(slave))
-- DEV_TO_SLAVE(slave) = dev;
-- }
-- ++wandev->ndev;
--
-- unlock_adapter_irq(&wandev->lock, &smp_flags);
-- err = 0; /* done !!! */
-- goto out;
-+ err = register_netdev(dev);
-+ if (!err) {
-+ struct net_device *slave = NULL;
-+ unsigned long smp_flags=0;
-+
-+ lock_adapter_irq(&wandev->lock, &smp_flags);
-+
-+ if (wandev->dev == NULL) {
-+ wandev->dev = dev;
-+ } else {
-+ for (slave=wandev->dev;
-+ DEV_TO_SLAVE(slave);
-+ slave = DEV_TO_SLAVE(slave))
-+ DEV_TO_SLAVE(slave) = dev;
- }
-+ ++wandev->ndev;
-+
-+ unlock_adapter_irq(&wandev->lock, &smp_flags);
-+ err = 0; /* done !!! */
-+ goto out;
- }
- if (wandev->del_if)
- wandev->del_if(wandev, dev);
-diff --git a/security/commoncap.c b/security/commoncap.c
-index fe30751..ee9d623 100644
---- a/security/commoncap.c
-+++ b/security/commoncap.c
-@@ -27,6 +27,7 @@
- #include <linux/sched.h>
- #include <linux/prctl.h>
- #include <linux/securebits.h>
-+#include <linux/personality.h>
-
- /*
- * If a non-root user executes a setuid-root binary in
-@@ -511,6 +512,11 @@ int cap_bprm_set_creds(struct linux_binprm *bprm)
- }
- skip:
-
-+ /* if we have fs caps, clear dangerous personality flags */
-+ if (!cap_issubset(new->cap_permitted, old->cap_permitted))
-+ bprm->per_clear |= PER_CLEAR_ON_SETID;
-+
-+
- /* Don't let someone trace a set[ug]id/setpcap binary with the revised
- * credentials unless they have the appropriate permit
- */
-diff --git a/sound/drivers/mpu401/mpu401_uart.c b/sound/drivers/mpu401/mpu401_uart.c
-index 2af0999..74f5a3d 100644
---- a/sound/drivers/mpu401/mpu401_uart.c
-+++ b/sound/drivers/mpu401/mpu401_uart.c
-@@ -554,6 +554,7 @@ int snd_mpu401_uart_new(struct snd_card *card, int device,
- spin_lock_init(&mpu->output_lock);
- spin_lock_init(&mpu->timer_lock);
- mpu->hardware = hardware;
-+ mpu->irq = -1;
- if (! (info_flags & MPU401_INFO_INTEGRATED)) {
- int res_size = hardware == MPU401_HW_PC98II ? 4 : 2;
- mpu->res = request_region(port, res_size, "MPU401 UART");
-diff --git a/sound/pci/echoaudio/echoaudio_dsp.c b/sound/pci/echoaudio/echoaudio_dsp.c
-index 4df51ef..5d14b7a 100644
---- a/sound/pci/echoaudio/echoaudio_dsp.c
-+++ b/sound/pci/echoaudio/echoaudio_dsp.c
-@@ -474,7 +474,7 @@ static int load_firmware(struct echoaudio *chip)
- const struct firmware *fw;
- int box_type, err;
-
-- if (snd_BUG_ON(!chip->dsp_code_to_load || !chip->comm_page))
-+ if (snd_BUG_ON(!chip->comm_page))
- return -EPERM;
-
- /* See if the ASIC is present and working - only if the DSP is already loaded */
-diff --git a/sound/pci/hda/hda_proc.c b/sound/pci/hda/hda_proc.c
-index 2b3d859..9294d40 100644
---- a/sound/pci/hda/hda_proc.c
-+++ b/sound/pci/hda/hda_proc.c
-@@ -340,7 +340,7 @@ static void print_digital_conv(struct snd_info_buffer *buffer,
- if (digi1 & AC_DIG1_EMPHASIS)
- snd_iprintf(buffer, " Preemphasis");
- if (digi1 & AC_DIG1_COPYRIGHT)
-- snd_iprintf(buffer, " Copyright");
-+ snd_iprintf(buffer, " Non-Copyright");
- if (digi1 & AC_DIG1_NONAUDIO)
- snd_iprintf(buffer, " Non-Audio");
- if (digi1 & AC_DIG1_PROFESSIONAL)
-diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
-index 4f3434f..82b6fdc 100644
---- a/virt/kvm/kvm_main.c
-+++ b/virt/kvm/kvm_main.c
-@@ -43,6 +43,8 @@
- #include <linux/swap.h>
- #include <linux/bitops.h>
- #include <linux/spinlock.h>
-+#include <linux/namei.h>
-+#include <linux/fs.h>
-
- #include <asm/processor.h>
- #include <asm/io.h>
-@@ -575,12 +577,76 @@ out:
- return r;
- }
-
-+/*
-+ * We want to test whether the caller has been granted permissions to
-+ * use this device. To be able to configure and control the device,
-+ * the user needs access to PCI configuration space and BAR resources.
-+ * These are accessed through PCI sysfs. PCI config space is often
-+ * passed to the process calling this ioctl via file descriptor, so we
-+ * can't rely on access to that file. We can check for permissions
-+ * on each of the BAR resource files, which is a pretty clear
-+ * indicator that the user has been granted access to the device.
-+ */
-+static int probe_sysfs_permissions(struct pci_dev *dev)
-+{
-+#ifdef CONFIG_SYSFS
-+ int i;
-+ bool bar_found = false;
-+
-+ for (i = PCI_STD_RESOURCES; i <= PCI_STD_RESOURCE_END; i++) {
-+ char *kpath, *syspath;
-+ struct path path;
-+ struct inode *inode;
-+ int r;
-+
-+ if (!pci_resource_len(dev, i))
-+ continue;
-+
-+ kpath = kobject_get_path(&dev->dev.kobj, GFP_KERNEL);
-+ if (!kpath)
-+ return -ENOMEM;
-+
-+ /* Per sysfs-rules, sysfs is always at /sys */
-+ syspath = kasprintf(GFP_KERNEL, "/sys%s/resource%d", kpath, i);
-+ kfree(kpath);
-+ if (!syspath)
-+ return -ENOMEM;
-+
-+ r = kern_path(syspath, LOOKUP_FOLLOW, &path);
-+ kfree(syspath);
-+ if (r)
-+ return r;
-+
-+ inode = path.dentry->d_inode;
-+
-+ r = inode_permission(inode, MAY_READ | MAY_WRITE | MAY_ACCESS);
-+ path_put(&path);
-+ if (r)
-+ return r;
-+
-+ bar_found = true;
-+ }
-+
-+ /* If no resources, probably something special */
-+ if (!bar_found)
-+ return -EPERM;
-+
-+ return 0;
-+#else
-+ return -EINVAL; /* No way to control the device without sysfs */
-+#endif
-+}
-+
- static int kvm_vm_ioctl_assign_device(struct kvm *kvm,
- struct kvm_assigned_pci_dev *assigned_dev)
- {
- int r = 0;
- struct kvm_assigned_dev_kernel *match;
- struct pci_dev *dev;
-+ u8 header_type;
-+
-+ if (!(assigned_dev->flags & KVM_DEV_ASSIGN_ENABLE_IOMMU))
-+ return -EINVAL;
-
- down_read(&kvm->slots_lock);
- mutex_lock(&kvm->lock);
-@@ -607,6 +673,18 @@ static int kvm_vm_ioctl_assign_device(struct kvm *kvm,
- r = -EINVAL;
- goto out_free;
- }
-+
-+ /* Don't allow bridges to be assigned */
-+ pci_read_config_byte(dev, PCI_HEADER_TYPE, &header_type);
-+ if ((header_type & PCI_HEADER_TYPE) != PCI_HEADER_TYPE_NORMAL) {
-+ r = -EPERM;
-+ goto out_put;
-+ }
-+
-+ r = probe_sysfs_permissions(dev);
-+ if (r)
-+ goto out_put;
-+
- if (pci_enable_device(dev)) {
- printk(KERN_INFO "%s: Could not enable PCI device\n", __func__);
- r = -EBUSY;
-@@ -635,16 +713,14 @@ static int kvm_vm_ioctl_assign_device(struct kvm *kvm,
-
- list_add(&match->list, &kvm->arch.assigned_dev_head);
-
-- if (assigned_dev->flags & KVM_DEV_ASSIGN_ENABLE_IOMMU) {
-- if (!kvm->arch.iommu_domain) {
-- r = kvm_iommu_map_guest(kvm);
-- if (r)
-- goto out_list_del;
-- }
-- r = kvm_assign_device(kvm, match);
-+ if (!kvm->arch.iommu_domain) {
-+ r = kvm_iommu_map_guest(kvm);
- if (r)
- goto out_list_del;
- }
-+ r = kvm_assign_device(kvm, match);
-+ if (r)
-+ goto out_list_del;
-
- out:
- mutex_unlock(&kvm->lock);
-@@ -683,8 +759,7 @@ static int kvm_vm_ioctl_deassign_device(struct kvm *kvm,
- goto out;
- }
-
-- if (match->flags & KVM_DEV_ASSIGN_ENABLE_IOMMU)
-- kvm_deassign_device(kvm, match);
-+ kvm_deassign_device(kvm, match);
-
- kvm_free_assigned_device(kvm, match);
-
-@@ -1782,6 +1857,10 @@ static int kvm_vm_ioctl_create_vcpu(struct kvm *kvm, u32 id)
- return r;
-
- mutex_lock(&kvm->lock);
-+ if (!kvm_vcpu_compatible(vcpu)) {
-+ r = -EINVAL;
-+ goto vcpu_destroy;
-+ }
- if (atomic_read(&kvm->online_vcpus) == KVM_MAX_VCPUS) {
- r = -EINVAL;
- goto vcpu_destroy;
diff --git a/2.6.32/1060_linux-2.6.32.61.patch b/2.6.32/1060_linux-2.6.32.61.patch
deleted file mode 100644
index 4c65031..0000000
--- a/2.6.32/1060_linux-2.6.32.61.patch
+++ /dev/null
@@ -1,7137 +0,0 @@
-diff --git a/arch/alpha/kernel/sys_nautilus.c b/arch/alpha/kernel/sys_nautilus.c
-index 99c0f46..dc616b3 100644
---- a/arch/alpha/kernel/sys_nautilus.c
-+++ b/arch/alpha/kernel/sys_nautilus.c
-@@ -189,6 +189,10 @@ nautilus_machine_check(unsigned long vector, unsigned long la_ptr)
- extern void free_reserved_mem(void *, void *);
- extern void pcibios_claim_one_bus(struct pci_bus *);
-
-+static struct resource irongate_io = {
-+ .name = "Irongate PCI IO",
-+ .flags = IORESOURCE_IO,
-+};
- static struct resource irongate_mem = {
- .name = "Irongate PCI MEM",
- .flags = IORESOURCE_MEM,
-@@ -210,6 +214,7 @@ nautilus_init_pci(void)
-
- irongate = pci_get_bus_and_slot(0, 0);
- bus->self = irongate;
-+ bus->resource[0] = &irongate_io;
- bus->resource[1] = &irongate_mem;
-
- pci_bus_size_bridges(bus);
-diff --git a/arch/arm/include/asm/signal.h b/arch/arm/include/asm/signal.h
-index 43ba0fb..559ee24 100644
---- a/arch/arm/include/asm/signal.h
-+++ b/arch/arm/include/asm/signal.h
-@@ -127,6 +127,7 @@ struct sigaction {
- __sigrestore_t sa_restorer;
- sigset_t sa_mask; /* mask last for extensibility */
- };
-+#define __ARCH_HAS_SA_RESTORER
-
- struct k_sigaction {
- struct sigaction sa;
-diff --git a/arch/avr32/include/asm/signal.h b/arch/avr32/include/asm/signal.h
-index 8790dfc..e6952a0 100644
---- a/arch/avr32/include/asm/signal.h
-+++ b/arch/avr32/include/asm/signal.h
-@@ -128,6 +128,7 @@ struct sigaction {
- __sigrestore_t sa_restorer;
- sigset_t sa_mask; /* mask last for extensibility */
- };
-+#define __ARCH_HAS_SA_RESTORER
-
- struct k_sigaction {
- struct sigaction sa;
-diff --git a/arch/cris/include/asm/signal.h b/arch/cris/include/asm/signal.h
-index ea6af9a..057fea2 100644
---- a/arch/cris/include/asm/signal.h
-+++ b/arch/cris/include/asm/signal.h
-@@ -122,6 +122,7 @@ struct sigaction {
- void (*sa_restorer)(void);
- sigset_t sa_mask; /* mask last for extensibility */
- };
-+#define __ARCH_HAS_SA_RESTORER
-
- struct k_sigaction {
- struct sigaction sa;
-diff --git a/arch/h8300/include/asm/signal.h b/arch/h8300/include/asm/signal.h
-index fd8b66e..8695707 100644
---- a/arch/h8300/include/asm/signal.h
-+++ b/arch/h8300/include/asm/signal.h
-@@ -121,6 +121,7 @@ struct sigaction {
- void (*sa_restorer)(void);
- sigset_t sa_mask; /* mask last for extensibility */
- };
-+#define __ARCH_HAS_SA_RESTORER
-
- struct k_sigaction {
- struct sigaction sa;
-diff --git a/arch/m32r/include/asm/signal.h b/arch/m32r/include/asm/signal.h
-index 9c1acb2..a96a9f4 100644
---- a/arch/m32r/include/asm/signal.h
-+++ b/arch/m32r/include/asm/signal.h
-@@ -123,6 +123,7 @@ struct sigaction {
- __sigrestore_t sa_restorer;
- sigset_t sa_mask; /* mask last for extensibility */
- };
-+#define __ARCH_HAS_SA_RESTORER
-
- struct k_sigaction {
- struct sigaction sa;
-diff --git a/arch/m68k/include/asm/signal.h b/arch/m68k/include/asm/signal.h
-index 5bc09c7..01a492a 100644
---- a/arch/m68k/include/asm/signal.h
-+++ b/arch/m68k/include/asm/signal.h
-@@ -119,6 +119,7 @@ struct sigaction {
- __sigrestore_t sa_restorer;
- sigset_t sa_mask; /* mask last for extensibility */
- };
-+#define __ARCH_HAS_SA_RESTORER
-
- struct k_sigaction {
- struct sigaction sa;
-diff --git a/arch/mips/Makefile b/arch/mips/Makefile
-index 77f5021..57ff855 100644
---- a/arch/mips/Makefile
-+++ b/arch/mips/Makefile
-@@ -657,7 +657,7 @@ KBUILD_CPPFLAGS += -D"DATAOFFSET=$(if $(dataoffset-y),$(dataoffset-y),0)"
- LDFLAGS += -m $(ld-emul)
-
- ifdef CONFIG_MIPS
--CHECKFLAGS += $(shell $(CC) $(KBUILD_CFLAGS) -dM -E -xc /dev/null | \
-+CHECKFLAGS += $(shell $(CC) $(KBUILD_CFLAGS) -dM -E -x c /dev/null | \
- egrep -vw '__GNUC_(|MINOR_|PATCHLEVEL_)_' | \
- sed -e 's/^\#define /-D/' -e "s/ /='/" -e "s/$$/'/")
- ifdef CONFIG_64BIT
-diff --git a/arch/mips/kernel/Makefile b/arch/mips/kernel/Makefile
-index eecd2a9..700dc14 100644
---- a/arch/mips/kernel/Makefile
-+++ b/arch/mips/kernel/Makefile
-@@ -88,7 +88,7 @@ obj-$(CONFIG_GPIO_TXX9) += gpio_txx9.o
- obj-$(CONFIG_KEXEC) += machine_kexec.o relocate_kernel.o
- obj-$(CONFIG_EARLY_PRINTK) += early_printk.o
-
--CFLAGS_cpu-bugs64.o = $(shell if $(CC) $(KBUILD_CFLAGS) -Wa,-mdaddi -c -o /dev/null -xc /dev/null >/dev/null 2>&1; then echo "-DHAVE_AS_SET_DADDI"; fi)
-+CFLAGS_cpu-bugs64.o = $(shell if $(CC) $(KBUILD_CFLAGS) -Wa,-mdaddi -c -o /dev/null -x c /dev/null >/dev/null 2>&1; then echo "-DHAVE_AS_SET_DADDI"; fi)
-
- obj-$(CONFIG_HAVE_STD_PC_SERIAL_PORT) += 8250-platform.o
-
-diff --git a/arch/mn10300/include/asm/signal.h b/arch/mn10300/include/asm/signal.h
-index 7e891fc..045d6a2 100644
---- a/arch/mn10300/include/asm/signal.h
-+++ b/arch/mn10300/include/asm/signal.h
-@@ -131,6 +131,7 @@ struct sigaction {
- __sigrestore_t sa_restorer;
- sigset_t sa_mask; /* mask last for extensibility */
- };
-+#define __ARCH_HAS_SA_RESTORER
-
- struct k_sigaction {
- struct sigaction sa;
-diff --git a/arch/parisc/kernel/signal32.c b/arch/parisc/kernel/signal32.c
-index fb59852..32d43e7 100644
---- a/arch/parisc/kernel/signal32.c
-+++ b/arch/parisc/kernel/signal32.c
-@@ -68,7 +68,8 @@ put_sigset32(compat_sigset_t __user *up, sigset_t *set, size_t sz)
- {
- compat_sigset_t s;
-
-- if (sz != sizeof *set) panic("put_sigset32()");
-+ if (sz != sizeof *set)
-+ return -EINVAL;
- sigset_64to32(&s, set);
-
- return copy_to_user(up, &s, sizeof s);
-@@ -80,7 +81,8 @@ get_sigset32(compat_sigset_t __user *up, sigset_t *set, size_t sz)
- compat_sigset_t s;
- int r;
-
-- if (sz != sizeof *set) panic("put_sigset32()");
-+ if (sz != sizeof *set)
-+ return -EINVAL;
-
- if ((r = copy_from_user(&s, up, sz)) == 0) {
- sigset_32to64(set, &s);
-diff --git a/arch/powerpc/include/asm/signal.h b/arch/powerpc/include/asm/signal.h
-index 3eb13be..ec63a0a 100644
---- a/arch/powerpc/include/asm/signal.h
-+++ b/arch/powerpc/include/asm/signal.h
-@@ -109,6 +109,7 @@ struct sigaction {
- __sigrestore_t sa_restorer;
- sigset_t sa_mask; /* mask last for extensibility */
- };
-+#define __ARCH_HAS_SA_RESTORER
-
- struct k_sigaction {
- struct sigaction sa;
-diff --git a/arch/s390/include/asm/signal.h b/arch/s390/include/asm/signal.h
-index cdf5cb2..c872626 100644
---- a/arch/s390/include/asm/signal.h
-+++ b/arch/s390/include/asm/signal.h
-@@ -131,6 +131,7 @@ struct sigaction {
- void (*sa_restorer)(void);
- sigset_t sa_mask; /* mask last for extensibility */
- };
-+#define __ARCH_HAS_SA_RESTORER
-
- struct k_sigaction {
- struct sigaction sa;
-diff --git a/arch/sparc/include/asm/signal.h b/arch/sparc/include/asm/signal.h
-index e49b828..4929431 100644
---- a/arch/sparc/include/asm/signal.h
-+++ b/arch/sparc/include/asm/signal.h
-@@ -191,6 +191,7 @@ struct __old_sigaction {
- unsigned long sa_flags;
- void (*sa_restorer)(void); /* not used by Linux/SPARC yet */
- };
-+#define __ARCH_HAS_SA_RESTORER
-
- typedef struct sigaltstack {
- void __user *ss_sp;
-diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
-index aa889d6..ee0168d 100644
---- a/arch/x86/Kconfig
-+++ b/arch/x86/Kconfig
-@@ -1430,7 +1430,7 @@ config ARCH_USES_PG_UNCACHED
-
- config ARCH_RANDOM
- def_bool y
-- prompt "x86 architectural random number generator" if EXPERT
-+ prompt "x86 architectural random number generator" if EMBEDDED
- ---help---
- Enable the x86 architectural RDRAND instruction
- (Intel Bull Mountain technology) to generate random numbers.
-diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
-index af6fd36..1cce9d2 100644
---- a/arch/x86/include/asm/pgtable.h
-+++ b/arch/x86/include/asm/pgtable.h
-@@ -130,6 +130,11 @@ static inline unsigned long pmd_pfn(pmd_t pmd)
- return (pmd_val(pmd) & PTE_PFN_MASK) >> PAGE_SHIFT;
- }
-
-+static inline unsigned long pud_pfn(pud_t pud)
-+{
-+ return (pud_val(pud) & PTE_PFN_MASK) >> PAGE_SHIFT;
-+}
-+
- #define pte_page(pte) pfn_to_page(pte_pfn(pte))
-
- static inline int pmd_large(pmd_t pte)
-diff --git a/arch/x86/include/asm/ptrace.h b/arch/x86/include/asm/ptrace.h
-index 0f0d908..e668d72 100644
---- a/arch/x86/include/asm/ptrace.h
-+++ b/arch/x86/include/asm/ptrace.h
-@@ -2,6 +2,7 @@
- #define _ASM_X86_PTRACE_H
-
- #include <linux/compiler.h> /* For __user */
-+#include <linux/linkage.h> /* For asmregparm */
- #include <asm/ptrace-abi.h>
- #include <asm/processor-flags.h>
-
-@@ -142,8 +143,8 @@ extern void send_sigtrap(struct task_struct *tsk, struct pt_regs *regs,
- int error_code, int si_code);
- void signal_fault(struct pt_regs *regs, void __user *frame, char *where);
-
--extern long syscall_trace_enter(struct pt_regs *);
--extern void syscall_trace_leave(struct pt_regs *);
-+extern asmregparm long syscall_trace_enter(struct pt_regs *);
-+extern asmregparm void syscall_trace_leave(struct pt_regs *);
-
- static inline unsigned long regs_return_value(struct pt_regs *regs)
- {
-diff --git a/arch/x86/include/asm/signal.h b/arch/x86/include/asm/signal.h
-index 598457c..6cbc795 100644
---- a/arch/x86/include/asm/signal.h
-+++ b/arch/x86/include/asm/signal.h
-@@ -125,6 +125,8 @@ typedef unsigned long sigset_t;
- extern void do_notify_resume(struct pt_regs *, void *, __u32);
- # endif /* __KERNEL__ */
-
-+#define __ARCH_HAS_SA_RESTORER
-+
- #ifdef __i386__
- # ifdef __KERNEL__
- struct old_sigaction {
-diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
-index 8928d97..d256bc3 100644
---- a/arch/x86/kernel/apic/io_apic.c
-+++ b/arch/x86/kernel/apic/io_apic.c
-@@ -4262,6 +4262,7 @@ static int bad_ioapic(unsigned long address)
- void __init mp_register_ioapic(int id, u32 address, u32 gsi_base)
- {
- int idx = 0;
-+ int entries;
-
- if (bad_ioapic(address))
- return;
-@@ -4280,10 +4281,14 @@ void __init mp_register_ioapic(int id, u32 address, u32 gsi_base)
- * Build basic GSI lookup table to facilitate gsi->io_apic lookups
- * and to prevent reprogramming of IOAPIC pins (PCI GSIs).
- */
-+ entries = io_apic_get_redir_entries(idx);
- mp_gsi_routing[idx].gsi_base = gsi_base;
-- mp_gsi_routing[idx].gsi_end = gsi_base +
-- io_apic_get_redir_entries(idx);
-+ mp_gsi_routing[idx].gsi_end = gsi_base + entries;
-
-+ /*
-+ * The number of IO-APIC IRQ registers (== #pins):
-+ */
-+ nr_ioapic_registers[idx] = entries + 1;
- printk(KERN_INFO "IOAPIC[%d]: apic_id %d, version %d, address 0x%x, "
- "GSI %d-%d\n", idx, mp_ioapics[idx].apicid,
- mp_ioapics[idx].apicver, mp_ioapics[idx].apicaddr,
-diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
-index 0f16a2b..28a7e4c8 100644
---- a/arch/x86/kernel/cpu/mcheck/mce.c
-+++ b/arch/x86/kernel/cpu/mcheck/mce.c
-@@ -431,6 +431,13 @@ static inline void mce_get_rip(struct mce *m, struct pt_regs *regs)
- if (regs && (m->mcgstatus & (MCG_STATUS_RIPV|MCG_STATUS_EIPV))) {
- m->ip = regs->ip;
- m->cs = regs->cs;
-+ /*
-+ * When in VM86 mode make the cs look like ring 3
-+ * always. This is a lie, but it's better than passing
-+ * the additional vm86 bit around everywhere.
-+ */
-+ if (v8086_mode(regs))
-+ m->cs |= 3;
- } else {
- m->ip = 0;
- m->cs = 0;
-@@ -968,6 +975,7 @@ void do_machine_check(struct pt_regs *regs, long error_code)
- */
- add_taint(TAINT_MACHINE_CHECK);
-
-+ mce_get_rip(&m, regs);
- severity = mce_severity(&m, tolerant, NULL);
-
- /*
-@@ -1006,7 +1014,6 @@ void do_machine_check(struct pt_regs *regs, long error_code)
- if (severity == MCE_AO_SEVERITY && mce_usable_address(&m))
- mce_ring_add(m.addr >> PAGE_SHIFT);
-
-- mce_get_rip(&m, regs);
- mce_log(&m);
-
- if (severity > worst) {
-diff --git a/arch/x86/kernel/efi.c b/arch/x86/kernel/efi.c
-index cdcfb12..a3e77af 100644
---- a/arch/x86/kernel/efi.c
-+++ b/arch/x86/kernel/efi.c
-@@ -459,9 +459,6 @@ void __init efi_init(void)
- x86_platform.set_wallclock = efi_set_rtc_mmss;
- #endif
-
-- /* Setup for EFI runtime service */
-- reboot_type = BOOT_EFI;
--
- #if EFI_DEBUG
- print_efi_memmap();
- #endif
-diff --git a/arch/x86/kernel/msr.c b/arch/x86/kernel/msr.c
-index 5eaeb5e..63a053b 100644
---- a/arch/x86/kernel/msr.c
-+++ b/arch/x86/kernel/msr.c
-@@ -176,6 +176,9 @@ static int msr_open(struct inode *inode, struct file *file)
- struct cpuinfo_x86 *c = &cpu_data(cpu);
- int ret = 0;
-
-+ if (!capable(CAP_SYS_RAWIO))
-+ return -EPERM;
-+
- lock_kernel();
- cpu = iminor(file->f_path.dentry->d_inode);
-
-diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index 271fddf..cdee77e 100644
---- a/arch/x86/kvm/x86.c
-+++ b/arch/x86/kvm/x86.c
-@@ -925,6 +925,12 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, u32 msr, u64 data)
- /* ...but clean it before doing the actual write */
- vcpu->arch.time_offset = data & ~(PAGE_MASK | 1);
-
-+ /* Check that address+len does not cross page boundary */
-+ if ((vcpu->arch.time_offset +
-+ sizeof(struct pvclock_vcpu_time_info) - 1)
-+ & PAGE_MASK)
-+ break;
-+
- vcpu->arch.time_page =
- gfn_to_page(vcpu->kvm, data >> PAGE_SHIFT);
-
-@@ -4713,6 +4719,9 @@ int kvm_arch_vcpu_ioctl_set_sregs(struct kvm_vcpu *vcpu,
- int pending_vec, max_bits;
- struct descriptor_table dt;
-
-+ if (sregs->cr4 & X86_CR4_OSXSAVE)
-+ return -EINVAL;
-+
- vcpu_load(vcpu);
-
- dt.limit = sregs->idt.limit;
-diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
-index 249ad57..df87450 100644
---- a/arch/x86/mm/fault.c
-+++ b/arch/x86/mm/fault.c
-@@ -376,10 +376,12 @@ static noinline int vmalloc_fault(unsigned long address)
- if (pgd_none(*pgd_ref))
- return -1;
-
-- if (pgd_none(*pgd))
-+ if (pgd_none(*pgd)) {
- set_pgd(pgd, *pgd_ref);
-- else
-+ arch_flush_lazy_mmu_mode();
-+ } else {
- BUG_ON(pgd_page_vaddr(*pgd) != pgd_page_vaddr(*pgd_ref));
-+ }
-
- /*
- * Below here mismatches are bugs because these lower tables
-diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
-index 7d095ad..ccbc61b 100644
---- a/arch/x86/mm/init_64.c
-+++ b/arch/x86/mm/init_64.c
-@@ -839,6 +839,9 @@ int kern_addr_valid(unsigned long addr)
- if (pud_none(*pud))
- return 0;
-
-+ if (pud_large(*pud))
-+ return pfn_valid(pud_pfn(*pud));
-+
- pmd = pmd_offset(pud, addr);
- if (pmd_none(*pmd))
- return 0;
-diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
-index d52f895..126a093 100644
---- a/arch/x86/xen/enlighten.c
-+++ b/arch/x86/xen/enlighten.c
-@@ -776,7 +776,16 @@ static void xen_write_cr4(unsigned long cr4)
-
- native_write_cr4(cr4);
- }
--
-+#ifdef CONFIG_X86_64
-+static inline unsigned long xen_read_cr8(void)
-+{
-+ return 0;
-+}
-+static inline void xen_write_cr8(unsigned long val)
-+{
-+ BUG_ON(val);
-+}
-+#endif
- static int xen_write_msr_safe(unsigned int msr, unsigned low, unsigned high)
- {
- int ret;
-@@ -942,6 +951,11 @@ static const struct pv_cpu_ops xen_cpu_ops __initdata = {
- .read_cr4_safe = native_read_cr4_safe,
- .write_cr4 = xen_write_cr4,
-
-+#ifdef CONFIG_X86_64
-+ .read_cr8 = xen_read_cr8,
-+ .write_cr8 = xen_write_cr8,
-+#endif
-+
- .wbinvd = native_wbinvd,
-
- .read_msr = native_read_msr_safe,
-@@ -952,6 +966,8 @@ static const struct pv_cpu_ops xen_cpu_ops __initdata = {
- .read_tsc = native_read_tsc,
- .read_pmc = native_read_pmc,
-
-+ .read_tscp = native_read_tscp,
-+
- .iret = xen_iret,
- .irq_enable_sysexit = xen_sysexit,
- #ifdef CONFIG_X86_64
-diff --git a/arch/x86/xen/xen-asm_32.S b/arch/x86/xen/xen-asm_32.S
-index 9a95a9c..d05bd11 100644
---- a/arch/x86/xen/xen-asm_32.S
-+++ b/arch/x86/xen/xen-asm_32.S
-@@ -88,11 +88,11 @@ ENTRY(xen_iret)
- */
- #ifdef CONFIG_SMP
- GET_THREAD_INFO(%eax)
-- movl TI_cpu(%eax), %eax
-- movl __per_cpu_offset(,%eax,4), %eax
-- mov per_cpu__xen_vcpu(%eax), %eax
-+ movl %ss:TI_cpu(%eax), %eax
-+ movl %ss:__per_cpu_offset(,%eax,4), %eax
-+ mov %ss:per_cpu__xen_vcpu(%eax), %eax
- #else
-- movl per_cpu__xen_vcpu, %eax
-+ movl %ss:per_cpu__xen_vcpu, %eax
- #endif
-
- /* check IF state we're restoring */
-@@ -105,11 +105,11 @@ ENTRY(xen_iret)
- * resuming the code, so we don't have to be worried about
- * being preempted to another CPU.
- */
-- setz XEN_vcpu_info_mask(%eax)
-+ setz %ss:XEN_vcpu_info_mask(%eax)
- xen_iret_start_crit:
-
- /* check for unmasked and pending */
-- cmpw $0x0001, XEN_vcpu_info_pending(%eax)
-+ cmpw $0x0001, %ss:XEN_vcpu_info_pending(%eax)
-
- /*
- * If there's something pending, mask events again so we can
-@@ -117,7 +117,7 @@ xen_iret_start_crit:
- * touch XEN_vcpu_info_mask.
- */
- jne 1f
-- movb $1, XEN_vcpu_info_mask(%eax)
-+ movb $1, %ss:XEN_vcpu_info_mask(%eax)
-
- 1: popl %eax
-
-diff --git a/arch/xtensa/include/asm/signal.h b/arch/xtensa/include/asm/signal.h
-index 633ba73..75edf8a 100644
---- a/arch/xtensa/include/asm/signal.h
-+++ b/arch/xtensa/include/asm/signal.h
-@@ -133,6 +133,7 @@ struct sigaction {
- void (*sa_restorer)(void);
- sigset_t sa_mask; /* mask last for extensibility */
- };
-+#define __ARCH_HAS_SA_RESTORER
-
- struct k_sigaction {
- struct sigaction sa;
-diff --git a/block/blk-core.c b/block/blk-core.c
-index cffd737..4058f46 100644
---- a/block/blk-core.c
-+++ b/block/blk-core.c
-@@ -865,6 +865,9 @@ struct request *blk_get_request(struct request_queue *q, int rw, gfp_t gfp_mask)
- {
- struct request *rq;
-
-+ if (unlikely(test_bit(QUEUE_FLAG_DEAD, &q->queue_flags)))
-+ return NULL;
-+
- BUG_ON(rw != READ && rw != WRITE);
-
- spin_lock_irq(q->queue_lock);
-@@ -1149,7 +1152,7 @@ void init_request_from_bio(struct request *req, struct bio *bio)
- */
- static inline bool queue_should_plug(struct request_queue *q)
- {
-- return !(blk_queue_nonrot(q) && blk_queue_queuing(q));
-+ return !(blk_queue_nonrot(q) && blk_queue_tagged(q));
- }
-
- static int __make_request(struct request_queue *q, struct bio *bio)
-@@ -1861,15 +1864,8 @@ void blk_dequeue_request(struct request *rq)
- * and to it is freed is accounted as io that is in progress at
- * the driver side.
- */
-- if (blk_account_rq(rq)) {
-+ if (blk_account_rq(rq))
- q->in_flight[rq_is_sync(rq)]++;
-- /*
-- * Mark this device as supporting hardware queuing, if
-- * we have more IOs in flight than 4.
-- */
-- if (!blk_queue_queuing(q) && queue_in_flight(q) > 4)
-- set_bit(QUEUE_FLAG_CQ, &q->queue_flags);
-- }
- }
-
- /**
-diff --git a/block/blk-exec.c b/block/blk-exec.c
-index 49557e9..85bd7b4 100644
---- a/block/blk-exec.c
-+++ b/block/blk-exec.c
-@@ -50,6 +50,13 @@ void blk_execute_rq_nowait(struct request_queue *q, struct gendisk *bd_disk,
- {
- int where = at_head ? ELEVATOR_INSERT_FRONT : ELEVATOR_INSERT_BACK;
-
-+ if (unlikely(test_bit(QUEUE_FLAG_DEAD, &q->queue_flags))) {
-+ rq->errors = -ENXIO;
-+ if (rq->end_io)
-+ rq->end_io(rq, rq->errors);
-+ return;
-+ }
-+
- rq->rq_disk = bd_disk;
- rq->end_io = done;
- WARN_ON(irqs_disabled());
-diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
-index 2be0a97..123eb17 100644
---- a/block/scsi_ioctl.c
-+++ b/block/scsi_ioctl.c
-@@ -720,11 +720,14 @@ int scsi_verify_blk_ioctl(struct block_device *bd, unsigned int cmd)
- break;
- }
-
-+ if (capable(CAP_SYS_RAWIO))
-+ return 0;
-+
- /* In particular, rule out all resets and host-specific ioctls. */
- printk_ratelimited(KERN_WARNING
- "%s: sending ioctl %x to a partition!\n", current->comm, cmd);
-
-- return capable(CAP_SYS_RAWIO) ? 0 : -ENOTTY;
-+ return -ENOTTY;
- }
- EXPORT_SYMBOL(scsi_verify_blk_ioctl);
-
-diff --git a/crypto/cryptd.c b/crypto/cryptd.c
-index 3533582..9e1bf69 100644
---- a/crypto/cryptd.c
-+++ b/crypto/cryptd.c
-@@ -116,13 +116,18 @@ static void cryptd_queue_worker(struct work_struct *work)
- struct crypto_async_request *req, *backlog;
-
- cpu_queue = container_of(work, struct cryptd_cpu_queue, work);
-- /* Only handle one request at a time to avoid hogging crypto
-- * workqueue. preempt_disable/enable is used to prevent
-- * being preempted by cryptd_enqueue_request() */
-+ /*
-+ * Only handle one request at a time to avoid hogging crypto workqueue.
-+ * preempt_disable/enable is used to prevent being preempted by
-+ * cryptd_enqueue_request(). local_bh_disable/enable is used to prevent
-+ * cryptd_enqueue_request() being accessed from software interrupts.
-+ */
-+ local_bh_disable();
- preempt_disable();
- backlog = crypto_get_backlog(&cpu_queue->queue);
- req = crypto_dequeue_request(&cpu_queue->queue);
- preempt_enable();
-+ local_bh_enable();
-
- if (!req)
- return;
-diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
-index a6ad608..70e9ed1 100644
---- a/drivers/acpi/processor_idle.c
-+++ b/drivers/acpi/processor_idle.c
-@@ -1071,6 +1071,9 @@ static int acpi_processor_setup_cpuidle(struct acpi_processor *pr)
- return -EINVAL;
- }
-
-+ if (!dev)
-+ return -EINVAL;
-+
- dev->cpu = pr->id;
- for (i = 0; i < CPUIDLE_STATE_MAX; i++) {
- dev->states[i].name[0] = '\0';
-diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
-index 553edcc..57e895a1 100644
---- a/drivers/ata/libata-scsi.c
-+++ b/drivers/ata/libata-scsi.c
-@@ -338,7 +338,8 @@ ata_scsi_activity_show(struct device *dev, struct device_attribute *attr,
- struct ata_port *ap = ata_shost_to_port(sdev->host);
- struct ata_device *atadev = ata_scsi_find_dev(ap, sdev);
-
-- if (ap->ops->sw_activity_show && (ap->flags & ATA_FLAG_SW_ACTIVITY))
-+ if (atadev && ap->ops->sw_activity_show &&
-+ (ap->flags & ATA_FLAG_SW_ACTIVITY))
- return ap->ops->sw_activity_show(atadev, buf);
- return -EINVAL;
- }
-@@ -353,7 +354,8 @@ ata_scsi_activity_store(struct device *dev, struct device_attribute *attr,
- enum sw_activity val;
- int rc;
-
-- if (ap->ops->sw_activity_store && (ap->flags & ATA_FLAG_SW_ACTIVITY)) {
-+ if (atadev && ap->ops->sw_activity_store &&
-+ (ap->flags & ATA_FLAG_SW_ACTIVITY)) {
- val = simple_strtoul(buf, NULL, 0);
- switch (val) {
- case OFF: case BLINK_ON: case BLINK_OFF:
-diff --git a/drivers/base/bus.c b/drivers/base/bus.c
-index 63c143e..6f1ba10 100644
---- a/drivers/base/bus.c
-+++ b/drivers/base/bus.c
-@@ -289,7 +289,7 @@ int bus_for_each_dev(struct bus_type *bus, struct device *start,
- struct device *dev;
- int error = 0;
-
-- if (!bus)
-+ if (!bus || !bus->p)
- return -EINVAL;
-
- klist_iter_init_node(&bus->p->klist_devices, &i,
-@@ -323,7 +323,7 @@ struct device *bus_find_device(struct bus_type *bus,
- struct klist_iter i;
- struct device *dev;
-
-- if (!bus)
-+ if (!bus || !bus->p)
- return NULL;
-
- klist_iter_init_node(&bus->p->klist_devices, &i,
-diff --git a/drivers/char/ipmi/ipmi_bt_sm.c b/drivers/char/ipmi/ipmi_bt_sm.c
-index 7b98c06..a65a574 100644
---- a/drivers/char/ipmi/ipmi_bt_sm.c
-+++ b/drivers/char/ipmi/ipmi_bt_sm.c
-@@ -95,9 +95,9 @@ struct si_sm_data {
- enum bt_states state;
- unsigned char seq; /* BT sequence number */
- struct si_sm_io *io;
-- unsigned char write_data[IPMI_MAX_MSG_LENGTH];
-+ unsigned char write_data[IPMI_MAX_MSG_LENGTH + 2]; /* +2 for memcpy */
- int write_count;
-- unsigned char read_data[IPMI_MAX_MSG_LENGTH];
-+ unsigned char read_data[IPMI_MAX_MSG_LENGTH + 2]; /* +2 for memcpy */
- int read_count;
- int truncated;
- long timeout; /* microseconds countdown */
-diff --git a/drivers/firmware/pcdp.c b/drivers/firmware/pcdp.c
-index a330492..51e0e2d 100644
---- a/drivers/firmware/pcdp.c
-+++ b/drivers/firmware/pcdp.c
-@@ -95,7 +95,7 @@ efi_setup_pcdp_console(char *cmdline)
- if (efi.hcdp == EFI_INVALID_TABLE_ADDR)
- return -ENODEV;
-
-- pcdp = early_ioremap(efi.hcdp, 4096);
-+ pcdp = ioremap(efi.hcdp, 4096);
- printk(KERN_INFO "PCDP: v%d at 0x%lx\n", pcdp->rev, efi.hcdp);
-
- if (strstr(cmdline, "console=hcdp")) {
-@@ -131,6 +131,6 @@ efi_setup_pcdp_console(char *cmdline)
- }
-
- out:
-- early_iounmap(pcdp, 4096);
-+ iounmap(pcdp);
- return rc;
- }
-diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
-index b4b2257..f6a23ec 100644
---- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
-+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
-@@ -157,7 +157,7 @@ static int ipoib_stop(struct net_device *dev)
-
- netif_stop_queue(dev);
-
-- ipoib_ib_dev_down(dev, 0);
-+ ipoib_ib_dev_down(dev, 1);
- ipoib_ib_dev_stop(dev, 0);
-
- if (!test_bit(IPOIB_FLAG_SUBINTERFACE, &priv->flags)) {
-diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
-index 8763c1e..bd656a7 100644
---- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
-+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
-@@ -188,7 +188,9 @@ static int ipoib_mcast_join_finish(struct ipoib_mcast *mcast,
-
- mcast->mcmember = *mcmember;
-
-- /* Set the cached Q_Key before we attach if it's the broadcast group */
-+ /* Set the multicast MTU and cached Q_Key before we attach if it's
-+ * the broadcast group.
-+ */
- if (!memcmp(mcast->mcmember.mgid.raw, priv->dev->broadcast + 4,
- sizeof (union ib_gid))) {
- spin_lock_irq(&priv->lock);
-@@ -196,10 +198,17 @@ static int ipoib_mcast_join_finish(struct ipoib_mcast *mcast,
- spin_unlock_irq(&priv->lock);
- return -EAGAIN;
- }
-+ priv->mcast_mtu = IPOIB_UD_MTU(ib_mtu_enum_to_int(priv->broadcast->mcmember.mtu));
- priv->qkey = be32_to_cpu(priv->broadcast->mcmember.qkey);
- spin_unlock_irq(&priv->lock);
- priv->tx_wr.wr.ud.remote_qkey = priv->qkey;
- set_qkey = 1;
-+
-+ if (!ipoib_cm_admin_enabled(dev)) {
-+ rtnl_lock();
-+ dev_set_mtu(dev, min(priv->mcast_mtu, priv->admin_mtu));
-+ rtnl_unlock();
-+ }
- }
-
- if (!test_bit(IPOIB_MCAST_FLAG_SENDONLY, &mcast->flags)) {
-@@ -588,14 +597,6 @@ void ipoib_mcast_join_task(struct work_struct *work)
- return;
- }
-
-- priv->mcast_mtu = IPOIB_UD_MTU(ib_mtu_enum_to_int(priv->broadcast->mcmember.mtu));
--
-- if (!ipoib_cm_admin_enabled(dev)) {
-- rtnl_lock();
-- dev_set_mtu(dev, min(priv->mcast_mtu, priv->admin_mtu));
-- rtnl_unlock();
-- }
--
- ipoib_dbg_mcast(priv, "successfully joined all multicast groups\n");
-
- clear_bit(IPOIB_MCAST_RUN, &priv->flags);
-diff --git a/drivers/isdn/isdnloop/isdnloop.c b/drivers/isdn/isdnloop/isdnloop.c
-index a335c85..22446f7 100644
---- a/drivers/isdn/isdnloop/isdnloop.c
-+++ b/drivers/isdn/isdnloop/isdnloop.c
-@@ -15,7 +15,6 @@
- #include <linux/sched.h>
- #include "isdnloop.h"
-
--static char *revision = "$Revision: 1.11.6.7 $";
- static char *isdnloop_id = "loop0";
-
- MODULE_DESCRIPTION("ISDN4Linux: Pseudo Driver that simulates an ISDN card");
-@@ -1493,17 +1492,6 @@ isdnloop_addcard(char *id1)
- static int __init
- isdnloop_init(void)
- {
-- char *p;
-- char rev[10];
--
-- if ((p = strchr(revision, ':'))) {
-- strcpy(rev, p + 1);
-- p = strchr(rev, '$');
-- *p = 0;
-- } else
-- strcpy(rev, " ??? ");
-- printk(KERN_NOTICE "isdnloop-ISDN-driver Rev%s\n", rev);
--
- if (isdnloop_id)
- return (isdnloop_addcard(isdnloop_id));
-
-diff --git a/drivers/net/bonding/bonding.h b/drivers/net/bonding/bonding.h
-index 6824771..5d127fc 100644
---- a/drivers/net/bonding/bonding.h
-+++ b/drivers/net/bonding/bonding.h
-@@ -236,11 +236,11 @@ static inline struct slave *bond_get_slave_by_dev(struct bonding *bond, struct n
-
- bond_for_each_slave(bond, slave, i) {
- if (slave->dev == slave_dev) {
-- break;
-+ return slave;
- }
- }
-
-- return slave;
-+ return 0;
- }
-
- static inline struct bonding *bond_get_bond_by_slave(struct slave *slave)
-diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
-index 3ebe50c..7ddbb8e 100644
---- a/drivers/net/r8169.c
-+++ b/drivers/net/r8169.c
-@@ -176,6 +176,7 @@ static struct pci_device_id rtl8169_pci_tbl[] = {
- { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8168), 0, 0, RTL_CFG_1 },
- { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8169), 0, 0, RTL_CFG_0 },
- { PCI_DEVICE(PCI_VENDOR_ID_DLINK, 0x4300), 0, 0, RTL_CFG_0 },
-+ { PCI_DEVICE(PCI_VENDOR_ID_DLINK, 0x4302), 0, 0, RTL_CFG_0 },
- { PCI_DEVICE(PCI_VENDOR_ID_AT, 0xc107), 0, 0, RTL_CFG_0 },
- { PCI_DEVICE(0x16ec, 0x0116), 0, 0, RTL_CFG_0 },
- { PCI_VENDOR_ID_LINKSYS, 0x1032,
-@@ -1306,7 +1307,7 @@ static void rtl8169_get_mac_version(struct rtl8169_private *tp,
- { 0x7c800000, 0x28000000, RTL_GIGA_MAC_VER_26 },
-
- /* 8168C family. */
-- { 0x7cf00000, 0x3ca00000, RTL_GIGA_MAC_VER_24 },
-+ { 0x7cf00000, 0x3cb00000, RTL_GIGA_MAC_VER_24 },
- { 0x7cf00000, 0x3c900000, RTL_GIGA_MAC_VER_23 },
- { 0x7cf00000, 0x3c800000, RTL_GIGA_MAC_VER_18 },
- { 0x7c800000, 0x3c800000, RTL_GIGA_MAC_VER_24 },
-@@ -3076,7 +3077,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
- goto err_out_mwi_3;
- }
-
-- tp->cp_cmd = PCIMulRW | RxChkSum;
-+ tp->cp_cmd = RxChkSum;
-
- if ((sizeof(dma_addr_t) > 4) &&
- !pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) && use_dac) {
-@@ -3824,8 +3825,7 @@ static void rtl_hw_start_8168(struct net_device *dev)
- Cxpl_dbg_sel | \
- ASF | \
- PktCntrDisable | \
-- PCIDAC | \
-- PCIMulRW)
-+ Mac_dbgo_sel)
-
- static void rtl_hw_start_8102e_1(void __iomem *ioaddr, struct pci_dev *pdev)
- {
-@@ -3855,8 +3855,6 @@ static void rtl_hw_start_8102e_1(void __iomem *ioaddr, struct pci_dev *pdev)
- if ((cfg1 & LEDS0) && (cfg1 & LEDS1))
- RTL_W8(Config1, cfg1 & ~LEDS0);
-
-- RTL_W16(CPlusCmd, RTL_R16(CPlusCmd) & ~R810X_CPCMD_QUIRK_MASK);
--
- rtl_ephy_init(ioaddr, e_info_8102e_1, ARRAY_SIZE(e_info_8102e_1));
- }
-
-@@ -3868,8 +3866,6 @@ static void rtl_hw_start_8102e_2(void __iomem *ioaddr, struct pci_dev *pdev)
-
- RTL_W8(Config1, MEMMAP | IOMAP | VPD | PMEnable);
- RTL_W8(Config3, RTL_R8(Config3) & ~Beacon_en);
--
-- RTL_W16(CPlusCmd, RTL_R16(CPlusCmd) & ~R810X_CPCMD_QUIRK_MASK);
- }
-
- static void rtl_hw_start_8102e_3(void __iomem *ioaddr, struct pci_dev *pdev)
-@@ -3895,6 +3891,8 @@ static void rtl_hw_start_8101(struct net_device *dev)
- }
- }
-
-+ RTL_W8(Cfg9346, Cfg9346_Unlock);
-+
- switch (tp->mac_version) {
- case RTL_GIGA_MAC_VER_07:
- rtl_hw_start_8102e_1(ioaddr, pdev);
-@@ -3909,14 +3907,13 @@ static void rtl_hw_start_8101(struct net_device *dev)
- break;
- }
-
-- RTL_W8(Cfg9346, Cfg9346_Unlock);
-+ RTL_W8(Cfg9346, Cfg9346_Lock);
-
- RTL_W8(EarlyTxThres, EarlyTxThld);
-
- rtl_set_rx_max_size(ioaddr, tp->rx_buf_sz);
-
-- tp->cp_cmd |= rtl_rw_cpluscmd(ioaddr) | PCIMulRW;
--
-+ tp->cp_cmd &= ~R810X_CPCMD_QUIRK_MASK;
- RTL_W16(CPlusCmd, tp->cp_cmd);
-
- RTL_W16(IntrMitigate, 0x0000);
-@@ -3926,14 +3923,10 @@ static void rtl_hw_start_8101(struct net_device *dev)
- RTL_W8(ChipCmd, CmdTxEnb | CmdRxEnb);
- rtl_set_rx_tx_config_registers(tp);
-
-- RTL_W8(Cfg9346, Cfg9346_Lock);
--
- RTL_R8(IntrMask);
-
- rtl_set_rx_mode(dev);
-
-- RTL_W8(ChipCmd, CmdTxEnb | CmdRxEnb);
--
- RTL_W16(MultiIntr, RTL_R16(MultiIntr) & 0xf000);
-
- RTL_W16(IntrMask, tp->intr_event);
-@@ -4579,13 +4572,6 @@ static int rtl8169_rx_interrupt(struct net_device *dev,
- dev->stats.rx_bytes += pkt_size;
- dev->stats.rx_packets++;
- }
--
-- /* Work around for AMD plateform. */
-- if ((desc->opts2 & cpu_to_le32(0xfffe000)) &&
-- (tp->mac_version == RTL_GIGA_MAC_VER_05)) {
-- desc->opts2 = 0;
-- cur_rx++;
-- }
- }
-
- count = cur_rx - tp->cur_rx;
-diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
-index fd6622c..89aa69c 100644
---- a/drivers/net/tg3.c
-+++ b/drivers/net/tg3.c
-@@ -4994,6 +4994,9 @@ static void tg3_poll_controller(struct net_device *dev)
- int i;
- struct tg3 *tp = netdev_priv(dev);
-
-+ if (tg3_irq_sync(tp))
-+ return;
-+
- for (i = 0; i < tp->irq_cnt; i++)
- tg3_interrupt(tp->napi[i].irq_vec, &tp->napi[i]);
- }
-@@ -13888,6 +13891,7 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
- tp->pm_cap = pm_cap;
- tp->rx_mode = TG3_DEF_RX_MODE;
- tp->tx_mode = TG3_DEF_TX_MODE;
-+ tp->irq_sync = 1;
-
- if (tg3_debug > 0)
- tp->msg_enable = tg3_debug;
-diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
-index c3968fad..fc0fc85 100644
---- a/drivers/net/wireless/b43legacy/main.c
-+++ b/drivers/net/wireless/b43legacy/main.c
-@@ -3870,6 +3870,8 @@ static void b43legacy_remove(struct ssb_device *dev)
- cancel_work_sync(&wldev->restart_work);
-
- B43legacy_WARN_ON(!wl);
-+ if (!wldev->fw.ucode)
-+ return; /* NULL if fw never loaded */
- if (wl->current_dev == wldev)
- ieee80211_unregister_hw(wl->hw);
-
-diff --git a/drivers/scsi/bnx2i/bnx2i_hwi.c b/drivers/scsi/bnx2i/bnx2i_hwi.c
-index 5c8d763..1ab55d6 100644
---- a/drivers/scsi/bnx2i/bnx2i_hwi.c
-+++ b/drivers/scsi/bnx2i/bnx2i_hwi.c
-@@ -1156,6 +1156,9 @@ int bnx2i_send_fw_iscsi_init_msg(struct bnx2i_hba *hba)
- int rc = 0;
- u64 mask64;
-
-+ memset(&iscsi_init, 0x00, sizeof(struct iscsi_kwqe_init1));
-+ memset(&iscsi_init2, 0x00, sizeof(struct iscsi_kwqe_init2));
-+
- bnx2i_adjust_qp_size(hba);
-
- iscsi_init.flags =
-diff --git a/drivers/scsi/mpt2sas/mpt2sas_ctl.c b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
-index 7767b8f..48ae81b 100644
---- a/drivers/scsi/mpt2sas/mpt2sas_ctl.c
-+++ b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
-@@ -750,8 +750,11 @@ _ctl_do_mpt_command(struct MPT2SAS_ADAPTER *ioc,
- (u32)mpt2sas_base_get_sense_buffer_dma(ioc, smid);
- priv_sense = mpt2sas_base_get_sense_buffer(ioc, smid);
- memset(priv_sense, 0, SCSI_SENSE_BUFFERSIZE);
-- mpt2sas_base_put_smid_scsi_io(ioc, smid,
-- le16_to_cpu(mpi_request->FunctionDependent1));
-+ if (mpi_request->Function == MPI2_FUNCTION_SCSI_IO_REQUEST)
-+ mpt2sas_base_put_smid_scsi_io(ioc, smid,
-+ le16_to_cpu(mpi_request->FunctionDependent1));
-+ else
-+ mpt2sas_base_put_smid_default(ioc, smid);
- break;
- }
- case MPI2_FUNCTION_SCSI_TASK_MGMT:
-diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
-index e28f9b0..933f1c5 100644
---- a/drivers/scsi/scsi_lib.c
-+++ b/drivers/scsi/scsi_lib.c
-@@ -215,6 +215,8 @@ int scsi_execute(struct scsi_device *sdev, const unsigned char *cmd,
- int ret = DRIVER_ERROR << 24;
-
- req = blk_get_request(sdev->request_queue, write, __GFP_WAIT);
-+ if (!req)
-+ return ret;
-
- if (bufflen && blk_rq_map_kern(sdev->request_queue, req,
- buffer, bufflen, __GFP_WAIT))
-diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c
-index 6a451e8..12e1e9e 100644
---- a/drivers/serial/8250.c
-+++ b/drivers/serial/8250.c
-@@ -81,7 +81,7 @@ static unsigned int skip_txen_test; /* force skip of txen test at init time */
- #define DEBUG_INTR(fmt...) do { } while (0)
- #endif
-
--#define PASS_LIMIT 256
-+#define PASS_LIMIT 512
-
- #define BOTH_EMPTY (UART_LSR_TEMT | UART_LSR_THRE)
-
-diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
-index 908f25a..90810e8 100644
---- a/drivers/staging/comedi/comedi_fops.c
-+++ b/drivers/staging/comedi/comedi_fops.c
-@@ -809,7 +809,7 @@ static int parse_insn(struct comedi_device *dev, struct comedi_insn *insn,
- ret = -EAGAIN;
- break;
- }
-- ret = s->async->inttrig(dev, s, insn->data[0]);
-+ ret = s->async->inttrig(dev, s, data[0]);
- if (ret >= 0)
- ret = 1;
- break;
-@@ -1035,7 +1035,6 @@ static int do_cmd_ioctl(struct comedi_device *dev, void *arg, void *file)
- goto cleanup;
- }
-
-- kfree(async->cmd.chanlist);
- async->cmd = user_cmd;
- async->cmd.data = NULL;
- /* load channel/gain list */
-@@ -1499,7 +1498,7 @@ static unsigned int comedi_poll(struct file *file, poll_table * wait)
-
- mask = 0;
- read_subdev = comedi_get_read_subdevice(dev_file_info);
-- if (read_subdev) {
-+ if (read_subdev && read_subdev->async) {
- poll_wait(file, &read_subdev->async->wait_head, wait);
- if (!read_subdev->busy
- || comedi_buf_read_n_available(read_subdev->async) > 0
-@@ -1509,7 +1508,7 @@ static unsigned int comedi_poll(struct file *file, poll_table * wait)
- }
- }
- write_subdev = comedi_get_write_subdevice(dev_file_info);
-- if (write_subdev) {
-+ if (write_subdev && write_subdev->async) {
- poll_wait(file, &write_subdev->async->wait_head, wait);
- comedi_buf_write_alloc(write_subdev->async,
- write_subdev->async->prealloc_bufsz);
-@@ -1551,7 +1550,7 @@ static ssize_t comedi_write(struct file *file, const char *buf, size_t nbytes,
- }
-
- s = comedi_get_write_subdevice(dev_file_info);
-- if (s == NULL) {
-+ if (s == NULL || s->async == NULL) {
- retval = -EIO;
- goto done;
- }
-@@ -1659,7 +1658,7 @@ static ssize_t comedi_read(struct file *file, char *buf, size_t nbytes,
- }
-
- s = comedi_get_read_subdevice(dev_file_info);
-- if (s == NULL) {
-+ if (s == NULL || s->async == NULL) {
- retval = -EIO;
- goto done;
- }
-@@ -1759,6 +1758,8 @@ void do_become_nonbusy(struct comedi_device *dev, struct comedi_subdevice *s)
- if (async) {
- comedi_reset_async_buf(async);
- async->inttrig = NULL;
-+ kfree(async->cmd.chanlist);
-+ async->cmd.chanlist = NULL;
- } else {
- printk(KERN_ERR
- "BUG: (?) do_become_nonbusy called with async=0\n");
-diff --git a/drivers/staging/comedi/drivers/comedi_test.c b/drivers/staging/comedi/drivers/comedi_test.c
-index ef83a1a..7a1e2e8 100644
---- a/drivers/staging/comedi/drivers/comedi_test.c
-+++ b/drivers/staging/comedi/drivers/comedi_test.c
-@@ -450,7 +450,7 @@ static int waveform_ai_cancel(struct comedi_device *dev,
- struct comedi_subdevice *s)
- {
- devpriv->timer_running = 0;
-- del_timer(&devpriv->timer);
-+ del_timer_sync(&devpriv->timer);
- return 0;
- }
-
-diff --git a/drivers/staging/comedi/drivers/das08.c b/drivers/staging/comedi/drivers/das08.c
-index f425833..c05cb4b 100644
---- a/drivers/staging/comedi/drivers/das08.c
-+++ b/drivers/staging/comedi/drivers/das08.c
-@@ -652,7 +652,7 @@ static int das08jr_ao_winsn(struct comedi_device *dev,
- int chan;
-
- lsb = data[0] & 0xff;
-- msb = (data[0] >> 8) & 0xf;
-+ msb = (data[0] >> 8) & 0xff;
-
- chan = CR_CHAN(insn->chanspec);
-
-diff --git a/drivers/staging/comedi/drivers/jr3_pci.c b/drivers/staging/comedi/drivers/jr3_pci.c
-index 1d6385a..ae6f40c 100644
---- a/drivers/staging/comedi/drivers/jr3_pci.c
-+++ b/drivers/staging/comedi/drivers/jr3_pci.c
-@@ -917,7 +917,7 @@ static int jr3_pci_attach(struct comedi_device *dev,
- }
-
- /* Reset DSP card */
-- devpriv->iobase->channel[0].reset = 0;
-+ writel(0, &devpriv->iobase->channel[0].reset);
-
- result = comedi_load_firmware(dev, "jr3pci.idm", jr3_download_firmware);
- printk("Firmare load %d\n", result);
-diff --git a/drivers/staging/comedi/drivers/ni_labpc.c b/drivers/staging/comedi/drivers/ni_labpc.c
-index 4ac745a..76ca73a 100644
---- a/drivers/staging/comedi/drivers/ni_labpc.c
-+++ b/drivers/staging/comedi/drivers/ni_labpc.c
-@@ -1178,7 +1178,9 @@ static int labpc_ai_cmd(struct comedi_device *dev, struct comedi_subdevice *s)
- else
- channel = CR_CHAN(cmd->chanlist[0]);
- /* munge channel bits for differential / scan disabled mode */
-- if (labpc_ai_scan_mode(cmd) != MODE_SINGLE_CHAN && aref == AREF_DIFF)
-+ if ((labpc_ai_scan_mode(cmd) == MODE_SINGLE_CHAN ||
-+ labpc_ai_scan_mode(cmd) == MODE_SINGLE_CHAN_INTERVAL) &&
-+ aref == AREF_DIFF)
- channel *= 2;
- devpriv->command1_bits |= ADC_CHAN_BITS(channel);
- devpriv->command1_bits |= thisboard->ai_range_code[range];
-@@ -1193,21 +1195,6 @@ static int labpc_ai_cmd(struct comedi_device *dev, struct comedi_subdevice *s)
- devpriv->write_byte(devpriv->command1_bits,
- dev->iobase + COMMAND1_REG);
- }
-- /* setup any external triggering/pacing (command4 register) */
-- devpriv->command4_bits = 0;
-- if (cmd->convert_src != TRIG_EXT)
-- devpriv->command4_bits |= EXT_CONVERT_DISABLE_BIT;
-- /* XXX should discard first scan when using interval scanning
-- * since manual says it is not synced with scan clock */
-- if (labpc_use_continuous_mode(cmd) == 0) {
-- devpriv->command4_bits |= INTERVAL_SCAN_EN_BIT;
-- if (cmd->scan_begin_src == TRIG_EXT)
-- devpriv->command4_bits |= EXT_SCAN_EN_BIT;
-- }
-- /* single-ended/differential */
-- if (aref == AREF_DIFF)
-- devpriv->command4_bits |= ADC_DIFF_BIT;
-- devpriv->write_byte(devpriv->command4_bits, dev->iobase + COMMAND4_REG);
-
- devpriv->write_byte(cmd->chanlist_len,
- dev->iobase + INTERVAL_COUNT_REG);
-@@ -1285,6 +1272,22 @@ static int labpc_ai_cmd(struct comedi_device *dev, struct comedi_subdevice *s)
- devpriv->command3_bits &= ~ADC_FNE_INTR_EN_BIT;
- devpriv->write_byte(devpriv->command3_bits, dev->iobase + COMMAND3_REG);
-
-+ /* setup any external triggering/pacing (command4 register) */
-+ devpriv->command4_bits = 0;
-+ if (cmd->convert_src != TRIG_EXT)
-+ devpriv->command4_bits |= EXT_CONVERT_DISABLE_BIT;
-+ /* XXX should discard first scan when using interval scanning
-+ * since manual says it is not synced with scan clock */
-+ if (labpc_use_continuous_mode(cmd) == 0) {
-+ devpriv->command4_bits |= INTERVAL_SCAN_EN_BIT;
-+ if (cmd->scan_begin_src == TRIG_EXT)
-+ devpriv->command4_bits |= EXT_SCAN_EN_BIT;
-+ }
-+ /* single-ended/differential */
-+ if (aref == AREF_DIFF)
-+ devpriv->command4_bits |= ADC_DIFF_BIT;
-+ devpriv->write_byte(devpriv->command4_bits, dev->iobase + COMMAND4_REG);
-+
- /* startup aquisition */
-
- /* command2 reg */
-diff --git a/drivers/staging/comedi/drivers/s626.c b/drivers/staging/comedi/drivers/s626.c
-index 80d2787..7a7c29f 100644
---- a/drivers/staging/comedi/drivers/s626.c
-+++ b/drivers/staging/comedi/drivers/s626.c
-@@ -2330,7 +2330,7 @@ static int s626_enc_insn_config(struct comedi_device *dev,
- /* (data==NULL) ? (Preloadvalue=0) : (Preloadvalue=data[0]); */
-
- k->SetMode(dev, k, Setup, TRUE);
-- Preload(dev, k, *(insn->data));
-+ Preload(dev, k, data[0]);
- k->PulseIndex(dev, k);
- SetLatchSource(dev, k, valueSrclatch);
- k->SetEnable(dev, k, (uint16_t) (enab != 0));
-diff --git a/drivers/staging/vt6656/rf.c b/drivers/staging/vt6656/rf.c
-index 405c4f7..9d059de 100644
---- a/drivers/staging/vt6656/rf.c
-+++ b/drivers/staging/vt6656/rf.c
-@@ -769,6 +769,9 @@ BYTE byPwr = pDevice->byCCKPwr;
- return TRUE;
- }
-
-+ if (uCH == 0)
-+ return -EINVAL;
-+
- switch (uRATE) {
- case RATE_1M:
- case RATE_2M:
-diff --git a/drivers/telephony/ixj.c b/drivers/telephony/ixj.c
-index 40de151..56eb6cc 100644
---- a/drivers/telephony/ixj.c
-+++ b/drivers/telephony/ixj.c
-@@ -3190,12 +3190,12 @@ static void ixj_write_cid(IXJ *j)
-
- ixj_fsk_alloc(j);
-
-- strcpy(sdmf1, j->cid_send.month);
-- strcat(sdmf1, j->cid_send.day);
-- strcat(sdmf1, j->cid_send.hour);
-- strcat(sdmf1, j->cid_send.min);
-- strcpy(sdmf2, j->cid_send.number);
-- strcpy(sdmf3, j->cid_send.name);
-+ strlcpy(sdmf1, j->cid_send.month, sizeof(sdmf1));
-+ strlcat(sdmf1, j->cid_send.day, sizeof(sdmf1));
-+ strlcat(sdmf1, j->cid_send.hour, sizeof(sdmf1));
-+ strlcat(sdmf1, j->cid_send.min, sizeof(sdmf1));
-+ strlcpy(sdmf2, j->cid_send.number, sizeof(sdmf2));
-+ strlcpy(sdmf3, j->cid_send.name, sizeof(sdmf3));
-
- len1 = strlen(sdmf1);
- len2 = strlen(sdmf2);
-@@ -3340,12 +3340,12 @@ static void ixj_write_cidcw(IXJ *j)
- ixj_pre_cid(j);
- }
- j->flags.cidcw_ack = 0;
-- strcpy(sdmf1, j->cid_send.month);
-- strcat(sdmf1, j->cid_send.day);
-- strcat(sdmf1, j->cid_send.hour);
-- strcat(sdmf1, j->cid_send.min);
-- strcpy(sdmf2, j->cid_send.number);
-- strcpy(sdmf3, j->cid_send.name);
-+ strlcpy(sdmf1, j->cid_send.month, sizeof(sdmf1));
-+ strlcat(sdmf1, j->cid_send.day, sizeof(sdmf1));
-+ strlcat(sdmf1, j->cid_send.hour, sizeof(sdmf1));
-+ strlcat(sdmf1, j->cid_send.min, sizeof(sdmf1));
-+ strlcpy(sdmf2, j->cid_send.number, sizeof(sdmf2));
-+ strlcpy(sdmf3, j->cid_send.name, sizeof(sdmf3));
-
- len1 = strlen(sdmf1);
- len2 = strlen(sdmf2);
-diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
-index 37f2899..01ae519 100644
---- a/drivers/usb/class/cdc-wdm.c
-+++ b/drivers/usb/class/cdc-wdm.c
-@@ -52,6 +52,7 @@ MODULE_DEVICE_TABLE (usb, wdm_ids);
- #define WDM_READ 4
- #define WDM_INT_STALL 5
- #define WDM_POLL_RUNNING 6
-+#define WDM_OVERFLOW 10
-
-
- #define WDM_MAX 16
-@@ -115,6 +116,7 @@ static void wdm_in_callback(struct urb *urb)
- {
- struct wdm_device *desc = urb->context;
- int status = urb->status;
-+ int length = urb->actual_length;
-
- spin_lock(&desc->iuspin);
-
-@@ -144,9 +146,17 @@ static void wdm_in_callback(struct urb *urb)
- }
-
- desc->rerr = status;
-- desc->reslength = urb->actual_length;
-- memmove(desc->ubuf + desc->length, desc->inbuf, desc->reslength);
-- desc->length += desc->reslength;
-+ if (length + desc->length > desc->wMaxCommand) {
-+ /* The buffer would overflow */
-+ set_bit(WDM_OVERFLOW, &desc->flags);
-+ } else {
-+ /* we may already be in overflow */
-+ if (!test_bit(WDM_OVERFLOW, &desc->flags)) {
-+ memmove(desc->ubuf + desc->length, desc->inbuf, length);
-+ desc->length += length;
-+ desc->reslength = length;
-+ }
-+ }
- wake_up(&desc->wait);
-
- set_bit(WDM_READ, &desc->flags);
-@@ -398,6 +408,11 @@ retry:
- rv = -ENODEV;
- goto err;
- }
-+ if (test_bit(WDM_OVERFLOW, &desc->flags)) {
-+ clear_bit(WDM_OVERFLOW, &desc->flags);
-+ rv = -ENOBUFS;
-+ goto err;
-+ }
- i++;
- if (file->f_flags & O_NONBLOCK) {
- if (!test_bit(WDM_READ, &desc->flags)) {
-@@ -440,6 +455,7 @@ retry:
- spin_unlock_irq(&desc->iuspin);
- goto retry;
- }
-+
- if (!desc->reslength) { /* zero length read */
- dev_dbg(&desc->intf->dev, "%s: zero length - clearing WDM_READ\n", __func__);
- clear_bit(WDM_READ, &desc->flags);
-@@ -844,6 +860,7 @@ static int wdm_post_reset(struct usb_interface *intf)
- struct wdm_device *desc = usb_get_intfdata(intf);
- int rv;
-
-+ clear_bit(WDM_OVERFLOW, &desc->flags);
- rv = recover_from_urb_loss(desc);
- mutex_unlock(&desc->plock);
- return 0;
-diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
-index 7b2e99c..8d17f780 100644
---- a/drivers/usb/host/ehci-hcd.c
-+++ b/drivers/usb/host/ehci-hcd.c
-@@ -84,7 +84,8 @@ static const char hcd_name [] = "ehci_hcd";
- #define EHCI_IAA_MSECS 10 /* arbitrary */
- #define EHCI_IO_JIFFIES (HZ/10) /* io watchdog > irq_thresh */
- #define EHCI_ASYNC_JIFFIES (HZ/20) /* async idle timeout */
--#define EHCI_SHRINK_FRAMES 5 /* async qh unlink delay */
-+#define EHCI_SHRINK_JIFFIES (DIV_ROUND_UP(HZ, 200) + 1)
-+ /* 200-ms async qh unlink delay */
-
- /* Initial IRQ latency: faster than hw default */
- static int log2_irq_thresh = 0; // 0 to 6
-@@ -139,10 +140,7 @@ timer_action(struct ehci_hcd *ehci, enum ehci_timer_action action)
- break;
- /* case TIMER_ASYNC_SHRINK: */
- default:
-- /* add a jiffie since we synch against the
-- * 8 KHz uframe counter.
-- */
-- t = DIV_ROUND_UP(EHCI_SHRINK_FRAMES * HZ, 1000) + 1;
-+ t = EHCI_SHRINK_JIFFIES;
- break;
- }
- mod_timer(&ehci->watchdog, t + jiffies);
-diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
-index 0ee5b4b..3b8fa18 100644
---- a/drivers/usb/host/ehci-q.c
-+++ b/drivers/usb/host/ehci-q.c
-@@ -1204,6 +1204,8 @@ static void start_unlink_async (struct ehci_hcd *ehci, struct ehci_qh *qh)
-
- prev->hw->hw_next = qh->hw->hw_next;
- prev->qh_next = qh->qh_next;
-+ if (ehci->qh_scan_next == qh)
-+ ehci->qh_scan_next = qh->qh_next.qh;
- wmb ();
-
- /* If the controller isn't running, we don't have to wait for it */
-@@ -1229,53 +1231,49 @@ static void scan_async (struct ehci_hcd *ehci)
- struct ehci_qh *qh;
- enum ehci_timer_action action = TIMER_IO_WATCHDOG;
-
-- ehci->stamp = ehci_readl(ehci, &ehci->regs->frame_index);
- timer_action_done (ehci, TIMER_ASYNC_SHRINK);
--rescan:
- stopped = !HC_IS_RUNNING(ehci_to_hcd(ehci)->state);
-- qh = ehci->async->qh_next.qh;
-- if (likely (qh != NULL)) {
-- do {
-- /* clean any finished work for this qh */
-- if (!list_empty(&qh->qtd_list) && (stopped ||
-- qh->stamp != ehci->stamp)) {
-- int temp;
--
-- /* unlinks could happen here; completion
-- * reporting drops the lock. rescan using
-- * the latest schedule, but don't rescan
-- * qhs we already finished (no looping)
-- * unless the controller is stopped.
-- */
-- qh = qh_get (qh);
-- qh->stamp = ehci->stamp;
-- temp = qh_completions (ehci, qh);
-- if (qh->needs_rescan)
-- unlink_async(ehci, qh);
-- qh_put (qh);
-- if (temp != 0) {
-- goto rescan;
-- }
-- }
-
-- /* unlink idle entries, reducing DMA usage as well
-- * as HCD schedule-scanning costs. delay for any qh
-- * we just scanned, there's a not-unusual case that it
-- * doesn't stay idle for long.
-- * (plus, avoids some kind of re-activation race.)
-+ ehci->qh_scan_next = ehci->async->qh_next.qh;
-+ while (ehci->qh_scan_next) {
-+ qh = ehci->qh_scan_next;
-+ ehci->qh_scan_next = qh->qh_next.qh;
-+ rescan:
-+ /* clean any finished work for this qh */
-+ if (!list_empty(&qh->qtd_list)) {
-+ int temp;
-+
-+ /*
-+ * Unlinks could happen here; completion reporting
-+ * drops the lock. That's why ehci->qh_scan_next
-+ * always holds the next qh to scan; if the next qh
-+ * gets unlinked then ehci->qh_scan_next is adjusted
-+ * in start_unlink_async().
- */
-- if (list_empty(&qh->qtd_list)
-- && qh->qh_state == QH_STATE_LINKED) {
-- if (!ehci->reclaim && (stopped ||
-- ((ehci->stamp - qh->stamp) & 0x1fff)
-- >= EHCI_SHRINK_FRAMES * 8))
-- start_unlink_async(ehci, qh);
-- else
-- action = TIMER_ASYNC_SHRINK;
-- }
-+ qh = qh_get(qh);
-+ temp = qh_completions(ehci, qh);
-+ if (qh->needs_rescan)
-+ unlink_async(ehci, qh);
-+ qh->unlink_time = jiffies + EHCI_SHRINK_JIFFIES;
-+ qh_put(qh);
-+ if (temp != 0)
-+ goto rescan;
-+ }
-
-- qh = qh->qh_next.qh;
-- } while (qh);
-+ /* unlink idle entries, reducing DMA usage as well
-+ * as HCD schedule-scanning costs. delay for any qh
-+ * we just scanned, there's a not-unusual case that it
-+ * doesn't stay idle for long.
-+ * (plus, avoids some kind of re-activation race.)
-+ */
-+ if (list_empty(&qh->qtd_list)
-+ && qh->qh_state == QH_STATE_LINKED) {
-+ if (!ehci->reclaim && (stopped ||
-+ time_after_eq(jiffies, qh->unlink_time)))
-+ start_unlink_async(ehci, qh);
-+ else
-+ action = TIMER_ASYNC_SHRINK;
-+ }
- }
- if (action == TIMER_ASYNC_SHRINK)
- timer_action (ehci, TIMER_ASYNC_SHRINK);
-diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
-index 5b3ca74..b2b3416 100644
---- a/drivers/usb/host/ehci.h
-+++ b/drivers/usb/host/ehci.h
-@@ -74,6 +74,7 @@ struct ehci_hcd { /* one per controller */
- /* async schedule support */
- struct ehci_qh *async;
- struct ehci_qh *reclaim;
-+ struct ehci_qh *qh_scan_next;
- unsigned scanning : 1;
-
- /* periodic schedule support */
-@@ -116,7 +117,6 @@ struct ehci_hcd { /* one per controller */
- struct timer_list iaa_watchdog;
- struct timer_list watchdog;
- unsigned long actions;
-- unsigned stamp;
- unsigned random_frame;
- unsigned long next_statechange;
- ktime_t last_periodic_enable;
-@@ -335,6 +335,7 @@ struct ehci_qh {
- struct ehci_qh *reclaim; /* next to reclaim */
-
- struct ehci_hcd *ehci;
-+ unsigned long unlink_time;
-
- /*
- * Do NOT use atomic operations for QH refcounting. On some CPUs
-diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
-index 981b604..01e7fae 100644
---- a/drivers/usb/host/pci-quirks.c
-+++ b/drivers/usb/host/pci-quirks.c
-@@ -418,12 +418,12 @@ static void __devinit quirk_usb_handoff_xhci(struct pci_dev *pdev)
- void __iomem *op_reg_base;
- u32 val;
- int timeout;
-+ int len = pci_resource_len(pdev, 0);
-
- if (!mmio_resource_enabled(pdev, 0))
- return;
-
-- base = ioremap_nocache(pci_resource_start(pdev, 0),
-- pci_resource_len(pdev, 0));
-+ base = ioremap_nocache(pci_resource_start(pdev, 0), len);
- if (base == NULL)
- return;
-
-@@ -433,9 +433,17 @@ static void __devinit quirk_usb_handoff_xhci(struct pci_dev *pdev)
- */
- ext_cap_offset = xhci_find_next_cap_offset(base, XHCI_HCC_PARAMS_OFFSET);
- do {
-+ if ((ext_cap_offset + sizeof(val)) > len) {
-+ /* We're reading garbage from the controller */
-+ dev_warn(&pdev->dev,
-+ "xHCI controller failing to respond");
-+ return;
-+ }
-+
- if (!ext_cap_offset)
- /* We've reached the end of the extended capabilities */
- goto hc_init;
-+
- val = readl(base + ext_cap_offset);
- if (XHCI_EXT_CAPS_ID(val) == XHCI_EXT_CAPS_LEGACY)
- break;
-diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
-index c374beb..dd958e9 100644
---- a/drivers/usb/serial/ftdi_sio.c
-+++ b/drivers/usb/serial/ftdi_sio.c
-@@ -2364,6 +2364,9 @@ static void ftdi_set_termios(struct tty_struct *tty,
-
- cflag = termios->c_cflag;
-
-+ if (!old_termios)
-+ goto no_skip;
-+
- if (old_termios->c_cflag == termios->c_cflag
- && old_termios->c_ispeed == termios->c_ispeed
- && old_termios->c_ospeed == termios->c_ospeed)
-@@ -2377,6 +2380,7 @@ static void ftdi_set_termios(struct tty_struct *tty,
- (termios->c_cflag & (CSIZE|PARODD|PARENB|CMSPAR|CSTOPB)))
- goto no_data_parity_stop_changes;
-
-+no_skip:
- /* Set number of data bits, parity, stop bits */
-
- termios->c_cflag &= ~CMSPAR;
-diff --git a/drivers/usb/serial/garmin_gps.c b/drivers/usb/serial/garmin_gps.c
-index 867d97b..7c3ac7b 100644
---- a/drivers/usb/serial/garmin_gps.c
-+++ b/drivers/usb/serial/garmin_gps.c
-@@ -974,10 +974,7 @@ static void garmin_close(struct usb_serial_port *port)
- if (!serial)
- return;
-
-- mutex_lock(&port->serial->disc_mutex);
--
-- if (!port->serial->disconnected)
-- garmin_clear(garmin_data_p);
-+ garmin_clear(garmin_data_p);
-
- /* shutdown our urbs */
- usb_kill_urb(port->read_urb);
-@@ -986,8 +983,6 @@ static void garmin_close(struct usb_serial_port *port)
- /* keep reset state so we know that we must start a new session */
- if (garmin_data_p->state != STATE_RESET)
- garmin_data_p->state = STATE_DISCONNECTED;
--
-- mutex_unlock(&port->serial->disc_mutex);
- }
-
-
-diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
-index 14d51e6..cf515f0 100644
---- a/drivers/usb/serial/io_ti.c
-+++ b/drivers/usb/serial/io_ti.c
-@@ -574,6 +574,9 @@ static void chase_port(struct edgeport_port *port, unsigned long timeout,
- wait_queue_t wait;
- unsigned long flags;
-
-+ if (!tty)
-+ return;
-+
- if (!timeout)
- timeout = (HZ * EDGE_CLOSING_WAIT)/100;
-
-diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
-index 61829b8..c802c77 100644
---- a/drivers/usb/serial/mos7840.c
-+++ b/drivers/usb/serial/mos7840.c
-@@ -2569,7 +2569,6 @@ error:
- kfree(mos7840_port->ctrl_buf);
- usb_free_urb(mos7840_port->control_urb);
- kfree(mos7840_port);
-- serial->port[i] = NULL;
- }
- return status;
- }
-@@ -2636,6 +2635,7 @@ static void mos7840_release(struct usb_serial *serial)
- mos7840_port = mos7840_get_port_private(serial->port[i]);
- dbg("mos7840_port %d = %p", i, mos7840_port);
- if (mos7840_port) {
-+ usb_free_urb(mos7840_port->control_urb);
- kfree(mos7840_port->ctrl_buf);
- kfree(mos7840_port->dr);
- kfree(mos7840_port);
-diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
-index 1b5c9f8..0cbf847 100644
---- a/drivers/usb/serial/sierra.c
-+++ b/drivers/usb/serial/sierra.c
-@@ -925,6 +925,7 @@ static void sierra_release(struct usb_serial *serial)
- continue;
- kfree(portdata);
- }
-+ kfree(serial->private);
- }
-
- #ifdef CONFIG_PM
-diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
-index 1093d2e..1247be1 100644
---- a/drivers/usb/serial/whiteheat.c
-+++ b/drivers/usb/serial/whiteheat.c
-@@ -576,6 +576,7 @@ no_firmware:
- "%s: please contact support@connecttech.com\n",
- serial->type->description);
- kfree(result);
-+ kfree(command);
- return -ENODEV;
-
- no_command_private:
-diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c
-index acc7e3b..74284bd 100644
---- a/drivers/w1/w1.c
-+++ b/drivers/w1/w1.c
-@@ -918,7 +918,8 @@ void w1_search(struct w1_master *dev, u8 search_type, w1_slave_found_callback cb
- tmp64 = (triplet_ret >> 2);
- rn |= (tmp64 << i);
-
-- if (kthread_should_stop()) {
-+ /* ensure we're called from kthread and not by netlink callback */
-+ if (!dev->priv && kthread_should_stop()) {
- dev_dbg(&dev->dev, "Abort w1_search\n");
- return;
- }
-diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
-index a64fde6..c564293 100644
---- a/fs/binfmt_elf.c
-+++ b/fs/binfmt_elf.c
-@@ -1699,30 +1699,19 @@ static int elf_note_info_init(struct elf_note_info *info)
- return 0;
- info->psinfo = kmalloc(sizeof(*info->psinfo), GFP_KERNEL);
- if (!info->psinfo)
-- goto notes_free;
-+ return 0;
- info->prstatus = kmalloc(sizeof(*info->prstatus), GFP_KERNEL);
- if (!info->prstatus)
-- goto psinfo_free;
-+ return 0;
- info->fpu = kmalloc(sizeof(*info->fpu), GFP_KERNEL);
- if (!info->fpu)
-- goto prstatus_free;
-+ return 0;
- #ifdef ELF_CORE_COPY_XFPREGS
- info->xfpu = kmalloc(sizeof(*info->xfpu), GFP_KERNEL);
- if (!info->xfpu)
-- goto fpu_free;
-+ return 0;
- #endif
- return 1;
--#ifdef ELF_CORE_COPY_XFPREGS
-- fpu_free:
-- kfree(info->fpu);
--#endif
-- prstatus_free:
-- kfree(info->prstatus);
-- psinfo_free:
-- kfree(info->psinfo);
-- notes_free:
-- kfree(info->notes);
-- return 0;
- }
-
- static int fill_note_info(struct elfhdr *elf, int phdrs,
-diff --git a/fs/binfmt_em86.c b/fs/binfmt_em86.c
-index 32fb00b..416dcae 100644
---- a/fs/binfmt_em86.c
-+++ b/fs/binfmt_em86.c
-@@ -43,7 +43,6 @@ static int load_em86(struct linux_binprm *bprm,struct pt_regs *regs)
- return -ENOEXEC;
- }
-
-- bprm->recursion_depth++; /* Well, the bang-shell is implicit... */
- allow_write_access(bprm->file);
- fput(bprm->file);
- bprm->file = NULL;
-diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c
-index 42b60b0..258c5ca 100644
---- a/fs/binfmt_misc.c
-+++ b/fs/binfmt_misc.c
-@@ -116,10 +116,6 @@ static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs)
- if (!enabled)
- goto _ret;
-
-- retval = -ENOEXEC;
-- if (bprm->recursion_depth > BINPRM_MAX_RECURSION)
-- goto _ret;
--
- /* to keep locking time low, we copy the interpreter string */
- read_lock(&entries_lock);
- fmt = check_file(bprm);
-@@ -176,7 +172,10 @@ static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs)
- goto _error;
- bprm->argc ++;
-
-- bprm->interp = iname; /* for binfmt_script */
-+ /* Update interp in case binfmt_script needs it. */
-+ retval = bprm_change_interp(iname, bprm);
-+ if (retval < 0)
-+ goto _error;
-
- interp_file = open_exec (iname);
- retval = PTR_ERR (interp_file);
-@@ -197,8 +196,6 @@ static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs)
- if (retval < 0)
- goto _error;
-
-- bprm->recursion_depth++;
--
- retval = search_binary_handler (bprm, regs);
- if (retval < 0)
- goto _error;
-diff --git a/fs/binfmt_script.c b/fs/binfmt_script.c
-index 0834350..4fe6b8a 100644
---- a/fs/binfmt_script.c
-+++ b/fs/binfmt_script.c
-@@ -22,15 +22,13 @@ static int load_script(struct linux_binprm *bprm,struct pt_regs *regs)
- char interp[BINPRM_BUF_SIZE];
- int retval;
-
-- if ((bprm->buf[0] != '#') || (bprm->buf[1] != '!') ||
-- (bprm->recursion_depth > BINPRM_MAX_RECURSION))
-+ if ((bprm->buf[0] != '#') || (bprm->buf[1] != '!'))
- return -ENOEXEC;
- /*
- * This section does the #! interpretation.
- * Sorta complicated, but hopefully it will work. -TYT
- */
-
-- bprm->recursion_depth++;
- allow_write_access(bprm->file);
- fput(bprm->file);
- bprm->file = NULL;
-@@ -82,7 +80,9 @@ static int load_script(struct linux_binprm *bprm,struct pt_regs *regs)
- retval = copy_strings_kernel(1, &i_name, bprm);
- if (retval) return retval;
- bprm->argc++;
-- bprm->interp = interp;
-+ retval = bprm_change_interp(interp, bprm);
-+ if (retval < 0)
-+ return retval;
-
- /*
- * OK, now restart the process with the interpreter's dentry.
-diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
-index 5d56a8d..6190a10 100644
---- a/fs/btrfs/volumes.c
-+++ b/fs/btrfs/volumes.c
-@@ -557,6 +557,12 @@ int btrfs_close_devices(struct btrfs_fs_devices *fs_devices)
- __btrfs_close_devices(fs_devices);
- free_fs_devices(fs_devices);
- }
-+ /*
-+ * Wait for rcu kworkers under __btrfs_close_devices
-+ * to finish all blkdev_puts so device is really
-+ * free when umount is done.
-+ */
-+ rcu_barrier();
- return ret;
- }
-
-diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c
-index fea9e89..b36a8aa 100644
---- a/fs/cifs/cifs_dfs_ref.c
-+++ b/fs/cifs/cifs_dfs_ref.c
-@@ -226,6 +226,8 @@ compose_mount_options_out:
- compose_mount_options_err:
- kfree(mountdata);
- mountdata = ERR_PTR(rc);
-+ kfree(*devname);
-+ *devname = NULL;
- goto compose_mount_options_out;
- }
-
-diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
-index d84e705..98d3c58 100644
---- a/fs/compat_ioctl.c
-+++ b/fs/compat_ioctl.c
-@@ -234,6 +234,8 @@ static int do_video_set_spu_palette(unsigned int fd, unsigned int cmd, unsigned
- up = (struct compat_video_spu_palette __user *) arg;
- err = get_user(palp, &up->palette);
- err |= get_user(length, &up->length);
-+ if (err)
-+ return -EFAULT;
-
- up_native = compat_alloc_user_space(sizeof(struct video_spu_palette));
- err = put_user(compat_ptr(palp), &up_native->palette);
-@@ -350,6 +352,7 @@ static int dev_ifconf(unsigned int fd, unsigned int cmd, unsigned long arg)
- if (copy_from_user(&ifc32, compat_ptr(arg), sizeof(struct ifconf32)))
- return -EFAULT;
-
-+ memset(&ifc, 0, sizeof(ifc));
- if (ifc32.ifcbuf == 0) {
- ifc32.ifc_len = 0;
- ifc.ifc_len = 0;
-diff --git a/fs/eventpoll.c b/fs/eventpoll.c
-index ff57421..83fbd64 100644
---- a/fs/eventpoll.c
-+++ b/fs/eventpoll.c
-@@ -1183,10 +1183,30 @@ static int ep_modify(struct eventpoll *ep, struct epitem *epi, struct epoll_even
- * otherwise we might miss an event that happens between the
- * f_op->poll() call and the new event set registering.
- */
-- epi->event.events = event->events;
-+ epi->event.events = event->events; /* need barrier below */
- epi->event.data = event->data; /* protected by mtx */
-
- /*
-+ * The following barrier has two effects:
-+ *
-+ * 1) Flush epi changes above to other CPUs. This ensures
-+ * we do not miss events from ep_poll_callback if an
-+ * event occurs immediately after we call f_op->poll().
-+ * We need this because we did not take ep->lock while
-+ * changing epi above (but ep_poll_callback does take
-+ * ep->lock).
-+ *
-+ * 2) We also need to ensure we do not miss _past_ events
-+ * when calling f_op->poll(). This barrier also
-+ * pairs with the barrier in wq_has_sleeper (see
-+ * comments for wq_has_sleeper).
-+ *
-+ * This barrier will now guarantee ep_poll_callback or f_op->poll
-+ * (or both) will notice the readiness of an item.
-+ */
-+ smp_mb();
-+
-+ /*
- * Get current event bits. We can safely use the file* here because
- * its usage count has been increased by the caller of this function.
- */
-diff --git a/fs/exec.c b/fs/exec.c
-index 86fafc6..feb2435 100644
---- a/fs/exec.c
-+++ b/fs/exec.c
-@@ -1108,9 +1108,24 @@ void free_bprm(struct linux_binprm *bprm)
- mutex_unlock(¤t->cred_guard_mutex);
- abort_creds(bprm->cred);
- }
-+ /* If a binfmt changed the interp, free it. */
-+ if (bprm->interp != bprm->filename)
-+ kfree(bprm->interp);
- kfree(bprm);
- }
-
-+int bprm_change_interp(char *interp, struct linux_binprm *bprm)
-+{
-+ /* If a binfmt changed the interp, free it first. */
-+ if (bprm->interp != bprm->filename)
-+ kfree(bprm->interp);
-+ bprm->interp = kstrdup(interp, GFP_KERNEL);
-+ if (!bprm->interp)
-+ return -ENOMEM;
-+ return 0;
-+}
-+EXPORT_SYMBOL(bprm_change_interp);
-+
- /*
- * install the new credentials for this executable
- */
-@@ -1270,6 +1285,10 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
- int try,retval;
- struct linux_binfmt *fmt;
-
-+ /* This allows 4 levels of binfmt rewrites before failing hard. */
-+ if (depth > 5)
-+ return -ELOOP;
-+
- retval = security_bprm_check(bprm);
- if (retval)
- return retval;
-@@ -1291,12 +1310,8 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
- if (!try_module_get(fmt->module))
- continue;
- read_unlock(&binfmt_lock);
-+ bprm->recursion_depth = depth + 1;
- retval = fn(bprm, regs);
-- /*
-- * Restore the depth counter to its starting value
-- * in this call, so we don't have to rely on every
-- * load_binary function to restore it on return.
-- */
- bprm->recursion_depth = depth;
- if (retval >= 0) {
- if (depth == 0)
-diff --git a/fs/ext4/acl.c b/fs/ext4/acl.c
-index 0df88b2..d29a06b 100644
---- a/fs/ext4/acl.c
-+++ b/fs/ext4/acl.c
-@@ -454,8 +454,10 @@ ext4_xattr_set_acl(struct inode *inode, int type, const void *value,
-
- retry:
- handle = ext4_journal_start(inode, EXT4_DATA_TRANS_BLOCKS(inode->i_sb));
-- if (IS_ERR(handle))
-- return PTR_ERR(handle);
-+ if (IS_ERR(handle)) {
-+ error = PTR_ERR(handle);
-+ goto release_and_out;
-+ }
- error = ext4_set_acl(handle, inode, type, acl);
- ext4_journal_stop(handle);
- if (error == -ENOSPC && ext4_should_retry_alloc(inode->i_sb, &retries))
-diff --git a/fs/ext4/ext4_extents.h b/fs/ext4/ext4_extents.h
-index bdb6ce7..24fa647 100644
---- a/fs/ext4/ext4_extents.h
-+++ b/fs/ext4/ext4_extents.h
-@@ -137,8 +137,11 @@ typedef int (*ext_prepare_callback)(struct inode *, struct ext4_ext_path *,
- #define EXT_BREAK 1
- #define EXT_REPEAT 2
-
--/* Maximum logical block in a file; ext4_extent's ee_block is __le32 */
--#define EXT_MAX_BLOCK 0xffffffff
-+/*
-+ * Maximum number of logical blocks in a file; ext4_extent's ee_block is
-+ * __le32.
-+ */
-+#define EXT_MAX_BLOCKS 0xffffffff
-
- /*
- * EXT_INIT_MAX_LEN is the maximum number of blocks we can have in an
-diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
-index b4402c8..3f022ea 100644
---- a/fs/ext4/extents.c
-+++ b/fs/ext4/extents.c
-@@ -62,6 +62,7 @@ ext4_fsblk_t ext_pblock(struct ext4_extent *ex)
- * idx_pblock:
- * combine low and high parts of a leaf physical block number into ext4_fsblk_t
- */
-+#define EXT4_EXT_DATA_VALID 0x8 /* extent contains valid data */
- ext4_fsblk_t idx_pblock(struct ext4_extent_idx *ix)
- {
- ext4_fsblk_t block;
-@@ -1331,7 +1332,7 @@ got_index:
-
- /*
- * ext4_ext_next_allocated_block:
-- * returns allocated block in subsequent extent or EXT_MAX_BLOCK.
-+ * returns allocated block in subsequent extent or EXT_MAX_BLOCKS.
- * NOTE: it considers block number from index entry as
- * allocated block. Thus, index entries have to be consistent
- * with leaves.
-@@ -1345,7 +1346,7 @@ ext4_ext_next_allocated_block(struct ext4_ext_path *path)
- depth = path->p_depth;
-
- if (depth == 0 && path->p_ext == NULL)
-- return EXT_MAX_BLOCK;
-+ return EXT_MAX_BLOCKS;
-
- while (depth >= 0) {
- if (depth == path->p_depth) {
-@@ -1362,12 +1363,12 @@ ext4_ext_next_allocated_block(struct ext4_ext_path *path)
- depth--;
- }
-
-- return EXT_MAX_BLOCK;
-+ return EXT_MAX_BLOCKS;
- }
-
- /*
- * ext4_ext_next_leaf_block:
-- * returns first allocated block from next leaf or EXT_MAX_BLOCK
-+ * returns first allocated block from next leaf or EXT_MAX_BLOCKS
- */
- static ext4_lblk_t ext4_ext_next_leaf_block(struct inode *inode,
- struct ext4_ext_path *path)
-@@ -1379,7 +1380,7 @@ static ext4_lblk_t ext4_ext_next_leaf_block(struct inode *inode,
-
- /* zero-tree has no leaf blocks at all */
- if (depth == 0)
-- return EXT_MAX_BLOCK;
-+ return EXT_MAX_BLOCKS;
-
- /* go to index block */
- depth--;
-@@ -1392,7 +1393,7 @@ static ext4_lblk_t ext4_ext_next_leaf_block(struct inode *inode,
- depth--;
- }
-
-- return EXT_MAX_BLOCK;
-+ return EXT_MAX_BLOCKS;
- }
-
- /*
-@@ -1572,13 +1573,13 @@ unsigned int ext4_ext_check_overlap(struct inode *inode,
- */
- if (b2 < b1) {
- b2 = ext4_ext_next_allocated_block(path);
-- if (b2 == EXT_MAX_BLOCK)
-+ if (b2 == EXT_MAX_BLOCKS)
- goto out;
- }
-
- /* check for wrap through zero on extent logical start block*/
- if (b1 + len1 < b1) {
-- len1 = EXT_MAX_BLOCK - b1;
-+ len1 = EXT_MAX_BLOCKS - b1;
- newext->ee_len = cpu_to_le16(len1);
- ret = 1;
- }
-@@ -1654,7 +1655,7 @@ repeat:
- fex = EXT_LAST_EXTENT(eh);
- next = ext4_ext_next_leaf_block(inode, path);
- if (le32_to_cpu(newext->ee_block) > le32_to_cpu(fex->ee_block)
-- && next != EXT_MAX_BLOCK) {
-+ && next != EXT_MAX_BLOCKS) {
- ext_debug("next leaf block - %d\n", next);
- BUG_ON(npath != NULL);
- npath = ext4_ext_find_extent(inode, next, NULL);
-@@ -1772,7 +1773,7 @@ int ext4_ext_walk_space(struct inode *inode, ext4_lblk_t block,
- BUG_ON(func == NULL);
- BUG_ON(inode == NULL);
-
-- while (block < last && block != EXT_MAX_BLOCK) {
-+ while (block < last && block != EXT_MAX_BLOCKS) {
- num = last - block;
- /* find extent for this block */
- down_read(&EXT4_I(inode)->i_data_sem);
-@@ -1900,7 +1901,7 @@ ext4_ext_put_gap_in_cache(struct inode *inode, struct ext4_ext_path *path,
- if (ex == NULL) {
- /* there is no extent yet, so gap is [0;-] */
- lblock = 0;
-- len = EXT_MAX_BLOCK;
-+ len = EXT_MAX_BLOCKS;
- ext_debug("cache gap(whole file):");
- } else if (block < le32_to_cpu(ex->ee_block)) {
- lblock = block;
-@@ -2145,8 +2146,8 @@ ext4_ext_rm_leaf(handle_t *handle, struct inode *inode,
- path[depth].p_ext = ex;
-
- a = ex_ee_block > start ? ex_ee_block : start;
-- b = ex_ee_block + ex_ee_len - 1 < EXT_MAX_BLOCK ?
-- ex_ee_block + ex_ee_len - 1 : EXT_MAX_BLOCK;
-+ b = ex_ee_block + ex_ee_len - 1 < EXT_MAX_BLOCKS ?
-+ ex_ee_block + ex_ee_len - 1 : EXT_MAX_BLOCKS;
-
- ext_debug(" border %u:%u\n", a, b);
-
-@@ -2933,6 +2934,30 @@ static int ext4_split_unwritten_extents(handle_t *handle,
- ext4_ext_mark_uninitialized(ex3);
- err = ext4_ext_insert_extent(handle, inode, path, ex3, flags);
- if (err == -ENOSPC && may_zeroout) {
-+ /*
-+ * This is different from the upstream, because we
-+ * need only a flag to say that the extent contains
-+ * the actual data.
-+ *
-+ * If the extent contains valid data, which can only
-+ * happen if AIO races with fallocate, then we got
-+ * here from ext4_convert_unwritten_extents_dio().
-+ * So we have to be careful not to zeroout valid data
-+ * in the extent.
-+ *
-+ * To avoid it, we only zeroout the ex3 and extend the
-+ * extent which is going to become initialized to cover
-+ * ex3 as well. and continue as we would if only
-+ * split in two was required.
-+ */
-+ if (flags & EXT4_EXT_DATA_VALID) {
-+ err = ext4_ext_zeroout(inode, ex3);
-+ if (err)
-+ goto fix_extent_len;
-+ max_blocks = allocated;
-+ ex2->ee_len = cpu_to_le16(max_blocks);
-+ goto skip;
-+ }
- err = ext4_ext_zeroout(inode, &orig_ex);
- if (err)
- goto fix_extent_len;
-@@ -2978,6 +3003,7 @@ static int ext4_split_unwritten_extents(handle_t *handle,
-
- allocated = max_blocks;
- }
-+skip:
- /*
- * If there was a change of depth as part of the
- * insertion of ex3 above, we need to update the length
-@@ -3030,11 +3056,16 @@ fix_extent_len:
- ext4_ext_dirty(handle, inode, path + depth);
- return err;
- }
-+
- static int ext4_convert_unwritten_extents_dio(handle_t *handle,
- struct inode *inode,
-+ ext4_lblk_t iblock,
-+ unsigned int max_blocks,
- struct ext4_ext_path *path)
- {
- struct ext4_extent *ex;
-+ ext4_lblk_t ee_block;
-+ unsigned int ee_len;
- struct ext4_extent_header *eh;
- int depth;
- int err = 0;
-@@ -3043,6 +3074,30 @@ static int ext4_convert_unwritten_extents_dio(handle_t *handle,
- depth = ext_depth(inode);
- eh = path[depth].p_hdr;
- ex = path[depth].p_ext;
-+ ee_block = le32_to_cpu(ex->ee_block);
-+ ee_len = ext4_ext_get_actual_len(ex);
-+
-+ ext_debug("ext4_convert_unwritten_extents_endio: inode %lu, logical"
-+ "block %llu, max_blocks %u\n", inode->i_ino,
-+ (unsigned long long)ee_block, ee_len);
-+
-+ /* If extent is larger than requested then split is required */
-+
-+ if (ee_block != iblock || ee_len > max_blocks) {
-+ err = ext4_split_unwritten_extents(handle, inode, path,
-+ iblock, max_blocks,
-+ EXT4_EXT_DATA_VALID);
-+ if (err < 0)
-+ goto out;
-+ ext4_ext_drop_refs(path);
-+ path = ext4_ext_find_extent(inode, iblock, path);
-+ if (IS_ERR(path)) {
-+ err = PTR_ERR(path);
-+ goto out;
-+ }
-+ depth = ext_depth(inode);
-+ ex = path[depth].p_ext;
-+ }
-
- err = ext4_ext_get_access(handle, inode, path + depth);
- if (err)
-@@ -3129,7 +3184,8 @@ ext4_ext_handle_uninitialized_extents(handle_t *handle, struct inode *inode,
- /* async DIO end_io complete, convert the filled extent to written */
- if (flags == EXT4_GET_BLOCKS_DIO_CONVERT_EXT) {
- ret = ext4_convert_unwritten_extents_dio(handle, inode,
-- path);
-+ iblock, max_blocks,
-+ path);
- if (ret >= 0)
- ext4_update_inode_fsync_trans(handle, inode, 1);
- goto out2;
-@@ -3498,6 +3554,12 @@ void ext4_ext_truncate(struct inode *inode)
- int err = 0;
-
- /*
-+ * finish any pending end_io work so we won't run the risk of
-+ * converting any truncated blocks to initialized later
-+ */
-+ flush_aio_dio_completed_IO(inode);
-+
-+ /*
- * probably first extent we're gonna free will be last in block
- */
- err = ext4_writepage_trans_blocks(inode);
-@@ -3630,6 +3692,9 @@ long ext4_fallocate(struct inode *inode, int mode, loff_t offset, loff_t len)
- mutex_unlock(&inode->i_mutex);
- return ret;
- }
-+
-+ /* Prevent race condition between unwritten */
-+ flush_aio_dio_completed_IO(inode);
- retry:
- while (ret >= 0 && ret < max_blocks) {
- block = block + ret;
-@@ -3783,15 +3848,14 @@ static int ext4_ext_fiemap_cb(struct inode *inode, struct ext4_ext_path *path,
- flags |= FIEMAP_EXTENT_UNWRITTEN;
-
- /*
-- * If this extent reaches EXT_MAX_BLOCK, it must be last.
-+ * If this extent reaches EXT_MAX_BLOCKS, it must be last.
- *
-- * Or if ext4_ext_next_allocated_block is EXT_MAX_BLOCK,
-+ * Or if ext4_ext_next_allocated_block is EXT_MAX_BLOCKS,
- * this also indicates no more allocated blocks.
- *
-- * XXX this might miss a single-block extent at EXT_MAX_BLOCK
- */
-- if (ext4_ext_next_allocated_block(path) == EXT_MAX_BLOCK ||
-- newex->ec_block + newex->ec_len - 1 == EXT_MAX_BLOCK) {
-+ if (ext4_ext_next_allocated_block(path) == EXT_MAX_BLOCKS ||
-+ newex->ec_block + newex->ec_len == EXT_MAX_BLOCKS) {
- loff_t size = i_size_read(inode);
- loff_t bs = EXT4_BLOCK_SIZE(inode->i_sb);
-
-@@ -3871,8 +3935,8 @@ int ext4_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
-
- start_blk = start >> inode->i_sb->s_blocksize_bits;
- last_blk = (start + len - 1) >> inode->i_sb->s_blocksize_bits;
-- if (last_blk >= EXT_MAX_BLOCK)
-- last_blk = EXT_MAX_BLOCK-1;
-+ if (last_blk >= EXT_MAX_BLOCKS)
-+ last_blk = EXT_MAX_BLOCKS-1;
- len_blks = ((ext4_lblk_t) last_blk) - start_blk + 1;
-
- /*
-diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
-index efe6363..babf448 100644
---- a/fs/ext4/inode.c
-+++ b/fs/ext4/inode.c
-@@ -5121,6 +5121,7 @@ static int ext4_do_update_inode(handle_t *handle,
- struct ext4_inode_info *ei = EXT4_I(inode);
- struct buffer_head *bh = iloc->bh;
- int err = 0, rc, block;
-+ int need_datasync = 0;
-
- /* For fields not not tracking in the in-memory inode,
- * initialise them to zero for new inodes. */
-@@ -5169,7 +5170,10 @@ static int ext4_do_update_inode(handle_t *handle,
- raw_inode->i_file_acl_high =
- cpu_to_le16(ei->i_file_acl >> 32);
- raw_inode->i_file_acl_lo = cpu_to_le32(ei->i_file_acl);
-- ext4_isize_set(raw_inode, ei->i_disksize);
-+ if (ei->i_disksize != ext4_isize(raw_inode)) {
-+ ext4_isize_set(raw_inode, ei->i_disksize);
-+ need_datasync = 1;
-+ }
- if (ei->i_disksize > 0x7fffffffULL) {
- struct super_block *sb = inode->i_sb;
- if (!EXT4_HAS_RO_COMPAT_FEATURE(sb,
-@@ -5222,7 +5226,7 @@ static int ext4_do_update_inode(handle_t *handle,
- err = rc;
- ext4_clear_inode_state(inode, EXT4_STATE_NEW);
-
-- ext4_update_inode_fsync_trans(handle, inode, 0);
-+ ext4_update_inode_fsync_trans(handle, inode, need_datasync);
- out_brelse:
- brelse(bh);
- ext4_std_error(inode->i_sb, err);
-diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
-index 42bac1b..cecf2a5 100644
---- a/fs/ext4/mballoc.c
-+++ b/fs/ext4/mballoc.c
-@@ -2070,7 +2070,11 @@ repeat:
- group = ac->ac_g_ex.fe_group;
-
- for (i = 0; i < ngroups; group++, i++) {
-- if (group == ngroups)
-+ /*
-+ * Artificially restricted ngroups for non-extent
-+ * files makes group > ngroups possible on first loop.
-+ */
-+ if (group >= ngroups)
- group = 0;
-
- /* This now checks without needing the buddy page */
-@@ -4163,7 +4167,7 @@ static void ext4_mb_add_n_trim(struct ext4_allocation_context *ac)
- /* The max size of hash table is PREALLOC_TB_SIZE */
- order = PREALLOC_TB_SIZE - 1;
- /* Add the prealloc space to lg */
-- rcu_read_lock();
-+ spin_lock(&lg->lg_prealloc_lock);
- list_for_each_entry_rcu(tmp_pa, &lg->lg_prealloc_list[order],
- pa_inode_list) {
- spin_lock(&tmp_pa->pa_lock);
-@@ -4187,12 +4191,12 @@ static void ext4_mb_add_n_trim(struct ext4_allocation_context *ac)
- if (!added)
- list_add_tail_rcu(&pa->pa_inode_list,
- &lg->lg_prealloc_list[order]);
-- rcu_read_unlock();
-+ spin_unlock(&lg->lg_prealloc_lock);
-
- /* Now trim the list to be not more than 8 elements */
- if (lg_prealloc_count > 8) {
- ext4_mb_discard_lg_preallocations(sb, lg,
-- order, lg_prealloc_count);
-+ order, lg_prealloc_count);
- return;
- }
- return ;
-diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
-index a73ed78..da25617 100644
---- a/fs/ext4/move_extent.c
-+++ b/fs/ext4/move_extent.c
-@@ -1001,12 +1001,12 @@ mext_check_arguments(struct inode *orig_inode,
- return -EINVAL;
- }
-
-- if ((orig_start > EXT_MAX_BLOCK) ||
-- (donor_start > EXT_MAX_BLOCK) ||
-- (*len > EXT_MAX_BLOCK) ||
-- (orig_start + *len > EXT_MAX_BLOCK)) {
-+ if ((orig_start >= EXT_MAX_BLOCKS) ||
-+ (donor_start >= EXT_MAX_BLOCKS) ||
-+ (*len > EXT_MAX_BLOCKS) ||
-+ (orig_start + *len >= EXT_MAX_BLOCKS)) {
- ext4_debug("ext4 move extent: Can't handle over [%u] blocks "
-- "[ino:orig %lu, donor %lu]\n", EXT_MAX_BLOCK,
-+ "[ino:orig %lu, donor %lu]\n", EXT_MAX_BLOCKS,
- orig_inode->i_ino, donor_inode->i_ino);
- return -EINVAL;
- }
-@@ -1208,7 +1208,12 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp,
- orig_inode->i_ino, donor_inode->i_ino);
- return -EINVAL;
- }
--
-+ /* TODO: This is non obvious task to swap blocks for inodes with full
-+ jornaling enabled */
-+ if (ext4_should_journal_data(orig_inode) ||
-+ ext4_should_journal_data(donor_inode)) {
-+ return -EINVAL;
-+ }
- /* Protect orig and donor inodes against a truncate */
- ret1 = mext_inode_double_lock(orig_inode, donor_inode);
- if (ret1 < 0)
-diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
-index c3b6ad0..3a1af19 100644
---- a/fs/ext4/namei.c
-+++ b/fs/ext4/namei.c
-@@ -1457,10 +1457,22 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry,
- frame->at = entries;
- frame->bh = bh;
- bh = bh2;
-+
-+ ext4_handle_dirty_metadata(handle, dir, frame->bh);
-+ ext4_handle_dirty_metadata(handle, dir, bh);
-+
- de = do_split(handle,dir, &bh, frame, &hinfo, &retval);
-- dx_release (frames);
-- if (!(de))
-+ if (!de) {
-+ /*
-+ * Even if the block split failed, we have to properly write
-+ * out all the changes we did so far. Otherwise we can end up
-+ * with corrupted filesystem.
-+ */
-+ ext4_mark_inode_dirty(handle, dir);
-+ dx_release(frames);
- return retval;
-+ }
-+ dx_release(frames);
-
- retval = add_dirent_to_buf(handle, dentry, inode, de, bh);
- brelse(bh);
-@@ -1816,9 +1828,7 @@ retry:
- err = PTR_ERR(inode);
- if (!IS_ERR(inode)) {
- init_special_inode(inode, inode->i_mode, rdev);
--#ifdef CONFIG_EXT4_FS_XATTR
- inode->i_op = &ext4_special_inode_operations;
--#endif
- err = ext4_add_nondir(handle, dentry, inode);
- }
- ext4_journal_stop(handle);
-@@ -1991,7 +2001,7 @@ int ext4_orphan_add(handle_t *handle, struct inode *inode)
- struct ext4_iloc iloc;
- int err = 0, rc;
-
-- if (!ext4_handle_valid(handle))
-+ if (!EXT4_SB(sb)->s_journal)
- return 0;
-
- mutex_lock(&EXT4_SB(sb)->s_orphan_lock);
-@@ -2072,8 +2082,8 @@ int ext4_orphan_del(handle_t *handle, struct inode *inode)
- struct ext4_iloc iloc;
- int err = 0;
-
-- /* ext4_handle_valid() assumes a valid handle_t pointer */
-- if (handle && !ext4_handle_valid(handle))
-+ if ((!EXT4_SB(inode->i_sb)->s_journal) &&
-+ !(EXT4_SB(inode->i_sb)->s_mount_state & EXT4_ORPHAN_FS))
- return 0;
-
- mutex_lock(&EXT4_SB(inode->i_sb)->s_orphan_lock);
-@@ -2092,7 +2102,7 @@ int ext4_orphan_del(handle_t *handle, struct inode *inode)
- * transaction handle with which to update the orphan list on
- * disk, but we still need to remove the inode from the linked
- * list in memory. */
-- if (sbi->s_journal && !handle)
-+ if (!handle)
- goto out;
-
- err = ext4_reserve_inode_write(handle, inode, &iloc);
-diff --git a/fs/ext4/super.c b/fs/ext4/super.c
-index f1e7077..108515f 100644
---- a/fs/ext4/super.c
-+++ b/fs/ext4/super.c
-@@ -1937,7 +1937,9 @@ static void ext4_orphan_cleanup(struct super_block *sb,
- __func__, inode->i_ino, inode->i_size);
- jbd_debug(2, "truncating inode %lu to %lld bytes\n",
- inode->i_ino, inode->i_size);
-+ mutex_lock(&inode->i_mutex);
- ext4_truncate(inode);
-+ mutex_unlock(&inode->i_mutex);
- nr_truncates++;
- } else {
- ext4_msg(sb, KERN_DEBUG,
-@@ -1975,6 +1977,12 @@ static void ext4_orphan_cleanup(struct super_block *sb,
- * in the vfs. ext4 inode has 48 bits of i_block in fsblock units,
- * so that won't be a limiting factor.
- *
-+ * However there is other limiting factor. We do store extents in the form
-+ * of starting block and length, hence the resulting length of the extent
-+ * covering maximum file size must fit into on-disk format containers as
-+ * well. Given that length is always by 1 unit bigger than max unit (because
-+ * we count 0 as well) we have to lower the s_maxbytes by one fs block.
-+ *
- * Note, this does *not* consider any metadata overhead for vfs i_blocks.
- */
- static loff_t ext4_max_size(int blkbits, int has_huge_files)
-@@ -1996,10 +2004,13 @@ static loff_t ext4_max_size(int blkbits, int has_huge_files)
- upper_limit <<= blkbits;
- }
-
-- /* 32-bit extent-start container, ee_block */
-- res = 1LL << 32;
-+ /*
-+ * 32-bit extent-start container, ee_block. We lower the maxbytes
-+ * by one fs block, so ee_len can cover the extent of maximum file
-+ * size
-+ */
-+ res = (1LL << 32) - 1;
- res <<= blkbits;
-- res -= 1;
-
- /* Sanity check against vm- & vfs- imposed limits */
- if (res > upper_limit)
-diff --git a/fs/fat/inode.c b/fs/fat/inode.c
-index 76b7961..c187e92 100644
---- a/fs/fat/inode.c
-+++ b/fs/fat/inode.c
-@@ -558,7 +558,7 @@ static int fat_statfs(struct dentry *dentry, struct kstatfs *buf)
- buf->f_bavail = sbi->free_clusters;
- buf->f_fsid.val[0] = (u32)id;
- buf->f_fsid.val[1] = (u32)(id >> 32);
-- buf->f_namelen = sbi->options.isvfat ? 260 : 12;
-+ buf->f_namelen = sbi->options.isvfat ? FAT_LFN_LEN : 12;
-
- return 0;
- }
-diff --git a/fs/fat/namei_vfat.c b/fs/fat/namei_vfat.c
-index 72646e2..4251f35 100644
---- a/fs/fat/namei_vfat.c
-+++ b/fs/fat/namei_vfat.c
-@@ -499,17 +499,18 @@ xlate_to_uni(const unsigned char *name, int len, unsigned char *outname,
- int charlen;
-
- if (utf8) {
-- *outlen = utf8s_to_utf16s(name, len, (wchar_t *)outname);
-+ *outlen = utf8s_to_utf16s(name, len, UTF16_HOST_ENDIAN,
-+ (wchar_t *) outname, FAT_LFN_LEN + 2);
- if (*outlen < 0)
- return *outlen;
-- else if (*outlen > 255)
-+ else if (*outlen > FAT_LFN_LEN)
- return -ENAMETOOLONG;
-
- op = &outname[*outlen * sizeof(wchar_t)];
- } else {
- if (nls) {
- for (i = 0, ip = name, op = outname, *outlen = 0;
-- i < len && *outlen <= 255;
-+ i < len && *outlen <= FAT_LFN_LEN;
- *outlen += 1)
- {
- if (escape && (*ip == ':')) {
-@@ -549,7 +550,7 @@ xlate_to_uni(const unsigned char *name, int len, unsigned char *outname,
- return -ENAMETOOLONG;
- } else {
- for (i = 0, ip = name, op = outname, *outlen = 0;
-- i < len && *outlen <= 255;
-+ i < len && *outlen <= FAT_LFN_LEN;
- i++, *outlen += 1)
- {
- *op++ = *ip++;
-diff --git a/fs/fscache/stats.c b/fs/fscache/stats.c
-index 46435f3a..4fd7e1c 100644
---- a/fs/fscache/stats.c
-+++ b/fs/fscache/stats.c
-@@ -276,5 +276,5 @@ const struct file_operations fscache_stats_fops = {
- .open = fscache_stats_open,
- .read = seq_read,
- .llseek = seq_lseek,
-- .release = seq_release,
-+ .release = single_release,
- };
-diff --git a/fs/hfsplus/extents.c b/fs/hfsplus/extents.c
-index 0022eec..b3d234e 100644
---- a/fs/hfsplus/extents.c
-+++ b/fs/hfsplus/extents.c
-@@ -447,7 +447,7 @@ void hfsplus_file_truncate(struct inode *inode)
- struct address_space *mapping = inode->i_mapping;
- struct page *page;
- void *fsdata;
-- u32 size = inode->i_size;
-+ loff_t size = inode->i_size;
- int res;
-
- res = pagecache_write_begin(NULL, mapping, size, 0,
-diff --git a/fs/isofs/export.c b/fs/isofs/export.c
-index e81a305..caec670 100644
---- a/fs/isofs/export.c
-+++ b/fs/isofs/export.c
-@@ -131,6 +131,7 @@ isofs_export_encode_fh(struct dentry *dentry,
- len = 3;
- fh32[0] = ei->i_iget5_block;
- fh16[2] = (__u16)ei->i_iget5_offset; /* fh16 [sic] */
-+ fh16[3] = 0; /* avoid leaking uninitialized data */
- fh32[2] = inode->i_generation;
- if (connectable && !S_ISDIR(inode->i_mode)) {
- struct inode *parent;
-diff --git a/fs/jbd/commit.c b/fs/jbd/commit.c
-index 17d29a8..1060d48 100644
---- a/fs/jbd/commit.c
-+++ b/fs/jbd/commit.c
-@@ -85,7 +85,12 @@ nope:
- static void release_data_buffer(struct buffer_head *bh)
- {
- if (buffer_freed(bh)) {
-+ WARN_ON_ONCE(buffer_dirty(bh));
- clear_buffer_freed(bh);
-+ clear_buffer_mapped(bh);
-+ clear_buffer_new(bh);
-+ clear_buffer_req(bh);
-+ bh->b_bdev = NULL;
- release_buffer_page(bh);
- } else
- put_bh(bh);
-@@ -864,17 +869,35 @@ restart_loop:
- * there's no point in keeping a checkpoint record for
- * it. */
-
-- /* A buffer which has been freed while still being
-- * journaled by a previous transaction may end up still
-- * being dirty here, but we want to avoid writing back
-- * that buffer in the future now that the last use has
-- * been committed. That's not only a performance gain,
-- * it also stops aliasing problems if the buffer is left
-- * behind for writeback and gets reallocated for another
-- * use in a different page. */
-+ /*
-+ * A buffer which has been freed while still being journaled by
-+ * a previous transaction.
-+ */
- if (buffer_freed(bh)) {
-- clear_buffer_freed(bh);
-- clear_buffer_jbddirty(bh);
-+ /*
-+ * If the running transaction is the one containing
-+ * "add to orphan" operation (b_next_transaction !=
-+ * NULL), we have to wait for that transaction to
-+ * commit before we can really get rid of the buffer.
-+ * So just clear b_modified to not confuse transaction
-+ * credit accounting and refile the buffer to
-+ * BJ_Forget of the running transaction. If the just
-+ * committed transaction contains "add to orphan"
-+ * operation, we can completely invalidate the buffer
-+ * now. We are rather throughout in that since the
-+ * buffer may be still accessible when blocksize <
-+ * pagesize and it is attached to the last partial
-+ * page.
-+ */
-+ jh->b_modified = 0;
-+ if (!jh->b_next_transaction) {
-+ clear_buffer_freed(bh);
-+ clear_buffer_jbddirty(bh);
-+ clear_buffer_mapped(bh);
-+ clear_buffer_new(bh);
-+ clear_buffer_req(bh);
-+ bh->b_bdev = NULL;
-+ }
- }
-
- if (buffer_jbddirty(bh)) {
-diff --git a/fs/jbd/transaction.c b/fs/jbd/transaction.c
-index 006f9ad..1352e60 100644
---- a/fs/jbd/transaction.c
-+++ b/fs/jbd/transaction.c
-@@ -1838,15 +1838,16 @@ static int __dispose_buffer(struct journal_head *jh, transaction_t *transaction)
- * We're outside-transaction here. Either or both of j_running_transaction
- * and j_committing_transaction may be NULL.
- */
--static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh)
-+static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh,
-+ int partial_page)
- {
- transaction_t *transaction;
- struct journal_head *jh;
- int may_free = 1;
-- int ret;
-
- BUFFER_TRACE(bh, "entry");
-
-+retry:
- /*
- * It is safe to proceed here without the j_list_lock because the
- * buffers cannot be stolen by try_to_free_buffers as long as we are
-@@ -1864,6 +1865,29 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh)
- if (!jh)
- goto zap_buffer_no_jh;
-
-+ /*
-+ * We cannot remove the buffer from checkpoint lists until the
-+ * transaction adding inode to orphan list (let's call it T)
-+ * is committed. Otherwise if the transaction changing the
-+ * buffer would be cleaned from the journal before T is
-+ * committed, a crash will cause that the correct contents of
-+ * the buffer will be lost. On the other hand we have to
-+ * clear the buffer dirty bit at latest at the moment when the
-+ * transaction marking the buffer as freed in the filesystem
-+ * structures is committed because from that moment on the
-+ * block can be reallocated and used by a different page.
-+ * Since the block hasn't been freed yet but the inode has
-+ * already been added to orphan list, it is safe for us to add
-+ * the buffer to BJ_Forget list of the newest transaction.
-+ *
-+ * Also we have to clear buffer_mapped flag of a truncated buffer
-+ * because the buffer_head may be attached to the page straddling
-+ * i_size (can happen only when blocksize < pagesize) and thus the
-+ * buffer_head can be reused when the file is extended again. So we end
-+ * up keeping around invalidated buffers attached to transactions'
-+ * BJ_Forget list just to stop checkpointing code from cleaning up
-+ * the transaction this buffer was modified in.
-+ */
- transaction = jh->b_transaction;
- if (transaction == NULL) {
- /* First case: not on any transaction. If it
-@@ -1889,13 +1913,9 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh)
- * committed, the buffer won't be needed any
- * longer. */
- JBUFFER_TRACE(jh, "checkpointed: add to BJ_Forget");
-- ret = __dispose_buffer(jh,
-+ may_free = __dispose_buffer(jh,
- journal->j_running_transaction);
-- journal_put_journal_head(jh);
-- spin_unlock(&journal->j_list_lock);
-- jbd_unlock_bh_state(bh);
-- spin_unlock(&journal->j_state_lock);
-- return ret;
-+ goto zap_buffer;
- } else {
- /* There is no currently-running transaction. So the
- * orphan record which we wrote for this file must have
-@@ -1903,13 +1923,9 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh)
- * the committing transaction, if it exists. */
- if (journal->j_committing_transaction) {
- JBUFFER_TRACE(jh, "give to committing trans");
-- ret = __dispose_buffer(jh,
-+ may_free = __dispose_buffer(jh,
- journal->j_committing_transaction);
-- journal_put_journal_head(jh);
-- spin_unlock(&journal->j_list_lock);
-- jbd_unlock_bh_state(bh);
-- spin_unlock(&journal->j_state_lock);
-- return ret;
-+ goto zap_buffer;
- } else {
- /* The orphan record's transaction has
- * committed. We can cleanse this buffer */
-@@ -1929,16 +1945,31 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh)
- goto zap_buffer;
- }
- /*
-- * If it is committing, we simply cannot touch it. We
-- * can remove it's next_transaction pointer from the
-- * running transaction if that is set, but nothing
-- * else. */
-- set_buffer_freed(bh);
-- if (jh->b_next_transaction) {
-- J_ASSERT(jh->b_next_transaction ==
-- journal->j_running_transaction);
-- jh->b_next_transaction = NULL;
-+ * The buffer is committing, we simply cannot touch
-+ * it. If the page is straddling i_size we have to wait
-+ * for commit and try again.
-+ */
-+ if (partial_page) {
-+ tid_t tid = journal->j_committing_transaction->t_tid;
-+
-+ journal_put_journal_head(jh);
-+ spin_unlock(&journal->j_list_lock);
-+ jbd_unlock_bh_state(bh);
-+ spin_unlock(&journal->j_state_lock);
-+ unlock_buffer(bh);
-+ log_wait_commit(journal, tid);
-+ lock_buffer(bh);
-+ goto retry;
- }
-+ /*
-+ * OK, buffer won't be reachable after truncate. We just set
-+ * j_next_transaction to the running transaction (if there is
-+ * one) and mark buffer as freed so that commit code knows it
-+ * should clear dirty bits when it is done with the buffer.
-+ */
-+ set_buffer_freed(bh);
-+ if (journal->j_running_transaction && buffer_jbddirty(bh))
-+ jh->b_next_transaction = journal->j_running_transaction;
- journal_put_journal_head(jh);
- spin_unlock(&journal->j_list_lock);
- jbd_unlock_bh_state(bh);
-@@ -1957,6 +1988,14 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh)
- }
-
- zap_buffer:
-+ /*
-+ * This is tricky. Although the buffer is truncated, it may be reused
-+ * if blocksize < pagesize and it is attached to the page straddling
-+ * EOF. Since the buffer might have been added to BJ_Forget list of the
-+ * running transaction, journal_get_write_access() won't clear
-+ * b_modified and credit accounting gets confused. So clear b_modified
-+ * here. */
-+ jh->b_modified = 0;
- journal_put_journal_head(jh);
- zap_buffer_no_jh:
- spin_unlock(&journal->j_list_lock);
-@@ -2005,7 +2044,8 @@ void journal_invalidatepage(journal_t *journal,
- if (offset <= curr_off) {
- /* This block is wholly outside the truncation point */
- lock_buffer(bh);
-- may_free &= journal_unmap_buffer(journal, bh);
-+ may_free &= journal_unmap_buffer(journal, bh,
-+ offset > 0);
- unlock_buffer(bh);
- }
- curr_off = next_off;
-@@ -2120,7 +2160,7 @@ void journal_file_buffer(struct journal_head *jh,
- */
- void __journal_refile_buffer(struct journal_head *jh)
- {
-- int was_dirty;
-+ int was_dirty, jlist;
- struct buffer_head *bh = jh2bh(jh);
-
- J_ASSERT_JH(jh, jbd_is_locked_bh_state(bh));
-@@ -2142,8 +2182,13 @@ void __journal_refile_buffer(struct journal_head *jh)
- __journal_temp_unlink_buffer(jh);
- jh->b_transaction = jh->b_next_transaction;
- jh->b_next_transaction = NULL;
-- __journal_file_buffer(jh, jh->b_transaction,
-- jh->b_modified ? BJ_Metadata : BJ_Reserved);
-+ if (buffer_freed(bh))
-+ jlist = BJ_Forget;
-+ else if (jh->b_modified)
-+ jlist = BJ_Metadata;
-+ else
-+ jlist = BJ_Reserved;
-+ __journal_file_buffer(jh, jh->b_transaction, jlist);
- J_ASSERT_JH(jh, jh->b_transaction->t_state == T_RUNNING);
-
- if (was_dirty)
-diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
-index 6d27757..ab87b05 100644
---- a/fs/nfsd/nfs4xdr.c
-+++ b/fs/nfsd/nfs4xdr.c
-@@ -2610,11 +2610,16 @@ nfsd4_encode_read(struct nfsd4_compoundres *resp, __be32 nfserr,
- len = maxcount;
- v = 0;
- while (len > 0) {
-- pn = resp->rqstp->rq_resused++;
-+ pn = resp->rqstp->rq_resused;
-+ if (!resp->rqstp->rq_respages[pn]) { /* ran out of pages */
-+ maxcount -= len;
-+ break;
-+ }
- resp->rqstp->rq_vec[v].iov_base =
- page_address(resp->rqstp->rq_respages[pn]);
- resp->rqstp->rq_vec[v].iov_len =
- len < PAGE_SIZE ? len : PAGE_SIZE;
-+ resp->rqstp->rq_resused++;
- v++;
- len -= PAGE_SIZE;
- }
-@@ -2662,6 +2667,8 @@ nfsd4_encode_readlink(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd
- return nfserr;
- if (resp->xbuf->page_len)
- return nfserr_resource;
-+ if (!resp->rqstp->rq_respages[resp->rqstp->rq_resused])
-+ return nfserr_resource;
-
- page = page_address(resp->rqstp->rq_respages[resp->rqstp->rq_resused++]);
-
-@@ -2711,6 +2718,8 @@ nfsd4_encode_readdir(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4
- return nfserr;
- if (resp->xbuf->page_len)
- return nfserr_resource;
-+ if (!resp->rqstp->rq_respages[resp->rqstp->rq_resused])
-+ return nfserr_resource;
-
- RESERVE_SPACE(8); /* verifier */
- savep = p;
-diff --git a/fs/nls/nls_base.c b/fs/nls/nls_base.c
-index 44a88a9..0eb059e 100644
---- a/fs/nls/nls_base.c
-+++ b/fs/nls/nls_base.c
-@@ -114,34 +114,57 @@ int utf32_to_utf8(unicode_t u, u8 *s, int maxlen)
- }
- EXPORT_SYMBOL(utf32_to_utf8);
-
--int utf8s_to_utf16s(const u8 *s, int len, wchar_t *pwcs)
-+static inline void put_utf16(wchar_t *s, unsigned c, enum utf16_endian endian)
-+{
-+ switch (endian) {
-+ default:
-+ *s = (wchar_t) c;
-+ break;
-+ case UTF16_LITTLE_ENDIAN:
-+ *s = __cpu_to_le16(c);
-+ break;
-+ case UTF16_BIG_ENDIAN:
-+ *s = __cpu_to_be16(c);
-+ break;
-+ }
-+}
-+
-+int utf8s_to_utf16s(const u8 *s, int len, enum utf16_endian endian,
-+ wchar_t *pwcs, int maxlen)
- {
- u16 *op;
- int size;
- unicode_t u;
-
- op = pwcs;
-- while (*s && len > 0) {
-+ while (len > 0 && maxlen > 0 && *s) {
- if (*s & 0x80) {
- size = utf8_to_utf32(s, len, &u);
- if (size < 0)
- return -EINVAL;
-+ s += size;
-+ len -= size;
-
- if (u >= PLANE_SIZE) {
-+ if (maxlen < 2)
-+ break;
- u -= PLANE_SIZE;
-- *op++ = (wchar_t) (SURROGATE_PAIR |
-- ((u >> 10) & SURROGATE_BITS));
-- *op++ = (wchar_t) (SURROGATE_PAIR |
-+ put_utf16(op++, SURROGATE_PAIR |
-+ ((u >> 10) & SURROGATE_BITS),
-+ endian);
-+ put_utf16(op++, SURROGATE_PAIR |
- SURROGATE_LOW |
-- (u & SURROGATE_BITS));
-+ (u & SURROGATE_BITS),
-+ endian);
-+ maxlen -= 2;
- } else {
-- *op++ = (wchar_t) u;
-+ put_utf16(op++, u, endian);
-+ maxlen--;
- }
-- s += size;
-- len -= size;
- } else {
-- *op++ = *s++;
-+ put_utf16(op++, *s++, endian);
- len--;
-+ maxlen--;
- }
- }
- return op - pwcs;
-diff --git a/fs/splice.c b/fs/splice.c
-index bb92b7c5..cdad986 100644
---- a/fs/splice.c
-+++ b/fs/splice.c
-@@ -30,6 +30,7 @@
- #include <linux/syscalls.h>
- #include <linux/uio.h>
- #include <linux/security.h>
-+#include <linux/socket.h>
-
- /*
- * Attempt to steal a page from a pipe buffer. This should perhaps go into
-@@ -637,7 +638,11 @@ static int pipe_to_sendpage(struct pipe_inode_info *pipe,
-
- ret = buf->ops->confirm(pipe, buf);
- if (!ret) {
-- more = (sd->flags & SPLICE_F_MORE) || sd->len < sd->total_len;
-+ more = (sd->flags & SPLICE_F_MORE) ? MSG_MORE : 0;
-+
-+ if (sd->len < sd->total_len && pipe->nrbufs > 1)
-+ more |= MSG_SENDPAGE_NOTLAST;
-+
- if (file->f_op && file->f_op->sendpage)
- ret = file->f_op->sendpage(file, buf->page, buf->offset,
- sd->len, &pos, more);
-diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
-index e020183..5e7279a 100644
---- a/fs/sysfs/dir.c
-+++ b/fs/sysfs/dir.c
-@@ -440,20 +440,18 @@ int __sysfs_add_one(struct sysfs_addrm_cxt *acxt, struct sysfs_dirent *sd)
- /**
- * sysfs_pathname - return full path to sysfs dirent
- * @sd: sysfs_dirent whose path we want
-- * @path: caller allocated buffer
-+ * @path: caller allocated buffer of size PATH_MAX
- *
- * Gives the name "/" to the sysfs_root entry; any path returned
- * is relative to wherever sysfs is mounted.
-- *
-- * XXX: does no error checking on @path size
- */
- static char *sysfs_pathname(struct sysfs_dirent *sd, char *path)
- {
- if (sd->s_parent) {
- sysfs_pathname(sd->s_parent, path);
-- strcat(path, "/");
-+ strlcat(path, "/", PATH_MAX);
- }
-- strcat(path, sd->s_name);
-+ strlcat(path, sd->s_name, PATH_MAX);
- return path;
- }
-
-@@ -486,9 +484,11 @@ int sysfs_add_one(struct sysfs_addrm_cxt *acxt, struct sysfs_dirent *sd)
- char *path = kzalloc(PATH_MAX, GFP_KERNEL);
- WARN(1, KERN_WARNING
- "sysfs: cannot create duplicate filename '%s'\n",
-- (path == NULL) ? sd->s_name :
-- strcat(strcat(sysfs_pathname(acxt->parent_sd, path), "/"),
-- sd->s_name));
-+ (path == NULL) ? sd->s_name
-+ : (sysfs_pathname(acxt->parent_sd, path),
-+ strlcat(path, "/", PATH_MAX),
-+ strlcat(path, sd->s_name, PATH_MAX),
-+ path));
- kfree(path);
- }
-
-diff --git a/fs/udf/inode.c b/fs/udf/inode.c
-index 6d24c2c..3c4ffb2 100644
---- a/fs/udf/inode.c
-+++ b/fs/udf/inode.c
-@@ -648,6 +648,8 @@ static struct buffer_head *inode_getblk(struct inode *inode, sector_t block,
- goal, err);
- if (!newblocknum) {
- brelse(prev_epos.bh);
-+ brelse(cur_epos.bh);
-+ brelse(next_epos.bh);
- *err = -ENOSPC;
- return NULL;
- }
-@@ -678,6 +680,8 @@ static struct buffer_head *inode_getblk(struct inode *inode, sector_t block,
- udf_update_extents(inode, laarr, startnum, endnum, &prev_epos);
-
- brelse(prev_epos.bh);
-+ brelse(cur_epos.bh);
-+ brelse(next_epos.bh);
-
- newblock = udf_get_pblock(inode->i_sb, newblocknum,
- iinfo->i_location.partitionReferenceNum, 0);
-diff --git a/fs/udf/namei.c b/fs/udf/namei.c
-index 21dad8c..b754151 100644
---- a/fs/udf/namei.c
-+++ b/fs/udf/namei.c
-@@ -1331,6 +1331,7 @@ static int udf_encode_fh(struct dentry *de, __u32 *fh, int *lenp,
- *lenp = 3;
- fid->udf.block = location.logicalBlockNum;
- fid->udf.partref = location.partitionReferenceNum;
-+ fid->udf.parent_partref = 0;
- fid->udf.generation = inode->i_generation;
-
- if (connectable && !S_ISDIR(inode->i_mode)) {
-diff --git a/fs/udf/udf_sb.h b/fs/udf/udf_sb.h
-index d113b72..efa82c9 100644
---- a/fs/udf/udf_sb.h
-+++ b/fs/udf/udf_sb.h
-@@ -78,7 +78,7 @@ struct udf_virtual_data {
- struct udf_bitmap {
- __u32 s_extLength;
- __u32 s_extPosition;
-- __u16 s_nr_groups;
-+ int s_nr_groups;
- struct buffer_head **s_block_bitmap;
- };
-
-diff --git a/include/asm-generic/signal.h b/include/asm-generic/signal.h
-index 555c0ae..743f7a5 100644
---- a/include/asm-generic/signal.h
-+++ b/include/asm-generic/signal.h
-@@ -99,6 +99,10 @@ typedef unsigned long old_sigset_t;
-
- #include <asm-generic/signal-defs.h>
-
-+#ifdef SA_RESTORER
-+#define __ARCH_HAS_SA_RESTORER
-+#endif
-+
- struct sigaction {
- __sighandler_t sa_handler;
- unsigned long sa_flags;
-diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
-index a3d802e..9ffffec 100644
---- a/include/linux/binfmts.h
-+++ b/include/linux/binfmts.h
-@@ -71,8 +71,6 @@ extern struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
- #define BINPRM_FLAGS_EXECFD_BIT 1
- #define BINPRM_FLAGS_EXECFD (1 << BINPRM_FLAGS_EXECFD_BIT)
-
--#define BINPRM_MAX_RECURSION 4
--
- /*
- * This structure defines the functions that are used to load the binary formats that
- * linux accepts.
-@@ -122,6 +120,7 @@ extern int setup_arg_pages(struct linux_binprm * bprm,
- unsigned long stack_top,
- int executable_stack);
- extern int bprm_mm_init(struct linux_binprm *bprm);
-+extern int bprm_change_interp(char *interp, struct linux_binprm *bprm);
- extern int copy_strings_kernel(int argc,char ** argv,struct linux_binprm *bprm);
- extern int prepare_bprm_creds(struct linux_binprm *bprm);
- extern void install_exec_creds(struct linux_binprm *bprm);
-diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
-index 5eb6cb0..ec9c10b 100644
---- a/include/linux/blkdev.h
-+++ b/include/linux/blkdev.h
-@@ -456,8 +456,7 @@ struct request_queue
- #define QUEUE_FLAG_NONROT 14 /* non-rotational device (SSD) */
- #define QUEUE_FLAG_VIRT QUEUE_FLAG_NONROT /* paravirt device */
- #define QUEUE_FLAG_IO_STAT 15 /* do IO stats */
--#define QUEUE_FLAG_CQ 16 /* hardware does queuing */
--#define QUEUE_FLAG_DISCARD 17 /* supports DISCARD */
-+#define QUEUE_FLAG_DISCARD 16 /* supports DISCARD */
-
- #define QUEUE_FLAG_DEFAULT ((1 << QUEUE_FLAG_IO_STAT) | \
- (1 << QUEUE_FLAG_STACKABLE) | \
-@@ -580,7 +579,6 @@ enum {
-
- #define blk_queue_plugged(q) test_bit(QUEUE_FLAG_PLUGGED, &(q)->queue_flags)
- #define blk_queue_tagged(q) test_bit(QUEUE_FLAG_QUEUED, &(q)->queue_flags)
--#define blk_queue_queuing(q) test_bit(QUEUE_FLAG_CQ, &(q)->queue_flags)
- #define blk_queue_stopped(q) test_bit(QUEUE_FLAG_STOPPED, &(q)->queue_flags)
- #define blk_queue_nomerges(q) test_bit(QUEUE_FLAG_NOMERGES, &(q)->queue_flags)
- #define blk_queue_nonrot(q) test_bit(QUEUE_FLAG_NONROT, &(q)->queue_flags)
-diff --git a/include/linux/kmod.h b/include/linux/kmod.h
-index 0546fe7..93e732e 100644
---- a/include/linux/kmod.h
-+++ b/include/linux/kmod.h
-@@ -64,6 +64,8 @@ enum umh_wait {
- UMH_WAIT_PROC = 1, /* wait for the process to complete */
- };
-
-+#define UMH_KILLABLE 4 /* wait for EXEC/PROC killable */
-+
- /* Actually execute the sub-process */
- int call_usermodehelper_exec(struct subprocess_info *info, enum umh_wait wait);
-
-diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h
-index 085c903..e68b592 100644
---- a/include/linux/mempolicy.h
-+++ b/include/linux/mempolicy.h
-@@ -180,7 +180,7 @@ struct sp_node {
-
- struct shared_policy {
- struct rb_root root;
-- spinlock_t lock;
-+ struct mutex mutex;
- };
-
- void mpol_shared_policy_init(struct shared_policy *sp, struct mempolicy *mpol);
-diff --git a/include/linux/msdos_fs.h b/include/linux/msdos_fs.h
-index ce38f1c..34066e6 100644
---- a/include/linux/msdos_fs.h
-+++ b/include/linux/msdos_fs.h
-@@ -15,6 +15,7 @@
- #define MSDOS_DPB_BITS 4 /* log2(MSDOS_DPB) */
- #define MSDOS_DPS (SECTOR_SIZE / sizeof(struct msdos_dir_entry))
- #define MSDOS_DPS_BITS 4 /* log2(MSDOS_DPS) */
-+#define MSDOS_LONGNAME 256 /* maximum name length */
- #define CF_LE_W(v) le16_to_cpu(v)
- #define CF_LE_L(v) le32_to_cpu(v)
- #define CT_LE_W(v) cpu_to_le16(v)
-@@ -47,8 +48,8 @@
- #define DELETED_FLAG 0xe5 /* marks file as deleted when in name[0] */
- #define IS_FREE(n) (!*(n) || *(n) == DELETED_FLAG)
-
-+#define FAT_LFN_LEN 255 /* maximum long name length */
- #define MSDOS_NAME 11 /* maximum name length */
--#define MSDOS_LONGNAME 256 /* maximum name length */
- #define MSDOS_SLOTS 21 /* max # of slots for short and long names */
- #define MSDOS_DOT ". " /* ".", padded to MSDOS_NAME chars */
- #define MSDOS_DOTDOT ".. " /* "..", padded to MSDOS_NAME chars */
-diff --git a/include/linux/nls.h b/include/linux/nls.h
-index d47beef..5dc635f 100644
---- a/include/linux/nls.h
-+++ b/include/linux/nls.h
-@@ -43,7 +43,7 @@ enum utf16_endian {
- UTF16_BIG_ENDIAN
- };
-
--/* nls.c */
-+/* nls_base.c */
- extern int register_nls(struct nls_table *);
- extern int unregister_nls(struct nls_table *);
- extern struct nls_table *load_nls(char *);
-@@ -52,7 +52,8 @@ extern struct nls_table *load_nls_default(void);
-
- extern int utf8_to_utf32(const u8 *s, int len, unicode_t *pu);
- extern int utf32_to_utf8(unicode_t u, u8 *s, int maxlen);
--extern int utf8s_to_utf16s(const u8 *s, int len, wchar_t *pwcs);
-+extern int utf8s_to_utf16s(const u8 *s, int len,
-+ enum utf16_endian endian, wchar_t *pwcs, int maxlen);
- extern int utf16s_to_utf8s(const wchar_t *pwcs, int len,
- enum utf16_endian endian, u8 *s, int maxlen);
-
-diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
-index 6b202b1..f451772 100644
---- a/include/linux/page-flags.h
-+++ b/include/linux/page-flags.h
-@@ -362,7 +362,7 @@ static inline int PageCompound(struct page *page)
- * pages on the LRU and/or pagecache.
- */
- TESTPAGEFLAG(Compound, compound)
--__PAGEFLAG(Head, compound)
-+__SETPAGEFLAG(Head, compound) __CLEARPAGEFLAG(Head, compound)
-
- /*
- * PG_reclaim is used in combination with PG_compound to mark the
-@@ -374,8 +374,14 @@ __PAGEFLAG(Head, compound)
- * PG_compound & PG_reclaim => Tail page
- * PG_compound & ~PG_reclaim => Head page
- */
-+#define PG_head_mask ((1L << PG_compound))
- #define PG_head_tail_mask ((1L << PG_compound) | (1L << PG_reclaim))
-
-+static inline int PageHead(struct page *page)
-+{
-+ return ((page->flags & PG_head_tail_mask) == PG_head_mask);
-+}
-+
- static inline int PageTail(struct page *page)
- {
- return ((page->flags & PG_head_tail_mask) == PG_head_tail_mask);
-diff --git a/include/linux/sched.h b/include/linux/sched.h
-index 71849bf..73c3b9b 100644
---- a/include/linux/sched.h
-+++ b/include/linux/sched.h
-@@ -2459,7 +2459,16 @@ static inline void thread_group_cputime_free(struct signal_struct *sig)
- extern void recalc_sigpending_and_wake(struct task_struct *t);
- extern void recalc_sigpending(void);
-
--extern void signal_wake_up(struct task_struct *t, int resume_stopped);
-+extern void signal_wake_up_state(struct task_struct *t, unsigned int state);
-+
-+static inline void signal_wake_up(struct task_struct *t, bool resume)
-+{
-+ signal_wake_up_state(t, resume ? TASK_WAKEKILL : 0);
-+}
-+static inline void ptrace_signal_wake_up(struct task_struct *t, bool resume)
-+{
-+ signal_wake_up_state(t, resume ? __TASK_TRACED : 0);
-+}
-
- /*
- * Wrappers for p->thread_info->cpu access. No-op on UP.
-diff --git a/include/linux/socket.h b/include/linux/socket.h
-index 3273a0c..3124c51 100644
---- a/include/linux/socket.h
-+++ b/include/linux/socket.h
-@@ -246,7 +246,7 @@ struct ucred {
- #define MSG_ERRQUEUE 0x2000 /* Fetch message from error queue */
- #define MSG_NOSIGNAL 0x4000 /* Do not generate SIGPIPE */
- #define MSG_MORE 0x8000 /* Sender will send more */
--
-+#define MSG_SENDPAGE_NOTLAST 0x20000 /* sendpage() internal : not the last page */
- #define MSG_EOF MSG_FIN
-
- #define MSG_CMSG_CLOEXEC 0x40000000 /* Set close_on_exit for file
-diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
-index 47004f3..cf65e77 100644
---- a/include/net/inet_sock.h
-+++ b/include/net/inet_sock.h
-@@ -56,7 +56,15 @@ struct ip_options {
- unsigned char __data[0];
- };
-
--#define optlength(opt) (sizeof(struct ip_options) + opt->optlen)
-+struct ip_options_rcu {
-+ struct rcu_head rcu;
-+ struct ip_options opt;
-+};
-+
-+struct ip_options_data {
-+ struct ip_options_rcu opt;
-+ char data[40];
-+};
-
- struct inet_request_sock {
- struct request_sock req;
-@@ -77,7 +85,7 @@ struct inet_request_sock {
- acked : 1,
- no_srccheck: 1;
- kmemcheck_bitfield_end(flags);
-- struct ip_options *opt;
-+ struct ip_options_rcu *opt;
- };
-
- static inline struct inet_request_sock *inet_rsk(const struct request_sock *sk)
-@@ -122,7 +130,7 @@ struct inet_sock {
- __be32 saddr;
- __s16 uc_ttl;
- __u16 cmsg_flags;
-- struct ip_options *opt;
-+ struct ip_options_rcu *inet_opt;
- __be16 sport;
- __u16 id;
- __u8 tos;
-diff --git a/include/net/ip.h b/include/net/ip.h
-index 69db943..a7d4675 100644
---- a/include/net/ip.h
-+++ b/include/net/ip.h
-@@ -54,7 +54,7 @@ struct ipcm_cookie
- {
- __be32 addr;
- int oif;
-- struct ip_options *opt;
-+ struct ip_options_rcu *opt;
- union skb_shared_tx shtx;
- };
-
-@@ -92,7 +92,7 @@ extern int igmp_mc_proc_init(void);
-
- extern int ip_build_and_send_pkt(struct sk_buff *skb, struct sock *sk,
- __be32 saddr, __be32 daddr,
-- struct ip_options *opt);
-+ struct ip_options_rcu *opt);
- extern int ip_rcv(struct sk_buff *skb, struct net_device *dev,
- struct packet_type *pt, struct net_device *orig_dev);
- extern int ip_local_deliver(struct sk_buff *skb);
-@@ -362,14 +362,15 @@ extern int ip_forward(struct sk_buff *skb);
- * Functions provided by ip_options.c
- */
-
--extern void ip_options_build(struct sk_buff *skb, struct ip_options *opt, __be32 daddr, struct rtable *rt, int is_frag);
-+extern void ip_options_build(struct sk_buff *skb, struct ip_options *opt,
-+ __be32 daddr, struct rtable *rt, int is_frag);
- extern int ip_options_echo(struct ip_options *dopt, struct sk_buff *skb);
- extern void ip_options_fragment(struct sk_buff *skb);
- extern int ip_options_compile(struct net *net,
- struct ip_options *opt, struct sk_buff *skb);
--extern int ip_options_get(struct net *net, struct ip_options **optp,
-+extern int ip_options_get(struct net *net, struct ip_options_rcu **optp,
- unsigned char *data, int optlen);
--extern int ip_options_get_from_user(struct net *net, struct ip_options **optp,
-+extern int ip_options_get_from_user(struct net *net, struct ip_options_rcu **optp,
- unsigned char __user *data, int optlen);
- extern void ip_options_undo(struct ip_options * opt);
- extern void ip_forward_options(struct sk_buff *skb);
-diff --git a/include/net/ipv6.h b/include/net/ipv6.h
-index 639bbf0..52d86da 100644
---- a/include/net/ipv6.h
-+++ b/include/net/ipv6.h
-@@ -449,17 +449,7 @@ static inline int ipv6_addr_diff(const struct in6_addr *a1, const struct in6_add
- return __ipv6_addr_diff(a1, a2, sizeof(struct in6_addr));
- }
-
--static __inline__ void ipv6_select_ident(struct frag_hdr *fhdr)
--{
-- static u32 ipv6_fragmentation_id = 1;
-- static DEFINE_SPINLOCK(ip6_id_lock);
--
-- spin_lock_bh(&ip6_id_lock);
-- fhdr->identification = htonl(ipv6_fragmentation_id);
-- if (++ipv6_fragmentation_id == 0)
-- ipv6_fragmentation_id = 1;
-- spin_unlock_bh(&ip6_id_lock);
--}
-+extern void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt);
-
- /*
- * Prototypes exported by ipv6
-diff --git a/include/net/transp_v6.h b/include/net/transp_v6.h
-index d65381c..8beefe1 100644
---- a/include/net/transp_v6.h
-+++ b/include/net/transp_v6.h
-@@ -16,6 +16,8 @@ extern struct proto tcpv6_prot;
-
- struct flowi;
-
-+extern void initialize_hashidentrnd(void);
-+
- /* extention headers */
- extern int ipv6_exthdrs_init(void);
- extern void ipv6_exthdrs_exit(void);
-diff --git a/include/scsi/scsi.h b/include/scsi/scsi.h
-index 34c46ab..b3cffec 100644
---- a/include/scsi/scsi.h
-+++ b/include/scsi/scsi.h
-@@ -145,10 +145,10 @@ struct scsi_cmnd;
-
- /* defined in T10 SCSI Primary Commands-2 (SPC2) */
- struct scsi_varlen_cdb_hdr {
-- u8 opcode; /* opcode always == VARIABLE_LENGTH_CMD */
-- u8 control;
-- u8 misc[5];
-- u8 additional_cdb_length; /* total cdb length - 8 */
-+ __u8 opcode; /* opcode always == VARIABLE_LENGTH_CMD */
-+ __u8 control;
-+ __u8 misc[5];
-+ __u8 additional_cdb_length; /* total cdb length - 8 */
- __be16 service_action;
- /* service specific data follows */
- };
-diff --git a/include/scsi/scsi_netlink.h b/include/scsi/scsi_netlink.h
-index 536752c..58ce8fe 100644
---- a/include/scsi/scsi_netlink.h
-+++ b/include/scsi/scsi_netlink.h
-@@ -105,8 +105,8 @@ struct scsi_nl_host_vendor_msg {
- * PCI : ID data is the 16 bit PCI Registered Vendor ID
- */
- #define SCSI_NL_VID_TYPE_SHIFT 56
--#define SCSI_NL_VID_TYPE_MASK ((u64)0xFF << SCSI_NL_VID_TYPE_SHIFT)
--#define SCSI_NL_VID_TYPE_PCI ((u64)0x01 << SCSI_NL_VID_TYPE_SHIFT)
-+#define SCSI_NL_VID_TYPE_MASK ((__u64)0xFF << SCSI_NL_VID_TYPE_SHIFT)
-+#define SCSI_NL_VID_TYPE_PCI ((__u64)0x01 << SCSI_NL_VID_TYPE_SHIFT)
- #define SCSI_NL_VID_ID_MASK (~ SCSI_NL_VID_TYPE_MASK)
-
-
-diff --git a/include/trace/events/kmem.h b/include/trace/events/kmem.h
-index eaf46bd..a8dc32a 100644
---- a/include/trace/events/kmem.h
-+++ b/include/trace/events/kmem.h
-@@ -293,7 +293,7 @@ TRACE_EVENT(mm_page_alloc,
-
- TP_printk("page=%p pfn=%lu order=%d migratetype=%d gfp_flags=%s",
- __entry->page,
-- page_to_pfn(__entry->page),
-+ __entry->page ? page_to_pfn(__entry->page) : 0,
- __entry->order,
- __entry->migratetype,
- show_gfp_flags(__entry->gfp_flags))
-@@ -319,7 +319,7 @@ TRACE_EVENT(mm_page_alloc_zone_locked,
-
- TP_printk("page=%p pfn=%lu order=%u migratetype=%d percpu_refill=%d",
- __entry->page,
-- page_to_pfn(__entry->page),
-+ __entry->page ? page_to_pfn(__entry->page) : 0,
- __entry->order,
- __entry->migratetype,
- __entry->order == 0)
-diff --git a/kernel/async.c b/kernel/async.c
-index 27235f5..397a7c7 100644
---- a/kernel/async.c
-+++ b/kernel/async.c
-@@ -93,6 +93,13 @@ static async_cookie_t __lowest_in_progress(struct list_head *running)
- {
- struct async_entry *entry;
-
-+ if (!running) { /* just check the entry count */
-+ if (atomic_read(&entry_count))
-+ return 0; /* smaller than any cookie */
-+ else
-+ return next_cookie;
-+ }
-+
- if (!list_empty(running)) {
- entry = list_first_entry(running,
- struct async_entry, list);
-@@ -248,9 +255,7 @@ EXPORT_SYMBOL_GPL(async_schedule_domain);
- */
- void async_synchronize_full(void)
- {
-- do {
-- async_synchronize_cookie(next_cookie);
-- } while (!list_empty(&async_running) || !list_empty(&async_pending));
-+ async_synchronize_cookie_domain(next_cookie, NULL);
- }
- EXPORT_SYMBOL_GPL(async_synchronize_full);
-
-@@ -270,7 +275,7 @@ EXPORT_SYMBOL_GPL(async_synchronize_full_domain);
- /**
- * async_synchronize_cookie_domain - synchronize asynchronous function calls within a certain domain with cookie checkpointing
- * @cookie: async_cookie_t to use as checkpoint
-- * @running: running list to synchronize on
-+ * @running: running list to synchronize on, NULL indicates all lists
- *
- * This function waits until all asynchronous function calls for the
- * synchronization domain specified by the running list @list submitted
-diff --git a/kernel/cgroup.c b/kernel/cgroup.c
-index 1fbcc74..04a9704 100644
---- a/kernel/cgroup.c
-+++ b/kernel/cgroup.c
-@@ -1992,9 +1992,7 @@ static int cgroup_create_dir(struct cgroup *cgrp, struct dentry *dentry,
- dentry->d_fsdata = cgrp;
- inc_nlink(parent->d_inode);
- rcu_assign_pointer(cgrp->dentry, dentry);
-- dget(dentry);
- }
-- dput(dentry);
-
- return error;
- }
-diff --git a/kernel/kmod.c b/kernel/kmod.c
-index a061472..8ecc509 100644
---- a/kernel/kmod.c
-+++ b/kernel/kmod.c
-@@ -53,6 +53,50 @@ static DECLARE_RWSEM(umhelper_sem);
- */
- char modprobe_path[KMOD_PATH_LEN] = "/sbin/modprobe";
-
-+static void free_modprobe_argv(char **argv, char **envp)
-+{
-+ kfree(argv[3]); /* check call_modprobe() */
-+ kfree(argv);
-+}
-+
-+static int call_modprobe(char *module_name, int wait)
-+{
-+ static char *envp[] = { "HOME=/",
-+ "TERM=linux",
-+ "PATH=/sbin:/usr/sbin:/bin:/usr/bin",
-+ NULL };
-+ struct subprocess_info *info;
-+
-+ char **argv = kmalloc(sizeof(char *[5]), GFP_KERNEL);
-+ if (!argv)
-+ goto out;
-+
-+ module_name = kstrdup(module_name, GFP_KERNEL);
-+ if (!module_name)
-+ goto free_argv;
-+
-+ argv[0] = modprobe_path;
-+ argv[1] = "-q";
-+ argv[2] = "--";
-+ argv[3] = module_name; /* check free_modprobe_argv() */
-+ argv[4] = NULL;
-+
-+ info = call_usermodehelper_setup(argv[0], argv, envp, GFP_ATOMIC);
-+ if (!info)
-+ goto free_module_name;
-+
-+ call_usermodehelper_setcleanup(info, free_modprobe_argv);
-+
-+ return call_usermodehelper_exec(info, wait | UMH_KILLABLE);
-+
-+free_module_name:
-+ kfree(module_name);
-+free_argv:
-+ kfree(argv);
-+out:
-+ return -ENOMEM;
-+}
-+
- /**
- * __request_module - try to load a kernel module
- * @wait: wait (or not) for the operation to complete
-@@ -74,11 +118,6 @@ int __request_module(bool wait, const char *fmt, ...)
- char module_name[MODULE_NAME_LEN];
- unsigned int max_modprobes;
- int ret;
-- char *argv[] = { modprobe_path, "-q", "--", module_name, NULL };
-- static char *envp[] = { "HOME=/",
-- "TERM=linux",
-- "PATH=/sbin:/usr/sbin:/bin:/usr/bin",
-- NULL };
- static atomic_t kmod_concurrent = ATOMIC_INIT(0);
- #define MAX_KMOD_CONCURRENT 50 /* Completely arbitrary value - KAO */
- static int kmod_loop_msg;
-@@ -121,8 +160,8 @@ int __request_module(bool wait, const char *fmt, ...)
-
- trace_module_request(module_name, wait, _RET_IP_);
-
-- ret = call_usermodehelper(modprobe_path, argv, envp,
-- wait ? UMH_WAIT_PROC : UMH_WAIT_EXEC);
-+ ret = call_modprobe(module_name, wait ? UMH_WAIT_PROC : UMH_WAIT_EXEC);
-+
- atomic_dec(&kmod_concurrent);
- return ret;
- }
-@@ -193,7 +232,7 @@ static int ____call_usermodehelper(void *data)
-
- /* Exec failed? */
- sub_info->retval = retval;
-- do_exit(0);
-+ return 0;
- }
-
- void call_usermodehelper_freeinfo(struct subprocess_info *info)
-@@ -206,6 +245,19 @@ void call_usermodehelper_freeinfo(struct subprocess_info *info)
- }
- EXPORT_SYMBOL(call_usermodehelper_freeinfo);
-
-+static void umh_complete(struct subprocess_info *sub_info)
-+{
-+ struct completion *comp = xchg(&sub_info->complete, NULL);
-+ /*
-+ * See call_usermodehelper_exec(). If xchg() returns NULL
-+ * we own sub_info, the UMH_KILLABLE caller has gone away.
-+ */
-+ if (comp)
-+ complete(comp);
-+ else
-+ call_usermodehelper_freeinfo(sub_info);
-+}
-+
- /* Keventd can't block, but this (a child) can. */
- static int wait_for_helper(void *data)
- {
-@@ -245,7 +297,7 @@ static int wait_for_helper(void *data)
- if (sub_info->wait == UMH_NO_WAIT)
- call_usermodehelper_freeinfo(sub_info);
- else
-- complete(sub_info->complete);
-+ umh_complete(sub_info);
- return 0;
- }
-
-@@ -259,6 +311,9 @@ static void __call_usermodehelper(struct work_struct *work)
-
- BUG_ON(atomic_read(&sub_info->cred->usage) != 1);
-
-+ if (wait != UMH_NO_WAIT)
-+ wait &= ~UMH_KILLABLE;
-+
- /* CLONE_VFORK: wait until the usermode helper has execve'd
- * successfully We need the data structures to stay around
- * until that is done. */
-@@ -280,7 +335,7 @@ static void __call_usermodehelper(struct work_struct *work)
- /* FALLTHROUGH */
-
- case UMH_WAIT_EXEC:
-- complete(sub_info->complete);
-+ umh_complete(sub_info);
- }
- }
-
-@@ -520,9 +575,21 @@ int call_usermodehelper_exec(struct subprocess_info *sub_info,
- queue_work(khelper_wq, &sub_info->work);
- if (wait == UMH_NO_WAIT) /* task has freed sub_info */
- goto unlock;
-+
-+ if (wait & UMH_KILLABLE) {
-+ retval = wait_for_completion_killable(&done);
-+ if (!retval)
-+ goto wait_done;
-+
-+ /* umh_complete() will see NULL and free sub_info */
-+ if (xchg(&sub_info->complete, NULL))
-+ goto unlock;
-+ /* fallthrough, umh_complete() was already called */
-+ }
-+
- wait_for_completion(&done);
-+wait_done:
- retval = sub_info->retval;
--
- out:
- call_usermodehelper_freeinfo(sub_info);
- unlock:
-diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c
-index 5c9dc22..ea83f5d 100644
---- a/kernel/posix-cpu-timers.c
-+++ b/kernel/posix-cpu-timers.c
-@@ -1537,8 +1537,10 @@ static int do_cpu_nanosleep(const clockid_t which_clock, int flags,
- while (!signal_pending(current)) {
- if (timer.it.cpu.expires.sched == 0) {
- /*
-- * Our timer fired and was reset.
-+ * Our timer fired and was reset, below
-+ * deletion can not fail.
- */
-+ posix_cpu_timer_del(&timer);
- spin_unlock_irq(&timer.it_lock);
- return 0;
- }
-@@ -1556,9 +1558,26 @@ static int do_cpu_nanosleep(const clockid_t which_clock, int flags,
- * We were interrupted by a signal.
- */
- sample_to_timespec(which_clock, timer.it.cpu.expires, rqtp);
-- posix_cpu_timer_set(&timer, 0, &zero_it, it);
-+ error = posix_cpu_timer_set(&timer, 0, &zero_it, it);
-+ if (!error) {
-+ /*
-+ * Timer is now unarmed, deletion can not fail.
-+ */
-+ posix_cpu_timer_del(&timer);
-+ }
- spin_unlock_irq(&timer.it_lock);
-
-+ while (error == TIMER_RETRY) {
-+ /*
-+ * We need to handle case when timer was or is in the
-+ * middle of firing. In other cases we already freed
-+ * resources.
-+ */
-+ spin_lock_irq(&timer.it_lock);
-+ error = posix_cpu_timer_del(&timer);
-+ spin_unlock_irq(&timer.it_lock);
-+ }
-+
- if ((it->it_value.tv_sec | it->it_value.tv_nsec) == 0) {
- /*
- * It actually did fire already.
-diff --git a/kernel/ptrace.c b/kernel/ptrace.c
-index 05625f6..d9c8c47 100644
---- a/kernel/ptrace.c
-+++ b/kernel/ptrace.c
-@@ -56,7 +56,7 @@ static void ptrace_untrace(struct task_struct *child)
- child->signal->group_stop_count)
- __set_task_state(child, TASK_STOPPED);
- else
-- signal_wake_up(child, 1);
-+ ptrace_signal_wake_up(child, true);
- }
- spin_unlock(&child->sighand->siglock);
- }
-@@ -80,6 +80,40 @@ void __ptrace_unlink(struct task_struct *child)
- ptrace_untrace(child);
- }
-
-+/* Ensure that nothing can wake it up, even SIGKILL */
-+static bool ptrace_freeze_traced(struct task_struct *task, int kill)
-+{
-+ bool ret = true;
-+
-+ spin_lock_irq(&task->sighand->siglock);
-+ if (task_is_stopped(task) && !__fatal_signal_pending(task))
-+ task->state = __TASK_TRACED;
-+ else if (!kill) {
-+ if (task_is_traced(task) && !__fatal_signal_pending(task))
-+ task->state = __TASK_TRACED;
-+ else
-+ ret = false;
-+ }
-+ spin_unlock_irq(&task->sighand->siglock);
-+
-+ return ret;
-+}
-+
-+static void ptrace_unfreeze_traced(struct task_struct *task)
-+{
-+ if (task->state != __TASK_TRACED)
-+ return;
-+
-+ WARN_ON(!task->ptrace || task->parent != current);
-+
-+ spin_lock_irq(&task->sighand->siglock);
-+ if (__fatal_signal_pending(task))
-+ wake_up_state(task, __TASK_TRACED);
-+ else
-+ task->state = TASK_TRACED;
-+ spin_unlock_irq(&task->sighand->siglock);
-+}
-+
- /*
- * Check that we have indeed attached to the thing..
- */
-@@ -95,25 +129,29 @@ int ptrace_check_attach(struct task_struct *child, int kill)
- * be changed by us so it's not changing right after this.
- */
- read_lock(&tasklist_lock);
-- if ((child->ptrace & PT_PTRACED) && child->parent == current) {
-- ret = 0;
-+ if (child->ptrace && child->parent == current) {
-+ WARN_ON(child->state == __TASK_TRACED);
- /*
- * child->sighand can't be NULL, release_task()
- * does ptrace_unlink() before __exit_signal().
- */
-- spin_lock_irq(&child->sighand->siglock);
-- if (task_is_stopped(child))
-- child->state = TASK_TRACED;
-- else if (!task_is_traced(child) && !kill)
-- ret = -ESRCH;
-- spin_unlock_irq(&child->sighand->siglock);
-+ if (ptrace_freeze_traced(child, kill))
-+ ret = 0;
- }
- read_unlock(&tasklist_lock);
-
-- if (!ret && !kill)
-- ret = wait_task_inactive(child, TASK_TRACED) ? 0 : -ESRCH;
-+ if (!ret && !kill) {
-+ if (!wait_task_inactive(child, __TASK_TRACED)) {
-+ /*
-+ * This can only happen if may_ptrace_stop() fails and
-+ * ptrace_stop() changes ->state back to TASK_RUNNING,
-+ * so we should not worry about leaking __TASK_TRACED.
-+ */
-+ WARN_ON(child->state == __TASK_TRACED);
-+ ret = -ESRCH;
-+ }
-+ }
-
-- /* All systems go.. */
- return ret;
- }
-
-@@ -506,7 +544,7 @@ static int ptrace_resume(struct task_struct *child, long request, long data)
- }
-
- child->exit_code = data;
-- wake_up_process(child);
-+ wake_up_state(child, __TASK_TRACED);
-
- return 0;
- }
-@@ -637,6 +675,8 @@ SYSCALL_DEFINE4(ptrace, long, request, long, pid, long, addr, long, data)
- goto out_put_task_struct;
-
- ret = arch_ptrace(child, request, addr, data);
-+ if (ret || request != PTRACE_DETACH)
-+ ptrace_unfreeze_traced(child);
-
- out_put_task_struct:
- put_task_struct(child);
-@@ -752,8 +792,11 @@ asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
- }
-
- ret = ptrace_check_attach(child, request == PTRACE_KILL);
-- if (!ret)
-+ if (!ret) {
- ret = compat_arch_ptrace(child, request, addr, data);
-+ if (ret || request != PTRACE_DETACH)
-+ ptrace_unfreeze_traced(child);
-+ }
-
- out_put_task_struct:
- put_task_struct(child);
-diff --git a/kernel/resource.c b/kernel/resource.c
-index fb11a58..207915a 100644
---- a/kernel/resource.c
-+++ b/kernel/resource.c
-@@ -533,6 +533,7 @@ static void __init __reserve_region_with_split(struct resource *root,
- struct resource *parent = root;
- struct resource *conflict;
- struct resource *res = kzalloc(sizeof(*res), GFP_ATOMIC);
-+ struct resource *next_res = NULL;
-
- if (!res)
- return;
-@@ -542,21 +543,46 @@ static void __init __reserve_region_with_split(struct resource *root,
- res->end = end;
- res->flags = IORESOURCE_BUSY;
-
-- conflict = __request_resource(parent, res);
-- if (!conflict)
-- return;
-+ while (1) {
-
-- /* failed, split and try again */
-- kfree(res);
-+ conflict = __request_resource(parent, res);
-+ if (!conflict) {
-+ if (!next_res)
-+ break;
-+ res = next_res;
-+ next_res = NULL;
-+ continue;
-+ }
-
-- /* conflict covered whole area */
-- if (conflict->start <= start && conflict->end >= end)
-- return;
-+ /* conflict covered whole area */
-+ if (conflict->start <= res->start &&
-+ conflict->end >= res->end) {
-+ kfree(res);
-+ WARN_ON(next_res);
-+ break;
-+ }
-+
-+ /* failed, split and try again */
-+ if (conflict->start > res->start) {
-+ end = res->end;
-+ res->end = conflict->start - 1;
-+ if (conflict->end < end) {
-+ next_res = kzalloc(sizeof(*next_res),
-+ GFP_ATOMIC);
-+ if (!next_res) {
-+ kfree(res);
-+ break;
-+ }
-+ next_res->name = name;
-+ next_res->start = conflict->end + 1;
-+ next_res->end = end;
-+ next_res->flags = IORESOURCE_BUSY;
-+ }
-+ } else {
-+ res->start = conflict->end + 1;
-+ }
-+ }
-
-- if (conflict->start > start)
-- __reserve_region_with_split(root, start, conflict->start-1, name);
-- if (conflict->end < end)
-- __reserve_region_with_split(root, conflict->end+1, end, name);
- }
-
- void __init reserve_region_with_split(struct resource *root,
-diff --git a/kernel/sched.c b/kernel/sched.c
-index 0591df8..42bf6a6 100644
---- a/kernel/sched.c
-+++ b/kernel/sched.c
-@@ -2618,7 +2618,8 @@ out:
- */
- int wake_up_process(struct task_struct *p)
- {
-- return try_to_wake_up(p, TASK_ALL, 0);
-+ WARN_ON(task_is_stopped_or_traced(p));
-+ return try_to_wake_up(p, TASK_NORMAL, 0);
- }
- EXPORT_SYMBOL(wake_up_process);
-
-diff --git a/kernel/signal.c b/kernel/signal.c
-index 2494827..fb7e242 100644
---- a/kernel/signal.c
-+++ b/kernel/signal.c
-@@ -320,6 +320,9 @@ flush_signal_handlers(struct task_struct *t, int force_default)
- if (force_default || ka->sa.sa_handler != SIG_IGN)
- ka->sa.sa_handler = SIG_DFL;
- ka->sa.sa_flags = 0;
-+#ifdef __ARCH_HAS_SA_RESTORER
-+ ka->sa.sa_restorer = NULL;
-+#endif
- sigemptyset(&ka->sa.sa_mask);
- ka++;
- }
-@@ -513,23 +516,17 @@ int dequeue_signal(struct task_struct *tsk, sigset_t *mask, siginfo_t *info)
- * No need to set need_resched since signal event passing
- * goes through ->blocked
- */
--void signal_wake_up(struct task_struct *t, int resume)
-+void signal_wake_up_state(struct task_struct *t, unsigned int state)
- {
-- unsigned int mask;
--
- set_tsk_thread_flag(t, TIF_SIGPENDING);
--
- /*
-- * For SIGKILL, we want to wake it up in the stopped/traced/killable
-+ * TASK_WAKEKILL also means wake it up in the stopped/traced/killable
- * case. We don't check t->state here because there is a race with it
- * executing another processor and just now entering stopped state.
- * By using wake_up_state, we ensure the process will wake up and
- * handle its death signal.
- */
-- mask = TASK_INTERRUPTIBLE;
-- if (resume)
-- mask |= TASK_WAKEKILL;
-- if (!wake_up_state(t, mask))
-+ if (!wake_up_state(t, state | TASK_INTERRUPTIBLE))
- kick_process(t);
- }
-
-@@ -1530,6 +1527,10 @@ static inline int may_ptrace_stop(void)
- * If SIGKILL was already sent before the caller unlocked
- * ->siglock we must see ->core_state != NULL. Otherwise it
- * is safe to enter schedule().
-+ *
-+ * This is almost outdated, a task with the pending SIGKILL can't
-+ * block in TASK_TRACED. But PTRACE_EVENT_EXIT can be reported
-+ * after SIGKILL was already dequeued.
- */
- if (unlikely(current->mm->core_state) &&
- unlikely(current->mm == current->parent->mm))
-@@ -2300,7 +2301,7 @@ do_send_specific(pid_t tgid, pid_t pid, int sig, struct siginfo *info)
-
- static int do_tkill(pid_t tgid, pid_t pid, int sig)
- {
-- struct siginfo info;
-+ struct siginfo info = {};
-
- info.si_signo = sig;
- info.si_errno = 0;
-diff --git a/kernel/softirq.c b/kernel/softirq.c
-index 04a0252..d75c136 100644
---- a/kernel/softirq.c
-+++ b/kernel/softirq.c
-@@ -194,21 +194,21 @@ void local_bh_enable_ip(unsigned long ip)
- EXPORT_SYMBOL(local_bh_enable_ip);
-
- /*
-- * We restart softirq processing MAX_SOFTIRQ_RESTART times,
-- * and we fall back to softirqd after that.
-+ * We restart softirq processing for at most 2 ms,
-+ * and if need_resched() is not set.
- *
-- * This number has been established via experimentation.
-+ * These limits have been established via experimentation.
- * The two things to balance is latency against fairness -
- * we want to handle softirqs as soon as possible, but they
- * should not be able to lock up the box.
- */
--#define MAX_SOFTIRQ_RESTART 10
-+#define MAX_SOFTIRQ_TIME msecs_to_jiffies(2)
-
- asmlinkage void __do_softirq(void)
- {
- struct softirq_action *h;
- __u32 pending;
-- int max_restart = MAX_SOFTIRQ_RESTART;
-+ unsigned long end = jiffies + MAX_SOFTIRQ_TIME;
- int cpu;
-
- pending = local_softirq_pending();
-@@ -253,11 +253,12 @@ restart:
- local_irq_disable();
-
- pending = local_softirq_pending();
-- if (pending && --max_restart)
-- goto restart;
-+ if (pending) {
-+ if (time_before(jiffies, end) && !need_resched())
-+ goto restart;
-
-- if (pending)
- wakeup_softirqd();
-+ }
-
- lockdep_softirq_exit();
-
-diff --git a/kernel/sys.c b/kernel/sys.c
-index e9512b1..5a381e6 100644
---- a/kernel/sys.c
-+++ b/kernel/sys.c
-@@ -303,6 +303,7 @@ void kernel_restart_prepare(char *cmd)
- void kernel_restart(char *cmd)
- {
- kernel_restart_prepare(cmd);
-+ disable_nonboot_cpus();
- if (!cmd)
- printk(KERN_EMERG "Restarting system.\n");
- else
-diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
-index 57b953f..67fe3d9 100644
---- a/kernel/time/tick-broadcast.c
-+++ b/kernel/time/tick-broadcast.c
-@@ -67,7 +67,8 @@ static void tick_broadcast_start_periodic(struct clock_event_device *bc)
- */
- int tick_check_broadcast_device(struct clock_event_device *dev)
- {
-- if ((tick_broadcast_device.evtdev &&
-+ if ((dev->features & CLOCK_EVT_FEAT_DUMMY) ||
-+ (tick_broadcast_device.evtdev &&
- tick_broadcast_device.evtdev->rating >= dev->rating) ||
- (dev->features & CLOCK_EVT_FEAT_C3STOP))
- return 0;
-diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
-index b63cfeb..9f0fd18 100644
---- a/kernel/time/tick-sched.c
-+++ b/kernel/time/tick-sched.c
-@@ -765,7 +765,7 @@ void tick_cancel_sched_timer(int cpu)
- hrtimer_cancel(&ts->sched_timer);
- # endif
-
-- ts->nohz_mode = NOHZ_MODE_INACTIVE;
-+ memset(ts, 0, sizeof(*ts));
- }
- #endif
-
-diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
-index 3d35af3..f65a0fb 100644
---- a/kernel/time/timekeeping.c
-+++ b/kernel/time/timekeeping.c
-@@ -809,7 +809,7 @@ void update_wall_time(void)
- #endif
- /* Check if there's really nothing to do */
- if (offset < timekeeper.cycle_interval)
-- return;
-+ goto out;
-
- timekeeper.xtime_nsec = (s64)xtime.tv_nsec << timekeeper.shift;
-
-@@ -881,6 +881,7 @@ void update_wall_time(void)
- timekeeper.ntp_error += timekeeper.xtime_nsec <<
- timekeeper.ntp_error_shift;
-
-+out:
- nsecs = clocksource_cyc2ns(offset, timekeeper.mult, timekeeper.shift);
- update_xtime_cache(nsecs);
-
-diff --git a/kernel/timer.c b/kernel/timer.c
-index cb3c1f1..8123679 100644
---- a/kernel/timer.c
-+++ b/kernel/timer.c
-@@ -1553,12 +1553,12 @@ static int __cpuinit init_timers_cpu(int cpu)
- boot_done = 1;
- base = &boot_tvec_bases;
- }
-+ spin_lock_init(&base->lock);
- tvec_base_done[cpu] = 1;
- } else {
- base = per_cpu(tvec_bases, cpu);
- }
-
-- spin_lock_init(&base->lock);
-
- for (j = 0; j < TVN_SIZE; j++) {
- INIT_LIST_HEAD(base->tv5.vec + j);
-diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
-index 4872937..c5f8ab9 100644
---- a/kernel/trace/ftrace.c
-+++ b/kernel/trace/ftrace.c
-@@ -469,7 +469,6 @@ int ftrace_profile_pages_init(struct ftrace_profile_stat *stat)
- free_page(tmp);
- }
-
-- free_page((unsigned long)stat->pages);
- stat->pages = NULL;
- stat->start = NULL;
-
-diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
-index e749a05..6024960 100644
---- a/kernel/trace/ring_buffer.c
-+++ b/kernel/trace/ring_buffer.c
-@@ -2876,6 +2876,8 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
- * Splice the empty reader page into the list around the head.
- */
- reader = rb_set_head_page(cpu_buffer);
-+ if (!reader)
-+ goto out;
- cpu_buffer->reader_page->list.next = reader->list.next;
- cpu_buffer->reader_page->list.prev = reader->list.prev;
-
-diff --git a/lib/genalloc.c b/lib/genalloc.c
-index eed2bdb..c1fb257 100644
---- a/lib/genalloc.c
-+++ b/lib/genalloc.c
-@@ -52,7 +52,7 @@ int gen_pool_add(struct gen_pool *pool, unsigned long addr, size_t size,
- struct gen_pool_chunk *chunk;
- int nbits = size >> pool->min_alloc_order;
- int nbytes = sizeof(struct gen_pool_chunk) +
-- (nbits + BITS_PER_BYTE - 1) / BITS_PER_BYTE;
-+ BITS_TO_LONGS(nbits) * sizeof(long);
-
- chunk = kmalloc_node(nbytes, GFP_KERNEL | __GFP_ZERO, nid);
- if (unlikely(chunk == NULL))
-diff --git a/mm/hugetlb.c b/mm/hugetlb.c
-index 20f9240..b435d1f 100644
---- a/mm/hugetlb.c
-+++ b/mm/hugetlb.c
-@@ -1772,6 +1772,15 @@ static void hugetlb_vm_op_open(struct vm_area_struct *vma)
- kref_get(&reservations->refs);
- }
-
-+static void resv_map_put(struct vm_area_struct *vma)
-+{
-+ struct resv_map *reservations = vma_resv_map(vma);
-+
-+ if (!reservations)
-+ return;
-+ kref_put(&reservations->refs, resv_map_release);
-+}
-+
- static void hugetlb_vm_op_close(struct vm_area_struct *vma)
- {
- struct hstate *h = hstate_vma(vma);
-@@ -1788,7 +1797,7 @@ static void hugetlb_vm_op_close(struct vm_area_struct *vma)
- reserve = (end - start) -
- region_count(&reservations->regions, start, end);
-
-- kref_put(&reservations->refs, resv_map_release);
-+ resv_map_put(vma);
-
- if (reserve) {
- hugetlb_acct_memory(h, -reserve);
-@@ -2472,12 +2481,16 @@ int hugetlb_reserve_pages(struct inode *inode,
- set_vma_resv_flags(vma, HPAGE_RESV_OWNER);
- }
-
-- if (chg < 0)
-- return chg;
-+ if (chg < 0) {
-+ ret = chg;
-+ goto out_err;
-+ }
-
- /* There must be enough pages in the subpool for the mapping */
-- if (hugepage_subpool_get_pages(spool, chg))
-- return -ENOSPC;
-+ if (hugepage_subpool_get_pages(spool, chg)) {
-+ ret = -ENOSPC;
-+ goto out_err;
-+ }
-
- /*
- * Check enough hugepages are available for the reservation.
-@@ -2486,7 +2499,7 @@ int hugetlb_reserve_pages(struct inode *inode,
- ret = hugetlb_acct_memory(h, chg);
- if (ret < 0) {
- hugepage_subpool_put_pages(spool, chg);
-- return ret;
-+ goto out_err;
- }
-
- /*
-@@ -2503,6 +2516,10 @@ int hugetlb_reserve_pages(struct inode *inode,
- if (!vma || vma->vm_flags & VM_MAYSHARE)
- region_add(&inode->i_mapping->private_list, from, to);
- return 0;
-+out_err:
-+ if (vma)
-+ resv_map_put(vma);
-+ return ret;
- }
-
- void hugetlb_unreserve_pages(struct inode *inode, long offset, long freed)
-diff --git a/mm/mempolicy.c b/mm/mempolicy.c
-index a6563fb..df6602f 100644
---- a/mm/mempolicy.c
-+++ b/mm/mempolicy.c
-@@ -1759,7 +1759,7 @@ int __mpol_equal(struct mempolicy *a, struct mempolicy *b)
- */
-
- /* lookup first element intersecting start-end */
--/* Caller holds sp->lock */
-+/* Caller holds sp->mutex */
- static struct sp_node *
- sp_lookup(struct shared_policy *sp, unsigned long start, unsigned long end)
- {
-@@ -1823,13 +1823,13 @@ mpol_shared_policy_lookup(struct shared_policy *sp, unsigned long idx)
-
- if (!sp->root.rb_node)
- return NULL;
-- spin_lock(&sp->lock);
-+ mutex_lock(&sp->mutex);
- sn = sp_lookup(sp, idx, idx+1);
- if (sn) {
- mpol_get(sn->policy);
- pol = sn->policy;
- }
-- spin_unlock(&sp->lock);
-+ mutex_unlock(&sp->mutex);
- return pol;
- }
-
-@@ -1860,10 +1860,10 @@ static struct sp_node *sp_alloc(unsigned long start, unsigned long end,
- static int shared_policy_replace(struct shared_policy *sp, unsigned long start,
- unsigned long end, struct sp_node *new)
- {
-- struct sp_node *n, *new2 = NULL;
-+ struct sp_node *n;
-+ int ret = 0;
-
--restart:
-- spin_lock(&sp->lock);
-+ mutex_lock(&sp->mutex);
- n = sp_lookup(sp, start, end);
- /* Take care of old policies in the same range. */
- while (n && n->start < end) {
-@@ -1876,16 +1876,14 @@ restart:
- } else {
- /* Old policy spanning whole new range. */
- if (n->end > end) {
-+ struct sp_node *new2;
-+ new2 = sp_alloc(end, n->end, n->policy);
- if (!new2) {
-- spin_unlock(&sp->lock);
-- new2 = sp_alloc(end, n->end, n->policy);
-- if (!new2)
-- return -ENOMEM;
-- goto restart;
-+ ret = -ENOMEM;
-+ goto out;
- }
- n->end = start;
- sp_insert(sp, new2);
-- new2 = NULL;
- break;
- } else
- n->end = start;
-@@ -1896,12 +1894,9 @@ restart:
- }
- if (new)
- sp_insert(sp, new);
-- spin_unlock(&sp->lock);
-- if (new2) {
-- mpol_put(new2->policy);
-- kmem_cache_free(sn_cache, new2);
-- }
-- return 0;
-+out:
-+ mutex_unlock(&sp->mutex);
-+ return ret;
- }
-
- /**
-@@ -1919,7 +1914,7 @@ void mpol_shared_policy_init(struct shared_policy *sp, struct mempolicy *mpol)
- int ret;
-
- sp->root = RB_ROOT; /* empty tree == default mempolicy */
-- spin_lock_init(&sp->lock);
-+ mutex_init(&sp->mutex);
-
- if (mpol) {
- struct vm_area_struct pvma;
-@@ -1987,7 +1982,7 @@ void mpol_free_shared_policy(struct shared_policy *p)
-
- if (!p->root.rb_node)
- return;
-- spin_lock(&p->lock);
-+ mutex_lock(&p->mutex);
- next = rb_first(&p->root);
- while (next) {
- n = rb_entry(next, struct sp_node, nd);
-@@ -1996,7 +1991,7 @@ void mpol_free_shared_policy(struct shared_policy *p)
- mpol_put(n->policy);
- kmem_cache_free(sn_cache, n);
- }
-- spin_unlock(&p->lock);
-+ mutex_unlock(&p->mutex);
- }
-
- /* assumes fs == KERNEL_DS */
-diff --git a/mm/shmem.c b/mm/shmem.c
-index 3e0005b..e6a0c72 100644
---- a/mm/shmem.c
-+++ b/mm/shmem.c
-@@ -2242,6 +2242,7 @@ static int shmem_remount_fs(struct super_block *sb, int *flags, char *data)
- unsigned long inodes;
- int error = -EINVAL;
-
-+ config.mpol = NULL;
- if (shmem_parse_options(data, &config, true))
- return error;
-
-@@ -2269,8 +2270,13 @@ static int shmem_remount_fs(struct super_block *sb, int *flags, char *data)
- sbinfo->max_inodes = config.max_inodes;
- sbinfo->free_inodes = config.max_inodes - inodes;
-
-- mpol_put(sbinfo->mpol);
-- sbinfo->mpol = config.mpol; /* transfers initial ref */
-+ /*
-+ * Preserve previous mempolicy unless mpol remount option was specified.
-+ */
-+ if (config.mpol) {
-+ mpol_put(sbinfo->mpol);
-+ sbinfo->mpol = config.mpol; /* transfers initial ref */
-+ }
- out:
- spin_unlock(&sbinfo->stat_lock);
- return error;
-diff --git a/mm/truncate.c b/mm/truncate.c
-index 258bda7..b41d26d 100644
---- a/mm/truncate.c
-+++ b/mm/truncate.c
-@@ -376,11 +376,12 @@ invalidate_complete_page2(struct address_space *mapping, struct page *page)
- if (page_has_private(page) && !try_to_release_page(page, GFP_KERNEL))
- return 0;
-
-+ clear_page_mlock(page);
-+
- spin_lock_irq(&mapping->tree_lock);
- if (PageDirty(page))
- goto failed;
-
-- clear_page_mlock(page);
- BUG_ON(page_has_private(page));
- __remove_from_page_cache(page);
- spin_unlock_irq(&mapping->tree_lock);
-diff --git a/mm/vmscan.c b/mm/vmscan.c
-index 4649929..738db2b 100644
---- a/mm/vmscan.c
-+++ b/mm/vmscan.c
-@@ -2241,6 +2241,8 @@ static int kswapd(void *p)
- balance_pgdat(pgdat, order);
- }
- }
-+
-+ current->reclaim_state = NULL;
- return 0;
- }
-
-diff --git a/net/atm/common.c b/net/atm/common.c
-index 950bd16..65737b8 100644
---- a/net/atm/common.c
-+++ b/net/atm/common.c
-@@ -473,6 +473,8 @@ int vcc_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
- struct sk_buff *skb;
- int copied, error = -EINVAL;
-
-+ msg->msg_namelen = 0;
-+
- if (sock->state != SS_CONNECTED)
- return -ENOTCONN;
- if (flags & ~MSG_DONTWAIT) /* only handle MSG_DONTWAIT */
-@@ -749,6 +751,7 @@ int vcc_getsockopt(struct socket *sock, int level, int optname,
- if (!vcc->dev ||
- !test_bit(ATM_VF_ADDR,&vcc->flags))
- return -ENOTCONN;
-+ memset(&pvc, 0, sizeof(pvc));
- pvc.sap_family = AF_ATMPVC;
- pvc.sap_addr.itf = vcc->dev->number;
- pvc.sap_addr.vpi = vcc->vpi;
-diff --git a/net/atm/pvc.c b/net/atm/pvc.c
-index d4c0245..523c21a 100644
---- a/net/atm/pvc.c
-+++ b/net/atm/pvc.c
-@@ -93,6 +93,7 @@ static int pvc_getname(struct socket *sock,struct sockaddr *sockaddr,
- if (!vcc->dev || !test_bit(ATM_VF_ADDR,&vcc->flags)) return -ENOTCONN;
- *sockaddr_len = sizeof(struct sockaddr_atmpvc);
- addr = (struct sockaddr_atmpvc *) sockaddr;
-+ memset(addr, 0, sizeof(*addr));
- addr->sap_family = AF_ATMPVC;
- addr->sap_addr.itf = vcc->dev->number;
- addr->sap_addr.vpi = vcc->vpi;
-diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
-index 1e9f3e42..8613bd1 100644
---- a/net/ax25/af_ax25.c
-+++ b/net/ax25/af_ax25.c
-@@ -1654,6 +1654,7 @@ static int ax25_recvmsg(struct kiocb *iocb, struct socket *sock,
- ax25_address src;
- const unsigned char *mac = skb_mac_header(skb);
-
-+ memset(sax, 0, sizeof(struct full_sockaddr_ax25));
- ax25_addr_parse(mac + 1, skb->data - mac - 1, &src, NULL,
- &digi, NULL, NULL);
- sax->sax25_family = AF_AX25;
-diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
-index 8cfb5a8..d7239dd 100644
---- a/net/bluetooth/af_bluetooth.c
-+++ b/net/bluetooth/af_bluetooth.c
-@@ -240,14 +240,14 @@ int bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
- if (flags & (MSG_OOB))
- return -EOPNOTSUPP;
-
-+ msg->msg_namelen = 0;
-+
- if (!(skb = skb_recv_datagram(sk, flags, noblock, &err))) {
- if (sk->sk_shutdown & RCV_SHUTDOWN)
- return 0;
- return err;
- }
-
-- msg->msg_namelen = 0;
--
- copied = skb->len;
- if (len < copied) {
- msg->msg_flags |= MSG_TRUNC;
-diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
-index 75302a9..45caaaa 100644
---- a/net/bluetooth/hci_sock.c
-+++ b/net/bluetooth/hci_sock.c
-@@ -576,6 +576,7 @@ static int hci_sock_getsockopt(struct socket *sock, int level, int optname, char
- {
- struct hci_filter *f = &hci_pi(sk)->filter;
-
-+ memset(&uf, 0, sizeof(uf));
- uf.type_mask = f->type_mask;
- uf.opcode = f->opcode;
- uf.event_mask[0] = *((u32 *) f->event_mask + 0);
-diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
-index 49d8495..0c2c59d 100644
---- a/net/bluetooth/hidp/core.c
-+++ b/net/bluetooth/hidp/core.c
-@@ -778,7 +778,7 @@ static int hidp_setup_hid(struct hidp_session *session,
- hid->version = req->version;
- hid->country = req->country;
-
-- strncpy(hid->name, req->name, 128);
-+ strncpy(hid->name, req->name, sizeof(req->name) - 1);
- strncpy(hid->phys, batostr(&src), 64);
- strncpy(hid->uniq, batostr(&dst), 64);
-
-diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
-index 71120ee..1c20bd9 100644
---- a/net/bluetooth/l2cap.c
-+++ b/net/bluetooth/l2cap.c
-@@ -1184,6 +1184,7 @@ static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr, int *l
-
- BT_DBG("sock %p, sk %p", sock, sk);
-
-+ memset(la, 0, sizeof(struct sockaddr_l2));
- addr->sa_family = AF_BLUETOOTH;
- *len = sizeof(struct sockaddr_l2);
-
-diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
-index 1ae3f80..1db0132 100644
---- a/net/bluetooth/rfcomm/sock.c
-+++ b/net/bluetooth/rfcomm/sock.c
-@@ -543,6 +543,7 @@ static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int *
-
- BT_DBG("sock %p, sk %p", sock, sk);
-
-+ memset(sa, 0, sizeof(*sa));
- sa->rc_family = AF_BLUETOOTH;
- sa->rc_channel = rfcomm_pi(sk)->channel;
- if (peer)
-@@ -651,6 +652,7 @@ static int rfcomm_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
-
- if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
- rfcomm_dlc_accept(d);
-+ msg->msg_namelen = 0;
- return 0;
- }
-
-diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c
-index 81ae40b..108215b 100644
---- a/net/bridge/br_stp_bpdu.c
-+++ b/net/bridge/br_stp_bpdu.c
-@@ -15,6 +15,7 @@
- #include <linux/netfilter_bridge.h>
- #include <linux/etherdevice.h>
- #include <linux/llc.h>
-+#include <linux/pkt_sched.h>
- #include <net/net_namespace.h>
- #include <net/llc.h>
- #include <net/llc_pdu.h>
-@@ -39,6 +40,7 @@ static void br_send_bpdu(struct net_bridge_port *p,
-
- skb->dev = p->dev;
- skb->protocol = htons(ETH_P_802_2);
-+ skb->priority = TC_PRIO_CONTROL;
-
- skb_reserve(skb, LLC_RESERVE);
- memcpy(__skb_put(skb, length), data, length);
-diff --git a/net/core/dev.c b/net/core/dev.c
-index 46e2a29..d775563 100644
---- a/net/core/dev.c
-+++ b/net/core/dev.c
-@@ -967,6 +967,8 @@ rollback:
- */
- int dev_set_alias(struct net_device *dev, const char *alias, size_t len)
- {
-+ char *new_ifalias;
-+
- ASSERT_RTNL();
-
- if (len >= IFALIASZ)
-@@ -980,9 +982,10 @@ int dev_set_alias(struct net_device *dev, const char *alias, size_t len)
- return 0;
- }
-
-- dev->ifalias = krealloc(dev->ifalias, len + 1, GFP_KERNEL);
-- if (!dev->ifalias)
-+ new_ifalias = krealloc(dev->ifalias, len + 1, GFP_KERNEL);
-+ if (!new_ifalias)
- return -ENOMEM;
-+ dev->ifalias = new_ifalias;
-
- strlcpy(dev->ifalias, alias, len+1);
- return len;
-@@ -2845,7 +2848,7 @@ static void net_rx_action(struct softirq_action *h)
- * Allow this to run for 2 jiffies since which will allow
- * an average latency of 1.5/HZ.
- */
-- if (unlikely(budget <= 0 || time_after(jiffies, time_limit)))
-+ if (unlikely(budget <= 0 || time_after_eq(jiffies, time_limit)))
- goto softnet_break;
-
- local_irq_enable();
-diff --git a/net/core/sock.c b/net/core/sock.c
-index 4538a34..eafa660 100644
---- a/net/core/sock.c
-+++ b/net/core/sock.c
-@@ -562,7 +562,8 @@ set_rcvbuf:
-
- case SO_KEEPALIVE:
- #ifdef CONFIG_INET
-- if (sk->sk_protocol == IPPROTO_TCP)
-+ if (sk->sk_protocol == IPPROTO_TCP &&
-+ sk->sk_type == SOCK_STREAM)
- tcp_set_keepalive(sk, valbool);
- #endif
- sock_valbool_flag(sk, SOCK_KEEPOPEN, valbool);
-diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
-index ac1205d..813fe4b 100644
---- a/net/dcb/dcbnl.c
-+++ b/net/dcb/dcbnl.c
-@@ -307,6 +307,7 @@ static int dcbnl_getperm_hwaddr(struct net_device *netdev, struct nlattr **tb,
- dcb->dcb_family = AF_UNSPEC;
- dcb->cmd = DCB_CMD_GPERM_HWADDR;
-
-+ memset(perm_addr, 0, sizeof(perm_addr));
- netdev->dcbnl_ops->getpermhwaddr(netdev, perm_addr);
-
- ret = nla_put(dcbnl_skb, DCB_ATTR_PERM_HWADDR, sizeof(perm_addr),
-diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
-index d14c0a3..cef3656 100644
---- a/net/dccp/ipv4.c
-+++ b/net/dccp/ipv4.c
-@@ -47,6 +47,7 @@ int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
- __be32 daddr, nexthop;
- int tmp;
- int err;
-+ struct ip_options_rcu *inet_opt;
-
- dp->dccps_role = DCCP_ROLE_CLIENT;
-
-@@ -57,10 +58,12 @@ int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
- return -EAFNOSUPPORT;
-
- nexthop = daddr = usin->sin_addr.s_addr;
-- if (inet->opt != NULL && inet->opt->srr) {
-+
-+ inet_opt = inet->inet_opt;
-+ if (inet_opt != NULL && inet_opt->opt.srr) {
- if (daddr == 0)
- return -EINVAL;
-- nexthop = inet->opt->faddr;
-+ nexthop = inet_opt->opt.faddr;
- }
-
- tmp = ip_route_connect(&rt, nexthop, inet->saddr,
-@@ -75,7 +78,7 @@ int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
- return -ENETUNREACH;
- }
-
-- if (inet->opt == NULL || !inet->opt->srr)
-+ if (inet_opt == NULL || !inet_opt->opt.srr)
- daddr = rt->rt_dst;
-
- if (inet->saddr == 0)
-@@ -86,8 +89,8 @@ int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
- inet->daddr = daddr;
-
- inet_csk(sk)->icsk_ext_hdr_len = 0;
-- if (inet->opt != NULL)
-- inet_csk(sk)->icsk_ext_hdr_len = inet->opt->optlen;
-+ if (inet_opt)
-+ inet_csk(sk)->icsk_ext_hdr_len = inet_opt->opt.optlen;
- /*
- * Socket identity is still unknown (sport may be zero).
- * However we set state to DCCP_REQUESTING and not releasing socket
-@@ -397,7 +400,7 @@ struct sock *dccp_v4_request_recv_sock(struct sock *sk, struct sk_buff *skb,
- newinet->daddr = ireq->rmt_addr;
- newinet->rcv_saddr = ireq->loc_addr;
- newinet->saddr = ireq->loc_addr;
-- newinet->opt = ireq->opt;
-+ newinet->inet_opt = ireq->opt;
- ireq->opt = NULL;
- newinet->mc_index = inet_iif(skb);
- newinet->mc_ttl = ip_hdr(skb)->ttl;
-diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
-index 9ed1962..2f11de7 100644
---- a/net/dccp/ipv6.c
-+++ b/net/dccp/ipv6.c
-@@ -600,7 +600,7 @@ static struct sock *dccp_v6_request_recv_sock(struct sock *sk,
-
- First: no IPv4 options.
- */
-- newinet->opt = NULL;
-+ newinet->inet_opt = NULL;
-
- /* Clone RX bits */
- newnp->rxopt.all = np->rxopt.all;
-diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
-index a289878..d1992a4 100644
---- a/net/ipv4/af_inet.c
-+++ b/net/ipv4/af_inet.c
-@@ -152,7 +152,7 @@ void inet_sock_destruct(struct sock *sk)
- WARN_ON(sk->sk_wmem_queued);
- WARN_ON(sk->sk_forward_alloc);
-
-- kfree(inet->opt);
-+ kfree(inet->inet_opt);
- dst_release(sk->sk_dst_cache);
- sk_refcnt_debug_dec(sk);
- }
-@@ -1065,9 +1065,11 @@ static int inet_sk_reselect_saddr(struct sock *sk)
- __be32 old_saddr = inet->saddr;
- __be32 new_saddr;
- __be32 daddr = inet->daddr;
-+ struct ip_options_rcu *inet_opt;
-
-- if (inet->opt && inet->opt->srr)
-- daddr = inet->opt->faddr;
-+ inet_opt = inet->inet_opt;
-+ if (inet_opt && inet_opt->opt.srr)
-+ daddr = inet_opt->opt.faddr;
-
- /* Query new route. */
- err = ip_route_connect(&rt, daddr, 0,
-@@ -1109,6 +1111,7 @@ int inet_sk_rebuild_header(struct sock *sk)
- struct inet_sock *inet = inet_sk(sk);
- struct rtable *rt = (struct rtable *)__sk_dst_check(sk, 0);
- __be32 daddr;
-+ struct ip_options_rcu *inet_opt;
- int err;
-
- /* Route is OK, nothing to do. */
-@@ -1116,9 +1119,12 @@ int inet_sk_rebuild_header(struct sock *sk)
- return 0;
-
- /* Reroute. */
-+ rcu_read_lock();
-+ inet_opt = rcu_dereference(inet->inet_opt);
- daddr = inet->daddr;
-- if (inet->opt && inet->opt->srr)
-- daddr = inet->opt->faddr;
-+ if (inet_opt && inet_opt->opt.srr)
-+ daddr = inet_opt->opt.faddr;
-+ rcu_read_unlock();
- {
- struct flowi fl = {
- .oif = sk->sk_bound_dev_if,
-diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
-index 10f8f8d..b6d06d6 100644
---- a/net/ipv4/cipso_ipv4.c
-+++ b/net/ipv4/cipso_ipv4.c
-@@ -1860,6 +1860,11 @@ static int cipso_v4_genopt(unsigned char *buf, u32 buf_len,
- return CIPSO_V4_HDR_LEN + ret_val;
- }
-
-+static void opt_kfree_rcu(struct rcu_head *head)
-+{
-+ kfree(container_of(head, struct ip_options_rcu, rcu));
-+}
-+
- /**
- * cipso_v4_sock_setattr - Add a CIPSO option to a socket
- * @sk: the socket
-@@ -1882,7 +1887,7 @@ int cipso_v4_sock_setattr(struct sock *sk,
- unsigned char *buf = NULL;
- u32 buf_len;
- u32 opt_len;
-- struct ip_options *opt = NULL;
-+ struct ip_options_rcu *old, *opt = NULL;
- struct inet_sock *sk_inet;
- struct inet_connection_sock *sk_conn;
-
-@@ -1918,22 +1923,25 @@ int cipso_v4_sock_setattr(struct sock *sk,
- ret_val = -ENOMEM;
- goto socket_setattr_failure;
- }
-- memcpy(opt->__data, buf, buf_len);
-- opt->optlen = opt_len;
-- opt->cipso = sizeof(struct iphdr);
-+ memcpy(opt->opt.__data, buf, buf_len);
-+ opt->opt.optlen = opt_len;
-+ opt->opt.cipso = sizeof(struct iphdr);
- kfree(buf);
- buf = NULL;
-
- sk_inet = inet_sk(sk);
-+
-+ old = sk_inet->inet_opt;
- if (sk_inet->is_icsk) {
- sk_conn = inet_csk(sk);
-- if (sk_inet->opt)
-- sk_conn->icsk_ext_hdr_len -= sk_inet->opt->optlen;
-- sk_conn->icsk_ext_hdr_len += opt->optlen;
-+ if (old)
-+ sk_conn->icsk_ext_hdr_len -= old->opt.optlen;
-+ sk_conn->icsk_ext_hdr_len += opt->opt.optlen;
- sk_conn->icsk_sync_mss(sk, sk_conn->icsk_pmtu_cookie);
- }
-- opt = xchg(&sk_inet->opt, opt);
-- kfree(opt);
-+ rcu_assign_pointer(sk_inet->inet_opt, opt);
-+ if (old)
-+ call_rcu(&old->rcu, opt_kfree_rcu);
-
- return 0;
-
-@@ -1963,7 +1971,7 @@ int cipso_v4_req_setattr(struct request_sock *req,
- unsigned char *buf = NULL;
- u32 buf_len;
- u32 opt_len;
-- struct ip_options *opt = NULL;
-+ struct ip_options_rcu *opt = NULL;
- struct inet_request_sock *req_inet;
-
- /* We allocate the maximum CIPSO option size here so we are probably
-@@ -1991,15 +1999,16 @@ int cipso_v4_req_setattr(struct request_sock *req,
- ret_val = -ENOMEM;
- goto req_setattr_failure;
- }
-- memcpy(opt->__data, buf, buf_len);
-- opt->optlen = opt_len;
-- opt->cipso = sizeof(struct iphdr);
-+ memcpy(opt->opt.__data, buf, buf_len);
-+ opt->opt.optlen = opt_len;
-+ opt->opt.cipso = sizeof(struct iphdr);
- kfree(buf);
- buf = NULL;
-
- req_inet = inet_rsk(req);
- opt = xchg(&req_inet->opt, opt);
-- kfree(opt);
-+ if (opt)
-+ call_rcu(&opt->rcu, opt_kfree_rcu);
-
- return 0;
-
-@@ -2019,34 +2028,34 @@ req_setattr_failure:
- * values on failure.
- *
- */
--int cipso_v4_delopt(struct ip_options **opt_ptr)
-+int cipso_v4_delopt(struct ip_options_rcu **opt_ptr)
- {
- int hdr_delta = 0;
-- struct ip_options *opt = *opt_ptr;
-+ struct ip_options_rcu *opt = *opt_ptr;
-
-- if (opt->srr || opt->rr || opt->ts || opt->router_alert) {
-+ if (opt->opt.srr || opt->opt.rr || opt->opt.ts || opt->opt.router_alert) {
- u8 cipso_len;
- u8 cipso_off;
- unsigned char *cipso_ptr;
- int iter;
- int optlen_new;
-
-- cipso_off = opt->cipso - sizeof(struct iphdr);
-- cipso_ptr = &opt->__data[cipso_off];
-+ cipso_off = opt->opt.cipso - sizeof(struct iphdr);
-+ cipso_ptr = &opt->opt.__data[cipso_off];
- cipso_len = cipso_ptr[1];
-
-- if (opt->srr > opt->cipso)
-- opt->srr -= cipso_len;
-- if (opt->rr > opt->cipso)
-- opt->rr -= cipso_len;
-- if (opt->ts > opt->cipso)
-- opt->ts -= cipso_len;
-- if (opt->router_alert > opt->cipso)
-- opt->router_alert -= cipso_len;
-- opt->cipso = 0;
-+ if (opt->opt.srr > opt->opt.cipso)
-+ opt->opt.srr -= cipso_len;
-+ if (opt->opt.rr > opt->opt.cipso)
-+ opt->opt.rr -= cipso_len;
-+ if (opt->opt.ts > opt->opt.cipso)
-+ opt->opt.ts -= cipso_len;
-+ if (opt->opt.router_alert > opt->opt.cipso)
-+ opt->opt.router_alert -= cipso_len;
-+ opt->opt.cipso = 0;
-
- memmove(cipso_ptr, cipso_ptr + cipso_len,
-- opt->optlen - cipso_off - cipso_len);
-+ opt->opt.optlen - cipso_off - cipso_len);
-
- /* determining the new total option length is tricky because of
- * the padding necessary, the only thing i can think to do at
-@@ -2055,21 +2064,21 @@ int cipso_v4_delopt(struct ip_options **opt_ptr)
- * from there we can determine the new total option length */
- iter = 0;
- optlen_new = 0;
-- while (iter < opt->optlen)
-- if (opt->__data[iter] != IPOPT_NOP) {
-- iter += opt->__data[iter + 1];
-+ while (iter < opt->opt.optlen)
-+ if (opt->opt.__data[iter] != IPOPT_NOP) {
-+ iter += opt->opt.__data[iter + 1];
- optlen_new = iter;
- } else
- iter++;
-- hdr_delta = opt->optlen;
-- opt->optlen = (optlen_new + 3) & ~3;
-- hdr_delta -= opt->optlen;
-+ hdr_delta = opt->opt.optlen;
-+ opt->opt.optlen = (optlen_new + 3) & ~3;
-+ hdr_delta -= opt->opt.optlen;
- } else {
- /* only the cipso option was present on the socket so we can
- * remove the entire option struct */
- *opt_ptr = NULL;
-- hdr_delta = opt->optlen;
-- kfree(opt);
-+ hdr_delta = opt->opt.optlen;
-+ call_rcu(&opt->rcu, opt_kfree_rcu);
- }
-
- return hdr_delta;
-@@ -2086,15 +2095,15 @@ int cipso_v4_delopt(struct ip_options **opt_ptr)
- void cipso_v4_sock_delattr(struct sock *sk)
- {
- int hdr_delta;
-- struct ip_options *opt;
-+ struct ip_options_rcu *opt;
- struct inet_sock *sk_inet;
-
- sk_inet = inet_sk(sk);
-- opt = sk_inet->opt;
-- if (opt == NULL || opt->cipso == 0)
-+ opt = sk_inet->inet_opt;
-+ if (opt == NULL || opt->opt.cipso == 0)
- return;
-
-- hdr_delta = cipso_v4_delopt(&sk_inet->opt);
-+ hdr_delta = cipso_v4_delopt(&sk_inet->inet_opt);
- if (sk_inet->is_icsk && hdr_delta > 0) {
- struct inet_connection_sock *sk_conn = inet_csk(sk);
- sk_conn->icsk_ext_hdr_len -= hdr_delta;
-@@ -2112,12 +2121,12 @@ void cipso_v4_sock_delattr(struct sock *sk)
- */
- void cipso_v4_req_delattr(struct request_sock *req)
- {
-- struct ip_options *opt;
-+ struct ip_options_rcu *opt;
- struct inet_request_sock *req_inet;
-
- req_inet = inet_rsk(req);
- opt = req_inet->opt;
-- if (opt == NULL || opt->cipso == 0)
-+ if (opt == NULL || opt->opt.cipso == 0)
- return;
-
- cipso_v4_delopt(&req_inet->opt);
-@@ -2187,14 +2196,18 @@ getattr_return:
- */
- int cipso_v4_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr)
- {
-- struct ip_options *opt;
-+ struct ip_options_rcu *opt;
-+ int res = -ENOMSG;
-
-- opt = inet_sk(sk)->opt;
-- if (opt == NULL || opt->cipso == 0)
-- return -ENOMSG;
--
-- return cipso_v4_getattr(opt->__data + opt->cipso - sizeof(struct iphdr),
-- secattr);
-+ rcu_read_lock();
-+ opt = rcu_dereference(inet_sk(sk)->inet_opt);
-+ if (opt && opt->opt.cipso)
-+ res = cipso_v4_getattr(opt->opt.__data +
-+ opt->opt.cipso -
-+ sizeof(struct iphdr),
-+ secattr);
-+ rcu_read_unlock();
-+ return res;
- }
-
- /**
-diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
-index 5bc13fe..859d781 100644
---- a/net/ipv4/icmp.c
-+++ b/net/ipv4/icmp.c
-@@ -107,8 +107,7 @@ struct icmp_bxm {
- __be32 times[3];
- } data;
- int head_len;
-- struct ip_options replyopts;
-- unsigned char optbuf[40];
-+ struct ip_options_data replyopts;
- };
-
- /* An array of errno for error messages from dest unreach. */
-@@ -362,7 +361,7 @@ static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb)
- struct inet_sock *inet;
- __be32 daddr;
-
-- if (ip_options_echo(&icmp_param->replyopts, skb))
-+ if (ip_options_echo(&icmp_param->replyopts.opt.opt, skb))
- return;
-
- sk = icmp_xmit_lock(net);
-@@ -376,10 +375,10 @@ static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb)
- daddr = ipc.addr = rt->rt_src;
- ipc.opt = NULL;
- ipc.shtx.flags = 0;
-- if (icmp_param->replyopts.optlen) {
-- ipc.opt = &icmp_param->replyopts;
-- if (ipc.opt->srr)
-- daddr = icmp_param->replyopts.faddr;
-+ if (icmp_param->replyopts.opt.opt.optlen) {
-+ ipc.opt = &icmp_param->replyopts.opt;
-+ if (ipc.opt->opt.srr)
-+ daddr = icmp_param->replyopts.opt.opt.faddr;
- }
- {
- struct flowi fl = { .nl_u = { .ip4_u =
-@@ -516,7 +515,7 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
- IPTOS_PREC_INTERNETCONTROL) :
- iph->tos;
-
-- if (ip_options_echo(&icmp_param.replyopts, skb_in))
-+ if (ip_options_echo(&icmp_param.replyopts.opt.opt, skb_in))
- goto out_unlock;
-
-
-@@ -532,15 +531,15 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
- icmp_param.offset = skb_network_offset(skb_in);
- inet_sk(sk)->tos = tos;
- ipc.addr = iph->saddr;
-- ipc.opt = &icmp_param.replyopts;
-+ ipc.opt = &icmp_param.replyopts.opt;
- ipc.shtx.flags = 0;
-
- {
- struct flowi fl = {
- .nl_u = {
- .ip4_u = {
-- .daddr = icmp_param.replyopts.srr ?
-- icmp_param.replyopts.faddr :
-+ .daddr = icmp_param.replyopts.opt.opt.srr ?
-+ icmp_param.replyopts.opt.opt.faddr :
- iph->saddr,
- .saddr = saddr,
- .tos = RT_TOS(tos)
-@@ -629,7 +628,7 @@ route_done:
- room = dst_mtu(&rt->u.dst);
- if (room > 576)
- room = 576;
-- room -= sizeof(struct iphdr) + icmp_param.replyopts.optlen;
-+ room -= sizeof(struct iphdr) + icmp_param.replyopts.opt.opt.optlen;
- room -= sizeof(struct icmphdr);
-
- icmp_param.data_len = skb_in->len - icmp_param.offset;
-diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
-index 537731b..a3bf986 100644
---- a/net/ipv4/inet_connection_sock.c
-+++ b/net/ipv4/inet_connection_sock.c
-@@ -356,11 +356,11 @@ struct dst_entry *inet_csk_route_req(struct sock *sk,
- {
- struct rtable *rt;
- const struct inet_request_sock *ireq = inet_rsk(req);
-- struct ip_options *opt = inet_rsk(req)->opt;
-+ struct ip_options_rcu *opt = inet_rsk(req)->opt;
- struct flowi fl = { .oif = sk->sk_bound_dev_if,
- .nl_u = { .ip4_u =
-- { .daddr = ((opt && opt->srr) ?
-- opt->faddr :
-+ { .daddr = ((opt && opt->opt.srr) ?
-+ opt->opt.faddr :
- ireq->rmt_addr),
- .saddr = ireq->loc_addr,
- .tos = RT_CONN_FLAGS(sk) } },
-@@ -374,7 +374,7 @@ struct dst_entry *inet_csk_route_req(struct sock *sk,
- security_req_classify_flow(req, &fl);
- if (ip_route_output_flow(net, &rt, &fl, sk, 0))
- goto no_route;
-- if (opt && opt->is_strictroute && rt->rt_dst != rt->rt_gateway)
-+ if (opt && opt->opt.is_strictroute && rt->rt_dst != rt->rt_gateway)
- goto route_err;
- return &rt->u.dst;
-
-diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
-index 94bf105..8a95972 100644
---- a/net/ipv4/ip_options.c
-+++ b/net/ipv4/ip_options.c
-@@ -35,7 +35,7 @@
- * saddr is address of outgoing interface.
- */
-
--void ip_options_build(struct sk_buff * skb, struct ip_options * opt,
-+void ip_options_build(struct sk_buff *skb, struct ip_options *opt,
- __be32 daddr, struct rtable *rt, int is_frag)
- {
- unsigned char *iph = skb_network_header(skb);
-@@ -82,9 +82,9 @@ void ip_options_build(struct sk_buff * skb, struct ip_options * opt,
- * NOTE: dopt cannot point to skb.
- */
-
--int ip_options_echo(struct ip_options * dopt, struct sk_buff * skb)
-+int ip_options_echo(struct ip_options *dopt, struct sk_buff *skb)
- {
-- struct ip_options *sopt;
-+ const struct ip_options *sopt;
- unsigned char *sptr, *dptr;
- int soffset, doffset;
- int optlen;
-@@ -94,10 +94,8 @@ int ip_options_echo(struct ip_options * dopt, struct sk_buff * skb)
-
- sopt = &(IPCB(skb)->opt);
-
-- if (sopt->optlen == 0) {
-- dopt->optlen = 0;
-+ if (sopt->optlen == 0)
- return 0;
-- }
-
- sptr = skb_network_header(skb);
- dptr = dopt->__data;
-@@ -156,7 +154,7 @@ int ip_options_echo(struct ip_options * dopt, struct sk_buff * skb)
- dopt->optlen += optlen;
- }
- if (sopt->srr) {
-- unsigned char * start = sptr+sopt->srr;
-+ unsigned char *start = sptr+sopt->srr;
- __be32 faddr;
-
- optlen = start[1];
-@@ -499,19 +497,19 @@ void ip_options_undo(struct ip_options * opt)
- }
- }
-
--static struct ip_options *ip_options_get_alloc(const int optlen)
-+static struct ip_options_rcu *ip_options_get_alloc(const int optlen)
- {
-- return kzalloc(sizeof(struct ip_options) + ((optlen + 3) & ~3),
-+ return kzalloc(sizeof(struct ip_options_rcu) + ((optlen + 3) & ~3),
- GFP_KERNEL);
- }
-
--static int ip_options_get_finish(struct net *net, struct ip_options **optp,
-- struct ip_options *opt, int optlen)
-+static int ip_options_get_finish(struct net *net, struct ip_options_rcu **optp,
-+ struct ip_options_rcu *opt, int optlen)
- {
- while (optlen & 3)
-- opt->__data[optlen++] = IPOPT_END;
-- opt->optlen = optlen;
-- if (optlen && ip_options_compile(net, opt, NULL)) {
-+ opt->opt.__data[optlen++] = IPOPT_END;
-+ opt->opt.optlen = optlen;
-+ if (optlen && ip_options_compile(net, &opt->opt, NULL)) {
- kfree(opt);
- return -EINVAL;
- }
-@@ -520,29 +518,29 @@ static int ip_options_get_finish(struct net *net, struct ip_options **optp,
- return 0;
- }
-
--int ip_options_get_from_user(struct net *net, struct ip_options **optp,
-+int ip_options_get_from_user(struct net *net, struct ip_options_rcu **optp,
- unsigned char __user *data, int optlen)
- {
-- struct ip_options *opt = ip_options_get_alloc(optlen);
-+ struct ip_options_rcu *opt = ip_options_get_alloc(optlen);
-
- if (!opt)
- return -ENOMEM;
-- if (optlen && copy_from_user(opt->__data, data, optlen)) {
-+ if (optlen && copy_from_user(opt->opt.__data, data, optlen)) {
- kfree(opt);
- return -EFAULT;
- }
- return ip_options_get_finish(net, optp, opt, optlen);
- }
-
--int ip_options_get(struct net *net, struct ip_options **optp,
-+int ip_options_get(struct net *net, struct ip_options_rcu **optp,
- unsigned char *data, int optlen)
- {
-- struct ip_options *opt = ip_options_get_alloc(optlen);
-+ struct ip_options_rcu *opt = ip_options_get_alloc(optlen);
-
- if (!opt)
- return -ENOMEM;
- if (optlen)
-- memcpy(opt->__data, data, optlen);
-+ memcpy(opt->opt.__data, data, optlen);
- return ip_options_get_finish(net, optp, opt, optlen);
- }
-
-diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
-index 44b7910..7dde039 100644
---- a/net/ipv4/ip_output.c
-+++ b/net/ipv4/ip_output.c
-@@ -137,14 +137,14 @@ static inline int ip_select_ttl(struct inet_sock *inet, struct dst_entry *dst)
- *
- */
- int ip_build_and_send_pkt(struct sk_buff *skb, struct sock *sk,
-- __be32 saddr, __be32 daddr, struct ip_options *opt)
-+ __be32 saddr, __be32 daddr, struct ip_options_rcu *opt)
- {
- struct inet_sock *inet = inet_sk(sk);
- struct rtable *rt = skb_rtable(skb);
- struct iphdr *iph;
-
- /* Build the IP header. */
-- skb_push(skb, sizeof(struct iphdr) + (opt ? opt->optlen : 0));
-+ skb_push(skb, sizeof(struct iphdr) + (opt ? opt->opt.optlen : 0));
- skb_reset_network_header(skb);
- iph = ip_hdr(skb);
- iph->version = 4;
-@@ -160,9 +160,9 @@ int ip_build_and_send_pkt(struct sk_buff *skb, struct sock *sk,
- iph->protocol = sk->sk_protocol;
- ip_select_ident(iph, &rt->u.dst, sk);
-
-- if (opt && opt->optlen) {
-- iph->ihl += opt->optlen>>2;
-- ip_options_build(skb, opt, daddr, rt, 0);
-+ if (opt && opt->opt.optlen) {
-+ iph->ihl += opt->opt.optlen>>2;
-+ ip_options_build(skb, &opt->opt, daddr, rt, 0);
- }
-
- skb->priority = sk->sk_priority;
-@@ -312,9 +312,10 @@ int ip_queue_xmit(struct sk_buff *skb, int ipfragok)
- {
- struct sock *sk = skb->sk;
- struct inet_sock *inet = inet_sk(sk);
-- struct ip_options *opt = inet->opt;
-+ struct ip_options_rcu *inet_opt = NULL;
- struct rtable *rt;
- struct iphdr *iph;
-+ int res;
-
- /* Skip all of this if the packet is already routed,
- * f.e. by something like SCTP.
-@@ -325,13 +326,15 @@ int ip_queue_xmit(struct sk_buff *skb, int ipfragok)
-
- /* Make sure we can route this packet. */
- rt = (struct rtable *)__sk_dst_check(sk, 0);
-+ rcu_read_lock();
-+ inet_opt = rcu_dereference(inet->inet_opt);
- if (rt == NULL) {
- __be32 daddr;
-
- /* Use correct destination address if we have options. */
- daddr = inet->daddr;
-- if(opt && opt->srr)
-- daddr = opt->faddr;
-+ if (inet_opt && inet_opt->opt.srr)
-+ daddr = inet_opt->opt.faddr;
-
- {
- struct flowi fl = { .oif = sk->sk_bound_dev_if,
-@@ -359,11 +362,11 @@ int ip_queue_xmit(struct sk_buff *skb, int ipfragok)
- skb_dst_set(skb, dst_clone(&rt->u.dst));
-
- packet_routed:
-- if (opt && opt->is_strictroute && rt->rt_dst != rt->rt_gateway)
-+ if (inet_opt && inet_opt->opt.is_strictroute && rt->rt_dst != rt->rt_gateway)
- goto no_route;
-
- /* OK, we know where to send it, allocate and build IP header. */
-- skb_push(skb, sizeof(struct iphdr) + (opt ? opt->optlen : 0));
-+ skb_push(skb, sizeof(struct iphdr) + (inet_opt ? inet_opt->opt.optlen : 0));
- skb_reset_network_header(skb);
- iph = ip_hdr(skb);
- *((__be16 *)iph) = htons((4 << 12) | (5 << 8) | (inet->tos & 0xff));
-@@ -377,9 +380,9 @@ packet_routed:
- iph->daddr = rt->rt_dst;
- /* Transport layer set skb->h.foo itself. */
-
-- if (opt && opt->optlen) {
-- iph->ihl += opt->optlen >> 2;
-- ip_options_build(skb, opt, inet->daddr, rt, 0);
-+ if (inet_opt && inet_opt->opt.optlen) {
-+ iph->ihl += inet_opt->opt.optlen >> 2;
-+ ip_options_build(skb, &inet_opt->opt, inet->daddr, rt, 0);
- }
-
- ip_select_ident_more(iph, &rt->u.dst, sk,
-@@ -387,10 +390,12 @@ packet_routed:
-
- skb->priority = sk->sk_priority;
- skb->mark = sk->sk_mark;
--
-- return ip_local_out(skb);
-+ res = ip_local_out(skb);
-+ rcu_read_unlock();
-+ return res;
-
- no_route:
-+ rcu_read_unlock();
- IP_INC_STATS(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
- kfree_skb(skb);
- return -EHOSTUNREACH;
-@@ -809,7 +814,7 @@ int ip_append_data(struct sock *sk,
- /*
- * setup for corking.
- */
-- opt = ipc->opt;
-+ opt = ipc->opt ? &ipc->opt->opt : NULL;
- if (opt) {
- if (inet->cork.opt == NULL) {
- inet->cork.opt = kmalloc(sizeof(struct ip_options) + 40, sk->sk_allocation);
-@@ -1367,26 +1372,23 @@ void ip_send_reply(struct sock *sk, struct sk_buff *skb, struct ip_reply_arg *ar
- unsigned int len)
- {
- struct inet_sock *inet = inet_sk(sk);
-- struct {
-- struct ip_options opt;
-- char data[40];
-- } replyopts;
-+ struct ip_options_data replyopts;
- struct ipcm_cookie ipc;
- __be32 daddr;
- struct rtable *rt = skb_rtable(skb);
-
-- if (ip_options_echo(&replyopts.opt, skb))
-+ if (ip_options_echo(&replyopts.opt.opt, skb))
- return;
-
- daddr = ipc.addr = rt->rt_src;
- ipc.opt = NULL;
- ipc.shtx.flags = 0;
-
-- if (replyopts.opt.optlen) {
-+ if (replyopts.opt.opt.optlen) {
- ipc.opt = &replyopts.opt;
-
-- if (ipc.opt->srr)
-- daddr = replyopts.opt.faddr;
-+ if (replyopts.opt.opt.srr)
-+ daddr = replyopts.opt.opt.faddr;
- }
-
- {
-diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
-index e982b5c..099e6c3 100644
---- a/net/ipv4/ip_sockglue.c
-+++ b/net/ipv4/ip_sockglue.c
-@@ -434,6 +434,11 @@ out:
- }
-
-
-+static void opt_kfree_rcu(struct rcu_head *head)
-+{
-+ kfree(container_of(head, struct ip_options_rcu, rcu));
-+}
-+
- /*
- * Socket option code for IP. This is the end of the line after any
- * TCP,UDP etc options on an IP socket.
-@@ -479,13 +484,15 @@ static int do_ip_setsockopt(struct sock *sk, int level,
- switch (optname) {
- case IP_OPTIONS:
- {
-- struct ip_options *opt = NULL;
-+ struct ip_options_rcu *old, *opt = NULL;
-+
- if (optlen > 40 || optlen < 0)
- goto e_inval;
- err = ip_options_get_from_user(sock_net(sk), &opt,
- optval, optlen);
- if (err)
- break;
-+ old = inet->inet_opt;
- if (inet->is_icsk) {
- struct inet_connection_sock *icsk = inet_csk(sk);
- #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
-@@ -494,17 +501,18 @@ static int do_ip_setsockopt(struct sock *sk, int level,
- (TCPF_LISTEN | TCPF_CLOSE)) &&
- inet->daddr != LOOPBACK4_IPV6)) {
- #endif
-- if (inet->opt)
-- icsk->icsk_ext_hdr_len -= inet->opt->optlen;
-+ if (old)
-+ icsk->icsk_ext_hdr_len -= old->opt.optlen;
- if (opt)
-- icsk->icsk_ext_hdr_len += opt->optlen;
-+ icsk->icsk_ext_hdr_len += opt->opt.optlen;
- icsk->icsk_sync_mss(sk, icsk->icsk_pmtu_cookie);
- #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
- }
- #endif
- }
-- opt = xchg(&inet->opt, opt);
-- kfree(opt);
-+ rcu_assign_pointer(inet->inet_opt, opt);
-+ if (old)
-+ call_rcu(&old->rcu, opt_kfree_rcu);
- break;
- }
- case IP_PKTINFO:
-@@ -563,7 +571,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
- case IP_TTL:
- if (optlen < 1)
- goto e_inval;
-- if (val != -1 && (val < 0 || val > 255))
-+ if (val != -1 && (val < 1 || val > 255))
- goto e_inval;
- inet->uc_ttl = val;
- break;
-@@ -1032,12 +1040,15 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
- case IP_OPTIONS:
- {
- unsigned char optbuf[sizeof(struct ip_options)+40];
-- struct ip_options * opt = (struct ip_options *)optbuf;
-+ struct ip_options *opt = (struct ip_options *)optbuf;
-+ struct ip_options_rcu *inet_opt;
-+
-+ inet_opt = inet->inet_opt;
- opt->optlen = 0;
-- if (inet->opt)
-- memcpy(optbuf, inet->opt,
-- sizeof(struct ip_options)+
-- inet->opt->optlen);
-+ if (inet_opt)
-+ memcpy(optbuf, &inet_opt->opt,
-+ sizeof(struct ip_options) +
-+ inet_opt->opt.optlen);
- release_sock(sk);
-
- if (opt->optlen == 0)
-diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
-index 1032a15..c6437d5 100644
---- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
-+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
-@@ -83,6 +83,14 @@ static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
- *dataoff = nhoff + (iph->ihl << 2);
- *protonum = iph->protocol;
-
-+ /* Check bogus IP headers */
-+ if (*dataoff > skb->len) {
-+ pr_debug("nf_conntrack_ipv4: bogus IPv4 packet: "
-+ "nhoff %u, ihl %u, skblen %u\n",
-+ nhoff, iph->ihl << 2, skb->len);
-+ return -NF_ACCEPT;
-+ }
-+
- return NF_ACCEPT;
- }
-
-diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
-index ab996f9..07ab583 100644
---- a/net/ipv4/raw.c
-+++ b/net/ipv4/raw.c
-@@ -459,6 +459,7 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
- __be32 saddr;
- u8 tos;
- int err;
-+ struct ip_options_data opt_copy;
-
- err = -EMSGSIZE;
- if (len > 0xFFFF)
-@@ -519,8 +520,18 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
- saddr = ipc.addr;
- ipc.addr = daddr;
-
-- if (!ipc.opt)
-- ipc.opt = inet->opt;
-+ if (!ipc.opt) {
-+ struct ip_options_rcu *inet_opt;
-+
-+ rcu_read_lock();
-+ inet_opt = rcu_dereference(inet->inet_opt);
-+ if (inet_opt) {
-+ memcpy(&opt_copy, inet_opt,
-+ sizeof(*inet_opt) + inet_opt->opt.optlen);
-+ ipc.opt = &opt_copy.opt;
-+ }
-+ rcu_read_unlock();
-+ }
-
- if (ipc.opt) {
- err = -EINVAL;
-@@ -529,10 +540,10 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
- */
- if (inet->hdrincl)
- goto done;
-- if (ipc.opt->srr) {
-+ if (ipc.opt->opt.srr) {
- if (!daddr)
- goto done;
-- daddr = ipc.opt->faddr;
-+ daddr = ipc.opt->opt.faddr;
- }
- }
- tos = RT_CONN_FLAGS(sk);
-diff --git a/net/ipv4/route.c b/net/ipv4/route.c
-index 58f141b..f16d19b 100644
---- a/net/ipv4/route.c
-+++ b/net/ipv4/route.c
-@@ -1412,7 +1412,7 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
- dev_hold(rt->u.dst.dev);
- if (rt->idev)
- in_dev_hold(rt->idev);
-- rt->u.dst.obsolete = 0;
-+ rt->u.dst.obsolete = -1;
- rt->u.dst.lastuse = jiffies;
- rt->u.dst.path = &rt->u.dst;
- rt->u.dst.neighbour = NULL;
-@@ -1477,7 +1477,7 @@ static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst)
- struct dst_entry *ret = dst;
-
- if (rt) {
-- if (dst->obsolete) {
-+ if (dst->obsolete > 0) {
- ip_rt_put(rt);
- ret = NULL;
- } else if ((rt->rt_flags & RTCF_REDIRECTED) ||
-@@ -1700,7 +1700,9 @@ static void ip_rt_update_pmtu(struct dst_entry *dst, u32 mtu)
-
- static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie)
- {
-- return NULL;
-+ if (rt_is_expired((struct rtable *)dst))
-+ return NULL;
-+ return dst;
- }
-
- static void ipv4_dst_destroy(struct dst_entry *dst)
-@@ -1862,7 +1864,8 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
- if (!rth)
- goto e_nobufs;
-
-- rth->u.dst.output= ip_rt_bug;
-+ rth->u.dst.output = ip_rt_bug;
-+ rth->u.dst.obsolete = -1;
-
- atomic_set(&rth->u.dst.__refcnt, 1);
- rth->u.dst.flags= DST_HOST;
-@@ -2023,6 +2026,7 @@ static int __mkroute_input(struct sk_buff *skb,
- rth->fl.oif = 0;
- rth->rt_spec_dst= spec_dst;
-
-+ rth->u.dst.obsolete = -1;
- rth->u.dst.input = ip_forward;
- rth->u.dst.output = ip_output;
- rth->rt_genid = rt_genid(dev_net(rth->u.dst.dev));
-@@ -2187,6 +2191,7 @@ local_input:
- goto e_nobufs;
-
- rth->u.dst.output= ip_rt_bug;
-+ rth->u.dst.obsolete = -1;
- rth->rt_genid = rt_genid(net);
-
- atomic_set(&rth->u.dst.__refcnt, 1);
-@@ -2411,7 +2416,8 @@ static int __mkroute_output(struct rtable **result,
- rth->rt_gateway = fl->fl4_dst;
- rth->rt_spec_dst= fl->fl4_src;
-
-- rth->u.dst.output=ip_output;
-+ rth->u.dst.output = ip_output;
-+ rth->u.dst.obsolete = -1;
- rth->rt_genid = rt_genid(dev_net(dev_out));
-
- RT_CACHE_STAT_INC(out_slow_tot);
-@@ -2741,6 +2747,7 @@ static int ipv4_dst_blackhole(struct net *net, struct rtable **rp, struct flowi
- if (rt) {
- struct dst_entry *new = &rt->u.dst;
-
-+ new->obsolete = -1;
- atomic_set(&new->__refcnt, 1);
- new->__use = 1;
- new->input = dst_discard;
-diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
-index a6e0e07..0a94b64 100644
---- a/net/ipv4/syncookies.c
-+++ b/net/ipv4/syncookies.c
-@@ -309,10 +309,10 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
- * the ACK carries the same options again (see RFC1122 4.2.3.8)
- */
- if (opt && opt->optlen) {
-- int opt_size = sizeof(struct ip_options) + opt->optlen;
-+ int opt_size = sizeof(struct ip_options_rcu) + opt->optlen;
-
- ireq->opt = kmalloc(opt_size, GFP_ATOMIC);
-- if (ireq->opt != NULL && ip_options_echo(ireq->opt, skb)) {
-+ if (ireq->opt != NULL && ip_options_echo(&ireq->opt->opt, skb)) {
- kfree(ireq->opt);
- ireq->opt = NULL;
- }
-diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
-index b9644d8..6232462 100644
---- a/net/ipv4/tcp.c
-+++ b/net/ipv4/tcp.c
-@@ -847,7 +847,7 @@ wait_for_memory:
- }
-
- out:
-- if (copied)
-+ if (copied && !(flags & MSG_SENDPAGE_NOTLAST))
- tcp_push(sk, flags, mss_now, tp->nonagle);
- return copied;
-
-diff --git a/net/ipv4/tcp_illinois.c b/net/ipv4/tcp_illinois.c
-index 1eba160..c35d91f 100644
---- a/net/ipv4/tcp_illinois.c
-+++ b/net/ipv4/tcp_illinois.c
-@@ -313,11 +313,13 @@ static void tcp_illinois_info(struct sock *sk, u32 ext,
- .tcpv_rttcnt = ca->cnt_rtt,
- .tcpv_minrtt = ca->base_rtt,
- };
-- u64 t = ca->sum_rtt;
-
-- do_div(t, ca->cnt_rtt);
-- info.tcpv_rtt = t;
-+ if (info.tcpv_rttcnt > 0) {
-+ u64 t = ca->sum_rtt;
-
-+ do_div(t, info.tcpv_rttcnt);
-+ info.tcpv_rtt = t;
-+ }
- nla_put(skb, INET_DIAG_VEGASINFO, sizeof(info), &info);
- }
- }
-diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
-index 6a4e832..d746d3b3 100644
---- a/net/ipv4/tcp_ipv4.c
-+++ b/net/ipv4/tcp_ipv4.c
-@@ -152,6 +152,7 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
- __be32 daddr, nexthop;
- int tmp;
- int err;
-+ struct ip_options_rcu *inet_opt;
-
- if (addr_len < sizeof(struct sockaddr_in))
- return -EINVAL;
-@@ -160,10 +161,11 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
- return -EAFNOSUPPORT;
-
- nexthop = daddr = usin->sin_addr.s_addr;
-- if (inet->opt && inet->opt->srr) {
-+ inet_opt = inet->inet_opt;
-+ if (inet_opt && inet_opt->opt.srr) {
- if (!daddr)
- return -EINVAL;
-- nexthop = inet->opt->faddr;
-+ nexthop = inet_opt->opt.faddr;
- }
-
- tmp = ip_route_connect(&rt, nexthop, inet->saddr,
-@@ -181,7 +183,7 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
- return -ENETUNREACH;
- }
-
-- if (!inet->opt || !inet->opt->srr)
-+ if (!inet_opt || !inet_opt->opt.srr)
- daddr = rt->rt_dst;
-
- if (!inet->saddr)
-@@ -215,8 +217,8 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
- inet->daddr = daddr;
-
- inet_csk(sk)->icsk_ext_hdr_len = 0;
-- if (inet->opt)
-- inet_csk(sk)->icsk_ext_hdr_len = inet->opt->optlen;
-+ if (inet_opt)
-+ inet_csk(sk)->icsk_ext_hdr_len = inet_opt->opt.optlen;
-
- tp->rx_opt.mss_clamp = 536;
-
-@@ -802,17 +804,18 @@ static void syn_flood_warning(struct sk_buff *skb)
- /*
- * Save and compile IPv4 options into the request_sock if needed.
- */
--static struct ip_options *tcp_v4_save_options(struct sock *sk,
-- struct sk_buff *skb)
-+static struct ip_options_rcu *tcp_v4_save_options(struct sock *sk,
-+ struct sk_buff *skb)
- {
-- struct ip_options *opt = &(IPCB(skb)->opt);
-- struct ip_options *dopt = NULL;
-+ const struct ip_options *opt = &(IPCB(skb)->opt);
-+ struct ip_options_rcu *dopt = NULL;
-
- if (opt && opt->optlen) {
-- int opt_size = optlength(opt);
-+ int opt_size = sizeof(*dopt) + opt->optlen;
-+
- dopt = kmalloc(opt_size, GFP_ATOMIC);
- if (dopt) {
-- if (ip_options_echo(dopt, skb)) {
-+ if (ip_options_echo(&dopt->opt, skb)) {
- kfree(dopt);
- dopt = NULL;
- }
-@@ -1362,6 +1365,7 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
- #ifdef CONFIG_TCP_MD5SIG
- struct tcp_md5sig_key *key;
- #endif
-+ struct ip_options_rcu *inet_opt;
-
- if (sk_acceptq_is_full(sk))
- goto exit_overflow;
-@@ -1382,13 +1386,14 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
- newinet->daddr = ireq->rmt_addr;
- newinet->rcv_saddr = ireq->loc_addr;
- newinet->saddr = ireq->loc_addr;
-- newinet->opt = ireq->opt;
-+ inet_opt = ireq->opt;
-+ rcu_assign_pointer(newinet->inet_opt, inet_opt);
- ireq->opt = NULL;
- newinet->mc_index = inet_iif(skb);
- newinet->mc_ttl = ip_hdr(skb)->ttl;
- inet_csk(newsk)->icsk_ext_hdr_len = 0;
-- if (newinet->opt)
-- inet_csk(newsk)->icsk_ext_hdr_len = newinet->opt->optlen;
-+ if (inet_opt)
-+ inet_csk(newsk)->icsk_ext_hdr_len = inet_opt->opt.optlen;
- newinet->id = newtp->write_seq ^ jiffies;
-
- tcp_mtup_init(newsk);
-diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
-index af83bdf..38a23e4 100644
---- a/net/ipv4/tcp_output.c
-+++ b/net/ipv4/tcp_output.c
-@@ -1391,8 +1391,11 @@ static int tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb)
- goto send_now;
- }
-
-- /* Ok, it looks like it is advisable to defer. */
-- tp->tso_deferred = 1 | (jiffies << 1);
-+ /* Ok, it looks like it is advisable to defer.
-+ * Do not rearm the timer if already set to not break TCP ACK clocking.
-+ */
-+ if (!tp->tso_deferred)
-+ tp->tso_deferred = 1 | (jiffies << 1);
-
- return 1;
-
-diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
-index 8e28770..af559e0 100644
---- a/net/ipv4/udp.c
-+++ b/net/ipv4/udp.c
-@@ -592,6 +592,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
- int err, is_udplite = IS_UDPLITE(sk);
- int corkreq = up->corkflag || msg->msg_flags&MSG_MORE;
- int (*getfrag)(void *, char *, int, int, int, struct sk_buff *);
-+ struct ip_options_data opt_copy;
-
- if (len > 0xFFFF)
- return -EMSGSIZE;
-@@ -663,22 +664,32 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
- free = 1;
- connected = 0;
- }
-- if (!ipc.opt)
-- ipc.opt = inet->opt;
-+ if (!ipc.opt) {
-+ struct ip_options_rcu *inet_opt;
-+
-+ rcu_read_lock();
-+ inet_opt = rcu_dereference(inet->inet_opt);
-+ if (inet_opt) {
-+ memcpy(&opt_copy, inet_opt,
-+ sizeof(*inet_opt) + inet_opt->opt.optlen);
-+ ipc.opt = &opt_copy.opt;
-+ }
-+ rcu_read_unlock();
-+ }
-
- saddr = ipc.addr;
- ipc.addr = faddr = daddr;
-
-- if (ipc.opt && ipc.opt->srr) {
-+ if (ipc.opt && ipc.opt->opt.srr) {
- if (!daddr)
- return -EINVAL;
-- faddr = ipc.opt->faddr;
-+ faddr = ipc.opt->opt.faddr;
- connected = 0;
- }
- tos = RT_TOS(inet->tos);
- if (sock_flag(sk, SOCK_LOCALROUTE) ||
- (msg->msg_flags & MSG_DONTROUTE) ||
-- (ipc.opt && ipc.opt->is_strictroute)) {
-+ (ipc.opt && ipc.opt->opt.is_strictroute)) {
- tos |= RTO_ONLINK;
- connected = 0;
- }
-diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
-index e127a32..835590d 100644
---- a/net/ipv6/af_inet6.c
-+++ b/net/ipv6/af_inet6.c
-@@ -1073,6 +1073,8 @@ static int __init inet6_init(void)
- goto out;
- }
-
-+ initialize_hashidentrnd();
-+
- err = proto_register(&tcpv6_prot, 1);
- if (err)
- goto out;
-diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
-index 9ad5792..6ba0fe2 100644
---- a/net/ipv6/ip6_output.c
-+++ b/net/ipv6/ip6_output.c
-@@ -604,6 +604,35 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
- return offset;
- }
-
-+static u32 hashidentrnd __read_mostly;
-+#define FID_HASH_SZ 16
-+static u32 ipv6_fragmentation_id[FID_HASH_SZ];
-+
-+void __init initialize_hashidentrnd(void)
-+{
-+ get_random_bytes(&hashidentrnd, sizeof(hashidentrnd));
-+}
-+
-+static u32 __ipv6_select_ident(const struct in6_addr *addr)
-+{
-+ u32 newid, oldid, hash = jhash2((u32 *)addr, 4, hashidentrnd);
-+ u32 *pid = &ipv6_fragmentation_id[hash % FID_HASH_SZ];
-+
-+ do {
-+ oldid = *pid;
-+ newid = oldid + 1;
-+ if (!(hash + newid))
-+ newid++;
-+ } while (cmpxchg(pid, oldid, newid) != oldid);
-+
-+ return hash + newid;
-+}
-+
-+void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
-+{
-+ fhdr->identification = htonl(__ipv6_select_ident(&rt->rt6i_dst.addr));
-+}
-+
- static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
- {
- struct sk_buff *frag;
-@@ -689,7 +718,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
- skb_reset_network_header(skb);
- memcpy(skb_network_header(skb), tmp_hdr, hlen);
-
-- ipv6_select_ident(fh);
-+ ipv6_select_ident(fh, rt);
- fh->nexthdr = nexthdr;
- fh->reserved = 0;
- fh->frag_off = htons(IP6_MF);
-@@ -835,7 +864,7 @@ slow_path:
- fh->nexthdr = nexthdr;
- fh->reserved = 0;
- if (!frag_id) {
-- ipv6_select_ident(fh);
-+ ipv6_select_ident(fh, rt);
- frag_id = fh->identification;
- } else
- fh->identification = frag_id;
-@@ -1039,7 +1068,8 @@ static inline int ip6_ufo_append_data(struct sock *sk,
- int getfrag(void *from, char *to, int offset, int len,
- int odd, struct sk_buff *skb),
- void *from, int length, int hh_len, int fragheaderlen,
-- int transhdrlen, int mtu,unsigned int flags)
-+ int transhdrlen, int mtu,unsigned int flags,
-+ struct rt6_info *rt)
-
- {
- struct sk_buff *skb;
-@@ -1084,7 +1114,7 @@ static inline int ip6_ufo_append_data(struct sock *sk,
- skb_shinfo(skb)->gso_size = (mtu - fragheaderlen -
- sizeof(struct frag_hdr)) & ~7;
- skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
-- ipv6_select_ident(&fhdr);
-+ ipv6_select_ident(&fhdr, rt);
- skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
- __skb_queue_tail(&sk->sk_write_queue, skb);
-
-@@ -1233,7 +1263,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
-
- err = ip6_ufo_append_data(sk, getfrag, from, length, hh_len,
- fragheaderlen, transhdrlen, mtu,
-- flags);
-+ flags, rt);
- if (err)
- goto error;
- return 0;
-diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
-index 4d18699..105de22 100644
---- a/net/ipv6/reassembly.c
-+++ b/net/ipv6/reassembly.c
-@@ -148,16 +148,6 @@ int ip6_frag_match(struct inet_frag_queue *q, void *a)
- }
- EXPORT_SYMBOL(ip6_frag_match);
-
--/* Memory Tracking Functions. */
--static inline void frag_kfree_skb(struct netns_frags *nf,
-- struct sk_buff *skb, int *work)
--{
-- if (work)
-- *work -= skb->truesize;
-- atomic_sub(skb->truesize, &nf->mem);
-- kfree_skb(skb);
--}
--
- void ip6_frag_init(struct inet_frag_queue *q, void *a)
- {
- struct frag_queue *fq = container_of(q, struct frag_queue, q);
-@@ -348,58 +338,22 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
- prev = next;
- }
-
-- /* We found where to put this one. Check for overlap with
-- * preceding fragment, and, if needed, align things so that
-- * any overlaps are eliminated.
-+ /* RFC5722, Section 4:
-+ * When reassembling an IPv6 datagram, if
-+ * one or more its constituent fragments is determined to be an
-+ * overlapping fragment, the entire datagram (and any constituent
-+ * fragments, including those not yet received) MUST be silently
-+ * discarded.
- */
-- if (prev) {
-- int i = (FRAG6_CB(prev)->offset + prev->len) - offset;
-
-- if (i > 0) {
-- offset += i;
-- if (end <= offset)
-- goto err;
-- if (!pskb_pull(skb, i))
-- goto err;
-- if (skb->ip_summed != CHECKSUM_UNNECESSARY)
-- skb->ip_summed = CHECKSUM_NONE;
-- }
-- }
-+ /* Check for overlap with preceding fragment. */
-+ if (prev &&
-+ (FRAG6_CB(prev)->offset + prev->len) - offset > 0)
-+ goto discard_fq;
-
-- /* Look for overlap with succeeding segments.
-- * If we can merge fragments, do it.
-- */
-- while (next && FRAG6_CB(next)->offset < end) {
-- int i = end - FRAG6_CB(next)->offset; /* overlap is 'i' bytes */
--
-- if (i < next->len) {
-- /* Eat head of the next overlapped fragment
-- * and leave the loop. The next ones cannot overlap.
-- */
-- if (!pskb_pull(next, i))
-- goto err;
-- FRAG6_CB(next)->offset += i; /* next fragment */
-- fq->q.meat -= i;
-- if (next->ip_summed != CHECKSUM_UNNECESSARY)
-- next->ip_summed = CHECKSUM_NONE;
-- break;
-- } else {
-- struct sk_buff *free_it = next;
--
-- /* Old fragment is completely overridden with
-- * new one drop it.
-- */
-- next = next->next;
--
-- if (prev)
-- prev->next = next;
-- else
-- fq->q.fragments = next;
--
-- fq->q.meat -= free_it->len;
-- frag_kfree_skb(fq->q.net, free_it, NULL);
-- }
-- }
-+ /* Look for overlap with succeeding segment. */
-+ if (next && FRAG6_CB(next)->offset < end)
-+ goto discard_fq;
-
- FRAG6_CB(skb)->offset = offset;
-
-@@ -436,6 +390,8 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
- write_unlock(&ip6_frags.lock);
- return -1;
-
-+discard_fq:
-+ fq_kill(fq);
- err:
- IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
- IPSTATS_MIB_REASMFAILS);
-diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
-index faae6df..1b25191 100644
---- a/net/ipv6/tcp_ipv6.c
-+++ b/net/ipv6/tcp_ipv6.c
-@@ -1391,7 +1391,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
-
- First: no IPv4 options.
- */
-- newinet->opt = NULL;
-+ newinet->inet_opt = NULL;
- newnp->ipv6_fl_list = NULL;
-
- /* Clone RX bits */
-diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
-index 9cc6289..d8c0374 100644
---- a/net/ipv6/udp.c
-+++ b/net/ipv6/udp.c
-@@ -1162,7 +1162,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb, int features)
- fptr = (struct frag_hdr *)(skb_network_header(skb) + unfrag_ip6hlen);
- fptr->nexthdr = nexthdr;
- fptr->reserved = 0;
-- ipv6_select_ident(fptr);
-+ ipv6_select_ident(fptr, (struct rt6_info *)skb_dst(skb));
-
- /* Fragment the skb. ipv6 header and the remaining fields of the
- * fragment header are updated in ipv6_gso_segment()
-diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
-index 476b24e..bfb325d 100644
---- a/net/irda/af_irda.c
-+++ b/net/irda/af_irda.c
-@@ -1338,6 +1338,8 @@ static int irda_recvmsg_dgram(struct kiocb *iocb, struct socket *sock,
- if ((err = sock_error(sk)) < 0)
- return err;
-
-+ msg->msg_namelen = 0;
-+
- skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
- flags & MSG_DONTWAIT, &err);
- if (!skb)
-diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
-index bada1b9..f605b23 100644
---- a/net/iucv/af_iucv.c
-+++ b/net/iucv/af_iucv.c
-@@ -1160,6 +1160,8 @@ static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
- struct sk_buff *skb, *rskb, *cskb;
- int err = 0;
-
-+ msg->msg_namelen = 0;
-+
- if ((sk->sk_state == IUCV_DISCONN || sk->sk_state == IUCV_SEVERED) &&
- skb_queue_empty(&iucv->backlog_skb_q) &&
- skb_queue_empty(&sk->sk_receive_queue) &&
-diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
-index 2da8d14..8a814a5 100644
---- a/net/llc/af_llc.c
-+++ b/net/llc/af_llc.c
-@@ -674,6 +674,8 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
- int target; /* Read at least this many bytes */
- long timeo;
-
-+ msg->msg_namelen = 0;
-+
- lock_sock(sk);
- copied = -ENOTCONN;
- if (unlikely(sk->sk_type == SOCK_STREAM && sk->sk_state == TCP_LISTEN))
-@@ -912,14 +914,13 @@ static int llc_ui_getname(struct socket *sock, struct sockaddr *uaddr,
- struct sockaddr_llc sllc;
- struct sock *sk = sock->sk;
- struct llc_sock *llc = llc_sk(sk);
-- int rc = 0;
-+ int rc = -EBADF;
-
- memset(&sllc, 0, sizeof(sllc));
- lock_sock(sk);
- if (sock_flag(sk, SOCK_ZAPPED))
- goto out;
- *uaddrlen = sizeof(sllc);
-- memset(uaddr, 0, *uaddrlen);
- if (peer) {
- rc = -ENOTCONN;
- if (sk->sk_state != TCP_ESTABLISHED)
-diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
-index 02b2610..9bcd972 100644
---- a/net/netfilter/ipvs/ip_vs_ctl.c
-+++ b/net/netfilter/ipvs/ip_vs_ctl.c
-@@ -2455,6 +2455,7 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
- {
- struct ip_vs_timeout_user t;
-
-+ memset(&t, 0, sizeof(t));
- __ip_vs_get_timeouts(&t);
- if (copy_to_user(user, &t, sizeof(t)) != 0)
- ret = -EFAULT;
-diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
-index 30b3189..5be9140 100644
---- a/net/netfilter/ipvs/ip_vs_xmit.c
-+++ b/net/netfilter/ipvs/ip_vs_xmit.c
-@@ -64,6 +64,15 @@ __ip_vs_dst_check(struct ip_vs_dest *dest, u32 rtos, u32 cookie)
- return dst;
- }
-
-+static inline bool
-+__mtu_check_toobig_v6(const struct sk_buff *skb, u32 mtu)
-+{
-+ if (skb->len > mtu && !skb_is_gso(skb)) {
-+ return true; /* Packet size violate MTU size */
-+ }
-+ return false;
-+}
-+
- static struct rtable *
- __ip_vs_get_out_rt(struct ip_vs_conn *cp, u32 rtos)
- {
-@@ -245,7 +254,8 @@ ip_vs_bypass_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
-
- /* MTU checking */
- mtu = dst_mtu(&rt->u.dst);
-- if ((skb->len > mtu) && (iph->frag_off & htons(IP_DF))) {
-+ if ((skb->len > mtu) && (iph->frag_off & htons(IP_DF)) &&
-+ !skb_is_gso(skb)) {
- ip_rt_put(rt);
- icmp_send(skb, ICMP_DEST_UNREACH,ICMP_FRAG_NEEDED, htonl(mtu));
- IP_VS_DBG_RL("%s(): frag needed\n", __func__);
-@@ -309,7 +319,7 @@ ip_vs_bypass_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
-
- /* MTU checking */
- mtu = dst_mtu(&rt->u.dst);
-- if (skb->len > mtu) {
-+ if (__mtu_check_toobig_v6(skb, mtu)) {
- dst_release(&rt->u.dst);
- icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
- IP_VS_DBG_RL("%s(): frag needed\n", __func__);
-@@ -376,7 +386,7 @@ ip_vs_nat_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
-
- /* MTU checking */
- mtu = dst_mtu(&rt->u.dst);
-- if ((skb->len > mtu) && (iph->frag_off & htons(IP_DF))) {
-+ if ((skb->len > mtu) && (iph->frag_off & htons(IP_DF)) && !skb_is_gso(skb)) {
- ip_rt_put(rt);
- icmp_send(skb, ICMP_DEST_UNREACH,ICMP_FRAG_NEEDED, htonl(mtu));
- IP_VS_DBG_RL_PKT(0, pp, skb, 0, "ip_vs_nat_xmit(): frag needed for");
-@@ -452,7 +462,7 @@ ip_vs_nat_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
-
- /* MTU checking */
- mtu = dst_mtu(&rt->u.dst);
-- if (skb->len > mtu) {
-+ if (__mtu_check_toobig_v6(skb, mtu)) {
- dst_release(&rt->u.dst);
- icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
- IP_VS_DBG_RL_PKT(0, pp, skb, 0,
-@@ -561,8 +571,8 @@ ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
-
- df |= (old_iph->frag_off & htons(IP_DF));
-
-- if ((old_iph->frag_off & htons(IP_DF))
-- && mtu < ntohs(old_iph->tot_len)) {
-+ if ((old_iph->frag_off & htons(IP_DF) &&
-+ mtu < ntohs(old_iph->tot_len) && !skb_is_gso(skb))) {
- icmp_send(skb, ICMP_DEST_UNREACH,ICMP_FRAG_NEEDED, htonl(mtu));
- ip_rt_put(rt);
- IP_VS_DBG_RL("%s(): frag needed\n", __func__);
-@@ -671,7 +681,8 @@ ip_vs_tunnel_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
- if (skb_dst(skb))
- skb_dst(skb)->ops->update_pmtu(skb_dst(skb), mtu);
-
-- if (mtu < ntohs(old_iph->payload_len) + sizeof(struct ipv6hdr)) {
-+ /* MTU checking: Notice that 'mtu' have been adjusted before hand */
-+ if (__mtu_check_toobig_v6(skb, mtu)) {
- icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
- dst_release(&rt->u.dst);
- IP_VS_DBG_RL("%s(): frag needed\n", __func__);
-@@ -760,7 +771,7 @@ ip_vs_dr_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
-
- /* MTU checking */
- mtu = dst_mtu(&rt->u.dst);
-- if ((iph->frag_off & htons(IP_DF)) && skb->len > mtu) {
-+ if ((iph->frag_off & htons(IP_DF)) && skb->len > mtu && !skb_is_gso(skb)) {
- icmp_send(skb, ICMP_DEST_UNREACH,ICMP_FRAG_NEEDED, htonl(mtu));
- ip_rt_put(rt);
- IP_VS_DBG_RL("%s(): frag needed\n", __func__);
-@@ -813,7 +824,7 @@ ip_vs_dr_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
-
- /* MTU checking */
- mtu = dst_mtu(&rt->u.dst);
-- if (skb->len > mtu) {
-+ if (__mtu_check_toobig_v6(skb, mtu)) {
- icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
- dst_release(&rt->u.dst);
- IP_VS_DBG_RL("%s(): frag needed\n", __func__);
-@@ -888,7 +899,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
-
- /* MTU checking */
- mtu = dst_mtu(&rt->u.dst);
-- if ((skb->len > mtu) && (ip_hdr(skb)->frag_off & htons(IP_DF))) {
-+ if ((skb->len > mtu) && (ip_hdr(skb)->frag_off & htons(IP_DF)) && !skb_is_gso(skb)) {
- ip_rt_put(rt);
- icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
- IP_VS_DBG_RL("%s(): frag needed\n", __func__);
-@@ -963,7 +974,7 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
-
- /* MTU checking */
- mtu = dst_mtu(&rt->u.dst);
-- if (skb->len > mtu) {
-+ if (__mtu_check_toobig_v6(skb, mtu)) {
- dst_release(&rt->u.dst);
- icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
- IP_VS_DBG_RL("%s(): frag needed\n", __func__);
-diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
-index 35cfa79..728c080 100644
---- a/net/packet/af_packet.c
-+++ b/net/packet/af_packet.c
-@@ -828,7 +828,6 @@ static void tpacket_destruct_skb(struct sk_buff *skb)
-
- if (likely(po->tx_ring.pg_vec)) {
- ph = skb_shinfo(skb)->destructor_arg;
-- BUG_ON(__packet_get_status(po, ph) != TP_STATUS_SENDING);
- BUG_ON(atomic_read(&po->tx_ring.pending) == 0);
- atomic_dec(&po->tx_ring.pending);
- __packet_set_status(po, ph, TP_STATUS_AVAILABLE);
-diff --git a/net/rds/recv.c b/net/rds/recv.c
-index 6a2654a..c45a881c 100644
---- a/net/rds/recv.c
-+++ b/net/rds/recv.c
-@@ -410,6 +410,8 @@ int rds_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
-
- rdsdebug("size %zu flags 0x%x timeo %ld\n", size, msg_flags, timeo);
-
-+ msg->msg_namelen = 0;
-+
- if (msg_flags & MSG_OOB)
- goto out;
-
-@@ -486,6 +488,7 @@ int rds_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
- sin->sin_port = inc->i_hdr.h_sport;
- sin->sin_addr.s_addr = inc->i_saddr;
- memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
-+ msg->msg_namelen = sizeof(*sin);
- }
- break;
- }
-diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
-index 523efbb..2984999 100644
---- a/net/rose/af_rose.c
-+++ b/net/rose/af_rose.c
-@@ -1275,6 +1275,7 @@ static int rose_recvmsg(struct kiocb *iocb, struct socket *sock,
- skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
-
- if (srose != NULL) {
-+ memset(srose, 0, msg->msg_namelen);
- srose->srose_family = AF_ROSE;
- srose->srose_addr = rose->dest_addr;
- srose->srose_call = rose->dest_call;
-diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c
-index f9fc6ec..faebd8a 100644
---- a/net/sched/act_gact.c
-+++ b/net/sched/act_gact.c
-@@ -67,6 +67,9 @@ static int tcf_gact_init(struct nlattr *nla, struct nlattr *est,
- struct tcf_common *pc;
- int ret = 0;
- int err;
-+#ifdef CONFIG_GACT_PROB
-+ struct tc_gact_p *p_parm = NULL;
-+#endif
-
- if (nla == NULL)
- return -EINVAL;
-@@ -82,6 +85,12 @@ static int tcf_gact_init(struct nlattr *nla, struct nlattr *est,
- #ifndef CONFIG_GACT_PROB
- if (tb[TCA_GACT_PROB] != NULL)
- return -EOPNOTSUPP;
-+#else
-+ if (tb[TCA_GACT_PROB]) {
-+ p_parm = nla_data(tb[TCA_GACT_PROB]);
-+ if (p_parm->ptype >= MAX_RAND)
-+ return -EINVAL;
-+ }
- #endif
-
- pc = tcf_hash_check(parm->index, a, bind, &gact_hash_info);
-@@ -103,8 +112,7 @@ static int tcf_gact_init(struct nlattr *nla, struct nlattr *est,
- spin_lock_bh(&gact->tcf_lock);
- gact->tcf_action = parm->action;
- #ifdef CONFIG_GACT_PROB
-- if (tb[TCA_GACT_PROB] != NULL) {
-- struct tc_gact_p *p_parm = nla_data(tb[TCA_GACT_PROB]);
-+ if (p_parm) {
- gact->tcfg_paction = p_parm->paction;
- gact->tcfg_pval = p_parm->pval;
- gact->tcfg_ptype = p_parm->ptype;
-@@ -132,7 +140,7 @@ static int tcf_gact(struct sk_buff *skb, struct tc_action *a, struct tcf_result
-
- spin_lock(&gact->tcf_lock);
- #ifdef CONFIG_GACT_PROB
-- if (gact->tcfg_ptype && gact_rand[gact->tcfg_ptype] != NULL)
-+ if (gact->tcfg_ptype)
- action = gact_rand[gact->tcfg_ptype](gact);
- else
- action = gact->tcf_action;
-diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
-index 85acab9..2f074d6 100644
---- a/net/sched/sch_htb.c
-+++ b/net/sched/sch_htb.c
-@@ -865,7 +865,7 @@ static struct sk_buff *htb_dequeue(struct Qdisc *sch)
- q->now = psched_get_time();
- start_at = jiffies;
-
-- next_event = q->now + 5 * PSCHED_TICKS_PER_SEC;
-+ next_event = q->now + 5LLU * PSCHED_TICKS_PER_SEC;
-
- for (level = 0; level < TC_HTB_MAXDEPTH; level++) {
- /* common case optimization - skip event handler quickly */
-diff --git a/net/sctp/auth.c b/net/sctp/auth.c
-index 914c419..7363b9f 100644
---- a/net/sctp/auth.c
-+++ b/net/sctp/auth.c
-@@ -70,7 +70,7 @@ void sctp_auth_key_put(struct sctp_auth_bytes *key)
- return;
-
- if (atomic_dec_and_test(&key->refcnt)) {
-- kfree(key);
-+ kzfree(key);
- SCTP_DBG_OBJCNT_DEC(keys);
- }
- }
-diff --git a/net/sctp/chunk.c b/net/sctp/chunk.c
-index acf7c4d..b29621d 100644
---- a/net/sctp/chunk.c
-+++ b/net/sctp/chunk.c
-@@ -272,7 +272,7 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
- goto errout;
- err = sctp_user_addto_chunk(chunk, offset, len, msgh->msg_iov);
- if (err < 0)
-- goto errout;
-+ goto errout_chunk_free;
-
- offset += len;
-
-@@ -308,7 +308,7 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
- __skb_pull(chunk->skb, (__u8 *)chunk->chunk_hdr
- - (__u8 *)chunk->skb->data);
- if (err < 0)
-- goto errout;
-+ goto errout_chunk_free;
-
- sctp_datamsg_assign(msg, chunk);
- list_add_tail(&chunk->frag_list, &msg->chunks);
-@@ -316,6 +316,9 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
-
- return msg;
-
-+errout_chunk_free:
-+ sctp_chunk_free(chunk);
-+
- errout:
- list_for_each_safe(pos, temp, &msg->chunks) {
- list_del_init(pos);
-diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
-index 905fda5..ca48660 100644
---- a/net/sctp/endpointola.c
-+++ b/net/sctp/endpointola.c
-@@ -249,6 +249,8 @@ void sctp_endpoint_free(struct sctp_endpoint *ep)
- /* Final destructor for endpoint. */
- static void sctp_endpoint_destroy(struct sctp_endpoint *ep)
- {
-+ int i;
-+
- SCTP_ASSERT(ep->base.dead, "Endpoint is not dead", return);
-
- /* Free up the HMAC transform. */
-@@ -271,6 +273,9 @@ static void sctp_endpoint_destroy(struct sctp_endpoint *ep)
- sctp_inq_free(&ep->base.inqueue);
- sctp_bind_addr_free(&ep->base.bind_addr);
-
-+ for (i = 0; i < SCTP_HOW_MANY_SECRETS; ++i)
-+ memset(&ep->secret_key[i], 0, SCTP_SECRET_SIZE);
-+
- /* Remove and free the port */
- if (sctp_sk(ep->base.sk)->bind_hash)
- sctp_put_port(ep->base.sk);
-diff --git a/net/sctp/socket.c b/net/sctp/socket.c
-index 1f9843e..26ffae2 100644
---- a/net/sctp/socket.c
-+++ b/net/sctp/socket.c
-@@ -3271,7 +3271,7 @@ static int sctp_setsockopt_auth_key(struct sock *sk,
-
- ret = sctp_auth_set_key(sctp_sk(sk)->ep, asoc, authkey);
- out:
-- kfree(authkey);
-+ kzfree(authkey);
- return ret;
- }
-
-diff --git a/net/socket.c b/net/socket.c
-index d449812..bf9fc68 100644
---- a/net/socket.c
-+++ b/net/socket.c
-@@ -732,9 +732,9 @@ static ssize_t sock_sendpage(struct file *file, struct page *page,
-
- sock = file->private_data;
-
-- flags = !(file->f_flags & O_NONBLOCK) ? 0 : MSG_DONTWAIT;
-- if (more)
-- flags |= MSG_MORE;
-+ flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
-+ /* more is a combination of MSG_MORE and MSG_SENDPAGE_NOTLAST */
-+ flags |= more;
-
- return kernel_sendpage(sock, page, offset, size, flags);
- }
-diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
-index ea1e6de..43aa601 100644
---- a/net/sunrpc/rpc_pipe.c
-+++ b/net/sunrpc/rpc_pipe.c
-@@ -459,7 +459,7 @@ static int __rpc_create_common(struct inode *dir, struct dentry *dentry,
- {
- struct inode *inode;
-
-- BUG_ON(!d_unhashed(dentry));
-+ d_drop(dentry);
- inode = rpc_get_inode(dir->i_sb, mode);
- if (!inode)
- goto out_err;
-diff --git a/net/tipc/socket.c b/net/tipc/socket.c
-index 8ebf4975..eccb86b 100644
---- a/net/tipc/socket.c
-+++ b/net/tipc/socket.c
-@@ -800,6 +800,7 @@ static void set_orig_addr(struct msghdr *m, struct tipc_msg *msg)
- if (addr) {
- addr->family = AF_TIPC;
- addr->addrtype = TIPC_ADDR_ID;
-+ memset(&addr->addr, 0, sizeof(addr->addr));
- addr->addr.id.ref = msg_origport(msg);
- addr->addr.id.node = msg_orignode(msg);
- addr->addr.name.domain = 0; /* could leave uninitialized */
-@@ -916,6 +917,9 @@ static int recv_msg(struct kiocb *iocb, struct socket *sock,
- goto exit;
- }
-
-+ /* will be updated in set_orig_addr() if needed */
-+ m->msg_namelen = 0;
-+
- restart:
-
- /* Look for a message in receive queue; wait if necessary */
-@@ -1049,6 +1053,9 @@ static int recv_stream(struct kiocb *iocb, struct socket *sock,
- goto exit;
- }
-
-+ /* will be updated in set_orig_addr() if needed */
-+ m->msg_namelen = 0;
-+
- restart:
-
- /* Look for a message in receive queue; wait if necessary */
-diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index db8d51a..d146b76 100644
---- a/net/unix/af_unix.c
-+++ b/net/unix/af_unix.c
-@@ -370,7 +370,7 @@ static void unix_sock_destructor(struct sock *sk)
- #endif
- }
-
--static int unix_release_sock(struct sock *sk, int embrion)
-+static void unix_release_sock(struct sock *sk, int embrion)
- {
- struct unix_sock *u = unix_sk(sk);
- struct dentry *dentry;
-@@ -445,8 +445,6 @@ static int unix_release_sock(struct sock *sk, int embrion)
-
- if (unix_tot_inflight)
- unix_gc(); /* Garbage collect fds */
--
-- return 0;
- }
-
- static int unix_listen(struct socket *sock, int backlog)
-@@ -660,9 +658,10 @@ static int unix_release(struct socket *sock)
- if (!sk)
- return 0;
-
-+ unix_release_sock(sk, 0);
- sock->sk = NULL;
-
-- return unix_release_sock(sk, 0);
-+ return 0;
- }
-
- static int unix_autobind(struct socket *sock)
-diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
-index b95a2d6..06f42f6 100644
---- a/net/xfrm/xfrm_user.c
-+++ b/net/xfrm/xfrm_user.c
-@@ -506,6 +506,7 @@ out:
-
- static void copy_to_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
- {
-+ memset(p, 0, sizeof(*p));
- memcpy(&p->id, &x->id, sizeof(p->id));
- memcpy(&p->sel, &x->sel, sizeof(p->sel));
- memcpy(&p->lft, &x->lft, sizeof(p->lft));
-@@ -646,6 +647,7 @@ static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb,
- {
- struct xfrm_dump_info info;
- struct sk_buff *skb;
-+ int err;
-
- skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
- if (!skb)
-@@ -656,9 +658,10 @@ static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb,
- info.nlmsg_seq = seq;
- info.nlmsg_flags = 0;
-
-- if (dump_one_state(x, 0, &info)) {
-+ err = dump_one_state(x, 0, &info);
-+ if (err) {
- kfree_skb(skb);
-- return NULL;
-+ return ERR_PTR(err);
- }
-
- return skb;
-@@ -1075,6 +1078,7 @@ static void copy_from_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy
-
- static void copy_to_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p, int dir)
- {
-+ memset(p, 0, sizeof(*p));
- memcpy(&p->sel, &xp->selector, sizeof(p->sel));
- memcpy(&p->lft, &xp->lft, sizeof(p->lft));
- memcpy(&p->curlft, &xp->curlft, sizeof(p->curlft));
-@@ -1176,6 +1180,7 @@ static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb)
- struct xfrm_user_tmpl *up = &vec[i];
- struct xfrm_tmpl *kp = &xp->xfrm_vec[i];
-
-+ memset(up, 0, sizeof(*up));
- memcpy(&up->id, &kp->id, sizeof(up->id));
- up->family = kp->encap_family;
- memcpy(&up->saddr, &kp->saddr, sizeof(up->saddr));
-@@ -1301,6 +1306,7 @@ static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb,
- {
- struct xfrm_dump_info info;
- struct sk_buff *skb;
-+ int err;
-
- skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
- if (!skb)
-@@ -1311,9 +1317,10 @@ static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb,
- info.nlmsg_seq = seq;
- info.nlmsg_flags = 0;
-
-- if (dump_one_policy(xp, dir, 0, &info) < 0) {
-+ err = dump_one_policy(xp, dir, 0, &info);
-+ if (err) {
- kfree_skb(skb);
-- return NULL;
-+ return ERR_PTR(err);
- }
-
- return skb;
-diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include
-index 92b62a8..5405ff17 100644
---- a/scripts/Kbuild.include
-+++ b/scripts/Kbuild.include
-@@ -94,24 +94,24 @@ try-run = $(shell set -e; \
- # Usage: cflags-y += $(call as-option,-Wa$(comma)-isa=foo,)
-
- as-option = $(call try-run,\
-- $(CC) $(KBUILD_CFLAGS) $(1) -c -xassembler /dev/null -o "$$TMP",$(1),$(2))
-+ $(CC) $(KBUILD_CFLAGS) $(1) -c -x assembler /dev/null -o "$$TMP",$(1),$(2))
-
- # as-instr
- # Usage: cflags-y += $(call as-instr,instr,option1,option2)
-
- as-instr = $(call try-run,\
-- /bin/echo -e "$(1)" | $(CC) $(KBUILD_AFLAGS) -c -xassembler -o "$$TMP" -,$(2),$(3))
-+ /bin/echo -e "$(1)" | $(CC) $(KBUILD_AFLAGS) -c -x assembler -o "$$TMP" -,$(2),$(3))
-
- # cc-option
- # Usage: cflags-y += $(call cc-option,-march=winchip-c6,-march=i586)
-
- cc-option = $(call try-run,\
-- $(CC) $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) $(1) -c -xc /dev/null -o "$$TMP",$(1),$(2))
-+ $(CC) $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) $(1) -c -x c /dev/null -o "$$TMP",$(1),$(2))
-
- # cc-option-yn
- # Usage: flag := $(call cc-option-yn,-march=winchip-c6)
- cc-option-yn = $(call try-run,\
-- $(CC) $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) $(1) -c -xc /dev/null -o "$$TMP",y,n)
-+ $(CC) $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) $(1) -c -x c /dev/null -o "$$TMP",y,n)
-
- # cc-option-align
- # Prefix align with either -falign or -malign
-@@ -121,7 +121,7 @@ cc-option-align = $(subst -functions=0,,\
- # cc-disable-warning
- # Usage: cflags-y += $(call cc-disable-warning,unused-but-set-variable)
- cc-disable-warning = $(call try-run,\
-- $(CC) $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) -W$(strip $(1)) -c -xc /dev/null -o "$$TMP",-Wno-$(strip $(1)))
-+ $(CC) $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) -W$(strip $(1)) -c -x c /dev/null -o "$$TMP",-Wno-$(strip $(1)))
-
- # cc-version
- # Usage gcc-ver := $(call cc-version)
-@@ -139,7 +139,7 @@ cc-ifversion = $(shell [ $(call cc-version, $(CC)) $(1) $(2) ] && echo $(3))
- # cc-ldoption
- # Usage: ldflags += $(call cc-ldoption, -Wl$(comma)--hash-style=both)
- cc-ldoption = $(call try-run,\
-- $(CC) $(1) -nostdlib -xc /dev/null -o "$$TMP",$(1),$(2))
-+ $(CC) $(1) -nostdlib -x c /dev/null -o "$$TMP",$(1),$(2))
-
- # ld-option
- # Usage: LDFLAGS += $(call ld-option, -X)
-diff --git a/scripts/gcc-version.sh b/scripts/gcc-version.sh
-index debecb5..7f2126d 100644
---- a/scripts/gcc-version.sh
-+++ b/scripts/gcc-version.sh
-@@ -22,10 +22,10 @@ if [ ${#compiler} -eq 0 ]; then
- exit 1
- fi
-
--MAJOR=$(echo __GNUC__ | $compiler -E -xc - | tail -n 1)
--MINOR=$(echo __GNUC_MINOR__ | $compiler -E -xc - | tail -n 1)
-+MAJOR=$(echo __GNUC__ | $compiler -E -x c - | tail -n 1)
-+MINOR=$(echo __GNUC_MINOR__ | $compiler -E -x c - | tail -n 1)
- if [ "x$with_patchlevel" != "x" ] ; then
-- PATCHLEVEL=$(echo __GNUC_PATCHLEVEL__ | $compiler -E -xc - | tail -n 1)
-+ PATCHLEVEL=$(echo __GNUC_PATCHLEVEL__ | $compiler -E -x c - | tail -n 1)
- printf "%02d%02d%02d\\n" $MAJOR $MINOR $PATCHLEVEL
- else
- printf "%02d%02d\\n" $MAJOR $MINOR
-diff --git a/scripts/gcc-x86_32-has-stack-protector.sh b/scripts/gcc-x86_32-has-stack-protector.sh
-index 29493dc..12dbd0b 100644
---- a/scripts/gcc-x86_32-has-stack-protector.sh
-+++ b/scripts/gcc-x86_32-has-stack-protector.sh
-@@ -1,6 +1,6 @@
- #!/bin/sh
-
--echo "int foo(void) { char X[200]; return 3; }" | $* -S -xc -c -O0 -fstack-protector - -o - 2> /dev/null | grep -q "%gs"
-+echo "int foo(void) { char X[200]; return 3; }" | $* -S -x c -c -O0 -fstack-protector - -o - 2> /dev/null | grep -q "%gs"
- if [ "$?" -eq "0" ] ; then
- echo y
- else
-diff --git a/scripts/gcc-x86_64-has-stack-protector.sh b/scripts/gcc-x86_64-has-stack-protector.sh
-index afaec61..973e8c1 100644
---- a/scripts/gcc-x86_64-has-stack-protector.sh
-+++ b/scripts/gcc-x86_64-has-stack-protector.sh
-@@ -1,6 +1,6 @@
- #!/bin/sh
-
--echo "int foo(void) { char X[200]; return 3; }" | $* -S -xc -c -O0 -mcmodel=kernel -fstack-protector - -o - 2> /dev/null | grep -q "%gs"
-+echo "int foo(void) { char X[200]; return 3; }" | $* -S -x c -c -O0 -mcmodel=kernel -fstack-protector - -o - 2> /dev/null | grep -q "%gs"
- if [ "$?" -eq "0" ] ; then
- echo y
- else
-diff --git a/scripts/kconfig/check.sh b/scripts/kconfig/check.sh
-index fa59cbf..854d9c7 100755
---- a/scripts/kconfig/check.sh
-+++ b/scripts/kconfig/check.sh
-@@ -1,6 +1,6 @@
- #!/bin/sh
- # Needed for systems without gettext
--$* -xc -o /dev/null - > /dev/null 2>&1 << EOF
-+$* -x c -o /dev/null - > /dev/null 2>&1 << EOF
- #include <libintl.h>
- int main()
- {
-diff --git a/scripts/kconfig/lxdialog/check-lxdialog.sh b/scripts/kconfig/lxdialog/check-lxdialog.sh
-index fcef0f5..4bab9e2 100644
---- a/scripts/kconfig/lxdialog/check-lxdialog.sh
-+++ b/scripts/kconfig/lxdialog/check-lxdialog.sh
-@@ -36,7 +36,7 @@ trap "rm -f $tmp" 0 1 2 3 15
-
- # Check if we can link to ncurses
- check() {
-- $cc -xc - -o $tmp 2>/dev/null <<'EOF'
-+ $cc -x c - -o $tmp 2>/dev/null <<'EOF'
- #include CURSES_LOC
- main() {}
- EOF
-diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
-index 931cfda..75fb18c 100644
---- a/security/keys/process_keys.c
-+++ b/security/keys/process_keys.c
-@@ -56,7 +56,7 @@ int install_user_keyrings(void)
-
- kenter("%p{%u}", user, user->uid);
-
-- if (user->uid_keyring) {
-+ if (user->uid_keyring && user->session_keyring) {
- kleave(" = 0 [exist]");
- return 0;
- }
-diff --git a/sound/core/seq/seq_timer.c b/sound/core/seq/seq_timer.c
-index f745c31..c2ec4ef 100644
---- a/sound/core/seq/seq_timer.c
-+++ b/sound/core/seq/seq_timer.c
-@@ -291,10 +291,10 @@ int snd_seq_timer_open(struct snd_seq_queue *q)
- tid.device = SNDRV_TIMER_GLOBAL_SYSTEM;
- err = snd_timer_open(&t, str, &tid, q->queue);
- }
-- if (err < 0) {
-- snd_printk(KERN_ERR "seq fatal error: cannot create timer (%i)\n", err);
-- return err;
-- }
-+ }
-+ if (err < 0) {
-+ snd_printk(KERN_ERR "seq fatal error: cannot create timer (%i)\n", err);
-+ return err;
- }
- t->callback = snd_seq_timer_interrupt;
- t->callback_data = q;
-diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c
-index 78288db..5f295f7 100644
---- a/sound/pci/ac97/ac97_codec.c
-+++ b/sound/pci/ac97/ac97_codec.c
-@@ -1252,6 +1252,8 @@ static int snd_ac97_cvol_new(struct snd_card *card, char *name, int reg, unsigne
- tmp.index = ac97->num;
- kctl = snd_ctl_new1(&tmp, ac97);
- }
-+ if (!kctl)
-+ return -ENOMEM;
- if (reg >= AC97_PHONE && reg <= AC97_PCM)
- set_tlv_db_scale(kctl, db_scale_5bit_12db_max);
- else
-diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
-index 6419095..d9b4453 100644
---- a/sound/pci/hda/patch_realtek.c
-+++ b/sound/pci/hda/patch_realtek.c
-@@ -131,8 +131,8 @@ enum {
- enum {
- ALC269_BASIC,
- ALC269_QUANTA_FL1,
-- ALC269_ASUS_EEEPC_P703,
-- ALC269_ASUS_EEEPC_P901,
-+ ALC269_ASUS_AMIC,
-+ ALC269_ASUS_DMIC,
- ALC269_FUJITSU,
- ALC269_LIFEBOOK,
- ALC269_AUTO,
-@@ -188,6 +188,8 @@ enum {
- ALC663_ASUS_MODE4,
- ALC663_ASUS_MODE5,
- ALC663_ASUS_MODE6,
-+ ALC663_ASUS_MODE7,
-+ ALC663_ASUS_MODE8,
- ALC272_DELL,
- ALC272_DELL_ZM1,
- ALC272_SAMSUNG_NC10,
-@@ -13234,10 +13236,12 @@ static struct hda_verb alc269_eeepc_amic_init_verbs[] = {
- /* toggle speaker-output according to the hp-jack state */
- static void alc269_speaker_automute(struct hda_codec *codec)
- {
-+ struct alc_spec *spec = codec->spec;
-+ unsigned int nid = spec->autocfg.hp_pins[0];
- unsigned int present;
- unsigned char bits;
-
-- present = snd_hda_codec_read(codec, 0x15, 0,
-+ present = snd_hda_codec_read(codec, nid, 0,
- AC_VERB_GET_PIN_SENSE, 0) & 0x80000000;
- bits = present ? AMP_IN_MUTE(0) : 0;
- snd_hda_codec_amp_stereo(codec, 0x0c, HDA_INPUT, 0,
-@@ -13463,8 +13467,8 @@ static void alc269_auto_init(struct hda_codec *codec)
- static const char *alc269_models[ALC269_MODEL_LAST] = {
- [ALC269_BASIC] = "basic",
- [ALC269_QUANTA_FL1] = "quanta",
-- [ALC269_ASUS_EEEPC_P703] = "eeepc-p703",
-- [ALC269_ASUS_EEEPC_P901] = "eeepc-p901",
-+ [ALC269_ASUS_AMIC] = "asus-amic",
-+ [ALC269_ASUS_DMIC] = "asus-dmic",
- [ALC269_FUJITSU] = "fujitsu",
- [ALC269_LIFEBOOK] = "lifebook",
- [ALC269_AUTO] = "auto",
-@@ -13473,18 +13477,41 @@ static const char *alc269_models[ALC269_MODEL_LAST] = {
- static struct snd_pci_quirk alc269_cfg_tbl[] = {
- SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_QUANTA_FL1),
- SND_PCI_QUIRK(0x1043, 0x8330, "ASUS Eeepc P703 P900A",
-- ALC269_ASUS_EEEPC_P703),
-- SND_PCI_QUIRK(0x1043, 0x1883, "ASUS F81Se", ALC269_ASUS_EEEPC_P703),
-- SND_PCI_QUIRK(0x1043, 0x16a3, "ASUS F5Q", ALC269_ASUS_EEEPC_P703),
-- SND_PCI_QUIRK(0x1043, 0x1723, "ASUS P80", ALC269_ASUS_EEEPC_P703),
-- SND_PCI_QUIRK(0x1043, 0x1773, "ASUS U20A", ALC269_ASUS_EEEPC_P703),
-- SND_PCI_QUIRK(0x1043, 0x1743, "ASUS U80", ALC269_ASUS_EEEPC_P703),
-- SND_PCI_QUIRK(0x1043, 0x1653, "ASUS U50", ALC269_ASUS_EEEPC_P703),
-+ ALC269_ASUS_AMIC),
-+ SND_PCI_QUIRK(0x1043, 0x1133, "ASUS UJ20ft", ALC269_ASUS_AMIC),
-+ SND_PCI_QUIRK(0x1043, 0x1273, "ASUS UL80JT", ALC269_ASUS_AMIC),
-+ SND_PCI_QUIRK(0x1043, 0x1283, "ASUS U53Jc", ALC269_ASUS_AMIC),
-+ SND_PCI_QUIRK(0x1043, 0x12b3, "ASUS N82Jv", ALC269_ASUS_AMIC),
-+ SND_PCI_QUIRK(0x1043, 0x13a3, "ASUS UL30Vt", ALC269_ASUS_AMIC),
-+ SND_PCI_QUIRK(0x1043, 0x1373, "ASUS G73JX", ALC269_ASUS_AMIC),
-+ SND_PCI_QUIRK(0x1043, 0x1383, "ASUS UJ30Jc", ALC269_ASUS_AMIC),
-+ SND_PCI_QUIRK(0x1043, 0x13d3, "ASUS N61JA", ALC269_ASUS_AMIC),
-+ SND_PCI_QUIRK(0x1043, 0x1413, "ASUS UL50", ALC269_ASUS_AMIC),
-+ SND_PCI_QUIRK(0x1043, 0x1443, "ASUS UL30", ALC269_ASUS_AMIC),
-+ SND_PCI_QUIRK(0x1043, 0x1453, "ASUS M60Jv", ALC269_ASUS_AMIC),
-+ SND_PCI_QUIRK(0x1043, 0x1483, "ASUS UL80", ALC269_ASUS_AMIC),
-+ SND_PCI_QUIRK(0x1043, 0x14f3, "ASUS F83Vf", ALC269_ASUS_AMIC),
-+ SND_PCI_QUIRK(0x1043, 0x14e3, "ASUS UL20", ALC269_ASUS_AMIC),
-+ SND_PCI_QUIRK(0x1043, 0x1513, "ASUS UX30", ALC269_ASUS_AMIC),
-+ SND_PCI_QUIRK(0x1043, 0x15a3, "ASUS N60Jv", ALC269_ASUS_AMIC),
-+ SND_PCI_QUIRK(0x1043, 0x15b3, "ASUS N60Dp", ALC269_ASUS_AMIC),
-+ SND_PCI_QUIRK(0x1043, 0x15c3, "ASUS N70De", ALC269_ASUS_AMIC),
-+ SND_PCI_QUIRK(0x1043, 0x15e3, "ASUS F83T", ALC269_ASUS_AMIC),
-+ SND_PCI_QUIRK(0x1043, 0x1643, "ASUS M60J", ALC269_ASUS_AMIC),
-+ SND_PCI_QUIRK(0x1043, 0x1653, "ASUS U50", ALC269_ASUS_AMIC),
-+ SND_PCI_QUIRK(0x1043, 0x1693, "ASUS F50N", ALC269_ASUS_AMIC),
-+ SND_PCI_QUIRK(0x1043, 0x16a3, "ASUS F5Q", ALC269_ASUS_AMIC),
-+ SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_ASUS_DMIC),
-+ SND_PCI_QUIRK(0x1043, 0x1723, "ASUS P80", ALC269_ASUS_AMIC),
-+ SND_PCI_QUIRK(0x1043, 0x1743, "ASUS U80", ALC269_ASUS_AMIC),
-+ SND_PCI_QUIRK(0x1043, 0x1773, "ASUS U20A", ALC269_ASUS_AMIC),
-+ SND_PCI_QUIRK(0x1043, 0x1883, "ASUS F81Se", ALC269_ASUS_AMIC),
- SND_PCI_QUIRK(0x1043, 0x831a, "ASUS Eeepc P901",
-- ALC269_ASUS_EEEPC_P901),
-+ ALC269_ASUS_DMIC),
- SND_PCI_QUIRK(0x1043, 0x834a, "ASUS Eeepc S101",
-- ALC269_ASUS_EEEPC_P901),
-- SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_ASUS_EEEPC_P901),
-+ ALC269_ASUS_DMIC),
-+ SND_PCI_QUIRK(0x1043, 0x8398, "ASUS P1005HA", ALC269_ASUS_DMIC),
-+ SND_PCI_QUIRK(0x1043, 0x83ce, "ASUS P1005HA", ALC269_ASUS_DMIC),
- SND_PCI_QUIRK(0x1734, 0x115d, "FSC Amilo", ALC269_FUJITSU),
- SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook ICH9M-based", ALC269_LIFEBOOK),
- {}
-@@ -13514,7 +13541,7 @@ static struct alc_config_preset alc269_presets[] = {
- .setup = alc269_quanta_fl1_setup,
- .init_hook = alc269_quanta_fl1_init_hook,
- },
-- [ALC269_ASUS_EEEPC_P703] = {
-+ [ALC269_ASUS_AMIC] = {
- .mixers = { alc269_eeepc_mixer },
- .cap_mixer = alc269_epc_capture_mixer,
- .init_verbs = { alc269_init_verbs,
-@@ -13528,7 +13555,7 @@ static struct alc_config_preset alc269_presets[] = {
- .setup = alc269_eeepc_amic_setup,
- .init_hook = alc269_eeepc_inithook,
- },
-- [ALC269_ASUS_EEEPC_P901] = {
-+ [ALC269_ASUS_DMIC] = {
- .mixers = { alc269_eeepc_mixer },
- .cap_mixer = alc269_epc_capture_mixer,
- .init_verbs = { alc269_init_verbs,
-@@ -14686,6 +14713,27 @@ static struct alc_config_preset alc861_presets[] = {
- },
- };
-
-+/* Pin config fixes */
-+enum {
-+ PINFIX_FSC_AMILO_PI1505,
-+};
-+
-+static struct alc_pincfg alc861_fsc_amilo_pi1505_pinfix[] = {
-+ { 0x0b, 0x0221101f }, /* HP */
-+ { 0x0f, 0x90170310 }, /* speaker */
-+ { }
-+};
-+
-+static const struct alc_fixup alc861_fixups[] = {
-+ [PINFIX_FSC_AMILO_PI1505] = {
-+ .pins = alc861_fsc_amilo_pi1505_pinfix
-+ },
-+};
-+
-+static struct snd_pci_quirk alc861_fixup_tbl[] = {
-+ SND_PCI_QUIRK(0x1734, 0x10c7, "FSC Amilo Pi1505", PINFIX_FSC_AMILO_PI1505),
-+ {}
-+};
-
- static int patch_alc861(struct hda_codec *codec)
- {
-@@ -14709,6 +14757,8 @@ static int patch_alc861(struct hda_codec *codec)
- board_config = ALC861_AUTO;
- }
-
-+ alc_pick_fixup(codec, alc861_fixup_tbl, alc861_fixups);
-+
- if (board_config == ALC861_AUTO) {
- /* automatic parse from the BIOS config */
- err = alc861_parse_auto_config(codec);
-@@ -16144,6 +16194,52 @@ static struct snd_kcontrol_new alc663_g50v_mixer[] = {
- { } /* end */
- };
-
-+static struct hda_bind_ctls alc663_asus_mode7_8_all_bind_switch = {
-+ .ops = &snd_hda_bind_sw,
-+ .values = {
-+ HDA_COMPOSE_AMP_VAL(0x14, 3, 0, HDA_OUTPUT),
-+ HDA_COMPOSE_AMP_VAL(0x15, 3, 0, HDA_OUTPUT),
-+ HDA_COMPOSE_AMP_VAL(0x17, 3, 0, HDA_OUTPUT),
-+ HDA_COMPOSE_AMP_VAL(0x1b, 3, 0, HDA_OUTPUT),
-+ HDA_COMPOSE_AMP_VAL(0x21, 3, 0, HDA_OUTPUT),
-+ 0
-+ },
-+};
-+
-+static struct hda_bind_ctls alc663_asus_mode7_8_sp_bind_switch = {
-+ .ops = &snd_hda_bind_sw,
-+ .values = {
-+ HDA_COMPOSE_AMP_VAL(0x14, 3, 0, HDA_OUTPUT),
-+ HDA_COMPOSE_AMP_VAL(0x17, 3, 0, HDA_OUTPUT),
-+ 0
-+ },
-+};
-+
-+static struct snd_kcontrol_new alc663_mode7_mixer[] = {
-+ HDA_BIND_SW("Master Playback Switch", &alc663_asus_mode7_8_all_bind_switch),
-+ HDA_BIND_VOL("Speaker Playback Volume", &alc663_asus_bind_master_vol),
-+ HDA_BIND_SW("Speaker Playback Switch", &alc663_asus_mode7_8_sp_bind_switch),
-+ HDA_CODEC_MUTE("Headphone1 Playback Switch", 0x1b, 0x0, HDA_OUTPUT),
-+ HDA_CODEC_MUTE("Headphone2 Playback Switch", 0x21, 0x0, HDA_OUTPUT),
-+ HDA_CODEC_VOLUME("IntMic Playback Volume", 0x0b, 0x0, HDA_INPUT),
-+ HDA_CODEC_MUTE("IntMic Playback Switch", 0x0b, 0x0, HDA_INPUT),
-+ HDA_CODEC_VOLUME("Mic Playback Volume", 0x0b, 0x1, HDA_INPUT),
-+ HDA_CODEC_MUTE("Mic Playback Switch", 0x0b, 0x1, HDA_INPUT),
-+ { } /* end */
-+};
-+
-+static struct snd_kcontrol_new alc663_mode8_mixer[] = {
-+ HDA_BIND_SW("Master Playback Switch", &alc663_asus_mode7_8_all_bind_switch),
-+ HDA_BIND_VOL("Speaker Playback Volume", &alc663_asus_bind_master_vol),
-+ HDA_BIND_SW("Speaker Playback Switch", &alc663_asus_mode7_8_sp_bind_switch),
-+ HDA_CODEC_MUTE("Headphone1 Playback Switch", 0x15, 0x0, HDA_OUTPUT),
-+ HDA_CODEC_MUTE("Headphone2 Playback Switch", 0x21, 0x0, HDA_OUTPUT),
-+ HDA_CODEC_VOLUME("Mic Playback Volume", 0x0b, 0x0, HDA_INPUT),
-+ HDA_CODEC_MUTE("Mic Playback Switch", 0x0b, 0x0, HDA_INPUT),
-+ { } /* end */
-+};
-+
-+
- static struct snd_kcontrol_new alc662_chmode_mixer[] = {
- {
- .iface = SNDRV_CTL_ELEM_IFACE_MIXER,
-@@ -16431,6 +16527,45 @@ static struct hda_verb alc272_dell_init_verbs[] = {
- {}
- };
-
-+static struct hda_verb alc663_mode7_init_verbs[] = {
-+ {0x15, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_IN},
-+ {0x16, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_IN},
-+ {0x17, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT},
-+ {0x17, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE},
-+ {0x1b, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_HP},
-+ {0x1b, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE},
-+ {0x1b, AC_VERB_SET_CONNECT_SEL, 0x01},
-+ {0x21, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_HP},
-+ {0x21, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE},
-+ {0x21, AC_VERB_SET_CONNECT_SEL, 0x01}, /* Headphone */
-+ {0x22, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(0)},
-+ {0x22, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(9)},
-+ {0x19, AC_VERB_SET_UNSOLICITED_ENABLE, AC_USRSP_EN | ALC880_MIC_EVENT},
-+ {0x1b, AC_VERB_SET_UNSOLICITED_ENABLE, AC_USRSP_EN | ALC880_HP_EVENT},
-+ {0x21, AC_VERB_SET_UNSOLICITED_ENABLE, AC_USRSP_EN | ALC880_HP_EVENT},
-+ {}
-+};
-+
-+static struct hda_verb alc663_mode8_init_verbs[] = {
-+ {0x12, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_IN},
-+ {0x15, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_HP},
-+ {0x15, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE},
-+ {0x15, AC_VERB_SET_CONNECT_SEL, 0x01},
-+ {0x16, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_IN},
-+ {0x17, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT},
-+ {0x17, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE},
-+ {0x1b, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_IN},
-+ {0x21, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_HP},
-+ {0x21, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE},
-+ {0x21, AC_VERB_SET_CONNECT_SEL, 0x01}, /* Headphone */
-+ {0x22, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(0)},
-+ {0x22, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(9)},
-+ {0x15, AC_VERB_SET_UNSOLICITED_ENABLE, AC_USRSP_EN | ALC880_HP_EVENT},
-+ {0x18, AC_VERB_SET_UNSOLICITED_ENABLE, AC_USRSP_EN | ALC880_MIC_EVENT},
-+ {0x21, AC_VERB_SET_UNSOLICITED_ENABLE, AC_USRSP_EN | ALC880_HP_EVENT},
-+ {}
-+};
-+
- static struct snd_kcontrol_new alc662_auto_capture_mixer[] = {
- HDA_CODEC_VOLUME("Capture Volume", 0x09, 0x0, HDA_INPUT),
- HDA_CODEC_MUTE("Capture Switch", 0x09, 0x0, HDA_INPUT),
-@@ -16626,6 +16761,54 @@ static void alc663_two_hp_m2_speaker_automute(struct hda_codec *codec)
- }
- }
-
-+static void alc663_two_hp_m7_speaker_automute(struct hda_codec *codec)
-+{
-+ unsigned int present1, present2;
-+
-+ present1 = snd_hda_codec_read(codec, 0x1b, 0,
-+ AC_VERB_GET_PIN_SENSE, 0)
-+ & AC_PINSENSE_PRESENCE;
-+ present2 = snd_hda_codec_read(codec, 0x21, 0,
-+ AC_VERB_GET_PIN_SENSE, 0)
-+ & AC_PINSENSE_PRESENCE;
-+
-+ if (present1 || present2) {
-+ snd_hda_codec_write_cache(codec, 0x14, 0,
-+ AC_VERB_SET_PIN_WIDGET_CONTROL, 0);
-+ snd_hda_codec_write_cache(codec, 0x17, 0,
-+ AC_VERB_SET_PIN_WIDGET_CONTROL, 0);
-+ } else {
-+ snd_hda_codec_write_cache(codec, 0x14, 0,
-+ AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT);
-+ snd_hda_codec_write_cache(codec, 0x17, 0,
-+ AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT);
-+ }
-+}
-+
-+static void alc663_two_hp_m8_speaker_automute(struct hda_codec *codec)
-+{
-+ unsigned int present1, present2;
-+
-+ present1 = snd_hda_codec_read(codec, 0x21, 0,
-+ AC_VERB_GET_PIN_SENSE, 0)
-+ & AC_PINSENSE_PRESENCE;
-+ present2 = snd_hda_codec_read(codec, 0x15, 0,
-+ AC_VERB_GET_PIN_SENSE, 0)
-+ & AC_PINSENSE_PRESENCE;
-+
-+ if (present1 || present2) {
-+ snd_hda_codec_write_cache(codec, 0x14, 0,
-+ AC_VERB_SET_PIN_WIDGET_CONTROL, 0);
-+ snd_hda_codec_write_cache(codec, 0x17, 0,
-+ AC_VERB_SET_PIN_WIDGET_CONTROL, 0);
-+ } else {
-+ snd_hda_codec_write_cache(codec, 0x14, 0,
-+ AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT);
-+ snd_hda_codec_write_cache(codec, 0x17, 0,
-+ AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT);
-+ }
-+}
-+
- static void alc663_m51va_unsol_event(struct hda_codec *codec,
- unsigned int res)
- {
-@@ -16645,7 +16828,7 @@ static void alc663_m51va_setup(struct hda_codec *codec)
- spec->ext_mic.pin = 0x18;
- spec->ext_mic.mux_idx = 0;
- spec->int_mic.pin = 0x12;
-- spec->int_mic.mux_idx = 1;
-+ spec->int_mic.mux_idx = 9;
- spec->auto_mic = 1;
- }
-
-@@ -16657,7 +16840,17 @@ static void alc663_m51va_inithook(struct hda_codec *codec)
-
- /* ***************** Mode1 ******************************/
- #define alc663_mode1_unsol_event alc663_m51va_unsol_event
--#define alc663_mode1_setup alc663_m51va_setup
-+
-+static void alc663_mode1_setup(struct hda_codec *codec)
-+{
-+ struct alc_spec *spec = codec->spec;
-+ spec->ext_mic.pin = 0x18;
-+ spec->ext_mic.mux_idx = 0;
-+ spec->int_mic.pin = 0x19;
-+ spec->int_mic.mux_idx = 1;
-+ spec->auto_mic = 1;
-+}
-+
- #define alc663_mode1_inithook alc663_m51va_inithook
-
- /* ***************** Mode2 ******************************/
-@@ -16674,7 +16867,7 @@ static void alc662_mode2_unsol_event(struct hda_codec *codec,
- }
- }
-
--#define alc662_mode2_setup alc663_m51va_setup
-+#define alc662_mode2_setup alc663_mode1_setup
-
- static void alc662_mode2_inithook(struct hda_codec *codec)
- {
-@@ -16695,7 +16888,7 @@ static void alc663_mode3_unsol_event(struct hda_codec *codec,
- }
- }
-
--#define alc663_mode3_setup alc663_m51va_setup
-+#define alc663_mode3_setup alc663_mode1_setup
-
- static void alc663_mode3_inithook(struct hda_codec *codec)
- {
-@@ -16716,7 +16909,7 @@ static void alc663_mode4_unsol_event(struct hda_codec *codec,
- }
- }
-
--#define alc663_mode4_setup alc663_m51va_setup
-+#define alc663_mode4_setup alc663_mode1_setup
-
- static void alc663_mode4_inithook(struct hda_codec *codec)
- {
-@@ -16737,7 +16930,7 @@ static void alc663_mode5_unsol_event(struct hda_codec *codec,
- }
- }
-
--#define alc663_mode5_setup alc663_m51va_setup
-+#define alc663_mode5_setup alc663_mode1_setup
-
- static void alc663_mode5_inithook(struct hda_codec *codec)
- {
-@@ -16758,7 +16951,7 @@ static void alc663_mode6_unsol_event(struct hda_codec *codec,
- }
- }
-
--#define alc663_mode6_setup alc663_m51va_setup
-+#define alc663_mode6_setup alc663_mode1_setup
-
- static void alc663_mode6_inithook(struct hda_codec *codec)
- {
-@@ -16766,6 +16959,50 @@ static void alc663_mode6_inithook(struct hda_codec *codec)
- alc_mic_automute(codec);
- }
-
-+/* ***************** Mode7 ******************************/
-+static void alc663_mode7_unsol_event(struct hda_codec *codec,
-+ unsigned int res)
-+{
-+ switch (res >> 26) {
-+ case ALC880_HP_EVENT:
-+ alc663_two_hp_m7_speaker_automute(codec);
-+ break;
-+ case ALC880_MIC_EVENT:
-+ alc_mic_automute(codec);
-+ break;
-+ }
-+}
-+
-+#define alc663_mode7_setup alc663_mode1_setup
-+
-+static void alc663_mode7_inithook(struct hda_codec *codec)
-+{
-+ alc663_two_hp_m7_speaker_automute(codec);
-+ alc_mic_automute(codec);
-+}
-+
-+/* ***************** Mode8 ******************************/
-+static void alc663_mode8_unsol_event(struct hda_codec *codec,
-+ unsigned int res)
-+{
-+ switch (res >> 26) {
-+ case ALC880_HP_EVENT:
-+ alc663_two_hp_m8_speaker_automute(codec);
-+ break;
-+ case ALC880_MIC_EVENT:
-+ alc_mic_automute(codec);
-+ break;
-+ }
-+}
-+
-+#define alc663_mode8_setup alc663_m51va_setup
-+
-+static void alc663_mode8_inithook(struct hda_codec *codec)
-+{
-+ alc663_two_hp_m8_speaker_automute(codec);
-+ alc_mic_automute(codec);
-+}
-+
- static void alc663_g71v_hp_automute(struct hda_codec *codec)
- {
- unsigned int present;
-@@ -16904,6 +17141,8 @@ static const char *alc662_models[ALC662_MODEL_LAST] = {
- [ALC663_ASUS_MODE4] = "asus-mode4",
- [ALC663_ASUS_MODE5] = "asus-mode5",
- [ALC663_ASUS_MODE6] = "asus-mode6",
-+ [ALC663_ASUS_MODE7] = "asus-mode7",
-+ [ALC663_ASUS_MODE8] = "asus-mode8",
- [ALC272_DELL] = "dell",
- [ALC272_DELL_ZM1] = "dell-zm1",
- [ALC272_SAMSUNG_NC10] = "samsung-nc10",
-@@ -16920,12 +17159,22 @@ static struct snd_pci_quirk alc662_cfg_tbl[] = {
- SND_PCI_QUIRK(0x1043, 0x11d3, "ASUS NB", ALC663_ASUS_MODE1),
- SND_PCI_QUIRK(0x1043, 0x11f3, "ASUS NB", ALC662_ASUS_MODE2),
- SND_PCI_QUIRK(0x1043, 0x1203, "ASUS NB", ALC663_ASUS_MODE1),
-+ SND_PCI_QUIRK(0x1043, 0x1303, "ASUS G60J", ALC663_ASUS_MODE1),
-+ SND_PCI_QUIRK(0x1043, 0x1333, "ASUS G60Jx", ALC663_ASUS_MODE1),
- SND_PCI_QUIRK(0x1043, 0x1339, "ASUS NB", ALC662_ASUS_MODE2),
-+ SND_PCI_QUIRK(0x1043, 0x13e3, "ASUS N71JA", ALC663_ASUS_MODE7),
-+ SND_PCI_QUIRK(0x1043, 0x1463, "ASUS N71", ALC663_ASUS_MODE7),
-+ SND_PCI_QUIRK(0x1043, 0x14d3, "ASUS G72", ALC663_ASUS_MODE8),
-+ SND_PCI_QUIRK(0x1043, 0x1563, "ASUS N90", ALC663_ASUS_MODE3),
-+ SND_PCI_QUIRK(0x1043, 0x15d3, "ASUS N50SF F50SF", ALC663_ASUS_MODE1),
- SND_PCI_QUIRK(0x1043, 0x16c3, "ASUS NB", ALC662_ASUS_MODE2),
-+ SND_PCI_QUIRK(0x1043, 0x16f3, "ASUS K40C K50C", ALC662_ASUS_MODE2),
-+ SND_PCI_QUIRK(0x1043, 0x1733, "ASUS N81De", ALC663_ASUS_MODE1),
- SND_PCI_QUIRK(0x1043, 0x1753, "ASUS NB", ALC662_ASUS_MODE2),
- SND_PCI_QUIRK(0x1043, 0x1763, "ASUS NB", ALC663_ASUS_MODE6),
- SND_PCI_QUIRK(0x1043, 0x1765, "ASUS NB", ALC663_ASUS_MODE6),
- SND_PCI_QUIRK(0x1043, 0x1783, "ASUS NB", ALC662_ASUS_MODE2),
-+ SND_PCI_QUIRK(0x1043, 0x1793, "ASUS F50GX", ALC663_ASUS_MODE1),
- SND_PCI_QUIRK(0x1043, 0x17b3, "ASUS F70SL", ALC663_ASUS_MODE3),
- SND_PCI_QUIRK(0x1043, 0x17c3, "ASUS UX20", ALC663_ASUS_M51VA),
- SND_PCI_QUIRK(0x1043, 0x17f3, "ASUS X58LE", ALC662_ASUS_MODE2),
-@@ -17208,6 +17457,36 @@ static struct alc_config_preset alc662_presets[] = {
- .setup = alc663_mode6_setup,
- .init_hook = alc663_mode6_inithook,
- },
-+ [ALC663_ASUS_MODE7] = {
-+ .mixers = { alc663_mode7_mixer },
-+ .cap_mixer = alc662_auto_capture_mixer,
-+ .init_verbs = { alc662_init_verbs,
-+ alc663_mode7_init_verbs },
-+ .num_dacs = ARRAY_SIZE(alc662_dac_nids),
-+ .hp_nid = 0x03,
-+ .dac_nids = alc662_dac_nids,
-+ .dig_out_nid = ALC662_DIGOUT_NID,
-+ .num_channel_mode = ARRAY_SIZE(alc662_3ST_2ch_modes),
-+ .channel_mode = alc662_3ST_2ch_modes,
-+ .unsol_event = alc663_mode7_unsol_event,
-+ .setup = alc663_mode7_setup,
-+ .init_hook = alc663_mode7_inithook,
-+ },
-+ [ALC663_ASUS_MODE8] = {
-+ .mixers = { alc663_mode8_mixer },
-+ .cap_mixer = alc662_auto_capture_mixer,
-+ .init_verbs = { alc662_init_verbs,
-+ alc663_mode8_init_verbs },
-+ .num_dacs = ARRAY_SIZE(alc662_dac_nids),
-+ .hp_nid = 0x03,
-+ .dac_nids = alc662_dac_nids,
-+ .dig_out_nid = ALC662_DIGOUT_NID,
-+ .num_channel_mode = ARRAY_SIZE(alc662_3ST_2ch_modes),
-+ .channel_mode = alc662_3ST_2ch_modes,
-+ .unsol_event = alc663_mode8_unsol_event,
-+ .setup = alc663_mode8_setup,
-+ .init_hook = alc663_mode8_inithook,
-+ },
- [ALC272_DELL] = {
- .mixers = { alc663_m51va_mixer },
- .cap_mixer = alc272_auto_capture_mixer,
-@@ -17676,7 +17955,9 @@ static struct hda_codec_preset snd_hda_preset_realtek[] = {
- { .id = 0x10ec0267, .name = "ALC267", .patch = patch_alc268 },
- { .id = 0x10ec0268, .name = "ALC268", .patch = patch_alc268 },
- { .id = 0x10ec0269, .name = "ALC269", .patch = patch_alc269 },
-+ { .id = 0x10ec0270, .name = "ALC270", .patch = patch_alc269 },
- { .id = 0x10ec0272, .name = "ALC272", .patch = patch_alc662 },
-+ { .id = 0x10ec0275, .name = "ALC275", .patch = patch_alc269 },
- { .id = 0x10ec0861, .rev = 0x100340, .name = "ALC660",
- .patch = patch_alc861 },
- { .id = 0x10ec0660, .name = "ALC660-VD", .patch = patch_alc861vd },
-diff --git a/usr/gen_init_cpio.c b/usr/gen_init_cpio.c
-index 83b3dde..13cd679 100644
---- a/usr/gen_init_cpio.c
-+++ b/usr/gen_init_cpio.c
-@@ -299,7 +299,7 @@ static int cpio_mkfile(const char *name, const char *location,
- int retval;
- int rc = -1;
- int namesize;
-- int i;
-+ unsigned int i;
-
- mode |= S_IFREG;
-
-@@ -372,25 +372,28 @@ error:
-
- static char *cpio_replace_env(char *new_location)
- {
-- char expanded[PATH_MAX + 1];
-- char env_var[PATH_MAX + 1];
-- char *start;
-- char *end;
--
-- for (start = NULL; (start = strstr(new_location, "${")); ) {
-- end = strchr(start, '}');
-- if (start < end) {
-- *env_var = *expanded = '\0';
-- strncat(env_var, start + 2, end - start - 2);
-- strncat(expanded, new_location, start - new_location);
-- strncat(expanded, getenv(env_var), PATH_MAX);
-- strncat(expanded, end + 1, PATH_MAX);
-- strncpy(new_location, expanded, PATH_MAX);
-- } else
-- break;
-- }
--
-- return new_location;
-+ char expanded[PATH_MAX + 1];
-+ char env_var[PATH_MAX + 1];
-+ char *start;
-+ char *end;
-+
-+ for (start = NULL; (start = strstr(new_location, "${")); ) {
-+ end = strchr(start, '}');
-+ if (start < end) {
-+ *env_var = *expanded = '\0';
-+ strncat(env_var, start + 2, end - start - 2);
-+ strncat(expanded, new_location, start - new_location);
-+ strncat(expanded, getenv(env_var),
-+ PATH_MAX - strlen(expanded));
-+ strncat(expanded, end + 1,
-+ PATH_MAX - strlen(expanded));
-+ strncpy(new_location, expanded, PATH_MAX);
-+ new_location[PATH_MAX] = 0;
-+ } else
-+ break;
-+ }
-+
-+ return new_location;
- }
-
-
-diff --git a/virt/kvm/ioapic.c b/virt/kvm/ioapic.c
-index 9fe140b..69969ae 100644
---- a/virt/kvm/ioapic.c
-+++ b/virt/kvm/ioapic.c
-@@ -71,9 +71,12 @@ static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic,
- u32 redir_index = (ioapic->ioregsel - 0x10) >> 1;
- u64 redir_content;
-
-- ASSERT(redir_index < IOAPIC_NUM_PINS);
-+ if (redir_index < IOAPIC_NUM_PINS)
-+ redir_content =
-+ ioapic->redirtbl[redir_index].bits;
-+ else
-+ redir_content = ~0ULL;
-
-- redir_content = ioapic->redirtbl[redir_index].bits;
- result = (ioapic->ioregsel & 0x1) ?
- (redir_content >> 32) & 0xffffffff :
- redir_content & 0xffffffff;
diff --git a/2.6.32/4420_grsecurity-2.9.1-2.6.32.61-201312262018.patch b/2.6.32/4420_grsecurity-2.9.1-2.6.32.61-201312262018.patch
deleted file mode 100644
index 46790bb..0000000
--- a/2.6.32/4420_grsecurity-2.9.1-2.6.32.61-201312262018.patch
+++ /dev/null
@@ -1,129872 +0,0 @@
-diff --git a/Documentation/dontdiff b/Documentation/dontdiff
-index e1efc40..3569a2f 100644
---- a/Documentation/dontdiff
-+++ b/Documentation/dontdiff
-@@ -1,15 +1,20 @@
- *.a
- *.aux
- *.bin
-+*.c.[012].*
-+*.cis
- *.cpio
- *.csp
-+*.dbg
- *.dsp
- *.dvi
- *.elf
- *.eps
- *.fw
-+*.gcno
- *.gen.S
- *.gif
-+*.gmo
- *.grep
- *.grp
- *.gz
-@@ -38,22 +43,30 @@
- *.tab.h
- *.tex
- *.ver
-+*.vim
- *.xml
- *_MODULES
-+*_reg_safe.h
- *_vga16.c
- *~
- *.9
- *.9.gz
--.*
-+.[^g]*
-+.gen*
- .mm
- 53c700_d.h
- CVS
- ChangeSet
-+GPATH
-+GRTAGS
-+GSYMS
-+GTAGS
- Image
- Kerntypes
- Module.markers
- Module.symvers
- PENDING
-+PERF*
- SCCS
- System.map*
- TAGS
-@@ -62,6 +75,7 @@ aic7*reg_print.c*
- aic7*seq.h*
- aicasm
- aicdb.h*
-+ashldi3.S
- asm-offsets.h
- asm_offsets.h
- autoconf.h*
-@@ -76,7 +90,11 @@ btfixupprep
- build
- bvmlinux
- bzImage*
-+capability_names.h
-+capflags.c
- classlist.h*
-+clut_vga16.c
-+common-cmds.h
- comp*.log
- compile.h*
- conf
-@@ -84,6 +102,8 @@ config
- config-*
- config_data.h*
- config_data.gz*
-+config.c
-+config.tmp
- conmakehash
- consolemap_deftbl.c*
- cpustr.h
-@@ -97,19 +117,23 @@ elfconfig.h*
- fixdep
- fore200e_mkfirm
- fore200e_pca_fw.c*
-+gate.lds
- gconf
- gen-devlist
- gen_crc32table
- gen_init_cpio
- genksyms
- *_gray256.c
-+hash
-+hid-example
- ihex2fw
- ikconfig.h*
- initramfs_data.cpio
-+initramfs_data.cpio.bz2
- initramfs_data.cpio.gz
- initramfs_list
- kallsyms
--kconfig
-+kern_constants.h
- keywords.c
- ksym.c*
- ksym.h*
-@@ -117,6 +141,7 @@ kxgettext
- lkc_defs.h
- lex.c
- lex.*.c
-+lib1funcs.S
- logo_*.c
- logo_*_clut224.c
- logo_*_mono.c
-@@ -127,13 +152,16 @@ machtypes.h
- map
- maui_boot.h
- mconf
-+mdp
- miboot*
- mk_elfconfig
- mkboot
- mkbugboot
- mkcpustr
- mkdep
-+mkpiggy
- mkprep
-+mkregtable
- mktables
- mktree
- modpost
-@@ -149,6 +177,7 @@ patches*
- pca200e.bin
- pca200e_ecd.bin2
- piggy.gz
-+piggy.S
- piggyback
- pnmtologo
- ppc_defs.h*
-@@ -157,12 +186,16 @@ qconf
- raid6altivec*.c
- raid6int*.c
- raid6tables.c
-+regdb.c
- relocs
-+rlim_names.h
- series
- setup
- setup.bin
- setup.elf
-+size_overflow_hash.h
- sImage
-+slabinfo
- sm_tbl*
- split-include
- syscalltab.h
-@@ -171,6 +204,7 @@ tftpboot.img
- timeconst.h
- times.h*
- trix_boot.h
-+user_constants.h
- utsrelease.h*
- vdso-syms.lds
- vdso.lds
-@@ -186,14 +220,20 @@ version.h*
- vmlinux
- vmlinux-*
- vmlinux.aout
-+vmlinux.bin.all
-+vmlinux.bin.bz2
- vmlinux.lds
-+vmlinux.relocs
-+voffset.h
- vsyscall.lds
- vsyscall_32.lds
- wanxlfw.inc
- uImage
- unifdef
-+utsrelease.h
- wakeup.bin
- wakeup.elf
- wakeup.lds
- zImage*
- zconf.hash.c
-+zoffset.h
-diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
-index 14c7fb0..0f7d099 100644
---- a/Documentation/kernel-parameters.txt
-+++ b/Documentation/kernel-parameters.txt
-@@ -806,6 +806,9 @@ and is between 256 and 4096 characters. It is defined in the file
- gpt [EFI] Forces disk with valid GPT signature but
- invalid Protective MBR to be treated as GPT.
-
-+ grsec_proc_gid= [GRKERNSEC_PROC_USERGROUP] Chooses GID to
-+ ignore grsecurity's /proc restrictions
-+
- gvp11= [HW,SCSI]
-
- hashdist= [KNL,NUMA] Large hashes allocated during boot
-@@ -856,6 +859,12 @@ and is between 256 and 4096 characters. It is defined in the file
- If specified, z/VM IUCV HVC accepts connections
- from listed z/VM user IDs only.
-
-+ keep_bootcon [KNL]
-+ Do not unregister boot console at start. This is only
-+ useful for debugging when something happens in the window
-+ between unregistering the boot console and initializing
-+ the real console.
-+
- i2c_bus= [HW] Override the default board specific I2C bus speed
- or register an additional I2C bus that is not
- registered from board initialization code.
-@@ -1842,6 +1851,13 @@ and is between 256 and 4096 characters. It is defined in the file
- the specified number of seconds. This is to be used if
- your oopses keep scrolling off the screen.
-
-+ pax_nouderef [X86] disables UDEREF. Most likely needed under certain
-+ virtualization environments that don't cope well with the
-+ expand down segment used by UDEREF on X86-32 or the frequent
-+ page table updates on X86-64.
-+
-+ pax_softmode= 0/1 to disable/enable PaX softmode on boot already.
-+
- pcbit= [HW,ISDN]
-
- pcd. [PARIDE]
-diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
-index fbe427a..195ff43 100644
---- a/Documentation/networking/ip-sysctl.txt
-+++ b/Documentation/networking/ip-sysctl.txt
-@@ -479,6 +479,11 @@ tcp_dma_copybreak - INTEGER
- and CONFIG_NET_DMA is enabled.
- Default: 4096
-
-+tcp_challenge_ack_limit - INTEGER
-+ Limits number of Challenge ACK sent per second, as recommended
-+ in RFC 5961 (Improving TCP's Robustness to Blind In-Window Attacks)
-+ Default: 100
-+
- UDP variables:
-
- udp_mem - vector of 3 INTEGERs: min, pressure, max
-diff --git a/MAINTAINERS b/MAINTAINERS
-index 334258c..1e8f4ff 100644
---- a/MAINTAINERS
-+++ b/MAINTAINERS
-@@ -5725,6 +5725,14 @@ L: netdev@vger.kernel.org
- S: Maintained
- F: drivers/net/vmxnet3/
-
-+VMware PVSCSI driver
-+M: Alok Kataria <akataria@vmware.com>
-+M: VMware PV-Drivers <pv-drivers@vmware.com>
-+L: linux-scsi@vger.kernel.org
-+S: Maintained
-+F: drivers/scsi/vmw_pvscsi.c
-+F: drivers/scsi/vmw_pvscsi.h
-+
- VOLTAGE AND CURRENT REGULATOR FRAMEWORK
- M: Liam Girdwood <lrg@slimlogic.co.uk>
- M: Mark Brown <broonie@opensource.wolfsonmicro.com>
-diff --git a/Makefile b/Makefile
-index e5a279c..2289941 100644
---- a/Makefile
-+++ b/Makefile
-@@ -221,8 +221,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
-
- HOSTCC = gcc
- HOSTCXX = g++
--HOSTCFLAGS = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
--HOSTCXXFLAGS = -O2
-+HOSTCFLAGS = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -Wno-unused-parameter -Wno-missing-field-initializers -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
-+HOSTCFLAGS += $(call cc-option, -Wno-empty-body)
-+HOSTCXXFLAGS = -O2 -Wall -W -fno-delete-null-pointer-checks
-
- # Decide whether to build built-in, modular, or both.
- # Normally, just do built-in.
-@@ -376,8 +377,8 @@ export RCS_TAR_IGNORE := --exclude SCCS --exclude BitKeeper --exclude .svn --exc
- # Rules shared between *config targets and build targets
-
- # Basic helpers built in scripts/
--PHONY += scripts_basic
--scripts_basic:
-+PHONY += scripts_basic gcc-plugins
-+scripts_basic: gcc-plugins
- $(Q)$(MAKE) $(build)=scripts/basic
-
- # To avoid any implicit rule to kick in, define an empty command.
-@@ -403,7 +404,7 @@ endif
- # of make so .config is not included in this case either (for *config).
-
- no-dot-config-targets := clean mrproper distclean \
-- cscope TAGS tags help %docs check% \
-+ cscope gtags TAGS tags help %docs check% \
- include/linux/version.h headers_% \
- kernelrelease kernelversion
-
-@@ -526,6 +527,64 @@ else
- KBUILD_CFLAGS += -O2
- endif
-
-+ifndef DISABLE_PAX_PLUGINS
-+ifeq ($(call cc-ifversion, -ge, 0408, y), y)
-+PLUGINCC := $(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-plugin.sh "$(HOSTCXX)" "$(HOSTCXX)" "$(CC)")
-+else
-+PLUGINCC := $(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-plugin.sh "$(HOSTCC)" "$(HOSTCXX)" "$(CC)")
-+endif
-+ifneq ($(PLUGINCC),)
-+ifndef DISABLE_PAX_CONSTIFY_PLUGIN
-+ifndef CONFIG_UML
-+CONSTIFY_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/constify_plugin.so -DCONSTIFY_PLUGIN
-+endif
-+endif
-+ifdef CONFIG_PAX_MEMORY_STACKLEAK
-+STACKLEAK_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/stackleak_plugin.so -DSTACKLEAK_PLUGIN
-+STACKLEAK_PLUGIN_CFLAGS += -fplugin-arg-stackleak_plugin-track-lowest-sp=100
-+endif
-+ifdef CONFIG_KALLOCSTAT_PLUGIN
-+KALLOCSTAT_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/kallocstat_plugin.so
-+endif
-+ifdef CONFIG_PAX_KERNEXEC_PLUGIN
-+KERNEXEC_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/kernexec_plugin.so
-+KERNEXEC_PLUGIN_CFLAGS += -fplugin-arg-kernexec_plugin-method=$(CONFIG_PAX_KERNEXEC_PLUGIN_METHOD) -DKERNEXEC_PLUGIN
-+KERNEXEC_PLUGIN_AFLAGS := -DKERNEXEC_PLUGIN
-+endif
-+ifdef CONFIG_CHECKER_PLUGIN
-+ifeq ($(call cc-ifversion, -ge, 0406, y), y)
-+CHECKER_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/checker_plugin.so -DCHECKER_PLUGIN
-+endif
-+endif
-+COLORIZE_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/colorize_plugin.so
-+ifdef CONFIG_PAX_SIZE_OVERFLOW
-+SIZE_OVERFLOW_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/size_overflow_plugin.so -DSIZE_OVERFLOW_PLUGIN
-+endif
-+ifdef CONFIG_PAX_LATENT_ENTROPY
-+LATENT_ENTROPY_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/latent_entropy_plugin.so -DLATENT_ENTROPY_PLUGIN
-+endif
-+GCC_PLUGINS_CFLAGS := $(CONSTIFY_PLUGIN_CFLAGS) $(STACKLEAK_PLUGIN_CFLAGS) $(KALLOCSTAT_PLUGIN_CFLAGS)
-+GCC_PLUGINS_CFLAGS += $(KERNEXEC_PLUGIN_CFLAGS) $(CHECKER_PLUGIN_CFLAGS) $(COLORIZE_PLUGIN_CFLAGS)
-+GCC_PLUGINS_CFLAGS += $(SIZE_OVERFLOW_PLUGIN_CFLAGS) $(LATENT_ENTROPY_PLUGIN_CFLAGS)
-+GCC_PLUGINS_AFLAGS := $(KERNEXEC_PLUGIN_AFLAGS)
-+export PLUGINCC CONSTIFY_PLUGIN
-+ifeq ($(KBUILD_EXTMOD),)
-+gcc-plugins:
-+ $(Q)$(MAKE) $(build)=tools/gcc
-+else
-+gcc-plugins: ;
-+endif
-+else
-+gcc-plugins:
-+ifeq ($(call cc-ifversion, -ge, 0405, y), y)
-+ $(error Your gcc installation does not support plugins. If the necessary headers for plugin support are missing, they should be installed. On Debian, apt-get install gcc-<ver>-plugin-dev. If you choose to ignore this error and lessen the improvements provided by this patch, re-run make with the DISABLE_PAX_PLUGINS=y argument.))
-+else
-+ $(Q)echo "warning, your gcc version does not support plugins, you should upgrade it to gcc 4.5 at least"
-+endif
-+ $(Q)echo "PAX_MEMORY_STACKLEAK, constification, PAX_LATENT_ENTROPY and other features will be less secure. PAX_SIZE_OVERFLOW will not be active."
-+endif
-+endif
-+
- include $(srctree)/arch/$(SRCARCH)/Makefile
-
- ifneq ($(CONFIG_FRAME_WARN),0)
-@@ -647,7 +706,7 @@ export mod_strip_cmd
-
-
- ifeq ($(KBUILD_EXTMOD),)
--core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
-+core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
-
- vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
- $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
-@@ -868,6 +927,8 @@ vmlinux.o: $(modpost-init) $(vmlinux-main) FORCE
-
- # The actual objects are generated when descending,
- # make sure no implicit rule kicks in
-+$(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
-+$(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
- $(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): $(vmlinux-dirs) ;
-
- # Handle descending into subdirectories listed in $(vmlinux-dirs)
-@@ -877,7 +938,7 @@ $(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): $(vmlinux-dirs) ;
- # Error messages still appears in the original language
-
- PHONY += $(vmlinux-dirs)
--$(vmlinux-dirs): prepare scripts
-+$(vmlinux-dirs): gcc-plugins prepare scripts
- $(Q)$(MAKE) $(build)=$@
-
- # Build the kernel release string
-@@ -986,6 +1047,7 @@ prepare0: archprepare FORCE
- $(Q)$(MAKE) $(build)=. missing-syscalls
-
- # All the preparing..
-+prepare: KBUILD_CFLAGS := $(filter-out $(GCC_PLUGINS_CFLAGS),$(KBUILD_CFLAGS))
- prepare: prepare0
-
- # The asm symlink changes when $(ARCH) changes.
-@@ -1127,6 +1189,8 @@ all: modules
- # using awk while concatenating to the final file.
-
- PHONY += modules
-+modules: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
-+modules: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
- modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux)
- $(Q)$(AWK) '!x[$$0]++' $(vmlinux-dirs:%=$(objtree)/%/modules.order) > $(objtree)/modules.order
- @$(kecho) ' Building modules, stage 2.';
-@@ -1136,7 +1200,7 @@ modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux)
-
- # Target to prepare building external modules
- PHONY += modules_prepare
--modules_prepare: prepare scripts
-+modules_prepare: gcc-plugins prepare scripts
-
- # Target to install modules
- PHONY += modules_install
-@@ -1199,9 +1263,9 @@ CLEAN_FILES += vmlinux System.map \
- MRPROPER_DIRS += include/config include2 usr/include include/generated
- MRPROPER_FILES += .config .config.old include/asm .version .old_version \
- include/linux/autoconf.h include/linux/version.h \
-- include/linux/utsrelease.h \
-+ include/linux/utsrelease.h tools/gcc/size_overflow_hash.h \
- include/linux/bounds.h include/asm*/asm-offsets.h \
-- Module.symvers Module.markers tags TAGS cscope*
-+ Module.symvers Module.markers tags TAGS cscope* GPATH GTAGS GRTAGS GSYMS
-
- # clean - Delete most, but leave enough to build external modules
- #
-@@ -1245,7 +1309,7 @@ distclean: mrproper
- @find $(srctree) $(RCS_FIND_IGNORE) \
- \( -name '*.orig' -o -name '*.rej' -o -name '*~' \
- -o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \
-- -o -name '.*.rej' -o -size 0 \
-+ -o -name '.*.rej' -o -name '*.so' -o -size 0 \
- -o -name '*%' -o -name '.*.cmd' -o -name 'core' \) \
- -type f -print | xargs rm -f
-
-@@ -1292,6 +1356,7 @@ help:
- @echo ' modules_prepare - Set up for building external modules'
- @echo ' tags/TAGS - Generate tags file for editors'
- @echo ' cscope - Generate cscope index'
-+ @echo ' gtags - Generate GNU GLOBAL index'
- @echo ' kernelrelease - Output the release version string'
- @echo ' kernelversion - Output the version stored in Makefile'
- @echo ' headers_install - Install sanitised kernel headers to INSTALL_HDR_PATH'; \
-@@ -1393,6 +1458,8 @@ PHONY += $(module-dirs) modules
- $(module-dirs): crmodverdir $(objtree)/Module.symvers
- $(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@)
-
-+modules: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
-+modules: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
- modules: $(module-dirs)
- @$(kecho) ' Building modules, stage 2.';
- $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
-@@ -1448,7 +1515,7 @@ endif # KBUILD_EXTMOD
- quiet_cmd_tags = GEN $@
- cmd_tags = $(CONFIG_SHELL) $(srctree)/scripts/tags.sh $@
-
--tags TAGS cscope: FORCE
-+tags TAGS cscope gtags: FORCE
- $(call cmd,tags)
-
- # Scripts to check various things for consistency
-@@ -1513,17 +1580,21 @@ else
- target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@))
- endif
-
--%.s: %.c prepare scripts FORCE
-+%.s: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
-+%.s: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
-+%.s: %.c gcc-plugins prepare scripts FORCE
- $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
- %.i: %.c prepare scripts FORCE
- $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
--%.o: %.c prepare scripts FORCE
-+%.o: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
-+%.o: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
-+%.o: %.c gcc-plugins prepare scripts FORCE
- $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
- %.lst: %.c prepare scripts FORCE
- $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
--%.s: %.S prepare scripts FORCE
-+%.s: %.S gcc-plugins prepare scripts FORCE
- $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
--%.o: %.S prepare scripts FORCE
-+%.o: %.S gcc-plugins prepare scripts FORCE
- $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
- %.symtypes: %.c prepare scripts FORCE
- $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
-@@ -1533,11 +1604,15 @@ endif
- $(cmd_crmodverdir)
- $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
- $(build)=$(build-dir)
--%/: prepare scripts FORCE
-+%/: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
-+%/: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
-+%/: gcc-plugins prepare scripts FORCE
- $(cmd_crmodverdir)
- $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
- $(build)=$(build-dir)
--%.ko: prepare scripts FORCE
-+%.ko: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
-+%.ko: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
-+%.ko: gcc-plugins prepare scripts FORCE
- $(cmd_crmodverdir)
- $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
- $(build)=$(build-dir) $(@:.ko=.o)
-diff --git a/arch/alpha/include/asm/atomic.h b/arch/alpha/include/asm/atomic.h
-index 610dff44..f396854 100644
---- a/arch/alpha/include/asm/atomic.h
-+++ b/arch/alpha/include/asm/atomic.h
-@@ -251,6 +251,16 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
- #define atomic_dec(v) atomic_sub(1,(v))
- #define atomic64_dec(v) atomic64_sub(1,(v))
-
-+#define atomic64_read_unchecked(v) atomic64_read(v)
-+#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
-+#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
-+#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
-+#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
-+#define atomic64_inc_unchecked(v) atomic64_inc(v)
-+#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
-+#define atomic64_dec_unchecked(v) atomic64_dec(v)
-+#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
-+
- #define smp_mb__before_atomic_dec() smp_mb()
- #define smp_mb__after_atomic_dec() smp_mb()
- #define smp_mb__before_atomic_inc() smp_mb()
-diff --git a/arch/alpha/include/asm/cache.h b/arch/alpha/include/asm/cache.h
-index f199e69..af005f5 100644
---- a/arch/alpha/include/asm/cache.h
-+++ b/arch/alpha/include/asm/cache.h
-@@ -4,19 +4,20 @@
- #ifndef __ARCH_ALPHA_CACHE_H
- #define __ARCH_ALPHA_CACHE_H
-
-+#include <linux/const.h>
-
- /* Bytes per L1 (data) cache line. */
- #if defined(CONFIG_ALPHA_GENERIC) || defined(CONFIG_ALPHA_EV6)
--# define L1_CACHE_BYTES 64
- # define L1_CACHE_SHIFT 6
- #else
- /* Both EV4 and EV5 are write-through, read-allocate,
- direct-mapped, physical.
- */
--# define L1_CACHE_BYTES 32
- # define L1_CACHE_SHIFT 5
- #endif
-
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-+
- #define L1_CACHE_ALIGN(x) (((x)+(L1_CACHE_BYTES-1))&~(L1_CACHE_BYTES-1))
- #define SMP_CACHE_BYTES L1_CACHE_BYTES
-
-diff --git a/arch/alpha/include/asm/elf.h b/arch/alpha/include/asm/elf.h
-index 5c75c1b..c82f878 100644
---- a/arch/alpha/include/asm/elf.h
-+++ b/arch/alpha/include/asm/elf.h
-@@ -91,6 +91,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
-
- #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x1000000)
-
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE (current->personality & ADDR_LIMIT_32BIT ? 0x10000 : 0x120000000UL)
-+
-+#define PAX_DELTA_MMAP_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 28)
-+#define PAX_DELTA_STACK_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 19)
-+#endif
-+
- /* $0 is set by ld.so to a pointer to a function which might be
- registered using atexit. This provides a mean for the dynamic
- linker to call DT_FINI functions for shared libraries that have
-diff --git a/arch/alpha/include/asm/pgalloc.h b/arch/alpha/include/asm/pgalloc.h
-index bc2a0da..8ad11ee 100644
---- a/arch/alpha/include/asm/pgalloc.h
-+++ b/arch/alpha/include/asm/pgalloc.h
-@@ -29,6 +29,12 @@ pgd_populate(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmd)
- pgd_set(pgd, pmd);
- }
-
-+static inline void
-+pgd_populate_kernel(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmd)
-+{
-+ pgd_populate(mm, pgd, pmd);
-+}
-+
- extern pgd_t *pgd_alloc(struct mm_struct *mm);
-
- static inline void
-diff --git a/arch/alpha/include/asm/pgtable.h b/arch/alpha/include/asm/pgtable.h
-index 3f0c59f..cf1e100 100644
---- a/arch/alpha/include/asm/pgtable.h
-+++ b/arch/alpha/include/asm/pgtable.h
-@@ -101,6 +101,17 @@ struct vm_area_struct;
- #define PAGE_SHARED __pgprot(_PAGE_VALID | __ACCESS_BITS)
- #define PAGE_COPY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
- #define PAGE_READONLY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOE)
-+# define PAGE_COPY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
-+# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
-+#else
-+# define PAGE_SHARED_NOEXEC PAGE_SHARED
-+# define PAGE_COPY_NOEXEC PAGE_COPY
-+# define PAGE_READONLY_NOEXEC PAGE_READONLY
-+#endif
-+
- #define PAGE_KERNEL __pgprot(_PAGE_VALID | _PAGE_ASM | _PAGE_KRE | _PAGE_KWE)
-
- #define _PAGE_NORMAL(x) __pgprot(_PAGE_VALID | __ACCESS_BITS | (x))
-diff --git a/arch/alpha/kernel/module.c b/arch/alpha/kernel/module.c
-index ebc3c89..20cfa63 100644
---- a/arch/alpha/kernel/module.c
-+++ b/arch/alpha/kernel/module.c
-@@ -182,7 +182,7 @@ apply_relocate_add(Elf64_Shdr *sechdrs, const char *strtab,
-
- /* The small sections were sorted to the end of the segment.
- The following should definitely cover them. */
-- gp = (u64)me->module_core + me->core_size - 0x8000;
-+ gp = (u64)me->module_core_rw + me->core_size_rw - 0x8000;
- got = sechdrs[me->arch.gotsecindex].sh_addr;
-
- for (i = 0; i < n; i++) {
-diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
-index a94e49c..491c166 100644
---- a/arch/alpha/kernel/osf_sys.c
-+++ b/arch/alpha/kernel/osf_sys.c
-@@ -1163,16 +1163,16 @@ SYSCALL_DEFINE1(old_adjtimex, struct timex32 __user *, txc_p)
- generic version except that we know how to honor ADDR_LIMIT_32BIT. */
-
- static unsigned long
--arch_get_unmapped_area_1(unsigned long addr, unsigned long len,
-- unsigned long limit)
-+arch_get_unmapped_area_1(struct file *filp, unsigned long addr, unsigned long len,
-+ unsigned long limit, unsigned long flags)
- {
- struct vm_area_struct *vma = find_vma(current->mm, addr);
--
-+ unsigned long offset = gr_rand_threadstack_offset(current->mm, filp, flags);
- while (1) {
- /* At this point: (!vma || addr < vma->vm_end). */
- if (limit - len < addr)
- return -ENOMEM;
-- if (!vma || addr + len <= vma->vm_start)
-+ if (check_heap_stack_gap(vma, &addr, len, offset))
- return addr;
- addr = vma->vm_end;
- vma = vma->vm_next;
-@@ -1208,20 +1208,24 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
- merely specific addresses, but regions of memory -- perhaps
- this feature should be incorporated into all ports? */
-
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- if (addr) {
-- addr = arch_get_unmapped_area_1 (PAGE_ALIGN(addr), len, limit);
-+ addr = arch_get_unmapped_area_1 (filp, PAGE_ALIGN(addr), len, limit, flags);
- if (addr != (unsigned long) -ENOMEM)
- return addr;
- }
-
- /* Next, try allocating at TASK_UNMAPPED_BASE. */
-- addr = arch_get_unmapped_area_1 (PAGE_ALIGN(TASK_UNMAPPED_BASE),
-- len, limit);
-+ addr = arch_get_unmapped_area_1 (filp, PAGE_ALIGN(current->mm->mmap_base), len, limit, flags);
-+
- if (addr != (unsigned long) -ENOMEM)
- return addr;
-
- /* Finally, try allocating in low memory. */
-- addr = arch_get_unmapped_area_1 (PAGE_SIZE, len, limit);
-+ addr = arch_get_unmapped_area_1 (filp, PAGE_SIZE, len, limit, flags);
-
- return addr;
- }
-diff --git a/arch/alpha/mm/fault.c b/arch/alpha/mm/fault.c
-index 00a31de..2ded0f2 100644
---- a/arch/alpha/mm/fault.c
-+++ b/arch/alpha/mm/fault.c
-@@ -54,6 +54,124 @@ __load_new_mm_context(struct mm_struct *next_mm)
- __reload_thread(pcb);
- }
-
-+#ifdef CONFIG_PAX_PAGEEXEC
-+/*
-+ * PaX: decide what to do with offenders (regs->pc = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ * 2 when patched PLT trampoline was detected
-+ * 3 when unpatched PLT trampoline was detected
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+ int err;
-+
-+ do { /* PaX: patched PLT emulation #1 */
-+ unsigned int ldah, ldq, jmp;
-+
-+ err = get_user(ldah, (unsigned int *)regs->pc);
-+ err |= get_user(ldq, (unsigned int *)(regs->pc+4));
-+ err |= get_user(jmp, (unsigned int *)(regs->pc+8));
-+
-+ if (err)
-+ break;
-+
-+ if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
-+ (ldq & 0xFFFF0000U) == 0xA77B0000U &&
-+ jmp == 0x6BFB0000U)
-+ {
-+ unsigned long r27, addr;
-+ unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
-+ unsigned long addrl = ldq | 0xFFFFFFFFFFFF0000UL;
-+
-+ addr = regs->r27 + ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
-+ err = get_user(r27, (unsigned long *)addr);
-+ if (err)
-+ break;
-+
-+ regs->r27 = r27;
-+ regs->pc = r27;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: patched PLT emulation #2 */
-+ unsigned int ldah, lda, br;
-+
-+ err = get_user(ldah, (unsigned int *)regs->pc);
-+ err |= get_user(lda, (unsigned int *)(regs->pc+4));
-+ err |= get_user(br, (unsigned int *)(regs->pc+8));
-+
-+ if (err)
-+ break;
-+
-+ if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
-+ (lda & 0xFFFF0000U) == 0xA77B0000U &&
-+ (br & 0xFFE00000U) == 0xC3E00000U)
-+ {
-+ unsigned long addr = br | 0xFFFFFFFFFFE00000UL;
-+ unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
-+ unsigned long addrl = lda | 0xFFFFFFFFFFFF0000UL;
-+
-+ regs->r27 += ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
-+ regs->pc += 12 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: unpatched PLT emulation */
-+ unsigned int br;
-+
-+ err = get_user(br, (unsigned int *)regs->pc);
-+
-+ if (!err && (br & 0xFFE00000U) == 0xC3800000U) {
-+ unsigned int br2, ldq, nop, jmp;
-+ unsigned long addr = br | 0xFFFFFFFFFFE00000UL, resolver;
-+
-+ addr = regs->pc + 4 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
-+ err = get_user(br2, (unsigned int *)addr);
-+ err |= get_user(ldq, (unsigned int *)(addr+4));
-+ err |= get_user(nop, (unsigned int *)(addr+8));
-+ err |= get_user(jmp, (unsigned int *)(addr+12));
-+ err |= get_user(resolver, (unsigned long *)(addr+16));
-+
-+ if (err)
-+ break;
-+
-+ if (br2 == 0xC3600000U &&
-+ ldq == 0xA77B000CU &&
-+ nop == 0x47FF041FU &&
-+ jmp == 0x6B7B0000U)
-+ {
-+ regs->r28 = regs->pc+4;
-+ regs->r27 = addr+16;
-+ regs->pc = resolver;
-+ return 3;
-+ }
-+ }
-+ } while (0);
-+#endif
-+
-+ return 1;
-+}
-+
-+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
-+{
-+ unsigned long i;
-+
-+ printk(KERN_ERR "PAX: bytes at PC: ");
-+ for (i = 0; i < 5; i++) {
-+ unsigned int c;
-+ if (get_user(c, (unsigned int *)pc+i))
-+ printk(KERN_CONT "???????? ");
-+ else
-+ printk(KERN_CONT "%08x ", c);
-+ }
-+ printk("\n");
-+}
-+#endif
-
- /*
- * This routine handles page faults. It determines the address,
-@@ -131,8 +249,29 @@ do_page_fault(unsigned long address, unsigned long mmcsr,
- good_area:
- si_code = SEGV_ACCERR;
- if (cause < 0) {
-- if (!(vma->vm_flags & VM_EXEC))
-+ if (!(vma->vm_flags & VM_EXEC)) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->pc)
-+ goto bad_area;
-+
-+ up_read(&mm->mmap_sem);
-+ switch (pax_handle_fetch_fault(regs)) {
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+ case 2:
-+ case 3:
-+ return;
-+#endif
-+
-+ }
-+ pax_report_fault(regs, (void *)regs->pc, (void *)rdusp());
-+ do_group_exit(SIGKILL);
-+#else
- goto bad_area;
-+#endif
-+
-+ }
- } else if (!cause) {
- /* Allow reads even for write-only mappings */
- if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
-diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
-index b68faef..6dd1496 100644
---- a/arch/arm/Kconfig
-+++ b/arch/arm/Kconfig
-@@ -14,6 +14,7 @@ config ARM
- select SYS_SUPPORTS_APM_EMULATION
- select HAVE_OPROFILE
- select HAVE_ARCH_KGDB
-+ select GENERIC_ATOMIC64
- select HAVE_KPROBES if (!XIP_KERNEL)
- select HAVE_KRETPROBES if (HAVE_KPROBES)
- select HAVE_FUNCTION_TRACER if (!XIP_KERNEL)
-diff --git a/arch/arm/include/asm/atomic.h b/arch/arm/include/asm/atomic.h
-index d0daeab..638f5e8 100644
---- a/arch/arm/include/asm/atomic.h
-+++ b/arch/arm/include/asm/atomic.h
-@@ -15,6 +15,10 @@
- #include <linux/types.h>
- #include <asm/system.h>
-
-+#ifdef CONFIG_GENERIC_ATOMIC64
-+#include <asm-generic/atomic64.h>
-+#endif
-+
- #define ATOMIC_INIT(i) { (i) }
-
- #ifdef __KERNEL__
-@@ -24,8 +28,16 @@
- * strex/ldrex monitor on some implementations. The reason we can use it for
- * atomic_set() is the clrex or dummy strex done on every exception return.
- */
--#define atomic_read(v) ((v)->counter)
-+#define atomic_read(v) (*(volatile int *)&(v)->counter)
-+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
-+{
-+ return v->counter;
-+}
- #define atomic_set(v,i) (((v)->counter) = (i))
-+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
-+{
-+ v->counter = i;
-+}
-
- #if __LINUX_ARM_ARCH__ >= 6
-
-@@ -40,6 +52,35 @@ static inline void atomic_add(int i, atomic_t *v)
- int result;
-
- __asm__ __volatile__("@ atomic_add\n"
-+"1: ldrex %1, [%2]\n"
-+" add %0, %1, %3\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+" bvc 3f\n"
-+"2: bkpt 0xf103\n"
-+"3:\n"
-+#endif
-+
-+" strex %1, %0, [%2]\n"
-+" teq %1, #0\n"
-+" bne 1b"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+"\n4:\n"
-+ _ASM_EXTABLE(2b, 4b)
-+#endif
-+
-+ : "=&r" (result), "=&r" (tmp)
-+ : "r" (&v->counter), "Ir" (i)
-+ : "cc");
-+}
-+
-+static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
-+{
-+ unsigned long tmp;
-+ int result;
-+
-+ __asm__ __volatile__("@ atomic_add_unchecked\n"
- "1: ldrex %0, [%2]\n"
- " add %0, %0, %3\n"
- " strex %1, %0, [%2]\n"
-@@ -58,6 +99,42 @@ static inline int atomic_add_return(int i, atomic_t *v)
- smp_mb();
-
- __asm__ __volatile__("@ atomic_add_return\n"
-+"1: ldrex %1, [%2]\n"
-+" add %0, %1, %3\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+" bvc 3f\n"
-+" mov %0, %1\n"
-+"2: bkpt 0xf103\n"
-+"3:\n"
-+#endif
-+
-+" strex %1, %0, [%2]\n"
-+" teq %1, #0\n"
-+" bne 1b"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+"\n4:\n"
-+ _ASM_EXTABLE(2b, 4b)
-+#endif
-+
-+ : "=&r" (result), "=&r" (tmp)
-+ : "r" (&v->counter), "Ir" (i)
-+ : "cc");
-+
-+ smp_mb();
-+
-+ return result;
-+}
-+
-+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
-+{
-+ unsigned long tmp;
-+ int result;
-+
-+ smp_mb();
-+
-+ __asm__ __volatile__("@ atomic_add_return_unchecked\n"
- "1: ldrex %0, [%2]\n"
- " add %0, %0, %3\n"
- " strex %1, %0, [%2]\n"
-@@ -78,6 +155,35 @@ static inline void atomic_sub(int i, atomic_t *v)
- int result;
-
- __asm__ __volatile__("@ atomic_sub\n"
-+"1: ldrex %1, [%2]\n"
-+" sub %0, %1, %3\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+" bvc 3f\n"
-+"2: bkpt 0xf103\n"
-+"3:\n"
-+#endif
-+
-+" strex %1, %0, [%2]\n"
-+" teq %1, #0\n"
-+" bne 1b"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+"\n4:\n"
-+ _ASM_EXTABLE(2b, 4b)
-+#endif
-+
-+ : "=&r" (result), "=&r" (tmp)
-+ : "r" (&v->counter), "Ir" (i)
-+ : "cc");
-+}
-+
-+static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
-+{
-+ unsigned long tmp;
-+ int result;
-+
-+ __asm__ __volatile__("@ atomic_sub_unchecked\n"
- "1: ldrex %0, [%2]\n"
- " sub %0, %0, %3\n"
- " strex %1, %0, [%2]\n"
-@@ -96,11 +202,25 @@ static inline int atomic_sub_return(int i, atomic_t *v)
- smp_mb();
-
- __asm__ __volatile__("@ atomic_sub_return\n"
--"1: ldrex %0, [%2]\n"
--" sub %0, %0, %3\n"
-+"1: ldrex %1, [%2]\n"
-+" subs %0, %1, %3\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+" bvc 3f\n"
-+" mov %0, %1\n"
-+"2: bkpt 0xf103\n"
-+"3:\n"
-+#endif
-+
- " strex %1, %0, [%2]\n"
- " teq %1, #0\n"
- " bne 1b"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+"\n4:\n"
-+ _ASM_EXTABLE(2b, 4b)
-+#endif
-+
- : "=&r" (result), "=&r" (tmp)
- : "r" (&v->counter), "Ir" (i)
- : "cc");
-@@ -132,6 +252,28 @@ static inline int atomic_cmpxchg(atomic_t *ptr, int old, int new)
- return oldval;
- }
-
-+static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *ptr, int old, int new)
-+{
-+ unsigned long oldval, res;
-+
-+ smp_mb();
-+
-+ do {
-+ __asm__ __volatile__("@ atomic_cmpxchg_unchecked\n"
-+ "ldrex %1, [%2]\n"
-+ "mov %0, #0\n"
-+ "teq %1, %3\n"
-+ "strexeq %0, %4, [%2]\n"
-+ : "=&r" (res), "=&r" (oldval)
-+ : "r" (&ptr->counter), "Ir" (old), "r" (new)
-+ : "cc");
-+ } while (res);
-+
-+ smp_mb();
-+
-+ return oldval;
-+}
-+
- static inline void atomic_clear_mask(unsigned long mask, unsigned long *addr)
- {
- unsigned long tmp, tmp2;
-@@ -165,7 +307,17 @@ static inline int atomic_add_return(int i, atomic_t *v)
-
- return val;
- }
-+
-+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
-+{
-+ return atomic_add_return(i, v);
-+}
-+
- #define atomic_add(i, v) (void) atomic_add_return(i, v)
-+static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
-+{
-+ (void) atomic_add_return(i, v);
-+}
-
- static inline int atomic_sub_return(int i, atomic_t *v)
- {
-@@ -180,6 +332,10 @@ static inline int atomic_sub_return(int i, atomic_t *v)
- return val;
- }
- #define atomic_sub(i, v) (void) atomic_sub_return(i, v)
-+static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
-+{
-+ (void) atomic_sub_return(i, v);
-+}
-
- static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
- {
-@@ -195,6 +351,11 @@ static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
- return ret;
- }
-
-+static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
-+{
-+ return atomic_cmpxchg(v, old, new);
-+}
-+
- static inline void atomic_clear_mask(unsigned long mask, unsigned long *addr)
- {
- unsigned long flags;
-@@ -207,6 +368,10 @@ static inline void atomic_clear_mask(unsigned long mask, unsigned long *addr)
- #endif /* __LINUX_ARM_ARCH__ */
-
- #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
-+static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
-+{
-+ return xchg(&v->counter, new);
-+}
-
- static inline int atomic_add_unless(atomic_t *v, int a, int u)
- {
-@@ -220,11 +385,27 @@ static inline int atomic_add_unless(atomic_t *v, int a, int u)
- #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
-
- #define atomic_inc(v) atomic_add(1, v)
-+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
-+{
-+ atomic_add_unchecked(1, v);
-+}
- #define atomic_dec(v) atomic_sub(1, v)
-+static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
-+{
-+ atomic_sub_unchecked(1, v);
-+}
-
- #define atomic_inc_and_test(v) (atomic_add_return(1, v) == 0)
-+static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
-+{
-+ return atomic_add_return_unchecked(1, v) == 0;
-+}
- #define atomic_dec_and_test(v) (atomic_sub_return(1, v) == 0)
- #define atomic_inc_return(v) (atomic_add_return(1, v))
-+static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
-+{
-+ return atomic_add_return_unchecked(1, v);
-+}
- #define atomic_dec_return(v) (atomic_sub_return(1, v))
- #define atomic_sub_and_test(i, v) (atomic_sub_return(i, v) == 0)
-
-diff --git a/arch/arm/include/asm/cache.h b/arch/arm/include/asm/cache.h
-index 66c160b..bca1449 100644
---- a/arch/arm/include/asm/cache.h
-+++ b/arch/arm/include/asm/cache.h
-@@ -4,8 +4,10 @@
- #ifndef __ASMARM_CACHE_H
- #define __ASMARM_CACHE_H
-
-+#include <linux/const.h>
-+
- #define L1_CACHE_SHIFT CONFIG_ARM_L1_CACHE_SHIFT
--#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-
- /*
- * Memory returned by kmalloc() may be used for DMA, so we must make
-diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h
-index 3d0cdd2..19957c5 100644
---- a/arch/arm/include/asm/cacheflush.h
-+++ b/arch/arm/include/asm/cacheflush.h
-@@ -216,13 +216,13 @@ struct cpu_cache_fns {
- void (*dma_inv_range)(const void *, const void *);
- void (*dma_clean_range)(const void *, const void *);
- void (*dma_flush_range)(const void *, const void *);
--};
-+} __no_const;
-
- struct outer_cache_fns {
- void (*inv_range)(unsigned long, unsigned long);
- void (*clean_range)(unsigned long, unsigned long);
- void (*flush_range)(unsigned long, unsigned long);
--};
-+} __no_const;
-
- /*
- * Select the calling method
-diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
-index 6aac3f5..265536b 100644
---- a/arch/arm/include/asm/elf.h
-+++ b/arch/arm/include/asm/elf.h
-@@ -109,7 +109,14 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
- the loader. We need to make sure that it is out of the way of the program
- that it will "exec", and that there is sufficient room for the brk. */
-
--#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
-+#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
-+
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE 0x00008000UL
-+
-+#define PAX_DELTA_MMAP_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
-+#define PAX_DELTA_STACK_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
-+#endif
-
- /* When the program starts, a1 contains a pointer to a function to be
- registered with atexit, as per the SVR4 ABI. A value of 0 means we
-diff --git a/arch/arm/include/asm/kmap_types.h b/arch/arm/include/asm/kmap_types.h
-index c019949..388fdd1 100644
---- a/arch/arm/include/asm/kmap_types.h
-+++ b/arch/arm/include/asm/kmap_types.h
-@@ -19,6 +19,7 @@ enum km_type {
- KM_SOFTIRQ0,
- KM_SOFTIRQ1,
- KM_L2_CACHE,
-+ KM_CLEARPAGE,
- KM_TYPE_NR
- };
-
-diff --git a/arch/arm/include/asm/page.h b/arch/arm/include/asm/page.h
-index 3a32af4..c8def8a 100644
---- a/arch/arm/include/asm/page.h
-+++ b/arch/arm/include/asm/page.h
-@@ -122,7 +122,7 @@ struct cpu_user_fns {
- void (*cpu_clear_user_highpage)(struct page *page, unsigned long vaddr);
- void (*cpu_copy_user_highpage)(struct page *to, struct page *from,
- unsigned long vaddr);
--};
-+} __no_const;
-
- #ifdef MULTI_USER
- extern struct cpu_user_fns cpu_user;
-diff --git a/arch/arm/include/asm/ptrace.h b/arch/arm/include/asm/ptrace.h
-index 1df6457..c806a73 100644
---- a/arch/arm/include/asm/ptrace.h
-+++ b/arch/arm/include/asm/ptrace.h
-@@ -69,7 +69,7 @@
- /*
- * ARMv7 groups of APSR bits
- */
--#define PSR_ISET_MASK 0x01000010 /* ISA state (J, T) mask */
-+#define PSR_ISET_MASK 0x01000020 /* ISA state (J, T) mask */
- #define PSR_IT_MASK 0x0600fc00 /* If-Then execution state mask */
- #define PSR_ENDIAN_MASK 0x00000200 /* Endianness state mask */
-
-diff --git a/arch/arm/include/asm/system.h b/arch/arm/include/asm/system.h
-index d65b2f5..9d87555 100644
---- a/arch/arm/include/asm/system.h
-+++ b/arch/arm/include/asm/system.h
-@@ -86,6 +86,8 @@ void hook_fault_code(int nr, int (*fn)(unsigned long, unsigned int,
-
- #define xchg(ptr,x) \
- ((__typeof__(*(ptr)))__xchg((unsigned long)(x),(ptr),sizeof(*(ptr))))
-+#define xchg_unchecked(ptr,x) \
-+ ((__typeof__(*(ptr)))__xchg((unsigned long)(x),(ptr),sizeof(*(ptr))))
-
- extern asmlinkage void __backtrace(void);
- extern asmlinkage void c_backtrace(unsigned long fp, int pmode);
-@@ -98,7 +100,7 @@ extern int cpu_architecture(void);
- extern void cpu_init(void);
-
- void arm_machine_restart(char mode, const char *cmd);
--extern void (*arm_pm_restart)(char str, const char *cmd);
-+extern void (*arm_pm_restart)(char str, const char *cmd) __noreturn;
-
- #define UDBG_UNDEFINED (1 << 0)
- #define UDBG_SYSCALL (1 << 1)
-@@ -505,6 +507,13 @@ static inline unsigned long long __cmpxchg64_mb(volatile void *ptr,
-
- #endif /* __LINUX_ARM_ARCH__ >= 6 */
-
-+#define _ASM_EXTABLE(from, to) \
-+" .pushsection __ex_table,\"a\"\n"\
-+" .align 3\n" \
-+" .long " #from ", " #to"\n" \
-+" .popsection"
-+
-+
- #endif /* __ASSEMBLY__ */
-
- #define arch_align_stack(x) (x)
-diff --git a/arch/arm/include/asm/thread_info.h b/arch/arm/include/asm/thread_info.h
-index 2dfb7d7..8fadd73 100644
---- a/arch/arm/include/asm/thread_info.h
-+++ b/arch/arm/include/asm/thread_info.h
-@@ -138,6 +138,12 @@ extern void vfp_sync_state(struct thread_info *thread);
- #define TIF_NEED_RESCHED 1
- #define TIF_NOTIFY_RESUME 2 /* callback before returning to user */
- #define TIF_SYSCALL_TRACE 8
-+
-+/* within 8 bits of TIF_SYSCALL_TRACE
-+ to meet flexible second operand requirements
-+*/
-+#define TIF_GRSEC_SETXID 9
-+
- #define TIF_POLLING_NRFLAG 16
- #define TIF_USING_IWMMXT 17
- #define TIF_MEMDIE 18
-@@ -152,6 +158,10 @@ extern void vfp_sync_state(struct thread_info *thread);
- #define _TIF_USING_IWMMXT (1 << TIF_USING_IWMMXT)
- #define _TIF_FREEZE (1 << TIF_FREEZE)
- #define _TIF_RESTORE_SIGMASK (1 << TIF_RESTORE_SIGMASK)
-+#define _TIF_GRSEC_SETXID (1 << TIF_GRSEC_SETXID)
-+
-+/* Checks for any syscall work in entry-common.S */
-+#define _TIF_SYSCALL_WORK (_TIF_SYSCALL_TRACE | _TIF_GRSEC_SETXID)
-
- /*
- * Change these and you break ASM code in entry-common.S
-diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
-index 1d6bd40..159316f 100644
---- a/arch/arm/include/asm/uaccess.h
-+++ b/arch/arm/include/asm/uaccess.h
-@@ -387,8 +387,23 @@ do { \
-
-
- #ifdef CONFIG_MMU
--extern unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n);
--extern unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n);
-+extern unsigned long __must_check ___copy_from_user(void *to, const void __user *from, unsigned long n);
-+extern unsigned long __must_check ___copy_to_user(void __user *to, const void *from, unsigned long n);
-+
-+static inline unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n)
-+{
-+ if (!__builtin_constant_p(n))
-+ check_object_size(to, n, false);
-+ return ___copy_from_user(to, from, n);
-+}
-+
-+static inline unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n)
-+{
-+ if (!__builtin_constant_p(n))
-+ check_object_size(from, n, true);
-+ return ___copy_to_user(to, from, n);
-+}
-+
- extern unsigned long __must_check __copy_to_user_std(void __user *to, const void *from, unsigned long n);
- extern unsigned long __must_check __clear_user(void __user *addr, unsigned long n);
- extern unsigned long __must_check __clear_user_std(void __user *addr, unsigned long n);
-@@ -403,6 +418,9 @@ extern unsigned long __must_check __strnlen_user(const char __user *s, long n);
-
- static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
- {
-+ if ((long)n < 0)
-+ return n;
-+
- if (access_ok(VERIFY_READ, from, n))
- n = __copy_from_user(to, from, n);
- else /* security hole - plug it */
-@@ -412,6 +430,9 @@ static inline unsigned long __must_check copy_from_user(void *to, const void __u
-
- static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
- {
-+ if ((long)n < 0)
-+ return n;
-+
- if (access_ok(VERIFY_WRITE, to, n))
- n = __copy_to_user(to, from, n);
- return n;
-diff --git a/arch/arm/kernel/armksyms.c b/arch/arm/kernel/armksyms.c
-index 0e62770..e2c2cd6 100644
---- a/arch/arm/kernel/armksyms.c
-+++ b/arch/arm/kernel/armksyms.c
-@@ -118,8 +118,8 @@ EXPORT_SYMBOL(__strncpy_from_user);
- #ifdef CONFIG_MMU
- EXPORT_SYMBOL(copy_page);
-
--EXPORT_SYMBOL(__copy_from_user);
--EXPORT_SYMBOL(__copy_to_user);
-+EXPORT_SYMBOL(___copy_from_user);
-+EXPORT_SYMBOL(___copy_to_user);
- EXPORT_SYMBOL(__clear_user);
-
- EXPORT_SYMBOL(__get_user_1);
-diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S
-index a6c66f5..bfdad39 100644
---- a/arch/arm/kernel/entry-common.S
-+++ b/arch/arm/kernel/entry-common.S
-@@ -77,7 +77,7 @@ ENTRY(ret_from_fork)
- get_thread_info tsk
- ldr r1, [tsk, #TI_FLAGS] @ check for syscall tracing
- mov why, #1
-- tst r1, #_TIF_SYSCALL_TRACE @ are we tracing syscalls?
-+ tst r1, #_TIF_SYSCALL_WORK @ are we tracing syscalls?
- beq ret_slow_syscall
- mov r1, sp
- mov r0, #1 @ trace exit [IP = 1]
-@@ -275,7 +275,7 @@ ENTRY(vector_swi)
- #endif
-
- stmdb sp!, {r4, r5} @ push fifth and sixth args
-- tst ip, #_TIF_SYSCALL_TRACE @ are we tracing syscalls?
-+ tst ip, #_TIF_SYSCALL_WORK @ are we tracing syscalls?
- bne __sys_trace
-
- cmp scno, #NR_syscalls @ check upper syscall limit
-diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
-index 38ccbe1..ca979b0 100644
---- a/arch/arm/kernel/head.S
-+++ b/arch/arm/kernel/head.S
-@@ -45,7 +45,9 @@
- .equ swapper_pg_dir, KERNEL_RAM_VADDR - 0x4000
-
- .macro pgtbl, rd
-- ldr \rd, =(KERNEL_RAM_PADDR - 0x4000)
-+ mov \rd, #KERNEL_RAM_PADDR
-+ sub \rd, #0x4000
-+ add \rd, \rd, \phys
- .endm
-
- #ifdef CONFIG_XIP_KERNEL
-diff --git a/arch/arm/kernel/kgdb.c b/arch/arm/kernel/kgdb.c
-index ba8ccfe..2dc34dc 100644
---- a/arch/arm/kernel/kgdb.c
-+++ b/arch/arm/kernel/kgdb.c
-@@ -190,7 +190,7 @@ void kgdb_arch_exit(void)
- * and we handle the normal undef case within the do_undefinstr
- * handler.
- */
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- #ifndef __ARMEB__
- .gdb_bpt_instr = {0xfe, 0xde, 0xff, 0xe7}
- #else /* ! __ARMEB__ */
-diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
-index 61f90d3..b1b8ab9 100644
---- a/arch/arm/kernel/process.c
-+++ b/arch/arm/kernel/process.c
-@@ -83,7 +83,7 @@ static int __init hlt_setup(char *__unused)
- __setup("nohlt", nohlt_setup);
- __setup("hlt", hlt_setup);
-
--void arm_machine_restart(char mode, const char *cmd)
-+__noreturn void arm_machine_restart(char mode, const char *cmd)
- {
- /*
- * Clean and disable cache, and turn off interrupts
-@@ -117,7 +117,7 @@ void arm_machine_restart(char mode, const char *cmd)
- void (*pm_power_off)(void);
- EXPORT_SYMBOL(pm_power_off);
-
--void (*arm_pm_restart)(char str, const char *cmd) = arm_machine_restart;
-+void (*arm_pm_restart)(char str, const char *cmd) __noreturn = arm_machine_restart;
- EXPORT_SYMBOL_GPL(arm_pm_restart);
-
-
-@@ -195,6 +195,7 @@ __setup("reboot=", reboot_setup);
-
- void machine_halt(void)
- {
-+ BUG();
- }
-
-
-@@ -202,6 +203,7 @@ void machine_power_off(void)
- {
- if (pm_power_off)
- pm_power_off();
-+ BUG();
- }
-
- void machine_restart(char *cmd)
-@@ -218,8 +220,8 @@ void __show_regs(struct pt_regs *regs)
- smp_processor_id(), print_tainted(), init_utsname()->release,
- (int)strcspn(init_utsname()->version, " "),
- init_utsname()->version);
-- print_symbol("PC is at %s\n", instruction_pointer(regs));
-- print_symbol("LR is at %s\n", regs->ARM_lr);
-+ printk("PC is at %pA\n", instruction_pointer(regs));
-+ printk("LR is at %pA\n", regs->ARM_lr);
- printk("pc : [<%08lx>] lr : [<%08lx>] psr: %08lx\n"
- "sp : %08lx ip : %08lx fp : %08lx\n",
- regs->ARM_pc, regs->ARM_lr, regs->ARM_cpsr,
-diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
-index a2ea385..4783488 100644
---- a/arch/arm/kernel/ptrace.c
-+++ b/arch/arm/kernel/ptrace.c
-@@ -847,10 +847,19 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
- return ret;
- }
-
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+extern void gr_delayed_cred_worker(void);
-+#endif
-+
- asmlinkage int syscall_trace(int why, struct pt_regs *regs, int scno)
- {
- unsigned long ip;
-
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+ if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
-+ gr_delayed_cred_worker();
-+#endif
-+
- if (!test_thread_flag(TIF_SYSCALL_TRACE))
- return scno;
- if (!(current->ptrace & PT_PTRACED))
-diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
-index c6c57b6..8ec5c3f 100644
---- a/arch/arm/kernel/setup.c
-+++ b/arch/arm/kernel/setup.c
-@@ -92,16 +92,16 @@ EXPORT_SYMBOL(elf_hwcap);
- struct processor processor;
- #endif
- #ifdef MULTI_TLB
--struct cpu_tlb_fns cpu_tlb;
-+struct cpu_tlb_fns cpu_tlb __read_mostly;
- #endif
- #ifdef MULTI_USER
--struct cpu_user_fns cpu_user;
-+struct cpu_user_fns cpu_user __read_mostly;
- #endif
- #ifdef MULTI_CACHE
--struct cpu_cache_fns cpu_cache;
-+struct cpu_cache_fns cpu_cache __read_mostly;
- #endif
- #ifdef CONFIG_OUTER_CACHE
--struct outer_cache_fns outer_cache;
-+struct outer_cache_fns outer_cache __read_mostly;
- #endif
-
- struct stack {
-diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
-index 3f361a7..aa0d108 100644
---- a/arch/arm/kernel/traps.c
-+++ b/arch/arm/kernel/traps.c
-@@ -50,10 +50,7 @@ static void dump_mem(const char *, const char *, unsigned long, unsigned long);
- void dump_backtrace_entry(unsigned long where, unsigned long from, unsigned long frame)
- {
- #ifdef CONFIG_KALLSYMS
-- char sym1[KSYM_SYMBOL_LEN], sym2[KSYM_SYMBOL_LEN];
-- sprint_symbol(sym1, where);
-- sprint_symbol(sym2, from);
-- printk("[<%08lx>] (%s) from [<%08lx>] (%s)\n", where, sym1, from, sym2);
-+ printk("[<%08lx>] (%pA) from [<%08lx>] (%pA)\n", where, (void *)where, from, (void *)from);
- #else
- printk("Function entered at [<%08lx>] from [<%08lx>]\n", where, from);
- #endif
-@@ -247,6 +244,8 @@ static void __die(const char *str, int err, struct thread_info *thread, struct p
-
- DEFINE_SPINLOCK(die_lock);
-
-+extern void gr_handle_kernel_exploit(void);
-+
- /*
- * This function is protected against re-entrancy.
- */
-@@ -271,6 +270,8 @@ NORET_TYPE void die(const char *str, struct pt_regs *regs, int err)
- if (panic_on_oops)
- panic("Fatal exception");
-
-+ gr_handle_kernel_exploit();
-+
- do_exit(SIGSEGV);
- }
-
-diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S
-index aecf87df..bed731b 100644
---- a/arch/arm/kernel/vmlinux.lds.S
-+++ b/arch/arm/kernel/vmlinux.lds.S
-@@ -74,14 +74,18 @@ SECTIONS
- #ifndef CONFIG_XIP_KERNEL
- __init_begin = _stext;
- INIT_DATA
-+ EXIT_TEXT
-+ EXIT_DATA
- . = ALIGN(PAGE_SIZE);
- __init_end = .;
- #endif
- }
-
- /DISCARD/ : { /* Exit code and data */
-+#ifdef CONFIG_XIP_KERNEL
- EXIT_TEXT
- EXIT_DATA
-+#endif
- *(.exitcall.exit)
- *(.discard)
- *(.ARM.exidx.exit.text)
-diff --git a/arch/arm/lib/copy_from_user.S b/arch/arm/lib/copy_from_user.S
-index e4fe124..0fc246b 100644
---- a/arch/arm/lib/copy_from_user.S
-+++ b/arch/arm/lib/copy_from_user.S
-@@ -16,7 +16,7 @@
- /*
- * Prototype:
- *
-- * size_t __copy_from_user(void *to, const void *from, size_t n)
-+ * size_t ___copy_from_user(void *to, const void *from, size_t n)
- *
- * Purpose:
- *
-@@ -84,11 +84,11 @@
-
- .text
-
--ENTRY(__copy_from_user)
-+ENTRY(___copy_from_user)
-
- #include "copy_template.S"
-
--ENDPROC(__copy_from_user)
-+ENDPROC(___copy_from_user)
-
- .section .fixup,"ax"
- .align 0
-diff --git a/arch/arm/lib/copy_page.S b/arch/arm/lib/copy_page.S
-index 6ee2f67..d1cce76 100644
---- a/arch/arm/lib/copy_page.S
-+++ b/arch/arm/lib/copy_page.S
-@@ -10,6 +10,7 @@
- * ASM optimised string functions
- */
- #include <linux/linkage.h>
-+#include <linux/const.h>
- #include <asm/assembler.h>
- #include <asm/asm-offsets.h>
- #include <asm/cache.h>
-diff --git a/arch/arm/lib/copy_to_user.S b/arch/arm/lib/copy_to_user.S
-index 1a71e15..ac7b258 100644
---- a/arch/arm/lib/copy_to_user.S
-+++ b/arch/arm/lib/copy_to_user.S
-@@ -16,7 +16,7 @@
- /*
- * Prototype:
- *
-- * size_t __copy_to_user(void *to, const void *from, size_t n)
-+ * size_t ___copy_to_user(void *to, const void *from, size_t n)
- *
- * Purpose:
- *
-@@ -88,11 +88,11 @@
- .text
-
- ENTRY(__copy_to_user_std)
--WEAK(__copy_to_user)
-+WEAK(___copy_to_user)
-
- #include "copy_template.S"
-
--ENDPROC(__copy_to_user)
-+ENDPROC(___copy_to_user)
-
- .section .fixup,"ax"
- .align 0
-diff --git a/arch/arm/lib/uaccess.S b/arch/arm/lib/uaccess.S
-index ffdd274..91017b6 100644
---- a/arch/arm/lib/uaccess.S
-+++ b/arch/arm/lib/uaccess.S
-@@ -19,7 +19,7 @@
-
- #define PAGE_SHIFT 12
-
--/* Prototype: int __copy_to_user(void *to, const char *from, size_t n)
-+/* Prototype: int ___copy_to_user(void *to, const char *from, size_t n)
- * Purpose : copy a block to user memory from kernel memory
- * Params : to - user memory
- * : from - kernel memory
-@@ -39,7 +39,7 @@ USER( strgtbt r3, [r0], #1) @ May fault
- sub r2, r2, ip
- b .Lc2u_dest_aligned
-
--ENTRY(__copy_to_user)
-+ENTRY(___copy_to_user)
- stmfd sp!, {r2, r4 - r7, lr}
- cmp r2, #4
- blt .Lc2u_not_enough
-@@ -277,14 +277,14 @@ USER( strgebt r3, [r0], #1) @ May fault
- ldrgtb r3, [r1], #0
- USER( strgtbt r3, [r0], #1) @ May fault
- b .Lc2u_finished
--ENDPROC(__copy_to_user)
-+ENDPROC(___copy_to_user)
-
- .section .fixup,"ax"
- .align 0
- 9001: ldmfd sp!, {r0, r4 - r7, pc}
- .previous
-
--/* Prototype: unsigned long __copy_from_user(void *to,const void *from,unsigned long n);
-+/* Prototype: unsigned long ___copy_from_user(void *to,const void *from,unsigned long n);
- * Purpose : copy a block from user memory to kernel memory
- * Params : to - kernel memory
- * : from - user memory
-@@ -303,7 +303,7 @@ USER( ldrgtbt r3, [r1], #1) @ May fault
- sub r2, r2, ip
- b .Lcfu_dest_aligned
-
--ENTRY(__copy_from_user)
-+ENTRY(___copy_from_user)
- stmfd sp!, {r0, r2, r4 - r7, lr}
- cmp r2, #4
- blt .Lcfu_not_enough
-@@ -543,7 +543,7 @@ USER( ldrgebt r3, [r1], #1) @ May fault
- USER( ldrgtbt r3, [r1], #1) @ May fault
- strgtb r3, [r0], #1
- b .Lcfu_finished
--ENDPROC(__copy_from_user)
-+ENDPROC(___copy_from_user)
-
- .section .fixup,"ax"
- .align 0
-diff --git a/arch/arm/lib/uaccess_with_memcpy.c b/arch/arm/lib/uaccess_with_memcpy.c
-index 6b967ff..67d5b2b 100644
---- a/arch/arm/lib/uaccess_with_memcpy.c
-+++ b/arch/arm/lib/uaccess_with_memcpy.c
-@@ -97,7 +97,7 @@ out:
- }
-
- unsigned long
--__copy_to_user(void __user *to, const void *from, unsigned long n)
-+___copy_to_user(void __user *to, const void *from, unsigned long n)
- {
- /*
- * This test is stubbed out of the main function above to keep
-diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
-index 4028724..beec230 100644
---- a/arch/arm/mach-at91/pm.c
-+++ b/arch/arm/mach-at91/pm.c
-@@ -348,7 +348,7 @@ static void at91_pm_end(void)
- }
-
-
--static struct platform_suspend_ops at91_pm_ops ={
-+static const struct platform_suspend_ops at91_pm_ops ={
- .valid = at91_pm_valid_state,
- .begin = at91_pm_begin,
- .enter = at91_pm_enter,
-diff --git a/arch/arm/mach-omap1/pm.c b/arch/arm/mach-omap1/pm.c
-index 5218943..0a34552 100644
---- a/arch/arm/mach-omap1/pm.c
-+++ b/arch/arm/mach-omap1/pm.c
-@@ -647,7 +647,7 @@ static struct irqaction omap_wakeup_irq = {
-
-
-
--static struct platform_suspend_ops omap_pm_ops ={
-+static const struct platform_suspend_ops omap_pm_ops ={
- .prepare = omap_pm_prepare,
- .enter = omap_pm_enter,
- .finish = omap_pm_finish,
-diff --git a/arch/arm/mach-omap2/pm24xx.c b/arch/arm/mach-omap2/pm24xx.c
-index bff5c4e..d4c649b 100644
---- a/arch/arm/mach-omap2/pm24xx.c
-+++ b/arch/arm/mach-omap2/pm24xx.c
-@@ -326,7 +326,7 @@ static void omap2_pm_finish(void)
- enable_hlt();
- }
-
--static struct platform_suspend_ops omap_pm_ops = {
-+static const struct platform_suspend_ops omap_pm_ops = {
- .prepare = omap2_pm_prepare,
- .enter = omap2_pm_enter,
- .finish = omap2_pm_finish,
-diff --git a/arch/arm/mach-omap2/pm34xx.c b/arch/arm/mach-omap2/pm34xx.c
-index 8946319..7d3e661 100644
---- a/arch/arm/mach-omap2/pm34xx.c
-+++ b/arch/arm/mach-omap2/pm34xx.c
-@@ -401,7 +401,7 @@ static void omap3_pm_end(void)
- return;
- }
-
--static struct platform_suspend_ops omap_pm_ops = {
-+static const struct platform_suspend_ops omap_pm_ops = {
- .begin = omap3_pm_begin,
- .end = omap3_pm_end,
- .prepare = omap3_pm_prepare,
-diff --git a/arch/arm/mach-pnx4008/pm.c b/arch/arm/mach-pnx4008/pm.c
-index b3d8d53..6e68ebc 100644
---- a/arch/arm/mach-pnx4008/pm.c
-+++ b/arch/arm/mach-pnx4008/pm.c
-@@ -116,7 +116,7 @@ static int pnx4008_pm_valid(suspend_state_t state)
- (state == PM_SUSPEND_MEM);
- }
-
--static struct platform_suspend_ops pnx4008_pm_ops = {
-+static const struct platform_suspend_ops pnx4008_pm_ops = {
- .enter = pnx4008_pm_enter,
- .valid = pnx4008_pm_valid,
- };
-diff --git a/arch/arm/mach-pxa/pm.c b/arch/arm/mach-pxa/pm.c
-index 7693355..9beb00a 100644
---- a/arch/arm/mach-pxa/pm.c
-+++ b/arch/arm/mach-pxa/pm.c
-@@ -95,7 +95,7 @@ void pxa_pm_finish(void)
- pxa_cpu_pm_fns->finish();
- }
-
--static struct platform_suspend_ops pxa_pm_ops = {
-+static const struct platform_suspend_ops pxa_pm_ops = {
- .valid = pxa_pm_valid,
- .enter = pxa_pm_enter,
- .prepare = pxa_pm_prepare,
-diff --git a/arch/arm/mach-pxa/sharpsl_pm.c b/arch/arm/mach-pxa/sharpsl_pm.c
-index 629e05d..06be589 100644
---- a/arch/arm/mach-pxa/sharpsl_pm.c
-+++ b/arch/arm/mach-pxa/sharpsl_pm.c
-@@ -891,7 +891,7 @@ static void sharpsl_apm_get_power_status(struct apm_power_info *info)
- }
-
- #ifdef CONFIG_PM
--static struct platform_suspend_ops sharpsl_pm_ops = {
-+static const struct platform_suspend_ops sharpsl_pm_ops = {
- .prepare = pxa_pm_prepare,
- .finish = pxa_pm_finish,
- .enter = corgi_pxa_pm_enter,
-diff --git a/arch/arm/mach-sa1100/pm.c b/arch/arm/mach-sa1100/pm.c
-index c83fdc8..ab9fc44 100644
---- a/arch/arm/mach-sa1100/pm.c
-+++ b/arch/arm/mach-sa1100/pm.c
-@@ -120,7 +120,7 @@ unsigned long sleep_phys_sp(void *sp)
- return virt_to_phys(sp);
- }
-
--static struct platform_suspend_ops sa11x0_pm_ops = {
-+static const struct platform_suspend_ops sa11x0_pm_ops = {
- .enter = sa11x0_pm_enter,
- .valid = suspend_valid_only_mem,
- };
-diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
-index 3191cd6..68bd2d7 100644
---- a/arch/arm/mm/fault.c
-+++ b/arch/arm/mm/fault.c
-@@ -569,6 +569,20 @@ do_PrefetchAbort(unsigned long addr, unsigned int ifsr, struct pt_regs *regs)
- const struct fsr_info *inf = ifsr_info + fsr_fs(ifsr);
- struct siginfo info;
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+ if (fsr_fs(ifsr) == 2) {
-+ unsigned int bkpt;
-+
-+ if (!probe_kernel_address((unsigned int *)addr, bkpt) && bkpt == 0xe12f1073) {
-+ current->thread.error_code = ifsr;
-+ current->thread.trap_no = 0;
-+ pax_report_refcount_overflow(regs);
-+ fixup_exception(regs);
-+ return;
-+ }
-+ }
-+#endif
-+
- if (!inf->fn(addr, ifsr | FSR_LNX_PF, regs))
- return;
-
-diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
-index f5abc51..aac904f 100644
---- a/arch/arm/mm/mmap.c
-+++ b/arch/arm/mm/mmap.c
-@@ -30,6 +30,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
- struct mm_struct *mm = current->mm;
- struct vm_area_struct *vma;
- unsigned long start_addr;
-+ unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
- #ifdef CONFIG_CPU_V6
- unsigned int cache_type;
- int do_align = 0, aliasing = 0;
-@@ -63,6 +64,10 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
- if (len > TASK_SIZE)
- return -ENOMEM;
-
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- if (addr) {
- if (do_align)
- addr = COLOUR_ALIGN(addr, pgoff);
-@@ -70,15 +75,14 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
- addr = PAGE_ALIGN(addr);
-
- vma = find_vma(mm, addr);
-- if (TASK_SIZE - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, &addr, len, offset))
- return addr;
- }
- if (len > mm->cached_hole_size) {
-- start_addr = addr = mm->free_area_cache;
-+ start_addr = addr = mm->free_area_cache;
- } else {
-- start_addr = addr = TASK_UNMAPPED_BASE;
-- mm->cached_hole_size = 0;
-+ start_addr = addr = mm->mmap_base;
-+ mm->cached_hole_size = 0;
- }
-
- full_search:
-@@ -94,14 +98,14 @@ full_search:
- * Start a new search - just in case we missed
- * some holes.
- */
-- if (start_addr != TASK_UNMAPPED_BASE) {
-- start_addr = addr = TASK_UNMAPPED_BASE;
-+ if (start_addr != mm->mmap_base) {
-+ start_addr = addr = mm->mmap_base;
- mm->cached_hole_size = 0;
- goto full_search;
- }
- return -ENOMEM;
- }
-- if (!vma || addr + len <= vma->vm_start) {
-+ if (check_heap_stack_gap(vma, &addr, len, offset)) {
- /*
- * Remember the place where we stopped the search:
- */
-@@ -116,7 +120,6 @@ full_search:
- }
- }
-
--
- /*
- * You really shouldn't be using read() or write() on /dev/mem. This
- * might go away in the future.
-diff --git a/arch/arm/plat-s3c/pm.c b/arch/arm/plat-s3c/pm.c
-index 8d97db2..b66cfa5 100644
---- a/arch/arm/plat-s3c/pm.c
-+++ b/arch/arm/plat-s3c/pm.c
-@@ -355,7 +355,7 @@ static void s3c_pm_finish(void)
- s3c_pm_check_cleanup();
- }
-
--static struct platform_suspend_ops s3c_pm_ops = {
-+static const struct platform_suspend_ops s3c_pm_ops = {
- .enter = s3c_pm_enter,
- .prepare = s3c_pm_prepare,
- .finish = s3c_pm_finish,
-diff --git a/arch/avr32/include/asm/cache.h b/arch/avr32/include/asm/cache.h
-index d3cf35a..0ba6053 100644
---- a/arch/avr32/include/asm/cache.h
-+++ b/arch/avr32/include/asm/cache.h
-@@ -1,8 +1,10 @@
- #ifndef __ASM_AVR32_CACHE_H
- #define __ASM_AVR32_CACHE_H
-
-+#include <linux/const.h>
-+
- #define L1_CACHE_SHIFT 5
--#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-
- /*
- * Memory returned by kmalloc() may be used for DMA, so we must make
-diff --git a/arch/avr32/include/asm/elf.h b/arch/avr32/include/asm/elf.h
-index d5d1d41..856e2ed 100644
---- a/arch/avr32/include/asm/elf.h
-+++ b/arch/avr32/include/asm/elf.h
-@@ -85,8 +85,14 @@ typedef struct user_fpu_struct elf_fpregset_t;
- the loader. We need to make sure that it is out of the way of the program
- that it will "exec", and that there is sufficient room for the brk. */
-
--#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
-+#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
-
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE 0x00001000UL
-+
-+#define PAX_DELTA_MMAP_LEN 15
-+#define PAX_DELTA_STACK_LEN 15
-+#endif
-
- /* This yields a mask that user programs can use to figure out what
- instruction set this CPU supports. This could be done in user space,
-diff --git a/arch/avr32/include/asm/kmap_types.h b/arch/avr32/include/asm/kmap_types.h
-index b7f5c68..556135c 100644
---- a/arch/avr32/include/asm/kmap_types.h
-+++ b/arch/avr32/include/asm/kmap_types.h
-@@ -22,7 +22,8 @@ D(10) KM_IRQ0,
- D(11) KM_IRQ1,
- D(12) KM_SOFTIRQ0,
- D(13) KM_SOFTIRQ1,
--D(14) KM_TYPE_NR
-+D(14) KM_CLEARPAGE,
-+D(15) KM_TYPE_NR
- };
-
- #undef D
-diff --git a/arch/avr32/mach-at32ap/pm.c b/arch/avr32/mach-at32ap/pm.c
-index f021edf..32d680e 100644
---- a/arch/avr32/mach-at32ap/pm.c
-+++ b/arch/avr32/mach-at32ap/pm.c
-@@ -176,7 +176,7 @@ out:
- return 0;
- }
-
--static struct platform_suspend_ops avr32_pm_ops = {
-+static const struct platform_suspend_ops avr32_pm_ops = {
- .valid = avr32_pm_valid_state,
- .enter = avr32_pm_enter,
- };
-diff --git a/arch/avr32/mm/fault.c b/arch/avr32/mm/fault.c
-index b61d86d..e292c7f 100644
---- a/arch/avr32/mm/fault.c
-+++ b/arch/avr32/mm/fault.c
-@@ -41,6 +41,23 @@ static inline int notify_page_fault(struct pt_regs *regs, int trap)
-
- int exception_trace = 1;
-
-+#ifdef CONFIG_PAX_PAGEEXEC
-+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
-+{
-+ unsigned long i;
-+
-+ printk(KERN_ERR "PAX: bytes at PC: ");
-+ for (i = 0; i < 20; i++) {
-+ unsigned char c;
-+ if (get_user(c, (unsigned char *)pc+i))
-+ printk(KERN_CONT "???????? ");
-+ else
-+ printk(KERN_CONT "%02x ", c);
-+ }
-+ printk("\n");
-+}
-+#endif
-+
- /*
- * This routine handles page faults. It determines the address and the
- * problem, and then passes it off to one of the appropriate routines.
-@@ -157,6 +174,16 @@ bad_area:
- up_read(&mm->mmap_sem);
-
- if (user_mode(regs)) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (mm->pax_flags & MF_PAX_PAGEEXEC) {
-+ if (ecr == ECR_PROTECTION_X || ecr == ECR_TLB_MISS_X) {
-+ pax_report_fault(regs, (void *)regs->pc, (void *)regs->sp);
-+ do_group_exit(SIGKILL);
-+ }
-+ }
-+#endif
-+
- if (exception_trace && printk_ratelimit())
- printk("%s%s[%d]: segfault at %08lx pc %08lx "
- "sp %08lx ecr %lu\n",
-diff --git a/arch/blackfin/include/asm/cache.h b/arch/blackfin/include/asm/cache.h
-index 93f6c63..d144953 100644
---- a/arch/blackfin/include/asm/cache.h
-+++ b/arch/blackfin/include/asm/cache.h
-@@ -7,12 +7,14 @@
- #ifndef __ARCH_BLACKFIN_CACHE_H
- #define __ARCH_BLACKFIN_CACHE_H
-
-+#include <linux/const.h>
-+
- /*
- * Bytes per L1 cache line
- * Blackfin loads 32 bytes for cache
- */
- #define L1_CACHE_SHIFT 5
--#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
- #define SMP_CACHE_BYTES L1_CACHE_BYTES
-
- #define ARCH_KMALLOC_MINALIGN L1_CACHE_BYTES
-diff --git a/arch/blackfin/kernel/kgdb.c b/arch/blackfin/kernel/kgdb.c
-index cce79d0..c406c85 100644
---- a/arch/blackfin/kernel/kgdb.c
-+++ b/arch/blackfin/kernel/kgdb.c
-@@ -428,7 +428,7 @@ int kgdb_arch_handle_exception(int vector, int signo,
- return -1; /* this means that we do not want to exit from the handler */
- }
-
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- .gdb_bpt_instr = {0xa1},
- #ifdef CONFIG_SMP
- .flags = KGDB_HW_BREAKPOINT|KGDB_THR_PROC_SWAP,
-diff --git a/arch/blackfin/mach-common/pm.c b/arch/blackfin/mach-common/pm.c
-index 8837be4..b2fb413 100644
---- a/arch/blackfin/mach-common/pm.c
-+++ b/arch/blackfin/mach-common/pm.c
-@@ -255,7 +255,7 @@ static int bfin_pm_enter(suspend_state_t state)
- return 0;
- }
-
--struct platform_suspend_ops bfin_pm_ops = {
-+const struct platform_suspend_ops bfin_pm_ops = {
- .enter = bfin_pm_enter,
- .valid = bfin_pm_valid,
- };
-diff --git a/arch/cris/include/arch-v10/arch/cache.h b/arch/cris/include/arch-v10/arch/cache.h
-index aea2718..3639a60 100644
---- a/arch/cris/include/arch-v10/arch/cache.h
-+++ b/arch/cris/include/arch-v10/arch/cache.h
-@@ -1,8 +1,9 @@
- #ifndef _ASM_ARCH_CACHE_H
- #define _ASM_ARCH_CACHE_H
-
-+#include <linux/const.h>
- /* Etrax 100LX have 32-byte cache-lines. */
--#define L1_CACHE_BYTES 32
- #define L1_CACHE_SHIFT 5
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-
- #endif /* _ASM_ARCH_CACHE_H */
-diff --git a/arch/cris/include/arch-v32/arch/cache.h b/arch/cris/include/arch-v32/arch/cache.h
-index dfc7305..417f5b3 100644
---- a/arch/cris/include/arch-v32/arch/cache.h
-+++ b/arch/cris/include/arch-v32/arch/cache.h
-@@ -1,11 +1,12 @@
- #ifndef _ASM_CRIS_ARCH_CACHE_H
- #define _ASM_CRIS_ARCH_CACHE_H
-
-+#include <linux/const.h>
- #include <arch/hwregs/dma.h>
-
- /* A cache-line is 32 bytes. */
--#define L1_CACHE_BYTES 32
- #define L1_CACHE_SHIFT 5
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-
- void flush_dma_list(dma_descr_data *descr);
- void flush_dma_descr(dma_descr_data *descr, int flush_buf);
-diff --git a/arch/frv/include/asm/atomic.h b/arch/frv/include/asm/atomic.h
-index 00a57af..c3ef0cd 100644
---- a/arch/frv/include/asm/atomic.h
-+++ b/arch/frv/include/asm/atomic.h
-@@ -241,6 +241,16 @@ extern uint32_t __xchg_32(uint32_t i, volatile void *v);
- #define atomic64_cmpxchg(v, old, new) (__cmpxchg_64(old, new, &(v)->counter))
- #define atomic64_xchg(v, new) (__xchg_64(new, &(v)->counter))
-
-+#define atomic64_read_unchecked(v) atomic64_read(v)
-+#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
-+#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
-+#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
-+#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
-+#define atomic64_inc_unchecked(v) atomic64_inc(v)
-+#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
-+#define atomic64_dec_unchecked(v) atomic64_dec(v)
-+#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
-+
- static __inline__ int atomic_add_unless(atomic_t *v, int a, int u)
- {
- int c, old;
-diff --git a/arch/frv/include/asm/cache.h b/arch/frv/include/asm/cache.h
-index 7dc0f0f..1e6a620 100644
---- a/arch/frv/include/asm/cache.h
-+++ b/arch/frv/include/asm/cache.h
-@@ -12,10 +12,11 @@
- #ifndef __ASM_CACHE_H
- #define __ASM_CACHE_H
-
-+#include <linux/const.h>
-
- /* bytes per L1 cache line */
- #define L1_CACHE_SHIFT (CONFIG_FRV_L1_CACHE_SHIFT)
--#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-
- #define ARCH_KMALLOC_MINALIGN L1_CACHE_BYTES
-
-diff --git a/arch/frv/include/asm/kmap_types.h b/arch/frv/include/asm/kmap_types.h
-index f8e16b2..c73ff79 100644
---- a/arch/frv/include/asm/kmap_types.h
-+++ b/arch/frv/include/asm/kmap_types.h
-@@ -23,6 +23,7 @@ enum km_type {
- KM_IRQ1,
- KM_SOFTIRQ0,
- KM_SOFTIRQ1,
-+ KM_CLEARPAGE,
- KM_TYPE_NR
- };
-
-diff --git a/arch/frv/mm/elf-fdpic.c b/arch/frv/mm/elf-fdpic.c
-index 385fd30..27cf8ba 100644
---- a/arch/frv/mm/elf-fdpic.c
-+++ b/arch/frv/mm/elf-fdpic.c
-@@ -61,6 +61,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
- {
- struct vm_area_struct *vma;
- unsigned long limit;
-+ unsigned long offset = gr_rand_threadstack_offset(current->mm, filp, flags);
-
- if (len > TASK_SIZE)
- return -ENOMEM;
-@@ -73,8 +74,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
- if (addr) {
- addr = PAGE_ALIGN(addr);
- vma = find_vma(current->mm, addr);
-- if (TASK_SIZE - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, &addr, len, offset))
- goto success;
- }
-
-@@ -89,7 +89,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
- for (; vma; vma = vma->vm_next) {
- if (addr > limit)
- break;
-- if (addr + len <= vma->vm_start)
-+ if (check_heap_stack_gap(vma, &addr, len, offset))
- goto success;
- addr = vma->vm_end;
- }
-@@ -104,7 +104,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
- for (; vma; vma = vma->vm_next) {
- if (addr > limit)
- break;
-- if (addr + len <= vma->vm_start)
-+ if (check_heap_stack_gap(vma, &addr, len, offset))
- goto success;
- addr = vma->vm_end;
- }
-diff --git a/arch/h8300/include/asm/cache.h b/arch/h8300/include/asm/cache.h
-index c635028..6d9445a 100644
---- a/arch/h8300/include/asm/cache.h
-+++ b/arch/h8300/include/asm/cache.h
-@@ -1,8 +1,10 @@
- #ifndef __ARCH_H8300_CACHE_H
- #define __ARCH_H8300_CACHE_H
-
-+#include <linux/const.h>
-+
- /* bytes per L1 cache line */
--#define L1_CACHE_BYTES 4
-+#define L1_CACHE_BYTES _AC(4,UL)
-
- /* m68k-elf-gcc 2.95.2 doesn't like these */
-
-diff --git a/arch/ia64/hp/common/hwsw_iommu.c b/arch/ia64/hp/common/hwsw_iommu.c
-index e4a80d8..11a7ea1 100644
---- a/arch/ia64/hp/common/hwsw_iommu.c
-+++ b/arch/ia64/hp/common/hwsw_iommu.c
-@@ -17,7 +17,7 @@
- #include <linux/swiotlb.h>
- #include <asm/machvec.h>
-
--extern struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
-+extern const struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
-
- /* swiotlb declarations & definitions: */
- extern int swiotlb_late_init_with_default_size (size_t size);
-@@ -33,7 +33,7 @@ static inline int use_swiotlb(struct device *dev)
- !sba_dma_ops.dma_supported(dev, *dev->dma_mask);
- }
-
--struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
-+const struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
- {
- if (use_swiotlb(dev))
- return &swiotlb_dma_ops;
-diff --git a/arch/ia64/hp/common/sba_iommu.c b/arch/ia64/hp/common/sba_iommu.c
-index 01ae69b..35752fd 100644
---- a/arch/ia64/hp/common/sba_iommu.c
-+++ b/arch/ia64/hp/common/sba_iommu.c
-@@ -2097,7 +2097,7 @@ static struct acpi_driver acpi_sba_ioc_driver = {
- },
- };
-
--extern struct dma_map_ops swiotlb_dma_ops;
-+extern const struct dma_map_ops swiotlb_dma_ops;
-
- static int __init
- sba_init(void)
-@@ -2211,7 +2211,7 @@ sba_page_override(char *str)
-
- __setup("sbapagesize=",sba_page_override);
-
--struct dma_map_ops sba_dma_ops = {
-+const struct dma_map_ops sba_dma_ops = {
- .alloc_coherent = sba_alloc_coherent,
- .free_coherent = sba_free_coherent,
- .map_page = sba_map_page,
-diff --git a/arch/ia64/ia32/binfmt_elf32.c b/arch/ia64/ia32/binfmt_elf32.c
-index c69552b..c7122f4 100644
---- a/arch/ia64/ia32/binfmt_elf32.c
-+++ b/arch/ia64/ia32/binfmt_elf32.c
-@@ -45,6 +45,13 @@ randomize_stack_top(unsigned long stack_top);
-
- #define elf_read_implies_exec(ex, have_pt_gnu_stack) (!(have_pt_gnu_stack))
-
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE (current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
-+
-+#define PAX_DELTA_MMAP_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
-+#define PAX_DELTA_STACK_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
-+#endif
-+
- /* Ugly but avoids duplication */
- #include "../../../fs/binfmt_elf.c"
-
-diff --git a/arch/ia64/ia32/ia32priv.h b/arch/ia64/ia32/ia32priv.h
-index 0f15349..26b3429 100644
---- a/arch/ia64/ia32/ia32priv.h
-+++ b/arch/ia64/ia32/ia32priv.h
-@@ -296,7 +296,14 @@ typedef struct compat_siginfo {
- #define ELF_DATA ELFDATA2LSB
- #define ELF_ARCH EM_386
-
--#define IA32_STACK_TOP IA32_PAGE_OFFSET
-+#ifdef CONFIG_PAX_RANDUSTACK
-+#define __IA32_DELTA_STACK (current->mm->delta_stack)
-+#else
-+#define __IA32_DELTA_STACK 0UL
-+#endif
-+
-+#define IA32_STACK_TOP (IA32_PAGE_OFFSET - __IA32_DELTA_STACK)
-+
- #define IA32_GATE_OFFSET IA32_PAGE_OFFSET
- #define IA32_GATE_END IA32_PAGE_OFFSET + PAGE_SIZE
-
-diff --git a/arch/ia64/include/asm/atomic.h b/arch/ia64/include/asm/atomic.h
-index 88405cb..de5ca5d 100644
---- a/arch/ia64/include/asm/atomic.h
-+++ b/arch/ia64/include/asm/atomic.h
-@@ -210,6 +210,16 @@ atomic64_add_negative (__s64 i, atomic64_t *v)
- #define atomic64_inc(v) atomic64_add(1, (v))
- #define atomic64_dec(v) atomic64_sub(1, (v))
-
-+#define atomic64_read_unchecked(v) atomic64_read(v)
-+#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
-+#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
-+#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
-+#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
-+#define atomic64_inc_unchecked(v) atomic64_inc(v)
-+#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
-+#define atomic64_dec_unchecked(v) atomic64_dec(v)
-+#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
-+
- /* Atomic operations are already serializing */
- #define smp_mb__before_atomic_dec() barrier()
- #define smp_mb__after_atomic_dec() barrier()
-diff --git a/arch/ia64/include/asm/cache.h b/arch/ia64/include/asm/cache.h
-index e7482bd..d1c9b8e 100644
---- a/arch/ia64/include/asm/cache.h
-+++ b/arch/ia64/include/asm/cache.h
-@@ -1,6 +1,7 @@
- #ifndef _ASM_IA64_CACHE_H
- #define _ASM_IA64_CACHE_H
-
-+#include <linux/const.h>
-
- /*
- * Copyright (C) 1998-2000 Hewlett-Packard Co
-@@ -9,7 +10,7 @@
-
- /* Bytes per L1 (data) cache line. */
- #define L1_CACHE_SHIFT CONFIG_IA64_L1_CACHE_SHIFT
--#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-
- #ifdef CONFIG_SMP
- # define SMP_CACHE_SHIFT L1_CACHE_SHIFT
-diff --git a/arch/ia64/include/asm/dma-mapping.h b/arch/ia64/include/asm/dma-mapping.h
-index 8d3c79c..71b3af6 100644
---- a/arch/ia64/include/asm/dma-mapping.h
-+++ b/arch/ia64/include/asm/dma-mapping.h
-@@ -12,7 +12,7 @@
-
- #define ARCH_HAS_DMA_GET_REQUIRED_MASK
-
--extern struct dma_map_ops *dma_ops;
-+extern const struct dma_map_ops *dma_ops;
- extern struct ia64_machine_vector ia64_mv;
- extern void set_iommu_machvec(void);
-
-@@ -24,7 +24,7 @@ extern void machvec_dma_sync_sg(struct device *, struct scatterlist *, int,
- static inline void *dma_alloc_coherent(struct device *dev, size_t size,
- dma_addr_t *daddr, gfp_t gfp)
- {
-- struct dma_map_ops *ops = platform_dma_get_ops(dev);
-+ const struct dma_map_ops *ops = platform_dma_get_ops(dev);
- void *caddr;
-
- caddr = ops->alloc_coherent(dev, size, daddr, gfp);
-@@ -35,7 +35,7 @@ static inline void *dma_alloc_coherent(struct device *dev, size_t size,
- static inline void dma_free_coherent(struct device *dev, size_t size,
- void *caddr, dma_addr_t daddr)
- {
-- struct dma_map_ops *ops = platform_dma_get_ops(dev);
-+ const struct dma_map_ops *ops = platform_dma_get_ops(dev);
- debug_dma_free_coherent(dev, size, caddr, daddr);
- ops->free_coherent(dev, size, caddr, daddr);
- }
-@@ -49,13 +49,13 @@ static inline void dma_free_coherent(struct device *dev, size_t size,
-
- static inline int dma_mapping_error(struct device *dev, dma_addr_t daddr)
- {
-- struct dma_map_ops *ops = platform_dma_get_ops(dev);
-+ const struct dma_map_ops *ops = platform_dma_get_ops(dev);
- return ops->mapping_error(dev, daddr);
- }
-
- static inline int dma_supported(struct device *dev, u64 mask)
- {
-- struct dma_map_ops *ops = platform_dma_get_ops(dev);
-+ const struct dma_map_ops *ops = platform_dma_get_ops(dev);
- return ops->dma_supported(dev, mask);
- }
-
-diff --git a/arch/ia64/include/asm/elf.h b/arch/ia64/include/asm/elf.h
-index 86eddee..b116bb4 100644
---- a/arch/ia64/include/asm/elf.h
-+++ b/arch/ia64/include/asm/elf.h
-@@ -43,6 +43,13 @@
- */
- #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x800000000UL)
-
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE (current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
-+
-+#define PAX_DELTA_MMAP_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
-+#define PAX_DELTA_STACK_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
-+#endif
-+
- #define PT_IA_64_UNWIND 0x70000001
-
- /* IA-64 relocations: */
-diff --git a/arch/ia64/include/asm/machvec.h b/arch/ia64/include/asm/machvec.h
-index 367d299..9ad4279 100644
---- a/arch/ia64/include/asm/machvec.h
-+++ b/arch/ia64/include/asm/machvec.h
-@@ -45,7 +45,7 @@ typedef void ia64_mv_kernel_launch_event_t(void);
- /* DMA-mapping interface: */
- typedef void ia64_mv_dma_init (void);
- typedef u64 ia64_mv_dma_get_required_mask (struct device *);
--typedef struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
-+typedef const struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
-
- /*
- * WARNING: The legacy I/O space is _architected_. Platforms are
-@@ -251,7 +251,7 @@ extern void machvec_init_from_cmdline(const char *cmdline);
- # endif /* CONFIG_IA64_GENERIC */
-
- extern void swiotlb_dma_init(void);
--extern struct dma_map_ops *dma_get_ops(struct device *);
-+extern const struct dma_map_ops *dma_get_ops(struct device *);
-
- /*
- * Define default versions so we can extend machvec for new platforms without having
-diff --git a/arch/ia64/include/asm/pgalloc.h b/arch/ia64/include/asm/pgalloc.h
-index 96a8d92..617a1cf 100644
---- a/arch/ia64/include/asm/pgalloc.h
-+++ b/arch/ia64/include/asm/pgalloc.h
-@@ -39,6 +39,12 @@ pgd_populate(struct mm_struct *mm, pgd_t * pgd_entry, pud_t * pud)
- pgd_val(*pgd_entry) = __pa(pud);
- }
-
-+static inline void
-+pgd_populate_kernel(struct mm_struct *mm, pgd_t * pgd_entry, pud_t * pud)
-+{
-+ pgd_populate(mm, pgd_entry, pud);
-+}
-+
- static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr)
- {
- return quicklist_alloc(0, GFP_KERNEL, NULL);
-@@ -57,6 +63,12 @@ pud_populate(struct mm_struct *mm, pud_t * pud_entry, pmd_t * pmd)
- pud_val(*pud_entry) = __pa(pmd);
- }
-
-+static inline void
-+pud_populate_kernel(struct mm_struct *mm, pud_t * pud_entry, pmd_t * pmd)
-+{
-+ pud_populate(mm, pud_entry, pmd);
-+}
-+
- static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long addr)
- {
- return quicklist_alloc(0, GFP_KERNEL, NULL);
-diff --git a/arch/ia64/include/asm/pgtable.h b/arch/ia64/include/asm/pgtable.h
-index 8840a69..cdb63d9 100644
---- a/arch/ia64/include/asm/pgtable.h
-+++ b/arch/ia64/include/asm/pgtable.h
-@@ -12,7 +12,7 @@
- * David Mosberger-Tang <davidm@hpl.hp.com>
- */
-
--
-+#include <linux/const.h>
- #include <asm/mman.h>
- #include <asm/page.h>
- #include <asm/processor.h>
-@@ -143,6 +143,17 @@
- #define PAGE_READONLY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
- #define PAGE_COPY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
- #define PAGE_COPY_EXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RX)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+# define PAGE_SHARED_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RW)
-+# define PAGE_READONLY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
-+# define PAGE_COPY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
-+#else
-+# define PAGE_SHARED_NOEXEC PAGE_SHARED
-+# define PAGE_READONLY_NOEXEC PAGE_READONLY
-+# define PAGE_COPY_NOEXEC PAGE_COPY
-+#endif
-+
- #define PAGE_GATE __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_X_RX)
- #define PAGE_KERNEL __pgprot(__DIRTY_BITS | _PAGE_PL_0 | _PAGE_AR_RWX)
- #define PAGE_KERNELRX __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_RX)
-diff --git a/arch/ia64/include/asm/processor.h b/arch/ia64/include/asm/processor.h
-index 3eaeedf..0530962 100644
---- a/arch/ia64/include/asm/processor.h
-+++ b/arch/ia64/include/asm/processor.h
-@@ -361,7 +361,7 @@ struct thread_struct {
- regs->loadrs = 0; \
- regs->r8 = get_dumpable(current->mm); /* set "don't zap registers" flag */ \
- regs->r12 = new_sp - 16; /* allocate 16 byte scratch area */ \
-- if (unlikely(!get_dumpable(current->mm))) { \
-+ if (unlikely(get_dumpable(current->mm) != SUID_DUMP_USER)) { \
- /* \
- * Zap scratch regs to avoid leaking bits between processes with different \
- * uid/privileges. \
-diff --git a/arch/ia64/include/asm/spinlock.h b/arch/ia64/include/asm/spinlock.h
-index 239ecdc..f94170e 100644
---- a/arch/ia64/include/asm/spinlock.h
-+++ b/arch/ia64/include/asm/spinlock.h
-@@ -72,7 +72,7 @@ static __always_inline void __ticket_spin_unlock(raw_spinlock_t *lock)
- unsigned short *p = (unsigned short *)&lock->lock + 1, tmp;
-
- asm volatile ("ld2.bias %0=[%1]" : "=r"(tmp) : "r"(p));
-- ACCESS_ONCE(*p) = (tmp + 2) & ~1;
-+ ACCESS_ONCE_RW(*p) = (tmp + 2) & ~1;
- }
-
- static __always_inline void __ticket_spin_unlock_wait(raw_spinlock_t *lock)
-diff --git a/arch/ia64/include/asm/uaccess.h b/arch/ia64/include/asm/uaccess.h
-index 449c8c0..18965fb 100644
---- a/arch/ia64/include/asm/uaccess.h
-+++ b/arch/ia64/include/asm/uaccess.h
-@@ -240,12 +240,24 @@ extern unsigned long __must_check __copy_user (void __user *to, const void __use
- static inline unsigned long
- __copy_to_user (void __user *to, const void *from, unsigned long count)
- {
-+ if (count > INT_MAX)
-+ return count;
-+
-+ if (!__builtin_constant_p(count))
-+ check_object_size(from, count, true);
-+
- return __copy_user(to, (__force void __user *) from, count);
- }
-
- static inline unsigned long
- __copy_from_user (void *to, const void __user *from, unsigned long count)
- {
-+ if (count > INT_MAX)
-+ return count;
-+
-+ if (!__builtin_constant_p(count))
-+ check_object_size(to, count, false);
-+
- return __copy_user((__force void __user *) to, from, count);
- }
-
-@@ -255,10 +267,13 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
- ({ \
- void __user *__cu_to = (to); \
- const void *__cu_from = (from); \
-- long __cu_len = (n); \
-+ unsigned long __cu_len = (n); \
- \
-- if (__access_ok(__cu_to, __cu_len, get_fs())) \
-+ if (__cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs())) { \
-+ if (!__builtin_constant_p(n)) \
-+ check_object_size(__cu_from, __cu_len, true); \
- __cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len); \
-+ } \
- __cu_len; \
- })
-
-@@ -266,11 +281,14 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
- ({ \
- void *__cu_to = (to); \
- const void __user *__cu_from = (from); \
-- long __cu_len = (n); \
-+ unsigned long __cu_len = (n); \
- \
- __chk_user_ptr(__cu_from); \
-- if (__access_ok(__cu_from, __cu_len, get_fs())) \
-+ if (__cu_len <= INT_MAX && __access_ok(__cu_from, __cu_len, get_fs())) { \
-+ if (!__builtin_constant_p(n)) \
-+ check_object_size(__cu_to, __cu_len, false); \
- __cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len); \
-+ } \
- __cu_len; \
- })
-
-diff --git a/arch/ia64/kernel/dma-mapping.c b/arch/ia64/kernel/dma-mapping.c
-index f2c1600..969398a 100644
---- a/arch/ia64/kernel/dma-mapping.c
-+++ b/arch/ia64/kernel/dma-mapping.c
-@@ -3,7 +3,7 @@
- /* Set this to 1 if there is a HW IOMMU in the system */
- int iommu_detected __read_mostly;
-
--struct dma_map_ops *dma_ops;
-+const struct dma_map_ops *dma_ops;
- EXPORT_SYMBOL(dma_ops);
-
- #define PREALLOC_DMA_DEBUG_ENTRIES (1 << 16)
-@@ -16,7 +16,7 @@ static int __init dma_init(void)
- }
- fs_initcall(dma_init);
-
--struct dma_map_ops *dma_get_ops(struct device *dev)
-+const struct dma_map_ops *dma_get_ops(struct device *dev)
- {
- return dma_ops;
- }
-diff --git a/arch/ia64/kernel/module.c b/arch/ia64/kernel/module.c
-index 1481b0a..e7d38ff 100644
---- a/arch/ia64/kernel/module.c
-+++ b/arch/ia64/kernel/module.c
-@@ -315,8 +315,7 @@ module_alloc (unsigned long size)
- void
- module_free (struct module *mod, void *module_region)
- {
-- if (mod && mod->arch.init_unw_table &&
-- module_region == mod->module_init) {
-+ if (mod && mod->arch.init_unw_table && module_region == mod->module_init_rx) {
- unw_remove_unwind_table(mod->arch.init_unw_table);
- mod->arch.init_unw_table = NULL;
- }
-@@ -502,15 +501,39 @@ module_frob_arch_sections (Elf_Ehdr *ehdr, Elf_Shdr *sechdrs, char *secstrings,
- }
-
- static inline int
-+in_init_rx (const struct module *mod, uint64_t addr)
-+{
-+ return addr - (uint64_t) mod->module_init_rx < mod->init_size_rx;
-+}
-+
-+static inline int
-+in_init_rw (const struct module *mod, uint64_t addr)
-+{
-+ return addr - (uint64_t) mod->module_init_rw < mod->init_size_rw;
-+}
-+
-+static inline int
- in_init (const struct module *mod, uint64_t addr)
- {
-- return addr - (uint64_t) mod->module_init < mod->init_size;
-+ return in_init_rx(mod, addr) || in_init_rw(mod, addr);
-+}
-+
-+static inline int
-+in_core_rx (const struct module *mod, uint64_t addr)
-+{
-+ return addr - (uint64_t) mod->module_core_rx < mod->core_size_rx;
-+}
-+
-+static inline int
-+in_core_rw (const struct module *mod, uint64_t addr)
-+{
-+ return addr - (uint64_t) mod->module_core_rw < mod->core_size_rw;
- }
-
- static inline int
- in_core (const struct module *mod, uint64_t addr)
- {
-- return addr - (uint64_t) mod->module_core < mod->core_size;
-+ return in_core_rx(mod, addr) || in_core_rw(mod, addr);
- }
-
- static inline int
-@@ -693,7 +716,14 @@ do_reloc (struct module *mod, uint8_t r_type, Elf64_Sym *sym, uint64_t addend,
- break;
-
- case RV_BDREL:
-- val -= (uint64_t) (in_init(mod, val) ? mod->module_init : mod->module_core);
-+ if (in_init_rx(mod, val))
-+ val -= (uint64_t) mod->module_init_rx;
-+ else if (in_init_rw(mod, val))
-+ val -= (uint64_t) mod->module_init_rw;
-+ else if (in_core_rx(mod, val))
-+ val -= (uint64_t) mod->module_core_rx;
-+ else if (in_core_rw(mod, val))
-+ val -= (uint64_t) mod->module_core_rw;
- break;
-
- case RV_LTV:
-@@ -828,15 +858,15 @@ apply_relocate_add (Elf64_Shdr *sechdrs, const char *strtab, unsigned int symind
- * addresses have been selected...
- */
- uint64_t gp;
-- if (mod->core_size > MAX_LTOFF)
-+ if (mod->core_size_rx + mod->core_size_rw > MAX_LTOFF)
- /*
- * This takes advantage of fact that SHF_ARCH_SMALL gets allocated
- * at the end of the module.
- */
-- gp = mod->core_size - MAX_LTOFF / 2;
-+ gp = mod->core_size_rx + mod->core_size_rw - MAX_LTOFF / 2;
- else
-- gp = mod->core_size / 2;
-- gp = (uint64_t) mod->module_core + ((gp + 7) & -8);
-+ gp = (mod->core_size_rx + mod->core_size_rw) / 2;
-+ gp = (uint64_t) mod->module_core_rx + ((gp + 7) & -8);
- mod->arch.gp = gp;
- DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp);
- }
-diff --git a/arch/ia64/kernel/palinfo.c b/arch/ia64/kernel/palinfo.c
-index fdf6f9d..dae10ed 100644
---- a/arch/ia64/kernel/palinfo.c
-+++ b/arch/ia64/kernel/palinfo.c
-@@ -977,7 +977,7 @@ create_palinfo_proc_entries(unsigned int cpu)
- struct proc_dir_entry **pdir;
- struct proc_dir_entry *cpu_dir;
- int j;
-- char cpustr[sizeof(CPUSTR)];
-+ char cpustr[3+4+1];
-
-
- /*
-diff --git a/arch/ia64/kernel/pci-dma.c b/arch/ia64/kernel/pci-dma.c
-index f6b1ff0..de773fb 100644
---- a/arch/ia64/kernel/pci-dma.c
-+++ b/arch/ia64/kernel/pci-dma.c
-@@ -43,7 +43,7 @@ struct device fallback_dev = {
- .dma_mask = &fallback_dev.coherent_dma_mask,
- };
-
--extern struct dma_map_ops intel_dma_ops;
-+extern const struct dma_map_ops intel_dma_ops;
-
- static int __init pci_iommu_init(void)
- {
-@@ -96,15 +96,34 @@ int iommu_dma_supported(struct device *dev, u64 mask)
- }
- EXPORT_SYMBOL(iommu_dma_supported);
-
-+extern void *intel_alloc_coherent(struct device *hwdev, size_t size, dma_addr_t *dma_handle, gfp_t flags);
-+extern void intel_free_coherent(struct device *hwdev, size_t size, void *vaddr, dma_addr_t dma_handle);
-+extern int intel_map_sg(struct device *hwdev, struct scatterlist *sglist, int nelems, enum dma_data_direction dir, struct dma_attrs *attrs);
-+extern void intel_unmap_sg(struct device *hwdev, struct scatterlist *sglist, int nelems, enum dma_data_direction dir, struct dma_attrs *attrs);
-+extern dma_addr_t intel_map_page(struct device *dev, struct page *page, unsigned long offset, size_t size, enum dma_data_direction dir, struct dma_attrs *attrs);
-+extern void intel_unmap_page(struct device *dev, dma_addr_t dev_addr, size_t size, enum dma_data_direction dir, struct dma_attrs *attrs);
-+extern int intel_mapping_error(struct device *dev, dma_addr_t dma_addr);
-+
-+static const struct dma_map_ops intel_iommu_dma_ops = {
-+ /* from drivers/pci/intel-iommu.c:intel_dma_ops */
-+ .alloc_coherent = intel_alloc_coherent,
-+ .free_coherent = intel_free_coherent,
-+ .map_sg = intel_map_sg,
-+ .unmap_sg = intel_unmap_sg,
-+ .map_page = intel_map_page,
-+ .unmap_page = intel_unmap_page,
-+ .mapping_error = intel_mapping_error,
-+
-+ .sync_single_for_cpu = machvec_dma_sync_single,
-+ .sync_sg_for_cpu = machvec_dma_sync_sg,
-+ .sync_single_for_device = machvec_dma_sync_single,
-+ .sync_sg_for_device = machvec_dma_sync_sg,
-+ .dma_supported = iommu_dma_supported,
-+};
-+
- void __init pci_iommu_alloc(void)
- {
-- dma_ops = &intel_dma_ops;
--
-- dma_ops->sync_single_for_cpu = machvec_dma_sync_single;
-- dma_ops->sync_sg_for_cpu = machvec_dma_sync_sg;
-- dma_ops->sync_single_for_device = machvec_dma_sync_single;
-- dma_ops->sync_sg_for_device = machvec_dma_sync_sg;
-- dma_ops->dma_supported = iommu_dma_supported;
-+ dma_ops = &intel_iommu_dma_ops;
-
- /*
- * The order of these functions is important for
-diff --git a/arch/ia64/kernel/pci-swiotlb.c b/arch/ia64/kernel/pci-swiotlb.c
-index 285aae8..61dbab6 100644
---- a/arch/ia64/kernel/pci-swiotlb.c
-+++ b/arch/ia64/kernel/pci-swiotlb.c
-@@ -21,7 +21,7 @@ static void *ia64_swiotlb_alloc_coherent(struct device *dev, size_t size,
- return swiotlb_alloc_coherent(dev, size, dma_handle, gfp);
- }
-
--struct dma_map_ops swiotlb_dma_ops = {
-+const struct dma_map_ops swiotlb_dma_ops = {
- .alloc_coherent = ia64_swiotlb_alloc_coherent,
- .free_coherent = swiotlb_free_coherent,
- .map_page = swiotlb_map_page,
-diff --git a/arch/ia64/kernel/perfmon.c b/arch/ia64/kernel/perfmon.c
-index f178270..2dcff27 100644
---- a/arch/ia64/kernel/perfmon.c
-+++ b/arch/ia64/kernel/perfmon.c
-@@ -2372,7 +2372,6 @@ pfm_smpl_buffer_alloc(struct task_struct *task, struct file *filp, pfm_context_t
- */
- insert_vm_struct(mm, vma);
-
-- mm->total_vm += size >> PAGE_SHIFT;
- vm_stat_account(vma->vm_mm, vma->vm_flags, vma->vm_file,
- vma_pages(vma));
- up_write(&task->mm->mmap_sem);
-diff --git a/arch/ia64/kernel/sys_ia64.c b/arch/ia64/kernel/sys_ia64.c
-index 609d500..254a3d7 100644
---- a/arch/ia64/kernel/sys_ia64.c
-+++ b/arch/ia64/kernel/sys_ia64.c
-@@ -28,6 +28,7 @@ arch_get_unmapped_area (struct file *filp, unsigned long addr, unsigned long len
- unsigned long start_addr, align_mask = PAGE_SIZE - 1;
- struct mm_struct *mm = current->mm;
- struct vm_area_struct *vma;
-+ unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
-
- if (len > RGN_MAP_LIMIT)
- return -ENOMEM;
-@@ -43,6 +44,13 @@ arch_get_unmapped_area (struct file *filp, unsigned long addr, unsigned long len
- if (REGION_NUMBER(addr) == RGN_HPAGE)
- addr = 0;
- #endif
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ addr = mm->free_area_cache;
-+ else
-+#endif
-+
- if (!addr)
- addr = mm->free_area_cache;
-
-@@ -61,14 +69,14 @@ arch_get_unmapped_area (struct file *filp, unsigned long addr, unsigned long len
- for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
- /* At this point: (!vma || addr < vma->vm_end). */
- if (TASK_SIZE - len < addr || RGN_MAP_LIMIT - len < REGION_OFFSET(addr)) {
-- if (start_addr != TASK_UNMAPPED_BASE) {
-+ if (start_addr != mm->mmap_base) {
- /* Start a new search --- just in case we missed some holes. */
-- addr = TASK_UNMAPPED_BASE;
-+ addr = mm->mmap_base;
- goto full_search;
- }
- return -ENOMEM;
- }
-- if (!vma || addr + len <= vma->vm_start) {
-+ if (check_heap_stack_gap(vma, &addr, len, offset)) {
- /* Remember the address where we stopped this search: */
- mm->free_area_cache = addr + len;
- return addr;
-diff --git a/arch/ia64/kernel/topology.c b/arch/ia64/kernel/topology.c
-index 8f06035..b3a5818 100644
---- a/arch/ia64/kernel/topology.c
-+++ b/arch/ia64/kernel/topology.c
-@@ -282,7 +282,7 @@ static ssize_t cache_show(struct kobject * kobj, struct attribute * attr, char *
- return ret;
- }
-
--static struct sysfs_ops cache_sysfs_ops = {
-+static const struct sysfs_ops cache_sysfs_ops = {
- .show = cache_show
- };
-
-diff --git a/arch/ia64/kernel/vmlinux.lds.S b/arch/ia64/kernel/vmlinux.lds.S
-index 0a0c77b..8e55a81 100644
---- a/arch/ia64/kernel/vmlinux.lds.S
-+++ b/arch/ia64/kernel/vmlinux.lds.S
-@@ -190,7 +190,7 @@ SECTIONS
- /* Per-cpu data: */
- . = ALIGN(PERCPU_PAGE_SIZE);
- PERCPU_VADDR(PERCPU_ADDR, :percpu)
-- __phys_per_cpu_start = __per_cpu_load;
-+ __phys_per_cpu_start = per_cpu_load;
- . = __phys_per_cpu_start + PERCPU_PAGE_SIZE; /* ensure percpu data fits
- * into percpu page size
- */
-diff --git a/arch/ia64/mm/fault.c b/arch/ia64/mm/fault.c
-index 19261a9..1611b7a 100644
---- a/arch/ia64/mm/fault.c
-+++ b/arch/ia64/mm/fault.c
-@@ -72,6 +72,23 @@ mapped_kernel_page_is_present (unsigned long address)
- return pte_present(pte);
- }
-
-+#ifdef CONFIG_PAX_PAGEEXEC
-+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
-+{
-+ unsigned long i;
-+
-+ printk(KERN_ERR "PAX: bytes at PC: ");
-+ for (i = 0; i < 8; i++) {
-+ unsigned int c;
-+ if (get_user(c, (unsigned int *)pc+i))
-+ printk(KERN_CONT "???????? ");
-+ else
-+ printk(KERN_CONT "%08x ", c);
-+ }
-+ printk("\n");
-+}
-+#endif
-+
- void __kprobes
- ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *regs)
- {
-@@ -145,9 +162,23 @@ ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *re
- mask = ( (((isr >> IA64_ISR_X_BIT) & 1UL) << VM_EXEC_BIT)
- | (((isr >> IA64_ISR_W_BIT) & 1UL) << VM_WRITE_BIT));
-
-- if ((vma->vm_flags & mask) != mask)
-+ if ((vma->vm_flags & mask) != mask) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (!(vma->vm_flags & VM_EXEC) && (mask & VM_EXEC)) {
-+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->cr_iip)
-+ goto bad_area;
-+
-+ up_read(&mm->mmap_sem);
-+ pax_report_fault(regs, (void *)regs->cr_iip, (void *)regs->r12);
-+ do_group_exit(SIGKILL);
-+ }
-+#endif
-+
- goto bad_area;
-
-+ }
-+
- survive:
- /*
- * If for any reason at all we couldn't handle the fault, make
-diff --git a/arch/ia64/mm/hugetlbpage.c b/arch/ia64/mm/hugetlbpage.c
-index b0f6157..0a3ade5 100644
---- a/arch/ia64/mm/hugetlbpage.c
-+++ b/arch/ia64/mm/hugetlbpage.c
-@@ -150,6 +150,7 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr, u
- unsigned long pgoff, unsigned long flags)
- {
- struct vm_area_struct *vmm;
-+ unsigned long offset = gr_rand_threadstack_offset(current->mm, file, flags);
-
- if (len > RGN_MAP_LIMIT)
- return -ENOMEM;
-@@ -172,7 +173,7 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr, u
- /* At this point: (!vmm || addr < vmm->vm_end). */
- if (REGION_OFFSET(addr) + len > RGN_MAP_LIMIT)
- return -ENOMEM;
-- if (!vmm || (addr + len) <= vmm->vm_start)
-+ if (check_heap_stack_gap(vmm, &addr, len, offset))
- return addr;
- addr = ALIGN(vmm->vm_end, HPAGE_SIZE);
- }
-diff --git a/arch/ia64/mm/init.c b/arch/ia64/mm/init.c
-index 1857766..05cc6a3 100644
---- a/arch/ia64/mm/init.c
-+++ b/arch/ia64/mm/init.c
-@@ -122,6 +122,19 @@ ia64_init_addr_space (void)
- vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
- vma->vm_end = vma->vm_start + PAGE_SIZE;
- vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT;
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (current->mm->pax_flags & MF_PAX_PAGEEXEC) {
-+ vma->vm_flags &= ~VM_EXEC;
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (current->mm->pax_flags & MF_PAX_MPROTECT)
-+ vma->vm_flags &= ~VM_MAYEXEC;
-+#endif
-+
-+ }
-+#endif
-+
- vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
- down_write(¤t->mm->mmap_sem);
- if (insert_vm_struct(current->mm, vma)) {
-diff --git a/arch/ia64/sn/pci/pci_dma.c b/arch/ia64/sn/pci/pci_dma.c
-index 98b6849..8046766 100644
---- a/arch/ia64/sn/pci/pci_dma.c
-+++ b/arch/ia64/sn/pci/pci_dma.c
-@@ -464,7 +464,7 @@ int sn_pci_legacy_write(struct pci_bus *bus, u16 port, u32 val, u8 size)
- return ret;
- }
-
--static struct dma_map_ops sn_dma_ops = {
-+static const struct dma_map_ops sn_dma_ops = {
- .alloc_coherent = sn_dma_alloc_coherent,
- .free_coherent = sn_dma_free_coherent,
- .map_page = sn_dma_map_page,
-diff --git a/arch/m32r/include/asm/cache.h b/arch/m32r/include/asm/cache.h
-index 40b3ee9..8c2c112 100644
---- a/arch/m32r/include/asm/cache.h
-+++ b/arch/m32r/include/asm/cache.h
-@@ -1,8 +1,10 @@
- #ifndef _ASM_M32R_CACHE_H
- #define _ASM_M32R_CACHE_H
-
-+#include <linux/const.h>
-+
- /* L1 cache line size */
- #define L1_CACHE_SHIFT 4
--#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-
- #endif /* _ASM_M32R_CACHE_H */
-diff --git a/arch/m32r/lib/usercopy.c b/arch/m32r/lib/usercopy.c
-index 82abd15..d95ae5d 100644
---- a/arch/m32r/lib/usercopy.c
-+++ b/arch/m32r/lib/usercopy.c
-@@ -14,6 +14,9 @@
- unsigned long
- __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
- {
-+ if ((long)n < 0)
-+ return n;
-+
- prefetch(from);
- if (access_ok(VERIFY_WRITE, to, n))
- __copy_user(to,from,n);
-@@ -23,6 +26,9 @@ __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
- unsigned long
- __generic_copy_from_user(void *to, const void __user *from, unsigned long n)
- {
-+ if ((long)n < 0)
-+ return n;
-+
- prefetchw(to);
- if (access_ok(VERIFY_READ, from, n))
- __copy_user_zeroing(to,from,n);
-diff --git a/arch/m68k/include/asm/cache.h b/arch/m68k/include/asm/cache.h
-index ecafbe1..432c3e4 100644
---- a/arch/m68k/include/asm/cache.h
-+++ b/arch/m68k/include/asm/cache.h
-@@ -4,9 +4,11 @@
- #ifndef __ARCH_M68K_CACHE_H
- #define __ARCH_M68K_CACHE_H
-
-+#include <linux/const.h>
-+
- /* bytes per L1 cache line */
- #define L1_CACHE_SHIFT 4
--#define L1_CACHE_BYTES (1<< L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-
- #define ARCH_KMALLOC_MINALIGN L1_CACHE_BYTES
-
-diff --git a/arch/microblaze/include/asm/cache.h b/arch/microblaze/include/asm/cache.h
-index c209c47..2ba96e2 100644
---- a/arch/microblaze/include/asm/cache.h
-+++ b/arch/microblaze/include/asm/cache.h
-@@ -13,11 +13,12 @@
- #ifndef _ASM_MICROBLAZE_CACHE_H
- #define _ASM_MICROBLAZE_CACHE_H
-
-+#include <linux/const.h>
- #include <asm/registers.h>
-
- #define L1_CACHE_SHIFT 2
- /* word-granular cache in microblaze */
--#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-
- #define SMP_CACHE_BYTES L1_CACHE_BYTES
-
-diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
-index fd7620f..63d73a6 100644
---- a/arch/mips/Kconfig
-+++ b/arch/mips/Kconfig
-@@ -5,6 +5,7 @@ config MIPS
- select HAVE_IDE
- select HAVE_OPROFILE
- select HAVE_ARCH_KGDB
-+ select GENERIC_ATOMIC64 if !64BIT
- # Horrible source of confusion. Die, die, die ...
- select EMBEDDED
- select RTC_LIB if !LEMOTE_FULOONG2E
-diff --git a/arch/mips/Makefile b/arch/mips/Makefile
-index 57ff855..b603951 100644
---- a/arch/mips/Makefile
-+++ b/arch/mips/Makefile
-@@ -51,6 +51,8 @@ endif
- cflags-y := -ffunction-sections
- cflags-y += $(call cc-option, -mno-check-zero-division)
-
-+cflags-y += -Wno-sign-compare -Wno-extra
-+
- ifdef CONFIG_32BIT
- ld-emul = $(32bit-emul)
- vmlinux-32 = vmlinux
-diff --git a/arch/mips/alchemy/devboards/pm.c b/arch/mips/alchemy/devboards/pm.c
-index 632f986..fd0378d 100644
---- a/arch/mips/alchemy/devboards/pm.c
-+++ b/arch/mips/alchemy/devboards/pm.c
-@@ -78,7 +78,7 @@ static void db1x_pm_end(void)
-
- }
-
--static struct platform_suspend_ops db1x_pm_ops = {
-+static const struct platform_suspend_ops db1x_pm_ops = {
- .valid = suspend_valid_only_mem,
- .begin = db1x_pm_begin,
- .enter = db1x_pm_enter,
-diff --git a/arch/mips/include/asm/atomic.h b/arch/mips/include/asm/atomic.h
-index 09e7128..111035b 100644
---- a/arch/mips/include/asm/atomic.h
-+++ b/arch/mips/include/asm/atomic.h
-@@ -21,6 +21,10 @@
- #include <asm/war.h>
- #include <asm/system.h>
-
-+#ifdef CONFIG_GENERIC_ATOMIC64
-+#include <asm-generic/atomic64.h>
-+#endif
-+
- #define ATOMIC_INIT(i) { (i) }
-
- /*
-@@ -782,6 +786,16 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
- */
- #define atomic64_add_negative(i, v) (atomic64_add_return(i, (v)) < 0)
-
-+#define atomic64_read_unchecked(v) atomic64_read(v)
-+#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
-+#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
-+#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
-+#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
-+#define atomic64_inc_unchecked(v) atomic64_inc(v)
-+#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
-+#define atomic64_dec_unchecked(v) atomic64_dec(v)
-+#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
-+
- #endif /* CONFIG_64BIT */
-
- /*
-diff --git a/arch/mips/include/asm/cache.h b/arch/mips/include/asm/cache.h
-index 37f175c..c7a3065 100644
---- a/arch/mips/include/asm/cache.h
-+++ b/arch/mips/include/asm/cache.h
-@@ -9,10 +9,11 @@
- #ifndef _ASM_CACHE_H
- #define _ASM_CACHE_H
-
-+#include <linux/const.h>
- #include <kmalloc.h>
-
- #define L1_CACHE_SHIFT CONFIG_MIPS_L1_CACHE_SHIFT
--#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-
- #define SMP_CACHE_SHIFT L1_CACHE_SHIFT
- #define SMP_CACHE_BYTES L1_CACHE_BYTES
-diff --git a/arch/mips/include/asm/elf.h b/arch/mips/include/asm/elf.h
-index 7990694..4e93acf 100644
---- a/arch/mips/include/asm/elf.h
-+++ b/arch/mips/include/asm/elf.h
-@@ -368,4 +368,11 @@ extern int dump_task_fpu(struct task_struct *, elf_fpregset_t *);
- #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
- #endif
-
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
-+
-+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#endif
-+
- #endif /* _ASM_ELF_H */
-diff --git a/arch/mips/include/asm/page.h b/arch/mips/include/asm/page.h
-index f266295..627cfff 100644
---- a/arch/mips/include/asm/page.h
-+++ b/arch/mips/include/asm/page.h
-@@ -93,7 +93,7 @@ extern void copy_user_highpage(struct page *to, struct page *from,
- #ifdef CONFIG_CPU_MIPS32
- typedef struct { unsigned long pte_low, pte_high; } pte_t;
- #define pte_val(x) ((x).pte_low | ((unsigned long long)(x).pte_high << 32))
-- #define __pte(x) ({ pte_t __pte = {(x), ((unsigned long long)(x)) >> 32}; __pte; })
-+ #define __pte(x) ({ pte_t __pte = {(x), (x) >> 32}; __pte; })
- #else
- typedef struct { unsigned long long pte; } pte_t;
- #define pte_val(x) ((x).pte)
-diff --git a/arch/mips/include/asm/pgalloc.h b/arch/mips/include/asm/pgalloc.h
-index 3738f4b..9020d86 100644
---- a/arch/mips/include/asm/pgalloc.h
-+++ b/arch/mips/include/asm/pgalloc.h
-@@ -37,6 +37,11 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
- {
- set_pud(pud, __pud((unsigned long)pmd));
- }
-+
-+static inline void pud_populate_kernel(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
-+{
-+ pud_populate(mm, pud, pmd);
-+}
- #endif
-
- /*
-diff --git a/arch/mips/include/asm/reboot.h b/arch/mips/include/asm/reboot.h
-index e48c0bf..f3acf65 100644
---- a/arch/mips/include/asm/reboot.h
-+++ b/arch/mips/include/asm/reboot.h
-@@ -9,7 +9,7 @@
- #ifndef _ASM_REBOOT_H
- #define _ASM_REBOOT_H
-
--extern void (*_machine_restart)(char *command);
--extern void (*_machine_halt)(void);
-+extern void (*__noreturn _machine_restart)(char *command);
-+extern void (*__noreturn _machine_halt)(void);
-
- #endif /* _ASM_REBOOT_H */
-diff --git a/arch/mips/include/asm/system.h b/arch/mips/include/asm/system.h
-index 83b5509..9fa24a23 100644
---- a/arch/mips/include/asm/system.h
-+++ b/arch/mips/include/asm/system.h
-@@ -230,6 +230,6 @@ extern void per_cpu_trap_init(void);
- */
- #define __ARCH_WANT_UNLOCKED_CTXSW
-
--extern unsigned long arch_align_stack(unsigned long sp);
-+#define arch_align_stack(x) ((x) & ~0xfUL)
-
- #endif /* _ASM_SYSTEM_H */
-diff --git a/arch/mips/include/asm/thread_info.h b/arch/mips/include/asm/thread_info.h
-index 0e50757..4e9432c 100644
---- a/arch/mips/include/asm/thread_info.h
-+++ b/arch/mips/include/asm/thread_info.h
-@@ -120,6 +120,8 @@ register struct thread_info *__current_thread_info __asm__("$28");
- #define TIF_32BIT_ADDR 23 /* 32-bit address space (o32/n32) */
- #define TIF_FPUBOUND 24 /* thread bound to FPU-full CPU set */
- #define TIF_LOAD_WATCH 25 /* If set, load watch registers */
-+/* li takes a 32bit immediate */
-+#define TIF_GRSEC_SETXID 29 /* update credentials on syscall entry/exit */
- #define TIF_SYSCALL_TRACE 31 /* syscall trace active */
-
- #ifdef CONFIG_MIPS32_O32
-@@ -144,11 +146,14 @@ register struct thread_info *__current_thread_info __asm__("$28");
- #define _TIF_32BIT_ADDR (1<<TIF_32BIT_ADDR)
- #define _TIF_FPUBOUND (1<<TIF_FPUBOUND)
- #define _TIF_LOAD_WATCH (1<<TIF_LOAD_WATCH)
-+#define _TIF_GRSEC_SETXID (1<<TIF_GRSEC_SETXID)
-+
-+#define _TIF_SYSCALL_WORK (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | _TIF_GRSEC_SETXID)
-
- /* work to do on interrupt/exception return */
- #define _TIF_WORK_MASK (0x0000ffef & ~_TIF_SECCOMP)
- /* work to do on any return to u-space */
--#define _TIF_ALLWORK_MASK (0x8000ffff & ~_TIF_SECCOMP)
-+#define _TIF_ALLWORK_MASK ((0x8000ffff & ~_TIF_SECCOMP) | _TIF_GRSEC_SETXID)
-
- #endif /* __KERNEL__ */
-
-diff --git a/arch/mips/kernel/binfmt_elfn32.c b/arch/mips/kernel/binfmt_elfn32.c
-index 9fdd8bc..fcf9d68 100644
---- a/arch/mips/kernel/binfmt_elfn32.c
-+++ b/arch/mips/kernel/binfmt_elfn32.c
-@@ -50,6 +50,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
- #undef ELF_ET_DYN_BASE
- #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
-
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
-+
-+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#endif
-+
- #include <asm/processor.h>
- #include <linux/module.h>
- #include <linux/elfcore.h>
-diff --git a/arch/mips/kernel/binfmt_elfo32.c b/arch/mips/kernel/binfmt_elfo32.c
-index ff44823..cf0b48a 100644
---- a/arch/mips/kernel/binfmt_elfo32.c
-+++ b/arch/mips/kernel/binfmt_elfo32.c
-@@ -52,6 +52,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
- #undef ELF_ET_DYN_BASE
- #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
-
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
-+
-+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#endif
-+
- #include <asm/processor.h>
-
- /*
-diff --git a/arch/mips/kernel/entry.S b/arch/mips/kernel/entry.S
-index ffa3310..f8b1e06 100644
---- a/arch/mips/kernel/entry.S
-+++ b/arch/mips/kernel/entry.S
-@@ -167,7 +167,7 @@ work_notifysig: # deal with pending signals and
- FEXPORT(syscall_exit_work_partial)
- SAVE_STATIC
- syscall_exit_work:
-- li t0, _TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT
-+ li t0, _TIF_SYSCALL_WORK
- and t0, a2 # a2 is preloaded with TI_FLAGS
- beqz t0, work_pending # trace bit set?
- local_irq_enable # could let do_syscall_trace()
-diff --git a/arch/mips/kernel/kgdb.c b/arch/mips/kernel/kgdb.c
-index 50c9bb8..efdd5f8 100644
---- a/arch/mips/kernel/kgdb.c
-+++ b/arch/mips/kernel/kgdb.c
-@@ -245,6 +245,7 @@ int kgdb_arch_handle_exception(int vector, int signo, int err_code,
- return -1;
- }
-
-+/* cannot be const */
- struct kgdb_arch arch_kgdb_ops;
-
- /*
-diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
-index f3d73e1..bb3f57a 100644
---- a/arch/mips/kernel/process.c
-+++ b/arch/mips/kernel/process.c
-@@ -470,15 +470,3 @@ unsigned long get_wchan(struct task_struct *task)
- out:
- return pc;
- }
--
--/*
-- * Don't forget that the stack pointer must be aligned on a 8 bytes
-- * boundary for 32-bits ABI and 16 bytes for 64-bits ABI.
-- */
--unsigned long arch_align_stack(unsigned long sp)
--{
-- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
-- sp -= get_random_int() & ~PAGE_MASK;
--
-- return sp & ALMASK;
--}
-diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
-index 054861c..ddbbc7d 100644
---- a/arch/mips/kernel/ptrace.c
-+++ b/arch/mips/kernel/ptrace.c
-@@ -558,6 +558,10 @@ static inline int audit_arch(void)
- return arch;
- }
-
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+extern void gr_delayed_cred_worker(void);
-+#endif
-+
- /*
- * Notification of system call entry/exit
- * - triggered by current->work.syscall_trace
-@@ -568,6 +572,11 @@ asmlinkage void do_syscall_trace(struct pt_regs *regs, int entryexit)
- if (!entryexit)
- secure_computing(regs->regs[0]);
-
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+ if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
-+ gr_delayed_cred_worker();
-+#endif
-+
- if (unlikely(current->audit_context) && entryexit)
- audit_syscall_exit(AUDITSC_RESULT(regs->regs[2]),
- regs->regs[2]);
-diff --git a/arch/mips/kernel/reset.c b/arch/mips/kernel/reset.c
-index 060563a..7fbf310 100644
---- a/arch/mips/kernel/reset.c
-+++ b/arch/mips/kernel/reset.c
-@@ -19,8 +19,8 @@
- * So handle all using function pointers to machine specific
- * functions.
- */
--void (*_machine_restart)(char *command);
--void (*_machine_halt)(void);
-+void (*__noreturn _machine_restart)(char *command);
-+void (*__noreturn _machine_halt)(void);
- void (*pm_power_off)(void);
-
- EXPORT_SYMBOL(pm_power_off);
-@@ -29,16 +29,19 @@ void machine_restart(char *command)
- {
- if (_machine_restart)
- _machine_restart(command);
-+ BUG();
- }
-
- void machine_halt(void)
- {
- if (_machine_halt)
- _machine_halt();
-+ BUG();
- }
-
- void machine_power_off(void)
- {
- if (pm_power_off)
- pm_power_off();
-+ BUG();
- }
-diff --git a/arch/mips/kernel/scall32-o32.S b/arch/mips/kernel/scall32-o32.S
-index fd2a9bb..73ecc89 100644
---- a/arch/mips/kernel/scall32-o32.S
-+++ b/arch/mips/kernel/scall32-o32.S
-@@ -52,7 +52,7 @@ NESTED(handle_sys, PT_SIZE, sp)
-
- stack_done:
- lw t0, TI_FLAGS($28) # syscall tracing enabled?
-- li t1, _TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT
-+ li t1, _TIF_SYSCALL_WORK
- and t0, t1
- bnez t0, syscall_trace_entry # -> yes
-
-diff --git a/arch/mips/kernel/scall64-64.S b/arch/mips/kernel/scall64-64.S
-index 18bf7f3..6659dde 100644
---- a/arch/mips/kernel/scall64-64.S
-+++ b/arch/mips/kernel/scall64-64.S
-@@ -54,7 +54,7 @@ NESTED(handle_sys64, PT_SIZE, sp)
-
- sd a3, PT_R26(sp) # save a3 for syscall restarting
-
-- li t1, _TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT
-+ li t1, _TIF_SYSCALL_WORK
- LONG_L t0, TI_FLAGS($28) # syscall tracing enabled?
- and t0, t1, t0
- bnez t0, syscall_trace_entry
-diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
-index 6ebc079..a16f976 100644
---- a/arch/mips/kernel/scall64-n32.S
-+++ b/arch/mips/kernel/scall64-n32.S
-@@ -53,7 +53,7 @@ NESTED(handle_sysn32, PT_SIZE, sp)
-
- sd a3, PT_R26(sp) # save a3 for syscall restarting
-
-- li t1, _TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT
-+ li t1, _TIF_SYSCALL_WORK
- LONG_L t0, TI_FLAGS($28) # syscall tracing enabled?
- and t0, t1, t0
- bnez t0, n32_syscall_trace_entry
-diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
-index 14dde4c..dc68acf 100644
---- a/arch/mips/kernel/scall64-o32.S
-+++ b/arch/mips/kernel/scall64-o32.S
-@@ -81,7 +81,7 @@ NESTED(handle_sys, PT_SIZE, sp)
- PTR 4b, bad_stack
- .previous
-
-- li t1, _TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT
-+ li t1, _TIF_SYSCALL_WORK
- LONG_L t0, TI_FLAGS($28) # syscall tracing enabled?
- and t0, t1, t0
- bnez t0, trace_a_syscall
-diff --git a/arch/mips/kernel/syscall.c b/arch/mips/kernel/syscall.c
-index 3f7f466..311c777 100644
---- a/arch/mips/kernel/syscall.c
-+++ b/arch/mips/kernel/syscall.c
-@@ -78,6 +78,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
- struct vm_area_struct * vmm;
- int do_color_align;
- unsigned long task_size;
-+ unsigned long offset = gr_rand_threadstack_offset(current->mm, filp, flags);
-
- task_size = STACK_TOP;
-
-@@ -102,17 +103,21 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
- do_color_align = 0;
- if (filp || (flags & MAP_SHARED))
- do_color_align = 1;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- if (addr) {
- if (do_color_align)
- addr = COLOUR_ALIGN(addr, pgoff);
- else
- addr = PAGE_ALIGN(addr);
- vmm = find_vma(current->mm, addr);
-- if (task_size - len >= addr &&
-- (!vmm || addr + len <= vmm->vm_start))
-+ if (task_size - len >= addr && check_heap_stack_gap(vmm, addr, len, offset))
- return addr;
- }
-- addr = TASK_UNMAPPED_BASE;
-+ addr = current->mm->mmap_base;
- if (do_color_align)
- addr = COLOUR_ALIGN(addr, pgoff);
- else
-@@ -122,7 +127,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
- /* At this point: (!vmm || addr < vmm->vm_end). */
- if (task_size - len < addr)
- return -ENOMEM;
-- if (!vmm || addr + len <= vmm->vm_start)
-+ if (check_heap_stack_gap(vmm, addr, len, offset))
- return addr;
- addr = vmm->vm_end;
- if (do_color_align)
-diff --git a/arch/mips/mm/fault.c b/arch/mips/mm/fault.c
-index e97a7a2..f18f5b0 100644
---- a/arch/mips/mm/fault.c
-+++ b/arch/mips/mm/fault.c
-@@ -26,6 +26,23 @@
- #include <asm/ptrace.h>
- #include <asm/highmem.h> /* For VMALLOC_END */
-
-+#ifdef CONFIG_PAX_PAGEEXEC
-+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
-+{
-+ unsigned long i;
-+
-+ printk(KERN_ERR "PAX: bytes at PC: ");
-+ for (i = 0; i < 5; i++) {
-+ unsigned int c;
-+ if (get_user(c, (unsigned int *)pc+i))
-+ printk(KERN_CONT "???????? ");
-+ else
-+ printk(KERN_CONT "%08x ", c);
-+ }
-+ printk("\n");
-+}
-+#endif
-+
- /*
- * This routine handles page faults. It determines the address,
- * and the problem, and then passes it off to one of the appropriate
-diff --git a/arch/mn10300/proc-mn103e010/include/proc/cache.h b/arch/mn10300/proc-mn103e010/include/proc/cache.h
-index bdc1f9a..e8de5c5 100644
---- a/arch/mn10300/proc-mn103e010/include/proc/cache.h
-+++ b/arch/mn10300/proc-mn103e010/include/proc/cache.h
-@@ -11,12 +11,14 @@
- #ifndef _ASM_PROC_CACHE_H
- #define _ASM_PROC_CACHE_H
-
-+#include <linux/const.h>
-+
- /* L1 cache */
-
- #define L1_CACHE_NWAYS 4 /* number of ways in caches */
- #define L1_CACHE_NENTRIES 256 /* number of entries in each way */
--#define L1_CACHE_BYTES 16 /* bytes per entry */
- #define L1_CACHE_SHIFT 4 /* shift for bytes per entry */
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT) /* bytes per entry */
- #define L1_CACHE_WAYDISP 0x1000 /* displacement of one way from the next */
-
- #define L1_CACHE_TAG_VALID 0x00000001 /* cache tag valid bit */
-diff --git a/arch/parisc/include/asm/atomic.h b/arch/parisc/include/asm/atomic.h
-index 6ee459d..71c1831 100644
---- a/arch/parisc/include/asm/atomic.h
-+++ b/arch/parisc/include/asm/atomic.h
-@@ -336,6 +336,16 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
-
- #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
-
-+#define atomic64_read_unchecked(v) atomic64_read(v)
-+#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
-+#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
-+#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
-+#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
-+#define atomic64_inc_unchecked(v) atomic64_inc(v)
-+#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
-+#define atomic64_dec_unchecked(v) atomic64_dec(v)
-+#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
-+
- #else /* CONFIG_64BIT */
-
- #include <asm-generic/atomic64.h>
-diff --git a/arch/parisc/include/asm/cache.h b/arch/parisc/include/asm/cache.h
-index 32c2cca..a7b3a64 100644
---- a/arch/parisc/include/asm/cache.h
-+++ b/arch/parisc/include/asm/cache.h
-@@ -5,6 +5,7 @@
- #ifndef __ARCH_PARISC_CACHE_H
- #define __ARCH_PARISC_CACHE_H
-
-+#include <linux/const.h>
-
- /*
- * PA 2.0 processors have 64-byte cachelines; PA 1.1 processors have
-@@ -15,13 +16,13 @@
- * just ruin performance.
- */
- #ifdef CONFIG_PA20
--#define L1_CACHE_BYTES 64
- #define L1_CACHE_SHIFT 6
- #else
--#define L1_CACHE_BYTES 32
- #define L1_CACHE_SHIFT 5
- #endif
-
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-+
- #ifndef __ASSEMBLY__
-
- #define L1_CACHE_ALIGN(x) (((x)+(L1_CACHE_BYTES-1))&~(L1_CACHE_BYTES-1))
-diff --git a/arch/parisc/include/asm/elf.h b/arch/parisc/include/asm/elf.h
-index 9c802eb..0592e41 100644
---- a/arch/parisc/include/asm/elf.h
-+++ b/arch/parisc/include/asm/elf.h
-@@ -343,6 +343,13 @@ struct pt_regs; /* forward declaration... */
-
- #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x01000000)
-
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE 0x10000UL
-+
-+#define PAX_DELTA_MMAP_LEN 16
-+#define PAX_DELTA_STACK_LEN 16
-+#endif
-+
- /* This yields a mask that user programs can use to figure out what
- instruction set this CPU supports. This could be done in user space,
- but it's not easy, and we've already done it here. */
-diff --git a/arch/parisc/include/asm/pgalloc.h b/arch/parisc/include/asm/pgalloc.h
-index fc987a1..6e068ef 100644
---- a/arch/parisc/include/asm/pgalloc.h
-+++ b/arch/parisc/include/asm/pgalloc.h
-@@ -61,6 +61,11 @@ static inline void pgd_populate(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmd)
- (__u32)(__pa((unsigned long)pmd) >> PxD_VALUE_SHIFT));
- }
-
-+static inline void pgd_populate_kernel(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmd)
-+{
-+ pgd_populate(mm, pgd, pmd);
-+}
-+
- static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long address)
- {
- pmd_t *pmd = (pmd_t *)__get_free_pages(GFP_KERNEL|__GFP_REPEAT,
-@@ -93,6 +98,7 @@ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
- #define pmd_alloc_one(mm, addr) ({ BUG(); ((pmd_t *)2); })
- #define pmd_free(mm, x) do { } while (0)
- #define pgd_populate(mm, pmd, pte) BUG()
-+#define pgd_populate_kernel(mm, pmd, pte) BUG()
-
- #endif
-
-diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
-index a27d2e2..18fd845 100644
---- a/arch/parisc/include/asm/pgtable.h
-+++ b/arch/parisc/include/asm/pgtable.h
-@@ -207,6 +207,17 @@
- #define PAGE_EXECREAD __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
- #define PAGE_COPY PAGE_EXECREAD
- #define PAGE_RWX __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_ACCESSED)
-+# define PAGE_COPY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
-+# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
-+#else
-+# define PAGE_SHARED_NOEXEC PAGE_SHARED
-+# define PAGE_COPY_NOEXEC PAGE_COPY
-+# define PAGE_READONLY_NOEXEC PAGE_READONLY
-+#endif
-+
- #define PAGE_KERNEL __pgprot(_PAGE_KERNEL)
- #define PAGE_KERNEL_RO __pgprot(_PAGE_KERNEL & ~_PAGE_WRITE)
- #define PAGE_KERNEL_UNC __pgprot(_PAGE_KERNEL | _PAGE_NO_CACHE)
-diff --git a/arch/parisc/kernel/drivers.c b/arch/parisc/kernel/drivers.c
-index 994bcd9..f25247a 100644
---- a/arch/parisc/kernel/drivers.c
-+++ b/arch/parisc/kernel/drivers.c
-@@ -393,7 +393,7 @@ EXPORT_SYMBOL(print_pci_hwpath);
- static void setup_bus_id(struct parisc_device *padev)
- {
- struct hardware_path path;
-- char name[20];
-+ char name[28];
- char *output = name;
- int i;
-
-diff --git a/arch/parisc/kernel/module.c b/arch/parisc/kernel/module.c
-index 2120746..8d70a5e 100644
---- a/arch/parisc/kernel/module.c
-+++ b/arch/parisc/kernel/module.c
-@@ -95,16 +95,38 @@
-
- /* three functions to determine where in the module core
- * or init pieces the location is */
-+static inline int in_init_rx(struct module *me, void *loc)
-+{
-+ return (loc >= me->module_init_rx &&
-+ loc < (me->module_init_rx + me->init_size_rx));
-+}
-+
-+static inline int in_init_rw(struct module *me, void *loc)
-+{
-+ return (loc >= me->module_init_rw &&
-+ loc < (me->module_init_rw + me->init_size_rw));
-+}
-+
- static inline int in_init(struct module *me, void *loc)
- {
-- return (loc >= me->module_init &&
-- loc <= (me->module_init + me->init_size));
-+ return in_init_rx(me, loc) || in_init_rw(me, loc);
-+}
-+
-+static inline int in_core_rx(struct module *me, void *loc)
-+{
-+ return (loc >= me->module_core_rx &&
-+ loc < (me->module_core_rx + me->core_size_rx));
-+}
-+
-+static inline int in_core_rw(struct module *me, void *loc)
-+{
-+ return (loc >= me->module_core_rw &&
-+ loc < (me->module_core_rw + me->core_size_rw));
- }
-
- static inline int in_core(struct module *me, void *loc)
- {
-- return (loc >= me->module_core &&
-- loc <= (me->module_core + me->core_size));
-+ return in_core_rx(me, loc) || in_core_rw(me, loc);
- }
-
- static inline int in_local(struct module *me, void *loc)
-@@ -364,13 +386,13 @@ int module_frob_arch_sections(CONST Elf_Ehdr *hdr,
- }
-
- /* align things a bit */
-- me->core_size = ALIGN(me->core_size, 16);
-- me->arch.got_offset = me->core_size;
-- me->core_size += gots * sizeof(struct got_entry);
-+ me->core_size_rw = ALIGN(me->core_size_rw, 16);
-+ me->arch.got_offset = me->core_size_rw;
-+ me->core_size_rw += gots * sizeof(struct got_entry);
-
-- me->core_size = ALIGN(me->core_size, 16);
-- me->arch.fdesc_offset = me->core_size;
-- me->core_size += fdescs * sizeof(Elf_Fdesc);
-+ me->core_size_rw = ALIGN(me->core_size_rw, 16);
-+ me->arch.fdesc_offset = me->core_size_rw;
-+ me->core_size_rw += fdescs * sizeof(Elf_Fdesc);
-
- me->arch.got_max = gots;
- me->arch.fdesc_max = fdescs;
-@@ -388,7 +410,7 @@ static Elf64_Word get_got(struct module *me, unsigned long value, long addend)
-
- BUG_ON(value == 0);
-
-- got = me->module_core + me->arch.got_offset;
-+ got = me->module_core_rw + me->arch.got_offset;
- for (i = 0; got[i].addr; i++)
- if (got[i].addr == value)
- goto out;
-@@ -406,7 +428,7 @@ static Elf64_Word get_got(struct module *me, unsigned long value, long addend)
- #ifdef CONFIG_64BIT
- static Elf_Addr get_fdesc(struct module *me, unsigned long value)
- {
-- Elf_Fdesc *fdesc = me->module_core + me->arch.fdesc_offset;
-+ Elf_Fdesc *fdesc = me->module_core_rw + me->arch.fdesc_offset;
-
- if (!value) {
- printk(KERN_ERR "%s: zero OPD requested!\n", me->name);
-@@ -424,7 +446,7 @@ static Elf_Addr get_fdesc(struct module *me, unsigned long value)
-
- /* Create new one */
- fdesc->addr = value;
-- fdesc->gp = (Elf_Addr)me->module_core + me->arch.got_offset;
-+ fdesc->gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
- return (Elf_Addr)fdesc;
- }
- #endif /* CONFIG_64BIT */
-@@ -848,7 +870,7 @@ register_unwind_table(struct module *me,
-
- table = (unsigned char *)sechdrs[me->arch.unwind_section].sh_addr;
- end = table + sechdrs[me->arch.unwind_section].sh_size;
-- gp = (Elf_Addr)me->module_core + me->arch.got_offset;
-+ gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
-
- DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n",
- me->arch.unwind_section, table, end, gp);
-diff --git a/arch/parisc/kernel/setup.c b/arch/parisc/kernel/setup.c
-index cb71f3d..306f0c0 100644
---- a/arch/parisc/kernel/setup.c
-+++ b/arch/parisc/kernel/setup.c
-@@ -68,7 +68,8 @@ void __init setup_cmdline(char **cmdline_p)
- /* called from hpux boot loader */
- boot_command_line[0] = '\0';
- } else {
-- strcpy(boot_command_line, (char *)__va(boot_args[1]));
-+ strlcpy(boot_command_line, (char *)__va(boot_args[1]),
-+ COMMAND_LINE_SIZE);
-
- #ifdef CONFIG_BLK_DEV_INITRD
- if (boot_args[2] != 0) /* did palo pass us a ramdisk? */
-diff --git a/arch/parisc/kernel/sys_parisc.c b/arch/parisc/kernel/sys_parisc.c
-index 9147391..1c99b82 100644
---- a/arch/parisc/kernel/sys_parisc.c
-+++ b/arch/parisc/kernel/sys_parisc.c
-@@ -33,9 +33,11 @@
- #include <linux/utsname.h>
- #include <linux/personality.h>
-
--static unsigned long get_unshared_area(unsigned long addr, unsigned long len)
-+static unsigned long get_unshared_area(struct file *filp, unsigned long addr, unsigned long len,
-+ unsigned long flags)
- {
- struct vm_area_struct *vma;
-+ unsigned long offset = gr_rand_threadstack_offset(current->mm, filp, flags);
-
- addr = PAGE_ALIGN(addr);
-
-@@ -43,7 +45,7 @@ static unsigned long get_unshared_area(unsigned long addr, unsigned long len)
- /* At this point: (!vma || addr < vma->vm_end). */
- if (TASK_SIZE - len < addr)
- return -ENOMEM;
-- if (!vma || addr + len <= vma->vm_start)
-+ if (check_heap_stack_gap(vma, &addr, len, offset))
- return addr;
- addr = vma->vm_end;
- }
-@@ -67,11 +69,12 @@ static int get_offset(struct address_space *mapping)
- return offset & 0x3FF000;
- }
-
--static unsigned long get_shared_area(struct address_space *mapping,
-- unsigned long addr, unsigned long len, unsigned long pgoff)
-+static unsigned long get_shared_area(struct file *filp, struct address_space *mapping,
-+ unsigned long addr, unsigned long len, unsigned long pgoff, unsigned long flags)
- {
- struct vm_area_struct *vma;
- int offset = mapping ? get_offset(mapping) : 0;
-+ unsigned long rand_offset = gr_rand_threadstack_offset(current->mm, filp, flags);
-
- addr = DCACHE_ALIGN(addr - offset) + offset;
-
-@@ -79,7 +82,7 @@ static unsigned long get_shared_area(struct address_space *mapping,
- /* At this point: (!vma || addr < vma->vm_end). */
- if (TASK_SIZE - len < addr)
- return -ENOMEM;
-- if (!vma || addr + len <= vma->vm_start)
-+ if (check_heap_stack_gap(vma, &addr, len, rand_offset))
- return addr;
- addr = DCACHE_ALIGN(vma->vm_end - offset) + offset;
- if (addr < vma->vm_end) /* handle wraparound */
-@@ -98,14 +101,14 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
- if (flags & MAP_FIXED)
- return addr;
- if (!addr)
-- addr = TASK_UNMAPPED_BASE;
-+ addr = current->mm->mmap_base;
-
- if (filp) {
-- addr = get_shared_area(filp->f_mapping, addr, len, pgoff);
-+ addr = get_shared_area(filp, filp->f_mapping, addr, len, pgoff, flags);
- } else if(flags & MAP_SHARED) {
-- addr = get_shared_area(NULL, addr, len, pgoff);
-+ addr = get_shared_area(filp, NULL, addr, len, pgoff, flags);
- } else {
-- addr = get_unshared_area(addr, len);
-+ addr = get_unshared_area(filp, addr, len, flags);
- }
- return addr;
- }
-diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
-index 8b58bf0..7afff03 100644
---- a/arch/parisc/kernel/traps.c
-+++ b/arch/parisc/kernel/traps.c
-@@ -733,9 +733,7 @@ void notrace handle_interruption(int code, struct pt_regs *regs)
-
- down_read(¤t->mm->mmap_sem);
- vma = find_vma(current->mm,regs->iaoq[0]);
-- if (vma && (regs->iaoq[0] >= vma->vm_start)
-- && (vma->vm_flags & VM_EXEC)) {
--
-+ if (vma && (regs->iaoq[0] >= vma->vm_start)) {
- fault_address = regs->iaoq[0];
- fault_space = regs->iasq[0];
-
-diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
-index c6afbfc..c5839f6 100644
---- a/arch/parisc/mm/fault.c
-+++ b/arch/parisc/mm/fault.c
-@@ -15,6 +15,7 @@
- #include <linux/sched.h>
- #include <linux/interrupt.h>
- #include <linux/module.h>
-+#include <linux/unistd.h>
-
- #include <asm/uaccess.h>
- #include <asm/traps.h>
-@@ -52,7 +53,7 @@ DEFINE_PER_CPU(struct exception_data, exception_data);
- static unsigned long
- parisc_acctyp(unsigned long code, unsigned int inst)
- {
-- if (code == 6 || code == 16)
-+ if (code == 6 || code == 7 || code == 16)
- return VM_EXEC;
-
- switch (inst & 0xf0000000) {
-@@ -138,6 +139,116 @@ parisc_acctyp(unsigned long code, unsigned int inst)
- }
- #endif
-
-+#ifdef CONFIG_PAX_PAGEEXEC
-+/*
-+ * PaX: decide what to do with offenders (instruction_pointer(regs) = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ * 2 when rt_sigreturn trampoline was detected
-+ * 3 when unpatched PLT trampoline was detected
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+ int err;
-+
-+ do { /* PaX: unpatched PLT emulation */
-+ unsigned int bl, depwi;
-+
-+ err = get_user(bl, (unsigned int *)instruction_pointer(regs));
-+ err |= get_user(depwi, (unsigned int *)(instruction_pointer(regs)+4));
-+
-+ if (err)
-+ break;
-+
-+ if (bl == 0xEA9F1FDDU && depwi == 0xD6801C1EU) {
-+ unsigned int ldw, bv, ldw2, addr = instruction_pointer(regs)-12;
-+
-+ err = get_user(ldw, (unsigned int *)addr);
-+ err |= get_user(bv, (unsigned int *)(addr+4));
-+ err |= get_user(ldw2, (unsigned int *)(addr+8));
-+
-+ if (err)
-+ break;
-+
-+ if (ldw == 0x0E801096U &&
-+ bv == 0xEAC0C000U &&
-+ ldw2 == 0x0E881095U)
-+ {
-+ unsigned int resolver, map;
-+
-+ err = get_user(resolver, (unsigned int *)(instruction_pointer(regs)+8));
-+ err |= get_user(map, (unsigned int *)(instruction_pointer(regs)+12));
-+ if (err)
-+ break;
-+
-+ regs->gr[20] = instruction_pointer(regs)+8;
-+ regs->gr[21] = map;
-+ regs->gr[22] = resolver;
-+ regs->iaoq[0] = resolver | 3UL;
-+ regs->iaoq[1] = regs->iaoq[0] + 4;
-+ return 3;
-+ }
-+ }
-+ } while (0);
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+
-+#ifndef CONFIG_PAX_EMUSIGRT
-+ if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
-+ return 1;
-+#endif
-+
-+ do { /* PaX: rt_sigreturn emulation */
-+ unsigned int ldi1, ldi2, bel, nop;
-+
-+ err = get_user(ldi1, (unsigned int *)instruction_pointer(regs));
-+ err |= get_user(ldi2, (unsigned int *)(instruction_pointer(regs)+4));
-+ err |= get_user(bel, (unsigned int *)(instruction_pointer(regs)+8));
-+ err |= get_user(nop, (unsigned int *)(instruction_pointer(regs)+12));
-+
-+ if (err)
-+ break;
-+
-+ if ((ldi1 == 0x34190000U || ldi1 == 0x34190002U) &&
-+ ldi2 == 0x3414015AU &&
-+ bel == 0xE4008200U &&
-+ nop == 0x08000240U)
-+ {
-+ regs->gr[25] = (ldi1 & 2) >> 1;
-+ regs->gr[20] = __NR_rt_sigreturn;
-+ regs->gr[31] = regs->iaoq[1] + 16;
-+ regs->sr[0] = regs->iasq[1];
-+ regs->iaoq[0] = 0x100UL;
-+ regs->iaoq[1] = regs->iaoq[0] + 4;
-+ regs->iasq[0] = regs->sr[2];
-+ regs->iasq[1] = regs->sr[2];
-+ return 2;
-+ }
-+ } while (0);
-+#endif
-+
-+ return 1;
-+}
-+
-+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
-+{
-+ unsigned long i;
-+
-+ printk(KERN_ERR "PAX: bytes at PC: ");
-+ for (i = 0; i < 5; i++) {
-+ unsigned int c;
-+ if (get_user(c, (unsigned int *)pc+i))
-+ printk(KERN_CONT "???????? ");
-+ else
-+ printk(KERN_CONT "%08x ", c);
-+ }
-+ printk("\n");
-+}
-+#endif
-+
- int fixup_exception(struct pt_regs *regs)
- {
- const struct exception_table_entry *fix;
-@@ -192,8 +303,33 @@ good_area:
-
- acc_type = parisc_acctyp(code,regs->iir);
-
-- if ((vma->vm_flags & acc_type) != acc_type)
-+ if ((vma->vm_flags & acc_type) != acc_type) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && (acc_type & VM_EXEC) &&
-+ (address & ~3UL) == instruction_pointer(regs))
-+ {
-+ up_read(&mm->mmap_sem);
-+ switch (pax_handle_fetch_fault(regs)) {
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+ case 3:
-+ return;
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+ case 2:
-+ return;
-+#endif
-+
-+ }
-+ pax_report_fault(regs, (void *)instruction_pointer(regs), (void *)regs->gr[30]);
-+ do_group_exit(SIGKILL);
-+ }
-+#endif
-+
- goto bad_area;
-+ }
-
- /*
- * If for any reason at all we couldn't handle the fault, make
-diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
-index c107b74..409dc0f 100644
---- a/arch/powerpc/Makefile
-+++ b/arch/powerpc/Makefile
-@@ -74,6 +74,8 @@ KBUILD_AFLAGS += -Iarch/$(ARCH)
- KBUILD_CFLAGS += -msoft-float -pipe -Iarch/$(ARCH) $(CFLAGS-y)
- CPP = $(CC) -E $(KBUILD_CFLAGS)
-
-+cflags-y += -Wno-sign-compare -Wno-extra
-+
- CHECKFLAGS += -m$(CONFIG_WORD_SIZE) -D__powerpc__ -D__powerpc$(CONFIG_WORD_SIZE)__
-
- ifeq ($(CONFIG_PPC64),y)
-diff --git a/arch/powerpc/include/asm/cache.h b/arch/powerpc/include/asm/cache.h
-index 81de6eb..d5d0e24 100644
---- a/arch/powerpc/include/asm/cache.h
-+++ b/arch/powerpc/include/asm/cache.h
-@@ -3,6 +3,7 @@
-
- #ifdef __KERNEL__
-
-+#include <linux/const.h>
-
- /* bytes per L1 cache line */
- #if defined(CONFIG_8xx) || defined(CONFIG_403GCX)
-@@ -18,7 +19,7 @@
- #define L1_CACHE_SHIFT 7
- #endif
-
--#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-
- #define SMP_CACHE_BYTES L1_CACHE_BYTES
-
-diff --git a/arch/powerpc/include/asm/device.h b/arch/powerpc/include/asm/device.h
-index 6d94d27..50d4cad 100644
---- a/arch/powerpc/include/asm/device.h
-+++ b/arch/powerpc/include/asm/device.h
-@@ -14,7 +14,7 @@ struct dev_archdata {
- struct device_node *of_node;
-
- /* DMA operations on that device */
-- struct dma_map_ops *dma_ops;
-+ const struct dma_map_ops *dma_ops;
-
- /*
- * When an iommu is in use, dma_data is used as a ptr to the base of the
-diff --git a/arch/powerpc/include/asm/dma-mapping.h b/arch/powerpc/include/asm/dma-mapping.h
-index e281dae..2b8a784 100644
---- a/arch/powerpc/include/asm/dma-mapping.h
-+++ b/arch/powerpc/include/asm/dma-mapping.h
-@@ -69,9 +69,9 @@ static inline unsigned long device_to_mask(struct device *dev)
- #ifdef CONFIG_PPC64
- extern struct dma_map_ops dma_iommu_ops;
- #endif
--extern struct dma_map_ops dma_direct_ops;
-+extern const struct dma_map_ops dma_direct_ops;
-
--static inline struct dma_map_ops *get_dma_ops(struct device *dev)
-+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
- {
- /* We don't handle the NULL dev case for ISA for now. We could
- * do it via an out of line call but it is not needed for now. The
-@@ -84,7 +84,7 @@ static inline struct dma_map_ops *get_dma_ops(struct device *dev)
- return dev->archdata.dma_ops;
- }
-
--static inline void set_dma_ops(struct device *dev, struct dma_map_ops *ops)
-+static inline void set_dma_ops(struct device *dev, const struct dma_map_ops *ops)
- {
- dev->archdata.dma_ops = ops;
- }
-@@ -118,7 +118,7 @@ static inline void set_dma_offset(struct device *dev, dma_addr_t off)
-
- static inline int dma_supported(struct device *dev, u64 mask)
- {
-- struct dma_map_ops *dma_ops = get_dma_ops(dev);
-+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
-
- if (unlikely(dma_ops == NULL))
- return 0;
-@@ -132,7 +132,7 @@ static inline int dma_supported(struct device *dev, u64 mask)
-
- static inline int dma_set_mask(struct device *dev, u64 dma_mask)
- {
-- struct dma_map_ops *dma_ops = get_dma_ops(dev);
-+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
-
- if (unlikely(dma_ops == NULL))
- return -EIO;
-@@ -147,7 +147,7 @@ static inline int dma_set_mask(struct device *dev, u64 dma_mask)
- static inline void *dma_alloc_coherent(struct device *dev, size_t size,
- dma_addr_t *dma_handle, gfp_t flag)
- {
-- struct dma_map_ops *dma_ops = get_dma_ops(dev);
-+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
- void *cpu_addr;
-
- BUG_ON(!dma_ops);
-@@ -162,7 +162,7 @@ static inline void *dma_alloc_coherent(struct device *dev, size_t size,
- static inline void dma_free_coherent(struct device *dev, size_t size,
- void *cpu_addr, dma_addr_t dma_handle)
- {
-- struct dma_map_ops *dma_ops = get_dma_ops(dev);
-+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
-
- BUG_ON(!dma_ops);
-
-@@ -173,7 +173,7 @@ static inline void dma_free_coherent(struct device *dev, size_t size,
-
- static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
- {
-- struct dma_map_ops *dma_ops = get_dma_ops(dev);
-+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
-
- if (dma_ops->mapping_error)
- return dma_ops->mapping_error(dev, dma_addr);
-diff --git a/arch/powerpc/include/asm/elf.h b/arch/powerpc/include/asm/elf.h
-index 5698502..5db093c 100644
---- a/arch/powerpc/include/asm/elf.h
-+++ b/arch/powerpc/include/asm/elf.h
-@@ -179,8 +179,19 @@ typedef elf_fpreg_t elf_vsrreghalf_t32[ELF_NVSRHALFREG];
- the loader. We need to make sure that it is out of the way of the program
- that it will "exec", and that there is sufficient room for the brk. */
-
--extern unsigned long randomize_et_dyn(unsigned long base);
--#define ELF_ET_DYN_BASE (randomize_et_dyn(0x20000000))
-+#define ELF_ET_DYN_BASE (0x20000000)
-+
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE (0x10000000UL)
-+
-+#ifdef __powerpc64__
-+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT) ? 16 : 28)
-+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT) ? 16 : 28)
-+#else
-+#define PAX_DELTA_MMAP_LEN 15
-+#define PAX_DELTA_STACK_LEN 15
-+#endif
-+#endif
-
- /*
- * Our registers are always unsigned longs, whether we're a 32 bit
-@@ -275,9 +286,6 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
- (0x7ff >> (PAGE_SHIFT - 12)) : \
- (0x3ffff >> (PAGE_SHIFT - 12)))
-
--extern unsigned long arch_randomize_brk(struct mm_struct *mm);
--#define arch_randomize_brk arch_randomize_brk
--
- #endif /* __KERNEL__ */
-
- /*
-diff --git a/arch/powerpc/include/asm/iommu.h b/arch/powerpc/include/asm/iommu.h
-index edfc980..1766f59 100644
---- a/arch/powerpc/include/asm/iommu.h
-+++ b/arch/powerpc/include/asm/iommu.h
-@@ -116,6 +116,9 @@ extern void iommu_init_early_iSeries(void);
- extern void iommu_init_early_dart(void);
- extern void iommu_init_early_pasemi(void);
-
-+/* dma-iommu.c */
-+extern int dma_iommu_dma_supported(struct device *dev, u64 mask);
-+
- #ifdef CONFIG_PCI
- extern void pci_iommu_init(void);
- extern void pci_direct_iommu_init(void);
-diff --git a/arch/powerpc/include/asm/kmap_types.h b/arch/powerpc/include/asm/kmap_types.h
-index 9163695..5a00112 100644
---- a/arch/powerpc/include/asm/kmap_types.h
-+++ b/arch/powerpc/include/asm/kmap_types.h
-@@ -26,6 +26,7 @@ enum km_type {
- KM_SOFTIRQ1,
- KM_PPC_SYNC_PAGE,
- KM_PPC_SYNC_ICACHE,
-+ KM_CLEARPAGE,
- KM_TYPE_NR
- };
-
-diff --git a/arch/powerpc/include/asm/page.h b/arch/powerpc/include/asm/page.h
-index ff24254..fe45b21 100644
---- a/arch/powerpc/include/asm/page.h
-+++ b/arch/powerpc/include/asm/page.h
-@@ -116,8 +116,9 @@ extern phys_addr_t kernstart_addr;
- * and needs to be executable. This means the whole heap ends
- * up being executable.
- */
--#define VM_DATA_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
-- VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-+#define VM_DATA_DEFAULT_FLAGS32 \
-+ (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
-+ VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-
- #define VM_DATA_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
- VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-@@ -145,6 +146,9 @@ extern phys_addr_t kernstart_addr;
- #define is_kernel_addr(x) ((x) >= PAGE_OFFSET)
- #endif
-
-+#define ktla_ktva(addr) (addr)
-+#define ktva_ktla(addr) (addr)
-+
- #ifndef __ASSEMBLY__
-
- #undef STRICT_MM_TYPECHECKS
-diff --git a/arch/powerpc/include/asm/page_64.h b/arch/powerpc/include/asm/page_64.h
-index 3f17b83..1f9e766 100644
---- a/arch/powerpc/include/asm/page_64.h
-+++ b/arch/powerpc/include/asm/page_64.h
-@@ -180,15 +180,18 @@ do { \
- * stack by default, so in the absense of a PT_GNU_STACK program header
- * we turn execute permission off.
- */
--#define VM_STACK_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
-- VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-+#define VM_STACK_DEFAULT_FLAGS32 \
-+ (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
-+ VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-
- #define VM_STACK_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
- VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-
-+#ifndef CONFIG_PAX_PAGEEXEC
- #define VM_STACK_DEFAULT_FLAGS \
- (test_thread_flag(TIF_32BIT) ? \
- VM_STACK_DEFAULT_FLAGS32 : VM_STACK_DEFAULT_FLAGS64)
-+#endif
-
- #include <asm-generic/getorder.h>
-
-diff --git a/arch/powerpc/include/asm/pci.h b/arch/powerpc/include/asm/pci.h
-index b5ea626..40308222 100644
---- a/arch/powerpc/include/asm/pci.h
-+++ b/arch/powerpc/include/asm/pci.h
-@@ -65,8 +65,8 @@ static inline int pci_get_legacy_ide_irq(struct pci_dev *dev, int channel)
- }
-
- #ifdef CONFIG_PCI
--extern void set_pci_dma_ops(struct dma_map_ops *dma_ops);
--extern struct dma_map_ops *get_pci_dma_ops(void);
-+extern void set_pci_dma_ops(const struct dma_map_ops *dma_ops);
-+extern const struct dma_map_ops *get_pci_dma_ops(void);
- #else /* CONFIG_PCI */
- #define set_pci_dma_ops(d)
- #define get_pci_dma_ops() NULL
-diff --git a/arch/powerpc/include/asm/pgalloc-64.h b/arch/powerpc/include/asm/pgalloc-64.h
-index e6f069c..6c7a1f8 100644
---- a/arch/powerpc/include/asm/pgalloc-64.h
-+++ b/arch/powerpc/include/asm/pgalloc-64.h
-@@ -37,6 +37,7 @@ static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
- #ifndef CONFIG_PPC_64K_PAGES
-
- #define pgd_populate(MM, PGD, PUD) pgd_set(PGD, PUD)
-+#define pgd_populate_kernel(MM, PGD, PUD) pgd_populate((MM), (PGD), (PUD))
-
- static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr)
- {
-@@ -54,6 +55,11 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
- pud_set(pud, (unsigned long)pmd);
- }
-
-+static inline void pud_populate_kernel(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
-+{
-+ pud_populate(mm, pud, pmd);
-+}
-+
- #define pmd_populate(mm, pmd, pte_page) \
- pmd_populate_kernel(mm, pmd, page_address(pte_page))
- #define pmd_populate_kernel(mm, pmd, pte) pmd_set(pmd, (unsigned long)(pte))
-@@ -63,6 +69,7 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
- #else /* CONFIG_PPC_64K_PAGES */
-
- #define pud_populate(mm, pud, pmd) pud_set(pud, (unsigned long)pmd)
-+#define pud_populate_kernel(mm, pud, pmd) pud_populate((mm), (pud), (pmd))
-
- static inline void pmd_populate_kernel(struct mm_struct *mm, pmd_t *pmd,
- pte_t *pte)
-diff --git a/arch/powerpc/include/asm/pgtable.h b/arch/powerpc/include/asm/pgtable.h
-index 2a5da06..d65bea2 100644
---- a/arch/powerpc/include/asm/pgtable.h
-+++ b/arch/powerpc/include/asm/pgtable.h
-@@ -2,6 +2,7 @@
- #define _ASM_POWERPC_PGTABLE_H
- #ifdef __KERNEL__
-
-+#include <linux/const.h>
- #ifndef __ASSEMBLY__
- #include <asm/processor.h> /* For TASK_SIZE */
- #include <asm/mmu.h>
-diff --git a/arch/powerpc/include/asm/pte-hash32.h b/arch/powerpc/include/asm/pte-hash32.h
-index 4aad413..85d86bf 100644
---- a/arch/powerpc/include/asm/pte-hash32.h
-+++ b/arch/powerpc/include/asm/pte-hash32.h
-@@ -21,6 +21,7 @@
- #define _PAGE_FILE 0x004 /* when !present: nonlinear file mapping */
- #define _PAGE_USER 0x004 /* usermode access allowed */
- #define _PAGE_GUARDED 0x008 /* G: prohibit speculative access */
-+#define _PAGE_EXEC _PAGE_GUARDED
- #define _PAGE_COHERENT 0x010 /* M: enforce memory coherence (SMP systems) */
- #define _PAGE_NO_CACHE 0x020 /* I: cache inhibit */
- #define _PAGE_WRITETHRU 0x040 /* W: cache write-through */
-diff --git a/arch/powerpc/include/asm/ptrace.h b/arch/powerpc/include/asm/ptrace.h
-index 8c34149..78f425a 100644
---- a/arch/powerpc/include/asm/ptrace.h
-+++ b/arch/powerpc/include/asm/ptrace.h
-@@ -103,7 +103,7 @@ extern unsigned long profile_pc(struct pt_regs *regs);
- } while(0)
-
- struct task_struct;
--extern unsigned long ptrace_get_reg(struct task_struct *task, int regno);
-+extern unsigned long ptrace_get_reg(struct task_struct *task, unsigned int regno);
- extern int ptrace_put_reg(struct task_struct *task, int regno,
- unsigned long data);
-
-diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
-index 6ce44dd..e054dcc 100644
---- a/arch/powerpc/include/asm/reg.h
-+++ b/arch/powerpc/include/asm/reg.h
-@@ -191,6 +191,7 @@
- #define SPRN_DBCR 0x136 /* e300 Data Breakpoint Control Reg */
- #define SPRN_DSISR 0x012 /* Data Storage Interrupt Status Register */
- #define DSISR_NOHPTE 0x40000000 /* no translation found */
-+#define DSISR_GUARDED 0x10000000 /* fetch from guarded storage */
- #define DSISR_PROTFAULT 0x08000000 /* protection fault */
- #define DSISR_ISSTORE 0x02000000 /* access was a store */
- #define DSISR_DABRMATCH 0x00400000 /* hit data breakpoint */
-diff --git a/arch/powerpc/include/asm/swiotlb.h b/arch/powerpc/include/asm/swiotlb.h
-index 8979d4c..d2fd0d3 100644
---- a/arch/powerpc/include/asm/swiotlb.h
-+++ b/arch/powerpc/include/asm/swiotlb.h
-@@ -13,7 +13,7 @@
-
- #include <linux/swiotlb.h>
-
--extern struct dma_map_ops swiotlb_dma_ops;
-+extern const struct dma_map_ops swiotlb_dma_ops;
-
- static inline void dma_mark_clean(void *addr, size_t size) {}
-
-diff --git a/arch/powerpc/include/asm/system.h b/arch/powerpc/include/asm/system.h
-index 094a12a..877a60a 100644
---- a/arch/powerpc/include/asm/system.h
-+++ b/arch/powerpc/include/asm/system.h
-@@ -531,7 +531,7 @@ __cmpxchg_local(volatile void *ptr, unsigned long old, unsigned long new,
- #define cmpxchg64_local(ptr, o, n) __cmpxchg64_local_generic((ptr), (o), (n))
- #endif
-
--extern unsigned long arch_align_stack(unsigned long sp);
-+#define arch_align_stack(x) ((x) & ~0xfUL)
-
- /* Used in very early kernel initialization. */
- extern unsigned long reloc_offset(void);
-diff --git a/arch/powerpc/include/asm/thread_info.h b/arch/powerpc/include/asm/thread_info.h
-index aa9d383..0380a05 100644
---- a/arch/powerpc/include/asm/thread_info.h
-+++ b/arch/powerpc/include/asm/thread_info.h
-@@ -110,7 +110,9 @@ static inline struct thread_info *current_thread_info(void)
- #define TIF_NOERROR 12 /* Force successful syscall return */
- #define TIF_NOTIFY_RESUME 13 /* callback before returning to user */
- #define TIF_FREEZE 14 /* Freezing for suspend */
--#define TIF_RUNLATCH 15 /* Is the runlatch enabled? */
-+/* mask must be expressable within 16 bits to satisfy 'andi' instruction reqs */
-+#define TIF_GRSEC_SETXID 15 /* update credentials on syscall entry/exit */
-+#define TIF_RUNLATCH 16 /* Is the runlatch enabled? */
-
- /* as above, but as bit values */
- #define _TIF_SYSCALL_TRACE (1<<TIF_SYSCALL_TRACE)
-@@ -128,7 +130,10 @@ static inline struct thread_info *current_thread_info(void)
- #define _TIF_NOTIFY_RESUME (1<<TIF_NOTIFY_RESUME)
- #define _TIF_FREEZE (1<<TIF_FREEZE)
- #define _TIF_RUNLATCH (1<<TIF_RUNLATCH)
--#define _TIF_SYSCALL_T_OR_A (_TIF_SYSCALL_TRACE|_TIF_SYSCALL_AUDIT|_TIF_SECCOMP)
-+#define _TIF_GRSEC_SETXID (1<<TIF_GRSEC_SETXID)
-+
-+#define _TIF_SYSCALL_T_OR_A (_TIF_SYSCALL_TRACE|_TIF_SYSCALL_AUDIT| \
-+ _TIF_SECCOMP|_TIF_GRSEC_SETXID)
-
- #define _TIF_USER_WORK_MASK (_TIF_SIGPENDING | _TIF_NEED_RESCHED | \
- _TIF_NOTIFY_RESUME)
-diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
-index bd0fb84..1f2d065 100644
---- a/arch/powerpc/include/asm/uaccess.h
-+++ b/arch/powerpc/include/asm/uaccess.h
-@@ -327,52 +327,6 @@ do { \
- extern unsigned long __copy_tofrom_user(void __user *to,
- const void __user *from, unsigned long size);
-
--#ifndef __powerpc64__
--
--static inline unsigned long copy_from_user(void *to,
-- const void __user *from, unsigned long n)
--{
-- unsigned long over;
--
-- if (access_ok(VERIFY_READ, from, n))
-- return __copy_tofrom_user((__force void __user *)to, from, n);
-- if ((unsigned long)from < TASK_SIZE) {
-- over = (unsigned long)from + n - TASK_SIZE;
-- return __copy_tofrom_user((__force void __user *)to, from,
-- n - over) + over;
-- }
-- return n;
--}
--
--static inline unsigned long copy_to_user(void __user *to,
-- const void *from, unsigned long n)
--{
-- unsigned long over;
--
-- if (access_ok(VERIFY_WRITE, to, n))
-- return __copy_tofrom_user(to, (__force void __user *)from, n);
-- if ((unsigned long)to < TASK_SIZE) {
-- over = (unsigned long)to + n - TASK_SIZE;
-- return __copy_tofrom_user(to, (__force void __user *)from,
-- n - over) + over;
-- }
-- return n;
--}
--
--#else /* __powerpc64__ */
--
--#define __copy_in_user(to, from, size) \
-- __copy_tofrom_user((to), (from), (size))
--
--extern unsigned long copy_from_user(void *to, const void __user *from,
-- unsigned long n);
--extern unsigned long copy_to_user(void __user *to, const void *from,
-- unsigned long n);
--extern unsigned long copy_in_user(void __user *to, const void __user *from,
-- unsigned long n);
--
--#endif /* __powerpc64__ */
--
- static inline unsigned long __copy_from_user_inatomic(void *to,
- const void __user *from, unsigned long n)
- {
-@@ -396,6 +350,10 @@ static inline unsigned long __copy_from_user_inatomic(void *to,
- if (ret == 0)
- return 0;
- }
-+
-+ if (!__builtin_constant_p(n))
-+ check_object_size(to, n, false);
-+
- return __copy_tofrom_user((__force void __user *)to, from, n);
- }
-
-@@ -422,6 +380,10 @@ static inline unsigned long __copy_to_user_inatomic(void __user *to,
- if (ret == 0)
- return 0;
- }
-+
-+ if (!__builtin_constant_p(n))
-+ check_object_size(from, n, true);
-+
- return __copy_tofrom_user(to, (__force const void __user *)from, n);
- }
-
-@@ -439,6 +401,92 @@ static inline unsigned long __copy_to_user(void __user *to,
- return __copy_to_user_inatomic(to, from, size);
- }
-
-+#ifndef __powerpc64__
-+
-+static inline unsigned long __must_check copy_from_user(void *to,
-+ const void __user *from, unsigned long n)
-+{
-+ unsigned long over;
-+
-+ if ((long)n < 0)
-+ return n;
-+
-+ if (access_ok(VERIFY_READ, from, n)) {
-+ if (!__builtin_constant_p(n))
-+ check_object_size(to, n, false);
-+ return __copy_tofrom_user((__force void __user *)to, from, n);
-+ }
-+ if ((unsigned long)from < TASK_SIZE) {
-+ over = (unsigned long)from + n - TASK_SIZE;
-+ if (!__builtin_constant_p(n - over))
-+ check_object_size(to, n - over, false);
-+ return __copy_tofrom_user((__force void __user *)to, from,
-+ n - over) + over;
-+ }
-+ return n;
-+}
-+
-+static inline unsigned long __must_check copy_to_user(void __user *to,
-+ const void *from, unsigned long n)
-+{
-+ unsigned long over;
-+
-+ if ((long)n < 0)
-+ return n;
-+
-+ if (access_ok(VERIFY_WRITE, to, n)) {
-+ if (!__builtin_constant_p(n))
-+ check_object_size(from, n, true);
-+ return __copy_tofrom_user(to, (__force void __user *)from, n);
-+ }
-+ if ((unsigned long)to < TASK_SIZE) {
-+ over = (unsigned long)to + n - TASK_SIZE;
-+ if (!__builtin_constant_p(n))
-+ check_object_size(from, n - over, true);
-+ return __copy_tofrom_user(to, (__force void __user *)from,
-+ n - over) + over;
-+ }
-+ return n;
-+}
-+
-+#else /* __powerpc64__ */
-+
-+#define __copy_in_user(to, from, size) \
-+ __copy_tofrom_user((to), (from), (size))
-+
-+static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
-+{
-+ if ((long)n < 0 || n > INT_MAX)
-+ return n;
-+
-+ if (!__builtin_constant_p(n))
-+ check_object_size(to, n, false);
-+
-+ if (likely(access_ok(VERIFY_READ, from, n)))
-+ n = __copy_from_user(to, from, n);
-+ else
-+ memset(to, 0, n);
-+ return n;
-+}
-+
-+static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
-+{
-+ if ((long)n < 0 || n > INT_MAX)
-+ return n;
-+
-+ if (likely(access_ok(VERIFY_WRITE, to, n))) {
-+ if (!__builtin_constant_p(n))
-+ check_object_size(from, n, true);
-+ n = __copy_to_user(to, from, n);
-+ }
-+ return n;
-+}
-+
-+extern unsigned long copy_in_user(void __user *to, const void __user *from,
-+ unsigned long n);
-+
-+#endif /* __powerpc64__ */
-+
- extern unsigned long __clear_user(void __user *addr, unsigned long size);
-
- static inline unsigned long clear_user(void __user *addr, unsigned long size)
-diff --git a/arch/powerpc/kernel/cacheinfo.c b/arch/powerpc/kernel/cacheinfo.c
-index bb37b1d..01fe9ce 100644
---- a/arch/powerpc/kernel/cacheinfo.c
-+++ b/arch/powerpc/kernel/cacheinfo.c
-@@ -642,7 +642,7 @@ static struct kobj_attribute *cache_index_opt_attrs[] = {
- &cache_assoc_attr,
- };
-
--static struct sysfs_ops cache_index_ops = {
-+static const struct sysfs_ops cache_index_ops = {
- .show = cache_index_show,
- };
-
-diff --git a/arch/powerpc/kernel/dma-iommu.c b/arch/powerpc/kernel/dma-iommu.c
-index 37771a5..648530c 100644
---- a/arch/powerpc/kernel/dma-iommu.c
-+++ b/arch/powerpc/kernel/dma-iommu.c
-@@ -70,7 +70,7 @@ static void dma_iommu_unmap_sg(struct device *dev, struct scatterlist *sglist,
- }
-
- /* We support DMA to/from any memory page via the iommu */
--static int dma_iommu_dma_supported(struct device *dev, u64 mask)
-+int dma_iommu_dma_supported(struct device *dev, u64 mask)
- {
- struct iommu_table *tbl = get_iommu_table_base(dev);
-
-diff --git a/arch/powerpc/kernel/dma-swiotlb.c b/arch/powerpc/kernel/dma-swiotlb.c
-index e96cbbd..bdd6d41 100644
---- a/arch/powerpc/kernel/dma-swiotlb.c
-+++ b/arch/powerpc/kernel/dma-swiotlb.c
-@@ -31,7 +31,7 @@ unsigned int ppc_swiotlb_enable;
- * map_page, and unmap_page on highmem, use normal dma_ops
- * for everything else.
- */
--struct dma_map_ops swiotlb_dma_ops = {
-+const struct dma_map_ops swiotlb_dma_ops = {
- .alloc_coherent = dma_direct_alloc_coherent,
- .free_coherent = dma_direct_free_coherent,
- .map_sg = swiotlb_map_sg_attrs,
-diff --git a/arch/powerpc/kernel/dma.c b/arch/powerpc/kernel/dma.c
-index 6215062..ebea59c 100644
---- a/arch/powerpc/kernel/dma.c
-+++ b/arch/powerpc/kernel/dma.c
-@@ -134,7 +134,7 @@ static inline void dma_direct_sync_single_range(struct device *dev,
- }
- #endif
-
--struct dma_map_ops dma_direct_ops = {
-+const struct dma_map_ops dma_direct_ops = {
- .alloc_coherent = dma_direct_alloc_coherent,
- .free_coherent = dma_direct_free_coherent,
- .map_sg = dma_direct_map_sg,
-diff --git a/arch/powerpc/kernel/exceptions-64e.S b/arch/powerpc/kernel/exceptions-64e.S
-index 24dcc0e..a300455 100644
---- a/arch/powerpc/kernel/exceptions-64e.S
-+++ b/arch/powerpc/kernel/exceptions-64e.S
-@@ -455,6 +455,7 @@ storage_fault_common:
- std r14,_DAR(r1)
- std r15,_DSISR(r1)
- addi r3,r1,STACK_FRAME_OVERHEAD
-+ bl .save_nvgprs
- mr r4,r14
- mr r5,r15
- ld r14,PACA_EXGEN+EX_R14(r13)
-@@ -464,8 +465,7 @@ storage_fault_common:
- cmpdi r3,0
- bne- 1f
- b .ret_from_except_lite
--1: bl .save_nvgprs
-- mr r5,r3
-+1: mr r5,r3
- addi r3,r1,STACK_FRAME_OVERHEAD
- ld r4,_DAR(r1)
- bl .bad_page_fault
-diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
-index 1808876..9fd206a 100644
---- a/arch/powerpc/kernel/exceptions-64s.S
-+++ b/arch/powerpc/kernel/exceptions-64s.S
-@@ -818,10 +818,10 @@ handle_page_fault:
- 11: ld r4,_DAR(r1)
- ld r5,_DSISR(r1)
- addi r3,r1,STACK_FRAME_OVERHEAD
-+ bl .save_nvgprs
- bl .do_page_fault
- cmpdi r3,0
- beq+ 13f
-- bl .save_nvgprs
- mr r5,r3
- addi r3,r1,STACK_FRAME_OVERHEAD
- lwz r4,_DAR(r1)
-diff --git a/arch/powerpc/kernel/ibmebus.c b/arch/powerpc/kernel/ibmebus.c
-index a4c8b38..1b09ad9 100644
---- a/arch/powerpc/kernel/ibmebus.c
-+++ b/arch/powerpc/kernel/ibmebus.c
-@@ -127,7 +127,7 @@ static int ibmebus_dma_supported(struct device *dev, u64 mask)
- return 1;
- }
-
--static struct dma_map_ops ibmebus_dma_ops = {
-+static const struct dma_map_ops ibmebus_dma_ops = {
- .alloc_coherent = ibmebus_alloc_coherent,
- .free_coherent = ibmebus_free_coherent,
- .map_sg = ibmebus_map_sg,
-diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
-index 8564a41..67f3471 100644
---- a/arch/powerpc/kernel/irq.c
-+++ b/arch/powerpc/kernel/irq.c
-@@ -490,9 +490,6 @@ struct irq_host *irq_alloc_host(struct device_node *of_node,
- host->ops = ops;
- host->of_node = of_node_get(of_node);
-
-- if (host->ops->match == NULL)
-- host->ops->match = default_irq_host_match;
--
- spin_lock_irqsave(&irq_big_lock, flags);
-
- /* If it's a legacy controller, check for duplicates and
-@@ -567,7 +564,12 @@ struct irq_host *irq_find_host(struct device_node *node)
- */
- spin_lock_irqsave(&irq_big_lock, flags);
- list_for_each_entry(h, &irq_hosts, link)
-- if (h->ops->match(h, node)) {
-+ if (h->ops->match) {
-+ if (h->ops->match(h, node)) {
-+ found = h;
-+ break;
-+ }
-+ } else if (default_irq_host_match(h, node)) {
- found = h;
- break;
- }
-diff --git a/arch/powerpc/kernel/kgdb.c b/arch/powerpc/kernel/kgdb.c
-index 641c74b..8339ad7 100644
---- a/arch/powerpc/kernel/kgdb.c
-+++ b/arch/powerpc/kernel/kgdb.c
-@@ -126,7 +126,7 @@ static int kgdb_handle_breakpoint(struct pt_regs *regs)
- if (kgdb_handle_exception(0, SIGTRAP, 0, regs) != 0)
- return 0;
-
-- if (*(u32 *) (regs->nip) == *(u32 *) (&arch_kgdb_ops.gdb_bpt_instr))
-+ if (*(u32 *) (regs->nip) == *(const u32 *) (&arch_kgdb_ops.gdb_bpt_instr))
- regs->nip += 4;
-
- return 1;
-@@ -353,7 +353,7 @@ int kgdb_arch_handle_exception(int vector, int signo, int err_code,
- /*
- * Global data
- */
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- .gdb_bpt_instr = {0x7d, 0x82, 0x10, 0x08},
- };
-
-diff --git a/arch/powerpc/kernel/module.c b/arch/powerpc/kernel/module.c
-index 477c663..4f50234 100644
---- a/arch/powerpc/kernel/module.c
-+++ b/arch/powerpc/kernel/module.c
-@@ -31,11 +31,24 @@
-
- LIST_HEAD(module_bug_list);
-
-+#ifdef CONFIG_PAX_KERNEXEC
- void *module_alloc(unsigned long size)
- {
- if (size == 0)
- return NULL;
-
-+ return vmalloc(size);
-+}
-+
-+void *module_alloc_exec(unsigned long size)
-+#else
-+void *module_alloc(unsigned long size)
-+#endif
-+
-+{
-+ if (size == 0)
-+ return NULL;
-+
- return vmalloc_exec(size);
- }
-
-@@ -45,6 +58,13 @@ void module_free(struct module *mod, void *module_region)
- vfree(module_region);
- }
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+void module_free_exec(struct module *mod, void *module_region)
-+{
-+ module_free(mod, module_region);
-+}
-+#endif
-+
- static const Elf_Shdr *find_section(const Elf_Ehdr *hdr,
- const Elf_Shdr *sechdrs,
- const char *name)
-diff --git a/arch/powerpc/kernel/module_32.c b/arch/powerpc/kernel/module_32.c
-index 449a7e0..5cb1140 100644
---- a/arch/powerpc/kernel/module_32.c
-+++ b/arch/powerpc/kernel/module_32.c
-@@ -162,7 +162,7 @@ int module_frob_arch_sections(Elf32_Ehdr *hdr,
- me->arch.core_plt_section = i;
- }
- if (!me->arch.core_plt_section || !me->arch.init_plt_section) {
-- printk("Module doesn't contain .plt or .init.plt sections.\n");
-+ printk("Module %s doesn't contain .plt or .init.plt sections.\n", me->name);
- return -ENOEXEC;
- }
-
-@@ -203,11 +203,16 @@ static uint32_t do_plt_call(void *location,
-
- DEBUGP("Doing plt for call to 0x%x at 0x%x\n", val, (unsigned int)location);
- /* Init, or core PLT? */
-- if (location >= mod->module_core
-- && location < mod->module_core + mod->core_size)
-+ if ((location >= mod->module_core_rx && location < mod->module_core_rx + mod->core_size_rx) ||
-+ (location >= mod->module_core_rw && location < mod->module_core_rw + mod->core_size_rw))
- entry = (void *)sechdrs[mod->arch.core_plt_section].sh_addr;
-- else
-+ else if ((location >= mod->module_init_rx && location < mod->module_init_rx + mod->init_size_rx) ||
-+ (location >= mod->module_init_rw && location < mod->module_init_rw + mod->init_size_rw))
- entry = (void *)sechdrs[mod->arch.init_plt_section].sh_addr;
-+ else {
-+ printk(KERN_ERR "%s: invalid R_PPC_REL24 entry found\n", mod->name);
-+ return ~0UL;
-+ }
-
- /* Find this entry, or if that fails, the next avail. entry */
- while (entry->jump[0]) {
-diff --git a/arch/powerpc/kernel/pci-common.c b/arch/powerpc/kernel/pci-common.c
-index cadbed6..b9bbb00 100644
---- a/arch/powerpc/kernel/pci-common.c
-+++ b/arch/powerpc/kernel/pci-common.c
-@@ -50,14 +50,14 @@ resource_size_t isa_mem_base;
- unsigned int ppc_pci_flags = 0;
-
-
--static struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
-+static const struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
-
--void set_pci_dma_ops(struct dma_map_ops *dma_ops)
-+void set_pci_dma_ops(const struct dma_map_ops *dma_ops)
- {
- pci_dma_ops = dma_ops;
- }
-
--struct dma_map_ops *get_pci_dma_ops(void)
-+const struct dma_map_ops *get_pci_dma_ops(void)
- {
- return pci_dma_ops;
- }
-diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
-index 7b816da..8d5c277 100644
---- a/arch/powerpc/kernel/process.c
-+++ b/arch/powerpc/kernel/process.c
-@@ -539,8 +539,8 @@ void show_regs(struct pt_regs * regs)
- * Lookup NIP late so we have the best change of getting the
- * above info out without failing
- */
-- printk("NIP ["REG"] %pS\n", regs->nip, (void *)regs->nip);
-- printk("LR ["REG"] %pS\n", regs->link, (void *)regs->link);
-+ printk("NIP ["REG"] %pA\n", regs->nip, (void *)regs->nip);
-+ printk("LR ["REG"] %pA\n", regs->link, (void *)regs->link);
- #endif
- show_stack(current, (unsigned long *) regs->gpr[1]);
- if (!user_mode(regs))
-@@ -1034,10 +1034,10 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
- newsp = stack[0];
- ip = stack[STACK_FRAME_LR_SAVE];
- if (!firstframe || ip != lr) {
-- printk("["REG"] ["REG"] %pS", sp, ip, (void *)ip);
-+ printk("["REG"] ["REG"] %pA", sp, ip, (void *)ip);
- #ifdef CONFIG_FUNCTION_GRAPH_TRACER
- if ((ip == rth || ip == mrth) && curr_frame >= 0) {
-- printk(" (%pS)",
-+ printk(" (%pA)",
- (void *)current->ret_stack[curr_frame].ret);
- curr_frame--;
- }
-@@ -1057,7 +1057,7 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
- struct pt_regs *regs = (struct pt_regs *)
- (sp + STACK_FRAME_OVERHEAD);
- lr = regs->link;
-- printk("--- Exception: %lx at %pS\n LR = %pS\n",
-+ printk("--- Exception: %lx at %pA\n LR = %pA\n",
- regs->trap, (void *)regs->nip, (void *)lr);
- firstframe = 1;
- }
-@@ -1134,58 +1134,3 @@ void thread_info_cache_init(void)
- }
-
- #endif /* THREAD_SHIFT < PAGE_SHIFT */
--
--unsigned long arch_align_stack(unsigned long sp)
--{
-- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
-- sp -= get_random_int() & ~PAGE_MASK;
-- return sp & ~0xf;
--}
--
--static inline unsigned long brk_rnd(void)
--{
-- unsigned long rnd = 0;
--
-- /* 8MB for 32bit, 1GB for 64bit */
-- if (is_32bit_task())
-- rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
-- else
-- rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
--
-- return rnd << PAGE_SHIFT;
--}
--
--unsigned long arch_randomize_brk(struct mm_struct *mm)
--{
-- unsigned long base = mm->brk;
-- unsigned long ret;
--
--#ifdef CONFIG_PPC_STD_MMU_64
-- /*
-- * If we are using 1TB segments and we are allowed to randomise
-- * the heap, we can put it above 1TB so it is backed by a 1TB
-- * segment. Otherwise the heap will be in the bottom 1TB
-- * which always uses 256MB segments and this may result in a
-- * performance penalty.
-- */
-- if (!is_32bit_task() && (mmu_highuser_ssize == MMU_SEGSIZE_1T))
-- base = max_t(unsigned long, mm->brk, 1UL << SID_SHIFT_1T);
--#endif
--
-- ret = PAGE_ALIGN(base + brk_rnd());
--
-- if (ret < mm->brk)
-- return mm->brk;
--
-- return ret;
--}
--
--unsigned long randomize_et_dyn(unsigned long base)
--{
-- unsigned long ret = PAGE_ALIGN(base + brk_rnd());
--
-- if (ret < base)
-- return base;
--
-- return ret;
--}
-diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
-index ef14988..8a37ddb 100644
---- a/arch/powerpc/kernel/ptrace.c
-+++ b/arch/powerpc/kernel/ptrace.c
-@@ -86,7 +86,7 @@ static int set_user_trap(struct task_struct *task, unsigned long trap)
- /*
- * Get contents of register REGNO in task TASK.
- */
--unsigned long ptrace_get_reg(struct task_struct *task, int regno)
-+unsigned long ptrace_get_reg(struct task_struct *task, unsigned int regno)
- {
- if (task->thread.regs == NULL)
- return -EIO;
-@@ -894,7 +894,7 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
-
- CHECK_FULL_REGS(child->thread.regs);
- if (index < PT_FPR0) {
-- tmp = ptrace_get_reg(child, (int) index);
-+ tmp = ptrace_get_reg(child, index);
- } else {
- flush_fp_to_thread(child);
- tmp = ((unsigned long *)child->thread.fpr)
-@@ -1033,6 +1033,10 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
- return ret;
- }
-
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+extern void gr_delayed_cred_worker(void);
-+#endif
-+
- /*
- * We must return the syscall number to actually look up in the table.
- * This can be -1L to skip running any syscall at all.
-@@ -1043,6 +1047,11 @@ long do_syscall_trace_enter(struct pt_regs *regs)
-
- secure_computing(regs->gpr[0]);
-
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+ if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
-+ gr_delayed_cred_worker();
-+#endif
-+
- if (test_thread_flag(TIF_SYSCALL_TRACE) &&
- tracehook_report_syscall_entry(regs))
- /*
-@@ -1076,6 +1085,11 @@ void do_syscall_trace_leave(struct pt_regs *regs)
- {
- int step;
-
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+ if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
-+ gr_delayed_cred_worker();
-+#endif
-+
- if (unlikely(current->audit_context))
- audit_syscall_exit((regs->ccr&0x10000000)?AUDITSC_FAILURE:AUDITSC_SUCCESS,
- regs->result);
-diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
-index d670429..2bc59b2 100644
---- a/arch/powerpc/kernel/signal_32.c
-+++ b/arch/powerpc/kernel/signal_32.c
-@@ -857,7 +857,7 @@ int handle_rt_signal32(unsigned long sig, struct k_sigaction *ka,
- /* Save user registers on the stack */
- frame = &rt_sf->uc.uc_mcontext;
- addr = frame;
-- if (vdso32_rt_sigtramp && current->mm->context.vdso_base) {
-+ if (vdso32_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
- if (save_user_regs(regs, frame, 0, 1))
- goto badframe;
- regs->link = current->mm->context.vdso_base + vdso32_rt_sigtramp;
-diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
-index 2fe6fc6..ada0d96 100644
---- a/arch/powerpc/kernel/signal_64.c
-+++ b/arch/powerpc/kernel/signal_64.c
-@@ -429,7 +429,7 @@ int handle_rt_signal64(int signr, struct k_sigaction *ka, siginfo_t *info,
- current->thread.fpscr.val = 0;
-
- /* Set up to return from userspace. */
-- if (vdso64_rt_sigtramp && current->mm->context.vdso_base) {
-+ if (vdso64_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
- regs->link = current->mm->context.vdso_base + vdso64_rt_sigtramp;
- } else {
- err |= setup_trampoline(__NR_rt_sigreturn, &frame->tramp[0]);
-diff --git a/arch/powerpc/kernel/sys_ppc32.c b/arch/powerpc/kernel/sys_ppc32.c
-index b97c2d6..dd01a6a 100644
---- a/arch/powerpc/kernel/sys_ppc32.c
-+++ b/arch/powerpc/kernel/sys_ppc32.c
-@@ -563,10 +563,10 @@ asmlinkage long compat_sys_sysctl(struct __sysctl_args32 __user *args)
- if (oldlenp) {
- if (!error) {
- if (get_user(oldlen, oldlenp) ||
-- put_user(oldlen, (compat_size_t __user *)compat_ptr(tmp.oldlenp)))
-+ put_user(oldlen, (compat_size_t __user *)compat_ptr(tmp.oldlenp)) ||
-+ copy_to_user(args->__unused, tmp.__unused, sizeof(tmp.__unused)))
- error = -EFAULT;
- }
-- copy_to_user(args->__unused, tmp.__unused, sizeof(tmp.__unused));
- }
- return error;
- }
-diff --git a/arch/powerpc/kernel/syscalls.c b/arch/powerpc/kernel/syscalls.c
-index 3370e62..527c659 100644
---- a/arch/powerpc/kernel/syscalls.c
-+++ b/arch/powerpc/kernel/syscalls.c
-@@ -201,11 +201,11 @@ long ppc64_personality(unsigned long personality)
- long ret;
-
- if (personality(current->personality) == PER_LINUX32
-- && personality == PER_LINUX)
-- personality = PER_LINUX32;
-+ && personality(personality) == PER_LINUX)
-+ personality = (personality & ~PER_MASK) | PER_LINUX32;
- ret = sys_personality(personality);
-- if (ret == PER_LINUX32)
-- ret = PER_LINUX;
-+ if (personality(ret) == PER_LINUX32)
-+ ret = (ret & ~PER_MASK) | PER_LINUX;
- return ret;
- }
- #endif
-diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
-index 6f0ae1a..e4b6a56 100644
---- a/arch/powerpc/kernel/traps.c
-+++ b/arch/powerpc/kernel/traps.c
-@@ -99,6 +99,8 @@ static void pmac_backlight_unblank(void)
- static inline void pmac_backlight_unblank(void) { }
- #endif
-
-+extern void gr_handle_kernel_exploit(void);
-+
- int die(const char *str, struct pt_regs *regs, long err)
- {
- static struct {
-@@ -168,6 +170,8 @@ int die(const char *str, struct pt_regs *regs, long err)
- if (panic_on_oops)
- panic("Fatal exception");
-
-+ gr_handle_kernel_exploit();
-+
- oops_exit();
- do_exit(err);
-
-diff --git a/arch/powerpc/kernel/vdso.c b/arch/powerpc/kernel/vdso.c
-index 137dc22..fe57a79 100644
---- a/arch/powerpc/kernel/vdso.c
-+++ b/arch/powerpc/kernel/vdso.c
-@@ -36,6 +36,7 @@
- #include <asm/firmware.h>
- #include <asm/vdso.h>
- #include <asm/vdso_datapage.h>
-+#include <asm/mman.h>
-
- #include "setup.h"
-
-@@ -220,7 +221,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
- vdso_base = VDSO32_MBASE;
- #endif
-
-- current->mm->context.vdso_base = 0;
-+ current->mm->context.vdso_base = ~0UL;
-
- /* vDSO has a problem and was disabled, just don't "enable" it for the
- * process
-@@ -240,7 +241,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
- vdso_base = get_unmapped_area(NULL, vdso_base,
- (vdso_pages << PAGE_SHIFT) +
- ((VDSO_ALIGNMENT - 1) & PAGE_MASK),
-- 0, 0);
-+ 0, MAP_PRIVATE | MAP_EXECUTABLE);
- if (IS_ERR_VALUE(vdso_base)) {
- rc = vdso_base;
- goto fail_mmapsem;
-diff --git a/arch/powerpc/kernel/vio.c b/arch/powerpc/kernel/vio.c
-index 77f6421..829564a 100644
---- a/arch/powerpc/kernel/vio.c
-+++ b/arch/powerpc/kernel/vio.c
-@@ -601,11 +601,12 @@ static void vio_dma_iommu_unmap_sg(struct device *dev,
- vio_cmo_dealloc(viodev, alloc_size);
- }
-
--struct dma_map_ops vio_dma_mapping_ops = {
-+static const struct dma_map_ops vio_dma_mapping_ops = {
- .alloc_coherent = vio_dma_iommu_alloc_coherent,
- .free_coherent = vio_dma_iommu_free_coherent,
- .map_sg = vio_dma_iommu_map_sg,
- .unmap_sg = vio_dma_iommu_unmap_sg,
-+ .dma_supported = dma_iommu_dma_supported,
- .map_page = vio_dma_iommu_map_page,
- .unmap_page = vio_dma_iommu_unmap_page,
-
-@@ -857,7 +858,6 @@ static void vio_cmo_bus_remove(struct vio_dev *viodev)
-
- static void vio_cmo_set_dma_ops(struct vio_dev *viodev)
- {
-- vio_dma_mapping_ops.dma_supported = dma_iommu_ops.dma_supported;
- viodev->dev.archdata.dma_ops = &vio_dma_mapping_ops;
- }
-
-diff --git a/arch/powerpc/lib/usercopy_64.c b/arch/powerpc/lib/usercopy_64.c
-index 5eea6f3..5d10396 100644
---- a/arch/powerpc/lib/usercopy_64.c
-+++ b/arch/powerpc/lib/usercopy_64.c
-@@ -9,22 +9,6 @@
- #include <linux/module.h>
- #include <asm/uaccess.h>
-
--unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
--{
-- if (likely(access_ok(VERIFY_READ, from, n)))
-- n = __copy_from_user(to, from, n);
-- else
-- memset(to, 0, n);
-- return n;
--}
--
--unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
--{
-- if (likely(access_ok(VERIFY_WRITE, to, n)))
-- n = __copy_to_user(to, from, n);
-- return n;
--}
--
- unsigned long copy_in_user(void __user *to, const void __user *from,
- unsigned long n)
- {
-@@ -35,7 +19,5 @@ unsigned long copy_in_user(void __user *to, const void __user *from,
- return n;
- }
-
--EXPORT_SYMBOL(copy_from_user);
--EXPORT_SYMBOL(copy_to_user);
- EXPORT_SYMBOL(copy_in_user);
-
-diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
-index e7dae82..877ce0d 100644
---- a/arch/powerpc/mm/fault.c
-+++ b/arch/powerpc/mm/fault.c
-@@ -30,6 +30,10 @@
- #include <linux/kprobes.h>
- #include <linux/kdebug.h>
- #include <linux/perf_event.h>
-+#include <linux/slab.h>
-+#include <linux/pagemap.h>
-+#include <linux/compiler.h>
-+#include <linux/unistd.h>
-
- #include <asm/firmware.h>
- #include <asm/page.h>
-@@ -40,6 +44,7 @@
- #include <asm/uaccess.h>
- #include <asm/tlbflush.h>
- #include <asm/siginfo.h>
-+#include <asm/ptrace.h>
-
-
- #ifdef CONFIG_KPROBES
-@@ -64,6 +69,33 @@ static inline int notify_page_fault(struct pt_regs *regs)
- }
- #endif
-
-+#ifdef CONFIG_PAX_PAGEEXEC
-+/*
-+ * PaX: decide what to do with offenders (regs->nip = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+ return 1;
-+}
-+
-+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
-+{
-+ unsigned long i;
-+
-+ printk(KERN_ERR "PAX: bytes at PC: ");
-+ for (i = 0; i < 5; i++) {
-+ unsigned int c;
-+ if (get_user(c, (unsigned int __user *)pc+i))
-+ printk(KERN_CONT "???????? ");
-+ else
-+ printk(KERN_CONT "%08x ", c);
-+ }
-+ printk("\n");
-+}
-+#endif
-+
- /*
- * Check whether the instruction at regs->nip is a store using
- * an update addressing form which will update r1.
-@@ -134,7 +166,7 @@ int __kprobes do_page_fault(struct pt_regs *regs, unsigned long address,
- * indicate errors in DSISR but can validly be set in SRR1.
- */
- if (trap == 0x400)
-- error_code &= 0x48200000;
-+ error_code &= 0x58200000;
- else
- is_write = error_code & DSISR_ISSTORE;
- #else
-@@ -250,7 +282,7 @@ good_area:
- * "undefined". Of those that can be set, this is the only
- * one which seems bad.
- */
-- if (error_code & 0x10000000)
-+ if (error_code & DSISR_GUARDED)
- /* Guarded storage error. */
- goto bad_area;
- #endif /* CONFIG_8xx */
-@@ -265,7 +297,7 @@ good_area:
- * processors use the same I/D cache coherency mechanism
- * as embedded.
- */
-- if (error_code & DSISR_PROTFAULT)
-+ if (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))
- goto bad_area;
- #endif /* CONFIG_PPC_STD_MMU */
-
-@@ -335,6 +367,23 @@ bad_area:
- bad_area_nosemaphore:
- /* User mode accesses cause a SIGSEGV */
- if (user_mode(regs)) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (mm->pax_flags & MF_PAX_PAGEEXEC) {
-+#ifdef CONFIG_PPC_STD_MMU
-+ if (is_exec && (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))) {
-+#else
-+ if (is_exec && regs->nip == address) {
-+#endif
-+ switch (pax_handle_fetch_fault(regs)) {
-+ }
-+
-+ pax_report_fault(regs, (void *)regs->nip, (void *)regs->gpr[PT_R1]);
-+ do_group_exit(SIGKILL);
-+ }
-+ }
-+#endif
-+
- _exception(SIGSEGV, regs, code, address);
- return 0;
- }
-diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c
-index 5973631..ad617af 100644
---- a/arch/powerpc/mm/mem.c
-+++ b/arch/powerpc/mm/mem.c
-@@ -250,7 +250,7 @@ static int __init mark_nonram_nosave(void)
- {
- unsigned long lmb_next_region_start_pfn,
- lmb_region_max_pfn;
-- int i;
-+ unsigned int i;
-
- for (i = 0; i < lmb.memory.cnt - 1; i++) {
- lmb_region_max_pfn =
-diff --git a/arch/powerpc/mm/mmap_64.c b/arch/powerpc/mm/mmap_64.c
-index 0d957a4..eae383e 100644
---- a/arch/powerpc/mm/mmap_64.c
-+++ b/arch/powerpc/mm/mmap_64.c
-@@ -65,6 +65,10 @@ static unsigned long mmap_rnd(void)
- {
- unsigned long rnd = 0;
-
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- if (current->flags & PF_RANDOMIZE) {
- /* 8MB for 32bit, 1GB for 64bit */
- if (is_32bit_task())
-@@ -99,10 +103,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
- */
- if (mmap_is_legacy()) {
- mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- mm->get_unmapped_area = arch_get_unmapped_area;
- mm->unmap_area = arch_unmap_area;
- } else {
- mm->mmap_base = mmap_base();
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
-+#endif
-+
- mm->get_unmapped_area = arch_get_unmapped_area_topdown;
- mm->unmap_area = arch_unmap_area_topdown;
- }
-diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c
-index ba51948..9190915 100644
---- a/arch/powerpc/mm/slice.c
-+++ b/arch/powerpc/mm/slice.c
-@@ -98,7 +98,7 @@ static int slice_area_is_free(struct mm_struct *mm, unsigned long addr,
- if ((mm->task_size - len) < addr)
- return 0;
- vma = find_vma(mm, addr);
-- return (!vma || (addr + len) <= vma->vm_start);
-+ return check_heap_stack_gap(vma, &addr, len, 0);
- }
-
- static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice)
-@@ -256,7 +256,7 @@ full_search:
- addr = _ALIGN_UP(addr + 1, 1ul << SLICE_HIGH_SHIFT);
- continue;
- }
-- if (!vma || addr + len <= vma->vm_start) {
-+ if (check_heap_stack_gap(vma, &addr, len, 0)) {
- /*
- * Remember the place where we stopped the search:
- */
-@@ -313,10 +313,14 @@ static unsigned long slice_find_area_topdown(struct mm_struct *mm,
- }
- }
-
-- addr = mm->mmap_base;
-- while (addr > len) {
-+ if (mm->mmap_base < len)
-+ addr = -ENOMEM;
-+ else
-+ addr = mm->mmap_base - len;
-+
-+ while (!IS_ERR_VALUE(addr)) {
- /* Go down by chunk size */
-- addr = _ALIGN_DOWN(addr - len, 1ul << pshift);
-+ addr = _ALIGN_DOWN(addr, 1ul << pshift);
-
- /* Check for hit with different page size */
- mask = slice_range_to_mask(addr, len);
-@@ -336,7 +340,7 @@ static unsigned long slice_find_area_topdown(struct mm_struct *mm,
- * return with success:
- */
- vma = find_vma(mm, addr);
-- if (!vma || (addr + len) <= vma->vm_start) {
-+ if (check_heap_stack_gap(vma, &addr, len, 0)) {
- /* remember the address as a hint for next time */
- if (use_cache)
- mm->free_area_cache = addr;
-@@ -348,7 +352,7 @@ static unsigned long slice_find_area_topdown(struct mm_struct *mm,
- mm->cached_hole_size = vma->vm_start - addr;
-
- /* try just below the current vma->vm_start */
-- addr = vma->vm_start;
-+ addr = skip_heap_stack_gap(vma, len, 0);
- }
-
- /*
-@@ -426,6 +430,11 @@ unsigned long slice_get_unmapped_area(unsigned long addr, unsigned long len,
- if (fixed && addr > (mm->task_size - len))
- return -EINVAL;
-
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!fixed && (mm->pax_flags & MF_PAX_RANDMMAP))
-+ addr = 0;
-+#endif
-+
- /* If hint, make sure it matches our alignment restrictions */
- if (!fixed && addr) {
- addr = _ALIGN_UP(addr, 1ul << pshift);
-diff --git a/arch/powerpc/platforms/52xx/lite5200_pm.c b/arch/powerpc/platforms/52xx/lite5200_pm.c
-index b5c753d..8f01abe 100644
---- a/arch/powerpc/platforms/52xx/lite5200_pm.c
-+++ b/arch/powerpc/platforms/52xx/lite5200_pm.c
-@@ -235,7 +235,7 @@ static void lite5200_pm_end(void)
- lite5200_pm_target_state = PM_SUSPEND_ON;
- }
-
--static struct platform_suspend_ops lite5200_pm_ops = {
-+static const struct platform_suspend_ops lite5200_pm_ops = {
- .valid = lite5200_pm_valid,
- .begin = lite5200_pm_begin,
- .prepare = lite5200_pm_prepare,
-diff --git a/arch/powerpc/platforms/52xx/mpc52xx_pm.c b/arch/powerpc/platforms/52xx/mpc52xx_pm.c
-index a55b0b6..478c18e 100644
---- a/arch/powerpc/platforms/52xx/mpc52xx_pm.c
-+++ b/arch/powerpc/platforms/52xx/mpc52xx_pm.c
-@@ -180,7 +180,7 @@ void mpc52xx_pm_finish(void)
- iounmap(mbar);
- }
-
--static struct platform_suspend_ops mpc52xx_pm_ops = {
-+static const struct platform_suspend_ops mpc52xx_pm_ops = {
- .valid = mpc52xx_pm_valid,
- .prepare = mpc52xx_pm_prepare,
- .enter = mpc52xx_pm_enter,
-diff --git a/arch/powerpc/platforms/83xx/suspend.c b/arch/powerpc/platforms/83xx/suspend.c
-index 08e65fc..643d3ac 100644
---- a/arch/powerpc/platforms/83xx/suspend.c
-+++ b/arch/powerpc/platforms/83xx/suspend.c
-@@ -273,7 +273,7 @@ static int mpc83xx_is_pci_agent(void)
- return ret;
- }
-
--static struct platform_suspend_ops mpc83xx_suspend_ops = {
-+static const struct platform_suspend_ops mpc83xx_suspend_ops = {
- .valid = mpc83xx_suspend_valid,
- .begin = mpc83xx_suspend_begin,
- .enter = mpc83xx_suspend_enter,
-diff --git a/arch/powerpc/platforms/cell/iommu.c b/arch/powerpc/platforms/cell/iommu.c
-index ca5bfdf..1602e09 100644
---- a/arch/powerpc/platforms/cell/iommu.c
-+++ b/arch/powerpc/platforms/cell/iommu.c
-@@ -642,7 +642,7 @@ static int dma_fixed_dma_supported(struct device *dev, u64 mask)
-
- static int dma_set_mask_and_switch(struct device *dev, u64 dma_mask);
-
--struct dma_map_ops dma_iommu_fixed_ops = {
-+const struct dma_map_ops dma_iommu_fixed_ops = {
- .alloc_coherent = dma_fixed_alloc_coherent,
- .free_coherent = dma_fixed_free_coherent,
- .map_sg = dma_fixed_map_sg,
-diff --git a/arch/powerpc/platforms/ps3/system-bus.c b/arch/powerpc/platforms/ps3/system-bus.c
-index e34b305..20e48ec 100644
---- a/arch/powerpc/platforms/ps3/system-bus.c
-+++ b/arch/powerpc/platforms/ps3/system-bus.c
-@@ -694,7 +694,7 @@ static int ps3_dma_supported(struct device *_dev, u64 mask)
- return mask >= DMA_BIT_MASK(32);
- }
-
--static struct dma_map_ops ps3_sb_dma_ops = {
-+static const struct dma_map_ops ps3_sb_dma_ops = {
- .alloc_coherent = ps3_alloc_coherent,
- .free_coherent = ps3_free_coherent,
- .map_sg = ps3_sb_map_sg,
-@@ -704,7 +704,7 @@ static struct dma_map_ops ps3_sb_dma_ops = {
- .unmap_page = ps3_unmap_page,
- };
-
--static struct dma_map_ops ps3_ioc0_dma_ops = {
-+static const struct dma_map_ops ps3_ioc0_dma_ops = {
- .alloc_coherent = ps3_alloc_coherent,
- .free_coherent = ps3_free_coherent,
- .map_sg = ps3_ioc0_map_sg,
-diff --git a/arch/powerpc/platforms/pseries/Kconfig b/arch/powerpc/platforms/pseries/Kconfig
-index f0e6f28..60d53ed 100644
---- a/arch/powerpc/platforms/pseries/Kconfig
-+++ b/arch/powerpc/platforms/pseries/Kconfig
-@@ -2,6 +2,8 @@ config PPC_PSERIES
- depends on PPC64 && PPC_BOOK3S
- bool "IBM pSeries & new (POWER5-based) iSeries"
- select MPIC
-+ select PCI_MSI
-+ select XICS
- select PPC_I8259
- select PPC_RTAS
- select RTAS_ERROR_LOGGING
-diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
-index aca7fff..76c2b6b 100644
---- a/arch/s390/Kconfig
-+++ b/arch/s390/Kconfig
-@@ -197,28 +197,26 @@ config AUDIT_ARCH
-
- config S390_SWITCH_AMODE
- bool "Switch kernel/user addressing modes"
-+ default y
- help
- This option allows to switch the addressing modes of kernel and user
-- space. The kernel parameter switch_amode=on will enable this feature,
-- default is disabled. Enabling this (via kernel parameter) on machines
-- earlier than IBM System z9-109 EC/BC will reduce system performance.
-+ space. Enabling this on machines earlier than IBM System z9-109 EC/BC
-+ will reduce system performance.
-
- Note that this option will also be selected by selecting the execute
-- protection option below. Enabling the execute protection via the
-- noexec kernel parameter will also switch the addressing modes,
-- independent of the switch_amode kernel parameter.
-+ protection option below. Enabling the execute protection will also
-+ switch the addressing modes, independent of this option.
-
-
- config S390_EXEC_PROTECT
- bool "Data execute protection"
-+ default y
- select S390_SWITCH_AMODE
- help
- This option allows to enable a buffer overflow protection for user
- space programs and it also selects the addressing mode option above.
-- The kernel parameter noexec=on will enable this feature and also
-- switch the addressing modes, default is disabled. Enabling this (via
-- kernel parameter) on machines earlier than IBM System z9-109 EC/BC
-- will reduce system performance.
-+ Enabling this on machines earlier than IBM System z9-109 EC/BC will
-+ reduce system performance.
-
- comment "Code generation options"
-
-diff --git a/arch/s390/include/asm/atomic.h b/arch/s390/include/asm/atomic.h
-index ae7c8f9..3f01a0c 100644
---- a/arch/s390/include/asm/atomic.h
-+++ b/arch/s390/include/asm/atomic.h
-@@ -362,6 +362,16 @@ static inline int atomic64_add_unless(atomic64_t *v, long long a, long long u)
- #define atomic64_dec_and_test(_v) (atomic64_sub_return(1, _v) == 0)
- #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
-
-+#define atomic64_read_unchecked(v) atomic64_read(v)
-+#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
-+#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
-+#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
-+#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
-+#define atomic64_inc_unchecked(v) atomic64_inc(v)
-+#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
-+#define atomic64_dec_unchecked(v) atomic64_dec(v)
-+#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
-+
- #define smp_mb__before_atomic_dec() smp_mb()
- #define smp_mb__after_atomic_dec() smp_mb()
- #define smp_mb__before_atomic_inc() smp_mb()
-diff --git a/arch/s390/include/asm/cache.h b/arch/s390/include/asm/cache.h
-index 9b86681..c5140db 100644
---- a/arch/s390/include/asm/cache.h
-+++ b/arch/s390/include/asm/cache.h
-@@ -11,8 +11,10 @@
- #ifndef __ARCH_S390_CACHE_H
- #define __ARCH_S390_CACHE_H
-
--#define L1_CACHE_BYTES 256
-+#include <linux/const.h>
-+
- #define L1_CACHE_SHIFT 8
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-
- #define __read_mostly __attribute__((__section__(".data.read_mostly")))
-
-diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
-index e885442..5b0c9aa3 100644
---- a/arch/s390/include/asm/elf.h
-+++ b/arch/s390/include/asm/elf.h
-@@ -164,6 +164,13 @@ extern unsigned int vdso_enabled;
- that it will "exec", and that there is sufficient room for the brk. */
- #define ELF_ET_DYN_BASE (STACK_TOP / 3 * 2)
-
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_31BIT) ? 0x10000UL : 0x80000000UL)
-+
-+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26)
-+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26)
-+#endif
-+
- /* This yields a mask that user programs can use to figure out what
- instruction set this CPU supports. */
-
-@@ -182,7 +189,8 @@ extern char elf_platform[];
- #define ELF_PLATFORM (elf_platform)
-
- #ifndef __s390x__
--#define SET_PERSONALITY(ex) set_personality(PER_LINUX)
-+#define SET_PERSONALITY(ex) \
-+ set_personality(PER_LINUX | (current->personality & (~PER_MASK)))
- #else /* __s390x__ */
- #define SET_PERSONALITY(ex) \
- do { \
-diff --git a/arch/s390/include/asm/setup.h b/arch/s390/include/asm/setup.h
-index e37478e..9ce0e9f 100644
---- a/arch/s390/include/asm/setup.h
-+++ b/arch/s390/include/asm/setup.h
-@@ -50,13 +50,13 @@ extern unsigned long memory_end;
- void detect_memory_layout(struct mem_chunk chunk[]);
-
- #ifdef CONFIG_S390_SWITCH_AMODE
--extern unsigned int switch_amode;
-+#define switch_amode (1)
- #else
- #define switch_amode (0)
- #endif
-
- #ifdef CONFIG_S390_EXEC_PROTECT
--extern unsigned int s390_noexec;
-+#define s390_noexec (1)
- #else
- #define s390_noexec (0)
- #endif
-diff --git a/arch/s390/include/asm/uaccess.h b/arch/s390/include/asm/uaccess.h
-index 8377e91..e28e6f1 100644
---- a/arch/s390/include/asm/uaccess.h
-+++ b/arch/s390/include/asm/uaccess.h
-@@ -232,6 +232,10 @@ static inline unsigned long __must_check
- copy_to_user(void __user *to, const void *from, unsigned long n)
- {
- might_fault();
-+
-+ if ((long)n < 0)
-+ return n;
-+
- if (access_ok(VERIFY_WRITE, to, n))
- n = __copy_to_user(to, from, n);
- return n;
-@@ -257,6 +261,9 @@ copy_to_user(void __user *to, const void *from, unsigned long n)
- static inline unsigned long __must_check
- __copy_from_user(void *to, const void __user *from, unsigned long n)
- {
-+ if ((long)n < 0)
-+ return n;
-+
- if (__builtin_constant_p(n) && (n <= 256))
- return uaccess.copy_from_user_small(n, from, to);
- else
-@@ -283,6 +290,10 @@ static inline unsigned long __must_check
- copy_from_user(void *to, const void __user *from, unsigned long n)
- {
- might_fault();
-+
-+ if ((long)n < 0)
-+ return n;
-+
- if (access_ok(VERIFY_READ, from, n))
- n = __copy_from_user(to, from, n);
- else
-diff --git a/arch/s390/kernel/module.c b/arch/s390/kernel/module.c
-index 639380a..72e3c02 100644
---- a/arch/s390/kernel/module.c
-+++ b/arch/s390/kernel/module.c
-@@ -166,11 +166,11 @@ module_frob_arch_sections(Elf_Ehdr *hdr, Elf_Shdr *sechdrs,
-
- /* Increase core size by size of got & plt and set start
- offsets for got and plt. */
-- me->core_size = ALIGN(me->core_size, 4);
-- me->arch.got_offset = me->core_size;
-- me->core_size += me->arch.got_size;
-- me->arch.plt_offset = me->core_size;
-- me->core_size += me->arch.plt_size;
-+ me->core_size_rw = ALIGN(me->core_size_rw, 4);
-+ me->arch.got_offset = me->core_size_rw;
-+ me->core_size_rw += me->arch.got_size;
-+ me->arch.plt_offset = me->core_size_rx;
-+ me->core_size_rx += me->arch.plt_size;
- return 0;
- }
-
-@@ -256,7 +256,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
- if (info->got_initialized == 0) {
- Elf_Addr *gotent;
-
-- gotent = me->module_core + me->arch.got_offset +
-+ gotent = me->module_core_rw + me->arch.got_offset +
- info->got_offset;
- *gotent = val;
- info->got_initialized = 1;
-@@ -280,7 +280,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
- else if (r_type == R_390_GOTENT ||
- r_type == R_390_GOTPLTENT)
- *(unsigned int *) loc =
-- (val + (Elf_Addr) me->module_core - loc) >> 1;
-+ (val + (Elf_Addr) me->module_core_rw - loc) >> 1;
- else if (r_type == R_390_GOT64 ||
- r_type == R_390_GOTPLT64)
- *(unsigned long *) loc = val;
-@@ -294,7 +294,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
- case R_390_PLTOFF64: /* 16 bit offset from GOT to PLT. */
- if (info->plt_initialized == 0) {
- unsigned int *ip;
-- ip = me->module_core + me->arch.plt_offset +
-+ ip = me->module_core_rx + me->arch.plt_offset +
- info->plt_offset;
- #ifndef CONFIG_64BIT
- ip[0] = 0x0d105810; /* basr 1,0; l 1,6(1); br 1 */
-@@ -319,7 +319,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
- val - loc + 0xffffUL < 0x1ffffeUL) ||
- (r_type == R_390_PLT32DBL &&
- val - loc + 0xffffffffULL < 0x1fffffffeULL)))
-- val = (Elf_Addr) me->module_core +
-+ val = (Elf_Addr) me->module_core_rx +
- me->arch.plt_offset +
- info->plt_offset;
- val += rela->r_addend - loc;
-@@ -341,7 +341,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
- case R_390_GOTOFF32: /* 32 bit offset to GOT. */
- case R_390_GOTOFF64: /* 64 bit offset to GOT. */
- val = val + rela->r_addend -
-- ((Elf_Addr) me->module_core + me->arch.got_offset);
-+ ((Elf_Addr) me->module_core_rw + me->arch.got_offset);
- if (r_type == R_390_GOTOFF16)
- *(unsigned short *) loc = val;
- else if (r_type == R_390_GOTOFF32)
-@@ -351,7 +351,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
- break;
- case R_390_GOTPC: /* 32 bit PC relative offset to GOT. */
- case R_390_GOTPCDBL: /* 32 bit PC rel. off. to GOT shifted by 1. */
-- val = (Elf_Addr) me->module_core + me->arch.got_offset +
-+ val = (Elf_Addr) me->module_core_rw + me->arch.got_offset +
- rela->r_addend - loc;
- if (r_type == R_390_GOTPC)
- *(unsigned int *) loc = val;
-diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
-index 358e545..051e4f4 100644
---- a/arch/s390/kernel/setup.c
-+++ b/arch/s390/kernel/setup.c
-@@ -307,9 +307,6 @@ static int __init early_parse_mem(char *p)
- early_param("mem", early_parse_mem);
-
- #ifdef CONFIG_S390_SWITCH_AMODE
--unsigned int switch_amode = 0;
--EXPORT_SYMBOL_GPL(switch_amode);
--
- static int set_amode_and_uaccess(unsigned long user_amode,
- unsigned long user32_amode)
- {
-@@ -335,17 +332,6 @@ static int set_amode_and_uaccess(unsigned long user_amode,
- return 0;
- }
- }
--
--/*
-- * Switch kernel/user addressing modes?
-- */
--static int __init early_parse_switch_amode(char *p)
--{
-- switch_amode = 1;
-- return 0;
--}
--early_param("switch_amode", early_parse_switch_amode);
--
- #else /* CONFIG_S390_SWITCH_AMODE */
- static inline int set_amode_and_uaccess(unsigned long user_amode,
- unsigned long user32_amode)
-@@ -354,24 +340,6 @@ static inline int set_amode_and_uaccess(unsigned long user_amode,
- }
- #endif /* CONFIG_S390_SWITCH_AMODE */
-
--#ifdef CONFIG_S390_EXEC_PROTECT
--unsigned int s390_noexec = 0;
--EXPORT_SYMBOL_GPL(s390_noexec);
--
--/*
-- * Enable execute protection?
-- */
--static int __init early_parse_noexec(char *p)
--{
-- if (!strncmp(p, "off", 3))
-- return 0;
-- switch_amode = 1;
-- s390_noexec = 1;
-- return 0;
--}
--early_param("noexec", early_parse_noexec);
--#endif /* CONFIG_S390_EXEC_PROTECT */
--
- static void setup_addressing_mode(void)
- {
- if (s390_noexec) {
-diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
-index 0ab74ae..c8b68f9 100644
---- a/arch/s390/mm/mmap.c
-+++ b/arch/s390/mm/mmap.c
-@@ -78,10 +78,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
- */
- if (mmap_is_legacy()) {
- mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- mm->get_unmapped_area = arch_get_unmapped_area;
- mm->unmap_area = arch_unmap_area;
- } else {
- mm->mmap_base = mmap_base();
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
-+#endif
-+
- mm->get_unmapped_area = arch_get_unmapped_area_topdown;
- mm->unmap_area = arch_unmap_area_topdown;
- }
-@@ -153,10 +165,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
- */
- if (mmap_is_legacy()) {
- mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- mm->get_unmapped_area = s390_get_unmapped_area;
- mm->unmap_area = arch_unmap_area;
- } else {
- mm->mmap_base = mmap_base();
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
-+#endif
-+
- mm->get_unmapped_area = s390_get_unmapped_area_topdown;
- mm->unmap_area = arch_unmap_area_topdown;
- }
-diff --git a/arch/score/include/asm/cache.h b/arch/score/include/asm/cache.h
-index ae3d59f..f65f075 100644
---- a/arch/score/include/asm/cache.h
-+++ b/arch/score/include/asm/cache.h
-@@ -1,7 +1,9 @@
- #ifndef _ASM_SCORE_CACHE_H
- #define _ASM_SCORE_CACHE_H
-
-+#include <linux/const.h>
-+
- #define L1_CACHE_SHIFT 4
--#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-
- #endif /* _ASM_SCORE_CACHE_H */
-diff --git a/arch/score/include/asm/system.h b/arch/score/include/asm/system.h
-index 589d5c7..669e274 100644
---- a/arch/score/include/asm/system.h
-+++ b/arch/score/include/asm/system.h
-@@ -17,7 +17,7 @@ do { \
- #define finish_arch_switch(prev) do {} while (0)
-
- typedef void (*vi_handler_t)(void);
--extern unsigned long arch_align_stack(unsigned long sp);
-+#define arch_align_stack(x) (x)
-
- #define mb() barrier()
- #define rmb() barrier()
-diff --git a/arch/score/kernel/process.c b/arch/score/kernel/process.c
-index 25d0803..d6c8e36 100644
---- a/arch/score/kernel/process.c
-+++ b/arch/score/kernel/process.c
-@@ -161,8 +161,3 @@ unsigned long get_wchan(struct task_struct *task)
-
- return task_pt_regs(task)->cp0_epc;
- }
--
--unsigned long arch_align_stack(unsigned long sp)
--{
-- return sp;
--}
-diff --git a/arch/sh/boards/mach-hp6xx/pm.c b/arch/sh/boards/mach-hp6xx/pm.c
-index d936c1a..304a252 100644
---- a/arch/sh/boards/mach-hp6xx/pm.c
-+++ b/arch/sh/boards/mach-hp6xx/pm.c
-@@ -143,7 +143,7 @@ static int hp6x0_pm_enter(suspend_state_t state)
- return 0;
- }
-
--static struct platform_suspend_ops hp6x0_pm_ops = {
-+static const struct platform_suspend_ops hp6x0_pm_ops = {
- .enter = hp6x0_pm_enter,
- .valid = suspend_valid_only_mem,
- };
-diff --git a/arch/sh/include/asm/cache.h b/arch/sh/include/asm/cache.h
-index 02df18e..ae3a793 100644
---- a/arch/sh/include/asm/cache.h
-+++ b/arch/sh/include/asm/cache.h
-@@ -9,10 +9,11 @@
- #define __ASM_SH_CACHE_H
- #ifdef __KERNEL__
-
-+#include <linux/const.h>
- #include <linux/init.h>
- #include <cpu/cache.h>
-
--#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-
- #define __read_mostly __attribute__((__section__(".data.read_mostly")))
-
-diff --git a/arch/sh/kernel/cpu/sh4/sq.c b/arch/sh/kernel/cpu/sh4/sq.c
-index 8a8a993..7b3079b 100644
---- a/arch/sh/kernel/cpu/sh4/sq.c
-+++ b/arch/sh/kernel/cpu/sh4/sq.c
-@@ -327,7 +327,7 @@ static struct attribute *sq_sysfs_attrs[] = {
- NULL,
- };
-
--static struct sysfs_ops sq_sysfs_ops = {
-+static const struct sysfs_ops sq_sysfs_ops = {
- .show = sq_sysfs_show,
- .store = sq_sysfs_store,
- };
-diff --git a/arch/sh/kernel/cpu/shmobile/pm.c b/arch/sh/kernel/cpu/shmobile/pm.c
-index ee3c2aa..c49cee6 100644
---- a/arch/sh/kernel/cpu/shmobile/pm.c
-+++ b/arch/sh/kernel/cpu/shmobile/pm.c
-@@ -58,7 +58,7 @@ static int sh_pm_enter(suspend_state_t state)
- return 0;
- }
-
--static struct platform_suspend_ops sh_pm_ops = {
-+static const struct platform_suspend_ops sh_pm_ops = {
- .enter = sh_pm_enter,
- .valid = suspend_valid_only_mem,
- };
-diff --git a/arch/sh/kernel/kgdb.c b/arch/sh/kernel/kgdb.c
-index 3e532d0..9faa306 100644
---- a/arch/sh/kernel/kgdb.c
-+++ b/arch/sh/kernel/kgdb.c
-@@ -271,7 +271,7 @@ void kgdb_arch_exit(void)
- {
- }
-
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- /* Breakpoint instruction: trapa #0x3c */
- #ifdef CONFIG_CPU_LITTLE_ENDIAN
- .gdb_bpt_instr = { 0x3c, 0xc3 },
-diff --git a/arch/sh/mm/mmap.c b/arch/sh/mm/mmap.c
-index afeb710..8da5c79 100644
---- a/arch/sh/mm/mmap.c
-+++ b/arch/sh/mm/mmap.c
-@@ -49,6 +49,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
- struct vm_area_struct *vma;
- unsigned long start_addr;
- int do_colour_align;
-+ unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
-
- if (flags & MAP_FIXED) {
- /* We do not accept a shared mapping if it would violate
-@@ -74,8 +75,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
- addr = PAGE_ALIGN(addr);
-
- vma = find_vma(mm, addr);
-- if (TASK_SIZE - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, &addr, len, offset))
- return addr;
- }
-
-@@ -106,7 +106,7 @@ full_search:
- }
- return -ENOMEM;
- }
-- if (likely(!vma || addr + len <= vma->vm_start)) {
-+ if (likely(check_heap_stack_gap(vma, &addr, len, offset))) {
- /*
- * Remember the place where we stopped the search:
- */
-@@ -131,6 +131,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- struct mm_struct *mm = current->mm;
- unsigned long addr = addr0;
- int do_colour_align;
-+ unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
-
- if (flags & MAP_FIXED) {
- /* We do not accept a shared mapping if it would violate
-@@ -157,8 +158,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- addr = PAGE_ALIGN(addr);
-
- vma = find_vma(mm, addr);
-- if (TASK_SIZE - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, &addr, len, offset))
- return addr;
- }
-
-@@ -178,28 +178,29 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
-
- /* make sure it can fit in the remaining address space */
- if (likely(addr > len)) {
-- vma = find_vma(mm, addr-len);
-- if (!vma || addr <= vma->vm_start) {
-+ addr -= len;
-+ vma = find_vma(mm, addr);
-+ if (check_heap_stack_gap(vma, &addr, len, offset)) {
- /* remember the address as a hint for next time */
-- return (mm->free_area_cache = addr-len);
-+ return (mm->free_area_cache = addr);
- }
- }
-
- if (unlikely(mm->mmap_base < len))
- goto bottomup;
-
-- addr = mm->mmap_base-len;
-- if (do_colour_align)
-- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
-+ addr = mm->mmap_base - len;
-
- do {
-+ if (do_colour_align)
-+ addr = COLOUR_ALIGN_DOWN(addr, pgoff);
- /*
- * Lookup failure means no vma is above this address,
- * else if new region fits below vma->vm_start,
- * return with success:
- */
- vma = find_vma(mm, addr);
-- if (likely(!vma || addr+len <= vma->vm_start)) {
-+ if (likely(check_heap_stack_gap(vma, &addr, len, offset))) {
- /* remember the address as a hint for next time */
- return (mm->free_area_cache = addr);
- }
-@@ -209,10 +210,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- mm->cached_hole_size = vma->vm_start - addr;
-
- /* try just below the current vma->vm_start */
-- addr = vma->vm_start-len;
-- if (do_colour_align)
-- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
-- } while (likely(len < vma->vm_start));
-+ addr = skip_heap_stack_gap(vma, len, offset);
-+ } while (!IS_ERR_VALUE(addr));
-
- bottomup:
- /*
-diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
-index 05ef538..dc9c857 100644
---- a/arch/sparc/Kconfig
-+++ b/arch/sparc/Kconfig
-@@ -32,6 +32,7 @@ config SPARC
-
- config SPARC32
- def_bool !64BIT
-+ select GENERIC_ATOMIC64
-
- config SPARC64
- def_bool 64BIT
-diff --git a/arch/sparc/Makefile b/arch/sparc/Makefile
-index 0538555..c826059 100644
---- a/arch/sparc/Makefile
-+++ b/arch/sparc/Makefile
-@@ -75,7 +75,7 @@ drivers-$(CONFIG_OPROFILE) += arch/sparc/oprofile/
- # Export what is needed by arch/sparc/boot/Makefile
- export VMLINUX_INIT VMLINUX_MAIN
- VMLINUX_INIT := $(head-y) $(init-y)
--VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/
-+VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
- VMLINUX_MAIN += $(patsubst %/, %/lib.a, $(libs-y)) $(libs-y)
- VMLINUX_MAIN += $(drivers-y) $(net-y)
-
-diff --git a/arch/sparc/include/asm/atomic_32.h b/arch/sparc/include/asm/atomic_32.h
-index f0d343c..cf36e68 100644
---- a/arch/sparc/include/asm/atomic_32.h
-+++ b/arch/sparc/include/asm/atomic_32.h
-@@ -13,6 +13,8 @@
-
- #include <linux/types.h>
-
-+#include <asm-generic/atomic64.h>
-+
- #ifdef __KERNEL__
-
- #include <asm/system.h>
-diff --git a/arch/sparc/include/asm/atomic_64.h b/arch/sparc/include/asm/atomic_64.h
-index f5cc06f..f858d47 100644
---- a/arch/sparc/include/asm/atomic_64.h
-+++ b/arch/sparc/include/asm/atomic_64.h
-@@ -14,18 +14,40 @@
- #define ATOMIC64_INIT(i) { (i) }
-
- #define atomic_read(v) ((v)->counter)
-+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
-+{
-+ return v->counter;
-+}
- #define atomic64_read(v) ((v)->counter)
-+static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
-+{
-+ return v->counter;
-+}
-
- #define atomic_set(v, i) (((v)->counter) = i)
-+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
-+{
-+ v->counter = i;
-+}
- #define atomic64_set(v, i) (((v)->counter) = i)
-+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
-+{
-+ v->counter = i;
-+}
-
- extern void atomic_add(int, atomic_t *);
-+extern void atomic_add_unchecked(int, atomic_unchecked_t *);
- extern void atomic64_add(long, atomic64_t *);
-+extern void atomic64_add_unchecked(long, atomic64_unchecked_t *);
- extern void atomic_sub(int, atomic_t *);
-+extern void atomic_sub_unchecked(int, atomic_unchecked_t *);
- extern void atomic64_sub(long, atomic64_t *);
-+extern void atomic64_sub_unchecked(long, atomic64_unchecked_t *);
-
- extern int atomic_add_ret(int, atomic_t *);
-+extern int atomic_add_ret_unchecked(int, atomic_unchecked_t *);
- extern long atomic64_add_ret(long, atomic64_t *);
-+extern long atomic64_add_ret_unchecked(long, atomic64_unchecked_t *);
- extern int atomic_sub_ret(int, atomic_t *);
- extern long atomic64_sub_ret(long, atomic64_t *);
-
-@@ -33,13 +55,29 @@ extern long atomic64_sub_ret(long, atomic64_t *);
- #define atomic64_dec_return(v) atomic64_sub_ret(1, v)
-
- #define atomic_inc_return(v) atomic_add_ret(1, v)
-+static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
-+{
-+ return atomic_add_ret_unchecked(1, v);
-+}
- #define atomic64_inc_return(v) atomic64_add_ret(1, v)
-+static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
-+{
-+ return atomic64_add_ret_unchecked(1, v);
-+}
-
- #define atomic_sub_return(i, v) atomic_sub_ret(i, v)
- #define atomic64_sub_return(i, v) atomic64_sub_ret(i, v)
-
- #define atomic_add_return(i, v) atomic_add_ret(i, v)
-+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
-+{
-+ return atomic_add_ret_unchecked(i, v);
-+}
- #define atomic64_add_return(i, v) atomic64_add_ret(i, v)
-+static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
-+{
-+ return atomic64_add_ret_unchecked(i, v);
-+}
-
- /*
- * atomic_inc_and_test - increment and test
-@@ -50,6 +88,10 @@ extern long atomic64_sub_ret(long, atomic64_t *);
- * other cases.
- */
- #define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
-+static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
-+{
-+ return atomic_inc_return_unchecked(v) == 0;
-+}
- #define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
-
- #define atomic_sub_and_test(i, v) (atomic_sub_ret(i, v) == 0)
-@@ -59,30 +101,65 @@ extern long atomic64_sub_ret(long, atomic64_t *);
- #define atomic64_dec_and_test(v) (atomic64_sub_ret(1, v) == 0)
-
- #define atomic_inc(v) atomic_add(1, v)
-+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
-+{
-+ atomic_add_unchecked(1, v);
-+}
- #define atomic64_inc(v) atomic64_add(1, v)
-+static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
-+{
-+ atomic64_add_unchecked(1, v);
-+}
-
- #define atomic_dec(v) atomic_sub(1, v)
-+static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
-+{
-+ atomic_sub_unchecked(1, v);
-+}
- #define atomic64_dec(v) atomic64_sub(1, v)
-+static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
-+{
-+ atomic64_sub_unchecked(1, v);
-+}
-
- #define atomic_add_negative(i, v) (atomic_add_ret(i, v) < 0)
- #define atomic64_add_negative(i, v) (atomic64_add_ret(i, v) < 0)
-
- #define atomic_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
-+static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
-+{
-+ return cmpxchg(&v->counter, old, new);
-+}
- #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
-+static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
-+{
-+ return xchg(&v->counter, new);
-+}
-
- static inline int atomic_add_unless(atomic_t *v, int a, int u)
- {
-- int c, old;
-+ int c, old, new;
- c = atomic_read(v);
- for (;;) {
-- if (unlikely(c == (u)))
-+ if (unlikely(c == u))
- break;
-- old = atomic_cmpxchg((v), c, c + (a));
-+
-+ asm volatile("addcc %2, %0, %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "tvs %%icc, 6\n"
-+#endif
-+
-+ : "=r" (new)
-+ : "0" (c), "ir" (a)
-+ : "cc");
-+
-+ old = atomic_cmpxchg(v, c, new);
- if (likely(old == c))
- break;
- c = old;
- }
-- return c != (u);
-+ return c != u;
- }
-
- #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
-@@ -90,20 +167,35 @@ static inline int atomic_add_unless(atomic_t *v, int a, int u)
- #define atomic64_cmpxchg(v, o, n) \
- ((__typeof__((v)->counter))cmpxchg(&((v)->counter), (o), (n)))
- #define atomic64_xchg(v, new) (xchg(&((v)->counter), new))
-+static inline long atomic64_xchg_unchecked(atomic64_unchecked_t *v, long new)
-+{
-+ return xchg(&v->counter, new);
-+}
-
- static inline long atomic64_add_unless(atomic64_t *v, long a, long u)
- {
-- long c, old;
-+ long c, old, new;
- c = atomic64_read(v);
- for (;;) {
-- if (unlikely(c == (u)))
-+ if (unlikely(c == u))
- break;
-- old = atomic64_cmpxchg((v), c, c + (a));
-+
-+ asm volatile("addcc %2, %0, %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "tvs %%xcc, 6\n"
-+#endif
-+
-+ : "=r" (new)
-+ : "0" (c), "ir" (a)
-+ : "cc");
-+
-+ old = atomic64_cmpxchg(v, c, new);
- if (likely(old == c))
- break;
- c = old;
- }
-- return c != (u);
-+ return c != u;
- }
-
- #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
-diff --git a/arch/sparc/include/asm/cache.h b/arch/sparc/include/asm/cache.h
-index 41f85ae..73b80b5 100644
---- a/arch/sparc/include/asm/cache.h
-+++ b/arch/sparc/include/asm/cache.h
-@@ -7,8 +7,10 @@
- #ifndef _SPARC_CACHE_H
- #define _SPARC_CACHE_H
-
-+#include <linux/const.h>
-+
- #define L1_CACHE_SHIFT 5
--#define L1_CACHE_BYTES 32
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
- #define L1_CACHE_ALIGN(x) ((((x)+(L1_CACHE_BYTES-1))&~(L1_CACHE_BYTES-1)))
-
- #ifdef CONFIG_SPARC32
-diff --git a/arch/sparc/include/asm/dma-mapping.h b/arch/sparc/include/asm/dma-mapping.h
-index 5a8c308..38def92 100644
---- a/arch/sparc/include/asm/dma-mapping.h
-+++ b/arch/sparc/include/asm/dma-mapping.h
-@@ -14,10 +14,10 @@ extern int dma_set_mask(struct device *dev, u64 dma_mask);
- #define dma_free_noncoherent(d, s, v, h) dma_free_coherent(d, s, v, h)
- #define dma_is_consistent(d, h) (1)
-
--extern struct dma_map_ops *dma_ops, pci32_dma_ops;
-+extern const struct dma_map_ops *dma_ops, pci32_dma_ops;
- extern struct bus_type pci_bus_type;
-
--static inline struct dma_map_ops *get_dma_ops(struct device *dev)
-+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
- {
- #if defined(CONFIG_SPARC32) && defined(CONFIG_PCI)
- if (dev->bus == &pci_bus_type)
-@@ -31,7 +31,7 @@ static inline struct dma_map_ops *get_dma_ops(struct device *dev)
- static inline void *dma_alloc_coherent(struct device *dev, size_t size,
- dma_addr_t *dma_handle, gfp_t flag)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
- void *cpu_addr;
-
- cpu_addr = ops->alloc_coherent(dev, size, dma_handle, flag);
-@@ -42,7 +42,7 @@ static inline void *dma_alloc_coherent(struct device *dev, size_t size,
- static inline void dma_free_coherent(struct device *dev, size_t size,
- void *cpu_addr, dma_addr_t dma_handle)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- debug_dma_free_coherent(dev, size, cpu_addr, dma_handle);
- ops->free_coherent(dev, size, cpu_addr, dma_handle);
-diff --git a/arch/sparc/include/asm/elf_32.h b/arch/sparc/include/asm/elf_32.h
-index 381a1b5..b97e3ff 100644
---- a/arch/sparc/include/asm/elf_32.h
-+++ b/arch/sparc/include/asm/elf_32.h
-@@ -116,6 +116,13 @@ typedef struct {
-
- #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE)
-
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE 0x10000UL
-+
-+#define PAX_DELTA_MMAP_LEN 16
-+#define PAX_DELTA_STACK_LEN 16
-+#endif
-+
- /* This yields a mask that user programs can use to figure out what
- instruction set this cpu supports. This can NOT be done in userspace
- on Sparc. */
-diff --git a/arch/sparc/include/asm/elf_64.h b/arch/sparc/include/asm/elf_64.h
-index 9968085..c2106ef 100644
---- a/arch/sparc/include/asm/elf_64.h
-+++ b/arch/sparc/include/asm/elf_64.h
-@@ -163,6 +163,12 @@ typedef struct {
- #define ELF_ET_DYN_BASE 0x0000010000000000UL
- #define COMPAT_ELF_ET_DYN_BASE 0x0000000070000000UL
-
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT) ? 0x10000UL : 0x100000UL)
-+
-+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT) ? 14 : 28)
-+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT) ? 15 : 29)
-+#endif
-
- /* This yields a mask that user programs can use to figure out what
- instruction set this cpu supports. */
-diff --git a/arch/sparc/include/asm/page_32.h b/arch/sparc/include/asm/page_32.h
-index 156707b..aefa786 100644
---- a/arch/sparc/include/asm/page_32.h
-+++ b/arch/sparc/include/asm/page_32.h
-@@ -8,6 +8,8 @@
- #ifndef _SPARC_PAGE_H
- #define _SPARC_PAGE_H
-
-+#include <linux/const.h>
-+
- #define PAGE_SHIFT 12
-
- #ifndef __ASSEMBLY__
-diff --git a/arch/sparc/include/asm/pgalloc_32.h b/arch/sparc/include/asm/pgalloc_32.h
-index ca2b344..c6084f89 100644
---- a/arch/sparc/include/asm/pgalloc_32.h
-+++ b/arch/sparc/include/asm/pgalloc_32.h
-@@ -37,6 +37,7 @@ BTFIXUPDEF_CALL(void, free_pgd_fast, pgd_t *)
- BTFIXUPDEF_CALL(void, pgd_set, pgd_t *, pmd_t *)
- #define pgd_set(pgdp,pmdp) BTFIXUP_CALL(pgd_set)(pgdp,pmdp)
- #define pgd_populate(MM, PGD, PMD) pgd_set(PGD, PMD)
-+#define pgd_populate_kernel(MM, PGD, PMD) pgd_populate((MM), (PGD), (PMD))
-
- BTFIXUPDEF_CALL(pmd_t *, pmd_alloc_one, struct mm_struct *, unsigned long)
- #define pmd_alloc_one(mm, address) BTFIXUP_CALL(pmd_alloc_one)(mm, address)
-diff --git a/arch/sparc/include/asm/pgalloc_64.h b/arch/sparc/include/asm/pgalloc_64.h
-index 5bdfa2c..92b0706 100644
---- a/arch/sparc/include/asm/pgalloc_64.h
-+++ b/arch/sparc/include/asm/pgalloc_64.h
-@@ -25,6 +25,7 @@ static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
- }
-
- #define pud_populate(MM, PUD, PMD) pud_set(PUD, PMD)
-+#define pud_populate_kernel(MM, PUD, PMD) pud_populate((MM), (PUD), (PMD))
-
- static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long addr)
- {
-diff --git a/arch/sparc/include/asm/pgtable_32.h b/arch/sparc/include/asm/pgtable_32.h
-index e0cabe7..efd60f1 100644
---- a/arch/sparc/include/asm/pgtable_32.h
-+++ b/arch/sparc/include/asm/pgtable_32.h
-@@ -43,6 +43,13 @@ BTFIXUPDEF_SIMM13(user_ptrs_per_pgd)
- BTFIXUPDEF_INT(page_none)
- BTFIXUPDEF_INT(page_copy)
- BTFIXUPDEF_INT(page_readonly)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+BTFIXUPDEF_INT(page_shared_noexec)
-+BTFIXUPDEF_INT(page_copy_noexec)
-+BTFIXUPDEF_INT(page_readonly_noexec)
-+#endif
-+
- BTFIXUPDEF_INT(page_kernel)
-
- #define PMD_SHIFT SUN4C_PMD_SHIFT
-@@ -64,6 +71,16 @@ extern pgprot_t PAGE_SHARED;
- #define PAGE_COPY __pgprot(BTFIXUP_INT(page_copy))
- #define PAGE_READONLY __pgprot(BTFIXUP_INT(page_readonly))
-
-+#ifdef CONFIG_PAX_PAGEEXEC
-+extern pgprot_t PAGE_SHARED_NOEXEC;
-+# define PAGE_COPY_NOEXEC __pgprot(BTFIXUP_INT(page_copy_noexec))
-+# define PAGE_READONLY_NOEXEC __pgprot(BTFIXUP_INT(page_readonly_noexec))
-+#else
-+# define PAGE_SHARED_NOEXEC PAGE_SHARED
-+# define PAGE_COPY_NOEXEC PAGE_COPY
-+# define PAGE_READONLY_NOEXEC PAGE_READONLY
-+#endif
-+
- extern unsigned long page_kernel;
-
- #ifdef MODULE
-diff --git a/arch/sparc/include/asm/pgtsrmmu.h b/arch/sparc/include/asm/pgtsrmmu.h
-index 1407c07..7e10231 100644
---- a/arch/sparc/include/asm/pgtsrmmu.h
-+++ b/arch/sparc/include/asm/pgtsrmmu.h
-@@ -115,6 +115,13 @@
- SRMMU_EXEC | SRMMU_REF)
- #define SRMMU_PAGE_RDONLY __pgprot(SRMMU_VALID | SRMMU_CACHE | \
- SRMMU_EXEC | SRMMU_REF)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+#define SRMMU_PAGE_SHARED_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_WRITE | SRMMU_REF)
-+#define SRMMU_PAGE_COPY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
-+#define SRMMU_PAGE_RDONLY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
-+#endif
-+
- #define SRMMU_PAGE_KERNEL __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_PRIV | \
- SRMMU_DIRTY | SRMMU_REF)
-
-diff --git a/arch/sparc/include/asm/spinlock_64.h b/arch/sparc/include/asm/spinlock_64.h
-index 43e5147..47622a1 100644
---- a/arch/sparc/include/asm/spinlock_64.h
-+++ b/arch/sparc/include/asm/spinlock_64.h
-@@ -92,14 +92,19 @@ static inline void __raw_spin_lock_flags(raw_spinlock_t *lock, unsigned long fla
-
- /* Multi-reader locks, these are much saner than the 32-bit Sparc ones... */
-
--static void inline arch_read_lock(raw_rwlock_t *lock)
-+static inline void arch_read_lock(raw_rwlock_t *lock)
- {
- unsigned long tmp1, tmp2;
-
- __asm__ __volatile__ (
- "1: ldsw [%2], %0\n"
- " brlz,pn %0, 2f\n"
--"4: add %0, 1, %1\n"
-+"4: addcc %0, 1, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+" tvs %%icc, 6\n"
-+#endif
-+
- " cas [%2], %0, %1\n"
- " cmp %0, %1\n"
- " bne,pn %%icc, 1b\n"
-@@ -112,10 +117,10 @@ static void inline arch_read_lock(raw_rwlock_t *lock)
- " .previous"
- : "=&r" (tmp1), "=&r" (tmp2)
- : "r" (lock)
-- : "memory");
-+ : "memory", "cc");
- }
-
--static int inline arch_read_trylock(raw_rwlock_t *lock)
-+static inline int arch_read_trylock(raw_rwlock_t *lock)
- {
- int tmp1, tmp2;
-
-@@ -123,7 +128,12 @@ static int inline arch_read_trylock(raw_rwlock_t *lock)
- "1: ldsw [%2], %0\n"
- " brlz,a,pn %0, 2f\n"
- " mov 0, %0\n"
--" add %0, 1, %1\n"
-+" addcc %0, 1, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+" tvs %%icc, 6\n"
-+#endif
-+
- " cas [%2], %0, %1\n"
- " cmp %0, %1\n"
- " bne,pn %%icc, 1b\n"
-@@ -136,13 +146,18 @@ static int inline arch_read_trylock(raw_rwlock_t *lock)
- return tmp1;
- }
-
--static void inline arch_read_unlock(raw_rwlock_t *lock)
-+static inline void arch_read_unlock(raw_rwlock_t *lock)
- {
- unsigned long tmp1, tmp2;
-
- __asm__ __volatile__(
- "1: lduw [%2], %0\n"
--" sub %0, 1, %1\n"
-+" subcc %0, 1, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+" tvs %%icc, 6\n"
-+#endif
-+
- " cas [%2], %0, %1\n"
- " cmp %0, %1\n"
- " bne,pn %%xcc, 1b\n"
-@@ -152,7 +167,7 @@ static void inline arch_read_unlock(raw_rwlock_t *lock)
- : "memory");
- }
-
--static void inline arch_write_lock(raw_rwlock_t *lock)
-+static inline void arch_write_lock(raw_rwlock_t *lock)
- {
- unsigned long mask, tmp1, tmp2;
-
-@@ -177,7 +192,7 @@ static void inline arch_write_lock(raw_rwlock_t *lock)
- : "memory");
- }
-
--static void inline arch_write_unlock(raw_rwlock_t *lock)
-+static inline void arch_write_unlock(raw_rwlock_t *lock)
- {
- __asm__ __volatile__(
- " stw %%g0, [%0]"
-@@ -186,7 +201,7 @@ static void inline arch_write_unlock(raw_rwlock_t *lock)
- : "memory");
- }
-
--static int inline arch_write_trylock(raw_rwlock_t *lock)
-+static inline int arch_write_trylock(raw_rwlock_t *lock)
- {
- unsigned long mask, tmp1, tmp2, result;
-
-diff --git a/arch/sparc/include/asm/thread_info_32.h b/arch/sparc/include/asm/thread_info_32.h
-index 844d73a..f787fb9 100644
---- a/arch/sparc/include/asm/thread_info_32.h
-+++ b/arch/sparc/include/asm/thread_info_32.h
-@@ -50,6 +50,8 @@ struct thread_info {
- unsigned long w_saved;
-
- struct restart_block restart_block;
-+
-+ unsigned long lowest_stack;
- };
-
- /*
-diff --git a/arch/sparc/include/asm/thread_info_64.h b/arch/sparc/include/asm/thread_info_64.h
-index f78ad9a..a3213ed 100644
---- a/arch/sparc/include/asm/thread_info_64.h
-+++ b/arch/sparc/include/asm/thread_info_64.h
-@@ -68,6 +68,8 @@ struct thread_info {
- struct pt_regs *kern_una_regs;
- unsigned int kern_una_insn;
-
-+ unsigned long lowest_stack;
-+
- unsigned long fpregs[0] __attribute__ ((aligned(64)));
- };
-
-@@ -227,6 +229,8 @@ register struct thread_info *current_thread_info_reg asm("g6");
- /* flag bit 8 is available */
- #define TIF_SECCOMP 9 /* secure computing */
- #define TIF_SYSCALL_AUDIT 10 /* syscall auditing active */
-+#define TIF_GRSEC_SETXID 11 /* update credentials on syscall entry/exit */
-+
- /* NOTE: Thread flags >= 12 should be ones we have no interest
- * in using in assembly, else we can't use the mask as
- * an immediate value in instructions such as andcc.
-@@ -247,12 +251,18 @@ register struct thread_info *current_thread_info_reg asm("g6");
- #define _TIF_SYSCALL_AUDIT (1<<TIF_SYSCALL_AUDIT)
- #define _TIF_POLLING_NRFLAG (1<<TIF_POLLING_NRFLAG)
- #define _TIF_FREEZE (1<<TIF_FREEZE)
-+#define _TIF_GRSEC_SETXID (1<<TIF_GRSEC_SETXID)
-
- #define _TIF_USER_WORK_MASK ((0xff << TI_FLAG_WSAVED_SHIFT) | \
- _TIF_DO_NOTIFY_RESUME_MASK | \
- _TIF_NEED_RESCHED | _TIF_PERFCTR)
- #define _TIF_DO_NOTIFY_RESUME_MASK (_TIF_NOTIFY_RESUME | _TIF_SIGPENDING)
-
-+#define _TIF_WORK_SYSCALL \
-+ (_TIF_SYSCALL_TRACE | _TIF_SECCOMP | _TIF_SYSCALL_AUDIT | \
-+ _TIF_GRSEC_SETXID)
-+
-+
- /*
- * Thread-synchronous status.
- *
-diff --git a/arch/sparc/include/asm/uaccess.h b/arch/sparc/include/asm/uaccess.h
-index e88fbe5..bd0eda7 100644
---- a/arch/sparc/include/asm/uaccess.h
-+++ b/arch/sparc/include/asm/uaccess.h
-@@ -1,5 +1,6 @@
- #ifndef ___ASM_SPARC_UACCESS_H
- #define ___ASM_SPARC_UACCESS_H
-+
- #if defined(__sparc__) && defined(__arch64__)
- #include <asm/uaccess_64.h>
- #else
-diff --git a/arch/sparc/include/asm/uaccess_32.h b/arch/sparc/include/asm/uaccess_32.h
-index 8303ac4..07f333d 100644
---- a/arch/sparc/include/asm/uaccess_32.h
-+++ b/arch/sparc/include/asm/uaccess_32.h
-@@ -249,27 +249,46 @@ extern unsigned long __copy_user(void __user *to, const void __user *from, unsig
-
- static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
- {
-- if (n && __access_ok((unsigned long) to, n))
-+ if ((long)n < 0)
-+ return n;
-+
-+ if (n && __access_ok((unsigned long) to, n)) {
-+ if (!__builtin_constant_p(n))
-+ check_object_size(from, n, true);
- return __copy_user(to, (__force void __user *) from, n);
-- else
-+ } else
- return n;
- }
-
- static inline unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n)
- {
-+ if ((long)n < 0)
-+ return n;
-+
-+ if (!__builtin_constant_p(n))
-+ check_object_size(from, n, true);
-+
- return __copy_user(to, (__force void __user *) from, n);
- }
-
- static inline unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
- {
-- if (n && __access_ok((unsigned long) from, n))
-+ if ((long)n < 0)
-+ return n;
-+
-+ if (n && __access_ok((unsigned long) from, n)) {
-+ if (!__builtin_constant_p(n))
-+ check_object_size(to, n, false);
- return __copy_user((__force void __user *) to, from, n);
-- else
-+ } else
- return n;
- }
-
- static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
- {
-+ if ((long)n < 0)
-+ return n;
-+
- return __copy_user((__force void __user *) to, from, n);
- }
-
-diff --git a/arch/sparc/include/asm/uaccess_64.h b/arch/sparc/include/asm/uaccess_64.h
-index 9ea271e..7b8a271 100644
---- a/arch/sparc/include/asm/uaccess_64.h
-+++ b/arch/sparc/include/asm/uaccess_64.h
-@@ -9,6 +9,7 @@
- #include <linux/compiler.h>
- #include <linux/string.h>
- #include <linux/thread_info.h>
-+#include <linux/kernel.h>
- #include <asm/asi.h>
- #include <asm/system.h>
- #include <asm/spitfire.h>
-@@ -212,8 +213,15 @@ extern unsigned long copy_from_user_fixup(void *to, const void __user *from,
- static inline unsigned long __must_check
- copy_from_user(void *to, const void __user *from, unsigned long size)
- {
-- unsigned long ret = ___copy_from_user(to, from, size);
-+ unsigned long ret;
-
-+ if ((long)size < 0 || size > INT_MAX)
-+ return size;
-+
-+ if (!__builtin_constant_p(size))
-+ check_object_size(to, size, false);
-+
-+ ret = ___copy_from_user(to, from, size);
- if (unlikely(ret))
- ret = copy_from_user_fixup(to, from, size);
- return ret;
-@@ -228,8 +236,15 @@ extern unsigned long copy_to_user_fixup(void __user *to, const void *from,
- static inline unsigned long __must_check
- copy_to_user(void __user *to, const void *from, unsigned long size)
- {
-- unsigned long ret = ___copy_to_user(to, from, size);
-+ unsigned long ret;
-
-+ if ((long)size < 0 || size > INT_MAX)
-+ return size;
-+
-+ if (!__builtin_constant_p(size))
-+ check_object_size(from, size, true);
-+
-+ ret = ___copy_to_user(to, from, size);
- if (unlikely(ret))
- ret = copy_to_user_fixup(to, from, size);
- return ret;
-diff --git a/arch/sparc/kernel/Makefile b/arch/sparc/kernel/Makefile
-index 2782681..77ded84 100644
---- a/arch/sparc/kernel/Makefile
-+++ b/arch/sparc/kernel/Makefile
-@@ -3,7 +3,7 @@
- #
-
- asflags-y := -ansi
--ccflags-y := -Werror
-+#ccflags-y := -Werror
-
- extra-y := head_$(BITS).o
- extra-y += init_task.o
-diff --git a/arch/sparc/kernel/ds.c b/arch/sparc/kernel/ds.c
-index 6a831bd..b37a849 100644
---- a/arch/sparc/kernel/ds.c
-+++ b/arch/sparc/kernel/ds.c
-@@ -780,6 +780,16 @@ void ldom_set_var(const char *var, const char *value)
- char *base, *p;
- int msg_len, loops;
-
-+ if (strlen(var) + strlen(value) + 2 >
-+ sizeof(pkt) - sizeof(pkt.header)) {
-+ printk(KERN_ERR PFX
-+ "contents length: %zu, which more than max: %lu,"
-+ "so could not set (%s) variable to (%s).\n",
-+ strlen(var) + strlen(value) + 2,
-+ sizeof(pkt) - sizeof(pkt.header), var, value);
-+ return;
-+ }
-+
- memset(&pkt, 0, sizeof(pkt));
- pkt.header.data.tag.type = DS_DATA;
- pkt.header.data.handle = cp->handle;
-diff --git a/arch/sparc/kernel/iommu.c b/arch/sparc/kernel/iommu.c
-index 7690cc2..ece64c9 100644
---- a/arch/sparc/kernel/iommu.c
-+++ b/arch/sparc/kernel/iommu.c
-@@ -826,7 +826,7 @@ static void dma_4u_sync_sg_for_cpu(struct device *dev,
- spin_unlock_irqrestore(&iommu->lock, flags);
- }
-
--static struct dma_map_ops sun4u_dma_ops = {
-+static const struct dma_map_ops sun4u_dma_ops = {
- .alloc_coherent = dma_4u_alloc_coherent,
- .free_coherent = dma_4u_free_coherent,
- .map_page = dma_4u_map_page,
-@@ -837,7 +837,7 @@ static struct dma_map_ops sun4u_dma_ops = {
- .sync_sg_for_cpu = dma_4u_sync_sg_for_cpu,
- };
-
--struct dma_map_ops *dma_ops = &sun4u_dma_ops;
-+const struct dma_map_ops *dma_ops = &sun4u_dma_ops;
- EXPORT_SYMBOL(dma_ops);
-
- extern int pci64_dma_supported(struct pci_dev *pdev, u64 device_mask);
-diff --git a/arch/sparc/kernel/ioport.c b/arch/sparc/kernel/ioport.c
-index 9f61fd8..bd048db 100644
---- a/arch/sparc/kernel/ioport.c
-+++ b/arch/sparc/kernel/ioport.c
-@@ -392,7 +392,7 @@ static void sbus_sync_sg_for_device(struct device *dev, struct scatterlist *sg,
- BUG();
- }
-
--struct dma_map_ops sbus_dma_ops = {
-+const struct dma_map_ops sbus_dma_ops = {
- .alloc_coherent = sbus_alloc_coherent,
- .free_coherent = sbus_free_coherent,
- .map_page = sbus_map_page,
-@@ -403,7 +403,7 @@ struct dma_map_ops sbus_dma_ops = {
- .sync_sg_for_device = sbus_sync_sg_for_device,
- };
-
--struct dma_map_ops *dma_ops = &sbus_dma_ops;
-+const struct dma_map_ops *dma_ops = &sbus_dma_ops;
- EXPORT_SYMBOL(dma_ops);
-
- static int __init sparc_register_ioport(void)
-@@ -640,7 +640,7 @@ static void pci32_sync_sg_for_device(struct device *device, struct scatterlist *
- }
- }
-
--struct dma_map_ops pci32_dma_ops = {
-+const struct dma_map_ops pci32_dma_ops = {
- .alloc_coherent = pci32_alloc_coherent,
- .free_coherent = pci32_free_coherent,
- .map_page = pci32_map_page,
-diff --git a/arch/sparc/kernel/kgdb_32.c b/arch/sparc/kernel/kgdb_32.c
-index 04df4ed..55c4b6e 100644
---- a/arch/sparc/kernel/kgdb_32.c
-+++ b/arch/sparc/kernel/kgdb_32.c
-@@ -158,7 +158,7 @@ void kgdb_arch_exit(void)
- {
- }
-
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- /* Breakpoint instruction: ta 0x7d */
- .gdb_bpt_instr = { 0x91, 0xd0, 0x20, 0x7d },
- };
-diff --git a/arch/sparc/kernel/kgdb_64.c b/arch/sparc/kernel/kgdb_64.c
-index f5a0fd4..d886f71 100644
---- a/arch/sparc/kernel/kgdb_64.c
-+++ b/arch/sparc/kernel/kgdb_64.c
-@@ -180,7 +180,7 @@ void kgdb_arch_exit(void)
- {
- }
-
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- /* Breakpoint instruction: ta 0x72 */
- .gdb_bpt_instr = { 0x91, 0xd0, 0x20, 0x72 },
- };
-diff --git a/arch/sparc/kernel/pci_sun4v.c b/arch/sparc/kernel/pci_sun4v.c
-index 23c33ff..d137fbd 100644
---- a/arch/sparc/kernel/pci_sun4v.c
-+++ b/arch/sparc/kernel/pci_sun4v.c
-@@ -525,7 +525,7 @@ static void dma_4v_unmap_sg(struct device *dev, struct scatterlist *sglist,
- spin_unlock_irqrestore(&iommu->lock, flags);
- }
-
--static struct dma_map_ops sun4v_dma_ops = {
-+static const struct dma_map_ops sun4v_dma_ops = {
- .alloc_coherent = dma_4v_alloc_coherent,
- .free_coherent = dma_4v_free_coherent,
- .map_page = dma_4v_map_page,
-diff --git a/arch/sparc/kernel/process_32.c b/arch/sparc/kernel/process_32.c
-index c49865b..b41a81b 100644
---- a/arch/sparc/kernel/process_32.c
-+++ b/arch/sparc/kernel/process_32.c
-@@ -196,7 +196,7 @@ void __show_backtrace(unsigned long fp)
- rw->ins[4], rw->ins[5],
- rw->ins[6],
- rw->ins[7]);
-- printk("%pS\n", (void *) rw->ins[7]);
-+ printk("%pA\n", (void *) rw->ins[7]);
- rw = (struct reg_window32 *) rw->ins[6];
- }
- spin_unlock_irqrestore(&sparc_backtrace_lock, flags);
-@@ -263,14 +263,14 @@ void show_regs(struct pt_regs *r)
-
- printk("PSR: %08lx PC: %08lx NPC: %08lx Y: %08lx %s\n",
- r->psr, r->pc, r->npc, r->y, print_tainted());
-- printk("PC: <%pS>\n", (void *) r->pc);
-+ printk("PC: <%pA>\n", (void *) r->pc);
- printk("%%G: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
- r->u_regs[0], r->u_regs[1], r->u_regs[2], r->u_regs[3],
- r->u_regs[4], r->u_regs[5], r->u_regs[6], r->u_regs[7]);
- printk("%%O: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
- r->u_regs[8], r->u_regs[9], r->u_regs[10], r->u_regs[11],
- r->u_regs[12], r->u_regs[13], r->u_regs[14], r->u_regs[15]);
-- printk("RPC: <%pS>\n", (void *) r->u_regs[15]);
-+ printk("RPC: <%pA>\n", (void *) r->u_regs[15]);
-
- printk("%%L: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
- rw->locals[0], rw->locals[1], rw->locals[2], rw->locals[3],
-@@ -305,7 +305,7 @@ void show_stack(struct task_struct *tsk, unsigned long *_ksp)
- rw = (struct reg_window32 *) fp;
- pc = rw->ins[7];
- printk("[%08lx : ", pc);
-- printk("%pS ] ", (void *) pc);
-+ printk("%pA ] ", (void *) pc);
- fp = rw->ins[6];
- } while (++count < 16);
- printk("\n");
-diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
-index cb70476..3d0c191 100644
---- a/arch/sparc/kernel/process_64.c
-+++ b/arch/sparc/kernel/process_64.c
-@@ -180,14 +180,14 @@ static void show_regwindow(struct pt_regs *regs)
- printk("i4: %016lx i5: %016lx i6: %016lx i7: %016lx\n",
- rwk->ins[4], rwk->ins[5], rwk->ins[6], rwk->ins[7]);
- if (regs->tstate & TSTATE_PRIV)
-- printk("I7: <%pS>\n", (void *) rwk->ins[7]);
-+ printk("I7: <%pA>\n", (void *) rwk->ins[7]);
- }
-
- void show_regs(struct pt_regs *regs)
- {
- printk("TSTATE: %016lx TPC: %016lx TNPC: %016lx Y: %08x %s\n", regs->tstate,
- regs->tpc, regs->tnpc, regs->y, print_tainted());
-- printk("TPC: <%pS>\n", (void *) regs->tpc);
-+ printk("TPC: <%pA>\n", (void *) regs->tpc);
- printk("g0: %016lx g1: %016lx g2: %016lx g3: %016lx\n",
- regs->u_regs[0], regs->u_regs[1], regs->u_regs[2],
- regs->u_regs[3]);
-@@ -200,7 +200,7 @@ void show_regs(struct pt_regs *regs)
- printk("o4: %016lx o5: %016lx sp: %016lx ret_pc: %016lx\n",
- regs->u_regs[12], regs->u_regs[13], regs->u_regs[14],
- regs->u_regs[15]);
-- printk("RPC: <%pS>\n", (void *) regs->u_regs[15]);
-+ printk("RPC: <%pA>\n", (void *) regs->u_regs[15]);
- show_regwindow(regs);
- }
-
-@@ -284,7 +284,7 @@ void arch_trigger_all_cpu_backtrace(void)
- ((tp && tp->task) ? tp->task->pid : -1));
-
- if (gp->tstate & TSTATE_PRIV) {
-- printk(" TPC[%pS] O7[%pS] I7[%pS] RPC[%pS]\n",
-+ printk(" TPC[%pA] O7[%pA] I7[%pA] RPC[%pA]\n",
- (void *) gp->tpc,
- (void *) gp->o7,
- (void *) gp->i7,
-diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c
-index 4ae91dc..c2e705e 100644
---- a/arch/sparc/kernel/ptrace_64.c
-+++ b/arch/sparc/kernel/ptrace_64.c
-@@ -1049,6 +1049,10 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
- return ret;
- }
-
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+extern void gr_delayed_cred_worker(void);
-+#endif
-+
- asmlinkage int syscall_trace_enter(struct pt_regs *regs)
- {
- int ret = 0;
-@@ -1056,6 +1060,11 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
- /* do the secure computing check first */
- secure_computing(regs->u_regs[UREG_G1]);
-
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+ if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
-+ gr_delayed_cred_worker();
-+#endif
-+
- if (test_thread_flag(TIF_SYSCALL_TRACE))
- ret = tracehook_report_syscall_entry(regs);
-
-@@ -1074,6 +1083,11 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
-
- asmlinkage void syscall_trace_leave(struct pt_regs *regs)
- {
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+ if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
-+ gr_delayed_cred_worker();
-+#endif
-+
- if (unlikely(current->audit_context)) {
- unsigned long tstate = regs->tstate;
- int result = AUDITSC_SUCCESS;
-diff --git a/arch/sparc/kernel/sigutil_64.c b/arch/sparc/kernel/sigutil_64.c
-index 6edc4e5..06a69b4 100644
---- a/arch/sparc/kernel/sigutil_64.c
-+++ b/arch/sparc/kernel/sigutil_64.c
-@@ -2,6 +2,7 @@
- #include <linux/types.h>
- #include <linux/thread_info.h>
- #include <linux/uaccess.h>
-+#include <linux/errno.h>
-
- #include <asm/sigcontext.h>
- #include <asm/fpumacro.h>
-diff --git a/arch/sparc/kernel/sys_sparc_32.c b/arch/sparc/kernel/sys_sparc_32.c
-index 3a82e65..c066b9b 100644
---- a/arch/sparc/kernel/sys_sparc_32.c
-+++ b/arch/sparc/kernel/sys_sparc_32.c
-@@ -40,6 +40,7 @@ asmlinkage unsigned long sys_getpagesize(void)
- unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsigned long len, unsigned long pgoff, unsigned long flags)
- {
- struct vm_area_struct * vmm;
-+ unsigned long offset = gr_rand_threadstack_offset(current->mm, filp, flags);
-
- if (flags & MAP_FIXED) {
- /* We do not accept a shared mapping if it would violate
-@@ -57,7 +58,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
- if (ARCH_SUN4C && len > 0x20000000)
- return -ENOMEM;
- if (!addr)
-- addr = TASK_UNMAPPED_BASE;
-+ addr = current->mm->mmap_base;
-
- if (flags & MAP_SHARED)
- addr = COLOUR_ALIGN(addr);
-@@ -72,7 +73,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
- }
- if (TASK_SIZE - PAGE_SIZE - len < addr)
- return -ENOMEM;
-- if (!vmm || addr + len <= vmm->vm_start)
-+ if (check_heap_stack_gap(vmm, &addr, len, offset))
- return addr;
- addr = vmm->vm_end;
- if (flags & MAP_SHARED)
-diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
-index cfa0e19..fd81c1b 100644
---- a/arch/sparc/kernel/sys_sparc_64.c
-+++ b/arch/sparc/kernel/sys_sparc_64.c
-@@ -120,12 +120,13 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
- unsigned long task_size = TASK_SIZE;
- unsigned long start_addr;
- int do_color_align;
-+ unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
-
- if (flags & MAP_FIXED) {
- /* We do not accept a shared mapping if it would violate
- * cache aliasing constraints.
- */
-- if ((flags & MAP_SHARED) &&
-+ if ((filp || (flags & MAP_SHARED)) &&
- ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
- return -EINVAL;
- return addr;
-@@ -140,6 +141,10 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
- if (filp || (flags & MAP_SHARED))
- do_color_align = 1;
-
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- if (addr) {
- if (do_color_align)
- addr = COLOUR_ALIGN(addr, pgoff);
-@@ -147,15 +152,14 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
- addr = PAGE_ALIGN(addr);
-
- vma = find_vma(mm, addr);
-- if (task_size - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-+ if (task_size - len >= addr && check_heap_stack_gap(vma, &addr, len, offset))
- return addr;
- }
-
- if (len > mm->cached_hole_size) {
-- start_addr = addr = mm->free_area_cache;
-+ start_addr = addr = mm->free_area_cache;
- } else {
-- start_addr = addr = TASK_UNMAPPED_BASE;
-+ start_addr = addr = mm->mmap_base;
- mm->cached_hole_size = 0;
- }
-
-@@ -175,14 +179,14 @@ full_search:
- vma = find_vma(mm, VA_EXCLUDE_END);
- }
- if (unlikely(task_size < addr)) {
-- if (start_addr != TASK_UNMAPPED_BASE) {
-- start_addr = addr = TASK_UNMAPPED_BASE;
-+ if (start_addr != mm->mmap_base) {
-+ start_addr = addr = mm->mmap_base;
- mm->cached_hole_size = 0;
- goto full_search;
- }
- return -ENOMEM;
- }
-- if (likely(!vma || addr + len <= vma->vm_start)) {
-+ if (likely(check_heap_stack_gap(vma, &addr, len, offset))) {
- /*
- * Remember the place where we stopped the search:
- */
-@@ -208,6 +212,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- unsigned long task_size = STACK_TOP32;
- unsigned long addr = addr0;
- int do_color_align;
-+ unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
-
- /* This should only ever run for 32-bit processes. */
- BUG_ON(!test_thread_flag(TIF_32BIT));
-@@ -216,7 +221,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- /* We do not accept a shared mapping if it would violate
- * cache aliasing constraints.
- */
-- if ((flags & MAP_SHARED) &&
-+ if ((filp || (flags & MAP_SHARED)) &&
- ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
- return -EINVAL;
- return addr;
-@@ -237,8 +242,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- addr = PAGE_ALIGN(addr);
-
- vma = find_vma(mm, addr);
-- if (task_size - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-+ if (task_size - len >= addr && check_heap_stack_gap(vma, &addr, len, offset))
- return addr;
- }
-
-@@ -258,28 +262,29 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
-
- /* make sure it can fit in the remaining address space */
- if (likely(addr > len)) {
-- vma = find_vma(mm, addr-len);
-- if (!vma || addr <= vma->vm_start) {
-+ addr -= len;
-+ vma = find_vma(mm, addr);
-+ if (check_heap_stack_gap(vma, &addr, len, offset)) {
- /* remember the address as a hint for next time */
-- return (mm->free_area_cache = addr-len);
-+ return (mm->free_area_cache = addr);
- }
- }
-
- if (unlikely(mm->mmap_base < len))
- goto bottomup;
-
-- addr = mm->mmap_base-len;
-- if (do_color_align)
-- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
-+ addr = mm->mmap_base - len;
-
- do {
-+ if (do_color_align)
-+ addr = COLOUR_ALIGN_DOWN(addr, pgoff);
- /*
- * Lookup failure means no vma is above this address,
- * else if new region fits below vma->vm_start,
- * return with success:
- */
- vma = find_vma(mm, addr);
-- if (likely(!vma || addr+len <= vma->vm_start)) {
-+ if (likely(check_heap_stack_gap(vma, &addr, len, offset))) {
- /* remember the address as a hint for next time */
- return (mm->free_area_cache = addr);
- }
-@@ -289,10 +294,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- mm->cached_hole_size = vma->vm_start - addr;
-
- /* try just below the current vma->vm_start */
-- addr = vma->vm_start-len;
-- if (do_color_align)
-- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
-- } while (likely(len < vma->vm_start));
-+ addr = skip_heap_stack_gap(vma, len, offset);
-+ } while (!IS_ERR_VALUE(addr));
-
- bottomup:
- /*
-@@ -366,6 +369,10 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
- {
- unsigned long random_factor = 0UL;
-
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- if (current->flags & PF_RANDOMIZE) {
- random_factor = get_random_int();
- if (test_thread_flag(TIF_32BIT))
-@@ -384,6 +391,12 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
- current->signal->rlim[RLIMIT_STACK].rlim_cur == RLIM_INFINITY ||
- sysctl_legacy_va_layout) {
- mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- mm->get_unmapped_area = arch_get_unmapped_area;
- mm->unmap_area = arch_unmap_area;
- } else {
-@@ -398,6 +411,12 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
- gap = (task_size / 6 * 5);
-
- mm->mmap_base = PAGE_ALIGN(task_size - gap - random_factor);
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
-+#endif
-+
- mm->get_unmapped_area = arch_get_unmapped_area_topdown;
- mm->unmap_area = arch_unmap_area_topdown;
- }
-diff --git a/arch/sparc/kernel/syscalls.S b/arch/sparc/kernel/syscalls.S
-index d150c2a..bffda9d 100644
---- a/arch/sparc/kernel/syscalls.S
-+++ b/arch/sparc/kernel/syscalls.S
-@@ -62,7 +62,7 @@ sys32_rt_sigreturn:
- #endif
- .align 32
- 1: ldx [%g6 + TI_FLAGS], %l5
-- andcc %l5, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT), %g0
-+ andcc %l5, _TIF_WORK_SYSCALL, %g0
- be,pt %icc, rtrap
- nop
- call syscall_trace_leave
-@@ -198,7 +198,7 @@ linux_sparc_syscall32:
-
- srl %i5, 0, %o5 ! IEU1
- srl %i2, 0, %o2 ! IEU0 Group
-- andcc %l0, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT), %g0
-+ andcc %l0, _TIF_WORK_SYSCALL, %g0
- bne,pn %icc, linux_syscall_trace32 ! CTI
- mov %i0, %l5 ! IEU1
- call %l7 ! CTI Group brk forced
-@@ -221,7 +221,7 @@ linux_sparc_syscall:
-
- mov %i3, %o3 ! IEU1
- mov %i4, %o4 ! IEU0 Group
-- andcc %l0, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT), %g0
-+ andcc %l0, _TIF_WORK_SYSCALL, %g0
- bne,pn %icc, linux_syscall_trace ! CTI Group
- mov %i0, %l5 ! IEU0
- 2: call %l7 ! CTI Group brk forced
-@@ -245,7 +245,7 @@ ret_sys_call:
-
- cmp %o0, -ERESTART_RESTARTBLOCK
- bgeu,pn %xcc, 1f
-- andcc %l0, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT), %l6
-+ andcc %l0, _TIF_WORK_SYSCALL, %l6
- 80:
- /* System call success, clear Carry condition code. */
- andn %g3, %g2, %g3
-@@ -260,7 +260,7 @@ ret_sys_call:
- /* System call failure, set Carry condition code.
- * Also, get abs(errno) to return to the process.
- */
-- andcc %l0, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT), %l6
-+ andcc %l0, _TIF_WORK_SYSCALL, %l6
- sub %g0, %o0, %o0
- or %g3, %g2, %g3
- stx %o0, [%sp + PTREGS_OFF + PT_V9_I0]
-diff --git a/arch/sparc/kernel/traps_32.c b/arch/sparc/kernel/traps_32.c
-index c0490c7..84959d1 100644
---- a/arch/sparc/kernel/traps_32.c
-+++ b/arch/sparc/kernel/traps_32.c
-@@ -44,6 +44,8 @@ static void instruction_dump(unsigned long *pc)
- #define __SAVE __asm__ __volatile__("save %sp, -0x40, %sp\n\t")
- #define __RESTORE __asm__ __volatile__("restore %g0, %g0, %g0\n\t")
-
-+extern void gr_handle_kernel_exploit(void);
-+
- void die_if_kernel(char *str, struct pt_regs *regs)
- {
- static int die_counter;
-@@ -76,15 +78,17 @@ void die_if_kernel(char *str, struct pt_regs *regs)
- count++ < 30 &&
- (((unsigned long) rw) >= PAGE_OFFSET) &&
- !(((unsigned long) rw) & 0x7)) {
-- printk("Caller[%08lx]: %pS\n", rw->ins[7],
-+ printk("Caller[%08lx]: %pA\n", rw->ins[7],
- (void *) rw->ins[7]);
- rw = (struct reg_window32 *)rw->ins[6];
- }
- }
- printk("Instruction DUMP:");
- instruction_dump ((unsigned long *) regs->pc);
-- if(regs->psr & PSR_PS)
-+ if(regs->psr & PSR_PS) {
-+ gr_handle_kernel_exploit();
- do_exit(SIGKILL);
-+ }
- do_exit(SIGSEGV);
- }
-
-diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c
-index 10f7bb9..cdb6793 100644
---- a/arch/sparc/kernel/traps_64.c
-+++ b/arch/sparc/kernel/traps_64.c
-@@ -73,7 +73,7 @@ static void dump_tl1_traplog(struct tl1_traplog *p)
- i + 1,
- p->trapstack[i].tstate, p->trapstack[i].tpc,
- p->trapstack[i].tnpc, p->trapstack[i].tt);
-- printk("TRAPLOG: TPC<%pS>\n", (void *) p->trapstack[i].tpc);
-+ printk("TRAPLOG: TPC<%pA>\n", (void *) p->trapstack[i].tpc);
- }
- }
-
-@@ -93,6 +93,12 @@ void bad_trap(struct pt_regs *regs, long lvl)
-
- lvl -= 0x100;
- if (regs->tstate & TSTATE_PRIV) {
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ if (lvl == 6)
-+ pax_report_refcount_overflow(regs);
-+#endif
-+
- sprintf(buffer, "Kernel bad sw trap %lx", lvl);
- die_if_kernel(buffer, regs);
- }
-@@ -111,11 +117,16 @@ void bad_trap(struct pt_regs *regs, long lvl)
- void bad_trap_tl1(struct pt_regs *regs, long lvl)
- {
- char buffer[32];
--
-+
- if (notify_die(DIE_TRAP_TL1, "bad trap tl1", regs,
- 0, lvl, SIGTRAP) == NOTIFY_STOP)
- return;
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+ if (lvl == 6)
-+ pax_report_refcount_overflow(regs);
-+#endif
-+
- dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
-
- sprintf (buffer, "Bad trap %lx at tl>0", lvl);
-@@ -1139,7 +1150,7 @@ static void cheetah_log_errors(struct pt_regs *regs, struct cheetah_err_info *in
- regs->tpc, regs->tnpc, regs->u_regs[UREG_I7], regs->tstate);
- printk("%s" "ERROR(%d): ",
- (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id());
-- printk("TPC<%pS>\n", (void *) regs->tpc);
-+ printk("TPC<%pA>\n", (void *) regs->tpc);
- printk("%s" "ERROR(%d): M_SYND(%lx), E_SYND(%lx)%s%s\n",
- (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id(),
- (afsr & CHAFSR_M_SYNDROME) >> CHAFSR_M_SYNDROME_SHIFT,
-@@ -1746,7 +1757,7 @@ void cheetah_plus_parity_error(int type, struct pt_regs *regs)
- smp_processor_id(),
- (type & 0x1) ? 'I' : 'D',
- regs->tpc);
-- printk(KERN_EMERG "TPC<%pS>\n", (void *) regs->tpc);
-+ printk(KERN_EMERG "TPC<%pA>\n", (void *) regs->tpc);
- panic("Irrecoverable Cheetah+ parity error.");
- }
-
-@@ -1754,7 +1765,7 @@ void cheetah_plus_parity_error(int type, struct pt_regs *regs)
- smp_processor_id(),
- (type & 0x1) ? 'I' : 'D',
- regs->tpc);
-- printk(KERN_WARNING "TPC<%pS>\n", (void *) regs->tpc);
-+ printk(KERN_WARNING "TPC<%pA>\n", (void *) regs->tpc);
- }
-
- struct sun4v_error_entry {
-@@ -1961,9 +1972,9 @@ void sun4v_itlb_error_report(struct pt_regs *regs, int tl)
-
- printk(KERN_EMERG "SUN4V-ITLB: Error at TPC[%lx], tl %d\n",
- regs->tpc, tl);
-- printk(KERN_EMERG "SUN4V-ITLB: TPC<%pS>\n", (void *) regs->tpc);
-+ printk(KERN_EMERG "SUN4V-ITLB: TPC<%pA>\n", (void *) regs->tpc);
- printk(KERN_EMERG "SUN4V-ITLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
-- printk(KERN_EMERG "SUN4V-ITLB: O7<%pS>\n",
-+ printk(KERN_EMERG "SUN4V-ITLB: O7<%pA>\n",
- (void *) regs->u_regs[UREG_I7]);
- printk(KERN_EMERG "SUN4V-ITLB: vaddr[%lx] ctx[%lx] "
- "pte[%lx] error[%lx]\n",
-@@ -1985,9 +1996,9 @@ void sun4v_dtlb_error_report(struct pt_regs *regs, int tl)
-
- printk(KERN_EMERG "SUN4V-DTLB: Error at TPC[%lx], tl %d\n",
- regs->tpc, tl);
-- printk(KERN_EMERG "SUN4V-DTLB: TPC<%pS>\n", (void *) regs->tpc);
-+ printk(KERN_EMERG "SUN4V-DTLB: TPC<%pA>\n", (void *) regs->tpc);
- printk(KERN_EMERG "SUN4V-DTLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
-- printk(KERN_EMERG "SUN4V-DTLB: O7<%pS>\n",
-+ printk(KERN_EMERG "SUN4V-DTLB: O7<%pA>\n",
- (void *) regs->u_regs[UREG_I7]);
- printk(KERN_EMERG "SUN4V-DTLB: vaddr[%lx] ctx[%lx] "
- "pte[%lx] error[%lx]\n",
-@@ -2191,7 +2202,7 @@ void show_stack(struct task_struct *tsk, unsigned long *_ksp)
- fp = (unsigned long)sf->fp + STACK_BIAS;
- }
-
-- printk(" [%016lx] %pS\n", pc, (void *) pc);
-+ printk(" [%016lx] %pA\n", pc, (void *) pc);
- } while (++count < 16);
- }
-
-@@ -2233,6 +2244,8 @@ static inline struct reg_window *kernel_stack_up(struct reg_window *rw)
- return (struct reg_window *) (fp + STACK_BIAS);
- }
-
-+extern void gr_handle_kernel_exploit(void);
-+
- void die_if_kernel(char *str, struct pt_regs *regs)
- {
- static int die_counter;
-@@ -2260,7 +2273,7 @@ void die_if_kernel(char *str, struct pt_regs *regs)
- while (rw &&
- count++ < 30&&
- is_kernel_stack(current, rw)) {
-- printk("Caller[%016lx]: %pS\n", rw->ins[7],
-+ printk("Caller[%016lx]: %pA\n", rw->ins[7],
- (void *) rw->ins[7]);
-
- rw = kernel_stack_up(rw);
-@@ -2273,8 +2286,11 @@ void die_if_kernel(char *str, struct pt_regs *regs)
- }
- user_instruction_dump ((unsigned int __user *) regs->tpc);
- }
-- if (regs->tstate & TSTATE_PRIV)
-+ if (regs->tstate & TSTATE_PRIV) {
-+ gr_handle_kernel_exploit();
- do_exit(SIGKILL);
-+ }
-+
- do_exit(SIGSEGV);
- }
- EXPORT_SYMBOL(die_if_kernel);
-diff --git a/arch/sparc/kernel/una_asm_64.S b/arch/sparc/kernel/una_asm_64.S
-index be183fe..1c8d332 100644
---- a/arch/sparc/kernel/una_asm_64.S
-+++ b/arch/sparc/kernel/una_asm_64.S
-@@ -127,7 +127,7 @@ do_int_load:
- wr %o5, 0x0, %asi
- retl
- mov 0, %o0
-- .size __do_int_load, .-__do_int_load
-+ .size do_int_load, .-do_int_load
-
- .section __ex_table,"a"
- .word 4b, __retl_efault
-diff --git a/arch/sparc/kernel/unaligned_64.c b/arch/sparc/kernel/unaligned_64.c
-index 3792099..2af17d8 100644
---- a/arch/sparc/kernel/unaligned_64.c
-+++ b/arch/sparc/kernel/unaligned_64.c
-@@ -288,7 +288,7 @@ static void log_unaligned(struct pt_regs *regs)
- if (count < 5) {
- last_time = jiffies;
- count++;
-- printk("Kernel unaligned access at TPC[%lx] %pS\n",
-+ printk("Kernel unaligned access at TPC[%lx] %pA\n",
- regs->tpc, (void *) regs->tpc);
- }
- }
-diff --git a/arch/sparc/kernel/us3_cpufreq.c b/arch/sparc/kernel/us3_cpufreq.c
-index 365b646..624f037 100644
---- a/arch/sparc/kernel/us3_cpufreq.c
-+++ b/arch/sparc/kernel/us3_cpufreq.c
-@@ -197,6 +197,20 @@ static int us3_freq_cpu_exit(struct cpufreq_policy *policy)
- return 0;
- }
-
-+static int __init us3_freq_init(void);
-+static void __exit us3_freq_exit(void);
-+
-+static struct cpufreq_driver _cpufreq_us3_driver = {
-+ .init = us3_freq_cpu_init,
-+ .verify = us3_freq_verify,
-+ .target = us3_freq_target,
-+ .get = us3_freq_get,
-+ .exit = us3_freq_cpu_exit,
-+ .owner = THIS_MODULE,
-+ .name = "UltraSPARC-III",
-+
-+};
-+
- static int __init us3_freq_init(void)
- {
- unsigned long manuf, impl, ver;
-@@ -214,39 +228,22 @@ static int __init us3_freq_init(void)
- impl == CHEETAH_PLUS_IMPL ||
- impl == JAGUAR_IMPL ||
- impl == PANTHER_IMPL)) {
-- struct cpufreq_driver *driver;
--
- ret = -ENOMEM;
-- driver = kzalloc(sizeof(struct cpufreq_driver), GFP_KERNEL);
-- if (!driver)
-- goto err_out;
--
- us3_freq_table = kzalloc(
- (NR_CPUS * sizeof(struct us3_freq_percpu_info)),
- GFP_KERNEL);
- if (!us3_freq_table)
- goto err_out;
-
-- driver->init = us3_freq_cpu_init;
-- driver->verify = us3_freq_verify;
-- driver->target = us3_freq_target;
-- driver->get = us3_freq_get;
-- driver->exit = us3_freq_cpu_exit;
-- driver->owner = THIS_MODULE,
-- strcpy(driver->name, "UltraSPARC-III");
--
-- cpufreq_us3_driver = driver;
-- ret = cpufreq_register_driver(driver);
-+ cpufreq_us3_driver = &_cpufreq_us3_driver;
-+ ret = cpufreq_register_driver(cpufreq_us3_driver);
- if (ret)
- goto err_out;
-
- return 0;
-
- err_out:
-- if (driver) {
-- kfree(driver);
-- cpufreq_us3_driver = NULL;
-- }
-+ cpufreq_us3_driver = NULL;
- kfree(us3_freq_table);
- us3_freq_table = NULL;
- return ret;
-@@ -259,7 +256,6 @@ static void __exit us3_freq_exit(void)
- {
- if (cpufreq_us3_driver) {
- cpufreq_unregister_driver(cpufreq_us3_driver);
-- kfree(cpufreq_us3_driver);
- cpufreq_us3_driver = NULL;
- kfree(us3_freq_table);
- us3_freq_table = NULL;
-diff --git a/arch/sparc/lib/Makefile b/arch/sparc/lib/Makefile
-index e75faf0..24f12f9 100644
---- a/arch/sparc/lib/Makefile
-+++ b/arch/sparc/lib/Makefile
-@@ -2,7 +2,7 @@
- #
-
- asflags-y := -ansi -DST_DIV0=0x02
--ccflags-y := -Werror
-+#ccflags-y := -Werror
-
- lib-$(CONFIG_SPARC32) += mul.o rem.o sdiv.o udiv.o umul.o urem.o ashrdi3.o
- lib-$(CONFIG_SPARC32) += memcpy.o memset.o
-diff --git a/arch/sparc/lib/atomic_64.S b/arch/sparc/lib/atomic_64.S
-index 0268210..f0291ca 100644
---- a/arch/sparc/lib/atomic_64.S
-+++ b/arch/sparc/lib/atomic_64.S
-@@ -18,7 +18,12 @@
- atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
- BACKOFF_SETUP(%o2)
- 1: lduw [%o1], %g1
-- add %g1, %o0, %g7
-+ addcc %g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %icc, 6
-+#endif
-+
- cas [%o1], %g1, %g7
- cmp %g1, %g7
- bne,pn %icc, 2f
-@@ -28,12 +33,32 @@ atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
- 2: BACKOFF_SPIN(%o2, %o3, 1b)
- .size atomic_add, .-atomic_add
-
-+ .globl atomic_add_unchecked
-+ .type atomic_add_unchecked,#function
-+atomic_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
-+ BACKOFF_SETUP(%o2)
-+1: lduw [%o1], %g1
-+ add %g1, %o0, %g7
-+ cas [%o1], %g1, %g7
-+ cmp %g1, %g7
-+ bne,pn %icc, 2f
-+ nop
-+ retl
-+ nop
-+2: BACKOFF_SPIN(%o2, %o3, 1b)
-+ .size atomic_add_unchecked, .-atomic_add_unchecked
-+
- .globl atomic_sub
- .type atomic_sub,#function
- atomic_sub: /* %o0 = decrement, %o1 = atomic_ptr */
- BACKOFF_SETUP(%o2)
- 1: lduw [%o1], %g1
-- sub %g1, %o0, %g7
-+ subcc %g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %icc, 6
-+#endif
-+
- cas [%o1], %g1, %g7
- cmp %g1, %g7
- bne,pn %icc, 2f
-@@ -43,12 +68,32 @@ atomic_sub: /* %o0 = decrement, %o1 = atomic_ptr */
- 2: BACKOFF_SPIN(%o2, %o3, 1b)
- .size atomic_sub, .-atomic_sub
-
-+ .globl atomic_sub_unchecked
-+ .type atomic_sub_unchecked,#function
-+atomic_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
-+ BACKOFF_SETUP(%o2)
-+1: lduw [%o1], %g1
-+ sub %g1, %o0, %g7
-+ cas [%o1], %g1, %g7
-+ cmp %g1, %g7
-+ bne,pn %icc, 2f
-+ nop
-+ retl
-+ nop
-+2: BACKOFF_SPIN(%o2, %o3, 1b)
-+ .size atomic_sub_unchecked, .-atomic_sub_unchecked
-+
- .globl atomic_add_ret
- .type atomic_add_ret,#function
- atomic_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
- BACKOFF_SETUP(%o2)
- 1: lduw [%o1], %g1
-- add %g1, %o0, %g7
-+ addcc %g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %icc, 6
-+#endif
-+
- cas [%o1], %g1, %g7
- cmp %g1, %g7
- bne,pn %icc, 2f
-@@ -59,12 +104,33 @@ atomic_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
- 2: BACKOFF_SPIN(%o2, %o3, 1b)
- .size atomic_add_ret, .-atomic_add_ret
-
-+ .globl atomic_add_ret_unchecked
-+ .type atomic_add_ret_unchecked,#function
-+atomic_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
-+ BACKOFF_SETUP(%o2)
-+1: lduw [%o1], %g1
-+ addcc %g1, %o0, %g7
-+ cas [%o1], %g1, %g7
-+ cmp %g1, %g7
-+ bne,pn %icc, 2f
-+ add %g7, %o0, %g7
-+ sra %g7, 0, %o0
-+ retl
-+ nop
-+2: BACKOFF_SPIN(%o2, %o3, 1b)
-+ .size atomic_add_ret_unchecked, .-atomic_add_ret_unchecked
-+
- .globl atomic_sub_ret
- .type atomic_sub_ret,#function
- atomic_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
- BACKOFF_SETUP(%o2)
- 1: lduw [%o1], %g1
-- sub %g1, %o0, %g7
-+ subcc %g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %icc, 6
-+#endif
-+
- cas [%o1], %g1, %g7
- cmp %g1, %g7
- bne,pn %icc, 2f
-@@ -80,7 +146,12 @@ atomic_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
- atomic64_add: /* %o0 = increment, %o1 = atomic_ptr */
- BACKOFF_SETUP(%o2)
- 1: ldx [%o1], %g1
-- add %g1, %o0, %g7
-+ addcc %g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %xcc, 6
-+#endif
-+
- casx [%o1], %g1, %g7
- cmp %g1, %g7
- bne,pn %xcc, 2f
-@@ -90,12 +161,32 @@ atomic64_add: /* %o0 = increment, %o1 = atomic_ptr */
- 2: BACKOFF_SPIN(%o2, %o3, 1b)
- .size atomic64_add, .-atomic64_add
-
-+ .globl atomic64_add_unchecked
-+ .type atomic64_add_unchecked,#function
-+atomic64_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
-+ BACKOFF_SETUP(%o2)
-+1: ldx [%o1], %g1
-+ addcc %g1, %o0, %g7
-+ casx [%o1], %g1, %g7
-+ cmp %g1, %g7
-+ bne,pn %xcc, 2f
-+ nop
-+ retl
-+ nop
-+2: BACKOFF_SPIN(%o2, %o3, 1b)
-+ .size atomic64_add_unchecked, .-atomic64_add_unchecked
-+
- .globl atomic64_sub
- .type atomic64_sub,#function
- atomic64_sub: /* %o0 = decrement, %o1 = atomic_ptr */
- BACKOFF_SETUP(%o2)
- 1: ldx [%o1], %g1
-- sub %g1, %o0, %g7
-+ subcc %g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %xcc, 6
-+#endif
-+
- casx [%o1], %g1, %g7
- cmp %g1, %g7
- bne,pn %xcc, 2f
-@@ -105,12 +196,32 @@ atomic64_sub: /* %o0 = decrement, %o1 = atomic_ptr */
- 2: BACKOFF_SPIN(%o2, %o3, 1b)
- .size atomic64_sub, .-atomic64_sub
-
-+ .globl atomic64_sub_unchecked
-+ .type atomic64_sub_unchecked,#function
-+atomic64_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
-+ BACKOFF_SETUP(%o2)
-+1: ldx [%o1], %g1
-+ subcc %g1, %o0, %g7
-+ casx [%o1], %g1, %g7
-+ cmp %g1, %g7
-+ bne,pn %xcc, 2f
-+ nop
-+ retl
-+ nop
-+2: BACKOFF_SPIN(%o2, %o3, 1b)
-+ .size atomic64_sub_unchecked, .-atomic64_sub_unchecked
-+
- .globl atomic64_add_ret
- .type atomic64_add_ret,#function
- atomic64_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
- BACKOFF_SETUP(%o2)
- 1: ldx [%o1], %g1
-- add %g1, %o0, %g7
-+ addcc %g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %xcc, 6
-+#endif
-+
- casx [%o1], %g1, %g7
- cmp %g1, %g7
- bne,pn %xcc, 2f
-@@ -121,12 +232,33 @@ atomic64_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
- 2: BACKOFF_SPIN(%o2, %o3, 1b)
- .size atomic64_add_ret, .-atomic64_add_ret
-
-+ .globl atomic64_add_ret_unchecked
-+ .type atomic64_add_ret_unchecked,#function
-+atomic64_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
-+ BACKOFF_SETUP(%o2)
-+1: ldx [%o1], %g1
-+ addcc %g1, %o0, %g7
-+ casx [%o1], %g1, %g7
-+ cmp %g1, %g7
-+ bne,pn %xcc, 2f
-+ add %g7, %o0, %g7
-+ mov %g7, %o0
-+ retl
-+ nop
-+2: BACKOFF_SPIN(%o2, %o3, 1b)
-+ .size atomic64_add_ret_unchecked, .-atomic64_add_ret_unchecked
-+
- .globl atomic64_sub_ret
- .type atomic64_sub_ret,#function
- atomic64_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
- BACKOFF_SETUP(%o2)
- 1: ldx [%o1], %g1
-- sub %g1, %o0, %g7
-+ subcc %g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %xcc, 6
-+#endif
-+
- casx [%o1], %g1, %g7
- cmp %g1, %g7
- bne,pn %xcc, 2f
-diff --git a/arch/sparc/lib/ksyms.c b/arch/sparc/lib/ksyms.c
-index 704b126..2e79d76 100644
---- a/arch/sparc/lib/ksyms.c
-+++ b/arch/sparc/lib/ksyms.c
-@@ -144,12 +144,18 @@ EXPORT_SYMBOL(__downgrade_write);
-
- /* Atomic counter implementation. */
- EXPORT_SYMBOL(atomic_add);
-+EXPORT_SYMBOL(atomic_add_unchecked);
- EXPORT_SYMBOL(atomic_add_ret);
-+EXPORT_SYMBOL(atomic_add_ret_unchecked);
- EXPORT_SYMBOL(atomic_sub);
-+EXPORT_SYMBOL(atomic_sub_unchecked);
- EXPORT_SYMBOL(atomic_sub_ret);
- EXPORT_SYMBOL(atomic64_add);
-+EXPORT_SYMBOL(atomic64_add_unchecked);
- EXPORT_SYMBOL(atomic64_add_ret);
-+EXPORT_SYMBOL(atomic64_add_ret_unchecked);
- EXPORT_SYMBOL(atomic64_sub);
-+EXPORT_SYMBOL(atomic64_sub_unchecked);
- EXPORT_SYMBOL(atomic64_sub_ret);
-
- /* Atomic bit operations. */
-diff --git a/arch/sparc/lib/rwsem_64.S b/arch/sparc/lib/rwsem_64.S
-index 91a7d29..ce75c29 100644
---- a/arch/sparc/lib/rwsem_64.S
-+++ b/arch/sparc/lib/rwsem_64.S
-@@ -11,7 +11,12 @@
- .globl __down_read
- __down_read:
- 1: lduw [%o0], %g1
-- add %g1, 1, %g7
-+ addcc %g1, 1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %icc, 6
-+#endif
-+
- cas [%o0], %g1, %g7
- cmp %g1, %g7
- bne,pn %icc, 1b
-@@ -33,7 +38,12 @@ __down_read:
- .globl __down_read_trylock
- __down_read_trylock:
- 1: lduw [%o0], %g1
-- add %g1, 1, %g7
-+ addcc %g1, 1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %icc, 6
-+#endif
-+
- cmp %g7, 0
- bl,pn %icc, 2f
- mov 0, %o1
-@@ -51,7 +61,12 @@ __down_write:
- or %g1, %lo(RWSEM_ACTIVE_WRITE_BIAS), %g1
- 1:
- lduw [%o0], %g3
-- add %g3, %g1, %g7
-+ addcc %g3, %g1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %icc, 6
-+#endif
-+
- cas [%o0], %g3, %g7
- cmp %g3, %g7
- bne,pn %icc, 1b
-@@ -77,7 +92,12 @@ __down_write_trylock:
- cmp %g3, 0
- bne,pn %icc, 2f
- mov 0, %o1
-- add %g3, %g1, %g7
-+ addcc %g3, %g1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %icc, 6
-+#endif
-+
- cas [%o0], %g3, %g7
- cmp %g3, %g7
- bne,pn %icc, 1b
-@@ -90,7 +110,12 @@ __down_write_trylock:
- __up_read:
- 1:
- lduw [%o0], %g1
-- sub %g1, 1, %g7
-+ subcc %g1, 1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %icc, 6
-+#endif
-+
- cas [%o0], %g1, %g7
- cmp %g1, %g7
- bne,pn %icc, 1b
-@@ -118,7 +143,12 @@ __up_write:
- or %g1, %lo(RWSEM_ACTIVE_WRITE_BIAS), %g1
- 1:
- lduw [%o0], %g3
-- sub %g3, %g1, %g7
-+ subcc %g3, %g1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %icc, 6
-+#endif
-+
- cas [%o0], %g3, %g7
- cmp %g3, %g7
- bne,pn %icc, 1b
-@@ -143,7 +173,12 @@ __downgrade_write:
- or %g1, %lo(RWSEM_WAITING_BIAS), %g1
- 1:
- lduw [%o0], %g3
-- sub %g3, %g1, %g7
-+ subcc %g3, %g1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %icc, 6
-+#endif
-+
- cas [%o0], %g3, %g7
- cmp %g3, %g7
- bne,pn %icc, 1b
-diff --git a/arch/sparc/mm/Makefile b/arch/sparc/mm/Makefile
-index 79836a7..62f47a2 100644
---- a/arch/sparc/mm/Makefile
-+++ b/arch/sparc/mm/Makefile
-@@ -2,7 +2,7 @@
- #
-
- asflags-y := -ansi
--ccflags-y := -Werror
-+#ccflags-y := -Werror
-
- obj-$(CONFIG_SPARC64) += ultra.o tlb.o tsb.o
- obj-y += fault_$(BITS).o
-diff --git a/arch/sparc/mm/fault_32.c b/arch/sparc/mm/fault_32.c
-index b99f81c..0a112f6 100644
---- a/arch/sparc/mm/fault_32.c
-+++ b/arch/sparc/mm/fault_32.c
-@@ -21,6 +21,9 @@
- #include <linux/interrupt.h>
- #include <linux/module.h>
- #include <linux/kdebug.h>
-+#include <linux/slab.h>
-+#include <linux/pagemap.h>
-+#include <linux/compiler.h>
-
- #include <asm/system.h>
- #include <asm/page.h>
-@@ -167,6 +170,276 @@ static unsigned long compute_si_addr(struct pt_regs *regs, int text_fault)
- return safe_compute_effective_address(regs, insn);
- }
-
-+#ifdef CONFIG_PAX_PAGEEXEC
-+#ifdef CONFIG_PAX_DLRESOLVE
-+static void pax_emuplt_close(struct vm_area_struct *vma)
-+{
-+ vma->vm_mm->call_dl_resolve = 0UL;
-+}
-+
-+static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
-+{
-+ unsigned int *kaddr;
-+
-+ vmf->page = alloc_page(GFP_HIGHUSER);
-+ if (!vmf->page)
-+ return VM_FAULT_OOM;
-+
-+ kaddr = kmap(vmf->page);
-+ memset(kaddr, 0, PAGE_SIZE);
-+ kaddr[0] = 0x9DE3BFA8U; /* save */
-+ flush_dcache_page(vmf->page);
-+ kunmap(vmf->page);
-+ return VM_FAULT_MAJOR;
-+}
-+
-+static const struct vm_operations_struct pax_vm_ops = {
-+ .close = pax_emuplt_close,
-+ .fault = pax_emuplt_fault
-+};
-+
-+static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
-+{
-+ int ret;
-+
-+ vma->vm_mm = current->mm;
-+ vma->vm_start = addr;
-+ vma->vm_end = addr + PAGE_SIZE;
-+ vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
-+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
-+ vma->vm_ops = &pax_vm_ops;
-+
-+ ret = insert_vm_struct(current->mm, vma);
-+ if (ret)
-+ return ret;
-+
-+ ++current->mm->total_vm;
-+ return 0;
-+}
-+#endif
-+
-+/*
-+ * PaX: decide what to do with offenders (regs->pc = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ * 2 when patched PLT trampoline was detected
-+ * 3 when unpatched PLT trampoline was detected
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+ int err;
-+
-+ do { /* PaX: patched PLT emulation #1 */
-+ unsigned int sethi1, sethi2, jmpl;
-+
-+ err = get_user(sethi1, (unsigned int *)regs->pc);
-+ err |= get_user(sethi2, (unsigned int *)(regs->pc+4));
-+ err |= get_user(jmpl, (unsigned int *)(regs->pc+8));
-+
-+ if (err)
-+ break;
-+
-+ if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
-+ (sethi2 & 0xFFC00000U) == 0x03000000U &&
-+ (jmpl & 0xFFFFE000U) == 0x81C06000U)
-+ {
-+ unsigned int addr;
-+
-+ regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
-+ addr = regs->u_regs[UREG_G1];
-+ addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
-+ regs->pc = addr;
-+ regs->npc = addr+4;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: patched PLT emulation #2 */
-+ unsigned int ba;
-+
-+ err = get_user(ba, (unsigned int *)regs->pc);
-+
-+ if (err)
-+ break;
-+
-+ if ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30480000U) {
-+ unsigned int addr;
-+
-+ if ((ba & 0xFFC00000U) == 0x30800000U)
-+ addr = regs->pc + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
-+ else
-+ addr = regs->pc + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
-+ regs->pc = addr;
-+ regs->npc = addr+4;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: patched PLT emulation #3 */
-+ unsigned int sethi, bajmpl, nop;
-+
-+ err = get_user(sethi, (unsigned int *)regs->pc);
-+ err |= get_user(bajmpl, (unsigned int *)(regs->pc+4));
-+ err |= get_user(nop, (unsigned int *)(regs->pc+8));
-+
-+ if (err)
-+ break;
-+
-+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+ ((bajmpl & 0xFFFFE000U) == 0x81C06000U || (bajmpl & 0xFFF80000U) == 0x30480000U) &&
-+ nop == 0x01000000U)
-+ {
-+ unsigned int addr;
-+
-+ addr = (sethi & 0x003FFFFFU) << 10;
-+ regs->u_regs[UREG_G1] = addr;
-+ if ((bajmpl & 0xFFFFE000U) == 0x81C06000U)
-+ addr += (((bajmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
-+ else
-+ addr = regs->pc + ((((bajmpl | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
-+ regs->pc = addr;
-+ regs->npc = addr+4;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: unpatched PLT emulation step 1 */
-+ unsigned int sethi, ba, nop;
-+
-+ err = get_user(sethi, (unsigned int *)regs->pc);
-+ err |= get_user(ba, (unsigned int *)(regs->pc+4));
-+ err |= get_user(nop, (unsigned int *)(regs->pc+8));
-+
-+ if (err)
-+ break;
-+
-+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+ ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
-+ nop == 0x01000000U)
-+ {
-+ unsigned int addr, save, call;
-+
-+ if ((ba & 0xFFC00000U) == 0x30800000U)
-+ addr = regs->pc + 4 + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
-+ else
-+ addr = regs->pc + 4 + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
-+
-+ err = get_user(save, (unsigned int *)addr);
-+ err |= get_user(call, (unsigned int *)(addr+4));
-+ err |= get_user(nop, (unsigned int *)(addr+8));
-+ if (err)
-+ break;
-+
-+#ifdef CONFIG_PAX_DLRESOLVE
-+ if (save == 0x9DE3BFA8U &&
-+ (call & 0xC0000000U) == 0x40000000U &&
-+ nop == 0x01000000U)
-+ {
-+ struct vm_area_struct *vma;
-+ unsigned long call_dl_resolve;
-+
-+ down_read(¤t->mm->mmap_sem);
-+ call_dl_resolve = current->mm->call_dl_resolve;
-+ up_read(¤t->mm->mmap_sem);
-+ if (likely(call_dl_resolve))
-+ goto emulate;
-+
-+ vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
-+
-+ down_write(¤t->mm->mmap_sem);
-+ if (current->mm->call_dl_resolve) {
-+ call_dl_resolve = current->mm->call_dl_resolve;
-+ up_write(¤t->mm->mmap_sem);
-+ if (vma)
-+ kmem_cache_free(vm_area_cachep, vma);
-+ goto emulate;
-+ }
-+
-+ call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
-+ if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
-+ up_write(¤t->mm->mmap_sem);
-+ if (vma)
-+ kmem_cache_free(vm_area_cachep, vma);
-+ return 1;
-+ }
-+
-+ if (pax_insert_vma(vma, call_dl_resolve)) {
-+ up_write(¤t->mm->mmap_sem);
-+ kmem_cache_free(vm_area_cachep, vma);
-+ return 1;
-+ }
-+
-+ current->mm->call_dl_resolve = call_dl_resolve;
-+ up_write(¤t->mm->mmap_sem);
-+
-+emulate:
-+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
-+ regs->pc = call_dl_resolve;
-+ regs->npc = addr+4;
-+ return 3;
-+ }
-+#endif
-+
-+ /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
-+ if ((save & 0xFFC00000U) == 0x05000000U &&
-+ (call & 0xFFFFE000U) == 0x85C0A000U &&
-+ nop == 0x01000000U)
-+ {
-+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
-+ regs->u_regs[UREG_G2] = addr + 4;
-+ addr = (save & 0x003FFFFFU) << 10;
-+ addr += (((call | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
-+ regs->pc = addr;
-+ regs->npc = addr+4;
-+ return 3;
-+ }
-+ }
-+ } while (0);
-+
-+ do { /* PaX: unpatched PLT emulation step 2 */
-+ unsigned int save, call, nop;
-+
-+ err = get_user(save, (unsigned int *)(regs->pc-4));
-+ err |= get_user(call, (unsigned int *)regs->pc);
-+ err |= get_user(nop, (unsigned int *)(regs->pc+4));
-+ if (err)
-+ break;
-+
-+ if (save == 0x9DE3BFA8U &&
-+ (call & 0xC0000000U) == 0x40000000U &&
-+ nop == 0x01000000U)
-+ {
-+ unsigned int dl_resolve = regs->pc + ((((call | 0xC0000000U) ^ 0x20000000U) + 0x20000000U) << 2);
-+
-+ regs->u_regs[UREG_RETPC] = regs->pc;
-+ regs->pc = dl_resolve;
-+ regs->npc = dl_resolve+4;
-+ return 3;
-+ }
-+ } while (0);
-+#endif
-+
-+ return 1;
-+}
-+
-+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
-+{
-+ unsigned long i;
-+
-+ printk(KERN_ERR "PAX: bytes at PC: ");
-+ for (i = 0; i < 8; i++) {
-+ unsigned int c;
-+ if (get_user(c, (unsigned int *)pc+i))
-+ printk(KERN_CONT "???????? ");
-+ else
-+ printk(KERN_CONT "%08x ", c);
-+ }
-+ printk("\n");
-+}
-+#endif
-+
- asmlinkage void do_sparc_fault(struct pt_regs *regs, int text_fault, int write,
- unsigned long address)
- {
-@@ -231,6 +504,24 @@ good_area:
- if(!(vma->vm_flags & VM_WRITE))
- goto bad_area;
- } else {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && text_fault && !(vma->vm_flags & VM_EXEC)) {
-+ up_read(&mm->mmap_sem);
-+ switch (pax_handle_fetch_fault(regs)) {
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+ case 2:
-+ case 3:
-+ return;
-+#endif
-+
-+ }
-+ pax_report_fault(regs, (void *)regs->pc, (void *)regs->u_regs[UREG_FP]);
-+ do_group_exit(SIGKILL);
-+ }
-+#endif
-+
- /* Allow reads even for write-only mappings */
- if(!(vma->vm_flags & (VM_READ | VM_EXEC)))
- goto bad_area;
-diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c
-index 43b0da9..f9f9985 100644
---- a/arch/sparc/mm/fault_64.c
-+++ b/arch/sparc/mm/fault_64.c
-@@ -20,6 +20,9 @@
- #include <linux/kprobes.h>
- #include <linux/kdebug.h>
- #include <linux/percpu.h>
-+#include <linux/slab.h>
-+#include <linux/pagemap.h>
-+#include <linux/compiler.h>
-
- #include <asm/page.h>
- #include <asm/pgtable.h>
-@@ -78,7 +81,7 @@ static void bad_kernel_pc(struct pt_regs *regs, unsigned long vaddr)
- printk(KERN_CRIT "OOPS: Bogus kernel PC [%016lx] in fault handler\n",
- regs->tpc);
- printk(KERN_CRIT "OOPS: RPC [%016lx]\n", regs->u_regs[15]);
-- printk("OOPS: RPC <%pS>\n", (void *) regs->u_regs[15]);
-+ printk("OOPS: RPC <%pA>\n", (void *) regs->u_regs[15]);
- printk(KERN_CRIT "OOPS: Fault was to vaddr[%lx]\n", vaddr);
- dump_stack();
- unhandled_fault(regs->tpc, current, regs);
-@@ -249,6 +252,465 @@ static void noinline bogus_32bit_fault_address(struct pt_regs *regs,
- show_regs(regs);
- }
-
-+#ifdef CONFIG_PAX_PAGEEXEC
-+#ifdef CONFIG_PAX_DLRESOLVE
-+static void pax_emuplt_close(struct vm_area_struct *vma)
-+{
-+ vma->vm_mm->call_dl_resolve = 0UL;
-+}
-+
-+static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
-+{
-+ unsigned int *kaddr;
-+
-+ vmf->page = alloc_page(GFP_HIGHUSER);
-+ if (!vmf->page)
-+ return VM_FAULT_OOM;
-+
-+ kaddr = kmap(vmf->page);
-+ memset(kaddr, 0, PAGE_SIZE);
-+ kaddr[0] = 0x9DE3BFA8U; /* save */
-+ flush_dcache_page(vmf->page);
-+ kunmap(vmf->page);
-+ return VM_FAULT_MAJOR;
-+}
-+
-+static const struct vm_operations_struct pax_vm_ops = {
-+ .close = pax_emuplt_close,
-+ .fault = pax_emuplt_fault
-+};
-+
-+static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
-+{
-+ int ret;
-+
-+ vma->vm_mm = current->mm;
-+ vma->vm_start = addr;
-+ vma->vm_end = addr + PAGE_SIZE;
-+ vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
-+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
-+ vma->vm_ops = &pax_vm_ops;
-+
-+ ret = insert_vm_struct(current->mm, vma);
-+ if (ret)
-+ return ret;
-+
-+ ++current->mm->total_vm;
-+ return 0;
-+}
-+#endif
-+
-+/*
-+ * PaX: decide what to do with offenders (regs->tpc = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ * 2 when patched PLT trampoline was detected
-+ * 3 when unpatched PLT trampoline was detected
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+ int err;
-+
-+ do { /* PaX: patched PLT emulation #1 */
-+ unsigned int sethi1, sethi2, jmpl;
-+
-+ err = get_user(sethi1, (unsigned int *)regs->tpc);
-+ err |= get_user(sethi2, (unsigned int *)(regs->tpc+4));
-+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+8));
-+
-+ if (err)
-+ break;
-+
-+ if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
-+ (sethi2 & 0xFFC00000U) == 0x03000000U &&
-+ (jmpl & 0xFFFFE000U) == 0x81C06000U)
-+ {
-+ unsigned long addr;
-+
-+ regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
-+ addr = regs->u_regs[UREG_G1];
-+ addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
-+
-+ if (test_thread_flag(TIF_32BIT))
-+ addr &= 0xFFFFFFFFUL;
-+
-+ regs->tpc = addr;
-+ regs->tnpc = addr+4;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: patched PLT emulation #2 */
-+ unsigned int ba;
-+
-+ err = get_user(ba, (unsigned int *)regs->tpc);
-+
-+ if (err)
-+ break;
-+
-+ if ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30480000U) {
-+ unsigned long addr;
-+
-+ if ((ba & 0xFFC00000U) == 0x30800000U)
-+ addr = regs->tpc + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
-+ else
-+ addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
-+
-+ if (test_thread_flag(TIF_32BIT))
-+ addr &= 0xFFFFFFFFUL;
-+
-+ regs->tpc = addr;
-+ regs->tnpc = addr+4;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: patched PLT emulation #3 */
-+ unsigned int sethi, bajmpl, nop;
-+
-+ err = get_user(sethi, (unsigned int *)regs->tpc);
-+ err |= get_user(bajmpl, (unsigned int *)(regs->tpc+4));
-+ err |= get_user(nop, (unsigned int *)(regs->tpc+8));
-+
-+ if (err)
-+ break;
-+
-+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+ ((bajmpl & 0xFFFFE000U) == 0x81C06000U || (bajmpl & 0xFFF80000U) == 0x30480000U) &&
-+ nop == 0x01000000U)
-+ {
-+ unsigned long addr;
-+
-+ addr = (sethi & 0x003FFFFFU) << 10;
-+ regs->u_regs[UREG_G1] = addr;
-+ if ((bajmpl & 0xFFFFE000U) == 0x81C06000U)
-+ addr += (((bajmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
-+ else
-+ addr = regs->tpc + ((((bajmpl | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
-+
-+ if (test_thread_flag(TIF_32BIT))
-+ addr &= 0xFFFFFFFFUL;
-+
-+ regs->tpc = addr;
-+ regs->tnpc = addr+4;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: patched PLT emulation #4 */
-+ unsigned int sethi, mov1, call, mov2;
-+
-+ err = get_user(sethi, (unsigned int *)regs->tpc);
-+ err |= get_user(mov1, (unsigned int *)(regs->tpc+4));
-+ err |= get_user(call, (unsigned int *)(regs->tpc+8));
-+ err |= get_user(mov2, (unsigned int *)(regs->tpc+12));
-+
-+ if (err)
-+ break;
-+
-+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+ mov1 == 0x8210000FU &&
-+ (call & 0xC0000000U) == 0x40000000U &&
-+ mov2 == 0x9E100001U)
-+ {
-+ unsigned long addr;
-+
-+ regs->u_regs[UREG_G1] = regs->u_regs[UREG_RETPC];
-+ addr = regs->tpc + 4 + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
-+
-+ if (test_thread_flag(TIF_32BIT))
-+ addr &= 0xFFFFFFFFUL;
-+
-+ regs->tpc = addr;
-+ regs->tnpc = addr+4;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: patched PLT emulation #5 */
-+ unsigned int sethi, sethi1, sethi2, or1, or2, sllx, jmpl, nop;
-+
-+ err = get_user(sethi, (unsigned int *)regs->tpc);
-+ err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
-+ err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
-+ err |= get_user(or1, (unsigned int *)(regs->tpc+12));
-+ err |= get_user(or2, (unsigned int *)(regs->tpc+16));
-+ err |= get_user(sllx, (unsigned int *)(regs->tpc+20));
-+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+24));
-+ err |= get_user(nop, (unsigned int *)(regs->tpc+28));
-+
-+ if (err)
-+ break;
-+
-+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+ (sethi1 & 0xFFC00000U) == 0x03000000U &&
-+ (sethi2 & 0xFFC00000U) == 0x0B000000U &&
-+ (or1 & 0xFFFFE000U) == 0x82106000U &&
-+ (or2 & 0xFFFFE000U) == 0x8A116000U &&
-+ sllx == 0x83287020U &&
-+ jmpl == 0x81C04005U &&
-+ nop == 0x01000000U)
-+ {
-+ unsigned long addr;
-+
-+ regs->u_regs[UREG_G1] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
-+ regs->u_regs[UREG_G1] <<= 32;
-+ regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
-+ addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
-+ regs->tpc = addr;
-+ regs->tnpc = addr+4;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: patched PLT emulation #6 */
-+ unsigned int sethi, sethi1, sethi2, sllx, or, jmpl, nop;
-+
-+ err = get_user(sethi, (unsigned int *)regs->tpc);
-+ err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
-+ err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
-+ err |= get_user(sllx, (unsigned int *)(regs->tpc+12));
-+ err |= get_user(or, (unsigned int *)(regs->tpc+16));
-+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+20));
-+ err |= get_user(nop, (unsigned int *)(regs->tpc+24));
-+
-+ if (err)
-+ break;
-+
-+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+ (sethi1 & 0xFFC00000U) == 0x03000000U &&
-+ (sethi2 & 0xFFC00000U) == 0x0B000000U &&
-+ sllx == 0x83287020U &&
-+ (or & 0xFFFFE000U) == 0x8A116000U &&
-+ jmpl == 0x81C04005U &&
-+ nop == 0x01000000U)
-+ {
-+ unsigned long addr;
-+
-+ regs->u_regs[UREG_G1] = (sethi1 & 0x003FFFFFU) << 10;
-+ regs->u_regs[UREG_G1] <<= 32;
-+ regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or & 0x3FFU);
-+ addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
-+ regs->tpc = addr;
-+ regs->tnpc = addr+4;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: unpatched PLT emulation step 1 */
-+ unsigned int sethi, ba, nop;
-+
-+ err = get_user(sethi, (unsigned int *)regs->tpc);
-+ err |= get_user(ba, (unsigned int *)(regs->tpc+4));
-+ err |= get_user(nop, (unsigned int *)(regs->tpc+8));
-+
-+ if (err)
-+ break;
-+
-+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+ ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
-+ nop == 0x01000000U)
-+ {
-+ unsigned long addr;
-+ unsigned int save, call;
-+ unsigned int sethi1, sethi2, or1, or2, sllx, add, jmpl;
-+
-+ if ((ba & 0xFFC00000U) == 0x30800000U)
-+ addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
-+ else
-+ addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
-+
-+ if (test_thread_flag(TIF_32BIT))
-+ addr &= 0xFFFFFFFFUL;
-+
-+ err = get_user(save, (unsigned int *)addr);
-+ err |= get_user(call, (unsigned int *)(addr+4));
-+ err |= get_user(nop, (unsigned int *)(addr+8));
-+ if (err)
-+ break;
-+
-+#ifdef CONFIG_PAX_DLRESOLVE
-+ if (save == 0x9DE3BFA8U &&
-+ (call & 0xC0000000U) == 0x40000000U &&
-+ nop == 0x01000000U)
-+ {
-+ struct vm_area_struct *vma;
-+ unsigned long call_dl_resolve;
-+
-+ down_read(¤t->mm->mmap_sem);
-+ call_dl_resolve = current->mm->call_dl_resolve;
-+ up_read(¤t->mm->mmap_sem);
-+ if (likely(call_dl_resolve))
-+ goto emulate;
-+
-+ vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
-+
-+ down_write(¤t->mm->mmap_sem);
-+ if (current->mm->call_dl_resolve) {
-+ call_dl_resolve = current->mm->call_dl_resolve;
-+ up_write(¤t->mm->mmap_sem);
-+ if (vma)
-+ kmem_cache_free(vm_area_cachep, vma);
-+ goto emulate;
-+ }
-+
-+ call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
-+ if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
-+ up_write(¤t->mm->mmap_sem);
-+ if (vma)
-+ kmem_cache_free(vm_area_cachep, vma);
-+ return 1;
-+ }
-+
-+ if (pax_insert_vma(vma, call_dl_resolve)) {
-+ up_write(¤t->mm->mmap_sem);
-+ kmem_cache_free(vm_area_cachep, vma);
-+ return 1;
-+ }
-+
-+ current->mm->call_dl_resolve = call_dl_resolve;
-+ up_write(¤t->mm->mmap_sem);
-+
-+emulate:
-+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
-+ regs->tpc = call_dl_resolve;
-+ regs->tnpc = addr+4;
-+ return 3;
-+ }
-+#endif
-+
-+ /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
-+ if ((save & 0xFFC00000U) == 0x05000000U &&
-+ (call & 0xFFFFE000U) == 0x85C0A000U &&
-+ nop == 0x01000000U)
-+ {
-+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
-+ regs->u_regs[UREG_G2] = addr + 4;
-+ addr = (save & 0x003FFFFFU) << 10;
-+ addr += (((call | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
-+
-+ if (test_thread_flag(TIF_32BIT))
-+ addr &= 0xFFFFFFFFUL;
-+
-+ regs->tpc = addr;
-+ regs->tnpc = addr+4;
-+ return 3;
-+ }
-+
-+ /* PaX: 64-bit PLT stub */
-+ err = get_user(sethi1, (unsigned int *)addr);
-+ err |= get_user(sethi2, (unsigned int *)(addr+4));
-+ err |= get_user(or1, (unsigned int *)(addr+8));
-+ err |= get_user(or2, (unsigned int *)(addr+12));
-+ err |= get_user(sllx, (unsigned int *)(addr+16));
-+ err |= get_user(add, (unsigned int *)(addr+20));
-+ err |= get_user(jmpl, (unsigned int *)(addr+24));
-+ err |= get_user(nop, (unsigned int *)(addr+28));
-+ if (err)
-+ break;
-+
-+ if ((sethi1 & 0xFFC00000U) == 0x09000000U &&
-+ (sethi2 & 0xFFC00000U) == 0x0B000000U &&
-+ (or1 & 0xFFFFE000U) == 0x88112000U &&
-+ (or2 & 0xFFFFE000U) == 0x8A116000U &&
-+ sllx == 0x89293020U &&
-+ add == 0x8A010005U &&
-+ jmpl == 0x89C14000U &&
-+ nop == 0x01000000U)
-+ {
-+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
-+ regs->u_regs[UREG_G4] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
-+ regs->u_regs[UREG_G4] <<= 32;
-+ regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
-+ regs->u_regs[UREG_G5] += regs->u_regs[UREG_G4];
-+ regs->u_regs[UREG_G4] = addr + 24;
-+ addr = regs->u_regs[UREG_G5];
-+ regs->tpc = addr;
-+ regs->tnpc = addr+4;
-+ return 3;
-+ }
-+ }
-+ } while (0);
-+
-+#ifdef CONFIG_PAX_DLRESOLVE
-+ do { /* PaX: unpatched PLT emulation step 2 */
-+ unsigned int save, call, nop;
-+
-+ err = get_user(save, (unsigned int *)(regs->tpc-4));
-+ err |= get_user(call, (unsigned int *)regs->tpc);
-+ err |= get_user(nop, (unsigned int *)(regs->tpc+4));
-+ if (err)
-+ break;
-+
-+ if (save == 0x9DE3BFA8U &&
-+ (call & 0xC0000000U) == 0x40000000U &&
-+ nop == 0x01000000U)
-+ {
-+ unsigned long dl_resolve = regs->tpc + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
-+
-+ if (test_thread_flag(TIF_32BIT))
-+ dl_resolve &= 0xFFFFFFFFUL;
-+
-+ regs->u_regs[UREG_RETPC] = regs->tpc;
-+ regs->tpc = dl_resolve;
-+ regs->tnpc = dl_resolve+4;
-+ return 3;
-+ }
-+ } while (0);
-+#endif
-+
-+ do { /* PaX: patched PLT emulation #7, must be AFTER the unpatched PLT emulation */
-+ unsigned int sethi, ba, nop;
-+
-+ err = get_user(sethi, (unsigned int *)regs->tpc);
-+ err |= get_user(ba, (unsigned int *)(regs->tpc+4));
-+ err |= get_user(nop, (unsigned int *)(regs->tpc+8));
-+
-+ if (err)
-+ break;
-+
-+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+ (ba & 0xFFF00000U) == 0x30600000U &&
-+ nop == 0x01000000U)
-+ {
-+ unsigned long addr;
-+
-+ addr = (sethi & 0x003FFFFFU) << 10;
-+ regs->u_regs[UREG_G1] = addr;
-+ addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
-+
-+ if (test_thread_flag(TIF_32BIT))
-+ addr &= 0xFFFFFFFFUL;
-+
-+ regs->tpc = addr;
-+ regs->tnpc = addr+4;
-+ return 2;
-+ }
-+ } while (0);
-+
-+#endif
-+
-+ return 1;
-+}
-+
-+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
-+{
-+ unsigned long i;
-+
-+ printk(KERN_ERR "PAX: bytes at PC: ");
-+ for (i = 0; i < 8; i++) {
-+ unsigned int c;
-+ if (get_user(c, (unsigned int *)pc+i))
-+ printk(KERN_CONT "???????? ");
-+ else
-+ printk(KERN_CONT "%08x ", c);
-+ }
-+ printk("\n");
-+}
-+#endif
-+
- asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
- {
- struct mm_struct *mm = current->mm;
-@@ -315,6 +777,29 @@ asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
- if (!vma)
- goto bad_area;
-
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ /* PaX: detect ITLB misses on non-exec pages */
-+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && vma->vm_start <= address &&
-+ !(vma->vm_flags & VM_EXEC) && (fault_code & FAULT_CODE_ITLB))
-+ {
-+ if (address != regs->tpc)
-+ goto good_area;
-+
-+ up_read(&mm->mmap_sem);
-+ switch (pax_handle_fetch_fault(regs)) {
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+ case 2:
-+ case 3:
-+ return;
-+#endif
-+
-+ }
-+ pax_report_fault(regs, (void *)regs->tpc, (void *)(regs->u_regs[UREG_FP] + STACK_BIAS));
-+ do_group_exit(SIGKILL);
-+ }
-+#endif
-+
- /* Pure DTLB misses do not tell us whether the fault causing
- * load/store/atomic was a write or not, it only says that there
- * was no match. So in such a case we (carefully) read the
-diff --git a/arch/sparc/mm/hugetlbpage.c b/arch/sparc/mm/hugetlbpage.c
-index f27d103..9f5fc4f 100644
---- a/arch/sparc/mm/hugetlbpage.c
-+++ b/arch/sparc/mm/hugetlbpage.c
-@@ -30,7 +30,8 @@ static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *filp,
- unsigned long addr,
- unsigned long len,
- unsigned long pgoff,
-- unsigned long flags)
-+ unsigned long flags,
-+ unsigned long offset)
- {
- struct mm_struct *mm = current->mm;
- struct vm_area_struct * vma;
-@@ -69,7 +70,7 @@ full_search:
- }
- return -ENOMEM;
- }
-- if (likely(!vma || addr + len <= vma->vm_start)) {
-+ if (likely(check_heap_stack_gap(vma, &addr, len, offset))) {
- /*
- * Remember the place where we stopped the search:
- */
-@@ -87,7 +88,8 @@ static unsigned long
- hugetlb_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- const unsigned long len,
- const unsigned long pgoff,
-- const unsigned long flags)
-+ const unsigned long flags,
-+ const unsigned long offset)
- {
- struct vm_area_struct *vma;
- struct mm_struct *mm = current->mm;
-@@ -107,26 +109,28 @@ hugetlb_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
-
- /* make sure it can fit in the remaining address space */
- if (likely(addr > len)) {
-- vma = find_vma(mm, addr-len);
-- if (!vma || addr <= vma->vm_start) {
-+ addr -= len;
-+ vma = find_vma(mm, addr);
-+ if (check_heap_stack_gap(vma, &addr, len, offset)) {
- /* remember the address as a hint for next time */
-- return (mm->free_area_cache = addr-len);
-+ return (mm->free_area_cache = addr);
- }
- }
-
- if (unlikely(mm->mmap_base < len))
- goto bottomup;
-
-- addr = (mm->mmap_base-len) & HPAGE_MASK;
-+ addr = mm->mmap_base - len;
-
- do {
-+ addr &= HPAGE_MASK;
- /*
- * Lookup failure means no vma is above this address,
- * else if new region fits below vma->vm_start,
- * return with success:
- */
- vma = find_vma(mm, addr);
-- if (likely(!vma || addr+len <= vma->vm_start)) {
-+ if (likely(check_heap_stack_gap(vma, &addr, len, offset))) {
- /* remember the address as a hint for next time */
- return (mm->free_area_cache = addr);
- }
-@@ -136,8 +140,8 @@ hugetlb_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- mm->cached_hole_size = vma->vm_start - addr;
-
- /* try just below the current vma->vm_start */
-- addr = (vma->vm_start-len) & HPAGE_MASK;
-- } while (likely(len < vma->vm_start));
-+ addr = skip_heap_stack_gap(vma, len, offset);
-+ } while (!IS_ERR_VALUE(addr));
-
- bottomup:
- /*
-@@ -165,6 +169,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
- struct mm_struct *mm = current->mm;
- struct vm_area_struct *vma;
- unsigned long task_size = TASK_SIZE;
-+ unsigned long offset = gr_rand_threadstack_offset(mm, file, flags);
-
- if (test_thread_flag(TIF_32BIT))
- task_size = STACK_TOP32;
-@@ -183,16 +188,15 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
- if (addr) {
- addr = ALIGN(addr, HPAGE_SIZE);
- vma = find_vma(mm, addr);
-- if (task_size - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-+ if (task_size - len >= addr && check_heap_stack_gap(vma, &addr, len, offset))
- return addr;
- }
- if (mm->get_unmapped_area == arch_get_unmapped_area)
- return hugetlb_get_unmapped_area_bottomup(file, addr, len,
-- pgoff, flags);
-+ pgoff, flags, offset);
- else
- return hugetlb_get_unmapped_area_topdown(file, addr, len,
-- pgoff, flags);
-+ pgoff, flags, offset);
- }
-
- pte_t *huge_pte_alloc(struct mm_struct *mm,
-diff --git a/arch/sparc/mm/init_32.c b/arch/sparc/mm/init_32.c
-index dc7c3b1..34c0070 100644
---- a/arch/sparc/mm/init_32.c
-+++ b/arch/sparc/mm/init_32.c
-@@ -317,6 +317,9 @@ extern void device_scan(void);
- pgprot_t PAGE_SHARED __read_mostly;
- EXPORT_SYMBOL(PAGE_SHARED);
-
-+pgprot_t PAGE_SHARED_NOEXEC __read_mostly;
-+EXPORT_SYMBOL(PAGE_SHARED_NOEXEC);
-+
- void __init paging_init(void)
- {
- switch(sparc_cpu_model) {
-@@ -345,17 +348,17 @@ void __init paging_init(void)
-
- /* Initialize the protection map with non-constant, MMU dependent values. */
- protection_map[0] = PAGE_NONE;
-- protection_map[1] = PAGE_READONLY;
-- protection_map[2] = PAGE_COPY;
-- protection_map[3] = PAGE_COPY;
-+ protection_map[1] = PAGE_READONLY_NOEXEC;
-+ protection_map[2] = PAGE_COPY_NOEXEC;
-+ protection_map[3] = PAGE_COPY_NOEXEC;
- protection_map[4] = PAGE_READONLY;
- protection_map[5] = PAGE_READONLY;
- protection_map[6] = PAGE_COPY;
- protection_map[7] = PAGE_COPY;
- protection_map[8] = PAGE_NONE;
-- protection_map[9] = PAGE_READONLY;
-- protection_map[10] = PAGE_SHARED;
-- protection_map[11] = PAGE_SHARED;
-+ protection_map[9] = PAGE_READONLY_NOEXEC;
-+ protection_map[10] = PAGE_SHARED_NOEXEC;
-+ protection_map[11] = PAGE_SHARED_NOEXEC;
- protection_map[12] = PAGE_READONLY;
- protection_map[13] = PAGE_READONLY;
- protection_map[14] = PAGE_SHARED;
-diff --git a/arch/sparc/mm/srmmu.c b/arch/sparc/mm/srmmu.c
-index 509b1ff..bfd7118 100644
---- a/arch/sparc/mm/srmmu.c
-+++ b/arch/sparc/mm/srmmu.c
-@@ -2200,6 +2200,13 @@ void __init ld_mmu_srmmu(void)
- PAGE_SHARED = pgprot_val(SRMMU_PAGE_SHARED);
- BTFIXUPSET_INT(page_copy, pgprot_val(SRMMU_PAGE_COPY));
- BTFIXUPSET_INT(page_readonly, pgprot_val(SRMMU_PAGE_RDONLY));
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ PAGE_SHARED_NOEXEC = pgprot_val(SRMMU_PAGE_SHARED_NOEXEC);
-+ BTFIXUPSET_INT(page_copy_noexec, pgprot_val(SRMMU_PAGE_COPY_NOEXEC));
-+ BTFIXUPSET_INT(page_readonly_noexec, pgprot_val(SRMMU_PAGE_RDONLY_NOEXEC));
-+#endif
-+
- BTFIXUPSET_INT(page_kernel, pgprot_val(SRMMU_PAGE_KERNEL));
- page_kernel = pgprot_val(SRMMU_PAGE_KERNEL);
-
-diff --git a/arch/um/Makefile b/arch/um/Makefile
-index fc633db..b46e213 100644
---- a/arch/um/Makefile
-+++ b/arch/um/Makefile
-@@ -49,6 +49,10 @@ USER_CFLAGS = $(patsubst $(KERNEL_DEFINES),,$(patsubst -D__KERNEL__,,\
- $(patsubst -I%,,$(KBUILD_CFLAGS)))) $(ARCH_INCLUDE) $(MODE_INCLUDE) \
- $(filter -I%,$(CFLAGS)) -D_FILE_OFFSET_BITS=64
-
-+ifdef CONSTIFY_PLUGIN
-+USER_CFLAGS += -fplugin-arg-constify_plugin-no-constify
-+endif
-+
- include $(srctree)/$(ARCH_DIR)/Makefile-$(SUBARCH)
-
- #This will adjust *FLAGS accordingly to the platform.
-diff --git a/arch/um/include/asm/cache.h b/arch/um/include/asm/cache.h
-index 19e1bdd..3665b77 100644
---- a/arch/um/include/asm/cache.h
-+++ b/arch/um/include/asm/cache.h
-@@ -1,6 +1,7 @@
- #ifndef __UM_CACHE_H
- #define __UM_CACHE_H
-
-+#include <linux/const.h>
-
- #if defined(CONFIG_UML_X86) && !defined(CONFIG_64BIT)
- # define L1_CACHE_SHIFT (CONFIG_X86_L1_CACHE_SHIFT)
-@@ -12,6 +13,6 @@
- # define L1_CACHE_SHIFT 5
- #endif
-
--#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-
- #endif
-diff --git a/arch/um/include/asm/kmap_types.h b/arch/um/include/asm/kmap_types.h
-index 6c03acd..a5e0215 100644
---- a/arch/um/include/asm/kmap_types.h
-+++ b/arch/um/include/asm/kmap_types.h
-@@ -23,6 +23,7 @@ enum km_type {
- KM_IRQ1,
- KM_SOFTIRQ0,
- KM_SOFTIRQ1,
-+ KM_CLEARPAGE,
- KM_TYPE_NR
- };
-
-diff --git a/arch/um/include/asm/page.h b/arch/um/include/asm/page.h
-index 4cc9b6c..02e5029 100644
---- a/arch/um/include/asm/page.h
-+++ b/arch/um/include/asm/page.h
-@@ -14,6 +14,9 @@
- #define PAGE_SIZE (_AC(1, UL) << PAGE_SHIFT)
- #define PAGE_MASK (~(PAGE_SIZE-1))
-
-+#define ktla_ktva(addr) (addr)
-+#define ktva_ktla(addr) (addr)
-+
- #ifndef __ASSEMBLY__
-
- struct page;
-diff --git a/arch/um/include/asm/pgtable-3level.h b/arch/um/include/asm/pgtable-3level.h
-index 084de4a..f44d25c 100644
---- a/arch/um/include/asm/pgtable-3level.h
-+++ b/arch/um/include/asm/pgtable-3level.h
-@@ -58,6 +58,7 @@
- #define pud_present(x) (pud_val(x) & _PAGE_PRESENT)
- #define pud_populate(mm, pud, pmd) \
- set_pud(pud, __pud(_PAGE_TABLE + __pa(pmd)))
-+#define pud_populate_kernel(mm, pud, pmd) pud_populate((mm), (pud), (pmd))
-
- #ifdef CONFIG_64BIT
- #define set_pud(pudptr, pudval) set_64bit((phys_t *) (pudptr), pud_val(pudval))
-diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c
-index 4a28a15..654dc2a 100644
---- a/arch/um/kernel/process.c
-+++ b/arch/um/kernel/process.c
-@@ -393,22 +393,6 @@ int singlestepping(void * t)
- return 2;
- }
-
--/*
-- * Only x86 and x86_64 have an arch_align_stack().
-- * All other arches have "#define arch_align_stack(x) (x)"
-- * in their asm/system.h
-- * As this is included in UML from asm-um/system-generic.h,
-- * we can use it to behave as the subarch does.
-- */
--#ifndef arch_align_stack
--unsigned long arch_align_stack(unsigned long sp)
--{
-- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
-- sp -= get_random_int() % 8192;
-- return sp & ~0xf;
--}
--#endif
--
- unsigned long get_wchan(struct task_struct *p)
- {
- unsigned long stack_page, sp, ip;
-diff --git a/arch/um/sys-i386/shared/sysdep/system.h b/arch/um/sys-i386/shared/sysdep/system.h
-index d1b93c4..ae1b7fd 100644
---- a/arch/um/sys-i386/shared/sysdep/system.h
-+++ b/arch/um/sys-i386/shared/sysdep/system.h
-@@ -17,7 +17,7 @@
- # define AT_VECTOR_SIZE_ARCH 1
- #endif
-
--extern unsigned long arch_align_stack(unsigned long sp);
-+#define arch_align_stack(x) ((x) & ~0xfUL)
-
- void default_idle(void);
-
-diff --git a/arch/um/sys-i386/syscalls.c b/arch/um/sys-i386/syscalls.c
-index 857ca0b..9a2669d 100644
---- a/arch/um/sys-i386/syscalls.c
-+++ b/arch/um/sys-i386/syscalls.c
-@@ -11,6 +11,21 @@
- #include "asm/uaccess.h"
- #include "asm/unistd.h"
-
-+int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
-+{
-+ unsigned long pax_task_size = TASK_SIZE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
-+ pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+ if (len > pax_task_size || addr > pax_task_size - len)
-+ return -EINVAL;
-+
-+ return 0;
-+}
-+
- /*
- * Perform the select(nd, in, out, ex, tv) and mmap() system
- * calls. Linux/i386 didn't use to be able to handle more than
-diff --git a/arch/um/sys-x86_64/shared/sysdep/system.h b/arch/um/sys-x86_64/shared/sysdep/system.h
-index d1b93c4..ae1b7fd 100644
---- a/arch/um/sys-x86_64/shared/sysdep/system.h
-+++ b/arch/um/sys-x86_64/shared/sysdep/system.h
-@@ -17,7 +17,7 @@
- # define AT_VECTOR_SIZE_ARCH 1
- #endif
-
--extern unsigned long arch_align_stack(unsigned long sp);
-+#define arch_align_stack(x) ((x) & ~0xfUL)
-
- void default_idle(void);
-
-diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
-index ee0168d..096ed0e 100644
---- a/arch/x86/Kconfig
-+++ b/arch/x86/Kconfig
-@@ -223,7 +223,7 @@ config X86_TRAMPOLINE
-
- config X86_32_LAZY_GS
- def_bool y
-- depends on X86_32 && !CC_STACKPROTECTOR
-+ depends on X86_32 && !CC_STACKPROTECTOR && !PAX_MEMORY_UDEREF
-
- config KTIME_SCALAR
- def_bool X86_32
-@@ -985,6 +985,7 @@ config MICROCODE_OLD_INTERFACE
-
- config X86_MSR
- tristate "/dev/cpu/*/msr - Model-specific register support"
-+ depends on !GRKERNSEC_KMEM
- ---help---
- This device gives privileged processes access to the x86
- Model-Specific Registers (MSRs). It is a character device with
-@@ -1008,7 +1009,7 @@ choice
-
- config NOHIGHMEM
- bool "off"
-- depends on !X86_NUMAQ
-+ depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
- ---help---
- Linux can use up to 64 Gigabytes of physical memory on x86 systems.
- However, the address space of 32-bit x86 processors is only 4
-@@ -1045,7 +1046,7 @@ config NOHIGHMEM
-
- config HIGHMEM4G
- bool "4GB"
-- depends on !X86_NUMAQ
-+ depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
- ---help---
- Select this if you have a 32-bit processor and between 1 and 4
- gigabytes of physical RAM.
-@@ -1099,7 +1100,7 @@ config PAGE_OFFSET
- hex
- default 0xB0000000 if VMSPLIT_3G_OPT
- default 0x80000000 if VMSPLIT_2G
-- default 0x78000000 if VMSPLIT_2G_OPT
-+ default 0x70000000 if VMSPLIT_2G_OPT
- default 0x40000000 if VMSPLIT_1G
- default 0xC0000000
- depends on X86_32
-@@ -1469,6 +1470,7 @@ config SECCOMP
-
- config CC_STACKPROTECTOR
- bool "Enable -fstack-protector buffer overflow detection (EXPERIMENTAL)"
-+ depends on X86_64 || !PAX_MEMORY_UDEREF
- ---help---
- This option turns on the -fstack-protector GCC feature. This
- feature puts, at the beginning of functions, a canary value on
-@@ -1526,6 +1528,7 @@ config KEXEC_JUMP
- config PHYSICAL_START
- hex "Physical address where the kernel is loaded" if (EMBEDDED || CRASH_DUMP)
- default "0x1000000"
-+ range 0x400000 0x40000000
- ---help---
- This gives the physical address where the kernel is loaded.
-
-@@ -1590,6 +1593,7 @@ config PHYSICAL_ALIGN
- hex
- prompt "Alignment value to which kernel should be aligned" if X86_32
- default "0x1000000"
-+ range 0x400000 0x1000000 if PAX_KERNEXEC
- range 0x2000 0x1000000
- ---help---
- This value puts the alignment restrictions on physical address
-@@ -1621,9 +1625,10 @@ config HOTPLUG_CPU
- Say N if you want to disable CPU hotplug.
-
- config COMPAT_VDSO
-- def_bool y
-+ def_bool n
- prompt "Compat VDSO support"
- depends on X86_32 || IA32_EMULATION
-+ depends on !PAX_PAGEEXEC && !PAX_SEGMEXEC && !PAX_KERNEXEC && !PAX_MEMORY_UDEREF
- ---help---
- Map the 32-bit VDSO to the predictable old-style address too.
- ---help---
-diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
-index 0e566103..1a6b57e 100644
---- a/arch/x86/Kconfig.cpu
-+++ b/arch/x86/Kconfig.cpu
-@@ -340,7 +340,7 @@ config X86_PPRO_FENCE
-
- config X86_F00F_BUG
- def_bool y
-- depends on M586MMX || M586TSC || M586 || M486 || M386
-+ depends on (M586MMX || M586TSC || M586 || M486 || M386) && !PAX_KERNEXEC
-
- config X86_WP_WORKS_OK
- def_bool y
-@@ -360,7 +360,7 @@ config X86_POPAD_OK
-
- config X86_ALIGNMENT_16
- def_bool y
-- depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK6 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
-+ depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK8 || MK7 || MK6 || MCORE2 || MPENTIUM4 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
-
- config X86_INTEL_USERCOPY
- def_bool y
-@@ -406,7 +406,7 @@ config X86_CMPXCHG64
- # generates cmov.
- config X86_CMOV
- def_bool y
-- depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM)
-+ depends on (MK8 || MK7 || MCORE2 || MPSC || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM)
-
- config X86_MINIMUM_CPU_FAMILY
- int
-diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug
-index d105f29..c928727 100644
---- a/arch/x86/Kconfig.debug
-+++ b/arch/x86/Kconfig.debug
-@@ -99,7 +99,7 @@ config X86_PTDUMP
- config DEBUG_RODATA
- bool "Write protect kernel read-only data structures"
- default y
-- depends on DEBUG_KERNEL
-+ depends on DEBUG_KERNEL && BROKEN
- ---help---
- Mark the kernel read-only data as write-protected in the pagetables,
- in order to catch accidental (and incorrect) writes to such const
-diff --git a/arch/x86/Makefile b/arch/x86/Makefile
-index d2d24c9..0f21f8d 100644
---- a/arch/x86/Makefile
-+++ b/arch/x86/Makefile
-@@ -44,6 +44,7 @@ ifeq ($(CONFIG_X86_32),y)
- else
- BITS := 64
- UTS_MACHINE := x86_64
-+ biarch := $(call cc-option,-m64)
- CHECKFLAGS += -D__x86_64__ -m64
-
- KBUILD_AFLAGS += -m64
-@@ -189,3 +190,12 @@ define archhelp
- echo ' FDARGS="..." arguments for the booted kernel'
- echo ' FDINITRD=file initrd for the booted kernel'
- endef
-+
-+define OLD_LD
-+
-+*** ${VERSION}.${PATCHLEVEL} PaX kernels no longer build correctly with old versions of binutils.
-+*** Please upgrade your binutils to 2.18 or newer
-+endef
-+
-+archprepare:
-+ $(if $(LDFLAGS_BUILD_ID),,$(error $(OLD_LD)))
-diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
-index ec749c2..c2abaf02 100644
---- a/arch/x86/boot/Makefile
-+++ b/arch/x86/boot/Makefile
-@@ -69,6 +69,9 @@ KBUILD_CFLAGS := $(LINUXINCLUDE) -g -Os -D_SETUP -D__KERNEL__ \
- $(call cc-option, -fno-stack-protector) \
- $(call cc-option, -mpreferred-stack-boundary=2)
- KBUILD_CFLAGS += $(call cc-option, -m32)
-+ifdef CONSTIFY_PLUGIN
-+KBUILD_CFLAGS += -fplugin-arg-constify_plugin-no-constify
-+endif
- KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
- GCOV_PROFILE := n
-
-diff --git a/arch/x86/boot/bitops.h b/arch/x86/boot/bitops.h
-index 878e4b9..20537ab 100644
---- a/arch/x86/boot/bitops.h
-+++ b/arch/x86/boot/bitops.h
-@@ -26,7 +26,7 @@ static inline int variable_test_bit(int nr, const void *addr)
- u8 v;
- const u32 *p = (const u32 *)addr;
-
-- asm("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
-+ asm volatile("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
- return v;
- }
-
-@@ -37,7 +37,7 @@ static inline int variable_test_bit(int nr, const void *addr)
-
- static inline void set_bit(int nr, void *addr)
- {
-- asm("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
-+ asm volatile("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
- }
-
- #endif /* BOOT_BITOPS_H */
-diff --git a/arch/x86/boot/boot.h b/arch/x86/boot/boot.h
-index 98239d2..f40214c 100644
---- a/arch/x86/boot/boot.h
-+++ b/arch/x86/boot/boot.h
-@@ -82,7 +82,7 @@ static inline void io_delay(void)
- static inline u16 ds(void)
- {
- u16 seg;
-- asm("movw %%ds,%0" : "=rm" (seg));
-+ asm volatile("movw %%ds,%0" : "=rm" (seg));
- return seg;
- }
-
-@@ -178,7 +178,7 @@ static inline void wrgs32(u32 v, addr_t addr)
- static inline int memcmp(const void *s1, const void *s2, size_t len)
- {
- u8 diff;
-- asm("repe; cmpsb; setnz %0"
-+ asm volatile("repe; cmpsb; setnz %0"
- : "=qm" (diff), "+D" (s1), "+S" (s2), "+c" (len));
- return diff;
- }
-diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
-index f8ed065..6764b5c 100644
---- a/arch/x86/boot/compressed/Makefile
-+++ b/arch/x86/boot/compressed/Makefile
-@@ -13,6 +13,9 @@ cflags-$(CONFIG_X86_64) := -mcmodel=small
- KBUILD_CFLAGS += $(cflags-y)
- KBUILD_CFLAGS += $(call cc-option,-ffreestanding)
- KBUILD_CFLAGS += $(call cc-option,-fno-stack-protector)
-+ifdef CONSTIFY_PLUGIN
-+KBUILD_CFLAGS += -fplugin-arg-constify_plugin-no-constify
-+endif
-
- KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
- GCOV_PROFILE := n
-diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S
-index f543b70..b60fba8 100644
---- a/arch/x86/boot/compressed/head_32.S
-+++ b/arch/x86/boot/compressed/head_32.S
-@@ -76,7 +76,7 @@ ENTRY(startup_32)
- notl %eax
- andl %eax, %ebx
- #else
-- movl $LOAD_PHYSICAL_ADDR, %ebx
-+ movl $____LOAD_PHYSICAL_ADDR, %ebx
- #endif
-
- /* Target address to relocate to for decompression */
-@@ -149,7 +149,7 @@ relocated:
- * and where it was actually loaded.
- */
- movl %ebp, %ebx
-- subl $LOAD_PHYSICAL_ADDR, %ebx
-+ subl $____LOAD_PHYSICAL_ADDR, %ebx
- jz 2f /* Nothing to be done if loaded at compiled addr. */
- /*
- * Process relocations.
-@@ -157,8 +157,7 @@ relocated:
-
- 1: subl $4, %edi
- movl (%edi), %ecx
-- testl %ecx, %ecx
-- jz 2f
-+ jecxz 2f
- addl %ebx, -__PAGE_OFFSET(%ebx, %ecx)
- jmp 1b
- 2:
-diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S
-index 077e1b6..2c6b13b5 100644
---- a/arch/x86/boot/compressed/head_64.S
-+++ b/arch/x86/boot/compressed/head_64.S
-@@ -91,7 +91,7 @@ ENTRY(startup_32)
- notl %eax
- andl %eax, %ebx
- #else
-- movl $LOAD_PHYSICAL_ADDR, %ebx
-+ movl $____LOAD_PHYSICAL_ADDR, %ebx
- #endif
-
- /* Target address to relocate to for decompression */
-@@ -183,7 +183,7 @@ no_longmode:
- hlt
- jmp 1b
-
--#include "../../kernel/verify_cpu_64.S"
-+#include "../../kernel/verify_cpu.S"
-
- /*
- * Be careful here startup_64 needs to be at a predictable
-@@ -234,7 +234,7 @@ ENTRY(startup_64)
- notq %rax
- andq %rax, %rbp
- #else
-- movq $LOAD_PHYSICAL_ADDR, %rbp
-+ movq $____LOAD_PHYSICAL_ADDR, %rbp
- #endif
-
- /* Target address to relocate to for decompression */
-diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
-index 842b2a3..f00178b 100644
---- a/arch/x86/boot/compressed/misc.c
-+++ b/arch/x86/boot/compressed/misc.c
-@@ -288,7 +288,7 @@ static void parse_elf(void *output)
- case PT_LOAD:
- #ifdef CONFIG_RELOCATABLE
- dest = output;
-- dest += (phdr->p_paddr - LOAD_PHYSICAL_ADDR);
-+ dest += (phdr->p_paddr - ____LOAD_PHYSICAL_ADDR);
- #else
- dest = (void *)(phdr->p_paddr);
- #endif
-@@ -335,7 +335,7 @@ asmlinkage void decompress_kernel(void *rmode, memptr heap,
- error("Destination address too large");
- #endif
- #ifndef CONFIG_RELOCATABLE
-- if ((unsigned long)output != LOAD_PHYSICAL_ADDR)
-+ if ((unsigned long)output != ____LOAD_PHYSICAL_ADDR)
- error("Wrong destination address");
- #endif
-
-diff --git a/arch/x86/boot/compressed/mkpiggy.c b/arch/x86/boot/compressed/mkpiggy.c
-index bcbd36c..b1754af 100644
---- a/arch/x86/boot/compressed/mkpiggy.c
-+++ b/arch/x86/boot/compressed/mkpiggy.c
-@@ -74,7 +74,7 @@ int main(int argc, char *argv[])
-
- offs = (olen > ilen) ? olen - ilen : 0;
- offs += olen >> 12; /* Add 8 bytes for each 32K block */
-- offs += 32*1024 + 18; /* Add 32K + 18 bytes slack */
-+ offs += 64*1024; /* Add 64K bytes slack */
- offs = (offs+4095) & ~4095; /* Round to a 4K boundary */
-
- printf(".section \".rodata.compressed\",\"a\",@progbits\n");
-diff --git a/arch/x86/boot/compressed/relocs.c b/arch/x86/boot/compressed/relocs.c
-index bbeb0c3..1eb0571 100644
---- a/arch/x86/boot/compressed/relocs.c
-+++ b/arch/x86/boot/compressed/relocs.c
-@@ -10,8 +10,11 @@
- #define USE_BSD
- #include <endian.h>
-
-+#include "../../../../include/linux/autoconf.h"
-+
- #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
- static Elf32_Ehdr ehdr;
-+static Elf32_Phdr *phdr;
- static unsigned long reloc_count, reloc_idx;
- static unsigned long *relocs;
-
-@@ -37,7 +40,7 @@ static const char* safe_abs_relocs[] = {
-
- static int is_safe_abs_reloc(const char* sym_name)
- {
-- int i;
-+ unsigned int i;
-
- for (i = 0; i < ARRAY_SIZE(safe_abs_relocs); i++) {
- if (!strcmp(sym_name, safe_abs_relocs[i]))
-@@ -245,9 +248,39 @@ static void read_ehdr(FILE *fp)
- }
- }
-
-+static void read_phdrs(FILE *fp)
-+{
-+ unsigned int i;
-+
-+ phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr));
-+ if (!phdr) {
-+ die("Unable to allocate %d program headers\n",
-+ ehdr.e_phnum);
-+ }
-+ if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) {
-+ die("Seek to %d failed: %s\n",
-+ ehdr.e_phoff, strerror(errno));
-+ }
-+ if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) {
-+ die("Cannot read ELF program headers: %s\n",
-+ strerror(errno));
-+ }
-+ for(i = 0; i < ehdr.e_phnum; i++) {
-+ phdr[i].p_type = elf32_to_cpu(phdr[i].p_type);
-+ phdr[i].p_offset = elf32_to_cpu(phdr[i].p_offset);
-+ phdr[i].p_vaddr = elf32_to_cpu(phdr[i].p_vaddr);
-+ phdr[i].p_paddr = elf32_to_cpu(phdr[i].p_paddr);
-+ phdr[i].p_filesz = elf32_to_cpu(phdr[i].p_filesz);
-+ phdr[i].p_memsz = elf32_to_cpu(phdr[i].p_memsz);
-+ phdr[i].p_flags = elf32_to_cpu(phdr[i].p_flags);
-+ phdr[i].p_align = elf32_to_cpu(phdr[i].p_align);
-+ }
-+
-+}
-+
- static void read_shdrs(FILE *fp)
- {
-- int i;
-+ unsigned int i;
- Elf32_Shdr shdr;
-
- secs = calloc(ehdr.e_shnum, sizeof(struct section));
-@@ -282,7 +315,7 @@ static void read_shdrs(FILE *fp)
-
- static void read_strtabs(FILE *fp)
- {
-- int i;
-+ unsigned int i;
- for (i = 0; i < ehdr.e_shnum; i++) {
- struct section *sec = &secs[i];
- if (sec->shdr.sh_type != SHT_STRTAB) {
-@@ -307,7 +340,7 @@ static void read_strtabs(FILE *fp)
-
- static void read_symtabs(FILE *fp)
- {
-- int i,j;
-+ unsigned int i,j;
- for (i = 0; i < ehdr.e_shnum; i++) {
- struct section *sec = &secs[i];
- if (sec->shdr.sh_type != SHT_SYMTAB) {
-@@ -340,7 +373,9 @@ static void read_symtabs(FILE *fp)
-
- static void read_relocs(FILE *fp)
- {
-- int i,j;
-+ unsigned int i,j;
-+ uint32_t base;
-+
- for (i = 0; i < ehdr.e_shnum; i++) {
- struct section *sec = &secs[i];
- if (sec->shdr.sh_type != SHT_REL) {
-@@ -360,9 +395,18 @@ static void read_relocs(FILE *fp)
- die("Cannot read symbol table: %s\n",
- strerror(errno));
- }
-+ base = 0;
-+ for (j = 0; j < ehdr.e_phnum; j++) {
-+ if (phdr[j].p_type != PT_LOAD )
-+ continue;
-+ if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz)
-+ continue;
-+ base = CONFIG_PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr;
-+ break;
-+ }
- for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
- Elf32_Rel *rel = &sec->reltab[j];
-- rel->r_offset = elf32_to_cpu(rel->r_offset);
-+ rel->r_offset = elf32_to_cpu(rel->r_offset) + base;
- rel->r_info = elf32_to_cpu(rel->r_info);
- }
- }
-@@ -371,14 +415,14 @@ static void read_relocs(FILE *fp)
-
- static void print_absolute_symbols(void)
- {
-- int i;
-+ unsigned int i;
- printf("Absolute symbols\n");
- printf(" Num: Value Size Type Bind Visibility Name\n");
- for (i = 0; i < ehdr.e_shnum; i++) {
- struct section *sec = &secs[i];
- char *sym_strtab;
- Elf32_Sym *sh_symtab;
-- int j;
-+ unsigned int j;
-
- if (sec->shdr.sh_type != SHT_SYMTAB) {
- continue;
-@@ -406,14 +450,14 @@ static void print_absolute_symbols(void)
-
- static void print_absolute_relocs(void)
- {
-- int i, printed = 0;
-+ unsigned int i, printed = 0;
-
- for (i = 0; i < ehdr.e_shnum; i++) {
- struct section *sec = &secs[i];
- struct section *sec_applies, *sec_symtab;
- char *sym_strtab;
- Elf32_Sym *sh_symtab;
-- int j;
-+ unsigned int j;
- if (sec->shdr.sh_type != SHT_REL) {
- continue;
- }
-@@ -474,13 +518,13 @@ static void print_absolute_relocs(void)
-
- static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
- {
-- int i;
-+ unsigned int i;
- /* Walk through the relocations */
- for (i = 0; i < ehdr.e_shnum; i++) {
- char *sym_strtab;
- Elf32_Sym *sh_symtab;
- struct section *sec_applies, *sec_symtab;
-- int j;
-+ unsigned int j;
- struct section *sec = &secs[i];
-
- if (sec->shdr.sh_type != SHT_REL) {
-@@ -504,6 +548,21 @@ static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
- if (sym->st_shndx == SHN_ABS) {
- continue;
- }
-+ /* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */
-+ if (!strcmp(sec_name(sym->st_shndx), ".data.percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load"))
-+ continue;
-+
-+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32)
-+ /* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
-+ if (!strcmp(sec_name(sym->st_shndx), ".text.end") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
-+ continue;
-+ if (!strcmp(sec_name(sym->st_shndx), ".init.text"))
-+ continue;
-+ if (!strcmp(sec_name(sym->st_shndx), ".exit.text"))
-+ continue;
-+ if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR"))
-+ continue;
-+#endif
- if (r_type == R_386_NONE || r_type == R_386_PC32) {
- /*
- * NONE can be ignored and and PC relative
-@@ -541,7 +600,7 @@ static int cmp_relocs(const void *va, const void *vb)
-
- static void emit_relocs(int as_text)
- {
-- int i;
-+ unsigned int i;
- /* Count how many relocations I have and allocate space for them. */
- reloc_count = 0;
- walk_relocs(count_reloc);
-@@ -634,6 +693,7 @@ int main(int argc, char **argv)
- fname, strerror(errno));
- }
- read_ehdr(fp);
-+ read_phdrs(fp);
- read_shdrs(fp);
- read_strtabs(fp);
- read_symtabs(fp);
-diff --git a/arch/x86/boot/cpucheck.c b/arch/x86/boot/cpucheck.c
-index 4d3ff03..e4972ff 100644
---- a/arch/x86/boot/cpucheck.c
-+++ b/arch/x86/boot/cpucheck.c
-@@ -74,7 +74,7 @@ static int has_fpu(void)
- u16 fcw = -1, fsw = -1;
- u32 cr0;
-
-- asm("movl %%cr0,%0" : "=r" (cr0));
-+ asm volatile("movl %%cr0,%0" : "=r" (cr0));
- if (cr0 & (X86_CR0_EM|X86_CR0_TS)) {
- cr0 &= ~(X86_CR0_EM|X86_CR0_TS);
- asm volatile("movl %0,%%cr0" : : "r" (cr0));
-@@ -90,7 +90,7 @@ static int has_eflag(u32 mask)
- {
- u32 f0, f1;
-
-- asm("pushfl ; "
-+ asm volatile("pushfl ; "
- "pushfl ; "
- "popl %0 ; "
- "movl %0,%1 ; "
-@@ -115,7 +115,7 @@ static void get_flags(void)
- set_bit(X86_FEATURE_FPU, cpu.flags);
-
- if (has_eflag(X86_EFLAGS_ID)) {
-- asm("cpuid"
-+ asm volatile("cpuid"
- : "=a" (max_intel_level),
- "=b" (cpu_vendor[0]),
- "=d" (cpu_vendor[1]),
-@@ -124,7 +124,7 @@ static void get_flags(void)
-
- if (max_intel_level >= 0x00000001 &&
- max_intel_level <= 0x0000ffff) {
-- asm("cpuid"
-+ asm volatile("cpuid"
- : "=a" (tfms),
- "=c" (cpu.flags[4]),
- "=d" (cpu.flags[0])
-@@ -136,7 +136,7 @@ static void get_flags(void)
- cpu.model += ((tfms >> 16) & 0xf) << 4;
- }
-
-- asm("cpuid"
-+ asm volatile("cpuid"
- : "=a" (max_amd_level)
- : "a" (0x80000000)
- : "ebx", "ecx", "edx");
-@@ -144,7 +144,7 @@ static void get_flags(void)
- if (max_amd_level >= 0x80000001 &&
- max_amd_level <= 0x8000ffff) {
- u32 eax = 0x80000001;
-- asm("cpuid"
-+ asm volatile("cpuid"
- : "+a" (eax),
- "=c" (cpu.flags[6]),
- "=d" (cpu.flags[1])
-@@ -203,9 +203,9 @@ int check_cpu(int *cpu_level_ptr, int *req_level_ptr, u32 **err_flags_ptr)
- u32 ecx = MSR_K7_HWCR;
- u32 eax, edx;
-
-- asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
-+ asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
- eax &= ~(1 << 15);
-- asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
-+ asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
-
- get_flags(); /* Make sure it really did something */
- err = check_flags();
-@@ -218,9 +218,9 @@ int check_cpu(int *cpu_level_ptr, int *req_level_ptr, u32 **err_flags_ptr)
- u32 ecx = MSR_VIA_FCR;
- u32 eax, edx;
-
-- asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
-+ asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
- eax |= (1<<1)|(1<<7);
-- asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
-+ asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
-
- set_bit(X86_FEATURE_CX8, cpu.flags);
- err = check_flags();
-@@ -231,12 +231,12 @@ int check_cpu(int *cpu_level_ptr, int *req_level_ptr, u32 **err_flags_ptr)
- u32 eax, edx;
- u32 level = 1;
-
-- asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
-- asm("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
-- asm("cpuid"
-+ asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
-+ asm volatile("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
-+ asm volatile("cpuid"
- : "+a" (level), "=d" (cpu.flags[0])
- : : "ecx", "ebx");
-- asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
-+ asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
-
- err = check_flags();
- }
-diff --git a/arch/x86/boot/header.S b/arch/x86/boot/header.S
-index b31cc54..afdbea1 100644
---- a/arch/x86/boot/header.S
-+++ b/arch/x86/boot/header.S
-@@ -224,10 +224,14 @@ setup_data: .quad 0 # 64-bit physical pointer to
- # single linked list of
- # struct setup_data
-
--pref_address: .quad LOAD_PHYSICAL_ADDR # preferred load addr
-+pref_address: .quad ____LOAD_PHYSICAL_ADDR # preferred load addr
-
- #define ZO_INIT_SIZE (ZO__end - ZO_startup_32 + ZO_z_extract_offset)
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+#define VO_INIT_SIZE (VO__end - VO__text - __PAGE_OFFSET - ____LOAD_PHYSICAL_ADDR)
-+#else
- #define VO_INIT_SIZE (VO__end - VO__text)
-+#endif
- #if ZO_INIT_SIZE > VO_INIT_SIZE
- #define INIT_SIZE ZO_INIT_SIZE
- #else
-diff --git a/arch/x86/boot/memory.c b/arch/x86/boot/memory.c
-index cae3feb..ff8ff2a 100644
---- a/arch/x86/boot/memory.c
-+++ b/arch/x86/boot/memory.c
-@@ -19,7 +19,7 @@
-
- static int detect_memory_e820(void)
- {
-- int count = 0;
-+ unsigned int count = 0;
- struct biosregs ireg, oreg;
- struct e820entry *desc = boot_params.e820_map;
- static struct e820entry buf; /* static so it is zeroed */
-diff --git a/arch/x86/boot/video-vesa.c b/arch/x86/boot/video-vesa.c
-index 11e8c6e..fdbb1ed 100644
---- a/arch/x86/boot/video-vesa.c
-+++ b/arch/x86/boot/video-vesa.c
-@@ -200,6 +200,7 @@ static void vesa_store_pm_info(void)
-
- boot_params.screen_info.vesapm_seg = oreg.es;
- boot_params.screen_info.vesapm_off = oreg.di;
-+ boot_params.screen_info.vesapm_size = oreg.cx;
- }
-
- /*
-diff --git a/arch/x86/boot/video-vga.c b/arch/x86/boot/video-vga.c
-index 819caa1..f32eba9 100644
---- a/arch/x86/boot/video-vga.c
-+++ b/arch/x86/boot/video-vga.c
-@@ -41,13 +41,12 @@ static __videocard video_vga;
- static u8 vga_set_basic_mode(void)
- {
- struct biosregs ireg, oreg;
-- u16 ax;
- u8 rows;
- u8 mode;
-
- initregs(&ireg);
-
-- ax = 0x0f00;
-+ ireg.ax = 0x0f00;
- intcall(0x10, &ireg, &oreg);
- mode = oreg.al;
-
-diff --git a/arch/x86/boot/video.c b/arch/x86/boot/video.c
-index d42da38..787cdf3 100644
---- a/arch/x86/boot/video.c
-+++ b/arch/x86/boot/video.c
-@@ -90,7 +90,7 @@ static void store_mode_params(void)
- static unsigned int get_entry(void)
- {
- char entry_buf[4];
-- int i, len = 0;
-+ unsigned int i, len = 0;
- int key;
- unsigned int v;
-
-diff --git a/arch/x86/crypto/aes-x86_64-asm_64.S b/arch/x86/crypto/aes-x86_64-asm_64.S
-index 5b577d5..3c1fed4 100644
---- a/arch/x86/crypto/aes-x86_64-asm_64.S
-+++ b/arch/x86/crypto/aes-x86_64-asm_64.S
-@@ -8,6 +8,8 @@
- * including this sentence is retained in full.
- */
-
-+#include <asm/alternative-asm.h>
-+
- .extern crypto_ft_tab
- .extern crypto_it_tab
- .extern crypto_fl_tab
-@@ -71,6 +73,8 @@ FUNC: movq r1,r2; \
- je B192; \
- leaq 32(r9),r9;
-
-+#define ret pax_force_retaddr 0, 1; ret
-+
- #define epilogue(r1,r2,r3,r4,r5,r6,r7,r8,r9) \
- movq r1,r2; \
- movq r3,r4; \
-diff --git a/arch/x86/crypto/aesni-intel_asm.S b/arch/x86/crypto/aesni-intel_asm.S
-index eb0566e..e3ebad8 100644
---- a/arch/x86/crypto/aesni-intel_asm.S
-+++ b/arch/x86/crypto/aesni-intel_asm.S
-@@ -16,6 +16,7 @@
- */
-
- #include <linux/linkage.h>
-+#include <asm/alternative-asm.h>
-
- .text
-
-@@ -52,6 +53,7 @@ _key_expansion_256a:
- pxor %xmm1, %xmm0
- movaps %xmm0, (%rcx)
- add $0x10, %rcx
-+ pax_force_retaddr_bts
- ret
-
- _key_expansion_192a:
-@@ -75,6 +77,7 @@ _key_expansion_192a:
- shufps $0b01001110, %xmm2, %xmm1
- movaps %xmm1, 16(%rcx)
- add $0x20, %rcx
-+ pax_force_retaddr_bts
- ret
-
- _key_expansion_192b:
-@@ -93,6 +96,7 @@ _key_expansion_192b:
-
- movaps %xmm0, (%rcx)
- add $0x10, %rcx
-+ pax_force_retaddr_bts
- ret
-
- _key_expansion_256b:
-@@ -104,6 +108,7 @@ _key_expansion_256b:
- pxor %xmm1, %xmm2
- movaps %xmm2, (%rcx)
- add $0x10, %rcx
-+ pax_force_retaddr_bts
- ret
-
- /*
-@@ -239,7 +244,9 @@ ENTRY(aesni_set_key)
- cmp %rcx, %rdi
- jb .Ldec_key_loop
- xor %rax, %rax
-+ pax_force_retaddr 0, 1
- ret
-+ENDPROC(aesni_set_key)
-
- /*
- * void aesni_enc(struct crypto_aes_ctx *ctx, u8 *dst, const u8 *src)
-@@ -249,7 +256,9 @@ ENTRY(aesni_enc)
- movups (INP), STATE # input
- call _aesni_enc1
- movups STATE, (OUTP) # output
-+ pax_force_retaddr 0, 1
- ret
-+ENDPROC(aesni_enc)
-
- /*
- * _aesni_enc1: internal ABI
-@@ -319,6 +328,7 @@ _aesni_enc1:
- movaps 0x70(TKEYP), KEY
- # aesenclast KEY, STATE # last round
- .byte 0x66, 0x0f, 0x38, 0xdd, 0xc2
-+ pax_force_retaddr_bts
- ret
-
- /*
-@@ -482,6 +492,7 @@ _aesni_enc4:
- .byte 0x66, 0x0f, 0x38, 0xdd, 0xea
- # aesenclast KEY, STATE4
- .byte 0x66, 0x0f, 0x38, 0xdd, 0xf2
-+ pax_force_retaddr_bts
- ret
-
- /*
-@@ -493,7 +504,9 @@ ENTRY(aesni_dec)
- movups (INP), STATE # input
- call _aesni_dec1
- movups STATE, (OUTP) #output
-+ pax_force_retaddr 0, 1
- ret
-+ENDPROC(aesni_dec)
-
- /*
- * _aesni_dec1: internal ABI
-@@ -563,6 +576,7 @@ _aesni_dec1:
- movaps 0x70(TKEYP), KEY
- # aesdeclast KEY, STATE # last round
- .byte 0x66, 0x0f, 0x38, 0xdf, 0xc2
-+ pax_force_retaddr_bts
- ret
-
- /*
-@@ -726,6 +740,7 @@ _aesni_dec4:
- .byte 0x66, 0x0f, 0x38, 0xdf, 0xea
- # aesdeclast KEY, STATE4
- .byte 0x66, 0x0f, 0x38, 0xdf, 0xf2
-+ pax_force_retaddr_bts
- ret
-
- /*
-@@ -769,7 +784,9 @@ ENTRY(aesni_ecb_enc)
- cmp $16, LEN
- jge .Lecb_enc_loop1
- .Lecb_enc_ret:
-+ pax_force_retaddr 0, 1
- ret
-+ENDPROC(aesni_ecb_enc)
-
- /*
- * void aesni_ecb_dec(struct crypto_aes_ctx *ctx, const u8 *dst, u8 *src,
-@@ -813,7 +830,9 @@ ENTRY(aesni_ecb_dec)
- cmp $16, LEN
- jge .Lecb_dec_loop1
- .Lecb_dec_ret:
-+ pax_force_retaddr 0, 1
- ret
-+ENDPROC(aesni_ecb_dec)
-
- /*
- * void aesni_cbc_enc(struct crypto_aes_ctx *ctx, const u8 *dst, u8 *src,
-@@ -837,7 +856,9 @@ ENTRY(aesni_cbc_enc)
- jge .Lcbc_enc_loop
- movups STATE, (IVP)
- .Lcbc_enc_ret:
-+ pax_force_retaddr 0, 1
- ret
-+ENDPROC(aesni_cbc_enc)
-
- /*
- * void aesni_cbc_dec(struct crypto_aes_ctx *ctx, const u8 *dst, u8 *src,
-@@ -894,4 +915,6 @@ ENTRY(aesni_cbc_dec)
- .Lcbc_dec_ret:
- movups IV, (IVP)
- .Lcbc_dec_just_ret:
-+ pax_force_retaddr 0, 1
- ret
-+ENDPROC(aesni_cbc_dec)
-diff --git a/arch/x86/crypto/salsa20-x86_64-asm_64.S b/arch/x86/crypto/salsa20-x86_64-asm_64.S
-index 6214a9b..1f4fc9a 100644
---- a/arch/x86/crypto/salsa20-x86_64-asm_64.S
-+++ b/arch/x86/crypto/salsa20-x86_64-asm_64.S
-@@ -1,3 +1,5 @@
-+#include <asm/alternative-asm.h>
-+
- # enter ECRYPT_encrypt_bytes
- .text
- .p2align 5
-@@ -790,6 +792,7 @@ ECRYPT_encrypt_bytes:
- add %r11,%rsp
- mov %rdi,%rax
- mov %rsi,%rdx
-+ pax_force_retaddr 0, 1
- ret
- # bytesatleast65:
- ._bytesatleast65:
-@@ -891,6 +894,7 @@ ECRYPT_keysetup:
- add %r11,%rsp
- mov %rdi,%rax
- mov %rsi,%rdx
-+ pax_force_retaddr
- ret
- # enter ECRYPT_ivsetup
- .text
-@@ -917,4 +921,5 @@ ECRYPT_ivsetup:
- add %r11,%rsp
- mov %rdi,%rax
- mov %rsi,%rdx
-+ pax_force_retaddr
- ret
-diff --git a/arch/x86/crypto/twofish-x86_64-asm_64.S b/arch/x86/crypto/twofish-x86_64-asm_64.S
-index 35974a5..5662ae2 100644
---- a/arch/x86/crypto/twofish-x86_64-asm_64.S
-+++ b/arch/x86/crypto/twofish-x86_64-asm_64.S
-@@ -21,6 +21,7 @@
- .text
-
- #include <asm/asm-offsets.h>
-+#include <asm/alternative-asm.h>
-
- #define a_offset 0
- #define b_offset 4
-@@ -269,6 +270,7 @@ twofish_enc_blk:
-
- popq R1
- movq $1,%rax
-+ pax_force_retaddr 0, 1
- ret
-
- twofish_dec_blk:
-@@ -321,4 +323,5 @@ twofish_dec_blk:
-
- popq R1
- movq $1,%rax
-+ pax_force_retaddr 0, 1
- ret
-diff --git a/arch/x86/ia32/ia32_aout.c b/arch/x86/ia32/ia32_aout.c
-index 14531ab..bc68a7b 100644
---- a/arch/x86/ia32/ia32_aout.c
-+++ b/arch/x86/ia32/ia32_aout.c
-@@ -169,6 +169,8 @@ static int aout_core_dump(long signr, struct pt_regs *regs, struct file *file,
- unsigned long dump_start, dump_size;
- struct user32 dump;
-
-+ memset(&dump, 0, sizeof(dump));
-+
- fs = get_fs();
- set_fs(KERNEL_DS);
- has_dumped = 1;
-@@ -218,12 +220,6 @@ static int aout_core_dump(long signr, struct pt_regs *regs, struct file *file,
- dump_size = dump.u_ssize << PAGE_SHIFT;
- DUMP_WRITE(dump_start, dump_size);
- }
-- /*
-- * Finally dump the task struct. Not be used by gdb, but
-- * could be useful
-- */
-- set_fs(KERNEL_DS);
-- DUMP_WRITE(current, sizeof(*current));
- end_coredump:
- set_fs(fs);
- return has_dumped;
-@@ -327,6 +323,13 @@ static int load_aout_binary(struct linux_binprm *bprm, struct pt_regs *regs)
- current->mm->free_area_cache = TASK_UNMAPPED_BASE;
- current->mm->cached_hole_size = 0;
-
-+ retval = setup_arg_pages(bprm, IA32_STACK_TOP, EXSTACK_DEFAULT);
-+ if (retval < 0) {
-+ /* Someone check-me: is this error path enough? */
-+ send_sig(SIGKILL, current, 0);
-+ return retval;
-+ }
-+
- install_exec_creds(bprm);
- current->flags &= ~PF_FORKNOEXEC;
-
-@@ -422,13 +425,6 @@ beyond_if:
-
- set_brk(current->mm->start_brk, current->mm->brk);
-
-- retval = setup_arg_pages(bprm, IA32_STACK_TOP, EXSTACK_DEFAULT);
-- if (retval < 0) {
-- /* Someone check-me: is this error path enough? */
-- send_sig(SIGKILL, current, 0);
-- return retval;
-- }
--
- current->mm->start_stack =
- (unsigned long)create_aout_tables((char __user *)bprm->p, bprm);
- /* start thread */
-diff --git a/arch/x86/ia32/ia32_signal.c b/arch/x86/ia32/ia32_signal.c
-index 588a7aa..a3468b0 100644
---- a/arch/x86/ia32/ia32_signal.c
-+++ b/arch/x86/ia32/ia32_signal.c
-@@ -167,7 +167,7 @@ asmlinkage long sys32_sigaltstack(const stack_ia32_t __user *uss_ptr,
- }
- seg = get_fs();
- set_fs(KERNEL_DS);
-- ret = do_sigaltstack(uss_ptr ? &uss : NULL, &uoss, regs->sp);
-+ ret = do_sigaltstack(uss_ptr ? (const stack_t __force_user *)&uss : NULL, (stack_t __force_user *)&uoss, regs->sp);
- set_fs(seg);
- if (ret >= 0 && uoss_ptr) {
- if (!access_ok(VERIFY_WRITE, uoss_ptr, sizeof(stack_ia32_t)))
-@@ -374,7 +374,7 @@ static int ia32_setup_sigcontext(struct sigcontext_ia32 __user *sc,
- */
- static void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
- size_t frame_size,
-- void **fpstate)
-+ void __user **fpstate)
- {
- unsigned long sp;
-
-@@ -395,7 +395,7 @@ static void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
-
- if (used_math()) {
- sp = sp - sig_xstate_ia32_size;
-- *fpstate = (struct _fpstate_ia32 *) sp;
-+ *fpstate = (struct _fpstate_ia32 __user *) sp;
- if (save_i387_xstate_ia32(*fpstate) < 0)
- return (void __user *) -1L;
- }
-@@ -403,7 +403,7 @@ static void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
- sp -= frame_size;
- /* Align the stack pointer according to the i386 ABI,
- * i.e. so that on function entry ((sp + 4) & 15) == 0. */
-- sp = ((sp + 4) & -16ul) - 4;
-+ sp = ((sp - 12) & -16ul) - 4;
- return (void __user *) sp;
- }
-
-@@ -461,7 +461,7 @@ int ia32_setup_frame(int sig, struct k_sigaction *ka,
- * These are actually not used anymore, but left because some
- * gdb versions depend on them as a marker.
- */
-- put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
-+ put_user_ex(*((const u64 *)&code), (u64 __user *)frame->retcode);
- } put_user_catch(err);
-
- if (err)
-@@ -503,7 +503,7 @@ int ia32_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
- 0xb8,
- __NR_ia32_rt_sigreturn,
- 0x80cd,
-- 0,
-+ 0
- };
-
- frame = get_sigframe(ka, regs, sizeof(*frame), &fpstate);
-@@ -533,16 +533,18 @@ int ia32_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
-
- if (ka->sa.sa_flags & SA_RESTORER)
- restorer = ka->sa.sa_restorer;
-+ else if (current->mm->context.vdso)
-+ /* Return stub is in 32bit vsyscall page */
-+ restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
- else
-- restorer = VDSO32_SYMBOL(current->mm->context.vdso,
-- rt_sigreturn);
-+ restorer = &frame->retcode;
- put_user_ex(ptr_to_compat(restorer), &frame->pretcode);
-
- /*
- * Not actually used anymore, but left because some gdb
- * versions need it.
- */
-- put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
-+ put_user_ex(*((const u64 *)&code), (u64 __user *)frame->retcode);
- } put_user_catch(err);
-
- if (err)
-diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
-index 4edd8eb..273579e 100644
---- a/arch/x86/ia32/ia32entry.S
-+++ b/arch/x86/ia32/ia32entry.S
-@@ -13,7 +13,9 @@
- #include <asm/thread_info.h>
- #include <asm/segment.h>
- #include <asm/irqflags.h>
-+#include <asm/pgtable.h>
- #include <linux/linkage.h>
-+#include <asm/alternative-asm.h>
-
- /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
- #include <linux/elf-em.h>
-@@ -93,6 +95,32 @@ ENTRY(native_irq_enable_sysexit)
- ENDPROC(native_irq_enable_sysexit)
- #endif
-
-+ .macro pax_enter_kernel_user
-+ pax_set_fptr_mask
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ call pax_enter_kernel_user
-+#endif
-+ .endm
-+
-+ .macro pax_exit_kernel_user
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ call pax_exit_kernel_user
-+#endif
-+#ifdef CONFIG_PAX_RANDKSTACK
-+ pushq %rax
-+ pushq %r11
-+ call pax_randomize_kstack
-+ popq %r11
-+ popq %rax
-+#endif
-+ .endm
-+
-+.macro pax_erase_kstack
-+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
-+ call pax_erase_kstack
-+#endif
-+.endm
-+
- /*
- * 32bit SYSENTER instruction entry.
- *
-@@ -119,12 +147,6 @@ ENTRY(ia32_sysenter_target)
- CFI_REGISTER rsp,rbp
- SWAPGS_UNSAFE_STACK
- movq PER_CPU_VAR(kernel_stack), %rsp
-- addq $(KERNEL_STACK_OFFSET),%rsp
-- /*
-- * No need to follow this irqs on/off section: the syscall
-- * disabled irqs, here we enable it straight after entry:
-- */
-- ENABLE_INTERRUPTS(CLBR_NONE)
- movl %ebp,%ebp /* zero extension */
- pushq $__USER32_DS
- CFI_ADJUST_CFA_OFFSET 8
-@@ -135,28 +157,47 @@ ENTRY(ia32_sysenter_target)
- pushfq
- CFI_ADJUST_CFA_OFFSET 8
- /*CFI_REL_OFFSET rflags,0*/
-- movl 8*3-THREAD_SIZE+TI_sysenter_return(%rsp), %r10d
-- CFI_REGISTER rip,r10
-+ orl $X86_EFLAGS_IF,(%rsp)
-+ GET_THREAD_INFO(%r11)
-+ movl TI_sysenter_return(%r11), %r11d
-+ CFI_REGISTER rip,r11
- pushq $__USER32_CS
- CFI_ADJUST_CFA_OFFSET 8
- /*CFI_REL_OFFSET cs,0*/
- movl %eax, %eax
-- pushq %r10
-+ pushq %r11
- CFI_ADJUST_CFA_OFFSET 8
- CFI_REL_OFFSET rip,0
- pushq %rax
- CFI_ADJUST_CFA_OFFSET 8
- cld
- SAVE_ARGS 0,0,1
-+ pax_enter_kernel_user
-+
-+#ifdef CONFIG_PAX_RANDKSTACK
-+ pax_erase_kstack
-+#endif
-+
-+ /*
-+ * No need to follow this irqs on/off section: the syscall
-+ * disabled irqs, here we enable it straight after entry:
-+ */
-+ ENABLE_INTERRUPTS(CLBR_NONE)
- /* no need to do an access_ok check here because rbp has been
- 32bit zero extended */
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ mov $PAX_USER_SHADOW_BASE,%r11
-+ add %r11,%rbp
-+#endif
-+
- 1: movl (%rbp),%ebp
- .section __ex_table,"a"
- .quad 1b,ia32_badarg
- .previous
-- GET_THREAD_INFO(%r10)
-- orl $TS_COMPAT,TI_status(%r10)
-- testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
-+ GET_THREAD_INFO(%r11)
-+ orl $TS_COMPAT,TI_status(%r11)
-+ testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r11)
- CFI_REMEMBER_STATE
- jnz sysenter_tracesys
- cmpq $(IA32_NR_syscalls-1),%rax
-@@ -166,13 +207,15 @@ sysenter_do_call:
- sysenter_dispatch:
- call *ia32_sys_call_table(,%rax,8)
- movq %rax,RAX-ARGOFFSET(%rsp)
-- GET_THREAD_INFO(%r10)
-+ GET_THREAD_INFO(%r11)
- DISABLE_INTERRUPTS(CLBR_NONE)
- TRACE_IRQS_OFF
-- testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
-+ testl $_TIF_ALLWORK_MASK,TI_flags(%r11)
- jnz sysexit_audit
- sysexit_from_sys_call:
-- andl $~TS_COMPAT,TI_status(%r10)
-+ pax_exit_kernel_user
-+ pax_erase_kstack
-+ andl $~TS_COMPAT,TI_status(%r11)
- /* clear IF, that popfq doesn't enable interrupts early */
- andl $~0x200,EFLAGS-R11(%rsp)
- movl RIP-R11(%rsp),%edx /* User %eip */
-@@ -200,6 +243,9 @@ sysexit_from_sys_call:
- movl %eax,%esi /* 2nd arg: syscall number */
- movl $AUDIT_ARCH_I386,%edi /* 1st arg: audit arch */
- call audit_syscall_entry
-+
-+ pax_erase_kstack
-+
- movl RAX-ARGOFFSET(%rsp),%eax /* reload syscall number */
- cmpq $(IA32_NR_syscalls-1),%rax
- ja ia32_badsys
-@@ -211,7 +257,7 @@ sysexit_from_sys_call:
- .endm
-
- .macro auditsys_exit exit
-- testl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),TI_flags(%r10)
-+ testl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),TI_flags(%r11)
- jnz ia32_ret_from_sys_call
- TRACE_IRQS_ON
- sti
-@@ -221,12 +267,12 @@ sysexit_from_sys_call:
- movzbl %al,%edi /* zero-extend that into %edi */
- inc %edi /* first arg, 0->1(AUDITSC_SUCCESS), 1->2(AUDITSC_FAILURE) */
- call audit_syscall_exit
-- GET_THREAD_INFO(%r10)
-+ GET_THREAD_INFO(%r11)
- movl RAX-ARGOFFSET(%rsp),%eax /* reload syscall return value */
- movl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),%edi
- cli
- TRACE_IRQS_OFF
-- testl %edi,TI_flags(%r10)
-+ testl %edi,TI_flags(%r11)
- jz \exit
- CLEAR_RREGS -ARGOFFSET
- jmp int_with_check
-@@ -244,7 +290,7 @@ sysexit_audit:
-
- sysenter_tracesys:
- #ifdef CONFIG_AUDITSYSCALL
-- testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%r10)
-+ testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%r11)
- jz sysenter_auditsys
- #endif
- SAVE_REST
-@@ -256,6 +302,9 @@ sysenter_tracesys:
- RESTORE_REST
- cmpq $(IA32_NR_syscalls-1),%rax
- ja int_ret_from_sys_call /* sysenter_tracesys has set RAX(%rsp) */
-+
-+ pax_erase_kstack
-+
- jmp sysenter_do_call
- CFI_ENDPROC
- ENDPROC(ia32_sysenter_target)
-@@ -283,19 +332,25 @@ ENDPROC(ia32_sysenter_target)
- ENTRY(ia32_cstar_target)
- CFI_STARTPROC32 simple
- CFI_SIGNAL_FRAME
-- CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
-+ CFI_DEF_CFA rsp,0
- CFI_REGISTER rip,rcx
- /*CFI_REGISTER rflags,r11*/
- SWAPGS_UNSAFE_STACK
- movl %esp,%r8d
- CFI_REGISTER rsp,r8
- movq PER_CPU_VAR(kernel_stack),%rsp
-+ SAVE_ARGS 8*6,1,1
-+ pax_enter_kernel_user
-+
-+#ifdef CONFIG_PAX_RANDKSTACK
-+ pax_erase_kstack
-+#endif
-+
- /*
- * No need to follow this irqs on/off section: the syscall
- * disabled irqs and here we enable it straight after entry:
- */
- ENABLE_INTERRUPTS(CLBR_NONE)
-- SAVE_ARGS 8,1,1
- movl %eax,%eax /* zero extension */
- movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
- movq %rcx,RIP-ARGOFFSET(%rsp)
-@@ -311,13 +366,19 @@ ENTRY(ia32_cstar_target)
- /* no need to do an access_ok check here because r8 has been
- 32bit zero extended */
- /* hardware stack frame is complete now */
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ mov $PAX_USER_SHADOW_BASE,%r11
-+ add %r11,%r8
-+#endif
-+
- 1: movl (%r8),%r9d
- .section __ex_table,"a"
- .quad 1b,ia32_badarg
- .previous
-- GET_THREAD_INFO(%r10)
-- orl $TS_COMPAT,TI_status(%r10)
-- testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
-+ GET_THREAD_INFO(%r11)
-+ orl $TS_COMPAT,TI_status(%r11)
-+ testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r11)
- CFI_REMEMBER_STATE
- jnz cstar_tracesys
- cmpq $IA32_NR_syscalls-1,%rax
-@@ -327,13 +388,15 @@ cstar_do_call:
- cstar_dispatch:
- call *ia32_sys_call_table(,%rax,8)
- movq %rax,RAX-ARGOFFSET(%rsp)
-- GET_THREAD_INFO(%r10)
-+ GET_THREAD_INFO(%r11)
- DISABLE_INTERRUPTS(CLBR_NONE)
- TRACE_IRQS_OFF
-- testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
-+ testl $_TIF_ALLWORK_MASK,TI_flags(%r11)
- jnz sysretl_audit
- sysretl_from_sys_call:
-- andl $~TS_COMPAT,TI_status(%r10)
-+ pax_exit_kernel_user
-+ pax_erase_kstack
-+ andl $~TS_COMPAT,TI_status(%r11)
- RESTORE_ARGS 1,-ARG_SKIP,1,1,1
- movl RIP-ARGOFFSET(%rsp),%ecx
- CFI_REGISTER rip,rcx
-@@ -361,7 +424,7 @@ sysretl_audit:
-
- cstar_tracesys:
- #ifdef CONFIG_AUDITSYSCALL
-- testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%r10)
-+ testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%r11)
- jz cstar_auditsys
- #endif
- xchgl %r9d,%ebp
-@@ -375,6 +438,9 @@ cstar_tracesys:
- xchgl %ebp,%r9d
- cmpq $(IA32_NR_syscalls-1),%rax
- ja int_ret_from_sys_call /* cstar_tracesys has set RAX(%rsp) */
-+
-+ pax_erase_kstack
-+
- jmp cstar_do_call
- END(ia32_cstar_target)
-
-@@ -415,11 +481,6 @@ ENTRY(ia32_syscall)
- CFI_REL_OFFSET rip,RIP-RIP
- PARAVIRT_ADJUST_EXCEPTION_FRAME
- SWAPGS
-- /*
-- * No need to follow this irqs on/off section: the syscall
-- * disabled irqs and here we enable it straight after entry:
-- */
-- ENABLE_INTERRUPTS(CLBR_NONE)
- movl %eax,%eax
- pushq %rax
- CFI_ADJUST_CFA_OFFSET 8
-@@ -427,9 +488,20 @@ ENTRY(ia32_syscall)
- /* note the registers are not zero extended to the sf.
- this could be a problem. */
- SAVE_ARGS 0,0,1
-- GET_THREAD_INFO(%r10)
-- orl $TS_COMPAT,TI_status(%r10)
-- testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
-+ pax_enter_kernel_user
-+
-+#ifdef CONFIG_PAX_RANDKSTACK
-+ pax_erase_kstack
-+#endif
-+
-+ /*
-+ * No need to follow this irqs on/off section: the syscall
-+ * disabled irqs and here we enable it straight after entry:
-+ */
-+ ENABLE_INTERRUPTS(CLBR_NONE)
-+ GET_THREAD_INFO(%r11)
-+ orl $TS_COMPAT,TI_status(%r11)
-+ testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r11)
- jnz ia32_tracesys
- cmpq $(IA32_NR_syscalls-1),%rax
- ja ia32_badsys
-@@ -452,6 +524,9 @@ ia32_tracesys:
- RESTORE_REST
- cmpq $(IA32_NR_syscalls-1),%rax
- ja int_ret_from_sys_call /* ia32_tracesys has set RAX(%rsp) */
-+
-+ pax_erase_kstack
-+
- jmp ia32_do_call
- END(ia32_syscall)
-
-@@ -462,6 +537,7 @@ ia32_badsys:
-
- quiet_ni_syscall:
- movq $-ENOSYS,%rax
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
-
-diff --git a/arch/x86/ia32/sys_ia32.c b/arch/x86/ia32/sys_ia32.c
-index 016218c..c5cd85d 100644
---- a/arch/x86/ia32/sys_ia32.c
-+++ b/arch/x86/ia32/sys_ia32.c
-@@ -69,8 +69,8 @@ asmlinkage long sys32_ftruncate64(unsigned int fd, unsigned long offset_low,
- */
- static int cp_stat64(struct stat64 __user *ubuf, struct kstat *stat)
- {
-- typeof(ubuf->st_uid) uid = 0;
-- typeof(ubuf->st_gid) gid = 0;
-+ typeof(((struct stat64 *)0)->st_uid) uid = 0;
-+ typeof(((struct stat64 *)0)->st_gid) gid = 0;
- SET_UID(uid, stat->uid);
- SET_GID(gid, stat->gid);
- if (!access_ok(VERIFY_WRITE, ubuf, sizeof(struct stat64)) ||
-@@ -308,8 +308,8 @@ asmlinkage long sys32_rt_sigprocmask(int how, compat_sigset_t __user *set,
- }
- set_fs(KERNEL_DS);
- ret = sys_rt_sigprocmask(how,
-- set ? (sigset_t __user *)&s : NULL,
-- oset ? (sigset_t __user *)&s : NULL,
-+ set ? (sigset_t __force_user *)&s : NULL,
-+ oset ? (sigset_t __force_user *)&s : NULL,
- sigsetsize);
- set_fs(old_fs);
- if (ret)
-@@ -371,7 +371,7 @@ asmlinkage long sys32_sched_rr_get_interval(compat_pid_t pid,
- mm_segment_t old_fs = get_fs();
-
- set_fs(KERNEL_DS);
-- ret = sys_sched_rr_get_interval(pid, (struct timespec __user *)&t);
-+ ret = sys_sched_rr_get_interval(pid, (struct timespec __force_user *)&t);
- set_fs(old_fs);
- if (put_compat_timespec(&t, interval))
- return -EFAULT;
-@@ -381,13 +381,13 @@ asmlinkage long sys32_sched_rr_get_interval(compat_pid_t pid,
- asmlinkage long sys32_rt_sigpending(compat_sigset_t __user *set,
- compat_size_t sigsetsize)
- {
-- sigset_t s;
-+ sigset_t s = { };
- compat_sigset_t s32;
- int ret;
- mm_segment_t old_fs = get_fs();
-
- set_fs(KERNEL_DS);
-- ret = sys_rt_sigpending((sigset_t __user *)&s, sigsetsize);
-+ ret = sys_rt_sigpending((sigset_t __force_user *)&s, sigsetsize);
- set_fs(old_fs);
- if (!ret) {
- switch (_NSIG_WORDS) {
-@@ -412,7 +412,7 @@ asmlinkage long sys32_rt_sigqueueinfo(int pid, int sig,
- if (copy_siginfo_from_user32(&info, uinfo))
- return -EFAULT;
- set_fs(KERNEL_DS);
-- ret = sys_rt_sigqueueinfo(pid, sig, (siginfo_t __user *)&info);
-+ ret = sys_rt_sigqueueinfo(pid, sig, (siginfo_t __force_user *)&info);
- set_fs(old_fs);
- return ret;
- }
-@@ -513,7 +513,7 @@ asmlinkage long sys32_sendfile(int out_fd, int in_fd,
- return -EFAULT;
-
- set_fs(KERNEL_DS);
-- ret = sys_sendfile(out_fd, in_fd, offset ? (off_t __user *)&of : NULL,
-+ ret = sys_sendfile(out_fd, in_fd, offset ? (off_t __force_user *)&of : NULL,
- count);
- set_fs(old_fs);
-
-diff --git a/arch/x86/include/asm/alternative-asm.h b/arch/x86/include/asm/alternative-asm.h
-index e2077d3..17d07ad 100644
---- a/arch/x86/include/asm/alternative-asm.h
-+++ b/arch/x86/include/asm/alternative-asm.h
-@@ -8,10 +8,10 @@
-
- #ifdef CONFIG_SMP
- .macro LOCK_PREFIX
--1: lock
-+672: lock
- .section .smp_locks,"a"
- .align 4
-- X86_ALIGN 1b
-+ X86_ALIGN 672b
- .previous
- .endm
- #else
-@@ -19,4 +19,43 @@
- .endm
- #endif
-
-+#ifdef KERNEXEC_PLUGIN
-+ .macro pax_force_retaddr_bts rip=0
-+ btsq $63,\rip(%rsp)
-+ .endm
-+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_BTS
-+ .macro pax_force_retaddr rip=0, reload=0
-+ btsq $63,\rip(%rsp)
-+ .endm
-+ .macro pax_force_fptr ptr
-+ btsq $63,\ptr
-+ .endm
-+ .macro pax_set_fptr_mask
-+ .endm
-+#endif
-+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR
-+ .macro pax_force_retaddr rip=0, reload=0
-+ .if \reload
-+ pax_set_fptr_mask
-+ .endif
-+ orq %r10,\rip(%rsp)
-+ .endm
-+ .macro pax_force_fptr ptr
-+ orq %r10,\ptr
-+ .endm
-+ .macro pax_set_fptr_mask
-+ movabs $0x8000000000000000,%r10
-+ .endm
-+#endif
-+#else
-+ .macro pax_force_retaddr rip=0, reload=0
-+ .endm
-+ .macro pax_force_fptr ptr
-+ .endm
-+ .macro pax_force_retaddr_bts rip=0
-+ .endm
-+ .macro pax_set_fptr_mask
-+ .endm
-+#endif
-+
- #endif /* __ASSEMBLY__ */
-diff --git a/arch/x86/include/asm/alternative.h b/arch/x86/include/asm/alternative.h
-index c240efc..fdfadf3 100644
---- a/arch/x86/include/asm/alternative.h
-+++ b/arch/x86/include/asm/alternative.h
-@@ -85,7 +85,7 @@ static inline void alternatives_smp_switch(int smp) {}
- " .byte 662b-661b\n" /* sourcelen */ \
- " .byte 664f-663f\n" /* replacementlen */ \
- ".previous\n" \
-- ".section .altinstr_replacement, \"ax\"\n" \
-+ ".section .altinstr_replacement, \"a\"\n" \
- "663:\n\t" newinstr "\n664:\n" /* replacement */ \
- ".previous"
-
-diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h
-index 474d80d..1f97d58 100644
---- a/arch/x86/include/asm/apic.h
-+++ b/arch/x86/include/asm/apic.h
-@@ -46,7 +46,7 @@ static inline void generic_apic_probe(void)
-
- #ifdef CONFIG_X86_LOCAL_APIC
-
--extern unsigned int apic_verbosity;
-+extern int apic_verbosity;
- extern int local_apic_timer_c2_ok;
-
- extern int disable_apic;
-diff --git a/arch/x86/include/asm/apm.h b/arch/x86/include/asm/apm.h
-index 20370c6..a2eb9b0 100644
---- a/arch/x86/include/asm/apm.h
-+++ b/arch/x86/include/asm/apm.h
-@@ -34,7 +34,7 @@ static inline void apm_bios_call_asm(u32 func, u32 ebx_in, u32 ecx_in,
- __asm__ __volatile__(APM_DO_ZERO_SEGS
- "pushl %%edi\n\t"
- "pushl %%ebp\n\t"
-- "lcall *%%cs:apm_bios_entry\n\t"
-+ "lcall *%%ss:apm_bios_entry\n\t"
- "setc %%al\n\t"
- "popl %%ebp\n\t"
- "popl %%edi\n\t"
-@@ -58,7 +58,7 @@ static inline u8 apm_bios_call_simple_asm(u32 func, u32 ebx_in,
- __asm__ __volatile__(APM_DO_ZERO_SEGS
- "pushl %%edi\n\t"
- "pushl %%ebp\n\t"
-- "lcall *%%cs:apm_bios_entry\n\t"
-+ "lcall *%%ss:apm_bios_entry\n\t"
- "setc %%bl\n\t"
- "popl %%ebp\n\t"
- "popl %%edi\n\t"
-diff --git a/arch/x86/include/asm/atomic_32.h b/arch/x86/include/asm/atomic_32.h
-index dc5a667..7a2470f 100644
---- a/arch/x86/include/asm/atomic_32.h
-+++ b/arch/x86/include/asm/atomic_32.h
-@@ -25,6 +25,17 @@ static inline int atomic_read(const atomic_t *v)
- }
-
- /**
-+ * atomic_read_unchecked - read atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically reads the value of @v.
-+ */
-+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
-+{
-+ return v->counter;
-+}
-+
-+/**
- * atomic_set - set atomic variable
- * @v: pointer of type atomic_t
- * @i: required value
-@@ -37,6 +48,18 @@ static inline void atomic_set(atomic_t *v, int i)
- }
-
- /**
-+ * atomic_set_unchecked - set atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ * @i: required value
-+ *
-+ * Atomically sets the value of @v to @i.
-+ */
-+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
-+{
-+ v->counter = i;
-+}
-+
-+/**
- * atomic_add - add integer to atomic variable
- * @i: integer value to add
- * @v: pointer of type atomic_t
-@@ -45,7 +68,29 @@ static inline void atomic_set(atomic_t *v, int i)
- */
- static inline void atomic_add(int i, atomic_t *v)
- {
-- asm volatile(LOCK_PREFIX "addl %1,%0"
-+ asm volatile(LOCK_PREFIX "addl %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "subl %1,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "+m" (v->counter)
-+ : "ir" (i));
-+}
-+
-+/**
-+ * atomic_add_unchecked - add integer to atomic variable
-+ * @i: integer value to add
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically adds @i to @v.
-+ */
-+static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "addl %1,%0\n"
- : "+m" (v->counter)
- : "ir" (i));
- }
-@@ -59,7 +104,29 @@ static inline void atomic_add(int i, atomic_t *v)
- */
- static inline void atomic_sub(int i, atomic_t *v)
- {
-- asm volatile(LOCK_PREFIX "subl %1,%0"
-+ asm volatile(LOCK_PREFIX "subl %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "addl %1,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "+m" (v->counter)
-+ : "ir" (i));
-+}
-+
-+/**
-+ * atomic_sub_unchecked - subtract integer from atomic variable
-+ * @i: integer value to subtract
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically subtracts @i from @v.
-+ */
-+static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "subl %1,%0\n"
- : "+m" (v->counter)
- : "ir" (i));
- }
-@@ -77,7 +144,16 @@ static inline int atomic_sub_and_test(int i, atomic_t *v)
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
-+ asm volatile(LOCK_PREFIX "subl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "addl %2,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
- : "+m" (v->counter), "=qm" (c)
- : "ir" (i) : "memory");
- return c;
-@@ -91,7 +167,27 @@ static inline int atomic_sub_and_test(int i, atomic_t *v)
- */
- static inline void atomic_inc(atomic_t *v)
- {
-- asm volatile(LOCK_PREFIX "incl %0"
-+ asm volatile(LOCK_PREFIX "incl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "decl %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "+m" (v->counter));
-+}
-+
-+/**
-+ * atomic_inc_unchecked - increment atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically increments @v by 1.
-+ */
-+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "incl %0\n"
- : "+m" (v->counter));
- }
-
-@@ -103,7 +199,27 @@ static inline void atomic_inc(atomic_t *v)
- */
- static inline void atomic_dec(atomic_t *v)
- {
-- asm volatile(LOCK_PREFIX "decl %0"
-+ asm volatile(LOCK_PREFIX "decl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "incl %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "+m" (v->counter));
-+}
-+
-+/**
-+ * atomic_dec_unchecked - decrement atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically decrements @v by 1.
-+ */
-+static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "decl %0\n"
- : "+m" (v->counter));
- }
-
-@@ -119,7 +235,16 @@ static inline int atomic_dec_and_test(atomic_t *v)
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "decl %0; sete %1"
-+ asm volatile(LOCK_PREFIX "decl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "incl %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
- : "+m" (v->counter), "=qm" (c)
- : : "memory");
- return c != 0;
-@@ -137,7 +262,35 @@ static inline int atomic_inc_and_test(atomic_t *v)
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "incl %0; sete %1"
-+ asm volatile(LOCK_PREFIX "incl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "decl %0\n"
-+ "into\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
-+ : "+m" (v->counter), "=qm" (c)
-+ : : "memory");
-+ return c != 0;
-+}
-+
-+/**
-+ * atomic_inc_and_test_unchecked - increment and test
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically increments @v by 1
-+ * and returns true if the result is zero, or false for all
-+ * other cases.
-+ */
-+static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
-+{
-+ unsigned char c;
-+
-+ asm volatile(LOCK_PREFIX "incl %0\n"
-+ "sete %1\n"
- : "+m" (v->counter), "=qm" (c)
- : : "memory");
- return c != 0;
-@@ -156,7 +309,16 @@ static inline int atomic_add_negative(int i, atomic_t *v)
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
-+ asm volatile(LOCK_PREFIX "addl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "subl %2,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sets %1\n"
- : "+m" (v->counter), "=qm" (c)
- : "ir" (i) : "memory");
- return c;
-@@ -179,7 +341,15 @@ static inline int atomic_add_return(int i, atomic_t *v)
- #endif
- /* Modern 486+ processor */
- __i = i;
-- asm volatile(LOCK_PREFIX "xaddl %0, %1"
-+ asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ "movl %0, %1\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- : "+r" (i), "+m" (v->counter)
- : : "memory");
- return i + __i;
-@@ -195,6 +365,38 @@ no_xadd: /* Legacy 386 processor */
- }
-
- /**
-+ * atomic_add_return_unchecked - add integer and return
-+ * @v: pointer of type atomic_unchecked_t
-+ * @i: integer value to add
-+ *
-+ * Atomically adds @i to @v and returns @i + @v
-+ */
-+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
-+{
-+ int __i;
-+#ifdef CONFIG_M386
-+ unsigned long flags;
-+ if (unlikely(boot_cpu_data.x86 <= 3))
-+ goto no_xadd;
-+#endif
-+ /* Modern 486+ processor */
-+ __i = i;
-+ asm volatile(LOCK_PREFIX "xaddl %0, %1"
-+ : "+r" (i), "+m" (v->counter)
-+ : : "memory");
-+ return i + __i;
-+
-+#ifdef CONFIG_M386
-+no_xadd: /* Legacy 386 processor */
-+ local_irq_save(flags);
-+ __i = atomic_read_unchecked(v);
-+ atomic_set_unchecked(v, i + __i);
-+ local_irq_restore(flags);
-+ return i + __i;
-+#endif
-+}
-+
-+/**
- * atomic_sub_return - subtract integer and return
- * @v: pointer of type atomic_t
- * @i: integer value to subtract
-@@ -211,11 +413,21 @@ static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
- return cmpxchg(&v->counter, old, new);
- }
-
-+static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
-+{
-+ return cmpxchg(&v->counter, old, new);
-+}
-+
- static inline int atomic_xchg(atomic_t *v, int new)
- {
- return xchg(&v->counter, new);
- }
-
-+static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
-+{
-+ return xchg(&v->counter, new);
-+}
-+
- /**
- * atomic_add_unless - add unless the number is already a given value
- * @v: pointer of type atomic_t
-@@ -227,32 +439,73 @@ static inline int atomic_xchg(atomic_t *v, int new)
- */
- static inline int atomic_add_unless(atomic_t *v, int a, int u)
- {
-- int c, old;
-+ int c, old, new;
- c = atomic_read(v);
- for (;;) {
-- if (unlikely(c == (u)))
-+ if (unlikely(c == u))
- break;
-- old = atomic_cmpxchg((v), c, c + (a));
-+
-+ asm volatile("addl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ "subl %2,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "=r" (new)
-+ : "0" (c), "ir" (a));
-+
-+ old = atomic_cmpxchg(v, c, new);
- if (likely(old == c))
- break;
- c = old;
- }
-- return c != (u);
-+ return c != u;
- }
-
- #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
-
- #define atomic_inc_return(v) (atomic_add_return(1, v))
-+static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
-+{
-+ return atomic_add_return_unchecked(1, v);
-+}
- #define atomic_dec_return(v) (atomic_sub_return(1, v))
-
- /* These are x86-specific, used by some header files */
--#define atomic_clear_mask(mask, addr) \
-- asm volatile(LOCK_PREFIX "andl %0,%1" \
-- : : "r" (~(mask)), "m" (*(addr)) : "memory")
-+static inline void atomic_clear_mask(unsigned int mask, atomic_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "andl %1,%0"
-+ : "+m" (v->counter)
-+ : "r" (~(mask))
-+ : "memory");
-+}
-
--#define atomic_set_mask(mask, addr) \
-- asm volatile(LOCK_PREFIX "orl %0,%1" \
-- : : "r" (mask), "m" (*(addr)) : "memory")
-+static inline void atomic_clear_mask_unchecked(unsigned int mask, atomic_unchecked_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "andl %1,%0"
-+ : "+m" (v->counter)
-+ : "r" (~(mask))
-+ : "memory");
-+}
-+
-+static inline void atomic_set_mask(unsigned int mask, atomic_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "orl %1,%0"
-+ : "+m" (v->counter)
-+ : "r" (mask)
-+ : "memory");
-+}
-+
-+static inline void atomic_set_mask_unchecked(unsigned int mask, atomic_unchecked_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "orl %1,%0"
-+ : "+m" (v->counter)
-+ : "r" (mask)
-+ : "memory");
-+}
-
- /* Atomic operations are already serializing on x86 */
- #define smp_mb__before_atomic_dec() barrier()
-@@ -266,9 +519,18 @@ typedef struct {
- u64 __aligned(8) counter;
- } atomic64_t;
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+typedef struct {
-+ u64 __aligned(8) counter;
-+} atomic64_unchecked_t;
-+#else
-+typedef atomic64_t atomic64_unchecked_t;
-+#endif
-+
- #define ATOMIC64_INIT(val) { (val) }
-
- extern u64 atomic64_cmpxchg(atomic64_t *ptr, u64 old_val, u64 new_val);
-+extern u64 atomic64_cmpxchg_unchecked(atomic64_unchecked_t *ptr, u64 old_val, u64 new_val);
-
- /**
- * atomic64_xchg - xchg atomic64 variable
-@@ -279,6 +541,7 @@ extern u64 atomic64_cmpxchg(atomic64_t *ptr, u64 old_val, u64 new_val);
- * the old value.
- */
- extern u64 atomic64_xchg(atomic64_t *ptr, u64 new_val);
-+extern u64 atomic64_xchg_unchecked(atomic64_unchecked_t *ptr, u64 new_val);
-
- /**
- * atomic64_set - set atomic64 variable
-@@ -290,6 +553,15 @@ extern u64 atomic64_xchg(atomic64_t *ptr, u64 new_val);
- extern void atomic64_set(atomic64_t *ptr, u64 new_val);
-
- /**
-+ * atomic64_unchecked_set - set atomic64 variable
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ * @new_val: value to assign
-+ *
-+ * Atomically sets the value of @ptr to @new_val.
-+ */
-+extern void atomic64_set_unchecked(atomic64_unchecked_t *ptr, u64 new_val);
-+
-+/**
- * atomic64_read - read atomic64 variable
- * @ptr: pointer to type atomic64_t
- *
-@@ -317,7 +589,33 @@ static inline u64 atomic64_read(atomic64_t *ptr)
- return res;
- }
-
--extern u64 atomic64_read(atomic64_t *ptr);
-+/**
-+ * atomic64_read_unchecked - read atomic64 variable
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically reads the value of @ptr and returns it.
-+ */
-+static inline u64 atomic64_read_unchecked(atomic64_unchecked_t *ptr)
-+{
-+ u64 res;
-+
-+ /*
-+ * Note, we inline this atomic64_unchecked_t primitive because
-+ * it only clobbers EAX/EDX and leaves the others
-+ * untouched. We also (somewhat subtly) rely on the
-+ * fact that cmpxchg8b returns the current 64-bit value
-+ * of the memory location we are touching:
-+ */
-+ asm volatile(
-+ "mov %%ebx, %%eax\n\t"
-+ "mov %%ecx, %%edx\n\t"
-+ LOCK_PREFIX "cmpxchg8b %1\n"
-+ : "=&A" (res)
-+ : "m" (*ptr)
-+ );
-+
-+ return res;
-+}
-
- /**
- * atomic64_add_return - add and return
-@@ -332,8 +630,11 @@ extern u64 atomic64_add_return(u64 delta, atomic64_t *ptr);
- * Other variants with different arithmetic operators:
- */
- extern u64 atomic64_sub_return(u64 delta, atomic64_t *ptr);
-+extern u64 atomic64_sub_return_unchecked(u64 delta, atomic64_unchecked_t *ptr);
- extern u64 atomic64_inc_return(atomic64_t *ptr);
-+extern u64 atomic64_inc_return_unchecked(atomic64_unchecked_t *ptr);
- extern u64 atomic64_dec_return(atomic64_t *ptr);
-+extern u64 atomic64_dec_return_unchecked(atomic64_unchecked_t *ptr);
-
- /**
- * atomic64_add - add integer to atomic64 variable
-@@ -345,6 +646,15 @@ extern u64 atomic64_dec_return(atomic64_t *ptr);
- extern void atomic64_add(u64 delta, atomic64_t *ptr);
-
- /**
-+ * atomic64_add_unchecked - add integer to atomic64 variable
-+ * @delta: integer value to add
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically adds @delta to @ptr.
-+ */
-+extern void atomic64_add_unchecked(u64 delta, atomic64_unchecked_t *ptr);
-+
-+/**
- * atomic64_sub - subtract the atomic64 variable
- * @delta: integer value to subtract
- * @ptr: pointer to type atomic64_t
-@@ -354,6 +664,15 @@ extern void atomic64_add(u64 delta, atomic64_t *ptr);
- extern void atomic64_sub(u64 delta, atomic64_t *ptr);
-
- /**
-+ * atomic64_sub_unchecked - subtract the atomic64 variable
-+ * @delta: integer value to subtract
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically subtracts @delta from @ptr.
-+ */
-+extern void atomic64_sub_unchecked(u64 delta, atomic64_unchecked_t *ptr);
-+
-+/**
- * atomic64_sub_and_test - subtract value from variable and test result
- * @delta: integer value to subtract
- * @ptr: pointer to type atomic64_t
-@@ -373,6 +692,14 @@ extern int atomic64_sub_and_test(u64 delta, atomic64_t *ptr);
- extern void atomic64_inc(atomic64_t *ptr);
-
- /**
-+ * atomic64_inc_unchecked - increment atomic64 variable
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically increments @ptr by 1.
-+ */
-+extern void atomic64_inc_unchecked(atomic64_unchecked_t *ptr);
-+
-+/**
- * atomic64_dec - decrement atomic64 variable
- * @ptr: pointer to type atomic64_t
- *
-@@ -381,6 +708,14 @@ extern void atomic64_inc(atomic64_t *ptr);
- extern void atomic64_dec(atomic64_t *ptr);
-
- /**
-+ * atomic64_dec_unchecked - decrement atomic64 variable
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically decrements @ptr by 1.
-+ */
-+extern void atomic64_dec_unchecked(atomic64_unchecked_t *ptr);
-+
-+/**
- * atomic64_dec_and_test - decrement and test
- * @ptr: pointer to type atomic64_t
- *
-diff --git a/arch/x86/include/asm/atomic_64.h b/arch/x86/include/asm/atomic_64.h
-index d605dc2..72cb5cd 100644
---- a/arch/x86/include/asm/atomic_64.h
-+++ b/arch/x86/include/asm/atomic_64.h
-@@ -24,6 +24,17 @@ static inline int atomic_read(const atomic_t *v)
- }
-
- /**
-+ * atomic_read_unchecked - read atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically reads the value of @v.
-+ */
-+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
-+{
-+ return v->counter;
-+}
-+
-+/**
- * atomic_set - set atomic variable
- * @v: pointer of type atomic_t
- * @i: required value
-@@ -36,6 +47,18 @@ static inline void atomic_set(atomic_t *v, int i)
- }
-
- /**
-+ * atomic_set_unchecked - set atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ * @i: required value
-+ *
-+ * Atomically sets the value of @v to @i.
-+ */
-+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
-+{
-+ v->counter = i;
-+}
-+
-+/**
- * atomic_add - add integer to atomic variable
- * @i: integer value to add
- * @v: pointer of type atomic_t
-@@ -44,7 +67,29 @@ static inline void atomic_set(atomic_t *v, int i)
- */
- static inline void atomic_add(int i, atomic_t *v)
- {
-- asm volatile(LOCK_PREFIX "addl %1,%0"
-+ asm volatile(LOCK_PREFIX "addl %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "subl %1,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "=m" (v->counter)
-+ : "ir" (i), "m" (v->counter));
-+}
-+
-+/**
-+ * atomic_add_unchecked - add integer to atomic variable
-+ * @i: integer value to add
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically adds @i to @v.
-+ */
-+static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "addl %1,%0\n"
- : "=m" (v->counter)
- : "ir" (i), "m" (v->counter));
- }
-@@ -58,7 +103,29 @@ static inline void atomic_add(int i, atomic_t *v)
- */
- static inline void atomic_sub(int i, atomic_t *v)
- {
-- asm volatile(LOCK_PREFIX "subl %1,%0"
-+ asm volatile(LOCK_PREFIX "subl %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "addl %1,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "=m" (v->counter)
-+ : "ir" (i), "m" (v->counter));
-+}
-+
-+/**
-+ * atomic_sub_unchecked - subtract the atomic variable
-+ * @i: integer value to subtract
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically subtracts @i from @v.
-+ */
-+static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "subl %1,%0\n"
- : "=m" (v->counter)
- : "ir" (i), "m" (v->counter));
- }
-@@ -76,7 +143,16 @@ static inline int atomic_sub_and_test(int i, atomic_t *v)
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
-+ asm volatile(LOCK_PREFIX "subl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "addl %2,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
- : "=m" (v->counter), "=qm" (c)
- : "ir" (i), "m" (v->counter) : "memory");
- return c;
-@@ -90,7 +166,28 @@ static inline int atomic_sub_and_test(int i, atomic_t *v)
- */
- static inline void atomic_inc(atomic_t *v)
- {
-- asm volatile(LOCK_PREFIX "incl %0"
-+ asm volatile(LOCK_PREFIX "incl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "decl %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "=m" (v->counter)
-+ : "m" (v->counter));
-+}
-+
-+/**
-+ * atomic_inc_unchecked - increment atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically increments @v by 1.
-+ */
-+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "incl %0\n"
- : "=m" (v->counter)
- : "m" (v->counter));
- }
-@@ -103,7 +200,28 @@ static inline void atomic_inc(atomic_t *v)
- */
- static inline void atomic_dec(atomic_t *v)
- {
-- asm volatile(LOCK_PREFIX "decl %0"
-+ asm volatile(LOCK_PREFIX "decl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "incl %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "=m" (v->counter)
-+ : "m" (v->counter));
-+}
-+
-+/**
-+ * atomic_dec_unchecked - decrement atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically decrements @v by 1.
-+ */
-+static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "decl %0\n"
- : "=m" (v->counter)
- : "m" (v->counter));
- }
-@@ -120,7 +238,16 @@ static inline int atomic_dec_and_test(atomic_t *v)
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "decl %0; sete %1"
-+ asm volatile(LOCK_PREFIX "decl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "incl %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
- : "=m" (v->counter), "=qm" (c)
- : "m" (v->counter) : "memory");
- return c != 0;
-@@ -138,7 +265,35 @@ static inline int atomic_inc_and_test(atomic_t *v)
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "incl %0; sete %1"
-+ asm volatile(LOCK_PREFIX "incl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "decl %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
-+ : "=m" (v->counter), "=qm" (c)
-+ : "m" (v->counter) : "memory");
-+ return c != 0;
-+}
-+
-+/**
-+ * atomic_inc_and_test_unchecked - increment and test
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically increments @v by 1
-+ * and returns true if the result is zero, or false for all
-+ * other cases.
-+ */
-+static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
-+{
-+ unsigned char c;
-+
-+ asm volatile(LOCK_PREFIX "incl %0\n"
-+ "sete %1\n"
- : "=m" (v->counter), "=qm" (c)
- : "m" (v->counter) : "memory");
- return c != 0;
-@@ -157,7 +312,16 @@ static inline int atomic_add_negative(int i, atomic_t *v)
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
-+ asm volatile(LOCK_PREFIX "addl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "subl %2,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sets %1\n"
- : "=m" (v->counter), "=qm" (c)
- : "ir" (i), "m" (v->counter) : "memory");
- return c;
-@@ -173,7 +337,31 @@ static inline int atomic_add_negative(int i, atomic_t *v)
- static inline int atomic_add_return(int i, atomic_t *v)
- {
- int __i = i;
-- asm volatile(LOCK_PREFIX "xaddl %0, %1"
-+ asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ "movl %0, %1\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "+r" (i), "+m" (v->counter)
-+ : : "memory");
-+ return i + __i;
-+}
-+
-+/**
-+ * atomic_add_return_unchecked - add and return
-+ * @i: integer value to add
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically adds @i to @v and returns @i + @v
-+ */
-+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
-+{
-+ int __i = i;
-+ asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
- : "+r" (i), "+m" (v->counter)
- : : "memory");
- return i + __i;
-@@ -185,6 +373,10 @@ static inline int atomic_sub_return(int i, atomic_t *v)
- }
-
- #define atomic_inc_return(v) (atomic_add_return(1, v))
-+static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
-+{
-+ return atomic_add_return_unchecked(1, v);
-+}
- #define atomic_dec_return(v) (atomic_sub_return(1, v))
-
- /* The 64-bit atomic type */
-@@ -204,6 +396,18 @@ static inline long atomic64_read(const atomic64_t *v)
- }
-
- /**
-+ * atomic64_read_unchecked - read atomic64 variable
-+ * @v: pointer of type atomic64_unchecked_t
-+ *
-+ * Atomically reads the value of @v.
-+ * Doesn't imply a read memory barrier.
-+ */
-+static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
-+{
-+ return v->counter;
-+}
-+
-+/**
- * atomic64_set - set atomic64 variable
- * @v: pointer to type atomic64_t
- * @i: required value
-@@ -216,6 +420,18 @@ static inline void atomic64_set(atomic64_t *v, long i)
- }
-
- /**
-+ * atomic64_set_unchecked - set atomic64 variable
-+ * @v: pointer to type atomic64_unchecked_t
-+ * @i: required value
-+ *
-+ * Atomically sets the value of @v to @i.
-+ */
-+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
-+{
-+ v->counter = i;
-+}
-+
-+/**
- * atomic64_add - add integer to atomic64 variable
- * @i: integer value to add
- * @v: pointer to type atomic64_t
-@@ -224,6 +440,28 @@ static inline void atomic64_set(atomic64_t *v, long i)
- */
- static inline void atomic64_add(long i, atomic64_t *v)
- {
-+ asm volatile(LOCK_PREFIX "addq %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "subq %1,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "=m" (v->counter)
-+ : "er" (i), "m" (v->counter));
-+}
-+
-+/**
-+ * atomic64_add_unchecked - add integer to atomic64 variable
-+ * @i: integer value to add
-+ * @v: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically adds @i to @v.
-+ */
-+static inline void atomic64_add_unchecked(long i, atomic64_unchecked_t *v)
-+{
- asm volatile(LOCK_PREFIX "addq %1,%0"
- : "=m" (v->counter)
- : "er" (i), "m" (v->counter));
-@@ -238,7 +476,15 @@ static inline void atomic64_add(long i, atomic64_t *v)
- */
- static inline void atomic64_sub(long i, atomic64_t *v)
- {
-- asm volatile(LOCK_PREFIX "subq %1,%0"
-+ asm volatile(LOCK_PREFIX "subq %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "addq %1,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- : "=m" (v->counter)
- : "er" (i), "m" (v->counter));
- }
-@@ -256,7 +502,16 @@ static inline int atomic64_sub_and_test(long i, atomic64_t *v)
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "subq %2,%0; sete %1"
-+ asm volatile(LOCK_PREFIX "subq %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "addq %2,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
- : "=m" (v->counter), "=qm" (c)
- : "er" (i), "m" (v->counter) : "memory");
- return c;
-@@ -270,6 +525,27 @@ static inline int atomic64_sub_and_test(long i, atomic64_t *v)
- */
- static inline void atomic64_inc(atomic64_t *v)
- {
-+ asm volatile(LOCK_PREFIX "incq %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "decq %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "=m" (v->counter)
-+ : "m" (v->counter));
-+}
-+
-+/**
-+ * atomic64_inc_unchecked - increment atomic64 variable
-+ * @v: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically increments @v by 1.
-+ */
-+static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
-+{
- asm volatile(LOCK_PREFIX "incq %0"
- : "=m" (v->counter)
- : "m" (v->counter));
-@@ -283,7 +559,28 @@ static inline void atomic64_inc(atomic64_t *v)
- */
- static inline void atomic64_dec(atomic64_t *v)
- {
-- asm volatile(LOCK_PREFIX "decq %0"
-+ asm volatile(LOCK_PREFIX "decq %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "incq %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "=m" (v->counter)
-+ : "m" (v->counter));
-+}
-+
-+/**
-+ * atomic64_dec_unchecked - decrement atomic64 variable
-+ * @v: pointer to type atomic64_t
-+ *
-+ * Atomically decrements @v by 1.
-+ */
-+static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "decq %0\n"
- : "=m" (v->counter)
- : "m" (v->counter));
- }
-@@ -300,7 +597,16 @@ static inline int atomic64_dec_and_test(atomic64_t *v)
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "decq %0; sete %1"
-+ asm volatile(LOCK_PREFIX "decq %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "incq %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
- : "=m" (v->counter), "=qm" (c)
- : "m" (v->counter) : "memory");
- return c != 0;
-@@ -318,7 +624,16 @@ static inline int atomic64_inc_and_test(atomic64_t *v)
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "incq %0; sete %1"
-+ asm volatile(LOCK_PREFIX "incq %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "decq %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
- : "=m" (v->counter), "=qm" (c)
- : "m" (v->counter) : "memory");
- return c != 0;
-@@ -337,7 +652,16 @@ static inline int atomic64_add_negative(long i, atomic64_t *v)
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "addq %2,%0; sets %1"
-+ asm volatile(LOCK_PREFIX "addq %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "subq %2,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sets %1\n"
- : "=m" (v->counter), "=qm" (c)
- : "er" (i), "m" (v->counter) : "memory");
- return c;
-@@ -353,7 +677,31 @@ static inline int atomic64_add_negative(long i, atomic64_t *v)
- static inline long atomic64_add_return(long i, atomic64_t *v)
- {
- long __i = i;
-- asm volatile(LOCK_PREFIX "xaddq %0, %1;"
-+ asm volatile(LOCK_PREFIX "xaddq %0, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ "movq %0, %1\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "+r" (i), "+m" (v->counter)
-+ : : "memory");
-+ return i + __i;
-+}
-+
-+/**
-+ * atomic64_add_return_unchecked - add and return
-+ * @i: integer value to add
-+ * @v: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically adds @i to @v and returns @i + @v
-+ */
-+static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
-+{
-+ long __i = i;
-+ asm volatile(LOCK_PREFIX "xaddq %0, %1"
- : "+r" (i), "+m" (v->counter)
- : : "memory");
- return i + __i;
-@@ -365,6 +713,10 @@ static inline long atomic64_sub_return(long i, atomic64_t *v)
- }
-
- #define atomic64_inc_return(v) (atomic64_add_return(1, (v)))
-+static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
-+{
-+ return atomic64_add_return_unchecked(1, v);
-+}
- #define atomic64_dec_return(v) (atomic64_sub_return(1, (v)))
-
- static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
-@@ -372,21 +724,41 @@ static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
- return cmpxchg(&v->counter, old, new);
- }
-
-+static inline long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long old, long new)
-+{
-+ return cmpxchg(&v->counter, old, new);
-+}
-+
- static inline long atomic64_xchg(atomic64_t *v, long new)
- {
- return xchg(&v->counter, new);
- }
-
-+static inline long atomic64_xchg_unchecked(atomic64_unchecked_t *v, long new)
-+{
-+ return xchg(&v->counter, new);
-+}
-+
- static inline long atomic_cmpxchg(atomic_t *v, int old, int new)
- {
- return cmpxchg(&v->counter, old, new);
- }
-
-+static inline long atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
-+{
-+ return cmpxchg(&v->counter, old, new);
-+}
-+
- static inline long atomic_xchg(atomic_t *v, int new)
- {
- return xchg(&v->counter, new);
- }
-
-+static inline long atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
-+{
-+ return xchg(&v->counter, new);
-+}
-+
- /**
- * atomic_add_unless - add unless the number is a given value
- * @v: pointer of type atomic_t
-@@ -398,17 +770,30 @@ static inline long atomic_xchg(atomic_t *v, int new)
- */
- static inline int atomic_add_unless(atomic_t *v, int a, int u)
- {
-- int c, old;
-+ int c, old, new;
- c = atomic_read(v);
- for (;;) {
-- if (unlikely(c == (u)))
-+ if (unlikely(c == u))
- break;
-- old = atomic_cmpxchg((v), c, c + (a));
-+
-+ asm volatile("addl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ "subl %2,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "=r" (new)
-+ : "0" (c), "ir" (a));
-+
-+ old = atomic_cmpxchg(v, c, new);
- if (likely(old == c))
- break;
- c = old;
- }
-- return c != (u);
-+ return c != u;
- }
-
- #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
-@@ -424,17 +809,30 @@ static inline int atomic_add_unless(atomic_t *v, int a, int u)
- */
- static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
- {
-- long c, old;
-+ long c, old, new;
- c = atomic64_read(v);
- for (;;) {
-- if (unlikely(c == (u)))
-+ if (unlikely(c == u))
- break;
-- old = atomic64_cmpxchg((v), c, c + (a));
-+
-+ asm volatile("addq %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ "subq %2,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "=r" (new)
-+ : "0" (c), "er" (a));
-+
-+ old = atomic64_cmpxchg(v, c, new);
- if (likely(old == c))
- break;
- c = old;
- }
-- return c != (u);
-+ return c != u;
- }
-
- /**
-@@ -466,14 +864,37 @@ static inline void atomic_or_long(unsigned long *v1, unsigned long v2)
- #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
-
- /* These are x86-specific, used by some header files */
--#define atomic_clear_mask(mask, addr) \
-- asm volatile(LOCK_PREFIX "andl %0,%1" \
-- : : "r" (~(mask)), "m" (*(addr)) : "memory")
-+static inline void atomic_clear_mask(unsigned int mask, atomic_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "andl %1,%0"
-+ : "+m" (v->counter)
-+ : "r" (~(mask))
-+ : "memory");
-+}
-
--#define atomic_set_mask(mask, addr) \
-- asm volatile(LOCK_PREFIX "orl %0,%1" \
-- : : "r" ((unsigned)(mask)), "m" (*(addr)) \
-- : "memory")
-+static inline void atomic_clear_mask_unchecked(unsigned int mask, atomic_unchecked_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "andl %1,%0"
-+ : "+m" (v->counter)
-+ : "r" (~(mask))
-+ : "memory");
-+}
-+
-+static inline void atomic_set_mask(unsigned int mask, atomic_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "orl %1,%0"
-+ : "+m" (v->counter)
-+ : "r" (mask)
-+ : "memory");
-+}
-+
-+static inline void atomic_set_mask_unchecked(unsigned int mask, atomic_unchecked_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "orl %1,%0"
-+ : "+m" (v->counter)
-+ : "r" (mask)
-+ : "memory");
-+}
-
- /* Atomic operations are already serializing on x86 */
- #define smp_mb__before_atomic_dec() barrier()
-diff --git a/arch/x86/include/asm/bitops.h b/arch/x86/include/asm/bitops.h
-index 02b47a6..d5c4b15 100644
---- a/arch/x86/include/asm/bitops.h
-+++ b/arch/x86/include/asm/bitops.h
-@@ -38,7 +38,7 @@
- * a mask operation on a byte.
- */
- #define IS_IMMEDIATE(nr) (__builtin_constant_p(nr))
--#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((void *)(addr) + ((nr)>>3))
-+#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((volatile void *)(addr) + ((nr)>>3))
- #define CONST_MASK(nr) (1 << ((nr) & 7))
-
- /**
-diff --git a/arch/x86/include/asm/boot.h b/arch/x86/include/asm/boot.h
-index 7a10659..8bbf355 100644
---- a/arch/x86/include/asm/boot.h
-+++ b/arch/x86/include/asm/boot.h
-@@ -11,10 +11,15 @@
- #include <asm/pgtable_types.h>
-
- /* Physical address where kernel should be loaded. */
--#define LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
-+#define ____LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
- + (CONFIG_PHYSICAL_ALIGN - 1)) \
- & ~(CONFIG_PHYSICAL_ALIGN - 1))
-
-+#ifndef __ASSEMBLY__
-+extern unsigned char __LOAD_PHYSICAL_ADDR[];
-+#define LOAD_PHYSICAL_ADDR ((unsigned long)__LOAD_PHYSICAL_ADDR)
-+#endif
-+
- /* Minimum kernel alignment, as a power of two */
- #ifdef CONFIG_X86_64
- #define MIN_KERNEL_ALIGN_LG2 PMD_SHIFT
-diff --git a/arch/x86/include/asm/cache.h b/arch/x86/include/asm/cache.h
-index 549860d..7d45f68 100644
---- a/arch/x86/include/asm/cache.h
-+++ b/arch/x86/include/asm/cache.h
-@@ -5,9 +5,10 @@
-
- /* L1 cache line size */
- #define L1_CACHE_SHIFT (CONFIG_X86_L1_CACHE_SHIFT)
--#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-
- #define __read_mostly __attribute__((__section__(".data.read_mostly")))
-+#define __read_only __attribute__((__section__(".data.read_only")))
-
- #ifdef CONFIG_X86_VSMP
- /* vSMP Internode cacheline shift */
-diff --git a/arch/x86/include/asm/cacheflush.h b/arch/x86/include/asm/cacheflush.h
-index b54f6af..5b376a6 100644
---- a/arch/x86/include/asm/cacheflush.h
-+++ b/arch/x86/include/asm/cacheflush.h
-@@ -60,7 +60,7 @@ PAGEFLAG(WC, WC)
- static inline unsigned long get_page_memtype(struct page *pg)
- {
- if (!PageUncached(pg) && !PageWC(pg))
-- return -1;
-+ return ~0UL;
- else if (!PageUncached(pg) && PageWC(pg))
- return _PAGE_CACHE_WC;
- else if (PageUncached(pg) && !PageWC(pg))
-@@ -85,7 +85,7 @@ static inline void set_page_memtype(struct page *pg, unsigned long memtype)
- SetPageWC(pg);
- break;
- default:
-- case -1:
-+ case ~0UL:
- ClearPageUncached(pg);
- ClearPageWC(pg);
- break;
-diff --git a/arch/x86/include/asm/calling.h b/arch/x86/include/asm/calling.h
-index 0e63c9a..ab8d972 100644
---- a/arch/x86/include/asm/calling.h
-+++ b/arch/x86/include/asm/calling.h
-@@ -52,32 +52,32 @@ For 32-bit we have the following conventions - kernel is built with
- * for assembly code:
- */
-
--#define R15 0
--#define R14 8
--#define R13 16
--#define R12 24
--#define RBP 32
--#define RBX 40
-+#define R15 (0)
-+#define R14 (8)
-+#define R13 (16)
-+#define R12 (24)
-+#define RBP (32)
-+#define RBX (40)
-
- /* arguments: interrupts/non tracing syscalls only save up to here: */
--#define R11 48
--#define R10 56
--#define R9 64
--#define R8 72
--#define RAX 80
--#define RCX 88
--#define RDX 96
--#define RSI 104
--#define RDI 112
--#define ORIG_RAX 120 /* + error_code */
-+#define R11 (48)
-+#define R10 (56)
-+#define R9 (64)
-+#define R8 (72)
-+#define RAX (80)
-+#define RCX (88)
-+#define RDX (96)
-+#define RSI (104)
-+#define RDI (112)
-+#define ORIG_RAX (120) /* + error_code */
- /* end of arguments */
-
- /* cpu exception frame or undefined in case of fast syscall: */
--#define RIP 128
--#define CS 136
--#define EFLAGS 144
--#define RSP 152
--#define SS 160
-+#define RIP (128)
-+#define CS (136)
-+#define EFLAGS (144)
-+#define RSP (152)
-+#define SS (160)
-
- #define ARGOFFSET R11
- #define SWFRAME ORIG_RAX
-diff --git a/arch/x86/include/asm/checksum_32.h b/arch/x86/include/asm/checksum_32.h
-index 46fc474..b02b0f9 100644
---- a/arch/x86/include/asm/checksum_32.h
-+++ b/arch/x86/include/asm/checksum_32.h
-@@ -31,6 +31,14 @@ asmlinkage __wsum csum_partial_copy_generic(const void *src, void *dst,
- int len, __wsum sum,
- int *src_err_ptr, int *dst_err_ptr);
-
-+asmlinkage __wsum csum_partial_copy_generic_to_user(const void *src, void *dst,
-+ int len, __wsum sum,
-+ int *src_err_ptr, int *dst_err_ptr);
-+
-+asmlinkage __wsum csum_partial_copy_generic_from_user(const void *src, void *dst,
-+ int len, __wsum sum,
-+ int *src_err_ptr, int *dst_err_ptr);
-+
- /*
- * Note: when you get a NULL pointer exception here this means someone
- * passed in an incorrect kernel address to one of these functions.
-@@ -50,7 +58,7 @@ static inline __wsum csum_partial_copy_from_user(const void __user *src,
- int *err_ptr)
- {
- might_sleep();
-- return csum_partial_copy_generic((__force void *)src, dst,
-+ return csum_partial_copy_generic_from_user((__force void *)src, dst,
- len, sum, err_ptr, NULL);
- }
-
-@@ -178,7 +186,7 @@ static inline __wsum csum_and_copy_to_user(const void *src,
- {
- might_sleep();
- if (access_ok(VERIFY_WRITE, dst, len))
-- return csum_partial_copy_generic(src, (__force void *)dst,
-+ return csum_partial_copy_generic_to_user(src, (__force void *)dst,
- len, sum, NULL, err_ptr);
-
- if (len)
-diff --git a/arch/x86/include/asm/desc.h b/arch/x86/include/asm/desc.h
-index 617bd56..7b047a1 100644
---- a/arch/x86/include/asm/desc.h
-+++ b/arch/x86/include/asm/desc.h
-@@ -4,6 +4,7 @@
- #include <asm/desc_defs.h>
- #include <asm/ldt.h>
- #include <asm/mmu.h>
-+#include <asm/pgtable.h>
- #include <linux/smp.h>
-
- static inline void fill_ldt(struct desc_struct *desc,
-@@ -15,6 +16,7 @@ static inline void fill_ldt(struct desc_struct *desc,
- desc->base1 = (info->base_addr & 0x00ff0000) >> 16;
- desc->type = (info->read_exec_only ^ 1) << 1;
- desc->type |= info->contents << 2;
-+ desc->type |= info->seg_not_present ^ 1;
- desc->s = 1;
- desc->dpl = 0x3;
- desc->p = info->seg_not_present ^ 1;
-@@ -31,16 +33,12 @@ static inline void fill_ldt(struct desc_struct *desc,
- }
-
- extern struct desc_ptr idt_descr;
--extern gate_desc idt_table[];
--
--struct gdt_page {
-- struct desc_struct gdt[GDT_ENTRIES];
--} __attribute__((aligned(PAGE_SIZE)));
--DECLARE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page);
-+extern gate_desc idt_table[256];
-
-+extern struct desc_struct cpu_gdt_table[NR_CPUS][PAGE_SIZE / sizeof(struct desc_struct)];
- static inline struct desc_struct *get_cpu_gdt_table(unsigned int cpu)
- {
-- return per_cpu(gdt_page, cpu).gdt;
-+ return cpu_gdt_table[cpu];
- }
-
- #ifdef CONFIG_X86_64
-@@ -65,9 +63,14 @@ static inline void pack_gate(gate_desc *gate, unsigned char type,
- unsigned long base, unsigned dpl, unsigned flags,
- unsigned short seg)
- {
-- gate->a = (seg << 16) | (base & 0xffff);
-- gate->b = (base & 0xffff0000) |
-- (((0x80 | type | (dpl << 5)) & 0xff) << 8);
-+ gate->gate.offset_low = base;
-+ gate->gate.seg = seg;
-+ gate->gate.reserved = 0;
-+ gate->gate.type = type;
-+ gate->gate.s = 0;
-+ gate->gate.dpl = dpl;
-+ gate->gate.p = 1;
-+ gate->gate.offset_high = base >> 16;
- }
-
- #endif
-@@ -115,13 +118,17 @@ static inline void paravirt_free_ldt(struct desc_struct *ldt, unsigned entries)
- static inline void native_write_idt_entry(gate_desc *idt, int entry,
- const gate_desc *gate)
- {
-+ pax_open_kernel();
- memcpy(&idt[entry], gate, sizeof(*gate));
-+ pax_close_kernel();
- }
-
- static inline void native_write_ldt_entry(struct desc_struct *ldt, int entry,
- const void *desc)
- {
-+ pax_open_kernel();
- memcpy(&ldt[entry], desc, 8);
-+ pax_close_kernel();
- }
-
- static inline void native_write_gdt_entry(struct desc_struct *gdt, int entry,
-@@ -139,7 +146,10 @@ static inline void native_write_gdt_entry(struct desc_struct *gdt, int entry,
- size = sizeof(struct desc_struct);
- break;
- }
-+
-+ pax_open_kernel();
- memcpy(&gdt[entry], desc, size);
-+ pax_close_kernel();
- }
-
- static inline void pack_descriptor(struct desc_struct *desc, unsigned long base,
-@@ -211,7 +221,9 @@ static inline void native_set_ldt(const void *addr, unsigned int entries)
-
- static inline void native_load_tr_desc(void)
- {
-+ pax_open_kernel();
- asm volatile("ltr %w0"::"q" (GDT_ENTRY_TSS*8));
-+ pax_close_kernel();
- }
-
- static inline void native_load_gdt(const struct desc_ptr *dtr)
-@@ -246,8 +258,10 @@ static inline void native_load_tls(struct thread_struct *t, unsigned int cpu)
- unsigned int i;
- struct desc_struct *gdt = get_cpu_gdt_table(cpu);
-
-+ pax_open_kernel();
- for (i = 0; i < GDT_ENTRY_TLS_ENTRIES; i++)
- gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i];
-+ pax_close_kernel();
- }
-
- #define _LDT_empty(info) \
-@@ -309,7 +323,7 @@ static inline void set_desc_limit(struct desc_struct *desc, unsigned long limit)
- desc->limit = (limit >> 16) & 0xf;
- }
-
--static inline void _set_gate(int gate, unsigned type, void *addr,
-+static inline void _set_gate(int gate, unsigned type, const void *addr,
- unsigned dpl, unsigned ist, unsigned seg)
- {
- gate_desc s;
-@@ -327,7 +341,7 @@ static inline void _set_gate(int gate, unsigned type, void *addr,
- * Pentium F0 0F bugfix can have resulted in the mapped
- * IDT being write-protected.
- */
--static inline void set_intr_gate(unsigned int n, void *addr)
-+static inline void set_intr_gate(unsigned int n, const void *addr)
- {
- BUG_ON((unsigned)n > 0xFF);
- _set_gate(n, GATE_INTERRUPT, addr, 0, 0, __KERNEL_CS);
-@@ -356,19 +370,19 @@ static inline void alloc_intr_gate(unsigned int n, void *addr)
- /*
- * This routine sets up an interrupt gate at directory privilege level 3.
- */
--static inline void set_system_intr_gate(unsigned int n, void *addr)
-+static inline void set_system_intr_gate(unsigned int n, const void *addr)
- {
- BUG_ON((unsigned)n > 0xFF);
- _set_gate(n, GATE_INTERRUPT, addr, 0x3, 0, __KERNEL_CS);
- }
-
--static inline void set_system_trap_gate(unsigned int n, void *addr)
-+static inline void set_system_trap_gate(unsigned int n, const void *addr)
- {
- BUG_ON((unsigned)n > 0xFF);
- _set_gate(n, GATE_TRAP, addr, 0x3, 0, __KERNEL_CS);
- }
-
--static inline void set_trap_gate(unsigned int n, void *addr)
-+static inline void set_trap_gate(unsigned int n, const void *addr)
- {
- BUG_ON((unsigned)n > 0xFF);
- _set_gate(n, GATE_TRAP, addr, 0, 0, __KERNEL_CS);
-@@ -377,19 +391,31 @@ static inline void set_trap_gate(unsigned int n, void *addr)
- static inline void set_task_gate(unsigned int n, unsigned int gdt_entry)
- {
- BUG_ON((unsigned)n > 0xFF);
-- _set_gate(n, GATE_TASK, (void *)0, 0, 0, (gdt_entry<<3));
-+ _set_gate(n, GATE_TASK, (const void *)0, 0, 0, (gdt_entry<<3));
- }
-
--static inline void set_intr_gate_ist(int n, void *addr, unsigned ist)
-+static inline void set_intr_gate_ist(int n, const void *addr, unsigned ist)
- {
- BUG_ON((unsigned)n > 0xFF);
- _set_gate(n, GATE_INTERRUPT, addr, 0, ist, __KERNEL_CS);
- }
-
--static inline void set_system_intr_gate_ist(int n, void *addr, unsigned ist)
-+static inline void set_system_intr_gate_ist(int n, const void *addr, unsigned ist)
- {
- BUG_ON((unsigned)n > 0xFF);
- _set_gate(n, GATE_INTERRUPT, addr, 0x3, ist, __KERNEL_CS);
- }
-
-+#ifdef CONFIG_X86_32
-+static inline void set_user_cs(unsigned long base, unsigned long limit, int cpu)
-+{
-+ struct desc_struct d;
-+
-+ if (likely(limit))
-+ limit = (limit - 1UL) >> PAGE_SHIFT;
-+ pack_descriptor(&d, base, limit, 0xFB, 0xC);
-+ write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_CS, &d, DESCTYPE_S);
-+}
-+#endif
-+
- #endif /* _ASM_X86_DESC_H */
-diff --git a/arch/x86/include/asm/desc_defs.h b/arch/x86/include/asm/desc_defs.h
-index 9d66848..6b4a691 100644
---- a/arch/x86/include/asm/desc_defs.h
-+++ b/arch/x86/include/asm/desc_defs.h
-@@ -31,6 +31,12 @@ struct desc_struct {
- unsigned base1: 8, type: 4, s: 1, dpl: 2, p: 1;
- unsigned limit: 4, avl: 1, l: 1, d: 1, g: 1, base2: 8;
- };
-+ struct {
-+ u16 offset_low;
-+ u16 seg;
-+ unsigned reserved: 8, type: 4, s: 1, dpl: 2, p: 1;
-+ unsigned offset_high: 16;
-+ } gate;
- };
- } __attribute__((packed));
-
-diff --git a/arch/x86/include/asm/device.h b/arch/x86/include/asm/device.h
-index cee34e9..a7c3fa2 100644
---- a/arch/x86/include/asm/device.h
-+++ b/arch/x86/include/asm/device.h
-@@ -6,7 +6,7 @@ struct dev_archdata {
- void *acpi_handle;
- #endif
- #ifdef CONFIG_X86_64
--struct dma_map_ops *dma_ops;
-+ const struct dma_map_ops *dma_ops;
- #endif
- #ifdef CONFIG_DMAR
- void *iommu; /* hook for IOMMU specific extension */
-diff --git a/arch/x86/include/asm/dma-mapping.h b/arch/x86/include/asm/dma-mapping.h
-index 6a25d5d..786b202 100644
---- a/arch/x86/include/asm/dma-mapping.h
-+++ b/arch/x86/include/asm/dma-mapping.h
-@@ -25,9 +25,9 @@ extern int iommu_merge;
- extern struct device x86_dma_fallback_dev;
- extern int panic_on_overflow;
-
--extern struct dma_map_ops *dma_ops;
-+extern const struct dma_map_ops *dma_ops;
-
--static inline struct dma_map_ops *get_dma_ops(struct device *dev)
-+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
- {
- #ifdef CONFIG_X86_32
- return dma_ops;
-@@ -44,7 +44,7 @@ static inline struct dma_map_ops *get_dma_ops(struct device *dev)
- /* Make sure we keep the same behaviour */
- static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
- if (ops->mapping_error)
- return ops->mapping_error(dev, dma_addr);
-
-@@ -122,7 +122,7 @@ static inline void *
- dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
- gfp_t gfp)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
- void *memory;
-
- gfp &= ~(__GFP_DMA | __GFP_HIGHMEM | __GFP_DMA32);
-@@ -149,7 +149,7 @@ dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
- static inline void dma_free_coherent(struct device *dev, size_t size,
- void *vaddr, dma_addr_t bus)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- WARN_ON(irqs_disabled()); /* for portability */
-
-diff --git a/arch/x86/include/asm/e820.h b/arch/x86/include/asm/e820.h
-index 40b4e61..40d8133 100644
---- a/arch/x86/include/asm/e820.h
-+++ b/arch/x86/include/asm/e820.h
-@@ -133,7 +133,7 @@ extern char *default_machine_specific_memory_setup(void);
- #define ISA_END_ADDRESS 0x100000
- #define is_ISA_range(s, e) ((s) >= ISA_START_ADDRESS && (e) < ISA_END_ADDRESS)
-
--#define BIOS_BEGIN 0x000a0000
-+#define BIOS_BEGIN 0x000c0000
- #define BIOS_END 0x00100000
-
- #ifdef __KERNEL__
-diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
-index 8ac9d9a..0a6c96e 100644
---- a/arch/x86/include/asm/elf.h
-+++ b/arch/x86/include/asm/elf.h
-@@ -257,7 +257,25 @@ extern int force_personality32;
- the loader. We need to make sure that it is out of the way of the program
- that it will "exec", and that there is sufficient room for the brk. */
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+#define ELF_ET_DYN_BASE ((current->mm->pax_flags & MF_PAX_SEGMEXEC) ? SEGMEXEC_TASK_SIZE/3*2 : TASK_SIZE/3*2)
-+#else
- #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
-+#endif
-+
-+#ifdef CONFIG_PAX_ASLR
-+#ifdef CONFIG_X86_32
-+#define PAX_ELF_ET_DYN_BASE 0x10000000UL
-+
-+#define PAX_DELTA_MMAP_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
-+#define PAX_DELTA_STACK_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
-+#else
-+#define PAX_ELF_ET_DYN_BASE 0x400000UL
-+
-+#define PAX_DELTA_MMAP_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
-+#define PAX_DELTA_STACK_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
-+#endif
-+#endif
-
- /* This yields a mask that user programs can use to figure out what
- instruction set this CPU supports. This could be done in user space,
-@@ -310,9 +328,7 @@ do { \
-
- #define ARCH_DLINFO \
- do { \
-- if (vdso_enabled) \
-- NEW_AUX_ENT(AT_SYSINFO_EHDR, \
-- (unsigned long)current->mm->context.vdso); \
-+ NEW_AUX_ENT(AT_SYSINFO_EHDR, current->mm->context.vdso); \
- } while (0)
-
- #define AT_SYSINFO 32
-@@ -323,7 +339,7 @@ do { \
-
- #endif /* !CONFIG_X86_32 */
-
--#define VDSO_CURRENT_BASE ((unsigned long)current->mm->context.vdso)
-+#define VDSO_CURRENT_BASE (current->mm->context.vdso)
-
- #define VDSO_ENTRY \
- ((unsigned long)VDSO32_SYMBOL(VDSO_CURRENT_BASE, vsyscall))
-@@ -337,7 +353,4 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
- extern int syscall32_setup_pages(struct linux_binprm *, int exstack);
- #define compat_arch_setup_additional_pages syscall32_setup_pages
-
--extern unsigned long arch_randomize_brk(struct mm_struct *mm);
--#define arch_randomize_brk arch_randomize_brk
--
- #endif /* _ASM_X86_ELF_H */
-diff --git a/arch/x86/include/asm/emergency-restart.h b/arch/x86/include/asm/emergency-restart.h
-index cc70c1c..d96d011 100644
---- a/arch/x86/include/asm/emergency-restart.h
-+++ b/arch/x86/include/asm/emergency-restart.h
-@@ -15,6 +15,6 @@ enum reboot_type {
-
- extern enum reboot_type reboot_type;
-
--extern void machine_emergency_restart(void);
-+extern void machine_emergency_restart(void) __noreturn;
-
- #endif /* _ASM_X86_EMERGENCY_RESTART_H */
-diff --git a/arch/x86/include/asm/futex.h b/arch/x86/include/asm/futex.h
-index 1f11ce4..3fed751 100644
---- a/arch/x86/include/asm/futex.h
-+++ b/arch/x86/include/asm/futex.h
-@@ -12,20 +12,22 @@
- #include <asm/system.h>
-
- #define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg) \
-+ typecheck(u32 __user *, uaddr); \
- asm volatile("1:\t" insn "\n" \
- "2:\t.section .fixup,\"ax\"\n" \
- "3:\tmov\t%3, %1\n" \
- "\tjmp\t2b\n" \
- "\t.previous\n" \
- _ASM_EXTABLE(1b, 3b) \
-- : "=r" (oldval), "=r" (ret), "+m" (*uaddr) \
-+ : "=r" (oldval), "=r" (ret), "+m" (*(u32 __user *)____m(uaddr))\
- : "i" (-EFAULT), "0" (oparg), "1" (0))
-
- #define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg) \
-+ typecheck(u32 __user *, uaddr); \
- asm volatile("1:\tmovl %2, %0\n" \
- "\tmovl\t%0, %3\n" \
- "\t" insn "\n" \
-- "2:\t" LOCK_PREFIX "cmpxchgl %3, %2\n" \
-+ "2:\t" LOCK_PREFIX __copyuser_seg"cmpxchgl %3, %2\n" \
- "\tjnz\t1b\n" \
- "3:\t.section .fixup,\"ax\"\n" \
- "4:\tmov\t%5, %1\n" \
-@@ -34,10 +36,10 @@
- _ASM_EXTABLE(1b, 4b) \
- _ASM_EXTABLE(2b, 4b) \
- : "=&a" (oldval), "=&r" (ret), \
-- "+m" (*uaddr), "=&r" (tem) \
-+ "+m" (*(u32 __user *)____m(uaddr)), "=&r" (tem) \
- : "r" (oparg), "i" (-EFAULT), "1" (0))
-
--static inline int futex_atomic_op_inuser(int encoded_op, int __user *uaddr)
-+static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
- {
- int op = (encoded_op >> 28) & 7;
- int cmp = (encoded_op >> 24) & 15;
-@@ -61,10 +63,10 @@ static inline int futex_atomic_op_inuser(int encoded_op, int __user *uaddr)
-
- switch (op) {
- case FUTEX_OP_SET:
-- __futex_atomic_op1("xchgl %0, %2", ret, oldval, uaddr, oparg);
-+ __futex_atomic_op1(__copyuser_seg"xchgl %0, %2", ret, oldval, uaddr, oparg);
- break;
- case FUTEX_OP_ADD:
-- __futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret, oldval,
-+ __futex_atomic_op1(LOCK_PREFIX __copyuser_seg"xaddl %0, %2", ret, oldval,
- uaddr, oparg);
- break;
- case FUTEX_OP_OR:
-@@ -109,7 +111,7 @@ static inline int futex_atomic_op_inuser(int encoded_op, int __user *uaddr)
- return ret;
- }
-
--static inline int futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval,
-+static inline int futex_atomic_cmpxchg_inatomic(u32 __user *uaddr, int oldval,
- int newval)
- {
-
-@@ -119,16 +121,16 @@ static inline int futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval,
- return -ENOSYS;
- #endif
-
-- if (!access_ok(VERIFY_WRITE, uaddr, sizeof(int)))
-+ if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
- return -EFAULT;
-
-- asm volatile("1:\t" LOCK_PREFIX "cmpxchgl %3, %1\n"
-+ asm volatile("1:\t" LOCK_PREFIX __copyuser_seg"cmpxchgl %3, %1\n"
- "2:\t.section .fixup, \"ax\"\n"
- "3:\tmov %2, %0\n"
- "\tjmp 2b\n"
- "\t.previous\n"
- _ASM_EXTABLE(1b, 3b)
-- : "=a" (oldval), "+m" (*uaddr)
-+ : "=a" (oldval), "+m" (*(u32 *)____m(uaddr))
- : "i" (-EFAULT), "r" (newval), "0" (oldval)
- : "memory"
- );
-diff --git a/arch/x86/include/asm/hw_irq.h b/arch/x86/include/asm/hw_irq.h
-index ba180d9..3bad351 100644
---- a/arch/x86/include/asm/hw_irq.h
-+++ b/arch/x86/include/asm/hw_irq.h
-@@ -92,8 +92,8 @@ extern void setup_ioapic_dest(void);
- extern void enable_IO_APIC(void);
-
- /* Statistics */
--extern atomic_t irq_err_count;
--extern atomic_t irq_mis_count;
-+extern atomic_unchecked_t irq_err_count;
-+extern atomic_unchecked_t irq_mis_count;
-
- /* EISA */
- extern void eisa_set_level_irq(unsigned int irq);
-diff --git a/arch/x86/include/asm/i387.h b/arch/x86/include/asm/i387.h
-index 0b20bbb..f06479b 100644
---- a/arch/x86/include/asm/i387.h
-+++ b/arch/x86/include/asm/i387.h
-@@ -56,10 +56,12 @@ static inline void tolerant_fwait(void)
- _ASM_EXTABLE(1b, 2b));
- }
-
--static inline int fxrstor_checking(struct i387_fxsave_struct *fx)
-+static inline int fxrstor_checking(struct i387_fxsave_struct __user *fx)
- {
- int err;
-
-+ fx = (struct i387_fxsave_struct __user *)____m(fx);
-+
- asm volatile("1: rex64/fxrstor (%[fx])\n\t"
- "2:\n"
- ".section .fixup,\"ax\"\n"
-@@ -105,6 +107,8 @@ static inline int fxsave_user(struct i387_fxsave_struct __user *fx)
- {
- int err;
-
-+ fx = (struct i387_fxsave_struct __user *)____m(fx);
-+
- asm volatile("1: rex64/fxsave (%[fx])\n\t"
- "2:\n"
- ".section .fixup,\"ax\"\n"
-@@ -179,15 +183,15 @@ static inline void tolerant_fwait(void)
- }
-
- /* perform fxrstor iff the processor has extended states, otherwise frstor */
--static inline int fxrstor_checking(struct i387_fxsave_struct *fx)
-+static inline int fxrstor_checking(struct i387_fxsave_struct __user *fx)
- {
- /*
- * The "nop" is needed to make the instructions the same
- * length.
- */
- alternative_input(
-- "nop ; frstor %1",
-- "fxrstor %1",
-+ __copyuser_seg" frstor %1; nop",
-+ __copyuser_seg" fxrstor %1",
- X86_FEATURE_FXSR,
- "m" (*fx));
-
-@@ -195,13 +199,8 @@ static inline int fxrstor_checking(struct i387_fxsave_struct *fx)
- }
-
- /* We need a safe address that is cheap to find and that is already
-- in L1 during context switch. The best choices are unfortunately
-- different for UP and SMP */
--#ifdef CONFIG_SMP
--#define safe_address (__per_cpu_offset[0])
--#else
--#define safe_address (kstat_cpu(0).cpustat.user)
--#endif
-+ in L1 during context switch. */
-+#define safe_address (init_tss[raw_smp_processor_id()].x86_tss.sp0)
-
- /*
- * These must be called with preempt disabled
-@@ -258,8 +257,16 @@ static inline int restore_fpu_checking(struct task_struct *tsk)
- {
- if (task_thread_info(tsk)->status & TS_XSAVE)
- return xrstor_checking(&tsk->thread.xstate->xsave);
-- else
-- return fxrstor_checking(&tsk->thread.xstate->fxsave);
-+ else {
-+ int ret;
-+ mm_segment_t fs;
-+
-+ fs = get_fs();
-+ set_fs(KERNEL_DS);
-+ ret = fxrstor_checking(&tsk->thread.xstate->fxsave);
-+ set_fs(fs);
-+ return ret;
-+ }
- }
-
- /*
-@@ -291,7 +298,7 @@ static inline void kernel_fpu_begin(void)
- struct thread_info *me = current_thread_info();
- preempt_disable();
- if (me->status & TS_USEDFPU)
-- __save_init_fpu(me->task);
-+ __save_init_fpu(current);
- else
- clts();
- }
-diff --git a/arch/x86/include/asm/io.h b/arch/x86/include/asm/io.h
-index 6a63b86..b6a731c 100644
---- a/arch/x86/include/asm/io.h
-+++ b/arch/x86/include/asm/io.h
-@@ -170,7 +170,7 @@ static inline void __iomem *ioremap(resource_size_t offset, unsigned long size)
- return ioremap_nocache(offset, size);
- }
-
--extern void iounmap(volatile void __iomem *addr);
-+extern void iounmap(const volatile void __iomem *addr);
-
- extern void set_iounmap_nonlazy(void);
-
-diff --git a/arch/x86/include/asm/io_32.h b/arch/x86/include/asm/io_32.h
-index a299900..15c5410 100644
---- a/arch/x86/include/asm/io_32.h
-+++ b/arch/x86/include/asm/io_32.h
-@@ -3,6 +3,7 @@
-
- #include <linux/string.h>
- #include <linux/compiler.h>
-+#include <asm/processor.h>
-
- /*
- * This file contains the definitions for the x86 IO instructions
-@@ -42,6 +43,17 @@
-
- #ifdef __KERNEL__
-
-+#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
-+static inline int valid_phys_addr_range(unsigned long addr, size_t count)
-+{
-+ return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
-+}
-+
-+static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
-+{
-+ return (pfn + (count >> PAGE_SHIFT)) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
-+}
-+
- #include <asm-generic/iomap.h>
-
- #include <linux/vmalloc.h>
-diff --git a/arch/x86/include/asm/io_64.h b/arch/x86/include/asm/io_64.h
-index 2440678..c158b88 100644
---- a/arch/x86/include/asm/io_64.h
-+++ b/arch/x86/include/asm/io_64.h
-@@ -140,6 +140,17 @@ __OUTS(l)
-
- #include <linux/vmalloc.h>
-
-+#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
-+static inline int valid_phys_addr_range(unsigned long addr, size_t count)
-+{
-+ return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
-+}
-+
-+static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
-+{
-+ return (pfn + (count >> PAGE_SHIFT)) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
-+}
-+
- #include <asm-generic/iomap.h>
-
- void __memcpy_fromio(void *, unsigned long, unsigned);
-diff --git a/arch/x86/include/asm/iommu.h b/arch/x86/include/asm/iommu.h
-index fd6d21b..8b13915 100644
---- a/arch/x86/include/asm/iommu.h
-+++ b/arch/x86/include/asm/iommu.h
-@@ -3,7 +3,7 @@
-
- extern void pci_iommu_shutdown(void);
- extern void no_iommu_init(void);
--extern struct dma_map_ops nommu_dma_ops;
-+extern const struct dma_map_ops nommu_dma_ops;
- extern int force_iommu, no_iommu;
- extern int iommu_detected;
- extern int iommu_pass_through;
-diff --git a/arch/x86/include/asm/irqflags.h b/arch/x86/include/asm/irqflags.h
-index 9e2b952..557206e 100644
---- a/arch/x86/include/asm/irqflags.h
-+++ b/arch/x86/include/asm/irqflags.h
-@@ -142,6 +142,11 @@ static inline unsigned long __raw_local_irq_save(void)
- sti; \
- sysexit
-
-+#define GET_CR0_INTO_RDI mov %cr0, %rdi
-+#define SET_RDI_INTO_CR0 mov %rdi, %cr0
-+#define GET_CR3_INTO_RDI mov %cr3, %rdi
-+#define SET_RDI_INTO_CR3 mov %rdi, %cr3
-+
- #else
- #define INTERRUPT_RETURN iret
- #define ENABLE_INTERRUPTS_SYSEXIT sti; sysexit
-diff --git a/arch/x86/include/asm/kprobes.h b/arch/x86/include/asm/kprobes.h
-index 4fe681d..bb6d40c 100644
---- a/arch/x86/include/asm/kprobes.h
-+++ b/arch/x86/include/asm/kprobes.h
-@@ -34,13 +34,8 @@ typedef u8 kprobe_opcode_t;
- #define BREAKPOINT_INSTRUCTION 0xcc
- #define RELATIVEJUMP_INSTRUCTION 0xe9
- #define MAX_INSN_SIZE 16
--#define MAX_STACK_SIZE 64
--#define MIN_STACK_SIZE(ADDR) \
-- (((MAX_STACK_SIZE) < (((unsigned long)current_thread_info()) + \
-- THREAD_SIZE - (unsigned long)(ADDR))) \
-- ? (MAX_STACK_SIZE) \
-- : (((unsigned long)current_thread_info()) + \
-- THREAD_SIZE - (unsigned long)(ADDR)))
-+#define MAX_STACK_SIZE 64UL
-+#define MIN_STACK_SIZE(ADDR) min(MAX_STACK_SIZE, current->thread.sp0 - (unsigned long)(ADDR))
-
- #define flush_insn_slot(p) do { } while (0)
-
-diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
-index 08bc2ff..2e88d1f 100644
---- a/arch/x86/include/asm/kvm_host.h
-+++ b/arch/x86/include/asm/kvm_host.h
-@@ -534,9 +534,9 @@ struct kvm_x86_ops {
- bool (*gb_page_enable)(void);
-
- const struct trace_print_flags *exit_reasons_str;
--};
-+} __do_const;
-
--extern struct kvm_x86_ops *kvm_x86_ops;
-+extern const struct kvm_x86_ops *kvm_x86_ops;
-
- int kvm_mmu_module_init(void);
- void kvm_mmu_module_exit(void);
-diff --git a/arch/x86/include/asm/local.h b/arch/x86/include/asm/local.h
-index 47b9b6f..17233f6 100644
---- a/arch/x86/include/asm/local.h
-+++ b/arch/x86/include/asm/local.h
-@@ -11,33 +11,97 @@ typedef struct {
- atomic_long_t a;
- } local_t;
-
-+typedef struct {
-+ atomic_long_unchecked_t a;
-+} local_unchecked_t;
-+
- #define LOCAL_INIT(i) { ATOMIC_LONG_INIT(i) }
-
- #define local_read(l) atomic_long_read(&(l)->a)
-+#define local_read_unchecked(l) atomic_long_read_unchecked(&(l)->a)
- #define local_set(l, i) atomic_long_set(&(l)->a, (i))
-+#define local_set_unchecked(l, i) atomic_long_set_unchecked(&(l)->a, (i))
-
- static inline void local_inc(local_t *l)
- {
-- asm volatile(_ASM_INC "%0"
-+ asm volatile(_ASM_INC "%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ _ASM_DEC "%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "+m" (l->a.counter));
-+}
-+
-+static inline void local_inc_unchecked(local_unchecked_t *l)
-+{
-+ asm volatile(_ASM_INC "%0\n"
- : "+m" (l->a.counter));
- }
-
- static inline void local_dec(local_t *l)
- {
-- asm volatile(_ASM_DEC "%0"
-+ asm volatile(_ASM_DEC "%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ _ASM_INC "%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "+m" (l->a.counter));
-+}
-+
-+static inline void local_dec_unchecked(local_unchecked_t *l)
-+{
-+ asm volatile(_ASM_DEC "%0\n"
- : "+m" (l->a.counter));
- }
-
- static inline void local_add(long i, local_t *l)
- {
-- asm volatile(_ASM_ADD "%1,%0"
-+ asm volatile(_ASM_ADD "%1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ _ASM_SUB "%1,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "+m" (l->a.counter)
-+ : "ir" (i));
-+}
-+
-+static inline void local_add_unchecked(long i, local_unchecked_t *l)
-+{
-+ asm volatile(_ASM_ADD "%1,%0\n"
- : "+m" (l->a.counter)
- : "ir" (i));
- }
-
- static inline void local_sub(long i, local_t *l)
- {
-- asm volatile(_ASM_SUB "%1,%0"
-+ asm volatile(_ASM_SUB "%1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ _ASM_ADD "%1,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "+m" (l->a.counter)
-+ : "ir" (i));
-+}
-+
-+static inline void local_sub_unchecked(long i, local_unchecked_t *l)
-+{
-+ asm volatile(_ASM_SUB "%1,%0\n"
- : "+m" (l->a.counter)
- : "ir" (i));
- }
-@@ -55,7 +119,16 @@ static inline int local_sub_and_test(long i, local_t *l)
- {
- unsigned char c;
-
-- asm volatile(_ASM_SUB "%2,%0; sete %1"
-+ asm volatile(_ASM_SUB "%2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ _ASM_ADD "%2,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
- : "+m" (l->a.counter), "=qm" (c)
- : "ir" (i) : "memory");
- return c;
-@@ -73,7 +146,16 @@ static inline int local_dec_and_test(local_t *l)
- {
- unsigned char c;
-
-- asm volatile(_ASM_DEC "%0; sete %1"
-+ asm volatile(_ASM_DEC "%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ _ASM_INC "%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
- : "+m" (l->a.counter), "=qm" (c)
- : : "memory");
- return c != 0;
-@@ -91,7 +173,16 @@ static inline int local_inc_and_test(local_t *l)
- {
- unsigned char c;
-
-- asm volatile(_ASM_INC "%0; sete %1"
-+ asm volatile(_ASM_INC "%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ _ASM_DEC "%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
- : "+m" (l->a.counter), "=qm" (c)
- : : "memory");
- return c != 0;
-@@ -110,7 +201,16 @@ static inline int local_add_negative(long i, local_t *l)
- {
- unsigned char c;
-
-- asm volatile(_ASM_ADD "%2,%0; sets %1"
-+ asm volatile(_ASM_ADD "%2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ _ASM_SUB "%2,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sets %1\n"
- : "+m" (l->a.counter), "=qm" (c)
- : "ir" (i) : "memory");
- return c;
-@@ -133,7 +233,15 @@ static inline long local_add_return(long i, local_t *l)
- #endif
- /* Modern 486+ processor */
- __i = i;
-- asm volatile(_ASM_XADD "%0, %1;"
-+ asm volatile(_ASM_XADD "%0, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ _ASM_MOV "%0,%1\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- : "+r" (i), "+m" (l->a.counter)
- : : "memory");
- return i + __i;
-@@ -148,6 +256,38 @@ no_xadd: /* Legacy 386 processor */
- #endif
- }
-
-+/**
-+ * local_add_return_unchecked - add and return
-+ * @i: integer value to add
-+ * @l: pointer to type local_unchecked_t
-+ *
-+ * Atomically adds @i to @l and returns @i + @l
-+ */
-+static inline long local_add_return_unchecked(long i, local_unchecked_t *l)
-+{
-+ long __i;
-+#ifdef CONFIG_M386
-+ unsigned long flags;
-+ if (unlikely(boot_cpu_data.x86 <= 3))
-+ goto no_xadd;
-+#endif
-+ /* Modern 486+ processor */
-+ __i = i;
-+ asm volatile(_ASM_XADD "%0, %1\n"
-+ : "+r" (i), "+m" (l->a.counter)
-+ : : "memory");
-+ return i + __i;
-+
-+#ifdef CONFIG_M386
-+no_xadd: /* Legacy 386 processor */
-+ local_irq_save(flags);
-+ __i = local_read_unchecked(l);
-+ local_set_unchecked(l, i + __i);
-+ local_irq_restore(flags);
-+ return i + __i;
-+#endif
-+}
-+
- static inline long local_sub_return(long i, local_t *l)
- {
- return local_add_return(-i, l);
-@@ -158,6 +298,8 @@ static inline long local_sub_return(long i, local_t *l)
-
- #define local_cmpxchg(l, o, n) \
- (cmpxchg_local(&((l)->a.counter), (o), (n)))
-+#define local_cmpxchg_unchecked(l, o, n) \
-+ (cmpxchg_local(&((l)->a.counter), (o), (n)))
- /* Always has a lock prefix */
- #define local_xchg(l, n) (xchg(&((l)->a.counter), (n)))
-
-diff --git a/arch/x86/include/asm/microcode.h b/arch/x86/include/asm/microcode.h
-index ef51b50..514ba37 100644
---- a/arch/x86/include/asm/microcode.h
-+++ b/arch/x86/include/asm/microcode.h
-@@ -12,13 +12,13 @@ struct device;
- enum ucode_state { UCODE_ERROR, UCODE_OK, UCODE_NFOUND };
-
- struct microcode_ops {
-- enum ucode_state (*request_microcode_user) (int cpu,
-+ enum ucode_state (* const request_microcode_user) (int cpu,
- const void __user *buf, size_t size);
-
-- enum ucode_state (*request_microcode_fw) (int cpu,
-+ enum ucode_state (* const request_microcode_fw) (int cpu,
- struct device *device);
-
-- void (*microcode_fini_cpu) (int cpu);
-+ void (* const microcode_fini_cpu) (int cpu);
-
- /*
- * The generic 'microcode_core' part guarantees that
-@@ -38,18 +38,18 @@ struct ucode_cpu_info {
- extern struct ucode_cpu_info ucode_cpu_info[];
-
- #ifdef CONFIG_MICROCODE_INTEL
--extern struct microcode_ops * __init init_intel_microcode(void);
-+extern const struct microcode_ops * __init init_intel_microcode(void);
- #else
--static inline struct microcode_ops * __init init_intel_microcode(void)
-+static inline const struct microcode_ops * __init init_intel_microcode(void)
- {
- return NULL;
- }
- #endif /* CONFIG_MICROCODE_INTEL */
-
- #ifdef CONFIG_MICROCODE_AMD
--extern struct microcode_ops * __init init_amd_microcode(void);
-+extern const struct microcode_ops * __init init_amd_microcode(void);
- #else
--static inline struct microcode_ops * __init init_amd_microcode(void)
-+static inline const struct microcode_ops * __init init_amd_microcode(void)
- {
- return NULL;
- }
-diff --git a/arch/x86/include/asm/mman.h b/arch/x86/include/asm/mman.h
-index 593e51d..fa69c9a 100644
---- a/arch/x86/include/asm/mman.h
-+++ b/arch/x86/include/asm/mman.h
-@@ -5,4 +5,14 @@
-
- #include <asm-generic/mman.h>
-
-+#ifdef __KERNEL__
-+#ifndef __ASSEMBLY__
-+#ifdef CONFIG_X86_32
-+#define arch_mmap_check i386_mmap_check
-+int i386_mmap_check(unsigned long addr, unsigned long len,
-+ unsigned long flags);
-+#endif
-+#endif
-+#endif
-+
- #endif /* _ASM_X86_MMAN_H */
-diff --git a/arch/x86/include/asm/mmu.h b/arch/x86/include/asm/mmu.h
-index 80a1dee..239c67d 100644
---- a/arch/x86/include/asm/mmu.h
-+++ b/arch/x86/include/asm/mmu.h
-@@ -9,10 +9,23 @@
- * we put the segment information here.
- */
- typedef struct {
-- void *ldt;
-+ struct desc_struct *ldt;
- int size;
- struct mutex lock;
-- void *vdso;
-+ unsigned long vdso;
-+
-+#ifdef CONFIG_X86_32
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+ unsigned long user_cs_base;
-+ unsigned long user_cs_limit;
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
-+ cpumask_t cpu_user_cs_mask;
-+#endif
-+
-+#endif
-+#endif
-+
- } mm_context_t;
-
- #ifdef CONFIG_SMP
-diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
-index 8b5393e..b59dac9 100644
---- a/arch/x86/include/asm/mmu_context.h
-+++ b/arch/x86/include/asm/mmu_context.h
-@@ -24,6 +24,18 @@ void destroy_context(struct mm_struct *mm);
-
- static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
- {
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ unsigned int i;
-+ pgd_t *pgd;
-+
-+ pax_open_kernel();
-+ pgd = get_cpu_pgd(smp_processor_id());
-+ for (i = USER_PGD_PTRS; i < 2 * USER_PGD_PTRS; ++i)
-+ set_pgd_batched(pgd+i, native_make_pgd(0));
-+ pax_close_kernel();
-+#endif
-+
- #ifdef CONFIG_SMP
- if (percpu_read(cpu_tlbstate.state) == TLBSTATE_OK)
- percpu_write(cpu_tlbstate.state, TLBSTATE_LAZY);
-@@ -34,16 +46,30 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
- struct task_struct *tsk)
- {
- unsigned cpu = smp_processor_id();
-+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)) && defined(CONFIG_SMP)
-+ int tlbstate = TLBSTATE_OK;
-+#endif
-
- if (likely(prev != next)) {
- #ifdef CONFIG_SMP
-+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
-+ tlbstate = percpu_read(cpu_tlbstate.state);
-+#endif
- percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
- percpu_write(cpu_tlbstate.active_mm, next);
- #endif
- cpumask_set_cpu(cpu, mm_cpumask(next));
-
- /* Re-load page tables */
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ pax_open_kernel();
-+ __clone_user_pgds(get_cpu_pgd(cpu), next->pgd);
-+ __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd);
-+ pax_close_kernel();
-+ load_cr3(get_cpu_pgd(cpu));
-+#else
- load_cr3(next->pgd);
-+#endif
-
- /* stop flush ipis for the previous mm */
- cpumask_clear_cpu(cpu, mm_cpumask(prev));
-@@ -53,9 +79,38 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
- */
- if (unlikely(prev->context.ldt != next->context.ldt))
- load_LDT_nolock(&next->context);
-- }
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
-+ if (!nx_enabled) {
-+ smp_mb__before_clear_bit();
-+ cpu_clear(cpu, prev->context.cpu_user_cs_mask);
-+ smp_mb__after_clear_bit();
-+ cpu_set(cpu, next->context.cpu_user_cs_mask);
-+ }
-+#endif
-+
-+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
-+ if (unlikely(prev->context.user_cs_base != next->context.user_cs_base ||
-+ prev->context.user_cs_limit != next->context.user_cs_limit))
-+ set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
- #ifdef CONFIG_SMP
-+ else if (unlikely(tlbstate != TLBSTATE_OK))
-+ set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
-+#endif
-+#endif
-+
-+ }
- else {
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ pax_open_kernel();
-+ __clone_user_pgds(get_cpu_pgd(cpu), next->pgd);
-+ __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd);
-+ pax_close_kernel();
-+ load_cr3(get_cpu_pgd(cpu));
-+#endif
-+
-+#ifdef CONFIG_SMP
- percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
- BUG_ON(percpu_read(cpu_tlbstate.active_mm) != next);
-
-@@ -64,11 +119,28 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
- * tlb flush IPI delivery. We must reload CR3
- * to make sure to use no freed page tables.
- */
-+
-+#ifndef CONFIG_PAX_PER_CPU_PGD
- load_cr3(next->pgd);
-+#endif
-+
- load_LDT_nolock(&next->context);
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
-+ if (!nx_enabled)
-+ cpu_set(cpu, next->context.cpu_user_cs_mask);
-+#endif
-+
-+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (!((next->pax_flags & MF_PAX_PAGEEXEC) && nx_enabled))
-+#endif
-+ set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
-+#endif
-+
- }
-+#endif
- }
--#endif
- }
-
- #define activate_mm(prev, next) \
-diff --git a/arch/x86/include/asm/module.h b/arch/x86/include/asm/module.h
-index 3e2ce58..caaf478 100644
---- a/arch/x86/include/asm/module.h
-+++ b/arch/x86/include/asm/module.h
-@@ -5,6 +5,7 @@
-
- #ifdef CONFIG_X86_64
- /* X86_64 does not define MODULE_PROC_FAMILY */
-+#define MODULE_PROC_FAMILY ""
- #elif defined CONFIG_M386
- #define MODULE_PROC_FAMILY "386 "
- #elif defined CONFIG_M486
-@@ -59,13 +60,26 @@
- #error unknown processor family
- #endif
-
--#ifdef CONFIG_X86_32
--# ifdef CONFIG_4KSTACKS
--# define MODULE_STACKSIZE "4KSTACKS "
--# else
--# define MODULE_STACKSIZE ""
--# endif
--# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_STACKSIZE
-+#if defined(CONFIG_X86_32) && defined(CONFIG_4KSTACKS)
-+#define MODULE_STACKSIZE "4KSTACKS "
-+#else
-+#define MODULE_STACKSIZE ""
- #endif
-
-+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_BTS
-+#define MODULE_PAX_KERNEXEC "KERNEXEC_BTS "
-+#elif defined(CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR)
-+#define MODULE_PAX_KERNEXEC "KERNEXEC_OR "
-+#else
-+#define MODULE_PAX_KERNEXEC ""
-+#endif
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+#define MODULE_PAX_UDEREF "UDEREF "
-+#else
-+#define MODULE_PAX_UDEREF ""
-+#endif
-+
-+#define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_STACKSIZE MODULE_PAX_KERNEXEC MODULE_PAX_UDEREF
-+
- #endif /* _ASM_X86_MODULE_H */
-diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h
-index 7639dbf..e08a58c 100644
---- a/arch/x86/include/asm/page_64_types.h
-+++ b/arch/x86/include/asm/page_64_types.h
-@@ -56,7 +56,7 @@ void copy_page(void *to, void *from);
-
- /* duplicated to the one in bootmem.h */
- extern unsigned long max_pfn;
--extern unsigned long phys_base;
-+extern const unsigned long phys_base;
-
- extern unsigned long __phys_addr(unsigned long);
- #define __phys_reloc_hide(x) (x)
-diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
-index efb3899..ef30687 100644
---- a/arch/x86/include/asm/paravirt.h
-+++ b/arch/x86/include/asm/paravirt.h
-@@ -648,6 +648,18 @@ static inline void set_pgd(pgd_t *pgdp, pgd_t pgd)
- val);
- }
-
-+static inline void set_pgd_batched(pgd_t *pgdp, pgd_t pgd)
-+{
-+ pgdval_t val = native_pgd_val(pgd);
-+
-+ if (sizeof(pgdval_t) > sizeof(long))
-+ PVOP_VCALL3(pv_mmu_ops.set_pgd_batched, pgdp,
-+ val, (u64)val >> 32);
-+ else
-+ PVOP_VCALL2(pv_mmu_ops.set_pgd_batched, pgdp,
-+ val);
-+}
-+
- static inline void pgd_clear(pgd_t *pgdp)
- {
- set_pgd(pgdp, __pgd(0));
-@@ -729,6 +741,21 @@ static inline void __set_fixmap(unsigned /* enum fixed_addresses */ idx,
- pv_mmu_ops.set_fixmap(idx, phys, flags);
- }
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+static inline unsigned long pax_open_kernel(void)
-+{
-+ return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_open_kernel);
-+}
-+
-+static inline unsigned long pax_close_kernel(void)
-+{
-+ return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_close_kernel);
-+}
-+#else
-+static inline unsigned long pax_open_kernel(void) { return 0; }
-+static inline unsigned long pax_close_kernel(void) { return 0; }
-+#endif
-+
- #if defined(CONFIG_SMP) && defined(CONFIG_PARAVIRT_SPINLOCKS)
-
- static inline int __raw_spin_is_locked(struct raw_spinlock *lock)
-@@ -945,7 +972,7 @@ extern void default_banner(void);
-
- #define PARA_PATCH(struct, off) ((PARAVIRT_PATCH_##struct + (off)) / 4)
- #define PARA_SITE(ptype, clobbers, ops) _PVSITE(ptype, clobbers, ops, .long, 4)
--#define PARA_INDIRECT(addr) *%cs:addr
-+#define PARA_INDIRECT(addr) *%ss:addr
- #endif
-
- #define INTERRUPT_RETURN \
-@@ -1022,6 +1049,21 @@ extern void default_banner(void);
- PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_irq_enable_sysexit), \
- CLBR_NONE, \
- jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_irq_enable_sysexit))
-+
-+#define GET_CR0_INTO_RDI \
-+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0); \
-+ mov %rax,%rdi
-+
-+#define SET_RDI_INTO_CR0 \
-+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
-+
-+#define GET_CR3_INTO_RDI \
-+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_read_cr3); \
-+ mov %rax,%rdi
-+
-+#define SET_RDI_INTO_CR3 \
-+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_write_cr3)
-+
- #endif /* CONFIG_X86_32 */
-
- #endif /* __ASSEMBLY__ */
-diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
-index 9357473..12e6413 100644
---- a/arch/x86/include/asm/paravirt_types.h
-+++ b/arch/x86/include/asm/paravirt_types.h
-@@ -78,7 +78,7 @@ struct pv_init_ops {
- */
- unsigned (*patch)(u8 type, u16 clobber, void *insnbuf,
- unsigned long addr, unsigned len);
--};
-+} __no_const;
-
-
- struct pv_lazy_ops {
-@@ -90,7 +90,7 @@ struct pv_lazy_ops {
- struct pv_time_ops {
- unsigned long long (*sched_clock)(void);
- unsigned long (*get_tsc_khz)(void);
--};
-+} __no_const;
-
- struct pv_cpu_ops {
- /* hooks for various privileged instructions */
-@@ -186,7 +186,7 @@ struct pv_cpu_ops {
-
- void (*start_context_switch)(struct task_struct *prev);
- void (*end_context_switch)(struct task_struct *next);
--};
-+} __no_const;
-
- struct pv_irq_ops {
- /*
-@@ -217,7 +217,7 @@ struct pv_apic_ops {
- unsigned long start_eip,
- unsigned long start_esp);
- #endif
--};
-+} __no_const;
-
- struct pv_mmu_ops {
- unsigned long (*read_cr2)(void);
-@@ -301,6 +301,7 @@ struct pv_mmu_ops {
- struct paravirt_callee_save make_pud;
-
- void (*set_pgd)(pgd_t *pudp, pgd_t pgdval);
-+ void (*set_pgd_batched)(pgd_t *pudp, pgd_t pgdval);
- #endif /* PAGETABLE_LEVELS == 4 */
- #endif /* PAGETABLE_LEVELS >= 3 */
-
-@@ -316,6 +317,12 @@ struct pv_mmu_ops {
- an mfn. We can tell which is which from the index. */
- void (*set_fixmap)(unsigned /* enum fixed_addresses */ idx,
- phys_addr_t phys, pgprot_t flags);
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ unsigned long (*pax_open_kernel)(void);
-+ unsigned long (*pax_close_kernel)(void);
-+#endif
-+
- };
-
- struct raw_spinlock;
-@@ -326,7 +333,7 @@ struct pv_lock_ops {
- void (*spin_lock_flags)(struct raw_spinlock *lock, unsigned long flags);
- int (*spin_trylock)(struct raw_spinlock *lock);
- void (*spin_unlock)(struct raw_spinlock *lock);
--};
-+} __no_const;
-
- /* This contains all the paravirt structures: we get a convenient
- * number for each function using the offset which we use to indicate
-diff --git a/arch/x86/include/asm/pci_x86.h b/arch/x86/include/asm/pci_x86.h
-index b399988..3f47c38 100644
---- a/arch/x86/include/asm/pci_x86.h
-+++ b/arch/x86/include/asm/pci_x86.h
-@@ -89,16 +89,16 @@ extern int (*pcibios_enable_irq)(struct pci_dev *dev);
- extern void (*pcibios_disable_irq)(struct pci_dev *dev);
-
- struct pci_raw_ops {
-- int (*read)(unsigned int domain, unsigned int bus, unsigned int devfn,
-+ int (* const read)(unsigned int domain, unsigned int bus, unsigned int devfn,
- int reg, int len, u32 *val);
-- int (*write)(unsigned int domain, unsigned int bus, unsigned int devfn,
-+ int (* const write)(unsigned int domain, unsigned int bus, unsigned int devfn,
- int reg, int len, u32 val);
- };
-
--extern struct pci_raw_ops *raw_pci_ops;
--extern struct pci_raw_ops *raw_pci_ext_ops;
-+extern const struct pci_raw_ops *raw_pci_ops;
-+extern const struct pci_raw_ops *raw_pci_ext_ops;
-
--extern struct pci_raw_ops pci_direct_conf1;
-+extern const struct pci_raw_ops pci_direct_conf1;
- extern bool port_cf9_safe;
-
- /* arch_initcall level */
-diff --git a/arch/x86/include/asm/percpu.h b/arch/x86/include/asm/percpu.h
-index b65a36d..50345a4 100644
---- a/arch/x86/include/asm/percpu.h
-+++ b/arch/x86/include/asm/percpu.h
-@@ -78,6 +78,7 @@ do { \
- if (0) { \
- T__ tmp__; \
- tmp__ = (val); \
-+ (void)tmp__; \
- } \
- switch (sizeof(var)) { \
- case 1: \
-diff --git a/arch/x86/include/asm/pgalloc.h b/arch/x86/include/asm/pgalloc.h
-index 271de94..c714995 100644
---- a/arch/x86/include/asm/pgalloc.h
-+++ b/arch/x86/include/asm/pgalloc.h
-@@ -63,6 +63,13 @@ static inline void pmd_populate_kernel(struct mm_struct *mm,
- pmd_t *pmd, pte_t *pte)
- {
- paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
-+ set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE));
-+}
-+
-+static inline void pmd_populate_user(struct mm_struct *mm,
-+ pmd_t *pmd, pte_t *pte)
-+{
-+ paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
- set_pmd(pmd, __pmd(__pa(pte) | _PAGE_TABLE));
- }
-
-@@ -99,12 +106,22 @@ static inline void __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd,
-
- #ifdef CONFIG_X86_PAE
- extern void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd);
-+static inline void pud_populate_kernel(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
-+{
-+ pud_populate(mm, pudp, pmd);
-+}
- #else /* !CONFIG_X86_PAE */
- static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
- {
- paravirt_alloc_pmd(mm, __pa(pmd) >> PAGE_SHIFT);
- set_pud(pud, __pud(_PAGE_TABLE | __pa(pmd)));
- }
-+
-+static inline void pud_populate_kernel(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
-+{
-+ paravirt_alloc_pmd(mm, __pa(pmd) >> PAGE_SHIFT);
-+ set_pud(pud, __pud(_KERNPG_TABLE | __pa(pmd)));
-+}
- #endif /* CONFIG_X86_PAE */
-
- #if PAGETABLE_LEVELS > 3
-@@ -114,6 +131,12 @@ static inline void pgd_populate(struct mm_struct *mm, pgd_t *pgd, pud_t *pud)
- set_pgd(pgd, __pgd(_PAGE_TABLE | __pa(pud)));
- }
-
-+static inline void pgd_populate_kernel(struct mm_struct *mm, pgd_t *pgd, pud_t *pud)
-+{
-+ paravirt_alloc_pud(mm, __pa(pud) >> PAGE_SHIFT);
-+ set_pgd(pgd, __pgd(_KERNPG_TABLE | __pa(pud)));
-+}
-+
- static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr)
- {
- return (pud_t *)get_zeroed_page(GFP_KERNEL|__GFP_REPEAT);
-diff --git a/arch/x86/include/asm/pgtable-2level.h b/arch/x86/include/asm/pgtable-2level.h
-index 2334982..70bc412 100644
---- a/arch/x86/include/asm/pgtable-2level.h
-+++ b/arch/x86/include/asm/pgtable-2level.h
-@@ -18,7 +18,9 @@ static inline void native_set_pte(pte_t *ptep , pte_t pte)
-
- static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
- {
-+ pax_open_kernel();
- *pmdp = pmd;
-+ pax_close_kernel();
- }
-
- static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
-diff --git a/arch/x86/include/asm/pgtable-3level.h b/arch/x86/include/asm/pgtable-3level.h
-index 33927d2..ccde329 100644
---- a/arch/x86/include/asm/pgtable-3level.h
-+++ b/arch/x86/include/asm/pgtable-3level.h
-@@ -38,12 +38,16 @@ static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
-
- static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
- {
-+ pax_open_kernel();
- set_64bit((unsigned long long *)(pmdp), native_pmd_val(pmd));
-+ pax_close_kernel();
- }
-
- static inline void native_set_pud(pud_t *pudp, pud_t pud)
- {
-+ pax_open_kernel();
- set_64bit((unsigned long long *)(pudp), native_pud_val(pud));
-+ pax_close_kernel();
- }
-
- /*
-diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
-index 1cce9d2..a7c3e4d 100644
---- a/arch/x86/include/asm/pgtable.h
-+++ b/arch/x86/include/asm/pgtable.h
-@@ -39,6 +39,7 @@ extern struct list_head pgd_list;
-
- #ifndef __PAGETABLE_PUD_FOLDED
- #define set_pgd(pgdp, pgd) native_set_pgd(pgdp, pgd)
-+#define set_pgd_batched(pgdp, pgd) native_set_pgd_batched(pgdp, pgd)
- #define pgd_clear(pgd) native_pgd_clear(pgd)
- #endif
-
-@@ -74,12 +75,51 @@ extern struct list_head pgd_list;
-
- #define arch_end_context_switch(prev) do {} while(0)
-
-+#define pax_open_kernel() native_pax_open_kernel()
-+#define pax_close_kernel() native_pax_close_kernel()
- #endif /* CONFIG_PARAVIRT */
-
-+#define __HAVE_ARCH_PAX_OPEN_KERNEL
-+#define __HAVE_ARCH_PAX_CLOSE_KERNEL
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+static inline unsigned long native_pax_open_kernel(void)
-+{
-+ unsigned long cr0;
-+
-+ preempt_disable();
-+ barrier();
-+ cr0 = read_cr0() ^ X86_CR0_WP;
-+ BUG_ON(cr0 & X86_CR0_WP);
-+ write_cr0(cr0);
-+ return cr0 ^ X86_CR0_WP;
-+}
-+
-+static inline unsigned long native_pax_close_kernel(void)
-+{
-+ unsigned long cr0;
-+
-+ cr0 = read_cr0() ^ X86_CR0_WP;
-+ BUG_ON(!(cr0 & X86_CR0_WP));
-+ write_cr0(cr0);
-+ barrier();
-+ preempt_enable_no_resched();
-+ return cr0 ^ X86_CR0_WP;
-+}
-+#else
-+static inline unsigned long native_pax_open_kernel(void) { return 0; }
-+static inline unsigned long native_pax_close_kernel(void) { return 0; }
-+#endif
-+
- /*
- * The following only work if pte_present() is true.
- * Undefined behaviour if not..
- */
-+static inline int pte_user(pte_t pte)
-+{
-+ return pte_val(pte) & _PAGE_USER;
-+}
-+
- static inline int pte_dirty(pte_t pte)
- {
- return pte_flags(pte) & _PAGE_DIRTY;
-@@ -139,8 +179,7 @@ static inline unsigned long pud_pfn(pud_t pud)
-
- static inline int pmd_large(pmd_t pte)
- {
-- return (pmd_flags(pte) & (_PAGE_PSE | _PAGE_PRESENT)) ==
-- (_PAGE_PSE | _PAGE_PRESENT);
-+ return pmd_flags(pte) & _PAGE_PSE;
- }
-
- static inline pte_t pte_set_flags(pte_t pte, pteval_t set)
-@@ -172,9 +211,29 @@ static inline pte_t pte_wrprotect(pte_t pte)
- return pte_clear_flags(pte, _PAGE_RW);
- }
-
-+static inline pte_t pte_mkread(pte_t pte)
-+{
-+ return __pte(pte_val(pte) | _PAGE_USER);
-+}
-+
- static inline pte_t pte_mkexec(pte_t pte)
- {
-- return pte_clear_flags(pte, _PAGE_NX);
-+#ifdef CONFIG_X86_PAE
-+ if (__supported_pte_mask & _PAGE_NX)
-+ return pte_clear_flags(pte, _PAGE_NX);
-+ else
-+#endif
-+ return pte_set_flags(pte, _PAGE_USER);
-+}
-+
-+static inline pte_t pte_exprotect(pte_t pte)
-+{
-+#ifdef CONFIG_X86_PAE
-+ if (__supported_pte_mask & _PAGE_NX)
-+ return pte_set_flags(pte, _PAGE_NX);
-+ else
-+#endif
-+ return pte_clear_flags(pte, _PAGE_USER);
- }
-
- static inline pte_t pte_mkdirty(pte_t pte)
-@@ -307,6 +366,15 @@ pte_t *populate_extra_pte(unsigned long vaddr);
- #endif
-
- #ifndef __ASSEMBLY__
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+extern pgd_t cpu_pgd[NR_CPUS][PTRS_PER_PGD];
-+static inline pgd_t *get_cpu_pgd(unsigned int cpu)
-+{
-+ return cpu_pgd[cpu];
-+}
-+#endif
-+
- #include <linux/mm_types.h>
-
- static inline int pte_none(pte_t pte)
-@@ -332,7 +400,13 @@ static inline int pte_hidden(pte_t pte)
-
- static inline int pmd_present(pmd_t pmd)
- {
-- return pmd_flags(pmd) & _PAGE_PRESENT;
-+ /*
-+ * Checking for _PAGE_PSE is needed too because
-+ * split_huge_page will temporarily clear the present bit (but
-+ * the _PAGE_PSE flag will remain set at all times while the
-+ * _PAGE_PRESENT bit is clear).
-+ */
-+ return pmd_flags(pmd) & (_PAGE_PRESENT | _PAGE_PROTNONE | _PAGE_PSE);
- }
-
- static inline int pmd_none(pmd_t pmd)
-@@ -477,7 +551,7 @@ static inline pud_t *pud_offset(pgd_t *pgd, unsigned long address)
-
- static inline int pgd_bad(pgd_t pgd)
- {
-- return (pgd_flags(pgd) & ~_PAGE_USER) != _KERNPG_TABLE;
-+ return (pgd_flags(pgd) & ~(_PAGE_USER | _PAGE_NX)) != _KERNPG_TABLE;
- }
-
- static inline int pgd_none(pgd_t pgd)
-@@ -500,7 +574,12 @@ static inline int pgd_none(pgd_t pgd)
- * pgd_offset() returns a (pgd_t *)
- * pgd_index() is used get the offset into the pgd page's array of pgd_t's;
- */
--#define pgd_offset(mm, address) ((mm)->pgd + pgd_index((address)))
-+#define pgd_offset(mm, address) ((mm)->pgd + pgd_index(address))
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+#define pgd_offset_cpu(cpu, address) (get_cpu_pgd(cpu) + pgd_index(address))
-+#endif
-+
- /*
- * a shortcut which implies the use of the kernel's pgd, instead
- * of a process's
-@@ -511,6 +590,20 @@ static inline int pgd_none(pgd_t pgd)
- #define KERNEL_PGD_BOUNDARY pgd_index(PAGE_OFFSET)
- #define KERNEL_PGD_PTRS (PTRS_PER_PGD - KERNEL_PGD_BOUNDARY)
-
-+#ifdef CONFIG_X86_32
-+#define USER_PGD_PTRS KERNEL_PGD_BOUNDARY
-+#else
-+#define TASK_SIZE_MAX_SHIFT CONFIG_TASK_SIZE_MAX_SHIFT
-+#define USER_PGD_PTRS (_AC(1,UL) << (TASK_SIZE_MAX_SHIFT - PGDIR_SHIFT))
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+#define PAX_USER_SHADOW_BASE (_AC(1,UL) << TASK_SIZE_MAX_SHIFT)
-+#else
-+#define PAX_USER_SHADOW_BASE (_AC(0,UL))
-+#endif
-+
-+#endif
-+
- #ifndef __ASSEMBLY__
-
- extern int direct_gbpages;
-@@ -616,11 +709,23 @@ static inline void ptep_set_wrprotect(struct mm_struct *mm,
- * dst and src can be on the same page, but the range must not overlap,
- * and must not cross a page boundary.
- */
--static inline void clone_pgd_range(pgd_t *dst, pgd_t *src, int count)
-+static inline void clone_pgd_range(pgd_t *dst, const pgd_t *src, int count)
- {
-- memcpy(dst, src, count * sizeof(pgd_t));
-+ pax_open_kernel();
-+ while (count--)
-+ *dst++ = *src++;
-+ pax_close_kernel();
- }
-
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+extern void __clone_user_pgds(pgd_t *dst, const pgd_t *src);
-+#endif
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+extern void __shadow_user_pgds(pgd_t *dst, const pgd_t *src);
-+#else
-+static inline void __shadow_user_pgds(pgd_t *dst, const pgd_t *src) {}
-+#endif
-
- #include <asm-generic/pgtable.h>
- #endif /* __ASSEMBLY__ */
-diff --git a/arch/x86/include/asm/pgtable_32.h b/arch/x86/include/asm/pgtable_32.h
-index 750f1bf..971e8394 100644
---- a/arch/x86/include/asm/pgtable_32.h
-+++ b/arch/x86/include/asm/pgtable_32.h
-@@ -26,9 +26,6 @@
- struct mm_struct;
- struct vm_area_struct;
-
--extern pgd_t swapper_pg_dir[1024];
--extern pgd_t trampoline_pg_dir[1024];
--
- static inline void pgtable_cache_init(void) { }
- static inline void check_pgt_cache(void) { }
- void paging_init(void);
-@@ -49,6 +46,12 @@ extern void set_pmd_pfn(unsigned long, unsigned long, pgprot_t);
- # include <asm/pgtable-2level.h>
- #endif
-
-+extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
-+extern pgd_t trampoline_pg_dir[PTRS_PER_PGD];
-+#ifdef CONFIG_X86_PAE
-+extern pmd_t swapper_pm_dir[PTRS_PER_PGD][PTRS_PER_PMD];
-+#endif
-+
- #if defined(CONFIG_HIGHPTE)
- #define __KM_PTE \
- (in_nmi() ? KM_NMI_PTE : \
-@@ -73,7 +76,9 @@ extern void set_pmd_pfn(unsigned long, unsigned long, pgprot_t);
- /* Clear a kernel PTE and flush it from the TLB */
- #define kpte_clear_flush(ptep, vaddr) \
- do { \
-+ pax_open_kernel(); \
- pte_clear(&init_mm, (vaddr), (ptep)); \
-+ pax_close_kernel(); \
- __flush_tlb_one((vaddr)); \
- } while (0)
-
-@@ -85,6 +90,9 @@ do { \
-
- #endif /* !__ASSEMBLY__ */
-
-+#define HAVE_ARCH_UNMAPPED_AREA
-+#define HAVE_ARCH_UNMAPPED_AREA_TOPDOWN
-+
- /*
- * kern_addr_valid() is (1) for FLATMEM and (0) for
- * SPARSEMEM and DISCONTIGMEM
-diff --git a/arch/x86/include/asm/pgtable_32_types.h b/arch/x86/include/asm/pgtable_32_types.h
-index 5e67c15..12d5c47 100644
---- a/arch/x86/include/asm/pgtable_32_types.h
-+++ b/arch/x86/include/asm/pgtable_32_types.h
-@@ -8,7 +8,7 @@
- */
- #ifdef CONFIG_X86_PAE
- # include <asm/pgtable-3level_types.h>
--# define PMD_SIZE (1UL << PMD_SHIFT)
-+# define PMD_SIZE (_AC(1, UL) << PMD_SHIFT)
- # define PMD_MASK (~(PMD_SIZE - 1))
- #else
- # include <asm/pgtable-2level_types.h>
-@@ -46,6 +46,19 @@ extern bool __vmalloc_start_set; /* set once high_memory is set */
- # define VMALLOC_END (FIXADDR_START - 2 * PAGE_SIZE)
- #endif
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+#ifndef __ASSEMBLY__
-+extern unsigned char MODULES_EXEC_VADDR[];
-+extern unsigned char MODULES_EXEC_END[];
-+#endif
-+#include <asm/boot.h>
-+#define ktla_ktva(addr) (addr + LOAD_PHYSICAL_ADDR + PAGE_OFFSET)
-+#define ktva_ktla(addr) (addr - LOAD_PHYSICAL_ADDR - PAGE_OFFSET)
-+#else
-+#define ktla_ktva(addr) (addr)
-+#define ktva_ktla(addr) (addr)
-+#endif
-+
- #define MODULES_VADDR VMALLOC_START
- #define MODULES_END VMALLOC_END
- #define MODULES_LEN (MODULES_VADDR - MODULES_END)
-diff --git a/arch/x86/include/asm/pgtable_64.h b/arch/x86/include/asm/pgtable_64.h
-index c57a301..5038210 100644
---- a/arch/x86/include/asm/pgtable_64.h
-+++ b/arch/x86/include/asm/pgtable_64.h
-@@ -16,10 +16,14 @@
-
- extern pud_t level3_kernel_pgt[512];
- extern pud_t level3_ident_pgt[512];
-+extern pud_t level3_vmalloc_start_pgt[512];
-+extern pud_t level3_vmalloc_end_pgt[512];
-+extern pud_t level3_vmemmap_pgt[512];
-+extern pud_t level2_vmemmap_pgt[512];
- extern pmd_t level2_kernel_pgt[512];
- extern pmd_t level2_fixmap_pgt[512];
--extern pmd_t level2_ident_pgt[512];
--extern pgd_t init_level4_pgt[];
-+extern pmd_t level2_ident_pgt[512*2];
-+extern pgd_t init_level4_pgt[512];
-
- #define swapper_pg_dir init_level4_pgt
-
-@@ -74,7 +78,9 @@ static inline pte_t native_ptep_get_and_clear(pte_t *xp)
-
- static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
- {
-+ pax_open_kernel();
- *pmdp = pmd;
-+ pax_close_kernel();
- }
-
- static inline void native_pmd_clear(pmd_t *pmd)
-@@ -84,7 +90,9 @@ static inline void native_pmd_clear(pmd_t *pmd)
-
- static inline void native_set_pud(pud_t *pudp, pud_t pud)
- {
-+ pax_open_kernel();
- *pudp = pud;
-+ pax_close_kernel();
- }
-
- static inline void native_pud_clear(pud_t *pud)
-@@ -94,6 +102,13 @@ static inline void native_pud_clear(pud_t *pud)
-
- static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)
- {
-+ pax_open_kernel();
-+ *pgdp = pgd;
-+ pax_close_kernel();
-+}
-+
-+static inline void native_set_pgd_batched(pgd_t *pgdp, pgd_t pgd)
-+{
- *pgdp = pgd;
- }
-
-diff --git a/arch/x86/include/asm/pgtable_64_types.h b/arch/x86/include/asm/pgtable_64_types.h
-index 766ea16..5b96cb3 100644
---- a/arch/x86/include/asm/pgtable_64_types.h
-+++ b/arch/x86/include/asm/pgtable_64_types.h
-@@ -59,5 +59,10 @@ typedef struct { pteval_t pte; } pte_t;
- #define MODULES_VADDR _AC(0xffffffffa0000000, UL)
- #define MODULES_END _AC(0xffffffffff000000, UL)
- #define MODULES_LEN (MODULES_END - MODULES_VADDR)
-+#define MODULES_EXEC_VADDR MODULES_VADDR
-+#define MODULES_EXEC_END MODULES_END
-+
-+#define ktla_ktva(addr) (addr)
-+#define ktva_ktla(addr) (addr)
-
- #endif /* _ASM_X86_PGTABLE_64_DEFS_H */
-diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h
-index d1f4a76..2f46ba1 100644
---- a/arch/x86/include/asm/pgtable_types.h
-+++ b/arch/x86/include/asm/pgtable_types.h
-@@ -16,12 +16,11 @@
- #define _PAGE_BIT_PSE 7 /* 4 MB (or 2MB) page */
- #define _PAGE_BIT_PAT 7 /* on 4KB pages */
- #define _PAGE_BIT_GLOBAL 8 /* Global TLB entry PPro+ */
--#define _PAGE_BIT_UNUSED1 9 /* available for programmer */
-+#define _PAGE_BIT_SPECIAL 9 /* special mappings, no associated struct page */
- #define _PAGE_BIT_IOMAP 10 /* flag used to indicate IO mapping */
- #define _PAGE_BIT_HIDDEN 11 /* hidden by kmemcheck */
- #define _PAGE_BIT_PAT_LARGE 12 /* On 2MB or 1GB pages */
--#define _PAGE_BIT_SPECIAL _PAGE_BIT_UNUSED1
--#define _PAGE_BIT_CPA_TEST _PAGE_BIT_UNUSED1
-+#define _PAGE_BIT_CPA_TEST _PAGE_BIT_SPECIAL
- #define _PAGE_BIT_NX 63 /* No execute: only valid after cpuid check */
-
- /* If _PAGE_BIT_PRESENT is clear, we use these: */
-@@ -39,7 +38,6 @@
- #define _PAGE_DIRTY (_AT(pteval_t, 1) << _PAGE_BIT_DIRTY)
- #define _PAGE_PSE (_AT(pteval_t, 1) << _PAGE_BIT_PSE)
- #define _PAGE_GLOBAL (_AT(pteval_t, 1) << _PAGE_BIT_GLOBAL)
--#define _PAGE_UNUSED1 (_AT(pteval_t, 1) << _PAGE_BIT_UNUSED1)
- #define _PAGE_IOMAP (_AT(pteval_t, 1) << _PAGE_BIT_IOMAP)
- #define _PAGE_PAT (_AT(pteval_t, 1) << _PAGE_BIT_PAT)
- #define _PAGE_PAT_LARGE (_AT(pteval_t, 1) << _PAGE_BIT_PAT_LARGE)
-@@ -55,8 +53,10 @@
-
- #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
- #define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_NX)
--#else
-+#elif defined(CONFIG_KMEMCHECK)
- #define _PAGE_NX (_AT(pteval_t, 0))
-+#else
-+#define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_HIDDEN)
- #endif
-
- #define _PAGE_FILE (_AT(pteval_t, 1) << _PAGE_BIT_FILE)
-@@ -93,6 +93,9 @@
- #define PAGE_READONLY_EXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | \
- _PAGE_ACCESSED)
-
-+#define PAGE_READONLY_NOEXEC PAGE_READONLY
-+#define PAGE_SHARED_NOEXEC PAGE_SHARED
-+
- #define __PAGE_KERNEL_EXEC \
- (_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_GLOBAL)
- #define __PAGE_KERNEL (__PAGE_KERNEL_EXEC | _PAGE_NX)
-@@ -103,8 +106,8 @@
- #define __PAGE_KERNEL_WC (__PAGE_KERNEL | _PAGE_CACHE_WC)
- #define __PAGE_KERNEL_NOCACHE (__PAGE_KERNEL | _PAGE_PCD | _PAGE_PWT)
- #define __PAGE_KERNEL_UC_MINUS (__PAGE_KERNEL | _PAGE_PCD)
--#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RX | _PAGE_USER)
--#define __PAGE_KERNEL_VSYSCALL_NOCACHE (__PAGE_KERNEL_VSYSCALL | _PAGE_PCD | _PAGE_PWT)
-+#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RO | _PAGE_USER)
-+#define __PAGE_KERNEL_VSYSCALL_NOCACHE (__PAGE_KERNEL_RO | _PAGE_PCD | _PAGE_PWT | _PAGE_USER)
- #define __PAGE_KERNEL_LARGE (__PAGE_KERNEL | _PAGE_PSE)
- #define __PAGE_KERNEL_LARGE_NOCACHE (__PAGE_KERNEL | _PAGE_CACHE_UC | _PAGE_PSE)
- #define __PAGE_KERNEL_LARGE_EXEC (__PAGE_KERNEL_EXEC | _PAGE_PSE)
-@@ -163,8 +166,8 @@
- * bits are combined, this will alow user to access the high address mapped
- * VDSO in the presence of CONFIG_COMPAT_VDSO
- */
--#define PTE_IDENT_ATTR 0x003 /* PRESENT+RW */
--#define PDE_IDENT_ATTR 0x067 /* PRESENT+RW+USER+DIRTY+ACCESSED */
-+#define PTE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
-+#define PDE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
- #define PGD_IDENT_ATTR 0x001 /* PRESENT (no other attributes) */
- #endif
-
-@@ -202,7 +205,17 @@ static inline pgdval_t pgd_flags(pgd_t pgd)
- {
- return native_pgd_val(pgd) & PTE_FLAGS_MASK;
- }
-+#endif
-
-+#if PAGETABLE_LEVELS == 3
-+#include <asm-generic/pgtable-nopud.h>
-+#endif
-+
-+#if PAGETABLE_LEVELS == 2
-+#include <asm-generic/pgtable-nopmd.h>
-+#endif
-+
-+#ifndef __ASSEMBLY__
- #if PAGETABLE_LEVELS > 3
- typedef struct { pudval_t pud; } pud_t;
-
-@@ -216,8 +229,6 @@ static inline pudval_t native_pud_val(pud_t pud)
- return pud.pud;
- }
- #else
--#include <asm-generic/pgtable-nopud.h>
--
- static inline pudval_t native_pud_val(pud_t pud)
- {
- return native_pgd_val(pud.pgd);
-@@ -237,8 +248,6 @@ static inline pmdval_t native_pmd_val(pmd_t pmd)
- return pmd.pmd;
- }
- #else
--#include <asm-generic/pgtable-nopmd.h>
--
- static inline pmdval_t native_pmd_val(pmd_t pmd)
- {
- return native_pgd_val(pmd.pud.pgd);
-@@ -278,7 +287,16 @@ typedef struct page *pgtable_t;
-
- extern pteval_t __supported_pte_mask;
- extern void set_nx(void);
-+
-+#ifdef CONFIG_X86_32
-+#ifdef CONFIG_X86_PAE
- extern int nx_enabled;
-+#else
-+#define nx_enabled (0)
-+#endif
-+#else
-+#define nx_enabled (1)
-+#endif
-
- #define pgprot_writecombine pgprot_writecombine
- extern pgprot_t pgprot_writecombine(pgprot_t prot);
-diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
-index fa04dea..5f823fc 100644
---- a/arch/x86/include/asm/processor.h
-+++ b/arch/x86/include/asm/processor.h
-@@ -272,7 +272,7 @@ struct tss_struct {
-
- } ____cacheline_aligned;
-
--DECLARE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss);
-+extern struct tss_struct init_tss[NR_CPUS];
-
- /*
- * Save the original ist values for checking stack pointers during debugging
-@@ -911,11 +911,18 @@ static inline void spin_lock_prefetch(const void *x)
- */
- #define TASK_SIZE PAGE_OFFSET
- #define TASK_SIZE_MAX TASK_SIZE
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+#define SEGMEXEC_TASK_SIZE (TASK_SIZE / 2)
-+#define STACK_TOP ((current->mm->pax_flags & MF_PAX_SEGMEXEC)?SEGMEXEC_TASK_SIZE:TASK_SIZE)
-+#else
- #define STACK_TOP TASK_SIZE
--#define STACK_TOP_MAX STACK_TOP
-+#endif
-+
-+#define STACK_TOP_MAX TASK_SIZE
-
- #define INIT_THREAD { \
-- .sp0 = sizeof(init_stack) + (long)&init_stack, \
-+ .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
- .vm86_info = NULL, \
- .sysenter_cs = __KERNEL_CS, \
- .io_bitmap_ptr = NULL, \
-@@ -929,7 +936,7 @@ static inline void spin_lock_prefetch(const void *x)
- */
- #define INIT_TSS { \
- .x86_tss = { \
-- .sp0 = sizeof(init_stack) + (long)&init_stack, \
-+ .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
- .ss0 = __KERNEL_DS, \
- .ss1 = __KERNEL_CS, \
- .io_bitmap_base = INVALID_IO_BITMAP_OFFSET, \
-@@ -940,11 +947,7 @@ static inline void spin_lock_prefetch(const void *x)
- extern unsigned long thread_saved_pc(struct task_struct *tsk);
-
- #define THREAD_SIZE_LONGS (THREAD_SIZE/sizeof(unsigned long))
--#define KSTK_TOP(info) \
--({ \
-- unsigned long *__ptr = (unsigned long *)(info); \
-- (unsigned long)(&__ptr[THREAD_SIZE_LONGS]); \
--})
-+#define KSTK_TOP(info) ((container_of(info, struct task_struct, tinfo))->thread.sp0)
-
- /*
- * The below -8 is to reserve 8 bytes on top of the ring0 stack.
-@@ -959,7 +962,7 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
- #define task_pt_regs(task) \
- ({ \
- struct pt_regs *__regs__; \
-- __regs__ = (struct pt_regs *)(KSTK_TOP(task_stack_page(task))-8); \
-+ __regs__ = (struct pt_regs *)((task)->thread.sp0); \
- __regs__ - 1; \
- })
-
-@@ -969,13 +972,13 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
- /*
- * User space process size. 47bits minus one guard page.
- */
--#define TASK_SIZE_MAX ((1UL << 47) - PAGE_SIZE)
-+#define TASK_SIZE_MAX ((1UL << TASK_SIZE_MAX_SHIFT) - PAGE_SIZE)
-
- /* This decides where the kernel will search for a free chunk of vm
- * space during mmap's.
- */
- #define IA32_PAGE_OFFSET ((current->personality & ADDR_LIMIT_3GB) ? \
-- 0xc0000000 : 0xFFFFe000)
-+ 0xc0000000 : 0xFFFFf000)
-
- #define TASK_SIZE (test_thread_flag(TIF_IA32) ? \
- IA32_PAGE_OFFSET : TASK_SIZE_MAX)
-@@ -986,11 +989,11 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
- #define STACK_TOP_MAX TASK_SIZE_MAX
-
- #define INIT_THREAD { \
-- .sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
-+ .sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
- }
-
- #define INIT_TSS { \
-- .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
-+ .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
- }
-
- /*
-@@ -1012,6 +1015,10 @@ extern void start_thread(struct pt_regs *regs, unsigned long new_ip,
- */
- #define TASK_UNMAPPED_BASE (PAGE_ALIGN(TASK_SIZE / 3))
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+#define SEGMEXEC_TASK_UNMAPPED_BASE (PAGE_ALIGN(SEGMEXEC_TASK_SIZE / 3))
-+#endif
-+
- #define KSTK_EIP(task) (task_pt_regs(task)->ip)
-
- /* Get/set a process' ability to use the timestamp counter instruction */
-diff --git a/arch/x86/include/asm/proto.h b/arch/x86/include/asm/proto.h
-index 621f56d..f1094fd 100644
---- a/arch/x86/include/asm/proto.h
-+++ b/arch/x86/include/asm/proto.h
-@@ -22,14 +22,4 @@ extern int reboot_force;
-
- long do_arch_prctl(struct task_struct *task, int code, unsigned long addr);
-
--/*
-- * This looks more complex than it should be. But we need to
-- * get the type for the ~ right in round_down (it needs to be
-- * as wide as the result!), and we want to evaluate the macro
-- * arguments just once each.
-- */
--#define __round_mask(x,y) ((__typeof__(x))((y)-1))
--#define round_up(x,y) ((((x)-1) | __round_mask(x,y))+1)
--#define round_down(x,y) ((x) & ~__round_mask(x,y))
--
- #endif /* _ASM_X86_PROTO_H */
-diff --git a/arch/x86/include/asm/ptrace.h b/arch/x86/include/asm/ptrace.h
-index e668d72..c4dd168 100644
---- a/arch/x86/include/asm/ptrace.h
-+++ b/arch/x86/include/asm/ptrace.h
-@@ -2,7 +2,6 @@
- #define _ASM_X86_PTRACE_H
-
- #include <linux/compiler.h> /* For __user */
--#include <linux/linkage.h> /* For asmregparm */
- #include <asm/ptrace-abi.h>
- #include <asm/processor-flags.h>
-
-@@ -143,37 +142,35 @@ extern void send_sigtrap(struct task_struct *tsk, struct pt_regs *regs,
- int error_code, int si_code);
- void signal_fault(struct pt_regs *regs, void __user *frame, char *where);
-
--extern asmregparm long syscall_trace_enter(struct pt_regs *);
--extern asmregparm void syscall_trace_leave(struct pt_regs *);
--
- static inline unsigned long regs_return_value(struct pt_regs *regs)
- {
- return regs->ax;
- }
-
- /*
-- * user_mode_vm(regs) determines whether a register set came from user mode.
-+ * user_mode(regs) determines whether a register set came from user mode.
- * This is true if V8086 mode was enabled OR if the register set was from
- * protected mode with RPL-3 CS value. This tricky test checks that with
- * one comparison. Many places in the kernel can bypass this full check
-- * if they have already ruled out V8086 mode, so user_mode(regs) can be used.
-+ * if they have already ruled out V8086 mode, so user_mode_novm(regs) can
-+ * be used.
- */
--static inline int user_mode(struct pt_regs *regs)
-+static inline int user_mode_novm(struct pt_regs *regs)
- {
- #ifdef CONFIG_X86_32
- return (regs->cs & SEGMENT_RPL_MASK) == USER_RPL;
- #else
-- return !!(regs->cs & 3);
-+ return !!(regs->cs & SEGMENT_RPL_MASK);
- #endif
- }
-
--static inline int user_mode_vm(struct pt_regs *regs)
-+static inline int user_mode(struct pt_regs *regs)
- {
- #ifdef CONFIG_X86_32
- return ((regs->cs & SEGMENT_RPL_MASK) | (regs->flags & X86_VM_MASK)) >=
- USER_RPL;
- #else
-- return user_mode(regs);
-+ return user_mode_novm(regs);
- #endif
- }
-
-diff --git a/arch/x86/include/asm/reboot.h b/arch/x86/include/asm/reboot.h
-index 562d4fd..1e42a5b 100644
---- a/arch/x86/include/asm/reboot.h
-+++ b/arch/x86/include/asm/reboot.h
-@@ -6,19 +6,19 @@
- struct pt_regs;
-
- struct machine_ops {
-- void (*restart)(char *cmd);
-- void (*halt)(void);
-- void (*power_off)(void);
-+ void (* __noreturn restart)(char *cmd);
-+ void (* __noreturn halt)(void);
-+ void (* __noreturn power_off)(void);
- void (*shutdown)(void);
- void (*crash_shutdown)(struct pt_regs *);
-- void (*emergency_restart)(void);
--};
-+ void (* __noreturn emergency_restart)(void);
-+} __no_const;
-
- extern struct machine_ops machine_ops;
-
- void native_machine_crash_shutdown(struct pt_regs *regs);
- void native_machine_shutdown(void);
--void machine_real_restart(const unsigned char *code, int length);
-+void __noreturn machine_real_restart(const unsigned char *code, unsigned int length);
-
- typedef void (*nmi_shootdown_cb)(int, struct die_args*);
- void nmi_shootdown_cpus(nmi_shootdown_cb callback);
-diff --git a/arch/x86/include/asm/rwsem.h b/arch/x86/include/asm/rwsem.h
-index 606ede1..dbfff37 100644
---- a/arch/x86/include/asm/rwsem.h
-+++ b/arch/x86/include/asm/rwsem.h
-@@ -118,6 +118,14 @@ static inline void __down_read(struct rw_semaphore *sem)
- {
- asm volatile("# beginning down_read\n\t"
- LOCK_PREFIX _ASM_INC "(%1)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX _ASM_DEC "(%1)\n\t"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- /* adds 0x00000001, returns the old value */
- " jns 1f\n"
- " call call_rwsem_down_read_failed\n"
-@@ -139,6 +147,14 @@ static inline int __down_read_trylock(struct rw_semaphore *sem)
- "1:\n\t"
- " mov %1,%2\n\t"
- " add %3,%2\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ "sub %3,%2\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- " jle 2f\n\t"
- LOCK_PREFIX " cmpxchg %2,%0\n\t"
- " jnz 1b\n\t"
-@@ -160,6 +176,14 @@ static inline void __down_write_nested(struct rw_semaphore *sem, int subclass)
- tmp = RWSEM_ACTIVE_WRITE_BIAS;
- asm volatile("# beginning down_write\n\t"
- LOCK_PREFIX " xadd %1,(%2)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ "mov %1,(%2)\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- /* subtract 0x0000ffff, returns the old value */
- " test %1,%1\n\t"
- /* was the count 0 before? */
-@@ -198,6 +222,14 @@ static inline void __up_read(struct rw_semaphore *sem)
- rwsem_count_t tmp = -RWSEM_ACTIVE_READ_BIAS;
- asm volatile("# beginning __up_read\n\t"
- LOCK_PREFIX " xadd %1,(%2)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ "mov %1,(%2)\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- /* subtracts 1, returns the old value */
- " jns 1f\n\t"
- " call call_rwsem_wake\n"
-@@ -216,6 +248,14 @@ static inline void __up_write(struct rw_semaphore *sem)
- rwsem_count_t tmp;
- asm volatile("# beginning __up_write\n\t"
- LOCK_PREFIX " xadd %1,(%2)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ "mov %1,(%2)\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- /* tries to transition
- 0xffff0001 -> 0x00000000 */
- " jz 1f\n"
-@@ -234,6 +274,14 @@ static inline void __downgrade_write(struct rw_semaphore *sem)
- {
- asm volatile("# beginning __downgrade_write\n\t"
- LOCK_PREFIX _ASM_ADD "%2,(%1)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX _ASM_SUB "%2,(%1)\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- /*
- * transitions 0xZZZZ0001 -> 0xYYYY0001 (i386)
- * 0xZZZZZZZZ00000001 -> 0xYYYYYYYY00000001 (x86_64)
-@@ -253,7 +301,15 @@ static inline void __downgrade_write(struct rw_semaphore *sem)
- static inline void rwsem_atomic_add(rwsem_count_t delta,
- struct rw_semaphore *sem)
- {
-- asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0"
-+ asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX _ASM_SUB "%1,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- : "+m" (sem->count)
- : "er" (delta));
- }
-@@ -266,7 +322,15 @@ static inline rwsem_count_t rwsem_atomic_update(rwsem_count_t delta,
- {
- rwsem_count_t tmp = delta;
-
-- asm volatile(LOCK_PREFIX "xadd %0,%1"
-+ asm volatile(LOCK_PREFIX "xadd %0,%1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ "mov %0,%1\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- : "+r" (tmp), "+m" (sem->count)
- : : "memory");
-
-diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h
-index 14e0ed8..7f7dd5e 100644
---- a/arch/x86/include/asm/segment.h
-+++ b/arch/x86/include/asm/segment.h
-@@ -62,10 +62,15 @@
- * 26 - ESPFIX small SS
- * 27 - per-cpu [ offset to per-cpu data area ]
- * 28 - stack_canary-20 [ for stack protector ]
-- * 29 - unused
-- * 30 - unused
-+ * 29 - PCI BIOS CS
-+ * 30 - PCI BIOS DS
- * 31 - TSS for double fault handler
- */
-+#define GDT_ENTRY_KERNEXEC_EFI_CS (1)
-+#define GDT_ENTRY_KERNEXEC_EFI_DS (2)
-+#define __KERNEXEC_EFI_CS (GDT_ENTRY_KERNEXEC_EFI_CS*8)
-+#define __KERNEXEC_EFI_DS (GDT_ENTRY_KERNEXEC_EFI_DS*8)
-+
- #define GDT_ENTRY_TLS_MIN 6
- #define GDT_ENTRY_TLS_MAX (GDT_ENTRY_TLS_MIN + GDT_ENTRY_TLS_ENTRIES - 1)
-
-@@ -77,6 +82,8 @@
-
- #define GDT_ENTRY_KERNEL_CS (GDT_ENTRY_KERNEL_BASE + 0)
-
-+#define GDT_ENTRY_KERNEXEC_KERNEL_CS (4)
-+
- #define GDT_ENTRY_KERNEL_DS (GDT_ENTRY_KERNEL_BASE + 1)
-
- #define GDT_ENTRY_TSS (GDT_ENTRY_KERNEL_BASE + 4)
-@@ -88,7 +95,7 @@
- #define GDT_ENTRY_ESPFIX_SS (GDT_ENTRY_KERNEL_BASE + 14)
- #define __ESPFIX_SS (GDT_ENTRY_ESPFIX_SS * 8)
-
--#define GDT_ENTRY_PERCPU (GDT_ENTRY_KERNEL_BASE + 15)
-+#define GDT_ENTRY_PERCPU (GDT_ENTRY_KERNEL_BASE + 15)
- #ifdef CONFIG_SMP
- #define __KERNEL_PERCPU (GDT_ENTRY_PERCPU * 8)
- #else
-@@ -102,6 +109,12 @@
- #define __KERNEL_STACK_CANARY 0
- #endif
-
-+#define GDT_ENTRY_PCIBIOS_CS (GDT_ENTRY_KERNEL_BASE + 17)
-+#define __PCIBIOS_CS (GDT_ENTRY_PCIBIOS_CS * 8)
-+
-+#define GDT_ENTRY_PCIBIOS_DS (GDT_ENTRY_KERNEL_BASE + 18)
-+#define __PCIBIOS_DS (GDT_ENTRY_PCIBIOS_DS * 8)
-+
- #define GDT_ENTRY_DOUBLEFAULT_TSS 31
-
- /*
-@@ -139,7 +152,7 @@
- */
-
- /* Matches PNP_CS32 and PNP_CS16 (they must be consecutive) */
--#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xf4) == GDT_ENTRY_PNPBIOS_BASE * 8)
-+#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xFFFCU) == PNP_CS32 || ((x) & 0xFFFCU) == PNP_CS16)
-
-
- #else
-@@ -163,6 +176,8 @@
- #define __USER32_CS (GDT_ENTRY_DEFAULT_USER32_CS * 8 + 3)
- #define __USER32_DS __USER_DS
-
-+#define GDT_ENTRY_KERNEXEC_KERNEL_CS 7
-+
- #define GDT_ENTRY_TSS 8 /* needs two entries */
- #define GDT_ENTRY_LDT 10 /* needs two entries */
- #define GDT_ENTRY_TLS_MIN 12
-@@ -183,6 +198,7 @@
- #endif
-
- #define __KERNEL_CS (GDT_ENTRY_KERNEL_CS * 8)
-+#define __KERNEXEC_KERNEL_CS (GDT_ENTRY_KERNEXEC_KERNEL_CS * 8)
- #define __KERNEL_DS (GDT_ENTRY_KERNEL_DS * 8)
- #define __USER_DS (GDT_ENTRY_DEFAULT_USER_DS* 8 + 3)
- #define __USER_CS (GDT_ENTRY_DEFAULT_USER_CS* 8 + 3)
-diff --git a/arch/x86/include/asm/smp.h b/arch/x86/include/asm/smp.h
-index 4c2f63c..5685db2 100644
---- a/arch/x86/include/asm/smp.h
-+++ b/arch/x86/include/asm/smp.h
-@@ -24,7 +24,7 @@ extern unsigned int num_processors;
- DECLARE_PER_CPU(cpumask_var_t, cpu_sibling_map);
- DECLARE_PER_CPU(cpumask_var_t, cpu_core_map);
- DECLARE_PER_CPU(u16, cpu_llc_id);
--DECLARE_PER_CPU(int, cpu_number);
-+DECLARE_PER_CPU(unsigned int, cpu_number);
-
- static inline struct cpumask *cpu_sibling_mask(int cpu)
- {
-@@ -40,10 +40,7 @@ DECLARE_EARLY_PER_CPU(u16, x86_cpu_to_apicid);
- DECLARE_EARLY_PER_CPU(u16, x86_bios_cpu_apicid);
-
- /* Static state in head.S used to set up a CPU */
--extern struct {
-- void *sp;
-- unsigned short ss;
--} stack_start;
-+extern unsigned long stack_start; /* Initial stack pointer address */
-
- struct smp_ops {
- void (*smp_prepare_boot_cpu)(void);
-@@ -60,7 +57,7 @@ struct smp_ops {
-
- void (*send_call_func_ipi)(const struct cpumask *mask);
- void (*send_call_func_single_ipi)(int cpu);
--};
-+} __no_const;
-
- /* Globals due to paravirt */
- extern void set_cpu_sibling_map(int cpu);
-@@ -175,14 +172,8 @@ extern unsigned disabled_cpus __cpuinitdata;
- extern int safe_smp_processor_id(void);
-
- #elif defined(CONFIG_X86_64_SMP)
--#define raw_smp_processor_id() (percpu_read(cpu_number))
--
--#define stack_smp_processor_id() \
--({ \
-- struct thread_info *ti; \
-- __asm__("andq %%rsp,%0; ":"=r" (ti) : "0" (CURRENT_MASK)); \
-- ti->cpu; \
--})
-+#define raw_smp_processor_id() (percpu_read(cpu_number))
-+#define stack_smp_processor_id() raw_smp_processor_id()
- #define safe_smp_processor_id() smp_processor_id()
-
- #endif
-diff --git a/arch/x86/include/asm/spinlock.h b/arch/x86/include/asm/spinlock.h
-index 4e77853..4359783 100644
---- a/arch/x86/include/asm/spinlock.h
-+++ b/arch/x86/include/asm/spinlock.h
-@@ -249,6 +249,14 @@ static inline int __raw_write_can_lock(raw_rwlock_t *lock)
- static inline void __raw_read_lock(raw_rwlock_t *rw)
- {
- asm volatile(LOCK_PREFIX " subl $1,(%0)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX " addl $1,(%0)\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- "jns 1f\n"
- "call __read_lock_failed\n\t"
- "1:\n"
-@@ -258,6 +266,14 @@ static inline void __raw_read_lock(raw_rwlock_t *rw)
- static inline void __raw_write_lock(raw_rwlock_t *rw)
- {
- asm volatile(LOCK_PREFIX " subl %1,(%0)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX " addl %1,(%0)\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- "jz 1f\n"
- "call __write_lock_failed\n\t"
- "1:\n"
-@@ -286,12 +302,29 @@ static inline int __raw_write_trylock(raw_rwlock_t *lock)
-
- static inline void __raw_read_unlock(raw_rwlock_t *rw)
- {
-- asm volatile(LOCK_PREFIX "incl %0" :"+m" (rw->lock) : : "memory");
-+ asm volatile(LOCK_PREFIX "incl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "decl %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ :"+m" (rw->lock) : : "memory");
- }
-
- static inline void __raw_write_unlock(raw_rwlock_t *rw)
- {
-- asm volatile(LOCK_PREFIX "addl %1, %0"
-+ asm volatile(LOCK_PREFIX "addl %1, %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "subl %1, %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- : "+m" (rw->lock) : "i" (RW_LOCK_BIAS) : "memory");
- }
-
-diff --git a/arch/x86/include/asm/stackprotector.h b/arch/x86/include/asm/stackprotector.h
-index 1575177..cb23f52 100644
---- a/arch/x86/include/asm/stackprotector.h
-+++ b/arch/x86/include/asm/stackprotector.h
-@@ -48,7 +48,7 @@
- * head_32 for boot CPU and setup_per_cpu_areas() for others.
- */
- #define GDT_STACK_CANARY_INIT \
-- [GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x18),
-+ [GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x17),
-
- /*
- * Initialize the stackprotector canary value.
-@@ -113,7 +113,7 @@ static inline void setup_stack_canary_segment(int cpu)
-
- static inline void load_stack_canary_segment(void)
- {
--#ifdef CONFIG_X86_32
-+#if defined(CONFIG_X86_32) && !defined(CONFIG_PAX_MEMORY_UDEREF)
- asm volatile ("mov %0, %%gs" : : "r" (0));
- #endif
- }
-diff --git a/arch/x86/include/asm/system.h b/arch/x86/include/asm/system.h
-index e0fbf29..858ef4a 100644
---- a/arch/x86/include/asm/system.h
-+++ b/arch/x86/include/asm/system.h
-@@ -132,7 +132,7 @@ do { \
- "thread_return:\n\t" \
- "movq "__percpu_arg([current_task])",%%rsi\n\t" \
- __switch_canary \
-- "movq %P[thread_info](%%rsi),%%r8\n\t" \
-+ "movq "__percpu_arg([thread_info])",%%r8\n\t" \
- "movq %%rax,%%rdi\n\t" \
- "testl %[_tif_fork],%P[ti_flags](%%r8)\n\t" \
- "jnz ret_from_fork\n\t" \
-@@ -143,7 +143,7 @@ do { \
- [threadrsp] "i" (offsetof(struct task_struct, thread.sp)), \
- [ti_flags] "i" (offsetof(struct thread_info, flags)), \
- [_tif_fork] "i" (_TIF_FORK), \
-- [thread_info] "i" (offsetof(struct task_struct, stack)), \
-+ [thread_info] "m" (per_cpu_var(current_tinfo)), \
- [current_task] "m" (per_cpu_var(current_task)) \
- __switch_canary_iparam \
- : "memory", "cc" __EXTRA_CLOBBER)
-@@ -200,7 +200,7 @@ static inline unsigned long get_limit(unsigned long segment)
- {
- unsigned long __limit;
- asm("lsll %1,%0" : "=r" (__limit) : "r" (segment));
-- return __limit + 1;
-+ return __limit;
- }
-
- static inline void native_clts(void)
-@@ -340,12 +340,12 @@ void enable_hlt(void);
-
- void cpu_idle_wait(void);
-
--extern unsigned long arch_align_stack(unsigned long sp);
-+#define arch_align_stack(x) ((x) & ~0xfUL)
- extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
-
- void default_idle(void);
-
--void stop_this_cpu(void *dummy);
-+void stop_this_cpu(void *dummy) __noreturn;
-
- /*
- * Force strict CPU ordering.
-diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h
-index 19c3ce4..4ad5ba4 100644
---- a/arch/x86/include/asm/thread_info.h
-+++ b/arch/x86/include/asm/thread_info.h
-@@ -10,6 +10,7 @@
- #include <linux/compiler.h>
- #include <asm/page.h>
- #include <asm/types.h>
-+#include <asm/percpu.h>
-
- /*
- * low level task data that entry.S needs immediate access to
-@@ -24,7 +25,6 @@ struct exec_domain;
- #include <asm/atomic.h>
-
- struct thread_info {
-- struct task_struct *task; /* main task structure */
- struct exec_domain *exec_domain; /* execution domain */
- __u32 flags; /* low level flags */
- __u32 status; /* thread synchronous flags */
-@@ -34,18 +34,12 @@ struct thread_info {
- mm_segment_t addr_limit;
- struct restart_block restart_block;
- void __user *sysenter_return;
--#ifdef CONFIG_X86_32
-- unsigned long previous_esp; /* ESP of the previous stack in
-- case of nested (IRQ) stacks
-- */
-- __u8 supervisor_stack[0];
--#endif
-+ unsigned long lowest_stack;
- int uaccess_err;
- };
-
--#define INIT_THREAD_INFO(tsk) \
-+#define INIT_THREAD_INFO \
- { \
-- .task = &tsk, \
- .exec_domain = &default_exec_domain, \
- .flags = 0, \
- .cpu = 0, \
-@@ -56,7 +50,7 @@ struct thread_info {
- }, \
- }
-
--#define init_thread_info (init_thread_union.thread_info)
-+#define init_thread_info (init_thread_union.stack)
- #define init_stack (init_thread_union.stack)
-
- #else /* !__ASSEMBLY__ */
-@@ -95,6 +89,7 @@ struct thread_info {
- #define TIF_DS_AREA_MSR 26 /* uses thread_struct.ds_area_msr */
- #define TIF_LAZY_MMU_UPDATES 27 /* task is updating the mmu lazily */
- #define TIF_SYSCALL_TRACEPOINT 28 /* syscall tracepoint instrumentation */
-+#define TIF_GRSEC_SETXID 29 /* update credentials on syscall entry/exit */
-
- #define _TIF_SYSCALL_TRACE (1 << TIF_SYSCALL_TRACE)
- #define _TIF_NOTIFY_RESUME (1 << TIF_NOTIFY_RESUME)
-@@ -117,16 +112,17 @@ struct thread_info {
- #define _TIF_DS_AREA_MSR (1 << TIF_DS_AREA_MSR)
- #define _TIF_LAZY_MMU_UPDATES (1 << TIF_LAZY_MMU_UPDATES)
- #define _TIF_SYSCALL_TRACEPOINT (1 << TIF_SYSCALL_TRACEPOINT)
-+#define _TIF_GRSEC_SETXID (1 << TIF_GRSEC_SETXID)
-
- /* work to do in syscall_trace_enter() */
- #define _TIF_WORK_SYSCALL_ENTRY \
- (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_EMU | _TIF_SYSCALL_AUDIT | \
-- _TIF_SECCOMP | _TIF_SINGLESTEP | _TIF_SYSCALL_TRACEPOINT)
-+ _TIF_SECCOMP | _TIF_SINGLESTEP | _TIF_SYSCALL_TRACEPOINT | _TIF_GRSEC_SETXID)
-
- /* work to do in syscall_trace_leave() */
- #define _TIF_WORK_SYSCALL_EXIT \
- (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | _TIF_SINGLESTEP | \
-- _TIF_SYSCALL_TRACEPOINT)
-+ _TIF_SYSCALL_TRACEPOINT | _TIF_GRSEC_SETXID)
-
- /* work to do on interrupt/exception return */
- #define _TIF_WORK_MASK \
-@@ -136,7 +132,8 @@ struct thread_info {
-
- /* work to do on any return to user space */
- #define _TIF_ALLWORK_MASK \
-- ((0x0000FFFF & ~_TIF_SECCOMP) | _TIF_SYSCALL_TRACEPOINT)
-+ ((0x0000FFFF & ~_TIF_SECCOMP) | _TIF_SYSCALL_TRACEPOINT | \
-+ _TIF_GRSEC_SETXID)
-
- /* Only used for 64 bit */
- #define _TIF_DO_NOTIFY_MASK \
-@@ -163,45 +160,40 @@ struct thread_info {
- #define alloc_thread_info(tsk) \
- ((struct thread_info *)__get_free_pages(THREAD_FLAGS, THREAD_ORDER))
-
--#ifdef CONFIG_X86_32
--
--#define STACK_WARN (THREAD_SIZE/8)
--/*
-- * macros/functions for gaining access to the thread information structure
-- *
-- * preempt_count needs to be 1 initially, until the scheduler is functional.
-- */
--#ifndef __ASSEMBLY__
--
--
--/* how to get the current stack pointer from C */
--register unsigned long current_stack_pointer asm("esp") __used;
--
--/* how to get the thread information struct from C */
--static inline struct thread_info *current_thread_info(void)
--{
-- return (struct thread_info *)
-- (current_stack_pointer & ~(THREAD_SIZE - 1));
--}
--
--#else /* !__ASSEMBLY__ */
--
-+#ifdef __ASSEMBLY__
- /* how to get the thread information struct from ASM */
- #define GET_THREAD_INFO(reg) \
-- movl $-THREAD_SIZE, reg; \
-- andl %esp, reg
-+ mov PER_CPU_VAR(current_tinfo), reg
-
- /* use this one if reg already contains %esp */
--#define GET_THREAD_INFO_WITH_ESP(reg) \
-- andl $-THREAD_SIZE, reg
-+#define GET_THREAD_INFO_WITH_ESP(reg) GET_THREAD_INFO(reg)
-+#else
-+/* how to get the thread information struct from C */
-+DECLARE_PER_CPU(struct thread_info *, current_tinfo);
-+
-+static __always_inline struct thread_info *current_thread_info(void)
-+{
-+ return percpu_read_stable(current_tinfo);
-+}
-+#endif
-+
-+#ifdef CONFIG_X86_32
-+
-+#define STACK_WARN (THREAD_SIZE/8)
-+/*
-+ * macros/functions for gaining access to the thread information structure
-+ *
-+ * preempt_count needs to be 1 initially, until the scheduler is functional.
-+ */
-+#ifndef __ASSEMBLY__
-+
-+/* how to get the current stack pointer from C */
-+register unsigned long current_stack_pointer asm("esp") __used;
-
- #endif
-
- #else /* X86_32 */
-
--#include <asm/percpu.h>
--#define KERNEL_STACK_OFFSET (5*8)
--
- /*
- * macros/functions for gaining access to the thread information structure
- * preempt_count needs to be 1 initially, until the scheduler is functional.
-@@ -209,21 +201,8 @@ static inline struct thread_info *current_thread_info(void)
- #ifndef __ASSEMBLY__
- DECLARE_PER_CPU(unsigned long, kernel_stack);
-
--static inline struct thread_info *current_thread_info(void)
--{
-- struct thread_info *ti;
-- ti = (void *)(percpu_read_stable(kernel_stack) +
-- KERNEL_STACK_OFFSET - THREAD_SIZE);
-- return ti;
--}
--
--#else /* !__ASSEMBLY__ */
--
--/* how to get the thread information struct from ASM */
--#define GET_THREAD_INFO(reg) \
-- movq PER_CPU_VAR(kernel_stack),reg ; \
-- subq $(THREAD_SIZE-KERNEL_STACK_OFFSET),reg
--
-+/* how to get the current stack pointer from C */
-+register unsigned long current_stack_pointer asm("rsp") __used;
- #endif
-
- #endif /* !X86_32 */
-@@ -260,5 +239,16 @@ extern void arch_task_cache_init(void);
- extern void free_thread_info(struct thread_info *ti);
- extern int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src);
- #define arch_task_cache_init arch_task_cache_init
-+
-+#define __HAVE_THREAD_FUNCTIONS
-+#define task_thread_info(task) (&(task)->tinfo)
-+#define task_stack_page(task) ((task)->stack)
-+#define setup_thread_stack(p, org) do {} while (0)
-+#define end_of_stack(p) ((unsigned long *)task_stack_page(p) + 1)
-+
-+#define __HAVE_ARCH_TASK_STRUCT_ALLOCATOR
-+extern struct task_struct *alloc_task_struct(void);
-+extern void free_task_struct(struct task_struct *);
-+
- #endif
- #endif /* _ASM_X86_THREAD_INFO_H */
-diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
-index 61c5874..28d8b16 100644
---- a/arch/x86/include/asm/uaccess.h
-+++ b/arch/x86/include/asm/uaccess.h
-@@ -8,6 +8,7 @@
- #include <linux/thread_info.h>
- #include <linux/prefetch.h>
- #include <linux/string.h>
-+#include <linux/sched.h>
- #include <asm/asm.h>
- #include <asm/page.h>
-
-@@ -29,7 +30,12 @@
-
- #define get_ds() (KERNEL_DS)
- #define get_fs() (current_thread_info()->addr_limit)
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+void __set_fs(mm_segment_t x);
-+void set_fs(mm_segment_t x);
-+#else
- #define set_fs(x) (current_thread_info()->addr_limit = (x))
-+#endif
-
- #define segment_eq(a, b) ((a).seg == (b).seg)
-
-@@ -77,7 +83,33 @@
- * checks that the pointer is in the user space range - after calling
- * this function, memory access functions may still return -EFAULT.
- */
--#define access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
-+#define __access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
-+#define access_ok(type, addr, size) \
-+({ \
-+ long __size = size; \
-+ unsigned long __addr = (unsigned long)addr; \
-+ unsigned long __addr_ao = __addr & PAGE_MASK; \
-+ unsigned long __end_ao = __addr + __size - 1; \
-+ bool __ret_ao = __range_not_ok(__addr, __size) == 0; \
-+ if (__ret_ao && unlikely((__end_ao ^ __addr_ao) & PAGE_MASK)) { \
-+ while(__addr_ao <= __end_ao) { \
-+ char __c_ao; \
-+ __addr_ao += PAGE_SIZE; \
-+ if (__size > PAGE_SIZE) \
-+ cond_resched(); \
-+ if (__get_user(__c_ao, (char __user *)__addr)) \
-+ break; \
-+ if (type != VERIFY_WRITE) { \
-+ __addr = __addr_ao; \
-+ continue; \
-+ } \
-+ if (__put_user(__c_ao, (char __user *)__addr)) \
-+ break; \
-+ __addr = __addr_ao; \
-+ } \
-+ } \
-+ __ret_ao; \
-+})
-
- /*
- * The exception table consists of pairs of addresses: the first is the
-@@ -183,12 +215,20 @@ extern int __get_user_bad(void);
- asm volatile("call __put_user_" #size : "=a" (__ret_pu) \
- : "0" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
-
--
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+#define __copyuser_seg "gs;"
-+#define __COPYUSER_SET_ES "pushl %%gs; popl %%es\n"
-+#define __COPYUSER_RESTORE_ES "pushl %%ss; popl %%es\n"
-+#else
-+#define __copyuser_seg
-+#define __COPYUSER_SET_ES
-+#define __COPYUSER_RESTORE_ES
-+#endif
-
- #ifdef CONFIG_X86_32
- #define __put_user_asm_u64(x, addr, err, errret) \
-- asm volatile("1: movl %%eax,0(%2)\n" \
-- "2: movl %%edx,4(%2)\n" \
-+ asm volatile("1: "__copyuser_seg"movl %%eax,0(%2)\n" \
-+ "2: "__copyuser_seg"movl %%edx,4(%2)\n" \
- "3:\n" \
- ".section .fixup,\"ax\"\n" \
- "4: movl %3,%0\n" \
-@@ -200,8 +240,8 @@ extern int __get_user_bad(void);
- : "A" (x), "r" (addr), "i" (errret), "0" (err))
-
- #define __put_user_asm_ex_u64(x, addr) \
-- asm volatile("1: movl %%eax,0(%1)\n" \
-- "2: movl %%edx,4(%1)\n" \
-+ asm volatile("1: "__copyuser_seg"movl %%eax,0(%1)\n" \
-+ "2: "__copyuser_seg"movl %%edx,4(%1)\n" \
- "3:\n" \
- _ASM_EXTABLE(1b, 2b - 1b) \
- _ASM_EXTABLE(2b, 3b - 2b) \
-@@ -253,7 +293,7 @@ extern void __put_user_8(void);
- __typeof__(*(ptr)) __pu_val; \
- __chk_user_ptr(ptr); \
- might_fault(); \
-- __pu_val = x; \
-+ __pu_val = (x); \
- switch (sizeof(*(ptr))) { \
- case 1: \
- __put_user_x(1, __pu_val, ptr, __ret_pu); \
-@@ -374,7 +414,7 @@ do { \
- } while (0)
-
- #define __get_user_asm(x, addr, err, itype, rtype, ltype, errret) \
-- asm volatile("1: mov"itype" %2,%"rtype"1\n" \
-+ asm volatile("1: "__copyuser_seg"mov"itype" %2,%"rtype"1\n"\
- "2:\n" \
- ".section .fixup,\"ax\"\n" \
- "3: mov %3,%0\n" \
-@@ -382,7 +422,7 @@ do { \
- " jmp 2b\n" \
- ".previous\n" \
- _ASM_EXTABLE(1b, 3b) \
-- : "=r" (err), ltype(x) \
-+ : "=r" (err), ltype (x) \
- : "m" (__m(addr)), "i" (errret), "0" (err))
-
- #define __get_user_size_ex(x, ptr, size) \
-@@ -407,7 +447,7 @@ do { \
- } while (0)
-
- #define __get_user_asm_ex(x, addr, itype, rtype, ltype) \
-- asm volatile("1: mov"itype" %1,%"rtype"0\n" \
-+ asm volatile("1: "__copyuser_seg"mov"itype" %1,%"rtype"0\n"\
- "2:\n" \
- _ASM_EXTABLE(1b, 2b - 1b) \
- : ltype(x) : "m" (__m(addr)))
-@@ -424,13 +464,24 @@ do { \
- int __gu_err; \
- unsigned long __gu_val; \
- __get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT); \
-- (x) = (__force __typeof__(*(ptr)))__gu_val; \
-+ (x) = (__typeof__(*(ptr)))__gu_val; \
- __gu_err; \
- })
-
- /* FIXME: this hack is definitely wrong -AK */
- struct __large_struct { unsigned long buf[100]; };
--#define __m(x) (*(struct __large_struct __user *)(x))
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+#define ____m(x) \
-+({ \
-+ unsigned long ____x = (unsigned long)(x); \
-+ if (____x < PAX_USER_SHADOW_BASE) \
-+ ____x += PAX_USER_SHADOW_BASE; \
-+ (void __user *)____x; \
-+})
-+#else
-+#define ____m(x) (x)
-+#endif
-+#define __m(x) (*(struct __large_struct __user *)____m(x))
-
- /*
- * Tell gcc we read from memory instead of writing: this is because
-@@ -438,7 +489,7 @@ struct __large_struct { unsigned long buf[100]; };
- * aliasing issues.
- */
- #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret) \
-- asm volatile("1: mov"itype" %"rtype"1,%2\n" \
-+ asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"1,%2\n"\
- "2:\n" \
- ".section .fixup,\"ax\"\n" \
- "3: mov %3,%0\n" \
-@@ -446,10 +497,10 @@ struct __large_struct { unsigned long buf[100]; };
- ".previous\n" \
- _ASM_EXTABLE(1b, 3b) \
- : "=r"(err) \
-- : ltype(x), "m" (__m(addr)), "i" (errret), "0" (err))
-+ : ltype (x), "m" (__m(addr)), "i" (errret), "0" (err))
-
- #define __put_user_asm_ex(x, addr, itype, rtype, ltype) \
-- asm volatile("1: mov"itype" %"rtype"0,%1\n" \
-+ asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"0,%1\n"\
- "2:\n" \
- _ASM_EXTABLE(1b, 2b - 1b) \
- : : ltype(x), "m" (__m(addr)))
-@@ -488,8 +539,12 @@ struct __large_struct { unsigned long buf[100]; };
- * On error, the variable @x is set to zero.
- */
-
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+#define __get_user(x, ptr) get_user((x), (ptr))
-+#else
- #define __get_user(x, ptr) \
- __get_user_nocheck((x), (ptr), sizeof(*(ptr)))
-+#endif
-
- /**
- * __put_user: - Write a simple value into user space, with less checking.
-@@ -511,8 +566,12 @@ struct __large_struct { unsigned long buf[100]; };
- * Returns zero on success, or -EFAULT on error.
- */
-
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+#define __put_user(x, ptr) put_user((x), (ptr))
-+#else
- #define __put_user(x, ptr) \
- __put_user_nocheck((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr)))
-+#endif
-
- #define __get_user_unaligned __get_user
- #define __put_user_unaligned __put_user
-@@ -530,7 +589,7 @@ struct __large_struct { unsigned long buf[100]; };
- #define get_user_ex(x, ptr) do { \
- unsigned long __gue_val; \
- __get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr)))); \
-- (x) = (__force __typeof__(*(ptr)))__gue_val; \
-+ (x) = (__typeof__(*(ptr)))__gue_val; \
- } while (0)
-
- #ifdef CONFIG_X86_WP_WORKS_OK
-@@ -567,6 +626,7 @@ extern struct movsl_mask {
-
- #define ARCH_HAS_NOCACHE_UACCESS 1
-
-+#define ARCH_HAS_SORT_EXTABLE
- #ifdef CONFIG_X86_32
- # include "uaccess_32.h"
- #else
-diff --git a/arch/x86/include/asm/uaccess_32.h b/arch/x86/include/asm/uaccess_32.h
-index 632fb44..b284405 100644
---- a/arch/x86/include/asm/uaccess_32.h
-+++ b/arch/x86/include/asm/uaccess_32.h
-@@ -12,15 +12,15 @@
- #include <asm/page.h>
-
- unsigned long __must_check __copy_to_user_ll
-- (void __user *to, const void *from, unsigned long n);
-+ (void __user *to, const void *from, unsigned long n) __size_overflow(3);
- unsigned long __must_check __copy_from_user_ll
-- (void *to, const void __user *from, unsigned long n);
-+ (void *to, const void __user *from, unsigned long n) __size_overflow(3);
- unsigned long __must_check __copy_from_user_ll_nozero
-- (void *to, const void __user *from, unsigned long n);
-+ (void *to, const void __user *from, unsigned long n) __size_overflow(3);
- unsigned long __must_check __copy_from_user_ll_nocache
-- (void *to, const void __user *from, unsigned long n);
-+ (void *to, const void __user *from, unsigned long n) __size_overflow(3);
- unsigned long __must_check __copy_from_user_ll_nocache_nozero
-- (void *to, const void __user *from, unsigned long n);
-+ (void *to, const void __user *from, unsigned long n) __size_overflow(3);
-
- /**
- * __copy_to_user_inatomic: - Copy a block of data into user space, with less checking.
-@@ -44,6 +44,13 @@ unsigned long __must_check __copy_from_user_ll_nocache_nozero
- static __always_inline unsigned long __must_check
- __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
- {
-+ pax_track_stack();
-+
-+ if ((long)n < 0)
-+ return n;
-+
-+ check_object_size(from, n, true);
-+
- if (__builtin_constant_p(n)) {
- unsigned long ret;
-
-@@ -83,12 +90,16 @@ static __always_inline unsigned long __must_check
- __copy_to_user(void __user *to, const void *from, unsigned long n)
- {
- might_fault();
-+
- return __copy_to_user_inatomic(to, from, n);
- }
-
- static __always_inline unsigned long
- __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
- {
-+ if ((long)n < 0)
-+ return n;
-+
- /* Avoid zeroing the tail if the copy fails..
- * If 'n' is constant and 1, 2, or 4, we do still zero on a failure,
- * but as the zeroing behaviour is only significant when n is not
-@@ -138,6 +149,14 @@ static __always_inline unsigned long
- __copy_from_user(void *to, const void __user *from, unsigned long n)
- {
- might_fault();
-+
-+ pax_track_stack();
-+
-+ if ((long)n < 0)
-+ return n;
-+
-+ check_object_size(to, n, false);
-+
- if (__builtin_constant_p(n)) {
- unsigned long ret;
-
-@@ -160,6 +179,10 @@ static __always_inline unsigned long __copy_from_user_nocache(void *to,
- const void __user *from, unsigned long n)
- {
- might_fault();
-+
-+ if ((long)n < 0)
-+ return n;
-+
- if (__builtin_constant_p(n)) {
- unsigned long ret;
-
-@@ -182,14 +205,72 @@ static __always_inline unsigned long
- __copy_from_user_inatomic_nocache(void *to, const void __user *from,
- unsigned long n)
- {
-- return __copy_from_user_ll_nocache_nozero(to, from, n);
-+ if ((long)n < 0)
-+ return n;
-+
-+ return __copy_from_user_ll_nocache_nozero(to, from, n);
-+}
-+
-+extern void copy_to_user_overflow(void) __compiletime_warning("copy_to_user() buffer size is not provably correct");
-+extern void copy_from_user_overflow(void) __compiletime_warning("copy_from_user() buffer size is not provably correct");
-+
-+/**
-+ * copy_to_user: - Copy a block of data into user space.
-+ * @to: Destination address, in user space.
-+ * @from: Source address, in kernel space.
-+ * @n: Number of bytes to copy.
-+ *
-+ * Context: User context only. This function may sleep.
-+ *
-+ * Copy data from kernel space to user space.
-+ *
-+ * Returns number of bytes that could not be copied.
-+ * On success, this will be zero.
-+ */
-+static __always_inline unsigned long __must_check
-+copy_to_user(void __user *to, const void *from, unsigned long n)
-+{
-+ size_t sz = __compiletime_object_size(from);
-+
-+ if (unlikely(sz != (size_t)-1 && sz < n))
-+ copy_to_user_overflow();
-+ else if (access_ok(VERIFY_WRITE, to, n))
-+ n = __copy_to_user(to, from, n);
-+ return n;
-+}
-+
-+/**
-+ * copy_from_user: - Copy a block of data from user space.
-+ * @to: Destination address, in kernel space.
-+ * @from: Source address, in user space.
-+ * @n: Number of bytes to copy.
-+ *
-+ * Context: User context only. This function may sleep.
-+ *
-+ * Copy data from user space to kernel space.
-+ *
-+ * Returns number of bytes that could not be copied.
-+ * On success, this will be zero.
-+ *
-+ * If some data could not be copied, this function will pad the copied
-+ * data to the requested size using zero bytes.
-+ */
-+static __always_inline unsigned long __must_check
-+copy_from_user(void *to, const void __user *from, unsigned long n)
-+{
-+ size_t sz = __compiletime_object_size(to);
-+
-+ check_object_size(to, n, false);
-+
-+ if (unlikely(sz != (size_t)-1 && sz < n))
-+ copy_from_user_overflow();
-+ else if (access_ok(VERIFY_READ, from, n))
-+ n = __copy_from_user(to, from, n);
-+ else if ((long)n > 0)
-+ memset(to, 0, n);
-+ return n;
- }
-
--unsigned long __must_check copy_to_user(void __user *to,
-- const void *from, unsigned long n);
--unsigned long __must_check copy_from_user(void *to,
-- const void __user *from,
-- unsigned long n);
- long __must_check strncpy_from_user(char *dst, const char __user *src,
- long count);
- long __must_check __strncpy_from_user(char *dst,
-@@ -212,7 +293,7 @@ long __must_check __strncpy_from_user(char *dst,
- #define strlen_user(str) strnlen_user(str, LONG_MAX)
-
- long strnlen_user(const char __user *str, long n);
--unsigned long __must_check clear_user(void __user *mem, unsigned long len);
--unsigned long __must_check __clear_user(void __user *mem, unsigned long len);
-+unsigned long __must_check clear_user(void __user *mem, unsigned long len) __size_overflow(2);
-+unsigned long __must_check __clear_user(void __user *mem, unsigned long len) __size_overflow(2);
-
- #endif /* _ASM_X86_UACCESS_32_H */
-diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h
-index db24b21..9fa9f18 100644
---- a/arch/x86/include/asm/uaccess_64.h
-+++ b/arch/x86/include/asm/uaccess_64.h
-@@ -9,6 +9,9 @@
- #include <linux/prefetch.h>
- #include <linux/lockdep.h>
- #include <asm/page.h>
-+#include <asm/pgtable.h>
-+
-+#define set_fs(x) (current_thread_info()->addr_limit = (x))
-
- /*
- * Copy To/From Userspace
-@@ -16,116 +19,187 @@
-
- /* Handles exceptions in both to and from, but doesn't do access_ok */
- __must_check unsigned long
--copy_user_generic(void *to, const void *from, unsigned len);
-+copy_user_generic(void *to, const void *from, unsigned long len) __size_overflow(3);
-
- __must_check unsigned long
--copy_to_user(void __user *to, const void *from, unsigned len);
--__must_check unsigned long
--copy_from_user(void *to, const void __user *from, unsigned len);
--__must_check unsigned long
--copy_in_user(void __user *to, const void __user *from, unsigned len);
-+copy_in_user(void __user *to, const void __user *from, unsigned long len);
-+
-+extern void copy_to_user_overflow(void) __compiletime_warning("copy_to_user() buffer size is not provably correct");
-+extern void copy_from_user_overflow(void) __compiletime_warning("copy_from_user() buffer size is not provably correct");
-
- static __always_inline __must_check
--int __copy_from_user(void *dst, const void __user *src, unsigned size)
-+unsigned long __copy_from_user(void *dst, const void __user *src, unsigned long size)
- {
-- int ret = 0;
-+ size_t sz = __compiletime_object_size(dst);
-+ unsigned ret = 0;
-
- might_fault();
-- if (!__builtin_constant_p(size))
-- return copy_user_generic(dst, (__force void *)src, size);
-+
-+ if (size > INT_MAX)
-+ return size;
-+
-+ check_object_size(dst, size, false);
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ if (!__access_ok(VERIFY_READ, src, size))
-+ return size;
-+#endif
-+
-+ if (unlikely(sz != (size_t)-1 && sz < size)) {
-+ copy_from_user_overflow();
-+ return size;
-+ }
-+
-+ if (!__builtin_constant_p(size)) {
-+ return copy_user_generic(dst, (__force_kernel const void *)____m(src), size);
-+ }
- switch (size) {
-- case 1:__get_user_asm(*(u8 *)dst, (u8 __user *)src,
-+ case 1:__get_user_asm(*(u8 *)dst, (const u8 __user *)src,
- ret, "b", "b", "=q", 1);
- return ret;
-- case 2:__get_user_asm(*(u16 *)dst, (u16 __user *)src,
-+ case 2:__get_user_asm(*(u16 *)dst, (const u16 __user *)src,
- ret, "w", "w", "=r", 2);
- return ret;
-- case 4:__get_user_asm(*(u32 *)dst, (u32 __user *)src,
-+ case 4:__get_user_asm(*(u32 *)dst, (const u32 __user *)src,
- ret, "l", "k", "=r", 4);
- return ret;
-- case 8:__get_user_asm(*(u64 *)dst, (u64 __user *)src,
-+ case 8:__get_user_asm(*(u64 *)dst, (const u64 __user *)src,
- ret, "q", "", "=r", 8);
- return ret;
- case 10:
-- __get_user_asm(*(u64 *)dst, (u64 __user *)src,
-+ __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
- ret, "q", "", "=r", 10);
- if (unlikely(ret))
- return ret;
- __get_user_asm(*(u16 *)(8 + (char *)dst),
-- (u16 __user *)(8 + (char __user *)src),
-+ (const u16 __user *)(8 + (const char __user *)src),
- ret, "w", "w", "=r", 2);
- return ret;
- case 16:
-- __get_user_asm(*(u64 *)dst, (u64 __user *)src,
-+ __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
- ret, "q", "", "=r", 16);
- if (unlikely(ret))
- return ret;
- __get_user_asm(*(u64 *)(8 + (char *)dst),
-- (u64 __user *)(8 + (char __user *)src),
-+ (const u64 __user *)(8 + (const char __user *)src),
- ret, "q", "", "=r", 8);
- return ret;
- default:
-- return copy_user_generic(dst, (__force void *)src, size);
-+ return copy_user_generic(dst, (__force_kernel const void *)____m(src), size);
- }
- }
-
- static __always_inline __must_check
--int __copy_to_user(void __user *dst, const void *src, unsigned size)
-+unsigned long __copy_to_user(void __user *dst, const void *src, unsigned long size)
- {
-- int ret = 0;
-+ size_t sz = __compiletime_object_size(dst);
-+ unsigned ret = 0;
-
- might_fault();
-+
-+ pax_track_stack();
-+
-+ if (size > INT_MAX)
-+ return size;
-+
-+ check_object_size(src, size, true);
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ if (!__access_ok(VERIFY_WRITE, dst, size))
-+ return size;
-+#endif
-+
-+ if (unlikely(sz != (size_t)-1 && sz < size)) {
-+ copy_to_user_overflow();
-+ return size;
-+ }
-+
- if (!__builtin_constant_p(size))
-- return copy_user_generic((__force void *)dst, src, size);
-+ return copy_user_generic((__force_kernel void *)____m(dst), src, size);
- switch (size) {
-- case 1:__put_user_asm(*(u8 *)src, (u8 __user *)dst,
-+ case 1:__put_user_asm(*(const u8 *)src, (u8 __user *)dst,
- ret, "b", "b", "iq", 1);
- return ret;
-- case 2:__put_user_asm(*(u16 *)src, (u16 __user *)dst,
-+ case 2:__put_user_asm(*(const u16 *)src, (u16 __user *)dst,
- ret, "w", "w", "ir", 2);
- return ret;
-- case 4:__put_user_asm(*(u32 *)src, (u32 __user *)dst,
-+ case 4:__put_user_asm(*(const u32 *)src, (u32 __user *)dst,
- ret, "l", "k", "ir", 4);
- return ret;
-- case 8:__put_user_asm(*(u64 *)src, (u64 __user *)dst,
-+ case 8:__put_user_asm(*(const u64 *)src, (u64 __user *)dst,
- ret, "q", "", "er", 8);
- return ret;
- case 10:
-- __put_user_asm(*(u64 *)src, (u64 __user *)dst,
-+ __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
- ret, "q", "", "er", 10);
- if (unlikely(ret))
- return ret;
- asm("":::"memory");
-- __put_user_asm(4[(u16 *)src], 4 + (u16 __user *)dst,
-+ __put_user_asm(4[(const u16 *)src], 4 + (u16 __user *)dst,
- ret, "w", "w", "ir", 2);
- return ret;
- case 16:
-- __put_user_asm(*(u64 *)src, (u64 __user *)dst,
-+ __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
- ret, "q", "", "er", 16);
- if (unlikely(ret))
- return ret;
- asm("":::"memory");
-- __put_user_asm(1[(u64 *)src], 1 + (u64 __user *)dst,
-+ __put_user_asm(1[(const u64 *)src], 1 + (u64 __user *)dst,
- ret, "q", "", "er", 8);
- return ret;
- default:
-- return copy_user_generic((__force void *)dst, src, size);
-+ return copy_user_generic((__force_kernel void *)____m(dst), src, size);
- }
- }
-
- static __always_inline __must_check
--int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
-+unsigned long copy_to_user(void __user *to, const void *from, unsigned long len)
- {
-- int ret = 0;
-+ if (access_ok(VERIFY_WRITE, to, len))
-+ len = __copy_to_user(to, from, len);
-+ return len;
-+}
-
-+static __always_inline __must_check
-+unsigned long copy_from_user(void *to, const void __user *from, unsigned long len)
-+{
- might_fault();
-+
-+ check_object_size(to, len, false);
-+
-+ if (access_ok(VERIFY_READ, from, len))
-+ len = __copy_from_user(to, from, len);
-+ else if (len < INT_MAX)
-+ memset(to, 0, len);
-+ return len;
-+}
-+
-+static __always_inline __must_check
-+unsigned long __copy_in_user(void __user *dst, const void __user *src, unsigned long size)
-+{
-+ unsigned ret = 0;
-+
-+ might_fault();
-+
-+ pax_track_stack();
-+
-+ if (size > INT_MAX)
-+ return size;
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ if (!__access_ok(VERIFY_READ, src, size))
-+ return size;
-+ if (!__access_ok(VERIFY_WRITE, dst, size))
-+ return size;
-+#endif
-+
- if (!__builtin_constant_p(size))
-- return copy_user_generic((__force void *)dst,
-- (__force void *)src, size);
-+ return copy_user_generic((__force_kernel void *)____m(dst),
-+ (__force_kernel const void *)____m(src), size);
- switch (size) {
- case 1: {
- u8 tmp;
-- __get_user_asm(tmp, (u8 __user *)src,
-+ __get_user_asm(tmp, (const u8 __user *)src,
- ret, "b", "b", "=q", 1);
- if (likely(!ret))
- __put_user_asm(tmp, (u8 __user *)dst,
-@@ -134,7 +208,7 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
- }
- case 2: {
- u16 tmp;
-- __get_user_asm(tmp, (u16 __user *)src,
-+ __get_user_asm(tmp, (const u16 __user *)src,
- ret, "w", "w", "=r", 2);
- if (likely(!ret))
- __put_user_asm(tmp, (u16 __user *)dst,
-@@ -144,7 +218,7 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
-
- case 4: {
- u32 tmp;
-- __get_user_asm(tmp, (u32 __user *)src,
-+ __get_user_asm(tmp, (const u32 __user *)src,
- ret, "l", "k", "=r", 4);
- if (likely(!ret))
- __put_user_asm(tmp, (u32 __user *)dst,
-@@ -153,7 +227,7 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
- }
- case 8: {
- u64 tmp;
-- __get_user_asm(tmp, (u64 __user *)src,
-+ __get_user_asm(tmp, (const u64 __user *)src,
- ret, "q", "", "=r", 8);
- if (likely(!ret))
- __put_user_asm(tmp, (u64 __user *)dst,
-@@ -161,8 +235,8 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
- return ret;
- }
- default:
-- return copy_user_generic((__force void *)dst,
-- (__force void *)src, size);
-+ return copy_user_generic((__force_kernel void *)____m(dst),
-+ (__force_kernel const void *)____m(src), size);
- }
- }
-
-@@ -173,36 +247,62 @@ __strncpy_from_user(char *dst, const char __user *src, long count);
- __must_check long strnlen_user(const char __user *str, long n);
- __must_check long __strnlen_user(const char __user *str, long n);
- __must_check long strlen_user(const char __user *str);
--__must_check unsigned long clear_user(void __user *mem, unsigned long len);
--__must_check unsigned long __clear_user(void __user *mem, unsigned long len);
-+__must_check unsigned long clear_user(void __user *mem, unsigned long len) __size_overflow(2);
-+__must_check unsigned long __clear_user(void __user *mem, unsigned long len) __size_overflow(2);
-
--__must_check long __copy_from_user_inatomic(void *dst, const void __user *src,
-- unsigned size);
-+static __must_check __always_inline unsigned long
-+__copy_from_user_inatomic(void *dst, const void __user *src, unsigned long size)
-+{
-+ pax_track_stack();
-+
-+ if (size > INT_MAX)
-+ return size;
-
--static __must_check __always_inline int
--__copy_to_user_inatomic(void __user *dst, const void *src, unsigned size)
-+ return copy_user_generic(dst, (__force_kernel const void *)____m(src), size);
-+}
-+
-+static __must_check __always_inline unsigned long
-+__copy_to_user_inatomic(void __user *dst, const void *src, unsigned long size)
- {
-- return copy_user_generic((__force void *)dst, src, size);
-+ if (size > INT_MAX)
-+ return size;
-+
-+ return copy_user_generic((__force_kernel void *)____m(dst), src, size);
- }
-
--extern long __copy_user_nocache(void *dst, const void __user *src,
-- unsigned size, int zerorest);
-+extern unsigned long __copy_user_nocache(void *dst, const void __user *src,
-+ unsigned long size, int zerorest) __size_overflow(3);
-
--static inline int
--__copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
-+static inline unsigned long __copy_from_user_nocache(void *dst, const void __user *src, unsigned long size)
- {
- might_sleep();
-+
-+ if (size > INT_MAX)
-+ return size;
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ if (!__access_ok(VERIFY_READ, src, size))
-+ return size;
-+#endif
-+
- return __copy_user_nocache(dst, src, size, 1);
- }
-
--static inline int
--__copy_from_user_inatomic_nocache(void *dst, const void __user *src,
-- unsigned size)
-+static inline unsigned long __copy_from_user_inatomic_nocache(void *dst, const void __user *src,
-+ unsigned long size)
- {
-+ if (size > INT_MAX)
-+ return size;
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ if (!__access_ok(VERIFY_READ, src, size))
-+ return size;
-+#endif
-+
- return __copy_user_nocache(dst, src, size, 0);
- }
-
--unsigned long
--copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest);
-+extern unsigned long
-+copy_user_handle_tail(char __user *to, char __user *from, unsigned long len, unsigned zerorest) __size_overflow(3);
-
- #endif /* _ASM_X86_UACCESS_64_H */
-diff --git a/arch/x86/include/asm/vdso.h b/arch/x86/include/asm/vdso.h
-index 9064052..786cfbc 100644
---- a/arch/x86/include/asm/vdso.h
-+++ b/arch/x86/include/asm/vdso.h
-@@ -25,7 +25,7 @@ extern const char VDSO32_PRELINK[];
- #define VDSO32_SYMBOL(base, name) \
- ({ \
- extern const char VDSO32_##name[]; \
-- (void *)(VDSO32_##name - VDSO32_PRELINK + (unsigned long)(base)); \
-+ (void __user *)(VDSO32_##name - VDSO32_PRELINK + (unsigned long)(base)); \
- })
- #endif
-
-diff --git a/arch/x86/include/asm/vgtod.h b/arch/x86/include/asm/vgtod.h
-index 3d61e20..9507180 100644
---- a/arch/x86/include/asm/vgtod.h
-+++ b/arch/x86/include/asm/vgtod.h
-@@ -14,6 +14,7 @@ struct vsyscall_gtod_data {
- int sysctl_enabled;
- struct timezone sys_tz;
- struct { /* extract of a clocksource struct */
-+ char name[8];
- cycle_t (*vread)(void);
- cycle_t cycle_last;
- cycle_t mask;
-diff --git a/arch/x86/include/asm/vmi.h b/arch/x86/include/asm/vmi.h
-index 61e08c0..b0da582 100644
---- a/arch/x86/include/asm/vmi.h
-+++ b/arch/x86/include/asm/vmi.h
-@@ -191,6 +191,7 @@ struct vrom_header {
- u8 reserved[96]; /* Reserved for headers */
- char vmi_init[8]; /* VMI_Init jump point */
- char get_reloc[8]; /* VMI_GetRelocationInfo jump point */
-+ char rom_data[8048]; /* rest of the option ROM */
- } __attribute__((packed));
-
- struct pnp_header {
-diff --git a/arch/x86/include/asm/vmi_time.h b/arch/x86/include/asm/vmi_time.h
-index c6e0bee..fcb9f74 100644
---- a/arch/x86/include/asm/vmi_time.h
-+++ b/arch/x86/include/asm/vmi_time.h
-@@ -43,7 +43,7 @@ extern struct vmi_timer_ops {
- int (*wallclock_updated)(void);
- void (*set_alarm)(u32 flags, u64 expiry, u64 period);
- void (*cancel_alarm)(u32 flags);
--} vmi_timer_ops;
-+} __no_const vmi_timer_ops;
-
- /* Prototypes */
- extern void __init vmi_time_init(void);
-diff --git a/arch/x86/include/asm/vsyscall.h b/arch/x86/include/asm/vsyscall.h
-index d0983d2..1f7c9e9 100644
---- a/arch/x86/include/asm/vsyscall.h
-+++ b/arch/x86/include/asm/vsyscall.h
-@@ -15,9 +15,10 @@ enum vsyscall_num {
-
- #ifdef __KERNEL__
- #include <linux/seqlock.h>
-+#include <linux/getcpu.h>
-+#include <linux/time.h>
-
- #define __section_vgetcpu_mode __attribute__ ((unused, __section__ (".vgetcpu_mode"), aligned(16)))
--#define __section_jiffies __attribute__ ((unused, __section__ (".jiffies"), aligned(16)))
-
- /* Definitions for CONFIG_GENERIC_TIME definitions */
- #define __section_vsyscall_gtod_data __attribute__ \
-@@ -31,7 +32,6 @@ enum vsyscall_num {
- #define VGETCPU_LSL 2
-
- extern int __vgetcpu_mode;
--extern volatile unsigned long __jiffies;
-
- /* kernel space (writeable) */
- extern int vgetcpu_mode;
-@@ -39,6 +39,9 @@ extern struct timezone sys_tz;
-
- extern void map_vsyscall(void);
-
-+extern int vgettimeofday(struct timeval * tv, struct timezone * tz);
-+extern time_t vtime(time_t *t);
-+extern long vgetcpu(unsigned *cpu, unsigned *node, struct getcpu_cache *tcache);
- #endif /* __KERNEL__ */
-
- #endif /* _ASM_X86_VSYSCALL_H */
-diff --git a/arch/x86/include/asm/x86_init.h b/arch/x86/include/asm/x86_init.h
-index 2c756fd..062473d 100644
---- a/arch/x86/include/asm/x86_init.h
-+++ b/arch/x86/include/asm/x86_init.h
-@@ -88,7 +88,7 @@ struct x86_init_timers {
- void (*setup_percpu_clockev)(void);
- void (*tsc_pre_init)(void);
- void (*timer_init)(void);
--};
-+} __no_const;
-
- /**
- * struct x86_init_ops - functions for platform specific setup
-@@ -101,7 +101,7 @@ struct x86_init_ops {
- struct x86_init_oem oem;
- struct x86_init_paging paging;
- struct x86_init_timers timers;
--};
-+} __no_const;
-
- /**
- * struct x86_cpuinit_ops - platform specific cpu hotplug setups
-@@ -109,7 +109,7 @@ struct x86_init_ops {
- */
- struct x86_cpuinit_ops {
- void (*setup_percpu_clockev)(void);
--};
-+} __no_const;
-
- /**
- * struct x86_platform_ops - platform specific runtime functions
-@@ -121,7 +121,7 @@ struct x86_platform_ops {
- unsigned long (*calibrate_tsc)(void);
- unsigned long (*get_wallclock)(void);
- int (*set_wallclock)(unsigned long nowtime);
--};
-+} __no_const;
-
- extern struct x86_init_ops x86_init;
- extern struct x86_cpuinit_ops x86_cpuinit;
-diff --git a/arch/x86/include/asm/xsave.h b/arch/x86/include/asm/xsave.h
-index 727acc1..52c9e4c 100644
---- a/arch/x86/include/asm/xsave.h
-+++ b/arch/x86/include/asm/xsave.h
-@@ -56,7 +56,12 @@ static inline int xrstor_checking(struct xsave_struct *fx)
- static inline int xsave_user(struct xsave_struct __user *buf)
- {
- int err;
-- __asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x27\n"
-+
-+ buf = (struct xsave_struct __user *)____m(buf);
-+
-+ __asm__ __volatile__("1:"
-+ __copyuser_seg
-+ ".byte " REX_PREFIX "0x0f,0xae,0x27\n"
- "2:\n"
- ".section .fixup,\"ax\"\n"
- "3: movl $-1,%[err]\n"
-@@ -78,11 +83,13 @@ static inline int xsave_user(struct xsave_struct __user *buf)
- static inline int xrestore_user(struct xsave_struct __user *buf, u64 mask)
- {
- int err;
-- struct xsave_struct *xstate = ((__force struct xsave_struct *)buf);
-+ struct xsave_struct *xstate = ((__force_kernel struct xsave_struct *)____m(buf));
- u32 lmask = mask;
- u32 hmask = mask >> 32;
-
-- __asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x2f\n"
-+ __asm__ __volatile__("1:"
-+ __copyuser_seg
-+ ".byte " REX_PREFIX "0x0f,0xae,0x2f\n"
- "2:\n"
- ".section .fixup,\"ax\"\n"
- "3: movl $-1,%[err]\n"
-diff --git a/arch/x86/kernel/acpi/realmode/Makefile b/arch/x86/kernel/acpi/realmode/Makefile
-index 6a564ac..3f3a3d7 100644
---- a/arch/x86/kernel/acpi/realmode/Makefile
-+++ b/arch/x86/kernel/acpi/realmode/Makefile
-@@ -41,6 +41,9 @@ KBUILD_CFLAGS := $(LINUXINCLUDE) -g -Os -D_SETUP -D_WAKEUP -D__KERNEL__ \
- $(call cc-option, -fno-stack-protector) \
- $(call cc-option, -mpreferred-stack-boundary=2)
- KBUILD_CFLAGS += $(call cc-option, -m32)
-+ifdef CONSTIFY_PLUGIN
-+KBUILD_CFLAGS += -fplugin-arg-constify_plugin-no-constify
-+endif
- KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
- GCOV_PROFILE := n
-
-diff --git a/arch/x86/kernel/acpi/realmode/wakeup.S b/arch/x86/kernel/acpi/realmode/wakeup.S
-index 580b4e2..d4129e4 100644
---- a/arch/x86/kernel/acpi/realmode/wakeup.S
-+++ b/arch/x86/kernel/acpi/realmode/wakeup.S
-@@ -91,6 +91,9 @@ _start:
- /* Do any other stuff... */
-
- #ifndef CONFIG_64BIT
-+ /* Recheck NX bit overrides (64bit path does this in trampoline) */
-+ call verify_cpu
-+
- /* This could also be done in C code... */
- movl pmode_cr3, %eax
- movl %eax, %cr3
-@@ -104,7 +107,7 @@ _start:
- movl %eax, %ecx
- orl %edx, %ecx
- jz 1f
-- movl $0xc0000080, %ecx
-+ mov $MSR_EFER, %ecx
- wrmsr
- 1:
-
-@@ -114,6 +117,7 @@ _start:
- movl pmode_cr0, %eax
- movl %eax, %cr0
- jmp pmode_return
-+# include "../../verify_cpu.S"
- #else
- pushw $0
- pushw trampoline_segment
-diff --git a/arch/x86/kernel/acpi/sleep.c b/arch/x86/kernel/acpi/sleep.c
-index ca93638..7042f24 100644
---- a/arch/x86/kernel/acpi/sleep.c
-+++ b/arch/x86/kernel/acpi/sleep.c
-@@ -11,11 +11,12 @@
- #include <linux/cpumask.h>
- #include <asm/segment.h>
- #include <asm/desc.h>
-+#include <asm/e820.h>
-
- #include "realmode/wakeup.h"
- #include "sleep.h"
-
--unsigned long acpi_wakeup_address;
-+unsigned long acpi_wakeup_address = 0x2000;
- unsigned long acpi_realmode_flags;
-
- /* address in low memory of the wakeup routine. */
-@@ -98,9 +99,13 @@ int acpi_save_state_mem(void)
- #else /* CONFIG_64BIT */
- header->trampoline_segment = setup_trampoline() >> 4;
- #ifdef CONFIG_SMP
-- stack_start.sp = temp_stack + sizeof(temp_stack);
-+ stack_start = (unsigned long)temp_stack + sizeof(temp_stack);
-+
-+ pax_open_kernel();
- early_gdt_descr.address =
- (unsigned long)get_cpu_gdt_table(smp_processor_id());
-+ pax_close_kernel();
-+
- initial_gs = per_cpu_offset(smp_processor_id());
- #endif
- initial_code = (unsigned long)wakeup_long64;
-@@ -134,14 +139,8 @@ void __init acpi_reserve_bootmem(void)
- return;
- }
-
-- acpi_realmode = (unsigned long)alloc_bootmem_low(WAKEUP_SIZE);
--
-- if (!acpi_realmode) {
-- printk(KERN_ERR "ACPI: Cannot allocate lowmem, S3 disabled.\n");
-- return;
-- }
--
-- acpi_wakeup_address = virt_to_phys((void *)acpi_realmode);
-+ reserve_early(acpi_wakeup_address, acpi_wakeup_address + WAKEUP_SIZE, "ACPI Wakeup Code");
-+ acpi_realmode = (unsigned long)__va(acpi_wakeup_address);;
- }
-
-
-diff --git a/arch/x86/kernel/acpi/wakeup_32.S b/arch/x86/kernel/acpi/wakeup_32.S
-index 8ded418..079961e 100644
---- a/arch/x86/kernel/acpi/wakeup_32.S
-+++ b/arch/x86/kernel/acpi/wakeup_32.S
-@@ -30,13 +30,11 @@ wakeup_pmode_return:
- # and restore the stack ... but you need gdt for this to work
- movl saved_context_esp, %esp
-
-- movl %cs:saved_magic, %eax
-- cmpl $0x12345678, %eax
-+ cmpl $0x12345678, saved_magic
- jne bogus_magic
-
- # jump to place where we left off
-- movl saved_eip, %eax
-- jmp *%eax
-+ jmp *(saved_eip)
-
- bogus_magic:
- jmp bogus_magic
-diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
-index de7353c..075da5f 100644
---- a/arch/x86/kernel/alternative.c
-+++ b/arch/x86/kernel/alternative.c
-@@ -407,7 +407,7 @@ void __init_or_module apply_paravirt(struct paravirt_patch_site *start,
-
- BUG_ON(p->len > MAX_PATCH_LEN);
- /* prep the buffer with the original instructions */
-- memcpy(insnbuf, p->instr, p->len);
-+ memcpy(insnbuf, ktla_ktva(p->instr), p->len);
- used = pv_init_ops.patch(p->instrtype, p->clobbers, insnbuf,
- (unsigned long)p->instr, p->len);
-
-@@ -475,7 +475,7 @@ void __init alternative_instructions(void)
- if (smp_alt_once)
- free_init_pages("SMP alternatives",
- (unsigned long)__smp_locks,
-- (unsigned long)__smp_locks_end);
-+ PAGE_ALIGN((unsigned long)__smp_locks_end));
-
- restart_nmi();
- }
-@@ -492,13 +492,17 @@ void __init alternative_instructions(void)
- * instructions. And on the local CPU you need to be protected again NMI or MCE
- * handlers seeing an inconsistent instruction while you patch.
- */
--static void *__init_or_module text_poke_early(void *addr, const void *opcode,
-+static void *__kprobes text_poke_early(void *addr, const void *opcode,
- size_t len)
- {
- unsigned long flags;
- local_irq_save(flags);
-- memcpy(addr, opcode, len);
-+
-+ pax_open_kernel();
-+ memcpy(ktla_ktva(addr), opcode, len);
- sync_core();
-+ pax_close_kernel();
-+
- local_irq_restore(flags);
- /* Could also do a CLFLUSH here to speed up CPU recovery; but
- that causes hangs on some VIA CPUs. */
-@@ -520,35 +524,21 @@ static void *__init_or_module text_poke_early(void *addr, const void *opcode,
- */
- void *__kprobes text_poke(void *addr, const void *opcode, size_t len)
- {
-- unsigned long flags;
-- char *vaddr;
-+ unsigned char *vaddr = ktla_ktva(addr);
- struct page *pages[2];
-- int i;
-+ size_t i;
-
- if (!core_kernel_text((unsigned long)addr)) {
-- pages[0] = vmalloc_to_page(addr);
-- pages[1] = vmalloc_to_page(addr + PAGE_SIZE);
-+ pages[0] = vmalloc_to_page(vaddr);
-+ pages[1] = vmalloc_to_page(vaddr + PAGE_SIZE);
- } else {
-- pages[0] = virt_to_page(addr);
-+ pages[0] = virt_to_page(vaddr);
- WARN_ON(!PageReserved(pages[0]));
-- pages[1] = virt_to_page(addr + PAGE_SIZE);
-+ pages[1] = virt_to_page(vaddr + PAGE_SIZE);
- }
- BUG_ON(!pages[0]);
-- local_irq_save(flags);
-- set_fixmap(FIX_TEXT_POKE0, page_to_phys(pages[0]));
-- if (pages[1])
-- set_fixmap(FIX_TEXT_POKE1, page_to_phys(pages[1]));
-- vaddr = (char *)fix_to_virt(FIX_TEXT_POKE0);
-- memcpy(&vaddr[(unsigned long)addr & ~PAGE_MASK], opcode, len);
-- clear_fixmap(FIX_TEXT_POKE0);
-- if (pages[1])
-- clear_fixmap(FIX_TEXT_POKE1);
-- local_flush_tlb();
-- sync_core();
-- /* Could also do a CLFLUSH here to speed up CPU recovery; but
-- that causes hangs on some VIA CPUs. */
-+ text_poke_early(addr, opcode, len);
- for (i = 0; i < len; i++)
-- BUG_ON(((char *)addr)[i] != ((char *)opcode)[i]);
-- local_irq_restore(flags);
-+ BUG_ON((vaddr)[i] != ((const unsigned char *)opcode)[i]);
- return addr;
- }
-diff --git a/arch/x86/kernel/amd_iommu.c b/arch/x86/kernel/amd_iommu.c
-index 3a44b75..1601800 100644
---- a/arch/x86/kernel/amd_iommu.c
-+++ b/arch/x86/kernel/amd_iommu.c
-@@ -2076,7 +2076,7 @@ static void prealloc_protection_domains(void)
- }
- }
-
--static struct dma_map_ops amd_iommu_dma_ops = {
-+static const struct dma_map_ops amd_iommu_dma_ops = {
- .alloc_coherent = alloc_coherent,
- .free_coherent = free_coherent,
- .map_page = map_page,
-diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
-index 1d2d670..8e3f477 100644
---- a/arch/x86/kernel/apic/apic.c
-+++ b/arch/x86/kernel/apic/apic.c
-@@ -170,7 +170,7 @@ int first_system_vector = 0xfe;
- /*
- * Debug level, exported for io_apic.c
- */
--unsigned int apic_verbosity;
-+int apic_verbosity;
-
- int pic_mode;
-
-@@ -1794,7 +1794,7 @@ void smp_error_interrupt(struct pt_regs *regs)
- apic_write(APIC_ESR, 0);
- v1 = apic_read(APIC_ESR);
- ack_APIC_irq();
-- atomic_inc(&irq_err_count);
-+ atomic_inc_unchecked(&irq_err_count);
-
- /*
- * Here is what the APIC error bits mean:
-@@ -2184,6 +2184,8 @@ static int __cpuinit apic_cluster_num(void)
- u16 *bios_cpu_apicid;
- DECLARE_BITMAP(clustermap, NUM_APIC_CLUSTERS);
-
-+ pax_track_stack();
-+
- bios_cpu_apicid = early_per_cpu_ptr(x86_bios_cpu_apicid);
- bitmap_zero(clustermap, NUM_APIC_CLUSTERS);
-
-diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
-index d256bc3..627a02d 100644
---- a/arch/x86/kernel/apic/io_apic.c
-+++ b/arch/x86/kernel/apic/io_apic.c
-@@ -716,7 +716,7 @@ struct IO_APIC_route_entry **alloc_ioapic_entries(void)
- ioapic_entries = kzalloc(sizeof(*ioapic_entries) * nr_ioapics,
- GFP_ATOMIC);
- if (!ioapic_entries)
-- return 0;
-+ return NULL;
-
- for (apic = 0; apic < nr_ioapics; apic++) {
- ioapic_entries[apic] =
-@@ -733,7 +733,7 @@ nomem:
- kfree(ioapic_entries[apic]);
- kfree(ioapic_entries);
-
-- return 0;
-+ return NULL;
- }
-
- /*
-@@ -1150,7 +1150,7 @@ int IO_APIC_get_PCI_irq_vector(int bus, int slot, int pin,
- }
- EXPORT_SYMBOL(IO_APIC_get_PCI_irq_vector);
-
--void lock_vector_lock(void)
-+void lock_vector_lock(void) __acquires(vector_lock)
- {
- /* Used to the online set of cpus does not change
- * during assign_irq_vector.
-@@ -1158,7 +1158,7 @@ void lock_vector_lock(void)
- spin_lock(&vector_lock);
- }
-
--void unlock_vector_lock(void)
-+void unlock_vector_lock(void) __releases(vector_lock)
- {
- spin_unlock(&vector_lock);
- }
-@@ -2542,7 +2542,7 @@ static void ack_apic_edge(unsigned int irq)
- ack_APIC_irq();
- }
-
--atomic_t irq_mis_count;
-+atomic_unchecked_t irq_mis_count;
-
- static void ack_apic_level(unsigned int irq)
- {
-@@ -2626,7 +2626,7 @@ static void ack_apic_level(unsigned int irq)
-
- /* Tail end of version 0x11 I/O APIC bug workaround */
- if (!(v & (1 << (i & 0x1f)))) {
-- atomic_inc(&irq_mis_count);
-+ atomic_inc_unchecked(&irq_mis_count);
- spin_lock(&ioapic_lock);
- __mask_and_edge_IO_APIC_irq(cfg);
- __unmask_and_level_IO_APIC_irq(cfg);
-diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c
-index 151ace6..f317474 100644
---- a/arch/x86/kernel/apm_32.c
-+++ b/arch/x86/kernel/apm_32.c
-@@ -410,7 +410,7 @@ static DEFINE_SPINLOCK(user_list_lock);
- * This is for buggy BIOS's that refer to (real mode) segment 0x40
- * even though they are called in protected mode.
- */
--static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
-+static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
- (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
-
- static const char driver_version[] = "1.16ac"; /* no spaces */
-@@ -588,7 +588,10 @@ static long __apm_bios_call(void *_call)
- BUG_ON(cpu != 0);
- gdt = get_cpu_gdt_table(cpu);
- save_desc_40 = gdt[0x40 / 8];
-+
-+ pax_open_kernel();
- gdt[0x40 / 8] = bad_bios_desc;
-+ pax_close_kernel();
-
- apm_irq_save(flags);
- APM_DO_SAVE_SEGS;
-@@ -597,7 +600,11 @@ static long __apm_bios_call(void *_call)
- &call->esi);
- APM_DO_RESTORE_SEGS;
- apm_irq_restore(flags);
-+
-+ pax_open_kernel();
- gdt[0x40 / 8] = save_desc_40;
-+ pax_close_kernel();
-+
- put_cpu();
-
- return call->eax & 0xff;
-@@ -664,7 +671,10 @@ static long __apm_bios_call_simple(void *_call)
- BUG_ON(cpu != 0);
- gdt = get_cpu_gdt_table(cpu);
- save_desc_40 = gdt[0x40 / 8];
-+
-+ pax_open_kernel();
- gdt[0x40 / 8] = bad_bios_desc;
-+ pax_close_kernel();
-
- apm_irq_save(flags);
- APM_DO_SAVE_SEGS;
-@@ -672,7 +682,11 @@ static long __apm_bios_call_simple(void *_call)
- &call->eax);
- APM_DO_RESTORE_SEGS;
- apm_irq_restore(flags);
-+
-+ pax_open_kernel();
- gdt[0x40 / 8] = save_desc_40;
-+ pax_close_kernel();
-+
- put_cpu();
- return error;
- }
-@@ -975,7 +989,7 @@ recalc:
-
- static void apm_power_off(void)
- {
-- unsigned char po_bios_call[] = {
-+ const unsigned char po_bios_call[] = {
- 0xb8, 0x00, 0x10, /* movw $0x1000,ax */
- 0x8e, 0xd0, /* movw ax,ss */
- 0xbc, 0x00, 0xf0, /* movw $0xf000,sp */
-@@ -2357,12 +2371,15 @@ static int __init apm_init(void)
- * code to that CPU.
- */
- gdt = get_cpu_gdt_table(0);
-+
-+ pax_open_kernel();
- set_desc_base(&gdt[APM_CS >> 3],
- (unsigned long)__va((unsigned long)apm_info.bios.cseg << 4));
- set_desc_base(&gdt[APM_CS_16 >> 3],
- (unsigned long)__va((unsigned long)apm_info.bios.cseg_16 << 4));
- set_desc_base(&gdt[APM_DS >> 3],
- (unsigned long)__va((unsigned long)apm_info.bios.dseg << 4));
-+ pax_close_kernel();
-
- proc_create("apm", 0, NULL, &apm_file_ops);
-
-diff --git a/arch/x86/kernel/asm-offsets_32.c b/arch/x86/kernel/asm-offsets_32.c
-index dfdbf64..9b2b6ce 100644
---- a/arch/x86/kernel/asm-offsets_32.c
-+++ b/arch/x86/kernel/asm-offsets_32.c
-@@ -51,7 +51,6 @@ void foo(void)
- OFFSET(CPUINFO_x86_vendor_id, cpuinfo_x86, x86_vendor_id);
- BLANK();
-
-- OFFSET(TI_task, thread_info, task);
- OFFSET(TI_exec_domain, thread_info, exec_domain);
- OFFSET(TI_flags, thread_info, flags);
- OFFSET(TI_status, thread_info, status);
-@@ -60,6 +59,8 @@ void foo(void)
- OFFSET(TI_restart_block, thread_info, restart_block);
- OFFSET(TI_sysenter_return, thread_info, sysenter_return);
- OFFSET(TI_cpu, thread_info, cpu);
-+ OFFSET(TI_lowest_stack, thread_info, lowest_stack);
-+ DEFINE(TI_task_thread_sp0, offsetof(struct task_struct, thread.sp0) - offsetof(struct task_struct, tinfo));
- BLANK();
-
- OFFSET(GDS_size, desc_ptr, size);
-@@ -99,6 +100,7 @@ void foo(void)
-
- DEFINE(PAGE_SIZE_asm, PAGE_SIZE);
- DEFINE(PAGE_SHIFT_asm, PAGE_SHIFT);
-+ DEFINE(THREAD_SIZE_asm, THREAD_SIZE);
- DEFINE(PTRS_PER_PTE, PTRS_PER_PTE);
- DEFINE(PTRS_PER_PMD, PTRS_PER_PMD);
- DEFINE(PTRS_PER_PGD, PTRS_PER_PGD);
-@@ -115,6 +117,11 @@ void foo(void)
- OFFSET(PV_CPU_iret, pv_cpu_ops, iret);
- OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
- OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
-+#endif
-+
- #endif
-
- #ifdef CONFIG_XEN
-diff --git a/arch/x86/kernel/asm-offsets_64.c b/arch/x86/kernel/asm-offsets_64.c
-index 4a6aeed..371de20 100644
---- a/arch/x86/kernel/asm-offsets_64.c
-+++ b/arch/x86/kernel/asm-offsets_64.c
-@@ -44,6 +44,8 @@ int main(void)
- ENTRY(addr_limit);
- ENTRY(preempt_count);
- ENTRY(status);
-+ ENTRY(lowest_stack);
-+ DEFINE(TI_task_thread_sp0, offsetof(struct task_struct, thread.sp0) - offsetof(struct task_struct, tinfo));
- #ifdef CONFIG_IA32_EMULATION
- ENTRY(sysenter_return);
- #endif
-@@ -63,6 +65,18 @@ int main(void)
- OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
- OFFSET(PV_CPU_swapgs, pv_cpu_ops, swapgs);
- OFFSET(PV_MMU_read_cr2, pv_mmu_ops, read_cr2);
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
-+ OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
-+#endif
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ OFFSET(PV_MMU_read_cr3, pv_mmu_ops, read_cr3);
-+ OFFSET(PV_MMU_write_cr3, pv_mmu_ops, write_cr3);
-+ OFFSET(PV_MMU_set_pgd_batched, pv_mmu_ops, set_pgd_batched);
-+#endif
-+
- #endif
-
-
-@@ -115,6 +129,7 @@ int main(void)
- ENTRY(cr8);
- BLANK();
- #undef ENTRY
-+ DEFINE(TSS_size, sizeof(struct tss_struct));
- DEFINE(TSS_ist, offsetof(struct tss_struct, x86_tss.ist));
- BLANK();
- DEFINE(crypto_tfm_ctx_offset, offsetof(struct crypto_tfm, __crt_ctx));
-@@ -130,6 +145,7 @@ int main(void)
-
- BLANK();
- DEFINE(PAGE_SIZE_asm, PAGE_SIZE);
-+ DEFINE(THREAD_SIZE_asm, THREAD_SIZE);
- #ifdef CONFIG_XEN
- BLANK();
- OFFSET(XEN_vcpu_info_mask, vcpu_info, evtchn_upcall_mask);
-diff --git a/arch/x86/kernel/cpu/Makefile b/arch/x86/kernel/cpu/Makefile
-index 1f537a2..a7cb6c6 100644
---- a/arch/x86/kernel/cpu/Makefile
-+++ b/arch/x86/kernel/cpu/Makefile
-@@ -7,10 +7,6 @@ ifdef CONFIG_FUNCTION_TRACER
- CFLAGS_REMOVE_common.o = -pg
- endif
-
--# Make sure load_percpu_segment has no stackprotector
--nostackp := $(call cc-option, -fno-stack-protector)
--CFLAGS_common.o := $(nostackp)
--
- obj-y := intel_cacheinfo.o addon_cpuid_features.o
- obj-y += proc.o capflags.o powerflags.o common.o
- obj-y += vmware.o hypervisor.o sched.o
-diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
-index 6e082dc..a0b5f36 100644
---- a/arch/x86/kernel/cpu/amd.c
-+++ b/arch/x86/kernel/cpu/amd.c
-@@ -602,7 +602,7 @@ static unsigned int __cpuinit amd_size_cache(struct cpuinfo_x86 *c,
- unsigned int size)
- {
- /* AMD errata T13 (order #21922) */
-- if ((c->x86 == 6)) {
-+ if (c->x86 == 6) {
- /* Duron Rev A0 */
- if (c->x86_model == 3 && c->x86_mask == 0)
- size = 64;
-diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
-index ba1a1dd..1a4b0af 100644
---- a/arch/x86/kernel/cpu/common.c
-+++ b/arch/x86/kernel/cpu/common.c
-@@ -84,60 +84,6 @@ static const struct cpu_dev __cpuinitconst default_cpu = {
-
- static const struct cpu_dev *this_cpu __cpuinitdata = &default_cpu;
-
--DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = {
--#ifdef CONFIG_X86_64
-- /*
-- * We need valid kernel segments for data and code in long mode too
-- * IRET will check the segment types kkeil 2000/10/28
-- * Also sysret mandates a special GDT layout
-- *
-- * TLS descriptors are currently at a different place compared to i386.
-- * Hopefully nobody expects them at a fixed place (Wine?)
-- */
-- [GDT_ENTRY_KERNEL32_CS] = GDT_ENTRY_INIT(0xc09b, 0, 0xfffff),
-- [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xa09b, 0, 0xfffff),
-- [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc093, 0, 0xfffff),
-- [GDT_ENTRY_DEFAULT_USER32_CS] = GDT_ENTRY_INIT(0xc0fb, 0, 0xfffff),
-- [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f3, 0, 0xfffff),
-- [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xa0fb, 0, 0xfffff),
--#else
-- [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xc09a, 0, 0xfffff),
-- [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
-- [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xc0fa, 0, 0xfffff),
-- [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f2, 0, 0xfffff),
-- /*
-- * Segments used for calling PnP BIOS have byte granularity.
-- * They code segments and data segments have fixed 64k limits,
-- * the transfer segment sizes are set at run time.
-- */
-- /* 32-bit code */
-- [GDT_ENTRY_PNPBIOS_CS32] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
-- /* 16-bit code */
-- [GDT_ENTRY_PNPBIOS_CS16] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
-- /* 16-bit data */
-- [GDT_ENTRY_PNPBIOS_DS] = GDT_ENTRY_INIT(0x0092, 0, 0xffff),
-- /* 16-bit data */
-- [GDT_ENTRY_PNPBIOS_TS1] = GDT_ENTRY_INIT(0x0092, 0, 0),
-- /* 16-bit data */
-- [GDT_ENTRY_PNPBIOS_TS2] = GDT_ENTRY_INIT(0x0092, 0, 0),
-- /*
-- * The APM segments have byte granularity and their bases
-- * are set at run time. All have 64k limits.
-- */
-- /* 32-bit code */
-- [GDT_ENTRY_APMBIOS_BASE] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
-- /* 16-bit code */
-- [GDT_ENTRY_APMBIOS_BASE+1] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
-- /* data */
-- [GDT_ENTRY_APMBIOS_BASE+2] = GDT_ENTRY_INIT(0x4092, 0, 0xffff),
--
-- [GDT_ENTRY_ESPFIX_SS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
-- [GDT_ENTRY_PERCPU] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
-- GDT_STACK_CANARY_INIT
--#endif
--} };
--EXPORT_PER_CPU_SYMBOL_GPL(gdt_page);
--
- static int __init x86_xsave_setup(char *s)
- {
- setup_clear_cpu_cap(X86_FEATURE_XSAVE);
-@@ -345,7 +291,7 @@ void switch_to_new_gdt(int cpu)
- {
- struct desc_ptr gdt_descr;
-
-- gdt_descr.address = (long)get_cpu_gdt_table(cpu);
-+ gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
- gdt_descr.size = GDT_SIZE - 1;
- load_gdt(&gdt_descr);
- /* Reload the per-cpu base */
-@@ -799,6 +745,10 @@ static void __cpuinit identify_cpu(struct cpuinfo_x86 *c)
- /* Filter out anything that depends on CPUID levels we don't have */
- filter_cpuid_features(c, true);
-
-+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF))
-+ setup_clear_cpu_cap(X86_FEATURE_SEP);
-+#endif
-+
- /* If the model name is still unset, do table lookup. */
- if (!c->x86_model_id[0]) {
- const char *p;
-@@ -982,6 +932,9 @@ static __init int setup_disablecpuid(char *arg)
- }
- __setup("clearcpuid=", setup_disablecpuid);
-
-+DEFINE_PER_CPU(struct thread_info *, current_tinfo) = &init_task.tinfo;
-+EXPORT_PER_CPU_SYMBOL(current_tinfo);
-+
- #ifdef CONFIG_X86_64
- struct desc_ptr idt_descr = { NR_VECTORS * 16 - 1, (unsigned long) idt_table };
-
-@@ -997,7 +950,7 @@ DEFINE_PER_CPU(struct task_struct *, current_task) ____cacheline_aligned =
- EXPORT_PER_CPU_SYMBOL(current_task);
-
- DEFINE_PER_CPU(unsigned long, kernel_stack) =
-- (unsigned long)&init_thread_union - KERNEL_STACK_OFFSET + THREAD_SIZE;
-+ (unsigned long)&init_thread_union - 16 + THREAD_SIZE;
- EXPORT_PER_CPU_SYMBOL(kernel_stack);
-
- DEFINE_PER_CPU(char *, irq_stack_ptr) =
-@@ -1062,7 +1015,7 @@ struct pt_regs * __cpuinit idle_regs(struct pt_regs *regs)
- {
- memset(regs, 0, sizeof(struct pt_regs));
- regs->fs = __KERNEL_PERCPU;
-- regs->gs = __KERNEL_STACK_CANARY;
-+ savesegment(gs, regs->gs);
-
- return regs;
- }
-@@ -1103,7 +1056,7 @@ void __cpuinit cpu_init(void)
- int i;
-
- cpu = stack_smp_processor_id();
-- t = &per_cpu(init_tss, cpu);
-+ t = init_tss + cpu;
- orig_ist = &per_cpu(orig_ist, cpu);
-
- #ifdef CONFIG_NUMA
-@@ -1129,7 +1082,7 @@ void __cpuinit cpu_init(void)
- switch_to_new_gdt(cpu);
- loadsegment(fs, 0);
-
-- load_idt((const struct desc_ptr *)&idt_descr);
-+ load_idt(&idt_descr);
-
- memset(me->thread.tls_array, 0, GDT_ENTRY_TLS_ENTRIES * 8);
- syscall_init();
-@@ -1138,7 +1091,6 @@ void __cpuinit cpu_init(void)
- wrmsrl(MSR_KERNEL_GS_BASE, 0);
- barrier();
-
-- check_efer();
- if (cpu != 0)
- enable_x2apic();
-
-@@ -1201,7 +1153,7 @@ void __cpuinit cpu_init(void)
- {
- int cpu = smp_processor_id();
- struct task_struct *curr = current;
-- struct tss_struct *t = &per_cpu(init_tss, cpu);
-+ struct tss_struct *t = init_tss + cpu;
- struct thread_struct *thread = &curr->thread;
-
- if (cpumask_test_and_set_cpu(cpu, cpu_initialized_mask)) {
-diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
-index 6a77cca..4f4fca0 100644
---- a/arch/x86/kernel/cpu/intel.c
-+++ b/arch/x86/kernel/cpu/intel.c
-@@ -162,7 +162,7 @@ static void __cpuinit trap_init_f00f_bug(void)
- * Update the IDT descriptor and reload the IDT so that
- * it uses the read-only mapped virtual address.
- */
-- idt_descr.address = fix_to_virt(FIX_F00F_IDT);
-+ idt_descr.address = (struct desc_struct *)fix_to_virt(FIX_F00F_IDT);
- load_idt(&idt_descr);
- }
- #endif
-diff --git a/arch/x86/kernel/cpu/intel_cacheinfo.c b/arch/x86/kernel/cpu/intel_cacheinfo.c
-index 417990f..8c489b8 100644
---- a/arch/x86/kernel/cpu/intel_cacheinfo.c
-+++ b/arch/x86/kernel/cpu/intel_cacheinfo.c
-@@ -921,7 +921,7 @@ static ssize_t store(struct kobject *kobj, struct attribute *attr,
- return ret;
- }
-
--static struct sysfs_ops sysfs_ops = {
-+static const struct sysfs_ops sysfs_ops = {
- .show = show,
- .store = store,
- };
-@@ -931,6 +931,11 @@ static struct kobj_type ktype_cache = {
- .default_attrs = default_attrs,
- };
-
-+static struct kobj_type ktype_l3_cache = {
-+ .sysfs_ops = &sysfs_ops,
-+ .default_attrs = default_l3_attrs,
-+};
-+
- static struct kobj_type ktype_percpu_entry = {
- .sysfs_ops = &sysfs_ops,
- };
-@@ -997,6 +1002,8 @@ static int __cpuinit cache_add_dev(struct sys_device * sys_dev)
- }
-
- for (i = 0; i < num_cache_leaves; i++) {
-+ struct kobj_type *ktype;
-+
- this_object = INDEX_KOBJECT_PTR(cpu, i);
- this_object->cpu = cpu;
- this_object->index = i;
-@@ -1004,12 +1011,12 @@ static int __cpuinit cache_add_dev(struct sys_device * sys_dev)
- this_leaf = CPUID4_INFO_IDX(cpu, i);
-
- if (this_leaf->can_disable)
-- ktype_cache.default_attrs = default_l3_attrs;
-+ ktype = &ktype_l3_cache;
- else
-- ktype_cache.default_attrs = default_attrs;
-+ ktype = &ktype_cache;
-
- retval = kobject_init_and_add(&(this_object->kobj),
-- &ktype_cache,
-+ ktype,
- per_cpu(cache_kobject, cpu),
- "index%1lu", i);
- if (unlikely(retval)) {
-diff --git a/arch/x86/kernel/cpu/mcheck/mce-inject.c b/arch/x86/kernel/cpu/mcheck/mce-inject.c
-index 472763d..9831e11 100644
---- a/arch/x86/kernel/cpu/mcheck/mce-inject.c
-+++ b/arch/x86/kernel/cpu/mcheck/mce-inject.c
-@@ -211,7 +211,9 @@ static ssize_t mce_write(struct file *filp, const char __user *ubuf,
- static int inject_init(void)
- {
- printk(KERN_INFO "Machine check injector initialized\n");
-- mce_chrdev_ops.write = mce_write;
-+ pax_open_kernel();
-+ *(void **)&mce_chrdev_ops.write = mce_write;
-+ pax_close_kernel();
- register_die_notifier(&mce_raise_nb);
- return 0;
- }
-diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
-index 28a7e4c8..3c94ef2 100644
---- a/arch/x86/kernel/cpu/mcheck/mce.c
-+++ b/arch/x86/kernel/cpu/mcheck/mce.c
-@@ -43,6 +43,7 @@
- #include <asm/ipi.h>
- #include <asm/mce.h>
- #include <asm/msr.h>
-+#include <asm/local.h>
-
- #include "mce-internal.h"
-
-@@ -187,7 +188,7 @@ static void print_mce(struct mce *m)
- !(m->mcgstatus & MCG_STATUS_EIPV) ? " !INEXACT!" : "",
- m->cs, m->ip);
-
-- if (m->cs == __KERNEL_CS)
-+ if (m->cs == __KERNEL_CS || m->cs == __KERNEXEC_KERNEL_CS)
- print_symbol("{%s}", m->ip);
- pr_cont("\n");
- }
-@@ -221,10 +222,10 @@ static void print_mce_tail(void)
-
- #define PANIC_TIMEOUT 5 /* 5 seconds */
-
--static atomic_t mce_paniced;
-+static atomic_unchecked_t mce_paniced;
-
- static int fake_panic;
--static atomic_t mce_fake_paniced;
-+static atomic_unchecked_t mce_fake_paniced;
-
- /* Panic in progress. Enable interrupts and wait for final IPI */
- static void wait_for_panic(void)
-@@ -248,7 +249,7 @@ static void mce_panic(char *msg, struct mce *final, char *exp)
- /*
- * Make sure only one CPU runs in machine check panic
- */
-- if (atomic_inc_return(&mce_paniced) > 1)
-+ if (atomic_inc_return_unchecked(&mce_paniced) > 1)
- wait_for_panic();
- barrier();
-
-@@ -256,7 +257,7 @@ static void mce_panic(char *msg, struct mce *final, char *exp)
- console_verbose();
- } else {
- /* Don't log too much for fake panic */
-- if (atomic_inc_return(&mce_fake_paniced) > 1)
-+ if (atomic_inc_return_unchecked(&mce_fake_paniced) > 1)
- return;
- }
- print_mce_head();
-@@ -623,7 +624,7 @@ static int mce_timed_out(u64 *t)
- * might have been modified by someone else.
- */
- rmb();
-- if (atomic_read(&mce_paniced))
-+ if (atomic_read_unchecked(&mce_paniced))
- wait_for_panic();
- if (!monarch_timeout)
- goto out;
-@@ -1401,7 +1402,7 @@ static void unexpected_machine_check(struct pt_regs *regs, long error_code)
- }
-
- /* Call the installed machine check handler for this CPU setup. */
--void (*machine_check_vector)(struct pt_regs *, long error_code) =
-+void (*machine_check_vector)(struct pt_regs *, long error_code) __read_only =
- unexpected_machine_check;
-
- /*
-@@ -1423,7 +1424,9 @@ void __cpuinit mcheck_init(struct cpuinfo_x86 *c)
- return;
- }
-
-+ pax_open_kernel();
- machine_check_vector = do_machine_check;
-+ pax_close_kernel();
-
- mce_init();
- mce_cpu_features(c);
-@@ -1436,14 +1439,14 @@ void __cpuinit mcheck_init(struct cpuinfo_x86 *c)
- */
-
- static DEFINE_SPINLOCK(mce_state_lock);
--static int open_count; /* #times opened */
-+static local_t open_count; /* #times opened */
- static int open_exclu; /* already open exclusive? */
-
- static int mce_open(struct inode *inode, struct file *file)
- {
- spin_lock(&mce_state_lock);
-
-- if (open_exclu || (open_count && (file->f_flags & O_EXCL))) {
-+ if (open_exclu || (local_read(&open_count) && (file->f_flags & O_EXCL))) {
- spin_unlock(&mce_state_lock);
-
- return -EBUSY;
-@@ -1451,7 +1454,7 @@ static int mce_open(struct inode *inode, struct file *file)
-
- if (file->f_flags & O_EXCL)
- open_exclu = 1;
-- open_count++;
-+ local_inc(&open_count);
-
- spin_unlock(&mce_state_lock);
-
-@@ -1462,7 +1465,7 @@ static int mce_release(struct inode *inode, struct file *file)
- {
- spin_lock(&mce_state_lock);
-
-- open_count--;
-+ local_dec(&open_count);
- open_exclu = 0;
-
- spin_unlock(&mce_state_lock);
-@@ -2014,7 +2017,7 @@ mce_cpu_callback(struct notifier_block *nfb, unsigned long action, void *hcpu)
- return NOTIFY_OK;
- }
-
--static struct notifier_block mce_cpu_notifier __cpuinitdata = {
-+static struct notifier_block mce_cpu_notifier __cpuinitconst = {
- .notifier_call = mce_cpu_callback,
- };
-
-@@ -2089,7 +2092,7 @@ struct dentry *mce_get_debugfs_dir(void)
- static void mce_reset(void)
- {
- cpu_missing = 0;
-- atomic_set(&mce_fake_paniced, 0);
-+ atomic_set_unchecked(&mce_fake_paniced, 0);
- atomic_set(&mce_executing, 0);
- atomic_set(&mce_callin, 0);
- atomic_set(&global_nwo, 0);
-diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c
-index ef3cd31..9d2f6ab 100644
---- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
-+++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
-@@ -385,7 +385,7 @@ static ssize_t store(struct kobject *kobj, struct attribute *attr,
- return ret;
- }
-
--static struct sysfs_ops threshold_ops = {
-+static const struct sysfs_ops threshold_ops = {
- .show = show,
- .store = store,
- };
-diff --git a/arch/x86/kernel/cpu/mcheck/p5.c b/arch/x86/kernel/cpu/mcheck/p5.c
-index 5c0e653..0882b0a 100644
---- a/arch/x86/kernel/cpu/mcheck/p5.c
-+++ b/arch/x86/kernel/cpu/mcheck/p5.c
-@@ -12,6 +12,7 @@
- #include <asm/system.h>
- #include <asm/mce.h>
- #include <asm/msr.h>
-+#include <asm/pgtable.h>
-
- /* By default disabled */
- int mce_p5_enabled __read_mostly;
-@@ -50,7 +51,9 @@ void intel_p5_mcheck_init(struct cpuinfo_x86 *c)
- if (!cpu_has(c, X86_FEATURE_MCE))
- return;
-
-+ pax_open_kernel();
- machine_check_vector = pentium_machine_check;
-+ pax_close_kernel();
- /* Make sure the vector pointer is visible before we enable MCEs: */
- wmb();
-
-diff --git a/arch/x86/kernel/cpu/mcheck/winchip.c b/arch/x86/kernel/cpu/mcheck/winchip.c
-index 54060f5..c1a7577 100644
---- a/arch/x86/kernel/cpu/mcheck/winchip.c
-+++ b/arch/x86/kernel/cpu/mcheck/winchip.c
-@@ -11,6 +11,7 @@
- #include <asm/system.h>
- #include <asm/mce.h>
- #include <asm/msr.h>
-+#include <asm/pgtable.h>
-
- /* Machine check handler for WinChip C6: */
- static void winchip_machine_check(struct pt_regs *regs, long error_code)
-@@ -24,7 +25,9 @@ void winchip_mcheck_init(struct cpuinfo_x86 *c)
- {
- u32 lo, hi;
-
-+ pax_open_kernel();
- machine_check_vector = winchip_machine_check;
-+ pax_close_kernel();
- /* Make sure the vector pointer is visible before we enable MCEs: */
- wmb();
-
-diff --git a/arch/x86/kernel/cpu/mtrr/amd.c b/arch/x86/kernel/cpu/mtrr/amd.c
-index 33af141..92ba9cd 100644
---- a/arch/x86/kernel/cpu/mtrr/amd.c
-+++ b/arch/x86/kernel/cpu/mtrr/amd.c
-@@ -108,7 +108,7 @@ amd_validate_add_page(unsigned long base, unsigned long size, unsigned int type)
- return 0;
- }
-
--static struct mtrr_ops amd_mtrr_ops = {
-+static const struct mtrr_ops amd_mtrr_ops = {
- .vendor = X86_VENDOR_AMD,
- .set = amd_set_mtrr,
- .get = amd_get_mtrr,
-diff --git a/arch/x86/kernel/cpu/mtrr/centaur.c b/arch/x86/kernel/cpu/mtrr/centaur.c
-index de89f14..316fe3e 100644
---- a/arch/x86/kernel/cpu/mtrr/centaur.c
-+++ b/arch/x86/kernel/cpu/mtrr/centaur.c
-@@ -110,7 +110,7 @@ centaur_validate_add_page(unsigned long base, unsigned long size, unsigned int t
- return 0;
- }
-
--static struct mtrr_ops centaur_mtrr_ops = {
-+static const struct mtrr_ops centaur_mtrr_ops = {
- .vendor = X86_VENDOR_CENTAUR,
- .set = centaur_set_mcr,
- .get = centaur_get_mcr,
-diff --git a/arch/x86/kernel/cpu/mtrr/cyrix.c b/arch/x86/kernel/cpu/mtrr/cyrix.c
-index 228d982..68a3343 100644
---- a/arch/x86/kernel/cpu/mtrr/cyrix.c
-+++ b/arch/x86/kernel/cpu/mtrr/cyrix.c
-@@ -265,7 +265,7 @@ static void cyrix_set_all(void)
- post_set();
- }
-
--static struct mtrr_ops cyrix_mtrr_ops = {
-+static const struct mtrr_ops cyrix_mtrr_ops = {
- .vendor = X86_VENDOR_CYRIX,
- .set_all = cyrix_set_all,
- .set = cyrix_set_arr,
-diff --git a/arch/x86/kernel/cpu/mtrr/generic.c b/arch/x86/kernel/cpu/mtrr/generic.c
-index 55da0c5..4d75584 100644
---- a/arch/x86/kernel/cpu/mtrr/generic.c
-+++ b/arch/x86/kernel/cpu/mtrr/generic.c
-@@ -752,7 +752,7 @@ int positive_have_wrcomb(void)
- /*
- * Generic structure...
- */
--struct mtrr_ops generic_mtrr_ops = {
-+const struct mtrr_ops generic_mtrr_ops = {
- .use_intel_if = 1,
- .set_all = generic_set_all,
- .get = generic_get_mtrr,
-diff --git a/arch/x86/kernel/cpu/mtrr/main.c b/arch/x86/kernel/cpu/mtrr/main.c
-index fd60f09..c94ef52 100644
---- a/arch/x86/kernel/cpu/mtrr/main.c
-+++ b/arch/x86/kernel/cpu/mtrr/main.c
-@@ -60,14 +60,14 @@ static DEFINE_MUTEX(mtrr_mutex);
- u64 size_or_mask, size_and_mask;
- static bool mtrr_aps_delayed_init;
-
--static struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM];
-+static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM] __read_only;
-
--struct mtrr_ops *mtrr_if;
-+const struct mtrr_ops *mtrr_if;
-
- static void set_mtrr(unsigned int reg, unsigned long base,
- unsigned long size, mtrr_type type);
-
--void set_mtrr_ops(struct mtrr_ops *ops)
-+void set_mtrr_ops(const struct mtrr_ops *ops)
- {
- if (ops->vendor && ops->vendor < X86_VENDOR_NUM)
- mtrr_ops[ops->vendor] = ops;
-diff --git a/arch/x86/kernel/cpu/mtrr/mtrr.h b/arch/x86/kernel/cpu/mtrr/mtrr.h
-index a501dee..816c719 100644
---- a/arch/x86/kernel/cpu/mtrr/mtrr.h
-+++ b/arch/x86/kernel/cpu/mtrr/mtrr.h
-@@ -25,14 +25,14 @@ struct mtrr_ops {
- int (*validate_add_page)(unsigned long base, unsigned long size,
- unsigned int type);
- int (*have_wrcomb)(void);
--};
-+} __do_const;
-
- extern int generic_get_free_region(unsigned long base, unsigned long size,
- int replace_reg);
- extern int generic_validate_add_page(unsigned long base, unsigned long size,
- unsigned int type);
-
--extern struct mtrr_ops generic_mtrr_ops;
-+extern const struct mtrr_ops generic_mtrr_ops;
-
- extern int positive_have_wrcomb(void);
-
-@@ -53,10 +53,10 @@ void fill_mtrr_var_range(unsigned int index,
- u32 base_lo, u32 base_hi, u32 mask_lo, u32 mask_hi);
- void get_mtrr_state(void);
-
--extern void set_mtrr_ops(struct mtrr_ops *ops);
-+extern void set_mtrr_ops(const struct mtrr_ops *ops);
-
- extern u64 size_or_mask, size_and_mask;
--extern struct mtrr_ops *mtrr_if;
-+extern const struct mtrr_ops *mtrr_if;
-
- #define is_cpu(vnd) (mtrr_if && mtrr_if->vendor == X86_VENDOR_##vnd)
- #define use_intel() (mtrr_if && mtrr_if->use_intel_if == 1)
-diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
-index 0ff02ca..9994c9d 100644
---- a/arch/x86/kernel/cpu/perf_event.c
-+++ b/arch/x86/kernel/cpu/perf_event.c
-@@ -723,10 +723,10 @@ x86_perf_event_update(struct perf_event *event,
- * count to the generic event atomically:
- */
- again:
-- prev_raw_count = atomic64_read(&hwc->prev_count);
-+ prev_raw_count = atomic64_read_unchecked(&hwc->prev_count);
- rdmsrl(hwc->event_base + idx, new_raw_count);
-
-- if (atomic64_cmpxchg(&hwc->prev_count, prev_raw_count,
-+ if (atomic64_cmpxchg_unchecked(&hwc->prev_count, prev_raw_count,
- new_raw_count) != prev_raw_count)
- goto again;
-
-@@ -741,7 +741,7 @@ again:
- delta = (new_raw_count << shift) - (prev_raw_count << shift);
- delta >>= shift;
-
-- atomic64_add(delta, &event->count);
-+ atomic64_add_unchecked(delta, &event->count);
- atomic64_sub(delta, &hwc->period_left);
-
- return new_raw_count;
-@@ -1353,7 +1353,7 @@ x86_perf_event_set_period(struct perf_event *event,
- * The hw event starts counting from this event offset,
- * mark it to be able to extra future deltas:
- */
-- atomic64_set(&hwc->prev_count, (u64)-left);
-+ atomic64_set_unchecked(&hwc->prev_count, (u64)-left);
-
- err = checking_wrmsrl(hwc->event_base + idx,
- (u64)(-left) & x86_pmu.event_mask);
-@@ -1940,7 +1940,7 @@ perf_event_nmi_handler(struct notifier_block *self,
- return NOTIFY_STOP;
- }
-
--static __read_mostly struct notifier_block perf_event_nmi_notifier = {
-+static struct notifier_block perf_event_nmi_notifier = {
- .notifier_call = perf_event_nmi_handler,
- .next = NULL,
- .priority = 1
-@@ -2357,7 +2357,7 @@ perf_callchain_user(struct pt_regs *regs, struct perf_callchain_entry *entry)
- break;
-
- callchain_store(entry, frame.return_address);
-- fp = frame.next_frame;
-+ fp = (__force const void __user *)frame.next_frame;
- }
- }
-
-diff --git a/arch/x86/kernel/cpu/perfctr-watchdog.c b/arch/x86/kernel/cpu/perfctr-watchdog.c
-index 898df97..9e82503 100644
---- a/arch/x86/kernel/cpu/perfctr-watchdog.c
-+++ b/arch/x86/kernel/cpu/perfctr-watchdog.c
-@@ -30,11 +30,11 @@ struct nmi_watchdog_ctlblk {
-
- /* Interface defining a CPU specific perfctr watchdog */
- struct wd_ops {
-- int (*reserve)(void);
-- void (*unreserve)(void);
-- int (*setup)(unsigned nmi_hz);
-- void (*rearm)(struct nmi_watchdog_ctlblk *wd, unsigned nmi_hz);
-- void (*stop)(void);
-+ int (* const reserve)(void);
-+ void (* const unreserve)(void);
-+ int (* const setup)(unsigned nmi_hz);
-+ void (* const rearm)(struct nmi_watchdog_ctlblk *wd, unsigned nmi_hz);
-+ void (* const stop)(void);
- unsigned perfctr;
- unsigned evntsel;
- u64 checkbit;
-@@ -645,6 +645,7 @@ static const struct wd_ops p4_wd_ops = {
- #define ARCH_PERFMON_NMI_EVENT_SEL ARCH_PERFMON_UNHALTED_CORE_CYCLES_SEL
- #define ARCH_PERFMON_NMI_EVENT_UMASK ARCH_PERFMON_UNHALTED_CORE_CYCLES_UMASK
-
-+/* cannot be const */
- static struct wd_ops intel_arch_wd_ops;
-
- static int setup_intel_arch_watchdog(unsigned nmi_hz)
-@@ -697,6 +698,7 @@ static int setup_intel_arch_watchdog(unsigned nmi_hz)
- return 1;
- }
-
-+/* cannot be const */
- static struct wd_ops intel_arch_wd_ops __read_mostly = {
- .reserve = single_msr_reserve,
- .unreserve = single_msr_unreserve,
-diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c
-index ff95824..2ffdcb5 100644
---- a/arch/x86/kernel/crash.c
-+++ b/arch/x86/kernel/crash.c
-@@ -41,7 +41,7 @@ static void kdump_nmi_callback(int cpu, struct die_args *args)
- regs = args->regs;
-
- #ifdef CONFIG_X86_32
-- if (!user_mode_vm(regs)) {
-+ if (!user_mode(regs)) {
- crash_fixup_ss_esp(&fixed_regs, regs);
- regs = &fixed_regs;
- }
-diff --git a/arch/x86/kernel/doublefault_32.c b/arch/x86/kernel/doublefault_32.c
-index 37250fe..bf2ec74 100644
---- a/arch/x86/kernel/doublefault_32.c
-+++ b/arch/x86/kernel/doublefault_32.c
-@@ -11,7 +11,7 @@
-
- #define DOUBLEFAULT_STACKSIZE (1024)
- static unsigned long doublefault_stack[DOUBLEFAULT_STACKSIZE];
--#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE)
-+#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE-2)
-
- #define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + MAXMEM)
-
-@@ -21,7 +21,7 @@ static void doublefault_fn(void)
- unsigned long gdt, tss;
-
- store_gdt(&gdt_desc);
-- gdt = gdt_desc.address;
-+ gdt = (unsigned long)gdt_desc.address;
-
- printk(KERN_EMERG "PANIC: double fault, gdt at %08lx [%d bytes]\n", gdt, gdt_desc.size);
-
-@@ -58,10 +58,10 @@ struct tss_struct doublefault_tss __cacheline_aligned = {
- /* 0x2 bit is always set */
- .flags = X86_EFLAGS_SF | 0x2,
- .sp = STACK_START,
-- .es = __USER_DS,
-+ .es = __KERNEL_DS,
- .cs = __KERNEL_CS,
- .ss = __KERNEL_DS,
-- .ds = __USER_DS,
-+ .ds = __KERNEL_DS,
- .fs = __KERNEL_PERCPU,
-
- .__cr3 = __pa_nodebug(swapper_pg_dir),
-diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c
-index 2d8a371..4fa6ae6 100644
---- a/arch/x86/kernel/dumpstack.c
-+++ b/arch/x86/kernel/dumpstack.c
-@@ -2,6 +2,9 @@
- * Copyright (C) 1991, 1992 Linus Torvalds
- * Copyright (C) 2000, 2001, 2002 Andi Kleen, SuSE Labs
- */
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+#define __INCLUDED_BY_HIDESYM 1
-+#endif
- #include <linux/kallsyms.h>
- #include <linux/kprobes.h>
- #include <linux/uaccess.h>
-@@ -28,7 +31,7 @@ static int die_counter;
-
- void printk_address(unsigned long address, int reliable)
- {
-- printk(" [<%p>] %s%pS\n", (void *) address,
-+ printk(" [<%p>] %s%pA\n", (void *) address,
- reliable ? "" : "? ", (void *) address);
- }
-
-@@ -36,9 +39,8 @@ void printk_address(unsigned long address, int reliable)
- static void
- print_ftrace_graph_addr(unsigned long addr, void *data,
- const struct stacktrace_ops *ops,
-- struct thread_info *tinfo, int *graph)
-+ struct task_struct *task, int *graph)
- {
-- struct task_struct *task = tinfo->task;
- unsigned long ret_addr;
- int index = task->curr_ret_stack;
-
-@@ -59,7 +61,7 @@ print_ftrace_graph_addr(unsigned long addr, void *data,
- static inline void
- print_ftrace_graph_addr(unsigned long addr, void *data,
- const struct stacktrace_ops *ops,
-- struct thread_info *tinfo, int *graph)
-+ struct task_struct *task, int *graph)
- { }
- #endif
-
-@@ -70,10 +72,8 @@ print_ftrace_graph_addr(unsigned long addr, void *data,
- * severe exception (double fault, nmi, stack fault, debug, mce) hardware stack
- */
-
--static inline int valid_stack_ptr(struct thread_info *tinfo,
-- void *p, unsigned int size, void *end)
-+static inline int valid_stack_ptr(void *t, void *p, unsigned int size, void *end)
- {
-- void *t = tinfo;
- if (end) {
- if (p < end && p >= (end-THREAD_SIZE))
- return 1;
-@@ -84,14 +84,14 @@ static inline int valid_stack_ptr(struct thread_info *tinfo,
- }
-
- unsigned long
--print_context_stack(struct thread_info *tinfo,
-+print_context_stack(struct task_struct *task, void *stack_start,
- unsigned long *stack, unsigned long bp,
- const struct stacktrace_ops *ops, void *data,
- unsigned long *end, int *graph)
- {
- struct stack_frame *frame = (struct stack_frame *)bp;
-
-- while (valid_stack_ptr(tinfo, stack, sizeof(*stack), end)) {
-+ while (valid_stack_ptr(stack_start, stack, sizeof(*stack), end)) {
- unsigned long addr;
-
- addr = *stack;
-@@ -103,7 +103,7 @@ print_context_stack(struct thread_info *tinfo,
- } else {
- ops->address(data, addr, 0);
- }
-- print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
-+ print_ftrace_graph_addr(addr, data, ops, task, graph);
- }
- stack++;
- }
-@@ -180,7 +180,7 @@ void dump_stack(void)
- #endif
-
- printk("Pid: %d, comm: %.20s %s %s %.*s\n",
-- current->pid, current->comm, print_tainted(),
-+ task_pid_nr(current), current->comm, print_tainted(),
- init_utsname()->release,
- (int)strcspn(init_utsname()->version, " "),
- init_utsname()->version);
-@@ -220,6 +220,8 @@ unsigned __kprobes long oops_begin(void)
- return flags;
- }
-
-+extern void gr_handle_kernel_exploit(void);
-+
- void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr)
- {
- if (regs && kexec_should_crash(current))
-@@ -241,7 +243,10 @@ void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr)
- panic("Fatal exception in interrupt");
- if (panic_on_oops)
- panic("Fatal exception");
-- do_exit(signr);
-+
-+ gr_handle_kernel_exploit();
-+
-+ do_group_exit(signr);
- }
-
- int __kprobes __die(const char *str, struct pt_regs *regs, long err)
-@@ -295,7 +300,7 @@ void die(const char *str, struct pt_regs *regs, long err)
- unsigned long flags = oops_begin();
- int sig = SIGSEGV;
-
-- if (!user_mode_vm(regs))
-+ if (!user_mode(regs))
- report_bug(regs->ip, regs);
-
- if (__die(str, regs, err))
-diff --git a/arch/x86/kernel/dumpstack.h b/arch/x86/kernel/dumpstack.h
-index 81086c2..13e8b17 100644
---- a/arch/x86/kernel/dumpstack.h
-+++ b/arch/x86/kernel/dumpstack.h
-@@ -15,7 +15,7 @@
- #endif
-
- extern unsigned long
--print_context_stack(struct thread_info *tinfo,
-+print_context_stack(struct task_struct *task, void *stack_start,
- unsigned long *stack, unsigned long bp,
- const struct stacktrace_ops *ops, void *data,
- unsigned long *end, int *graph);
-diff --git a/arch/x86/kernel/dumpstack_32.c b/arch/x86/kernel/dumpstack_32.c
-index f7dd2a7..c7b8ce6 100644
---- a/arch/x86/kernel/dumpstack_32.c
-+++ b/arch/x86/kernel/dumpstack_32.c
-@@ -53,16 +53,12 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
- #endif
-
- for (;;) {
-- struct thread_info *context;
-+ void *stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
-+ bp = print_context_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
-
-- context = (struct thread_info *)
-- ((unsigned long)stack & (~(THREAD_SIZE - 1)));
-- bp = print_context_stack(context, stack, bp, ops,
-- data, NULL, &graph);
--
-- stack = (unsigned long *)context->previous_esp;
-- if (!stack)
-+ if (stack_start == task_stack_page(task))
- break;
-+ stack = *(unsigned long **)stack_start;
- if (ops->stack(data, "IRQ") < 0)
- break;
- touch_nmi_watchdog();
-@@ -112,11 +108,12 @@ void show_registers(struct pt_regs *regs)
- * When in-kernel, we also print out the stack and code at the
- * time of the fault..
- */
-- if (!user_mode_vm(regs)) {
-+ if (!user_mode(regs)) {
- unsigned int code_prologue = code_bytes * 43 / 64;
- unsigned int code_len = code_bytes;
- unsigned char c;
- u8 *ip;
-+ unsigned long cs_base = get_desc_base(&get_cpu_gdt_table(0)[(0xffff & regs->cs) >> 3]);
-
- printk(KERN_EMERG "Stack:\n");
- show_stack_log_lvl(NULL, regs, ®s->sp,
-@@ -124,10 +121,10 @@ void show_registers(struct pt_regs *regs)
-
- printk(KERN_EMERG "Code: ");
-
-- ip = (u8 *)regs->ip - code_prologue;
-+ ip = (u8 *)regs->ip - code_prologue + cs_base;
- if (ip < (u8 *)PAGE_OFFSET || probe_kernel_address(ip, c)) {
- /* try starting at IP */
-- ip = (u8 *)regs->ip;
-+ ip = (u8 *)regs->ip + cs_base;
- code_len = code_len - code_prologue + 1;
- }
- for (i = 0; i < code_len; i++, ip++) {
-@@ -136,7 +133,7 @@ void show_registers(struct pt_regs *regs)
- printk(" Bad EIP value.");
- break;
- }
-- if (ip == (u8 *)regs->ip)
-+ if (ip == (u8 *)regs->ip + cs_base)
- printk("<%02x> ", c);
- else
- printk("%02x ", c);
-@@ -145,10 +142,23 @@ void show_registers(struct pt_regs *regs)
- printk("\n");
- }
-
-+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
-+void pax_check_alloca(unsigned long size)
-+{
-+ unsigned long sp = (unsigned long)&sp, stack_left;
-+
-+ /* all kernel stacks are of the same size */
-+ stack_left = sp & (THREAD_SIZE - 1);
-+ BUG_ON(stack_left < 256 || size >= stack_left - 256);
-+}
-+EXPORT_SYMBOL(pax_check_alloca);
-+#endif
-+
- int is_valid_bugaddr(unsigned long ip)
- {
- unsigned short ud2;
-
-+ ip = ktla_ktva(ip);
- if (ip < PAGE_OFFSET)
- return 0;
- if (probe_kernel_address((unsigned short *)ip, ud2))
-diff --git a/arch/x86/kernel/dumpstack_64.c b/arch/x86/kernel/dumpstack_64.c
-index a071e6b..1ad66d7 100644
---- a/arch/x86/kernel/dumpstack_64.c
-+++ b/arch/x86/kernel/dumpstack_64.c
-@@ -116,8 +116,8 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
- unsigned long *irq_stack_end =
- (unsigned long *)per_cpu(irq_stack_ptr, cpu);
- unsigned used = 0;
-- struct thread_info *tinfo;
- int graph = 0;
-+ void *stack_start;
-
- if (!task)
- task = current;
-@@ -146,10 +146,10 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
- * current stack address. If the stacks consist of nested
- * exceptions
- */
-- tinfo = task_thread_info(task);
- for (;;) {
- char *id;
- unsigned long *estack_end;
-+
- estack_end = in_exception_stack(cpu, (unsigned long)stack,
- &used, &id);
-
-@@ -157,7 +157,7 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
- if (ops->stack(data, id) < 0)
- break;
-
-- bp = print_context_stack(tinfo, stack, bp, ops,
-+ bp = print_context_stack(task, estack_end - EXCEPTION_STKSZ, stack, bp, ops,
- data, estack_end, &graph);
- ops->stack(data, "<EOE>");
- /*
-@@ -165,6 +165,8 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
- * second-to-last pointer (index -2 to end) in the
- * exception stack:
- */
-+ if ((u16)estack_end[-1] != __KERNEL_DS)
-+ goto out;
- stack = (unsigned long *) estack_end[-2];
- continue;
- }
-@@ -176,7 +178,7 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
- if (stack >= irq_stack && stack < irq_stack_end) {
- if (ops->stack(data, "IRQ") < 0)
- break;
-- bp = print_context_stack(tinfo, stack, bp,
-+ bp = print_context_stack(task, irq_stack, stack, bp,
- ops, data, irq_stack_end, &graph);
- /*
- * We link to the next stack (which would be
-@@ -195,7 +197,9 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
- /*
- * This handles the process stack:
- */
-- bp = print_context_stack(tinfo, stack, bp, ops, data, NULL, &graph);
-+ stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
-+ bp = print_context_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
-+out:
- put_cpu();
- }
- EXPORT_SYMBOL(dump_trace);
-@@ -248,7 +252,7 @@ void show_registers(struct pt_regs *regs)
- {
- int i;
- unsigned long sp;
-- const int cpu = smp_processor_id();
-+ const int cpu = raw_smp_processor_id();
- struct task_struct *cur = current;
-
- sp = regs->sp;
-@@ -304,3 +308,50 @@ int is_valid_bugaddr(unsigned long ip)
- return ud2 == 0x0b0f;
- }
-
-+
-+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
-+void pax_check_alloca(unsigned long size)
-+{
-+ unsigned long sp = (unsigned long)&sp, stack_start, stack_end;
-+ unsigned cpu, used;
-+ char *id;
-+
-+ /* check the process stack first */
-+ stack_start = (unsigned long)task_stack_page(current);
-+ stack_end = stack_start + THREAD_SIZE;
-+ if (likely(stack_start <= sp && sp < stack_end)) {
-+ unsigned long stack_left = sp & (THREAD_SIZE - 1);
-+ BUG_ON(stack_left < 256 || size >= stack_left - 256);
-+ return;
-+ }
-+
-+ cpu = get_cpu();
-+
-+ /* check the irq stacks */
-+ stack_end = (unsigned long)per_cpu(irq_stack_ptr, cpu);
-+ stack_start = stack_end - IRQ_STACK_SIZE;
-+ if (stack_start <= sp && sp < stack_end) {
-+ unsigned long stack_left = sp & (IRQ_STACK_SIZE - 1);
-+ put_cpu();
-+ BUG_ON(stack_left < 256 || size >= stack_left - 256);
-+ return;
-+ }
-+
-+ /* check the exception stacks */
-+ used = 0;
-+ stack_end = (unsigned long)in_exception_stack(cpu, sp, &used, &id);
-+ stack_start = stack_end - EXCEPTION_STKSZ;
-+ if (stack_end && stack_start <= sp && sp < stack_end) {
-+ unsigned long stack_left = sp & (EXCEPTION_STKSZ - 1);
-+ put_cpu();
-+ BUG_ON(stack_left < 256 || size >= stack_left - 256);
-+ return;
-+ }
-+
-+ put_cpu();
-+
-+ /* unknown stack */
-+ BUG();
-+}
-+EXPORT_SYMBOL(pax_check_alloca);
-+#endif
-diff --git a/arch/x86/kernel/e820.c b/arch/x86/kernel/e820.c
-index a89739a..95e0c48 100644
---- a/arch/x86/kernel/e820.c
-+++ b/arch/x86/kernel/e820.c
-@@ -733,7 +733,7 @@ struct early_res {
- };
- static struct early_res early_res[MAX_EARLY_RES] __initdata = {
- { 0, PAGE_SIZE, "BIOS data page" }, /* BIOS data page */
-- {}
-+ { 0, 0, {0}, 0 }
- };
-
- static int __init find_overlapped_early(u64 start, u64 end)
-diff --git a/arch/x86/kernel/early_printk.c b/arch/x86/kernel/early_printk.c
-index b9c830c..1e41a96 100644
---- a/arch/x86/kernel/early_printk.c
-+++ b/arch/x86/kernel/early_printk.c
-@@ -7,6 +7,7 @@
- #include <linux/pci_regs.h>
- #include <linux/pci_ids.h>
- #include <linux/errno.h>
-+#include <linux/sched.h>
- #include <asm/io.h>
- #include <asm/processor.h>
- #include <asm/fcntl.h>
-@@ -170,6 +171,8 @@ asmlinkage void early_printk(const char *fmt, ...)
- int n;
- va_list ap;
-
-+ pax_track_stack();
-+
- va_start(ap, fmt);
- n = vscnprintf(buf, sizeof(buf), fmt, ap);
- early_console->write(early_console, buf, n);
-diff --git a/arch/x86/kernel/efi_32.c b/arch/x86/kernel/efi_32.c
-index 5cab48e..b025f9b 100644
---- a/arch/x86/kernel/efi_32.c
-+++ b/arch/x86/kernel/efi_32.c
-@@ -38,70 +38,56 @@
- */
-
- static unsigned long efi_rt_eflags;
--static pgd_t efi_bak_pg_dir_pointer[2];
-+static pgd_t __initdata efi_bak_pg_dir_pointer[KERNEL_PGD_PTRS];
-
--void efi_call_phys_prelog(void)
-+void __init efi_call_phys_prelog(void)
- {
-- unsigned long cr4;
-- unsigned long temp;
- struct desc_ptr gdt_descr;
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+ struct desc_struct d;
-+#endif
-+
- local_irq_save(efi_rt_eflags);
-
-- /*
-- * If I don't have PAE, I should just duplicate two entries in page
-- * directory. If I have PAE, I just need to duplicate one entry in
-- * page directory.
-- */
-- cr4 = read_cr4_safe();
--
-- if (cr4 & X86_CR4_PAE) {
-- efi_bak_pg_dir_pointer[0].pgd =
-- swapper_pg_dir[pgd_index(0)].pgd;
-- swapper_pg_dir[0].pgd =
-- swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
-- } else {
-- efi_bak_pg_dir_pointer[0].pgd =
-- swapper_pg_dir[pgd_index(0)].pgd;
-- efi_bak_pg_dir_pointer[1].pgd =
-- swapper_pg_dir[pgd_index(0x400000)].pgd;
-- swapper_pg_dir[pgd_index(0)].pgd =
-- swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
-- temp = PAGE_OFFSET + 0x400000;
-- swapper_pg_dir[pgd_index(0x400000)].pgd =
-- swapper_pg_dir[pgd_index(temp)].pgd;
-- }
-+ clone_pgd_range(efi_bak_pg_dir_pointer, swapper_pg_dir, KERNEL_PGD_PTRS);
-+ clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-+ min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
-
- /*
- * After the lock is released, the original page table is restored.
- */
- __flush_tlb_all();
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+ pack_descriptor(&d, 0, 0xFFFFF, 0x9B, 0xC);
-+ write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_CS, &d, DESCTYPE_S);
-+ pack_descriptor(&d, 0, 0xFFFFF, 0x93, 0xC);
-+ write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_DS, &d, DESCTYPE_S);
-+#endif
-+
- gdt_descr.address = __pa(get_cpu_gdt_table(0));
- gdt_descr.size = GDT_SIZE - 1;
- load_gdt(&gdt_descr);
- }
-
--void efi_call_phys_epilog(void)
-+void __init efi_call_phys_epilog(void)
- {
-- unsigned long cr4;
- struct desc_ptr gdt_descr;
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+ struct desc_struct d;
-+
-+ memset(&d, 0, sizeof d);
-+ write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_CS, &d, DESCTYPE_S);
-+ write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_DS, &d, DESCTYPE_S);
-+#endif
-+
- gdt_descr.address = (unsigned long)get_cpu_gdt_table(0);
- gdt_descr.size = GDT_SIZE - 1;
- load_gdt(&gdt_descr);
-
-- cr4 = read_cr4_safe();
--
-- if (cr4 & X86_CR4_PAE) {
-- swapper_pg_dir[pgd_index(0)].pgd =
-- efi_bak_pg_dir_pointer[0].pgd;
-- } else {
-- swapper_pg_dir[pgd_index(0)].pgd =
-- efi_bak_pg_dir_pointer[0].pgd;
-- swapper_pg_dir[pgd_index(0x400000)].pgd =
-- efi_bak_pg_dir_pointer[1].pgd;
-- }
-+ clone_pgd_range(swapper_pg_dir, efi_bak_pg_dir_pointer, KERNEL_PGD_PTRS);
-
- /*
- * After the lock is released, the original page table is restored.
-diff --git a/arch/x86/kernel/efi_stub_32.S b/arch/x86/kernel/efi_stub_32.S
-index fbe66e6..eae5e38 100644
---- a/arch/x86/kernel/efi_stub_32.S
-+++ b/arch/x86/kernel/efi_stub_32.S
-@@ -6,7 +6,9 @@
- */
-
- #include <linux/linkage.h>
-+#include <linux/init.h>
- #include <asm/page_types.h>
-+#include <asm/segment.h>
-
- /*
- * efi_call_phys(void *, ...) is a function with variable parameters.
-@@ -20,7 +22,7 @@
- * service functions will comply with gcc calling convention, too.
- */
-
--.text
-+__INIT
- ENTRY(efi_call_phys)
- /*
- * 0. The function can only be called in Linux kernel. So CS has been
-@@ -36,10 +38,24 @@ ENTRY(efi_call_phys)
- * The mapping of lower virtual memory has been created in prelog and
- * epilog.
- */
-- movl $1f, %edx
-- subl $__PAGE_OFFSET, %edx
-- jmp *%edx
-+#ifdef CONFIG_PAX_KERNEXEC
-+ movl $(__KERNEXEC_EFI_DS), %edx
-+ mov %edx, %ds
-+ mov %edx, %es
-+ mov %edx, %ss
-+ addl $2f,(1f)
-+ ljmp *(1f)
-+
-+__INITDATA
-+1: .long __LOAD_PHYSICAL_ADDR, __KERNEXEC_EFI_CS
-+.previous
-+
-+2:
-+ subl $2b,(1b)
-+#else
-+ jmp 1f-__PAGE_OFFSET
- 1:
-+#endif
-
- /*
- * 2. Now on the top of stack is the return
-@@ -47,14 +63,8 @@ ENTRY(efi_call_phys)
- * parameter 2, ..., param n. To make things easy, we save the return
- * address of efi_call_phys in a global variable.
- */
-- popl %edx
-- movl %edx, saved_return_addr
-- /* get the function pointer into ECX*/
-- popl %ecx
-- movl %ecx, efi_rt_function_ptr
-- movl $2f, %edx
-- subl $__PAGE_OFFSET, %edx
-- pushl %edx
-+ popl (saved_return_addr)
-+ popl (efi_rt_function_ptr)
-
- /*
- * 3. Clear PG bit in %CR0.
-@@ -73,9 +83,8 @@ ENTRY(efi_call_phys)
- /*
- * 5. Call the physical function.
- */
-- jmp *%ecx
-+ call *(efi_rt_function_ptr-__PAGE_OFFSET)
-
--2:
- /*
- * 6. After EFI runtime service returns, control will return to
- * following instruction. We'd better readjust stack pointer first.
-@@ -88,35 +97,36 @@ ENTRY(efi_call_phys)
- movl %cr0, %edx
- orl $0x80000000, %edx
- movl %edx, %cr0
-- jmp 1f
--1:
-+
- /*
- * 8. Now restore the virtual mode from flat mode by
- * adding EIP with PAGE_OFFSET.
- */
-- movl $1f, %edx
-- jmp *%edx
-+#ifdef CONFIG_PAX_KERNEXEC
-+ movl $(__KERNEL_DS), %edx
-+ mov %edx, %ds
-+ mov %edx, %es
-+ mov %edx, %ss
-+ ljmp $(__KERNEL_CS),$1f
-+#else
-+ jmp 1f+__PAGE_OFFSET
-+#endif
- 1:
-
- /*
- * 9. Balance the stack. And because EAX contain the return value,
- * we'd better not clobber it.
- */
-- leal efi_rt_function_ptr, %edx
-- movl (%edx), %ecx
-- pushl %ecx
-+ pushl (efi_rt_function_ptr)
-
- /*
-- * 10. Push the saved return address onto the stack and return.
-+ * 10. Return to the saved return address.
- */
-- leal saved_return_addr, %edx
-- movl (%edx), %ecx
-- pushl %ecx
-- ret
-+ jmpl *(saved_return_addr)
- ENDPROC(efi_call_phys)
- .previous
-
--.data
-+__INITDATA
- saved_return_addr:
- .long 0
- efi_rt_function_ptr:
-diff --git a/arch/x86/kernel/efi_stub_64.S b/arch/x86/kernel/efi_stub_64.S
-index 4c07cca..2c8427d 100644
---- a/arch/x86/kernel/efi_stub_64.S
-+++ b/arch/x86/kernel/efi_stub_64.S
-@@ -7,6 +7,7 @@
- */
-
- #include <linux/linkage.h>
-+#include <asm/alternative-asm.h>
-
- #define SAVE_XMM \
- mov %rsp, %rax; \
-@@ -40,6 +41,7 @@ ENTRY(efi_call0)
- call *%rdi
- addq $32, %rsp
- RESTORE_XMM
-+ pax_force_retaddr 0, 1
- ret
- ENDPROC(efi_call0)
-
-@@ -50,6 +52,7 @@ ENTRY(efi_call1)
- call *%rdi
- addq $32, %rsp
- RESTORE_XMM
-+ pax_force_retaddr 0, 1
- ret
- ENDPROC(efi_call1)
-
-@@ -60,6 +63,7 @@ ENTRY(efi_call2)
- call *%rdi
- addq $32, %rsp
- RESTORE_XMM
-+ pax_force_retaddr 0, 1
- ret
- ENDPROC(efi_call2)
-
-@@ -71,6 +75,7 @@ ENTRY(efi_call3)
- call *%rdi
- addq $32, %rsp
- RESTORE_XMM
-+ pax_force_retaddr 0, 1
- ret
- ENDPROC(efi_call3)
-
-@@ -83,6 +88,7 @@ ENTRY(efi_call4)
- call *%rdi
- addq $32, %rsp
- RESTORE_XMM
-+ pax_force_retaddr 0, 1
- ret
- ENDPROC(efi_call4)
-
-@@ -96,6 +102,7 @@ ENTRY(efi_call5)
- call *%rdi
- addq $48, %rsp
- RESTORE_XMM
-+ pax_force_retaddr 0, 1
- ret
- ENDPROC(efi_call5)
-
-@@ -112,5 +119,6 @@ ENTRY(efi_call6)
- call *%rdi
- addq $48, %rsp
- RESTORE_XMM
-+ pax_force_retaddr 0, 1
- ret
- ENDPROC(efi_call6)
-diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
-index c097e7d..a3f1930 100644
---- a/arch/x86/kernel/entry_32.S
-+++ b/arch/x86/kernel/entry_32.S
-@@ -95,12 +95,6 @@
- #endif
- .endm
-
--#ifdef CONFIG_VM86
--#define resume_userspace_sig check_userspace
--#else
--#define resume_userspace_sig resume_userspace
--#endif
--
- /*
- * User gs save/restore
- *
-@@ -185,13 +179,153 @@
- /*CFI_REL_OFFSET gs, PT_GS*/
- .endm
- .macro SET_KERNEL_GS reg
-+
-+#ifdef CONFIG_CC_STACKPROTECTOR
- movl $(__KERNEL_STACK_CANARY), \reg
-+#elif defined(CONFIG_PAX_MEMORY_UDEREF)
-+ movl $(__USER_DS), \reg
-+#else
-+ xorl \reg, \reg
-+#endif
-+
- movl \reg, %gs
- .endm
-
- #endif /* CONFIG_X86_32_LAZY_GS */
-
--.macro SAVE_ALL
-+.macro pax_enter_kernel
-+#ifdef CONFIG_PAX_KERNEXEC
-+ call pax_enter_kernel
-+#endif
-+.endm
-+
-+.macro pax_exit_kernel
-+#ifdef CONFIG_PAX_KERNEXEC
-+ call pax_exit_kernel
-+#endif
-+.endm
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ENTRY(pax_enter_kernel)
-+#ifdef CONFIG_PARAVIRT
-+ pushl %eax
-+ pushl %ecx
-+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0)
-+ mov %eax, %esi
-+#else
-+ mov %cr0, %esi
-+#endif
-+ bts $16, %esi
-+ jnc 1f
-+ mov %cs, %esi
-+ cmp $__KERNEL_CS, %esi
-+ jz 3f
-+ ljmp $__KERNEL_CS, $3f
-+1: ljmp $__KERNEXEC_KERNEL_CS, $2f
-+2:
-+#ifdef CONFIG_PARAVIRT
-+ mov %esi, %eax
-+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
-+#else
-+ mov %esi, %cr0
-+#endif
-+3:
-+#ifdef CONFIG_PARAVIRT
-+ popl %ecx
-+ popl %eax
-+#endif
-+ ret
-+ENDPROC(pax_enter_kernel)
-+
-+ENTRY(pax_exit_kernel)
-+#ifdef CONFIG_PARAVIRT
-+ pushl %eax
-+ pushl %ecx
-+#endif
-+ mov %cs, %esi
-+ cmp $__KERNEXEC_KERNEL_CS, %esi
-+ jnz 2f
-+#ifdef CONFIG_PARAVIRT
-+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);
-+ mov %eax, %esi
-+#else
-+ mov %cr0, %esi
-+#endif
-+ btr $16, %esi
-+ ljmp $__KERNEL_CS, $1f
-+1:
-+#ifdef CONFIG_PARAVIRT
-+ mov %esi, %eax
-+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0);
-+#else
-+ mov %esi, %cr0
-+#endif
-+2:
-+#ifdef CONFIG_PARAVIRT
-+ popl %ecx
-+ popl %eax
-+#endif
-+ ret
-+ENDPROC(pax_exit_kernel)
-+#endif
-+
-+.macro pax_erase_kstack
-+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
-+ call pax_erase_kstack
-+#endif
-+.endm
-+
-+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
-+/*
-+ * ebp: thread_info
-+ */
-+ENTRY(pax_erase_kstack)
-+ pushl %edi
-+ pushl %ecx
-+ pushl %eax
-+
-+ mov TI_lowest_stack(%ebp), %edi
-+ mov $-0xBEEF, %eax
-+ std
-+
-+1: mov %edi, %ecx
-+ and $THREAD_SIZE_asm - 1, %ecx
-+ shr $2, %ecx
-+ repne scasl
-+ jecxz 2f
-+
-+ cmp $2*16, %ecx
-+ jc 2f
-+
-+ mov $2*16, %ecx
-+ repe scasl
-+ jecxz 2f
-+ jne 1b
-+
-+2: cld
-+ mov %esp, %ecx
-+ sub %edi, %ecx
-+
-+ cmp $THREAD_SIZE_asm, %ecx
-+ jb 3f
-+ ud2
-+3:
-+
-+ shr $2, %ecx
-+ rep stosl
-+
-+ mov TI_task_thread_sp0(%ebp), %edi
-+ sub $128, %edi
-+ mov %edi, TI_lowest_stack(%ebp)
-+
-+ popl %eax
-+ popl %ecx
-+ popl %edi
-+ ret
-+ENDPROC(pax_erase_kstack)
-+#endif
-+
-+.macro __SAVE_ALL _DS
- cld
- PUSH_GS
- pushl %fs
-@@ -224,7 +358,7 @@
- pushl %ebx
- CFI_ADJUST_CFA_OFFSET 4
- CFI_REL_OFFSET ebx, 0
-- movl $(__USER_DS), %edx
-+ movl $\_DS, %edx
- movl %edx, %ds
- movl %edx, %es
- movl $(__KERNEL_PERCPU), %edx
-@@ -232,6 +366,15 @@
- SET_KERNEL_GS %edx
- .endm
-
-+.macro SAVE_ALL
-+#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
-+ __SAVE_ALL __KERNEL_DS
-+ pax_enter_kernel
-+#else
-+ __SAVE_ALL __USER_DS
-+#endif
-+.endm
-+
- .macro RESTORE_INT_REGS
- popl %ebx
- CFI_ADJUST_CFA_OFFSET -4
-@@ -331,7 +474,7 @@ ENTRY(ret_from_fork)
- CFI_ADJUST_CFA_OFFSET -4
- jmp syscall_exit
- CFI_ENDPROC
--END(ret_from_fork)
-+ENDPROC(ret_from_fork)
-
- /*
- * Return to user mode is not as complex as all this looks,
-@@ -347,12 +490,29 @@ ret_from_exception:
- preempt_stop(CLBR_ANY)
- ret_from_intr:
- GET_THREAD_INFO(%ebp)
--check_userspace:
-+resume_userspace_sig:
-+#ifdef CONFIG_VM86
- movl PT_EFLAGS(%esp), %eax # mix EFLAGS and CS
- movb PT_CS(%esp), %al
- andl $(X86_EFLAGS_VM | SEGMENT_RPL_MASK), %eax
-+#else
-+ /*
-+ * We can be coming here from a syscall done in the kernel space,
-+ * e.g. a failed kernel_execve().
-+ */
-+ movl PT_CS(%esp), %eax
-+ andl $SEGMENT_RPL_MASK, %eax
-+#endif
- cmpl $USER_RPL, %eax
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ jae resume_userspace
-+
-+ pax_exit_kernel
-+ jmp resume_kernel
-+#else
- jb resume_kernel # not returning to v8086 or userspace
-+#endif
-
- ENTRY(resume_userspace)
- LOCKDEP_SYS_EXIT
-@@ -364,8 +524,8 @@ ENTRY(resume_userspace)
- andl $_TIF_WORK_MASK, %ecx # is there any work to be done on
- # int/exception return?
- jne work_pending
-- jmp restore_all
--END(ret_from_exception)
-+ jmp restore_all_pax
-+ENDPROC(ret_from_exception)
-
- #ifdef CONFIG_PREEMPT
- ENTRY(resume_kernel)
-@@ -380,7 +540,7 @@ need_resched:
- jz restore_all
- call preempt_schedule_irq
- jmp need_resched
--END(resume_kernel)
-+ENDPROC(resume_kernel)
- #endif
- CFI_ENDPROC
-
-@@ -414,25 +574,36 @@ sysenter_past_esp:
- /*CFI_REL_OFFSET cs, 0*/
- /*
- * Push current_thread_info()->sysenter_return to the stack.
-- * A tiny bit of offset fixup is necessary - 4*4 means the 4 words
-- * pushed above; +8 corresponds to copy_thread's esp0 setting.
- */
-- pushl (TI_sysenter_return-THREAD_SIZE+8+4*4)(%esp)
-+ pushl $0
- CFI_ADJUST_CFA_OFFSET 4
- CFI_REL_OFFSET eip, 0
-
- pushl %eax
- CFI_ADJUST_CFA_OFFSET 4
- SAVE_ALL
-+ GET_THREAD_INFO(%ebp)
-+ movl TI_sysenter_return(%ebp),%ebp
-+ movl %ebp,PT_EIP(%esp)
- ENABLE_INTERRUPTS(CLBR_NONE)
-
- /*
- * Load the potential sixth argument from user stack.
- * Careful about security.
- */
-+ movl PT_OLDESP(%esp),%ebp
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ mov PT_OLDSS(%esp),%ds
-+1: movl %ds:(%ebp),%ebp
-+ push %ss
-+ pop %ds
-+#else
- cmpl $__PAGE_OFFSET-3,%ebp
- jae syscall_fault
- 1: movl (%ebp),%ebp
-+#endif
-+
- movl %ebp,PT_EBP(%esp)
- .section __ex_table,"a"
- .align 4
-@@ -441,6 +612,10 @@ sysenter_past_esp:
-
- GET_THREAD_INFO(%ebp)
-
-+#ifdef CONFIG_PAX_RANDKSTACK
-+ pax_erase_kstack
-+#endif
-+
- testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%ebp)
- jnz sysenter_audit
- sysenter_do_call:
-@@ -455,12 +630,24 @@ sysenter_do_call:
- testl $_TIF_ALLWORK_MASK, %ecx
- jne sysexit_audit
- sysenter_exit:
-+
-+#ifdef CONFIG_PAX_RANDKSTACK
-+ pushl_cfi %eax
-+ movl %esp, %eax
-+ call pax_randomize_kstack
-+ popl_cfi %eax
-+#endif
-+
-+ pax_erase_kstack
-+
- /* if something modifies registers it must also disable sysexit */
- movl PT_EIP(%esp), %edx
- movl PT_OLDESP(%esp), %ecx
- xorl %ebp,%ebp
- TRACE_IRQS_ON
- 1: mov PT_FS(%esp), %fs
-+2: mov PT_DS(%esp), %ds
-+3: mov PT_ES(%esp), %es
- PTGS_TO_GS
- ENABLE_INTERRUPTS_SYSEXIT
-
-@@ -477,6 +664,9 @@ sysenter_audit:
- movl %eax,%edx /* 2nd arg: syscall number */
- movl $AUDIT_ARCH_I386,%eax /* 1st arg: audit arch */
- call audit_syscall_entry
-+
-+ pax_erase_kstack
-+
- pushl %ebx
- CFI_ADJUST_CFA_OFFSET 4
- movl PT_EAX(%esp),%eax /* reload syscall number */
-@@ -504,11 +694,17 @@ sysexit_audit:
-
- CFI_ENDPROC
- .pushsection .fixup,"ax"
--2: movl $0,PT_FS(%esp)
-+4: movl $0,PT_FS(%esp)
-+ jmp 1b
-+5: movl $0,PT_DS(%esp)
-+ jmp 1b
-+6: movl $0,PT_ES(%esp)
- jmp 1b
- .section __ex_table,"a"
- .align 4
-- .long 1b,2b
-+ .long 1b,4b
-+ .long 2b,5b
-+ .long 3b,6b
- .popsection
- PTGS_TO_GS_EX
- ENDPROC(ia32_sysenter_target)
-@@ -520,6 +716,11 @@ ENTRY(system_call)
- CFI_ADJUST_CFA_OFFSET 4
- SAVE_ALL
- GET_THREAD_INFO(%ebp)
-+
-+#ifdef CONFIG_PAX_RANDKSTACK
-+ pax_erase_kstack
-+#endif
-+
- # system call tracing in operation / emulation
- testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%ebp)
- jnz syscall_trace_entry
-@@ -538,6 +739,15 @@ syscall_exit:
- testl $_TIF_ALLWORK_MASK, %ecx # current->work
- jne syscall_exit_work
-
-+restore_all_pax:
-+
-+#ifdef CONFIG_PAX_RANDKSTACK
-+ movl %esp, %eax
-+ call pax_randomize_kstack
-+#endif
-+
-+ pax_erase_kstack
-+
- restore_all:
- TRACE_IRQS_IRET
- restore_all_notrace:
-@@ -602,10 +812,29 @@ ldt_ss:
- mov PT_OLDESP(%esp), %eax /* load userspace esp */
- mov %dx, %ax /* eax: new kernel esp */
- sub %eax, %edx /* offset (low word is 0) */
-- PER_CPU(gdt_page, %ebx)
-+#ifdef CONFIG_SMP
-+ movl PER_CPU_VAR(cpu_number), %ebx
-+ shll $PAGE_SHIFT_asm, %ebx
-+ addl $cpu_gdt_table, %ebx
-+#else
-+ movl $cpu_gdt_table, %ebx
-+#endif
- shr $16, %edx
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ mov %cr0, %esi
-+ btr $16, %esi
-+ mov %esi, %cr0
-+#endif
-+
- mov %dl, GDT_ENTRY_ESPFIX_SS * 8 + 4(%ebx) /* bits 16..23 */
- mov %dh, GDT_ENTRY_ESPFIX_SS * 8 + 7(%ebx) /* bits 24..31 */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ bts $16, %esi
-+ mov %esi, %cr0
-+#endif
-+
- pushl $__ESPFIX_SS
- CFI_ADJUST_CFA_OFFSET 4
- push %eax /* new kernel esp */
-@@ -636,36 +865,30 @@ work_resched:
- movl TI_flags(%ebp), %ecx
- andl $_TIF_WORK_MASK, %ecx # is there any work to be done other
- # than syscall tracing?
-- jz restore_all
-+ jz restore_all_pax
- testb $_TIF_NEED_RESCHED, %cl
- jnz work_resched
-
- work_notifysig: # deal with pending signals and
- # notify-resume requests
-+ movl %esp, %eax
- #ifdef CONFIG_VM86
- testl $X86_EFLAGS_VM, PT_EFLAGS(%esp)
-- movl %esp, %eax
-- jne work_notifysig_v86 # returning to kernel-space or
-+ jz 1f # returning to kernel-space or
- # vm86-space
-- xorl %edx, %edx
-- call do_notify_resume
-- jmp resume_userspace_sig
-
-- ALIGN
--work_notifysig_v86:
- pushl %ecx # save ti_flags for do_notify_resume
- CFI_ADJUST_CFA_OFFSET 4
- call save_v86_state # %eax contains pt_regs pointer
- popl %ecx
- CFI_ADJUST_CFA_OFFSET -4
- movl %eax, %esp
--#else
-- movl %esp, %eax
-+1:
- #endif
- xorl %edx, %edx
- call do_notify_resume
- jmp resume_userspace_sig
--END(work_pending)
-+ENDPROC(work_pending)
-
- # perform syscall exit tracing
- ALIGN
-@@ -673,11 +896,14 @@ syscall_trace_entry:
- movl $-ENOSYS,PT_EAX(%esp)
- movl %esp, %eax
- call syscall_trace_enter
-+
-+ pax_erase_kstack
-+
- /* What it returned is what we'll actually use. */
- cmpl $(nr_syscalls), %eax
- jnae syscall_call
- jmp syscall_exit
--END(syscall_trace_entry)
-+ENDPROC(syscall_trace_entry)
-
- # perform syscall exit tracing
- ALIGN
-@@ -690,20 +916,24 @@ syscall_exit_work:
- movl %esp, %eax
- call syscall_trace_leave
- jmp resume_userspace
--END(syscall_exit_work)
-+ENDPROC(syscall_exit_work)
- CFI_ENDPROC
-
- RING0_INT_FRAME # can't unwind into user space anyway
- syscall_fault:
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ push %ss
-+ pop %ds
-+#endif
- GET_THREAD_INFO(%ebp)
- movl $-EFAULT,PT_EAX(%esp)
- jmp resume_userspace
--END(syscall_fault)
-+ENDPROC(syscall_fault)
-
- syscall_badsys:
- movl $-ENOSYS,PT_EAX(%esp)
- jmp resume_userspace
--END(syscall_badsys)
-+ENDPROC(syscall_badsys)
- CFI_ENDPROC
-
- /*
-@@ -726,6 +956,33 @@ PTREGSCALL(rt_sigreturn)
- PTREGSCALL(vm86)
- PTREGSCALL(vm86old)
-
-+ ALIGN;
-+ENTRY(kernel_execve)
-+ push %ebp
-+ sub $PT_OLDSS+4,%esp
-+ push %edi
-+ push %ecx
-+ push %eax
-+ lea 3*4(%esp),%edi
-+ mov $PT_OLDSS/4+1,%ecx
-+ xorl %eax,%eax
-+ rep stosl
-+ pop %eax
-+ pop %ecx
-+ pop %edi
-+ movl $X86_EFLAGS_IF,PT_EFLAGS(%esp)
-+ mov %eax,PT_EBX(%esp)
-+ mov %edx,PT_ECX(%esp)
-+ mov %ecx,PT_EDX(%esp)
-+ mov %esp,%eax
-+ call sys_execve
-+ GET_THREAD_INFO(%ebp)
-+ test %eax,%eax
-+ jz syscall_exit
-+ add $PT_OLDSS+4,%esp
-+ pop %ebp
-+ ret
-+
- .macro FIXUP_ESPFIX_STACK
- /*
- * Switch back for ESPFIX stack to the normal zerobased stack
-@@ -735,7 +992,13 @@ PTREGSCALL(vm86old)
- * normal stack and adjusts ESP with the matching offset.
- */
- /* fixup the stack */
-- PER_CPU(gdt_page, %ebx)
-+#ifdef CONFIG_SMP
-+ movl PER_CPU_VAR(cpu_number), %ebx
-+ shll $PAGE_SHIFT_asm, %ebx
-+ addl $cpu_gdt_table, %ebx
-+#else
-+ movl $cpu_gdt_table, %ebx
-+#endif
- mov GDT_ENTRY_ESPFIX_SS * 8 + 4(%ebx), %al /* bits 16..23 */
- mov GDT_ENTRY_ESPFIX_SS * 8 + 7(%ebx), %ah /* bits 24..31 */
- shl $16, %eax
-@@ -793,7 +1056,7 @@ vector=vector+1
- .endr
- 2: jmp common_interrupt
- .endr
--END(irq_entries_start)
-+ENDPROC(irq_entries_start)
-
- .previous
- END(interrupt)
-@@ -840,7 +1103,7 @@ ENTRY(coprocessor_error)
- CFI_ADJUST_CFA_OFFSET 4
- jmp error_code
- CFI_ENDPROC
--END(coprocessor_error)
-+ENDPROC(coprocessor_error)
-
- ENTRY(simd_coprocessor_error)
- RING0_INT_FRAME
-@@ -850,7 +1113,7 @@ ENTRY(simd_coprocessor_error)
- CFI_ADJUST_CFA_OFFSET 4
- jmp error_code
- CFI_ENDPROC
--END(simd_coprocessor_error)
-+ENDPROC(simd_coprocessor_error)
-
- ENTRY(device_not_available)
- RING0_INT_FRAME
-@@ -860,7 +1123,7 @@ ENTRY(device_not_available)
- CFI_ADJUST_CFA_OFFSET 4
- jmp error_code
- CFI_ENDPROC
--END(device_not_available)
-+ENDPROC(device_not_available)
-
- #ifdef CONFIG_PARAVIRT
- ENTRY(native_iret)
-@@ -869,12 +1132,12 @@ ENTRY(native_iret)
- .align 4
- .long native_iret, iret_exc
- .previous
--END(native_iret)
-+ENDPROC(native_iret)
-
- ENTRY(native_irq_enable_sysexit)
- sti
- sysexit
--END(native_irq_enable_sysexit)
-+ENDPROC(native_irq_enable_sysexit)
- #endif
-
- ENTRY(overflow)
-@@ -885,7 +1148,7 @@ ENTRY(overflow)
- CFI_ADJUST_CFA_OFFSET 4
- jmp error_code
- CFI_ENDPROC
--END(overflow)
-+ENDPROC(overflow)
-
- ENTRY(bounds)
- RING0_INT_FRAME
-@@ -895,7 +1158,7 @@ ENTRY(bounds)
- CFI_ADJUST_CFA_OFFSET 4
- jmp error_code
- CFI_ENDPROC
--END(bounds)
-+ENDPROC(bounds)
-
- ENTRY(invalid_op)
- RING0_INT_FRAME
-@@ -905,7 +1168,7 @@ ENTRY(invalid_op)
- CFI_ADJUST_CFA_OFFSET 4
- jmp error_code
- CFI_ENDPROC
--END(invalid_op)
-+ENDPROC(invalid_op)
-
- ENTRY(coprocessor_segment_overrun)
- RING0_INT_FRAME
-@@ -915,7 +1178,7 @@ ENTRY(coprocessor_segment_overrun)
- CFI_ADJUST_CFA_OFFSET 4
- jmp error_code
- CFI_ENDPROC
--END(coprocessor_segment_overrun)
-+ENDPROC(coprocessor_segment_overrun)
-
- ENTRY(invalid_TSS)
- RING0_EC_FRAME
-@@ -923,7 +1186,7 @@ ENTRY(invalid_TSS)
- CFI_ADJUST_CFA_OFFSET 4
- jmp error_code
- CFI_ENDPROC
--END(invalid_TSS)
-+ENDPROC(invalid_TSS)
-
- ENTRY(segment_not_present)
- RING0_EC_FRAME
-@@ -931,7 +1194,7 @@ ENTRY(segment_not_present)
- CFI_ADJUST_CFA_OFFSET 4
- jmp error_code
- CFI_ENDPROC
--END(segment_not_present)
-+ENDPROC(segment_not_present)
-
- ENTRY(stack_segment)
- RING0_EC_FRAME
-@@ -939,7 +1202,7 @@ ENTRY(stack_segment)
- CFI_ADJUST_CFA_OFFSET 4
- jmp error_code
- CFI_ENDPROC
--END(stack_segment)
-+ENDPROC(stack_segment)
-
- ENTRY(alignment_check)
- RING0_EC_FRAME
-@@ -947,7 +1210,7 @@ ENTRY(alignment_check)
- CFI_ADJUST_CFA_OFFSET 4
- jmp error_code
- CFI_ENDPROC
--END(alignment_check)
-+ENDPROC(alignment_check)
-
- ENTRY(divide_error)
- RING0_INT_FRAME
-@@ -957,7 +1220,7 @@ ENTRY(divide_error)
- CFI_ADJUST_CFA_OFFSET 4
- jmp error_code
- CFI_ENDPROC
--END(divide_error)
-+ENDPROC(divide_error)
-
- #ifdef CONFIG_X86_MCE
- ENTRY(machine_check)
-@@ -968,7 +1231,7 @@ ENTRY(machine_check)
- CFI_ADJUST_CFA_OFFSET 4
- jmp error_code
- CFI_ENDPROC
--END(machine_check)
-+ENDPROC(machine_check)
- #endif
-
- ENTRY(spurious_interrupt_bug)
-@@ -979,7 +1242,7 @@ ENTRY(spurious_interrupt_bug)
- CFI_ADJUST_CFA_OFFSET 4
- jmp error_code
- CFI_ENDPROC
--END(spurious_interrupt_bug)
-+ENDPROC(spurious_interrupt_bug)
-
- ENTRY(kernel_thread_helper)
- pushl $0 # fake return address for unwinder
-@@ -1095,7 +1358,7 @@ ENDPROC(xen_failsafe_callback)
-
- ENTRY(mcount)
- ret
--END(mcount)
-+ENDPROC(mcount)
-
- ENTRY(ftrace_caller)
- cmpl $0, function_trace_stop
-@@ -1124,7 +1387,7 @@ ftrace_graph_call:
- .globl ftrace_stub
- ftrace_stub:
- ret
--END(ftrace_caller)
-+ENDPROC(ftrace_caller)
-
- #else /* ! CONFIG_DYNAMIC_FTRACE */
-
-@@ -1160,7 +1423,7 @@ trace:
- popl %ecx
- popl %eax
- jmp ftrace_stub
--END(mcount)
-+ENDPROC(mcount)
- #endif /* CONFIG_DYNAMIC_FTRACE */
- #endif /* CONFIG_FUNCTION_TRACER */
-
-@@ -1181,7 +1444,7 @@ ENTRY(ftrace_graph_caller)
- popl %ecx
- popl %eax
- ret
--END(ftrace_graph_caller)
-+ENDPROC(ftrace_graph_caller)
-
- .globl return_to_handler
- return_to_handler:
-@@ -1198,7 +1461,6 @@ return_to_handler:
- ret
- #endif
-
--.section .rodata,"a"
- #include "syscall_table_32.S"
-
- syscall_table_size=(.-sys_call_table)
-@@ -1255,15 +1517,18 @@ error_code:
- movl $-1, PT_ORIG_EAX(%esp) # no syscall to restart
- REG_TO_PTGS %ecx
- SET_KERNEL_GS %ecx
-- movl $(__USER_DS), %ecx
-+ movl $(__KERNEL_DS), %ecx
- movl %ecx, %ds
- movl %ecx, %es
-+
-+ pax_enter_kernel
-+
- TRACE_IRQS_OFF
- movl %esp,%eax # pt_regs pointer
- call *%edi
- jmp ret_from_exception
- CFI_ENDPROC
--END(page_fault)
-+ENDPROC(page_fault)
-
- /*
- * Debug traps and NMI can happen at the one SYSENTER instruction
-@@ -1309,7 +1574,7 @@ debug_stack_correct:
- call do_debug
- jmp ret_from_exception
- CFI_ENDPROC
--END(debug)
-+ENDPROC(debug)
-
- /*
- * NMI is doubly nasty. It can happen _while_ we're handling
-@@ -1351,6 +1616,9 @@ nmi_stack_correct:
- xorl %edx,%edx # zero error code
- movl %esp,%eax # pt_regs pointer
- call do_nmi
-+
-+ pax_exit_kernel
-+
- jmp restore_all_notrace
- CFI_ENDPROC
-
-@@ -1391,12 +1659,15 @@ nmi_espfix_stack:
- FIXUP_ESPFIX_STACK # %eax == %esp
- xorl %edx,%edx # zero error code
- call do_nmi
-+
-+ pax_exit_kernel
-+
- RESTORE_REGS
- lss 12+4(%esp), %esp # back to espfix stack
- CFI_ADJUST_CFA_OFFSET -24
- jmp irq_return
- CFI_ENDPROC
--END(nmi)
-+ENDPROC(nmi)
-
- ENTRY(int3)
- RING0_INT_FRAME
-@@ -1409,7 +1680,7 @@ ENTRY(int3)
- call do_int3
- jmp ret_from_exception
- CFI_ENDPROC
--END(int3)
-+ENDPROC(int3)
-
- ENTRY(general_protection)
- RING0_EC_FRAME
-@@ -1417,7 +1688,7 @@ ENTRY(general_protection)
- CFI_ADJUST_CFA_OFFSET 4
- jmp error_code
- CFI_ENDPROC
--END(general_protection)
-+ENDPROC(general_protection)
-
- /*
- * End of kprobes section
-diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
-index 34a56a9..7da97ae 100644
---- a/arch/x86/kernel/entry_64.S
-+++ b/arch/x86/kernel/entry_64.S
-@@ -53,6 +53,8 @@
- #include <asm/paravirt.h>
- #include <asm/ftrace.h>
- #include <asm/percpu.h>
-+#include <asm/pgtable.h>
-+#include <asm/alternative-asm.h>
-
- /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
- #include <linux/elf-em.h>
-@@ -64,8 +66,9 @@
- #ifdef CONFIG_FUNCTION_TRACER
- #ifdef CONFIG_DYNAMIC_FTRACE
- ENTRY(mcount)
-+ pax_force_retaddr
- retq
--END(mcount)
-+ENDPROC(mcount)
-
- ENTRY(ftrace_caller)
- cmpl $0, function_trace_stop
-@@ -88,8 +91,9 @@ GLOBAL(ftrace_graph_call)
- #endif
-
- GLOBAL(ftrace_stub)
-+ pax_force_retaddr
- retq
--END(ftrace_caller)
-+ENDPROC(ftrace_caller)
-
- #else /* ! CONFIG_DYNAMIC_FTRACE */
- ENTRY(mcount)
-@@ -108,6 +112,7 @@ ENTRY(mcount)
- #endif
-
- GLOBAL(ftrace_stub)
-+ pax_force_retaddr
- retq
-
- trace:
-@@ -117,12 +122,13 @@ trace:
- movq 8(%rbp), %rsi
- subq $MCOUNT_INSN_SIZE, %rdi
-
-+ pax_force_fptr ftrace_trace_function
- call *ftrace_trace_function
-
- MCOUNT_RESTORE_FRAME
-
- jmp ftrace_stub
--END(mcount)
-+ENDPROC(mcount)
- #endif /* CONFIG_DYNAMIC_FTRACE */
- #endif /* CONFIG_FUNCTION_TRACER */
-
-@@ -142,8 +148,9 @@ ENTRY(ftrace_graph_caller)
-
- MCOUNT_RESTORE_FRAME
-
-+ pax_force_retaddr
- retq
--END(ftrace_graph_caller)
-+ENDPROC(ftrace_graph_caller)
-
- GLOBAL(return_to_handler)
- subq $24, %rsp
-@@ -159,6 +166,7 @@ GLOBAL(return_to_handler)
- movq 8(%rsp), %rdx
- movq (%rsp), %rax
- addq $16, %rsp
-+ pax_force_retaddr
- retq
- #endif
-
-@@ -174,6 +182,273 @@ ENTRY(native_usergs_sysret64)
- ENDPROC(native_usergs_sysret64)
- #endif /* CONFIG_PARAVIRT */
-
-+ .macro ljmpq sel, off
-+#if defined(CONFIG_MPSC) || defined(CONFIG_MCORE2) || defined (CONFIG_MATOM)
-+ .byte 0x48; ljmp *1234f(%rip)
-+ .pushsection .rodata
-+ .align 16
-+ 1234: .quad \off; .word \sel
-+ .popsection
-+#else
-+ pushq $\sel
-+ pushq $\off
-+ lretq
-+#endif
-+ .endm
-+
-+ .macro pax_enter_kernel
-+ pax_set_fptr_mask
-+#ifdef CONFIG_PAX_KERNEXEC
-+ call pax_enter_kernel
-+#endif
-+ .endm
-+
-+ .macro pax_exit_kernel
-+#ifdef CONFIG_PAX_KERNEXEC
-+ call pax_exit_kernel
-+#endif
-+ .endm
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ENTRY(pax_enter_kernel)
-+ pushq %rdi
-+
-+#ifdef CONFIG_PARAVIRT
-+ PV_SAVE_REGS(CLBR_RDI)
-+#endif
-+
-+ GET_CR0_INTO_RDI
-+ bts $16,%rdi
-+ jnc 3f
-+ mov %cs,%edi
-+ cmp $__KERNEL_CS,%edi
-+ jnz 2f
-+1:
-+
-+#ifdef CONFIG_PARAVIRT
-+ PV_RESTORE_REGS(CLBR_RDI)
-+#endif
-+
-+ popq %rdi
-+ pax_force_retaddr
-+ retq
-+
-+2: ljmpq __KERNEL_CS,1f
-+3: ljmpq __KERNEXEC_KERNEL_CS,4f
-+4: SET_RDI_INTO_CR0
-+ jmp 1b
-+ENDPROC(pax_enter_kernel)
-+
-+ENTRY(pax_exit_kernel)
-+ pushq %rdi
-+
-+#ifdef CONFIG_PARAVIRT
-+ PV_SAVE_REGS(CLBR_RDI)
-+#endif
-+
-+ mov %cs,%rdi
-+ cmp $__KERNEXEC_KERNEL_CS,%edi
-+ jz 2f
-+1:
-+
-+#ifdef CONFIG_PARAVIRT
-+ PV_RESTORE_REGS(CLBR_RDI);
-+#endif
-+
-+ popq %rdi
-+ pax_force_retaddr
-+ retq
-+
-+2: GET_CR0_INTO_RDI
-+ btr $16,%rdi
-+ ljmpq __KERNEL_CS,3f
-+3: SET_RDI_INTO_CR0
-+ jmp 1b
-+ENDPROC(pax_exit_kernel)
-+#endif
-+
-+ .macro pax_enter_kernel_user
-+ pax_set_fptr_mask
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ call pax_enter_kernel_user
-+#endif
-+ .endm
-+
-+ .macro pax_exit_kernel_user
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ call pax_exit_kernel_user
-+#endif
-+#ifdef CONFIG_PAX_RANDKSTACK
-+ pushq %rax
-+ call pax_randomize_kstack
-+ popq %rax
-+#endif
-+ .endm
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ENTRY(pax_enter_kernel_user)
-+ pushq %rdi
-+ pushq %rbx
-+
-+#ifdef CONFIG_PARAVIRT
-+ PV_SAVE_REGS(CLBR_RDI)
-+#endif
-+
-+ GET_CR3_INTO_RDI
-+ mov %rdi,%rbx
-+ add $__START_KERNEL_map,%rbx
-+ sub phys_base(%rip),%rbx
-+
-+#ifdef CONFIG_PARAVIRT
-+ pushq %rdi
-+ cmpl $0, pv_info+PARAVIRT_enabled
-+ jz 1f
-+ i = 0
-+ .rept USER_PGD_PTRS
-+ mov i*8(%rbx),%rsi
-+ mov $0,%sil
-+ lea i*8(%rbx),%rdi
-+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd_batched)
-+ i = i + 1
-+ .endr
-+ jmp 2f
-+1:
-+#endif
-+
-+ i = 0
-+ .rept USER_PGD_PTRS
-+ movb $0,i*8(%rbx)
-+ i = i + 1
-+ .endr
-+
-+#ifdef CONFIG_PARAVIRT
-+2: popq %rdi
-+#endif
-+ SET_RDI_INTO_CR3
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ GET_CR0_INTO_RDI
-+ bts $16,%rdi
-+ SET_RDI_INTO_CR0
-+#endif
-+
-+#ifdef CONFIG_PARAVIRT
-+ PV_RESTORE_REGS(CLBR_RDI)
-+#endif
-+
-+ popq %rbx
-+ popq %rdi
-+ pax_force_retaddr
-+ retq
-+ENDPROC(pax_enter_kernel_user)
-+
-+ENTRY(pax_exit_kernel_user)
-+ push %rdi
-+
-+#ifdef CONFIG_PARAVIRT
-+ pushq %rbx
-+ PV_SAVE_REGS(CLBR_RDI)
-+#endif
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ GET_CR0_INTO_RDI
-+ btr $16,%rdi
-+ SET_RDI_INTO_CR0
-+#endif
-+
-+ GET_CR3_INTO_RDI
-+ add $__START_KERNEL_map,%rdi
-+ sub phys_base(%rip),%rdi
-+
-+#ifdef CONFIG_PARAVIRT
-+ cmpl $0, pv_info+PARAVIRT_enabled
-+ jz 1f
-+ mov %rdi,%rbx
-+ i = 0
-+ .rept USER_PGD_PTRS
-+ mov i*8(%rbx),%rsi
-+ mov $0x67,%sil
-+ lea i*8(%rbx),%rdi
-+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd_batched)
-+ i = i + 1
-+ .endr
-+ jmp 2f
-+1:
-+#endif
-+
-+ i = 0
-+ .rept USER_PGD_PTRS
-+ movb $0x67,i*8(%rdi)
-+ i = i + 1
-+ .endr
-+
-+#ifdef CONFIG_PARAVIRT
-+2: PV_RESTORE_REGS(CLBR_RDI)
-+ popq %rbx
-+#endif
-+
-+ popq %rdi
-+ pax_force_retaddr
-+ retq
-+ENDPROC(pax_exit_kernel_user)
-+#endif
-+
-+.macro pax_erase_kstack
-+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
-+ call pax_erase_kstack
-+#endif
-+.endm
-+
-+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
-+ENTRY(pax_erase_kstack)
-+ pushq %rdi
-+ pushq %rcx
-+ pushq %rax
-+ pushq %r11
-+
-+ GET_THREAD_INFO(%r11)
-+ mov TI_lowest_stack(%r11), %rdi
-+ mov $-0xBEEF, %rax
-+ std
-+
-+1: mov %edi, %ecx
-+ and $THREAD_SIZE_asm - 1, %ecx
-+ shr $3, %ecx
-+ repne scasq
-+ jecxz 2f
-+
-+ cmp $2*8, %ecx
-+ jc 2f
-+
-+ mov $2*8, %ecx
-+ repe scasq
-+ jecxz 2f
-+ jne 1b
-+
-+2: cld
-+ mov %esp, %ecx
-+ sub %edi, %ecx
-+
-+ cmp $THREAD_SIZE_asm, %rcx
-+ jb 3f
-+ ud2
-+3:
-+
-+ shr $3, %ecx
-+ rep stosq
-+
-+ mov TI_task_thread_sp0(%r11), %rdi
-+ sub $256, %rdi
-+ mov %rdi, TI_lowest_stack(%r11)
-+
-+ popq %r11
-+ popq %rax
-+ popq %rcx
-+ popq %rdi
-+ pax_force_retaddr
-+ ret
-+ENDPROC(pax_erase_kstack)
-+#endif
-
- .macro TRACE_IRQS_IRETQ offset=ARGOFFSET
- #ifdef CONFIG_TRACE_IRQFLAGS
-@@ -233,8 +508,8 @@ ENDPROC(native_usergs_sysret64)
- .endm
-
- .macro UNFAKE_STACK_FRAME
-- addq $8*6, %rsp
-- CFI_ADJUST_CFA_OFFSET -(6*8)
-+ addq $8*6 + ARG_SKIP, %rsp
-+ CFI_ADJUST_CFA_OFFSET -(6*8 + ARG_SKIP)
- .endm
-
- /*
-@@ -317,7 +592,7 @@ ENTRY(save_args)
- leaq -ARGOFFSET+16(%rsp),%rdi /* arg1 for handler */
- movq_cfi rbp, 8 /* push %rbp */
- leaq 8(%rsp), %rbp /* mov %rsp, %ebp */
-- testl $3, CS(%rdi)
-+ testb $3, CS(%rdi)
- je 1f
- SWAPGS
- /*
-@@ -337,9 +612,10 @@ ENTRY(save_args)
- * We entered an interrupt context - irqs are off:
- */
- 2: TRACE_IRQS_OFF
-+ pax_force_retaddr_bts
- ret
- CFI_ENDPROC
--END(save_args)
-+ENDPROC(save_args)
-
- ENTRY(save_rest)
- PARTIAL_FRAME 1 REST_SKIP+8
-@@ -352,9 +628,10 @@ ENTRY(save_rest)
- movq_cfi r15, R15+16
- movq %r11, 8(%rsp) /* return address */
- FIXUP_TOP_OF_STACK %r11, 16
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
--END(save_rest)
-+ENDPROC(save_rest)
-
- /* save complete stack frame */
- .pushsection .kprobes.text, "ax"
-@@ -383,9 +660,10 @@ ENTRY(save_paranoid)
- js 1f /* negative -> in kernel */
- SWAPGS
- xorl %ebx,%ebx
--1: ret
-+1: pax_force_retaddr_bts
-+ ret
- CFI_ENDPROC
--END(save_paranoid)
-+ENDPROC(save_paranoid)
- .popsection
-
- /*
-@@ -409,7 +687,7 @@ ENTRY(ret_from_fork)
-
- RESTORE_REST
-
-- testl $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
-+ testb $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
- je int_ret_from_sys_call
-
- testl $_TIF_IA32, TI_flags(%rcx) # 32-bit compat task needs IRET
-@@ -419,7 +697,7 @@ ENTRY(ret_from_fork)
- jmp ret_from_sys_call # go to the SYSRET fastpath
-
- CFI_ENDPROC
--END(ret_from_fork)
-+ENDPROC(ret_from_fork)
-
- /*
- * System call entry. Upto 6 arguments in registers are supported.
-@@ -455,7 +733,7 @@ END(ret_from_fork)
- ENTRY(system_call)
- CFI_STARTPROC simple
- CFI_SIGNAL_FRAME
-- CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
-+ CFI_DEF_CFA rsp,0
- CFI_REGISTER rip,rcx
- /*CFI_REGISTER rflags,r11*/
- SWAPGS_UNSAFE_STACK
-@@ -468,12 +746,18 @@ ENTRY(system_call_after_swapgs)
-
- movq %rsp,PER_CPU_VAR(old_rsp)
- movq PER_CPU_VAR(kernel_stack),%rsp
-+ SAVE_ARGS 8*6,1
-+ pax_enter_kernel_user
-+
-+#ifdef CONFIG_PAX_RANDKSTACK
-+ pax_erase_kstack
-+#endif
-+
- /*
- * No need to follow this irqs off/on section - it's straight
- * and short:
- */
- ENABLE_INTERRUPTS(CLBR_NONE)
-- SAVE_ARGS 8,1
- movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
- movq %rcx,RIP-ARGOFFSET(%rsp)
- CFI_REL_OFFSET rip,RIP-ARGOFFSET
-@@ -483,7 +767,7 @@ ENTRY(system_call_after_swapgs)
- system_call_fastpath:
- cmpq $__NR_syscall_max,%rax
- ja badsys
-- movq %r10,%rcx
-+ movq R10-ARGOFFSET(%rsp),%rcx
- call *sys_call_table(,%rax,8) # XXX: rip relative
- movq %rax,RAX-ARGOFFSET(%rsp)
- /*
-@@ -502,6 +786,8 @@ sysret_check:
- andl %edi,%edx
- jnz sysret_careful
- CFI_REMEMBER_STATE
-+ pax_exit_kernel_user
-+ pax_erase_kstack
- /*
- * sysretq will re-enable interrupts:
- */
-@@ -555,14 +841,18 @@ badsys:
- * jump back to the normal fast path.
- */
- auditsys:
-- movq %r10,%r9 /* 6th arg: 4th syscall arg */
-+ movq R10-ARGOFFSET(%rsp),%r9 /* 6th arg: 4th syscall arg */
- movq %rdx,%r8 /* 5th arg: 3rd syscall arg */
- movq %rsi,%rcx /* 4th arg: 2nd syscall arg */
- movq %rdi,%rdx /* 3rd arg: 1st syscall arg */
- movq %rax,%rsi /* 2nd arg: syscall number */
- movl $AUDIT_ARCH_X86_64,%edi /* 1st arg: audit arch */
- call audit_syscall_entry
-+
-+ pax_erase_kstack
-+
- LOAD_ARGS 0 /* reload call-clobbered registers */
-+ pax_set_fptr_mask
- jmp system_call_fastpath
-
- /*
-@@ -592,16 +882,20 @@ tracesys:
- FIXUP_TOP_OF_STACK %rdi
- movq %rsp,%rdi
- call syscall_trace_enter
-+
-+ pax_erase_kstack
-+
- /*
- * Reload arg registers from stack in case ptrace changed them.
- * We don't reload %rax because syscall_trace_enter() returned
- * the value it wants us to use in the table lookup.
- */
- LOAD_ARGS ARGOFFSET, 1
-+ pax_set_fptr_mask
- RESTORE_REST
- cmpq $__NR_syscall_max,%rax
- ja int_ret_from_sys_call /* RAX(%rsp) set to -ENOSYS above */
-- movq %r10,%rcx /* fixup for C */
-+ movq R10-ARGOFFSET(%rsp),%rcx /* fixup for C */
- call *sys_call_table(,%rax,8)
- movq %rax,RAX-ARGOFFSET(%rsp)
- /* Use IRET because user could have changed frame */
-@@ -613,7 +907,7 @@ tracesys:
- GLOBAL(int_ret_from_sys_call)
- DISABLE_INTERRUPTS(CLBR_NONE)
- TRACE_IRQS_OFF
-- testl $3,CS-ARGOFFSET(%rsp)
-+ testb $3,CS-ARGOFFSET(%rsp)
- je retint_restore_args
- movl $_TIF_ALLWORK_MASK,%edi
- /* edi: mask to check */
-@@ -624,7 +918,9 @@ GLOBAL(int_with_check)
- andl %edi,%edx
- jnz int_careful
- andl $~TS_COMPAT,TI_status(%rcx)
-- jmp retint_swapgs
-+ pax_exit_kernel_user
-+ pax_erase_kstack
-+ jmp retint_swapgs_pax
-
- /* Either reschedule or signal or syscall exit tracking needed. */
- /* First do a reschedule test. */
-@@ -674,7 +970,7 @@ int_restore_rest:
- TRACE_IRQS_OFF
- jmp int_with_check
- CFI_ENDPROC
--END(system_call)
-+ENDPROC(system_call)
-
- /*
- * Certain special system calls that need to save a complete full stack frame.
-@@ -690,7 +986,7 @@ ENTRY(\label)
- call \func
- jmp ptregscall_common
- CFI_ENDPROC
--END(\label)
-+ENDPROC(\label)
- .endm
-
- PTREGSCALL stub_clone, sys_clone, %r8
-@@ -708,9 +1004,10 @@ ENTRY(ptregscall_common)
- movq_cfi_restore R12+8, r12
- movq_cfi_restore RBP+8, rbp
- movq_cfi_restore RBX+8, rbx
-+ pax_force_retaddr
- ret $REST_SKIP /* pop extended registers */
- CFI_ENDPROC
--END(ptregscall_common)
-+ENDPROC(ptregscall_common)
-
- ENTRY(stub_execve)
- CFI_STARTPROC
-@@ -726,7 +1023,7 @@ ENTRY(stub_execve)
- RESTORE_REST
- jmp int_ret_from_sys_call
- CFI_ENDPROC
--END(stub_execve)
-+ENDPROC(stub_execve)
-
- /*
- * sigreturn is special because it needs to restore all registers on return.
-@@ -744,7 +1041,7 @@ ENTRY(stub_rt_sigreturn)
- RESTORE_REST
- jmp int_ret_from_sys_call
- CFI_ENDPROC
--END(stub_rt_sigreturn)
-+ENDPROC(stub_rt_sigreturn)
-
- /*
- * Build the entry stubs and pointer table with some assembler magic.
-@@ -780,7 +1077,7 @@ vector=vector+1
- 2: jmp common_interrupt
- .endr
- CFI_ENDPROC
--END(irq_entries_start)
-+ENDPROC(irq_entries_start)
-
- .previous
- END(interrupt)
-@@ -800,6 +1097,16 @@ END(interrupt)
- CFI_ADJUST_CFA_OFFSET 10*8
- call save_args
- PARTIAL_FRAME 0
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ testb $3, CS(%rdi)
-+ jnz 1f
-+ pax_enter_kernel
-+ jmp 2f
-+1: pax_enter_kernel_user
-+2:
-+#else
-+ pax_enter_kernel
-+#endif
- call \func
- .endm
-
-@@ -822,7 +1129,7 @@ ret_from_intr:
- CFI_ADJUST_CFA_OFFSET -8
- exit_intr:
- GET_THREAD_INFO(%rcx)
-- testl $3,CS-ARGOFFSET(%rsp)
-+ testb $3,CS-ARGOFFSET(%rsp)
- je retint_kernel
-
- /* Interrupt came from user space */
-@@ -844,12 +1151,16 @@ retint_swapgs: /* return to user-space */
- * The iretq could re-enable interrupts:
- */
- DISABLE_INTERRUPTS(CLBR_ANY)
-+ pax_exit_kernel_user
-+retint_swapgs_pax:
- TRACE_IRQS_IRETQ
- SWAPGS
- jmp restore_args
-
- retint_restore_args: /* return to kernel space */
- DISABLE_INTERRUPTS(CLBR_ANY)
-+ pax_exit_kernel
-+ pax_force_retaddr (RIP-ARGOFFSET)
- /*
- * The iretq could re-enable interrupts:
- */
-@@ -940,7 +1251,7 @@ ENTRY(retint_kernel)
- #endif
-
- CFI_ENDPROC
--END(common_interrupt)
-+ENDPROC(common_interrupt)
-
- /*
- * APIC interrupts.
-@@ -953,7 +1264,7 @@ ENTRY(\sym)
- interrupt \do_sym
- jmp ret_from_intr
- CFI_ENDPROC
--END(\sym)
-+ENDPROC(\sym)
- .endm
-
- #ifdef CONFIG_SMP
-@@ -1032,12 +1343,22 @@ ENTRY(\sym)
- CFI_ADJUST_CFA_OFFSET 15*8
- call error_entry
- DEFAULT_FRAME 0
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ testb $3, CS(%rsp)
-+ jnz 1f
-+ pax_enter_kernel
-+ jmp 2f
-+1: pax_enter_kernel_user
-+2:
-+#else
-+ pax_enter_kernel
-+#endif
- movq %rsp,%rdi /* pt_regs pointer */
- xorl %esi,%esi /* no error code */
- call \do_sym
- jmp error_exit /* %ebx: no swapgs flag */
- CFI_ENDPROC
--END(\sym)
-+ENDPROC(\sym)
- .endm
-
- .macro paranoidzeroentry sym do_sym
-@@ -1049,12 +1370,22 @@ ENTRY(\sym)
- subq $15*8, %rsp
- call save_paranoid
- TRACE_IRQS_OFF
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ testb $3, CS(%rsp)
-+ jnz 1f
-+ pax_enter_kernel
-+ jmp 2f
-+1: pax_enter_kernel_user
-+2:
-+#else
-+ pax_enter_kernel
-+#endif
- movq %rsp,%rdi /* pt_regs pointer */
- xorl %esi,%esi /* no error code */
- call \do_sym
- jmp paranoid_exit /* %ebx: no swapgs flag */
- CFI_ENDPROC
--END(\sym)
-+ENDPROC(\sym)
- .endm
-
- .macro paranoidzeroentry_ist sym do_sym ist
-@@ -1066,15 +1397,30 @@ ENTRY(\sym)
- subq $15*8, %rsp
- call save_paranoid
- TRACE_IRQS_OFF
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ testb $3, CS(%rsp)
-+ jnz 1f
-+ pax_enter_kernel
-+ jmp 2f
-+1: pax_enter_kernel_user
-+2:
-+#else
-+ pax_enter_kernel
-+#endif
- movq %rsp,%rdi /* pt_regs pointer */
- xorl %esi,%esi /* no error code */
-- PER_CPU(init_tss, %rbp)
-+#ifdef CONFIG_SMP
-+ imul $TSS_size, PER_CPU_VAR(cpu_number), %ebp
-+ lea init_tss(%rbp), %rbp
-+#else
-+ lea init_tss(%rip), %rbp
-+#endif
- subq $EXCEPTION_STKSZ, TSS_ist + (\ist - 1) * 8(%rbp)
- call \do_sym
- addq $EXCEPTION_STKSZ, TSS_ist + (\ist - 1) * 8(%rbp)
- jmp paranoid_exit /* %ebx: no swapgs flag */
- CFI_ENDPROC
--END(\sym)
-+ENDPROC(\sym)
- .endm
-
- .macro errorentry sym do_sym
-@@ -1085,13 +1431,23 @@ ENTRY(\sym)
- CFI_ADJUST_CFA_OFFSET 15*8
- call error_entry
- DEFAULT_FRAME 0
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ testb $3, CS(%rsp)
-+ jnz 1f
-+ pax_enter_kernel
-+ jmp 2f
-+1: pax_enter_kernel_user
-+2:
-+#else
-+ pax_enter_kernel
-+#endif
- movq %rsp,%rdi /* pt_regs pointer */
- movq ORIG_RAX(%rsp),%rsi /* get error code */
- movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
- call \do_sym
- jmp error_exit /* %ebx: no swapgs flag */
- CFI_ENDPROC
--END(\sym)
-+ENDPROC(\sym)
- .endm
-
- /* error code is on the stack already */
-@@ -1104,13 +1460,23 @@ ENTRY(\sym)
- call save_paranoid
- DEFAULT_FRAME 0
- TRACE_IRQS_OFF
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ testb $3, CS(%rsp)
-+ jnz 1f
-+ pax_enter_kernel
-+ jmp 2f
-+1: pax_enter_kernel_user
-+2:
-+#else
-+ pax_enter_kernel
-+#endif
- movq %rsp,%rdi /* pt_regs pointer */
- movq ORIG_RAX(%rsp),%rsi /* get error code */
- movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
- call \do_sym
- jmp paranoid_exit /* %ebx: no swapgs flag */
- CFI_ENDPROC
--END(\sym)
-+ENDPROC(\sym)
- .endm
-
- zeroentry divide_error do_divide_error
-@@ -1141,9 +1507,10 @@ gs_change:
- SWAPGS
- popf
- CFI_ADJUST_CFA_OFFSET -8
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
--END(native_load_gs_index)
-+ENDPROC(native_load_gs_index)
-
- .section __ex_table,"a"
- .align 8
-@@ -1193,11 +1560,12 @@ ENTRY(kernel_thread)
- * of hacks for example to fork off the per-CPU idle tasks.
- * [Hopefully no generic code relies on the reschedule -AK]
- */
-- RESTORE_ALL
-+ RESTORE_REST
- UNFAKE_STACK_FRAME
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
--END(kernel_thread)
-+ENDPROC(kernel_thread)
-
- ENTRY(child_rip)
- pushq $0 # fake return address
-@@ -1208,13 +1576,14 @@ ENTRY(child_rip)
- */
- movq %rdi, %rax
- movq %rsi, %rdi
-+ pax_force_fptr %rax
- call *%rax
- # exit
- mov %eax, %edi
- call do_exit
- ud2 # padding for call trace
- CFI_ENDPROC
--END(child_rip)
-+ENDPROC(child_rip)
-
- /*
- * execve(). This function needs to use IRET, not SYSRET, to set up all state properly.
-@@ -1241,11 +1610,11 @@ ENTRY(kernel_execve)
- RESTORE_REST
- testq %rax,%rax
- je int_ret_from_sys_call
-- RESTORE_ARGS
- UNFAKE_STACK_FRAME
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
--END(kernel_execve)
-+ENDPROC(kernel_execve)
-
- /* Call softirq on interrupt stack. Interrupts are off. */
- ENTRY(call_softirq)
-@@ -1263,9 +1632,10 @@ ENTRY(call_softirq)
- CFI_DEF_CFA_REGISTER rsp
- CFI_ADJUST_CFA_OFFSET -8
- decl PER_CPU_VAR(irq_count)
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
--END(call_softirq)
-+ENDPROC(call_softirq)
-
- #ifdef CONFIG_XEN
- zeroentry xen_hypervisor_callback xen_do_hypervisor_callback
-@@ -1303,7 +1673,7 @@ ENTRY(xen_do_hypervisor_callback) # do_hypervisor_callback(struct *pt_regs)
- decl PER_CPU_VAR(irq_count)
- jmp error_exit
- CFI_ENDPROC
--END(xen_do_hypervisor_callback)
-+ENDPROC(xen_do_hypervisor_callback)
-
- /*
- * Hypervisor uses this for application faults while it executes.
-@@ -1362,7 +1732,7 @@ ENTRY(xen_failsafe_callback)
- SAVE_ALL
- jmp error_exit
- CFI_ENDPROC
--END(xen_failsafe_callback)
-+ENDPROC(xen_failsafe_callback)
-
- #endif /* CONFIG_XEN */
-
-@@ -1405,16 +1775,31 @@ ENTRY(paranoid_exit)
- TRACE_IRQS_OFF
- testl %ebx,%ebx /* swapgs needed? */
- jnz paranoid_restore
-- testl $3,CS(%rsp)
-+ testb $3,CS(%rsp)
- jnz paranoid_userspace
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ pax_exit_kernel
-+ TRACE_IRQS_IRETQ 0
-+ SWAPGS_UNSAFE_STACK
-+ RESTORE_ALL 8
-+ pax_force_retaddr_bts
-+ jmp irq_return
-+#endif
- paranoid_swapgs:
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ pax_exit_kernel_user
-+#else
-+ pax_exit_kernel
-+#endif
- TRACE_IRQS_IRETQ 0
- SWAPGS_UNSAFE_STACK
- RESTORE_ALL 8
- jmp irq_return
- paranoid_restore:
-+ pax_exit_kernel
- TRACE_IRQS_IRETQ 0
- RESTORE_ALL 8
-+ pax_force_retaddr_bts
- jmp irq_return
- paranoid_userspace:
- GET_THREAD_INFO(%rcx)
-@@ -1443,7 +1828,7 @@ paranoid_schedule:
- TRACE_IRQS_OFF
- jmp paranoid_userspace
- CFI_ENDPROC
--END(paranoid_exit)
-+ENDPROC(paranoid_exit)
-
- /*
- * Exception entry point. This expects an error code/orig_rax on the stack.
-@@ -1470,12 +1855,13 @@ ENTRY(error_entry)
- movq_cfi r14, R14+8
- movq_cfi r15, R15+8
- xorl %ebx,%ebx
-- testl $3,CS+8(%rsp)
-+ testb $3,CS+8(%rsp)
- je error_kernelspace
- error_swapgs:
- SWAPGS
- error_sti:
- TRACE_IRQS_OFF
-+ pax_force_retaddr_bts
- ret
- CFI_ENDPROC
-
-@@ -1497,7 +1883,7 @@ error_kernelspace:
- cmpq $gs_change,RIP+8(%rsp)
- je error_swapgs
- jmp error_sti
--END(error_entry)
-+ENDPROC(error_entry)
-
-
- /* ebx: no swapgs flag (1: don't need swapgs, 0: need it) */
-@@ -1517,7 +1903,7 @@ ENTRY(error_exit)
- jnz retint_careful
- jmp retint_swapgs
- CFI_ENDPROC
--END(error_exit)
-+ENDPROC(error_exit)
-
-
- /* runs on exception stack */
-@@ -1529,6 +1915,16 @@ ENTRY(nmi)
- CFI_ADJUST_CFA_OFFSET 15*8
- call save_paranoid
- DEFAULT_FRAME 0
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ testb $3, CS(%rsp)
-+ jnz 1f
-+ pax_enter_kernel
-+ jmp 2f
-+1: pax_enter_kernel_user
-+2:
-+#else
-+ pax_enter_kernel
-+#endif
- /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
- movq %rsp,%rdi
- movq $-1,%rsi
-@@ -1539,12 +1935,28 @@ ENTRY(nmi)
- DISABLE_INTERRUPTS(CLBR_NONE)
- testl %ebx,%ebx /* swapgs needed? */
- jnz nmi_restore
-- testl $3,CS(%rsp)
-+ testb $3,CS(%rsp)
- jnz nmi_userspace
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ pax_exit_kernel
-+ SWAPGS_UNSAFE_STACK
-+ RESTORE_ALL 8
-+ pax_force_retaddr_bts
-+ jmp irq_return
-+#endif
- nmi_swapgs:
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ pax_exit_kernel_user
-+#else
-+ pax_exit_kernel
-+#endif
- SWAPGS_UNSAFE_STACK
-+ RESTORE_ALL 8
-+ jmp irq_return
- nmi_restore:
-+ pax_exit_kernel
- RESTORE_ALL 8
-+ pax_force_retaddr_bts
- jmp irq_return
- nmi_userspace:
- GET_THREAD_INFO(%rcx)
-@@ -1573,14 +1985,14 @@ nmi_schedule:
- jmp paranoid_exit
- CFI_ENDPROC
- #endif
--END(nmi)
-+ENDPROC(nmi)
-
- ENTRY(ignore_sysret)
- CFI_STARTPROC
- mov $-ENOSYS,%eax
- sysret
- CFI_ENDPROC
--END(ignore_sysret)
-+ENDPROC(ignore_sysret)
-
- /*
- * End of kprobes section
-diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
-index 9dbb527..9fe4f21 100644
---- a/arch/x86/kernel/ftrace.c
-+++ b/arch/x86/kernel/ftrace.c
-@@ -103,7 +103,7 @@ static void *mod_code_ip; /* holds the IP to write to */
- static void *mod_code_newcode; /* holds the text to write to the IP */
-
- static unsigned nmi_wait_count;
--static atomic_t nmi_update_count = ATOMIC_INIT(0);
-+static atomic_unchecked_t nmi_update_count = ATOMIC_INIT(0);
-
- int ftrace_arch_read_dyn_info(char *buf, int size)
- {
-@@ -111,7 +111,7 @@ int ftrace_arch_read_dyn_info(char *buf, int size)
-
- r = snprintf(buf, size, "%u %u",
- nmi_wait_count,
-- atomic_read(&nmi_update_count));
-+ atomic_read_unchecked(&nmi_update_count));
- return r;
- }
-
-@@ -149,8 +149,10 @@ void ftrace_nmi_enter(void)
- {
- if (atomic_inc_return(&nmi_running) & MOD_CODE_WRITE_FLAG) {
- smp_rmb();
-+ pax_open_kernel();
- ftrace_mod_code();
-- atomic_inc(&nmi_update_count);
-+ pax_close_kernel();
-+ atomic_inc_unchecked(&nmi_update_count);
- }
- /* Must have previous changes seen before executions */
- smp_mb();
-@@ -215,7 +217,7 @@ do_ftrace_mod_code(unsigned long ip, void *new_code)
-
-
-
--static unsigned char ftrace_nop[MCOUNT_INSN_SIZE];
-+static unsigned char ftrace_nop[MCOUNT_INSN_SIZE] __read_only;
-
- static unsigned char *ftrace_nop_replace(void)
- {
-@@ -228,6 +230,8 @@ ftrace_modify_code(unsigned long ip, unsigned char *old_code,
- {
- unsigned char replaced[MCOUNT_INSN_SIZE];
-
-+ ip = ktla_ktva(ip);
-+
- /*
- * Note: Due to modules and __init, code can
- * disappear and change, we need to protect against faulting
-@@ -284,7 +288,7 @@ int ftrace_update_ftrace_func(ftrace_func_t func)
- unsigned char old[MCOUNT_INSN_SIZE], *new;
- int ret;
-
-- memcpy(old, &ftrace_call, MCOUNT_INSN_SIZE);
-+ memcpy(old, ktla_ktva((void *)ftrace_call), MCOUNT_INSN_SIZE);
- new = ftrace_call_replace(ip, (unsigned long)func);
- ret = ftrace_modify_code(ip, old, new);
-
-@@ -337,15 +341,15 @@ int __init ftrace_dyn_arch_init(void *data)
- switch (faulted) {
- case 0:
- pr_info("ftrace: converting mcount calls to 0f 1f 44 00 00\n");
-- memcpy(ftrace_nop, ftrace_test_p6nop, MCOUNT_INSN_SIZE);
-+ memcpy(ftrace_nop, ktla_ktva(ftrace_test_p6nop), MCOUNT_INSN_SIZE);
- break;
- case 1:
- pr_info("ftrace: converting mcount calls to 66 66 66 66 90\n");
-- memcpy(ftrace_nop, ftrace_test_nop5, MCOUNT_INSN_SIZE);
-+ memcpy(ftrace_nop, ktla_ktva(ftrace_test_nop5), MCOUNT_INSN_SIZE);
- break;
- case 2:
- pr_info("ftrace: converting mcount calls to jmp . + 5\n");
-- memcpy(ftrace_nop, ftrace_test_jmp, MCOUNT_INSN_SIZE);
-+ memcpy(ftrace_nop, ktla_ktva(ftrace_test_jmp), MCOUNT_INSN_SIZE);
- break;
- }
-
-@@ -366,6 +370,8 @@ static int ftrace_mod_jmp(unsigned long ip,
- {
- unsigned char code[MCOUNT_INSN_SIZE];
-
-+ ip = ktla_ktva(ip);
-+
- if (probe_kernel_read(code, (void *)ip, MCOUNT_INSN_SIZE))
- return -EFAULT;
-
-diff --git a/arch/x86/kernel/head.c b/arch/x86/kernel/head.c
-index 3e66bd3..6d6adbe 100644
---- a/arch/x86/kernel/head.c
-+++ b/arch/x86/kernel/head.c
-@@ -4,8 +4,6 @@
- #include <asm/setup.h>
- #include <asm/bios_ebda.h>
-
--#define BIOS_LOWMEM_KILOBYTES 0x413
--
- /*
- * The BIOS places the EBDA/XBDA at the top of conventional
- * memory, and usually decreases the reported amount of
-@@ -15,17 +13,30 @@
- * chipset: reserve a page before VGA to prevent PCI prefetch
- * into it (errata #56). Usually the page is reserved anyways,
- * unless you have no PS/2 mouse plugged in.
-+ *
-+ * This functions is deliberately very conservative. Losing
-+ * memory in the bottom megabyte is rarely a problem, as long
-+ * as we have enough memory to install the trampoline. Using
-+ * memory that is in use by the BIOS or by some DMA device
-+ * the BIOS didn't shut down *is* a big problem.
- */
-+
-+#define BIOS_LOWMEM_KILOBYTES 0x413
-+#define LOWMEM_CAP 0x9f000U /* Absolute maximum */
-+#define INSANE_CUTOFF 0x20000U /* Less than this = insane */
-+
- void __init reserve_ebda_region(void)
- {
- unsigned int lowmem, ebda_addr;
-
-- /* To determine the position of the EBDA and the */
-- /* end of conventional memory, we need to look at */
-- /* the BIOS data area. In a paravirtual environment */
-- /* that area is absent. We'll just have to assume */
-- /* that the paravirt case can handle memory setup */
-- /* correctly, without our help. */
-+ /*
-+ * To determine the position of the EBDA and the
-+ * end of conventional memory, we need to look at
-+ * the BIOS data area. In a paravirtual environment
-+ * that area is absent. We'll just have to assume
-+ * that the paravirt case can handle memory setup
-+ * correctly, without our help.
-+ */
- if (paravirt_enabled())
- return;
-
-@@ -36,19 +47,23 @@ void __init reserve_ebda_region(void)
- /* start of EBDA area */
- ebda_addr = get_bios_ebda();
-
-- /* Fixup: bios puts an EBDA in the top 64K segment */
-- /* of conventional memory, but does not adjust lowmem. */
-- if ((lowmem - ebda_addr) <= 0x10000)
-- lowmem = ebda_addr;
-+ /*
-+ * Note: some old Dells seem to need 4k EBDA without
-+ * reporting so, so just consider the memory above 0x9f000
-+ * to be off limits (bugzilla 2990).
-+ */
-
-- /* Fixup: bios does not report an EBDA at all. */
-- /* Some old Dells seem to need 4k anyhow (bugzilla 2990) */
-- if ((ebda_addr == 0) && (lowmem >= 0x9f000))
-- lowmem = 0x9f000;
-+ /* If the EBDA address is below 128K, assume it is bogus */
-+ if (ebda_addr < INSANE_CUTOFF)
-+ ebda_addr = LOWMEM_CAP;
-
-- /* Paranoia: should never happen, but... */
-- if ((lowmem == 0) || (lowmem >= 0x100000))
-- lowmem = 0x9f000;
-+ /* If lowmem is less than 128K, assume it is bogus */
-+ if (lowmem < INSANE_CUTOFF)
-+ lowmem = LOWMEM_CAP;
-+
-+ /* Use the lower of the lowmem and EBDA markers as the cutoff */
-+ lowmem = min(lowmem, ebda_addr);
-+ lowmem = min(lowmem, LOWMEM_CAP); /* Absolute cap */
-
- /* reserve all memory between lowmem and the 1MB mark */
- reserve_early_overlap_ok(lowmem, 0x100000, "BIOS reserved");
-diff --git a/arch/x86/kernel/head32.c b/arch/x86/kernel/head32.c
-index 4f8e250..df24706 100644
---- a/arch/x86/kernel/head32.c
-+++ b/arch/x86/kernel/head32.c
-@@ -16,6 +16,7 @@
- #include <asm/apic.h>
- #include <asm/io_apic.h>
- #include <asm/bios_ebda.h>
-+#include <asm/boot.h>
-
- static void __init i386_default_early_setup(void)
- {
-@@ -31,7 +32,7 @@ void __init i386_start_kernel(void)
- {
- reserve_trampoline_memory();
-
-- reserve_early(__pa_symbol(&_text), __pa_symbol(&__bss_stop), "TEXT DATA BSS");
-+ reserve_early(LOAD_PHYSICAL_ADDR, __pa_symbol(&__bss_stop), "TEXT DATA BSS");
-
- #ifdef CONFIG_BLK_DEV_INITRD
- /* Reserve INITRD */
-diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
-index 34c3308..162120a 100644
---- a/arch/x86/kernel/head_32.S
-+++ b/arch/x86/kernel/head_32.S
-@@ -19,10 +19,17 @@
- #include <asm/setup.h>
- #include <asm/processor-flags.h>
- #include <asm/percpu.h>
-+#include <asm/msr-index.h>
-
- /* Physical address */
- #define pa(X) ((X) - __PAGE_OFFSET)
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+#define ta(X) (X)
-+#else
-+#define ta(X) ((X) - __PAGE_OFFSET)
-+#endif
-+
- /*
- * References to members of the new_cpu_data structure.
- */
-@@ -52,11 +59,7 @@
- * and small than max_low_pfn, otherwise will waste some page table entries
- */
-
--#if PTRS_PER_PMD > 1
--#define PAGE_TABLE_SIZE(pages) (((pages) / PTRS_PER_PMD) + PTRS_PER_PGD)
--#else
--#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PGD)
--#endif
-+#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PTE)
-
- /* Enough space to fit pagetables for the low memory linear map */
- MAPPING_BEYOND_END = \
-@@ -73,6 +76,12 @@ INIT_MAP_SIZE = PAGE_TABLE_SIZE(KERNEL_PAGES) * PAGE_SIZE_asm
- RESERVE_BRK(pagetables, INIT_MAP_SIZE)
-
- /*
-+ * Real beginning of normal "text" segment
-+ */
-+ENTRY(stext)
-+ENTRY(_stext)
-+
-+/*
- * 32-bit kernel entrypoint; only used by the boot CPU. On entry,
- * %esi points to the real-mode code as a 32-bit pointer.
- * CS and DS must be 4 GB flat segments, but we don't depend on
-@@ -80,7 +89,16 @@ RESERVE_BRK(pagetables, INIT_MAP_SIZE)
- * can.
- */
- __HEAD
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ jmp startup_32
-+/* PaX: fill first page in .text with int3 to catch NULL derefs in kernel mode */
-+.fill PAGE_SIZE-5,1,0xcc
-+#endif
-+
- ENTRY(startup_32)
-+ movl pa(stack_start),%ecx
-+
- /* test KEEP_SEGMENTS flag to see if the bootloader is asking
- us to not reload segments */
- testb $(1<<6), BP_loadflags(%esi)
-@@ -95,7 +113,62 @@ ENTRY(startup_32)
- movl %eax,%es
- movl %eax,%fs
- movl %eax,%gs
-+ movl %eax,%ss
- 2:
-+ leal -__PAGE_OFFSET(%ecx),%esp
-+
-+#ifdef CONFIG_SMP
-+ movl $pa(cpu_gdt_table),%edi
-+ movl $__per_cpu_load,%eax
-+ movw %ax,GDT_ENTRY_PERCPU * 8 + 2(%edi)
-+ rorl $16,%eax
-+ movb %al,GDT_ENTRY_PERCPU * 8 + 4(%edi)
-+ movb %ah,GDT_ENTRY_PERCPU * 8 + 7(%edi)
-+ movl $__per_cpu_end - 1,%eax
-+ subl $__per_cpu_start,%eax
-+ movw %ax,GDT_ENTRY_PERCPU * 8 + 0(%edi)
-+#endif
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ movl $NR_CPUS,%ecx
-+ movl $pa(cpu_gdt_table),%edi
-+1:
-+ movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c09700),GDT_ENTRY_KERNEL_DS * 8 + 4(%edi)
-+ movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0fb00),GDT_ENTRY_DEFAULT_USER_CS * 8 + 4(%edi)
-+ movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0f300),GDT_ENTRY_DEFAULT_USER_DS * 8 + 4(%edi)
-+ addl $PAGE_SIZE_asm,%edi
-+ loop 1b
-+#endif
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ movl $pa(boot_gdt),%edi
-+ movl $__LOAD_PHYSICAL_ADDR,%eax
-+ movw %ax,GDT_ENTRY_BOOT_CS * 8 + 2(%edi)
-+ rorl $16,%eax
-+ movb %al,GDT_ENTRY_BOOT_CS * 8 + 4(%edi)
-+ movb %ah,GDT_ENTRY_BOOT_CS * 8 + 7(%edi)
-+ rorl $16,%eax
-+
-+ ljmp $(__BOOT_CS),$1f
-+1:
-+
-+ movl $NR_CPUS,%ecx
-+ movl $pa(cpu_gdt_table),%edi
-+ addl $__PAGE_OFFSET,%eax
-+1:
-+ movb $0xc0,GDT_ENTRY_KERNEL_CS * 8 + 6(%edi)
-+ movb $0xc0,GDT_ENTRY_KERNEXEC_KERNEL_CS * 8 + 6(%edi)
-+ movw %ax,GDT_ENTRY_KERNEL_CS * 8 + 2(%edi)
-+ movw %ax,GDT_ENTRY_KERNEXEC_KERNEL_CS * 8 + 2(%edi)
-+ rorl $16,%eax
-+ movb %al,GDT_ENTRY_KERNEL_CS * 8 + 4(%edi)
-+ movb %al,GDT_ENTRY_KERNEXEC_KERNEL_CS * 8 + 4(%edi)
-+ movb %ah,GDT_ENTRY_KERNEL_CS * 8 + 7(%edi)
-+ movb %ah,GDT_ENTRY_KERNEXEC_KERNEL_CS * 8 + 7(%edi)
-+ rorl $16,%eax
-+ addl $PAGE_SIZE_asm,%edi
-+ loop 1b
-+#endif
-
- /*
- * Clear BSS first so that there are no surprises...
-@@ -140,9 +213,7 @@ ENTRY(startup_32)
- cmpl $num_subarch_entries, %eax
- jae bad_subarch
-
-- movl pa(subarch_entries)(,%eax,4), %eax
-- subl $__PAGE_OFFSET, %eax
-- jmp *%eax
-+ jmp *pa(subarch_entries)(,%eax,4)
-
- bad_subarch:
- WEAK(lguest_entry)
-@@ -154,10 +225,10 @@ WEAK(xen_entry)
- __INITDATA
-
- subarch_entries:
-- .long default_entry /* normal x86/PC */
-- .long lguest_entry /* lguest hypervisor */
-- .long xen_entry /* Xen hypervisor */
-- .long default_entry /* Moorestown MID */
-+ .long ta(default_entry) /* normal x86/PC */
-+ .long ta(lguest_entry) /* lguest hypervisor */
-+ .long ta(xen_entry) /* Xen hypervisor */
-+ .long ta(default_entry) /* Moorestown MID */
- num_subarch_entries = (. - subarch_entries) / 4
- .previous
- #endif /* CONFIG_PARAVIRT */
-@@ -218,8 +289,11 @@ default_entry:
- movl %eax, pa(max_pfn_mapped)
-
- /* Do early initialization of the fixmap area */
-- movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,%eax
-- movl %eax,pa(swapper_pg_pmd+0x1000*KPMDS-8)
-+#ifdef CONFIG_COMPAT_VDSO
-+ movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(swapper_pg_pmd+0x1000*KPMDS-8)
-+#else
-+ movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,pa(swapper_pg_pmd+0x1000*KPMDS-8)
-+#endif
- #else /* Not PAE */
-
- page_pde_offset = (__PAGE_OFFSET >> 20);
-@@ -249,8 +323,11 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
- movl %eax, pa(max_pfn_mapped)
-
- /* Do early initialization of the fixmap area */
-- movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,%eax
-- movl %eax,pa(swapper_pg_dir+0xffc)
-+#ifdef CONFIG_COMPAT_VDSO
-+ movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(swapper_pg_dir+0xffc)
-+#else
-+ movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,pa(swapper_pg_dir+0xffc)
-+#endif
- #endif
- jmp 3f
- /*
-@@ -272,6 +349,9 @@ ENTRY(startup_32_smp)
- movl %eax,%es
- movl %eax,%fs
- movl %eax,%gs
-+ movl pa(stack_start),%ecx
-+ movl %eax,%ss
-+ leal -__PAGE_OFFSET(%ecx),%esp
- #endif /* CONFIG_SMP */
- 3:
-
-@@ -297,6 +377,7 @@ ENTRY(startup_32_smp)
- orl %edx,%eax
- movl %eax,%cr4
-
-+#ifdef CONFIG_X86_PAE
- btl $5, %eax # check if PAE is enabled
- jnc 6f
-
-@@ -305,6 +386,10 @@ ENTRY(startup_32_smp)
- cpuid
- cmpl $0x80000000, %eax
- jbe 6f
-+
-+ /* Clear bogus XD_DISABLE bits */
-+ call verify_cpu
-+
- mov $0x80000001, %eax
- cpuid
- /* Execute Disable bit supported? */
-@@ -312,13 +397,17 @@ ENTRY(startup_32_smp)
- jnc 6f
-
- /* Setup EFER (Extended Feature Enable Register) */
-- movl $0xc0000080, %ecx
-+ movl $MSR_EFER, %ecx
- rdmsr
-
- btsl $11, %eax
- /* Make changes effective */
- wrmsr
-
-+ btsl $_PAGE_BIT_NX-32,pa(__supported_pte_mask+4)
-+ movl $1,pa(nx_enabled)
-+#endif
-+
- 6:
-
- /*
-@@ -331,8 +420,8 @@ ENTRY(startup_32_smp)
- movl %eax,%cr0 /* ..and set paging (PG) bit */
- ljmp $__BOOT_CS,$1f /* Clear prefetch and normalize %eip */
- 1:
-- /* Set up the stack pointer */
-- lss stack_start,%esp
-+ /* Shift the stack pointer to a virtual address */
-+ addl $__PAGE_OFFSET, %esp
-
- /*
- * Initialize eflags. Some BIOS's leave bits like NT set. This would
-@@ -344,9 +433,7 @@ ENTRY(startup_32_smp)
-
- #ifdef CONFIG_SMP
- cmpb $0, ready
-- jz 1f /* Initial CPU cleans BSS */
-- jmp checkCPUtype
--1:
-+ jnz checkCPUtype
- #endif /* CONFIG_SMP */
-
- /*
-@@ -424,7 +511,7 @@ is386: movl $2,%ecx # set MP
- 1: movl $(__KERNEL_DS),%eax # reload all the segment registers
- movl %eax,%ss # after changing gdt.
-
-- movl $(__USER_DS),%eax # DS/ES contains default USER segment
-+# movl $(__KERNEL_DS),%eax # DS/ES contains default KERNEL segment
- movl %eax,%ds
- movl %eax,%es
-
-@@ -438,15 +525,22 @@ is386: movl $2,%ecx # set MP
- */
- cmpb $0,ready
- jne 1f
-- movl $per_cpu__gdt_page,%eax
-+ movl $cpu_gdt_table,%eax
- movl $per_cpu__stack_canary,%ecx
-+#ifdef CONFIG_SMP
-+ addl $__per_cpu_load,%ecx
-+#endif
- movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
- shrl $16, %ecx
- movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
- movb %ch, 8 * GDT_ENTRY_STACK_CANARY + 7(%eax)
- 1:
--#endif
- movl $(__KERNEL_STACK_CANARY),%eax
-+#elif defined(CONFIG_PAX_MEMORY_UDEREF)
-+ movl $(__USER_DS),%eax
-+#else
-+ xorl %eax,%eax
-+#endif
- movl %eax,%gs
-
- xorl %eax,%eax # Clear LDT
-@@ -454,14 +548,7 @@ is386: movl $2,%ecx # set MP
-
- cld # gcc2 wants the direction flag cleared at all times
- pushl $0 # fake return address for unwinder
--#ifdef CONFIG_SMP
-- movb ready, %cl
- movb $1, ready
-- cmpb $0,%cl # the first CPU calls start_kernel
-- je 1f
-- movl (stack_start), %esp
--1:
--#endif /* CONFIG_SMP */
- jmp *(initial_code)
-
- /*
-@@ -546,22 +633,22 @@ early_page_fault:
- jmp early_fault
-
- early_fault:
-- cld
- #ifdef CONFIG_PRINTK
-+ cmpl $1,%ss:early_recursion_flag
-+ je hlt_loop
-+ incl %ss:early_recursion_flag
-+ cld
- pusha
- movl $(__KERNEL_DS),%eax
- movl %eax,%ds
- movl %eax,%es
-- cmpl $2,early_recursion_flag
-- je hlt_loop
-- incl early_recursion_flag
- movl %cr2,%eax
- pushl %eax
- pushl %edx /* trapno */
- pushl $fault_msg
- call printk
-+; call dump_stack
- #endif
-- call dump_stack
- hlt_loop:
- hlt
- jmp hlt_loop
-@@ -569,8 +656,11 @@ hlt_loop:
- /* This is the default interrupt "handler" :-) */
- ALIGN
- ignore_int:
-- cld
- #ifdef CONFIG_PRINTK
-+ cmpl $2,%ss:early_recursion_flag
-+ je hlt_loop
-+ incl %ss:early_recursion_flag
-+ cld
- pushl %eax
- pushl %ecx
- pushl %edx
-@@ -579,9 +669,6 @@ ignore_int:
- movl $(__KERNEL_DS),%eax
- movl %eax,%ds
- movl %eax,%es
-- cmpl $2,early_recursion_flag
-- je hlt_loop
-- incl early_recursion_flag
- pushl 16(%esp)
- pushl 24(%esp)
- pushl 32(%esp)
-@@ -600,6 +687,8 @@ ignore_int:
- #endif
- iret
-
-+#include "verify_cpu.S"
-+
- __REFDATA
- .align 4
- ENTRY(initial_code)
-@@ -610,31 +699,47 @@ ENTRY(initial_page_table)
- /*
- * BSS section
- */
--__PAGE_ALIGNED_BSS
-- .align PAGE_SIZE_asm
- #ifdef CONFIG_X86_PAE
-+.section .swapper_pg_pmd,"a",@progbits
- swapper_pg_pmd:
- .fill 1024*KPMDS,4,0
- #else
-+.section .swapper_pg_dir,"a",@progbits
- ENTRY(swapper_pg_dir)
- .fill 1024,4,0
- #endif
-+.section .swapper_pg_fixmap,"a",@progbits
- swapper_pg_fixmap:
- .fill 1024,4,0
- #ifdef CONFIG_X86_TRAMPOLINE
-+.section .trampoline_pg_dir,"a",@progbits
- ENTRY(trampoline_pg_dir)
-+#ifdef CONFIG_X86_PAE
-+ .fill 4,8,0
-+#else
- .fill 1024,4,0
- #endif
-+#endif
-+
-+.section .empty_zero_page,"a",@progbits
- ENTRY(empty_zero_page)
- .fill 4096,1,0
-
- /*
-+ * The IDT has to be page-aligned to simplify the Pentium
-+ * F0 0F bug workaround.. We have a special link segment
-+ * for this.
-+ */
-+.section .idt,"a",@progbits
-+ENTRY(idt_table)
-+ .fill 256,8,0
-+
-+/*
- * This starts the data section.
- */
- #ifdef CONFIG_X86_PAE
--__PAGE_ALIGNED_DATA
-- /* Page-aligned for the benefit of paravirt? */
-- .align PAGE_SIZE_asm
-+.section .swapper_pg_dir,"a",@progbits
-+
- ENTRY(swapper_pg_dir)
- .long pa(swapper_pg_pmd+PGD_IDENT_ATTR),0 /* low identity map */
- # if KPMDS == 3
-@@ -653,15 +758,24 @@ ENTRY(swapper_pg_dir)
- # error "Kernel PMDs should be 1, 2 or 3"
- # endif
- .align PAGE_SIZE_asm /* needs to be page-sized too */
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ENTRY(cpu_pgd)
-+ .rept NR_CPUS
-+ .fill 4,8,0
-+ .endr
-+#endif
-+
- #endif
-
- .data
-+.balign 4
- ENTRY(stack_start)
-- .long init_thread_union+THREAD_SIZE
-- .long __BOOT_DS
-+ .long init_thread_union+THREAD_SIZE-8
-
- ready: .byte 0
-
-+.section .rodata,"a",@progbits
- early_recursion_flag:
- .long 0
-
-@@ -697,7 +811,7 @@ fault_msg:
- .word 0 # 32 bit align gdt_desc.address
- boot_gdt_descr:
- .word __BOOT_DS+7
-- .long boot_gdt - __PAGE_OFFSET
-+ .long pa(boot_gdt)
-
- .word 0 # 32-bit align idt_desc.address
- idt_descr:
-@@ -708,7 +822,7 @@ idt_descr:
- .word 0 # 32 bit align gdt_desc.address
- ENTRY(early_gdt_descr)
- .word GDT_ENTRIES*8-1
-- .long per_cpu__gdt_page /* Overwritten for secondary CPUs */
-+ .long cpu_gdt_table /* Overwritten for secondary CPUs */
-
- /*
- * The boot_gdt must mirror the equivalent in setup.S and is
-@@ -717,5 +831,65 @@ ENTRY(early_gdt_descr)
- .align L1_CACHE_BYTES
- ENTRY(boot_gdt)
- .fill GDT_ENTRY_BOOT_CS,8,0
-- .quad 0x00cf9a000000ffff /* kernel 4GB code at 0x00000000 */
-- .quad 0x00cf92000000ffff /* kernel 4GB data at 0x00000000 */
-+ .quad 0x00cf9b000000ffff /* kernel 4GB code at 0x00000000 */
-+ .quad 0x00cf93000000ffff /* kernel 4GB data at 0x00000000 */
-+
-+ .align PAGE_SIZE_asm
-+ENTRY(cpu_gdt_table)
-+ .rept NR_CPUS
-+ .quad 0x0000000000000000 /* NULL descriptor */
-+ .quad 0x0000000000000000 /* 0x0b reserved */
-+ .quad 0x0000000000000000 /* 0x13 reserved */
-+ .quad 0x0000000000000000 /* 0x1b reserved */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ .quad 0x00cf9b000000ffff /* 0x20 alternate kernel 4GB code at 0x00000000 */
-+#else
-+ .quad 0x0000000000000000 /* 0x20 unused */
-+#endif
-+
-+ .quad 0x0000000000000000 /* 0x28 unused */
-+ .quad 0x0000000000000000 /* 0x33 TLS entry 1 */
-+ .quad 0x0000000000000000 /* 0x3b TLS entry 2 */
-+ .quad 0x0000000000000000 /* 0x43 TLS entry 3 */
-+ .quad 0x0000000000000000 /* 0x4b reserved */
-+ .quad 0x0000000000000000 /* 0x53 reserved */
-+ .quad 0x0000000000000000 /* 0x5b reserved */
-+
-+ .quad 0x00cf9b000000ffff /* 0x60 kernel 4GB code at 0x00000000 */
-+ .quad 0x00cf93000000ffff /* 0x68 kernel 4GB data at 0x00000000 */
-+ .quad 0x00cffb000000ffff /* 0x73 user 4GB code at 0x00000000 */
-+ .quad 0x00cff3000000ffff /* 0x7b user 4GB data at 0x00000000 */
-+
-+ .quad 0x0000000000000000 /* 0x80 TSS descriptor */
-+ .quad 0x0000000000000000 /* 0x88 LDT descriptor */
-+
-+ /*
-+ * Segments used for calling PnP BIOS have byte granularity.
-+ * The code segments and data segments have fixed 64k limits,
-+ * the transfer segment sizes are set at run time.
-+ */
-+ .quad 0x00409b000000ffff /* 0x90 32-bit code */
-+ .quad 0x00009b000000ffff /* 0x98 16-bit code */
-+ .quad 0x000093000000ffff /* 0xa0 16-bit data */
-+ .quad 0x0000930000000000 /* 0xa8 16-bit data */
-+ .quad 0x0000930000000000 /* 0xb0 16-bit data */
-+
-+ /*
-+ * The APM segments have byte granularity and their bases
-+ * are set at run time. All have 64k limits.
-+ */
-+ .quad 0x00409b000000ffff /* 0xb8 APM CS code */
-+ .quad 0x00009b000000ffff /* 0xc0 APM CS 16 code (16 bit) */
-+ .quad 0x004093000000ffff /* 0xc8 APM DS data */
-+
-+ .quad 0x00c0930000000000 /* 0xd0 - ESPFIX SS */
-+ .quad 0x0040930000000000 /* 0xd8 - PERCPU */
-+ .quad 0x0040910000000017 /* 0xe0 - STACK_CANARY */
-+ .quad 0x0000000000000000 /* 0xe8 - PCIBIOS_CS */
-+ .quad 0x0000000000000000 /* 0xf0 - PCIBIOS_DS */
-+ .quad 0x0000000000000000 /* 0xf8 - GDT entry 31: double-fault TSS */
-+
-+ /* Be sure this is zeroed to avoid false validations in Xen */
-+ .fill PAGE_SIZE_asm - GDT_SIZE,1,0
-+ .endr
-diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
-index 780cd92..0e071b9 100644
---- a/arch/x86/kernel/head_64.S
-+++ b/arch/x86/kernel/head_64.S
-@@ -19,6 +19,8 @@
- #include <asm/cache.h>
- #include <asm/processor-flags.h>
- #include <asm/percpu.h>
-+#include <asm/cpufeature.h>
-+#include <asm/alternative-asm.h>
-
- #ifdef CONFIG_PARAVIRT
- #include <asm/asm-offsets.h>
-@@ -38,6 +40,12 @@ L4_PAGE_OFFSET = pgd_index(__PAGE_OFFSET)
- L3_PAGE_OFFSET = pud_index(__PAGE_OFFSET)
- L4_START_KERNEL = pgd_index(__START_KERNEL_map)
- L3_START_KERNEL = pud_index(__START_KERNEL_map)
-+L4_VMALLOC_START = pgd_index(VMALLOC_START)
-+L3_VMALLOC_START = pud_index(VMALLOC_START)
-+L4_VMALLOC_END = pgd_index(VMALLOC_END)
-+L3_VMALLOC_END = pud_index(VMALLOC_END)
-+L4_VMEMMAP_START = pgd_index(VMEMMAP_START)
-+L3_VMEMMAP_START = pud_index(VMEMMAP_START)
-
- .text
- __HEAD
-@@ -85,35 +93,22 @@ startup_64:
- */
- addq %rbp, init_level4_pgt + 0(%rip)
- addq %rbp, init_level4_pgt + (L4_PAGE_OFFSET*8)(%rip)
-+ addq %rbp, init_level4_pgt + (L4_VMALLOC_START*8)(%rip)
-+ addq %rbp, init_level4_pgt + (L4_VMALLOC_END*8)(%rip)
-+ addq %rbp, init_level4_pgt + (L4_VMEMMAP_START*8)(%rip)
- addq %rbp, init_level4_pgt + (L4_START_KERNEL*8)(%rip)
-
- addq %rbp, level3_ident_pgt + 0(%rip)
-+#ifndef CONFIG_XEN
-+ addq %rbp, level3_ident_pgt + 8(%rip)
-+#endif
-
-- addq %rbp, level3_kernel_pgt + (510*8)(%rip)
-- addq %rbp, level3_kernel_pgt + (511*8)(%rip)
-+ addq %rbp, level3_vmemmap_pgt + (L3_VMEMMAP_START*8)(%rip)
-
-- addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
-+ addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8)(%rip)
-+ addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8+8)(%rip)
-
-- /* Add an Identity mapping if I am above 1G */
-- leaq _text(%rip), %rdi
-- andq $PMD_PAGE_MASK, %rdi
--
-- movq %rdi, %rax
-- shrq $PUD_SHIFT, %rax
-- andq $(PTRS_PER_PUD - 1), %rax
-- jz ident_complete
--
-- leaq (level2_spare_pgt - __START_KERNEL_map + _KERNPG_TABLE)(%rbp), %rdx
-- leaq level3_ident_pgt(%rip), %rbx
-- movq %rdx, 0(%rbx, %rax, 8)
--
-- movq %rdi, %rax
-- shrq $PMD_SHIFT, %rax
-- andq $(PTRS_PER_PMD - 1), %rax
-- leaq __PAGE_KERNEL_IDENT_LARGE_EXEC(%rdi), %rdx
-- leaq level2_spare_pgt(%rip), %rbx
-- movq %rdx, 0(%rbx, %rax, 8)
--ident_complete:
-+ addq %rbp, level2_fixmap_pgt + (507*8)(%rip)
-
- /*
- * Fixup the kernel text+data virtual addresses. Note that
-@@ -161,8 +156,8 @@ ENTRY(secondary_startup_64)
- * after the boot processor executes this code.
- */
-
-- /* Enable PAE mode and PGE */
-- movl $(X86_CR4_PAE | X86_CR4_PGE), %eax
-+ /* Enable PAE mode and PSE/PGE */
-+ movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
- movq %rax, %cr4
-
- /* Setup early boot stage 4 level pagetables. */
-@@ -184,9 +179,16 @@ ENTRY(secondary_startup_64)
- movl $MSR_EFER, %ecx
- rdmsr
- btsl $_EFER_SCE, %eax /* Enable System Call */
-- btl $20,%edi /* No Execute supported? */
-+ btl $(X86_FEATURE_NX & 31),%edi /* No Execute supported? */
- jnc 1f
- btsl $_EFER_NX, %eax
-+ leaq init_level4_pgt(%rip), %rdi
-+#ifndef CONFIG_EFI
-+ btsq $_PAGE_BIT_NX, 8*L4_PAGE_OFFSET(%rdi)
-+#endif
-+ btsq $_PAGE_BIT_NX, 8*L4_VMALLOC_START(%rdi)
-+ btsq $_PAGE_BIT_NX, 8*L4_VMALLOC_END(%rdi)
-+ btsq $_PAGE_BIT_NX, 8*L4_VMEMMAP_START(%rdi)
- 1: wrmsr /* Make changes effective */
-
- /* Setup cr0 */
-@@ -249,6 +251,7 @@ ENTRY(secondary_startup_64)
- * jump. In addition we need to ensure %cs is set so we make this
- * a far return.
- */
-+ pax_set_fptr_mask
- movq initial_code(%rip),%rax
- pushq $0 # fake return address to stop unwinder
- pushq $__KERNEL_CS # set correct cs
-@@ -262,16 +265,16 @@ ENTRY(secondary_startup_64)
- .quad x86_64_start_kernel
- ENTRY(initial_gs)
- .quad INIT_PER_CPU_VAR(irq_stack_union)
-- __FINITDATA
-
- ENTRY(stack_start)
- .quad init_thread_union+THREAD_SIZE-8
- .word 0
-+ __FINITDATA
-
- bad_address:
- jmp bad_address
-
-- .section ".init.text","ax"
-+ __INIT
- #ifdef CONFIG_EARLY_PRINTK
- .globl early_idt_handlers
- early_idt_handlers:
-@@ -316,18 +319,23 @@ ENTRY(early_idt_handler)
- #endif /* EARLY_PRINTK */
- 1: hlt
- jmp 1b
-+ .previous
-
- #ifdef CONFIG_EARLY_PRINTK
-+ __INITDATA
- early_recursion_flag:
- .long 0
-+ .previous
-
-+ .section .rodata,"a",@progbits
- early_idt_msg:
- .asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n"
- early_idt_ripmsg:
- .asciz "RIP %s\n"
-+ .previous
- #endif /* CONFIG_EARLY_PRINTK */
-- .previous
-
-+ .section .rodata,"a",@progbits
- #define NEXT_PAGE(name) \
- .balign PAGE_SIZE; \
- ENTRY(name)
-@@ -350,13 +358,41 @@ NEXT_PAGE(init_level4_pgt)
- .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
- .org init_level4_pgt + L4_PAGE_OFFSET*8, 0
- .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
-+ .org init_level4_pgt + L4_VMALLOC_START*8, 0
-+ .quad level3_vmalloc_start_pgt - __START_KERNEL_map + _KERNPG_TABLE
-+ .org init_level4_pgt + L4_VMALLOC_END*8, 0
-+ .quad level3_vmalloc_end_pgt - __START_KERNEL_map + _KERNPG_TABLE
-+ .org init_level4_pgt + L4_VMEMMAP_START*8, 0
-+ .quad level3_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
- .org init_level4_pgt + L4_START_KERNEL*8, 0
- /* (2^48-(2*1024*1024*1024))/(2^39) = 511 */
- .quad level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE
-
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+NEXT_PAGE(cpu_pgd)
-+ .rept NR_CPUS
-+ .fill 512,8,0
-+ .endr
-+#endif
-+
- NEXT_PAGE(level3_ident_pgt)
- .quad level2_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
-+#ifdef CONFIG_XEN
- .fill 511,8,0
-+#else
-+ .quad level2_ident_pgt + PAGE_SIZE - __START_KERNEL_map + _KERNPG_TABLE
-+ .fill 510,8,0
-+#endif
-+
-+NEXT_PAGE(level3_vmalloc_start_pgt)
-+ .fill 512,8,0
-+
-+NEXT_PAGE(level3_vmalloc_end_pgt)
-+ .fill 512,8,0
-+
-+NEXT_PAGE(level3_vmemmap_pgt)
-+ .fill L3_VMEMMAP_START,8,0
-+ .quad level2_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
-
- NEXT_PAGE(level3_kernel_pgt)
- .fill L3_START_KERNEL,8,0
-@@ -364,20 +400,23 @@ NEXT_PAGE(level3_kernel_pgt)
- .quad level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE
- .quad level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
-
-+NEXT_PAGE(level2_vmemmap_pgt)
-+ .fill 512,8,0
-+
- NEXT_PAGE(level2_fixmap_pgt)
-- .fill 506,8,0
-- .quad level1_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
-- /* 8MB reserved for vsyscalls + a 2MB hole = 4 + 1 entries */
-- .fill 5,8,0
-+ .fill 507,8,0
-+ .quad level1_vsyscall_pgt - __START_KERNEL_map + _PAGE_TABLE
-+ /* 6MB reserved for vsyscalls + a 2MB hole = 3 + 1 entries */
-+ .fill 4,8,0
-
--NEXT_PAGE(level1_fixmap_pgt)
-+NEXT_PAGE(level1_vsyscall_pgt)
- .fill 512,8,0
-
--NEXT_PAGE(level2_ident_pgt)
-- /* Since I easily can, map the first 1G.
-+ /* Since I easily can, map the first 2G.
- * Don't set NX because code runs from these pages.
- */
-- PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, PTRS_PER_PMD)
-+NEXT_PAGE(level2_ident_pgt)
-+ PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, 2*PTRS_PER_PMD)
-
- NEXT_PAGE(level2_kernel_pgt)
- /*
-@@ -390,33 +429,55 @@ NEXT_PAGE(level2_kernel_pgt)
- * If you want to increase this then increase MODULES_VADDR
- * too.)
- */
-- PMDS(0, __PAGE_KERNEL_LARGE_EXEC,
-- KERNEL_IMAGE_SIZE/PMD_SIZE)
--
--NEXT_PAGE(level2_spare_pgt)
-- .fill 512, 8, 0
-+ PMDS(0, __PAGE_KERNEL_LARGE_EXEC, KERNEL_IMAGE_SIZE/PMD_SIZE)
-
- #undef PMDS
- #undef NEXT_PAGE
-
-- .data
-+ .align PAGE_SIZE
-+ENTRY(cpu_gdt_table)
-+ .rept NR_CPUS
-+ .quad 0x0000000000000000 /* NULL descriptor */
-+ .quad 0x00cf9b000000ffff /* __KERNEL32_CS */
-+ .quad 0x00af9b000000ffff /* __KERNEL_CS */
-+ .quad 0x00cf93000000ffff /* __KERNEL_DS */
-+ .quad 0x00cffb000000ffff /* __USER32_CS */
-+ .quad 0x00cff3000000ffff /* __USER_DS, __USER32_DS */
-+ .quad 0x00affb000000ffff /* __USER_CS */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ .quad 0x00af9b000000ffff /* __KERNEXEC_KERNEL_CS */
-+#else
-+ .quad 0x0 /* unused */
-+#endif
-+
-+ .quad 0,0 /* TSS */
-+ .quad 0,0 /* LDT */
-+ .quad 0,0,0 /* three TLS descriptors */
-+ .quad 0x0000f40000000000 /* node/CPU stored in limit */
-+ /* asm/segment.h:GDT_ENTRIES must match this */
-+
-+ /* zero the remaining page */
-+ .fill PAGE_SIZE / 8 - GDT_ENTRIES,8,0
-+ .endr
-+
- .align 16
- .globl early_gdt_descr
- early_gdt_descr:
- .word GDT_ENTRIES*8-1
- early_gdt_descr_base:
-- .quad INIT_PER_CPU_VAR(gdt_page)
-+ .quad cpu_gdt_table
-
- ENTRY(phys_base)
- /* This must match the first entry in level2_kernel_pgt */
- .quad 0x0000000000000000
-
- #include "../../x86/xen/xen-head.S"
--
-- .section .bss, "aw", @nobits
-+
-+ .section .rodata,"a",@progbits
- .align L1_CACHE_BYTES
- ENTRY(idt_table)
-- .skip IDT_ENTRIES * 16
-+ .fill 512,8,0
-
- __PAGE_ALIGNED_BSS
- .align PAGE_SIZE
-diff --git a/arch/x86/kernel/i386_ksyms_32.c b/arch/x86/kernel/i386_ksyms_32.c
-index 9c3bd4a..e1d9b35 100644
---- a/arch/x86/kernel/i386_ksyms_32.c
-+++ b/arch/x86/kernel/i386_ksyms_32.c
-@@ -20,8 +20,12 @@ extern void cmpxchg8b_emu(void);
- EXPORT_SYMBOL(cmpxchg8b_emu);
- #endif
-
-+EXPORT_SYMBOL_GPL(cpu_gdt_table);
-+
- /* Networking helper routines. */
- EXPORT_SYMBOL(csum_partial_copy_generic);
-+EXPORT_SYMBOL(csum_partial_copy_generic_to_user);
-+EXPORT_SYMBOL(csum_partial_copy_generic_from_user);
-
- EXPORT_SYMBOL(__get_user_1);
- EXPORT_SYMBOL(__get_user_2);
-@@ -36,3 +40,7 @@ EXPORT_SYMBOL(strstr);
-
- EXPORT_SYMBOL(csum_partial);
- EXPORT_SYMBOL(empty_zero_page);
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+EXPORT_SYMBOL(__LOAD_PHYSICAL_ADDR);
-+#endif
-diff --git a/arch/x86/kernel/i8259.c b/arch/x86/kernel/i8259.c
-index df89102..a244320 100644
---- a/arch/x86/kernel/i8259.c
-+++ b/arch/x86/kernel/i8259.c
-@@ -208,7 +208,7 @@ spurious_8259A_irq:
- "spurious 8259A interrupt: IRQ%d.\n", irq);
- spurious_irq_mask |= irqmask;
- }
-- atomic_inc(&irq_err_count);
-+ atomic_inc_unchecked(&irq_err_count);
- /*
- * Theoretically we do not have to handle this IRQ,
- * but in Linux this does not cause problems and is
-diff --git a/arch/x86/kernel/init_task.c b/arch/x86/kernel/init_task.c
-index 3a54dcb..1c22348 100644
---- a/arch/x86/kernel/init_task.c
-+++ b/arch/x86/kernel/init_task.c
-@@ -20,8 +20,7 @@ static struct sighand_struct init_sighand = INIT_SIGHAND(init_sighand);
- * way process stacks are handled. This is done by having a special
- * "init_task" linker map entry..
- */
--union thread_union init_thread_union __init_task_data =
-- { INIT_THREAD_INFO(init_task) };
-+union thread_union init_thread_union __init_task_data;
-
- /*
- * Initial task structure.
-@@ -38,5 +37,5 @@ EXPORT_SYMBOL(init_task);
- * section. Since TSS's are completely CPU-local, we want them
- * on exact cacheline boundaries, to eliminate cacheline ping-pong.
- */
--DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss) = INIT_TSS;
--
-+struct tss_struct init_tss[NR_CPUS] ____cacheline_internodealigned_in_smp = { [0 ... NR_CPUS-1] = INIT_TSS };
-+EXPORT_SYMBOL(init_tss);
-diff --git a/arch/x86/kernel/ioport.c b/arch/x86/kernel/ioport.c
-index 99c4d30..74c84e9 100644
---- a/arch/x86/kernel/ioport.c
-+++ b/arch/x86/kernel/ioport.c
-@@ -6,6 +6,7 @@
- #include <linux/sched.h>
- #include <linux/kernel.h>
- #include <linux/capability.h>
-+#include <linux/security.h>
- #include <linux/errno.h>
- #include <linux/types.h>
- #include <linux/ioport.h>
-@@ -41,6 +42,12 @@ asmlinkage long sys_ioperm(unsigned long from, unsigned long num, int turn_on)
-
- if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
- return -EINVAL;
-+#ifdef CONFIG_GRKERNSEC_IO
-+ if (turn_on && grsec_disable_privio) {
-+ gr_handle_ioperm();
-+ return -EPERM;
-+ }
-+#endif
- if (turn_on && !capable(CAP_SYS_RAWIO))
- return -EPERM;
-
-@@ -67,7 +74,7 @@ asmlinkage long sys_ioperm(unsigned long from, unsigned long num, int turn_on)
- * because the ->io_bitmap_max value must match the bitmap
- * contents:
- */
-- tss = &per_cpu(init_tss, get_cpu());
-+ tss = init_tss + get_cpu();
-
- set_bitmap(t->io_bitmap_ptr, from, num, !turn_on);
-
-@@ -111,6 +118,12 @@ static int do_iopl(unsigned int level, struct pt_regs *regs)
- return -EINVAL;
- /* Trying to gain more privileges? */
- if (level > old) {
-+#ifdef CONFIG_GRKERNSEC_IO
-+ if (grsec_disable_privio) {
-+ gr_handle_iopl();
-+ return -EPERM;
-+ }
-+#endif
- if (!capable(CAP_SYS_RAWIO))
- return -EPERM;
- }
-diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
-index 04bbd52..83a07d9 100644
---- a/arch/x86/kernel/irq.c
-+++ b/arch/x86/kernel/irq.c
-@@ -15,7 +15,7 @@
- #include <asm/mce.h>
- #include <asm/hw_irq.h>
-
--atomic_t irq_err_count;
-+atomic_unchecked_t irq_err_count;
-
- /* Function pointer for generic interrupt vector handling */
- void (*generic_interrupt_extension)(void) = NULL;
-@@ -114,9 +114,9 @@ static int show_other_interrupts(struct seq_file *p, int prec)
- seq_printf(p, "%10u ", per_cpu(mce_poll_count, j));
- seq_printf(p, " Machine check polls\n");
- #endif
-- seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read(&irq_err_count));
-+ seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read_unchecked(&irq_err_count));
- #if defined(CONFIG_X86_IO_APIC)
-- seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read(&irq_mis_count));
-+ seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read_unchecked(&irq_mis_count));
- #endif
- return 0;
- }
-@@ -209,10 +209,10 @@ u64 arch_irq_stat_cpu(unsigned int cpu)
-
- u64 arch_irq_stat(void)
- {
-- u64 sum = atomic_read(&irq_err_count);
-+ u64 sum = atomic_read_unchecked(&irq_err_count);
-
- #ifdef CONFIG_X86_IO_APIC
-- sum += atomic_read(&irq_mis_count);
-+ sum += atomic_read_unchecked(&irq_mis_count);
- #endif
- return sum;
- }
-diff --git a/arch/x86/kernel/irq_32.c b/arch/x86/kernel/irq_32.c
-index 7d35d0f..03f1d52 100644
---- a/arch/x86/kernel/irq_32.c
-+++ b/arch/x86/kernel/irq_32.c
-@@ -35,7 +35,7 @@ static int check_stack_overflow(void)
- __asm__ __volatile__("andl %%esp,%0" :
- "=r" (sp) : "0" (THREAD_SIZE - 1));
-
-- return sp < (sizeof(struct thread_info) + STACK_WARN);
-+ return sp < STACK_WARN;
- }
-
- static void print_stack_overflow(void)
-@@ -54,9 +54,9 @@ static inline void print_stack_overflow(void) { }
- * per-CPU IRQ handling contexts (thread information and stack)
- */
- union irq_ctx {
-- struct thread_info tinfo;
-- u32 stack[THREAD_SIZE/sizeof(u32)];
--} __attribute__((aligned(PAGE_SIZE)));
-+ unsigned long previous_esp;
-+ u32 stack[THREAD_SIZE/sizeof(u32)];
-+} __attribute__((aligned(THREAD_SIZE)));
-
- static DEFINE_PER_CPU(union irq_ctx *, hardirq_ctx);
- static DEFINE_PER_CPU(union irq_ctx *, softirq_ctx);
-@@ -78,10 +78,9 @@ static void call_on_stack(void *func, void *stack)
- static inline int
- execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
- {
-- union irq_ctx *curctx, *irqctx;
-+ union irq_ctx *irqctx;
- u32 *isp, arg1, arg2;
-
-- curctx = (union irq_ctx *) current_thread_info();
- irqctx = __get_cpu_var(hardirq_ctx);
-
- /*
-@@ -90,21 +89,16 @@ execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
- * handler) we can't do that and just have to keep using the
- * current stack (which is the irq stack already after all)
- */
-- if (unlikely(curctx == irqctx))
-+ if (unlikely((void *)current_stack_pointer - (void *)irqctx < THREAD_SIZE))
- return 0;
-
- /* build the stack frame on the IRQ stack */
-- isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
-- irqctx->tinfo.task = curctx->tinfo.task;
-- irqctx->tinfo.previous_esp = current_stack_pointer;
-+ isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
-+ irqctx->previous_esp = current_stack_pointer;
-
-- /*
-- * Copy the softirq bits in preempt_count so that the
-- * softirq checks work in the hardirq context.
-- */
-- irqctx->tinfo.preempt_count =
-- (irqctx->tinfo.preempt_count & ~SOFTIRQ_MASK) |
-- (curctx->tinfo.preempt_count & SOFTIRQ_MASK);
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ __set_fs(MAKE_MM_SEG(0));
-+#endif
-
- if (unlikely(overflow))
- call_on_stack(print_stack_overflow, isp);
-@@ -116,6 +110,11 @@ execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
- : "0" (irq), "1" (desc), "2" (isp),
- "D" (desc->handle_irq)
- : "memory", "cc", "ecx");
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ __set_fs(current_thread_info()->addr_limit);
-+#endif
-+
- return 1;
- }
-
-@@ -124,28 +123,11 @@ execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
- */
- void __cpuinit irq_ctx_init(int cpu)
- {
-- union irq_ctx *irqctx;
--
- if (per_cpu(hardirq_ctx, cpu))
- return;
-
-- irqctx = &per_cpu(hardirq_stack, cpu);
-- irqctx->tinfo.task = NULL;
-- irqctx->tinfo.exec_domain = NULL;
-- irqctx->tinfo.cpu = cpu;
-- irqctx->tinfo.preempt_count = HARDIRQ_OFFSET;
-- irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
--
-- per_cpu(hardirq_ctx, cpu) = irqctx;
--
-- irqctx = &per_cpu(softirq_stack, cpu);
-- irqctx->tinfo.task = NULL;
-- irqctx->tinfo.exec_domain = NULL;
-- irqctx->tinfo.cpu = cpu;
-- irqctx->tinfo.preempt_count = 0;
-- irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
--
-- per_cpu(softirq_ctx, cpu) = irqctx;
-+ per_cpu(hardirq_ctx, cpu) = &per_cpu(hardirq_stack, cpu);
-+ per_cpu(softirq_ctx, cpu) = &per_cpu(softirq_stack, cpu);
-
- printk(KERN_DEBUG "CPU %u irqstacks, hard=%p soft=%p\n",
- cpu, per_cpu(hardirq_ctx, cpu), per_cpu(softirq_ctx, cpu));
-@@ -159,7 +141,6 @@ void irq_ctx_exit(int cpu)
- asmlinkage void do_softirq(void)
- {
- unsigned long flags;
-- struct thread_info *curctx;
- union irq_ctx *irqctx;
- u32 *isp;
-
-@@ -169,15 +150,22 @@ asmlinkage void do_softirq(void)
- local_irq_save(flags);
-
- if (local_softirq_pending()) {
-- curctx = current_thread_info();
- irqctx = __get_cpu_var(softirq_ctx);
-- irqctx->tinfo.task = curctx->task;
-- irqctx->tinfo.previous_esp = current_stack_pointer;
-+ irqctx->previous_esp = current_stack_pointer;
-
- /* build the stack frame on the softirq stack */
-- isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
-+ isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ __set_fs(MAKE_MM_SEG(0));
-+#endif
-
- call_on_stack(__do_softirq, isp);
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ __set_fs(current_thread_info()->addr_limit);
-+#endif
-+
- /*
- * Shouldnt happen, we returned above if in_interrupt():
- */
-diff --git a/arch/x86/kernel/kdebugfs.c b/arch/x86/kernel/kdebugfs.c
-index e444357..e21e51e 100644
---- a/arch/x86/kernel/kdebugfs.c
-+++ b/arch/x86/kernel/kdebugfs.c
-@@ -26,7 +26,7 @@ struct setup_data_node {
- u32 len;
- };
-
--static ssize_t setup_data_read(struct file *file, char __user *user_buf,
-+static ssize_t __size_overflow(3) setup_data_read(struct file *file, char __user *user_buf,
- size_t count, loff_t *ppos)
- {
- struct setup_data_node *node = file->private_data;
-diff --git a/arch/x86/kernel/kgdb.c b/arch/x86/kernel/kgdb.c
-index 8d82a77..47a7f0b 100644
---- a/arch/x86/kernel/kgdb.c
-+++ b/arch/x86/kernel/kgdb.c
-@@ -42,6 +42,7 @@
- #include <linux/init.h>
- #include <linux/smp.h>
- #include <linux/nmi.h>
-+#include <linux/uaccess.h>
-
- #include <asm/apicdef.h>
- #include <asm/system.h>
-@@ -220,8 +221,12 @@ static void kgdb_correct_hw_break(void)
- dr7 |= ((breakinfo[breakno].len << 2) |
- breakinfo[breakno].type) <<
- ((breakno << 2) + 16);
-- if (breakno >= 0 && breakno <= 3)
-- set_debugreg(breakinfo[breakno].addr, breakno);
-+ if (breakno >= 0 && breakno <= 3) {
-+ if (breakinfo[breakno].type == 0)
-+ set_debugreg(ktla_ktva(breakinfo[breakno].addr), breakno);
-+ else
-+ set_debugreg(breakinfo[breakno].addr, breakno);
-+ }
-
- } else {
- if ((dr7 & breakbit) && !breakinfo[breakno].enabled) {
-@@ -390,13 +395,13 @@ int kgdb_arch_handle_exception(int e_vector, int signo, int err_code,
-
- /* clear the trace bit */
- linux_regs->flags &= ~X86_EFLAGS_TF;
-- atomic_set(&kgdb_cpu_doing_single_step, -1);
-+ atomic_set_unchecked(&kgdb_cpu_doing_single_step, -1);
-
- /* set the trace bit if we're stepping */
- if (remcomInBuffer[0] == 's') {
- linux_regs->flags |= X86_EFLAGS_TF;
- kgdb_single_step = 1;
-- atomic_set(&kgdb_cpu_doing_single_step,
-+ atomic_set_unchecked(&kgdb_cpu_doing_single_step,
- raw_smp_processor_id());
- }
-
-@@ -476,7 +481,7 @@ static int __kgdb_notify(struct die_args *args, unsigned long cmd)
- break;
-
- case DIE_DEBUG:
-- if (atomic_read(&kgdb_cpu_doing_single_step) ==
-+ if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) ==
- raw_smp_processor_id()) {
- if (user_mode(regs))
- return single_step_cont(regs, args);
-@@ -573,7 +578,27 @@ unsigned long kgdb_arch_pc(int exception, struct pt_regs *regs)
- return instruction_pointer(regs);
- }
-
--struct kgdb_arch arch_kgdb_ops = {
-+int kgdb_arch_set_breakpoint(unsigned long addr, char *saved_instr)
-+{
-+ int err;
-+
-+ addr = ktla_ktva(addr);
-+ err = probe_kernel_read(saved_instr, (char *)addr, BREAK_INSTR_SIZE);
-+ if (err)
-+ return err;
-+
-+ return probe_kernel_write((char *)addr, arch_kgdb_ops.gdb_bpt_instr,
-+ BREAK_INSTR_SIZE);
-+}
-+
-+int kgdb_arch_remove_breakpoint(unsigned long addr, char *bundle)
-+{
-+ addr = ktla_ktva(addr);
-+ return probe_kernel_write((char *)addr,
-+ (char *)bundle, BREAK_INSTR_SIZE);
-+}
-+
-+const struct kgdb_arch arch_kgdb_ops = {
- /* Breakpoint instruction: */
- .gdb_bpt_instr = { 0xcc },
- .flags = KGDB_HW_BREAKPOINT,
-diff --git a/arch/x86/kernel/kprobes.c b/arch/x86/kernel/kprobes.c
-index 7a67820..17c9752 100644
---- a/arch/x86/kernel/kprobes.c
-+++ b/arch/x86/kernel/kprobes.c
-@@ -168,9 +168,13 @@ static void __kprobes set_jmp_op(void *from, void *to)
- char op;
- s32 raddr;
- } __attribute__((packed)) * jop;
-- jop = (struct __arch_jmp_op *)from;
-+
-+ jop = (struct __arch_jmp_op *)(ktla_ktva(from));
-+
-+ pax_open_kernel();
- jop->raddr = (s32)((long)(to) - ((long)(from) + 5));
- jop->op = RELATIVEJUMP_INSTRUCTION;
-+ pax_close_kernel();
- }
-
- /*
-@@ -195,7 +199,7 @@ static int __kprobes can_boost(kprobe_opcode_t *opcodes)
- kprobe_opcode_t opcode;
- kprobe_opcode_t *orig_opcodes = opcodes;
-
-- if (search_exception_tables((unsigned long)opcodes))
-+ if (search_exception_tables(ktva_ktla((unsigned long)opcodes)))
- return 0; /* Page fault may occur on this address. */
-
- retry:
-@@ -339,7 +343,9 @@ static void __kprobes fix_riprel(struct kprobe *p)
- disp = (u8 *) p->addr + *((s32 *) insn) -
- (u8 *) p->ainsn.insn;
- BUG_ON((s64) (s32) disp != disp); /* Sanity check. */
-+ pax_open_kernel();
- *(s32 *)insn = (s32) disp;
-+ pax_close_kernel();
- }
- }
- #endif
-@@ -347,16 +353,18 @@ static void __kprobes fix_riprel(struct kprobe *p)
-
- static void __kprobes arch_copy_kprobe(struct kprobe *p)
- {
-- memcpy(p->ainsn.insn, p->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
-+ pax_open_kernel();
-+ memcpy(p->ainsn.insn, ktla_ktva(p->addr), MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
-+ pax_close_kernel();
-
- fix_riprel(p);
-
-- if (can_boost(p->addr))
-+ if (can_boost(ktla_ktva(p->addr)))
- p->ainsn.boostable = 0;
- else
- p->ainsn.boostable = -1;
-
-- p->opcode = *p->addr;
-+ p->opcode = *(ktla_ktva(p->addr));
- }
-
- int __kprobes arch_prepare_kprobe(struct kprobe *p)
-@@ -432,9 +440,9 @@ static void __kprobes prepare_singlestep(struct kprobe *p, struct pt_regs *regs)
- regs->flags &= ~X86_EFLAGS_IF;
- /* single step inline if the instruction is an int3 */
- if (p->opcode == BREAKPOINT_INSTRUCTION)
-- regs->ip = (unsigned long)p->addr;
-+ regs->ip = ktla_ktva((unsigned long)p->addr);
- else
-- regs->ip = (unsigned long)p->ainsn.insn;
-+ regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
- }
-
- void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri,
-@@ -455,7 +463,7 @@ static void __kprobes setup_singlestep(struct kprobe *p, struct pt_regs *regs,
- if (p->ainsn.boostable == 1 && !p->post_handler) {
- /* Boost up -- we can execute copied instructions directly */
- reset_current_kprobe();
-- regs->ip = (unsigned long)p->ainsn.insn;
-+ regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
- preempt_enable_no_resched();
- return;
- }
-@@ -525,7 +533,7 @@ static int __kprobes kprobe_handler(struct pt_regs *regs)
- struct kprobe_ctlblk *kcb;
-
- addr = (kprobe_opcode_t *)(regs->ip - sizeof(kprobe_opcode_t));
-- if (*addr != BREAKPOINT_INSTRUCTION) {
-+ if (*(kprobe_opcode_t *)ktla_ktva((unsigned long)addr) != BREAKPOINT_INSTRUCTION) {
- /*
- * The breakpoint instruction was removed right
- * after we hit it. Another cpu has removed
-@@ -637,6 +645,9 @@ static void __used __kprobes kretprobe_trampoline_holder(void)
- /* Skip orig_ax, ip, cs */
- " addq $24, %rsp\n"
- " popfq\n"
-+#ifdef KERNEXEC_PLUGIN
-+ " btsq $63,(%rsp)\n"
-+#endif
- #else
- " pushf\n"
- /*
-@@ -777,7 +788,7 @@ static void __kprobes resume_execution(struct kprobe *p,
- struct pt_regs *regs, struct kprobe_ctlblk *kcb)
- {
- unsigned long *tos = stack_addr(regs);
-- unsigned long copy_ip = (unsigned long)p->ainsn.insn;
-+ unsigned long copy_ip = ktva_ktla((unsigned long)p->ainsn.insn);
- unsigned long orig_ip = (unsigned long)p->addr;
- kprobe_opcode_t *insn = p->ainsn.insn;
-
-@@ -960,7 +971,7 @@ int __kprobes kprobe_exceptions_notify(struct notifier_block *self,
- struct die_args *args = data;
- int ret = NOTIFY_DONE;
-
-- if (args->regs && user_mode_vm(args->regs))
-+ if (args->regs && user_mode(args->regs))
- return ret;
-
- switch (val) {
-diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
-index 63b0ec8..6d92227 100644
---- a/arch/x86/kernel/kvm.c
-+++ b/arch/x86/kernel/kvm.c
-@@ -216,6 +216,7 @@ static void __init paravirt_ops_setup(void)
- pv_mmu_ops.set_pud = kvm_set_pud;
- #if PAGETABLE_LEVELS == 4
- pv_mmu_ops.set_pgd = kvm_set_pgd;
-+ pv_mmu_ops.set_pgd_batched = kvm_set_pgd;
- #endif
- #endif
- pv_mmu_ops.flush_tlb_user = kvm_flush_tlb;
-diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
-index ec6ef60..ab2c824 100644
---- a/arch/x86/kernel/ldt.c
-+++ b/arch/x86/kernel/ldt.c
-@@ -66,13 +66,13 @@ static int alloc_ldt(mm_context_t *pc, int mincount, int reload)
- if (reload) {
- #ifdef CONFIG_SMP
- preempt_disable();
-- load_LDT(pc);
-+ load_LDT_nolock(pc);
- if (!cpumask_equal(mm_cpumask(current->mm),
- cpumask_of(smp_processor_id())))
- smp_call_function(flush_ldt, current->mm, 1);
- preempt_enable();
- #else
-- load_LDT(pc);
-+ load_LDT_nolock(pc);
- #endif
- }
- if (oldsize) {
-@@ -94,7 +94,7 @@ static inline int copy_ldt(mm_context_t *new, mm_context_t *old)
- return err;
-
- for (i = 0; i < old->size; i++)
-- write_ldt_entry(new->ldt, i, old->ldt + i * LDT_ENTRY_SIZE);
-+ write_ldt_entry(new->ldt, i, old->ldt + i);
- return 0;
- }
-
-@@ -115,6 +115,24 @@ int init_new_context(struct task_struct *tsk, struct mm_struct *mm)
- retval = copy_ldt(&mm->context, &old_mm->context);
- mutex_unlock(&old_mm->context.lock);
- }
-+
-+ if (tsk == current) {
-+ mm->context.vdso = 0;
-+
-+#ifdef CONFIG_X86_32
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+ mm->context.user_cs_base = 0UL;
-+ mm->context.user_cs_limit = ~0UL;
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
-+ cpus_clear(mm->context.cpu_user_cs_mask);
-+#endif
-+
-+#endif
-+#endif
-+
-+ }
-+
- return retval;
- }
-
-@@ -229,6 +247,13 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
- }
- }
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (ldt_info.contents & MODIFY_LDT_CONTENTS_CODE)) {
-+ error = -EINVAL;
-+ goto out_unlock;
-+ }
-+#endif
-+
- fill_ldt(&ldt, &ldt_info);
- if (oldmode)
- ldt.avl = 0;
-diff --git a/arch/x86/kernel/machine_kexec_32.c b/arch/x86/kernel/machine_kexec_32.c
-index c1c429d..f02eaf9 100644
---- a/arch/x86/kernel/machine_kexec_32.c
-+++ b/arch/x86/kernel/machine_kexec_32.c
-@@ -26,7 +26,7 @@
- #include <asm/system.h>
- #include <asm/cacheflush.h>
-
--static void set_idt(void *newidt, __u16 limit)
-+static void set_idt(struct desc_struct *newidt, __u16 limit)
- {
- struct desc_ptr curidt;
-
-@@ -38,7 +38,7 @@ static void set_idt(void *newidt, __u16 limit)
- }
-
-
--static void set_gdt(void *newgdt, __u16 limit)
-+static void set_gdt(struct desc_struct *newgdt, __u16 limit)
- {
- struct desc_ptr curgdt;
-
-@@ -217,7 +217,7 @@ void machine_kexec(struct kimage *image)
- }
-
- control_page = page_address(image->control_code_page);
-- memcpy(control_page, relocate_kernel, KEXEC_CONTROL_CODE_MAX_SIZE);
-+ memcpy(control_page, (void *)ktla_ktva((unsigned long)relocate_kernel), KEXEC_CONTROL_CODE_MAX_SIZE);
-
- relocate_kernel_ptr = control_page;
- page_list[PA_CONTROL_PAGE] = __pa(control_page);
-diff --git a/arch/x86/kernel/microcode_amd.c b/arch/x86/kernel/microcode_amd.c
-index 1e47679..e73449d 100644
---- a/arch/x86/kernel/microcode_amd.c
-+++ b/arch/x86/kernel/microcode_amd.c
-@@ -364,7 +364,7 @@ static void microcode_fini_cpu_amd(int cpu)
- uci->mc = NULL;
- }
-
--static struct microcode_ops microcode_amd_ops = {
-+static const struct microcode_ops microcode_amd_ops = {
- .request_microcode_user = request_microcode_user,
- .request_microcode_fw = request_microcode_fw,
- .collect_cpu_info = collect_cpu_info_amd,
-@@ -372,7 +372,7 @@ static struct microcode_ops microcode_amd_ops = {
- .microcode_fini_cpu = microcode_fini_cpu_amd,
- };
-
--struct microcode_ops * __init init_amd_microcode(void)
-+const struct microcode_ops * __init init_amd_microcode(void)
- {
- return µcode_amd_ops;
- }
-diff --git a/arch/x86/kernel/microcode_core.c b/arch/x86/kernel/microcode_core.c
-index 378e9a8..b5a6ea9 100644
---- a/arch/x86/kernel/microcode_core.c
-+++ b/arch/x86/kernel/microcode_core.c
-@@ -90,7 +90,7 @@ MODULE_LICENSE("GPL");
-
- #define MICROCODE_VERSION "2.00"
-
--static struct microcode_ops *microcode_ops;
-+static const struct microcode_ops *microcode_ops;
-
- /*
- * Synchronization.
-diff --git a/arch/x86/kernel/microcode_intel.c b/arch/x86/kernel/microcode_intel.c
-index 0d334dd..14cedaf 100644
---- a/arch/x86/kernel/microcode_intel.c
-+++ b/arch/x86/kernel/microcode_intel.c
-@@ -443,13 +443,13 @@ static enum ucode_state request_microcode_fw(int cpu, struct device *device)
-
- static int get_ucode_user(void *to, const void *from, size_t n)
- {
-- return copy_from_user(to, from, n);
-+ return copy_from_user(to, (const void __force_user *)from, n);
- }
-
- static enum ucode_state
- request_microcode_user(int cpu, const void __user *buf, size_t size)
- {
-- return generic_load_microcode(cpu, (void *)buf, size, &get_ucode_user);
-+ return generic_load_microcode(cpu, (__force_kernel void *)buf, size, &get_ucode_user);
- }
-
- static void microcode_fini_cpu(int cpu)
-@@ -460,7 +460,7 @@ static void microcode_fini_cpu(int cpu)
- uci->mc = NULL;
- }
-
--static struct microcode_ops microcode_intel_ops = {
-+static const struct microcode_ops microcode_intel_ops = {
- .request_microcode_user = request_microcode_user,
- .request_microcode_fw = request_microcode_fw,
- .collect_cpu_info = collect_cpu_info,
-@@ -468,7 +468,7 @@ static struct microcode_ops microcode_intel_ops = {
- .microcode_fini_cpu = microcode_fini_cpu,
- };
-
--struct microcode_ops * __init init_intel_microcode(void)
-+const struct microcode_ops * __init init_intel_microcode(void)
- {
- return µcode_intel_ops;
- }
-diff --git a/arch/x86/kernel/module.c b/arch/x86/kernel/module.c
-index 89f386f..9028f51 100644
---- a/arch/x86/kernel/module.c
-+++ b/arch/x86/kernel/module.c
-@@ -34,7 +34,7 @@
- #define DEBUGP(fmt...)
- #endif
-
--void *module_alloc(unsigned long size)
-+static void *__module_alloc(unsigned long size, pgprot_t prot)
- {
- struct vm_struct *area;
-
-@@ -48,8 +48,18 @@ void *module_alloc(unsigned long size)
- if (!area)
- return NULL;
-
-- return __vmalloc_area(area, GFP_KERNEL | __GFP_HIGHMEM,
-- PAGE_KERNEL_EXEC);
-+ return __vmalloc_area(area, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, prot);
-+}
-+
-+void *module_alloc(unsigned long size)
-+{
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ return __module_alloc(size, PAGE_KERNEL);
-+#else
-+ return __module_alloc(size, PAGE_KERNEL_EXEC);
-+#endif
-+
- }
-
- /* Free memory returned from module_alloc */
-@@ -58,6 +68,40 @@ void module_free(struct module *mod, void *module_region)
- vfree(module_region);
- }
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+#ifdef CONFIG_X86_32
-+void *module_alloc_exec(unsigned long size)
-+{
-+ struct vm_struct *area;
-+
-+ if (size == 0)
-+ return NULL;
-+
-+ area = __get_vm_area(size, VM_ALLOC, (unsigned long)&MODULES_EXEC_VADDR, (unsigned long)&MODULES_EXEC_END);
-+ return area ? area->addr : NULL;
-+}
-+EXPORT_SYMBOL(module_alloc_exec);
-+
-+void module_free_exec(struct module *mod, void *module_region)
-+{
-+ vunmap(module_region);
-+}
-+EXPORT_SYMBOL(module_free_exec);
-+#else
-+void module_free_exec(struct module *mod, void *module_region)
-+{
-+ module_free(mod, module_region);
-+}
-+EXPORT_SYMBOL(module_free_exec);
-+
-+void *module_alloc_exec(unsigned long size)
-+{
-+ return __module_alloc(size, PAGE_KERNEL_RX);
-+}
-+EXPORT_SYMBOL(module_alloc_exec);
-+#endif
-+#endif
-+
- /* We don't need anything special. */
- int module_frob_arch_sections(Elf_Ehdr *hdr,
- Elf_Shdr *sechdrs,
-@@ -77,14 +121,16 @@ int apply_relocate(Elf32_Shdr *sechdrs,
- unsigned int i;
- Elf32_Rel *rel = (void *)sechdrs[relsec].sh_addr;
- Elf32_Sym *sym;
-- uint32_t *location;
-+ uint32_t *plocation, location;
-
- DEBUGP("Applying relocate section %u to %u\n", relsec,
- sechdrs[relsec].sh_info);
- for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) {
- /* This is where to make the change */
-- location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr
-- + rel[i].r_offset;
-+ plocation = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr + rel[i].r_offset;
-+ location = (uint32_t)plocation;
-+ if (sechdrs[sechdrs[relsec].sh_info].sh_flags & SHF_EXECINSTR)
-+ plocation = ktla_ktva((void *)plocation);
- /* This is the symbol it is referring to. Note that all
- undefined symbols have been resolved. */
- sym = (Elf32_Sym *)sechdrs[symindex].sh_addr
-@@ -93,11 +139,15 @@ int apply_relocate(Elf32_Shdr *sechdrs,
- switch (ELF32_R_TYPE(rel[i].r_info)) {
- case R_386_32:
- /* We add the value into the location given */
-- *location += sym->st_value;
-+ pax_open_kernel();
-+ *plocation += sym->st_value;
-+ pax_close_kernel();
- break;
- case R_386_PC32:
- /* Add the value, subtract its postition */
-- *location += sym->st_value - (uint32_t)location;
-+ pax_open_kernel();
-+ *plocation += sym->st_value - location;
-+ pax_close_kernel();
- break;
- default:
- printk(KERN_ERR "module %s: Unknown relocation: %u\n",
-@@ -153,21 +203,30 @@ int apply_relocate_add(Elf64_Shdr *sechdrs,
- case R_X86_64_NONE:
- break;
- case R_X86_64_64:
-+ pax_open_kernel();
- *(u64 *)loc = val;
-+ pax_close_kernel();
- break;
- case R_X86_64_32:
-+ pax_open_kernel();
- *(u32 *)loc = val;
-+ pax_close_kernel();
- if (val != *(u32 *)loc)
- goto overflow;
- break;
- case R_X86_64_32S:
-+ pax_open_kernel();
- *(s32 *)loc = val;
-+ pax_close_kernel();
- if ((s64)val != *(s32 *)loc)
- goto overflow;
- break;
- case R_X86_64_PC32:
- val -= (u64)loc;
-+ pax_open_kernel();
- *(u32 *)loc = val;
-+ pax_close_kernel();
-+
- #if 0
- if ((s64)val != *(s32 *)loc)
- goto overflow;
-diff --git a/arch/x86/kernel/paravirt-spinlocks.c b/arch/x86/kernel/paravirt-spinlocks.c
-index 3a7c5a4..9191528 100644
---- a/arch/x86/kernel/paravirt-spinlocks.c
-+++ b/arch/x86/kernel/paravirt-spinlocks.c
-@@ -13,7 +13,7 @@ default_spin_lock_flags(raw_spinlock_t *lock, unsigned long flags)
- __raw_spin_lock(lock);
- }
-
--struct pv_lock_ops pv_lock_ops = {
-+struct pv_lock_ops pv_lock_ops __read_only = {
- #ifdef CONFIG_SMP
- .spin_is_locked = __ticket_spin_is_locked,
- .spin_is_contended = __ticket_spin_is_contended,
-diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
-index 1b1739d..dea6077 100644
---- a/arch/x86/kernel/paravirt.c
-+++ b/arch/x86/kernel/paravirt.c
-@@ -53,6 +53,9 @@ u64 _paravirt_ident_64(u64 x)
- {
- return x;
- }
-+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
-+PV_CALLEE_SAVE_REGS_THUNK(_paravirt_ident_64);
-+#endif
-
- void __init default_banner(void)
- {
-@@ -122,7 +125,7 @@ unsigned paravirt_patch_jmp(void *insnbuf, const void *target,
- * corresponding structure. */
- static void *get_call_destination(u8 type)
- {
-- struct paravirt_patch_template tmpl = {
-+ const struct paravirt_patch_template tmpl = {
- .pv_init_ops = pv_init_ops,
- .pv_time_ops = pv_time_ops,
- .pv_cpu_ops = pv_cpu_ops,
-@@ -133,6 +136,8 @@ static void *get_call_destination(u8 type)
- .pv_lock_ops = pv_lock_ops,
- #endif
- };
-+
-+ pax_track_stack();
- return *((void **)&tmpl + type);
- }
-
-@@ -145,15 +150,19 @@ unsigned paravirt_patch_default(u8 type, u16 clobbers, void *insnbuf,
- if (opfunc == NULL)
- /* If there's no function, patch it with a ud2a (BUG) */
- ret = paravirt_patch_insns(insnbuf, len, ud2a, ud2a+sizeof(ud2a));
-- else if (opfunc == _paravirt_nop)
-+ else if (opfunc == (void *)_paravirt_nop)
- /* If the operation is a nop, then nop the callsite */
- ret = paravirt_patch_nop();
-
- /* identity functions just return their single argument */
-- else if (opfunc == _paravirt_ident_32)
-+ else if (opfunc == (void *)_paravirt_ident_32)
- ret = paravirt_patch_ident_32(insnbuf, len);
-- else if (opfunc == _paravirt_ident_64)
-+ else if (opfunc == (void *)_paravirt_ident_64)
- ret = paravirt_patch_ident_64(insnbuf, len);
-+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
-+ else if (opfunc == (void *)__raw_callee_save__paravirt_ident_64)
-+ ret = paravirt_patch_ident_64(insnbuf, len);
-+#endif
-
- else if (type == PARAVIRT_PATCH(pv_cpu_ops.iret) ||
- type == PARAVIRT_PATCH(pv_cpu_ops.irq_enable_sysexit) ||
-@@ -178,7 +187,7 @@ unsigned paravirt_patch_insns(void *insnbuf, unsigned len,
- if (insn_len > len || start == NULL)
- insn_len = len;
- else
-- memcpy(insnbuf, start, insn_len);
-+ memcpy(insnbuf, ktla_ktva(start), insn_len);
-
- return insn_len;
- }
-@@ -294,22 +303,22 @@ void arch_flush_lazy_mmu_mode(void)
- preempt_enable();
- }
-
--struct pv_info pv_info = {
-+struct pv_info pv_info __read_only = {
- .name = "bare hardware",
- .paravirt_enabled = 0,
- .kernel_rpl = 0,
- .shared_kernel_pmd = 1, /* Only used when CONFIG_X86_PAE is set */
- };
-
--struct pv_init_ops pv_init_ops = {
-+struct pv_init_ops pv_init_ops __read_only = {
- .patch = native_patch,
- };
-
--struct pv_time_ops pv_time_ops = {
-+struct pv_time_ops pv_time_ops __read_only = {
- .sched_clock = native_sched_clock,
- };
-
--struct pv_irq_ops pv_irq_ops = {
-+struct pv_irq_ops pv_irq_ops __read_only = {
- .save_fl = __PV_IS_CALLEE_SAVE(native_save_fl),
- .restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl),
- .irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable),
-@@ -321,7 +330,7 @@ struct pv_irq_ops pv_irq_ops = {
- #endif
- };
-
--struct pv_cpu_ops pv_cpu_ops = {
-+struct pv_cpu_ops pv_cpu_ops __read_only = {
- .cpuid = native_cpuid,
- .get_debugreg = native_get_debugreg,
- .set_debugreg = native_set_debugreg,
-@@ -382,21 +391,26 @@ struct pv_cpu_ops pv_cpu_ops = {
- .end_context_switch = paravirt_nop,
- };
-
--struct pv_apic_ops pv_apic_ops = {
-+struct pv_apic_ops pv_apic_ops __read_only = {
- #ifdef CONFIG_X86_LOCAL_APIC
- .startup_ipi_hook = paravirt_nop,
- #endif
- };
-
--#if defined(CONFIG_X86_32) && !defined(CONFIG_X86_PAE)
-+#ifdef CONFIG_X86_32
-+#ifdef CONFIG_X86_PAE
-+/* 64-bit pagetable entries */
-+#define PTE_IDENT PV_CALLEE_SAVE(_paravirt_ident_64)
-+#else
- /* 32-bit pagetable entries */
- #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_32)
-+#endif
- #else
- /* 64-bit pagetable entries */
- #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_64)
- #endif
-
--struct pv_mmu_ops pv_mmu_ops = {
-+struct pv_mmu_ops pv_mmu_ops __read_only = {
-
- .read_cr2 = native_read_cr2,
- .write_cr2 = native_write_cr2,
-@@ -448,6 +462,7 @@ struct pv_mmu_ops pv_mmu_ops = {
- .make_pud = PTE_IDENT,
-
- .set_pgd = native_set_pgd,
-+ .set_pgd_batched = native_set_pgd_batched,
- #endif
- #endif /* PAGETABLE_LEVELS >= 3 */
-
-@@ -467,6 +482,12 @@ struct pv_mmu_ops pv_mmu_ops = {
- },
-
- .set_fixmap = native_set_fixmap,
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ .pax_open_kernel = native_pax_open_kernel,
-+ .pax_close_kernel = native_pax_close_kernel,
-+#endif
-+
- };
-
- EXPORT_SYMBOL_GPL(pv_time_ops);
-diff --git a/arch/x86/kernel/pci-calgary_64.c b/arch/x86/kernel/pci-calgary_64.c
-index 1a2d4b1..6a0dd55 100644
---- a/arch/x86/kernel/pci-calgary_64.c
-+++ b/arch/x86/kernel/pci-calgary_64.c
-@@ -477,7 +477,7 @@ static void calgary_free_coherent(struct device *dev, size_t size,
- free_pages((unsigned long)vaddr, get_order(size));
- }
-
--static struct dma_map_ops calgary_dma_ops = {
-+static const struct dma_map_ops calgary_dma_ops = {
- .alloc_coherent = calgary_alloc_coherent,
- .free_coherent = calgary_free_coherent,
- .map_sg = calgary_map_sg,
-diff --git a/arch/x86/kernel/pci-dma.c b/arch/x86/kernel/pci-dma.c
-index 6ac3931..42b4414 100644
---- a/arch/x86/kernel/pci-dma.c
-+++ b/arch/x86/kernel/pci-dma.c
-@@ -14,7 +14,7 @@
-
- static int forbid_dac __read_mostly;
-
--struct dma_map_ops *dma_ops;
-+const struct dma_map_ops *dma_ops;
- EXPORT_SYMBOL(dma_ops);
-
- static int iommu_sac_force __read_mostly;
-@@ -243,7 +243,7 @@ early_param("iommu", iommu_setup);
-
- int dma_supported(struct device *dev, u64 mask)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- #ifdef CONFIG_PCI
- if (mask > 0xffffffff && forbid_dac > 0) {
-diff --git a/arch/x86/kernel/pci-gart_64.c b/arch/x86/kernel/pci-gart_64.c
-index 1c76691..e3632db 100644
---- a/arch/x86/kernel/pci-gart_64.c
-+++ b/arch/x86/kernel/pci-gart_64.c
-@@ -682,7 +682,7 @@ static __init int init_k8_gatt(struct agp_kern_info *info)
- return -1;
- }
-
--static struct dma_map_ops gart_dma_ops = {
-+static const struct dma_map_ops gart_dma_ops = {
- .map_sg = gart_map_sg,
- .unmap_sg = gart_unmap_sg,
- .map_page = gart_map_page,
-diff --git a/arch/x86/kernel/pci-nommu.c b/arch/x86/kernel/pci-nommu.c
-index a3933d4..c898869 100644
---- a/arch/x86/kernel/pci-nommu.c
-+++ b/arch/x86/kernel/pci-nommu.c
-@@ -94,7 +94,7 @@ static void nommu_sync_sg_for_device(struct device *dev,
- flush_write_buffers();
- }
-
--struct dma_map_ops nommu_dma_ops = {
-+const struct dma_map_ops nommu_dma_ops = {
- .alloc_coherent = dma_generic_alloc_coherent,
- .free_coherent = nommu_free_coherent,
- .map_sg = nommu_map_sg,
-diff --git a/arch/x86/kernel/pci-swiotlb.c b/arch/x86/kernel/pci-swiotlb.c
-index aaa6b78..4de1881 100644
---- a/arch/x86/kernel/pci-swiotlb.c
-+++ b/arch/x86/kernel/pci-swiotlb.c
-@@ -25,7 +25,7 @@ static void *x86_swiotlb_alloc_coherent(struct device *hwdev, size_t size,
- return swiotlb_alloc_coherent(hwdev, size, dma_handle, flags);
- }
-
--static struct dma_map_ops swiotlb_dma_ops = {
-+static const struct dma_map_ops swiotlb_dma_ops = {
- .mapping_error = swiotlb_dma_mapping_error,
- .alloc_coherent = x86_swiotlb_alloc_coherent,
- .free_coherent = swiotlb_free_coherent,
-diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
-index fc6c84d..0312ca2 100644
---- a/arch/x86/kernel/process.c
-+++ b/arch/x86/kernel/process.c
-@@ -51,16 +51,33 @@ void free_thread_xstate(struct task_struct *tsk)
-
- void free_thread_info(struct thread_info *ti)
- {
-- free_thread_xstate(ti->task);
- free_pages((unsigned long)ti, get_order(THREAD_SIZE));
- }
-
-+static struct kmem_cache *task_struct_cachep;
-+
- void arch_task_cache_init(void)
- {
-- task_xstate_cachep =
-- kmem_cache_create("task_xstate", xstate_size,
-+ /* create a slab on which task_structs can be allocated */
-+ task_struct_cachep =
-+ kmem_cache_create("task_struct", sizeof(struct task_struct),
-+ ARCH_MIN_TASKALIGN, SLAB_PANIC | SLAB_NOTRACK, NULL);
-+
-+ task_xstate_cachep =
-+ kmem_cache_create("task_xstate", xstate_size,
- __alignof__(union thread_xstate),
-- SLAB_PANIC | SLAB_NOTRACK, NULL);
-+ SLAB_PANIC | SLAB_NOTRACK | SLAB_USERCOPY, NULL);
-+}
-+
-+struct task_struct *alloc_task_struct(void)
-+{
-+ return kmem_cache_alloc(task_struct_cachep, GFP_KERNEL);
-+}
-+
-+void free_task_struct(struct task_struct *task)
-+{
-+ free_thread_xstate(task);
-+ kmem_cache_free(task_struct_cachep, task);
- }
-
- /*
-@@ -73,7 +90,7 @@ void exit_thread(void)
- unsigned long *bp = t->io_bitmap_ptr;
-
- if (bp) {
-- struct tss_struct *tss = &per_cpu(init_tss, get_cpu());
-+ struct tss_struct *tss = init_tss + get_cpu();
-
- t->io_bitmap_ptr = NULL;
- clear_thread_flag(TIF_IO_BITMAP);
-@@ -93,6 +110,9 @@ void flush_thread(void)
-
- clear_tsk_thread_flag(tsk, TIF_DEBUG);
-
-+#if defined(CONFIG_X86_32) && !defined(CONFIG_CC_STACKPROTECTOR) && !defined(CONFIG_PAX_MEMORY_UDEREF)
-+ loadsegment(gs, 0);
-+#endif
- tsk->thread.debugreg0 = 0;
- tsk->thread.debugreg1 = 0;
- tsk->thread.debugreg2 = 0;
-@@ -307,7 +327,7 @@ void default_idle(void)
- EXPORT_SYMBOL(default_idle);
- #endif
-
--void stop_this_cpu(void *dummy)
-+__noreturn void stop_this_cpu(void *dummy)
- {
- local_irq_disable();
- /*
-@@ -568,16 +588,38 @@ static int __init idle_setup(char *str)
- }
- early_param("idle", idle_setup);
-
--unsigned long arch_align_stack(unsigned long sp)
-+#ifdef CONFIG_PAX_RANDKSTACK
-+void pax_randomize_kstack(struct pt_regs *regs)
- {
-- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
-- sp -= get_random_int() % 8192;
-- return sp & ~0xf;
--}
-+ struct thread_struct *thread = ¤t->thread;
-+ unsigned long time;
-
--unsigned long arch_randomize_brk(struct mm_struct *mm)
--{
-- unsigned long range_end = mm->brk + 0x02000000;
-- return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
-+ if (!randomize_va_space)
-+ return;
-+
-+ if (v8086_mode(regs))
-+ return;
-+
-+ rdtscl(time);
-+
-+ /* P4 seems to return a 0 LSB, ignore it */
-+#ifdef CONFIG_MPENTIUM4
-+ time &= 0x3EUL;
-+ time <<= 2;
-+#elif defined(CONFIG_X86_64)
-+ time &= 0xFUL;
-+ time <<= 4;
-+#else
-+ time &= 0x1FUL;
-+ time <<= 3;
-+#endif
-+
-+ thread->sp0 ^= time;
-+ load_sp0(init_tss + smp_processor_id(), thread);
-+
-+#ifdef CONFIG_X86_64
-+ percpu_write(kernel_stack, thread->sp0);
-+#endif
- }
-+#endif
-
-diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
-index c40c432..e88c62c 100644
---- a/arch/x86/kernel/process_32.c
-+++ b/arch/x86/kernel/process_32.c
-@@ -67,6 +67,7 @@ asmlinkage void ret_from_fork(void) __asm__("ret_from_fork");
- unsigned long thread_saved_pc(struct task_struct *tsk)
- {
- return ((unsigned long *)tsk->thread.sp)[3];
-+//XXX return tsk->thread.eip;
- }
-
- #ifndef CONFIG_SMP
-@@ -129,15 +130,14 @@ void __show_regs(struct pt_regs *regs, int all)
- unsigned short ss, gs;
- const char *board;
-
-- if (user_mode_vm(regs)) {
-+ if (user_mode(regs)) {
- sp = regs->sp;
- ss = regs->ss & 0xffff;
-- gs = get_user_gs(regs);
- } else {
- sp = (unsigned long) (®s->sp);
- savesegment(ss, ss);
-- savesegment(gs, gs);
- }
-+ gs = get_user_gs(regs);
-
- printk("\n");
-
-@@ -152,7 +152,7 @@ void __show_regs(struct pt_regs *regs, int all)
-
- printk("EIP: %04x:[<%08lx>] EFLAGS: %08lx CPU: %d\n",
- (u16)regs->cs, regs->ip, regs->flags,
-- smp_processor_id());
-+ raw_smp_processor_id());
- print_symbol("EIP is at %s\n", regs->ip);
-
- printk("EAX: %08lx EBX: %08lx ECX: %08lx EDX: %08lx\n",
-@@ -210,10 +210,10 @@ int kernel_thread(int (*fn)(void *), void *arg, unsigned long flags)
- regs.bx = (unsigned long) fn;
- regs.dx = (unsigned long) arg;
-
-- regs.ds = __USER_DS;
-- regs.es = __USER_DS;
-+ regs.ds = __KERNEL_DS;
-+ regs.es = __KERNEL_DS;
- regs.fs = __KERNEL_PERCPU;
-- regs.gs = __KERNEL_STACK_CANARY;
-+ savesegment(gs, regs.gs);
- regs.orig_ax = -1;
- regs.ip = (unsigned long) kernel_thread_helper;
- regs.cs = __KERNEL_CS | get_kernel_rpl();
-@@ -247,13 +247,14 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
- struct task_struct *tsk;
- int err;
-
-- childregs = task_pt_regs(p);
-+ childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 8;
- *childregs = *regs;
- childregs->ax = 0;
- childregs->sp = sp;
-
- p->thread.sp = (unsigned long) childregs;
- p->thread.sp0 = (unsigned long) (childregs+1);
-+ p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
-
- p->thread.ip = (unsigned long) ret_from_fork;
-
-@@ -345,7 +346,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
- struct thread_struct *prev = &prev_p->thread,
- *next = &next_p->thread;
- int cpu = smp_processor_id();
-- struct tss_struct *tss = &per_cpu(init_tss, cpu);
-+ struct tss_struct *tss = init_tss + cpu;
- bool preload_fpu;
-
- /* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
-@@ -380,6 +381,10 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
- */
- lazy_save_gs(prev->gs);
-
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ __set_fs(task_thread_info(next_p)->addr_limit);
-+#endif
-+
- /*
- * Load the per-thread Thread-Local Storage descriptor.
- */
-@@ -415,6 +420,9 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
- */
- arch_end_context_switch(next_p);
-
-+ percpu_write(current_task, next_p);
-+ percpu_write(current_tinfo, &next_p->tinfo);
-+
- if (preload_fpu)
- __math_state_restore();
-
-@@ -424,8 +432,6 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
- if (prev->gs | next->gs)
- lazy_load_gs(next->gs);
-
-- percpu_write(current_task, next_p);
--
- return prev_p;
- }
-
-@@ -495,4 +501,3 @@ unsigned long get_wchan(struct task_struct *p)
- } while (count++ < 16);
- return 0;
- }
--
-diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
-index 39493bc..196816d 100644
---- a/arch/x86/kernel/process_64.c
-+++ b/arch/x86/kernel/process_64.c
-@@ -91,7 +91,7 @@ static void __exit_idle(void)
- void exit_idle(void)
- {
- /* idle loop has pid 0 */
-- if (current->pid)
-+ if (task_pid_nr(current))
- return;
- __exit_idle();
- }
-@@ -170,7 +170,7 @@ void __show_regs(struct pt_regs *regs, int all)
- if (!board)
- board = "";
- printk(KERN_INFO "Pid: %d, comm: %.20s %s %s %.*s %s\n",
-- current->pid, current->comm, print_tainted(),
-+ task_pid_nr(current), current->comm, print_tainted(),
- init_utsname()->release,
- (int)strcspn(init_utsname()->version, " "),
- init_utsname()->version, board);
-@@ -280,8 +280,7 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
- struct pt_regs *childregs;
- struct task_struct *me = current;
-
-- childregs = ((struct pt_regs *)
-- (THREAD_SIZE + task_stack_page(p))) - 1;
-+ childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 16;
- *childregs = *regs;
-
- childregs->ax = 0;
-@@ -292,6 +291,7 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
- p->thread.sp = (unsigned long) childregs;
- p->thread.sp0 = (unsigned long) (childregs+1);
- p->thread.usersp = me->thread.usersp;
-+ p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
-
- set_tsk_thread_flag(p, TIF_FORK);
-
-@@ -379,7 +379,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
- struct thread_struct *prev = &prev_p->thread;
- struct thread_struct *next = &next_p->thread;
- int cpu = smp_processor_id();
-- struct tss_struct *tss = &per_cpu(init_tss, cpu);
-+ struct tss_struct *tss = init_tss + cpu;
- unsigned fsindex, gsindex;
- bool preload_fpu;
-
-@@ -475,10 +475,9 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
- prev->usersp = percpu_read(old_rsp);
- percpu_write(old_rsp, next->usersp);
- percpu_write(current_task, next_p);
-+ percpu_write(current_tinfo, &next_p->tinfo);
-
-- percpu_write(kernel_stack,
-- (unsigned long)task_stack_page(next_p) +
-- THREAD_SIZE - KERNEL_STACK_OFFSET);
-+ percpu_write(kernel_stack, next->sp0);
-
- /*
- * Now maybe reload the debug registers and handle I/O bitmaps
-@@ -559,12 +558,11 @@ unsigned long get_wchan(struct task_struct *p)
- if (!p || p == current || p->state == TASK_RUNNING)
- return 0;
- stack = (unsigned long)task_stack_page(p);
-- if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
-+ if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE-16-sizeof(u64))
- return 0;
- fp = *(u64 *)(p->thread.sp);
- do {
-- if (fp < (unsigned long)stack ||
-- fp >= (unsigned long)stack+THREAD_SIZE)
-+ if (fp < stack || fp > stack+THREAD_SIZE-16-sizeof(u64))
- return 0;
- ip = *(u64 *)(fp+8);
- if (!in_sched_functions(ip))
-diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
-index c06acdd..00810d8 100644
---- a/arch/x86/kernel/ptrace.c
-+++ b/arch/x86/kernel/ptrace.c
-@@ -925,7 +925,7 @@ static const struct user_regset_view user_x86_32_view; /* Initialized below. */
- long arch_ptrace(struct task_struct *child, long request, long addr, long data)
- {
- int ret;
-- unsigned long __user *datap = (unsigned long __user *)data;
-+ unsigned long __user *datap = (__force unsigned long __user *)data;
-
- switch (request) {
- /* read the word at location addr in the USER area. */
-@@ -1012,14 +1012,14 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
- if (addr < 0)
- return -EIO;
- ret = do_get_thread_area(child, addr,
-- (struct user_desc __user *) data);
-+ (__force struct user_desc __user *) data);
- break;
-
- case PTRACE_SET_THREAD_AREA:
- if (addr < 0)
- return -EIO;
- ret = do_set_thread_area(child, addr,
-- (struct user_desc __user *) data, 0);
-+ (__force struct user_desc __user *) data, 0);
- break;
- #endif
-
-@@ -1038,12 +1038,12 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
- #ifdef CONFIG_X86_PTRACE_BTS
- case PTRACE_BTS_CONFIG:
- ret = ptrace_bts_config
-- (child, data, (struct ptrace_bts_config __user *)addr);
-+ (child, data, (__force struct ptrace_bts_config __user *)addr);
- break;
-
- case PTRACE_BTS_STATUS:
- ret = ptrace_bts_status
-- (child, data, (struct ptrace_bts_config __user *)addr);
-+ (child, data, (__force struct ptrace_bts_config __user *)addr);
- break;
-
- case PTRACE_BTS_SIZE:
-@@ -1052,7 +1052,7 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
-
- case PTRACE_BTS_GET:
- ret = ptrace_bts_read_record
-- (child, data, (struct bts_struct __user *) addr);
-+ (child, data, (__force struct bts_struct __user *) addr);
- break;
-
- case PTRACE_BTS_CLEAR:
-@@ -1061,7 +1061,7 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
-
- case PTRACE_BTS_DRAIN:
- ret = ptrace_bts_drain
-- (child, data, (struct bts_struct __user *) addr);
-+ (child, data, (__force struct bts_struct __user *) addr);
- break;
- #endif /* CONFIG_X86_PTRACE_BTS */
-
-@@ -1450,7 +1450,7 @@ void send_sigtrap(struct task_struct *tsk, struct pt_regs *regs,
- info.si_code = si_code;
-
- /* User-mode ip? */
-- info.si_addr = user_mode_vm(regs) ? (void __user *) regs->ip : NULL;
-+ info.si_addr = user_mode(regs) ? (__force void __user *) regs->ip : NULL;
-
- /* Send us the fake SIGTRAP */
- force_sig_info(SIGTRAP, &info, tsk);
-@@ -1465,6 +1465,10 @@ void send_sigtrap(struct task_struct *tsk, struct pt_regs *regs,
- # define IS_IA32 0
- #endif
-
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+extern void gr_delayed_cred_worker(void);
-+#endif
-+
- /*
- * We must return the syscall number to actually look up in the table.
- * This can be -1L to skip running any syscall at all.
-@@ -1473,6 +1477,11 @@ asmregparm long syscall_trace_enter(struct pt_regs *regs)
- {
- long ret = 0;
-
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+ if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
-+ gr_delayed_cred_worker();
-+#endif
-+
- /*
- * If we stepped into a sysenter/syscall insn, it trapped in
- * kernel mode; do_debug() cleared TF and set TIF_SINGLESTEP.
-@@ -1516,6 +1525,11 @@ asmregparm long syscall_trace_enter(struct pt_regs *regs)
-
- asmregparm void syscall_trace_leave(struct pt_regs *regs)
- {
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+ if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
-+ gr_delayed_cred_worker();
-+#endif
-+
- if (unlikely(current->audit_context))
- audit_syscall_exit(AUDITSC_RESULT(regs->ax), regs->ax);
-
-diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
-index cf98100..169bb39 100644
---- a/arch/x86/kernel/reboot.c
-+++ b/arch/x86/kernel/reboot.c
-@@ -33,7 +33,7 @@ void (*pm_power_off)(void);
- EXPORT_SYMBOL(pm_power_off);
-
- static const struct desc_ptr no_idt = {};
--static int reboot_mode;
-+static unsigned short reboot_mode;
- enum reboot_type reboot_type = BOOT_KBD;
- int reboot_force;
-
-@@ -292,12 +292,12 @@ core_initcall(reboot_init);
- controller to pulse the CPU reset line, which is more thorough, but
- doesn't work with at least one type of 486 motherboard. It is easy
- to stop this code working; hence the copious comments. */
--static const unsigned long long
--real_mode_gdt_entries [3] =
-+static struct desc_struct
-+real_mode_gdt_entries [3] __read_only =
- {
-- 0x0000000000000000ULL, /* Null descriptor */
-- 0x00009b000000ffffULL, /* 16-bit real-mode 64k code at 0x00000000 */
-- 0x000093000100ffffULL /* 16-bit real-mode 64k data at 0x00000100 */
-+ GDT_ENTRY_INIT(0, 0, 0), /* Null descriptor */
-+ GDT_ENTRY_INIT(0x9b, 0, 0xffff), /* 16-bit real-mode 64k code at 0x00000000 */
-+ GDT_ENTRY_INIT(0x93, 0x100, 0xffff) /* 16-bit real-mode 64k data at 0x00000100 */
- };
-
- static const struct desc_ptr
-@@ -346,7 +346,7 @@ static const unsigned char jump_to_bios [] =
- * specified by the code and length parameters.
- * We assume that length will aways be less that 100!
- */
--void machine_real_restart(const unsigned char *code, int length)
-+__noreturn void machine_real_restart(const unsigned char *code, unsigned int length)
- {
- local_irq_disable();
-
-@@ -366,8 +366,8 @@ void machine_real_restart(const unsigned char *code, int length)
- /* Remap the kernel at virtual address zero, as well as offset zero
- from the kernel segment. This assumes the kernel segment starts at
- virtual address PAGE_OFFSET. */
-- memcpy(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-- sizeof(swapper_pg_dir [0]) * KERNEL_PGD_PTRS);
-+ clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-+ min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
-
- /*
- * Use `swapper_pg_dir' as our page directory.
-@@ -379,16 +379,15 @@ void machine_real_restart(const unsigned char *code, int length)
- boot)". This seems like a fairly standard thing that gets set by
- REBOOT.COM programs, and the previous reset routine did this
- too. */
-- *((unsigned short *)0x472) = reboot_mode;
-+ *(unsigned short *)(__va(0x472)) = reboot_mode;
-
- /* For the switch to real mode, copy some code to low memory. It has
- to be in the first 64k because it is running in 16-bit mode, and it
- has to have the same physical and virtual address, because it turns
- off paging. Copy it near the end of the first page, out of the way
- of BIOS variables. */
-- memcpy((void *)(0x1000 - sizeof(real_mode_switch) - 100),
-- real_mode_switch, sizeof (real_mode_switch));
-- memcpy((void *)(0x1000 - 100), code, length);
-+ memcpy(__va(0x1000 - sizeof (real_mode_switch) - 100), real_mode_switch, sizeof (real_mode_switch));
-+ memcpy(__va(0x1000 - 100), code, length);
-
- /* Set up the IDT for real mode. */
- load_idt(&real_mode_idt);
-@@ -416,6 +415,7 @@ void machine_real_restart(const unsigned char *code, int length)
- __asm__ __volatile__ ("ljmp $0x0008,%0"
- :
- : "i" ((void *)(0x1000 - sizeof (real_mode_switch) - 100)));
-+ do { } while (1);
- }
- #ifdef CONFIG_APM_MODULE
- EXPORT_SYMBOL(machine_real_restart);
-@@ -544,7 +544,7 @@ void __attribute__((weak)) mach_reboot_fixups(void)
- {
- }
-
--static void native_machine_emergency_restart(void)
-+static void __noreturn native_machine_emergency_restart(void)
- {
- int i;
-
-@@ -659,13 +659,13 @@ void native_machine_shutdown(void)
- #endif
- }
-
--static void __machine_emergency_restart(int emergency)
-+static __noreturn void __machine_emergency_restart(int emergency)
- {
- reboot_emergency = emergency;
- machine_ops.emergency_restart();
- }
-
--static void native_machine_restart(char *__unused)
-+static void __noreturn native_machine_restart(char *__unused)
- {
- printk("machine restart\n");
-
-@@ -674,7 +674,7 @@ static void native_machine_restart(char *__unused)
- __machine_emergency_restart(0);
- }
-
--static void native_machine_halt(void)
-+static void __noreturn native_machine_halt(void)
- {
- /* stop other cpus and apics */
- machine_shutdown();
-@@ -685,7 +685,7 @@ static void native_machine_halt(void)
- stop_this_cpu(NULL);
- }
-
--static void native_machine_power_off(void)
-+static void __noreturn native_machine_power_off(void)
- {
- if (pm_power_off) {
- if (!reboot_force)
-@@ -694,9 +694,10 @@ static void native_machine_power_off(void)
- }
- /* a fallback in case there is no PM info available */
- tboot_shutdown(TB_SHUTDOWN_HALT);
-+ do { } while (1);
- }
-
--struct machine_ops machine_ops = {
-+struct machine_ops machine_ops __read_only = {
- .power_off = native_machine_power_off,
- .shutdown = native_machine_shutdown,
- .emergency_restart = native_machine_emergency_restart,
-diff --git a/arch/x86/kernel/relocate_kernel_64.S b/arch/x86/kernel/relocate_kernel_64.S
-index 7a6f3b3..976a959 100644
---- a/arch/x86/kernel/relocate_kernel_64.S
-+++ b/arch/x86/kernel/relocate_kernel_64.S
-@@ -11,6 +11,7 @@
- #include <asm/kexec.h>
- #include <asm/processor-flags.h>
- #include <asm/pgtable_types.h>
-+#include <asm/alternative-asm.h>
-
- /*
- * Must be relocatable PIC code callable as a C function
-@@ -167,6 +168,7 @@ identity_mapped:
- xorq %r14, %r14
- xorq %r15, %r15
-
-+ pax_force_retaddr 0, 1
- ret
-
- 1:
-diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
-index 5449a26..0b6c759 100644
---- a/arch/x86/kernel/setup.c
-+++ b/arch/x86/kernel/setup.c
-@@ -783,14 +783,14 @@ void __init setup_arch(char **cmdline_p)
-
- if (!boot_params.hdr.root_flags)
- root_mountflags &= ~MS_RDONLY;
-- init_mm.start_code = (unsigned long) _text;
-- init_mm.end_code = (unsigned long) _etext;
-+ init_mm.start_code = ktla_ktva((unsigned long) _text);
-+ init_mm.end_code = ktla_ktva((unsigned long) _etext);
- init_mm.end_data = (unsigned long) _edata;
- init_mm.brk = _brk_end;
-
-- code_resource.start = virt_to_phys(_text);
-- code_resource.end = virt_to_phys(_etext)-1;
-- data_resource.start = virt_to_phys(_etext);
-+ code_resource.start = virt_to_phys(ktla_ktva(_text));
-+ code_resource.end = virt_to_phys(ktla_ktva(_etext))-1;
-+ data_resource.start = virt_to_phys(_sdata);
- data_resource.end = virt_to_phys(_edata)-1;
- bss_resource.start = virt_to_phys(&__bss_start);
- bss_resource.end = virt_to_phys(&__bss_stop)-1;
-diff --git a/arch/x86/kernel/setup_percpu.c b/arch/x86/kernel/setup_percpu.c
-index d559af9..524c6ad 100644
---- a/arch/x86/kernel/setup_percpu.c
-+++ b/arch/x86/kernel/setup_percpu.c
-@@ -25,19 +25,17 @@
- # define DBG(x...)
- #endif
-
--DEFINE_PER_CPU(int, cpu_number);
-+#ifdef CONFIG_SMP
-+DEFINE_PER_CPU(unsigned int, cpu_number);
- EXPORT_PER_CPU_SYMBOL(cpu_number);
-+#endif
-
--#ifdef CONFIG_X86_64
- #define BOOT_PERCPU_OFFSET ((unsigned long)__per_cpu_load)
--#else
--#define BOOT_PERCPU_OFFSET 0
--#endif
-
- DEFINE_PER_CPU(unsigned long, this_cpu_off) = BOOT_PERCPU_OFFSET;
- EXPORT_PER_CPU_SYMBOL(this_cpu_off);
-
--unsigned long __per_cpu_offset[NR_CPUS] __read_mostly = {
-+unsigned long __per_cpu_offset[NR_CPUS] __read_only = {
- [0 ... NR_CPUS-1] = BOOT_PERCPU_OFFSET,
- };
- EXPORT_SYMBOL(__per_cpu_offset);
-@@ -159,10 +157,10 @@ static inline void setup_percpu_segment(int cpu)
- {
- #ifdef CONFIG_X86_32
- struct desc_struct gdt;
-+ unsigned long base = per_cpu_offset(cpu);
-
-- pack_descriptor(&gdt, per_cpu_offset(cpu), 0xFFFFF,
-- 0x2 | DESCTYPE_S, 0x8);
-- gdt.s = 1;
-+ pack_descriptor(&gdt, base, (VMALLOC_END - base - 1) >> PAGE_SHIFT,
-+ 0x83 | DESCTYPE_S, 0xC);
- write_gdt_entry(get_cpu_gdt_table(cpu),
- GDT_ENTRY_PERCPU, &gdt, DESCTYPE_S);
- #endif
-@@ -212,6 +210,11 @@ void __init setup_per_cpu_areas(void)
- /* alrighty, percpu areas up and running */
- delta = (unsigned long)pcpu_base_addr - (unsigned long)__per_cpu_start;
- for_each_possible_cpu(cpu) {
-+#ifdef CONFIG_CC_STACKPROTECTOR
-+#ifdef CONFIG_X86_32
-+ unsigned long canary = per_cpu(stack_canary.canary, cpu);
-+#endif
-+#endif
- per_cpu_offset(cpu) = delta + pcpu_unit_offsets[cpu];
- per_cpu(this_cpu_off, cpu) = per_cpu_offset(cpu);
- per_cpu(cpu_number, cpu) = cpu;
-@@ -239,6 +242,12 @@ void __init setup_per_cpu_areas(void)
- early_per_cpu_map(x86_cpu_to_node_map, cpu);
- #endif
- #endif
-+#ifdef CONFIG_CC_STACKPROTECTOR
-+#ifdef CONFIG_X86_32
-+ if (!cpu)
-+ per_cpu(stack_canary.canary, cpu) = canary;
-+#endif
-+#endif
- /*
- * Up to this point, the boot CPU has been using .data.init
- * area. Reload any changed state for the boot CPU.
-diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
-index 6a44a76..3cab8c7 100644
---- a/arch/x86/kernel/signal.c
-+++ b/arch/x86/kernel/signal.c
-@@ -197,7 +197,7 @@ static unsigned long align_sigframe(unsigned long sp)
- * Align the stack pointer according to the i386 ABI,
- * i.e. so that on function entry ((sp + 4) & 15) == 0.
- */
-- sp = ((sp + 4) & -16ul) - 4;
-+ sp = ((sp - 12) & -16ul) - 4;
- #else /* !CONFIG_X86_32 */
- sp = round_down(sp, 16) - 8;
- #endif
-@@ -248,11 +248,11 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, size_t frame_size,
- * Return an always-bogus address instead so we will die with SIGSEGV.
- */
- if (onsigstack && !likely(on_sig_stack(sp)))
-- return (void __user *)-1L;
-+ return (__force void __user *)-1L;
-
- /* save i387 state */
- if (used_math() && save_i387_xstate(*fpstate) < 0)
-- return (void __user *)-1L;
-+ return (__force void __user *)-1L;
-
- return (void __user *)sp;
- }
-@@ -307,9 +307,9 @@ __setup_frame(int sig, struct k_sigaction *ka, sigset_t *set,
- }
-
- if (current->mm->context.vdso)
-- restorer = VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
-+ restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
- else
-- restorer = &frame->retcode;
-+ restorer = (void __user *)&frame->retcode;
- if (ka->sa.sa_flags & SA_RESTORER)
- restorer = ka->sa.sa_restorer;
-
-@@ -323,7 +323,7 @@ __setup_frame(int sig, struct k_sigaction *ka, sigset_t *set,
- * reasons and because gdb uses it as a signature to notice
- * signal handler stack frames.
- */
-- err |= __put_user(*((u64 *)&retcode), (u64 *)frame->retcode);
-+ err |= __put_user(*((u64 *)&retcode), (u64 __user *)frame->retcode);
-
- if (err)
- return -EFAULT;
-@@ -377,7 +377,10 @@ static int __setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
- err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
-
- /* Set up to return from userspace. */
-- restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
-+ if (current->mm->context.vdso)
-+ restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
-+ else
-+ restorer = (void __user *)&frame->retcode;
- if (ka->sa.sa_flags & SA_RESTORER)
- restorer = ka->sa.sa_restorer;
- put_user_ex(restorer, &frame->pretcode);
-@@ -389,7 +392,7 @@ static int __setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
- * reasons and because gdb uses it as a signature to notice
- * signal handler stack frames.
- */
-- put_user_ex(*((u64 *)&rt_retcode), (u64 *)frame->retcode);
-+ put_user_ex(*((u64 *)&rt_retcode), (u64 __user *)frame->retcode);
- } put_user_catch(err);
-
- if (err)
-@@ -782,6 +785,8 @@ static void do_signal(struct pt_regs *regs)
- int signr;
- sigset_t *oldset;
-
-+ pax_track_stack();
-+
- /*
- * We want the common case to go fast, which is why we may in certain
- * cases get here from kernel mode. Just return without doing anything
-@@ -789,7 +794,7 @@ static void do_signal(struct pt_regs *regs)
- * X86_32: vm86 regs switched out by assembly code before reaching
- * here, so testing against kernel CS suffices.
- */
-- if (!user_mode(regs))
-+ if (!user_mode_novm(regs))
- return;
-
- if (current_thread_info()->status & TS_RESTORE_SIGMASK)
-@@ -799,6 +804,7 @@ static void do_signal(struct pt_regs *regs)
-
- signr = get_signal_to_deliver(&info, &ka, regs, NULL);
- if (signr > 0) {
-+ sigset_t sigcopy = *oldset;
- /*
- * Re-enable any watchpoints before delivering the
- * signal to user space. The processor register will
-@@ -809,7 +815,7 @@ static void do_signal(struct pt_regs *regs)
- set_debugreg(current->thread.debugreg7, 7);
-
- /* Whee! Actually deliver the signal. */
-- if (handle_signal(signr, &info, &ka, oldset, regs) == 0) {
-+ if (handle_signal(signr, &info, &ka, &sigcopy, regs) == 0) {
- /*
- * A signal was successfully delivered; the saved
- * sigmask will have been stored in the signal frame,
-diff --git a/arch/x86/kernel/smp.c b/arch/x86/kernel/smp.c
-index 29f0a78..374912c 100644
---- a/arch/x86/kernel/smp.c
-+++ b/arch/x86/kernel/smp.c
-@@ -224,7 +224,7 @@ void smp_call_function_single_interrupt(struct pt_regs *regs)
- irq_exit();
- }
-
--struct smp_ops smp_ops = {
-+struct smp_ops smp_ops __read_only = {
- .smp_prepare_boot_cpu = native_smp_prepare_boot_cpu,
- .smp_prepare_cpus = native_smp_prepare_cpus,
- .smp_cpus_done = native_smp_cpus_done,
-diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
-index 7e8e905..64d5c32 100644
---- a/arch/x86/kernel/smpboot.c
-+++ b/arch/x86/kernel/smpboot.c
-@@ -94,14 +94,14 @@ static DEFINE_PER_CPU(struct task_struct *, idle_thread_array);
- */
- static DEFINE_MUTEX(x86_cpu_hotplug_driver_mutex);
-
--void cpu_hotplug_driver_lock()
-+void cpu_hotplug_driver_lock(void)
- {
-- mutex_lock(&x86_cpu_hotplug_driver_mutex);
-+ mutex_lock(&x86_cpu_hotplug_driver_mutex);
- }
-
--void cpu_hotplug_driver_unlock()
-+void cpu_hotplug_driver_unlock(void)
- {
-- mutex_unlock(&x86_cpu_hotplug_driver_mutex);
-+ mutex_unlock(&x86_cpu_hotplug_driver_mutex);
- }
-
- ssize_t arch_cpu_probe(const char *buf, size_t count) { return -1; }
-@@ -625,7 +625,7 @@ wakeup_secondary_cpu_via_init(int phys_apicid, unsigned long start_eip)
- * target processor state.
- */
- startup_ipi_hook(phys_apicid, (unsigned long) start_secondary,
-- (unsigned long)stack_start.sp);
-+ stack_start);
-
- /*
- * Run STARTUP IPI loop.
-@@ -743,6 +743,7 @@ static int __cpuinit do_boot_cpu(int apicid, int cpu)
- set_idle_for_cpu(cpu, c_idle.idle);
- do_rest:
- per_cpu(current_task, cpu) = c_idle.idle;
-+ per_cpu(current_tinfo, cpu) = &c_idle.idle->tinfo;
- #ifdef CONFIG_X86_32
- /* Stack for startup_32 can be just as for start_secondary onwards */
- irq_ctx_init(cpu);
-@@ -750,13 +751,15 @@ do_rest:
- #else
- clear_tsk_thread_flag(c_idle.idle, TIF_FORK);
- initial_gs = per_cpu_offset(cpu);
-- per_cpu(kernel_stack, cpu) =
-- (unsigned long)task_stack_page(c_idle.idle) -
-- KERNEL_STACK_OFFSET + THREAD_SIZE;
-+ per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(c_idle.idle) - 16 + THREAD_SIZE;
- #endif
-+
-+ pax_open_kernel();
- early_gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
-+ pax_close_kernel();
-+
- initial_code = (unsigned long)start_secondary;
-- stack_start.sp = (void *) c_idle.idle->thread.sp;
-+ stack_start = c_idle.idle->thread.sp;
-
- /* start_ip had better be page-aligned! */
- start_ip = setup_trampoline();
-@@ -891,6 +894,12 @@ int __cpuinit native_cpu_up(unsigned int cpu)
-
- per_cpu(cpu_state, cpu) = CPU_UP_PREPARE;
-
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ clone_pgd_range(get_cpu_pgd(cpu) + KERNEL_PGD_BOUNDARY,
-+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-+ KERNEL_PGD_PTRS);
-+#endif
-+
- err = do_boot_cpu(apicid, cpu);
-
- if (err) {
-diff --git a/arch/x86/kernel/step.c b/arch/x86/kernel/step.c
-index 3149032..14f1053 100644
---- a/arch/x86/kernel/step.c
-+++ b/arch/x86/kernel/step.c
-@@ -27,10 +27,10 @@ unsigned long convert_ip_to_linear(struct task_struct *child, struct pt_regs *re
- struct desc_struct *desc;
- unsigned long base;
-
-- seg &= ~7UL;
-+ seg >>= 3;
-
- mutex_lock(&child->mm->context.lock);
-- if (unlikely((seg >> 3) >= child->mm->context.size))
-+ if (unlikely(seg >= child->mm->context.size))
- addr = -1L; /* bogus selector, access would fault */
- else {
- desc = child->mm->context.ldt + seg;
-@@ -42,7 +42,8 @@ unsigned long convert_ip_to_linear(struct task_struct *child, struct pt_regs *re
- addr += base;
- }
- mutex_unlock(&child->mm->context.lock);
-- }
-+ } else if (seg == __KERNEL_CS || seg == __KERNEXEC_KERNEL_CS)
-+ addr = ktla_ktva(addr);
-
- return addr;
- }
-@@ -53,6 +54,9 @@ static int is_setting_trap_flag(struct task_struct *child, struct pt_regs *regs)
- unsigned char opcode[15];
- unsigned long addr = convert_ip_to_linear(child, regs);
-
-+ if (addr == -EINVAL)
-+ return 0;
-+
- copied = access_process_vm(child, addr, opcode, sizeof(opcode), 0);
- for (i = 0; i < copied; i++) {
- switch (opcode[i]) {
-@@ -74,7 +78,7 @@ static int is_setting_trap_flag(struct task_struct *child, struct pt_regs *regs)
-
- #ifdef CONFIG_X86_64
- case 0x40 ... 0x4f:
-- if (regs->cs != __USER_CS)
-+ if ((regs->cs & 0xffff) != __USER_CS)
- /* 32-bit mode: register increment */
- return 0;
- /* 64-bit mode: REX prefix */
-diff --git a/arch/x86/kernel/sys_i386_32.c b/arch/x86/kernel/sys_i386_32.c
-index dee1ff7..59c4a25 100644
---- a/arch/x86/kernel/sys_i386_32.c
-+++ b/arch/x86/kernel/sys_i386_32.c
-@@ -24,6 +24,22 @@
-
- #include <asm/syscalls.h>
-
-+int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
-+{
-+ unsigned long pax_task_size = TASK_SIZE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
-+ pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+ if (flags & MAP_FIXED)
-+ if (len > pax_task_size || addr > pax_task_size - len)
-+ return -EINVAL;
-+
-+ return 0;
-+}
-+
- /*
- * Perform the select(nd, in, out, ex, tv) and mmap() system
- * calls. Linux/i386 didn't use to be able to handle more than
-@@ -58,6 +74,215 @@ out:
- return err;
- }
-
-+unsigned long
-+arch_get_unmapped_area(struct file *filp, unsigned long addr,
-+ unsigned long len, unsigned long pgoff, unsigned long flags)
-+{
-+ struct mm_struct *mm = current->mm;
-+ struct vm_area_struct *vma;
-+ unsigned long start_addr, pax_task_size = TASK_SIZE;
-+ unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+ pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+ pax_task_size -= PAGE_SIZE;
-+
-+ if (len > pax_task_size)
-+ return -ENOMEM;
-+
-+ if (flags & MAP_FIXED)
-+ return addr;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
-+ if (addr) {
-+ addr = PAGE_ALIGN(addr);
-+ if (pax_task_size - len >= addr) {
-+ vma = find_vma(mm, addr);
-+ if (check_heap_stack_gap(vma, &addr, len, offset))
-+ return addr;
-+ }
-+ }
-+ if (len > mm->cached_hole_size) {
-+ start_addr = addr = mm->free_area_cache;
-+ } else {
-+ start_addr = addr = mm->mmap_base;
-+ mm->cached_hole_size = 0;
-+ }
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (!nx_enabled && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE) && start_addr >= mm->mmap_base) {
-+ start_addr = 0x00110000UL;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ start_addr += mm->delta_mmap & 0x03FFF000UL;
-+#endif
-+
-+ if (mm->start_brk <= start_addr && start_addr < mm->mmap_base)
-+ start_addr = addr = mm->mmap_base;
-+ else
-+ addr = start_addr;
-+ }
-+#endif
-+
-+full_search:
-+ for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
-+ /* At this point: (!vma || addr < vma->vm_end). */
-+ if (pax_task_size - len < addr) {
-+ /*
-+ * Start a new search - just in case we missed
-+ * some holes.
-+ */
-+ if (start_addr != mm->mmap_base) {
-+ start_addr = addr = mm->mmap_base;
-+ mm->cached_hole_size = 0;
-+ goto full_search;
-+ }
-+ return -ENOMEM;
-+ }
-+ if (check_heap_stack_gap(vma, &addr, len, offset))
-+ break;
-+ if (addr + mm->cached_hole_size < vma->vm_start)
-+ mm->cached_hole_size = vma->vm_start - addr;
-+ addr = vma->vm_end;
-+ if (mm->start_brk <= addr && addr < mm->mmap_base) {
-+ start_addr = addr = mm->mmap_base;
-+ mm->cached_hole_size = 0;
-+ goto full_search;
-+ }
-+ }
-+
-+ /*
-+ * Remember the place where we stopped the search:
-+ */
-+ mm->free_area_cache = addr + len;
-+ return addr;
-+}
-+
-+unsigned long
-+arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
-+ const unsigned long len, const unsigned long pgoff,
-+ const unsigned long flags)
-+{
-+ struct vm_area_struct *vma;
-+ struct mm_struct *mm = current->mm;
-+ unsigned long base = mm->mmap_base, addr = addr0, pax_task_size = TASK_SIZE;
-+ unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+ pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+ pax_task_size -= PAGE_SIZE;
-+
-+ /* requested length too big for entire address space */
-+ if (len > pax_task_size)
-+ return -ENOMEM;
-+
-+ if (flags & MAP_FIXED)
-+ return addr;
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (!nx_enabled && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE))
-+ goto bottomup;
-+#endif
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
-+ /* requesting a specific address */
-+ if (addr) {
-+ addr = PAGE_ALIGN(addr);
-+ if (pax_task_size - len >= addr) {
-+ vma = find_vma(mm, addr);
-+ if (check_heap_stack_gap(vma, &addr, len, offset))
-+ return addr;
-+ }
-+ }
-+
-+ /* check if free_area_cache is useful for us */
-+ if (len <= mm->cached_hole_size) {
-+ mm->cached_hole_size = 0;
-+ mm->free_area_cache = mm->mmap_base;
-+ }
-+
-+ /* either no address requested or can't fit in requested address hole */
-+ addr = mm->free_area_cache;
-+
-+ /* make sure it can fit in the remaining address space */
-+ if (addr > len) {
-+ addr -= len;
-+ vma = find_vma(mm, addr);
-+ if (check_heap_stack_gap(vma, &addr, len, offset))
-+ /* remember the address as a hint for next time */
-+ return (mm->free_area_cache = addr);
-+ }
-+
-+ if (mm->mmap_base < len)
-+ goto bottomup;
-+
-+ addr = mm->mmap_base-len;
-+
-+ do {
-+ /*
-+ * Lookup failure means no vma is above this address,
-+ * else if new region fits below vma->vm_start,
-+ * return with success:
-+ */
-+ vma = find_vma(mm, addr);
-+ if (check_heap_stack_gap(vma, &addr, len, offset))
-+ /* remember the address as a hint for next time */
-+ return (mm->free_area_cache = addr);
-+
-+ /* remember the largest hole we saw so far */
-+ if (addr + mm->cached_hole_size < vma->vm_start)
-+ mm->cached_hole_size = vma->vm_start - addr;
-+
-+ /* try just below the current vma->vm_start */
-+ addr = skip_heap_stack_gap(vma, len, offset);
-+ } while (!IS_ERR_VALUE(addr));
-+
-+bottomup:
-+ /*
-+ * A failed mmap() very likely causes application failure,
-+ * so fall back to the bottom-up function here. This scenario
-+ * can happen with large stack limits and large mmap()
-+ * allocations.
-+ */
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+ mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
-+ else
-+#endif
-+
-+ mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base += mm->delta_mmap;
-+#endif
-+
-+ mm->free_area_cache = mm->mmap_base;
-+ mm->cached_hole_size = ~0UL;
-+ addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
-+ /*
-+ * Restore the topdown base:
-+ */
-+ mm->mmap_base = base;
-+ mm->free_area_cache = base;
-+ mm->cached_hole_size = ~0UL;
-+
-+ return addr;
-+}
-
- struct sel_arg_struct {
- unsigned long n;
-@@ -93,7 +318,7 @@ asmlinkage int sys_ipc(uint call, int first, int second,
- return sys_semtimedop(first, (struct sembuf __user *)ptr, second, NULL);
- case SEMTIMEDOP:
- return sys_semtimedop(first, (struct sembuf __user *)ptr, second,
-- (const struct timespec __user *)fifth);
-+ (__force const struct timespec __user *)fifth);
-
- case SEMGET:
- return sys_semget(first, second, third);
-@@ -140,7 +365,7 @@ asmlinkage int sys_ipc(uint call, int first, int second,
- ret = do_shmat(first, (char __user *) ptr, second, &raddr);
- if (ret)
- return ret;
-- return put_user(raddr, (ulong __user *) third);
-+ return put_user(raddr, (__force ulong __user *) third);
- }
- case 1: /* iBCS2 emulator entry point */
- if (!segment_eq(get_fs(), get_ds()))
-@@ -207,17 +432,3 @@ asmlinkage int sys_olduname(struct oldold_utsname __user *name)
-
- return error;
- }
--
--
--/*
-- * Do a system call from kernel instead of calling sys_execve so we
-- * end up with proper pt_regs.
-- */
--int kernel_execve(const char *filename, char *const argv[], char *const envp[])
--{
-- long __res;
-- asm volatile ("push %%ebx ; movl %2,%%ebx ; int $0x80 ; pop %%ebx"
-- : "=a" (__res)
-- : "0" (__NR_execve), "ri" (filename), "c" (argv), "d" (envp) : "memory");
-- return __res;
--}
-diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c
-index 8aa2057..489c52d 100644
---- a/arch/x86/kernel/sys_x86_64.c
-+++ b/arch/x86/kernel/sys_x86_64.c
-@@ -32,8 +32,8 @@ out:
- return error;
- }
-
--static void find_start_end(unsigned long flags, unsigned long *begin,
-- unsigned long *end)
-+static void find_start_end(struct mm_struct *mm, unsigned long flags,
-+ unsigned long *begin, unsigned long *end)
- {
- if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT)) {
- unsigned long new_begin;
-@@ -52,7 +52,7 @@ static void find_start_end(unsigned long flags, unsigned long *begin,
- *begin = new_begin;
- }
- } else {
-- *begin = TASK_UNMAPPED_BASE;
-+ *begin = mm->mmap_base;
- *end = TASK_SIZE;
- }
- }
-@@ -65,20 +65,24 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
- struct vm_area_struct *vma;
- unsigned long start_addr;
- unsigned long begin, end;
-+ unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
-
- if (flags & MAP_FIXED)
- return addr;
-
-- find_start_end(flags, &begin, &end);
-+ find_start_end(mm, flags, &begin, &end);
-
- if (len > end)
- return -ENOMEM;
-
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- if (addr) {
- addr = PAGE_ALIGN(addr);
- vma = find_vma(mm, addr);
-- if (end - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-+ if (end - len >= addr && check_heap_stack_gap(vma, &addr, len, offset))
- return addr;
- }
- if (((flags & MAP_32BIT) || test_thread_flag(TIF_IA32))
-@@ -106,7 +110,7 @@ full_search:
- }
- return -ENOMEM;
- }
-- if (!vma || addr + len <= vma->vm_start) {
-+ if (check_heap_stack_gap(vma, &addr, len, offset)) {
- /*
- * Remember the place where we stopped the search:
- */
-@@ -128,7 +132,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- {
- struct vm_area_struct *vma;
- struct mm_struct *mm = current->mm;
-- unsigned long addr = addr0;
-+ unsigned long base = mm->mmap_base, addr = addr0;
-+ unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
-
- /* requested length too big for entire address space */
- if (len > TASK_SIZE)
-@@ -141,13 +146,18 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT))
- goto bottomup;
-
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- /* requesting a specific address */
- if (addr) {
- addr = PAGE_ALIGN(addr);
-- vma = find_vma(mm, addr);
-- if (TASK_SIZE - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-- return addr;
-+ if (TASK_SIZE - len >= addr) {
-+ vma = find_vma(mm, addr);
-+ if (check_heap_stack_gap(vma, &addr, len, offset))
-+ return addr;
-+ }
- }
-
- /* check if free_area_cache is useful for us */
-@@ -161,10 +171,11 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
-
- /* make sure it can fit in the remaining address space */
- if (addr > len) {
-- vma = find_vma(mm, addr-len);
-- if (!vma || addr <= vma->vm_start)
-+ addr -= len;
-+ vma = find_vma(mm, addr);
-+ if (check_heap_stack_gap(vma, &addr, len, offset))
- /* remember the address as a hint for next time */
-- return mm->free_area_cache = addr-len;
-+ return mm->free_area_cache = addr;
- }
-
- if (mm->mmap_base < len)
-@@ -179,7 +190,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- * return with success:
- */
- vma = find_vma(mm, addr);
-- if (!vma || addr+len <= vma->vm_start)
-+ if (check_heap_stack_gap(vma, &addr, len, offset))
- /* remember the address as a hint for next time */
- return mm->free_area_cache = addr;
-
-@@ -188,8 +199,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- mm->cached_hole_size = vma->vm_start - addr;
-
- /* try just below the current vma->vm_start */
-- addr = vma->vm_start-len;
-- } while (len < vma->vm_start);
-+ addr = skip_heap_stack_gap(vma, len, offset);
-+ } while (!IS_ERR_VALUE(addr));
-
- bottomup:
- /*
-@@ -198,13 +209,21 @@ bottomup:
- * can happen with large stack limits and large mmap()
- * allocations.
- */
-+ mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base += mm->delta_mmap;
-+#endif
-+
-+ mm->free_area_cache = mm->mmap_base;
- mm->cached_hole_size = ~0UL;
-- mm->free_area_cache = TASK_UNMAPPED_BASE;
- addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
- /*
- * Restore the topdown base:
- */
-- mm->free_area_cache = mm->mmap_base;
-+ mm->mmap_base = base;
-+ mm->free_area_cache = base;
- mm->cached_hole_size = ~0UL;
-
- return addr;
-diff --git a/arch/x86/kernel/syscall_table_32.S b/arch/x86/kernel/syscall_table_32.S
-index 76d70a4..4c94a44 100644
---- a/arch/x86/kernel/syscall_table_32.S
-+++ b/arch/x86/kernel/syscall_table_32.S
-@@ -1,3 +1,4 @@
-+.section .rodata,"a",@progbits
- ENTRY(sys_call_table)
- .long sys_restart_syscall /* 0 - old "setup()" system call, used for restarting */
- .long sys_exit
-diff --git a/arch/x86/kernel/tboot.c b/arch/x86/kernel/tboot.c
-index 46b8277..3349d55 100644
---- a/arch/x86/kernel/tboot.c
-+++ b/arch/x86/kernel/tboot.c
-@@ -216,7 +216,7 @@ static int tboot_setup_sleep(void)
-
- void tboot_shutdown(u32 shutdown_type)
- {
-- void (*shutdown)(void);
-+ void (* __noreturn shutdown)(void);
-
- if (!tboot_enabled())
- return;
-@@ -238,7 +238,7 @@ void tboot_shutdown(u32 shutdown_type)
-
- switch_to_tboot_pt();
-
-- shutdown = (void(*)(void))(unsigned long)tboot->shutdown_entry;
-+ shutdown = (void *)tboot->shutdown_entry;
- shutdown();
-
- /* should not reach here */
-@@ -295,7 +295,7 @@ void tboot_sleep(u8 sleep_state, u32 pm1a_control, u32 pm1b_control)
- tboot_shutdown(acpi_shutdown_map[sleep_state]);
- }
-
--static atomic_t ap_wfs_count;
-+static atomic_unchecked_t ap_wfs_count;
-
- static int tboot_wait_for_aps(int num_aps)
- {
-@@ -319,9 +319,9 @@ static int __cpuinit tboot_cpu_callback(struct notifier_block *nfb,
- {
- switch (action) {
- case CPU_DYING:
-- atomic_inc(&ap_wfs_count);
-+ atomic_inc_unchecked(&ap_wfs_count);
- if (num_online_cpus() == 1)
-- if (tboot_wait_for_aps(atomic_read(&ap_wfs_count)))
-+ if (tboot_wait_for_aps(atomic_read_unchecked(&ap_wfs_count)))
- return NOTIFY_BAD;
- break;
- }
-@@ -340,7 +340,7 @@ static __init int tboot_late_init(void)
-
- tboot_create_trampoline();
-
-- atomic_set(&ap_wfs_count, 0);
-+ atomic_set_unchecked(&ap_wfs_count, 0);
- register_hotcpu_notifier(&tboot_cpu_notifier);
- return 0;
- }
-diff --git a/arch/x86/kernel/time.c b/arch/x86/kernel/time.c
-index be25734..87fe232 100644
---- a/arch/x86/kernel/time.c
-+++ b/arch/x86/kernel/time.c
-@@ -26,17 +26,13 @@
- int timer_ack;
- #endif
-
--#ifdef CONFIG_X86_64
--volatile unsigned long __jiffies __section_jiffies = INITIAL_JIFFIES;
--#endif
--
- unsigned long profile_pc(struct pt_regs *regs)
- {
- unsigned long pc = instruction_pointer(regs);
-
-- if (!user_mode_vm(regs) && in_lock_functions(pc)) {
-+ if (!user_mode(regs) && in_lock_functions(pc)) {
- #ifdef CONFIG_FRAME_POINTER
-- return *(unsigned long *)(regs->bp + sizeof(long));
-+ return ktla_ktva(*(unsigned long *)(regs->bp + sizeof(long)));
- #else
- unsigned long *sp =
- (unsigned long *)kernel_stack_pointer(regs);
-@@ -45,11 +41,17 @@ unsigned long profile_pc(struct pt_regs *regs)
- * or above a saved flags. Eflags has bits 22-31 zero,
- * kernel addresses don't.
- */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ return ktla_ktva(sp[0]);
-+#else
- if (sp[0] >> 22)
- return sp[0];
- if (sp[1] >> 22)
- return sp[1];
- #endif
-+
-+#endif
- }
- return pc;
- }
-diff --git a/arch/x86/kernel/tls.c b/arch/x86/kernel/tls.c
-index bcfec2d..aeb81c2 100644
---- a/arch/x86/kernel/tls.c
-+++ b/arch/x86/kernel/tls.c
-@@ -85,6 +85,11 @@ int do_set_thread_area(struct task_struct *p, int idx,
- if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
- return -EINVAL;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((p->mm->pax_flags & MF_PAX_SEGMEXEC) && (info.contents & MODIFY_LDT_CONTENTS_CODE))
-+ return -EINVAL;
-+#endif
-+
- set_tls_desc(p, idx, &info, 1);
-
- return 0;
-@@ -205,7 +210,7 @@ int regset_tls_set(struct task_struct *target, const struct user_regset *regset,
-
- if (kbuf)
- info = kbuf;
-- else if (__copy_from_user(infobuf, ubuf, count))
-+ else if (count > sizeof infobuf || __copy_from_user(infobuf, ubuf, count))
- return -EFAULT;
- else
- info = infobuf;
-diff --git a/arch/x86/kernel/trampoline_32.S b/arch/x86/kernel/trampoline_32.S
-index 8508237..229b664 100644
---- a/arch/x86/kernel/trampoline_32.S
-+++ b/arch/x86/kernel/trampoline_32.S
-@@ -32,6 +32,12 @@
- #include <asm/segment.h>
- #include <asm/page_types.h>
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+#define ta(X) (X)
-+#else
-+#define ta(X) ((X) - __PAGE_OFFSET)
-+#endif
-+
- /* We can free up trampoline after bootup if cpu hotplug is not supported. */
- __CPUINITRODATA
- .code16
-@@ -60,7 +66,7 @@ r_base = .
- inc %ax # protected mode (PE) bit
- lmsw %ax # into protected mode
- # flush prefetch and jump to startup_32_smp in arch/i386/kernel/head.S
-- ljmpl $__BOOT_CS, $(startup_32_smp-__PAGE_OFFSET)
-+ ljmpl $__BOOT_CS, $ta(startup_32_smp)
-
- # These need to be in the same 64K segment as the above;
- # hence we don't use the boot_gdt_descr defined in head.S
-diff --git a/arch/x86/kernel/trampoline_64.S b/arch/x86/kernel/trampoline_64.S
-index 3af2dff..ba8aa49 100644
---- a/arch/x86/kernel/trampoline_64.S
-+++ b/arch/x86/kernel/trampoline_64.S
-@@ -91,7 +91,7 @@ startup_32:
- movl $__KERNEL_DS, %eax # Initialize the %ds segment register
- movl %eax, %ds
-
-- movl $X86_CR4_PAE, %eax
-+ movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
- movl %eax, %cr4 # Enable PAE mode
-
- # Setup trampoline 4 level pagetables
-@@ -127,7 +127,7 @@ startup_64:
- no_longmode:
- hlt
- jmp no_longmode
--#include "verify_cpu_64.S"
-+#include "verify_cpu.S"
-
- # Careful these need to be in the same 64K segment as the above;
- tidt:
-@@ -138,7 +138,7 @@ tidt:
- # so the kernel can live anywhere
- .balign 4
- tgdt:
-- .short tgdt_end - tgdt # gdt limit
-+ .short tgdt_end - tgdt - 1 # gdt limit
- .long tgdt - r_base
- .short 0
- .quad 0x00cf9b000000ffff # __KERNEL32_CS
-diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
-index 7e37dce..ec3f8e5 100644
---- a/arch/x86/kernel/traps.c
-+++ b/arch/x86/kernel/traps.c
-@@ -69,12 +69,6 @@ asmlinkage int system_call(void);
-
- /* Do we ignore FPU interrupts ? */
- char ignore_fpu_irq;
--
--/*
-- * The IDT has to be page-aligned to simplify the Pentium
-- * F0 0F bug workaround.
-- */
--gate_desc idt_table[NR_VECTORS] __page_aligned_data = { { { { 0, 0 } } }, };
- #endif
-
- DECLARE_BITMAP(used_vectors, NR_VECTORS);
-@@ -112,19 +106,19 @@ static inline void preempt_conditional_cli(struct pt_regs *regs)
- static inline void
- die_if_kernel(const char *str, struct pt_regs *regs, long err)
- {
-- if (!user_mode_vm(regs))
-+ if (!user_mode(regs))
- die(str, regs, err);
- }
- #endif
-
- static void __kprobes
--do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
-+do_trap(int trapnr, int signr, const char *str, struct pt_regs *regs,
- long error_code, siginfo_t *info)
- {
- struct task_struct *tsk = current;
-
- #ifdef CONFIG_X86_32
-- if (regs->flags & X86_VM_MASK) {
-+ if (v8086_mode(regs)) {
- /*
- * traps 0, 1, 3, 4, and 5 should be forwarded to vm86.
- * On nmi (interrupt 2), do_trap should not be called.
-@@ -135,7 +129,7 @@ do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
- }
- #endif
-
-- if (!user_mode(regs))
-+ if (!user_mode_novm(regs))
- goto kernel_trap;
-
- #ifdef CONFIG_X86_32
-@@ -158,7 +152,7 @@ trap_signal:
- printk_ratelimit()) {
- printk(KERN_INFO
- "%s[%d] trap %s ip:%lx sp:%lx error:%lx",
-- tsk->comm, tsk->pid, str,
-+ tsk->comm, task_pid_nr(tsk), str,
- regs->ip, regs->sp, error_code);
- print_vma_addr(" in ", regs->ip);
- printk("\n");
-@@ -175,8 +169,20 @@ kernel_trap:
- if (!fixup_exception(regs)) {
- tsk->thread.error_code = error_code;
- tsk->thread.trap_no = trapnr;
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ if (trapnr == 12 && ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS))
-+ str = "PAX: suspicious stack segment fault";
-+#endif
-+
- die(str, regs, error_code);
- }
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ if (trapnr == 4)
-+ pax_report_refcount_overflow(regs);
-+#endif
-+
- return;
-
- #ifdef CONFIG_X86_32
-@@ -265,14 +271,30 @@ do_general_protection(struct pt_regs *regs, long error_code)
- conditional_sti(regs);
-
- #ifdef CONFIG_X86_32
-- if (regs->flags & X86_VM_MASK)
-+ if (v8086_mode(regs))
- goto gp_in_vm86;
- #endif
-
- tsk = current;
-- if (!user_mode(regs))
-+ if (!user_mode_novm(regs))
- goto gp_in_kernel;
-
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
-+ if (!nx_enabled && tsk->mm && (tsk->mm->pax_flags & MF_PAX_PAGEEXEC)) {
-+ struct mm_struct *mm = tsk->mm;
-+ unsigned long limit;
-+
-+ down_write(&mm->mmap_sem);
-+ limit = mm->context.user_cs_limit;
-+ if (limit < TASK_SIZE) {
-+ track_exec_limit(mm, limit, TASK_SIZE, VM_EXEC);
-+ up_write(&mm->mmap_sem);
-+ return;
-+ }
-+ up_write(&mm->mmap_sem);
-+ }
-+#endif
-+
- tsk->thread.error_code = error_code;
- tsk->thread.trap_no = 13;
-
-@@ -305,6 +327,13 @@ gp_in_kernel:
- if (notify_die(DIE_GPF, "general protection fault", regs,
- error_code, 13, SIGSEGV) == NOTIFY_STOP)
- return;
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ if ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS)
-+ die("PAX: suspicious general protection fault", regs, error_code);
-+ else
-+#endif
-+
- die("general protection fault", regs, error_code);
- }
-
-@@ -435,6 +464,17 @@ static notrace __kprobes void default_do_nmi(struct pt_regs *regs)
- dotraplinkage notrace __kprobes void
- do_nmi(struct pt_regs *regs, long error_code)
- {
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ if (!user_mode(regs)) {
-+ unsigned long cs = regs->cs & 0xFFFF;
-+ unsigned long ip = ktva_ktla(regs->ip);
-+
-+ if ((cs == __KERNEL_CS || cs == __KERNEXEC_KERNEL_CS) && ip <= (unsigned long)_etext)
-+ regs->ip = ip;
-+ }
-+#endif
-+
- nmi_enter();
-
- inc_irq_stat(__nmi_count);
-@@ -558,7 +598,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
- }
-
- #ifdef CONFIG_X86_32
-- if (regs->flags & X86_VM_MASK)
-+ if (v8086_mode(regs))
- goto debug_vm86;
- #endif
-
-@@ -570,7 +610,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
- * kernel space (but re-enable TF when returning to user mode).
- */
- if (condition & DR_STEP) {
-- if (!user_mode(regs))
-+ if (!user_mode_novm(regs))
- goto clear_TF_reenable;
- }
-
-@@ -757,7 +797,7 @@ do_simd_coprocessor_error(struct pt_regs *regs, long error_code)
- * Handle strange cache flush from user space exception
- * in all other cases. This is undocumented behaviour.
- */
-- if (regs->flags & X86_VM_MASK) {
-+ if (v8086_mode(regs)) {
- handle_vm86_fault((struct kernel_vm86_regs *)regs, error_code);
- return;
- }
-@@ -798,7 +838,7 @@ asmlinkage void __attribute__((weak)) smp_threshold_interrupt(void)
- void __math_state_restore(void)
- {
- struct thread_info *thread = current_thread_info();
-- struct task_struct *tsk = thread->task;
-+ struct task_struct *tsk = current;
-
- /*
- * Paranoid restore. send a SIGSEGV if we fail to restore the state.
-@@ -825,8 +865,7 @@ void __math_state_restore(void)
- */
- asmlinkage void math_state_restore(void)
- {
-- struct thread_info *thread = current_thread_info();
-- struct task_struct *tsk = thread->task;
-+ struct task_struct *tsk = current;
-
- if (!tsk_used_math(tsk)) {
- local_irq_enable();
-diff --git a/arch/x86/kernel/verify_cpu.S b/arch/x86/kernel/verify_cpu.S
-new file mode 100644
-index 0000000..50c5edd
---- /dev/null
-+++ b/arch/x86/kernel/verify_cpu.S
-@@ -0,0 +1,140 @@
-+/*
-+ *
-+ * verify_cpu.S - Code for cpu long mode and SSE verification. This
-+ * code has been borrowed from boot/setup.S and was introduced by
-+ * Andi Kleen.
-+ *
-+ * Copyright (c) 2007 Andi Kleen (ak@suse.de)
-+ * Copyright (c) 2007 Eric Biederman (ebiederm@xmission.com)
-+ * Copyright (c) 2007 Vivek Goyal (vgoyal@in.ibm.com)
-+ * Copyright (c) 2010 Kees Cook (kees.cook@canonical.com)
-+ *
-+ * This source code is licensed under the GNU General Public License,
-+ * Version 2. See the file COPYING for more details.
-+ *
-+ * This is a common code for verification whether CPU supports
-+ * long mode and SSE or not. It is not called directly instead this
-+ * file is included at various places and compiled in that context.
-+ * This file is expected to run in 32bit code. Currently:
-+ *
-+ * arch/x86/boot/compressed/head_64.S: Boot cpu verification
-+ * arch/x86/kernel/trampoline_64.S: secondary processor verification
-+ * arch/x86/kernel/head_32.S: processor startup
-+ * arch/x86/kernel/acpi/realmode/wakeup.S: 32bit processor resume
-+ *
-+ * verify_cpu, returns the status of longmode and SSE in register %eax.
-+ * 0: Success 1: Failure
-+ *
-+ * On Intel, the XD_DISABLE flag will be cleared as a side-effect.
-+ *
-+ * The caller needs to check for the error code and take the action
-+ * appropriately. Either display a message or halt.
-+ */
-+
-+#include <asm/cpufeature.h>
-+#include <asm/msr-index.h>
-+
-+verify_cpu:
-+ pushfl # Save caller passed flags
-+ pushl $0 # Kill any dangerous flags
-+ popfl
-+
-+ pushfl # standard way to check for cpuid
-+ popl %eax
-+ movl %eax,%ebx
-+ xorl $0x200000,%eax
-+ pushl %eax
-+ popfl
-+ pushfl
-+ popl %eax
-+ cmpl %eax,%ebx
-+ jz verify_cpu_no_longmode # cpu has no cpuid
-+
-+ movl $0x0,%eax # See if cpuid 1 is implemented
-+ cpuid
-+ cmpl $0x1,%eax
-+ jb verify_cpu_no_longmode # no cpuid 1
-+
-+ xor %di,%di
-+ cmpl $0x68747541,%ebx # AuthenticAMD
-+ jnz verify_cpu_noamd
-+ cmpl $0x69746e65,%edx
-+ jnz verify_cpu_noamd
-+ cmpl $0x444d4163,%ecx
-+ jnz verify_cpu_noamd
-+ mov $1,%di # cpu is from AMD
-+ jmp verify_cpu_check
-+
-+verify_cpu_noamd:
-+ cmpl $0x756e6547,%ebx # GenuineIntel?
-+ jnz verify_cpu_check
-+ cmpl $0x49656e69,%edx
-+ jnz verify_cpu_check
-+ cmpl $0x6c65746e,%ecx
-+ jnz verify_cpu_check
-+
-+ # only call IA32_MISC_ENABLE when:
-+ # family > 6 || (family == 6 && model >= 0xd)
-+ movl $0x1, %eax # check CPU family and model
-+ cpuid
-+ movl %eax, %ecx
-+
-+ andl $0x0ff00f00, %eax # mask family and extended family
-+ shrl $8, %eax
-+ cmpl $6, %eax
-+ ja verify_cpu_clear_xd # family > 6, ok
-+ jb verify_cpu_check # family < 6, skip
-+
-+ andl $0x000f00f0, %ecx # mask model and extended model
-+ shrl $4, %ecx
-+ cmpl $0xd, %ecx
-+ jb verify_cpu_check # family == 6, model < 0xd, skip
-+
-+verify_cpu_clear_xd:
-+ movl $MSR_IA32_MISC_ENABLE, %ecx
-+ rdmsr
-+ btrl $2, %edx # clear MSR_IA32_MISC_ENABLE_XD_DISABLE
-+ jnc verify_cpu_check # only write MSR if bit was changed
-+ wrmsr
-+
-+verify_cpu_check:
-+ movl $0x1,%eax # Does the cpu have what it takes
-+ cpuid
-+ andl $REQUIRED_MASK0,%edx
-+ xorl $REQUIRED_MASK0,%edx
-+ jnz verify_cpu_no_longmode
-+
-+ movl $0x80000000,%eax # See if extended cpuid is implemented
-+ cpuid
-+ cmpl $0x80000001,%eax
-+ jb verify_cpu_no_longmode # no extended cpuid
-+
-+ movl $0x80000001,%eax # Does the cpu have what it takes
-+ cpuid
-+ andl $REQUIRED_MASK1,%edx
-+ xorl $REQUIRED_MASK1,%edx
-+ jnz verify_cpu_no_longmode
-+
-+verify_cpu_sse_test:
-+ movl $1,%eax
-+ cpuid
-+ andl $SSE_MASK,%edx
-+ cmpl $SSE_MASK,%edx
-+ je verify_cpu_sse_ok
-+ test %di,%di
-+ jz verify_cpu_no_longmode # only try to force SSE on AMD
-+ movl $MSR_K7_HWCR,%ecx
-+ rdmsr
-+ btr $15,%eax # enable SSE
-+ wrmsr
-+ xor %di,%di # don't loop
-+ jmp verify_cpu_sse_test # try again
-+
-+verify_cpu_no_longmode:
-+ popfl # Restore caller passed flags
-+ movl $1,%eax
-+ ret
-+verify_cpu_sse_ok:
-+ popfl # Restore caller passed flags
-+ xorl %eax, %eax
-+ ret
-diff --git a/arch/x86/kernel/verify_cpu_64.S b/arch/x86/kernel/verify_cpu_64.S
-deleted file mode 100644
-index 45b6f8a..0000000
---- a/arch/x86/kernel/verify_cpu_64.S
-+++ /dev/null
-@@ -1,105 +0,0 @@
--/*
-- *
-- * verify_cpu.S - Code for cpu long mode and SSE verification. This
-- * code has been borrowed from boot/setup.S and was introduced by
-- * Andi Kleen.
-- *
-- * Copyright (c) 2007 Andi Kleen (ak@suse.de)
-- * Copyright (c) 2007 Eric Biederman (ebiederm@xmission.com)
-- * Copyright (c) 2007 Vivek Goyal (vgoyal@in.ibm.com)
-- *
-- * This source code is licensed under the GNU General Public License,
-- * Version 2. See the file COPYING for more details.
-- *
-- * This is a common code for verification whether CPU supports
-- * long mode and SSE or not. It is not called directly instead this
-- * file is included at various places and compiled in that context.
-- * Following are the current usage.
-- *
-- * This file is included by both 16bit and 32bit code.
-- *
-- * arch/x86_64/boot/setup.S : Boot cpu verification (16bit)
-- * arch/x86_64/boot/compressed/head.S: Boot cpu verification (32bit)
-- * arch/x86_64/kernel/trampoline.S: secondary processor verfication (16bit)
-- * arch/x86_64/kernel/acpi/wakeup.S:Verfication at resume (16bit)
-- *
-- * verify_cpu, returns the status of cpu check in register %eax.
-- * 0: Success 1: Failure
-- *
-- * The caller needs to check for the error code and take the action
-- * appropriately. Either display a message or halt.
-- */
--
--#include <asm/cpufeature.h>
--
--verify_cpu:
-- pushfl # Save caller passed flags
-- pushl $0 # Kill any dangerous flags
-- popfl
--
-- pushfl # standard way to check for cpuid
-- popl %eax
-- movl %eax,%ebx
-- xorl $0x200000,%eax
-- pushl %eax
-- popfl
-- pushfl
-- popl %eax
-- cmpl %eax,%ebx
-- jz verify_cpu_no_longmode # cpu has no cpuid
--
-- movl $0x0,%eax # See if cpuid 1 is implemented
-- cpuid
-- cmpl $0x1,%eax
-- jb verify_cpu_no_longmode # no cpuid 1
--
-- xor %di,%di
-- cmpl $0x68747541,%ebx # AuthenticAMD
-- jnz verify_cpu_noamd
-- cmpl $0x69746e65,%edx
-- jnz verify_cpu_noamd
-- cmpl $0x444d4163,%ecx
-- jnz verify_cpu_noamd
-- mov $1,%di # cpu is from AMD
--
--verify_cpu_noamd:
-- movl $0x1,%eax # Does the cpu have what it takes
-- cpuid
-- andl $REQUIRED_MASK0,%edx
-- xorl $REQUIRED_MASK0,%edx
-- jnz verify_cpu_no_longmode
--
-- movl $0x80000000,%eax # See if extended cpuid is implemented
-- cpuid
-- cmpl $0x80000001,%eax
-- jb verify_cpu_no_longmode # no extended cpuid
--
-- movl $0x80000001,%eax # Does the cpu have what it takes
-- cpuid
-- andl $REQUIRED_MASK1,%edx
-- xorl $REQUIRED_MASK1,%edx
-- jnz verify_cpu_no_longmode
--
--verify_cpu_sse_test:
-- movl $1,%eax
-- cpuid
-- andl $SSE_MASK,%edx
-- cmpl $SSE_MASK,%edx
-- je verify_cpu_sse_ok
-- test %di,%di
-- jz verify_cpu_no_longmode # only try to force SSE on AMD
-- movl $0xc0010015,%ecx # HWCR
-- rdmsr
-- btr $15,%eax # enable SSE
-- wrmsr
-- xor %di,%di # don't loop
-- jmp verify_cpu_sse_test # try again
--
--verify_cpu_no_longmode:
-- popfl # Restore caller passed flags
-- movl $1,%eax
-- ret
--verify_cpu_sse_ok:
-- popfl # Restore caller passed flags
-- xorl %eax, %eax
-- ret
-diff --git a/arch/x86/kernel/vm86_32.c b/arch/x86/kernel/vm86_32.c
-index 9c4e625..c992817 100644
---- a/arch/x86/kernel/vm86_32.c
-+++ b/arch/x86/kernel/vm86_32.c
-@@ -41,6 +41,7 @@
- #include <linux/ptrace.h>
- #include <linux/audit.h>
- #include <linux/stddef.h>
-+#include <linux/grsecurity.h>
-
- #include <asm/uaccess.h>
- #include <asm/io.h>
-@@ -148,7 +149,7 @@ struct pt_regs *save_v86_state(struct kernel_vm86_regs *regs)
- do_exit(SIGSEGV);
- }
-
-- tss = &per_cpu(init_tss, get_cpu());
-+ tss = init_tss + get_cpu();
- current->thread.sp0 = current->thread.saved_sp0;
- current->thread.sysenter_cs = __KERNEL_CS;
- load_sp0(tss, ¤t->thread);
-@@ -208,6 +209,13 @@ int sys_vm86old(struct pt_regs *regs)
- struct task_struct *tsk;
- int tmp, ret = -EPERM;
-
-+#ifdef CONFIG_GRKERNSEC_VM86
-+ if (!capable(CAP_SYS_RAWIO)) {
-+ gr_handle_vm86();
-+ goto out;
-+ }
-+#endif
-+
- tsk = current;
- if (tsk->thread.saved_sp0)
- goto out;
-@@ -238,6 +246,14 @@ int sys_vm86(struct pt_regs *regs)
- int tmp, ret;
- struct vm86plus_struct __user *v86;
-
-+#ifdef CONFIG_GRKERNSEC_VM86
-+ if (!capable(CAP_SYS_RAWIO)) {
-+ gr_handle_vm86();
-+ ret = -EPERM;
-+ goto out;
-+ }
-+#endif
-+
- tsk = current;
- switch (regs->bx) {
- case VM86_REQUEST_IRQ:
-@@ -324,7 +340,7 @@ static void do_sys_vm86(struct kernel_vm86_struct *info, struct task_struct *tsk
- tsk->thread.saved_fs = info->regs32->fs;
- tsk->thread.saved_gs = get_user_gs(info->regs32);
-
-- tss = &per_cpu(init_tss, get_cpu());
-+ tss = init_tss + get_cpu();
- tsk->thread.sp0 = (unsigned long) &info->VM86_TSS_ESP0;
- if (cpu_has_sep)
- tsk->thread.sysenter_cs = 0;
-@@ -529,7 +545,7 @@ static void do_int(struct kernel_vm86_regs *regs, int i,
- goto cannot_handle;
- if (i == 0x21 && is_revectored(AH(regs), &KVM86->int21_revectored))
- goto cannot_handle;
-- intr_ptr = (unsigned long __user *) (i << 2);
-+ intr_ptr = (__force unsigned long __user *) (i << 2);
- if (get_user(segoffs, intr_ptr))
- goto cannot_handle;
- if ((segoffs >> 16) == BIOSSEG)
-diff --git a/arch/x86/kernel/vmi_32.c b/arch/x86/kernel/vmi_32.c
-index d430e4c..831f817 100644
---- a/arch/x86/kernel/vmi_32.c
-+++ b/arch/x86/kernel/vmi_32.c
-@@ -44,12 +44,17 @@ typedef u32 __attribute__((regparm(1))) (VROMFUNC)(void);
- typedef u64 __attribute__((regparm(2))) (VROMLONGFUNC)(int);
-
- #define call_vrom_func(rom,func) \
-- (((VROMFUNC *)(rom->func))())
-+ (((VROMFUNC *)(ktva_ktla(rom.func)))())
-
- #define call_vrom_long_func(rom,func,arg) \
-- (((VROMLONGFUNC *)(rom->func)) (arg))
-+({\
-+ u64 __reloc = ((VROMLONGFUNC *)(ktva_ktla(rom.func))) (arg);\
-+ struct vmi_relocation_info *const __rel = (struct vmi_relocation_info *)&__reloc;\
-+ __rel->eip = (unsigned char *)ktva_ktla((unsigned long)__rel->eip);\
-+ __reloc;\
-+})
-
--static struct vrom_header *vmi_rom;
-+static struct vrom_header vmi_rom __attribute((__section__(".vmi.rom"), __aligned__(PAGE_SIZE)));
- static int disable_pge;
- static int disable_pse;
- static int disable_sep;
-@@ -76,10 +81,10 @@ static struct {
- void (*set_initial_ap_state)(int, int);
- void (*halt)(void);
- void (*set_lazy_mode)(int mode);
--} vmi_ops;
-+} __no_const vmi_ops __read_only;
-
- /* Cached VMI operations */
--struct vmi_timer_ops vmi_timer_ops;
-+struct vmi_timer_ops vmi_timer_ops __read_only;
-
- /*
- * VMI patching routines.
-@@ -94,7 +99,7 @@ struct vmi_timer_ops vmi_timer_ops;
- static inline void patch_offset(void *insnbuf,
- unsigned long ip, unsigned long dest)
- {
-- *(unsigned long *)(insnbuf+1) = dest-ip-5;
-+ *(unsigned long *)(insnbuf+1) = dest-ip-5;
- }
-
- static unsigned patch_internal(int call, unsigned len, void *insnbuf,
-@@ -102,6 +107,7 @@ static unsigned patch_internal(int call, unsigned len, void *insnbuf,
- {
- u64 reloc;
- struct vmi_relocation_info *const rel = (struct vmi_relocation_info *)&reloc;
-+
- reloc = call_vrom_long_func(vmi_rom, get_reloc, call);
- switch(rel->type) {
- case VMI_RELOCATION_CALL_REL:
-@@ -404,13 +410,13 @@ static void vmi_set_pud(pud_t *pudp, pud_t pudval)
-
- static void vmi_pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
- {
-- const pte_t pte = { .pte = 0 };
-+ const pte_t pte = __pte(0ULL);
- vmi_ops.set_pte(pte, ptep, vmi_flags_addr(mm, addr, VMI_PAGE_PT, 0));
- }
-
- static void vmi_pmd_clear(pmd_t *pmd)
- {
-- const pte_t pte = { .pte = 0 };
-+ const pte_t pte = __pte(0ULL);
- vmi_ops.set_pte(pte, (pte_t *)pmd, VMI_PAGE_PD);
- }
- #endif
-@@ -438,10 +444,10 @@ vmi_startup_ipi_hook(int phys_apicid, unsigned long start_eip,
- ap.ss = __KERNEL_DS;
- ap.esp = (unsigned long) start_esp;
-
-- ap.ds = __USER_DS;
-- ap.es = __USER_DS;
-+ ap.ds = __KERNEL_DS;
-+ ap.es = __KERNEL_DS;
- ap.fs = __KERNEL_PERCPU;
-- ap.gs = __KERNEL_STACK_CANARY;
-+ savesegment(gs, ap.gs);
-
- ap.eflags = 0;
-
-@@ -486,6 +492,18 @@ static void vmi_leave_lazy_mmu(void)
- paravirt_leave_lazy_mmu();
- }
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+static unsigned long vmi_pax_open_kernel(void)
-+{
-+ return 0;
-+}
-+
-+static unsigned long vmi_pax_close_kernel(void)
-+{
-+ return 0;
-+}
-+#endif
-+
- static inline int __init check_vmi_rom(struct vrom_header *rom)
- {
- struct pci_header *pci;
-@@ -498,6 +516,10 @@ static inline int __init check_vmi_rom(struct vrom_header *rom)
- return 0;
- if (rom->vrom_signature != VMI_SIGNATURE)
- return 0;
-+ if (rom->rom_length * 512 > sizeof(*rom)) {
-+ printk(KERN_WARNING "PAX: VMI: ROM size too big: %x\n", rom->rom_length * 512);
-+ return 0;
-+ }
- if (rom->api_version_maj != VMI_API_REV_MAJOR ||
- rom->api_version_min+1 < VMI_API_REV_MINOR+1) {
- printk(KERN_WARNING "VMI: Found mismatched rom version %d.%d\n",
-@@ -562,7 +584,7 @@ static inline int __init probe_vmi_rom(void)
- struct vrom_header *romstart;
- romstart = (struct vrom_header *)isa_bus_to_virt(base);
- if (check_vmi_rom(romstart)) {
-- vmi_rom = romstart;
-+ vmi_rom = *romstart;
- return 1;
- }
- }
-@@ -836,6 +858,11 @@ static inline int __init activate_vmi(void)
-
- para_fill(pv_irq_ops.safe_halt, Halt);
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+ pv_mmu_ops.pax_open_kernel = vmi_pax_open_kernel;
-+ pv_mmu_ops.pax_close_kernel = vmi_pax_close_kernel;
-+#endif
-+
- /*
- * Alternative instruction rewriting doesn't happen soon enough
- * to convert VMI_IRET to a call instead of a jump; so we have
-@@ -853,16 +880,16 @@ static inline int __init activate_vmi(void)
-
- void __init vmi_init(void)
- {
-- if (!vmi_rom)
-+ if (!vmi_rom.rom_signature)
- probe_vmi_rom();
- else
-- check_vmi_rom(vmi_rom);
-+ check_vmi_rom(&vmi_rom);
-
- /* In case probing for or validating the ROM failed, basil */
-- if (!vmi_rom)
-+ if (!vmi_rom.rom_signature)
- return;
-
-- reserve_top_address(-vmi_rom->virtual_top);
-+ reserve_top_address(-vmi_rom.virtual_top);
-
- #ifdef CONFIG_X86_IO_APIC
- /* This is virtual hardware; timer routing is wired correctly */
-@@ -874,7 +901,7 @@ void __init vmi_activate(void)
- {
- unsigned long flags;
-
-- if (!vmi_rom)
-+ if (!vmi_rom.rom_signature)
- return;
-
- local_irq_save(flags);
-diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
-index 3c68fe2..7a8c35b 100644
---- a/arch/x86/kernel/vmlinux.lds.S
-+++ b/arch/x86/kernel/vmlinux.lds.S
-@@ -26,6 +26,13 @@
- #include <asm/page_types.h>
- #include <asm/cache.h>
- #include <asm/boot.h>
-+#include <asm/segment.h>
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+#define __KERNEL_TEXT_OFFSET (LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR)
-+#else
-+#define __KERNEL_TEXT_OFFSET 0
-+#endif
-
- #undef i386 /* in case the preprocessor is a 32bit one */
-
-@@ -34,40 +41,53 @@ OUTPUT_FORMAT(CONFIG_OUTPUT_FORMAT, CONFIG_OUTPUT_FORMAT, CONFIG_OUTPUT_FORMAT)
- #ifdef CONFIG_X86_32
- OUTPUT_ARCH(i386)
- ENTRY(phys_startup_32)
--jiffies = jiffies_64;
- #else
- OUTPUT_ARCH(i386:x86-64)
- ENTRY(phys_startup_64)
--jiffies_64 = jiffies;
- #endif
-
- PHDRS {
- text PT_LOAD FLAGS(5); /* R_E */
-- data PT_LOAD FLAGS(7); /* RWE */
-+#ifdef CONFIG_X86_32
-+ module PT_LOAD FLAGS(5); /* R_E */
-+#endif
-+#ifdef CONFIG_XEN
-+ rodata PT_LOAD FLAGS(5); /* R_E */
-+#else
-+ rodata PT_LOAD FLAGS(4); /* R__ */
-+#endif
-+ data PT_LOAD FLAGS(6); /* RW_ */
- #ifdef CONFIG_X86_64
- user PT_LOAD FLAGS(5); /* R_E */
-+#endif
-+ init.begin PT_LOAD FLAGS(6); /* RW_ */
- #ifdef CONFIG_SMP
- percpu PT_LOAD FLAGS(6); /* RW_ */
- #endif
-+ text.init PT_LOAD FLAGS(5); /* R_E */
-+ text.exit PT_LOAD FLAGS(5); /* R_E */
- init PT_LOAD FLAGS(7); /* RWE */
--#endif
- note PT_NOTE FLAGS(0); /* ___ */
- }
-
- SECTIONS
- {
- #ifdef CONFIG_X86_32
-- . = LOAD_OFFSET + LOAD_PHYSICAL_ADDR;
-- phys_startup_32 = startup_32 - LOAD_OFFSET;
-+ . = LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR;
- #else
-- . = __START_KERNEL;
-- phys_startup_64 = startup_64 - LOAD_OFFSET;
-+ . = __START_KERNEL;
- #endif
-
- /* Text and read-only data */
-- .text : AT(ADDR(.text) - LOAD_OFFSET) {
-- _text = .;
-+ .text (. - __KERNEL_TEXT_OFFSET): AT(ADDR(.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
- /* bootstrapping code */
-+#ifdef CONFIG_X86_32
-+ phys_startup_32 = startup_32 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
-+#else
-+ phys_startup_64 = startup_64 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
-+#endif
-+ __LOAD_PHYSICAL_ADDR = . - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
-+ _text = .;
- HEAD_TEXT
- #ifdef CONFIG_X86_32
- . = ALIGN(PAGE_SIZE);
-@@ -82,28 +102,72 @@ SECTIONS
- IRQENTRY_TEXT
- *(.fixup)
- *(.gnu.warning)
-- /* End of text section */
-- _etext = .;
- } :text = 0x9090
-
-- NOTES :text :note
-+ . += __KERNEL_TEXT_OFFSET;
-
-- EXCEPTION_TABLE(16) :text = 0x9090
-+#ifdef CONFIG_X86_32
-+ . = ALIGN(PAGE_SIZE);
-+ .vmi.rom : AT(ADDR(.vmi.rom) - LOAD_OFFSET) {
-+ *(.vmi.rom)
-+ } :module
-+
-+ . = ALIGN(PAGE_SIZE);
-+ .module.text : AT(ADDR(.module.text) - LOAD_OFFSET) {
-+
-+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_MODULES)
-+ MODULES_EXEC_VADDR = .;
-+ BYTE(0)
-+ . += (CONFIG_PAX_KERNEXEC_MODULE_TEXT * 1024 * 1024);
-+ . = ALIGN(HPAGE_SIZE) - 1;
-+ MODULES_EXEC_END = .;
-+#endif
-+
-+ } :module
-+#endif
-+
-+ .text.end : AT(ADDR(.text.end) - LOAD_OFFSET) {
-+ /* End of text section */
-+ BYTE(0)
-+ _etext = . - __KERNEL_TEXT_OFFSET;
-+ }
-+
-+#ifdef CONFIG_X86_32
-+ . = ALIGN(PAGE_SIZE);
-+ .rodata.page_aligned : AT(ADDR(.rodata.page_aligned) - LOAD_OFFSET) {
-+ *(.idt)
-+ . = ALIGN(PAGE_SIZE);
-+ *(.empty_zero_page)
-+ *(.swapper_pg_fixmap)
-+ *(.swapper_pg_pmd)
-+ *(.swapper_pg_dir)
-+ *(.trampoline_pg_dir)
-+ } :rodata
-+#endif
-+
-+ . = ALIGN(PAGE_SIZE);
-+ NOTES :rodata :note
-+
-+ EXCEPTION_TABLE(16) :rodata
-
- RO_DATA(PAGE_SIZE)
-
- /* Data */
- .data : AT(ADDR(.data) - LOAD_OFFSET) {
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ . = ALIGN(HPAGE_SIZE);
-+#else
-+ . = ALIGN(PAGE_SIZE);
-+#endif
-+
- /* Start of data section */
- _sdata = .;
-
- /* init_task */
- INIT_TASK_DATA(THREAD_SIZE)
-
--#ifdef CONFIG_X86_32
-- /* 32 bit has nosave before _edata */
- NOSAVE_DATA
--#endif
-
- PAGE_ALIGNED_DATA(PAGE_SIZE)
-
-@@ -112,6 +176,8 @@ SECTIONS
- DATA_DATA
- CONSTRUCTORS
-
-+ jiffies = jiffies_64;
-+
- /* rarely changed data like cpu maps */
- READ_MOSTLY_DATA(CONFIG_X86_INTERNODE_CACHE_BYTES)
-
-@@ -166,12 +232,6 @@ SECTIONS
- }
- vgetcpu_mode = VVIRT(.vgetcpu_mode);
-
-- . = ALIGN(CONFIG_X86_L1_CACHE_BYTES);
-- .jiffies : AT(VLOAD(.jiffies)) {
-- *(.jiffies)
-- }
-- jiffies = VVIRT(.jiffies);
--
- .vsyscall_3 ADDR(.vsyscall_0) + 3072: AT(VLOAD(.vsyscall_3)) {
- *(.vsyscall_3)
- }
-@@ -187,12 +247,19 @@ SECTIONS
- #endif /* CONFIG_X86_64 */
-
- /* Init code and data - will be freed after init */
-- . = ALIGN(PAGE_SIZE);
- .init.begin : AT(ADDR(.init.begin) - LOAD_OFFSET) {
-+ BYTE(0)
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ . = ALIGN(HPAGE_SIZE);
-+#else
-+ . = ALIGN(PAGE_SIZE);
-+#endif
-+
- __init_begin = .; /* paired with __init_end */
-- }
-+ } :init.begin
-
--#if defined(CONFIG_X86_64) && defined(CONFIG_SMP)
-+#ifdef CONFIG_SMP
- /*
- * percpu offsets are zero-based on SMP. PERCPU_VADDR() changes the
- * output PHDR, so the next output section - .init.text - should
-@@ -201,12 +268,27 @@ SECTIONS
- PERCPU_VADDR(0, :percpu)
- #endif
-
-- INIT_TEXT_SECTION(PAGE_SIZE)
--#ifdef CONFIG_X86_64
-- :init
--#endif
-+ . = ALIGN(PAGE_SIZE);
-+ init_begin = .;
-+ .init.text (. - __KERNEL_TEXT_OFFSET): AT(init_begin - LOAD_OFFSET) {
-+ VMLINUX_SYMBOL(_sinittext) = .;
-+ INIT_TEXT
-+ VMLINUX_SYMBOL(_einittext) = .;
-+ . = ALIGN(PAGE_SIZE);
-+ } :text.init
-
-- INIT_DATA_SECTION(16)
-+ /*
-+ * .exit.text is discard at runtime, not link time, to deal with
-+ * references from .altinstructions and .eh_frame
-+ */
-+ .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
-+ EXIT_TEXT
-+ . = ALIGN(16);
-+ } :text.exit
-+ . = init_begin + SIZEOF(.init.text) + SIZEOF(.exit.text);
-+
-+ . = ALIGN(PAGE_SIZE);
-+ INIT_DATA_SECTION(16) :init
-
- .x86_cpu_dev.init : AT(ADDR(.x86_cpu_dev.init) - LOAD_OFFSET) {
- __x86_cpu_dev_start = .;
-@@ -232,19 +314,11 @@ SECTIONS
- *(.altinstr_replacement)
- }
-
-- /*
-- * .exit.text is discard at runtime, not link time, to deal with
-- * references from .altinstructions and .eh_frame
-- */
-- .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
-- EXIT_TEXT
-- }
--
- .exit.data : AT(ADDR(.exit.data) - LOAD_OFFSET) {
- EXIT_DATA
- }
-
--#if !defined(CONFIG_X86_64) || !defined(CONFIG_SMP)
-+#ifndef CONFIG_SMP
- PERCPU(PAGE_SIZE)
- #endif
-
-@@ -267,12 +341,6 @@ SECTIONS
- . = ALIGN(PAGE_SIZE);
- }
-
--#ifdef CONFIG_X86_64
-- .data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) {
-- NOSAVE_DATA
-- }
--#endif
--
- /* BSS */
- . = ALIGN(PAGE_SIZE);
- .bss : AT(ADDR(.bss) - LOAD_OFFSET) {
-@@ -288,6 +356,7 @@ SECTIONS
- __brk_base = .;
- . += 64 * 1024; /* 64k alignment slop space */
- *(.brk_reservation) /* areas brk users have reserved */
-+ . = ALIGN(HPAGE_SIZE);
- __brk_limit = .;
- }
-
-@@ -316,13 +385,12 @@ SECTIONS
- * for the boot processor.
- */
- #define INIT_PER_CPU(x) init_per_cpu__##x = per_cpu__##x + __per_cpu_load
--INIT_PER_CPU(gdt_page);
- INIT_PER_CPU(irq_stack_union);
-
- /*
- * Build-time check on the image size:
- */
--. = ASSERT((_end - _text <= KERNEL_IMAGE_SIZE),
-+. = ASSERT((_end - _text - __KERNEL_TEXT_OFFSET <= KERNEL_IMAGE_SIZE),
- "kernel image bigger than KERNEL_IMAGE_SIZE");
-
- #ifdef CONFIG_SMP
-diff --git a/arch/x86/kernel/vsyscall_64.c b/arch/x86/kernel/vsyscall_64.c
-index 62f39d7..3bc46a1 100644
---- a/arch/x86/kernel/vsyscall_64.c
-+++ b/arch/x86/kernel/vsyscall_64.c
-@@ -80,6 +80,7 @@ void update_vsyscall(struct timespec *wall_time, struct clocksource *clock,
-
- write_seqlock_irqsave(&vsyscall_gtod_data.lock, flags);
- /* copy vsyscall data */
-+ strlcpy(vsyscall_gtod_data.clock.name, clock->name, sizeof vsyscall_gtod_data.clock.name);
- vsyscall_gtod_data.clock.vread = clock->vread;
- vsyscall_gtod_data.clock.cycle_last = clock->cycle_last;
- vsyscall_gtod_data.clock.mask = clock->mask;
-@@ -203,7 +204,7 @@ vgetcpu(unsigned *cpu, unsigned *node, struct getcpu_cache *tcache)
- We do this here because otherwise user space would do it on
- its own in a likely inferior way (no access to jiffies).
- If you don't like it pass NULL. */
-- if (tcache && tcache->blob[0] == (j = __jiffies)) {
-+ if (tcache && tcache->blob[0] == (j = jiffies)) {
- p = tcache->blob[1];
- } else if (__vgetcpu_mode == VGETCPU_RDTSCP) {
- /* Load per CPU data from RDTSCP */
-diff --git a/arch/x86/kernel/x8664_ksyms_64.c b/arch/x86/kernel/x8664_ksyms_64.c
-index 3909e3b..5433a97 100644
---- a/arch/x86/kernel/x8664_ksyms_64.c
-+++ b/arch/x86/kernel/x8664_ksyms_64.c
-@@ -30,8 +30,6 @@ EXPORT_SYMBOL(__put_user_8);
-
- EXPORT_SYMBOL(copy_user_generic);
- EXPORT_SYMBOL(__copy_user_nocache);
--EXPORT_SYMBOL(copy_from_user);
--EXPORT_SYMBOL(copy_to_user);
- EXPORT_SYMBOL(__copy_from_user_inatomic);
-
- EXPORT_SYMBOL(copy_page);
-diff --git a/arch/x86/kernel/xsave.c b/arch/x86/kernel/xsave.c
-index c5ee17e..e73621d2 100644
---- a/arch/x86/kernel/xsave.c
-+++ b/arch/x86/kernel/xsave.c
-@@ -54,7 +54,7 @@ int check_for_xstate(struct i387_fxsave_struct __user *buf,
- fx_sw_user->xstate_size > fx_sw_user->extended_size)
- return -1;
-
-- err = __get_user(magic2, (__u32 *) (((void *)fpstate) +
-+ err = __get_user(magic2, (__u32 __user *) (((void __user *)fpstate) +
- fx_sw_user->extended_size -
- FP_XSTATE_MAGIC2_SIZE));
- /*
-@@ -196,7 +196,7 @@ fx_only:
- * the other extended state.
- */
- xrstor_state(init_xstate_buf, pcntxt_mask & ~XSTATE_FPSSE);
-- return fxrstor_checking((__force struct i387_fxsave_struct *)buf);
-+ return fxrstor_checking((struct i387_fxsave_struct __user *)buf);
- }
-
- /*
-@@ -228,8 +228,7 @@ int restore_i387_xstate(void __user *buf)
- if (task_thread_info(tsk)->status & TS_XSAVE)
- err = restore_user_xstate(buf);
- else
-- err = fxrstor_checking((__force struct i387_fxsave_struct *)
-- buf);
-+ err = fxrstor_checking((struct i387_fxsave_struct __user *)buf);
- if (unlikely(err)) {
- /*
- * Encountered an error while doing the restore from the
-diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
-index aa2d905..d7384e3 100644
---- a/arch/x86/kvm/emulate.c
-+++ b/arch/x86/kvm/emulate.c
-@@ -81,8 +81,8 @@
- #define Src2CL (1<<29)
- #define Src2ImmByte (2<<29)
- #define Src2One (3<<29)
--#define Src2Imm16 (4<<29)
--#define Src2Mask (7<<29)
-+#define Src2Imm16 (4U<<29)
-+#define Src2Mask (7U<<29)
-
- enum {
- Group1_80, Group1_81, Group1_82, Group1_83,
-@@ -411,6 +411,7 @@ static u32 group2_table[] = {
-
- #define ____emulate_2op(_op, _src, _dst, _eflags, _x, _y, _suffix) \
- do { \
-+ unsigned long _tmp; \
- __asm__ __volatile__ ( \
- _PRE_EFLAGS("0", "4", "2") \
- _op _suffix " %"_x"3,%1; " \
-@@ -424,8 +425,6 @@ static u32 group2_table[] = {
- /* Raw emulation: instruction has two explicit operands. */
- #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
- do { \
-- unsigned long _tmp; \
-- \
- switch ((_dst).bytes) { \
- case 2: \
- ____emulate_2op(_op,_src,_dst,_eflags,_wx,_wy,"w"); \
-@@ -441,7 +440,6 @@ static u32 group2_table[] = {
-
- #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
- do { \
-- unsigned long _tmp; \
- switch ((_dst).bytes) { \
- case 1: \
- ____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b"); \
-diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
-index 8dfeaaa..4daa395 100644
---- a/arch/x86/kvm/lapic.c
-+++ b/arch/x86/kvm/lapic.c
-@@ -52,7 +52,7 @@
- #define APIC_BUS_CYCLE_NS 1
-
- /* #define apic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg) */
--#define apic_debug(fmt, arg...)
-+#define apic_debug(fmt, arg...) do {} while (0)
-
- #define APIC_LVT_NUM 6
- /* 14 is the version for Xeon and Pentium 8.4.8*/
-diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
-index 3bc2707..dd157e2 100644
---- a/arch/x86/kvm/paging_tmpl.h
-+++ b/arch/x86/kvm/paging_tmpl.h
-@@ -416,6 +416,8 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr,
- int level = PT_PAGE_TABLE_LEVEL;
- unsigned long mmu_seq;
-
-+ pax_track_stack();
-+
- pgprintk("%s: addr %lx err %x\n", __func__, addr, error_code);
- kvm_mmu_audit(vcpu, "pre page fault");
-
-@@ -461,6 +463,7 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr,
- kvm_mmu_free_some_pages(vcpu);
- sptep = FNAME(fetch)(vcpu, addr, &walker, user_fault, write_fault,
- level, &write_pt, pfn);
-+ (void)sptep;
- pgprintk("%s: shadow pte %p %llx ptwrite %d\n", __func__,
- sptep, *sptep, write_pt);
-
-diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
-index 7c6e63e..c5d92c1 100644
---- a/arch/x86/kvm/svm.c
-+++ b/arch/x86/kvm/svm.c
-@@ -2486,7 +2486,11 @@ static void reload_tss(struct kvm_vcpu *vcpu)
- int cpu = raw_smp_processor_id();
-
- struct svm_cpu_data *svm_data = per_cpu(svm_data, cpu);
-+
-+ pax_open_kernel();
- svm_data->tss_desc->type = 9; /* available 32/64-bit TSS */
-+ pax_close_kernel();
-+
- load_TR_desc();
- }
-
-@@ -2947,7 +2951,7 @@ static bool svm_gb_page_enable(void)
- return true;
- }
-
--static struct kvm_x86_ops svm_x86_ops = {
-+static const struct kvm_x86_ops svm_x86_ops = {
- .cpu_has_kvm_support = has_svm,
- .disabled_by_bios = is_disabled,
- .hardware_setup = svm_hardware_setup,
-diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
-index e6d925f..6bde4d6 100644
---- a/arch/x86/kvm/vmx.c
-+++ b/arch/x86/kvm/vmx.c
-@@ -570,7 +570,11 @@ static void reload_tss(void)
-
- kvm_get_gdt(&gdt);
- descs = (void *)gdt.base;
-+
-+ pax_open_kernel();
- descs[GDT_ENTRY_TSS].type = 9; /* available TSS */
-+ pax_close_kernel();
-+
- load_TR_desc();
- }
-
-@@ -746,6 +750,10 @@ static void vmx_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
- kvm_get_gdt(&dt);
- vmcs_writel(HOST_GDTR_BASE, dt.base); /* 22.2.4 */
-
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ vmcs_writel(HOST_CR3, read_cr3()); /* 22.2.3 FIXME: shadow tables */
-+#endif
-+
- rdmsrl(MSR_IA32_SYSENTER_ESP, sysenter_esp);
- vmcs_writel(HOST_IA32_SYSENTER_ESP, sysenter_esp); /* 22.2.3 */
-
-@@ -1410,8 +1418,11 @@ static __init int hardware_setup(void)
- if (!cpu_has_vmx_flexpriority())
- flexpriority_enabled = 0;
-
-- if (!cpu_has_vmx_tpr_shadow())
-- kvm_x86_ops->update_cr8_intercept = NULL;
-+ if (!cpu_has_vmx_tpr_shadow()) {
-+ pax_open_kernel();
-+ *(void **)&kvm_x86_ops->update_cr8_intercept = NULL;
-+ pax_close_kernel();
-+ }
-
- if (enable_ept && !cpu_has_vmx_ept_2m_page())
- kvm_disable_largepages();
-@@ -2338,7 +2349,10 @@ static int vmx_vcpu_setup(struct vcpu_vmx *vmx)
-
- vmcs_writel(HOST_CR0, read_cr0()); /* 22.2.3 */
- vmcs_writel(HOST_CR4, read_cr4()); /* 22.2.3, 22.2.5 */
-+
-+#ifndef CONFIG_PAX_PER_CPU_PGD
- vmcs_writel(HOST_CR3, read_cr3()); /* 22.2.3 FIXME: shadow tables */
-+#endif
-
- vmcs_write16(HOST_CS_SELECTOR, __KERNEL_CS); /* 22.2.4 */
- vmcs_write16(HOST_DS_SELECTOR, __KERNEL_DS); /* 22.2.4 */
-@@ -2362,7 +2376,7 @@ static int vmx_vcpu_setup(struct vcpu_vmx *vmx)
- vmcs_writel(HOST_IDTR_BASE, dt.base); /* 22.2.4 */
-
- asm("mov $.Lkvm_vmx_return, %0" : "=r"(kvm_vmx_return));
-- vmcs_writel(HOST_RIP, kvm_vmx_return); /* 22.2.5 */
-+ vmcs_writel(HOST_RIP, ktla_ktva(kvm_vmx_return)); /* 22.2.5 */
- vmcs_write32(VM_EXIT_MSR_STORE_COUNT, 0);
- vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, 0);
- vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, 0);
-@@ -3718,6 +3732,12 @@ static void vmx_vcpu_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
- "jmp .Lkvm_vmx_return \n\t"
- ".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t"
- ".Lkvm_vmx_return: "
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ "ljmp %[cs],$.Lkvm_vmx_return2\n\t"
-+ ".Lkvm_vmx_return2: "
-+#endif
-+
- /* Save guest registers, load host registers, keep flags */
- "xchg %0, (%%"R"sp) \n\t"
- "mov %%"R"ax, %c[rax](%0) \n\t"
-@@ -3764,8 +3784,13 @@ static void vmx_vcpu_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
- [r15]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R15])),
- #endif
- [cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2))
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ ,[cs]"i"(__KERNEL_CS)
-+#endif
-+
- : "cc", "memory"
-- , R"bx", R"di", R"si"
-+ , R"ax", R"bx", R"di", R"si"
- #ifdef CONFIG_X86_64
- , "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15"
- #endif
-@@ -3782,7 +3807,16 @@ static void vmx_vcpu_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
- if (vmx->rmode.irq.pending)
- fixup_rmode_irq(vmx);
-
-- asm("mov %0, %%ds; mov %0, %%es" : : "r"(__USER_DS));
-+ asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r"(__KERNEL_DS));
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ loadsegment(fs, __KERNEL_PERCPU);
-+#endif
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ __set_fs(current_thread_info()->addr_limit);
-+#endif
-+
- vmx->launched = 1;
-
- vmx_complete_interrupts(vmx);
-@@ -3957,7 +3991,7 @@ static bool vmx_gb_page_enable(void)
- return false;
- }
-
--static struct kvm_x86_ops vmx_x86_ops = {
-+static const struct kvm_x86_ops vmx_x86_ops = {
- .cpu_has_kvm_support = cpu_has_kvm_support,
- .disabled_by_bios = vmx_disabled_by_bios,
- .hardware_setup = hardware_setup,
-diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index cdee77e..4d06778 100644
---- a/arch/x86/kvm/x86.c
-+++ b/arch/x86/kvm/x86.c
-@@ -82,7 +82,7 @@ static void update_cr8_intercept(struct kvm_vcpu *vcpu);
- static int kvm_dev_ioctl_get_supported_cpuid(struct kvm_cpuid2 *cpuid,
- struct kvm_cpuid_entry2 __user *entries);
-
--struct kvm_x86_ops *kvm_x86_ops;
-+const struct kvm_x86_ops *kvm_x86_ops;
- EXPORT_SYMBOL_GPL(kvm_x86_ops);
-
- int ignore_msrs = 0;
-@@ -1436,15 +1436,20 @@ static int kvm_vcpu_ioctl_set_cpuid2(struct kvm_vcpu *vcpu,
- struct kvm_cpuid2 *cpuid,
- struct kvm_cpuid_entry2 __user *entries)
- {
-- int r;
-+ int r, i;
-
- r = -E2BIG;
- if (cpuid->nent > KVM_MAX_CPUID_ENTRIES)
- goto out;
- r = -EFAULT;
-- if (copy_from_user(&vcpu->arch.cpuid_entries, entries,
-- cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
-+ if (!access_ok(VERIFY_READ, entries, cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
- goto out;
-+ for (i = 0; i < cpuid->nent; ++i) {
-+ struct kvm_cpuid_entry2 cpuid_entry;
-+ if (__copy_from_user(&cpuid_entry, entries + i, sizeof(cpuid_entry)))
-+ goto out;
-+ vcpu->arch.cpuid_entries[i] = cpuid_entry;
-+ }
- vcpu->arch.cpuid_nent = cpuid->nent;
- kvm_apic_set_version(vcpu);
- return 0;
-@@ -1457,16 +1462,20 @@ static int kvm_vcpu_ioctl_get_cpuid2(struct kvm_vcpu *vcpu,
- struct kvm_cpuid2 *cpuid,
- struct kvm_cpuid_entry2 __user *entries)
- {
-- int r;
-+ int r, i;
-
- vcpu_load(vcpu);
- r = -E2BIG;
- if (cpuid->nent < vcpu->arch.cpuid_nent)
- goto out;
- r = -EFAULT;
-- if (copy_to_user(entries, &vcpu->arch.cpuid_entries,
-- vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
-+ if (!access_ok(VERIFY_WRITE, entries, vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
- goto out;
-+ for (i = 0; i < vcpu->arch.cpuid_nent; ++i) {
-+ struct kvm_cpuid_entry2 cpuid_entry = vcpu->arch.cpuid_entries[i];
-+ if (__copy_to_user(entries + i, &cpuid_entry, sizeof(cpuid_entry)))
-+ goto out;
-+ }
- return 0;
-
- out:
-@@ -1684,7 +1693,7 @@ static int kvm_vcpu_ioctl_set_lapic(struct kvm_vcpu *vcpu,
- static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
- struct kvm_interrupt *irq)
- {
-- if (irq->irq < 0 || irq->irq >= 256)
-+ if (irq->irq >= 256)
- return -EINVAL;
- if (irqchip_in_kernel(vcpu->kvm))
- return -ENXIO;
-@@ -3306,10 +3315,10 @@ static struct notifier_block kvmclock_cpufreq_notifier_block = {
- .notifier_call = kvmclock_cpufreq_notifier
- };
-
--int kvm_arch_init(void *opaque)
-+int kvm_arch_init(const void *opaque)
- {
- int r, cpu;
-- struct kvm_x86_ops *ops = (struct kvm_x86_ops *)opaque;
-+ const struct kvm_x86_ops *ops = (const struct kvm_x86_ops *)opaque;
-
- if (kvm_x86_ops) {
- printk(KERN_ERR "kvm: already loaded the other module\n");
-diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
-index 7e59dc1..b88c98f 100644
---- a/arch/x86/lguest/boot.c
-+++ b/arch/x86/lguest/boot.c
-@@ -1172,9 +1172,10 @@ static __init int early_put_chars(u32 vtermno, const char *buf, int count)
- * Rebooting also tells the Host we're finished, but the RESTART flag tells the
- * Launcher to reboot us.
- */
--static void lguest_restart(char *reason)
-+static __noreturn void lguest_restart(char *reason)
- {
- kvm_hypercall2(LHCALL_SHUTDOWN, __pa(reason), LGUEST_SHUTDOWN_RESTART);
-+ BUG();
- }
-
- /*G:050
-diff --git a/arch/x86/lib/atomic64_32.c b/arch/x86/lib/atomic64_32.c
-index 824fa0b..c619e96 100644
---- a/arch/x86/lib/atomic64_32.c
-+++ b/arch/x86/lib/atomic64_32.c
-@@ -25,6 +25,12 @@ u64 atomic64_cmpxchg(atomic64_t *ptr, u64 old_val, u64 new_val)
- }
- EXPORT_SYMBOL(atomic64_cmpxchg);
-
-+u64 atomic64_cmpxchg_unchecked(atomic64_unchecked_t *ptr, u64 old_val, u64 new_val)
-+{
-+ return cmpxchg8b(&ptr->counter, old_val, new_val);
-+}
-+EXPORT_SYMBOL(atomic64_cmpxchg_unchecked);
-+
- /**
- * atomic64_xchg - xchg atomic64 variable
- * @ptr: pointer to type atomic64_t
-@@ -56,6 +62,36 @@ u64 atomic64_xchg(atomic64_t *ptr, u64 new_val)
- EXPORT_SYMBOL(atomic64_xchg);
-
- /**
-+ * atomic64_xchg_unchecked - xchg atomic64 variable
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ * @new_val: value to assign
-+ *
-+ * Atomically xchgs the value of @ptr to @new_val and returns
-+ * the old value.
-+ */
-+u64 atomic64_xchg_unchecked(atomic64_unchecked_t *ptr, u64 new_val)
-+{
-+ /*
-+ * Try first with a (possibly incorrect) assumption about
-+ * what we have there. We'll do two loops most likely,
-+ * but we'll get an ownership MESI transaction straight away
-+ * instead of a read transaction followed by a
-+ * flush-for-ownership transaction:
-+ */
-+ u64 old_val, real_val = 0;
-+
-+ do {
-+ old_val = real_val;
-+
-+ real_val = atomic64_cmpxchg_unchecked(ptr, old_val, new_val);
-+
-+ } while (real_val != old_val);
-+
-+ return old_val;
-+}
-+EXPORT_SYMBOL(atomic64_xchg_unchecked);
-+
-+/**
- * atomic64_set - set atomic64 variable
- * @ptr: pointer to type atomic64_t
- * @new_val: value to assign
-@@ -69,7 +105,19 @@ void atomic64_set(atomic64_t *ptr, u64 new_val)
- EXPORT_SYMBOL(atomic64_set);
-
- /**
--EXPORT_SYMBOL(atomic64_read);
-+ * atomic64_unchecked_set - set atomic64 variable
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ * @new_val: value to assign
-+ *
-+ * Atomically sets the value of @ptr to @new_val.
-+ */
-+void atomic64_set_unchecked(atomic64_unchecked_t *ptr, u64 new_val)
-+{
-+ atomic64_xchg_unchecked(ptr, new_val);
-+}
-+EXPORT_SYMBOL(atomic64_set_unchecked);
-+
-+/**
- * atomic64_add_return - add and return
- * @delta: integer value to add
- * @ptr: pointer to type atomic64_t
-@@ -99,24 +147,72 @@ noinline u64 atomic64_add_return(u64 delta, atomic64_t *ptr)
- }
- EXPORT_SYMBOL(atomic64_add_return);
-
-+/**
-+ * atomic64_add_return_unchecked - add and return
-+ * @delta: integer value to add
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically adds @delta to @ptr and returns @delta + *@ptr
-+ */
-+noinline u64 atomic64_add_return_unchecked(u64 delta, atomic64_unchecked_t *ptr)
-+{
-+ /*
-+ * Try first with a (possibly incorrect) assumption about
-+ * what we have there. We'll do two loops most likely,
-+ * but we'll get an ownership MESI transaction straight away
-+ * instead of a read transaction followed by a
-+ * flush-for-ownership transaction:
-+ */
-+ u64 old_val, new_val, real_val = 0;
-+
-+ do {
-+ old_val = real_val;
-+ new_val = old_val + delta;
-+
-+ real_val = atomic64_cmpxchg_unchecked(ptr, old_val, new_val);
-+
-+ } while (real_val != old_val);
-+
-+ return new_val;
-+}
-+EXPORT_SYMBOL(atomic64_add_return_unchecked);
-+
- u64 atomic64_sub_return(u64 delta, atomic64_t *ptr)
- {
- return atomic64_add_return(-delta, ptr);
- }
- EXPORT_SYMBOL(atomic64_sub_return);
-
-+u64 atomic64_sub_return_unchecked(u64 delta, atomic64_unchecked_t *ptr)
-+{
-+ return atomic64_add_return_unchecked(-delta, ptr);
-+}
-+EXPORT_SYMBOL(atomic64_sub_return_unchecked);
-+
- u64 atomic64_inc_return(atomic64_t *ptr)
- {
- return atomic64_add_return(1, ptr);
- }
- EXPORT_SYMBOL(atomic64_inc_return);
-
-+u64 atomic64_inc_return_unchecked(atomic64_unchecked_t *ptr)
-+{
-+ return atomic64_add_return_unchecked(1, ptr);
-+}
-+EXPORT_SYMBOL(atomic64_inc_return_unchecked);
-+
- u64 atomic64_dec_return(atomic64_t *ptr)
- {
- return atomic64_sub_return(1, ptr);
- }
- EXPORT_SYMBOL(atomic64_dec_return);
-
-+u64 atomic64_dec_return_unchecked(atomic64_unchecked_t *ptr)
-+{
-+ return atomic64_sub_return_unchecked(1, ptr);
-+}
-+EXPORT_SYMBOL(atomic64_dec_return_unchecked);
-+
- /**
- * atomic64_add - add integer to atomic64 variable
- * @delta: integer value to add
-@@ -131,6 +227,19 @@ void atomic64_add(u64 delta, atomic64_t *ptr)
- EXPORT_SYMBOL(atomic64_add);
-
- /**
-+ * atomic64_add_unchecked - add integer to atomic64 variable
-+ * @delta: integer value to add
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically adds @delta to @ptr.
-+ */
-+void atomic64_add_unchecked(u64 delta, atomic64_unchecked_t *ptr)
-+{
-+ atomic64_add_return_unchecked(delta, ptr);
-+}
-+EXPORT_SYMBOL(atomic64_add_unchecked);
-+
-+/**
- * atomic64_sub - subtract the atomic64 variable
- * @delta: integer value to subtract
- * @ptr: pointer to type atomic64_t
-@@ -144,6 +253,19 @@ void atomic64_sub(u64 delta, atomic64_t *ptr)
- EXPORT_SYMBOL(atomic64_sub);
-
- /**
-+ * atomic64_sub_unchecked - subtract the atomic64 variable
-+ * @delta: integer value to subtract
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically subtracts @delta from @ptr.
-+ */
-+void atomic64_sub_unchecked(u64 delta, atomic64_unchecked_t *ptr)
-+{
-+ atomic64_add_unchecked(-delta, ptr);
-+}
-+EXPORT_SYMBOL(atomic64_sub_unchecked);
-+
-+/**
- * atomic64_sub_and_test - subtract value from variable and test result
- * @delta: integer value to subtract
- * @ptr: pointer to type atomic64_t
-@@ -173,6 +295,18 @@ void atomic64_inc(atomic64_t *ptr)
- EXPORT_SYMBOL(atomic64_inc);
-
- /**
-+ * atomic64_inc_unchecked - increment atomic64 variable
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically increments @ptr by 1.
-+ */
-+void atomic64_inc_unchecked(atomic64_unchecked_t *ptr)
-+{
-+ atomic64_add_unchecked(1, ptr);
-+}
-+EXPORT_SYMBOL(atomic64_inc_unchecked);
-+
-+/**
- * atomic64_dec - decrement atomic64 variable
- * @ptr: pointer to type atomic64_t
- *
-@@ -185,6 +319,18 @@ void atomic64_dec(atomic64_t *ptr)
- EXPORT_SYMBOL(atomic64_dec);
-
- /**
-+ * atomic64_dec_unchecked - decrement atomic64 variable
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically decrements @ptr by 1.
-+ */
-+void atomic64_dec_unchecked(atomic64_unchecked_t *ptr)
-+{
-+ atomic64_sub_unchecked(1, ptr);
-+}
-+EXPORT_SYMBOL(atomic64_dec_unchecked);
-+
-+/**
- * atomic64_dec_and_test - decrement and test
- * @ptr: pointer to type atomic64_t
- *
-diff --git a/arch/x86/lib/checksum_32.S b/arch/x86/lib/checksum_32.S
-index adbccd0..98f96c8 100644
---- a/arch/x86/lib/checksum_32.S
-+++ b/arch/x86/lib/checksum_32.S
-@@ -28,7 +28,8 @@
- #include <linux/linkage.h>
- #include <asm/dwarf2.h>
- #include <asm/errno.h>
--
-+#include <asm/segment.h>
-+
- /*
- * computes a partial checksum, e.g. for TCP/UDP fragments
- */
-@@ -304,9 +305,28 @@ unsigned int csum_partial_copy_generic (const char *src, char *dst,
-
- #define ARGBASE 16
- #define FP 12
--
--ENTRY(csum_partial_copy_generic)
-+
-+ENTRY(csum_partial_copy_generic_to_user)
- CFI_STARTPROC
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ pushl %gs
-+ CFI_ADJUST_CFA_OFFSET 4
-+ popl %es
-+ CFI_ADJUST_CFA_OFFSET -4
-+ jmp csum_partial_copy_generic
-+#endif
-+
-+ENTRY(csum_partial_copy_generic_from_user)
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ pushl %gs
-+ CFI_ADJUST_CFA_OFFSET 4
-+ popl %ds
-+ CFI_ADJUST_CFA_OFFSET -4
-+#endif
-+
-+ENTRY(csum_partial_copy_generic)
- subl $4,%esp
- CFI_ADJUST_CFA_OFFSET 4
- pushl %edi
-@@ -331,7 +351,7 @@ ENTRY(csum_partial_copy_generic)
- jmp 4f
- SRC(1: movw (%esi), %bx )
- addl $2, %esi
--DST( movw %bx, (%edi) )
-+DST( movw %bx, %es:(%edi) )
- addl $2, %edi
- addw %bx, %ax
- adcl $0, %eax
-@@ -343,30 +363,30 @@ DST( movw %bx, (%edi) )
- SRC(1: movl (%esi), %ebx )
- SRC( movl 4(%esi), %edx )
- adcl %ebx, %eax
--DST( movl %ebx, (%edi) )
-+DST( movl %ebx, %es:(%edi) )
- adcl %edx, %eax
--DST( movl %edx, 4(%edi) )
-+DST( movl %edx, %es:4(%edi) )
-
- SRC( movl 8(%esi), %ebx )
- SRC( movl 12(%esi), %edx )
- adcl %ebx, %eax
--DST( movl %ebx, 8(%edi) )
-+DST( movl %ebx, %es:8(%edi) )
- adcl %edx, %eax
--DST( movl %edx, 12(%edi) )
-+DST( movl %edx, %es:12(%edi) )
-
- SRC( movl 16(%esi), %ebx )
- SRC( movl 20(%esi), %edx )
- adcl %ebx, %eax
--DST( movl %ebx, 16(%edi) )
-+DST( movl %ebx, %es:16(%edi) )
- adcl %edx, %eax
--DST( movl %edx, 20(%edi) )
-+DST( movl %edx, %es:20(%edi) )
-
- SRC( movl 24(%esi), %ebx )
- SRC( movl 28(%esi), %edx )
- adcl %ebx, %eax
--DST( movl %ebx, 24(%edi) )
-+DST( movl %ebx, %es:24(%edi) )
- adcl %edx, %eax
--DST( movl %edx, 28(%edi) )
-+DST( movl %edx, %es:28(%edi) )
-
- lea 32(%esi), %esi
- lea 32(%edi), %edi
-@@ -380,7 +400,7 @@ DST( movl %edx, 28(%edi) )
- shrl $2, %edx # This clears CF
- SRC(3: movl (%esi), %ebx )
- adcl %ebx, %eax
--DST( movl %ebx, (%edi) )
-+DST( movl %ebx, %es:(%edi) )
- lea 4(%esi), %esi
- lea 4(%edi), %edi
- dec %edx
-@@ -392,12 +412,12 @@ DST( movl %ebx, (%edi) )
- jb 5f
- SRC( movw (%esi), %cx )
- leal 2(%esi), %esi
--DST( movw %cx, (%edi) )
-+DST( movw %cx, %es:(%edi) )
- leal 2(%edi), %edi
- je 6f
- shll $16,%ecx
- SRC(5: movb (%esi), %cl )
--DST( movb %cl, (%edi) )
-+DST( movb %cl, %es:(%edi) )
- 6: addl %ecx, %eax
- adcl $0, %eax
- 7:
-@@ -408,7 +428,7 @@ DST( movb %cl, (%edi) )
-
- 6001:
- movl ARGBASE+20(%esp), %ebx # src_err_ptr
-- movl $-EFAULT, (%ebx)
-+ movl $-EFAULT, %ss:(%ebx)
-
- # zero the complete destination - computing the rest
- # is too much work
-@@ -421,11 +441,19 @@ DST( movb %cl, (%edi) )
-
- 6002:
- movl ARGBASE+24(%esp), %ebx # dst_err_ptr
-- movl $-EFAULT,(%ebx)
-+ movl $-EFAULT,%ss:(%ebx)
- jmp 5000b
-
- .previous
-
-+ pushl %ss
-+ CFI_ADJUST_CFA_OFFSET 4
-+ popl %ds
-+ CFI_ADJUST_CFA_OFFSET -4
-+ pushl %ss
-+ CFI_ADJUST_CFA_OFFSET 4
-+ popl %es
-+ CFI_ADJUST_CFA_OFFSET -4
- popl %ebx
- CFI_ADJUST_CFA_OFFSET -4
- CFI_RESTORE ebx
-@@ -439,26 +467,47 @@ DST( movb %cl, (%edi) )
- CFI_ADJUST_CFA_OFFSET -4
- ret
- CFI_ENDPROC
--ENDPROC(csum_partial_copy_generic)
-+ENDPROC(csum_partial_copy_generic_to_user)
-
- #else
-
- /* Version for PentiumII/PPro */
-
- #define ROUND1(x) \
-+ nop; nop; nop; \
- SRC(movl x(%esi), %ebx ) ; \
- addl %ebx, %eax ; \
-- DST(movl %ebx, x(%edi) ) ;
-+ DST(movl %ebx, %es:x(%edi)) ;
-
- #define ROUND(x) \
-+ nop; nop; nop; \
- SRC(movl x(%esi), %ebx ) ; \
- adcl %ebx, %eax ; \
-- DST(movl %ebx, x(%edi) ) ;
-+ DST(movl %ebx, %es:x(%edi)) ;
-
- #define ARGBASE 12
--
--ENTRY(csum_partial_copy_generic)
-+
-+ENTRY(csum_partial_copy_generic_to_user)
- CFI_STARTPROC
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ pushl %gs
-+ CFI_ADJUST_CFA_OFFSET 4
-+ popl %es
-+ CFI_ADJUST_CFA_OFFSET -4
-+ jmp csum_partial_copy_generic
-+#endif
-+
-+ENTRY(csum_partial_copy_generic_from_user)
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ pushl %gs
-+ CFI_ADJUST_CFA_OFFSET 4
-+ popl %ds
-+ CFI_ADJUST_CFA_OFFSET -4
-+#endif
-+
-+ENTRY(csum_partial_copy_generic)
- pushl %ebx
- CFI_ADJUST_CFA_OFFSET 4
- CFI_REL_OFFSET ebx, 0
-@@ -482,7 +531,7 @@ ENTRY(csum_partial_copy_generic)
- subl %ebx, %edi
- lea -1(%esi),%edx
- andl $-32,%edx
-- lea 3f(%ebx,%ebx), %ebx
-+ lea 3f(%ebx,%ebx,2), %ebx
- testl %esi, %esi
- jmp *%ebx
- 1: addl $64,%esi
-@@ -503,19 +552,19 @@ ENTRY(csum_partial_copy_generic)
- jb 5f
- SRC( movw (%esi), %dx )
- leal 2(%esi), %esi
--DST( movw %dx, (%edi) )
-+DST( movw %dx, %es:(%edi) )
- leal 2(%edi), %edi
- je 6f
- shll $16,%edx
- 5:
- SRC( movb (%esi), %dl )
--DST( movb %dl, (%edi) )
-+DST( movb %dl, %es:(%edi) )
- 6: addl %edx, %eax
- adcl $0, %eax
- 7:
- .section .fixup, "ax"
- 6001: movl ARGBASE+20(%esp), %ebx # src_err_ptr
-- movl $-EFAULT, (%ebx)
-+ movl $-EFAULT, %ss:(%ebx)
- # zero the complete destination (computing the rest is too much work)
- movl ARGBASE+8(%esp),%edi # dst
- movl ARGBASE+12(%esp),%ecx # len
-@@ -523,10 +572,21 @@ DST( movb %dl, (%edi) )
- rep; stosb
- jmp 7b
- 6002: movl ARGBASE+24(%esp), %ebx # dst_err_ptr
-- movl $-EFAULT, (%ebx)
-+ movl $-EFAULT, %ss:(%ebx)
- jmp 7b
- .previous
-
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ pushl %ss
-+ CFI_ADJUST_CFA_OFFSET 4
-+ popl %ds
-+ CFI_ADJUST_CFA_OFFSET -4
-+ pushl %ss
-+ CFI_ADJUST_CFA_OFFSET 4
-+ popl %es
-+ CFI_ADJUST_CFA_OFFSET -4
-+#endif
-+
- popl %esi
- CFI_ADJUST_CFA_OFFSET -4
- CFI_RESTORE esi
-@@ -538,7 +598,7 @@ DST( movb %dl, (%edi) )
- CFI_RESTORE ebx
- ret
- CFI_ENDPROC
--ENDPROC(csum_partial_copy_generic)
-+ENDPROC(csum_partial_copy_generic_to_user)
-
- #undef ROUND
- #undef ROUND1
-diff --git a/arch/x86/lib/clear_page_64.S b/arch/x86/lib/clear_page_64.S
-index ebeafcc..1e3a402 100644
---- a/arch/x86/lib/clear_page_64.S
-+++ b/arch/x86/lib/clear_page_64.S
-@@ -1,5 +1,6 @@
- #include <linux/linkage.h>
- #include <asm/dwarf2.h>
-+#include <asm/alternative-asm.h>
-
- /*
- * Zero a page.
-@@ -10,6 +11,7 @@ ENTRY(clear_page_c)
- movl $4096/8,%ecx
- xorl %eax,%eax
- rep stosq
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
- ENDPROC(clear_page_c)
-@@ -33,6 +35,7 @@ ENTRY(clear_page)
- leaq 64(%rdi),%rdi
- jnz .Lloop
- nop
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
- .Lclear_page_end:
-@@ -43,7 +46,7 @@ ENDPROC(clear_page)
-
- #include <asm/cpufeature.h>
-
-- .section .altinstr_replacement,"ax"
-+ .section .altinstr_replacement,"a"
- 1: .byte 0xeb /* jmp <disp8> */
- .byte (clear_page_c - clear_page) - (2f - 1b) /* offset */
- 2:
-diff --git a/arch/x86/lib/copy_page_64.S b/arch/x86/lib/copy_page_64.S
-index 727a5d4..333818a 100644
---- a/arch/x86/lib/copy_page_64.S
-+++ b/arch/x86/lib/copy_page_64.S
-@@ -2,12 +2,14 @@
-
- #include <linux/linkage.h>
- #include <asm/dwarf2.h>
-+#include <asm/alternative-asm.h>
-
- ALIGN
- copy_page_c:
- CFI_STARTPROC
- movl $4096/8,%ecx
- rep movsq
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
- ENDPROC(copy_page_c)
-@@ -38,7 +40,7 @@ ENTRY(copy_page)
- movq 16 (%rsi), %rdx
- movq 24 (%rsi), %r8
- movq 32 (%rsi), %r9
-- movq 40 (%rsi), %r10
-+ movq 40 (%rsi), %r13
- movq 48 (%rsi), %r11
- movq 56 (%rsi), %r12
-
-@@ -49,7 +51,7 @@ ENTRY(copy_page)
- movq %rdx, 16 (%rdi)
- movq %r8, 24 (%rdi)
- movq %r9, 32 (%rdi)
-- movq %r10, 40 (%rdi)
-+ movq %r13, 40 (%rdi)
- movq %r11, 48 (%rdi)
- movq %r12, 56 (%rdi)
-
-@@ -68,7 +70,7 @@ ENTRY(copy_page)
- movq 16 (%rsi), %rdx
- movq 24 (%rsi), %r8
- movq 32 (%rsi), %r9
-- movq 40 (%rsi), %r10
-+ movq 40 (%rsi), %r13
- movq 48 (%rsi), %r11
- movq 56 (%rsi), %r12
-
-@@ -77,7 +79,7 @@ ENTRY(copy_page)
- movq %rdx, 16 (%rdi)
- movq %r8, 24 (%rdi)
- movq %r9, 32 (%rdi)
-- movq %r10, 40 (%rdi)
-+ movq %r13, 40 (%rdi)
- movq %r11, 48 (%rdi)
- movq %r12, 56 (%rdi)
-
-@@ -94,6 +96,7 @@ ENTRY(copy_page)
- CFI_RESTORE r13
- addq $3*8,%rsp
- CFI_ADJUST_CFA_OFFSET -3*8
-+ pax_force_retaddr
- ret
- .Lcopy_page_end:
- CFI_ENDPROC
-@@ -104,7 +107,7 @@ ENDPROC(copy_page)
-
- #include <asm/cpufeature.h>
-
-- .section .altinstr_replacement,"ax"
-+ .section .altinstr_replacement,"a"
- 1: .byte 0xeb /* jmp <disp8> */
- .byte (copy_page_c - copy_page) - (2f - 1b) /* offset */
- 2:
-diff --git a/arch/x86/lib/copy_user_64.S b/arch/x86/lib/copy_user_64.S
-index af8debd..40c75f3 100644
---- a/arch/x86/lib/copy_user_64.S
-+++ b/arch/x86/lib/copy_user_64.S
-@@ -15,13 +15,15 @@
- #include <asm/asm-offsets.h>
- #include <asm/thread_info.h>
- #include <asm/cpufeature.h>
-+#include <asm/pgtable.h>
-+#include <asm/alternative-asm.h>
-
- .macro ALTERNATIVE_JUMP feature,orig,alt
- 0:
- .byte 0xe9 /* 32bit jump */
- .long \orig-1f /* by default jump to orig */
- 1:
-- .section .altinstr_replacement,"ax"
-+ .section .altinstr_replacement,"a"
- 2: .byte 0xe9 /* near jump with 32bit immediate */
- .long \alt-1b /* offset */ /* or alternatively to alt */
- .previous
-@@ -64,55 +66,26 @@
- #endif
- .endm
-
--/* Standard copy_to_user with segment limit checking */
--ENTRY(copy_to_user)
-- CFI_STARTPROC
-- GET_THREAD_INFO(%rax)
-- movq %rdi,%rcx
-- addq %rdx,%rcx
-- jc bad_to_user
-- cmpq TI_addr_limit(%rax),%rcx
-- ja bad_to_user
-- ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
-- CFI_ENDPROC
--ENDPROC(copy_to_user)
--
--/* Standard copy_from_user with segment limit checking */
--ENTRY(copy_from_user)
-- CFI_STARTPROC
-- GET_THREAD_INFO(%rax)
-- movq %rsi,%rcx
-- addq %rdx,%rcx
-- jc bad_from_user
-- cmpq TI_addr_limit(%rax),%rcx
-- ja bad_from_user
-- ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
-- CFI_ENDPROC
--ENDPROC(copy_from_user)
--
- ENTRY(copy_user_generic)
- CFI_STARTPROC
- ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
- CFI_ENDPROC
- ENDPROC(copy_user_generic)
-
--ENTRY(__copy_from_user_inatomic)
-- CFI_STARTPROC
-- ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
-- CFI_ENDPROC
--ENDPROC(__copy_from_user_inatomic)
--
- .section .fixup,"ax"
- /* must zero dest */
- ENTRY(bad_from_user)
- bad_from_user:
- CFI_STARTPROC
-+ testl %edx,%edx
-+ js bad_to_user
- movl %edx,%ecx
- xorl %eax,%eax
- rep
- stosb
- bad_to_user:
- movl %edx,%eax
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
- ENDPROC(bad_from_user)
-@@ -142,19 +115,19 @@ ENTRY(copy_user_generic_unrolled)
- jz 17f
- 1: movq (%rsi),%r8
- 2: movq 1*8(%rsi),%r9
--3: movq 2*8(%rsi),%r10
-+3: movq 2*8(%rsi),%rax
- 4: movq 3*8(%rsi),%r11
- 5: movq %r8,(%rdi)
- 6: movq %r9,1*8(%rdi)
--7: movq %r10,2*8(%rdi)
-+7: movq %rax,2*8(%rdi)
- 8: movq %r11,3*8(%rdi)
- 9: movq 4*8(%rsi),%r8
- 10: movq 5*8(%rsi),%r9
--11: movq 6*8(%rsi),%r10
-+11: movq 6*8(%rsi),%rax
- 12: movq 7*8(%rsi),%r11
- 13: movq %r8,4*8(%rdi)
- 14: movq %r9,5*8(%rdi)
--15: movq %r10,6*8(%rdi)
-+15: movq %rax,6*8(%rdi)
- 16: movq %r11,7*8(%rdi)
- leaq 64(%rsi),%rsi
- leaq 64(%rdi),%rdi
-@@ -180,6 +153,7 @@ ENTRY(copy_user_generic_unrolled)
- decl %ecx
- jnz 21b
- 23: xor %eax,%eax
-+ pax_force_retaddr
- ret
-
- .section .fixup,"ax"
-@@ -252,6 +226,7 @@ ENTRY(copy_user_generic_string)
- 3: rep
- movsb
- 4: xorl %eax,%eax
-+ pax_force_retaddr
- ret
-
- .section .fixup,"ax"
-diff --git a/arch/x86/lib/copy_user_nocache_64.S b/arch/x86/lib/copy_user_nocache_64.S
-index cb0c112..e3a6895 100644
---- a/arch/x86/lib/copy_user_nocache_64.S
-+++ b/arch/x86/lib/copy_user_nocache_64.S
-@@ -8,12 +8,14 @@
-
- #include <linux/linkage.h>
- #include <asm/dwarf2.h>
-+#include <asm/alternative-asm.h>
-
- #define FIX_ALIGNMENT 1
-
- #include <asm/current.h>
- #include <asm/asm-offsets.h>
- #include <asm/thread_info.h>
-+#include <asm/pgtable.h>
-
- .macro ALIGN_DESTINATION
- #ifdef FIX_ALIGNMENT
-@@ -50,6 +52,15 @@
- */
- ENTRY(__copy_user_nocache)
- CFI_STARTPROC
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ mov $PAX_USER_SHADOW_BASE,%rcx
-+ cmp %rcx,%rsi
-+ jae 1f
-+ add %rcx,%rsi
-+1:
-+#endif
-+
- cmpl $8,%edx
- jb 20f /* less then 8 bytes, go to byte copy loop */
- ALIGN_DESTINATION
-@@ -59,19 +70,19 @@ ENTRY(__copy_user_nocache)
- jz 17f
- 1: movq (%rsi),%r8
- 2: movq 1*8(%rsi),%r9
--3: movq 2*8(%rsi),%r10
-+3: movq 2*8(%rsi),%rax
- 4: movq 3*8(%rsi),%r11
- 5: movnti %r8,(%rdi)
- 6: movnti %r9,1*8(%rdi)
--7: movnti %r10,2*8(%rdi)
-+7: movnti %rax,2*8(%rdi)
- 8: movnti %r11,3*8(%rdi)
- 9: movq 4*8(%rsi),%r8
- 10: movq 5*8(%rsi),%r9
--11: movq 6*8(%rsi),%r10
-+11: movq 6*8(%rsi),%rax
- 12: movq 7*8(%rsi),%r11
- 13: movnti %r8,4*8(%rdi)
- 14: movnti %r9,5*8(%rdi)
--15: movnti %r10,6*8(%rdi)
-+15: movnti %rax,6*8(%rdi)
- 16: movnti %r11,7*8(%rdi)
- leaq 64(%rsi),%rsi
- leaq 64(%rdi),%rdi
-@@ -98,6 +109,7 @@ ENTRY(__copy_user_nocache)
- jnz 21b
- 23: xorl %eax,%eax
- sfence
-+ pax_force_retaddr
- ret
-
- .section .fixup,"ax"
-diff --git a/arch/x86/lib/csum-copy_64.S b/arch/x86/lib/csum-copy_64.S
-index f0dba36..48cb4d6 100644
---- a/arch/x86/lib/csum-copy_64.S
-+++ b/arch/x86/lib/csum-copy_64.S
-@@ -8,6 +8,7 @@
- #include <linux/linkage.h>
- #include <asm/dwarf2.h>
- #include <asm/errno.h>
-+#include <asm/alternative-asm.h>
-
- /*
- * Checksum copy with exception handling.
-@@ -228,6 +229,7 @@ ENTRY(csum_partial_copy_generic)
- CFI_RESTORE rbp
- addq $7*8,%rsp
- CFI_ADJUST_CFA_OFFSET -7*8
-+ pax_force_retaddr 0, 1
- ret
- CFI_RESTORE_STATE
-
-diff --git a/arch/x86/lib/csum-wrappers_64.c b/arch/x86/lib/csum-wrappers_64.c
-index 459b58a..d67737f 100644
---- a/arch/x86/lib/csum-wrappers_64.c
-+++ b/arch/x86/lib/csum-wrappers_64.c
-@@ -52,7 +52,7 @@ csum_partial_copy_from_user(const void __user *src, void *dst,
- len -= 2;
- }
- }
-- isum = csum_partial_copy_generic((__force const void *)src,
-+ isum = csum_partial_copy_generic((const void __force_kernel *)____m(src),
- dst, len, isum, errp, NULL);
- if (unlikely(*errp))
- goto out_err;
-@@ -105,7 +105,7 @@ csum_partial_copy_to_user(const void *src, void __user *dst,
- }
-
- *errp = 0;
-- return csum_partial_copy_generic(src, (void __force *)dst,
-+ return csum_partial_copy_generic(src, (void __force_kernel *)____m(dst),
- len, isum, NULL, errp);
- }
- EXPORT_SYMBOL(csum_partial_copy_to_user);
-diff --git a/arch/x86/lib/getuser.S b/arch/x86/lib/getuser.S
-index 51f1504..ddac4c1 100644
---- a/arch/x86/lib/getuser.S
-+++ b/arch/x86/lib/getuser.S
-@@ -33,15 +33,38 @@
- #include <asm/asm-offsets.h>
- #include <asm/thread_info.h>
- #include <asm/asm.h>
-+#include <asm/segment.h>
-+#include <asm/pgtable.h>
-+#include <asm/alternative-asm.h>
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+#define __copyuser_seg gs;
-+#else
-+#define __copyuser_seg
-+#endif
-
- .text
- ENTRY(__get_user_1)
- CFI_STARTPROC
-+
-+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
- GET_THREAD_INFO(%_ASM_DX)
- cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
- jae bad_get_user
--1: movzb (%_ASM_AX),%edx
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
-+ cmp %_ASM_DX,%_ASM_AX
-+ jae 1234f
-+ add %_ASM_DX,%_ASM_AX
-+1234:
-+#endif
-+
-+#endif
-+
-+1: __copyuser_seg movzb (%_ASM_AX),%edx
- xor %eax,%eax
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
- ENDPROC(__get_user_1)
-@@ -49,12 +72,26 @@ ENDPROC(__get_user_1)
- ENTRY(__get_user_2)
- CFI_STARTPROC
- add $1,%_ASM_AX
-+
-+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
- jc bad_get_user
- GET_THREAD_INFO(%_ASM_DX)
- cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
- jae bad_get_user
--2: movzwl -1(%_ASM_AX),%edx
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
-+ cmp %_ASM_DX,%_ASM_AX
-+ jae 1234f
-+ add %_ASM_DX,%_ASM_AX
-+1234:
-+#endif
-+
-+#endif
-+
-+2: __copyuser_seg movzwl -1(%_ASM_AX),%edx
- xor %eax,%eax
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
- ENDPROC(__get_user_2)
-@@ -62,12 +99,26 @@ ENDPROC(__get_user_2)
- ENTRY(__get_user_4)
- CFI_STARTPROC
- add $3,%_ASM_AX
-+
-+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
- jc bad_get_user
- GET_THREAD_INFO(%_ASM_DX)
- cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
- jae bad_get_user
--3: mov -3(%_ASM_AX),%edx
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
-+ cmp %_ASM_DX,%_ASM_AX
-+ jae 1234f
-+ add %_ASM_DX,%_ASM_AX
-+1234:
-+#endif
-+
-+#endif
-+
-+3: __copyuser_seg mov -3(%_ASM_AX),%edx
- xor %eax,%eax
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
- ENDPROC(__get_user_4)
-@@ -80,8 +131,18 @@ ENTRY(__get_user_8)
- GET_THREAD_INFO(%_ASM_DX)
- cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
- jae bad_get_user
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
-+ cmp %_ASM_DX,%_ASM_AX
-+ jae 1234f
-+ add %_ASM_DX,%_ASM_AX
-+1234:
-+#endif
-+
- 4: movq -7(%_ASM_AX),%_ASM_DX
- xor %eax,%eax
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
- ENDPROC(__get_user_8)
-@@ -91,6 +152,7 @@ bad_get_user:
- CFI_STARTPROC
- xor %edx,%edx
- mov $(-EFAULT),%_ASM_AX
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
- END(bad_get_user)
-diff --git a/arch/x86/lib/iomap_copy_64.S b/arch/x86/lib/iomap_copy_64.S
-index 05a95e7..326f2fa 100644
---- a/arch/x86/lib/iomap_copy_64.S
-+++ b/arch/x86/lib/iomap_copy_64.S
-@@ -17,6 +17,7 @@
-
- #include <linux/linkage.h>
- #include <asm/dwarf2.h>
-+#include <asm/alternative-asm.h>
-
- /*
- * override generic version in lib/iomap_copy.c
-@@ -25,6 +26,7 @@ ENTRY(__iowrite32_copy)
- CFI_STARTPROC
- movl %edx,%ecx
- rep movsd
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
- ENDPROC(__iowrite32_copy)
-diff --git a/arch/x86/lib/memcpy_64.S b/arch/x86/lib/memcpy_64.S
-index ad5441e..610e351 100644
---- a/arch/x86/lib/memcpy_64.S
-+++ b/arch/x86/lib/memcpy_64.S
-@@ -4,6 +4,7 @@
-
- #include <asm/cpufeature.h>
- #include <asm/dwarf2.h>
-+#include <asm/alternative-asm.h>
-
- /*
- * memcpy - Copy a memory block.
-@@ -34,6 +35,7 @@ memcpy_c:
- rep movsq
- movl %edx, %ecx
- rep movsb
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
- ENDPROC(memcpy_c)
-@@ -118,6 +120,7 @@ ENTRY(memcpy)
- jnz .Lloop_1
-
- .Lend:
-+ pax_force_retaddr 0, 1
- ret
- CFI_ENDPROC
- ENDPROC(memcpy)
-@@ -128,7 +131,7 @@ ENDPROC(__memcpy)
- * It is also a lot simpler. Use this when possible:
- */
-
-- .section .altinstr_replacement, "ax"
-+ .section .altinstr_replacement, "a"
- 1: .byte 0xeb /* jmp <disp8> */
- .byte (memcpy_c - memcpy) - (2f - 1b) /* offset */
- 2:
-diff --git a/arch/x86/lib/memset_64.S b/arch/x86/lib/memset_64.S
-index 2c59481..7e9ba4e 100644
---- a/arch/x86/lib/memset_64.S
-+++ b/arch/x86/lib/memset_64.S
-@@ -2,6 +2,7 @@
-
- #include <linux/linkage.h>
- #include <asm/dwarf2.h>
-+#include <asm/alternative-asm.h>
-
- /*
- * ISO C memset - set a memory block to a byte value.
-@@ -28,6 +29,7 @@ memset_c:
- movl %r8d,%ecx
- rep stosb
- movq %r9,%rax
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
- ENDPROC(memset_c)
-@@ -35,13 +37,13 @@ ENDPROC(memset_c)
- ENTRY(memset)
- ENTRY(__memset)
- CFI_STARTPROC
-- movq %rdi,%r10
- movq %rdx,%r11
-
- /* expand byte value */
- movzbl %sil,%ecx
- movabs $0x0101010101010101,%rax
- mul %rcx /* with rax, clobbers rdx */
-+ movq %rdi,%rdx
-
- /* align dst */
- movl %edi,%r9d
-@@ -95,7 +97,8 @@ ENTRY(__memset)
- jnz .Lloop_1
-
- .Lende:
-- movq %r10,%rax
-+ movq %rdx,%rax
-+ pax_force_retaddr
- ret
-
- CFI_RESTORE_STATE
-@@ -118,7 +121,7 @@ ENDPROC(__memset)
-
- #include <asm/cpufeature.h>
-
-- .section .altinstr_replacement,"ax"
-+ .section .altinstr_replacement,"a"
- 1: .byte 0xeb /* jmp <disp8> */
- .byte (memset_c - memset) - (2f - 1b) /* offset */
- 2:
-diff --git a/arch/x86/lib/mmx_32.c b/arch/x86/lib/mmx_32.c
-index c9f2d9b..e7fd2c0 100644
---- a/arch/x86/lib/mmx_32.c
-+++ b/arch/x86/lib/mmx_32.c
-@@ -29,6 +29,7 @@ void *_mmx_memcpy(void *to, const void *from, size_t len)
- {
- void *p;
- int i;
-+ unsigned long cr0;
-
- if (unlikely(in_interrupt()))
- return __memcpy(to, from, len);
-@@ -39,44 +40,72 @@ void *_mmx_memcpy(void *to, const void *from, size_t len)
- kernel_fpu_begin();
-
- __asm__ __volatile__ (
-- "1: prefetch (%0)\n" /* This set is 28 bytes */
-- " prefetch 64(%0)\n"
-- " prefetch 128(%0)\n"
-- " prefetch 192(%0)\n"
-- " prefetch 256(%0)\n"
-+ "1: prefetch (%1)\n" /* This set is 28 bytes */
-+ " prefetch 64(%1)\n"
-+ " prefetch 128(%1)\n"
-+ " prefetch 192(%1)\n"
-+ " prefetch 256(%1)\n"
- "2: \n"
- ".section .fixup, \"ax\"\n"
-- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
-+ "3: \n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %%cr0, %0\n"
-+ " movl %0, %%eax\n"
-+ " andl $0xFFFEFFFF, %%eax\n"
-+ " movl %%eax, %%cr0\n"
-+#endif
-+
-+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %0, %%cr0\n"
-+#endif
-+
- " jmp 2b\n"
- ".previous\n"
- _ASM_EXTABLE(1b, 3b)
-- : : "r" (from));
-+ : "=&r" (cr0) : "r" (from) : "ax");
-
- for ( ; i > 5; i--) {
- __asm__ __volatile__ (
-- "1: prefetch 320(%0)\n"
-- "2: movq (%0), %%mm0\n"
-- " movq 8(%0), %%mm1\n"
-- " movq 16(%0), %%mm2\n"
-- " movq 24(%0), %%mm3\n"
-- " movq %%mm0, (%1)\n"
-- " movq %%mm1, 8(%1)\n"
-- " movq %%mm2, 16(%1)\n"
-- " movq %%mm3, 24(%1)\n"
-- " movq 32(%0), %%mm0\n"
-- " movq 40(%0), %%mm1\n"
-- " movq 48(%0), %%mm2\n"
-- " movq 56(%0), %%mm3\n"
-- " movq %%mm0, 32(%1)\n"
-- " movq %%mm1, 40(%1)\n"
-- " movq %%mm2, 48(%1)\n"
-- " movq %%mm3, 56(%1)\n"
-+ "1: prefetch 320(%1)\n"
-+ "2: movq (%1), %%mm0\n"
-+ " movq 8(%1), %%mm1\n"
-+ " movq 16(%1), %%mm2\n"
-+ " movq 24(%1), %%mm3\n"
-+ " movq %%mm0, (%2)\n"
-+ " movq %%mm1, 8(%2)\n"
-+ " movq %%mm2, 16(%2)\n"
-+ " movq %%mm3, 24(%2)\n"
-+ " movq 32(%1), %%mm0\n"
-+ " movq 40(%1), %%mm1\n"
-+ " movq 48(%1), %%mm2\n"
-+ " movq 56(%1), %%mm3\n"
-+ " movq %%mm0, 32(%2)\n"
-+ " movq %%mm1, 40(%2)\n"
-+ " movq %%mm2, 48(%2)\n"
-+ " movq %%mm3, 56(%2)\n"
- ".section .fixup, \"ax\"\n"
-- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
-+ "3:\n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %%cr0, %0\n"
-+ " movl %0, %%eax\n"
-+ " andl $0xFFFEFFFF, %%eax\n"
-+ " movl %%eax, %%cr0\n"
-+#endif
-+
-+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %0, %%cr0\n"
-+#endif
-+
- " jmp 2b\n"
- ".previous\n"
- _ASM_EXTABLE(1b, 3b)
-- : : "r" (from), "r" (to) : "memory");
-+ : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
-
- from += 64;
- to += 64;
-@@ -158,6 +187,7 @@ static void fast_clear_page(void *page)
- static void fast_copy_page(void *to, void *from)
- {
- int i;
-+ unsigned long cr0;
-
- kernel_fpu_begin();
-
-@@ -166,42 +196,70 @@ static void fast_copy_page(void *to, void *from)
- * but that is for later. -AV
- */
- __asm__ __volatile__(
-- "1: prefetch (%0)\n"
-- " prefetch 64(%0)\n"
-- " prefetch 128(%0)\n"
-- " prefetch 192(%0)\n"
-- " prefetch 256(%0)\n"
-+ "1: prefetch (%1)\n"
-+ " prefetch 64(%1)\n"
-+ " prefetch 128(%1)\n"
-+ " prefetch 192(%1)\n"
-+ " prefetch 256(%1)\n"
- "2: \n"
- ".section .fixup, \"ax\"\n"
-- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
-+ "3: \n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %%cr0, %0\n"
-+ " movl %0, %%eax\n"
-+ " andl $0xFFFEFFFF, %%eax\n"
-+ " movl %%eax, %%cr0\n"
-+#endif
-+
-+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %0, %%cr0\n"
-+#endif
-+
- " jmp 2b\n"
- ".previous\n"
-- _ASM_EXTABLE(1b, 3b) : : "r" (from));
-+ _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
-
- for (i = 0; i < (4096-320)/64; i++) {
- __asm__ __volatile__ (
-- "1: prefetch 320(%0)\n"
-- "2: movq (%0), %%mm0\n"
-- " movntq %%mm0, (%1)\n"
-- " movq 8(%0), %%mm1\n"
-- " movntq %%mm1, 8(%1)\n"
-- " movq 16(%0), %%mm2\n"
-- " movntq %%mm2, 16(%1)\n"
-- " movq 24(%0), %%mm3\n"
-- " movntq %%mm3, 24(%1)\n"
-- " movq 32(%0), %%mm4\n"
-- " movntq %%mm4, 32(%1)\n"
-- " movq 40(%0), %%mm5\n"
-- " movntq %%mm5, 40(%1)\n"
-- " movq 48(%0), %%mm6\n"
-- " movntq %%mm6, 48(%1)\n"
-- " movq 56(%0), %%mm7\n"
-- " movntq %%mm7, 56(%1)\n"
-+ "1: prefetch 320(%1)\n"
-+ "2: movq (%1), %%mm0\n"
-+ " movntq %%mm0, (%2)\n"
-+ " movq 8(%1), %%mm1\n"
-+ " movntq %%mm1, 8(%2)\n"
-+ " movq 16(%1), %%mm2\n"
-+ " movntq %%mm2, 16(%2)\n"
-+ " movq 24(%1), %%mm3\n"
-+ " movntq %%mm3, 24(%2)\n"
-+ " movq 32(%1), %%mm4\n"
-+ " movntq %%mm4, 32(%2)\n"
-+ " movq 40(%1), %%mm5\n"
-+ " movntq %%mm5, 40(%2)\n"
-+ " movq 48(%1), %%mm6\n"
-+ " movntq %%mm6, 48(%2)\n"
-+ " movq 56(%1), %%mm7\n"
-+ " movntq %%mm7, 56(%2)\n"
- ".section .fixup, \"ax\"\n"
-- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
-+ "3:\n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %%cr0, %0\n"
-+ " movl %0, %%eax\n"
-+ " andl $0xFFFEFFFF, %%eax\n"
-+ " movl %%eax, %%cr0\n"
-+#endif
-+
-+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %0, %%cr0\n"
-+#endif
-+
- " jmp 2b\n"
- ".previous\n"
-- _ASM_EXTABLE(1b, 3b) : : "r" (from), "r" (to) : "memory");
-+ _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
-
- from += 64;
- to += 64;
-@@ -280,47 +338,76 @@ static void fast_clear_page(void *page)
- static void fast_copy_page(void *to, void *from)
- {
- int i;
-+ unsigned long cr0;
-
- kernel_fpu_begin();
-
- __asm__ __volatile__ (
-- "1: prefetch (%0)\n"
-- " prefetch 64(%0)\n"
-- " prefetch 128(%0)\n"
-- " prefetch 192(%0)\n"
-- " prefetch 256(%0)\n"
-+ "1: prefetch (%1)\n"
-+ " prefetch 64(%1)\n"
-+ " prefetch 128(%1)\n"
-+ " prefetch 192(%1)\n"
-+ " prefetch 256(%1)\n"
- "2: \n"
- ".section .fixup, \"ax\"\n"
-- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
-+ "3: \n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %%cr0, %0\n"
-+ " movl %0, %%eax\n"
-+ " andl $0xFFFEFFFF, %%eax\n"
-+ " movl %%eax, %%cr0\n"
-+#endif
-+
-+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %0, %%cr0\n"
-+#endif
-+
- " jmp 2b\n"
- ".previous\n"
-- _ASM_EXTABLE(1b, 3b) : : "r" (from));
-+ _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
-
- for (i = 0; i < 4096/64; i++) {
- __asm__ __volatile__ (
-- "1: prefetch 320(%0)\n"
-- "2: movq (%0), %%mm0\n"
-- " movq 8(%0), %%mm1\n"
-- " movq 16(%0), %%mm2\n"
-- " movq 24(%0), %%mm3\n"
-- " movq %%mm0, (%1)\n"
-- " movq %%mm1, 8(%1)\n"
-- " movq %%mm2, 16(%1)\n"
-- " movq %%mm3, 24(%1)\n"
-- " movq 32(%0), %%mm0\n"
-- " movq 40(%0), %%mm1\n"
-- " movq 48(%0), %%mm2\n"
-- " movq 56(%0), %%mm3\n"
-- " movq %%mm0, 32(%1)\n"
-- " movq %%mm1, 40(%1)\n"
-- " movq %%mm2, 48(%1)\n"
-- " movq %%mm3, 56(%1)\n"
-+ "1: prefetch 320(%1)\n"
-+ "2: movq (%1), %%mm0\n"
-+ " movq 8(%1), %%mm1\n"
-+ " movq 16(%1), %%mm2\n"
-+ " movq 24(%1), %%mm3\n"
-+ " movq %%mm0, (%2)\n"
-+ " movq %%mm1, 8(%2)\n"
-+ " movq %%mm2, 16(%2)\n"
-+ " movq %%mm3, 24(%2)\n"
-+ " movq 32(%1), %%mm0\n"
-+ " movq 40(%1), %%mm1\n"
-+ " movq 48(%1), %%mm2\n"
-+ " movq 56(%1), %%mm3\n"
-+ " movq %%mm0, 32(%2)\n"
-+ " movq %%mm1, 40(%2)\n"
-+ " movq %%mm2, 48(%2)\n"
-+ " movq %%mm3, 56(%2)\n"
- ".section .fixup, \"ax\"\n"
-- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
-+ "3:\n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %%cr0, %0\n"
-+ " movl %0, %%eax\n"
-+ " andl $0xFFFEFFFF, %%eax\n"
-+ " movl %%eax, %%cr0\n"
-+#endif
-+
-+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %0, %%cr0\n"
-+#endif
-+
- " jmp 2b\n"
- ".previous\n"
- _ASM_EXTABLE(1b, 3b)
-- : : "r" (from), "r" (to) : "memory");
-+ : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
-
- from += 64;
- to += 64;
-diff --git a/arch/x86/lib/msr-reg.S b/arch/x86/lib/msr-reg.S
-index 69fa106..adda88b 100644
---- a/arch/x86/lib/msr-reg.S
-+++ b/arch/x86/lib/msr-reg.S
-@@ -3,6 +3,7 @@
- #include <asm/dwarf2.h>
- #include <asm/asm.h>
- #include <asm/msr.h>
-+#include <asm/alternative-asm.h>
-
- #ifdef CONFIG_X86_64
- /*
-@@ -16,7 +17,7 @@ ENTRY(native_\op\()_safe_regs)
- CFI_STARTPROC
- pushq_cfi %rbx
- pushq_cfi %rbp
-- movq %rdi, %r10 /* Save pointer */
-+ movq %rdi, %r9 /* Save pointer */
- xorl %r11d, %r11d /* Return value */
- movl (%rdi), %eax
- movl 4(%rdi), %ecx
-@@ -27,16 +28,17 @@ ENTRY(native_\op\()_safe_regs)
- movl 28(%rdi), %edi
- CFI_REMEMBER_STATE
- 1: \op
--2: movl %eax, (%r10)
-+2: movl %eax, (%r9)
- movl %r11d, %eax /* Return value */
-- movl %ecx, 4(%r10)
-- movl %edx, 8(%r10)
-- movl %ebx, 12(%r10)
-- movl %ebp, 20(%r10)
-- movl %esi, 24(%r10)
-- movl %edi, 28(%r10)
-+ movl %ecx, 4(%r9)
-+ movl %edx, 8(%r9)
-+ movl %ebx, 12(%r9)
-+ movl %ebp, 20(%r9)
-+ movl %esi, 24(%r9)
-+ movl %edi, 28(%r9)
- popq_cfi %rbp
- popq_cfi %rbx
-+ pax_force_retaddr
- ret
- 3:
- CFI_RESTORE_STATE
-diff --git a/arch/x86/lib/putuser.S b/arch/x86/lib/putuser.S
-index 36b0d15..d381858 100644
---- a/arch/x86/lib/putuser.S
-+++ b/arch/x86/lib/putuser.S
-@@ -15,7 +15,9 @@
- #include <asm/thread_info.h>
- #include <asm/errno.h>
- #include <asm/asm.h>
--
-+#include <asm/segment.h>
-+#include <asm/pgtable.h>
-+#include <asm/alternative-asm.h>
-
- /*
- * __put_user_X
-@@ -29,52 +31,119 @@
- * as they get called from within inline assembly.
- */
-
--#define ENTER CFI_STARTPROC ; \
-- GET_THREAD_INFO(%_ASM_BX)
--#define EXIT ret ; \
-+#define ENTER CFI_STARTPROC
-+#define EXIT pax_force_retaddr; ret ; \
- CFI_ENDPROC
-
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+#define _DEST %_ASM_CX,%_ASM_BX
-+#else
-+#define _DEST %_ASM_CX
-+#endif
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+#define __copyuser_seg gs;
-+#else
-+#define __copyuser_seg
-+#endif
-+
- .text
- ENTRY(__put_user_1)
- ENTER
-+
-+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
-+ GET_THREAD_INFO(%_ASM_BX)
- cmp TI_addr_limit(%_ASM_BX),%_ASM_CX
- jae bad_put_user
--1: movb %al,(%_ASM_CX)
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
-+ cmp %_ASM_BX,%_ASM_CX
-+ jb 1234f
-+ xor %ebx,%ebx
-+1234:
-+#endif
-+
-+#endif
-+
-+1: __copyuser_seg movb %al,(_DEST)
- xor %eax,%eax
- EXIT
- ENDPROC(__put_user_1)
-
- ENTRY(__put_user_2)
- ENTER
-+
-+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
-+ GET_THREAD_INFO(%_ASM_BX)
- mov TI_addr_limit(%_ASM_BX),%_ASM_BX
- sub $1,%_ASM_BX
- cmp %_ASM_BX,%_ASM_CX
- jae bad_put_user
--2: movw %ax,(%_ASM_CX)
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
-+ cmp %_ASM_BX,%_ASM_CX
-+ jb 1234f
-+ xor %ebx,%ebx
-+1234:
-+#endif
-+
-+#endif
-+
-+2: __copyuser_seg movw %ax,(_DEST)
- xor %eax,%eax
- EXIT
- ENDPROC(__put_user_2)
-
- ENTRY(__put_user_4)
- ENTER
-+
-+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
-+ GET_THREAD_INFO(%_ASM_BX)
- mov TI_addr_limit(%_ASM_BX),%_ASM_BX
- sub $3,%_ASM_BX
- cmp %_ASM_BX,%_ASM_CX
- jae bad_put_user
--3: movl %eax,(%_ASM_CX)
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
-+ cmp %_ASM_BX,%_ASM_CX
-+ jb 1234f
-+ xor %ebx,%ebx
-+1234:
-+#endif
-+
-+#endif
-+
-+3: __copyuser_seg movl %eax,(_DEST)
- xor %eax,%eax
- EXIT
- ENDPROC(__put_user_4)
-
- ENTRY(__put_user_8)
- ENTER
-+
-+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
-+ GET_THREAD_INFO(%_ASM_BX)
- mov TI_addr_limit(%_ASM_BX),%_ASM_BX
- sub $7,%_ASM_BX
- cmp %_ASM_BX,%_ASM_CX
- jae bad_put_user
--4: mov %_ASM_AX,(%_ASM_CX)
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
-+ cmp %_ASM_BX,%_ASM_CX
-+ jb 1234f
-+ xor %ebx,%ebx
-+1234:
-+#endif
-+
-+#endif
-+
-+4: __copyuser_seg mov %_ASM_AX,(_DEST)
- #ifdef CONFIG_X86_32
--5: movl %edx,4(%_ASM_CX)
-+5: __copyuser_seg movl %edx,4(_DEST)
- #endif
- xor %eax,%eax
- EXIT
-diff --git a/arch/x86/lib/rwlock_64.S b/arch/x86/lib/rwlock_64.S
-index 05ea55f..6345b9a 100644
---- a/arch/x86/lib/rwlock_64.S
-+++ b/arch/x86/lib/rwlock_64.S
-@@ -2,6 +2,7 @@
-
- #include <linux/linkage.h>
- #include <asm/rwlock.h>
-+#include <asm/asm.h>
- #include <asm/alternative-asm.h>
- #include <asm/dwarf2.h>
-
-@@ -10,13 +11,34 @@ ENTRY(__write_lock_failed)
- CFI_STARTPROC
- LOCK_PREFIX
- addl $RW_LOCK_BIAS,(%rdi)
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ jno 1234f
-+ LOCK_PREFIX
-+ subl $RW_LOCK_BIAS,(%rdi)
-+ int $4
-+1234:
-+ _ASM_EXTABLE(1234b, 1234b)
-+#endif
-+
- 1: rep
- nop
- cmpl $RW_LOCK_BIAS,(%rdi)
- jne 1b
- LOCK_PREFIX
- subl $RW_LOCK_BIAS,(%rdi)
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ jno 1234f
-+ LOCK_PREFIX
-+ addl $RW_LOCK_BIAS,(%rdi)
-+ int $4
-+1234:
-+ _ASM_EXTABLE(1234b, 1234b)
-+#endif
-+
- jnz __write_lock_failed
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
- END(__write_lock_failed)
-@@ -26,13 +48,34 @@ ENTRY(__read_lock_failed)
- CFI_STARTPROC
- LOCK_PREFIX
- incl (%rdi)
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ jno 1234f
-+ LOCK_PREFIX
-+ decl (%rdi)
-+ int $4
-+1234:
-+ _ASM_EXTABLE(1234b, 1234b)
-+#endif
-+
- 1: rep
- nop
- cmpl $1,(%rdi)
- js 1b
- LOCK_PREFIX
- decl (%rdi)
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ jno 1234f
-+ LOCK_PREFIX
-+ incl (%rdi)
-+ int $4
-+1234:
-+ _ASM_EXTABLE(1234b, 1234b)
-+#endif
-+
- js __read_lock_failed
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
- END(__read_lock_failed)
-diff --git a/arch/x86/lib/rwsem_64.S b/arch/x86/lib/rwsem_64.S
-index 15acecf..f768b10 100644
---- a/arch/x86/lib/rwsem_64.S
-+++ b/arch/x86/lib/rwsem_64.S
-@@ -48,6 +48,7 @@ ENTRY(call_rwsem_down_read_failed)
- call rwsem_down_read_failed
- popq %rdx
- restore_common_regs
-+ pax_force_retaddr
- ret
- ENDPROC(call_rwsem_down_read_failed)
-
-@@ -56,6 +57,7 @@ ENTRY(call_rwsem_down_write_failed)
- movq %rax,%rdi
- call rwsem_down_write_failed
- restore_common_regs
-+ pax_force_retaddr
- ret
- ENDPROC(call_rwsem_down_write_failed)
-
-@@ -66,7 +68,8 @@ ENTRY(call_rwsem_wake)
- movq %rax,%rdi
- call rwsem_wake
- restore_common_regs
--1: ret
-+1: pax_force_retaddr
-+ ret
- ENDPROC(call_rwsem_wake)
-
- /* Fix up special calling conventions */
-@@ -77,5 +80,6 @@ ENTRY(call_rwsem_downgrade_wake)
- call rwsem_downgrade_wake
- popq %rdx
- restore_common_regs
-+ pax_force_retaddr
- ret
- ENDPROC(call_rwsem_downgrade_wake)
-diff --git a/arch/x86/lib/thunk_64.S b/arch/x86/lib/thunk_64.S
-index bf9a7d5..fb06ab5 100644
---- a/arch/x86/lib/thunk_64.S
-+++ b/arch/x86/lib/thunk_64.S
-@@ -10,7 +10,8 @@
- #include <asm/dwarf2.h>
- #include <asm/calling.h>
- #include <asm/rwlock.h>
--
-+ #include <asm/alternative-asm.h>
-+
- /* rdi: arg1 ... normal C conventions. rax is saved/restored. */
- .macro thunk name,func
- .globl \name
-@@ -70,6 +71,7 @@
- SAVE_ARGS
- restore:
- RESTORE_ARGS
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
-
-@@ -77,5 +79,6 @@ restore:
- SAVE_ARGS
- restore_norax:
- RESTORE_ARGS 1
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
-diff --git a/arch/x86/lib/usercopy_32.c b/arch/x86/lib/usercopy_32.c
-index 1f118d4..7d522b8 100644
---- a/arch/x86/lib/usercopy_32.c
-+++ b/arch/x86/lib/usercopy_32.c
-@@ -43,7 +43,7 @@ do { \
- __asm__ __volatile__( \
- " testl %1,%1\n" \
- " jz 2f\n" \
-- "0: lodsb\n" \
-+ "0: "__copyuser_seg"lodsb\n" \
- " stosb\n" \
- " testb %%al,%%al\n" \
- " jz 1f\n" \
-@@ -128,10 +128,12 @@ do { \
- int __d0; \
- might_fault(); \
- __asm__ __volatile__( \
-+ __COPYUSER_SET_ES \
- "0: rep; stosl\n" \
- " movl %2,%0\n" \
- "1: rep; stosb\n" \
- "2:\n" \
-+ __COPYUSER_RESTORE_ES \
- ".section .fixup,\"ax\"\n" \
- "3: lea 0(%2,%0,4),%0\n" \
- " jmp 2b\n" \
-@@ -200,6 +202,7 @@ long strnlen_user(const char __user *s, long n)
- might_fault();
-
- __asm__ __volatile__(
-+ __COPYUSER_SET_ES
- " testl %0, %0\n"
- " jz 3f\n"
- " andl %0,%%ecx\n"
-@@ -208,6 +211,7 @@ long strnlen_user(const char __user *s, long n)
- " subl %%ecx,%0\n"
- " addl %0,%%eax\n"
- "1:\n"
-+ __COPYUSER_RESTORE_ES
- ".section .fixup,\"ax\"\n"
- "2: xorl %%eax,%%eax\n"
- " jmp 1b\n"
-@@ -227,7 +231,7 @@ EXPORT_SYMBOL(strnlen_user);
-
- #ifdef CONFIG_X86_INTEL_USERCOPY
- static unsigned long
--__copy_user_intel(void __user *to, const void *from, unsigned long size)
-+__generic_copy_to_user_intel(void __user *to, const void *from, unsigned long size)
- {
- int d0, d1;
- __asm__ __volatile__(
-@@ -239,36 +243,36 @@ __copy_user_intel(void __user *to, const void *from, unsigned long size)
- " .align 2,0x90\n"
- "3: movl 0(%4), %%eax\n"
- "4: movl 4(%4), %%edx\n"
-- "5: movl %%eax, 0(%3)\n"
-- "6: movl %%edx, 4(%3)\n"
-+ "5: "__copyuser_seg" movl %%eax, 0(%3)\n"
-+ "6: "__copyuser_seg" movl %%edx, 4(%3)\n"
- "7: movl 8(%4), %%eax\n"
- "8: movl 12(%4),%%edx\n"
-- "9: movl %%eax, 8(%3)\n"
-- "10: movl %%edx, 12(%3)\n"
-+ "9: "__copyuser_seg" movl %%eax, 8(%3)\n"
-+ "10: "__copyuser_seg" movl %%edx, 12(%3)\n"
- "11: movl 16(%4), %%eax\n"
- "12: movl 20(%4), %%edx\n"
-- "13: movl %%eax, 16(%3)\n"
-- "14: movl %%edx, 20(%3)\n"
-+ "13: "__copyuser_seg" movl %%eax, 16(%3)\n"
-+ "14: "__copyuser_seg" movl %%edx, 20(%3)\n"
- "15: movl 24(%4), %%eax\n"
- "16: movl 28(%4), %%edx\n"
-- "17: movl %%eax, 24(%3)\n"
-- "18: movl %%edx, 28(%3)\n"
-+ "17: "__copyuser_seg" movl %%eax, 24(%3)\n"
-+ "18: "__copyuser_seg" movl %%edx, 28(%3)\n"
- "19: movl 32(%4), %%eax\n"
- "20: movl 36(%4), %%edx\n"
-- "21: movl %%eax, 32(%3)\n"
-- "22: movl %%edx, 36(%3)\n"
-+ "21: "__copyuser_seg" movl %%eax, 32(%3)\n"
-+ "22: "__copyuser_seg" movl %%edx, 36(%3)\n"
- "23: movl 40(%4), %%eax\n"
- "24: movl 44(%4), %%edx\n"
-- "25: movl %%eax, 40(%3)\n"
-- "26: movl %%edx, 44(%3)\n"
-+ "25: "__copyuser_seg" movl %%eax, 40(%3)\n"
-+ "26: "__copyuser_seg" movl %%edx, 44(%3)\n"
- "27: movl 48(%4), %%eax\n"
- "28: movl 52(%4), %%edx\n"
-- "29: movl %%eax, 48(%3)\n"
-- "30: movl %%edx, 52(%3)\n"
-+ "29: "__copyuser_seg" movl %%eax, 48(%3)\n"
-+ "30: "__copyuser_seg" movl %%edx, 52(%3)\n"
- "31: movl 56(%4), %%eax\n"
- "32: movl 60(%4), %%edx\n"
-- "33: movl %%eax, 56(%3)\n"
-- "34: movl %%edx, 60(%3)\n"
-+ "33: "__copyuser_seg" movl %%eax, 56(%3)\n"
-+ "34: "__copyuser_seg" movl %%edx, 60(%3)\n"
- " addl $-64, %0\n"
- " addl $64, %4\n"
- " addl $64, %3\n"
-@@ -278,10 +282,12 @@ __copy_user_intel(void __user *to, const void *from, unsigned long size)
- " shrl $2, %0\n"
- " andl $3, %%eax\n"
- " cld\n"
-+ __COPYUSER_SET_ES
- "99: rep; movsl\n"
- "36: movl %%eax, %0\n"
- "37: rep; movsb\n"
- "100:\n"
-+ __COPYUSER_RESTORE_ES
- ".section .fixup,\"ax\"\n"
- "101: lea 0(%%eax,%0,4),%0\n"
- " jmp 100b\n"
-@@ -334,46 +340,153 @@ __copy_user_intel(void __user *to, const void *from, unsigned long size)
- }
-
- static unsigned long
-+__generic_copy_from_user_intel(void *to, const void __user *from, unsigned long size)
-+{
-+ int d0, d1;
-+ __asm__ __volatile__(
-+ " .align 2,0x90\n"
-+ "1: "__copyuser_seg" movl 32(%4), %%eax\n"
-+ " cmpl $67, %0\n"
-+ " jbe 3f\n"
-+ "2: "__copyuser_seg" movl 64(%4), %%eax\n"
-+ " .align 2,0x90\n"
-+ "3: "__copyuser_seg" movl 0(%4), %%eax\n"
-+ "4: "__copyuser_seg" movl 4(%4), %%edx\n"
-+ "5: movl %%eax, 0(%3)\n"
-+ "6: movl %%edx, 4(%3)\n"
-+ "7: "__copyuser_seg" movl 8(%4), %%eax\n"
-+ "8: "__copyuser_seg" movl 12(%4),%%edx\n"
-+ "9: movl %%eax, 8(%3)\n"
-+ "10: movl %%edx, 12(%3)\n"
-+ "11: "__copyuser_seg" movl 16(%4), %%eax\n"
-+ "12: "__copyuser_seg" movl 20(%4), %%edx\n"
-+ "13: movl %%eax, 16(%3)\n"
-+ "14: movl %%edx, 20(%3)\n"
-+ "15: "__copyuser_seg" movl 24(%4), %%eax\n"
-+ "16: "__copyuser_seg" movl 28(%4), %%edx\n"
-+ "17: movl %%eax, 24(%3)\n"
-+ "18: movl %%edx, 28(%3)\n"
-+ "19: "__copyuser_seg" movl 32(%4), %%eax\n"
-+ "20: "__copyuser_seg" movl 36(%4), %%edx\n"
-+ "21: movl %%eax, 32(%3)\n"
-+ "22: movl %%edx, 36(%3)\n"
-+ "23: "__copyuser_seg" movl 40(%4), %%eax\n"
-+ "24: "__copyuser_seg" movl 44(%4), %%edx\n"
-+ "25: movl %%eax, 40(%3)\n"
-+ "26: movl %%edx, 44(%3)\n"
-+ "27: "__copyuser_seg" movl 48(%4), %%eax\n"
-+ "28: "__copyuser_seg" movl 52(%4), %%edx\n"
-+ "29: movl %%eax, 48(%3)\n"
-+ "30: movl %%edx, 52(%3)\n"
-+ "31: "__copyuser_seg" movl 56(%4), %%eax\n"
-+ "32: "__copyuser_seg" movl 60(%4), %%edx\n"
-+ "33: movl %%eax, 56(%3)\n"
-+ "34: movl %%edx, 60(%3)\n"
-+ " addl $-64, %0\n"
-+ " addl $64, %4\n"
-+ " addl $64, %3\n"
-+ " cmpl $63, %0\n"
-+ " ja 1b\n"
-+ "35: movl %0, %%eax\n"
-+ " shrl $2, %0\n"
-+ " andl $3, %%eax\n"
-+ " cld\n"
-+ "99: rep; "__copyuser_seg" movsl\n"
-+ "36: movl %%eax, %0\n"
-+ "37: rep; "__copyuser_seg" movsb\n"
-+ "100:\n"
-+ ".section .fixup,\"ax\"\n"
-+ "101: lea 0(%%eax,%0,4),%0\n"
-+ " jmp 100b\n"
-+ ".previous\n"
-+ ".section __ex_table,\"a\"\n"
-+ " .align 4\n"
-+ " .long 1b,100b\n"
-+ " .long 2b,100b\n"
-+ " .long 3b,100b\n"
-+ " .long 4b,100b\n"
-+ " .long 5b,100b\n"
-+ " .long 6b,100b\n"
-+ " .long 7b,100b\n"
-+ " .long 8b,100b\n"
-+ " .long 9b,100b\n"
-+ " .long 10b,100b\n"
-+ " .long 11b,100b\n"
-+ " .long 12b,100b\n"
-+ " .long 13b,100b\n"
-+ " .long 14b,100b\n"
-+ " .long 15b,100b\n"
-+ " .long 16b,100b\n"
-+ " .long 17b,100b\n"
-+ " .long 18b,100b\n"
-+ " .long 19b,100b\n"
-+ " .long 20b,100b\n"
-+ " .long 21b,100b\n"
-+ " .long 22b,100b\n"
-+ " .long 23b,100b\n"
-+ " .long 24b,100b\n"
-+ " .long 25b,100b\n"
-+ " .long 26b,100b\n"
-+ " .long 27b,100b\n"
-+ " .long 28b,100b\n"
-+ " .long 29b,100b\n"
-+ " .long 30b,100b\n"
-+ " .long 31b,100b\n"
-+ " .long 32b,100b\n"
-+ " .long 33b,100b\n"
-+ " .long 34b,100b\n"
-+ " .long 35b,100b\n"
-+ " .long 36b,100b\n"
-+ " .long 37b,100b\n"
-+ " .long 99b,101b\n"
-+ ".previous"
-+ : "=&c"(size), "=&D" (d0), "=&S" (d1)
-+ : "1"(to), "2"(from), "0"(size)
-+ : "eax", "edx", "memory");
-+ return size;
-+}
-+
-+static unsigned long __size_overflow(3)
- __copy_user_zeroing_intel(void *to, const void __user *from, unsigned long size)
- {
- int d0, d1;
- __asm__ __volatile__(
- " .align 2,0x90\n"
-- "0: movl 32(%4), %%eax\n"
-+ "0: "__copyuser_seg" movl 32(%4), %%eax\n"
- " cmpl $67, %0\n"
- " jbe 2f\n"
-- "1: movl 64(%4), %%eax\n"
-+ "1: "__copyuser_seg" movl 64(%4), %%eax\n"
- " .align 2,0x90\n"
-- "2: movl 0(%4), %%eax\n"
-- "21: movl 4(%4), %%edx\n"
-+ "2: "__copyuser_seg" movl 0(%4), %%eax\n"
-+ "21: "__copyuser_seg" movl 4(%4), %%edx\n"
- " movl %%eax, 0(%3)\n"
- " movl %%edx, 4(%3)\n"
-- "3: movl 8(%4), %%eax\n"
-- "31: movl 12(%4),%%edx\n"
-+ "3: "__copyuser_seg" movl 8(%4), %%eax\n"
-+ "31: "__copyuser_seg" movl 12(%4),%%edx\n"
- " movl %%eax, 8(%3)\n"
- " movl %%edx, 12(%3)\n"
-- "4: movl 16(%4), %%eax\n"
-- "41: movl 20(%4), %%edx\n"
-+ "4: "__copyuser_seg" movl 16(%4), %%eax\n"
-+ "41: "__copyuser_seg" movl 20(%4), %%edx\n"
- " movl %%eax, 16(%3)\n"
- " movl %%edx, 20(%3)\n"
-- "10: movl 24(%4), %%eax\n"
-- "51: movl 28(%4), %%edx\n"
-+ "10: "__copyuser_seg" movl 24(%4), %%eax\n"
-+ "51: "__copyuser_seg" movl 28(%4), %%edx\n"
- " movl %%eax, 24(%3)\n"
- " movl %%edx, 28(%3)\n"
-- "11: movl 32(%4), %%eax\n"
-- "61: movl 36(%4), %%edx\n"
-+ "11: "__copyuser_seg" movl 32(%4), %%eax\n"
-+ "61: "__copyuser_seg" movl 36(%4), %%edx\n"
- " movl %%eax, 32(%3)\n"
- " movl %%edx, 36(%3)\n"
-- "12: movl 40(%4), %%eax\n"
-- "71: movl 44(%4), %%edx\n"
-+ "12: "__copyuser_seg" movl 40(%4), %%eax\n"
-+ "71: "__copyuser_seg" movl 44(%4), %%edx\n"
- " movl %%eax, 40(%3)\n"
- " movl %%edx, 44(%3)\n"
-- "13: movl 48(%4), %%eax\n"
-- "81: movl 52(%4), %%edx\n"
-+ "13: "__copyuser_seg" movl 48(%4), %%eax\n"
-+ "81: "__copyuser_seg" movl 52(%4), %%edx\n"
- " movl %%eax, 48(%3)\n"
- " movl %%edx, 52(%3)\n"
-- "14: movl 56(%4), %%eax\n"
-- "91: movl 60(%4), %%edx\n"
-+ "14: "__copyuser_seg" movl 56(%4), %%eax\n"
-+ "91: "__copyuser_seg" movl 60(%4), %%edx\n"
- " movl %%eax, 56(%3)\n"
- " movl %%edx, 60(%3)\n"
- " addl $-64, %0\n"
-@@ -385,9 +498,9 @@ __copy_user_zeroing_intel(void *to, const void __user *from, unsigned long size)
- " shrl $2, %0\n"
- " andl $3, %%eax\n"
- " cld\n"
-- "6: rep; movsl\n"
-+ "6: rep; "__copyuser_seg" movsl\n"
- " movl %%eax,%0\n"
-- "7: rep; movsb\n"
-+ "7: rep; "__copyuser_seg" movsb\n"
- "8:\n"
- ".section .fixup,\"ax\"\n"
- "9: lea 0(%%eax,%0,4),%0\n"
-@@ -433,48 +546,48 @@ __copy_user_zeroing_intel(void *to, const void __user *from, unsigned long size)
- * hyoshiok@miraclelinux.com
- */
-
--static unsigned long __copy_user_zeroing_intel_nocache(void *to,
-+static unsigned long __size_overflow(3) __copy_user_zeroing_intel_nocache(void *to,
- const void __user *from, unsigned long size)
- {
- int d0, d1;
-
- __asm__ __volatile__(
- " .align 2,0x90\n"
-- "0: movl 32(%4), %%eax\n"
-+ "0: "__copyuser_seg" movl 32(%4), %%eax\n"
- " cmpl $67, %0\n"
- " jbe 2f\n"
-- "1: movl 64(%4), %%eax\n"
-+ "1: "__copyuser_seg" movl 64(%4), %%eax\n"
- " .align 2,0x90\n"
-- "2: movl 0(%4), %%eax\n"
-- "21: movl 4(%4), %%edx\n"
-+ "2: "__copyuser_seg" movl 0(%4), %%eax\n"
-+ "21: "__copyuser_seg" movl 4(%4), %%edx\n"
- " movnti %%eax, 0(%3)\n"
- " movnti %%edx, 4(%3)\n"
-- "3: movl 8(%4), %%eax\n"
-- "31: movl 12(%4),%%edx\n"
-+ "3: "__copyuser_seg" movl 8(%4), %%eax\n"
-+ "31: "__copyuser_seg" movl 12(%4),%%edx\n"
- " movnti %%eax, 8(%3)\n"
- " movnti %%edx, 12(%3)\n"
-- "4: movl 16(%4), %%eax\n"
-- "41: movl 20(%4), %%edx\n"
-+ "4: "__copyuser_seg" movl 16(%4), %%eax\n"
-+ "41: "__copyuser_seg" movl 20(%4), %%edx\n"
- " movnti %%eax, 16(%3)\n"
- " movnti %%edx, 20(%3)\n"
-- "10: movl 24(%4), %%eax\n"
-- "51: movl 28(%4), %%edx\n"
-+ "10: "__copyuser_seg" movl 24(%4), %%eax\n"
-+ "51: "__copyuser_seg" movl 28(%4), %%edx\n"
- " movnti %%eax, 24(%3)\n"
- " movnti %%edx, 28(%3)\n"
-- "11: movl 32(%4), %%eax\n"
-- "61: movl 36(%4), %%edx\n"
-+ "11: "__copyuser_seg" movl 32(%4), %%eax\n"
-+ "61: "__copyuser_seg" movl 36(%4), %%edx\n"
- " movnti %%eax, 32(%3)\n"
- " movnti %%edx, 36(%3)\n"
-- "12: movl 40(%4), %%eax\n"
-- "71: movl 44(%4), %%edx\n"
-+ "12: "__copyuser_seg" movl 40(%4), %%eax\n"
-+ "71: "__copyuser_seg" movl 44(%4), %%edx\n"
- " movnti %%eax, 40(%3)\n"
- " movnti %%edx, 44(%3)\n"
-- "13: movl 48(%4), %%eax\n"
-- "81: movl 52(%4), %%edx\n"
-+ "13: "__copyuser_seg" movl 48(%4), %%eax\n"
-+ "81: "__copyuser_seg" movl 52(%4), %%edx\n"
- " movnti %%eax, 48(%3)\n"
- " movnti %%edx, 52(%3)\n"
-- "14: movl 56(%4), %%eax\n"
-- "91: movl 60(%4), %%edx\n"
-+ "14: "__copyuser_seg" movl 56(%4), %%eax\n"
-+ "91: "__copyuser_seg" movl 60(%4), %%edx\n"
- " movnti %%eax, 56(%3)\n"
- " movnti %%edx, 60(%3)\n"
- " addl $-64, %0\n"
-@@ -487,9 +600,9 @@ static unsigned long __copy_user_zeroing_intel_nocache(void *to,
- " shrl $2, %0\n"
- " andl $3, %%eax\n"
- " cld\n"
-- "6: rep; movsl\n"
-+ "6: rep; "__copyuser_seg" movsl\n"
- " movl %%eax,%0\n"
-- "7: rep; movsb\n"
-+ "7: rep; "__copyuser_seg" movsb\n"
- "8:\n"
- ".section .fixup,\"ax\"\n"
- "9: lea 0(%%eax,%0,4),%0\n"
-@@ -530,48 +643,48 @@ static unsigned long __copy_user_zeroing_intel_nocache(void *to,
- return size;
- }
-
--static unsigned long __copy_user_intel_nocache(void *to,
-+static unsigned long __size_overflow(3) __copy_user_intel_nocache(void *to,
- const void __user *from, unsigned long size)
- {
- int d0, d1;
-
- __asm__ __volatile__(
- " .align 2,0x90\n"
-- "0: movl 32(%4), %%eax\n"
-+ "0: "__copyuser_seg" movl 32(%4), %%eax\n"
- " cmpl $67, %0\n"
- " jbe 2f\n"
-- "1: movl 64(%4), %%eax\n"
-+ "1: "__copyuser_seg" movl 64(%4), %%eax\n"
- " .align 2,0x90\n"
-- "2: movl 0(%4), %%eax\n"
-- "21: movl 4(%4), %%edx\n"
-+ "2: "__copyuser_seg" movl 0(%4), %%eax\n"
-+ "21: "__copyuser_seg" movl 4(%4), %%edx\n"
- " movnti %%eax, 0(%3)\n"
- " movnti %%edx, 4(%3)\n"
-- "3: movl 8(%4), %%eax\n"
-- "31: movl 12(%4),%%edx\n"
-+ "3: "__copyuser_seg" movl 8(%4), %%eax\n"
-+ "31: "__copyuser_seg" movl 12(%4),%%edx\n"
- " movnti %%eax, 8(%3)\n"
- " movnti %%edx, 12(%3)\n"
-- "4: movl 16(%4), %%eax\n"
-- "41: movl 20(%4), %%edx\n"
-+ "4: "__copyuser_seg" movl 16(%4), %%eax\n"
-+ "41: "__copyuser_seg" movl 20(%4), %%edx\n"
- " movnti %%eax, 16(%3)\n"
- " movnti %%edx, 20(%3)\n"
-- "10: movl 24(%4), %%eax\n"
-- "51: movl 28(%4), %%edx\n"
-+ "10: "__copyuser_seg" movl 24(%4), %%eax\n"
-+ "51: "__copyuser_seg" movl 28(%4), %%edx\n"
- " movnti %%eax, 24(%3)\n"
- " movnti %%edx, 28(%3)\n"
-- "11: movl 32(%4), %%eax\n"
-- "61: movl 36(%4), %%edx\n"
-+ "11: "__copyuser_seg" movl 32(%4), %%eax\n"
-+ "61: "__copyuser_seg" movl 36(%4), %%edx\n"
- " movnti %%eax, 32(%3)\n"
- " movnti %%edx, 36(%3)\n"
-- "12: movl 40(%4), %%eax\n"
-- "71: movl 44(%4), %%edx\n"
-+ "12: "__copyuser_seg" movl 40(%4), %%eax\n"
-+ "71: "__copyuser_seg" movl 44(%4), %%edx\n"
- " movnti %%eax, 40(%3)\n"
- " movnti %%edx, 44(%3)\n"
-- "13: movl 48(%4), %%eax\n"
-- "81: movl 52(%4), %%edx\n"
-+ "13: "__copyuser_seg" movl 48(%4), %%eax\n"
-+ "81: "__copyuser_seg" movl 52(%4), %%edx\n"
- " movnti %%eax, 48(%3)\n"
- " movnti %%edx, 52(%3)\n"
-- "14: movl 56(%4), %%eax\n"
-- "91: movl 60(%4), %%edx\n"
-+ "14: "__copyuser_seg" movl 56(%4), %%eax\n"
-+ "91: "__copyuser_seg" movl 60(%4), %%edx\n"
- " movnti %%eax, 56(%3)\n"
- " movnti %%edx, 60(%3)\n"
- " addl $-64, %0\n"
-@@ -584,9 +697,9 @@ static unsigned long __copy_user_intel_nocache(void *to,
- " shrl $2, %0\n"
- " andl $3, %%eax\n"
- " cld\n"
-- "6: rep; movsl\n"
-+ "6: rep; "__copyuser_seg" movsl\n"
- " movl %%eax,%0\n"
-- "7: rep; movsb\n"
-+ "7: rep; "__copyuser_seg" movsb\n"
- "8:\n"
- ".section .fixup,\"ax\"\n"
- "9: lea 0(%%eax,%0,4),%0\n"
-@@ -629,32 +742,36 @@ static unsigned long __copy_user_intel_nocache(void *to,
- */
- unsigned long __copy_user_zeroing_intel(void *to, const void __user *from,
- unsigned long size);
--unsigned long __copy_user_intel(void __user *to, const void *from,
-+unsigned long __generic_copy_to_user_intel(void __user *to, const void *from,
-+ unsigned long size);
-+unsigned long __generic_copy_from_user_intel(void *to, const void __user *from,
- unsigned long size);
- unsigned long __copy_user_zeroing_intel_nocache(void *to,
- const void __user *from, unsigned long size);
- #endif /* CONFIG_X86_INTEL_USERCOPY */
-
- /* Generic arbitrary sized copy. */
--#define __copy_user(to, from, size) \
-+#define __copy_user(to, from, size, prefix, set, restore) \
- do { \
- int __d0, __d1, __d2; \
- __asm__ __volatile__( \
-+ set \
- " cmp $7,%0\n" \
- " jbe 1f\n" \
- " movl %1,%0\n" \
- " negl %0\n" \
- " andl $7,%0\n" \
- " subl %0,%3\n" \
-- "4: rep; movsb\n" \
-+ "4: rep; "prefix"movsb\n" \
- " movl %3,%0\n" \
- " shrl $2,%0\n" \
- " andl $3,%3\n" \
- " .align 2,0x90\n" \
-- "0: rep; movsl\n" \
-+ "0: rep; "prefix"movsl\n" \
- " movl %3,%0\n" \
-- "1: rep; movsb\n" \
-+ "1: rep; "prefix"movsb\n" \
- "2:\n" \
-+ restore \
- ".section .fixup,\"ax\"\n" \
- "5: addl %3,%0\n" \
- " jmp 2b\n" \
-@@ -682,14 +799,14 @@ do { \
- " negl %0\n" \
- " andl $7,%0\n" \
- " subl %0,%3\n" \
-- "4: rep; movsb\n" \
-+ "4: rep; "__copyuser_seg"movsb\n" \
- " movl %3,%0\n" \
- " shrl $2,%0\n" \
- " andl $3,%3\n" \
- " .align 2,0x90\n" \
-- "0: rep; movsl\n" \
-+ "0: rep; "__copyuser_seg"movsl\n" \
- " movl %3,%0\n" \
-- "1: rep; movsb\n" \
-+ "1: rep; "__copyuser_seg"movsb\n" \
- "2:\n" \
- ".section .fixup,\"ax\"\n" \
- "5: addl %3,%0\n" \
-@@ -775,9 +892,9 @@ survive:
- }
- #endif
- if (movsl_is_ok(to, from, n))
-- __copy_user(to, from, n);
-+ __copy_user(to, from, n, "", __COPYUSER_SET_ES, __COPYUSER_RESTORE_ES);
- else
-- n = __copy_user_intel(to, from, n);
-+ n = __generic_copy_to_user_intel(to, from, n);
- return n;
- }
- EXPORT_SYMBOL(__copy_to_user_ll);
-@@ -797,10 +914,9 @@ unsigned long __copy_from_user_ll_nozero(void *to, const void __user *from,
- unsigned long n)
- {
- if (movsl_is_ok(to, from, n))
-- __copy_user(to, from, n);
-+ __copy_user(to, from, n, __copyuser_seg, "", "");
- else
-- n = __copy_user_intel((void __user *)to,
-- (const void *)from, n);
-+ n = __generic_copy_from_user_intel(to, from, n);
- return n;
- }
- EXPORT_SYMBOL(__copy_from_user_ll_nozero);
-@@ -827,59 +943,50 @@ unsigned long __copy_from_user_ll_nocache_nozero(void *to, const void __user *fr
- if (n > 64 && cpu_has_xmm2)
- n = __copy_user_intel_nocache(to, from, n);
- else
-- __copy_user(to, from, n);
-+ __copy_user(to, from, n, __copyuser_seg, "", "");
- #else
-- __copy_user(to, from, n);
-+ __copy_user(to, from, n, __copyuser_seg, "", "");
- #endif
- return n;
- }
- EXPORT_SYMBOL(__copy_from_user_ll_nocache_nozero);
-
--/**
-- * copy_to_user: - Copy a block of data into user space.
-- * @to: Destination address, in user space.
-- * @from: Source address, in kernel space.
-- * @n: Number of bytes to copy.
-- *
-- * Context: User context only. This function may sleep.
-- *
-- * Copy data from kernel space to user space.
-- *
-- * Returns number of bytes that could not be copied.
-- * On success, this will be zero.
-- */
--unsigned long
--copy_to_user(void __user *to, const void *from, unsigned long n)
-+void copy_from_user_overflow(void)
- {
-- if (access_ok(VERIFY_WRITE, to, n))
-- n = __copy_to_user(to, from, n);
-- return n;
-+ WARN(1, "Buffer overflow detected!\n");
- }
--EXPORT_SYMBOL(copy_to_user);
-+EXPORT_SYMBOL(copy_from_user_overflow);
-
--/**
-- * copy_from_user: - Copy a block of data from user space.
-- * @to: Destination address, in kernel space.
-- * @from: Source address, in user space.
-- * @n: Number of bytes to copy.
-- *
-- * Context: User context only. This function may sleep.
-- *
-- * Copy data from user space to kernel space.
-- *
-- * Returns number of bytes that could not be copied.
-- * On success, this will be zero.
-- *
-- * If some data could not be copied, this function will pad the copied
-- * data to the requested size using zero bytes.
-- */
--unsigned long
--copy_from_user(void *to, const void __user *from, unsigned long n)
-+void copy_to_user_overflow(void)
- {
-- if (access_ok(VERIFY_READ, from, n))
-- n = __copy_from_user(to, from, n);
-- else
-- memset(to, 0, n);
-- return n;
-+ WARN(1, "Buffer overflow detected!\n");
- }
--EXPORT_SYMBOL(copy_from_user);
-+EXPORT_SYMBOL(copy_to_user_overflow);
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+void __set_fs(mm_segment_t x)
-+{
-+ switch (x.seg) {
-+ case 0:
-+ loadsegment(gs, 0);
-+ break;
-+ case TASK_SIZE_MAX:
-+ loadsegment(gs, __USER_DS);
-+ break;
-+ case -1UL:
-+ loadsegment(gs, __KERNEL_DS);
-+ break;
-+ default:
-+ BUG();
-+ }
-+ return;
-+}
-+EXPORT_SYMBOL(__set_fs);
-+
-+void set_fs(mm_segment_t x)
-+{
-+ current_thread_info()->addr_limit = x;
-+ __set_fs(x);
-+}
-+EXPORT_SYMBOL(set_fs);
-+#endif
-diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
-index b7c2849..17c878da 100644
---- a/arch/x86/lib/usercopy_64.c
-+++ b/arch/x86/lib/usercopy_64.c
-@@ -42,6 +42,12 @@ long
- __strncpy_from_user(char *dst, const char __user *src, long count)
- {
- long res;
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
-+ src += PAX_USER_SHADOW_BASE;
-+#endif
-+
- __do_strncpy_from_user(dst, src, count, res);
- return res;
- }
-@@ -87,7 +93,7 @@ unsigned long __clear_user(void __user *addr, unsigned long size)
- _ASM_EXTABLE(0b,3b)
- _ASM_EXTABLE(1b,2b)
- : [size8] "=&c"(size), [dst] "=&D" (__d0)
-- : [size1] "r"(size & 7), "[size8]" (size / 8), "[dst]"(addr),
-+ : [size1] "r"(size & 7), "[size8]" (size / 8), "[dst]"(____m(addr)),
- [zero] "r" (0UL), [eight] "r" (8UL));
- return size;
- }
-@@ -149,12 +155,11 @@ long strlen_user(const char __user *s)
- }
- EXPORT_SYMBOL(strlen_user);
-
--unsigned long copy_in_user(void __user *to, const void __user *from, unsigned len)
-+unsigned long copy_in_user(void __user *to, const void __user *from, unsigned long len)
- {
-- if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
-- return copy_user_generic((__force void *)to, (__force void *)from, len);
-- }
-- return len;
-+ if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len))
-+ return copy_user_generic((void __force_kernel *)____m(to), (void __force_kernel *)____m(from), len);
-+ return len;
- }
- EXPORT_SYMBOL(copy_in_user);
-
-@@ -164,7 +169,7 @@ EXPORT_SYMBOL(copy_in_user);
- * it is not necessary to optimize tail handling.
- */
- unsigned long
--copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest)
-+copy_user_handle_tail(char __user *to, char __user *from, unsigned long len, unsigned zerorest)
- {
- char c;
- unsigned zero_len;
-@@ -181,3 +186,15 @@ copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest)
- break;
- return len;
- }
-+
-+void copy_from_user_overflow(void)
-+{
-+ WARN(1, "Buffer overflow detected!\n");
-+}
-+EXPORT_SYMBOL(copy_from_user_overflow);
-+
-+void copy_to_user_overflow(void)
-+{
-+ WARN(1, "Buffer overflow detected!\n");
-+}
-+EXPORT_SYMBOL(copy_to_user_overflow);
-diff --git a/arch/x86/mm/extable.c b/arch/x86/mm/extable.c
-index 61b41ca..5fef66a 100644
---- a/arch/x86/mm/extable.c
-+++ b/arch/x86/mm/extable.c
-@@ -1,14 +1,71 @@
- #include <linux/module.h>
- #include <linux/spinlock.h>
-+#include <linux/sort.h>
- #include <asm/uaccess.h>
-+#include <asm/pgtable.h>
-
-+/*
-+ * The exception table needs to be sorted so that the binary
-+ * search that we use to find entries in it works properly.
-+ * This is used both for the kernel exception table and for
-+ * the exception tables of modules that get loaded.
-+ */
-+static int cmp_ex(const void *a, const void *b)
-+{
-+ const struct exception_table_entry *x = a, *y = b;
-+
-+ /* avoid overflow */
-+ if (x->insn > y->insn)
-+ return 1;
-+ if (x->insn < y->insn)
-+ return -1;
-+ return 0;
-+}
-+
-+static void swap_ex(void *a, void *b, int size)
-+{
-+ struct exception_table_entry t, *x = a, *y = b;
-+
-+ t = *x;
-+
-+ pax_open_kernel();
-+ *x = *y;
-+ *y = t;
-+ pax_close_kernel();
-+}
-+
-+void sort_extable(struct exception_table_entry *start,
-+ struct exception_table_entry *finish)
-+{
-+ sort(start, finish - start, sizeof(struct exception_table_entry),
-+ cmp_ex, swap_ex);
-+}
-+
-+#ifdef CONFIG_MODULES
-+/*
-+ * If the exception table is sorted, any referring to the module init
-+ * will be at the beginning or the end.
-+ */
-+void trim_init_extable(struct module *m)
-+{
-+ /*trim the beginning*/
-+ while (m->num_exentries && within_module_init(m->extable[0].insn, m)) {
-+ m->extable++;
-+ m->num_exentries--;
-+ }
-+ /*trim the end*/
-+ while (m->num_exentries &&
-+ within_module_init(m->extable[m->num_exentries-1].insn, m))
-+ m->num_exentries--;
-+}
-+#endif /* CONFIG_MODULES */
-
- int fixup_exception(struct pt_regs *regs)
- {
- const struct exception_table_entry *fixup;
-
- #ifdef CONFIG_PNPBIOS
-- if (unlikely(SEGMENT_IS_PNP_CODE(regs->cs))) {
-+ if (unlikely(!v8086_mode(regs) && SEGMENT_IS_PNP_CODE(regs->cs))) {
- extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp;
- extern u32 pnp_bios_is_utter_crap;
- pnp_bios_is_utter_crap = 1;
-diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
-index df87450..2cbcfc3 100644
---- a/arch/x86/mm/fault.c
-+++ b/arch/x86/mm/fault.c
-@@ -11,10 +11,19 @@
- #include <linux/kprobes.h> /* __kprobes, ... */
- #include <linux/mmiotrace.h> /* kmmio_handler, ... */
- #include <linux/perf_event.h> /* perf_sw_event */
-+#include <linux/unistd.h>
-+#include <linux/compiler.h>
-
- #include <asm/traps.h> /* dotraplinkage, ... */
- #include <asm/pgalloc.h> /* pgd_*(), ... */
- #include <asm/kmemcheck.h> /* kmemcheck_*(), ... */
-+#include <asm/vsyscall.h>
-+#include <asm/tlbflush.h>
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+#include <asm/stacktrace.h>
-+#include "../kernel/dumpstack.h"
-+#endif
-
- /*
- * Page fault error code bits:
-@@ -51,7 +60,7 @@ static inline int notify_page_fault(struct pt_regs *regs)
- int ret = 0;
-
- /* kprobe_running() needs smp_processor_id() */
-- if (kprobes_built_in() && !user_mode_vm(regs)) {
-+ if (kprobes_built_in() && !user_mode(regs)) {
- preempt_disable();
- if (kprobe_running() && kprobe_fault_handler(regs, 14))
- ret = 1;
-@@ -112,7 +121,10 @@ check_prefetch_opcode(struct pt_regs *regs, unsigned char *instr,
- return !instr_lo || (instr_lo>>1) == 1;
- case 0x00:
- /* Prefetch instruction is 0x0F0D or 0x0F18 */
-- if (probe_kernel_address(instr, opcode))
-+ if (user_mode(regs)) {
-+ if (__copy_from_user_inatomic(&opcode, (unsigned char __force_user *)(instr), 1))
-+ return 0;
-+ } else if (probe_kernel_address(instr, opcode))
- return 0;
-
- *prefetch = (instr_lo == 0xF) &&
-@@ -146,7 +158,10 @@ is_prefetch(struct pt_regs *regs, unsigned long error_code, unsigned long addr)
- while (instr < max_instr) {
- unsigned char opcode;
-
-- if (probe_kernel_address(instr, opcode))
-+ if (user_mode(regs)) {
-+ if (__copy_from_user_inatomic(&opcode, (unsigned char __force_user *)(instr), 1))
-+ break;
-+ } else if (probe_kernel_address(instr, opcode))
- break;
-
- instr++;
-@@ -172,6 +187,34 @@ force_sig_info_fault(int si_signo, int si_code, unsigned long address,
- force_sig_info(si_signo, &info, tsk);
- }
-
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+static bool pax_is_fetch_fault(struct pt_regs *regs, unsigned long error_code, unsigned long address);
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+static int pax_handle_fetch_fault(struct pt_regs *regs);
-+#endif
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+static inline pmd_t * pax_get_pmd(struct mm_struct *mm, unsigned long address)
-+{
-+ pgd_t *pgd;
-+ pud_t *pud;
-+ pmd_t *pmd;
-+
-+ pgd = pgd_offset(mm, address);
-+ if (!pgd_present(*pgd))
-+ return NULL;
-+ pud = pud_offset(pgd, address);
-+ if (!pud_present(*pud))
-+ return NULL;
-+ pmd = pmd_offset(pud, address);
-+ if (!pmd_present(*pmd))
-+ return NULL;
-+ return pmd;
-+}
-+#endif
-+
- DEFINE_SPINLOCK(pgd_lock);
- LIST_HEAD(pgd_list);
-
-@@ -223,11 +266,23 @@ void vmalloc_sync_all(void)
- address >= TASK_SIZE && address < FIXADDR_TOP;
- address += PMD_SIZE) {
-
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ unsigned long cpu;
-+#else
- struct page *page;
-+#endif
-
- spin_lock(&pgd_lock);
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ for (cpu = 0; cpu < nr_cpu_ids; ++cpu) {
-+ pgd_t *pgd = get_cpu_pgd(cpu);
-+#else
- list_for_each_entry(page, &pgd_list, lru) {
-- if (!vmalloc_sync_one(page_address(page), address))
-+ pgd_t *pgd = page_address(page);
-+#endif
-+
-+ if (!vmalloc_sync_one(pgd, address))
- break;
- }
- spin_unlock(&pgd_lock);
-@@ -257,6 +312,11 @@ static noinline int vmalloc_fault(unsigned long address)
- * an interrupt in the middle of a task switch..
- */
- pgd_paddr = read_cr3();
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (pgd_paddr & PHYSICAL_PAGE_MASK));
-+#endif
-+
- pmd_k = vmalloc_sync_one(__va(pgd_paddr), address);
- if (!pmd_k)
- return -1;
-@@ -330,15 +390,27 @@ void vmalloc_sync_all(void)
- address += PGDIR_SIZE) {
-
- const pgd_t *pgd_ref = pgd_offset_k(address);
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ unsigned long cpu;
-+#else
- struct page *page;
-+#endif
-
- if (pgd_none(*pgd_ref))
- continue;
-
- spin_lock(&pgd_lock);
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ for (cpu = 0; cpu < nr_cpu_ids; ++cpu) {
-+ pgd_t *pgd = pgd_offset_cpu(cpu, address);
-+#else
- list_for_each_entry(page, &pgd_list, lru) {
- pgd_t *pgd;
- pgd = (pgd_t *)page_address(page) + pgd_index(address);
-+#endif
-+
- if (pgd_none(*pgd))
- set_pgd(pgd, *pgd_ref);
- else
-@@ -371,7 +443,14 @@ static noinline int vmalloc_fault(unsigned long address)
- * happen within a race in page table update. In the later
- * case just flush:
- */
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (read_cr3() & PHYSICAL_PAGE_MASK));
-+ pgd = pgd_offset_cpu(smp_processor_id(), address);
-+#else
- pgd = pgd_offset(current->active_mm, address);
-+#endif
-+
- pgd_ref = pgd_offset_k(address);
- if (pgd_none(*pgd_ref))
- return -1;
-@@ -535,7 +614,7 @@ static int is_errata93(struct pt_regs *regs, unsigned long address)
- static int is_errata100(struct pt_regs *regs, unsigned long address)
- {
- #ifdef CONFIG_X86_64
-- if ((regs->cs == __USER32_CS || (regs->cs & (1<<2))) && (address >> 32))
-+ if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)) && (address >> 32))
- return 1;
- #endif
- return 0;
-@@ -562,7 +641,7 @@ static int is_f00f_bug(struct pt_regs *regs, unsigned long address)
- }
-
- static const char nx_warning[] = KERN_CRIT
--"kernel tried to execute NX-protected page - exploit attempt? (uid: %d)\n";
-+"kernel tried to execute NX-protected page - exploit attempt? (uid: %d, task: %s, pid: %d)\n";
-
- static void
- show_fault_oops(struct pt_regs *regs, unsigned long error_code,
-@@ -571,15 +650,26 @@ show_fault_oops(struct pt_regs *regs, unsigned long error_code,
- if (!oops_may_print())
- return;
-
-- if (error_code & PF_INSTR) {
-+ if (nx_enabled && (error_code & PF_INSTR)) {
- unsigned int level;
-
- pte_t *pte = lookup_address(address, &level);
-
- if (pte && pte_present(*pte) && !pte_exec(*pte))
-- printk(nx_warning, current_uid());
-+ printk(nx_warning, current_uid(), current->comm, task_pid_nr(current));
- }
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+ if (init_mm.start_code <= address && address < init_mm.end_code) {
-+ if (current->signal->curr_ip)
-+ printk(KERN_ERR "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
-+ ¤t->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
-+ else
-+ printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
-+ current->comm, task_pid_nr(current), current_uid(), current_euid());
-+ }
-+#endif
-+
- printk(KERN_ALERT "BUG: unable to handle kernel ");
- if (address < PAGE_SIZE)
- printk(KERN_CONT "NULL pointer dereference");
-@@ -705,6 +795,23 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
- {
- struct task_struct *tsk = current;
-
-+#ifdef CONFIG_X86_64
-+ struct mm_struct *mm = tsk->mm;
-+
-+ if (mm && (error_code & PF_INSTR) && mm->context.vdso) {
-+ if (regs->ip == (unsigned long)vgettimeofday) {
-+ regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_gettimeofday);
-+ return;
-+ } else if (regs->ip == (unsigned long)vtime) {
-+ regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_time);
-+ return;
-+ } else if (regs->ip == (unsigned long)vgetcpu) {
-+ regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, getcpu);
-+ return;
-+ }
-+ }
-+#endif
-+
- /* User mode accesses just cause a SIGSEGV */
- if (error_code & PF_USER) {
- /*
-@@ -722,12 +829,30 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
- if (is_errata100(regs, address))
- return;
-
-- if (unlikely(show_unhandled_signals))
-- show_signal_msg(regs, error_code, address, tsk);
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+ if (pax_is_fetch_fault(regs, error_code, address)) {
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+ switch (pax_handle_fetch_fault(regs)) {
-+ case 2:
-+ return;
-+ }
-+#endif
-+
-+ pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
-+ do_group_exit(SIGKILL);
-+ }
-+#endif
-
- /* Kernel addresses are always protection faults: */
-+ if (address >= TASK_SIZE)
-+ error_code |= PF_PROT;
-+
-+ if (likely(show_unhandled_signals))
-+ show_signal_msg(regs, error_code, address, tsk);
-+
- tsk->thread.cr2 = address;
-- tsk->thread.error_code = error_code | (address >= TASK_SIZE);
-+ tsk->thread.error_code = error_code;
- tsk->thread.trap_no = 14;
-
- force_sig_info_fault(SIGSEGV, si_code, address, tsk);
-@@ -818,7 +943,7 @@ do_sigbus(struct pt_regs *regs, unsigned long error_code, unsigned long address,
- if (fault & VM_FAULT_HWPOISON) {
- printk(KERN_ERR
- "MCE: Killing %s:%d due to hardware memory corruption fault at %lx\n",
-- tsk->comm, tsk->pid, address);
-+ tsk->comm, task_pid_nr(tsk), address);
- code = BUS_MCEERR_AR;
- }
- #endif
-@@ -857,6 +982,99 @@ static int spurious_fault_check(unsigned long error_code, pte_t *pte)
- return 1;
- }
-
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
-+static int pax_handle_pageexec_fault(struct pt_regs *regs, struct mm_struct *mm, unsigned long address, unsigned long error_code)
-+{
-+ pte_t *pte;
-+ pmd_t *pmd;
-+ spinlock_t *ptl;
-+ unsigned char pte_mask;
-+
-+ if (nx_enabled || (error_code & (PF_PROT|PF_USER)) != (PF_PROT|PF_USER) || v8086_mode(regs) ||
-+ !(mm->pax_flags & MF_PAX_PAGEEXEC))
-+ return 0;
-+
-+ /* PaX: it's our fault, let's handle it if we can */
-+
-+ /* PaX: take a look at read faults before acquiring any locks */
-+ if (unlikely(!(error_code & PF_WRITE) && (regs->ip == address))) {
-+ /* instruction fetch attempt from a protected page in user mode */
-+ up_read(&mm->mmap_sem);
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+ switch (pax_handle_fetch_fault(regs)) {
-+ case 2:
-+ return 1;
-+ }
-+#endif
-+
-+ pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
-+ do_group_exit(SIGKILL);
-+ }
-+
-+ pmd = pax_get_pmd(mm, address);
-+ if (unlikely(!pmd))
-+ return 0;
-+
-+ pte = pte_offset_map_lock(mm, pmd, address, &ptl);
-+ if (unlikely(!(pte_val(*pte) & _PAGE_PRESENT) || pte_user(*pte))) {
-+ pte_unmap_unlock(pte, ptl);
-+ return 0;
-+ }
-+
-+ if (unlikely((error_code & PF_WRITE) && !pte_write(*pte))) {
-+ /* write attempt to a protected page in user mode */
-+ pte_unmap_unlock(pte, ptl);
-+ return 0;
-+ }
-+
-+#ifdef CONFIG_SMP
-+ if (likely(address > get_limit(regs->cs) && cpu_isset(smp_processor_id(), mm->context.cpu_user_cs_mask)))
-+#else
-+ if (likely(address > get_limit(regs->cs)))
-+#endif
-+ {
-+ set_pte(pte, pte_mkread(*pte));
-+ __flush_tlb_one(address);
-+ pte_unmap_unlock(pte, ptl);
-+ up_read(&mm->mmap_sem);
-+ return 1;
-+ }
-+
-+ pte_mask = _PAGE_ACCESSED | _PAGE_USER | ((error_code & PF_WRITE) << (_PAGE_BIT_DIRTY-1));
-+
-+ /*
-+ * PaX: fill DTLB with user rights and retry
-+ */
-+ __asm__ __volatile__ (
-+ "orb %2,(%1)\n"
-+#if defined(CONFIG_M586) || defined(CONFIG_M586TSC)
-+/*
-+ * PaX: let this uncommented 'invlpg' remind us on the behaviour of Intel's
-+ * (and AMD's) TLBs. namely, they do not cache PTEs that would raise *any*
-+ * page fault when examined during a TLB load attempt. this is true not only
-+ * for PTEs holding a non-present entry but also present entries that will
-+ * raise a page fault (such as those set up by PaX, or the copy-on-write
-+ * mechanism). in effect it means that we do *not* need to flush the TLBs
-+ * for our target pages since their PTEs are simply not in the TLBs at all.
-+
-+ * the best thing in omitting it is that we gain around 15-20% speed in the
-+ * fast path of the page fault handler and can get rid of tracing since we
-+ * can no longer flush unintended entries.
-+ */
-+ "invlpg (%0)\n"
-+#endif
-+ __copyuser_seg"testb $0,(%0)\n"
-+ "xorb %3,(%1)\n"
-+ :
-+ : "r" (address), "r" (pte), "q" (pte_mask), "i" (_PAGE_USER)
-+ : "memory", "cc");
-+ pte_unmap_unlock(pte, ptl);
-+ up_read(&mm->mmap_sem);
-+ return 1;
-+}
-+#endif
-+
- /*
- * Handle a spurious fault caused by a stale TLB entry.
- *
-@@ -923,6 +1141,9 @@ int show_unhandled_signals = 1;
- static inline int
- access_error(unsigned long error_code, int write, struct vm_area_struct *vma)
- {
-+ if (nx_enabled && (error_code & PF_INSTR) && !(vma->vm_flags & VM_EXEC))
-+ return 1;
-+
- if (write) {
- /* write, present and write, not present: */
- if (unlikely(!(vma->vm_flags & VM_WRITE)))
-@@ -956,16 +1177,30 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
- {
- struct vm_area_struct *vma;
- struct task_struct *tsk;
-- unsigned long address;
- struct mm_struct *mm;
- int write;
- int fault;
-
-- tsk = current;
-- mm = tsk->mm;
--
- /* Get the faulting address: */
-- address = read_cr2();
-+ unsigned long address = read_cr2();
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ if (!user_mode(regs) && address < 2 * PAX_USER_SHADOW_BASE) {
-+ if (!search_exception_tables(regs->ip)) {
-+ bad_area_nosemaphore(regs, error_code, address);
-+ return;
-+ }
-+ if (address < PAX_USER_SHADOW_BASE) {
-+ printk(KERN_ERR "PAX: please report this to pageexec@freemail.hu\n");
-+ printk(KERN_ERR "PAX: faulting IP: %pA\n", (void *)regs->ip);
-+ show_trace_log_lvl(NULL, NULL, (void *)regs->sp, regs->bp, KERN_ERR);
-+ } else
-+ address -= PAX_USER_SHADOW_BASE;
-+ }
-+#endif
-+
-+ tsk = current;
-+ mm = tsk->mm;
-
- /*
- * Detect and handle instructions that would cause a page fault for
-@@ -1026,7 +1261,7 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
- * User-mode registers count as a user access even for any
- * potential system fault or CPU buglet:
- */
-- if (user_mode_vm(regs)) {
-+ if (user_mode(regs)) {
- local_irq_enable();
- error_code |= PF_USER;
- } else {
-@@ -1080,6 +1315,11 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
- might_sleep();
- }
-
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
-+ if (pax_handle_pageexec_fault(regs, mm, address, error_code))
-+ return;
-+#endif
-+
- vma = find_vma(mm, address);
- if (unlikely(!vma)) {
- bad_area(regs, error_code, address);
-@@ -1091,18 +1331,24 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
- bad_area(regs, error_code, address);
- return;
- }
-- if (error_code & PF_USER) {
-- /*
-- * Accessing the stack below %sp is always a bug.
-- * The large cushion allows instructions like enter
-- * and pusha to work. ("enter $65535, $31" pushes
-- * 32 pointers and then decrements %sp by 65535.)
-- */
-- if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < regs->sp)) {
-- bad_area(regs, error_code, address);
-- return;
-- }
-+ /*
-+ * Accessing the stack below %sp is always a bug.
-+ * The large cushion allows instructions like enter
-+ * and pusha to work. ("enter $65535, $31" pushes
-+ * 32 pointers and then decrements %sp by 65535.)
-+ */
-+ if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < task_pt_regs(tsk)->sp)) {
-+ bad_area(regs, error_code, address);
-+ return;
- }
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (unlikely((mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end - SEGMEXEC_TASK_SIZE - 1 < address - SEGMEXEC_TASK_SIZE - 1)) {
-+ bad_area(regs, error_code, address);
-+ return;
-+ }
-+#endif
-+
- if (unlikely(expand_stack(vma, address))) {
- bad_area(regs, error_code, address);
- return;
-@@ -1146,3 +1392,292 @@ good_area:
-
- up_read(&mm->mmap_sem);
- }
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+static bool pax_is_fetch_fault(struct pt_regs *regs, unsigned long error_code, unsigned long address)
-+{
-+ struct mm_struct *mm = current->mm;
-+ unsigned long ip = regs->ip;
-+
-+ if (v8086_mode(regs))
-+ ip = ((regs->cs & 0xffff) << 4) + (ip & 0xffff);
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (mm->pax_flags & MF_PAX_PAGEEXEC) {
-+ if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR))
-+ return true;
-+ if (!(error_code & (PF_PROT | PF_WRITE)) && ip == address)
-+ return true;
-+ return false;
-+ }
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC) {
-+ if (!(error_code & (PF_PROT | PF_WRITE)) && (ip + SEGMEXEC_TASK_SIZE == address))
-+ return true;
-+ return false;
-+ }
-+#endif
-+
-+ return false;
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+static int pax_handle_fetch_fault_32(struct pt_regs *regs)
-+{
-+ int err;
-+
-+ do { /* PaX: libffi trampoline emulation */
-+ unsigned char mov, jmp;
-+ unsigned int addr1, addr2;
-+
-+#ifdef CONFIG_X86_64
-+ if ((regs->ip + 9) >> 32)
-+ break;
-+#endif
-+
-+ err = get_user(mov, (unsigned char __user *)regs->ip);
-+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
-+ err |= get_user(jmp, (unsigned char __user *)(regs->ip + 5));
-+ err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
-+
-+ if (err)
-+ break;
-+
-+ if (mov == 0xB8 && jmp == 0xE9) {
-+ regs->ax = addr1;
-+ regs->ip = (unsigned int)(regs->ip + addr2 + 10);
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: gcc trampoline emulation #1 */
-+ unsigned char mov1, mov2;
-+ unsigned short jmp;
-+ unsigned int addr1, addr2;
-+
-+#ifdef CONFIG_X86_64
-+ if ((regs->ip + 11) >> 32)
-+ break;
-+#endif
-+
-+ err = get_user(mov1, (unsigned char __user *)regs->ip);
-+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
-+ err |= get_user(mov2, (unsigned char __user *)(regs->ip + 5));
-+ err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
-+ err |= get_user(jmp, (unsigned short __user *)(regs->ip + 10));
-+
-+ if (err)
-+ break;
-+
-+ if (mov1 == 0xB9 && mov2 == 0xB8 && jmp == 0xE0FF) {
-+ regs->cx = addr1;
-+ regs->ax = addr2;
-+ regs->ip = addr2;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: gcc trampoline emulation #2 */
-+ unsigned char mov, jmp;
-+ unsigned int addr1, addr2;
-+
-+#ifdef CONFIG_X86_64
-+ if ((regs->ip + 9) >> 32)
-+ break;
-+#endif
-+
-+ err = get_user(mov, (unsigned char __user *)regs->ip);
-+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
-+ err |= get_user(jmp, (unsigned char __user *)(regs->ip + 5));
-+ err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
-+
-+ if (err)
-+ break;
-+
-+ if (mov == 0xB9 && jmp == 0xE9) {
-+ regs->cx = addr1;
-+ regs->ip = (unsigned int)(regs->ip + addr2 + 10);
-+ return 2;
-+ }
-+ } while (0);
-+
-+ return 1; /* PaX in action */
-+}
-+
-+#ifdef CONFIG_X86_64
-+static int pax_handle_fetch_fault_64(struct pt_regs *regs)
-+{
-+ int err;
-+
-+ do { /* PaX: libffi trampoline emulation */
-+ unsigned short mov1, mov2, jmp1;
-+ unsigned char stcclc, jmp2;
-+ unsigned long addr1, addr2;
-+
-+ err = get_user(mov1, (unsigned short __user *)regs->ip);
-+ err |= get_user(addr1, (unsigned long __user *)(regs->ip + 2));
-+ err |= get_user(mov2, (unsigned short __user *)(regs->ip + 10));
-+ err |= get_user(addr2, (unsigned long __user *)(regs->ip + 12));
-+ err |= get_user(stcclc, (unsigned char __user *)(regs->ip + 20));
-+ err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 21));
-+ err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 23));
-+
-+ if (err)
-+ break;
-+
-+ if (mov1 == 0xBB49 && mov2 == 0xBA49 && (stcclc == 0xF8 || stcclc == 0xF9) && jmp1 == 0xFF49 && jmp2 == 0xE3) {
-+ regs->r11 = addr1;
-+ regs->r10 = addr2;
-+ if (stcclc == 0xF8)
-+ regs->flags &= ~X86_EFLAGS_CF;
-+ else
-+ regs->flags |= X86_EFLAGS_CF;
-+ regs->ip = addr1;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: gcc trampoline emulation #1 */
-+ unsigned short mov1, mov2, jmp1;
-+ unsigned char jmp2;
-+ unsigned int addr1;
-+ unsigned long addr2;
-+
-+ err = get_user(mov1, (unsigned short __user *)regs->ip);
-+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 2));
-+ err |= get_user(mov2, (unsigned short __user *)(regs->ip + 6));
-+ err |= get_user(addr2, (unsigned long __user *)(regs->ip + 8));
-+ err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 16));
-+ err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 18));
-+
-+ if (err)
-+ break;
-+
-+ if (mov1 == 0xBB41 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
-+ regs->r11 = addr1;
-+ regs->r10 = addr2;
-+ regs->ip = addr1;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: gcc trampoline emulation #2 */
-+ unsigned short mov1, mov2, jmp1;
-+ unsigned char jmp2;
-+ unsigned long addr1, addr2;
-+
-+ err = get_user(mov1, (unsigned short __user *)regs->ip);
-+ err |= get_user(addr1, (unsigned long __user *)(regs->ip + 2));
-+ err |= get_user(mov2, (unsigned short __user *)(regs->ip + 10));
-+ err |= get_user(addr2, (unsigned long __user *)(regs->ip + 12));
-+ err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 20));
-+ err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 22));
-+
-+ if (err)
-+ break;
-+
-+ if (mov1 == 0xBB49 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
-+ regs->r11 = addr1;
-+ regs->r10 = addr2;
-+ regs->ip = addr1;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ return 1; /* PaX in action */
-+}
-+#endif
-+
-+/*
-+ * PaX: decide what to do with offenders (regs->ip = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ * 2 when gcc trampoline was detected
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+ if (v8086_mode(regs))
-+ return 1;
-+
-+ if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
-+ return 1;
-+
-+#ifdef CONFIG_X86_32
-+ return pax_handle_fetch_fault_32(regs);
-+#else
-+ if (regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))
-+ return pax_handle_fetch_fault_32(regs);
-+ else
-+ return pax_handle_fetch_fault_64(regs);
-+#endif
-+}
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
-+{
-+ long i;
-+
-+ printk(KERN_ERR "PAX: bytes at PC: ");
-+ for (i = 0; i < 20; i++) {
-+ unsigned char c;
-+ if (get_user(c, (unsigned char __force_user *)pc+i))
-+ printk(KERN_CONT "?? ");
-+ else
-+ printk(KERN_CONT "%02x ", c);
-+ }
-+ printk("\n");
-+
-+ printk(KERN_ERR "PAX: bytes at SP-%lu: ", (unsigned long)sizeof(long));
-+ for (i = -1; i < 80 / (long)sizeof(long); i++) {
-+ unsigned long c;
-+ if (get_user(c, (unsigned long __force_user *)sp+i)) {
-+#ifdef CONFIG_X86_32
-+ printk(KERN_CONT "???????? ");
-+#else
-+ if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)))
-+ printk(KERN_CONT "???????? ???????? ");
-+ else
-+ printk(KERN_CONT "???????????????? ");
-+#endif
-+ } else {
-+#ifdef CONFIG_X86_64
-+ if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))) {
-+ printk(KERN_CONT "%08x ", (unsigned int)c);
-+ printk(KERN_CONT "%08x ", (unsigned int)(c >> 32));
-+ } else
-+#endif
-+ printk(KERN_CONT "%0*lx ", 2 * (int)sizeof(long), c);
-+ }
-+ }
-+ printk("\n");
-+}
-+#endif
-+
-+/**
-+ * probe_kernel_write(): safely attempt to write to a location
-+ * @dst: address to write to
-+ * @src: pointer to the data that shall be written
-+ * @size: size of the data chunk
-+ *
-+ * Safely write to address @dst from the buffer at @src. If a kernel fault
-+ * happens, handle that and return -EFAULT.
-+ */
-+long notrace probe_kernel_write(void *dst, const void *src, size_t size)
-+{
-+ long ret;
-+ mm_segment_t old_fs = get_fs();
-+
-+ set_fs(KERNEL_DS);
-+ pagefault_disable();
-+ pax_open_kernel();
-+ ret = __copy_to_user_inatomic((void __force_user *)dst, src, size);
-+ pax_close_kernel();
-+ pagefault_enable();
-+ set_fs(old_fs);
-+
-+ return ret ? -EFAULT : 0;
-+}
-diff --git a/arch/x86/mm/gup.c b/arch/x86/mm/gup.c
-index 71da1bc..7a16bf4 100644
---- a/arch/x86/mm/gup.c
-+++ b/arch/x86/mm/gup.c
-@@ -237,7 +237,7 @@ int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
- addr = start;
- len = (unsigned long) nr_pages << PAGE_SHIFT;
- end = start + len;
-- if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
-+ if (unlikely(!__access_ok(write ? VERIFY_WRITE : VERIFY_READ,
- (void __user *)start, len)))
- return 0;
-
-diff --git a/arch/x86/mm/highmem_32.c b/arch/x86/mm/highmem_32.c
-index 63a6ba6..79abd7a 100644
---- a/arch/x86/mm/highmem_32.c
-+++ b/arch/x86/mm/highmem_32.c
-@@ -43,7 +43,10 @@ void *kmap_atomic_prot(struct page *page, enum km_type type, pgprot_t prot)
- idx = type + KM_TYPE_NR*smp_processor_id();
- vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
- BUG_ON(!pte_none(*(kmap_pte-idx)));
-+
-+ pax_open_kernel();
- set_pte(kmap_pte-idx, mk_pte(page, prot));
-+ pax_close_kernel();
-
- return (void *)vaddr;
- }
-diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c
-index f46c3407..e840ce6 100644
---- a/arch/x86/mm/hugetlbpage.c
-+++ b/arch/x86/mm/hugetlbpage.c
-@@ -267,13 +267,21 @@ static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *file,
- struct hstate *h = hstate_file(file);
- struct mm_struct *mm = current->mm;
- struct vm_area_struct *vma;
-- unsigned long start_addr;
-+ unsigned long start_addr, pax_task_size = TASK_SIZE;
-+ unsigned long offset = gr_rand_threadstack_offset(mm, file, flags);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+ pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+ pax_task_size -= PAGE_SIZE;
-
- if (len > mm->cached_hole_size) {
-- start_addr = mm->free_area_cache;
-+ start_addr = mm->free_area_cache;
- } else {
-- start_addr = TASK_UNMAPPED_BASE;
-- mm->cached_hole_size = 0;
-+ start_addr = mm->mmap_base;
-+ mm->cached_hole_size = 0;
- }
-
- full_search:
-@@ -281,26 +289,27 @@ full_search:
-
- for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
- /* At this point: (!vma || addr < vma->vm_end). */
-- if (TASK_SIZE - len < addr) {
-+ if (pax_task_size - len < addr) {
- /*
- * Start a new search - just in case we missed
- * some holes.
- */
-- if (start_addr != TASK_UNMAPPED_BASE) {
-- start_addr = TASK_UNMAPPED_BASE;
-+ if (start_addr != mm->mmap_base) {
-+ start_addr = mm->mmap_base;
- mm->cached_hole_size = 0;
- goto full_search;
- }
- return -ENOMEM;
- }
-- if (!vma || addr + len <= vma->vm_start) {
-- mm->free_area_cache = addr + len;
-- return addr;
-- }
-+ if (check_heap_stack_gap(vma, &addr, len, offset))
-+ break;
- if (addr + mm->cached_hole_size < vma->vm_start)
- mm->cached_hole_size = vma->vm_start - addr;
- addr = ALIGN(vma->vm_end, huge_page_size(h));
- }
-+
-+ mm->free_area_cache = addr + len;
-+ return addr;
- }
-
- static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
-@@ -309,10 +318,10 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
- {
- struct hstate *h = hstate_file(file);
- struct mm_struct *mm = current->mm;
-- struct vm_area_struct *vma, *prev_vma;
-- unsigned long base = mm->mmap_base, addr = addr0;
-+ struct vm_area_struct *vma;
-+ unsigned long base = mm->mmap_base, addr;
- unsigned long largest_hole = mm->cached_hole_size;
-- int first_time = 1;
-+ unsigned long offset = gr_rand_threadstack_offset(mm, file, flags);
-
- /* don't allow allocations above current base */
- if (mm->free_area_cache > base)
-@@ -322,64 +331,68 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
- largest_hole = 0;
- mm->free_area_cache = base;
- }
--try_again:
-+
- /* make sure it can fit in the remaining address space */
- if (mm->free_area_cache < len)
- goto fail;
-
- /* either no address requested or cant fit in requested address hole */
-- addr = (mm->free_area_cache - len) & huge_page_mask(h);
-+ addr = (mm->free_area_cache - len);
- do {
-+ addr &= huge_page_mask(h);
- /*
- * Lookup failure means no vma is above this address,
- * i.e. return with success:
- */
-- if (!(vma = find_vma_prev(mm, addr, &prev_vma)))
-+ vma = find_vma(mm, addr);
-+ if (!vma)
- return addr;
-
- /*
- * new region fits between prev_vma->vm_end and
- * vma->vm_start, use it:
- */
-- if (addr + len <= vma->vm_start &&
-- (!prev_vma || (addr >= prev_vma->vm_end))) {
-+ if (check_heap_stack_gap(vma, &addr, len, offset)) {
- /* remember the address as a hint for next time */
-- mm->cached_hole_size = largest_hole;
-- return (mm->free_area_cache = addr);
-- } else {
-- /* pull free_area_cache down to the first hole */
-- if (mm->free_area_cache == vma->vm_end) {
-- mm->free_area_cache = vma->vm_start;
-- mm->cached_hole_size = largest_hole;
-- }
-+ mm->cached_hole_size = largest_hole;
-+ return (mm->free_area_cache = addr);
-+ }
-+ /* pull free_area_cache down to the first hole */
-+ if (mm->free_area_cache == vma->vm_end) {
-+ mm->free_area_cache = vma->vm_start;
-+ mm->cached_hole_size = largest_hole;
- }
-
- /* remember the largest hole we saw so far */
- if (addr + largest_hole < vma->vm_start)
-- largest_hole = vma->vm_start - addr;
-+ largest_hole = vma->vm_start - addr;
-
- /* try just below the current vma->vm_start */
-- addr = (vma->vm_start - len) & huge_page_mask(h);
-- } while (len <= vma->vm_start);
-+ addr = skip_heap_stack_gap(vma, len, offset);
-+ } while (!IS_ERR_VALUE(addr));
-
- fail:
- /*
-- * if hint left us with no space for the requested
-- * mapping then try again:
-- */
-- if (first_time) {
-- mm->free_area_cache = base;
-- largest_hole = 0;
-- first_time = 0;
-- goto try_again;
-- }
-- /*
- * A failed mmap() very likely causes application failure,
- * so fall back to the bottom-up function here. This scenario
- * can happen with large stack limits and large mmap()
- * allocations.
- */
-- mm->free_area_cache = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+ mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
-+ else
-+#endif
-+
-+ mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base += mm->delta_mmap;
-+#endif
-+
-+ mm->free_area_cache = mm->mmap_base;
- mm->cached_hole_size = ~0UL;
- addr = hugetlb_get_unmapped_area_bottomup(file, addr0,
- len, pgoff, flags);
-@@ -387,6 +400,7 @@ fail:
- /*
- * Restore the topdown base:
- */
-+ mm->mmap_base = base;
- mm->free_area_cache = base;
- mm->cached_hole_size = ~0UL;
-
-@@ -400,10 +414,20 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
- struct hstate *h = hstate_file(file);
- struct mm_struct *mm = current->mm;
- struct vm_area_struct *vma;
-+ unsigned long pax_task_size = TASK_SIZE;
-+ unsigned long offset = gr_rand_threadstack_offset(mm, file, flags);
-
- if (len & ~huge_page_mask(h))
- return -EINVAL;
-- if (len > TASK_SIZE)
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+ pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+ pax_task_size -= PAGE_SIZE;
-+
-+ if (len > pax_task_size)
- return -ENOMEM;
-
- if (flags & MAP_FIXED) {
-@@ -412,11 +436,14 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
- return addr;
- }
-
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- if (addr) {
- addr = ALIGN(addr, huge_page_size(h));
- vma = find_vma(mm, addr);
-- if (TASK_SIZE - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-+ if (pax_task_size - len >= addr && check_heap_stack_gap(vma, &addr, len, offset))
- return addr;
- }
- if (mm->get_unmapped_area == arch_get_unmapped_area)
-diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
-index 73ffd55..628bc4e 100644
---- a/arch/x86/mm/init.c
-+++ b/arch/x86/mm/init.c
-@@ -1,6 +1,7 @@
- #include <linux/initrd.h>
- #include <linux/ioport.h>
- #include <linux/swap.h>
-+#include <linux/tboot.h>
-
- #include <asm/cacheflush.h>
- #include <asm/e820.h>
-@@ -13,6 +14,7 @@
- #include <asm/tlbflush.h>
- #include <asm/tlb.h>
- #include <asm/proto.h>
-+#include <asm/bios_ebda.h>
-
- DEFINE_PER_CPU(struct mmu_gather, mmu_gathers);
-
-@@ -69,11 +71,7 @@ static void __init find_early_table_space(unsigned long end, int use_pse,
- * cause a hotspot and fill up ZONE_DMA. The page tables
- * need roughly 0.5KB per GB.
- */
--#ifdef CONFIG_X86_32
-- start = 0x7000;
--#else
-- start = 0x8000;
--#endif
-+ start = 0x100000;
- e820_table_start = find_e820_area(start, max_pfn_mapped<<PAGE_SHIFT,
- tables, PAGE_SIZE);
- if (e820_table_start == -1UL)
-@@ -147,7 +145,7 @@ unsigned long __init_refok init_memory_mapping(unsigned long start,
- #endif
-
- set_nx();
-- if (nx_enabled)
-+ if (nx_enabled && cpu_has_nx)
- printk(KERN_INFO "NX (Execute Disable) protection: active\n");
-
- /* Enable PSE if available */
-@@ -283,7 +281,14 @@ unsigned long __init_refok init_memory_mapping(unsigned long start,
-
- #ifdef CONFIG_X86_32
- early_ioremap_page_table_range_init();
-+#endif
-
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
-+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-+ KERNEL_PGD_PTRS);
-+ load_cr3(get_cpu_pgd(0));
-+#elif defined(CONFIG_X86_32)
- load_cr3(swapper_pg_dir);
- #endif
-
-@@ -329,10 +334,35 @@ unsigned long __init_refok init_memory_mapping(unsigned long start,
- * Access has to be given to non-kernel-ram areas as well, these contain the PCI
- * mmio resources as well as potential bios/acpi data regions.
- */
-+
-+#ifdef CONFIG_GRKERNSEC_KMEM
-+static unsigned int ebda_start __read_only;
-+static unsigned int ebda_end __read_only;
-+#endif
-+
- int devmem_is_allowed(unsigned long pagenr)
- {
-+#ifdef CONFIG_GRKERNSEC_KMEM
-+ /* allow BDA */
-+ if (!pagenr)
-+ return 1;
-+ /* allow EBDA */
-+ if (pagenr >= ebda_start && pagenr < ebda_end)
-+ return 1;
-+ /* if tboot is in use, allow access to its hardcoded serial log range */
-+ if (tboot_enabled() && ((0x60000 >> PAGE_SHIFT) <= pagenr) && (pagenr < (0x68000 >> PAGE_SHIFT)))
-+ return 1;
-+ /* allow ISA/video mem */
-+ if ((ISA_START_ADDRESS >> PAGE_SHIFT) <= pagenr && pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
-+ return 1;
-+ /* throw out everything else below 1MB */
- if (pagenr <= 256)
-+ return 0;
-+#else
-+ if (pagenr < 256)
- return 1;
-+#endif
-+
- if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
- return 0;
- if (!page_is_ram(pagenr))
-@@ -377,8 +407,117 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end)
- #endif
- }
-
-+#ifdef CONFIG_GRKERNSEC_KMEM
-+static inline void gr_init_ebda(void)
-+{
-+ unsigned int ebda_addr;
-+ unsigned int ebda_size = 0;
-+
-+ ebda_addr = get_bios_ebda();
-+ if (ebda_addr) {
-+ ebda_size = *(unsigned char *)phys_to_virt(ebda_addr);
-+ ebda_size <<= 10;
-+ }
-+ if (ebda_addr && ebda_size) {
-+ ebda_start = ebda_addr >> PAGE_SHIFT;
-+ ebda_end = min((unsigned int)PAGE_ALIGN(ebda_addr + ebda_size), (unsigned int)0xa0000) >> PAGE_SHIFT;
-+ } else {
-+ ebda_start = 0x9f000 >> PAGE_SHIFT;
-+ ebda_end = 0xa0000 >> PAGE_SHIFT;
-+ }
-+}
-+#else
-+static inline void gr_init_ebda(void) { }
-+#endif
-+
- void free_initmem(void)
- {
-+#ifdef CONFIG_PAX_KERNEXEC
-+#ifdef CONFIG_X86_32
-+ /* PaX: limit KERNEL_CS to actual size */
-+ unsigned long addr, limit;
-+ struct desc_struct d;
-+ int cpu;
-+#else
-+ pgd_t *pgd;
-+ pud_t *pud;
-+ pmd_t *pmd;
-+ unsigned long addr, end;
-+#endif
-+#endif
-+
-+ gr_init_ebda();
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+#ifdef CONFIG_X86_32
-+ limit = paravirt_enabled() ? ktva_ktla(0xffffffff) : (unsigned long)&_etext;
-+ limit = (limit - 1UL) >> PAGE_SHIFT;
-+
-+ memset(__LOAD_PHYSICAL_ADDR + PAGE_OFFSET, POISON_FREE_INITMEM, PAGE_SIZE);
-+ for (cpu = 0; cpu < nr_cpu_ids; cpu++) {
-+ pack_descriptor(&d, get_desc_base(&get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_CS]), limit, 0x9B, 0xC);
-+ write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_KERNEL_CS, &d, DESCTYPE_S);
-+ write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_KERNEXEC_KERNEL_CS, &d, DESCTYPE_S);
-+ }
-+
-+ /* PaX: make KERNEL_CS read-only */
-+ addr = PFN_ALIGN(ktla_ktva((unsigned long)&_text));
-+ if (!paravirt_enabled())
-+ set_memory_ro(addr, (PFN_ALIGN(_sdata) - addr) >> PAGE_SHIFT);
-+/*
-+ for (addr = ktla_ktva((unsigned long)&_text); addr < (unsigned long)&_sdata; addr += PMD_SIZE) {
-+ pgd = pgd_offset_k(addr);
-+ pud = pud_offset(pgd, addr);
-+ pmd = pmd_offset(pud, addr);
-+ set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
-+ }
-+*/
-+#ifdef CONFIG_X86_PAE
-+ set_memory_nx(PFN_ALIGN(__init_begin), (PFN_ALIGN(__init_end) - PFN_ALIGN(__init_begin)) >> PAGE_SHIFT);
-+/*
-+ for (addr = (unsigned long)&__init_begin; addr < (unsigned long)&__init_end; addr += PMD_SIZE) {
-+ pgd = pgd_offset_k(addr);
-+ pud = pud_offset(pgd, addr);
-+ pmd = pmd_offset(pud, addr);
-+ set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
-+ }
-+*/
-+#endif
-+
-+#ifdef CONFIG_MODULES
-+ set_memory_4k((unsigned long)MODULES_EXEC_VADDR, (MODULES_EXEC_END - MODULES_EXEC_VADDR) >> PAGE_SHIFT);
-+#endif
-+
-+#else
-+ /* PaX: make kernel code/rodata read-only, rest non-executable */
-+ for (addr = __START_KERNEL_map; addr < __START_KERNEL_map + KERNEL_IMAGE_SIZE; addr += PMD_SIZE) {
-+ pgd = pgd_offset_k(addr);
-+ pud = pud_offset(pgd, addr);
-+ pmd = pmd_offset(pud, addr);
-+ if (!pmd_present(*pmd))
-+ continue;
-+ if ((unsigned long)_text <= addr && addr < (unsigned long)_sdata)
-+ set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
-+ else
-+ set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
-+ }
-+
-+ addr = (unsigned long)__va(__pa(__START_KERNEL_map));
-+ end = addr + KERNEL_IMAGE_SIZE;
-+ for (; addr < end; addr += PMD_SIZE) {
-+ pgd = pgd_offset_k(addr);
-+ pud = pud_offset(pgd, addr);
-+ pmd = pmd_offset(pud, addr);
-+ if (!pmd_present(*pmd))
-+ continue;
-+ if ((unsigned long)__va(__pa(_text)) <= addr && addr < (unsigned long)__va(__pa(_sdata)))
-+ set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
-+ }
-+#endif
-+
-+ flush_tlb_all();
-+#endif
-+
- free_init_pages("unused kernel memory",
- (unsigned long)(&__init_begin),
- (unsigned long)(&__init_end));
-diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c
-index 30938c1..60601c8 100644
---- a/arch/x86/mm/init_32.c
-+++ b/arch/x86/mm/init_32.c
-@@ -72,36 +72,6 @@ static __init void *alloc_low_page(void)
- }
-
- /*
-- * Creates a middle page table and puts a pointer to it in the
-- * given global directory entry. This only returns the gd entry
-- * in non-PAE compilation mode, since the middle layer is folded.
-- */
--static pmd_t * __init one_md_table_init(pgd_t *pgd)
--{
-- pud_t *pud;
-- pmd_t *pmd_table;
--
--#ifdef CONFIG_X86_PAE
-- if (!(pgd_val(*pgd) & _PAGE_PRESENT)) {
-- if (after_bootmem)
-- pmd_table = (pmd_t *)alloc_bootmem_pages(PAGE_SIZE);
-- else
-- pmd_table = (pmd_t *)alloc_low_page();
-- paravirt_alloc_pmd(&init_mm, __pa(pmd_table) >> PAGE_SHIFT);
-- set_pgd(pgd, __pgd(__pa(pmd_table) | _PAGE_PRESENT));
-- pud = pud_offset(pgd, 0);
-- BUG_ON(pmd_table != pmd_offset(pud, 0));
--
-- return pmd_table;
-- }
--#endif
-- pud = pud_offset(pgd, 0);
-- pmd_table = pmd_offset(pud, 0);
--
-- return pmd_table;
--}
--
--/*
- * Create a page table and place a pointer to it in a middle page
- * directory entry:
- */
-@@ -121,13 +91,28 @@ static pte_t * __init one_page_table_init(pmd_t *pmd)
- page_table = (pte_t *)alloc_low_page();
-
- paravirt_alloc_pte(&init_mm, __pa(page_table) >> PAGE_SHIFT);
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+ set_pmd(pmd, __pmd(__pa(page_table) | _KERNPG_TABLE));
-+#else
- set_pmd(pmd, __pmd(__pa(page_table) | _PAGE_TABLE));
-+#endif
- BUG_ON(page_table != pte_offset_kernel(pmd, 0));
- }
-
- return pte_offset_kernel(pmd, 0);
- }
-
-+static pmd_t * __init one_md_table_init(pgd_t *pgd)
-+{
-+ pud_t *pud;
-+ pmd_t *pmd_table;
-+
-+ pud = pud_offset(pgd, 0);
-+ pmd_table = pmd_offset(pud, 0);
-+
-+ return pmd_table;
-+}
-+
- pmd_t * __init populate_extra_pmd(unsigned long vaddr)
- {
- int pgd_idx = pgd_index(vaddr);
-@@ -201,6 +186,7 @@ page_table_range_init(unsigned long start, unsigned long end, pgd_t *pgd_base)
- int pgd_idx, pmd_idx;
- unsigned long vaddr;
- pgd_t *pgd;
-+ pud_t *pud;
- pmd_t *pmd;
- pte_t *pte = NULL;
-
-@@ -210,8 +196,13 @@ page_table_range_init(unsigned long start, unsigned long end, pgd_t *pgd_base)
- pgd = pgd_base + pgd_idx;
-
- for ( ; (pgd_idx < PTRS_PER_PGD) && (vaddr != end); pgd++, pgd_idx++) {
-- pmd = one_md_table_init(pgd);
-- pmd = pmd + pmd_index(vaddr);
-+ pud = pud_offset(pgd, vaddr);
-+ pmd = pmd_offset(pud, vaddr);
-+
-+#ifdef CONFIG_X86_PAE
-+ paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
-+#endif
-+
- for (; (pmd_idx < PTRS_PER_PMD) && (vaddr != end);
- pmd++, pmd_idx++) {
- pte = page_table_kmap_check(one_page_table_init(pmd),
-@@ -223,11 +214,20 @@ page_table_range_init(unsigned long start, unsigned long end, pgd_t *pgd_base)
- }
- }
-
--static inline int is_kernel_text(unsigned long addr)
-+static inline int is_kernel_text(unsigned long start, unsigned long end)
- {
-- if (addr >= PAGE_OFFSET && addr <= (unsigned long)__init_end)
-- return 1;
-- return 0;
-+ if ((start > ktla_ktva((unsigned long)_etext) ||
-+ end <= ktla_ktva((unsigned long)_stext)) &&
-+ (start > ktla_ktva((unsigned long)_einittext) ||
-+ end <= ktla_ktva((unsigned long)_sinittext)) &&
-+
-+#ifdef CONFIG_ACPI_SLEEP
-+ (start > (unsigned long)__va(acpi_wakeup_address) + 0x4000 || end <= (unsigned long)__va(acpi_wakeup_address)) &&
-+#endif
-+
-+ (start > (unsigned long)__va(0xfffff) || end <= (unsigned long)__va(0xc0000)))
-+ return 0;
-+ return 1;
- }
-
- /*
-@@ -243,9 +243,10 @@ kernel_physical_mapping_init(unsigned long start,
- int use_pse = page_size_mask == (1<<PG_LEVEL_2M);
- unsigned long start_pfn, end_pfn;
- pgd_t *pgd_base = swapper_pg_dir;
-- int pgd_idx, pmd_idx, pte_ofs;
-+ unsigned int pgd_idx, pmd_idx, pte_ofs;
- unsigned long pfn;
- pgd_t *pgd;
-+ pud_t *pud;
- pmd_t *pmd;
- pte_t *pte;
- unsigned pages_2m, pages_4k;
-@@ -278,8 +279,13 @@ repeat:
- pfn = start_pfn;
- pgd_idx = pgd_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
- pgd = pgd_base + pgd_idx;
-- for (; pgd_idx < PTRS_PER_PGD; pgd++, pgd_idx++) {
-- pmd = one_md_table_init(pgd);
-+ for (; pgd_idx < PTRS_PER_PGD && pfn < max_low_pfn; pgd++, pgd_idx++) {
-+ pud = pud_offset(pgd, 0);
-+ pmd = pmd_offset(pud, 0);
-+
-+#ifdef CONFIG_X86_PAE
-+ paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
-+#endif
-
- if (pfn >= end_pfn)
- continue;
-@@ -291,14 +297,13 @@ repeat:
- #endif
- for (; pmd_idx < PTRS_PER_PMD && pfn < end_pfn;
- pmd++, pmd_idx++) {
-- unsigned int addr = pfn * PAGE_SIZE + PAGE_OFFSET;
-+ unsigned long address = pfn * PAGE_SIZE + PAGE_OFFSET;
-
- /*
- * Map with big pages if possible, otherwise
- * create normal page tables:
- */
- if (use_pse) {
-- unsigned int addr2;
- pgprot_t prot = PAGE_KERNEL_LARGE;
- /*
- * first pass will use the same initial
-@@ -308,11 +313,7 @@ repeat:
- __pgprot(PTE_IDENT_ATTR |
- _PAGE_PSE);
-
-- addr2 = (pfn + PTRS_PER_PTE-1) * PAGE_SIZE +
-- PAGE_OFFSET + PAGE_SIZE-1;
--
-- if (is_kernel_text(addr) ||
-- is_kernel_text(addr2))
-+ if (is_kernel_text(address, address + PMD_SIZE))
- prot = PAGE_KERNEL_LARGE_EXEC;
-
- pages_2m++;
-@@ -329,7 +330,7 @@ repeat:
- pte_ofs = pte_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
- pte += pte_ofs;
- for (; pte_ofs < PTRS_PER_PTE && pfn < end_pfn;
-- pte++, pfn++, pte_ofs++, addr += PAGE_SIZE) {
-+ pte++, pfn++, pte_ofs++, address += PAGE_SIZE) {
- pgprot_t prot = PAGE_KERNEL;
- /*
- * first pass will use the same initial
-@@ -337,7 +338,7 @@ repeat:
- */
- pgprot_t init_prot = __pgprot(PTE_IDENT_ATTR);
-
-- if (is_kernel_text(addr))
-+ if (is_kernel_text(address, address + PAGE_SIZE))
- prot = PAGE_KERNEL_EXEC;
-
- pages_4k++;
-@@ -489,7 +490,7 @@ void __init native_pagetable_setup_start(pgd_t *base)
-
- pud = pud_offset(pgd, va);
- pmd = pmd_offset(pud, va);
-- if (!pmd_present(*pmd))
-+ if (!pmd_present(*pmd) || pmd_huge(*pmd))
- break;
-
- pte = pte_offset_kernel(pmd, va);
-@@ -541,9 +542,7 @@ void __init early_ioremap_page_table_range_init(void)
-
- static void __init pagetable_init(void)
- {
-- pgd_t *pgd_base = swapper_pg_dir;
--
-- permanent_kmaps_init(pgd_base);
-+ permanent_kmaps_init(swapper_pg_dir);
- }
-
- #ifdef CONFIG_ACPI_SLEEP
-@@ -551,12 +550,12 @@ static void __init pagetable_init(void)
- * ACPI suspend needs this for resume, because things like the intel-agp
- * driver might have split up a kernel 4MB mapping.
- */
--char swsusp_pg_dir[PAGE_SIZE]
-+pgd_t swsusp_pg_dir[PTRS_PER_PGD]
- __attribute__ ((aligned(PAGE_SIZE)));
-
- static inline void save_pg_dir(void)
- {
-- memcpy(swsusp_pg_dir, swapper_pg_dir, PAGE_SIZE);
-+ clone_pgd_range(swsusp_pg_dir, swapper_pg_dir, PTRS_PER_PGD);
- }
- #else /* !CONFIG_ACPI_SLEEP */
- static inline void save_pg_dir(void)
-@@ -588,7 +587,7 @@ void zap_low_mappings(bool early)
- flush_tlb_all();
- }
-
--pteval_t __supported_pte_mask __read_mostly = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
-+pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
- EXPORT_SYMBOL_GPL(__supported_pte_mask);
-
- /* user-defined highmem size */
-@@ -777,7 +776,7 @@ void __init setup_bootmem_allocator(void)
- * Initialize the boot-time allocator (with low memory only):
- */
- bootmap_size = bootmem_bootmap_pages(max_low_pfn)<<PAGE_SHIFT;
-- bootmap = find_e820_area(0, max_pfn_mapped<<PAGE_SHIFT, bootmap_size,
-+ bootmap = find_e820_area(0x100000, max_pfn_mapped<<PAGE_SHIFT, bootmap_size,
- PAGE_SIZE);
- if (bootmap == -1L)
- panic("Cannot find bootmem map of size %ld\n", bootmap_size);
-@@ -881,7 +880,7 @@ void __init mem_init(void)
- set_highmem_pages_init();
-
- codesize = (unsigned long) &_etext - (unsigned long) &_text;
-- datasize = (unsigned long) &_edata - (unsigned long) &_etext;
-+ datasize = (unsigned long) &_edata - (unsigned long) &_sdata;
- initsize = (unsigned long) &__init_end - (unsigned long) &__init_begin;
-
- printk(KERN_INFO "Memory: %luk/%luk available (%dk kernel code, "
-@@ -923,10 +922,10 @@ void __init mem_init(void)
- ((unsigned long)&__init_end -
- (unsigned long)&__init_begin) >> 10,
-
-- (unsigned long)&_etext, (unsigned long)&_edata,
-- ((unsigned long)&_edata - (unsigned long)&_etext) >> 10,
-+ (unsigned long)&_sdata, (unsigned long)&_edata,
-+ ((unsigned long)&_edata - (unsigned long)&_sdata) >> 10,
-
-- (unsigned long)&_text, (unsigned long)&_etext,
-+ ktla_ktva((unsigned long)&_text), ktla_ktva((unsigned long)&_etext),
- ((unsigned long)&_etext - (unsigned long)&_text) >> 10);
-
- /*
-@@ -1007,6 +1006,7 @@ void set_kernel_text_rw(void)
- if (!kernel_set_to_readonly)
- return;
-
-+ start = ktla_ktva(start);
- pr_debug("Set kernel text: %lx - %lx for read write\n",
- start, start+size);
-
-@@ -1021,6 +1021,7 @@ void set_kernel_text_ro(void)
- if (!kernel_set_to_readonly)
- return;
-
-+ start = ktla_ktva(start);
- pr_debug("Set kernel text: %lx - %lx for read only\n",
- start, start+size);
-
-@@ -1032,6 +1033,7 @@ void mark_rodata_ro(void)
- unsigned long start = PFN_ALIGN(_text);
- unsigned long size = PFN_ALIGN(_etext) - start;
-
-+ start = ktla_ktva(start);
- set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT);
- printk(KERN_INFO "Write protecting the kernel text: %luk\n",
- size >> 10);
-diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
-index ccbc61b..751fd75 100644
---- a/arch/x86/mm/init_64.c
-+++ b/arch/x86/mm/init_64.c
-@@ -123,7 +123,7 @@ static pud_t *fill_pud(pgd_t *pgd, unsigned long vaddr)
- {
- if (pgd_none(*pgd)) {
- pud_t *pud = (pud_t *)spp_getpage();
-- pgd_populate(&init_mm, pgd, pud);
-+ pgd_populate_kernel(&init_mm, pgd, pud);
- if (pud != pud_offset(pgd, 0))
- printk(KERN_ERR "PAGETABLE BUG #00! %p <-> %p\n",
- pud, pud_offset(pgd, 0));
-@@ -135,7 +135,7 @@ static pmd_t *fill_pmd(pud_t *pud, unsigned long vaddr)
- {
- if (pud_none(*pud)) {
- pmd_t *pmd = (pmd_t *) spp_getpage();
-- pud_populate(&init_mm, pud, pmd);
-+ pud_populate_kernel(&init_mm, pud, pmd);
- if (pmd != pmd_offset(pud, 0))
- printk(KERN_ERR "PAGETABLE BUG #01! %p <-> %p\n",
- pmd, pmd_offset(pud, 0));
-@@ -164,7 +164,9 @@ void set_pte_vaddr_pud(pud_t *pud_page, unsigned long vaddr, pte_t new_pte)
- pmd = fill_pmd(pud, vaddr);
- pte = fill_pte(pmd, vaddr);
-
-+ pax_open_kernel();
- set_pte(pte, new_pte);
-+ pax_close_kernel();
-
- /*
- * It's enough to flush this one mapping.
-@@ -223,14 +225,12 @@ static void __init __init_extra_mapping(unsigned long phys, unsigned long size,
- pgd = pgd_offset_k((unsigned long)__va(phys));
- if (pgd_none(*pgd)) {
- pud = (pud_t *) spp_getpage();
-- set_pgd(pgd, __pgd(__pa(pud) | _KERNPG_TABLE |
-- _PAGE_USER));
-+ set_pgd(pgd, __pgd(__pa(pud) | _PAGE_TABLE));
- }
- pud = pud_offset(pgd, (unsigned long)__va(phys));
- if (pud_none(*pud)) {
- pmd = (pmd_t *) spp_getpage();
-- set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE |
-- _PAGE_USER));
-+ set_pud(pud, __pud(__pa(pmd) | _PAGE_TABLE));
- }
- pmd = pmd_offset(pud, phys);
- BUG_ON(!pmd_none(*pmd));
-@@ -507,7 +507,7 @@ phys_pud_init(pud_t *pud_page, unsigned long addr, unsigned long end,
- unmap_low_page(pmd);
-
- spin_lock(&init_mm.page_table_lock);
-- pud_populate(&init_mm, pud, __va(pmd_phys));
-+ pud_populate_kernel(&init_mm, pud, __va(pmd_phys));
- spin_unlock(&init_mm.page_table_lock);
- }
- __flush_tlb_all();
-@@ -560,7 +560,7 @@ kernel_physical_mapping_init(unsigned long start,
- unmap_low_page(pud);
-
- spin_lock(&init_mm.page_table_lock);
-- pgd_populate(&init_mm, pgd, __va(pud_phys));
-+ pgd_populate_kernel(&init_mm, pgd, __va(pud_phys));
- spin_unlock(&init_mm.page_table_lock);
- }
- __flush_tlb_all();
-@@ -864,8 +864,8 @@ int kern_addr_valid(unsigned long addr)
- static struct vm_area_struct gate_vma = {
- .vm_start = VSYSCALL_START,
- .vm_end = VSYSCALL_START + (VSYSCALL_MAPPED_PAGES * PAGE_SIZE),
-- .vm_page_prot = PAGE_READONLY_EXEC,
-- .vm_flags = VM_READ | VM_EXEC
-+ .vm_page_prot = PAGE_READONLY,
-+ .vm_flags = VM_READ
- };
-
- struct vm_area_struct *get_gate_vma(struct task_struct *tsk)
-@@ -899,7 +899,7 @@ int in_gate_area_no_task(unsigned long addr)
-
- const char *arch_vma_name(struct vm_area_struct *vma)
- {
-- if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
-+ if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
- return "[vdso]";
- if (vma == &gate_vma)
- return "[vsyscall]";
-diff --git a/arch/x86/mm/iomap_32.c b/arch/x86/mm/iomap_32.c
-index 84e236c..69bd3f6 100644
---- a/arch/x86/mm/iomap_32.c
-+++ b/arch/x86/mm/iomap_32.c
-@@ -65,7 +65,11 @@ void *kmap_atomic_prot_pfn(unsigned long pfn, enum km_type type, pgprot_t prot)
- debug_kmap_atomic(type);
- idx = type + KM_TYPE_NR * smp_processor_id();
- vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
-+
-+ pax_open_kernel();
- set_pte(kmap_pte - idx, pfn_pte(pfn, prot));
-+ pax_close_kernel();
-+
- arch_flush_lazy_mmu_mode();
-
- return (void *)vaddr;
-diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
-index 2feb9bd..4d4be88 100644
---- a/arch/x86/mm/ioremap.c
-+++ b/arch/x86/mm/ioremap.c
-@@ -41,8 +41,8 @@ int page_is_ram(unsigned long pagenr)
- * Second special case: Some BIOSen report the PC BIOS
- * area (640->1Mb) as ram even though it is not.
- */
-- if (pagenr >= (BIOS_BEGIN >> PAGE_SHIFT) &&
-- pagenr < (BIOS_END >> PAGE_SHIFT))
-+ if (pagenr >= (ISA_START_ADDRESS >> PAGE_SHIFT) &&
-+ pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
- return 0;
-
- for (i = 0; i < e820.nr_map; i++) {
-@@ -137,13 +137,10 @@ static void __iomem *__ioremap_caller(resource_size_t phys_addr,
- /*
- * Don't allow anybody to remap normal RAM that we're using..
- */
-- for (pfn = phys_addr >> PAGE_SHIFT;
-- (pfn << PAGE_SHIFT) < (last_addr & PAGE_MASK);
-- pfn++) {
--
-+ for (pfn = phys_addr >> PAGE_SHIFT; ((resource_size_t)pfn << PAGE_SHIFT) < (last_addr & PAGE_MASK); pfn++) {
- int is_ram = page_is_ram(pfn);
-
-- if (is_ram && pfn_valid(pfn) && !PageReserved(pfn_to_page(pfn)))
-+ if (is_ram && pfn_valid(pfn) && (pfn >= 0x100 || !PageReserved(pfn_to_page(pfn))))
- return NULL;
- WARN_ON_ONCE(is_ram);
- }
-@@ -319,7 +316,7 @@ EXPORT_SYMBOL(ioremap_prot);
- *
- * Caller must ensure there is only one unmapping for the same pointer.
- */
--void iounmap(volatile void __iomem *addr)
-+void iounmap(const volatile void __iomem *addr)
- {
- struct vm_struct *p, *o;
-
-@@ -378,6 +375,9 @@ void *xlate_dev_mem_ptr(unsigned long phys)
-
- /* If page is RAM, we can use __va. Otherwise ioremap and unmap. */
- if (page_is_ram(start >> PAGE_SHIFT))
-+#ifdef CONFIG_HIGHMEM
-+ if ((start >> PAGE_SHIFT) < max_low_pfn)
-+#endif
- return __va(phys);
-
- addr = (void __force *)ioremap_default(start, PAGE_SIZE);
-@@ -407,7 +407,7 @@ static int __init early_ioremap_debug_setup(char *str)
- early_param("early_ioremap_debug", early_ioremap_debug_setup);
-
- static __initdata int after_paging_init;
--static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __page_aligned_bss;
-+static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __read_only __aligned(PAGE_SIZE);
-
- static inline pmd_t * __init early_ioremap_pmd(unsigned long addr)
- {
-@@ -439,8 +439,7 @@ void __init early_ioremap_init(void)
- slot_virt[i] = __fix_to_virt(FIX_BTMAP_BEGIN - NR_FIX_BTMAPS*i);
-
- pmd = early_ioremap_pmd(fix_to_virt(FIX_BTMAP_BEGIN));
-- memset(bm_pte, 0, sizeof(bm_pte));
-- pmd_populate_kernel(&init_mm, pmd, bm_pte);
-+ pmd_populate_user(&init_mm, pmd, bm_pte);
-
- /*
- * The boot-ioremap range spans multiple pmds, for which
-diff --git a/arch/x86/mm/kmemcheck/kmemcheck.c b/arch/x86/mm/kmemcheck/kmemcheck.c
-index 8cc1833..1abbc5b 100644
---- a/arch/x86/mm/kmemcheck/kmemcheck.c
-+++ b/arch/x86/mm/kmemcheck/kmemcheck.c
-@@ -622,9 +622,9 @@ bool kmemcheck_fault(struct pt_regs *regs, unsigned long address,
- * memory (e.g. tracked pages)? For now, we need this to avoid
- * invoking kmemcheck for PnP BIOS calls.
- */
-- if (regs->flags & X86_VM_MASK)
-+ if (v8086_mode(regs))
- return false;
-- if (regs->cs != __KERNEL_CS)
-+ if (regs->cs != __KERNEL_CS && regs->cs != __KERNEXEC_KERNEL_CS)
- return false;
-
- pte = kmemcheck_pte_lookup(address);
-diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
-index c9e57af..07a321b 100644
---- a/arch/x86/mm/mmap.c
-+++ b/arch/x86/mm/mmap.c
-@@ -49,7 +49,7 @@ static unsigned int stack_maxrandom_size(void)
- * Leave an at least ~128 MB hole with possible stack randomization.
- */
- #define MIN_GAP (128*1024*1024UL + stack_maxrandom_size())
--#define MAX_GAP (TASK_SIZE/6*5)
-+#define MAX_GAP (pax_task_size/6*5)
-
- /*
- * True on X86_32 or when emulating IA32 on X86_64
-@@ -94,27 +94,40 @@ static unsigned long mmap_rnd(void)
- return rnd << PAGE_SHIFT;
- }
-
--static unsigned long mmap_base(void)
-+static unsigned long mmap_base(struct mm_struct *mm)
- {
- unsigned long gap = current->signal->rlim[RLIMIT_STACK].rlim_cur;
-+ unsigned long pax_task_size = TASK_SIZE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+ pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-
- if (gap < MIN_GAP)
- gap = MIN_GAP;
- else if (gap > MAX_GAP)
- gap = MAX_GAP;
-
-- return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
-+ return PAGE_ALIGN(pax_task_size - gap - mmap_rnd());
- }
-
- /*
- * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
- * does, but not when emulating X86_32
- */
--static unsigned long mmap_legacy_base(void)
-+static unsigned long mmap_legacy_base(struct mm_struct *mm)
- {
-- if (mmap_is_ia32())
-+ if (mmap_is_ia32()) {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+ return SEGMEXEC_TASK_UNMAPPED_BASE;
-+ else
-+#endif
-+
- return TASK_UNMAPPED_BASE;
-- else
-+ } else
- return TASK_UNMAPPED_BASE + mmap_rnd();
- }
-
-@@ -125,11 +138,23 @@ static unsigned long mmap_legacy_base(void)
- void arch_pick_mmap_layout(struct mm_struct *mm)
- {
- if (mmap_is_legacy()) {
-- mm->mmap_base = mmap_legacy_base();
-+ mm->mmap_base = mmap_legacy_base(mm);
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- mm->get_unmapped_area = arch_get_unmapped_area;
- mm->unmap_area = arch_unmap_area;
- } else {
-- mm->mmap_base = mmap_base();
-+ mm->mmap_base = mmap_base(mm);
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
-+#endif
-+
- mm->get_unmapped_area = arch_get_unmapped_area_topdown;
- mm->unmap_area = arch_unmap_area_topdown;
- }
-diff --git a/arch/x86/mm/mmio-mod.c b/arch/x86/mm/mmio-mod.c
-index 132772a..3c81fd2 100644
---- a/arch/x86/mm/mmio-mod.c
-+++ b/arch/x86/mm/mmio-mod.c
-@@ -193,7 +193,7 @@ static void pre(struct kmmio_probe *p, struct pt_regs *regs,
- break;
- default:
- {
-- unsigned char *ip = (unsigned char *)instptr;
-+ unsigned char *ip = (unsigned char *)ktla_ktva(instptr);
- my_trace->opcode = MMIO_UNKNOWN_OP;
- my_trace->width = 0;
- my_trace->value = (*ip) << 16 | *(ip + 1) << 8 |
-@@ -233,7 +233,7 @@ static void post(struct kmmio_probe *p, unsigned long condition,
- static void ioremap_trace_core(resource_size_t offset, unsigned long size,
- void __iomem *addr)
- {
-- static atomic_t next_id;
-+ static atomic_unchecked_t next_id;
- struct remap_trace *trace = kmalloc(sizeof(*trace), GFP_KERNEL);
- /* These are page-unaligned. */
- struct mmiotrace_map map = {
-@@ -257,7 +257,7 @@ static void ioremap_trace_core(resource_size_t offset, unsigned long size,
- .private = trace
- },
- .phys = offset,
-- .id = atomic_inc_return(&next_id)
-+ .id = atomic_inc_return_unchecked(&next_id)
- };
- map.map_id = trace->id;
-
-@@ -289,7 +289,7 @@ void mmiotrace_ioremap(resource_size_t offset, unsigned long size,
- ioremap_trace_core(offset, size, addr);
- }
-
--static void iounmap_trace_core(volatile void __iomem *addr)
-+static void iounmap_trace_core(const volatile void __iomem *addr)
- {
- struct mmiotrace_map map = {
- .phys = 0,
-@@ -327,7 +327,7 @@ not_enabled:
- }
- }
-
--void mmiotrace_iounmap(volatile void __iomem *addr)
-+void mmiotrace_iounmap(const volatile void __iomem *addr)
- {
- might_sleep();
- if (is_enabled()) /* recheck and proper locking in *_core() */
-diff --git a/arch/x86/mm/numa_32.c b/arch/x86/mm/numa_32.c
-index d253006..e56dd6a 100644
---- a/arch/x86/mm/numa_32.c
-+++ b/arch/x86/mm/numa_32.c
-@@ -98,7 +98,6 @@ unsigned long node_memmap_size_bytes(int nid, unsigned long start_pfn,
- }
- #endif
-
--extern unsigned long find_max_low_pfn(void);
- extern unsigned long highend_pfn, highstart_pfn;
-
- #define LARGE_PAGE_BYTES (PTRS_PER_PTE * PAGE_SIZE)
-diff --git a/arch/x86/mm/pageattr-test.c b/arch/x86/mm/pageattr-test.c
-index e1d1069..2251ff3 100644
---- a/arch/x86/mm/pageattr-test.c
-+++ b/arch/x86/mm/pageattr-test.c
-@@ -36,7 +36,7 @@ enum {
-
- static int pte_testbit(pte_t pte)
- {
-- return pte_flags(pte) & _PAGE_UNUSED1;
-+ return pte_flags(pte) & _PAGE_CPA_TEST;
- }
-
- struct split_state {
-diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
-index 6d44087..6609b55 100644
---- a/arch/x86/mm/pageattr.c
-+++ b/arch/x86/mm/pageattr.c
-@@ -259,16 +259,17 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
- * PCI BIOS based config access (CONFIG_PCI_GOBIOS) support.
- */
- if (within(pfn, BIOS_BEGIN >> PAGE_SHIFT, BIOS_END >> PAGE_SHIFT))
-- pgprot_val(forbidden) |= _PAGE_NX;
-+ pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
-
- /*
- * The kernel text needs to be executable for obvious reasons
- * Does not cover __inittext since that is gone later on. On
- * 64bit we do not enforce !NX on the low mapping
- */
-- if (within(address, (unsigned long)_text, (unsigned long)_etext))
-- pgprot_val(forbidden) |= _PAGE_NX;
-+ if (within(address, ktla_ktva((unsigned long)_text), ktla_ktva((unsigned long)_etext)))
-+ pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
-
-+#ifdef CONFIG_DEBUG_RODATA
- /*
- * The .rodata section needs to be read-only. Using the pfn
- * catches all aliases.
-@@ -276,6 +277,14 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
- if (within(pfn, __pa((unsigned long)__start_rodata) >> PAGE_SHIFT,
- __pa((unsigned long)__end_rodata) >> PAGE_SHIFT))
- pgprot_val(forbidden) |= _PAGE_RW;
-+#endif
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ if (within(pfn, __pa(ktla_ktva((unsigned long)&_text)), __pa((unsigned long)&_sdata))) {
-+ pgprot_val(forbidden) |= _PAGE_RW;
-+ pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
-+ }
-+#endif
-
- prot = __pgprot(pgprot_val(prot) & ~pgprot_val(forbidden));
-
-@@ -329,23 +338,37 @@ EXPORT_SYMBOL_GPL(lookup_address);
- static void __set_pmd_pte(pte_t *kpte, unsigned long address, pte_t pte)
- {
- /* change init_mm */
-+ pax_open_kernel();
- set_pte_atomic(kpte, pte);
-+
- #ifdef CONFIG_X86_32
- if (!SHARED_KERNEL_PMD) {
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ unsigned long cpu;
-+#else
- struct page *page;
-+#endif
-
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ for (cpu = 0; cpu < nr_cpu_ids; ++cpu) {
-+ pgd_t *pgd = get_cpu_pgd(cpu);
-+#else
- list_for_each_entry(page, &pgd_list, lru) {
-- pgd_t *pgd;
-+ pgd_t *pgd = (pgd_t *)page_address(page);
-+#endif
-+
- pud_t *pud;
- pmd_t *pmd;
-
-- pgd = (pgd_t *)page_address(page) + pgd_index(address);
-+ pgd += pgd_index(address);
- pud = pud_offset(pgd, address);
- pmd = pmd_offset(pud, address);
- set_pte_atomic((pte_t *)pmd, pte);
- }
- }
- #endif
-+ pax_close_kernel();
- }
-
- static int
-diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
-index e78cd0e..de0a817 100644
---- a/arch/x86/mm/pat.c
-+++ b/arch/x86/mm/pat.c
-@@ -258,7 +258,7 @@ chk_conflict(struct memtype *new, struct memtype *entry, unsigned long *type)
-
- conflict:
- printk(KERN_INFO "%s:%d conflicting memory types "
-- "%Lx-%Lx %s<->%s\n", current->comm, current->pid, new->start,
-+ "%Lx-%Lx %s<->%s\n", current->comm, task_pid_nr(current), new->start,
- new->end, cattr_name(new->type), cattr_name(entry->type));
- return -EBUSY;
- }
-@@ -559,7 +559,7 @@ unlock_ret:
-
- if (err) {
- printk(KERN_INFO "%s:%d freeing invalid memtype %Lx-%Lx\n",
-- current->comm, current->pid, start, end);
-+ current->comm, task_pid_nr(current), start, end);
- }
-
- dprintk("free_memtype request 0x%Lx-0x%Lx\n", start, end);
-@@ -689,8 +689,8 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
- while (cursor < to) {
- if (!devmem_is_allowed(pfn)) {
- printk(KERN_INFO
-- "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
-- current->comm, from, to);
-+ "Program %s tried to access /dev/mem between %Lx->%Lx (%Lx).\n",
-+ current->comm, from, to, cursor);
- return 0;
- }
- cursor += PAGE_SIZE;
-@@ -755,7 +755,7 @@ int kernel_map_sync_memtype(u64 base, unsigned long size, unsigned long flags)
- printk(KERN_INFO
- "%s:%d ioremap_change_attr failed %s "
- "for %Lx-%Lx\n",
-- current->comm, current->pid,
-+ current->comm, task_pid_nr(current),
- cattr_name(flags),
- base, (unsigned long long)(base + size));
- return -EINVAL;
-@@ -813,7 +813,7 @@ static int reserve_pfn_range(u64 paddr, unsigned long size, pgprot_t *vma_prot,
- free_memtype(paddr, paddr + size);
- printk(KERN_ERR "%s:%d map pfn expected mapping type %s"
- " for %Lx-%Lx, got %s\n",
-- current->comm, current->pid,
-+ current->comm, task_pid_nr(current),
- cattr_name(want_flags),
- (unsigned long long)paddr,
- (unsigned long long)(paddr + size),
-diff --git a/arch/x86/mm/pf_in.c b/arch/x86/mm/pf_in.c
-index df3d5c8..c2223e1 100644
---- a/arch/x86/mm/pf_in.c
-+++ b/arch/x86/mm/pf_in.c
-@@ -148,7 +148,7 @@ enum reason_type get_ins_type(unsigned long ins_addr)
- int i;
- enum reason_type rv = OTHERS;
-
-- p = (unsigned char *)ins_addr;
-+ p = (unsigned char *)ktla_ktva(ins_addr);
- p += skip_prefix(p, &prf);
- p += get_opcode(p, &opcode);
-
-@@ -168,7 +168,7 @@ static unsigned int get_ins_reg_width(unsigned long ins_addr)
- struct prefix_bits prf;
- int i;
-
-- p = (unsigned char *)ins_addr;
-+ p = (unsigned char *)ktla_ktva(ins_addr);
- p += skip_prefix(p, &prf);
- p += get_opcode(p, &opcode);
-
-@@ -191,7 +191,7 @@ unsigned int get_ins_mem_width(unsigned long ins_addr)
- struct prefix_bits prf;
- int i;
-
-- p = (unsigned char *)ins_addr;
-+ p = (unsigned char *)ktla_ktva(ins_addr);
- p += skip_prefix(p, &prf);
- p += get_opcode(p, &opcode);
-
-@@ -417,7 +417,7 @@ unsigned long get_ins_reg_val(unsigned long ins_addr, struct pt_regs *regs)
- int i;
- unsigned long rv;
-
-- p = (unsigned char *)ins_addr;
-+ p = (unsigned char *)ktla_ktva(ins_addr);
- p += skip_prefix(p, &prf);
- p += get_opcode(p, &opcode);
- for (i = 0; i < ARRAY_SIZE(reg_rop); i++)
-@@ -472,7 +472,7 @@ unsigned long get_ins_imm_val(unsigned long ins_addr)
- int i;
- unsigned long rv;
-
-- p = (unsigned char *)ins_addr;
-+ p = (unsigned char *)ktla_ktva(ins_addr);
- p += skip_prefix(p, &prf);
- p += get_opcode(p, &opcode);
- for (i = 0; i < ARRAY_SIZE(imm_wop); i++)
-diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
-index cb7cfc8..84a438a 100644
---- a/arch/x86/mm/pgtable.c
-+++ b/arch/x86/mm/pgtable.c
-@@ -83,9 +83,64 @@ static inline void pgd_list_del(pgd_t *pgd)
- list_del(&page->lru);
- }
-
--#define UNSHARED_PTRS_PER_PGD \
-- (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+pgdval_t clone_pgd_mask __read_only = ~_PAGE_PRESENT;
-
-+void __shadow_user_pgds(pgd_t *dst, const pgd_t *src)
-+{
-+ unsigned int count = USER_PGD_PTRS;
-+
-+ while (count--)
-+ *dst++ = __pgd((pgd_val(*src++) | (_PAGE_NX & __supported_pte_mask)) & ~_PAGE_USER);
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+void __clone_user_pgds(pgd_t *dst, const pgd_t *src)
-+{
-+ unsigned int count = USER_PGD_PTRS;
-+
-+ while (count--) {
-+ pgd_t pgd;
-+
-+#ifdef CONFIG_X86_64
-+ pgd = __pgd(pgd_val(*src++) | _PAGE_USER);
-+#else
-+ pgd = *src++;
-+#endif
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ pgd = __pgd(pgd_val(pgd) & clone_pgd_mask);
-+#endif
-+
-+ *dst++ = pgd;
-+ }
-+
-+}
-+#endif
-+
-+#ifdef CONFIG_X86_64
-+#define pxd_t pud_t
-+#define pyd_t pgd_t
-+#define paravirt_release_pxd(pfn) paravirt_release_pud(pfn)
-+#define pxd_free(mm, pud) pud_free((mm), (pud))
-+#define pyd_populate(mm, pgd, pud) pgd_populate((mm), (pgd), (pud))
-+#define pyd_offset(mm, address) pgd_offset((mm), (address))
-+#define PYD_SIZE PGDIR_SIZE
-+#else
-+#define pxd_t pmd_t
-+#define pyd_t pud_t
-+#define paravirt_release_pxd(pfn) paravirt_release_pmd(pfn)
-+#define pxd_free(mm, pud) pmd_free((mm), (pud))
-+#define pyd_populate(mm, pgd, pud) pud_populate((mm), (pgd), (pud))
-+#define pyd_offset(mm, address) pud_offset((mm), (address))
-+#define PYD_SIZE PUD_SIZE
-+#endif
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+static inline void pgd_ctor(pgd_t *pgd) {}
-+static inline void pgd_dtor(pgd_t *pgd) {}
-+#else
- static void pgd_ctor(pgd_t *pgd)
- {
- /* If the pgd points to a shared pagetable level (either the
-@@ -117,6 +172,7 @@ static void pgd_dtor(pgd_t *pgd)
- pgd_list_del(pgd);
- spin_unlock(&pgd_lock);
- }
-+#endif
-
- /*
- * List of all pgd's needed for non-PAE so it can invalidate entries
-@@ -129,7 +185,7 @@ static void pgd_dtor(pgd_t *pgd)
- * -- wli
- */
-
--#ifdef CONFIG_X86_PAE
-+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
- /*
- * In PAE mode, we need to do a cr3 reload (=tlb flush) when
- * updating the top-level pagetable entries to guarantee the
-@@ -141,7 +197,7 @@ static void pgd_dtor(pgd_t *pgd)
- * not shared between pagetables (!SHARED_KERNEL_PMDS), we allocate
- * and initialize the kernel pmds here.
- */
--#define PREALLOCATED_PMDS UNSHARED_PTRS_PER_PGD
-+#define PREALLOCATED_PXDS (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
-
- void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
- {
-@@ -159,36 +215,38 @@ void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
- */
- flush_tlb_mm(mm);
- }
-+#elif defined(CONFIG_X86_64) && defined(CONFIG_PAX_PER_CPU_PGD)
-+#define PREALLOCATED_PXDS USER_PGD_PTRS
- #else /* !CONFIG_X86_PAE */
-
- /* No need to prepopulate any pagetable entries in non-PAE modes. */
--#define PREALLOCATED_PMDS 0
-+#define PREALLOCATED_PXDS 0
-
- #endif /* CONFIG_X86_PAE */
-
--static void free_pmds(pmd_t *pmds[])
-+static void free_pxds(pxd_t *pxds[])
- {
- int i;
-
-- for(i = 0; i < PREALLOCATED_PMDS; i++)
-- if (pmds[i])
-- free_page((unsigned long)pmds[i]);
-+ for(i = 0; i < PREALLOCATED_PXDS; i++)
-+ if (pxds[i])
-+ free_page((unsigned long)pxds[i]);
- }
-
--static int preallocate_pmds(pmd_t *pmds[])
-+static int preallocate_pxds(pxd_t *pxds[])
- {
- int i;
- bool failed = false;
-
-- for(i = 0; i < PREALLOCATED_PMDS; i++) {
-- pmd_t *pmd = (pmd_t *)__get_free_page(PGALLOC_GFP);
-- if (pmd == NULL)
-+ for(i = 0; i < PREALLOCATED_PXDS; i++) {
-+ pxd_t *pxd = (pxd_t *)__get_free_page(PGALLOC_GFP);
-+ if (pxd == NULL)
- failed = true;
-- pmds[i] = pmd;
-+ pxds[i] = pxd;
- }
-
- if (failed) {
-- free_pmds(pmds);
-+ free_pxds(pxds);
- return -ENOMEM;
- }
-
-@@ -201,51 +259,55 @@ static int preallocate_pmds(pmd_t *pmds[])
- * preallocate which never got a corresponding vma will need to be
- * freed manually.
- */
--static void pgd_mop_up_pmds(struct mm_struct *mm, pgd_t *pgdp)
-+static void pgd_mop_up_pxds(struct mm_struct *mm, pgd_t *pgdp)
- {
- int i;
-
-- for(i = 0; i < PREALLOCATED_PMDS; i++) {
-+ for(i = 0; i < PREALLOCATED_PXDS; i++) {
- pgd_t pgd = pgdp[i];
-
- if (pgd_val(pgd) != 0) {
-- pmd_t *pmd = (pmd_t *)pgd_page_vaddr(pgd);
-+ pxd_t *pxd = (pxd_t *)pgd_page_vaddr(pgd);
-
-- pgdp[i] = native_make_pgd(0);
-+ set_pgd(pgdp + i, native_make_pgd(0));
-
-- paravirt_release_pmd(pgd_val(pgd) >> PAGE_SHIFT);
-- pmd_free(mm, pmd);
-+ paravirt_release_pxd(pgd_val(pgd) >> PAGE_SHIFT);
-+ pxd_free(mm, pxd);
- }
- }
- }
-
--static void pgd_prepopulate_pmd(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmds[])
-+static void pgd_prepopulate_pxd(struct mm_struct *mm, pgd_t *pgd, pxd_t *pxds[])
- {
-- pud_t *pud;
-+ pyd_t *pyd;
- unsigned long addr;
- int i;
-
-- if (PREALLOCATED_PMDS == 0) /* Work around gcc-3.4.x bug */
-+ if (PREALLOCATED_PXDS == 0) /* Work around gcc-3.4.x bug */
- return;
-
-- pud = pud_offset(pgd, 0);
-+#ifdef CONFIG_X86_64
-+ pyd = pyd_offset(mm, 0L);
-+#else
-+ pyd = pyd_offset(pgd, 0L);
-+#endif
-
-- for (addr = i = 0; i < PREALLOCATED_PMDS;
-- i++, pud++, addr += PUD_SIZE) {
-- pmd_t *pmd = pmds[i];
-+ for (addr = i = 0; i < PREALLOCATED_PXDS;
-+ i++, pyd++, addr += PYD_SIZE) {
-+ pxd_t *pxd = pxds[i];
-
- if (i >= KERNEL_PGD_BOUNDARY)
-- memcpy(pmd, (pmd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
-- sizeof(pmd_t) * PTRS_PER_PMD);
-+ memcpy(pxd, (pxd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
-+ sizeof(pxd_t) * PTRS_PER_PMD);
-
-- pud_populate(mm, pud, pmd);
-+ pyd_populate(mm, pyd, pxd);
- }
- }
-
- pgd_t *pgd_alloc(struct mm_struct *mm)
- {
- pgd_t *pgd;
-- pmd_t *pmds[PREALLOCATED_PMDS];
-+ pxd_t *pxds[PREALLOCATED_PXDS];
-
- pgd = (pgd_t *)__get_free_page(PGALLOC_GFP);
-
-@@ -254,11 +316,11 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
-
- mm->pgd = pgd;
-
-- if (preallocate_pmds(pmds) != 0)
-+ if (preallocate_pxds(pxds) != 0)
- goto out_free_pgd;
-
- if (paravirt_pgd_alloc(mm) != 0)
-- goto out_free_pmds;
-+ goto out_free_pxds;
-
- /*
- * Make sure that pre-populating the pmds is atomic with
-@@ -268,14 +330,14 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
- spin_lock(&pgd_lock);
-
- pgd_ctor(pgd);
-- pgd_prepopulate_pmd(mm, pgd, pmds);
-+ pgd_prepopulate_pxd(mm, pgd, pxds);
-
- spin_unlock(&pgd_lock);
-
- return pgd;
-
--out_free_pmds:
-- free_pmds(pmds);
-+out_free_pxds:
-+ free_pxds(pxds);
- out_free_pgd:
- free_page((unsigned long)pgd);
- out:
-@@ -284,7 +346,7 @@ out:
-
- void pgd_free(struct mm_struct *mm, pgd_t *pgd)
- {
-- pgd_mop_up_pmds(mm, pgd);
-+ pgd_mop_up_pxds(mm, pgd);
- pgd_dtor(pgd);
- paravirt_pgd_free(mm, pgd);
- free_page((unsigned long)pgd);
-diff --git a/arch/x86/mm/pgtable_32.c b/arch/x86/mm/pgtable_32.c
-index 46c8834..fcab43d 100644
---- a/arch/x86/mm/pgtable_32.c
-+++ b/arch/x86/mm/pgtable_32.c
-@@ -49,10 +49,13 @@ void set_pte_vaddr(unsigned long vaddr, pte_t pteval)
- return;
- }
- pte = pte_offset_kernel(pmd, vaddr);
-+
-+ pax_open_kernel();
- if (pte_val(pteval))
- set_pte_at(&init_mm, vaddr, pte, pteval);
- else
- pte_clear(&init_mm, vaddr, pte);
-+ pax_close_kernel();
-
- /*
- * It's enough to flush this one mapping.
-diff --git a/arch/x86/mm/setup_nx.c b/arch/x86/mm/setup_nx.c
-index 513d8ed..978c161 100644
---- a/arch/x86/mm/setup_nx.c
-+++ b/arch/x86/mm/setup_nx.c
-@@ -4,11 +4,10 @@
-
- #include <asm/pgtable.h>
-
-+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
- int nx_enabled;
-
--#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
--static int disable_nx __cpuinitdata;
--
-+#ifndef CONFIG_PAX_PAGEEXEC
- /*
- * noexec = on|off
- *
-@@ -22,32 +21,26 @@ static int __init noexec_setup(char *str)
- if (!str)
- return -EINVAL;
- if (!strncmp(str, "on", 2)) {
-- __supported_pte_mask |= _PAGE_NX;
-- disable_nx = 0;
-+ nx_enabled = 1;
- } else if (!strncmp(str, "off", 3)) {
-- disable_nx = 1;
-- __supported_pte_mask &= ~_PAGE_NX;
-+ nx_enabled = 0;
- }
- return 0;
- }
- early_param("noexec", noexec_setup);
- #endif
-+#endif
-
- #ifdef CONFIG_X86_PAE
- void __init set_nx(void)
- {
-- unsigned int v[4], l, h;
-+ if (!nx_enabled && cpu_has_nx) {
-+ unsigned l, h;
-
-- if (cpu_has_pae && (cpuid_eax(0x80000000) > 0x80000001)) {
-- cpuid(0x80000001, &v[0], &v[1], &v[2], &v[3]);
--
-- if ((v[3] & (1 << 20)) && !disable_nx) {
-- rdmsr(MSR_EFER, l, h);
-- l |= EFER_NX;
-- wrmsr(MSR_EFER, l, h);
-- nx_enabled = 1;
-- __supported_pte_mask |= _PAGE_NX;
-- }
-+ __supported_pte_mask &= ~_PAGE_NX;
-+ rdmsr(MSR_EFER, l, h);
-+ l &= ~EFER_NX;
-+ wrmsr(MSR_EFER, l, h);
- }
- }
- #else
-@@ -62,7 +55,7 @@ void __cpuinit check_efer(void)
- unsigned long efer;
-
- rdmsrl(MSR_EFER, efer);
-- if (!(efer & EFER_NX) || disable_nx)
-+ if (!(efer & EFER_NX) || !nx_enabled)
- __supported_pte_mask &= ~_PAGE_NX;
- }
- #endif
-diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
-index 36fe08e..b123d3a 100644
---- a/arch/x86/mm/tlb.c
-+++ b/arch/x86/mm/tlb.c
-@@ -61,7 +61,11 @@ void leave_mm(int cpu)
- BUG();
- cpumask_clear_cpu(cpu,
- mm_cpumask(percpu_read(cpu_tlbstate.active_mm)));
-+
-+#ifndef CONFIG_PAX_PER_CPU_PGD
- load_cr3(swapper_pg_dir);
-+#endif
-+
- }
- EXPORT_SYMBOL_GPL(leave_mm);
-
-diff --git a/arch/x86/oprofile/backtrace.c b/arch/x86/oprofile/backtrace.c
-index b50a280..ada6ded 100644
---- a/arch/x86/oprofile/backtrace.c
-+++ b/arch/x86/oprofile/backtrace.c
-@@ -115,7 +115,7 @@ x86_backtrace(struct pt_regs * const regs, unsigned int depth)
- {
- struct frame_head *head = (struct frame_head *)frame_pointer(regs);
-
-- if (!user_mode_vm(regs)) {
-+ if (!user_mode(regs)) {
- unsigned long stack = kernel_stack_pointer(regs);
- if (depth)
- dump_trace(NULL, regs, (unsigned long *)stack, 0,
-diff --git a/arch/x86/oprofile/op_model_p4.c b/arch/x86/oprofile/op_model_p4.c
-index e6a160a..36deff6 100644
---- a/arch/x86/oprofile/op_model_p4.c
-+++ b/arch/x86/oprofile/op_model_p4.c
-@@ -50,7 +50,7 @@ static inline void setup_num_counters(void)
- #endif
- }
-
--static int inline addr_increment(void)
-+static inline int addr_increment(void)
- {
- #ifdef CONFIG_SMP
- return smp_num_siblings == 2 ? 2 : 1;
-diff --git a/arch/x86/pci/common.c b/arch/x86/pci/common.c
-index 1331fcf..03901b2 100644
---- a/arch/x86/pci/common.c
-+++ b/arch/x86/pci/common.c
-@@ -31,8 +31,8 @@ int noioapicreroute = 1;
- int pcibios_last_bus = -1;
- unsigned long pirq_table_addr;
- struct pci_bus *pci_root_bus;
--struct pci_raw_ops *raw_pci_ops;
--struct pci_raw_ops *raw_pci_ext_ops;
-+const struct pci_raw_ops *raw_pci_ops;
-+const struct pci_raw_ops *raw_pci_ext_ops;
-
- int raw_pci_read(unsigned int domain, unsigned int bus, unsigned int devfn,
- int reg, int len, u32 *val)
-diff --git a/arch/x86/pci/direct.c b/arch/x86/pci/direct.c
-index 347d882..4baf6b6 100644
---- a/arch/x86/pci/direct.c
-+++ b/arch/x86/pci/direct.c
-@@ -79,7 +79,7 @@ static int pci_conf1_write(unsigned int seg, unsigned int bus,
-
- #undef PCI_CONF1_ADDRESS
-
--struct pci_raw_ops pci_direct_conf1 = {
-+const struct pci_raw_ops pci_direct_conf1 = {
- .read = pci_conf1_read,
- .write = pci_conf1_write,
- };
-@@ -173,7 +173,7 @@ static int pci_conf2_write(unsigned int seg, unsigned int bus,
-
- #undef PCI_CONF2_ADDRESS
-
--struct pci_raw_ops pci_direct_conf2 = {
-+const struct pci_raw_ops pci_direct_conf2 = {
- .read = pci_conf2_read,
- .write = pci_conf2_write,
- };
-@@ -189,7 +189,7 @@ struct pci_raw_ops pci_direct_conf2 = {
- * This should be close to trivial, but it isn't, because there are buggy
- * chipsets (yes, you guessed it, by Intel and Compaq) that have no class ID.
- */
--static int __init pci_sanity_check(struct pci_raw_ops *o)
-+static int __init pci_sanity_check(const struct pci_raw_ops *o)
- {
- u32 x = 0;
- int year, devfn;
-diff --git a/arch/x86/pci/mmconfig-shared.c b/arch/x86/pci/mmconfig-shared.c
-index 602c172..28703ae 100644
---- a/arch/x86/pci/mmconfig-shared.c
-+++ b/arch/x86/pci/mmconfig-shared.c
-@@ -340,8 +340,7 @@ static void __init pci_mmcfg_insert_resources(void)
- char *names;
- unsigned num_buses;
-
-- res = kcalloc(PCI_MMCFG_RESOURCE_NAME_LEN + sizeof(*res),
-- pci_mmcfg_config_num, GFP_KERNEL);
-+ res = kcalloc(pci_mmcfg_config_num, PCI_MMCFG_RESOURCE_NAME_LEN + sizeof(*res), GFP_KERNEL);
- if (!res) {
- printk(KERN_ERR "PCI: Unable to allocate MMCONFIG resources\n");
- return;
-diff --git a/arch/x86/pci/mmconfig_32.c b/arch/x86/pci/mmconfig_32.c
-index f10a7e9..0425342 100644
---- a/arch/x86/pci/mmconfig_32.c
-+++ b/arch/x86/pci/mmconfig_32.c
-@@ -125,7 +125,7 @@ static int pci_mmcfg_write(unsigned int seg, unsigned int bus,
- return 0;
- }
-
--static struct pci_raw_ops pci_mmcfg = {
-+static const struct pci_raw_ops pci_mmcfg = {
- .read = pci_mmcfg_read,
- .write = pci_mmcfg_write,
- };
-diff --git a/arch/x86/pci/mmconfig_64.c b/arch/x86/pci/mmconfig_64.c
-index 94349f8..41600a7 100644
---- a/arch/x86/pci/mmconfig_64.c
-+++ b/arch/x86/pci/mmconfig_64.c
-@@ -104,7 +104,7 @@ static int pci_mmcfg_write(unsigned int seg, unsigned int bus,
- return 0;
- }
-
--static struct pci_raw_ops pci_mmcfg = {
-+static const struct pci_raw_ops pci_mmcfg = {
- .read = pci_mmcfg_read,
- .write = pci_mmcfg_write,
- };
-diff --git a/arch/x86/pci/numaq_32.c b/arch/x86/pci/numaq_32.c
-index 8eb295e..86bd657 100644
---- a/arch/x86/pci/numaq_32.c
-+++ b/arch/x86/pci/numaq_32.c
-@@ -112,7 +112,7 @@ static int pci_conf1_mq_write(unsigned int seg, unsigned int bus,
-
- #undef PCI_CONF1_MQ_ADDRESS
-
--static struct pci_raw_ops pci_direct_conf1_mq = {
-+static const struct pci_raw_ops pci_direct_conf1_mq = {
- .read = pci_conf1_mq_read,
- .write = pci_conf1_mq_write
- };
-diff --git a/arch/x86/pci/olpc.c b/arch/x86/pci/olpc.c
-index b889d82..5a58a0a 100644
---- a/arch/x86/pci/olpc.c
-+++ b/arch/x86/pci/olpc.c
-@@ -297,7 +297,7 @@ static int pci_olpc_write(unsigned int seg, unsigned int bus,
- return 0;
- }
-
--static struct pci_raw_ops pci_olpc_conf = {
-+static const struct pci_raw_ops pci_olpc_conf = {
- .read = pci_olpc_read,
- .write = pci_olpc_write,
- };
-diff --git a/arch/x86/pci/pcbios.c b/arch/x86/pci/pcbios.c
-index 1c975cc..b8e16c2 100644
---- a/arch/x86/pci/pcbios.c
-+++ b/arch/x86/pci/pcbios.c
-@@ -56,50 +56,93 @@ union bios32 {
- static struct {
- unsigned long address;
- unsigned short segment;
--} bios32_indirect = { 0, __KERNEL_CS };
-+} bios32_indirect __read_only = { 0, __PCIBIOS_CS };
-
- /*
- * Returns the entry point for the given service, NULL on error
- */
-
--static unsigned long bios32_service(unsigned long service)
-+static unsigned long __devinit bios32_service(unsigned long service)
- {
- unsigned char return_code; /* %al */
- unsigned long address; /* %ebx */
- unsigned long length; /* %ecx */
- unsigned long entry; /* %edx */
- unsigned long flags;
-+ struct desc_struct d, *gdt;
-
- local_irq_save(flags);
-- __asm__("lcall *(%%edi); cld"
-+
-+ gdt = get_cpu_gdt_table(smp_processor_id());
-+
-+ pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x9B, 0xC);
-+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
-+ pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x93, 0xC);
-+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
-+
-+ __asm__("movw %w7, %%ds; lcall *(%%edi); push %%ss; pop %%ds; cld"
- : "=a" (return_code),
- "=b" (address),
- "=c" (length),
- "=d" (entry)
- : "0" (service),
- "1" (0),
-- "D" (&bios32_indirect));
-+ "D" (&bios32_indirect),
-+ "r"(__PCIBIOS_DS)
-+ : "memory");
-+
-+ pax_open_kernel();
-+ gdt[GDT_ENTRY_PCIBIOS_CS].a = 0;
-+ gdt[GDT_ENTRY_PCIBIOS_CS].b = 0;
-+ gdt[GDT_ENTRY_PCIBIOS_DS].a = 0;
-+ gdt[GDT_ENTRY_PCIBIOS_DS].b = 0;
-+ pax_close_kernel();
-+
- local_irq_restore(flags);
-
- switch (return_code) {
-- case 0:
-- return address + entry;
-- case 0x80: /* Not present */
-- printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
-- return 0;
-- default: /* Shouldn't happen */
-- printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
-- service, return_code);
-+ case 0: {
-+ int cpu;
-+ unsigned char flags;
-+
-+ printk(KERN_INFO "bios32_service: base:%08lx length:%08lx entry:%08lx\n", address, length, entry);
-+ if (address >= 0xFFFF0 || length > 0x100000 - address || length <= entry) {
-+ printk(KERN_WARNING "bios32_service: not valid\n");
- return 0;
-+ }
-+ address = address + PAGE_OFFSET;
-+ length += 16UL; /* some BIOSs underreport this... */
-+ flags = 4;
-+ if (length >= 64*1024*1024) {
-+ length >>= PAGE_SHIFT;
-+ flags |= 8;
-+ }
-+
-+ for (cpu = 0; cpu < nr_cpu_ids; cpu++) {
-+ gdt = get_cpu_gdt_table(cpu);
-+ pack_descriptor(&d, address, length, 0x9b, flags);
-+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
-+ pack_descriptor(&d, address, length, 0x93, flags);
-+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
-+ }
-+ return entry;
-+ }
-+ case 0x80: /* Not present */
-+ printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
-+ return 0;
-+ default: /* Shouldn't happen */
-+ printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
-+ service, return_code);
-+ return 0;
- }
- }
-
- static struct {
- unsigned long address;
- unsigned short segment;
--} pci_indirect = { 0, __KERNEL_CS };
-+} pci_indirect __read_only = { 0, __PCIBIOS_CS };
-
--static int pci_bios_present;
-+static int pci_bios_present __read_only;
-
- static int __devinit check_pcibios(void)
- {
-@@ -108,11 +151,13 @@ static int __devinit check_pcibios(void)
- unsigned long flags, pcibios_entry;
-
- if ((pcibios_entry = bios32_service(PCI_SERVICE))) {
-- pci_indirect.address = pcibios_entry + PAGE_OFFSET;
-+ pci_indirect.address = pcibios_entry;
-
- local_irq_save(flags);
-- __asm__(
-- "lcall *(%%edi); cld\n\t"
-+ __asm__("movw %w6, %%ds\n\t"
-+ "lcall *%%ss:(%%edi); cld\n\t"
-+ "push %%ss\n\t"
-+ "pop %%ds\n\t"
- "jc 1f\n\t"
- "xor %%ah, %%ah\n"
- "1:"
-@@ -121,7 +166,8 @@ static int __devinit check_pcibios(void)
- "=b" (ebx),
- "=c" (ecx)
- : "1" (PCIBIOS_PCI_BIOS_PRESENT),
-- "D" (&pci_indirect)
-+ "D" (&pci_indirect),
-+ "r" (__PCIBIOS_DS)
- : "memory");
- local_irq_restore(flags);
-
-@@ -165,7 +211,10 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
-
- switch (len) {
- case 1:
-- __asm__("lcall *(%%esi); cld\n\t"
-+ __asm__("movw %w6, %%ds\n\t"
-+ "lcall *%%ss:(%%esi); cld\n\t"
-+ "push %%ss\n\t"
-+ "pop %%ds\n\t"
- "jc 1f\n\t"
- "xor %%ah, %%ah\n"
- "1:"
-@@ -174,7 +223,8 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
- : "1" (PCIBIOS_READ_CONFIG_BYTE),
- "b" (bx),
- "D" ((long)reg),
-- "S" (&pci_indirect));
-+ "S" (&pci_indirect),
-+ "r" (__PCIBIOS_DS));
- /*
- * Zero-extend the result beyond 8 bits, do not trust the
- * BIOS having done it:
-@@ -182,7 +232,10 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
- *value &= 0xff;
- break;
- case 2:
-- __asm__("lcall *(%%esi); cld\n\t"
-+ __asm__("movw %w6, %%ds\n\t"
-+ "lcall *%%ss:(%%esi); cld\n\t"
-+ "push %%ss\n\t"
-+ "pop %%ds\n\t"
- "jc 1f\n\t"
- "xor %%ah, %%ah\n"
- "1:"
-@@ -191,7 +244,8 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
- : "1" (PCIBIOS_READ_CONFIG_WORD),
- "b" (bx),
- "D" ((long)reg),
-- "S" (&pci_indirect));
-+ "S" (&pci_indirect),
-+ "r" (__PCIBIOS_DS));
- /*
- * Zero-extend the result beyond 16 bits, do not trust the
- * BIOS having done it:
-@@ -199,7 +253,10 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
- *value &= 0xffff;
- break;
- case 4:
-- __asm__("lcall *(%%esi); cld\n\t"
-+ __asm__("movw %w6, %%ds\n\t"
-+ "lcall *%%ss:(%%esi); cld\n\t"
-+ "push %%ss\n\t"
-+ "pop %%ds\n\t"
- "jc 1f\n\t"
- "xor %%ah, %%ah\n"
- "1:"
-@@ -208,7 +265,8 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
- : "1" (PCIBIOS_READ_CONFIG_DWORD),
- "b" (bx),
- "D" ((long)reg),
-- "S" (&pci_indirect));
-+ "S" (&pci_indirect),
-+ "r" (__PCIBIOS_DS));
- break;
- }
-
-@@ -231,7 +289,10 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
-
- switch (len) {
- case 1:
-- __asm__("lcall *(%%esi); cld\n\t"
-+ __asm__("movw %w6, %%ds\n\t"
-+ "lcall *%%ss:(%%esi); cld\n\t"
-+ "push %%ss\n\t"
-+ "pop %%ds\n\t"
- "jc 1f\n\t"
- "xor %%ah, %%ah\n"
- "1:"
-@@ -240,10 +301,14 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
- "c" (value),
- "b" (bx),
- "D" ((long)reg),
-- "S" (&pci_indirect));
-+ "S" (&pci_indirect),
-+ "r" (__PCIBIOS_DS));
- break;
- case 2:
-- __asm__("lcall *(%%esi); cld\n\t"
-+ __asm__("movw %w6, %%ds\n\t"
-+ "lcall *%%ss:(%%esi); cld\n\t"
-+ "push %%ss\n\t"
-+ "pop %%ds\n\t"
- "jc 1f\n\t"
- "xor %%ah, %%ah\n"
- "1:"
-@@ -252,10 +317,14 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
- "c" (value),
- "b" (bx),
- "D" ((long)reg),
-- "S" (&pci_indirect));
-+ "S" (&pci_indirect),
-+ "r" (__PCIBIOS_DS));
- break;
- case 4:
-- __asm__("lcall *(%%esi); cld\n\t"
-+ __asm__("movw %w6, %%ds\n\t"
-+ "lcall *%%ss:(%%esi); cld\n\t"
-+ "push %%ss\n\t"
-+ "pop %%ds\n\t"
- "jc 1f\n\t"
- "xor %%ah, %%ah\n"
- "1:"
-@@ -264,7 +333,8 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
- "c" (value),
- "b" (bx),
- "D" ((long)reg),
-- "S" (&pci_indirect));
-+ "S" (&pci_indirect),
-+ "r" (__PCIBIOS_DS));
- break;
- }
-
-@@ -278,7 +348,7 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
- * Function table for BIOS32 access
- */
-
--static struct pci_raw_ops pci_bios_access = {
-+static const struct pci_raw_ops pci_bios_access = {
- .read = pci_bios_read,
- .write = pci_bios_write
- };
-@@ -287,7 +357,7 @@ static struct pci_raw_ops pci_bios_access = {
- * Try to find PCI BIOS.
- */
-
--static struct pci_raw_ops * __devinit pci_find_bios(void)
-+static const struct pci_raw_ops * __devinit pci_find_bios(void)
- {
- union bios32 *check;
- unsigned char sum;
-@@ -368,10 +438,13 @@ struct irq_routing_table * pcibios_get_irq_routing_table(void)
-
- DBG("PCI: Fetching IRQ routing table... ");
- __asm__("push %%es\n\t"
-+ "movw %w8, %%ds\n\t"
- "push %%ds\n\t"
- "pop %%es\n\t"
-- "lcall *(%%esi); cld\n\t"
-+ "lcall *%%ss:(%%esi); cld\n\t"
- "pop %%es\n\t"
-+ "push %%ss\n\t"
-+ "pop %%ds\n"
- "jc 1f\n\t"
- "xor %%ah, %%ah\n"
- "1:"
-@@ -382,7 +455,8 @@ struct irq_routing_table * pcibios_get_irq_routing_table(void)
- "1" (0),
- "D" ((long) &opt),
- "S" (&pci_indirect),
-- "m" (opt)
-+ "m" (opt),
-+ "r" (__PCIBIOS_DS)
- : "memory");
- DBG("OK ret=%d, size=%d, map=%x\n", ret, opt.size, map);
- if (ret & 0xff00)
-@@ -406,7 +480,10 @@ int pcibios_set_irq_routing(struct pci_dev *dev, int pin, int irq)
- {
- int ret;
-
-- __asm__("lcall *(%%esi); cld\n\t"
-+ __asm__("movw %w5, %%ds\n\t"
-+ "lcall *%%ss:(%%esi); cld\n\t"
-+ "push %%ss\n\t"
-+ "pop %%ds\n"
- "jc 1f\n\t"
- "xor %%ah, %%ah\n"
- "1:"
-@@ -414,7 +491,8 @@ int pcibios_set_irq_routing(struct pci_dev *dev, int pin, int irq)
- : "0" (PCIBIOS_SET_PCI_HW_INT),
- "b" ((dev->bus->number << 8) | dev->devfn),
- "c" ((irq << 8) | (pin + 10)),
-- "S" (&pci_indirect));
-+ "S" (&pci_indirect),
-+ "r" (__PCIBIOS_DS));
- return !(ret & 0xff00);
- }
- EXPORT_SYMBOL(pcibios_set_irq_routing);
-diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c
-index fa0f651..462a948 100644
---- a/arch/x86/power/cpu.c
-+++ b/arch/x86/power/cpu.c
-@@ -129,7 +129,7 @@ static void do_fpu_end(void)
- static void fix_processor_context(void)
- {
- int cpu = smp_processor_id();
-- struct tss_struct *t = &per_cpu(init_tss, cpu);
-+ struct tss_struct *t = init_tss + cpu;
-
- set_tss_desc(cpu, t); /*
- * This just modifies memory; should not be
-@@ -139,8 +139,6 @@ static void fix_processor_context(void)
- */
-
- #ifdef CONFIG_X86_64
-- get_cpu_gdt_table(cpu)[GDT_ENTRY_TSS].type = 9;
--
- syscall_init(); /* This sets MSR_*STAR and related */
- #endif
- load_TR_desc(); /* This does ltr */
-diff --git a/arch/x86/vdso/Makefile b/arch/x86/vdso/Makefile
-index dd78ef6..f9d928d 100644
---- a/arch/x86/vdso/Makefile
-+++ b/arch/x86/vdso/Makefile
-@@ -122,7 +122,7 @@ quiet_cmd_vdso = VDSO $@
- $(VDSO_LDFLAGS) $(VDSO_LDFLAGS_$(filter %.lds,$(^F))) \
- -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^)
-
--VDSO_LDFLAGS = -fPIC -shared $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
-+VDSO_LDFLAGS = -fPIC -shared -Wl,--no-undefined $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
- GCOV_PROFILE := n
-
- #
-diff --git a/arch/x86/vdso/vclock_gettime.c b/arch/x86/vdso/vclock_gettime.c
-index ee55754..0013b2e 100644
---- a/arch/x86/vdso/vclock_gettime.c
-+++ b/arch/x86/vdso/vclock_gettime.c
-@@ -22,24 +22,48 @@
- #include <asm/hpet.h>
- #include <asm/unistd.h>
- #include <asm/io.h>
-+#include <asm/fixmap.h>
- #include "vextern.h"
-
- #define gtod vdso_vsyscall_gtod_data
-
-+notrace noinline long __vdso_fallback_time(long *t)
-+{
-+ long secs;
-+ asm volatile("syscall"
-+ : "=a" (secs)
-+ : "0" (__NR_time),"D" (t) : "r11", "cx", "memory");
-+ return secs;
-+}
-+
- notrace static long vdso_fallback_gettime(long clock, struct timespec *ts)
- {
- long ret;
- asm("syscall" : "=a" (ret) :
-- "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "memory");
-+ "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "r11", "cx", "memory");
- return ret;
- }
-
-+notrace static inline cycle_t __vdso_vread_hpet(void)
-+{
-+ return readl((const void __iomem *)fix_to_virt(VSYSCALL_HPET) + 0xf0);
-+}
-+
-+notrace static inline cycle_t __vdso_vread_tsc(void)
-+{
-+ cycle_t ret = (cycle_t)vget_cycles();
-+
-+ return ret >= gtod->clock.cycle_last ? ret : gtod->clock.cycle_last;
-+}
-+
- notrace static inline long vgetns(void)
- {
- long v;
-- cycles_t (*vread)(void);
-- vread = gtod->clock.vread;
-- v = (vread() - gtod->clock.cycle_last) & gtod->clock.mask;
-+ if (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3])
-+ v = __vdso_vread_tsc();
-+ else
-+ v = __vdso_vread_hpet();
-+ v = (v - gtod->clock.cycle_last) & gtod->clock.mask;
- return (v * gtod->clock.mult) >> gtod->clock.shift;
- }
-
-@@ -113,7 +137,9 @@ notrace static noinline int do_monotonic_coarse(struct timespec *ts)
-
- notrace int __vdso_clock_gettime(clockid_t clock, struct timespec *ts)
- {
-- if (likely(gtod->sysctl_enabled))
-+ if (likely(gtod->sysctl_enabled &&
-+ ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
-+ (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
- switch (clock) {
- case CLOCK_REALTIME:
- if (likely(gtod->clock.vread))
-@@ -133,10 +159,20 @@ notrace int __vdso_clock_gettime(clockid_t clock, struct timespec *ts)
- int clock_gettime(clockid_t, struct timespec *)
- __attribute__((weak, alias("__vdso_clock_gettime")));
-
-+notrace noinline int __vdso_fallback_gettimeofday(struct timeval *tv, struct timezone *tz)
-+{
-+ long ret;
-+ asm("syscall" : "=a" (ret) :
-+ "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "r11", "cx", "memory");
-+ return ret;
-+}
-+
- notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
- {
-- long ret;
-- if (likely(gtod->sysctl_enabled && gtod->clock.vread)) {
-+ if (likely(gtod->sysctl_enabled &&
-+ ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
-+ (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
-+ {
- if (likely(tv != NULL)) {
- BUILD_BUG_ON(offsetof(struct timeval, tv_usec) !=
- offsetof(struct timespec, tv_nsec) ||
-@@ -151,9 +187,7 @@ notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
- }
- return 0;
- }
-- asm("syscall" : "=a" (ret) :
-- "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "memory");
-- return ret;
-+ return __vdso_fallback_gettimeofday(tv, tz);
- }
- int gettimeofday(struct timeval *, struct timezone *)
- __attribute__((weak, alias("__vdso_gettimeofday")));
-diff --git a/arch/x86/vdso/vdso.lds.S b/arch/x86/vdso/vdso.lds.S
-index 4e5dd3b..00ba15e 100644
---- a/arch/x86/vdso/vdso.lds.S
-+++ b/arch/x86/vdso/vdso.lds.S
-@@ -35,3 +35,9 @@ VDSO64_PRELINK = VDSO_PRELINK;
- #define VEXTERN(x) VDSO64_ ## x = vdso_ ## x;
- #include "vextern.h"
- #undef VEXTERN
-+
-+#define VEXTERN(x) VDSO64_ ## x = __vdso_ ## x;
-+VEXTERN(fallback_gettimeofday)
-+VEXTERN(fallback_time)
-+VEXTERN(getcpu)
-+#undef VEXTERN
-diff --git a/arch/x86/vdso/vdso32-setup.c b/arch/x86/vdso/vdso32-setup.c
-index 58bc00f..d53fb48 100644
---- a/arch/x86/vdso/vdso32-setup.c
-+++ b/arch/x86/vdso/vdso32-setup.c
-@@ -25,6 +25,7 @@
- #include <asm/tlbflush.h>
- #include <asm/vdso.h>
- #include <asm/proto.h>
-+#include <asm/mman.h>
-
- enum {
- VDSO_DISABLED = 0,
-@@ -226,7 +227,7 @@ static inline void map_compat_vdso(int map)
- void enable_sep_cpu(void)
- {
- int cpu = get_cpu();
-- struct tss_struct *tss = &per_cpu(init_tss, cpu);
-+ struct tss_struct *tss = init_tss + cpu;
-
- if (!boot_cpu_has(X86_FEATURE_SEP)) {
- put_cpu();
-@@ -249,7 +250,7 @@ static int __init gate_vma_init(void)
- gate_vma.vm_start = FIXADDR_USER_START;
- gate_vma.vm_end = FIXADDR_USER_END;
- gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
-- gate_vma.vm_page_prot = __P101;
-+ gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
- /*
- * Make sure the vDSO gets into every core dump.
- * Dumping its contents makes post-mortem fully interpretable later
-@@ -331,14 +332,14 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
- if (compat)
- addr = VDSO_HIGH_BASE;
- else {
-- addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
-+ addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, MAP_EXECUTABLE);
- if (IS_ERR_VALUE(addr)) {
- ret = addr;
- goto up_fail;
- }
- }
-
-- current->mm->context.vdso = (void *)addr;
-+ current->mm->context.vdso = addr;
-
- if (compat_uses_vma || !compat) {
- /*
-@@ -361,11 +362,11 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
- }
-
- current_thread_info()->sysenter_return =
-- VDSO32_SYMBOL(addr, SYSENTER_RETURN);
-+ (__force void __user *)VDSO32_SYMBOL(addr, SYSENTER_RETURN);
-
- up_fail:
- if (ret)
-- current->mm->context.vdso = NULL;
-+ current->mm->context.vdso = 0;
-
- up_write(&mm->mmap_sem);
-
-@@ -413,8 +414,14 @@ __initcall(ia32_binfmt_init);
-
- const char *arch_vma_name(struct vm_area_struct *vma)
- {
-- if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
-+ if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
- return "[vdso]";
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (vma->vm_mm && vma->vm_mirror && vma->vm_mirror->vm_start == vma->vm_mm->context.vdso)
-+ return "[vdso]";
-+#endif
-+
- return NULL;
- }
-
-@@ -423,7 +430,7 @@ struct vm_area_struct *get_gate_vma(struct task_struct *tsk)
- struct mm_struct *mm = tsk->mm;
-
- /* Check to see if this task was created in compat vdso mode */
-- if (mm && mm->context.vdso == (void *)VDSO_HIGH_BASE)
-+ if (mm && mm->context.vdso == VDSO_HIGH_BASE)
- return &gate_vma;
- return NULL;
- }
-diff --git a/arch/x86/vdso/vextern.h b/arch/x86/vdso/vextern.h
-index 1683ba2..48d07f3 100644
---- a/arch/x86/vdso/vextern.h
-+++ b/arch/x86/vdso/vextern.h
-@@ -11,6 +11,5 @@
- put into vextern.h and be referenced as a pointer with vdso prefix.
- The main kernel later fills in the values. */
-
--VEXTERN(jiffies)
- VEXTERN(vgetcpu_mode)
- VEXTERN(vsyscall_gtod_data)
-diff --git a/arch/x86/vdso/vma.c b/arch/x86/vdso/vma.c
-index 21e1aeb..2c0b3c4 100644
---- a/arch/x86/vdso/vma.c
-+++ b/arch/x86/vdso/vma.c
-@@ -17,8 +17,6 @@
- #include "vextern.h" /* Just for VMAGIC. */
- #undef VEXTERN
-
--unsigned int __read_mostly vdso_enabled = 1;
--
- extern char vdso_start[], vdso_end[];
- extern unsigned short vdso_sync_cpuid;
-
-@@ -27,10 +25,8 @@ static unsigned vdso_size;
-
- static inline void *var_ref(void *p, char *name)
- {
-- if (*(void **)p != (void *)VMAGIC) {
-- printk("VDSO: variable %s broken\n", name);
-- vdso_enabled = 0;
-- }
-+ if (*(void **)p != (void *)VMAGIC)
-+ panic("VDSO: variable %s broken\n", name);
- return p;
- }
-
-@@ -57,21 +53,18 @@ static int __init init_vdso_vars(void)
- if (!vbase)
- goto oom;
-
-- if (memcmp(vbase, "\177ELF", 4)) {
-- printk("VDSO: I'm broken; not ELF\n");
-- vdso_enabled = 0;
-- }
-+ if (memcmp(vbase, ELFMAG, SELFMAG))
-+ panic("VDSO: I'm broken; not ELF\n");
-
- #define VEXTERN(x) \
- *(typeof(__ ## x) **) var_ref(VDSO64_SYMBOL(vbase, x), #x) = &__ ## x;
- #include "vextern.h"
- #undef VEXTERN
-+ vunmap(vbase);
- return 0;
-
- oom:
-- printk("Cannot allocate vdso\n");
-- vdso_enabled = 0;
-- return -ENOMEM;
-+ panic("Cannot allocate vdso\n");
- }
- __initcall(init_vdso_vars);
-
-@@ -102,13 +95,15 @@ static unsigned long vdso_addr(unsigned long start, unsigned len)
- int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
- {
- struct mm_struct *mm = current->mm;
-- unsigned long addr;
-+ unsigned long addr = 0;
- int ret;
-
-- if (!vdso_enabled)
-- return 0;
--
- down_write(&mm->mmap_sem);
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- addr = vdso_addr(mm->start_stack, vdso_size);
- addr = get_unmapped_area(NULL, addr, vdso_size, 0, 0);
- if (IS_ERR_VALUE(addr)) {
-@@ -116,7 +111,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
- goto up_fail;
- }
-
-- current->mm->context.vdso = (void *)addr;
-+ current->mm->context.vdso = addr;
-
- ret = install_special_mapping(mm, addr, vdso_size,
- VM_READ|VM_EXEC|
-@@ -124,7 +119,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
- VM_ALWAYSDUMP,
- vdso_pages);
- if (ret) {
-- current->mm->context.vdso = NULL;
-+ current->mm->context.vdso = 0;
- goto up_fail;
- }
-
-@@ -132,10 +127,3 @@ up_fail:
- up_write(&mm->mmap_sem);
- return ret;
- }
--
--static __init int vdso_setup(char *s)
--{
-- vdso_enabled = simple_strtoul(s, NULL, 0);
-- return 0;
--}
--__setup("vdso=", vdso_setup);
-diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
-index 126a093..c9313db 100644
---- a/arch/x86/xen/enlighten.c
-+++ b/arch/x86/xen/enlighten.c
-@@ -71,8 +71,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
-
- struct shared_info xen_dummy_shared_info;
-
--void *xen_initial_gdt;
--
- /*
- * Point at some empty memory to start with. We map the real shared_info
- * page as soon as fixmap is up and running.
-@@ -336,8 +334,7 @@ static void xen_load_gdt(const struct desc_ptr *dtr)
- {
- unsigned long va = dtr->address;
- unsigned int size = dtr->size + 1;
-- unsigned pages = (size + PAGE_SIZE - 1) / PAGE_SIZE;
-- unsigned long frames[pages];
-+ unsigned long frames[(GDT_SIZE + PAGE_SIZE - 1) / PAGE_SIZE];
- int f;
-
- /*
-@@ -345,7 +342,7 @@ static void xen_load_gdt(const struct desc_ptr *dtr)
- * 8-byte entries, or 16 4k pages..
- */
-
-- BUG_ON(size > 65536);
-+ BUG_ON(size > GDT_SIZE);
- BUG_ON(va & ~PAGE_MASK);
-
- for (f = 0; va < dtr->address + size; va += PAGE_SIZE, f++) {
-@@ -385,8 +382,7 @@ static __init void xen_load_gdt_boot(const struct desc_ptr *dtr)
- {
- unsigned long va = dtr->address;
- unsigned int size = dtr->size + 1;
-- unsigned pages = (size + PAGE_SIZE - 1) / PAGE_SIZE;
-- unsigned long frames[pages];
-+ unsigned long frames[65536 / PAGE_SIZE];
- int f;
-
- /*
-@@ -548,7 +544,7 @@ static void xen_write_idt_entry(gate_desc *dt, int entrynum, const gate_desc *g)
-
- preempt_disable();
-
-- start = __get_cpu_var(idt_desc).address;
-+ start = (unsigned long)__get_cpu_var(idt_desc).address;
- end = start + __get_cpu_var(idt_desc).size + 1;
-
- xen_mc_flush();
-@@ -1012,25 +1008,25 @@ static const struct pv_apic_ops xen_apic_ops __initdata = {
- #endif
- };
-
--static void xen_reboot(int reason)
-+static __noreturn void xen_reboot(int reason)
- {
- struct sched_shutdown r = { .reason = reason };
-
-- if (HYPERVISOR_sched_op(SCHEDOP_shutdown, &r))
-- BUG();
-+ HYPERVISOR_sched_op(SCHEDOP_shutdown, &r);
-+ BUG();
- }
-
--static void xen_restart(char *msg)
-+static __noreturn void xen_restart(char *msg)
- {
- xen_reboot(SHUTDOWN_reboot);
- }
-
--static void xen_emergency_restart(void)
-+static __noreturn void xen_emergency_restart(void)
- {
- xen_reboot(SHUTDOWN_reboot);
- }
-
--static void xen_machine_halt(void)
-+static __noreturn void xen_machine_halt(void)
- {
- xen_reboot(SHUTDOWN_poweroff);
- }
-@@ -1078,10 +1074,10 @@ asmlinkage void __init xen_start_kernel(void)
-
- /* Install Xen paravirt ops */
- pv_info = xen_info;
-- pv_init_ops = xen_init_ops;
-- pv_time_ops = xen_time_ops;
-- pv_cpu_ops = xen_cpu_ops;
-- pv_apic_ops = xen_apic_ops;
-+ memcpy((void *)&pv_init_ops, &xen_init_ops, sizeof pv_init_ops);
-+ memcpy((void *)&pv_time_ops, &xen_time_ops, sizeof pv_time_ops);
-+ memcpy((void *)&pv_cpu_ops, &xen_cpu_ops, sizeof pv_cpu_ops);
-+ memcpy((void *)&pv_apic_ops, &xen_apic_ops, sizeof pv_apic_ops);
-
- x86_init.resources.memory_setup = xen_memory_setup;
- x86_init.oem.arch_setup = xen_arch_setup;
-@@ -1114,9 +1110,20 @@ asmlinkage void __init xen_start_kernel(void)
- */
- __userpte_alloc_gfp &= ~__GFP_HIGHMEM;
-
--#ifdef CONFIG_X86_64
- /* Work out if we support NX */
-- check_efer();
-+#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
-+ if ((cpuid_eax(0x80000000) & 0xffff0000) == 0x80000000 &&
-+ (cpuid_edx(0x80000001) & (1U << (X86_FEATURE_NX & 31)))) {
-+ unsigned l, h;
-+
-+#ifdef CONFIG_X86_PAE
-+ nx_enabled = 1;
-+#endif
-+ __supported_pte_mask |= _PAGE_NX;
-+ rdmsr(MSR_EFER, l, h);
-+ l |= EFER_NX;
-+ wrmsr(MSR_EFER, l, h);
-+ }
- #endif
-
- xen_setup_features();
-@@ -1148,13 +1155,6 @@ asmlinkage void __init xen_start_kernel(void)
-
- machine_ops = xen_machine_ops;
-
-- /*
-- * The only reliable way to retain the initial address of the
-- * percpu gdt_page is to remember it here, so we can go and
-- * mark it RW later, when the initial percpu area is freed.
-- */
-- xen_initial_gdt = &per_cpu(gdt_page, 0);
--
- xen_smp_init();
-
- pgd = (pgd_t *)xen_start_info->pt_base;
-diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
-index 8f4452c..38873e5 100644
---- a/arch/x86/xen/mmu.c
-+++ b/arch/x86/xen/mmu.c
-@@ -1717,6 +1717,9 @@ __init pgd_t *xen_setup_kernel_pagetable(pgd_t *pgd,
- convert_pfn_mfn(init_level4_pgt);
- convert_pfn_mfn(level3_ident_pgt);
- convert_pfn_mfn(level3_kernel_pgt);
-+ convert_pfn_mfn(level3_vmalloc_start_pgt);
-+ convert_pfn_mfn(level3_vmalloc_end_pgt);
-+ convert_pfn_mfn(level3_vmemmap_pgt);
-
- l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd);
- l2 = m2v(l3[pud_index(__START_KERNEL_map)].pud);
-@@ -1735,7 +1738,11 @@ __init pgd_t *xen_setup_kernel_pagetable(pgd_t *pgd,
- set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
- set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
- set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
-+ set_page_prot(level3_vmalloc_start_pgt, PAGE_KERNEL_RO);
-+ set_page_prot(level3_vmalloc_end_pgt, PAGE_KERNEL_RO);
-+ set_page_prot(level3_vmemmap_pgt, PAGE_KERNEL_RO);
- set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
-+ set_page_prot(level2_vmemmap_pgt, PAGE_KERNEL_RO);
- set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
- set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
-
-@@ -1858,6 +1865,7 @@ static __init void xen_post_allocator_init(void)
- pv_mmu_ops.set_pud = xen_set_pud;
- #if PAGETABLE_LEVELS == 4
- pv_mmu_ops.set_pgd = xen_set_pgd;
-+ pv_mmu_ops.set_pgd_batched = xen_set_pgd;
- #endif
-
- /* This will work as long as patching hasn't happened yet
-@@ -1944,6 +1952,7 @@ static const struct pv_mmu_ops xen_mmu_ops __initdata = {
- .pud_val = PV_CALLEE_SAVE(xen_pud_val),
- .make_pud = PV_CALLEE_SAVE(xen_make_pud),
- .set_pgd = xen_set_pgd_hyper,
-+ .set_pgd_batched = xen_set_pgd_hyper,
-
- .alloc_pud = xen_alloc_pmd_init,
- .release_pud = xen_release_pmd_init,
-diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
-index ad0047f..cfec0c4 100644
---- a/arch/x86/xen/setup.c
-+++ b/arch/x86/xen/setup.c
-@@ -14,6 +14,7 @@
- #include <asm/e820.h>
- #include <asm/setup.h>
- #include <asm/acpi.h>
-+#include <asm/numa.h>
- #include <asm/xen/hypervisor.h>
- #include <asm/xen/hypercall.h>
-
-@@ -191,4 +192,7 @@ void __init xen_arch_setup(void)
- paravirt_disable_iospace();
-
- fiddle_vdso();
-+#ifdef CONFIG_NUMA
-+ numa_off = 1;
-+#endif
- }
-diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
-index a96204a..4d2ebba 100644
---- a/arch/x86/xen/smp.c
-+++ b/arch/x86/xen/smp.c
-@@ -168,11 +168,6 @@ static void __init xen_smp_prepare_boot_cpu(void)
- {
- BUG_ON(smp_processor_id() != 0);
- native_smp_prepare_boot_cpu();
--
-- /* We've switched to the "real" per-cpu gdt, so make sure the
-- old memory can be recycled */
-- make_lowmem_page_readwrite(xen_initial_gdt);
--
- xen_setup_vcpu_info_placement();
- }
-
-@@ -241,12 +236,12 @@ cpu_initialize_context(unsigned int cpu, struct task_struct *idle)
- gdt = get_cpu_gdt_table(cpu);
-
- ctxt->flags = VGCF_IN_KERNEL;
-- ctxt->user_regs.ds = __USER_DS;
-- ctxt->user_regs.es = __USER_DS;
-+ ctxt->user_regs.ds = __KERNEL_DS;
-+ ctxt->user_regs.es = __KERNEL_DS;
- ctxt->user_regs.ss = __KERNEL_DS;
- #ifdef CONFIG_X86_32
- ctxt->user_regs.fs = __KERNEL_PERCPU;
-- ctxt->user_regs.gs = __KERNEL_STACK_CANARY;
-+ savesegment(gs, ctxt->user_regs.gs);
- #else
- ctxt->gs_base_kernel = per_cpu_offset(cpu);
- #endif
-@@ -297,13 +292,12 @@ static int __cpuinit xen_cpu_up(unsigned int cpu)
- int rc;
-
- per_cpu(current_task, cpu) = idle;
-+ per_cpu(current_tinfo, cpu) = &idle->tinfo;
- #ifdef CONFIG_X86_32
- irq_ctx_init(cpu);
- #else
- clear_tsk_thread_flag(idle, TIF_FORK);
-- per_cpu(kernel_stack, cpu) =
-- (unsigned long)task_stack_page(idle) -
-- KERNEL_STACK_OFFSET + THREAD_SIZE;
-+ per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(idle) - 16 + THREAD_SIZE;
- #endif
- xen_setup_runstate_info(cpu);
- xen_setup_timer(cpu);
-@@ -485,7 +479,7 @@ static const struct smp_ops xen_smp_ops __initdata = {
-
- void __init xen_smp_init(void)
- {
-- smp_ops = xen_smp_ops;
-+ memcpy((void *)&smp_ops, &xen_smp_ops, sizeof smp_ops);
- xen_fill_possible_map();
- xen_init_spinlocks();
- }
-diff --git a/arch/x86/xen/xen-asm_32.S b/arch/x86/xen/xen-asm_32.S
-index d05bd11..c457aa7 100644
---- a/arch/x86/xen/xen-asm_32.S
-+++ b/arch/x86/xen/xen-asm_32.S
-@@ -83,16 +83,16 @@ ENTRY(xen_iret)
- ESP_OFFSET=4 # bytes pushed onto stack
-
- /*
-- * Store vcpu_info pointer for easy access. Do it this way to
-- * avoid having to reload %fs
-+ * Store vcpu_info pointer for easy access.
- */
- #ifdef CONFIG_SMP
-- GET_THREAD_INFO(%eax)
-- movl %ss:TI_cpu(%eax), %eax
-- movl %ss:__per_cpu_offset(,%eax,4), %eax
-- mov %ss:per_cpu__xen_vcpu(%eax), %eax
-+ push %fs
-+ mov $(__KERNEL_PERCPU), %eax
-+ mov %eax, %fs
-+ mov PER_CPU_VAR(xen_vcpu), %eax
-+ pop %fs
- #else
-- movl %ss:per_cpu__xen_vcpu, %eax
-+ movl %ss:xen_vcpu, %eax
- #endif
-
- /* check IF state we're restoring */
-diff --git a/arch/x86/xen/xen-head.S b/arch/x86/xen/xen-head.S
-index 1a5ff24..a187d40 100644
---- a/arch/x86/xen/xen-head.S
-+++ b/arch/x86/xen/xen-head.S
-@@ -19,6 +19,17 @@ ENTRY(startup_xen)
- #ifdef CONFIG_X86_32
- mov %esi,xen_start_info
- mov $init_thread_union+THREAD_SIZE,%esp
-+#ifdef CONFIG_SMP
-+ movl $cpu_gdt_table,%edi
-+ movl $__per_cpu_load,%eax
-+ movw %ax,__KERNEL_PERCPU + 2(%edi)
-+ rorl $16,%eax
-+ movb %al,__KERNEL_PERCPU + 4(%edi)
-+ movb %ah,__KERNEL_PERCPU + 7(%edi)
-+ movl $__per_cpu_end - 1,%eax
-+ subl $__per_cpu_start,%eax
-+ movw %ax,__KERNEL_PERCPU + 0(%edi)
-+#endif
- #else
- mov %rsi,xen_start_info
- mov $init_thread_union+THREAD_SIZE,%rsp
-diff --git a/arch/x86/xen/xen-ops.h b/arch/x86/xen/xen-ops.h
-index f9153a3..51eab3d 100644
---- a/arch/x86/xen/xen-ops.h
-+++ b/arch/x86/xen/xen-ops.h
-@@ -10,8 +10,6 @@
- extern const char xen_hypervisor_callback[];
- extern const char xen_failsafe_callback[];
-
--extern void *xen_initial_gdt;
--
- struct trap_info;
- void xen_copy_trap_info(struct trap_info *traps);
-
-diff --git a/arch/xtensa/variants/dc232b/include/variant/core.h b/arch/xtensa/variants/dc232b/include/variant/core.h
-index 525bd3d..ef888b1 100644
---- a/arch/xtensa/variants/dc232b/include/variant/core.h
-+++ b/arch/xtensa/variants/dc232b/include/variant/core.h
-@@ -119,9 +119,9 @@
- ----------------------------------------------------------------------*/
-
- #define XCHAL_ICACHE_LINESIZE 32 /* I-cache line size in bytes */
--#define XCHAL_DCACHE_LINESIZE 32 /* D-cache line size in bytes */
- #define XCHAL_ICACHE_LINEWIDTH 5 /* log2(I line size in bytes) */
- #define XCHAL_DCACHE_LINEWIDTH 5 /* log2(D line size in bytes) */
-+#define XCHAL_DCACHE_LINESIZE (_AC(1,UL) << XCHAL_DCACHE_LINEWIDTH) /* D-cache line size in bytes */
-
- #define XCHAL_ICACHE_SIZE 16384 /* I-cache size in bytes or 0 */
- #define XCHAL_DCACHE_SIZE 16384 /* D-cache size in bytes or 0 */
-diff --git a/arch/xtensa/variants/fsf/include/variant/core.h b/arch/xtensa/variants/fsf/include/variant/core.h
-index 2f33760..835e50a 100644
---- a/arch/xtensa/variants/fsf/include/variant/core.h
-+++ b/arch/xtensa/variants/fsf/include/variant/core.h
-@@ -11,6 +11,7 @@
- #ifndef _XTENSA_CORE_H
- #define _XTENSA_CORE_H
-
-+#include <linux/const.h>
-
- /****************************************************************************
- Parameters Useful for Any Code, USER or PRIVILEGED
-@@ -112,9 +113,9 @@
- ----------------------------------------------------------------------*/
-
- #define XCHAL_ICACHE_LINESIZE 16 /* I-cache line size in bytes */
--#define XCHAL_DCACHE_LINESIZE 16 /* D-cache line size in bytes */
- #define XCHAL_ICACHE_LINEWIDTH 4 /* log2(I line size in bytes) */
- #define XCHAL_DCACHE_LINEWIDTH 4 /* log2(D line size in bytes) */
-+#define XCHAL_DCACHE_LINESIZE (_AC(1,UL) << XCHAL_DCACHE_LINEWIDTH) /* D-cache line size in bytes */
-
- #define XCHAL_ICACHE_SIZE 8192 /* I-cache size in bytes or 0 */
- #define XCHAL_DCACHE_SIZE 8192 /* D-cache size in bytes or 0 */
-diff --git a/arch/xtensa/variants/s6000/include/variant/core.h b/arch/xtensa/variants/s6000/include/variant/core.h
-index af00795..2bb8105 100644
---- a/arch/xtensa/variants/s6000/include/variant/core.h
-+++ b/arch/xtensa/variants/s6000/include/variant/core.h
-@@ -11,6 +11,7 @@
- #ifndef _XTENSA_CORE_CONFIGURATION_H
- #define _XTENSA_CORE_CONFIGURATION_H
-
-+#include <linux/const.h>
-
- /****************************************************************************
- Parameters Useful for Any Code, USER or PRIVILEGED
-@@ -118,9 +119,9 @@
- ----------------------------------------------------------------------*/
-
- #define XCHAL_ICACHE_LINESIZE 16 /* I-cache line size in bytes */
--#define XCHAL_DCACHE_LINESIZE 16 /* D-cache line size in bytes */
- #define XCHAL_ICACHE_LINEWIDTH 4 /* log2(I line size in bytes) */
- #define XCHAL_DCACHE_LINEWIDTH 4 /* log2(D line size in bytes) */
-+#define XCHAL_DCACHE_LINESIZE (_AC(1,UL) << XCHAL_DCACHE_LINEWIDTH) /* D-cache line size in bytes */
-
- #define XCHAL_ICACHE_SIZE 32768 /* I-cache size in bytes or 0 */
- #define XCHAL_DCACHE_SIZE 32768 /* D-cache size in bytes or 0 */
-diff --git a/block/blk-integrity.c b/block/blk-integrity.c
-index 15c6308..96e83c2 100644
---- a/block/blk-integrity.c
-+++ b/block/blk-integrity.c
-@@ -278,7 +278,7 @@ static struct attribute *integrity_attrs[] = {
- NULL,
- };
-
--static struct sysfs_ops integrity_ops = {
-+static const struct sysfs_ops integrity_ops = {
- .show = &integrity_attr_show,
- .store = &integrity_attr_store,
- };
-diff --git a/block/blk-iopoll.c b/block/blk-iopoll.c
-index ca56420..f2fc409 100644
---- a/block/blk-iopoll.c
-+++ b/block/blk-iopoll.c
-@@ -77,7 +77,7 @@ void blk_iopoll_complete(struct blk_iopoll *iopoll)
- }
- EXPORT_SYMBOL(blk_iopoll_complete);
-
--static void blk_iopoll_softirq(struct softirq_action *h)
-+static void blk_iopoll_softirq(void)
- {
- struct list_head *list = &__get_cpu_var(blk_cpu_iopoll);
- int rearm = 0, budget = blk_iopoll_budget;
-diff --git a/block/blk-map.c b/block/blk-map.c
-index 30a7e51..0aeec6a 100644
---- a/block/blk-map.c
-+++ b/block/blk-map.c
-@@ -54,7 +54,7 @@ static int __blk_rq_map_user(struct request_queue *q, struct request *rq,
- * direct dma. else, set up kernel bounce buffers
- */
- uaddr = (unsigned long) ubuf;
-- if (blk_rq_aligned(q, ubuf, len) && !map_data)
-+ if (blk_rq_aligned(q, (__force void *)ubuf, len) && !map_data)
- bio = bio_map_user(q, NULL, uaddr, len, reading, gfp_mask);
- else
- bio = bio_copy_user(q, map_data, uaddr, len, reading, gfp_mask);
-@@ -201,12 +201,13 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq,
- for (i = 0; i < iov_count; i++) {
- unsigned long uaddr = (unsigned long)iov[i].iov_base;
-
-+ if (!iov[i].iov_len)
-+ return -EINVAL;
-+
- if (uaddr & queue_dma_alignment(q)) {
- unaligned = 1;
- break;
- }
-- if (!iov[i].iov_len)
-- return -EINVAL;
- }
-
- if (unaligned || (q->dma_pad_mask & len) || map_data)
-@@ -299,7 +300,7 @@ int blk_rq_map_kern(struct request_queue *q, struct request *rq, void *kbuf,
- if (!len || !kbuf)
- return -EINVAL;
-
-- do_copy = !blk_rq_aligned(q, kbuf, len) || object_is_on_stack(kbuf);
-+ do_copy = !blk_rq_aligned(q, kbuf, len) || object_starts_on_stack(kbuf);
- if (do_copy)
- bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
- else
-diff --git a/block/blk-softirq.c b/block/blk-softirq.c
-index ee9c216..58d410a 100644
---- a/block/blk-softirq.c
-+++ b/block/blk-softirq.c
-@@ -17,7 +17,7 @@ static DEFINE_PER_CPU(struct list_head, blk_cpu_done);
- * Softirq action handler - move entries to local list and loop over them
- * while passing them to the queue registered handler.
- */
--static void blk_done_softirq(struct softirq_action *h)
-+static void blk_done_softirq(void)
- {
- struct list_head *cpu_list, local_list;
-
-diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
-index bb9c5ea..5330d48 100644
---- a/block/blk-sysfs.c
-+++ b/block/blk-sysfs.c
-@@ -414,7 +414,7 @@ static void blk_release_queue(struct kobject *kobj)
- kmem_cache_free(blk_requestq_cachep, q);
- }
-
--static struct sysfs_ops queue_sysfs_ops = {
-+static const struct sysfs_ops queue_sysfs_ops = {
- .show = queue_attr_show,
- .store = queue_attr_store,
- };
-diff --git a/block/bsg.c b/block/bsg.c
-index e3e3241..759ebf7 100644
---- a/block/bsg.c
-+++ b/block/bsg.c
-@@ -175,16 +175,24 @@ static int blk_fill_sgv4_hdr_rq(struct request_queue *q, struct request *rq,
- struct sg_io_v4 *hdr, struct bsg_device *bd,
- fmode_t has_write_perm)
- {
-+ unsigned char tmpcmd[sizeof(rq->__cmd)];
-+ unsigned char *cmdptr;
-+
- if (hdr->request_len > BLK_MAX_CDB) {
- rq->cmd = kzalloc(hdr->request_len, GFP_KERNEL);
- if (!rq->cmd)
- return -ENOMEM;
-- }
-+ cmdptr = rq->cmd;
-+ } else
-+ cmdptr = tmpcmd;
-
-- if (copy_from_user(rq->cmd, (void *)(unsigned long)hdr->request,
-+ if (copy_from_user(cmdptr, (void __user *)(unsigned long)hdr->request,
- hdr->request_len))
- return -EFAULT;
-
-+ if (cmdptr != rq->cmd)
-+ memcpy(rq->cmd, cmdptr, hdr->request_len);
-+
- if (hdr->subprotocol == BSG_SUB_PROTOCOL_SCSI_CMD) {
- if (blk_verify_command(rq->cmd, has_write_perm))
- return -EPERM;
-@@ -282,7 +290,7 @@ bsg_map_hdr(struct bsg_device *bd, struct sg_io_v4 *hdr, fmode_t has_write_perm,
- rq->next_rq = next_rq;
- next_rq->cmd_type = rq->cmd_type;
-
-- dxferp = (void*)(unsigned long)hdr->din_xferp;
-+ dxferp = (void __user *)(unsigned long)hdr->din_xferp;
- ret = blk_rq_map_user(q, next_rq, NULL, dxferp,
- hdr->din_xfer_len, GFP_KERNEL);
- if (ret)
-@@ -291,10 +299,10 @@ bsg_map_hdr(struct bsg_device *bd, struct sg_io_v4 *hdr, fmode_t has_write_perm,
-
- if (hdr->dout_xfer_len) {
- dxfer_len = hdr->dout_xfer_len;
-- dxferp = (void*)(unsigned long)hdr->dout_xferp;
-+ dxferp = (void __user *)(unsigned long)hdr->dout_xferp;
- } else if (hdr->din_xfer_len) {
- dxfer_len = hdr->din_xfer_len;
-- dxferp = (void*)(unsigned long)hdr->din_xferp;
-+ dxferp = (void __user *)(unsigned long)hdr->din_xferp;
- } else
- dxfer_len = 0;
-
-@@ -436,7 +444,7 @@ static int blk_complete_sgv4_hdr_rq(struct request *rq, struct sg_io_v4 *hdr,
- int len = min_t(unsigned int, hdr->max_response_len,
- rq->sense_len);
-
-- ret = copy_to_user((void*)(unsigned long)hdr->response,
-+ ret = copy_to_user((void __user *)(unsigned long)hdr->response,
- rq->sense, len);
- if (!ret)
- hdr->response_len = len;
-diff --git a/block/compat_ioctl.c b/block/compat_ioctl.c
-index 9bd086c..ca1fc22 100644
---- a/block/compat_ioctl.c
-+++ b/block/compat_ioctl.c
-@@ -354,7 +354,7 @@ static int compat_fd_ioctl(struct block_device *bdev, fmode_t mode,
- err |= __get_user(f->spec1, &uf->spec1);
- err |= __get_user(f->fmt_gap, &uf->fmt_gap);
- err |= __get_user(name, &uf->name);
-- f->name = compat_ptr(name);
-+ f->name = (void __force_kernel *)compat_ptr(name);
- if (err) {
- err = -EFAULT;
- goto out;
-diff --git a/block/elevator.c b/block/elevator.c
-index a847046..75a1746 100644
---- a/block/elevator.c
-+++ b/block/elevator.c
-@@ -889,7 +889,7 @@ elv_attr_store(struct kobject *kobj, struct attribute *attr,
- return error;
- }
-
--static struct sysfs_ops elv_sysfs_ops = {
-+static const struct sysfs_ops elv_sysfs_ops = {
- .show = elv_attr_show,
- .store = elv_attr_store,
- };
-diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
-index 123eb17..614fbd1 100644
---- a/block/scsi_ioctl.c
-+++ b/block/scsi_ioctl.c
-@@ -221,8 +221,20 @@ EXPORT_SYMBOL(blk_verify_command);
- static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
- struct sg_io_hdr *hdr, fmode_t mode)
- {
-- if (copy_from_user(rq->cmd, hdr->cmdp, hdr->cmd_len))
-+ unsigned char tmpcmd[sizeof(rq->__cmd)];
-+ unsigned char *cmdptr;
-+
-+ if (rq->cmd != rq->__cmd)
-+ cmdptr = rq->cmd;
-+ else
-+ cmdptr = tmpcmd;
-+
-+ if (copy_from_user(cmdptr, hdr->cmdp, hdr->cmd_len))
- return -EFAULT;
-+
-+ if (cmdptr != rq->cmd)
-+ memcpy(rq->cmd, cmdptr, hdr->cmd_len);
-+
- if (blk_verify_command(rq->cmd, mode & FMODE_WRITE))
- return -EPERM;
-
-@@ -431,6 +443,8 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
- int err;
- unsigned int in_len, out_len, bytes, opcode, cmdlen;
- char *buffer = NULL, sense[SCSI_SENSE_BUFFERSIZE];
-+ unsigned char tmpcmd[sizeof(rq->__cmd)];
-+ unsigned char *cmdptr;
-
- if (!sic)
- return -EINVAL;
-@@ -464,9 +478,18 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
- */
- err = -EFAULT;
- rq->cmd_len = cmdlen;
-- if (copy_from_user(rq->cmd, sic->data, cmdlen))
-+
-+ if (rq->cmd != rq->__cmd)
-+ cmdptr = rq->cmd;
-+ else
-+ cmdptr = tmpcmd;
-+
-+ if (copy_from_user(cmdptr, sic->data, cmdlen))
- goto error;
-
-+ if (rq->cmd != cmdptr)
-+ memcpy(rq->cmd, cmdptr, cmdlen);
-+
- if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len))
- goto error;
-
-diff --git a/crypto/cryptd.c b/crypto/cryptd.c
-index 9e1bf69..0efffdb 100644
---- a/crypto/cryptd.c
-+++ b/crypto/cryptd.c
-@@ -50,7 +50,7 @@ struct cryptd_blkcipher_ctx {
-
- struct cryptd_blkcipher_request_ctx {
- crypto_completion_t complete;
--};
-+} __no_const;
-
- struct cryptd_hash_ctx {
- struct crypto_shash *child;
-diff --git a/crypto/gf128mul.c b/crypto/gf128mul.c
-index a90d260..7a9765e 100644
---- a/crypto/gf128mul.c
-+++ b/crypto/gf128mul.c
-@@ -182,7 +182,7 @@ void gf128mul_lle(be128 *r, const be128 *b)
- for (i = 0; i < 7; ++i)
- gf128mul_x_lle(&p[i + 1], &p[i]);
-
-- memset(r, 0, sizeof(r));
-+ memset(r, 0, sizeof(*r));
- for (i = 0;;) {
- u8 ch = ((u8 *)b)[15 - i];
-
-@@ -220,7 +220,7 @@ void gf128mul_bbe(be128 *r, const be128 *b)
- for (i = 0; i < 7; ++i)
- gf128mul_x_bbe(&p[i + 1], &p[i]);
-
-- memset(r, 0, sizeof(r));
-+ memset(r, 0, sizeof(*r));
- for (i = 0;;) {
- u8 ch = ((u8 *)b)[i];
-
-diff --git a/crypto/serpent.c b/crypto/serpent.c
-index b651a55..023297d 100644
---- a/crypto/serpent.c
-+++ b/crypto/serpent.c
-@@ -21,6 +21,7 @@
- #include <asm/byteorder.h>
- #include <linux/crypto.h>
- #include <linux/types.h>
-+#include <linux/sched.h>
-
- /* Key is padded to the maximum of 256 bits before round key generation.
- * Any key length <= 256 bits (32 bytes) is allowed by the algorithm.
-@@ -224,6 +225,8 @@ static int serpent_setkey(struct crypto_tfm *tfm, const u8 *key,
- u32 r0,r1,r2,r3,r4;
- int i;
-
-+ pax_track_stack();
-+
- /* Copy key, add padding */
-
- for (i = 0; i < keylen; ++i)
-diff --git a/drivers/acpi/acpi_pad.c b/drivers/acpi/acpi_pad.c
-index 0d2cdb8..d8de48d 100644
---- a/drivers/acpi/acpi_pad.c
-+++ b/drivers/acpi/acpi_pad.c
-@@ -30,7 +30,7 @@
- #include <acpi/acpi_bus.h>
- #include <acpi/acpi_drivers.h>
-
--#define ACPI_PROCESSOR_AGGREGATOR_CLASS "processor_aggregator"
-+#define ACPI_PROCESSOR_AGGREGATOR_CLASS "acpi_pad"
- #define ACPI_PROCESSOR_AGGREGATOR_DEVICE_NAME "Processor Aggregator"
- #define ACPI_PROCESSOR_AGGREGATOR_NOTIFY 0x80
- static DEFINE_MUTEX(isolated_cpus_lock);
-diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
-index 3f4602b..2e41d36 100644
---- a/drivers/acpi/battery.c
-+++ b/drivers/acpi/battery.c
-@@ -763,7 +763,7 @@ DECLARE_FILE_FUNCTIONS(alarm);
- }
-
- static struct battery_file {
-- struct file_operations ops;
-+ const struct file_operations ops;
- mode_t mode;
- const char *name;
- } acpi_battery_file[] = {
-diff --git a/drivers/acpi/dock.c b/drivers/acpi/dock.c
-index 7338b6a..82f0257 100644
---- a/drivers/acpi/dock.c
-+++ b/drivers/acpi/dock.c
-@@ -77,7 +77,7 @@ struct dock_dependent_device {
- struct list_head list;
- struct list_head hotplug_list;
- acpi_handle handle;
-- struct acpi_dock_ops *ops;
-+ const struct acpi_dock_ops *ops;
- void *context;
- };
-
-@@ -605,7 +605,7 @@ EXPORT_SYMBOL_GPL(unregister_dock_notifier);
- * the dock driver after _DCK is executed.
- */
- int
--register_hotplug_dock_device(acpi_handle handle, struct acpi_dock_ops *ops,
-+register_hotplug_dock_device(acpi_handle handle, const struct acpi_dock_ops *ops,
- void *context)
- {
- struct dock_dependent_device *dd;
-diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
-index 7c1c59e..2993595 100644
---- a/drivers/acpi/osl.c
-+++ b/drivers/acpi/osl.c
-@@ -523,6 +523,8 @@ acpi_os_read_memory(acpi_physical_address phys_addr, u32 * value, u32 width)
- void __iomem *virt_addr;
-
- virt_addr = ioremap(phys_addr, width);
-+ if (!virt_addr)
-+ return AE_NO_MEMORY;
- if (!value)
- value = &dummy;
-
-@@ -551,6 +553,8 @@ acpi_os_write_memory(acpi_physical_address phys_addr, u32 value, u32 width)
- void __iomem *virt_addr;
-
- virt_addr = ioremap(phys_addr, width);
-+ if (!virt_addr)
-+ return AE_NO_MEMORY;
-
- switch (width) {
- case 8:
-diff --git a/drivers/acpi/power_meter.c b/drivers/acpi/power_meter.c
-index c216062..eec10d2 100644
---- a/drivers/acpi/power_meter.c
-+++ b/drivers/acpi/power_meter.c
-@@ -315,8 +315,6 @@ static ssize_t set_trip(struct device *dev, struct device_attribute *devattr,
- return res;
-
- temp /= 1000;
-- if (temp < 0)
-- return -EINVAL;
-
- mutex_lock(&resource->lock);
- resource->trip[attr->index - 7] = temp;
-diff --git a/drivers/acpi/proc.c b/drivers/acpi/proc.c
-index d0d25e2..94ecee0 100644
---- a/drivers/acpi/proc.c
-+++ b/drivers/acpi/proc.c
-@@ -393,17 +393,14 @@ acpi_system_write_wakeup_device(struct file *file,
- struct list_head *node, *next;
- char strbuf[5];
- char str[5] = "";
-- unsigned int len = count;
- struct acpi_device *found_dev = NULL;
-
-- if (len > 4)
-- len = 4;
-- if (len < 0)
-- return -EFAULT;
-+ if (count > 4)
-+ count = 4;
-
-- if (copy_from_user(strbuf, buffer, len))
-+ if (copy_from_user(strbuf, buffer, count))
- return -EFAULT;
-- strbuf[len] = '\0';
-+ strbuf[count] = '\0';
- sscanf(strbuf, "%s", str);
-
- mutex_lock(&acpi_device_lock);
-diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
-index 7102474..de8ad22 100644
---- a/drivers/acpi/processor_core.c
-+++ b/drivers/acpi/processor_core.c
-@@ -790,7 +790,7 @@ static int __cpuinit acpi_processor_add(struct acpi_device *device)
- return 0;
- }
-
-- BUG_ON((pr->id >= nr_cpu_ids) || (pr->id < 0));
-+ BUG_ON(pr->id >= nr_cpu_ids);
-
- /*
- * Buggy BIOS check
-diff --git a/drivers/acpi/sbshc.c b/drivers/acpi/sbshc.c
-index d933980..5761f13 100644
---- a/drivers/acpi/sbshc.c
-+++ b/drivers/acpi/sbshc.c
-@@ -17,7 +17,7 @@
-
- #define PREFIX "ACPI: "
-
--#define ACPI_SMB_HC_CLASS "smbus_host_controller"
-+#define ACPI_SMB_HC_CLASS "smbus_host_ctl"
- #define ACPI_SMB_HC_DEVICE_NAME "ACPI SMBus HC"
-
- struct acpi_smb_hc {
-diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
-index 0458094..6978e7b 100644
---- a/drivers/acpi/sleep.c
-+++ b/drivers/acpi/sleep.c
-@@ -283,7 +283,7 @@ static int acpi_suspend_state_valid(suspend_state_t pm_state)
- }
- }
-
--static struct platform_suspend_ops acpi_suspend_ops = {
-+static const struct platform_suspend_ops acpi_suspend_ops = {
- .valid = acpi_suspend_state_valid,
- .begin = acpi_suspend_begin,
- .prepare_late = acpi_pm_prepare,
-@@ -311,7 +311,7 @@ static int acpi_suspend_begin_old(suspend_state_t pm_state)
- * The following callbacks are used if the pre-ACPI 2.0 suspend ordering has
- * been requested.
- */
--static struct platform_suspend_ops acpi_suspend_ops_old = {
-+static const struct platform_suspend_ops acpi_suspend_ops_old = {
- .valid = acpi_suspend_state_valid,
- .begin = acpi_suspend_begin_old,
- .prepare_late = acpi_pm_disable_gpes,
-@@ -460,7 +460,7 @@ static void acpi_pm_enable_gpes(void)
- acpi_enable_all_runtime_gpes();
- }
-
--static struct platform_hibernation_ops acpi_hibernation_ops = {
-+static const struct platform_hibernation_ops acpi_hibernation_ops = {
- .begin = acpi_hibernation_begin,
- .end = acpi_pm_end,
- .pre_snapshot = acpi_hibernation_pre_snapshot,
-@@ -513,7 +513,7 @@ static int acpi_hibernation_pre_snapshot_old(void)
- * The following callbacks are used if the pre-ACPI 2.0 suspend ordering has
- * been requested.
- */
--static struct platform_hibernation_ops acpi_hibernation_ops_old = {
-+static const struct platform_hibernation_ops acpi_hibernation_ops_old = {
- .begin = acpi_hibernation_begin_old,
- .end = acpi_pm_end,
- .pre_snapshot = acpi_hibernation_pre_snapshot_old,
-diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
-index 05dff63..b662ab7 100644
---- a/drivers/acpi/video.c
-+++ b/drivers/acpi/video.c
-@@ -359,7 +359,7 @@ static int acpi_video_set_brightness(struct backlight_device *bd)
- vd->brightness->levels[request_level]);
- }
-
--static struct backlight_ops acpi_backlight_ops = {
-+static const struct backlight_ops acpi_backlight_ops = {
- .get_brightness = acpi_video_get_brightness,
- .update_status = acpi_video_set_brightness,
- };
-diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
-index 6787aab..23ffb0e 100644
---- a/drivers/ata/ahci.c
-+++ b/drivers/ata/ahci.c
-@@ -387,7 +387,7 @@ static struct scsi_host_template ahci_sht = {
- .sdev_attrs = ahci_sdev_attrs,
- };
-
--static struct ata_port_operations ahci_ops = {
-+static const struct ata_port_operations ahci_ops = {
- .inherits = &sata_pmp_port_ops,
-
- .qc_defer = sata_pmp_qc_defer_cmd_switch,
-@@ -424,17 +424,17 @@ static struct ata_port_operations ahci_ops = {
- .port_stop = ahci_port_stop,
- };
-
--static struct ata_port_operations ahci_vt8251_ops = {
-+static const struct ata_port_operations ahci_vt8251_ops = {
- .inherits = &ahci_ops,
- .hardreset = ahci_vt8251_hardreset,
- };
-
--static struct ata_port_operations ahci_p5wdh_ops = {
-+static const struct ata_port_operations ahci_p5wdh_ops = {
- .inherits = &ahci_ops,
- .hardreset = ahci_p5wdh_hardreset,
- };
-
--static struct ata_port_operations ahci_sb600_ops = {
-+static const struct ata_port_operations ahci_sb600_ops = {
- .inherits = &ahci_ops,
- .softreset = ahci_sb600_softreset,
- .pmp_softreset = ahci_sb600_softreset,
-diff --git a/drivers/ata/ata_generic.c b/drivers/ata/ata_generic.c
-index 99e7196..4968c77 100644
---- a/drivers/ata/ata_generic.c
-+++ b/drivers/ata/ata_generic.c
-@@ -104,7 +104,7 @@ static struct scsi_host_template generic_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations generic_port_ops = {
-+static const struct ata_port_operations generic_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = ata_cable_unknown,
- .set_mode = generic_set_mode,
-diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
-index c33591d..000c121 100644
---- a/drivers/ata/ata_piix.c
-+++ b/drivers/ata/ata_piix.c
-@@ -318,7 +318,7 @@ static struct scsi_host_template piix_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations piix_pata_ops = {
-+static const struct ata_port_operations piix_pata_ops = {
- .inherits = &ata_bmdma32_port_ops,
- .cable_detect = ata_cable_40wire,
- .set_piomode = piix_set_piomode,
-@@ -326,22 +326,22 @@ static struct ata_port_operations piix_pata_ops = {
- .prereset = piix_pata_prereset,
- };
-
--static struct ata_port_operations piix_vmw_ops = {
-+static const struct ata_port_operations piix_vmw_ops = {
- .inherits = &piix_pata_ops,
- .bmdma_status = piix_vmw_bmdma_status,
- };
-
--static struct ata_port_operations ich_pata_ops = {
-+static const struct ata_port_operations ich_pata_ops = {
- .inherits = &piix_pata_ops,
- .cable_detect = ich_pata_cable_detect,
- .set_dmamode = ich_set_dmamode,
- };
-
--static struct ata_port_operations piix_sata_ops = {
-+static const struct ata_port_operations piix_sata_ops = {
- .inherits = &ata_bmdma_port_ops,
- };
-
--static struct ata_port_operations piix_sidpr_sata_ops = {
-+static const struct ata_port_operations piix_sidpr_sata_ops = {
- .inherits = &piix_sata_ops,
- .hardreset = sata_std_hardreset,
- .scr_read = piix_sidpr_scr_read,
-diff --git a/drivers/ata/libata-acpi.c b/drivers/ata/libata-acpi.c
-index b0882cd..c295d65 100644
---- a/drivers/ata/libata-acpi.c
-+++ b/drivers/ata/libata-acpi.c
-@@ -223,12 +223,12 @@ static void ata_acpi_dev_uevent(acpi_handle handle, u32 event, void *data)
- ata_acpi_uevent(dev->link->ap, dev, event);
- }
-
--static struct acpi_dock_ops ata_acpi_dev_dock_ops = {
-+static const struct acpi_dock_ops ata_acpi_dev_dock_ops = {
- .handler = ata_acpi_dev_notify_dock,
- .uevent = ata_acpi_dev_uevent,
- };
-
--static struct acpi_dock_ops ata_acpi_ap_dock_ops = {
-+static const struct acpi_dock_ops ata_acpi_ap_dock_ops = {
- .handler = ata_acpi_ap_notify_dock,
- .uevent = ata_acpi_ap_uevent,
- };
-diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
-index d4f7f99..94f603e 100644
---- a/drivers/ata/libata-core.c
-+++ b/drivers/ata/libata-core.c
-@@ -4954,7 +4954,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
- struct ata_port *ap;
- unsigned int tag;
-
-- WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
-+ BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
- ap = qc->ap;
-
- qc->flags = 0;
-@@ -4970,7 +4970,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc)
- struct ata_port *ap;
- struct ata_link *link;
-
-- WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
-+ BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
- WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE));
- ap = qc->ap;
- link = qc->dev->link;
-@@ -5987,7 +5987,7 @@ static void ata_host_stop(struct device *gendev, void *res)
- * LOCKING:
- * None.
- */
--static void ata_finalize_port_ops(struct ata_port_operations *ops)
-+static void ata_finalize_port_ops(const struct ata_port_operations *ops)
- {
- static DEFINE_SPINLOCK(lock);
- const struct ata_port_operations *cur;
-@@ -5999,6 +5999,7 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
- return;
-
- spin_lock(&lock);
-+ pax_open_kernel();
-
- for (cur = ops->inherits; cur; cur = cur->inherits) {
- void **inherit = (void **)cur;
-@@ -6012,8 +6013,9 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
- if (IS_ERR(*pp))
- *pp = NULL;
-
-- ops->inherits = NULL;
-+ *(struct ata_port_operations **)&ops->inherits = NULL;
-
-+ pax_close_kernel();
- spin_unlock(&lock);
- }
-
-@@ -6110,7 +6112,7 @@ int ata_host_start(struct ata_host *host)
- */
- /* KILLME - the only user left is ipr */
- void ata_host_init(struct ata_host *host, struct device *dev,
-- unsigned long flags, struct ata_port_operations *ops)
-+ unsigned long flags, const struct ata_port_operations *ops)
- {
- spin_lock_init(&host->lock);
- host->dev = dev;
-@@ -6773,7 +6775,7 @@ static void ata_dummy_error_handler(struct ata_port *ap)
- /* truly dummy */
- }
-
--struct ata_port_operations ata_dummy_port_ops = {
-+const struct ata_port_operations ata_dummy_port_ops = {
- .qc_prep = ata_noop_qc_prep,
- .qc_issue = ata_dummy_qc_issue,
- .error_handler = ata_dummy_error_handler,
-diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
-index e5bdb9b..45a8e72 100644
---- a/drivers/ata/libata-eh.c
-+++ b/drivers/ata/libata-eh.c
-@@ -2423,6 +2423,8 @@ void ata_eh_report(struct ata_port *ap)
- {
- struct ata_link *link;
-
-+ pax_track_stack();
-+
- ata_for_each_link(link, ap, HOST_FIRST)
- ata_eh_link_report(link);
- }
-@@ -3594,7 +3596,7 @@ void ata_do_eh(struct ata_port *ap, ata_prereset_fn_t prereset,
- */
- void ata_std_error_handler(struct ata_port *ap)
- {
-- struct ata_port_operations *ops = ap->ops;
-+ const struct ata_port_operations *ops = ap->ops;
- ata_reset_fn_t hardreset = ops->hardreset;
-
- /* ignore built-in hardreset if SCR access is not available */
-diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c
-index 51f0ffb..19ce3e3 100644
---- a/drivers/ata/libata-pmp.c
-+++ b/drivers/ata/libata-pmp.c
-@@ -841,7 +841,7 @@ static int sata_pmp_handle_link_fail(struct ata_link *link, int *link_tries)
- */
- static int sata_pmp_eh_recover(struct ata_port *ap)
- {
-- struct ata_port_operations *ops = ap->ops;
-+ const struct ata_port_operations *ops = ap->ops;
- int pmp_tries, link_tries[SATA_PMP_MAX_PORTS];
- struct ata_link *pmp_link = &ap->link;
- struct ata_device *pmp_dev = pmp_link->device;
-diff --git a/drivers/ata/pata_acpi.c b/drivers/ata/pata_acpi.c
-index d8f35fe..288180a 100644
---- a/drivers/ata/pata_acpi.c
-+++ b/drivers/ata/pata_acpi.c
-@@ -215,7 +215,7 @@ static struct scsi_host_template pacpi_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations pacpi_ops = {
-+static const struct ata_port_operations pacpi_ops = {
- .inherits = &ata_bmdma_port_ops,
- .qc_issue = pacpi_qc_issue,
- .cable_detect = pacpi_cable_detect,
-diff --git a/drivers/ata/pata_ali.c b/drivers/ata/pata_ali.c
-index 9434114..1f2f364 100644
---- a/drivers/ata/pata_ali.c
-+++ b/drivers/ata/pata_ali.c
-@@ -365,7 +365,7 @@ static struct scsi_host_template ali_sht = {
- * Port operations for PIO only ALi
- */
-
--static struct ata_port_operations ali_early_port_ops = {
-+static const struct ata_port_operations ali_early_port_ops = {
- .inherits = &ata_sff_port_ops,
- .cable_detect = ata_cable_40wire,
- .set_piomode = ali_set_piomode,
-@@ -382,7 +382,7 @@ static const struct ata_port_operations ali_dma_base_ops = {
- * Port operations for DMA capable ALi without cable
- * detect
- */
--static struct ata_port_operations ali_20_port_ops = {
-+static const struct ata_port_operations ali_20_port_ops = {
- .inherits = &ali_dma_base_ops,
- .cable_detect = ata_cable_40wire,
- .mode_filter = ali_20_filter,
-@@ -393,7 +393,7 @@ static struct ata_port_operations ali_20_port_ops = {
- /*
- * Port operations for DMA capable ALi with cable detect
- */
--static struct ata_port_operations ali_c2_port_ops = {
-+static const struct ata_port_operations ali_c2_port_ops = {
- .inherits = &ali_dma_base_ops,
- .check_atapi_dma = ali_check_atapi_dma,
- .cable_detect = ali_c2_cable_detect,
-@@ -404,7 +404,7 @@ static struct ata_port_operations ali_c2_port_ops = {
- /*
- * Port operations for DMA capable ALi with cable detect
- */
--static struct ata_port_operations ali_c4_port_ops = {
-+static const struct ata_port_operations ali_c4_port_ops = {
- .inherits = &ali_dma_base_ops,
- .check_atapi_dma = ali_check_atapi_dma,
- .cable_detect = ali_c2_cable_detect,
-@@ -414,7 +414,7 @@ static struct ata_port_operations ali_c4_port_ops = {
- /*
- * Port operations for DMA capable ALi with cable detect and LBA48
- */
--static struct ata_port_operations ali_c5_port_ops = {
-+static const struct ata_port_operations ali_c5_port_ops = {
- .inherits = &ali_dma_base_ops,
- .check_atapi_dma = ali_check_atapi_dma,
- .dev_config = ali_warn_atapi_dma,
-diff --git a/drivers/ata/pata_amd.c b/drivers/ata/pata_amd.c
-index 567f3f7..c8ee0da 100644
---- a/drivers/ata/pata_amd.c
-+++ b/drivers/ata/pata_amd.c
-@@ -397,28 +397,28 @@ static const struct ata_port_operations amd_base_port_ops = {
- .prereset = amd_pre_reset,
- };
-
--static struct ata_port_operations amd33_port_ops = {
-+static const struct ata_port_operations amd33_port_ops = {
- .inherits = &amd_base_port_ops,
- .cable_detect = ata_cable_40wire,
- .set_piomode = amd33_set_piomode,
- .set_dmamode = amd33_set_dmamode,
- };
-
--static struct ata_port_operations amd66_port_ops = {
-+static const struct ata_port_operations amd66_port_ops = {
- .inherits = &amd_base_port_ops,
- .cable_detect = ata_cable_unknown,
- .set_piomode = amd66_set_piomode,
- .set_dmamode = amd66_set_dmamode,
- };
-
--static struct ata_port_operations amd100_port_ops = {
-+static const struct ata_port_operations amd100_port_ops = {
- .inherits = &amd_base_port_ops,
- .cable_detect = ata_cable_unknown,
- .set_piomode = amd100_set_piomode,
- .set_dmamode = amd100_set_dmamode,
- };
-
--static struct ata_port_operations amd133_port_ops = {
-+static const struct ata_port_operations amd133_port_ops = {
- .inherits = &amd_base_port_ops,
- .cable_detect = amd_cable_detect,
- .set_piomode = amd133_set_piomode,
-@@ -433,13 +433,13 @@ static const struct ata_port_operations nv_base_port_ops = {
- .host_stop = nv_host_stop,
- };
-
--static struct ata_port_operations nv100_port_ops = {
-+static const struct ata_port_operations nv100_port_ops = {
- .inherits = &nv_base_port_ops,
- .set_piomode = nv100_set_piomode,
- .set_dmamode = nv100_set_dmamode,
- };
-
--static struct ata_port_operations nv133_port_ops = {
-+static const struct ata_port_operations nv133_port_ops = {
- .inherits = &nv_base_port_ops,
- .set_piomode = nv133_set_piomode,
- .set_dmamode = nv133_set_dmamode,
-diff --git a/drivers/ata/pata_artop.c b/drivers/ata/pata_artop.c
-index d332cfd..4b7eaae 100644
---- a/drivers/ata/pata_artop.c
-+++ b/drivers/ata/pata_artop.c
-@@ -311,7 +311,7 @@ static struct scsi_host_template artop_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations artop6210_ops = {
-+static const struct ata_port_operations artop6210_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = ata_cable_40wire,
- .set_piomode = artop6210_set_piomode,
-@@ -320,7 +320,7 @@ static struct ata_port_operations artop6210_ops = {
- .qc_defer = artop6210_qc_defer,
- };
-
--static struct ata_port_operations artop6260_ops = {
-+static const struct ata_port_operations artop6260_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = artop6260_cable_detect,
- .set_piomode = artop6260_set_piomode,
-diff --git a/drivers/ata/pata_at32.c b/drivers/ata/pata_at32.c
-index 5c129f9..7bb7ccb 100644
---- a/drivers/ata/pata_at32.c
-+++ b/drivers/ata/pata_at32.c
-@@ -172,7 +172,7 @@ static struct scsi_host_template at32_sht = {
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations at32_port_ops = {
-+static const struct ata_port_operations at32_port_ops = {
- .inherits = &ata_sff_port_ops,
- .cable_detect = ata_cable_40wire,
- .set_piomode = pata_at32_set_piomode,
-diff --git a/drivers/ata/pata_at91.c b/drivers/ata/pata_at91.c
-index 41c94b1..829006d 100644
---- a/drivers/ata/pata_at91.c
-+++ b/drivers/ata/pata_at91.c
-@@ -195,7 +195,7 @@ static struct scsi_host_template pata_at91_sht = {
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations pata_at91_port_ops = {
-+static const struct ata_port_operations pata_at91_port_ops = {
- .inherits = &ata_sff_port_ops,
-
- .sff_data_xfer = pata_at91_data_xfer_noirq,
-diff --git a/drivers/ata/pata_atiixp.c b/drivers/ata/pata_atiixp.c
-index ae4454d..d391eb4 100644
---- a/drivers/ata/pata_atiixp.c
-+++ b/drivers/ata/pata_atiixp.c
-@@ -205,7 +205,7 @@ static struct scsi_host_template atiixp_sht = {
- .sg_tablesize = LIBATA_DUMB_MAX_PRD,
- };
-
--static struct ata_port_operations atiixp_port_ops = {
-+static const struct ata_port_operations atiixp_port_ops = {
- .inherits = &ata_bmdma_port_ops,
-
- .qc_prep = ata_sff_dumb_qc_prep,
-diff --git a/drivers/ata/pata_atp867x.c b/drivers/ata/pata_atp867x.c
-index 6fe7ded..2a425dc 100644
---- a/drivers/ata/pata_atp867x.c
-+++ b/drivers/ata/pata_atp867x.c
-@@ -274,7 +274,7 @@ static struct scsi_host_template atp867x_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations atp867x_ops = {
-+static const struct ata_port_operations atp867x_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = atp867x_cable_detect,
- .set_piomode = atp867x_set_piomode,
-diff --git a/drivers/ata/pata_bf54x.c b/drivers/ata/pata_bf54x.c
-index c4b47a3..b27a367 100644
---- a/drivers/ata/pata_bf54x.c
-+++ b/drivers/ata/pata_bf54x.c
-@@ -1464,7 +1464,7 @@ static struct scsi_host_template bfin_sht = {
- .dma_boundary = ATA_DMA_BOUNDARY,
- };
-
--static struct ata_port_operations bfin_pata_ops = {
-+static const struct ata_port_operations bfin_pata_ops = {
- .inherits = &ata_sff_port_ops,
-
- .set_piomode = bfin_set_piomode,
-diff --git a/drivers/ata/pata_cmd640.c b/drivers/ata/pata_cmd640.c
-index 5acf9fa..84248be 100644
---- a/drivers/ata/pata_cmd640.c
-+++ b/drivers/ata/pata_cmd640.c
-@@ -168,7 +168,7 @@ static struct scsi_host_template cmd640_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations cmd640_port_ops = {
-+static const struct ata_port_operations cmd640_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- /* In theory xfer_noirq is not needed once we kill the prefetcher */
- .sff_data_xfer = ata_sff_data_xfer_noirq,
-diff --git a/drivers/ata/pata_cmd64x.c b/drivers/ata/pata_cmd64x.c
-index ccd2694..c869c3d 100644
---- a/drivers/ata/pata_cmd64x.c
-+++ b/drivers/ata/pata_cmd64x.c
-@@ -271,18 +271,18 @@ static const struct ata_port_operations cmd64x_base_ops = {
- .set_dmamode = cmd64x_set_dmamode,
- };
-
--static struct ata_port_operations cmd64x_port_ops = {
-+static const struct ata_port_operations cmd64x_port_ops = {
- .inherits = &cmd64x_base_ops,
- .cable_detect = ata_cable_40wire,
- };
-
--static struct ata_port_operations cmd646r1_port_ops = {
-+static const struct ata_port_operations cmd646r1_port_ops = {
- .inherits = &cmd64x_base_ops,
- .bmdma_stop = cmd646r1_bmdma_stop,
- .cable_detect = ata_cable_40wire,
- };
-
--static struct ata_port_operations cmd648_port_ops = {
-+static const struct ata_port_operations cmd648_port_ops = {
- .inherits = &cmd64x_base_ops,
- .bmdma_stop = cmd648_bmdma_stop,
- .cable_detect = cmd648_cable_detect,
-diff --git a/drivers/ata/pata_cs5520.c b/drivers/ata/pata_cs5520.c
-index 0df83cf..d7595b0 100644
---- a/drivers/ata/pata_cs5520.c
-+++ b/drivers/ata/pata_cs5520.c
-@@ -144,7 +144,7 @@ static struct scsi_host_template cs5520_sht = {
- .sg_tablesize = LIBATA_DUMB_MAX_PRD,
- };
-
--static struct ata_port_operations cs5520_port_ops = {
-+static const struct ata_port_operations cs5520_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .qc_prep = ata_sff_dumb_qc_prep,
- .cable_detect = ata_cable_40wire,
-diff --git a/drivers/ata/pata_cs5530.c b/drivers/ata/pata_cs5530.c
-index c974b05..6d26b11 100644
---- a/drivers/ata/pata_cs5530.c
-+++ b/drivers/ata/pata_cs5530.c
-@@ -164,7 +164,7 @@ static struct scsi_host_template cs5530_sht = {
- .sg_tablesize = LIBATA_DUMB_MAX_PRD,
- };
-
--static struct ata_port_operations cs5530_port_ops = {
-+static const struct ata_port_operations cs5530_port_ops = {
- .inherits = &ata_bmdma_port_ops,
-
- .qc_prep = ata_sff_dumb_qc_prep,
-diff --git a/drivers/ata/pata_cs5535.c b/drivers/ata/pata_cs5535.c
-index 403f561..aacd26b 100644
---- a/drivers/ata/pata_cs5535.c
-+++ b/drivers/ata/pata_cs5535.c
-@@ -160,7 +160,7 @@ static struct scsi_host_template cs5535_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations cs5535_port_ops = {
-+static const struct ata_port_operations cs5535_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = cs5535_cable_detect,
- .set_piomode = cs5535_set_piomode,
-diff --git a/drivers/ata/pata_cs5536.c b/drivers/ata/pata_cs5536.c
-index 6da4cb4..de24a25 100644
---- a/drivers/ata/pata_cs5536.c
-+++ b/drivers/ata/pata_cs5536.c
-@@ -223,7 +223,7 @@ static struct scsi_host_template cs5536_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations cs5536_port_ops = {
-+static const struct ata_port_operations cs5536_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = cs5536_cable_detect,
- .set_piomode = cs5536_set_piomode,
-diff --git a/drivers/ata/pata_cypress.c b/drivers/ata/pata_cypress.c
-index 8fb040b..b16a9c9 100644
---- a/drivers/ata/pata_cypress.c
-+++ b/drivers/ata/pata_cypress.c
-@@ -113,7 +113,7 @@ static struct scsi_host_template cy82c693_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations cy82c693_port_ops = {
-+static const struct ata_port_operations cy82c693_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = ata_cable_40wire,
- .set_piomode = cy82c693_set_piomode,
-diff --git a/drivers/ata/pata_efar.c b/drivers/ata/pata_efar.c
-index 2a6412f..555ee11 100644
---- a/drivers/ata/pata_efar.c
-+++ b/drivers/ata/pata_efar.c
-@@ -222,7 +222,7 @@ static struct scsi_host_template efar_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations efar_ops = {
-+static const struct ata_port_operations efar_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = efar_cable_detect,
- .set_piomode = efar_set_piomode,
-diff --git a/drivers/ata/pata_hpt366.c b/drivers/ata/pata_hpt366.c
-index b9d8836..0b92030 100644
---- a/drivers/ata/pata_hpt366.c
-+++ b/drivers/ata/pata_hpt366.c
-@@ -282,7 +282,7 @@ static struct scsi_host_template hpt36x_sht = {
- * Configuration for HPT366/68
- */
-
--static struct ata_port_operations hpt366_port_ops = {
-+static const struct ata_port_operations hpt366_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = hpt36x_cable_detect,
- .mode_filter = hpt366_filter,
-diff --git a/drivers/ata/pata_hpt37x.c b/drivers/ata/pata_hpt37x.c
-index 5af7f19..00c4980 100644
---- a/drivers/ata/pata_hpt37x.c
-+++ b/drivers/ata/pata_hpt37x.c
-@@ -576,7 +576,7 @@ static struct scsi_host_template hpt37x_sht = {
- * Configuration for HPT370
- */
-
--static struct ata_port_operations hpt370_port_ops = {
-+static const struct ata_port_operations hpt370_port_ops = {
- .inherits = &ata_bmdma_port_ops,
-
- .bmdma_stop = hpt370_bmdma_stop,
-@@ -591,7 +591,7 @@ static struct ata_port_operations hpt370_port_ops = {
- * Configuration for HPT370A. Close to 370 but less filters
- */
-
--static struct ata_port_operations hpt370a_port_ops = {
-+static const struct ata_port_operations hpt370a_port_ops = {
- .inherits = &hpt370_port_ops,
- .mode_filter = hpt370a_filter,
- };
-@@ -601,7 +601,7 @@ static struct ata_port_operations hpt370a_port_ops = {
- * and DMA mode setting functionality.
- */
-
--static struct ata_port_operations hpt372_port_ops = {
-+static const struct ata_port_operations hpt372_port_ops = {
- .inherits = &ata_bmdma_port_ops,
-
- .bmdma_stop = hpt37x_bmdma_stop,
-@@ -616,7 +616,7 @@ static struct ata_port_operations hpt372_port_ops = {
- * but we have a different cable detection procedure for function 1.
- */
-
--static struct ata_port_operations hpt374_fn1_port_ops = {
-+static const struct ata_port_operations hpt374_fn1_port_ops = {
- .inherits = &hpt372_port_ops,
- .prereset = hpt374_fn1_pre_reset,
- };
-diff --git a/drivers/ata/pata_hpt3x2n.c b/drivers/ata/pata_hpt3x2n.c
-index 100f227..2e39382 100644
---- a/drivers/ata/pata_hpt3x2n.c
-+++ b/drivers/ata/pata_hpt3x2n.c
-@@ -337,7 +337,7 @@ static struct scsi_host_template hpt3x2n_sht = {
- * Configuration for HPT3x2n.
- */
-
--static struct ata_port_operations hpt3x2n_port_ops = {
-+static const struct ata_port_operations hpt3x2n_port_ops = {
- .inherits = &ata_bmdma_port_ops,
-
- .bmdma_stop = hpt3x2n_bmdma_stop,
-diff --git a/drivers/ata/pata_hpt3x3.c b/drivers/ata/pata_hpt3x3.c
-index 7e31025..6fca8f4 100644
---- a/drivers/ata/pata_hpt3x3.c
-+++ b/drivers/ata/pata_hpt3x3.c
-@@ -141,7 +141,7 @@ static struct scsi_host_template hpt3x3_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations hpt3x3_port_ops = {
-+static const struct ata_port_operations hpt3x3_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = ata_cable_40wire,
- .set_piomode = hpt3x3_set_piomode,
-diff --git a/drivers/ata/pata_icside.c b/drivers/ata/pata_icside.c
-index b663b7f..9a26c2a 100644
---- a/drivers/ata/pata_icside.c
-+++ b/drivers/ata/pata_icside.c
-@@ -319,7 +319,7 @@ static void pata_icside_postreset(struct ata_link *link, unsigned int *classes)
- }
- }
-
--static struct ata_port_operations pata_icside_port_ops = {
-+static const struct ata_port_operations pata_icside_port_ops = {
- .inherits = &ata_sff_port_ops,
- /* no need to build any PRD tables for DMA */
- .qc_prep = ata_noop_qc_prep,
-diff --git a/drivers/ata/pata_isapnp.c b/drivers/ata/pata_isapnp.c
-index 4bceb88..457dfb6 100644
---- a/drivers/ata/pata_isapnp.c
-+++ b/drivers/ata/pata_isapnp.c
-@@ -23,12 +23,12 @@ static struct scsi_host_template isapnp_sht = {
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations isapnp_port_ops = {
-+static const struct ata_port_operations isapnp_port_ops = {
- .inherits = &ata_sff_port_ops,
- .cable_detect = ata_cable_40wire,
- };
-
--static struct ata_port_operations isapnp_noalt_port_ops = {
-+static const struct ata_port_operations isapnp_noalt_port_ops = {
- .inherits = &ata_sff_port_ops,
- .cable_detect = ata_cable_40wire,
- /* No altstatus so we don't want to use the lost interrupt poll */
-diff --git a/drivers/ata/pata_it8213.c b/drivers/ata/pata_it8213.c
-index f156da8..24976e2 100644
---- a/drivers/ata/pata_it8213.c
-+++ b/drivers/ata/pata_it8213.c
-@@ -234,7 +234,7 @@ static struct scsi_host_template it8213_sht = {
- };
-
-
--static struct ata_port_operations it8213_ops = {
-+static const struct ata_port_operations it8213_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = it8213_cable_detect,
- .set_piomode = it8213_set_piomode,
-diff --git a/drivers/ata/pata_it821x.c b/drivers/ata/pata_it821x.c
-index 188bc2f..ca9e785 100644
---- a/drivers/ata/pata_it821x.c
-+++ b/drivers/ata/pata_it821x.c
-@@ -800,7 +800,7 @@ static struct scsi_host_template it821x_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations it821x_smart_port_ops = {
-+static const struct ata_port_operations it821x_smart_port_ops = {
- .inherits = &ata_bmdma_port_ops,
-
- .check_atapi_dma= it821x_check_atapi_dma,
-@@ -814,7 +814,7 @@ static struct ata_port_operations it821x_smart_port_ops = {
- .port_start = it821x_port_start,
- };
-
--static struct ata_port_operations it821x_passthru_port_ops = {
-+static const struct ata_port_operations it821x_passthru_port_ops = {
- .inherits = &ata_bmdma_port_ops,
-
- .check_atapi_dma= it821x_check_atapi_dma,
-@@ -830,7 +830,7 @@ static struct ata_port_operations it821x_passthru_port_ops = {
- .port_start = it821x_port_start,
- };
-
--static struct ata_port_operations it821x_rdc_port_ops = {
-+static const struct ata_port_operations it821x_rdc_port_ops = {
- .inherits = &ata_bmdma_port_ops,
-
- .check_atapi_dma= it821x_check_atapi_dma,
-diff --git a/drivers/ata/pata_ixp4xx_cf.c b/drivers/ata/pata_ixp4xx_cf.c
-index ba54b08..4b952b7 100644
---- a/drivers/ata/pata_ixp4xx_cf.c
-+++ b/drivers/ata/pata_ixp4xx_cf.c
-@@ -89,7 +89,7 @@ static struct scsi_host_template ixp4xx_sht = {
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations ixp4xx_port_ops = {
-+static const struct ata_port_operations ixp4xx_port_ops = {
- .inherits = &ata_sff_port_ops,
- .sff_data_xfer = ixp4xx_mmio_data_xfer,
- .cable_detect = ata_cable_40wire,
-diff --git a/drivers/ata/pata_jmicron.c b/drivers/ata/pata_jmicron.c
-index 3a1474a..434b0ff 100644
---- a/drivers/ata/pata_jmicron.c
-+++ b/drivers/ata/pata_jmicron.c
-@@ -111,7 +111,7 @@ static struct scsi_host_template jmicron_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations jmicron_ops = {
-+static const struct ata_port_operations jmicron_ops = {
- .inherits = &ata_bmdma_port_ops,
- .prereset = jmicron_pre_reset,
- };
-diff --git a/drivers/ata/pata_legacy.c b/drivers/ata/pata_legacy.c
-index 6932e56..220e71d 100644
---- a/drivers/ata/pata_legacy.c
-+++ b/drivers/ata/pata_legacy.c
-@@ -106,7 +106,7 @@ struct legacy_probe {
-
- struct legacy_controller {
- const char *name;
-- struct ata_port_operations *ops;
-+ const struct ata_port_operations *ops;
- unsigned int pio_mask;
- unsigned int flags;
- unsigned int pflags;
-@@ -223,12 +223,12 @@ static const struct ata_port_operations legacy_base_port_ops = {
- * pio_mask as well.
- */
-
--static struct ata_port_operations simple_port_ops = {
-+static const struct ata_port_operations simple_port_ops = {
- .inherits = &legacy_base_port_ops,
- .sff_data_xfer = ata_sff_data_xfer_noirq,
- };
-
--static struct ata_port_operations legacy_port_ops = {
-+static const struct ata_port_operations legacy_port_ops = {
- .inherits = &legacy_base_port_ops,
- .sff_data_xfer = ata_sff_data_xfer_noirq,
- .set_mode = legacy_set_mode,
-@@ -324,7 +324,7 @@ static unsigned int pdc_data_xfer_vlb(struct ata_device *dev,
- return buflen;
- }
-
--static struct ata_port_operations pdc20230_port_ops = {
-+static const struct ata_port_operations pdc20230_port_ops = {
- .inherits = &legacy_base_port_ops,
- .set_piomode = pdc20230_set_piomode,
- .sff_data_xfer = pdc_data_xfer_vlb,
-@@ -357,7 +357,7 @@ static void ht6560a_set_piomode(struct ata_port *ap, struct ata_device *adev)
- ioread8(ap->ioaddr.status_addr);
- }
-
--static struct ata_port_operations ht6560a_port_ops = {
-+static const struct ata_port_operations ht6560a_port_ops = {
- .inherits = &legacy_base_port_ops,
- .set_piomode = ht6560a_set_piomode,
- };
-@@ -400,7 +400,7 @@ static void ht6560b_set_piomode(struct ata_port *ap, struct ata_device *adev)
- ioread8(ap->ioaddr.status_addr);
- }
-
--static struct ata_port_operations ht6560b_port_ops = {
-+static const struct ata_port_operations ht6560b_port_ops = {
- .inherits = &legacy_base_port_ops,
- .set_piomode = ht6560b_set_piomode,
- };
-@@ -499,7 +499,7 @@ static void opti82c611a_set_piomode(struct ata_port *ap,
- }
-
-
--static struct ata_port_operations opti82c611a_port_ops = {
-+static const struct ata_port_operations opti82c611a_port_ops = {
- .inherits = &legacy_base_port_ops,
- .set_piomode = opti82c611a_set_piomode,
- };
-@@ -609,7 +609,7 @@ static unsigned int opti82c46x_qc_issue(struct ata_queued_cmd *qc)
- return ata_sff_qc_issue(qc);
- }
-
--static struct ata_port_operations opti82c46x_port_ops = {
-+static const struct ata_port_operations opti82c46x_port_ops = {
- .inherits = &legacy_base_port_ops,
- .set_piomode = opti82c46x_set_piomode,
- .qc_issue = opti82c46x_qc_issue,
-@@ -771,20 +771,20 @@ static int qdi_port(struct platform_device *dev,
- return 0;
- }
-
--static struct ata_port_operations qdi6500_port_ops = {
-+static const struct ata_port_operations qdi6500_port_ops = {
- .inherits = &legacy_base_port_ops,
- .set_piomode = qdi6500_set_piomode,
- .qc_issue = qdi_qc_issue,
- .sff_data_xfer = vlb32_data_xfer,
- };
-
--static struct ata_port_operations qdi6580_port_ops = {
-+static const struct ata_port_operations qdi6580_port_ops = {
- .inherits = &legacy_base_port_ops,
- .set_piomode = qdi6580_set_piomode,
- .sff_data_xfer = vlb32_data_xfer,
- };
-
--static struct ata_port_operations qdi6580dp_port_ops = {
-+static const struct ata_port_operations qdi6580dp_port_ops = {
- .inherits = &legacy_base_port_ops,
- .set_piomode = qdi6580dp_set_piomode,
- .sff_data_xfer = vlb32_data_xfer,
-@@ -855,7 +855,7 @@ static int winbond_port(struct platform_device *dev,
- return 0;
- }
-
--static struct ata_port_operations winbond_port_ops = {
-+static const struct ata_port_operations winbond_port_ops = {
- .inherits = &legacy_base_port_ops,
- .set_piomode = winbond_set_piomode,
- .sff_data_xfer = vlb32_data_xfer,
-@@ -978,7 +978,7 @@ static __init int legacy_init_one(struct legacy_probe *probe)
- int pio_modes = controller->pio_mask;
- unsigned long io = probe->port;
- u32 mask = (1 << probe->slot);
-- struct ata_port_operations *ops = controller->ops;
-+ const struct ata_port_operations *ops = controller->ops;
- struct legacy_data *ld = &legacy_data[probe->slot];
- struct ata_host *host = NULL;
- struct ata_port *ap;
-diff --git a/drivers/ata/pata_marvell.c b/drivers/ata/pata_marvell.c
-index 2096fb7..4d090fc 100644
---- a/drivers/ata/pata_marvell.c
-+++ b/drivers/ata/pata_marvell.c
-@@ -100,7 +100,7 @@ static struct scsi_host_template marvell_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations marvell_ops = {
-+static const struct ata_port_operations marvell_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = marvell_cable_detect,
- .prereset = marvell_pre_reset,
-diff --git a/drivers/ata/pata_mpc52xx.c b/drivers/ata/pata_mpc52xx.c
-index 99d41be..7d56aa8 100644
---- a/drivers/ata/pata_mpc52xx.c
-+++ b/drivers/ata/pata_mpc52xx.c
-@@ -609,7 +609,7 @@ static struct scsi_host_template mpc52xx_ata_sht = {
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations mpc52xx_ata_port_ops = {
-+static const struct ata_port_operations mpc52xx_ata_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .sff_dev_select = mpc52xx_ata_dev_select,
- .set_piomode = mpc52xx_ata_set_piomode,
-diff --git a/drivers/ata/pata_mpiix.c b/drivers/ata/pata_mpiix.c
-index b21f002..0a27e7f 100644
---- a/drivers/ata/pata_mpiix.c
-+++ b/drivers/ata/pata_mpiix.c
-@@ -140,7 +140,7 @@ static struct scsi_host_template mpiix_sht = {
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations mpiix_port_ops = {
-+static const struct ata_port_operations mpiix_port_ops = {
- .inherits = &ata_sff_port_ops,
- .qc_issue = mpiix_qc_issue,
- .cable_detect = ata_cable_40wire,
-diff --git a/drivers/ata/pata_netcell.c b/drivers/ata/pata_netcell.c
-index f0d52f7..89c3be3 100644
---- a/drivers/ata/pata_netcell.c
-+++ b/drivers/ata/pata_netcell.c
-@@ -34,7 +34,7 @@ static struct scsi_host_template netcell_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations netcell_ops = {
-+static const struct ata_port_operations netcell_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = ata_cable_80wire,
- .read_id = netcell_read_id,
-diff --git a/drivers/ata/pata_ninja32.c b/drivers/ata/pata_ninja32.c
-index dd53a66..a3f4317 100644
---- a/drivers/ata/pata_ninja32.c
-+++ b/drivers/ata/pata_ninja32.c
-@@ -81,7 +81,7 @@ static struct scsi_host_template ninja32_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations ninja32_port_ops = {
-+static const struct ata_port_operations ninja32_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .sff_dev_select = ninja32_dev_select,
- .cable_detect = ata_cable_40wire,
-diff --git a/drivers/ata/pata_ns87410.c b/drivers/ata/pata_ns87410.c
-index ca53fac..9aa93ef 100644
---- a/drivers/ata/pata_ns87410.c
-+++ b/drivers/ata/pata_ns87410.c
-@@ -132,7 +132,7 @@ static struct scsi_host_template ns87410_sht = {
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations ns87410_port_ops = {
-+static const struct ata_port_operations ns87410_port_ops = {
- .inherits = &ata_sff_port_ops,
- .qc_issue = ns87410_qc_issue,
- .cable_detect = ata_cable_40wire,
-diff --git a/drivers/ata/pata_ns87415.c b/drivers/ata/pata_ns87415.c
-index 773b159..55f454e 100644
---- a/drivers/ata/pata_ns87415.c
-+++ b/drivers/ata/pata_ns87415.c
-@@ -299,7 +299,7 @@ static u8 ns87560_bmdma_status(struct ata_port *ap)
- }
- #endif /* 87560 SuperIO Support */
-
--static struct ata_port_operations ns87415_pata_ops = {
-+static const struct ata_port_operations ns87415_pata_ops = {
- .inherits = &ata_bmdma_port_ops,
-
- .check_atapi_dma = ns87415_check_atapi_dma,
-@@ -313,7 +313,7 @@ static struct ata_port_operations ns87415_pata_ops = {
- };
-
- #if defined(CONFIG_SUPERIO)
--static struct ata_port_operations ns87560_pata_ops = {
-+static const struct ata_port_operations ns87560_pata_ops = {
- .inherits = &ns87415_pata_ops,
- .sff_tf_read = ns87560_tf_read,
- .sff_check_status = ns87560_check_status,
-diff --git a/drivers/ata/pata_octeon_cf.c b/drivers/ata/pata_octeon_cf.c
-index d6f6956..639295b 100644
---- a/drivers/ata/pata_octeon_cf.c
-+++ b/drivers/ata/pata_octeon_cf.c
-@@ -801,6 +801,7 @@ static unsigned int octeon_cf_qc_issue(struct ata_queued_cmd *qc)
- return 0;
- }
-
-+/* cannot be const */
- static struct ata_port_operations octeon_cf_ops = {
- .inherits = &ata_sff_port_ops,
- .check_atapi_dma = octeon_cf_check_atapi_dma,
-diff --git a/drivers/ata/pata_oldpiix.c b/drivers/ata/pata_oldpiix.c
-index 84ac503..adee1cd 100644
---- a/drivers/ata/pata_oldpiix.c
-+++ b/drivers/ata/pata_oldpiix.c
-@@ -208,7 +208,7 @@ static struct scsi_host_template oldpiix_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations oldpiix_pata_ops = {
-+static const struct ata_port_operations oldpiix_pata_ops = {
- .inherits = &ata_bmdma_port_ops,
- .qc_issue = oldpiix_qc_issue,
- .cable_detect = ata_cable_40wire,
-diff --git a/drivers/ata/pata_opti.c b/drivers/ata/pata_opti.c
-index 99eddda..3a4c0aa 100644
---- a/drivers/ata/pata_opti.c
-+++ b/drivers/ata/pata_opti.c
-@@ -152,7 +152,7 @@ static struct scsi_host_template opti_sht = {
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations opti_port_ops = {
-+static const struct ata_port_operations opti_port_ops = {
- .inherits = &ata_sff_port_ops,
- .cable_detect = ata_cable_40wire,
- .set_piomode = opti_set_piomode,
-diff --git a/drivers/ata/pata_optidma.c b/drivers/ata/pata_optidma.c
-index 86885a4..8e9968d 100644
---- a/drivers/ata/pata_optidma.c
-+++ b/drivers/ata/pata_optidma.c
-@@ -337,7 +337,7 @@ static struct scsi_host_template optidma_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations optidma_port_ops = {
-+static const struct ata_port_operations optidma_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = ata_cable_40wire,
- .set_piomode = optidma_set_pio_mode,
-@@ -346,7 +346,7 @@ static struct ata_port_operations optidma_port_ops = {
- .prereset = optidma_pre_reset,
- };
-
--static struct ata_port_operations optiplus_port_ops = {
-+static const struct ata_port_operations optiplus_port_ops = {
- .inherits = &optidma_port_ops,
- .set_piomode = optiplus_set_pio_mode,
- .set_dmamode = optiplus_set_dma_mode,
-diff --git a/drivers/ata/pata_palmld.c b/drivers/ata/pata_palmld.c
-index 11fb4cc..1a14022 100644
---- a/drivers/ata/pata_palmld.c
-+++ b/drivers/ata/pata_palmld.c
-@@ -37,7 +37,7 @@ static struct scsi_host_template palmld_sht = {
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations palmld_port_ops = {
-+static const struct ata_port_operations palmld_port_ops = {
- .inherits = &ata_sff_port_ops,
- .sff_data_xfer = ata_sff_data_xfer_noirq,
- .cable_detect = ata_cable_40wire,
-diff --git a/drivers/ata/pata_pcmcia.c b/drivers/ata/pata_pcmcia.c
-index dc99e26..7f4b1e4 100644
---- a/drivers/ata/pata_pcmcia.c
-+++ b/drivers/ata/pata_pcmcia.c
-@@ -162,14 +162,14 @@ static struct scsi_host_template pcmcia_sht = {
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations pcmcia_port_ops = {
-+static const struct ata_port_operations pcmcia_port_ops = {
- .inherits = &ata_sff_port_ops,
- .sff_data_xfer = ata_sff_data_xfer_noirq,
- .cable_detect = ata_cable_40wire,
- .set_mode = pcmcia_set_mode,
- };
-
--static struct ata_port_operations pcmcia_8bit_port_ops = {
-+static const struct ata_port_operations pcmcia_8bit_port_ops = {
- .inherits = &ata_sff_port_ops,
- .sff_data_xfer = ata_data_xfer_8bit,
- .cable_detect = ata_cable_40wire,
-@@ -256,7 +256,7 @@ static int pcmcia_init_one(struct pcmcia_device *pdev)
- unsigned long io_base, ctl_base;
- void __iomem *io_addr, *ctl_addr;
- int n_ports = 1;
-- struct ata_port_operations *ops = &pcmcia_port_ops;
-+ const struct ata_port_operations *ops = &pcmcia_port_ops;
-
- info = kzalloc(sizeof(*info), GFP_KERNEL);
- if (info == NULL)
-diff --git a/drivers/ata/pata_pdc2027x.c b/drivers/ata/pata_pdc2027x.c
-index ca5cad0..3a1f125 100644
---- a/drivers/ata/pata_pdc2027x.c
-+++ b/drivers/ata/pata_pdc2027x.c
-@@ -132,14 +132,14 @@ static struct scsi_host_template pdc2027x_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations pdc2027x_pata100_ops = {
-+static const struct ata_port_operations pdc2027x_pata100_ops = {
- .inherits = &ata_bmdma_port_ops,
- .check_atapi_dma = pdc2027x_check_atapi_dma,
- .cable_detect = pdc2027x_cable_detect,
- .prereset = pdc2027x_prereset,
- };
-
--static struct ata_port_operations pdc2027x_pata133_ops = {
-+static const struct ata_port_operations pdc2027x_pata133_ops = {
- .inherits = &pdc2027x_pata100_ops,
- .mode_filter = pdc2027x_mode_filter,
- .set_piomode = pdc2027x_set_piomode,
-diff --git a/drivers/ata/pata_pdc202xx_old.c b/drivers/ata/pata_pdc202xx_old.c
-index 2911120..4bf62aa 100644
---- a/drivers/ata/pata_pdc202xx_old.c
-+++ b/drivers/ata/pata_pdc202xx_old.c
-@@ -274,7 +274,7 @@ static struct scsi_host_template pdc202xx_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations pdc2024x_port_ops = {
-+static const struct ata_port_operations pdc2024x_port_ops = {
- .inherits = &ata_bmdma_port_ops,
-
- .cable_detect = ata_cable_40wire,
-@@ -284,7 +284,7 @@ static struct ata_port_operations pdc2024x_port_ops = {
- .sff_exec_command = pdc202xx_exec_command,
- };
-
--static struct ata_port_operations pdc2026x_port_ops = {
-+static const struct ata_port_operations pdc2026x_port_ops = {
- .inherits = &pdc2024x_port_ops,
-
- .check_atapi_dma = pdc2026x_check_atapi_dma,
-diff --git a/drivers/ata/pata_platform.c b/drivers/ata/pata_platform.c
-index 3f6ebc6..a18c358 100644
---- a/drivers/ata/pata_platform.c
-+++ b/drivers/ata/pata_platform.c
-@@ -48,7 +48,7 @@ static struct scsi_host_template pata_platform_sht = {
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations pata_platform_port_ops = {
-+static const struct ata_port_operations pata_platform_port_ops = {
- .inherits = &ata_sff_port_ops,
- .sff_data_xfer = ata_sff_data_xfer_noirq,
- .cable_detect = ata_cable_unknown,
-diff --git a/drivers/ata/pata_qdi.c b/drivers/ata/pata_qdi.c
-index 45879dc..165a9f9 100644
---- a/drivers/ata/pata_qdi.c
-+++ b/drivers/ata/pata_qdi.c
-@@ -157,7 +157,7 @@ static struct scsi_host_template qdi_sht = {
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations qdi6500_port_ops = {
-+static const struct ata_port_operations qdi6500_port_ops = {
- .inherits = &ata_sff_port_ops,
- .qc_issue = qdi_qc_issue,
- .sff_data_xfer = qdi_data_xfer,
-@@ -165,7 +165,7 @@ static struct ata_port_operations qdi6500_port_ops = {
- .set_piomode = qdi6500_set_piomode,
- };
-
--static struct ata_port_operations qdi6580_port_ops = {
-+static const struct ata_port_operations qdi6580_port_ops = {
- .inherits = &qdi6500_port_ops,
- .set_piomode = qdi6580_set_piomode,
- };
-diff --git a/drivers/ata/pata_radisys.c b/drivers/ata/pata_radisys.c
-index 4401b33..716c5cc 100644
---- a/drivers/ata/pata_radisys.c
-+++ b/drivers/ata/pata_radisys.c
-@@ -187,7 +187,7 @@ static struct scsi_host_template radisys_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations radisys_pata_ops = {
-+static const struct ata_port_operations radisys_pata_ops = {
- .inherits = &ata_bmdma_port_ops,
- .qc_issue = radisys_qc_issue,
- .cable_detect = ata_cable_unknown,
-diff --git a/drivers/ata/pata_rb532_cf.c b/drivers/ata/pata_rb532_cf.c
-index 45f1e10..fab6bca 100644
---- a/drivers/ata/pata_rb532_cf.c
-+++ b/drivers/ata/pata_rb532_cf.c
-@@ -68,7 +68,7 @@ static irqreturn_t rb532_pata_irq_handler(int irq, void *dev_instance)
- return IRQ_HANDLED;
- }
-
--static struct ata_port_operations rb532_pata_port_ops = {
-+static const struct ata_port_operations rb532_pata_port_ops = {
- .inherits = &ata_sff_port_ops,
- .sff_data_xfer = ata_sff_data_xfer32,
- };
-diff --git a/drivers/ata/pata_rdc.c b/drivers/ata/pata_rdc.c
-index c843a1e..b5853c3 100644
---- a/drivers/ata/pata_rdc.c
-+++ b/drivers/ata/pata_rdc.c
-@@ -272,7 +272,7 @@ static void rdc_set_dmamode(struct ata_port *ap, struct ata_device *adev)
- pci_write_config_byte(dev, 0x48, udma_enable);
- }
-
--static struct ata_port_operations rdc_pata_ops = {
-+static const struct ata_port_operations rdc_pata_ops = {
- .inherits = &ata_bmdma32_port_ops,
- .cable_detect = rdc_pata_cable_detect,
- .set_piomode = rdc_set_piomode,
-diff --git a/drivers/ata/pata_rz1000.c b/drivers/ata/pata_rz1000.c
-index a5e4dfe..080c8c9 100644
---- a/drivers/ata/pata_rz1000.c
-+++ b/drivers/ata/pata_rz1000.c
-@@ -54,7 +54,7 @@ static struct scsi_host_template rz1000_sht = {
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations rz1000_port_ops = {
-+static const struct ata_port_operations rz1000_port_ops = {
- .inherits = &ata_sff_port_ops,
- .cable_detect = ata_cable_40wire,
- .set_mode = rz1000_set_mode,
-diff --git a/drivers/ata/pata_sc1200.c b/drivers/ata/pata_sc1200.c
-index 3bbed83..e309daf 100644
---- a/drivers/ata/pata_sc1200.c
-+++ b/drivers/ata/pata_sc1200.c
-@@ -207,7 +207,7 @@ static struct scsi_host_template sc1200_sht = {
- .sg_tablesize = LIBATA_DUMB_MAX_PRD,
- };
-
--static struct ata_port_operations sc1200_port_ops = {
-+static const struct ata_port_operations sc1200_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .qc_prep = ata_sff_dumb_qc_prep,
- .qc_issue = sc1200_qc_issue,
-diff --git a/drivers/ata/pata_scc.c b/drivers/ata/pata_scc.c
-index 4257d6b..4c1d9d5 100644
---- a/drivers/ata/pata_scc.c
-+++ b/drivers/ata/pata_scc.c
-@@ -965,7 +965,7 @@ static struct scsi_host_template scc_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations scc_pata_ops = {
-+static const struct ata_port_operations scc_pata_ops = {
- .inherits = &ata_bmdma_port_ops,
-
- .set_piomode = scc_set_piomode,
-diff --git a/drivers/ata/pata_sch.c b/drivers/ata/pata_sch.c
-index 99cceb45..e2e0a87 100644
---- a/drivers/ata/pata_sch.c
-+++ b/drivers/ata/pata_sch.c
-@@ -75,7 +75,7 @@ static struct scsi_host_template sch_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations sch_pata_ops = {
-+static const struct ata_port_operations sch_pata_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = ata_cable_unknown,
- .set_piomode = sch_set_piomode,
-diff --git a/drivers/ata/pata_serverworks.c b/drivers/ata/pata_serverworks.c
-index beaed12..39969f1 100644
---- a/drivers/ata/pata_serverworks.c
-+++ b/drivers/ata/pata_serverworks.c
-@@ -299,7 +299,7 @@ static struct scsi_host_template serverworks_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations serverworks_osb4_port_ops = {
-+static const struct ata_port_operations serverworks_osb4_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = serverworks_cable_detect,
- .mode_filter = serverworks_osb4_filter,
-@@ -307,7 +307,7 @@ static struct ata_port_operations serverworks_osb4_port_ops = {
- .set_dmamode = serverworks_set_dmamode,
- };
-
--static struct ata_port_operations serverworks_csb_port_ops = {
-+static const struct ata_port_operations serverworks_csb_port_ops = {
- .inherits = &serverworks_osb4_port_ops,
- .mode_filter = serverworks_csb_filter,
- };
-diff --git a/drivers/ata/pata_sil680.c b/drivers/ata/pata_sil680.c
-index a2ace48..0463b44 100644
---- a/drivers/ata/pata_sil680.c
-+++ b/drivers/ata/pata_sil680.c
-@@ -194,7 +194,7 @@ static struct scsi_host_template sil680_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations sil680_port_ops = {
-+static const struct ata_port_operations sil680_port_ops = {
- .inherits = &ata_bmdma32_port_ops,
- .cable_detect = sil680_cable_detect,
- .set_piomode = sil680_set_piomode,
-diff --git a/drivers/ata/pata_sis.c b/drivers/ata/pata_sis.c
-index 488e77b..b3724d5 100644
---- a/drivers/ata/pata_sis.c
-+++ b/drivers/ata/pata_sis.c
-@@ -503,47 +503,47 @@ static struct scsi_host_template sis_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations sis_133_for_sata_ops = {
-+static const struct ata_port_operations sis_133_for_sata_ops = {
- .inherits = &ata_bmdma_port_ops,
- .set_piomode = sis_133_set_piomode,
- .set_dmamode = sis_133_set_dmamode,
- .cable_detect = sis_133_cable_detect,
- };
-
--static struct ata_port_operations sis_base_ops = {
-+static const struct ata_port_operations sis_base_ops = {
- .inherits = &ata_bmdma_port_ops,
- .prereset = sis_pre_reset,
- };
-
--static struct ata_port_operations sis_133_ops = {
-+static const struct ata_port_operations sis_133_ops = {
- .inherits = &sis_base_ops,
- .set_piomode = sis_133_set_piomode,
- .set_dmamode = sis_133_set_dmamode,
- .cable_detect = sis_133_cable_detect,
- };
-
--static struct ata_port_operations sis_133_early_ops = {
-+static const struct ata_port_operations sis_133_early_ops = {
- .inherits = &sis_base_ops,
- .set_piomode = sis_100_set_piomode,
- .set_dmamode = sis_133_early_set_dmamode,
- .cable_detect = sis_66_cable_detect,
- };
-
--static struct ata_port_operations sis_100_ops = {
-+static const struct ata_port_operations sis_100_ops = {
- .inherits = &sis_base_ops,
- .set_piomode = sis_100_set_piomode,
- .set_dmamode = sis_100_set_dmamode,
- .cable_detect = sis_66_cable_detect,
- };
-
--static struct ata_port_operations sis_66_ops = {
-+static const struct ata_port_operations sis_66_ops = {
- .inherits = &sis_base_ops,
- .set_piomode = sis_old_set_piomode,
- .set_dmamode = sis_66_set_dmamode,
- .cable_detect = sis_66_cable_detect,
- };
-
--static struct ata_port_operations sis_old_ops = {
-+static const struct ata_port_operations sis_old_ops = {
- .inherits = &sis_base_ops,
- .set_piomode = sis_old_set_piomode,
- .set_dmamode = sis_old_set_dmamode,
-diff --git a/drivers/ata/pata_sl82c105.c b/drivers/ata/pata_sl82c105.c
-index 29f733c..43e9ca0 100644
---- a/drivers/ata/pata_sl82c105.c
-+++ b/drivers/ata/pata_sl82c105.c
-@@ -231,7 +231,7 @@ static struct scsi_host_template sl82c105_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations sl82c105_port_ops = {
-+static const struct ata_port_operations sl82c105_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .qc_defer = sl82c105_qc_defer,
- .bmdma_start = sl82c105_bmdma_start,
-diff --git a/drivers/ata/pata_triflex.c b/drivers/ata/pata_triflex.c
-index f1f13ff..df39e99 100644
---- a/drivers/ata/pata_triflex.c
-+++ b/drivers/ata/pata_triflex.c
-@@ -178,7 +178,7 @@ static struct scsi_host_template triflex_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations triflex_port_ops = {
-+static const struct ata_port_operations triflex_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .bmdma_start = triflex_bmdma_start,
- .bmdma_stop = triflex_bmdma_stop,
-diff --git a/drivers/ata/pata_via.c b/drivers/ata/pata_via.c
-index 1d73b8d..98a4b29 100644
---- a/drivers/ata/pata_via.c
-+++ b/drivers/ata/pata_via.c
-@@ -419,7 +419,7 @@ static struct scsi_host_template via_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations via_port_ops = {
-+static const struct ata_port_operations via_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = via_cable_detect,
- .set_piomode = via_set_piomode,
-@@ -429,7 +429,7 @@ static struct ata_port_operations via_port_ops = {
- .port_start = via_port_start,
- };
-
--static struct ata_port_operations via_port_ops_noirq = {
-+static const struct ata_port_operations via_port_ops_noirq = {
- .inherits = &via_port_ops,
- .sff_data_xfer = ata_sff_data_xfer_noirq,
- };
-diff --git a/drivers/ata/pata_winbond.c b/drivers/ata/pata_winbond.c
-index 6d8619b..ad511c4 100644
---- a/drivers/ata/pata_winbond.c
-+++ b/drivers/ata/pata_winbond.c
-@@ -125,7 +125,7 @@ static struct scsi_host_template winbond_sht = {
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations winbond_port_ops = {
-+static const struct ata_port_operations winbond_port_ops = {
- .inherits = &ata_sff_port_ops,
- .sff_data_xfer = winbond_data_xfer,
- .cable_detect = ata_cable_40wire,
-diff --git a/drivers/ata/pdc_adma.c b/drivers/ata/pdc_adma.c
-index 6c65b07..f996ec7 100644
---- a/drivers/ata/pdc_adma.c
-+++ b/drivers/ata/pdc_adma.c
-@@ -145,7 +145,7 @@ static struct scsi_host_template adma_ata_sht = {
- .dma_boundary = ADMA_DMA_BOUNDARY,
- };
-
--static struct ata_port_operations adma_ata_ops = {
-+static const struct ata_port_operations adma_ata_ops = {
- .inherits = &ata_sff_port_ops,
-
- .lost_interrupt = ATA_OP_NULL,
-diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
-index 172b57e..c49bc1e 100644
---- a/drivers/ata/sata_fsl.c
-+++ b/drivers/ata/sata_fsl.c
-@@ -1258,7 +1258,7 @@ static struct scsi_host_template sata_fsl_sht = {
- .dma_boundary = ATA_DMA_BOUNDARY,
- };
-
--static struct ata_port_operations sata_fsl_ops = {
-+static const struct ata_port_operations sata_fsl_ops = {
- .inherits = &sata_pmp_port_ops,
-
- .qc_defer = ata_std_qc_defer,
-diff --git a/drivers/ata/sata_inic162x.c b/drivers/ata/sata_inic162x.c
-index 4406902..60603ef 100644
---- a/drivers/ata/sata_inic162x.c
-+++ b/drivers/ata/sata_inic162x.c
-@@ -721,7 +721,7 @@ static int inic_port_start(struct ata_port *ap)
- return 0;
- }
-
--static struct ata_port_operations inic_port_ops = {
-+static const struct ata_port_operations inic_port_ops = {
- .inherits = &sata_port_ops,
-
- .check_atapi_dma = inic_check_atapi_dma,
-diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
-index cf41126..8107be6 100644
---- a/drivers/ata/sata_mv.c
-+++ b/drivers/ata/sata_mv.c
-@@ -656,7 +656,7 @@ static struct scsi_host_template mv6_sht = {
- .dma_boundary = MV_DMA_BOUNDARY,
- };
-
--static struct ata_port_operations mv5_ops = {
-+static const struct ata_port_operations mv5_ops = {
- .inherits = &ata_sff_port_ops,
-
- .lost_interrupt = ATA_OP_NULL,
-@@ -678,7 +678,7 @@ static struct ata_port_operations mv5_ops = {
- .port_stop = mv_port_stop,
- };
-
--static struct ata_port_operations mv6_ops = {
-+static const struct ata_port_operations mv6_ops = {
- .inherits = &mv5_ops,
- .dev_config = mv6_dev_config,
- .scr_read = mv_scr_read,
-@@ -698,7 +698,7 @@ static struct ata_port_operations mv6_ops = {
- .bmdma_status = mv_bmdma_status,
- };
-
--static struct ata_port_operations mv_iie_ops = {
-+static const struct ata_port_operations mv_iie_ops = {
- .inherits = &mv6_ops,
- .dev_config = ATA_OP_NULL,
- .qc_prep = mv_qc_prep_iie,
-diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
-index ae2297c..d5c9c33 100644
---- a/drivers/ata/sata_nv.c
-+++ b/drivers/ata/sata_nv.c
-@@ -464,7 +464,7 @@ static struct scsi_host_template nv_swncq_sht = {
- * cases. Define nv_hardreset() which only kicks in for post-boot
- * probing and use it for all variants.
- */
--static struct ata_port_operations nv_generic_ops = {
-+static const struct ata_port_operations nv_generic_ops = {
- .inherits = &ata_bmdma_port_ops,
- .lost_interrupt = ATA_OP_NULL,
- .scr_read = nv_scr_read,
-@@ -472,20 +472,20 @@ static struct ata_port_operations nv_generic_ops = {
- .hardreset = nv_hardreset,
- };
-
--static struct ata_port_operations nv_nf2_ops = {
-+static const struct ata_port_operations nv_nf2_ops = {
- .inherits = &nv_generic_ops,
- .freeze = nv_nf2_freeze,
- .thaw = nv_nf2_thaw,
- };
-
--static struct ata_port_operations nv_ck804_ops = {
-+static const struct ata_port_operations nv_ck804_ops = {
- .inherits = &nv_generic_ops,
- .freeze = nv_ck804_freeze,
- .thaw = nv_ck804_thaw,
- .host_stop = nv_ck804_host_stop,
- };
-
--static struct ata_port_operations nv_adma_ops = {
-+static const struct ata_port_operations nv_adma_ops = {
- .inherits = &nv_ck804_ops,
-
- .check_atapi_dma = nv_adma_check_atapi_dma,
-@@ -509,7 +509,7 @@ static struct ata_port_operations nv_adma_ops = {
- .host_stop = nv_adma_host_stop,
- };
-
--static struct ata_port_operations nv_swncq_ops = {
-+static const struct ata_port_operations nv_swncq_ops = {
- .inherits = &nv_generic_ops,
-
- .qc_defer = ata_std_qc_defer,
-diff --git a/drivers/ata/sata_promise.c b/drivers/ata/sata_promise.c
-index 07d8d00..6cc70bb 100644
---- a/drivers/ata/sata_promise.c
-+++ b/drivers/ata/sata_promise.c
-@@ -195,7 +195,7 @@ static const struct ata_port_operations pdc_common_ops = {
- .error_handler = pdc_error_handler,
- };
-
--static struct ata_port_operations pdc_sata_ops = {
-+static const struct ata_port_operations pdc_sata_ops = {
- .inherits = &pdc_common_ops,
- .cable_detect = pdc_sata_cable_detect,
- .freeze = pdc_sata_freeze,
-@@ -208,14 +208,14 @@ static struct ata_port_operations pdc_sata_ops = {
-
- /* First-generation chips need a more restrictive ->check_atapi_dma op,
- and ->freeze/thaw that ignore the hotplug controls. */
--static struct ata_port_operations pdc_old_sata_ops = {
-+static const struct ata_port_operations pdc_old_sata_ops = {
- .inherits = &pdc_sata_ops,
- .freeze = pdc_freeze,
- .thaw = pdc_thaw,
- .check_atapi_dma = pdc_old_sata_check_atapi_dma,
- };
-
--static struct ata_port_operations pdc_pata_ops = {
-+static const struct ata_port_operations pdc_pata_ops = {
- .inherits = &pdc_common_ops,
- .cable_detect = pdc_pata_cable_detect,
- .freeze = pdc_freeze,
-diff --git a/drivers/ata/sata_qstor.c b/drivers/ata/sata_qstor.c
-index 326c0cf..36ecebe 100644
---- a/drivers/ata/sata_qstor.c
-+++ b/drivers/ata/sata_qstor.c
-@@ -132,7 +132,7 @@ static struct scsi_host_template qs_ata_sht = {
- .dma_boundary = QS_DMA_BOUNDARY,
- };
-
--static struct ata_port_operations qs_ata_ops = {
-+static const struct ata_port_operations qs_ata_ops = {
- .inherits = &ata_sff_port_ops,
-
- .check_atapi_dma = qs_check_atapi_dma,
-diff --git a/drivers/ata/sata_sil.c b/drivers/ata/sata_sil.c
-index 3cb69d5..0871d3c 100644
---- a/drivers/ata/sata_sil.c
-+++ b/drivers/ata/sata_sil.c
-@@ -182,7 +182,7 @@ static struct scsi_host_template sil_sht = {
- .sg_tablesize = ATA_MAX_PRD
- };
-
--static struct ata_port_operations sil_ops = {
-+static const struct ata_port_operations sil_ops = {
- .inherits = &ata_bmdma32_port_ops,
- .dev_config = sil_dev_config,
- .set_mode = sil_set_mode,
-diff --git a/drivers/ata/sata_sil24.c b/drivers/ata/sata_sil24.c
-index e6946fc..eddb794 100644
---- a/drivers/ata/sata_sil24.c
-+++ b/drivers/ata/sata_sil24.c
-@@ -388,7 +388,7 @@ static struct scsi_host_template sil24_sht = {
- .dma_boundary = ATA_DMA_BOUNDARY,
- };
-
--static struct ata_port_operations sil24_ops = {
-+static const struct ata_port_operations sil24_ops = {
- .inherits = &sata_pmp_port_ops,
-
- .qc_defer = sil24_qc_defer,
-diff --git a/drivers/ata/sata_sis.c b/drivers/ata/sata_sis.c
-index f8a91bf..9cb06b6 100644
---- a/drivers/ata/sata_sis.c
-+++ b/drivers/ata/sata_sis.c
-@@ -89,7 +89,7 @@ static struct scsi_host_template sis_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations sis_ops = {
-+static const struct ata_port_operations sis_ops = {
- .inherits = &ata_bmdma_port_ops,
- .scr_read = sis_scr_read,
- .scr_write = sis_scr_write,
-diff --git a/drivers/ata/sata_svw.c b/drivers/ata/sata_svw.c
-index 7257f2d..d04c6f5 100644
---- a/drivers/ata/sata_svw.c
-+++ b/drivers/ata/sata_svw.c
-@@ -344,7 +344,7 @@ static struct scsi_host_template k2_sata_sht = {
- };
-
-
--static struct ata_port_operations k2_sata_ops = {
-+static const struct ata_port_operations k2_sata_ops = {
- .inherits = &ata_bmdma_port_ops,
- .sff_tf_load = k2_sata_tf_load,
- .sff_tf_read = k2_sata_tf_read,
-diff --git a/drivers/ata/sata_sx4.c b/drivers/ata/sata_sx4.c
-index bbcf970..cd0df0d 100644
---- a/drivers/ata/sata_sx4.c
-+++ b/drivers/ata/sata_sx4.c
-@@ -248,7 +248,7 @@ static struct scsi_host_template pdc_sata_sht = {
- };
-
- /* TODO: inherit from base port_ops after converting to new EH */
--static struct ata_port_operations pdc_20621_ops = {
-+static const struct ata_port_operations pdc_20621_ops = {
- .inherits = &ata_sff_port_ops,
-
- .check_atapi_dma = pdc_check_atapi_dma,
-diff --git a/drivers/ata/sata_uli.c b/drivers/ata/sata_uli.c
-index e5bff47..089d859 100644
---- a/drivers/ata/sata_uli.c
-+++ b/drivers/ata/sata_uli.c
-@@ -79,7 +79,7 @@ static struct scsi_host_template uli_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations uli_ops = {
-+static const struct ata_port_operations uli_ops = {
- .inherits = &ata_bmdma_port_ops,
- .scr_read = uli_scr_read,
- .scr_write = uli_scr_write,
-diff --git a/drivers/ata/sata_via.c b/drivers/ata/sata_via.c
-index f5dcca7..77b94eb 100644
---- a/drivers/ata/sata_via.c
-+++ b/drivers/ata/sata_via.c
-@@ -115,32 +115,32 @@ static struct scsi_host_template svia_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations svia_base_ops = {
-+static const struct ata_port_operations svia_base_ops = {
- .inherits = &ata_bmdma_port_ops,
- .sff_tf_load = svia_tf_load,
- };
-
--static struct ata_port_operations vt6420_sata_ops = {
-+static const struct ata_port_operations vt6420_sata_ops = {
- .inherits = &svia_base_ops,
- .freeze = svia_noop_freeze,
- .prereset = vt6420_prereset,
- .bmdma_start = vt6420_bmdma_start,
- };
-
--static struct ata_port_operations vt6421_pata_ops = {
-+static const struct ata_port_operations vt6421_pata_ops = {
- .inherits = &svia_base_ops,
- .cable_detect = vt6421_pata_cable_detect,
- .set_piomode = vt6421_set_pio_mode,
- .set_dmamode = vt6421_set_dma_mode,
- };
-
--static struct ata_port_operations vt6421_sata_ops = {
-+static const struct ata_port_operations vt6421_sata_ops = {
- .inherits = &svia_base_ops,
- .scr_read = svia_scr_read,
- .scr_write = svia_scr_write,
- };
-
--static struct ata_port_operations vt8251_ops = {
-+static const struct ata_port_operations vt8251_ops = {
- .inherits = &svia_base_ops,
- .hardreset = sata_std_hardreset,
- .scr_read = vt8251_scr_read,
-diff --git a/drivers/ata/sata_vsc.c b/drivers/ata/sata_vsc.c
-index 8b2a278..51e65d3 100644
---- a/drivers/ata/sata_vsc.c
-+++ b/drivers/ata/sata_vsc.c
-@@ -306,7 +306,7 @@ static struct scsi_host_template vsc_sata_sht = {
- };
-
-
--static struct ata_port_operations vsc_sata_ops = {
-+static const struct ata_port_operations vsc_sata_ops = {
- .inherits = &ata_bmdma_port_ops,
- /* The IRQ handling is not quite standard SFF behaviour so we
- cannot use the default lost interrupt handler */
-diff --git a/drivers/atm/adummy.c b/drivers/atm/adummy.c
-index 5effec6..7e4019a 100644
---- a/drivers/atm/adummy.c
-+++ b/drivers/atm/adummy.c
-@@ -77,7 +77,7 @@ adummy_send(struct atm_vcc *vcc, struct sk_buff *skb)
- vcc->pop(vcc, skb);
- else
- dev_kfree_skb_any(skb);
-- atomic_inc(&vcc->stats->tx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
-
- return 0;
- }
-diff --git a/drivers/atm/ambassador.c b/drivers/atm/ambassador.c
-index 66e1813..26a27c6 100644
---- a/drivers/atm/ambassador.c
-+++ b/drivers/atm/ambassador.c
-@@ -453,7 +453,7 @@ static void tx_complete (amb_dev * dev, tx_out * tx) {
- PRINTD (DBG_FLOW|DBG_TX, "tx_complete %p %p", dev, tx);
-
- // VC layer stats
-- atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
-+ atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
-
- // free the descriptor
- kfree (tx_descr);
-@@ -494,7 +494,7 @@ static void rx_complete (amb_dev * dev, rx_out * rx) {
- dump_skb ("<<<", vc, skb);
-
- // VC layer stats
-- atomic_inc(&atm_vcc->stats->rx);
-+ atomic_inc_unchecked(&atm_vcc->stats->rx);
- __net_timestamp(skb);
- // end of our responsability
- atm_vcc->push (atm_vcc, skb);
-@@ -509,7 +509,7 @@ static void rx_complete (amb_dev * dev, rx_out * rx) {
- } else {
- PRINTK (KERN_INFO, "dropped over-size frame");
- // should we count this?
-- atomic_inc(&atm_vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
- }
-
- } else {
-@@ -1341,7 +1341,7 @@ static int amb_send (struct atm_vcc * atm_vcc, struct sk_buff * skb) {
- }
-
- if (check_area (skb->data, skb->len)) {
-- atomic_inc(&atm_vcc->stats->tx_err);
-+ atomic_inc_unchecked(&atm_vcc->stats->tx_err);
- return -ENOMEM; // ?
- }
-
-diff --git a/drivers/atm/atmtcp.c b/drivers/atm/atmtcp.c
-index 02ad83d..6daffeb 100644
---- a/drivers/atm/atmtcp.c
-+++ b/drivers/atm/atmtcp.c
-@@ -206,7 +206,7 @@ static int atmtcp_v_send(struct atm_vcc *vcc,struct sk_buff *skb)
- if (vcc->pop) vcc->pop(vcc,skb);
- else dev_kfree_skb(skb);
- if (dev_data) return 0;
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- return -ENOLINK;
- }
- size = skb->len+sizeof(struct atmtcp_hdr);
-@@ -214,7 +214,7 @@ static int atmtcp_v_send(struct atm_vcc *vcc,struct sk_buff *skb)
- if (!new_skb) {
- if (vcc->pop) vcc->pop(vcc,skb);
- else dev_kfree_skb(skb);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- return -ENOBUFS;
- }
- hdr = (void *) skb_put(new_skb,sizeof(struct atmtcp_hdr));
-@@ -225,8 +225,8 @@ static int atmtcp_v_send(struct atm_vcc *vcc,struct sk_buff *skb)
- if (vcc->pop) vcc->pop(vcc,skb);
- else dev_kfree_skb(skb);
- out_vcc->push(out_vcc,new_skb);
-- atomic_inc(&vcc->stats->tx);
-- atomic_inc(&out_vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
-+ atomic_inc_unchecked(&out_vcc->stats->rx);
- return 0;
- }
-
-@@ -300,7 +300,7 @@ static int atmtcp_c_send(struct atm_vcc *vcc,struct sk_buff *skb)
- out_vcc = find_vcc(dev, ntohs(hdr->vpi), ntohs(hdr->vci));
- read_unlock(&vcc_sklist_lock);
- if (!out_vcc) {
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- goto done;
- }
- skb_pull(skb,sizeof(struct atmtcp_hdr));
-@@ -312,8 +312,8 @@ static int atmtcp_c_send(struct atm_vcc *vcc,struct sk_buff *skb)
- __net_timestamp(new_skb);
- skb_copy_from_linear_data(skb, skb_put(new_skb, skb->len), skb->len);
- out_vcc->push(out_vcc,new_skb);
-- atomic_inc(&vcc->stats->tx);
-- atomic_inc(&out_vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
-+ atomic_inc_unchecked(&out_vcc->stats->rx);
- done:
- if (vcc->pop) vcc->pop(vcc,skb);
- else dev_kfree_skb(skb);
-diff --git a/drivers/atm/eni.c b/drivers/atm/eni.c
-index 0c30261..3da356e 100644
---- a/drivers/atm/eni.c
-+++ b/drivers/atm/eni.c
-@@ -525,7 +525,7 @@ static int rx_aal0(struct atm_vcc *vcc)
- DPRINTK(DEV_LABEL "(itf %d): trashing empty cell\n",
- vcc->dev->number);
- length = 0;
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- }
- else {
- length = ATM_CELL_SIZE-1; /* no HEC */
-@@ -580,7 +580,7 @@ static int rx_aal5(struct atm_vcc *vcc)
- size);
- }
- eff = length = 0;
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- }
- else {
- size = (descr & MID_RED_COUNT)*(ATM_CELL_PAYLOAD >> 2);
-@@ -597,7 +597,7 @@ static int rx_aal5(struct atm_vcc *vcc)
- "(VCI=%d,length=%ld,size=%ld (descr 0x%lx))\n",
- vcc->dev->number,vcc->vci,length,size << 2,descr);
- length = eff = 0;
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- }
- }
- skb = eff ? atm_alloc_charge(vcc,eff << 2,GFP_ATOMIC) : NULL;
-@@ -770,7 +770,7 @@ rx_dequeued++;
- vcc->push(vcc,skb);
- pushed++;
- }
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
- }
- wake_up(&eni_dev->rx_wait);
- }
-@@ -1227,7 +1227,7 @@ static void dequeue_tx(struct atm_dev *dev)
- PCI_DMA_TODEVICE);
- if (vcc->pop) vcc->pop(vcc,skb);
- else dev_kfree_skb_irq(skb);
-- atomic_inc(&vcc->stats->tx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
- wake_up(&eni_dev->tx_wait);
- dma_complete++;
- }
-@@ -1570,7 +1570,7 @@ tx_complete++;
- /*--------------------------------- entries ---------------------------------*/
-
-
--static const char *media_name[] __devinitdata = {
-+static const char *media_name[] __devinitconst = {
- "MMF", "SMF", "MMF", "03?", /* 0- 3 */
- "UTP", "05?", "06?", "07?", /* 4- 7 */
- "TAXI","09?", "10?", "11?", /* 8-11 */
-diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c
-index cd5049a..a51209f 100644
---- a/drivers/atm/firestream.c
-+++ b/drivers/atm/firestream.c
-@@ -748,7 +748,7 @@ static void process_txdone_queue (struct fs_dev *dev, struct queue *q)
- }
- }
-
-- atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
-+ atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
-
- fs_dprintk (FS_DEBUG_TXMEM, "i");
- fs_dprintk (FS_DEBUG_ALLOC, "Free t-skb: %p\n", skb);
-@@ -815,7 +815,7 @@ static void process_incoming (struct fs_dev *dev, struct queue *q)
- #endif
- skb_put (skb, qe->p1 & 0xffff);
- ATM_SKB(skb)->vcc = atm_vcc;
-- atomic_inc(&atm_vcc->stats->rx);
-+ atomic_inc_unchecked(&atm_vcc->stats->rx);
- __net_timestamp(skb);
- fs_dprintk (FS_DEBUG_ALLOC, "Free rec-skb: %p (pushed)\n", skb);
- atm_vcc->push (atm_vcc, skb);
-@@ -836,12 +836,12 @@ static void process_incoming (struct fs_dev *dev, struct queue *q)
- kfree (pe);
- }
- if (atm_vcc)
-- atomic_inc(&atm_vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
- break;
- case 0x1f: /* Reassembly abort: no buffers. */
- /* Silently increment error counter. */
- if (atm_vcc)
-- atomic_inc(&atm_vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
- break;
- default: /* Hmm. Haven't written the code to handle the others yet... -- REW */
- printk (KERN_WARNING "Don't know what to do with RX status %x: %s.\n",
-diff --git a/drivers/atm/fore200e.c b/drivers/atm/fore200e.c
-index f766cc4..a34002e 100644
---- a/drivers/atm/fore200e.c
-+++ b/drivers/atm/fore200e.c
-@@ -931,9 +931,9 @@ fore200e_tx_irq(struct fore200e* fore200e)
- #endif
- /* check error condition */
- if (*entry->status & STATUS_ERROR)
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- else
-- atomic_inc(&vcc->stats->tx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
- }
- }
-
-@@ -1082,7 +1082,7 @@ fore200e_push_rpd(struct fore200e* fore200e, struct atm_vcc* vcc, struct rpd* rp
- if (skb == NULL) {
- DPRINTK(2, "unable to alloc new skb, rx PDU length = %d\n", pdu_len);
-
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- return -ENOMEM;
- }
-
-@@ -1125,14 +1125,14 @@ fore200e_push_rpd(struct fore200e* fore200e, struct atm_vcc* vcc, struct rpd* rp
-
- dev_kfree_skb_any(skb);
-
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- return -ENOMEM;
- }
-
- ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
-
- vcc->push(vcc, skb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
-
- ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
-
-@@ -1210,7 +1210,7 @@ fore200e_rx_irq(struct fore200e* fore200e)
- DPRINTK(2, "damaged PDU on %d.%d.%d\n",
- fore200e->atm_dev->number,
- entry->rpd->atm_header.vpi, entry->rpd->atm_header.vci);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- }
- }
-
-@@ -1655,7 +1655,7 @@ fore200e_send(struct atm_vcc *vcc, struct sk_buff *skb)
- goto retry_here;
- }
-
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
-
- fore200e->tx_sat++;
- DPRINTK(2, "tx queue of device %s is saturated, PDU dropped - heartbeat is %08x\n",
-diff --git a/drivers/atm/he.c b/drivers/atm/he.c
-index 7066703..2b130de 100644
---- a/drivers/atm/he.c
-+++ b/drivers/atm/he.c
-@@ -1769,7 +1769,7 @@ he_service_rbrq(struct he_dev *he_dev, int group)
-
- if (RBRQ_HBUF_ERR(he_dev->rbrq_head)) {
- hprintk("HBUF_ERR! (cid 0x%x)\n", cid);
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- goto return_host_buffers;
- }
-
-@@ -1802,7 +1802,7 @@ he_service_rbrq(struct he_dev *he_dev, int group)
- RBRQ_LEN_ERR(he_dev->rbrq_head)
- ? "LEN_ERR" : "",
- vcc->vpi, vcc->vci);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- goto return_host_buffers;
- }
-
-@@ -1861,7 +1861,7 @@ he_service_rbrq(struct he_dev *he_dev, int group)
- vcc->push(vcc, skb);
- spin_lock(&he_dev->global_lock);
-
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
-
- return_host_buffers:
- ++pdus_assembled;
-@@ -2206,7 +2206,7 @@ __enqueue_tpd(struct he_dev *he_dev, struct he_tpd *tpd, unsigned cid)
- tpd->vcc->pop(tpd->vcc, tpd->skb);
- else
- dev_kfree_skb_any(tpd->skb);
-- atomic_inc(&tpd->vcc->stats->tx_err);
-+ atomic_inc_unchecked(&tpd->vcc->stats->tx_err);
- }
- pci_pool_free(he_dev->tpd_pool, tpd, TPD_ADDR(tpd->status));
- return;
-@@ -2618,7 +2618,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
- vcc->pop(vcc, skb);
- else
- dev_kfree_skb_any(skb);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- return -EINVAL;
- }
-
-@@ -2629,7 +2629,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
- vcc->pop(vcc, skb);
- else
- dev_kfree_skb_any(skb);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- return -EINVAL;
- }
- #endif
-@@ -2641,7 +2641,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
- vcc->pop(vcc, skb);
- else
- dev_kfree_skb_any(skb);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- spin_unlock_irqrestore(&he_dev->global_lock, flags);
- return -ENOMEM;
- }
-@@ -2683,7 +2683,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
- vcc->pop(vcc, skb);
- else
- dev_kfree_skb_any(skb);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- spin_unlock_irqrestore(&he_dev->global_lock, flags);
- return -ENOMEM;
- }
-@@ -2714,7 +2714,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
- __enqueue_tpd(he_dev, tpd, cid);
- spin_unlock_irqrestore(&he_dev->global_lock, flags);
-
-- atomic_inc(&vcc->stats->tx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
-
- return 0;
- }
-diff --git a/drivers/atm/horizon.c b/drivers/atm/horizon.c
-index 4e49021..01b1512 100644
---- a/drivers/atm/horizon.c
-+++ b/drivers/atm/horizon.c
-@@ -1033,7 +1033,7 @@ static void rx_schedule (hrz_dev * dev, int irq) {
- {
- struct atm_vcc * vcc = ATM_SKB(skb)->vcc;
- // VC layer stats
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
- __net_timestamp(skb);
- // end of our responsability
- vcc->push (vcc, skb);
-@@ -1185,7 +1185,7 @@ static void tx_schedule (hrz_dev * const dev, int irq) {
- dev->tx_iovec = NULL;
-
- // VC layer stats
-- atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
-+ atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
-
- // free the skb
- hrz_kfree_skb (skb);
-diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c
-index e33ae00..9deb4ab 100644
---- a/drivers/atm/idt77252.c
-+++ b/drivers/atm/idt77252.c
-@@ -810,7 +810,7 @@ drain_scq(struct idt77252_dev *card, struct vc_map *vc)
- else
- dev_kfree_skb(skb);
-
-- atomic_inc(&vcc->stats->tx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
- }
-
- atomic_dec(&scq->used);
-@@ -1073,13 +1073,13 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
- if ((sb = dev_alloc_skb(64)) == NULL) {
- printk("%s: Can't allocate buffers for aal0.\n",
- card->name);
-- atomic_add(i, &vcc->stats->rx_drop);
-+ atomic_add_unchecked(i, &vcc->stats->rx_drop);
- break;
- }
- if (!atm_charge(vcc, sb->truesize)) {
- RXPRINTK("%s: atm_charge() dropped aal0 packets.\n",
- card->name);
-- atomic_add(i - 1, &vcc->stats->rx_drop);
-+ atomic_add_unchecked(i - 1, &vcc->stats->rx_drop);
- dev_kfree_skb(sb);
- break;
- }
-@@ -1096,7 +1096,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
- ATM_SKB(sb)->vcc = vcc;
- __net_timestamp(sb);
- vcc->push(vcc, sb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
-
- cell += ATM_CELL_PAYLOAD;
- }
-@@ -1133,13 +1133,13 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
- "(CDC: %08x)\n",
- card->name, len, rpp->len, readl(SAR_REG_CDC));
- recycle_rx_pool_skb(card, rpp);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- return;
- }
- if (stat & SAR_RSQE_CRC) {
- RXPRINTK("%s: AAL5 CRC error.\n", card->name);
- recycle_rx_pool_skb(card, rpp);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- return;
- }
- if (skb_queue_len(&rpp->queue) > 1) {
-@@ -1150,7 +1150,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
- RXPRINTK("%s: Can't alloc RX skb.\n",
- card->name);
- recycle_rx_pool_skb(card, rpp);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- return;
- }
- if (!atm_charge(vcc, skb->truesize)) {
-@@ -1169,7 +1169,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
- __net_timestamp(skb);
-
- vcc->push(vcc, skb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
-
- return;
- }
-@@ -1191,7 +1191,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
- __net_timestamp(skb);
-
- vcc->push(vcc, skb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
-
- if (skb->truesize > SAR_FB_SIZE_3)
- add_rx_skb(card, 3, SAR_FB_SIZE_3, 1);
-@@ -1303,14 +1303,14 @@ idt77252_rx_raw(struct idt77252_dev *card)
- if (vcc->qos.aal != ATM_AAL0) {
- RPRINTK("%s: raw cell for non AAL0 vc %u.%u\n",
- card->name, vpi, vci);
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- goto drop;
- }
-
- if ((sb = dev_alloc_skb(64)) == NULL) {
- printk("%s: Can't allocate buffers for AAL0.\n",
- card->name);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- goto drop;
- }
-
-@@ -1329,7 +1329,7 @@ idt77252_rx_raw(struct idt77252_dev *card)
- ATM_SKB(sb)->vcc = vcc;
- __net_timestamp(sb);
- vcc->push(vcc, sb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
-
- drop:
- skb_pull(queue, 64);
-@@ -1954,13 +1954,13 @@ idt77252_send_skb(struct atm_vcc *vcc, struct sk_buff *skb, int oam)
-
- if (vc == NULL) {
- printk("%s: NULL connection in send().\n", card->name);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- dev_kfree_skb(skb);
- return -EINVAL;
- }
- if (!test_bit(VCF_TX, &vc->flags)) {
- printk("%s: Trying to transmit on a non-tx VC.\n", card->name);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- dev_kfree_skb(skb);
- return -EINVAL;
- }
-@@ -1972,14 +1972,14 @@ idt77252_send_skb(struct atm_vcc *vcc, struct sk_buff *skb, int oam)
- break;
- default:
- printk("%s: Unsupported AAL: %d\n", card->name, vcc->qos.aal);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- dev_kfree_skb(skb);
- return -EINVAL;
- }
-
- if (skb_shinfo(skb)->nr_frags != 0) {
- printk("%s: No scatter-gather yet.\n", card->name);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- dev_kfree_skb(skb);
- return -EINVAL;
- }
-@@ -1987,7 +1987,7 @@ idt77252_send_skb(struct atm_vcc *vcc, struct sk_buff *skb, int oam)
-
- err = queue_skb(card, vc, skb, oam);
- if (err) {
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- dev_kfree_skb(skb);
- return err;
- }
-@@ -2010,7 +2010,7 @@ idt77252_send_oam(struct atm_vcc *vcc, void *cell, int flags)
- skb = dev_alloc_skb(64);
- if (!skb) {
- printk("%s: Out of memory in send_oam().\n", card->name);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- return -ENOMEM;
- }
- atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
-diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c
-index b2c1b37..faa672b 100644
---- a/drivers/atm/iphase.c
-+++ b/drivers/atm/iphase.c
-@@ -1123,7 +1123,7 @@ static int rx_pkt(struct atm_dev *dev)
- status = (u_short) (buf_desc_ptr->desc_mode);
- if (status & (RX_CER | RX_PTE | RX_OFL))
- {
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- IF_ERR(printk("IA: bad packet, dropping it");)
- if (status & RX_CER) {
- IF_ERR(printk(" cause: packet CRC error\n");)
-@@ -1146,7 +1146,7 @@ static int rx_pkt(struct atm_dev *dev)
- len = dma_addr - buf_addr;
- if (len > iadev->rx_buf_sz) {
- printk("Over %d bytes sdu received, dropped!!!\n", iadev->rx_buf_sz);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- goto out_free_desc;
- }
-
-@@ -1296,7 +1296,7 @@ static void rx_dle_intr(struct atm_dev *dev)
- ia_vcc = INPH_IA_VCC(vcc);
- if (ia_vcc == NULL)
- {
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- dev_kfree_skb_any(skb);
- atm_return(vcc, atm_guess_pdu2truesize(len));
- goto INCR_DLE;
-@@ -1308,7 +1308,7 @@ static void rx_dle_intr(struct atm_dev *dev)
- if ((length > iadev->rx_buf_sz) || (length >
- (skb->len - sizeof(struct cpcs_trailer))))
- {
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- IF_ERR(printk("rx_dle_intr: Bad AAL5 trailer %d (skb len %d)",
- length, skb->len);)
- dev_kfree_skb_any(skb);
-@@ -1324,7 +1324,7 @@ static void rx_dle_intr(struct atm_dev *dev)
-
- IF_RX(printk("rx_dle_intr: skb push");)
- vcc->push(vcc,skb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
- iadev->rx_pkt_cnt++;
- }
- INCR_DLE:
-@@ -2806,15 +2806,15 @@ static int ia_ioctl(struct atm_dev *dev, unsigned int cmd, void __user *arg)
- {
- struct k_sonet_stats *stats;
- stats = &PRIV(_ia_dev[board])->sonet_stats;
-- printk("section_bip: %d\n", atomic_read(&stats->section_bip));
-- printk("line_bip : %d\n", atomic_read(&stats->line_bip));
-- printk("path_bip : %d\n", atomic_read(&stats->path_bip));
-- printk("line_febe : %d\n", atomic_read(&stats->line_febe));
-- printk("path_febe : %d\n", atomic_read(&stats->path_febe));
-- printk("corr_hcs : %d\n", atomic_read(&stats->corr_hcs));
-- printk("uncorr_hcs : %d\n", atomic_read(&stats->uncorr_hcs));
-- printk("tx_cells : %d\n", atomic_read(&stats->tx_cells));
-- printk("rx_cells : %d\n", atomic_read(&stats->rx_cells));
-+ printk("section_bip: %d\n", atomic_read_unchecked(&stats->section_bip));
-+ printk("line_bip : %d\n", atomic_read_unchecked(&stats->line_bip));
-+ printk("path_bip : %d\n", atomic_read_unchecked(&stats->path_bip));
-+ printk("line_febe : %d\n", atomic_read_unchecked(&stats->line_febe));
-+ printk("path_febe : %d\n", atomic_read_unchecked(&stats->path_febe));
-+ printk("corr_hcs : %d\n", atomic_read_unchecked(&stats->corr_hcs));
-+ printk("uncorr_hcs : %d\n", atomic_read_unchecked(&stats->uncorr_hcs));
-+ printk("tx_cells : %d\n", atomic_read_unchecked(&stats->tx_cells));
-+ printk("rx_cells : %d\n", atomic_read_unchecked(&stats->rx_cells));
- }
- ia_cmds.status = 0;
- break;
-@@ -2919,7 +2919,7 @@ static int ia_pkt_tx (struct atm_vcc *vcc, struct sk_buff *skb) {
- if ((desc == 0) || (desc > iadev->num_tx_desc))
- {
- IF_ERR(printk(DEV_LABEL "invalid desc for send: %d\n", desc);)
-- atomic_inc(&vcc->stats->tx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
- if (vcc->pop)
- vcc->pop(vcc, skb);
- else
-@@ -3024,14 +3024,14 @@ static int ia_pkt_tx (struct atm_vcc *vcc, struct sk_buff *skb) {
- ATM_DESC(skb) = vcc->vci;
- skb_queue_tail(&iadev->tx_dma_q, skb);
-
-- atomic_inc(&vcc->stats->tx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
- iadev->tx_pkt_cnt++;
- /* Increment transaction counter */
- writel(2, iadev->dma+IPHASE5575_TX_COUNTER);
-
- #if 0
- /* add flow control logic */
-- if (atomic_read(&vcc->stats->tx) % 20 == 0) {
-+ if (atomic_read_unchecked(&vcc->stats->tx) % 20 == 0) {
- if (iavcc->vc_desc_cnt > 10) {
- vcc->tx_quota = vcc->tx_quota * 3 / 4;
- printk("Tx1: vcc->tx_quota = %d \n", (u32)vcc->tx_quota );
-diff --git a/drivers/atm/lanai.c b/drivers/atm/lanai.c
-index cf97c34..8d30655 100644
---- a/drivers/atm/lanai.c
-+++ b/drivers/atm/lanai.c
-@@ -1305,7 +1305,7 @@ static void lanai_send_one_aal5(struct lanai_dev *lanai,
- vcc_tx_add_aal5_trailer(lvcc, skb->len, 0, 0);
- lanai_endtx(lanai, lvcc);
- lanai_free_skb(lvcc->tx.atmvcc, skb);
-- atomic_inc(&lvcc->tx.atmvcc->stats->tx);
-+ atomic_inc_unchecked(&lvcc->tx.atmvcc->stats->tx);
- }
-
- /* Try to fill the buffer - don't call unless there is backlog */
-@@ -1428,7 +1428,7 @@ static void vcc_rx_aal5(struct lanai_vcc *lvcc, int endptr)
- ATM_SKB(skb)->vcc = lvcc->rx.atmvcc;
- __net_timestamp(skb);
- lvcc->rx.atmvcc->push(lvcc->rx.atmvcc, skb);
-- atomic_inc(&lvcc->rx.atmvcc->stats->rx);
-+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx);
- out:
- lvcc->rx.buf.ptr = end;
- cardvcc_write(lvcc, endptr, vcc_rxreadptr);
-@@ -1670,7 +1670,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
- DPRINTK("(itf %d) got RX service entry 0x%X for non-AAL5 "
- "vcc %d\n", lanai->number, (unsigned int) s, vci);
- lanai->stats.service_rxnotaal5++;
-- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
-+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
- return 0;
- }
- if (likely(!(s & (SERVICE_TRASH | SERVICE_STREAM | SERVICE_CRCERR)))) {
-@@ -1682,7 +1682,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
- int bytes;
- read_unlock(&vcc_sklist_lock);
- DPRINTK("got trashed rx pdu on vci %d\n", vci);
-- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
-+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
- lvcc->stats.x.aal5.service_trash++;
- bytes = (SERVICE_GET_END(s) * 16) -
- (((unsigned long) lvcc->rx.buf.ptr) -
-@@ -1694,7 +1694,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
- }
- if (s & SERVICE_STREAM) {
- read_unlock(&vcc_sklist_lock);
-- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
-+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
- lvcc->stats.x.aal5.service_stream++;
- printk(KERN_ERR DEV_LABEL "(itf %d): Got AAL5 stream "
- "PDU on VCI %d!\n", lanai->number, vci);
-@@ -1702,7 +1702,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
- return 0;
- }
- DPRINTK("got rx crc error on vci %d\n", vci);
-- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
-+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
- lvcc->stats.x.aal5.service_rxcrc++;
- lvcc->rx.buf.ptr = &lvcc->rx.buf.start[SERVICE_GET_END(s) * 4];
- cardvcc_write(lvcc, SERVICE_GET_END(s), vcc_rxreadptr);
-diff --git a/drivers/atm/nicstar.c b/drivers/atm/nicstar.c
-index 3da804b..d3b0eed 100644
---- a/drivers/atm/nicstar.c
-+++ b/drivers/atm/nicstar.c
-@@ -1723,7 +1723,7 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
- if ((vc = (vc_map *) vcc->dev_data) == NULL)
- {
- printk("nicstar%d: vcc->dev_data == NULL on ns_send().\n", card->index);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- dev_kfree_skb_any(skb);
- return -EINVAL;
- }
-@@ -1731,7 +1731,7 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
- if (!vc->tx)
- {
- printk("nicstar%d: Trying to transmit on a non-tx VC.\n", card->index);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- dev_kfree_skb_any(skb);
- return -EINVAL;
- }
-@@ -1739,7 +1739,7 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
- if (vcc->qos.aal != ATM_AAL5 && vcc->qos.aal != ATM_AAL0)
- {
- printk("nicstar%d: Only AAL0 and AAL5 are supported.\n", card->index);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- dev_kfree_skb_any(skb);
- return -EINVAL;
- }
-@@ -1747,7 +1747,7 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
- if (skb_shinfo(skb)->nr_frags != 0)
- {
- printk("nicstar%d: No scatter-gather yet.\n", card->index);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- dev_kfree_skb_any(skb);
- return -EINVAL;
- }
-@@ -1792,11 +1792,11 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
-
- if (push_scqe(card, vc, scq, &scqe, skb) != 0)
- {
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- dev_kfree_skb_any(skb);
- return -EIO;
- }
-- atomic_inc(&vcc->stats->tx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
-
- return 0;
- }
-@@ -2111,14 +2111,14 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
- {
- printk("nicstar%d: Can't allocate buffers for aal0.\n",
- card->index);
-- atomic_add(i,&vcc->stats->rx_drop);
-+ atomic_add_unchecked(i,&vcc->stats->rx_drop);
- break;
- }
- if (!atm_charge(vcc, sb->truesize))
- {
- RXPRINTK("nicstar%d: atm_charge() dropped aal0 packets.\n",
- card->index);
-- atomic_add(i-1,&vcc->stats->rx_drop); /* already increased by 1 */
-+ atomic_add_unchecked(i-1,&vcc->stats->rx_drop); /* already increased by 1 */
- dev_kfree_skb_any(sb);
- break;
- }
-@@ -2133,7 +2133,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
- ATM_SKB(sb)->vcc = vcc;
- __net_timestamp(sb);
- vcc->push(vcc, sb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
- cell += ATM_CELL_PAYLOAD;
- }
-
-@@ -2152,7 +2152,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
- if (iovb == NULL)
- {
- printk("nicstar%d: Out of iovec buffers.\n", card->index);
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- recycle_rx_buf(card, skb);
- return;
- }
-@@ -2182,7 +2182,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
- else if (NS_SKB(iovb)->iovcnt >= NS_MAX_IOVECS)
- {
- printk("nicstar%d: received too big AAL5 SDU.\n", card->index);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data, NS_MAX_IOVECS);
- NS_SKB(iovb)->iovcnt = 0;
- iovb->len = 0;
-@@ -2202,7 +2202,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
- printk("nicstar%d: Expected a small buffer, and this is not one.\n",
- card->index);
- which_list(card, skb);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- recycle_rx_buf(card, skb);
- vc->rx_iov = NULL;
- recycle_iov_buf(card, iovb);
-@@ -2216,7 +2216,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
- printk("nicstar%d: Expected a large buffer, and this is not one.\n",
- card->index);
- which_list(card, skb);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
- NS_SKB(iovb)->iovcnt);
- vc->rx_iov = NULL;
-@@ -2240,7 +2240,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
- printk(" - PDU size mismatch.\n");
- else
- printk(".\n");
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
- NS_SKB(iovb)->iovcnt);
- vc->rx_iov = NULL;
-@@ -2256,7 +2256,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
- if (!atm_charge(vcc, skb->truesize))
- {
- push_rxbufs(card, skb);
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- }
- else
- {
-@@ -2268,7 +2268,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
- ATM_SKB(skb)->vcc = vcc;
- __net_timestamp(skb);
- vcc->push(vcc, skb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
- }
- }
- else if (NS_SKB(iovb)->iovcnt == 2) /* One small plus one large buffer */
-@@ -2283,7 +2283,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
- if (!atm_charge(vcc, sb->truesize))
- {
- push_rxbufs(card, sb);
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- }
- else
- {
-@@ -2295,7 +2295,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
- ATM_SKB(sb)->vcc = vcc;
- __net_timestamp(sb);
- vcc->push(vcc, sb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
- }
-
- push_rxbufs(card, skb);
-@@ -2306,7 +2306,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
- if (!atm_charge(vcc, skb->truesize))
- {
- push_rxbufs(card, skb);
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- }
- else
- {
-@@ -2320,7 +2320,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
- ATM_SKB(skb)->vcc = vcc;
- __net_timestamp(skb);
- vcc->push(vcc, skb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
- }
-
- push_rxbufs(card, sb);
-@@ -2342,7 +2342,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
- if (hb == NULL)
- {
- printk("nicstar%d: Out of huge buffers.\n", card->index);
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
- NS_SKB(iovb)->iovcnt);
- vc->rx_iov = NULL;
-@@ -2393,7 +2393,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
- }
- else
- dev_kfree_skb_any(hb);
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- }
- else
- {
-@@ -2427,7 +2427,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
- #endif /* NS_USE_DESTRUCTORS */
- __net_timestamp(hb);
- vcc->push(vcc, hb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
- }
- }
-
-diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
-index 84c93ff..e6ed269 100644
---- a/drivers/atm/solos-pci.c
-+++ b/drivers/atm/solos-pci.c
-@@ -708,7 +708,7 @@ void solos_bh(unsigned long card_arg)
- }
- atm_charge(vcc, skb->truesize);
- vcc->push(vcc, skb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
- break;
-
- case PKT_STATUS:
-@@ -914,6 +914,8 @@ static int print_buffer(struct sk_buff *buf)
- char msg[500];
- char item[10];
-
-+ pax_track_stack();
-+
- len = buf->len;
- for (i = 0; i < len; i++){
- if(i % 8 == 0)
-@@ -1023,7 +1025,7 @@ static uint32_t fpga_tx(struct solos_card *card)
- vcc = SKB_CB(oldskb)->vcc;
-
- if (vcc) {
-- atomic_inc(&vcc->stats->tx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
- solos_pop(vcc, oldskb);
- } else
- dev_kfree_skb_irq(oldskb);
-diff --git a/drivers/atm/suni.c b/drivers/atm/suni.c
-index 6dd3f59..ee377f3 100644
---- a/drivers/atm/suni.c
-+++ b/drivers/atm/suni.c
-@@ -49,8 +49,8 @@ static DEFINE_SPINLOCK(sunis_lock);
-
-
- #define ADD_LIMITED(s,v) \
-- atomic_add((v),&stats->s); \
-- if (atomic_read(&stats->s) < 0) atomic_set(&stats->s,INT_MAX);
-+ atomic_add_unchecked((v),&stats->s); \
-+ if (atomic_read_unchecked(&stats->s) < 0) atomic_set_unchecked(&stats->s,INT_MAX);
-
-
- static void suni_hz(unsigned long from_timer)
-diff --git a/drivers/atm/uPD98402.c b/drivers/atm/uPD98402.c
-index fc8cb07..4a80e53 100644
---- a/drivers/atm/uPD98402.c
-+++ b/drivers/atm/uPD98402.c
-@@ -41,7 +41,7 @@ static int fetch_stats(struct atm_dev *dev,struct sonet_stats __user *arg,int ze
- struct sonet_stats tmp;
- int error = 0;
-
-- atomic_add(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
-+ atomic_add_unchecked(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
- sonet_copy_stats(&PRIV(dev)->sonet_stats,&tmp);
- if (arg) error = copy_to_user(arg,&tmp,sizeof(tmp));
- if (zero && !error) {
-@@ -160,9 +160,9 @@ static int uPD98402_ioctl(struct atm_dev *dev,unsigned int cmd,void __user *arg)
-
-
- #define ADD_LIMITED(s,v) \
-- { atomic_add(GET(v),&PRIV(dev)->sonet_stats.s); \
-- if (atomic_read(&PRIV(dev)->sonet_stats.s) < 0) \
-- atomic_set(&PRIV(dev)->sonet_stats.s,INT_MAX); }
-+ { atomic_add_unchecked(GET(v),&PRIV(dev)->sonet_stats.s); \
-+ if (atomic_read_unchecked(&PRIV(dev)->sonet_stats.s) < 0) \
-+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.s,INT_MAX); }
-
-
- static void stat_event(struct atm_dev *dev)
-@@ -193,7 +193,7 @@ static void uPD98402_int(struct atm_dev *dev)
- if (reason & uPD98402_INT_PFM) stat_event(dev);
- if (reason & uPD98402_INT_PCO) {
- (void) GET(PCOCR); /* clear interrupt cause */
-- atomic_add(GET(HECCT),
-+ atomic_add_unchecked(GET(HECCT),
- &PRIV(dev)->sonet_stats.uncorr_hcs);
- }
- if ((reason & uPD98402_INT_RFO) &&
-@@ -221,9 +221,9 @@ static int uPD98402_start(struct atm_dev *dev)
- PUT(~(uPD98402_INT_PFM | uPD98402_INT_ALM | uPD98402_INT_RFO |
- uPD98402_INT_LOS),PIMR); /* enable them */
- (void) fetch_stats(dev,NULL,1); /* clear kernel counters */
-- atomic_set(&PRIV(dev)->sonet_stats.corr_hcs,-1);
-- atomic_set(&PRIV(dev)->sonet_stats.tx_cells,-1);
-- atomic_set(&PRIV(dev)->sonet_stats.rx_cells,-1);
-+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.corr_hcs,-1);
-+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.tx_cells,-1);
-+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.rx_cells,-1);
- return 0;
- }
-
-diff --git a/drivers/atm/zatm.c b/drivers/atm/zatm.c
-index 2e9635b..32927b4 100644
---- a/drivers/atm/zatm.c
-+++ b/drivers/atm/zatm.c
-@@ -458,7 +458,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy[0],dummy[1]);
- }
- if (!size) {
- dev_kfree_skb_irq(skb);
-- if (vcc) atomic_inc(&vcc->stats->rx_err);
-+ if (vcc) atomic_inc_unchecked(&vcc->stats->rx_err);
- continue;
- }
- if (!atm_charge(vcc,skb->truesize)) {
-@@ -468,7 +468,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy[0],dummy[1]);
- skb->len = size;
- ATM_SKB(skb)->vcc = vcc;
- vcc->push(vcc,skb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
- }
- zout(pos & 0xffff,MTA(mbx));
- #if 0 /* probably a stupid idea */
-@@ -732,7 +732,7 @@ if (*ZATM_PRV_DSC(skb) != (uPD98401_TXPD_V | uPD98401_TXPD_DP |
- skb_queue_head(&zatm_vcc->backlog,skb);
- break;
- }
-- atomic_inc(&vcc->stats->tx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
- wake_up(&zatm_vcc->tx_wait);
- }
-
-diff --git a/drivers/base/bus.c b/drivers/base/bus.c
-index 6f1ba10..2c26804 100644
---- a/drivers/base/bus.c
-+++ b/drivers/base/bus.c
-@@ -70,7 +70,7 @@ static ssize_t drv_attr_store(struct kobject *kobj, struct attribute *attr,
- return ret;
- }
-
--static struct sysfs_ops driver_sysfs_ops = {
-+static const struct sysfs_ops driver_sysfs_ops = {
- .show = drv_attr_show,
- .store = drv_attr_store,
- };
-@@ -115,7 +115,7 @@ static ssize_t bus_attr_store(struct kobject *kobj, struct attribute *attr,
- return ret;
- }
-
--static struct sysfs_ops bus_sysfs_ops = {
-+static const struct sysfs_ops bus_sysfs_ops = {
- .show = bus_attr_show,
- .store = bus_attr_store,
- };
-@@ -154,7 +154,7 @@ static int bus_uevent_filter(struct kset *kset, struct kobject *kobj)
- return 0;
- }
-
--static struct kset_uevent_ops bus_uevent_ops = {
-+static const struct kset_uevent_ops bus_uevent_ops = {
- .filter = bus_uevent_filter,
- };
-
-diff --git a/drivers/base/class.c b/drivers/base/class.c
-index 6e2c3b0..cb61871 100644
---- a/drivers/base/class.c
-+++ b/drivers/base/class.c
-@@ -63,7 +63,7 @@ static void class_release(struct kobject *kobj)
- kfree(cp);
- }
-
--static struct sysfs_ops class_sysfs_ops = {
-+static const struct sysfs_ops class_sysfs_ops = {
- .show = class_attr_show,
- .store = class_attr_store,
- };
-diff --git a/drivers/base/core.c b/drivers/base/core.c
-index f33d768..a9358d0 100644
---- a/drivers/base/core.c
-+++ b/drivers/base/core.c
-@@ -100,7 +100,7 @@ static ssize_t dev_attr_store(struct kobject *kobj, struct attribute *attr,
- return ret;
- }
-
--static struct sysfs_ops dev_sysfs_ops = {
-+static const struct sysfs_ops dev_sysfs_ops = {
- .show = dev_attr_show,
- .store = dev_attr_store,
- };
-@@ -252,7 +252,7 @@ static int dev_uevent(struct kset *kset, struct kobject *kobj,
- return retval;
- }
-
--static struct kset_uevent_ops device_uevent_ops = {
-+static const struct kset_uevent_ops device_uevent_ops = {
- .filter = dev_uevent_filter,
- .name = dev_uevent_name,
- .uevent = dev_uevent,
-diff --git a/drivers/base/memory.c b/drivers/base/memory.c
-index 989429c..2272b00 100644
---- a/drivers/base/memory.c
-+++ b/drivers/base/memory.c
-@@ -44,7 +44,7 @@ static int memory_uevent(struct kset *kset, struct kobject *obj, struct kobj_uev
- return retval;
- }
-
--static struct kset_uevent_ops memory_uevent_ops = {
-+static const struct kset_uevent_ops memory_uevent_ops = {
- .name = memory_uevent_name,
- .uevent = memory_uevent,
- };
-diff --git a/drivers/base/node.c b/drivers/base/node.c
-index 1fe5536..6c2ca13 100644
---- a/drivers/base/node.c
-+++ b/drivers/base/node.c
-@@ -390,11 +390,9 @@ static ssize_t print_nodes_state(enum node_states state, char *buf)
- {
- int n;
-
-- n = nodelist_scnprintf(buf, PAGE_SIZE, node_states[state]);
-- if (n > 0 && PAGE_SIZE > n + 1) {
-- *(buf + n++) = '\n';
-- *(buf + n++) = '\0';
-- }
-+ n = nodelist_scnprintf(buf, PAGE_SIZE-2, node_states[state]);
-+ buf[n++] = '\n';
-+ buf[n] = '\0';
- return n;
- }
-
-diff --git a/drivers/base/sys.c b/drivers/base/sys.c
-index 3f202f7..61c4a6f 100644
---- a/drivers/base/sys.c
-+++ b/drivers/base/sys.c
-@@ -54,7 +54,7 @@ sysdev_store(struct kobject *kobj, struct attribute *attr,
- return -EIO;
- }
-
--static struct sysfs_ops sysfs_ops = {
-+static const struct sysfs_ops sysfs_ops = {
- .show = sysdev_show,
- .store = sysdev_store,
- };
-@@ -104,7 +104,7 @@ static ssize_t sysdev_class_store(struct kobject *kobj, struct attribute *attr,
- return -EIO;
- }
-
--static struct sysfs_ops sysfs_class_ops = {
-+static const struct sysfs_ops sysfs_class_ops = {
- .show = sysdev_class_show,
- .store = sysdev_class_store,
- };
-diff --git a/drivers/block/DAC960.c b/drivers/block/DAC960.c
-index eb4fa19..1954777 100644
---- a/drivers/block/DAC960.c
-+++ b/drivers/block/DAC960.c
-@@ -1973,6 +1973,8 @@ static bool DAC960_V1_ReadDeviceConfiguration(DAC960_Controller_T
- unsigned long flags;
- int Channel, TargetID;
-
-+ pax_track_stack();
-+
- if (!init_dma_loaf(Controller->PCIDevice, &local_dma,
- DAC960_V1_MaxChannels*(sizeof(DAC960_V1_DCDB_T) +
- sizeof(DAC960_SCSI_Inquiry_T) +
-diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
-index 68b90d9..d87f5c9 100644
---- a/drivers/block/cciss.c
-+++ b/drivers/block/cciss.c
-@@ -1,6 +1,6 @@
- /*
- * Disk Array driver for HP Smart Array controllers.
-- * (C) Copyright 2000, 2007 Hewlett-Packard Development Company, L.P.
-+ * (C) Copyright 2000, 2010 Hewlett-Packard Development Company, L.P.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
-@@ -26,7 +26,6 @@
- #include <linux/pci.h>
- #include <linux/kernel.h>
- #include <linux/slab.h>
--#include <linux/smp_lock.h>
- #include <linux/delay.h>
- #include <linux/major.h>
- #include <linux/fs.h>
-@@ -53,20 +52,24 @@
- #include <scsi/scsi_ioctl.h>
- #include <linux/cdrom.h>
- #include <linux/scatterlist.h>
--#include <linux/kthread.h>
-+#include "cciss_cmd.h"
-+#include "cciss.h"
-+#include "cciss_kernel_compat.h"
-+#include <linux/cciss_ioctl.h>
-
- #define CCISS_DRIVER_VERSION(maj,min,submin) ((maj<<16)|(min<<8)|(submin))
--#define DRIVER_NAME "HP CISS Driver (v 3.6.20)"
--#define DRIVER_VERSION CCISS_DRIVER_VERSION(3, 6, 20)
-+#define DRIVER_NAME "HP CISS Driver (v 4.6.28-20 )"
-+#define DRIVER_VERSION CCISS_DRIVER_VERSION(4, 6, 28)
-
- /* Embedded module documentation macros - see modules.h */
- MODULE_AUTHOR("Hewlett-Packard Company");
--MODULE_DESCRIPTION("Driver for HP Smart Array Controllers");
--MODULE_SUPPORTED_DEVICE("HP SA5i SA5i+ SA532 SA5300 SA5312 SA641 SA642 SA6400"
-- " SA6i P600 P800 P400 P400i E200 E200i E500 P700m"
-- " Smart Array G2 Series SAS/SATA Controllers");
--MODULE_VERSION("3.6.20");
-+MODULE_DESCRIPTION("Driver for HP Smart Array Controllers version 4.6.28-20 (d744/s1436)");
-+MODULE_SUPPORTED_DEVICE("HP Smart Array Controllers");
-+MODULE_VERSION("4.6.28-20");
- MODULE_LICENSE("GPL");
-+static int cciss_tape_cmds = 6;
-+module_param(cciss_tape_cmds, int, 0644);
-+MODULE_PARM_DESC(cciss_tape_cmds, "number of commands to allocate for tape devices (default: 6)");
-
- static int cciss_allow_hpsa;
- module_param(cciss_allow_hpsa, int, S_IRUGO|S_IWUSR);
-@@ -74,12 +77,19 @@ MODULE_PARM_DESC(cciss_allow_hpsa,
- "Prevent cciss driver from accessing hardware known to be "
- " supported by the hpsa driver");
-
--#include "cciss_cmd.h"
--#include "cciss.h"
--#include <linux/cciss_ioctl.h>
-+static int cciss_simple_mode;
-+module_param(cciss_simple_mode, int, S_IRUGO|S_IWUSR);
-+MODULE_PARM_DESC(cciss_simple_mode,
-+ "Use 'simple mode' rather than 'performant mode'");
-+
-+#undef PCI_DEVICE_ID_HP_CISSF
-+#ifndef PCI_DEVICE_ID_HP_CISSF
-+#define PCI_DEVICE_ID_HP_CISSF 0x323B
-+#endif
-
- /* define the PCI info for the cards we can control */
- static const struct pci_device_id cciss_pci_device_id[] = {
-+#if SA_CONTROLLERS_LEGACY
- {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISS, 0x0E11, 0x4070},
- {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSB, 0x0E11, 0x4080},
- {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSB, 0x0E11, 0x4082},
-@@ -100,13 +110,25 @@ static const struct pci_device_id cciss_pci_device_id[] = {
- {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSD, 0x103C, 0x3215},
- {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSC, 0x103C, 0x3237},
- {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSC, 0x103C, 0x323D},
-- {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSE, 0x103C, 0x3241},
-+#endif
-+#if SA_CONTROLLERS_GEN6
-+ {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSE, 0x103C, 0x3241},
- {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSE, 0x103C, 0x3243},
- {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSE, 0x103C, 0x3245},
- {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSE, 0x103C, 0x3247},
- {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSE, 0x103C, 0x3249},
- {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSE, 0x103C, 0x324A},
- {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSE, 0x103C, 0x324B},
-+#endif
-+#if SA_CONTROLLERS_GEN8
-+ {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSF, 0x103C, 0x3350},
-+ {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSF, 0x103C, 0x3351},
-+ {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSF, 0x103C, 0x3352},
-+ {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSF, 0x103C, 0x3353},
-+ {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSF, 0x103C, 0x3354},
-+ {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSF, 0x103C, 0x3355},
-+ {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSF, 0x103C, 0x3356},
-+#endif
- {0,}
- };
-
-@@ -117,6 +139,8 @@ MODULE_DEVICE_TABLE(pci, cciss_pci_device_id);
- * access = Address of the struct of function pointers
- */
- static struct board_type products[] = {
-+
-+#if SA_CONTROLLERS_LEGACY
- {0x40700E11, "Smart Array 5300", &SA5_access},
- {0x40800E11, "Smart Array 5i", &SA5B_access},
- {0x40820E11, "Smart Array 532", &SA5B_access},
-@@ -127,6 +151,8 @@ static struct board_type products[] = {
- {0x409D0E11, "Smart Array 6400 EM", &SA5_access},
- {0x40910E11, "Smart Array 6i", &SA5_access},
- {0x3225103C, "Smart Array P600", &SA5_access},
-+ {0x3223103C, "Smart Array P800", &SA5_access},
-+ {0x3234103C, "Smart Array P400", &SA5_access},
- {0x3235103C, "Smart Array P400i", &SA5_access},
- {0x3211103C, "Smart Array E200i", &SA5_access},
- {0x3212103C, "Smart Array E200", &SA5_access},
-@@ -134,11 +160,9 @@ static struct board_type products[] = {
- {0x3214103C, "Smart Array E200i", &SA5_access},
- {0x3215103C, "Smart Array E200i", &SA5_access},
- {0x3237103C, "Smart Array E500", &SA5_access},
--/* controllers below this line are also supported by the hpsa driver. */
--#define HPSA_BOUNDARY 0x3223103C
-- {0x3223103C, "Smart Array P800", &SA5_access},
-- {0x3234103C, "Smart Array P400", &SA5_access},
-- {0x323D103C, "Smart Array P700m", &SA5_access},
-+ {0x323d103c, "Smart Array P700M", &SA5_access},
-+#endif
-+#if SA_CONTROLLERS_GEN6
- {0x3241103C, "Smart Array P212", &SA5_access},
- {0x3243103C, "Smart Array P410", &SA5_access},
- {0x3245103C, "Smart Array P410i", &SA5_access},
-@@ -146,6 +170,16 @@ static struct board_type products[] = {
- {0x3249103C, "Smart Array P812", &SA5_access},
- {0x324A103C, "Smart Array P712m", &SA5_access},
- {0x324B103C, "Smart Array P711m", &SA5_access},
-+#endif
-+#if SA_CONTROLLERS_GEN8
-+ {0x3350103C, "Smart Array P222", &SA5_access},
-+ {0x3351103C, "Smart Array P420", &SA5_access},
-+ {0x3352103C, "Smart Array P421", &SA5_access},
-+ {0x3353103C, "Smart Array P822", &SA5_access},
-+ {0x3354103C, "Smart Array P420i", &SA5_access},
-+ {0x3355103C, "Smart Array P220i", &SA5_access},
-+ {0x3356103C, "Smart Array", &SA5_access},
-+#endif
- };
-
- /* How long to wait (in milliseconds) for board to go into simple mode */
-@@ -162,16 +196,17 @@ static struct board_type products[] = {
-
- static ctlr_info_t *hba[MAX_CTLR];
-
--static struct task_struct *cciss_scan_thread;
--static DEFINE_MUTEX(scan_mutex);
--static LIST_HEAD(scan_q);
--
- static void do_cciss_request(struct request_queue *q);
--static irqreturn_t do_cciss_intr(int irq, void *dev_id);
-+static irqreturn_t do_cciss_intx(int irq, void *dev_id);
-+static irqreturn_t do_cciss_msix_intr(int irq, void *dev_id);
- static int cciss_open(struct block_device *bdev, fmode_t mode);
- static int cciss_release(struct gendisk *disk, fmode_t mode);
- static int cciss_ioctl(struct block_device *bdev, fmode_t mode,
- unsigned int cmd, unsigned long arg);
-+#if defined (CONFIG_COMPAT) || !KFEATURE_HAS_LOCKED_IOCTL
-+static int do_ioctl(struct block_device *bdev, fmode_t mode,
-+ unsigned cmd, unsigned long arg);
-+#endif
- static int cciss_getgeo(struct block_device *bdev, struct hd_geometry *geo);
-
- static int cciss_revalidate(struct gendisk *disk);
-@@ -179,39 +214,52 @@ static int rebuild_lun_table(ctlr_info_t *h, int first_time, int via_ioctl);
- static int deregister_disk(ctlr_info_t *h, int drv_index,
- int clear_all, int via_ioctl);
-
--static void cciss_read_capacity(int ctlr, int logvol, int withirq,
-+static void cciss_read_capacity(ctlr_info_t *h, int logvol,
- sector_t *total_size, unsigned int *block_size);
--static void cciss_read_capacity_16(int ctlr, int logvol, int withirq,
-+static void cciss_read_capacity_16(ctlr_info_t *h, int logvol,
- sector_t *total_size, unsigned int *block_size);
--static void cciss_geometry_inquiry(int ctlr, int logvol,
-- int withirq, sector_t total_size,
-+static void cciss_geometry_inquiry(ctlr_info_t *h, int logvol,
-+ sector_t total_size,
- unsigned int block_size, InquiryData_struct *inq_buff,
- drive_info_struct *drv);
--static void __devinit cciss_interrupt_mode(ctlr_info_t *, struct pci_dev *,
-- __u32);
-+static void __devinit cciss_interrupt_mode(ctlr_info_t *);
-+static int __devinit cciss_enter_simple_mode(struct ctlr_info *h);
- static void start_io(ctlr_info_t *h);
--static int sendcmd(__u8 cmd, int ctlr, void *buff, size_t size,
-- __u8 page_code, unsigned char *scsi3addr, int cmd_type);
--static int sendcmd_withirq(__u8 cmd, int ctlr, void *buff, size_t size,
-+static int sendcmd_withirq(ctlr_info_t *h, __u8 cmd, void *buff, size_t size,
- __u8 page_code, unsigned char scsi3addr[],
- int cmd_type);
- static int sendcmd_withirq_core(ctlr_info_t *h, CommandList_struct *c,
- int attempt_retry);
- static int process_sendcmd_error(ctlr_info_t *h, CommandList_struct *c);
-
--static void fail_all_cmds(unsigned long ctlr);
--static int add_to_scan_list(struct ctlr_info *h);
--static int scan_thread(void *data);
-+static void cciss_get_uid(ctlr_info_t *h, int logvol,
-+ unsigned char *uid, int buflen);
- static int check_for_unit_attention(ctlr_info_t *h, CommandList_struct *c);
- static void cciss_hba_release(struct device *dev);
- static void cciss_device_release(struct device *dev);
- static void cciss_free_gendisk(ctlr_info_t *h, int drv_index);
- static void cciss_free_drive_info(ctlr_info_t *h, int drv_index);
-+static inline void log_unit_to_scsi3addr(ctlr_info_t *h,
-+ unsigned char scsi3addr[], uint32_t log_unit);
-+static int __devinit cciss_find_cfg_addrs(struct pci_dev *pdev,
-+ void __iomem *vaddr, u32 *cfg_base_addr, u64 *cfg_base_addr_index,
-+ u64 *cfg_offset);
-+static int __devinit cciss_pci_find_memory_BAR(struct pci_dev *pdev,
-+ unsigned long *memory_bar);
-+static inline u32 cciss_tag_discard_error_bits(ctlr_info_t *h, u32 tag);
-+static __devinit int write_driver_ver_to_cfgtable(
-+ CfgTable_struct __iomem *cfgtable);
-+
-+
-+/* performant mode helper functions */
-+static void calc_bucket_map(int *bucket, int num_buckets, int nsgs,
-+ int *bucket_map);
-+static void cciss_put_controller_into_performant_mode(ctlr_info_t *h);
-
- #ifdef CONFIG_PROC_FS
--static void cciss_procinit(int i);
-+static void cciss_procinit(ctlr_info_t *h);
- #else
--static void cciss_procinit(int i)
-+static void cciss_procinit(ctlr_info_t *h)
- {
- }
- #endif /* CONFIG_PROC_FS */
-@@ -220,12 +268,14 @@ static void cciss_procinit(int i)
- static int cciss_compat_ioctl(struct block_device *, fmode_t,
- unsigned, unsigned long);
- #endif
-+static void cciss_sysfs_stat_inquiry(ctlr_info_t *h, int logvol,
-+ drive_info_struct *drv);
-
- static const struct block_device_operations cciss_fops = {
- .owner = THIS_MODULE,
- .open = cciss_open,
- .release = cciss_release,
-- .locked_ioctl = cciss_ioctl,
-+ SET_IOCTL_FUNCTION(cciss_ioctl, do_ioctl)
- .getgeo = cciss_getgeo,
- #ifdef CONFIG_COMPAT
- .compat_ioctl = cciss_compat_ioctl,
-@@ -233,12 +283,22 @@ static const struct block_device_operations cciss_fops = {
- .revalidate_disk = cciss_revalidate,
- };
-
-+/* set_performant_mode: Modify the tag for cciss performant
-+ * set bit 0 for pull model, bits 3-1 for block fetch
-+ * register number
-+ */
-+static void set_performant_mode(ctlr_info_t *h, CommandList_struct *c)
-+{
-+ if (likely(h->transMethod & CFGTBL_Trans_Performant))
-+ c->busaddr |= 1 | (h->blockFetchTable[c->Header.SGList] << 1);
-+}
-+
- /*
- * Enqueuing and dequeuing functions for cmdlists.
- */
--static inline void addQ(struct hlist_head *list, CommandList_struct *c)
-+static inline void addQ(struct list_head *list, CommandList_struct *c)
- {
-- hlist_add_head(&c->list, list);
-+ list_add_tail(&c->list, list);
- }
-
- static inline void removeQ(CommandList_struct *c)
-@@ -251,18 +311,105 @@ static inline void removeQ(CommandList_struct *c)
- * them off as 'stale' to prevent the driver from
- * falling over.
- */
-- if (WARN_ON(hlist_unhashed(&c->list))) {
-+ if (WARN_ON(list_empty(&c->list))) {
- c->cmd_type = CMD_MSG_STALE;
- return;
- }
-
-- hlist_del_init(&c->list);
-+ list_del_init(&c->list);
-+}
-+
-+static void enqueue_cmd_and_start_io(ctlr_info_t *h,
-+ CommandList_struct *c)
-+{
-+ unsigned long flags;
-+ set_performant_mode(h, c);
-+ spin_lock_irqsave(&h->lock, flags);
-+ addQ(&h->reqQ, c);
-+ h->Qdepth++;
-+ if (h->Qdepth > h->maxQsinceinit)
-+ h->maxQsinceinit = h->Qdepth;
-+ start_io(h);
-+ spin_unlock_irqrestore(&h->lock, flags);
-+}
-+
-+static void cciss_free_sg_chain_blocks(SGDescriptor_struct **cmd_sg_list,
-+ int nr_cmds)
-+{
-+ int i;
-+
-+ if (!cmd_sg_list)
-+ return;
-+ for (i = 0; i < nr_cmds; i++) {
-+ kfree(cmd_sg_list[i]);
-+ cmd_sg_list[i] = NULL;
-+ }
-+ kfree(cmd_sg_list);
-+}
-+
-+static SGDescriptor_struct **cciss_allocate_sg_chain_blocks(
-+ ctlr_info_t *h, int chainsize, int nr_cmds)
-+{
-+ int j;
-+ SGDescriptor_struct **cmd_sg_list;
-+
-+ if (chainsize <= 0)
-+ return NULL;
-+
-+ cmd_sg_list = kmalloc(sizeof(*cmd_sg_list) * nr_cmds, GFP_KERNEL);
-+ if (!cmd_sg_list)
-+ return NULL;
-+
-+ /* Build up chain blocks for each command */
-+ for (j = 0; j < nr_cmds; j++) {
-+ /* Need a block of chainsized s/g elements. */
-+ cmd_sg_list[j] = kmalloc((chainsize *
-+ sizeof(*cmd_sg_list[j])), GFP_KERNEL);
-+ if (!cmd_sg_list[j]) {
-+ dev_err(&h->pdev->dev, "Cannot get memory "
-+ "for s/g chains.\n");
-+ goto clean;
-+ }
-+ }
-+ return cmd_sg_list;
-+clean:
-+ cciss_free_sg_chain_blocks(cmd_sg_list, nr_cmds);
-+ return NULL;
-+}
-+
-+static void cciss_unmap_sg_chain_block(ctlr_info_t *h, CommandList_struct *c)
-+{
-+ SGDescriptor_struct *chain_sg;
-+ u64bit temp64;
-+
-+ if (c->Header.SGTotal <= h->max_cmd_sgentries)
-+ return;
-+
-+ chain_sg = &c->SG[h->max_cmd_sgentries - 1];
-+ temp64.val32.lower = chain_sg->Addr.lower;
-+ temp64.val32.upper = chain_sg->Addr.upper;
-+ pci_unmap_single(h->pdev, temp64.val, chain_sg->Len, PCI_DMA_TODEVICE);
-+}
-+
-+static void cciss_map_sg_chain_block(ctlr_info_t *h, CommandList_struct *c,
-+ SGDescriptor_struct *chain_block, int len)
-+{
-+ SGDescriptor_struct *chain_sg;
-+ u64bit temp64;
-+
-+ chain_sg = &c->SG[h->max_cmd_sgentries - 1];
-+ chain_sg->Ext = CCISS_SG_CHAIN;
-+ chain_sg->Len = len;
-+ temp64.val = pci_map_single(h->pdev, chain_block, len,
-+ PCI_DMA_TODEVICE);
-+ chain_sg->Addr.lower = temp64.val32.lower;
-+ chain_sg->Addr.upper = temp64.val32.upper;
- }
-
- #include "cciss_scsi.c" /* For SCSI tape support */
-
- static const char *raid_label[] = { "0", "4", "1(1+0)", "5", "5+1", "ADG",
-- "UNKNOWN"
-+ "1(ADM)", "UNKNOWN"
- };
- #define RAID_UNKNOWN (sizeof(raid_label) / sizeof(raid_label[0])-1)
-
-@@ -295,32 +442,31 @@ static void cciss_seq_show_header(struct seq_file *seq)
- h->product_name,
- (unsigned long)h->board_id,
- h->firm_ver[0], h->firm_ver[1], h->firm_ver[2],
-- h->firm_ver[3], (unsigned int)h->intr[SIMPLE_MODE_INT],
-+ h->firm_ver[3], (unsigned int)h->intr[h->intr_mode],
- h->num_luns,
- h->Qdepth, h->commands_outstanding,
- h->maxQsinceinit, h->max_outstanding, h->maxSG);
-
- #ifdef CONFIG_CISS_SCSI_TAPE
-- cciss_seq_tape_report(seq, h->ctlr);
-+ cciss_seq_tape_report(seq, h);
- #endif /* CONFIG_CISS_SCSI_TAPE */
- }
-
- static void *cciss_seq_start(struct seq_file *seq, loff_t *pos)
- {
- ctlr_info_t *h = seq->private;
-- unsigned ctlr = h->ctlr;
- unsigned long flags;
-
- /* prevent displaying bogus info during configuration
- * or deconfiguration of a logical volume
- */
-- spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
-+ spin_lock_irqsave(&h->lock, flags);
- if (h->busy_configuring) {
-- spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
-+ spin_unlock_irqrestore(&h->lock, flags);
- return ERR_PTR(-EBUSY);
- }
- h->busy_configuring = 1;
-- spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
-+ spin_unlock_irqrestore(&h->lock, flags);
-
- if (*pos == 0)
- cciss_seq_show_header(seq);
-@@ -427,12 +573,9 @@ cciss_proc_write(struct file *file, const char __user *buf,
- if (strncmp(ENGAGE_SCSI, buffer, sizeof ENGAGE_SCSI - 1) == 0) {
- struct seq_file *seq = file->private_data;
- ctlr_info_t *h = seq->private;
-- int rc;
-
-- rc = cciss_engage_scsi(h->ctlr);
-- if (rc != 0)
-- err = -rc;
-- else
-+ err = cciss_engage_scsi(h);
-+ if (err == 0)
- err = length;
- } else
- #endif /* CONFIG_CISS_SCSI_TAPE */
-@@ -454,7 +597,7 @@ static const struct file_operations cciss_proc_fops = {
- .write = cciss_proc_write,
- };
-
--static void __devinit cciss_procinit(int i)
-+static void __devinit cciss_procinit(ctlr_info_t *h)
- {
- struct proc_dir_entry *pde;
-
-@@ -462,17 +605,76 @@ static void __devinit cciss_procinit(int i)
- proc_cciss = proc_mkdir("driver/cciss", NULL);
- if (!proc_cciss)
- return;
-- pde = proc_create_data(hba[i]->devname, S_IWUSR | S_IRUSR | S_IRGRP |
-+ pde = proc_create_data(h->devname, S_IWUSR | S_IRUSR | S_IRGRP |
- S_IROTH, proc_cciss,
-- &cciss_proc_fops, hba[i]);
-+ &cciss_proc_fops, h);
- }
- #endif /* CONFIG_PROC_FS */
-
--#define MAX_PRODUCT_NAME_LEN 19
--
- #define to_hba(n) container_of(n, struct ctlr_info, dev)
- #define to_drv(n) container_of(n, drive_info_struct, dev)
-
-+/* List of controllers which cannot be hard reset on kexec with reset_devices */
-+static u32 unresettable_controller[] = {
-+ 0x324a103C, /* Smart Array P712m */
-+ 0x324b103C, /* SmartArray P711m */
-+ 0x3223103C, /* Smart Array P800 */
-+ 0x3234103C, /* Smart Array P400 */
-+ 0x3235103C, /* Smart Array P400i */
-+ 0x3211103C, /* Smart Array E200i */
-+ 0x3212103C, /* Smart Array E200 */
-+ 0x3213103C, /* Smart Array E200i */
-+ 0x3214103C, /* Smart Array E200i */
-+ 0x3215103C, /* Smart Array E200i */
-+ 0x3237103C, /* Smart Array E500 */
-+ 0x323D103C, /* Smart Array P700m */
-+ 0x409C0E11, /* Smart Array 6400 */
-+ 0x409D0E11, /* Smart Array 6400 EM */
-+};
-+
-+/* List of controllers which cannot even be soft reset */
-+static u32 soft_unresettable_controller[] = {
-+ 0x409C0E11, /* Smart Array 6400 */
-+ 0x409D0E11, /* Smart Array 6400 EM */
-+};
-+
-+static int ctlr_is_hard_resettable(u32 board_id)
-+{
-+ int i;
-+
-+ for (i = 0; i < ARRAY_SIZE(unresettable_controller); i++)
-+ if (unresettable_controller[i] == board_id)
-+ return 0;
-+ return 1;
-+}
-+
-+static int ctlr_is_soft_resettable(u32 board_id)
-+{
-+ int i;
-+
-+ for (i = 0; i < ARRAY_SIZE(soft_unresettable_controller); i++)
-+ if (soft_unresettable_controller[i] == board_id)
-+ return 0;
-+ return 1;
-+}
-+
-+static int ctlr_is_resettable(u32 board_id)
-+{
-+ return ctlr_is_hard_resettable(board_id) ||
-+ ctlr_is_soft_resettable(board_id);
-+}
-+
-+static ssize_t host_show_resettable(struct device *dev,
-+ struct device_attribute *attr,
-+ char *buf)
-+{
-+ struct ctlr_info *h = to_hba(dev);
-+
-+ return snprintf(buf, 20, "%d\n", ctlr_is_resettable(h->board_id));
-+}
-+static DEVICE_ATTR(resettable, S_IRUGO, host_show_resettable, NULL);
-+
-+#if 0
- static ssize_t host_store_rescan(struct device *dev,
- struct device_attribute *attr,
- const char *buf, size_t count)
-@@ -486,6 +688,19 @@ static ssize_t host_store_rescan(struct device *dev,
- return count;
- }
- static DEVICE_ATTR(rescan, S_IWUSR, NULL, host_store_rescan);
-+#endif /* mfm need to do something else in sysfs */
-+
-+static ssize_t host_show_transport_mode(struct device *dev,
-+ struct device_attribute *attr,
-+ char *buf)
-+{
-+ struct ctlr_info *h = to_hba(dev);
-+
-+ return snprintf(buf, 20, "%s\n",
-+ h->transMethod & CFGTBL_Trans_Performant ?
-+ "performant" : "simple");
-+}
-+static DEVICE_ATTR(transport_mode, S_IRUGO, host_show_transport_mode, NULL);
-
- static ssize_t dev_show_unique_id(struct device *dev,
- struct device_attribute *attr,
-@@ -497,12 +712,12 @@ static ssize_t dev_show_unique_id(struct device *dev,
- unsigned long flags;
- int ret = 0;
-
-- spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
-+ spin_lock_irqsave(&h->lock, flags);
- if (h->busy_configuring)
- ret = -EBUSY;
- else
-- memcpy(sn, drv->serial_no, sizeof(sn));
-- spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
-+ memcpy(sn, drv->uid, sizeof(sn));
-+ spin_unlock_irqrestore(&h->lock, flags);
-
- if (ret)
- return ret;
-@@ -527,12 +742,12 @@ static ssize_t dev_show_vendor(struct device *dev,
- unsigned long flags;
- int ret = 0;
-
-- spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
-+ spin_lock_irqsave(&h->lock, flags);
- if (h->busy_configuring)
- ret = -EBUSY;
- else
- memcpy(vendor, drv->vendor, VENDOR_LEN + 1);
-- spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
-+ spin_unlock_irqrestore(&h->lock, flags);
-
- if (ret)
- return ret;
-@@ -551,12 +766,12 @@ static ssize_t dev_show_model(struct device *dev,
- unsigned long flags;
- int ret = 0;
-
-- spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
-+ spin_lock_irqsave(&h->lock, flags);
- if (h->busy_configuring)
- ret = -EBUSY;
- else
- memcpy(model, drv->model, MODEL_LEN + 1);
-- spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
-+ spin_unlock_irqrestore(&h->lock, flags);
-
- if (ret)
- return ret;
-@@ -575,12 +790,12 @@ static ssize_t dev_show_rev(struct device *dev,
- unsigned long flags;
- int ret = 0;
-
-- spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
-+ spin_lock_irqsave(&h->lock, flags);
- if (h->busy_configuring)
- ret = -EBUSY;
- else
- memcpy(rev, drv->rev, REV_LEN + 1);
-- spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
-+ spin_unlock_irqrestore(&h->lock, flags);
-
- if (ret)
- return ret;
-@@ -597,17 +812,17 @@ static ssize_t cciss_show_lunid(struct device *dev,
- unsigned long flags;
- unsigned char lunid[8];
-
-- spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
-+ spin_lock_irqsave(&h->lock, flags);
- if (h->busy_configuring) {
-- spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
-+ spin_unlock_irqrestore(&h->lock, flags);
- return -EBUSY;
- }
- if (!drv->heads) {
-- spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
-+ spin_unlock_irqrestore(&h->lock, flags);
- return -ENOTTY;
- }
- memcpy(lunid, drv->LunID, sizeof(lunid));
-- spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
-+ spin_unlock_irqrestore(&h->lock, flags);
- return snprintf(buf, 20, "0x%02x%02x%02x%02x%02x%02x%02x%02x\n",
- lunid[0], lunid[1], lunid[2], lunid[3],
- lunid[4], lunid[5], lunid[6], lunid[7]);
-@@ -622,13 +837,13 @@ static ssize_t cciss_show_raid_level(struct device *dev,
- int raid;
- unsigned long flags;
-
-- spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
-+ spin_lock_irqsave(&h->lock, flags);
- if (h->busy_configuring) {
-- spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
-+ spin_unlock_irqrestore(&h->lock, flags);
- return -EBUSY;
- }
- raid = drv->raid_level;
-- spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
-+ spin_unlock_irqrestore(&h->lock, flags);
- if (raid < 0 || raid > RAID_UNKNOWN)
- raid = RAID_UNKNOWN;
-
-@@ -645,19 +860,23 @@ static ssize_t cciss_show_usage_count(struct device *dev,
- unsigned long flags;
- int count;
-
-- spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
-+ spin_lock_irqsave(&h->lock, flags);
- if (h->busy_configuring) {
-- spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
-+ spin_unlock_irqrestore(&h->lock, flags);
- return -EBUSY;
- }
- count = drv->usage_count;
-- spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
-+ spin_unlock_irqrestore(&h->lock, flags);
- return snprintf(buf, 20, "%d\n", count);
- }
- static DEVICE_ATTR(usage_count, S_IRUGO, cciss_show_usage_count, NULL);
-
- static struct attribute *cciss_host_attrs[] = {
-+#if 0
- &dev_attr_rescan.attr,
-+#endif
-+ &dev_attr_resettable.attr,
-+ &dev_attr_transport_mode.attr,
- NULL
- };
-
-@@ -672,8 +891,8 @@ static const struct attribute_group *cciss_host_attr_groups[] = {
-
- static struct device_type cciss_host_type = {
- .name = "cciss_host",
-- .groups = cciss_host_attr_groups,
- .release = cciss_hba_release,
-+ .groups = cciss_host_attr_groups,
- };
-
- static struct attribute *cciss_dev_attrs[] = {
-@@ -796,62 +1015,72 @@ static void cciss_destroy_ld_sysfs_entry(struct ctlr_info *h, int drv_index,
- /*
- * For operations that cannot sleep, a command block is allocated at init,
- * and managed by cmd_alloc() and cmd_free() using a simple bitmap to track
-- * which ones are free or in use. For operations that can wait for kmalloc
-- * to possible sleep, this routine can be called with get_from_pool set to 0.
-- * cmd_free() MUST be called with a got_from_pool set to 0 if cmd_alloc was.
-+ * which ones are free or in use.
- */
--static CommandList_struct *cmd_alloc(ctlr_info_t *h, int get_from_pool)
-+static CommandList_struct *cmd_alloc(ctlr_info_t *h)
- {
- CommandList_struct *c;
- int i;
- u64bit temp64;
- dma_addr_t cmd_dma_handle, err_dma_handle;
-
-- if (!get_from_pool) {
-- c = (CommandList_struct *) pci_alloc_consistent(h->pdev,
-- sizeof(CommandList_struct), &cmd_dma_handle);
-- if (c == NULL)
-+ do {
-+ i = find_first_zero_bit(h->cmd_pool_bits, h->nr_cmds);
-+ if (i == h->nr_cmds)
- return NULL;
-- memset(c, 0, sizeof(CommandList_struct));
-+ } while (test_and_set_bit(i & (BITS_PER_LONG - 1),
-+ h->cmd_pool_bits + (i / BITS_PER_LONG)) != 0);
-+ c = h->cmd_pool + i;
-+ memset(c, 0, sizeof(CommandList_struct));
-+ cmd_dma_handle = h->cmd_pool_dhandle + i * sizeof(CommandList_struct);
-+ c->err_info = h->errinfo_pool + i;
-+ memset(c->err_info, 0, sizeof(ErrorInfo_struct));
-+ err_dma_handle = h->errinfo_pool_dhandle
-+ + i * sizeof(ErrorInfo_struct);
-+ h->nr_allocs++;
-
-- c->cmdindex = -1;
-+ c->cmdindex = i;
-
-- c->err_info = (ErrorInfo_struct *)
-- pci_alloc_consistent(h->pdev, sizeof(ErrorInfo_struct),
-- &err_dma_handle);
-+ INIT_LIST_HEAD(&c->list);
-+ c->busaddr = (__u32) cmd_dma_handle;
-+ temp64.val = (__u64) err_dma_handle;
-+ c->ErrDesc.Addr.lower = temp64.val32.lower;
-+ c->ErrDesc.Addr.upper = temp64.val32.upper;
-+ c->ErrDesc.Len = sizeof(ErrorInfo_struct);
-
-- if (c->err_info == NULL) {
-- pci_free_consistent(h->pdev,
-- sizeof(CommandList_struct), c, cmd_dma_handle);
-- return NULL;
-- }
-- memset(c->err_info, 0, sizeof(ErrorInfo_struct));
-- } else { /* get it out of the controllers pool */
-+ c->ctlr = h->ctlr;
-+ return c;
-+}
-
-- do {
-- i = find_first_zero_bit(h->cmd_pool_bits, h->nr_cmds);
-- if (i == h->nr_cmds)
-- return NULL;
-- } while (test_and_set_bit
-- (i & (BITS_PER_LONG - 1),
-- h->cmd_pool_bits + (i / BITS_PER_LONG)) != 0);
--#ifdef CCISS_DEBUG
-- printk(KERN_DEBUG "cciss: using command buffer %d\n", i);
--#endif
-- c = h->cmd_pool + i;
-- memset(c, 0, sizeof(CommandList_struct));
-- cmd_dma_handle = h->cmd_pool_dhandle
-- + i * sizeof(CommandList_struct);
-- c->err_info = h->errinfo_pool + i;
-- memset(c->err_info, 0, sizeof(ErrorInfo_struct));
-- err_dma_handle = h->errinfo_pool_dhandle
-- + i * sizeof(ErrorInfo_struct);
-- h->nr_allocs++;
-+/* allocate a command using pci_alloc_consistent, used for ioctls,
-+ * etc., not for the main i/o path.
-+ */
-+static CommandList_struct *cmd_special_alloc(ctlr_info_t *h)
-+{
-+ CommandList_struct *c;
-+ u64bit temp64;
-+ dma_addr_t cmd_dma_handle, err_dma_handle;
-+
-+ c = (CommandList_struct *) pci_alloc_consistent(h->pdev,
-+ sizeof(CommandList_struct), &cmd_dma_handle);
-+ if (c == NULL)
-+ return NULL;
-+ memset(c, 0, sizeof(CommandList_struct));
-
-- c->cmdindex = i;
-+ c->cmdindex = -1;
-+
-+ c->err_info = (ErrorInfo_struct *)
-+ pci_alloc_consistent(h->pdev, sizeof(ErrorInfo_struct),
-+ &err_dma_handle);
-+
-+ if (c->err_info == NULL) {
-+ pci_free_consistent(h->pdev,
-+ sizeof(CommandList_struct), c, cmd_dma_handle);
-+ return NULL;
- }
-+ memset(c->err_info, 0, sizeof(ErrorInfo_struct));
-
-- INIT_HLIST_NODE(&c->list);
-+ INIT_LIST_HEAD(&c->list);
- c->busaddr = (__u32) cmd_dma_handle;
- temp64.val = (__u64) err_dma_handle;
- c->ErrDesc.Addr.lower = temp64.val32.lower;
-@@ -862,27 +1091,26 @@ static CommandList_struct *cmd_alloc(ctlr_info_t *h, int get_from_pool)
- return c;
- }
-
--/*
-- * Frees a command block that was previously allocated with cmd_alloc().
-- */
--static void cmd_free(ctlr_info_t *h, CommandList_struct *c, int got_from_pool)
-+static void cmd_free(ctlr_info_t *h, CommandList_struct *c)
- {
- int i;
-+
-+ i = c - h->cmd_pool;
-+ clear_bit(i & (BITS_PER_LONG - 1),
-+ h->cmd_pool_bits + (i / BITS_PER_LONG));
-+ h->nr_frees++;
-+}
-+
-+static void cmd_special_free(ctlr_info_t *h, CommandList_struct *c)
-+{
- u64bit temp64;
-
-- if (!got_from_pool) {
-- temp64.val32.lower = c->ErrDesc.Addr.lower;
-- temp64.val32.upper = c->ErrDesc.Addr.upper;
-- pci_free_consistent(h->pdev, sizeof(ErrorInfo_struct),
-- c->err_info, (dma_addr_t) temp64.val);
-- pci_free_consistent(h->pdev, sizeof(CommandList_struct),
-- c, (dma_addr_t) c->busaddr);
-- } else {
-- i = c - h->cmd_pool;
-- clear_bit(i & (BITS_PER_LONG - 1),
-- h->cmd_pool_bits + (i / BITS_PER_LONG));
-- h->nr_frees++;
-- }
-+ temp64.val32.lower = c->ErrDesc.Addr.lower;
-+ temp64.val32.upper = c->ErrDesc.Addr.upper;
-+ pci_free_consistent(h->pdev, sizeof(ErrorInfo_struct),
-+ c->err_info, (dma_addr_t) temp64.val);
-+ pci_free_consistent(h->pdev, sizeof(CommandList_struct),
-+ c, (dma_addr_t) cciss_tag_discard_error_bits(h, (u32) c->busaddr));
- }
-
- static inline ctlr_info_t *get_host(struct gendisk *disk)
-@@ -900,13 +1128,10 @@ static inline drive_info_struct *get_drv(struct gendisk *disk)
- */
- static int cciss_open(struct block_device *bdev, fmode_t mode)
- {
-- ctlr_info_t *host = get_host(bdev->bd_disk);
-+ ctlr_info_t *h = get_host(bdev->bd_disk);
- drive_info_struct *drv = get_drv(bdev->bd_disk);
-
--#ifdef CCISS_DEBUG
-- printk(KERN_DEBUG "cciss_open %s\n", bdev->bd_disk->disk_name);
--#endif /* CCISS_DEBUG */
--
-+ dev_dbg(&h->pdev->dev, "cciss_open %s\n", bdev->bd_disk->disk_name);
- if (drv->busy_configuring)
- return -EBUSY;
- /*
-@@ -932,7 +1157,7 @@ static int cciss_open(struct block_device *bdev, fmode_t mode)
- return -EPERM;
- }
- drv->usage_count++;
-- host->usage_count++;
-+ h->usage_count++;
- return 0;
- }
-
-@@ -941,19 +1166,18 @@ static int cciss_open(struct block_device *bdev, fmode_t mode)
- */
- static int cciss_release(struct gendisk *disk, fmode_t mode)
- {
-- ctlr_info_t *host = get_host(disk);
-+ ctlr_info_t *h = get_host(disk);
- drive_info_struct *drv = get_drv(disk);
--
--#ifdef CCISS_DEBUG
-- printk(KERN_DEBUG "cciss_release %s\n", disk->disk_name);
--#endif /* CCISS_DEBUG */
--
-+ dev_dbg(&h->pdev->dev, "cciss_release %s\n", disk->disk_name);
- drv->usage_count--;
-- host->usage_count--;
-+ h->usage_count--;
- return 0;
- }
-
--#ifdef CONFIG_COMPAT
-+/*
-+ * This area could use some work to make it easier to understand.
-+ */
-+#if defined (CONFIG_COMPAT) || !KFEATURE_HAS_LOCKED_IOCTL
-
- static int do_ioctl(struct block_device *bdev, fmode_t mode,
- unsigned cmd, unsigned long arg)
-@@ -965,6 +1189,10 @@ static int do_ioctl(struct block_device *bdev, fmode_t mode,
- return ret;
- }
-
-+#endif
-+
-+#ifdef CONFIG_COMPAT
-+
- static int cciss_ioctl32_passthru(struct block_device *bdev, fmode_t mode,
- unsigned cmd, unsigned long arg);
- static int cciss_ioctl32_big_passthru(struct block_device *bdev, fmode_t mode,
-@@ -1011,6 +1239,7 @@ static int cciss_ioctl32_passthru(struct block_device *bdev, fmode_t mode,
- int err;
- u32 cp;
-
-+ memset(&arg64, 0, sizeof(arg64));
- err = 0;
- err |=
- copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
-@@ -1051,6 +1280,7 @@ static int cciss_ioctl32_big_passthru(struct block_device *bdev, fmode_t mode,
- int err;
- u32 cp;
-
-+ memset(&arg64, 0, sizeof(arg64));
- err = 0;
- err |=
- copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
-@@ -1095,493 +1325,459 @@ static int cciss_getgeo(struct block_device *bdev, struct hd_geometry *geo)
- return 0;
- }
-
--static void check_ioctl_unit_attention(ctlr_info_t *host, CommandList_struct *c)
-+static void check_ioctl_unit_attention(ctlr_info_t *h, CommandList_struct *c)
- {
- if (c->err_info->CommandStatus == CMD_TARGET_STATUS &&
- c->err_info->ScsiStatus != SAM_STAT_CHECK_CONDITION)
-- (void)check_for_unit_attention(host, c);
-+ (void)check_for_unit_attention(h, c);
- }
--/*
-- * ioctl
-- */
-+
-+static int cciss_getpciinfo(ctlr_info_t *h, void __user *argp)
-+{
-+ cciss_pci_info_struct pciinfo;
-+
-+ if (!argp)
-+ return -EINVAL;
-+ pciinfo.domain = pci_domain_nr(h->pdev->bus);
-+ pciinfo.bus = h->pdev->bus->number;
-+ pciinfo.dev_fn = h->pdev->devfn;
-+ pciinfo.board_id = h->board_id;
-+ if (copy_to_user(argp, &pciinfo, sizeof(cciss_pci_info_struct)))
-+ return -EFAULT;
-+ return 0;
-+}
-+
-+static int cciss_getintinfo(ctlr_info_t *h, void __user *argp)
-+{
-+ cciss_coalint_struct intinfo;
-+
-+ if (!argp)
-+ return -EINVAL;
-+ intinfo.delay = readl(&h->cfgtable->HostWrite.CoalIntDelay);
-+ intinfo.count = readl(&h->cfgtable->HostWrite.CoalIntCount);
-+ if (copy_to_user
-+ (argp, &intinfo, sizeof(cciss_coalint_struct)))
-+ return -EFAULT;
-+ return 0;
-+}
-+
-+static int cciss_setintinfo(ctlr_info_t *h, void __user *argp)
-+{
-+ cciss_coalint_struct intinfo;
-+ unsigned long flags;
-+ int i;
-+
-+ if (!argp)
-+ return -EINVAL;
-+ if (!capable(CAP_SYS_ADMIN))
-+ return -EPERM;
-+ if (copy_from_user(&intinfo, argp, sizeof(intinfo)))
-+ return -EFAULT;
-+ if ((intinfo.delay == 0) && (intinfo.count == 0))
-+ return -EINVAL;
-+ spin_lock_irqsave(&h->lock, flags);
-+ /* Update the field, and then ring the doorbell */
-+ writel(intinfo.delay, &(h->cfgtable->HostWrite.CoalIntDelay));
-+ writel(intinfo.count, &(h->cfgtable->HostWrite.CoalIntCount));
-+ writel(CFGTBL_ChangeReq, h->vaddr + SA5_DOORBELL);
-+
-+ for (i = 0; i < MAX_IOCTL_CONFIG_WAIT; i++) {
-+ if (!(readl(h->vaddr + SA5_DOORBELL) & CFGTBL_ChangeReq))
-+ break;
-+ udelay(1000); /* delay and try again */
-+ }
-+ spin_unlock_irqrestore(&h->lock, flags);
-+ if (i >= MAX_IOCTL_CONFIG_WAIT)
-+ return -EAGAIN;
-+ return 0;
-+}
-+
-+static int cciss_getnodename(ctlr_info_t *h, void __user *argp)
-+{
-+ NodeName_type NodeName;
-+ int i;
-+
-+ if (!argp)
-+ return -EINVAL;
-+ for (i = 0; i < 16; i++)
-+ NodeName[i] = readb(&h->cfgtable->ServerName[i]);
-+ if (copy_to_user(argp, NodeName, sizeof(NodeName_type)))
-+ return -EFAULT;
-+ return 0;
-+}
-+
-+static int cciss_setnodename(ctlr_info_t *h, void __user *argp)
-+{
-+ NodeName_type NodeName;
-+ unsigned long flags;
-+ int i;
-+
-+ if (!argp)
-+ return -EINVAL;
-+ if (!capable(CAP_SYS_ADMIN))
-+ return -EPERM;
-+ if (copy_from_user(NodeName, argp, sizeof(NodeName_type)))
-+ return -EFAULT;
-+ spin_lock_irqsave(&h->lock, flags);
-+ /* Update the field, and then ring the doorbell */
-+ for (i = 0; i < 16; i++)
-+ writeb(NodeName[i], &h->cfgtable->ServerName[i]);
-+ writel(CFGTBL_ChangeReq, h->vaddr + SA5_DOORBELL);
-+ for (i = 0; i < MAX_IOCTL_CONFIG_WAIT; i++) {
-+ if (!(readl(h->vaddr + SA5_DOORBELL) & CFGTBL_ChangeReq))
-+ break;
-+ udelay(1000); /* delay and try again */
-+ }
-+ spin_unlock_irqrestore(&h->lock, flags);
-+ if (i >= MAX_IOCTL_CONFIG_WAIT)
-+ return -EAGAIN;
-+ return 0;
-+}
-+
-+static int cciss_getheartbeat(ctlr_info_t *h, void __user *argp)
-+{
-+ Heartbeat_type heartbeat;
-+
-+ if (!argp)
-+ return -EINVAL;
-+ heartbeat = readl(&h->cfgtable->HeartBeat);
-+ if (copy_to_user(argp, &heartbeat, sizeof(Heartbeat_type)))
-+ return -EFAULT;
-+ return 0;
-+}
-+
-+static int cciss_getbustypes(ctlr_info_t *h, void __user *argp)
-+{
-+ BusTypes_type BusTypes;
-+
-+ if (!argp)
-+ return -EINVAL;
-+ BusTypes = readl(&h->cfgtable->BusTypes);
-+ if (copy_to_user(argp, &BusTypes, sizeof(BusTypes_type)))
-+ return -EFAULT;
-+ return 0;
-+}
-+
-+static int cciss_getfirmver(ctlr_info_t *h, void __user *argp)
-+{
-+ FirmwareVer_type firmware;
-+
-+ if (!argp)
-+ return -EINVAL;
-+ memcpy(firmware, h->firm_ver, 4);
-+
-+ if (copy_to_user
-+ (argp, firmware, sizeof(FirmwareVer_type)))
-+ return -EFAULT;
-+ return 0;
-+}
-+
-+static int cciss_getdrivver(ctlr_info_t *h, void __user *argp)
-+{
-+ DriverVer_type DriverVer = DRIVER_VERSION;
-+
-+ if (!argp)
-+ return -EINVAL;
-+ if (copy_to_user(argp, &DriverVer, sizeof(DriverVer_type)))
-+ return -EFAULT;
-+ return 0;
-+}
-+
-+static int cciss_getluninfo(ctlr_info_t *h,
-+ struct gendisk *disk, void __user *argp)
-+{
-+ LogvolInfo_struct luninfo;
-+ drive_info_struct *drv = get_drv(disk);
-+
-+ if (!argp)
-+ return -EINVAL;
-+ memcpy(&luninfo.LunID, drv->LunID, sizeof(luninfo.LunID));
-+ luninfo.num_opens = drv->usage_count;
-+ luninfo.num_parts = 0;
-+ if (copy_to_user(argp, &luninfo, sizeof(LogvolInfo_struct)))
-+ return -EFAULT;
-+ return 0;
-+}
-+
-+static int cciss_passthru(ctlr_info_t *h, void __user *argp)
-+{
-+ IOCTL_Command_struct iocommand;
-+ CommandList_struct *c;
-+ char *buff = NULL;
-+ u64bit temp64;
-+ DECLARE_COMPLETION_ONSTACK(wait);
-+
-+ if (!argp)
-+ return -EINVAL;
-+
-+ if (!capable(CAP_SYS_RAWIO))
-+ return -EPERM;
-+
-+ if (copy_from_user(&iocommand, argp, sizeof(IOCTL_Command_struct)))
-+ return -EFAULT;
-+ if ((iocommand.buf_size < 1) &&
-+ (iocommand.Request.Type.Direction != XFER_NONE))
-+ return -EINVAL;
-+ if (iocommand.buf_size > 0) {
-+ buff = kmalloc(iocommand.buf_size, GFP_KERNEL);
-+ if (buff == NULL)
-+ return -EFAULT;
-+ }
-+ if (iocommand.Request.Type.Direction == XFER_WRITE) {
-+ if (copy_from_user(buff, iocommand.buf, iocommand.buf_size)) {
-+ kfree(buff);
-+ return -EFAULT;
-+ }
-+ } else {
-+ memset(buff, 0, iocommand.buf_size);
-+ }
-+ c = cmd_special_alloc(h);
-+ if (!c) {
-+ kfree(buff);
-+ return -ENOMEM;
-+ }
-+ c->cmd_type = CMD_IOCTL_PEND; /* Fill in the command type */
-+ /* Fill in Command Header */
-+ c->Header.ReplyQueue = 0; /* unused in simple mode */
-+ if (iocommand.buf_size > 0) { /* buffer to fill */
-+ c->Header.SGList = 1;
-+ c->Header.SGTotal = 1;
-+ } else { /* no buffers to fill */
-+ c->Header.SGList = 0;
-+ c->Header.SGTotal = 0;
-+ }
-+ c->Header.LUN = iocommand.LUN_info;
-+ c->Header.Tag.lower = c->busaddr; /* use bus addr for tag */
-+ c->Request = iocommand.Request; /* Fill in Request block */
-+
-+ /* Fill in the scatter gather information */
-+ if (iocommand.buf_size > 0) {
-+ temp64.val = pci_map_single(h->pdev, buff,
-+ iocommand.buf_size,
-+ PCI_DMA_BIDIRECTIONAL);
-+ c->SG[0].Addr.lower = temp64.val32.lower;
-+ c->SG[0].Addr.upper = temp64.val32.upper;
-+ c->SG[0].Len = iocommand.buf_size;
-+ c->SG[0].Ext = 0; /* we are not chaining */
-+ }
-+ c->waiting = &wait;
-+ enqueue_cmd_and_start_io(h, c);
-+ wait_for_completion(&wait);
-+
-+ /* unmap the DMA buffers */
-+ temp64.val32.lower = c->SG[0].Addr.lower;
-+ temp64.val32.upper = c->SG[0].Addr.upper;
-+ pci_unmap_single(h->pdev, (dma_addr_t) temp64.val,
-+ iocommand.buf_size, PCI_DMA_BIDIRECTIONAL);
-+
-+ check_ioctl_unit_attention(h, c);
-+
-+ /* Copy the error information out */
-+ iocommand.error_info = *(c->err_info);
-+ if (copy_to_user(argp, &iocommand, sizeof(IOCTL_Command_struct))) {
-+ kfree(buff);
-+ cmd_special_free(h, c);
-+ return -EFAULT;
-+ }
-+
-+ if (iocommand.Request.Type.Direction == XFER_READ) {
-+ /* Copy the data out of the buffer we created */
-+ if (copy_to_user(iocommand.buf, buff, iocommand.buf_size)) {
-+ kfree(buff);
-+ cmd_special_free(h, c);
-+ return -EFAULT;
-+ }
-+ }
-+ kfree(buff);
-+ cmd_special_free(h, c);
-+ return 0;
-+}
-+
-+static int cciss_bigpassthru(ctlr_info_t *h, void __user *argp)
-+{
-+ BIG_IOCTL_Command_struct *ioc;
-+ CommandList_struct *c;
-+ unsigned char **buff = NULL;
-+ int *buff_size = NULL;
-+ u64bit temp64;
-+ BYTE sg_used = 0;
-+ int status = 0;
-+ int i;
-+ DECLARE_COMPLETION_ONSTACK(wait);
-+ __u32 left;
-+ __u32 sz;
-+ BYTE __user *data_ptr;
-+
-+ if (!argp)
-+ return -EINVAL;
-+ if (!capable(CAP_SYS_RAWIO))
-+ return -EPERM;
-+ ioc = kmalloc(sizeof(*ioc), GFP_KERNEL);
-+ if (!ioc) {
-+ status = -ENOMEM;
-+ goto cleanup1;
-+ }
-+ if (copy_from_user(ioc, argp, sizeof(*ioc))) {
-+ status = -EFAULT;
-+ goto cleanup1;
-+ }
-+ if ((ioc->buf_size < 1) &&
-+ (ioc->Request.Type.Direction != XFER_NONE)) {
-+ status = -EINVAL;
-+ goto cleanup1;
-+ }
-+ /* Check kmalloc limits using all SGs */
-+ if (ioc->malloc_size > MAX_KMALLOC_SIZE) {
-+ status = -EINVAL;
-+ goto cleanup1;
-+ }
-+ if (ioc->buf_size > ioc->malloc_size * MAXSGENTRIES) {
-+ status = -EINVAL;
-+ goto cleanup1;
-+ }
-+ buff = kzalloc(MAXSGENTRIES * sizeof(char *), GFP_KERNEL);
-+ if (!buff) {
-+ status = -ENOMEM;
-+ goto cleanup1;
-+ }
-+ buff_size = kmalloc(MAXSGENTRIES * sizeof(int), GFP_KERNEL);
-+ if (!buff_size) {
-+ status = -ENOMEM;
-+ goto cleanup1;
-+ }
-+ left = ioc->buf_size;
-+ data_ptr = ioc->buf;
-+ while (left) {
-+ sz = (left > ioc->malloc_size) ? ioc-> malloc_size : left;
-+ buff_size[sg_used] = sz;
-+ buff[sg_used] = kmalloc(sz, GFP_KERNEL);
-+ if (buff[sg_used] == NULL) {
-+ status = -ENOMEM;
-+ goto cleanup1;
-+ }
-+ if (ioc->Request.Type.Direction == XFER_WRITE) {
-+ if (copy_from_user(buff[sg_used], data_ptr, sz)) {
-+ status = -EFAULT;
-+ goto cleanup1;
-+ }
-+ } else {
-+ memset(buff[sg_used], 0, sz);
-+ }
-+ left -= sz;
-+ data_ptr += sz;
-+ sg_used++;
-+ }
-+ c = cmd_special_alloc(h);
-+ if (!c) {
-+ status = -ENOMEM;
-+ goto cleanup1;
-+ }
-+ c->cmd_type = CMD_IOCTL_PEND;
-+ c->Header.ReplyQueue = 0;
-+
-+ if (ioc->buf_size > 0) {
-+ c->Header.SGList = sg_used;
-+ c->Header.SGTotal = sg_used;
-+ } else {
-+ c->Header.SGList = 0;
-+ c->Header.SGTotal = 0;
-+ }
-+ c->Header.LUN = ioc->LUN_info;
-+ c->Header.Tag.lower = c->busaddr;
-+
-+ c->Request = ioc->Request;
-+ if (ioc->buf_size > 0) {
-+ int i;
-+ for (i = 0; i < sg_used; i++) {
-+ temp64.val = pci_map_single(h->pdev, buff[i],
-+ buff_size[i], PCI_DMA_BIDIRECTIONAL);
-+ c->SG[i].Addr.lower = temp64.val32.lower;
-+ c->SG[i].Addr.upper = temp64.val32.upper;
-+ c->SG[i].Len = buff_size[i];
-+ c->SG[i].Ext = 0; /* we are not chaining */
-+ }
-+ }
-+ c->waiting = &wait;
-+ enqueue_cmd_and_start_io(h, c);
-+ wait_for_completion(&wait);
-+ /* unlock the buffers from DMA */
-+ for (i = 0; i < sg_used; i++) {
-+ temp64.val32.lower = c->SG[i].Addr.lower;
-+ temp64.val32.upper = c->SG[i].Addr.upper;
-+ pci_unmap_single(h->pdev, (dma_addr_t) temp64.val,
-+ buff_size[i], PCI_DMA_BIDIRECTIONAL);
-+ }
-+ check_ioctl_unit_attention(h, c);
-+ /* Copy the error information out */
-+ ioc->error_info = *(c->err_info);
-+ if (copy_to_user(argp, ioc, sizeof(*ioc))) {
-+ cmd_special_free(h, c);
-+ status = -EFAULT;
-+ goto cleanup1;
-+ }
-+ if (ioc->Request.Type.Direction == XFER_READ) {
-+ /* Copy the data out of the buffer we created */
-+ BYTE __user *ptr = ioc->buf;
-+ for (i = 0; i < sg_used; i++) {
-+ if (copy_to_user(ptr, buff[i], buff_size[i])) {
-+ cmd_special_free(h, c);
-+ status = -EFAULT;
-+ goto cleanup1;
-+ }
-+ ptr += buff_size[i];
-+ }
-+ }
-+ cmd_special_free(h, c);
-+ status = 0;
-+cleanup1:
-+ if (buff) {
-+ for (i = 0; i < sg_used; i++)
-+ kfree(buff[i]);
-+ kfree(buff);
-+ }
-+ kfree(buff_size);
-+ kfree(ioc);
-+ return status;
-+}
-+
- static int cciss_ioctl(struct block_device *bdev, fmode_t mode,
-- unsigned int cmd, unsigned long arg)
-+ unsigned int cmd, unsigned long arg)
- {
- struct gendisk *disk = bdev->bd_disk;
-- ctlr_info_t *host = get_host(disk);
-- drive_info_struct *drv = get_drv(disk);
-- int ctlr = host->ctlr;
-+ ctlr_info_t *h = get_host(disk);
- void __user *argp = (void __user *)arg;
-
--#ifdef CCISS_DEBUG
-- printk(KERN_DEBUG "cciss_ioctl: Called with cmd=%x %lx\n", cmd, arg);
--#endif /* CCISS_DEBUG */
--
-+ dev_dbg(&h->pdev->dev, "cciss_ioctl: Called with cmd=%x %lx\n",
-+ cmd, arg);
- switch (cmd) {
- case CCISS_GETPCIINFO:
-- {
-- cciss_pci_info_struct pciinfo;
--
-- if (!arg)
-- return -EINVAL;
-- pciinfo.domain = pci_domain_nr(host->pdev->bus);
-- pciinfo.bus = host->pdev->bus->number;
-- pciinfo.dev_fn = host->pdev->devfn;
-- pciinfo.board_id = host->board_id;
-- if (copy_to_user
-- (argp, &pciinfo, sizeof(cciss_pci_info_struct)))
-- return -EFAULT;
-- return 0;
-- }
-+ return cciss_getpciinfo(h, argp);
- case CCISS_GETINTINFO:
-- {
-- cciss_coalint_struct intinfo;
-- if (!arg)
-- return -EINVAL;
-- intinfo.delay =
-- readl(&host->cfgtable->HostWrite.CoalIntDelay);
-- intinfo.count =
-- readl(&host->cfgtable->HostWrite.CoalIntCount);
-- if (copy_to_user
-- (argp, &intinfo, sizeof(cciss_coalint_struct)))
-- return -EFAULT;
-- return 0;
-- }
-+ return cciss_getintinfo(h, argp);
- case CCISS_SETINTINFO:
-- {
-- cciss_coalint_struct intinfo;
-- unsigned long flags;
-- int i;
--
-- if (!arg)
-- return -EINVAL;
-- if (!capable(CAP_SYS_ADMIN))
-- return -EPERM;
-- if (copy_from_user
-- (&intinfo, argp, sizeof(cciss_coalint_struct)))
-- return -EFAULT;
-- if ((intinfo.delay == 0) && (intinfo.count == 0))
-- {
--// printk("cciss_ioctl: delay and count cannot be 0\n");
-- return -EINVAL;
-- }
-- spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
-- /* Update the field, and then ring the doorbell */
-- writel(intinfo.delay,
-- &(host->cfgtable->HostWrite.CoalIntDelay));
-- writel(intinfo.count,
-- &(host->cfgtable->HostWrite.CoalIntCount));
-- writel(CFGTBL_ChangeReq, host->vaddr + SA5_DOORBELL);
--
-- for (i = 0; i < MAX_IOCTL_CONFIG_WAIT; i++) {
-- if (!(readl(host->vaddr + SA5_DOORBELL)
-- & CFGTBL_ChangeReq))
-- break;
-- /* delay and try again */
-- udelay(1000);
-- }
-- spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
-- if (i >= MAX_IOCTL_CONFIG_WAIT)
-- return -EAGAIN;
-- return 0;
-- }
-+ return cciss_setintinfo(h, argp);
- case CCISS_GETNODENAME:
-- {
-- NodeName_type NodeName;
-- int i;
--
-- if (!arg)
-- return -EINVAL;
-- for (i = 0; i < 16; i++)
-- NodeName[i] =
-- readb(&host->cfgtable->ServerName[i]);
-- if (copy_to_user(argp, NodeName, sizeof(NodeName_type)))
-- return -EFAULT;
-- return 0;
-- }
-+ return cciss_getnodename(h, argp);
- case CCISS_SETNODENAME:
-- {
-- NodeName_type NodeName;
-- unsigned long flags;
-- int i;
--
-- if (!arg)
-- return -EINVAL;
-- if (!capable(CAP_SYS_ADMIN))
-- return -EPERM;
--
-- if (copy_from_user
-- (NodeName, argp, sizeof(NodeName_type)))
-- return -EFAULT;
--
-- spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
--
-- /* Update the field, and then ring the doorbell */
-- for (i = 0; i < 16; i++)
-- writeb(NodeName[i],
-- &host->cfgtable->ServerName[i]);
--
-- writel(CFGTBL_ChangeReq, host->vaddr + SA5_DOORBELL);
--
-- for (i = 0; i < MAX_IOCTL_CONFIG_WAIT; i++) {
-- if (!(readl(host->vaddr + SA5_DOORBELL)
-- & CFGTBL_ChangeReq))
-- break;
-- /* delay and try again */
-- udelay(1000);
-- }
-- spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
-- if (i >= MAX_IOCTL_CONFIG_WAIT)
-- return -EAGAIN;
-- return 0;
-- }
--
-+ return cciss_setnodename(h, argp);
- case CCISS_GETHEARTBEAT:
-- {
-- Heartbeat_type heartbeat;
--
-- if (!arg)
-- return -EINVAL;
-- heartbeat = readl(&host->cfgtable->HeartBeat);
-- if (copy_to_user
-- (argp, &heartbeat, sizeof(Heartbeat_type)))
-- return -EFAULT;
-- return 0;
-- }
-+ return cciss_getheartbeat(h, argp);
- case CCISS_GETBUSTYPES:
-- {
-- BusTypes_type BusTypes;
--
-- if (!arg)
-- return -EINVAL;
-- BusTypes = readl(&host->cfgtable->BusTypes);
-- if (copy_to_user
-- (argp, &BusTypes, sizeof(BusTypes_type)))
-- return -EFAULT;
-- return 0;
-- }
-+ return cciss_getbustypes(h, argp);
- case CCISS_GETFIRMVER:
-- {
-- FirmwareVer_type firmware;
--
-- if (!arg)
-- return -EINVAL;
-- memcpy(firmware, host->firm_ver, 4);
--
-- if (copy_to_user
-- (argp, firmware, sizeof(FirmwareVer_type)))
-- return -EFAULT;
-- return 0;
-- }
-+ return cciss_getfirmver(h, argp);
- case CCISS_GETDRIVVER:
-- {
-- DriverVer_type DriverVer = DRIVER_VERSION;
--
-- if (!arg)
-- return -EINVAL;
--
-- if (copy_to_user
-- (argp, &DriverVer, sizeof(DriverVer_type)))
-- return -EFAULT;
-- return 0;
-- }
--
-+ return cciss_getdrivver(h, argp);
- case CCISS_DEREGDISK:
- case CCISS_REGNEWD:
- case CCISS_REVALIDVOLS:
-- return rebuild_lun_table(host, 0, 1);
--
-- case CCISS_GETLUNINFO:{
-- LogvolInfo_struct luninfo;
--
-- memcpy(&luninfo.LunID, drv->LunID,
-- sizeof(luninfo.LunID));
-- luninfo.num_opens = drv->usage_count;
-- luninfo.num_parts = 0;
-- if (copy_to_user(argp, &luninfo,
-- sizeof(LogvolInfo_struct)))
-- return -EFAULT;
-- return 0;
-- }
-+ return rebuild_lun_table(h, 0, 1);
-+ case CCISS_GETLUNINFO:
-+ return cciss_getluninfo(h, disk, argp);
- case CCISS_PASSTHRU:
-- {
-- IOCTL_Command_struct iocommand;
-- CommandList_struct *c;
-- char *buff = NULL;
-- u64bit temp64;
-- unsigned long flags;
-- DECLARE_COMPLETION_ONSTACK(wait);
--
-- if (!arg)
-- return -EINVAL;
--
-- if (!capable(CAP_SYS_RAWIO))
-- return -EPERM;
--
-- if (copy_from_user
-- (&iocommand, argp, sizeof(IOCTL_Command_struct)))
-- return -EFAULT;
-- if ((iocommand.buf_size < 1) &&
-- (iocommand.Request.Type.Direction != XFER_NONE)) {
-- return -EINVAL;
-- }
--#if 0 /* 'buf_size' member is 16-bits, and always smaller than kmalloc limit */
-- /* Check kmalloc limits */
-- if (iocommand.buf_size > 128000)
-- return -EINVAL;
--#endif
-- if (iocommand.buf_size > 0) {
-- buff = kmalloc(iocommand.buf_size, GFP_KERNEL);
-- if (buff == NULL)
-- return -EFAULT;
-- }
-- if (iocommand.Request.Type.Direction == XFER_WRITE) {
-- /* Copy the data into the buffer we created */
-- if (copy_from_user
-- (buff, iocommand.buf, iocommand.buf_size)) {
-- kfree(buff);
-- return -EFAULT;
-- }
-- } else {
-- memset(buff, 0, iocommand.buf_size);
-- }
-- if ((c = cmd_alloc(host, 0)) == NULL) {
-- kfree(buff);
-- return -ENOMEM;
-- }
-- // Fill in the command type
-- c->cmd_type = CMD_IOCTL_PEND;
-- // Fill in Command Header
-- c->Header.ReplyQueue = 0; // unused in simple mode
-- if (iocommand.buf_size > 0) // buffer to fill
-- {
-- c->Header.SGList = 1;
-- c->Header.SGTotal = 1;
-- } else // no buffers to fill
-- {
-- c->Header.SGList = 0;
-- c->Header.SGTotal = 0;
-- }
-- c->Header.LUN = iocommand.LUN_info;
-- c->Header.Tag.lower = c->busaddr; // use the kernel address the cmd block for tag
--
-- // Fill in Request block
-- c->Request = iocommand.Request;
--
-- // Fill in the scatter gather information
-- if (iocommand.buf_size > 0) {
-- temp64.val = pci_map_single(host->pdev, buff,
-- iocommand.buf_size,
-- PCI_DMA_BIDIRECTIONAL);
-- c->SG[0].Addr.lower = temp64.val32.lower;
-- c->SG[0].Addr.upper = temp64.val32.upper;
-- c->SG[0].Len = iocommand.buf_size;
-- c->SG[0].Ext = 0; // we are not chaining
-- }
-- c->waiting = &wait;
--
-- /* Put the request on the tail of the request queue */
-- spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
-- addQ(&host->reqQ, c);
-- host->Qdepth++;
-- start_io(host);
-- spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
--
-- wait_for_completion(&wait);
--
-- /* unlock the buffers from DMA */
-- temp64.val32.lower = c->SG[0].Addr.lower;
-- temp64.val32.upper = c->SG[0].Addr.upper;
-- pci_unmap_single(host->pdev, (dma_addr_t) temp64.val,
-- iocommand.buf_size,
-- PCI_DMA_BIDIRECTIONAL);
--
-- check_ioctl_unit_attention(host, c);
--
-- /* Copy the error information out */
-- iocommand.error_info = *(c->err_info);
-- if (copy_to_user
-- (argp, &iocommand, sizeof(IOCTL_Command_struct))) {
-- kfree(buff);
-- cmd_free(host, c, 0);
-- return -EFAULT;
-- }
--
-- if (iocommand.Request.Type.Direction == XFER_READ) {
-- /* Copy the data out of the buffer we created */
-- if (copy_to_user
-- (iocommand.buf, buff, iocommand.buf_size)) {
-- kfree(buff);
-- cmd_free(host, c, 0);
-- return -EFAULT;
-- }
-- }
-- kfree(buff);
-- cmd_free(host, c, 0);
-- return 0;
-- }
-- case CCISS_BIG_PASSTHRU:{
-- BIG_IOCTL_Command_struct *ioc;
-- CommandList_struct *c;
-- unsigned char **buff = NULL;
-- int *buff_size = NULL;
-- u64bit temp64;
-- unsigned long flags;
-- BYTE sg_used = 0;
-- int status = 0;
-- int i;
-- DECLARE_COMPLETION_ONSTACK(wait);
-- __u32 left;
-- __u32 sz;
-- BYTE __user *data_ptr;
--
-- if (!arg)
-- return -EINVAL;
-- if (!capable(CAP_SYS_RAWIO))
-- return -EPERM;
-- ioc = (BIG_IOCTL_Command_struct *)
-- kmalloc(sizeof(*ioc), GFP_KERNEL);
-- if (!ioc) {
-- status = -ENOMEM;
-- goto cleanup1;
-- }
-- if (copy_from_user(ioc, argp, sizeof(*ioc))) {
-- status = -EFAULT;
-- goto cleanup1;
-- }
-- if ((ioc->buf_size < 1) &&
-- (ioc->Request.Type.Direction != XFER_NONE)) {
-- status = -EINVAL;
-- goto cleanup1;
-- }
-- /* Check kmalloc limits using all SGs */
-- if (ioc->malloc_size > MAX_KMALLOC_SIZE) {
-- status = -EINVAL;
-- goto cleanup1;
-- }
-- if (ioc->buf_size > ioc->malloc_size * MAXSGENTRIES) {
-- status = -EINVAL;
-- goto cleanup1;
-- }
-- buff =
-- kzalloc(MAXSGENTRIES * sizeof(char *), GFP_KERNEL);
-- if (!buff) {
-- status = -ENOMEM;
-- goto cleanup1;
-- }
-- buff_size = kmalloc(MAXSGENTRIES * sizeof(int),
-- GFP_KERNEL);
-- if (!buff_size) {
-- status = -ENOMEM;
-- goto cleanup1;
-- }
-- left = ioc->buf_size;
-- data_ptr = ioc->buf;
-- while (left) {
-- sz = (left >
-- ioc->malloc_size) ? ioc->
-- malloc_size : left;
-- buff_size[sg_used] = sz;
-- buff[sg_used] = kmalloc(sz, GFP_KERNEL);
-- if (buff[sg_used] == NULL) {
-- status = -ENOMEM;
-- goto cleanup1;
-- }
-- if (ioc->Request.Type.Direction == XFER_WRITE) {
-- if (copy_from_user
-- (buff[sg_used], data_ptr, sz)) {
-- status = -EFAULT;
-- goto cleanup1;
-- }
-- } else {
-- memset(buff[sg_used], 0, sz);
-- }
-- left -= sz;
-- data_ptr += sz;
-- sg_used++;
-- }
-- if ((c = cmd_alloc(host, 0)) == NULL) {
-- status = -ENOMEM;
-- goto cleanup1;
-- }
-- c->cmd_type = CMD_IOCTL_PEND;
-- c->Header.ReplyQueue = 0;
--
-- if (ioc->buf_size > 0) {
-- c->Header.SGList = sg_used;
-- c->Header.SGTotal = sg_used;
-- } else {
-- c->Header.SGList = 0;
-- c->Header.SGTotal = 0;
-- }
-- c->Header.LUN = ioc->LUN_info;
-- c->Header.Tag.lower = c->busaddr;
--
-- c->Request = ioc->Request;
-- if (ioc->buf_size > 0) {
-- int i;
-- for (i = 0; i < sg_used; i++) {
-- temp64.val =
-- pci_map_single(host->pdev, buff[i],
-- buff_size[i],
-- PCI_DMA_BIDIRECTIONAL);
-- c->SG[i].Addr.lower =
-- temp64.val32.lower;
-- c->SG[i].Addr.upper =
-- temp64.val32.upper;
-- c->SG[i].Len = buff_size[i];
-- c->SG[i].Ext = 0; /* we are not chaining */
-- }
-- }
-- c->waiting = &wait;
-- /* Put the request on the tail of the request queue */
-- spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
-- addQ(&host->reqQ, c);
-- host->Qdepth++;
-- start_io(host);
-- spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
-- wait_for_completion(&wait);
-- /* unlock the buffers from DMA */
-- for (i = 0; i < sg_used; i++) {
-- temp64.val32.lower = c->SG[i].Addr.lower;
-- temp64.val32.upper = c->SG[i].Addr.upper;
-- pci_unmap_single(host->pdev,
-- (dma_addr_t) temp64.val, buff_size[i],
-- PCI_DMA_BIDIRECTIONAL);
-- }
-- check_ioctl_unit_attention(host, c);
-- /* Copy the error information out */
-- ioc->error_info = *(c->err_info);
-- if (copy_to_user(argp, ioc, sizeof(*ioc))) {
-- cmd_free(host, c, 0);
-- status = -EFAULT;
-- goto cleanup1;
-- }
-- if (ioc->Request.Type.Direction == XFER_READ) {
-- /* Copy the data out of the buffer we created */
-- BYTE __user *ptr = ioc->buf;
-- for (i = 0; i < sg_used; i++) {
-- if (copy_to_user
-- (ptr, buff[i], buff_size[i])) {
-- cmd_free(host, c, 0);
-- status = -EFAULT;
-- goto cleanup1;
-- }
-- ptr += buff_size[i];
-- }
-- }
-- cmd_free(host, c, 0);
-- status = 0;
-- cleanup1:
-- if (buff) {
-- for (i = 0; i < sg_used; i++)
-- kfree(buff[i]);
-- kfree(buff);
-- }
-- kfree(buff_size);
-- kfree(ioc);
-- return status;
-- }
-+ return cciss_passthru(h, argp);
-+ case CCISS_BIG_PASSTHRU:
-+ return cciss_bigpassthru(h, argp);
-
- /* scsi_cmd_blk_ioctl handles these, below, though some are not */
- /* very meaningful for cciss. SG_IO is the main one people want. */
-@@ -1658,37 +1854,45 @@ static void cciss_check_queues(ctlr_info_t *h)
-
- static void cciss_softirq_done(struct request *rq)
- {
-- CommandList_struct *cmd = rq->completion_data;
-- ctlr_info_t *h = hba[cmd->ctlr];
-- unsigned long flags;
-+ CommandList_struct *c = rq->completion_data;
-+ ctlr_info_t *h = hba[c->ctlr];
-+ SGDescriptor_struct *curr_sg = c->SG;
- u64bit temp64;
-+ unsigned long flags;
- int i, ddir;
-+ int sg_index = 0;
-
-- if (cmd->Request.Type.Direction == XFER_READ)
-+ if (c->Request.Type.Direction == XFER_READ)
- ddir = PCI_DMA_FROMDEVICE;
- else
- ddir = PCI_DMA_TODEVICE;
-
- /* command did not need to be retried */
- /* unmap the DMA mapping for all the scatter gather elements */
-- for (i = 0; i < cmd->Header.SGList; i++) {
-- temp64.val32.lower = cmd->SG[i].Addr.lower;
-- temp64.val32.upper = cmd->SG[i].Addr.upper;
-- pci_unmap_page(h->pdev, temp64.val, cmd->SG[i].Len, ddir);
-+ for (i = 0; i < c->Header.SGList; i++) {
-+ if (curr_sg[sg_index].Ext == CCISS_SG_CHAIN) {
-+ cciss_unmap_sg_chain_block(h, c);
-+ /* Point to the next block */
-+ curr_sg = h->cmd_sg_list[c->cmdindex];
-+ sg_index = 0;
-+ }
-+ temp64.val32.lower = curr_sg[sg_index].Addr.lower;
-+ temp64.val32.upper = curr_sg[sg_index].Addr.upper;
-+ pci_unmap_page(h->pdev, temp64.val, curr_sg[sg_index].Len,
-+ ddir);
-+ ++sg_index;
- }
-
--#ifdef CCISS_DEBUG
-- printk("Done with %p\n", rq);
--#endif /* CCISS_DEBUG */
-+ dev_dbg(&h->pdev->dev, "Done with %p\n", rq);
-
- /* set the residual count for pc requests */
-- if (blk_pc_request(rq))
-- rq->resid_len = cmd->err_info->ResidualCnt;
-+ if (rq->cmd_type == REQ_TYPE_BLOCK_PC)
-+ rq->resid_len = c->err_info->ResidualCnt;
-
- blk_end_request_all(rq, (rq->errors == 0) ? 0 : -EIO);
-
- spin_lock_irqsave(&h->lock, flags);
-- cmd_free(h, cmd, 1);
-+ cmd_free(h, c);
- cciss_check_queues(h);
- spin_unlock_irqrestore(&h->lock, flags);
- }
-@@ -1704,7 +1908,7 @@ static inline void log_unit_to_scsi3addr(ctlr_info_t *h,
- * via the inquiry page 0. Model, vendor, and rev are set to empty strings if
- * they cannot be read.
- */
--static void cciss_get_device_descr(int ctlr, int logvol, int withirq,
-+static void cciss_get_device_descr(ctlr_info_t *h, int logvol,
- char *vendor, char *model, char *rev)
- {
- int rc;
-@@ -1719,15 +1923,9 @@ static void cciss_get_device_descr(int ctlr, int logvol, int withirq,
- if (!inq_buf)
- return;
-
-- log_unit_to_scsi3addr(hba[ctlr], scsi3addr, logvol);
-- if (withirq)
-- rc = sendcmd_withirq(CISS_INQUIRY, ctlr, inq_buf,
-- sizeof(InquiryData_struct), 0,
-- scsi3addr, TYPE_CMD);
-- else
-- rc = sendcmd(CISS_INQUIRY, ctlr, inq_buf,
-- sizeof(InquiryData_struct), 0,
-- scsi3addr, TYPE_CMD);
-+ log_unit_to_scsi3addr(h, scsi3addr, logvol);
-+ rc = sendcmd_withirq(h, CISS_INQUIRY, inq_buf, sizeof(*inq_buf), 0,
-+ scsi3addr, TYPE_CMD);
- if (rc == IO_OK) {
- memcpy(vendor, &inq_buf->data_byte[8], VENDOR_LEN);
- vendor[VENDOR_LEN] = '\0';
-@@ -1746,8 +1944,8 @@ static void cciss_get_device_descr(int ctlr, int logvol, int withirq,
- * number cannot be had, for whatever reason, 16 bytes of 0xff
- * are returned instead.
- */
--static void cciss_get_serial_no(int ctlr, int logvol, int withirq,
-- unsigned char *serial_no, int buflen)
-+static void cciss_get_uid(ctlr_info_t *h, int logvol,
-+ unsigned char *uid, int buflen)
- {
- #define PAGE_83_INQ_BYTES 64
- int rc;
-@@ -1756,20 +1954,16 @@ static void cciss_get_serial_no(int ctlr, int logvol, int withirq,
-
- if (buflen > 16)
- buflen = 16;
-- memset(serial_no, 0xff, buflen);
-+ memset(uid, 0xff, buflen);
- buf = kzalloc(PAGE_83_INQ_BYTES, GFP_KERNEL);
- if (!buf)
- return;
-- memset(serial_no, 0, buflen);
-- log_unit_to_scsi3addr(hba[ctlr], scsi3addr, logvol);
-- if (withirq)
-- rc = sendcmd_withirq(CISS_INQUIRY, ctlr, buf,
-- PAGE_83_INQ_BYTES, 0x83, scsi3addr, TYPE_CMD);
-- else
-- rc = sendcmd(CISS_INQUIRY, ctlr, buf,
-- PAGE_83_INQ_BYTES, 0x83, scsi3addr, TYPE_CMD);
-+ memset(uid, 0, buflen);
-+ log_unit_to_scsi3addr(h, scsi3addr, logvol);
-+ rc = sendcmd_withirq(h, CISS_INQUIRY, buf,
-+ PAGE_83_INQ_BYTES, 0x83, scsi3addr, TYPE_CMD);
- if (rc == IO_OK)
-- memcpy(serial_no, &buf[8], buflen);
-+ memcpy(uid, &buf[8], buflen);
- kfree(buf);
- return;
- }
-@@ -1796,12 +1990,9 @@ static int cciss_add_disk(ctlr_info_t *h, struct gendisk *disk,
- blk_queue_bounce_limit(disk->queue, h->pdev->dma_mask);
-
- /* This is a hardware imposed limit. */
-- blk_queue_max_hw_segments(disk->queue, MAXSGENTRIES);
-+ blk_queue_max_segments(disk->queue, h->maxsgentries);
-
-- /* This is a limit in the driver and could be eliminated. */
-- blk_queue_max_phys_segments(disk->queue, MAXSGENTRIES);
--
-- blk_queue_max_sectors(disk->queue, h->cciss_max_sectors);
-+ blk_queue_max_hw_sectors(disk->queue, h->cciss_max_sectors);
-
- blk_queue_softirq_done(disk->queue, cciss_softirq_done);
-
-@@ -1835,10 +2026,9 @@ init_queue_failure:
- * is also the controller node. Any changes to disk 0 will show up on
- * the next reboot.
- */
--static void cciss_update_drive_info(int ctlr, int drv_index, int first_time,
-- int via_ioctl)
-+static void cciss_update_drive_info(ctlr_info_t *h, int drv_index,
-+ int first_time, int via_ioctl)
- {
-- ctlr_info_t *h = hba[ctlr];
- struct gendisk *disk;
- InquiryData_struct *inq_buff = NULL;
- unsigned int block_size;
-@@ -1855,18 +2045,16 @@ static void cciss_update_drive_info(int ctlr, int drv_index, int first_time,
-
- /* testing to see if 16-byte CDBs are already being used */
- if (h->cciss_read == CCISS_READ_16) {
-- cciss_read_capacity_16(h->ctlr, drv_index, 1,
-+ cciss_read_capacity_16(h, drv_index,
- &total_size, &block_size);
-
- } else {
-- cciss_read_capacity(ctlr, drv_index, 1,
-- &total_size, &block_size);
--
-+ cciss_read_capacity(h, drv_index, &total_size, &block_size);
- /* if read_capacity returns all F's this volume is >2TB */
- /* in size so we switch to 16-byte CDB's for all */
- /* read/write ops */
- if (total_size == 0xFFFFFFFFULL) {
-- cciss_read_capacity_16(ctlr, drv_index, 1,
-+ cciss_read_capacity_16(h, drv_index,
- &total_size, &block_size);
- h->cciss_read = CCISS_READ_16;
- h->cciss_write = CCISS_WRITE_16;
-@@ -1876,23 +2064,22 @@ static void cciss_update_drive_info(int ctlr, int drv_index, int first_time,
- }
- }
-
-- cciss_geometry_inquiry(ctlr, drv_index, 1, total_size, block_size,
-+ cciss_geometry_inquiry(h, drv_index, total_size, block_size,
- inq_buff, drvinfo);
- drvinfo->block_size = block_size;
- drvinfo->nr_blocks = total_size + 1;
-
-- cciss_get_device_descr(ctlr, drv_index, 1, drvinfo->vendor,
-+ cciss_get_device_descr(h, drv_index, drvinfo->vendor,
- drvinfo->model, drvinfo->rev);
-- cciss_get_serial_no(ctlr, drv_index, 1, drvinfo->serial_no,
-- sizeof(drvinfo->serial_no));
-+ cciss_get_uid(h, drv_index, drvinfo->uid, sizeof(drvinfo->uid));
- /* Save the lunid in case we deregister the disk, below. */
- memcpy(drvinfo->LunID, h->drv[drv_index]->LunID,
- sizeof(drvinfo->LunID));
-
- /* Is it the same disk we already know, and nothing's changed? */
- if (h->drv[drv_index]->raid_level != -1 &&
-- ((memcmp(drvinfo->serial_no,
-- h->drv[drv_index]->serial_no, 16) == 0) &&
-+ ((memcmp(drvinfo->uid,
-+ h->drv[drv_index]->uid, 16) == 0) &&
- drvinfo->block_size == h->drv[drv_index]->block_size &&
- drvinfo->nr_blocks == h->drv[drv_index]->nr_blocks &&
- drvinfo->heads == h->drv[drv_index]->heads &&
-@@ -1908,10 +2095,10 @@ static void cciss_update_drive_info(int ctlr, int drv_index, int first_time,
- * (unless it's the first disk (for the controller node).
- */
- if (h->drv[drv_index]->raid_level != -1 && drv_index != 0) {
-- printk(KERN_WARNING "disk %d has changed.\n", drv_index);
-- spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
-+ dev_warn(&h->pdev->dev, "disk %d has changed.\n", drv_index);
-+ spin_lock_irqsave(&h->lock, flags);
- h->drv[drv_index]->busy_configuring = 1;
-- spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
-+ spin_unlock_irqrestore(&h->lock, flags);
-
- /* deregister_disk sets h->drv[drv_index]->queue = NULL
- * which keeps the interrupt handler from starting
-@@ -1940,7 +2127,7 @@ static void cciss_update_drive_info(int ctlr, int drv_index, int first_time,
- h->drv[drv_index]->sectors = drvinfo->sectors;
- h->drv[drv_index]->cylinders = drvinfo->cylinders;
- h->drv[drv_index]->raid_level = drvinfo->raid_level;
-- memcpy(h->drv[drv_index]->serial_no, drvinfo->serial_no, 16);
-+ memcpy(h->drv[drv_index]->uid, drvinfo->uid, 16);
- memcpy(h->drv[drv_index]->vendor, drvinfo->vendor,
- VENDOR_LEN + 1);
- memcpy(h->drv[drv_index]->model, drvinfo->model, MODEL_LEN + 1);
-@@ -1950,6 +2137,7 @@ static void cciss_update_drive_info(int ctlr, int drv_index, int first_time,
- ++h->num_luns;
- disk = h->gendisk[drv_index];
- set_capacity(disk, h->drv[drv_index]->nr_blocks);
-+ cciss_sysfs_stat_inquiry(h, drv_index, h->drv[drv_index]);
-
- /* If it's not disk 0 (drv_index != 0)
- * or if it was disk 0, but there was previously
-@@ -1961,8 +2149,8 @@ static void cciss_update_drive_info(int ctlr, int drv_index, int first_time,
- if (cciss_add_disk(h, disk, drv_index) != 0) {
- cciss_free_gendisk(h, drv_index);
- cciss_free_drive_info(h, drv_index);
-- printk(KERN_WARNING "cciss:%d could not update "
-- "disk %d\n", h->ctlr, drv_index);
-+ dev_warn(&h->pdev->dev, "could not update disk %d\n",
-+ drv_index);
- --h->num_luns;
- }
- }
-@@ -1972,7 +2160,7 @@ freeret:
- kfree(drvinfo);
- return;
- mem_msg:
-- printk(KERN_ERR "cciss: out of memory\n");
-+ dev_err(&h->pdev->dev, "out of memory\n");
- goto freeret;
- }
-
-@@ -2051,7 +2239,7 @@ static void cciss_free_gendisk(ctlr_info_t *h, int drv_index)
- * drives have yet been configured.
- */
- static int cciss_add_gendisk(ctlr_info_t *h, unsigned char lunid[],
-- int controller_node)
-+ int controller_node)
- {
- int drv_index;
-
-@@ -2064,9 +2252,9 @@ static int cciss_add_gendisk(ctlr_info_t *h, unsigned char lunid[],
- h->gendisk[drv_index] =
- alloc_disk(1 << NWD_SHIFT);
- if (!h->gendisk[drv_index]) {
-- printk(KERN_ERR "cciss%d: could not "
-- "allocate a new disk %d\n",
-- h->ctlr, drv_index);
-+ dev_err(&h->pdev->dev,
-+ "could not allocate a new disk %d\n",
-+ drv_index);
- goto err_free_drive_info;
- }
- }
-@@ -2110,15 +2298,14 @@ static void cciss_add_controller_node(ctlr_info_t *h)
- h->drv[drv_index]->sectors = 0;
- h->drv[drv_index]->cylinders = 0;
- h->drv[drv_index]->raid_level = -1;
-- memset(h->drv[drv_index]->serial_no, 0, 16);
-+ memset(h->drv[drv_index]->uid, 0, 16);
- disk = h->gendisk[drv_index];
- if (cciss_add_disk(h, disk, drv_index) == 0)
- return;
- cciss_free_gendisk(h, drv_index);
- cciss_free_drive_info(h, drv_index);
- error:
-- printk(KERN_WARNING "cciss%d: could not "
-- "add disk 0.\n", h->ctlr);
-+ dev_warn(&h->pdev->dev, "could not add disk 0.\n");
- return;
- }
-
-@@ -2133,7 +2320,6 @@ error:
- static int rebuild_lun_table(ctlr_info_t *h, int first_time,
- int via_ioctl)
- {
-- int ctlr = h->ctlr;
- int num_luns;
- ReportLunData_struct *ld_buff = NULL;
- int return_code;
-@@ -2148,27 +2334,27 @@ static int rebuild_lun_table(ctlr_info_t *h, int first_time,
- return -EPERM;
-
- /* Set busy_configuring flag for this operation */
-- spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
-+ spin_lock_irqsave(&h->lock, flags);
- if (h->busy_configuring) {
-- spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
-+ spin_unlock_irqrestore(&h->lock, flags);
- return -EBUSY;
- }
- h->busy_configuring = 1;
-- spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
-+ spin_unlock_irqrestore(&h->lock, flags);
-
- ld_buff = kzalloc(sizeof(ReportLunData_struct), GFP_KERNEL);
- if (ld_buff == NULL)
- goto mem_msg;
-
-- return_code = sendcmd_withirq(CISS_REPORT_LOG, ctlr, ld_buff,
-+ return_code = sendcmd_withirq(h, CISS_REPORT_LOG, ld_buff,
- sizeof(ReportLunData_struct),
- 0, CTLR_LUNID, TYPE_CMD);
-
- if (return_code == IO_OK)
- listlength = be32_to_cpu(*(__be32 *) ld_buff->LUNListLength);
- else { /* reading number of logical volumes failed */
-- printk(KERN_WARNING "cciss: report logical volume"
-- " command failed\n");
-+ dev_warn(&h->pdev->dev,
-+ "report logical volume command failed\n");
- listlength = 0;
- goto freeret;
- }
-@@ -2176,7 +2362,7 @@ static int rebuild_lun_table(ctlr_info_t *h, int first_time,
- num_luns = listlength / 8; /* 8 bytes per entry */
- if (num_luns > CISS_MAX_LUN) {
- num_luns = CISS_MAX_LUN;
-- printk(KERN_WARNING "cciss: more luns configured"
-+ dev_warn(&h->pdev->dev, "more luns configured"
- " on controller than can be handled by"
- " this driver.\n");
- }
-@@ -2200,16 +2386,16 @@ static int rebuild_lun_table(ctlr_info_t *h, int first_time,
- for (j = 0; j < num_luns; j++) {
- memcpy(lunid, &ld_buff->LUN[j][0], sizeof(lunid));
- if (memcmp(h->drv[i]->LunID, lunid,
-- sizeof(lunid)) == 0) {
-+ sizeof(lunid)) == 0) {
- drv_found = 1;
- break;
- }
- }
- if (!drv_found) {
- /* Deregister it from the OS, it's gone. */
-- spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
-+ spin_lock_irqsave(&h->lock, flags);
- h->drv[i]->busy_configuring = 1;
-- spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
-+ spin_unlock_irqrestore(&h->lock, flags);
- return_code = deregister_disk(h, i, 1, via_ioctl);
- if (h->drv[i] != NULL)
- h->drv[i]->busy_configuring = 0;
-@@ -2248,8 +2434,7 @@ static int rebuild_lun_table(ctlr_info_t *h, int first_time,
- if (drv_index == -1)
- goto freeret;
- }
-- cciss_update_drive_info(ctlr, drv_index, first_time,
-- via_ioctl);
-+ cciss_update_drive_info(h, drv_index, first_time, via_ioctl);
- } /* end for */
-
- freeret:
-@@ -2261,7 +2446,7 @@ freeret:
- */
- return -1;
- mem_msg:
-- printk(KERN_ERR "cciss: out of memory\n");
-+ dev_err(&h->pdev->dev, "out of memory\n");
- h->busy_configuring = 0;
- goto freeret;
- }
-@@ -2275,7 +2460,7 @@ static void cciss_clear_drive_info(drive_info_struct *drive_info)
- drive_info->sectors = 0;
- drive_info->cylinders = 0;
- drive_info->raid_level = -1;
-- memset(drive_info->serial_no, 0, sizeof(drive_info->serial_no));
-+ memset(drive_info->uid, 0, sizeof(drive_info->uid));
- memset(drive_info->model, 0, sizeof(drive_info->model));
- memset(drive_info->rev, 0, sizeof(drive_info->rev));
- memset(drive_info->vendor, 0, sizeof(drive_info->vendor));
-@@ -2381,11 +2566,10 @@ static int deregister_disk(ctlr_info_t *h, int drv_index,
- return 0;
- }
-
--static int fill_cmd(CommandList_struct *c, __u8 cmd, int ctlr, void *buff,
-+static int fill_cmd(ctlr_info_t *h, CommandList_struct *c, __u8 cmd, void *buff,
- size_t size, __u8 page_code, unsigned char *scsi3addr,
- int cmd_type)
- {
-- ctlr_info_t *h = hba[ctlr];
- u64bit buff_dma_handle;
- int status = IO_OK;
-
-@@ -2427,7 +2611,7 @@ static int fill_cmd(CommandList_struct *c, __u8 cmd, int ctlr, void *buff,
- c->Request.Type.Direction = XFER_READ;
- c->Request.Timeout = 0;
- c->Request.CDB[0] = cmd;
-- c->Request.CDB[6] = (size >> 24) & 0xFF; //MSB
-+ c->Request.CDB[6] = (size >> 24) & 0xFF; /* MSB */
- c->Request.CDB[7] = (size >> 16) & 0xFF;
- c->Request.CDB[8] = (size >> 8) & 0xFF;
- c->Request.CDB[9] = size & 0xFF;
-@@ -2461,6 +2645,8 @@ static int fill_cmd(CommandList_struct *c, __u8 cmd, int ctlr, void *buff,
- c->Request.Timeout = 0;
- c->Request.CDB[0] = BMIC_WRITE;
- c->Request.CDB[6] = BMIC_CACHE_FLUSH;
-+ c->Request.CDB[7] = (size >> 8) & 0xFF;
-+ c->Request.CDB[8] = size & 0xFF;
- break;
- case TEST_UNIT_READY:
- c->Request.CDBLen = 6;
-@@ -2469,13 +2655,12 @@ static int fill_cmd(CommandList_struct *c, __u8 cmd, int ctlr, void *buff,
- c->Request.Timeout = 0;
- break;
- default:
-- printk(KERN_WARNING
-- "cciss%d: Unknown Command 0x%c\n", ctlr, cmd);
-+ dev_warn(&h->pdev->dev, "Unknown Command 0x%c\n", cmd);
- return IO_ERROR;
- }
- } else if (cmd_type == TYPE_MSG) {
- switch (cmd) {
-- case 0: /* ABORT message */
-+ case CCISS_ABORT_MSG:
- c->Request.CDBLen = 12;
- c->Request.Type.Attribute = ATTR_SIMPLE;
- c->Request.Type.Direction = XFER_WRITE;
-@@ -2485,16 +2670,16 @@ static int fill_cmd(CommandList_struct *c, __u8 cmd, int ctlr, void *buff,
- /* buff contains the tag of the command to abort */
- memcpy(&c->Request.CDB[4], buff, 8);
- break;
-- case 1: /* RESET message */
-+ case CCISS_RESET_MSG:
- c->Request.CDBLen = 16;
- c->Request.Type.Attribute = ATTR_SIMPLE;
- c->Request.Type.Direction = XFER_NONE;
- c->Request.Timeout = 0;
- memset(&c->Request.CDB[0], 0, sizeof(c->Request.CDB));
- c->Request.CDB[0] = cmd; /* reset */
-- c->Request.CDB[1] = 0x03; /* reset a target */
-+ c->Request.CDB[1] = CCISS_RESET_TYPE_TARGET;
- break;
-- case 3: /* No-Op message */
-+ case CCISS_NOOP_MSG:
- c->Request.CDBLen = 1;
- c->Request.Type.Attribute = ATTR_SIMPLE;
- c->Request.Type.Direction = XFER_WRITE;
-@@ -2502,13 +2687,12 @@ static int fill_cmd(CommandList_struct *c, __u8 cmd, int ctlr, void *buff,
- c->Request.CDB[0] = cmd;
- break;
- default:
-- printk(KERN_WARNING
-- "cciss%d: unknown message type %d\n", ctlr, cmd);
-+ dev_warn(&h->pdev->dev,
-+ "unknown message type %d\n", cmd);
- return IO_ERROR;
- }
- } else {
-- printk(KERN_WARNING
-- "cciss%d: unknown command type %d\n", ctlr, cmd_type);
-+ dev_warn(&h->pdev->dev, "unknown command type %d\n", cmd_type);
- return IO_ERROR;
- }
- /* Fill in the scatter gather information */
-@@ -2524,6 +2708,31 @@ static int fill_cmd(CommandList_struct *c, __u8 cmd, int ctlr, void *buff,
- return status;
- }
-
-+static int __devinit cciss_send_reset(ctlr_info_t *h, unsigned char *scsi3addr,
-+ u8 reset_type)
-+{
-+ CommandList_struct *c;
-+ int return_status;
-+
-+ c = cmd_alloc(h);
-+ if (!c)
-+ return -ENOMEM;
-+ return_status = fill_cmd(h, c, CCISS_RESET_MSG, NULL, 0, 0,
-+ CTLR_LUNID, TYPE_MSG);
-+ c->Request.CDB[1] = reset_type; /* fill_cmd defaults to target reset */
-+ if (return_status != IO_OK) {
-+ cmd_special_free(h, c);
-+ return return_status;
-+ }
-+ c->waiting = NULL;
-+ enqueue_cmd_and_start_io(h, c);
-+ /* Don't wait for completion, the reset won't complete. Don't free
-+ * the command either. This is the last command we will send before
-+ * re-initializing everything, so it doesn't matter and won't leak.
-+ */
-+ return 0;
-+}
-+
- static int check_target_status(ctlr_info_t *h, CommandList_struct *c)
- {
- switch (c->err_info->ScsiStatus) {
-@@ -2534,15 +2743,16 @@ static int check_target_status(ctlr_info_t *h, CommandList_struct *c)
- case 0: return IO_OK; /* no sense */
- case 1: return IO_OK; /* recovered error */
- default:
-- printk(KERN_WARNING "cciss%d: cmd 0x%02x "
-+ if (check_for_unit_attention(h, c))
-+ return IO_NEEDS_RETRY;
-+ dev_warn(&h->pdev->dev, "cmd 0x%02x "
- "check condition, sense key = 0x%02x\n",
-- h->ctlr, c->Request.CDB[0],
-- c->err_info->SenseInfo[2]);
-+ c->Request.CDB[0], c->err_info->SenseInfo[2]);
- }
- break;
- default:
-- printk(KERN_WARNING "cciss%d: cmd 0x%02x"
-- "scsi status = 0x%02x\n", h->ctlr,
-+ dev_warn(&h->pdev->dev, "cmd 0x%02x"
-+ "scsi status = 0x%02x\n",
- c->Request.CDB[0], c->err_info->ScsiStatus);
- break;
- }
-@@ -2565,43 +2775,46 @@ static int process_sendcmd_error(ctlr_info_t *h, CommandList_struct *c)
- /* expected for inquiry and report lun commands */
- break;
- case CMD_INVALID:
-- printk(KERN_WARNING "cciss: cmd 0x%02x is "
-+ dev_warn(&h->pdev->dev, "cmd 0x%02x is "
- "reported invalid\n", c->Request.CDB[0]);
- return_status = IO_ERROR;
- break;
- case CMD_PROTOCOL_ERR:
-- printk(KERN_WARNING "cciss: cmd 0x%02x has "
-- "protocol error \n", c->Request.CDB[0]);
-+ dev_warn(&h->pdev->dev, "cmd 0x%02x has "
-+ "protocol error\n", c->Request.CDB[0]);
- return_status = IO_ERROR;
- break;
- case CMD_HARDWARE_ERR:
-- printk(KERN_WARNING "cciss: cmd 0x%02x had "
-+ dev_warn(&h->pdev->dev, "cmd 0x%02x had "
- " hardware error\n", c->Request.CDB[0]);
- return_status = IO_ERROR;
- break;
- case CMD_CONNECTION_LOST:
-- printk(KERN_WARNING "cciss: cmd 0x%02x had "
-+ dev_warn(&h->pdev->dev, "cmd 0x%02x had "
- "connection lost\n", c->Request.CDB[0]);
- return_status = IO_ERROR;
- break;
- case CMD_ABORTED:
-- printk(KERN_WARNING "cciss: cmd 0x%02x was "
-+ dev_warn(&h->pdev->dev, "cmd 0x%02x was "
- "aborted\n", c->Request.CDB[0]);
- return_status = IO_ERROR;
- break;
- case CMD_ABORT_FAILED:
-- printk(KERN_WARNING "cciss: cmd 0x%02x reports "
-+ dev_warn(&h->pdev->dev, "cmd 0x%02x reports "
- "abort failed\n", c->Request.CDB[0]);
- return_status = IO_ERROR;
- break;
- case CMD_UNSOLICITED_ABORT:
-- printk(KERN_WARNING
-- "cciss%d: unsolicited abort 0x%02x\n", h->ctlr,
-+ dev_warn(&h->pdev->dev, "unsolicited abort 0x%02x\n",
- c->Request.CDB[0]);
- return_status = IO_NEEDS_RETRY;
- break;
-+ case CMD_UNABORTABLE:
-+ dev_warn(&h->pdev->dev, "cmd unabortable\n");
-+ return_status = IO_ERROR;
-+ break;
- default:
-- printk(KERN_WARNING "cciss: cmd 0x%02x returned "
-+ dev_warn(&h->pdev->dev, "cmd 0x%02x returned "
- "unknown status %x\n", c->Request.CDB[0],
- c->err_info->CommandStatus);
- return_status = IO_ERROR;
-@@ -2614,17 +2827,11 @@ static int sendcmd_withirq_core(ctlr_info_t *h, CommandList_struct *c,
- {
- DECLARE_COMPLETION_ONSTACK(wait);
- u64bit buff_dma_handle;
-- unsigned long flags;
- int return_status = IO_OK;
-
- resend_cmd2:
- c->waiting = &wait;
-- /* Put the request on the tail of the queue and send it */
-- spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
-- addQ(&h->reqQ, c);
-- h->Qdepth++;
-- start_io(h);
-- spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
-+ enqueue_cmd_and_start_io(h, c);
-
- wait_for_completion(&wait);
-
-@@ -2635,7 +2842,7 @@ resend_cmd2:
-
- if (return_status == IO_NEEDS_RETRY &&
- c->retry_count < MAX_CMD_RETRIES) {
-- printk(KERN_WARNING "cciss%d: retrying 0x%02x\n", h->ctlr,
-+ dev_warn(&h->pdev->dev, "retrying 0x%02x\n",
- c->Request.CDB[0]);
- c->retry_count++;
- /* erase the old error information */
-@@ -2654,28 +2861,27 @@ command_done:
- return return_status;
- }
-
--static int sendcmd_withirq(__u8 cmd, int ctlr, void *buff, size_t size,
-+static int sendcmd_withirq(ctlr_info_t *h, __u8 cmd, void *buff, size_t size,
- __u8 page_code, unsigned char scsi3addr[],
- int cmd_type)
- {
-- ctlr_info_t *h = hba[ctlr];
- CommandList_struct *c;
- int return_status;
-
-- c = cmd_alloc(h, 0);
-+ c = cmd_special_alloc(h);
- if (!c)
- return -ENOMEM;
-- return_status = fill_cmd(c, cmd, ctlr, buff, size, page_code,
-+ return_status = fill_cmd(h, c, cmd, buff, size, page_code,
- scsi3addr, cmd_type);
- if (return_status == IO_OK)
- return_status = sendcmd_withirq_core(h, c, 1);
-
-- cmd_free(h, c, 0);
-+ cmd_special_free(h, c);
- return return_status;
- }
-
--static void cciss_geometry_inquiry(int ctlr, int logvol,
-- int withirq, sector_t total_size,
-+static void cciss_geometry_inquiry(ctlr_info_t *h, int logvol,
-+ sector_t total_size,
- unsigned int block_size,
- InquiryData_struct *inq_buff,
- drive_info_struct *drv)
-@@ -2685,22 +2891,16 @@ static void cciss_geometry_inquiry(int ctlr, int logvol,
- unsigned char scsi3addr[8];
-
- memset(inq_buff, 0, sizeof(InquiryData_struct));
-- log_unit_to_scsi3addr(hba[ctlr], scsi3addr, logvol);
-- if (withirq)
-- return_code = sendcmd_withirq(CISS_INQUIRY, ctlr,
-- inq_buff, sizeof(*inq_buff),
-- 0xC1, scsi3addr, TYPE_CMD);
-- else
-- return_code = sendcmd(CISS_INQUIRY, ctlr, inq_buff,
-- sizeof(*inq_buff), 0xC1, scsi3addr,
-- TYPE_CMD);
-+ log_unit_to_scsi3addr(h, scsi3addr, logvol);
-+ return_code = sendcmd_withirq(h, CISS_INQUIRY, inq_buff,
-+ sizeof(*inq_buff), 0xC1, scsi3addr, TYPE_CMD);
- if (return_code == IO_OK) {
- if (inq_buff->data_byte[8] == 0xFF) {
-- printk(KERN_WARNING
-- "cciss: reading geometry failed, volume "
-+ dev_warn(&h->pdev->dev,
-+ "reading geometry failed, volume "
- "does not support reading geometry\n");
- drv->heads = 255;
-- drv->sectors = 32; // Sectors per track
-+ drv->sectors = 32; /* Sectors per track */
- drv->cylinders = total_size + 1;
- drv->raid_level = RAID_UNKNOWN;
- } else {
-@@ -2721,12 +2921,12 @@ static void cciss_geometry_inquiry(int ctlr, int logvol,
- drv->cylinders = real_size;
- }
- } else { /* Get geometry failed */
-- printk(KERN_WARNING "cciss: reading geometry failed\n");
-+ dev_warn(&h->pdev->dev, "reading geometry failed\n");
- }
- }
-
- static void
--cciss_read_capacity(int ctlr, int logvol, int withirq, sector_t *total_size,
-+cciss_read_capacity(ctlr_info_t *h, int logvol, sector_t *total_size,
- unsigned int *block_size)
- {
- ReadCapdata_struct *buf;
-@@ -2735,32 +2935,26 @@ cciss_read_capacity(int ctlr, int logvol, int withirq, sector_t *total_size,
-
- buf = kzalloc(sizeof(ReadCapdata_struct), GFP_KERNEL);
- if (!buf) {
-- printk(KERN_WARNING "cciss: out of memory\n");
-+ dev_warn(&h->pdev->dev, "out of memory\n");
- return;
- }
-
-- log_unit_to_scsi3addr(hba[ctlr], scsi3addr, logvol);
-- if (withirq)
-- return_code = sendcmd_withirq(CCISS_READ_CAPACITY,
-- ctlr, buf, sizeof(ReadCapdata_struct),
-- 0, scsi3addr, TYPE_CMD);
-- else
-- return_code = sendcmd(CCISS_READ_CAPACITY,
-- ctlr, buf, sizeof(ReadCapdata_struct),
-- 0, scsi3addr, TYPE_CMD);
-+ log_unit_to_scsi3addr(h, scsi3addr, logvol);
-+ return_code = sendcmd_withirq(h, CCISS_READ_CAPACITY, buf,
-+ sizeof(ReadCapdata_struct), 0, scsi3addr, TYPE_CMD);
- if (return_code == IO_OK) {
- *total_size = be32_to_cpu(*(__be32 *) buf->total_size);
- *block_size = be32_to_cpu(*(__be32 *) buf->block_size);
- } else { /* read capacity command failed */
-- printk(KERN_WARNING "cciss: read capacity failed\n");
-+ dev_warn(&h->pdev->dev, "read capacity failed\n");
- *total_size = 0;
- *block_size = BLOCK_SIZE;
- }
- kfree(buf);
- }
-
--static void
--cciss_read_capacity_16(int ctlr, int logvol, int withirq, sector_t *total_size, unsigned int *block_size)
-+static void cciss_read_capacity_16(ctlr_info_t *h, int logvol,
-+ sector_t *total_size, unsigned int *block_size)
- {
- ReadCapdata_struct_16 *buf;
- int return_code;
-@@ -2768,30 +2962,23 @@ cciss_read_capacity_16(int ctlr, int logvol, int withirq, sector_t *total_size,
-
- buf = kzalloc(sizeof(ReadCapdata_struct_16), GFP_KERNEL);
- if (!buf) {
-- printk(KERN_WARNING "cciss: out of memory\n");
-+ dev_warn(&h->pdev->dev, "out of memory\n");
- return;
- }
-
-- log_unit_to_scsi3addr(hba[ctlr], scsi3addr, logvol);
-- if (withirq) {
-- return_code = sendcmd_withirq(CCISS_READ_CAPACITY_16,
-- ctlr, buf, sizeof(ReadCapdata_struct_16),
-- 0, scsi3addr, TYPE_CMD);
-- }
-- else {
-- return_code = sendcmd(CCISS_READ_CAPACITY_16,
-- ctlr, buf, sizeof(ReadCapdata_struct_16),
-- 0, scsi3addr, TYPE_CMD);
-- }
-+ log_unit_to_scsi3addr(h, scsi3addr, logvol);
-+ return_code = sendcmd_withirq(h, CCISS_READ_CAPACITY_16,
-+ buf, sizeof(ReadCapdata_struct_16),
-+ 0, scsi3addr, TYPE_CMD);
- if (return_code == IO_OK) {
- *total_size = be64_to_cpu(*(__be64 *) buf->total_size);
- *block_size = be32_to_cpu(*(__be32 *) buf->block_size);
- } else { /* read capacity command failed */
-- printk(KERN_WARNING "cciss: read capacity failed\n");
-+ dev_warn(&h->pdev->dev, "read capacity failed\n");
- *total_size = 0;
- *block_size = BLOCK_SIZE;
- }
-- printk(KERN_INFO " blocks= %llu block_size= %d\n",
-+ dev_info(&h->pdev->dev, " blocks= %llu block_size= %d\n",
- (unsigned long long)*total_size+1, *block_size);
- kfree(buf);
- }
-@@ -2806,7 +2993,9 @@ static int cciss_revalidate(struct gendisk *disk)
- sector_t total_size;
- InquiryData_struct *inq_buff = NULL;
-
-- for (logvol = 0; logvol < CISS_MAX_LUN; logvol++) {
-+ for (logvol = 0; logvol <= h->highest_lun; logvol++) {
-+ if (!h->drv[logvol]) /* h->drv[] may contain holes */
-+ continue;
- if (memcmp(h->drv[logvol]->LunID, drv->LunID,
- sizeof(drv->LunID)) == 0) {
- FOUND = 1;
-@@ -2819,17 +3008,17 @@ static int cciss_revalidate(struct gendisk *disk)
-
- inq_buff = kmalloc(sizeof(InquiryData_struct), GFP_KERNEL);
- if (inq_buff == NULL) {
-- printk(KERN_WARNING "cciss: out of memory\n");
-+ dev_warn(&h->pdev->dev, "out of memory\n");
- return 1;
- }
- if (h->cciss_read == CCISS_READ_10) {
-- cciss_read_capacity(h->ctlr, logvol, 1,
-+ cciss_read_capacity(h, logvol,
- &total_size, &block_size);
- } else {
-- cciss_read_capacity_16(h->ctlr, logvol, 1,
-+ cciss_read_capacity_16(h, logvol,
- &total_size, &block_size);
- }
-- cciss_geometry_inquiry(h->ctlr, logvol, 1, total_size, block_size,
-+ cciss_geometry_inquiry(h, logvol, total_size, block_size,
- inq_buff, drv);
-
- blk_queue_logical_block_size(drv->queue, drv->block_size);
-@@ -2840,167 +3029,6 @@ static int cciss_revalidate(struct gendisk *disk)
- }
-
- /*
-- * Wait polling for a command to complete.
-- * The memory mapped FIFO is polled for the completion.
-- * Used only at init time, interrupts from the HBA are disabled.
-- */
--static unsigned long pollcomplete(int ctlr)
--{
-- unsigned long done;
-- int i;
--
-- /* Wait (up to 20 seconds) for a command to complete */
--
-- for (i = 20 * HZ; i > 0; i--) {
-- done = hba[ctlr]->access.command_completed(hba[ctlr]);
-- if (done == FIFO_EMPTY)
-- schedule_timeout_uninterruptible(1);
-- else
-- return done;
-- }
-- /* Invalid address to tell caller we ran out of time */
-- return 1;
--}
--
--/* Send command c to controller h and poll for it to complete.
-- * Turns interrupts off on the board. Used at driver init time
-- * and during SCSI error recovery.
-- */
--static int sendcmd_core(ctlr_info_t *h, CommandList_struct *c)
--{
-- int i;
-- unsigned long complete;
-- int status = IO_ERROR;
-- u64bit buff_dma_handle;
--
--resend_cmd1:
--
-- /* Disable interrupt on the board. */
-- h->access.set_intr_mask(h, CCISS_INTR_OFF);
--
-- /* Make sure there is room in the command FIFO */
-- /* Actually it should be completely empty at this time */
-- /* unless we are in here doing error handling for the scsi */
-- /* tape side of the driver. */
-- for (i = 200000; i > 0; i--) {
-- /* if fifo isn't full go */
-- if (!(h->access.fifo_full(h)))
-- break;
-- udelay(10);
-- printk(KERN_WARNING "cciss cciss%d: SendCmd FIFO full,"
-- " waiting!\n", h->ctlr);
-- }
-- h->access.submit_command(h, c); /* Send the cmd */
-- do {
-- complete = pollcomplete(h->ctlr);
--
--#ifdef CCISS_DEBUG
-- printk(KERN_DEBUG "cciss: command completed\n");
--#endif /* CCISS_DEBUG */
--
-- if (complete == 1) {
-- printk(KERN_WARNING
-- "cciss cciss%d: SendCmd Timeout out, "
-- "No command list address returned!\n", h->ctlr);
-- status = IO_ERROR;
-- break;
-- }
--
-- /* Make sure it's the command we're expecting. */
-- if ((complete & ~CISS_ERROR_BIT) != c->busaddr) {
-- printk(KERN_WARNING "cciss%d: Unexpected command "
-- "completion.\n", h->ctlr);
-- continue;
-- }
--
-- /* It is our command. If no error, we're done. */
-- if (!(complete & CISS_ERROR_BIT)) {
-- status = IO_OK;
-- break;
-- }
--
-- /* There is an error... */
--
-- /* if data overrun or underun on Report command ignore it */
-- if (((c->Request.CDB[0] == CISS_REPORT_LOG) ||
-- (c->Request.CDB[0] == CISS_REPORT_PHYS) ||
-- (c->Request.CDB[0] == CISS_INQUIRY)) &&
-- ((c->err_info->CommandStatus == CMD_DATA_OVERRUN) ||
-- (c->err_info->CommandStatus == CMD_DATA_UNDERRUN))) {
-- complete = c->busaddr;
-- status = IO_OK;
-- break;
-- }
--
-- if (c->err_info->CommandStatus == CMD_UNSOLICITED_ABORT) {
-- printk(KERN_WARNING "cciss%d: unsolicited abort %p\n",
-- h->ctlr, c);
-- if (c->retry_count < MAX_CMD_RETRIES) {
-- printk(KERN_WARNING "cciss%d: retrying %p\n",
-- h->ctlr, c);
-- c->retry_count++;
-- /* erase the old error information */
-- memset(c->err_info, 0, sizeof(c->err_info));
-- goto resend_cmd1;
-- }
-- printk(KERN_WARNING "cciss%d: retried %p too many "
-- "times\n", h->ctlr, c);
-- status = IO_ERROR;
-- break;
-- }
--
-- if (c->err_info->CommandStatus == CMD_UNABORTABLE) {
-- printk(KERN_WARNING "cciss%d: command could not be "
-- "aborted.\n", h->ctlr);
-- status = IO_ERROR;
-- break;
-- }
--
-- if (c->err_info->CommandStatus == CMD_TARGET_STATUS) {
-- status = check_target_status(h, c);
-- break;
-- }
--
-- printk(KERN_WARNING "cciss%d: sendcmd error\n", h->ctlr);
-- printk(KERN_WARNING "cmd = 0x%02x, CommandStatus = 0x%02x\n",
-- c->Request.CDB[0], c->err_info->CommandStatus);
-- status = IO_ERROR;
-- break;
--
-- } while (1);
--
-- /* unlock the data buffer from DMA */
-- buff_dma_handle.val32.lower = c->SG[0].Addr.lower;
-- buff_dma_handle.val32.upper = c->SG[0].Addr.upper;
-- pci_unmap_single(h->pdev, (dma_addr_t) buff_dma_handle.val,
-- c->SG[0].Len, PCI_DMA_BIDIRECTIONAL);
-- return status;
--}
--
--/*
-- * Send a command to the controller, and wait for it to complete.
-- * Used at init time, and during SCSI error recovery.
-- */
--static int sendcmd(__u8 cmd, int ctlr, void *buff, size_t size,
-- __u8 page_code, unsigned char *scsi3addr, int cmd_type)
--{
-- CommandList_struct *c;
-- int status;
--
-- c = cmd_alloc(hba[ctlr], 1);
-- if (!c) {
-- printk(KERN_WARNING "cciss: unable to get memory");
-- return IO_ERROR;
-- }
-- status = fill_cmd(c, cmd, ctlr, buff, size, page_code,
-- scsi3addr, cmd_type);
-- if (status == IO_OK)
-- status = sendcmd_core(hba[ctlr], c);
-- cmd_free(hba[ctlr], c, 1);
-- return status;
--}
--
--/*
- * Map (physical) PCI mem into (virtual) kernel space
- */
- static void __iomem *remap_pci_mem(ulong base, ulong size)
-@@ -3020,11 +3048,11 @@ static void start_io(ctlr_info_t *h)
- {
- CommandList_struct *c;
-
-- while (!hlist_empty(&h->reqQ)) {
-- c = hlist_entry(h->reqQ.first, CommandList_struct, list);
-+ while (!list_empty(&h->reqQ)) {
-+ c = list_entry(h->reqQ.next, CommandList_struct, list);
- /* can't do anything if fifo is full */
-- if ((h->access.fifo_full(h))) {
-- printk(KERN_WARNING "cciss: fifo full\n");
-+ if ((h->access->fifo_full(h))) {
-+ dev_warn(&h->pdev->dev, "fifo full\n");
- break;
- }
-
-@@ -3033,14 +3061,14 @@ static void start_io(ctlr_info_t *h)
- h->Qdepth--;
-
- /* Tell the controller execute command */
-- h->access.submit_command(h, c);
-+ h->access->submit_command(h, c);
-
- /* Put job onto the completed Q */
- addQ(&h->cmpQ, c);
- }
- }
-
--/* Assumes that CCISS_LOCK(h->ctlr) is held. */
-+/* Assumes that h->lock is held. */
- /* Zeros out the error record and then resends the command back */
- /* to the controller */
- static inline void resend_cciss_cmd(ctlr_info_t *h, CommandList_struct *c)
-@@ -3081,7 +3109,7 @@ static inline int evaluate_target_status(ctlr_info_t *h,
- driver_byte = DRIVER_OK;
- msg_byte = cmd->err_info->CommandStatus; /* correct? seems too device specific */
-
-- if (blk_pc_request(cmd->rq))
-+ if (cmd->rq->cmd_type == REQ_TYPE_BLOCK_PC)
- host_byte = DID_PASSTHROUGH;
- else
- host_byte = DID_OK;
-@@ -3090,8 +3118,8 @@ static inline int evaluate_target_status(ctlr_info_t *h,
- host_byte, driver_byte);
-
- if (cmd->err_info->ScsiStatus != SAM_STAT_CHECK_CONDITION) {
-- if (!blk_pc_request(cmd->rq))
-- printk(KERN_WARNING "cciss: cmd %p "
-+ if (cmd->rq->cmd_type != REQ_TYPE_BLOCK_PC)
-+ dev_warn(&h->pdev->dev, "cmd %p "
- "has SCSI Status 0x%x\n",
- cmd, cmd->err_info->ScsiStatus);
- return error_value;
-@@ -3100,17 +3128,18 @@ static inline int evaluate_target_status(ctlr_info_t *h,
- /* check the sense key */
- sense_key = 0xf & cmd->err_info->SenseInfo[2];
- /* no status or recovered error */
-- if (((sense_key == 0x0) || (sense_key == 0x1)) && !blk_pc_request(cmd->rq))
-+ if (((sense_key == 0x0) || (sense_key == 0x1)) &&
-+ (cmd->rq->cmd_type != REQ_TYPE_BLOCK_PC))
- error_value = 0;
-
- if (check_for_unit_attention(h, cmd)) {
-- *retry_cmd = !blk_pc_request(cmd->rq);
-+ *retry_cmd = (cmd->rq->cmd_type != REQ_TYPE_BLOCK_PC);
- return 0;
- }
-
-- if (!blk_pc_request(cmd->rq)) { /* Not SG_IO or similar? */
-+ if (cmd->rq->cmd_type != REQ_TYPE_BLOCK_PC) { /* Not SG_IO? */
- if (error_value != 0)
-- printk(KERN_WARNING "cciss: cmd %p has CHECK CONDITION"
-+ dev_warn(&h->pdev->dev, "cmd %p has CHECK CONDITION"
- " sense key = 0x%x\n", cmd, sense_key);
- return error_value;
- }
-@@ -3150,90 +3179,104 @@ static inline void complete_command(ctlr_info_t *h, CommandList_struct *cmd,
- rq->errors = evaluate_target_status(h, cmd, &retry_cmd);
- break;
- case CMD_DATA_UNDERRUN:
-- if (blk_fs_request(cmd->rq)) {
-- printk(KERN_WARNING "cciss: cmd %p has"
-+ if (cmd->rq->cmd_type == REQ_TYPE_FS) {
-+ dev_warn(&h->pdev->dev, "cmd %p has"
- " completed with data underrun "
- "reported\n", cmd);
- cmd->rq->resid_len = cmd->err_info->ResidualCnt;
- }
- break;
- case CMD_DATA_OVERRUN:
-- if (blk_fs_request(cmd->rq))
-- printk(KERN_WARNING "cciss: cmd %p has"
-+ if (cmd->rq->cmd_type == REQ_TYPE_FS)
-+ dev_warn(&h->pdev->dev, "cciss: cmd %p has"
- " completed with data overrun "
- "reported\n", cmd);
- break;
- case CMD_INVALID:
-- printk(KERN_WARNING "cciss: cmd %p is "
-+ dev_warn(&h->pdev->dev, "cciss: cmd %p is "
- "reported invalid\n", cmd);
- rq->errors = make_status_bytes(SAM_STAT_GOOD,
- cmd->err_info->CommandStatus, DRIVER_OK,
-- blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ERROR);
-+ (cmd->rq->cmd_type == REQ_TYPE_BLOCK_PC) ?
-+ DID_PASSTHROUGH : DID_ERROR);
- break;
- case CMD_PROTOCOL_ERR:
-- printk(KERN_WARNING "cciss: cmd %p has "
-- "protocol error \n", cmd);
-+ dev_warn(&h->pdev->dev, "cciss: cmd %p has "
-+ "protocol error\n", cmd);
- rq->errors = make_status_bytes(SAM_STAT_GOOD,
- cmd->err_info->CommandStatus, DRIVER_OK,
-- blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ERROR);
-+ (cmd->rq->cmd_type == REQ_TYPE_BLOCK_PC) ?
-+ DID_PASSTHROUGH : DID_ERROR);
- break;
- case CMD_HARDWARE_ERR:
-- printk(KERN_WARNING "cciss: cmd %p had "
-+ dev_warn(&h->pdev->dev, "cciss: cmd %p had "
- " hardware error\n", cmd);
- rq->errors = make_status_bytes(SAM_STAT_GOOD,
- cmd->err_info->CommandStatus, DRIVER_OK,
-- blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ERROR);
-+ (cmd->rq->cmd_type == REQ_TYPE_BLOCK_PC) ?
-+ DID_PASSTHROUGH : DID_ERROR);
- break;
- case CMD_CONNECTION_LOST:
-- printk(KERN_WARNING "cciss: cmd %p had "
-+ dev_warn(&h->pdev->dev, "cciss: cmd %p had "
- "connection lost\n", cmd);
- rq->errors = make_status_bytes(SAM_STAT_GOOD,
- cmd->err_info->CommandStatus, DRIVER_OK,
-- blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ERROR);
-+ (cmd->rq->cmd_type == REQ_TYPE_BLOCK_PC) ?
-+ DID_PASSTHROUGH : DID_ERROR);
- break;
- case CMD_ABORTED:
-- printk(KERN_WARNING "cciss: cmd %p was "
-+ dev_warn(&h->pdev->dev, "cciss: cmd %p was "
- "aborted\n", cmd);
- rq->errors = make_status_bytes(SAM_STAT_GOOD,
- cmd->err_info->CommandStatus, DRIVER_OK,
-- blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ABORT);
-+ (cmd->rq->cmd_type == REQ_TYPE_BLOCK_PC) ?
-+ DID_PASSTHROUGH : DID_ABORT);
- break;
- case CMD_ABORT_FAILED:
-- printk(KERN_WARNING "cciss: cmd %p reports "
-+ dev_warn(&h->pdev->dev, "cciss: cmd %p reports "
- "abort failed\n", cmd);
- rq->errors = make_status_bytes(SAM_STAT_GOOD,
- cmd->err_info->CommandStatus, DRIVER_OK,
-- blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ERROR);
-+ (cmd->rq->cmd_type == REQ_TYPE_BLOCK_PC) ?
-+ DID_PASSTHROUGH : DID_ERROR);
- break;
- case CMD_UNSOLICITED_ABORT:
-- printk(KERN_WARNING "cciss%d: unsolicited "
-+ dev_warn(&h->pdev->dev, "cciss%d: unsolicited "
- "abort %p\n", h->ctlr, cmd);
- if (cmd->retry_count < MAX_CMD_RETRIES) {
- retry_cmd = 1;
-- printk(KERN_WARNING
-- "cciss%d: retrying %p\n", h->ctlr, cmd);
-+ dev_warn(&h->pdev->dev, "retrying %p\n", cmd);
- cmd->retry_count++;
- } else
-- printk(KERN_WARNING
-- "cciss%d: %p retried too "
-- "many times\n", h->ctlr, cmd);
-+ dev_warn(&h->pdev->dev,
-+ "%p retried too many times\n", cmd);
- rq->errors = make_status_bytes(SAM_STAT_GOOD,
- cmd->err_info->CommandStatus, DRIVER_OK,
-- blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ABORT);
-+ (cmd->rq->cmd_type == REQ_TYPE_BLOCK_PC) ?
-+ DID_PASSTHROUGH : DID_ABORT);
- break;
- case CMD_TIMEOUT:
-- printk(KERN_WARNING "cciss: cmd %p timedout\n", cmd);
-+ dev_warn(&h->pdev->dev, "cmd %p timedout\n", cmd);
- rq->errors = make_status_bytes(SAM_STAT_GOOD,
- cmd->err_info->CommandStatus, DRIVER_OK,
-- blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ERROR);
-+ (cmd->rq->cmd_type == REQ_TYPE_BLOCK_PC) ?
-+ DID_PASSTHROUGH : DID_ERROR);
-+ break;
-+ case CMD_UNABORTABLE:
-+ dev_warn(&h->pdev->dev, "cmd %p unabortable\n", cmd);
-+ rq->errors = make_status_bytes(SAM_STAT_GOOD,
-+ cmd->err_info->CommandStatus, DRIVER_OK,
-+ (cmd->rq->cmd_type == REQ_TYPE_BLOCK_PC) ?
-+ DID_PASSTHROUGH : DID_ERROR);
- break;
- default:
-- printk(KERN_WARNING "cciss: cmd %p returned "
-+ dev_warn(&h->pdev->dev, "cmd %p returned "
- "unknown status %x\n", cmd,
- cmd->err_info->CommandStatus);
- rq->errors = make_status_bytes(SAM_STAT_GOOD,
- cmd->err_info->CommandStatus, DRIVER_OK,
-- blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ERROR);
-+ (cmd->rq->cmd_type == REQ_TYPE_BLOCK_PC) ?
-+ DID_PASSTHROUGH : DID_ERROR);
- }
-
- after_error_processing:
-@@ -3247,6 +3290,37 @@ after_error_processing:
- blk_complete_request(cmd->rq);
- }
-
-+static inline u32 cciss_tag_contains_index(u32 tag)
-+{
-+#define DIRECT_LOOKUP_BIT 0x10
-+ return tag & DIRECT_LOOKUP_BIT;
-+}
-+
-+static inline u32 cciss_tag_to_index(u32 tag)
-+{
-+#define DIRECT_LOOKUP_SHIFT 5
-+ return tag >> DIRECT_LOOKUP_SHIFT;
-+}
-+
-+static inline u32 cciss_tag_discard_error_bits(ctlr_info_t *h, u32 tag)
-+{
-+#define CCISS_PERF_ERROR_BITS ((1 << DIRECT_LOOKUP_SHIFT) - 1)
-+#define CCISS_SIMPLE_ERROR_BITS 0x03
-+ if (likely(h->transMethod & CFGTBL_Trans_Performant))
-+ return tag & ~CCISS_PERF_ERROR_BITS;
-+ return tag & ~CCISS_SIMPLE_ERROR_BITS;
-+}
-+
-+static inline void cciss_mark_tag_indexed(u32 *tag)
-+{
-+ *tag |= DIRECT_LOOKUP_BIT;
-+}
-+
-+static inline void cciss_set_tag_index(u32 *tag, u32 index)
-+{
-+ *tag |= (index << DIRECT_LOOKUP_SHIFT);
-+}
-+
- /*
- * Get a request and submit it to the controller.
- */
-@@ -3258,14 +3332,17 @@ static void do_cciss_request(struct request_queue *q)
- int seg;
- struct request *creq;
- u64bit temp64;
-- struct scatterlist tmp_sg[MAXSGENTRIES];
-+ struct scatterlist *tmp_sg;
-+ SGDescriptor_struct *curr_sg;
- drive_info_struct *drv;
- int i, dir;
-+ int sg_index = 0;
-+ int chained = 0;
-
- /* We call start_io here in case there is a command waiting on the
- * queue that has not been sent.
- */
-- if (blk_queue_plugged(q))
-+ if (BLK_QUEUE_PLUGGED(q))
- goto startio;
-
- queue:
-@@ -3273,13 +3350,15 @@ static void do_cciss_request(struct request_queue *q)
- if (!creq)
- goto startio;
-
-- BUG_ON(creq->nr_phys_segments > MAXSGENTRIES);
-+ BUG_ON(creq->nr_phys_segments > h->maxsgentries);
-
-- if ((c = cmd_alloc(h, 1)) == NULL)
-+ c = cmd_alloc(h);
-+ if (!c)
- goto full;
-
- blk_start_request(creq);
-
-+ tmp_sg = h->scatter_list[c->cmdindex];
- spin_unlock_irq(q->queue_lock);
-
- c->cmd_type = CMD_RWREQ;
-@@ -3287,28 +3366,25 @@ static void do_cciss_request(struct request_queue *q)
-
- /* fill in the request */
- drv = creq->rq_disk->private_data;
-- c->Header.ReplyQueue = 0; // unused in simple mode
-+ c->Header.ReplyQueue = 0; /* unused in simple mode */
- /* got command from pool, so use the command block index instead */
- /* for direct lookups. */
- /* The first 2 bits are reserved for controller error reporting. */
-- c->Header.Tag.lower = (c->cmdindex << 3);
-- c->Header.Tag.lower |= 0x04; /* flag for direct lookup. */
-+ cciss_set_tag_index(&c->Header.Tag.lower, c->cmdindex);
-+ cciss_mark_tag_indexed(&c->Header.Tag.lower);
- memcpy(&c->Header.LUN, drv->LunID, sizeof(drv->LunID));
-- c->Request.CDBLen = 10; // 12 byte commands not in FW yet;
-- c->Request.Type.Type = TYPE_CMD; // It is a command.
-+ c->Request.CDBLen = 10; /* 12 byte commands not in FW yet; */
-+ c->Request.Type.Type = TYPE_CMD; /* It is a command. */
- c->Request.Type.Attribute = ATTR_SIMPLE;
- c->Request.Type.Direction =
- (rq_data_dir(creq) == READ) ? XFER_READ : XFER_WRITE;
-- c->Request.Timeout = 0; // Don't time out
-+ c->Request.Timeout = 0; /* Don't time out */
- c->Request.CDB[0] =
- (rq_data_dir(creq) == READ) ? h->cciss_read : h->cciss_write;
- start_blk = blk_rq_pos(creq);
--#ifdef CCISS_DEBUG
-- printk(KERN_DEBUG "ciss: sector =%d nr_sectors=%d\n",
-+ dev_dbg(&h->pdev->dev, "sector =%d nr_sectors=%d\n",
- (int)blk_rq_pos(creq), (int)blk_rq_sectors(creq));
--#endif /* CCISS_DEBUG */
--
-- sg_init_table(tmp_sg, MAXSGENTRIES);
-+ sg_init_table(tmp_sg, h->maxsgentries);
- seg = blk_rq_map_sg(q, creq, tmp_sg);
-
- /* get the DMA records for the setup */
-@@ -3317,33 +3393,56 @@ static void do_cciss_request(struct request_queue *q)
- else
- dir = PCI_DMA_TODEVICE;
-
-+ curr_sg = c->SG;
-+ sg_index = 0;
-+ chained = 0;
-+
- for (i = 0; i < seg; i++) {
-- c->SG[i].Len = tmp_sg[i].length;
-+ if (((sg_index+1) == (h->max_cmd_sgentries)) &&
-+ !chained && ((seg - i) > 1)) {
-+ /* Point to next chain block. */
-+ curr_sg = h->cmd_sg_list[c->cmdindex];
-+ sg_index = 0;
-+ chained = 1;
-+ }
-+ curr_sg[sg_index].Len = tmp_sg[i].length;
- temp64.val = (__u64) pci_map_page(h->pdev, sg_page(&tmp_sg[i]),
-- tmp_sg[i].offset,
-- tmp_sg[i].length, dir);
-- c->SG[i].Addr.lower = temp64.val32.lower;
-- c->SG[i].Addr.upper = temp64.val32.upper;
-- c->SG[i].Ext = 0; // we are not chaining
-+ tmp_sg[i].offset,
-+ tmp_sg[i].length, dir);
-+ curr_sg[sg_index].Addr.lower = temp64.val32.lower;
-+ curr_sg[sg_index].Addr.upper = temp64.val32.upper;
-+ curr_sg[sg_index].Ext = 0; /* we are not chaining */
-+
-+ ++sg_index;
- }
-+
-+ if (chained)
-+ cciss_map_sg_chain_block(h, c, h->cmd_sg_list[c->cmdindex],
-+ (seg - (h->max_cmd_sgentries - 1)) *
-+ sizeof(SGDescriptor_struct));
- /* track how many SG entries we are using */
- if (seg > h->maxSG)
- h->maxSG = seg;
-
--#ifdef CCISS_DEBUG
-- printk(KERN_DEBUG "cciss: Submitting %u sectors in %d segments\n",
-- blk_rq_sectors(creq), seg);
--#endif /* CCISS_DEBUG */
-+ dev_dbg(&h->pdev->dev, "Submitting %u sectors in %d segments "
-+ "chained[%d]\n",
-+ blk_rq_sectors(creq), seg, chained);
-
-- c->Header.SGList = c->Header.SGTotal = seg;
-- if (likely(blk_fs_request(creq))) {
-+ c->Header.SGTotal = seg + chained;
-+ if (seg <= h->max_cmd_sgentries)
-+ c->Header.SGList = c->Header.SGTotal;
-+ else
-+ c->Header.SGList = h->max_cmd_sgentries;
-+ set_performant_mode(h, c);
-+
-+ if (likely(creq->cmd_type == REQ_TYPE_FS)) {
- if(h->cciss_read == CCISS_READ_10) {
- c->Request.CDB[1] = 0;
-- c->Request.CDB[2] = (start_blk >> 24) & 0xff; //MSB
-+ c->Request.CDB[2] = (start_blk >> 24) & 0xff; /* MSB */
- c->Request.CDB[3] = (start_blk >> 16) & 0xff;
- c->Request.CDB[4] = (start_blk >> 8) & 0xff;
- c->Request.CDB[5] = start_blk & 0xff;
-- c->Request.CDB[6] = 0; // (sect >> 24) & 0xff; MSB
-+ c->Request.CDB[6] = 0; /* (sect >> 24) & 0xff; MSB */
- c->Request.CDB[7] = (blk_rq_sectors(creq) >> 8) & 0xff;
- c->Request.CDB[8] = blk_rq_sectors(creq) & 0xff;
- c->Request.CDB[9] = c->Request.CDB[11] = c->Request.CDB[12] = 0;
-@@ -3352,7 +3451,7 @@ static void do_cciss_request(struct request_queue *q)
-
- c->Request.CDBLen = 16;
- c->Request.CDB[1]= 0;
-- c->Request.CDB[2]= (upper32 >> 24) & 0xff; //MSB
-+ c->Request.CDB[2]= (upper32 >> 24) & 0xff; /* MSB */
- c->Request.CDB[3]= (upper32 >> 16) & 0xff;
- c->Request.CDB[4]= (upper32 >> 8) & 0xff;
- c->Request.CDB[5]= upper32 & 0xff;
-@@ -3366,11 +3465,12 @@ static void do_cciss_request(struct request_queue *q)
- c->Request.CDB[13]= blk_rq_sectors(creq) & 0xff;
- c->Request.CDB[14] = c->Request.CDB[15] = 0;
- }
-- } else if (blk_pc_request(creq)) {
-+ } else if (creq->cmd_type == REQ_TYPE_BLOCK_PC) {
- c->Request.CDBLen = creq->cmd_len;
- memcpy(c->Request.CDB, creq->cmd, BLK_MAX_CDB);
- } else {
-- printk(KERN_WARNING "cciss%d: bad request type %d\n", h->ctlr, creq->cmd_type);
-+ dev_warn(&h->pdev->dev, "bad request type %d\n",
-+ creq->cmd_type);
- BUG();
- }
-
-@@ -3393,202 +3493,197 @@ startio:
-
- static inline unsigned long get_next_completion(ctlr_info_t *h)
- {
-- return h->access.command_completed(h);
-+ return h->access->command_completed(h);
- }
-
- static inline int interrupt_pending(ctlr_info_t *h)
- {
-- return h->access.intr_pending(h);
-+ return h->access->intr_pending(h);
- }
-
- static inline long interrupt_not_for_us(ctlr_info_t *h)
- {
-- return (((h->access.intr_pending(h) == 0) ||
-- (h->interrupts_enabled == 0)));
-+ return ((h->access->intr_pending(h) == 0) ||
-+ (h->interrupts_enabled == 0));
- }
-
--static irqreturn_t do_cciss_intr(int irq, void *dev_id)
-+static inline int bad_tag(ctlr_info_t *h, u32 tag_index,
-+ u32 raw_tag)
- {
-- ctlr_info_t *h = dev_id;
-- CommandList_struct *c;
-- unsigned long flags;
-- __u32 a, a1, a2;
--
-- if (interrupt_not_for_us(h))
-- return IRQ_NONE;
-- /*
-- * If there are completed commands in the completion queue,
-- * we had better do something about it.
-- */
-- spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
-- while (interrupt_pending(h)) {
-- while ((a = get_next_completion(h)) != FIFO_EMPTY) {
-- a1 = a;
-- if ((a & 0x04)) {
-- a2 = (a >> 3);
-- if (a2 >= h->nr_cmds) {
-- printk(KERN_WARNING
-- "cciss: controller cciss%d failed, stopping.\n",
-- h->ctlr);
-- fail_all_cmds(h->ctlr);
-- return IRQ_HANDLED;
-- }
--
-- c = h->cmd_pool + a2;
-- a = c->busaddr;
--
-- } else {
-- struct hlist_node *tmp;
--
-- a &= ~3;
-- c = NULL;
-- hlist_for_each_entry(c, tmp, &h->cmpQ, list) {
-- if (c->busaddr == a)
-- break;
-- }
-- }
-- /*
-- * If we've found the command, take it off the
-- * completion Q and free it
-- */
-- if (c && c->busaddr == a) {
-- removeQ(c);
-- if (c->cmd_type == CMD_RWREQ) {
-- complete_command(h, c, 0);
-- } else if (c->cmd_type == CMD_IOCTL_PEND) {
-- complete(c->waiting);
-- }
--# ifdef CONFIG_CISS_SCSI_TAPE
-- else if (c->cmd_type == CMD_SCSI)
-- complete_scsi_command(c, 0, a1);
--# endif
-- continue;
-- }
-- }
-+ if (unlikely(tag_index >= h->nr_cmds)) {
-+ dev_warn(&h->pdev->dev, "bad tag 0x%08x ignored.\n", raw_tag);
-+ return 1;
- }
--
-- spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
-- return IRQ_HANDLED;
--}
--
--/**
-- * add_to_scan_list() - add controller to rescan queue
-- * @h: Pointer to the controller.
-- *
-- * Adds the controller to the rescan queue if not already on the queue.
-- *
-- * returns 1 if added to the queue, 0 if skipped (could be on the
-- * queue already, or the controller could be initializing or shutting
-- * down).
-- **/
--static int add_to_scan_list(struct ctlr_info *h)
--{
-- struct ctlr_info *test_h;
-- int found = 0;
-- int ret = 0;
--
-- if (h->busy_initializing)
-- return 0;
--
-- if (!mutex_trylock(&h->busy_shutting_down))
-- return 0;
--
-- mutex_lock(&scan_mutex);
-- list_for_each_entry(test_h, &scan_q, scan_list) {
-- if (test_h == h) {
-- found = 1;
-- break;
-- }
-- }
-- if (!found && !h->busy_scanning) {
-- INIT_COMPLETION(h->scan_wait);
-- list_add_tail(&h->scan_list, &scan_q);
-- ret = 1;
-- }
-- mutex_unlock(&scan_mutex);
-- mutex_unlock(&h->busy_shutting_down);
--
-- return ret;
--}
--
--/**
-- * remove_from_scan_list() - remove controller from rescan queue
-- * @h: Pointer to the controller.
-- *
-- * Removes the controller from the rescan queue if present. Blocks if
-- * the controller is currently conducting a rescan.
-- **/
--static void remove_from_scan_list(struct ctlr_info *h)
--{
-- struct ctlr_info *test_h, *tmp_h;
-- int scanning = 0;
--
-- mutex_lock(&scan_mutex);
-- list_for_each_entry_safe(test_h, tmp_h, &scan_q, scan_list) {
-- if (test_h == h) {
-- list_del(&h->scan_list);
-- complete_all(&h->scan_wait);
-- mutex_unlock(&scan_mutex);
-- return;
-- }
-- }
-- if (&h->busy_scanning)
-- scanning = 0;
-- mutex_unlock(&scan_mutex);
--
-- if (scanning)
-- wait_for_completion(&h->scan_wait);
--}
--
--/**
-- * scan_thread() - kernel thread used to rescan controllers
-- * @data: Ignored.
-- *
-- * A kernel thread used scan for drive topology changes on
-- * controllers. The thread processes only one controller at a time
-- * using a queue. Controllers are added to the queue using
-- * add_to_scan_list() and removed from the queue either after done
-- * processing or using remove_from_scan_list().
-- *
-- * returns 0.
-- **/
--static int scan_thread(void *data)
--{
-- struct ctlr_info *h;
--
-- while (1) {
-- set_current_state(TASK_INTERRUPTIBLE);
-- schedule();
-- if (kthread_should_stop())
-- break;
--
-- while (1) {
-- mutex_lock(&scan_mutex);
-- if (list_empty(&scan_q)) {
-- mutex_unlock(&scan_mutex);
-- break;
-- }
--
-- h = list_entry(scan_q.next,
-- struct ctlr_info,
-- scan_list);
-- list_del(&h->scan_list);
-- h->busy_scanning = 1;
-- mutex_unlock(&scan_mutex);
--
-- if (h) {
-- rebuild_lun_table(h, 0, 0);
-- complete_all(&h->scan_wait);
-- mutex_lock(&scan_mutex);
-- h->busy_scanning = 0;
-- mutex_unlock(&scan_mutex);
-- }
-- }
-- }
--
- return 0;
- }
-
-+static inline void finish_cmd(ctlr_info_t *h, CommandList_struct *c,
-+ u32 raw_tag)
-+{
-+ removeQ(c);
-+ if (likely(c->cmd_type == CMD_RWREQ))
-+ complete_command(h, c, 0);
-+ else if (c->cmd_type == CMD_IOCTL_PEND)
-+ complete(c->waiting);
-+#ifdef CONFIG_CISS_SCSI_TAPE
-+ else if (c->cmd_type == CMD_SCSI)
-+ complete_scsi_command(c, 0, raw_tag);
-+#endif
-+}
-+
-+static inline u32 next_command(ctlr_info_t *h)
-+{
-+ u32 a;
-+
-+ if (unlikely(!(h->transMethod & CFGTBL_Trans_Performant)))
-+ return h->access->command_completed(h);
-+
-+ if ((*(h->reply_pool_head) & 1) == (h->reply_pool_wraparound)) {
-+ a = *(h->reply_pool_head); /* Next cmd in ring buffer */
-+ (h->reply_pool_head)++;
-+ h->commands_outstanding--;
-+ } else {
-+ a = FIFO_EMPTY;
-+ }
-+ /* Check for wraparound */
-+ if (h->reply_pool_head == (h->reply_pool + h->max_commands)) {
-+ h->reply_pool_head = h->reply_pool;
-+ h->reply_pool_wraparound ^= 1;
-+ }
-+ return a;
-+}
-+
-+/* process completion of an indexed ("direct lookup") command */
-+static inline u32 process_indexed_cmd(ctlr_info_t *h, u32 raw_tag)
-+{
-+ u32 tag_index;
-+ CommandList_struct *c;
-+
-+ tag_index = cciss_tag_to_index(raw_tag);
-+ if (bad_tag(h, tag_index, raw_tag))
-+ return next_command(h);
-+ c = h->cmd_pool + tag_index;
-+ finish_cmd(h, c, raw_tag);
-+ return next_command(h);
-+}
-+
-+/* process completion of a non-indexed command */
-+static inline u32 process_nonindexed_cmd(ctlr_info_t *h, u32 raw_tag)
-+{
-+ CommandList_struct *c = NULL;
-+ __u32 busaddr_masked, tag_masked;
-+
-+ tag_masked = cciss_tag_discard_error_bits(h, raw_tag);
-+ list_for_each_entry(c, &h->cmpQ, list) {
-+ busaddr_masked = cciss_tag_discard_error_bits(h, c->busaddr);
-+ if (busaddr_masked == tag_masked) {
-+ finish_cmd(h, c, raw_tag);
-+ return next_command(h);
-+ }
-+ }
-+ bad_tag(h, h->nr_cmds + 1, raw_tag);
-+ return next_command(h);
-+}
-+
-+/* Some controllers, like p400, will give us one interrupt
-+ * after a soft reset, even if we turned interrupts off.
-+ * Only need to check for this in the cciss_xxx_discard_completions
-+ * functions.
-+ */
-+static int ignore_bogus_interrupt(ctlr_info_t *h)
-+{
-+ if (likely(!reset_devices))
-+ return 0;
-+
-+ if (likely(h->interrupts_enabled))
-+ return 0;
-+
-+ dev_info(&h->pdev->dev, "Received interrupt while interrupts disabled "
-+ "(known firmware bug.) Ignoring.\n");
-+
-+ return 1;
-+}
-+
-+static irqreturn_t cciss_intx_discard_completions(int irq, void *dev_id)
-+{
-+ ctlr_info_t *h = dev_id;
-+ unsigned long flags;
-+ u32 raw_tag;
-+
-+ if (ignore_bogus_interrupt(h))
-+ return IRQ_NONE;
-+
-+ if (interrupt_not_for_us(h))
-+ return IRQ_NONE;
-+ spin_lock_irqsave(&h->lock, flags);
-+ while (interrupt_pending(h)) {
-+ raw_tag = get_next_completion(h);
-+ while (raw_tag != FIFO_EMPTY)
-+ raw_tag = next_command(h);
-+ }
-+ spin_unlock_irqrestore(&h->lock, flags);
-+ return IRQ_HANDLED;
-+}
-+
-+static irqreturn_t cciss_msix_discard_completions(int irq, void *dev_id)
-+{
-+ ctlr_info_t *h = dev_id;
-+ unsigned long flags;
-+ u32 raw_tag;
-+
-+ if (ignore_bogus_interrupt(h))
-+ return IRQ_NONE;
-+
-+ spin_lock_irqsave(&h->lock, flags);
-+ raw_tag = get_next_completion(h);
-+ while (raw_tag != FIFO_EMPTY)
-+ raw_tag = next_command(h);
-+ spin_unlock_irqrestore(&h->lock, flags);
-+ return IRQ_HANDLED;
-+}
-+
-+static irqreturn_t do_cciss_intx(int irq, void *dev_id)
-+{
-+ ctlr_info_t *h = dev_id;
-+ unsigned long flags;
-+ u32 raw_tag;
-+
-+ if (interrupt_not_for_us(h))
-+ return IRQ_NONE;
-+ spin_lock_irqsave(&h->lock, flags);
-+ while (interrupt_pending(h)) {
-+ raw_tag = get_next_completion(h);
-+ while (raw_tag != FIFO_EMPTY) {
-+ if (cciss_tag_contains_index(raw_tag))
-+ raw_tag = process_indexed_cmd(h, raw_tag);
-+ else
-+ raw_tag = process_nonindexed_cmd(h, raw_tag);
-+ }
-+ }
-+ spin_unlock_irqrestore(&h->lock, flags);
-+ return IRQ_HANDLED;
-+}
-+/* Add a second interrupt handler for MSI/MSI-X mode. In this mode we never
-+ * check the interrupt pending register because it is not set.
-+ */
-+static irqreturn_t do_cciss_msix_intr(int irq, void *dev_id)
-+{
-+ ctlr_info_t *h = dev_id;
-+ unsigned long flags;
-+ u32 raw_tag;
-+
-+ spin_lock_irqsave(&h->lock, flags);
-+ raw_tag = get_next_completion(h);
-+ while (raw_tag != FIFO_EMPTY) {
-+ if (cciss_tag_contains_index(raw_tag))
-+ raw_tag = process_indexed_cmd(h, raw_tag);
-+ else
-+ raw_tag = process_nonindexed_cmd(h, raw_tag);
-+ }
-+ spin_unlock_irqrestore(&h->lock, flags);
-+ return IRQ_HANDLED;
-+}
-+
- static int check_for_unit_attention(ctlr_info_t *h, CommandList_struct *c)
- {
- if (c->err_info->SenseInfo[2] != UNIT_ATTENTION)
-@@ -3596,36 +3691,48 @@ static int check_for_unit_attention(ctlr_info_t *h, CommandList_struct *c)
-
- switch (c->err_info->SenseInfo[12]) {
- case STATE_CHANGED:
-- printk(KERN_WARNING "cciss%d: a state change "
-- "detected, command retried\n", h->ctlr);
-+ dev_warn(&h->pdev->dev, "a state change "
-+ "detected, command retried\n");
- return 1;
- break;
- case LUN_FAILED:
-- printk(KERN_WARNING "cciss%d: LUN failure "
-- "detected, action required\n", h->ctlr);
-+ dev_warn(&h->pdev->dev, "LUN failure "
-+ "detected, action required\n");
- return 1;
- break;
- case REPORT_LUNS_CHANGED:
-- printk(KERN_WARNING "cciss%d: report LUN data "
-- "changed\n", h->ctlr);
-- add_to_scan_list(h);
-- wake_up_process(cciss_scan_thread);
-+ dev_warn(&h->pdev->dev, "report LUN data changed\n");
-+ /*
-+ * Here, we could call add_to_scan_list and wake up the scan thread,
-+ * except that it's quite likely that we will get more than one
-+ * REPORT_LUNS_CHANGED condition in quick succession, which means
-+ * that those which occur after the first one will likely happen
-+ * *during* the scan_thread's rescan. And the rescan code is not
-+ * robust enough to restart in the middle, undoing what it has already
-+ * done, and it's not clear that it's even possible to do this, since
-+ * part of what it does is notify the block layer, which starts
-+ * doing it's own i/o to read partition tables and so on, and the
-+ * driver doesn't have visibility to know what might need undoing.
-+ * In any event, if possible, it is horribly complicated to get right
-+ * so we just don't do it for now.
-+ *
-+ * Note: this REPORT_LUNS_CHANGED condition only occurs on the MSA2012.
-+ */
- return 1;
- break;
- case POWER_OR_RESET:
-- printk(KERN_WARNING "cciss%d: a power on "
-- "or device reset detected\n", h->ctlr);
-+ dev_warn(&h->pdev->dev,
-+ "a power on or device reset detected\n");
- return 1;
- break;
- case UNIT_ATTENTION_CLEARED:
-- printk(KERN_WARNING "cciss%d: unit attention "
-- "cleared by another initiator\n", h->ctlr);
-+ dev_warn(&h->pdev->dev,
-+ "unit attention cleared by another initiator\n");
- return 1;
- break;
- default:
-- printk(KERN_WARNING "cciss%d: unknown "
-- "unit attention detected\n", h->ctlr);
-- return 1;
-+ dev_warn(&h->pdev->dev, "unknown unit attention detected\n");
-+ return 1;
- }
- }
-
-@@ -3634,39 +3741,41 @@ static int check_for_unit_attention(ctlr_info_t *h, CommandList_struct *c)
- * the io functions.
- * This is for debug only.
- */
--#ifdef CCISS_DEBUG
--static void print_cfg_table(CfgTable_struct *tb)
-+static void print_cfg_table(ctlr_info_t *h)
- {
- int i;
- char temp_name[17];
-+ CfgTable_struct *tb = h->cfgtable;
-
-- printk("Controller Configuration information\n");
-- printk("------------------------------------\n");
-+ dev_dbg(&h->pdev->dev, "Controller Configuration information\n");
-+ dev_dbg(&h->pdev->dev, "------------------------------------\n");
- for (i = 0; i < 4; i++)
- temp_name[i] = readb(&(tb->Signature[i]));
- temp_name[4] = '\0';
-- printk(" Signature = %s\n", temp_name);
-- printk(" Spec Number = %d\n", readl(&(tb->SpecValence)));
-- printk(" Transport methods supported = 0x%x\n",
-+ dev_dbg(&h->pdev->dev, " Signature = %s\n", temp_name);
-+ dev_dbg(&h->pdev->dev, " Spec Number = %d\n",
-+ readl(&(tb->SpecValence)));
-+ dev_dbg(&h->pdev->dev, " Transport methods supported = 0x%x\n",
- readl(&(tb->TransportSupport)));
-- printk(" Transport methods active = 0x%x\n",
-+ dev_dbg(&h->pdev->dev, " Transport methods active = 0x%x\n",
- readl(&(tb->TransportActive)));
-- printk(" Requested transport Method = 0x%x\n",
-+ dev_dbg(&h->pdev->dev, " Requested transport Method = 0x%x\n",
- readl(&(tb->HostWrite.TransportRequest)));
-- printk(" Coalesce Interrupt Delay = 0x%x\n",
-+ dev_dbg(&h->pdev->dev, " Coalesce Interrupt Delay = 0x%x\n",
- readl(&(tb->HostWrite.CoalIntDelay)));
-- printk(" Coalesce Interrupt Count = 0x%x\n",
-+ dev_dbg(&h->pdev->dev, " Coalesce Interrupt Count = 0x%x\n",
- readl(&(tb->HostWrite.CoalIntCount)));
-- printk(" Max outstanding commands = 0x%d\n",
-+ dev_dbg(&h->pdev->dev, " Max outstanding commands = 0x%d\n",
- readl(&(tb->CmdsOutMax)));
-- printk(" Bus Types = 0x%x\n", readl(&(tb->BusTypes)));
-+ dev_dbg(&h->pdev->dev, " Bus Types = 0x%x\n",
-+ readl(&(tb->BusTypes)));
- for (i = 0; i < 16; i++)
- temp_name[i] = readb(&(tb->ServerName[i]));
- temp_name[16] = '\0';
-- printk(" Server Name = %s\n", temp_name);
-- printk(" Heartbeat Counter = 0x%x\n\n\n", readl(&(tb->HeartBeat)));
-+ dev_dbg(&h->pdev->dev, " Server Name = %s\n", temp_name);
-+ dev_dbg(&h->pdev->dev, " Heartbeat Counter = 0x%x\n\n\n",
-+ readl(&(tb->HeartBeat)));
- }
--#endif /* CCISS_DEBUG */
-
- static int find_PCI_BAR_index(struct pci_dev *pdev, unsigned long pci_bar_addr)
- {
-@@ -3690,7 +3799,7 @@ static int find_PCI_BAR_index(struct pci_dev *pdev, unsigned long pci_bar_addr)
- offset += 8;
- break;
- default: /* reserved in PCI 2.2 */
-- printk(KERN_WARNING
-+ dev_warn(&pdev->dev,
- "Base address is invalid\n");
- return -1;
- break;
-@@ -3702,12 +3811,187 @@ static int find_PCI_BAR_index(struct pci_dev *pdev, unsigned long pci_bar_addr)
- return -1;
- }
-
-+/* Fill in bucket_map[], given nsgs (the max number of
-+ * scatter gather elements supported) and bucket[],
-+ * which is an array of 8 integers. The bucket[] array
-+ * contains 8 different DMA transfer sizes (in 16
-+ * byte increments) which the controller uses to fetch
-+ * commands. This function fills in bucket_map[], which
-+ * maps a given number of scatter gather elements to one of
-+ * the 8 DMA transfer sizes. The point of it is to allow the
-+ * controller to only do as much DMA as needed to fetch the
-+ * command, with the DMA transfer size encoded in the lower
-+ * bits of the command address.
-+ */
-+static void calc_bucket_map(int bucket[], int num_buckets,
-+ int nsgs, int *bucket_map)
-+{
-+ int i, j, b, size;
-+
-+ /* even a command with 0 SGs requires 4 blocks */
-+#define MINIMUM_TRANSFER_BLOCKS 4
-+#define NUM_BUCKETS 8
-+ /* Note, bucket_map must have nsgs+1 entries. */
-+ for (i = 0; i <= nsgs; i++) {
-+ /* Compute size of a command with i SG entries */
-+ size = i + MINIMUM_TRANSFER_BLOCKS;
-+ b = num_buckets; /* Assume the biggest bucket */
-+ /* Find the bucket that is just big enough */
-+ for (j = 0; j < 8; j++) {
-+ if (bucket[j] >= size) {
-+ b = j;
-+ break;
-+ }
-+ }
-+ /* for a command with i SG entries, use bucket b. */
-+ bucket_map[i] = b;
-+ }
-+}
-+
-+static void __devinit cciss_wait_for_mode_change_ack(ctlr_info_t *h)
-+{
-+ int i;
-+
-+ /* under certain very rare conditions, this can take awhile.
-+ * (e.g.: hot replace a failed 144GB drive in a RAID 5 set right
-+ * as we enter this code.) */
-+ for (i = 0; i < MAX_CONFIG_WAIT; i++) {
-+ if (!(readl(h->vaddr + SA5_DOORBELL) & CFGTBL_ChangeReq))
-+ break;
-+ msleep(10);
-+ }
-+}
-+
-+static __devinit void cciss_enter_performant_mode(ctlr_info_t *h,
-+ u32 use_short_tags)
-+{
-+ /* This is a bit complicated. There are 8 registers on
-+ * the controller which we write to to tell it 8 different
-+ * sizes of commands which there may be. It's a way of
-+ * reducing the DMA done to fetch each command. Encoded into
-+ * each command's tag are 3 bits which communicate to the controller
-+ * which of the eight sizes that command fits within. The size of
-+ * each command depends on how many scatter gather entries there are.
-+ * Each SG entry requires 16 bytes. The eight registers are programmed
-+ * with the number of 16-byte blocks a command of that size requires.
-+ * The smallest command possible requires 5 such 16 byte blocks.
-+ * the largest command possible requires MAXSGENTRIES + 4 16-byte
-+ * blocks. Note, this only extends to the SG entries contained
-+ * within the command block, and does not extend to chained blocks
-+ * of SG elements. bft[] contains the eight values we write to
-+ * the registers. They are not evenly distributed, but have more
-+ * sizes for small commands, and fewer sizes for larger commands.
-+ */
-+ __u32 trans_offset;
-+ int bft[8] = { 5, 6, 8, 10, 12, 20, 28, MAXSGENTRIES + 4};
-+ /*
-+ * 5 = 1 s/g entry or 4k
-+ * 6 = 2 s/g entry or 8k
-+ * 8 = 4 s/g entry or 16k
-+ * 10 = 6 s/g entry or 24k
-+ */
-+ unsigned long register_value;
-+ BUILD_BUG_ON(28 > MAXSGENTRIES + 4);
-+
-+ h->reply_pool_wraparound = 1; /* spec: init to 1 */
-+
-+ /* Controller spec: zero out this buffer. */
-+ memset(h->reply_pool, 0, h->max_commands * sizeof(__u64));
-+ h->reply_pool_head = h->reply_pool;
-+
-+ trans_offset = readl(&(h->cfgtable->TransMethodOffset));
-+ calc_bucket_map(bft, ARRAY_SIZE(bft), h->maxsgentries,
-+ h->blockFetchTable);
-+ writel(bft[0], &h->transtable->BlockFetch0);
-+ writel(bft[1], &h->transtable->BlockFetch1);
-+ writel(bft[2], &h->transtable->BlockFetch2);
-+ writel(bft[3], &h->transtable->BlockFetch3);
-+ writel(bft[4], &h->transtable->BlockFetch4);
-+ writel(bft[5], &h->transtable->BlockFetch5);
-+ writel(bft[6], &h->transtable->BlockFetch6);
-+ writel(bft[7], &h->transtable->BlockFetch7);
-+
-+ /* size of controller ring buffer */
-+ writel(h->max_commands, &h->transtable->RepQSize);
-+ writel(1, &h->transtable->RepQCount);
-+ writel(0, &h->transtable->RepQCtrAddrLow32);
-+ writel(0, &h->transtable->RepQCtrAddrHigh32);
-+ writel(h->reply_pool_dhandle, &h->transtable->RepQAddr0Low32);
-+ writel(0, &h->transtable->RepQAddr0High32);
-+ writel(CFGTBL_Trans_Performant | use_short_tags,
-+ &(h->cfgtable->HostWrite.TransportRequest));
-+
-+ writel(CFGTBL_ChangeReq, h->vaddr + SA5_DOORBELL);
-+ cciss_wait_for_mode_change_ack(h);
-+ register_value = readl(&(h->cfgtable->TransportActive));
-+ if (!(register_value & CFGTBL_Trans_Performant))
-+ dev_warn(&h->pdev->dev, "cciss: unable to get board into"
-+ " performant mode\n");
-+}
-+
-+static void __devinit cciss_put_controller_into_performant_mode(ctlr_info_t *h)
-+{
-+ __u32 trans_support;
-+
-+ if (cciss_simple_mode)
-+ return;
-+
-+ dev_dbg(&h->pdev->dev, "Trying to put board into Performant mode\n");
-+ /* Attempt to put controller into performant mode if supported */
-+ /* Does board support performant mode? */
-+ trans_support = readl(&(h->cfgtable->TransportSupport));
-+ if (!(trans_support & PERFORMANT_MODE))
-+ return;
-+
-+ dev_dbg(&h->pdev->dev, "Placing controller into performant mode\n");
-+ /* Performant mode demands commands on a 32 byte boundary
-+ * pci_alloc_consistent aligns on page boundarys already.
-+ * Just need to check if divisible by 32
-+ */
-+ if ((sizeof(CommandList_struct) % 32) != 0) {
-+ dev_warn(&h->pdev->dev, "%s %d %s\n",
-+ "cciss info: command size[",
-+ (int)sizeof(CommandList_struct),
-+ "] not divisible by 32, no performant mode..\n");
-+ return;
-+ }
-+
-+ /* Performant mode ring buffer and supporting data structures */
-+ h->reply_pool = (__u64 *)pci_alloc_consistent(
-+ h->pdev, h->max_commands * sizeof(__u64),
-+ &(h->reply_pool_dhandle));
-+
-+ /* Need a block fetch table for performant mode */
-+ h->blockFetchTable = kmalloc(((h->maxsgentries+1) *
-+ sizeof(__u32)), GFP_KERNEL);
-+
-+ if ((h->reply_pool == NULL) || (h->blockFetchTable == NULL))
-+ goto clean_up;
-+
-+ cciss_enter_performant_mode(h,
-+ trans_support & CFGTBL_Trans_use_short_tags);
-+
-+ /* Change the access methods to the performant access methods */
-+ h->access = &SA5_performant_access;
-+ h->transMethod = CFGTBL_Trans_Performant;
-+
-+ return;
-+clean_up:
-+ kfree(h->blockFetchTable);
-+ if (h->reply_pool)
-+ pci_free_consistent(h->pdev,
-+ h->max_commands * sizeof(__u64),
-+ h->reply_pool,
-+ h->reply_pool_dhandle);
-+ return;
-+
-+} /* cciss_put_controller_into_performant_mode */
-+
- /* If MSI/MSI-X is supported by the kernel we will try to enable it on
- * controllers that are capable. If not, we use IO-APIC mode.
- */
-
--static void __devinit cciss_interrupt_mode(ctlr_info_t *c,
-- struct pci_dev *pdev, __u32 board_id)
-+static void __devinit cciss_interrupt_mode(ctlr_info_t *h)
- {
- #ifdef CONFIG_PCI_MSI
- int err;
-@@ -3716,251 +4000,307 @@ static void __devinit cciss_interrupt_mode(ctlr_info_t *c,
- };
-
- /* Some boards advertise MSI but don't really support it */
-- if ((board_id == 0x40700E11) ||
-- (board_id == 0x40800E11) ||
-- (board_id == 0x40820E11) || (board_id == 0x40830E11))
-+ if ((h->board_id == 0x40700E11) || (h->board_id == 0x40800E11) ||
-+ (h->board_id == 0x40820E11) || (h->board_id == 0x40830E11))
- goto default_int_mode;
-
-- if (pci_find_capability(pdev, PCI_CAP_ID_MSIX)) {
-- err = pci_enable_msix(pdev, cciss_msix_entries, 4);
-+ if (pci_find_capability(h->pdev, PCI_CAP_ID_MSIX)) {
-+ err = pci_enable_msix(h->pdev, cciss_msix_entries, 4);
- if (!err) {
-- c->intr[0] = cciss_msix_entries[0].vector;
-- c->intr[1] = cciss_msix_entries[1].vector;
-- c->intr[2] = cciss_msix_entries[2].vector;
-- c->intr[3] = cciss_msix_entries[3].vector;
-- c->msix_vector = 1;
-+ h->intr[0] = cciss_msix_entries[0].vector;
-+ h->intr[1] = cciss_msix_entries[1].vector;
-+ h->intr[2] = cciss_msix_entries[2].vector;
-+ h->intr[3] = cciss_msix_entries[3].vector;
-+ h->msix_vector = 1;
- return;
- }
- if (err > 0) {
-- printk(KERN_WARNING "cciss: only %d MSI-X vectors "
-- "available\n", err);
-+ dev_warn(&h->pdev->dev,
-+ "only %d MSI-X vectors available\n", err);
- goto default_int_mode;
- } else {
-- printk(KERN_WARNING "cciss: MSI-X init failed %d\n",
-- err);
-+ dev_warn(&h->pdev->dev,
-+ "MSI-X init failed %d\n", err);
- goto default_int_mode;
- }
- }
-- if (pci_find_capability(pdev, PCI_CAP_ID_MSI)) {
-- if (!pci_enable_msi(pdev)) {
-- c->msi_vector = 1;
-- } else {
-- printk(KERN_WARNING "cciss: MSI init failed\n");
-- }
-+ if (pci_find_capability(h->pdev, PCI_CAP_ID_MSI)) {
-+ if (!pci_enable_msi(h->pdev))
-+ h->msi_vector = 1;
-+ else
-+ dev_warn(&h->pdev->dev, "MSI init failed\n");
- }
- default_int_mode:
- #endif /* CONFIG_PCI_MSI */
- /* if we get here we're going to use the default interrupt mode */
-- c->intr[SIMPLE_MODE_INT] = pdev->irq;
-+ h->intr[h->intr_mode] = h->pdev->irq;
- return;
- }
-
--static int __devinit cciss_pci_init(ctlr_info_t *c, struct pci_dev *pdev)
-+static int __devinit cciss_lookup_board_id(struct pci_dev *pdev, u32 *board_id)
- {
-- ushort subsystem_vendor_id, subsystem_device_id, command;
-- __u32 board_id, scratchpad = 0;
-- __u64 cfg_offset;
-- __u32 cfg_base_addr;
-- __u64 cfg_base_addr_index;
-- int i, prod_index, err;
-+ int i;
-+ u32 subsystem_vendor_id, subsystem_device_id;
-
- subsystem_vendor_id = pdev->subsystem_vendor;
- subsystem_device_id = pdev->subsystem_device;
-- board_id = (((__u32) (subsystem_device_id << 16) & 0xffff0000) |
-- subsystem_vendor_id);
-+ *board_id = ((subsystem_device_id << 16) & 0xffff0000) |
-+ subsystem_vendor_id;
-
- for (i = 0; i < ARRAY_SIZE(products); i++) {
- /* Stand aside for hpsa driver on request */
-- if (cciss_allow_hpsa && products[i].board_id == HPSA_BOUNDARY)
-+ if (cciss_allow_hpsa)
- return -ENODEV;
-- if (board_id == products[i].board_id)
-- break;
-- }
-- prod_index = i;
-- if (prod_index == ARRAY_SIZE(products)) {
-- dev_warn(&pdev->dev,
-- "unrecognized board ID: 0x%08lx, ignoring.\n",
-- (unsigned long) board_id);
-- return -ENODEV;
-+ if (*board_id == products[i].board_id)
-+ return i;
-+ }
-+ dev_warn(&pdev->dev, "unrecognized board ID: 0x%08x, ignoring.\n",
-+ *board_id);
-+ return -ENODEV;
-+}
-+
-+static inline bool cciss_board_disabled(ctlr_info_t *h)
-+{
-+ u16 command;
-+
-+ (void) pci_read_config_word(h->pdev, PCI_COMMAND, &command);
-+ return ((command & PCI_COMMAND_MEMORY) == 0);
-+}
-+
-+static int __devinit cciss_pci_find_memory_BAR(struct pci_dev *pdev,
-+ unsigned long *memory_bar)
-+{
-+ int i;
-+
-+ for (i = 0; i < DEVICE_COUNT_RESOURCE; i++)
-+ if (pci_resource_flags(pdev, i) & IORESOURCE_MEM) {
-+ /* addressing mode bits already removed */
-+ *memory_bar = pci_resource_start(pdev, i);
-+ dev_dbg(&pdev->dev, "memory BAR = %lx\n",
-+ *memory_bar);
-+ return 0;
-+ }
-+ dev_warn(&pdev->dev, "no memory BAR found\n");
-+ return -ENODEV;
-+}
-+
-+static int __devinit cciss_wait_for_board_state(struct pci_dev *pdev,
-+ void __iomem *vaddr, int wait_for_ready)
-+#define BOARD_READY 1
-+#define BOARD_NOT_READY 0
-+{
-+ int i, iterations;
-+ u32 scratchpad;
-+
-+ if (wait_for_ready)
-+ iterations = CCISS_BOARD_READY_ITERATIONS;
-+ else
-+ iterations = CCISS_BOARD_NOT_READY_ITERATIONS;
-+
-+ for (i = 0; i < iterations; i++) {
-+ scratchpad = readl(vaddr + SA5_SCRATCHPAD_OFFSET);
-+ if (wait_for_ready) {
-+ if (scratchpad == CCISS_FIRMWARE_READY)
-+ return 0;
-+ } else {
-+ if (scratchpad != CCISS_FIRMWARE_READY)
-+ return 0;
-+ }
-+ msleep(CCISS_BOARD_READY_POLL_INTERVAL_MSECS);
- }
-+ dev_warn(&pdev->dev, "board not ready, timed out.\n");
-+ return -ENODEV;
-+}
-
-- /* check to see if controller has been disabled */
-- /* BEFORE trying to enable it */
-- (void)pci_read_config_word(pdev, PCI_COMMAND, &command);
-- if (!(command & 0x02)) {
-- printk(KERN_WARNING
-- "cciss: controller appears to be disabled\n");
-+static int __devinit cciss_find_cfg_addrs(struct pci_dev *pdev,
-+ void __iomem *vaddr, u32 *cfg_base_addr, u64 *cfg_base_addr_index,
-+ u64 *cfg_offset)
-+{
-+ *cfg_base_addr = readl(vaddr + SA5_CTCFG_OFFSET);
-+ *cfg_offset = readl(vaddr + SA5_CTMEM_OFFSET);
-+ *cfg_base_addr &= (u32) 0x0000ffff;
-+ *cfg_base_addr_index = find_PCI_BAR_index(pdev, *cfg_base_addr);
-+ if (*cfg_base_addr_index == -1) {
-+ dev_warn(&pdev->dev, "cannot find cfg_base_addr_index, "
-+ "*cfg_base_addr = 0x%08x\n", *cfg_base_addr);
- return -ENODEV;
- }
-+ return 0;
-+}
-+
-+static int __devinit cciss_find_cfgtables(ctlr_info_t *h)
-+{
-+ u64 cfg_offset;
-+ u32 cfg_base_addr;
-+ u64 cfg_base_addr_index;
-+ u32 trans_offset;
-+ int rc;
-+
-+ rc = cciss_find_cfg_addrs(h->pdev, h->vaddr, &cfg_base_addr,
-+ &cfg_base_addr_index, &cfg_offset);
-+ if (rc)
-+ return rc;
-+ h->cfgtable = remap_pci_mem(pci_resource_start(h->pdev,
-+ cfg_base_addr_index) + cfg_offset, sizeof(*h->cfgtable));
-+ if (!h->cfgtable)
-+ return -ENOMEM;
-+ rc = write_driver_ver_to_cfgtable(h->cfgtable);
-+ if (rc)
-+ return rc;
-+ /* Find performant mode table. */
-+ trans_offset = readl(&h->cfgtable->TransMethodOffset);
-+ h->transtable = remap_pci_mem(pci_resource_start(h->pdev,
-+ cfg_base_addr_index)+cfg_offset+trans_offset,
-+ sizeof(*h->transtable));
-+ if (!h->transtable)
-+ return -ENOMEM;
-+ return 0;
-+}
-+
-+static void __devinit cciss_get_max_perf_mode_cmds(struct ctlr_info *h)
-+{
-+ h->max_commands = readl(&(h->cfgtable->MaxPerformantModeCommands));
-+
-+ /* Limit commands in memory limited kdump scenario. */
-+ if (reset_devices && h->max_commands > 32)
-+ h->max_commands = 32;
-+
-+ if (h->max_commands < 16) {
-+ dev_warn(&h->pdev->dev, "Controller reports "
-+ "max supported commands of %d, an obvious lie. "
-+ "Using 16. Ensure that firmware is up to date.\n",
-+ h->max_commands);
-+ h->max_commands = 16;
-+ }
-+}
-+
-+/* Interrogate the hardware for some limits:
-+ * max commands, max SG elements without chaining, and with chaining,
-+ * SG chain block size, etc.
-+ */
-+static void __devinit cciss_find_board_params(ctlr_info_t *h)
-+{
-+ cciss_get_max_perf_mode_cmds(h);
-+ h->nr_cmds = h->max_commands - 4 - cciss_tape_cmds;
-+ h->maxsgentries = readl(&(h->cfgtable->MaxSGElements));
-+ /*
-+ * Limit in-command s/g elements to 32 save dma'able memory.
-+ * Howvever spec says if 0, use 31
-+ */
-+ h->max_cmd_sgentries = 31;
-+ if (h->maxsgentries > 512) {
-+ h->max_cmd_sgentries = 32;
-+ h->chainsize = h->maxsgentries - h->max_cmd_sgentries + 1;
-+ h->maxsgentries--; /* save one for chain pointer */
-+ } else {
-+ h->maxsgentries = 31; /* default to traditional values */
-+ h->chainsize = 0;
-+ }
-+}
-+
-+static inline bool CISS_signature_present(ctlr_info_t *h)
-+{
-+ if ((readb(&h->cfgtable->Signature[0]) != 'C') ||
-+ (readb(&h->cfgtable->Signature[1]) != 'I') ||
-+ (readb(&h->cfgtable->Signature[2]) != 'S') ||
-+ (readb(&h->cfgtable->Signature[3]) != 'S')) {
-+ dev_warn(&h->pdev->dev, "not a valid CISS config table\n");
-+ return false;
-+ }
-+ return true;
-+}
-+
-+/* Need to enable prefetch in the SCSI core for 6400 in x86 */
-+static inline void cciss_enable_scsi_prefetch(ctlr_info_t *h)
-+{
-+#ifdef CONFIG_X86
-+ u32 prefetch;
-+
-+ prefetch = readl(&(h->cfgtable->SCSI_Prefetch));
-+ prefetch |= 0x100;
-+ writel(prefetch, &(h->cfgtable->SCSI_Prefetch));
-+#endif
-+}
-
-- err = pci_enable_device(pdev);
-+/* Disable DMA prefetch for the P600. Otherwise an ASIC bug may result
-+ * in a prefetch beyond physical memory.
-+ */
-+static inline void cciss_p600_dma_prefetch_quirk(ctlr_info_t *h)
-+{
-+ u32 dma_prefetch;
-+ __u32 dma_refetch;
-+
-+ if (h->board_id != 0x3225103C)
-+ return;
-+ dma_prefetch = readl(h->vaddr + I2O_DMA1_CFG);
-+ dma_prefetch |= 0x8000;
-+ writel(dma_prefetch, h->vaddr + I2O_DMA1_CFG);
-+ pci_read_config_dword(h->pdev, PCI_COMMAND_PARITY, &dma_refetch);
-+ dma_refetch |= 0x1;
-+ pci_write_config_dword(h->pdev, PCI_COMMAND_PARITY, dma_refetch);
-+}
-+
-+static int __devinit cciss_pci_init(ctlr_info_t *h)
-+{
-+ int prod_index, err;
-+
-+ prod_index = cciss_lookup_board_id(h->pdev, &h->board_id);
-+ if (prod_index < 0)
-+ return -ENODEV;
-+ h->product_name = products[prod_index].product_name;
-+ h->access = products[prod_index].access;
-+
-+ if (cciss_board_disabled(h)) {
-+ dev_warn(&h->pdev->dev, "controller appears to be disabled\n");
-+ return -ENODEV;
-+ }
-+ err = pci_enable_device(h->pdev);
- if (err) {
-- printk(KERN_ERR "cciss: Unable to Enable PCI device\n");
-+ dev_warn(&h->pdev->dev, "Unable to Enable PCI device\n");
- return err;
- }
-
-- err = pci_request_regions(pdev, "cciss");
-+ err = pci_request_regions(h->pdev, "cciss");
- if (err) {
-- printk(KERN_ERR "cciss: Cannot obtain PCI resources, "
-- "aborting\n");
-+ dev_warn(&h->pdev->dev,
-+ "Cannot obtain PCI resources, aborting\n");
- return err;
- }
-
--#ifdef CCISS_DEBUG
-- printk("command = %x\n", command);
-- printk("irq = %x\n", pdev->irq);
-- printk("board_id = %x\n", board_id);
--#endif /* CCISS_DEBUG */
-+ dev_dbg(&h->pdev->dev, "irq = %x\n", h->pdev->irq);
-+ dev_dbg(&h->pdev->dev, "board_id = %x\n", h->board_id);
-
- /* If the kernel supports MSI/MSI-X we will try to enable that functionality,
- * else we use the IO-APIC interrupt assigned to us by system ROM.
- */
-- cciss_interrupt_mode(c, pdev, board_id);
--
-- /* find the memory BAR */
-- for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
-- if (pci_resource_flags(pdev, i) & IORESOURCE_MEM)
-- break;
-- }
-- if (i == DEVICE_COUNT_RESOURCE) {
-- printk(KERN_WARNING "cciss: No memory BAR found\n");
-- err = -ENODEV;
-+ cciss_interrupt_mode(h);
-+ err = cciss_pci_find_memory_BAR(h->pdev, &h->paddr);
-+ if (err)
- goto err_out_free_res;
-- }
--
-- c->paddr = pci_resource_start(pdev, i); /* addressing mode bits
-- * already removed
-- */
--
--#ifdef CCISS_DEBUG
-- printk("address 0 = %lx\n", c->paddr);
--#endif /* CCISS_DEBUG */
-- c->vaddr = remap_pci_mem(c->paddr, 0x250);
--
-- /* Wait for the board to become ready. (PCI hotplug needs this.)
-- * We poll for up to 120 secs, once per 100ms. */
-- for (i = 0; i < 1200; i++) {
-- scratchpad = readl(c->vaddr + SA5_SCRATCHPAD_OFFSET);
-- if (scratchpad == CCISS_FIRMWARE_READY)
-- break;
-- set_current_state(TASK_INTERRUPTIBLE);
-- schedule_timeout(msecs_to_jiffies(100)); /* wait 100ms */
-- }
-- if (scratchpad != CCISS_FIRMWARE_READY) {
-- printk(KERN_WARNING "cciss: Board not ready. Timed out.\n");
-- err = -ENODEV;
-+ h->vaddr = remap_pci_mem(h->paddr, 0x250);
-+ if (!h->vaddr) {
-+ err = -ENOMEM;
- goto err_out_free_res;
- }
--
-- /* get the address index number */
-- cfg_base_addr = readl(c->vaddr + SA5_CTCFG_OFFSET);
-- cfg_base_addr &= (__u32) 0x0000ffff;
--#ifdef CCISS_DEBUG
-- printk("cfg base address = %x\n", cfg_base_addr);
--#endif /* CCISS_DEBUG */
-- cfg_base_addr_index = find_PCI_BAR_index(pdev, cfg_base_addr);
--#ifdef CCISS_DEBUG
-- printk("cfg base address index = %llx\n",
-- (unsigned long long)cfg_base_addr_index);
--#endif /* CCISS_DEBUG */
-- if (cfg_base_addr_index == -1) {
-- printk(KERN_WARNING "cciss: Cannot find cfg_base_addr_index\n");
-- err = -ENODEV;
-+ err = cciss_wait_for_board_state(h->pdev, h->vaddr, BOARD_READY);
-+ if (err)
- goto err_out_free_res;
-- }
--
-- cfg_offset = readl(c->vaddr + SA5_CTMEM_OFFSET);
--#ifdef CCISS_DEBUG
-- printk("cfg offset = %llx\n", (unsigned long long)cfg_offset);
--#endif /* CCISS_DEBUG */
-- c->cfgtable = remap_pci_mem(pci_resource_start(pdev,
-- cfg_base_addr_index) +
-- cfg_offset, sizeof(CfgTable_struct));
-- c->board_id = board_id;
--
--#ifdef CCISS_DEBUG
-- print_cfg_table(c->cfgtable);
--#endif /* CCISS_DEBUG */
--
-- /* Some controllers support Zero Memory Raid (ZMR).
-- * When configured in ZMR mode the number of supported
-- * commands drops to 64. So instead of just setting an
-- * arbitrary value we make the driver a little smarter.
-- * We read the config table to tell us how many commands
-- * are supported on the controller then subtract 4 to
-- * leave a little room for ioctl calls.
-- */
-- c->max_commands = readl(&(c->cfgtable->CmdsOutMax));
-- c->product_name = products[prod_index].product_name;
-- c->access = *(products[prod_index].access);
-- c->nr_cmds = c->max_commands - 4;
-- if ((readb(&c->cfgtable->Signature[0]) != 'C') ||
-- (readb(&c->cfgtable->Signature[1]) != 'I') ||
-- (readb(&c->cfgtable->Signature[2]) != 'S') ||
-- (readb(&c->cfgtable->Signature[3]) != 'S')) {
-- printk("Does not appear to be a valid CISS config table\n");
-- err = -ENODEV;
-+ err = cciss_find_cfgtables(h);
-+ if (err)
- goto err_out_free_res;
-- }
--#ifdef CONFIG_X86
-- {
-- /* Need to enable prefetch in the SCSI core for 6400 in x86 */
-- __u32 prefetch;
-- prefetch = readl(&(c->cfgtable->SCSI_Prefetch));
-- prefetch |= 0x100;
-- writel(prefetch, &(c->cfgtable->SCSI_Prefetch));
-- }
--#endif
--
-- /* Disabling DMA prefetch and refetch for the P600.
-- * An ASIC bug may result in accesses to invalid memory addresses.
-- * We've disabled prefetch for some time now. Testing with XEN
-- * kernels revealed a bug in the refetch if dom0 resides on a P600.
-- */
-- if(board_id == 0x3225103C) {
-- __u32 dma_prefetch;
-- __u32 dma_refetch;
-- dma_prefetch = readl(c->vaddr + I2O_DMA1_CFG);
-- dma_prefetch |= 0x8000;
-- writel(dma_prefetch, c->vaddr + I2O_DMA1_CFG);
-- pci_read_config_dword(pdev, PCI_COMMAND_PARITY, &dma_refetch);
-- dma_refetch |= 0x1;
-- pci_write_config_dword(pdev, PCI_COMMAND_PARITY, dma_refetch);
-- }
--
--#ifdef CCISS_DEBUG
-- printk("Trying to put board into Simple mode\n");
--#endif /* CCISS_DEBUG */
-- c->max_commands = readl(&(c->cfgtable->CmdsOutMax));
-- /* Update the field, and then ring the doorbell */
-- writel(CFGTBL_Trans_Simple, &(c->cfgtable->HostWrite.TransportRequest));
-- writel(CFGTBL_ChangeReq, c->vaddr + SA5_DOORBELL);
--
-- /* under certain very rare conditions, this can take awhile.
-- * (e.g.: hot replace a failed 144GB drive in a RAID 5 set right
-- * as we enter this code.) */
-- for (i = 0; i < MAX_CONFIG_WAIT; i++) {
-- if (!(readl(c->vaddr + SA5_DOORBELL) & CFGTBL_ChangeReq))
-- break;
-- /* delay and try again */
-- set_current_state(TASK_INTERRUPTIBLE);
-- schedule_timeout(msecs_to_jiffies(1));
-- }
--
--#ifdef CCISS_DEBUG
-- printk(KERN_DEBUG "I counter got to %d %x\n", i,
-- readl(c->vaddr + SA5_DOORBELL));
--#endif /* CCISS_DEBUG */
--#ifdef CCISS_DEBUG
-- print_cfg_table(c->cfgtable);
--#endif /* CCISS_DEBUG */
-+ print_cfg_table(h);
-+ cciss_find_board_params(h);
-
-- if (!(readl(&(c->cfgtable->TransportActive)) & CFGTBL_Trans_Simple)) {
-- printk(KERN_WARNING "cciss: unable to get board into"
-- " simple mode\n");
-+ if (!CISS_signature_present(h)) {
- err = -ENODEV;
- goto err_out_free_res;
- }
-+ cciss_enable_scsi_prefetch(h);
-+ cciss_p600_dma_prefetch_quirk(h);
-+ err = cciss_enter_simple_mode(h);
-+ if (err)
-+ goto err_out_free_res;
-+ cciss_put_controller_into_performant_mode(h);
- return 0;
-
- err_out_free_res:
-@@ -3968,42 +4308,47 @@ err_out_free_res:
- * Deliberately omit pci_disable_device(): it does something nasty to
- * Smart Array controllers that pci_enable_device does not undo
- */
-- pci_release_regions(pdev);
-+ if (h->transtable)
-+ iounmap(h->transtable);
-+ if (h->cfgtable)
-+ iounmap(h->cfgtable);
-+ if (h->vaddr)
-+ iounmap(h->vaddr);
-+ pci_release_regions(h->pdev);
- return err;
- }
-
- /* Function to find the first free pointer into our hba[] array
- * Returns -1 if no free entries are left.
- */
--static int alloc_cciss_hba(void)
-+static int alloc_cciss_hba(struct pci_dev *pdev)
- {
- int i;
-
- for (i = 0; i < MAX_CTLR; i++) {
- if (!hba[i]) {
-- ctlr_info_t *p;
-+ ctlr_info_t *h;
-
-- p = kzalloc(sizeof(ctlr_info_t), GFP_KERNEL);
-- if (!p)
-+ h = kzalloc(sizeof(ctlr_info_t), GFP_KERNEL);
-+ if (!h)
- goto Enomem;
-- hba[i] = p;
-+ hba[i] = h;
- return i;
- }
- }
-- printk(KERN_WARNING "cciss: This driver supports a maximum"
-+ dev_warn(&pdev->dev, "This driver supports a maximum"
- " of %d controllers.\n", MAX_CTLR);
- return -1;
- Enomem:
-- printk(KERN_ERR "cciss: out of memory.\n");
-+ dev_warn(&pdev->dev, "out of memory.\n");
- return -1;
- }
-
--static void free_hba(int n)
-+static void free_hba(ctlr_info_t *h)
- {
-- ctlr_info_t *h = hba[n];
- int i;
-
-- hba[n] = NULL;
-+ hba[h->ctlr] = NULL;
- for (i = 0; i < h->highest_lun + 1; i++)
- if (h->gendisk[i] != NULL)
- put_disk(h->gendisk[i]);
-@@ -4075,7 +4420,7 @@ static __devinit int cciss_message(struct pci_dev *pdev, unsigned char opcode, u
- tag = readl(vaddr + SA5_REPLY_PORT_OFFSET);
- if ((tag & ~3) == paddr32)
- break;
-- schedule_timeout_uninterruptible(HZ);
-+ msleep(CCISS_POST_RESET_NOOP_TIMEOUT_MSECS);
- }
-
- iounmap(vaddr);
-@@ -4083,7 +4428,8 @@ static __devinit int cciss_message(struct pci_dev *pdev, unsigned char opcode, u
- /* we leak the DMA buffer here ... no choice since the controller could
- still complete the command. */
- if (i == 10) {
-- printk(KERN_ERR "cciss: controller message %02x:%02x timed out\n",
-+ dev_err(&pdev->dev,
-+ "controller message %02x:%02x timed out\n",
- opcode, type);
- return -ETIMEDOUT;
- }
-@@ -4091,122 +4437,439 @@ static __devinit int cciss_message(struct pci_dev *pdev, unsigned char opcode, u
- pci_free_consistent(pdev, cmd_sz, cmd, paddr64);
-
- if (tag & 2) {
-- printk(KERN_ERR "cciss: controller message %02x:%02x failed\n",
-+ dev_err(&pdev->dev, "controller message %02x:%02x failed\n",
- opcode, type);
- return -EIO;
- }
-
-- printk(KERN_INFO "cciss: controller message %02x:%02x succeeded\n",
-+ dev_info(&pdev->dev, "controller message %02x:%02x succeeded\n",
- opcode, type);
- return 0;
- }
-
--#define cciss_soft_reset_controller(p) cciss_message(p, 1, 0)
- #define cciss_noop(p) cciss_message(p, 3, 0)
-
--static __devinit int cciss_reset_msi(struct pci_dev *pdev)
-+static int cciss_controller_hard_reset(struct pci_dev *pdev,
-+ void * __iomem vaddr, u32 use_doorbell)
- {
--/* the #defines are stolen from drivers/pci/msi.h. */
--#define msi_control_reg(base) (base + PCI_MSI_FLAGS)
--#define PCI_MSIX_FLAGS_ENABLE (1 << 15)
--
-+ u16 pmcsr;
- int pos;
-- u16 control = 0;
--
-- pos = pci_find_capability(pdev, PCI_CAP_ID_MSI);
-- if (pos) {
-- pci_read_config_word(pdev, msi_control_reg(pos), &control);
-- if (control & PCI_MSI_FLAGS_ENABLE) {
-- printk(KERN_INFO "cciss: resetting MSI\n");
-- pci_write_config_word(pdev, msi_control_reg(pos), control & ~PCI_MSI_FLAGS_ENABLE);
-- }
-- }
-
-- pos = pci_find_capability(pdev, PCI_CAP_ID_MSIX);
-- if (pos) {
-- pci_read_config_word(pdev, msi_control_reg(pos), &control);
-- if (control & PCI_MSIX_FLAGS_ENABLE) {
-- printk(KERN_INFO "cciss: resetting MSI-X\n");
-- pci_write_config_word(pdev, msi_control_reg(pos), control & ~PCI_MSIX_FLAGS_ENABLE);
-+ if (use_doorbell) {
-+ /* For everything after the P600, the PCI power state method
-+ * of resetting the controller doesn't work, so we have this
-+ * other way using the doorbell register.
-+ */
-+ dev_info(&pdev->dev, "using doorbell to reset controller\n");
-+ writel(use_doorbell, vaddr + SA5_DOORBELL);
-+ } else { /* Try to do it the PCI power state way */
-+
-+ /* Quoting from the Open CISS Specification: "The Power
-+ * Management Control/Status Register (CSR) controls the power
-+ * state of the device. The normal operating state is D0,
-+ * CSR=00h. The software off state is D3, CSR=03h. To reset
-+ * the controller, place the interface device in D3 then to D0,
-+ * this causes a secondary PCI reset which will reset the
-+ * controller." */
-+
-+ pos = pci_find_capability(pdev, PCI_CAP_ID_PM);
-+ if (pos == 0) {
-+ dev_err(&pdev->dev,
-+ "cciss_controller_hard_reset: "
-+ "PCI PM not supported\n");
-+ return -ENODEV;
- }
-+ dev_info(&pdev->dev, "using PCI PM to reset controller\n");
-+ /* enter the D3hot power management state */
-+ pci_read_config_word(pdev, pos + PCI_PM_CTRL, &pmcsr);
-+ pmcsr &= ~PCI_PM_CTRL_STATE_MASK;
-+ pmcsr |= PCI_D3hot;
-+ pci_write_config_word(pdev, pos + PCI_PM_CTRL, pmcsr);
-+
-+ msleep(500);
-+
-+ /* enter the D0 power management state */
-+ pmcsr &= ~PCI_PM_CTRL_STATE_MASK;
-+ pmcsr |= PCI_D0;
-+ pci_write_config_word(pdev, pos + PCI_PM_CTRL, pmcsr);
- }
-+ return 0;
-+}
-+
-+static __devinit void init_driver_version(char *driver_version, int len)
-+{
-+ memset(driver_version, 0, len);
-+ strncpy(driver_version, "cciss " DRIVER_NAME, len - 1);
-+}
-
-+static __devinit int write_driver_ver_to_cfgtable(
-+ CfgTable_struct __iomem *cfgtable)
-+{
-+ char *driver_version;
-+ int i, size = sizeof(cfgtable->driver_version);
-+
-+ driver_version = kmalloc(size, GFP_KERNEL);
-+ if (!driver_version)
-+ return -ENOMEM;
-+
-+ init_driver_version(driver_version, size);
-+ for (i = 0; i < size; i++)
-+ writeb(driver_version[i], &cfgtable->driver_version[i]);
-+ kfree(driver_version);
- return 0;
- }
-
-+static __devinit void read_driver_ver_from_cfgtable(
-+ CfgTable_struct __iomem *cfgtable, unsigned char *driver_ver)
-+{
-+ int i;
-+
-+ for (i = 0; i < sizeof(cfgtable->driver_version); i++)
-+ driver_ver[i] = readb(&cfgtable->driver_version[i]);
-+}
-+
-+static __devinit int controller_reset_failed(
-+ CfgTable_struct __iomem *cfgtable)
-+{
-+
-+ char *driver_ver, *old_driver_ver;
-+ int rc, size = sizeof(cfgtable->driver_version);
-+
-+ old_driver_ver = kmalloc(2 * size, GFP_KERNEL);
-+ if (!old_driver_ver)
-+ return -ENOMEM;
-+ driver_ver = old_driver_ver + size;
-+
-+ /* After a reset, the 32 bytes of "driver version" in the cfgtable
-+ * should have been changed, otherwise we know the reset failed.
-+ */
-+ init_driver_version(old_driver_ver, size);
-+ read_driver_ver_from_cfgtable(cfgtable, driver_ver);
-+ rc = !memcmp(driver_ver, old_driver_ver, size);
-+ kfree(old_driver_ver);
-+ return rc;
-+}
-+
- /* This does a hard reset of the controller using PCI power management
-- * states. */
--static __devinit int cciss_hard_reset_controller(struct pci_dev *pdev)
-+ * states or using the doorbell register. */
-+static __devinit int cciss_kdump_hard_reset_controller(struct pci_dev *pdev)
- {
-- u16 pmcsr, saved_config_space[32];
-- int i, pos;
-+ u64 cfg_offset;
-+ u32 cfg_base_addr;
-+ u64 cfg_base_addr_index;
-+ void __iomem *vaddr;
-+ unsigned long paddr;
-+ u32 misc_fw_support;
-+ int rc;
-+ CfgTable_struct __iomem *cfgtable;
-+ u32 use_doorbell;
-+ u32 board_id;
-+ u16 command_register;
-
-- printk(KERN_INFO "cciss: using PCI PM to reset controller\n");
-+ /* For controllers as old a the p600, this is very nearly
-+ * the same thing as
-+ *
-+ * pci_save_state(pci_dev);
-+ * pci_set_power_state(pci_dev, PCI_D3hot);
-+ * pci_set_power_state(pci_dev, PCI_D0);
-+ * pci_restore_state(pci_dev);
-+ *
-+ * For controllers newer than the P600, the pci power state
-+ * method of resetting doesn't work so we have another way
-+ * using the doorbell register.
-+ */
-
-- /* This is very nearly the same thing as
-+ /* Exclude 640x boards. These are two pci devices in one slot
-+ * which share a battery backed cache module. One controls the
-+ * cache, the other accesses the cache through the one that controls
-+ * it. If we reset the one controlling the cache, the other will
-+ * likely not be happy. Just forbid resetting this conjoined mess.
-+ */
-+ cciss_lookup_board_id(pdev, &board_id);
-+ if (!ctlr_is_resettable(board_id)) {
-+ dev_warn(&pdev->dev, "Cannot reset Smart Array 640x "
-+ "due to shared cache module.");
-+ return -ENODEV;
-+ }
-+
-+ /* if controller is soft- but not hard resettable... */
-+ if (!ctlr_is_hard_resettable(board_id))
-+ return -ENOTSUPP; /* try soft reset later. */
-+
-+ /* Save the PCI command register */
-+ pci_read_config_word(pdev, 4, &command_register);
-+ /* Turn the board off. This is so that later pci_restore_state()
-+ * won't turn the board on before the rest of config space is ready.
-+ */
-+ pci_disable_device(pdev);
-+ pci_save_state(pdev);
-+
-+ /* find the first memory BAR, so we can find the cfg table */
-+ rc = cciss_pci_find_memory_BAR(pdev, &paddr);
-+ if (rc)
-+ return rc;
-+ vaddr = remap_pci_mem(paddr, 0x250);
-+ if (!vaddr)
-+ return -ENOMEM;
-+
-+ /* find cfgtable in order to check if reset via doorbell is supported */
-+ rc = cciss_find_cfg_addrs(pdev, vaddr, &cfg_base_addr,
-+ &cfg_base_addr_index, &cfg_offset);
-+ if (rc)
-+ goto unmap_vaddr;
-+ cfgtable = remap_pci_mem(pci_resource_start(pdev,
-+ cfg_base_addr_index) + cfg_offset, sizeof(*cfgtable));
-+ if (!cfgtable) {
-+ rc = -ENOMEM;
-+ goto unmap_vaddr;
-+ }
-+ rc = write_driver_ver_to_cfgtable(cfgtable);
-+ if (rc)
-+ goto unmap_vaddr;
-+
-+ /* If reset via doorbell register is supported, use that.
-+ * There are two such methods. Favor the newest method.
-+ */
-+ misc_fw_support = readl(&cfgtable->misc_fw_support);
-+ use_doorbell = misc_fw_support & MISC_FW_DOORBELL_RESET2;
-+ if (use_doorbell) {
-+ use_doorbell = DOORBELL_CTLR_RESET2;
-+ } else {
-+ use_doorbell = misc_fw_support & MISC_FW_DOORBELL_RESET;
-+ if (use_doorbell) {
-+ dev_warn(&pdev->dev, "Controller claims that "
-+ "'Bit 2 doorbell reset' is "
-+ "supported, but not 'bit 5 doorbell reset'. "
-+ "Firmware update is recommended.\n");
-+ rc = -ENOTSUPP; /* use the soft reset */
-+ goto unmap_cfgtable;
-+ }
-+ }
-+
-+ rc = cciss_controller_hard_reset(pdev, vaddr, use_doorbell);
-+ if (rc)
-+ goto unmap_cfgtable;
-+
-+ pci_restore_state(pdev);
-+ rc = pci_enable_device(pdev);
-+ if (rc) {
-+ dev_warn(&pdev->dev, "failed to enable device.\n");
-+ goto unmap_cfgtable;
-+ }
-+ pci_write_config_word(pdev, 4, command_register);
-+
-+ /* Some devices (notably the HP Smart Array 5i Controller)
-+ need a little pause here */
-+ msleep(CCISS_POST_RESET_PAUSE_MSECS);
-
-- pci_save_state(pci_dev);
-- pci_set_power_state(pci_dev, PCI_D3hot);
-- pci_set_power_state(pci_dev, PCI_D0);
-- pci_restore_state(pci_dev);
-+ /* Wait for board to become not ready, then ready. */
-+ dev_info(&pdev->dev, "Waiting for board to reset.\n");
-+ rc = cciss_wait_for_board_state(pdev, vaddr, BOARD_NOT_READY);
-+ if (rc) {
-+ dev_warn(&pdev->dev, "Failed waiting for board to hard reset."
-+ " Will try soft reset.\n");
-+ rc = -ENOTSUPP; /* Not expected, but try soft reset later */
-+ goto unmap_cfgtable;
-+ }
-+ rc = cciss_wait_for_board_state(pdev, vaddr, BOARD_READY);
-+ if (rc) {
-+ dev_warn(&pdev->dev,
-+ "failed waiting for board to become ready "
-+ "after hard reset\n");
-+ goto unmap_cfgtable;
-+ }
-+
-+ rc = controller_reset_failed(vaddr);
-+ if (rc < 0)
-+ goto unmap_cfgtable;
-+ if (rc) {
-+ dev_warn(&pdev->dev, "Unable to successfully hard reset "
-+ "controller. Will try soft reset.\n");
-+ rc = -ENOTSUPP; /* Not expected, but try soft reset later */
-+ } else {
-+ dev_info(&pdev->dev, "Board ready after hard reset.\n");
-+ }
-
-- but we can't use these nice canned kernel routines on
-- kexec, because they also check the MSI/MSI-X state in PCI
-- configuration space and do the wrong thing when it is
-- set/cleared. Also, the pci_save/restore_state functions
-- violate the ordering requirements for restoring the
-- configuration space from the CCISS document (see the
-- comment below). So we roll our own .... */
-+unmap_cfgtable:
-+ iounmap(cfgtable);
-+
-+unmap_vaddr:
-+ iounmap(vaddr);
-+ return rc;
-+}
-+
-+static __devinit int cciss_init_reset_devices(struct pci_dev *pdev)
-+{
-+ int rc, i;
-
-- for (i = 0; i < 32; i++)
-- pci_read_config_word(pdev, 2*i, &saved_config_space[i]);
-+ if (!reset_devices)
-+ return 0;
-
-- pos = pci_find_capability(pdev, PCI_CAP_ID_PM);
-- if (pos == 0) {
-- printk(KERN_ERR "cciss_reset_controller: PCI PM not supported\n");
-+ /* Reset the controller with a PCI power-cycle or via doorbell */
-+ rc = cciss_kdump_hard_reset_controller(pdev);
-+
-+ /* -ENOTSUPP here means we cannot reset the controller
-+ * but it's already (and still) up and running in
-+ * "performant mode". Or, it might be 640x, which can't reset
-+ * due to concerns about shared bbwc between 6402/6404 pair.
-+ */
-+ if (rc == -ENOTSUPP)
-+ return rc; /* just try to do the kdump anyhow. */
-+ if (rc)
- return -ENODEV;
-+
-+ /* Now try to get the controller to respond to a no-op */
-+ dev_warn(&pdev->dev, "Waiting for controller to respond to no-op\n");
-+ for (i = 0; i < CCISS_POST_RESET_NOOP_RETRIES; i++) {
-+ if (cciss_noop(pdev) == 0)
-+ break;
-+ else
-+ dev_warn(&pdev->dev, "no-op failed%s\n",
-+ (i < CCISS_POST_RESET_NOOP_RETRIES - 1 ?
-+ "; re-trying" : ""));
-+ msleep(CCISS_POST_RESET_NOOP_INTERVAL_MSECS);
- }
-+ return 0;
-+}
-
-- /* Quoting from the Open CISS Specification: "The Power
-- * Management Control/Status Register (CSR) controls the power
-- * state of the device. The normal operating state is D0,
-- * CSR=00h. The software off state is D3, CSR=03h. To reset
-- * the controller, place the interface device in D3 then to
-- * D0, this causes a secondary PCI reset which will reset the
-- * controller." */
--
-- /* enter the D3hot power management state */
-- pci_read_config_word(pdev, pos + PCI_PM_CTRL, &pmcsr);
-- pmcsr &= ~PCI_PM_CTRL_STATE_MASK;
-- pmcsr |= PCI_D3hot;
-- pci_write_config_word(pdev, pos + PCI_PM_CTRL, pmcsr);
--
-- schedule_timeout_uninterruptible(HZ >> 1);
--
-- /* enter the D0 power management state */
-- pmcsr &= ~PCI_PM_CTRL_STATE_MASK;
-- pmcsr |= PCI_D0;
-- pci_write_config_word(pdev, pos + PCI_PM_CTRL, pmcsr);
--
-- schedule_timeout_uninterruptible(HZ >> 1);
--
-- /* Restore the PCI configuration space. The Open CISS
-- * Specification says, "Restore the PCI Configuration
-- * Registers, offsets 00h through 60h. It is important to
-- * restore the command register, 16-bits at offset 04h,
-- * last. Do not restore the configuration status register,
-- * 16-bits at offset 06h." Note that the offset is 2*i. */
-- for (i = 0; i < 32; i++) {
-- if (i == 2 || i == 3)
-- continue;
-- pci_write_config_word(pdev, 2*i, saved_config_space[i]);
-+static __devinit int cciss_allocate_cmd_pool(ctlr_info_t *h)
-+{
-+ h->cmd_pool_bits = kmalloc(
-+ DIV_ROUND_UP(h->nr_cmds, BITS_PER_LONG) *
-+ sizeof(unsigned long), GFP_KERNEL);
-+ h->cmd_pool = pci_alloc_consistent(h->pdev,
-+ h->nr_cmds * sizeof(CommandList_struct),
-+ &(h->cmd_pool_dhandle));
-+ h->errinfo_pool = pci_alloc_consistent(h->pdev,
-+ h->nr_cmds * sizeof(ErrorInfo_struct),
-+ &(h->errinfo_pool_dhandle));
-+ if ((h->cmd_pool_bits == NULL)
-+ || (h->cmd_pool == NULL)
-+ || (h->errinfo_pool == NULL)) {
-+ dev_err(&h->pdev->dev, "out of memory");
-+ return -ENOMEM;
- }
-- wmb();
-- pci_write_config_word(pdev, 4, saved_config_space[2]);
-+ return 0;
-+}
-
-+static __devinit int cciss_allocate_scatterlists(ctlr_info_t *h)
-+{
-+ int i;
-+
-+ /* zero it, so that on free we need not know how many were alloc'ed */
-+ h->scatter_list = kzalloc(h->max_commands *
-+ sizeof(struct scatterlist *), GFP_KERNEL);
-+ if (!h->scatter_list)
-+ return -ENOMEM;
-+
-+ for (i = 0; i < h->nr_cmds; i++) {
-+ h->scatter_list[i] = kmalloc(sizeof(struct scatterlist) *
-+ h->maxsgentries, GFP_KERNEL);
-+ if (h->scatter_list[i] == NULL) {
-+ dev_err(&h->pdev->dev, "could not allocate "
-+ "s/g lists\n");
-+ return -ENOMEM;
-+ }
-+ }
- return 0;
- }
-
-+static void cciss_free_scatterlists(ctlr_info_t *h)
-+{
-+ int i;
-+
-+ if (h->scatter_list) {
-+ for (i = 0; i < h->nr_cmds; i++)
-+ kfree(h->scatter_list[i]);
-+ kfree(h->scatter_list);
-+ }
-+}
-+
-+static void cciss_free_cmd_pool(ctlr_info_t *h)
-+{
-+ kfree(h->cmd_pool_bits);
-+ if (h->cmd_pool)
-+ pci_free_consistent(h->pdev,
-+ h->nr_cmds * sizeof(CommandList_struct),
-+ h->cmd_pool, h->cmd_pool_dhandle);
-+ if (h->errinfo_pool)
-+ pci_free_consistent(h->pdev,
-+ h->nr_cmds * sizeof(ErrorInfo_struct),
-+ h->errinfo_pool, h->errinfo_pool_dhandle);
-+}
-+
-+static int cciss_request_irq(ctlr_info_t *h,
-+ irqreturn_t (*msixhandler)(int, void *),
-+ irqreturn_t (*intxhandler)(int, void *))
-+{
-+ if (h->msix_vector || h->msi_vector) {
-+ if (!request_irq(h->intr[h->intr_mode], msixhandler,
-+ IRQF_DISABLED, h->devname, h))
-+ return 0;
-+ dev_err(&h->pdev->dev, "Unable to get msi irq %d"
-+ " for %s\n", h->intr[h->intr_mode],
-+ h->devname);
-+ return -1;
-+ }
-+
-+ if (!request_irq(h->intr[h->intr_mode], intxhandler,
-+ IRQF_DISABLED | IRQF_SHARED, h->devname, h))
-+ return 0;
-+ dev_err(&h->pdev->dev, "Unable to get irq %d for %s\n",
-+ h->intr[h->intr_mode], h->devname);
-+ return -1;
-+}
-+
-+static int __devinit cciss_kdump_soft_reset(ctlr_info_t *h)
-+{
-+ if (cciss_send_reset(h, CTLR_LUNID, CCISS_RESET_TYPE_CONTROLLER)) {
-+ dev_warn(&h->pdev->dev, "Resetting array controller failed.\n");
-+ return -EIO;
-+ }
-+
-+ dev_info(&h->pdev->dev, "Waiting for board to soft reset.\n");
-+ if (cciss_wait_for_board_state(h->pdev, h->vaddr, BOARD_NOT_READY)) {
-+ dev_warn(&h->pdev->dev, "Soft reset had no effect.\n");
-+ return -1;
-+ }
-+
-+ dev_info(&h->pdev->dev, "Board reset, awaiting READY status.\n");
-+ if (cciss_wait_for_board_state(h->pdev, h->vaddr, BOARD_READY)) {
-+ dev_warn(&h->pdev->dev, "Board failed to become ready "
-+ "after soft reset.\n");
-+ return -1;
-+ }
-+
-+ return 0;
-+}
-+
-+static void cciss_undo_allocations_after_kdump_soft_reset(ctlr_info_t *h)
-+{
-+ int ctlr = h->ctlr;
-+
-+ free_irq(h->intr[h->intr_mode], h);
-+#ifdef CONFIG_PCI_MSI
-+ if (h->msix_vector)
-+ pci_disable_msix(h->pdev);
-+ else if (h->msi_vector)
-+ pci_disable_msi(h->pdev);
-+#endif /* CONFIG_PCI_MSI */
-+ cciss_free_sg_chain_blocks(h->cmd_sg_list, h->nr_cmds);
-+ cciss_free_scatterlists(h);
-+ cciss_free_cmd_pool(h);
-+ if (h->transtable)
-+ iounmap(h->transtable);
-+ if (h->cfgtable)
-+ iounmap(h->cfgtable);
-+ if (h->vaddr)
-+ iounmap(h->vaddr);
-+ unregister_blkdev(h->major, h->devname);
-+ cciss_destroy_hba_sysfs_entry(h);
-+ pci_release_regions(h->pdev);
-+ kfree(h);
-+ hba[ctlr] = NULL;
-+}
-+
- /*
- * This is it. Find all the controllers and register them. I really hate
- * stealing all these major device numbers.
-@@ -4218,48 +4881,51 @@ static int __devinit cciss_init_one(struct pci_dev *pdev,
- int i;
- int j = 0;
- int rc;
-+ int try_soft_reset = 0;
- int dac, return_code;
- InquiryData_struct *inq_buff;
-+ ctlr_info_t *h;
-+ unsigned long flags;
-
-- if (reset_devices) {
-- /* Reset the controller with a PCI power-cycle */
-- if (cciss_hard_reset_controller(pdev) || cciss_reset_msi(pdev))
-- return -ENODEV;
--
-- /* Now try to get the controller to respond to a no-op. Some
-- devices (notably the HP Smart Array 5i Controller) need
-- up to 30 seconds to respond. */
-- for (i=0; i<30; i++) {
-- if (cciss_noop(pdev) == 0)
-- break;
--
-- schedule_timeout_uninterruptible(HZ);
-- }
-- if (i == 30) {
-- printk(KERN_ERR "cciss: controller seems dead\n");
-- return -EBUSY;
-- }
-+ rc = cciss_init_reset_devices(pdev);
-+ if (rc) {
-+ if (rc != -ENOTSUPP)
-+ return rc;
-+ /* If the reset fails in a particular way (it has no way to do
-+ * a proper hard reset, so returns -ENOTSUPP) we can try to do
-+ * a soft reset once we get the controller configured up to the
-+ * point that it can accept a command.
-+ */
-+ try_soft_reset = 1;
-+ rc = 0;
- }
-
-- i = alloc_cciss_hba();
-+reinit_after_soft_reset:
-+
-+ i = alloc_cciss_hba(pdev);
- if (i < 0)
- return -1;
-
-- hba[i]->busy_initializing = 1;
-- INIT_HLIST_HEAD(&hba[i]->cmpQ);
-- INIT_HLIST_HEAD(&hba[i]->reqQ);
-- mutex_init(&hba[i]->busy_shutting_down);
-+ h = hba[i];
-+ h->pdev = pdev;
-+ h->busy_initializing = 1;
-+ h->intr_mode = cciss_simple_mode ? SIMPLE_MODE_INT : PERF_MODE_INT;
-+ INIT_LIST_HEAD(&h->cmpQ);
-+ INIT_LIST_HEAD(&h->reqQ);
-+ mutex_init(&h->busy_shutting_down);
-
-- if (cciss_pci_init(hba[i], pdev) != 0)
-+ sprintf(h->devname, "cciss%d", i);
-+ h->ctlr = i;
-+
-+ if (cciss_tape_cmds < 2)
-+ cciss_tape_cmds = 2;
-+ if (cciss_tape_cmds > 16)
-+ cciss_tape_cmds = 16;
-+
-+ if (cciss_pci_init(h) != 0)
- goto clean_no_release_regions;
-
-- sprintf(hba[i]->devname, "cciss%d", i);
-- hba[i]->ctlr = i;
-- hba[i]->pdev = pdev;
--
-- init_completion(&hba[i]->scan_wait);
--
-- if (cciss_create_hba_sysfs_entry(hba[i]))
-+ if (cciss_create_hba_sysfs_entry(h))
- goto clean0;
-
- /* configure PCI DMA stuff */
-@@ -4268,7 +4934,7 @@ static int __devinit cciss_init_one(struct pci_dev *pdev,
- else if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(32)))
- dac = 0;
- else {
-- printk(KERN_ERR "cciss: no suitable DMA available\n");
-+ dev_err(&h->pdev->dev, "no suitable DMA available\n");
- goto clean1;
- }
-
-@@ -4278,189 +4944,244 @@ static int __devinit cciss_init_one(struct pci_dev *pdev,
- * 8 controller support.
- */
- if (i < MAX_CTLR_ORIG)
-- hba[i]->major = COMPAQ_CISS_MAJOR + i;
-- rc = register_blkdev(hba[i]->major, hba[i]->devname);
-+ h->major = COMPAQ_CISS_MAJOR + i;
-+ rc = register_blkdev(h->major, h->devname);
- if (rc == -EBUSY || rc == -EINVAL) {
-- printk(KERN_ERR
-- "cciss: Unable to get major number %d for %s "
-- "on hba %d\n", hba[i]->major, hba[i]->devname, i);
-+ dev_err(&h->pdev->dev,
-+ "Unable to get major number %d for %s "
-+ "on hba %d\n", h->major, h->devname, i);
- goto clean1;
- } else {
- if (i >= MAX_CTLR_ORIG)
-- hba[i]->major = rc;
-+ h->major = rc;
- }
-
- /* make sure the board interrupts are off */
-- hba[i]->access.set_intr_mask(hba[i], CCISS_INTR_OFF);
-- if (request_irq(hba[i]->intr[SIMPLE_MODE_INT], do_cciss_intr,
-- IRQF_DISABLED | IRQF_SHARED, hba[i]->devname, hba[i])) {
-- printk(KERN_ERR "cciss: Unable to get irq %d for %s\n",
-- hba[i]->intr[SIMPLE_MODE_INT], hba[i]->devname);
-+ h->access->set_intr_mask(h, CCISS_INTR_OFF);
-+ rc = cciss_request_irq(h, do_cciss_msix_intr, do_cciss_intx);
-+ if (rc)
- goto clean2;
-- }
-
-- printk(KERN_INFO "%s: <0x%x> at PCI %s IRQ %d%s using DAC\n",
-- hba[i]->devname, pdev->device, pci_name(pdev),
-- hba[i]->intr[SIMPLE_MODE_INT], dac ? "" : " not");
-+ dev_info(&h->pdev->dev, "%s: <0x%x> at PCI %s IRQ %d%s using DAC\n",
-+ h->devname, pdev->device, pci_name(pdev),
-+ h->intr[h->intr_mode], dac ? "" : " not");
-
-- hba[i]->cmd_pool_bits =
-- kmalloc(DIV_ROUND_UP(hba[i]->nr_cmds, BITS_PER_LONG)
-- * sizeof(unsigned long), GFP_KERNEL);
-- hba[i]->cmd_pool = (CommandList_struct *)
-- pci_alloc_consistent(hba[i]->pdev,
-- hba[i]->nr_cmds * sizeof(CommandList_struct),
-- &(hba[i]->cmd_pool_dhandle));
-- hba[i]->errinfo_pool = (ErrorInfo_struct *)
-- pci_alloc_consistent(hba[i]->pdev,
-- hba[i]->nr_cmds * sizeof(ErrorInfo_struct),
-- &(hba[i]->errinfo_pool_dhandle));
-- if ((hba[i]->cmd_pool_bits == NULL)
-- || (hba[i]->cmd_pool == NULL)
-- || (hba[i]->errinfo_pool == NULL)) {
-- printk(KERN_ERR "cciss: out of memory");
-+ if (cciss_allocate_cmd_pool(h))
- goto clean4;
-- }
-- spin_lock_init(&hba[i]->lock);
-+
-+ if (cciss_allocate_scatterlists(h))
-+ goto clean4;
-+
-+ h->cmd_sg_list = cciss_allocate_sg_chain_blocks(h,
-+ h->chainsize, h->nr_cmds);
-+ if (!h->cmd_sg_list && h->chainsize > 0)
-+ goto clean4;
-+
-+ spin_lock_init(&h->lock);
-
- /* Initialize the pdev driver private data.
-- have it point to hba[i]. */
-- pci_set_drvdata(pdev, hba[i]);
-+ have it point to h. */
-+ pci_set_drvdata(pdev, h);
- /* command and error info recs zeroed out before
- they are used */
-- memset(hba[i]->cmd_pool_bits, 0,
-- DIV_ROUND_UP(hba[i]->nr_cmds, BITS_PER_LONG)
-+ memset(h->cmd_pool_bits, 0,
-+ DIV_ROUND_UP(h->nr_cmds, BITS_PER_LONG)
- * sizeof(unsigned long));
-
-- hba[i]->num_luns = 0;
-- hba[i]->highest_lun = -1;
-+ h->num_luns = 0;
-+ h->highest_lun = -1;
- for (j = 0; j < CISS_MAX_LUN; j++) {
-- hba[i]->drv[j] = NULL;
-- hba[i]->gendisk[j] = NULL;
-+ h->drv[j] = NULL;
-+ h->gendisk[j] = NULL;
- }
-
-- cciss_scsi_setup(i);
-+ /* At this point, the controller is ready to take commands.
-+ * Now, if reset_devices and the hard reset didn't work, try
-+ * the soft reset and see if that works.
-+ */
-+ if (try_soft_reset) {
-+
-+ /* This is kind of gross. We may or may not get a completion
-+ * from the soft reset command, and if we do, then the value
-+ * from the fifo may or may not be valid. So, we wait 10 secs
-+ * after the reset throwing away any completions we get during
-+ * that time. Unregister the interrupt handler and register
-+ * fake ones to scoop up any residual completions.
-+ */
-+ spin_lock_irqsave(&h->lock, flags);
-+ h->access->set_intr_mask(h, CCISS_INTR_OFF);
-+ spin_unlock_irqrestore(&h->lock, flags);
-+ free_irq(h->intr[h->intr_mode], h);
-+ rc = cciss_request_irq(h, cciss_msix_discard_completions,
-+ cciss_intx_discard_completions);
-+ if (rc) {
-+ dev_warn(&h->pdev->dev, "Failed to request_irq after "
-+ "soft reset.\n");
-+ goto clean4;
-+ }
-+
-+ rc = cciss_kdump_soft_reset(h);
-+ if (rc) {
-+ dev_warn(&h->pdev->dev, "Soft reset failed.\n");
-+ goto clean4;
-+ }
-+
-+ dev_info(&h->pdev->dev, "Board READY.\n");
-+ dev_info(&h->pdev->dev,
-+ "Waiting for stale completions to drain.\n");
-+ h->access->set_intr_mask(h, CCISS_INTR_ON);
-+ msleep(10000);
-+ h->access->set_intr_mask(h, CCISS_INTR_OFF);
-+
-+ rc = controller_reset_failed(h->cfgtable);
-+ if (rc)
-+ dev_info(&h->pdev->dev,
-+ "Soft reset appears to have failed.\n");
-+
-+ /* since the controller's reset, we have to go back and re-init
-+ * everything. Easiest to just forget what we've done and do it
-+ * all over again.
-+ */
-+ cciss_undo_allocations_after_kdump_soft_reset(h);
-+ try_soft_reset = 0;
-+ if (rc)
-+ /* don't go to clean4, we already unallocated */
-+ return -ENODEV;
-+
-+ goto reinit_after_soft_reset;
-+ }
-+
-+ cciss_scsi_setup(h);
-
- /* Turn the interrupts on so we can service requests */
-- hba[i]->access.set_intr_mask(hba[i], CCISS_INTR_ON);
-+ h->access->set_intr_mask(h, CCISS_INTR_ON);
-
- /* Get the firmware version */
- inq_buff = kzalloc(sizeof(InquiryData_struct), GFP_KERNEL);
- if (inq_buff == NULL) {
-- printk(KERN_ERR "cciss: out of memory\n");
-+ dev_err(&h->pdev->dev, "out of memory\n");
- goto clean4;
- }
-
-- return_code = sendcmd_withirq(CISS_INQUIRY, i, inq_buff,
-+ return_code = sendcmd_withirq(h, CISS_INQUIRY, inq_buff,
- sizeof(InquiryData_struct), 0, CTLR_LUNID, TYPE_CMD);
- if (return_code == IO_OK) {
-- hba[i]->firm_ver[0] = inq_buff->data_byte[32];
-- hba[i]->firm_ver[1] = inq_buff->data_byte[33];
-- hba[i]->firm_ver[2] = inq_buff->data_byte[34];
-- hba[i]->firm_ver[3] = inq_buff->data_byte[35];
-+ h->firm_ver[0] = inq_buff->data_byte[32];
-+ h->firm_ver[1] = inq_buff->data_byte[33];
-+ h->firm_ver[2] = inq_buff->data_byte[34];
-+ h->firm_ver[3] = inq_buff->data_byte[35];
- } else { /* send command failed */
-- printk(KERN_WARNING "cciss: unable to determine firmware"
-+ dev_warn(&h->pdev->dev, "unable to determine firmware"
- " version of controller\n");
- }
- kfree(inq_buff);
-
-- cciss_procinit(i);
-+ cciss_procinit(h);
-
-- hba[i]->cciss_max_sectors = 2048;
-+ h->cciss_max_sectors = 8192;
-
-- rebuild_lun_table(hba[i], 1, 0);
-- hba[i]->busy_initializing = 0;
-+ rebuild_lun_table(h, 1, 0);
-+ cciss_engage_scsi(h);
-+ h->busy_initializing = 0;
- return 1;
-
- clean4:
-- kfree(hba[i]->cmd_pool_bits);
-- if (hba[i]->cmd_pool)
-- pci_free_consistent(hba[i]->pdev,
-- hba[i]->nr_cmds * sizeof(CommandList_struct),
-- hba[i]->cmd_pool, hba[i]->cmd_pool_dhandle);
-- if (hba[i]->errinfo_pool)
-- pci_free_consistent(hba[i]->pdev,
-- hba[i]->nr_cmds * sizeof(ErrorInfo_struct),
-- hba[i]->errinfo_pool,
-- hba[i]->errinfo_pool_dhandle);
-- free_irq(hba[i]->intr[SIMPLE_MODE_INT], hba[i]);
-+ cciss_free_cmd_pool(h);
-+ cciss_free_scatterlists(h);
-+ cciss_free_sg_chain_blocks(h->cmd_sg_list, h->nr_cmds);
-+ free_irq(h->intr[h->intr_mode], h);
- clean2:
-- unregister_blkdev(hba[i]->major, hba[i]->devname);
-+ unregister_blkdev(h->major, h->devname);
- clean1:
-- cciss_destroy_hba_sysfs_entry(hba[i]);
-+ cciss_destroy_hba_sysfs_entry(h);
- clean0:
- pci_release_regions(pdev);
- clean_no_release_regions:
-- hba[i]->busy_initializing = 0;
-+ h->busy_initializing = 0;
-
- /*
- * Deliberately omit pci_disable_device(): it does something nasty to
- * Smart Array controllers that pci_enable_device does not undo
- */
- pci_set_drvdata(pdev, NULL);
-- free_hba(i);
-+ free_hba(h);
- return -1;
- }
-
- static void cciss_shutdown(struct pci_dev *pdev)
- {
-- ctlr_info_t *tmp_ptr;
-- int i;
-- char flush_buf[4];
-+ ctlr_info_t *h;
-+ char *flush_buf;
- int return_code;
-
-- tmp_ptr = pci_get_drvdata(pdev);
-- if (tmp_ptr == NULL)
-+ h = pci_get_drvdata(pdev);
-+ flush_buf = kzalloc(4, GFP_KERNEL);
-+ if (!flush_buf) {
-+ dev_warn(&h->pdev->dev, "cache not flushed, out of memory.\n");
- return;
-- i = tmp_ptr->ctlr;
-- if (hba[i] == NULL)
-- return;
--
-- /* Turn board interrupts off and send the flush cache command */
-- /* sendcmd will turn off interrupt, and send the flush...
-- * To write all data in the battery backed cache to disks */
-+ }
-+ /* write all data in the battery backed cache to disk */
- memset(flush_buf, 0, 4);
-- return_code = sendcmd(CCISS_CACHE_FLUSH, i, flush_buf, 4, 0,
-- CTLR_LUNID, TYPE_CMD);
-- if (return_code == IO_OK) {
-- printk(KERN_INFO "Completed flushing cache on controller %d\n", i);
-- } else {
-- printk(KERN_WARNING "Error flushing cache on controller %d\n", i);
-+ return_code = sendcmd_withirq(h, CCISS_CACHE_FLUSH, flush_buf,
-+ 4, 0, CTLR_LUNID, TYPE_CMD);
-+ kfree(flush_buf);
-+ if (return_code != IO_OK)
-+ dev_warn(&h->pdev->dev, "Error flushing cache\n");
-+ h->access->set_intr_mask(h, CCISS_INTR_OFF);
-+ free_irq(h->intr[h->intr_mode], h);
-+}
-+
-+static int __devinit cciss_enter_simple_mode(struct ctlr_info *h)
-+{
-+ u32 trans_support;
-+
-+ trans_support = readl(&(h->cfgtable->TransportSupport));
-+ if (!(trans_support & SIMPLE_MODE))
-+ return -ENOTSUPP;
-+
-+ h->max_commands = readl(&(h->cfgtable->CmdsOutMax));
-+ writel(CFGTBL_Trans_Simple, &(h->cfgtable->HostWrite.TransportRequest));
-+ writel(CFGTBL_ChangeReq, h->vaddr + SA5_DOORBELL);
-+ cciss_wait_for_mode_change_ack(h);
-+ print_cfg_table(h);
-+ if (!(readl(&(h->cfgtable->TransportActive)) & CFGTBL_Trans_Simple)) {
-+ dev_warn(&h->pdev->dev, "unable to get board into simple mode\n");
-+ return -ENODEV;
- }
-- free_irq(hba[i]->intr[2], hba[i]);
-+ h->transMethod = CFGTBL_Trans_Simple;
-+ return 0;
- }
-
-+
- static void __devexit cciss_remove_one(struct pci_dev *pdev)
- {
-- ctlr_info_t *tmp_ptr;
-+ ctlr_info_t *h;
- int i, j;
-
- if (pci_get_drvdata(pdev) == NULL) {
-- printk(KERN_ERR "cciss: Unable to remove device \n");
-+ dev_err(&pdev->dev, "Unable to remove device\n");
- return;
- }
-
-- tmp_ptr = pci_get_drvdata(pdev);
-- i = tmp_ptr->ctlr;
-+ h = pci_get_drvdata(pdev);
-+ i = h->ctlr;
- if (hba[i] == NULL) {
-- printk(KERN_ERR "cciss: device appears to "
-- "already be removed \n");
-+ dev_err(&pdev->dev, "device appears to already be removed \n");
- return;
- }
-
-- mutex_lock(&hba[i]->busy_shutting_down);
--
-- remove_from_scan_list(hba[i]);
-- remove_proc_entry(hba[i]->devname, proc_cciss);
-- unregister_blkdev(hba[i]->major, hba[i]->devname);
-+ mutex_lock(&h->busy_shutting_down);
-+ remove_proc_entry(h->devname, proc_cciss);
-+ unregister_blkdev(h->major, h->devname);
-
- /* remove it from the disk list */
- for (j = 0; j < CISS_MAX_LUN; j++) {
-- struct gendisk *disk = hba[i]->gendisk[j];
-+ struct gendisk *disk = h->gendisk[j];
- if (disk) {
- struct request_queue *q = disk->queue;
-
- if (disk->flags & GENHD_FL_UP) {
-- cciss_destroy_ld_sysfs_entry(hba[i], j, 1);
-+ cciss_destroy_ld_sysfs_entry(h, j, 1);
- del_gendisk(disk);
- }
- if (q)
-@@ -4469,34 +5190,41 @@ static void __devexit cciss_remove_one(struct pci_dev *pdev)
- }
-
- #ifdef CONFIG_CISS_SCSI_TAPE
-- cciss_unregister_scsi(i); /* unhook from SCSI subsystem */
-+ cciss_unregister_scsi(h); /* unhook from SCSI subsystem */
- #endif
-
- cciss_shutdown(pdev);
-
- #ifdef CONFIG_PCI_MSI
-- if (hba[i]->msix_vector)
-- pci_disable_msix(hba[i]->pdev);
-- else if (hba[i]->msi_vector)
-- pci_disable_msi(hba[i]->pdev);
-+ if (h->msix_vector)
-+ pci_disable_msix(h->pdev);
-+ else if (h->msi_vector)
-+ pci_disable_msi(h->pdev);
- #endif /* CONFIG_PCI_MSI */
-
-- iounmap(hba[i]->vaddr);
-+ iounmap(h->transtable);
-+ iounmap(h->cfgtable);
-+ iounmap(h->vaddr);
-
-- pci_free_consistent(hba[i]->pdev, hba[i]->nr_cmds * sizeof(CommandList_struct),
-- hba[i]->cmd_pool, hba[i]->cmd_pool_dhandle);
-- pci_free_consistent(hba[i]->pdev, hba[i]->nr_cmds * sizeof(ErrorInfo_struct),
-- hba[i]->errinfo_pool, hba[i]->errinfo_pool_dhandle);
-- kfree(hba[i]->cmd_pool_bits);
-+ cciss_free_cmd_pool(h);
-+ /* Free up sg elements */
-+ for (j = 0; j < h->nr_cmds; j++)
-+ kfree(h->scatter_list[j]);
-+ kfree(h->scatter_list);
-+ cciss_free_sg_chain_blocks(h->cmd_sg_list, h->nr_cmds);
-+ kfree(h->blockFetchTable);
-+ if (h->reply_pool)
-+ pci_free_consistent(h->pdev, h->max_commands * sizeof(__u64),
-+ h->reply_pool, h->reply_pool_dhandle);
- /*
- * Deliberately omit pci_disable_device(): it does something nasty to
- * Smart Array controllers that pci_enable_device does not undo
- */
- pci_release_regions(pdev);
- pci_set_drvdata(pdev, NULL);
-- cciss_destroy_hba_sysfs_entry(hba[i]);
-- mutex_unlock(&hba[i]->busy_shutting_down);
-- free_hba(i);
-+ cciss_destroy_hba_sysfs_entry(h);
-+ mutex_unlock(&h->busy_shutting_down);
-+ free_hba(h);
- }
-
- static struct pci_driver cciss_pci_driver = {
-@@ -4520,33 +5248,21 @@ static int __init cciss_init(void)
- * boundary. Given that we use pci_alloc_consistent() to allocate an
- * array of them, the size must be a multiple of 8 bytes.
- */
-- BUILD_BUG_ON(sizeof(CommandList_struct) % 8);
--
-+ BUILD_BUG_ON(sizeof(CommandList_struct) % COMMANDLIST_ALIGNMENT);
- printk(KERN_INFO DRIVER_NAME "\n");
-
- err = bus_register(&cciss_bus_type);
- if (err)
- return err;
-
-- /* Start the scan thread */
-- cciss_scan_thread = kthread_run(scan_thread, NULL, "cciss_scan");
-- if (IS_ERR(cciss_scan_thread)) {
-- err = PTR_ERR(cciss_scan_thread);
-- goto err_bus_unregister;
-- }
--
- /* Register for our PCI devices */
- err = pci_register_driver(&cciss_pci_driver);
- if (err)
-- goto err_thread_stop;
--
-+ goto err_bus_unregister;
- return err;
-
--err_thread_stop:
-- kthread_stop(cciss_scan_thread);
- err_bus_unregister:
- bus_unregister(&cciss_bus_type);
--
- return err;
- }
-
-@@ -4558,55 +5274,55 @@ static void __exit cciss_cleanup(void)
- /* double check that all controller entrys have been removed */
- for (i = 0; i < MAX_CTLR; i++) {
- if (hba[i] != NULL) {
-- printk(KERN_WARNING "cciss: had to remove"
-- " controller %d\n", i);
-+ dev_warn(&hba[i]->pdev->dev,
-+ "had to remove controller\n");
- cciss_remove_one(hba[i]->pdev);
- }
- }
-- kthread_stop(cciss_scan_thread);
-- remove_proc_entry("driver/cciss", NULL);
-+ if (proc_cciss)
-+ remove_proc_entry("driver/cciss", NULL);
- bus_unregister(&cciss_bus_type);
- }
-
--static void fail_all_cmds(unsigned long ctlr)
-+static void cciss_sysfs_stat_inquiry(ctlr_info_t *h, int logvol,
-+ drive_info_struct *drv)
- {
-- /* If we get here, the board is apparently dead. */
-- ctlr_info_t *h = hba[ctlr];
-- CommandList_struct *c;
-- unsigned long flags;
-+ int return_code;
-+ InquiryData_struct *inq_buff;
-+ unsigned char scsi3addr[8];
-
-- printk(KERN_WARNING "cciss%d: controller not responding.\n", h->ctlr);
-- h->alive = 0; /* the controller apparently died... */
-+ /* If there are no heads then this is the controller disk and
-+ * not a valid logical drive so don't query it.
-+ */
-+ if (!drv->heads)
-+ return;
-
-- spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
--
-- pci_disable_device(h->pdev); /* Make sure it is really dead. */
--
-- /* move everything off the request queue onto the completed queue */
-- while (!hlist_empty(&h->reqQ)) {
-- c = hlist_entry(h->reqQ.first, CommandList_struct, list);
-- removeQ(c);
-- h->Qdepth--;
-- addQ(&h->cmpQ, c);
-+ inq_buff = kzalloc(sizeof(InquiryData_struct), GFP_KERNEL);
-+ if (!inq_buff) {
-+ dev_err(&h->pdev->dev, "out of memory\n");
-+ goto err;
- }
--
-- /* Now, fail everything on the completed queue with a HW error */
-- while (!hlist_empty(&h->cmpQ)) {
-- c = hlist_entry(h->cmpQ.first, CommandList_struct, list);
-- removeQ(c);
-- if (c->cmd_type != CMD_MSG_STALE)
-- c->err_info->CommandStatus = CMD_HARDWARE_ERR;
-- if (c->cmd_type == CMD_RWREQ) {
-- complete_command(h, c, 0);
-- } else if (c->cmd_type == CMD_IOCTL_PEND)
-- complete(c->waiting);
--#ifdef CONFIG_CISS_SCSI_TAPE
-- else if (c->cmd_type == CMD_SCSI)
-- complete_scsi_command(c, 0, 0);
--#endif
-+ log_unit_to_scsi3addr(h, scsi3addr, logvol);
-+ return_code = sendcmd_withirq(h, CISS_INQUIRY, inq_buff, sizeof(*inq_buff), 0,
-+ scsi3addr, TYPE_CMD);
-+ if (return_code == IO_OK) {
-+ memcpy(drv->vendor, &inq_buff->data_byte[8], 8);
-+ drv->vendor[8]='\0';
-+ memcpy(drv->model, &inq_buff->data_byte[16], 16);
-+ drv->model[16] = '\0';
-+ memcpy(drv->rev, &inq_buff->data_byte[32], 4);
-+ drv->rev[4] = '\0';
-+ } else { /* Get geometry failed */
-+ dev_warn(&h->pdev->dev, "inquiry for VPD page 0 failed\n");
- }
-- spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
-- return;
-+ kfree(inq_buff);
-+ cciss_get_uid(h, logvol, drv->uid, sizeof(drv->uid));
-+
-+err:
-+ drv->vendor[8] = '\0';
-+ drv->model[16] = '\0';
-+ drv->rev[4] = '\0';
-+
- }
-
- module_init(cciss_init);
-diff --git a/drivers/block/cciss.h b/drivers/block/cciss.h
-index 04d6bf8..ad6d020 100644
---- a/drivers/block/cciss.h
-+++ b/drivers/block/cciss.h
-@@ -25,12 +25,13 @@ struct access_method {
- void (*submit_command)(ctlr_info_t *h, CommandList_struct *c);
- void (*set_intr_mask)(ctlr_info_t *h, unsigned long val);
- unsigned long (*fifo_full)(ctlr_info_t *h);
-- unsigned long (*intr_pending)(ctlr_info_t *h);
-+ bool (*intr_pending)(ctlr_info_t *h);
- unsigned long (*command_completed)(ctlr_info_t *h);
- };
- typedef struct _drive_info_struct
- {
-- unsigned char LunID[8];
-+ unsigned char LunID[8];
-+#define CCISS_HBA_LUNID "\0\0\0\0\0\0\0\0"
- int usage_count;
- struct request_queue *queue;
- sector_t nr_blocks;
-@@ -40,27 +41,31 @@ typedef struct _drive_info_struct
- int cylinders;
- int raid_level; /* set to -1 to indicate that
- * the drive is not in use/configured
-- */
-- int busy_configuring; /* This is set when a drive is being removed
-- * to prevent it from being opened or it's
-- * queue from being started.
-- */
-- struct device dev;
-- __u8 serial_no[16]; /* from inquiry page 0x83,
-- * not necc. null terminated.
-- */
-+ */
-+ int busy_configuring; /*This is set when the drive is being removed
-+ *to prevent it from being opened or it's queue
-+ *from being started.
-+ */
-+ struct device dev;
-+ __u8 uid[16]; /* from inquiry page 0x83, */
-+ /* not necc. null terminated. */
- char vendor[VENDOR_LEN + 1]; /* SCSI vendor string */
- char model[MODEL_LEN + 1]; /* SCSI model string */
- char rev[REV_LEN + 1]; /* SCSI revision string */
- char device_initialized; /* indicates whether dev is initialized */
- } drive_info_struct;
-
--struct ctlr_info
-+struct Cmd_sg_list {
-+ dma_addr_t sg_chain_dma;
-+ int chain_block_size;
-+};
-+
-+struct ctlr_info
- {
- int ctlr;
- char devname[8];
- char *product_name;
-- char firm_ver[4]; // Firmware version
-+ char firm_ver[4]; /* Firmware version */
- struct pci_dev *pdev;
- __u32 board_id;
- void __iomem *vaddr;
-@@ -71,68 +76,91 @@ struct ctlr_info
- int major;
- int max_commands;
- int commands_outstanding;
-- int max_outstanding; /* Debug */
-+ int max_outstanding; /* Debug */
- int num_luns;
- int highest_lun;
- int usage_count; /* number of opens all all minor devices */
--# define DOORBELL_INT 0
--# define PERF_MODE_INT 1
-+ /* Need space for temp sg list
-+ * number of scatter/gathers supported
-+ * number of scatter/gathers in chained block
-+ */
-+ struct scatterlist **scatter_list;
-+ int maxsgentries;
-+ int chainsize;
-+ int max_cmd_sgentries;
-+ SGDescriptor_struct **cmd_sg_list;
-+
-+# define PERF_MODE_INT 0
-+# define DOORBELL_INT 1
- # define SIMPLE_MODE_INT 2
- # define MEMQ_MODE_INT 3
- unsigned int intr[4];
- unsigned int msix_vector;
- unsigned int msi_vector;
-+ int intr_mode;
- int cciss_max_sectors;
- BYTE cciss_read;
- BYTE cciss_write;
- BYTE cciss_read_capacity;
-
-- // information about each logical volume
-+ /* information about each logical volume */
- drive_info_struct *drv[CISS_MAX_LUN];
-
-- struct access_method access;
-+ struct access_method *access;
-
-- /* queue and queue Info */
-- struct hlist_head reqQ;
-- struct hlist_head cmpQ;
-+ /* queue and queue Info */
-+ struct list_head reqQ;
-+ struct list_head cmpQ;
- unsigned int Qdepth;
- unsigned int maxQsinceinit;
- unsigned int maxSG;
- spinlock_t lock;
-
-- //* pointers to command and error info pool */
-+ /* pointers to command and error info pool */
- CommandList_struct *cmd_pool;
-- dma_addr_t cmd_pool_dhandle;
-+ dma_addr_t cmd_pool_dhandle;
- ErrorInfo_struct *errinfo_pool;
-- dma_addr_t errinfo_pool_dhandle;
-+ dma_addr_t errinfo_pool_dhandle;
- unsigned long *cmd_pool_bits;
- int nr_allocs;
-- int nr_frees;
-+ int nr_frees;
- int busy_configuring;
- int busy_initializing;
-- int busy_scanning;
-- struct mutex busy_shutting_down;
-+ struct mutex busy_shutting_down;
-
- /* This element holds the zero based queue number of the last
- * queue to be started. It is used for fairness.
- */
- int next_to_run;
-
-- // Disk structures we need to pass back
-+ /* Disk structures we need to pass back */
- struct gendisk *gendisk[CISS_MAX_LUN];
- #ifdef CONFIG_CISS_SCSI_TAPE
-- void *scsi_ctlr; /* ptr to structure containing scsi related stuff */
-- /* list of block side commands the scsi error handling sucked up */
-- /* and saved for later processing */
-+ struct cciss_scsi_adapter_data_t *scsi_ctlr;
- #endif
- unsigned char alive;
-- struct list_head scan_list;
-- struct completion scan_wait;
- struct device dev;
-+ /*
-+ * Performant mode tables.
-+ */
-+ u32 trans_support;
-+ u32 trans_offset;
-+ struct TransTable_struct *transtable;
-+ unsigned long transMethod;
-+
-+ /*
-+ * Performant mode completion buffer
-+ */
-+ u64 *reply_pool;
-+ dma_addr_t reply_pool_dhandle;
-+ u64 *reply_pool_head;
-+ size_t reply_pool_size;
-+ unsigned char reply_pool_wraparound;
-+ u32 *blockFetchTable;
- };
-
--/* Defining the diffent access_menthods */
--/*
-+/* Defining the diffent access_methods
-+ *
- * Memory mapped FIFO interface (SMART 53xx cards)
- */
- #define SA5_DOORBELL 0x20
-@@ -151,42 +179,77 @@ struct ctlr_info
- #define SA5B_INTR_PENDING 0x04
- #define FIFO_EMPTY 0xffffffff
- #define CCISS_FIRMWARE_READY 0xffff0000 /* value in scratchpad register */
-+/* Perf. mode flags */
-+#define SA5_PERF_INTR_PENDING 0x04
-+#define SA5_PERF_INTR_OFF 0x05
-+#define SA5_OUTDB_STATUS_PERF_BIT 0x01
-+#define SA5_OUTDB_CLEAR_PERF_BIT 0x01
-+#define SA5_OUTDB_CLEAR 0xA0
-+#define SA5_OUTDB_CLEAR_PERF_BIT 0x01
-+#define SA5_OUTDB_STATUS 0x9C
-+
-
- #define CISS_ERROR_BIT 0x02
-
--#define CCISS_INTR_ON 1
-+#define CCISS_INTR_ON 1
- #define CCISS_INTR_OFF 0
--/*
-- Send the command to the hardware
-+
-+
-+/* CCISS_BOARD_READY_WAIT_SECS is how long to wait for a board
-+ * to become ready, in seconds, before giving up on it.
-+ * CCISS_BOARD_READY_POLL_INTERVAL_MSECS * is how long to wait
-+ * between polling the board to see if it is ready, in
-+ * milliseconds. CCISS_BOARD_READY_ITERATIONS is derived
-+ * the above.
-+ */
-+#define CCISS_BOARD_READY_WAIT_SECS (120)
-+#define CCISS_BOARD_NOT_READY_WAIT_SECS (100)
-+#define CCISS_BOARD_READY_POLL_INTERVAL_MSECS (100)
-+#define CCISS_BOARD_READY_ITERATIONS \
-+ ((CCISS_BOARD_READY_WAIT_SECS * 1000) / \
-+ CCISS_BOARD_READY_POLL_INTERVAL_MSECS)
-+#define CCISS_BOARD_NOT_READY_ITERATIONS \
-+ ((CCISS_BOARD_NOT_READY_WAIT_SECS * 1000) / \
-+ CCISS_BOARD_READY_POLL_INTERVAL_MSECS)
-+#define CCISS_POST_RESET_PAUSE_MSECS (3000)
-+#define CCISS_POST_RESET_NOOP_INTERVAL_MSECS (1000)
-+#define CCISS_POST_RESET_NOOP_RETRIES (12)
-+#define CCISS_POST_RESET_NOOP_TIMEOUT_MSECS (10000)
-+
-+/*
-+ Send the command to the hardware
- */
--static void SA5_submit_command( ctlr_info_t *h, CommandList_struct *c)
-+static void SA5_submit_command( ctlr_info_t *h, CommandList_struct *c)
- {
- #ifdef CCISS_DEBUG
-- printk("Sending %x - down to controller\n", c->busaddr );
--#endif /* CCISS_DEBUG */
-- writel(c->busaddr, h->vaddr + SA5_REQUEST_PORT_OFFSET);
-- readl(h->vaddr + SA5_SCRATCHPAD_OFFSET);
-- h->commands_outstanding++;
-- if ( h->commands_outstanding > h->max_outstanding)
-+ printk(KERN_WARNING "cciss%d: Sending %08x - down to controller\n",
-+ h->ctlr, c->busaddr);
-+#endif /* CCISS_DEBUG */
-+ writel(c->busaddr, h->vaddr + SA5_REQUEST_PORT_OFFSET);
-+ (void) readl(h->vaddr + SA5_SCRATCHPAD_OFFSET);
-+ h->commands_outstanding++;
-+ if ( h->commands_outstanding > h->max_outstanding)
- h->max_outstanding = h->commands_outstanding;
- }
-
--/*
-- * This card is the opposite of the other cards.
-- * 0 turns interrupts on...
-- * 0x08 turns them off...
-+/*
-+ * This card is the opposite of the other cards.
-+ * 0 turns interrupts on...
-+ * 0x08 turns them off...
- */
- static void SA5_intr_mask(ctlr_info_t *h, unsigned long val)
- {
-- if (val)
-+ if (val)
- { /* Turn interrupts on */
- h->interrupts_enabled = 1;
- writel(0, h->vaddr + SA5_REPLY_INTR_MASK_OFFSET);
-+ (void) readl(h->vaddr + SA5_REPLY_INTR_MASK_OFFSET);
- } else /* Turn them off */
- {
- h->interrupts_enabled = 0;
-- writel( SA5_INTR_OFF,
-+ writel( SA5_INTR_OFF,
- h->vaddr + SA5_REPLY_INTR_MASK_OFFSET);
-+ (void) readl(h->vaddr + SA5_REPLY_INTR_MASK_OFFSET);
- }
- }
- /*
-@@ -200,60 +263,112 @@ static void SA5B_intr_mask(ctlr_info_t *h, unsigned long val)
- { /* Turn interrupts on */
- h->interrupts_enabled = 1;
- writel(0, h->vaddr + SA5_REPLY_INTR_MASK_OFFSET);
-+ (void) readl(h->vaddr + SA5_REPLY_INTR_MASK_OFFSET);
- } else /* Turn them off */
- {
- h->interrupts_enabled = 0;
- writel( SA5B_INTR_OFF,
- h->vaddr + SA5_REPLY_INTR_MASK_OFFSET);
-+ (void) readl(h->vaddr + SA5_REPLY_INTR_MASK_OFFSET);
- }
- }
-+
-+/* Performant mode intr_mask */
-+static void SA5_performant_intr_mask(ctlr_info_t *h, unsigned long val)
-+{
-+ if (val) { /* turn on interrupts */
-+ h->interrupts_enabled = 1;
-+ writel(0, h->vaddr + SA5_REPLY_INTR_MASK_OFFSET);
-+ (void) readl(h->vaddr + SA5_REPLY_INTR_MASK_OFFSET);
-+ } else {
-+ h->interrupts_enabled = 0;
-+ writel(SA5_PERF_INTR_OFF,
-+ h->vaddr + SA5_REPLY_INTR_MASK_OFFSET);
-+ (void) readl(h->vaddr + SA5_REPLY_INTR_MASK_OFFSET);
-+ }
-+}
-+
- /*
-- * Returns true if fifo is full.
-- *
-- */
-+ * Returns true if fifo is full.
-+ *
-+ */
- static unsigned long SA5_fifo_full(ctlr_info_t *h)
- {
- if( h->commands_outstanding >= h->max_commands)
- return(1);
-- else
-+ else
- return(0);
-
- }
--/*
-- * returns value read from hardware.
-- * returns FIFO_EMPTY if there is nothing to read
-- */
-+/*
-+ * returns value read from hardware.
-+ * returns FIFO_EMPTY if there is nothing to read
-+ */
- static unsigned long SA5_completed(ctlr_info_t *h)
- {
-- unsigned long register_value
-+ unsigned long register_value
- = readl(h->vaddr + SA5_REPLY_PORT_OFFSET);
- if(register_value != FIFO_EMPTY)
- {
- h->commands_outstanding--;
- #ifdef CCISS_DEBUG
- printk("cciss: Read %lx back from board\n", register_value);
--#endif /* CCISS_DEBUG */
-- }
-+#endif /* CCISS_DEBUG */
-+ }
- #ifdef CCISS_DEBUG
- else
- {
- printk("cciss: FIFO Empty read\n");
- }
--#endif
-- return ( register_value);
-+#endif
-+ return ( register_value);
-
- }
-+
-+/* Performant mode command completed */
-+static unsigned long SA5_performant_completed(ctlr_info_t *h)
-+{
-+ unsigned long register_value = FIFO_EMPTY;
-+
-+ /* flush the controller write of the reply queue by reading
-+ * outbound doorbell status register.
-+ */
-+ register_value = readl(h->vaddr + SA5_OUTDB_STATUS);
-+ /* msi auto clears the interrupt pending bit. */
-+ if (!(h->msi_vector || h->msix_vector)) {
-+ writel(SA5_OUTDB_CLEAR_PERF_BIT, h->vaddr + SA5_OUTDB_CLEAR);
-+ /* Do a read in order to flush the write to the controller
-+ * (as per spec.)
-+ */
-+ register_value = readl(h->vaddr + SA5_OUTDB_STATUS);
-+ }
-+
-+ if ((*(h->reply_pool_head) & 1) == (h->reply_pool_wraparound)) {
-+ register_value = *(h->reply_pool_head);
-+ (h->reply_pool_head)++;
-+ h->commands_outstanding--;
-+ } else {
-+ register_value = FIFO_EMPTY;
-+ }
-+ /* Check for wraparound */
-+ if (h->reply_pool_head == (h->reply_pool + h->max_commands)) {
-+ h->reply_pool_head = h->reply_pool;
-+ h->reply_pool_wraparound ^= 1;
-+ }
-+
-+ return register_value;
-+}
- /*
-- * Returns true if an interrupt is pending..
-+ * Returns true if an interrupt is pending..
- */
--static unsigned long SA5_intr_pending(ctlr_info_t *h)
-+static bool SA5_intr_pending(ctlr_info_t *h)
- {
-- unsigned long register_value =
-+ unsigned long register_value =
- readl(h->vaddr + SA5_INTR_STATUS);
- #ifdef CCISS_DEBUG
- printk("cciss: intr_pending %lx\n", register_value);
- #endif /* CCISS_DEBUG */
-- if( register_value & SA5_INTR_PENDING)
-+ if( register_value & SA5_INTR_PENDING)
- return 1;
- return 0 ;
- }
-@@ -261,7 +376,7 @@ static unsigned long SA5_intr_pending(ctlr_info_t *h)
- /*
- * Returns true if an interrupt is pending..
- */
--static unsigned long SA5B_intr_pending(ctlr_info_t *h)
-+static bool SA5B_intr_pending(ctlr_info_t *h)
- {
- unsigned long register_value =
- readl(h->vaddr + SA5_INTR_STATUS);
-@@ -273,6 +388,20 @@ static unsigned long SA5B_intr_pending(ctlr_info_t *h)
- return 0 ;
- }
-
-+static bool SA5_performant_intr_pending(ctlr_info_t *h)
-+{
-+ unsigned long register_value = readl(h->vaddr + SA5_INTR_STATUS);
-+
-+ if (!register_value)
-+ return false;
-+
-+ if (h->msi_vector || h->msix_vector)
-+ return true;
-+
-+ /* Read outbound doorbell to flush */
-+ register_value = readl(h->vaddr + SA5_OUTDB_STATUS);
-+ return register_value & SA5_OUTDB_STATUS_PERF_BIT;
-+}
-
- static struct access_method SA5_access = {
- SA5_submit_command,
-@@ -290,6 +419,14 @@ static struct access_method SA5B_access = {
- SA5_completed,
- };
-
-+static struct access_method SA5_performant_access = {
-+ SA5_submit_command,
-+ SA5_performant_intr_mask,
-+ SA5_fifo_full,
-+ SA5_performant_intr_pending,
-+ SA5_performant_completed,
-+};
-+
- struct board_type {
- __u32 board_id;
- char *product_name;
-@@ -297,7 +434,4 @@ struct board_type {
- int nr_cmds; /* Max cmds this kind of ctlr can handle. */
- };
-
--#define CCISS_LOCK(i) (&hba[i]->lock)
--
- #endif /* CCISS_H */
--
-diff --git a/drivers/block/cciss_cmd.h b/drivers/block/cciss_cmd.h
-index dbaed1e..0e6584d 100644
---- a/drivers/block/cciss_cmd.h
-+++ b/drivers/block/cciss_cmd.h
-@@ -1,30 +1,16 @@
- #ifndef CCISS_CMD_H
- #define CCISS_CMD_H
--//###########################################################################
--//DEFINES
--//###########################################################################
-+
-+#include <linux/cciss_defs.h>
-+
-+/* DEFINES */
- #define CISS_VERSION "1.00"
-
--//general boundary defintions
--#define SENSEINFOBYTES 32//note that this value may vary between host implementations
--#define MAXSGENTRIES 31
-+/* general boundary definitions */
-+#define MAXSGENTRIES 32
-+#define CCISS_SG_CHAIN 0x80000000
- #define MAXREPLYQS 256
-
--//Command Status value
--#define CMD_SUCCESS 0x0000
--#define CMD_TARGET_STATUS 0x0001
--#define CMD_DATA_UNDERRUN 0x0002
--#define CMD_DATA_OVERRUN 0x0003
--#define CMD_INVALID 0x0004
--#define CMD_PROTOCOL_ERR 0x0005
--#define CMD_HARDWARE_ERR 0x0006
--#define CMD_CONNECTION_LOST 0x0007
--#define CMD_ABORTED 0x0008
--#define CMD_ABORT_FAILED 0x0009
--#define CMD_UNSOLICITED_ABORT 0x000A
--#define CMD_TIMEOUT 0x000B
--#define CMD_UNABORTABLE 0x000C
--
- /* Unit Attentions ASC's as defined for the MSA2012sa */
- #define POWER_OR_RESET 0x29
- #define STATE_CHANGED 0x2a
-@@ -48,30 +34,13 @@
- #define ASYM_ACCESS_CHANGED 0x06
- #define LUN_CAPACITY_CHANGED 0x09
-
--//transfer direction
--#define XFER_NONE 0x00
--#define XFER_WRITE 0x01
--#define XFER_READ 0x02
--#define XFER_RSVD 0x03
--
--//task attribute
--#define ATTR_UNTAGGED 0x00
--#define ATTR_SIMPLE 0x04
--#define ATTR_HEADOFQUEUE 0x05
--#define ATTR_ORDERED 0x06
--#define ATTR_ACA 0x07
--
--//cdb type
--#define TYPE_CMD 0x00
--#define TYPE_MSG 0x01
--
--//config space register offsets
-+/* config space register offsets */
- #define CFG_VENDORID 0x00
- #define CFG_DEVICEID 0x02
- #define CFG_I2OBAR 0x10
- #define CFG_MEM1BAR 0x14
-
--//i2o space register offsets
-+/* i2o space register offsets */
- #define I2O_IBDB_SET 0x20
- #define I2O_IBDB_CLEAR 0x70
- #define I2O_INT_STATUS 0x30
-@@ -80,11 +49,15 @@
- #define I2O_OBPOST_Q 0x44
- #define I2O_DMA1_CFG 0x214
-
--//Configuration Table
-+/* Configuration Table */
- #define CFGTBL_ChangeReq 0x00000001l
- #define CFGTBL_AccCmds 0x00000001l
-+#define DOORBELL_CTLR_RESET 0x00000004l
-+#define DOORBELL_CTLR_RESET2 0x00000020l
-
- #define CFGTBL_Trans_Simple 0x00000002l
-+#define CFGTBL_Trans_Performant 0x00000004l
-+#define CFGTBL_Trans_use_short_tags 0x20000000l
-
- #define CFGTBL_BusType_Ultra2 0x00000001l
- #define CFGTBL_BusType_Ultra3 0x00000002l
-@@ -102,24 +75,17 @@ typedef union _u64bit
- __u64 val;
- } u64bit;
-
--// Type defs used in the following structs
--#define BYTE __u8
--#define WORD __u16
--#define HWORD __u16
--#define DWORD __u32
--#define QWORD vals32
-+/* Type defs used in the following structs */
-+#define QWORD vals32
-
--//###########################################################################
--//STRUCTURES
--//###########################################################################
--#define CISS_MAX_LUN 1024
-+/* STRUCTURES */
- #define CISS_MAX_PHYS_LUN 1024
--// SCSI-3 Cmmands
-+/* SCSI-3 Cmmands */
-
- #pragma pack(1)
-
- #define CISS_INQUIRY 0x12
--//Date returned
-+/* Date returned */
- typedef struct _InquiryData_struct
- {
- BYTE data_byte[36];
-@@ -127,7 +93,7 @@ typedef struct _InquiryData_struct
-
- #define CISS_REPORT_LOG 0xc2 /* Report Logical LUNs */
- #define CISS_REPORT_PHYS 0xc3 /* Report Physical LUNs */
--// Data returned
-+/* Data returned */
- typedef struct _ReportLUNdata_struct
- {
- BYTE LUNListLength[4];
-@@ -135,11 +101,11 @@ typedef struct _ReportLUNdata_struct
- BYTE LUN[CISS_MAX_LUN][8];
- } ReportLunData_struct;
-
--#define CCISS_READ_CAPACITY 0x25 /* Read Capacity */
-+#define CCISS_READ_CAPACITY 0x25 /* Read Capacity */
- typedef struct _ReadCapdata_struct
- {
-- BYTE total_size[4]; // Total size in blocks
-- BYTE block_size[4]; // Size of blocks in bytes
-+ BYTE total_size[4]; /* Total size in blocks */
-+ BYTE block_size[4]; /* Size of blocks in bytes */
- } ReadCapdata_struct;
-
- #define CCISS_READ_CAPACITY_16 0x9e /* Read Capacity 16 */
-@@ -171,52 +137,21 @@ typedef struct _ReadCapdata_struct_16
- #define CDB_LEN10 10
- #define CDB_LEN16 16
-
--// BMIC commands
-+/* BMIC commands */
- #define BMIC_READ 0x26
- #define BMIC_WRITE 0x27
- #define BMIC_CACHE_FLUSH 0xc2
--#define CCISS_CACHE_FLUSH 0x01 //C2 was already being used by CCISS
-+#define CCISS_CACHE_FLUSH 0x01 /* C2 was already being used by CCISS */
-
--//Command List Structure
--typedef union _SCSI3Addr_struct {
-- struct {
-- BYTE Dev;
-- BYTE Bus:6;
-- BYTE Mode:2; // b00
-- } PeripDev;
-- struct {
-- BYTE DevLSB;
-- BYTE DevMSB:6;
-- BYTE Mode:2; // b01
-- } LogDev;
-- struct {
-- BYTE Dev:5;
-- BYTE Bus:3;
-- BYTE Targ:6;
-- BYTE Mode:2; // b10
-- } LogUnit;
--} SCSI3Addr_struct;
--
--typedef struct _PhysDevAddr_struct {
-- DWORD TargetId:24;
-- DWORD Bus:6;
-- DWORD Mode:2;
-- SCSI3Addr_struct Target[2]; //2 level target device addr
--} PhysDevAddr_struct;
--
--typedef struct _LogDevAddr_struct {
-- DWORD VolId:30;
-- DWORD Mode:2;
-- BYTE reserved[4];
--} LogDevAddr_struct;
--
--typedef union _LUNAddr_struct {
-- BYTE LunAddrBytes[8];
-- SCSI3Addr_struct SCSI3Lun[4];
-- PhysDevAddr_struct PhysDev;
-- LogDevAddr_struct LogDev;
--} LUNAddr_struct;
-+#define CCISS_ABORT_MSG 0x00
-+#define CCISS_RESET_MSG 0x01
-+#define CCISS_RESET_TYPE_CONTROLLER 0x00
-+#define CCISS_RESET_TYPE_BUS 0x01
-+#define CCISS_RESET_TYPE_TARGET 0x03
-+#define CCISS_RESET_TYPE_LUN 0x04
-+#define CCISS_NOOP_MSG 0x03
-
-+/* Command List Structure */
- #define CTLR_LUNID "\0\0\0\0\0\0\0\0"
-
- typedef struct _CommandListHeader_struct {
-@@ -226,16 +161,6 @@ typedef struct _CommandListHeader_struct {
- QWORD Tag;
- LUNAddr_struct LUN;
- } CommandListHeader_struct;
--typedef struct _RequestBlock_struct {
-- BYTE CDBLen;
-- struct {
-- BYTE Type:3;
-- BYTE Attribute:3;
-- BYTE Direction:2;
-- } Type;
-- HWORD Timeout;
-- BYTE CDB[16];
--} RequestBlock_struct;
- typedef struct _ErrDescriptor_struct {
- QWORD Addr;
- DWORD Len;
-@@ -246,28 +171,6 @@ typedef struct _SGDescriptor_struct {
- DWORD Ext;
- } SGDescriptor_struct;
-
--typedef union _MoreErrInfo_struct{
-- struct {
-- BYTE Reserved[3];
-- BYTE Type;
-- DWORD ErrorInfo;
-- }Common_Info;
-- struct{
-- BYTE Reserved[2];
-- BYTE offense_size;//size of offending entry
-- BYTE offense_num; //byte # of offense 0-base
-- DWORD offense_value;
-- }Invalid_Cmd;
--}MoreErrInfo_struct;
--typedef struct _ErrorInfo_struct {
-- BYTE ScsiStatus;
-- BYTE SenseLen;
-- HWORD CommandStatus;
-- DWORD ResidualCnt;
-- MoreErrInfo_struct MoreErrInfo;
-- BYTE SenseInfo[SENSEINFOBYTES];
--} ErrorInfo_struct;
--
- /* Command types */
- #define CMD_RWREQ 0x00
- #define CMD_IOCTL_PEND 0x01
-@@ -276,30 +179,41 @@ typedef struct _ErrorInfo_struct {
- #define CMD_MSG_TIMEOUT 0x05
- #define CMD_MSG_STALE 0xff
-
--/* This structure needs to be divisible by 8 for new
-- * indexing method.
-+/* This structure needs to be divisible by COMMANDLIST_ALIGNMENT
-+ * because low bits of the address are used to to indicate that
-+ * whether the tag contains an index or an address. PAD_32 and
-+ * PAD_64 can be adjusted independently as needed for 32-bit
-+ * and 64-bits systems.
- */
--#define PADSIZE (sizeof(long) - 4)
-+#define COMMANDLIST_ALIGNMENT (32)
-+#define IS_64_BIT ((sizeof(long) - 4)/4)
-+#define IS_32_BIT (!IS_64_BIT)
-+#define PAD_32 (0)
-+#define PAD_64 (4)
-+#define PADSIZE (IS_32_BIT * PAD_32 + IS_64_BIT * PAD_64)
-+#define DIRECT_LOOKUP_BIT 0x10
-+#define DIRECT_LOOKUP_SHIFT 5
-+
- typedef struct _CommandList_struct {
- CommandListHeader_struct Header;
- RequestBlock_struct Request;
- ErrDescriptor_struct ErrDesc;
- SGDescriptor_struct SG[MAXSGENTRIES];
-- /* information associated with the command */
-+ /* information associated with the command */
- __u32 busaddr; /* physical address of this record */
-- ErrorInfo_struct * err_info; /* pointer to the allocated mem */
-+ ErrorInfo_struct * err_info; /* pointer to the allocated mem */
- int ctlr;
-- int cmd_type;
-+ int cmd_type;
- long cmdindex;
-- struct hlist_node list;
-+ struct list_head list;
- struct request * rq;
- struct completion *waiting;
- int retry_count;
- void * scsi_cmd;
-- char pad[PADSIZE];
-+ char pad[PADSIZE];
- } CommandList_struct;
-
--//Configuration Table Structure
-+/* Configuration Table Structure */
- typedef struct _HostWrite_struct {
- DWORD TransportRequest;
- DWORD Reserved;
-@@ -310,15 +224,46 @@ typedef struct _HostWrite_struct {
- typedef struct _CfgTable_struct {
- BYTE Signature[4];
- DWORD SpecValence;
-+#define SIMPLE_MODE 0x02
-+#define PERFORMANT_MODE 0x04
-+#define MEMQ_MODE 0x08
- DWORD TransportSupport;
- DWORD TransportActive;
- HostWrite_struct HostWrite;
- DWORD CmdsOutMax;
- DWORD BusTypes;
-- DWORD Reserved;
-+ DWORD TransMethodOffset;
- BYTE ServerName[16];
- DWORD HeartBeat;
- DWORD SCSI_Prefetch;
-+ DWORD MaxSGElements;
-+ DWORD MaxLogicalUnits;
-+ DWORD MaxPhysicalDrives;
-+ DWORD MaxPhysicalDrivesPerLogicalUnit;
-+ DWORD MaxPerformantModeCommands;
-+ u8 reserved[0x78 - 0x58];
-+ u32 misc_fw_support; /* offset 0x78 */
-+#define MISC_FW_DOORBELL_RESET (0x02)
-+#define MISC_FW_DOORBELL_RESET2 (0x10)
-+ u8 driver_version[32];
- } CfgTable_struct;
--#pragma pack()
--#endif // CCISS_CMD_H
-+
-+struct TransTable_struct {
-+ u32 BlockFetch0;
-+ u32 BlockFetch1;
-+ u32 BlockFetch2;
-+ u32 BlockFetch3;
-+ u32 BlockFetch4;
-+ u32 BlockFetch5;
-+ u32 BlockFetch6;
-+ u32 BlockFetch7;
-+ u32 RepQSize;
-+ u32 RepQCount;
-+ u32 RepQCtrAddrLow32;
-+ u32 RepQCtrAddrHigh32;
-+ u32 RepQAddr0Low32;
-+ u32 RepQAddr0High32;
-+};
-+
-+#pragma pack()
-+#endif /* CCISS_CMD_H */
-diff --git a/drivers/block/cciss_kernel_compat.h b/drivers/block/cciss_kernel_compat.h
-new file mode 100644
-index 0000000..671f3b8
---- /dev/null
-+++ b/drivers/block/cciss_kernel_compat.h
-@@ -0,0 +1,128 @@
-+/*
-+ * Disk Array driver for HP Smart Array controllers.
-+ * (C) Copyright 2000, 2010, 2012 Hewlett-Packard Development Company, L.P.
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License as published by
-+ * the Free Software Foundation; version 2 of the License.
-+ *
-+ * This program is distributed in the hope that it will be useful,
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-+ * General Public License for more details.
-+ *
-+ * You should have received a copy of the GNU General Public License
-+ * along with this program; if not, write to the Free Software
-+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
-+ * 02111-1307, USA.
-+ *
-+ * Questions/Comments/Bugfixes to iss_storagedev@hp.com
-+ *
-+ */
-+
-+/* Kernel compat file for the cciss_4_6_xx branch */
-+
-+/* #define SLES11sp2plus */
-+/* #define SLES11sp1 */
-+/* #define SLES11sp2plus */
-+/* #define RHEL6 */
-+/* Default is kernel.org */
-+
-+#ifdef SLES11sp1
-+# define KFEATURE_HAS_LOCKED_IOCTL 1
-+# define KFEATURE_HAS_BLK_QUEUE_MAX_SEGMENTS 0
-+# define KFEATURE_HAS_SMP_LOCK_H 1
-+# define KFEATURE_HAS_BLK_QUEUE_PLUGGED 1
-+# define KFEATURE_HAS_LOCK_KERNEL 1
-+# define SA_CONTROLLERS_GEN8 0
-+# define SA_CONTROLLERS_GEN6 1
-+# define SA_CONTROLLERS_LEGACY 1
-+# define KFEATURE_HAS_2011_03_QUEUECOMMAND 0
-+#else
-+#ifdef SLES11sp2plus
-+# define KFEATURE_HAS_LOCKED_IOCTL 0
-+# define KFEATURE_HAS_BLK_QUEUE_MAX_SEGMENTS 1
-+# define KFEATURE_HAS_SMP_LOCK_H 0
-+# define KFEATURE_HAS_BLK_QUEUE_PLUGGED 0
-+# define KFEATURE_HAS_LOCK_KERNEL 0
-+# define SA_CONTROLLERS_GEN8 0
-+# define SA_CONTROLLERS_GEN6 1
-+# define SA_CONTROLLERS_LEGACY 1
-+# define KFEATURE_HAS_2011_03_QUEUECOMMAND 1
-+#else
-+#ifdef RHEL6
-+# define KFEATURE_HAS_LOCKED_IOCTL 0
-+# define KFEATURE_HAS_BLK_QUEUE_MAX_SEGMENTS 1
-+# define KFEATURE_HAS_SMP_LOCK_H 1
-+# define KFEATURE_HAS_BLK_QUEUE_PLUGGED 1
-+# define KFEATURE_HAS_LOCK_KERNEL 1
-+# define SA_CONTROLLERS_GEN8 0
-+# define SA_CONTROLLERS_GEN6 0
-+# define SA_CONTROLLERS_LEGACY 1
-+# define KFEATURE_HAS_2011_03_QUEUECOMMAND 0
-+#else /* kernel.org */
-+# define KFEATURE_HAS_LOCKED_IOCTL 0
-+# define KFEATURE_HAS_BLK_QUEUE_MAX_SEGMENTS 0
-+# define KFEATURE_HAS_SMP_LOCK_H 1
-+# define KFEATURE_HAS_BLK_QUEUE_PLUGGED 1
-+# define KFEATURE_HAS_LOCK_KERNEL 1
-+# define SA_CONTROLLERS_GEN8 1
-+# define SA_CONTROLLERS_GEN6 1
-+# define SA_CONTROLLERS_LEGACY 1
-+# define KFEATURE_HAS_2011_03_QUEUECOMMAND 0
-+#endif
-+#endif
-+#endif
-+
-+/* Some kernels have a .locked_ioctl while some have a .ioctl in the fops */
-+#if KFEATURE_HAS_LOCKED_IOCTL
-+# define SET_IOCTL_FUNCTION(locked_function, unlocked_function) .locked_ioctl = locked_function,
-+#else
-+# define SET_IOCTL_FUNCTION(locked_function, unlocked_function) .ioctl = unlocked_function,
-+#endif /* KFEATURE_HAS_LOCKED_IOCTL */
-+
-+#if KFEATURE_HAS_BLK_QUEUE_MAX_SEGMENTS
-+#else
-+/*
-+ * Some kernels don't have blk_queue_max_segments(), instead it has the older
-+ * blk_queue_max_hw_segments() and blk_queue_max_phys_segments()
-+ */
-+static inline void blk_queue_max_segments(struct request_queue *queue,
-+ int nsegments)
-+{
-+ blk_queue_max_hw_segments(queue, nsegments);
-+ blk_queue_max_phys_segments(queue, nsegments);
-+}
-+#endif /* KFEATURE_HAS_BLK_QUEUE_MAX_SEGMENTS */
-+
-+#if KFEATURE_HAS_SMP_LOCK_H
-+#include <linux/smp_lock.h>
-+#endif
-+
-+#if KFEATURE_HAS_BLK_QUEUE_PLUGGED
-+# define BLK_QUEUE_PLUGGED(x) blk_queue_plugged(x)
-+#else
-+ /* No such thing as blk_queue_plugged, so always return
-+ * false, compiler will optimize away
-+ */
-+# define BLK_QUEUE_PLUGGED(x) (0)
-+#endif
-+
-+#if KFEATURE_HAS_LOCK_KERNEL
-+#else
-+# define lock_kernel() do { } while (0)
-+# define unlock_kernel() do { } while (0)
-+#endif
-+
-+#if KFEATURE_HAS_2011_03_QUEUECOMMAND
-+# define DECLARE_QUEUECOMMAND(func) \
-+ static int func##_lck(struct scsi_cmnd *cmd, \
-+ void (*done)(struct scsi_cmnd *))
-+# define DECLARE_QUEUECOMMAND_WRAPPER(func) static DEF_SCSI_QCMD(func)
-+#else
-+# define DECLARE_QUEUECOMMAND(func) \
-+ static int func(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *))
-+# define DECLARE_QUEUECOMMAND_WRAPPER(func)
-+#endif
-+
-+
-diff --git a/drivers/block/cciss_scsi.c b/drivers/block/cciss_scsi.c
-index ad8e592..2921035 100644
---- a/drivers/block/cciss_scsi.c
-+++ b/drivers/block/cciss_scsi.c
-@@ -1,6 +1,6 @@
- /*
- * Disk Array driver for HP Smart Array controllers, SCSI Tape module.
-- * (C) Copyright 2001, 2007 Hewlett-Packard Development Company, L.P.
-+ * (C) Copyright 2001, 2010 Hewlett-Packard Development Company, L.P.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
-@@ -17,15 +17,15 @@
- * 02111-1307, USA.
- *
- * Questions/Comments/Bugfixes to iss_storagedev@hp.com
-- *
-+ *
- * Author: Stephen M. Cameron
- */
- #ifdef CONFIG_CISS_SCSI_TAPE
-
--/* Here we have code to present the driver as a scsi driver
-- as it is simultaneously presented as a block driver. The
-+/* Here we have code to present the driver as a scsi driver
-+ as it is simultaneously presented as a block driver. The
- reason for doing this is to allow access to SCSI tape drives
-- through the array controller. Note in particular, neither
-+ through the array controller. Note in particular, neither
- physical nor logical disks are presented through the scsi layer. */
-
- #include <linux/timer.h>
-@@ -37,20 +37,22 @@
-
- #include <scsi/scsi_cmnd.h>
- #include <scsi/scsi_device.h>
--#include <scsi/scsi_host.h>
-+#include <scsi/scsi_host.h>
-
- #include "cciss_scsi.h"
-
- #define CCISS_ABORT_MSG 0x00
- #define CCISS_RESET_MSG 0x01
-
--static int fill_cmd(CommandList_struct *c, __u8 cmd, int ctlr, void *buff,
-+static int fill_cmd(ctlr_info_t *h, CommandList_struct *c, __u8 cmd, void *buff,
- size_t size,
- __u8 page_code, unsigned char *scsi3addr,
- int cmd_type);
-
--static CommandList_struct *cmd_alloc(ctlr_info_t *h, int get_from_pool);
--static void cmd_free(ctlr_info_t *h, CommandList_struct *c, int got_from_pool);
-+static CommandList_struct *cmd_alloc(ctlr_info_t *h);
-+static CommandList_struct *cmd_special_alloc(ctlr_info_t *h);
-+static void cmd_free(ctlr_info_t *h, CommandList_struct *c);
-+static void cmd_special_free(ctlr_info_t *h, CommandList_struct *c);
-
- static int cciss_scsi_proc_info(
- struct Scsi_Host *sh,
-@@ -60,8 +62,8 @@ static int cciss_scsi_proc_info(
- int length, /* length of data in buffer */
- int func); /* 0 == read, 1 == write */
-
--static int cciss_scsi_queue_command (struct scsi_cmnd *cmd,
-- void (* done)(struct scsi_cmnd *));
-+DECLARE_QUEUECOMMAND(cciss_scsi_queue_command);
-+DECLARE_QUEUECOMMAND_WRAPPER(cciss_scsi_queue_command);
- static int cciss_eh_device_reset_handler(struct scsi_cmnd *);
- static int cciss_eh_abort_handler(struct scsi_cmnd *);
-
-@@ -82,9 +84,7 @@ static struct scsi_host_template cciss_driver_template = {
- .proc_name = "cciss",
- .proc_info = cciss_scsi_proc_info,
- .queuecommand = cciss_scsi_queue_command,
-- .can_queue = SCSI_CCISS_CAN_QUEUE,
- .this_id = 7,
-- .sg_tablesize = MAXSGENTRIES,
- .cmd_per_lun = 1,
- .use_clustering = DISABLE_CLUSTERING,
- /* Can't have eh_bus_reset_handler or eh_host_reset_handler for cciss */
-@@ -93,47 +93,45 @@ static struct scsi_host_template cciss_driver_template = {
- };
-
- #pragma pack(1)
-+
-+#define SCSI_PAD_32 8
-+#define SCSI_PAD_64 8
-+
- struct cciss_scsi_cmd_stack_elem_t {
- CommandList_struct cmd;
- ErrorInfo_struct Err;
- __u32 busaddr;
-- __u32 pad;
-+ int cmdindex;
-+ unsigned char pad[IS_32_BIT * SCSI_PAD_32 + IS_64_BIT * SCSI_PAD_64];
- };
-
--#pragma pack()
--
--#define CMD_STACK_SIZE (SCSI_CCISS_CAN_QUEUE * \
-- CCISS_MAX_SCSI_DEVS_PER_HBA + 2)
-- // plus two for init time usage
--
--#pragma pack(1)
- struct cciss_scsi_cmd_stack_t {
- struct cciss_scsi_cmd_stack_elem_t *pool;
-- struct cciss_scsi_cmd_stack_elem_t *elem[CMD_STACK_SIZE];
-+ struct cciss_scsi_cmd_stack_elem_t **elem;
- dma_addr_t cmd_pool_handle;
- int top;
-+ int nelems;
- };
- #pragma pack()
-
- struct cciss_scsi_adapter_data_t {
- struct Scsi_Host *scsi_host;
- struct cciss_scsi_cmd_stack_t cmd_stack;
-+ SGDescriptor_struct **cmd_sg_list;
- int registered;
-- spinlock_t lock; // to protect ccissscsi[ctlr];
-+ spinlock_t lock; // to protect ccissscsi[ctlr];
- };
-
--#define CPQ_TAPE_LOCK(ctlr, flags) spin_lock_irqsave( \
-- &(((struct cciss_scsi_adapter_data_t *) \
-- hba[ctlr]->scsi_ctlr)->lock), flags);
--#define CPQ_TAPE_UNLOCK(ctlr, flags) spin_unlock_irqrestore( \
-- &(((struct cciss_scsi_adapter_data_t *) \
-- hba[ctlr]->scsi_ctlr)->lock), flags);
-+#define CPQ_TAPE_LOCK(h, flags) spin_lock_irqsave( \
-+ &h->scsi_ctlr->lock, flags);
-+#define CPQ_TAPE_UNLOCK(h, flags) spin_unlock_irqrestore( \
-+ &h->scsi_ctlr->lock, flags);
-
- static CommandList_struct *
- scsi_cmd_alloc(ctlr_info_t *h)
- {
- /* assume only one process in here at a time, locking done by caller. */
-- /* use CCISS_LOCK(ctlr) */
-+ /* use h->lock */
- /* might be better to rewrite how we allocate scsi commands in a way that */
- /* needs no locking at all. */
-
-@@ -143,22 +141,23 @@ scsi_cmd_alloc(ctlr_info_t *h)
- struct cciss_scsi_cmd_stack_t *stk;
- u64bit temp64;
-
-- sa = (struct cciss_scsi_adapter_data_t *) h->scsi_ctlr;
-- stk = &sa->cmd_stack;
-+ sa = h->scsi_ctlr;
-+ stk = &sa->cmd_stack;
-
-- if (stk->top < 0)
-+ if (stk->top < 0)
- return NULL;
- c = stk->elem[stk->top];
- /* memset(c, 0, sizeof(*c)); */
- memset(&c->cmd, 0, sizeof(c->cmd));
- memset(&c->Err, 0, sizeof(c->Err));
- /* set physical addr of cmd and addr of scsi parameters */
-- c->cmd.busaddr = c->busaddr;
-- /* (__u32) (stk->cmd_pool_handle +
-+ c->cmd.busaddr = c->busaddr;
-+ c->cmd.cmdindex = c->cmdindex;
-+ /* (__u32) (stk->cmd_pool_handle +
- (sizeof(struct cciss_scsi_cmd_stack_elem_t)*stk->top)); */
-
- temp64.val = (__u64) (c->busaddr + sizeof(CommandList_struct));
-- /* (__u64) (stk->cmd_pool_handle +
-+ /* (__u64) (stk->cmd_pool_handle +
- (sizeof(struct cciss_scsi_cmd_stack_elem_t)*stk->top) +
- sizeof(CommandList_struct)); */
- stk->top--;
-@@ -172,75 +171,92 @@ scsi_cmd_alloc(ctlr_info_t *h)
- return (CommandList_struct *) c;
- }
-
--static void
--scsi_cmd_free(ctlr_info_t *h, CommandList_struct *cmd)
-+static void
-+scsi_cmd_free(ctlr_info_t *h, CommandList_struct *c)
- {
- /* assume only one process in here at a time, locking done by caller. */
-- /* use CCISS_LOCK(ctlr) */
-+ /* use h->lock */
- /* drop the free memory chunk on top of the stack. */
-
- struct cciss_scsi_adapter_data_t *sa;
- struct cciss_scsi_cmd_stack_t *stk;
-
-- sa = (struct cciss_scsi_adapter_data_t *) h->scsi_ctlr;
-- stk = &sa->cmd_stack;
-- if (stk->top >= CMD_STACK_SIZE) {
-- printk("cciss: scsi_cmd_free called too many times.\n");
-- BUG();
-- }
-+ sa = h->scsi_ctlr;
-+ stk = &sa->cmd_stack;
- stk->top++;
-- stk->elem[stk->top] = (struct cciss_scsi_cmd_stack_elem_t *) cmd;
-+ if (stk->top >= stk->nelems) {
-+ dev_err(&h->pdev->dev,
-+ "scsi_cmd_free called too many times.\n");
-+ BUG();
-+ }
-+ stk->elem[stk->top] = (struct cciss_scsi_cmd_stack_elem_t *) c;
- }
-
- static int
--scsi_cmd_stack_setup(int ctlr, struct cciss_scsi_adapter_data_t *sa)
-+scsi_cmd_stack_setup(ctlr_info_t *h, struct cciss_scsi_adapter_data_t *sa)
- {
- int i;
- struct cciss_scsi_cmd_stack_t *stk;
- size_t size;
-
-- stk = &sa->cmd_stack;
-- size = sizeof(struct cciss_scsi_cmd_stack_elem_t) * CMD_STACK_SIZE;
-+ stk = &sa->cmd_stack;
-+ stk->nelems = cciss_tape_cmds + 2;
-+ sa->cmd_sg_list = cciss_allocate_sg_chain_blocks(h,
-+ h->chainsize, stk->nelems);
-+ if (!sa->cmd_sg_list && h->chainsize > 0)
-+ return -ENOMEM;
-
-+ size = sizeof(struct cciss_scsi_cmd_stack_elem_t) * stk->nelems;
-+
-+ /* Check alignment, see cciss_cmd.h near CommandList_struct def. */
-+ BUILD_BUG_ON((sizeof(*stk->pool) % COMMANDLIST_ALIGNMENT) != 0);
- // pci_alloc_consistent guarantees 32-bit DMA address will
- // be used
--
- stk->pool = (struct cciss_scsi_cmd_stack_elem_t *)
-- pci_alloc_consistent(hba[ctlr]->pdev, size, &stk->cmd_pool_handle);
-+ pci_alloc_consistent(h->pdev, size, &stk->cmd_pool_handle);
-
- if (stk->pool == NULL) {
-- printk("stk->pool is null\n");
-+ cciss_free_sg_chain_blocks(sa->cmd_sg_list, stk->nelems);
-+ sa->cmd_sg_list = NULL;
-+ return -ENOMEM;
-+ }
-+ stk->elem = kmalloc(sizeof(stk->elem[0]) * stk->nelems, GFP_KERNEL);
-+ if (!stk->elem) {
-+ pci_free_consistent(h->pdev, size, stk->pool,
-+ stk->cmd_pool_handle);
- return -1;
- }
--
-- for (i=0; i<CMD_STACK_SIZE; i++) {
-+ for (i = 0; i < stk->nelems; i++) {
- stk->elem[i] = &stk->pool[i];
-- stk->elem[i]->busaddr = (__u32) (stk->cmd_pool_handle +
-+ stk->elem[i]->busaddr = (__u32) (stk->cmd_pool_handle +
- (sizeof(struct cciss_scsi_cmd_stack_elem_t) * i));
-+ stk->elem[i]->cmdindex = i;
- }
-- stk->top = CMD_STACK_SIZE-1;
-+ stk->top = stk->nelems - 1;
- return 0;
- }
-
- static void
--scsi_cmd_stack_free(int ctlr)
-+scsi_cmd_stack_free(ctlr_info_t *h)
- {
- struct cciss_scsi_adapter_data_t *sa;
- struct cciss_scsi_cmd_stack_t *stk;
- size_t size;
-
-- sa = (struct cciss_scsi_adapter_data_t *) hba[ctlr]->scsi_ctlr;
-- stk = &sa->cmd_stack;
-- if (stk->top != CMD_STACK_SIZE-1) {
-- printk( "cciss: %d scsi commands are still outstanding.\n",
-- CMD_STACK_SIZE - stk->top);
-- // BUG();
-- printk("WE HAVE A BUG HERE!!! stk=0x%p\n", stk);
-+ sa = h->scsi_ctlr;
-+ stk = &sa->cmd_stack;
-+ if (stk->top != stk->nelems - 1) {
-+ dev_warn(&h->pdev->dev,
-+ "bug: %d scsi commands are still outstanding.\n",
-+ stk->nelems - stk->top);
- }
-- size = sizeof(struct cciss_scsi_cmd_stack_elem_t) * CMD_STACK_SIZE;
-+ size = sizeof(struct cciss_scsi_cmd_stack_elem_t) * stk->nelems;
-
-- pci_free_consistent(hba[ctlr]->pdev, size, stk->pool, stk->cmd_pool_handle);
-+ pci_free_consistent(h->pdev, size, stk->pool, stk->cmd_pool_handle);
- stk->pool = NULL;
-+ cciss_free_sg_chain_blocks(sa->cmd_sg_list, stk->nelems);
-+ kfree(stk->elem);
-+ stk->elem = NULL;
- }
-
- #if 0
-@@ -287,7 +303,7 @@ print_cmd(CommandList_struct *cp)
- printk("queue:%d\n", cp->Header.ReplyQueue);
- printk("sglist:%d\n", cp->Header.SGList);
- printk("sgtot:%d\n", cp->Header.SGTotal);
-- printk("Tag:0x%08x/0x%08x\n", cp->Header.Tag.upper,
-+ printk("Tag:0x%08x/0x%08x\n", cp->Header.Tag.upper,
- cp->Header.Tag.lower);
- printk("LUN:0x%02x%02x%02x%02x%02x%02x%02x%02x\n",
- cp->Header.LUN.LunAddrBytes[0],
-@@ -313,8 +329,8 @@ print_cmd(CommandList_struct *cp)
- cp->Request.CDB[10], cp->Request.CDB[11],
- cp->Request.CDB[12], cp->Request.CDB[13],
- cp->Request.CDB[14], cp->Request.CDB[15]),
-- printk("edesc.Addr: 0x%08x/0%08x, Len = %d\n",
-- cp->ErrDesc.Addr.upper, cp->ErrDesc.Addr.lower,
-+ printk("edesc.Addr: 0x%08x/0%08x, Len = %d\n",
-+ cp->ErrDesc.Addr.upper, cp->ErrDesc.Addr.lower,
- cp->ErrDesc.Len);
- printk("sgs..........Errorinfo:\n");
- printk("scsistatus:%d\n", cp->err_info->ScsiStatus);
-@@ -329,21 +345,21 @@ print_cmd(CommandList_struct *cp)
-
- #endif
-
--static int
--find_bus_target_lun(int ctlr, int *bus, int *target, int *lun)
-+static int
-+find_bus_target_lun(ctlr_info_t *h, int *bus, int *target, int *lun)
- {
- /* finds an unused bus, target, lun for a new device */
-- /* assumes hba[ctlr]->scsi_ctlr->lock is held */
-+ /* assumes h->scsi_ctlr->lock is held */
- int i, found=0;
- unsigned char target_taken[CCISS_MAX_SCSI_DEVS_PER_HBA];
-
- memset(&target_taken[0], 0, CCISS_MAX_SCSI_DEVS_PER_HBA);
-
- target_taken[SELF_SCSI_ID] = 1;
-- for (i=0;i<ccissscsi[ctlr].ndevices;i++)
-- target_taken[ccissscsi[ctlr].dev[i].target] = 1;
-+ for (i = 0; i < ccissscsi[h->ctlr].ndevices; i++)
-+ target_taken[ccissscsi[h->ctlr].dev[i].target] = 1;
-
-- for (i=0;i<CCISS_MAX_SCSI_DEVS_PER_HBA;i++) {
-+ for (i = 0; i < CCISS_MAX_SCSI_DEVS_PER_HBA; i++) {
- if (!target_taken[i]) {
- *bus = 0; *target=i; *lun = 0; found=1;
- break;
-@@ -356,20 +372,20 @@ struct scsi2map {
- int bus, target, lun;
- };
-
--static int
--cciss_scsi_add_entry(int ctlr, int hostno,
-+static int
-+cciss_scsi_add_entry(ctlr_info_t *h, int hostno,
- struct cciss_scsi_dev_t *device,
- struct scsi2map *added, int *nadded)
- {
-- /* assumes hba[ctlr]->scsi_ctlr->lock is held */
-- int n = ccissscsi[ctlr].ndevices;
-+ /* assumes h->scsi_ctlr->lock is held */
-+ int n = ccissscsi[h->ctlr].ndevices;
- struct cciss_scsi_dev_t *sd;
- int i, bus, target, lun;
- unsigned char addr1[8], addr2[8];
-
- if (n >= CCISS_MAX_SCSI_DEVS_PER_HBA) {
-- printk("cciss%d: Too many devices, "
-- "some will be inaccessible.\n", ctlr);
-+ dev_warn(&h->pdev->dev, "Too many devices, "
-+ "some will be inaccessible.\n");
- return -1;
- }
-
-@@ -385,7 +401,7 @@ cciss_scsi_add_entry(int ctlr, int hostno,
- memcpy(addr1, device->scsi3addr, 8);
- addr1[4] = 0;
- for (i = 0; i < n; i++) {
-- sd = &ccissscsi[ctlr].dev[i];
-+ sd = &ccissscsi[h->ctlr].dev[i];
- memcpy(addr2, sd->scsi3addr, 8);
- addr2[4] = 0;
- /* differ only in byte 4? */
-@@ -398,9 +414,9 @@ cciss_scsi_add_entry(int ctlr, int hostno,
- }
- }
-
-- sd = &ccissscsi[ctlr].dev[n];
-+ sd = &ccissscsi[h->ctlr].dev[n];
- if (lun == 0) {
-- if (find_bus_target_lun(ctlr,
-+ if (find_bus_target_lun(h,
- &sd->bus, &sd->target, &sd->lun) != 0)
- return -1;
- } else {
-@@ -419,37 +435,37 @@ cciss_scsi_add_entry(int ctlr, int hostno,
- memcpy(sd->device_id, device->device_id, sizeof(sd->device_id));
- sd->devtype = device->devtype;
-
-- ccissscsi[ctlr].ndevices++;
-+ ccissscsi[h->ctlr].ndevices++;
-
-- /* initially, (before registering with scsi layer) we don't
-- know our hostno and we don't want to print anything first
-+ /* initially, (before registering with scsi layer) we don't
-+ know our hostno and we don't want to print anything first
- time anyway (the scsi layer's inquiries will show that info) */
- if (hostno != -1)
-- printk("cciss%d: %s device c%db%dt%dl%d added.\n",
-- ctlr, scsi_device_type(sd->devtype), hostno,
-+ dev_info(&h->pdev->dev, "%s device c%db%dt%dl%d added.\n",
-+ scsi_device_type(sd->devtype), hostno,
- sd->bus, sd->target, sd->lun);
- return 0;
- }
-
- static void
--cciss_scsi_remove_entry(int ctlr, int hostno, int entry,
-+cciss_scsi_remove_entry(ctlr_info_t *h, int hostno, int entry,
- struct scsi2map *removed, int *nremoved)
- {
-- /* assumes hba[ctlr]->scsi_ctlr->lock is held */
-+ /* assumes h->ctlr]->scsi_ctlr->lock is held */
- int i;
- struct cciss_scsi_dev_t sd;
-
- if (entry < 0 || entry >= CCISS_MAX_SCSI_DEVS_PER_HBA) return;
-- sd = ccissscsi[ctlr].dev[entry];
-+ sd = ccissscsi[h->ctlr].dev[entry];
- removed[*nremoved].bus = sd.bus;
- removed[*nremoved].target = sd.target;
- removed[*nremoved].lun = sd.lun;
- (*nremoved)++;
-- for (i=entry;i<ccissscsi[ctlr].ndevices-1;i++)
-- ccissscsi[ctlr].dev[i] = ccissscsi[ctlr].dev[i+1];
-- ccissscsi[ctlr].ndevices--;
-- printk("cciss%d: %s device c%db%dt%dl%d removed.\n",
-- ctlr, scsi_device_type(sd.devtype), hostno,
-+ for (i = entry; i < ccissscsi[h->ctlr].ndevices-1; i++)
-+ ccissscsi[h->ctlr].dev[i] = ccissscsi[h->ctlr].dev[i+1];
-+ ccissscsi[h->ctlr].ndevices--;
-+ dev_info(&h->pdev->dev, "%s device c%db%dt%dl%d removed.\n",
-+ scsi_device_type(sd.devtype), hostno,
- sd.bus, sd.target, sd.lun);
- }
-
-@@ -464,24 +480,24 @@ cciss_scsi_remove_entry(int ctlr, int hostno, int entry,
- (a)[1] == (b)[1] && \
- (a)[0] == (b)[0])
-
--static void fixup_botched_add(int ctlr, char *scsi3addr)
-+static void fixup_botched_add(ctlr_info_t *h, char *scsi3addr)
- {
- /* called when scsi_add_device fails in order to re-adjust */
- /* ccissscsi[] to match the mid layer's view. */
- unsigned long flags;
- int i, j;
-- CPQ_TAPE_LOCK(ctlr, flags);
-- for (i = 0; i < ccissscsi[ctlr].ndevices; i++) {
-+ CPQ_TAPE_LOCK(h, flags);
-+ for (i = 0; i < ccissscsi[h->ctlr].ndevices; i++) {
- if (memcmp(scsi3addr,
-- ccissscsi[ctlr].dev[i].scsi3addr, 8) == 0) {
-- for (j = i; j < ccissscsi[ctlr].ndevices-1; j++)
-- ccissscsi[ctlr].dev[j] =
-- ccissscsi[ctlr].dev[j+1];
-- ccissscsi[ctlr].ndevices--;
-+ ccissscsi[h->ctlr].dev[i].scsi3addr, 8) == 0) {
-+ for (j = i; j < ccissscsi[h->ctlr].ndevices-1; j++)
-+ ccissscsi[h->ctlr].dev[j] =
-+ ccissscsi[h->ctlr].dev[j+1];
-+ ccissscsi[h->ctlr].ndevices--;
- break;
- }
- }
-- CPQ_TAPE_UNLOCK(ctlr, flags);
-+ CPQ_TAPE_UNLOCK(h, flags);
- }
-
- static int device_is_the_same(struct cciss_scsi_dev_t *dev1,
-@@ -501,13 +517,13 @@ static int device_is_the_same(struct cciss_scsi_dev_t *dev1,
- }
-
- static int
--adjust_cciss_scsi_table(int ctlr, int hostno,
-+adjust_cciss_scsi_table(ctlr_info_t *h, int hostno,
- struct cciss_scsi_dev_t sd[], int nsds)
- {
- /* sd contains scsi3 addresses and devtypes, but
- bus target and lun are not filled in. This funciton
- takes what's in sd to be the current and adjusts
-- ccissscsi[] to be in line with what's in sd. */
-+ ccissscsi[] to be in line with what's in sd. */
-
- int i,j, found, changes=0;
- struct cciss_scsi_dev_t *csd;
-@@ -522,25 +538,24 @@ adjust_cciss_scsi_table(int ctlr, int hostno,
- GFP_KERNEL);
-
- if (!added || !removed) {
-- printk(KERN_WARNING "cciss%d: Out of memory in "
-- "adjust_cciss_scsi_table\n", ctlr);
-+ dev_warn(&h->pdev->dev,
-+ "Out of memory in adjust_cciss_scsi_table\n");
- goto free_and_out;
- }
-
-- CPQ_TAPE_LOCK(ctlr, flags);
-+ CPQ_TAPE_LOCK(h, flags);
-
- if (hostno != -1) /* if it's not the first time... */
-- sh = ((struct cciss_scsi_adapter_data_t *)
-- hba[ctlr]->scsi_ctlr)->scsi_host;
-+ sh = h->scsi_ctlr->scsi_host;
-
-- /* find any devices in ccissscsi[] that are not in
-+ /* find any devices in ccissscsi[] that are not in
- sd[] and remove them from ccissscsi[] */
-
- i = 0;
- nremoved = 0;
- nadded = 0;
-- while(i<ccissscsi[ctlr].ndevices) {
-- csd = &ccissscsi[ctlr].dev[i];
-+ while (i < ccissscsi[h->ctlr].ndevices) {
-+ csd = &ccissscsi[h->ctlr].dev[i];
- found=0;
- for (j=0;j<nsds;j++) {
- if (SCSI3ADDR_EQ(sd[j].scsi3addr,
-@@ -553,22 +568,20 @@ adjust_cciss_scsi_table(int ctlr, int hostno,
- }
- }
-
-- if (found == 0) { /* device no longer present. */
-+ if (found == 0) { /* device no longer present. */
- changes++;
-- /* printk("cciss%d: %s device c%db%dt%dl%d removed.\n",
-- ctlr, scsi_device_type(csd->devtype), hostno,
-- csd->bus, csd->target, csd->lun); */
-- cciss_scsi_remove_entry(ctlr, hostno, i,
-+ cciss_scsi_remove_entry(h, hostno, i,
- removed, &nremoved);
- /* remove ^^^, hence i not incremented */
- } else if (found == 1) { /* device is different in some way */
- changes++;
-- printk("cciss%d: device c%db%dt%dl%d has changed.\n",
-- ctlr, hostno, csd->bus, csd->target, csd->lun);
-- cciss_scsi_remove_entry(ctlr, hostno, i,
-+ dev_info(&h->pdev->dev,
-+ "device c%db%dt%dl%d has changed.\n",
-+ hostno, csd->bus, csd->target, csd->lun);
-+ cciss_scsi_remove_entry(h, hostno, i,
- removed, &nremoved);
- /* remove ^^^, hence i not incremented */
-- if (cciss_scsi_add_entry(ctlr, hostno, &sd[j],
-+ if (cciss_scsi_add_entry(h, hostno, &sd[j],
- added, &nadded) != 0)
- /* we just removed one, so add can't fail. */
- BUG();
-@@ -590,8 +603,8 @@ adjust_cciss_scsi_table(int ctlr, int hostno,
-
- for (i=0;i<nsds;i++) {
- found=0;
-- for (j=0;j<ccissscsi[ctlr].ndevices;j++) {
-- csd = &ccissscsi[ctlr].dev[j];
-+ for (j = 0; j < ccissscsi[h->ctlr].ndevices; j++) {
-+ csd = &ccissscsi[h->ctlr].dev[j];
- if (SCSI3ADDR_EQ(sd[i].scsi3addr,
- csd->scsi3addr)) {
- if (device_is_the_same(&sd[i], csd))
-@@ -603,18 +616,18 @@ adjust_cciss_scsi_table(int ctlr, int hostno,
- }
- if (!found) {
- changes++;
-- if (cciss_scsi_add_entry(ctlr, hostno, &sd[i],
-+ if (cciss_scsi_add_entry(h, hostno, &sd[i],
- added, &nadded) != 0)
- break;
- } else if (found == 1) {
- /* should never happen... */
- changes++;
-- printk(KERN_WARNING "cciss%d: device "
-- "unexpectedly changed\n", ctlr);
-+ dev_warn(&h->pdev->dev,
-+ "device unexpectedly changed\n");
- /* but if it does happen, we just ignore that device */
- }
- }
-- CPQ_TAPE_UNLOCK(ctlr, flags);
-+ CPQ_TAPE_UNLOCK(h, flags);
-
- /* Don't notify scsi mid layer of any changes the first time through */
- /* (or if there are no changes) scsi_scan_host will do it later the */
-@@ -634,9 +647,9 @@ adjust_cciss_scsi_table(int ctlr, int hostno,
- /* We don't expect to get here. */
- /* future cmds to this device will get selection */
- /* timeout as if the device was gone. */
-- printk(KERN_WARNING "cciss%d: didn't find "
-+ dev_warn(&h->pdev->dev, "didn't find "
- "c%db%dt%dl%d\n for removal.",
-- ctlr, hostno, removed[i].bus,
-+ hostno, removed[i].bus,
- removed[i].target, removed[i].lun);
- }
- }
-@@ -648,13 +661,12 @@ adjust_cciss_scsi_table(int ctlr, int hostno,
- added[i].target, added[i].lun);
- if (rc == 0)
- continue;
-- printk(KERN_WARNING "cciss%d: scsi_add_device "
-+ dev_warn(&h->pdev->dev, "scsi_add_device "
- "c%db%dt%dl%d failed, device not added.\n",
-- ctlr, hostno,
-- added[i].bus, added[i].target, added[i].lun);
-+ hostno, added[i].bus, added[i].target, added[i].lun);
- /* now we have to remove it from ccissscsi, */
- /* since it didn't get added to scsi mid layer */
-- fixup_botched_add(ctlr, added[i].scsi3addr);
-+ fixup_botched_add(h, added[i].scsi3addr);
- }
-
- free_and_out:
-@@ -664,33 +676,33 @@ free_and_out:
- }
-
- static int
--lookup_scsi3addr(int ctlr, int bus, int target, int lun, char *scsi3addr)
-+lookup_scsi3addr(ctlr_info_t *h, int bus, int target, int lun, char *scsi3addr)
- {
- int i;
- struct cciss_scsi_dev_t *sd;
- unsigned long flags;
-
-- CPQ_TAPE_LOCK(ctlr, flags);
-- for (i=0;i<ccissscsi[ctlr].ndevices;i++) {
-- sd = &ccissscsi[ctlr].dev[i];
-+ CPQ_TAPE_LOCK(h, flags);
-+ for (i = 0; i < ccissscsi[h->ctlr].ndevices; i++) {
-+ sd = &ccissscsi[h->ctlr].dev[i];
- if (sd->bus == bus &&
- sd->target == target &&
- sd->lun == lun) {
- memcpy(scsi3addr, &sd->scsi3addr[0], 8);
-- CPQ_TAPE_UNLOCK(ctlr, flags);
-+ CPQ_TAPE_UNLOCK(h, flags);
- return 0;
- }
- }
-- CPQ_TAPE_UNLOCK(ctlr, flags);
-+ CPQ_TAPE_UNLOCK(h, flags);
- return -1;
- }
-
--static void
--cciss_scsi_setup(int cntl_num)
-+static void
-+cciss_scsi_setup(ctlr_info_t *h)
- {
- struct cciss_scsi_adapter_data_t * shba;
-
-- ccissscsi[cntl_num].ndevices = 0;
-+ ccissscsi[h->ctlr].ndevices = 0;
- shba = (struct cciss_scsi_adapter_data_t *)
- kmalloc(sizeof(*shba), GFP_KERNEL);
- if (shba == NULL)
-@@ -698,33 +710,35 @@ cciss_scsi_setup(int cntl_num)
- shba->scsi_host = NULL;
- spin_lock_init(&shba->lock);
- shba->registered = 0;
-- if (scsi_cmd_stack_setup(cntl_num, shba) != 0) {
-+ if (scsi_cmd_stack_setup(h, shba) != 0) {
- kfree(shba);
- shba = NULL;
- }
-- hba[cntl_num]->scsi_ctlr = (void *) shba;
-+ h->scsi_ctlr = shba;
- return;
- }
-
--static void
--complete_scsi_command( CommandList_struct *cp, int timeout, __u32 tag)
-+static void complete_scsi_command(CommandList_struct *c, int timeout,
-+ __u32 tag)
- {
- struct scsi_cmnd *cmd;
-- ctlr_info_t *ctlr;
-+ ctlr_info_t *h;
- ErrorInfo_struct *ei;
-
-- ei = cp->err_info;
-+ ei = c->err_info;
-
- /* First, see if it was a message rather than a command */
-- if (cp->Request.Type.Type == TYPE_MSG) {
-- cp->cmd_type = CMD_MSG_DONE;
-+ if (c->Request.Type.Type == TYPE_MSG) {
-+ c->cmd_type = CMD_MSG_DONE;
- return;
- }
-
-- cmd = (struct scsi_cmnd *) cp->scsi_cmd;
-- ctlr = hba[cp->ctlr];
-+ cmd = (struct scsi_cmnd *) c->scsi_cmd;
-+ h = hba[c->ctlr];
-
- scsi_dma_unmap(cmd);
-+ if (c->Header.SGTotal > h->max_cmd_sgentries)
-+ cciss_unmap_sg_chain_block(h, c);
-
- cmd->result = (DID_OK << 16); /* host byte */
- cmd->result |= (COMMAND_COMPLETE << 8); /* msg byte */
-@@ -735,19 +749,27 @@ complete_scsi_command( CommandList_struct *cp, int timeout, __u32 tag)
-
- /* copy the sense data whether we need to or not. */
-
-- memcpy(cmd->sense_buffer, ei->SenseInfo,
-+ memcpy(cmd->sense_buffer, ei->SenseInfo,
- ei->SenseLen > SCSI_SENSE_BUFFERSIZE ?
-- SCSI_SENSE_BUFFERSIZE :
-+ SCSI_SENSE_BUFFERSIZE :
- ei->SenseLen);
- scsi_set_resid(cmd, ei->ResidualCnt);
-
-- if(ei->CommandStatus != 0)
-- { /* an error has occurred */
-+ if(ei->CommandStatus != 0)
-+ { /* an error has occurred */
- switch(ei->CommandStatus)
- {
- case CMD_TARGET_STATUS:
- /* Pass it up to the upper layers... */
-- if (!ei->ScsiStatus) {
-+ if( ei->ScsiStatus)
-+ {
-+#if 0
-+ printk(KERN_WARNING "cciss: cmd %p "
-+ "has SCSI Status = %x\n",
-+ c, ei->ScsiStatus);
-+#endif
-+ }
-+ else { /* scsi status is zero??? How??? */
-
- /* Ordinarily, this case should never happen, but there is a bug
- in some released firmware revisions that allows it to happen
-@@ -763,15 +785,15 @@ complete_scsi_command( CommandList_struct *cp, int timeout, __u32 tag)
- case CMD_DATA_UNDERRUN: /* let mid layer handle it. */
- break;
- case CMD_DATA_OVERRUN:
-- printk(KERN_WARNING "cciss: cp %p has"
-+ dev_warn(&h->pdev->dev, "%p has"
- " completed with data overrun "
-- "reported\n", cp);
-+ "reported\n", c);
- break;
- case CMD_INVALID: {
-- /* print_bytes(cp, sizeof(*cp), 1, 0);
-- print_cmd(cp); */
-+ /* print_bytes(c, sizeof(*c), 1, 0);
-+ print_cmd(c); */
- /* We get CMD_INVALID if you address a non-existent tape drive instead
-- of a selection timeout (no response). You will see this if you yank
-+ of a selection timeout (no response). You will see this if you yank
- out a tape drive, then try to access it. This is kind of a shame
- because it means that any other CMD_INVALID (e.g. driver bug) will
- get interpreted as a missing target. */
-@@ -779,54 +801,55 @@ complete_scsi_command( CommandList_struct *cp, int timeout, __u32 tag)
- }
- break;
- case CMD_PROTOCOL_ERR:
-- printk(KERN_WARNING "cciss: cp %p has "
-- "protocol error \n", cp);
-+ dev_warn(&h->pdev->dev,
-+ "%p has protocol error\n", c);
- break;
- case CMD_HARDWARE_ERR:
- cmd->result = DID_ERROR << 16;
-- printk(KERN_WARNING "cciss: cp %p had "
-- " hardware error\n", cp);
-+ dev_warn(&h->pdev->dev,
-+ "%p had hardware error\n", c);
- break;
- case CMD_CONNECTION_LOST:
- cmd->result = DID_ERROR << 16;
-- printk(KERN_WARNING "cciss: cp %p had "
-- "connection lost\n", cp);
-+ dev_warn(&h->pdev->dev,
-+ "%p had connection lost\n", c);
- break;
- case CMD_ABORTED:
- cmd->result = DID_ABORT << 16;
-- printk(KERN_WARNING "cciss: cp %p was "
-- "aborted\n", cp);
-+ dev_warn(&h->pdev->dev, "%p was aborted\n", c);
- break;
- case CMD_ABORT_FAILED:
- cmd->result = DID_ERROR << 16;
-- printk(KERN_WARNING "cciss: cp %p reports "
-- "abort failed\n", cp);
-+ dev_warn(&h->pdev->dev,
-+ "%p reports abort failed\n", c);
- break;
- case CMD_UNSOLICITED_ABORT:
- cmd->result = DID_ABORT << 16;
-- printk(KERN_WARNING "cciss: cp %p aborted "
-- "do to an unsolicited abort\n", cp);
-+ dev_warn(&h->pdev->dev, "%p aborted do to an "
-+ "unsolicited abort\n", c);
- break;
- case CMD_TIMEOUT:
- cmd->result = DID_TIME_OUT << 16;
-- printk(KERN_WARNING "cciss: cp %p timedout\n",
-- cp);
-+ dev_warn(&h->pdev->dev, "%p timedout\n", c);
-+ break;
-+ case CMD_UNABORTABLE:
-+ cmd->result = DID_ERROR << 16;
-+ dev_warn(&h->pdev->dev, "c %p command "
-+ "unabortable\n", c);
- break;
- default:
- cmd->result = DID_ERROR << 16;
-- printk(KERN_WARNING "cciss: cp %p returned "
-- "unknown status %x\n", cp,
-- ei->CommandStatus);
-+ dev_warn(&h->pdev->dev,
-+ "%p returned unknown status %x\n", c,
-+ ei->CommandStatus);
- }
- }
-- // printk("c:%p:c%db%dt%dl%d ", cmd, ctlr->ctlr, cmd->channel,
-- // cmd->target, cmd->lun);
- cmd->scsi_done(cmd);
-- scsi_cmd_free(ctlr, cp);
-+ scsi_cmd_free(h, c);
- }
-
- static int
--cciss_scsi_detect(int ctlr)
-+cciss_scsi_detect(ctlr_info_t *h)
- {
- struct Scsi_Host *sh;
- int error;
-@@ -834,16 +857,20 @@ cciss_scsi_detect(int ctlr)
- sh = scsi_host_alloc(&cciss_driver_template, sizeof(struct ctlr_info *));
- if (sh == NULL)
- goto fail;
-- sh->io_port = 0; // good enough? FIXME,
-+ sh->io_port = 0; // good enough? FIXME,
- sh->n_io_port = 0; // I don't think we use these two...
-- sh->this_id = SELF_SCSI_ID;
-+ sh->this_id = SELF_SCSI_ID;
-+ sh->sg_tablesize = h->maxsgentries;
-+ sh->can_queue = cciss_tape_cmds;
-+ sh->max_cmd_len = MAX_COMMAND_SIZE;
-+ sh->max_sectors = h->cciss_max_sectors;
-
-- ((struct cciss_scsi_adapter_data_t *)
-- hba[ctlr]->scsi_ctlr)->scsi_host = (void *) sh;
-- sh->hostdata[0] = (unsigned long) hba[ctlr];
-- sh->irq = hba[ctlr]->intr[SIMPLE_MODE_INT];
-+ ((struct cciss_scsi_adapter_data_t *)
-+ h->scsi_ctlr)->scsi_host = sh;
-+ sh->hostdata[0] = (unsigned long) h;
-+ sh->irq = h->intr[SIMPLE_MODE_INT];
- sh->unique_id = sh->irq;
-- error = scsi_add_host(sh, &hba[ctlr]->pdev->dev);
-+ error = scsi_add_host(sh, &h->pdev->dev);
- if (error)
- goto fail_host_put;
- scsi_scan_host(sh);
-@@ -857,20 +884,20 @@ cciss_scsi_detect(int ctlr)
-
- static void
- cciss_unmap_one(struct pci_dev *pdev,
-- CommandList_struct *cp,
-+ CommandList_struct *c,
- size_t buflen,
- int data_direction)
- {
- u64bit addr64;
-
-- addr64.val32.lower = cp->SG[0].Addr.lower;
-- addr64.val32.upper = cp->SG[0].Addr.upper;
-+ addr64.val32.lower = c->SG[0].Addr.lower;
-+ addr64.val32.upper = c->SG[0].Addr.upper;
- pci_unmap_single(pdev, (dma_addr_t) addr64.val, buflen, data_direction);
- }
-
- static void
- cciss_map_one(struct pci_dev *pdev,
-- CommandList_struct *cp,
-+ CommandList_struct *c,
- unsigned char *buf,
- size_t buflen,
- int data_direction)
-@@ -878,164 +905,153 @@ cciss_map_one(struct pci_dev *pdev,
- __u64 addr64;
-
- addr64 = (__u64) pci_map_single(pdev, buf, buflen, data_direction);
-- cp->SG[0].Addr.lower =
-+ c->SG[0].Addr.lower =
- (__u32) (addr64 & (__u64) 0x00000000FFFFFFFF);
-- cp->SG[0].Addr.upper =
-+ c->SG[0].Addr.upper =
- (__u32) ((addr64 >> 32) & (__u64) 0x00000000FFFFFFFF);
-- cp->SG[0].Len = buflen;
-- cp->Header.SGList = (__u8) 1; /* no. SGs contig in this cmd */
-- cp->Header.SGTotal = (__u16) 1; /* total sgs in this cmd list */
-+ c->SG[0].Len = buflen;
-+ c->Header.SGList = (__u8) 1; /* no. SGs contig in this cmd */
-+ c->Header.SGTotal = (__u16) 1; /* total sgs in this cmd list */
- }
-
- static int
--cciss_scsi_do_simple_cmd(ctlr_info_t *c,
-- CommandList_struct *cp,
-- unsigned char *scsi3addr,
-+cciss_scsi_do_simple_cmd(ctlr_info_t *h,
-+ CommandList_struct *c,
-+ unsigned char *scsi3addr,
- unsigned char *cdb,
- unsigned char cdblen,
- unsigned char *buf, int bufsize,
- int direction)
- {
-- unsigned long flags;
- DECLARE_COMPLETION_ONSTACK(wait);
-
-- cp->cmd_type = CMD_IOCTL_PEND; // treat this like an ioctl
-- cp->scsi_cmd = NULL;
-- cp->Header.ReplyQueue = 0; // unused in simple mode
-- memcpy(&cp->Header.LUN, scsi3addr, sizeof(cp->Header.LUN));
-- cp->Header.Tag.lower = cp->busaddr; // Use k. address of cmd as tag
-+ c->cmd_type = CMD_IOCTL_PEND; /* treat this like an ioctl */
-+ c->scsi_cmd = NULL;
-+ c->Header.ReplyQueue = 0; /* unused in simple mode */
-+ memcpy(&c->Header.LUN, scsi3addr, sizeof(c->Header.LUN));
-+ c->Header.Tag.lower = c->busaddr; /* Use k. address of cmd as tag */
- // Fill in the request block...
-
-- /* printk("Using scsi3addr 0x%02x%0x2%0x2%0x2%0x2%0x2%0x2%0x2\n",
-+ /* printk("Using scsi3addr 0x%02x%0x2%0x2%0x2%0x2%0x2%0x2%0x2\n",
- scsi3addr[0], scsi3addr[1], scsi3addr[2], scsi3addr[3],
- scsi3addr[4], scsi3addr[5], scsi3addr[6], scsi3addr[7]); */
-
-- memset(cp->Request.CDB, 0, sizeof(cp->Request.CDB));
-- memcpy(cp->Request.CDB, cdb, cdblen);
-- cp->Request.Timeout = 0;
-- cp->Request.CDBLen = cdblen;
-- cp->Request.Type.Type = TYPE_CMD;
-- cp->Request.Type.Attribute = ATTR_SIMPLE;
-- cp->Request.Type.Direction = direction;
-+ memset(c->Request.CDB, 0, sizeof(c->Request.CDB));
-+ memcpy(c->Request.CDB, cdb, cdblen);
-+ c->Request.Timeout = 0;
-+ c->Request.CDBLen = cdblen;
-+ c->Request.Type.Type = TYPE_CMD;
-+ c->Request.Type.Attribute = ATTR_SIMPLE;
-+ c->Request.Type.Direction = direction;
-
- /* Fill in the SG list and do dma mapping */
-- cciss_map_one(c->pdev, cp, (unsigned char *) buf,
-- bufsize, DMA_FROM_DEVICE);
--
-- cp->waiting = &wait;
--
-- /* Put the request on the tail of the request queue */
-- spin_lock_irqsave(CCISS_LOCK(c->ctlr), flags);
-- addQ(&c->reqQ, cp);
-- c->Qdepth++;
-- start_io(c);
-- spin_unlock_irqrestore(CCISS_LOCK(c->ctlr), flags);
-+ cciss_map_one(h->pdev, c, (unsigned char *) buf,
-+ bufsize, DMA_FROM_DEVICE);
-
-+ c->waiting = &wait;
-+ enqueue_cmd_and_start_io(h, c);
- wait_for_completion(&wait);
-
- /* undo the dma mapping */
-- cciss_unmap_one(c->pdev, cp, bufsize, DMA_FROM_DEVICE);
-+ cciss_unmap_one(h->pdev, c, bufsize, DMA_FROM_DEVICE);
- return(0);
- }
-
--static void
--cciss_scsi_interpret_error(CommandList_struct *cp)
-+static void
-+cciss_scsi_interpret_error(ctlr_info_t *h, CommandList_struct *c)
- {
- ErrorInfo_struct *ei;
-
-- ei = cp->err_info;
-+ ei = c->err_info;
- switch(ei->CommandStatus)
- {
- case CMD_TARGET_STATUS:
-- printk(KERN_WARNING "cciss: cmd %p has "
-- "completed with errors\n", cp);
-- printk(KERN_WARNING "cciss: cmd %p "
-- "has SCSI Status = %x\n",
-- cp,
-- ei->ScsiStatus);
-+ dev_warn(&h->pdev->dev,
-+ "cmd %p has completed with errors\n", c);
-+ dev_warn(&h->pdev->dev,
-+ "cmd %p has SCSI Status = %x\n",
-+ c, ei->ScsiStatus);
- if (ei->ScsiStatus == 0)
-- printk(KERN_WARNING
-- "cciss:SCSI status is abnormally zero. "
-+ dev_warn(&h->pdev->dev,
-+ "SCSI status is abnormally zero. "
- "(probably indicates selection timeout "
- "reported incorrectly due to a known "
- "firmware bug, circa July, 2001.)\n");
- break;
- case CMD_DATA_UNDERRUN: /* let mid layer handle it. */
-- printk("UNDERRUN\n");
-+ dev_info(&h->pdev->dev, "UNDERRUN\n");
- break;
- case CMD_DATA_OVERRUN:
-- printk(KERN_WARNING "cciss: cp %p has"
-+ dev_warn(&h->pdev->dev, "%p has"
- " completed with data overrun "
-- "reported\n", cp);
-+ "reported\n", c);
- break;
- case CMD_INVALID: {
- /* controller unfortunately reports SCSI passthru's */
- /* to non-existent targets as invalid commands. */
-- printk(KERN_WARNING "cciss: cp %p is "
-- "reported invalid (probably means "
-- "target device no longer present)\n",
-- cp);
-- /* print_bytes((unsigned char *) cp, sizeof(*cp), 1, 0);
-- print_cmd(cp); */
-+ dev_warn(&h->pdev->dev,
-+ "%p is reported invalid (probably means "
-+ "target device no longer present)\n", c);
-+ /* print_bytes((unsigned char *) c, sizeof(*c), 1, 0);
-+ print_cmd(c); */
- }
- break;
- case CMD_PROTOCOL_ERR:
-- printk(KERN_WARNING "cciss: cp %p has "
-- "protocol error \n", cp);
-+ dev_warn(&h->pdev->dev, "%p has protocol error\n", c);
- break;
- case CMD_HARDWARE_ERR:
- /* cmd->result = DID_ERROR << 16; */
-- printk(KERN_WARNING "cciss: cp %p had "
-- " hardware error\n", cp);
-+ dev_warn(&h->pdev->dev, "%p had hardware error\n", c);
- break;
- case CMD_CONNECTION_LOST:
-- printk(KERN_WARNING "cciss: cp %p had "
-- "connection lost\n", cp);
-+ dev_warn(&h->pdev->dev, "%p had connection lost\n", c);
- break;
- case CMD_ABORTED:
-- printk(KERN_WARNING "cciss: cp %p was "
-- "aborted\n", cp);
-+ dev_warn(&h->pdev->dev, "%p was aborted\n", c);
- break;
- case CMD_ABORT_FAILED:
-- printk(KERN_WARNING "cciss: cp %p reports "
-- "abort failed\n", cp);
-+ dev_warn(&h->pdev->dev,
-+ "%p reports abort failed\n", c);
- break;
- case CMD_UNSOLICITED_ABORT:
-- printk(KERN_WARNING "cciss: cp %p aborted "
-- "do to an unsolicited abort\n", cp);
-+ dev_warn(&h->pdev->dev,
-+ "%p aborted due to an unsolicited abort\n", c);
- break;
- case CMD_TIMEOUT:
-- printk(KERN_WARNING "cciss: cp %p timedout\n",
-- cp);
-+ dev_warn(&h->pdev->dev, "%p timedout\n", c);
-+ break;
-+ case CMD_UNABORTABLE:
-+ dev_warn(&h->pdev->dev,
-+ "%p unabortable\n", c);
- break;
- default:
-- printk(KERN_WARNING "cciss: cp %p returned "
-- "unknown status %x\n", cp,
-- ei->CommandStatus);
-+ dev_warn(&h->pdev->dev,
-+ "%p returned unknown status %x\n",
-+ c, ei->CommandStatus);
- }
- }
-
- static int
--cciss_scsi_do_inquiry(ctlr_info_t *c, unsigned char *scsi3addr,
-+cciss_scsi_do_inquiry(ctlr_info_t *h, unsigned char *scsi3addr,
- unsigned char page, unsigned char *buf,
- unsigned char bufsize)
- {
- int rc;
-- CommandList_struct *cp;
-+ CommandList_struct *c;
- char cdb[6];
- ErrorInfo_struct *ei;
- unsigned long flags;
-
-- spin_lock_irqsave(CCISS_LOCK(c->ctlr), flags);
-- cp = scsi_cmd_alloc(c);
-- spin_unlock_irqrestore(CCISS_LOCK(c->ctlr), flags);
-+ spin_lock_irqsave(&h->lock, flags);
-+ c = scsi_cmd_alloc(h);
-+ spin_unlock_irqrestore(&h->lock, flags);
-
-- if (cp == NULL) { /* trouble... */
-- printk("cmd_alloc returned NULL!\n");
-+ if (c == NULL) { /* trouble... */
-+ dev_warn(&h->pdev->dev, "scsi_cmd_alloc returned NULL!\n");
- return -1;
- }
-
-- ei = cp->err_info;
-+ ei = c->err_info;
-
- cdb[0] = CISS_INQUIRY;
- cdb[1] = (page != 0);
-@@ -1043,24 +1059,24 @@ cciss_scsi_do_inquiry(ctlr_info_t *c, unsigned char *scsi3addr,
- cdb[3] = 0;
- cdb[4] = bufsize;
- cdb[5] = 0;
-- rc = cciss_scsi_do_simple_cmd(c, cp, scsi3addr, cdb,
-+ rc = cciss_scsi_do_simple_cmd(h, c, scsi3addr, cdb,
- 6, buf, bufsize, XFER_READ);
-
- if (rc != 0) return rc; /* something went wrong */
-
-- if (ei->CommandStatus != 0 &&
-+ if (ei->CommandStatus != 0 &&
- ei->CommandStatus != CMD_DATA_UNDERRUN) {
-- cciss_scsi_interpret_error(cp);
-+ cciss_scsi_interpret_error(h, c);
- rc = -1;
- }
-- spin_lock_irqsave(CCISS_LOCK(c->ctlr), flags);
-- scsi_cmd_free(c, cp);
-- spin_unlock_irqrestore(CCISS_LOCK(c->ctlr), flags);
-+ spin_lock_irqsave(&h->lock, flags);
-+ scsi_cmd_free(h, c);
-+ spin_unlock_irqrestore(&h->lock, flags);
- return rc;
- }
-
- /* Get the device id from inquiry page 0x83 */
--static int cciss_scsi_get_device_id(ctlr_info_t *c, unsigned char *scsi3addr,
-+static int cciss_scsi_get_device_id(ctlr_info_t *h, unsigned char *scsi3addr,
- unsigned char *device_id, int buflen)
- {
- int rc;
-@@ -1071,7 +1087,7 @@ static int cciss_scsi_get_device_id(ctlr_info_t *c, unsigned char *scsi3addr,
- buf = kzalloc(64, GFP_KERNEL);
- if (!buf)
- return -1;
-- rc = cciss_scsi_do_inquiry(c, scsi3addr, 0x83, buf, 64);
-+ rc = cciss_scsi_do_inquiry(h, scsi3addr, 0x83, buf, 64);
- if (rc == 0)
- memcpy(device_id, &buf[8], buflen);
- kfree(buf);
-@@ -1079,21 +1095,21 @@ static int cciss_scsi_get_device_id(ctlr_info_t *c, unsigned char *scsi3addr,
- }
-
- static int
--cciss_scsi_do_report_phys_luns(ctlr_info_t *c,
-+cciss_scsi_do_report_phys_luns(ctlr_info_t *h,
- ReportLunData_struct *buf, int bufsize)
- {
- int rc;
-- CommandList_struct *cp;
-+ CommandList_struct *c;
- unsigned char cdb[12];
-- unsigned char scsi3addr[8];
-+ unsigned char scsi3addr[8];
- ErrorInfo_struct *ei;
- unsigned long flags;
-
-- spin_lock_irqsave(CCISS_LOCK(c->ctlr), flags);
-- cp = scsi_cmd_alloc(c);
-- spin_unlock_irqrestore(CCISS_LOCK(c->ctlr), flags);
-- if (cp == NULL) { /* trouble... */
-- printk("cmd_alloc returned NULL!\n");
-+ spin_lock_irqsave(&h->lock, flags);
-+ c = scsi_cmd_alloc(h);
-+ spin_unlock_irqrestore(&h->lock, flags);
-+ if (c == NULL) { /* trouble... */
-+ dev_warn(&h->pdev->dev, "scsi_cmd_alloc returned NULL!\n");
- return -1;
- }
-
-@@ -1111,52 +1127,52 @@ cciss_scsi_do_report_phys_luns(ctlr_info_t *c,
- cdb[10] = 0;
- cdb[11] = 0;
-
-- rc = cciss_scsi_do_simple_cmd(c, cp, scsi3addr,
-- cdb, 12,
-- (unsigned char *) buf,
-+ rc = cciss_scsi_do_simple_cmd(h, c, scsi3addr,
-+ cdb, 12,
-+ (unsigned char *) buf,
- bufsize, XFER_READ);
-
- if (rc != 0) return rc; /* something went wrong */
-
-- ei = cp->err_info;
-- if (ei->CommandStatus != 0 &&
-+ ei = c->err_info;
-+ if (ei->CommandStatus != 0 &&
- ei->CommandStatus != CMD_DATA_UNDERRUN) {
-- cciss_scsi_interpret_error(cp);
-+ cciss_scsi_interpret_error(h, c);
- rc = -1;
- }
-- spin_lock_irqsave(CCISS_LOCK(c->ctlr), flags);
-- scsi_cmd_free(c, cp);
-- spin_unlock_irqrestore(CCISS_LOCK(c->ctlr), flags);
-+ spin_lock_irqsave(&h->lock, flags);
-+ scsi_cmd_free(h, c);
-+ spin_unlock_irqrestore(&h->lock, flags);
- return rc;
- }
-
- static void
--cciss_update_non_disk_devices(int cntl_num, int hostno)
-+cciss_update_non_disk_devices(ctlr_info_t *h, int hostno)
- {
- /* the idea here is we could get notified from /proc
-- that some devices have changed, so we do a report
-- physical luns cmd, and adjust our list of devices
-+ that some devices have changed, so we do a report
-+ physical luns cmd, and adjust our list of devices
- accordingly. (We can't rely on the scsi-mid layer just
-- doing inquiries, because the "busses" that the scsi
-+ doing inquiries, because the "busses" that the scsi
- mid-layer probes are totally fabricated by this driver,
- so new devices wouldn't show up.
-
-- the scsi3addr's of devices won't change so long as the
-- adapter is not reset. That means we can rescan and
-- tell which devices we already know about, vs. new
-+ the scsi3addr's of devices won't change so long as the
-+ adapter is not reset. That means we can rescan and
-+ tell which devices we already know about, vs. new
- devices, vs. disappearing devices.
-
- Also, if you yank out a tape drive, then put in a disk
-- in it's place, (say, a configured volume from another
-- array controller for instance) _don't_ poke this driver
-- (so it thinks it's still a tape, but _do_ poke the scsi
-- mid layer, so it does an inquiry... the scsi mid layer
-+ in it's place, (say, a configured volume from another
-+ array controller for instance) _don't_ poke this driver
-+ (so it thinks it's still a tape, but _do_ poke the scsi
-+ mid layer, so it does an inquiry... the scsi mid layer
- will see the physical disk. This would be bad. Need to
-- think about how to prevent that. One idea would be to
-+ think about how to prevent that. One idea would be to
- snoop all scsi responses and if an inquiry repsonse comes
- back that reports a disk, chuck it an return selection
- timeout instead and adjust our table... Not sure i like
-- that though.
-+ that though.
-
- */
- #define OBDR_TAPE_INQ_SIZE 49
-@@ -1164,7 +1180,6 @@ cciss_update_non_disk_devices(int cntl_num, int hostno)
- ReportLunData_struct *ld_buff;
- unsigned char *inq_buff;
- unsigned char scsi3addr[8];
-- ctlr_info_t *c;
- __u32 num_luns=0;
- unsigned char *ch;
- struct cciss_scsi_dev_t *currentsd, *this_device;
-@@ -1172,29 +1187,28 @@ cciss_update_non_disk_devices(int cntl_num, int hostno)
- int reportlunsize = sizeof(*ld_buff) + CISS_MAX_PHYS_LUN * 8;
- int i;
-
-- c = (ctlr_info_t *) hba[cntl_num];
- ld_buff = kzalloc(reportlunsize, GFP_KERNEL);
- inq_buff = kmalloc(OBDR_TAPE_INQ_SIZE, GFP_KERNEL);
- currentsd = kzalloc(sizeof(*currentsd) *
- (CCISS_MAX_SCSI_DEVS_PER_HBA+1), GFP_KERNEL);
- if (ld_buff == NULL || inq_buff == NULL || currentsd == NULL) {
-- printk(KERN_ERR "cciss: out of memory\n");
-+ dev_err(&h->pdev->dev, "out of memory\n");
- goto out;
- }
- this_device = ¤tsd[CCISS_MAX_SCSI_DEVS_PER_HBA];
-- if (cciss_scsi_do_report_phys_luns(c, ld_buff, reportlunsize) == 0) {
-+ if (cciss_scsi_do_report_phys_luns(h, ld_buff, reportlunsize) == 0) {
- ch = &ld_buff->LUNListLength[0];
- num_luns = ((ch[0]<<24) | (ch[1]<<16) | (ch[2]<<8) | ch[3]) / 8;
- if (num_luns > CISS_MAX_PHYS_LUN) {
-- printk(KERN_WARNING
-- "cciss: Maximum physical LUNs (%d) exceeded. "
-- "%d LUNs ignored.\n", CISS_MAX_PHYS_LUN,
-+ dev_warn(&h->pdev->dev,
-+ "Maximum physical LUNs (%d) exceeded. "
-+ "%d LUNs ignored.\n", CISS_MAX_PHYS_LUN,
- num_luns - CISS_MAX_PHYS_LUN);
- num_luns = CISS_MAX_PHYS_LUN;
- }
- }
- else {
-- printk(KERN_ERR "cciss: Report physical LUNs failed.\n");
-+ dev_err(&h->pdev->dev, "Report physical LUNs failed.\n");
- goto out;
- }
-
-@@ -1206,7 +1220,7 @@ cciss_update_non_disk_devices(int cntl_num, int hostno)
- memset(inq_buff, 0, OBDR_TAPE_INQ_SIZE);
- memcpy(&scsi3addr[0], &ld_buff->LUN[i][0], 8);
-
-- if (cciss_scsi_do_inquiry(hba[cntl_num], scsi3addr, 0, inq_buff,
-+ if (cciss_scsi_do_inquiry(h, scsi3addr, 0, inq_buff,
- (unsigned char) OBDR_TAPE_INQ_SIZE) != 0)
- /* Inquiry failed (msg printed already) */
- continue; /* so we will skip this device. */
-@@ -1224,7 +1238,7 @@ cciss_update_non_disk_devices(int cntl_num, int hostno)
- sizeof(this_device->revision));
- memset(this_device->device_id, 0,
- sizeof(this_device->device_id));
-- cciss_scsi_get_device_id(hba[cntl_num], scsi3addr,
-+ cciss_scsi_get_device_id(h, scsi3addr,
- this_device->device_id, sizeof(this_device->device_id));
-
- switch (this_device->devtype)
-@@ -1250,20 +1264,20 @@ cciss_update_non_disk_devices(int cntl_num, int hostno)
- case 0x01: /* sequential access, (tape) */
- case 0x08: /* medium changer */
- if (ncurrent >= CCISS_MAX_SCSI_DEVS_PER_HBA) {
-- printk(KERN_INFO "cciss%d: %s ignored, "
-- "too many devices.\n", cntl_num,
-+ dev_info(&h->pdev->dev, "%s ignored, "
-+ "too many devices.\n",
- scsi_device_type(this_device->devtype));
- break;
- }
- currentsd[ncurrent] = *this_device;
- ncurrent++;
- break;
-- default:
-+ default:
- break;
- }
- }
-
-- adjust_cciss_scsi_table(cntl_num, hostno, currentsd, ncurrent);
-+ adjust_cciss_scsi_table(h, hostno, currentsd, ncurrent);
- out:
- kfree(inq_buff);
- kfree(ld_buff);
-@@ -1282,12 +1296,12 @@ is_keyword(char *ptr, int len, char *verb) // Thanks to ncr53c8xx.c
- }
-
- static int
--cciss_scsi_user_command(int ctlr, int hostno, char *buffer, int length)
-+cciss_scsi_user_command(ctlr_info_t *h, int hostno, char *buffer, int length)
- {
- int arg_len;
-
- if ((arg_len = is_keyword(buffer, length, "rescan")) != 0)
-- cciss_update_non_disk_devices(ctlr, hostno);
-+ cciss_update_non_disk_devices(h, hostno);
- else
- return -EINVAL;
- return length;
-@@ -1304,20 +1318,16 @@ cciss_scsi_proc_info(struct Scsi_Host *sh,
- {
-
- int buflen, datalen;
-- ctlr_info_t *ci;
-+ ctlr_info_t *h;
- int i;
-- int cntl_num;
-
--
-- ci = (ctlr_info_t *) sh->hostdata[0];
-- if (ci == NULL) /* This really shouldn't ever happen. */
-+ h = (ctlr_info_t *) sh->hostdata[0];
-+ if (h == NULL) /* This really shouldn't ever happen. */
- return -EINVAL;
-
-- cntl_num = ci->ctlr; /* Get our index into the hba[] array */
--
- if (func == 0) { /* User is reading from /proc/scsi/ciss*?/?* */
- buflen = sprintf(buffer, "cciss%d: SCSI host: %d\n",
-- cntl_num, sh->host_no);
-+ h->ctlr, sh->host_no);
-
- /* this information is needed by apps to know which cciss
- device corresponds to which scsi host number without
-@@ -1327,8 +1337,9 @@ cciss_scsi_proc_info(struct Scsi_Host *sh,
- this info is for an app to be able to use to know how to
- get them back in sync. */
-
-- for (i=0;i<ccissscsi[cntl_num].ndevices;i++) {
-- struct cciss_scsi_dev_t *sd = &ccissscsi[cntl_num].dev[i];
-+ for (i = 0; i < ccissscsi[h->ctlr].ndevices; i++) {
-+ struct cciss_scsi_dev_t *sd =
-+ &ccissscsi[h->ctlr].dev[i];
- buflen += sprintf(&buffer[buflen], "c%db%dt%dl%d %02d "
- "0x%02x%02x%02x%02x%02x%02x%02x%02x\n",
- sh->host_no, sd->bus, sd->target, sd->lun,
-@@ -1346,61 +1357,78 @@ cciss_scsi_proc_info(struct Scsi_Host *sh,
- *start = buffer + offset;
- return(datalen);
- } else /* User is writing to /proc/scsi/cciss*?/?* ... */
-- return cciss_scsi_user_command(cntl_num, sh->host_no,
-+ return cciss_scsi_user_command(h, sh->host_no,
- buffer, length);
--}
-+}
-
--/* cciss_scatter_gather takes a struct scsi_cmnd, (cmd), and does the pci
-- dma mapping and fills in the scatter gather entries of the
-- cciss command, cp. */
-+/* cciss_scatter_gather takes a struct scsi_cmnd, (cmd), and does the pci
-+ dma mapping and fills in the scatter gather entries of the
-+ cciss command, c. */
-
--static void
--cciss_scatter_gather(struct pci_dev *pdev,
-- CommandList_struct *cp,
-- struct scsi_cmnd *cmd)
-+static void cciss_scatter_gather(ctlr_info_t *h, CommandList_struct *c,
-+ struct scsi_cmnd *cmd)
- {
- unsigned int len;
- struct scatterlist *sg;
- __u64 addr64;
-- int use_sg, i;
-+ int request_nsgs, i, chained, sg_index;
-+ struct cciss_scsi_adapter_data_t *sa = h->scsi_ctlr;
-+ SGDescriptor_struct *curr_sg;
-
-- BUG_ON(scsi_sg_count(cmd) > MAXSGENTRIES);
-+ BUG_ON(scsi_sg_count(cmd) > h->maxsgentries);
-
-- use_sg = scsi_dma_map(cmd);
-- if (use_sg) { /* not too many addrs? */
-- scsi_for_each_sg(cmd, sg, use_sg, i) {
-+ chained = 0;
-+ sg_index = 0;
-+ curr_sg = c->SG;
-+ request_nsgs = scsi_dma_map(cmd);
-+ if (request_nsgs) {
-+ scsi_for_each_sg(cmd, sg, request_nsgs, i) {
-+ if (sg_index + 1 == h->max_cmd_sgentries &&
-+ !chained && request_nsgs - i > 1) {
-+ chained = 1;
-+ sg_index = 0;
-+ curr_sg = sa->cmd_sg_list[c->cmdindex];
-+ }
- addr64 = (__u64) sg_dma_address(sg);
- len = sg_dma_len(sg);
-- cp->SG[i].Addr.lower =
-- (__u32) (addr64 & (__u64) 0x00000000FFFFFFFF);
-- cp->SG[i].Addr.upper =
-- (__u32) ((addr64 >> 32) & (__u64) 0x00000000FFFFFFFF);
-- cp->SG[i].Len = len;
-- cp->SG[i].Ext = 0; // we are not chaining
-+ curr_sg[sg_index].Addr.lower =
-+ (__u32) (addr64 & 0x0FFFFFFFFULL);
-+ curr_sg[sg_index].Addr.upper =
-+ (__u32) ((addr64 >> 32) & 0x0FFFFFFFFULL);
-+ curr_sg[sg_index].Len = len;
-+ curr_sg[sg_index].Ext = 0;
-+ ++sg_index;
- }
-+ if (chained)
-+ cciss_map_sg_chain_block(h, c,
-+ sa->cmd_sg_list[c->cmdindex],
-+ (request_nsgs - (h->max_cmd_sgentries - 1)) *
-+ sizeof(SGDescriptor_struct));
- }
--
-- cp->Header.SGList = (__u8) use_sg; /* no. SGs contig in this cmd */
-- cp->Header.SGTotal = (__u16) use_sg; /* total sgs in this cmd list */
-+ /* track how many SG entries we are using */
-+ if (request_nsgs > h->maxSG)
-+ h->maxSG = request_nsgs;
-+ c->Header.SGTotal = (__u16) request_nsgs + chained;
-+ if (request_nsgs > h->max_cmd_sgentries)
-+ c->Header.SGList = h->max_cmd_sgentries;
-+ else
-+ c->Header.SGList = c->Header.SGTotal;
- return;
- }
-
--
--static int
--cciss_scsi_queue_command (struct scsi_cmnd *cmd, void (* done)(struct scsi_cmnd *))
-+DECLARE_QUEUECOMMAND(cciss_scsi_queue_command)
- {
-- ctlr_info_t **c;
-- int ctlr, rc;
-+ ctlr_info_t *h;
-+ int rc;
- unsigned char scsi3addr[8];
-- CommandList_struct *cp;
-+ CommandList_struct *c;
- unsigned long flags;
-
- // Get the ptr to our adapter structure (hba[i]) out of cmd->host.
- // We violate cmd->host privacy here. (Is there another way?)
-- c = (ctlr_info_t **) &cmd->device->host->hostdata[0];
-- ctlr = (*c)->ctlr;
-+ h = (ctlr_info_t *) cmd->device->host->hostdata[0];
-
-- rc = lookup_scsi3addr(ctlr, cmd->device->channel, cmd->device->id,
-+ rc = lookup_scsi3addr(h, cmd->device->channel, cmd->device->id,
- cmd->device->lun, scsi3addr);
- if (rc != 0) {
- /* the scsi nexus does not match any that we presented... */
-@@ -1412,19 +1440,14 @@ cciss_scsi_queue_command (struct scsi_cmnd *cmd, void (* done)(struct scsi_cmnd
- return 0;
- }
-
-- /* printk("cciss_queue_command, p=%p, cmd=0x%02x, c%db%dt%dl%d\n",
-- cmd, cmd->cmnd[0], ctlr, cmd->channel, cmd->target, cmd->lun);*/
-- // printk("q:%p:c%db%dt%dl%d ", cmd, ctlr, cmd->channel,
-- // cmd->target, cmd->lun);
--
- /* Ok, we have a reasonable scsi nexus, so send the cmd down, and
- see what the device thinks of it. */
-
-- spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
-- cp = scsi_cmd_alloc(*c);
-- spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
-- if (cp == NULL) { /* trouble... */
-- printk("scsi_cmd_alloc returned NULL!\n");
-+ spin_lock_irqsave(&h->lock, flags);
-+ c = scsi_cmd_alloc(h);
-+ spin_unlock_irqrestore(&h->lock, flags);
-+ if (c == NULL) { /* trouble... */
-+ dev_warn(&h->pdev->dev, "scsi_cmd_alloc returned NULL!\n");
- /* FIXME: next 3 lines are -> BAD! <- */
- cmd->result = DID_NO_CONNECT << 16;
- done(cmd);
-@@ -1433,69 +1456,65 @@ cciss_scsi_queue_command (struct scsi_cmnd *cmd, void (* done)(struct scsi_cmnd
-
- // Fill in the command list header
-
-- cmd->scsi_done = done; // save this for use by completion code
-+ cmd->scsi_done = done; // save this for use by completion code
-
-- // save cp in case we have to abort it
-- cmd->host_scribble = (unsigned char *) cp;
-+ /* save c in case we have to abort it */
-+ cmd->host_scribble = (unsigned char *) c;
-
-- cp->cmd_type = CMD_SCSI;
-- cp->scsi_cmd = cmd;
-- cp->Header.ReplyQueue = 0; // unused in simple mode
-- memcpy(&cp->Header.LUN.LunAddrBytes[0], &scsi3addr[0], 8);
-- cp->Header.Tag.lower = cp->busaddr; // Use k. address of cmd as tag
-+ c->cmd_type = CMD_SCSI;
-+ c->scsi_cmd = cmd;
-+ c->Header.ReplyQueue = 0; /* unused in simple mode */
-+ memcpy(&c->Header.LUN.LunAddrBytes[0], &scsi3addr[0], 8);
-+ c->Header.Tag.lower = c->busaddr; /* Use k. address of cmd as tag */
-
- // Fill in the request block...
-
-- cp->Request.Timeout = 0;
-- memset(cp->Request.CDB, 0, sizeof(cp->Request.CDB));
-- BUG_ON(cmd->cmd_len > sizeof(cp->Request.CDB));
-- cp->Request.CDBLen = cmd->cmd_len;
-- memcpy(cp->Request.CDB, cmd->cmnd, cmd->cmd_len);
-- cp->Request.Type.Type = TYPE_CMD;
-- cp->Request.Type.Attribute = ATTR_SIMPLE;
-+ c->Request.Timeout = 0;
-+ memset(c->Request.CDB, 0, sizeof(c->Request.CDB));
-+ BUG_ON(cmd->cmd_len > sizeof(c->Request.CDB));
-+ c->Request.CDBLen = cmd->cmd_len;
-+ memcpy(c->Request.CDB, cmd->cmnd, cmd->cmd_len);
-+ c->Request.Type.Type = TYPE_CMD;
-+ c->Request.Type.Attribute = ATTR_SIMPLE;
- switch(cmd->sc_data_direction)
- {
-- case DMA_TO_DEVICE: cp->Request.Type.Direction = XFER_WRITE; break;
-- case DMA_FROM_DEVICE: cp->Request.Type.Direction = XFER_READ; break;
-- case DMA_NONE: cp->Request.Type.Direction = XFER_NONE; break;
-+ case DMA_TO_DEVICE:
-+ c->Request.Type.Direction = XFER_WRITE;
-+ break;
-+ case DMA_FROM_DEVICE:
-+ c->Request.Type.Direction = XFER_READ;
-+ break;
-+ case DMA_NONE:
-+ c->Request.Type.Direction = XFER_NONE;
-+ break;
- case DMA_BIDIRECTIONAL:
- // This can happen if a buggy application does a scsi passthru
- // and sets both inlen and outlen to non-zero. ( see
- // ../scsi/scsi_ioctl.c:scsi_ioctl_send_command() )
-
-- cp->Request.Type.Direction = XFER_RSVD;
-+ c->Request.Type.Direction = XFER_RSVD;
- // This is technically wrong, and cciss controllers should
-- // reject it with CMD_INVALID, which is the most correct
-- // response, but non-fibre backends appear to let it
-+ // reject it with CMD_INVALID, which is the most correct
-+ // response, but non-fibre backends appear to let it
- // slide by, and give the same results as if this field
- // were set correctly. Either way is acceptable for
- // our purposes here.
-
- break;
-
-- default:
-- printk("cciss: unknown data direction: %d\n",
-+ default:
-+ dev_warn(&h->pdev->dev, "unknown data direction: %d\n",
- cmd->sc_data_direction);
- BUG();
- break;
- }
--
-- cciss_scatter_gather((*c)->pdev, cp, cmd); // Fill the SG list
--
-- /* Put the request on the tail of the request queue */
--
-- spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
-- addQ(&(*c)->reqQ, cp);
-- (*c)->Qdepth++;
-- start_io(*c);
-- spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
--
-+ cciss_scatter_gather(h, c, cmd);
-+ enqueue_cmd_and_start_io(h, c);
- /* the cmd'll come back via intr handler in complete_scsi_command() */
- return 0;
- }
-
--static void
--cciss_unregister_scsi(int ctlr)
-+static void cciss_unregister_scsi(ctlr_info_t *h)
- {
- struct cciss_scsi_adapter_data_t *sa;
- struct cciss_scsi_cmd_stack_t *stk;
-@@ -1503,59 +1522,58 @@ cciss_unregister_scsi(int ctlr)
-
- /* we are being forcibly unloaded, and may not refuse. */
-
-- spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
-- sa = (struct cciss_scsi_adapter_data_t *) hba[ctlr]->scsi_ctlr;
-- stk = &sa->cmd_stack;
-+ spin_lock_irqsave(&h->lock, flags);
-+ sa = h->scsi_ctlr;
-+ stk = &sa->cmd_stack;
-
-- /* if we weren't ever actually registered, don't unregister */
-+ /* if we weren't ever actually registered, don't unregister */
- if (sa->registered) {
-- spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
-+ spin_unlock_irqrestore(&h->lock, flags);
- scsi_remove_host(sa->scsi_host);
- scsi_host_put(sa->scsi_host);
-- spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
-+ spin_lock_irqsave(&h->lock, flags);
- }
-
-- /* set scsi_host to NULL so our detect routine will
-+ /* set scsi_host to NULL so our detect routine will
- find us on register */
- sa->scsi_host = NULL;
-- spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
-- scsi_cmd_stack_free(ctlr);
-+ spin_unlock_irqrestore(&h->lock, flags);
-+ scsi_cmd_stack_free(h);
- kfree(sa);
- }
-
--static int
--cciss_engage_scsi(int ctlr)
-+static int cciss_engage_scsi(ctlr_info_t *h)
- {
- struct cciss_scsi_adapter_data_t *sa;
- struct cciss_scsi_cmd_stack_t *stk;
- unsigned long flags;
-
-- spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
-- sa = (struct cciss_scsi_adapter_data_t *) hba[ctlr]->scsi_ctlr;
-- stk = &sa->cmd_stack;
-+ spin_lock_irqsave(&h->lock, flags);
-+ sa = h->scsi_ctlr;
-+ stk = &sa->cmd_stack;
-
- if (sa->registered) {
-- printk("cciss%d: SCSI subsystem already engaged.\n", ctlr);
-- spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
-- return ENXIO;
-+ dev_info(&h->pdev->dev, "SCSI subsystem already engaged.\n");
-+ spin_unlock_irqrestore(&h->lock, flags);
-+ return -ENXIO;
- }
- sa->registered = 1;
-- spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
-- cciss_update_non_disk_devices(ctlr, -1);
-- cciss_scsi_detect(ctlr);
-+ spin_unlock_irqrestore(&h->lock, flags);
-+ cciss_update_non_disk_devices(h, -1);
-+ cciss_scsi_detect(h);
- return 0;
- }
-
- static void
--cciss_seq_tape_report(struct seq_file *seq, int ctlr)
-+cciss_seq_tape_report(struct seq_file *seq, ctlr_info_t *h)
- {
- unsigned long flags;
-
-- CPQ_TAPE_LOCK(ctlr, flags);
-+ CPQ_TAPE_LOCK(h, flags);
- seq_printf(seq,
- "Sequential access devices: %d\n\n",
-- ccissscsi[ctlr].ndevices);
-- CPQ_TAPE_UNLOCK(ctlr, flags);
-+ ccissscsi[h->ctlr].ndevices);
-+ CPQ_TAPE_UNLOCK(h, flags);
- }
-
- static int wait_for_device_to_become_ready(ctlr_info_t *h,
-@@ -1566,10 +1584,10 @@ static int wait_for_device_to_become_ready(ctlr_info_t *h,
- int waittime = HZ;
- CommandList_struct *c;
-
-- c = cmd_alloc(h, 1);
-+ c = cmd_alloc(h);
- if (!c) {
-- printk(KERN_WARNING "cciss%d: out of memory in "
-- "wait_for_device_to_become_ready.\n", h->ctlr);
-+ dev_warn(&h->pdev->dev, "out of memory in "
-+ "wait_for_device_to_become_ready.\n");
- return IO_ERROR;
- }
-
-@@ -1587,7 +1605,7 @@ static int wait_for_device_to_become_ready(ctlr_info_t *h,
- waittime = waittime * 2;
-
- /* Send the Test Unit Ready */
-- rc = fill_cmd(c, TEST_UNIT_READY, h->ctlr, NULL, 0, 0,
-+ rc = fill_cmd(h, c, TEST_UNIT_READY, NULL, 0, 0,
- lunaddr, TYPE_CMD);
- if (rc == 0)
- rc = sendcmd_withirq_core(h, c, 0);
-@@ -1613,28 +1631,28 @@ static int wait_for_device_to_become_ready(ctlr_info_t *h,
- }
- }
- retry_tur:
-- printk(KERN_WARNING "cciss%d: Waiting %d secs "
-+ dev_warn(&h->pdev->dev, "Waiting %d secs "
- "for device to become ready.\n",
-- h->ctlr, waittime / HZ);
-+ waittime / HZ);
- rc = 1; /* device not ready. */
- }
-
- if (rc)
-- printk("cciss%d: giving up on device.\n", h->ctlr);
-+ dev_warn(&h->pdev->dev, "giving up on device.\n");
- else
-- printk(KERN_WARNING "cciss%d: device is ready.\n", h->ctlr);
-+ dev_warn(&h->pdev->dev, "device is ready.\n");
-
-- cmd_free(h, c, 1);
-+ cmd_free(h, c);
- return rc;
- }
-
--/* Need at least one of these error handlers to keep ../scsi/hosts.c from
-- * complaining. Doing a host- or bus-reset can't do anything good here.
-+/* Need at least one of these error handlers to keep ../scsi/hosts.c from
-+ * complaining. Doing a host- or bus-reset can't do anything good here.
- * Despite what it might say in scsi_error.c, there may well be commands
- * on the controller, as the cciss driver registers twice, once as a block
- * device for the logical drives, and once as a scsi device, for any tape
- * drives. So we know there are no commands out on the tape drives, but we
-- * don't know there are no commands on the controller, and it is likely
-+ * don't know there are no commands on the controller, and it is likely
- * that there probably are, as the cciss block device is most commonly used
- * as a boot device (embedded controller on HP/Compaq systems.)
- */
-@@ -1644,26 +1662,24 @@ static int cciss_eh_device_reset_handler(struct scsi_cmnd *scsicmd)
- int rc;
- CommandList_struct *cmd_in_trouble;
- unsigned char lunaddr[8];
-- ctlr_info_t **c;
-- int ctlr;
-+ ctlr_info_t *h;
-
- /* find the controller to which the command to be aborted was sent */
-- c = (ctlr_info_t **) &scsicmd->device->host->hostdata[0];
-- if (c == NULL) /* paranoia */
-+ h = (ctlr_info_t *) scsicmd->device->host->hostdata[0];
-+ if (h == NULL) /* paranoia */
- return FAILED;
-- ctlr = (*c)->ctlr;
-- printk(KERN_WARNING "cciss%d: resetting tape drive or medium changer.\n", ctlr);
-+ dev_warn(&h->pdev->dev, "resetting tape drive or medium changer.\n");
- /* find the command that's giving us trouble */
- cmd_in_trouble = (CommandList_struct *) scsicmd->host_scribble;
- if (cmd_in_trouble == NULL) /* paranoia */
- return FAILED;
- memcpy(lunaddr, &cmd_in_trouble->Header.LUN.LunAddrBytes[0], 8);
- /* send a reset to the SCSI LUN which the command was sent to */
-- rc = sendcmd_withirq(CCISS_RESET_MSG, ctlr, NULL, 0, 0, lunaddr,
-+ rc = sendcmd_withirq(h, CCISS_RESET_MSG, NULL, 0, 0, lunaddr,
- TYPE_MSG);
-- if (rc == 0 && wait_for_device_to_become_ready(*c, lunaddr) == 0)
-+ if (rc == 0 && wait_for_device_to_become_ready(h, lunaddr) == 0)
- return SUCCESS;
-- printk(KERN_WARNING "cciss%d: resetting device failed.\n", ctlr);
-+ dev_warn(&h->pdev->dev, "resetting device failed.\n");
- return FAILED;
- }
-
-@@ -1672,22 +1688,20 @@ static int cciss_eh_abort_handler(struct scsi_cmnd *scsicmd)
- int rc;
- CommandList_struct *cmd_to_abort;
- unsigned char lunaddr[8];
-- ctlr_info_t **c;
-- int ctlr;
-+ ctlr_info_t *h;
-
- /* find the controller to which the command to be aborted was sent */
-- c = (ctlr_info_t **) &scsicmd->device->host->hostdata[0];
-- if (c == NULL) /* paranoia */
-+ h = (ctlr_info_t *) scsicmd->device->host->hostdata[0];
-+ if (h == NULL) /* paranoia */
- return FAILED;
-- ctlr = (*c)->ctlr;
-- printk(KERN_WARNING "cciss%d: aborting tardy SCSI cmd\n", ctlr);
-+ dev_warn(&h->pdev->dev, "aborting tardy SCSI cmd\n");
-
- /* find the command to be aborted */
- cmd_to_abort = (CommandList_struct *) scsicmd->host_scribble;
- if (cmd_to_abort == NULL) /* paranoia */
- return FAILED;
- memcpy(lunaddr, &cmd_to_abort->Header.LUN.LunAddrBytes[0], 8);
-- rc = sendcmd_withirq(CCISS_ABORT_MSG, ctlr, &cmd_to_abort->Header.Tag,
-+ rc = sendcmd_withirq(h, CCISS_ABORT_MSG, &cmd_to_abort->Header.Tag,
- 0, 0, lunaddr, TYPE_MSG);
- if (rc == 0)
- return SUCCESS;
-@@ -1700,5 +1714,7 @@ static int cciss_eh_abort_handler(struct scsi_cmnd *scsicmd)
- /* If no tape support, then these become defined out of existence */
-
- #define cciss_scsi_setup(cntl_num)
-+#define cciss_engage_scsi(h)
-+static void print_cmd(CommandList_struct *cp) {}
-
- #endif /* CONFIG_CISS_SCSI_TAPE */
-diff --git a/drivers/block/cciss_scsi.h b/drivers/block/cciss_scsi.h
-index 7b75024..a4c62e8 100644
---- a/drivers/block/cciss_scsi.h
-+++ b/drivers/block/cciss_scsi.h
-@@ -1,6 +1,6 @@
- /*
- * Disk Array driver for HP Smart Array controllers, SCSI Tape module.
-- * (C) Copyright 2001, 2007 Hewlett-Packard Development Company, L.P.
-+ * (C) Copyright 2001, 2010 Hewlett-Packard Development Company, L.P.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
-@@ -25,30 +25,25 @@
-
- #include <scsi/scsicam.h> /* possibly irrelevant, since we don't show disks */
-
-- // the scsi id of the adapter...
-+ /* the scsi id of the adapter... */
- #define SELF_SCSI_ID 15
-- // 15 is somewhat arbitrary, since the scsi-2 bus
-- // that's presented by the driver to the OS is
-- // fabricated. The "real" scsi-3 bus the
-- // hardware presents is fabricated too.
-- // The actual, honest-to-goodness physical
-- // bus that the devices are attached to is not
-- // addressible natively, and may in fact turn
-- // out to be not scsi at all.
--
--#define SCSI_CCISS_CAN_QUEUE 2
--
--/*
--
--Note, cmd_per_lun could give us some trouble, so I'm setting it very low.
--Likewise, SCSI_CCISS_CAN_QUEUE is set very conservatively.
--
--If the upper scsi layer tries to track how many commands we have
-+ /* 15 is somewhat arbitrary, since the scsi-2 bus
-+ that's presented by the driver to the OS is
-+ fabricated. The "real" scsi-3 bus the
-+ hardware presents is fabricated too.
-+ The actual, honest-to-goodness physical
-+ bus that the devices are attached to is not
-+ addressible natively, and may in fact turn
-+ out to be not scsi at all. */
-+
-+/*
-+
-+If the upper scsi layer tries to track how many commands we have
- outstanding, it will be operating under the misapprehension that it is
- the only one sending us requests. We also have the block interface,
- which is where most requests must surely come from, so the upper layer's
- notion of how many requests we have outstanding will be wrong most or
--all of the time.
-+all of the time.
-
- Note, the normal SCSI mid-layer error handling doesn't work well
- for this driver because 1) it takes the io_request_lock before
-@@ -78,6 +73,5 @@ struct cciss_scsi_hba_t {
- #define CCISS_MAX_SCSI_DEVS_PER_HBA 16
- struct cciss_scsi_dev_t dev[CCISS_MAX_SCSI_DEVS_PER_HBA];
- };
--
- #endif /* _CCISS_SCSI_H_ */
- #endif /* CONFIG_CISS_SCSI_TAPE */
-diff --git a/drivers/block/cpqarray.c b/drivers/block/cpqarray.c
-index 6422651..bb1bdef 100644
---- a/drivers/block/cpqarray.c
-+++ b/drivers/block/cpqarray.c
-@@ -402,7 +402,7 @@ static int __init cpqarray_register_ctlr( int i, struct pci_dev *pdev)
- if (register_blkdev(COMPAQ_SMART2_MAJOR+i, hba[i]->devname)) {
- goto Enomem4;
- }
-- hba[i]->access.set_intr_mask(hba[i], 0);
-+ hba[i]->access->set_intr_mask(hba[i], 0);
- if (request_irq(hba[i]->intr, do_ida_intr,
- IRQF_DISABLED|IRQF_SHARED, hba[i]->devname, hba[i]))
- {
-@@ -460,7 +460,7 @@ static int __init cpqarray_register_ctlr( int i, struct pci_dev *pdev)
- add_timer(&hba[i]->timer);
-
- /* Enable IRQ now that spinlock and rate limit timer are set up */
-- hba[i]->access.set_intr_mask(hba[i], FIFO_NOT_EMPTY);
-+ hba[i]->access->set_intr_mask(hba[i], FIFO_NOT_EMPTY);
-
- for(j=0; j<NWD; j++) {
- struct gendisk *disk = ida_gendisk[i][j];
-@@ -695,7 +695,7 @@ DBGINFO(
- for(i=0; i<NR_PRODUCTS; i++) {
- if (board_id == products[i].board_id) {
- c->product_name = products[i].product_name;
-- c->access = *(products[i].access);
-+ c->access = products[i].access;
- break;
- }
- }
-@@ -793,7 +793,7 @@ static int __init cpqarray_eisa_detect(void)
- hba[ctlr]->intr = intr;
- sprintf(hba[ctlr]->devname, "ida%d", nr_ctlr);
- hba[ctlr]->product_name = products[j].product_name;
-- hba[ctlr]->access = *(products[j].access);
-+ hba[ctlr]->access = products[j].access;
- hba[ctlr]->ctlr = ctlr;
- hba[ctlr]->board_id = board_id;
- hba[ctlr]->pci_dev = NULL; /* not PCI */
-@@ -896,6 +896,8 @@ static void do_ida_request(struct request_queue *q)
- struct scatterlist tmp_sg[SG_MAX];
- int i, dir, seg;
-
-+ pax_track_stack();
-+
- if (blk_queue_plugged(q))
- goto startio;
-
-@@ -968,7 +970,7 @@ static void start_io(ctlr_info_t *h)
-
- while((c = h->reqQ) != NULL) {
- /* Can't do anything if we're busy */
-- if (h->access.fifo_full(h) == 0)
-+ if (h->access->fifo_full(h) == 0)
- return;
-
- /* Get the first entry from the request Q */
-@@ -976,7 +978,7 @@ static void start_io(ctlr_info_t *h)
- h->Qdepth--;
-
- /* Tell the controller to do our bidding */
-- h->access.submit_command(h, c);
-+ h->access->submit_command(h, c);
-
- /* Get onto the completion Q */
- addQ(&h->cmpQ, c);
-@@ -1038,7 +1040,7 @@ static irqreturn_t do_ida_intr(int irq, void *dev_id)
- unsigned long flags;
- __u32 a,a1;
-
-- istat = h->access.intr_pending(h);
-+ istat = h->access->intr_pending(h);
- /* Is this interrupt for us? */
- if (istat == 0)
- return IRQ_NONE;
-@@ -1049,7 +1051,7 @@ static irqreturn_t do_ida_intr(int irq, void *dev_id)
- */
- spin_lock_irqsave(IDA_LOCK(h->ctlr), flags);
- if (istat & FIFO_NOT_EMPTY) {
-- while((a = h->access.command_completed(h))) {
-+ while((a = h->access->command_completed(h))) {
- a1 = a; a &= ~3;
- if ((c = h->cmpQ) == NULL)
- {
-@@ -1434,11 +1436,11 @@ static int sendcmd(
- /*
- * Disable interrupt
- */
-- info_p->access.set_intr_mask(info_p, 0);
-+ info_p->access->set_intr_mask(info_p, 0);
- /* Make sure there is room in the command FIFO */
- /* Actually it should be completely empty at this time. */
- for (i = 200000; i > 0; i--) {
-- temp = info_p->access.fifo_full(info_p);
-+ temp = info_p->access->fifo_full(info_p);
- if (temp != 0) {
- break;
- }
-@@ -1451,7 +1453,7 @@ DBG(
- /*
- * Send the cmd
- */
-- info_p->access.submit_command(info_p, c);
-+ info_p->access->submit_command(info_p, c);
- complete = pollcomplete(ctlr);
-
- pci_unmap_single(info_p->pci_dev, (dma_addr_t) c->req.sg[0].addr,
-@@ -1534,9 +1536,9 @@ static int revalidate_allvol(ctlr_info_t *host)
- * we check the new geometry. Then turn interrupts back on when
- * we're done.
- */
-- host->access.set_intr_mask(host, 0);
-+ host->access->set_intr_mask(host, 0);
- getgeometry(ctlr);
-- host->access.set_intr_mask(host, FIFO_NOT_EMPTY);
-+ host->access->set_intr_mask(host, FIFO_NOT_EMPTY);
-
- for(i=0; i<NWD; i++) {
- struct gendisk *disk = ida_gendisk[ctlr][i];
-@@ -1576,7 +1578,7 @@ static int pollcomplete(int ctlr)
- /* Wait (up to 2 seconds) for a command to complete */
-
- for (i = 200000; i > 0; i--) {
-- done = hba[ctlr]->access.command_completed(hba[ctlr]);
-+ done = hba[ctlr]->access->command_completed(hba[ctlr]);
- if (done == 0) {
- udelay(10); /* a short fixed delay */
- } else
-diff --git a/drivers/block/cpqarray.h b/drivers/block/cpqarray.h
-index be73e9d..7fbf140 100644
---- a/drivers/block/cpqarray.h
-+++ b/drivers/block/cpqarray.h
-@@ -99,7 +99,7 @@ struct ctlr_info {
- drv_info_t drv[NWD];
- struct proc_dir_entry *proc;
-
-- struct access_method access;
-+ struct access_method *access;
-
- cmdlist_t *reqQ;
- cmdlist_t *cmpQ;
-diff --git a/drivers/block/loop.c b/drivers/block/loop.c
-index 8ec2d70..2804b30 100644
---- a/drivers/block/loop.c
-+++ b/drivers/block/loop.c
-@@ -282,7 +282,7 @@ static int __do_lo_send_write(struct file *file,
- mm_segment_t old_fs = get_fs();
-
- set_fs(get_ds());
-- bw = file->f_op->write(file, buf, len, &pos);
-+ bw = file->f_op->write(file, (const char __force_user *)buf, len, &pos);
- set_fs(old_fs);
- if (likely(bw == len))
- return 0;
-diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
-index 26ada47..083c480 100644
---- a/drivers/block/nbd.c
-+++ b/drivers/block/nbd.c
-@@ -155,6 +155,8 @@ static int sock_xmit(struct nbd_device *lo, int send, void *buf, int size,
- struct kvec iov;
- sigset_t blocked, oldset;
-
-+ pax_track_stack();
-+
- if (unlikely(!sock)) {
- printk(KERN_ERR "%s: Attempted %s on closed socket in sock_xmit\n",
- lo->disk->disk_name, (send ? "send" : "recv"));
-@@ -569,6 +571,8 @@ static void do_nbd_request(struct request_queue *q)
- static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *lo,
- unsigned int cmd, unsigned long arg)
- {
-+ pax_track_stack();
-+
- switch (cmd) {
- case NBD_DISCONNECT: {
- struct request sreq;
-diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
-index a5d585d..d087be3 100644
---- a/drivers/block/pktcdvd.c
-+++ b/drivers/block/pktcdvd.c
-@@ -284,7 +284,7 @@ static ssize_t kobj_pkt_store(struct kobject *kobj,
- return len;
- }
-
--static struct sysfs_ops kobj_pkt_ops = {
-+static const struct sysfs_ops kobj_pkt_ops = {
- .show = kobj_pkt_show,
- .store = kobj_pkt_store
- };
-diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
-index a4592ec..9236a27 100644
---- a/drivers/cdrom/cdrom.c
-+++ b/drivers/cdrom/cdrom.c
-@@ -410,7 +410,6 @@ int register_cdrom(struct cdrom_device_info *cdi)
- ENSURE(reset, CDC_RESET);
- ENSURE(generic_packet, CDC_GENERIC_PACKET);
- cdi->mc_flags = 0;
-- cdo->n_minors = 0;
- cdi->options = CDO_USE_FFLAGS;
-
- if (autoclose==1 && CDROM_CAN(CDC_CLOSE_TRAY))
-@@ -430,8 +429,11 @@ int register_cdrom(struct cdrom_device_info *cdi)
- else
- cdi->cdda_method = CDDA_OLD;
-
-- if (!cdo->generic_packet)
-- cdo->generic_packet = cdrom_dummy_generic_packet;
-+ if (!cdo->generic_packet) {
-+ pax_open_kernel();
-+ *(void **)&cdo->generic_packet = cdrom_dummy_generic_packet;
-+ pax_close_kernel();
-+ }
-
- cdinfo(CD_REG_UNREG, "drive \"/dev/%s\" registered\n", cdi->name);
- mutex_lock(&cdrom_mutex);
-@@ -452,7 +454,6 @@ void unregister_cdrom(struct cdrom_device_info *cdi)
- if (cdi->exit)
- cdi->exit(cdi);
-
-- cdi->ops->n_minors--;
- cdinfo(CD_REG_UNREG, "drive \"/dev/%s\" unregistered\n", cdi->name);
- }
-
-@@ -2047,7 +2048,7 @@ static int cdrom_read_cdda_old(struct cdrom_device_info *cdi, __u8 __user *ubuf,
- */
- nr = nframes;
- do {
-- cgc.buffer = kmalloc(CD_FRAMESIZE_RAW * nr, GFP_KERNEL);
-+ cgc.buffer = kzalloc(CD_FRAMESIZE_RAW * nr, GFP_KERNEL);
- if (cgc.buffer)
- break;
-
-@@ -2822,7 +2823,7 @@ static noinline int mmc_ioctl_cdrom_read_data(struct cdrom_device_info *cdi,
- if (lba < 0)
- return -EINVAL;
-
-- cgc->buffer = kmalloc(blocksize, GFP_KERNEL);
-+ cgc->buffer = kzalloc(blocksize, GFP_KERNEL);
- if (cgc->buffer == NULL)
- return -ENOMEM;
-
-diff --git a/drivers/cdrom/gdrom.c b/drivers/cdrom/gdrom.c
-index a762283..57cb232 100644
---- a/drivers/cdrom/gdrom.c
-+++ b/drivers/cdrom/gdrom.c
-@@ -487,7 +487,6 @@ static struct cdrom_device_ops gdrom_ops = {
- .audio_ioctl = gdrom_audio_ioctl,
- .capability = CDC_MULTI_SESSION | CDC_MEDIA_CHANGED |
- CDC_RESET | CDC_DRIVE_STATUS | CDC_CD_R,
-- .n_minors = 1,
- };
-
- static int gdrom_bdops_open(struct block_device *bdev, fmode_t mode)
-diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
-index 6aad99e..89cd142 100644
---- a/drivers/char/Kconfig
-+++ b/drivers/char/Kconfig
-@@ -90,7 +90,8 @@ config VT_HW_CONSOLE_BINDING
-
- config DEVKMEM
- bool "/dev/kmem virtual device support"
-- default y
-+ default n
-+ depends on !GRKERNSEC_KMEM
- help
- Say Y here if you want to support the /dev/kmem device. The
- /dev/kmem device is rarely used, but can be used for certain
-@@ -1114,6 +1115,7 @@ config DEVPORT
- bool
- depends on !M68K
- depends on ISA || PCI
-+ depends on !GRKERNSEC_KMEM
- default y
-
- source "drivers/s390/char/Kconfig"
-diff --git a/drivers/char/agp/frontend.c b/drivers/char/agp/frontend.c
-index a96f319..a778a5b 100644
---- a/drivers/char/agp/frontend.c
-+++ b/drivers/char/agp/frontend.c
-@@ -824,7 +824,7 @@ static int agpioc_reserve_wrap(struct agp_file_private *priv, void __user *arg)
- if (copy_from_user(&reserve, arg, sizeof(struct agp_region)))
- return -EFAULT;
-
-- if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment))
-+ if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment_priv))
- return -EFAULT;
-
- client = agp_find_client_by_pid(reserve.pid);
-diff --git a/drivers/char/briq_panel.c b/drivers/char/briq_panel.c
-index d8cff90..9628e70 100644
---- a/drivers/char/briq_panel.c
-+++ b/drivers/char/briq_panel.c
-@@ -10,6 +10,7 @@
- #include <linux/types.h>
- #include <linux/errno.h>
- #include <linux/tty.h>
-+#include <linux/mutex.h>
- #include <linux/timer.h>
- #include <linux/kernel.h>
- #include <linux/wait.h>
-@@ -36,6 +37,7 @@ static int vfd_is_open;
- static unsigned char vfd[40];
- static int vfd_cursor;
- static unsigned char ledpb, led;
-+static DEFINE_MUTEX(vfd_mutex);
-
- static void update_vfd(void)
- {
-@@ -142,12 +144,15 @@ static ssize_t briq_panel_write(struct file *file, const char __user *buf, size_
- if (!vfd_is_open)
- return -EBUSY;
-
-+ mutex_lock(&vfd_mutex);
- for (;;) {
- char c;
- if (!indx)
- break;
-- if (get_user(c, buf))
-+ if (get_user(c, buf)) {
-+ mutex_unlock(&vfd_mutex);
- return -EFAULT;
-+ }
- if (esc) {
- set_led(c);
- esc = 0;
-@@ -177,6 +182,7 @@ static ssize_t briq_panel_write(struct file *file, const char __user *buf, size_
- buf++;
- }
- update_vfd();
-+ mutex_unlock(&vfd_mutex);
-
- return len;
- }
-diff --git a/drivers/char/genrtc.c b/drivers/char/genrtc.c
-index 31e7c91..161afc0 100644
---- a/drivers/char/genrtc.c
-+++ b/drivers/char/genrtc.c
-@@ -272,6 +272,7 @@ static int gen_rtc_ioctl(struct inode *inode, struct file *file,
- switch (cmd) {
-
- case RTC_PLL_GET:
-+ memset(&pll, 0, sizeof(pll));
- if (get_rtc_pll(&pll))
- return -EINVAL;
- else
-diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
-index 006466d..b1acdc1 100644
---- a/drivers/char/hpet.c
-+++ b/drivers/char/hpet.c
-@@ -355,26 +355,14 @@ static int hpet_mmap(struct file *file, struct vm_area_struct *vma)
- struct hpet_dev *devp;
- unsigned long addr;
-
-- if (((vma->vm_end - vma->vm_start) != PAGE_SIZE) || vma->vm_pgoff)
-- return -EINVAL;
--
- devp = file->private_data;
- addr = devp->hd_hpets->hp_hpet_phys;
-
- if (addr & (PAGE_SIZE - 1))
- return -ENOSYS;
-
-- vma->vm_flags |= VM_IO;
- vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
--
-- if (io_remap_pfn_range(vma, vma->vm_start, addr >> PAGE_SHIFT,
-- PAGE_SIZE, vma->vm_page_prot)) {
-- printk(KERN_ERR "%s: io_remap_pfn_range failed\n",
-- __func__);
-- return -EAGAIN;
-- }
--
-- return 0;
-+ return vm_iomap_memory(vma, addr, PAGE_SIZE);
- #else
- return -ENOSYS;
- #endif
-@@ -430,7 +418,7 @@ static int hpet_release(struct inode *inode, struct file *file)
- return 0;
- }
-
--static int hpet_ioctl_common(struct hpet_dev *, int, unsigned long, int);
-+static int hpet_ioctl_common(struct hpet_dev *, unsigned int, unsigned long, int);
-
- static int
- hpet_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
-@@ -565,7 +553,7 @@ static inline unsigned long hpet_time_div(struct hpets *hpets,
- }
-
- static int
--hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg, int kernel)
-+hpet_ioctl_common(struct hpet_dev *devp, unsigned int cmd, unsigned long arg, int kernel)
- {
- struct hpet_timer __iomem *timer;
- struct hpet __iomem *hpet;
-@@ -608,11 +596,11 @@ hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg, int kernel)
- {
- struct hpet_info info;
-
-+ memset(&info, 0, sizeof(info));
-+
- if (devp->hd_ireqfreq)
- info.hi_ireqfreq =
- hpet_time_div(hpetp, devp->hd_ireqfreq);
-- else
-- info.hi_ireqfreq = 0;
- info.hi_flags =
- readq(&timer->hpet_config) & Tn_PER_INT_CAP_MASK;
- info.hi_hpet = hpetp->hp_which;
-diff --git a/drivers/char/hvc_beat.c b/drivers/char/hvc_beat.c
-index 0afc8b8..6913fc3 100644
---- a/drivers/char/hvc_beat.c
-+++ b/drivers/char/hvc_beat.c
-@@ -84,7 +84,7 @@ static int hvc_beat_put_chars(uint32_t vtermno, const char *buf, int cnt)
- return cnt;
- }
-
--static struct hv_ops hvc_beat_get_put_ops = {
-+static const struct hv_ops hvc_beat_get_put_ops = {
- .get_chars = hvc_beat_get_chars,
- .put_chars = hvc_beat_put_chars,
- };
-diff --git a/drivers/char/hvc_console.c b/drivers/char/hvc_console.c
-index 98097f2..407dddc 100644
---- a/drivers/char/hvc_console.c
-+++ b/drivers/char/hvc_console.c
-@@ -125,7 +125,7 @@ static struct hvc_struct *hvc_get_by_index(int index)
- * console interfaces but can still be used as a tty device. This has to be
- * static because kmalloc will not work during early console init.
- */
--static struct hv_ops *cons_ops[MAX_NR_HVC_CONSOLES];
-+static const struct hv_ops *cons_ops[MAX_NR_HVC_CONSOLES];
- static uint32_t vtermnos[MAX_NR_HVC_CONSOLES] =
- {[0 ... MAX_NR_HVC_CONSOLES - 1] = -1};
-
-@@ -249,7 +249,7 @@ static void destroy_hvc_struct(struct kref *kref)
- * vty adapters do NOT get an hvc_instantiate() callback since they
- * appear after early console init.
- */
--int hvc_instantiate(uint32_t vtermno, int index, struct hv_ops *ops)
-+int hvc_instantiate(uint32_t vtermno, int index, const struct hv_ops *ops)
- {
- struct hvc_struct *hp;
-
-@@ -758,7 +758,7 @@ static const struct tty_operations hvc_ops = {
- };
-
- struct hvc_struct __devinit *hvc_alloc(uint32_t vtermno, int data,
-- struct hv_ops *ops, int outbuf_size)
-+ const struct hv_ops *ops, int outbuf_size)
- {
- struct hvc_struct *hp;
- int i;
-diff --git a/drivers/char/hvc_console.h b/drivers/char/hvc_console.h
-index 10950ca..ed176c3 100644
---- a/drivers/char/hvc_console.h
-+++ b/drivers/char/hvc_console.h
-@@ -55,7 +55,7 @@ struct hvc_struct {
- int outbuf_size;
- int n_outbuf;
- uint32_t vtermno;
-- struct hv_ops *ops;
-+ const struct hv_ops *ops;
- int irq_requested;
- int data;
- struct winsize ws;
-@@ -76,11 +76,11 @@ struct hv_ops {
- };
-
- /* Register a vterm and a slot index for use as a console (console_init) */
--extern int hvc_instantiate(uint32_t vtermno, int index, struct hv_ops *ops);
-+extern int hvc_instantiate(uint32_t vtermno, int index, const struct hv_ops *ops);
-
- /* register a vterm for hvc tty operation (module_init or hotplug add) */
- extern struct hvc_struct * __devinit hvc_alloc(uint32_t vtermno, int data,
-- struct hv_ops *ops, int outbuf_size);
-+ const struct hv_ops *ops, int outbuf_size);
- /* remove a vterm from hvc tty operation (module_exit or hotplug remove) */
- extern int hvc_remove(struct hvc_struct *hp);
-
-diff --git a/drivers/char/hvc_iseries.c b/drivers/char/hvc_iseries.c
-index 936d05b..fd02426 100644
---- a/drivers/char/hvc_iseries.c
-+++ b/drivers/char/hvc_iseries.c
-@@ -197,7 +197,7 @@ done:
- return sent;
- }
-
--static struct hv_ops hvc_get_put_ops = {
-+static const struct hv_ops hvc_get_put_ops = {
- .get_chars = get_chars,
- .put_chars = put_chars,
- .notifier_add = notifier_add_irq,
-diff --git a/drivers/char/hvc_iucv.c b/drivers/char/hvc_iucv.c
-index b0e168f..69cda2a 100644
---- a/drivers/char/hvc_iucv.c
-+++ b/drivers/char/hvc_iucv.c
-@@ -924,7 +924,7 @@ static int hvc_iucv_pm_restore_thaw(struct device *dev)
-
-
- /* HVC operations */
--static struct hv_ops hvc_iucv_ops = {
-+static const struct hv_ops hvc_iucv_ops = {
- .get_chars = hvc_iucv_get_chars,
- .put_chars = hvc_iucv_put_chars,
- .notifier_add = hvc_iucv_notifier_add,
-diff --git a/drivers/char/hvc_rtas.c b/drivers/char/hvc_rtas.c
-index 88590d0..61c4a61 100644
---- a/drivers/char/hvc_rtas.c
-+++ b/drivers/char/hvc_rtas.c
-@@ -71,7 +71,7 @@ static int hvc_rtas_read_console(uint32_t vtermno, char *buf, int count)
- return i;
- }
-
--static struct hv_ops hvc_rtas_get_put_ops = {
-+static const struct hv_ops hvc_rtas_get_put_ops = {
- .get_chars = hvc_rtas_read_console,
- .put_chars = hvc_rtas_write_console,
- };
-diff --git a/drivers/char/hvc_udbg.c b/drivers/char/hvc_udbg.c
-index bd63ba8..b0957e6 100644
---- a/drivers/char/hvc_udbg.c
-+++ b/drivers/char/hvc_udbg.c
-@@ -58,7 +58,7 @@ static int hvc_udbg_get(uint32_t vtermno, char *buf, int count)
- return i;
- }
-
--static struct hv_ops hvc_udbg_ops = {
-+static const struct hv_ops hvc_udbg_ops = {
- .get_chars = hvc_udbg_get,
- .put_chars = hvc_udbg_put,
- };
-diff --git a/drivers/char/hvc_vio.c b/drivers/char/hvc_vio.c
-index 10be343..27370e9 100644
---- a/drivers/char/hvc_vio.c
-+++ b/drivers/char/hvc_vio.c
-@@ -77,7 +77,7 @@ static int filtered_get_chars(uint32_t vtermno, char *buf, int count)
- return got;
- }
-
--static struct hv_ops hvc_get_put_ops = {
-+static const struct hv_ops hvc_get_put_ops = {
- .get_chars = filtered_get_chars,
- .put_chars = hvc_put_chars,
- .notifier_add = notifier_add_irq,
-diff --git a/drivers/char/hvc_xen.c b/drivers/char/hvc_xen.c
-index a6ee32b..94f8c26 100644
---- a/drivers/char/hvc_xen.c
-+++ b/drivers/char/hvc_xen.c
-@@ -120,7 +120,7 @@ static int read_console(uint32_t vtermno, char *buf, int len)
- return recv;
- }
-
--static struct hv_ops hvc_ops = {
-+static const struct hv_ops hvc_ops = {
- .get_chars = read_console,
- .put_chars = write_console,
- .notifier_add = notifier_add_irq,
-diff --git a/drivers/char/hvcs.c b/drivers/char/hvcs.c
-index 266b858..f3ee0bb 100644
---- a/drivers/char/hvcs.c
-+++ b/drivers/char/hvcs.c
-@@ -82,6 +82,7 @@
- #include <asm/hvcserver.h>
- #include <asm/uaccess.h>
- #include <asm/vio.h>
-+#include <asm/local.h>
-
- /*
- * 1.3.0 -> 1.3.1 In hvcs_open memset(..,0x00,..) instead of memset(..,0x3F,00).
-@@ -269,7 +270,7 @@ struct hvcs_struct {
- unsigned int index;
-
- struct tty_struct *tty;
-- int open_count;
-+ local_t open_count;
-
- /*
- * Used to tell the driver kernel_thread what operations need to take
-@@ -419,7 +420,7 @@ static ssize_t hvcs_vterm_state_store(struct device *dev, struct device_attribut
-
- spin_lock_irqsave(&hvcsd->lock, flags);
-
-- if (hvcsd->open_count > 0) {
-+ if (local_read(&hvcsd->open_count) > 0) {
- spin_unlock_irqrestore(&hvcsd->lock, flags);
- printk(KERN_INFO "HVCS: vterm state unchanged. "
- "The hvcs device node is still in use.\n");
-@@ -1135,7 +1136,7 @@ static int hvcs_open(struct tty_struct *tty, struct file *filp)
- if ((retval = hvcs_partner_connect(hvcsd)))
- goto error_release;
-
-- hvcsd->open_count = 1;
-+ local_set(&hvcsd->open_count, 1);
- hvcsd->tty = tty;
- tty->driver_data = hvcsd;
-
-@@ -1169,7 +1170,7 @@ fast_open:
-
- spin_lock_irqsave(&hvcsd->lock, flags);
- kref_get(&hvcsd->kref);
-- hvcsd->open_count++;
-+ local_inc(&hvcsd->open_count);
- hvcsd->todo_mask |= HVCS_SCHED_READ;
- spin_unlock_irqrestore(&hvcsd->lock, flags);
-
-@@ -1213,7 +1214,7 @@ static void hvcs_close(struct tty_struct *tty, struct file *filp)
- hvcsd = tty->driver_data;
-
- spin_lock_irqsave(&hvcsd->lock, flags);
-- if (--hvcsd->open_count == 0) {
-+ if (local_dec_and_test(&hvcsd->open_count)) {
-
- vio_disable_interrupts(hvcsd->vdev);
-
-@@ -1239,10 +1240,10 @@ static void hvcs_close(struct tty_struct *tty, struct file *filp)
- free_irq(irq, hvcsd);
- kref_put(&hvcsd->kref, destroy_hvcs_struct);
- return;
-- } else if (hvcsd->open_count < 0) {
-+ } else if (local_read(&hvcsd->open_count) < 0) {
- printk(KERN_ERR "HVCS: vty-server@%X open_count: %d"
- " is missmanaged.\n",
-- hvcsd->vdev->unit_address, hvcsd->open_count);
-+ hvcsd->vdev->unit_address, local_read(&hvcsd->open_count));
- }
-
- spin_unlock_irqrestore(&hvcsd->lock, flags);
-@@ -1258,7 +1259,7 @@ static void hvcs_hangup(struct tty_struct * tty)
-
- spin_lock_irqsave(&hvcsd->lock, flags);
- /* Preserve this so that we know how many kref refs to put */
-- temp_open_count = hvcsd->open_count;
-+ temp_open_count = local_read(&hvcsd->open_count);
-
- /*
- * Don't kref put inside the spinlock because the destruction
-@@ -1273,7 +1274,7 @@ static void hvcs_hangup(struct tty_struct * tty)
- hvcsd->tty->driver_data = NULL;
- hvcsd->tty = NULL;
-
-- hvcsd->open_count = 0;
-+ local_set(&hvcsd->open_count, 0);
-
- /* This will drop any buffered data on the floor which is OK in a hangup
- * scenario. */
-@@ -1344,7 +1345,7 @@ static int hvcs_write(struct tty_struct *tty,
- * the middle of a write operation? This is a crummy place to do this
- * but we want to keep it all in the spinlock.
- */
-- if (hvcsd->open_count <= 0) {
-+ if (local_read(&hvcsd->open_count) <= 0) {
- spin_unlock_irqrestore(&hvcsd->lock, flags);
- return -ENODEV;
- }
-@@ -1418,7 +1419,7 @@ static int hvcs_write_room(struct tty_struct *tty)
- {
- struct hvcs_struct *hvcsd = tty->driver_data;
-
-- if (!hvcsd || hvcsd->open_count <= 0)
-+ if (!hvcsd || local_read(&hvcsd->open_count) <= 0)
- return 0;
-
- return HVCS_BUFF_LEN - hvcsd->chars_in_buffer;
-diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
-index ec5e3f8..02455ba 100644
---- a/drivers/char/ipmi/ipmi_msghandler.c
-+++ b/drivers/char/ipmi/ipmi_msghandler.c
-@@ -414,7 +414,7 @@ struct ipmi_smi {
- struct proc_dir_entry *proc_dir;
- char proc_dir_name[10];
-
-- atomic_t stats[IPMI_NUM_STATS];
-+ atomic_unchecked_t stats[IPMI_NUM_STATS];
-
- /*
- * run_to_completion duplicate of smb_info, smi_info
-@@ -447,9 +447,9 @@ static DEFINE_MUTEX(smi_watchers_mutex);
-
-
- #define ipmi_inc_stat(intf, stat) \
-- atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
-+ atomic_inc_unchecked(&(intf)->stats[IPMI_STAT_ ## stat])
- #define ipmi_get_stat(intf, stat) \
-- ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
-+ ((unsigned int) atomic_read_unchecked(&(intf)->stats[IPMI_STAT_ ## stat]))
-
- static int is_lan_addr(struct ipmi_addr *addr)
- {
-@@ -2808,7 +2808,7 @@ int ipmi_register_smi(struct ipmi_smi_handlers *handlers,
- INIT_LIST_HEAD(&intf->cmd_rcvrs);
- init_waitqueue_head(&intf->waitq);
- for (i = 0; i < IPMI_NUM_STATS; i++)
-- atomic_set(&intf->stats[i], 0);
-+ atomic_set_unchecked(&intf->stats[i], 0);
-
- intf->proc_dir = NULL;
-
-@@ -4160,6 +4160,8 @@ static void send_panic_events(char *str)
- struct ipmi_smi_msg smi_msg;
- struct ipmi_recv_msg recv_msg;
-
-+ pax_track_stack();
-+
- si = (struct ipmi_system_interface_addr *) &addr;
- si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
- si->channel = IPMI_BMC_CHANNEL;
-diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
-index abae8c9..8021979 100644
---- a/drivers/char/ipmi/ipmi_si_intf.c
-+++ b/drivers/char/ipmi/ipmi_si_intf.c
-@@ -277,7 +277,7 @@ struct smi_info {
- unsigned char slave_addr;
-
- /* Counters and things for the proc filesystem. */
-- atomic_t stats[SI_NUM_STATS];
-+ atomic_unchecked_t stats[SI_NUM_STATS];
-
- struct task_struct *thread;
-
-@@ -285,9 +285,9 @@ struct smi_info {
- };
-
- #define smi_inc_stat(smi, stat) \
-- atomic_inc(&(smi)->stats[SI_STAT_ ## stat])
-+ atomic_inc_unchecked(&(smi)->stats[SI_STAT_ ## stat])
- #define smi_get_stat(smi, stat) \
-- ((unsigned int) atomic_read(&(smi)->stats[SI_STAT_ ## stat]))
-+ ((unsigned int) atomic_read_unchecked(&(smi)->stats[SI_STAT_ ## stat]))
-
- #define SI_MAX_PARMS 4
-
-@@ -2931,7 +2931,7 @@ static int try_smi_init(struct smi_info *new_smi)
- atomic_set(&new_smi->req_events, 0);
- new_smi->run_to_completion = 0;
- for (i = 0; i < SI_NUM_STATS; i++)
-- atomic_set(&new_smi->stats[i], 0);
-+ atomic_set_unchecked(&new_smi->stats[i], 0);
-
- new_smi->interrupt_disabled = 0;
- atomic_set(&new_smi->stop_operation, 0);
-diff --git a/drivers/char/istallion.c b/drivers/char/istallion.c
-index 402838f..55e2200 100644
---- a/drivers/char/istallion.c
-+++ b/drivers/char/istallion.c
-@@ -187,7 +187,6 @@ static struct ktermios stli_deftermios = {
- * re-used for each stats call.
- */
- static comstats_t stli_comstats;
--static combrd_t stli_brdstats;
- static struct asystats stli_cdkstats;
-
- /*****************************************************************************/
-@@ -4058,6 +4057,7 @@ static int stli_getbrdstats(combrd_t __user *bp)
- {
- struct stlibrd *brdp;
- unsigned int i;
-+ combrd_t stli_brdstats;
-
- if (copy_from_user(&stli_brdstats, bp, sizeof(combrd_t)))
- return -EFAULT;
-@@ -4269,6 +4269,8 @@ static int stli_getportstruct(struct stliport __user *arg)
- struct stliport stli_dummyport;
- struct stliport *portp;
-
-+ pax_track_stack();
-+
- if (copy_from_user(&stli_dummyport, arg, sizeof(struct stliport)))
- return -EFAULT;
- portp = stli_getport(stli_dummyport.brdnr, stli_dummyport.panelnr,
-@@ -4291,6 +4293,8 @@ static int stli_getbrdstruct(struct stlibrd __user *arg)
- struct stlibrd stli_dummybrd;
- struct stlibrd *brdp;
-
-+ pax_track_stack();
-+
- if (copy_from_user(&stli_dummybrd, arg, sizeof(struct stlibrd)))
- return -EFAULT;
- if (stli_dummybrd.brdnr >= STL_MAXBRDS)
-diff --git a/drivers/char/keyboard.c b/drivers/char/keyboard.c
-index 950837c..e55a288 100644
---- a/drivers/char/keyboard.c
-+++ b/drivers/char/keyboard.c
-@@ -635,6 +635,16 @@ static void k_spec(struct vc_data *vc, unsigned char value, char up_flag)
- kbd->kbdmode == VC_MEDIUMRAW) &&
- value != KVAL(K_SAK))
- return; /* SAK is allowed even in raw mode */
-+
-+#if defined(CONFIG_GRKERNSEC_PROC) || defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
-+ {
-+ void *func = fn_handler[value];
-+ if (func == fn_show_state || func == fn_show_ptregs ||
-+ func == fn_show_mem)
-+ return;
-+ }
-+#endif
-+
- fn_handler[value](vc);
- }
-
-@@ -1386,7 +1396,7 @@ static const struct input_device_id kbd_ids[] = {
- .evbit = { BIT_MASK(EV_SND) },
- },
-
-- { }, /* Terminating entry */
-+ { 0 }, /* Terminating entry */
- };
-
- MODULE_DEVICE_TABLE(input, kbd_ids);
-diff --git a/drivers/char/mbcs.c b/drivers/char/mbcs.c
-index 87c67b4..230527a 100644
---- a/drivers/char/mbcs.c
-+++ b/drivers/char/mbcs.c
-@@ -799,7 +799,7 @@ static int mbcs_remove(struct cx_dev *dev)
- return 0;
- }
-
--static const struct cx_device_id __devinitdata mbcs_id_table[] = {
-+static const struct cx_device_id __devinitconst mbcs_id_table[] = {
- {
- .part_num = MBCS_PART_NUM,
- .mfg_num = MBCS_MFG_NUM,
-diff --git a/drivers/char/mem.c b/drivers/char/mem.c
-index 1270f64..3f4b1fa 100644
---- a/drivers/char/mem.c
-+++ b/drivers/char/mem.c
-@@ -18,6 +18,7 @@
- #include <linux/raw.h>
- #include <linux/tty.h>
- #include <linux/capability.h>
-+#include <linux/security.h>
- #include <linux/ptrace.h>
- #include <linux/device.h>
- #include <linux/highmem.h>
-@@ -35,6 +36,10 @@
- # include <linux/efi.h>
- #endif
-
-+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
-+extern struct file_operations grsec_fops;
-+#endif
-+
- static inline unsigned long size_inside_page(unsigned long start,
- unsigned long size)
- {
-@@ -102,9 +107,13 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
-
- while (cursor < to) {
- if (!devmem_is_allowed(pfn)) {
-+#ifdef CONFIG_GRKERNSEC_KMEM
-+ gr_handle_mem_readwrite(from, to);
-+#else
- printk(KERN_INFO
- "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
- current->comm, from, to);
-+#endif
- return 0;
- }
- cursor += PAGE_SIZE;
-@@ -112,6 +121,11 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
- }
- return 1;
- }
-+#elif defined(CONFIG_GRKERNSEC_KMEM)
-+static inline int range_is_allowed(unsigned long pfn, unsigned long size)
-+{
-+ return 0;
-+}
- #else
- static inline int range_is_allowed(unsigned long pfn, unsigned long size)
- {
-@@ -155,6 +169,8 @@ static ssize_t read_mem(struct file * file, char __user * buf,
- #endif
-
- while (count > 0) {
-+ char *temp;
-+
- /*
- * Handle first page in case it's not aligned
- */
-@@ -177,11 +193,31 @@ static ssize_t read_mem(struct file * file, char __user * buf,
- if (!ptr)
- return -EFAULT;
-
-- if (copy_to_user(buf, ptr, sz)) {
-+#ifdef CONFIG_PAX_USERCOPY
-+ temp = kmalloc(sz, GFP_KERNEL|GFP_USERCOPY);
-+ if (!temp) {
-+ unxlate_dev_mem_ptr(p, ptr);
-+ return -ENOMEM;
-+ }
-+ memcpy(temp, ptr, sz);
-+#else
-+ temp = ptr;
-+#endif
-+
-+ if (copy_to_user(buf, temp, sz)) {
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+ kfree(temp);
-+#endif
-+
- unxlate_dev_mem_ptr(p, ptr);
- return -EFAULT;
- }
-
-+#ifdef CONFIG_PAX_USERCOPY
-+ kfree(temp);
-+#endif
-+
- unxlate_dev_mem_ptr(p, ptr);
-
- buf += sz;
-@@ -419,9 +455,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
- size_t count, loff_t *ppos)
- {
- unsigned long p = *ppos;
-- ssize_t low_count, read, sz;
-+ ssize_t low_count, read, sz, err = 0;
- char * kbuf; /* k-addr because vread() takes vmlist_lock rwlock */
-- int err = 0;
-
- read = 0;
- if (p < (unsigned long) high_memory) {
-@@ -444,6 +479,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
- }
- #endif
- while (low_count > 0) {
-+ char *temp;
-+
- sz = size_inside_page(p, low_count);
-
- /*
-@@ -453,7 +490,22 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
- */
- kbuf = xlate_dev_kmem_ptr((char *)p);
-
-- if (copy_to_user(buf, kbuf, sz))
-+#ifdef CONFIG_PAX_USERCOPY
-+ temp = kmalloc(sz, GFP_KERNEL|GFP_USERCOPY);
-+ if (!temp)
-+ return -ENOMEM;
-+ memcpy(temp, kbuf, sz);
-+#else
-+ temp = kbuf;
-+#endif
-+
-+ err = copy_to_user(buf, temp, sz);
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+ kfree(temp);
-+#endif
-+
-+ if (err)
- return -EFAULT;
- buf += sz;
- p += sz;
-@@ -848,6 +900,11 @@ static ssize_t kmsg_write(struct file * file, const char __user * buf,
- char *tmp;
- ssize_t ret;
-
-+#ifdef CONFIG_GRKERNSEC_DMESG
-+ if (!capable(CAP_SYS_ADMIN))
-+ return -EPERM;
-+#endif
-+
- tmp = kmalloc(count + 1, GFP_KERNEL);
- if (tmp == NULL)
- return -ENOMEM;
-@@ -889,6 +946,9 @@ static const struct memdev {
- #ifdef CONFIG_CRASH_DUMP
- [12] = { "oldmem", 0, &oldmem_fops, NULL },
- #endif
-+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
-+ [13] = { "grsec",S_IRUSR | S_IWUGO, &grsec_fops, NULL },
-+#endif
- };
-
- static int memory_open(struct inode *inode, struct file *filp)
-diff --git a/drivers/char/mmtimer.c b/drivers/char/mmtimer.c
-index 918711a..4ffaf5e 100644
---- a/drivers/char/mmtimer.c
-+++ b/drivers/char/mmtimer.c
-@@ -756,7 +756,7 @@ static int sgi_timer_set(struct k_itimer *timr, int flags,
- return err;
- }
-
--static struct k_clock sgi_clock = {
-+static k_clock_no_const sgi_clock = {
- .res = 0,
- .clock_set = sgi_clock_set,
- .clock_get = sgi_clock_get,
-diff --git a/drivers/char/mwave/tp3780i.c b/drivers/char/mwave/tp3780i.c
-index c689697..04e6d6a2 100644
---- a/drivers/char/mwave/tp3780i.c
-+++ b/drivers/char/mwave/tp3780i.c
-@@ -479,6 +479,7 @@ int tp3780I_QueryAbilities(THINKPAD_BD_DATA * pBDData, MW_ABILITIES * pAbilities
- PRINTK_2(TRACE_TP3780I,
- "tp3780i::tp3780I_QueryAbilities entry pBDData %p\n", pBDData);
-
-+ memset(pAbilities, 0, sizeof(*pAbilities));
- /* fill out standard constant fields */
- pAbilities->instr_per_sec = pBDData->rDspSettings.uIps;
- pAbilities->data_size = pBDData->rDspSettings.uDStoreSize;
-diff --git a/drivers/char/pcmcia/ipwireless/tty.c b/drivers/char/pcmcia/ipwireless/tty.c
-index 674b3ab..a8d1970 100644
---- a/drivers/char/pcmcia/ipwireless/tty.c
-+++ b/drivers/char/pcmcia/ipwireless/tty.c
-@@ -29,6 +29,7 @@
- #include <linux/tty_driver.h>
- #include <linux/tty_flip.h>
- #include <linux/uaccess.h>
-+#include <asm/local.h>
-
- #include "tty.h"
- #include "network.h"
-@@ -51,7 +52,7 @@ struct ipw_tty {
- int tty_type;
- struct ipw_network *network;
- struct tty_struct *linux_tty;
-- int open_count;
-+ local_t open_count;
- unsigned int control_lines;
- struct mutex ipw_tty_mutex;
- int tx_bytes_queued;
-@@ -127,10 +128,10 @@ static int ipw_open(struct tty_struct *linux_tty, struct file *filp)
- mutex_unlock(&tty->ipw_tty_mutex);
- return -ENODEV;
- }
-- if (tty->open_count == 0)
-+ if (local_read(&tty->open_count) == 0)
- tty->tx_bytes_queued = 0;
-
-- tty->open_count++;
-+ local_inc(&tty->open_count);
-
- tty->linux_tty = linux_tty;
- linux_tty->driver_data = tty;
-@@ -146,9 +147,7 @@ static int ipw_open(struct tty_struct *linux_tty, struct file *filp)
-
- static void do_ipw_close(struct ipw_tty *tty)
- {
-- tty->open_count--;
--
-- if (tty->open_count == 0) {
-+ if (local_dec_return(&tty->open_count) == 0) {
- struct tty_struct *linux_tty = tty->linux_tty;
-
- if (linux_tty != NULL) {
-@@ -169,7 +168,7 @@ static void ipw_hangup(struct tty_struct *linux_tty)
- return;
-
- mutex_lock(&tty->ipw_tty_mutex);
-- if (tty->open_count == 0) {
-+ if (local_read(&tty->open_count) == 0) {
- mutex_unlock(&tty->ipw_tty_mutex);
- return;
- }
-@@ -198,7 +197,7 @@ void ipwireless_tty_received(struct ipw_tty *tty, unsigned char *data,
- return;
- }
-
-- if (!tty->open_count) {
-+ if (!local_read(&tty->open_count)) {
- mutex_unlock(&tty->ipw_tty_mutex);
- return;
- }
-@@ -240,7 +239,7 @@ static int ipw_write(struct tty_struct *linux_tty,
- return -ENODEV;
-
- mutex_lock(&tty->ipw_tty_mutex);
-- if (!tty->open_count) {
-+ if (!local_read(&tty->open_count)) {
- mutex_unlock(&tty->ipw_tty_mutex);
- return -EINVAL;
- }
-@@ -280,7 +279,7 @@ static int ipw_write_room(struct tty_struct *linux_tty)
- if (!tty)
- return -ENODEV;
-
-- if (!tty->open_count)
-+ if (!local_read(&tty->open_count))
- return -EINVAL;
-
- room = IPWIRELESS_TX_QUEUE_SIZE - tty->tx_bytes_queued;
-@@ -322,7 +321,7 @@ static int ipw_chars_in_buffer(struct tty_struct *linux_tty)
- if (!tty)
- return 0;
-
-- if (!tty->open_count)
-+ if (!local_read(&tty->open_count))
- return 0;
-
- return tty->tx_bytes_queued;
-@@ -403,7 +402,7 @@ static int ipw_tiocmget(struct tty_struct *linux_tty, struct file *file)
- if (!tty)
- return -ENODEV;
-
-- if (!tty->open_count)
-+ if (!local_read(&tty->open_count))
- return -EINVAL;
-
- return get_control_lines(tty);
-@@ -419,7 +418,7 @@ ipw_tiocmset(struct tty_struct *linux_tty, struct file *file,
- if (!tty)
- return -ENODEV;
-
-- if (!tty->open_count)
-+ if (!local_read(&tty->open_count))
- return -EINVAL;
-
- return set_control_lines(tty, set, clear);
-@@ -433,7 +432,7 @@ static int ipw_ioctl(struct tty_struct *linux_tty, struct file *file,
- if (!tty)
- return -ENODEV;
-
-- if (!tty->open_count)
-+ if (!local_read(&tty->open_count))
- return -EINVAL;
-
- /* FIXME: Exactly how is the tty object locked here .. */
-@@ -591,7 +590,7 @@ void ipwireless_tty_free(struct ipw_tty *tty)
- against a parallel ioctl etc */
- mutex_lock(&ttyj->ipw_tty_mutex);
- }
-- while (ttyj->open_count)
-+ while (local_read(&ttyj->open_count))
- do_ipw_close(ttyj);
- ipwireless_disassociate_network_ttys(network,
- ttyj->channel_idx);
-diff --git a/drivers/char/pty.c b/drivers/char/pty.c
-index 62f282e..e45c45c 100644
---- a/drivers/char/pty.c
-+++ b/drivers/char/pty.c
-@@ -736,8 +736,10 @@ static void __init unix98_pty_init(void)
- register_sysctl_table(pty_root_table);
-
- /* Now create the /dev/ptmx special device */
-+ pax_open_kernel();
- tty_default_fops(&ptmx_fops);
-- ptmx_fops.open = ptmx_open;
-+ *(void **)&ptmx_fops.open = ptmx_open;
-+ pax_close_kernel();
-
- cdev_init(&ptmx_cdev, &ptmx_fops);
- if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
-diff --git a/drivers/char/random.c b/drivers/char/random.c
-index 446b20a..1193fa7 100644
---- a/drivers/char/random.c
-+++ b/drivers/char/random.c
-@@ -269,8 +269,13 @@
- /*
- * Configuration information
- */
-+#ifdef CONFIG_GRKERNSEC_RANDNET
-+#define INPUT_POOL_WORDS 512
-+#define OUTPUT_POOL_WORDS 128
-+#else
- #define INPUT_POOL_WORDS 128
- #define OUTPUT_POOL_WORDS 32
-+#endif
- #define SEC_XFER_SIZE 512
- #define EXTRACT_SIZE 10
-
-@@ -310,10 +315,17 @@ static struct poolinfo {
- int poolwords;
- int tap1, tap2, tap3, tap4, tap5;
- } poolinfo_table[] = {
-+#ifdef CONFIG_GRKERNSEC_RANDNET
-+ /* x^512 + x^411 + x^308 + x^208 +x^104 + x + 1 -- 225 */
-+ { 512, 411, 308, 208, 104, 1 },
-+ /* x^128 + x^103 + x^76 + x^51 + x^25 + x + 1 -- 105 */
-+ { 128, 103, 76, 51, 25, 1 },
-+#else
- /* x^128 + x^103 + x^76 + x^51 +x^25 + x + 1 -- 105 */
- { 128, 103, 76, 51, 25, 1 },
- /* x^32 + x^26 + x^20 + x^14 + x^7 + x + 1 -- 15 */
- { 32, 26, 20, 14, 7, 1 },
-+#endif
- #if 0
- /* x^2048 + x^1638 + x^1231 + x^819 + x^411 + x + 1 -- 115 */
- { 2048, 1638, 1231, 819, 411, 1 },
-@@ -434,6 +446,7 @@ struct entropy_store {
- int entropy_count;
- int entropy_total;
- unsigned int initialized:1;
-+ bool last_data_init;
- __u8 last_data[EXTRACT_SIZE];
- };
-
-@@ -524,8 +537,8 @@ static void __mix_pool_bytes(struct entropy_store *r, const void *in,
- input_rotate += i ? 7 : 14;
- }
-
-- ACCESS_ONCE(r->input_rotate) = input_rotate;
-- ACCESS_ONCE(r->add_ptr) = i;
-+ ACCESS_ONCE_RW(r->input_rotate) = input_rotate;
-+ ACCESS_ONCE_RW(r->add_ptr) = i;
- smp_wmb();
-
- if (out)
-@@ -840,6 +853,7 @@ static size_t account(struct entropy_store *r, size_t nbytes, int min,
- int reserved)
- {
- unsigned long flags;
-+ int wakeup_write = 0;
-
- /* Hold lock while accounting */
- spin_lock_irqsave(&r->lock, flags);
-@@ -852,19 +866,25 @@ static size_t account(struct entropy_store *r, size_t nbytes, int min,
- if (r->entropy_count / 8 < min + reserved) {
- nbytes = 0;
- } else {
-+ int entropy_count, orig;
-+retry:
-+ entropy_count = orig = ACCESS_ONCE(r->entropy_count);
- /* If limited, never pull more than available */
-- if (r->limit && nbytes + reserved >= r->entropy_count / 8)
-- nbytes = r->entropy_count/8 - reserved;
-+ if (r->limit && nbytes + reserved >= entropy_count / 8)
-+ nbytes = entropy_count/8 - reserved;
-
-- if (r->entropy_count / 8 >= nbytes + reserved)
-- r->entropy_count -= nbytes*8;
-- else
-- r->entropy_count = reserved;
--
-- if (r->entropy_count < random_write_wakeup_thresh) {
-- wake_up_interruptible(&random_write_wait);
-- kill_fasync(&fasync, SIGIO, POLL_OUT);
-+ if (entropy_count / 8 >= nbytes + reserved) {
-+ entropy_count -= nbytes*8;
-+ if (cmpxchg(&r->entropy_count, orig, entropy_count) != orig)
-+ goto retry;
-+ } else {
-+ entropy_count = reserved;
-+ if (cmpxchg(&r->entropy_count, orig, entropy_count) != orig)
-+ goto retry;
- }
-+
-+ if (entropy_count < random_write_wakeup_thresh)
-+ wakeup_write = 1;
- }
-
- DEBUG_ENT("debiting %d entropy credits from %s%s\n",
-@@ -872,6 +892,11 @@ static size_t account(struct entropy_store *r, size_t nbytes, int min,
-
- spin_unlock_irqrestore(&r->lock, flags);
-
-+ if (wakeup_write) {
-+ wake_up_interruptible(&random_write_wait);
-+ kill_fasync(&fasync, SIGIO, POLL_OUT);
-+ }
-+
- return nbytes;
- }
-
-@@ -941,6 +966,21 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
- {
- ssize_t ret = 0, i;
- __u8 tmp[EXTRACT_SIZE];
-+ unsigned long flags;
-+
-+ /* if last_data isn't primed, we need EXTRACT_SIZE extra bytes */
-+ if (fips_enabled) {
-+ spin_lock_irqsave(&r->lock, flags);
-+ if (!r->last_data_init) {
-+ r->last_data_init = true;
-+ spin_unlock_irqrestore(&r->lock, flags);
-+ xfer_secondary_pool(r, EXTRACT_SIZE);
-+ extract_buf(r, tmp);
-+ spin_lock_irqsave(&r->lock, flags);
-+ memcpy(r->last_data, tmp, EXTRACT_SIZE);
-+ }
-+ spin_unlock_irqrestore(&r->lock, flags);
-+ }
-
- xfer_secondary_pool(r, nbytes);
- nbytes = account(r, nbytes, min, reserved);
-@@ -949,8 +989,6 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
- extract_buf(r, tmp);
-
- if (fips_enabled) {
-- unsigned long flags;
--
- spin_lock_irqsave(&r->lock, flags);
- if (!memcmp(tmp, r->last_data, EXTRACT_SIZE))
- panic("Hardware RNG duplicated output!\n");
-@@ -1015,7 +1053,21 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf,
- */
- void get_random_bytes(void *buf, int nbytes)
- {
-- extract_entropy(&nonblocking_pool, buf, nbytes, 0, 0);
-+ char *p = buf;
-+
-+ while (nbytes) {
-+ unsigned long v;
-+ int chunk = min(nbytes, (int)sizeof(unsigned long));
-+
-+ if (!arch_get_random_long(&v))
-+ break;
-+
-+ memcpy(buf, &v, chunk);
-+ p += chunk;
-+ nbytes -= chunk;
-+ }
-+
-+ extract_entropy(&nonblocking_pool, p, nbytes, 0, 0);
- }
- EXPORT_SYMBOL(get_random_bytes);
-
-@@ -1068,6 +1120,7 @@ static void init_std_data(struct entropy_store *r)
-
- r->entropy_count = 0;
- r->entropy_total = 0;
-+ r->last_data_init = false;
- mix_pool_bytes(r, &now, sizeof(now), NULL);
- for (i = r->poolinfo->POOLBYTES; i > 0; i -= sizeof(rv)) {
- if (!arch_get_random_long(&rv))
-@@ -1322,7 +1375,7 @@ EXPORT_SYMBOL(generate_random_uuid);
- #include <linux/sysctl.h>
-
- static int min_read_thresh = 8, min_write_thresh;
--static int max_read_thresh = INPUT_POOL_WORDS * 32;
-+static int max_read_thresh = OUTPUT_POOL_WORDS * 32;
- static int max_write_thresh = INPUT_POOL_WORDS * 32;
- static char sysctl_bootid[16];
-
-@@ -1397,6 +1450,7 @@ static int uuid_strategy(ctl_table *table,
- }
-
- static int sysctl_poolsize = INPUT_POOL_WORDS * 32;
-+extern ctl_table random_table[];
- ctl_table random_table[] = {
- {
- .ctl_name = RANDOM_POOLSIZE,
-@@ -1472,7 +1526,7 @@ late_initcall(random_int_secret_init);
- * value is not cryptographically secure but for several uses the cost of
- * depleting entropy is too high
- */
--DEFINE_PER_CPU(__u32 [MD5_DIGEST_WORDS], get_random_int_hash);
-+static DEFINE_PER_CPU(__u32 [MD5_DIGEST_WORDS], get_random_int_hash);
- unsigned int get_random_int(void)
- {
- __u32 *hash;
-diff --git a/drivers/char/rocket.c b/drivers/char/rocket.c
-index 0e29a23..0efc2c2 100644
---- a/drivers/char/rocket.c
-+++ b/drivers/char/rocket.c
-@@ -1266,6 +1266,8 @@ static int get_ports(struct r_port *info, struct rocket_ports __user *retports)
- struct rocket_ports tmp;
- int board;
-
-+ pax_track_stack();
-+
- if (!retports)
- return -EFAULT;
- memset(&tmp, 0, sizeof (tmp));
-diff --git a/drivers/char/sonypi.c b/drivers/char/sonypi.c
-index 8c262aa..4d3b058 100644
---- a/drivers/char/sonypi.c
-+++ b/drivers/char/sonypi.c
-@@ -55,6 +55,7 @@
- #include <asm/uaccess.h>
- #include <asm/io.h>
- #include <asm/system.h>
-+#include <asm/local.h>
-
- #include <linux/sonypi.h>
-
-@@ -491,7 +492,7 @@ static struct sonypi_device {
- spinlock_t fifo_lock;
- wait_queue_head_t fifo_proc_list;
- struct fasync_struct *fifo_async;
-- int open_count;
-+ local_t open_count;
- int model;
- struct input_dev *input_jog_dev;
- struct input_dev *input_key_dev;
-@@ -895,7 +896,7 @@ static int sonypi_misc_fasync(int fd, struct file *filp, int on)
- static int sonypi_misc_release(struct inode *inode, struct file *file)
- {
- mutex_lock(&sonypi_device.lock);
-- sonypi_device.open_count--;
-+ local_dec(&sonypi_device.open_count);
- mutex_unlock(&sonypi_device.lock);
- return 0;
- }
-@@ -905,9 +906,9 @@ static int sonypi_misc_open(struct inode *inode, struct file *file)
- lock_kernel();
- mutex_lock(&sonypi_device.lock);
- /* Flush input queue on first open */
-- if (!sonypi_device.open_count)
-+ if (!local_read(&sonypi_device.open_count))
- kfifo_reset(sonypi_device.fifo);
-- sonypi_device.open_count++;
-+ local_inc(&sonypi_device.open_count);
- mutex_unlock(&sonypi_device.lock);
- unlock_kernel();
- return 0;
-diff --git a/drivers/char/stallion.c b/drivers/char/stallion.c
-index db6dcfa..13834cb 100644
---- a/drivers/char/stallion.c
-+++ b/drivers/char/stallion.c
-@@ -2448,6 +2448,8 @@ static int stl_getportstruct(struct stlport __user *arg)
- struct stlport stl_dummyport;
- struct stlport *portp;
-
-+ pax_track_stack();
-+
- if (copy_from_user(&stl_dummyport, arg, sizeof(struct stlport)))
- return -EFAULT;
- portp = stl_getport(stl_dummyport.brdnr, stl_dummyport.panelnr,
-diff --git a/drivers/char/sysrq.c b/drivers/char/sysrq.c
-index 44203ff..09a3678 100644
---- a/drivers/char/sysrq.c
-+++ b/drivers/char/sysrq.c
-@@ -591,7 +591,7 @@ EXPORT_SYMBOL(unregister_sysrq_key);
- static ssize_t write_sysrq_trigger(struct file *file, const char __user *buf,
- size_t count, loff_t *ppos)
- {
-- if (count) {
-+ if (count && capable(CAP_SYS_ADMIN)) {
- char c;
-
- if (get_user(c, buf))
-diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
-index a0789f6..cea3902 100644
---- a/drivers/char/tpm/tpm.c
-+++ b/drivers/char/tpm/tpm.c
-@@ -405,7 +405,7 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
- chip->vendor.req_complete_val)
- goto out_recv;
-
-- if ((status == chip->vendor.req_canceled)) {
-+ if (status == chip->vendor.req_canceled) {
- dev_err(chip->dev, "Operation Canceled\n");
- rc = -ECANCELED;
- goto out;
-@@ -824,6 +824,8 @@ ssize_t tpm_show_pubek(struct device *dev, struct device_attribute *attr,
-
- struct tpm_chip *chip = dev_get_drvdata(dev);
-
-+ pax_track_stack();
-+
- tpm_cmd.header.in = tpm_readpubek_header;
- err = transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE,
- "attempting to read the PUBEK");
-diff --git a/drivers/char/tpm/tpm_bios.c b/drivers/char/tpm/tpm_bios.c
-index bf2170f..ce8cab9 100644
---- a/drivers/char/tpm/tpm_bios.c
-+++ b/drivers/char/tpm/tpm_bios.c
-@@ -172,7 +172,7 @@ static void *tpm_bios_measurements_start(struct seq_file *m, loff_t *pos)
- event = addr;
-
- if ((event->event_type == 0 && event->event_size == 0) ||
-- ((addr + sizeof(struct tcpa_event) + event->event_size) >= limit))
-+ (event->event_size >= limit - addr - sizeof(struct tcpa_event)))
- return NULL;
-
- return addr;
-@@ -197,7 +197,7 @@ static void *tpm_bios_measurements_next(struct seq_file *m, void *v,
- return NULL;
-
- if ((event->event_type == 0 && event->event_size == 0) ||
-- ((v + sizeof(struct tcpa_event) + event->event_size) >= limit))
-+ (event->event_size >= limit - v - sizeof(struct tcpa_event)))
- return NULL;
-
- (*pos)++;
-@@ -290,7 +290,8 @@ static int tpm_binary_bios_measurements_show(struct seq_file *m, void *v)
- int i;
-
- for (i = 0; i < sizeof(struct tcpa_event) + event->event_size; i++)
-- seq_putc(m, data[i]);
-+ if (!seq_putc(m, data[i]))
-+ return -EFAULT;
-
- return 0;
- }
-@@ -409,8 +410,13 @@ static int read_log(struct tpm_bios_log *log)
- log->bios_event_log_end = log->bios_event_log + len;
-
- virt = acpi_os_map_memory(start, len);
-+ if (!virt) {
-+ kfree(log->bios_event_log);
-+ log->bios_event_log = NULL;
-+ return -EFAULT;
-+ }
-
-- memcpy(log->bios_event_log, virt, len);
-+ memcpy(log->bios_event_log, (const char __force_kernel *)virt, len);
-
- acpi_os_unmap_memory(virt, len);
- return 0;
-diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
-index 123cedf..f7eebb9 100644
---- a/drivers/char/tty_io.c
-+++ b/drivers/char/tty_io.c
-@@ -146,7 +146,7 @@ static int tty_open(struct inode *, struct file *);
- static int tty_release(struct inode *, struct file *);
- long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
- #ifdef CONFIG_COMPAT
--static long tty_compat_ioctl(struct file *file, unsigned int cmd,
-+long tty_compat_ioctl(struct file *file, unsigned int cmd,
- unsigned long arg);
- #else
- #define tty_compat_ioctl NULL
-@@ -856,6 +856,14 @@ void start_tty(struct tty_struct *tty)
-
- EXPORT_SYMBOL(start_tty);
-
-+static void tty_update_time(struct timespec *time)
-+{
-+ unsigned long sec = get_seconds();
-+ sec -= sec % 60;
-+ if ((long)(sec - time->tv_sec) > 0)
-+ time->tv_sec = sec;
-+}
-+
- /**
- * tty_read - read method for tty device files
- * @file: pointer to tty file
-@@ -894,8 +902,10 @@ static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
- else
- i = -EIO;
- tty_ldisc_deref(ld);
-+
- if (i > 0)
-- inode->i_atime = current_fs_time(inode->i_sb);
-+ tty_update_time(&inode->i_atime);
-+
- return i;
- }
-
-@@ -995,8 +1005,7 @@ static inline ssize_t do_tty_write(
- cond_resched();
- }
- if (written) {
-- struct inode *inode = file->f_path.dentry->d_inode;
-- inode->i_mtime = current_fs_time(inode->i_sb);
-+ tty_update_time(&file->f_dentry->d_inode->i_mtime);
- ret = written;
- }
- out:
-@@ -1774,6 +1783,7 @@ got_driver:
-
- if (IS_ERR(tty)) {
- mutex_unlock(&tty_mutex);
-+ tty_driver_kref_put(driver);
- return PTR_ERR(tty);
- }
- }
-@@ -2603,8 +2613,10 @@ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
- return retval;
- }
-
-+EXPORT_SYMBOL(tty_ioctl);
-+
- #ifdef CONFIG_COMPAT
--static long tty_compat_ioctl(struct file *file, unsigned int cmd,
-+long tty_compat_ioctl(struct file *file, unsigned int cmd,
- unsigned long arg)
- {
- struct inode *inode = file->f_dentry->d_inode;
-@@ -2628,6 +2640,8 @@ static long tty_compat_ioctl(struct file *file, unsigned int cmd,
-
- return retval;
- }
-+
-+EXPORT_SYMBOL(tty_compat_ioctl);
- #endif
-
- /*
-@@ -3073,7 +3087,7 @@ EXPORT_SYMBOL_GPL(get_current_tty);
-
- void tty_default_fops(struct file_operations *fops)
- {
-- *fops = tty_fops;
-+ memcpy((void *)fops, &tty_fops, sizeof(tty_fops));
- }
-
- /*
-diff --git a/drivers/char/tty_ldisc.c b/drivers/char/tty_ldisc.c
-index d814a3d..b55b9c9 100644
---- a/drivers/char/tty_ldisc.c
-+++ b/drivers/char/tty_ldisc.c
-@@ -74,7 +74,7 @@ static void put_ldisc(struct tty_ldisc *ld)
- if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) {
- struct tty_ldisc_ops *ldo = ld->ops;
-
-- ldo->refcount--;
-+ atomic_dec(&ldo->refcount);
- module_put(ldo->owner);
- spin_unlock_irqrestore(&tty_ldisc_lock, flags);
-
-@@ -109,7 +109,7 @@ int tty_register_ldisc(int disc, struct tty_ldisc_ops *new_ldisc)
- spin_lock_irqsave(&tty_ldisc_lock, flags);
- tty_ldiscs[disc] = new_ldisc;
- new_ldisc->num = disc;
-- new_ldisc->refcount = 0;
-+ atomic_set(&new_ldisc->refcount, 0);
- spin_unlock_irqrestore(&tty_ldisc_lock, flags);
-
- return ret;
-@@ -137,7 +137,7 @@ int tty_unregister_ldisc(int disc)
- return -EINVAL;
-
- spin_lock_irqsave(&tty_ldisc_lock, flags);
-- if (tty_ldiscs[disc]->refcount)
-+ if (atomic_read(&tty_ldiscs[disc]->refcount))
- ret = -EBUSY;
- else
- tty_ldiscs[disc] = NULL;
-@@ -158,7 +158,7 @@ static struct tty_ldisc_ops *get_ldops(int disc)
- if (ldops) {
- ret = ERR_PTR(-EAGAIN);
- if (try_module_get(ldops->owner)) {
-- ldops->refcount++;
-+ atomic_inc(&ldops->refcount);
- ret = ldops;
- }
- }
-@@ -171,7 +171,7 @@ static void put_ldops(struct tty_ldisc_ops *ldops)
- unsigned long flags;
-
- spin_lock_irqsave(&tty_ldisc_lock, flags);
-- ldops->refcount--;
-+ atomic_dec(&ldops->refcount);
- module_put(ldops->owner);
- spin_unlock_irqrestore(&tty_ldisc_lock, flags);
- }
-diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
-index a035ae3..c27fe2c 100644
---- a/drivers/char/virtio_console.c
-+++ b/drivers/char/virtio_console.c
-@@ -133,7 +133,9 @@ static int get_chars(u32 vtermno, char *buf, int count)
- * virtqueue, so we let the drivers do some boutique early-output thing. */
- int __init virtio_cons_early_init(int (*put_chars)(u32, const char *, int))
- {
-- virtio_cons.put_chars = put_chars;
-+ pax_open_kernel();
-+ *(void **)&virtio_cons.put_chars = put_chars;
-+ pax_close_kernel();
- return hvc_instantiate(0, 0, &virtio_cons);
- }
-
-@@ -213,11 +215,13 @@ static int __devinit virtcons_probe(struct virtio_device *dev)
- out_vq = vqs[1];
-
- /* Start using the new console output. */
-- virtio_cons.get_chars = get_chars;
-- virtio_cons.put_chars = put_chars;
-- virtio_cons.notifier_add = notifier_add_vio;
-- virtio_cons.notifier_del = notifier_del_vio;
-- virtio_cons.notifier_hangup = notifier_del_vio;
-+ pax_open_kernel();
-+ *(void **)&virtio_cons.get_chars = get_chars;
-+ *(void **)&virtio_cons.put_chars = put_chars;
-+ *(void **)&virtio_cons.notifier_add = notifier_add_vio;
-+ *(void **)&virtio_cons.notifier_del = notifier_del_vio;
-+ *(void **)&virtio_cons.notifier_hangup = notifier_del_vio;
-+ pax_close_kernel();
-
- /* The first argument of hvc_alloc() is the virtual console number, so
- * we use zero. The second argument is the parameter for the
-diff --git a/drivers/char/vt.c b/drivers/char/vt.c
-index 0c80c68..53d59c1 100644
---- a/drivers/char/vt.c
-+++ b/drivers/char/vt.c
-@@ -243,7 +243,7 @@ EXPORT_SYMBOL_GPL(unregister_vt_notifier);
-
- static void notify_write(struct vc_data *vc, unsigned int unicode)
- {
-- struct vt_notifier_param param = { .vc = vc, unicode = unicode };
-+ struct vt_notifier_param param = { .vc = vc, .c = unicode };
- atomic_notifier_call_chain(&vt_notifier_list, VT_WRITE, ¶m);
- }
-
-diff --git a/drivers/char/vt_ioctl.c b/drivers/char/vt_ioctl.c
-index 6351a26..999af95 100644
---- a/drivers/char/vt_ioctl.c
-+++ b/drivers/char/vt_ioctl.c
-@@ -210,9 +210,6 @@ do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm, struct kbd_str
- if (copy_from_user(&tmp, user_kbe, sizeof(struct kbentry)))
- return -EFAULT;
-
-- if (!capable(CAP_SYS_TTY_CONFIG))
-- perm = 0;
--
- switch (cmd) {
- case KDGKBENT:
- key_map = key_maps[s];
-@@ -224,8 +221,12 @@ do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm, struct kbd_str
- val = (i ? K_HOLE : K_NOSUCHMAP);
- return put_user(val, &user_kbe->kb_value);
- case KDSKBENT:
-+ if (!capable(CAP_SYS_TTY_CONFIG))
-+ perm = 0;
-+
- if (!perm)
- return -EPERM;
-+
- if (!i && v == K_NOSUCHMAP) {
- /* deallocate map */
- key_map = key_maps[s];
-@@ -325,9 +326,6 @@ do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
- int i, j, k;
- int ret;
-
-- if (!capable(CAP_SYS_TTY_CONFIG))
-- perm = 0;
--
- kbs = kmalloc(sizeof(*kbs), GFP_KERNEL);
- if (!kbs) {
- ret = -ENOMEM;
-@@ -361,6 +359,9 @@ do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
- kfree(kbs);
- return ((p && *p) ? -EOVERFLOW : 0);
- case KDSKBSENT:
-+ if (!capable(CAP_SYS_TTY_CONFIG))
-+ perm = 0;
-+
- if (!perm) {
- ret = -EPERM;
- goto reterr;
-diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c
-index 6069790..33c174a 100644
---- a/drivers/connector/cn_proc.c
-+++ b/drivers/connector/cn_proc.c
-@@ -236,7 +236,13 @@ static void cn_proc_mcast_ctl(struct cn_msg *msg,
- if (msg->len != sizeof(*mc_op))
- return;
-
-- mc_op = (enum proc_cn_mcast_op*)msg->data;
-+ /* Can only change if privileged. */
-+ if (!capable(CAP_NET_ADMIN)) {
-+ err = EPERM;
-+ goto out;
-+ }
-+
-+ mc_op = (enum proc_cn_mcast_op *)msg->data;
- switch (*mc_op) {
- case PROC_CN_MCAST_LISTEN:
- atomic_inc(&proc_event_num_listeners);
-@@ -248,6 +254,8 @@ static void cn_proc_mcast_ctl(struct cn_msg *msg,
- err = EINVAL;
- break;
- }
-+
-+out:
- cn_proc_ack(err, msg->seq, msg->ack);
- }
-
-diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
-index c7ae026..1769c1d 100644
---- a/drivers/cpufreq/cpufreq.c
-+++ b/drivers/cpufreq/cpufreq.c
-@@ -750,7 +750,7 @@ static void cpufreq_sysfs_release(struct kobject *kobj)
- complete(&policy->kobj_unregister);
- }
-
--static struct sysfs_ops sysfs_ops = {
-+static const struct sysfs_ops sysfs_ops = {
- .show = show,
- .store = store,
- };
-diff --git a/drivers/cpuidle/sysfs.c b/drivers/cpuidle/sysfs.c
-index 97b0038..2056670 100644
---- a/drivers/cpuidle/sysfs.c
-+++ b/drivers/cpuidle/sysfs.c
-@@ -191,7 +191,7 @@ static ssize_t cpuidle_store(struct kobject * kobj, struct attribute * attr,
- return ret;
- }
-
--static struct sysfs_ops cpuidle_sysfs_ops = {
-+static const struct sysfs_ops cpuidle_sysfs_ops = {
- .show = cpuidle_show,
- .store = cpuidle_store,
- };
-@@ -277,7 +277,7 @@ static ssize_t cpuidle_state_show(struct kobject * kobj,
- return ret;
- }
-
--static struct sysfs_ops cpuidle_state_sysfs_ops = {
-+static const struct sysfs_ops cpuidle_state_sysfs_ops = {
- .show = cpuidle_state_show,
- };
-
-@@ -294,7 +294,7 @@ static struct kobj_type ktype_state_cpuidle = {
- .release = cpuidle_state_sysfs_release,
- };
-
--static void inline cpuidle_free_state_kobj(struct cpuidle_device *device, int i)
-+static inline void cpuidle_free_state_kobj(struct cpuidle_device *device, int i)
- {
- kobject_put(&device->kobjs[i]->kobj);
- wait_for_completion(&device->kobjs[i]->kobj_unregister);
-diff --git a/drivers/crypto/hifn_795x.c b/drivers/crypto/hifn_795x.c
-index 5f753fc..0377ae9 100644
---- a/drivers/crypto/hifn_795x.c
-+++ b/drivers/crypto/hifn_795x.c
-@@ -1655,6 +1655,8 @@ static int hifn_test(struct hifn_device *dev, int encdec, u8 snum)
- 0xCA, 0x34, 0x2B, 0x2E};
- struct scatterlist sg;
-
-+ pax_track_stack();
-+
- memset(src, 0, sizeof(src));
- memset(ctx.key, 0, sizeof(ctx.key));
-
-diff --git a/drivers/crypto/padlock-aes.c b/drivers/crypto/padlock-aes.c
-index 71e6482..de8d96c 100644
---- a/drivers/crypto/padlock-aes.c
-+++ b/drivers/crypto/padlock-aes.c
-@@ -108,6 +108,8 @@ static int aes_set_key(struct crypto_tfm *tfm, const u8 *in_key,
- struct crypto_aes_ctx gen_aes;
- int cpu;
-
-+ pax_track_stack();
-+
- if (key_len % 8) {
- *flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
- return -EINVAL;
-diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c
-index dcc4ab7..cc834bb 100644
---- a/drivers/dma/ioat/dma.c
-+++ b/drivers/dma/ioat/dma.c
-@@ -1146,7 +1146,7 @@ ioat_attr_show(struct kobject *kobj, struct attribute *attr, char *page)
- return entry->show(&chan->common, page);
- }
-
--struct sysfs_ops ioat_sysfs_ops = {
-+const struct sysfs_ops ioat_sysfs_ops = {
- .show = ioat_attr_show,
- };
-
-diff --git a/drivers/dma/ioat/dma.h b/drivers/dma/ioat/dma.h
-index bbc3e78..f2db62c 100644
---- a/drivers/dma/ioat/dma.h
-+++ b/drivers/dma/ioat/dma.h
-@@ -347,7 +347,7 @@ bool ioat_cleanup_preamble(struct ioat_chan_common *chan,
- unsigned long *phys_complete);
- void ioat_kobject_add(struct ioatdma_device *device, struct kobj_type *type);
- void ioat_kobject_del(struct ioatdma_device *device);
--extern struct sysfs_ops ioat_sysfs_ops;
-+extern const struct sysfs_ops ioat_sysfs_ops;
- extern struct ioat_sysfs_entry ioat_version_attr;
- extern struct ioat_sysfs_entry ioat_cap_attr;
- #endif /* IOATDMA_H */
-diff --git a/drivers/dma/ioat/dma_v3.c b/drivers/dma/ioat/dma_v3.c
-index 9908c9e..3ceb0e5 100644
---- a/drivers/dma/ioat/dma_v3.c
-+++ b/drivers/dma/ioat/dma_v3.c
-@@ -71,10 +71,10 @@
- /* provide a lookup table for setting the source address in the base or
- * extended descriptor of an xor or pq descriptor
- */
--static const u8 xor_idx_to_desc __read_mostly = 0xd0;
--static const u8 xor_idx_to_field[] __read_mostly = { 1, 4, 5, 6, 7, 0, 1, 2 };
--static const u8 pq_idx_to_desc __read_mostly = 0xf8;
--static const u8 pq_idx_to_field[] __read_mostly = { 1, 4, 5, 0, 1, 2, 4, 5 };
-+static const u8 xor_idx_to_desc = 0xd0;
-+static const u8 xor_idx_to_field[] = { 1, 4, 5, 6, 7, 0, 1, 2 };
-+static const u8 pq_idx_to_desc = 0xf8;
-+static const u8 pq_idx_to_field[] = { 1, 4, 5, 0, 1, 2, 4, 5 };
-
- static dma_addr_t xor_get_src(struct ioat_raw_descriptor *descs[2], int idx)
- {
-diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
-index 85c464a..378a72b 100644
---- a/drivers/edac/amd64_edac.c
-+++ b/drivers/edac/amd64_edac.c
-@@ -106,8 +106,11 @@ static int amd64_search_set_scrub_rate(struct pci_dev *ctl, u32 new_bw,
- * memory controller and apply to register. Search for the first
- * bandwidth entry that is greater or equal than the setting requested
- * and program that. If at last entry, turn off DRAM scrubbing.
-+ *
-+ * If no suitable bandwidth is found, turn off DRAM scrubbing entirely
-+ * by falling back to the last element in scrubrates[].
- */
-- for (i = 0; i < ARRAY_SIZE(scrubrates); i++) {
-+ for (i = 0; i < ARRAY_SIZE(scrubrates) - 1; i++) {
- /*
- * skip scrub rates which aren't recommended
- * (see F10 BKDG, F3x58)
-@@ -117,12 +120,6 @@ static int amd64_search_set_scrub_rate(struct pci_dev *ctl, u32 new_bw,
-
- if (scrubrates[i].bandwidth <= new_bw)
- break;
--
-- /*
-- * if no suitable bandwidth found, turn off DRAM scrubbing
-- * entirely by falling back to the last element in the
-- * scrubrates array.
-- */
- }
-
- scrubval = scrubrates[i].scrubval;
-@@ -3099,7 +3096,7 @@ static void __devexit amd64_remove_one_instance(struct pci_dev *pdev)
- * PCI core identifies what devices are on a system during boot, and then
- * inquiry this table to see if this driver is for a given device found.
- */
--static const struct pci_device_id amd64_pci_table[] __devinitdata = {
-+static const struct pci_device_id amd64_pci_table[] __devinitconst = {
- {
- .vendor = PCI_VENDOR_ID_AMD,
- .device = PCI_DEVICE_ID_AMD_K8_NB_MEMCTL,
-diff --git a/drivers/edac/amd76x_edac.c b/drivers/edac/amd76x_edac.c
-index 2b95f1a..4f52793 100644
---- a/drivers/edac/amd76x_edac.c
-+++ b/drivers/edac/amd76x_edac.c
-@@ -322,7 +322,7 @@ static void __devexit amd76x_remove_one(struct pci_dev *pdev)
- edac_mc_free(mci);
- }
-
--static const struct pci_device_id amd76x_pci_tbl[] __devinitdata = {
-+static const struct pci_device_id amd76x_pci_tbl[] __devinitconst = {
- {
- PCI_VEND_DEV(AMD, FE_GATE_700C), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
- AMD762},
-diff --git a/drivers/edac/e752x_edac.c b/drivers/edac/e752x_edac.c
-index d205d49..74c9672 100644
---- a/drivers/edac/e752x_edac.c
-+++ b/drivers/edac/e752x_edac.c
-@@ -1282,7 +1282,7 @@ static void __devexit e752x_remove_one(struct pci_dev *pdev)
- edac_mc_free(mci);
- }
-
--static const struct pci_device_id e752x_pci_tbl[] __devinitdata = {
-+static const struct pci_device_id e752x_pci_tbl[] __devinitconst = {
- {
- PCI_VEND_DEV(INTEL, 7520_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
- E7520},
-diff --git a/drivers/edac/e7xxx_edac.c b/drivers/edac/e7xxx_edac.c
-index c7d11cc..c59c1ca 100644
---- a/drivers/edac/e7xxx_edac.c
-+++ b/drivers/edac/e7xxx_edac.c
-@@ -526,7 +526,7 @@ static void __devexit e7xxx_remove_one(struct pci_dev *pdev)
- edac_mc_free(mci);
- }
-
--static const struct pci_device_id e7xxx_pci_tbl[] __devinitdata = {
-+static const struct pci_device_id e7xxx_pci_tbl[] __devinitconst = {
- {
- PCI_VEND_DEV(INTEL, 7205_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
- E7205},
-diff --git a/drivers/edac/edac_device_sysfs.c b/drivers/edac/edac_device_sysfs.c
-index 5376457..5fdedbc 100644
---- a/drivers/edac/edac_device_sysfs.c
-+++ b/drivers/edac/edac_device_sysfs.c
-@@ -137,7 +137,7 @@ static ssize_t edac_dev_ctl_info_store(struct kobject *kobj,
- }
-
- /* edac_dev file operations for an 'ctl_info' */
--static struct sysfs_ops device_ctl_info_ops = {
-+static const struct sysfs_ops device_ctl_info_ops = {
- .show = edac_dev_ctl_info_show,
- .store = edac_dev_ctl_info_store
- };
-@@ -373,7 +373,7 @@ static ssize_t edac_dev_instance_store(struct kobject *kobj,
- }
-
- /* edac_dev file operations for an 'instance' */
--static struct sysfs_ops device_instance_ops = {
-+static const struct sysfs_ops device_instance_ops = {
- .show = edac_dev_instance_show,
- .store = edac_dev_instance_store
- };
-@@ -476,7 +476,7 @@ static ssize_t edac_dev_block_store(struct kobject *kobj,
- }
-
- /* edac_dev file operations for a 'block' */
--static struct sysfs_ops device_block_ops = {
-+static const struct sysfs_ops device_block_ops = {
- .show = edac_dev_block_show,
- .store = edac_dev_block_store
- };
-diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
-index e1d4ce0..88840e9 100644
---- a/drivers/edac/edac_mc_sysfs.c
-+++ b/drivers/edac/edac_mc_sysfs.c
-@@ -245,7 +245,7 @@ static ssize_t csrowdev_store(struct kobject *kobj, struct attribute *attr,
- return -EIO;
- }
-
--static struct sysfs_ops csrowfs_ops = {
-+static const struct sysfs_ops csrowfs_ops = {
- .show = csrowdev_show,
- .store = csrowdev_store
- };
-@@ -575,7 +575,7 @@ static ssize_t mcidev_store(struct kobject *kobj, struct attribute *attr,
- }
-
- /* Intermediate show/store table */
--static struct sysfs_ops mci_ops = {
-+static const struct sysfs_ops mci_ops = {
- .show = mcidev_show,
- .store = mcidev_store
- };
-diff --git a/drivers/edac/edac_pci_sysfs.c b/drivers/edac/edac_pci_sysfs.c
-index 422728c..d8d9c88 100644
---- a/drivers/edac/edac_pci_sysfs.c
-+++ b/drivers/edac/edac_pci_sysfs.c
-@@ -25,8 +25,8 @@ static int edac_pci_log_pe = 1; /* log PCI parity errors */
- static int edac_pci_log_npe = 1; /* log PCI non-parity error errors */
- static int edac_pci_poll_msec = 1000; /* one second workq period */
-
--static atomic_t pci_parity_count = ATOMIC_INIT(0);
--static atomic_t pci_nonparity_count = ATOMIC_INIT(0);
-+static atomic_unchecked_t pci_parity_count = ATOMIC_INIT(0);
-+static atomic_unchecked_t pci_nonparity_count = ATOMIC_INIT(0);
-
- static struct kobject *edac_pci_top_main_kobj;
- static atomic_t edac_pci_sysfs_refcount = ATOMIC_INIT(0);
-@@ -121,7 +121,7 @@ static ssize_t edac_pci_instance_store(struct kobject *kobj,
- }
-
- /* fs_ops table */
--static struct sysfs_ops pci_instance_ops = {
-+static const struct sysfs_ops pci_instance_ops = {
- .show = edac_pci_instance_show,
- .store = edac_pci_instance_store
- };
-@@ -261,7 +261,7 @@ static ssize_t edac_pci_dev_store(struct kobject *kobj,
- return -EIO;
- }
-
--static struct sysfs_ops edac_pci_sysfs_ops = {
-+static const struct sysfs_ops edac_pci_sysfs_ops = {
- .show = edac_pci_dev_show,
- .store = edac_pci_dev_store
- };
-@@ -579,7 +579,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
- edac_printk(KERN_CRIT, EDAC_PCI,
- "Signaled System Error on %s\n",
- pci_name(dev));
-- atomic_inc(&pci_nonparity_count);
-+ atomic_inc_unchecked(&pci_nonparity_count);
- }
-
- if (status & (PCI_STATUS_PARITY)) {
-@@ -587,7 +587,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
- "Master Data Parity Error on %s\n",
- pci_name(dev));
-
-- atomic_inc(&pci_parity_count);
-+ atomic_inc_unchecked(&pci_parity_count);
- }
-
- if (status & (PCI_STATUS_DETECTED_PARITY)) {
-@@ -595,7 +595,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
- "Detected Parity Error on %s\n",
- pci_name(dev));
-
-- atomic_inc(&pci_parity_count);
-+ atomic_inc_unchecked(&pci_parity_count);
- }
- }
-
-@@ -616,7 +616,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
- edac_printk(KERN_CRIT, EDAC_PCI, "Bridge "
- "Signaled System Error on %s\n",
- pci_name(dev));
-- atomic_inc(&pci_nonparity_count);
-+ atomic_inc_unchecked(&pci_nonparity_count);
- }
-
- if (status & (PCI_STATUS_PARITY)) {
-@@ -624,7 +624,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
- "Master Data Parity Error on "
- "%s\n", pci_name(dev));
-
-- atomic_inc(&pci_parity_count);
-+ atomic_inc_unchecked(&pci_parity_count);
- }
-
- if (status & (PCI_STATUS_DETECTED_PARITY)) {
-@@ -632,7 +632,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
- "Detected Parity Error on %s\n",
- pci_name(dev));
-
-- atomic_inc(&pci_parity_count);
-+ atomic_inc_unchecked(&pci_parity_count);
- }
- }
- }
-@@ -674,7 +674,7 @@ void edac_pci_do_parity_check(void)
- if (!check_pci_errors)
- return;
-
-- before_count = atomic_read(&pci_parity_count);
-+ before_count = atomic_read_unchecked(&pci_parity_count);
-
- /* scan all PCI devices looking for a Parity Error on devices and
- * bridges.
-@@ -686,7 +686,7 @@ void edac_pci_do_parity_check(void)
- /* Only if operator has selected panic on PCI Error */
- if (edac_pci_get_panic_on_pe()) {
- /* If the count is different 'after' from 'before' */
-- if (before_count != atomic_read(&pci_parity_count))
-+ if (before_count != atomic_read_unchecked(&pci_parity_count))
- panic("EDAC: PCI Parity Error");
- }
- }
-diff --git a/drivers/edac/i3000_edac.c b/drivers/edac/i3000_edac.c
-index 6c9a0f2..9c1cf7e 100644
---- a/drivers/edac/i3000_edac.c
-+++ b/drivers/edac/i3000_edac.c
-@@ -471,7 +471,7 @@ static void __devexit i3000_remove_one(struct pci_dev *pdev)
- edac_mc_free(mci);
- }
-
--static const struct pci_device_id i3000_pci_tbl[] __devinitdata = {
-+static const struct pci_device_id i3000_pci_tbl[] __devinitconst = {
- {
- PCI_VEND_DEV(INTEL, 3000_HB), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
- I3000},
-diff --git a/drivers/edac/i3200_edac.c b/drivers/edac/i3200_edac.c
-index fde4db9..fe108f9 100644
---- a/drivers/edac/i3200_edac.c
-+++ b/drivers/edac/i3200_edac.c
-@@ -444,7 +444,7 @@ static void __devexit i3200_remove_one(struct pci_dev *pdev)
- edac_mc_free(mci);
- }
-
--static const struct pci_device_id i3200_pci_tbl[] __devinitdata = {
-+static const struct pci_device_id i3200_pci_tbl[] __devinitconst = {
- {
- PCI_VEND_DEV(INTEL, 3200_HB), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
- I3200},
-diff --git a/drivers/edac/i5000_edac.c b/drivers/edac/i5000_edac.c
-index adc10a2..57d4ccf 100644
---- a/drivers/edac/i5000_edac.c
-+++ b/drivers/edac/i5000_edac.c
-@@ -1516,7 +1516,7 @@ static void __devexit i5000_remove_one(struct pci_dev *pdev)
- *
- * The "E500P" device is the first device supported.
- */
--static const struct pci_device_id i5000_pci_tbl[] __devinitdata = {
-+static const struct pci_device_id i5000_pci_tbl[] __devinitconst = {
- {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_I5000_DEV16),
- .driver_data = I5000P},
-
-diff --git a/drivers/edac/i5100_edac.c b/drivers/edac/i5100_edac.c
-index 22db05a..b2b5503 100644
---- a/drivers/edac/i5100_edac.c
-+++ b/drivers/edac/i5100_edac.c
-@@ -944,7 +944,7 @@ static void __devexit i5100_remove_one(struct pci_dev *pdev)
- edac_mc_free(mci);
- }
-
--static const struct pci_device_id i5100_pci_tbl[] __devinitdata = {
-+static const struct pci_device_id i5100_pci_tbl[] __devinitconst = {
- /* Device 16, Function 0, Channel 0 Memory Map, Error Flag/Mask, ... */
- { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_5100_16) },
- { 0, }
-diff --git a/drivers/edac/i5400_edac.c b/drivers/edac/i5400_edac.c
-index f99d106..f050710 100644
---- a/drivers/edac/i5400_edac.c
-+++ b/drivers/edac/i5400_edac.c
-@@ -1383,7 +1383,7 @@ static void __devexit i5400_remove_one(struct pci_dev *pdev)
- *
- * The "E500P" device is the first device supported.
- */
--static const struct pci_device_id i5400_pci_tbl[] __devinitdata = {
-+static const struct pci_device_id i5400_pci_tbl[] __devinitconst = {
- {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_5400_ERR)},
- {0,} /* 0 terminated list. */
- };
-diff --git a/drivers/edac/i82443bxgx_edac.c b/drivers/edac/i82443bxgx_edac.c
-index 577760a..9ce16ce 100644
---- a/drivers/edac/i82443bxgx_edac.c
-+++ b/drivers/edac/i82443bxgx_edac.c
-@@ -381,7 +381,7 @@ static void __devexit i82443bxgx_edacmc_remove_one(struct pci_dev *pdev)
-
- EXPORT_SYMBOL_GPL(i82443bxgx_edacmc_remove_one);
-
--static const struct pci_device_id i82443bxgx_pci_tbl[] __devinitdata = {
-+static const struct pci_device_id i82443bxgx_pci_tbl[] __devinitconst = {
- {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443BX_0)},
- {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443BX_2)},
- {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443GX_0)},
-diff --git a/drivers/edac/i82860_edac.c b/drivers/edac/i82860_edac.c
-index c0088ba..64a7b98 100644
---- a/drivers/edac/i82860_edac.c
-+++ b/drivers/edac/i82860_edac.c
-@@ -271,7 +271,7 @@ static void __devexit i82860_remove_one(struct pci_dev *pdev)
- edac_mc_free(mci);
- }
-
--static const struct pci_device_id i82860_pci_tbl[] __devinitdata = {
-+static const struct pci_device_id i82860_pci_tbl[] __devinitconst = {
- {
- PCI_VEND_DEV(INTEL, 82860_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
- I82860},
-diff --git a/drivers/edac/i82875p_edac.c b/drivers/edac/i82875p_edac.c
-index b2d83b9..a34357b 100644
---- a/drivers/edac/i82875p_edac.c
-+++ b/drivers/edac/i82875p_edac.c
-@@ -512,7 +512,7 @@ static void __devexit i82875p_remove_one(struct pci_dev *pdev)
- edac_mc_free(mci);
- }
-
--static const struct pci_device_id i82875p_pci_tbl[] __devinitdata = {
-+static const struct pci_device_id i82875p_pci_tbl[] __devinitconst = {
- {
- PCI_VEND_DEV(INTEL, 82875_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
- I82875P},
-diff --git a/drivers/edac/i82975x_edac.c b/drivers/edac/i82975x_edac.c
-index 2eed3ea..87bbbd1 100644
---- a/drivers/edac/i82975x_edac.c
-+++ b/drivers/edac/i82975x_edac.c
-@@ -586,7 +586,7 @@ static void __devexit i82975x_remove_one(struct pci_dev *pdev)
- edac_mc_free(mci);
- }
-
--static const struct pci_device_id i82975x_pci_tbl[] __devinitdata = {
-+static const struct pci_device_id i82975x_pci_tbl[] __devinitconst = {
- {
- PCI_VEND_DEV(INTEL, 82975_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
- I82975X
-diff --git a/drivers/edac/r82600_edac.c b/drivers/edac/r82600_edac.c
-index 9900675..78ac2b6 100644
---- a/drivers/edac/r82600_edac.c
-+++ b/drivers/edac/r82600_edac.c
-@@ -374,7 +374,7 @@ static void __devexit r82600_remove_one(struct pci_dev *pdev)
- edac_mc_free(mci);
- }
-
--static const struct pci_device_id r82600_pci_tbl[] __devinitdata = {
-+static const struct pci_device_id r82600_pci_tbl[] __devinitconst = {
- {
- PCI_DEVICE(PCI_VENDOR_ID_RADISYS, R82600_BRIDGE_ID)
- },
-diff --git a/drivers/edac/x38_edac.c b/drivers/edac/x38_edac.c
-index d4ec605..4cfec4e 100644
---- a/drivers/edac/x38_edac.c
-+++ b/drivers/edac/x38_edac.c
-@@ -441,7 +441,7 @@ static void __devexit x38_remove_one(struct pci_dev *pdev)
- edac_mc_free(mci);
- }
-
--static const struct pci_device_id x38_pci_tbl[] __devinitdata = {
-+static const struct pci_device_id x38_pci_tbl[] __devinitconst = {
- {
- PCI_VEND_DEV(INTEL, X38_HB), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
- X38},
-diff --git a/drivers/firewire/core-card.c b/drivers/firewire/core-card.c
-index 3fc2ceb..daf098f 100644
---- a/drivers/firewire/core-card.c
-+++ b/drivers/firewire/core-card.c
-@@ -558,7 +558,7 @@ void fw_card_release(struct kref *kref)
-
- void fw_core_remove_card(struct fw_card *card)
- {
-- struct fw_card_driver dummy_driver = dummy_driver_template;
-+ fw_card_driver_no_const dummy_driver = dummy_driver_template;
-
- card->driver->update_phy_reg(card, 4,
- PHY_LINK_ACTIVE | PHY_CONTENDER, 0);
-diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
-index 4560d8f..36db24a 100644
---- a/drivers/firewire/core-cdev.c
-+++ b/drivers/firewire/core-cdev.c
-@@ -1141,8 +1141,7 @@ static int init_iso_resource(struct client *client,
- int ret;
-
- if ((request->channels == 0 && request->bandwidth == 0) ||
-- request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL ||
-- request->bandwidth < 0)
-+ request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL)
- return -EINVAL;
-
- r = kmalloc(sizeof(*r), GFP_KERNEL);
-diff --git a/drivers/firewire/core-transaction.c b/drivers/firewire/core-transaction.c
-index da628c7..cf54a2c 100644
---- a/drivers/firewire/core-transaction.c
-+++ b/drivers/firewire/core-transaction.c
-@@ -36,6 +36,7 @@
- #include <linux/string.h>
- #include <linux/timer.h>
- #include <linux/types.h>
-+#include <linux/sched.h>
-
- #include <asm/byteorder.h>
-
-@@ -344,6 +345,8 @@ int fw_run_transaction(struct fw_card *card, int tcode, int destination_id,
- struct transaction_callback_data d;
- struct fw_transaction t;
-
-+ pax_track_stack();
-+
- init_completion(&d.done);
- d.payload = payload;
- fw_send_request(card, &t, tcode, destination_id, generation, speed,
-diff --git a/drivers/firewire/core.h b/drivers/firewire/core.h
-index 7ff6e75..a2965d9 100644
---- a/drivers/firewire/core.h
-+++ b/drivers/firewire/core.h
-@@ -86,6 +86,7 @@ struct fw_card_driver {
-
- int (*stop_iso)(struct fw_iso_context *ctx);
- };
-+typedef struct fw_card_driver __no_const fw_card_driver_no_const;
-
- void fw_card_initialize(struct fw_card *card,
- const struct fw_card_driver *driver, struct device *device);
-diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
-index 10a4246..8365cd1 100644
---- a/drivers/firmware/dmi_scan.c
-+++ b/drivers/firmware/dmi_scan.c
-@@ -394,11 +394,6 @@ void __init dmi_scan_machine(void)
- }
- }
- else {
-- /*
-- * no iounmap() for that ioremap(); it would be a no-op, but
-- * it's so early in setup that sucker gets confused into doing
-- * what it shouldn't if we actually call it.
-- */
- p = dmi_ioremap(0xF0000, 0x10000);
- if (p == NULL)
- goto error;
-@@ -670,7 +665,7 @@ int dmi_walk(void (*decode)(const struct dmi_header *, void *),
- if (buf == NULL)
- return -1;
-
-- dmi_table(buf, dmi_len, dmi_num, decode, private_data);
-+ dmi_table((char __force_kernel *)buf, dmi_len, dmi_num, decode, private_data);
-
- iounmap(buf);
- return 0;
-diff --git a/drivers/firmware/edd.c b/drivers/firmware/edd.c
-index 9e4f59d..110e24e 100644
---- a/drivers/firmware/edd.c
-+++ b/drivers/firmware/edd.c
-@@ -122,7 +122,7 @@ edd_attr_show(struct kobject * kobj, struct attribute *attr, char *buf)
- return ret;
- }
-
--static struct sysfs_ops edd_attr_ops = {
-+static const struct sysfs_ops edd_attr_ops = {
- .show = edd_attr_show,
- };
-
-diff --git a/drivers/firmware/efivars.c b/drivers/firmware/efivars.c
-index f4f709d..082f06e 100644
---- a/drivers/firmware/efivars.c
-+++ b/drivers/firmware/efivars.c
-@@ -362,7 +362,7 @@ static ssize_t efivar_attr_store(struct kobject *kobj, struct attribute *attr,
- return ret;
- }
-
--static struct sysfs_ops efivar_attr_ops = {
-+static const struct sysfs_ops efivar_attr_ops = {
- .show = efivar_attr_show,
- .store = efivar_attr_store,
- };
-diff --git a/drivers/firmware/iscsi_ibft.c b/drivers/firmware/iscsi_ibft.c
-index 051d1eb..0a5d4e7 100644
---- a/drivers/firmware/iscsi_ibft.c
-+++ b/drivers/firmware/iscsi_ibft.c
-@@ -525,7 +525,7 @@ static ssize_t ibft_show_attribute(struct kobject *kobj,
- return ret;
- }
-
--static struct sysfs_ops ibft_attr_ops = {
-+static const struct sysfs_ops ibft_attr_ops = {
- .show = ibft_show_attribute,
- };
-
-diff --git a/drivers/firmware/memmap.c b/drivers/firmware/memmap.c
-index 56f9234..8c58c7b 100644
---- a/drivers/firmware/memmap.c
-+++ b/drivers/firmware/memmap.c
-@@ -74,7 +74,7 @@ static struct attribute *def_attrs[] = {
- NULL
- };
-
--static struct sysfs_ops memmap_attr_ops = {
-+static const struct sysfs_ops memmap_attr_ops = {
- .show = memmap_attr_show,
- };
-
-diff --git a/drivers/gpio/vr41xx_giu.c b/drivers/gpio/vr41xx_giu.c
-index b16c9a8..2af7d3f 100644
---- a/drivers/gpio/vr41xx_giu.c
-+++ b/drivers/gpio/vr41xx_giu.c
-@@ -204,7 +204,7 @@ static int giu_get_irq(unsigned int irq)
- printk(KERN_ERR "spurious GIU interrupt: %04x(%04x),%04x(%04x)\n",
- maskl, pendl, maskh, pendh);
-
-- atomic_inc(&irq_err_count);
-+ atomic_inc_unchecked(&irq_err_count);
-
- return -EINVAL;
- }
-diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
-index bea6efc..3dc0f42 100644
---- a/drivers/gpu/drm/drm_crtc.c
-+++ b/drivers/gpu/drm/drm_crtc.c
-@@ -1323,7 +1323,7 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
- */
- if ((out_resp->count_modes >= mode_count) && mode_count) {
- copied = 0;
-- mode_ptr = (struct drm_mode_modeinfo *)(unsigned long)out_resp->modes_ptr;
-+ mode_ptr = (struct drm_mode_modeinfo __user *)(unsigned long)out_resp->modes_ptr;
- list_for_each_entry(mode, &connector->modes, head) {
- drm_crtc_convert_to_umode(&u_mode, mode);
- if (copy_to_user(mode_ptr + copied,
-@@ -1338,8 +1338,8 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
-
- if ((out_resp->count_props >= props_count) && props_count) {
- copied = 0;
-- prop_ptr = (uint32_t *)(unsigned long)(out_resp->props_ptr);
-- prop_values = (uint64_t *)(unsigned long)(out_resp->prop_values_ptr);
-+ prop_ptr = (uint32_t __user *)(unsigned long)(out_resp->props_ptr);
-+ prop_values = (uint64_t __user *)(unsigned long)(out_resp->prop_values_ptr);
- for (i = 0; i < DRM_CONNECTOR_MAX_PROPERTY; i++) {
- if (connector->property_ids[i] != 0) {
- if (put_user(connector->property_ids[i],
-@@ -1361,7 +1361,7 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
-
- if ((out_resp->count_encoders >= encoders_count) && encoders_count) {
- copied = 0;
-- encoder_ptr = (uint32_t *)(unsigned long)(out_resp->encoders_ptr);
-+ encoder_ptr = (uint32_t __user *)(unsigned long)(out_resp->encoders_ptr);
- for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
- if (connector->encoder_ids[i] != 0) {
- if (put_user(connector->encoder_ids[i],
-@@ -1513,7 +1513,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
- }
-
- for (i = 0; i < crtc_req->count_connectors; i++) {
-- set_connectors_ptr = (uint32_t *)(unsigned long)crtc_req->set_connectors_ptr;
-+ set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr;
- if (get_user(out_id, &set_connectors_ptr[i])) {
- ret = -EFAULT;
- goto out;
-@@ -2118,7 +2118,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
- out_resp->flags = property->flags;
-
- if ((out_resp->count_values >= value_count) && value_count) {
-- values_ptr = (uint64_t *)(unsigned long)out_resp->values_ptr;
-+ values_ptr = (uint64_t __user *)(unsigned long)out_resp->values_ptr;
- for (i = 0; i < value_count; i++) {
- if (copy_to_user(values_ptr + i, &property->values[i], sizeof(uint64_t))) {
- ret = -EFAULT;
-@@ -2131,7 +2131,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
- if (property->flags & DRM_MODE_PROP_ENUM) {
- if ((out_resp->count_enum_blobs >= enum_count) && enum_count) {
- copied = 0;
-- enum_ptr = (struct drm_mode_property_enum *)(unsigned long)out_resp->enum_blob_ptr;
-+ enum_ptr = (struct drm_mode_property_enum __user *)(unsigned long)out_resp->enum_blob_ptr;
- list_for_each_entry(prop_enum, &property->enum_blob_list, head) {
-
- if (copy_to_user(&enum_ptr[copied].value, &prop_enum->value, sizeof(uint64_t))) {
-@@ -2154,7 +2154,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
- if ((out_resp->count_enum_blobs >= blob_count) && blob_count) {
- copied = 0;
- blob_id_ptr = (uint32_t *)(unsigned long)out_resp->enum_blob_ptr;
-- blob_length_ptr = (uint32_t *)(unsigned long)out_resp->values_ptr;
-+ blob_length_ptr = (uint32_t __user *)(unsigned long)out_resp->values_ptr;
-
- list_for_each_entry(prop_blob, &property->enum_blob_list, head) {
- if (put_user(prop_blob->base.id, blob_id_ptr + copied)) {
-@@ -2226,7 +2226,7 @@ int drm_mode_getblob_ioctl(struct drm_device *dev,
- blob = obj_to_blob(obj);
-
- if (out_resp->length == blob->length) {
-- blob_ptr = (void *)(unsigned long)out_resp->data;
-+ blob_ptr = (void __user *)(unsigned long)out_resp->data;
- if (copy_to_user(blob_ptr, blob->data, blob->length)){
- ret = -EFAULT;
- goto done;
-diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
-index 1b8745d..92fdbf6 100644
---- a/drivers/gpu/drm/drm_crtc_helper.c
-+++ b/drivers/gpu/drm/drm_crtc_helper.c
-@@ -573,7 +573,7 @@ static bool drm_encoder_crtc_ok(struct drm_encoder *encoder,
- struct drm_crtc *tmp;
- int crtc_mask = 1;
-
-- WARN(!crtc, "checking null crtc?");
-+ BUG_ON(!crtc);
-
- dev = crtc->dev;
-
-@@ -642,6 +642,8 @@ bool drm_crtc_helper_set_mode(struct drm_crtc *crtc,
-
- adjusted_mode = drm_mode_duplicate(dev, mode);
-
-+ pax_track_stack();
-+
- crtc->enabled = drm_helper_crtc_in_use(crtc);
-
- if (!crtc->enabled)
-diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
-index 0e27d98..dec8768 100644
---- a/drivers/gpu/drm/drm_drv.c
-+++ b/drivers/gpu/drm/drm_drv.c
-@@ -417,7 +417,7 @@ int drm_ioctl(struct inode *inode, struct file *filp,
- char *kdata = NULL;
-
- atomic_inc(&dev->ioctl_count);
-- atomic_inc(&dev->counts[_DRM_STAT_IOCTLS]);
-+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_IOCTLS]);
- ++file_priv->ioctl_count;
-
- DRM_DEBUG("pid=%d, cmd=0x%02x, nr=0x%02x, dev 0x%lx, auth=%d\n",
-diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c
-index 519161e..98c840c 100644
---- a/drivers/gpu/drm/drm_fops.c
-+++ b/drivers/gpu/drm/drm_fops.c
-@@ -66,7 +66,7 @@ static int drm_setup(struct drm_device * dev)
- }
-
- for (i = 0; i < ARRAY_SIZE(dev->counts); i++)
-- atomic_set(&dev->counts[i], 0);
-+ atomic_set_unchecked(&dev->counts[i], 0);
-
- dev->sigdata.lock = NULL;
-
-@@ -130,9 +130,9 @@ int drm_open(struct inode *inode, struct file *filp)
-
- retcode = drm_open_helper(inode, filp, dev);
- if (!retcode) {
-- atomic_inc(&dev->counts[_DRM_STAT_OPENS]);
-+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_OPENS]);
- spin_lock(&dev->count_lock);
-- if (!dev->open_count++) {
-+ if (local_inc_return(&dev->open_count) == 1) {
- spin_unlock(&dev->count_lock);
- retcode = drm_setup(dev);
- goto out;
-@@ -435,7 +435,7 @@ int drm_release(struct inode *inode, struct file *filp)
-
- lock_kernel();
-
-- DRM_DEBUG("open_count = %d\n", dev->open_count);
-+ DRM_DEBUG("open_count = %d\n", local_read(&dev->open_count));
-
- if (dev->driver->preclose)
- dev->driver->preclose(dev, file_priv);
-@@ -447,7 +447,7 @@ int drm_release(struct inode *inode, struct file *filp)
- DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %d\n",
- task_pid_nr(current),
- (long)old_encode_dev(file_priv->minor->device),
-- dev->open_count);
-+ local_read(&dev->open_count));
-
- /* Release any auth tokens that might point to this file_priv,
- (do that under the drm_global_mutex) */
-@@ -529,9 +529,9 @@ int drm_release(struct inode *inode, struct file *filp)
- * End inline drm_release
- */
-
-- atomic_inc(&dev->counts[_DRM_STAT_CLOSES]);
-+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_CLOSES]);
- spin_lock(&dev->count_lock);
-- if (!--dev->open_count) {
-+ if (local_dec_and_test(&dev->open_count)) {
- if (atomic_read(&dev->ioctl_count)) {
- DRM_ERROR("Device busy: %d\n",
- atomic_read(&dev->ioctl_count));
-diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
-index 8bf3770..79422805 100644
---- a/drivers/gpu/drm/drm_gem.c
-+++ b/drivers/gpu/drm/drm_gem.c
-@@ -83,11 +83,11 @@ drm_gem_init(struct drm_device *dev)
- spin_lock_init(&dev->object_name_lock);
- idr_init(&dev->object_name_idr);
- atomic_set(&dev->object_count, 0);
-- atomic_set(&dev->object_memory, 0);
-+ atomic_set_unchecked(&dev->object_memory, 0);
- atomic_set(&dev->pin_count, 0);
-- atomic_set(&dev->pin_memory, 0);
-+ atomic_set_unchecked(&dev->pin_memory, 0);
- atomic_set(&dev->gtt_count, 0);
-- atomic_set(&dev->gtt_memory, 0);
-+ atomic_set_unchecked(&dev->gtt_memory, 0);
-
- mm = kzalloc(sizeof(struct drm_gem_mm), GFP_KERNEL);
- if (!mm) {
-@@ -150,7 +150,7 @@ drm_gem_object_alloc(struct drm_device *dev, size_t size)
- goto fput;
- }
- atomic_inc(&dev->object_count);
-- atomic_add(obj->size, &dev->object_memory);
-+ atomic_add_unchecked(obj->size, &dev->object_memory);
- return obj;
- fput:
- fput(obj->filp);
-@@ -429,7 +429,7 @@ drm_gem_object_free(struct kref *kref)
-
- fput(obj->filp);
- atomic_dec(&dev->object_count);
-- atomic_sub(obj->size, &dev->object_memory);
-+ atomic_sub_unchecked(obj->size, &dev->object_memory);
- kfree(obj);
- }
- EXPORT_SYMBOL(drm_gem_object_free);
-diff --git a/drivers/gpu/drm/drm_info.c b/drivers/gpu/drm/drm_info.c
-index f0f6c6b..34af322 100644
---- a/drivers/gpu/drm/drm_info.c
-+++ b/drivers/gpu/drm/drm_info.c
-@@ -75,10 +75,14 @@ int drm_vm_info(struct seq_file *m, void *data)
- struct drm_local_map *map;
- struct drm_map_list *r_list;
-
-- /* Hardcoded from _DRM_FRAME_BUFFER,
-- _DRM_REGISTERS, _DRM_SHM, _DRM_AGP, and
-- _DRM_SCATTER_GATHER and _DRM_CONSISTENT */
-- const char *types[] = { "FB", "REG", "SHM", "AGP", "SG", "PCI" };
-+ static const char * const types[] = {
-+ [_DRM_FRAME_BUFFER] = "FB",
-+ [_DRM_REGISTERS] = "REG",
-+ [_DRM_SHM] = "SHM",
-+ [_DRM_AGP] = "AGP",
-+ [_DRM_SCATTER_GATHER] = "SG",
-+ [_DRM_CONSISTENT] = "PCI",
-+ [_DRM_GEM] = "GEM" };
- const char *type;
- int i;
-
-@@ -89,7 +93,7 @@ int drm_vm_info(struct seq_file *m, void *data)
- map = r_list->map;
- if (!map)
- continue;
-- if (map->type < 0 || map->type > 5)
-+ if (map->type >= ARRAY_SIZE(types))
- type = "??";
- else
- type = types[map->type];
-@@ -265,10 +269,10 @@ int drm_gem_object_info(struct seq_file *m, void* data)
- struct drm_device *dev = node->minor->dev;
-
- seq_printf(m, "%d objects\n", atomic_read(&dev->object_count));
-- seq_printf(m, "%d object bytes\n", atomic_read(&dev->object_memory));
-+ seq_printf(m, "%d object bytes\n", atomic_read_unchecked(&dev->object_memory));
- seq_printf(m, "%d pinned\n", atomic_read(&dev->pin_count));
-- seq_printf(m, "%d pin bytes\n", atomic_read(&dev->pin_memory));
-- seq_printf(m, "%d gtt bytes\n", atomic_read(&dev->gtt_memory));
-+ seq_printf(m, "%d pin bytes\n", atomic_read_unchecked(&dev->pin_memory));
-+ seq_printf(m, "%d gtt bytes\n", atomic_read_unchecked(&dev->gtt_memory));
- seq_printf(m, "%d gtt total\n", dev->gtt_total);
- return 0;
- }
-@@ -288,7 +292,11 @@ int drm_vma_info(struct seq_file *m, void *data)
- mutex_lock(&dev->struct_mutex);
- seq_printf(m, "vma use count: %d, high_memory = %p, 0x%08llx\n",
- atomic_read(&dev->vma_count),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL, 0);
-+#else
- high_memory, (u64)virt_to_phys(high_memory));
-+#endif
-
- list_for_each_entry(pt, &dev->vmalist, head) {
- vma = pt->vma;
-@@ -296,14 +304,23 @@ int drm_vma_info(struct seq_file *m, void *data)
- continue;
- seq_printf(m,
- "\n%5d 0x%08lx-0x%08lx %c%c%c%c%c%c 0x%08lx000",
-- pt->pid, vma->vm_start, vma->vm_end,
-+ pt->pid,
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ 0, 0,
-+#else
-+ vma->vm_start, vma->vm_end,
-+#endif
- vma->vm_flags & VM_READ ? 'r' : '-',
- vma->vm_flags & VM_WRITE ? 'w' : '-',
- vma->vm_flags & VM_EXEC ? 'x' : '-',
- vma->vm_flags & VM_MAYSHARE ? 's' : 'p',
- vma->vm_flags & VM_LOCKED ? 'l' : '-',
- vma->vm_flags & VM_IO ? 'i' : '-',
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ 0);
-+#else
- vma->vm_pgoff);
-+#endif
-
- #if defined(__i386__)
- pgprot = pgprot_val(vma->vm_page_prot);
-diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
-index 282d9fd..71e5f11 100644
---- a/drivers/gpu/drm/drm_ioc32.c
-+++ b/drivers/gpu/drm/drm_ioc32.c
-@@ -463,7 +463,7 @@ static int compat_drm_infobufs(struct file *file, unsigned int cmd,
- request = compat_alloc_user_space(nbytes);
- if (!access_ok(VERIFY_WRITE, request, nbytes))
- return -EFAULT;
-- list = (struct drm_buf_desc *) (request + 1);
-+ list = (struct drm_buf_desc __user *) (request + 1);
-
- if (__put_user(count, &request->count)
- || __put_user(list, &request->list))
-@@ -525,7 +525,7 @@ static int compat_drm_mapbufs(struct file *file, unsigned int cmd,
- request = compat_alloc_user_space(nbytes);
- if (!access_ok(VERIFY_WRITE, request, nbytes))
- return -EFAULT;
-- list = (struct drm_buf_pub *) (request + 1);
-+ list = (struct drm_buf_pub __user *) (request + 1);
-
- if (__put_user(count, &request->count)
- || __put_user(list, &request->list))
-diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c
-index 9b9ff46..4ea724c 100644
---- a/drivers/gpu/drm/drm_ioctl.c
-+++ b/drivers/gpu/drm/drm_ioctl.c
-@@ -283,7 +283,7 @@ int drm_getstats(struct drm_device *dev, void *data,
- stats->data[i].value =
- (file_priv->master->lock.hw_lock ? file_priv->master->lock.hw_lock->lock : 0);
- else
-- stats->data[i].value = atomic_read(&dev->counts[i]);
-+ stats->data[i].value = atomic_read_unchecked(&dev->counts[i]);
- stats->data[i].type = dev->types[i];
- }
-
-diff --git a/drivers/gpu/drm/drm_lock.c b/drivers/gpu/drm/drm_lock.c
-index e2f70a5..c703e86 100644
---- a/drivers/gpu/drm/drm_lock.c
-+++ b/drivers/gpu/drm/drm_lock.c
-@@ -87,7 +87,7 @@ int drm_lock(struct drm_device *dev, void *data, struct drm_file *file_priv)
- if (drm_lock_take(&master->lock, lock->context)) {
- master->lock.file_priv = file_priv;
- master->lock.lock_time = jiffies;
-- atomic_inc(&dev->counts[_DRM_STAT_LOCKS]);
-+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_LOCKS]);
- break; /* Got lock */
- }
-
-@@ -165,7 +165,7 @@ int drm_unlock(struct drm_device *dev, void *data, struct drm_file *file_priv)
- return -EINVAL;
- }
-
-- atomic_inc(&dev->counts[_DRM_STAT_UNLOCKS]);
-+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_UNLOCKS]);
-
- /* kernel_context_switch isn't used by any of the x86 drm
- * modules but is required by the Sparc driver.
-diff --git a/drivers/gpu/drm/i810/i810_dma.c b/drivers/gpu/drm/i810/i810_dma.c
-index 7d1d88cd..b9131b2 100644
---- a/drivers/gpu/drm/i810/i810_dma.c
-+++ b/drivers/gpu/drm/i810/i810_dma.c
-@@ -952,8 +952,8 @@ static int i810_dma_vertex(struct drm_device *dev, void *data,
- dma->buflist[vertex->idx],
- vertex->discard, vertex->used);
-
-- atomic_add(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
-- atomic_inc(&dev->counts[_DRM_STAT_DMA]);
-+ atomic_add_unchecked(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
-+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
- sarea_priv->last_enqueue = dev_priv->counter - 1;
- sarea_priv->last_dispatch = (int)hw_status[5];
-
-@@ -1115,8 +1115,8 @@ static int i810_dma_mc(struct drm_device *dev, void *data,
- i810_dma_dispatch_mc(dev, dma->buflist[mc->idx], mc->used,
- mc->last_render);
-
-- atomic_add(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
-- atomic_inc(&dev->counts[_DRM_STAT_DMA]);
-+ atomic_add_unchecked(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
-+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
- sarea_priv->last_enqueue = dev_priv->counter - 1;
- sarea_priv->last_dispatch = (int)hw_status[5];
-
-diff --git a/drivers/gpu/drm/i810/i810_drv.h b/drivers/gpu/drm/i810/i810_drv.h
-index 21e2691..7321edd 100644
---- a/drivers/gpu/drm/i810/i810_drv.h
-+++ b/drivers/gpu/drm/i810/i810_drv.h
-@@ -108,8 +108,8 @@ typedef struct drm_i810_private {
- int page_flipping;
-
- wait_queue_head_t irq_queue;
-- atomic_t irq_received;
-- atomic_t irq_emitted;
-+ atomic_unchecked_t irq_received;
-+ atomic_unchecked_t irq_emitted;
-
- int front_offset;
- } drm_i810_private_t;
-diff --git a/drivers/gpu/drm/i830/i830_drv.h b/drivers/gpu/drm/i830/i830_drv.h
-index da82afe..48a45de 100644
---- a/drivers/gpu/drm/i830/i830_drv.h
-+++ b/drivers/gpu/drm/i830/i830_drv.h
-@@ -115,8 +115,8 @@ typedef struct drm_i830_private {
- int page_flipping;
-
- wait_queue_head_t irq_queue;
-- atomic_t irq_received;
-- atomic_t irq_emitted;
-+ atomic_unchecked_t irq_received;
-+ atomic_unchecked_t irq_emitted;
-
- int use_mi_batchbuffer_start;
-
-diff --git a/drivers/gpu/drm/i830/i830_irq.c b/drivers/gpu/drm/i830/i830_irq.c
-index 91ec2bb..6f21fab 100644
---- a/drivers/gpu/drm/i830/i830_irq.c
-+++ b/drivers/gpu/drm/i830/i830_irq.c
-@@ -47,7 +47,7 @@ irqreturn_t i830_driver_irq_handler(DRM_IRQ_ARGS)
-
- I830_WRITE16(I830REG_INT_IDENTITY_R, temp);
-
-- atomic_inc(&dev_priv->irq_received);
-+ atomic_inc_unchecked(&dev_priv->irq_received);
- wake_up_interruptible(&dev_priv->irq_queue);
-
- return IRQ_HANDLED;
-@@ -60,14 +60,14 @@ static int i830_emit_irq(struct drm_device * dev)
-
- DRM_DEBUG("%s\n", __func__);
-
-- atomic_inc(&dev_priv->irq_emitted);
-+ atomic_inc_unchecked(&dev_priv->irq_emitted);
-
- BEGIN_LP_RING(2);
- OUT_RING(0);
- OUT_RING(GFX_OP_USER_INTERRUPT);
- ADVANCE_LP_RING();
-
-- return atomic_read(&dev_priv->irq_emitted);
-+ return atomic_read_unchecked(&dev_priv->irq_emitted);
- }
-
- static int i830_wait_irq(struct drm_device * dev, int irq_nr)
-@@ -79,7 +79,7 @@ static int i830_wait_irq(struct drm_device * dev, int irq_nr)
-
- DRM_DEBUG("%s\n", __func__);
-
-- if (atomic_read(&dev_priv->irq_received) >= irq_nr)
-+ if (atomic_read_unchecked(&dev_priv->irq_received) >= irq_nr)
- return 0;
-
- dev_priv->sarea_priv->perf_boxes |= I830_BOX_WAIT;
-@@ -88,7 +88,7 @@ static int i830_wait_irq(struct drm_device * dev, int irq_nr)
-
- for (;;) {
- __set_current_state(TASK_INTERRUPTIBLE);
-- if (atomic_read(&dev_priv->irq_received) >= irq_nr)
-+ if (atomic_read_unchecked(&dev_priv->irq_received) >= irq_nr)
- break;
- if ((signed)(end - jiffies) <= 0) {
- DRM_ERROR("timeout iir %x imr %x ier %x hwstam %x\n",
-@@ -163,8 +163,8 @@ void i830_driver_irq_preinstall(struct drm_device * dev)
- I830_WRITE16(I830REG_HWSTAM, 0xffff);
- I830_WRITE16(I830REG_INT_MASK_R, 0x0);
- I830_WRITE16(I830REG_INT_ENABLE_R, 0x0);
-- atomic_set(&dev_priv->irq_received, 0);
-- atomic_set(&dev_priv->irq_emitted, 0);
-+ atomic_set_unchecked(&dev_priv->irq_received, 0);
-+ atomic_set_unchecked(&dev_priv->irq_emitted, 0);
- init_waitqueue_head(&dev_priv->irq_queue);
- }
-
-diff --git a/drivers/gpu/drm/i915/dvo.h b/drivers/gpu/drm/i915/dvo.h
-index 288fc50..c6092055 100644
---- a/drivers/gpu/drm/i915/dvo.h
-+++ b/drivers/gpu/drm/i915/dvo.h
-@@ -135,23 +135,23 @@ struct intel_dvo_dev_ops {
- *
- * \return singly-linked list of modes or NULL if no modes found.
- */
-- struct drm_display_mode *(*get_modes)(struct intel_dvo_device *dvo);
-+ struct drm_display_mode *(* const get_modes)(struct intel_dvo_device *dvo);
-
- /**
- * Clean up driver-specific bits of the output
- */
-- void (*destroy) (struct intel_dvo_device *dvo);
-+ void (* const destroy) (struct intel_dvo_device *dvo);
-
- /**
- * Debugging hook to dump device registers to log file
- */
-- void (*dump_regs)(struct intel_dvo_device *dvo);
-+ void (* const dump_regs)(struct intel_dvo_device *dvo);
- };
-
--extern struct intel_dvo_dev_ops sil164_ops;
--extern struct intel_dvo_dev_ops ch7xxx_ops;
--extern struct intel_dvo_dev_ops ivch_ops;
--extern struct intel_dvo_dev_ops tfp410_ops;
--extern struct intel_dvo_dev_ops ch7017_ops;
-+extern const struct intel_dvo_dev_ops sil164_ops;
-+extern const struct intel_dvo_dev_ops ch7xxx_ops;
-+extern const struct intel_dvo_dev_ops ivch_ops;
-+extern const struct intel_dvo_dev_ops tfp410_ops;
-+extern const struct intel_dvo_dev_ops ch7017_ops;
-
- #endif /* _INTEL_DVO_H */
-diff --git a/drivers/gpu/drm/i915/dvo_ch7017.c b/drivers/gpu/drm/i915/dvo_ch7017.c
-index 621815b..499d82e 100644
---- a/drivers/gpu/drm/i915/dvo_ch7017.c
-+++ b/drivers/gpu/drm/i915/dvo_ch7017.c
-@@ -443,7 +443,7 @@ static void ch7017_destroy(struct intel_dvo_device *dvo)
- }
- }
-
--struct intel_dvo_dev_ops ch7017_ops = {
-+const struct intel_dvo_dev_ops ch7017_ops = {
- .init = ch7017_init,
- .detect = ch7017_detect,
- .mode_valid = ch7017_mode_valid,
-diff --git a/drivers/gpu/drm/i915/dvo_ch7xxx.c b/drivers/gpu/drm/i915/dvo_ch7xxx.c
-index a9b8962..ac769ba 100644
---- a/drivers/gpu/drm/i915/dvo_ch7xxx.c
-+++ b/drivers/gpu/drm/i915/dvo_ch7xxx.c
-@@ -356,7 +356,7 @@ static void ch7xxx_destroy(struct intel_dvo_device *dvo)
- }
- }
-
--struct intel_dvo_dev_ops ch7xxx_ops = {
-+const struct intel_dvo_dev_ops ch7xxx_ops = {
- .init = ch7xxx_init,
- .detect = ch7xxx_detect,
- .mode_valid = ch7xxx_mode_valid,
-diff --git a/drivers/gpu/drm/i915/dvo_ivch.c b/drivers/gpu/drm/i915/dvo_ivch.c
-index aa176f9..ed2930c 100644
---- a/drivers/gpu/drm/i915/dvo_ivch.c
-+++ b/drivers/gpu/drm/i915/dvo_ivch.c
-@@ -430,7 +430,7 @@ static void ivch_destroy(struct intel_dvo_device *dvo)
- }
- }
-
--struct intel_dvo_dev_ops ivch_ops= {
-+const struct intel_dvo_dev_ops ivch_ops= {
- .init = ivch_init,
- .dpms = ivch_dpms,
- .save = ivch_save,
-diff --git a/drivers/gpu/drm/i915/dvo_sil164.c b/drivers/gpu/drm/i915/dvo_sil164.c
-index e1c1f73..7dbebcf 100644
---- a/drivers/gpu/drm/i915/dvo_sil164.c
-+++ b/drivers/gpu/drm/i915/dvo_sil164.c
-@@ -290,7 +290,7 @@ static void sil164_destroy(struct intel_dvo_device *dvo)
- }
- }
-
--struct intel_dvo_dev_ops sil164_ops = {
-+const struct intel_dvo_dev_ops sil164_ops = {
- .init = sil164_init,
- .detect = sil164_detect,
- .mode_valid = sil164_mode_valid,
-diff --git a/drivers/gpu/drm/i915/dvo_tfp410.c b/drivers/gpu/drm/i915/dvo_tfp410.c
-index 16dce84..7e1b6f8 100644
---- a/drivers/gpu/drm/i915/dvo_tfp410.c
-+++ b/drivers/gpu/drm/i915/dvo_tfp410.c
-@@ -323,7 +323,7 @@ static void tfp410_destroy(struct intel_dvo_device *dvo)
- }
- }
-
--struct intel_dvo_dev_ops tfp410_ops = {
-+const struct intel_dvo_dev_ops tfp410_ops = {
- .init = tfp410_init,
- .detect = tfp410_detect,
- .mode_valid = tfp410_mode_valid,
-diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
-index 7e859d6..7d1cf2b 100644
---- a/drivers/gpu/drm/i915/i915_debugfs.c
-+++ b/drivers/gpu/drm/i915/i915_debugfs.c
-@@ -192,7 +192,7 @@ static int i915_interrupt_info(struct seq_file *m, void *data)
- I915_READ(GTIMR));
- }
- seq_printf(m, "Interrupts received: %d\n",
-- atomic_read(&dev_priv->irq_received));
-+ atomic_read_unchecked(&dev_priv->irq_received));
- if (dev_priv->hw_status_page != NULL) {
- seq_printf(m, "Current sequence: %d\n",
- i915_get_gem_seqno(dev));
-diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
-index 5449239..7e4f68d 100644
---- a/drivers/gpu/drm/i915/i915_drv.c
-+++ b/drivers/gpu/drm/i915/i915_drv.c
-@@ -285,7 +285,7 @@ i915_pci_resume(struct pci_dev *pdev)
- return i915_resume(dev);
- }
-
--static struct vm_operations_struct i915_gem_vm_ops = {
-+static const struct vm_operations_struct i915_gem_vm_ops = {
- .fault = i915_gem_fault,
- .open = drm_gem_vm_open,
- .close = drm_gem_vm_close,
-diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
-index 97163f7..65574ff 100644
---- a/drivers/gpu/drm/i915/i915_drv.h
-+++ b/drivers/gpu/drm/i915/i915_drv.h
-@@ -197,7 +197,7 @@ typedef struct drm_i915_private {
- int page_flipping;
-
- wait_queue_head_t irq_queue;
-- atomic_t irq_received;
-+ atomic_unchecked_t irq_received;
- /** Protects user_irq_refcount and irq_mask_reg */
- spinlock_t user_irq_lock;
- /** Refcount for i915_user_irq_get() versus i915_user_irq_put(). */
-diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
-index 27a3074..df81827 100644
---- a/drivers/gpu/drm/i915/i915_gem.c
-+++ b/drivers/gpu/drm/i915/i915_gem.c
-@@ -102,7 +102,7 @@ i915_gem_get_aperture_ioctl(struct drm_device *dev, void *data,
-
- args->aper_size = dev->gtt_total;
- args->aper_available_size = (args->aper_size -
-- atomic_read(&dev->pin_memory));
-+ atomic_read_unchecked(&dev->pin_memory));
-
- return 0;
- }
-@@ -2058,7 +2058,7 @@ i915_gem_object_unbind(struct drm_gem_object *obj)
-
- if (obj_priv->gtt_space) {
- atomic_dec(&dev->gtt_count);
-- atomic_sub(obj->size, &dev->gtt_memory);
-+ atomic_sub_unchecked(obj->size, &dev->gtt_memory);
-
- drm_mm_put_block(obj_priv->gtt_space);
- obj_priv->gtt_space = NULL;
-@@ -2701,7 +2701,7 @@ i915_gem_object_bind_to_gtt(struct drm_gem_object *obj, unsigned alignment)
- goto search_free;
- }
- atomic_inc(&dev->gtt_count);
-- atomic_add(obj->size, &dev->gtt_memory);
-+ atomic_add_unchecked(obj->size, &dev->gtt_memory);
-
- /* Assert that the object is not currently in any GPU domain. As it
- * wasn't in the GTT, there shouldn't be any way it could have been in
-@@ -3639,8 +3639,8 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
- return -EINVAL;
- }
- /* Copy in the exec list from userland */
-- exec_list = drm_calloc_large(sizeof(*exec_list), args->buffer_count);
-- object_list = drm_calloc_large(sizeof(*object_list), args->buffer_count);
-+ exec_list = drm_calloc_large(args->buffer_count, sizeof(*exec_list));
-+ object_list = drm_calloc_large(args->buffer_count, sizeof(*object_list));
- if (exec_list == NULL || object_list == NULL) {
- DRM_ERROR("Failed to allocate exec or object list "
- "for %d buffers\n",
-@@ -3755,9 +3755,9 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
- "%d/%d gtt bytes\n",
- atomic_read(&dev->object_count),
- atomic_read(&dev->pin_count),
-- atomic_read(&dev->object_memory),
-- atomic_read(&dev->pin_memory),
-- atomic_read(&dev->gtt_memory),
-+ atomic_read_unchecked(&dev->object_memory),
-+ atomic_read_unchecked(&dev->pin_memory),
-+ atomic_read_unchecked(&dev->gtt_memory),
- dev->gtt_total);
- }
- goto err;
-@@ -3989,7 +3989,7 @@ i915_gem_object_pin(struct drm_gem_object *obj, uint32_t alignment)
- */
- if (obj_priv->pin_count == 1) {
- atomic_inc(&dev->pin_count);
-- atomic_add(obj->size, &dev->pin_memory);
-+ atomic_add_unchecked(obj->size, &dev->pin_memory);
- if (!obj_priv->active &&
- (obj->write_domain & I915_GEM_GPU_DOMAINS) == 0 &&
- !list_empty(&obj_priv->list))
-@@ -4022,7 +4022,7 @@ i915_gem_object_unpin(struct drm_gem_object *obj)
- list_move_tail(&obj_priv->list,
- &dev_priv->mm.inactive_list);
- atomic_dec(&dev->pin_count);
-- atomic_sub(obj->size, &dev->pin_memory);
-+ atomic_sub_unchecked(obj->size, &dev->pin_memory);
- }
- i915_verify_inactive(dev, __FILE__, __LINE__);
- }
-diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
-index 63f28ad..f5469da 100644
---- a/drivers/gpu/drm/i915/i915_irq.c
-+++ b/drivers/gpu/drm/i915/i915_irq.c
-@@ -528,7 +528,7 @@ irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
- int irq_received;
- int ret = IRQ_NONE;
-
-- atomic_inc(&dev_priv->irq_received);
-+ atomic_inc_unchecked(&dev_priv->irq_received);
-
- if (IS_IGDNG(dev))
- return igdng_irq_handler(dev);
-@@ -1021,7 +1021,7 @@ void i915_driver_irq_preinstall(struct drm_device * dev)
- {
- drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
-
-- atomic_set(&dev_priv->irq_received, 0);
-+ atomic_set_unchecked(&dev_priv->irq_received, 0);
-
- INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
- INIT_WORK(&dev_priv->error_work, i915_error_work_func);
-diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
-index 5d9c6a7..d1b0e29 100644
---- a/drivers/gpu/drm/i915/intel_sdvo.c
-+++ b/drivers/gpu/drm/i915/intel_sdvo.c
-@@ -2795,7 +2795,9 @@ bool intel_sdvo_init(struct drm_device *dev, int output_device)
- sdvo_priv->slave_addr = intel_sdvo_get_slave_addr(dev, output_device);
-
- /* Save the bit-banging i2c functionality for use by the DDC wrapper */
-- intel_sdvo_i2c_bit_algo.functionality = intel_output->i2c_bus->algo->functionality;
-+ pax_open_kernel();
-+ *(void **)&intel_sdvo_i2c_bit_algo.functionality = intel_output->i2c_bus->algo->functionality;
-+ pax_close_kernel();
-
- /* Read the regs to test if we can talk to the device */
- for (i = 0; i < 0x40; i++) {
-diff --git a/drivers/gpu/drm/mga/mga_drv.h b/drivers/gpu/drm/mga/mga_drv.h
-index be6c6b9..8615d9c 100644
---- a/drivers/gpu/drm/mga/mga_drv.h
-+++ b/drivers/gpu/drm/mga/mga_drv.h
-@@ -120,9 +120,9 @@ typedef struct drm_mga_private {
- u32 clear_cmd;
- u32 maccess;
-
-- atomic_t vbl_received; /**< Number of vblanks received. */
-+ atomic_unchecked_t vbl_received; /**< Number of vblanks received. */
- wait_queue_head_t fence_queue;
-- atomic_t last_fence_retired;
-+ atomic_unchecked_t last_fence_retired;
- u32 next_fence_to_post;
-
- unsigned int fb_cpp;
-diff --git a/drivers/gpu/drm/mga/mga_irq.c b/drivers/gpu/drm/mga/mga_irq.c
-index daa6041..a28a5da 100644
---- a/drivers/gpu/drm/mga/mga_irq.c
-+++ b/drivers/gpu/drm/mga/mga_irq.c
-@@ -44,7 +44,7 @@ u32 mga_get_vblank_counter(struct drm_device *dev, int crtc)
- if (crtc != 0)
- return 0;
-
-- return atomic_read(&dev_priv->vbl_received);
-+ return atomic_read_unchecked(&dev_priv->vbl_received);
- }
-
-
-@@ -60,7 +60,7 @@ irqreturn_t mga_driver_irq_handler(DRM_IRQ_ARGS)
- /* VBLANK interrupt */
- if (status & MGA_VLINEPEN) {
- MGA_WRITE(MGA_ICLEAR, MGA_VLINEICLR);
-- atomic_inc(&dev_priv->vbl_received);
-+ atomic_inc_unchecked(&dev_priv->vbl_received);
- drm_handle_vblank(dev, 0);
- handled = 1;
- }
-@@ -80,7 +80,7 @@ irqreturn_t mga_driver_irq_handler(DRM_IRQ_ARGS)
- MGA_WRITE(MGA_PRIMEND, prim_end);
- }
-
-- atomic_inc(&dev_priv->last_fence_retired);
-+ atomic_inc_unchecked(&dev_priv->last_fence_retired);
- DRM_WAKEUP(&dev_priv->fence_queue);
- handled = 1;
- }
-@@ -131,7 +131,7 @@ int mga_driver_fence_wait(struct drm_device * dev, unsigned int *sequence)
- * using fences.
- */
- DRM_WAIT_ON(ret, dev_priv->fence_queue, 3 * DRM_HZ,
-- (((cur_fence = atomic_read(&dev_priv->last_fence_retired))
-+ (((cur_fence = atomic_read_unchecked(&dev_priv->last_fence_retired))
- - *sequence) <= (1 << 23)));
-
- *sequence = cur_fence;
-diff --git a/drivers/gpu/drm/r128/r128_cce.c b/drivers/gpu/drm/r128/r128_cce.c
-index 4c39a40..b22a9ea 100644
---- a/drivers/gpu/drm/r128/r128_cce.c
-+++ b/drivers/gpu/drm/r128/r128_cce.c
-@@ -377,7 +377,7 @@ static int r128_do_init_cce(struct drm_device * dev, drm_r128_init_t * init)
-
- /* GH: Simple idle check.
- */
-- atomic_set(&dev_priv->idle_count, 0);
-+ atomic_set_unchecked(&dev_priv->idle_count, 0);
-
- /* We don't support anything other than bus-mastering ring mode,
- * but the ring can be in either AGP or PCI space for the ring
-diff --git a/drivers/gpu/drm/r128/r128_drv.h b/drivers/gpu/drm/r128/r128_drv.h
-index 3c60829..4faf484 100644
---- a/drivers/gpu/drm/r128/r128_drv.h
-+++ b/drivers/gpu/drm/r128/r128_drv.h
-@@ -90,14 +90,14 @@ typedef struct drm_r128_private {
- int is_pci;
- unsigned long cce_buffers_offset;
-
-- atomic_t idle_count;
-+ atomic_unchecked_t idle_count;
-
- int page_flipping;
- int current_page;
- u32 crtc_offset;
- u32 crtc_offset_cntl;
-
-- atomic_t vbl_received;
-+ atomic_unchecked_t vbl_received;
-
- u32 color_fmt;
- unsigned int front_offset;
-diff --git a/drivers/gpu/drm/r128/r128_irq.c b/drivers/gpu/drm/r128/r128_irq.c
-index 69810fb..97bf17a 100644
---- a/drivers/gpu/drm/r128/r128_irq.c
-+++ b/drivers/gpu/drm/r128/r128_irq.c
-@@ -42,7 +42,7 @@ u32 r128_get_vblank_counter(struct drm_device *dev, int crtc)
- if (crtc != 0)
- return 0;
-
-- return atomic_read(&dev_priv->vbl_received);
-+ return atomic_read_unchecked(&dev_priv->vbl_received);
- }
-
- irqreturn_t r128_driver_irq_handler(DRM_IRQ_ARGS)
-@@ -56,7 +56,7 @@ irqreturn_t r128_driver_irq_handler(DRM_IRQ_ARGS)
- /* VBLANK interrupt */
- if (status & R128_CRTC_VBLANK_INT) {
- R128_WRITE(R128_GEN_INT_STATUS, R128_CRTC_VBLANK_INT_AK);
-- atomic_inc(&dev_priv->vbl_received);
-+ atomic_inc_unchecked(&dev_priv->vbl_received);
- drm_handle_vblank(dev, 0);
- return IRQ_HANDLED;
- }
-diff --git a/drivers/gpu/drm/r128/r128_state.c b/drivers/gpu/drm/r128/r128_state.c
-index af2665c..51922d2 100644
---- a/drivers/gpu/drm/r128/r128_state.c
-+++ b/drivers/gpu/drm/r128/r128_state.c
-@@ -323,10 +323,10 @@ static void r128_clear_box(drm_r128_private_t * dev_priv,
-
- static void r128_cce_performance_boxes(drm_r128_private_t * dev_priv)
- {
-- if (atomic_read(&dev_priv->idle_count) == 0) {
-+ if (atomic_read_unchecked(&dev_priv->idle_count) == 0) {
- r128_clear_box(dev_priv, 64, 4, 8, 8, 0, 255, 0);
- } else {
-- atomic_set(&dev_priv->idle_count, 0);
-+ atomic_set_unchecked(&dev_priv->idle_count, 0);
- }
- }
-
-diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
-index dd72b91..8644b3c 100644
---- a/drivers/gpu/drm/radeon/atom.c
-+++ b/drivers/gpu/drm/radeon/atom.c
-@@ -1115,6 +1115,8 @@ struct atom_context *atom_parse(struct card_info *card, void *bios)
- char name[512];
- int i;
-
-+ pax_track_stack();
-+
- ctx->card = card;
- ctx->bios = bios;
-
-diff --git a/drivers/gpu/drm/radeon/mkregtable.c b/drivers/gpu/drm/radeon/mkregtable.c
-index 0d79577..efaa7a5 100644
---- a/drivers/gpu/drm/radeon/mkregtable.c
-+++ b/drivers/gpu/drm/radeon/mkregtable.c
-@@ -637,14 +637,14 @@ static int parser_auth(struct table *t, const char *filename)
- regex_t mask_rex;
- regmatch_t match[4];
- char buf[1024];
-- size_t end;
-+ long end;
- int len;
- int done = 0;
- int r;
- unsigned o;
- struct offset *offset;
- char last_reg_s[10];
-- int last_reg;
-+ unsigned long last_reg;
-
- if (regcomp
- (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
-diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
-index a2ae151..0017d7b 100644
---- a/drivers/gpu/drm/radeon/r100.c
-+++ b/drivers/gpu/drm/radeon/r100.c
-@@ -89,8 +89,10 @@ int r100_pci_gart_init(struct radeon_device *rdev)
- if (r)
- return r;
- rdev->gart.table_size = rdev->gart.num_gpu_pages * 4;
-- rdev->asic->gart_tlb_flush = &r100_pci_gart_tlb_flush;
-- rdev->asic->gart_set_page = &r100_pci_gart_set_page;
-+ pax_open_kernel();
-+ *(void **)&rdev->asic->gart_tlb_flush = &r100_pci_gart_tlb_flush;
-+ *(void **)&rdev->asic->gart_set_page = &r100_pci_gart_set_page;
-+ pax_close_kernel();
- return radeon_gart_table_ram_alloc(rdev);
- }
-
-diff --git a/drivers/gpu/drm/radeon/r300.c b/drivers/gpu/drm/radeon/r300.c
-index d8c4f72..20936ed 100644
---- a/drivers/gpu/drm/radeon/r300.c
-+++ b/drivers/gpu/drm/radeon/r300.c
-@@ -91,8 +91,10 @@ int rv370_pcie_gart_init(struct radeon_device *rdev)
- if (r)
- DRM_ERROR("Failed to register debugfs file for PCIE gart !\n");
- rdev->gart.table_size = rdev->gart.num_gpu_pages * 4;
-- rdev->asic->gart_tlb_flush = &rv370_pcie_gart_tlb_flush;
-- rdev->asic->gart_set_page = &rv370_pcie_gart_set_page;
-+ pax_open_kernel();
-+ *(void **)&rdev->asic->gart_tlb_flush = &rv370_pcie_gart_tlb_flush;
-+ *(void **)&rdev->asic->gart_set_page = &rv370_pcie_gart_set_page;
-+ pax_close_kernel();
- return radeon_gart_table_vram_alloc(rdev);
- }
-
-diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
-index 6735213..c6ca8e6 100644
---- a/drivers/gpu/drm/radeon/radeon.h
-+++ b/drivers/gpu/drm/radeon/radeon.h
-@@ -149,7 +149,7 @@ int radeon_pm_init(struct radeon_device *rdev);
- */
- struct radeon_fence_driver {
- uint32_t scratch_reg;
-- atomic_t seq;
-+ atomic_unchecked_t seq;
- uint32_t last_seq;
- unsigned long count_timeout;
- wait_queue_head_t queue;
-diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
-index 4e928b9..d8b6008 100644
---- a/drivers/gpu/drm/radeon/radeon_atombios.c
-+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
-@@ -275,6 +275,8 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev)
- bool linkb;
- struct radeon_i2c_bus_rec ddc_bus;
-
-+ pax_track_stack();
-+
- atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset);
-
- if (data_offset == 0)
-@@ -520,13 +522,13 @@ static uint16_t atombios_get_connector_object_id(struct drm_device *dev,
- }
- }
-
--struct bios_connector {
-+static struct bios_connector {
- bool valid;
- uint16_t line_mux;
- uint16_t devices;
- int connector_type;
- struct radeon_i2c_bus_rec ddc_bus;
--};
-+} bios_connectors[ATOM_MAX_SUPPORTED_DEVICE];
-
- bool radeon_get_atom_connector_info_from_supported_devices_table(struct
- drm_device
-@@ -542,7 +544,6 @@ bool radeon_get_atom_connector_info_from_supported_devices_table(struct
- uint8_t dac;
- union atom_supported_devices *supported_devices;
- int i, j;
-- struct bios_connector bios_connectors[ATOM_MAX_SUPPORTED_DEVICE];
-
- atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset);
-
-diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
-index 3db54e9..ccfa400 100644
---- a/drivers/gpu/drm/radeon/radeon_device.c
-+++ b/drivers/gpu/drm/radeon/radeon_device.c
-@@ -322,8 +322,10 @@ int radeon_asic_init(struct radeon_device *rdev)
- case CHIP_RV380:
- rdev->asic = &r300_asic;
- if (rdev->flags & RADEON_IS_PCIE) {
-- rdev->asic->gart_tlb_flush = &rv370_pcie_gart_tlb_flush;
-- rdev->asic->gart_set_page = &rv370_pcie_gart_set_page;
-+ pax_open_kernel();
-+ *(void **)&rdev->asic->gart_tlb_flush = &rv370_pcie_gart_tlb_flush;
-+ *(void **)&rdev->asic->gart_set_page = &rv370_pcie_gart_set_page;
-+ pax_close_kernel();
- }
- break;
- case CHIP_R420:
-@@ -506,13 +508,17 @@ void radeon_agp_disable(struct radeon_device *rdev)
- rdev->family == CHIP_R423) {
- DRM_INFO("Forcing AGP to PCIE mode\n");
- rdev->flags |= RADEON_IS_PCIE;
-- rdev->asic->gart_tlb_flush = &rv370_pcie_gart_tlb_flush;
-- rdev->asic->gart_set_page = &rv370_pcie_gart_set_page;
-+ pax_open_kernel();
-+ *(void **)&rdev->asic->gart_tlb_flush = &rv370_pcie_gart_tlb_flush;
-+ *(void **)&rdev->asic->gart_set_page = &rv370_pcie_gart_set_page;
-+ pax_close_kernel();
- } else {
- DRM_INFO("Forcing AGP to PCI mode\n");
- rdev->flags |= RADEON_IS_PCI;
-- rdev->asic->gart_tlb_flush = &r100_pci_gart_tlb_flush;
-- rdev->asic->gart_set_page = &r100_pci_gart_set_page;
-+ pax_open_kernel();
-+ *(void **)&rdev->asic->gart_tlb_flush = &r100_pci_gart_tlb_flush;
-+ *(void **)&rdev->asic->gart_set_page = &r100_pci_gart_set_page;
-+ pax_close_kernel();
- }
- }
-
-diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
-index 083a181..ccccae0 100644
---- a/drivers/gpu/drm/radeon/radeon_display.c
-+++ b/drivers/gpu/drm/radeon/radeon_display.c
-@@ -482,7 +482,7 @@ void radeon_compute_pll(struct radeon_pll *pll,
-
- if (flags & RADEON_PLL_PREFER_CLOSEST_LOWER) {
- error = freq - current_freq;
-- error = error < 0 ? 0xffffffff : error;
-+ error = (int32_t)error < 0 ? 0xffffffff : error;
- } else
- error = abs(current_freq - freq);
- vco_diff = abs(vco - best_vco);
-diff --git a/drivers/gpu/drm/radeon/radeon_drv.h b/drivers/gpu/drm/radeon/radeon_drv.h
-index 76e4070..193fa7f 100644
---- a/drivers/gpu/drm/radeon/radeon_drv.h
-+++ b/drivers/gpu/drm/radeon/radeon_drv.h
-@@ -253,7 +253,7 @@ typedef struct drm_radeon_private {
-
- /* SW interrupt */
- wait_queue_head_t swi_queue;
-- atomic_t swi_emitted;
-+ atomic_unchecked_t swi_emitted;
- int vblank_crtc;
- uint32_t irq_enable_reg;
- uint32_t r500_disp_irq_reg;
-diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
-index 3beb26d..6ce9c4a 100644
---- a/drivers/gpu/drm/radeon/radeon_fence.c
-+++ b/drivers/gpu/drm/radeon/radeon_fence.c
-@@ -47,7 +47,7 @@ int radeon_fence_emit(struct radeon_device *rdev, struct radeon_fence *fence)
- write_unlock_irqrestore(&rdev->fence_drv.lock, irq_flags);
- return 0;
- }
-- fence->seq = atomic_add_return(1, &rdev->fence_drv.seq);
-+ fence->seq = atomic_add_return_unchecked(1, &rdev->fence_drv.seq);
- if (!rdev->cp.ready) {
- /* FIXME: cp is not running assume everythings is done right
- * away
-@@ -364,7 +364,7 @@ int radeon_fence_driver_init(struct radeon_device *rdev)
- return r;
- }
- WREG32(rdev->fence_drv.scratch_reg, 0);
-- atomic_set(&rdev->fence_drv.seq, 0);
-+ atomic_set_unchecked(&rdev->fence_drv.seq, 0);
- INIT_LIST_HEAD(&rdev->fence_drv.created);
- INIT_LIST_HEAD(&rdev->fence_drv.emited);
- INIT_LIST_HEAD(&rdev->fence_drv.signaled);
-diff --git a/drivers/gpu/drm/radeon/radeon_ioc32.c b/drivers/gpu/drm/radeon/radeon_ioc32.c
-index a1bf11de..4a123c0 100644
---- a/drivers/gpu/drm/radeon/radeon_ioc32.c
-+++ b/drivers/gpu/drm/radeon/radeon_ioc32.c
-@@ -368,7 +368,7 @@ static int compat_radeon_cp_setparam(struct file *file, unsigned int cmd,
- request = compat_alloc_user_space(sizeof(*request));
- if (!access_ok(VERIFY_WRITE, request, sizeof(*request))
- || __put_user(req32.param, &request->param)
-- || __put_user((void __user *)(unsigned long)req32.value,
-+ || __put_user((unsigned long)req32.value,
- &request->value))
- return -EFAULT;
-
-diff --git a/drivers/gpu/drm/radeon/radeon_irq.c b/drivers/gpu/drm/radeon/radeon_irq.c
-index b79ecc4..8dab92d 100644
---- a/drivers/gpu/drm/radeon/radeon_irq.c
-+++ b/drivers/gpu/drm/radeon/radeon_irq.c
-@@ -225,8 +225,8 @@ static int radeon_emit_irq(struct drm_device * dev)
- unsigned int ret;
- RING_LOCALS;
-
-- atomic_inc(&dev_priv->swi_emitted);
-- ret = atomic_read(&dev_priv->swi_emitted);
-+ atomic_inc_unchecked(&dev_priv->swi_emitted);
-+ ret = atomic_read_unchecked(&dev_priv->swi_emitted);
-
- BEGIN_RING(4);
- OUT_RING_REG(RADEON_LAST_SWI_REG, ret);
-@@ -352,7 +352,7 @@ int radeon_driver_irq_postinstall(struct drm_device *dev)
- drm_radeon_private_t *dev_priv =
- (drm_radeon_private_t *) dev->dev_private;
-
-- atomic_set(&dev_priv->swi_emitted, 0);
-+ atomic_set_unchecked(&dev_priv->swi_emitted, 0);
- DRM_INIT_WAITQUEUE(&dev_priv->swi_queue);
-
- dev->max_vblank_count = 0x001fffff;
-diff --git a/drivers/gpu/drm/radeon/radeon_state.c b/drivers/gpu/drm/radeon/radeon_state.c
-index 4747910..48ca4b3 100644
---- a/drivers/gpu/drm/radeon/radeon_state.c
-+++ b/drivers/gpu/drm/radeon/radeon_state.c
-@@ -3021,7 +3021,7 @@ static int radeon_cp_getparam(struct drm_device *dev, void *data, struct drm_fil
- {
- drm_radeon_private_t *dev_priv = dev->dev_private;
- drm_radeon_getparam_t *param = data;
-- int value;
-+ int value = 0;
-
- DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
-
-diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
-index 1381e06..0e53b17 100644
---- a/drivers/gpu/drm/radeon/radeon_ttm.c
-+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
-@@ -535,27 +535,10 @@ void radeon_ttm_fini(struct radeon_device *rdev)
- DRM_INFO("radeon: ttm finalized\n");
- }
-
--static struct vm_operations_struct radeon_ttm_vm_ops;
--static const struct vm_operations_struct *ttm_vm_ops = NULL;
--
--static int radeon_ttm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
--{
-- struct ttm_buffer_object *bo;
-- int r;
--
-- bo = (struct ttm_buffer_object *)vma->vm_private_data;
-- if (bo == NULL) {
-- return VM_FAULT_NOPAGE;
-- }
-- r = ttm_vm_ops->fault(vma, vmf);
-- return r;
--}
--
- int radeon_mmap(struct file *filp, struct vm_area_struct *vma)
- {
- struct drm_file *file_priv;
- struct radeon_device *rdev;
-- int r;
-
- if (unlikely(vma->vm_pgoff < DRM_FILE_PAGE_OFFSET)) {
- return drm_mmap(filp, vma);
-@@ -563,20 +546,9 @@ int radeon_mmap(struct file *filp, struct vm_area_struct *vma)
-
- file_priv = (struct drm_file *)filp->private_data;
- rdev = file_priv->minor->dev->dev_private;
-- if (rdev == NULL) {
-+ if (!rdev)
- return -EINVAL;
-- }
-- r = ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
-- if (unlikely(r != 0)) {
-- return r;
-- }
-- if (unlikely(ttm_vm_ops == NULL)) {
-- ttm_vm_ops = vma->vm_ops;
-- radeon_ttm_vm_ops = *ttm_vm_ops;
-- radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
-- }
-- vma->vm_ops = &radeon_ttm_vm_ops;
-- return 0;
-+ return ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
- }
-
-
-diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
-index b12ff76..0bd0c6e 100644
---- a/drivers/gpu/drm/radeon/rs690.c
-+++ b/drivers/gpu/drm/radeon/rs690.c
-@@ -302,9 +302,11 @@ void rs690_crtc_bandwidth_compute(struct radeon_device *rdev,
- if (rdev->pm.max_bandwidth.full > rdev->pm.sideport_bandwidth.full &&
- rdev->pm.sideport_bandwidth.full)
- rdev->pm.max_bandwidth = rdev->pm.sideport_bandwidth;
-- read_delay_latency.full = rfixed_const(370 * 800 * 1000);
-+ read_delay_latency.full = rfixed_const(800 * 1000);
- read_delay_latency.full = rfixed_div(read_delay_latency,
- rdev->pm.igp_sideport_mclk);
-+ a.full = rfixed_const(370);
-+ read_delay_latency.full = rfixed_mul(read_delay_latency, a);
- } else {
- if (rdev->pm.max_bandwidth.full > rdev->pm.k8_bandwidth.full &&
- rdev->pm.k8_bandwidth.full)
-diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
-index 0ed436e..e6e7ce3 100644
---- a/drivers/gpu/drm/ttm/ttm_bo.c
-+++ b/drivers/gpu/drm/ttm/ttm_bo.c
-@@ -67,7 +67,7 @@ static struct attribute *ttm_bo_global_attrs[] = {
- NULL
- };
-
--static struct sysfs_ops ttm_bo_global_ops = {
-+static const struct sysfs_ops ttm_bo_global_ops = {
- .show = &ttm_bo_global_show
- };
-
-diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
-index 1c040d0..f9e4af8 100644
---- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
-+++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
-@@ -73,7 +73,7 @@ static int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
- {
- struct ttm_buffer_object *bo = (struct ttm_buffer_object *)
- vma->vm_private_data;
-- struct ttm_bo_device *bdev = bo->bdev;
-+ struct ttm_bo_device *bdev;
- unsigned long bus_base;
- unsigned long bus_offset;
- unsigned long bus_size;
-@@ -88,6 +88,10 @@ static int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
- unsigned long address = (unsigned long)vmf->virtual_address;
- int retval = VM_FAULT_NOPAGE;
-
-+ if (!bo)
-+ return VM_FAULT_NOPAGE;
-+ bdev = bo->bdev;
-+
- /*
- * Work around locking order reversal in fault / nopfn
- * between mmap_sem and bo_reserve: Perform a trylock operation
-diff --git a/drivers/gpu/drm/ttm/ttm_global.c b/drivers/gpu/drm/ttm/ttm_global.c
-index b170071..28ae90e 100644
---- a/drivers/gpu/drm/ttm/ttm_global.c
-+++ b/drivers/gpu/drm/ttm/ttm_global.c
-@@ -36,7 +36,7 @@
- struct ttm_global_item {
- struct mutex mutex;
- void *object;
-- int refcount;
-+ atomic_t refcount;
- };
-
- static struct ttm_global_item glob[TTM_GLOBAL_NUM];
-@@ -49,7 +49,7 @@ void ttm_global_init(void)
- struct ttm_global_item *item = &glob[i];
- mutex_init(&item->mutex);
- item->object = NULL;
-- item->refcount = 0;
-+ atomic_set(&item->refcount, 0);
- }
- }
-
-@@ -59,7 +59,7 @@ void ttm_global_release(void)
- for (i = 0; i < TTM_GLOBAL_NUM; ++i) {
- struct ttm_global_item *item = &glob[i];
- BUG_ON(item->object != NULL);
-- BUG_ON(item->refcount != 0);
-+ BUG_ON(atomic_read(&item->refcount) != 0);
- }
- }
-
-@@ -70,7 +70,7 @@ int ttm_global_item_ref(struct ttm_global_reference *ref)
- void *object;
-
- mutex_lock(&item->mutex);
-- if (item->refcount == 0) {
-+ if (atomic_read(&item->refcount) == 0) {
- item->object = kzalloc(ref->size, GFP_KERNEL);
- if (unlikely(item->object == NULL)) {
- ret = -ENOMEM;
-@@ -83,7 +83,7 @@ int ttm_global_item_ref(struct ttm_global_reference *ref)
- goto out_err;
-
- }
-- ++item->refcount;
-+ atomic_inc(&item->refcount);
- ref->object = item->object;
- object = item->object;
- mutex_unlock(&item->mutex);
-@@ -100,9 +100,9 @@ void ttm_global_item_unref(struct ttm_global_reference *ref)
- struct ttm_global_item *item = &glob[ref->global_type];
-
- mutex_lock(&item->mutex);
-- BUG_ON(item->refcount == 0);
-+ BUG_ON(atomic_read(&item->refcount) == 0);
- BUG_ON(ref->object != item->object);
-- if (--item->refcount == 0) {
-+ if (atomic_dec_and_test(&item->refcount)) {
- ref->release(ref);
- item->object = NULL;
- }
-diff --git a/drivers/gpu/drm/ttm/ttm_memory.c b/drivers/gpu/drm/ttm/ttm_memory.c
-index 072c281a..d8ef483 100644
---- a/drivers/gpu/drm/ttm/ttm_memory.c
-+++ b/drivers/gpu/drm/ttm/ttm_memory.c
-@@ -152,7 +152,7 @@ static struct attribute *ttm_mem_zone_attrs[] = {
- NULL
- };
-
--static struct sysfs_ops ttm_mem_zone_ops = {
-+static const struct sysfs_ops ttm_mem_zone_ops = {
- .show = &ttm_mem_zone_show,
- .store = &ttm_mem_zone_store
- };
-diff --git a/drivers/gpu/drm/via/via_drv.h b/drivers/gpu/drm/via/via_drv.h
-index cafcb84..b8e66cc 100644
---- a/drivers/gpu/drm/via/via_drv.h
-+++ b/drivers/gpu/drm/via/via_drv.h
-@@ -51,7 +51,7 @@ typedef struct drm_via_ring_buffer {
- typedef uint32_t maskarray_t[5];
-
- typedef struct drm_via_irq {
-- atomic_t irq_received;
-+ atomic_unchecked_t irq_received;
- uint32_t pending_mask;
- uint32_t enable_mask;
- wait_queue_head_t irq_queue;
-@@ -75,7 +75,7 @@ typedef struct drm_via_private {
- struct timeval last_vblank;
- int last_vblank_valid;
- unsigned usec_per_vblank;
-- atomic_t vbl_received;
-+ atomic_unchecked_t vbl_received;
- drm_via_state_t hc_state;
- char pci_buf[VIA_PCI_BUF_SIZE];
- const uint32_t *fire_offsets[VIA_FIRE_BUF_SIZE];
-diff --git a/drivers/gpu/drm/via/via_irq.c b/drivers/gpu/drm/via/via_irq.c
-index 5935b88..127a8a6 100644
---- a/drivers/gpu/drm/via/via_irq.c
-+++ b/drivers/gpu/drm/via/via_irq.c
-@@ -102,7 +102,7 @@ u32 via_get_vblank_counter(struct drm_device *dev, int crtc)
- if (crtc != 0)
- return 0;
-
-- return atomic_read(&dev_priv->vbl_received);
-+ return atomic_read_unchecked(&dev_priv->vbl_received);
- }
-
- irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
-@@ -117,8 +117,8 @@ irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
-
- status = VIA_READ(VIA_REG_INTERRUPT);
- if (status & VIA_IRQ_VBLANK_PENDING) {
-- atomic_inc(&dev_priv->vbl_received);
-- if (!(atomic_read(&dev_priv->vbl_received) & 0x0F)) {
-+ atomic_inc_unchecked(&dev_priv->vbl_received);
-+ if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0x0F)) {
- do_gettimeofday(&cur_vblank);
- if (dev_priv->last_vblank_valid) {
- dev_priv->usec_per_vblank =
-@@ -128,7 +128,7 @@ irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
- dev_priv->last_vblank = cur_vblank;
- dev_priv->last_vblank_valid = 1;
- }
-- if (!(atomic_read(&dev_priv->vbl_received) & 0xFF)) {
-+ if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0xFF)) {
- DRM_DEBUG("US per vblank is: %u\n",
- dev_priv->usec_per_vblank);
- }
-@@ -138,7 +138,7 @@ irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
-
- for (i = 0; i < dev_priv->num_irqs; ++i) {
- if (status & cur_irq->pending_mask) {
-- atomic_inc(&cur_irq->irq_received);
-+ atomic_inc_unchecked(&cur_irq->irq_received);
- DRM_WAKEUP(&cur_irq->irq_queue);
- handled = 1;
- if (dev_priv->irq_map[drm_via_irq_dma0_td] == i) {
-@@ -244,11 +244,11 @@ via_driver_irq_wait(struct drm_device * dev, unsigned int irq, int force_sequenc
- DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
- ((VIA_READ(masks[irq][2]) & masks[irq][3]) ==
- masks[irq][4]));
-- cur_irq_sequence = atomic_read(&cur_irq->irq_received);
-+ cur_irq_sequence = atomic_read_unchecked(&cur_irq->irq_received);
- } else {
- DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
- (((cur_irq_sequence =
-- atomic_read(&cur_irq->irq_received)) -
-+ atomic_read_unchecked(&cur_irq->irq_received)) -
- *sequence) <= (1 << 23)));
- }
- *sequence = cur_irq_sequence;
-@@ -286,7 +286,7 @@ void via_driver_irq_preinstall(struct drm_device * dev)
- }
-
- for (i = 0; i < dev_priv->num_irqs; ++i) {
-- atomic_set(&cur_irq->irq_received, 0);
-+ atomic_set_unchecked(&cur_irq->irq_received, 0);
- cur_irq->enable_mask = dev_priv->irq_masks[i][0];
- cur_irq->pending_mask = dev_priv->irq_masks[i][1];
- DRM_INIT_WAITQUEUE(&cur_irq->irq_queue);
-@@ -368,7 +368,7 @@ int via_wait_irq(struct drm_device *dev, void *data, struct drm_file *file_priv)
- switch (irqwait->request.type & ~VIA_IRQ_FLAGS_MASK) {
- case VIA_IRQ_RELATIVE:
- irqwait->request.sequence +=
-- atomic_read(&cur_irq->irq_received);
-+ atomic_read_unchecked(&cur_irq->irq_received);
- irqwait->request.type &= ~_DRM_VBLANK_RELATIVE;
- case VIA_IRQ_ABSOLUTE:
- break;
-diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c
-index aa8688d..6a0140c 100644
---- a/drivers/gpu/vga/vgaarb.c
-+++ b/drivers/gpu/vga/vgaarb.c
-@@ -894,14 +894,20 @@ static ssize_t vga_arb_write(struct file *file, const char __user * buf,
- uc = &priv->cards[i];
- }
-
-- if (!uc)
-- return -EINVAL;
-+ if (!uc) {
-+ ret_val = -EINVAL;
-+ goto done;
-+ }
-
-- if (io_state & VGA_RSRC_LEGACY_IO && uc->io_cnt == 0)
-- return -EINVAL;
-+ if (io_state & VGA_RSRC_LEGACY_IO && uc->io_cnt == 0) {
-+ ret_val = -EINVAL;
-+ goto done;
-+ }
-
-- if (io_state & VGA_RSRC_LEGACY_MEM && uc->mem_cnt == 0)
-- return -EINVAL;
-+ if (io_state & VGA_RSRC_LEGACY_MEM && uc->mem_cnt == 0) {
-+ ret_val = -EINVAL;
-+ goto done;
-+ }
-
- vga_put(pdev, io_state);
-
-diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
-index 11f8069..4783396 100644
---- a/drivers/hid/hid-core.c
-+++ b/drivers/hid/hid-core.c
-@@ -1752,7 +1752,7 @@ static bool hid_ignore(struct hid_device *hdev)
-
- int hid_add_device(struct hid_device *hdev)
- {
-- static atomic_t id = ATOMIC_INIT(0);
-+ static atomic_unchecked_t id = ATOMIC_INIT(0);
- int ret;
-
- if (WARN_ON(hdev->status & HID_STAT_ADDED))
-@@ -1766,7 +1766,7 @@ int hid_add_device(struct hid_device *hdev)
- /* XXX hack, any other cleaner solution after the driver core
- * is converted to allow more than 20 bytes as the device name? */
- dev_set_name(&hdev->dev, "%04X:%04X:%04X.%04X", hdev->bus,
-- hdev->vendor, hdev->product, atomic_inc_return(&id));
-+ hdev->vendor, hdev->product, atomic_inc_return_unchecked(&id));
-
- ret = device_add(&hdev->dev);
- if (!ret)
-diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
-index 8b6ee24..70f657d 100644
---- a/drivers/hid/usbhid/hiddev.c
-+++ b/drivers/hid/usbhid/hiddev.c
-@@ -617,7 +617,7 @@ static long hiddev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
- return put_user(HID_VERSION, (int __user *)arg);
-
- case HIDIOCAPPLICATION:
-- if (arg < 0 || arg >= hid->maxapplication)
-+ if (arg >= hid->maxapplication)
- return -EINVAL;
-
- for (i = 0; i < hid->maxcollection; i++)
-diff --git a/drivers/hwmon/lis3lv02d.c b/drivers/hwmon/lis3lv02d.c
-index 5d5ed69..f40533e 100644
---- a/drivers/hwmon/lis3lv02d.c
-+++ b/drivers/hwmon/lis3lv02d.c
-@@ -146,7 +146,7 @@ static irqreturn_t lis302dl_interrupt(int irq, void *dummy)
- * the lid is closed. This leads to interrupts as soon as a little move
- * is done.
- */
-- atomic_inc(&lis3_dev.count);
-+ atomic_inc_unchecked(&lis3_dev.count);
-
- wake_up_interruptible(&lis3_dev.misc_wait);
- kill_fasync(&lis3_dev.async_queue, SIGIO, POLL_IN);
-@@ -160,7 +160,7 @@ static int lis3lv02d_misc_open(struct inode *inode, struct file *file)
- if (test_and_set_bit(0, &lis3_dev.misc_opened))
- return -EBUSY; /* already open */
-
-- atomic_set(&lis3_dev.count, 0);
-+ atomic_set_unchecked(&lis3_dev.count, 0);
-
- /*
- * The sensor can generate interrupts for free-fall and direction
-@@ -206,7 +206,7 @@ static ssize_t lis3lv02d_misc_read(struct file *file, char __user *buf,
- add_wait_queue(&lis3_dev.misc_wait, &wait);
- while (true) {
- set_current_state(TASK_INTERRUPTIBLE);
-- data = atomic_xchg(&lis3_dev.count, 0);
-+ data = atomic_xchg_unchecked(&lis3_dev.count, 0);
- if (data)
- break;
-
-@@ -244,7 +244,7 @@ out:
- static unsigned int lis3lv02d_misc_poll(struct file *file, poll_table *wait)
- {
- poll_wait(file, &lis3_dev.misc_wait, wait);
-- if (atomic_read(&lis3_dev.count))
-+ if (atomic_read_unchecked(&lis3_dev.count))
- return POLLIN | POLLRDNORM;
- return 0;
- }
-diff --git a/drivers/hwmon/lis3lv02d.h b/drivers/hwmon/lis3lv02d.h
-index 7cdd76f..fe0efdf 100644
---- a/drivers/hwmon/lis3lv02d.h
-+++ b/drivers/hwmon/lis3lv02d.h
-@@ -201,7 +201,7 @@ struct lis3lv02d {
-
- struct input_polled_dev *idev; /* input device */
- struct platform_device *pdev; /* platform device */
-- atomic_t count; /* interrupt count after last read */
-+ atomic_unchecked_t count; /* interrupt count after last read */
- int xcalib; /* calibrated null value for x */
- int ycalib; /* calibrated null value for y */
- int zcalib; /* calibrated null value for z */
-diff --git a/drivers/hwmon/sht15.c b/drivers/hwmon/sht15.c
-index 740785e..5a5c6c6 100644
---- a/drivers/hwmon/sht15.c
-+++ b/drivers/hwmon/sht15.c
-@@ -112,7 +112,7 @@ struct sht15_data {
- int supply_uV;
- int supply_uV_valid;
- struct work_struct update_supply_work;
-- atomic_t interrupt_handled;
-+ atomic_unchecked_t interrupt_handled;
- };
-
- /**
-@@ -245,13 +245,13 @@ static inline int sht15_update_single_val(struct sht15_data *data,
- return ret;
-
- gpio_direction_input(data->pdata->gpio_data);
-- atomic_set(&data->interrupt_handled, 0);
-+ atomic_set_unchecked(&data->interrupt_handled, 0);
-
- enable_irq(gpio_to_irq(data->pdata->gpio_data));
- if (gpio_get_value(data->pdata->gpio_data) == 0) {
- disable_irq_nosync(gpio_to_irq(data->pdata->gpio_data));
- /* Only relevant if the interrupt hasn't occured. */
-- if (!atomic_read(&data->interrupt_handled))
-+ if (!atomic_read_unchecked(&data->interrupt_handled))
- schedule_work(&data->read_work);
- }
- ret = wait_event_timeout(data->wait_queue,
-@@ -398,7 +398,7 @@ static irqreturn_t sht15_interrupt_fired(int irq, void *d)
- struct sht15_data *data = d;
- /* First disable the interrupt */
- disable_irq_nosync(irq);
-- atomic_inc(&data->interrupt_handled);
-+ atomic_inc_unchecked(&data->interrupt_handled);
- /* Then schedule a reading work struct */
- if (data->flag != SHT15_READING_NOTHING)
- schedule_work(&data->read_work);
-@@ -449,11 +449,11 @@ static void sht15_bh_read_data(struct work_struct *work_s)
- here as could have gone low in meantime so verify
- it hasn't!
- */
-- atomic_set(&data->interrupt_handled, 0);
-+ atomic_set_unchecked(&data->interrupt_handled, 0);
- enable_irq(gpio_to_irq(data->pdata->gpio_data));
- /* If still not occured or another handler has been scheduled */
- if (gpio_get_value(data->pdata->gpio_data)
-- || atomic_read(&data->interrupt_handled))
-+ || atomic_read_unchecked(&data->interrupt_handled))
- return;
- }
- /* Read the data back from the device */
-diff --git a/drivers/hwmon/w83791d.c b/drivers/hwmon/w83791d.c
-index 97851c5..cb40626 100644
---- a/drivers/hwmon/w83791d.c
-+++ b/drivers/hwmon/w83791d.c
-@@ -330,8 +330,8 @@ static int w83791d_detect(struct i2c_client *client, int kind,
- struct i2c_board_info *info);
- static int w83791d_remove(struct i2c_client *client);
-
--static int w83791d_read(struct i2c_client *client, u8 register);
--static int w83791d_write(struct i2c_client *client, u8 register, u8 value);
-+static int w83791d_read(struct i2c_client *client, u8 reg);
-+static int w83791d_write(struct i2c_client *client, u8 reg, u8 value);
- static struct w83791d_data *w83791d_update_device(struct device *dev);
-
- #ifdef DEBUG
-diff --git a/drivers/i2c/busses/i2c-amd756-s4882.c b/drivers/i2c/busses/i2c-amd756-s4882.c
-index 378fcb5..5e91fa8 100644
---- a/drivers/i2c/busses/i2c-amd756-s4882.c
-+++ b/drivers/i2c/busses/i2c-amd756-s4882.c
-@@ -43,7 +43,7 @@
- extern struct i2c_adapter amd756_smbus;
-
- static struct i2c_adapter *s4882_adapter;
--static struct i2c_algorithm *s4882_algo;
-+static i2c_algorithm_no_const *s4882_algo;
-
- /* Wrapper access functions for multiplexed SMBus */
- static DEFINE_MUTEX(amd756_lock);
-diff --git a/drivers/i2c/busses/i2c-nforce2-s4985.c b/drivers/i2c/busses/i2c-nforce2-s4985.c
-index 29015eb..af2d8e9 100644
---- a/drivers/i2c/busses/i2c-nforce2-s4985.c
-+++ b/drivers/i2c/busses/i2c-nforce2-s4985.c
-@@ -41,7 +41,7 @@
- extern struct i2c_adapter *nforce2_smbus;
-
- static struct i2c_adapter *s4985_adapter;
--static struct i2c_algorithm *s4985_algo;
-+static i2c_algorithm_no_const *s4985_algo;
-
- /* Wrapper access functions for multiplexed SMBus */
- static DEFINE_MUTEX(nforce2_lock);
-diff --git a/drivers/ide/aec62xx.c b/drivers/ide/aec62xx.c
-index 878f8ec..12376fc 100644
---- a/drivers/ide/aec62xx.c
-+++ b/drivers/ide/aec62xx.c
-@@ -180,7 +180,7 @@ static const struct ide_port_ops atp86x_port_ops = {
- .cable_detect = atp86x_cable_detect,
- };
-
--static const struct ide_port_info aec62xx_chipsets[] __devinitdata = {
-+static const struct ide_port_info aec62xx_chipsets[] __devinitconst = {
- { /* 0: AEC6210 */
- .name = DRV_NAME,
- .init_chipset = init_chipset_aec62xx,
-diff --git a/drivers/ide/alim15x3.c b/drivers/ide/alim15x3.c
-index e59b6de..4b4fc65 100644
---- a/drivers/ide/alim15x3.c
-+++ b/drivers/ide/alim15x3.c
-@@ -509,7 +509,7 @@ static const struct ide_dma_ops ali_dma_ops = {
- .dma_sff_read_status = ide_dma_sff_read_status,
- };
-
--static const struct ide_port_info ali15x3_chipset __devinitdata = {
-+static const struct ide_port_info ali15x3_chipset __devinitconst = {
- .name = DRV_NAME,
- .init_chipset = init_chipset_ali15x3,
- .init_hwif = init_hwif_ali15x3,
-diff --git a/drivers/ide/amd74xx.c b/drivers/ide/amd74xx.c
-index 628cd2e..087a414 100644
---- a/drivers/ide/amd74xx.c
-+++ b/drivers/ide/amd74xx.c
-@@ -221,7 +221,7 @@ static const struct ide_port_ops amd_port_ops = {
- .udma_mask = udma, \
- }
-
--static const struct ide_port_info amd74xx_chipsets[] __devinitdata = {
-+static const struct ide_port_info amd74xx_chipsets[] __devinitconst = {
- /* 0: AMD7401 */ DECLARE_AMD_DEV(0x00, ATA_UDMA2),
- /* 1: AMD7409 */ DECLARE_AMD_DEV(ATA_SWDMA2, ATA_UDMA4),
- /* 2: AMD7411/7441 */ DECLARE_AMD_DEV(ATA_SWDMA2, ATA_UDMA5),
-diff --git a/drivers/ide/atiixp.c b/drivers/ide/atiixp.c
-index 837322b..837fd71 100644
---- a/drivers/ide/atiixp.c
-+++ b/drivers/ide/atiixp.c
-@@ -137,7 +137,7 @@ static const struct ide_port_ops atiixp_port_ops = {
- .cable_detect = atiixp_cable_detect,
- };
-
--static const struct ide_port_info atiixp_pci_info[] __devinitdata = {
-+static const struct ide_port_info atiixp_pci_info[] __devinitconst = {
- { /* 0: IXP200/300/400/700 */
- .name = DRV_NAME,
- .enablebits = {{0x48,0x01,0x00}, {0x48,0x08,0x00}},
-diff --git a/drivers/ide/cmd64x.c b/drivers/ide/cmd64x.c
-index ca0c46f..d55318a 100644
---- a/drivers/ide/cmd64x.c
-+++ b/drivers/ide/cmd64x.c
-@@ -372,7 +372,7 @@ static const struct ide_dma_ops cmd646_rev1_dma_ops = {
- .dma_sff_read_status = ide_dma_sff_read_status,
- };
-
--static const struct ide_port_info cmd64x_chipsets[] __devinitdata = {
-+static const struct ide_port_info cmd64x_chipsets[] __devinitconst = {
- { /* 0: CMD643 */
- .name = DRV_NAME,
- .init_chipset = init_chipset_cmd64x,
-diff --git a/drivers/ide/cs5520.c b/drivers/ide/cs5520.c
-index 09f98ed..cebc5bc 100644
---- a/drivers/ide/cs5520.c
-+++ b/drivers/ide/cs5520.c
-@@ -93,7 +93,7 @@ static const struct ide_port_ops cs5520_port_ops = {
- .set_dma_mode = cs5520_set_dma_mode,
- };
-
--static const struct ide_port_info cyrix_chipset __devinitdata = {
-+static const struct ide_port_info cyrix_chipset __devinitconst = {
- .name = DRV_NAME,
- .enablebits = { { 0x60, 0x01, 0x01 }, { 0x60, 0x02, 0x02 } },
- .port_ops = &cs5520_port_ops,
-diff --git a/drivers/ide/cs5530.c b/drivers/ide/cs5530.c
-index 40bf05e..7d58ca0 100644
---- a/drivers/ide/cs5530.c
-+++ b/drivers/ide/cs5530.c
-@@ -244,7 +244,7 @@ static const struct ide_port_ops cs5530_port_ops = {
- .udma_filter = cs5530_udma_filter,
- };
-
--static const struct ide_port_info cs5530_chipset __devinitdata = {
-+static const struct ide_port_info cs5530_chipset __devinitconst = {
- .name = DRV_NAME,
- .init_chipset = init_chipset_cs5530,
- .init_hwif = init_hwif_cs5530,
-diff --git a/drivers/ide/cs5535.c b/drivers/ide/cs5535.c
-index 983d957..53e6172 100644
---- a/drivers/ide/cs5535.c
-+++ b/drivers/ide/cs5535.c
-@@ -170,7 +170,7 @@ static const struct ide_port_ops cs5535_port_ops = {
- .cable_detect = cs5535_cable_detect,
- };
-
--static const struct ide_port_info cs5535_chipset __devinitdata = {
-+static const struct ide_port_info cs5535_chipset __devinitconst = {
- .name = DRV_NAME,
- .port_ops = &cs5535_port_ops,
- .host_flags = IDE_HFLAG_SINGLE | IDE_HFLAG_POST_SET_MODE,
-diff --git a/drivers/ide/cy82c693.c b/drivers/ide/cy82c693.c
-index 74fc540..8e933d8 100644
---- a/drivers/ide/cy82c693.c
-+++ b/drivers/ide/cy82c693.c
-@@ -288,7 +288,7 @@ static const struct ide_port_ops cy82c693_port_ops = {
- .set_dma_mode = cy82c693_set_dma_mode,
- };
-
--static const struct ide_port_info cy82c693_chipset __devinitdata = {
-+static const struct ide_port_info cy82c693_chipset __devinitconst = {
- .name = DRV_NAME,
- .init_iops = init_iops_cy82c693,
- .port_ops = &cy82c693_port_ops,
-diff --git a/drivers/ide/hpt366.c b/drivers/ide/hpt366.c
-index 7ce68ef..e78197d 100644
---- a/drivers/ide/hpt366.c
-+++ b/drivers/ide/hpt366.c
-@@ -507,7 +507,7 @@ static struct hpt_timings hpt37x_timings = {
- }
- };
-
--static const struct hpt_info hpt36x __devinitdata = {
-+static const struct hpt_info hpt36x __devinitconst = {
- .chip_name = "HPT36x",
- .chip_type = HPT36x,
- .udma_mask = HPT366_ALLOW_ATA66_3 ? (HPT366_ALLOW_ATA66_4 ? ATA_UDMA4 : ATA_UDMA3) : ATA_UDMA2,
-@@ -515,7 +515,7 @@ static const struct hpt_info hpt36x __devinitdata = {
- .timings = &hpt36x_timings
- };
-
--static const struct hpt_info hpt370 __devinitdata = {
-+static const struct hpt_info hpt370 __devinitconst = {
- .chip_name = "HPT370",
- .chip_type = HPT370,
- .udma_mask = HPT370_ALLOW_ATA100_5 ? ATA_UDMA5 : ATA_UDMA4,
-@@ -523,7 +523,7 @@ static const struct hpt_info hpt370 __devinitdata = {
- .timings = &hpt37x_timings
- };
-
--static const struct hpt_info hpt370a __devinitdata = {
-+static const struct hpt_info hpt370a __devinitconst = {
- .chip_name = "HPT370A",
- .chip_type = HPT370A,
- .udma_mask = HPT370_ALLOW_ATA100_5 ? ATA_UDMA5 : ATA_UDMA4,
-@@ -531,7 +531,7 @@ static const struct hpt_info hpt370a __devinitdata = {
- .timings = &hpt37x_timings
- };
-
--static const struct hpt_info hpt374 __devinitdata = {
-+static const struct hpt_info hpt374 __devinitconst = {
- .chip_name = "HPT374",
- .chip_type = HPT374,
- .udma_mask = ATA_UDMA5,
-@@ -539,7 +539,7 @@ static const struct hpt_info hpt374 __devinitdata = {
- .timings = &hpt37x_timings
- };
-
--static const struct hpt_info hpt372 __devinitdata = {
-+static const struct hpt_info hpt372 __devinitconst = {
- .chip_name = "HPT372",
- .chip_type = HPT372,
- .udma_mask = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
-@@ -547,7 +547,7 @@ static const struct hpt_info hpt372 __devinitdata = {
- .timings = &hpt37x_timings
- };
-
--static const struct hpt_info hpt372a __devinitdata = {
-+static const struct hpt_info hpt372a __devinitconst = {
- .chip_name = "HPT372A",
- .chip_type = HPT372A,
- .udma_mask = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
-@@ -555,7 +555,7 @@ static const struct hpt_info hpt372a __devinitdata = {
- .timings = &hpt37x_timings
- };
-
--static const struct hpt_info hpt302 __devinitdata = {
-+static const struct hpt_info hpt302 __devinitconst = {
- .chip_name = "HPT302",
- .chip_type = HPT302,
- .udma_mask = HPT302_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
-@@ -563,7 +563,7 @@ static const struct hpt_info hpt302 __devinitdata = {
- .timings = &hpt37x_timings
- };
-
--static const struct hpt_info hpt371 __devinitdata = {
-+static const struct hpt_info hpt371 __devinitconst = {
- .chip_name = "HPT371",
- .chip_type = HPT371,
- .udma_mask = HPT371_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
-@@ -571,7 +571,7 @@ static const struct hpt_info hpt371 __devinitdata = {
- .timings = &hpt37x_timings
- };
-
--static const struct hpt_info hpt372n __devinitdata = {
-+static const struct hpt_info hpt372n __devinitconst = {
- .chip_name = "HPT372N",
- .chip_type = HPT372N,
- .udma_mask = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
-@@ -579,7 +579,7 @@ static const struct hpt_info hpt372n __devinitdata = {
- .timings = &hpt37x_timings
- };
-
--static const struct hpt_info hpt302n __devinitdata = {
-+static const struct hpt_info hpt302n __devinitconst = {
- .chip_name = "HPT302N",
- .chip_type = HPT302N,
- .udma_mask = HPT302_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
-@@ -587,7 +587,7 @@ static const struct hpt_info hpt302n __devinitdata = {
- .timings = &hpt37x_timings
- };
-
--static const struct hpt_info hpt371n __devinitdata = {
-+static const struct hpt_info hpt371n __devinitconst = {
- .chip_name = "HPT371N",
- .chip_type = HPT371N,
- .udma_mask = HPT371_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
-@@ -1422,7 +1422,7 @@ static const struct ide_dma_ops hpt36x_dma_ops = {
- .dma_sff_read_status = ide_dma_sff_read_status,
- };
-
--static const struct ide_port_info hpt366_chipsets[] __devinitdata = {
-+static const struct ide_port_info hpt366_chipsets[] __devinitconst = {
- { /* 0: HPT36x */
- .name = DRV_NAME,
- .init_chipset = init_chipset_hpt366,
-diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
-index 2de76cc..74186a1 100644
---- a/drivers/ide/ide-cd.c
-+++ b/drivers/ide/ide-cd.c
-@@ -774,7 +774,7 @@ static void cdrom_do_block_pc(ide_drive_t *drive, struct request *rq)
- alignment = queue_dma_alignment(q) | q->dma_pad_mask;
- if ((unsigned long)buf & alignment
- || blk_rq_bytes(rq) & q->dma_pad_mask
-- || object_is_on_stack(buf))
-+ || object_starts_on_stack(buf))
- drive->dma = 0;
- }
- }
-diff --git a/drivers/ide/ide-floppy.c b/drivers/ide/ide-floppy.c
-index fefbdfc..62ff465 100644
---- a/drivers/ide/ide-floppy.c
-+++ b/drivers/ide/ide-floppy.c
-@@ -373,6 +373,8 @@ static int ide_floppy_get_capacity(ide_drive_t *drive)
- u8 pc_buf[256], header_len, desc_cnt;
- int i, rc = 1, blocks, length;
-
-+ pax_track_stack();
-+
- ide_debug_log(IDE_DBG_FUNC, "enter");
-
- drive->bios_cyl = 0;
-diff --git a/drivers/ide/ide-pci-generic.c b/drivers/ide/ide-pci-generic.c
-index 39d4e01..11538ce 100644
---- a/drivers/ide/ide-pci-generic.c
-+++ b/drivers/ide/ide-pci-generic.c
-@@ -53,7 +53,7 @@ static const struct ide_port_ops netcell_port_ops = {
- .udma_mask = ATA_UDMA6, \
- }
-
--static const struct ide_port_info generic_chipsets[] __devinitdata = {
-+static const struct ide_port_info generic_chipsets[] __devinitconst = {
- /* 0: Unknown */
- DECLARE_GENERIC_PCI_DEV(0),
-
-diff --git a/drivers/ide/it8172.c b/drivers/ide/it8172.c
-index 0d266a5..aaca790 100644
---- a/drivers/ide/it8172.c
-+++ b/drivers/ide/it8172.c
-@@ -115,7 +115,7 @@ static const struct ide_port_ops it8172_port_ops = {
- .set_dma_mode = it8172_set_dma_mode,
- };
-
--static const struct ide_port_info it8172_port_info __devinitdata = {
-+static const struct ide_port_info it8172_port_info __devinitconst = {
- .name = DRV_NAME,
- .port_ops = &it8172_port_ops,
- .enablebits = { {0x41, 0x80, 0x80}, {0x00, 0x00, 0x00} },
-diff --git a/drivers/ide/it8213.c b/drivers/ide/it8213.c
-index 4797616..4be488a 100644
---- a/drivers/ide/it8213.c
-+++ b/drivers/ide/it8213.c
-@@ -156,7 +156,7 @@ static const struct ide_port_ops it8213_port_ops = {
- .cable_detect = it8213_cable_detect,
- };
-
--static const struct ide_port_info it8213_chipset __devinitdata = {
-+static const struct ide_port_info it8213_chipset __devinitconst = {
- .name = DRV_NAME,
- .enablebits = { {0x41, 0x80, 0x80} },
- .port_ops = &it8213_port_ops,
-diff --git a/drivers/ide/it821x.c b/drivers/ide/it821x.c
-index 51aa745..146ee60 100644
---- a/drivers/ide/it821x.c
-+++ b/drivers/ide/it821x.c
-@@ -627,7 +627,7 @@ static const struct ide_port_ops it821x_port_ops = {
- .cable_detect = it821x_cable_detect,
- };
-
--static const struct ide_port_info it821x_chipset __devinitdata = {
-+static const struct ide_port_info it821x_chipset __devinitconst = {
- .name = DRV_NAME,
- .init_chipset = init_chipset_it821x,
- .init_hwif = init_hwif_it821x,
-diff --git a/drivers/ide/jmicron.c b/drivers/ide/jmicron.c
-index bf2be643..9270098 100644
---- a/drivers/ide/jmicron.c
-+++ b/drivers/ide/jmicron.c
-@@ -102,7 +102,7 @@ static const struct ide_port_ops jmicron_port_ops = {
- .cable_detect = jmicron_cable_detect,
- };
-
--static const struct ide_port_info jmicron_chipset __devinitdata = {
-+static const struct ide_port_info jmicron_chipset __devinitconst = {
- .name = DRV_NAME,
- .enablebits = { { 0x40, 0x01, 0x01 }, { 0x40, 0x10, 0x10 } },
- .port_ops = &jmicron_port_ops,
-diff --git a/drivers/ide/ns87415.c b/drivers/ide/ns87415.c
-index 95327a2..73f78d8 100644
---- a/drivers/ide/ns87415.c
-+++ b/drivers/ide/ns87415.c
-@@ -293,7 +293,7 @@ static const struct ide_dma_ops ns87415_dma_ops = {
- .dma_sff_read_status = superio_dma_sff_read_status,
- };
-
--static const struct ide_port_info ns87415_chipset __devinitdata = {
-+static const struct ide_port_info ns87415_chipset __devinitconst = {
- .name = DRV_NAME,
- .init_hwif = init_hwif_ns87415,
- .tp_ops = &ns87415_tp_ops,
-diff --git a/drivers/ide/opti621.c b/drivers/ide/opti621.c
-index f1d70d6..e1de05b 100644
---- a/drivers/ide/opti621.c
-+++ b/drivers/ide/opti621.c
-@@ -202,7 +202,7 @@ static const struct ide_port_ops opti621_port_ops = {
- .set_pio_mode = opti621_set_pio_mode,
- };
-
--static const struct ide_port_info opti621_chipset __devinitdata = {
-+static const struct ide_port_info opti621_chipset __devinitconst = {
- .name = DRV_NAME,
- .enablebits = { {0x45, 0x80, 0x00}, {0x40, 0x08, 0x00} },
- .port_ops = &opti621_port_ops,
-diff --git a/drivers/ide/pdc202xx_new.c b/drivers/ide/pdc202xx_new.c
-index 65ba823..7311f4d 100644
---- a/drivers/ide/pdc202xx_new.c
-+++ b/drivers/ide/pdc202xx_new.c
-@@ -465,7 +465,7 @@ static const struct ide_port_ops pdcnew_port_ops = {
- .udma_mask = udma, \
- }
-
--static const struct ide_port_info pdcnew_chipsets[] __devinitdata = {
-+static const struct ide_port_info pdcnew_chipsets[] __devinitconst = {
- /* 0: PDC202{68,70} */ DECLARE_PDCNEW_DEV(ATA_UDMA5),
- /* 1: PDC202{69,71,75,76,77} */ DECLARE_PDCNEW_DEV(ATA_UDMA6),
- };
-diff --git a/drivers/ide/pdc202xx_old.c b/drivers/ide/pdc202xx_old.c
-index cb812f3..af816ef 100644
---- a/drivers/ide/pdc202xx_old.c
-+++ b/drivers/ide/pdc202xx_old.c
-@@ -285,7 +285,7 @@ static const struct ide_dma_ops pdc2026x_dma_ops = {
- .max_sectors = sectors, \
- }
-
--static const struct ide_port_info pdc202xx_chipsets[] __devinitdata = {
-+static const struct ide_port_info pdc202xx_chipsets[] __devinitconst = {
- { /* 0: PDC20246 */
- .name = DRV_NAME,
- .init_chipset = init_chipset_pdc202xx,
-diff --git a/drivers/ide/piix.c b/drivers/ide/piix.c
-index bf14f39..15c4b98 100644
---- a/drivers/ide/piix.c
-+++ b/drivers/ide/piix.c
-@@ -344,7 +344,7 @@ static const struct ide_port_ops ich_port_ops = {
- .udma_mask = udma, \
- }
-
--static const struct ide_port_info piix_pci_info[] __devinitdata = {
-+static const struct ide_port_info piix_pci_info[] __devinitconst = {
- /* 0: MPIIX */
- { /*
- * MPIIX actually has only a single IDE channel mapped to
-diff --git a/drivers/ide/rz1000.c b/drivers/ide/rz1000.c
-index a6414a8..c04173e 100644
---- a/drivers/ide/rz1000.c
-+++ b/drivers/ide/rz1000.c
-@@ -38,7 +38,7 @@ static int __devinit rz1000_disable_readahead(struct pci_dev *dev)
- }
- }
-
--static const struct ide_port_info rz1000_chipset __devinitdata = {
-+static const struct ide_port_info rz1000_chipset __devinitconst = {
- .name = DRV_NAME,
- .host_flags = IDE_HFLAG_NO_DMA,
- };
-diff --git a/drivers/ide/sc1200.c b/drivers/ide/sc1200.c
-index d467478..9203942 100644
---- a/drivers/ide/sc1200.c
-+++ b/drivers/ide/sc1200.c
-@@ -290,7 +290,7 @@ static const struct ide_dma_ops sc1200_dma_ops = {
- .dma_sff_read_status = ide_dma_sff_read_status,
- };
-
--static const struct ide_port_info sc1200_chipset __devinitdata = {
-+static const struct ide_port_info sc1200_chipset __devinitconst = {
- .name = DRV_NAME,
- .port_ops = &sc1200_port_ops,
- .dma_ops = &sc1200_dma_ops,
-diff --git a/drivers/ide/scc_pata.c b/drivers/ide/scc_pata.c
-index 1104bb3..59c5194 100644
---- a/drivers/ide/scc_pata.c
-+++ b/drivers/ide/scc_pata.c
-@@ -811,7 +811,7 @@ static const struct ide_dma_ops scc_dma_ops = {
- .dma_sff_read_status = scc_dma_sff_read_status,
- };
-
--static const struct ide_port_info scc_chipset __devinitdata = {
-+static const struct ide_port_info scc_chipset __devinitconst = {
- .name = "sccIDE",
- .init_iops = init_iops_scc,
- .init_dma = scc_init_dma,
-diff --git a/drivers/ide/serverworks.c b/drivers/ide/serverworks.c
-index b6554ef..6cc2cc3 100644
---- a/drivers/ide/serverworks.c
-+++ b/drivers/ide/serverworks.c
-@@ -353,7 +353,7 @@ static const struct ide_port_ops svwks_port_ops = {
- .cable_detect = svwks_cable_detect,
- };
-
--static const struct ide_port_info serverworks_chipsets[] __devinitdata = {
-+static const struct ide_port_info serverworks_chipsets[] __devinitconst = {
- { /* 0: OSB4 */
- .name = DRV_NAME,
- .init_chipset = init_chipset_svwks,
-diff --git a/drivers/ide/setup-pci.c b/drivers/ide/setup-pci.c
-index ab3db61..afed580 100644
---- a/drivers/ide/setup-pci.c
-+++ b/drivers/ide/setup-pci.c
-@@ -542,6 +542,8 @@ int ide_pci_init_two(struct pci_dev *dev1, struct pci_dev *dev2,
- int ret, i, n_ports = dev2 ? 4 : 2;
- struct ide_hw hw[4], *hws[] = { NULL, NULL, NULL, NULL };
-
-+ pax_track_stack();
-+
- for (i = 0; i < n_ports / 2; i++) {
- ret = ide_setup_pci_controller(pdev[i], d, !i);
- if (ret < 0)
-diff --git a/drivers/ide/siimage.c b/drivers/ide/siimage.c
-index d95df52..0b03a39 100644
---- a/drivers/ide/siimage.c
-+++ b/drivers/ide/siimage.c
-@@ -719,7 +719,7 @@ static const struct ide_dma_ops sil_dma_ops = {
- .udma_mask = ATA_UDMA6, \
- }
-
--static const struct ide_port_info siimage_chipsets[] __devinitdata = {
-+static const struct ide_port_info siimage_chipsets[] __devinitconst = {
- /* 0: SiI680 */ DECLARE_SII_DEV(&sil_pata_port_ops),
- /* 1: SiI3112 */ DECLARE_SII_DEV(&sil_sata_port_ops)
- };
-diff --git a/drivers/ide/sis5513.c b/drivers/ide/sis5513.c
-index 3b88eba..ca8699d 100644
---- a/drivers/ide/sis5513.c
-+++ b/drivers/ide/sis5513.c
-@@ -561,7 +561,7 @@ static const struct ide_port_ops sis_ata133_port_ops = {
- .cable_detect = sis_cable_detect,
- };
-
--static const struct ide_port_info sis5513_chipset __devinitdata = {
-+static const struct ide_port_info sis5513_chipset __devinitconst = {
- .name = DRV_NAME,
- .init_chipset = init_chipset_sis5513,
- .enablebits = { {0x4a, 0x02, 0x02}, {0x4a, 0x04, 0x04} },
-diff --git a/drivers/ide/sl82c105.c b/drivers/ide/sl82c105.c
-index d698da4..fca42a4 100644
---- a/drivers/ide/sl82c105.c
-+++ b/drivers/ide/sl82c105.c
-@@ -319,7 +319,7 @@ static const struct ide_dma_ops sl82c105_dma_ops = {
- .dma_sff_read_status = ide_dma_sff_read_status,
- };
-
--static const struct ide_port_info sl82c105_chipset __devinitdata = {
-+static const struct ide_port_info sl82c105_chipset __devinitconst = {
- .name = DRV_NAME,
- .init_chipset = init_chipset_sl82c105,
- .enablebits = {{0x40,0x01,0x01}, {0x40,0x10,0x10}},
-diff --git a/drivers/ide/slc90e66.c b/drivers/ide/slc90e66.c
-index 1ccfb40..83d5779 100644
---- a/drivers/ide/slc90e66.c
-+++ b/drivers/ide/slc90e66.c
-@@ -131,7 +131,7 @@ static const struct ide_port_ops slc90e66_port_ops = {
- .cable_detect = slc90e66_cable_detect,
- };
-
--static const struct ide_port_info slc90e66_chipset __devinitdata = {
-+static const struct ide_port_info slc90e66_chipset __devinitconst = {
- .name = DRV_NAME,
- .enablebits = { {0x41, 0x80, 0x80}, {0x43, 0x80, 0x80} },
- .port_ops = &slc90e66_port_ops,
-diff --git a/drivers/ide/tc86c001.c b/drivers/ide/tc86c001.c
-index 05a93d6..5f9e325 100644
---- a/drivers/ide/tc86c001.c
-+++ b/drivers/ide/tc86c001.c
-@@ -190,7 +190,7 @@ static const struct ide_dma_ops tc86c001_dma_ops = {
- .dma_sff_read_status = ide_dma_sff_read_status,
- };
-
--static const struct ide_port_info tc86c001_chipset __devinitdata = {
-+static const struct ide_port_info tc86c001_chipset __devinitconst = {
- .name = DRV_NAME,
- .init_hwif = init_hwif_tc86c001,
- .port_ops = &tc86c001_port_ops,
-diff --git a/drivers/ide/triflex.c b/drivers/ide/triflex.c
-index 8773c3b..7907d6c 100644
---- a/drivers/ide/triflex.c
-+++ b/drivers/ide/triflex.c
-@@ -92,7 +92,7 @@ static const struct ide_port_ops triflex_port_ops = {
- .set_dma_mode = triflex_set_mode,
- };
-
--static const struct ide_port_info triflex_device __devinitdata = {
-+static const struct ide_port_info triflex_device __devinitconst = {
- .name = DRV_NAME,
- .enablebits = {{0x80, 0x01, 0x01}, {0x80, 0x02, 0x02}},
- .port_ops = &triflex_port_ops,
-diff --git a/drivers/ide/trm290.c b/drivers/ide/trm290.c
-index 4b42ca0..e494a98 100644
---- a/drivers/ide/trm290.c
-+++ b/drivers/ide/trm290.c
-@@ -324,7 +324,7 @@ static struct ide_dma_ops trm290_dma_ops = {
- .dma_check = trm290_dma_check,
- };
-
--static const struct ide_port_info trm290_chipset __devinitdata = {
-+static const struct ide_port_info trm290_chipset __devinitconst = {
- .name = DRV_NAME,
- .init_hwif = init_hwif_trm290,
- .tp_ops = &trm290_tp_ops,
-diff --git a/drivers/ide/via82cxxx.c b/drivers/ide/via82cxxx.c
-index 028de26..520d5d5 100644
---- a/drivers/ide/via82cxxx.c
-+++ b/drivers/ide/via82cxxx.c
-@@ -374,7 +374,7 @@ static const struct ide_port_ops via_port_ops = {
- .cable_detect = via82cxxx_cable_detect,
- };
-
--static const struct ide_port_info via82cxxx_chipset __devinitdata = {
-+static const struct ide_port_info via82cxxx_chipset __devinitconst = {
- .name = DRV_NAME,
- .init_chipset = init_chipset_via82cxxx,
- .enablebits = { { 0x40, 0x02, 0x02 }, { 0x40, 0x01, 0x01 } },
-diff --git a/drivers/ieee1394/dv1394.c b/drivers/ieee1394/dv1394.c
-index 2cd00b5..14de699 100644
---- a/drivers/ieee1394/dv1394.c
-+++ b/drivers/ieee1394/dv1394.c
-@@ -739,7 +739,7 @@ static void frame_prepare(struct video_card *video, unsigned int this_frame)
- based upon DIF section and sequence
- */
-
--static void inline
-+static inline void
- frame_put_packet (struct frame *f, struct packet *p)
- {
- int section_type = p->data[0] >> 5; /* section type is in bits 5 - 7 */
-diff --git a/drivers/ieee1394/hosts.c b/drivers/ieee1394/hosts.c
-index e947d8f..6a966b9 100644
---- a/drivers/ieee1394/hosts.c
-+++ b/drivers/ieee1394/hosts.c
-@@ -78,6 +78,7 @@ static int dummy_isoctl(struct hpsb_iso *iso, enum isoctl_cmd command,
- }
-
- static struct hpsb_host_driver dummy_driver = {
-+ .name = "dummy",
- .transmit_packet = dummy_transmit_packet,
- .devctl = dummy_devctl,
- .isoctl = dummy_isoctl
-diff --git a/drivers/ieee1394/init_ohci1394_dma.c b/drivers/ieee1394/init_ohci1394_dma.c
-index ddaab6e..8d37435 100644
---- a/drivers/ieee1394/init_ohci1394_dma.c
-+++ b/drivers/ieee1394/init_ohci1394_dma.c
-@@ -257,7 +257,7 @@ void __init init_ohci1394_dma_on_all_controllers(void)
- for (func = 0; func < 8; func++) {
- u32 class = read_pci_config(num,slot,func,
- PCI_CLASS_REVISION);
-- if ((class == 0xffffffff))
-+ if (class == 0xffffffff)
- continue; /* No device at this func */
-
- if (class>>8 != PCI_CLASS_SERIAL_FIREWIRE_OHCI)
-diff --git a/drivers/ieee1394/ohci1394.c b/drivers/ieee1394/ohci1394.c
-index 65c1429..5d8c11f 100644
---- a/drivers/ieee1394/ohci1394.c
-+++ b/drivers/ieee1394/ohci1394.c
-@@ -147,9 +147,9 @@ printk(level "%s: " fmt "\n" , OHCI1394_DRIVER_NAME , ## args)
- printk(level "%s: fw-host%d: " fmt "\n" , OHCI1394_DRIVER_NAME, ohci->host->id , ## args)
-
- /* Module Parameters */
--static int phys_dma = 1;
-+static int phys_dma;
- module_param(phys_dma, int, 0444);
--MODULE_PARM_DESC(phys_dma, "Enable physical DMA (default = 1).");
-+MODULE_PARM_DESC(phys_dma, "Enable physical DMA (default = 0).");
-
- static void dma_trm_tasklet(unsigned long data);
- static void dma_trm_reset(struct dma_trm_ctx *d);
-diff --git a/drivers/ieee1394/sbp2.c b/drivers/ieee1394/sbp2.c
-index f199896..78c9fc8 100644
---- a/drivers/ieee1394/sbp2.c
-+++ b/drivers/ieee1394/sbp2.c
-@@ -2111,7 +2111,7 @@ MODULE_DESCRIPTION("IEEE-1394 SBP-2 protocol driver");
- MODULE_SUPPORTED_DEVICE(SBP2_DEVICE_NAME);
- MODULE_LICENSE("GPL");
-
--static int sbp2_module_init(void)
-+static int __init sbp2_module_init(void)
- {
- int ret;
-
-diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
-index a5dea6b..0cefe8f 100644
---- a/drivers/infiniband/core/cm.c
-+++ b/drivers/infiniband/core/cm.c
-@@ -112,7 +112,7 @@ static char const counter_group_names[CM_COUNTER_GROUPS]
-
- struct cm_counter_group {
- struct kobject obj;
-- atomic_long_t counter[CM_ATTR_COUNT];
-+ atomic_long_unchecked_t counter[CM_ATTR_COUNT];
- };
-
- struct cm_counter_attribute {
-@@ -1386,7 +1386,7 @@ static void cm_dup_req_handler(struct cm_work *work,
- struct ib_mad_send_buf *msg = NULL;
- int ret;
-
-- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- counter[CM_REQ_COUNTER]);
-
- /* Quick state check to discard duplicate REQs. */
-@@ -1764,7 +1764,7 @@ static void cm_dup_rep_handler(struct cm_work *work)
- if (!cm_id_priv)
- return;
-
-- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- counter[CM_REP_COUNTER]);
- ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
- if (ret)
-@@ -1931,7 +1931,7 @@ static int cm_rtu_handler(struct cm_work *work)
- if (cm_id_priv->id.state != IB_CM_REP_SENT &&
- cm_id_priv->id.state != IB_CM_MRA_REP_RCVD) {
- spin_unlock_irq(&cm_id_priv->lock);
-- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- counter[CM_RTU_COUNTER]);
- goto out;
- }
-@@ -2110,7 +2110,7 @@ static int cm_dreq_handler(struct cm_work *work)
- cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id,
- dreq_msg->local_comm_id);
- if (!cm_id_priv) {
-- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- counter[CM_DREQ_COUNTER]);
- cm_issue_drep(work->port, work->mad_recv_wc);
- return -EINVAL;
-@@ -2131,7 +2131,7 @@ static int cm_dreq_handler(struct cm_work *work)
- case IB_CM_MRA_REP_RCVD:
- break;
- case IB_CM_TIMEWAIT:
-- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- counter[CM_DREQ_COUNTER]);
- if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
- goto unlock;
-@@ -2145,7 +2145,7 @@ static int cm_dreq_handler(struct cm_work *work)
- cm_free_msg(msg);
- goto deref;
- case IB_CM_DREQ_RCVD:
-- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- counter[CM_DREQ_COUNTER]);
- goto unlock;
- default:
-@@ -2501,7 +2501,7 @@ static int cm_mra_handler(struct cm_work *work)
- ib_modify_mad(cm_id_priv->av.port->mad_agent,
- cm_id_priv->msg, timeout)) {
- if (cm_id_priv->id.lap_state == IB_CM_MRA_LAP_RCVD)
-- atomic_long_inc(&work->port->
-+ atomic_long_inc_unchecked(&work->port->
- counter_group[CM_RECV_DUPLICATES].
- counter[CM_MRA_COUNTER]);
- goto out;
-@@ -2510,7 +2510,7 @@ static int cm_mra_handler(struct cm_work *work)
- break;
- case IB_CM_MRA_REQ_RCVD:
- case IB_CM_MRA_REP_RCVD:
-- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- counter[CM_MRA_COUNTER]);
- /* fall through */
- default:
-@@ -2672,7 +2672,7 @@ static int cm_lap_handler(struct cm_work *work)
- case IB_CM_LAP_IDLE:
- break;
- case IB_CM_MRA_LAP_SENT:
-- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- counter[CM_LAP_COUNTER]);
- if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
- goto unlock;
-@@ -2688,7 +2688,7 @@ static int cm_lap_handler(struct cm_work *work)
- cm_free_msg(msg);
- goto deref;
- case IB_CM_LAP_RCVD:
-- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- counter[CM_LAP_COUNTER]);
- goto unlock;
- default:
-@@ -2972,7 +2972,7 @@ static int cm_sidr_req_handler(struct cm_work *work)
- cur_cm_id_priv = cm_insert_remote_sidr(cm_id_priv);
- if (cur_cm_id_priv) {
- spin_unlock_irq(&cm.lock);
-- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- counter[CM_SIDR_REQ_COUNTER]);
- goto out; /* Duplicate message. */
- }
-@@ -3184,10 +3184,10 @@ static void cm_send_handler(struct ib_mad_agent *mad_agent,
- if (!msg->context[0] && (attr_index != CM_REJ_COUNTER))
- msg->retries = 1;
-
-- atomic_long_add(1 + msg->retries,
-+ atomic_long_add_unchecked(1 + msg->retries,
- &port->counter_group[CM_XMIT].counter[attr_index]);
- if (msg->retries)
-- atomic_long_add(msg->retries,
-+ atomic_long_add_unchecked(msg->retries,
- &port->counter_group[CM_XMIT_RETRIES].
- counter[attr_index]);
-
-@@ -3397,7 +3397,7 @@ static void cm_recv_handler(struct ib_mad_agent *mad_agent,
- }
-
- attr_id = be16_to_cpu(mad_recv_wc->recv_buf.mad->mad_hdr.attr_id);
-- atomic_long_inc(&port->counter_group[CM_RECV].
-+ atomic_long_inc_unchecked(&port->counter_group[CM_RECV].
- counter[attr_id - CM_ATTR_ID_OFFSET]);
-
- work = kmalloc(sizeof *work + sizeof(struct ib_sa_path_rec) * paths,
-@@ -3595,10 +3595,10 @@ static ssize_t cm_show_counter(struct kobject *obj, struct attribute *attr,
- cm_attr = container_of(attr, struct cm_counter_attribute, attr);
-
- return sprintf(buf, "%ld\n",
-- atomic_long_read(&group->counter[cm_attr->index]));
-+ atomic_long_read_unchecked(&group->counter[cm_attr->index]));
- }
-
--static struct sysfs_ops cm_counter_ops = {
-+static const struct sysfs_ops cm_counter_ops = {
- .show = cm_show_counter
- };
-
-diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
-index 8fd3a6f..61d8075 100644
---- a/drivers/infiniband/core/cma.c
-+++ b/drivers/infiniband/core/cma.c
-@@ -2267,6 +2267,9 @@ static int cma_resolve_ib_udp(struct rdma_id_private *id_priv,
-
- req.private_data_len = sizeof(struct cma_hdr) +
- conn_param->private_data_len;
-+ if (req.private_data_len < conn_param->private_data_len)
-+ return -EINVAL;
-+
- req.private_data = kzalloc(req.private_data_len, GFP_ATOMIC);
- if (!req.private_data)
- return -ENOMEM;
-@@ -2314,6 +2317,9 @@ static int cma_connect_ib(struct rdma_id_private *id_priv,
- memset(&req, 0, sizeof req);
- offset = cma_user_data_offset(id_priv->id.ps);
- req.private_data_len = offset + conn_param->private_data_len;
-+ if (req.private_data_len < conn_param->private_data_len)
-+ return -EINVAL;
-+
- private_data = kzalloc(req.private_data_len, GFP_ATOMIC);
- if (!private_data)
- return -ENOMEM;
-diff --git a/drivers/infiniband/core/fmr_pool.c b/drivers/infiniband/core/fmr_pool.c
-index 4507043..14ad522 100644
---- a/drivers/infiniband/core/fmr_pool.c
-+++ b/drivers/infiniband/core/fmr_pool.c
-@@ -97,8 +97,8 @@ struct ib_fmr_pool {
-
- struct task_struct *thread;
-
-- atomic_t req_ser;
-- atomic_t flush_ser;
-+ atomic_unchecked_t req_ser;
-+ atomic_unchecked_t flush_ser;
-
- wait_queue_head_t force_wait;
- };
-@@ -179,10 +179,10 @@ static int ib_fmr_cleanup_thread(void *pool_ptr)
- struct ib_fmr_pool *pool = pool_ptr;
-
- do {
-- if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) < 0) {
-+ if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) < 0) {
- ib_fmr_batch_release(pool);
-
-- atomic_inc(&pool->flush_ser);
-+ atomic_inc_unchecked(&pool->flush_ser);
- wake_up_interruptible(&pool->force_wait);
-
- if (pool->flush_function)
-@@ -190,7 +190,7 @@ static int ib_fmr_cleanup_thread(void *pool_ptr)
- }
-
- set_current_state(TASK_INTERRUPTIBLE);
-- if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) >= 0 &&
-+ if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) >= 0 &&
- !kthread_should_stop())
- schedule();
- __set_current_state(TASK_RUNNING);
-@@ -282,8 +282,8 @@ struct ib_fmr_pool *ib_create_fmr_pool(struct ib_pd *pd,
- pool->dirty_watermark = params->dirty_watermark;
- pool->dirty_len = 0;
- spin_lock_init(&pool->pool_lock);
-- atomic_set(&pool->req_ser, 0);
-- atomic_set(&pool->flush_ser, 0);
-+ atomic_set_unchecked(&pool->req_ser, 0);
-+ atomic_set_unchecked(&pool->flush_ser, 0);
- init_waitqueue_head(&pool->force_wait);
-
- pool->thread = kthread_run(ib_fmr_cleanup_thread,
-@@ -411,11 +411,11 @@ int ib_flush_fmr_pool(struct ib_fmr_pool *pool)
- }
- spin_unlock_irq(&pool->pool_lock);
-
-- serial = atomic_inc_return(&pool->req_ser);
-+ serial = atomic_inc_return_unchecked(&pool->req_ser);
- wake_up_process(pool->thread);
-
- if (wait_event_interruptible(pool->force_wait,
-- atomic_read(&pool->flush_ser) - serial >= 0))
-+ atomic_read_unchecked(&pool->flush_ser) - serial >= 0))
- return -EINTR;
-
- return 0;
-@@ -525,7 +525,7 @@ int ib_fmr_pool_unmap(struct ib_pool_fmr *fmr)
- } else {
- list_add_tail(&fmr->list, &pool->dirty_list);
- if (++pool->dirty_len >= pool->dirty_watermark) {
-- atomic_inc(&pool->req_ser);
-+ atomic_inc_unchecked(&pool->req_ser);
- wake_up_process(pool->thread);
- }
- }
-diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
-index 158a214..1558bb7 100644
---- a/drivers/infiniband/core/sysfs.c
-+++ b/drivers/infiniband/core/sysfs.c
-@@ -79,7 +79,7 @@ static ssize_t port_attr_show(struct kobject *kobj,
- return port_attr->show(p, port_attr, buf);
- }
-
--static struct sysfs_ops port_sysfs_ops = {
-+static const struct sysfs_ops port_sysfs_ops = {
- .show = port_attr_show
- };
-
-diff --git a/drivers/infiniband/core/uverbs_marshall.c b/drivers/infiniband/core/uverbs_marshall.c
-index 5440da0..1194ecb 100644
---- a/drivers/infiniband/core/uverbs_marshall.c
-+++ b/drivers/infiniband/core/uverbs_marshall.c
-@@ -40,18 +40,21 @@ void ib_copy_ah_attr_to_user(struct ib_uverbs_ah_attr *dst,
- dst->grh.sgid_index = src->grh.sgid_index;
- dst->grh.hop_limit = src->grh.hop_limit;
- dst->grh.traffic_class = src->grh.traffic_class;
-+ memset(&dst->grh.reserved, 0, sizeof(dst->grh.reserved));
- dst->dlid = src->dlid;
- dst->sl = src->sl;
- dst->src_path_bits = src->src_path_bits;
- dst->static_rate = src->static_rate;
- dst->is_global = src->ah_flags & IB_AH_GRH ? 1 : 0;
- dst->port_num = src->port_num;
-+ dst->reserved = 0;
- }
- EXPORT_SYMBOL(ib_copy_ah_attr_to_user);
-
- void ib_copy_qp_attr_to_user(struct ib_uverbs_qp_attr *dst,
- struct ib_qp_attr *src)
- {
-+ dst->qp_state = src->qp_state;
- dst->cur_qp_state = src->cur_qp_state;
- dst->path_mtu = src->path_mtu;
- dst->path_mig_state = src->path_mig_state;
-@@ -83,6 +86,7 @@ void ib_copy_qp_attr_to_user(struct ib_uverbs_qp_attr *dst,
- dst->rnr_retry = src->rnr_retry;
- dst->alt_port_num = src->alt_port_num;
- dst->alt_timeout = src->alt_timeout;
-+ memset(dst->reserved, 0, sizeof(dst->reserved));
- }
- EXPORT_SYMBOL(ib_copy_qp_attr_to_user);
-
-diff --git a/drivers/infiniband/hw/ipath/ipath_fs.c b/drivers/infiniband/hw/ipath/ipath_fs.c
-index 100da85..62e6b88 100644
---- a/drivers/infiniband/hw/ipath/ipath_fs.c
-+++ b/drivers/infiniband/hw/ipath/ipath_fs.c
-@@ -110,6 +110,8 @@ static ssize_t atomic_counters_read(struct file *file, char __user *buf,
- struct infinipath_counters counters;
- struct ipath_devdata *dd;
-
-+ pax_track_stack();
-+
- dd = file->f_path.dentry->d_inode->i_private;
- dd->ipath_f_read_counters(dd, &counters);
-
-diff --git a/drivers/infiniband/hw/nes/nes.c b/drivers/infiniband/hw/nes/nes.c
-index cbde0cf..afaf55c 100644
---- a/drivers/infiniband/hw/nes/nes.c
-+++ b/drivers/infiniband/hw/nes/nes.c
-@@ -102,7 +102,7 @@ MODULE_PARM_DESC(limit_maxrdreqsz, "Limit max read request size to 256 Bytes");
- LIST_HEAD(nes_adapter_list);
- static LIST_HEAD(nes_dev_list);
-
--atomic_t qps_destroyed;
-+atomic_unchecked_t qps_destroyed;
-
- static unsigned int ee_flsh_adapter;
- static unsigned int sysfs_nonidx_addr;
-@@ -259,7 +259,7 @@ static void nes_cqp_rem_ref_callback(struct nes_device *nesdev, struct nes_cqp_r
- struct nes_adapter *nesadapter = nesdev->nesadapter;
- u32 qp_id;
-
-- atomic_inc(&qps_destroyed);
-+ atomic_inc_unchecked(&qps_destroyed);
-
- /* Free the control structures */
-
-diff --git a/drivers/infiniband/hw/nes/nes.h b/drivers/infiniband/hw/nes/nes.h
-index bcc6abc..9c76b2f 100644
---- a/drivers/infiniband/hw/nes/nes.h
-+++ b/drivers/infiniband/hw/nes/nes.h
-@@ -174,17 +174,17 @@ extern unsigned int nes_debug_level;
- extern unsigned int wqm_quanta;
- extern struct list_head nes_adapter_list;
-
--extern atomic_t cm_connects;
--extern atomic_t cm_accepts;
--extern atomic_t cm_disconnects;
--extern atomic_t cm_closes;
--extern atomic_t cm_connecteds;
--extern atomic_t cm_connect_reqs;
--extern atomic_t cm_rejects;
--extern atomic_t mod_qp_timouts;
--extern atomic_t qps_created;
--extern atomic_t qps_destroyed;
--extern atomic_t sw_qps_destroyed;
-+extern atomic_unchecked_t cm_connects;
-+extern atomic_unchecked_t cm_accepts;
-+extern atomic_unchecked_t cm_disconnects;
-+extern atomic_unchecked_t cm_closes;
-+extern atomic_unchecked_t cm_connecteds;
-+extern atomic_unchecked_t cm_connect_reqs;
-+extern atomic_unchecked_t cm_rejects;
-+extern atomic_unchecked_t mod_qp_timouts;
-+extern atomic_unchecked_t qps_created;
-+extern atomic_unchecked_t qps_destroyed;
-+extern atomic_unchecked_t sw_qps_destroyed;
- extern u32 mh_detected;
- extern u32 mh_pauses_sent;
- extern u32 cm_packets_sent;
-@@ -196,11 +196,11 @@ extern u32 cm_packets_retrans;
- extern u32 cm_listens_created;
- extern u32 cm_listens_destroyed;
- extern u32 cm_backlog_drops;
--extern atomic_t cm_loopbacks;
--extern atomic_t cm_nodes_created;
--extern atomic_t cm_nodes_destroyed;
--extern atomic_t cm_accel_dropped_pkts;
--extern atomic_t cm_resets_recvd;
-+extern atomic_unchecked_t cm_loopbacks;
-+extern atomic_unchecked_t cm_nodes_created;
-+extern atomic_unchecked_t cm_nodes_destroyed;
-+extern atomic_unchecked_t cm_accel_dropped_pkts;
-+extern atomic_unchecked_t cm_resets_recvd;
-
- extern u32 int_mod_timer_init;
- extern u32 int_mod_cq_depth_256;
-diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c
-index 73473db..5ed06e8 100644
---- a/drivers/infiniband/hw/nes/nes_cm.c
-+++ b/drivers/infiniband/hw/nes/nes_cm.c
-@@ -69,11 +69,11 @@ u32 cm_packets_received;
- u32 cm_listens_created;
- u32 cm_listens_destroyed;
- u32 cm_backlog_drops;
--atomic_t cm_loopbacks;
--atomic_t cm_nodes_created;
--atomic_t cm_nodes_destroyed;
--atomic_t cm_accel_dropped_pkts;
--atomic_t cm_resets_recvd;
-+atomic_unchecked_t cm_loopbacks;
-+atomic_unchecked_t cm_nodes_created;
-+atomic_unchecked_t cm_nodes_destroyed;
-+atomic_unchecked_t cm_accel_dropped_pkts;
-+atomic_unchecked_t cm_resets_recvd;
-
- static inline int mini_cm_accelerated(struct nes_cm_core *,
- struct nes_cm_node *);
-@@ -149,13 +149,13 @@ static struct nes_cm_ops nes_cm_api = {
-
- static struct nes_cm_core *g_cm_core;
-
--atomic_t cm_connects;
--atomic_t cm_accepts;
--atomic_t cm_disconnects;
--atomic_t cm_closes;
--atomic_t cm_connecteds;
--atomic_t cm_connect_reqs;
--atomic_t cm_rejects;
-+atomic_unchecked_t cm_connects;
-+atomic_unchecked_t cm_accepts;
-+atomic_unchecked_t cm_disconnects;
-+atomic_unchecked_t cm_closes;
-+atomic_unchecked_t cm_connecteds;
-+atomic_unchecked_t cm_connect_reqs;
-+atomic_unchecked_t cm_rejects;
-
-
- /**
-@@ -1195,7 +1195,7 @@ static struct nes_cm_node *make_cm_node(struct nes_cm_core *cm_core,
- cm_node->rem_mac);
-
- add_hte_node(cm_core, cm_node);
-- atomic_inc(&cm_nodes_created);
-+ atomic_inc_unchecked(&cm_nodes_created);
-
- return cm_node;
- }
-@@ -1253,7 +1253,7 @@ static int rem_ref_cm_node(struct nes_cm_core *cm_core,
- }
-
- atomic_dec(&cm_core->node_cnt);
-- atomic_inc(&cm_nodes_destroyed);
-+ atomic_inc_unchecked(&cm_nodes_destroyed);
- nesqp = cm_node->nesqp;
- if (nesqp) {
- nesqp->cm_node = NULL;
-@@ -1320,7 +1320,7 @@ static int process_options(struct nes_cm_node *cm_node, u8 *optionsloc,
-
- static void drop_packet(struct sk_buff *skb)
- {
-- atomic_inc(&cm_accel_dropped_pkts);
-+ atomic_inc_unchecked(&cm_accel_dropped_pkts);
- dev_kfree_skb_any(skb);
- }
-
-@@ -1377,7 +1377,7 @@ static void handle_rst_pkt(struct nes_cm_node *cm_node, struct sk_buff *skb,
-
- int reset = 0; /* whether to send reset in case of err.. */
- int passive_state;
-- atomic_inc(&cm_resets_recvd);
-+ atomic_inc_unchecked(&cm_resets_recvd);
- nes_debug(NES_DBG_CM, "Received Reset, cm_node = %p, state = %u."
- " refcnt=%d\n", cm_node, cm_node->state,
- atomic_read(&cm_node->ref_count));
-@@ -2000,7 +2000,7 @@ static struct nes_cm_node *mini_cm_connect(struct nes_cm_core *cm_core,
- rem_ref_cm_node(cm_node->cm_core, cm_node);
- return NULL;
- }
-- atomic_inc(&cm_loopbacks);
-+ atomic_inc_unchecked(&cm_loopbacks);
- loopbackremotenode->loopbackpartner = cm_node;
- loopbackremotenode->tcp_cntxt.rcv_wscale =
- NES_CM_DEFAULT_RCV_WND_SCALE;
-@@ -2262,7 +2262,7 @@ static int mini_cm_recv_pkt(struct nes_cm_core *cm_core,
- add_ref_cm_node(cm_node);
- } else if (cm_node->state == NES_CM_STATE_TSA) {
- rem_ref_cm_node(cm_core, cm_node);
-- atomic_inc(&cm_accel_dropped_pkts);
-+ atomic_inc_unchecked(&cm_accel_dropped_pkts);
- dev_kfree_skb_any(skb);
- break;
- }
-@@ -2568,7 +2568,7 @@ static int nes_cm_disconn_true(struct nes_qp *nesqp)
-
- if ((cm_id) && (cm_id->event_handler)) {
- if (issue_disconn) {
-- atomic_inc(&cm_disconnects);
-+ atomic_inc_unchecked(&cm_disconnects);
- cm_event.event = IW_CM_EVENT_DISCONNECT;
- cm_event.status = disconn_status;
- cm_event.local_addr = cm_id->local_addr;
-@@ -2590,7 +2590,7 @@ static int nes_cm_disconn_true(struct nes_qp *nesqp)
- }
-
- if (issue_close) {
-- atomic_inc(&cm_closes);
-+ atomic_inc_unchecked(&cm_closes);
- nes_disconnect(nesqp, 1);
-
- cm_id->provider_data = nesqp;
-@@ -2710,7 +2710,7 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
-
- nes_debug(NES_DBG_CM, "QP%u, cm_node=%p, jiffies = %lu listener = %p\n",
- nesqp->hwqp.qp_id, cm_node, jiffies, cm_node->listener);
-- atomic_inc(&cm_accepts);
-+ atomic_inc_unchecked(&cm_accepts);
-
- nes_debug(NES_DBG_CM, "netdev refcnt = %u.\n",
- atomic_read(&nesvnic->netdev->refcnt));
-@@ -2919,7 +2919,7 @@ int nes_reject(struct iw_cm_id *cm_id, const void *pdata, u8 pdata_len)
-
- struct nes_cm_core *cm_core;
-
-- atomic_inc(&cm_rejects);
-+ atomic_inc_unchecked(&cm_rejects);
- cm_node = (struct nes_cm_node *) cm_id->provider_data;
- loopback = cm_node->loopbackpartner;
- cm_core = cm_node->cm_core;
-@@ -2982,7 +2982,7 @@ int nes_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
- ntohl(cm_id->local_addr.sin_addr.s_addr),
- ntohs(cm_id->local_addr.sin_port));
-
-- atomic_inc(&cm_connects);
-+ atomic_inc_unchecked(&cm_connects);
- nesqp->active_conn = 1;
-
- /* cache the cm_id in the qp */
-@@ -3195,7 +3195,7 @@ static void cm_event_connected(struct nes_cm_event *event)
- if (nesqp->destroyed) {
- return;
- }
-- atomic_inc(&cm_connecteds);
-+ atomic_inc_unchecked(&cm_connecteds);
- nes_debug(NES_DBG_CM, "QP%u attempting to connect to 0x%08X:0x%04X on"
- " local port 0x%04X. jiffies = %lu.\n",
- nesqp->hwqp.qp_id,
-@@ -3403,7 +3403,7 @@ static void cm_event_reset(struct nes_cm_event *event)
-
- ret = cm_id->event_handler(cm_id, &cm_event);
- cm_id->add_ref(cm_id);
-- atomic_inc(&cm_closes);
-+ atomic_inc_unchecked(&cm_closes);
- cm_event.event = IW_CM_EVENT_CLOSE;
- cm_event.status = IW_CM_EVENT_STATUS_OK;
- cm_event.provider_data = cm_id->provider_data;
-@@ -3439,7 +3439,7 @@ static void cm_event_mpa_req(struct nes_cm_event *event)
- return;
- cm_id = cm_node->cm_id;
-
-- atomic_inc(&cm_connect_reqs);
-+ atomic_inc_unchecked(&cm_connect_reqs);
- nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
- cm_node, cm_id, jiffies);
-
-@@ -3477,7 +3477,7 @@ static void cm_event_mpa_reject(struct nes_cm_event *event)
- return;
- cm_id = cm_node->cm_id;
-
-- atomic_inc(&cm_connect_reqs);
-+ atomic_inc_unchecked(&cm_connect_reqs);
- nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
- cm_node, cm_id, jiffies);
-
-diff --git a/drivers/infiniband/hw/nes/nes_nic.c b/drivers/infiniband/hw/nes/nes_nic.c
-index e593af3..870694a 100644
---- a/drivers/infiniband/hw/nes/nes_nic.c
-+++ b/drivers/infiniband/hw/nes/nes_nic.c
-@@ -1210,17 +1210,17 @@ static void nes_netdev_get_ethtool_stats(struct net_device *netdev,
- target_stat_values[++index] = mh_detected;
- target_stat_values[++index] = mh_pauses_sent;
- target_stat_values[++index] = nesvnic->endnode_ipv4_tcp_retransmits;
-- target_stat_values[++index] = atomic_read(&cm_connects);
-- target_stat_values[++index] = atomic_read(&cm_accepts);
-- target_stat_values[++index] = atomic_read(&cm_disconnects);
-- target_stat_values[++index] = atomic_read(&cm_connecteds);
-- target_stat_values[++index] = atomic_read(&cm_connect_reqs);
-- target_stat_values[++index] = atomic_read(&cm_rejects);
-- target_stat_values[++index] = atomic_read(&mod_qp_timouts);
-- target_stat_values[++index] = atomic_read(&qps_created);
-- target_stat_values[++index] = atomic_read(&sw_qps_destroyed);
-- target_stat_values[++index] = atomic_read(&qps_destroyed);
-- target_stat_values[++index] = atomic_read(&cm_closes);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_connects);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_accepts);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_disconnects);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_connecteds);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_connect_reqs);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_rejects);
-+ target_stat_values[++index] = atomic_read_unchecked(&mod_qp_timouts);
-+ target_stat_values[++index] = atomic_read_unchecked(&qps_created);
-+ target_stat_values[++index] = atomic_read_unchecked(&sw_qps_destroyed);
-+ target_stat_values[++index] = atomic_read_unchecked(&qps_destroyed);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_closes);
- target_stat_values[++index] = cm_packets_sent;
- target_stat_values[++index] = cm_packets_bounced;
- target_stat_values[++index] = cm_packets_created;
-@@ -1230,11 +1230,11 @@ static void nes_netdev_get_ethtool_stats(struct net_device *netdev,
- target_stat_values[++index] = cm_listens_created;
- target_stat_values[++index] = cm_listens_destroyed;
- target_stat_values[++index] = cm_backlog_drops;
-- target_stat_values[++index] = atomic_read(&cm_loopbacks);
-- target_stat_values[++index] = atomic_read(&cm_nodes_created);
-- target_stat_values[++index] = atomic_read(&cm_nodes_destroyed);
-- target_stat_values[++index] = atomic_read(&cm_accel_dropped_pkts);
-- target_stat_values[++index] = atomic_read(&cm_resets_recvd);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_loopbacks);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_created);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_destroyed);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_accel_dropped_pkts);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_resets_recvd);
- target_stat_values[++index] = int_mod_timer_init;
- target_stat_values[++index] = int_mod_cq_depth_1;
- target_stat_values[++index] = int_mod_cq_depth_4;
-diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
-index a680c42..f914deb 100644
---- a/drivers/infiniband/hw/nes/nes_verbs.c
-+++ b/drivers/infiniband/hw/nes/nes_verbs.c
-@@ -45,9 +45,9 @@
-
- #include <rdma/ib_umem.h>
-
--atomic_t mod_qp_timouts;
--atomic_t qps_created;
--atomic_t sw_qps_destroyed;
-+atomic_unchecked_t mod_qp_timouts;
-+atomic_unchecked_t qps_created;
-+atomic_unchecked_t sw_qps_destroyed;
-
- static void nes_unregister_ofa_device(struct nes_ib_device *nesibdev);
-
-@@ -1240,7 +1240,7 @@ static struct ib_qp *nes_create_qp(struct ib_pd *ibpd,
- if (init_attr->create_flags)
- return ERR_PTR(-EINVAL);
-
-- atomic_inc(&qps_created);
-+ atomic_inc_unchecked(&qps_created);
- switch (init_attr->qp_type) {
- case IB_QPT_RC:
- if (nes_drv_opt & NES_DRV_OPT_NO_INLINE_DATA) {
-@@ -1568,7 +1568,7 @@ static int nes_destroy_qp(struct ib_qp *ibqp)
- struct iw_cm_event cm_event;
- int ret;
-
-- atomic_inc(&sw_qps_destroyed);
-+ atomic_inc_unchecked(&sw_qps_destroyed);
- nesqp->destroyed = 1;
-
- /* Blow away the connection if it exists. */
-diff --git a/drivers/input/gameport/gameport.c b/drivers/input/gameport/gameport.c
-index ac11be0..3883c04 100644
---- a/drivers/input/gameport/gameport.c
-+++ b/drivers/input/gameport/gameport.c
-@@ -515,13 +515,13 @@ EXPORT_SYMBOL(gameport_set_phys);
- */
- static void gameport_init_port(struct gameport *gameport)
- {
-- static atomic_t gameport_no = ATOMIC_INIT(0);
-+ static atomic_unchecked_t gameport_no = ATOMIC_INIT(0);
-
- __module_get(THIS_MODULE);
-
- mutex_init(&gameport->drv_mutex);
- device_initialize(&gameport->dev);
-- dev_set_name(&gameport->dev, "gameport%lu", (unsigned long)atomic_inc_return(&gameport_no) - 1);
-+ dev_set_name(&gameport->dev, "gameport%lu", (unsigned long)atomic_inc_return_unchecked(&gameport_no) - 1);
- gameport->dev.bus = &gameport_bus;
- gameport->dev.release = gameport_release_port;
- if (gameport->parent)
-diff --git a/drivers/input/input.c b/drivers/input/input.c
-index c82ae82..8cfb9cb 100644
---- a/drivers/input/input.c
-+++ b/drivers/input/input.c
-@@ -1558,7 +1558,7 @@ EXPORT_SYMBOL(input_set_capability);
- */
- int input_register_device(struct input_dev *dev)
- {
-- static atomic_t input_no = ATOMIC_INIT(0);
-+ static atomic_unchecked_t input_no = ATOMIC_INIT(0);
- struct input_handler *handler;
- const char *path;
- int error;
-@@ -1585,7 +1585,7 @@ int input_register_device(struct input_dev *dev)
- dev->setkeycode = input_default_setkeycode;
-
- dev_set_name(&dev->dev, "input%ld",
-- (unsigned long) atomic_inc_return(&input_no) - 1);
-+ (unsigned long) atomic_inc_return_unchecked(&input_no) - 1);
-
- error = device_add(&dev->dev);
- if (error)
-diff --git a/drivers/input/joystick/sidewinder.c b/drivers/input/joystick/sidewinder.c
-index ca13a6b..b032b0c 100644
---- a/drivers/input/joystick/sidewinder.c
-+++ b/drivers/input/joystick/sidewinder.c
-@@ -30,6 +30,7 @@
- #include <linux/kernel.h>
- #include <linux/module.h>
- #include <linux/slab.h>
-+#include <linux/sched.h>
- #include <linux/init.h>
- #include <linux/input.h>
- #include <linux/gameport.h>
-@@ -428,6 +429,8 @@ static int sw_read(struct sw *sw)
- unsigned char buf[SW_LENGTH];
- int i;
-
-+ pax_track_stack();
-+
- i = sw_read_packet(sw->gameport, buf, sw->length, 0);
-
- if (sw->type == SW_ID_3DP && sw->length == 66 && i != 66) { /* Broken packet, try to fix */
-diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
-index 79e3edc..01412b9 100644
---- a/drivers/input/joystick/xpad.c
-+++ b/drivers/input/joystick/xpad.c
-@@ -621,7 +621,7 @@ static void xpad_led_set(struct led_classdev *led_cdev,
-
- static int xpad_led_probe(struct usb_xpad *xpad)
- {
-- static atomic_t led_seq = ATOMIC_INIT(0);
-+ static atomic_unchecked_t led_seq = ATOMIC_INIT(0);
- long led_no;
- struct xpad_led *led;
- struct led_classdev *led_cdev;
-@@ -634,7 +634,7 @@ static int xpad_led_probe(struct usb_xpad *xpad)
- if (!led)
- return -ENOMEM;
-
-- led_no = (long)atomic_inc_return(&led_seq) - 1;
-+ led_no = (long)atomic_inc_return_unchecked(&led_seq) - 1;
-
- snprintf(led->name, sizeof(led->name), "xpad%ld", led_no);
- led->xpad = xpad;
-diff --git a/drivers/input/serio/serio.c b/drivers/input/serio/serio.c
-index 0236f0d..c7327f1 100644
---- a/drivers/input/serio/serio.c
-+++ b/drivers/input/serio/serio.c
-@@ -527,7 +527,7 @@ static void serio_release_port(struct device *dev)
- */
- static void serio_init_port(struct serio *serio)
- {
-- static atomic_t serio_no = ATOMIC_INIT(0);
-+ static atomic_unchecked_t serio_no = ATOMIC_INIT(0);
-
- __module_get(THIS_MODULE);
-
-@@ -536,7 +536,7 @@ static void serio_init_port(struct serio *serio)
- mutex_init(&serio->drv_mutex);
- device_initialize(&serio->dev);
- dev_set_name(&serio->dev, "serio%ld",
-- (long)atomic_inc_return(&serio_no) - 1);
-+ (long)atomic_inc_return_unchecked(&serio_no) - 1);
- serio->dev.bus = &serio_bus;
- serio->dev.release = serio_release_port;
- if (serio->parent) {
-diff --git a/drivers/isdn/capi/kcapi.c b/drivers/isdn/capi/kcapi.c
-index dc506ab..af04b54 100644
---- a/drivers/isdn/capi/kcapi.c
-+++ b/drivers/isdn/capi/kcapi.c
-@@ -95,7 +95,7 @@ capi_ctr_put(struct capi_ctr *card)
-
- static inline struct capi_ctr *get_capi_ctr_by_nr(u16 contr)
- {
-- if (contr - 1 >= CAPI_MAXCONTR)
-+ if (contr < 1 || contr - 1 >= CAPI_MAXCONTR)
- return NULL;
-
- return capi_cards[contr - 1];
-@@ -103,7 +103,7 @@ static inline struct capi_ctr *get_capi_ctr_by_nr(u16 contr)
-
- static inline struct capi20_appl *get_capi_appl_by_nr(u16 applid)
- {
-- if (applid - 1 >= CAPI_MAXAPPL)
-+ if (applid < 1 || applid - 1 >= CAPI_MAXAPPL)
- return NULL;
-
- return capi_applications[applid - 1];
-diff --git a/drivers/isdn/gigaset/common.c b/drivers/isdn/gigaset/common.c
-index 33dcd8d..2783d25 100644
---- a/drivers/isdn/gigaset/common.c
-+++ b/drivers/isdn/gigaset/common.c
-@@ -712,7 +712,7 @@ struct cardstate *gigaset_initcs(struct gigaset_driver *drv, int channels,
- cs->commands_pending = 0;
- cs->cur_at_seq = 0;
- cs->gotfwver = -1;
-- cs->open_count = 0;
-+ local_set(&cs->open_count, 0);
- cs->dev = NULL;
- cs->tty = NULL;
- cs->tty_dev = NULL;
-diff --git a/drivers/isdn/gigaset/gigaset.h b/drivers/isdn/gigaset/gigaset.h
-index a2f6125..6a70677 100644
---- a/drivers/isdn/gigaset/gigaset.h
-+++ b/drivers/isdn/gigaset/gigaset.h
-@@ -34,6 +34,7 @@
- #include <linux/tty_driver.h>
- #include <linux/list.h>
- #include <asm/atomic.h>
-+#include <asm/local.h>
-
- #define GIG_VERSION {0,5,0,0}
- #define GIG_COMPAT {0,4,0,0}
-@@ -446,7 +447,7 @@ struct cardstate {
- spinlock_t cmdlock;
- unsigned curlen, cmdbytes;
-
-- unsigned open_count;
-+ local_t open_count;
- struct tty_struct *tty;
- struct tasklet_struct if_wake_tasklet;
- unsigned control_state;
-diff --git a/drivers/isdn/gigaset/interface.c b/drivers/isdn/gigaset/interface.c
-index b3065b8..c7e8cc9 100644
---- a/drivers/isdn/gigaset/interface.c
-+++ b/drivers/isdn/gigaset/interface.c
-@@ -165,9 +165,7 @@ static int if_open(struct tty_struct *tty, struct file *filp)
- return -ERESTARTSYS; // FIXME -EINTR?
- tty->driver_data = cs;
-
-- ++cs->open_count;
--
-- if (cs->open_count == 1) {
-+ if (local_inc_return(&cs->open_count) == 1) {
- spin_lock_irqsave(&cs->lock, flags);
- cs->tty = tty;
- spin_unlock_irqrestore(&cs->lock, flags);
-@@ -195,10 +193,10 @@ static void if_close(struct tty_struct *tty, struct file *filp)
-
- if (!cs->connected)
- gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
-- else if (!cs->open_count)
-+ else if (!local_read(&cs->open_count))
- dev_warn(cs->dev, "%s: device not opened\n", __func__);
- else {
-- if (!--cs->open_count) {
-+ if (!local_dec_return(&cs->open_count)) {
- spin_lock_irqsave(&cs->lock, flags);
- cs->tty = NULL;
- spin_unlock_irqrestore(&cs->lock, flags);
-@@ -233,7 +231,7 @@ static int if_ioctl(struct tty_struct *tty, struct file *file,
- if (!cs->connected) {
- gig_dbg(DEBUG_IF, "not connected");
- retval = -ENODEV;
-- } else if (!cs->open_count)
-+ } else if (!local_read(&cs->open_count))
- dev_warn(cs->dev, "%s: device not opened\n", __func__);
- else {
- retval = 0;
-@@ -361,7 +359,7 @@ static int if_write(struct tty_struct *tty, const unsigned char *buf, int count)
- if (!cs->connected) {
- gig_dbg(DEBUG_IF, "not connected");
- retval = -ENODEV;
-- } else if (!cs->open_count)
-+ } else if (!local_read(&cs->open_count))
- dev_warn(cs->dev, "%s: device not opened\n", __func__);
- else if (cs->mstate != MS_LOCKED) {
- dev_warn(cs->dev, "can't write to unlocked device\n");
-@@ -395,7 +393,7 @@ static int if_write_room(struct tty_struct *tty)
- if (!cs->connected) {
- gig_dbg(DEBUG_IF, "not connected");
- retval = -ENODEV;
-- } else if (!cs->open_count)
-+ } else if (!local_read(&cs->open_count))
- dev_warn(cs->dev, "%s: device not opened\n", __func__);
- else if (cs->mstate != MS_LOCKED) {
- dev_warn(cs->dev, "can't write to unlocked device\n");
-@@ -425,7 +423,7 @@ static int if_chars_in_buffer(struct tty_struct *tty)
-
- if (!cs->connected)
- gig_dbg(DEBUG_IF, "not connected");
-- else if (!cs->open_count)
-+ else if (!local_read(&cs->open_count))
- dev_warn(cs->dev, "%s: device not opened\n", __func__);
- else if (cs->mstate != MS_LOCKED)
- dev_warn(cs->dev, "can't write to unlocked device\n");
-@@ -453,7 +451,7 @@ static void if_throttle(struct tty_struct *tty)
-
- if (!cs->connected)
- gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
-- else if (!cs->open_count)
-+ else if (!local_read(&cs->open_count))
- dev_warn(cs->dev, "%s: device not opened\n", __func__);
- else {
- //FIXME
-@@ -478,7 +476,7 @@ static void if_unthrottle(struct tty_struct *tty)
-
- if (!cs->connected)
- gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
-- else if (!cs->open_count)
-+ else if (!local_read(&cs->open_count))
- dev_warn(cs->dev, "%s: device not opened\n", __func__);
- else {
- //FIXME
-@@ -510,7 +508,7 @@ static void if_set_termios(struct tty_struct *tty, struct ktermios *old)
- goto out;
- }
-
-- if (!cs->open_count) {
-+ if (!local_read(&cs->open_count)) {
- dev_warn(cs->dev, "%s: device not opened\n", __func__);
- goto out;
- }
-diff --git a/drivers/isdn/hardware/avm/b1.c b/drivers/isdn/hardware/avm/b1.c
-index a7c0083..62a7cb6 100644
---- a/drivers/isdn/hardware/avm/b1.c
-+++ b/drivers/isdn/hardware/avm/b1.c
-@@ -173,7 +173,7 @@ int b1_load_t4file(avmcard *card, capiloaddatapart * t4file)
- }
- if (left) {
- if (t4file->user) {
-- if (copy_from_user(buf, dp, left))
-+ if (left > sizeof buf || copy_from_user(buf, dp, left))
- return -EFAULT;
- } else {
- memcpy(buf, dp, left);
-@@ -221,7 +221,7 @@ int b1_load_config(avmcard *card, capiloaddatapart * config)
- }
- if (left) {
- if (config->user) {
-- if (copy_from_user(buf, dp, left))
-+ if (left > sizeof buf || copy_from_user(buf, dp, left))
- return -EFAULT;
- } else {
- memcpy(buf, dp, left);
-diff --git a/drivers/isdn/hardware/eicon/capidtmf.c b/drivers/isdn/hardware/eicon/capidtmf.c
-index f130724..c373c68 100644
---- a/drivers/isdn/hardware/eicon/capidtmf.c
-+++ b/drivers/isdn/hardware/eicon/capidtmf.c
-@@ -498,6 +498,7 @@ void capidtmf_recv_block (t_capidtmf_state *p_state, byte *buffer, word leng
- byte goertzel_result_buffer[CAPIDTMF_RECV_TOTAL_FREQUENCY_COUNT];
- short windowed_sample_buffer[CAPIDTMF_RECV_WINDOWED_SAMPLES];
-
-+ pax_track_stack();
-
- if (p_state->recv.state & CAPIDTMF_RECV_STATE_DTMF_ACTIVE)
- {
-diff --git a/drivers/isdn/hardware/eicon/capifunc.c b/drivers/isdn/hardware/eicon/capifunc.c
-index 4d425c6..a9be6c4 100644
---- a/drivers/isdn/hardware/eicon/capifunc.c
-+++ b/drivers/isdn/hardware/eicon/capifunc.c
-@@ -1055,6 +1055,8 @@ static int divacapi_connect_didd(void)
- IDI_SYNC_REQ req;
- DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
-
-+ pax_track_stack();
-+
- DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
-
- for (x = 0; x < MAX_DESCRIPTORS; x++) {
-diff --git a/drivers/isdn/hardware/eicon/diddfunc.c b/drivers/isdn/hardware/eicon/diddfunc.c
-index 3029234..ef0d9e2 100644
---- a/drivers/isdn/hardware/eicon/diddfunc.c
-+++ b/drivers/isdn/hardware/eicon/diddfunc.c
-@@ -54,6 +54,8 @@ static int DIVA_INIT_FUNCTION connect_didd(void)
- IDI_SYNC_REQ req;
- DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
-
-+ pax_track_stack();
-+
- DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
-
- for (x = 0; x < MAX_DESCRIPTORS; x++) {
-diff --git a/drivers/isdn/hardware/eicon/divasfunc.c b/drivers/isdn/hardware/eicon/divasfunc.c
-index d36a4c0..11e7d1a 100644
---- a/drivers/isdn/hardware/eicon/divasfunc.c
-+++ b/drivers/isdn/hardware/eicon/divasfunc.c
-@@ -161,6 +161,8 @@ static int DIVA_INIT_FUNCTION connect_didd(void)
- IDI_SYNC_REQ req;
- DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
-
-+ pax_track_stack();
-+
- DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
-
- for (x = 0; x < MAX_DESCRIPTORS; x++) {
-diff --git a/drivers/isdn/hardware/eicon/idifunc.c b/drivers/isdn/hardware/eicon/idifunc.c
-index db87d51..7d09acf 100644
---- a/drivers/isdn/hardware/eicon/idifunc.c
-+++ b/drivers/isdn/hardware/eicon/idifunc.c
-@@ -188,6 +188,8 @@ static int DIVA_INIT_FUNCTION connect_didd(void)
- IDI_SYNC_REQ req;
- DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
-
-+ pax_track_stack();
-+
- DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
-
- for (x = 0; x < MAX_DESCRIPTORS; x++) {
-diff --git a/drivers/isdn/hardware/eicon/message.c b/drivers/isdn/hardware/eicon/message.c
-index ae89fb8..0fab299 100644
---- a/drivers/isdn/hardware/eicon/message.c
-+++ b/drivers/isdn/hardware/eicon/message.c
-@@ -4889,6 +4889,8 @@ static void sig_ind(PLCI *plci)
- dword d;
- word w;
-
-+ pax_track_stack();
-+
- a = plci->adapter;
- Id = ((word)plci->Id<<8)|a->Id;
- PUT_WORD(&SS_Ind[4],0x0000);
-@@ -7484,6 +7486,8 @@ static word add_b1(PLCI *plci, API_PARSE *bp, word b_channel_info,
- word j, n, w;
- dword d;
-
-+ pax_track_stack();
-+
-
- for(i=0;i<8;i++) bp_parms[i].length = 0;
- for(i=0;i<2;i++) global_config[i].length = 0;
-@@ -7958,6 +7962,8 @@ static word add_b23(PLCI *plci, API_PARSE *bp)
- const byte llc3[] = {4,3,2,2,6,6,0};
- const byte header[] = {0,2,3,3,0,0,0};
-
-+ pax_track_stack();
-+
- for(i=0;i<8;i++) bp_parms[i].length = 0;
- for(i=0;i<6;i++) b2_config_parms[i].length = 0;
- for(i=0;i<5;i++) b3_config_parms[i].length = 0;
-@@ -14761,6 +14767,8 @@ static void group_optimization(DIVA_CAPI_ADAPTER * a, PLCI * plci)
- word appl_number_group_type[MAX_APPL];
- PLCI *auxplci;
-
-+ pax_track_stack();
-+
- set_group_ind_mask (plci); /* all APPLs within this inc. call are allowed to dial in */
-
- if(!a->group_optimization_enabled)
-diff --git a/drivers/isdn/hardware/eicon/mntfunc.c b/drivers/isdn/hardware/eicon/mntfunc.c
-index a564b75..f3cf8b5 100644
---- a/drivers/isdn/hardware/eicon/mntfunc.c
-+++ b/drivers/isdn/hardware/eicon/mntfunc.c
-@@ -79,6 +79,8 @@ static int DIVA_INIT_FUNCTION connect_didd(void)
- IDI_SYNC_REQ req;
- DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
-
-+ pax_track_stack();
-+
- DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
-
- for (x = 0; x < MAX_DESCRIPTORS; x++) {
-diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
-index adb1e8c..21b590b 100644
---- a/drivers/isdn/i4l/isdn_common.c
-+++ b/drivers/isdn/i4l/isdn_common.c
-@@ -1290,6 +1290,8 @@ isdn_ioctl(struct inode *inode, struct file *file, uint cmd, ulong arg)
- } iocpar;
- void __user *argp = (void __user *)arg;
-
-+ pax_track_stack();
-+
- #define name iocpar.name
- #define bname iocpar.bname
- #define iocts iocpar.iocts
-diff --git a/drivers/isdn/i4l/isdn_net.c b/drivers/isdn/i4l/isdn_net.c
-index 90b56ed..5ed3305 100644
---- a/drivers/isdn/i4l/isdn_net.c
-+++ b/drivers/isdn/i4l/isdn_net.c
-@@ -1902,7 +1902,7 @@ static int isdn_net_header(struct sk_buff *skb, struct net_device *dev,
- {
- isdn_net_local *lp = netdev_priv(dev);
- unsigned char *p;
-- ushort len = 0;
-+ int len = 0;
-
- switch (lp->p_encap) {
- case ISDN_NET_ENCAP_ETHER:
-diff --git a/drivers/isdn/icn/icn.c b/drivers/isdn/icn/icn.c
-index bf7997a..cf091db 100644
---- a/drivers/isdn/icn/icn.c
-+++ b/drivers/isdn/icn/icn.c
-@@ -1044,7 +1044,7 @@ icn_writecmd(const u_char * buf, int len, int user, icn_card * card)
- if (count > len)
- count = len;
- if (user) {
-- if (copy_from_user(msg, buf, count))
-+ if (count > sizeof msg || copy_from_user(msg, buf, count))
- return -EFAULT;
- } else
- memcpy(msg, buf, count);
-diff --git a/drivers/isdn/isdnloop/isdnloop.c b/drivers/isdn/isdnloop/isdnloop.c
-index 22446f7..5396ea6 100644
---- a/drivers/isdn/isdnloop/isdnloop.c
-+++ b/drivers/isdn/isdnloop/isdnloop.c
-@@ -1083,7 +1083,7 @@ isdnloop_start(isdnloop_card * card, isdnloop_sdef * sdefp)
- return -ENOMEM;
- }
- for (i = 0; i < 3; i++)
-- strcpy(card->s0num[i], sdef.num[i]);
-+ strlcpy(card->s0num[i], sdef.num[i], sizeof(card->s0num[0]));
- break;
- case ISDN_PTYPE_1TR6:
- if (isdnloop_fake(card, "DRV1.04TC-1TR6-CAPI-CNS-BASIS-29.11.95",
-@@ -1096,7 +1096,7 @@ isdnloop_start(isdnloop_card * card, isdnloop_sdef * sdefp)
- spin_unlock_irqrestore(&card->isdnloop_lock, flags);
- return -ENOMEM;
- }
-- strcpy(card->s0num[0], sdef.num[0]);
-+ strlcpy(card->s0num[0], sdef.num[0], sizeof(card->s0num[0]));
- card->s0num[1][0] = '\0';
- card->s0num[2][0] = '\0';
- break;
-diff --git a/drivers/isdn/mISDN/socket.c b/drivers/isdn/mISDN/socket.c
-index feb0fa4..f76f830 100644
---- a/drivers/isdn/mISDN/socket.c
-+++ b/drivers/isdn/mISDN/socket.c
-@@ -391,6 +391,7 @@ data_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
- if (dev) {
- struct mISDN_devinfo di;
-
-+ memset(&di, 0, sizeof(di));
- di.id = dev->id;
- di.Dprotocols = dev->Dprotocols;
- di.Bprotocols = dev->Bprotocols | get_all_Bprotocols();
-@@ -671,6 +672,7 @@ base_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
- if (dev) {
- struct mISDN_devinfo di;
-
-+ memset(&di, 0, sizeof(di));
- di.id = dev->id;
- di.Dprotocols = dev->Dprotocols;
- di.Bprotocols = dev->Bprotocols | get_all_Bprotocols();
-diff --git a/drivers/isdn/sc/interrupt.c b/drivers/isdn/sc/interrupt.c
-index 485be8b..f0225bc 100644
---- a/drivers/isdn/sc/interrupt.c
-+++ b/drivers/isdn/sc/interrupt.c
-@@ -112,11 +112,19 @@ irqreturn_t interrupt_handler(int dummy, void *card_inst)
- }
- else if(callid>=0x0000 && callid<=0x7FFF)
- {
-+ int len;
-+
- pr_debug("%s: Got Incoming Call\n",
- sc_adapter[card]->devicename);
-- strcpy(setup.phone,&(rcvmsg.msg_data.byte_array[4]));
-- strcpy(setup.eazmsn,
-- sc_adapter[card]->channel[rcvmsg.phy_link_no-1].dn);
-+ len = strlcpy(setup.phone, &(rcvmsg.msg_data.byte_array[4]),
-+ sizeof(setup.phone));
-+ if (len >= sizeof(setup.phone))
-+ continue;
-+ len = strlcpy(setup.eazmsn,
-+ sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn,
-+ sizeof(setup.eazmsn));
-+ if (len >= sizeof(setup.eazmsn))
-+ continue;
- setup.si1 = 7;
- setup.si2 = 0;
- setup.plan = 0;
-@@ -176,7 +184,9 @@ irqreturn_t interrupt_handler(int dummy, void *card_inst)
- * Handle a GetMyNumber Rsp
- */
- if (IS_CE_MESSAGE(rcvmsg,Call,0,GetMyNumber)){
-- strcpy(sc_adapter[card]->channel[rcvmsg.phy_link_no-1].dn,rcvmsg.msg_data.byte_array);
-+ strlcpy(sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn,
-+ rcvmsg.msg_data.byte_array,
-+ sizeof(rcvmsg.msg_data.byte_array));
- continue;
- }
-
-diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c
-index 8744d24..d1f9a9a 100644
---- a/drivers/lguest/core.c
-+++ b/drivers/lguest/core.c
-@@ -91,9 +91,17 @@ static __init int map_switcher(void)
- * it's worked so far. The end address needs +1 because __get_vm_area
- * allocates an extra guard page, so we need space for that.
- */
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
-+ VM_ALLOC | VM_KERNEXEC, SWITCHER_ADDR, SWITCHER_ADDR
-+ + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
-+#else
- switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
- VM_ALLOC, SWITCHER_ADDR, SWITCHER_ADDR
- + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
-+#endif
-+
- if (!switcher_vma) {
- err = -ENOMEM;
- printk("lguest: could not map switcher pages high\n");
-@@ -118,7 +126,7 @@ static __init int map_switcher(void)
- * Now the Switcher is mapped at the right address, we can't fail!
- * Copy in the compiled-in Switcher code (from <arch>_switcher.S).
- */
-- memcpy(switcher_vma->addr, start_switcher_text,
-+ memcpy(switcher_vma->addr, ktla_ktva(start_switcher_text),
- end_switcher_text - start_switcher_text);
-
- printk(KERN_INFO "lguest: mapped switcher at %p\n",
-diff --git a/drivers/lguest/x86/core.c b/drivers/lguest/x86/core.c
-index 6ae3888..8b38145 100644
---- a/drivers/lguest/x86/core.c
-+++ b/drivers/lguest/x86/core.c
-@@ -59,7 +59,7 @@ static struct {
- /* Offset from where switcher.S was compiled to where we've copied it */
- static unsigned long switcher_offset(void)
- {
-- return SWITCHER_ADDR - (unsigned long)start_switcher_text;
-+ return SWITCHER_ADDR - (unsigned long)ktla_ktva(start_switcher_text);
- }
-
- /* This cpu's struct lguest_pages. */
-@@ -100,7 +100,13 @@ static void copy_in_guest_info(struct lg_cpu *cpu, struct lguest_pages *pages)
- * These copies are pretty cheap, so we do them unconditionally: */
- /* Save the current Host top-level page directory.
- */
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ pages->state.host_cr3 = read_cr3();
-+#else
- pages->state.host_cr3 = __pa(current->mm->pgd);
-+#endif
-+
- /*
- * Set up the Guest's page tables to see this CPU's pages (and no
- * other CPU's pages).
-@@ -535,7 +541,7 @@ void __init lguest_arch_host_init(void)
- * compiled-in switcher code and the high-mapped copy we just made.
- */
- for (i = 0; i < IDT_ENTRIES; i++)
-- default_idt_entries[i] += switcher_offset();
-+ default_idt_entries[i] = ktla_ktva(default_idt_entries[i]) + switcher_offset();
-
- /*
- * Set up the Switcher's per-cpu areas.
-@@ -618,7 +624,7 @@ void __init lguest_arch_host_init(void)
- * it will be undisturbed when we switch. To change %cs and jump we
- * need this structure to feed to Intel's "lcall" instruction.
- */
-- lguest_entry.offset = (long)switch_to_guest + switcher_offset();
-+ lguest_entry.offset = (long)ktla_ktva(switch_to_guest) + switcher_offset();
- lguest_entry.segment = LGUEST_CS;
-
- /*
-diff --git a/drivers/lguest/x86/switcher_32.S b/drivers/lguest/x86/switcher_32.S
-index 40634b0..4f5855e 100644
---- a/drivers/lguest/x86/switcher_32.S
-+++ b/drivers/lguest/x86/switcher_32.S
-@@ -87,6 +87,7 @@
- #include <asm/page.h>
- #include <asm/segment.h>
- #include <asm/lguest.h>
-+#include <asm/processor-flags.h>
-
- // We mark the start of the code to copy
- // It's placed in .text tho it's never run here
-@@ -149,6 +150,13 @@ ENTRY(switch_to_guest)
- // Changes type when we load it: damn Intel!
- // For after we switch over our page tables
- // That entry will be read-only: we'd crash.
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ mov %cr0, %edx
-+ xor $X86_CR0_WP, %edx
-+ mov %edx, %cr0
-+#endif
-+
- movl $(GDT_ENTRY_TSS*8), %edx
- ltr %dx
-
-@@ -157,9 +165,15 @@ ENTRY(switch_to_guest)
- // Let's clear it again for our return.
- // The GDT descriptor of the Host
- // Points to the table after two "size" bytes
-- movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %edx
-+ movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %eax
- // Clear "used" from type field (byte 5, bit 2)
-- andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%edx)
-+ andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%eax)
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ mov %cr0, %eax
-+ xor $X86_CR0_WP, %eax
-+ mov %eax, %cr0
-+#endif
-
- // Once our page table's switched, the Guest is live!
- // The Host fades as we run this final step.
-@@ -295,13 +309,12 @@ deliver_to_host:
- // I consulted gcc, and it gave
- // These instructions, which I gladly credit:
- leal (%edx,%ebx,8), %eax
-- movzwl (%eax),%edx
-- movl 4(%eax), %eax
-- xorw %ax, %ax
-- orl %eax, %edx
-+ movl 4(%eax), %edx
-+ movw (%eax), %dx
- // Now the address of the handler's in %edx
- // We call it now: its "iret" drops us home.
-- jmp *%edx
-+ ljmp $__KERNEL_CS, $1f
-+1: jmp *%edx
-
- // Every interrupt can come to us here
- // But we must truly tell each apart.
-diff --git a/drivers/macintosh/macio_asic.c b/drivers/macintosh/macio_asic.c
-index 588a5b0..b71db89 100644
---- a/drivers/macintosh/macio_asic.c
-+++ b/drivers/macintosh/macio_asic.c
-@@ -701,7 +701,7 @@ static void __devexit macio_pci_remove(struct pci_dev* pdev)
- * MacIO is matched against any Apple ID, it's probe() function
- * will then decide wether it applies or not
- */
--static const struct pci_device_id __devinitdata pci_ids [] = { {
-+static const struct pci_device_id __devinitconst pci_ids [] = { {
- .vendor = PCI_VENDOR_ID_APPLE,
- .device = PCI_ANY_ID,
- .subvendor = PCI_ANY_ID,
-diff --git a/drivers/macintosh/via-pmu-backlight.c b/drivers/macintosh/via-pmu-backlight.c
-index a348bb0..ecd9b3f 100644
---- a/drivers/macintosh/via-pmu-backlight.c
-+++ b/drivers/macintosh/via-pmu-backlight.c
-@@ -15,7 +15,7 @@
-
- #define MAX_PMU_LEVEL 0xFF
-
--static struct backlight_ops pmu_backlight_data;
-+static const struct backlight_ops pmu_backlight_data;
- static DEFINE_SPINLOCK(pmu_backlight_lock);
- static int sleeping, uses_pmu_bl;
- static u8 bl_curve[FB_BACKLIGHT_LEVELS];
-@@ -115,7 +115,7 @@ static int pmu_backlight_get_brightness(struct backlight_device *bd)
- return bd->props.brightness;
- }
-
--static struct backlight_ops pmu_backlight_data = {
-+static const struct backlight_ops pmu_backlight_data = {
- .get_brightness = pmu_backlight_get_brightness,
- .update_status = pmu_backlight_update_status,
-
-diff --git a/drivers/macintosh/via-pmu.c b/drivers/macintosh/via-pmu.c
-index 6f308a4..b5f7ff7 100644
---- a/drivers/macintosh/via-pmu.c
-+++ b/drivers/macintosh/via-pmu.c
-@@ -2232,7 +2232,7 @@ static int pmu_sleep_valid(suspend_state_t state)
- && (pmac_call_feature(PMAC_FTR_SLEEP_STATE, NULL, 0, -1) >= 0);
- }
-
--static struct platform_suspend_ops pmu_pm_ops = {
-+static const struct platform_suspend_ops pmu_pm_ops = {
- .enter = powerbook_sleep,
- .valid = pmu_sleep_valid,
- };
-diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
-index 818b617..4656e38 100644
---- a/drivers/md/dm-ioctl.c
-+++ b/drivers/md/dm-ioctl.c
-@@ -1437,7 +1437,7 @@ static int validate_params(uint cmd, struct dm_ioctl *param)
- cmd == DM_LIST_VERSIONS_CMD)
- return 0;
-
-- if ((cmd == DM_DEV_CREATE_CMD)) {
-+ if (cmd == DM_DEV_CREATE_CMD) {
- if (!*param->name) {
- DMWARN("name not supplied when creating device");
- return -EINVAL;
-diff --git a/drivers/md/dm-log-userspace-transfer.c b/drivers/md/dm-log-userspace-transfer.c
-index f1c8cae..59f0822 100644
---- a/drivers/md/dm-log-userspace-transfer.c
-+++ b/drivers/md/dm-log-userspace-transfer.c
-@@ -133,7 +133,7 @@ static void cn_ulog_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
- {
- struct dm_ulog_request *tfr = (struct dm_ulog_request *)(msg + 1);
-
-- if (!cap_raised(nsp->eff_cap, CAP_SYS_ADMIN))
-+ if (!capable(CAP_SYS_ADMIN))
- return;
-
- spin_lock(&receiving_list_lock);
-diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
-index 6021d0a..a878643 100644
---- a/drivers/md/dm-raid1.c
-+++ b/drivers/md/dm-raid1.c
-@@ -41,7 +41,7 @@ enum dm_raid1_error {
-
- struct mirror {
- struct mirror_set *ms;
-- atomic_t error_count;
-+ atomic_unchecked_t error_count;
- unsigned long error_type;
- struct dm_dev *dev;
- sector_t offset;
-@@ -203,7 +203,7 @@ static void fail_mirror(struct mirror *m, enum dm_raid1_error error_type)
- * simple way to tell if a device has encountered
- * errors.
- */
-- atomic_inc(&m->error_count);
-+ atomic_inc_unchecked(&m->error_count);
-
- if (test_and_set_bit(error_type, &m->error_type))
- return;
-@@ -225,7 +225,7 @@ static void fail_mirror(struct mirror *m, enum dm_raid1_error error_type)
- }
-
- for (new = ms->mirror; new < ms->mirror + ms->nr_mirrors; new++)
-- if (!atomic_read(&new->error_count)) {
-+ if (!atomic_read_unchecked(&new->error_count)) {
- set_default_mirror(new);
- break;
- }
-@@ -363,7 +363,7 @@ static struct mirror *choose_mirror(struct mirror_set *ms, sector_t sector)
- struct mirror *m = get_default_mirror(ms);
-
- do {
-- if (likely(!atomic_read(&m->error_count)))
-+ if (likely(!atomic_read_unchecked(&m->error_count)))
- return m;
-
- if (m-- == ms->mirror)
-@@ -377,7 +377,7 @@ static int default_ok(struct mirror *m)
- {
- struct mirror *default_mirror = get_default_mirror(m->ms);
-
-- return !atomic_read(&default_mirror->error_count);
-+ return !atomic_read_unchecked(&default_mirror->error_count);
- }
-
- static int mirror_available(struct mirror_set *ms, struct bio *bio)
-@@ -484,7 +484,7 @@ static void do_reads(struct mirror_set *ms, struct bio_list *reads)
- */
- if (likely(region_in_sync(ms, region, 1)))
- m = choose_mirror(ms, bio->bi_sector);
-- else if (m && atomic_read(&m->error_count))
-+ else if (m && atomic_read_unchecked(&m->error_count))
- m = NULL;
-
- if (likely(m))
-@@ -855,7 +855,7 @@ static int get_mirror(struct mirror_set *ms, struct dm_target *ti,
- }
-
- ms->mirror[mirror].ms = ms;
-- atomic_set(&(ms->mirror[mirror].error_count), 0);
-+ atomic_set_unchecked(&(ms->mirror[mirror].error_count), 0);
- ms->mirror[mirror].error_type = 0;
- ms->mirror[mirror].offset = offset;
-
-@@ -1241,7 +1241,7 @@ static void mirror_resume(struct dm_target *ti)
- */
- static char device_status_char(struct mirror *m)
- {
-- if (!atomic_read(&(m->error_count)))
-+ if (!atomic_read_unchecked(&(m->error_count)))
- return 'A';
-
- return (test_bit(DM_RAID1_WRITE_ERROR, &(m->error_type))) ? 'D' :
-diff --git a/drivers/md/dm-stripe.c b/drivers/md/dm-stripe.c
-index bd58703..9f26571 100644
---- a/drivers/md/dm-stripe.c
-+++ b/drivers/md/dm-stripe.c
-@@ -20,7 +20,7 @@ struct stripe {
- struct dm_dev *dev;
- sector_t physical_start;
-
-- atomic_t error_count;
-+ atomic_unchecked_t error_count;
- };
-
- struct stripe_c {
-@@ -188,7 +188,7 @@ static int stripe_ctr(struct dm_target *ti, unsigned int argc, char **argv)
- kfree(sc);
- return r;
- }
-- atomic_set(&(sc->stripe[i].error_count), 0);
-+ atomic_set_unchecked(&(sc->stripe[i].error_count), 0);
- }
-
- ti->private = sc;
-@@ -257,7 +257,7 @@ static int stripe_status(struct dm_target *ti,
- DMEMIT("%d ", sc->stripes);
- for (i = 0; i < sc->stripes; i++) {
- DMEMIT("%s ", sc->stripe[i].dev->name);
-- buffer[i] = atomic_read(&(sc->stripe[i].error_count)) ?
-+ buffer[i] = atomic_read_unchecked(&(sc->stripe[i].error_count)) ?
- 'D' : 'A';
- }
- buffer[i] = '\0';
-@@ -304,8 +304,8 @@ static int stripe_end_io(struct dm_target *ti, struct bio *bio,
- */
- for (i = 0; i < sc->stripes; i++)
- if (!strcmp(sc->stripe[i].dev->name, major_minor)) {
-- atomic_inc(&(sc->stripe[i].error_count));
-- if (atomic_read(&(sc->stripe[i].error_count)) <
-+ atomic_inc_unchecked(&(sc->stripe[i].error_count));
-+ if (atomic_read_unchecked(&(sc->stripe[i].error_count)) <
- DM_IO_ERROR_THRESHOLD)
- queue_work(kstriped, &sc->kstriped_ws);
- }
-diff --git a/drivers/md/dm-sysfs.c b/drivers/md/dm-sysfs.c
-index 4b04590..13a77b2 100644
---- a/drivers/md/dm-sysfs.c
-+++ b/drivers/md/dm-sysfs.c
-@@ -75,7 +75,7 @@ static struct attribute *dm_attrs[] = {
- NULL,
- };
-
--static struct sysfs_ops dm_sysfs_ops = {
-+static const struct sysfs_ops dm_sysfs_ops = {
- .show = dm_attr_show,
- };
-
-diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
-index 03345bb..332250d 100644
---- a/drivers/md/dm-table.c
-+++ b/drivers/md/dm-table.c
-@@ -376,7 +376,7 @@ static int device_area_is_invalid(struct dm_target *ti, struct dm_dev *dev,
- if (!dev_size)
- return 0;
-
-- if ((start >= dev_size) || (start + len > dev_size)) {
-+ if ((start >= dev_size) || (len > dev_size - start)) {
- DMWARN("%s: %s too small for target: "
- "start=%llu, len=%llu, dev_size=%llu",
- dm_device_name(ti->table->md), bdevname(bdev, b),
-diff --git a/drivers/md/dm.c b/drivers/md/dm.c
-index c988ac2..c418141 100644
---- a/drivers/md/dm.c
-+++ b/drivers/md/dm.c
-@@ -165,9 +165,9 @@ struct mapped_device {
- /*
- * Event handling.
- */
-- atomic_t event_nr;
-+ atomic_unchecked_t event_nr;
- wait_queue_head_t eventq;
-- atomic_t uevent_seq;
-+ atomic_unchecked_t uevent_seq;
- struct list_head uevent_list;
- spinlock_t uevent_lock; /* Protect access to uevent_list */
-
-@@ -1776,8 +1776,8 @@ static struct mapped_device *alloc_dev(int minor)
- rwlock_init(&md->map_lock);
- atomic_set(&md->holders, 1);
- atomic_set(&md->open_count, 0);
-- atomic_set(&md->event_nr, 0);
-- atomic_set(&md->uevent_seq, 0);
-+ atomic_set_unchecked(&md->event_nr, 0);
-+ atomic_set_unchecked(&md->uevent_seq, 0);
- INIT_LIST_HEAD(&md->uevent_list);
- spin_lock_init(&md->uevent_lock);
-
-@@ -1927,7 +1927,7 @@ static void event_callback(void *context)
-
- dm_send_uevents(&uevents, &disk_to_dev(md->disk)->kobj);
-
-- atomic_inc(&md->event_nr);
-+ atomic_inc_unchecked(&md->event_nr);
- wake_up(&md->eventq);
- }
-
-@@ -2562,18 +2562,18 @@ void dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
-
- uint32_t dm_next_uevent_seq(struct mapped_device *md)
- {
-- return atomic_add_return(1, &md->uevent_seq);
-+ return atomic_add_return_unchecked(1, &md->uevent_seq);
- }
-
- uint32_t dm_get_event_nr(struct mapped_device *md)
- {
-- return atomic_read(&md->event_nr);
-+ return atomic_read_unchecked(&md->event_nr);
- }
-
- int dm_wait_event(struct mapped_device *md, int event_nr)
- {
- return wait_event_interruptible(md->eventq,
-- (event_nr != atomic_read(&md->event_nr)));
-+ (event_nr != atomic_read_unchecked(&md->event_nr)));
- }
-
- void dm_uevent_add(struct mapped_device *md, struct list_head *elist)
-diff --git a/drivers/md/md.c b/drivers/md/md.c
-index 4ce6e2f..7a9530a 100644
---- a/drivers/md/md.c
-+++ b/drivers/md/md.c
-@@ -153,10 +153,10 @@ static int start_readonly;
- * start build, activate spare
- */
- static DECLARE_WAIT_QUEUE_HEAD(md_event_waiters);
--static atomic_t md_event_count;
-+static atomic_unchecked_t md_event_count;
- void md_new_event(mddev_t *mddev)
- {
-- atomic_inc(&md_event_count);
-+ atomic_inc_unchecked(&md_event_count);
- wake_up(&md_event_waiters);
- }
- EXPORT_SYMBOL_GPL(md_new_event);
-@@ -166,7 +166,7 @@ EXPORT_SYMBOL_GPL(md_new_event);
- */
- static void md_new_event_inintr(mddev_t *mddev)
- {
-- atomic_inc(&md_event_count);
-+ atomic_inc_unchecked(&md_event_count);
- wake_up(&md_event_waiters);
- }
-
-@@ -1226,7 +1226,7 @@ static int super_1_load(mdk_rdev_t *rdev, mdk_rdev_t *refdev, int minor_version)
-
- rdev->preferred_minor = 0xffff;
- rdev->data_offset = le64_to_cpu(sb->data_offset);
-- atomic_set(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
-+ atomic_set_unchecked(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
-
- rdev->sb_size = le32_to_cpu(sb->max_dev) * 2 + 256;
- bmask = queue_logical_block_size(rdev->bdev->bd_disk->queue)-1;
-@@ -1400,7 +1400,7 @@ static void super_1_sync(mddev_t *mddev, mdk_rdev_t *rdev)
- else
- sb->resync_offset = cpu_to_le64(0);
-
-- sb->cnt_corrected_read = cpu_to_le32(atomic_read(&rdev->corrected_errors));
-+ sb->cnt_corrected_read = cpu_to_le32(atomic_read_unchecked(&rdev->corrected_errors));
-
- sb->raid_disks = cpu_to_le32(mddev->raid_disks);
- sb->size = cpu_to_le64(mddev->dev_sectors);
-@@ -2222,7 +2222,7 @@ __ATTR(state, S_IRUGO|S_IWUSR, state_show, state_store);
- static ssize_t
- errors_show(mdk_rdev_t *rdev, char *page)
- {
-- return sprintf(page, "%d\n", atomic_read(&rdev->corrected_errors));
-+ return sprintf(page, "%d\n", atomic_read_unchecked(&rdev->corrected_errors));
- }
-
- static ssize_t
-@@ -2231,7 +2231,7 @@ errors_store(mdk_rdev_t *rdev, const char *buf, size_t len)
- char *e;
- unsigned long n = simple_strtoul(buf, &e, 10);
- if (*buf && (*e == 0 || *e == '\n')) {
-- atomic_set(&rdev->corrected_errors, n);
-+ atomic_set_unchecked(&rdev->corrected_errors, n);
- return len;
- }
- return -EINVAL;
-@@ -2525,7 +2525,7 @@ static void rdev_free(struct kobject *ko)
- mdk_rdev_t *rdev = container_of(ko, mdk_rdev_t, kobj);
- kfree(rdev);
- }
--static struct sysfs_ops rdev_sysfs_ops = {
-+static const struct sysfs_ops rdev_sysfs_ops = {
- .show = rdev_attr_show,
- .store = rdev_attr_store,
- };
-@@ -2574,8 +2574,8 @@ static mdk_rdev_t *md_import_device(dev_t newdev, int super_format, int super_mi
- rdev->data_offset = 0;
- rdev->sb_events = 0;
- atomic_set(&rdev->nr_pending, 0);
-- atomic_set(&rdev->read_errors, 0);
-- atomic_set(&rdev->corrected_errors, 0);
-+ atomic_set_unchecked(&rdev->read_errors, 0);
-+ atomic_set_unchecked(&rdev->corrected_errors, 0);
-
- size = rdev->bdev->bd_inode->i_size >> BLOCK_SIZE_BITS;
- if (!size) {
-@@ -3895,7 +3895,7 @@ static void md_free(struct kobject *ko)
- kfree(mddev);
- }
-
--static struct sysfs_ops md_sysfs_ops = {
-+static const struct sysfs_ops md_sysfs_ops = {
- .show = md_attr_show,
- .store = md_attr_store,
- };
-@@ -4482,7 +4482,8 @@ out:
- err = 0;
- blk_integrity_unregister(disk);
- md_new_event(mddev);
-- sysfs_notify_dirent(mddev->sysfs_state);
-+ if (mddev->sysfs_state)
-+ sysfs_notify_dirent(mddev->sysfs_state);
- return err;
- }
-
-@@ -5962,7 +5963,7 @@ static int md_seq_show(struct seq_file *seq, void *v)
-
- spin_unlock(&pers_lock);
- seq_printf(seq, "\n");
-- mi->event = atomic_read(&md_event_count);
-+ mi->event = atomic_read_unchecked(&md_event_count);
- return 0;
- }
- if (v == (void*)2) {
-@@ -6051,7 +6052,7 @@ static int md_seq_show(struct seq_file *seq, void *v)
- chunk_kb ? "KB" : "B");
- if (bitmap->file) {
- seq_printf(seq, ", file: ");
-- seq_path(seq, &bitmap->file->f_path, " \t\n");
-+ seq_path(seq, &bitmap->file->f_path, " \t\n\\");
- }
-
- seq_printf(seq, "\n");
-@@ -6085,7 +6086,7 @@ static int md_seq_open(struct inode *inode, struct file *file)
- else {
- struct seq_file *p = file->private_data;
- p->private = mi;
-- mi->event = atomic_read(&md_event_count);
-+ mi->event = atomic_read_unchecked(&md_event_count);
- }
- return error;
- }
-@@ -6101,7 +6102,7 @@ static unsigned int mdstat_poll(struct file *filp, poll_table *wait)
- /* always allow read */
- mask = POLLIN | POLLRDNORM;
-
-- if (mi->event != atomic_read(&md_event_count))
-+ if (mi->event != atomic_read_unchecked(&md_event_count))
- mask |= POLLERR | POLLPRI;
- return mask;
- }
-@@ -6145,7 +6146,7 @@ static int is_mddev_idle(mddev_t *mddev, int init)
- struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
- curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
- (int)part_stat_read(&disk->part0, sectors[1]) -
-- atomic_read(&disk->sync_io);
-+ atomic_read_unchecked(&disk->sync_io);
- /* sync IO will cause sync_io to increase before the disk_stats
- * as sync_io is counted when a request starts, and
- * disk_stats is counted when it completes.
-diff --git a/drivers/md/md.h b/drivers/md/md.h
-index 87430fe..0024a4c 100644
---- a/drivers/md/md.h
-+++ b/drivers/md/md.h
-@@ -94,10 +94,10 @@ struct mdk_rdev_s
- * only maintained for arrays that
- * support hot removal
- */
-- atomic_t read_errors; /* number of consecutive read errors that
-+ atomic_unchecked_t read_errors; /* number of consecutive read errors that
- * we have tried to ignore.
- */
-- atomic_t corrected_errors; /* number of corrected read errors,
-+ atomic_unchecked_t corrected_errors; /* number of corrected read errors,
- * for reporting to userspace and storing
- * in superblock.
- */
-@@ -304,7 +304,7 @@ static inline void rdev_dec_pending(mdk_rdev_t *rdev, mddev_t *mddev)
-
- static inline void md_sync_acct(struct block_device *bdev, unsigned long nr_sectors)
- {
-- atomic_add(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
-+ atomic_add_unchecked(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
- }
-
- struct mdk_personality
-diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
-index 968cb14b..f0ad2e4 100644
---- a/drivers/md/raid1.c
-+++ b/drivers/md/raid1.c
-@@ -1415,7 +1415,7 @@ static void sync_request_write(mddev_t *mddev, r1bio_t *r1_bio)
- if (r1_bio->bios[d]->bi_end_io != end_sync_read)
- continue;
- rdev = conf->mirrors[d].rdev;
-- atomic_add(s, &rdev->corrected_errors);
-+ atomic_add_unchecked(s, &rdev->corrected_errors);
- if (sync_page_io(rdev->bdev,
- sect + rdev->data_offset,
- s<<9,
-@@ -1564,7 +1564,7 @@ static void fix_read_error(conf_t *conf, int read_disk,
- /* Well, this device is dead */
- md_error(mddev, rdev);
- else {
-- atomic_add(s, &rdev->corrected_errors);
-+ atomic_add_unchecked(s, &rdev->corrected_errors);
- printk(KERN_INFO
- "raid1:%s: read error corrected "
- "(%d sectors at %llu on %s)\n",
-diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
-index 1b4e232..cf0f534b 100644
---- a/drivers/md/raid10.c
-+++ b/drivers/md/raid10.c
-@@ -1255,7 +1255,7 @@ static void end_sync_read(struct bio *bio, int error)
- if (test_bit(BIO_UPTODATE, &bio->bi_flags))
- set_bit(R10BIO_Uptodate, &r10_bio->state);
- else {
-- atomic_add(r10_bio->sectors,
-+ atomic_add_unchecked(r10_bio->sectors,
- &conf->mirrors[d].rdev->corrected_errors);
- if (!test_bit(MD_RECOVERY_SYNC, &conf->mddev->recovery))
- md_error(r10_bio->mddev,
-@@ -1520,7 +1520,7 @@ static void fix_read_error(conf_t *conf, mddev_t *mddev, r10bio_t *r10_bio)
- test_bit(In_sync, &rdev->flags)) {
- atomic_inc(&rdev->nr_pending);
- rcu_read_unlock();
-- atomic_add(s, &rdev->corrected_errors);
-+ atomic_add_unchecked(s, &rdev->corrected_errors);
- if (sync_page_io(rdev->bdev,
- r10_bio->devs[sl].addr +
- sect + rdev->data_offset,
-diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
-index 883215d..675bf47 100644
---- a/drivers/md/raid5.c
-+++ b/drivers/md/raid5.c
-@@ -482,7 +482,7 @@ static void ops_run_io(struct stripe_head *sh, struct stripe_head_state *s)
- bi->bi_next = NULL;
- if ((rw & WRITE) &&
- test_bit(R5_ReWrite, &sh->dev[i].flags))
-- atomic_add(STRIPE_SECTORS,
-+ atomic_add_unchecked(STRIPE_SECTORS,
- &rdev->corrected_errors);
- generic_make_request(bi);
- } else {
-@@ -1517,15 +1517,15 @@ static void raid5_end_read_request(struct bio * bi, int error)
- clear_bit(R5_ReadError, &sh->dev[i].flags);
- clear_bit(R5_ReWrite, &sh->dev[i].flags);
- }
-- if (atomic_read(&conf->disks[i].rdev->read_errors))
-- atomic_set(&conf->disks[i].rdev->read_errors, 0);
-+ if (atomic_read_unchecked(&conf->disks[i].rdev->read_errors))
-+ atomic_set_unchecked(&conf->disks[i].rdev->read_errors, 0);
- } else {
- const char *bdn = bdevname(conf->disks[i].rdev->bdev, b);
- int retry = 0;
- rdev = conf->disks[i].rdev;
-
- clear_bit(R5_UPTODATE, &sh->dev[i].flags);
-- atomic_inc(&rdev->read_errors);
-+ atomic_inc_unchecked(&rdev->read_errors);
- if (conf->mddev->degraded >= conf->max_degraded)
- printk_rl(KERN_WARNING
- "raid5:%s: read error not correctable "
-@@ -1543,7 +1543,7 @@ static void raid5_end_read_request(struct bio * bi, int error)
- (unsigned long long)(sh->sector
- + rdev->data_offset),
- bdn);
-- else if (atomic_read(&rdev->read_errors)
-+ else if (atomic_read_unchecked(&rdev->read_errors)
- > conf->max_nr_stripes)
- printk(KERN_WARNING
- "raid5:%s: Too many read errors, failing device %s.\n",
-@@ -1870,6 +1870,7 @@ static sector_t compute_blocknr(struct stripe_head *sh, int i, int previous)
- sector_t r_sector;
- struct stripe_head sh2;
-
-+ pax_track_stack();
-
- chunk_offset = sector_div(new_sector, sectors_per_chunk);
- stripe = new_sector;
-diff --git a/drivers/media/common/saa7146_hlp.c b/drivers/media/common/saa7146_hlp.c
-index 05bde9c..2f31d40 100644
---- a/drivers/media/common/saa7146_hlp.c
-+++ b/drivers/media/common/saa7146_hlp.c
-@@ -353,6 +353,8 @@ static void calculate_clipping_registers_rect(struct saa7146_dev *dev, struct sa
-
- int x[32], y[32], w[32], h[32];
-
-+ pax_track_stack();
-+
- /* clear out memory */
- memset(&line_list[0], 0x00, sizeof(u32)*32);
- memset(&pixel_list[0], 0x00, sizeof(u32)*32);
-diff --git a/drivers/media/dvb/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
-index cb22da5..82b686e 100644
---- a/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
-+++ b/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
-@@ -590,6 +590,8 @@ static int dvb_ca_en50221_read_data(struct dvb_ca_private *ca, int slot, u8 * eb
- u8 buf[HOST_LINK_BUF_SIZE];
- int i;
-
-+ pax_track_stack();
-+
- dprintk("%s\n", __func__);
-
- /* check if we have space for a link buf in the rx_buffer */
-@@ -1285,6 +1287,8 @@ static ssize_t dvb_ca_en50221_io_write(struct file *file,
- unsigned long timeout;
- int written;
-
-+ pax_track_stack();
-+
- dprintk("%s\n", __func__);
-
- /* Incoming packet has a 2 byte header. hdr[0] = slot_id, hdr[1] = connection_id */
-diff --git a/drivers/media/dvb/dvb-core/dvbdev.c b/drivers/media/dvb/dvb-core/dvbdev.c
-index 94159b9..376bd8e 100644
---- a/drivers/media/dvb/dvb-core/dvbdev.c
-+++ b/drivers/media/dvb/dvb-core/dvbdev.c
-@@ -191,7 +191,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev,
- const struct dvb_device *template, void *priv, int type)
- {
- struct dvb_device *dvbdev;
-- struct file_operations *dvbdevfops;
-+ file_operations_no_const *dvbdevfops;
- struct device *clsdev;
- int minor;
- int id;
-diff --git a/drivers/media/dvb/dvb-usb/cxusb.c b/drivers/media/dvb/dvb-usb/cxusb.c
-index 2a53dd0..db8c07a 100644
---- a/drivers/media/dvb/dvb-usb/cxusb.c
-+++ b/drivers/media/dvb/dvb-usb/cxusb.c
-@@ -1040,7 +1040,7 @@ static struct dib0070_config dib7070p_dib0070_config = {
- struct dib0700_adapter_state {
- int (*set_param_save) (struct dvb_frontend *,
- struct dvb_frontend_parameters *);
--};
-+} __no_const;
-
- static int dib7070_set_param_override(struct dvb_frontend *fe,
- struct dvb_frontend_parameters *fep)
-diff --git a/drivers/media/dvb/dvb-usb/dib0700_core.c b/drivers/media/dvb/dvb-usb/dib0700_core.c
-index db7f7f7..f55e96f 100644
---- a/drivers/media/dvb/dvb-usb/dib0700_core.c
-+++ b/drivers/media/dvb/dvb-usb/dib0700_core.c
-@@ -332,6 +332,8 @@ int dib0700_download_firmware(struct usb_device *udev, const struct firmware *fw
-
- u8 buf[260];
-
-+ pax_track_stack();
-+
- while ((ret = dvb_usb_get_hexline(fw, &hx, &pos)) > 0) {
- deb_fwdata("writing to address 0x%08x (buffer: 0x%02x %02x)\n",hx.addr, hx.len, hx.chk);
-
-diff --git a/drivers/media/dvb/dvb-usb/dib0700_devices.c b/drivers/media/dvb/dvb-usb/dib0700_devices.c
-index 524acf5..5ffc403 100644
---- a/drivers/media/dvb/dvb-usb/dib0700_devices.c
-+++ b/drivers/media/dvb/dvb-usb/dib0700_devices.c
-@@ -28,7 +28,7 @@ MODULE_PARM_DESC(force_lna_activation, "force the activation of Low-Noise-Amplif
-
- struct dib0700_adapter_state {
- int (*set_param_save) (struct dvb_frontend *, struct dvb_frontend_parameters *);
--};
-+} __no_const;
-
- /* Hauppauge Nova-T 500 (aka Bristol)
- * has a LNA on GPIO0 which is enabled by setting 1 */
-diff --git a/drivers/media/dvb/frontends/dib3000.h b/drivers/media/dvb/frontends/dib3000.h
-index ba91735..4261d84 100644
---- a/drivers/media/dvb/frontends/dib3000.h
-+++ b/drivers/media/dvb/frontends/dib3000.h
-@@ -39,7 +39,7 @@ struct dib_fe_xfer_ops
- int (*fifo_ctrl)(struct dvb_frontend *fe, int onoff);
- int (*pid_ctrl)(struct dvb_frontend *fe, int index, int pid, int onoff);
- int (*tuner_pass_ctrl)(struct dvb_frontend *fe, int onoff, u8 pll_ctrl);
--};
-+} __no_const;
-
- #if defined(CONFIG_DVB_DIB3000MB) || (defined(CONFIG_DVB_DIB3000MB_MODULE) && defined(MODULE))
- extern struct dvb_frontend* dib3000mb_attach(const struct dib3000_config* config,
-diff --git a/drivers/media/dvb/frontends/or51211.c b/drivers/media/dvb/frontends/or51211.c
-index c709ce6..b3fe620 100644
---- a/drivers/media/dvb/frontends/or51211.c
-+++ b/drivers/media/dvb/frontends/or51211.c
-@@ -113,6 +113,8 @@ static int or51211_load_firmware (struct dvb_frontend* fe,
- u8 tudata[585];
- int i;
-
-+ pax_track_stack();
-+
- dprintk("Firmware is %zd bytes\n",fw->size);
-
- /* Get eprom data */
-diff --git a/drivers/media/radio/radio-cadet.c b/drivers/media/radio/radio-cadet.c
-index 482d0f3..ee1e202 100644
---- a/drivers/media/radio/radio-cadet.c
-+++ b/drivers/media/radio/radio-cadet.c
-@@ -347,7 +347,7 @@ static ssize_t cadet_read(struct file *file, char __user *data, size_t count, lo
- while (i < count && dev->rdsin != dev->rdsout)
- readbuf[i++] = dev->rdsbuf[dev->rdsout++];
-
-- if (copy_to_user(data, readbuf, i))
-+ if (i > sizeof readbuf || copy_to_user(data, readbuf, i))
- return -EFAULT;
- return i;
- }
-diff --git a/drivers/media/video/cx18/cx18-driver.c b/drivers/media/video/cx18/cx18-driver.c
-index 6dd51e2..0359b92 100644
---- a/drivers/media/video/cx18/cx18-driver.c
-+++ b/drivers/media/video/cx18/cx18-driver.c
-@@ -56,7 +56,7 @@ static struct pci_device_id cx18_pci_tbl[] __devinitdata = {
-
- MODULE_DEVICE_TABLE(pci, cx18_pci_tbl);
-
--static atomic_t cx18_instance = ATOMIC_INIT(0);
-+static atomic_unchecked_t cx18_instance = ATOMIC_INIT(0);
-
- /* Parameter declarations */
- static int cardtype[CX18_MAX_CARDS];
-@@ -288,6 +288,8 @@ void cx18_read_eeprom(struct cx18 *cx, struct tveeprom *tv)
- struct i2c_client c;
- u8 eedata[256];
-
-+ pax_track_stack();
-+
- memset(&c, 0, sizeof(c));
- strlcpy(c.name, "cx18 tveeprom tmp", sizeof(c.name));
- c.adapter = &cx->i2c_adap[0];
-@@ -800,7 +802,7 @@ static int __devinit cx18_probe(struct pci_dev *pci_dev,
- struct cx18 *cx;
-
- /* FIXME - module parameter arrays constrain max instances */
-- i = atomic_inc_return(&cx18_instance) - 1;
-+ i = atomic_inc_return_unchecked(&cx18_instance) - 1;
- if (i >= CX18_MAX_CARDS) {
- printk(KERN_ERR "cx18: cannot manage card %d, driver has a "
- "limit of 0 - %d\n", i, CX18_MAX_CARDS - 1);
-diff --git a/drivers/media/video/ivtv/ivtv-driver.c b/drivers/media/video/ivtv/ivtv-driver.c
-index 463ec34..2f4625a 100644
---- a/drivers/media/video/ivtv/ivtv-driver.c
-+++ b/drivers/media/video/ivtv/ivtv-driver.c
-@@ -79,7 +79,7 @@ static struct pci_device_id ivtv_pci_tbl[] __devinitdata = {
- MODULE_DEVICE_TABLE(pci,ivtv_pci_tbl);
-
- /* ivtv instance counter */
--static atomic_t ivtv_instance = ATOMIC_INIT(0);
-+static atomic_unchecked_t ivtv_instance = ATOMIC_INIT(0);
-
- /* Parameter declarations */
- static int cardtype[IVTV_MAX_CARDS];
-diff --git a/drivers/media/video/omap24xxcam.c b/drivers/media/video/omap24xxcam.c
-index 5fc4ac0..652a54a 100644
---- a/drivers/media/video/omap24xxcam.c
-+++ b/drivers/media/video/omap24xxcam.c
-@@ -401,7 +401,7 @@ static void omap24xxcam_vbq_complete(struct omap24xxcam_sgdma *sgdma,
- spin_unlock_irqrestore(&cam->core_enable_disable_lock, flags);
-
- do_gettimeofday(&vb->ts);
-- vb->field_count = atomic_add_return(2, &fh->field_count);
-+ vb->field_count = atomic_add_return_unchecked(2, &fh->field_count);
- if (csr & csr_error) {
- vb->state = VIDEOBUF_ERROR;
- if (!atomic_read(&fh->cam->in_reset)) {
-diff --git a/drivers/media/video/omap24xxcam.h b/drivers/media/video/omap24xxcam.h
-index 2ce67f5..cf26a5b 100644
---- a/drivers/media/video/omap24xxcam.h
-+++ b/drivers/media/video/omap24xxcam.h
-@@ -533,7 +533,7 @@ struct omap24xxcam_fh {
- spinlock_t vbq_lock; /* spinlock for the videobuf queue */
- struct videobuf_queue vbq;
- struct v4l2_pix_format pix; /* serialise pix by vbq->lock */
-- atomic_t field_count; /* field counter for videobuf_buffer */
-+ atomic_unchecked_t field_count; /* field counter for videobuf_buffer */
- /* accessing cam here doesn't need serialisation: it's constant */
- struct omap24xxcam_device *cam;
- };
-diff --git a/drivers/media/video/pvrusb2/pvrusb2-eeprom.c b/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
-index 299afa4..eb47459 100644
---- a/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
-+++ b/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
-@@ -119,6 +119,8 @@ int pvr2_eeprom_analyze(struct pvr2_hdw *hdw)
- u8 *eeprom;
- struct tveeprom tvdata;
-
-+ pax_track_stack();
-+
- memset(&tvdata,0,sizeof(tvdata));
-
- eeprom = pvr2_eeprom_fetch(hdw);
-diff --git a/drivers/media/video/saa7134/saa6752hs.c b/drivers/media/video/saa7134/saa6752hs.c
-index 1eabff6..8e2313a 100644
---- a/drivers/media/video/saa7134/saa6752hs.c
-+++ b/drivers/media/video/saa7134/saa6752hs.c
-@@ -683,6 +683,8 @@ static int saa6752hs_init(struct v4l2_subdev *sd, u32 leading_null_bytes)
- unsigned char localPAT[256];
- unsigned char localPMT[256];
-
-+ pax_track_stack();
-+
- /* Set video format - must be done first as it resets other settings */
- set_reg8(client, 0x41, h->video_format);
-
-diff --git a/drivers/media/video/saa7164/saa7164-cmd.c b/drivers/media/video/saa7164/saa7164-cmd.c
-index 9c1d3ac..b1b49e9 100644
---- a/drivers/media/video/saa7164/saa7164-cmd.c
-+++ b/drivers/media/video/saa7164/saa7164-cmd.c
-@@ -87,6 +87,8 @@ int saa7164_irq_dequeue(struct saa7164_dev *dev)
- wait_queue_head_t *q = 0;
- dprintk(DBGLVL_CMD, "%s()\n", __func__);
-
-+ pax_track_stack();
-+
- /* While any outstand message on the bus exists... */
- do {
-
-@@ -126,6 +128,8 @@ int saa7164_cmd_dequeue(struct saa7164_dev *dev)
- u8 tmp[512];
- dprintk(DBGLVL_CMD, "%s()\n", __func__);
-
-+ pax_track_stack();
-+
- while (loop) {
-
- tmComResInfo_t tRsp = { 0, 0, 0, 0, 0, 0 };
-diff --git a/drivers/media/video/usbvideo/ibmcam.c b/drivers/media/video/usbvideo/ibmcam.c
-index b085496..527b519 100644
---- a/drivers/media/video/usbvideo/ibmcam.c
-+++ b/drivers/media/video/usbvideo/ibmcam.c
-@@ -3947,7 +3947,7 @@ static struct usb_device_id id_table[] = {
- static int __init ibmcam_init(void)
- {
- struct usbvideo_cb cbTbl;
-- memset(&cbTbl, 0, sizeof(cbTbl));
-+ memset((void *)&cbTbl, 0, sizeof(cbTbl));
- cbTbl.probe = ibmcam_probe;
- cbTbl.setupOnOpen = ibmcam_setup_on_open;
- cbTbl.videoStart = ibmcam_video_start;
-diff --git a/drivers/media/video/usbvideo/konicawc.c b/drivers/media/video/usbvideo/konicawc.c
-index 31d57f2..aa5085d 100644
---- a/drivers/media/video/usbvideo/konicawc.c
-+++ b/drivers/media/video/usbvideo/konicawc.c
-@@ -225,7 +225,7 @@ static void konicawc_register_input(struct konicawc *cam, struct usb_device *dev
- int error;
-
- usb_make_path(dev, cam->input_physname, sizeof(cam->input_physname));
-- strncat(cam->input_physname, "/input0", sizeof(cam->input_physname));
-+ strlcat(cam->input_physname, "/input0", sizeof(cam->input_physname));
-
- cam->input = input_dev = input_allocate_device();
- if (!input_dev) {
-@@ -935,7 +935,7 @@ static int __init konicawc_init(void)
- struct usbvideo_cb cbTbl;
- printk(KERN_INFO KBUILD_MODNAME ": " DRIVER_VERSION ":"
- DRIVER_DESC "\n");
-- memset(&cbTbl, 0, sizeof(cbTbl));
-+ memset((void * )&cbTbl, 0, sizeof(cbTbl));
- cbTbl.probe = konicawc_probe;
- cbTbl.setupOnOpen = konicawc_setup_on_open;
- cbTbl.processData = konicawc_process_isoc;
-diff --git a/drivers/media/video/usbvideo/quickcam_messenger.c b/drivers/media/video/usbvideo/quickcam_messenger.c
-index 803d3e4..c4d1b96 100644
---- a/drivers/media/video/usbvideo/quickcam_messenger.c
-+++ b/drivers/media/video/usbvideo/quickcam_messenger.c
-@@ -89,7 +89,7 @@ static void qcm_register_input(struct qcm *cam, struct usb_device *dev)
- int error;
-
- usb_make_path(dev, cam->input_physname, sizeof(cam->input_physname));
-- strncat(cam->input_physname, "/input0", sizeof(cam->input_physname));
-+ strlcat(cam->input_physname, "/input0", sizeof(cam->input_physname));
-
- cam->input = input_dev = input_allocate_device();
- if (!input_dev) {
-diff --git a/drivers/media/video/usbvideo/usbvideo.c b/drivers/media/video/usbvideo/usbvideo.c
-index dea8b32..9c02650 100644
---- a/drivers/media/video/usbvideo/usbvideo.c
-+++ b/drivers/media/video/usbvideo/usbvideo.c
-@@ -697,7 +697,7 @@ int usbvideo_register(
- __func__, cams, base_size, num_cams);
-
- /* Copy callbacks, apply defaults for those that are not set */
-- memmove(&cams->cb, cbTbl, sizeof(cams->cb));
-+ memmove((void *)&cams->cb, cbTbl, sizeof(cams->cb));
- if (cams->cb.getFrame == NULL)
- cams->cb.getFrame = usbvideo_GetFrame;
- if (cams->cb.disconnect == NULL)
-diff --git a/drivers/media/video/usbvideo/usbvideo.h b/drivers/media/video/usbvideo/usbvideo.h
-index c66985b..7fa143a 100644
---- a/drivers/media/video/usbvideo/usbvideo.h
-+++ b/drivers/media/video/usbvideo/usbvideo.h
-@@ -268,7 +268,7 @@ struct usbvideo_cb {
- int (*startDataPump)(struct uvd *uvd);
- void (*stopDataPump)(struct uvd *uvd);
- int (*setVideoMode)(struct uvd *uvd, struct video_window *vw);
--};
-+} __no_const;
-
- struct usbvideo {
- int num_cameras; /* As allocated */
-diff --git a/drivers/media/video/usbvision/usbvision-core.c b/drivers/media/video/usbvision/usbvision-core.c
-index e0f91e4..37554ea 100644
---- a/drivers/media/video/usbvision/usbvision-core.c
-+++ b/drivers/media/video/usbvision/usbvision-core.c
-@@ -820,6 +820,8 @@ static enum ParseState usbvision_parse_compress(struct usb_usbvision *usbvision,
- unsigned char rv, gv, bv;
- static unsigned char *Y, *U, *V;
-
-+ pax_track_stack();
-+
- frame = usbvision->curFrame;
- imageSize = frame->frmwidth * frame->frmheight;
- if ( (frame->v4l2_format.format == V4L2_PIX_FMT_YUV422P) ||
-diff --git a/drivers/media/video/v4l2-device.c b/drivers/media/video/v4l2-device.c
-index 0d06e7c..3d17d24 100644
---- a/drivers/media/video/v4l2-device.c
-+++ b/drivers/media/video/v4l2-device.c
-@@ -50,9 +50,9 @@ int v4l2_device_register(struct device *dev, struct v4l2_device *v4l2_dev)
- EXPORT_SYMBOL_GPL(v4l2_device_register);
-
- int v4l2_device_set_name(struct v4l2_device *v4l2_dev, const char *basename,
-- atomic_t *instance)
-+ atomic_unchecked_t *instance)
- {
-- int num = atomic_inc_return(instance) - 1;
-+ int num = atomic_inc_return_unchecked(instance) - 1;
- int len = strlen(basename);
-
- if (basename[len - 1] >= '0' && basename[len - 1] <= '9')
-diff --git a/drivers/media/video/videobuf-dma-sg.c b/drivers/media/video/videobuf-dma-sg.c
-index 032ebae..6a3532c 100644
---- a/drivers/media/video/videobuf-dma-sg.c
-+++ b/drivers/media/video/videobuf-dma-sg.c
-@@ -693,6 +693,8 @@ void *videobuf_sg_alloc(size_t size)
- {
- struct videobuf_queue q;
-
-+ pax_track_stack();
-+
- /* Required to make generic handler to call __videobuf_alloc */
- q.int_ops = &sg_ops;
-
-diff --git a/drivers/message/fusion/mptbase.c b/drivers/message/fusion/mptbase.c
-index b6992b7..ff830bd 100644
---- a/drivers/message/fusion/mptbase.c
-+++ b/drivers/message/fusion/mptbase.c
-@@ -6710,7 +6710,12 @@ procmpt_iocinfo_read(char *buf, char **start, off_t offset, int request, int *eo
- len += sprintf(buf+len, " MinBlockSize = 0x%02x bytes\n", 4*ioc->facts.BlockSize);
-
- len += sprintf(buf+len, " RequestFrames @ 0x%p (Dma @ 0x%p)\n",
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL, NULL);
-+#else
- (void *)ioc->req_frames, (void *)(ulong)ioc->req_frames_dma);
-+#endif
-+
- /*
- * Rounding UP to nearest 4-kB boundary here...
- */
-@@ -6723,7 +6728,11 @@ procmpt_iocinfo_read(char *buf, char **start, off_t offset, int request, int *eo
- ioc->facts.GlobalCredits);
-
- len += sprintf(buf+len, " Frames @ 0x%p (Dma @ 0x%p)\n",
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL, NULL);
-+#else
- (void *)ioc->alloc, (void *)(ulong)ioc->alloc_dma);
-+#endif
- sz = (ioc->reply_sz * ioc->reply_depth) + 128;
- len += sprintf(buf+len, " {CurRepSz=%d} x {CurRepDepth=%d} = %d bytes ^= 0x%x\n",
- ioc->reply_sz, ioc->reply_depth, ioc->reply_sz*ioc->reply_depth, sz);
-diff --git a/drivers/message/fusion/mptsas.c b/drivers/message/fusion/mptsas.c
-index 83873e3..e360e9a 100644
---- a/drivers/message/fusion/mptsas.c
-+++ b/drivers/message/fusion/mptsas.c
-@@ -436,6 +436,23 @@ mptsas_is_end_device(struct mptsas_devinfo * attached)
- return 0;
- }
-
-+static inline void
-+mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
-+{
-+ if (phy_info->port_details) {
-+ phy_info->port_details->rphy = rphy;
-+ dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
-+ ioc->name, rphy));
-+ }
-+
-+ if (rphy) {
-+ dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
-+ &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
-+ dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
-+ ioc->name, rphy, rphy->dev.release));
-+ }
-+}
-+
- /* no mutex */
- static void
- mptsas_port_delete(MPT_ADAPTER *ioc, struct mptsas_portinfo_details * port_details)
-@@ -474,23 +491,6 @@ mptsas_get_rphy(struct mptsas_phyinfo *phy_info)
- return NULL;
- }
-
--static inline void
--mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
--{
-- if (phy_info->port_details) {
-- phy_info->port_details->rphy = rphy;
-- dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
-- ioc->name, rphy));
-- }
--
-- if (rphy) {
-- dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
-- &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
-- dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
-- ioc->name, rphy, rphy->dev.release));
-- }
--}
--
- static inline struct sas_port *
- mptsas_get_port(struct mptsas_phyinfo *phy_info)
- {
-diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c
-index bd096ca..332cf76 100644
---- a/drivers/message/fusion/mptscsih.c
-+++ b/drivers/message/fusion/mptscsih.c
-@@ -1248,15 +1248,16 @@ mptscsih_info(struct Scsi_Host *SChost)
-
- h = shost_priv(SChost);
-
-- if (h) {
-- if (h->info_kbuf == NULL)
-- if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
-- return h->info_kbuf;
-- h->info_kbuf[0] = '\0';
-+ if (!h)
-+ return NULL;
-
-- mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
-- h->info_kbuf[size-1] = '\0';
-- }
-+ if (h->info_kbuf == NULL)
-+ if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
-+ return h->info_kbuf;
-+ h->info_kbuf[0] = '\0';
-+
-+ mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
-+ h->info_kbuf[size-1] = '\0';
-
- return h->info_kbuf;
- }
-diff --git a/drivers/message/i2o/i2o_config.c b/drivers/message/i2o/i2o_config.c
-index efba702..59b2c0f 100644
---- a/drivers/message/i2o/i2o_config.c
-+++ b/drivers/message/i2o/i2o_config.c
-@@ -787,6 +787,8 @@ static int i2o_cfg_passthru(unsigned long arg)
- struct i2o_message *msg;
- unsigned int iop;
-
-+ pax_track_stack();
-+
- if (get_user(iop, &cmd->iop) || get_user(user_msg, &cmd->msg))
- return -EFAULT;
-
-diff --git a/drivers/message/i2o/i2o_proc.c b/drivers/message/i2o/i2o_proc.c
-index 7045c45..c07b170 100644
---- a/drivers/message/i2o/i2o_proc.c
-+++ b/drivers/message/i2o/i2o_proc.c
-@@ -259,13 +259,6 @@ static char *scsi_devices[] = {
- "Array Controller Device"
- };
-
--static char *chtostr(u8 * chars, int n)
--{
-- char tmp[256];
-- tmp[0] = 0;
-- return strncat(tmp, (char *)chars, n);
--}
--
- static int i2o_report_query_status(struct seq_file *seq, int block_status,
- char *group)
- {
-@@ -842,8 +835,7 @@ static int i2o_seq_show_ddm_table(struct seq_file *seq, void *v)
-
- seq_printf(seq, "%-#7x", ddm_table.i2o_vendor_id);
- seq_printf(seq, "%-#8x", ddm_table.module_id);
-- seq_printf(seq, "%-29s",
-- chtostr(ddm_table.module_name_version, 28));
-+ seq_printf(seq, "%-.28s", ddm_table.module_name_version);
- seq_printf(seq, "%9d ", ddm_table.data_size);
- seq_printf(seq, "%8d", ddm_table.code_size);
-
-@@ -944,8 +936,8 @@ static int i2o_seq_show_drivers_stored(struct seq_file *seq, void *v)
-
- seq_printf(seq, "%-#7x", dst->i2o_vendor_id);
- seq_printf(seq, "%-#8x", dst->module_id);
-- seq_printf(seq, "%-29s", chtostr(dst->module_name_version, 28));
-- seq_printf(seq, "%-9s", chtostr(dst->date, 8));
-+ seq_printf(seq, "%-.28s", dst->module_name_version);
-+ seq_printf(seq, "%-.8s", dst->date);
- seq_printf(seq, "%8d ", dst->module_size);
- seq_printf(seq, "%8d ", dst->mpb_size);
- seq_printf(seq, "0x%04x", dst->module_flags);
-@@ -1276,14 +1268,10 @@ static int i2o_seq_show_dev_identity(struct seq_file *seq, void *v)
- seq_printf(seq, "Device Class : %s\n", i2o_get_class_name(work16[0]));
- seq_printf(seq, "Owner TID : %0#5x\n", work16[2]);
- seq_printf(seq, "Parent TID : %0#5x\n", work16[3]);
-- seq_printf(seq, "Vendor info : %s\n",
-- chtostr((u8 *) (work32 + 2), 16));
-- seq_printf(seq, "Product info : %s\n",
-- chtostr((u8 *) (work32 + 6), 16));
-- seq_printf(seq, "Description : %s\n",
-- chtostr((u8 *) (work32 + 10), 16));
-- seq_printf(seq, "Product rev. : %s\n",
-- chtostr((u8 *) (work32 + 14), 8));
-+ seq_printf(seq, "Vendor info : %.16s\n", (u8 *) (work32 + 2));
-+ seq_printf(seq, "Product info : %.16s\n", (u8 *) (work32 + 6));
-+ seq_printf(seq, "Description : %.16s\n", (u8 *) (work32 + 10));
-+ seq_printf(seq, "Product rev. : %.8s\n", (u8 *) (work32 + 14));
-
- seq_printf(seq, "Serial number : ");
- print_serial_number(seq, (u8 *) (work32 + 16),
-@@ -1328,10 +1316,8 @@ static int i2o_seq_show_ddm_identity(struct seq_file *seq, void *v)
- }
-
- seq_printf(seq, "Registering DDM TID : 0x%03x\n", result.ddm_tid);
-- seq_printf(seq, "Module name : %s\n",
-- chtostr(result.module_name, 24));
-- seq_printf(seq, "Module revision : %s\n",
-- chtostr(result.module_rev, 8));
-+ seq_printf(seq, "Module name : %.24s\n", result.module_name);
-+ seq_printf(seq, "Module revision : %.8s\n", result.module_rev);
-
- seq_printf(seq, "Serial number : ");
- print_serial_number(seq, result.serial_number, sizeof(result) - 36);
-@@ -1362,14 +1348,10 @@ static int i2o_seq_show_uinfo(struct seq_file *seq, void *v)
- return 0;
- }
-
-- seq_printf(seq, "Device name : %s\n",
-- chtostr(result.device_name, 64));
-- seq_printf(seq, "Service name : %s\n",
-- chtostr(result.service_name, 64));
-- seq_printf(seq, "Physical name : %s\n",
-- chtostr(result.physical_location, 64));
-- seq_printf(seq, "Instance number : %s\n",
-- chtostr(result.instance_number, 4));
-+ seq_printf(seq, "Device name : %.64s\n", result.device_name);
-+ seq_printf(seq, "Service name : %.64s\n", result.service_name);
-+ seq_printf(seq, "Physical name : %.64s\n", result.physical_location);
-+ seq_printf(seq, "Instance number : %.4s\n", result.instance_number);
-
- return 0;
- }
-diff --git a/drivers/message/i2o/iop.c b/drivers/message/i2o/iop.c
-index 27cf4af..b1205b8 100644
---- a/drivers/message/i2o/iop.c
-+++ b/drivers/message/i2o/iop.c
-@@ -110,10 +110,10 @@ u32 i2o_cntxt_list_add(struct i2o_controller * c, void *ptr)
-
- spin_lock_irqsave(&c->context_list_lock, flags);
-
-- if (unlikely(atomic_inc_and_test(&c->context_list_counter)))
-- atomic_inc(&c->context_list_counter);
-+ if (unlikely(atomic_inc_and_test_unchecked(&c->context_list_counter)))
-+ atomic_inc_unchecked(&c->context_list_counter);
-
-- entry->context = atomic_read(&c->context_list_counter);
-+ entry->context = atomic_read_unchecked(&c->context_list_counter);
-
- list_add(&entry->list, &c->context_list);
-
-@@ -1076,7 +1076,7 @@ struct i2o_controller *i2o_iop_alloc(void)
-
- #if BITS_PER_LONG == 64
- spin_lock_init(&c->context_list_lock);
-- atomic_set(&c->context_list_counter, 0);
-+ atomic_set_unchecked(&c->context_list_counter, 0);
- INIT_LIST_HEAD(&c->context_list);
- #endif
-
-diff --git a/drivers/mfd/ab3100-core.c b/drivers/mfd/ab3100-core.c
-index 78e3e85..66c9a0d 100644
---- a/drivers/mfd/ab3100-core.c
-+++ b/drivers/mfd/ab3100-core.c
-@@ -777,7 +777,7 @@ struct ab_family_id {
- char *name;
- };
-
--static const struct ab_family_id ids[] __initdata = {
-+static const struct ab_family_id ids[] __initconst = {
- /* AB3100 */
- {
- .id = 0xc0,
-diff --git a/drivers/mfd/wm8350-i2c.c b/drivers/mfd/wm8350-i2c.c
-index 8d8c932..8104515 100644
---- a/drivers/mfd/wm8350-i2c.c
-+++ b/drivers/mfd/wm8350-i2c.c
-@@ -43,6 +43,8 @@ static int wm8350_i2c_write_device(struct wm8350 *wm8350, char reg,
- u8 msg[(WM8350_MAX_REGISTER << 1) + 1];
- int ret;
-
-+ pax_track_stack();
-+
- if (bytes > ((WM8350_MAX_REGISTER << 1) + 1))
- return -EINVAL;
-
-diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c
-index e4ff50b..80b88b4 100644
---- a/drivers/misc/kgdbts.c
-+++ b/drivers/misc/kgdbts.c
-@@ -118,7 +118,7 @@
- } while (0)
- #define MAX_CONFIG_LEN 40
-
--static struct kgdb_io kgdbts_io_ops;
-+static const struct kgdb_io kgdbts_io_ops;
- static char get_buf[BUFMAX];
- static int get_buf_cnt;
- static char put_buf[BUFMAX];
-@@ -740,7 +740,7 @@ static void run_plant_and_detach_test(int is_early)
- char before[BREAK_INSTR_SIZE];
- char after[BREAK_INSTR_SIZE];
-
-- probe_kernel_read(before, (char *)kgdbts_break_test,
-+ probe_kernel_read(before, ktla_ktva((char *)kgdbts_break_test),
- BREAK_INSTR_SIZE);
- init_simple_test();
- ts.tst = plant_and_detach_test;
-@@ -748,7 +748,7 @@ static void run_plant_and_detach_test(int is_early)
- /* Activate test with initial breakpoint */
- if (!is_early)
- kgdb_breakpoint();
-- probe_kernel_read(after, (char *)kgdbts_break_test,
-+ probe_kernel_read(after, ktla_ktva((char *)kgdbts_break_test),
- BREAK_INSTR_SIZE);
- if (memcmp(before, after, BREAK_INSTR_SIZE)) {
- printk(KERN_CRIT "kgdbts: ERROR kgdb corrupted memory\n");
-@@ -1102,7 +1102,7 @@ static void kgdbts_post_exp_handler(void)
- module_put(THIS_MODULE);
- }
-
--static struct kgdb_io kgdbts_io_ops = {
-+static const struct kgdb_io kgdbts_io_ops = {
- .name = "kgdbts",
- .read_char = kgdbts_get_char,
- .write_char = kgdbts_put_char,
-diff --git a/drivers/misc/sgi-gru/gruhandles.c b/drivers/misc/sgi-gru/gruhandles.c
-index 37e7cfc..67cfb76 100644
---- a/drivers/misc/sgi-gru/gruhandles.c
-+++ b/drivers/misc/sgi-gru/gruhandles.c
-@@ -39,8 +39,8 @@ struct mcs_op_statistic mcs_op_statistics[mcsop_last];
-
- static void update_mcs_stats(enum mcs_op op, unsigned long clks)
- {
-- atomic_long_inc(&mcs_op_statistics[op].count);
-- atomic_long_add(clks, &mcs_op_statistics[op].total);
-+ atomic_long_inc_unchecked(&mcs_op_statistics[op].count);
-+ atomic_long_add_unchecked(clks, &mcs_op_statistics[op].total);
- if (mcs_op_statistics[op].max < clks)
- mcs_op_statistics[op].max = clks;
- }
-diff --git a/drivers/misc/sgi-gru/gruprocfs.c b/drivers/misc/sgi-gru/gruprocfs.c
-index 3f2375c..467c6e6 100644
---- a/drivers/misc/sgi-gru/gruprocfs.c
-+++ b/drivers/misc/sgi-gru/gruprocfs.c
-@@ -32,9 +32,9 @@
-
- #define printstat(s, f) printstat_val(s, &gru_stats.f, #f)
-
--static void printstat_val(struct seq_file *s, atomic_long_t *v, char *id)
-+static void printstat_val(struct seq_file *s, atomic_long_unchecked_t *v, char *id)
- {
-- unsigned long val = atomic_long_read(v);
-+ unsigned long val = atomic_long_read_unchecked(v);
-
- if (val)
- seq_printf(s, "%16lu %s\n", val, id);
-@@ -136,8 +136,8 @@ static int mcs_statistics_show(struct seq_file *s, void *p)
- "cch_interrupt_sync", "cch_deallocate", "tgh_invalidate"};
-
- for (op = 0; op < mcsop_last; op++) {
-- count = atomic_long_read(&mcs_op_statistics[op].count);
-- total = atomic_long_read(&mcs_op_statistics[op].total);
-+ count = atomic_long_read_unchecked(&mcs_op_statistics[op].count);
-+ total = atomic_long_read_unchecked(&mcs_op_statistics[op].total);
- max = mcs_op_statistics[op].max;
- seq_printf(s, "%-20s%12ld%12ld%12ld\n", id[op], count,
- count ? total / count : 0, max);
-diff --git a/drivers/misc/sgi-gru/grutables.h b/drivers/misc/sgi-gru/grutables.h
-index 46990bc..4a251b5 100644
---- a/drivers/misc/sgi-gru/grutables.h
-+++ b/drivers/misc/sgi-gru/grutables.h
-@@ -167,84 +167,84 @@ extern unsigned int gru_max_gids;
- * GRU statistics.
- */
- struct gru_stats_s {
-- atomic_long_t vdata_alloc;
-- atomic_long_t vdata_free;
-- atomic_long_t gts_alloc;
-- atomic_long_t gts_free;
-- atomic_long_t vdata_double_alloc;
-- atomic_long_t gts_double_allocate;
-- atomic_long_t assign_context;
-- atomic_long_t assign_context_failed;
-- atomic_long_t free_context;
-- atomic_long_t load_user_context;
-- atomic_long_t load_kernel_context;
-- atomic_long_t lock_kernel_context;
-- atomic_long_t unlock_kernel_context;
-- atomic_long_t steal_user_context;
-- atomic_long_t steal_kernel_context;
-- atomic_long_t steal_context_failed;
-- atomic_long_t nopfn;
-- atomic_long_t break_cow;
-- atomic_long_t asid_new;
-- atomic_long_t asid_next;
-- atomic_long_t asid_wrap;
-- atomic_long_t asid_reuse;
-- atomic_long_t intr;
-- atomic_long_t intr_mm_lock_failed;
-- atomic_long_t call_os;
-- atomic_long_t call_os_offnode_reference;
-- atomic_long_t call_os_check_for_bug;
-- atomic_long_t call_os_wait_queue;
-- atomic_long_t user_flush_tlb;
-- atomic_long_t user_unload_context;
-- atomic_long_t user_exception;
-- atomic_long_t set_context_option;
-- atomic_long_t migrate_check;
-- atomic_long_t migrated_retarget;
-- atomic_long_t migrated_unload;
-- atomic_long_t migrated_unload_delay;
-- atomic_long_t migrated_nopfn_retarget;
-- atomic_long_t migrated_nopfn_unload;
-- atomic_long_t tlb_dropin;
-- atomic_long_t tlb_dropin_fail_no_asid;
-- atomic_long_t tlb_dropin_fail_upm;
-- atomic_long_t tlb_dropin_fail_invalid;
-- atomic_long_t tlb_dropin_fail_range_active;
-- atomic_long_t tlb_dropin_fail_idle;
-- atomic_long_t tlb_dropin_fail_fmm;
-- atomic_long_t tlb_dropin_fail_no_exception;
-- atomic_long_t tlb_dropin_fail_no_exception_war;
-- atomic_long_t tfh_stale_on_fault;
-- atomic_long_t mmu_invalidate_range;
-- atomic_long_t mmu_invalidate_page;
-- atomic_long_t mmu_clear_flush_young;
-- atomic_long_t flush_tlb;
-- atomic_long_t flush_tlb_gru;
-- atomic_long_t flush_tlb_gru_tgh;
-- atomic_long_t flush_tlb_gru_zero_asid;
-+ atomic_long_unchecked_t vdata_alloc;
-+ atomic_long_unchecked_t vdata_free;
-+ atomic_long_unchecked_t gts_alloc;
-+ atomic_long_unchecked_t gts_free;
-+ atomic_long_unchecked_t vdata_double_alloc;
-+ atomic_long_unchecked_t gts_double_allocate;
-+ atomic_long_unchecked_t assign_context;
-+ atomic_long_unchecked_t assign_context_failed;
-+ atomic_long_unchecked_t free_context;
-+ atomic_long_unchecked_t load_user_context;
-+ atomic_long_unchecked_t load_kernel_context;
-+ atomic_long_unchecked_t lock_kernel_context;
-+ atomic_long_unchecked_t unlock_kernel_context;
-+ atomic_long_unchecked_t steal_user_context;
-+ atomic_long_unchecked_t steal_kernel_context;
-+ atomic_long_unchecked_t steal_context_failed;
-+ atomic_long_unchecked_t nopfn;
-+ atomic_long_unchecked_t break_cow;
-+ atomic_long_unchecked_t asid_new;
-+ atomic_long_unchecked_t asid_next;
-+ atomic_long_unchecked_t asid_wrap;
-+ atomic_long_unchecked_t asid_reuse;
-+ atomic_long_unchecked_t intr;
-+ atomic_long_unchecked_t intr_mm_lock_failed;
-+ atomic_long_unchecked_t call_os;
-+ atomic_long_unchecked_t call_os_offnode_reference;
-+ atomic_long_unchecked_t call_os_check_for_bug;
-+ atomic_long_unchecked_t call_os_wait_queue;
-+ atomic_long_unchecked_t user_flush_tlb;
-+ atomic_long_unchecked_t user_unload_context;
-+ atomic_long_unchecked_t user_exception;
-+ atomic_long_unchecked_t set_context_option;
-+ atomic_long_unchecked_t migrate_check;
-+ atomic_long_unchecked_t migrated_retarget;
-+ atomic_long_unchecked_t migrated_unload;
-+ atomic_long_unchecked_t migrated_unload_delay;
-+ atomic_long_unchecked_t migrated_nopfn_retarget;
-+ atomic_long_unchecked_t migrated_nopfn_unload;
-+ atomic_long_unchecked_t tlb_dropin;
-+ atomic_long_unchecked_t tlb_dropin_fail_no_asid;
-+ atomic_long_unchecked_t tlb_dropin_fail_upm;
-+ atomic_long_unchecked_t tlb_dropin_fail_invalid;
-+ atomic_long_unchecked_t tlb_dropin_fail_range_active;
-+ atomic_long_unchecked_t tlb_dropin_fail_idle;
-+ atomic_long_unchecked_t tlb_dropin_fail_fmm;
-+ atomic_long_unchecked_t tlb_dropin_fail_no_exception;
-+ atomic_long_unchecked_t tlb_dropin_fail_no_exception_war;
-+ atomic_long_unchecked_t tfh_stale_on_fault;
-+ atomic_long_unchecked_t mmu_invalidate_range;
-+ atomic_long_unchecked_t mmu_invalidate_page;
-+ atomic_long_unchecked_t mmu_clear_flush_young;
-+ atomic_long_unchecked_t flush_tlb;
-+ atomic_long_unchecked_t flush_tlb_gru;
-+ atomic_long_unchecked_t flush_tlb_gru_tgh;
-+ atomic_long_unchecked_t flush_tlb_gru_zero_asid;
-
-- atomic_long_t copy_gpa;
-+ atomic_long_unchecked_t copy_gpa;
-
-- atomic_long_t mesq_receive;
-- atomic_long_t mesq_receive_none;
-- atomic_long_t mesq_send;
-- atomic_long_t mesq_send_failed;
-- atomic_long_t mesq_noop;
-- atomic_long_t mesq_send_unexpected_error;
-- atomic_long_t mesq_send_lb_overflow;
-- atomic_long_t mesq_send_qlimit_reached;
-- atomic_long_t mesq_send_amo_nacked;
-- atomic_long_t mesq_send_put_nacked;
-- atomic_long_t mesq_qf_not_full;
-- atomic_long_t mesq_qf_locked;
-- atomic_long_t mesq_qf_noop_not_full;
-- atomic_long_t mesq_qf_switch_head_failed;
-- atomic_long_t mesq_qf_unexpected_error;
-- atomic_long_t mesq_noop_unexpected_error;
-- atomic_long_t mesq_noop_lb_overflow;
-- atomic_long_t mesq_noop_qlimit_reached;
-- atomic_long_t mesq_noop_amo_nacked;
-- atomic_long_t mesq_noop_put_nacked;
-+ atomic_long_unchecked_t mesq_receive;
-+ atomic_long_unchecked_t mesq_receive_none;
-+ atomic_long_unchecked_t mesq_send;
-+ atomic_long_unchecked_t mesq_send_failed;
-+ atomic_long_unchecked_t mesq_noop;
-+ atomic_long_unchecked_t mesq_send_unexpected_error;
-+ atomic_long_unchecked_t mesq_send_lb_overflow;
-+ atomic_long_unchecked_t mesq_send_qlimit_reached;
-+ atomic_long_unchecked_t mesq_send_amo_nacked;
-+ atomic_long_unchecked_t mesq_send_put_nacked;
-+ atomic_long_unchecked_t mesq_qf_not_full;
-+ atomic_long_unchecked_t mesq_qf_locked;
-+ atomic_long_unchecked_t mesq_qf_noop_not_full;
-+ atomic_long_unchecked_t mesq_qf_switch_head_failed;
-+ atomic_long_unchecked_t mesq_qf_unexpected_error;
-+ atomic_long_unchecked_t mesq_noop_unexpected_error;
-+ atomic_long_unchecked_t mesq_noop_lb_overflow;
-+ atomic_long_unchecked_t mesq_noop_qlimit_reached;
-+ atomic_long_unchecked_t mesq_noop_amo_nacked;
-+ atomic_long_unchecked_t mesq_noop_put_nacked;
-
- };
-
-@@ -252,8 +252,8 @@ enum mcs_op {cchop_allocate, cchop_start, cchop_interrupt, cchop_interrupt_sync,
- cchop_deallocate, tghop_invalidate, mcsop_last};
-
- struct mcs_op_statistic {
-- atomic_long_t count;
-- atomic_long_t total;
-+ atomic_long_unchecked_t count;
-+ atomic_long_unchecked_t total;
- unsigned long max;
- };
-
-@@ -276,7 +276,7 @@ extern struct mcs_op_statistic mcs_op_statistics[mcsop_last];
-
- #define STAT(id) do { \
- if (gru_options & OPT_STATS) \
-- atomic_long_inc(&gru_stats.id); \
-+ atomic_long_inc_unchecked(&gru_stats.id); \
- } while (0)
-
- #ifdef CONFIG_SGI_GRU_DEBUG
-diff --git a/drivers/misc/sgi-xp/xp.h b/drivers/misc/sgi-xp/xp.h
-index 2275126..12a9dbfb 100644
---- a/drivers/misc/sgi-xp/xp.h
-+++ b/drivers/misc/sgi-xp/xp.h
-@@ -289,7 +289,7 @@ struct xpc_interface {
- xpc_notify_func, void *);
- void (*received) (short, int, void *);
- enum xp_retval (*partid_to_nasids) (short, void *);
--};
-+} __no_const;
-
- extern struct xpc_interface xpc_interface;
-
-diff --git a/drivers/misc/sgi-xp/xpc.h b/drivers/misc/sgi-xp/xpc.h
-index b94d5f7..7f494c5 100644
---- a/drivers/misc/sgi-xp/xpc.h
-+++ b/drivers/misc/sgi-xp/xpc.h
-@@ -835,6 +835,7 @@ struct xpc_arch_operations {
- void (*received_payload) (struct xpc_channel *, void *);
- void (*notify_senders_of_disconnect) (struct xpc_channel *);
- };
-+typedef struct xpc_arch_operations __no_const xpc_arch_operations_no_const;
-
- /* struct xpc_partition act_state values (for XPC HB) */
-
-@@ -876,7 +877,7 @@ extern struct xpc_registration xpc_registrations[];
- /* found in xpc_main.c */
- extern struct device *xpc_part;
- extern struct device *xpc_chan;
--extern struct xpc_arch_operations xpc_arch_ops;
-+extern xpc_arch_operations_no_const xpc_arch_ops;
- extern int xpc_disengage_timelimit;
- extern int xpc_disengage_timedout;
- extern int xpc_activate_IRQ_rcvd;
-diff --git a/drivers/misc/sgi-xp/xpc_main.c b/drivers/misc/sgi-xp/xpc_main.c
-index fd3688a..7e211a4 100644
---- a/drivers/misc/sgi-xp/xpc_main.c
-+++ b/drivers/misc/sgi-xp/xpc_main.c
-@@ -169,7 +169,7 @@ static struct notifier_block xpc_die_notifier = {
- .notifier_call = xpc_system_die,
- };
-
--struct xpc_arch_operations xpc_arch_ops;
-+xpc_arch_operations_no_const xpc_arch_ops;
-
- /*
- * Timer function to enforce the timelimit on the partition disengage.
-diff --git a/drivers/misc/sgi-xp/xpc_sn2.c b/drivers/misc/sgi-xp/xpc_sn2.c
-index 8b70e03..700bda6 100644
---- a/drivers/misc/sgi-xp/xpc_sn2.c
-+++ b/drivers/misc/sgi-xp/xpc_sn2.c
-@@ -2350,7 +2350,7 @@ xpc_received_payload_sn2(struct xpc_channel *ch, void *payload)
- xpc_acknowledge_msgs_sn2(ch, get, msg->flags);
- }
-
--static struct xpc_arch_operations xpc_arch_ops_sn2 = {
-+static const struct xpc_arch_operations xpc_arch_ops_sn2 = {
- .setup_partitions = xpc_setup_partitions_sn2,
- .teardown_partitions = xpc_teardown_partitions_sn2,
- .process_activate_IRQ_rcvd = xpc_process_activate_IRQ_rcvd_sn2,
-@@ -2413,7 +2413,9 @@ xpc_init_sn2(void)
- int ret;
- size_t buf_size;
-
-- xpc_arch_ops = xpc_arch_ops_sn2;
-+ pax_open_kernel();
-+ memcpy((void *)&xpc_arch_ops, &xpc_arch_ops_sn2, sizeof(xpc_arch_ops_sn2));
-+ pax_close_kernel();
-
- if (offsetof(struct xpc_msg_sn2, payload) > XPC_MSG_HDR_MAX_SIZE) {
- dev_err(xpc_part, "header portion of struct xpc_msg_sn2 is "
-diff --git a/drivers/misc/sgi-xp/xpc_uv.c b/drivers/misc/sgi-xp/xpc_uv.c
-index 8e08d71..7cb8c9b 100644
---- a/drivers/misc/sgi-xp/xpc_uv.c
-+++ b/drivers/misc/sgi-xp/xpc_uv.c
-@@ -1669,7 +1669,7 @@ xpc_received_payload_uv(struct xpc_channel *ch, void *payload)
- XPC_DEACTIVATE_PARTITION(&xpc_partitions[ch->partid], ret);
- }
-
--static struct xpc_arch_operations xpc_arch_ops_uv = {
-+static const struct xpc_arch_operations xpc_arch_ops_uv = {
- .setup_partitions = xpc_setup_partitions_uv,
- .teardown_partitions = xpc_teardown_partitions_uv,
- .process_activate_IRQ_rcvd = xpc_process_activate_IRQ_rcvd_uv,
-@@ -1729,7 +1729,9 @@ static struct xpc_arch_operations xpc_arch_ops_uv = {
- int
- xpc_init_uv(void)
- {
-- xpc_arch_ops = xpc_arch_ops_uv;
-+ pax_open_kernel();
-+ memcpy((void *)&xpc_arch_ops, &xpc_arch_ops_uv, sizeof(xpc_arch_ops_uv));
-+ pax_close_kernel();
-
- if (sizeof(struct xpc_notify_mq_msghdr_uv) > XPC_MSG_HDR_MAX_SIZE) {
- dev_err(xpc_part, "xpc_notify_mq_msghdr_uv is larger than %d\n",
-diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c
-index 6fd20b42..650efe3 100644
---- a/drivers/mmc/host/sdhci-pci.c
-+++ b/drivers/mmc/host/sdhci-pci.c
-@@ -297,7 +297,7 @@ static const struct sdhci_pci_fixes sdhci_via = {
- .probe = via_probe,
- };
-
--static const struct pci_device_id pci_ids[] __devinitdata = {
-+static const struct pci_device_id pci_ids[] __devinitconst = {
- {
- .vendor = PCI_VENDOR_ID_RICOH,
- .device = PCI_DEVICE_ID_RICOH_R5C822,
-diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
-index e7563a9..5f90ce5 100644
---- a/drivers/mtd/chips/cfi_cmdset_0001.c
-+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
-@@ -743,6 +743,8 @@ static int chip_ready (struct map_info *map, struct flchip *chip, unsigned long
- struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
- unsigned long timeo = jiffies + HZ;
-
-+ pax_track_stack();
-+
- /* Prevent setting state FL_SYNCING for chip in suspended state. */
- if (mode == FL_SYNCING && chip->oldstate != FL_READY)
- goto sleep;
-@@ -1642,6 +1644,8 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
- unsigned long initial_adr;
- int initial_len = len;
-
-+ pax_track_stack();
-+
- wbufsize = cfi_interleave(cfi) << cfi->cfiq->MaxBufWriteSize;
- adr += chip->start;
- initial_adr = adr;
-@@ -1860,6 +1864,8 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
- int retries = 3;
- int ret;
-
-+ pax_track_stack();
-+
- adr += chip->start;
-
- retry:
-diff --git a/drivers/mtd/chips/cfi_cmdset_0020.c b/drivers/mtd/chips/cfi_cmdset_0020.c
-index 0667a67..3ab97ed 100644
---- a/drivers/mtd/chips/cfi_cmdset_0020.c
-+++ b/drivers/mtd/chips/cfi_cmdset_0020.c
-@@ -255,6 +255,8 @@ static inline int do_read_onechip(struct map_info *map, struct flchip *chip, lof
- unsigned long cmd_addr;
- struct cfi_private *cfi = map->fldrv_priv;
-
-+ pax_track_stack();
-+
- adr += chip->start;
-
- /* Ensure cmd read/writes are aligned. */
-@@ -428,6 +430,8 @@ static inline int do_write_buffer(struct map_info *map, struct flchip *chip,
- DECLARE_WAITQUEUE(wait, current);
- int wbufsize, z;
-
-+ pax_track_stack();
-+
- /* M58LW064A requires bus alignment for buffer wriets -- saw */
- if (adr & (map_bankwidth(map)-1))
- return -EINVAL;
-@@ -742,6 +746,8 @@ static inline int do_erase_oneblock(struct map_info *map, struct flchip *chip, u
- DECLARE_WAITQUEUE(wait, current);
- int ret = 0;
-
-+ pax_track_stack();
-+
- adr += chip->start;
-
- /* Let's determine this according to the interleave only once */
-@@ -1047,6 +1053,8 @@ static inline int do_lock_oneblock(struct map_info *map, struct flchip *chip, un
- unsigned long timeo = jiffies + HZ;
- DECLARE_WAITQUEUE(wait, current);
-
-+ pax_track_stack();
-+
- adr += chip->start;
-
- /* Let's determine this according to the interleave only once */
-@@ -1196,6 +1204,8 @@ static inline int do_unlock_oneblock(struct map_info *map, struct flchip *chip,
- unsigned long timeo = jiffies + HZ;
- DECLARE_WAITQUEUE(wait, current);
-
-+ pax_track_stack();
-+
- adr += chip->start;
-
- /* Let's determine this according to the interleave only once */
-diff --git a/drivers/mtd/devices/doc2000.c b/drivers/mtd/devices/doc2000.c
-index 5bf5f46..c5de373 100644
---- a/drivers/mtd/devices/doc2000.c
-+++ b/drivers/mtd/devices/doc2000.c
-@@ -776,7 +776,7 @@ static int doc_write(struct mtd_info *mtd, loff_t to, size_t len,
-
- /* The ECC will not be calculated correctly if less than 512 is written */
- /* DBB-
-- if (len != 0x200 && eccbuf)
-+ if (len != 0x200)
- printk(KERN_WARNING
- "ECC needs a full sector write (adr: %lx size %lx)\n",
- (long) to, (long) len);
-diff --git a/drivers/mtd/devices/doc2001.c b/drivers/mtd/devices/doc2001.c
-index 0990f78..bb4e8a4 100644
---- a/drivers/mtd/devices/doc2001.c
-+++ b/drivers/mtd/devices/doc2001.c
-@@ -393,7 +393,7 @@ static int doc_read (struct mtd_info *mtd, loff_t from, size_t len,
- struct Nand *mychip = &this->chips[from >> (this->chipshift)];
-
- /* Don't allow read past end of device */
-- if (from >= this->totlen)
-+ if (from >= this->totlen || !len)
- return -EINVAL;
-
- /* Don't allow a single read to cross a 512-byte block boundary */
-diff --git a/drivers/mtd/ftl.c b/drivers/mtd/ftl.c
-index e56d6b4..f07e6cf 100644
---- a/drivers/mtd/ftl.c
-+++ b/drivers/mtd/ftl.c
-@@ -474,6 +474,8 @@ static int copy_erase_unit(partition_t *part, uint16_t srcunit,
- loff_t offset;
- uint16_t srcunitswap = cpu_to_le16(srcunit);
-
-+ pax_track_stack();
-+
- eun = &part->EUNInfo[srcunit];
- xfer = &part->XferInfo[xferunit];
- DEBUG(2, "ftl_cs: copying block 0x%x to 0x%x\n",
-diff --git a/drivers/mtd/inftlcore.c b/drivers/mtd/inftlcore.c
-index 8aca552..146446e 100755
---- a/drivers/mtd/inftlcore.c
-+++ b/drivers/mtd/inftlcore.c
-@@ -260,6 +260,8 @@ static u16 INFTL_foldchain(struct INFTLrecord *inftl, unsigned thisVUC, unsigned
- struct inftl_oob oob;
- size_t retlen;
-
-+ pax_track_stack();
-+
- DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_foldchain(inftl=%p,thisVUC=%d,"
- "pending=%d)\n", inftl, thisVUC, pendingblock);
-
-diff --git a/drivers/mtd/inftlmount.c b/drivers/mtd/inftlmount.c
-index 32e82ae..ed50953 100644
---- a/drivers/mtd/inftlmount.c
-+++ b/drivers/mtd/inftlmount.c
-@@ -54,6 +54,8 @@ static int find_boot_record(struct INFTLrecord *inftl)
- struct INFTLPartition *ip;
- size_t retlen;
-
-+ pax_track_stack();
-+
- DEBUG(MTD_DEBUG_LEVEL3, "INFTL: find_boot_record(inftl=%p)\n", inftl);
-
- /*
-diff --git a/drivers/mtd/lpddr/qinfo_probe.c b/drivers/mtd/lpddr/qinfo_probe.c
-index 79bf40f..fe5f8fd 100644
---- a/drivers/mtd/lpddr/qinfo_probe.c
-+++ b/drivers/mtd/lpddr/qinfo_probe.c
-@@ -106,6 +106,8 @@ static int lpddr_pfow_present(struct map_info *map, struct lpddr_private *lpddr)
- {
- map_word pfow_val[4];
-
-+ pax_track_stack();
-+
- /* Check identification string */
- pfow_val[0] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_P);
- pfow_val[1] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_F);
-diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
-index 726a1b8..f46b460 100644
---- a/drivers/mtd/mtdchar.c
-+++ b/drivers/mtd/mtdchar.c
-@@ -461,6 +461,8 @@ static int mtd_ioctl(struct inode *inode, struct file *file,
- u_long size;
- struct mtd_info_user info;
-
-+ pax_track_stack();
-+
- DEBUG(MTD_DEBUG_LEVEL0, "MTD_ioctl\n");
-
- size = (cmd & IOCSIZE_MASK) >> IOCSIZE_SHIFT;
-diff --git a/drivers/mtd/nftlcore.c b/drivers/mtd/nftlcore.c
-index 1002e18..26d82d5 100644
---- a/drivers/mtd/nftlcore.c
-+++ b/drivers/mtd/nftlcore.c
-@@ -254,6 +254,8 @@ static u16 NFTL_foldchain (struct NFTLrecord *nftl, unsigned thisVUC, unsigned p
- int inplace = 1;
- size_t retlen;
-
-+ pax_track_stack();
-+
- memset(BlockMap, 0xff, sizeof(BlockMap));
- memset(BlockFreeFound, 0, sizeof(BlockFreeFound));
-
-diff --git a/drivers/mtd/nftlmount.c b/drivers/mtd/nftlmount.c
-index 8b22b18..6fada85 100644
---- a/drivers/mtd/nftlmount.c
-+++ b/drivers/mtd/nftlmount.c
-@@ -23,6 +23,7 @@
- #include <asm/errno.h>
- #include <linux/delay.h>
- #include <linux/slab.h>
-+#include <linux/sched.h>
- #include <linux/mtd/mtd.h>
- #include <linux/mtd/nand.h>
- #include <linux/mtd/nftl.h>
-@@ -44,6 +45,8 @@ static int find_boot_record(struct NFTLrecord *nftl)
- struct mtd_info *mtd = nftl->mbd.mtd;
- unsigned int i;
-
-+ pax_track_stack();
-+
- /* Assume logical EraseSize == physical erasesize for starting the scan.
- We'll sort it out later if we find a MediaHeader which says otherwise */
- /* Actually, we won't. The new DiskOnChip driver has already scanned
-diff --git a/drivers/net/atlx/atl2.c b/drivers/net/atlx/atl2.c
-index ab68886..ca405e8 100644
---- a/drivers/net/atlx/atl2.c
-+++ b/drivers/net/atlx/atl2.c
-@@ -2845,7 +2845,7 @@ static void atl2_force_ps(struct atl2_hw *hw)
- */
-
- #define ATL2_PARAM(X, desc) \
-- static const int __devinitdata X[ATL2_MAX_NIC + 1] = ATL2_PARAM_INIT; \
-+ static const int __devinitconst X[ATL2_MAX_NIC + 1] = ATL2_PARAM_INIT; \
- MODULE_PARM(X, "1-" __MODULE_STRING(ATL2_MAX_NIC) "i"); \
- MODULE_PARM_DESC(X, desc);
- #else
-diff --git a/drivers/net/benet/Makefile b/drivers/net/benet/Makefile
-index a60cd80..0ed11ef 100644
---- a/drivers/net/benet/Makefile
-+++ b/drivers/net/benet/Makefile
-@@ -1,7 +1,9 @@
- #
--# Makefile to build the network driver for ServerEngine's BladeEngine.
-+# Makefile to build the be2net network driver
- #
-
-+EXTRA_CFLAGS += -DCONFIG_PALAU
-+
- obj-$(CONFIG_BE2NET) += be2net.o
-
--be2net-y := be_main.o be_cmds.o be_ethtool.o
-+be2net-y := be_main.o be_cmds.o be_ethtool.o be_compat.o be_misc.o
-diff --git a/drivers/net/benet/be.h b/drivers/net/benet/be.h
-index 5c74ff0..7382603 100644
---- a/drivers/net/benet/be.h
-+++ b/drivers/net/benet/be.h
-@@ -1,18 +1,18 @@
- /*
-- * Copyright (C) 2005 - 2009 ServerEngines
-+ * Copyright (C) 2005 - 2011 Emulex
- * All rights reserved.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License version 2
-- * as published by the Free Software Foundation. The full GNU General
-+ * as published by the Free Software Foundation. The full GNU General
- * Public License is included in this distribution in the file called COPYING.
- *
- * Contact Information:
-- * linux-drivers@serverengines.com
-+ * linux-drivers@emulex.com
- *
-- * ServerEngines
-- * 209 N. Fair Oaks Ave
-- * Sunnyvale, CA 94085
-+ * Emulex
-+ * 3333 Susan Street
-+ * Costa Mesa, CA 92626
- */
-
- #ifndef BE_H
-@@ -29,32 +29,53 @@
- #include <linux/workqueue.h>
- #include <linux/interrupt.h>
- #include <linux/firmware.h>
-+#include <linux/jhash.h>
-+#ifndef CONFIG_PALAU
-+#include <linux/inet_lro.h>
-+#endif
-
-+#ifdef CONFIG_PALAU
-+#include "be_compat.h"
-+#endif
- #include "be_hw.h"
-
--#define DRV_VER "2.101.205"
-+#ifdef CONFIG_PALAU
-+#include "version.h"
-+#define DRV_VER STR_BE_MAJOR "." STR_BE_MINOR "."\
-+ STR_BE_BUILD "." STR_BE_BRANCH
-+#else
-+#define DRV_VER "2.0.348"
-+#endif
- #define DRV_NAME "be2net"
--#define BE_NAME "ServerEngines BladeEngine2 10Gbps NIC"
--#define BE3_NAME "ServerEngines BladeEngine3 10Gbps NIC"
--#define OC_NAME "Emulex OneConnect 10Gbps NIC"
--#define OC_NAME1 "Emulex OneConnect 10Gbps NIC (be3)"
--#define DRV_DESC BE_NAME "Driver"
-+#define BE_NAME "Emulex BladeEngine2"
-+#define BE3_NAME "Emulex BladeEngine3"
-+#define OC_NAME "Emulex OneConnect"
-+#define OC_NAME_BE OC_NAME "(be3)"
-+#define OC_NAME_LANCER OC_NAME "(Lancer)"
-+#define DRV_DESC "Emulex OneConnect 10Gbps NIC Driver"
-
--#define BE_VENDOR_ID 0x19a2
-+#define BE_VENDOR_ID 0x19a2
-+#define EMULEX_VENDOR_ID 0x10df
- #define BE_DEVICE_ID1 0x211
- #define BE_DEVICE_ID2 0x221
--#define OC_DEVICE_ID1 0x700
--#define OC_DEVICE_ID2 0x701
--#define OC_DEVICE_ID3 0x710
-+#define OC_DEVICE_ID1 0x700 /* Device Id for BE2 cards */
-+#define OC_DEVICE_ID2 0x710 /* Device Id for BE3 cards */
-+#define OC_DEVICE_ID3 0xe220 /* Device id for Lancer cards */
-+
-+#define OC_SUBSYS_DEVICE_ID1 0xE602
-+#define OC_SUBSYS_DEVICE_ID2 0xE642
-+#define OC_SUBSYS_DEVICE_ID3 0xE612
-+#define OC_SUBSYS_DEVICE_ID4 0xE652
-
- static inline char *nic_name(struct pci_dev *pdev)
- {
- switch (pdev->device) {
- case OC_DEVICE_ID1:
-- case OC_DEVICE_ID2:
- return OC_NAME;
-+ case OC_DEVICE_ID2:
-+ return OC_NAME_BE;
- case OC_DEVICE_ID3:
-- return OC_NAME1;
-+ return OC_NAME_LANCER;
- case BE_DEVICE_ID2:
- return BE3_NAME;
- default:
-@@ -63,7 +84,7 @@ static inline char *nic_name(struct pci_dev *pdev)
- }
-
- /* Number of bytes of an RX frame that are copied to skb->data */
--#define BE_HDR_LEN 64
-+#define BE_HDR_LEN ((u16) 64)
- #define BE_MAX_JUMBO_FRAME_SIZE 9018
- #define BE_MIN_MTU 256
-
-@@ -79,10 +100,24 @@ static inline char *nic_name(struct pci_dev *pdev)
- #define MCC_Q_LEN 128 /* total size not to exceed 8 pages */
- #define MCC_CQ_LEN 256
-
-+#define MAX_RSS_QS 4 /* BE limit is 4 queues/port */
-+
-+#define MAX_RX_QS (MAX_RSS_QS + 1)
-+
-+#ifdef MQ_TX
-+#define MAX_TX_QS 8
-+#else
-+#define MAX_TX_QS 1
-+#endif
-+
-+#define BE_MAX_MSIX_VECTORS (MAX_RX_QS + 1)/* RSS qs + 1 def Rx + Tx */
- #define BE_NAPI_WEIGHT 64
--#define MAX_RX_POST BE_NAPI_WEIGHT /* Frags posted at a time */
-+#define MAX_RX_POST BE_NAPI_WEIGHT /* Frags posted at a time */
- #define RX_FRAGS_REFILL_WM (RX_Q_LEN - MAX_RX_POST)
-
-+#define BE_MAX_LRO_DESCRIPTORS 16
-+#define BE_MAX_FRAGS_PER_FRAME (min((u32) 16, (u32) MAX_SKB_FRAGS))
-+
- #define FW_VER_LEN 32
-
- struct be_dma_mem {
-@@ -127,6 +162,11 @@ static inline void *queue_tail_node(struct be_queue_info *q)
- return q->dma_mem.va + q->tail * q->entry_size;
- }
-
-+static inline void *queue_index_node(struct be_queue_info *q, u16 index)
-+{
-+ return q->dma_mem.va + index * q->entry_size;
-+}
-+
- static inline void queue_head_inc(struct be_queue_info *q)
- {
- index_inc(&q->head, q->len);
-@@ -137,6 +177,7 @@ static inline void queue_tail_inc(struct be_queue_info *q)
- index_inc(&q->tail, q->len);
- }
-
-+
- struct be_eq_obj {
- struct be_queue_info q;
- char desc[32];
-@@ -146,6 +187,7 @@ struct be_eq_obj {
- u16 min_eqd; /* in usecs */
- u16 max_eqd; /* in usecs */
- u16 cur_eqd; /* in usecs */
-+ u8 eq_idx;
-
- struct napi_struct napi;
- };
-@@ -153,49 +195,20 @@ struct be_eq_obj {
- struct be_mcc_obj {
- struct be_queue_info q;
- struct be_queue_info cq;
-+ bool rearm_cq;
- };
-
--struct be_drvr_stats {
-+struct be_tx_stats {
- u32 be_tx_reqs; /* number of TX requests initiated */
- u32 be_tx_stops; /* number of times TX Q was stopped */
-- u32 be_fwd_reqs; /* number of send reqs through forwarding i/f */
- u32 be_tx_wrbs; /* number of tx WRBs used */
-- u32 be_tx_events; /* number of tx completion events */
- u32 be_tx_compl; /* number of tx completion entries processed */
- ulong be_tx_jiffies;
- u64 be_tx_bytes;
- u64 be_tx_bytes_prev;
- u64 be_tx_pkts;
- u32 be_tx_rate;
--
-- u32 cache_barrier[16];
--
-- u32 be_ethrx_post_fail;/* number of ethrx buffer alloc failures */
-- u32 be_polls; /* number of times NAPI called poll function */
-- u32 be_rx_events; /* number of ucast rx completion events */
-- u32 be_rx_compl; /* number of rx completion entries processed */
-- ulong be_rx_jiffies;
-- u64 be_rx_bytes;
-- u64 be_rx_bytes_prev;
-- u64 be_rx_pkts;
-- u32 be_rx_rate;
-- /* number of non ether type II frames dropped where
-- * frame len > length field of Mac Hdr */
-- u32 be_802_3_dropped_frames;
-- /* number of non ether type II frames malformed where
-- * in frame len < length field of Mac Hdr */
-- u32 be_802_3_malformed_frames;
-- u32 be_rxcp_err; /* Num rx completion entries w/ err set. */
-- ulong rx_fps_jiffies; /* jiffies at last FPS calc */
-- u32 be_rx_frags;
-- u32 be_prev_rx_frags;
-- u32 be_rx_fps; /* Rx frags per second */
--};
--
--struct be_stats_obj {
-- struct be_drvr_stats drvr_stats;
-- struct net_device_stats net_stats;
-- struct be_dma_mem cmd;
-+ u32 be_ipv6_ext_hdr_tx_drop;
- };
-
- struct be_tx_obj {
-@@ -203,23 +216,124 @@ struct be_tx_obj {
- struct be_queue_info cq;
- /* Remember the skbs that were transmitted */
- struct sk_buff *sent_skb_list[TX_Q_LEN];
-+ struct be_tx_stats stats;
- };
-
- /* Struct to remember the pages posted for rx frags */
- struct be_rx_page_info {
- struct page *page;
-- dma_addr_t bus;
-+ DEFINE_DMA_UNMAP_ADDR(bus);
- u16 page_offset;
- bool last_page_user;
- };
-
-+struct be_rx_stats {
-+ u32 rx_post_fail;/* number of ethrx buffer alloc failures */
-+ u32 rx_polls; /* number of times NAPI called poll function */
-+ u32 rx_events; /* number of ucast rx completion events */
-+ u32 rx_compl; /* number of rx completion entries processed */
-+ ulong rx_jiffies;
-+ u64 rx_bytes;
-+ u64 rx_bytes_prev;
-+ u64 rx_pkts;
-+ u32 rx_rate;
-+ u32 rx_mcast_pkts;
-+ u32 rxcp_err; /* Num rx completion entries w/ err set. */
-+ ulong rx_fps_jiffies; /* jiffies at last FPS calc */
-+ u32 rx_frags;
-+ u32 prev_rx_frags;
-+ u32 rx_fps; /* Rx frags per second */
-+ u32 rx_drops_no_frags;
-+};
-+
-+struct be_rx_compl_info {
-+ u32 rss_hash;
-+ u16 vlan_tag;
-+ u16 pkt_size;
-+ u16 rxq_idx;
-+ u16 port;
-+ u8 vlanf;
-+ u8 num_rcvd;
-+ u8 err;
-+ u8 ipf;
-+ u8 tcpf;
-+ u8 udpf;
-+ u8 ip_csum;
-+ u8 l4_csum;
-+ u8 ipv6;
-+ u8 vtm;
-+ u8 pkt_type;
-+};
-+
- struct be_rx_obj {
-+ struct be_adapter *adapter;
- struct be_queue_info q;
- struct be_queue_info cq;
-- struct be_rx_page_info page_info_tbl[RX_Q_LEN];
-+ struct be_rx_compl_info rxcp;
-+ struct be_rx_page_info *page_info_tbl;
-+ struct net_lro_mgr lro_mgr;
-+ struct net_lro_desc lro_desc[BE_MAX_LRO_DESCRIPTORS];
-+ struct be_eq_obj rx_eq;
-+ struct be_rx_stats stats;
-+ u8 rss_id;
-+ bool rx_post_starved; /* Zero rx frags have been posted to BE */
-+ u16 prev_frag_idx;
-+ u32 cache_line_barrier[16];
- };
-
--#define BE_NUM_MSIX_VECTORS 2 /* 1 each for Tx and Rx */
-+struct be_drv_stats {
-+ u32 be_on_die_temperature;
-+ u32 be_tx_events;
-+ u32 eth_red_drops;
-+ u32 rx_drops_no_pbuf;
-+ u32 rx_drops_no_txpb;
-+ u32 rx_drops_no_erx_descr;
-+ u32 rx_drops_no_tpre_descr;
-+ u32 rx_drops_too_many_frags;
-+ u32 rx_drops_invalid_ring;
-+ u32 forwarded_packets;
-+ u32 rx_drops_mtu;
-+ u32 rx_crc_errors;
-+ u32 rx_alignment_symbol_errors;
-+ u32 rx_pause_frames;
-+ u32 rx_priority_pause_frames;
-+ u32 rx_control_frames;
-+ u32 rx_in_range_errors;
-+ u32 rx_out_range_errors;
-+ u32 rx_frame_too_long;
-+ u32 rx_address_match_errors;
-+ u32 rx_dropped_too_small;
-+ u32 rx_dropped_too_short;
-+ u32 rx_dropped_header_too_small;
-+ u32 rx_dropped_tcp_length;
-+ u32 rx_dropped_runt;
-+ u32 rx_ip_checksum_errs;
-+ u32 rx_tcp_checksum_errs;
-+ u32 rx_udp_checksum_errs;
-+ u32 rx_switched_unicast_packets;
-+ u32 rx_switched_multicast_packets;
-+ u32 rx_switched_broadcast_packets;
-+ u32 tx_pauseframes;
-+ u32 tx_priority_pauseframes;
-+ u32 tx_controlframes;
-+ u32 rxpp_fifo_overflow_drop;
-+ u32 rx_input_fifo_overflow_drop;
-+ u32 pmem_fifo_overflow_drop;
-+ u32 jabber_events;
-+};
-+
-+struct be_vf_cfg {
-+ unsigned char vf_mac_addr[ETH_ALEN];
-+ u32 vf_if_handle;
-+ u32 vf_pmac_id;
-+ u16 vf_def_vid;
-+ u16 vf_vlan_tag;
-+ u32 vf_tx_rate;
-+};
-+
-+#define BE_INVALID_PMAC_ID 0xffffffff
-+#define BE_FLAGS_DCBX (1 << 16)
-+
- struct be_adapter {
- struct pci_dev *pdev;
- struct net_device *netdev;
-@@ -228,7 +342,7 @@ struct be_adapter {
- u8 __iomem *db; /* Door Bell */
- u8 __iomem *pcicfg; /* PCI config space */
-
-- spinlock_t mbox_lock; /* For serializing mbox cmds to BE card */
-+ struct mutex mbox_lock; /* For serializing mbox cmds to BE card */
- struct be_dma_mem mbox_mem;
- /* Mbox mem is adjusted to align to 16 bytes. The allocated addr
- * is stored for freeing purpose */
-@@ -238,66 +352,121 @@ struct be_adapter {
- spinlock_t mcc_lock; /* For serializing mcc cmds to BE card */
- spinlock_t mcc_cq_lock;
-
-- struct msix_entry msix_entries[BE_NUM_MSIX_VECTORS];
-- bool msix_enabled;
-+ struct msix_entry msix_entries[BE_MAX_MSIX_VECTORS];
-+ u32 num_msix_vec;
- bool isr_registered;
-
- /* TX Rings */
- struct be_eq_obj tx_eq;
-- struct be_tx_obj tx_obj;
-+ struct be_tx_obj tx_obj[MAX_TX_QS];
-+ u8 num_tx_qs;
-+ u8 prio_tc_map[MAX_TX_QS]; /* prio_tc_map[prio] => tc-id */
-+ u8 tc_txq_map[MAX_TX_QS]; /* tc_txq_map[tc-id] => txq index */
-
- u32 cache_line_break[8];
-
- /* Rx rings */
-- struct be_eq_obj rx_eq;
-- struct be_rx_obj rx_obj;
-+ struct be_rx_obj rx_obj[MAX_RX_QS]; /* one default non-rss Q */
-+ u32 num_rx_qs;
-+
-+ struct be_dma_mem stats_cmd;
-+ struct net_device_stats net_stats;
-+ struct be_drv_stats drv_stats;
- u32 big_page_size; /* Compounded page size shared by rx wrbs */
-- bool rx_post_starved; /* Zero rx frags have been posted to BE */
-
- struct vlan_group *vlan_grp;
-- u16 num_vlans;
-+ u16 vlans_added;
-+ u16 max_vlans; /* Number of vlans supported */
- u8 vlan_tag[VLAN_GROUP_ARRAY_LEN];
-+ u8 vlan_prio_bmap; /* Available priority BitMap */
-+ u16 recommended_prio; /* Recommended Priority */
-+ struct be_dma_mem rx_filter;
-
-- struct be_stats_obj stats;
- /* Work queue used to perform periodic tasks like getting statistics */
- struct delayed_work work;
-+ u16 work_counter;
-
-- /* Ethtool knobs and info */
-- bool rx_csum; /* BE card must perform rx-checksumming */
-+ u32 flags;
-+ bool rx_csum; /* BE card must perform rx-checksumming */
-+ u32 max_rx_coal;
- char fw_ver[FW_VER_LEN];
- u32 if_handle; /* Used to configure filtering */
- u32 pmac_id; /* MAC addr handle used by BE card */
-+ u32 beacon_state; /* for set_phys_id */
-
-- bool link_up;
-+ bool eeh_err;
-+ int link_status;
- u32 port_num;
-+ u32 hba_port_num;
- bool promiscuous;
-- u32 cap;
-+ bool wol;
-+ u32 function_mode;
-+ u32 function_caps;
- u32 rx_fc; /* Rx flow control */
- u32 tx_fc; /* Tx flow control */
-+ bool ue_detected;
-+ bool stats_cmd_sent;
-+ bool gro_supported;
-+ int link_speed;
-+ u8 port_type;
-+ u8 transceiver;
-+ u8 autoneg;
- u8 generation; /* BladeEngine ASIC generation */
-+ u32 flash_status;
-+ struct completion flash_compl;
-+
-+ u8 eq_next_idx;
-+ bool be3_native;
-+ u16 num_vfs;
-+ struct be_vf_cfg *vf_cfg;
-+ u8 is_virtfn;
-+ u16 pvid;
-+ u32 sli_family;
-+ u8 port_name[4];
-+ char model_number[32];
- };
-
- /* BladeEngine Generation numbers */
- #define BE_GEN2 2
- #define BE_GEN3 3
-
--extern const struct ethtool_ops be_ethtool_ops;
-+#define ON 1
-+#define OFF 0
-+#define lancer_chip(adapter) (adapter->pdev->device == OC_DEVICE_ID3)
-+#define lancer_A0_chip(adapter) \
-+ (adapter->sli_family == LANCER_A0_SLI_FAMILY)
-
--#define drvr_stats(adapter) (&adapter->stats.drvr_stats)
-+extern struct ethtool_ops be_ethtool_ops;
-
--static inline unsigned int be_pci_func(struct be_adapter *adapter)
--{
-- return PCI_FUNC(adapter->pdev->devfn);
--}
-+#define msix_enabled(adapter) (adapter->num_msix_vec > 0)
-+#define tx_stats(txo) (&txo->stats)
-+#define rx_stats(rxo) (&rxo->stats)
-
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 29)
-+#define BE_SET_NETDEV_OPS(netdev, ops) be_netdev_ops_init(netdev, ops)
-+#else
- #define BE_SET_NETDEV_OPS(netdev, ops) (netdev->netdev_ops = ops)
-+#endif
-+
-+#define for_all_rx_queues(adapter, rxo, i) \
-+ for (i = 0, rxo = &adapter->rx_obj[i]; i < adapter->num_rx_qs; \
-+ i++, rxo++)
-+
-+/* Just skip the first default non-rss queue */
-+#define for_all_rss_queues(adapter, rxo, i) \
-+ for (i = 0, rxo = &adapter->rx_obj[i+1]; i < (adapter->num_rx_qs - 1);\
-+ i++, rxo++)
-+
-+#define for_all_tx_queues(adapter, txo, i) \
-+ for (i = 0, txo = &adapter->tx_obj[i]; i < adapter->num_tx_qs; \
-+ i++, txo++)
-
- #define PAGE_SHIFT_4K 12
- #define PAGE_SIZE_4K (1 << PAGE_SHIFT_4K)
-
- /* Returns number of pages spanned by the data starting at the given addr */
--#define PAGES_4K_SPANNED(_address, size) \
-- ((u32)((((size_t)(_address) & (PAGE_SIZE_4K - 1)) + \
-+#define PAGES_4K_SPANNED(_address, size) \
-+ ((u32)((((size_t)(_address) & (PAGE_SIZE_4K - 1)) + \
- (size) + (PAGE_SIZE_4K - 1)) >> PAGE_SHIFT_4K))
-
- /* Byte offset into the page corresponding to given address */
-@@ -305,7 +474,7 @@ static inline unsigned int be_pci_func(struct be_adapter *adapter)
- ((size_t)(addr) & (PAGE_SIZE_4K-1))
-
- /* Returns bit offset within a DWORD of a bitfield */
--#define AMAP_BIT_OFFSET(_struct, field) \
-+#define AMAP_BIT_OFFSET(_struct, field) \
- (((size_t)&(((_struct *)0)->field))%32)
-
- /* Returns the bit mask of the field that is NOT shifted into location. */
-@@ -356,6 +525,11 @@ static inline void swap_dws(void *wrb, int len)
- #endif /* __BIG_ENDIAN */
- }
-
-+static inline bool vlan_configured(struct be_adapter *adapter)
-+{
-+ return adapter->vlan_grp && adapter->vlans_added;
-+}
-+
- static inline u8 is_tcp_pkt(struct sk_buff *skb)
- {
- u8 val = 0;
-@@ -380,9 +554,65 @@ static inline u8 is_udp_pkt(struct sk_buff *skb)
- return val;
- }
-
-+static inline u8 is_ipv6_ext_hdr(struct sk_buff *skb)
-+{
-+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
-+ if (ip_hdr(skb)->version == 6)
-+ return ipv6_ext_hdr(ipv6_hdr(skb)->nexthdr);
-+ else
-+#endif
-+ return 0;
-+}
-+
-+static inline void be_check_sriov_fn_type(struct be_adapter *adapter)
-+{
-+ u32 sli_intf;
-+
-+ pci_read_config_dword(adapter->pdev, SLI_INTF_REG_OFFSET, &sli_intf);
-+ adapter->is_virtfn = (sli_intf & SLI_INTF_FT_MASK) ? 1 : 0;
-+}
-+
-+static inline void be_vf_eth_addr_generate(struct be_adapter *adapter, u8 *mac)
-+{
-+ u32 addr;
-+
-+ addr = jhash(adapter->netdev->dev_addr, ETH_ALEN, 0);
-+
-+ mac[5] = (u8)(addr & 0xFF);
-+ mac[4] = (u8)((addr >> 8) & 0xFF);
-+ mac[3] = (u8)((addr >> 16) & 0xFF);
-+ /* Use the OUI programmed in hardware */
-+ memcpy(mac, adapter->netdev->dev_addr, 3);
-+}
-+
-+static inline u16 be_get_tx_vlan_tag(struct be_adapter *adapter,
-+ struct sk_buff *skb)
-+{
-+ u8 vlan_prio = 0;
-+ u16 vlan_tag = 0;
-+
-+ vlan_tag = vlan_tx_tag_get(skb);
-+ vlan_prio = (vlan_tag & VLAN_PRIO_MASK) >> VLAN_PRIO_SHIFT;
-+ /* If vlan priority provided by OS is NOT in available bmap */
-+ if (!(adapter->vlan_prio_bmap & (1 << vlan_prio)))
-+ vlan_tag = (vlan_tag & ~VLAN_PRIO_MASK) |
-+ adapter->recommended_prio;
-+
-+ return vlan_tag;
-+}
-+
-+#define be_physfn(adapter) (!adapter->is_virtfn)
-+
- extern void be_cq_notify(struct be_adapter *adapter, u16 qid, bool arm,
- u16 num_popped);
--extern void be_link_status_update(struct be_adapter *adapter, bool link_up);
-+extern void be_link_status_update(struct be_adapter *adapter, int link_status);
- extern void netdev_stats_update(struct be_adapter *adapter);
-+extern void be_parse_stats(struct be_adapter *adapter);
- extern int be_load_fw(struct be_adapter *adapter, u8 *func);
-+
-+#ifdef CONFIG_PALAU
-+extern void be_sysfs_create_group(struct be_adapter *adapter);
-+extern void be_sysfs_remove_group(struct be_adapter *adapter);
-+#endif
-+
- #endif /* BE_H */
-diff --git a/drivers/net/benet/be_cmds.c b/drivers/net/benet/be_cmds.c
-index 28a0eda..b4ca89c 100644
---- a/drivers/net/benet/be_cmds.c
-+++ b/drivers/net/benet/be_cmds.c
-@@ -1,30 +1,45 @@
- /*
-- * Copyright (C) 2005 - 2009 ServerEngines
-+ * Copyright (C) 2005 - 2011 Emulex
- * All rights reserved.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License version 2
-- * as published by the Free Software Foundation. The full GNU General
-+ * as published by the Free Software Foundation. The full GNU General
- * Public License is included in this distribution in the file called COPYING.
- *
- * Contact Information:
-- * linux-drivers@serverengines.com
-+ * linux-drivers@emulex.com
- *
-- * ServerEngines
-- * 209 N. Fair Oaks Ave
-- * Sunnyvale, CA 94085
-+ * Emulex
-+ * 3333 Susan Street
-+ * Costa Mesa, CA 92626
- */
-
- #include "be.h"
- #include "be_cmds.h"
-
-+/* Must be a power of 2 or else MODULO will BUG_ON */
-+static int be_get_temp_freq = 64;
-+
-+static inline void *embedded_payload(struct be_mcc_wrb *wrb)
-+{
-+ return wrb->payload.embedded_payload;
-+}
-+
- static void be_mcc_notify(struct be_adapter *adapter)
- {
- struct be_queue_info *mccq = &adapter->mcc_obj.q;
- u32 val = 0;
-
-+ if (adapter->eeh_err) {
-+ dev_info(&adapter->pdev->dev, "Error in Card Detected! Cannot issue commands\n");
-+ return;
-+ }
-+
- val |= mccq->id & DB_MCCQ_RING_ID_MASK;
- val |= 1 << DB_MCCQ_NUM_POSTED_SHIFT;
-+
-+ wmb();
- iowrite32(val, adapter->db + DB_MCCQ_OFFSET);
- }
-
-@@ -59,21 +74,67 @@ static int be_mcc_compl_process(struct be_adapter *adapter,
-
- compl_status = (compl->status >> CQE_STATUS_COMPL_SHIFT) &
- CQE_STATUS_COMPL_MASK;
-+
-+ if ((compl->tag0 == OPCODE_COMMON_WRITE_FLASHROM) &&
-+ (compl->tag1 == CMD_SUBSYSTEM_COMMON)) {
-+ adapter->flash_status = compl_status;
-+ complete(&adapter->flash_compl);
-+ }
-+
- if (compl_status == MCC_STATUS_SUCCESS) {
-- if (compl->tag0 == OPCODE_ETH_GET_STATISTICS) {
-- struct be_cmd_resp_get_stats *resp =
-- adapter->stats.cmd.va;
-- be_dws_le_to_cpu(&resp->hw_stats,
-- sizeof(resp->hw_stats));
-+ if ((compl->tag0 == OPCODE_ETH_GET_STATISTICS) &&
-+ (compl->tag1 == CMD_SUBSYSTEM_ETH)) {
-+ if (adapter->generation == BE_GEN3) {
-+ struct be_cmd_resp_get_stats_v1 *resp =
-+ adapter->stats_cmd.va;
-+
-+ be_dws_le_to_cpu(&resp->hw_stats,
-+ sizeof(resp->hw_stats));
-+ } else {
-+ struct be_cmd_resp_get_stats_v0 *resp =
-+ adapter->stats_cmd.va;
-+
-+ be_dws_le_to_cpu(&resp->hw_stats,
-+ sizeof(resp->hw_stats));
-+ }
-+ be_parse_stats(adapter);
- netdev_stats_update(adapter);
-+ adapter->stats_cmd_sent = false;
-+ }
-+ if (compl->tag0 ==
-+ OPCODE_COMMON_GET_CNTL_ADDITIONAL_ATTRIBUTES) {
-+ struct be_mcc_wrb *mcc_wrb =
-+ queue_index_node(&adapter->mcc_obj.q,
-+ compl->tag1);
-+ struct be_cmd_resp_get_cntl_addnl_attribs *resp =
-+ embedded_payload(mcc_wrb);
-+ adapter->drv_stats.be_on_die_temperature =
-+ resp->on_die_temperature;
-+ }
-+ } else {
-+ if (compl->tag0 == OPCODE_COMMON_GET_CNTL_ADDITIONAL_ATTRIBUTES)
-+ be_get_temp_freq = 0;
-+
-+ if (compl->tag1 == MCC_WRB_PASS_THRU)
-+ goto done;
-+
-+ if (compl_status == MCC_STATUS_NOT_SUPPORTED ||
-+ compl_status == MCC_STATUS_ILLEGAL_REQUEST)
-+ goto done;
-+
-+ if (compl_status == MCC_STATUS_UNAUTHORIZED_REQUEST) {
-+ dev_warn(&adapter->pdev->dev, "This domain(VM) is not "
-+ "permitted to execute this cmd (opcode %d)\n",
-+ compl->tag0);
-+ } else {
-+ extd_status = (compl->status >> CQE_STATUS_EXTD_SHIFT) &
-+ CQE_STATUS_EXTD_MASK;
-+ dev_err(&adapter->pdev->dev, "Cmd (opcode %d) failed:"
-+ "status %d, extd-status %d\n",
-+ compl->tag0, compl_status, extd_status);
- }
-- } else if (compl_status != MCC_STATUS_NOT_SUPPORTED) {
-- extd_status = (compl->status >> CQE_STATUS_EXTD_SHIFT) &
-- CQE_STATUS_EXTD_MASK;
-- dev_warn(&adapter->pdev->dev,
-- "Error in cmd completion: status(compl/extd)=%d/%d\n",
-- compl_status, extd_status);
- }
-+done:
- return compl_status;
- }
-
-@@ -82,7 +143,70 @@ static void be_async_link_state_process(struct be_adapter *adapter,
- struct be_async_event_link_state *evt)
- {
- be_link_status_update(adapter,
-- evt->port_link_status == ASYNC_EVENT_LINK_UP);
-+ ((evt->port_link_status & ~ASYNC_EVENT_LOGICAL) ==
-+ ASYNC_EVENT_LINK_UP ? LINK_UP : LINK_DOWN));
-+}
-+
-+/* Grp5 CoS Priority evt */
-+static void be_async_grp5_cos_priority_process(struct be_adapter *adapter,
-+ struct be_async_event_grp5_cos_priority *evt)
-+{
-+ if (evt->valid) {
-+ adapter->vlan_prio_bmap = evt->available_priority_bmap;
-+ adapter->recommended_prio &= ~VLAN_PRIO_MASK;
-+ adapter->recommended_prio =
-+ evt->reco_default_priority << VLAN_PRIO_SHIFT;
-+ }
-+}
-+
-+/* Grp5 QOS Speed evt */
-+static void be_async_grp5_qos_speed_process(struct be_adapter *adapter,
-+ struct be_async_event_grp5_qos_link_speed *evt)
-+{
-+ if (evt->physical_port == adapter->hba_port_num) {
-+ /* qos_link_speed is in units of 10 Mbps */
-+ adapter->link_speed = evt->qos_link_speed * 10;
-+ }
-+}
-+
-+/*Grp5 PVID evt*/
-+static void be_async_grp5_pvid_state_process(struct be_adapter *adapter,
-+ struct be_async_event_grp5_pvid_state *evt)
-+{
-+ if (evt->enabled)
-+ adapter->pvid = le16_to_cpu(evt->tag) & VLAN_VID_MASK ;
-+ else
-+ adapter->pvid = 0;
-+}
-+
-+static void be_async_grp5_evt_process(struct be_adapter *adapter,
-+ u32 trailer, struct be_mcc_compl *evt)
-+{
-+ u8 event_type = 0;
-+
-+ event_type = (trailer >> ASYNC_TRAILER_EVENT_TYPE_SHIFT) &
-+ ASYNC_TRAILER_EVENT_TYPE_MASK;
-+
-+ switch (event_type) {
-+ case ASYNC_EVENT_COS_PRIORITY:
-+ be_async_grp5_cos_priority_process(adapter,
-+ (struct be_async_event_grp5_cos_priority *)evt);
-+ break;
-+ case ASYNC_EVENT_QOS_SPEED:
-+ be_async_grp5_qos_speed_process(adapter,
-+ (struct be_async_event_grp5_qos_link_speed *)evt);
-+ break;
-+ case ASYNC_EVENT_PVID_STATE:
-+ be_async_grp5_pvid_state_process(adapter,
-+ (struct be_async_event_grp5_pvid_state *)evt);
-+ break;
-+ case GRP5_TYPE_PRIO_TC_MAP:
-+ memcpy(adapter->prio_tc_map, evt, MAX_TX_QS);
-+ break;
-+ default:
-+ printk(KERN_WARNING "Unknown grp5 event!\n");
-+ break;
-+ }
- }
-
- static inline bool is_link_state_evt(u32 trailer)
-@@ -92,6 +216,13 @@ static inline bool is_link_state_evt(u32 trailer)
- ASYNC_EVENT_CODE_LINK_STATE);
- }
-
-+static inline bool is_grp5_evt(u32 trailer)
-+{
-+ return (((trailer >> ASYNC_TRAILER_EVENT_CODE_SHIFT) &
-+ ASYNC_TRAILER_EVENT_CODE_MASK) ==
-+ ASYNC_EVENT_CODE_GRP_5);
-+}
-+
- static struct be_mcc_compl *be_mcc_compl_get(struct be_adapter *adapter)
- {
- struct be_queue_info *mcc_cq = &adapter->mcc_obj.cq;
-@@ -104,46 +235,67 @@ static struct be_mcc_compl *be_mcc_compl_get(struct be_adapter *adapter)
- return NULL;
- }
-
--int be_process_mcc(struct be_adapter *adapter)
-+void be_async_mcc_enable(struct be_adapter *adapter)
-+{
-+ spin_lock_bh(&adapter->mcc_cq_lock);
-+
-+ be_cq_notify(adapter, adapter->mcc_obj.cq.id, true, 0);
-+ adapter->mcc_obj.rearm_cq = true;
-+
-+ spin_unlock_bh(&adapter->mcc_cq_lock);
-+}
-+
-+void be_async_mcc_disable(struct be_adapter *adapter)
-+{
-+ adapter->mcc_obj.rearm_cq = false;
-+}
-+
-+int be_process_mcc(struct be_adapter *adapter, int *status)
- {
- struct be_mcc_compl *compl;
-- int num = 0, status = 0;
-+ int num = 0;
-+ struct be_mcc_obj *mcc_obj = &adapter->mcc_obj;
-
- spin_lock_bh(&adapter->mcc_cq_lock);
- while ((compl = be_mcc_compl_get(adapter))) {
- if (compl->flags & CQE_FLAGS_ASYNC_MASK) {
- /* Interpret flags as an async trailer */
-- BUG_ON(!is_link_state_evt(compl->flags));
--
-- /* Interpret compl as a async link evt */
-- be_async_link_state_process(adapter,
-+ if (is_link_state_evt(compl->flags))
-+ be_async_link_state_process(adapter,
- (struct be_async_event_link_state *) compl);
-+ else if (is_grp5_evt(compl->flags))
-+ be_async_grp5_evt_process(adapter,
-+ compl->flags, compl);
-+
- } else if (compl->flags & CQE_FLAGS_COMPLETED_MASK) {
-- status = be_mcc_compl_process(adapter, compl);
-- atomic_dec(&adapter->mcc_obj.q.used);
-+ *status = be_mcc_compl_process(adapter, compl);
-+ atomic_dec(&mcc_obj->q.used);
- }
- be_mcc_compl_use(compl);
- num++;
- }
-
-- if (num)
-- be_cq_notify(adapter, adapter->mcc_obj.cq.id, true, num);
--
- spin_unlock_bh(&adapter->mcc_cq_lock);
-- return status;
-+ return num;
- }
-
- /* Wait till no more pending mcc requests are present */
- static int be_mcc_wait_compl(struct be_adapter *adapter)
- {
- #define mcc_timeout 120000 /* 12s timeout */
-- int i, status;
-+ int i, num, status = 0;
-+ struct be_mcc_obj *mcc_obj = &adapter->mcc_obj;
-+
-+ if (adapter->eeh_err)
-+ return -EIO;
-+
- for (i = 0; i < mcc_timeout; i++) {
-- status = be_process_mcc(adapter);
-- if (status)
-- return status;
-+ num = be_process_mcc(adapter, &status);
-+ if (num)
-+ be_cq_notify(adapter, mcc_obj->cq.id,
-+ mcc_obj->rearm_cq, num);
-
-- if (atomic_read(&adapter->mcc_obj.q.used) == 0)
-+ if (atomic_read(&mcc_obj->q.used) == 0)
- break;
- udelay(100);
- }
-@@ -151,7 +303,7 @@ static int be_mcc_wait_compl(struct be_adapter *adapter)
- dev_err(&adapter->pdev->dev, "mccq poll timed out\n");
- return -1;
- }
-- return 0;
-+ return status;
- }
-
- /* Notify MCC requests and wait for completion */
-@@ -163,23 +315,34 @@ static int be_mcc_notify_wait(struct be_adapter *adapter)
-
- static int be_mbox_db_ready_wait(struct be_adapter *adapter, void __iomem *db)
- {
-- int cnt = 0, wait = 5;
-+ int msecs = 0;
- u32 ready;
-
-+ if (adapter->eeh_err) {
-+ dev_err(&adapter->pdev->dev, "Error detected in card.Cannot issue commands\n");
-+ return -EIO;
-+ }
- do {
-- ready = ioread32(db) & MPU_MAILBOX_DB_RDY_MASK;
-+ ready = ioread32(db);
-+ if (ready == 0xffffffff) {
-+ dev_err(&adapter->pdev->dev,
-+ "pci slot disconnected\n");
-+ return -1;
-+ }
-+
-+ ready &= MPU_MAILBOX_DB_RDY_MASK;
- if (ready)
- break;
-
-- if (cnt > 4000000) {
-+ if (msecs > 4000) {
- dev_err(&adapter->pdev->dev, "mbox poll timed out\n");
-+ be_detect_dump_ue(adapter);
- return -1;
- }
-
-- if (cnt > 50)
-- wait = 200;
-- cnt += wait;
-- udelay(wait);
-+ set_current_state(TASK_UNINTERRUPTIBLE);
-+ schedule_timeout(msecs_to_jiffies(1));
-+ msecs++;
- } while (true);
-
- return 0;
-@@ -198,6 +361,11 @@ static int be_mbox_notify_wait(struct be_adapter *adapter)
- struct be_mcc_mailbox *mbox = mbox_mem->va;
- struct be_mcc_compl *compl = &mbox->compl;
-
-+ /* wait for ready to be set */
-+ status = be_mbox_db_ready_wait(adapter, db);
-+ if (status != 0)
-+ return status;
-+
- val |= MPU_MAILBOX_DB_HI_MASK;
- /* at bits 2 - 31 place mbox dma addr msb bits 34 - 63 */
- val |= (upper_32_bits(mbox_mem->dma) >> 2) << 2;
-@@ -232,7 +400,12 @@ static int be_mbox_notify_wait(struct be_adapter *adapter)
-
- static int be_POST_stage_get(struct be_adapter *adapter, u16 *stage)
- {
-- u32 sem = ioread32(adapter->csr + MPU_EP_SEMAPHORE_OFFSET);
-+ u32 sem;
-+
-+ if (lancer_chip(adapter))
-+ sem = ioread32(adapter->db + MPU_EP_SEMAPHORE_IF_TYPE2_OFFSET);
-+ else
-+ sem = ioread32(adapter->csr + MPU_EP_SEMAPHORE_OFFSET);
-
- *stage = sem & EP_SEMAPHORE_POST_STAGE_MASK;
- if ((sem >> EP_SEMAPHORE_POST_ERR_SHIFT) & EP_SEMAPHORE_POST_ERR_MASK)
-@@ -245,30 +418,29 @@ int be_cmd_POST(struct be_adapter *adapter)
- {
- u16 stage;
- int status, timeout = 0;
-+ struct device *dev = &adapter->pdev->dev;
-
- do {
- status = be_POST_stage_get(adapter, &stage);
- if (status) {
-- dev_err(&adapter->pdev->dev, "POST error; stage=0x%x\n",
-- stage);
-+ dev_err(dev, "POST error; stage=0x%x\n", stage);
- return -1;
- } else if (stage != POST_STAGE_ARMFW_RDY) {
- set_current_state(TASK_INTERRUPTIBLE);
-- schedule_timeout(2 * HZ);
-+ if (schedule_timeout(2 * HZ)) {
-+ dev_err(dev, "POST cmd aborted\n");
-+ return -EINTR;
-+ }
- timeout += 2;
- } else {
- return 0;
- }
-- } while (timeout < 20);
-+ } while (timeout < 40);
-
-- dev_err(&adapter->pdev->dev, "POST timeout; stage=0x%x\n", stage);
-+ dev_err(dev, "POST timeout; stage=0x%x\n", stage);
- return -1;
- }
-
--static inline void *embedded_payload(struct be_mcc_wrb *wrb)
--{
-- return wrb->payload.embedded_payload;
--}
-
- static inline struct be_sge *nonembedded_sgl(struct be_mcc_wrb *wrb)
- {
-@@ -277,7 +449,7 @@ static inline struct be_sge *nonembedded_sgl(struct be_mcc_wrb *wrb)
-
- /* Don't touch the hdr after it's prepared */
- static void be_wrb_hdr_prepare(struct be_mcc_wrb *wrb, int payload_len,
-- bool embedded, u8 sge_cnt)
-+ bool embedded, u8 sge_cnt, u32 opcode)
- {
- if (embedded)
- wrb->embedded |= MCC_WRB_EMBEDDED_MASK;
-@@ -285,7 +457,8 @@ static void be_wrb_hdr_prepare(struct be_mcc_wrb *wrb, int payload_len,
- wrb->embedded |= (sge_cnt & MCC_WRB_SGE_CNT_MASK) <<
- MCC_WRB_SGE_CNT_SHIFT;
- wrb->payload_length = payload_len;
-- be_dws_cpu_to_le(wrb, 20);
-+ wrb->tag0 = opcode;
-+ be_dws_cpu_to_le(wrb, 8);
- }
-
- /* Don't touch the hdr after it's prepared */
-@@ -295,6 +468,7 @@ static void be_cmd_hdr_prepare(struct be_cmd_req_hdr *req_hdr,
- req_hdr->opcode = opcode;
- req_hdr->subsystem = subsystem;
- req_hdr->request_length = cpu_to_le32(cmd_len - sizeof(*req_hdr));
-+ req_hdr->version = 0;
- }
-
- static void be_cmd_page_addrs_prepare(struct phys_addr *pages, u32 max_pages,
-@@ -349,7 +523,11 @@ static struct be_mcc_wrb *wrb_from_mccq(struct be_adapter *adapter)
- struct be_queue_info *mccq = &adapter->mcc_obj.q;
- struct be_mcc_wrb *wrb;
-
-- BUG_ON(atomic_read(&mccq->used) >= mccq->len);
-+ if (atomic_read(&mccq->used) >= mccq->len) {
-+ dev_err(&adapter->pdev->dev, "Out of MCCQ wrbs\n");
-+ return NULL;
-+ }
-+
- wrb = queue_head_node(mccq);
- queue_head_inc(mccq);
- atomic_inc(&mccq->used);
-@@ -357,6 +535,59 @@ static struct be_mcc_wrb *wrb_from_mccq(struct be_adapter *adapter)
- return wrb;
- }
-
-+/* Tell fw we're about to start firing cmds by writing a
-+ * special pattern across the wrb hdr; uses mbox
-+ */
-+int be_cmd_fw_init(struct be_adapter *adapter)
-+{
-+ u8 *wrb;
-+ int status;
-+
-+ if (mutex_lock_interruptible(&adapter->mbox_lock))
-+ return -1;
-+
-+ wrb = (u8 *)wrb_from_mbox(adapter);
-+ *wrb++ = 0xFF;
-+ *wrb++ = 0x12;
-+ *wrb++ = 0x34;
-+ *wrb++ = 0xFF;
-+ *wrb++ = 0xFF;
-+ *wrb++ = 0x56;
-+ *wrb++ = 0x78;
-+ *wrb = 0xFF;
-+
-+ status = be_mbox_notify_wait(adapter);
-+
-+ mutex_unlock(&adapter->mbox_lock);
-+ return status;
-+}
-+
-+/* Tell fw we're done with firing cmds by writing a
-+ * special pattern across the wrb hdr; uses mbox
-+ */
-+int be_cmd_fw_clean(struct be_adapter *adapter)
-+{
-+ u8 *wrb;
-+ int status;
-+
-+ if (mutex_lock_interruptible(&adapter->mbox_lock))
-+ return -1;
-+
-+ wrb = (u8 *)wrb_from_mbox(adapter);
-+ *wrb++ = 0xFF;
-+ *wrb++ = 0xAA;
-+ *wrb++ = 0xBB;
-+ *wrb++ = 0xFF;
-+ *wrb++ = 0xFF;
-+ *wrb++ = 0xCC;
-+ *wrb++ = 0xDD;
-+ *wrb = 0xFF;
-+
-+ status = be_mbox_notify_wait(adapter);
-+
-+ mutex_unlock(&adapter->mbox_lock);
-+ return status;
-+}
- int be_cmd_eq_create(struct be_adapter *adapter,
- struct be_queue_info *eq, int eq_delay)
- {
-@@ -365,20 +596,19 @@ int be_cmd_eq_create(struct be_adapter *adapter,
- struct be_dma_mem *q_mem = &eq->dma_mem;
- int status;
-
-- spin_lock(&adapter->mbox_lock);
-+ if (mutex_lock_interruptible(&adapter->mbox_lock))
-+ return -1;
-
- wrb = wrb_from_mbox(adapter);
- req = embedded_payload(wrb);
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0, OPCODE_COMMON_EQ_CREATE);
-
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
- OPCODE_COMMON_EQ_CREATE, sizeof(*req));
-
- req->num_pages = cpu_to_le16(PAGES_4K_SPANNED(q_mem->va, q_mem->size));
-
-- AMAP_SET_BITS(struct amap_eq_context, func, req->context,
-- be_pci_func(adapter));
- AMAP_SET_BITS(struct amap_eq_context, valid, req->context, 1);
- /* 4byte eqe*/
- AMAP_SET_BITS(struct amap_eq_context, size, req->context, 0);
-@@ -397,7 +627,7 @@ int be_cmd_eq_create(struct be_adapter *adapter,
- eq->created = true;
- }
-
-- spin_unlock(&adapter->mbox_lock);
-+ mutex_unlock(&adapter->mbox_lock);
- return status;
- }
-
-@@ -409,12 +639,14 @@ int be_cmd_mac_addr_query(struct be_adapter *adapter, u8 *mac_addr,
- struct be_cmd_req_mac_query *req;
- int status;
-
-- spin_lock(&adapter->mbox_lock);
-+ if (mutex_lock_interruptible(&adapter->mbox_lock))
-+ return -1;
-
- wrb = wrb_from_mbox(adapter);
- req = embedded_payload(wrb);
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_NTWK_MAC_QUERY);
-
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
- OPCODE_COMMON_NTWK_MAC_QUERY, sizeof(*req));
-@@ -433,13 +665,13 @@ int be_cmd_mac_addr_query(struct be_adapter *adapter, u8 *mac_addr,
- memcpy(mac_addr, resp->mac.addr, ETH_ALEN);
- }
-
-- spin_unlock(&adapter->mbox_lock);
-+ mutex_unlock(&adapter->mbox_lock);
- return status;
- }
-
- /* Uses synchronous MCCQ */
- int be_cmd_pmac_add(struct be_adapter *adapter, u8 *mac_addr,
-- u32 if_id, u32 *pmac_id)
-+ u32 if_id, u32 *pmac_id, u32 domain)
- {
- struct be_mcc_wrb *wrb;
- struct be_cmd_req_pmac_add *req;
-@@ -448,13 +680,19 @@ int be_cmd_pmac_add(struct be_adapter *adapter, u8 *mac_addr,
- spin_lock_bh(&adapter->mcc_lock);
-
- wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
- req = embedded_payload(wrb);
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_NTWK_PMAC_ADD);
-
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
- OPCODE_COMMON_NTWK_PMAC_ADD, sizeof(*req));
-
-+ req->hdr.domain = domain;
- req->if_id = cpu_to_le32(if_id);
- memcpy(req->mac_address, mac_addr, ETH_ALEN);
-
-@@ -464,12 +702,13 @@ int be_cmd_pmac_add(struct be_adapter *adapter, u8 *mac_addr,
- *pmac_id = le32_to_cpu(resp->pmac_id);
- }
-
-+err:
- spin_unlock_bh(&adapter->mcc_lock);
- return status;
- }
-
- /* Uses synchronous MCCQ */
--int be_cmd_pmac_del(struct be_adapter *adapter, u32 if_id, u32 pmac_id)
-+int be_cmd_pmac_del(struct be_adapter *adapter, u32 if_id, u32 pmac_id, u32 dom)
- {
- struct be_mcc_wrb *wrb;
- struct be_cmd_req_pmac_del *req;
-@@ -478,20 +717,26 @@ int be_cmd_pmac_del(struct be_adapter *adapter, u32 if_id, u32 pmac_id)
- spin_lock_bh(&adapter->mcc_lock);
-
- wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
- req = embedded_payload(wrb);
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_NTWK_PMAC_DEL);
-
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
- OPCODE_COMMON_NTWK_PMAC_DEL, sizeof(*req));
-
-+ req->hdr.domain = dom;
- req->if_id = cpu_to_le32(if_id);
- req->pmac_id = cpu_to_le32(pmac_id);
-
- status = be_mcc_notify_wait(adapter);
-
-+err:
- spin_unlock_bh(&adapter->mcc_lock);
--
- return status;
- }
-
-@@ -506,29 +751,51 @@ int be_cmd_cq_create(struct be_adapter *adapter,
- void *ctxt;
- int status;
-
-- spin_lock(&adapter->mbox_lock);
-+ if (mutex_lock_interruptible(&adapter->mbox_lock))
-+ return -1;
-
- wrb = wrb_from_mbox(adapter);
- req = embedded_payload(wrb);
- ctxt = &req->context;
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_CQ_CREATE);
-
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
- OPCODE_COMMON_CQ_CREATE, sizeof(*req));
-
- req->num_pages = cpu_to_le16(PAGES_4K_SPANNED(q_mem->va, q_mem->size));
-
-- AMAP_SET_BITS(struct amap_cq_context, coalescwm, ctxt, coalesce_wm);
-- AMAP_SET_BITS(struct amap_cq_context, nodelay, ctxt, no_delay);
-- AMAP_SET_BITS(struct amap_cq_context, count, ctxt,
-- __ilog2_u32(cq->len/256));
-- AMAP_SET_BITS(struct amap_cq_context, valid, ctxt, 1);
-- AMAP_SET_BITS(struct amap_cq_context, solevent, ctxt, sol_evts);
-- AMAP_SET_BITS(struct amap_cq_context, eventable, ctxt, 1);
-- AMAP_SET_BITS(struct amap_cq_context, eqid, ctxt, eq->id);
-- AMAP_SET_BITS(struct amap_cq_context, armed, ctxt, 1);
-- AMAP_SET_BITS(struct amap_cq_context, func, ctxt, be_pci_func(adapter));
-+ if (lancer_chip(adapter)) {
-+ req->hdr.version = 2;
-+ req->page_size = 1; /* 1 for 4K */
-+ AMAP_SET_BITS(struct amap_cq_context_lancer, coalescwm, ctxt,
-+ coalesce_wm);
-+ AMAP_SET_BITS(struct amap_cq_context_lancer, nodelay, ctxt,
-+ no_delay);
-+ AMAP_SET_BITS(struct amap_cq_context_lancer, count, ctxt,
-+ __ilog2_u32(cq->len/256));
-+ AMAP_SET_BITS(struct amap_cq_context_lancer, valid, ctxt, 1);
-+ AMAP_SET_BITS(struct amap_cq_context_lancer, eventable,
-+ ctxt, 1);
-+ AMAP_SET_BITS(struct amap_cq_context_lancer, eqid,
-+ ctxt, eq->id);
-+ AMAP_SET_BITS(struct amap_cq_context_lancer, armed, ctxt, 1);
-+ } else {
-+ AMAP_SET_BITS(struct amap_cq_context_be, coalescwm, ctxt,
-+ coalesce_wm);
-+ AMAP_SET_BITS(struct amap_cq_context_be, nodelay,
-+ ctxt, no_delay);
-+ AMAP_SET_BITS(struct amap_cq_context_be, count, ctxt,
-+ __ilog2_u32(cq->len/256));
-+ AMAP_SET_BITS(struct amap_cq_context_be, valid, ctxt, 1);
-+ AMAP_SET_BITS(struct amap_cq_context_be, solevent,
-+ ctxt, sol_evts);
-+ AMAP_SET_BITS(struct amap_cq_context_be, eventable, ctxt, 1);
-+ AMAP_SET_BITS(struct amap_cq_context_be, eqid, ctxt, eq->id);
-+ AMAP_SET_BITS(struct amap_cq_context_be, armed, ctxt, 1);
-+ }
-+
- be_dws_cpu_to_le(ctxt, sizeof(req->context));
-
- be_cmd_page_addrs_prepare(req->pages, ARRAY_SIZE(req->pages), q_mem);
-@@ -540,8 +807,7 @@ int be_cmd_cq_create(struct be_adapter *adapter,
- cq->created = true;
- }
-
-- spin_unlock(&adapter->mbox_lock);
--
-+ mutex_unlock(&adapter->mbox_lock);
- return status;
- }
-
-@@ -553,7 +819,68 @@ static u32 be_encoded_q_len(int q_len)
- return len_encoded;
- }
-
--int be_cmd_mccq_create(struct be_adapter *adapter,
-+int be_cmd_mccq_ext_create(struct be_adapter *adapter,
-+ struct be_queue_info *mccq,
-+ struct be_queue_info *cq)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_mcc_ext_create *req;
-+ struct be_dma_mem *q_mem = &mccq->dma_mem;
-+ void *ctxt;
-+ int status;
-+
-+ if (mutex_lock_interruptible(&adapter->mbox_lock))
-+ return -1;
-+
-+ wrb = wrb_from_mbox(adapter);
-+ req = embedded_payload(wrb);
-+ ctxt = &req->context;
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_MCC_CREATE_EXT);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_MCC_CREATE_EXT, sizeof(*req));
-+
-+ req->num_pages = cpu_to_le16(PAGES_4K_SPANNED(q_mem->va, q_mem->size));
-+ if (lancer_chip(adapter)) {
-+ req->hdr.version = 1;
-+ req->cq_id = cpu_to_le16(cq->id);
-+
-+ AMAP_SET_BITS(struct amap_mcc_context_lancer, ring_size, ctxt,
-+ be_encoded_q_len(mccq->len));
-+ AMAP_SET_BITS(struct amap_mcc_context_lancer, valid, ctxt, 1);
-+ AMAP_SET_BITS(struct amap_mcc_context_lancer, async_cq_id,
-+ ctxt, cq->id);
-+ AMAP_SET_BITS(struct amap_mcc_context_lancer, async_cq_valid,
-+ ctxt, 1);
-+
-+ } else {
-+ AMAP_SET_BITS(struct amap_mcc_context_be, valid, ctxt, 1);
-+ AMAP_SET_BITS(struct amap_mcc_context_be, ring_size, ctxt,
-+ be_encoded_q_len(mccq->len));
-+ AMAP_SET_BITS(struct amap_mcc_context_be, cq_id, ctxt, cq->id);
-+ }
-+
-+ /* Subscribe to Link State and Group 5 Events(bits 1 and 5 set) */
-+ req->async_event_bitmap[0] |= cpu_to_le32(0x00000022);
-+
-+ be_dws_cpu_to_le(ctxt, sizeof(req->context));
-+
-+ be_cmd_page_addrs_prepare(req->pages, ARRAY_SIZE(req->pages), q_mem);
-+
-+ status = be_mbox_notify_wait(adapter);
-+ if (!status) {
-+ struct be_cmd_resp_mcc_create *resp = embedded_payload(wrb);
-+ mccq->id = le16_to_cpu(resp->id);
-+ mccq->created = true;
-+ }
-+
-+ mutex_unlock(&adapter->mbox_lock);
-+ return status;
-+}
-+
-+int be_cmd_mccq_org_create(struct be_adapter *adapter,
- struct be_queue_info *mccq,
- struct be_queue_info *cq)
- {
-@@ -563,24 +890,25 @@ int be_cmd_mccq_create(struct be_adapter *adapter,
- void *ctxt;
- int status;
-
-- spin_lock(&adapter->mbox_lock);
-+ if (mutex_lock_interruptible(&adapter->mbox_lock))
-+ return -1;
-
- wrb = wrb_from_mbox(adapter);
- req = embedded_payload(wrb);
- ctxt = &req->context;
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_MCC_CREATE);
-
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
- OPCODE_COMMON_MCC_CREATE, sizeof(*req));
-
-- req->num_pages = PAGES_4K_SPANNED(q_mem->va, q_mem->size);
-+ req->num_pages = cpu_to_le16(PAGES_4K_SPANNED(q_mem->va, q_mem->size));
-
-- AMAP_SET_BITS(struct amap_mcc_context, fid, ctxt, be_pci_func(adapter));
-- AMAP_SET_BITS(struct amap_mcc_context, valid, ctxt, 1);
-- AMAP_SET_BITS(struct amap_mcc_context, ring_size, ctxt,
-- be_encoded_q_len(mccq->len));
-- AMAP_SET_BITS(struct amap_mcc_context, cq_id, ctxt, cq->id);
-+ AMAP_SET_BITS(struct amap_mcc_context_be, valid, ctxt, 1);
-+ AMAP_SET_BITS(struct amap_mcc_context_be, ring_size, ctxt,
-+ be_encoded_q_len(mccq->len));
-+ AMAP_SET_BITS(struct amap_mcc_context_be, cq_id, ctxt, cq->id);
-
- be_dws_cpu_to_le(ctxt, sizeof(req->context));
-
-@@ -592,75 +920,93 @@ int be_cmd_mccq_create(struct be_adapter *adapter,
- mccq->id = le16_to_cpu(resp->id);
- mccq->created = true;
- }
-- spin_unlock(&adapter->mbox_lock);
-
-+ mutex_unlock(&adapter->mbox_lock);
- return status;
- }
-
--int be_cmd_txq_create(struct be_adapter *adapter,
-- struct be_queue_info *txq,
-+int be_cmd_mccq_create(struct be_adapter *adapter,
-+ struct be_queue_info *mccq,
- struct be_queue_info *cq)
- {
-+ int status;
-+
-+ status = be_cmd_mccq_ext_create(adapter, mccq, cq);
-+ if (status && !lancer_chip(adapter)) {
-+ dev_warn(&adapter->pdev->dev, "Upgrade to F/W ver 2.102.235.0 "
-+ "or newer to avoid conflicting priorities between NIC "
-+ "and FCoE traffic");
-+ status = be_cmd_mccq_org_create(adapter, mccq, cq);
-+ }
-+ return status;
-+}
-+
-+int be_cmd_txq_create(struct be_adapter *adapter, struct be_queue_info *txq,
-+ struct be_queue_info *cq, u8 *tc_id)
-+{
- struct be_mcc_wrb *wrb;
- struct be_cmd_req_eth_tx_create *req;
- struct be_dma_mem *q_mem = &txq->dma_mem;
-- void *ctxt;
- int status;
-
-- spin_lock(&adapter->mbox_lock);
-+ if (mutex_lock_interruptible(&adapter->mbox_lock))
-+ return -1;
-
- wrb = wrb_from_mbox(adapter);
- req = embedded_payload(wrb);
-- ctxt = &req->context;
--
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0, OPCODE_ETH_TX_CREATE);
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_ETH, OPCODE_ETH_TX_CREATE,
- sizeof(*req));
-
-- req->num_pages = PAGES_4K_SPANNED(q_mem->va, q_mem->size);
-+ if (adapter->flags & BE_FLAGS_DCBX || lancer_chip(adapter)) {
-+ req->hdr.version = 1;
-+ req->if_id = cpu_to_le16(adapter->if_handle);
-+ }
-+ if (adapter->flags & BE_FLAGS_DCBX)
-+ req->type = cpu_to_le16(ETX_QUEUE_TYPE_PRIORITY);
-+ else
-+ req->type = cpu_to_le16(ETX_QUEUE_TYPE_STANDARD);
- req->ulp_num = BE_ULP1_NUM;
-- req->type = BE_ETH_TX_RING_TYPE_STANDARD;
--
-- AMAP_SET_BITS(struct amap_tx_context, tx_ring_size, ctxt,
-- be_encoded_q_len(txq->len));
-- AMAP_SET_BITS(struct amap_tx_context, pci_func_id, ctxt,
-- be_pci_func(adapter));
-- AMAP_SET_BITS(struct amap_tx_context, ctx_valid, ctxt, 1);
-- AMAP_SET_BITS(struct amap_tx_context, cq_id_send, ctxt, cq->id);
--
-- be_dws_cpu_to_le(ctxt, sizeof(req->context));
--
-+ req->cq_id = cpu_to_le16(cq->id);
-+ req->queue_size = be_encoded_q_len(txq->len);
-+ req->num_pages = PAGES_4K_SPANNED(q_mem->va, q_mem->size);
- be_cmd_page_addrs_prepare(req->pages, ARRAY_SIZE(req->pages), q_mem);
-
- status = be_mbox_notify_wait(adapter);
- if (!status) {
- struct be_cmd_resp_eth_tx_create *resp = embedded_payload(wrb);
- txq->id = le16_to_cpu(resp->cid);
-+ if (adapter->flags & BE_FLAGS_DCBX)
-+ *tc_id = resp->tc_id;
- txq->created = true;
- }
-
-- spin_unlock(&adapter->mbox_lock);
--
-+ mutex_unlock(&adapter->mbox_lock);
- return status;
- }
-
--/* Uses mbox */
-+/* Uses MCC */
- int be_cmd_rxq_create(struct be_adapter *adapter,
- struct be_queue_info *rxq, u16 cq_id, u16 frag_size,
-- u16 max_frame_size, u32 if_id, u32 rss)
-+ u16 max_frame_size, u32 if_id, u32 rss, u8 *rss_id)
- {
- struct be_mcc_wrb *wrb;
- struct be_cmd_req_eth_rx_create *req;
- struct be_dma_mem *q_mem = &rxq->dma_mem;
- int status;
-
-- spin_lock(&adapter->mbox_lock);
-+ spin_lock_bh(&adapter->mcc_lock);
-
-- wrb = wrb_from_mbox(adapter);
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
- req = embedded_payload(wrb);
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_ETH_RX_CREATE);
-
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_ETH, OPCODE_ETH_RX_CREATE,
- sizeof(*req));
-@@ -673,15 +1019,16 @@ int be_cmd_rxq_create(struct be_adapter *adapter,
- req->max_frame_size = cpu_to_le16(max_frame_size);
- req->rss_queue = cpu_to_le32(rss);
-
-- status = be_mbox_notify_wait(adapter);
-+ status = be_mcc_notify_wait(adapter);
- if (!status) {
- struct be_cmd_resp_eth_rx_create *resp = embedded_payload(wrb);
- rxq->id = le16_to_cpu(resp->id);
- rxq->created = true;
-+ *rss_id = resp->rss_id;
- }
-
-- spin_unlock(&adapter->mbox_lock);
--
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
- return status;
- }
-
-@@ -696,13 +1043,12 @@ int be_cmd_q_destroy(struct be_adapter *adapter, struct be_queue_info *q,
- u8 subsys = 0, opcode = 0;
- int status;
-
-- spin_lock(&adapter->mbox_lock);
-+ if (mutex_lock_interruptible(&adapter->mbox_lock))
-+ return -1;
-
- wrb = wrb_from_mbox(adapter);
- req = embedded_payload(wrb);
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
--
- switch (queue_type) {
- case QTYPE_EQ:
- subsys = CMD_SUBSYSTEM_COMMON;
-@@ -727,13 +1073,47 @@ int be_cmd_q_destroy(struct be_adapter *adapter, struct be_queue_info *q,
- default:
- BUG();
- }
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0, opcode);
-+
- be_cmd_hdr_prepare(&req->hdr, subsys, opcode, sizeof(*req));
- req->id = cpu_to_le16(q->id);
-
- status = be_mbox_notify_wait(adapter);
-+ if (!status)
-+ q->created = false;
-
-- spin_unlock(&adapter->mbox_lock);
-+ mutex_unlock(&adapter->mbox_lock);
-+ return status;
-+}
-
-+/* Uses MCC */
-+int be_cmd_rxq_destroy(struct be_adapter *adapter, struct be_queue_info *q)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_q_destroy *req;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+ req = embedded_payload(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0, OPCODE_ETH_RX_DESTROY);
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_ETH, OPCODE_ETH_RX_DESTROY,
-+ sizeof(*req));
-+ req->id = cpu_to_le16(q->id);
-+
-+ status = be_mcc_notify_wait(adapter);
-+ if (!status)
-+ q->created = false;
-+
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
- return status;
- }
-
-@@ -741,22 +1121,26 @@ int be_cmd_q_destroy(struct be_adapter *adapter, struct be_queue_info *q,
- * Uses mbox
- */
- int be_cmd_if_create(struct be_adapter *adapter, u32 cap_flags, u32 en_flags,
-- u8 *mac, bool pmac_invalid, u32 *if_handle, u32 *pmac_id)
-+ u8 *mac, bool pmac_invalid, u32 *if_handle, u32 *pmac_id,
-+ u32 domain)
- {
- struct be_mcc_wrb *wrb;
- struct be_cmd_req_if_create *req;
- int status;
-
-- spin_lock(&adapter->mbox_lock);
-+ if (mutex_lock_interruptible(&adapter->mbox_lock))
-+ return -1;
-
- wrb = wrb_from_mbox(adapter);
- req = embedded_payload(wrb);
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_NTWK_INTERFACE_CREATE);
-
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
- OPCODE_COMMON_NTWK_INTERFACE_CREATE, sizeof(*req));
-
-+ req->hdr.domain = domain;
- req->capability_flags = cpu_to_le32(cap_flags);
- req->enable_flags = cpu_to_le32(en_flags);
- req->pmac_invalid = pmac_invalid;
-@@ -771,33 +1155,35 @@ int be_cmd_if_create(struct be_adapter *adapter, u32 cap_flags, u32 en_flags,
- *pmac_id = le32_to_cpu(resp->pmac_id);
- }
-
-- spin_unlock(&adapter->mbox_lock);
-+ mutex_unlock(&adapter->mbox_lock);
- return status;
- }
-
- /* Uses mbox */
--int be_cmd_if_destroy(struct be_adapter *adapter, u32 interface_id)
-+int be_cmd_if_destroy(struct be_adapter *adapter, u32 interface_id, u32 domain)
- {
- struct be_mcc_wrb *wrb;
- struct be_cmd_req_if_destroy *req;
- int status;
-
-- spin_lock(&adapter->mbox_lock);
-+ if (mutex_lock_interruptible(&adapter->mbox_lock))
-+ return -1;
-
- wrb = wrb_from_mbox(adapter);
- req = embedded_payload(wrb);
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_NTWK_INTERFACE_DESTROY);
-
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
- OPCODE_COMMON_NTWK_INTERFACE_DESTROY, sizeof(*req));
-
-+ req->hdr.domain = domain;
- req->interface_id = cpu_to_le32(interface_id);
-
- status = be_mbox_notify_wait(adapter);
-
-- spin_unlock(&adapter->mbox_lock);
--
-+ mutex_unlock(&adapter->mbox_lock);
- return status;
- }
-
-@@ -808,33 +1194,48 @@ int be_cmd_if_destroy(struct be_adapter *adapter, u32 interface_id)
- int be_cmd_get_stats(struct be_adapter *adapter, struct be_dma_mem *nonemb_cmd)
- {
- struct be_mcc_wrb *wrb;
-- struct be_cmd_req_get_stats *req;
-+ struct be_cmd_req_hdr *hdr;
- struct be_sge *sge;
-+ int status = 0;
-+
-+ if (MODULO(adapter->work_counter, be_get_temp_freq) == 0)
-+ be_cmd_get_die_temperature(adapter);
-
- spin_lock_bh(&adapter->mcc_lock);
-
- wrb = wrb_from_mccq(adapter);
-- req = nonemb_cmd->va;
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+ hdr = nonemb_cmd->va;
- sge = nonembedded_sgl(wrb);
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), false, 1);
-- wrb->tag0 = OPCODE_ETH_GET_STATISTICS;
-+ be_wrb_hdr_prepare(wrb, nonemb_cmd->size, false, 1,
-+ OPCODE_ETH_GET_STATISTICS);
-
-- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_ETH,
-- OPCODE_ETH_GET_STATISTICS, sizeof(*req));
-+ be_cmd_hdr_prepare(hdr, CMD_SUBSYSTEM_ETH,
-+ OPCODE_ETH_GET_STATISTICS, nonemb_cmd->size);
-+
-+ if (adapter->generation == BE_GEN3)
-+ hdr->version = 1;
-+
-+ wrb->tag1 = CMD_SUBSYSTEM_ETH;
- sge->pa_hi = cpu_to_le32(upper_32_bits(nonemb_cmd->dma));
- sge->pa_lo = cpu_to_le32(nonemb_cmd->dma & 0xFFFFFFFF);
- sge->len = cpu_to_le32(nonemb_cmd->size);
-
- be_mcc_notify(adapter);
-+ adapter->stats_cmd_sent = true;
-
-+err:
- spin_unlock_bh(&adapter->mcc_lock);
-- return 0;
-+ return status;
- }
-
- /* Uses synchronous mcc */
- int be_cmd_link_status_query(struct be_adapter *adapter,
-- bool *link_up)
-+ int *link_status, u8 *mac_speed, u16 *link_speed, u32 dom)
- {
- struct be_mcc_wrb *wrb;
- struct be_cmd_req_link_status *req;
-@@ -843,50 +1244,216 @@ int be_cmd_link_status_query(struct be_adapter *adapter,
- spin_lock_bh(&adapter->mcc_lock);
-
- wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
- req = embedded_payload(wrb);
-
-- *link_up = false;
-+ *link_status = LINK_DOWN;
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_NTWK_LINK_STATUS_QUERY);
-
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
- OPCODE_COMMON_NTWK_LINK_STATUS_QUERY, sizeof(*req));
-
-+ req->hdr.domain = dom;
-+
- status = be_mcc_notify_wait(adapter);
- if (!status) {
- struct be_cmd_resp_link_status *resp = embedded_payload(wrb);
-- if (resp->mac_speed != PHY_LINK_SPEED_ZERO)
-- *link_up = true;
-+ if (resp->mac_speed != PHY_LINK_SPEED_ZERO) {
-+ *link_status = LINK_UP;
-+ *link_speed = le16_to_cpu(resp->link_speed);
-+ *mac_speed = resp->mac_speed;
-+ }
- }
-
-+err:
- spin_unlock_bh(&adapter->mcc_lock);
- return status;
- }
-
--/* Uses Mbox */
--int be_cmd_get_fw_ver(struct be_adapter *adapter, char *fw_ver)
-+/* Uses synchronous mcc */
-+int be_cmd_get_die_temperature(struct be_adapter *adapter)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_get_cntl_addnl_attribs *req;
-+ u16 mccq_index;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ mccq_index = adapter->mcc_obj.q.head;
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+ req = embedded_payload(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_GET_CNTL_ADDITIONAL_ATTRIBUTES);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_GET_CNTL_ADDITIONAL_ATTRIBUTES, sizeof(*req));
-+
-+ wrb->tag1 = mccq_index;
-+
-+ be_mcc_notify(adapter);
-+
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+
-+/* Uses synchronous mcc */
-+int be_cmd_get_reg_len(struct be_adapter *adapter, u32 *log_size)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_get_fat *req;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+ req = embedded_payload(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_MANAGE_FAT);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_MANAGE_FAT, sizeof(*req));
-+ req->fat_operation = cpu_to_le32(QUERY_FAT);
-+ status = be_mcc_notify_wait(adapter);
-+ if (!status) {
-+ struct be_cmd_resp_get_fat *resp = embedded_payload(wrb);
-+ if (log_size && resp->log_size)
-+ *log_size = le32_to_cpu(resp->log_size) -
-+ sizeof(u32);
-+ }
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+void be_cmd_get_regs(struct be_adapter *adapter, u32 buf_len, void *buf)
-+{
-+ struct be_dma_mem get_fat_cmd;
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_get_fat *req;
-+ struct be_sge *sge;
-+ u32 offset = 0, total_size, buf_size,
-+ log_offset = sizeof(u32), payload_len;
-+ int status;
-+
-+ if (buf_len == 0)
-+ return;
-+
-+ total_size = buf_len;
-+
-+ get_fat_cmd.size = sizeof(struct be_cmd_req_get_fat) + 60*1024;
-+ get_fat_cmd.va = pci_alloc_consistent(adapter->pdev,
-+ get_fat_cmd.size,
-+ &get_fat_cmd.dma);
-+ if (!get_fat_cmd.va) {
-+ status = -ENOMEM;
-+ dev_err(&adapter->pdev->dev,
-+ "Memory allocation failure while retrieving FAT data\n");
-+ return;
-+ }
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ while (total_size) {
-+ buf_size = min(total_size, (u32)60*1024);
-+ total_size -= buf_size;
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+ req = get_fat_cmd.va;
-+ sge = nonembedded_sgl(wrb);
-+
-+ payload_len = sizeof(struct be_cmd_req_get_fat) + buf_size;
-+ be_wrb_hdr_prepare(wrb, payload_len, false, 1,
-+ OPCODE_COMMON_MANAGE_FAT);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_MANAGE_FAT, payload_len);
-+
-+ sge->pa_hi = cpu_to_le32(upper_32_bits(get_fat_cmd.dma));
-+ sge->pa_lo = cpu_to_le32(get_fat_cmd.dma & 0xFFFFFFFF);
-+ sge->len = cpu_to_le32(get_fat_cmd.size);
-+
-+ req->fat_operation = cpu_to_le32(RETRIEVE_FAT);
-+ req->read_log_offset = cpu_to_le32(log_offset);
-+ req->read_log_length = cpu_to_le32(buf_size);
-+ req->data_buffer_size = cpu_to_le32(buf_size);
-+
-+ status = be_mcc_notify_wait(adapter);
-+ if (!status) {
-+ struct be_cmd_resp_get_fat *resp = get_fat_cmd.va;
-+ memcpy(buf + offset,
-+ resp->data_buffer,
-+ le32_to_cpu(resp->read_log_length));
-+ } else {
-+ dev_err(&adapter->pdev->dev, "FAT Table Retrieve error\n");
-+ goto err;
-+ }
-+ offset += buf_size;
-+ log_offset += buf_size;
-+ }
-+err:
-+ pci_free_consistent(adapter->pdev, get_fat_cmd.size,
-+ get_fat_cmd.va,
-+ get_fat_cmd.dma);
-+ spin_unlock_bh(&adapter->mcc_lock);
-+}
-+
-+/* Uses synchronous mcc */
-+int be_cmd_get_fw_ver(struct be_adapter *adapter, char *fw_ver,
-+ char *fw_on_flash)
- {
- struct be_mcc_wrb *wrb;
- struct be_cmd_req_get_fw_version *req;
- int status;
-
-- spin_lock(&adapter->mbox_lock);
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-
-- wrb = wrb_from_mbox(adapter);
- req = embedded_payload(wrb);
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_GET_FW_VERSION);
-
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
- OPCODE_COMMON_GET_FW_VERSION, sizeof(*req));
-
-- status = be_mbox_notify_wait(adapter);
-+ status = be_mcc_notify_wait(adapter);
- if (!status) {
- struct be_cmd_resp_get_fw_version *resp = embedded_payload(wrb);
-- strncpy(fw_ver, resp->firmware_version_string, FW_VER_LEN);
-+ strncpy(fw_ver, resp->firmware_version_string, FW_VER_LEN-1);
-+ if (fw_on_flash)
-+ strncpy(fw_on_flash, resp->fw_on_flash_version_string,
-+ FW_VER_LEN-1);
- }
--
-- spin_unlock(&adapter->mbox_lock);
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
- return status;
- }
-
-@@ -897,13 +1464,19 @@ int be_cmd_modify_eqd(struct be_adapter *adapter, u32 eq_id, u32 eqd)
- {
- struct be_mcc_wrb *wrb;
- struct be_cmd_req_modify_eq_delay *req;
-+ int status = 0;
-
- spin_lock_bh(&adapter->mcc_lock);
-
- wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
- req = embedded_payload(wrb);
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_MODIFY_EQ_DELAY);
-
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
- OPCODE_COMMON_MODIFY_EQ_DELAY, sizeof(*req));
-@@ -915,8 +1488,9 @@ int be_cmd_modify_eqd(struct be_adapter *adapter, u32 eq_id, u32 eqd)
-
- be_mcc_notify(adapter);
-
-+err:
- spin_unlock_bh(&adapter->mcc_lock);
-- return 0;
-+ return status;
- }
-
- /* Uses sycnhronous mcc */
-@@ -930,9 +1504,14 @@ int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array,
- spin_lock_bh(&adapter->mcc_lock);
-
- wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
- req = embedded_payload(wrb);
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_NTWK_VLAN_CONFIG);
-
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
- OPCODE_COMMON_NTWK_VLAN_CONFIG, sizeof(*req));
-@@ -948,79 +1527,63 @@ int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array,
-
- status = be_mcc_notify_wait(adapter);
-
-+err:
- spin_unlock_bh(&adapter->mcc_lock);
- return status;
- }
-
--/* Uses MCC for this command as it may be called in BH context
-- * Uses synchronous mcc
-- */
--int be_cmd_promiscuous_config(struct be_adapter *adapter, u8 port_num, bool en)
-+int be_cmd_rx_filter(struct be_adapter *adapter, u32 flags, u32 value)
- {
- struct be_mcc_wrb *wrb;
-- struct be_cmd_req_promiscuous_config *req;
-+ struct be_dma_mem *mem = &adapter->rx_filter;
-+ struct be_cmd_req_rx_filter *req = mem->va;
-+ struct be_sge *sge;
- int status;
-
- spin_lock_bh(&adapter->mcc_lock);
-
- wrb = wrb_from_mccq(adapter);
-- req = embedded_payload(wrb);
--
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
--
-- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_ETH,
-- OPCODE_ETH_PROMISCUOUS, sizeof(*req));
--
-- if (port_num)
-- req->port1_promiscuous = en;
-- else
-- req->port0_promiscuous = en;
--
-- status = be_mcc_notify_wait(adapter);
--
-- spin_unlock_bh(&adapter->mcc_lock);
-- return status;
--}
--
--/*
-- * Uses MCC for this command as it may be called in BH context
-- * (mc == NULL) => multicast promiscous
-- */
--int be_cmd_multicast_set(struct be_adapter *adapter, u32 if_id,
-- struct dev_mc_list *mc_list, u32 mc_count)
--{
--#define BE_MAX_MC 32 /* set mcast promisc if > 32 */
-- struct be_mcc_wrb *wrb;
-- struct be_cmd_req_mcast_mac_config *req;
--
-- spin_lock_bh(&adapter->mcc_lock);
--
-- wrb = wrb_from_mccq(adapter);
-- req = embedded_payload(wrb);
--
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
--
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+ sge = nonembedded_sgl(wrb);
-+ sge->pa_hi = cpu_to_le32(upper_32_bits(mem->dma));
-+ sge->pa_lo = cpu_to_le32(mem->dma & 0xFFFFFFFF);
-+ sge->len = cpu_to_le32(mem->size);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), false, 1,
-+ OPCODE_COMMON_NTWK_RX_FILTER);
-+
-+ memset(req, 0, sizeof(*req));
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-- OPCODE_COMMON_NTWK_MULTICAST_SET, sizeof(*req));
-+ OPCODE_COMMON_NTWK_RX_FILTER, sizeof(*req));
-
-- req->interface_id = if_id;
-- if (mc_list && mc_count <= BE_MAX_MC) {
-- int i;
-- struct dev_mc_list *mc;
--
-- req->num_mac = cpu_to_le16(mc_count);
--
-- for (mc = mc_list, i = 0; mc; mc = mc->next, i++)
-- memcpy(req->mac[i].byte, mc->dmi_addr, ETH_ALEN);
-+ req->if_id = cpu_to_le32(adapter->if_handle);
-+ if (flags & IFF_PROMISC) {
-+ req->if_flags_mask = cpu_to_le32(BE_IF_FLAGS_PROMISCUOUS |
-+ BE_IF_FLAGS_VLAN_PROMISCUOUS);
-+ if (value == ON)
-+ req->if_flags = cpu_to_le32(BE_IF_FLAGS_PROMISCUOUS |
-+ BE_IF_FLAGS_VLAN_PROMISCUOUS);
-+ } else if (flags & IFF_ALLMULTI) {
-+ req->if_flags_mask = req->if_flags =
-+ cpu_to_le32(BE_IF_FLAGS_MCAST_PROMISCUOUS);
- } else {
-- req->promiscuous = 1;
-- }
-+ struct netdev_hw_addr *ha;
-+ int i = 0;
-
-- be_mcc_notify_wait(adapter);
-+ req->if_flags_mask = req->if_flags =
-+ cpu_to_le32(BE_IF_FLAGS_MULTICAST);
-+ req->mcast_num = cpu_to_le16(netdev_mc_count(adapter->netdev));
-+ netdev_for_each_mc_addr(ha, adapter->netdev)
-+ memcpy(req->mcast_mac[i++].byte, ha->DMI_ADDR,
-+ ETH_ALEN);
-+ }
-+ status = be_mcc_notify_wait(adapter);
-
-+err:
- spin_unlock_bh(&adapter->mcc_lock);
--
-- return 0;
-+ return status;
- }
-
- /* Uses synchrounous mcc */
-@@ -1033,9 +1596,14 @@ int be_cmd_set_flow_control(struct be_adapter *adapter, u32 tx_fc, u32 rx_fc)
- spin_lock_bh(&adapter->mcc_lock);
-
- wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
- req = embedded_payload(wrb);
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_SET_FLOW_CONTROL);
-
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
- OPCODE_COMMON_SET_FLOW_CONTROL, sizeof(*req));
-@@ -1045,6 +1613,7 @@ int be_cmd_set_flow_control(struct be_adapter *adapter, u32 tx_fc, u32 rx_fc)
-
- status = be_mcc_notify_wait(adapter);
-
-+err:
- spin_unlock_bh(&adapter->mcc_lock);
- return status;
- }
-@@ -1059,9 +1628,14 @@ int be_cmd_get_flow_control(struct be_adapter *adapter, u32 *tx_fc, u32 *rx_fc)
- spin_lock_bh(&adapter->mcc_lock);
-
- wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
- req = embedded_payload(wrb);
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_GET_FLOW_CONTROL);
-
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
- OPCODE_COMMON_GET_FLOW_CONTROL, sizeof(*req));
-@@ -1074,23 +1648,27 @@ int be_cmd_get_flow_control(struct be_adapter *adapter, u32 *tx_fc, u32 *rx_fc)
- *rx_fc = le16_to_cpu(resp->rx_flow_control);
- }
-
-+err:
- spin_unlock_bh(&adapter->mcc_lock);
- return status;
- }
-
- /* Uses mbox */
--int be_cmd_query_fw_cfg(struct be_adapter *adapter, u32 *port_num, u32 *cap)
-+int be_cmd_query_fw_cfg(struct be_adapter *adapter, u32 *port_num,
-+ u32 *mode, u32 *function_caps)
- {
- struct be_mcc_wrb *wrb;
- struct be_cmd_req_query_fw_cfg *req;
- int status;
-
-- spin_lock(&adapter->mbox_lock);
-+ if (mutex_lock_interruptible(&adapter->mbox_lock))
-+ return -1;
-
- wrb = wrb_from_mbox(adapter);
- req = embedded_payload(wrb);
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_QUERY_FIRMWARE_CONFIG);
-
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
- OPCODE_COMMON_QUERY_FIRMWARE_CONFIG, sizeof(*req));
-@@ -1099,10 +1677,11 @@ int be_cmd_query_fw_cfg(struct be_adapter *adapter, u32 *port_num, u32 *cap)
- if (!status) {
- struct be_cmd_resp_query_fw_cfg *resp = embedded_payload(wrb);
- *port_num = le32_to_cpu(resp->phys_port);
-- *cap = le32_to_cpu(resp->function_cap);
-+ *mode = le32_to_cpu(resp->function_mode);
-+ *function_caps = le32_to_cpu(resp->function_caps);
- }
-
-- spin_unlock(&adapter->mbox_lock);
-+ mutex_unlock(&adapter->mbox_lock);
- return status;
- }
-
-@@ -1113,19 +1692,161 @@ int be_cmd_reset_function(struct be_adapter *adapter)
- struct be_cmd_req_hdr *req;
- int status;
-
-- spin_lock(&adapter->mbox_lock);
-+ if (mutex_lock_interruptible(&adapter->mbox_lock))
-+ return -1;
-
- wrb = wrb_from_mbox(adapter);
- req = embedded_payload(wrb);
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_FUNCTION_RESET);
-
- be_cmd_hdr_prepare(req, CMD_SUBSYSTEM_COMMON,
- OPCODE_COMMON_FUNCTION_RESET, sizeof(*req));
-
- status = be_mbox_notify_wait(adapter);
-
-- spin_unlock(&adapter->mbox_lock);
-+ mutex_unlock(&adapter->mbox_lock);
-+ return status;
-+}
-+
-+int be_cmd_rss_config(struct be_adapter *adapter, u8 *rsstable, u16 table_size)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_rss_config *req;
-+ u32 myhash[10] = {0x0123, 0x4567, 0x89AB, 0xCDEF, 0x01EF,
-+ 0x0123, 0x4567, 0x89AB, 0xCDEF, 0x01EF};
-+ int status;
-+
-+ if (mutex_lock_interruptible(&adapter->mbox_lock))
-+ return -1;
-+
-+ wrb = wrb_from_mbox(adapter);
-+ req = embedded_payload(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_ETH_RSS_CONFIG);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_ETH,
-+ OPCODE_ETH_RSS_CONFIG, sizeof(*req));
-+
-+ req->if_id = cpu_to_le32(adapter->if_handle);
-+ req->enable_rss = cpu_to_le16(RSS_ENABLE_TCP_IPV4 | RSS_ENABLE_IPV4);
-+ req->cpu_table_size_log2 = cpu_to_le16(fls(table_size) - 1);
-+ memcpy(req->cpu_table, rsstable, table_size);
-+ memcpy(req->hash, myhash, sizeof(myhash));
-+ be_dws_cpu_to_le(req->hash, sizeof(req->hash));
-+
-+ status = be_mbox_notify_wait(adapter);
-+
-+ mutex_unlock(&adapter->mbox_lock);
-+ return status;
-+}
-+
-+/* Uses sync mcc */
-+int be_cmd_set_beacon_state(struct be_adapter *adapter, u8 port_num,
-+ u8 bcn, u8 sts, u8 state)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_enable_disable_beacon *req;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+ req = embedded_payload(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_ENABLE_DISABLE_BEACON);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_ENABLE_DISABLE_BEACON, sizeof(*req));
-+
-+ req->port_num = port_num;
-+ req->beacon_state = state;
-+ req->beacon_duration = bcn;
-+ req->status_duration = sts;
-+
-+ status = be_mcc_notify_wait(adapter);
-+
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+/* Uses sync mcc */
-+int be_cmd_get_beacon_state(struct be_adapter *adapter, u8 port_num, u32 *state)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_get_beacon_state *req;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+ req = embedded_payload(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_GET_BEACON_STATE);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_GET_BEACON_STATE, sizeof(*req));
-+
-+ req->port_num = port_num;
-+
-+ status = be_mcc_notify_wait(adapter);
-+ if (!status) {
-+ struct be_cmd_resp_get_beacon_state *resp =
-+ embedded_payload(wrb);
-+ *state = resp->beacon_state;
-+ }
-+
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+/* Uses sync mcc */
-+int be_cmd_read_port_type(struct be_adapter *adapter, u32 port,
-+ u8 *connector)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_port_type *req;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+ req = embedded_payload(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(struct be_cmd_resp_port_type), true, 0,
-+ OPCODE_COMMON_READ_TRANSRECV_DATA);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_READ_TRANSRECV_DATA, sizeof(*req));
-+
-+ req->port = cpu_to_le32(port);
-+ req->page_num = cpu_to_le32(TR_PAGE_A0);
-+ status = be_mcc_notify_wait(adapter);
-+ if (!status) {
-+ struct be_cmd_resp_port_type *resp = embedded_payload(wrb);
-+ *connector = resp->data.connector;
-+ }
-+
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
- return status;
- }
-
-@@ -1133,16 +1854,24 @@ int be_cmd_write_flashrom(struct be_adapter *adapter, struct be_dma_mem *cmd,
- u32 flash_type, u32 flash_opcode, u32 buf_size)
- {
- struct be_mcc_wrb *wrb;
-- struct be_cmd_write_flashrom *req = cmd->va;
-+ struct be_cmd_write_flashrom *req;
- struct be_sge *sge;
- int status;
-
- spin_lock_bh(&adapter->mcc_lock);
-+ adapter->flash_status = 0;
-
- wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err_unlock;
-+ }
-+ req = cmd->va;
- sge = nonembedded_sgl(wrb);
-
-- be_wrb_hdr_prepare(wrb, cmd->size, false, 1);
-+ be_wrb_hdr_prepare(wrb, cmd->size, false, 1,
-+ OPCODE_COMMON_WRITE_FLASHROM);
-+ wrb->tag1 = CMD_SUBSYSTEM_COMMON;
-
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
- OPCODE_COMMON_WRITE_FLASHROM, cmd->size);
-@@ -1154,8 +1883,852 @@ int be_cmd_write_flashrom(struct be_adapter *adapter, struct be_dma_mem *cmd,
- req->params.op_code = cpu_to_le32(flash_opcode);
- req->params.data_buf_size = cpu_to_le32(buf_size);
-
-+ be_mcc_notify(adapter);
-+ spin_unlock_bh(&adapter->mcc_lock);
-+
-+ if (!wait_for_completion_timeout(&adapter->flash_compl,
-+ msecs_to_jiffies(40000)))
-+ status = -1;
-+ else
-+ status = adapter->flash_status;
-+
-+ return status;
-+
-+err_unlock:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+int be_cmd_get_flash_crc(struct be_adapter *adapter, u8 *flashed_crc,
-+ int offset)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_write_flashrom *req;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+ req = embedded_payload(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req)+4, true, 0,
-+ OPCODE_COMMON_READ_FLASHROM);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_READ_FLASHROM, sizeof(*req)+4);
-+
-+ req->params.op_type = cpu_to_le32(IMG_TYPE_REDBOOT);
-+ req->params.op_code = cpu_to_le32(FLASHROM_OPER_REPORT);
-+ req->params.offset = cpu_to_le32(offset);
-+ req->params.data_buf_size = cpu_to_le32(0x4);
-+
-+ status = be_mcc_notify_wait(adapter);
-+ if (!status)
-+ memcpy(flashed_crc, req->params.data_buf, 4);
-+
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+int be_cmd_enable_magic_wol(struct be_adapter *adapter, u8 *mac,
-+ struct be_dma_mem *nonemb_cmd)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_acpi_wol_magic_config *req;
-+ struct be_sge *sge;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+ req = nonemb_cmd->va;
-+ sge = nonembedded_sgl(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), false, 1,
-+ OPCODE_ETH_ACPI_WOL_MAGIC_CONFIG);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_ETH,
-+ OPCODE_ETH_ACPI_WOL_MAGIC_CONFIG, sizeof(*req));
-+ memcpy(req->magic_mac, mac, ETH_ALEN);
-+
-+ sge->pa_hi = cpu_to_le32(upper_32_bits(nonemb_cmd->dma));
-+ sge->pa_lo = cpu_to_le32(nonemb_cmd->dma & 0xFFFFFFFF);
-+ sge->len = cpu_to_le32(nonemb_cmd->size);
-+
-+ status = be_mcc_notify_wait(adapter);
-+
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+int be_cmd_set_loopback(struct be_adapter *adapter, u8 port_num,
-+ u8 loopback_type, u8 enable)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_set_lmode *req;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+
-+ req = embedded_payload(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_LOWLEVEL_SET_LOOPBACK_MODE);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_LOWLEVEL,
-+ OPCODE_LOWLEVEL_SET_LOOPBACK_MODE,
-+ sizeof(*req));
-+
-+ req->src_port = port_num;
-+ req->dest_port = port_num;
-+ req->loopback_type = loopback_type;
-+ req->loopback_state = enable;
-+
-+ status = be_mcc_notify_wait(adapter);
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+int be_cmd_loopback_test(struct be_adapter *adapter, u32 port_num,
-+ u32 loopback_type, u32 pkt_size, u32 num_pkts, u64 pattern)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_loopback_test *req;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+
-+ req = embedded_payload(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_LOWLEVEL_LOOPBACK_TEST);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_LOWLEVEL,
-+ OPCODE_LOWLEVEL_LOOPBACK_TEST, sizeof(*req));
-+ req->hdr.timeout = cpu_to_le32(4);
-+
-+ req->pattern = cpu_to_le64(pattern);
-+ req->src_port = cpu_to_le32(port_num);
-+ req->dest_port = cpu_to_le32(port_num);
-+ req->pkt_size = cpu_to_le32(pkt_size);
-+ req->num_pkts = cpu_to_le32(num_pkts);
-+ req->loopback_type = cpu_to_le32(loopback_type);
-+
-+ status = be_mcc_notify_wait(adapter);
-+ if (!status) {
-+ struct be_cmd_resp_loopback_test *resp = embedded_payload(wrb);
-+ status = le32_to_cpu(resp->status);
-+ }
-+
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+int be_cmd_ddr_dma_test(struct be_adapter *adapter, u64 pattern,
-+ u32 byte_cnt, struct be_dma_mem *cmd)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_ddrdma_test *req;
-+ struct be_sge *sge;
-+ int status;
-+ int i, j = 0;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+ req = cmd->va;
-+ sge = nonembedded_sgl(wrb);
-+ be_wrb_hdr_prepare(wrb, cmd->size, false, 1,
-+ OPCODE_LOWLEVEL_HOST_DDR_DMA);
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_LOWLEVEL,
-+ OPCODE_LOWLEVEL_HOST_DDR_DMA, cmd->size);
-+
-+ sge->pa_hi = cpu_to_le32(upper_32_bits(cmd->dma));
-+ sge->pa_lo = cpu_to_le32(cmd->dma & 0xFFFFFFFF);
-+ sge->len = cpu_to_le32(cmd->size);
-+
-+ req->pattern = cpu_to_le64(pattern);
-+ req->byte_count = cpu_to_le32(byte_cnt);
-+ for (i = 0; i < byte_cnt; i++) {
-+ req->snd_buff[i] = (u8)(pattern >> (j*8));
-+ j++;
-+ if (j > 7)
-+ j = 0;
-+ }
-+
-+ status = be_mcc_notify_wait(adapter);
-+
-+ if (!status) {
-+ struct be_cmd_resp_ddrdma_test *resp;
-+ resp = cmd->va;
-+ if ((memcmp(resp->rcv_buff, req->snd_buff, byte_cnt) != 0) ||
-+ resp->snd_err) {
-+ status = -1;
-+ }
-+ }
-+
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+int be_cmd_get_seeprom_data(struct be_adapter *adapter,
-+ struct be_dma_mem *nonemb_cmd)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_seeprom_read *req;
-+ struct be_sge *sge;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ req = nonemb_cmd->va;
-+ sge = nonembedded_sgl(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), false, 1,
-+ OPCODE_COMMON_SEEPROM_READ);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_SEEPROM_READ, sizeof(*req));
-+
-+ sge->pa_hi = cpu_to_le32(upper_32_bits(nonemb_cmd->dma));
-+ sge->pa_lo = cpu_to_le32(nonemb_cmd->dma & 0xFFFFFFFF);
-+ sge->len = cpu_to_le32(nonemb_cmd->size);
-+
-+ status = be_mcc_notify_wait(adapter);
-+
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+int be_cmd_get_phy_info(struct be_adapter *adapter,
-+ struct be_phy_info *phy_info)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_get_phy_info *req;
-+ struct be_sge *sge;
-+ struct be_dma_mem cmd;
-+ struct be_phy_info *resp_phy_info;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+ cmd.size = sizeof(struct be_cmd_req_get_phy_info);
-+ cmd.va = pci_alloc_consistent(adapter->pdev, cmd.size,
-+ &cmd.dma);
-+ if (!cmd.va) {
-+ dev_err(&adapter->pdev->dev, "Memory alloc failure\n");
-+ status = -ENOMEM;
-+ goto err;
-+ }
-+
-+ req = cmd.va;
-+ sge = nonembedded_sgl(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), false, 1,
-+ OPCODE_COMMON_GET_PHY_DETAILS);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_GET_PHY_DETAILS,
-+ sizeof(*req));
-+
-+ sge->pa_hi = cpu_to_le32(upper_32_bits(cmd.dma));
-+ sge->pa_lo = cpu_to_le32(cmd.dma & 0xFFFFFFFF);
-+ sge->len = cpu_to_le32(cmd.size);
-+
-+ status = be_mcc_notify_wait(adapter);
-+ if (!status) {
-+ resp_phy_info = cmd.va + sizeof(struct be_cmd_req_hdr);
-+ phy_info->phy_type = le16_to_cpu(resp_phy_info->phy_type);
-+ phy_info->interface_type =
-+ le16_to_cpu(resp_phy_info->interface_type);
-+ phy_info->auto_speeds_supported =
-+ le16_to_cpu(resp_phy_info->auto_speeds_supported);
-+ phy_info->fixed_speeds_supported =
-+ le16_to_cpu(resp_phy_info->fixed_speeds_supported);
-+ phy_info->misc_params =
-+ le32_to_cpu(resp_phy_info->misc_params);
-+ }
-+ pci_free_consistent(adapter->pdev, cmd.size,
-+ cmd.va, cmd.dma);
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+int be_cmd_set_qos(struct be_adapter *adapter, u32 bps, u32 domain)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_set_qos *req;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+
-+ req = embedded_payload(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_SET_QOS);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_SET_QOS, sizeof(*req));
-+
-+ req->hdr.domain = domain;
-+ req->valid_bits = cpu_to_le32(BE_QOS_BITS_NIC);
-+ req->max_bps_nic = cpu_to_le32(bps);
-+
-+ status = be_mcc_notify_wait(adapter);
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+int be_cmd_get_cntl_attributes(struct be_adapter *adapter)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_cntl_attribs *req;
-+ struct be_cmd_resp_cntl_attribs *resp;
-+ struct be_sge *sge;
-+ int status;
-+ int payload_len = max(sizeof(*req), sizeof(*resp));
-+ struct mgmt_controller_attrib *attribs;
-+ struct be_dma_mem attribs_cmd;
-+
-+ memset(&attribs_cmd, 0, sizeof(struct be_dma_mem));
-+ attribs_cmd.size = sizeof(struct be_cmd_resp_cntl_attribs);
-+ attribs_cmd.va = pci_alloc_consistent(adapter->pdev, attribs_cmd.size,
-+ &attribs_cmd.dma);
-+ if (!attribs_cmd.va) {
-+ dev_err(&adapter->pdev->dev,
-+ "Memory allocation failure\n");
-+ return -ENOMEM;
-+ }
-+
-+ if (mutex_lock_interruptible(&adapter->mbox_lock))
-+ return -1;
-+
-+ wrb = wrb_from_mbox(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+ req = attribs_cmd.va;
-+ sge = nonembedded_sgl(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, payload_len, false, 1,
-+ OPCODE_COMMON_GET_CNTL_ATTRIBUTES);
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_GET_CNTL_ATTRIBUTES, payload_len);
-+ sge->pa_hi = cpu_to_le32(upper_32_bits(attribs_cmd.dma));
-+ sge->pa_lo = cpu_to_le32(attribs_cmd.dma & 0xFFFFFFFF);
-+ sge->len = cpu_to_le32(attribs_cmd.size);
-+
-+ status = be_mbox_notify_wait(adapter);
-+ if (!status) {
-+ attribs = (struct mgmt_controller_attrib *)(attribs_cmd.va +
-+ sizeof(struct be_cmd_resp_hdr));
-+ adapter->hba_port_num = attribs->hba_attribs.phy_port;
-+ strncpy(adapter->model_number,
-+ attribs->hba_attribs.controller_model_number, 31);
-+ }
-+
-+err:
-+ mutex_unlock(&adapter->mbox_lock);
-+ pci_free_consistent(adapter->pdev, attribs_cmd.size, attribs_cmd.va,
-+ attribs_cmd.dma);
-+ return status;
-+}
-+
-+/* Uses mbox */
-+int be_cmd_req_native_mode(struct be_adapter *adapter)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_set_func_cap *req;
-+ int status;
-+
-+ if (mutex_lock_interruptible(&adapter->mbox_lock))
-+ return -1;
-+
-+ wrb = wrb_from_mbox(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+
-+ req = embedded_payload(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_SET_DRIVER_FUNCTION_CAP);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_SET_DRIVER_FUNCTION_CAP, sizeof(*req));
-+
-+ req->valid_cap_flags = cpu_to_le32(CAPABILITY_SW_TIMESTAMPS |
-+ CAPABILITY_BE3_NATIVE_ERX_API);
-+ req->cap_flags = cpu_to_le32(CAPABILITY_BE3_NATIVE_ERX_API);
-+
-+ status = be_mbox_notify_wait(adapter);
-+ if (!status) {
-+ struct be_cmd_resp_set_func_cap *resp = embedded_payload(wrb);
-+ adapter->be3_native = le32_to_cpu(resp->cap_flags) &
-+ CAPABILITY_BE3_NATIVE_ERX_API;
-+ }
-+err:
-+ mutex_unlock(&adapter->mbox_lock);
-+ return status;
-+}
-+
-+static void encode_port_names(struct be_adapter *adapter)
-+{
-+ switch (adapter->port_name[adapter->hba_port_num]) {
-+ case '0':
-+ adapter->port_name[adapter->hba_port_num] = 0;
-+ break;
-+ case '1':
-+ adapter->port_name[adapter->hba_port_num] = 1;
-+ break;
-+ case '2':
-+ adapter->port_name[adapter->hba_port_num] = 2;
-+ break;
-+ case '3':
-+ adapter->port_name[adapter->hba_port_num] = 3;
-+ break;
-+ case '4':
-+ adapter->port_name[adapter->hba_port_num] = 4;
-+ break;
-+ case 'A':
-+ adapter->port_name[adapter->hba_port_num] = 5;
-+ break;
-+ case 'B':
-+ adapter->port_name[adapter->hba_port_num] = 6;
-+ break;
-+ case 'C':
-+ adapter->port_name[adapter->hba_port_num] = 7;
-+ break;
-+ case 'D':
-+ adapter->port_name[adapter->hba_port_num] = 8;
-+ break;
-+ }
-+}
-+
-+int be_cmd_query_port_names_v0(struct be_adapter *adapter, u8 *port_name)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_get_port_name *req;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+
-+ req = embedded_payload(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_GET_PORT_NAME);
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_GET_PORT_NAME, sizeof(*req));
-+
-+ status = be_mcc_notify_wait(adapter);
-+ if (!status) {
-+ struct be_cmd_resp_get_port_name *resp = embedded_payload(wrb);
-+ port_name[0] = resp->port0_name;
-+ port_name[1] = resp->port1_name;
-+ }
-+
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+
-+ if(!status)
-+ encode_port_names(adapter);
-+ return status;
-+}
-+
-+int be_cmd_query_port_names_v1(struct be_adapter *adapter, u8 *port_name)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_get_port_name *req;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+ req = embedded_payload(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_GET_PORT_NAME);
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_GET_PORT_NAME, sizeof(*req));
-+ req->hdr.version = 1;
-+
- status = be_mcc_notify_wait(adapter);
-+ if (!status) {
-+ struct be_cmd_resp_get_port_name_v1 *resp = embedded_payload(wrb);
-+ port_name[0] = resp->port0_name;
-+ port_name[1] = resp->port1_name;
-+ port_name[2] = resp->port2_name;
-+ port_name[3] = resp->port3_name;
-+ }
-+
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+
-+ if (!status)
-+ encode_port_names(adapter);
-+ return status;
-+}
-+
-+int be_cmd_req_pg_pfc(struct be_adapter *adapter, int *fw_num_txqs)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_pg *req;
-+ int status, num = 0;
-+ bool query = true;
-+
-+ *fw_num_txqs = MAX_TX_QS;
-+
-+ if (mutex_lock_interruptible(&adapter->mbox_lock))
-+ return -1;
-+
-+enable_pfc:
-+ wrb = wrb_from_mbox(adapter);
-+ req = embedded_payload(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_ETH_PG_FEATURE_QUERY_REQUEST);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_ETH,
-+ OPCODE_ETH_PG_FEATURE_QUERY_REQUEST, sizeof(*req));
-+
-+ if (query)
-+ req->query |= cpu_to_le32(REQ_PG_QUERY);
-+ req->pfc_pg |= cpu_to_le32(REQ_PG_FEAT);
-+
-+ status = be_mbox_notify_wait(adapter);
-+ if (!status) {
-+ struct be_cmd_resp_pg *resp = embedded_payload(wrb);
-+ if (query) {
-+ if (le32_to_cpu(resp->pfc_pg) & REQ_PG_FEAT) {
-+ num = le32_to_cpu(resp->num_tx_rings);
-+ query = false;
-+ goto enable_pfc;
-+ }
-+ } else {
-+ adapter->flags |= BE_FLAGS_DCBX;
-+ *fw_num_txqs = num;
-+ }
-+ }
-+
-+ mutex_unlock(&adapter->mbox_lock);
-+ return status;
-+}
-+
-+/* Set privilege(s) for a function */
-+int be_cmd_set_fn_privileges(struct be_adapter *adapter, u32 mask, u32 *prev,
-+ u32 domain)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_set_fn_privileges *req;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+
-+ req = embedded_payload(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_SET_FN_PRIVILEGES);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_SET_FN_PRIVILEGES, sizeof(*req));
-+
-+ req->hdr.domain = domain;
-+ req->privilege_mask = cpu_to_le32(mask);
-+
-+ status = be_mcc_notify_wait(adapter);
-+
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+/* Get privilege(s) for a function */
-+int be_cmd_get_fn_privileges(struct be_adapter *adapter, u32 *privilege,
-+ u32 domain)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_get_fn_privileges *req;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+
-+ req = embedded_payload(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_GET_FN_PRIVILEGES);
-
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_GET_FN_PRIVILEGES, sizeof(*req));
-+
-+ req->hdr.domain = domain;
-+
-+ status = be_mcc_notify_wait(adapter);
-+ if (!status) {
-+ struct be_cmd_resp_get_fn_privileges *resp =
-+ embedded_payload(wrb);
-+ *privilege = le32_to_cpu(resp->privilege_mask);
-+ } else
-+ *privilege = 0;
-+
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+/* Set Hyper switch config */
-+int be_cmd_set_hsw_config(struct be_adapter *adapter, u16 pvid,
-+ u32 domain, u16 intf_id)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_set_hsw_config *req;
-+ void *ctxt;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+
-+ req = embedded_payload(wrb);
-+ ctxt = &req->context;
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_SET_HSW_CONFIG);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_SET_HSW_CONFIG, sizeof(*req));
-+
-+ req->hdr.domain = domain;
-+ AMAP_SET_BITS(struct amap_set_hsw_context, interface_id, ctxt, intf_id);
-+ if (pvid) {
-+ AMAP_SET_BITS(struct amap_set_hsw_context, pvid_valid, ctxt, 1);
-+ AMAP_SET_BITS(struct amap_set_hsw_context, pvid, ctxt, pvid);
-+ }
-+
-+ be_dws_cpu_to_le(req->context, sizeof(req->context));
-+ status = be_mcc_notify_wait(adapter);
-+
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+/* Get Hyper switch config */
-+int be_cmd_get_hsw_config(struct be_adapter *adapter, u16 *pvid,
-+ u32 domain, u16 intf_id)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_get_hsw_config *req;
-+ void *ctxt;
-+ int status;
-+ u16 vid;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+
-+ req = embedded_payload(wrb);
-+ ctxt = &req->context;
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_GET_HSW_CONFIG);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_GET_HSW_CONFIG, sizeof(*req));
-+
-+ req->hdr.domain = domain;
-+ AMAP_SET_BITS(struct amap_get_hsw_req_context, interface_id, ctxt,
-+ intf_id);
-+ AMAP_SET_BITS(struct amap_get_hsw_req_context, pvid_valid, ctxt, 1);
-+ be_dws_cpu_to_le(req->context, sizeof(req->context));
-+
-+ status = be_mcc_notify_wait(adapter);
-+ if (!status) {
-+ struct be_cmd_resp_get_hsw_config *resp =
-+ embedded_payload(wrb);
-+ be_dws_le_to_cpu(&resp->context,
-+ sizeof(resp->context));
-+ vid = AMAP_GET_BITS(struct amap_get_hsw_resp_context,
-+ pvid, &resp->context);
-+ *pvid = le16_to_cpu(vid);
-+ }
-+
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+int be_cmd_get_port_speed(struct be_adapter *adapter,
-+ u8 port_num, u16 *dac_cable_len, u16 *port_speed)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_get_port_speed *req;
-+ int status = 0;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+
-+ req = embedded_payload(wrb);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_NTWK_GET_LINK_SPEED);
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_NTWK_GET_LINK_SPEED,
-+ sizeof(*req));
-+ req->port_num = port_num;
-+ status = be_mcc_notify_wait(adapter);
-+ if (!status) {
-+ struct be_cmd_resp_get_port_speed *resp =
-+ embedded_payload(wrb);
-+ *dac_cable_len = resp->dac_cable_length;
-+ *port_speed = resp->mac_speed;
-+ }
-+
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+int be_cmd_set_port_speed_v1(struct be_adapter *adapter,
-+ u8 port_num, u16 mac_speed,
-+ u16 dac_cable_len)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_set_port_speed_v1 *req;
-+ int status = 0;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+ req = embedded_payload(wrb);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_NTWK_SET_LINK_SPEED);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_NTWK_SET_LINK_SPEED,
-+ sizeof(*req));
-+ req->hdr.version=1;
-+
-+ req->port_num = port_num;
-+ req->virt_port = port_num;
-+ req->mac_speed = mac_speed;
-+ req->dac_cable_length = dac_cable_len;
-+ status = be_mcc_notify_wait(adapter);
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+
-+/* Uses sync mcc */
-+#ifdef CONFIG_PALAU
-+int be_cmd_pass_ext_ioctl(struct be_adapter *adapter, dma_addr_t dma,
-+ int req_size, void *va)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_sge *sge;
-+ int status;
-+ struct be_cmd_req_hdr *hdr = (struct be_cmd_req_hdr *) va;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+ sge = nonembedded_sgl(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, req_size, false, 1, hdr->opcode);
-+ wrb->tag1 = MCC_WRB_PASS_THRU;
-+ sge->pa_hi = cpu_to_le32(upper_32_bits(dma));
-+ sge->pa_lo = cpu_to_le32(dma & 0xFFFFFFFF);
-+ sge->len = cpu_to_le32(req_size);
-+
-+ status = be_mcc_notify_wait(adapter);
-+err:
- spin_unlock_bh(&adapter->mcc_lock);
- return status;
- }
-+#endif
-diff --git a/drivers/net/benet/be_cmds.h b/drivers/net/benet/be_cmds.h
-index ad33d55..35aa5c7 100644
---- a/drivers/net/benet/be_cmds.h
-+++ b/drivers/net/benet/be_cmds.h
-@@ -1,20 +1,23 @@
- /*
-- * Copyright (C) 2005 - 2009 ServerEngines
-+ * Copyright (C) 2005 - 2011 Emulex
- * All rights reserved.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License version 2
-- * as published by the Free Software Foundation. The full GNU General
-+ * as published by the Free Software Foundation. The full GNU General
- * Public License is included in this distribution in the file called COPYING.
- *
- * Contact Information:
-- * linux-drivers@serverengines.com
-+ * linux-drivers@emulex.com
- *
-- * ServerEngines
-- * 209 N. Fair Oaks Ave
-- * Sunnyvale, CA 94085
-+ * Emulex
-+ * 3333 Susan Street
-+ * Costa Mesa, CA 92626
- */
-
-+#ifndef BE_CMDS_H
-+#define BE_CMDS_H
-+
- /*
- * The driver sends configuration and managements command requests to the
- * firmware in the BE. These requests are communicated to the processor
-@@ -29,9 +32,10 @@ struct be_sge {
- u32 len;
- };
-
--#define MCC_WRB_EMBEDDED_MASK 1 /* bit 0 of dword 0*/
-+#define MCC_WRB_EMBEDDED_MASK 1 /* bit 0 of dword 0*/
- #define MCC_WRB_SGE_CNT_SHIFT 3 /* bits 3 - 7 of dword 0 */
- #define MCC_WRB_SGE_CNT_MASK 0x1F /* bits 3 - 7 of dword 0 */
-+#define MCC_WRB_PASS_THRU 0xFF /* this wrb is used for pass thru cmd */
- struct be_mcc_wrb {
- u32 embedded; /* dword 0 */
- u32 payload_length; /* dword 1 */
-@@ -44,24 +48,19 @@ struct be_mcc_wrb {
- } payload;
- };
-
--#define CQE_FLAGS_VALID_MASK (1 << 31)
--#define CQE_FLAGS_ASYNC_MASK (1 << 30)
--#define CQE_FLAGS_COMPLETED_MASK (1 << 28)
--#define CQE_FLAGS_CONSUMED_MASK (1 << 27)
-+#define CQE_FLAGS_VALID_MASK (1 << 31)
-+#define CQE_FLAGS_ASYNC_MASK (1 << 30)
-+#define CQE_FLAGS_COMPLETED_MASK (1 << 28)
-+#define CQE_FLAGS_CONSUMED_MASK (1 << 27)
-
- /* Completion Status */
- enum {
-- MCC_STATUS_SUCCESS = 0x0,
--/* The client does not have sufficient privileges to execute the command */
-- MCC_STATUS_INSUFFICIENT_PRIVILEGES = 0x1,
--/* A parameter in the command was invalid. */
-- MCC_STATUS_INVALID_PARAMETER = 0x2,
--/* There are insufficient chip resources to execute the command */
-- MCC_STATUS_INSUFFICIENT_RESOURCES = 0x3,
--/* The command is completing because the queue was getting flushed */
-- MCC_STATUS_QUEUE_FLUSHING = 0x4,
--/* The command is completing with a DMA error */
-- MCC_STATUS_DMA_FAILED = 0x5,
-+ MCC_STATUS_SUCCESS = 0,
-+ MCC_STATUS_FAILED = 1,
-+ MCC_STATUS_ILLEGAL_REQUEST = 2,
-+ MCC_STATUS_ILLEGAL_FIELD = 3,
-+ MCC_STATUS_INSUFFICIENT_BUFFER = 4,
-+ MCC_STATUS_UNAUTHORIZED_REQUEST = 5,
- MCC_STATUS_NOT_SUPPORTED = 66
- };
-
-@@ -81,15 +80,24 @@ struct be_mcc_compl {
- * mcc_compl is interpreted as follows:
- */
- #define ASYNC_TRAILER_EVENT_CODE_SHIFT 8 /* bits 8 - 15 */
-+#define ASYNC_TRAILER_EVENT_TYPE_SHIFT 16 /* bits 16 - 23 */
- #define ASYNC_TRAILER_EVENT_CODE_MASK 0xFF
-+#define ASYNC_TRAILER_EVENT_TYPE_MASK 0xFF
- #define ASYNC_EVENT_CODE_LINK_STATE 0x1
-+#define ASYNC_EVENT_CODE_GRP_5 0x5
-+#define ASYNC_EVENT_QOS_SPEED 0x1
-+#define ASYNC_EVENT_COS_PRIORITY 0x2
-+#define ASYNC_EVENT_PVID_STATE 0x3
-+#define GRP5_TYPE_PRIO_TC_MAP 4
-+
- struct be_async_event_trailer {
- u32 code;
- };
-
- enum {
-- ASYNC_EVENT_LINK_DOWN = 0x0,
-- ASYNC_EVENT_LINK_UP = 0x1
-+ ASYNC_EVENT_LINK_DOWN = 0x0,
-+ ASYNC_EVENT_LINK_UP = 0x1,
-+ ASYNC_EVENT_LOGICAL = 0x2
- };
-
- /* When the event code of an async trailer is link-state, the mcc_compl
-@@ -101,7 +109,51 @@ struct be_async_event_link_state {
- u8 port_duplex;
- u8 port_speed;
- u8 port_fault;
-- u8 rsvd0[7];
-+ u8 rsvd0;
-+ u16 qos_link_speed;
-+ u32 event_tag;
-+ struct be_async_event_trailer trailer;
-+} __packed;
-+
-+/* When the event code of an async trailer is GRP-5 and event_type is QOS_SPEED
-+ * the mcc_compl must be interpreted as follows
-+ */
-+struct be_async_event_grp5_qos_link_speed {
-+ u8 physical_port;
-+ u8 rsvd[5];
-+ u16 qos_link_speed;
-+ u32 event_tag;
-+ struct be_async_event_trailer trailer;
-+} __packed;
-+
-+/* When the event code of an async trailer is GRP5 and event type is
-+ * CoS-Priority, the mcc_compl must be interpreted as follows
-+ */
-+struct be_async_event_grp5_cos_priority {
-+ u8 physical_port;
-+ u8 available_priority_bmap;
-+ u8 reco_default_priority;
-+ u8 valid;
-+ u8 rsvd0;
-+ u8 event_tag;
-+ struct be_async_event_trailer trailer;
-+} __packed;
-+
-+/* When the event code of an async trailer is GRP5 and event type is
-+ * PVID state, the mcc_compl must be interpreted as follows
-+ */
-+struct be_async_event_grp5_pvid_state {
-+ u8 enabled;
-+ u8 rsvd0;
-+ u16 tag;
-+ u32 event_tag;
-+ u32 rsvd1;
-+ struct be_async_event_trailer trailer;
-+} __packed;
-+
-+/* GRP5 prio-tc-map event */
-+struct be_async_event_grp5_prio_tc_map {
-+ u8 prio_tc_map[8]; /* map[prio] -> tc_id */
- struct be_async_event_trailer trailer;
- } __packed;
-
-@@ -111,41 +163,68 @@ struct be_mcc_mailbox {
- };
-
- #define CMD_SUBSYSTEM_COMMON 0x1
--#define CMD_SUBSYSTEM_ETH 0x3
-+#define CMD_SUBSYSTEM_ETH 0x3
-+#define CMD_SUBSYSTEM_LOWLEVEL 0xb
-
- #define OPCODE_COMMON_NTWK_MAC_QUERY 1
- #define OPCODE_COMMON_NTWK_MAC_SET 2
- #define OPCODE_COMMON_NTWK_MULTICAST_SET 3
--#define OPCODE_COMMON_NTWK_VLAN_CONFIG 4
-+#define OPCODE_COMMON_NTWK_VLAN_CONFIG 4
- #define OPCODE_COMMON_NTWK_LINK_STATUS_QUERY 5
-+#define OPCODE_COMMON_READ_FLASHROM 6
- #define OPCODE_COMMON_WRITE_FLASHROM 7
- #define OPCODE_COMMON_CQ_CREATE 12
- #define OPCODE_COMMON_EQ_CREATE 13
--#define OPCODE_COMMON_MCC_CREATE 21
--#define OPCODE_COMMON_NTWK_RX_FILTER 34
-+#define OPCODE_COMMON_MCC_CREATE 21
-+#define OPCODE_COMMON_SET_QOS 28
-+#define OPCODE_COMMON_MCC_CREATE_EXT 90
-+#define OPCODE_COMMON_SEEPROM_READ 30
-+#define OPCODE_COMMON_GET_CNTL_ATTRIBUTES 32
-+#define OPCODE_COMMON_NTWK_RX_FILTER 34
- #define OPCODE_COMMON_GET_FW_VERSION 35
- #define OPCODE_COMMON_SET_FLOW_CONTROL 36
- #define OPCODE_COMMON_GET_FLOW_CONTROL 37
- #define OPCODE_COMMON_SET_FRAME_SIZE 39
- #define OPCODE_COMMON_MODIFY_EQ_DELAY 41
- #define OPCODE_COMMON_FIRMWARE_CONFIG 42
--#define OPCODE_COMMON_NTWK_INTERFACE_CREATE 50
--#define OPCODE_COMMON_NTWK_INTERFACE_DESTROY 51
--#define OPCODE_COMMON_MCC_DESTROY 53
--#define OPCODE_COMMON_CQ_DESTROY 54
--#define OPCODE_COMMON_EQ_DESTROY 55
-+#define OPCODE_COMMON_NTWK_INTERFACE_CREATE 50
-+#define OPCODE_COMMON_NTWK_INTERFACE_DESTROY 51
-+#define OPCODE_COMMON_MCC_DESTROY 53
-+#define OPCODE_COMMON_CQ_DESTROY 54
-+#define OPCODE_COMMON_EQ_DESTROY 55
-+#define OPCODE_COMMON_NTWK_SET_LINK_SPEED 57
- #define OPCODE_COMMON_QUERY_FIRMWARE_CONFIG 58
- #define OPCODE_COMMON_NTWK_PMAC_ADD 59
- #define OPCODE_COMMON_NTWK_PMAC_DEL 60
- #define OPCODE_COMMON_FUNCTION_RESET 61
-+#define OPCODE_COMMON_MANAGE_FAT 68
-+#define OPCODE_COMMON_ENABLE_DISABLE_BEACON 69
-+#define OPCODE_COMMON_GET_BEACON_STATE 70
-+#define OPCODE_COMMON_READ_TRANSRECV_DATA 73
-+#define OPCODE_COMMON_GET_PORT_NAME 77
-+#define OPCODE_COMMON_SET_FN_PRIVILEGES 100
-+#define OPCODE_COMMON_GET_PHY_DETAILS 102
-+#define OPCODE_COMMON_SET_DRIVER_FUNCTION_CAP 103
-+#define OPCODE_COMMON_GET_CNTL_ADDITIONAL_ATTRIBUTES 121
-+#define OPCODE_COMMON_NTWK_GET_LINK_SPEED 134
-+#define OPCODE_COMMON_GET_HSW_CONFIG 152
-+#define OPCODE_COMMON_SET_HSW_CONFIG 153
-+#define OPCODE_COMMON_GET_FN_PRIVILEGES 170
-
-+#define OPCODE_ETH_RSS_CONFIG 1
- #define OPCODE_ETH_ACPI_CONFIG 2
- #define OPCODE_ETH_PROMISCUOUS 3
- #define OPCODE_ETH_GET_STATISTICS 4
- #define OPCODE_ETH_TX_CREATE 7
--#define OPCODE_ETH_RX_CREATE 8
--#define OPCODE_ETH_TX_DESTROY 9
--#define OPCODE_ETH_RX_DESTROY 10
-+#define OPCODE_ETH_RX_CREATE 8
-+#define OPCODE_ETH_TX_DESTROY 9
-+#define OPCODE_ETH_RX_DESTROY 10
-+#define OPCODE_ETH_ACPI_WOL_MAGIC_CONFIG 12
-+#define OPCODE_ETH_PG_FEATURE_QUERY_REQUEST 23
-+
-+#define OPCODE_LOWLEVEL_HOST_DDR_DMA 17
-+#define OPCODE_LOWLEVEL_LOOPBACK_TEST 18
-+#define OPCODE_LOWLEVEL_SET_LOOPBACK_MODE 19
-
- struct be_cmd_req_hdr {
- u8 opcode; /* dword 0 */
-@@ -159,7 +238,7 @@ struct be_cmd_req_hdr {
- };
-
- #define RESP_HDR_INFO_OPCODE_SHIFT 0 /* bits 0 - 7 */
--#define RESP_HDR_INFO_SUBSYS_SHIFT 8 /* bits 8 - 15 */
-+#define RESP_HDR_INFO_SUBSYS_SHIFT 8 /* bits 8 - 15 */
- struct be_cmd_resp_hdr {
- u32 info; /* dword 0 */
- u32 status; /* dword 1 */
-@@ -265,7 +344,7 @@ struct be_cmd_req_pmac_del {
- /******************** Create CQ ***************************/
- /* Pseudo amap definition in which each bit of the actual structure is defined
- * as a byte: used to calculate offset/shift/mask of each field */
--struct amap_cq_context {
-+struct amap_cq_context_be {
- u8 cidx[11]; /* dword 0*/
- u8 rsvd0; /* dword 0*/
- u8 coalescwm[2]; /* dword 0*/
-@@ -288,11 +367,28 @@ struct amap_cq_context {
- u8 rsvd5[32]; /* dword 3*/
- } __packed;
-
-+struct amap_cq_context_lancer {
-+ u8 rsvd0[12]; /* dword 0*/
-+ u8 coalescwm[2]; /* dword 0*/
-+ u8 nodelay; /* dword 0*/
-+ u8 rsvd1[12]; /* dword 0*/
-+ u8 count[2]; /* dword 0*/
-+ u8 valid; /* dword 0*/
-+ u8 rsvd2; /* dword 0*/
-+ u8 eventable; /* dword 0*/
-+ u8 eqid[16]; /* dword 1*/
-+ u8 rsvd3[15]; /* dword 1*/
-+ u8 armed; /* dword 1*/
-+ u8 rsvd4[32]; /* dword 2*/
-+ u8 rsvd5[32]; /* dword 3*/
-+} __packed;
-+
- struct be_cmd_req_cq_create {
- struct be_cmd_req_hdr hdr;
- u16 num_pages;
-- u16 rsvd0;
-- u8 context[sizeof(struct amap_cq_context) / 8];
-+ u8 page_size;
-+ u8 rsvd0;
-+ u8 context[sizeof(struct amap_cq_context_be) / 8];
- struct phys_addr pages[8];
- } __packed;
-
-@@ -302,10 +398,28 @@ struct be_cmd_resp_cq_create {
- u16 rsvd0;
- } __packed;
-
-+struct be_cmd_req_get_fat {
-+ struct be_cmd_req_hdr hdr;
-+ u32 fat_operation;
-+ u32 read_log_offset;
-+ u32 read_log_length;
-+ u32 data_buffer_size;
-+ u32 data_buffer[1];
-+} __packed;
-+
-+struct be_cmd_resp_get_fat {
-+ struct be_cmd_resp_hdr hdr;
-+ u32 log_size;
-+ u32 read_log_length;
-+ u32 rsvd[2];
-+ u32 data_buffer[1];
-+} __packed;
-+
-+
- /******************** Create MCCQ ***************************/
- /* Pseudo amap definition in which each bit of the actual structure is defined
- * as a byte: used to calculate offset/shift/mask of each field */
--struct amap_mcc_context {
-+struct amap_mcc_context_be {
- u8 con_index[14];
- u8 rsvd0[2];
- u8 ring_size[4];
-@@ -320,11 +434,31 @@ struct amap_mcc_context {
- u8 rsvd2[32];
- } __packed;
-
-+struct amap_mcc_context_lancer {
-+ u8 async_cq_id[16];
-+ u8 ring_size[4];
-+ u8 rsvd0[12];
-+ u8 rsvd1[31];
-+ u8 valid;
-+ u8 async_cq_valid[1];
-+ u8 rsvd2[31];
-+ u8 rsvd3[32];
-+} __packed;
-+
- struct be_cmd_req_mcc_create {
- struct be_cmd_req_hdr hdr;
- u16 num_pages;
-- u16 rsvd0;
-- u8 context[sizeof(struct amap_mcc_context) / 8];
-+ u16 cq_id;
-+ u8 context[sizeof(struct amap_mcc_context_be) / 8];
-+ struct phys_addr pages[8];
-+} __packed;
-+
-+struct be_cmd_req_mcc_ext_create {
-+ struct be_cmd_req_hdr hdr;
-+ u16 num_pages;
-+ u16 cq_id;
-+ u32 async_event_bitmap[1];
-+ u8 context[sizeof(struct amap_mcc_context_be) / 8];
- struct phys_addr pages[8];
- } __packed;
-
-@@ -335,49 +469,32 @@ struct be_cmd_resp_mcc_create {
- } __packed;
-
- /******************** Create TxQ ***************************/
--#define BE_ETH_TX_RING_TYPE_STANDARD 2
-+#define ETX_QUEUE_TYPE_STANDARD 0x2
-+#define ETX_QUEUE_TYPE_PRIORITY 0x10
- #define BE_ULP1_NUM 1
-
--/* Pseudo amap definition in which each bit of the actual structure is defined
-- * as a byte: used to calculate offset/shift/mask of each field */
--struct amap_tx_context {
-- u8 rsvd0[16]; /* dword 0 */
-- u8 tx_ring_size[4]; /* dword 0 */
-- u8 rsvd1[26]; /* dword 0 */
-- u8 pci_func_id[8]; /* dword 1 */
-- u8 rsvd2[9]; /* dword 1 */
-- u8 ctx_valid; /* dword 1 */
-- u8 cq_id_send[16]; /* dword 2 */
-- u8 rsvd3[16]; /* dword 2 */
-- u8 rsvd4[32]; /* dword 3 */
-- u8 rsvd5[32]; /* dword 4 */
-- u8 rsvd6[32]; /* dword 5 */
-- u8 rsvd7[32]; /* dword 6 */
-- u8 rsvd8[32]; /* dword 7 */
-- u8 rsvd9[32]; /* dword 8 */
-- u8 rsvd10[32]; /* dword 9 */
-- u8 rsvd11[32]; /* dword 10 */
-- u8 rsvd12[32]; /* dword 11 */
-- u8 rsvd13[32]; /* dword 12 */
-- u8 rsvd14[32]; /* dword 13 */
-- u8 rsvd15[32]; /* dword 14 */
-- u8 rsvd16[32]; /* dword 15 */
--} __packed;
--
- struct be_cmd_req_eth_tx_create {
- struct be_cmd_req_hdr hdr;
- u8 num_pages;
- u8 ulp_num;
-- u8 type;
-- u8 bound_port;
-- u8 context[sizeof(struct amap_tx_context) / 8];
-+ u16 type;
-+ u16 if_id;
-+ u8 queue_size;
-+ u8 rsvd1;
-+ u32 rsvd2;
-+ u16 cq_id;
-+ u16 rsvd3;
-+ u32 rsvd4[13];
- struct phys_addr pages[8];
- } __packed;
-
- struct be_cmd_resp_eth_tx_create {
- struct be_cmd_resp_hdr hdr;
- u16 cid;
-- u16 rsvd0;
-+ u16 rid;
-+ u32 db_offset;
-+ u8 tc_id;
-+ u8 rsvd0[3];
- } __packed;
-
- /******************** Create RxQ ***************************/
-@@ -396,7 +513,7 @@ struct be_cmd_req_eth_rx_create {
- struct be_cmd_resp_eth_rx_create {
- struct be_cmd_resp_hdr hdr;
- u16 id;
-- u8 cpu_id;
-+ u8 rss_id;
- u8 rsvd0;
- } __packed;
-
-@@ -429,14 +546,15 @@ enum be_if_flags {
- BE_IF_FLAGS_VLAN = 0x100,
- BE_IF_FLAGS_MCAST_PROMISCUOUS = 0x200,
- BE_IF_FLAGS_PASS_L2_ERRORS = 0x400,
-- BE_IF_FLAGS_PASS_L3L4_ERRORS = 0x800
-+ BE_IF_FLAGS_PASS_L3L4_ERRORS = 0x800,
-+ BE_IF_FLAGS_MULTICAST = 0x1000
- };
-
- /* An RX interface is an object with one or more MAC addresses and
- * filtering capabilities. */
- struct be_cmd_req_if_create {
- struct be_cmd_req_hdr hdr;
-- u32 version; /* ignore currntly */
-+ u32 version; /* ignore currently */
- u32 capability_flags;
- u32 enable_flags;
- u8 mac_addr[ETH_ALEN];
-@@ -458,7 +576,7 @@ struct be_cmd_req_if_destroy {
- };
-
- /*************** HW Stats Get **********************************/
--struct be_port_rxf_stats {
-+struct be_port_rxf_stats_v0 {
- u32 rx_bytes_lsd; /* dword 0*/
- u32 rx_bytes_msd; /* dword 1*/
- u32 rx_total_frames; /* dword 2*/
-@@ -527,8 +645,8 @@ struct be_port_rxf_stats {
- u32 rx_input_fifo_overflow; /* dword 65*/
- };
-
--struct be_rxf_stats {
-- struct be_port_rxf_stats port[2];
-+struct be_rxf_stats_v0 {
-+ struct be_port_rxf_stats_v0 port[2];
- u32 rx_drops_no_pbuf; /* dword 132*/
- u32 rx_drops_no_txpb; /* dword 133*/
- u32 rx_drops_no_erx_descr; /* dword 134*/
-@@ -545,31 +663,51 @@ struct be_rxf_stats {
- u32 rx_drops_invalid_ring; /* dword 145*/
- u32 forwarded_packets; /* dword 146*/
- u32 rx_drops_mtu; /* dword 147*/
-- u32 rsvd0[15];
-+ u32 rsvd0[7];
-+ u32 port0_jabber_events;
-+ u32 port1_jabber_events;
-+ u32 rsvd1[6];
- };
-
--struct be_erx_stats {
-+struct be_erx_stats_v0 {
- u32 rx_drops_no_fragments[44]; /* dwordS 0 to 43*/
-- u32 debug_wdma_sent_hold; /* dword 44*/
-- u32 debug_wdma_pbfree_sent_hold; /* dword 45*/
-- u32 debug_wdma_zerobyte_pbfree_sent_hold; /* dword 46*/
-- u32 debug_pmem_pbuf_dealloc; /* dword 47*/
-+ u32 rsvd[4];
- };
-
--struct be_hw_stats {
-- struct be_rxf_stats rxf;
-+struct be_pmem_stats {
-+ u32 eth_red_drops;
-+ u32 rsvd[5];
-+};
-+
-+struct be_hw_stats_v0 {
-+ struct be_rxf_stats_v0 rxf;
- u32 rsvd[48];
-- struct be_erx_stats erx;
-+ struct be_erx_stats_v0 erx;
-+ struct be_pmem_stats pmem;
- };
-
--struct be_cmd_req_get_stats {
-+struct be_cmd_req_get_stats_v0 {
- struct be_cmd_req_hdr hdr;
-- u8 rsvd[sizeof(struct be_hw_stats)];
-+ u8 rsvd[sizeof(struct be_hw_stats_v0)];
- };
-
--struct be_cmd_resp_get_stats {
-+struct be_cmd_resp_get_stats_v0 {
- struct be_cmd_resp_hdr hdr;
-- struct be_hw_stats hw_stats;
-+ struct be_hw_stats_v0 hw_stats;
-+};
-+
-+struct be_cmd_req_get_cntl_addnl_attribs {
-+ struct be_cmd_req_hdr hdr;
-+ u8 rsvd[8];
-+};
-+
-+struct be_cmd_resp_get_cntl_addnl_attribs {
-+ struct be_cmd_resp_hdr hdr;
-+ u16 ipl_file_number;
-+ u8 ipl_file_version;
-+ u8 rsvd0;
-+ u8 on_die_temperature; /* in degrees centigrade*/
-+ u8 rsvd1[3];
- };
-
- struct be_cmd_req_vlan_config {
-@@ -581,30 +719,22 @@ struct be_cmd_req_vlan_config {
- u16 normal_vlan[64];
- } __packed;
-
--struct be_cmd_req_promiscuous_config {
-- struct be_cmd_req_hdr hdr;
-- u8 port0_promiscuous;
-- u8 port1_promiscuous;
-- u16 rsvd0;
--} __packed;
--
-+/******************** RX FILTER ******************************/
-+#define BE_MAX_MC 64 /* set mcast promisc if > 64 */
- struct macaddr {
- u8 byte[ETH_ALEN];
- };
-
--struct be_cmd_req_mcast_mac_config {
-+struct be_cmd_req_rx_filter {
- struct be_cmd_req_hdr hdr;
-- u16 num_mac;
-- u8 promiscuous;
-- u8 interface_id;
-- struct macaddr mac[32];
--} __packed;
--
--static inline struct be_hw_stats *
--hw_stats_from_cmd(struct be_cmd_resp_get_stats *cmd)
--{
-- return &cmd->hw_stats;
--}
-+ u32 global_flags_mask;
-+ u32 global_flags;
-+ u32 if_flags_mask;
-+ u32 if_flags;
-+ u32 if_id;
-+ u32 mcast_num;
-+ struct macaddr mcast_mac[BE_MAX_MC];
-+};
-
- /******************** Link Status Query *******************/
- struct be_cmd_req_link_status {
-@@ -619,13 +749,18 @@ enum {
- };
-
- enum {
-- PHY_LINK_SPEED_ZERO = 0x0, /* => No link */
-+ PHY_LINK_SPEED_ZERO = 0x0, /* => No link */
- PHY_LINK_SPEED_10MBPS = 0x1,
- PHY_LINK_SPEED_100MBPS = 0x2,
- PHY_LINK_SPEED_1GBPS = 0x3,
- PHY_LINK_SPEED_10GBPS = 0x4
- };
-
-+enum {
-+ LINK_DOWN = 0x0,
-+ LINK_UP = 0X1
-+};
-+
- struct be_cmd_resp_link_status {
- struct be_cmd_resp_hdr hdr;
- u8 physical_port;
-@@ -634,9 +769,47 @@ struct be_cmd_resp_link_status {
- u8 mac_fault;
- u8 mgmt_mac_duplex;
- u8 mgmt_mac_speed;
-- u16 rsvd0;
-+ u16 link_speed;
-+ u32 logical_link_status;
- } __packed;
-
-+/******************** Port Identification ***************************/
-+/* Identifies the type of port attached to NIC */
-+struct be_cmd_req_port_type {
-+ struct be_cmd_req_hdr hdr;
-+ u32 page_num;
-+ u32 port;
-+};
-+
-+enum {
-+ TR_PAGE_A0 = 0xa0,
-+ TR_PAGE_A2 = 0xa2
-+};
-+
-+struct be_cmd_resp_port_type {
-+ struct be_cmd_resp_hdr hdr;
-+ u32 page_num;
-+ u32 port;
-+ struct data {
-+ u8 identifier;
-+ u8 identifier_ext;
-+ u8 connector;
-+ u8 transceiver[8];
-+ u8 rsvd0[3];
-+ u8 length_km;
-+ u8 length_hm;
-+ u8 length_om1;
-+ u8 length_om2;
-+ u8 length_cu;
-+ u8 length_cu_m;
-+ u8 vendor_name[16];
-+ u8 rsvd;
-+ u8 vendor_oui[3];
-+ u8 vendor_pn[16];
-+ u8 vendor_rev[4];
-+ } data;
-+};
-+
- /******************** Get FW Version *******************/
- struct be_cmd_req_get_fw_version {
- struct be_cmd_req_hdr hdr;
-@@ -686,9 +859,13 @@ struct be_cmd_resp_modify_eq_delay {
- } __packed;
-
- /******************** Get FW Config *******************/
-+#define FLEX10_MODE 0x400
-+#define VNIC_MODE 0x20000
-+#define UMC_ENABLED 0x1000000
-+
- struct be_cmd_req_query_fw_cfg {
- struct be_cmd_req_hdr hdr;
-- u32 rsvd[30];
-+ u32 rsvd[31];
- };
-
- struct be_cmd_resp_query_fw_cfg {
-@@ -696,10 +873,61 @@ struct be_cmd_resp_query_fw_cfg {
- u32 be_config_number;
- u32 asic_revision;
- u32 phys_port;
-- u32 function_cap;
-+ u32 function_mode;
- u32 rsvd[26];
-+ u32 function_caps;
- };
-
-+/******************** RSS Config *******************/
-+/* RSS types */
-+#define RSS_ENABLE_NONE 0x0
-+#define RSS_ENABLE_IPV4 0x1
-+#define RSS_ENABLE_TCP_IPV4 0x2
-+#define RSS_ENABLE_IPV6 0x4
-+#define RSS_ENABLE_TCP_IPV6 0x8
-+
-+struct be_cmd_req_rss_config {
-+ struct be_cmd_req_hdr hdr;
-+ u32 if_id;
-+ u16 enable_rss;
-+ u16 cpu_table_size_log2;
-+ u32 hash[10];
-+ u8 cpu_table[128];
-+ u8 flush;
-+ u8 rsvd0[3];
-+};
-+
-+/******************** Port Beacon ***************************/
-+
-+#define BEACON_STATE_ENABLED 0x1
-+#define BEACON_STATE_DISABLED 0x0
-+
-+struct be_cmd_req_enable_disable_beacon {
-+ struct be_cmd_req_hdr hdr;
-+ u8 port_num;
-+ u8 beacon_state;
-+ u8 beacon_duration;
-+ u8 status_duration;
-+} __packed;
-+
-+struct be_cmd_resp_enable_disable_beacon {
-+ struct be_cmd_resp_hdr resp_hdr;
-+ u32 rsvd0;
-+} __packed;
-+
-+struct be_cmd_req_get_beacon_state {
-+ struct be_cmd_req_hdr hdr;
-+ u8 port_num;
-+ u8 rsvd0;
-+ u16 rsvd1;
-+} __packed;
-+
-+struct be_cmd_resp_get_beacon_state {
-+ struct be_cmd_resp_hdr resp_hdr;
-+ u8 beacon_state;
-+ u8 rsvd0[3];
-+} __packed;
-+
- /****************** Firmware Flash ******************/
- struct flashrom_params {
- u32 op_code;
-@@ -714,17 +942,468 @@ struct be_cmd_write_flashrom {
- struct flashrom_params params;
- };
-
-+/************************ WOL *******************************/
-+struct be_cmd_req_acpi_wol_magic_config {
-+ struct be_cmd_req_hdr hdr;
-+ u32 rsvd0[145];
-+ u8 magic_mac[6];
-+ u8 rsvd2[2];
-+} __packed;
-+
-+/********************** LoopBack test *********************/
-+struct be_cmd_req_loopback_test {
-+ struct be_cmd_req_hdr hdr;
-+ u32 loopback_type;
-+ u32 num_pkts;
-+ u64 pattern;
-+ u32 src_port;
-+ u32 dest_port;
-+ u32 pkt_size;
-+};
-+
-+struct be_cmd_resp_loopback_test {
-+ struct be_cmd_resp_hdr resp_hdr;
-+ u32 status;
-+ u32 num_txfer;
-+ u32 num_rx;
-+ u32 miscomp_off;
-+ u32 ticks_compl;
-+};
-+
-+struct be_cmd_req_set_lmode {
-+ struct be_cmd_req_hdr hdr;
-+ u8 src_port;
-+ u8 dest_port;
-+ u8 loopback_type;
-+ u8 loopback_state;
-+};
-+
-+struct be_cmd_resp_set_lmode {
-+ struct be_cmd_resp_hdr resp_hdr;
-+ u8 rsvd0[4];
-+};
-+
-+/********************** DDR DMA test *********************/
-+struct be_cmd_req_ddrdma_test {
-+ struct be_cmd_req_hdr hdr;
-+ u64 pattern;
-+ u32 byte_count;
-+ u32 rsvd0;
-+ u8 snd_buff[4096];
-+ u8 rsvd1[4096];
-+};
-+
-+struct be_cmd_resp_ddrdma_test {
-+ struct be_cmd_resp_hdr hdr;
-+ u64 pattern;
-+ u32 byte_cnt;
-+ u32 snd_err;
-+ u8 rsvd0[4096];
-+ u8 rcv_buff[4096];
-+};
-+
-+/*********************** SEEPROM Read ***********************/
-+
-+#define BE_READ_SEEPROM_LEN 1024
-+struct be_cmd_req_seeprom_read {
-+ struct be_cmd_req_hdr hdr;
-+ u8 rsvd0[BE_READ_SEEPROM_LEN];
-+};
-+
-+struct be_cmd_resp_seeprom_read {
-+ struct be_cmd_req_hdr hdr;
-+ u8 seeprom_data[BE_READ_SEEPROM_LEN];
-+};
-+
-+enum {
-+ PHY_TYPE_CX4_10GB = 0,
-+ PHY_TYPE_XFP_10GB,
-+ PHY_TYPE_SFP_1GB,
-+ PHY_TYPE_SFP_PLUS_10GB,
-+ PHY_TYPE_KR_10GB,
-+ PHY_TYPE_KX4_10GB,
-+ PHY_TYPE_BASET_10GB,
-+ PHY_TYPE_BASET_1GB,
-+ PHY_TYPE_BASEX_1GB,
-+ PHY_TYPE_SGMII,
-+ PHY_TYPE_DISABLED = 255
-+};
-+
-+#define BE_AN_EN 0x2
-+#define BE_PAUSE_SYM_EN 0x80
-+
-+struct be_cmd_req_get_phy_info {
-+ struct be_cmd_req_hdr hdr;
-+ u8 rsvd0[24];
-+};
-+
-+struct be_phy_info {
-+ u16 phy_type;
-+ u16 interface_type;
-+ u32 misc_params;
-+ u16 ext_phy_details;
-+ u16 rsvd;
-+ u16 auto_speeds_supported;
-+ u16 fixed_speeds_supported;
-+ u32 future_use[2];
-+};
-+
-+struct be_cmd_resp_get_phy_info {
-+ struct be_cmd_req_hdr hdr;
-+ struct be_phy_info phy_info;
-+};
-+
-+/*********************** Set QOS ***********************/
-+
-+#define BE_QOS_BITS_NIC 1
-+
-+struct be_cmd_req_set_qos {
-+ struct be_cmd_req_hdr hdr;
-+ u32 valid_bits;
-+ u32 max_bps_nic;
-+ u32 rsvd[7];
-+};
-+
-+struct be_cmd_resp_set_qos {
-+ struct be_cmd_resp_hdr hdr;
-+ u32 rsvd;
-+};
-+
-+/*********************** Controller Attributes ***********************/
-+struct be_cmd_req_cntl_attribs {
-+ struct be_cmd_req_hdr hdr;
-+};
-+
-+struct be_cmd_resp_cntl_attribs {
-+ struct be_cmd_resp_hdr hdr;
-+ struct mgmt_controller_attrib attribs;
-+};
-+
-+/******************* get port names ***************/
-+struct be_cmd_req_get_port_name {
-+ struct be_cmd_req_hdr hdr;
-+ u32 rsvd0;
-+};
-+
-+struct be_cmd_resp_get_port_name {
-+ struct be_cmd_req_hdr hdr;
-+ u8 port0_name;
-+ u8 port1_name;
-+ u8 rsvd0[2];
-+};
-+
-+struct be_cmd_resp_get_port_name_v1 {
-+ struct be_cmd_req_hdr hdr;
-+ u32 pt : 2;
-+ u32 rsvd0 : 30;
-+ u8 port0_name;
-+ u8 port1_name;
-+ u8 port2_name;
-+ u8 port3_name;
-+};
-+
-+/*********************** Set driver function ***********************/
-+#define CAPABILITY_SW_TIMESTAMPS 2
-+#define CAPABILITY_BE3_NATIVE_ERX_API 4
-+
-+struct be_cmd_req_set_func_cap {
-+ struct be_cmd_req_hdr hdr;
-+ u32 valid_cap_flags;
-+ u32 cap_flags;
-+ u8 rsvd[212];
-+};
-+
-+struct be_cmd_resp_set_func_cap {
-+ struct be_cmd_resp_hdr hdr;
-+ u32 valid_cap_flags;
-+ u32 cap_flags;
-+ u8 rsvd[212];
-+};
-+
-+/*********************** PG Query Request ****************************/
-+#define REQ_PG_QUERY 0x1
-+#define REQ_PG_FEAT 0x1
-+struct be_cmd_req_pg {
-+ struct be_cmd_req_hdr hdr;
-+ u32 query;
-+ u32 pfc_pg;
-+};
-+
-+struct be_cmd_resp_pg {
-+ struct be_cmd_resp_hdr hdr;
-+ u32 pfc_pg;
-+ u32 num_tx_rings;
-+};
-+
-+/*********************** Function Privileges ***********************/
-+enum {
-+ BE_PRIV_DEFAULT = 0x1,
-+ BE_PRIV_LNKQUERY = 0x2,
-+ BE_PRIV_LNKSTATS = 0x4,
-+ BE_PRIV_LNKMGMT = 0x8,
-+ BE_PRIV_LNKDIAG = 0x10,
-+ BE_PRIV_UTILQUERY = 0x20,
-+ BE_PRIV_FILTMGMT = 0x40,
-+ BE_PRIV_IFACEMGMT = 0x80,
-+ BE_PRIV_VHADM = 0x100,
-+ BE_PRIV_DEVCFG = 0x200,
-+ BE_PRIV_DEVSEC = 0x400
-+};
-+
-+struct be_cmd_req_get_fn_privileges {
-+ struct be_cmd_req_hdr hdr;
-+ u32 rsvd;
-+};
-+
-+struct be_cmd_resp_get_fn_privileges {
-+ struct be_cmd_resp_hdr hdr;
-+ u32 privilege_mask;
-+};
-+
-+struct be_cmd_req_set_fn_privileges {
-+ struct be_cmd_req_hdr hdr;
-+ u32 privilege_mask;
-+};
-+
-+struct be_cmd_resp_set_fn_privileges {
-+ struct be_cmd_resp_hdr hdr;
-+ u32 prev_privilege_mask;
-+};
-+
-+/*********************** HSW Config ***********************/
-+struct amap_set_hsw_context {
-+ u8 interface_id[16];
-+ u8 rsvd0[14];
-+ u8 pvid_valid;
-+ u8 rsvd1;
-+ u8 rsvd2[16];
-+ u8 pvid[16];
-+ u8 rsvd3[32];
-+ u8 rsvd4[32];
-+ u8 rsvd5[32];
-+} __packed;
-+
-+struct be_cmd_req_set_hsw_config {
-+ struct be_cmd_req_hdr hdr;
-+ u8 context[sizeof(struct amap_set_hsw_context) / 8];
-+} __packed;
-+
-+struct be_cmd_resp_set_hsw_config {
-+ struct be_cmd_resp_hdr hdr;
-+ u32 rsvd;
-+};
-+
-+struct amap_get_hsw_req_context {
-+ u8 interface_id[16];
-+ u8 rsvd0[14];
-+ u8 pvid_valid;
-+ u8 pport;
-+} __packed;
-+
-+struct amap_get_hsw_resp_context {
-+ u8 rsvd1[16];
-+ u8 pvid[16];
-+ u8 rsvd2[32];
-+ u8 rsvd3[32];
-+ u8 rsvd4[32];
-+} __packed;
-+
-+struct be_cmd_req_get_hsw_config {
-+ struct be_cmd_req_hdr hdr;
-+ u8 context[sizeof(struct amap_get_hsw_req_context) / 8];
-+} __packed;
-+
-+struct be_cmd_resp_get_hsw_config {
-+ struct be_cmd_resp_hdr hdr;
-+ u8 context[sizeof(struct amap_get_hsw_resp_context) / 8];
-+ u32 rsvd;
-+};
-+
-+/*************** Set speed ********************/
-+struct be_cmd_req_set_port_speed_v1 {
-+ struct be_cmd_req_hdr hdr;
-+ u8 port_num;
-+ u8 virt_port;
-+ u16 mac_speed;
-+ u16 dac_cable_length;
-+ u16 rsvd0;
-+};
-+
-+struct be_cmd_resp_set_port_speed_v1 {
-+ struct be_cmd_resp_hdr hdr;
-+ u32 rsvd0;
-+};
-+
-+/************** get port speed *******************/
-+struct be_cmd_req_get_port_speed {
-+ struct be_cmd_req_hdr hdr;
-+ u8 port_num;
-+};
-+
-+struct be_cmd_resp_get_port_speed {
-+ struct be_cmd_req_hdr hdr;
-+ u16 mac_speed;
-+ u16 dac_cable_length;
-+};
-+
-+/*************** HW Stats Get v1 **********************************/
-+#define BE_TXP_SW_SZ 48
-+struct be_port_rxf_stats_v1 {
-+ u32 rsvd0[12];
-+ u32 rx_crc_errors;
-+ u32 rx_alignment_symbol_errors;
-+ u32 rx_pause_frames;
-+ u32 rx_priority_pause_frames;
-+ u32 rx_control_frames;
-+ u32 rx_in_range_errors;
-+ u32 rx_out_range_errors;
-+ u32 rx_frame_too_long;
-+ u32 rx_address_match_errors;
-+ u32 rx_dropped_too_small;
-+ u32 rx_dropped_too_short;
-+ u32 rx_dropped_header_too_small;
-+ u32 rx_dropped_tcp_length;
-+ u32 rx_dropped_runt;
-+ u32 rsvd1[10];
-+ u32 rx_ip_checksum_errs;
-+ u32 rx_tcp_checksum_errs;
-+ u32 rx_udp_checksum_errs;
-+ u32 rsvd2[7];
-+ u32 rx_switched_unicast_packets;
-+ u32 rx_switched_multicast_packets;
-+ u32 rx_switched_broadcast_packets;
-+ u32 rsvd3[3];
-+ u32 tx_pauseframes;
-+ u32 tx_priority_pauseframes;
-+ u32 tx_controlframes;
-+ u32 rsvd4[10];
-+ u32 rxpp_fifo_overflow_drop;
-+ u32 rx_input_fifo_overflow_drop;
-+ u32 pmem_fifo_overflow_drop;
-+ u32 jabber_events;
-+ u32 rsvd5[3];
-+};
-+
-+
-+struct be_rxf_stats_v1 {
-+ struct be_port_rxf_stats_v1 port[4];
-+ u32 rsvd0[2];
-+ u32 rx_drops_no_pbuf;
-+ u32 rx_drops_no_txpb;
-+ u32 rx_drops_no_erx_descr;
-+ u32 rx_drops_no_tpre_descr;
-+ u32 rsvd1[6];
-+ u32 rx_drops_too_many_frags;
-+ u32 rx_drops_invalid_ring;
-+ u32 forwarded_packets;
-+ u32 rx_drops_mtu;
-+ u32 rsvd2[14];
-+};
-+
-+struct be_erx_stats_v1 {
-+ u32 rx_drops_no_fragments[68]; /* dwordS 0 to 67*/
-+ u32 rsvd[4];
-+};
-+
-+struct be_hw_stats_v1 {
-+ struct be_rxf_stats_v1 rxf;
-+ u32 rsvd0[BE_TXP_SW_SZ];
-+ struct be_erx_stats_v1 erx;
-+ struct be_pmem_stats pmem;
-+ u32 rsvd1[3];
-+};
-+
-+struct be_cmd_req_get_stats_v1 {
-+ struct be_cmd_req_hdr hdr;
-+ u8 rsvd[sizeof(struct be_hw_stats_v1)];
-+};
-+
-+struct be_cmd_resp_get_stats_v1 {
-+ struct be_cmd_resp_hdr hdr;
-+ struct be_hw_stats_v1 hw_stats;
-+};
-+
-+static inline void *
-+hw_stats_from_cmd(struct be_adapter *adapter)
-+{
-+ if (adapter->generation == BE_GEN3) {
-+ struct be_cmd_resp_get_stats_v1 *cmd = adapter->stats_cmd.va;
-+
-+ return &cmd->hw_stats;
-+ } else {
-+ struct be_cmd_resp_get_stats_v0 *cmd = adapter->stats_cmd.va;
-+
-+ return &cmd->hw_stats;
-+ }
-+}
-+
-+static inline void *be_port_rxf_stats_from_cmd(struct be_adapter *adapter)
-+{
-+ if (adapter->generation == BE_GEN3) {
-+ struct be_hw_stats_v1 *hw_stats = hw_stats_from_cmd(adapter);
-+ struct be_rxf_stats_v1 *rxf_stats = &hw_stats->rxf;
-+
-+ return &rxf_stats->port[adapter->port_num];
-+ } else {
-+ struct be_hw_stats_v0 *hw_stats = hw_stats_from_cmd(adapter);
-+ struct be_rxf_stats_v0 *rxf_stats = &hw_stats->rxf;
-+
-+ return &rxf_stats->port[adapter->port_num];
-+ }
-+}
-+
-+static inline void *be_rxf_stats_from_cmd(struct be_adapter *adapter)
-+{
-+ if (adapter->generation == BE_GEN3) {
-+ struct be_hw_stats_v1 *hw_stats = hw_stats_from_cmd(adapter);
-+
-+ return &hw_stats->rxf;
-+ } else {
-+ struct be_hw_stats_v0 *hw_stats = hw_stats_from_cmd(adapter);
-+
-+ return &hw_stats->rxf;
-+ }
-+}
-+
-+static inline void *be_erx_stats_from_cmd(struct be_adapter *adapter)
-+{
-+ if (adapter->generation == BE_GEN3) {
-+ struct be_hw_stats_v1 *hw_stats = hw_stats_from_cmd(adapter);
-+
-+ return &hw_stats->erx;
-+ } else {
-+ struct be_hw_stats_v0 *hw_stats = hw_stats_from_cmd(adapter);
-+
-+ return &hw_stats->erx;
-+ }
-+}
-+
-+static inline void *be_pmem_stats_from_cmd(struct be_adapter *adapter)
-+{
-+ if (adapter->generation == BE_GEN3) {
-+ struct be_hw_stats_v1 *hw_stats = hw_stats_from_cmd(adapter);
-+
-+ return &hw_stats->pmem;
-+ } else {
-+ struct be_hw_stats_v0 *hw_stats = hw_stats_from_cmd(adapter);
-+
-+ return &hw_stats->pmem;
-+ }
-+}
-+
- extern int be_pci_fnum_get(struct be_adapter *adapter);
- extern int be_cmd_POST(struct be_adapter *adapter);
- extern int be_cmd_mac_addr_query(struct be_adapter *adapter, u8 *mac_addr,
- u8 type, bool permanent, u32 if_handle);
- extern int be_cmd_pmac_add(struct be_adapter *adapter, u8 *mac_addr,
-- u32 if_id, u32 *pmac_id);
--extern int be_cmd_pmac_del(struct be_adapter *adapter, u32 if_id, u32 pmac_id);
-+ u32 if_id, u32 *pmac_id, u32 domain);
-+extern int be_cmd_pmac_del(struct be_adapter *adapter, u32 if_id, u32 pmac_id,
-+ u32 domain);
- extern int be_cmd_if_create(struct be_adapter *adapter, u32 cap_flags,
- u32 en_flags, u8 *mac, bool pmac_invalid,
-- u32 *if_handle, u32 *pmac_id);
--extern int be_cmd_if_destroy(struct be_adapter *adapter, u32 if_handle);
-+ u32 *if_handle, u32 *pmac_id, u32 domain);
-+extern int be_cmd_if_destroy(struct be_adapter *adapter, u32 if_handle,
-+ u32 domain);
- extern int be_cmd_eq_create(struct be_adapter *adapter,
- struct be_queue_info *eq, int eq_delay);
- extern int be_cmd_cq_create(struct be_adapter *adapter,
-@@ -736,36 +1415,92 @@ extern int be_cmd_mccq_create(struct be_adapter *adapter,
- struct be_queue_info *cq);
- extern int be_cmd_txq_create(struct be_adapter *adapter,
- struct be_queue_info *txq,
-- struct be_queue_info *cq);
-+ struct be_queue_info *cq, u8 *tc_id);
- extern int be_cmd_rxq_create(struct be_adapter *adapter,
- struct be_queue_info *rxq, u16 cq_id,
- u16 frag_size, u16 max_frame_size, u32 if_id,
-- u32 rss);
-+ u32 rss, u8 *rss_id);
- extern int be_cmd_q_destroy(struct be_adapter *adapter, struct be_queue_info *q,
- int type);
-+extern int be_cmd_rxq_destroy(struct be_adapter *adapter,
-+ struct be_queue_info *q);
- extern int be_cmd_link_status_query(struct be_adapter *adapter,
-- bool *link_up);
-+ int *link_status, u8 *mac_speed, u16 *link_speed, u32 dom);
- extern int be_cmd_reset(struct be_adapter *adapter);
- extern int be_cmd_get_stats(struct be_adapter *adapter,
- struct be_dma_mem *nonemb_cmd);
--extern int be_cmd_get_fw_ver(struct be_adapter *adapter, char *fw_ver);
-+extern int be_cmd_get_fw_ver(struct be_adapter *adapter, char *fw_ver,
-+ char *fw_on_flash);
-
- extern int be_cmd_modify_eqd(struct be_adapter *adapter, u32 eq_id, u32 eqd);
- extern int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id,
- u16 *vtag_array, u32 num, bool untagged,
- bool promiscuous);
--extern int be_cmd_promiscuous_config(struct be_adapter *adapter,
-- u8 port_num, bool en);
--extern int be_cmd_multicast_set(struct be_adapter *adapter, u32 if_id,
-- struct dev_mc_list *mc_list, u32 mc_count);
-+extern int be_cmd_rx_filter(struct be_adapter *adapter, u32 flags, u32 status);
- extern int be_cmd_set_flow_control(struct be_adapter *adapter,
- u32 tx_fc, u32 rx_fc);
- extern int be_cmd_get_flow_control(struct be_adapter *adapter,
- u32 *tx_fc, u32 *rx_fc);
--extern int be_cmd_query_fw_cfg(struct be_adapter *adapter,
-- u32 *port_num, u32 *cap);
-+extern int be_cmd_query_fw_cfg(struct be_adapter *adapter, u32 *port_num,
-+ u32 *function_mode, u32 *functions_caps);
- extern int be_cmd_reset_function(struct be_adapter *adapter);
--extern int be_process_mcc(struct be_adapter *adapter);
-+extern int be_cmd_rss_config(struct be_adapter *adapter, u8 *rsstable,
-+ u16 table_size);
-+extern int be_process_mcc(struct be_adapter *adapter, int *status);
-+extern int be_cmd_set_beacon_state(struct be_adapter *adapter,
-+ u8 port_num, u8 beacon, u8 status, u8 state);
-+extern int be_cmd_get_beacon_state(struct be_adapter *adapter,
-+ u8 port_num, u32 *state);
-+extern int be_cmd_read_port_type(struct be_adapter *adapter, u32 port,
-+ u8 *connector);
- extern int be_cmd_write_flashrom(struct be_adapter *adapter,
- struct be_dma_mem *cmd, u32 flash_oper,
- u32 flash_opcode, u32 buf_size);
-+int be_cmd_get_flash_crc(struct be_adapter *adapter, u8 *flashed_crc,
-+ int offset);
-+extern int be_cmd_enable_magic_wol(struct be_adapter *adapter, u8 *mac,
-+ struct be_dma_mem *nonemb_cmd);
-+extern int be_cmd_fw_init(struct be_adapter *adapter);
-+extern int be_cmd_fw_clean(struct be_adapter *adapter);
-+extern void be_async_mcc_enable(struct be_adapter *adapter);
-+extern void be_async_mcc_disable(struct be_adapter *adapter);
-+extern int be_cmd_loopback_test(struct be_adapter *adapter, u32 port_num,
-+ u32 loopback_type, u32 pkt_size,
-+ u32 num_pkts, u64 pattern);
-+extern int be_cmd_ddr_dma_test(struct be_adapter *adapter, u64 pattern,
-+ u32 byte_cnt, struct be_dma_mem *cmd);
-+extern int be_cmd_get_seeprom_data(struct be_adapter *adapter,
-+ struct be_dma_mem *nonemb_cmd);
-+extern int be_cmd_set_loopback(struct be_adapter *adapter, u8 port_num,
-+ u8 loopback_type, u8 enable);
-+extern int be_cmd_get_phy_info(struct be_adapter *adapter,
-+ struct be_phy_info *phy_info);
-+extern int be_cmd_set_qos(struct be_adapter *adapter, u32 bps, u32 domain);
-+extern void be_detect_dump_ue(struct be_adapter *adapter);
-+extern int be_cmd_get_die_temperature(struct be_adapter *adapter);
-+extern int be_cmd_get_cntl_attributes(struct be_adapter *adapter);
-+extern int be_cmd_get_reg_len(struct be_adapter *adapter, u32 *log_size);
-+extern void be_cmd_get_regs(struct be_adapter *adapter, u32 buf_len, void *buf);
-+extern int be_cmd_req_native_mode(struct be_adapter *adapter);
-+extern int be_cmd_query_port_names_v0(struct be_adapter *adapter, u8 *port_name);
-+extern int be_cmd_query_port_names_v1(struct be_adapter *adapter, u8 *port_name);
-+extern int be_cmd_req_pg_pfc(struct be_adapter *adapter, int *fw_num_txqs);
-+
-+extern int be_cmd_get_fn_privileges(struct be_adapter *adapter,
-+ u32 *privilege, u32 domain);
-+extern int be_cmd_set_fn_privileges(struct be_adapter *adapter,
-+ u32 mask, u32 *prev, u32 domain);
-+extern int be_cmd_set_hsw_config(struct be_adapter *adapter, u16 pvid,
-+ u32 domain, u16 intf_id);
-+extern int be_cmd_get_hsw_config(struct be_adapter *adapter, u16 *pvid,
-+ u32 domain, u16 intf_id);
-+extern int be_cmd_set_port_speed_v1(struct be_adapter *adapter, u8 port_num,
-+ u16 mac_speed, u16 dac_cable_len);
-+extern int be_cmd_get_port_speed(struct be_adapter *adapter, u8 port_num,
-+ u16 *dac_cable_len, u16 *port_speed);
-+#ifdef CONFIG_PALAU
-+int be_cmd_pass_ext_ioctl(struct be_adapter *adapter, dma_addr_t dma,
-+ int req_size, void *va);
-+#endif
-+
-+#endif /* !BE_CMDS_H */
-diff --git a/drivers/net/benet/be_compat.c b/drivers/net/benet/be_compat.c
-new file mode 100644
-index 0000000..bdd1dba
---- /dev/null
-+++ b/drivers/net/benet/be_compat.c
-@@ -0,0 +1,630 @@
-+/*
-+ * Copyright (C) 2005 - 2011 Emulex
-+ * All rights reserved.
-+ *
-+ * This program is free software; you can redistribute it and/or
-+ * modify it under the terms of the GNU General Public License version 2
-+ * as published by the Free Software Foundation. The full GNU General
-+ * Public License is included in this distribution in the file called COPYING.
-+ *
-+ * Contact Information:
-+ * linux-drivers@emulex.com
-+ *
-+ * Emulex
-+ * 3333 Susan Street
-+ * Costa Mesa, CA 92626
-+ */
-+
-+#include "be.h"
-+
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 28)
-+void be_netdev_ops_init(struct net_device *netdev, struct net_device_ops *ops)
-+{
-+ netdev->open = ops->ndo_open;
-+ netdev->stop = ops->ndo_stop;
-+ netdev->hard_start_xmit = ops->ndo_start_xmit;
-+ netdev->set_mac_address = ops->ndo_set_mac_address;
-+ netdev->get_stats = ops->ndo_get_stats;
-+ netdev->set_multicast_list = ops->ndo_set_rx_mode;
-+ netdev->change_mtu = ops->ndo_change_mtu;
-+ netdev->vlan_rx_register = ops->ndo_vlan_rx_register;
-+ netdev->vlan_rx_add_vid = ops->ndo_vlan_rx_add_vid;
-+ netdev->vlan_rx_kill_vid = ops->ndo_vlan_rx_kill_vid;
-+ netdev->do_ioctl = ops->ndo_do_ioctl;
-+#ifdef CONFIG_NET_POLL_CONTROLLER
-+ netdev->poll_controller = ops->ndo_poll_controller;
-+#endif
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
-+ netdev->select_queue = ops->ndo_select_queue;
-+#endif
-+}
-+#endif
-+
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 28)
-+int eth_validate_addr(struct net_device *netdev)
-+{
-+ return 0;
-+}
-+#endif
-+
-+/* New NAPI backport */
-+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 24)
-+
-+int be_poll_compat(struct net_device *netdev, int *budget)
-+{
-+ struct napi_struct *napi = netdev->priv;
-+ u32 work_done, can_do;
-+
-+ can_do = min(*budget, netdev->quota);
-+ work_done = napi->poll(napi, can_do);
-+
-+ *budget -= work_done;
-+ netdev->quota -= work_done;
-+ if (napi->rx)
-+ return (work_done >= can_do);
-+ return 0;
-+}
-+
-+
-+#endif /* New NAPI backport */
-+
-+int be_netif_napi_add(struct net_device *netdev,
-+ struct napi_struct *napi,
-+ int (*poll) (struct napi_struct *, int), int weight)
-+{
-+#ifdef HAVE_SIMULATED_MULTI_NAPI
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+ struct net_device *nd;
-+
-+ nd = alloc_netdev(0, "", ether_setup);
-+ if (!nd)
-+ return -ENOMEM;
-+ nd->priv = napi;
-+ nd->weight = BE_NAPI_WEIGHT;
-+ nd->poll = be_poll_compat;
-+ set_bit(__LINK_STATE_START, &nd->state);
-+
-+ if (napi == &adapter->rx_obj[0].rx_eq.napi)
-+ napi->rx = true;
-+ napi->poll = poll;
-+ napi->dev = nd;
-+#ifdef RHEL_NEW_NAPI
-+ napi->napi.dev = netdev;
-+#endif
-+ return 0;
-+#else
-+ netif_napi_add(netdev, napi, poll, weight);
-+ return 0;
-+#endif
-+}
-+void be_netif_napi_del(struct net_device *netdev)
-+{
-+#ifdef HAVE_SIMULATED_MULTI_NAPI
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+ struct napi_struct *napi;
-+ struct be_rx_obj *rxo;
-+ int i;
-+
-+ for_all_rx_queues(adapter, rxo, i) {
-+ napi = &rxo->rx_eq.napi;
-+ if (napi->dev) {
-+ free_netdev(napi->dev);
-+ napi->dev = NULL;
-+ }
-+ }
-+
-+ napi = &adapter->tx_eq.napi;
-+ if (napi->dev) {
-+ free_netdev(napi->dev);
-+ napi->dev = NULL;
-+ }
-+#endif
-+}
-+/* INET_LRO backport */
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 27)
-+
-+#define TCP_HDR_LEN(tcph) (tcph->doff << 2)
-+#define IP_HDR_LEN(iph) (iph->ihl << 2)
-+#define TCP_PAYLOAD_LENGTH(iph, tcph) (ntohs(iph->tot_len) - IP_HDR_LEN(iph) \
-+ - TCP_HDR_LEN(tcph))
-+
-+#define IPH_LEN_WO_OPTIONS 5
-+#define TCPH_LEN_WO_OPTIONS 5
-+#define TCPH_LEN_W_TIMESTAMP 8
-+
-+#define LRO_MAX_PG_HLEN 64
-+#define LRO_INC_STATS(lro_mgr, attr) { lro_mgr->stats.attr++; }
-+/*
-+ * Basic tcp checks whether packet is suitable for LRO
-+ */
-+static int lro_tcp_ip_check(struct iphdr *iph, struct tcphdr *tcph,
-+ int len, struct net_lro_desc *lro_desc)
-+{
-+ /* check ip header: don't aggregate padded frames */
-+ if (ntohs(iph->tot_len) != len)
-+ return -1;
-+
-+ if (iph->ihl != IPH_LEN_WO_OPTIONS)
-+ return -1;
-+
-+ if (tcph->cwr || tcph->ece || tcph->urg || !tcph->ack
-+ || tcph->rst || tcph->syn || tcph->fin)
-+ return -1;
-+
-+ if (INET_ECN_is_ce(ipv4_get_dsfield(iph)))
-+ return -1;
-+
-+ if (tcph->doff != TCPH_LEN_WO_OPTIONS
-+ && tcph->doff != TCPH_LEN_W_TIMESTAMP)
-+ return -1;
-+
-+ /* check tcp options (only timestamp allowed) */
-+ if (tcph->doff == TCPH_LEN_W_TIMESTAMP) {
-+ u32 *topt = (u32 *)(tcph + 1);
-+
-+ if (*topt != htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16)
-+ | (TCPOPT_TIMESTAMP << 8)
-+ | TCPOLEN_TIMESTAMP))
-+ return -1;
-+
-+ /* timestamp should be in right order */
-+ topt++;
-+ if (lro_desc && after(ntohl(lro_desc->tcp_rcv_tsval),
-+ ntohl(*topt)))
-+ return -1;
-+
-+ /* timestamp reply should not be zero */
-+ topt++;
-+ if (*topt == 0)
-+ return -1;
-+ }
-+
-+ return 0;
-+}
-+
-+static void lro_update_tcp_ip_header(struct net_lro_desc *lro_desc)
-+{
-+ struct iphdr *iph = lro_desc->iph;
-+ struct tcphdr *tcph = lro_desc->tcph;
-+ u32 *p;
-+ __wsum tcp_hdr_csum;
-+
-+ tcph->ack_seq = lro_desc->tcp_ack;
-+ tcph->window = lro_desc->tcp_window;
-+
-+ if (lro_desc->tcp_saw_tstamp) {
-+ p = (u32 *)(tcph + 1);
-+ *(p+2) = lro_desc->tcp_rcv_tsecr;
-+ }
-+
-+ iph->tot_len = htons(lro_desc->ip_tot_len);
-+
-+ iph->check = 0;
-+ iph->check = ip_fast_csum((u8 *)lro_desc->iph, iph->ihl);
-+
-+ tcph->check = 0;
-+ tcp_hdr_csum = csum_partial((u8 *)tcph, TCP_HDR_LEN(tcph), 0);
-+ lro_desc->data_csum = csum_add(lro_desc->data_csum, tcp_hdr_csum);
-+ tcph->check = csum_tcpudp_magic(iph->saddr, iph->daddr,
-+ lro_desc->ip_tot_len -
-+ IP_HDR_LEN(iph), IPPROTO_TCP,
-+ lro_desc->data_csum);
-+}
-+
-+static __wsum lro_tcp_data_csum(struct iphdr *iph, struct tcphdr *tcph, int len)
-+{
-+ __wsum tcp_csum;
-+ __wsum tcp_hdr_csum;
-+ __wsum tcp_ps_hdr_csum;
-+
-+ tcp_csum = ~csum_unfold(tcph->check);
-+ tcp_hdr_csum = csum_partial((u8 *)tcph, TCP_HDR_LEN(tcph), tcp_csum);
-+
-+ tcp_ps_hdr_csum = csum_tcpudp_nofold(iph->saddr, iph->daddr,
-+ len + TCP_HDR_LEN(tcph),
-+ IPPROTO_TCP, 0);
-+
-+ return csum_sub(csum_sub(tcp_csum, tcp_hdr_csum),
-+ tcp_ps_hdr_csum);
-+}
-+
-+static void lro_init_desc(struct net_lro_desc *lro_desc, struct sk_buff *skb,
-+ struct iphdr *iph, struct tcphdr *tcph,
-+ u16 vlan_tag, struct vlan_group *vgrp)
-+{
-+ int nr_frags;
-+ u32 *ptr;
-+ u32 tcp_data_len = TCP_PAYLOAD_LENGTH(iph, tcph);
-+
-+ nr_frags = skb_shinfo(skb)->nr_frags;
-+ lro_desc->parent = skb;
-+ lro_desc->next_frag = &(skb_shinfo(skb)->frags[nr_frags]);
-+ lro_desc->iph = iph;
-+ lro_desc->tcph = tcph;
-+ lro_desc->tcp_next_seq = ntohl(tcph->seq) + tcp_data_len;
-+ lro_desc->tcp_ack = ntohl(tcph->ack_seq);
-+ lro_desc->tcp_window = tcph->window;
-+
-+ lro_desc->pkt_aggr_cnt = 1;
-+ lro_desc->ip_tot_len = ntohs(iph->tot_len);
-+
-+ if (tcph->doff == 8) {
-+ ptr = (u32 *)(tcph+1);
-+ lro_desc->tcp_saw_tstamp = 1;
-+ lro_desc->tcp_rcv_tsval = *(ptr+1);
-+ lro_desc->tcp_rcv_tsecr = *(ptr+2);
-+ }
-+
-+ lro_desc->mss = tcp_data_len;
-+ lro_desc->vgrp = vgrp;
-+ lro_desc->vlan_tag = vlan_tag;
-+ lro_desc->active = 1;
-+
-+ if (tcp_data_len)
-+ lro_desc->data_csum = lro_tcp_data_csum(iph, tcph,
-+ tcp_data_len);
-+
-+ if (!tcp_data_len)
-+ lro_desc->ack_cnt++;
-+}
-+
-+static inline void lro_clear_desc(struct net_lro_desc *lro_desc)
-+{
-+ memset(lro_desc, 0, sizeof(struct net_lro_desc));
-+}
-+
-+static void lro_add_common(struct net_lro_desc *lro_desc, struct iphdr *iph,
-+ struct tcphdr *tcph, int tcp_data_len)
-+{
-+ struct sk_buff *parent = lro_desc->parent;
-+ u32 *topt;
-+
-+ lro_desc->pkt_aggr_cnt++;
-+ lro_desc->ip_tot_len += tcp_data_len;
-+ lro_desc->tcp_next_seq += tcp_data_len;
-+ lro_desc->tcp_window = tcph->window;
-+ lro_desc->tcp_ack = tcph->ack_seq;
-+
-+ /* don't update tcp_rcv_tsval, would not work with PAWS */
-+ if (lro_desc->tcp_saw_tstamp) {
-+ topt = (u32 *) (tcph + 1);
-+ lro_desc->tcp_rcv_tsecr = *(topt + 2);
-+ }
-+
-+ if (tcp_data_len)
-+ lro_desc->data_csum = csum_block_add(lro_desc->data_csum,
-+ lro_tcp_data_csum(iph, tcph,
-+ tcp_data_len),
-+ parent->len);
-+
-+ parent->len += tcp_data_len;
-+ parent->data_len += tcp_data_len;
-+ if (tcp_data_len > lro_desc->mss)
-+ lro_desc->mss = tcp_data_len;
-+}
-+
-+static void lro_add_frags(struct net_lro_desc *lro_desc,
-+ int len, int hlen, int truesize,
-+ struct skb_frag_struct *skb_frags,
-+ struct iphdr *iph, struct tcphdr *tcph)
-+{
-+ struct sk_buff *skb = lro_desc->parent;
-+ int tcp_data_len = TCP_PAYLOAD_LENGTH(iph, tcph);
-+
-+ lro_add_common(lro_desc, iph, tcph, tcp_data_len);
-+
-+ skb->truesize += truesize;
-+
-+ if (!tcp_data_len) {
-+ put_page(skb_frags[0].page);
-+ lro_desc->ack_cnt++;
-+ return;
-+ }
-+
-+ skb_frags[0].page_offset += hlen;
-+ skb_frags[0].size -= hlen;
-+
-+ while (tcp_data_len > 0) {
-+ *(lro_desc->next_frag) = *skb_frags;
-+ tcp_data_len -= skb_frags->size;
-+ lro_desc->next_frag++;
-+ skb_frags++;
-+ skb_shinfo(skb)->nr_frags++;
-+ }
-+}
-+
-+static int lro_check_tcp_conn(struct net_lro_desc *lro_desc,
-+ struct iphdr *iph,
-+ struct tcphdr *tcph)
-+{
-+ if ((lro_desc->iph->saddr != iph->saddr)
-+ || (lro_desc->iph->daddr != iph->daddr)
-+ || (lro_desc->tcph->source != tcph->source)
-+ || (lro_desc->tcph->dest != tcph->dest))
-+ return -1;
-+ return 0;
-+}
-+
-+static struct net_lro_desc *lro_get_desc(struct net_lro_mgr *lro_mgr,
-+ struct net_lro_desc *lro_arr,
-+ struct iphdr *iph,
-+ struct tcphdr *tcph)
-+{
-+ struct net_lro_desc *lro_desc = NULL;
-+ struct net_lro_desc *tmp;
-+ int max_desc = lro_mgr->max_desc;
-+ int i;
-+
-+ for (i = 0; i < max_desc; i++) {
-+ tmp = &lro_arr[i];
-+ if (tmp->active)
-+ if (!lro_check_tcp_conn(tmp, iph, tcph)) {
-+ lro_desc = tmp;
-+ goto out;
-+ }
-+ }
-+
-+ for (i = 0; i < max_desc; i++) {
-+ if (!lro_arr[i].active) {
-+ lro_desc = &lro_arr[i];
-+ goto out;
-+ }
-+ }
-+
-+ LRO_INC_STATS(lro_mgr, no_desc);
-+out:
-+ return lro_desc;
-+}
-+
-+static void lro_flush(struct net_lro_mgr *lro_mgr,
-+ struct net_lro_desc *lro_desc)
-+{
-+ struct be_adapter *adapter = netdev_priv(lro_mgr->dev);
-+
-+ if (lro_desc->pkt_aggr_cnt > 1)
-+ lro_update_tcp_ip_header(lro_desc);
-+
-+ skb_shinfo(lro_desc->parent)->gso_size = lro_desc->mss;
-+
-+ if (lro_desc->vgrp) {
-+ if (test_bit(LRO_F_NAPI, &lro_mgr->features))
-+ vlan_hwaccel_receive_skb(lro_desc->parent,
-+ lro_desc->vgrp,
-+ lro_desc->vlan_tag);
-+ else
-+ vlan_hwaccel_rx(lro_desc->parent,
-+ lro_desc->vgrp,
-+ lro_desc->vlan_tag);
-+
-+ } else {
-+ if (test_bit(LRO_F_NAPI, &lro_mgr->features))
-+ netif_receive_skb(lro_desc->parent);
-+ else
-+ netif_rx(lro_desc->parent);
-+ }
-+
-+ LRO_INC_STATS(lro_mgr, flushed);
-+ lro_clear_desc(lro_desc);
-+}
-+
-+static struct sk_buff *lro_gen_skb(struct net_lro_mgr *lro_mgr,
-+ struct skb_frag_struct *frags,
-+ int len, int true_size,
-+ void *mac_hdr,
-+ int hlen, __wsum sum,
-+ u32 ip_summed)
-+{
-+ struct sk_buff *skb;
-+ struct skb_frag_struct *skb_frags;
-+ int data_len = len;
-+ int hdr_len = min(len, hlen);
-+
-+ skb = netdev_alloc_skb(lro_mgr->dev, hlen);
-+ if (!skb)
-+ return NULL;
-+
-+ skb->len = len;
-+ skb->data_len = len - hdr_len;
-+ skb->truesize += true_size;
-+ skb->tail += hdr_len;
-+
-+ memcpy(skb->data, mac_hdr, hdr_len);
-+
-+ if (skb->data_len) {
-+ skb_frags = skb_shinfo(skb)->frags;
-+ while (data_len > 0) {
-+ *skb_frags = *frags;
-+ data_len -= frags->size;
-+ skb_frags++;
-+ frags++;
-+ skb_shinfo(skb)->nr_frags++;
-+ }
-+ skb_shinfo(skb)->frags[0].page_offset += hdr_len;
-+ skb_shinfo(skb)->frags[0].size -= hdr_len;
-+ } else {
-+ put_page(frags[0].page);
-+ }
-+
-+
-+ skb->ip_summed = ip_summed;
-+ skb->csum = sum;
-+ skb->protocol = eth_type_trans(skb, lro_mgr->dev);
-+ return skb;
-+}
-+
-+static struct sk_buff *__lro_proc_segment(struct net_lro_mgr *lro_mgr,
-+ struct skb_frag_struct *frags,
-+ int len, int true_size,
-+ struct vlan_group *vgrp,
-+ u16 vlan_tag, void *priv, __wsum sum)
-+{
-+ struct net_lro_desc *lro_desc;
-+ struct iphdr *iph;
-+ struct tcphdr *tcph;
-+ struct sk_buff *skb;
-+ u64 flags;
-+ void *mac_hdr;
-+ int mac_hdr_len;
-+ int hdr_len = LRO_MAX_PG_HLEN;
-+ int vlan_hdr_len = 0;
-+ u8 pad_bytes;
-+
-+ if (!lro_mgr->get_frag_header
-+ || lro_mgr->get_frag_header(frags, (void *)&mac_hdr, (void *)&iph,
-+ (void *)&tcph, &flags, priv)) {
-+ mac_hdr = page_address(frags->page) + frags->page_offset;
-+ goto out1;
-+ }
-+
-+ if (!(flags & LRO_IPV4) || !(flags & LRO_TCP))
-+ goto out1;
-+
-+ hdr_len = (int)((void *)(tcph) + TCP_HDR_LEN(tcph) - mac_hdr);
-+ mac_hdr_len = (int)((void *)(iph) - mac_hdr);
-+
-+ lro_desc = lro_get_desc(lro_mgr, lro_mgr->lro_arr, iph, tcph);
-+ if (!lro_desc)
-+ goto out1;
-+
-+ pad_bytes = len - (ntohs(iph->tot_len) + mac_hdr_len);
-+ if (!TCP_PAYLOAD_LENGTH(iph, tcph) && pad_bytes) {
-+ len -= pad_bytes; /* trim the packet */
-+ frags[0].size -= pad_bytes;
-+ true_size -= pad_bytes;
-+ }
-+
-+ if (!lro_desc->active) { /* start new lro session */
-+ if (lro_tcp_ip_check(iph, tcph, len - mac_hdr_len, NULL))
-+ goto out1;
-+
-+ skb = lro_gen_skb(lro_mgr, frags, len, true_size, mac_hdr,
-+ hdr_len, 0, lro_mgr->ip_summed_aggr);
-+ if (!skb)
-+ goto out;
-+
-+ if ((skb->protocol == htons(ETH_P_8021Q))
-+ && !test_bit(LRO_F_EXTRACT_VLAN_ID, &lro_mgr->features))
-+ vlan_hdr_len = VLAN_HLEN;
-+
-+ iph = (void *)(skb->data + vlan_hdr_len);
-+ tcph = (void *)((u8 *)skb->data + vlan_hdr_len
-+ + IP_HDR_LEN(iph));
-+
-+ lro_init_desc(lro_desc, skb, iph, tcph, vlan_tag, vgrp);
-+ LRO_INC_STATS(lro_mgr, aggregated);
-+ return 0;
-+ }
-+
-+ if (lro_desc->tcp_next_seq != ntohl(tcph->seq))
-+ goto out2;
-+
-+ if (lro_tcp_ip_check(iph, tcph, len - mac_hdr_len, lro_desc))
-+ goto out2;
-+
-+ lro_add_frags(lro_desc, len, hdr_len, true_size, frags, iph, tcph);
-+ LRO_INC_STATS(lro_mgr, aggregated);
-+
-+ if ((skb_shinfo(lro_desc->parent)->nr_frags >= lro_mgr->max_aggr) ||
-+ lro_desc->parent->len > (0xFFFF - lro_mgr->dev->mtu))
-+ lro_flush(lro_mgr, lro_desc);
-+
-+ return NULL;
-+
-+out2: /* send aggregated packets to the stack */
-+ lro_flush(lro_mgr, lro_desc);
-+
-+out1: /* Original packet has to be posted to the stack */
-+ skb = lro_gen_skb(lro_mgr, frags, len, true_size, mac_hdr,
-+ hdr_len, sum, lro_mgr->ip_summed);
-+out:
-+ return skb;
-+}
-+
-+void lro_receive_frags_compat(struct net_lro_mgr *lro_mgr,
-+ struct skb_frag_struct *frags,
-+ int len, int true_size, void *priv, __wsum sum)
-+{
-+ struct sk_buff *skb;
-+
-+ skb = __lro_proc_segment(lro_mgr, frags, len, true_size, NULL, 0,
-+ priv, sum);
-+ if (!skb)
-+ return;
-+
-+ if (test_bit(LRO_F_NAPI, &lro_mgr->features))
-+ netif_receive_skb(skb);
-+ else
-+ netif_rx(skb);
-+}
-+
-+void lro_vlan_hwaccel_receive_frags_compat(struct net_lro_mgr *lro_mgr,
-+ struct skb_frag_struct *frags,
-+ int len, int true_size,
-+ struct vlan_group *vgrp,
-+ u16 vlan_tag, void *priv, __wsum sum)
-+{
-+ struct sk_buff *skb;
-+
-+ skb = __lro_proc_segment(lro_mgr, frags, len, true_size, vgrp,
-+ vlan_tag, priv, sum);
-+ if (!skb)
-+ return;
-+
-+ if (test_bit(LRO_F_NAPI, &lro_mgr->features))
-+ vlan_hwaccel_receive_skb(skb, vgrp, vlan_tag);
-+ else
-+ vlan_hwaccel_rx(skb, vgrp, vlan_tag);
-+}
-+
-+void lro_flush_all_compat(struct net_lro_mgr *lro_mgr)
-+{
-+ int i;
-+ struct net_lro_desc *lro_desc = lro_mgr->lro_arr;
-+
-+ for (i = 0; i < lro_mgr->max_desc; i++) {
-+ if (lro_desc[i].active)
-+ lro_flush(lro_mgr, &lro_desc[i]);
-+ }
-+}
-+#endif /* INET_LRO backport */
-+
-+#ifndef TX_MQ
-+struct net_device *alloc_etherdev_mq_compat(int sizeof_priv,
-+ unsigned int queue_count)
-+{
-+ return alloc_etherdev(sizeof_priv);
-+}
-+
-+void netif_wake_subqueue_compat(struct net_device *dev, u16 queue_index)
-+{
-+ netif_wake_queue(dev);
-+}
-+
-+void netif_stop_subqueue_compat(struct net_device *dev, u16 queue_index)
-+{
-+ netif_stop_queue(dev);
-+}
-+
-+int __netif_subqueue_stopped_compat(const struct net_device *dev,
-+ u16 queue_index)
-+{
-+ return netif_queue_stopped(dev);
-+}
-+
-+u16 skb_get_queue_mapping_compat(const struct sk_buff *skb)
-+{
-+ return 0;
-+}
-+
-+void netif_set_real_num_tx_queues_compat(struct net_device *dev,
-+ unsigned int txq)
-+{
-+ return;
-+}
-+
-+u16 skb_tx_hash_compat(const struct net_device *dev,
-+ const struct sk_buff *skb)
-+{
-+ return 0;
-+}
-+#endif
-diff --git a/drivers/net/benet/be_compat.h b/drivers/net/benet/be_compat.h
-new file mode 100644
-index 0000000..8ceecc8
---- /dev/null
-+++ b/drivers/net/benet/be_compat.h
-@@ -0,0 +1,621 @@
-+/*
-+ * Copyright (C) 2005 - 2011 Emulex
-+ * All rights reserved.
-+ *
-+ * This program is free software; you can redistribute it and/or
-+ * modify it under the terms of the GNU General Public License version 2
-+ * as published by the Free Software Foundation. The full GNU General
-+ * Public License is included in this distribution in the file called COPYING.
-+ *
-+ * Contact Information:
-+ * linux-drivers@emulex.com
-+ *
-+ * Emulex
-+ * 3333 Susan Street
-+ * Costa Mesa, CA 92626
-+ */
-+
-+#ifndef BE_COMPAT_H
-+#define BE_COMPAT_H
-+
-+/****************** RHEL5 and SLES10 backport ***************************/
-+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 18)
-+
-+#ifndef upper_32_bits
-+#define upper_32_bits(n) ((u32)(((n) >> 16) >> 16))
-+#endif
-+
-+#ifndef CHECKSUM_PARTIAL
-+#define CHECKSUM_PARTIAL CHECKSUM_HW
-+#define CHECKSUM_COMPLETE CHECKSUM_HW
-+#endif
-+
-+#if !defined(ip_hdr)
-+#define ip_hdr(skb) (skb->nh.iph)
-+#define ipv6_hdr(skb) (skb->nh.ipv6h)
-+#endif
-+
-+#if !defined(__packed)
-+#define __packed __attribute__ ((packed))
-+#endif
-+
-+#if !defined(RHEL_MINOR)
-+/* Only for RH5U1 (Maui) and SLES10 NIC driver */
-+enum {
-+ false = 0,
-+ true = 1
-+};
-+#if LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 18)
-+/* Only for RH5U1 (Maui) NIC driver */
-+static inline __attribute__((const))
-+int __ilog2_u32(u32 n)
-+{
-+ return fls(n) - 1;
-+}
-+#endif
-+#endif
-+
-+#define ETH_FCS_LEN 4
-+#define bool u8
-+#ifndef PTR_ALIGN
-+#define PTR_ALIGN(p, a) ((typeof(p)) \
-+ ALIGN((unsigned long)(p), (a)))
-+#endif
-+#define list_first_entry(ptr, type, member) \
-+ list_entry((ptr)->next, type, member)
-+
-+#if (defined(RHEL_MINOR) && RHEL_MINOR < 6) || \
-+ LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 16)
-+#define DEFINE_PCI_DEVICE_TABLE(_table) struct pci_device_id _table[] \
-+ __devinitdata
-+#endif
-+
-+/* Backport of request_irq */
-+typedef irqreturn_t(*backport_irq_handler_t) (int, void *);
-+static inline int
-+backport_request_irq(unsigned int irq, irqreturn_t(*handler) (int, void *),
-+ unsigned long flags, const char *dev_name, void *dev_id)
-+{
-+ return request_irq(irq,
-+ (irqreturn_t(*) (int, void *, struct pt_regs *))handler,
-+ flags, dev_name, dev_id);
-+}
-+#define request_irq backport_request_irq
-+
-+#endif /*** RHEL5 and SLES10 backport ***/
-+
-+#if !defined(__packed)
-+#define __packed __attribute__ ((packed))
-+#endif
-+
-+/****************** SLES10 only backport ***************************/
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 18)
-+
-+#include <linux/tifm.h>
-+
-+#define FIELD_SIZEOF(t, f) (sizeof(((t *)0)->f))
-+#define IRQF_SHARED SA_SHIRQ
-+#define CHECKSUM_PARTIAL CHECKSUM_HW
-+#define CHECKSUM_COMPLETE CHECKSUM_HW
-+#define DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d))
-+#define NETIF_F_IPV6_CSUM NETIF_F_IP_CSUM
-+#define NETIF_F_TSO6 NETIF_F_TSO
-+
-+
-+static inline struct sk_buff *netdev_alloc_skb(struct net_device *dev,
-+ unsigned int length)
-+{
-+ /* 16 == NET_PAD_SKB */
-+ struct sk_buff *skb;
-+ skb = alloc_skb(length + 16, GFP_ATOMIC);
-+ if (likely(skb != NULL)) {
-+ skb_reserve(skb, 16);
-+ skb->dev = dev;
-+ }
-+ return skb;
-+}
-+
-+#define PCI_SAVE_STATE(x)
-+
-+#else /* SLES10 only backport */
-+
-+#define PCI_SAVE_STATE(x) pci_save_state(x)
-+
-+#endif /* SLES10 only backport */
-+
-+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 31)
-+#define netdev_tx_t int
-+#endif
-+
-+#ifndef VLAN_PRIO_MASK
-+#define VLAN_PRIO_MASK 0xe000 /* Priority Code Point */
-+#define VLAN_PRIO_SHIFT 13
-+#endif
-+
-+/*
-+ * Backport of netdev ops struct
-+ */
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 28)
-+struct net_device_ops {
-+ int (*ndo_init)(struct net_device *dev);
-+ void (*ndo_uninit)(struct net_device *dev);
-+ int (*ndo_open)(struct net_device *dev);
-+ int (*ndo_stop)(struct net_device *dev);
-+ int (*ndo_start_xmit) (struct sk_buff *skb, struct net_device *dev);
-+ u16 (*ndo_select_queue)(struct net_device *dev,
-+ struct sk_buff *skb);
-+ void (*ndo_change_rx_flags)(struct net_device *dev, int flags);
-+ void (*ndo_set_rx_mode)(struct net_device *dev);
-+ void (*ndo_set_multicast_list)(struct net_device *dev);
-+ int (*ndo_set_mac_address)(struct net_device *dev, void *addr);
-+ int (*ndo_validate_addr)(struct net_device *dev);
-+ int (*ndo_do_ioctl)(struct net_device *dev,
-+ struct ifreq *ifr, int cmd);
-+ int (*ndo_set_config)(struct net_device *dev, struct ifmap *map);
-+ int (*ndo_change_mtu)(struct net_device *dev, int new_mtu);
-+ int (*ndo_neigh_setup)(struct net_device *dev,
-+ struct neigh_parms *);
-+ void (*ndo_tx_timeout) (struct net_device *dev);
-+
-+ struct net_device_stats* (*ndo_get_stats)(struct net_device *dev);
-+
-+ void (*ndo_vlan_rx_register)(struct net_device *dev,
-+ struct vlan_group *grp);
-+ void (*ndo_vlan_rx_add_vid)(struct net_device *dev,
-+ unsigned short vid);
-+ void (*ndo_vlan_rx_kill_vid)(struct net_device *dev,
-+ unsigned short vid);
-+#ifdef CONFIG_NET_POLL_CONTROLLER
-+#define HAVE_NETDEV_POLL
-+ void (*ndo_poll_controller)(struct net_device *dev);
-+#endif
-+};
-+extern void be_netdev_ops_init(struct net_device *netdev,
-+ struct net_device_ops *ops);
-+extern int eth_validate_addr(struct net_device *);
-+
-+#endif /* Netdev ops backport */
-+
-+#if LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 29)
-+#undef NETIF_F_GRO
-+#endif
-+
-+#ifdef NO_GRO
-+#if ((defined(RHEL_MAJOR) && (RHEL_MAJOR == 5)))
-+#undef NETIF_F_GRO
-+#endif
-+#endif
-+
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 32)
-+#define HAVE_ETHTOOL_FLASH
-+#endif
-+
-+/*
-+ * Backport of NAPI
-+ */
-+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 24)
-+
-+#if defined(RHEL_MINOR) && (RHEL_MINOR > 3)
-+#define RHEL_NEW_NAPI
-+#endif
-+
-+/* We need a new struct that has some meta data beyond rhel 5.4's napi_struct
-+ * to fix rhel5.4's half-baked new napi implementation.
-+ * We don't want to use rhel 5.4's broken napi_complete; so
-+ * define a new be_napi_complete that executes the logic only for Rx
-+ */
-+
-+#ifdef RHEL_NEW_NAPI
-+#define napi_complete be_napi_complete
-+typedef struct napi_struct rhel_napi_struct;
-+#endif
-+#define napi_struct be_napi_struct
-+#define napi_gro_frags(napi) napi_gro_frags((rhel_napi_struct *) napi)
-+#define vlan_gro_frags(napi, vlan_grp, vid)\
-+ vlan_gro_frags((rhel_napi_struct *) napi, vlan_grp, vid)
-+#define napi_get_frags(napi) napi_get_frags((rhel_napi_struct *) napi)
-+
-+struct napi_struct {
-+#ifdef RHEL_NEW_NAPI
-+ rhel_napi_struct napi; /* must be the first member */
-+#endif
-+ struct net_device *dev;
-+ int (*poll) (struct napi_struct *napi, int budget);
-+ bool rx;
-+};
-+
-+static inline void napi_complete(struct napi_struct *napi)
-+{
-+#ifdef NETIF_F_GRO
-+ napi_gro_flush((rhel_napi_struct *)napi);
-+#endif
-+ netif_rx_complete(napi->dev);
-+}
-+
-+static inline void napi_schedule(struct napi_struct *napi)
-+{
-+ netif_rx_schedule(napi->dev);
-+}
-+
-+static inline void napi_enable(struct napi_struct *napi)
-+{
-+ netif_poll_enable(napi->dev);
-+}
-+
-+static inline void napi_disable(struct napi_struct *napi)
-+{
-+ netif_poll_disable(napi->dev);
-+}
-+
-+#if (defined(RHEL_MINOR) && RHEL_MINOR < 6) || \
-+ LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 16)
-+static inline void vlan_group_set_device(struct vlan_group *vg,
-+ u16 vlan_id,
-+ struct net_device *dev)
-+{
-+ struct net_device **array;
-+ if (!vg)
-+ return;
-+ array = vg->vlan_devices;
-+ array[vlan_id] = dev;
-+}
-+#endif
-+
-+#endif /* New NAPI backport */
-+
-+extern int be_netif_napi_add(struct net_device *netdev,
-+ struct napi_struct *napi,
-+ int (*poll) (struct napi_struct *, int), int weight);
-+extern void be_netif_napi_del(struct net_device *netdev);
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 27)
-+#define HAVE_SIMULATED_MULTI_NAPI
-+#endif
-+
-+/************** Backport of Delayed work queues interface ****************/
-+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 19)
-+#if (defined(RHEL_MINOR) && RHEL_MINOR < 6) || \
-+ LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 16)
-+struct delayed_work {
-+ struct work_struct work;
-+};
-+#endif
-+
-+#define INIT_DELAYED_WORK(_work, _func) \
-+ INIT_WORK(&(_work)->work, _func, &(_work)->work)
-+
-+static inline int backport_cancel_delayed_work_sync(struct delayed_work *work)
-+{
-+ cancel_rearming_delayed_work(&work->work);
-+ return 0;
-+}
-+#define cancel_delayed_work_sync backport_cancel_delayed_work_sync
-+
-+static inline int backport_schedule_delayed_work(struct delayed_work *work,
-+ unsigned long delay)
-+{
-+ if (unlikely(!delay))
-+ return schedule_work(&work->work);
-+ else
-+ return schedule_delayed_work(&work->work, delay);
-+}
-+#define schedule_delayed_work backport_schedule_delayed_work
-+#endif /* backport delayed workqueue */
-+
-+
-+/************** Backport of INET_LRO **********************************/
-+#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 18)
-+
-+#include <linux/inet_lro.h>
-+
-+#else
-+
-+#if LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 18)
-+
-+#if defined(RHEL_MINOR) && RHEL_MINOR < 6
-+typedef __u16 __bitwise __sum16;
-+typedef __u32 __bitwise __wsum;
-+#endif
-+
-+#if ((defined(RHEL_MAJOR) && (RHEL_MAJOR == 5) && (RHEL_MINOR <= 3)) || \
-+ (!defined(RHEL_MINOR)))
-+static inline __wsum csum_unfold(__sum16 n)
-+{
-+ return (__force __wsum)n;
-+}
-+#endif
-+
-+#endif
-+
-+#define lro_flush_all lro_flush_all_compat
-+#define lro_vlan_hwaccel_receive_frags lro_vlan_hwaccel_receive_frags_compat
-+#define lro_receive_frags lro_receive_frags_compat
-+
-+struct net_lro_stats {
-+ unsigned long aggregated;
-+ unsigned long flushed;
-+ unsigned long no_desc;
-+};
-+
-+struct net_lro_desc {
-+ struct sk_buff *parent;
-+ struct sk_buff *last_skb;
-+ struct skb_frag_struct *next_frag;
-+ struct iphdr *iph;
-+ struct tcphdr *tcph;
-+ struct vlan_group *vgrp;
-+ __wsum data_csum;
-+ u32 tcp_rcv_tsecr;
-+ u32 tcp_rcv_tsval;
-+ u32 tcp_ack;
-+ u32 tcp_next_seq;
-+ u32 skb_tot_frags_len;
-+ u32 ack_cnt;
-+ u16 ip_tot_len;
-+ u16 tcp_saw_tstamp; /* timestamps enabled */
-+ u16 tcp_window;
-+ u16 vlan_tag;
-+ int pkt_aggr_cnt; /* counts aggregated packets */
-+ int vlan_packet;
-+ int mss;
-+ int active;
-+};
-+
-+struct net_lro_mgr {
-+ struct net_device *dev;
-+ struct net_lro_stats stats;
-+
-+ /* LRO features */
-+ unsigned long features;
-+#define LRO_F_NAPI 1 /* Pass packets to stack via NAPI */
-+#define LRO_F_EXTRACT_VLAN_ID 2 /* Set flag if VLAN IDs are extracted
-+ from received packets and eth protocol
-+ is still ETH_P_8021Q */
-+
-+ u32 ip_summed; /* Set in non generated SKBs in page mode */
-+ u32 ip_summed_aggr; /* Set in aggregated SKBs: CHECKSUM_UNNECESSARY
-+ * or CHECKSUM_NONE */
-+
-+ int max_desc; /* Max number of LRO descriptors */
-+ int max_aggr; /* Max number of LRO packets to be aggregated */
-+
-+ struct net_lro_desc *lro_arr; /* Array of LRO descriptors */
-+
-+ /* Optimized driver functions
-+ * get_skb_header: returns tcp and ip header for packet in SKB
-+ */
-+ int (*get_skb_header)(struct sk_buff *skb, void **ip_hdr,
-+ void **tcpudp_hdr, u64 *hdr_flags, void *priv);
-+
-+ /* hdr_flags: */
-+#define LRO_IPV4 1 /* ip_hdr is IPv4 header */
-+#define LRO_TCP 2 /* tcpudp_hdr is TCP header */
-+
-+ /*
-+ * get_frag_header: returns mac, tcp and ip header for packet in SKB
-+ *
-+ * @hdr_flags: Indicate what kind of LRO has to be done
-+ * (IPv4/IPv6/TCP/UDP)
-+ */
-+ int (*get_frag_header)(struct skb_frag_struct *frag, void **mac_hdr,
-+ void **ip_hdr, void **tcpudp_hdr, u64 *hdr_flags,
-+ void *priv);
-+};
-+
-+extern void lro_receive_skb(struct net_lro_mgr *lro_mgr, struct sk_buff *skb,
-+ void *priv);
-+
-+extern void lro_vlan_hwaccel_receive_skb(struct net_lro_mgr *lro_mgr,
-+ struct sk_buff *skb, struct vlan_group *vgrp,
-+ u16 vlan_tag, void *priv);
-+
-+/* This functions aggregate fragments and generate SKBs do pass
-+ * the packets to the stack.
-+ *
-+ * @lro_mgr: LRO manager to use
-+ * @frags: Fragment to be processed. Must contain entire header in first
-+ * element.
-+ * @len: Length of received data
-+ * @true_size: Actual size of memory the fragment is consuming
-+ * @priv: Private data that may be used by driver functions
-+ * (for example get_tcp_ip_hdr)
-+ */
-+extern void lro_receive_frags_compat(struct net_lro_mgr *lro_mgr,
-+ struct skb_frag_struct *frags, int len, int true_size,
-+ void *priv, __wsum sum);
-+
-+extern void lro_vlan_hwaccel_receive_frags_compat(struct net_lro_mgr *lro_mgr,
-+ struct skb_frag_struct *frags, int len, int true_size,
-+ struct vlan_group *vgrp, u16 vlan_tag, void *priv,
-+ __wsum sum);
-+
-+/* Forward all aggregated SKBs held by lro_mgr to network stack */
-+extern void lro_flush_all_compat(struct net_lro_mgr *lro_mgr);
-+
-+extern void lro_flush_pkt(struct net_lro_mgr *lro_mgr, struct iphdr *iph,
-+ struct tcphdr *tcph);
-+#endif /* backport of inet_lro */
-+
-+#ifndef ETHTOOL_FLASH_MAX_FILENAME
-+#define ETHTOOL_FLASH_MAX_FILENAME 128
-+#endif
-+
-+#if defined(CONFIG_XEN) && !defined(NETIF_F_GRO)
-+#define BE_INIT_FRAGS_PER_FRAME (u32) 1
-+#else
-+#define BE_INIT_FRAGS_PER_FRAME (min((u32) 16, (u32) MAX_SKB_FRAGS))
-+#endif
-+
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 32)
-+#ifdef CONFIG_PCI_IOV
-+#if (!(defined(RHEL_MAJOR) && (RHEL_MAJOR == 5) && (RHEL_MINOR == 6)))
-+#undef CONFIG_PCI_IOV
-+#endif
-+#endif
-+#endif
-+
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 20)
-+#define dev_to_node(dev) -1
-+#endif
-+
-+
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 32)
-+#if (!(defined(RHEL_MAJOR) && (RHEL_MAJOR == 5) && (RHEL_MINOR > 6)))
-+static inline struct sk_buff *netdev_alloc_skb_ip_align(struct net_device *dev,
-+ unsigned int length)
-+{
-+ struct sk_buff *skb = netdev_alloc_skb(dev, length + NET_IP_ALIGN);
-+
-+ if (NET_IP_ALIGN && skb)
-+ skb_reserve(skb, NET_IP_ALIGN);
-+ return skb;
-+}
-+#endif
-+#endif
-+
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 26)
-+#ifndef netif_set_gso_max_size
-+#define netif_set_gso_max_size(netdev, size) do {} while (0)
-+#endif
-+#endif
-+
-+#if (LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 18))
-+#if defined(RHEL_MINOR) && (RHEL_MINOR <= 4)
-+static inline int skb_is_gso_v6(const struct sk_buff *skb)
-+{
-+ return skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6;
-+}
-+#endif
-+#endif
-+
-+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 18))
-+static inline int skb_is_gso_v6(const struct sk_buff *skb)
-+{
-+ return (ip_hdr(skb)->version == 6);
-+}
-+#endif
-+
-+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 18))
-+#define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
-+#endif
-+
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 32)
-+#if ((defined(RHEL_MAJOR) && (RHEL_MAJOR == 6)))
-+#define HAVE_SRIOV_CONFIG
-+#endif
-+#endif
-+
-+#ifndef NETIF_F_VLAN_SG
-+#define NETIF_F_VLAN_SG NETIF_F_SG
-+#endif
-+
-+#ifndef NETIF_F_VLAN_CSUM
-+#define NETIF_F_VLAN_CSUM NETIF_F_HW_CSUM
-+#endif
-+
-+#ifndef NETIF_F_VLAN_TSO
-+#define NETIF_F_VLAN_TSO NETIF_F_TSO
-+#endif
-+
-+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 27))
-+#define vlan_features features
-+#endif
-+
-+#ifndef DEFINE_DMA_UNMAP_ADDR
-+#define DEFINE_DMA_UNMAP_ADDR(bus) dma_addr_t bus
-+#endif
-+
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 0, 0)
-+
-+#ifndef netdev_mc_count
-+#define netdev_mc_count(nd) (nd->mc_count)
-+#endif
-+
-+#ifndef netdev_hw_addr
-+#define netdev_hw_addr dev_mc_list
-+#endif
-+
-+#ifndef netdev_for_each_mc_addr
-+#define netdev_for_each_mc_addr(ha, nd) \
-+ for (ha = (nd)->mc_list; ha; ha = ha->next)
-+#endif
-+
-+#define DMI_ADDR dmi_addr
-+#else
-+#define DMI_ADDR addr
-+#endif
-+
-+#ifndef VLAN_GROUP_ARRAY_LEN
-+#define VLAN_GROUP_ARRAY_LEN VLAN_N_VID
-+#endif
-+/**************************** Multi TXQ Support ******************************/
-+
-+/* Supported only in RHEL6 and SL11.1 (barring one execption) */
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 32)
-+#define MQ_TX
-+#endif
-+
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 27)
-+#define alloc_etherdev_mq(sz, cnt) alloc_etherdev(sz)
-+#define skb_get_queue_mapping(skb) 0
-+#define skb_tx_hash(dev, skb) 0
-+#define netif_set_real_num_tx_queues(dev, txq) do {} while(0)
-+#define netif_wake_subqueue(dev, idx) netif_wake_queue(dev)
-+#define netif_stop_subqueue(dev, idx) netif_stop_queue(dev)
-+#define __netif_subqueue_stopped(dev, idx) netif_queue_stopped(dev)
-+#endif /* < 2.6.27 */
-+
-+#if ((LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && \
-+ (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 32)))
-+#define skb_tx_hash(dev, skb) 0
-+#define netif_set_real_num_tx_queues(dev, txq) do {} while(0)
-+#endif
-+
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 32)
-+#define netif_set_real_num_tx_queues be_set_real_num_tx_queues
-+static inline void be_set_real_num_tx_queues(struct net_device *dev,
-+ unsigned int txq)
-+{
-+ dev->real_num_tx_queues = txq;
-+}
-+#endif
-+
-+#include <linux/if_vlan.h>
-+static inline void be_reset_skb_tx_vlan(struct sk_buff *skb)
-+{
-+#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 18)
-+ skb->vlan_tci = 0;
-+#else
-+ struct vlan_skb_tx_cookie *cookie;
-+
-+ cookie = VLAN_TX_SKB_CB(skb);
-+ cookie->magic = 0;
-+#endif
-+}
-+
-+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 18))
-+static inline void skb_set_network_header(struct sk_buff *skb, const int offset)
-+{
-+ skb->nh.raw = skb->data + offset;
-+}
-+#endif
-+
-+static inline struct sk_buff *be_vlan_put_tag(struct sk_buff *skb,
-+ unsigned short vlan_tag)
-+{
-+ struct sk_buff *new_skb = __vlan_put_tag(skb, vlan_tag);
-+ /* On kernel versions < 2.6.27 the __vlan_put_tag() function
-+ * distorts the network layer hdr pointer in the skb which
-+ * affects the detection of UDP/TCP packets down the line in
-+ * wrb_fill_hdr().This work-around sets it right.
-+ */
-+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 27))
-+ skb_set_network_header(new_skb, VLAN_ETH_HLEN);
-+#endif
-+ return new_skb;
-+}
-+
-+#ifndef ACCESS_ONCE
-+#define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x))
-+#endif
-+
-+#endif /* BE_COMPAT_H */
-diff --git a/drivers/net/benet/be_ethtool.c b/drivers/net/benet/be_ethtool.c
-index f0fd95b..37bad99 100644
---- a/drivers/net/benet/be_ethtool.c
-+++ b/drivers/net/benet/be_ethtool.c
-@@ -1,18 +1,18 @@
- /*
-- * Copyright (C) 2005 - 2009 ServerEngines
-+ * Copyright (C) 2005 - 2011 Emulex
- * All rights reserved.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License version 2
-- * as published by the Free Software Foundation. The full GNU General
-+ * as published by the Free Software Foundation. The full GNU General
- * Public License is included in this distribution in the file called COPYING.
- *
- * Contact Information:
-- * linux-drivers@serverengines.com
-+ * linux-drivers@emulex.com
- *
-- * ServerEngines
-- * 209 N. Fair Oaks Ave
-- * Sunnyvale, CA 94085
-+ * Emulex
-+ * 3333 Susan Street
-+ * Costa Mesa, CA 92626
- */
-
- #include "be.h"
-@@ -26,21 +26,19 @@ struct be_ethtool_stat {
- int offset;
- };
-
--enum {NETSTAT, PORTSTAT, MISCSTAT, DRVSTAT, ERXSTAT};
-+enum {NETSTAT, DRVSTAT_TX, DRVSTAT_RX, DRVSTAT};
- #define FIELDINFO(_struct, field) FIELD_SIZEOF(_struct, field), \
- offsetof(_struct, field)
--#define NETSTAT_INFO(field) #field, NETSTAT,\
-+#define NETSTAT_INFO(field) #field, NETSTAT,\
- FIELDINFO(struct net_device_stats,\
- field)
--#define DRVSTAT_INFO(field) #field, DRVSTAT,\
-- FIELDINFO(struct be_drvr_stats, field)
--#define MISCSTAT_INFO(field) #field, MISCSTAT,\
-- FIELDINFO(struct be_rxf_stats, field)
--#define PORTSTAT_INFO(field) #field, PORTSTAT,\
-- FIELDINFO(struct be_port_rxf_stats, \
-+#define DRVSTAT_TX_INFO(field) #field, DRVSTAT_TX,\
-+ FIELDINFO(struct be_tx_stats, field)
-+#define DRVSTAT_RX_INFO(field) #field, DRVSTAT_RX,\
-+ FIELDINFO(struct be_rx_stats, field)
-+#define DRVSTAT_INFO(field) #field, DRVSTAT,\
-+ FIELDINFO(struct be_drv_stats, \
- field)
--#define ERXSTAT_INFO(field) #field, ERXSTAT,\
-- FIELDINFO(struct be_erx_stats, field)
-
- static const struct be_ethtool_stat et_stats[] = {
- {NETSTAT_INFO(rx_packets)},
-@@ -51,70 +49,131 @@ static const struct be_ethtool_stat et_stats[] = {
- {NETSTAT_INFO(tx_errors)},
- {NETSTAT_INFO(rx_dropped)},
- {NETSTAT_INFO(tx_dropped)},
-- {DRVSTAT_INFO(be_tx_reqs)},
-- {DRVSTAT_INFO(be_tx_stops)},
-- {DRVSTAT_INFO(be_fwd_reqs)},
-- {DRVSTAT_INFO(be_tx_wrbs)},
-- {DRVSTAT_INFO(be_polls)},
- {DRVSTAT_INFO(be_tx_events)},
-- {DRVSTAT_INFO(be_rx_events)},
-- {DRVSTAT_INFO(be_tx_compl)},
-- {DRVSTAT_INFO(be_rx_compl)},
-- {DRVSTAT_INFO(be_ethrx_post_fail)},
-- {DRVSTAT_INFO(be_802_3_dropped_frames)},
-- {DRVSTAT_INFO(be_802_3_malformed_frames)},
-- {DRVSTAT_INFO(be_tx_rate)},
-- {DRVSTAT_INFO(be_rx_rate)},
-- {PORTSTAT_INFO(rx_unicast_frames)},
-- {PORTSTAT_INFO(rx_multicast_frames)},
-- {PORTSTAT_INFO(rx_broadcast_frames)},
-- {PORTSTAT_INFO(rx_crc_errors)},
-- {PORTSTAT_INFO(rx_alignment_symbol_errors)},
-- {PORTSTAT_INFO(rx_pause_frames)},
-- {PORTSTAT_INFO(rx_control_frames)},
-- {PORTSTAT_INFO(rx_in_range_errors)},
-- {PORTSTAT_INFO(rx_out_range_errors)},
-- {PORTSTAT_INFO(rx_frame_too_long)},
-- {PORTSTAT_INFO(rx_address_match_errors)},
-- {PORTSTAT_INFO(rx_vlan_mismatch)},
-- {PORTSTAT_INFO(rx_dropped_too_small)},
-- {PORTSTAT_INFO(rx_dropped_too_short)},
-- {PORTSTAT_INFO(rx_dropped_header_too_small)},
-- {PORTSTAT_INFO(rx_dropped_tcp_length)},
-- {PORTSTAT_INFO(rx_dropped_runt)},
-- {PORTSTAT_INFO(rx_fifo_overflow)},
-- {PORTSTAT_INFO(rx_input_fifo_overflow)},
-- {PORTSTAT_INFO(rx_ip_checksum_errs)},
-- {PORTSTAT_INFO(rx_tcp_checksum_errs)},
-- {PORTSTAT_INFO(rx_udp_checksum_errs)},
-- {PORTSTAT_INFO(rx_non_rss_packets)},
-- {PORTSTAT_INFO(rx_ipv4_packets)},
-- {PORTSTAT_INFO(rx_ipv6_packets)},
-- {PORTSTAT_INFO(tx_unicastframes)},
-- {PORTSTAT_INFO(tx_multicastframes)},
-- {PORTSTAT_INFO(tx_broadcastframes)},
-- {PORTSTAT_INFO(tx_pauseframes)},
-- {PORTSTAT_INFO(tx_controlframes)},
-- {MISCSTAT_INFO(rx_drops_no_pbuf)},
-- {MISCSTAT_INFO(rx_drops_no_txpb)},
-- {MISCSTAT_INFO(rx_drops_no_erx_descr)},
-- {MISCSTAT_INFO(rx_drops_no_tpre_descr)},
-- {MISCSTAT_INFO(rx_drops_too_many_frags)},
-- {MISCSTAT_INFO(rx_drops_invalid_ring)},
-- {MISCSTAT_INFO(forwarded_packets)},
-- {MISCSTAT_INFO(rx_drops_mtu)},
-- {ERXSTAT_INFO(rx_drops_no_fragments)},
-+ {DRVSTAT_INFO(rx_crc_errors)},
-+ {DRVSTAT_INFO(rx_alignment_symbol_errors)},
-+ {DRVSTAT_INFO(rx_pause_frames)},
-+ {DRVSTAT_INFO(rx_control_frames)},
-+ {DRVSTAT_INFO(rx_in_range_errors)},
-+ {DRVSTAT_INFO(rx_out_range_errors)},
-+ {DRVSTAT_INFO(rx_frame_too_long)},
-+ {DRVSTAT_INFO(rx_address_match_errors)},
-+ {DRVSTAT_INFO(rx_dropped_too_small)},
-+ {DRVSTAT_INFO(rx_dropped_too_short)},
-+ {DRVSTAT_INFO(rx_dropped_header_too_small)},
-+ {DRVSTAT_INFO(rx_dropped_tcp_length)},
-+ {DRVSTAT_INFO(rx_dropped_runt)},
-+ {DRVSTAT_INFO(rxpp_fifo_overflow_drop)},
-+ {DRVSTAT_INFO(rx_input_fifo_overflow_drop)},
-+ {DRVSTAT_INFO(rx_ip_checksum_errs)},
-+ {DRVSTAT_INFO(rx_tcp_checksum_errs)},
-+ {DRVSTAT_INFO(rx_udp_checksum_errs)},
-+ {DRVSTAT_INFO(rx_switched_unicast_packets)},
-+ {DRVSTAT_INFO(rx_switched_multicast_packets)},
-+ {DRVSTAT_INFO(rx_switched_broadcast_packets)},
-+ {DRVSTAT_INFO(tx_pauseframes)},
-+ {DRVSTAT_INFO(tx_controlframes)},
-+ {DRVSTAT_INFO(rx_priority_pause_frames)},
-+ {DRVSTAT_INFO(pmem_fifo_overflow_drop)},
-+ {DRVSTAT_INFO(jabber_events)},
-+ {DRVSTAT_INFO(rx_drops_no_pbuf)},
-+ {DRVSTAT_INFO(rx_drops_no_txpb)},
-+ {DRVSTAT_INFO(rx_drops_no_erx_descr)},
-+ {DRVSTAT_INFO(rx_drops_no_tpre_descr)},
-+ {DRVSTAT_INFO(rx_drops_too_many_frags)},
-+ {DRVSTAT_INFO(rx_drops_invalid_ring)},
-+ {DRVSTAT_INFO(forwarded_packets)},
-+ {DRVSTAT_INFO(rx_drops_mtu)},
-+ {DRVSTAT_INFO(eth_red_drops)},
-+ {DRVSTAT_INFO(be_on_die_temperature)}
- };
- #define ETHTOOL_STATS_NUM ARRAY_SIZE(et_stats)
-
-+/* Stats related to multi RX queues */
-+static const struct be_ethtool_stat et_rx_stats[] = {
-+ {DRVSTAT_RX_INFO(rx_bytes)},
-+ {DRVSTAT_RX_INFO(rx_pkts)},
-+ {DRVSTAT_RX_INFO(rx_rate)},
-+ {DRVSTAT_RX_INFO(rx_polls)},
-+ {DRVSTAT_RX_INFO(rx_events)},
-+ {DRVSTAT_RX_INFO(rx_compl)},
-+ {DRVSTAT_RX_INFO(rx_mcast_pkts)},
-+ {DRVSTAT_RX_INFO(rx_post_fail)},
-+ {DRVSTAT_RX_INFO(rx_drops_no_frags)}
-+};
-+#define ETHTOOL_RXSTATS_NUM (ARRAY_SIZE(et_rx_stats))
-+
-+/* Stats related to multi TX queues */
-+static const struct be_ethtool_stat et_tx_stats[] = {
-+ {DRVSTAT_TX_INFO(be_tx_rate)},
-+ {DRVSTAT_TX_INFO(be_tx_reqs)},
-+ {DRVSTAT_TX_INFO(be_tx_wrbs)},
-+ {DRVSTAT_TX_INFO(be_tx_stops)},
-+ {DRVSTAT_TX_INFO(be_tx_compl)},
-+ {DRVSTAT_TX_INFO(be_ipv6_ext_hdr_tx_drop)}
-+};
-+#define ETHTOOL_TXSTATS_NUM (ARRAY_SIZE(et_tx_stats))
-+
-+static const char et_self_tests[][ETH_GSTRING_LEN] = {
-+ "MAC Loopback test",
-+ "PHY Loopback test",
-+ "External Loopback test",
-+ "DDR DMA test",
-+ "Link test"
-+};
-+
-+#define ETHTOOL_TESTS_NUM ARRAY_SIZE(et_self_tests)
-+#define BE_MAC_LOOPBACK 0x0
-+#define BE_PHY_LOOPBACK 0x1
-+#define BE_ONE_PORT_EXT_LOOPBACK 0x2
-+#define BE_NO_LOOPBACK 0xff
-+
-+/* MAC speed valid values */
-+#define SPEED_DEFAULT 0x0
-+#define SPEED_FORCED_10GB 0x1
-+#define SPEED_FORCED_1GB 0x2
-+#define SPEED_AUTONEG_10GB 0x3
-+#define SPEED_AUTONEG_1GB 0x4
-+#define SPEED_AUTONEG_100MB 0x5
-+#define SPEED_AUTONEG_10GB_1GB 0x6
-+#define SPEED_AUTONEG_10GB_1GB_100MB 0x7
-+#define SPEED_AUTONEG_1GB_100MB 0x8
-+#define SPEED_AUTONEG_10MB 0x9
-+#define SPEED_AUTONEG_1GB_100MB_10MB 0xa
-+#define SPEED_AUTONEG_100MB_10MB 0xb
-+#define SPEED_FORCED_100MB 0xc
-+#define SPEED_FORCED_10MB 0xd
-+
-+
-+
- static void
- be_get_drvinfo(struct net_device *netdev, struct ethtool_drvinfo *drvinfo)
- {
- struct be_adapter *adapter = netdev_priv(netdev);
-+ int len;
-+ char fw_on_flash[FW_VER_LEN];
-+
-+ memset(fw_on_flash, 0 , sizeof(fw_on_flash));
-+
-+ be_cmd_get_fw_ver(adapter, adapter->fw_ver,
-+ fw_on_flash);
-
- strcpy(drvinfo->driver, DRV_NAME);
- strcpy(drvinfo->version, DRV_VER);
-+
- strncpy(drvinfo->fw_version, adapter->fw_ver, FW_VER_LEN);
-+ if (memcmp(adapter->fw_ver, fw_on_flash,
-+ FW_VER_LEN) != 0) {
-+ len = strlen(drvinfo->fw_version);
-+ strncpy(drvinfo->fw_version+len, " [",
-+ FW_VER_LEN-len-1);
-+ len = strlen(drvinfo->fw_version);
-+ strncpy(drvinfo->fw_version+len, fw_on_flash,
-+ FW_VER_LEN-len-1);
-+ len = strlen(drvinfo->fw_version);
-+ strncpy(drvinfo->fw_version+len, "]", FW_VER_LEN-len-1);
-+ }
-+
- strcpy(drvinfo->bus_info, pci_name(adapter->pdev));
- drvinfo->testinfo_len = 0;
- drvinfo->regdump_len = 0;
-@@ -122,12 +181,37 @@ be_get_drvinfo(struct net_device *netdev, struct ethtool_drvinfo *drvinfo)
- }
-
- static int
-+be_get_reg_len(struct net_device *netdev)
-+{
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+ u32 log_size = 0;
-+
-+ if (be_physfn(adapter))
-+ be_cmd_get_reg_len(adapter, &log_size);
-+
-+ return log_size;
-+}
-+
-+static void
-+be_get_regs(struct net_device *netdev, struct ethtool_regs *regs, void *buf)
-+{
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+
-+ if (be_physfn(adapter)) {
-+ memset(buf, 0, regs->len);
-+ be_cmd_get_regs(adapter, regs->len, buf);
-+ }
-+}
-+
-+static int
- be_get_coalesce(struct net_device *netdev, struct ethtool_coalesce *coalesce)
- {
- struct be_adapter *adapter = netdev_priv(netdev);
-- struct be_eq_obj *rx_eq = &adapter->rx_eq;
-+ struct be_eq_obj *rx_eq = &adapter->rx_obj[0].rx_eq;
- struct be_eq_obj *tx_eq = &adapter->tx_eq;
-
-+ coalesce->rx_max_coalesced_frames = adapter->max_rx_coal;
-+
- coalesce->rx_coalesce_usecs = rx_eq->cur_eqd;
- coalesce->rx_coalesce_usecs_high = rx_eq->max_eqd;
- coalesce->rx_coalesce_usecs_low = rx_eq->min_eqd;
-@@ -149,25 +233,52 @@ static int
- be_set_coalesce(struct net_device *netdev, struct ethtool_coalesce *coalesce)
- {
- struct be_adapter *adapter = netdev_priv(netdev);
-- struct be_eq_obj *rx_eq = &adapter->rx_eq;
-+ struct be_rx_obj *rxo;
-+ struct be_eq_obj *rx_eq;
- struct be_eq_obj *tx_eq = &adapter->tx_eq;
- u32 tx_max, tx_min, tx_cur;
- u32 rx_max, rx_min, rx_cur;
-- int status = 0;
-+ int status = 0, i;
-
- if (coalesce->use_adaptive_tx_coalesce == 1)
- return -EINVAL;
-+ adapter->max_rx_coal = coalesce->rx_max_coalesced_frames;
-+ if (adapter->max_rx_coal > BE_MAX_FRAGS_PER_FRAME)
-+ adapter->max_rx_coal = BE_MAX_FRAGS_PER_FRAME;
-
-- /* if AIC is being turned on now, start with an EQD of 0 */
-- if (rx_eq->enable_aic == 0 &&
-- coalesce->use_adaptive_rx_coalesce == 1) {
-- rx_eq->cur_eqd = 0;
-+ for_all_rx_queues(adapter, rxo, i) {
-+ rx_eq = &rxo->rx_eq;
-+
-+ if (!rx_eq->enable_aic && coalesce->use_adaptive_rx_coalesce)
-+ rx_eq->cur_eqd = 0;
-+ rx_eq->enable_aic = coalesce->use_adaptive_rx_coalesce;
-+
-+ rx_max = coalesce->rx_coalesce_usecs_high;
-+ rx_min = coalesce->rx_coalesce_usecs_low;
-+ rx_cur = coalesce->rx_coalesce_usecs;
-+
-+ if (rx_eq->enable_aic) {
-+ if (rx_max > BE_MAX_EQD)
-+ rx_max = BE_MAX_EQD;
-+ if (rx_min > rx_max)
-+ rx_min = rx_max;
-+ rx_eq->max_eqd = rx_max;
-+ rx_eq->min_eqd = rx_min;
-+ if (rx_eq->cur_eqd > rx_max)
-+ rx_eq->cur_eqd = rx_max;
-+ if (rx_eq->cur_eqd < rx_min)
-+ rx_eq->cur_eqd = rx_min;
-+ } else {
-+ if (rx_cur > BE_MAX_EQD)
-+ rx_cur = BE_MAX_EQD;
-+ if (rx_eq->cur_eqd != rx_cur) {
-+ status = be_cmd_modify_eqd(adapter, rx_eq->q.id,
-+ rx_cur);
-+ if (!status)
-+ rx_eq->cur_eqd = rx_cur;
-+ }
-+ }
- }
-- rx_eq->enable_aic = coalesce->use_adaptive_rx_coalesce;
--
-- rx_max = coalesce->rx_coalesce_usecs_high;
-- rx_min = coalesce->rx_coalesce_usecs_low;
-- rx_cur = coalesce->rx_coalesce_usecs;
-
- tx_max = coalesce->tx_coalesce_usecs_high;
- tx_min = coalesce->tx_coalesce_usecs_low;
-@@ -181,27 +292,6 @@ be_set_coalesce(struct net_device *netdev, struct ethtool_coalesce *coalesce)
- tx_eq->cur_eqd = tx_cur;
- }
-
-- if (rx_eq->enable_aic) {
-- if (rx_max > BE_MAX_EQD)
-- rx_max = BE_MAX_EQD;
-- if (rx_min > rx_max)
-- rx_min = rx_max;
-- rx_eq->max_eqd = rx_max;
-- rx_eq->min_eqd = rx_min;
-- if (rx_eq->cur_eqd > rx_max)
-- rx_eq->cur_eqd = rx_max;
-- if (rx_eq->cur_eqd < rx_min)
-- rx_eq->cur_eqd = rx_min;
-- } else {
-- if (rx_cur > BE_MAX_EQD)
-- rx_cur = BE_MAX_EQD;
-- if (rx_eq->cur_eqd != rx_cur) {
-- status = be_cmd_modify_eqd(adapter, rx_eq->q.id,
-- rx_cur);
-- if (!status)
-- rx_eq->cur_eqd = rx_cur;
-- }
-- }
- return 0;
- }
-
-@@ -229,81 +319,294 @@ be_get_ethtool_stats(struct net_device *netdev,
- struct ethtool_stats *stats, uint64_t *data)
- {
- struct be_adapter *adapter = netdev_priv(netdev);
-- struct be_drvr_stats *drvr_stats = &adapter->stats.drvr_stats;
-- struct be_hw_stats *hw_stats = hw_stats_from_cmd(adapter->stats.cmd.va);
-- struct be_rxf_stats *rxf_stats = &hw_stats->rxf;
-- struct be_port_rxf_stats *port_stats =
-- &rxf_stats->port[adapter->port_num];
-- struct net_device_stats *net_stats = &adapter->stats.net_stats;
-- struct be_erx_stats *erx_stats = &hw_stats->erx;
-+ struct be_rx_obj *rxo;
-+ struct be_tx_obj *txo;
- void *p = NULL;
-- int i;
-+ int i, j, base;
-
- for (i = 0; i < ETHTOOL_STATS_NUM; i++) {
- switch (et_stats[i].type) {
- case NETSTAT:
-- p = net_stats;
-+ p = &adapter->net_stats;
- break;
- case DRVSTAT:
-- p = drvr_stats;
-- break;
-- case PORTSTAT:
-- p = port_stats;
-- break;
-- case MISCSTAT:
-- p = rxf_stats;
-- break;
-- case ERXSTAT: /* Currently only one ERX stat is provided */
-- p = (u32 *)erx_stats + adapter->rx_obj.q.id;
-+ p = &adapter->drv_stats;
- break;
- }
-
- p = (u8 *)p + et_stats[i].offset;
- data[i] = (et_stats[i].size == sizeof(u64)) ?
-- *(u64 *)p: *(u32 *)p;
-+ *(u64 *)p:(*(u32 *)p);
- }
-
-- return;
-+ base = ETHTOOL_STATS_NUM;
-+ for_all_rx_queues(adapter, rxo, j) {
-+ for (i = 0; i < ETHTOOL_RXSTATS_NUM; i++) {
-+ p = (u8 *)&rxo->stats + et_rx_stats[i].offset;
-+ data[base + j * ETHTOOL_RXSTATS_NUM + i] =
-+ (et_rx_stats[i].size == sizeof(u64)) ?
-+ *(u64 *)p: *(u32 *)p;
-+ }
-+ }
-+
-+ base = ETHTOOL_STATS_NUM + adapter->num_rx_qs * ETHTOOL_RXSTATS_NUM;
-+ for_all_tx_queues(adapter, txo, j) {
-+ for (i = 0; i < ETHTOOL_TXSTATS_NUM; i++) {
-+ p = (u8 *)&txo->stats + et_tx_stats[i].offset;
-+ data[base + j * ETHTOOL_TXSTATS_NUM + i] =
-+ (et_tx_stats[i].size == sizeof(u64)) ?
-+ *(u64 *)p: *(u32 *)p;
-+ }
-+ }
- }
-
- static void
- be_get_stat_strings(struct net_device *netdev, uint32_t stringset,
- uint8_t *data)
- {
-- int i;
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+ int i, j;
-+
- switch (stringset) {
- case ETH_SS_STATS:
- for (i = 0; i < ETHTOOL_STATS_NUM; i++) {
- memcpy(data, et_stats[i].desc, ETH_GSTRING_LEN);
- data += ETH_GSTRING_LEN;
- }
-+ for (i = 0; i < adapter->num_rx_qs; i++) {
-+ for (j = 0; j < ETHTOOL_RXSTATS_NUM; j++) {
-+ sprintf(data, "rxq%d: %s", i,
-+ et_rx_stats[j].desc);
-+ data += ETH_GSTRING_LEN;
-+ }
-+ }
-+ for (i = 0; i < adapter->num_tx_qs; i++) {
-+ for (j = 0; j < ETHTOOL_TXSTATS_NUM; j++) {
-+ sprintf(data, "txq%d: %s", i,
-+ et_tx_stats[j].desc);
-+ data += ETH_GSTRING_LEN;
-+ }
-+ }
-+ break;
-+ case ETH_SS_TEST:
-+ for (i = 0; i < ETHTOOL_TESTS_NUM; i++) {
-+ memcpy(data, et_self_tests[i], ETH_GSTRING_LEN);
-+ data += ETH_GSTRING_LEN;
-+ }
- break;
- }
- }
-
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 0, 0)
- static int be_get_stats_count(struct net_device *netdev)
- {
-- return ETHTOOL_STATS_NUM;
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+
-+ return ETHTOOL_STATS_NUM + adapter->num_rx_qs * ETHTOOL_RXSTATS_NUM
-+ + adapter->num_tx_qs * ETHTOOL_TXSTATS_NUM;
- }
-+static int
-+be_self_test_count(struct net_device *dev)
-+{
-+ return ETHTOOL_TESTS_NUM;
-+}
-+#else
-+
-+static int be_get_sset_count(struct net_device *netdev, int stringset)
-+{
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+
-+ switch (stringset) {
-+ case ETH_SS_TEST:
-+ return ETHTOOL_TESTS_NUM;
-+ case ETH_SS_STATS:
-+ return ETHTOOL_STATS_NUM +
-+ adapter->num_rx_qs * ETHTOOL_RXSTATS_NUM +
-+ adapter->num_tx_qs * ETHTOOL_TXSTATS_NUM;
-+ default:
-+ return -EINVAL;
-+ }
-+}
-+#endif
-
- static int be_get_settings(struct net_device *netdev, struct ethtool_cmd *ecmd)
- {
-- ecmd->speed = SPEED_10000;
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+ struct be_phy_info phy_info;
-+ u8 mac_speed = 0;
-+ u16 link_speed = 0;
-+ int link_status = LINK_DOWN;
-+ int status;
-+
-+ if ((adapter->link_speed < 0) || (!(netdev->flags & IFF_UP))) {
-+ status = be_cmd_link_status_query(adapter, &link_status,
-+ &mac_speed, &link_speed, 0);
-+
-+ be_link_status_update(adapter, link_status);
-+ /* link_speed is in units of 10 Mbps */
-+ if (link_speed) {
-+ ecmd->speed = link_speed*10;
-+ } else {
-+ switch (mac_speed) {
-+ case PHY_LINK_SPEED_10MBPS:
-+ ecmd->speed = SPEED_10;
-+ break;
-+ case PHY_LINK_SPEED_100MBPS:
-+ ecmd->speed = SPEED_100;
-+ break;
-+ case PHY_LINK_SPEED_1GBPS:
-+ ecmd->speed = SPEED_1000;
-+ break;
-+ case PHY_LINK_SPEED_10GBPS:
-+ ecmd->speed = SPEED_10000;
-+ break;
-+ case PHY_LINK_SPEED_ZERO:
-+ ecmd->speed = 0;
-+ break;
-+ }
-+ }
-+
-+ status = be_cmd_get_phy_info(adapter, &phy_info);
-+ if (!status) {
-+ switch (phy_info.interface_type) {
-+ case PHY_TYPE_XFP_10GB:
-+ case PHY_TYPE_SFP_1GB:
-+ case PHY_TYPE_SFP_PLUS_10GB:
-+ ecmd->port = PORT_FIBRE;
-+ break;
-+ default:
-+ ecmd->port = PORT_TP;
-+ break;
-+ }
-+
-+ switch (phy_info.interface_type) {
-+ case PHY_TYPE_KR_10GB:
-+ case PHY_TYPE_KX4_10GB:
-+ ecmd->transceiver = XCVR_INTERNAL;
-+ break;
-+ default:
-+ ecmd->transceiver = XCVR_EXTERNAL;
-+ break;
-+ }
-+
-+ if (phy_info.auto_speeds_supported) {
-+ ecmd->supported |= SUPPORTED_Autoneg;
-+ ecmd->autoneg = AUTONEG_ENABLE;
-+ ecmd->advertising |= ADVERTISED_Autoneg;
-+ }
-+
-+ if (phy_info.misc_params & BE_PAUSE_SYM_EN) {
-+ ecmd->supported |= SUPPORTED_Pause;
-+ ecmd->advertising |= ADVERTISED_Pause;
-+ }
-+
-+ }
-+
-+ /* Save for future use */
-+ adapter->link_speed = ecmd->speed;
-+ adapter->port_type = ecmd->port;
-+ adapter->transceiver = ecmd->transceiver;
-+ adapter->autoneg = ecmd->autoneg;
-+ } else {
-+ ecmd->speed = adapter->link_speed;
-+ ecmd->port = adapter->port_type;
-+ ecmd->transceiver = adapter->transceiver;
-+ ecmd->autoneg = adapter->autoneg;
-+ }
-+
- ecmd->duplex = DUPLEX_FULL;
-- ecmd->autoneg = AUTONEG_DISABLE;
-+ ecmd->phy_address = (adapter->hba_port_num << 4) |
-+ (adapter->port_name[adapter->hba_port_num]);
-+ switch (ecmd->port) {
-+ case PORT_FIBRE:
-+ ecmd->supported = (SUPPORTED_10000baseT_Full | SUPPORTED_FIBRE);
-+ break;
-+ case PORT_TP:
-+ ecmd->supported = (SUPPORTED_10000baseT_Full | SUPPORTED_TP);
-+ break;
-+ }
-+
-+ if (ecmd->autoneg) {
-+ ecmd->supported |= SUPPORTED_1000baseT_Full;
-+ ecmd->advertising |= (ADVERTISED_10000baseT_Full |
-+ ADVERTISED_1000baseT_Full);
-+ }
-+
- return 0;
- }
-
-+static int be_set_settings(struct net_device *netdev,
-+ struct ethtool_cmd *ecmd)
-+{
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+ struct be_phy_info phy_info;
-+ u16 mac_speed=0;
-+ u16 dac_cable_len=0;
-+ u16 port_speed = 0;
-+ int status;
-+
-+ status = be_cmd_get_phy_info(adapter, &phy_info);
-+ if (status) {
-+ dev_warn(&adapter->pdev->dev, "port speed set failed.\n");
-+ return status;
-+ }
-+
-+ if (ecmd->autoneg == AUTONEG_ENABLE) {
-+ switch(phy_info.interface_type) {
-+ case PHY_TYPE_SFP_1GB:
-+ case PHY_TYPE_BASET_1GB:
-+ case PHY_TYPE_BASEX_1GB:
-+ case PHY_TYPE_SGMII:
-+ mac_speed = SPEED_AUTONEG_1GB_100MB_10MB;
-+ break;
-+ case PHY_TYPE_SFP_PLUS_10GB:
-+ dev_warn(&adapter->pdev->dev,
-+ "Autoneg not supported on this module. \n");
-+ return -EINVAL;
-+ case PHY_TYPE_KR_10GB:
-+ case PHY_TYPE_KX4_10GB:
-+ mac_speed = SPEED_AUTONEG_10GB_1GB;
-+ break;
-+ case PHY_TYPE_BASET_10GB:
-+ mac_speed = SPEED_AUTONEG_10GB_1GB_100MB;
-+ break;
-+ }
-+ } else if(ecmd->autoneg == AUTONEG_DISABLE) {
-+ if(ecmd->speed == SPEED_10) {
-+ mac_speed = SPEED_FORCED_10MB;
-+ } else if(ecmd->speed == SPEED_100) {
-+ mac_speed = SPEED_FORCED_100MB;
-+ } else if(ecmd->speed == SPEED_1000) {
-+ mac_speed = SPEED_FORCED_1GB;
-+ } else if(ecmd->speed == SPEED_10000) {
-+ mac_speed = SPEED_FORCED_10GB;
-+ }
-+ }
-+
-+ status = be_cmd_get_port_speed(adapter, adapter->hba_port_num,
-+ &dac_cable_len, &port_speed);
-+
-+ if (!status && port_speed != mac_speed)
-+ status = be_cmd_set_port_speed_v1(adapter,
-+ adapter->hba_port_num, mac_speed,
-+ dac_cable_len);
-+ if (status)
-+ dev_warn(&adapter->pdev->dev, "port speed set failed.\n");
-+
-+ return status;
-+
-+}
-+
- static void
- be_get_ringparam(struct net_device *netdev, struct ethtool_ringparam *ring)
- {
- struct be_adapter *adapter = netdev_priv(netdev);
-
-- ring->rx_max_pending = adapter->rx_obj.q.len;
-- ring->tx_max_pending = adapter->tx_obj.q.len;
-+ ring->rx_max_pending = adapter->rx_obj[0].q.len;
-+ ring->tx_max_pending = adapter->tx_obj[0].q.len;
-
-- ring->rx_pending = atomic_read(&adapter->rx_obj.q.used);
-- ring->tx_pending = atomic_read(&adapter->tx_obj.q.used);
-+ ring->rx_pending = atomic_read(&adapter->rx_obj[0].q.used);
-+ ring->tx_pending = atomic_read(&adapter->tx_obj[0].q.used);
- }
-
- static void
-@@ -312,7 +615,7 @@ be_get_pauseparam(struct net_device *netdev, struct ethtool_pauseparam *ecmd)
- struct be_adapter *adapter = netdev_priv(netdev);
-
- be_cmd_get_flow_control(adapter, &ecmd->tx_pause, &ecmd->rx_pause);
-- ecmd->autoneg = 0;
-+ ecmd->autoneg = adapter->autoneg;
- }
-
- static int
-@@ -334,6 +637,203 @@ be_set_pauseparam(struct net_device *netdev, struct ethtool_pauseparam *ecmd)
- return status;
- }
-
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 0, 0)
-+static int
-+be_phys_id(struct net_device *netdev, u32 data)
-+{
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+ int status;
-+ u32 cur;
-+
-+ be_cmd_get_beacon_state(adapter, adapter->hba_port_num, &cur);
-+
-+ if (cur == BEACON_STATE_ENABLED)
-+ return 0;
-+
-+ if (data < 2)
-+ data = 2;
-+
-+ status = be_cmd_set_beacon_state(adapter, adapter->hba_port_num, 0, 0,
-+ BEACON_STATE_ENABLED);
-+ set_current_state(TASK_INTERRUPTIBLE);
-+ schedule_timeout(data*HZ);
-+
-+ status = be_cmd_set_beacon_state(adapter, adapter->hba_port_num, 0, 0,
-+ BEACON_STATE_DISABLED);
-+
-+ return status;
-+}
-+#else
-+static int
-+be_set_phys_id(struct net_device *netdev,
-+ enum ethtool_phys_id_state state)
-+{
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+
-+ switch (state) {
-+ case ETHTOOL_ID_ACTIVE:
-+ be_cmd_get_beacon_state(adapter, adapter->hba_port_num,
-+ &adapter->beacon_state);
-+ return 1; /* cycle on/off once per second */
-+
-+ case ETHTOOL_ID_ON:
-+ be_cmd_set_beacon_state(adapter, adapter->hba_port_num, 0, 0,
-+ BEACON_STATE_ENABLED);
-+ break;
-+
-+ case ETHTOOL_ID_OFF:
-+ be_cmd_set_beacon_state(adapter, adapter->hba_port_num, 0, 0,
-+ BEACON_STATE_DISABLED);
-+ break;
-+
-+ case ETHTOOL_ID_INACTIVE:
-+ be_cmd_set_beacon_state(adapter, adapter->hba_port_num, 0, 0,
-+ adapter->beacon_state);
-+ }
-+
-+ return 0;
-+}
-+#endif
-+
-+static bool
-+be_is_wol_supported(struct be_adapter *adapter)
-+{
-+ struct pci_dev *pdev = adapter->pdev;
-+
-+ if (!be_physfn(adapter))
-+ return false;
-+
-+ switch (pdev->subsystem_device) {
-+ case OC_SUBSYS_DEVICE_ID1:
-+ case OC_SUBSYS_DEVICE_ID2:
-+ case OC_SUBSYS_DEVICE_ID3:
-+ case OC_SUBSYS_DEVICE_ID4:
-+ return false;
-+ default:
-+ return true;
-+ }
-+}
-+
-+static void
-+be_get_wol(struct net_device *netdev, struct ethtool_wolinfo *wol)
-+{
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+
-+ if (be_is_wol_supported(adapter))
-+ wol->supported = WAKE_MAGIC;
-+ if (adapter->wol)
-+ wol->wolopts = WAKE_MAGIC;
-+ else
-+ wol->wolopts = 0;
-+ memset(&wol->sopass, 0, sizeof(wol->sopass));
-+}
-+
-+static int
-+be_set_wol(struct net_device *netdev, struct ethtool_wolinfo *wol)
-+{
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+
-+ if (wol->wolopts & ~WAKE_MAGIC)
-+ return -EOPNOTSUPP;
-+
-+ if (!be_is_wol_supported(adapter)) {
-+ dev_warn(&adapter->pdev->dev,
-+ "WOL not supported for this subsystemid: %x\n",
-+ adapter->pdev->subsystem_device);
-+ return -EOPNOTSUPP;
-+ }
-+
-+ if (wol->wolopts & WAKE_MAGIC)
-+ adapter->wol = true;
-+ else
-+ adapter->wol = false;
-+
-+ return 0;
-+}
-+
-+static int
-+be_test_ddr_dma(struct be_adapter *adapter)
-+{
-+ int ret, i;
-+ struct be_dma_mem ddrdma_cmd;
-+ u64 pattern[2] = {0x5a5a5a5a5a5a5a5aULL, 0xa5a5a5a5a5a5a5a5ULL};
-+
-+ ddrdma_cmd.size = sizeof(struct be_cmd_req_ddrdma_test);
-+ ddrdma_cmd.va = pci_alloc_consistent(adapter->pdev, ddrdma_cmd.size,
-+ &ddrdma_cmd.dma);
-+ if (!ddrdma_cmd.va) {
-+ dev_err(&adapter->pdev->dev, "Memory allocation failure\n");
-+ return -ENOMEM;
-+ }
-+
-+ for (i = 0; i < 2; i++) {
-+ ret = be_cmd_ddr_dma_test(adapter, pattern[i],
-+ 4096, &ddrdma_cmd);
-+ if (ret != 0)
-+ goto err;
-+ }
-+
-+err:
-+ pci_free_consistent(adapter->pdev, ddrdma_cmd.size,
-+ ddrdma_cmd.va, ddrdma_cmd.dma);
-+ return ret;
-+}
-+
-+static u64 be_loopback_test(struct be_adapter *adapter, u8 loopback_type,
-+ u64 *status)
-+{
-+ be_cmd_set_loopback(adapter, adapter->hba_port_num,
-+ loopback_type, 1);
-+ *status = be_cmd_loopback_test(adapter, adapter->hba_port_num,
-+ loopback_type, 1500,
-+ 2, 0xabc);
-+ be_cmd_set_loopback(adapter, adapter->hba_port_num,
-+ BE_NO_LOOPBACK, 1);
-+ return *status;
-+}
-+
-+static void
-+be_self_test(struct net_device *netdev, struct ethtool_test *test, u64 *data)
-+{
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+ int link_status;
-+ u8 mac_speed = 0;
-+ u16 qos_link_speed = 0;
-+
-+ memset(data, 0, sizeof(u64) * ETHTOOL_TESTS_NUM);
-+
-+ if (test->flags & ETH_TEST_FL_OFFLINE) {
-+ if (be_loopback_test(adapter, BE_MAC_LOOPBACK,
-+ &data[0]) != 0) {
-+ test->flags |= ETH_TEST_FL_FAILED;
-+ }
-+ if (be_loopback_test(adapter, BE_PHY_LOOPBACK,
-+ &data[1]) != 0) {
-+ test->flags |= ETH_TEST_FL_FAILED;
-+ }
-+ if (be_loopback_test(adapter, BE_ONE_PORT_EXT_LOOPBACK,
-+ &data[2]) != 0) {
-+ test->flags |= ETH_TEST_FL_FAILED;
-+ }
-+ }
-+
-+ if (be_test_ddr_dma(adapter) != 0) {
-+ data[3] = 1;
-+ test->flags |= ETH_TEST_FL_FAILED;
-+ }
-+
-+ if (be_cmd_link_status_query(adapter, &link_status, &mac_speed,
-+ &qos_link_speed, 0) != 0) {
-+ test->flags |= ETH_TEST_FL_FAILED;
-+ data[4] = -1;
-+ } else if (!mac_speed) {
-+ test->flags |= ETH_TEST_FL_FAILED;
-+ data[4] = 1;
-+ }
-+
-+}
-+
-+#ifdef HAVE_ETHTOOL_FLASH
- static int
- be_do_flash(struct net_device *netdev, struct ethtool_flash *efl)
- {
-@@ -347,11 +847,73 @@ be_do_flash(struct net_device *netdev, struct ethtool_flash *efl)
-
- return be_load_fw(adapter, file_name);
- }
-+#endif
-
--const struct ethtool_ops be_ethtool_ops = {
-+static int
-+be_get_eeprom_len(struct net_device *netdev)
-+{
-+ return BE_READ_SEEPROM_LEN;
-+}
-+
-+static int
-+be_read_eeprom(struct net_device *netdev, struct ethtool_eeprom *eeprom,
-+ uint8_t *data)
-+{
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+ struct be_dma_mem eeprom_cmd;
-+ struct be_cmd_resp_seeprom_read *resp;
-+ int status;
-+
-+ if (!eeprom->len)
-+ return -EINVAL;
-+
-+ eeprom->magic = BE_VENDOR_ID | (adapter->pdev->device<<16);
-+
-+ memset(&eeprom_cmd, 0, sizeof(struct be_dma_mem));
-+ eeprom_cmd.size = sizeof(struct be_cmd_req_seeprom_read);
-+ eeprom_cmd.va = pci_alloc_consistent(adapter->pdev, eeprom_cmd.size,
-+ &eeprom_cmd.dma);
-+
-+ if (!eeprom_cmd.va) {
-+ dev_err(&adapter->pdev->dev,
-+ "Memory allocation failure. Could not read eeprom\n");
-+ return -ENOMEM;
-+ }
-+
-+ status = be_cmd_get_seeprom_data(adapter, &eeprom_cmd);
-+
-+ if (!status) {
-+ resp = (struct be_cmd_resp_seeprom_read *) eeprom_cmd.va;
-+ memcpy(data, resp->seeprom_data + eeprom->offset, eeprom->len);
-+ }
-+ pci_free_consistent(adapter->pdev, eeprom_cmd.size, eeprom_cmd.va,
-+ eeprom_cmd.dma);
-+
-+ return status;
-+}
-+
-+static int be_set_tso(struct net_device *netdev, uint32_t data)
-+{
-+ if (data) {
-+ netdev->features |= NETIF_F_TSO;
-+ netdev->features |= NETIF_F_TSO6;
-+ } else {
-+ netdev->features &= ~NETIF_F_TSO;
-+ netdev->features &= ~NETIF_F_TSO6;
-+ }
-+ return 0;
-+}
-+
-+
-+struct ethtool_ops be_ethtool_ops = {
- .get_settings = be_get_settings,
-+ .set_settings = be_set_settings,
- .get_drvinfo = be_get_drvinfo,
-+ .get_wol = be_get_wol,
-+ .set_wol = be_set_wol,
- .get_link = ethtool_op_get_link,
-+ .get_eeprom_len = be_get_eeprom_len,
-+ .get_eeprom = be_read_eeprom,
- .get_coalesce = be_get_coalesce,
- .set_coalesce = be_set_coalesce,
- .get_ringparam = be_get_ringparam,
-@@ -364,9 +926,21 @@ const struct ethtool_ops be_ethtool_ops = {
- .get_sg = ethtool_op_get_sg,
- .set_sg = ethtool_op_set_sg,
- .get_tso = ethtool_op_get_tso,
-- .set_tso = ethtool_op_set_tso,
-+ .set_tso = be_set_tso,
- .get_strings = be_get_stat_strings,
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 0, 0)
-+ .phys_id = be_phys_id,
- .get_stats_count = be_get_stats_count,
-+ .self_test_count = be_self_test_count,
-+#else
-+ .set_phys_id = be_set_phys_id,
-+ .get_sset_count = be_get_sset_count,
-+#endif
- .get_ethtool_stats = be_get_ethtool_stats,
-+ .get_regs_len = be_get_reg_len,
-+ .get_regs = be_get_regs,
-+#ifdef HAVE_ETHTOOL_FLASH
- .flash_device = be_do_flash,
-+#endif
-+ .self_test = be_self_test
- };
-diff --git a/drivers/net/benet/be_hw.h b/drivers/net/benet/be_hw.h
-index a3394b4..f871d8c 100644
---- a/drivers/net/benet/be_hw.h
-+++ b/drivers/net/benet/be_hw.h
-@@ -1,18 +1,18 @@
- /*
-- * Copyright (C) 2005 - 2009 ServerEngines
-+ * Copyright (C) 2005 - 2011 Emulex
- * All rights reserved.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License version 2
-- * as published by the Free Software Foundation. The full GNU General
-+ * as published by the Free Software Foundation. The full GNU General
- * Public License is included in this distribution in the file called COPYING.
- *
- * Contact Information:
-- * linux-drivers@serverengines.com
-+ * linux-drivers@emulex.com
- *
-- * ServerEngines
-- * 209 N. Fair Oaks Ave
-- * Sunnyvale, CA 94085
-+ * Emulex
-+ * 3333 Susan Street
-+ * Costa Mesa, CA 92626
- */
-
- /********* Mailbox door bell *************/
-@@ -26,24 +26,34 @@
- * queue entry.
- */
- #define MPU_MAILBOX_DB_OFFSET 0x160
--#define MPU_MAILBOX_DB_RDY_MASK 0x1 /* bit 0 */
-+#define MPU_MAILBOX_DB_RDY_MASK 0x1 /* bit 0 */
- #define MPU_MAILBOX_DB_HI_MASK 0x2 /* bit 1 */
-
--#define MPU_EP_CONTROL 0
-+#define MPU_EP_CONTROL 0
-
- /********** MPU semphore ******************/
--#define MPU_EP_SEMAPHORE_OFFSET 0xac
-+#define MPU_EP_SEMAPHORE_OFFSET 0xac
-+#define MPU_EP_SEMAPHORE_IF_TYPE2_OFFSET 0x400
- #define EP_SEMAPHORE_POST_STAGE_MASK 0x0000FFFF
- #define EP_SEMAPHORE_POST_ERR_MASK 0x1
- #define EP_SEMAPHORE_POST_ERR_SHIFT 31
- /* MPU semphore POST stage values */
--#define POST_STAGE_AWAITING_HOST_RDY 0x1 /* FW awaiting goahead from host */
--#define POST_STAGE_HOST_RDY 0x2 /* Host has given go-ahed to FW */
-+#define POST_STAGE_AWAITING_HOST_RDY 0x1 /* FW awaiting goahead from host */
-+#define POST_STAGE_HOST_RDY 0x2 /* Host has given go-ahed to FW */
- #define POST_STAGE_BE_RESET 0x3 /* Host wants to reset chip */
- #define POST_STAGE_ARMFW_RDY 0xc000 /* FW is done with POST */
-
-+/* Lancer SLIPORT_CONTROL SLIPORT_STATUS registers */
-+#define SLIPORT_STATUS_OFFSET 0x404
-+#define SLIPORT_CONTROL_OFFSET 0x408
-+
-+#define SLIPORT_STATUS_ERR_MASK 0x80000000
-+#define SLIPORT_STATUS_RN_MASK 0x01000000
-+#define SLIPORT_STATUS_RDY_MASK 0x00800000
-+#define SLI_PORT_CONTROL_IP_MASK 0x08000000
-+
- /********* Memory BAR register ************/
--#define PCICFG_MEMBAR_CTRL_INT_CTRL_OFFSET 0xfc
-+#define PCICFG_MEMBAR_CTRL_INT_CTRL_OFFSET 0xfc
- /* Host Interrupt Enable, if set interrupts are enabled although "PCI Interrupt
- * Disable" may still globally block interrupts in addition to individual
- * interrupt masks; a mechanism for the device driver to block all interrupts
-@@ -52,13 +62,70 @@
- */
- #define MEMBAR_CTRL_INT_CTRL_HOSTINTR_MASK (1 << 29) /* bit 29 */
-
-+/********* Link Status CSR ****************/
-+#define PCICFG_PCIE_LINK_STATUS_OFFSET 0xd0
-+#define PCIE_LINK_STATUS_SPEED_MASK 0xFF /* bits 16 - 19 */
-+#define PCIE_LINK_STATUS_SPEED_SHIFT 16
-+#define PCIE_LINK_STATUS_NEG_WIDTH_MASK 0x3F /* bits 20 - 25 */
-+#define PCIE_LINK_STATUS_NEG_WIDTH_SHIFT 20
-+
-+/********* Link Capability CSR ************/
-+#define PCICFG_PCIE_LINK_CAP_OFFSET 0xcc
-+#define PCIE_LINK_CAP_MAX_SPEED_MASK 0xFF /* bits 0 - 3 */
-+#define PCIE_LINK_CAP_MAX_SPEED_SHIFT 0
-+#define PCIE_LINK_CAP_MAX_WIDTH_MASK 0x3F /* bits 4 - 9 */
-+#define PCIE_LINK_CAP_MAX_WIDTH_SHIFT 4
-+
-+/********* PCI Function Capability ************/
-+#define BE_FUNCTION_CAPS_UNCLASSIFIED_STATS 0x1
-+#define BE_FUNCTION_CAPS_RSS 0x2
-+#define BE_FUNCTION_CAPS_PROMISCUOUS 0x4
-+#define BE_FUNCTION_CAPS_LEGACY_MODE 0x8
-+
-+/********* Power managment (WOL) **********/
-+#define PCICFG_PM_CONTROL_OFFSET 0x44
-+#define PCICFG_PM_CONTROL_MASK 0x108 /* bits 3 & 8 */
-+
-+/********* Online Control Registers *******/
-+#define PCICFG_ONLINE0 0xB0
-+#define PCICFG_ONLINE1 0xB4
-+
-+/********* UE Status and Mask Registers ***/
-+#define PCICFG_UE_STATUS_LOW 0xA0
-+#define PCICFG_UE_STATUS_HIGH 0xA4
-+#define PCICFG_UE_STATUS_LOW_MASK 0xA8
-+#define PCICFG_UE_STATUS_HI_MASK 0xAC
-+
-+/******** SLI_INTF ***********************/
-+#define SLI_INTF_REG_OFFSET 0x58
-+#define SLI_INTF_VALID_MASK 0xE0000000
-+#define SLI_INTF_VALID 0xC0000000
-+#define SLI_INTF_HINT2_MASK 0x1F000000
-+#define SLI_INTF_HINT2_SHIFT 24
-+#define SLI_INTF_HINT1_MASK 0x00FF0000
-+#define SLI_INTF_HINT1_SHIFT 16
-+#define SLI_INTF_FAMILY_MASK 0x00000F00
-+#define SLI_INTF_FAMILY_SHIFT 8
-+#define SLI_INTF_IF_TYPE_MASK 0x0000F000
-+#define SLI_INTF_IF_TYPE_SHIFT 12
-+#define SLI_INTF_REV_MASK 0x000000F0
-+#define SLI_INTF_REV_SHIFT 4
-+#define SLI_INTF_FT_MASK 0x00000001
-+
-+/* SLI family */
-+#define BE_SLI_FAMILY 0x0
-+#define LANCER_A0_SLI_FAMILY 0xA
-+
- /********* ISR0 Register offset **********/
--#define CEV_ISR0_OFFSET 0xC18
-+#define CEV_ISR0_OFFSET 0xC18
- #define CEV_ISR_SIZE 4
-
- /********* Event Q door bell *************/
- #define DB_EQ_OFFSET DB_CQ_OFFSET
- #define DB_EQ_RING_ID_MASK 0x1FF /* bits 0 - 8 */
-+#define DB_EQ_RING_ID_EXT_MASK 0x3e00 /* bits 9-13 */
-+#define DB_EQ_RING_ID_EXT_MASK_SHIFT (2) /* qid bits 9-13 placing at 11-15 */
-+
- /* Clear the interrupt for this eq */
- #define DB_EQ_CLR_SHIFT (9) /* bit 9 */
- /* Must be 1 */
-@@ -69,12 +136,16 @@
- #define DB_EQ_REARM_SHIFT (29) /* bit 29 */
-
- /********* Compl Q door bell *************/
--#define DB_CQ_OFFSET 0x120
-+#define DB_CQ_OFFSET 0x120
- #define DB_CQ_RING_ID_MASK 0x3FF /* bits 0 - 9 */
-+#define DB_CQ_RING_ID_EXT_MASK 0x7C00 /* bits 10-14 */
-+#define DB_CQ_RING_ID_EXT_MASK_SHIFT (1) /* qid bits 10-14
-+ placing at 11-15 */
-+
- /* Number of event entries processed */
--#define DB_CQ_NUM_POPPED_SHIFT (16) /* bits 16 - 28 */
-+#define DB_CQ_NUM_POPPED_SHIFT (16) /* bits 16 - 28 */
- /* Rearm bit */
--#define DB_CQ_REARM_SHIFT (29) /* bit 29 */
-+#define DB_CQ_REARM_SHIFT (29) /* bit 29 */
-
- /********** TX ULP door bell *************/
- #define DB_TXULP1_OFFSET 0x60
-@@ -84,25 +155,103 @@
- #define DB_TXULP_NUM_POSTED_MASK 0x3FFF /* bits 16 - 29 */
-
- /********** RQ(erx) door bell ************/
--#define DB_RQ_OFFSET 0x100
-+#define DB_RQ_OFFSET 0x100
- #define DB_RQ_RING_ID_MASK 0x3FF /* bits 0 - 9 */
- /* Number of rx frags posted */
- #define DB_RQ_NUM_POSTED_SHIFT (24) /* bits 24 - 31 */
-
- /********** MCC door bell ************/
--#define DB_MCCQ_OFFSET 0x140
-+#define DB_MCCQ_OFFSET 0x140
- #define DB_MCCQ_RING_ID_MASK 0x7FF /* bits 0 - 10 */
- /* Number of entries posted */
- #define DB_MCCQ_NUM_POSTED_SHIFT (16) /* bits 16 - 29 */
-
-+/********** SRIOV VF PCICFG OFFSET ********/
-+#define SRIOV_VF_PCICFG_OFFSET (4096)
-+
-+/********** FAT TABLE ********/
-+#define RETRIEVE_FAT 0
-+#define QUERY_FAT 1
-+
-+/* Flashrom related descriptors */
-+#define IMAGE_TYPE_FIRMWARE 160
-+#define IMAGE_TYPE_BOOTCODE 224
-+#define IMAGE_TYPE_OPTIONROM 32
-+
-+#define NUM_FLASHDIR_ENTRIES 32
-+
-+#define IMG_TYPE_ISCSI_ACTIVE 0
-+#define IMG_TYPE_REDBOOT 1
-+#define IMG_TYPE_BIOS 2
-+#define IMG_TYPE_PXE_BIOS 3
-+#define IMG_TYPE_FCOE_BIOS 8
-+#define IMG_TYPE_ISCSI_BACKUP 9
-+#define IMG_TYPE_FCOE_FW_ACTIVE 10
-+#define IMG_TYPE_FCOE_FW_BACKUP 11
-+#define IMG_TYPE_NCSI_FW 13
-+#define IMG_TYPE_PHY_FW 99
-+#define TN_8022 13
-+
-+#define ILLEGAL_IOCTL_REQ 2
-+#define FLASHROM_OPER_PHY_FLASH 9
-+#define FLASHROM_OPER_PHY_SAVE 10
-+#define FLASHROM_OPER_FLASH 1
-+#define FLASHROM_OPER_SAVE 2
-+#define FLASHROM_OPER_REPORT 4
-+
-+#define FLASH_IMAGE_MAX_SIZE_g2 (1310720) /* Max firmware image size */
-+#define FLASH_BIOS_IMAGE_MAX_SIZE_g2 (262144) /* Max OPTION ROM image sz */
-+#define FLASH_REDBOOT_IMAGE_MAX_SIZE_g2 (262144) /* Max Redboot image sz */
-+#define FLASH_IMAGE_MAX_SIZE_g3 (2097152) /* Max firmware image size */
-+#define FLASH_BIOS_IMAGE_MAX_SIZE_g3 (524288) /* Max OPTION ROM image sz */
-+#define FLASH_REDBOOT_IMAGE_MAX_SIZE_g3 (1048576) /* Max Redboot image sz */
-+#define FLASH_NCSI_IMAGE_MAX_SIZE_g3 (262144)
-+#define FLASH_PHY_FW_IMAGE_MAX_SIZE_g3 (262144)
-+
-+#define FLASH_NCSI_MAGIC (0x16032009)
-+#define FLASH_NCSI_DISABLED (0)
-+#define FLASH_NCSI_ENABLED (1)
-+
-+#define FLASH_NCSI_BITFILE_HDR_OFFSET (0x600000)
-+
-+/* Offsets for components on Flash. */
-+#define FLASH_iSCSI_PRIMARY_IMAGE_START_g2 (1048576)
-+#define FLASH_iSCSI_BACKUP_IMAGE_START_g2 (2359296)
-+#define FLASH_FCoE_PRIMARY_IMAGE_START_g2 (3670016)
-+#define FLASH_FCoE_BACKUP_IMAGE_START_g2 (4980736)
-+#define FLASH_iSCSI_BIOS_START_g2 (7340032)
-+#define FLASH_PXE_BIOS_START_g2 (7864320)
-+#define FLASH_FCoE_BIOS_START_g2 (524288)
-+#define FLASH_REDBOOT_START_g2 (0)
-+
-+#define FLASH_NCSI_START_g3 (15990784)
-+#define FLASH_iSCSI_PRIMARY_IMAGE_START_g3 (2097152)
-+#define FLASH_iSCSI_BACKUP_IMAGE_START_g3 (4194304)
-+#define FLASH_FCoE_PRIMARY_IMAGE_START_g3 (6291456)
-+#define FLASH_FCoE_BACKUP_IMAGE_START_g3 (8388608)
-+#define FLASH_iSCSI_BIOS_START_g3 (12582912)
-+#define FLASH_PXE_BIOS_START_g3 (13107200)
-+#define FLASH_FCoE_BIOS_START_g3 (13631488)
-+#define FLASH_REDBOOT_START_g3 (262144)
-+#define FLASH_PHY_FW_START_g3 (1310720)
-+
-+/************* Rx Packet Type Encoding **************/
-+#define BE_UNICAST_PACKET 0
-+#define BE_MULTICAST_PACKET 1
-+#define BE_BROADCAST_PACKET 2
-+#define BE_RSVD_PACKET 3
-+
- /*
- * BE descriptors: host memory data structures whose formats
- * are hardwired in BE silicon.
- */
- /* Event Queue Descriptor */
--#define EQ_ENTRY_VALID_MASK 0x1 /* bit 0 */
--#define EQ_ENTRY_RES_ID_MASK 0xFFFF /* bits 16 - 31 */
--#define EQ_ENTRY_RES_ID_SHIFT 16
-+#define EQ_ENTRY_VALID_MASK 0x1 /* bit 0 */
-+#define EQ_ENTRY_RES_ID_MASK 0xFFFF /* bits 16 - 31 */
-+#define EQ_ENTRY_RES_ID_SHIFT 16
-+
-+#define BE_MAC_PROMISCUOUS 62 /* Promiscuous mode */
-+
- struct be_eq_entry {
- u32 evt;
- };
-@@ -126,7 +275,7 @@ struct amap_eth_hdr_wrb {
- u8 event;
- u8 crc;
- u8 forward;
-- u8 ipsec;
-+ u8 lso6;
- u8 mgmt;
- u8 ipcs;
- u8 udpcs;
-@@ -151,7 +300,7 @@ struct be_eth_hdr_wrb {
- * offset/shift/mask of each field */
- struct amap_eth_tx_compl {
- u8 wrb_index[16]; /* dword 0 */
-- u8 ct[2]; /* dword 0 */
-+ u8 ct[2]; /* dword 0 */
- u8 port[2]; /* dword 0 */
- u8 rsvd0[8]; /* dword 0 */
- u8 status[4]; /* dword 0 */
-@@ -179,10 +328,10 @@ struct be_eth_rx_d {
-
- /* RX Compl Queue Descriptor */
-
--/* Pseudo amap definition for eth_rx_compl in which each bit of the
-- * actual structure is defined as a byte: used to calculate
-+/* Pseudo amap definition for BE2 and BE3 legacy mode eth_rx_compl in which
-+ * each bit of the actual structure is defined as a byte: used to calculate
- * offset/shift/mask of each field */
--struct amap_eth_rx_compl {
-+struct amap_eth_rx_compl_v0 {
- u8 vlan_tag[16]; /* dword 0 */
- u8 pktsize[14]; /* dword 0 */
- u8 port; /* dword 0 */
-@@ -213,39 +362,91 @@ struct amap_eth_rx_compl {
- u8 rsshash[32]; /* dword 3 */
- } __packed;
-
-+/* Pseudo amap definition for BE3 native mode eth_rx_compl in which
-+ * each bit of the actual structure is defined as a byte: used to calculate
-+ * offset/shift/mask of each field */
-+struct amap_eth_rx_compl_v1 {
-+ u8 vlan_tag[16]; /* dword 0 */
-+ u8 pktsize[14]; /* dword 0 */
-+ u8 vtp; /* dword 0 */
-+ u8 ip_opt; /* dword 0 */
-+ u8 err; /* dword 1 */
-+ u8 rsshp; /* dword 1 */
-+ u8 ipf; /* dword 1 */
-+ u8 tcpf; /* dword 1 */
-+ u8 udpf; /* dword 1 */
-+ u8 ipcksm; /* dword 1 */
-+ u8 l4_cksm; /* dword 1 */
-+ u8 ip_version; /* dword 1 */
-+ u8 macdst[7]; /* dword 1 */
-+ u8 rsvd0; /* dword 1 */
-+ u8 fragndx[10]; /* dword 1 */
-+ u8 ct[2]; /* dword 1 */
-+ u8 sw; /* dword 1 */
-+ u8 numfrags[3]; /* dword 1 */
-+ u8 rss_flush; /* dword 2 */
-+ u8 cast_enc[2]; /* dword 2 */
-+ u8 vtm; /* dword 2 */
-+ u8 rss_bank; /* dword 2 */
-+ u8 port[2]; /* dword 2 */
-+ u8 vntagp; /* dword 2 */
-+ u8 header_len[8]; /* dword 2 */
-+ u8 header_split[2]; /* dword 2 */
-+ u8 rsvd1[13]; /* dword 2 */
-+ u8 valid; /* dword 2 */
-+ u8 rsshash[32]; /* dword 3 */
-+} __packed;
-+
- struct be_eth_rx_compl {
- u32 dw[4];
- };
-
--/* Flashrom related descriptors */
--#define IMAGE_TYPE_FIRMWARE 160
--#define IMAGE_TYPE_BOOTCODE 224
--#define IMAGE_TYPE_OPTIONROM 32
-+struct mgmt_hba_attribs {
-+ u8 flashrom_version_string[32];
-+ u8 manufacturer_name[32];
-+ u32 supported_modes;
-+ u32 rsvd0[3];
-+ u8 ncsi_ver_string[12];
-+ u32 default_extended_timeout;
-+ u8 controller_model_number[32];
-+ u8 controller_description[64];
-+ u8 controller_serial_number[32];
-+ u8 ip_version_string[32];
-+ u8 firmware_version_string[32];
-+ u8 bios_version_string[32];
-+ u8 redboot_version_string[32];
-+ u8 driver_version_string[32];
-+ u8 fw_on_flash_version_string[32];
-+ u32 functionalities_supported;
-+ u16 max_cdblength;
-+ u8 asic_revision;
-+ u8 generational_guid[16];
-+ u8 hba_port_count;
-+ u16 default_link_down_timeout;
-+ u8 iscsi_ver_min_max;
-+ u8 multifunction_device;
-+ u8 cache_valid;
-+ u8 hba_status;
-+ u8 max_domains_supported;
-+ u8 phy_port;
-+ u32 firmware_post_status;
-+ u32 hba_mtu[8];
-+ u32 rsvd1[4];
-+};
-
--#define NUM_FLASHDIR_ENTRIES 32
--
--#define FLASHROM_TYPE_ISCSI_ACTIVE 0
--#define FLASHROM_TYPE_BIOS 2
--#define FLASHROM_TYPE_PXE_BIOS 3
--#define FLASHROM_TYPE_FCOE_BIOS 8
--#define FLASHROM_TYPE_ISCSI_BACKUP 9
--#define FLASHROM_TYPE_FCOE_FW_ACTIVE 10
--#define FLASHROM_TYPE_FCOE_FW_BACKUP 11
--
--#define FLASHROM_OPER_FLASH 1
--#define FLASHROM_OPER_SAVE 2
--
--#define FLASH_IMAGE_MAX_SIZE (1310720) /* Max firmware image size */
--#define FLASH_BIOS_IMAGE_MAX_SIZE (262144) /* Max OPTION ROM image sz */
--
--/* Offsets for components on Flash. */
--#define FLASH_iSCSI_PRIMARY_IMAGE_START (1048576)
--#define FLASH_iSCSI_BACKUP_IMAGE_START (2359296)
--#define FLASH_FCoE_PRIMARY_IMAGE_START (3670016)
--#define FLASH_FCoE_BACKUP_IMAGE_START (4980736)
--#define FLASH_iSCSI_BIOS_START (7340032)
--#define FLASH_PXE_BIOS_START (7864320)
--#define FLASH_FCoE_BIOS_START (524288)
-+struct mgmt_controller_attrib {
-+ struct mgmt_hba_attribs hba_attribs;
-+ u16 pci_vendor_id;
-+ u16 pci_device_id;
-+ u16 pci_sub_vendor_id;
-+ u16 pci_sub_system_id;
-+ u8 pci_bus_number;
-+ u8 pci_device_number;
-+ u8 pci_function_number;
-+ u8 interface_type;
-+ u64 unique_identifier;
-+ u32 rsvd0[5];
-+};
-
- struct controller_id {
- u32 vendor;
-@@ -254,7 +455,20 @@ struct controller_id {
- u32 subdevice;
- };
-
--struct flash_file_hdr {
-+struct flash_comp {
-+ unsigned long offset;
-+ int optype;
-+ int size;
-+};
-+
-+struct image_hdr {
-+ u32 imageid;
-+ u32 imageoffset;
-+ u32 imagelength;
-+ u32 image_checksum;
-+ u8 image_version[32];
-+};
-+struct flash_file_hdr_g2 {
- u8 sign[32];
- u32 cksum;
- u32 antidote;
-@@ -266,6 +480,17 @@ struct flash_file_hdr {
- u8 build[24];
- };
-
-+struct flash_file_hdr_g3 {
-+ u8 sign[52];
-+ u8 ufi_version[4];
-+ u32 file_len;
-+ u32 cksum;
-+ u32 antidote;
-+ u32 num_imgs;
-+ u8 build[24];
-+ u8 rsvd[32];
-+};
-+
- struct flash_section_hdr {
- u32 format_rev;
- u32 cksum;
-@@ -299,3 +524,19 @@ struct flash_section_info {
- struct flash_section_hdr fsec_hdr;
- struct flash_section_entry fsec_entry[32];
- };
-+
-+struct flash_ncsi_image_hdr {
-+ u32 magic;
-+ u8 hdr_len;
-+ u8 type;
-+ u16 hdr_ver;
-+ u8 rsvd0[2];
-+ u16 load_offset;
-+ u32 len;
-+ u32 flash_offset;
-+ u8 ver[16];
-+ u8 name[24];
-+ u32 img_cksum;
-+ u8 rsvd1[4];
-+ u32 hdr_cksum;
-+};
-diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
-index 000e377..709dc47 100644
---- a/drivers/net/benet/be_main.c
-+++ b/drivers/net/benet/be_main.c
-@@ -1,18 +1,18 @@
- /*
-- * Copyright (C) 2005 - 2009 ServerEngines
-+ * Copyright (C) 2005 - 2011 Emulex
- * All rights reserved.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License version 2
-- * as published by the Free Software Foundation. The full GNU General
-+ * as published by the Free Software Foundation. The full GNU General
- * Public License is included in this distribution in the file called COPYING.
- *
- * Contact Information:
-- * linux-drivers@serverengines.com
-+ * linux-drivers@emulex.com
- *
-- * ServerEngines
-- * 209 N. Fair Oaks Ave
-- * Sunnyvale, CA 94085
-+ * Emulex
-+ * 3333 Susan Street
-+ * Costa Mesa, CA 92626
- */
-
- #include "be.h"
-@@ -22,23 +22,119 @@
- MODULE_VERSION(DRV_VER);
- MODULE_DEVICE_TABLE(pci, be_dev_ids);
- MODULE_DESCRIPTION(DRV_DESC " " DRV_VER);
--MODULE_AUTHOR("ServerEngines Corporation");
-+MODULE_AUTHOR("Emulex Corporation");
- MODULE_LICENSE("GPL");
-+MODULE_INFO(supported, "external");
-
--static unsigned int rx_frag_size = 2048;
--module_param(rx_frag_size, uint, S_IRUGO);
--MODULE_PARM_DESC(rx_frag_size, "Size of a fragment that holds rcvd data.");
-+static ushort rx_frag_size = 2048;
-+static unsigned int num_vfs;
-+static unsigned int msix = 1;
-+module_param(rx_frag_size, ushort, S_IRUGO);
-+module_param(num_vfs, uint, S_IRUGO);
-+module_param(msix, uint, S_IRUGO);
-+MODULE_PARM_DESC(rx_frag_size, "Size of receive fragment buffer"
-+ " - 2048 (default), 4096 or 8192");
-+MODULE_PARM_DESC(num_vfs, "Number of PCI VFs to initialize");
-+MODULE_PARM_DESC(msix, "Enable and disable the MSI"
-+ "x (By default MSIx is enabled)");
-+static unsigned int gro = 1;
-+module_param(gro, uint, S_IRUGO);
-+MODULE_PARM_DESC(gro, "Enable or Disable GRO. Enabled by default");
-+
-+static unsigned int multi_rxq = true;
-+module_param(multi_rxq, uint, S_IRUGO);
-+MODULE_PARM_DESC(multi_rxq, "Multi Rx Queue support. Enabled by default");
-
- static DEFINE_PCI_DEVICE_TABLE(be_dev_ids) = {
- { PCI_DEVICE(BE_VENDOR_ID, BE_DEVICE_ID1) },
- { PCI_DEVICE(BE_VENDOR_ID, BE_DEVICE_ID2) },
- { PCI_DEVICE(BE_VENDOR_ID, OC_DEVICE_ID1) },
- { PCI_DEVICE(BE_VENDOR_ID, OC_DEVICE_ID2) },
-- { PCI_DEVICE(BE_VENDOR_ID, OC_DEVICE_ID3) },
-+ /*
-+ * Lancer is not part of Palau 4.0
-+ * { PCI_DEVICE(EMULEX_VENDOR_ID, OC_DEVICE_ID3)},
-+ */
- { 0 }
- };
- MODULE_DEVICE_TABLE(pci, be_dev_ids);
-
-+/* UE Status Low CSR */
-+static char *ue_status_low_desc[] = {
-+ "CEV",
-+ "CTX",
-+ "DBUF",
-+ "ERX",
-+ "Host",
-+ "MPU",
-+ "NDMA",
-+ "PTC ",
-+ "RDMA ",
-+ "RXF ",
-+ "RXIPS ",
-+ "RXULP0 ",
-+ "RXULP1 ",
-+ "RXULP2 ",
-+ "TIM ",
-+ "TPOST ",
-+ "TPRE ",
-+ "TXIPS ",
-+ "TXULP0 ",
-+ "TXULP1 ",
-+ "UC ",
-+ "WDMA ",
-+ "TXULP2 ",
-+ "HOST1 ",
-+ "P0_OB_LINK ",
-+ "P1_OB_LINK ",
-+ "HOST_GPIO ",
-+ "MBOX ",
-+ "AXGMAC0",
-+ "AXGMAC1",
-+ "JTAG",
-+ "MPU_INTPEND"
-+};
-+
-+/* UE Status High CSR */
-+static char *ue_status_hi_desc[] = {
-+ "LPCMEMHOST",
-+ "MGMT_MAC",
-+ "PCS0ONLINE",
-+ "MPU_IRAM",
-+ "PCS1ONLINE",
-+ "PCTL0",
-+ "PCTL1",
-+ "PMEM",
-+ "RR",
-+ "TXPB",
-+ "RXPP",
-+ "XAUI",
-+ "TXP",
-+ "ARM",
-+ "IPC",
-+ "HOST2",
-+ "HOST3",
-+ "HOST4",
-+ "HOST5",
-+ "HOST6",
-+ "HOST7",
-+ "HOST8",
-+ "HOST9",
-+ "NETC",
-+ "Unknown",
-+ "Unknown",
-+ "Unknown",
-+ "Unknown",
-+ "Unknown",
-+ "Unknown",
-+ "Unknown",
-+ "Unknown"
-+};
-+
-+static inline bool be_multi_rxq(struct be_adapter *adapter)
-+{
-+ return (adapter->num_rx_qs > 1);
-+}
-+
- static void be_queue_free(struct be_adapter *adapter, struct be_queue_info *q)
- {
- struct be_dma_mem *mem = &q->dma_mem;
-@@ -69,6 +165,9 @@ static void be_intr_set(struct be_adapter *adapter, bool enable)
- u32 reg = ioread32(addr);
- u32 enabled = reg & MEMBAR_CTRL_INT_CTRL_HOSTINTR_MASK;
-
-+ if (adapter->eeh_err)
-+ return;
-+
- if (!enabled && enable)
- reg |= MEMBAR_CTRL_INT_CTRL_HOSTINTR_MASK;
- else if (enabled && !enable)
-@@ -84,6 +183,8 @@ static void be_rxq_notify(struct be_adapter *adapter, u16 qid, u16 posted)
- u32 val = 0;
- val |= qid & DB_RQ_RING_ID_MASK;
- val |= posted << DB_RQ_NUM_POSTED_SHIFT;
-+
-+ wmb();
- iowrite32(val, adapter->db + DB_RQ_OFFSET);
- }
-
-@@ -92,6 +193,8 @@ static void be_txq_notify(struct be_adapter *adapter, u16 qid, u16 posted)
- u32 val = 0;
- val |= qid & DB_TXULP_RING_ID_MASK;
- val |= (posted & DB_TXULP_NUM_POSTED_MASK) << DB_TXULP_NUM_POSTED_SHIFT;
-+
-+ wmb();
- iowrite32(val, adapter->db + DB_TXULP1_OFFSET);
- }
-
-@@ -100,6 +203,12 @@ static void be_eq_notify(struct be_adapter *adapter, u16 qid,
- {
- u32 val = 0;
- val |= qid & DB_EQ_RING_ID_MASK;
-+ val |= ((qid & DB_EQ_RING_ID_EXT_MASK) <<
-+ DB_EQ_RING_ID_EXT_MASK_SHIFT);
-+
-+ if (adapter->eeh_err)
-+ return;
-+
- if (arm)
- val |= 1 << DB_EQ_REARM_SHIFT;
- if (clear_int)
-@@ -113,6 +222,12 @@ void be_cq_notify(struct be_adapter *adapter, u16 qid, bool arm, u16 num_popped)
- {
- u32 val = 0;
- val |= qid & DB_CQ_RING_ID_MASK;
-+ val |= ((qid & DB_CQ_RING_ID_EXT_MASK) <<
-+ DB_CQ_RING_ID_EXT_MASK_SHIFT);
-+
-+ if (adapter->eeh_err)
-+ return;
-+
- if (arm)
- val |= 1 << DB_CQ_REARM_SHIFT;
- val |= num_popped << DB_CQ_NUM_POPPED_SHIFT;
-@@ -124,96 +239,250 @@ static int be_mac_addr_set(struct net_device *netdev, void *p)
- struct be_adapter *adapter = netdev_priv(netdev);
- struct sockaddr *addr = p;
- int status = 0;
-+ u8 current_mac[ETH_ALEN];
-+ u32 pmac_id = adapter->pmac_id;
-
-- status = be_cmd_pmac_del(adapter, adapter->if_handle, adapter->pmac_id);
-+ if (!is_valid_ether_addr(addr->sa_data))
-+ return -EADDRNOTAVAIL;
-+
-+ status = be_cmd_mac_addr_query(adapter, current_mac,
-+ MAC_ADDRESS_TYPE_NETWORK, false,
-+ adapter->if_handle);
- if (status)
-- return status;
-+ goto err;
-+
-+ if (!memcmp(addr->sa_data, current_mac, ETH_ALEN))
-+ goto done;
-
- status = be_cmd_pmac_add(adapter, (u8 *)addr->sa_data,
-- adapter->if_handle, &adapter->pmac_id);
-- if (!status)
-+ adapter->if_handle, &adapter->pmac_id, 0);
-+
-+ if (!status) {
-+ status = be_cmd_pmac_del(adapter, adapter->if_handle,
-+ pmac_id, 0);
- memcpy(netdev->dev_addr, addr->sa_data, netdev->addr_len);
-+ goto done;
-+ }
-
-- return status;
-+err:
-+ if (status == MCC_STATUS_UNAUTHORIZED_REQUEST)
-+ return -EPERM;
-+ else
-+ dev_err(&adapter->pdev->dev, "MAC %pM set Failed\n",
-+ addr->sa_data);
-+done:
-+ return status;
-+}
-+
-+static void populate_be2_stats(struct be_adapter *adapter)
-+{
-+
-+ struct be_drv_stats *drvs = &adapter->drv_stats;
-+ struct be_pmem_stats *pmem_sts = be_pmem_stats_from_cmd(adapter);
-+ struct be_port_rxf_stats_v0 *port_stats =
-+ be_port_rxf_stats_from_cmd(adapter);
-+ struct be_rxf_stats_v0 *rxf_stats =
-+ be_rxf_stats_from_cmd(adapter);
-+
-+ drvs->rx_pause_frames = port_stats->rx_pause_frames;
-+ drvs->rx_crc_errors = port_stats->rx_crc_errors;
-+ drvs->rx_control_frames = port_stats->rx_control_frames;
-+ drvs->rx_in_range_errors = port_stats->rx_in_range_errors;
-+ drvs->rx_frame_too_long = port_stats->rx_frame_too_long;
-+ drvs->rx_dropped_runt = port_stats->rx_dropped_runt;
-+ drvs->rx_ip_checksum_errs = port_stats->rx_ip_checksum_errs;
-+ drvs->rx_tcp_checksum_errs = port_stats->rx_tcp_checksum_errs;
-+ drvs->rx_udp_checksum_errs = port_stats->rx_udp_checksum_errs;
-+ drvs->rxpp_fifo_overflow_drop = port_stats->rx_fifo_overflow;
-+ drvs->rx_dropped_tcp_length = port_stats->rx_dropped_tcp_length;
-+ drvs->rx_dropped_too_small = port_stats->rx_dropped_too_small;
-+ drvs->rx_dropped_too_short = port_stats->rx_dropped_too_short;
-+ drvs->rx_out_range_errors = port_stats->rx_out_range_errors;
-+ drvs->rx_input_fifo_overflow_drop =
-+ port_stats->rx_input_fifo_overflow;
-+ drvs->rx_dropped_header_too_small =
-+ port_stats->rx_dropped_header_too_small;
-+ drvs->rx_address_match_errors =
-+ port_stats->rx_address_match_errors;
-+ drvs->rx_alignment_symbol_errors =
-+ port_stats->rx_alignment_symbol_errors;
-+
-+ drvs->tx_pauseframes = port_stats->tx_pauseframes;
-+ drvs->tx_controlframes = port_stats->tx_controlframes;
-+
-+ if (adapter->port_num)
-+ drvs->jabber_events =
-+ rxf_stats->port1_jabber_events;
-+ else
-+ drvs->jabber_events =
-+ rxf_stats->port0_jabber_events;
-+ drvs->rx_drops_no_pbuf = rxf_stats->rx_drops_no_pbuf;
-+ drvs->rx_drops_no_txpb = rxf_stats->rx_drops_no_txpb;
-+ drvs->rx_drops_no_erx_descr = rxf_stats->rx_drops_no_erx_descr;
-+ drvs->rx_drops_invalid_ring = rxf_stats->rx_drops_invalid_ring;
-+ drvs->forwarded_packets = rxf_stats->forwarded_packets;
-+ drvs->rx_drops_mtu = rxf_stats->rx_drops_mtu;
-+ drvs->rx_drops_no_tpre_descr =
-+ rxf_stats->rx_drops_no_tpre_descr;
-+ drvs->rx_drops_too_many_frags =
-+ rxf_stats->rx_drops_too_many_frags;
-+ adapter->drv_stats.eth_red_drops = pmem_sts->eth_red_drops;
-+}
-+
-+static void populate_be3_stats(struct be_adapter *adapter)
-+{
-+ struct be_drv_stats *drvs = &adapter->drv_stats;
-+ struct be_pmem_stats *pmem_sts = be_pmem_stats_from_cmd(adapter);
-+
-+ struct be_rxf_stats_v1 *rxf_stats =
-+ be_rxf_stats_from_cmd(adapter);
-+ struct be_port_rxf_stats_v1 *port_stats =
-+ be_port_rxf_stats_from_cmd(adapter);
-+
-+ drvs->pmem_fifo_overflow_drop = port_stats->pmem_fifo_overflow_drop;
-+ drvs->rx_priority_pause_frames = port_stats->rx_priority_pause_frames;
-+ drvs->rx_pause_frames = port_stats->rx_pause_frames;
-+ drvs->rx_crc_errors = port_stats->rx_crc_errors;
-+ drvs->rx_control_frames = port_stats->rx_control_frames;
-+ drvs->rx_in_range_errors = port_stats->rx_in_range_errors;
-+ drvs->rx_frame_too_long = port_stats->rx_frame_too_long;
-+ drvs->rx_dropped_runt = port_stats->rx_dropped_runt;
-+ drvs->rx_ip_checksum_errs = port_stats->rx_ip_checksum_errs;
-+ drvs->rx_tcp_checksum_errs = port_stats->rx_tcp_checksum_errs;
-+ drvs->rx_udp_checksum_errs = port_stats->rx_udp_checksum_errs;
-+ drvs->rx_dropped_tcp_length = port_stats->rx_dropped_tcp_length;
-+ drvs->rx_dropped_too_small = port_stats->rx_dropped_too_small;
-+ drvs->rx_dropped_too_short = port_stats->rx_dropped_too_short;
-+ drvs->rx_out_range_errors = port_stats->rx_out_range_errors;
-+ drvs->rx_dropped_header_too_small =
-+ port_stats->rx_dropped_header_too_small;
-+ drvs->rx_input_fifo_overflow_drop =
-+ port_stats->rx_input_fifo_overflow_drop;
-+ drvs->rx_address_match_errors =
-+ port_stats->rx_address_match_errors;
-+ drvs->rx_alignment_symbol_errors =
-+ port_stats->rx_alignment_symbol_errors;
-+ drvs->rxpp_fifo_overflow_drop =
-+ port_stats->rxpp_fifo_overflow_drop;
-+ drvs->tx_pauseframes = port_stats->tx_pauseframes;
-+ drvs->tx_controlframes = port_stats->tx_controlframes;
-+ drvs->jabber_events = port_stats->jabber_events;
-+ drvs->rx_drops_no_pbuf = rxf_stats->rx_drops_no_pbuf;
-+ drvs->rx_drops_no_txpb = rxf_stats->rx_drops_no_txpb;
-+ drvs->rx_drops_no_erx_descr = rxf_stats->rx_drops_no_erx_descr;
-+ drvs->rx_drops_invalid_ring = rxf_stats->rx_drops_invalid_ring;
-+ drvs->forwarded_packets = rxf_stats->forwarded_packets;
-+ drvs->rx_drops_mtu = rxf_stats->rx_drops_mtu;
-+ drvs->rx_drops_no_tpre_descr =
-+ rxf_stats->rx_drops_no_tpre_descr;
-+ drvs->rx_drops_too_many_frags =
-+ rxf_stats->rx_drops_too_many_frags;
-+ adapter->drv_stats.eth_red_drops = pmem_sts->eth_red_drops;
-+}
-+
-+
-+static void accumulate_16bit_val(u32 *acc, u16 val)
-+{
-+#define lo(x) (x & 0xFFFF)
-+#define hi(x) (x & 0xFFFF0000)
-+ bool wrapped = val < lo(*acc);
-+ u32 newacc = hi(*acc) + val;
-+
-+ if (wrapped)
-+ newacc += 65536;
-+ ACCESS_ONCE_RW(*acc) = newacc;
-+}
-+
-+void be_parse_stats(struct be_adapter *adapter)
-+{
-+ struct be_erx_stats_v1 *erx = be_erx_stats_from_cmd(adapter);
-+ struct be_rx_obj *rxo;
-+ int i;
-+
-+ if (adapter->generation == BE_GEN3) {
-+ populate_be3_stats(adapter);
-+ } else {
-+ populate_be2_stats(adapter);
-+ }
-+
-+ /* as erx_v1 is longer than v0, ok to use v1 defn for v0 access */
-+ for_all_rx_queues(adapter, rxo, i) {
-+ /* below erx HW counter can actually wrap around after
-+ * 65535. Driver accumulates a 32-bit value
-+ */
-+ accumulate_16bit_val(&rx_stats(rxo)->rx_drops_no_frags,
-+ (u16)erx->rx_drops_no_fragments[rxo->q.id]);
-+ }
- }
-
- void netdev_stats_update(struct be_adapter *adapter)
- {
-- struct be_hw_stats *hw_stats = hw_stats_from_cmd(adapter->stats.cmd.va);
-- struct be_rxf_stats *rxf_stats = &hw_stats->rxf;
-- struct be_port_rxf_stats *port_stats =
-- &rxf_stats->port[adapter->port_num];
-- struct net_device_stats *dev_stats = &adapter->stats.net_stats;
-- struct be_erx_stats *erx_stats = &hw_stats->erx;
-+ struct be_drv_stats *drvs = &adapter->drv_stats;
-+ struct net_device_stats *dev_stats = &adapter->net_stats;
-+ struct be_rx_obj *rxo;
-+ struct be_tx_obj *txo;
-+ unsigned long pkts = 0, bytes = 0, mcast = 0, drops = 0;
-+ int i;
-
-- dev_stats->rx_packets = drvr_stats(adapter)->be_rx_pkts;
-- dev_stats->tx_packets = drvr_stats(adapter)->be_tx_pkts;
-- dev_stats->rx_bytes = drvr_stats(adapter)->be_rx_bytes;
-- dev_stats->tx_bytes = drvr_stats(adapter)->be_tx_bytes;
-+ for_all_rx_queues(adapter, rxo, i) {
-+ pkts += rx_stats(rxo)->rx_pkts;
-+ bytes += rx_stats(rxo)->rx_bytes;
-+ mcast += rx_stats(rxo)->rx_mcast_pkts;
-+ drops += rx_stats(rxo)->rx_drops_no_frags;
-+ }
-+ dev_stats->rx_packets = pkts;
-+ dev_stats->rx_bytes = bytes;
-+ dev_stats->multicast = mcast;
-+ dev_stats->rx_dropped = drops;
-+
-+ pkts = bytes = 0;
-+ for_all_tx_queues(adapter, txo, i) {
-+ pkts += tx_stats(txo)->be_tx_pkts;
-+ bytes += tx_stats(txo)->be_tx_bytes;
-+ }
-+ dev_stats->tx_packets = pkts;
-+ dev_stats->tx_bytes = bytes;
-
- /* bad pkts received */
-- dev_stats->rx_errors = port_stats->rx_crc_errors +
-- port_stats->rx_alignment_symbol_errors +
-- port_stats->rx_in_range_errors +
-- port_stats->rx_out_range_errors +
-- port_stats->rx_frame_too_long +
-- port_stats->rx_dropped_too_small +
-- port_stats->rx_dropped_too_short +
-- port_stats->rx_dropped_header_too_small +
-- port_stats->rx_dropped_tcp_length +
-- port_stats->rx_dropped_runt +
-- port_stats->rx_tcp_checksum_errs +
-- port_stats->rx_ip_checksum_errs +
-- port_stats->rx_udp_checksum_errs;
--
-- /* no space in linux buffers: best possible approximation */
-- dev_stats->rx_dropped = erx_stats->rx_drops_no_fragments[0];
-+ dev_stats->rx_errors = drvs->rx_crc_errors +
-+ drvs->rx_alignment_symbol_errors +
-+ drvs->rx_in_range_errors +
-+ drvs->rx_out_range_errors +
-+ drvs->rx_frame_too_long +
-+ drvs->rx_dropped_too_small +
-+ drvs->rx_dropped_too_short +
-+ drvs->rx_dropped_header_too_small +
-+ drvs->rx_dropped_tcp_length +
-+ drvs->rx_dropped_runt +
-+ drvs->rx_tcp_checksum_errs +
-+ drvs->rx_ip_checksum_errs +
-+ drvs->rx_udp_checksum_errs;
-
- /* detailed rx errors */
-- dev_stats->rx_length_errors = port_stats->rx_in_range_errors +
-- port_stats->rx_out_range_errors +
-- port_stats->rx_frame_too_long;
-+ dev_stats->rx_length_errors = drvs->rx_in_range_errors +
-+ drvs->rx_out_range_errors +
-+ drvs->rx_frame_too_long;
-
-- /* receive ring buffer overflow */
-- dev_stats->rx_over_errors = 0;
--
-- dev_stats->rx_crc_errors = port_stats->rx_crc_errors;
-+ dev_stats->rx_crc_errors = drvs->rx_crc_errors;
-
- /* frame alignment errors */
-- dev_stats->rx_frame_errors = port_stats->rx_alignment_symbol_errors;
-+ dev_stats->rx_frame_errors = drvs->rx_alignment_symbol_errors;
-
- /* receiver fifo overrun */
- /* drops_no_pbuf is no per i/f, it's per BE card */
-- dev_stats->rx_fifo_errors = port_stats->rx_fifo_overflow +
-- port_stats->rx_input_fifo_overflow +
-- rxf_stats->rx_drops_no_pbuf;
-- /* receiver missed packetd */
-- dev_stats->rx_missed_errors = 0;
--
-- /* packet transmit problems */
-- dev_stats->tx_errors = 0;
--
-- /* no space available in linux */
-- dev_stats->tx_dropped = 0;
--
-- dev_stats->multicast = port_stats->rx_multicast_frames;
-- dev_stats->collisions = 0;
--
-- /* detailed tx_errors */
-- dev_stats->tx_aborted_errors = 0;
-- dev_stats->tx_carrier_errors = 0;
-- dev_stats->tx_fifo_errors = 0;
-- dev_stats->tx_heartbeat_errors = 0;
-- dev_stats->tx_window_errors = 0;
-+ dev_stats->rx_fifo_errors = drvs->rxpp_fifo_overflow_drop +
-+ drvs->rx_input_fifo_overflow_drop +
-+ drvs->rx_drops_no_pbuf;
- }
-
--void be_link_status_update(struct be_adapter *adapter, bool link_up)
-+void be_link_status_update(struct be_adapter *adapter, int link_status)
- {
- struct net_device *netdev = adapter->netdev;
-
- /* If link came up or went down */
-- if (adapter->link_up != link_up) {
-- if (link_up) {
-+ if (adapter->link_status != link_status) {
-+ adapter->link_speed = -1;
-+ if (link_status == LINK_UP) {
- netif_start_queue(netdev);
- netif_carrier_on(netdev);
- printk(KERN_INFO "%s: Link up\n", netdev->name);
-@@ -222,15 +491,15 @@ void be_link_status_update(struct be_adapter *adapter, bool link_up)
- netif_carrier_off(netdev);
- printk(KERN_INFO "%s: Link down\n", netdev->name);
- }
-- adapter->link_up = link_up;
-+ adapter->link_status = link_status;
- }
- }
-
- /* Update the EQ delay n BE based on the RX frags consumed / sec */
--static void be_rx_eqd_update(struct be_adapter *adapter)
-+static void be_rx_eqd_update(struct be_adapter *adapter, struct be_rx_obj *rxo)
- {
-- struct be_eq_obj *rx_eq = &adapter->rx_eq;
-- struct be_drvr_stats *stats = &adapter->stats.drvr_stats;
-+ struct be_eq_obj *rx_eq = &rxo->rx_eq;
-+ struct be_rx_stats *stats = &rxo->stats;
- ulong now = jiffies;
- u32 eqd;
-
-@@ -247,19 +516,17 @@ static void be_rx_eqd_update(struct be_adapter *adapter)
- if ((now - stats->rx_fps_jiffies) < HZ)
- return;
-
-- stats->be_rx_fps = (stats->be_rx_frags - stats->be_prev_rx_frags) /
-+ stats->rx_fps = (stats->rx_frags - stats->prev_rx_frags) /
- ((now - stats->rx_fps_jiffies) / HZ);
-
- stats->rx_fps_jiffies = now;
-- stats->be_prev_rx_frags = stats->be_rx_frags;
-- eqd = stats->be_rx_fps / 110000;
-+ stats->prev_rx_frags = stats->rx_frags;
-+ eqd = stats->rx_fps / 110000;
- eqd = eqd << 3;
- if (eqd > rx_eq->max_eqd)
- eqd = rx_eq->max_eqd;
- if (eqd < rx_eq->min_eqd)
- eqd = rx_eq->min_eqd;
-- if (eqd < 10)
-- eqd = 0;
- if (eqd != rx_eq->cur_eqd)
- be_cmd_modify_eqd(adapter, rx_eq->q.id, eqd);
-
-@@ -270,7 +537,7 @@ static struct net_device_stats *be_get_stats(struct net_device *dev)
- {
- struct be_adapter *adapter = netdev_priv(dev);
-
-- return &adapter->stats.net_stats;
-+ return &adapter->net_stats;
- }
-
- static u32 be_calc_rate(u64 bytes, unsigned long ticks)
-@@ -284,9 +551,9 @@ static u32 be_calc_rate(u64 bytes, unsigned long ticks)
- return rate;
- }
-
--static void be_tx_rate_update(struct be_adapter *adapter)
-+static void be_tx_rate_update(struct be_tx_obj *txo)
- {
-- struct be_drvr_stats *stats = drvr_stats(adapter);
-+ struct be_tx_stats *stats = tx_stats(txo);
- ulong now = jiffies;
-
- /* Wrapped around? */
-@@ -305,10 +572,11 @@ static void be_tx_rate_update(struct be_adapter *adapter)
- }
- }
-
--static void be_tx_stats_update(struct be_adapter *adapter,
-+static void be_tx_stats_update(struct be_tx_obj *txo,
- u32 wrb_cnt, u32 copied, u32 gso_segs, bool stopped)
- {
-- struct be_drvr_stats *stats = drvr_stats(adapter);
-+ struct be_tx_stats *stats = tx_stats(txo);
-+
- stats->be_tx_reqs++;
- stats->be_tx_wrbs += wrb_cnt;
- stats->be_tx_bytes += copied;
-@@ -318,7 +586,8 @@ static void be_tx_stats_update(struct be_adapter *adapter,
- }
-
- /* Determine number of WRB entries needed to xmit data in an skb */
--static u32 wrb_cnt_for_skb(struct sk_buff *skb, bool *dummy)
-+static u32 wrb_cnt_for_skb(struct be_adapter *adapter, struct sk_buff *skb,
-+ bool *dummy)
- {
- int cnt = (skb->len > skb->data_len);
-
-@@ -326,12 +595,13 @@ static u32 wrb_cnt_for_skb(struct sk_buff *skb, bool *dummy)
-
- /* to account for hdr wrb */
- cnt++;
-- if (cnt & 1) {
-+ if (lancer_chip(adapter) || !(cnt & 1)) {
-+ *dummy = false;
-+ } else {
- /* add a dummy to make it an even num */
- cnt++;
- *dummy = true;
-- } else
-- *dummy = false;
-+ }
- BUG_ON(cnt > BE_MAX_TX_FRAG_COUNT);
- return cnt;
- }
-@@ -343,17 +613,31 @@ static inline void wrb_fill(struct be_eth_wrb *wrb, u64 addr, int len)
- wrb->frag_len = len & ETH_WRB_FRAG_LEN_MASK;
- }
-
--static void wrb_fill_hdr(struct be_eth_hdr_wrb *hdr, struct sk_buff *skb,
-- bool vlan, u32 wrb_cnt, u32 len)
-+static void wrb_fill_hdr(struct be_adapter *adapter, struct be_eth_hdr_wrb *hdr,
-+ struct sk_buff *skb, u32 wrb_cnt, u32 len)
- {
-+ u16 vlan_tag = 0;
-+
- memset(hdr, 0, sizeof(*hdr));
-
- AMAP_SET_BITS(struct amap_eth_hdr_wrb, crc, hdr, 1);
-
-- if (skb_shinfo(skb)->gso_segs > 1 && skb_shinfo(skb)->gso_size) {
-+ if (skb_is_gso(skb)) {
- AMAP_SET_BITS(struct amap_eth_hdr_wrb, lso, hdr, 1);
- AMAP_SET_BITS(struct amap_eth_hdr_wrb, lso_mss,
- hdr, skb_shinfo(skb)->gso_size);
-+ if (skb_is_gso_v6(skb) && !lancer_chip(adapter))
-+ AMAP_SET_BITS(struct amap_eth_hdr_wrb, lso6, hdr, 1);
-+
-+ if (lancer_A0_chip(adapter)) {
-+ AMAP_SET_BITS(struct amap_eth_hdr_wrb, ipcs, hdr, 1);
-+ if (is_tcp_pkt(skb))
-+ AMAP_SET_BITS(struct amap_eth_hdr_wrb,
-+ tcpcs, hdr, 1);
-+ else if (is_udp_pkt(skb))
-+ AMAP_SET_BITS(struct amap_eth_hdr_wrb,
-+ udpcs, hdr, 1);
-+ }
- } else if (skb->ip_summed == CHECKSUM_PARTIAL) {
- if (is_tcp_pkt(skb))
- AMAP_SET_BITS(struct amap_eth_hdr_wrb, tcpcs, hdr, 1);
-@@ -361,10 +645,10 @@ static void wrb_fill_hdr(struct be_eth_hdr_wrb *hdr, struct sk_buff *skb,
- AMAP_SET_BITS(struct amap_eth_hdr_wrb, udpcs, hdr, 1);
- }
-
-- if (vlan && vlan_tx_tag_present(skb)) {
-+ if (adapter->vlan_grp && vlan_tx_tag_present(skb)) {
- AMAP_SET_BITS(struct amap_eth_hdr_wrb, vlan, hdr, 1);
-- AMAP_SET_BITS(struct amap_eth_hdr_wrb, vlan_tag,
-- hdr, vlan_tx_tag_get(skb));
-+ vlan_tag = be_get_tx_vlan_tag(adapter, skb);
-+ AMAP_SET_BITS(struct amap_eth_hdr_wrb, vlan_tag, hdr, vlan_tag);
- }
-
- AMAP_SET_BITS(struct amap_eth_hdr_wrb, event, hdr, 1);
-@@ -374,14 +658,13 @@ static void wrb_fill_hdr(struct be_eth_hdr_wrb *hdr, struct sk_buff *skb,
- }
-
-
--static int make_tx_wrbs(struct be_adapter *adapter,
-+static int make_tx_wrbs(struct be_adapter *adapter, struct be_queue_info *txq,
- struct sk_buff *skb, u32 wrb_cnt, bool dummy_wrb)
- {
-- u64 busaddr;
-- u32 i, copied = 0;
-+ dma_addr_t busaddr;
-+ int i, copied = 0;
- struct pci_dev *pdev = adapter->pdev;
- struct sk_buff *first_skb = skb;
-- struct be_queue_info *txq = &adapter->tx_obj.q;
- struct be_eth_wrb *wrb;
- struct be_eth_hdr_wrb *hdr;
-
-@@ -389,15 +672,11 @@ static int make_tx_wrbs(struct be_adapter *adapter,
- atomic_add(wrb_cnt, &txq->used);
- queue_head_inc(txq);
-
-- if (skb_dma_map(&pdev->dev, skb, DMA_TO_DEVICE)) {
-- dev_err(&pdev->dev, "TX DMA mapping failed\n");
-- return 0;
-- }
--
- if (skb->len > skb->data_len) {
-- int len = skb->len - skb->data_len;
-+ int len = skb_headlen(skb);
-+ busaddr = pci_map_single(pdev, skb->data, len,
-+ PCI_DMA_TODEVICE);
- wrb = queue_head_node(txq);
-- busaddr = skb_shinfo(skb)->dma_head;
- wrb_fill(wrb, busaddr, len);
- be_dws_cpu_to_le(wrb, sizeof(*wrb));
- queue_head_inc(txq);
-@@ -407,8 +686,9 @@ static int make_tx_wrbs(struct be_adapter *adapter,
- for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
- struct skb_frag_struct *frag =
- &skb_shinfo(skb)->frags[i];
--
-- busaddr = skb_shinfo(skb)->dma_maps[i];
-+ busaddr = pci_map_page(pdev, frag->page,
-+ frag->page_offset,
-+ frag->size, PCI_DMA_TODEVICE);
- wrb = queue_head_node(txq);
- wrb_fill(wrb, busaddr, frag->size);
- be_dws_cpu_to_le(wrb, sizeof(*wrb));
-@@ -423,8 +703,7 @@ static int make_tx_wrbs(struct be_adapter *adapter,
- queue_head_inc(txq);
- }
-
-- wrb_fill_hdr(hdr, first_skb, adapter->vlan_grp ? true : false,
-- wrb_cnt, copied);
-+ wrb_fill_hdr(adapter, hdr, first_skb, wrb_cnt, copied);
- be_dws_cpu_to_le(hdr, sizeof(*hdr));
-
- return copied;
-@@ -434,19 +713,72 @@ static netdev_tx_t be_xmit(struct sk_buff *skb,
- struct net_device *netdev)
- {
- struct be_adapter *adapter = netdev_priv(netdev);
-- struct be_tx_obj *tx_obj = &adapter->tx_obj;
-- struct be_queue_info *txq = &tx_obj->q;
-+ struct be_tx_obj *txo = &adapter->tx_obj[skb_get_queue_mapping(skb)];
-+ struct be_queue_info *txq = &txo->q;
- u32 wrb_cnt = 0, copied = 0;
- u32 start = txq->head;
- bool dummy_wrb, stopped = false;
-
-- wrb_cnt = wrb_cnt_for_skb(skb, &dummy_wrb);
-+ if (unlikely((skb_shinfo(skb)->gso_segs > 1) &&
-+ skb_shinfo(skb)->gso_size && is_ipv6_ext_hdr(skb))) {
-+ tx_stats(txo)->be_ipv6_ext_hdr_tx_drop++;
-+ goto tx_drop;
-+ }
-
-- copied = make_tx_wrbs(adapter, skb, wrb_cnt, dummy_wrb);
-+ /* If the skb is a large pkt forwarded to this interface
-+ * after being LRO'd on another interface, drop the pkt.
-+ * HW cannot handle such pkts. LRO must be disabled when
-+ * using the server as a router.
-+ */
-+ if (!skb_is_gso(skb)) {
-+ int eth_hdr_len = ntohs(skb->protocol) == ETH_P_8021Q ?
-+ VLAN_ETH_HLEN : ETH_HLEN;
-+
-+ if ((skb->len - eth_hdr_len) > adapter->netdev->mtu)
-+ goto tx_drop;
-+ }
-+
-+ /* The ASIC is calculating checksum for Vlan tagged pkts
-+ * though CSO is disabled.
-+ * To work around this, insert the Vlan tag in the driver
-+ * and donot set the vlan bit, cso bit in the Tx WRB.
-+ */
-+ if (unlikely(vlan_tx_tag_present(skb) &&
-+ ((skb->ip_summed != CHECKSUM_PARTIAL) || (skb->len <= 60)))) {
-+ /* Bug 28694: Don't embed the host VLAN tag in SKB
-+ * when UMC mode enabled on that interface
-+ */
-+ if (!(adapter->function_mode & UMC_ENABLED)) {
-+ skb = skb_share_check(skb, GFP_ATOMIC);
-+ if (unlikely(!skb))
-+ goto tx_drop;
-+
-+ skb = be_vlan_put_tag(skb,
-+ be_get_tx_vlan_tag(adapter, skb));
-+ if (unlikely(!skb))
-+ goto tx_drop;
-+
-+ be_reset_skb_tx_vlan(skb);
-+ }
-+ }
-+
-+ /* Bug 12422: the stack can send us skbs with length more than 65535
-+ * BE cannot handle such requests. Hack the extra data out and drop it.
-+ */
-+ if (skb->len > 65535) {
-+ int err = __pskb_trim(skb, 65535);
-+ BUG_ON(err);
-+ }
-+
-+ wrb_cnt = wrb_cnt_for_skb(adapter, skb, &dummy_wrb);
-+
-+ copied = make_tx_wrbs(adapter, txq, skb, wrb_cnt, dummy_wrb);
- if (copied) {
-+ int gso_segs = skb_shinfo(skb)->gso_segs;
-+
- /* record the sent skb in the sent_skb table */
-- BUG_ON(tx_obj->sent_skb_list[start]);
-- tx_obj->sent_skb_list[start] = skb;
-+ BUG_ON(txo->sent_skb_list[start]);
-+ txo->sent_skb_list[start] = skb;
-
- /* Ensure txq has space for the next skb; Else stop the queue
- * *BEFORE* ringing the tx doorbell, so that we serialze the
-@@ -454,16 +786,20 @@ static netdev_tx_t be_xmit(struct sk_buff *skb,
- */
- if ((BE_MAX_TX_FRAG_COUNT + atomic_read(&txq->used)) >=
- txq->len) {
-- netif_stop_queue(netdev);
-+ netif_stop_subqueue(netdev, skb_get_queue_mapping(skb));
- stopped = true;
- }
-
- be_txq_notify(adapter, txq->id, wrb_cnt);
-
-- be_tx_stats_update(adapter, wrb_cnt, copied,
-- skb_shinfo(skb)->gso_segs, stopped);
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 32)
-+ netdev->trans_start = jiffies;
-+#endif
-+
-+ be_tx_stats_update(txo, wrb_cnt, copied, gso_segs, stopped);
- } else {
- txq->head = start;
-+tx_drop:
- dev_kfree_skb_any(skb);
- }
- return NETDEV_TX_OK;
-@@ -473,10 +809,12 @@ static int be_change_mtu(struct net_device *netdev, int new_mtu)
- {
- struct be_adapter *adapter = netdev_priv(netdev);
- if (new_mtu < BE_MIN_MTU ||
-- new_mtu > BE_MAX_JUMBO_FRAME_SIZE) {
-+ new_mtu > (BE_MAX_JUMBO_FRAME_SIZE -
-+ (ETH_HLEN + ETH_FCS_LEN))) {
- dev_info(&adapter->pdev->dev,
- "MTU must be between %d and %d bytes\n",
-- BE_MIN_MTU, BE_MAX_JUMBO_FRAME_SIZE);
-+ BE_MIN_MTU,
-+ (BE_MAX_JUMBO_FRAME_SIZE - (ETH_HLEN + ETH_FCS_LEN)));
- return -EINVAL;
- }
- dev_info(&adapter->pdev->dev, "MTU changed from %d to %d bytes\n",
-@@ -486,17 +824,19 @@ static int be_change_mtu(struct net_device *netdev, int new_mtu)
- }
-
- /*
-- * if there are BE_NUM_VLANS_SUPPORTED or lesser number of VLANS configured,
-- * program them in BE. If more than BE_NUM_VLANS_SUPPORTED are configured,
-- * set the BE in promiscuous VLAN mode.
-+ * A max of 64 (BE_NUM_VLANS_SUPPORTED) vlans can be configured in BE.
-+ * If the user configures more, place BE in vlan promiscuous mode.
- */
--static int be_vid_config(struct be_adapter *adapter)
-+static int be_vid_config(struct be_adapter *adapter, bool vf, u32 vf_num)
- {
- u16 vtag[BE_NUM_VLANS_SUPPORTED];
- u16 ntags = 0, i;
-- int status;
-+ int status = 0;
-
-- if (adapter->num_vlans <= BE_NUM_VLANS_SUPPORTED) {
-+ /* No need to change the VLAN state if the I/F is in promiscous */
-+ if (adapter->promiscuous)
-+ return 0;
-+ if (adapter->vlans_added <= adapter->max_vlans) {
- /* Construct VLAN Table to give to HW */
- for (i = 0; i < VLAN_GROUP_ARRAY_LEN; i++) {
- if (adapter->vlan_tag[i]) {
-@@ -504,47 +844,46 @@ static int be_vid_config(struct be_adapter *adapter)
- ntags++;
- }
- }
-- status = be_cmd_vlan_config(adapter, adapter->if_handle,
-- vtag, ntags, 1, 0);
-+ /* Send command only if there is something to be programmed */
-+ if (ntags)
-+ status = be_cmd_vlan_config(adapter, adapter->if_handle,
-+ vtag, ntags, 1, 0);
- } else {
- status = be_cmd_vlan_config(adapter, adapter->if_handle,
-- NULL, 0, 1, 1);
-+ NULL, 0, 1, 1);
- }
-+
- return status;
- }
-
- static void be_vlan_register(struct net_device *netdev, struct vlan_group *grp)
- {
- struct be_adapter *adapter = netdev_priv(netdev);
-- struct be_eq_obj *rx_eq = &adapter->rx_eq;
-- struct be_eq_obj *tx_eq = &adapter->tx_eq;
-
-- be_eq_notify(adapter, rx_eq->q.id, false, false, 0);
-- be_eq_notify(adapter, tx_eq->q.id, false, false, 0);
- adapter->vlan_grp = grp;
-- be_eq_notify(adapter, rx_eq->q.id, true, false, 0);
-- be_eq_notify(adapter, tx_eq->q.id, true, false, 0);
- }
-
- static void be_vlan_add_vid(struct net_device *netdev, u16 vid)
- {
- struct be_adapter *adapter = netdev_priv(netdev);
-
-- adapter->num_vlans++;
-+ adapter->vlans_added++;
-+
- adapter->vlan_tag[vid] = 1;
--
-- be_vid_config(adapter);
-+ if (adapter->vlans_added <= (adapter->max_vlans + 1))
-+ be_vid_config(adapter, false, 0);
- }
-
- static void be_vlan_rem_vid(struct net_device *netdev, u16 vid)
- {
- struct be_adapter *adapter = netdev_priv(netdev);
-
-- adapter->num_vlans--;
-- adapter->vlan_tag[vid] = 0;
--
-+ adapter->vlans_added--;
- vlan_group_set_device(adapter->vlan_grp, vid, NULL);
-- be_vid_config(adapter);
-+
-+ adapter->vlan_tag[vid] = 0;
-+ if (adapter->vlans_added <= adapter->max_vlans)
-+ be_vid_config(adapter, false, 0);
- }
-
- static void be_set_multicast_list(struct net_device *netdev)
-@@ -552,7 +891,7 @@ static void be_set_multicast_list(struct net_device *netdev)
- struct be_adapter *adapter = netdev_priv(netdev);
-
- if (netdev->flags & IFF_PROMISC) {
-- be_cmd_promiscuous_config(adapter, adapter->port_num, 1);
-+ be_cmd_rx_filter(adapter, IFF_PROMISC, ON);
- adapter->promiscuous = true;
- goto done;
- }
-@@ -560,81 +899,244 @@ static void be_set_multicast_list(struct net_device *netdev)
- /* BE was previously in promiscous mode; disable it */
- if (adapter->promiscuous) {
- adapter->promiscuous = false;
-- be_cmd_promiscuous_config(adapter, adapter->port_num, 0);
-+ be_cmd_rx_filter(adapter, IFF_PROMISC, OFF);
-+
-+ if (adapter->vlans_added)
-+ be_vid_config(adapter, false, 0);
- }
-
-- if (netdev->flags & IFF_ALLMULTI) {
-- be_cmd_multicast_set(adapter, adapter->if_handle, NULL, 0);
-+ /* Enable multicast promisc if num configured exceeds what we support */
-+ if (netdev->flags & IFF_ALLMULTI ||
-+ netdev_mc_count(netdev) > BE_MAX_MC) {
-+ be_cmd_rx_filter(adapter, IFF_ALLMULTI, ON);
- goto done;
- }
-
-- be_cmd_multicast_set(adapter, adapter->if_handle, netdev->mc_list,
-- netdev->mc_count);
-+ be_cmd_rx_filter(adapter, IFF_MULTICAST, ON);
- done:
- return;
- }
-
--static void be_rx_rate_update(struct be_adapter *adapter)
-+#ifdef HAVE_SRIOV_CONFIG
-+static int be_set_vf_mac(struct net_device *netdev, int vf, u8 *mac)
- {
-- struct be_drvr_stats *stats = drvr_stats(adapter);
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+ int status;
-+
-+ if (adapter->num_vfs == 0)
-+ return -EPERM;
-+
-+ if (!is_valid_ether_addr(mac) || (vf >= adapter->num_vfs))
-+ return -EINVAL;
-+
-+ if (adapter->vf_cfg[vf].vf_pmac_id != BE_INVALID_PMAC_ID)
-+ status = be_cmd_pmac_del(adapter,
-+ adapter->vf_cfg[vf].vf_if_handle,
-+ adapter->vf_cfg[vf].vf_pmac_id, vf + 1);
-+
-+ status = be_cmd_pmac_add(adapter, mac,
-+ adapter->vf_cfg[vf].vf_if_handle,
-+ &adapter->vf_cfg[vf].vf_pmac_id, vf + 1);
-+
-+ if (status)
-+ dev_err(&adapter->pdev->dev, "MAC %pM set on VF %d Failed\n",
-+ mac, vf);
-+ else
-+ memcpy(adapter->vf_cfg[vf].vf_mac_addr, mac, ETH_ALEN);
-+
-+ return status;
-+}
-+
-+static int be_get_vf_config(struct net_device *netdev, int vf,
-+ struct ifla_vf_info *vi)
-+{
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+
-+ if (adapter->num_vfs == 0)
-+ return -EPERM;
-+
-+ if (vf >= adapter->num_vfs)
-+ return -EINVAL;
-+
-+ vi->vf = vf;
-+ vi->tx_rate = adapter->vf_cfg[vf].vf_tx_rate;
-+ vi->vlan = adapter->vf_cfg[vf].vf_vlan_tag & VLAN_VID_MASK;
-+ vi->qos = adapter->vf_cfg[vf].vf_vlan_tag >> VLAN_PRIO_SHIFT;
-+ memcpy(&vi->mac, adapter->vf_cfg[vf].vf_mac_addr, ETH_ALEN);
-+
-+ return 0;
-+}
-+
-+/*
-+ * Entry point to configure vlan behavior for a VF.
-+ * 1. By default a VF is vlan Challenged.
-+ * 2. It may or may not have Transparent Tagging enabled.
-+ * 3. Vlan privilege for a VF can be toggled using special VID 4095.
-+ * 4. When removing the Vlan privilege for a VF there is no need set default vid
-+ * 5. Transparent Tagging configured for a VF resets its Vlan privilege
-+ * 6. To disable the current Transparet Tagging for a VF:
-+ * 6a. run the last iproute command with vlan set to 0.
-+ * 6b. programing the default vid will disable Transparent Tagging in ARM/ASIC
-+ */
-+static int be_set_vf_vlan(struct net_device *netdev,
-+ int vf, u16 vlan, u8 qos)
-+{
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+ int status = 0;
-+ u32 en = 0;
-+
-+ if (adapter->num_vfs == 0)
-+ return -EPERM;
-+
-+ if ((vf >= adapter->num_vfs) || (vlan > 4095) || (qos > 7))
-+ return -EINVAL;
-+
-+ status = be_cmd_get_fn_privileges(adapter, &en, vf + 1);
-+ if (status)
-+ goto sts;
-+
-+ if (vlan == 4095) {
-+ if (en & BE_PRIV_FILTMGMT) {
-+ /* Knock off filtering privileges */
-+ en &= ~BE_PRIV_FILTMGMT;
-+ } else {
-+ en |= BE_PRIV_FILTMGMT;
-+ /* Transparent Tagging is currently enabled, Reset it */
-+ if (adapter->vf_cfg[vf].vf_vlan_tag) {
-+ adapter->vf_cfg[vf].vf_vlan_tag = 0;
-+ vlan = adapter->vf_cfg[vf].vf_def_vid;
-+ be_cmd_set_hsw_config(adapter, vlan, vf + 1,
-+ adapter->vf_cfg[vf].vf_if_handle);
-+ }
-+ }
-+
-+ adapter->vf_cfg[vf].vf_vlan_tag = 0;
-+ status = be_cmd_set_fn_privileges(adapter, en, NULL, vf + 1);
-+
-+ goto sts;
-+ }
-+
-+ if (vlan || qos) {
-+ if (en & BE_PRIV_FILTMGMT) {
-+ /* Check privilege and reset it to default */
-+ en &= ~BE_PRIV_FILTMGMT;
-+ be_cmd_set_fn_privileges(adapter, en, NULL, vf + 1);
-+ }
-+
-+ vlan |= qos << VLAN_PRIO_SHIFT;
-+ if (adapter->vf_cfg[vf].vf_vlan_tag != vlan) {
-+ /* If this is new value, program it. Else skip. */
-+ adapter->vf_cfg[vf].vf_vlan_tag = vlan;
-+
-+ status = be_cmd_set_hsw_config(adapter, vlan,
-+ vf + 1, adapter->vf_cfg[vf].vf_if_handle);
-+ }
-+
-+ } else {
-+ /* Reset Transparent Vlan Tagging. */
-+ adapter->vf_cfg[vf].vf_vlan_tag = 0;
-+ vlan = adapter->vf_cfg[vf].vf_def_vid;
-+ status = be_cmd_set_hsw_config(adapter, vlan, vf + 1,
-+ adapter->vf_cfg[vf].vf_if_handle);
-+ }
-+
-+sts:
-+ if (status)
-+ dev_info(&adapter->pdev->dev,
-+ "VLAN %d config on VF %d failed\n", vlan, vf);
-+ return status;
-+}
-+
-+static int be_set_vf_tx_rate(struct net_device *netdev,
-+ int vf, int rate)
-+{
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+ int status = 0;
-+
-+ if (adapter->num_vfs == 0)
-+ return -EPERM;
-+
-+ if ((vf >= adapter->num_vfs) || (rate < 0))
-+ return -EINVAL;
-+
-+ if (rate > 10000)
-+ rate = 10000;
-+
-+ adapter->vf_cfg[vf].vf_tx_rate = rate;
-+ status = be_cmd_set_qos(adapter, rate / 10, vf + 1);
-+
-+ if (status)
-+ dev_info(&adapter->pdev->dev,
-+ "tx rate %d on VF %d failed\n", rate, vf);
-+ return status;
-+}
-+#endif /* HAVE_SRIOV_CONFIG */
-+
-+static void be_rx_rate_update(struct be_rx_obj *rxo)
-+{
-+ struct be_rx_stats *stats = &rxo->stats;
- ulong now = jiffies;
-
- /* Wrapped around */
-- if (time_before(now, stats->be_rx_jiffies)) {
-- stats->be_rx_jiffies = now;
-+ if (time_before(now, stats->rx_jiffies)) {
-+ stats->rx_jiffies = now;
- return;
- }
-
- /* Update the rate once in two seconds */
-- if ((now - stats->be_rx_jiffies) < 2 * HZ)
-+ if ((now - stats->rx_jiffies) < 2 * HZ)
- return;
-
-- stats->be_rx_rate = be_calc_rate(stats->be_rx_bytes
-- - stats->be_rx_bytes_prev,
-- now - stats->be_rx_jiffies);
-- stats->be_rx_jiffies = now;
-- stats->be_rx_bytes_prev = stats->be_rx_bytes;
-+ stats->rx_rate = be_calc_rate(stats->rx_bytes - stats->rx_bytes_prev,
-+ now - stats->rx_jiffies);
-+ stats->rx_jiffies = now;
-+ stats->rx_bytes_prev = stats->rx_bytes;
- }
-
--static void be_rx_stats_update(struct be_adapter *adapter,
-- u32 pktsize, u16 numfrags)
-+static void be_rx_stats_update(struct be_rx_obj *rxo,
-+ struct be_rx_compl_info *rxcp)
- {
-- struct be_drvr_stats *stats = drvr_stats(adapter);
-+ struct be_rx_stats *stats = &rxo->stats;
-
-- stats->be_rx_compl++;
-- stats->be_rx_frags += numfrags;
-- stats->be_rx_bytes += pktsize;
-- stats->be_rx_pkts++;
-+ stats->rx_compl++;
-+ stats->rx_frags += rxcp->num_rcvd;
-+ stats->rx_bytes += rxcp->pkt_size;
-+ stats->rx_pkts++;
-+ if (rxcp->pkt_type == BE_MULTICAST_PACKET)
-+ stats->rx_mcast_pkts++;
-+ if (rxcp->err)
-+ stats->rxcp_err++;
- }
-
--static inline bool do_pkt_csum(struct be_eth_rx_compl *rxcp, bool cso)
-+static inline bool csum_passed(struct be_rx_compl_info *rxcp)
- {
-- u8 l4_cksm, ip_version, ipcksm, tcpf = 0, udpf = 0, ipv6_chk;
--
-- l4_cksm = AMAP_GET_BITS(struct amap_eth_rx_compl, l4_cksm, rxcp);
-- ipcksm = AMAP_GET_BITS(struct amap_eth_rx_compl, ipcksm, rxcp);
-- ip_version = AMAP_GET_BITS(struct amap_eth_rx_compl, ip_version, rxcp);
-- if (ip_version) {
-- tcpf = AMAP_GET_BITS(struct amap_eth_rx_compl, tcpf, rxcp);
-- udpf = AMAP_GET_BITS(struct amap_eth_rx_compl, udpf, rxcp);
-- }
-- ipv6_chk = (ip_version && (tcpf || udpf));
--
-- return ((l4_cksm && ipv6_chk && ipcksm) && cso) ? false : true;
-+ /* L4 checksum is not reliable for non TCP/UDP packets.
-+ * Also ignore ipcksm for ipv6 pkts */
-+ return (rxcp->tcpf || rxcp->udpf) && rxcp->l4_csum &&
-+ (rxcp->ip_csum || rxcp->ipv6);
- }
-
- static struct be_rx_page_info *
--get_rx_page_info(struct be_adapter *adapter, u16 frag_idx)
-+get_rx_page_info(struct be_adapter *adapter, struct be_rx_obj *rxo,
-+ u16 frag_idx)
- {
- struct be_rx_page_info *rx_page_info;
-- struct be_queue_info *rxq = &adapter->rx_obj.q;
-+ struct be_queue_info *rxq = &rxo->q;
-
-- rx_page_info = &adapter->rx_obj.page_info_tbl[frag_idx];
-- BUG_ON(!rx_page_info->page);
-+ rx_page_info = &rxo->page_info_tbl[frag_idx];
-+ if (!rx_page_info->page) {
-+ printk(KERN_EMERG "curr_idx=%d prev_dix=%d rxq->head=%d\n",
-+ frag_idx, rxo->prev_frag_idx, rxq->head);
-+ BUG_ON(!rx_page_info->page);
-+ }
-
-- if (rx_page_info->last_page_user)
-+ if (rx_page_info->last_page_user) {
- pci_unmap_page(adapter->pdev, pci_unmap_addr(rx_page_info, bus),
- adapter->big_page_size, PCI_DMA_FROMDEVICE);
-+ rx_page_info->last_page_user = false;
-+ }
-+
-+ rxo->prev_frag_idx = frag_idx;
-
- atomic_dec(&rxq->used);
- return rx_page_info;
-@@ -642,20 +1144,26 @@ get_rx_page_info(struct be_adapter *adapter, u16 frag_idx)
-
- /* Throwaway the data in the Rx completion */
- static void be_rx_compl_discard(struct be_adapter *adapter,
-- struct be_eth_rx_compl *rxcp)
-+ struct be_rx_obj *rxo,
-+ struct be_rx_compl_info *rxcp)
- {
-- struct be_queue_info *rxq = &adapter->rx_obj.q;
-+ struct be_queue_info *rxq = &rxo->q;
- struct be_rx_page_info *page_info;
-- u16 rxq_idx, i, num_rcvd;
-+ u16 i;
-+ bool oob_error;
-+ u16 num_rcvd = rxcp->num_rcvd;
-
-- rxq_idx = AMAP_GET_BITS(struct amap_eth_rx_compl, fragndx, rxcp);
-- num_rcvd = AMAP_GET_BITS(struct amap_eth_rx_compl, numfrags, rxcp);
-+ oob_error = lancer_A0_chip(adapter) && rxcp->err;
-+
-+ /* In case of OOB error num_rcvd will be 1 more than actual */
-+ if (oob_error && num_rcvd)
-+ num_rcvd -= 1;
-
- for (i = 0; i < num_rcvd; i++) {
-- page_info = get_rx_page_info(adapter, rxq_idx);
-+ page_info = get_rx_page_info(adapter, rxo, rxcp->rxq_idx);
- put_page(page_info->page);
- memset(page_info, 0, sizeof(*page_info));
-- index_inc(&rxq_idx, rxq->len);
-+ index_inc(&rxcp->rxq_idx, rxq->len);
- }
- }
-
-@@ -663,29 +1171,24 @@ static void be_rx_compl_discard(struct be_adapter *adapter,
- * skb_fill_rx_data forms a complete skb for an ether frame
- * indicated by rxcp.
- */
--static void skb_fill_rx_data(struct be_adapter *adapter,
-- struct sk_buff *skb, struct be_eth_rx_compl *rxcp)
-+static void skb_fill_rx_data(struct be_adapter *adapter, struct be_rx_obj *rxo,
-+ struct sk_buff *skb, struct be_rx_compl_info *rxcp)
- {
-- struct be_queue_info *rxq = &adapter->rx_obj.q;
-+ struct be_queue_info *rxq = &rxo->q;
- struct be_rx_page_info *page_info;
-- u16 rxq_idx, i, num_rcvd, j;
-- u32 pktsize, hdr_len, curr_frag_len, size;
-+ u16 i, j;
-+ u16 hdr_len, curr_frag_len, remaining;
- u8 *start;
-
-- rxq_idx = AMAP_GET_BITS(struct amap_eth_rx_compl, fragndx, rxcp);
-- pktsize = AMAP_GET_BITS(struct amap_eth_rx_compl, pktsize, rxcp);
-- num_rcvd = AMAP_GET_BITS(struct amap_eth_rx_compl, numfrags, rxcp);
--
-- page_info = get_rx_page_info(adapter, rxq_idx);
--
-+ page_info = get_rx_page_info(adapter, rxo, rxcp->rxq_idx);
- start = page_address(page_info->page) + page_info->page_offset;
- prefetch(start);
-
- /* Copy data in the first descriptor of this completion */
-- curr_frag_len = min(pktsize, rx_frag_size);
-+ curr_frag_len = min(rxcp->pkt_size, rx_frag_size);
-
- /* Copy the header portion into skb_data */
-- hdr_len = min((u32)BE_HDR_LEN, curr_frag_len);
-+ hdr_len = min(BE_HDR_LEN, curr_frag_len);
- memcpy(skb->data, start, hdr_len);
- skb->len = curr_frag_len;
- if (curr_frag_len <= BE_HDR_LEN) { /* tiny packet */
-@@ -702,21 +1205,19 @@ static void skb_fill_rx_data(struct be_adapter *adapter,
- skb->data_len = curr_frag_len - hdr_len;
- skb->tail += hdr_len;
- }
-- memset(page_info, 0, sizeof(*page_info));
-+ page_info->page = NULL;
-
-- if (pktsize <= rx_frag_size) {
-- BUG_ON(num_rcvd != 1);
-- goto done;
-+ if (rxcp->pkt_size <= rx_frag_size) {
-+ BUG_ON(rxcp->num_rcvd != 1);
-+ return;
- }
-
- /* More frags present for this completion */
-- size = pktsize;
-- for (i = 1, j = 0; i < num_rcvd; i++) {
-- size -= curr_frag_len;
-- index_inc(&rxq_idx, rxq->len);
-- page_info = get_rx_page_info(adapter, rxq_idx);
--
-- curr_frag_len = min(size, rx_frag_size);
-+ index_inc(&rxcp->rxq_idx, rxq->len);
-+ remaining = rxcp->pkt_size - curr_frag_len;
-+ for (i = 1, j = 0; i < rxcp->num_rcvd; i++) {
-+ page_info = get_rx_page_info(adapter, rxo, rxcp->rxq_idx);
-+ curr_frag_len = min(remaining, rx_frag_size);
-
- /* Coalesce all frags from the same physical page in one slot */
- if (page_info->page_offset == 0) {
-@@ -735,99 +1236,122 @@ static void skb_fill_rx_data(struct be_adapter *adapter,
- skb->len += curr_frag_len;
- skb->data_len += curr_frag_len;
-
-- memset(page_info, 0, sizeof(*page_info));
-+ remaining -= curr_frag_len;
-+ index_inc(&rxcp->rxq_idx, rxq->len);
-+ page_info->page = NULL;
- }
- BUG_ON(j > MAX_SKB_FRAGS);
--
--done:
-- be_rx_stats_update(adapter, pktsize, num_rcvd);
-- return;
- }
-
--/* Process the RX completion indicated by rxcp when GRO is disabled */
-+/* Process the RX completion indicated by rxcp when LRO is disabled */
- static void be_rx_compl_process(struct be_adapter *adapter,
-- struct be_eth_rx_compl *rxcp)
-+ struct be_rx_obj *rxo,
-+ struct be_rx_compl_info *rxcp)
- {
- struct sk_buff *skb;
-- u32 vlanf, vid;
-- u8 vtm;
-
-- vlanf = AMAP_GET_BITS(struct amap_eth_rx_compl, vtp, rxcp);
-- vtm = AMAP_GET_BITS(struct amap_eth_rx_compl, vtm, rxcp);
--
-- /* vlanf could be wrongly set in some cards.
-- * ignore if vtm is not set */
-- if ((adapter->cap == 0x400) && !vtm)
-- vlanf = 0;
--
-- skb = netdev_alloc_skb(adapter->netdev, BE_HDR_LEN + NET_IP_ALIGN);
-- if (!skb) {
-+ skb = netdev_alloc_skb_ip_align(adapter->netdev, BE_HDR_LEN);
-+ if (unlikely(!skb)) {
- if (net_ratelimit())
- dev_warn(&adapter->pdev->dev, "skb alloc failed\n");
-- be_rx_compl_discard(adapter, rxcp);
-+ be_rx_compl_discard(adapter, rxo, rxcp);
- return;
- }
-
-- skb_reserve(skb, NET_IP_ALIGN);
-+ skb_fill_rx_data(adapter, rxo, skb, rxcp);
-
-- skb_fill_rx_data(adapter, skb, rxcp);
--
-- if (do_pkt_csum(rxcp, adapter->rx_csum))
-- skb->ip_summed = CHECKSUM_NONE;
-- else
-+ if (likely(adapter->rx_csum && csum_passed(rxcp)))
- skb->ip_summed = CHECKSUM_UNNECESSARY;
-+ else
-+ skb->ip_summed = CHECKSUM_NONE;
-
- skb->truesize = skb->len + sizeof(struct sk_buff);
-+ if (unlikely(rxcp->vlanf) &&
-+ unlikely(!vlan_configured(adapter))) {
-+ __vlan_put_tag(skb, rxcp->vlan_tag);
-+ }
- skb->protocol = eth_type_trans(skb, adapter->netdev);
- skb->dev = adapter->netdev;
-
-- if (vlanf) {
-- if (!adapter->vlan_grp || adapter->num_vlans == 0) {
-- kfree_skb(skb);
-- return;
-- }
-- vid = AMAP_GET_BITS(struct amap_eth_rx_compl, vlan_tag, rxcp);
-- vid = be16_to_cpu(vid);
-- vlan_hwaccel_receive_skb(skb, adapter->vlan_grp, vid);
-- } else {
-+ if (unlikely(rxcp->vlanf) &&
-+ vlan_configured(adapter))
-+ vlan_hwaccel_receive_skb(skb, adapter->vlan_grp,
-+ rxcp->vlan_tag);
-+ else
- netif_receive_skb(skb);
-+
-+ return;
-+}
-+
-+/* Process the RX completion indicated by rxcp when LRO is enabled */
-+static void be_rx_compl_process_lro(struct be_adapter *adapter,
-+ struct be_rx_obj *rxo,
-+ struct be_rx_compl_info *rxcp)
-+{
-+ struct be_rx_page_info *page_info;
-+ struct skb_frag_struct rx_frags[BE_MAX_FRAGS_PER_FRAME];
-+ struct be_queue_info *rxq = &rxo->q;
-+ u16 remaining, curr_frag_len;
-+ u16 i, j;
-+
-+ remaining = rxcp->pkt_size;
-+ for (i = 0, j = -1; i < rxcp->num_rcvd; i++) {
-+ page_info = get_rx_page_info(adapter, rxo, rxcp->rxq_idx);
-+
-+ curr_frag_len = min(remaining, rx_frag_size);
-+
-+ /* Coalesce all frags from the same physical page in one slot */
-+ if (i == 0 || page_info->page_offset == 0) {
-+ /* First frag or Fresh page */
-+ j++;
-+ rx_frags[j].page = page_info->page;
-+ rx_frags[j].page_offset = page_info->page_offset;
-+ rx_frags[j].size = 0;
-+ } else {
-+ put_page(page_info->page);
-+ }
-+ rx_frags[j].size += curr_frag_len;
-+
-+ remaining -= curr_frag_len;
-+ index_inc(&rxcp->rxq_idx, rxq->len);
-+ memset(page_info, 0, sizeof(*page_info));
-+ }
-+ BUG_ON(j > MAX_SKB_FRAGS);
-+
-+ if (likely(!rxcp->vlanf)) {
-+ lro_receive_frags(&rxo->lro_mgr, rx_frags, rxcp->pkt_size,
-+ rxcp->pkt_size, NULL, 0);
-+ } else {
-+ lro_vlan_hwaccel_receive_frags(&rxo->lro_mgr, rx_frags,
-+ rxcp->pkt_size, rxcp->pkt_size, adapter->vlan_grp,
-+ rxcp->vlan_tag, NULL, 0);
- }
-
- return;
- }
-
- /* Process the RX completion indicated by rxcp when GRO is enabled */
--static void be_rx_compl_process_gro(struct be_adapter *adapter,
-- struct be_eth_rx_compl *rxcp)
-+void be_rx_compl_process_gro(struct be_adapter *adapter,
-+ struct be_rx_obj *rxo,
-+ struct be_rx_compl_info *rxcp)
- {
-+#ifdef NETIF_F_GRO
- struct be_rx_page_info *page_info;
- struct sk_buff *skb = NULL;
-- struct be_queue_info *rxq = &adapter->rx_obj.q;
-- struct be_eq_obj *eq_obj = &adapter->rx_eq;
-- u32 num_rcvd, pkt_size, remaining, vlanf, curr_frag_len;
-- u16 i, rxq_idx = 0, vid, j;
-- u8 vtm;
--
-- num_rcvd = AMAP_GET_BITS(struct amap_eth_rx_compl, numfrags, rxcp);
-- pkt_size = AMAP_GET_BITS(struct amap_eth_rx_compl, pktsize, rxcp);
-- vlanf = AMAP_GET_BITS(struct amap_eth_rx_compl, vtp, rxcp);
-- rxq_idx = AMAP_GET_BITS(struct amap_eth_rx_compl, fragndx, rxcp);
-- vtm = AMAP_GET_BITS(struct amap_eth_rx_compl, vtm, rxcp);
--
-- /* vlanf could be wrongly set in some cards.
-- * ignore if vtm is not set */
-- if ((adapter->cap == 0x400) && !vtm)
-- vlanf = 0;
-+ struct be_queue_info *rxq = &rxo->q;
-+ struct be_eq_obj *eq_obj = &rxo->rx_eq;
-+ u16 remaining, curr_frag_len;
-+ u16 i, j;
-
- skb = napi_get_frags(&eq_obj->napi);
- if (!skb) {
-- be_rx_compl_discard(adapter, rxcp);
-+ be_rx_compl_discard(adapter, rxo, rxcp);
- return;
- }
-
-- remaining = pkt_size;
-- for (i = 0, j = -1; i < num_rcvd; i++) {
-- page_info = get_rx_page_info(adapter, rxq_idx);
-+ remaining = rxcp->pkt_size;
-+ for (i = 0, j = -1; i < rxcp->num_rcvd; i++) {
-+ page_info = get_rx_page_info(adapter, rxo, rxcp->rxq_idx);
-
- curr_frag_len = min(remaining, rx_frag_size);
-
-@@ -845,55 +1369,129 @@ static void be_rx_compl_process_gro(struct be_adapter *adapter,
- skb_shinfo(skb)->frags[j].size += curr_frag_len;
-
- remaining -= curr_frag_len;
-- index_inc(&rxq_idx, rxq->len);
-+ index_inc(&rxcp->rxq_idx, rxq->len);
- memset(page_info, 0, sizeof(*page_info));
- }
- BUG_ON(j > MAX_SKB_FRAGS);
-
- skb_shinfo(skb)->nr_frags = j + 1;
-- skb->len = pkt_size;
-- skb->data_len = pkt_size;
-- skb->truesize += pkt_size;
-+ skb->len = rxcp->pkt_size;
-+ skb->data_len = rxcp->pkt_size;
-+ skb->truesize += rxcp->pkt_size;
- skb->ip_summed = CHECKSUM_UNNECESSARY;
-
-- if (likely(!vlanf)) {
-+ if (likely(!rxcp->vlanf))
- napi_gro_frags(&eq_obj->napi);
-- } else {
-- vid = AMAP_GET_BITS(struct amap_eth_rx_compl, vlan_tag, rxcp);
-- vid = be16_to_cpu(vid);
-+ else
-+ vlan_gro_frags(&eq_obj->napi,
-+ adapter->vlan_grp, rxcp->vlan_tag);
-+#endif
-
-- if (!adapter->vlan_grp || adapter->num_vlans == 0)
-- return;
--
-- vlan_gro_frags(&eq_obj->napi, adapter->vlan_grp, vid);
-- }
--
-- be_rx_stats_update(adapter, pkt_size, num_rcvd);
- return;
- }
-
--static struct be_eth_rx_compl *be_rx_compl_get(struct be_adapter *adapter)
-+static void be_parse_rx_compl_v1(struct be_adapter *adapter,
-+ struct be_eth_rx_compl *compl,
-+ struct be_rx_compl_info *rxcp)
- {
-- struct be_eth_rx_compl *rxcp = queue_tail_node(&adapter->rx_obj.cq);
-+ rxcp->pkt_size =
-+ AMAP_GET_BITS(struct amap_eth_rx_compl_v1, pktsize, compl);
-+ rxcp->vlanf = AMAP_GET_BITS(struct amap_eth_rx_compl_v1, vtp, compl);
-+ rxcp->err = AMAP_GET_BITS(struct amap_eth_rx_compl_v1, err, compl);
-+ rxcp->tcpf = AMAP_GET_BITS(struct amap_eth_rx_compl_v1, tcpf, compl);
-+ rxcp->udpf = AMAP_GET_BITS(struct amap_eth_rx_compl_v1, udpf, compl);
-+ rxcp->ip_csum =
-+ AMAP_GET_BITS(struct amap_eth_rx_compl_v1, ipcksm, compl);
-+ rxcp->l4_csum =
-+ AMAP_GET_BITS(struct amap_eth_rx_compl_v1, l4_cksm, compl);
-+ rxcp->ipv6 =
-+ AMAP_GET_BITS(struct amap_eth_rx_compl_v1, ip_version, compl);
-+ rxcp->rxq_idx =
-+ AMAP_GET_BITS(struct amap_eth_rx_compl_v1, fragndx, compl);
-+ rxcp->num_rcvd =
-+ AMAP_GET_BITS(struct amap_eth_rx_compl_v1, numfrags, compl);
-+ rxcp->pkt_type =
-+ AMAP_GET_BITS(struct amap_eth_rx_compl_v1, cast_enc, compl);
-+ if (rxcp->vlanf) {
-+ rxcp->vtm = AMAP_GET_BITS(struct amap_eth_rx_compl_v1, vtm,
-+ compl);
-+ rxcp->vlan_tag = AMAP_GET_BITS(struct amap_eth_rx_compl_v1,
-+ vlan_tag, compl);
-+ }
-+ rxcp->port = AMAP_GET_BITS(struct amap_eth_rx_compl_v1, port, compl);
-+}
-
-- if (rxcp->dw[offsetof(struct amap_eth_rx_compl, valid) / 32] == 0)
-+static void be_parse_rx_compl_v0(struct be_adapter *adapter,
-+ struct be_eth_rx_compl *compl,
-+ struct be_rx_compl_info *rxcp)
-+{
-+ rxcp->pkt_size =
-+ AMAP_GET_BITS(struct amap_eth_rx_compl_v0, pktsize, compl);
-+ rxcp->vlanf = AMAP_GET_BITS(struct amap_eth_rx_compl_v0, vtp, compl);
-+ rxcp->err = AMAP_GET_BITS(struct amap_eth_rx_compl_v0, err, compl);
-+ rxcp->tcpf = AMAP_GET_BITS(struct amap_eth_rx_compl_v0, tcpf, compl);
-+ rxcp->udpf = AMAP_GET_BITS(struct amap_eth_rx_compl_v0, udpf, compl);
-+ rxcp->ip_csum =
-+ AMAP_GET_BITS(struct amap_eth_rx_compl_v0, ipcksm, compl);
-+ rxcp->l4_csum =
-+ AMAP_GET_BITS(struct amap_eth_rx_compl_v0, l4_cksm, compl);
-+ rxcp->ipv6 =
-+ AMAP_GET_BITS(struct amap_eth_rx_compl_v0, ip_version, compl);
-+ rxcp->rxq_idx =
-+ AMAP_GET_BITS(struct amap_eth_rx_compl_v0, fragndx, compl);
-+ rxcp->num_rcvd =
-+ AMAP_GET_BITS(struct amap_eth_rx_compl_v0, numfrags, compl);
-+ rxcp->pkt_type =
-+ AMAP_GET_BITS(struct amap_eth_rx_compl_v0, cast_enc, compl);
-+ if (rxcp->vlanf) {
-+ rxcp->vtm = AMAP_GET_BITS(struct amap_eth_rx_compl_v0, vtm,
-+ compl);
-+ rxcp->vlan_tag = AMAP_GET_BITS(struct amap_eth_rx_compl_v0,
-+ vlan_tag, compl);
-+ }
-+ rxcp->port = AMAP_GET_BITS(struct amap_eth_rx_compl_v0, port, compl);
-+}
-+
-+static struct be_rx_compl_info *be_rx_compl_get(struct be_rx_obj *rxo)
-+{
-+ struct be_eth_rx_compl *compl = queue_tail_node(&rxo->cq);
-+ struct be_rx_compl_info *rxcp = &rxo->rxcp;
-+ struct be_adapter *adapter = rxo->adapter;
-+
-+ /* For checking the valid bit it is Ok to use either definition as the
-+ * valid bit is at the same position in both v0 and v1 Rx compl */
-+ if (compl->dw[offsetof(struct amap_eth_rx_compl_v1, valid) / 32] == 0)
- return NULL;
-
-- be_dws_le_to_cpu(rxcp, sizeof(*rxcp));
-+ rmb();
-+ be_dws_le_to_cpu(compl, sizeof(*compl));
-
-- queue_tail_inc(&adapter->rx_obj.cq);
-+ if (adapter->be3_native)
-+ be_parse_rx_compl_v1(adapter, compl, rxcp);
-+ else
-+ be_parse_rx_compl_v0(adapter, compl, rxcp);
-+
-+ if (rxcp->vlanf) {
-+ /* vlanf could be wrongly set in some cards.
-+ * ignore if vtm is not set */
-+ if ((adapter->function_mode & FLEX10_MODE) && !rxcp->vtm)
-+ rxcp->vlanf = 0;
-+
-+ if (!lancer_chip(adapter))
-+ rxcp->vlan_tag = swab16(rxcp->vlan_tag);
-+
-+ if ((adapter->pvid == (rxcp->vlan_tag & VLAN_VID_MASK)) &&
-+ !adapter->vlan_tag[rxcp->vlan_tag])
-+ rxcp->vlanf = 0;
-+ }
-+
-+ /* As the compl has been parsed, reset it; we wont touch it again */
-+ compl->dw[offsetof(struct amap_eth_rx_compl_v1, valid) / 32] = 0;
-+
-+ queue_tail_inc(&rxo->cq);
- return rxcp;
- }
-
--/* To reset the valid bit, we need to reset the whole word as
-- * when walking the queue the valid entries are little-endian
-- * and invalid entries are host endian
-- */
--static inline void be_rx_compl_reset(struct be_eth_rx_compl *rxcp)
--{
-- rxcp->dw[offsetof(struct amap_eth_rx_compl, valid) / 32] = 0;
--}
--
- static inline struct page *be_alloc_pages(u32 size)
- {
- gfp_t alloc_flags = GFP_ATOMIC;
-@@ -907,11 +1505,12 @@ static inline struct page *be_alloc_pages(u32 size)
- * Allocate a page, split it to fragments of size rx_frag_size and post as
- * receive buffers to BE
- */
--static void be_post_rx_frags(struct be_adapter *adapter)
-+static void be_post_rx_frags(struct be_rx_obj *rxo)
- {
-- struct be_rx_page_info *page_info_tbl = adapter->rx_obj.page_info_tbl;
-- struct be_rx_page_info *page_info = NULL;
-- struct be_queue_info *rxq = &adapter->rx_obj.q;
-+ struct be_adapter *adapter = rxo->adapter;
-+ struct be_rx_page_info *page_info_tbl = rxo->page_info_tbl;
-+ struct be_rx_page_info *page_info = NULL, *prev_page_info = NULL;
-+ struct be_queue_info *rxq = &rxo->q;
- struct page *pagep = NULL;
- struct be_eth_rx_d *rxd;
- u64 page_dmaaddr = 0, frag_dmaaddr;
-@@ -922,7 +1521,7 @@ static void be_post_rx_frags(struct be_adapter *adapter)
- if (!pagep) {
- pagep = be_alloc_pages(adapter->big_page_size);
- if (unlikely(!pagep)) {
-- drvr_stats(adapter)->be_ethrx_post_fail++;
-+ rxo->stats.rx_post_fail++;
- break;
- }
- page_dmaaddr = pci_map_page(adapter->pdev, pagep, 0,
-@@ -941,7 +1540,6 @@ static void be_post_rx_frags(struct be_adapter *adapter)
- rxd = queue_head_node(rxq);
- rxd->fragpa_lo = cpu_to_le32(frag_dmaaddr & 0xFFFFFFFF);
- rxd->fragpa_hi = cpu_to_le32(upper_32_bits(frag_dmaaddr));
-- queue_head_inc(rxq);
-
- /* Any space left in the current big page for another frag? */
- if ((page_offset + rx_frag_size + rx_frag_size) >
-@@ -949,17 +1547,24 @@ static void be_post_rx_frags(struct be_adapter *adapter)
- pagep = NULL;
- page_info->last_page_user = true;
- }
-+
-+ prev_page_info = page_info;
-+ queue_head_inc(rxq);
- page_info = &page_info_tbl[rxq->head];
- }
- if (pagep)
-- page_info->last_page_user = true;
-+ prev_page_info->last_page_user = true;
-
-+ /* Ensure that posting buffers is the last thing done by this
-+ * routine to avoid racing between rx bottom-half and
-+ * be_worker (process) contexts.
-+ */
- if (posted) {
- atomic_add(posted, &rxq->used);
- be_rxq_notify(adapter, rxq->id, posted);
- } else if (atomic_read(&rxq->used) == 0) {
- /* Let be_worker replenish when memory is available */
-- adapter->rx_post_starved = true;
-+ rxo->rx_post_starved = true;
- }
-
- return;
-@@ -972,6 +1577,7 @@ static struct be_eth_tx_compl *be_tx_compl_get(struct be_queue_info *tx_cq)
- if (txcp->dw[offsetof(struct amap_eth_tx_compl, valid) / 32] == 0)
- return NULL;
-
-+ rmb();
- be_dws_le_to_cpu(txcp, sizeof(*txcp));
-
- txcp->dw[offsetof(struct amap_eth_tx_compl, valid) / 32] = 0;
-@@ -980,11 +1586,14 @@ static struct be_eth_tx_compl *be_tx_compl_get(struct be_queue_info *tx_cq)
- return txcp;
- }
-
--static void be_tx_compl_process(struct be_adapter *adapter, u16 last_index)
-+static u16 be_tx_compl_process(struct be_adapter *adapter,
-+ struct be_tx_obj *txo, u16 last_index)
- {
-- struct be_queue_info *txq = &adapter->tx_obj.q;
-- struct sk_buff **sent_skbs = adapter->tx_obj.sent_skb_list;
-+ struct be_queue_info *txq = &txo->q;
-+ struct be_eth_wrb *wrb;
-+ struct sk_buff **sent_skbs = txo->sent_skb_list;
- struct sk_buff *sent_skb;
-+ u64 busaddr;
- u16 cur_index, num_wrbs = 0;
-
- cur_index = txq->tail;
-@@ -992,15 +1601,31 @@ static void be_tx_compl_process(struct be_adapter *adapter, u16 last_index)
- BUG_ON(!sent_skb);
- sent_skbs[cur_index] = NULL;
-
-- do {
-+ wrb = queue_tail_node(txq);
-+ be_dws_le_to_cpu(wrb, sizeof(*wrb));
-+ busaddr = ((u64)wrb->frag_pa_hi << 32) | (u64)wrb->frag_pa_lo;
-+ if (busaddr != 0) {
-+ pci_unmap_single(adapter->pdev, busaddr,
-+ wrb->frag_len, PCI_DMA_TODEVICE);
-+ }
-+ num_wrbs++;
-+ queue_tail_inc(txq);
-+
-+ while (cur_index != last_index) {
- cur_index = txq->tail;
-+ wrb = queue_tail_node(txq);
-+ be_dws_le_to_cpu(wrb, sizeof(*wrb));
-+ busaddr = ((u64)wrb->frag_pa_hi << 32) | (u64)wrb->frag_pa_lo;
-+ if (busaddr != 0) {
-+ pci_unmap_page(adapter->pdev, busaddr,
-+ wrb->frag_len, PCI_DMA_TODEVICE);
-+ }
- num_wrbs++;
- queue_tail_inc(txq);
-- } while (cur_index != last_index);
-+ }
-
-- atomic_sub(num_wrbs, &txq->used);
-- skb_dma_unmap(&adapter->pdev->dev, sent_skb, DMA_TO_DEVICE);
- kfree_skb(sent_skb);
-+ return num_wrbs;
- }
-
- static inline struct be_eq_entry *event_get(struct be_eq_obj *eq_obj)
-@@ -1010,13 +1635,15 @@ static inline struct be_eq_entry *event_get(struct be_eq_obj *eq_obj)
- if (!eqe->evt)
- return NULL;
-
-+ rmb();
- eqe->evt = le32_to_cpu(eqe->evt);
- queue_tail_inc(&eq_obj->q);
- return eqe;
- }
-
- static int event_handle(struct be_adapter *adapter,
-- struct be_eq_obj *eq_obj)
-+ struct be_eq_obj *eq_obj,
-+ bool rearm)
- {
- struct be_eq_entry *eqe;
- u16 num = 0;
-@@ -1029,7 +1656,10 @@ static int event_handle(struct be_adapter *adapter,
- /* Deal with any spurious interrupts that come
- * without events
- */
-- be_eq_notify(adapter, eq_obj->q.id, true, true, num);
-+ if (!num)
-+ rearm = true;
-+
-+ be_eq_notify(adapter, eq_obj->q.id, rearm, true, num);
- if (num)
- napi_schedule(&eq_obj->napi);
-
-@@ -1053,49 +1683,55 @@ static void be_eq_clean(struct be_adapter *adapter,
- be_eq_notify(adapter, eq_obj->q.id, false, true, num);
- }
-
--static void be_rx_q_clean(struct be_adapter *adapter)
-+static void be_rx_q_clean(struct be_adapter *adapter, struct be_rx_obj *rxo)
- {
- struct be_rx_page_info *page_info;
-- struct be_queue_info *rxq = &adapter->rx_obj.q;
-- struct be_queue_info *rx_cq = &adapter->rx_obj.cq;
-- struct be_eth_rx_compl *rxcp;
-+ struct be_queue_info *rxq = &rxo->q;
-+ struct be_queue_info *rx_cq = &rxo->cq;
-+ struct be_rx_compl_info *rxcp;
- u16 tail;
-
- /* First cleanup pending rx completions */
-- while ((rxcp = be_rx_compl_get(adapter)) != NULL) {
-- be_rx_compl_discard(adapter, rxcp);
-- be_rx_compl_reset(rxcp);
-+ while ((rxcp = be_rx_compl_get(rxo)) != NULL) {
-+ be_rx_compl_discard(adapter, rxo, rxcp);
- be_cq_notify(adapter, rx_cq->id, true, 1);
- }
-
- /* Then free posted rx buffer that were not used */
- tail = (rxq->head + rxq->len - atomic_read(&rxq->used)) % rxq->len;
- for (; atomic_read(&rxq->used) > 0; index_inc(&tail, rxq->len)) {
-- page_info = get_rx_page_info(adapter, tail);
-+ page_info = get_rx_page_info(adapter, rxo, tail);
- put_page(page_info->page);
- memset(page_info, 0, sizeof(*page_info));
- }
- BUG_ON(atomic_read(&rxq->used));
-+ rxq->tail = rxq->head = 0;
- }
-
--static void be_tx_compl_clean(struct be_adapter *adapter)
-+static void be_tx_compl_clean(struct be_adapter *adapter,
-+ struct be_tx_obj *txo)
- {
-- struct be_queue_info *tx_cq = &adapter->tx_obj.cq;
-- struct be_queue_info *txq = &adapter->tx_obj.q;
-+ struct be_queue_info *tx_cq = &txo->cq;
-+ struct be_queue_info *txq = &txo->q;
- struct be_eth_tx_compl *txcp;
-- u16 end_idx, cmpl = 0, timeo = 0;
-+ u16 end_idx, cmpl = 0, timeo = 0, num_wrbs = 0;
-+ struct sk_buff **sent_skbs = txo->sent_skb_list;
-+ struct sk_buff *sent_skb;
-+ bool dummy_wrb;
-
- /* Wait for a max of 200ms for all the tx-completions to arrive. */
- do {
- while ((txcp = be_tx_compl_get(tx_cq))) {
- end_idx = AMAP_GET_BITS(struct amap_eth_tx_compl,
- wrb_index, txcp);
-- be_tx_compl_process(adapter, end_idx);
-+ num_wrbs += be_tx_compl_process(adapter, txo, end_idx);
- cmpl++;
- }
- if (cmpl) {
- be_cq_notify(adapter, tx_cq->id, false, cmpl);
-+ atomic_sub(num_wrbs, &txq->used);
- cmpl = 0;
-+ num_wrbs = 0;
- }
-
- if (atomic_read(&txq->used) == 0 || ++timeo > 200)
-@@ -1107,6 +1743,17 @@ static void be_tx_compl_clean(struct be_adapter *adapter)
- if (atomic_read(&txq->used))
- dev_err(&adapter->pdev->dev, "%d pending tx-completions\n",
- atomic_read(&txq->used));
-+
-+ /* free posted tx for which compls will never arrive */
-+ while (atomic_read(&txq->used)) {
-+ sent_skb = sent_skbs[txq->tail];
-+ end_idx = txq->tail;
-+ index_adv(&end_idx,
-+ wrb_cnt_for_skb(adapter, sent_skb, &dummy_wrb) - 1,
-+ txq->len);
-+ num_wrbs = be_tx_compl_process(adapter, txo, end_idx);
-+ atomic_sub(num_wrbs, &txq->used);
-+ }
- }
-
- static void be_mcc_queues_destroy(struct be_adapter *adapter)
-@@ -1145,8 +1792,9 @@ static int be_mcc_queues_create(struct be_adapter *adapter)
- goto mcc_cq_destroy;
-
- /* Ask BE to create MCC queue */
-- if (be_cmd_mccq_create(adapter, q, cq))
-+ if (be_cmd_mccq_create(adapter, q, cq)) {
- goto mcc_q_free;
-+ }
-
- return 0;
-
-@@ -1163,16 +1811,20 @@ err:
- static void be_tx_queues_destroy(struct be_adapter *adapter)
- {
- struct be_queue_info *q;
-+ struct be_tx_obj *txo;
-+ u8 i;
-
-- q = &adapter->tx_obj.q;
-- if (q->created)
-- be_cmd_q_destroy(adapter, q, QTYPE_TXQ);
-- be_queue_free(adapter, q);
-+ for_all_tx_queues(adapter, txo, i) {
-+ q = &txo->q;
-+ if (q->created)
-+ be_cmd_q_destroy(adapter, q, QTYPE_TXQ);
-+ be_queue_free(adapter, q);
-
-- q = &adapter->tx_obj.cq;
-- if (q->created)
-- be_cmd_q_destroy(adapter, q, QTYPE_CQ);
-- be_queue_free(adapter, q);
-+ q = &txo->cq;
-+ if (q->created)
-+ be_cmd_q_destroy(adapter, q, QTYPE_CQ);
-+ be_queue_free(adapter, q);
-+ }
-
- /* Clear any residual events */
- be_eq_clean(adapter, &adapter->tx_eq);
-@@ -1183,168 +1835,210 @@ static void be_tx_queues_destroy(struct be_adapter *adapter)
- be_queue_free(adapter, q);
- }
-
-+/* One TX event queue is shared by all TX compl qs */
- static int be_tx_queues_create(struct be_adapter *adapter)
- {
- struct be_queue_info *eq, *q, *cq;
-+ struct be_tx_obj *txo;
-+ u8 i, tc_id;
-
- adapter->tx_eq.max_eqd = 0;
- adapter->tx_eq.min_eqd = 0;
- adapter->tx_eq.cur_eqd = 96;
- adapter->tx_eq.enable_aic = false;
-- /* Alloc Tx Event queue */
-+
- eq = &adapter->tx_eq.q;
-- if (be_queue_alloc(adapter, eq, EVNT_Q_LEN, sizeof(struct be_eq_entry)))
-+ if (be_queue_alloc(adapter, eq, EVNT_Q_LEN,
-+ sizeof(struct be_eq_entry)))
- return -1;
-
-- /* Ask BE to create Tx Event queue */
- if (be_cmd_eq_create(adapter, eq, adapter->tx_eq.cur_eqd))
-- goto tx_eq_free;
-- /* Alloc TX eth compl queue */
-- cq = &adapter->tx_obj.cq;
-- if (be_queue_alloc(adapter, cq, TX_CQ_LEN,
-+ goto err;
-+ adapter->tx_eq.eq_idx = adapter->eq_next_idx++;
-+
-+ for_all_tx_queues(adapter, txo, i) {
-+ cq = &txo->cq;
-+ if (be_queue_alloc(adapter, cq, TX_CQ_LEN,
- sizeof(struct be_eth_tx_compl)))
-- goto tx_eq_destroy;
-+ goto err;
-
-- /* Ask BE to create Tx eth compl queue */
-- if (be_cmd_cq_create(adapter, cq, eq, false, false, 3))
-- goto tx_cq_free;
-+ if (be_cmd_cq_create(adapter, cq, eq, false, false, 3))
-+ goto err;
-
-- /* Alloc TX eth queue */
-- q = &adapter->tx_obj.q;
-- if (be_queue_alloc(adapter, q, TX_Q_LEN, sizeof(struct be_eth_wrb)))
-- goto tx_cq_destroy;
-+ q = &txo->q;
-+ if (be_queue_alloc(adapter, q, TX_Q_LEN,
-+ sizeof(struct be_eth_wrb)))
-+ goto err;
-
-- /* Ask BE to create Tx eth queue */
-- if (be_cmd_txq_create(adapter, q, cq))
-- goto tx_q_free;
-+ if (be_cmd_txq_create(adapter, q, cq, &tc_id))
-+ goto err;
-+
-+ if (adapter->flags & BE_FLAGS_DCBX)
-+ adapter->tc_txq_map[tc_id] = i;
-+ }
- return 0;
-
--tx_q_free:
-- be_queue_free(adapter, q);
--tx_cq_destroy:
-- be_cmd_q_destroy(adapter, cq, QTYPE_CQ);
--tx_cq_free:
-- be_queue_free(adapter, cq);
--tx_eq_destroy:
-- be_cmd_q_destroy(adapter, eq, QTYPE_EQ);
--tx_eq_free:
-- be_queue_free(adapter, eq);
-+err:
-+ be_tx_queues_destroy(adapter);
- return -1;
- }
-
- static void be_rx_queues_destroy(struct be_adapter *adapter)
- {
- struct be_queue_info *q;
-+ struct be_rx_obj *rxo;
-+ int i;
-
-- q = &adapter->rx_obj.q;
-- if (q->created) {
-- be_cmd_q_destroy(adapter, q, QTYPE_RXQ);
-- be_rx_q_clean(adapter);
-- }
-- be_queue_free(adapter, q);
-+ for_all_rx_queues(adapter, rxo, i) {
-+ be_queue_free(adapter, &rxo->q);
-+
-+ q = &rxo->cq;
-+ if (q->created)
-+ be_cmd_q_destroy(adapter, q, QTYPE_CQ);
-+ be_queue_free(adapter, q);
-
-- q = &adapter->rx_obj.cq;
-- if (q->created)
-- be_cmd_q_destroy(adapter, q, QTYPE_CQ);
-- be_queue_free(adapter, q);
-+ q = &rxo->rx_eq.q;
-+ if (q->created)
-+ be_cmd_q_destroy(adapter, q, QTYPE_EQ);
-+ be_queue_free(adapter, q);
-
-- /* Clear any residual events */
-- be_eq_clean(adapter, &adapter->rx_eq);
-+ kfree(rxo->page_info_tbl);
-+ }
-+}
-
-- q = &adapter->rx_eq.q;
-- if (q->created)
-- be_cmd_q_destroy(adapter, q, QTYPE_EQ);
-- be_queue_free(adapter, q);
-+/* Is BE in a multi-channel mode */
-+static inline bool be_is_mc(struct be_adapter *adapter) {
-+ return (adapter->function_mode & FLEX10_MODE ||
-+ adapter->function_mode & VNIC_MODE ||
-+ adapter->function_mode & UMC_ENABLED);
-+}
-+
-+static u32 be_num_rxqs_want(struct be_adapter *adapter)
-+{
-+ if (multi_rxq && (adapter->function_caps & BE_FUNCTION_CAPS_RSS) &&
-+ adapter->num_vfs == 0 && be_physfn(adapter) &&
-+ !be_is_mc(adapter)) {
-+ return 1 + MAX_RSS_QS; /* one default non-RSS queue */
-+ } else {
-+ dev_warn(&adapter->pdev->dev,
-+ "No support for multiple RX queues\n");
-+ return 1;
-+ }
- }
-
- static int be_rx_queues_create(struct be_adapter *adapter)
- {
- struct be_queue_info *eq, *q, *cq;
-- int rc;
-+ struct be_rx_obj *rxo;
-+ int rc, i;
-
-+ adapter->num_rx_qs = min(be_num_rxqs_want(adapter),
-+ msix_enabled(adapter) ?
-+ adapter->num_msix_vec - 1 : 1);
-+ if (adapter->num_rx_qs != MAX_RX_QS)
-+ dev_warn(&adapter->pdev->dev,
-+ "Could create only %d receive queues",
-+ adapter->num_rx_qs);
-+
-+ adapter->max_rx_coal = gro ? BE_INIT_FRAGS_PER_FRAME : 1;
- adapter->big_page_size = (1 << get_order(rx_frag_size)) * PAGE_SIZE;
-- adapter->rx_eq.max_eqd = BE_MAX_EQD;
-- adapter->rx_eq.min_eqd = 0;
-- adapter->rx_eq.cur_eqd = 0;
-- adapter->rx_eq.enable_aic = true;
-+ for_all_rx_queues(adapter, rxo, i) {
-+ rxo->adapter = adapter;
-+ rxo->rx_eq.max_eqd = BE_MAX_EQD;
-+ rxo->rx_eq.enable_aic = true;
-
-- /* Alloc Rx Event queue */
-- eq = &adapter->rx_eq.q;
-- rc = be_queue_alloc(adapter, eq, EVNT_Q_LEN,
-- sizeof(struct be_eq_entry));
-- if (rc)
-- return rc;
-+ /* EQ */
-+ eq = &rxo->rx_eq.q;
-+ rc = be_queue_alloc(adapter, eq, EVNT_Q_LEN,
-+ sizeof(struct be_eq_entry));
-+ if (rc)
-+ goto err;
-
-- /* Ask BE to create Rx Event queue */
-- rc = be_cmd_eq_create(adapter, eq, adapter->rx_eq.cur_eqd);
-- if (rc)
-- goto rx_eq_free;
-+ rc = be_cmd_eq_create(adapter, eq, rxo->rx_eq.cur_eqd);
-+ if (rc)
-+ goto err;
-
-- /* Alloc RX eth compl queue */
-- cq = &adapter->rx_obj.cq;
-- rc = be_queue_alloc(adapter, cq, RX_CQ_LEN,
-- sizeof(struct be_eth_rx_compl));
-- if (rc)
-- goto rx_eq_destroy;
-+ rxo->rx_eq.eq_idx = adapter->eq_next_idx++;
-
-- /* Ask BE to create Rx eth compl queue */
-- rc = be_cmd_cq_create(adapter, cq, eq, false, false, 3);
-- if (rc)
-- goto rx_cq_free;
-+ /* CQ */
-+ cq = &rxo->cq;
-+ rc = be_queue_alloc(adapter, cq, RX_CQ_LEN,
-+ sizeof(struct be_eth_rx_compl));
-+ if (rc)
-+ goto err;
-
-- /* Alloc RX eth queue */
-- q = &adapter->rx_obj.q;
-- rc = be_queue_alloc(adapter, q, RX_Q_LEN, sizeof(struct be_eth_rx_d));
-- if (rc)
-- goto rx_cq_destroy;
-+ rc = be_cmd_cq_create(adapter, cq, eq, false, false, 3);
-+ if (rc)
-+ goto err;
-
-- /* Ask BE to create Rx eth queue */
-- rc = be_cmd_rxq_create(adapter, q, cq->id, rx_frag_size,
-- BE_MAX_JUMBO_FRAME_SIZE, adapter->if_handle, false);
-- if (rc)
-- goto rx_q_free;
-+ /* Rx Q - will be created in be_open() */
-+ q = &rxo->q;
-+ rc = be_queue_alloc(adapter, q, RX_Q_LEN,
-+ sizeof(struct be_eth_rx_d));
-+ if (rc)
-+ goto err;
-+
-+ rxo->page_info_tbl = kzalloc(sizeof(struct be_rx_page_info) *
-+ RX_Q_LEN, GFP_KERNEL);
-+ if (!rxo->page_info_tbl)
-+ goto err;
-+ }
-
- return 0;
--rx_q_free:
-- be_queue_free(adapter, q);
--rx_cq_destroy:
-- be_cmd_q_destroy(adapter, cq, QTYPE_CQ);
--rx_cq_free:
-- be_queue_free(adapter, cq);
--rx_eq_destroy:
-- be_cmd_q_destroy(adapter, eq, QTYPE_EQ);
--rx_eq_free:
-- be_queue_free(adapter, eq);
-- return rc;
-+err:
-+ be_rx_queues_destroy(adapter);
-+ return -1;
- }
-
--/* There are 8 evt ids per func. Retruns the evt id's bit number */
--static inline int be_evt_bit_get(struct be_adapter *adapter, u32 eq_id)
-+static bool event_peek(struct be_eq_obj *eq_obj)
- {
-- return eq_id - 8 * be_pci_func(adapter);
-+ struct be_eq_entry *eqe = queue_tail_node(&eq_obj->q);
-+ if (!eqe->evt)
-+ return false;
-+ else
-+ return true;
- }
-
- static irqreturn_t be_intx(int irq, void *dev)
- {
- struct be_adapter *adapter = dev;
-- int isr;
-+ struct be_rx_obj *rxo;
-+ int isr, i, tx = 0 , rx = 0;
-
-- isr = ioread32(adapter->csr + CEV_ISR0_OFFSET +
-- be_pci_func(adapter) * CEV_ISR_SIZE);
-- if (!isr)
-- return IRQ_NONE;
-+ if (lancer_chip(adapter)) {
-+ if (event_peek(&adapter->tx_eq))
-+ tx = event_handle(adapter, &adapter->tx_eq, false);
-+ for_all_rx_queues(adapter, rxo, i) {
-+ if (event_peek(&rxo->rx_eq))
-+ rx |= event_handle(adapter, &rxo->rx_eq, true);
-+ }
-
-- event_handle(adapter, &adapter->tx_eq);
-- event_handle(adapter, &adapter->rx_eq);
-+ if (!(tx || rx))
-+ return IRQ_NONE;
-+ } else {
-+ isr = ioread32(adapter->csr + CEV_ISR0_OFFSET +
-+ (adapter->tx_eq.q.id / 8) * CEV_ISR_SIZE);
-+ if (!isr)
-+ return IRQ_NONE;
-+
-+ if ((1 << adapter->tx_eq.eq_idx & isr))
-+ event_handle(adapter, &adapter->tx_eq, false);
-+
-+ for_all_rx_queues(adapter, rxo, i) {
-+ if ((1 << rxo->rx_eq.eq_idx & isr))
-+ event_handle(adapter, &rxo->rx_eq, true);
-+ }
-+ }
-
- return IRQ_HANDLED;
- }
-
- static irqreturn_t be_msix_rx(int irq, void *dev)
- {
-- struct be_adapter *adapter = dev;
-+ struct be_rx_obj *rxo = dev;
-+ struct be_adapter *adapter = rxo->adapter;
-
-- event_handle(adapter, &adapter->rx_eq);
-+ event_handle(adapter, &rxo->rx_eq, true);
-
- return IRQ_HANDLED;
- }
-@@ -1353,48 +2047,72 @@ static irqreturn_t be_msix_tx_mcc(int irq, void *dev)
- {
- struct be_adapter *adapter = dev;
-
-- event_handle(adapter, &adapter->tx_eq);
-+ event_handle(adapter, &adapter->tx_eq, false);
-
- return IRQ_HANDLED;
- }
-
- static inline bool do_gro(struct be_adapter *adapter,
-- struct be_eth_rx_compl *rxcp)
-+ struct be_rx_compl_info *rxcp)
- {
-- int err = AMAP_GET_BITS(struct amap_eth_rx_compl, err, rxcp);
-- int tcp_frame = AMAP_GET_BITS(struct amap_eth_rx_compl, tcpf, rxcp);
--
-- if (err)
-- drvr_stats(adapter)->be_rxcp_err++;
--
-- return (tcp_frame && !err) ? true : false;
-+ return (!rxcp->tcpf || rxcp->err || adapter->max_rx_coal <= 1 ||
-+ (rxcp->vlanf && !vlan_configured(adapter))) ?
-+ false : true;
- }
-
- int be_poll_rx(struct napi_struct *napi, int budget)
- {
- struct be_eq_obj *rx_eq = container_of(napi, struct be_eq_obj, napi);
-- struct be_adapter *adapter =
-- container_of(rx_eq, struct be_adapter, rx_eq);
-- struct be_queue_info *rx_cq = &adapter->rx_obj.cq;
-- struct be_eth_rx_compl *rxcp;
-+ struct be_rx_obj *rxo = container_of(rx_eq, struct be_rx_obj, rx_eq);
-+ struct be_adapter *adapter = rxo->adapter;
-+ struct be_queue_info *rx_cq = &rxo->cq;
-+ struct be_rx_compl_info *rxcp;
- u32 work_done;
-+ bool flush_lro = false;
-
-+ rxo->stats.rx_polls++;
- for (work_done = 0; work_done < budget; work_done++) {
-- rxcp = be_rx_compl_get(adapter);
-+ rxcp = be_rx_compl_get(rxo);
- if (!rxcp)
- break;
-
-- if (do_gro(adapter, rxcp))
-- be_rx_compl_process_gro(adapter, rxcp);
-- else
-- be_rx_compl_process(adapter, rxcp);
-+ /* Is it a flush compl that has no data */
-+ if (unlikely(rxcp->num_rcvd == 0))
-+ continue;
-
-- be_rx_compl_reset(rxcp);
-+ if (unlikely(rxcp->port != adapter->port_num)) {
-+ be_rx_compl_discard(adapter, rxo, rxcp);
-+ be_rx_stats_update(rxo, rxcp);
-+ continue;
-+ }
-+
-+ if (likely((lancer_A0_chip(adapter) && !rxcp->err) ||
-+ !lancer_A0_chip(adapter))) {
-+ if (do_gro(adapter, rxcp)) {
-+ if (adapter->gro_supported) {
-+ be_rx_compl_process_gro(adapter, rxo,
-+ rxcp);
-+ } else {
-+ be_rx_compl_process_lro(adapter, rxo,
-+ rxcp);
-+ flush_lro = true;
-+ }
-+ } else {
-+ be_rx_compl_process(adapter, rxo, rxcp);
-+ }
-+ } else if (lancer_A0_chip(adapter) && rxcp->err) {
-+ be_rx_compl_discard(adapter, rxo, rxcp);
-+ }
-+
-+ be_rx_stats_update(rxo, rxcp);
- }
-
-+ if (flush_lro)
-+ lro_flush_all(&rxo->lro_mgr);
-+
- /* Refill the queue */
-- if (atomic_read(&adapter->rx_obj.q.used) < RX_FRAGS_REFILL_WM)
-- be_post_rx_frags(adapter);
-+ if (work_done && atomic_read(&rxo->q.used) < RX_FRAGS_REFILL_WM)
-+ be_post_rx_frags(rxo);
-
- /* All consumed */
- if (work_done < budget) {
-@@ -1404,40 +2122,13 @@ int be_poll_rx(struct napi_struct *napi, int budget)
- /* More to be consumed; continue with interrupts disabled */
- be_cq_notify(adapter, rx_cq->id, false, work_done);
- }
-+
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 32)
-+ adapter->netdev->last_rx = jiffies;
-+#endif
- return work_done;
- }
-
--void be_process_tx(struct be_adapter *adapter)
--{
-- struct be_queue_info *txq = &adapter->tx_obj.q;
-- struct be_queue_info *tx_cq = &adapter->tx_obj.cq;
-- struct be_eth_tx_compl *txcp;
-- u32 num_cmpl = 0;
-- u16 end_idx;
--
-- while ((txcp = be_tx_compl_get(tx_cq))) {
-- end_idx = AMAP_GET_BITS(struct amap_eth_tx_compl,
-- wrb_index, txcp);
-- be_tx_compl_process(adapter, end_idx);
-- num_cmpl++;
-- }
--
-- if (num_cmpl) {
-- be_cq_notify(adapter, tx_cq->id, true, num_cmpl);
--
-- /* As Tx wrbs have been freed up, wake up netdev queue if
-- * it was stopped due to lack of tx wrbs.
-- */
-- if (netif_queue_stopped(adapter->netdev) &&
-- atomic_read(&txq->used) < txq->len / 2) {
-- netif_wake_queue(adapter->netdev);
-- }
--
-- drvr_stats(adapter)->be_tx_events++;
-- drvr_stats(adapter)->be_tx_compl += num_cmpl;
-- }
--}
--
- /* As TX and MCC share the same EQ check for both TX and MCC completions.
- * For TX/MCC we don't honour budget; consume everything
- */
-@@ -1446,96 +2137,264 @@ static int be_poll_tx_mcc(struct napi_struct *napi, int budget)
- struct be_eq_obj *tx_eq = container_of(napi, struct be_eq_obj, napi);
- struct be_adapter *adapter =
- container_of(tx_eq, struct be_adapter, tx_eq);
-+ struct be_tx_obj *txo;
-+ struct be_eth_tx_compl *txcp;
-+ int tx_compl, mcc_compl, status = 0;
-+ u8 i;
-+ u16 num_wrbs;
-+
-+ for_all_tx_queues(adapter, txo, i) {
-+ tx_compl = 0;
-+ num_wrbs = 0;
-+ while ((txcp = be_tx_compl_get(&txo->cq))) {
-+ num_wrbs += be_tx_compl_process(adapter, txo,
-+ AMAP_GET_BITS(struct amap_eth_tx_compl,
-+ wrb_index, txcp));
-+ tx_compl++;
-+ }
-+ if (tx_compl) {
-+ be_cq_notify(adapter, txo->cq.id, true, tx_compl);
-+
-+ atomic_sub(num_wrbs, &txo->q.used);
-+
-+ /* As Tx wrbs have been freed up, wake up netdev queue
-+ * if it was stopped due to lack of tx wrbs. */
-+ if (__netif_subqueue_stopped(adapter->netdev, i) &&
-+ atomic_read(&txo->q.used) < txo->q.len / 2) {
-+ netif_wake_subqueue(adapter->netdev, i);
-+ }
-+
-+ adapter->drv_stats.be_tx_events++;
-+ txo->stats.be_tx_compl += tx_compl;
-+ }
-+ }
-+
-+ mcc_compl = be_process_mcc(adapter, &status);
-+
-+ if (mcc_compl) {
-+ struct be_mcc_obj *mcc_obj = &adapter->mcc_obj;
-+ be_cq_notify(adapter, mcc_obj->cq.id, true, mcc_compl);
-+ }
-
- napi_complete(napi);
-
-- be_process_tx(adapter);
--
-- be_process_mcc(adapter);
--
-+ be_eq_notify(adapter, tx_eq->q.id, true, false, 0);
- return 1;
- }
-
-+void be_detect_dump_ue(struct be_adapter *adapter)
-+{
-+ u32 ue_status_lo, ue_status_hi, ue_status_lo_mask, ue_status_hi_mask;
-+ u32 i;
-+
-+ pci_read_config_dword(adapter->pdev,
-+ PCICFG_UE_STATUS_LOW, &ue_status_lo);
-+ pci_read_config_dword(adapter->pdev,
-+ PCICFG_UE_STATUS_HIGH, &ue_status_hi);
-+ pci_read_config_dword(adapter->pdev,
-+ PCICFG_UE_STATUS_LOW_MASK, &ue_status_lo_mask);
-+ pci_read_config_dword(adapter->pdev,
-+ PCICFG_UE_STATUS_HI_MASK, &ue_status_hi_mask);
-+
-+ ue_status_lo = (ue_status_lo & (~ue_status_lo_mask));
-+ ue_status_hi = (ue_status_hi & (~ue_status_hi_mask));
-+
-+ if (ue_status_lo || ue_status_hi) {
-+ adapter->ue_detected = true;
-+ adapter->eeh_err = true;
-+ dev_err(&adapter->pdev->dev, "UE Detected!!\n");
-+ }
-+
-+ if (ue_status_lo) {
-+ for (i = 0; ue_status_lo; ue_status_lo >>= 1, i++) {
-+ if (ue_status_lo & 1)
-+ dev_err(&adapter->pdev->dev,
-+ "UE: %s bit set\n", ue_status_low_desc[i]);
-+ }
-+ }
-+ if (ue_status_hi) {
-+ for (i = 0; ue_status_hi; ue_status_hi >>= 1, i++) {
-+ if (ue_status_hi & 1)
-+ dev_err(&adapter->pdev->dev,
-+ "UE: %s bit set\n", ue_status_hi_desc[i]);
-+ }
-+ }
-+
-+}
-+
- static void be_worker(struct work_struct *work)
- {
- struct be_adapter *adapter =
- container_of(work, struct be_adapter, work.work);
-+ struct be_rx_obj *rxo;
-+ struct be_tx_obj *txo;
-+ int i;
-
-- be_cmd_get_stats(adapter, &adapter->stats.cmd);
-+ if (!adapter->ue_detected && !lancer_chip(adapter))
-+ be_detect_dump_ue(adapter);
-
-- /* Set EQ delay */
-- be_rx_eqd_update(adapter);
-+ /* when interrupts are not yet enabled, just reap any pending
-+ * mcc completions */
-+ if (!netif_running(adapter->netdev)) {
-+ int mcc_compl, status = 0;
-
-- be_tx_rate_update(adapter);
-- be_rx_rate_update(adapter);
-+ mcc_compl = be_process_mcc(adapter, &status);
-
-- if (adapter->rx_post_starved) {
-- adapter->rx_post_starved = false;
-- be_post_rx_frags(adapter);
-+ if (mcc_compl) {
-+ struct be_mcc_obj *mcc_obj = &adapter->mcc_obj;
-+ be_cq_notify(adapter, mcc_obj->cq.id, false, mcc_compl);
-+ }
-+
-+ goto reschedule;
-+ }
-+
-+ if (!adapter->stats_cmd_sent)
-+ be_cmd_get_stats(adapter, &adapter->stats_cmd);
-+
-+ for_all_tx_queues(adapter, txo, i)
-+ be_tx_rate_update(txo);
-+
-+ for_all_rx_queues(adapter, rxo, i) {
-+ be_rx_rate_update(rxo);
-+ be_rx_eqd_update(adapter, rxo);
-+
-+ if (rxo->rx_post_starved) {
-+ rxo->rx_post_starved = false;
-+ be_post_rx_frags(rxo);
-+ }
- }
-
-+reschedule:
-+ adapter->work_counter++;
- schedule_delayed_work(&adapter->work, msecs_to_jiffies(1000));
- }
-
-+static void be_msix_disable(struct be_adapter *adapter)
-+{
-+ if (msix_enabled(adapter)) {
-+ pci_disable_msix(adapter->pdev);
-+ adapter->num_msix_vec = 0;
-+ }
-+}
-+
- static void be_msix_enable(struct be_adapter *adapter)
- {
-- int i, status;
-+#define BE_MIN_MSIX_VECTORS (1 + 1) /* Rx + Tx */
-+ int i, status, num_vec;
-
-- for (i = 0; i < BE_NUM_MSIX_VECTORS; i++)
-+ num_vec = be_num_rxqs_want(adapter) + 1;
-+
-+ for (i = 0; i < num_vec; i++)
- adapter->msix_entries[i].entry = i;
-
-- status = pci_enable_msix(adapter->pdev, adapter->msix_entries,
-- BE_NUM_MSIX_VECTORS);
-- if (status == 0)
-- adapter->msix_enabled = true;
-+ status = pci_enable_msix(adapter->pdev, adapter->msix_entries, num_vec);
-+ if (status == 0) {
-+ goto done;
-+ } else if (status >= BE_MIN_MSIX_VECTORS) {
-+ num_vec = status;
-+ if (pci_enable_msix(adapter->pdev, adapter->msix_entries,
-+ num_vec) == 0)
-+ goto done;
-+ }
- return;
-+done:
-+ adapter->num_msix_vec = num_vec;
-+ return;
-+}
-+
-+static void be_sriov_enable(struct be_adapter *adapter)
-+{
-+ be_check_sriov_fn_type(adapter);
-+#ifdef CONFIG_PCI_IOV
-+ if (be_physfn(adapter) && num_vfs) {
-+ int status, pos;
-+ u16 nvfs;
-+
-+ pos = pci_find_ext_capability(adapter->pdev,
-+ PCI_EXT_CAP_ID_SRIOV);
-+ pci_read_config_word(adapter->pdev,
-+ pos + PCI_SRIOV_TOTAL_VF, &nvfs);
-+ adapter->num_vfs = num_vfs;
-+ if (num_vfs > nvfs) {
-+ dev_info(&adapter->pdev->dev,
-+ "Device supports %d VFs and not %d\n",
-+ nvfs, num_vfs);
-+ adapter->num_vfs = nvfs;
-+ }
-+
-+ status = pci_enable_sriov(adapter->pdev, adapter->num_vfs);
-+ if (status)
-+ adapter->num_vfs = 0;
-+ }
-+#endif
-+}
-+
-+static void be_sriov_disable(struct be_adapter *adapter)
-+{
-+#ifdef CONFIG_PCI_IOV
-+ if (adapter->num_vfs > 0) {
-+ pci_disable_sriov(adapter->pdev);
-+ adapter->num_vfs = 0;
-+ }
-+#endif
- }
-
--static inline int be_msix_vec_get(struct be_adapter *adapter, u32 eq_id)
-+static inline int be_msix_vec_get(struct be_adapter *adapter,
-+ struct be_eq_obj *eq_obj)
- {
-- return adapter->msix_entries[
-- be_evt_bit_get(adapter, eq_id)].vector;
-+ return adapter->msix_entries[eq_obj->eq_idx].vector;
- }
-
- static int be_request_irq(struct be_adapter *adapter,
- struct be_eq_obj *eq_obj,
-- void *handler, char *desc)
-+ void *handler, char *desc, void *context)
- {
- struct net_device *netdev = adapter->netdev;
- int vec;
-
- sprintf(eq_obj->desc, "%s-%s", netdev->name, desc);
-- vec = be_msix_vec_get(adapter, eq_obj->q.id);
-- return request_irq(vec, handler, 0, eq_obj->desc, adapter);
-+ vec = be_msix_vec_get(adapter, eq_obj);
-+ return request_irq(vec, handler, 0, eq_obj->desc, context);
- }
-
--static void be_free_irq(struct be_adapter *adapter, struct be_eq_obj *eq_obj)
-+static void be_free_irq(struct be_adapter *adapter, struct be_eq_obj *eq_obj,
-+ void *context)
- {
-- int vec = be_msix_vec_get(adapter, eq_obj->q.id);
-- free_irq(vec, adapter);
-+ int vec = be_msix_vec_get(adapter, eq_obj);
-+ free_irq(vec, context);
- }
-
- static int be_msix_register(struct be_adapter *adapter)
- {
-- int status;
-+ struct be_rx_obj *rxo;
-+ int status, i;
-+ char qname[10];
-
-- status = be_request_irq(adapter, &adapter->tx_eq, be_msix_tx_mcc, "tx");
-+ status = be_request_irq(adapter, &adapter->tx_eq, be_msix_tx_mcc, "tx",
-+ adapter);
- if (status)
- goto err;
-
-- status = be_request_irq(adapter, &adapter->rx_eq, be_msix_rx, "rx");
-- if (status)
-- goto free_tx_irq;
-+ for_all_rx_queues(adapter, rxo, i) {
-+ sprintf(qname, "rxq%d", i);
-+ status = be_request_irq(adapter, &rxo->rx_eq, be_msix_rx,
-+ qname, rxo);
-+ if (status)
-+ goto err_msix;
-+ }
-
- return 0;
-
--free_tx_irq:
-- be_free_irq(adapter, &adapter->tx_eq);
-+err_msix:
-+ be_free_irq(adapter, &adapter->tx_eq, adapter);
-+
-+ for (i--, rxo = &adapter->rx_obj[i]; i >= 0; i--, rxo--)
-+ be_free_irq(adapter, &rxo->rx_eq, rxo);
-+
- err:
- dev_warn(&adapter->pdev->dev,
- "MSIX Request IRQ failed - err %d\n", status);
-- pci_disable_msix(adapter->pdev);
-- adapter->msix_enabled = false;
-+ be_msix_disable(adapter);
- return status;
- }
-
-@@ -1544,10 +2403,13 @@ static int be_irq_register(struct be_adapter *adapter)
- struct net_device *netdev = adapter->netdev;
- int status;
-
-- if (adapter->msix_enabled) {
-+ if (msix_enabled(adapter)) {
- status = be_msix_register(adapter);
- if (status == 0)
- goto done;
-+ /* INTx is not supported for VF */
-+ if (!be_physfn(adapter))
-+ return status;
- }
-
- /* INTx */
-@@ -1567,87 +2429,363 @@ done:
- static void be_irq_unregister(struct be_adapter *adapter)
- {
- struct net_device *netdev = adapter->netdev;
-+ struct be_rx_obj *rxo;
-+ int i;
-
- if (!adapter->isr_registered)
- return;
-
- /* INTx */
-- if (!adapter->msix_enabled) {
-+ if (!msix_enabled(adapter)) {
- free_irq(netdev->irq, adapter);
- goto done;
- }
-
- /* MSIx */
-- be_free_irq(adapter, &adapter->tx_eq);
-- be_free_irq(adapter, &adapter->rx_eq);
-+ be_free_irq(adapter, &adapter->tx_eq, adapter);
-+
-+ for_all_rx_queues(adapter, rxo, i)
-+ be_free_irq(adapter, &rxo->rx_eq, rxo);
-+
- done:
- adapter->isr_registered = false;
-- return;
- }
-
--static int be_open(struct net_device *netdev)
-+static u16 be_select_queue(struct net_device *netdev,
-+ struct sk_buff *skb)
- {
- struct be_adapter *adapter = netdev_priv(netdev);
-- struct be_eq_obj *rx_eq = &adapter->rx_eq;
-+ u8 prio;
-+
-+ if (adapter->num_tx_qs == 1)
-+ return 0;
-+
-+ prio = (vlan_tx_tag_get(skb) & VLAN_PRIO_MASK) >> VLAN_PRIO_SHIFT;
-+ return adapter->tc_txq_map[adapter->prio_tc_map[prio]];
-+}
-+
-+static void be_rx_queues_clear(struct be_adapter *adapter)
-+{
-+ struct be_queue_info *q;
-+ struct be_rx_obj *rxo;
-+ int i;
-+
-+ for_all_rx_queues(adapter, rxo, i) {
-+ q = &rxo->q;
-+ if (q->created) {
-+ be_cmd_rxq_destroy(adapter, q);
-+ /* After the rxq is invalidated, wait for a grace time
-+ * of 1ms for all dma to end and the flush compl to
-+ * arrive
-+ */
-+ mdelay(1);
-+ be_rx_q_clean(adapter, rxo);
-+ }
-+
-+ /* Clear any residual events */
-+ q = &rxo->rx_eq.q;
-+ if (q->created)
-+ be_eq_clean(adapter, &rxo->rx_eq);
-+ }
-+}
-+
-+static int be_close(struct net_device *netdev)
-+{
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+ struct be_rx_obj *rxo;
-+ struct be_tx_obj *txo;
- struct be_eq_obj *tx_eq = &adapter->tx_eq;
-- bool link_up;
-- int status;
-+ int vec, i;
-+
-+ be_async_mcc_disable(adapter);
-+
-+ netif_stop_queue(netdev);
-+ netif_carrier_off(netdev);
-+ adapter->link_status = LINK_DOWN;
-+
-+ if (!lancer_chip(adapter))
-+ be_intr_set(adapter, false);
-+
-+ for_all_rx_queues(adapter, rxo, i)
-+ napi_disable(&rxo->rx_eq.napi);
-+
-+ napi_disable(&tx_eq->napi);
-+
-+ if (lancer_chip(adapter)) {
-+ be_cq_notify(adapter, adapter->mcc_obj.cq.id, false, 0);
-+ for_all_rx_queues(adapter, rxo, i)
-+ be_cq_notify(adapter, rxo->cq.id, false, 0);
-+ for_all_tx_queues(adapter, txo, i)
-+ be_cq_notify(adapter, txo->cq.id, false, 0);
-+ }
-+
-+ if (msix_enabled(adapter)) {
-+ vec = be_msix_vec_get(adapter, tx_eq);
-+ synchronize_irq(vec);
-+
-+ for_all_rx_queues(adapter, rxo, i) {
-+ vec = be_msix_vec_get(adapter, &rxo->rx_eq);
-+ synchronize_irq(vec);
-+ }
-+ } else {
-+ synchronize_irq(netdev->irq);
-+ }
-+ be_irq_unregister(adapter);
-+
-+ /* Wait for all pending tx completions to arrive so that
-+ * all tx skbs are freed.
-+ */
-+ for_all_tx_queues(adapter, txo, i)
-+ be_tx_compl_clean(adapter, txo);
-+
-+ be_rx_queues_clear(adapter);
-+ return 0;
-+}
-+
-+static int be_rx_queues_setup(struct be_adapter *adapter)
-+{
-+ struct be_rx_obj *rxo;
-+ int rc, i;
-+ u8 rsstable[MAX_RSS_QS];
-+
-+ for_all_rx_queues(adapter, rxo, i) {
-+ rc = be_cmd_rxq_create(adapter, &rxo->q, rxo->cq.id,
-+ rx_frag_size, BE_MAX_JUMBO_FRAME_SIZE,
-+ adapter->if_handle,
-+ (i > 0) ? 1 : 0/* rss enable */, &rxo->rss_id);
-+ if (rc)
-+ return rc;
-+ }
-+
-+ if (be_multi_rxq(adapter)) {
-+ for_all_rss_queues(adapter, rxo, i)
-+ rsstable[i] = rxo->rss_id;
-+
-+ rc = be_cmd_rss_config(adapter, rsstable,
-+ adapter->num_rx_qs - 1);
-+ if (rc)
-+ return rc;
-+ }
-
- /* First time posting */
-- be_post_rx_frags(adapter);
-+ for_all_rx_queues(adapter, rxo, i) {
-+ be_post_rx_frags(rxo);
-+ napi_enable(&rxo->rx_eq.napi);
-+ }
-+ return 0;
-+}
-+
-+static int be_open(struct net_device *netdev)
-+{
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+ struct be_eq_obj *tx_eq = &adapter->tx_eq;
-+ struct be_rx_obj *rxo;
-+ int link_status;
-+ int status, i;
-+ u8 mac_speed;
-+ u16 link_speed;
-+
-+ status = be_rx_queues_setup(adapter);
-+ if (status)
-+ goto err;
-
-- napi_enable(&rx_eq->napi);
- napi_enable(&tx_eq->napi);
-
- be_irq_register(adapter);
-
-- be_intr_set(adapter, true);
-+ if (!lancer_chip(adapter))
-+ be_intr_set(adapter, true);
-
- /* The evt queues are created in unarmed state; arm them */
-- be_eq_notify(adapter, rx_eq->q.id, true, false, 0);
-+ for_all_rx_queues(adapter, rxo, i) {
-+ be_eq_notify(adapter, rxo->rx_eq.q.id, true, false, 0);
-+ be_cq_notify(adapter, rxo->cq.id, true, 0);
-+ }
- be_eq_notify(adapter, tx_eq->q.id, true, false, 0);
-
-- /* Rx compl queue may be in unarmed state; rearm it */
-- be_cq_notify(adapter, adapter->rx_obj.cq.id, true, 0);
-+ /* Now that interrupts are on we can process async mcc */
-+ be_async_mcc_enable(adapter);
-
-- status = be_cmd_link_status_query(adapter, &link_up);
-+ status = be_cmd_link_status_query(adapter, &link_status, &mac_speed,
-+ &link_speed, 0);
- if (status)
-- goto ret_sts;
-- be_link_status_update(adapter, link_up);
-+ goto err;
-+ be_link_status_update(adapter, link_status);
-
-- status = be_vid_config(adapter);
-+ status = be_vid_config(adapter, false, 0);
- if (status)
-- goto ret_sts;
-+ goto err;
-
-- status = be_cmd_set_flow_control(adapter,
-- adapter->tx_fc, adapter->rx_fc);
-- if (status)
-- goto ret_sts;
-+ if (be_physfn(adapter)) {
-+ status = be_cmd_set_flow_control(adapter,
-+ adapter->tx_fc, adapter->rx_fc);
-+ if (status)
-+ goto err;
-+ }
-+
-+ return 0;
-+err:
-+ be_close(adapter->netdev);
-+ return -EIO;
-+}
-+
-+static int be_setup_wol(struct be_adapter *adapter, bool enable)
-+{
-+ struct be_dma_mem cmd;
-+ int status = 0;
-+ u8 mac[ETH_ALEN];
-+
-+ memset(mac, 0, ETH_ALEN);
-+
-+ cmd.size = sizeof(struct be_cmd_req_acpi_wol_magic_config);
-+ cmd.va = pci_alloc_consistent(adapter->pdev, cmd.size, &cmd.dma);
-+ if (cmd.va == NULL)
-+ return -1;
-+ memset(cmd.va, 0, cmd.size);
-+
-+ if (enable) {
-+ status = pci_write_config_dword(adapter->pdev,
-+ PCICFG_PM_CONTROL_OFFSET, PCICFG_PM_CONTROL_MASK);
-+ if (status) {
-+ dev_err(&adapter->pdev->dev,
-+ "Could not enable Wake-on-lan\n");
-+ pci_free_consistent(adapter->pdev, cmd.size, cmd.va,
-+ cmd.dma);
-+ return status;
-+ }
-+ status = be_cmd_enable_magic_wol(adapter,
-+ adapter->netdev->dev_addr, &cmd);
-+ pci_enable_wake(adapter->pdev, PCI_D3hot, 1);
-+ pci_enable_wake(adapter->pdev, PCI_D3cold, 1);
-+ } else {
-+ status = be_cmd_enable_magic_wol(adapter, mac, &cmd);
-+ pci_enable_wake(adapter->pdev, PCI_D3hot, 0);
-+ pci_enable_wake(adapter->pdev, PCI_D3cold, 0);
-+ }
-+
-+ pci_free_consistent(adapter->pdev, cmd.size, cmd.va, cmd.dma);
-+ return status;
-+}
-+
-+/*
-+ * Generate a seed MAC address from the PF MAC Address using jhash.
-+ * MAC Address for VFs are assigned incrementally starting from the seed.
-+ * These addresses are programmed in the ASIC by the PF and the VF driver
-+ * queries for the MAC address during its probe.
-+ */
-+static inline int be_vf_eth_addr_config(struct be_adapter *adapter)
-+{
-+ u32 vf = 0;
-+ int status = 0;
-+ u8 mac[ETH_ALEN];
-+
-+ be_vf_eth_addr_generate(adapter, mac);
-+
-+ for (vf = 0; vf < adapter->num_vfs; vf++) {
-+ status = be_cmd_pmac_add(adapter, mac,
-+ adapter->vf_cfg[vf].vf_if_handle,
-+ &adapter->vf_cfg[vf].vf_pmac_id,
-+ vf + 1);
-+ if (status)
-+ dev_err(&adapter->pdev->dev,
-+ "Mac address add failed for VF %d\n", vf);
-+ else
-+ memcpy(adapter->vf_cfg[vf].vf_mac_addr, mac, ETH_ALEN);
-
-- schedule_delayed_work(&adapter->work, msecs_to_jiffies(100));
--ret_sts:
-+ mac[5] += 1;
-+ }
- return status;
- }
-
-+static inline void be_vf_eth_addr_rem(struct be_adapter *adapter)
-+{
-+ u32 vf;
-+
-+ for (vf = 0; vf < adapter->num_vfs; vf++) {
-+ if (adapter->vf_cfg[vf].vf_pmac_id != BE_INVALID_PMAC_ID)
-+ be_cmd_pmac_del(adapter,
-+ adapter->vf_cfg[vf].vf_if_handle,
-+ adapter->vf_cfg[vf].vf_pmac_id, vf + 1);
-+ }
-+}
-+
-+static int be_num_txqs_want(struct be_adapter *adapter)
-+{
-+ if (adapter->num_vfs > 0 || be_is_mc(adapter) ||
-+ lancer_chip(adapter) || !be_physfn(adapter) ||
-+ adapter->generation == BE_GEN2)
-+ return 1;
-+ else
-+ return MAX_TX_QS;
-+}
-+
- static int be_setup(struct be_adapter *adapter)
- {
- struct net_device *netdev = adapter->netdev;
-- u32 cap_flags, en_flags;
-- int status;
--
-- cap_flags = BE_IF_FLAGS_UNTAGGED | BE_IF_FLAGS_BROADCAST |
-- BE_IF_FLAGS_MCAST_PROMISCUOUS |
-- BE_IF_FLAGS_PROMISCUOUS |
-- BE_IF_FLAGS_PASS_L3L4_ERRORS;
-- en_flags = BE_IF_FLAGS_UNTAGGED | BE_IF_FLAGS_BROADCAST |
-- BE_IF_FLAGS_PASS_L3L4_ERRORS;
-+ int status, fw_num_txqs, num_txqs;
-+ u32 cap_flags, en_flags, vf = 0;
-+ u8 mac[ETH_ALEN];
-+
-+ num_txqs = be_num_txqs_want(adapter);
-+ if (num_txqs > 1) {
-+ be_cmd_req_pg_pfc(adapter, &fw_num_txqs);
-+ num_txqs = min(num_txqs, fw_num_txqs);
-+ }
-+ adapter->num_tx_qs = num_txqs;
-+ if (adapter->num_tx_qs != MAX_TX_QS)
-+ netif_set_real_num_tx_queues(adapter->netdev,
-+ adapter->num_tx_qs);
-+
-+ be_cmd_req_native_mode(adapter);
-+
-+ cap_flags = en_flags = BE_IF_FLAGS_UNTAGGED |
-+ BE_IF_FLAGS_BROADCAST |
-+ BE_IF_FLAGS_MULTICAST;
-+
-+ if (be_physfn(adapter)) {
-+ if (adapter->function_caps & BE_FUNCTION_CAPS_RSS) {
-+ cap_flags |= BE_IF_FLAGS_RSS;
-+ en_flags |= BE_IF_FLAGS_RSS;
-+ }
-+ cap_flags |= BE_IF_FLAGS_MCAST_PROMISCUOUS |
-+ BE_IF_FLAGS_PROMISCUOUS;
-+ if (!lancer_A0_chip(adapter)) {
-+ cap_flags |= BE_IF_FLAGS_PASS_L3L4_ERRORS;
-+ en_flags |= BE_IF_FLAGS_PASS_L3L4_ERRORS;
-+ }
-+ }
-
- status = be_cmd_if_create(adapter, cap_flags, en_flags,
- netdev->dev_addr, false/* pmac_invalid */,
-- &adapter->if_handle, &adapter->pmac_id);
-+ &adapter->if_handle, &adapter->pmac_id, 0);
- if (status != 0)
- goto do_none;
-
-+ if (be_physfn(adapter)) {
-+ while (vf < adapter->num_vfs) {
-+ cap_flags = en_flags = BE_IF_FLAGS_UNTAGGED |
-+ BE_IF_FLAGS_BROADCAST;
-+ status = be_cmd_if_create(adapter, cap_flags,
-+ en_flags, mac, true,
-+ &adapter->vf_cfg[vf].vf_if_handle,
-+ NULL, vf+1);
-+ if (status) {
-+ dev_err(&adapter->pdev->dev,
-+ "Interface Create failed for VF %d\n", vf);
-+ goto if_destroy;
-+ }
-+ adapter->vf_cfg[vf].vf_pmac_id = BE_INVALID_PMAC_ID;
-+ vf++;
-+ }
-+ } else {
-+ status = be_cmd_mac_addr_query(adapter, mac,
-+ MAC_ADDRESS_TYPE_NETWORK, false, adapter->if_handle);
-+ if (!status) {
-+ memcpy(adapter->netdev->dev_addr, mac, ETH_ALEN);
-+ memcpy(adapter->netdev->perm_addr, mac, ETH_ALEN);
-+ }
-+ }
-+
- status = be_tx_queues_create(adapter);
- if (status != 0)
- goto if_destroy;
-@@ -1656,10 +2794,15 @@ static int be_setup(struct be_adapter *adapter)
- if (status != 0)
- goto tx_qs_destroy;
-
-+ /* Allow all priorities by default. A GRP5 evt may modify this */
-+ adapter->vlan_prio_bmap = 0xff;
-+
- status = be_mcc_queues_create(adapter);
- if (status != 0)
- goto rx_qs_destroy;
-
-+ adapter->link_speed = -1;
-+
- return 0;
-
- rx_qs_destroy:
-@@ -1667,158 +2810,392 @@ rx_qs_destroy:
- tx_qs_destroy:
- be_tx_queues_destroy(adapter);
- if_destroy:
-- be_cmd_if_destroy(adapter, adapter->if_handle);
-+ if (be_physfn(adapter)) {
-+ for (vf = 0; vf < adapter->num_vfs; vf++)
-+ if (adapter->vf_cfg[vf].vf_if_handle)
-+ be_cmd_if_destroy(adapter,
-+ adapter->vf_cfg[vf].vf_if_handle,
-+ vf + 1);
-+ }
-+ be_cmd_if_destroy(adapter, adapter->if_handle, 0);
- do_none:
- return status;
- }
-
- static int be_clear(struct be_adapter *adapter)
- {
-+ int vf;
-+
-+ if (be_physfn(adapter) && adapter->num_vfs)
-+ be_vf_eth_addr_rem(adapter);
-+
- be_mcc_queues_destroy(adapter);
- be_rx_queues_destroy(adapter);
- be_tx_queues_destroy(adapter);
-+ adapter->eq_next_idx = 0;
-
-- be_cmd_if_destroy(adapter, adapter->if_handle);
-+ if (be_physfn(adapter)) {
-+ for (vf = 0; vf < adapter->num_vfs; vf++)
-+ if (adapter->vf_cfg[vf].vf_if_handle)
-+ be_cmd_if_destroy(adapter,
-+ adapter->vf_cfg[vf].vf_if_handle, vf + 1);
-+ }
-+ be_cmd_if_destroy(adapter, adapter->if_handle, 0);
-
-+ /* tell fw we're done with firing cmds */
-+ be_cmd_fw_clean(adapter);
- return 0;
- }
-
--static int be_close(struct net_device *netdev)
-+static void be_cpy_drv_ver(struct be_adapter *adapter, void *va)
-+{
-+ struct mgmt_controller_attrib *attrib =
-+ (struct mgmt_controller_attrib *) ((u8*) va +
-+ sizeof(struct be_cmd_resp_hdr));
-+
-+ memcpy(attrib->hba_attribs.driver_version_string,
-+ DRV_VER, sizeof(DRV_VER));
-+ attrib->pci_bus_number = adapter->pdev->bus->number;
-+ attrib->pci_device_number = PCI_SLOT(adapter->pdev->devfn);
-+ return;
-+}
-+
-+#define IOCTL_COOKIE "SERVERENGINES CORP"
-+static int be_do_ioctl(struct net_device *netdev,
-+ struct ifreq *ifr, int cmd)
- {
- struct be_adapter *adapter = netdev_priv(netdev);
-- struct be_eq_obj *rx_eq = &adapter->rx_eq;
-- struct be_eq_obj *tx_eq = &adapter->tx_eq;
-- int vec;
-+ struct be_cmd_req_hdr req;
-+ struct be_cmd_resp_hdr *resp;
-+ void *data = ifr->ifr_data;
-+ void *ioctl_ptr;
-+ void *va;
-+ dma_addr_t dma;
-+ u32 req_size;
-+ int status, ret = 0;
-+ u8 cookie[32];
-+
-+ switch (cmd) {
-+ case SIOCDEVPRIVATE:
-+ if (copy_from_user(cookie, data, strlen(IOCTL_COOKIE)))
-+ return -EFAULT;
-+
-+ if (memcmp(cookie, IOCTL_COOKIE, strlen(IOCTL_COOKIE)))
-+ return -EINVAL;
-
-- cancel_delayed_work_sync(&adapter->work);
-+ ioctl_ptr = (u8 *)data + strlen(IOCTL_COOKIE);
-+ if (copy_from_user(&req, ioctl_ptr,
-+ sizeof(struct be_cmd_req_hdr)))
-+ return -EFAULT;
-
-- netif_stop_queue(netdev);
-- netif_carrier_off(netdev);
-- adapter->link_up = false;
-+ req_size = le32_to_cpu(req.request_length);
-+ if (req_size > 65536)
-+ return -EINVAL;
-
-- be_intr_set(adapter, false);
-+ req_size += sizeof(struct be_cmd_req_hdr);
-+ va = pci_alloc_consistent(adapter->pdev, req_size, &dma);
-+ if (!va)
-+ return -ENOMEM;
-+ if (copy_from_user(va, ioctl_ptr, req_size)) {
-+ ret = -EFAULT;
-+ break;
-+ }
-
-- if (adapter->msix_enabled) {
-- vec = be_msix_vec_get(adapter, tx_eq->q.id);
-- synchronize_irq(vec);
-- vec = be_msix_vec_get(adapter, rx_eq->q.id);
-- synchronize_irq(vec);
-- } else {
-- synchronize_irq(netdev->irq);
-+ status = be_cmd_pass_ext_ioctl(adapter, dma, req_size, va);
-+ if (status == -1) {
-+ ret = -EIO;
-+ break;
-+ }
-+
-+ resp = (struct be_cmd_resp_hdr *) va;
-+ if (!status) {
-+ if (req.opcode == OPCODE_COMMON_GET_CNTL_ATTRIBUTES)
-+ be_cpy_drv_ver(adapter, va);
-+ }
-+
-+ if (copy_to_user(ioctl_ptr, va, req_size)) {
-+ ret = -EFAULT;
-+ break;
-+ }
-+ break;
-+ default:
-+ return -EOPNOTSUPP;
- }
-- be_irq_unregister(adapter);
-
-- napi_disable(&rx_eq->napi);
-- napi_disable(&tx_eq->napi);
-+ if (va)
-+ pci_free_consistent(adapter->pdev, req_size, va, dma);
-+
-+ return ret;
-+}
-+
-+#ifdef CONFIG_NET_POLL_CONTROLLER
-+static void be_netpoll(struct net_device *netdev)
-+{
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+ struct be_rx_obj *rxo;
-+ int i;
-
-- /* Wait for all pending tx completions to arrive so that
-- * all tx skbs are freed.
-- */
-- be_tx_compl_clean(adapter);
-+ event_handle(adapter, &adapter->tx_eq, false);
-+ for_all_rx_queues(adapter, rxo, i)
-+ event_handle(adapter, &rxo->rx_eq, true);
-+
-+ return;
-+}
-+#endif
-+
-+static int be_get_frag_header(struct skb_frag_struct *frag, void **mac_hdr,
-+ void **ip_hdr, void **tcpudp_hdr,
-+ u64 *hdr_flags, void *priv)
-+{
-+ struct ethhdr *eh;
-+ struct vlan_ethhdr *veh;
-+ struct iphdr *iph;
-+ u8 *va = page_address(frag->page) + frag->page_offset;
-+ unsigned long ll_hlen;
-+
-+ prefetch(va);
-+ eh = (struct ethhdr *)va;
-+ *mac_hdr = eh;
-+ ll_hlen = ETH_HLEN;
-+ if (eh->h_proto != htons(ETH_P_IP)) {
-+ if (eh->h_proto == htons(ETH_P_8021Q)) {
-+ veh = (struct vlan_ethhdr *)va;
-+ if (veh->h_vlan_encapsulated_proto != htons(ETH_P_IP))
-+ return -1;
-+
-+ ll_hlen += VLAN_HLEN;
-+ } else {
-+ return -1;
-+ }
-+ }
-+ *hdr_flags = LRO_IPV4;
-+ iph = (struct iphdr *)(va + ll_hlen);
-+ *ip_hdr = iph;
-+ if (iph->protocol != IPPROTO_TCP)
-+ return -1;
-+ *hdr_flags |= LRO_TCP;
-+ *tcpudp_hdr = (u8 *) (*ip_hdr) + (iph->ihl << 2);
-
- return 0;
- }
-
--#define FW_FILE_HDR_SIGN "ServerEngines Corp. "
-+static void be_lro_init(struct be_adapter *adapter, struct net_device *netdev)
-+{
-+ struct net_lro_mgr *lro_mgr;
-+ struct be_rx_obj *rxo;
-+ int i;
-+
-+ for_all_rx_queues(adapter, rxo, i) {
-+ lro_mgr = &rxo->lro_mgr;
-+ lro_mgr->dev = netdev;
-+ lro_mgr->features = LRO_F_NAPI;
-+ lro_mgr->ip_summed = CHECKSUM_UNNECESSARY;
-+ lro_mgr->ip_summed_aggr = CHECKSUM_UNNECESSARY;
-+ lro_mgr->max_desc = BE_MAX_LRO_DESCRIPTORS;
-+ lro_mgr->lro_arr = rxo->lro_desc;
-+ lro_mgr->get_frag_header = be_get_frag_header;
-+ lro_mgr->max_aggr = BE_MAX_FRAGS_PER_FRAME;
-+ }
-+
-+#ifdef NETIF_F_GRO
-+ netdev->features |= NETIF_F_GRO;
-+ adapter->gro_supported = true;
-+#endif
-+}
-+
-+#define FW_FILE_HDR_SIGN "ServerEngines Corp. "
- char flash_cookie[2][16] = {"*** SE FLAS",
- "H DIRECTORY *** "};
--static int be_flash_image(struct be_adapter *adapter,
-+
-+static bool be_flash_redboot(struct be_adapter *adapter,
-+ const u8 *p, u32 img_start, int image_size,
-+ int hdr_size)
-+{
-+ u32 crc_offset;
-+ u8 flashed_crc[4];
-+ int status;
-+
-+ crc_offset = hdr_size + img_start + image_size - 4;
-+
-+ p += crc_offset;
-+
-+ status = be_cmd_get_flash_crc(adapter, flashed_crc,
-+ (image_size - 4));
-+ if (status) {
-+ dev_err(&adapter->pdev->dev,
-+ "could not get crc from flash, not flashing redboot\n");
-+ return false;
-+ }
-+
-+ /*update redboot only if crc does not match*/
-+ if (!memcmp(flashed_crc, p, 4))
-+ return false;
-+ else
-+ return true;
-+}
-+
-+static bool phy_flashing_required(struct be_adapter *adapter)
-+{
-+ int status = 0;
-+ struct be_phy_info phy_info;
-+
-+ status = be_cmd_get_phy_info(adapter, &phy_info);
-+ if (status)
-+ return false;
-+ if ((phy_info.phy_type == TN_8022) &&
-+ (phy_info.interface_type == PHY_TYPE_BASET_10GB)) {
-+ return true;
-+ }
-+ return false;
-+}
-+
-+static int be_flash_data(struct be_adapter *adapter,
- const struct firmware *fw,
-- struct be_dma_mem *flash_cmd, u32 flash_type)
-+ struct be_dma_mem *flash_cmd, int num_of_images)
-+
- {
-- int status;
-- u32 flash_op, image_offset = 0, total_bytes, image_size = 0;
-+ int status = 0, i, filehdr_size = 0;
-+ u32 total_bytes = 0, flash_op;
- int num_bytes;
- const u8 *p = fw->data;
- struct be_cmd_write_flashrom *req = flash_cmd->va;
-+ struct flash_comp *pflashcomp;
-+ int num_comp;
-
-- switch (flash_type) {
-- case FLASHROM_TYPE_ISCSI_ACTIVE:
-- image_offset = FLASH_iSCSI_PRIMARY_IMAGE_START;
-- image_size = FLASH_IMAGE_MAX_SIZE;
-- break;
-- case FLASHROM_TYPE_ISCSI_BACKUP:
-- image_offset = FLASH_iSCSI_BACKUP_IMAGE_START;
-- image_size = FLASH_IMAGE_MAX_SIZE;
-- break;
-- case FLASHROM_TYPE_FCOE_FW_ACTIVE:
-- image_offset = FLASH_FCoE_PRIMARY_IMAGE_START;
-- image_size = FLASH_IMAGE_MAX_SIZE;
-- break;
-- case FLASHROM_TYPE_FCOE_FW_BACKUP:
-- image_offset = FLASH_FCoE_BACKUP_IMAGE_START;
-- image_size = FLASH_IMAGE_MAX_SIZE;
-- break;
-- case FLASHROM_TYPE_BIOS:
-- image_offset = FLASH_iSCSI_BIOS_START;
-- image_size = FLASH_BIOS_IMAGE_MAX_SIZE;
-- break;
-- case FLASHROM_TYPE_FCOE_BIOS:
-- image_offset = FLASH_FCoE_BIOS_START;
-- image_size = FLASH_BIOS_IMAGE_MAX_SIZE;
-- break;
-- case FLASHROM_TYPE_PXE_BIOS:
-- image_offset = FLASH_PXE_BIOS_START;
-- image_size = FLASH_BIOS_IMAGE_MAX_SIZE;
-- break;
-- default:
-- return 0;
-+ struct flash_comp gen3_flash_types[10] = {
-+ { FLASH_iSCSI_PRIMARY_IMAGE_START_g3, IMG_TYPE_ISCSI_ACTIVE,
-+ FLASH_IMAGE_MAX_SIZE_g3},
-+ { FLASH_REDBOOT_START_g3, IMG_TYPE_REDBOOT,
-+ FLASH_REDBOOT_IMAGE_MAX_SIZE_g3},
-+ { FLASH_iSCSI_BIOS_START_g3, IMG_TYPE_BIOS,
-+ FLASH_BIOS_IMAGE_MAX_SIZE_g3},
-+ { FLASH_PXE_BIOS_START_g3, IMG_TYPE_PXE_BIOS,
-+ FLASH_BIOS_IMAGE_MAX_SIZE_g3},
-+ { FLASH_FCoE_BIOS_START_g3, IMG_TYPE_FCOE_BIOS,
-+ FLASH_BIOS_IMAGE_MAX_SIZE_g3},
-+ { FLASH_iSCSI_BACKUP_IMAGE_START_g3, IMG_TYPE_ISCSI_BACKUP,
-+ FLASH_IMAGE_MAX_SIZE_g3},
-+ { FLASH_FCoE_PRIMARY_IMAGE_START_g3, IMG_TYPE_FCOE_FW_ACTIVE,
-+ FLASH_IMAGE_MAX_SIZE_g3},
-+ { FLASH_FCoE_BACKUP_IMAGE_START_g3, IMG_TYPE_FCOE_FW_BACKUP,
-+ FLASH_IMAGE_MAX_SIZE_g3},
-+ { FLASH_NCSI_START_g3, IMG_TYPE_NCSI_FW,
-+ FLASH_NCSI_IMAGE_MAX_SIZE_g3},
-+ { FLASH_PHY_FW_START_g3, IMG_TYPE_PHY_FW,
-+ FLASH_PHY_FW_IMAGE_MAX_SIZE_g3}
-+ };
-+ struct flash_comp gen2_flash_types[8] = {
-+ { FLASH_iSCSI_PRIMARY_IMAGE_START_g2, IMG_TYPE_ISCSI_ACTIVE,
-+ FLASH_IMAGE_MAX_SIZE_g2},
-+ { FLASH_REDBOOT_START_g2, IMG_TYPE_REDBOOT,
-+ FLASH_REDBOOT_IMAGE_MAX_SIZE_g2},
-+ { FLASH_iSCSI_BIOS_START_g2, IMG_TYPE_BIOS,
-+ FLASH_BIOS_IMAGE_MAX_SIZE_g2},
-+ { FLASH_PXE_BIOS_START_g2, IMG_TYPE_PXE_BIOS,
-+ FLASH_BIOS_IMAGE_MAX_SIZE_g2},
-+ { FLASH_FCoE_BIOS_START_g2, IMG_TYPE_FCOE_BIOS,
-+ FLASH_BIOS_IMAGE_MAX_SIZE_g2},
-+ { FLASH_iSCSI_BACKUP_IMAGE_START_g2, IMG_TYPE_ISCSI_BACKUP,
-+ FLASH_IMAGE_MAX_SIZE_g2},
-+ { FLASH_FCoE_PRIMARY_IMAGE_START_g2, IMG_TYPE_FCOE_FW_ACTIVE,
-+ FLASH_IMAGE_MAX_SIZE_g2},
-+ { FLASH_FCoE_BACKUP_IMAGE_START_g2, IMG_TYPE_FCOE_FW_BACKUP,
-+ FLASH_IMAGE_MAX_SIZE_g2}
-+ };
-+ if (adapter->generation == BE_GEN3) {
-+ pflashcomp = gen3_flash_types;
-+ filehdr_size = sizeof(struct flash_file_hdr_g3);
-+ num_comp = ARRAY_SIZE(gen3_flash_types);
-+ } else {
-+ pflashcomp = gen2_flash_types;
-+ filehdr_size = sizeof(struct flash_file_hdr_g2);
-+ num_comp = ARRAY_SIZE(gen2_flash_types);
- }
-+ for (i = 0; i < num_comp; i++) {
-+ if ((pflashcomp[i].optype == IMG_TYPE_NCSI_FW) &&
-+ memcmp(adapter->fw_ver, "3.102.148.0", 11) < 0)
-+ continue;
-+ if (pflashcomp[i].optype == IMG_TYPE_PHY_FW) {
-+ if (!phy_flashing_required(adapter))
-+ continue;
-+ }
-+ if ((pflashcomp[i].optype == IMG_TYPE_REDBOOT) &&
-+ (!be_flash_redboot(adapter, fw->data,
-+ pflashcomp[i].offset, pflashcomp[i].size, filehdr_size +
-+ (num_of_images * sizeof(struct image_hdr)))))
-+ continue;
-
-- p += sizeof(struct flash_file_hdr) + image_offset;
-- if (p + image_size > fw->data + fw->size)
-- return -1;
--
-- total_bytes = image_size;
--
-- while (total_bytes) {
-- if (total_bytes > 32*1024)
-- num_bytes = 32*1024;
-- else
-- num_bytes = total_bytes;
-- total_bytes -= num_bytes;
--
-- if (!total_bytes)
-- flash_op = FLASHROM_OPER_FLASH;
-- else
-- flash_op = FLASHROM_OPER_SAVE;
-- memcpy(req->params.data_buf, p, num_bytes);
-- p += num_bytes;
-- status = be_cmd_write_flashrom(adapter, flash_cmd,
-- flash_type, flash_op, num_bytes);
-- if (status) {
-- dev_err(&adapter->pdev->dev,
-- "cmd to write to flash rom failed. type/op %d/%d\n",
-- flash_type, flash_op);
-+ p = fw->data;
-+ p += filehdr_size + pflashcomp[i].offset
-+ + (num_of_images * sizeof(struct image_hdr));
-+ if (p + pflashcomp[i].size > fw->data + fw->size)
- return -1;
-+ total_bytes = pflashcomp[i].size;
-+ while (total_bytes) {
-+ if (total_bytes > 32*1024)
-+ num_bytes = 32*1024;
-+ else
-+ num_bytes = total_bytes;
-+ total_bytes -= num_bytes;
-+ if (!total_bytes) {
-+ if (pflashcomp[i].optype == IMG_TYPE_PHY_FW)
-+ flash_op = FLASHROM_OPER_PHY_FLASH;
-+ else
-+ flash_op = FLASHROM_OPER_FLASH;
-+ } else {
-+ if (pflashcomp[i].optype == IMG_TYPE_PHY_FW)
-+ flash_op = FLASHROM_OPER_PHY_SAVE;
-+ else
-+ flash_op = FLASHROM_OPER_SAVE;
-+ }
-+ memcpy(req->params.data_buf, p, num_bytes);
-+ p += num_bytes;
-+ status = be_cmd_write_flashrom(adapter, flash_cmd,
-+ pflashcomp[i].optype, flash_op, num_bytes);
-+ if (status) {
-+ if ((status == ILLEGAL_IOCTL_REQ) &&
-+ (pflashcomp[i].optype ==
-+ IMG_TYPE_PHY_FW))
-+ break;
-+ dev_err(&adapter->pdev->dev,
-+ "cmd to write to flash rom failed.\n");
-+ return -1;
-+ }
-+ yield();
- }
-- yield();
- }
--
- return 0;
- }
-
-+static int get_ufigen_type(struct flash_file_hdr_g2 *fhdr)
-+{
-+ if (fhdr == NULL)
-+ return 0;
-+ if (fhdr->build[0] == '3')
-+ return BE_GEN3;
-+ else if (fhdr->build[0] == '2')
-+ return BE_GEN2;
-+ else
-+ return 0;
-+}
-+
- int be_load_fw(struct be_adapter *adapter, u8 *func)
- {
- char fw_file[ETHTOOL_FLASH_MAX_FILENAME];
- const struct firmware *fw;
-- struct flash_file_hdr *fhdr;
-- struct flash_section_info *fsec = NULL;
-+ struct flash_file_hdr_g2 *fhdr;
-+ struct flash_file_hdr_g3 *fhdr3;
-+ struct image_hdr *img_hdr_ptr = NULL;
- struct be_dma_mem flash_cmd;
-- int status;
-+ int status, i = 0, num_imgs = 0;
- const u8 *p;
-- bool entry_found = false;
-- int flash_type;
-- char fw_ver[FW_VER_LEN];
-- char fw_cfg;
-
-- status = be_cmd_get_fw_ver(adapter, fw_ver);
-- if (status)
-- return status;
-+ if (!netif_running(adapter->netdev)) {
-+ dev_err(&adapter->pdev->dev,
-+ "Firmware load not allowed (interface is down)\n");
-+ return -1;
-+ }
-
-- fw_cfg = *(fw_ver + 2);
-- if (fw_cfg == '0')
-- fw_cfg = '1';
- strcpy(fw_file, func);
-
- status = request_firmware(&fw, fw_file, &adapter->pdev->dev);
-@@ -1826,34 +3203,9 @@ int be_load_fw(struct be_adapter *adapter, u8 *func)
- goto fw_exit;
-
- p = fw->data;
-- fhdr = (struct flash_file_hdr *) p;
-- if (memcmp(fhdr->sign, FW_FILE_HDR_SIGN, strlen(FW_FILE_HDR_SIGN))) {
-- dev_err(&adapter->pdev->dev,
-- "Firmware(%s) load error (signature did not match)\n",
-- fw_file);
-- status = -1;
-- goto fw_exit;
-- }
--
-+ fhdr = (struct flash_file_hdr_g2 *) p;
- dev_info(&adapter->pdev->dev, "Flashing firmware file %s\n", fw_file);
-
-- p += sizeof(struct flash_file_hdr);
-- while (p < (fw->data + fw->size)) {
-- fsec = (struct flash_section_info *)p;
-- if (!memcmp(flash_cookie, fsec->cookie, sizeof(flash_cookie))) {
-- entry_found = true;
-- break;
-- }
-- p += 32;
-- }
--
-- if (!entry_found) {
-- status = -1;
-- dev_err(&adapter->pdev->dev,
-- "Flash cookie not found in firmware image\n");
-- goto fw_exit;
-- }
--
- flash_cmd.size = sizeof(struct be_cmd_write_flashrom) + 32*1024;
- flash_cmd.va = pci_alloc_consistent(adapter->pdev, flash_cmd.size,
- &flash_cmd.dma);
-@@ -1864,12 +3216,25 @@ int be_load_fw(struct be_adapter *adapter, u8 *func)
- goto fw_exit;
- }
-
-- for (flash_type = FLASHROM_TYPE_ISCSI_ACTIVE;
-- flash_type <= FLASHROM_TYPE_FCOE_FW_BACKUP; flash_type++) {
-- status = be_flash_image(adapter, fw, &flash_cmd,
-- flash_type);
-- if (status)
-- break;
-+ if ((adapter->generation == BE_GEN3) &&
-+ (get_ufigen_type(fhdr) == BE_GEN3)) {
-+ fhdr3 = (struct flash_file_hdr_g3 *) fw->data;
-+ num_imgs = le32_to_cpu(fhdr3->num_imgs);
-+ for (i = 0; i < num_imgs; i++) {
-+ img_hdr_ptr = (struct image_hdr *) (fw->data +
-+ (sizeof(struct flash_file_hdr_g3) +
-+ i * sizeof(struct image_hdr)));
-+ if (le32_to_cpu(img_hdr_ptr->imageid) == 1)
-+ status = be_flash_data(adapter, fw, &flash_cmd,
-+ num_imgs);
-+ }
-+ } else if ((adapter->generation == BE_GEN2) &&
-+ (get_ufigen_type(fhdr) == BE_GEN2)) {
-+ status = be_flash_data(adapter, fw, &flash_cmd, 0);
-+ } else {
-+ dev_err(&adapter->pdev->dev,
-+ "UFI and Interface are not compatible for flashing\n");
-+ status = -1;
- }
-
- pci_free_consistent(adapter->pdev, flash_cmd.size, flash_cmd.va,
-@@ -1879,14 +3244,14 @@ int be_load_fw(struct be_adapter *adapter, u8 *func)
- goto fw_exit;
- }
-
-- dev_info(&adapter->pdev->dev, "Firmware flashed succesfully\n");
-+ dev_info(&adapter->pdev->dev, "Firmware flashed successfully\n");
-
- fw_exit:
- release_firmware(fw);
- return status;
- }
-
--static struct net_device_ops be_netdev_ops = {
-+static net_device_ops_no_const be_netdev_ops = {
- .ndo_open = be_open,
- .ndo_stop = be_close,
- .ndo_start_xmit = be_xmit,
-@@ -1898,15 +3263,32 @@ static struct net_device_ops be_netdev_ops = {
- .ndo_vlan_rx_register = be_vlan_register,
- .ndo_vlan_rx_add_vid = be_vlan_add_vid,
- .ndo_vlan_rx_kill_vid = be_vlan_rem_vid,
-+#ifdef HAVE_SRIOV_CONFIG
-+ .ndo_set_vf_mac = be_set_vf_mac,
-+ .ndo_set_vf_vlan = be_set_vf_vlan,
-+ .ndo_set_vf_tx_rate = be_set_vf_tx_rate,
-+ .ndo_get_vf_config = be_get_vf_config,
-+#endif
-+ .ndo_do_ioctl = be_do_ioctl,
-+#ifdef CONFIG_NET_POLL_CONTROLLER
-+ .ndo_poll_controller = be_netpoll,
-+#endif
- };
-
--static void be_netdev_init(struct net_device *netdev)
-+static int be_netdev_init(struct net_device *netdev)
- {
- struct be_adapter *adapter = netdev_priv(netdev);
-+ struct be_rx_obj *rxo;
-+ int i, status = 0;
-
- netdev->features |= NETIF_F_SG | NETIF_F_HW_VLAN_RX | NETIF_F_TSO |
-- NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_FILTER | NETIF_F_HW_CSUM |
-- NETIF_F_GRO;
-+ NETIF_F_HW_VLAN_TX | NETIF_F_HW_CSUM | NETIF_F_TSO6;
-+
-+ netdev->vlan_features |= NETIF_F_SG | NETIF_F_TSO | NETIF_F_TSO6 |
-+ NETIF_F_HW_CSUM;
-+
-+ netdev->features |= NETIF_F_VLAN_SG | NETIF_F_VLAN_TSO |
-+ NETIF_F_VLAN_CSUM;
-
- netdev->flags |= IFF_MULTICAST;
-
-@@ -1918,17 +3300,30 @@ static void be_netdev_init(struct net_device *netdev)
-
- netif_set_gso_max_size(netdev, 65535);
-
-+ if (adapter->flags & BE_FLAGS_DCBX)
-+ be_netdev_ops.ndo_select_queue = be_select_queue;
- BE_SET_NETDEV_OPS(netdev, &be_netdev_ops);
--
-+
- SET_ETHTOOL_OPS(netdev, &be_ethtool_ops);
-
-- netif_napi_add(netdev, &adapter->rx_eq.napi, be_poll_rx,
-- BE_NAPI_WEIGHT);
-- netif_napi_add(netdev, &adapter->tx_eq.napi, be_poll_tx_mcc,
-+ be_lro_init(adapter, netdev);
-+
-+ for_all_rx_queues(adapter, rxo, i) {
-+ status = be_netif_napi_add(netdev, &rxo->rx_eq.napi, be_poll_rx,
-+ BE_NAPI_WEIGHT);
-+ if (status) {
-+ dev_err(&adapter->pdev->dev, "dummy netdev alloc fail"
-+ "for rxo:%d\n", i);
-+ return status;
-+ }
-+ }
-+ status = be_netif_napi_add(netdev, &adapter->tx_eq.napi, be_poll_tx_mcc,
- BE_NAPI_WEIGHT);
-+ if (status)
-+ dev_err(&adapter->pdev->dev, "dummy netdev alloc fail"
-+ "for tx\n");
-
-- netif_carrier_off(netdev);
-- netif_stop_queue(netdev);
-+ return status;
- }
-
- static void be_unmap_pci_bars(struct be_adapter *adapter)
-@@ -1937,37 +3332,62 @@ static void be_unmap_pci_bars(struct be_adapter *adapter)
- iounmap(adapter->csr);
- if (adapter->db)
- iounmap(adapter->db);
-- if (adapter->pcicfg)
-+ if (adapter->pcicfg && be_physfn(adapter))
- iounmap(adapter->pcicfg);
- }
-
- static int be_map_pci_bars(struct be_adapter *adapter)
- {
-+ struct pci_dev *pdev = adapter->pdev;
- u8 __iomem *addr;
-- int pcicfg_reg;
-+ int pcicfg_reg, db_reg;
-
-- addr = ioremap_nocache(pci_resource_start(adapter->pdev, 2),
-- pci_resource_len(adapter->pdev, 2));
-- if (addr == NULL)
-- return -ENOMEM;
-- adapter->csr = addr;
-+ if (lancer_chip(adapter)) {
-+ addr = ioremap_nocache(pci_resource_start(pdev, 0),
-+ pci_resource_len(adapter->pdev, 0));
-+ if (addr == NULL)
-+ return -ENOMEM;
-+ adapter->db = addr;
-+ return 0;
-+ }
-
-- addr = ioremap_nocache(pci_resource_start(adapter->pdev, 4),
-- 128 * 1024);
-- if (addr == NULL)
-- goto pci_map_err;
-- adapter->db = addr;
-+ if (be_physfn(adapter)) {
-+ addr = ioremap_nocache(pci_resource_start(pdev, 2),
-+ pci_resource_len(pdev, 2));
-+ if (addr == NULL)
-+ return -ENOMEM;
-+ adapter->csr = addr;
-+ adapter->netdev->mem_start = pci_resource_start(pdev, 2);
-+ adapter->netdev->mem_end = pci_resource_start(pdev, 2) +
-+ pci_resource_len(pdev, 2);
-+ }
-
-- if (adapter->generation == BE_GEN2)
-+ if (adapter->generation == BE_GEN2) {
- pcicfg_reg = 1;
-- else
-+ db_reg = 4;
-+ } else {
- pcicfg_reg = 0;
-+ if (be_physfn(adapter))
-+ db_reg = 4;
-+ else
-+ db_reg = 0;
-+ }
-
-- addr = ioremap_nocache(pci_resource_start(adapter->pdev, pcicfg_reg),
-- pci_resource_len(adapter->pdev, pcicfg_reg));
-+ addr = ioremap_nocache(pci_resource_start(pdev, db_reg),
-+ pci_resource_len(pdev, db_reg));
- if (addr == NULL)
- goto pci_map_err;
-- adapter->pcicfg = addr;
-+ adapter->db = addr;
-+
-+ if (be_physfn(adapter)) {
-+ addr = ioremap_nocache(
-+ pci_resource_start(pdev, pcicfg_reg),
-+ pci_resource_len(pdev, pcicfg_reg));
-+ if (addr == NULL)
-+ goto pci_map_err;
-+ adapter->pcicfg = addr;
-+ } else
-+ adapter->pcicfg = adapter->db + SRIOV_VF_PCICFG_OFFSET;
-
- return 0;
- pci_map_err:
-@@ -1985,40 +3405,69 @@ static void be_ctrl_cleanup(struct be_adapter *adapter)
- if (mem->va)
- pci_free_consistent(adapter->pdev, mem->size,
- mem->va, mem->dma);
-+
-+ mem = &adapter->rx_filter;
-+ if (mem->va)
-+ pci_free_consistent(adapter->pdev, mem->size,
-+ mem->va, mem->dma);
- }
-
- static int be_ctrl_init(struct be_adapter *adapter)
- {
- struct be_dma_mem *mbox_mem_alloc = &adapter->mbox_mem_alloced;
- struct be_dma_mem *mbox_mem_align = &adapter->mbox_mem;
-+ struct be_dma_mem *rx_filter = &adapter->rx_filter;
- int status;
-
- status = be_map_pci_bars(adapter);
- if (status)
-- return status;
-+ goto done;
-
- mbox_mem_alloc->size = sizeof(struct be_mcc_mailbox) + 16;
- mbox_mem_alloc->va = pci_alloc_consistent(adapter->pdev,
- mbox_mem_alloc->size, &mbox_mem_alloc->dma);
- if (!mbox_mem_alloc->va) {
-- be_unmap_pci_bars(adapter);
-- return -1;
-+ status = -ENOMEM;
-+ goto unmap_pci_bars;
- }
-+
- mbox_mem_align->size = sizeof(struct be_mcc_mailbox);
- mbox_mem_align->va = PTR_ALIGN(mbox_mem_alloc->va, 16);
- mbox_mem_align->dma = PTR_ALIGN(mbox_mem_alloc->dma, 16);
- memset(mbox_mem_align->va, 0, sizeof(struct be_mcc_mailbox));
-- spin_lock_init(&adapter->mbox_lock);
-+
-+ rx_filter->size = sizeof(struct be_cmd_req_rx_filter);
-+ rx_filter->va = pci_alloc_consistent(adapter->pdev, rx_filter->size,
-+ &rx_filter->dma);
-+ if (rx_filter->va == NULL) {
-+ status = -ENOMEM;
-+ goto free_mbox;
-+ }
-+ memset(rx_filter->va, 0, rx_filter->size);
-+
-+ mutex_init(&adapter->mbox_lock);
- spin_lock_init(&adapter->mcc_lock);
- spin_lock_init(&adapter->mcc_cq_lock);
-
-+ init_completion(&adapter->flash_compl);
-+
-+ PCI_SAVE_STATE(adapter->pdev);
- return 0;
-+
-+free_mbox:
-+ pci_free_consistent(adapter->pdev, mbox_mem_alloc->size,
-+ mbox_mem_alloc->va, mbox_mem_alloc->dma);
-+
-+unmap_pci_bars:
-+ be_unmap_pci_bars(adapter);
-+
-+done:
-+ return status;
- }
-
- static void be_stats_cleanup(struct be_adapter *adapter)
- {
-- struct be_stats_obj *stats = &adapter->stats;
-- struct be_dma_mem *cmd = &stats->cmd;
-+ struct be_dma_mem *cmd = &adapter->stats_cmd;
-
- if (cmd->va)
- pci_free_consistent(adapter->pdev, cmd->size,
-@@ -2027,10 +3476,12 @@ static void be_stats_cleanup(struct be_adapter *adapter)
-
- static int be_stats_init(struct be_adapter *adapter)
- {
-- struct be_stats_obj *stats = &adapter->stats;
-- struct be_dma_mem *cmd = &stats->cmd;
-+ struct be_dma_mem *cmd = &adapter->stats_cmd;
-
-- cmd->size = sizeof(struct be_cmd_req_get_stats);
-+ if (adapter->generation == BE_GEN2)
-+ cmd->size = sizeof(struct be_cmd_req_get_stats_v0);
-+ else
-+ cmd->size = sizeof(struct be_cmd_req_get_stats_v1);
- cmd->va = pci_alloc_consistent(adapter->pdev, cmd->size, &cmd->dma);
- if (cmd->va == NULL)
- return -1;
-@@ -2041,9 +3492,17 @@ static int be_stats_init(struct be_adapter *adapter)
- static void __devexit be_remove(struct pci_dev *pdev)
- {
- struct be_adapter *adapter = pci_get_drvdata(pdev);
-+
- if (!adapter)
- return;
-
-+ cancel_delayed_work_sync(&adapter->work);
-+
-+#ifdef CONFIG_PALAU
-+ be_sysfs_remove_group(adapter);
-+#endif
-+
-+ /* be_close() gets called if the device is open by unregister */
- unregister_netdev(adapter->netdev);
-
- be_clear(adapter);
-@@ -2052,36 +3511,203 @@ static void __devexit be_remove(struct pci_dev *pdev)
-
- be_ctrl_cleanup(adapter);
-
-- if (adapter->msix_enabled) {
-- pci_disable_msix(adapter->pdev);
-- adapter->msix_enabled = false;
-- }
-+ kfree(adapter->vf_cfg);
-+ be_sriov_disable(adapter);
-+
-+ be_msix_disable(adapter);
-
- pci_set_drvdata(pdev, NULL);
- pci_release_regions(pdev);
- pci_disable_device(pdev);
--
-+ be_netif_napi_del(adapter->netdev);
- free_netdev(adapter->netdev);
- }
-
--static int be_hw_up(struct be_adapter *adapter)
-+static void be_pcie_slot_check(struct be_adapter *adapter)
-+{
-+ u32 curr, max, width, max_wd, speed, max_sp;
-+
-+ pci_read_config_dword(adapter->pdev, PCICFG_PCIE_LINK_STATUS_OFFSET,
-+ &curr);
-+ width = (curr >> PCIE_LINK_STATUS_NEG_WIDTH_SHIFT) &
-+ PCIE_LINK_STATUS_NEG_WIDTH_MASK;
-+ speed = (curr >> PCIE_LINK_STATUS_SPEED_SHIFT) &
-+ PCIE_LINK_STATUS_SPEED_MASK;
-+
-+ pci_read_config_dword(adapter->pdev, PCICFG_PCIE_LINK_CAP_OFFSET,
-+ &max);
-+ max_wd = (max >> PCIE_LINK_CAP_MAX_WIDTH_SHIFT) &
-+ PCIE_LINK_CAP_MAX_WIDTH_MASK;
-+ max_sp = (max >> PCIE_LINK_CAP_MAX_SPEED_SHIFT) &
-+ PCIE_LINK_CAP_MAX_SPEED_MASK;
-+
-+ if (width < max_wd || speed < max_sp)
-+ dev_warn(&adapter->pdev->dev,
-+ "Found network device in a Gen%s x%d PCIe slot. It "
-+ "should be in a Gen2 x%d slot for best performance\n",
-+ speed < max_sp ? "1" : "2", width, max_wd);
-+}
-+
-+static int be_get_ioctl_version(char *fw_version) {
-+ char *str[4];
-+ int i;
-+ int val[4];
-+ char *endptr;
-+
-+ if(!fw_version)
-+ return 0;
-+ for(i=0; i<3; i++) {
-+ str[i] = strsep(&fw_version, ".");
-+ val[i] = simple_strtol(str[i], &endptr, 10);
-+ }
-+
-+ if (val[0]>4 || (val[0]>3 && val[2]>143))
-+ return 1;
-+ return 0;
-+}
-+
-+static int be_get_port_names(struct be_adapter *adapter)
- {
- int status;
-+ int ver;
-
-- status = be_cmd_POST(adapter);
-+ status = be_cmd_get_fw_ver(adapter,
-+ adapter->fw_ver, NULL);
- if (status)
- return status;
-+ ver = be_get_ioctl_version(adapter->fw_ver);
-+ if (ver && (adapter->generation == BE_GEN3))
-+ status = be_cmd_query_port_names_v1(adapter,
-+ adapter->port_name);
-+ else
-+ status = be_cmd_query_port_names_v0(adapter,
-+ adapter->port_name);
-+ return status;
-+}
-
-- status = be_cmd_reset_function(adapter);
-+static int be_get_config(struct be_adapter *adapter)
-+{
-+ int status;
-+ u8 mac[ETH_ALEN];
-+
-+ status = be_cmd_query_fw_cfg(adapter, &adapter->port_num,
-+ &adapter->function_mode,
-+ &adapter->function_caps);
- if (status)
- return status;
-
-- status = be_cmd_get_fw_ver(adapter, adapter->fw_ver);
-+ status = be_cmd_get_cntl_attributes(adapter);
- if (status)
- return status;
-
-- status = be_cmd_query_fw_cfg(adapter,
-- &adapter->port_num, &adapter->cap);
-+ memset(mac, 0, ETH_ALEN);
-+ be_pcie_slot_check(adapter);
-+
-+ if (be_physfn(adapter)) {
-+ status = be_cmd_mac_addr_query(adapter, mac,
-+ MAC_ADDRESS_TYPE_NETWORK, true /*permanent */, 0);
-+
-+ if (status)
-+ return status;
-+
-+ if (!is_valid_ether_addr(mac))
-+ return -EADDRNOTAVAIL;
-+
-+ memcpy(adapter->netdev->dev_addr, mac, ETH_ALEN);
-+ memcpy(adapter->netdev->perm_addr, mac, ETH_ALEN);
-+ }
-+
-+ if (adapter->function_mode & FLEX10_MODE)
-+ adapter->max_vlans = BE_NUM_VLANS_SUPPORTED/8;
-+ else
-+ adapter->max_vlans = BE_NUM_VLANS_SUPPORTED;
-+
-+ return 0;
-+}
-+
-+static int be_dev_family_check(struct be_adapter *adapter)
-+{
-+ struct pci_dev *pdev = adapter->pdev;
-+ u32 sli_intf = 0, if_type;
-+
-+ switch (pdev->device) {
-+ case BE_DEVICE_ID1:
-+ case OC_DEVICE_ID1:
-+ adapter->generation = BE_GEN2;
-+ break;
-+ case BE_DEVICE_ID2:
-+ case OC_DEVICE_ID2:
-+ adapter->generation = BE_GEN3;
-+ break;
-+ case OC_DEVICE_ID3:
-+ pci_read_config_dword(pdev, SLI_INTF_REG_OFFSET, &sli_intf);
-+ if_type = (sli_intf & SLI_INTF_IF_TYPE_MASK) >>
-+ SLI_INTF_IF_TYPE_SHIFT;
-+
-+ if (((sli_intf & SLI_INTF_VALID_MASK) != SLI_INTF_VALID) ||
-+ if_type != 0x02) {
-+ dev_err(&pdev->dev, "SLI_INTF reg val is not valid\n");
-+ return -EINVAL;
-+ }
-+ if (num_vfs > 0) {
-+ dev_err(&pdev->dev, "VFs not supported\n");
-+ return -EINVAL;
-+ }
-+ adapter->sli_family = ((sli_intf & SLI_INTF_FAMILY_MASK) >>
-+ SLI_INTF_FAMILY_SHIFT);
-+ adapter->generation = BE_GEN3;
-+ break;
-+ default:
-+ adapter->generation = 0;
-+ }
-+ return 0;
-+}
-+
-+static int lancer_wait_ready(struct be_adapter *adapter)
-+{
-+#define SLIPORT_READY_TIMEOUT 500
-+ u32 sliport_status;
-+ int status = 0, i;
-+
-+ for (i = 0; i < SLIPORT_READY_TIMEOUT; i++) {
-+ sliport_status = ioread32(adapter->db + SLIPORT_STATUS_OFFSET);
-+ if (sliport_status & SLIPORT_STATUS_RDY_MASK)
-+ break;
-+
-+ msleep(20);
-+ }
-+
-+ if (i == SLIPORT_READY_TIMEOUT)
-+ status = -1;
-+
-+ return status;
-+}
-+
-+static int lancer_test_and_set_rdy_state(struct be_adapter *adapter)
-+{
-+ int status;
-+ u32 sliport_status, err, reset_needed;
-+ status = lancer_wait_ready(adapter);
-+ if (!status) {
-+ sliport_status = ioread32(adapter->db + SLIPORT_STATUS_OFFSET);
-+ err = sliport_status & SLIPORT_STATUS_ERR_MASK;
-+ reset_needed = sliport_status & SLIPORT_STATUS_RN_MASK;
-+ if (err && reset_needed) {
-+ iowrite32(SLI_PORT_CONTROL_IP_MASK,
-+ adapter->db + SLIPORT_CONTROL_OFFSET);
-+
-+ /* check adapter has corrected the error */
-+ status = lancer_wait_ready(adapter);
-+ sliport_status = ioread32(adapter->db +
-+ SLIPORT_STATUS_OFFSET);
-+ sliport_status &= (SLIPORT_STATUS_ERR_MASK |
-+ SLIPORT_STATUS_RN_MASK);
-+ if (status || sliport_status)
-+ status = -1;
-+ } else if (err || reset_needed) {
-+ status = -1;
-+ }
-+ }
- return status;
- }
-
-@@ -2091,7 +3717,7 @@ static int __devinit be_probe(struct pci_dev *pdev,
- int status = 0;
- struct be_adapter *adapter;
- struct net_device *netdev;
-- u8 mac[ETH_ALEN];
-+ u32 en;
-
- status = pci_enable_device(pdev);
- if (status)
-@@ -2102,31 +3728,22 @@ static int __devinit be_probe(struct pci_dev *pdev,
- goto disable_dev;
- pci_set_master(pdev);
-
-- netdev = alloc_etherdev(sizeof(struct be_adapter));
-+ netdev = alloc_etherdev_mq(sizeof(struct be_adapter), MAX_TX_QS);
- if (netdev == NULL) {
- status = -ENOMEM;
- goto rel_reg;
- }
- adapter = netdev_priv(netdev);
-
-- switch (pdev->device) {
-- case BE_DEVICE_ID1:
-- case OC_DEVICE_ID1:
-- adapter->generation = BE_GEN2;
-- break;
-- case BE_DEVICE_ID2:
-- case OC_DEVICE_ID2:
-- adapter->generation = BE_GEN3;
-- break;
-- default:
-- adapter->generation = 0;
-- }
--
- adapter->pdev = pdev;
-+
-+ status = be_dev_family_check(adapter);
-+ if (status)
-+ goto free_netdev;
-+
- pci_set_drvdata(pdev, adapter);
- adapter->netdev = netdev;
--
-- be_msix_enable(adapter);
-+ SET_NETDEV_DEV(netdev, &pdev->dev);
-
- status = pci_set_dma_mask(pdev, DMA_BIT_MASK(64));
- if (!status) {
-@@ -2139,46 +3756,150 @@ static int __devinit be_probe(struct pci_dev *pdev,
- }
- }
-
-+ be_sriov_enable(adapter);
-+ if (adapter->num_vfs > 0) {
-+ adapter->vf_cfg = kcalloc(adapter->num_vfs,
-+ sizeof(struct be_vf_cfg), GFP_KERNEL);
-+
-+ if (!adapter->vf_cfg)
-+ goto free_netdev;
-+ }
-+
- status = be_ctrl_init(adapter);
- if (status)
-- goto free_netdev;
-+ goto free_vf_cfg;
-+
-+ if (lancer_chip(adapter)) {
-+ status = lancer_test_and_set_rdy_state(adapter);
-+ if (status) {
-+ dev_err(&pdev->dev, "Adapter in non recoverable error\n");
-+ goto ctrl_clean;
-+ }
-+ }
-+
-+ /* sync up with fw's ready state */
-+ if (be_physfn(adapter)) {
-+ status = be_cmd_POST(adapter);
-+ if (status)
-+ goto ctrl_clean;
-+ }
-+
-+ /* tell fw we're ready to fire cmds */
-+ status = be_cmd_fw_init(adapter);
-+ if (status)
-+ goto ctrl_clean;
-+
-+ status = be_cmd_reset_function(adapter);
-+ if (status)
-+ goto ctrl_clean;
-
- status = be_stats_init(adapter);
- if (status)
- goto ctrl_clean;
-
-- status = be_hw_up(adapter);
-+ status = be_get_config(adapter);
- if (status)
- goto stats_clean;
-
-- status = be_cmd_mac_addr_query(adapter, mac, MAC_ADDRESS_TYPE_NETWORK,
-- true /* permanent */, 0);
-- if (status)
-- goto stats_clean;
-- memcpy(netdev->dev_addr, mac, ETH_ALEN);
-+ /* This bit is zero in normal boot case, but in crash kernel case this
-+ is not cleared. clear this bit here, until we are ready with the irqs
-+ i.e in be_open call.*/
-+ if (!lancer_chip(adapter))
-+ be_intr_set(adapter, false);
-+
-+ if (msix)
-+ be_msix_enable(adapter);
-
- INIT_DELAYED_WORK(&adapter->work, be_worker);
-- be_netdev_init(netdev);
-- SET_NETDEV_DEV(netdev, &adapter->pdev->dev);
-
- status = be_setup(adapter);
- if (status)
-- goto stats_clean;
-+ goto msix_disable;
-+
-+ /* Initilize the link status to -1 */
-+ adapter->link_status = -1;
-+
-+ status = be_netdev_init(netdev);
-+ if (status)
-+ goto unsetup;
-+
- status = register_netdev(netdev);
- if (status != 0)
- goto unsetup;
-
-- dev_info(&pdev->dev, "%s port %d\n", nic_name(pdev), adapter->port_num);
-+ be_cmd_get_fw_ver(adapter, adapter->fw_ver, NULL);
-+
-+ if (be_physfn(adapter) && adapter->num_vfs) {
-+ u8 mac_speed;
-+ int link_status;
-+ u16 def_vlan, vf, lnk_speed;
-+
-+ status = be_vf_eth_addr_config(adapter);
-+ if (status)
-+ goto unreg_netdev;
-+
-+ for (vf = 0; vf < adapter->num_vfs; vf++) {
-+ status = be_cmd_get_hsw_config(adapter, &def_vlan,
-+ vf + 1, adapter->vf_cfg[vf].vf_if_handle);
-+ if (!status)
-+ adapter->vf_cfg[vf].vf_def_vid = def_vlan;
-+ else
-+ goto unreg_netdev;
-+
-+ status = be_cmd_link_status_query(adapter, &link_status,
-+ &mac_speed, &lnk_speed, vf + 1);
-+ if (!status)
-+ adapter->vf_cfg[vf].vf_tx_rate = lnk_speed * 10;
-+ else
-+ goto unreg_netdev;
-+ }
-+ }
-+ if (be_physfn(adapter)) {
-+ /* Temp fix ofr bug# 23034. Till ARM
-+ * f/w fixes privilege lvl */
-+ be_get_port_names(adapter);
-+ }
-+
-+ /* Enable Vlan capability based on privileges.
-+ * PF will have Vlan capability anyway. */
-+ be_cmd_get_fn_privileges(adapter, &en, 0);
-+
-+ if ((en & (BE_PRIV_FILTMGMT | BE_PRIV_VHADM | BE_PRIV_DEVCFG)) ||
-+ be_physfn(adapter))
-+ netdev->features |= NETIF_F_HW_VLAN_FILTER;
-+ else
-+ netdev->features |= NETIF_F_VLAN_CHALLENGED;
-+
-+ dev_info(&pdev->dev, "%s: numa node %d\n", netdev->name,
-+ dev_to_node(&pdev->dev));
-+ dev_info(&pdev->dev, "%s %s \"%s\" port %d\n", nic_name(pdev),
-+ (adapter->port_num > 1 ? "1Gbps NIC" : "10Gbps NIC"),
-+ adapter->model_number, adapter->hba_port_num);
-+
-+
-+#ifdef CONFIG_PALAU
-+ be_sysfs_create_group(adapter);
-+#endif
-+ schedule_delayed_work(&adapter->work, msecs_to_jiffies(100));
- return 0;
-
-+unreg_netdev:
-+ unregister_netdev(netdev);
- unsetup:
- be_clear(adapter);
-+msix_disable:
-+ be_msix_disable(adapter);
- stats_clean:
- be_stats_cleanup(adapter);
- ctrl_clean:
- be_ctrl_cleanup(adapter);
-+free_vf_cfg:
-+ kfree(adapter->vf_cfg);
- free_netdev:
-- free_netdev(adapter->netdev);
-+ be_sriov_disable(adapter);
-+ be_netif_napi_del(netdev);
-+ free_netdev(netdev);
-+ pci_set_drvdata(pdev, NULL);
- rel_reg:
- pci_release_regions(pdev);
- disable_dev:
-@@ -2193,6 +3914,10 @@ static int be_suspend(struct pci_dev *pdev, pm_message_t state)
- struct be_adapter *adapter = pci_get_drvdata(pdev);
- struct net_device *netdev = adapter->netdev;
-
-+ cancel_delayed_work_sync(&adapter->work);
-+ if (adapter->wol)
-+ be_setup_wol(adapter, true);
-+
- netif_device_detach(netdev);
- if (netif_running(netdev)) {
- rtnl_lock();
-@@ -2202,6 +3927,7 @@ static int be_suspend(struct pci_dev *pdev, pm_message_t state)
- be_cmd_get_flow_control(adapter, &adapter->tx_fc, &adapter->rx_fc);
- be_clear(adapter);
-
-+ be_msix_disable(adapter);
- pci_save_state(pdev);
- pci_disable_device(pdev);
- pci_set_power_state(pdev, pci_choose_state(pdev, state));
-@@ -2223,6 +3949,12 @@ static int be_resume(struct pci_dev *pdev)
- pci_set_power_state(pdev, 0);
- pci_restore_state(pdev);
-
-+ be_msix_enable(adapter);
-+ /* tell fw we're ready to fire cmds */
-+ status = be_cmd_fw_init(adapter);
-+ if (status)
-+ return status;
-+
- be_setup(adapter);
- if (netif_running(netdev)) {
- rtnl_lock();
-@@ -2230,28 +3962,152 @@ static int be_resume(struct pci_dev *pdev)
- rtnl_unlock();
- }
- netif_device_attach(netdev);
-+
-+ if (adapter->wol)
-+ be_setup_wol(adapter, false);
-+
-+ schedule_delayed_work(&adapter->work, msecs_to_jiffies(100));
- return 0;
- }
-
-+/*
-+ * An FLR will stop BE from DMAing any data.
-+ */
-+static void be_shutdown(struct pci_dev *pdev)
-+{
-+ struct be_adapter *adapter = pci_get_drvdata(pdev);
-+
-+ if (!adapter)
-+ return;
-+
-+ cancel_delayed_work_sync(&adapter->work);
-+
-+ netif_device_detach(adapter->netdev);
-+
-+ if (adapter->wol)
-+ be_setup_wol(adapter, true);
-+
-+ be_cmd_reset_function(adapter);
-+
-+ pci_disable_device(pdev);
-+}
-+
-+static pci_ers_result_t be_eeh_err_detected(struct pci_dev *pdev,
-+ pci_channel_state_t state)
-+{
-+ struct be_adapter *adapter = pci_get_drvdata(pdev);
-+ struct net_device *netdev = adapter->netdev;
-+
-+ dev_err(&adapter->pdev->dev, "EEH error detected\n");
-+
-+ adapter->eeh_err = true;
-+
-+ netif_device_detach(netdev);
-+
-+ if (netif_running(netdev)) {
-+ rtnl_lock();
-+ be_close(netdev);
-+ rtnl_unlock();
-+ }
-+ be_clear(adapter);
-+
-+ if (state == pci_channel_io_perm_failure)
-+ return PCI_ERS_RESULT_DISCONNECT;
-+
-+ pci_disable_device(pdev);
-+
-+ return PCI_ERS_RESULT_NEED_RESET;
-+}
-+
-+static pci_ers_result_t be_eeh_reset(struct pci_dev *pdev)
-+{
-+ struct be_adapter *adapter = pci_get_drvdata(pdev);
-+ int status;
-+
-+ dev_info(&adapter->pdev->dev, "EEH reset\n");
-+ adapter->eeh_err = false;
-+
-+ status = pci_enable_device(pdev);
-+ if (status)
-+ return PCI_ERS_RESULT_DISCONNECT;
-+
-+ pci_set_master(pdev);
-+ pci_set_power_state(pdev, 0);
-+ pci_restore_state(pdev);
-+
-+ /* Check if card is ok and fw is ready */
-+ status = be_cmd_POST(adapter);
-+ if (status)
-+ return PCI_ERS_RESULT_DISCONNECT;
-+
-+ return PCI_ERS_RESULT_RECOVERED;
-+}
-+
-+static void be_eeh_resume(struct pci_dev *pdev)
-+{
-+ int status = 0;
-+ struct be_adapter *adapter = pci_get_drvdata(pdev);
-+ struct net_device *netdev = adapter->netdev;
-+
-+ dev_info(&adapter->pdev->dev, "EEH resume\n");
-+
-+ pci_save_state(pdev);
-+
-+ /* tell fw we're ready to fire cmds */
-+ status = be_cmd_fw_init(adapter);
-+ if (status)
-+ goto err;
-+
-+ status = be_setup(adapter);
-+ if (status)
-+ goto err;
-+
-+ if (netif_running(netdev)) {
-+ status = be_open(netdev);
-+ if (status)
-+ goto err;
-+ }
-+ netif_device_attach(netdev);
-+ return;
-+err:
-+ dev_err(&adapter->pdev->dev, "EEH resume failed\n");
-+ return;
-+}
-+
-+static struct pci_error_handlers be_eeh_handlers = {
-+ .error_detected = be_eeh_err_detected,
-+ .slot_reset = be_eeh_reset,
-+ .resume = be_eeh_resume,
-+};
-+
- static struct pci_driver be_driver = {
- .name = DRV_NAME,
- .id_table = be_dev_ids,
- .probe = be_probe,
- .remove = be_remove,
- .suspend = be_suspend,
-- .resume = be_resume
-+ .resume = be_resume,
-+ .shutdown = be_shutdown,
-+ .err_handler = &be_eeh_handlers
- };
-
- static int __init be_init_module(void)
- {
-- if (rx_frag_size != 8192 && rx_frag_size != 4096
-- && rx_frag_size != 2048) {
-+ if (rx_frag_size != 8192 && rx_frag_size != 4096 &&
-+ rx_frag_size != 2048) {
- printk(KERN_WARNING DRV_NAME
- " : Module param rx_frag_size must be 2048/4096/8192."
- " Using 2048\n");
- rx_frag_size = 2048;
- }
-
-+ if (!msix && num_vfs > 0) {
-+ printk(KERN_WARNING DRV_NAME
-+ " : MSIx required for num_vfs > 0. Ignoring msix=0\n");
-+ msix = 1;
-+ }
-+
-+
- return pci_register_driver(&be_driver);
- }
- module_init(be_init_module);
-diff --git a/drivers/net/benet/be_misc.c b/drivers/net/benet/be_misc.c
-new file mode 100644
-index 0000000..4ab499f
---- /dev/null
-+++ b/drivers/net/benet/be_misc.c
-@@ -0,0 +1,106 @@
-+/*
-+ * Copyright (C) 2005 - 2011 Emulex
-+ * All rights reserved.
-+ *
-+ * This program is free software; you can redistribute it and/or
-+ * modify it under the terms of the GNU General Public License version 2
-+ * as published by the Free Software Foundation. The full GNU General
-+ * Public License is included in this distribution in the file called COPYING.
-+ *
-+ * Contact Information:
-+ * linux-drivers@emulex.com
-+ *
-+ * Emulex
-+ * 3333 Susan Street
-+ * Costa Mesa, CA 92626
-+ */
-+#include "be.h"
-+
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 24)
-+static ssize_t
-+flash_fw_store(struct class_device *cd, const char *buf, size_t len)
-+{
-+ struct be_adapter *adapter =
-+ netdev_priv(container_of(cd, struct net_device, class_dev));
-+ char file_name[ETHTOOL_FLASH_MAX_FILENAME];
-+ int status;
-+
-+ if (!capable(CAP_NET_ADMIN))
-+ return -EPERM;
-+
-+ file_name[ETHTOOL_FLASH_MAX_FILENAME - 1] = 0;
-+ strncpy(file_name, buf, (ETHTOOL_FLASH_MAX_FILENAME - 1));
-+
-+ /* Removing new-line char given by sysfs */
-+ file_name[strlen(file_name) - 1] = '\0';
-+
-+ status = be_load_fw(adapter, file_name);
-+ if (!status)
-+ return len;
-+ else
-+ return status;
-+}
-+
-+static CLASS_DEVICE_ATTR(flash_fw, S_IWUSR, NULL, flash_fw_store);
-+
-+static struct attribute *benet_attrs[] = {
-+ &class_device_attr_flash_fw.attr,
-+ NULL,
-+};
-+#else
-+
-+static ssize_t
-+flash_fw_store(struct device *dev, struct device_attribute *attr,
-+ const char *buf, size_t len)
-+{
-+ struct be_adapter *adapter =
-+ netdev_priv(container_of(dev, struct net_device, dev));
-+ char file_name[ETHTOOL_FLASH_MAX_FILENAME];
-+ int status;
-+
-+ if (!capable(CAP_NET_ADMIN))
-+ return -EPERM;
-+
-+ file_name[ETHTOOL_FLASH_MAX_FILENAME - 1] = 0;
-+ strncpy(file_name, buf, (ETHTOOL_FLASH_MAX_FILENAME - 1));
-+
-+ /* Removing new-line char given by sysfs */
-+ file_name[strlen(file_name) - 1] = '\0';
-+
-+ status = be_load_fw(adapter, file_name);
-+ if (!status)
-+ return len;
-+ else
-+ return status;
-+}
-+
-+static DEVICE_ATTR(flash_fw, S_IWUSR, NULL, flash_fw_store);
-+
-+static struct attribute *benet_attrs[] = {
-+ &dev_attr_flash_fw.attr,
-+ NULL,
-+};
-+#endif
-+
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 24)
-+#define CLASS_DEV class_dev
-+#else
-+#define CLASS_DEV dev
-+#endif
-+
-+static struct attribute_group benet_attr_group = {.attrs = benet_attrs };
-+
-+void be_sysfs_create_group(struct be_adapter *adapter)
-+{
-+ int status;
-+
-+ status = sysfs_create_group(&adapter->netdev->CLASS_DEV.kobj,
-+ &benet_attr_group);
-+ if (status)
-+ dev_err(&adapter->pdev->dev, "Could not create sysfs group\n");
-+}
-+
-+void be_sysfs_remove_group(struct be_adapter *adapter)
-+{
-+ sysfs_remove_group(&adapter->netdev->CLASS_DEV.kobj, &benet_attr_group);
-+}
-diff --git a/drivers/net/benet/be_proc.c b/drivers/net/benet/be_proc.c
-new file mode 100644
-index 0000000..0bfdb3b
---- /dev/null
-+++ b/drivers/net/benet/be_proc.c
-@@ -0,0 +1,513 @@
-+/*
-+ * Copyright (C) 2005 - 2011 ServerEngines
-+ * All rights reserved.
-+ *
-+ * This program is free software; you can redistribute it and/or
-+ * modify it under the terms of the GNU General Public License version 2
-+ * as published by the Free Software Foundation. The full GNU General
-+ * Public License is included in this distribution in the file called COPYING.
-+ *
-+ * Contact Information:
-+ * linux-drivers@serverengines.com
-+ *
-+ * ServerEngines
-+ * 209 N. Fair Oaks Ave
-+ * Sunnyvale, CA 94085
-+ */
-+#include <linux/proc_fs.h>
-+#include "be.h"
-+
-+char *be_adpt_name[] = {
-+ "driver/be2net0",
-+ "driver/be2net1",
-+ "driver/be2net2",
-+ "driver/be2net3",
-+ "driver/be2net4",
-+ "driver/be2net5",
-+ "driver/be2net6",
-+ "driver/be2net7"
-+};
-+
-+#define MAX_BE_DEVICES 8
-+struct proc_dir_entry *be_proc_dir[MAX_BE_DEVICES];
-+
-+/*File to read Eth Ring Information */
-+#define BE_ETH_RING_FILE "eth_ring"
-+#define BE_DRVR_STAT_FILE "drvr_stat"
-+
-+/*
-+ * this file enables user to read a 32 bit CSR register.
-+ * to read 32 bit value of a register at offset 0x1234,
-+ * first write the offset 0x1234 (echo "0x1234") in
-+ * the file and then read the value from this file.
-+ * the written offset is latched until another value is written
-+ */
-+#define BE_CSR_R_FILE "csrr"
-+/*
-+ * this file enables user to write to a 32 bit CSR register.
-+ * to write a value 0xdeadbeef to a register at offset 0x1234,
-+ * write 0x1234 0xdeadbeef (echo "0x1234 0xdeadbeeb") to
-+ * the file.
-+ */
-+#define BE_CSR_W_FILE "csrw"
-+
-+#define BE_PROC_MODE 0600
-+
-+static char read_eth_ring_buf[4096];
-+static int read_eth_ring_count;
-+
-+/*
-+ * Get Various Eth Ring Properties
-+ */
-+static int proc_eth_read_ring(char *page, char **start,
-+ off_t off, int count, int *eof, void *data)
-+{
-+ int i, n;
-+ char *p = read_eth_ring_buf;
-+ struct be_adapter *adapter = (struct be_adapter *) data;
-+
-+ if (off == 0) {
-+ /* Reset read_eth_ring_count */
-+ read_eth_ring_count = 0;
-+
-+ n = sprintf(p, " PhyAddr VirtAddr Size TotalEntries ProducerIndex ConsumerIndex NumUsed\n");
-+ p += n;
-+ read_eth_ring_count += n;
-+
-+ n = sprintf(p, " ------- -------- ---- ------------ ------------- ------------- -------\n");
-+ p += n;
-+ read_eth_ring_count += n;
-+
-+ n = sprintf(p, "%s", "EthSendRing");
-+ p += n;
-+ read_eth_ring_count += n;
-+
-+ n = sprintf(p, " %7lx %8p %4u %12u %13u %13u %7u \n",
-+ (long) adapter->tx_obj.q.dma_mem.dma,
-+ (void *)adapter->tx_obj.q.dma_mem.va,
-+ (u32) (adapter->tx_obj.q.len *
-+ sizeof(struct be_eth_wrb)),
-+ adapter->tx_obj.q.len, adapter->tx_obj.q.head,
-+ adapter->tx_obj.q.tail,
-+ atomic_read(&adapter->tx_obj.q.used));
-+
-+ p += n;
-+ read_eth_ring_count += n;
-+
-+ /* Get Eth Send Compl Queue Details */
-+ n = sprintf(p, "%s", "EthSendCmplRing");
-+ p += n;
-+ read_eth_ring_count += n;
-+
-+ n = sprintf(p, " %7lx %8p %4u %12u %13s %13u %7s\n",
-+ (long)adapter->tx_obj.cq.dma_mem.dma,
-+ (void *)adapter->tx_obj.cq.dma_mem.va,
-+ (u32) (adapter->tx_obj.cq.len *
-+ sizeof(struct be_eth_tx_compl)),
-+ adapter->tx_obj.cq.len, "NA",
-+ adapter->tx_obj.cq.tail, "NA");
-+
-+ p += n;
-+ read_eth_ring_count += n;
-+ /* Get Eth Rx Queue Details */
-+ n = sprintf(p, "%s", "EthRxRing");
-+ p += n;
-+ read_eth_ring_count += n;
-+
-+ n = sprintf(p, " %7lx %8p %4u %12u %13u %13s %7u \n",
-+ (long)adapter->rx_obj.q.dma_mem.dma,
-+ (void *)adapter->rx_obj.q.dma_mem.va,
-+ (u32) (adapter->rx_obj.q.len *
-+ sizeof(struct be_eth_rx_d)),
-+ adapter->rx_obj.q.len, adapter->rx_obj.q.head,"NA",
-+ atomic_read(&adapter->rx_obj.q.used));
-+ p += n;
-+ read_eth_ring_count += n;
-+
-+ /* Get Eth Unicast Rx Compl Queue Details */
-+ n = sprintf(p, "%s", "EthRxCmplRing");
-+ p += n;
-+ read_eth_ring_count += n;
-+
-+ n = sprintf(p, " %7lx %8p %4u %12u %13s %13u %7s\n",
-+ (long)adapter->rx_obj.cq.dma_mem.dma,
-+ (void *)adapter->rx_obj.cq.dma_mem.va,
-+ (u32) (adapter->rx_obj.cq.len *
-+ sizeof(struct be_eth_rx_compl)),
-+ adapter->rx_obj.cq.len, "NA",
-+ adapter->rx_obj.cq.tail, "NA");
-+ p += n;
-+ read_eth_ring_count += n;
-+
-+ /* Get Eth Event Queue Details */
-+ n = sprintf(p, "%s", "EthTxEventRing");
-+ p += n;
-+ read_eth_ring_count += n;
-+
-+ n = sprintf(p,
-+ " %7lx %8p %4u %12u %13s %13u %7s\n",
-+ (long) adapter->tx_eq.q.dma_mem.dma,
-+ (void *)adapter->tx_eq.q.dma_mem.va,
-+ (u32) (adapter->tx_eq.q.len *
-+ sizeof(struct be_eq_entry)),
-+ adapter->tx_eq.q.len, "NA",
-+ adapter->tx_eq.q.tail, "NA");
-+
-+ p += n;
-+ read_eth_ring_count += n;
-+
-+ /* Get Eth Event Queue Details */
-+ n = sprintf(p, "%s", "EthRxEventRing");
-+ p += n;
-+ read_eth_ring_count += n;
-+
-+ n = sprintf(p,
-+ " %7lx %8p %4u %12u %13s %13u %7s\n",
-+ (long) adapter->rx_eq.q.dma_mem.dma,
-+ (void *)adapter->rx_eq.q.dma_mem.va,
-+ (u32) (adapter->rx_eq.q.len *
-+ sizeof(struct be_eq_entry)),
-+ adapter->rx_eq.q.len, "NA",
-+ adapter->rx_eq.q.tail, "NA");
-+
-+ p += n;
-+ read_eth_ring_count += n;
-+ }
-+
-+ *start = page;
-+ /* copy whatever we can */
-+ if (count < (read_eth_ring_count - off)) {
-+ i = count;
-+ *eof = 0; /* More bytes left */
-+ } else {
-+ i = read_eth_ring_count - off;
-+ *eof = 1; /* Nothing left. indicate EOF */
-+ }
-+
-+ memcpy(page, read_eth_ring_buf + off, i);
-+ return (i);
-+}
-+
-+static int proc_eth_write_ring(struct file *file,
-+ const char *buffer, unsigned long count,
-+ void *data)
-+{
-+ return (count); /* we do not support write */
-+}
-+
-+/*
-+ * read the driver stats.
-+ */
-+static int proc_read_drvr_stat(char *page, char **start,
-+ off_t off, int count, int *eof, void *data)
-+{
-+ int n, lro_cp;
-+ char *p = page;
-+ struct be_adapter *adapter = (struct be_adapter *) data;
-+ struct net_device *netdev = adapter->netdev;
-+
-+ if (off == 0) {
-+ n = sprintf(p, "interface = %s\n", netdev->name);
-+ p += n;
-+ n = sprintf(p, "tx_reqs = %d\n",
-+ drvr_stats(adapter)->be_tx_reqs);
-+ p += n;
-+ n = sprintf(p, "tx_stops = %d\n",
-+ drvr_stats(adapter)->be_tx_stops);
-+ p += n;
-+ n = sprintf(p, "fwd_reqs = %d\n",
-+ drvr_stats(adapter)->be_fwd_reqs);
-+ p += n;
-+ n = sprintf(p, "tx_wrbs = %d\n",
-+ drvr_stats(adapter)->be_tx_wrbs);
-+ p += n;
-+ n = sprintf(p, "rx_poll = %d\n", drvr_stats(adapter)->be_rx_polls);
-+ p += n;
-+ n = sprintf(p, "tx_events = %d\n",
-+ drvr_stats(adapter)->be_tx_events);
-+ p += n;
-+ n = sprintf(p, "rx_events = %d\n",
-+ drvr_stats(adapter)->be_rx_events);
-+ p += n;
-+ n = sprintf(p, "tx_compl = %d\n",
-+ drvr_stats(adapter)->be_tx_compl);
-+ p += n;
-+ n = sprintf(p, "rx_compl = %d\n",
-+ drvr_stats(adapter)->be_rx_compl);
-+ p += n;
-+ n = sprintf(p, "ethrx_post_fail = %d\n",
-+ drvr_stats(adapter)->be_ethrx_post_fail);
-+ p += n;
-+ n = sprintf(p, "802.3_dropped_frames = %d\n",
-+ drvr_stats(adapter)->be_802_3_dropped_frames);
-+ p += n;
-+ n = sprintf(p, "802.3_malformed_frames = %d\n",
-+ drvr_stats(adapter)->be_802_3_malformed_frames);
-+ p += n;
-+ n = sprintf(p, "eth_tx_rate = %d\n",
-+ drvr_stats(adapter)->be_tx_rate);
-+ p += n;
-+ n = sprintf(p, "eth_rx_rate = %d\n",
-+ drvr_stats(adapter)->be_rx_rate);
-+ p += n;
-+
-+ lro_cp = (drvr_stats(adapter)->be_lro_hgram_data[0] +
-+ drvr_stats(adapter)->be_lro_hgram_data[1] +
-+ drvr_stats(adapter)->be_lro_hgram_data[2] +
-+ drvr_stats(adapter)->be_lro_hgram_data[3] +
-+ drvr_stats(adapter)->be_lro_hgram_data[4] +
-+ drvr_stats(adapter)->be_lro_hgram_data[5] +
-+ drvr_stats(adapter)->be_lro_hgram_data[6] +
-+ drvr_stats(adapter)->be_lro_hgram_data[7])/100;
-+ lro_cp = (lro_cp == 0) ? 1 : lro_cp; /* avoid divide by 0 */
-+ n = sprintf(p,
-+ "LRO data count %% histogram (1, 2-3, 4-5,..,>=16) = "
-+ "%d, %d, %d, %d - %d, %d, %d, %d\n",
-+ drvr_stats(adapter)->be_lro_hgram_data[0]/lro_cp,
-+ drvr_stats(adapter)->be_lro_hgram_data[1]/lro_cp,
-+ drvr_stats(adapter)->be_lro_hgram_data[2]/lro_cp,
-+ drvr_stats(adapter)->be_lro_hgram_data[3]/lro_cp,
-+ drvr_stats(adapter)->be_lro_hgram_data[4]/lro_cp,
-+ drvr_stats(adapter)->be_lro_hgram_data[5]/lro_cp,
-+ drvr_stats(adapter)->be_lro_hgram_data[6]/lro_cp,
-+ drvr_stats(adapter)->be_lro_hgram_data[7]/lro_cp);
-+ p += n;
-+
-+ lro_cp = (drvr_stats(adapter)->be_lro_hgram_ack[0] +
-+ drvr_stats(adapter)->be_lro_hgram_ack[1] +
-+ drvr_stats(adapter)->be_lro_hgram_ack[2] +
-+ drvr_stats(adapter)->be_lro_hgram_ack[3] +
-+ drvr_stats(adapter)->be_lro_hgram_ack[4] +
-+ drvr_stats(adapter)->be_lro_hgram_ack[5] +
-+ drvr_stats(adapter)->be_lro_hgram_ack[6] +
-+ drvr_stats(adapter)->be_lro_hgram_ack[7])/100;
-+ lro_cp = (lro_cp == 0) ? 1 : lro_cp; /* avoid divide by 0 */
-+ n = sprintf(p,
-+ "LRO ack count %% histogram (1, 2-3, 4-5,..,>=16) = "
-+ "%d, %d, %d, %d - %d, %d, %d, %d\n",
-+ drvr_stats(adapter)->be_lro_hgram_ack[0]/lro_cp,
-+ drvr_stats(adapter)->be_lro_hgram_ack[1]/lro_cp,
-+ drvr_stats(adapter)->be_lro_hgram_ack[2]/lro_cp,
-+ drvr_stats(adapter)->be_lro_hgram_ack[3]/lro_cp,
-+ drvr_stats(adapter)->be_lro_hgram_ack[4]/lro_cp,
-+ drvr_stats(adapter)->be_lro_hgram_ack[5]/lro_cp,
-+ drvr_stats(adapter)->be_lro_hgram_ack[6]/lro_cp,
-+ drvr_stats(adapter)->be_lro_hgram_ack[7]/lro_cp);
-+ p += n;
-+ n = sprintf(p, "rx_eq_delay = %d \n", adapter->rx_eq.cur_eqd);
-+ p += n;
-+ n = sprintf(p, "rx frags per sec=%d \n",
-+ drvr_stats(adapter)->be_rx_fps);
-+ p += n;
-+
-+ }
-+ *eof = 1;
-+ return (p - page);
-+}
-+
-+static int proc_write_drvr_stat(struct file *file,
-+ const char *buffer, unsigned long count,
-+ void *data)
-+{
-+ struct be_adapter *adapter = (struct be_adapter *) data;
-+
-+ memset(&(adapter->stats.drvr_stats), 0,
-+ sizeof(adapter->stats.drvr_stats));
-+ return (count); /* we do not support write */
-+}
-+
-+#if 0
-+/* the following are some of the functions that are needed here
-+ * until all initializations are done by MPU.
-+ */
-+
-+u32
-+CsrReadDr(void* BaseAddress, u32 Offset)
-+{
-+ u32 *rp;
-+
-+ rp = (u32 *) (((u8 *) BaseAddress) + Offset);
-+ return (*rp);
-+}
-+
-+/*!
-+
-+@brief
-+ This routine writes to a register located within the CSR
-+ space for a given function object.
-+
-+@param
-+ FuncObj - Pointer to the function object to read from.
-+
-+@param
-+ Offset - The Offset (in bytes) to write to within the function's CSR space.
-+
-+@param
-+ Value - The value to write to the register.
-+
-+@return
-+
-+@note
-+ IRQL: any
-+
-+*/
-+void
-+CsrWriteDr(void* BaseAddress, u32 Offset, u32 Value)
-+{
-+ u32 *Register;
-+
-+ Register = (u32 *) (((u8 *) BaseAddress) + Offset);
-+
-+ //TRACE(DL_INFO, "CsrWrite[ %X ] <= %X", Register, Value);
-+ *Register = Value;
-+}
-+u32 be_proc_csrr_offset = -1; /* to latch the offset of next CSR Read req. */
-+
-+/*
-+ * read the csr_r file. return the 32 bit register value from
-+ * CSR space at offset latched in the global location
-+ * be_proc_csrr_offset
-+ */
-+static int proc_read_csr_r(char *page, char **start,
-+ off_t off, int count, int *eof, void *data)
-+{
-+ struct be_adapter * adapter = (struct be_adapter *)data;
-+ u32 val;
-+ int n = 0;
-+ if (be_proc_csrr_offset == -1)
-+ return -EINVAL;
-+
-+ if (off == 0) {
-+ /* read the CSR at offset be_proc_csrr_offset and return */
-+ val = CsrReadDr(adapter->csr_va, be_proc_csrr_offset);
-+ n = sprintf(page, "0x%x\n", val);
-+ }
-+ *eof = 1;
-+ return n;
-+}
-+
-+/*
-+ * save the written value in be_proc_csrr_offset for next
-+ * read from the file
-+ */
-+static int proc_write_csr_r(struct file *file,
-+ const char *buffer, unsigned long count, void *data)
-+{
-+ char buf[64];
-+ u32 n;
-+
-+ if (count > sizeof(buf) + 1)
-+ return -EINVAL;
-+ if (copy_from_user(buf, buffer, count))
-+ return -EFAULT;
-+ buf[count] = '\0';
-+
-+ n = simple_strtoul(buf, NULL, 16);
-+ if (n < 0x50000)
-+ be_proc_csrr_offset = n;
-+ return (count);
-+}
-+
-+/*
-+ * return the latched offset for reading the csr_r file.
-+ */
-+static int proc_read_csr_w(char *page, char **start,
-+ off_t off, int count, int *eof, void *data)
-+{
-+
-+ *eof = 1;
-+ return sprintf(page, "0x%x\n", be_proc_csrr_offset);
-+}
-+
-+/*
-+ * the incoming string is of the form "<offset> <value>"
-+ * where the offset is the offset of the register to be written
-+ * and value is the value to be written.
-+ */
-+static int proc_write_csr_w(struct file *file,
-+ const char *buffer, unsigned long count,
-+ void *data)
-+{
-+ char buf[64];
-+ char *p;
-+ u32 n, val;
-+ struct be_adapter * adapter = (struct be_adapter *)data;
-+
-+ if (count > sizeof(buf) + 1)
-+ return -EINVAL;
-+ if (copy_from_user(buf, buffer, count))
-+ return -EFAULT;
-+ buf[count] = '\0';
-+
-+ n = simple_strtoul(buf, &p, 16);
-+ if (n > 0x50000)
-+ return -EINVAL;
-+
-+ /* now get the actual value to be written */
-+ while (*p == ' ' || *p == '\t')
-+ p++;
-+ val = simple_strtoul(p, NULL, 16);
-+ CsrWriteDr(adapter->csr_va, n, val);
-+ return (count);
-+}
-+#endif
-+
-+void be_init_procfs(struct be_adapter *adapter, int adapt_num)
-+{
-+ static struct proc_dir_entry *pde;
-+
-+ if (adapt_num > MAX_BE_DEVICES - 1)
-+ return;
-+
-+ /* create directory */
-+ be_proc_dir[adapt_num] =
-+ proc_mkdir(be_adpt_name[adapt_num], NULL);
-+ if (be_proc_dir[adapt_num]) {
-+ (be_proc_dir[adapt_num])->owner = THIS_MODULE;
-+ }
-+
-+ pde = create_proc_entry(BE_ETH_RING_FILE, BE_PROC_MODE,
-+ be_proc_dir[adapt_num]);
-+ if (pde) {
-+ pde->read_proc = proc_eth_read_ring;
-+ pde->write_proc = proc_eth_write_ring;
-+ pde->data = adapter;
-+ pde->owner = THIS_MODULE;
-+ }
-+
-+ pde = create_proc_entry(BE_DRVR_STAT_FILE, BE_PROC_MODE,
-+ be_proc_dir[adapt_num]);
-+ if (pde) {
-+ pde->read_proc = proc_read_drvr_stat;
-+ pde->write_proc = proc_write_drvr_stat;
-+ pde->data = adapter;
-+ pde->owner = THIS_MODULE;
-+ }
-+
-+#if 0
-+ if ((pde = create_proc_entry(BE_CSR_R_FILE, BE_PROC_MODE, be_proc_dir[adapt_num]))) {
-+ pde->read_proc = proc_read_csr_r;
-+ pde->write_proc = proc_write_csr_r;
-+ pde->data = adapter;
-+ pde->owner = THIS_MODULE;
-+ }
-+
-+ if ((pde = create_proc_entry(BE_CSR_W_FILE, BE_PROC_MODE, be_proc_dir[adapt_num]))) {
-+ pde->read_proc = proc_read_csr_w;
-+ pde->write_proc = proc_write_csr_w;
-+ pde->data = adapter;
-+ pde->owner = THIS_MODULE;
-+ }
-+#endif
-+}
-+
-+void be_cleanup_procfs(struct be_adapter *adapter, int adapt_num)
-+{
-+ if (adapt_num > MAX_BE_DEVICES - 1)
-+ return;
-+ remove_proc_entry(BE_ETH_RING_FILE, be_proc_dir[adapt_num]);
-+ remove_proc_entry(BE_DRVR_STAT_FILE, be_proc_dir[adapt_num]);
-+ remove_proc_entry(BE_CSR_R_FILE, be_proc_dir[adapt_num]);
-+ remove_proc_entry(BE_CSR_W_FILE, be_proc_dir[adapt_num]);
-+ remove_proc_entry(be_adpt_name[adapt_num], NULL);
-+}
-diff --git a/drivers/net/benet/version.h b/drivers/net/benet/version.h
-new file mode 100644
-index 0000000..c7ed692
---- /dev/null
-+++ b/drivers/net/benet/version.h
-@@ -0,0 +1,51 @@
-+#define STR_BE_BRANCH "0"
-+#define STR_BE_BUILD "479"
-+#define STR_BE_DOT "0"
-+#define STR_BE_MINOR "0"
-+#define STR_BE_MAJOR "4"
-+
-+#define BE_BRANCH 0
-+#define BE_BUILD 479
-+#define BE_DOT 0
-+#define BE_MINOR 0
-+#define BE_MAJOR 4
-+
-+#define MGMT_BRANCH 0
-+#define MGMT_BUILDNUM 479
-+#define MGMT_MINOR 0
-+#define MGMT_MAJOR 4
-+
-+#define BE_REDBOOT_VERSION "2.0.5.0"
-+
-+//start-auto
-+#define BUILD_MONTH "12"
-+#define BUILD_MONTH_NAME "December"
-+#define BUILD_DAY "6"
-+#define BUILD_YEAR "2011"
-+#define BUILD_24HOUR "21"
-+#define BUILD_12HOUR "9"
-+#define BUILD_AM_PM "PM"
-+#define BUILD_MIN "48"
-+#define BUILD_SEC "05"
-+#define BUILD_MONTH_NUMBER 12
-+#define BUILD_DAY_NUMBER 6
-+#define BUILD_YEAR_NUMBER 2011
-+#define BUILD_24HOUR_NUMBER 21
-+#define BUILD_12HOUR_NUMBER 9
-+#define BUILD_MIN_NUMBER 48
-+#define BUILD_SEC_NUMBER 5
-+#undef MAJOR_BUILD
-+#undef MINOR_BUILD
-+#undef DOT_BUILD
-+#define NUMBERED_BUILD
-+#undef BRANCH_BUILD
-+//end-auto
-+
-+#define ELX_FCOE_XROM_BIOS_VER "7.03a1"
-+#define ELX_FCoE_X86_VER "4.02a1"
-+#define ELX_FCoE_EFI_VER "5.01a1"
-+#define ELX_FCoE_FCODE_VER "4.01a0"
-+#define ELX_PXE_BIOS_VER "3.00a5"
-+#define ELX_UEFI_NIC_VER "2.10A10"
-+#define ELX_UEFI_FCODE_VER "1.10A0"
-+#define ELX_ISCSI_BIOS_VER "1.00A8"
-diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
-index 4874b2b..67f8526 100644
---- a/drivers/net/bnx2.c
-+++ b/drivers/net/bnx2.c
-@@ -5809,6 +5809,8 @@ bnx2_test_nvram(struct bnx2 *bp)
- int rc = 0;
- u32 magic, csum;
-
-+ pax_track_stack();
-+
- if ((rc = bnx2_nvram_read(bp, 0, data, 4)) != 0)
- goto test_nvram_done;
-
-diff --git a/drivers/net/cxgb3/l2t.h b/drivers/net/cxgb3/l2t.h
-index fd3eb07..8a6978d 100644
---- a/drivers/net/cxgb3/l2t.h
-+++ b/drivers/net/cxgb3/l2t.h
-@@ -86,7 +86,7 @@ typedef void (*arp_failure_handler_func)(struct t3cdev * dev,
- */
- struct l2t_skb_cb {
- arp_failure_handler_func arp_failure_handler;
--};
-+} __no_const;
-
- #define L2T_SKB_CB(skb) ((struct l2t_skb_cb *)(skb)->cb)
-
-diff --git a/drivers/net/cxgb3/t3_hw.c b/drivers/net/cxgb3/t3_hw.c
-index 032cfe0..411af379 100644
---- a/drivers/net/cxgb3/t3_hw.c
-+++ b/drivers/net/cxgb3/t3_hw.c
-@@ -699,6 +699,8 @@ static int get_vpd_params(struct adapter *adapter, struct vpd_params *p)
- int i, addr, ret;
- struct t3_vpd vpd;
-
-+ pax_track_stack();
-+
- /*
- * Card information is normally at VPD_BASE but some early cards had
- * it at 0.
-diff --git a/drivers/net/dl2k.h b/drivers/net/dl2k.h
-index cde8ecd..db944d3 100644
---- a/drivers/net/dl2k.h
-+++ b/drivers/net/dl2k.h
-@@ -438,4 +438,7 @@ MODULE_DEVICE_TABLE (pci, rio_pci_tbl);
- #define DEFAULT_RXT 750
- #define DEFAULT_TXC 1
- #define MAX_TXC 8
-+
-+#include <linux/mii.h>
-+
- #endif /* __DL2K_H__ */
-diff --git a/drivers/net/e1000e/82571.c b/drivers/net/e1000e/82571.c
-index d1e0563..77f3794 100644
---- a/drivers/net/e1000e/82571.c
-+++ b/drivers/net/e1000e/82571.c
-@@ -212,7 +212,6 @@ static s32 e1000_init_mac_params_82571(struct e1000_adapter *adapter)
- {
- struct e1000_hw *hw = &adapter->hw;
- struct e1000_mac_info *mac = &hw->mac;
-- struct e1000_mac_operations *func = &mac->ops;
- u32 swsm = 0;
- u32 swsm2 = 0;
- bool force_clear_smbi = false;
-@@ -245,22 +244,22 @@ static s32 e1000_init_mac_params_82571(struct e1000_adapter *adapter)
- /* check for link */
- switch (hw->phy.media_type) {
- case e1000_media_type_copper:
-- func->setup_physical_interface = e1000_setup_copper_link_82571;
-- func->check_for_link = e1000e_check_for_copper_link;
-- func->get_link_up_info = e1000e_get_speed_and_duplex_copper;
-+ mac->ops.setup_physical_interface = e1000_setup_copper_link_82571;
-+ mac->ops.check_for_link = e1000e_check_for_copper_link;
-+ mac->ops.get_link_up_info = e1000e_get_speed_and_duplex_copper;
- break;
- case e1000_media_type_fiber:
-- func->setup_physical_interface =
-+ mac->ops.setup_physical_interface =
- e1000_setup_fiber_serdes_link_82571;
-- func->check_for_link = e1000e_check_for_fiber_link;
-- func->get_link_up_info =
-+ mac->ops.check_for_link = e1000e_check_for_fiber_link;
-+ mac->ops.get_link_up_info =
- e1000e_get_speed_and_duplex_fiber_serdes;
- break;
- case e1000_media_type_internal_serdes:
-- func->setup_physical_interface =
-+ mac->ops.setup_physical_interface =
- e1000_setup_fiber_serdes_link_82571;
-- func->check_for_link = e1000_check_for_serdes_link_82571;
-- func->get_link_up_info =
-+ mac->ops.check_for_link = e1000_check_for_serdes_link_82571;
-+ mac->ops.get_link_up_info =
- e1000e_get_speed_and_duplex_fiber_serdes;
- break;
- default:
-@@ -271,12 +270,12 @@ static s32 e1000_init_mac_params_82571(struct e1000_adapter *adapter)
- switch (hw->mac.type) {
- case e1000_82574:
- case e1000_82583:
-- func->check_mng_mode = e1000_check_mng_mode_82574;
-- func->led_on = e1000_led_on_82574;
-+ mac->ops.check_mng_mode = e1000_check_mng_mode_82574;
-+ mac->ops.led_on = e1000_led_on_82574;
- break;
- default:
-- func->check_mng_mode = e1000e_check_mng_mode_generic;
-- func->led_on = e1000e_led_on_generic;
-+ mac->ops.check_mng_mode = e1000e_check_mng_mode_generic;
-+ mac->ops.led_on = e1000e_led_on_generic;
- break;
- }
-
-@@ -1656,7 +1655,7 @@ static void e1000_clear_hw_cntrs_82571(struct e1000_hw *hw)
- temp = er32(ICRXDMTC);
- }
-
--static struct e1000_mac_operations e82571_mac_ops = {
-+static const struct e1000_mac_operations e82571_mac_ops = {
- /* .check_mng_mode: mac type dependent */
- /* .check_for_link: media type dependent */
- .id_led_init = e1000e_id_led_init,
-@@ -1674,7 +1673,7 @@ static struct e1000_mac_operations e82571_mac_ops = {
- .setup_led = e1000e_setup_led_generic,
- };
-
--static struct e1000_phy_operations e82_phy_ops_igp = {
-+static const struct e1000_phy_operations e82_phy_ops_igp = {
- .acquire_phy = e1000_get_hw_semaphore_82571,
- .check_reset_block = e1000e_check_reset_block_generic,
- .commit_phy = NULL,
-@@ -1691,7 +1690,7 @@ static struct e1000_phy_operations e82_phy_ops_igp = {
- .cfg_on_link_up = NULL,
- };
-
--static struct e1000_phy_operations e82_phy_ops_m88 = {
-+static const struct e1000_phy_operations e82_phy_ops_m88 = {
- .acquire_phy = e1000_get_hw_semaphore_82571,
- .check_reset_block = e1000e_check_reset_block_generic,
- .commit_phy = e1000e_phy_sw_reset,
-@@ -1708,7 +1707,7 @@ static struct e1000_phy_operations e82_phy_ops_m88 = {
- .cfg_on_link_up = NULL,
- };
-
--static struct e1000_phy_operations e82_phy_ops_bm = {
-+static const struct e1000_phy_operations e82_phy_ops_bm = {
- .acquire_phy = e1000_get_hw_semaphore_82571,
- .check_reset_block = e1000e_check_reset_block_generic,
- .commit_phy = e1000e_phy_sw_reset,
-@@ -1725,7 +1724,7 @@ static struct e1000_phy_operations e82_phy_ops_bm = {
- .cfg_on_link_up = NULL,
- };
-
--static struct e1000_nvm_operations e82571_nvm_ops = {
-+static const struct e1000_nvm_operations e82571_nvm_ops = {
- .acquire_nvm = e1000_acquire_nvm_82571,
- .read_nvm = e1000e_read_nvm_eerd,
- .release_nvm = e1000_release_nvm_82571,
-diff --git a/drivers/net/e1000e/e1000.h b/drivers/net/e1000e/e1000.h
-index 47db9bd..fa58ccd 100644
---- a/drivers/net/e1000e/e1000.h
-+++ b/drivers/net/e1000e/e1000.h
-@@ -375,9 +375,9 @@ struct e1000_info {
- u32 pba;
- u32 max_hw_frame_size;
- s32 (*get_variants)(struct e1000_adapter *);
-- struct e1000_mac_operations *mac_ops;
-- struct e1000_phy_operations *phy_ops;
-- struct e1000_nvm_operations *nvm_ops;
-+ const struct e1000_mac_operations *mac_ops;
-+ const struct e1000_phy_operations *phy_ops;
-+ const struct e1000_nvm_operations *nvm_ops;
- };
-
- /* hardware capability, feature, and workaround flags */
-diff --git a/drivers/net/e1000e/es2lan.c b/drivers/net/e1000e/es2lan.c
-index ae5d736..afc88d6 100644
---- a/drivers/net/e1000e/es2lan.c
-+++ b/drivers/net/e1000e/es2lan.c
-@@ -207,7 +207,6 @@ static s32 e1000_init_mac_params_80003es2lan(struct e1000_adapter *adapter)
- {
- struct e1000_hw *hw = &adapter->hw;
- struct e1000_mac_info *mac = &hw->mac;
-- struct e1000_mac_operations *func = &mac->ops;
-
- /* Set media type */
- switch (adapter->pdev->device) {
-@@ -229,16 +228,16 @@ static s32 e1000_init_mac_params_80003es2lan(struct e1000_adapter *adapter)
- /* check for link */
- switch (hw->phy.media_type) {
- case e1000_media_type_copper:
-- func->setup_physical_interface = e1000_setup_copper_link_80003es2lan;
-- func->check_for_link = e1000e_check_for_copper_link;
-+ mac->ops.setup_physical_interface = e1000_setup_copper_link_80003es2lan;
-+ mac->ops.check_for_link = e1000e_check_for_copper_link;
- break;
- case e1000_media_type_fiber:
-- func->setup_physical_interface = e1000e_setup_fiber_serdes_link;
-- func->check_for_link = e1000e_check_for_fiber_link;
-+ mac->ops.setup_physical_interface = e1000e_setup_fiber_serdes_link;
-+ mac->ops.check_for_link = e1000e_check_for_fiber_link;
- break;
- case e1000_media_type_internal_serdes:
-- func->setup_physical_interface = e1000e_setup_fiber_serdes_link;
-- func->check_for_link = e1000e_check_for_serdes_link;
-+ mac->ops.setup_physical_interface = e1000e_setup_fiber_serdes_link;
-+ mac->ops.check_for_link = e1000e_check_for_serdes_link;
- break;
- default:
- return -E1000_ERR_CONFIG;
-@@ -1365,7 +1364,7 @@ static void e1000_clear_hw_cntrs_80003es2lan(struct e1000_hw *hw)
- temp = er32(ICRXDMTC);
- }
-
--static struct e1000_mac_operations es2_mac_ops = {
-+static const struct e1000_mac_operations es2_mac_ops = {
- .id_led_init = e1000e_id_led_init,
- .check_mng_mode = e1000e_check_mng_mode_generic,
- /* check_for_link dependent on media type */
-@@ -1383,7 +1382,7 @@ static struct e1000_mac_operations es2_mac_ops = {
- .setup_led = e1000e_setup_led_generic,
- };
-
--static struct e1000_phy_operations es2_phy_ops = {
-+static const struct e1000_phy_operations es2_phy_ops = {
- .acquire_phy = e1000_acquire_phy_80003es2lan,
- .check_reset_block = e1000e_check_reset_block_generic,
- .commit_phy = e1000e_phy_sw_reset,
-@@ -1400,7 +1399,7 @@ static struct e1000_phy_operations es2_phy_ops = {
- .cfg_on_link_up = e1000_cfg_on_link_up_80003es2lan,
- };
-
--static struct e1000_nvm_operations es2_nvm_ops = {
-+static const struct e1000_nvm_operations es2_nvm_ops = {
- .acquire_nvm = e1000_acquire_nvm_80003es2lan,
- .read_nvm = e1000e_read_nvm_eerd,
- .release_nvm = e1000_release_nvm_80003es2lan,
-diff --git a/drivers/net/e1000e/ich8lan.c b/drivers/net/e1000e/ich8lan.c
-index de39f9a..e28d3e0 100644
---- a/drivers/net/e1000e/ich8lan.c
-+++ b/drivers/net/e1000e/ich8lan.c
-@@ -3463,7 +3463,7 @@ static void e1000_clear_hw_cntrs_ich8lan(struct e1000_hw *hw)
- }
- }
-
--static struct e1000_mac_operations ich8_mac_ops = {
-+static const struct e1000_mac_operations ich8_mac_ops = {
- .id_led_init = e1000e_id_led_init,
- .check_mng_mode = e1000_check_mng_mode_ich8lan,
- .check_for_link = e1000_check_for_copper_link_ich8lan,
-@@ -3481,7 +3481,7 @@ static struct e1000_mac_operations ich8_mac_ops = {
- /* id_led_init dependent on mac type */
- };
-
--static struct e1000_phy_operations ich8_phy_ops = {
-+static const struct e1000_phy_operations ich8_phy_ops = {
- .acquire_phy = e1000_acquire_swflag_ich8lan,
- .check_reset_block = e1000_check_reset_block_ich8lan,
- .commit_phy = NULL,
-@@ -3497,7 +3497,7 @@ static struct e1000_phy_operations ich8_phy_ops = {
- .write_phy_reg = e1000e_write_phy_reg_igp,
- };
-
--static struct e1000_nvm_operations ich8_nvm_ops = {
-+static const struct e1000_nvm_operations ich8_nvm_ops = {
- .acquire_nvm = e1000_acquire_nvm_ich8lan,
- .read_nvm = e1000_read_nvm_ich8lan,
- .release_nvm = e1000_release_nvm_ich8lan,
-diff --git a/drivers/net/fealnx.c b/drivers/net/fealnx.c
-index 18d5fbb..542d96d 100644
---- a/drivers/net/fealnx.c
-+++ b/drivers/net/fealnx.c
-@@ -151,7 +151,7 @@ struct chip_info {
- int flags;
- };
-
--static const struct chip_info skel_netdrv_tbl[] __devinitdata = {
-+static const struct chip_info skel_netdrv_tbl[] __devinitconst = {
- { "100/10M Ethernet PCI Adapter", HAS_MII_XCVR },
- { "100/10M Ethernet PCI Adapter", HAS_CHIP_XCVR },
- { "1000/100/10M Ethernet PCI Adapter", HAS_MII_XCVR },
-diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
-index 0e5b54b..b503f82 100644
---- a/drivers/net/hamradio/6pack.c
-+++ b/drivers/net/hamradio/6pack.c
-@@ -461,6 +461,8 @@ static void sixpack_receive_buf(struct tty_struct *tty,
- unsigned char buf[512];
- int count1;
-
-+ pax_track_stack();
-+
- if (!count)
- return;
-
-diff --git a/drivers/net/ibmveth.c b/drivers/net/ibmveth.c
-index 5862282..7cce8cb 100644
---- a/drivers/net/ibmveth.c
-+++ b/drivers/net/ibmveth.c
-@@ -1577,7 +1577,7 @@ static struct attribute * veth_pool_attrs[] = {
- NULL,
- };
-
--static struct sysfs_ops veth_pool_ops = {
-+static const struct sysfs_ops veth_pool_ops = {
- .show = veth_pool_show,
- .store = veth_pool_store,
- };
-diff --git a/drivers/net/igb/e1000_82575.c b/drivers/net/igb/e1000_82575.c
-index d617f2d..57b5309 100644
---- a/drivers/net/igb/e1000_82575.c
-+++ b/drivers/net/igb/e1000_82575.c
-@@ -1411,7 +1411,7 @@ void igb_vmdq_set_replication_pf(struct e1000_hw *hw, bool enable)
- wr32(E1000_VT_CTL, vt_ctl);
- }
-
--static struct e1000_mac_operations e1000_mac_ops_82575 = {
-+static const struct e1000_mac_operations e1000_mac_ops_82575 = {
- .reset_hw = igb_reset_hw_82575,
- .init_hw = igb_init_hw_82575,
- .check_for_link = igb_check_for_link_82575,
-@@ -1420,13 +1420,13 @@ static struct e1000_mac_operations e1000_mac_ops_82575 = {
- .get_speed_and_duplex = igb_get_speed_and_duplex_copper,
- };
-
--static struct e1000_phy_operations e1000_phy_ops_82575 = {
-+static const struct e1000_phy_operations e1000_phy_ops_82575 = {
- .acquire = igb_acquire_phy_82575,
- .get_cfg_done = igb_get_cfg_done_82575,
- .release = igb_release_phy_82575,
- };
-
--static struct e1000_nvm_operations e1000_nvm_ops_82575 = {
-+static const struct e1000_nvm_operations e1000_nvm_ops_82575 = {
- .acquire = igb_acquire_nvm_82575,
- .read = igb_read_nvm_eerd,
- .release = igb_release_nvm_82575,
-diff --git a/drivers/net/iseries_veth.c b/drivers/net/iseries_veth.c
-index aa7286b..a61394f 100644
---- a/drivers/net/iseries_veth.c
-+++ b/drivers/net/iseries_veth.c
-@@ -384,7 +384,7 @@ static struct attribute *veth_cnx_default_attrs[] = {
- NULL
- };
-
--static struct sysfs_ops veth_cnx_sysfs_ops = {
-+static const struct sysfs_ops veth_cnx_sysfs_ops = {
- .show = veth_cnx_attribute_show
- };
-
-@@ -441,7 +441,7 @@ static struct attribute *veth_port_default_attrs[] = {
- NULL
- };
-
--static struct sysfs_ops veth_port_sysfs_ops = {
-+static const struct sysfs_ops veth_port_sysfs_ops = {
- .show = veth_port_attribute_show
- };
-
-diff --git a/drivers/net/ixgb/ixgb_main.c b/drivers/net/ixgb/ixgb_main.c
-index 8aa44dc..fa1e797 100644
---- a/drivers/net/ixgb/ixgb_main.c
-+++ b/drivers/net/ixgb/ixgb_main.c
-@@ -1052,6 +1052,8 @@ ixgb_set_multi(struct net_device *netdev)
- u32 rctl;
- int i;
-
-+ pax_track_stack();
-+
- /* Check for Promiscuous and All Multicast modes */
-
- rctl = IXGB_READ_REG(hw, RCTL);
-diff --git a/drivers/net/ixgb/ixgb_param.c b/drivers/net/ixgb/ixgb_param.c
-index af35e1d..8781785 100644
---- a/drivers/net/ixgb/ixgb_param.c
-+++ b/drivers/net/ixgb/ixgb_param.c
-@@ -260,6 +260,9 @@ void __devinit
- ixgb_check_options(struct ixgb_adapter *adapter)
- {
- int bd = adapter->bd_number;
-+
-+ pax_track_stack();
-+
- if (bd >= IXGB_MAX_NIC) {
- printk(KERN_NOTICE
- "Warning: no configuration for board #%i\n", bd);
-diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
-index 2490aa3..185d647 100644
---- a/drivers/net/macvlan.c
-+++ b/drivers/net/macvlan.c
-@@ -568,7 +568,7 @@ static void macvlan_dellink(struct net_device *dev)
- macvlan_port_destroy(port->dev);
- }
-
--static struct rtnl_link_ops macvlan_link_ops __read_mostly = {
-+static struct rtnl_link_ops macvlan_link_ops = {
- .kind = "macvlan",
- .priv_size = sizeof(struct macvlan_dev),
- .get_tx_queues = macvlan_get_tx_queues,
-diff --git a/drivers/net/mlx4/eq.c b/drivers/net/mlx4/eq.c
-index bffb799..20374f5 100644
---- a/drivers/net/mlx4/eq.c
-+++ b/drivers/net/mlx4/eq.c
-@@ -552,8 +552,7 @@ int mlx4_init_eq_table(struct mlx4_dev *dev)
- int err;
- int i;
-
-- priv->eq_table.uar_map = kcalloc(sizeof *priv->eq_table.uar_map,
-- mlx4_num_eq_uar(dev), GFP_KERNEL);
-+ priv->eq_table.uar_map = kcalloc(mlx4_num_eq_uar(dev), sizeof *priv->eq_table.uar_map, GFP_KERNEL);
- if (!priv->eq_table.uar_map) {
- err = -ENOMEM;
- goto err_out_free;
-diff --git a/drivers/net/mlx4/main.c b/drivers/net/mlx4/main.c
-index 291a505..2543756 100644
---- a/drivers/net/mlx4/main.c
-+++ b/drivers/net/mlx4/main.c
-@@ -38,6 +38,7 @@
- #include <linux/errno.h>
- #include <linux/pci.h>
- #include <linux/dma-mapping.h>
-+#include <linux/sched.h>
-
- #include <linux/mlx4/device.h>
- #include <linux/mlx4/doorbell.h>
-@@ -730,6 +731,8 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
- u64 icm_size;
- int err;
-
-+ pax_track_stack();
-+
- err = mlx4_QUERY_FW(dev);
- if (err) {
- if (err == -EACCES)
-diff --git a/drivers/net/niu.c b/drivers/net/niu.c
-index 2dce134..fa5ce75 100644
---- a/drivers/net/niu.c
-+++ b/drivers/net/niu.c
-@@ -9128,6 +9128,8 @@ static void __devinit niu_try_msix(struct niu *np, u8 *ldg_num_map)
- int i, num_irqs, err;
- u8 first_ldg;
-
-+ pax_track_stack();
-+
- first_ldg = (NIU_NUM_LDG / parent->num_ports) * np->port;
- for (i = 0; i < (NIU_NUM_LDG / parent->num_ports); i++)
- ldg_num_map[i] = first_ldg + i;
-diff --git a/drivers/net/pasemi_mac.c b/drivers/net/pasemi_mac.c
-index c254a7f..7aa030e 100644
---- a/drivers/net/pasemi_mac.c
-+++ b/drivers/net/pasemi_mac.c
-@@ -1099,9 +1099,9 @@ static int pasemi_mac_phy_init(struct net_device *dev)
- phydev = of_phy_connect(dev, phy_dn, &pasemi_adjust_link, 0,
- PHY_INTERFACE_MODE_SGMII);
-
-- if (IS_ERR(phydev)) {
-+ if (!phydev) {
- printk(KERN_ERR "%s: Could not attach to phy\n", dev->name);
-- return PTR_ERR(phydev);
-+ return -ENODEV;
- }
-
- mac->phydev = phydev;
-diff --git a/drivers/net/pcnet32.c b/drivers/net/pcnet32.c
-index c1b3f09..97cd8c4 100644
---- a/drivers/net/pcnet32.c
-+++ b/drivers/net/pcnet32.c
-@@ -79,7 +79,7 @@ static int cards_found;
- /*
- * VLB I/O addresses
- */
--static unsigned int pcnet32_portlist[] __initdata =
-+static unsigned int pcnet32_portlist[] __devinitdata =
- { 0x300, 0x320, 0x340, 0x360, 0 };
-
- static int pcnet32_debug = 0;
-@@ -267,7 +267,7 @@ struct pcnet32_private {
- struct sk_buff **rx_skbuff;
- dma_addr_t *tx_dma_addr;
- dma_addr_t *rx_dma_addr;
-- struct pcnet32_access a;
-+ struct pcnet32_access *a;
- spinlock_t lock; /* Guard lock */
- unsigned int cur_rx, cur_tx; /* The next free ring entry */
- unsigned int rx_ring_size; /* current rx ring size */
-@@ -457,9 +457,9 @@ static void pcnet32_netif_start(struct net_device *dev)
- u16 val;
-
- netif_wake_queue(dev);
-- val = lp->a.read_csr(ioaddr, CSR3);
-+ val = lp->a->read_csr(ioaddr, CSR3);
- val &= 0x00ff;
-- lp->a.write_csr(ioaddr, CSR3, val);
-+ lp->a->write_csr(ioaddr, CSR3, val);
- napi_enable(&lp->napi);
- }
-
-@@ -744,7 +744,7 @@ static u32 pcnet32_get_link(struct net_device *dev)
- r = mii_link_ok(&lp->mii_if);
- } else if (lp->chip_version >= PCNET32_79C970A) {
- ulong ioaddr = dev->base_addr; /* card base I/O address */
-- r = (lp->a.read_bcr(ioaddr, 4) != 0xc0);
-+ r = (lp->a->read_bcr(ioaddr, 4) != 0xc0);
- } else { /* can not detect link on really old chips */
- r = 1;
- }
-@@ -806,7 +806,7 @@ static int pcnet32_set_ringparam(struct net_device *dev,
- pcnet32_netif_stop(dev);
-
- spin_lock_irqsave(&lp->lock, flags);
-- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
-
- size = min(ering->tx_pending, (unsigned int)TX_MAX_RING_SIZE);
-
-@@ -886,7 +886,7 @@ static void pcnet32_ethtool_test(struct net_device *dev,
- static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
- {
- struct pcnet32_private *lp = netdev_priv(dev);
-- struct pcnet32_access *a = &lp->a; /* access to registers */
-+ struct pcnet32_access *a = lp->a; /* access to registers */
- ulong ioaddr = dev->base_addr; /* card base I/O address */
- struct sk_buff *skb; /* sk buff */
- int x, i; /* counters */
-@@ -906,21 +906,21 @@ static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
- pcnet32_netif_stop(dev);
-
- spin_lock_irqsave(&lp->lock, flags);
-- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
-
- numbuffs = min(numbuffs, (int)min(lp->rx_ring_size, lp->tx_ring_size));
-
- /* Reset the PCNET32 */
-- lp->a.reset(ioaddr);
-- lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
-+ lp->a->reset(ioaddr);
-+ lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
-
- /* switch pcnet32 to 32bit mode */
-- lp->a.write_bcr(ioaddr, 20, 2);
-+ lp->a->write_bcr(ioaddr, 20, 2);
-
- /* purge & init rings but don't actually restart */
- pcnet32_restart(dev, 0x0000);
-
-- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
-
- /* Initialize Transmit buffers. */
- size = data_len + 15;
-@@ -966,10 +966,10 @@ static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
-
- /* set int loopback in CSR15 */
- x = a->read_csr(ioaddr, CSR15) & 0xfffc;
-- lp->a.write_csr(ioaddr, CSR15, x | 0x0044);
-+ lp->a->write_csr(ioaddr, CSR15, x | 0x0044);
-
- teststatus = cpu_to_le16(0x8000);
-- lp->a.write_csr(ioaddr, CSR0, CSR0_START); /* Set STRT bit */
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_START); /* Set STRT bit */
-
- /* Check status of descriptors */
- for (x = 0; x < numbuffs; x++) {
-@@ -990,7 +990,7 @@ static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
- }
- }
-
-- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
- wmb();
- if (netif_msg_hw(lp) && netif_msg_pktdata(lp)) {
- printk(KERN_DEBUG "%s: RX loopback packets:\n", dev->name);
-@@ -1039,7 +1039,7 @@ static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
- pcnet32_restart(dev, CSR0_NORMAL);
- } else {
- pcnet32_purge_rx_ring(dev);
-- lp->a.write_bcr(ioaddr, 20, 4); /* return to 16bit mode */
-+ lp->a->write_bcr(ioaddr, 20, 4); /* return to 16bit mode */
- }
- spin_unlock_irqrestore(&lp->lock, flags);
-
-@@ -1049,7 +1049,7 @@ static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
- static void pcnet32_led_blink_callback(struct net_device *dev)
- {
- struct pcnet32_private *lp = netdev_priv(dev);
-- struct pcnet32_access *a = &lp->a;
-+ struct pcnet32_access *a = lp->a;
- ulong ioaddr = dev->base_addr;
- unsigned long flags;
- int i;
-@@ -1066,7 +1066,7 @@ static void pcnet32_led_blink_callback(struct net_device *dev)
- static int pcnet32_phys_id(struct net_device *dev, u32 data)
- {
- struct pcnet32_private *lp = netdev_priv(dev);
-- struct pcnet32_access *a = &lp->a;
-+ struct pcnet32_access *a = lp->a;
- ulong ioaddr = dev->base_addr;
- unsigned long flags;
- int i, regs[4];
-@@ -1112,7 +1112,7 @@ static int pcnet32_suspend(struct net_device *dev, unsigned long *flags,
- {
- int csr5;
- struct pcnet32_private *lp = netdev_priv(dev);
-- struct pcnet32_access *a = &lp->a;
-+ struct pcnet32_access *a = lp->a;
- ulong ioaddr = dev->base_addr;
- int ticks;
-
-@@ -1388,8 +1388,8 @@ static int pcnet32_poll(struct napi_struct *napi, int budget)
- spin_lock_irqsave(&lp->lock, flags);
- if (pcnet32_tx(dev)) {
- /* reset the chip to clear the error condition, then restart */
-- lp->a.reset(ioaddr);
-- lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
-+ lp->a->reset(ioaddr);
-+ lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
- pcnet32_restart(dev, CSR0_START);
- netif_wake_queue(dev);
- }
-@@ -1401,12 +1401,12 @@ static int pcnet32_poll(struct napi_struct *napi, int budget)
- __napi_complete(napi);
-
- /* clear interrupt masks */
-- val = lp->a.read_csr(ioaddr, CSR3);
-+ val = lp->a->read_csr(ioaddr, CSR3);
- val &= 0x00ff;
-- lp->a.write_csr(ioaddr, CSR3, val);
-+ lp->a->write_csr(ioaddr, CSR3, val);
-
- /* Set interrupt enable. */
-- lp->a.write_csr(ioaddr, CSR0, CSR0_INTEN);
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_INTEN);
-
- spin_unlock_irqrestore(&lp->lock, flags);
- }
-@@ -1429,7 +1429,7 @@ static void pcnet32_get_regs(struct net_device *dev, struct ethtool_regs *regs,
- int i, csr0;
- u16 *buff = ptr;
- struct pcnet32_private *lp = netdev_priv(dev);
-- struct pcnet32_access *a = &lp->a;
-+ struct pcnet32_access *a = lp->a;
- ulong ioaddr = dev->base_addr;
- unsigned long flags;
-
-@@ -1466,9 +1466,9 @@ static void pcnet32_get_regs(struct net_device *dev, struct ethtool_regs *regs,
- for (j = 0; j < PCNET32_MAX_PHYS; j++) {
- if (lp->phymask & (1 << j)) {
- for (i = 0; i < PCNET32_REGS_PER_PHY; i++) {
-- lp->a.write_bcr(ioaddr, 33,
-+ lp->a->write_bcr(ioaddr, 33,
- (j << 5) | i);
-- *buff++ = lp->a.read_bcr(ioaddr, 34);
-+ *buff++ = lp->a->read_bcr(ioaddr, 34);
- }
- }
- }
-@@ -1858,7 +1858,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
- ((cards_found >= MAX_UNITS) || full_duplex[cards_found]))
- lp->options |= PCNET32_PORT_FD;
-
-- lp->a = *a;
-+ lp->a = a;
-
- /* prior to register_netdev, dev->name is not yet correct */
- if (pcnet32_alloc_ring(dev, pci_name(lp->pci_dev))) {
-@@ -1917,7 +1917,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
- if (lp->mii) {
- /* lp->phycount and lp->phymask are set to 0 by memset above */
-
-- lp->mii_if.phy_id = ((lp->a.read_bcr(ioaddr, 33)) >> 5) & 0x1f;
-+ lp->mii_if.phy_id = ((lp->a->read_bcr(ioaddr, 33)) >> 5) & 0x1f;
- /* scan for PHYs */
- for (i = 0; i < PCNET32_MAX_PHYS; i++) {
- unsigned short id1, id2;
-@@ -1938,7 +1938,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
- "Found PHY %04x:%04x at address %d.\n",
- id1, id2, i);
- }
-- lp->a.write_bcr(ioaddr, 33, (lp->mii_if.phy_id) << 5);
-+ lp->a->write_bcr(ioaddr, 33, (lp->mii_if.phy_id) << 5);
- if (lp->phycount > 1) {
- lp->options |= PCNET32_PORT_MII;
- }
-@@ -2109,10 +2109,10 @@ static int pcnet32_open(struct net_device *dev)
- }
-
- /* Reset the PCNET32 */
-- lp->a.reset(ioaddr);
-+ lp->a->reset(ioaddr);
-
- /* switch pcnet32 to 32bit mode */
-- lp->a.write_bcr(ioaddr, 20, 2);
-+ lp->a->write_bcr(ioaddr, 20, 2);
-
- if (netif_msg_ifup(lp))
- printk(KERN_DEBUG
-@@ -2122,14 +2122,14 @@ static int pcnet32_open(struct net_device *dev)
- (u32) (lp->init_dma_addr));
-
- /* set/reset autoselect bit */
-- val = lp->a.read_bcr(ioaddr, 2) & ~2;
-+ val = lp->a->read_bcr(ioaddr, 2) & ~2;
- if (lp->options & PCNET32_PORT_ASEL)
- val |= 2;
-- lp->a.write_bcr(ioaddr, 2, val);
-+ lp->a->write_bcr(ioaddr, 2, val);
-
- /* handle full duplex setting */
- if (lp->mii_if.full_duplex) {
-- val = lp->a.read_bcr(ioaddr, 9) & ~3;
-+ val = lp->a->read_bcr(ioaddr, 9) & ~3;
- if (lp->options & PCNET32_PORT_FD) {
- val |= 1;
- if (lp->options == (PCNET32_PORT_FD | PCNET32_PORT_AUI))
-@@ -2139,14 +2139,14 @@ static int pcnet32_open(struct net_device *dev)
- if (lp->chip_version == 0x2627)
- val |= 3;
- }
-- lp->a.write_bcr(ioaddr, 9, val);
-+ lp->a->write_bcr(ioaddr, 9, val);
- }
-
- /* set/reset GPSI bit in test register */
-- val = lp->a.read_csr(ioaddr, 124) & ~0x10;
-+ val = lp->a->read_csr(ioaddr, 124) & ~0x10;
- if ((lp->options & PCNET32_PORT_PORTSEL) == PCNET32_PORT_GPSI)
- val |= 0x10;
-- lp->a.write_csr(ioaddr, 124, val);
-+ lp->a->write_csr(ioaddr, 124, val);
-
- /* Allied Telesyn AT 2700/2701 FX are 100Mbit only and do not negotiate */
- if (pdev && pdev->subsystem_vendor == PCI_VENDOR_ID_AT &&
-@@ -2167,24 +2167,24 @@ static int pcnet32_open(struct net_device *dev)
- * duplex, and/or enable auto negotiation, and clear DANAS
- */
- if (lp->mii && !(lp->options & PCNET32_PORT_ASEL)) {
-- lp->a.write_bcr(ioaddr, 32,
-- lp->a.read_bcr(ioaddr, 32) | 0x0080);
-+ lp->a->write_bcr(ioaddr, 32,
-+ lp->a->read_bcr(ioaddr, 32) | 0x0080);
- /* disable Auto Negotiation, set 10Mpbs, HD */
-- val = lp->a.read_bcr(ioaddr, 32) & ~0xb8;
-+ val = lp->a->read_bcr(ioaddr, 32) & ~0xb8;
- if (lp->options & PCNET32_PORT_FD)
- val |= 0x10;
- if (lp->options & PCNET32_PORT_100)
- val |= 0x08;
-- lp->a.write_bcr(ioaddr, 32, val);
-+ lp->a->write_bcr(ioaddr, 32, val);
- } else {
- if (lp->options & PCNET32_PORT_ASEL) {
-- lp->a.write_bcr(ioaddr, 32,
-- lp->a.read_bcr(ioaddr,
-+ lp->a->write_bcr(ioaddr, 32,
-+ lp->a->read_bcr(ioaddr,
- 32) | 0x0080);
- /* enable auto negotiate, setup, disable fd */
-- val = lp->a.read_bcr(ioaddr, 32) & ~0x98;
-+ val = lp->a->read_bcr(ioaddr, 32) & ~0x98;
- val |= 0x20;
-- lp->a.write_bcr(ioaddr, 32, val);
-+ lp->a->write_bcr(ioaddr, 32, val);
- }
- }
- } else {
-@@ -2197,10 +2197,10 @@ static int pcnet32_open(struct net_device *dev)
- * There is really no good other way to handle multiple PHYs
- * other than turning off all automatics
- */
-- val = lp->a.read_bcr(ioaddr, 2);
-- lp->a.write_bcr(ioaddr, 2, val & ~2);
-- val = lp->a.read_bcr(ioaddr, 32);
-- lp->a.write_bcr(ioaddr, 32, val & ~(1 << 7)); /* stop MII manager */
-+ val = lp->a->read_bcr(ioaddr, 2);
-+ lp->a->write_bcr(ioaddr, 2, val & ~2);
-+ val = lp->a->read_bcr(ioaddr, 32);
-+ lp->a->write_bcr(ioaddr, 32, val & ~(1 << 7)); /* stop MII manager */
-
- if (!(lp->options & PCNET32_PORT_ASEL)) {
- /* setup ecmd */
-@@ -2210,7 +2210,7 @@ static int pcnet32_open(struct net_device *dev)
- ecmd.speed =
- lp->
- options & PCNET32_PORT_100 ? SPEED_100 : SPEED_10;
-- bcr9 = lp->a.read_bcr(ioaddr, 9);
-+ bcr9 = lp->a->read_bcr(ioaddr, 9);
-
- if (lp->options & PCNET32_PORT_FD) {
- ecmd.duplex = DUPLEX_FULL;
-@@ -2219,7 +2219,7 @@ static int pcnet32_open(struct net_device *dev)
- ecmd.duplex = DUPLEX_HALF;
- bcr9 |= ~(1 << 0);
- }
-- lp->a.write_bcr(ioaddr, 9, bcr9);
-+ lp->a->write_bcr(ioaddr, 9, bcr9);
- }
-
- for (i = 0; i < PCNET32_MAX_PHYS; i++) {
-@@ -2252,9 +2252,9 @@ static int pcnet32_open(struct net_device *dev)
-
- #ifdef DO_DXSUFLO
- if (lp->dxsuflo) { /* Disable transmit stop on underflow */
-- val = lp->a.read_csr(ioaddr, CSR3);
-+ val = lp->a->read_csr(ioaddr, CSR3);
- val |= 0x40;
-- lp->a.write_csr(ioaddr, CSR3, val);
-+ lp->a->write_csr(ioaddr, CSR3, val);
- }
- #endif
-
-@@ -2270,11 +2270,11 @@ static int pcnet32_open(struct net_device *dev)
- napi_enable(&lp->napi);
-
- /* Re-initialize the PCNET32, and start it when done. */
-- lp->a.write_csr(ioaddr, 1, (lp->init_dma_addr & 0xffff));
-- lp->a.write_csr(ioaddr, 2, (lp->init_dma_addr >> 16));
-+ lp->a->write_csr(ioaddr, 1, (lp->init_dma_addr & 0xffff));
-+ lp->a->write_csr(ioaddr, 2, (lp->init_dma_addr >> 16));
-
-- lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
-- lp->a.write_csr(ioaddr, CSR0, CSR0_INIT);
-+ lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_INIT);
-
- netif_start_queue(dev);
-
-@@ -2286,20 +2286,20 @@ static int pcnet32_open(struct net_device *dev)
-
- i = 0;
- while (i++ < 100)
-- if (lp->a.read_csr(ioaddr, CSR0) & CSR0_IDON)
-+ if (lp->a->read_csr(ioaddr, CSR0) & CSR0_IDON)
- break;
- /*
- * We used to clear the InitDone bit, 0x0100, here but Mark Stockton
- * reports that doing so triggers a bug in the '974.
- */
-- lp->a.write_csr(ioaddr, CSR0, CSR0_NORMAL);
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_NORMAL);
-
- if (netif_msg_ifup(lp))
- printk(KERN_DEBUG
- "%s: pcnet32 open after %d ticks, init block %#x csr0 %4.4x.\n",
- dev->name, i,
- (u32) (lp->init_dma_addr),
-- lp->a.read_csr(ioaddr, CSR0));
-+ lp->a->read_csr(ioaddr, CSR0));
-
- spin_unlock_irqrestore(&lp->lock, flags);
-
-@@ -2313,7 +2313,7 @@ static int pcnet32_open(struct net_device *dev)
- * Switch back to 16bit mode to avoid problems with dumb
- * DOS packet driver after a warm reboot
- */
-- lp->a.write_bcr(ioaddr, 20, 4);
-+ lp->a->write_bcr(ioaddr, 20, 4);
-
- err_free_irq:
- spin_unlock_irqrestore(&lp->lock, flags);
-@@ -2420,7 +2420,7 @@ static void pcnet32_restart(struct net_device *dev, unsigned int csr0_bits)
-
- /* wait for stop */
- for (i = 0; i < 100; i++)
-- if (lp->a.read_csr(ioaddr, CSR0) & CSR0_STOP)
-+ if (lp->a->read_csr(ioaddr, CSR0) & CSR0_STOP)
- break;
-
- if (i >= 100 && netif_msg_drv(lp))
-@@ -2433,13 +2433,13 @@ static void pcnet32_restart(struct net_device *dev, unsigned int csr0_bits)
- return;
-
- /* ReInit Ring */
-- lp->a.write_csr(ioaddr, CSR0, CSR0_INIT);
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_INIT);
- i = 0;
- while (i++ < 1000)
-- if (lp->a.read_csr(ioaddr, CSR0) & CSR0_IDON)
-+ if (lp->a->read_csr(ioaddr, CSR0) & CSR0_IDON)
- break;
-
-- lp->a.write_csr(ioaddr, CSR0, csr0_bits);
-+ lp->a->write_csr(ioaddr, CSR0, csr0_bits);
- }
-
- static void pcnet32_tx_timeout(struct net_device *dev)
-@@ -2452,8 +2452,8 @@ static void pcnet32_tx_timeout(struct net_device *dev)
- if (pcnet32_debug & NETIF_MSG_DRV)
- printk(KERN_ERR
- "%s: transmit timed out, status %4.4x, resetting.\n",
-- dev->name, lp->a.read_csr(ioaddr, CSR0));
-- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
-+ dev->name, lp->a->read_csr(ioaddr, CSR0));
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
- dev->stats.tx_errors++;
- if (netif_msg_tx_err(lp)) {
- int i;
-@@ -2497,7 +2497,7 @@ static netdev_tx_t pcnet32_start_xmit(struct sk_buff *skb,
- if (netif_msg_tx_queued(lp)) {
- printk(KERN_DEBUG
- "%s: pcnet32_start_xmit() called, csr0 %4.4x.\n",
-- dev->name, lp->a.read_csr(ioaddr, CSR0));
-+ dev->name, lp->a->read_csr(ioaddr, CSR0));
- }
-
- /* Default status -- will not enable Successful-TxDone
-@@ -2528,7 +2528,7 @@ static netdev_tx_t pcnet32_start_xmit(struct sk_buff *skb,
- dev->stats.tx_bytes += skb->len;
-
- /* Trigger an immediate send poll. */
-- lp->a.write_csr(ioaddr, CSR0, CSR0_INTEN | CSR0_TXPOLL);
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_INTEN | CSR0_TXPOLL);
-
- dev->trans_start = jiffies;
-
-@@ -2555,18 +2555,18 @@ pcnet32_interrupt(int irq, void *dev_id)
-
- spin_lock(&lp->lock);
-
-- csr0 = lp->a.read_csr(ioaddr, CSR0);
-+ csr0 = lp->a->read_csr(ioaddr, CSR0);
- while ((csr0 & 0x8f00) && --boguscnt >= 0) {
- if (csr0 == 0xffff) {
- break; /* PCMCIA remove happened */
- }
- /* Acknowledge all of the current interrupt sources ASAP. */
-- lp->a.write_csr(ioaddr, CSR0, csr0 & ~0x004f);
-+ lp->a->write_csr(ioaddr, CSR0, csr0 & ~0x004f);
-
- if (netif_msg_intr(lp))
- printk(KERN_DEBUG
- "%s: interrupt csr0=%#2.2x new csr=%#2.2x.\n",
-- dev->name, csr0, lp->a.read_csr(ioaddr, CSR0));
-+ dev->name, csr0, lp->a->read_csr(ioaddr, CSR0));
-
- /* Log misc errors. */
- if (csr0 & 0x4000)
-@@ -2595,19 +2595,19 @@ pcnet32_interrupt(int irq, void *dev_id)
- if (napi_schedule_prep(&lp->napi)) {
- u16 val;
- /* set interrupt masks */
-- val = lp->a.read_csr(ioaddr, CSR3);
-+ val = lp->a->read_csr(ioaddr, CSR3);
- val |= 0x5f00;
-- lp->a.write_csr(ioaddr, CSR3, val);
-+ lp->a->write_csr(ioaddr, CSR3, val);
-
- __napi_schedule(&lp->napi);
- break;
- }
-- csr0 = lp->a.read_csr(ioaddr, CSR0);
-+ csr0 = lp->a->read_csr(ioaddr, CSR0);
- }
-
- if (netif_msg_intr(lp))
- printk(KERN_DEBUG "%s: exiting interrupt, csr0=%#4.4x.\n",
-- dev->name, lp->a.read_csr(ioaddr, CSR0));
-+ dev->name, lp->a->read_csr(ioaddr, CSR0));
-
- spin_unlock(&lp->lock);
-
-@@ -2627,21 +2627,21 @@ static int pcnet32_close(struct net_device *dev)
-
- spin_lock_irqsave(&lp->lock, flags);
-
-- dev->stats.rx_missed_errors = lp->a.read_csr(ioaddr, 112);
-+ dev->stats.rx_missed_errors = lp->a->read_csr(ioaddr, 112);
-
- if (netif_msg_ifdown(lp))
- printk(KERN_DEBUG
- "%s: Shutting down ethercard, status was %2.2x.\n",
-- dev->name, lp->a.read_csr(ioaddr, CSR0));
-+ dev->name, lp->a->read_csr(ioaddr, CSR0));
-
- /* We stop the PCNET32 here -- it occasionally polls memory if we don't. */
-- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
-
- /*
- * Switch back to 16bit mode to avoid problems with dumb
- * DOS packet driver after a warm reboot
- */
-- lp->a.write_bcr(ioaddr, 20, 4);
-+ lp->a->write_bcr(ioaddr, 20, 4);
-
- spin_unlock_irqrestore(&lp->lock, flags);
-
-@@ -2664,7 +2664,7 @@ static struct net_device_stats *pcnet32_get_stats(struct net_device *dev)
- unsigned long flags;
-
- spin_lock_irqsave(&lp->lock, flags);
-- dev->stats.rx_missed_errors = lp->a.read_csr(ioaddr, 112);
-+ dev->stats.rx_missed_errors = lp->a->read_csr(ioaddr, 112);
- spin_unlock_irqrestore(&lp->lock, flags);
-
- return &dev->stats;
-@@ -2686,10 +2686,10 @@ static void pcnet32_load_multicast(struct net_device *dev)
- if (dev->flags & IFF_ALLMULTI) {
- ib->filter[0] = cpu_to_le32(~0U);
- ib->filter[1] = cpu_to_le32(~0U);
-- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER, 0xffff);
-- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+1, 0xffff);
-- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+2, 0xffff);
-- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+3, 0xffff);
-+ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER, 0xffff);
-+ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+1, 0xffff);
-+ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+2, 0xffff);
-+ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+3, 0xffff);
- return;
- }
- /* clear the multicast filter */
-@@ -2710,7 +2710,7 @@ static void pcnet32_load_multicast(struct net_device *dev)
- mcast_table[crc >> 4] |= cpu_to_le16(1 << (crc & 0xf));
- }
- for (i = 0; i < 4; i++)
-- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER + i,
-+ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER + i,
- le16_to_cpu(mcast_table[i]));
- return;
- }
-@@ -2726,7 +2726,7 @@ static void pcnet32_set_multicast_list(struct net_device *dev)
-
- spin_lock_irqsave(&lp->lock, flags);
- suspended = pcnet32_suspend(dev, &flags, 0);
-- csr15 = lp->a.read_csr(ioaddr, CSR15);
-+ csr15 = lp->a->read_csr(ioaddr, CSR15);
- if (dev->flags & IFF_PROMISC) {
- /* Log any net taps. */
- if (netif_msg_hw(lp))
-@@ -2735,21 +2735,21 @@ static void pcnet32_set_multicast_list(struct net_device *dev)
- lp->init_block->mode =
- cpu_to_le16(0x8000 | (lp->options & PCNET32_PORT_PORTSEL) <<
- 7);
-- lp->a.write_csr(ioaddr, CSR15, csr15 | 0x8000);
-+ lp->a->write_csr(ioaddr, CSR15, csr15 | 0x8000);
- } else {
- lp->init_block->mode =
- cpu_to_le16((lp->options & PCNET32_PORT_PORTSEL) << 7);
-- lp->a.write_csr(ioaddr, CSR15, csr15 & 0x7fff);
-+ lp->a->write_csr(ioaddr, CSR15, csr15 & 0x7fff);
- pcnet32_load_multicast(dev);
- }
-
- if (suspended) {
- int csr5;
- /* clear SUSPEND (SPND) - CSR5 bit 0 */
-- csr5 = lp->a.read_csr(ioaddr, CSR5);
-- lp->a.write_csr(ioaddr, CSR5, csr5 & (~CSR5_SUSPEND));
-+ csr5 = lp->a->read_csr(ioaddr, CSR5);
-+ lp->a->write_csr(ioaddr, CSR5, csr5 & (~CSR5_SUSPEND));
- } else {
-- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
- pcnet32_restart(dev, CSR0_NORMAL);
- netif_wake_queue(dev);
- }
-@@ -2767,8 +2767,8 @@ static int mdio_read(struct net_device *dev, int phy_id, int reg_num)
- if (!lp->mii)
- return 0;
-
-- lp->a.write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
-- val_out = lp->a.read_bcr(ioaddr, 34);
-+ lp->a->write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
-+ val_out = lp->a->read_bcr(ioaddr, 34);
-
- return val_out;
- }
-@@ -2782,8 +2782,8 @@ static void mdio_write(struct net_device *dev, int phy_id, int reg_num, int val)
- if (!lp->mii)
- return;
-
-- lp->a.write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
-- lp->a.write_bcr(ioaddr, 34, val);
-+ lp->a->write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
-+ lp->a->write_bcr(ioaddr, 34, val);
- }
-
- static int pcnet32_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
-@@ -2862,7 +2862,7 @@ static void pcnet32_check_media(struct net_device *dev, int verbose)
- curr_link = mii_link_ok(&lp->mii_if);
- } else {
- ulong ioaddr = dev->base_addr; /* card base I/O address */
-- curr_link = (lp->a.read_bcr(ioaddr, 4) != 0xc0);
-+ curr_link = (lp->a->read_bcr(ioaddr, 4) != 0xc0);
- }
- if (!curr_link) {
- if (prev_link || verbose) {
-@@ -2887,13 +2887,13 @@ static void pcnet32_check_media(struct net_device *dev, int verbose)
- (ecmd.duplex ==
- DUPLEX_FULL) ? "full" : "half");
- }
-- bcr9 = lp->a.read_bcr(dev->base_addr, 9);
-+ bcr9 = lp->a->read_bcr(dev->base_addr, 9);
- if ((bcr9 & (1 << 0)) != lp->mii_if.full_duplex) {
- if (lp->mii_if.full_duplex)
- bcr9 |= (1 << 0);
- else
- bcr9 &= ~(1 << 0);
-- lp->a.write_bcr(dev->base_addr, 9, bcr9);
-+ lp->a->write_bcr(dev->base_addr, 9, bcr9);
- }
- } else {
- if (netif_msg_link(lp))
-diff --git a/drivers/net/phy/mdio-bitbang.c b/drivers/net/phy/mdio-bitbang.c
-index 2576055..4b8b7d3 100644
---- a/drivers/net/phy/mdio-bitbang.c
-+++ b/drivers/net/phy/mdio-bitbang.c
-@@ -184,6 +184,7 @@ void free_mdio_bitbang(struct mii_bus *bus)
- struct mdiobb_ctrl *ctrl = bus->priv;
-
- module_put(ctrl->ops->owner);
-+ mdiobus_unregister(bus);
- mdiobus_free(bus);
- }
- EXPORT_SYMBOL(free_mdio_bitbang);
-diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c
-index 9235901..d31e726 100644
---- a/drivers/net/pppol2tp.c
-+++ b/drivers/net/pppol2tp.c
-@@ -1174,7 +1174,7 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
-
- /* Get routing info from the tunnel socket */
- skb_dst_drop(skb);
-- skb_dst_set(skb, dst_clone(__sk_dst_get(sk_tun)));
-+ skb_dst_set(skb, dst_clone(__sk_dst_check(sk_tun, 0)));
- pppol2tp_skb_set_owner_w(skb, sk_tun);
-
- /* Calculate UDP checksum if configured to do so */
-diff --git a/drivers/net/sis190.c b/drivers/net/sis190.c
-index 7cc9898..6eb50d3 100644
---- a/drivers/net/sis190.c
-+++ b/drivers/net/sis190.c
-@@ -1598,7 +1598,7 @@ static int __devinit sis190_get_mac_addr_from_eeprom(struct pci_dev *pdev,
- static int __devinit sis190_get_mac_addr_from_apc(struct pci_dev *pdev,
- struct net_device *dev)
- {
-- static const u16 __devinitdata ids[] = { 0x0965, 0x0966, 0x0968 };
-+ static const u16 __devinitconst ids[] = { 0x0965, 0x0966, 0x0968 };
- struct sis190_private *tp = netdev_priv(dev);
- struct pci_dev *isa_bridge;
- u8 reg, tmp8;
-diff --git a/drivers/net/sundance.c b/drivers/net/sundance.c
-index e13685a..60c948c 100644
---- a/drivers/net/sundance.c
-+++ b/drivers/net/sundance.c
-@@ -225,7 +225,7 @@ enum {
- struct pci_id_info {
- const char *name;
- };
--static const struct pci_id_info pci_id_tbl[] __devinitdata = {
-+static const struct pci_id_info pci_id_tbl[] __devinitconst = {
- {"D-Link DFE-550TX FAST Ethernet Adapter"},
- {"D-Link DFE-550FX 100Mbps Fiber-optics Adapter"},
- {"D-Link DFE-580TX 4 port Server Adapter"},
-diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
-index 529f55a..cccaa18 100644
---- a/drivers/net/tg3.h
-+++ b/drivers/net/tg3.h
-@@ -95,6 +95,7 @@
- #define CHIPREV_ID_5750_A0 0x4000
- #define CHIPREV_ID_5750_A1 0x4001
- #define CHIPREV_ID_5750_A3 0x4003
-+#define CHIPREV_ID_5750_C1 0x4201
- #define CHIPREV_ID_5750_C2 0x4202
- #define CHIPREV_ID_5752_A0_HW 0x5000
- #define CHIPREV_ID_5752_A0 0x6000
-diff --git a/drivers/net/tokenring/abyss.c b/drivers/net/tokenring/abyss.c
-index b9db1b5..720f9ce 100644
---- a/drivers/net/tokenring/abyss.c
-+++ b/drivers/net/tokenring/abyss.c
-@@ -451,10 +451,12 @@ static struct pci_driver abyss_driver = {
-
- static int __init abyss_init (void)
- {
-- abyss_netdev_ops = tms380tr_netdev_ops;
-+ pax_open_kernel();
-+ memcpy((void *)&abyss_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
-
-- abyss_netdev_ops.ndo_open = abyss_open;
-- abyss_netdev_ops.ndo_stop = abyss_close;
-+ *(void **)&abyss_netdev_ops.ndo_open = abyss_open;
-+ *(void **)&abyss_netdev_ops.ndo_stop = abyss_close;
-+ pax_close_kernel();
-
- return pci_register_driver(&abyss_driver);
- }
-diff --git a/drivers/net/tokenring/madgemc.c b/drivers/net/tokenring/madgemc.c
-index 456f8bf..373e56d 100644
---- a/drivers/net/tokenring/madgemc.c
-+++ b/drivers/net/tokenring/madgemc.c
-@@ -755,9 +755,11 @@ static struct mca_driver madgemc_driver = {
-
- static int __init madgemc_init (void)
- {
-- madgemc_netdev_ops = tms380tr_netdev_ops;
-- madgemc_netdev_ops.ndo_open = madgemc_open;
-- madgemc_netdev_ops.ndo_stop = madgemc_close;
-+ pax_open_kernel();
-+ memcpy((void *)&madgemc_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
-+ *(void **)&madgemc_netdev_ops.ndo_open = madgemc_open;
-+ *(void **)&madgemc_netdev_ops.ndo_stop = madgemc_close;
-+ pax_close_kernel();
-
- return mca_register_driver (&madgemc_driver);
- }
-diff --git a/drivers/net/tokenring/proteon.c b/drivers/net/tokenring/proteon.c
-index 16e8783..925bd49 100644
---- a/drivers/net/tokenring/proteon.c
-+++ b/drivers/net/tokenring/proteon.c
-@@ -353,9 +353,11 @@ static int __init proteon_init(void)
- struct platform_device *pdev;
- int i, num = 0, err = 0;
-
-- proteon_netdev_ops = tms380tr_netdev_ops;
-- proteon_netdev_ops.ndo_open = proteon_open;
-- proteon_netdev_ops.ndo_stop = tms380tr_close;
-+ pax_open_kernel();
-+ memcpy((void *)&proteon_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
-+ *(void **)&proteon_netdev_ops.ndo_open = proteon_open;
-+ *(void **)&proteon_netdev_ops.ndo_stop = tms380tr_close;
-+ pax_close_kernel();
-
- err = platform_driver_register(&proteon_driver);
- if (err)
-diff --git a/drivers/net/tokenring/skisa.c b/drivers/net/tokenring/skisa.c
-index 46db5c5..37c1536 100644
---- a/drivers/net/tokenring/skisa.c
-+++ b/drivers/net/tokenring/skisa.c
-@@ -363,9 +363,11 @@ static int __init sk_isa_init(void)
- struct platform_device *pdev;
- int i, num = 0, err = 0;
-
-- sk_isa_netdev_ops = tms380tr_netdev_ops;
-- sk_isa_netdev_ops.ndo_open = sk_isa_open;
-- sk_isa_netdev_ops.ndo_stop = tms380tr_close;
-+ pax_open_kernel();
-+ memcpy((void *)&sk_isa_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
-+ *(void **)&sk_isa_netdev_ops.ndo_open = sk_isa_open;
-+ *(void **)&sk_isa_netdev_ops.ndo_stop = tms380tr_close;
-+ pax_close_kernel();
-
- err = platform_driver_register(&sk_isa_driver);
- if (err)
-diff --git a/drivers/net/tokenring/tms380tr.c b/drivers/net/tokenring/tms380tr.c
-index fa15214..ebecd45 100644
---- a/drivers/net/tokenring/tms380tr.c
-+++ b/drivers/net/tokenring/tms380tr.c
-@@ -1248,7 +1248,7 @@ void tms380tr_wait(unsigned long time)
- tmp = schedule_timeout_interruptible(tmp);
- } while(time_after(tmp, jiffies));
- #else
-- udelay(time);
-+ mdelay(time / 1000);
- #endif
- return;
- }
-diff --git a/drivers/net/tulip/de2104x.c b/drivers/net/tulip/de2104x.c
-index 74e5ba4..5cf6bc9 100644
---- a/drivers/net/tulip/de2104x.c
-+++ b/drivers/net/tulip/de2104x.c
-@@ -1785,6 +1785,8 @@ static void __devinit de21041_get_srom_info (struct de_private *de)
- struct de_srom_info_leaf *il;
- void *bufp;
-
-+ pax_track_stack();
-+
- /* download entire eeprom */
- for (i = 0; i < DE_EEPROM_WORDS; i++)
- ((__le16 *)ee_data)[i] =
-diff --git a/drivers/net/tulip/de4x5.c b/drivers/net/tulip/de4x5.c
-index a8349b7..90f9dfe 100644
---- a/drivers/net/tulip/de4x5.c
-+++ b/drivers/net/tulip/de4x5.c
-@@ -5472,7 +5472,7 @@ de4x5_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
- for (i=0; i<ETH_ALEN; i++) {
- tmp.addr[i] = dev->dev_addr[i];
- }
-- if (copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
-+ if (ioc->len > sizeof tmp.addr || copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
- break;
-
- case DE4X5_SET_HWADDR: /* Set the hardware address */
-@@ -5512,7 +5512,7 @@ de4x5_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
- spin_lock_irqsave(&lp->lock, flags);
- memcpy(&statbuf, &lp->pktStats, ioc->len);
- spin_unlock_irqrestore(&lp->lock, flags);
-- if (copy_to_user(ioc->data, &statbuf, ioc->len))
-+ if (ioc->len > sizeof statbuf || copy_to_user(ioc->data, &statbuf, ioc->len))
- return -EFAULT;
- break;
- }
-diff --git a/drivers/net/tulip/eeprom.c b/drivers/net/tulip/eeprom.c
-index 391acd3..56d11cd 100644
---- a/drivers/net/tulip/eeprom.c
-+++ b/drivers/net/tulip/eeprom.c
-@@ -80,7 +80,7 @@ static struct eeprom_fixup eeprom_fixups[] __devinitdata = {
- {NULL}};
-
-
--static const char *block_name[] __devinitdata = {
-+static const char *block_name[] __devinitconst = {
- "21140 non-MII",
- "21140 MII PHY",
- "21142 Serial PHY",
-diff --git a/drivers/net/tulip/winbond-840.c b/drivers/net/tulip/winbond-840.c
-index b38d3b7..b1cff23 100644
---- a/drivers/net/tulip/winbond-840.c
-+++ b/drivers/net/tulip/winbond-840.c
-@@ -235,7 +235,7 @@ struct pci_id_info {
- int drv_flags; /* Driver use, intended as capability flags. */
- };
-
--static const struct pci_id_info pci_id_tbl[] __devinitdata = {
-+static const struct pci_id_info pci_id_tbl[] __devinitconst = {
- { /* Sometime a Level-One switch card. */
- "Winbond W89c840", CanHaveMII | HasBrokenTx | FDXOnNoMII},
- { "Winbond W89c840", CanHaveMII | HasBrokenTx},
-diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
-index f450bc9..2b747c8 100644
---- a/drivers/net/usb/hso.c
-+++ b/drivers/net/usb/hso.c
-@@ -71,7 +71,7 @@
- #include <asm/byteorder.h>
- #include <linux/serial_core.h>
- #include <linux/serial.h>
--
-+#include <asm/local.h>
-
- #define DRIVER_VERSION "1.2"
- #define MOD_AUTHOR "Option Wireless"
-@@ -258,7 +258,7 @@ struct hso_serial {
-
- /* from usb_serial_port */
- struct tty_struct *tty;
-- int open_count;
-+ local_t open_count;
- spinlock_t serial_lock;
-
- int (*write_data) (struct hso_serial *serial);
-@@ -1180,7 +1180,7 @@ static void put_rxbuf_data_and_resubmit_ctrl_urb(struct hso_serial *serial)
- struct urb *urb;
-
- urb = serial->rx_urb[0];
-- if (serial->open_count > 0) {
-+ if (local_read(&serial->open_count) > 0) {
- count = put_rxbuf_data(urb, serial);
- if (count == -1)
- return;
-@@ -1216,7 +1216,7 @@ static void hso_std_serial_read_bulk_callback(struct urb *urb)
- DUMP1(urb->transfer_buffer, urb->actual_length);
-
- /* Anyone listening? */
-- if (serial->open_count == 0)
-+ if (local_read(&serial->open_count) == 0)
- return;
-
- if (status == 0) {
-@@ -1311,8 +1311,7 @@ static int hso_serial_open(struct tty_struct *tty, struct file *filp)
- spin_unlock_irq(&serial->serial_lock);
-
- /* check for port already opened, if not set the termios */
-- serial->open_count++;
-- if (serial->open_count == 1) {
-+ if (local_inc_return(&serial->open_count) == 1) {
- tty->low_latency = 1;
- serial->rx_state = RX_IDLE;
- /* Force default termio settings */
-@@ -1325,7 +1324,7 @@ static int hso_serial_open(struct tty_struct *tty, struct file *filp)
- result = hso_start_serial_device(serial->parent, GFP_KERNEL);
- if (result) {
- hso_stop_serial_device(serial->parent);
-- serial->open_count--;
-+ local_dec(&serial->open_count);
- kref_put(&serial->parent->ref, hso_serial_ref_free);
- }
- } else {
-@@ -1362,10 +1361,10 @@ static void hso_serial_close(struct tty_struct *tty, struct file *filp)
-
- /* reset the rts and dtr */
- /* do the actual close */
-- serial->open_count--;
-+ local_dec(&serial->open_count);
-
-- if (serial->open_count <= 0) {
-- serial->open_count = 0;
-+ if (local_read(&serial->open_count) <= 0) {
-+ local_set(&serial->open_count, 0);
- spin_lock_irq(&serial->serial_lock);
- if (serial->tty == tty) {
- serial->tty->driver_data = NULL;
-@@ -1447,7 +1446,7 @@ static void hso_serial_set_termios(struct tty_struct *tty, struct ktermios *old)
-
- /* the actual setup */
- spin_lock_irqsave(&serial->serial_lock, flags);
-- if (serial->open_count)
-+ if (local_read(&serial->open_count))
- _hso_serial_set_termios(tty, old);
- else
- tty->termios = old;
-@@ -3097,7 +3096,7 @@ static int hso_resume(struct usb_interface *iface)
- /* Start all serial ports */
- for (i = 0; i < HSO_SERIAL_TTY_MINORS; i++) {
- if (serial_table[i] && (serial_table[i]->interface == iface)) {
-- if (dev2ser(serial_table[i])->open_count) {
-+ if (local_read(&dev2ser(serial_table[i])->open_count)) {
- result =
- hso_start_serial_device(serial_table[i], GFP_NOIO);
- hso_kick_transmit(dev2ser(serial_table[i]));
-diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
-index 07f69ee..57fc4c7 100644
---- a/drivers/net/usb/usbnet.c
-+++ b/drivers/net/usb/usbnet.c
-@@ -331,6 +331,12 @@ static void rx_submit (struct usbnet *dev, struct urb *urb, gfp_t flags)
- unsigned long lockflags;
- size_t size = dev->rx_urb_size;
-
-+ /* prevent rx skb allocation when error ratio is high */
-+ if (test_bit(EVENT_RX_KILL, &dev->flags)) {
-+ usb_free_urb(urb);
-+ return;
-+ }
-+
- if ((skb = alloc_skb (size + NET_IP_ALIGN, flags)) == NULL) {
- if (netif_msg_rx_err (dev))
- devdbg (dev, "no rx skb");
-@@ -481,6 +487,17 @@ block:
- break;
- }
-
-+ /* stop rx if packet error rate is high */
-+ if (++dev->pkt_cnt > 30) {
-+ dev->pkt_cnt = 0;
-+ dev->pkt_err = 0;
-+ } else {
-+ if (entry->state == rx_cleanup)
-+ dev->pkt_err++;
-+ if (dev->pkt_err > 20)
-+ set_bit(EVENT_RX_KILL, &dev->flags);
-+ }
-+
- defer_bh(dev, skb, &dev->rxq);
-
- if (urb) {
-@@ -762,6 +779,11 @@ int usbnet_open (struct net_device *net)
- framing);
- }
-
-+ /* reset rx error state */
-+ dev->pkt_cnt = 0;
-+ dev->pkt_err = 0;
-+ clear_bit(EVENT_RX_KILL, &dev->flags);
-+
- // delay posting reads until we're fully open
- tasklet_schedule (&dev->bh);
- return retval;
-@@ -1129,6 +1151,9 @@ static void usbnet_bh (unsigned long param)
- }
- }
-
-+ /* restart RX again after disabling due to high error rate */
-+ clear_bit(EVENT_RX_KILL, &dev->flags);
-+
- // waiting for all pending urbs to complete?
- if (dev->wait) {
- if ((dev->txq.qlen + dev->rxq.qlen + dev->done.qlen) == 0) {
-diff --git a/drivers/net/vxge/vxge-config.c b/drivers/net/vxge/vxge-config.c
-index 9e94c4b..316ee65 100644
---- a/drivers/net/vxge/vxge-config.c
-+++ b/drivers/net/vxge/vxge-config.c
-@@ -1467,7 +1467,9 @@ __vxge_hw_ring_create(struct __vxge_hw_vpath_handle *vp,
- struct vxge_hw_ring_config *config;
- struct __vxge_hw_device *hldev;
- u32 vp_id;
-- struct vxge_hw_mempool_cbs ring_mp_callback;
-+ static struct vxge_hw_mempool_cbs ring_mp_callback = {
-+ .item_func_alloc = __vxge_hw_ring_mempool_item_alloc,
-+ };
-
- if ((vp == NULL) || (attr == NULL)) {
- status = VXGE_HW_FAIL;
-@@ -1521,7 +1523,6 @@ __vxge_hw_ring_create(struct __vxge_hw_vpath_handle *vp,
-
- /* calculate actual RxD block private size */
- ring->rxdblock_priv_size = ring->rxd_priv_size * ring->rxds_per_block;
-- ring_mp_callback.item_func_alloc = __vxge_hw_ring_mempool_item_alloc;
- ring->mempool = __vxge_hw_mempool_create(hldev,
- VXGE_HW_BLOCK_SIZE,
- VXGE_HW_BLOCK_SIZE,
-@@ -2509,7 +2510,10 @@ __vxge_hw_fifo_create(struct __vxge_hw_vpath_handle *vp,
- struct __vxge_hw_fifo *fifo;
- struct vxge_hw_fifo_config *config;
- u32 txdl_size, txdl_per_memblock;
-- struct vxge_hw_mempool_cbs fifo_mp_callback;
-+ static struct vxge_hw_mempool_cbs fifo_mp_callback = {
-+ .item_func_alloc = __vxge_hw_fifo_mempool_item_alloc,
-+ };
-+
- struct __vxge_hw_virtualpath *vpath;
-
- if ((vp == NULL) || (attr == NULL)) {
-@@ -2590,8 +2594,6 @@ __vxge_hw_fifo_create(struct __vxge_hw_vpath_handle *vp,
- goto exit;
- }
-
-- fifo_mp_callback.item_func_alloc = __vxge_hw_fifo_mempool_item_alloc;
--
- fifo->mempool =
- __vxge_hw_mempool_create(vpath->hldev,
- fifo->config->memblock_size,
-diff --git a/drivers/net/vxge/vxge-main.c b/drivers/net/vxge/vxge-main.c
-index 068d7a9..35293de 100644
---- a/drivers/net/vxge/vxge-main.c
-+++ b/drivers/net/vxge/vxge-main.c
-@@ -93,6 +93,8 @@ static inline void VXGE_COMPLETE_VPATH_TX(struct vxge_fifo *fifo)
- struct sk_buff *completed[NR_SKB_COMPLETED];
- int more;
-
-+ pax_track_stack();
-+
- do {
- more = 0;
- skb_ptr = completed;
-@@ -1779,6 +1781,8 @@ static enum vxge_hw_status vxge_rth_configure(struct vxgedev *vdev)
- u8 mtable[256] = {0}; /* CPU to vpath mapping */
- int index;
-
-+ pax_track_stack();
-+
- /*
- * Filling
- * - itable with bucket numbers
-diff --git a/drivers/net/wan/cycx_x25.c b/drivers/net/wan/cycx_x25.c
-index cd8cb95..4153b79 100644
---- a/drivers/net/wan/cycx_x25.c
-+++ b/drivers/net/wan/cycx_x25.c
-@@ -1017,6 +1017,8 @@ static void hex_dump(char *msg, unsigned char *p, int len)
- unsigned char hex[1024],
- * phex = hex;
-
-+ pax_track_stack();
-+
- if (len >= (sizeof(hex) / 2))
- len = (sizeof(hex) / 2) - 1;
-
-diff --git a/drivers/net/wan/dlci.c b/drivers/net/wan/dlci.c
-index 15d353f..a7184e0 100644
---- a/drivers/net/wan/dlci.c
-+++ b/drivers/net/wan/dlci.c
-@@ -382,20 +382,24 @@ static int dlci_del(struct dlci_add *dlci)
- struct net_device *master, *slave;
- int err;
-
-+ rtnl_lock();
-+
- /* validate slave device */
- master = __dev_get_by_name(&init_net, dlci->devname);
-- if (!master)
-- return(-ENODEV);
-+ if (!master) {
-+ err = -ENODEV;
-+ goto out;
-+ }
-
- if (netif_running(master)) {
-- return(-EBUSY);
-+ err = -EBUSY;
-+ goto out;
- }
-
- dlp = netdev_priv(master);
- slave = dlp->slave;
- flp = netdev_priv(slave);
-
-- rtnl_lock();
- err = (*flp->deassoc)(slave, master);
- if (!err) {
- list_del(&dlp->list);
-@@ -404,9 +408,9 @@ static int dlci_del(struct dlci_add *dlci)
-
- dev_put(slave);
- }
-+out:
- rtnl_unlock();
--
-- return(err);
-+ return err;
- }
-
- static int dlci_ioctl(unsigned int cmd, void __user *arg)
-diff --git a/drivers/net/wan/hdlc_x25.c b/drivers/net/wan/hdlc_x25.c
-index aa9248f..a4e3c3b 100644
---- a/drivers/net/wan/hdlc_x25.c
-+++ b/drivers/net/wan/hdlc_x25.c
-@@ -136,16 +136,16 @@ static netdev_tx_t x25_xmit(struct sk_buff *skb, struct net_device *dev)
-
- static int x25_open(struct net_device *dev)
- {
-- struct lapb_register_struct cb;
-+ static struct lapb_register_struct cb = {
-+ .connect_confirmation = x25_connected,
-+ .connect_indication = x25_connected,
-+ .disconnect_confirmation = x25_disconnected,
-+ .disconnect_indication = x25_disconnected,
-+ .data_indication = x25_data_indication,
-+ .data_transmit = x25_data_transmit
-+ };
- int result;
-
-- cb.connect_confirmation = x25_connected;
-- cb.connect_indication = x25_connected;
-- cb.disconnect_confirmation = x25_disconnected;
-- cb.disconnect_indication = x25_disconnected;
-- cb.data_indication = x25_data_indication;
-- cb.data_transmit = x25_data_transmit;
--
- result = lapb_register(dev, &cb);
- if (result != LAPB_OK)
- return result;
-diff --git a/drivers/net/wimax/i2400m/usb-fw.c b/drivers/net/wimax/i2400m/usb-fw.c
-index 5ad287c..783b020 100644
---- a/drivers/net/wimax/i2400m/usb-fw.c
-+++ b/drivers/net/wimax/i2400m/usb-fw.c
-@@ -263,6 +263,8 @@ ssize_t i2400mu_bus_bm_wait_for_ack(struct i2400m *i2400m,
- int do_autopm = 1;
- DECLARE_COMPLETION_ONSTACK(notif_completion);
-
-+ pax_track_stack();
-+
- d_fnstart(8, dev, "(i2400m %p ack %p size %zu)\n",
- i2400m, ack, ack_size);
- BUG_ON(_ack == i2400m->bm_ack_buf);
-diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
-index 6c26840..62c97c3 100644
---- a/drivers/net/wireless/airo.c
-+++ b/drivers/net/wireless/airo.c
-@@ -3003,6 +3003,8 @@ static void airo_process_scan_results (struct airo_info *ai) {
- BSSListElement * loop_net;
- BSSListElement * tmp_net;
-
-+ pax_track_stack();
-+
- /* Blow away current list of scan results */
- list_for_each_entry_safe (loop_net, tmp_net, &ai->network_list, list) {
- list_move_tail (&loop_net->list, &ai->network_free_list);
-@@ -3783,6 +3785,8 @@ static u16 setup_card(struct airo_info *ai, u8 *mac, int lock)
- WepKeyRid wkr;
- int rc;
-
-+ pax_track_stack();
-+
- memset( &mySsid, 0, sizeof( mySsid ) );
- kfree (ai->flash);
- ai->flash = NULL;
-@@ -4758,6 +4762,8 @@ static int proc_stats_rid_open( struct inode *inode,
- __le32 *vals = stats.vals;
- int len;
-
-+ pax_track_stack();
-+
- if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
- return -ENOMEM;
- data = (struct proc_data *)file->private_data;
-@@ -5487,6 +5493,8 @@ static int proc_BSSList_open( struct inode *inode, struct file *file ) {
- /* If doLoseSync is not 1, we won't do a Lose Sync */
- int doLoseSync = -1;
-
-+ pax_track_stack();
-+
- if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
- return -ENOMEM;
- data = (struct proc_data *)file->private_data;
-@@ -7193,6 +7201,8 @@ static int airo_get_aplist(struct net_device *dev,
- int i;
- int loseSync = capable(CAP_NET_ADMIN) ? 1: -1;
-
-+ pax_track_stack();
-+
- qual = kmalloc(IW_MAX_AP * sizeof(*qual), GFP_KERNEL);
- if (!qual)
- return -ENOMEM;
-@@ -7753,6 +7763,8 @@ static void airo_read_wireless_stats(struct airo_info *local)
- CapabilityRid cap_rid;
- __le32 *vals = stats_rid.vals;
-
-+ pax_track_stack();
-+
- /* Get stats out of the card */
- clear_bit(JOB_WSTATS, &local->jobs);
- if (local->power.event) {
-diff --git a/drivers/net/wireless/ath/ath5k/debug.c b/drivers/net/wireless/ath/ath5k/debug.c
-index 747508c..82e965d 100644
---- a/drivers/net/wireless/ath/ath5k/debug.c
-+++ b/drivers/net/wireless/ath/ath5k/debug.c
-@@ -205,6 +205,8 @@ static ssize_t read_file_beacon(struct file *file, char __user *user_buf,
- unsigned int v;
- u64 tsf;
-
-+ pax_track_stack();
-+
- v = ath5k_hw_reg_read(sc->ah, AR5K_BEACON);
- len += snprintf(buf+len, sizeof(buf)-len,
- "%-24s0x%08x\tintval: %d\tTIM: 0x%x\n",
-@@ -318,6 +320,8 @@ static ssize_t read_file_debug(struct file *file, char __user *user_buf,
- unsigned int len = 0;
- unsigned int i;
-
-+ pax_track_stack();
-+
- len += snprintf(buf+len, sizeof(buf)-len,
- "DEBUG LEVEL: 0x%08x\n\n", sc->debug.level);
-
-diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
-index 2be4c22..593b1eb 100644
---- a/drivers/net/wireless/ath/ath9k/debug.c
-+++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -220,6 +220,8 @@ static ssize_t read_file_interrupt(struct file *file, char __user *user_buf,
- char buf[512];
- unsigned int len = 0;
-
-+ pax_track_stack();
-+
- len += snprintf(buf + len, sizeof(buf) - len,
- "%8s: %10u\n", "RX", sc->debug.stats.istats.rxok);
- len += snprintf(buf + len, sizeof(buf) - len,
-@@ -360,6 +362,8 @@ static ssize_t read_file_wiphy(struct file *file, char __user *user_buf,
- int i;
- u8 addr[ETH_ALEN];
-
-+ pax_track_stack();
-+
- len += snprintf(buf + len, sizeof(buf) - len,
- "primary: %s (%s chan=%d ht=%d)\n",
- wiphy_name(sc->pri_wiphy->hw->wiphy),
-diff --git a/drivers/net/wireless/b43/debugfs.c b/drivers/net/wireless/b43/debugfs.c
-index 80b19a4..dab3a45 100644
---- a/drivers/net/wireless/b43/debugfs.c
-+++ b/drivers/net/wireless/b43/debugfs.c
-@@ -43,7 +43,7 @@ static struct dentry *rootdir;
- struct b43_debugfs_fops {
- ssize_t (*read)(struct b43_wldev *dev, char *buf, size_t bufsize);
- int (*write)(struct b43_wldev *dev, const char *buf, size_t count);
-- struct file_operations fops;
-+ const struct file_operations fops;
- /* Offset of struct b43_dfs_file in struct b43_dfsentry */
- size_t file_struct_offset;
- };
-diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
-index 94dae56..3cf2472 100644
---- a/drivers/net/wireless/b43/main.c
-+++ b/drivers/net/wireless/b43/main.c
-@@ -2257,7 +2257,7 @@ static int b43_request_firmware(struct b43_wldev *dev)
- for (i = 0; i < B43_NR_FWTYPES; i++) {
- errmsg = ctx->errors[i];
- if (strlen(errmsg))
-- b43err(dev->wl, errmsg);
-+ b43err(dev->wl, "%s", errmsg);
- }
- b43_print_fw_helptext(dev->wl, 1);
- err = -ENOENT;
-diff --git a/drivers/net/wireless/b43legacy/debugfs.c b/drivers/net/wireless/b43legacy/debugfs.c
-index 1f85ac5..c99b4b4 100644
---- a/drivers/net/wireless/b43legacy/debugfs.c
-+++ b/drivers/net/wireless/b43legacy/debugfs.c
-@@ -44,7 +44,7 @@ static struct dentry *rootdir;
- struct b43legacy_debugfs_fops {
- ssize_t (*read)(struct b43legacy_wldev *dev, char *buf, size_t bufsize);
- int (*write)(struct b43legacy_wldev *dev, const char *buf, size_t count);
-- struct file_operations fops;
-+ const struct file_operations fops;
- /* Offset of struct b43legacy_dfs_file in struct b43legacy_dfsentry */
- size_t file_struct_offset;
- /* Take wl->irq_lock before calling read/write? */
-diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
-index 43102bf..3b569c3 100644
---- a/drivers/net/wireless/ipw2x00/ipw2100.c
-+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
-@@ -2014,6 +2014,8 @@ static int ipw2100_set_essid(struct ipw2100_priv *priv, char *essid,
- int err;
- DECLARE_SSID_BUF(ssid);
-
-+ pax_track_stack();
-+
- IPW_DEBUG_HC("SSID: '%s'\n", print_ssid(ssid, essid, ssid_len));
-
- if (ssid_len)
-@@ -5380,6 +5382,8 @@ static int ipw2100_set_key(struct ipw2100_priv *priv,
- struct ipw2100_wep_key *wep_key = (void *)cmd.host_command_parameters;
- int err;
-
-+ pax_track_stack();
-+
- IPW_DEBUG_HC("WEP_KEY_INFO: index = %d, len = %d/%d\n",
- idx, keylen, len);
-
-diff --git a/drivers/net/wireless/ipw2x00/libipw_rx.c b/drivers/net/wireless/ipw2x00/libipw_rx.c
-index 282b1f7..169f0cf 100644
---- a/drivers/net/wireless/ipw2x00/libipw_rx.c
-+++ b/drivers/net/wireless/ipw2x00/libipw_rx.c
-@@ -1566,6 +1566,8 @@ static void libipw_process_probe_response(struct libipw_device
- unsigned long flags;
- DECLARE_SSID_BUF(ssid);
-
-+ pax_track_stack();
-+
- LIBIPW_DEBUG_SCAN("'%s' (%pM"
- "): %c%c%c%c %c%c%c%c-%c%c%c%c %c%c%c%c\n",
- print_ssid(ssid, info_element->data, info_element->len),
-diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
-index 950267a..80d5fd2 100644
---- a/drivers/net/wireless/iwlwifi/iwl-1000.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
-@@ -137,7 +137,7 @@ static struct iwl_lib_ops iwl1000_lib = {
- },
- };
-
--static struct iwl_ops iwl1000_ops = {
-+static const struct iwl_ops iwl1000_ops = {
- .ucode = &iwl5000_ucode,
- .lib = &iwl1000_lib,
- .hcmd = &iwl5000_hcmd,
-diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
-index 56bfcc3..b348020 100644
---- a/drivers/net/wireless/iwlwifi/iwl-3945.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
-@@ -2874,7 +2874,7 @@ static struct iwl_hcmd_utils_ops iwl3945_hcmd_utils = {
- .build_addsta_hcmd = iwl3945_build_addsta_hcmd,
- };
-
--static struct iwl_ops iwl3945_ops = {
-+static const struct iwl_ops iwl3945_ops = {
- .ucode = &iwl3945_ucode,
- .lib = &iwl3945_lib,
- .hcmd = &iwl3945_hcmd,
-diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
-index 585b8d4..e142963 100644
---- a/drivers/net/wireless/iwlwifi/iwl-4965.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
-@@ -2345,7 +2345,7 @@ static struct iwl_lib_ops iwl4965_lib = {
- },
- };
-
--static struct iwl_ops iwl4965_ops = {
-+static const struct iwl_ops iwl4965_ops = {
- .ucode = &iwl4965_ucode,
- .lib = &iwl4965_lib,
- .hcmd = &iwl4965_hcmd,
-diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
-index 1f423f2..e37c192 100644
---- a/drivers/net/wireless/iwlwifi/iwl-5000.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
-@@ -1633,14 +1633,14 @@ static struct iwl_lib_ops iwl5150_lib = {
- },
- };
-
--struct iwl_ops iwl5000_ops = {
-+const struct iwl_ops iwl5000_ops = {
- .ucode = &iwl5000_ucode,
- .lib = &iwl5000_lib,
- .hcmd = &iwl5000_hcmd,
- .utils = &iwl5000_hcmd_utils,
- };
-
--static struct iwl_ops iwl5150_ops = {
-+static const struct iwl_ops iwl5150_ops = {
- .ucode = &iwl5000_ucode,
- .lib = &iwl5150_lib,
- .hcmd = &iwl5000_hcmd,
-diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
-index 1473452..f07d5e1 100644
---- a/drivers/net/wireless/iwlwifi/iwl-6000.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
-@@ -146,7 +146,7 @@ static struct iwl_hcmd_utils_ops iwl6000_hcmd_utils = {
- .calc_rssi = iwl5000_calc_rssi,
- };
-
--static struct iwl_ops iwl6000_ops = {
-+static const struct iwl_ops iwl6000_ops = {
- .ucode = &iwl5000_ucode,
- .lib = &iwl6000_lib,
- .hcmd = &iwl5000_hcmd,
-diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
-index 1a3dfa2..b3e0a61 100644
---- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
-@@ -857,6 +857,8 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
- u8 active_index = 0;
- s32 tpt = 0;
-
-+ pax_track_stack();
-+
- IWL_DEBUG_RATE_LIMIT(priv, "get frame ack response, update rate scale window\n");
-
- if (!ieee80211_is_data(hdr->frame_control) ||
-@@ -2722,6 +2724,8 @@ static void rs_fill_link_cmd(struct iwl_priv *priv,
- u8 valid_tx_ant = 0;
- struct iwl_link_quality_cmd *lq_cmd = &lq_sta->lq;
-
-+ pax_track_stack();
-+
- /* Override starting rate (index 0) if needed for debug purposes */
- rs_dbgfs_set_mcs(lq_sta, &new_rate, index);
-
-diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
-index 0e56d78..6a3c107 100644
---- a/drivers/net/wireless/iwlwifi/iwl-agn.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
-@@ -2911,7 +2911,9 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
- if (iwl_debug_level & IWL_DL_INFO)
- dev_printk(KERN_DEBUG, &(pdev->dev),
- "Disabling hw_scan\n");
-- iwl_hw_ops.hw_scan = NULL;
-+ pax_open_kernel();
-+ *(void **)&iwl_hw_ops.hw_scan = NULL;
-+ pax_close_kernel();
- }
-
- hw = iwl_alloc_all(cfg, &iwl_hw_ops);
-diff --git a/drivers/net/wireless/iwlwifi/iwl-debug.h b/drivers/net/wireless/iwlwifi/iwl-debug.h
-index cbc6290..eb323d7 100644
---- a/drivers/net/wireless/iwlwifi/iwl-debug.h
-+++ b/drivers/net/wireless/iwlwifi/iwl-debug.h
-@@ -118,8 +118,8 @@ void iwl_dbgfs_unregister(struct iwl_priv *priv);
- #endif
-
- #else
--#define IWL_DEBUG(__priv, level, fmt, args...)
--#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...)
-+#define IWL_DEBUG(__priv, level, fmt, args...) do {} while (0)
-+#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...) do {} while (0)
- static inline void iwl_print_hex_dump(struct iwl_priv *priv, int level,
- void *p, u32 len)
- {}
-diff --git a/drivers/net/wireless/iwlwifi/iwl-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
-index a198bcf..aaa4128 100644
---- a/drivers/net/wireless/iwlwifi/iwl-debugfs.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
-@@ -166,7 +166,7 @@ static ssize_t iwl_dbgfs_tx_statistics_write(struct file *file,
- struct iwl_priv *priv = file->private_data;
- u32 clear_flag;
- char buf[8];
-- int buf_size;
-+ size_t buf_size;
-
- memset(buf, 0, sizeof(buf));
- buf_size = min(count, sizeof(buf) - 1);
-@@ -285,7 +285,7 @@ static ssize_t iwl_dbgfs_sram_write(struct file *file,
- {
- struct iwl_priv *priv = file->private_data;
- char buf[64];
-- int buf_size;
-+ size_t buf_size;
- u32 offset, len;
-
- memset(buf, 0, sizeof(buf));
-@@ -524,6 +524,8 @@ static ssize_t iwl_dbgfs_status_read(struct file *file,
- int pos = 0;
- const size_t bufsz = sizeof(buf);
-
-+ pax_track_stack();
-+
- pos += scnprintf(buf + pos, bufsz - pos, "STATUS_HCMD_ACTIVE:\t %d\n",
- test_bit(STATUS_HCMD_ACTIVE, &priv->status));
- pos += scnprintf(buf + pos, bufsz - pos, "STATUS_HCMD_SYNC_ACTIVE: %d\n",
-@@ -658,6 +660,8 @@ static ssize_t iwl_dbgfs_qos_read(struct file *file, char __user *user_buf,
- const size_t bufsz = sizeof(buf);
- ssize_t ret;
-
-+ pax_track_stack();
-+
- for (i = 0; i < AC_NUM; i++) {
- pos += scnprintf(buf + pos, bufsz - pos,
- "\tcw_min\tcw_max\taifsn\ttxop\n");
-@@ -739,7 +743,7 @@ static ssize_t iwl_dbgfs_disable_ht40_write(struct file *file,
- {
- struct iwl_priv *priv = file->private_data;
- char buf[8];
-- int buf_size;
-+ size_t buf_size;
- int ht40;
-
- memset(buf, 0, sizeof(buf));
-@@ -782,7 +786,7 @@ static ssize_t iwl_dbgfs_sleep_level_override_write(struct file *file,
- {
- struct iwl_priv *priv = file->private_data;
- char buf[8];
-- int buf_size;
-+ size_t buf_size;
- int value;
-
- memset(buf, 0, sizeof(buf));
-@@ -950,7 +954,7 @@ static ssize_t iwl_dbgfs_traffic_log_write(struct file *file,
- {
- struct iwl_priv *priv = file->private_data;
- char buf[8];
-- int buf_size;
-+ size_t buf_size;
- int traffic_log;
-
- memset(buf, 0, sizeof(buf));
-diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
-index 3539ea4..b174bfa 100644
---- a/drivers/net/wireless/iwlwifi/iwl-dev.h
-+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
-@@ -68,7 +68,7 @@ struct iwl_tx_queue;
-
- /* shared structures from iwl-5000.c */
- extern struct iwl_mod_params iwl50_mod_params;
--extern struct iwl_ops iwl5000_ops;
-+extern const struct iwl_ops iwl5000_ops;
- extern struct iwl_ucode_ops iwl5000_ucode;
- extern struct iwl_lib_ops iwl5000_lib;
- extern struct iwl_hcmd_ops iwl5000_hcmd;
-diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
-index 619590d..69235ee 100644
---- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
-+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
-@@ -3927,7 +3927,9 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
- */
- if (iwl3945_mod_params.disable_hw_scan) {
- IWL_DEBUG_INFO(priv, "Disabling hw_scan\n");
-- iwl3945_hw_ops.hw_scan = NULL;
-+ pax_open_kernel();
-+ *(void **)&iwl3945_hw_ops.hw_scan = NULL;
-+ pax_close_kernel();
- }
-
-
-diff --git a/drivers/net/wireless/iwmc3200wifi/debugfs.c b/drivers/net/wireless/iwmc3200wifi/debugfs.c
-index 1465379..fe4d78b 100644
---- a/drivers/net/wireless/iwmc3200wifi/debugfs.c
-+++ b/drivers/net/wireless/iwmc3200wifi/debugfs.c
-@@ -299,6 +299,8 @@ static ssize_t iwm_debugfs_fw_err_read(struct file *filp,
- int buf_len = 512;
- size_t len = 0;
-
-+ pax_track_stack();
-+
- if (*ppos != 0)
- return 0;
- if (count < sizeof(buf))
-diff --git a/drivers/net/wireless/libertas/debugfs.c b/drivers/net/wireless/libertas/debugfs.c
-index 893a55c..48f2a7a 100644
---- a/drivers/net/wireless/libertas/debugfs.c
-+++ b/drivers/net/wireless/libertas/debugfs.c
-@@ -708,7 +708,7 @@ out_unlock:
- struct lbs_debugfs_files {
- const char *name;
- int perm;
-- struct file_operations fops;
-+ const struct file_operations fops;
- };
-
- static const struct lbs_debugfs_files debugfs_files[] = {
-@@ -925,7 +925,10 @@ static ssize_t lbs_debugfs_write(struct file *f, const char __user *buf,
- char *p2;
- struct debug_data *d = (struct debug_data *)f->private_data;
-
-- pdata = kmalloc(cnt, GFP_KERNEL);
-+ if (cnt == 0)
-+ return 0;
-+
-+ pdata = kmalloc(cnt + 1, GFP_KERNEL);
- if (pdata == NULL)
- return 0;
-
-@@ -934,6 +937,7 @@ static ssize_t lbs_debugfs_write(struct file *f, const char __user *buf,
- kfree(pdata);
- return 0;
- }
-+ pdata[cnt] = '\0';
-
- p0 = pdata;
- for (i = 0; i < num_of_items; i++) {
-diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
-index 2ecbedb..42704f0 100644
---- a/drivers/net/wireless/rndis_wlan.c
-+++ b/drivers/net/wireless/rndis_wlan.c
-@@ -1176,7 +1176,7 @@ static int set_rts_threshold(struct usbnet *usbdev, u32 rts_threshold)
-
- devdbg(usbdev, "set_rts_threshold %i", rts_threshold);
-
-- if (rts_threshold < 0 || rts_threshold > 2347)
-+ if (rts_threshold > 2347)
- rts_threshold = 2347;
-
- tmp = cpu_to_le32(rts_threshold);
-diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c
-index 23a6a6d..bb6f311 100644
---- a/drivers/net/wireless/zd1211rw/zd_usb.c
-+++ b/drivers/net/wireless/zd1211rw/zd_usb.c
-@@ -357,7 +357,7 @@ static inline void handle_regs_int(struct urb *urb)
- {
- struct zd_usb *usb = urb->context;
- struct zd_usb_interrupt *intr = &usb->intr;
-- int len;
-+ unsigned int len;
- u16 int_num;
-
- ZD_ASSERT(in_interrupt());
-diff --git a/drivers/oprofile/buffer_sync.c b/drivers/oprofile/buffer_sync.c
-index 334ccd6..47f8944 100644
---- a/drivers/oprofile/buffer_sync.c
-+++ b/drivers/oprofile/buffer_sync.c
-@@ -342,7 +342,7 @@ static void add_data(struct op_entry *entry, struct mm_struct *mm)
- if (cookie == NO_COOKIE)
- offset = pc;
- if (cookie == INVALID_COOKIE) {
-- atomic_inc(&oprofile_stats.sample_lost_no_mapping);
-+ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
- offset = pc;
- }
- if (cookie != last_cookie) {
-@@ -386,14 +386,14 @@ add_sample(struct mm_struct *mm, struct op_sample *s, int in_kernel)
- /* add userspace sample */
-
- if (!mm) {
-- atomic_inc(&oprofile_stats.sample_lost_no_mm);
-+ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mm);
- return 0;
- }
-
- cookie = lookup_dcookie(mm, s->eip, &offset);
-
- if (cookie == INVALID_COOKIE) {
-- atomic_inc(&oprofile_stats.sample_lost_no_mapping);
-+ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
- return 0;
- }
-
-@@ -562,7 +562,7 @@ void sync_buffer(int cpu)
- /* ignore backtraces if failed to add a sample */
- if (state == sb_bt_start) {
- state = sb_bt_ignore;
-- atomic_inc(&oprofile_stats.bt_lost_no_mapping);
-+ atomic_inc_unchecked(&oprofile_stats.bt_lost_no_mapping);
- }
- }
- release_mm(mm);
-diff --git a/drivers/oprofile/event_buffer.c b/drivers/oprofile/event_buffer.c
-index 5df60a6..72f5c1c 100644
---- a/drivers/oprofile/event_buffer.c
-+++ b/drivers/oprofile/event_buffer.c
-@@ -53,7 +53,7 @@ void add_event_entry(unsigned long value)
- }
-
- if (buffer_pos == buffer_size) {
-- atomic_inc(&oprofile_stats.event_lost_overflow);
-+ atomic_inc_unchecked(&oprofile_stats.event_lost_overflow);
- return;
- }
-
-diff --git a/drivers/oprofile/oprof.c b/drivers/oprofile/oprof.c
-index dc8a042..fe5f315 100644
---- a/drivers/oprofile/oprof.c
-+++ b/drivers/oprofile/oprof.c
-@@ -110,7 +110,7 @@ static void switch_worker(struct work_struct *work)
- if (oprofile_ops.switch_events())
- return;
-
-- atomic_inc(&oprofile_stats.multiplex_counter);
-+ atomic_inc_unchecked(&oprofile_stats.multiplex_counter);
- start_switch_worker();
- }
-
-diff --git a/drivers/oprofile/oprofile_stats.c b/drivers/oprofile/oprofile_stats.c
-index 61689e8..387f7f8 100644
---- a/drivers/oprofile/oprofile_stats.c
-+++ b/drivers/oprofile/oprofile_stats.c
-@@ -30,11 +30,11 @@ void oprofile_reset_stats(void)
- cpu_buf->sample_invalid_eip = 0;
- }
-
-- atomic_set(&oprofile_stats.sample_lost_no_mm, 0);
-- atomic_set(&oprofile_stats.sample_lost_no_mapping, 0);
-- atomic_set(&oprofile_stats.event_lost_overflow, 0);
-- atomic_set(&oprofile_stats.bt_lost_no_mapping, 0);
-- atomic_set(&oprofile_stats.multiplex_counter, 0);
-+ atomic_set_unchecked(&oprofile_stats.sample_lost_no_mm, 0);
-+ atomic_set_unchecked(&oprofile_stats.sample_lost_no_mapping, 0);
-+ atomic_set_unchecked(&oprofile_stats.event_lost_overflow, 0);
-+ atomic_set_unchecked(&oprofile_stats.bt_lost_no_mapping, 0);
-+ atomic_set_unchecked(&oprofile_stats.multiplex_counter, 0);
- }
-
-
-diff --git a/drivers/oprofile/oprofile_stats.h b/drivers/oprofile/oprofile_stats.h
-index 0b54e46..a37c527 100644
---- a/drivers/oprofile/oprofile_stats.h
-+++ b/drivers/oprofile/oprofile_stats.h
-@@ -13,11 +13,11 @@
- #include <asm/atomic.h>
-
- struct oprofile_stat_struct {
-- atomic_t sample_lost_no_mm;
-- atomic_t sample_lost_no_mapping;
-- atomic_t bt_lost_no_mapping;
-- atomic_t event_lost_overflow;
-- atomic_t multiplex_counter;
-+ atomic_unchecked_t sample_lost_no_mm;
-+ atomic_unchecked_t sample_lost_no_mapping;
-+ atomic_unchecked_t bt_lost_no_mapping;
-+ atomic_unchecked_t event_lost_overflow;
-+ atomic_unchecked_t multiplex_counter;
- };
-
- extern struct oprofile_stat_struct oprofile_stats;
-diff --git a/drivers/oprofile/oprofilefs.c b/drivers/oprofile/oprofilefs.c
-index 2766a6d..80c77e2 100644
---- a/drivers/oprofile/oprofilefs.c
-+++ b/drivers/oprofile/oprofilefs.c
-@@ -187,7 +187,7 @@ static const struct file_operations atomic_ro_fops = {
-
-
- int oprofilefs_create_ro_atomic(struct super_block *sb, struct dentry *root,
-- char const *name, atomic_t *val)
-+ char const *name, atomic_unchecked_t *val)
- {
- struct dentry *d = __oprofilefs_create_file(sb, root, name,
- &atomic_ro_fops, 0444);
-diff --git a/drivers/parisc/pdc_stable.c b/drivers/parisc/pdc_stable.c
-index 13a64bc..ad62835 100644
---- a/drivers/parisc/pdc_stable.c
-+++ b/drivers/parisc/pdc_stable.c
-@@ -481,7 +481,7 @@ pdcspath_attr_store(struct kobject *kobj, struct attribute *attr,
- return ret;
- }
-
--static struct sysfs_ops pdcspath_attr_ops = {
-+static const struct sysfs_ops pdcspath_attr_ops = {
- .show = pdcspath_attr_show,
- .store = pdcspath_attr_store,
- };
-diff --git a/drivers/parport/procfs.c b/drivers/parport/procfs.c
-index 8eefe56..40751a7 100644
---- a/drivers/parport/procfs.c
-+++ b/drivers/parport/procfs.c
-@@ -64,7 +64,7 @@ static int do_active_device(ctl_table *table, int write,
-
- *ppos += len;
-
-- return copy_to_user(result, buffer, len) ? -EFAULT : 0;
-+ return (len > sizeof buffer || copy_to_user(result, buffer, len)) ? -EFAULT : 0;
- }
-
- #ifdef CONFIG_PARPORT_1284
-@@ -106,7 +106,7 @@ static int do_autoprobe(ctl_table *table, int write,
-
- *ppos += len;
-
-- return copy_to_user (result, buffer, len) ? -EFAULT : 0;
-+ return (len > sizeof buffer || copy_to_user (result, buffer, len)) ? -EFAULT : 0;
- }
- #endif /* IEEE1284.3 support. */
-
-diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
-index 73e7d8e..c80f3d2 100644
---- a/drivers/pci/hotplug/acpiphp_glue.c
-+++ b/drivers/pci/hotplug/acpiphp_glue.c
-@@ -111,7 +111,7 @@ static int post_dock_fixups(struct notifier_block *nb, unsigned long val,
- }
-
-
--static struct acpi_dock_ops acpiphp_dock_ops = {
-+static const struct acpi_dock_ops acpiphp_dock_ops = {
- .handler = handle_hotplug_event_func,
- };
-
-diff --git a/drivers/pci/hotplug/cpcihp_generic.c b/drivers/pci/hotplug/cpcihp_generic.c
-index 148fb46..6ff9455 100644
---- a/drivers/pci/hotplug/cpcihp_generic.c
-+++ b/drivers/pci/hotplug/cpcihp_generic.c
-@@ -73,7 +73,6 @@ static u16 port;
- static unsigned int enum_bit;
- static u8 enum_mask;
-
--static struct cpci_hp_controller_ops generic_hpc_ops;
- static struct cpci_hp_controller generic_hpc;
-
- static int __init validate_parameters(void)
-@@ -139,6 +138,10 @@ static int query_enum(void)
- return ((value & enum_mask) == enum_mask);
- }
-
-+static struct cpci_hp_controller_ops generic_hpc_ops = {
-+ .query_enum = query_enum,
-+};
-+
- static int __init cpcihp_generic_init(void)
- {
- int status;
-@@ -168,7 +171,6 @@ static int __init cpcihp_generic_init(void)
- pci_dev_put(dev);
-
- memset(&generic_hpc, 0, sizeof (struct cpci_hp_controller));
-- generic_hpc_ops.query_enum = query_enum;
- generic_hpc.ops = &generic_hpc_ops;
-
- status = cpci_hp_register_controller(&generic_hpc);
-diff --git a/drivers/pci/hotplug/cpcihp_zt5550.c b/drivers/pci/hotplug/cpcihp_zt5550.c
-index 41f6a8d..da73050 100644
---- a/drivers/pci/hotplug/cpcihp_zt5550.c
-+++ b/drivers/pci/hotplug/cpcihp_zt5550.c
-@@ -59,7 +59,6 @@
- /* local variables */
- static int debug;
- static int poll;
--static struct cpci_hp_controller_ops zt5550_hpc_ops;
- static struct cpci_hp_controller zt5550_hpc;
-
- /* Primary cPCI bus bridge device */
-@@ -205,6 +204,10 @@ static int zt5550_hc_disable_irq(void)
- return 0;
- }
-
-+static struct cpci_hp_controller_ops zt5550_hpc_ops = {
-+ .query_enum = zt5550_hc_query_enum,
-+};
-+
- static int zt5550_hc_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
- {
- int status;
-@@ -216,16 +219,17 @@ static int zt5550_hc_init_one (struct pci_dev *pdev, const struct pci_device_id
- dbg("returned from zt5550_hc_config");
-
- memset(&zt5550_hpc, 0, sizeof (struct cpci_hp_controller));
-- zt5550_hpc_ops.query_enum = zt5550_hc_query_enum;
- zt5550_hpc.ops = &zt5550_hpc_ops;
- if(!poll) {
- zt5550_hpc.irq = hc_dev->irq;
- zt5550_hpc.irq_flags = IRQF_SHARED;
- zt5550_hpc.dev_id = hc_dev;
-
-- zt5550_hpc_ops.enable_irq = zt5550_hc_enable_irq;
-- zt5550_hpc_ops.disable_irq = zt5550_hc_disable_irq;
-- zt5550_hpc_ops.check_irq = zt5550_hc_check_irq;
-+ pax_open_kernel();
-+ *(void **)&zt5550_hpc_ops.enable_irq = zt5550_hc_enable_irq;
-+ *(void **)&zt5550_hpc_ops.disable_irq = zt5550_hc_disable_irq;
-+ *(void **)&zt5550_hpc_ops.check_irq = zt5550_hc_check_irq;
-+ pax_open_kernel();
- } else {
- info("using ENUM# polling mode");
- }
-diff --git a/drivers/pci/hotplug/cpqphp_nvram.c b/drivers/pci/hotplug/cpqphp_nvram.c
-index 76ba8a1..20ca857 100644
---- a/drivers/pci/hotplug/cpqphp_nvram.c
-+++ b/drivers/pci/hotplug/cpqphp_nvram.c
-@@ -428,9 +428,13 @@ static u32 store_HRT (void __iomem *rom_start)
-
- void compaq_nvram_init (void __iomem *rom_start)
- {
-+
-+#ifndef CONFIG_PAX_KERNEXEC
- if (rom_start) {
- compaq_int15_entry_point = (rom_start + ROM_INT15_PHY_ADDR - ROM_PHY_ADDR);
- }
-+#endif
-+
- dbg("int15 entry = %p\n", compaq_int15_entry_point);
-
- /* initialize our int15 lock */
-diff --git a/drivers/pci/hotplug/fakephp.c b/drivers/pci/hotplug/fakephp.c
-index 6151389..0a894ef 100644
---- a/drivers/pci/hotplug/fakephp.c
-+++ b/drivers/pci/hotplug/fakephp.c
-@@ -73,7 +73,7 @@ static void legacy_release(struct kobject *kobj)
- }
-
- static struct kobj_type legacy_ktype = {
-- .sysfs_ops = &(struct sysfs_ops){
-+ .sysfs_ops = &(const struct sysfs_ops){
- .store = legacy_store, .show = legacy_show
- },
- .release = &legacy_release,
-diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
-index 5b680df..fe05b7e 100644
---- a/drivers/pci/intel-iommu.c
-+++ b/drivers/pci/intel-iommu.c
-@@ -2643,7 +2643,7 @@ error:
- return 0;
- }
-
--static dma_addr_t intel_map_page(struct device *dev, struct page *page,
-+dma_addr_t intel_map_page(struct device *dev, struct page *page,
- unsigned long offset, size_t size,
- enum dma_data_direction dir,
- struct dma_attrs *attrs)
-@@ -2719,7 +2719,7 @@ static void add_unmap(struct dmar_domain *dom, struct iova *iova)
- spin_unlock_irqrestore(&async_umap_flush_lock, flags);
- }
-
--static void intel_unmap_page(struct device *dev, dma_addr_t dev_addr,
-+void intel_unmap_page(struct device *dev, dma_addr_t dev_addr,
- size_t size, enum dma_data_direction dir,
- struct dma_attrs *attrs)
- {
-@@ -2768,7 +2768,7 @@ static void intel_unmap_page(struct device *dev, dma_addr_t dev_addr,
- }
- }
-
--static void *intel_alloc_coherent(struct device *hwdev, size_t size,
-+void *intel_alloc_coherent(struct device *hwdev, size_t size,
- dma_addr_t *dma_handle, gfp_t flags)
- {
- void *vaddr;
-@@ -2800,7 +2800,7 @@ static void *intel_alloc_coherent(struct device *hwdev, size_t size,
- return NULL;
- }
-
--static void intel_free_coherent(struct device *hwdev, size_t size, void *vaddr,
-+void intel_free_coherent(struct device *hwdev, size_t size, void *vaddr,
- dma_addr_t dma_handle)
- {
- int order;
-@@ -2812,7 +2812,7 @@ static void intel_free_coherent(struct device *hwdev, size_t size, void *vaddr,
- free_pages((unsigned long)vaddr, order);
- }
-
--static void intel_unmap_sg(struct device *hwdev, struct scatterlist *sglist,
-+void intel_unmap_sg(struct device *hwdev, struct scatterlist *sglist,
- int nelems, enum dma_data_direction dir,
- struct dma_attrs *attrs)
- {
-@@ -2872,7 +2872,7 @@ static int intel_nontranslate_map_sg(struct device *hddev,
- return nelems;
- }
-
--static int intel_map_sg(struct device *hwdev, struct scatterlist *sglist, int nelems,
-+int intel_map_sg(struct device *hwdev, struct scatterlist *sglist, int nelems,
- enum dma_data_direction dir, struct dma_attrs *attrs)
- {
- int i;
-@@ -2941,12 +2941,12 @@ static int intel_map_sg(struct device *hwdev, struct scatterlist *sglist, int ne
- return nelems;
- }
-
--static int intel_mapping_error(struct device *dev, dma_addr_t dma_addr)
-+int intel_mapping_error(struct device *dev, dma_addr_t dma_addr)
- {
- return !dma_addr;
- }
-
--struct dma_map_ops intel_dma_ops = {
-+const struct dma_map_ops intel_dma_ops = {
- .alloc_coherent = intel_alloc_coherent,
- .free_coherent = intel_free_coherent,
- .map_sg = intel_map_sg,
-diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
-index 5b7056c..607bc94 100644
---- a/drivers/pci/pcie/aspm.c
-+++ b/drivers/pci/pcie/aspm.c
-@@ -27,9 +27,9 @@
- #define MODULE_PARAM_PREFIX "pcie_aspm."
-
- /* Note: those are not register definitions */
--#define ASPM_STATE_L0S_UP (1) /* Upstream direction L0s state */
--#define ASPM_STATE_L0S_DW (2) /* Downstream direction L0s state */
--#define ASPM_STATE_L1 (4) /* L1 state */
-+#define ASPM_STATE_L0S_UP (1U) /* Upstream direction L0s state */
-+#define ASPM_STATE_L0S_DW (2U) /* Downstream direction L0s state */
-+#define ASPM_STATE_L1 (4U) /* L1 state */
- #define ASPM_STATE_L0S (ASPM_STATE_L0S_UP | ASPM_STATE_L0S_DW)
- #define ASPM_STATE_ALL (ASPM_STATE_L0S | ASPM_STATE_L1)
-
-diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
-index 8105e32..ca10419 100644
---- a/drivers/pci/probe.c
-+++ b/drivers/pci/probe.c
-@@ -62,14 +62,14 @@ static ssize_t pci_bus_show_cpuaffinity(struct device *dev,
- return ret;
- }
-
--static ssize_t inline pci_bus_show_cpumaskaffinity(struct device *dev,
-+static inline ssize_t pci_bus_show_cpumaskaffinity(struct device *dev,
- struct device_attribute *attr,
- char *buf)
- {
- return pci_bus_show_cpuaffinity(dev, 0, attr, buf);
- }
-
--static ssize_t inline pci_bus_show_cpulistaffinity(struct device *dev,
-+static inline ssize_t pci_bus_show_cpulistaffinity(struct device *dev,
- struct device_attribute *attr,
- char *buf)
- {
-diff --git a/drivers/pci/proc.c b/drivers/pci/proc.c
-index a03ad8c..024b0da 100644
---- a/drivers/pci/proc.c
-+++ b/drivers/pci/proc.c
-@@ -480,7 +480,16 @@ static const struct file_operations proc_bus_pci_dev_operations = {
- static int __init pci_proc_init(void)
- {
- struct pci_dev *dev = NULL;
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+ proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR, NULL);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
-+#endif
-+#else
- proc_bus_pci_dir = proc_mkdir("bus/pci", NULL);
-+#endif
- proc_create("devices", 0, proc_bus_pci_dir,
- &proc_bus_pci_dev_operations);
- proc_initialized = 1;
-diff --git a/drivers/pci/slot.c b/drivers/pci/slot.c
-index 8c02b6c..5584d8e 100644
---- a/drivers/pci/slot.c
-+++ b/drivers/pci/slot.c
-@@ -29,7 +29,7 @@ static ssize_t pci_slot_attr_store(struct kobject *kobj,
- return attribute->store ? attribute->store(slot, buf, len) : -EIO;
- }
-
--static struct sysfs_ops pci_slot_sysfs_ops = {
-+static const struct sysfs_ops pci_slot_sysfs_ops = {
- .show = pci_slot_attr_show,
- .store = pci_slot_attr_store,
- };
-diff --git a/drivers/pcmcia/pcmcia_ioctl.c b/drivers/pcmcia/pcmcia_ioctl.c
-index 30cf71d2..50938f1 100644
---- a/drivers/pcmcia/pcmcia_ioctl.c
-+++ b/drivers/pcmcia/pcmcia_ioctl.c
-@@ -819,7 +819,7 @@ static int ds_ioctl(struct inode * inode, struct file * file,
- return -EFAULT;
- }
- }
-- buf = kmalloc(sizeof(ds_ioctl_arg_t), GFP_KERNEL);
-+ buf = kzalloc(sizeof(ds_ioctl_arg_t), GFP_KERNEL);
- if (!buf)
- return -ENOMEM;
-
-diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
-index 52183c4..b224c69 100644
---- a/drivers/platform/x86/acer-wmi.c
-+++ b/drivers/platform/x86/acer-wmi.c
-@@ -918,7 +918,7 @@ static int update_bl_status(struct backlight_device *bd)
- return 0;
- }
-
--static struct backlight_ops acer_bl_ops = {
-+static const struct backlight_ops acer_bl_ops = {
- .get_brightness = read_brightness,
- .update_status = update_bl_status,
- };
-diff --git a/drivers/platform/x86/asus-laptop.c b/drivers/platform/x86/asus-laptop.c
-index 767cb61..a87380b 100644
---- a/drivers/platform/x86/asus-laptop.c
-+++ b/drivers/platform/x86/asus-laptop.c
-@@ -250,7 +250,7 @@ static struct backlight_device *asus_backlight_device;
- */
- static int read_brightness(struct backlight_device *bd);
- static int update_bl_status(struct backlight_device *bd);
--static struct backlight_ops asusbl_ops = {
-+static const struct backlight_ops asusbl_ops = {
- .get_brightness = read_brightness,
- .update_status = update_bl_status,
- };
-diff --git a/drivers/platform/x86/asus_acpi.c b/drivers/platform/x86/asus_acpi.c
-index d66c07a..a4abaac 100644
---- a/drivers/platform/x86/asus_acpi.c
-+++ b/drivers/platform/x86/asus_acpi.c
-@@ -1396,7 +1396,7 @@ static int asus_hotk_remove(struct acpi_device *device, int type)
- return 0;
- }
-
--static struct backlight_ops asus_backlight_data = {
-+static const struct backlight_ops asus_backlight_data = {
- .get_brightness = read_brightness,
- .update_status = set_brightness_status,
- };
-diff --git a/drivers/platform/x86/compal-laptop.c b/drivers/platform/x86/compal-laptop.c
-index 11003bb..550ff1b 100644
---- a/drivers/platform/x86/compal-laptop.c
-+++ b/drivers/platform/x86/compal-laptop.c
-@@ -163,7 +163,7 @@ static int bl_update_status(struct backlight_device *b)
- return set_lcd_level(b->props.brightness);
- }
-
--static struct backlight_ops compalbl_ops = {
-+static const struct backlight_ops compalbl_ops = {
- .get_brightness = bl_get_brightness,
- .update_status = bl_update_status,
- };
-diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
-index 07a74da..9dc99fa 100644
---- a/drivers/platform/x86/dell-laptop.c
-+++ b/drivers/platform/x86/dell-laptop.c
-@@ -318,7 +318,7 @@ static int dell_get_intensity(struct backlight_device *bd)
- return buffer.output[1];
- }
-
--static struct backlight_ops dell_ops = {
-+static const struct backlight_ops dell_ops = {
- .get_brightness = dell_get_intensity,
- .update_status = dell_send_intensity,
- };
-diff --git a/drivers/platform/x86/eeepc-laptop.c b/drivers/platform/x86/eeepc-laptop.c
-index c533b1c..5c81f22 100644
---- a/drivers/platform/x86/eeepc-laptop.c
-+++ b/drivers/platform/x86/eeepc-laptop.c
-@@ -245,7 +245,7 @@ static struct device *eeepc_hwmon_device;
- */
- static int read_brightness(struct backlight_device *bd);
- static int update_bl_status(struct backlight_device *bd);
--static struct backlight_ops eeepcbl_ops = {
-+static const struct backlight_ops eeepcbl_ops = {
- .get_brightness = read_brightness,
- .update_status = update_bl_status,
- };
-diff --git a/drivers/platform/x86/fujitsu-laptop.c b/drivers/platform/x86/fujitsu-laptop.c
-index bcd4ba8..a249b35 100644
---- a/drivers/platform/x86/fujitsu-laptop.c
-+++ b/drivers/platform/x86/fujitsu-laptop.c
-@@ -436,7 +436,7 @@ static int bl_update_status(struct backlight_device *b)
- return ret;
- }
-
--static struct backlight_ops fujitsubl_ops = {
-+static const struct backlight_ops fujitsubl_ops = {
- .get_brightness = bl_get_brightness,
- .update_status = bl_update_status,
- };
-diff --git a/drivers/platform/x86/msi-laptop.c b/drivers/platform/x86/msi-laptop.c
-index 759763d..1093ba2 100644
---- a/drivers/platform/x86/msi-laptop.c
-+++ b/drivers/platform/x86/msi-laptop.c
-@@ -161,7 +161,7 @@ static int bl_update_status(struct backlight_device *b)
- return set_lcd_level(b->props.brightness);
- }
-
--static struct backlight_ops msibl_ops = {
-+static const struct backlight_ops msibl_ops = {
- .get_brightness = bl_get_brightness,
- .update_status = bl_update_status,
- };
-diff --git a/drivers/platform/x86/panasonic-laptop.c b/drivers/platform/x86/panasonic-laptop.c
-index fe7cf01..9012d8d 100644
---- a/drivers/platform/x86/panasonic-laptop.c
-+++ b/drivers/platform/x86/panasonic-laptop.c
-@@ -352,7 +352,7 @@ static int bl_set_status(struct backlight_device *bd)
- return acpi_pcc_write_sset(pcc, SINF_DC_CUR_BRIGHT, bright);
- }
-
--static struct backlight_ops pcc_backlight_ops = {
-+static const struct backlight_ops pcc_backlight_ops = {
- .get_brightness = bl_get,
- .update_status = bl_set_status,
- };
-diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
-index a2a742c..b37e25e 100644
---- a/drivers/platform/x86/sony-laptop.c
-+++ b/drivers/platform/x86/sony-laptop.c
-@@ -850,7 +850,7 @@ static int sony_backlight_get_brightness(struct backlight_device *bd)
- }
-
- static struct backlight_device *sony_backlight_device;
--static struct backlight_ops sony_backlight_ops = {
-+static const struct backlight_ops sony_backlight_ops = {
- .update_status = sony_backlight_update_status,
- .get_brightness = sony_backlight_get_brightness,
- };
-diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
-index 68271ae..5e8fb10 100644
---- a/drivers/platform/x86/thinkpad_acpi.c
-+++ b/drivers/platform/x86/thinkpad_acpi.c
-@@ -2139,7 +2139,7 @@ static int hotkey_mask_get(void)
- return 0;
- }
-
--void static hotkey_mask_warn_incomplete_mask(void)
-+static void hotkey_mask_warn_incomplete_mask(void)
- {
- /* log only what the user can fix... */
- const u32 wantedmask = hotkey_driver_mask &
-@@ -6125,7 +6125,7 @@ static void tpacpi_brightness_notify_change(void)
- BACKLIGHT_UPDATE_HOTKEY);
- }
-
--static struct backlight_ops ibm_backlight_data = {
-+static const struct backlight_ops ibm_backlight_data = {
- .get_brightness = brightness_get,
- .update_status = brightness_update_status,
- };
-diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c
-index 51c0a8b..0786629 100644
---- a/drivers/platform/x86/toshiba_acpi.c
-+++ b/drivers/platform/x86/toshiba_acpi.c
-@@ -671,7 +671,7 @@ static acpi_status remove_device(void)
- return AE_OK;
- }
-
--static struct backlight_ops toshiba_backlight_data = {
-+static const struct backlight_ops toshiba_backlight_data = {
- .get_brightness = get_lcd,
- .update_status = set_lcd_status,
- };
-diff --git a/drivers/pnp/pnpbios/bioscalls.c b/drivers/pnp/pnpbios/bioscalls.c
-index fc83783c..cf370d7 100644
---- a/drivers/pnp/pnpbios/bioscalls.c
-+++ b/drivers/pnp/pnpbios/bioscalls.c
-@@ -60,7 +60,7 @@ do { \
- set_desc_limit(&gdt[(selname) >> 3], (size) - 1); \
- } while(0)
-
--static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
-+static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
- (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
-
- /*
-@@ -97,7 +97,10 @@ static inline u16 call_pnp_bios(u16 func, u16 arg1, u16 arg2, u16 arg3,
-
- cpu = get_cpu();
- save_desc_40 = get_cpu_gdt_table(cpu)[0x40 / 8];
-+
-+ pax_open_kernel();
- get_cpu_gdt_table(cpu)[0x40 / 8] = bad_bios_desc;
-+ pax_close_kernel();
-
- /* On some boxes IRQ's during PnP BIOS calls are deadly. */
- spin_lock_irqsave(&pnp_bios_lock, flags);
-@@ -135,7 +138,10 @@ static inline u16 call_pnp_bios(u16 func, u16 arg1, u16 arg2, u16 arg3,
- :"memory");
- spin_unlock_irqrestore(&pnp_bios_lock, flags);
-
-+ pax_open_kernel();
- get_cpu_gdt_table(cpu)[0x40 / 8] = save_desc_40;
-+ pax_close_kernel();
-+
- put_cpu();
-
- /* If we get here and this is set then the PnP BIOS faulted on us. */
-@@ -469,7 +475,7 @@ int pnp_bios_read_escd(char *data, u32 nvram_base)
- return status;
- }
-
--void pnpbios_calls_init(union pnp_bios_install_struct *header)
-+void __init pnpbios_calls_init(union pnp_bios_install_struct *header)
- {
- int i;
-
-@@ -477,6 +483,8 @@ void pnpbios_calls_init(union pnp_bios_install_struct *header)
- pnp_bios_callpoint.offset = header->fields.pm16offset;
- pnp_bios_callpoint.segment = PNP_CS16;
-
-+ pax_open_kernel();
-+
- for_each_possible_cpu(i) {
- struct desc_struct *gdt = get_cpu_gdt_table(i);
- if (!gdt)
-@@ -488,4 +496,6 @@ void pnpbios_calls_init(union pnp_bios_install_struct *header)
- set_desc_base(&gdt[GDT_ENTRY_PNPBIOS_DS],
- (unsigned long)__va(header->fields.pm16dseg));
- }
-+
-+ pax_close_kernel();
- }
-diff --git a/drivers/pnp/resource.c b/drivers/pnp/resource.c
-index ba97654..66b99d4 100644
---- a/drivers/pnp/resource.c
-+++ b/drivers/pnp/resource.c
-@@ -355,7 +355,7 @@ int pnp_check_irq(struct pnp_dev *dev, struct resource *res)
- return 1;
-
- /* check if the resource is valid */
-- if (*irq < 0 || *irq > 15)
-+ if (*irq > 15)
- return 0;
-
- /* check if the resource is reserved */
-@@ -419,7 +419,7 @@ int pnp_check_dma(struct pnp_dev *dev, struct resource *res)
- return 1;
-
- /* check if the resource is valid */
-- if (*dma < 0 || *dma == 4 || *dma > 7)
-+ if (*dma == 4 || *dma > 7)
- return 0;
-
- /* check if the resource is reserved */
-diff --git a/drivers/power/bq27x00_battery.c b/drivers/power/bq27x00_battery.c
-index 62bb981..428f9a2 100644
---- a/drivers/power/bq27x00_battery.c
-+++ b/drivers/power/bq27x00_battery.c
-@@ -53,7 +53,7 @@ struct bq27x00_device_info {
- int current_uA;
- int temp_C;
- int charge_rsoc;
-- struct bq27x00_access_methods *bus;
-+ struct bq27x00_access_methods bus;
- struct power_supply bat;
-
- struct i2c_client *client;
-@@ -76,7 +76,7 @@ static int bq27x00_read(u8 reg, int *rt_value, int b_single,
- {
- int ret;
-
-- ret = di->bus->read(reg, rt_value, b_single, di);
-+ ret = di->bus.read(reg, rt_value, b_single, di);
- *rt_value = be16_to_cpu(*rt_value);
-
- return ret;
-@@ -253,7 +253,6 @@ static int bq27200_battery_probe(struct i2c_client *client,
- {
- char *name;
- struct bq27x00_device_info *di;
-- struct bq27x00_access_methods *bus;
- int num;
- int retval = 0;
-
-@@ -282,19 +281,10 @@ static int bq27200_battery_probe(struct i2c_client *client,
- }
- di->id = num;
-
-- bus = kzalloc(sizeof(*bus), GFP_KERNEL);
-- if (!bus) {
-- dev_err(&client->dev, "failed to allocate access method "
-- "data\n");
-- retval = -ENOMEM;
-- goto batt_failed_3;
-- }
--
- i2c_set_clientdata(client, di);
- di->dev = &client->dev;
- di->bat.name = name;
-- bus->read = &bq27200_read;
-- di->bus = bus;
-+ di->bus.read = &bq27200_read;
- di->client = client;
-
- bq27x00_powersupply_init(di);
-@@ -302,15 +292,13 @@ static int bq27200_battery_probe(struct i2c_client *client,
- retval = power_supply_register(&client->dev, &di->bat);
- if (retval) {
- dev_err(&client->dev, "failed to register battery\n");
-- goto batt_failed_4;
-+ goto batt_failed_3;
- }
-
- dev_info(&client->dev, "support ver. %s enabled\n", DRIVER_VERSION);
-
- return 0;
-
--batt_failed_4:
-- kfree(bus);
- batt_failed_3:
- kfree(di);
- batt_failed_2:
-diff --git a/drivers/rtc/rtc-dev.c b/drivers/rtc/rtc-dev.c
-index 62227cd..b5b538b 100644
---- a/drivers/rtc/rtc-dev.c
-+++ b/drivers/rtc/rtc-dev.c
-@@ -14,6 +14,7 @@
- #include <linux/module.h>
- #include <linux/rtc.h>
- #include <linux/sched.h>
-+#include <linux/grsecurity.h>
- #include "rtc-core.h"
-
- static dev_t rtc_devt;
-@@ -357,6 +358,8 @@ static long rtc_dev_ioctl(struct file *file,
- if (copy_from_user(&tm, uarg, sizeof(tm)))
- return -EFAULT;
-
-+ gr_log_timechange();
-+
- return rtc_set_time(rtc, &tm);
-
- case RTC_PIE_ON:
-diff --git a/drivers/s390/cio/qdio_perf.c b/drivers/s390/cio/qdio_perf.c
-index 968e3c7..fbc637a 100644
---- a/drivers/s390/cio/qdio_perf.c
-+++ b/drivers/s390/cio/qdio_perf.c
-@@ -31,51 +31,51 @@ static struct proc_dir_entry *qdio_perf_pde;
- static int qdio_perf_proc_show(struct seq_file *m, void *v)
- {
- seq_printf(m, "Number of qdio interrupts\t\t\t: %li\n",
-- (long)atomic_long_read(&perf_stats.qdio_int));
-+ (long)atomic_long_read_unchecked(&perf_stats.qdio_int));
- seq_printf(m, "Number of PCI interrupts\t\t\t: %li\n",
-- (long)atomic_long_read(&perf_stats.pci_int));
-+ (long)atomic_long_read_unchecked(&perf_stats.pci_int));
- seq_printf(m, "Number of adapter interrupts\t\t\t: %li\n",
-- (long)atomic_long_read(&perf_stats.thin_int));
-+ (long)atomic_long_read_unchecked(&perf_stats.thin_int));
- seq_printf(m, "\n");
- seq_printf(m, "Inbound tasklet runs\t\t\t\t: %li\n",
-- (long)atomic_long_read(&perf_stats.tasklet_inbound));
-+ (long)atomic_long_read_unchecked(&perf_stats.tasklet_inbound));
- seq_printf(m, "Outbound tasklet runs\t\t\t\t: %li\n",
-- (long)atomic_long_read(&perf_stats.tasklet_outbound));
-+ (long)atomic_long_read_unchecked(&perf_stats.tasklet_outbound));
- seq_printf(m, "Adapter interrupt tasklet runs/loops\t\t: %li/%li\n",
-- (long)atomic_long_read(&perf_stats.tasklet_thinint),
-- (long)atomic_long_read(&perf_stats.tasklet_thinint_loop));
-+ (long)atomic_long_read_unchecked(&perf_stats.tasklet_thinint),
-+ (long)atomic_long_read_unchecked(&perf_stats.tasklet_thinint_loop));
- seq_printf(m, "Adapter interrupt inbound tasklet runs/loops\t: %li/%li\n",
-- (long)atomic_long_read(&perf_stats.thinint_inbound),
-- (long)atomic_long_read(&perf_stats.thinint_inbound_loop));
-+ (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound),
-+ (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound_loop));
- seq_printf(m, "\n");
- seq_printf(m, "Number of SIGA In issued\t\t\t: %li\n",
-- (long)atomic_long_read(&perf_stats.siga_in));
-+ (long)atomic_long_read_unchecked(&perf_stats.siga_in));
- seq_printf(m, "Number of SIGA Out issued\t\t\t: %li\n",
-- (long)atomic_long_read(&perf_stats.siga_out));
-+ (long)atomic_long_read_unchecked(&perf_stats.siga_out));
- seq_printf(m, "Number of SIGA Sync issued\t\t\t: %li\n",
-- (long)atomic_long_read(&perf_stats.siga_sync));
-+ (long)atomic_long_read_unchecked(&perf_stats.siga_sync));
- seq_printf(m, "\n");
- seq_printf(m, "Number of inbound transfers\t\t\t: %li\n",
-- (long)atomic_long_read(&perf_stats.inbound_handler));
-+ (long)atomic_long_read_unchecked(&perf_stats.inbound_handler));
- seq_printf(m, "Number of outbound transfers\t\t\t: %li\n",
-- (long)atomic_long_read(&perf_stats.outbound_handler));
-+ (long)atomic_long_read_unchecked(&perf_stats.outbound_handler));
- seq_printf(m, "\n");
- seq_printf(m, "Number of fast requeues (outg. SBAL w/o SIGA)\t: %li\n",
-- (long)atomic_long_read(&perf_stats.fast_requeue));
-+ (long)atomic_long_read_unchecked(&perf_stats.fast_requeue));
- seq_printf(m, "Number of outbound target full condition\t: %li\n",
-- (long)atomic_long_read(&perf_stats.outbound_target_full));
-+ (long)atomic_long_read_unchecked(&perf_stats.outbound_target_full));
- seq_printf(m, "Number of outbound tasklet mod_timer calls\t: %li\n",
-- (long)atomic_long_read(&perf_stats.debug_tl_out_timer));
-+ (long)atomic_long_read_unchecked(&perf_stats.debug_tl_out_timer));
- seq_printf(m, "Number of stop polling calls\t\t\t: %li\n",
-- (long)atomic_long_read(&perf_stats.debug_stop_polling));
-+ (long)atomic_long_read_unchecked(&perf_stats.debug_stop_polling));
- seq_printf(m, "AI inbound tasklet loops after stop polling\t: %li\n",
-- (long)atomic_long_read(&perf_stats.thinint_inbound_loop2));
-+ (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound_loop2));
- seq_printf(m, "QEBSM EQBS total/incomplete\t\t\t: %li/%li\n",
-- (long)atomic_long_read(&perf_stats.debug_eqbs_all),
-- (long)atomic_long_read(&perf_stats.debug_eqbs_incomplete));
-+ (long)atomic_long_read_unchecked(&perf_stats.debug_eqbs_all),
-+ (long)atomic_long_read_unchecked(&perf_stats.debug_eqbs_incomplete));
- seq_printf(m, "QEBSM SQBS total/incomplete\t\t\t: %li/%li\n",
-- (long)atomic_long_read(&perf_stats.debug_sqbs_all),
-- (long)atomic_long_read(&perf_stats.debug_sqbs_incomplete));
-+ (long)atomic_long_read_unchecked(&perf_stats.debug_sqbs_all),
-+ (long)atomic_long_read_unchecked(&perf_stats.debug_sqbs_incomplete));
- seq_printf(m, "\n");
- return 0;
- }
-diff --git a/drivers/s390/cio/qdio_perf.h b/drivers/s390/cio/qdio_perf.h
-index ff4504c..b3604c3 100644
---- a/drivers/s390/cio/qdio_perf.h
-+++ b/drivers/s390/cio/qdio_perf.h
-@@ -13,46 +13,46 @@
-
- struct qdio_perf_stats {
- /* interrupt handler calls */
-- atomic_long_t qdio_int;
-- atomic_long_t pci_int;
-- atomic_long_t thin_int;
-+ atomic_long_unchecked_t qdio_int;
-+ atomic_long_unchecked_t pci_int;
-+ atomic_long_unchecked_t thin_int;
-
- /* tasklet runs */
-- atomic_long_t tasklet_inbound;
-- atomic_long_t tasklet_outbound;
-- atomic_long_t tasklet_thinint;
-- atomic_long_t tasklet_thinint_loop;
-- atomic_long_t thinint_inbound;
-- atomic_long_t thinint_inbound_loop;
-- atomic_long_t thinint_inbound_loop2;
-+ atomic_long_unchecked_t tasklet_inbound;
-+ atomic_long_unchecked_t tasklet_outbound;
-+ atomic_long_unchecked_t tasklet_thinint;
-+ atomic_long_unchecked_t tasklet_thinint_loop;
-+ atomic_long_unchecked_t thinint_inbound;
-+ atomic_long_unchecked_t thinint_inbound_loop;
-+ atomic_long_unchecked_t thinint_inbound_loop2;
-
- /* signal adapter calls */
-- atomic_long_t siga_out;
-- atomic_long_t siga_in;
-- atomic_long_t siga_sync;
-+ atomic_long_unchecked_t siga_out;
-+ atomic_long_unchecked_t siga_in;
-+ atomic_long_unchecked_t siga_sync;
-
- /* misc */
-- atomic_long_t inbound_handler;
-- atomic_long_t outbound_handler;
-- atomic_long_t fast_requeue;
-- atomic_long_t outbound_target_full;
-+ atomic_long_unchecked_t inbound_handler;
-+ atomic_long_unchecked_t outbound_handler;
-+ atomic_long_unchecked_t fast_requeue;
-+ atomic_long_unchecked_t outbound_target_full;
-
- /* for debugging */
-- atomic_long_t debug_tl_out_timer;
-- atomic_long_t debug_stop_polling;
-- atomic_long_t debug_eqbs_all;
-- atomic_long_t debug_eqbs_incomplete;
-- atomic_long_t debug_sqbs_all;
-- atomic_long_t debug_sqbs_incomplete;
-+ atomic_long_unchecked_t debug_tl_out_timer;
-+ atomic_long_unchecked_t debug_stop_polling;
-+ atomic_long_unchecked_t debug_eqbs_all;
-+ atomic_long_unchecked_t debug_eqbs_incomplete;
-+ atomic_long_unchecked_t debug_sqbs_all;
-+ atomic_long_unchecked_t debug_sqbs_incomplete;
- };
-
- extern struct qdio_perf_stats perf_stats;
- extern int qdio_performance_stats;
-
--static inline void qdio_perf_stat_inc(atomic_long_t *count)
-+static inline void qdio_perf_stat_inc(atomic_long_unchecked_t *count)
- {
- if (qdio_performance_stats)
-- atomic_long_inc(count);
-+ atomic_long_inc_unchecked(count);
- }
-
- int qdio_setup_perf_stats(void);
-diff --git a/drivers/scsi/3w-sas.c b/drivers/scsi/3w-sas.c
-new file mode 100644
-index 0000000..7d18a18
---- /dev/null
-+++ b/drivers/scsi/3w-sas.c
-@@ -0,0 +1,1933 @@
-+/*
-+ 3w-sas.c -- LSI 3ware SAS/SATA-RAID Controller device driver for Linux.
-+
-+ Written By: Adam Radford <linuxraid@lsi.com>
-+
-+ Copyright (C) 2009 LSI Corporation.
-+
-+ This program is free software; you can redistribute it and/or modify
-+ it under the terms of the GNU General Public License as published by
-+ the Free Software Foundation; version 2 of the License.
-+
-+ This program is distributed in the hope that it will be useful,
-+ but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-+ GNU General Public License for more details.
-+
-+ NO WARRANTY
-+ THE PROGRAM IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OR
-+ CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED INCLUDING, WITHOUT
-+ LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE, NON-INFRINGEMENT,
-+ MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each Recipient is
-+ solely responsible for determining the appropriateness of using and
-+ distributing the Program and assumes all risks associated with its
-+ exercise of rights under this Agreement, including but not limited to
-+ the risks and costs of program errors, damage to or loss of data,
-+ programs or equipment, and unavailability or interruption of operations.
-+
-+ DISCLAIMER OF LIABILITY
-+ NEITHER RECIPIENT NOR ANY CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY
-+ DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-+ DAMAGES (INCLUDING WITHOUT LIMITATION LOST PROFITS), HOWEVER CAUSED AND
-+ ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
-+ TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
-+ USE OR DISTRIBUTION OF THE PROGRAM OR THE EXERCISE OF ANY RIGHTS GRANTED
-+ HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES
-+
-+ You should have received a copy of the GNU General Public License
-+ along with this program; if not, write to the Free Software
-+ Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
-+
-+ Controllers supported by this driver:
-+
-+ LSI 3ware 9750 6Gb/s SAS/SATA-RAID
-+
-+ Bugs/Comments/Suggestions should be mailed to:
-+ linuxraid@lsi.com
-+
-+ For more information, goto:
-+ http://www.lsi.com
-+
-+ History
-+ -------
-+ 3.26.00.000 - Initial driver release.
-+*/
-+
-+#include <linux/module.h>
-+#include <linux/reboot.h>
-+#include <linux/spinlock.h>
-+#include <linux/interrupt.h>
-+#include <linux/moduleparam.h>
-+#include <linux/errno.h>
-+#include <linux/types.h>
-+#include <linux/delay.h>
-+#include <linux/pci.h>
-+#include <linux/time.h>
-+#include <linux/mutex.h>
-+#include <linux/smp_lock.h>
-+#include <asm/io.h>
-+#include <asm/irq.h>
-+#include <asm/uaccess.h>
-+#include <scsi/scsi.h>
-+#include <scsi/scsi_host.h>
-+#include <scsi/scsi_tcq.h>
-+#include <scsi/scsi_cmnd.h>
-+#include "3w-sas.h"
-+
-+/* Globals */
-+#define TW_DRIVER_VERSION "3.26.00.028-2.6.32RH"
-+static TW_Device_Extension *twl_device_extension_list[TW_MAX_SLOT];
-+static unsigned int twl_device_extension_count;
-+static int twl_major = -1;
-+extern struct timezone sys_tz;
-+
-+/* Module parameters */
-+MODULE_AUTHOR ("LSI");
-+MODULE_DESCRIPTION ("LSI 3ware SAS/SATA-RAID Linux Driver");
-+MODULE_LICENSE("GPL");
-+MODULE_VERSION(TW_DRIVER_VERSION);
-+
-+static int use_msi = 0;
-+module_param(use_msi, int, S_IRUGO);
-+MODULE_PARM_DESC(use_msi, "Use Message Signaled Interrupts. Default: 0");
-+
-+/* Function prototypes */
-+static int twl_reset_device_extension(TW_Device_Extension *tw_dev, int ioctl_reset);
-+
-+/* Functions */
-+
-+/* This function returns AENs through sysfs */
-+static ssize_t twl_sysfs_aen_read(struct file *filp, struct kobject *kobj,
-+ struct bin_attribute *bin_attr,
-+ char *outbuf, loff_t offset, size_t count)
-+{
-+ struct device *dev = container_of(kobj, struct device, kobj);
-+ struct Scsi_Host *shost = class_to_shost(dev);
-+ TW_Device_Extension *tw_dev = (TW_Device_Extension *)shost->hostdata;
-+ unsigned long flags = 0;
-+ ssize_t ret;
-+
-+ if (!capable(CAP_SYS_ADMIN))
-+ return -EACCES;
-+
-+ spin_lock_irqsave(tw_dev->host->host_lock, flags);
-+ ret = memory_read_from_buffer(outbuf, count, &offset, tw_dev->event_queue[0], sizeof(TW_Event) * TW_Q_LENGTH);
-+ spin_unlock_irqrestore(tw_dev->host->host_lock, flags);
-+
-+ return ret;
-+} /* End twl_sysfs_aen_read() */
-+
-+/* aen_read sysfs attribute initializer */
-+static struct bin_attribute twl_sysfs_aen_read_attr = {
-+ .attr = {
-+ .name = "3ware_aen_read",
-+ .mode = S_IRUSR,
-+ },
-+ .size = 0,
-+ .read = twl_sysfs_aen_read
-+};
-+
-+/* This function returns driver compatibility info through sysfs */
-+static ssize_t twl_sysfs_compat_info(struct file *filp, struct kobject *kobj,
-+ struct bin_attribute *bin_attr,
-+ char *outbuf, loff_t offset, size_t count)
-+{
-+ struct device *dev = container_of(kobj, struct device, kobj);
-+ struct Scsi_Host *shost = class_to_shost(dev);
-+ TW_Device_Extension *tw_dev = (TW_Device_Extension *)shost->hostdata;
-+ unsigned long flags = 0;
-+ ssize_t ret;
-+
-+ if (!capable(CAP_SYS_ADMIN))
-+ return -EACCES;
-+
-+ spin_lock_irqsave(tw_dev->host->host_lock, flags);
-+ ret = memory_read_from_buffer(outbuf, count, &offset, &tw_dev->tw_compat_info, sizeof(TW_Compatibility_Info));
-+ spin_unlock_irqrestore(tw_dev->host->host_lock, flags);
-+
-+ return ret;
-+} /* End twl_sysfs_compat_info() */
-+
-+/* compat_info sysfs attribute initializer */
-+static struct bin_attribute twl_sysfs_compat_info_attr = {
-+ .attr = {
-+ .name = "3ware_compat_info",
-+ .mode = S_IRUSR,
-+ },
-+ .size = 0,
-+ .read = twl_sysfs_compat_info
-+};
-+
-+/* Show some statistics about the card */
-+static ssize_t twl_show_stats(struct device *dev,
-+ struct device_attribute *attr, char *buf)
-+{
-+ struct Scsi_Host *host = class_to_shost(dev);
-+ TW_Device_Extension *tw_dev = (TW_Device_Extension *)host->hostdata;
-+ unsigned long flags = 0;
-+ ssize_t len;
-+
-+ spin_lock_irqsave(tw_dev->host->host_lock, flags);
-+ len = snprintf(buf, PAGE_SIZE, "3w-sas Driver version: %s\n"
-+ "Current commands posted: %4d\n"
-+ "Max commands posted: %4d\n"
-+ "Last sgl length: %4d\n"
-+ "Max sgl length: %4d\n"
-+ "Last sector count: %4d\n"
-+ "Max sector count: %4d\n"
-+ "SCSI Host Resets: %4d\n"
-+ "AEN's: %4d\n",
-+ TW_DRIVER_VERSION,
-+ tw_dev->posted_request_count,
-+ tw_dev->max_posted_request_count,
-+ tw_dev->sgl_entries,
-+ tw_dev->max_sgl_entries,
-+ tw_dev->sector_count,
-+ tw_dev->max_sector_count,
-+ tw_dev->num_resets,
-+ tw_dev->aen_count);
-+ spin_unlock_irqrestore(tw_dev->host->host_lock, flags);
-+ return len;
-+} /* End twl_show_stats() */
-+
-+/* This function will set a devices queue depth */
-+static int twl_change_queue_depth(struct scsi_device *sdev, int queue_depth,
-+ int reason)
-+{
-+ if (reason != SCSI_QDEPTH_DEFAULT)
-+ return -EOPNOTSUPP;
-+
-+ if (queue_depth > TW_Q_LENGTH-2)
-+ queue_depth = TW_Q_LENGTH-2;
-+ scsi_adjust_queue_depth(sdev, MSG_ORDERED_TAG, queue_depth);
-+ return queue_depth;
-+} /* End twl_change_queue_depth() */
-+
-+/* stats sysfs attribute initializer */
-+static struct device_attribute twl_host_stats_attr = {
-+ .attr = {
-+ .name = "3ware_stats",
-+ .mode = S_IRUGO,
-+ },
-+ .show = twl_show_stats
-+};
-+
-+/* Host attributes initializer */
-+static struct device_attribute *twl_host_attrs[] = {
-+ &twl_host_stats_attr,
-+ NULL,
-+};
-+
-+/* This function will look up an AEN severity string */
-+static char *twl_aen_severity_lookup(unsigned char severity_code)
-+{
-+ char *retval = NULL;
-+
-+ if ((severity_code < (unsigned char) TW_AEN_SEVERITY_ERROR) ||
-+ (severity_code > (unsigned char) TW_AEN_SEVERITY_DEBUG))
-+ goto out;
-+
-+ retval = twl_aen_severity_table[severity_code];
-+out:
-+ return retval;
-+} /* End twl_aen_severity_lookup() */
-+
-+/* This function will queue an event */
-+static void twl_aen_queue_event(TW_Device_Extension *tw_dev, TW_Command_Apache_Header *header)
-+{
-+ u32 local_time;
-+ struct timeval time;
-+ TW_Event *event;
-+ unsigned short aen;
-+ char host[16];
-+ char *error_str;
-+
-+ tw_dev->aen_count++;
-+
-+ /* Fill out event info */
-+ event = tw_dev->event_queue[tw_dev->error_index];
-+
-+ host[0] = '\0';
-+ if (tw_dev->host)
-+ sprintf(host, " scsi%d:", tw_dev->host->host_no);
-+
-+ aen = le16_to_cpu(header->status_block.error);
-+ memset(event, 0, sizeof(TW_Event));
-+
-+ event->severity = TW_SEV_OUT(header->status_block.severity__reserved);
-+ do_gettimeofday(&time);
-+ local_time = (u32)(time.tv_sec - (sys_tz.tz_minuteswest * 60));
-+ event->time_stamp_sec = local_time;
-+ event->aen_code = aen;
-+ event->retrieved = TW_AEN_NOT_RETRIEVED;
-+ event->sequence_id = tw_dev->error_sequence_id;
-+ tw_dev->error_sequence_id++;
-+
-+ /* Check for embedded error string */
-+ error_str = &(header->err_specific_desc[strlen(header->err_specific_desc)+1]);
-+
-+ header->err_specific_desc[sizeof(header->err_specific_desc) - 1] = '\0';
-+ event->parameter_len = strlen(header->err_specific_desc);
-+ memcpy(event->parameter_data, header->err_specific_desc, event->parameter_len + 1 + strlen(error_str));
-+ if (event->severity != TW_AEN_SEVERITY_DEBUG)
-+ printk(KERN_WARNING "3w-sas:%s AEN: %s (0x%02X:0x%04X): %s:%s.\n",
-+ host,
-+ twl_aen_severity_lookup(TW_SEV_OUT(header->status_block.severity__reserved)),
-+ TW_MESSAGE_SOURCE_CONTROLLER_EVENT, aen, error_str,
-+ header->err_specific_desc);
-+ else
-+ tw_dev->aen_count--;
-+
-+ tw_dev->error_index = (tw_dev->error_index + 1 ) % TW_Q_LENGTH;
-+} /* End twl_aen_queue_event() */
-+
-+/* This function will attempt to post a command packet to the board */
-+static int twl_post_command_packet(TW_Device_Extension *tw_dev, int request_id)
-+{
-+ dma_addr_t command_que_value;
-+
-+ command_que_value = tw_dev->command_packet_phys[request_id];
-+ command_que_value += TW_COMMAND_OFFSET;
-+
-+ /* First write upper 4 bytes */
-+ writel((u32)((u64)command_que_value >> 32), TWL_HIBQPH_REG_ADDR(tw_dev));
-+ /* Then the lower 4 bytes */
-+ writel((u32)(command_que_value | TWL_PULL_MODE), TWL_HIBQPL_REG_ADDR(tw_dev));
-+
-+ tw_dev->state[request_id] = TW_S_POSTED;
-+ tw_dev->posted_request_count++;
-+ if (tw_dev->posted_request_count > tw_dev->max_posted_request_count)
-+ tw_dev->max_posted_request_count = tw_dev->posted_request_count;
-+
-+ return 0;
-+} /* End twl_post_command_packet() */
-+
-+/* This function will perform a pci-dma mapping for a scatter gather list */
-+static int twl_map_scsi_sg_data(TW_Device_Extension *tw_dev, int request_id)
-+{
-+ int use_sg;
-+ struct scsi_cmnd *cmd = tw_dev->srb[request_id];
-+
-+ use_sg = scsi_dma_map(cmd);
-+ if (!use_sg)
-+ return 0;
-+ else if (use_sg < 0) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1, "Failed to map scatter gather list");
-+ return 0;
-+ }
-+
-+ cmd->SCp.phase = TW_PHASE_SGLIST;
-+ cmd->SCp.have_data_in = use_sg;
-+
-+ return use_sg;
-+} /* End twl_map_scsi_sg_data() */
-+
-+/* This function hands scsi cdb's to the firmware */
-+static int twl_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, char *cdb, int use_sg, TW_SG_Entry_ISO *sglistarg)
-+{
-+ TW_Command_Full *full_command_packet;
-+ TW_Command_Apache *command_packet;
-+ int i, sg_count;
-+ struct scsi_cmnd *srb = NULL;
-+ struct scatterlist *sglist = NULL, *sg;
-+ int retval = 1;
-+
-+ if (tw_dev->srb[request_id]) {
-+ srb = tw_dev->srb[request_id];
-+ if (scsi_sglist(srb))
-+ sglist = scsi_sglist(srb);
-+ }
-+
-+ /* Initialize command packet */
-+ full_command_packet = tw_dev->command_packet_virt[request_id];
-+ full_command_packet->header.header_desc.size_header = 128;
-+ full_command_packet->header.status_block.error = 0;
-+ full_command_packet->header.status_block.severity__reserved = 0;
-+
-+ command_packet = &full_command_packet->command.newcommand;
-+ command_packet->status = 0;
-+ command_packet->opcode__reserved = TW_OPRES_IN(0, TW_OP_EXECUTE_SCSI);
-+
-+ /* We forced 16 byte cdb use earlier */
-+ if (!cdb)
-+ memcpy(command_packet->cdb, srb->cmnd, TW_MAX_CDB_LEN);
-+ else
-+ memcpy(command_packet->cdb, cdb, TW_MAX_CDB_LEN);
-+
-+ if (srb) {
-+ command_packet->unit = srb->device->id;
-+ command_packet->request_id__lunl =
-+ cpu_to_le16(TW_REQ_LUN_IN(srb->device->lun, request_id));
-+ } else {
-+ command_packet->request_id__lunl =
-+ cpu_to_le16(TW_REQ_LUN_IN(0, request_id));
-+ command_packet->unit = 0;
-+ }
-+
-+ command_packet->sgl_offset = 16;
-+
-+ if (!sglistarg) {
-+ /* Map sglist from scsi layer to cmd packet */
-+ if (scsi_sg_count(srb)) {
-+ sg_count = twl_map_scsi_sg_data(tw_dev, request_id);
-+ if (sg_count == 0)
-+ goto out;
-+
-+ scsi_for_each_sg(srb, sg, sg_count, i) {
-+ command_packet->sg_list[i].address = TW_CPU_TO_SGL(sg_dma_address(sg));
-+ command_packet->sg_list[i].length = TW_CPU_TO_SGL(sg_dma_len(sg));
-+ }
-+ command_packet->sgl_entries__lunh = cpu_to_le16(TW_REQ_LUN_IN((srb->device->lun >> 4), scsi_sg_count(tw_dev->srb[request_id])));
-+ }
-+ } else {
-+ /* Internal cdb post */
-+ for (i = 0; i < use_sg; i++) {
-+ command_packet->sg_list[i].address = TW_CPU_TO_SGL(sglistarg[i].address);
-+ command_packet->sg_list[i].length = TW_CPU_TO_SGL(sglistarg[i].length);
-+ }
-+ command_packet->sgl_entries__lunh = cpu_to_le16(TW_REQ_LUN_IN(0, use_sg));
-+ }
-+
-+ /* Update some stats */
-+ if (srb) {
-+ tw_dev->sector_count = scsi_bufflen(srb) / 512;
-+ if (tw_dev->sector_count > tw_dev->max_sector_count)
-+ tw_dev->max_sector_count = tw_dev->sector_count;
-+ tw_dev->sgl_entries = scsi_sg_count(srb);
-+ if (tw_dev->sgl_entries > tw_dev->max_sgl_entries)
-+ tw_dev->max_sgl_entries = tw_dev->sgl_entries;
-+ }
-+
-+ /* Now post the command to the board */
-+ retval = twl_post_command_packet(tw_dev, request_id);
-+
-+out:
-+ return retval;
-+} /* End twl_scsiop_execute_scsi() */
-+
-+/* This function will read the aen queue from the isr */
-+static int twl_aen_read_queue(TW_Device_Extension *tw_dev, int request_id)
-+{
-+ char cdb[TW_MAX_CDB_LEN];
-+ TW_SG_Entry_ISO sglist[1];
-+ TW_Command_Full *full_command_packet;
-+ int retval = 1;
-+
-+ full_command_packet = tw_dev->command_packet_virt[request_id];
-+ memset(full_command_packet, 0, sizeof(TW_Command_Full));
-+
-+ /* Initialize cdb */
-+ memset(&cdb, 0, TW_MAX_CDB_LEN);
-+ cdb[0] = REQUEST_SENSE; /* opcode */
-+ cdb[4] = TW_ALLOCATION_LENGTH; /* allocation length */
-+
-+ /* Initialize sglist */
-+ memset(&sglist, 0, sizeof(TW_SG_Entry_ISO));
-+ sglist[0].length = TW_SECTOR_SIZE;
-+ sglist[0].address = tw_dev->generic_buffer_phys[request_id];
-+
-+ /* Mark internal command */
-+ tw_dev->srb[request_id] = NULL;
-+
-+ /* Now post the command packet */
-+ if (twl_scsiop_execute_scsi(tw_dev, request_id, cdb, 1, sglist)) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x2, "Post failed while reading AEN queue");
-+ goto out;
-+ }
-+ retval = 0;
-+out:
-+ return retval;
-+} /* End twl_aen_read_queue() */
-+
-+/* This function will sync firmware time with the host time */
-+static void twl_aen_sync_time(TW_Device_Extension *tw_dev, int request_id)
-+{
-+ u32 schedulertime;
-+ struct timeval utc;
-+ TW_Command_Full *full_command_packet;
-+ TW_Command *command_packet;
-+ TW_Param_Apache *param;
-+ u32 local_time;
-+
-+ /* Fill out the command packet */
-+ full_command_packet = tw_dev->command_packet_virt[request_id];
-+ memset(full_command_packet, 0, sizeof(TW_Command_Full));
-+ command_packet = &full_command_packet->command.oldcommand;
-+ command_packet->opcode__sgloffset = TW_OPSGL_IN(2, TW_OP_SET_PARAM);
-+ command_packet->request_id = request_id;
-+ command_packet->byte8_offset.param.sgl[0].address = TW_CPU_TO_SGL(tw_dev->generic_buffer_phys[request_id]);
-+ command_packet->byte8_offset.param.sgl[0].length = TW_CPU_TO_SGL(TW_SECTOR_SIZE);
-+ command_packet->size = TW_COMMAND_SIZE;
-+ command_packet->byte6_offset.parameter_count = cpu_to_le16(1);
-+
-+ /* Setup the param */
-+ param = (TW_Param_Apache *)tw_dev->generic_buffer_virt[request_id];
-+ memset(param, 0, TW_SECTOR_SIZE);
-+ param->table_id = cpu_to_le16(TW_TIMEKEEP_TABLE | 0x8000); /* Controller time keep table */
-+ param->parameter_id = cpu_to_le16(0x3); /* SchedulerTime */
-+ param->parameter_size_bytes = cpu_to_le16(4);
-+
-+ /* Convert system time in UTC to local time seconds since last
-+ Sunday 12:00AM */
-+ do_gettimeofday(&utc);
-+ local_time = (u32)(utc.tv_sec - (sys_tz.tz_minuteswest * 60));
-+ schedulertime = local_time - (3 * 86400);
-+ schedulertime = cpu_to_le32(schedulertime % 604800);
-+
-+ memcpy(param->data, &schedulertime, sizeof(u32));
-+
-+ /* Mark internal command */
-+ tw_dev->srb[request_id] = NULL;
-+
-+ /* Now post the command */
-+ twl_post_command_packet(tw_dev, request_id);
-+} /* End twl_aen_sync_time() */
-+
-+/* This function will assign an available request id */
-+static void twl_get_request_id(TW_Device_Extension *tw_dev, int *request_id)
-+{
-+ *request_id = tw_dev->free_queue[tw_dev->free_head];
-+ tw_dev->free_head = (tw_dev->free_head + 1) % TW_Q_LENGTH;
-+ tw_dev->state[*request_id] = TW_S_STARTED;
-+} /* End twl_get_request_id() */
-+
-+/* This function will free a request id */
-+static void twl_free_request_id(TW_Device_Extension *tw_dev, int request_id)
-+{
-+ tw_dev->free_queue[tw_dev->free_tail] = request_id;
-+ tw_dev->state[request_id] = TW_S_FINISHED;
-+ tw_dev->free_tail = (tw_dev->free_tail + 1) % TW_Q_LENGTH;
-+} /* End twl_free_request_id() */
-+
-+/* This function will complete an aen request from the isr */
-+static int twl_aen_complete(TW_Device_Extension *tw_dev, int request_id)
-+{
-+ TW_Command_Full *full_command_packet;
-+ TW_Command *command_packet;
-+ TW_Command_Apache_Header *header;
-+ unsigned short aen;
-+ int retval = 1;
-+
-+ header = (TW_Command_Apache_Header *)tw_dev->generic_buffer_virt[request_id];
-+ tw_dev->posted_request_count--;
-+ aen = le16_to_cpu(header->status_block.error);
-+ full_command_packet = tw_dev->command_packet_virt[request_id];
-+ command_packet = &full_command_packet->command.oldcommand;
-+
-+ /* First check for internal completion of set param for time sync */
-+ if (TW_OP_OUT(command_packet->opcode__sgloffset) == TW_OP_SET_PARAM) {
-+ /* Keep reading the queue in case there are more aen's */
-+ if (twl_aen_read_queue(tw_dev, request_id))
-+ goto out2;
-+ else {
-+ retval = 0;
-+ goto out;
-+ }
-+ }
-+
-+ switch (aen) {
-+ case TW_AEN_QUEUE_EMPTY:
-+ /* Quit reading the queue if this is the last one */
-+ break;
-+ case TW_AEN_SYNC_TIME_WITH_HOST:
-+ twl_aen_sync_time(tw_dev, request_id);
-+ retval = 0;
-+ goto out;
-+ default:
-+ twl_aen_queue_event(tw_dev, header);
-+
-+ /* If there are more aen's, keep reading the queue */
-+ if (twl_aen_read_queue(tw_dev, request_id))
-+ goto out2;
-+ else {
-+ retval = 0;
-+ goto out;
-+ }
-+ }
-+ retval = 0;
-+out2:
-+ tw_dev->state[request_id] = TW_S_COMPLETED;
-+ twl_free_request_id(tw_dev, request_id);
-+ clear_bit(TW_IN_ATTENTION_LOOP, &tw_dev->flags);
-+out:
-+ return retval;
-+} /* End twl_aen_complete() */
-+
-+/* This function will poll for a response */
-+static int twl_poll_response(TW_Device_Extension *tw_dev, int request_id, int seconds)
-+{
-+ unsigned long before;
-+ dma_addr_t mfa;
-+ u32 regh, regl;
-+ u32 response;
-+ int retval = 1;
-+ int found = 0;
-+
-+ before = jiffies;
-+
-+ while (!found) {
-+ if (sizeof(dma_addr_t) > 4) {
-+ regh = readl(TWL_HOBQPH_REG_ADDR(tw_dev));
-+ regl = readl(TWL_HOBQPL_REG_ADDR(tw_dev));
-+ mfa = ((u64)regh << 32) | regl;
-+ } else
-+ mfa = readl(TWL_HOBQPL_REG_ADDR(tw_dev));
-+
-+ response = (u32)mfa;
-+
-+ if (TW_RESID_OUT(response) == request_id)
-+ found = 1;
-+
-+ if (time_after(jiffies, before + HZ * seconds))
-+ goto out;
-+
-+ msleep(50);
-+ }
-+ retval = 0;
-+out:
-+ return retval;
-+} /* End twl_poll_response() */
-+
-+/* This function will drain the aen queue */
-+static int twl_aen_drain_queue(TW_Device_Extension *tw_dev, int no_check_reset)
-+{
-+ int request_id = 0;
-+ char cdb[TW_MAX_CDB_LEN];
-+ TW_SG_Entry_ISO sglist[1];
-+ int finished = 0, count = 0;
-+ TW_Command_Full *full_command_packet;
-+ TW_Command_Apache_Header *header;
-+ unsigned short aen;
-+ int first_reset = 0, queue = 0, retval = 1;
-+
-+ if (no_check_reset)
-+ first_reset = 0;
-+ else
-+ first_reset = 1;
-+
-+ full_command_packet = tw_dev->command_packet_virt[request_id];
-+ memset(full_command_packet, 0, sizeof(TW_Command_Full));
-+
-+ /* Initialize cdb */
-+ memset(&cdb, 0, TW_MAX_CDB_LEN);
-+ cdb[0] = REQUEST_SENSE; /* opcode */
-+ cdb[4] = TW_ALLOCATION_LENGTH; /* allocation length */
-+
-+ /* Initialize sglist */
-+ memset(&sglist, 0, sizeof(TW_SG_Entry_ISO));
-+ sglist[0].length = TW_SECTOR_SIZE;
-+ sglist[0].address = tw_dev->generic_buffer_phys[request_id];
-+
-+ /* Mark internal command */
-+ tw_dev->srb[request_id] = NULL;
-+
-+ do {
-+ /* Send command to the board */
-+ if (twl_scsiop_execute_scsi(tw_dev, request_id, cdb, 1, sglist)) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x3, "Error posting request sense");
-+ goto out;
-+ }
-+
-+ /* Now poll for completion */
-+ if (twl_poll_response(tw_dev, request_id, 30)) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x4, "No valid response while draining AEN queue");
-+ tw_dev->posted_request_count--;
-+ goto out;
-+ }
-+
-+ tw_dev->posted_request_count--;
-+ header = (TW_Command_Apache_Header *)tw_dev->generic_buffer_virt[request_id];
-+ aen = le16_to_cpu(header->status_block.error);
-+ queue = 0;
-+ count++;
-+
-+ switch (aen) {
-+ case TW_AEN_QUEUE_EMPTY:
-+ if (first_reset != 1)
-+ goto out;
-+ else
-+ finished = 1;
-+ break;
-+ case TW_AEN_SOFT_RESET:
-+ if (first_reset == 0)
-+ first_reset = 1;
-+ else
-+ queue = 1;
-+ break;
-+ case TW_AEN_SYNC_TIME_WITH_HOST:
-+ break;
-+ default:
-+ queue = 1;
-+ }
-+
-+ /* Now queue an event info */
-+ if (queue)
-+ twl_aen_queue_event(tw_dev, header);
-+ } while ((finished == 0) && (count < TW_MAX_AEN_DRAIN));
-+
-+ if (count == TW_MAX_AEN_DRAIN)
-+ goto out;
-+
-+ retval = 0;
-+out:
-+ tw_dev->state[request_id] = TW_S_INITIAL;
-+ return retval;
-+} /* End twl_aen_drain_queue() */
-+
-+/* This function will allocate memory and check if it is correctly aligned */
-+static int twl_allocate_memory(TW_Device_Extension *tw_dev, int size, int which)
-+{
-+ int i;
-+ dma_addr_t dma_handle;
-+ unsigned long *cpu_addr;
-+ int retval = 1;
-+
-+ cpu_addr = pci_alloc_consistent(tw_dev->tw_pci_dev, size*TW_Q_LENGTH, &dma_handle);
-+ if (!cpu_addr) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x5, "Memory allocation failed");
-+ goto out;
-+ }
-+
-+ memset(cpu_addr, 0, size*TW_Q_LENGTH);
-+
-+ for (i = 0; i < TW_Q_LENGTH; i++) {
-+ switch(which) {
-+ case 0:
-+ tw_dev->command_packet_phys[i] = dma_handle+(i*size);
-+ tw_dev->command_packet_virt[i] = (TW_Command_Full *)((unsigned char *)cpu_addr + (i*size));
-+ break;
-+ case 1:
-+ tw_dev->generic_buffer_phys[i] = dma_handle+(i*size);
-+ tw_dev->generic_buffer_virt[i] = (unsigned long *)((unsigned char *)cpu_addr + (i*size));
-+ break;
-+ case 2:
-+ tw_dev->sense_buffer_phys[i] = dma_handle+(i*size);
-+ tw_dev->sense_buffer_virt[i] = (TW_Command_Apache_Header *)((unsigned char *)cpu_addr + (i*size));
-+ break;
-+ }
-+ }
-+ retval = 0;
-+out:
-+ return retval;
-+} /* End twl_allocate_memory() */
-+
-+/* This function will load the request id and various sgls for ioctls */
-+static void twl_load_sgl(TW_Device_Extension *tw_dev, TW_Command_Full *full_command_packet, int request_id, dma_addr_t dma_handle, int length)
-+{
-+ TW_Command *oldcommand;
-+ TW_Command_Apache *newcommand;
-+ TW_SG_Entry_ISO *sgl;
-+ unsigned int pae = 0;
-+
-+ if ((sizeof(long) < 8) && (sizeof(dma_addr_t) > 4))
-+ pae = 1;
-+
-+ if (TW_OP_OUT(full_command_packet->command.newcommand.opcode__reserved) == TW_OP_EXECUTE_SCSI) {
-+ newcommand = &full_command_packet->command.newcommand;
-+ newcommand->request_id__lunl =
-+ cpu_to_le16(TW_REQ_LUN_IN(TW_LUN_OUT(newcommand->request_id__lunl), request_id));
-+ if (length) {
-+ newcommand->sg_list[0].address = TW_CPU_TO_SGL(dma_handle + sizeof(TW_Ioctl_Buf_Apache) - 1);
-+ newcommand->sg_list[0].length = TW_CPU_TO_SGL(length);
-+ }
-+ newcommand->sgl_entries__lunh =
-+ cpu_to_le16(TW_REQ_LUN_IN(TW_LUN_OUT(newcommand->sgl_entries__lunh), length ? 1 : 0));
-+ } else {
-+ oldcommand = &full_command_packet->command.oldcommand;
-+ oldcommand->request_id = request_id;
-+
-+ if (TW_SGL_OUT(oldcommand->opcode__sgloffset)) {
-+ /* Load the sg list */
-+ sgl = (TW_SG_Entry_ISO *)((u32 *)oldcommand+oldcommand->size - (sizeof(TW_SG_Entry_ISO)/4) + pae + (sizeof(dma_addr_t) > 4 ? 1 : 0));
-+ sgl->address = TW_CPU_TO_SGL(dma_handle + sizeof(TW_Ioctl_Buf_Apache) - 1);
-+ sgl->length = TW_CPU_TO_SGL(length);
-+ oldcommand->size += pae;
-+ oldcommand->size += sizeof(dma_addr_t) > 4 ? 1 : 0;
-+ }
-+ }
-+} /* End twl_load_sgl() */
-+
-+/* This function handles ioctl for the character device
-+ This interface is used by smartmontools open source software */
-+static int twl_chrdev_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned long arg)
-+{
-+ long timeout;
-+ unsigned long *cpu_addr, data_buffer_length_adjusted = 0, flags = 0;
-+ dma_addr_t dma_handle;
-+ int request_id = 0;
-+ TW_Ioctl_Driver_Command driver_command;
-+ TW_Ioctl_Buf_Apache *tw_ioctl;
-+ TW_Command_Full *full_command_packet;
-+ TW_Device_Extension *tw_dev = twl_device_extension_list[iminor(inode)];
-+ int retval = -EFAULT;
-+ void __user *argp = (void __user *)arg;
-+
-+ /* Only let one of these through at a time */
-+ if (mutex_lock_interruptible(&tw_dev->ioctl_lock)) {
-+ retval = -EINTR;
-+ goto out;
-+ }
-+
-+ /* First copy down the driver command */
-+ if (copy_from_user(&driver_command, argp, sizeof(TW_Ioctl_Driver_Command)))
-+ goto out2;
-+
-+ /* Check data buffer size */
-+ if (driver_command.buffer_length > TW_MAX_SECTORS * 2048) {
-+ retval = -EINVAL;
-+ goto out2;
-+ }
-+
-+ /* Hardware can only do multiple of 512 byte transfers */
-+ data_buffer_length_adjusted = (driver_command.buffer_length + 511) & ~511;
-+
-+ /* Now allocate ioctl buf memory */
-+ cpu_addr = dma_alloc_coherent(&tw_dev->tw_pci_dev->dev, data_buffer_length_adjusted+sizeof(TW_Ioctl_Buf_Apache) - 1, &dma_handle, GFP_KERNEL);
-+ if (!cpu_addr) {
-+ retval = -ENOMEM;
-+ goto out2;
-+ }
-+
-+ tw_ioctl = (TW_Ioctl_Buf_Apache *)cpu_addr;
-+
-+ /* Now copy down the entire ioctl */
-+ if (copy_from_user(tw_ioctl, argp, driver_command.buffer_length + sizeof(TW_Ioctl_Buf_Apache) - 1))
-+ goto out3;
-+
-+ /* See which ioctl we are doing */
-+ switch (cmd) {
-+ case TW_IOCTL_FIRMWARE_PASS_THROUGH:
-+ spin_lock_irqsave(tw_dev->host->host_lock, flags);
-+ twl_get_request_id(tw_dev, &request_id);
-+
-+ /* Flag internal command */
-+ tw_dev->srb[request_id] = NULL;
-+
-+ /* Flag chrdev ioctl */
-+ tw_dev->chrdev_request_id = request_id;
-+
-+ full_command_packet = (TW_Command_Full *)&tw_ioctl->firmware_command;
-+
-+ /* Load request id and sglist for both command types */
-+ twl_load_sgl(tw_dev, full_command_packet, request_id, dma_handle, data_buffer_length_adjusted);
-+
-+ memcpy(tw_dev->command_packet_virt[request_id], &(tw_ioctl->firmware_command), sizeof(TW_Command_Full));
-+
-+ /* Now post the command packet to the controller */
-+ twl_post_command_packet(tw_dev, request_id);
-+ spin_unlock_irqrestore(tw_dev->host->host_lock, flags);
-+
-+ timeout = TW_IOCTL_CHRDEV_TIMEOUT*HZ;
-+
-+ /* Now wait for command to complete */
-+ timeout = wait_event_timeout(tw_dev->ioctl_wqueue, tw_dev->chrdev_request_id == TW_IOCTL_CHRDEV_FREE, timeout);
-+
-+ /* We timed out, and didn't get an interrupt */
-+ if (tw_dev->chrdev_request_id != TW_IOCTL_CHRDEV_FREE) {
-+ /* Now we need to reset the board */
-+ printk(KERN_WARNING "3w-sas: scsi%d: WARNING: (0x%02X:0x%04X): Character ioctl (0x%x) timed out, resetting card.\n",
-+ tw_dev->host->host_no, TW_DRIVER, 0x6,
-+ cmd);
-+ retval = -EIO;
-+ twl_reset_device_extension(tw_dev, 1);
-+ goto out3;
-+ }
-+
-+ /* Now copy in the command packet response */
-+ memcpy(&(tw_ioctl->firmware_command), tw_dev->command_packet_virt[request_id], sizeof(TW_Command_Full));
-+
-+ /* Now complete the io */
-+ spin_lock_irqsave(tw_dev->host->host_lock, flags);
-+ tw_dev->posted_request_count--;
-+ tw_dev->state[request_id] = TW_S_COMPLETED;
-+ twl_free_request_id(tw_dev, request_id);
-+ spin_unlock_irqrestore(tw_dev->host->host_lock, flags);
-+ break;
-+ default:
-+ retval = -ENOTTY;
-+ goto out3;
-+ }
-+
-+ /* Now copy the entire response to userspace */
-+ if (copy_to_user(argp, tw_ioctl, sizeof(TW_Ioctl_Buf_Apache) + driver_command.buffer_length - 1) == 0)
-+ retval = 0;
-+out3:
-+ /* Now free ioctl buf memory */
-+ dma_free_coherent(&tw_dev->tw_pci_dev->dev, data_buffer_length_adjusted+sizeof(TW_Ioctl_Buf_Apache) - 1, cpu_addr, dma_handle);
-+out2:
-+ mutex_unlock(&tw_dev->ioctl_lock);
-+out:
-+ return retval;
-+} /* End twl_chrdev_ioctl() */
-+
-+/* This function handles open for the character device */
-+static int twl_chrdev_open(struct inode *inode, struct file *file)
-+{
-+ unsigned int minor_number;
-+ int retval = -ENODEV;
-+
-+ if (!capable(CAP_SYS_ADMIN)) {
-+ retval = -EACCES;
-+ goto out;
-+ }
-+
-+ cycle_kernel_lock();
-+ minor_number = iminor(inode);
-+ if (minor_number >= twl_device_extension_count)
-+ goto out;
-+ retval = 0;
-+out:
-+ return retval;
-+} /* End twl_chrdev_open() */
-+
-+/* File operations struct for character device */
-+static const struct file_operations twl_fops = {
-+ .owner = THIS_MODULE,
-+ .ioctl = twl_chrdev_ioctl,
-+ .open = twl_chrdev_open,
-+ .release = NULL
-+};
-+
-+/* This function passes sense data from firmware to scsi layer */
-+static int twl_fill_sense(TW_Device_Extension *tw_dev, int i, int request_id, int copy_sense, int print_host)
-+{
-+ TW_Command_Apache_Header *header;
-+ TW_Command_Full *full_command_packet;
-+ unsigned short error;
-+ char *error_str;
-+ int retval = 1;
-+
-+ header = tw_dev->sense_buffer_virt[i];
-+ full_command_packet = tw_dev->command_packet_virt[request_id];
-+
-+ /* Get embedded firmware error string */
-+ error_str = &(header->err_specific_desc[strlen(header->err_specific_desc) + 1]);
-+
-+ /* Don't print error for Logical unit not supported during rollcall */
-+ error = le16_to_cpu(header->status_block.error);
-+ if ((error != TW_ERROR_LOGICAL_UNIT_NOT_SUPPORTED) && (error != TW_ERROR_UNIT_OFFLINE) && (error != TW_ERROR_INVALID_FIELD_IN_CDB)) {
-+ if (print_host)
-+ printk(KERN_WARNING "3w-sas: scsi%d: ERROR: (0x%02X:0x%04X): %s:%s.\n",
-+ tw_dev->host->host_no,
-+ TW_MESSAGE_SOURCE_CONTROLLER_ERROR,
-+ header->status_block.error,
-+ error_str,
-+ header->err_specific_desc);
-+ else
-+ printk(KERN_WARNING "3w-sas: ERROR: (0x%02X:0x%04X): %s:%s.\n",
-+ TW_MESSAGE_SOURCE_CONTROLLER_ERROR,
-+ header->status_block.error,
-+ error_str,
-+ header->err_specific_desc);
-+ }
-+
-+ if (copy_sense) {
-+ memcpy(tw_dev->srb[request_id]->sense_buffer, header->sense_data, TW_SENSE_DATA_LENGTH);
-+ tw_dev->srb[request_id]->result = (full_command_packet->command.newcommand.status << 1);
-+ goto out;
-+ }
-+out:
-+ return retval;
-+} /* End twl_fill_sense() */
-+
-+/* This function will free up device extension resources */
-+static void twl_free_device_extension(TW_Device_Extension *tw_dev)
-+{
-+ if (tw_dev->command_packet_virt[0])
-+ pci_free_consistent(tw_dev->tw_pci_dev,
-+ sizeof(TW_Command_Full)*TW_Q_LENGTH,
-+ tw_dev->command_packet_virt[0],
-+ tw_dev->command_packet_phys[0]);
-+
-+ if (tw_dev->generic_buffer_virt[0])
-+ pci_free_consistent(tw_dev->tw_pci_dev,
-+ TW_SECTOR_SIZE*TW_Q_LENGTH,
-+ tw_dev->generic_buffer_virt[0],
-+ tw_dev->generic_buffer_phys[0]);
-+
-+ if (tw_dev->sense_buffer_virt[0])
-+ pci_free_consistent(tw_dev->tw_pci_dev,
-+ sizeof(TW_Command_Apache_Header)*
-+ TW_Q_LENGTH,
-+ tw_dev->sense_buffer_virt[0],
-+ tw_dev->sense_buffer_phys[0]);
-+
-+ kfree(tw_dev->event_queue[0]);
-+} /* End twl_free_device_extension() */
-+
-+/* This function will get parameter table entries from the firmware */
-+static void *twl_get_param(TW_Device_Extension *tw_dev, int request_id, int table_id, int parameter_id, int parameter_size_bytes)
-+{
-+ TW_Command_Full *full_command_packet;
-+ TW_Command *command_packet;
-+ TW_Param_Apache *param;
-+ void *retval = NULL;
-+
-+ /* Setup the command packet */
-+ full_command_packet = tw_dev->command_packet_virt[request_id];
-+ memset(full_command_packet, 0, sizeof(TW_Command_Full));
-+ command_packet = &full_command_packet->command.oldcommand;
-+
-+ command_packet->opcode__sgloffset = TW_OPSGL_IN(2, TW_OP_GET_PARAM);
-+ command_packet->size = TW_COMMAND_SIZE;
-+ command_packet->request_id = request_id;
-+ command_packet->byte6_offset.block_count = cpu_to_le16(1);
-+
-+ /* Now setup the param */
-+ param = (TW_Param_Apache *)tw_dev->generic_buffer_virt[request_id];
-+ memset(param, 0, TW_SECTOR_SIZE);
-+ param->table_id = cpu_to_le16(table_id | 0x8000);
-+ param->parameter_id = cpu_to_le16(parameter_id);
-+ param->parameter_size_bytes = cpu_to_le16(parameter_size_bytes);
-+
-+ command_packet->byte8_offset.param.sgl[0].address = TW_CPU_TO_SGL(tw_dev->generic_buffer_phys[request_id]);
-+ command_packet->byte8_offset.param.sgl[0].length = TW_CPU_TO_SGL(TW_SECTOR_SIZE);
-+
-+ /* Post the command packet to the board */
-+ twl_post_command_packet(tw_dev, request_id);
-+
-+ /* Poll for completion */
-+ if (twl_poll_response(tw_dev, request_id, 30))
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x7, "No valid response during get param")
-+ else
-+ retval = (void *)&(param->data[0]);
-+
-+ tw_dev->posted_request_count--;
-+ tw_dev->state[request_id] = TW_S_INITIAL;
-+
-+ return retval;
-+} /* End twl_get_param() */
-+
-+/* This function will send an initconnection command to controller */
-+static int twl_initconnection(TW_Device_Extension *tw_dev, int message_credits,
-+ u32 set_features, unsigned short current_fw_srl,
-+ unsigned short current_fw_arch_id,
-+ unsigned short current_fw_branch,
-+ unsigned short current_fw_build,
-+ unsigned short *fw_on_ctlr_srl,
-+ unsigned short *fw_on_ctlr_arch_id,
-+ unsigned short *fw_on_ctlr_branch,
-+ unsigned short *fw_on_ctlr_build,
-+ u32 *init_connect_result)
-+{
-+ TW_Command_Full *full_command_packet;
-+ TW_Initconnect *tw_initconnect;
-+ int request_id = 0, retval = 1;
-+
-+ /* Initialize InitConnection command packet */
-+ full_command_packet = tw_dev->command_packet_virt[request_id];
-+ memset(full_command_packet, 0, sizeof(TW_Command_Full));
-+ full_command_packet->header.header_desc.size_header = 128;
-+
-+ tw_initconnect = (TW_Initconnect *)&full_command_packet->command.oldcommand;
-+ tw_initconnect->opcode__reserved = TW_OPRES_IN(0, TW_OP_INIT_CONNECTION);
-+ tw_initconnect->request_id = request_id;
-+ tw_initconnect->message_credits = cpu_to_le16(message_credits);
-+ tw_initconnect->features = set_features;
-+
-+ /* Turn on 64-bit sgl support if we need to */
-+ tw_initconnect->features |= sizeof(dma_addr_t) > 4 ? 1 : 0;
-+
-+ tw_initconnect->features = cpu_to_le32(tw_initconnect->features);
-+
-+ if (set_features & TW_EXTENDED_INIT_CONNECT) {
-+ tw_initconnect->size = TW_INIT_COMMAND_PACKET_SIZE_EXTENDED;
-+ tw_initconnect->fw_srl = cpu_to_le16(current_fw_srl);
-+ tw_initconnect->fw_arch_id = cpu_to_le16(current_fw_arch_id);
-+ tw_initconnect->fw_branch = cpu_to_le16(current_fw_branch);
-+ tw_initconnect->fw_build = cpu_to_le16(current_fw_build);
-+ } else
-+ tw_initconnect->size = TW_INIT_COMMAND_PACKET_SIZE;
-+
-+ /* Send command packet to the board */
-+ twl_post_command_packet(tw_dev, request_id);
-+
-+ /* Poll for completion */
-+ if (twl_poll_response(tw_dev, request_id, 30)) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x8, "No valid response during init connection");
-+ } else {
-+ if (set_features & TW_EXTENDED_INIT_CONNECT) {
-+ *fw_on_ctlr_srl = le16_to_cpu(tw_initconnect->fw_srl);
-+ *fw_on_ctlr_arch_id = le16_to_cpu(tw_initconnect->fw_arch_id);
-+ *fw_on_ctlr_branch = le16_to_cpu(tw_initconnect->fw_branch);
-+ *fw_on_ctlr_build = le16_to_cpu(tw_initconnect->fw_build);
-+ *init_connect_result = le32_to_cpu(tw_initconnect->result);
-+ }
-+ retval = 0;
-+ }
-+
-+ tw_dev->posted_request_count--;
-+ tw_dev->state[request_id] = TW_S_INITIAL;
-+
-+ return retval;
-+} /* End twl_initconnection() */
-+
-+/* This function will initialize the fields of a device extension */
-+static int twl_initialize_device_extension(TW_Device_Extension *tw_dev)
-+{
-+ int i, retval = 1;
-+
-+ /* Initialize command packet buffers */
-+ if (twl_allocate_memory(tw_dev, sizeof(TW_Command_Full), 0)) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x9, "Command packet memory allocation failed");
-+ goto out;
-+ }
-+
-+ /* Initialize generic buffer */
-+ if (twl_allocate_memory(tw_dev, TW_SECTOR_SIZE, 1)) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0xa, "Generic memory allocation failed");
-+ goto out;
-+ }
-+
-+ /* Allocate sense buffers */
-+ if (twl_allocate_memory(tw_dev, sizeof(TW_Command_Apache_Header), 2)) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0xb, "Sense buffer allocation failed");
-+ goto out;
-+ }
-+
-+ /* Allocate event info space */
-+ tw_dev->event_queue[0] = kcalloc(TW_Q_LENGTH, sizeof(TW_Event), GFP_KERNEL);
-+ if (!tw_dev->event_queue[0]) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0xc, "Event info memory allocation failed");
-+ goto out;
-+ }
-+
-+ for (i = 0; i < TW_Q_LENGTH; i++) {
-+ tw_dev->event_queue[i] = (TW_Event *)((unsigned char *)tw_dev->event_queue[0] + (i * sizeof(TW_Event)));
-+ tw_dev->free_queue[i] = i;
-+ tw_dev->state[i] = TW_S_INITIAL;
-+ }
-+
-+ tw_dev->free_head = TW_Q_START;
-+ tw_dev->free_tail = TW_Q_START;
-+ tw_dev->error_sequence_id = 1;
-+ tw_dev->chrdev_request_id = TW_IOCTL_CHRDEV_FREE;
-+
-+ mutex_init(&tw_dev->ioctl_lock);
-+ init_waitqueue_head(&tw_dev->ioctl_wqueue);
-+
-+ retval = 0;
-+out:
-+ return retval;
-+} /* End twl_initialize_device_extension() */
-+
-+/* This function will perform a pci-dma unmap */
-+static void twl_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id)
-+{
-+ struct scsi_cmnd *cmd = tw_dev->srb[request_id];
-+
-+ if (cmd->SCp.phase == TW_PHASE_SGLIST)
-+ scsi_dma_unmap(cmd);
-+} /* End twl_unmap_scsi_data() */
-+
-+/* This function will handle attention interrupts */
-+static int twl_handle_attention_interrupt(TW_Device_Extension *tw_dev)
-+{
-+ int retval = 1;
-+ u32 request_id, doorbell;
-+
-+ /* Read doorbell status */
-+ doorbell = readl(TWL_HOBDB_REG_ADDR(tw_dev));
-+
-+ /* Check for controller errors */
-+ if (doorbell & TWL_DOORBELL_CONTROLLER_ERROR) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0xd, "Microcontroller Error: clearing");
-+ goto out;
-+ }
-+
-+ /* Check if we need to perform an AEN drain */
-+ if (doorbell & TWL_DOORBELL_ATTENTION_INTERRUPT) {
-+ if (!(test_and_set_bit(TW_IN_ATTENTION_LOOP, &tw_dev->flags))) {
-+ twl_get_request_id(tw_dev, &request_id);
-+ if (twl_aen_read_queue(tw_dev, request_id)) {
-+ tw_dev->state[request_id] = TW_S_COMPLETED;
-+ twl_free_request_id(tw_dev, request_id);
-+ clear_bit(TW_IN_ATTENTION_LOOP, &tw_dev->flags);
-+ }
-+ }
-+ }
-+
-+ retval = 0;
-+out:
-+ /* Clear doorbell interrupt */
-+ TWL_CLEAR_DB_INTERRUPT(tw_dev);
-+
-+ /* Make sure the clear was flushed by reading it back */
-+ readl(TWL_HOBDBC_REG_ADDR(tw_dev));
-+
-+ return retval;
-+} /* End twl_handle_attention_interrupt() */
-+
-+/* Interrupt service routine */
-+static irqreturn_t twl_interrupt(int irq, void *dev_instance)
-+{
-+ TW_Device_Extension *tw_dev = (TW_Device_Extension *)dev_instance;
-+ int i, handled = 0, error = 0;
-+ dma_addr_t mfa = 0;
-+ u32 reg, regl, regh, response, request_id = 0;
-+ struct scsi_cmnd *cmd;
-+ TW_Command_Full *full_command_packet;
-+
-+ spin_lock(tw_dev->host->host_lock);
-+
-+ /* Read host interrupt status */
-+ reg = readl(TWL_HISTAT_REG_ADDR(tw_dev));
-+
-+ /* Check if this is our interrupt, otherwise bail */
-+ if (!(reg & TWL_HISTATUS_VALID_INTERRUPT))
-+ goto twl_interrupt_bail;
-+
-+ handled = 1;
-+
-+ /* If we are resetting, bail */
-+ if (test_bit(TW_IN_RESET, &tw_dev->flags))
-+ goto twl_interrupt_bail;
-+
-+ /* Attention interrupt */
-+ if (reg & TWL_HISTATUS_ATTENTION_INTERRUPT) {
-+ if (twl_handle_attention_interrupt(tw_dev)) {
-+ TWL_MASK_INTERRUPTS(tw_dev);
-+ goto twl_interrupt_bail;
-+ }
-+ }
-+
-+ /* Response interrupt */
-+ while (reg & TWL_HISTATUS_RESPONSE_INTERRUPT) {
-+ if (sizeof(dma_addr_t) > 4) {
-+ regh = readl(TWL_HOBQPH_REG_ADDR(tw_dev));
-+ regl = readl(TWL_HOBQPL_REG_ADDR(tw_dev));
-+ mfa = ((u64)regh << 32) | regl;
-+ } else
-+ mfa = readl(TWL_HOBQPL_REG_ADDR(tw_dev));
-+
-+ error = 0;
-+ response = (u32)mfa;
-+
-+ /* Check for command packet error */
-+ if (!TW_NOTMFA_OUT(response)) {
-+ for (i=0;i<TW_Q_LENGTH;i++) {
-+ if (tw_dev->sense_buffer_phys[i] == mfa) {
-+ request_id = le16_to_cpu(tw_dev->sense_buffer_virt[i]->header_desc.request_id);
-+ if (tw_dev->srb[request_id] != NULL)
-+ error = twl_fill_sense(tw_dev, i, request_id, 1, 1);
-+ else {
-+ /* Skip ioctl error prints */
-+ if (request_id != tw_dev->chrdev_request_id)
-+ error = twl_fill_sense(tw_dev, i, request_id, 0, 1);
-+ else
-+ memcpy(tw_dev->command_packet_virt[request_id], tw_dev->sense_buffer_virt[i], sizeof(TW_Command_Apache_Header));
-+ }
-+
-+ /* Now re-post the sense buffer */
-+ writel((u32)((u64)tw_dev->sense_buffer_phys[i] >> 32), TWL_HOBQPH_REG_ADDR(tw_dev));
-+ writel((u32)tw_dev->sense_buffer_phys[i], TWL_HOBQPL_REG_ADDR(tw_dev));
-+ break;
-+ }
-+ }
-+ } else
-+ request_id = TW_RESID_OUT(response);
-+
-+ full_command_packet = tw_dev->command_packet_virt[request_id];
-+
-+ /* Check for correct state */
-+ if (tw_dev->state[request_id] != TW_S_POSTED) {
-+ if (tw_dev->srb[request_id] != NULL) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0xe, "Received a request id that wasn't posted");
-+ TWL_MASK_INTERRUPTS(tw_dev);
-+ goto twl_interrupt_bail;
-+ }
-+ }
-+
-+ /* Check for internal command completion */
-+ if (tw_dev->srb[request_id] == NULL) {
-+ if (request_id != tw_dev->chrdev_request_id) {
-+ if (twl_aen_complete(tw_dev, request_id))
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0xf, "Error completing AEN during attention interrupt");
-+ } else {
-+ tw_dev->chrdev_request_id = TW_IOCTL_CHRDEV_FREE;
-+ wake_up(&tw_dev->ioctl_wqueue);
-+ }
-+ } else {
-+ cmd = tw_dev->srb[request_id];
-+
-+ if (!error)
-+ cmd->result = (DID_OK << 16);
-+
-+ /* Report residual bytes for single sgl */
-+ if ((scsi_sg_count(cmd) <= 1) && (full_command_packet->command.newcommand.status == 0)) {
-+ if (full_command_packet->command.newcommand.sg_list[0].length < scsi_bufflen(tw_dev->srb[request_id]))
-+ scsi_set_resid(cmd, scsi_bufflen(cmd) - full_command_packet->command.newcommand.sg_list[0].length);
-+ }
-+
-+ /* Now complete the io */
-+ tw_dev->state[request_id] = TW_S_COMPLETED;
-+ twl_free_request_id(tw_dev, request_id);
-+ tw_dev->posted_request_count--;
-+ tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
-+ twl_unmap_scsi_data(tw_dev, request_id);
-+ }
-+
-+ /* Check for another response interrupt */
-+ reg = readl(TWL_HISTAT_REG_ADDR(tw_dev));
-+ }
-+
-+twl_interrupt_bail:
-+ spin_unlock(tw_dev->host->host_lock);
-+ return IRQ_RETVAL(handled);
-+} /* End twl_interrupt() */
-+
-+/* This function will poll for a register change */
-+static int twl_poll_register(TW_Device_Extension *tw_dev, void *reg, u32 value, u32 result, int seconds)
-+{
-+ unsigned long before;
-+ int retval = 1;
-+ u32 reg_value;
-+
-+ reg_value = readl(reg);
-+ before = jiffies;
-+
-+ while ((reg_value & value) != result) {
-+ reg_value = readl(reg);
-+ if (time_after(jiffies, before + HZ * seconds))
-+ goto out;
-+ msleep(50);
-+ }
-+ retval = 0;
-+out:
-+ return retval;
-+} /* End twl_poll_register() */
-+
-+/* This function will reset a controller */
-+static int twl_reset_sequence(TW_Device_Extension *tw_dev, int soft_reset)
-+{
-+ int retval = 1;
-+ int i = 0;
-+ u32 status = 0;
-+ unsigned short fw_on_ctlr_srl = 0, fw_on_ctlr_arch_id = 0;
-+ unsigned short fw_on_ctlr_branch = 0, fw_on_ctlr_build = 0;
-+ u32 init_connect_result = 0;
-+ int tries = 0;
-+ int do_soft_reset = soft_reset;
-+
-+ while (tries < TW_MAX_RESET_TRIES) {
-+ /* Do a soft reset if one is needed */
-+ if (do_soft_reset) {
-+ TWL_SOFT_RESET(tw_dev);
-+
-+ /* Make sure controller is in a good state */
-+ if (twl_poll_register(tw_dev, TWL_SCRPD3_REG_ADDR(tw_dev), TWL_CONTROLLER_READY, 0x0, 30)) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x10, "Controller never went non-ready during reset sequence");
-+ tries++;
-+ continue;
-+ }
-+ if (twl_poll_register(tw_dev, TWL_SCRPD3_REG_ADDR(tw_dev), TWL_CONTROLLER_READY, TWL_CONTROLLER_READY, 60)) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x11, "Controller not ready during reset sequence");
-+ tries++;
-+ continue;
-+ }
-+ }
-+
-+ /* Initconnect */
-+ if (twl_initconnection(tw_dev, TW_INIT_MESSAGE_CREDITS,
-+ TW_EXTENDED_INIT_CONNECT, TW_CURRENT_DRIVER_SRL,
-+ TW_9750_ARCH_ID, TW_CURRENT_DRIVER_BRANCH,
-+ TW_CURRENT_DRIVER_BUILD, &fw_on_ctlr_srl,
-+ &fw_on_ctlr_arch_id, &fw_on_ctlr_branch,
-+ &fw_on_ctlr_build, &init_connect_result)) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x12, "Initconnection failed while checking SRL");
-+ do_soft_reset = 1;
-+ tries++;
-+ continue;
-+ }
-+
-+ /* Load sense buffers */
-+ while (i < TW_Q_LENGTH) {
-+ writel((u32)((u64)tw_dev->sense_buffer_phys[i] >> 32), TWL_HOBQPH_REG_ADDR(tw_dev));
-+ writel((u32)tw_dev->sense_buffer_phys[i], TWL_HOBQPL_REG_ADDR(tw_dev));
-+
-+ /* Check status for over-run after each write */
-+ status = readl(TWL_STATUS_REG_ADDR(tw_dev));
-+ if (!(status & TWL_STATUS_OVERRUN_SUBMIT))
-+ i++;
-+ }
-+
-+ /* Now check status */
-+ status = readl(TWL_STATUS_REG_ADDR(tw_dev));
-+ if (status) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x13, "Bad controller status after loading sense buffers");
-+ do_soft_reset = 1;
-+ tries++;
-+ continue;
-+ }
-+
-+ /* Drain the AEN queue */
-+ if (twl_aen_drain_queue(tw_dev, soft_reset)) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x14, "AEN drain failed during reset sequence");
-+ do_soft_reset = 1;
-+ tries++;
-+ continue;
-+ }
-+
-+ /* Load rest of compatibility struct */
-+ strncpy(tw_dev->tw_compat_info.driver_version, TW_DRIVER_VERSION, strlen(TW_DRIVER_VERSION));
-+ tw_dev->tw_compat_info.driver_srl_high = TW_CURRENT_DRIVER_SRL;
-+ tw_dev->tw_compat_info.driver_branch_high = TW_CURRENT_DRIVER_BRANCH;
-+ tw_dev->tw_compat_info.driver_build_high = TW_CURRENT_DRIVER_BUILD;
-+ tw_dev->tw_compat_info.driver_srl_low = TW_BASE_FW_SRL;
-+ tw_dev->tw_compat_info.driver_branch_low = TW_BASE_FW_BRANCH;
-+ tw_dev->tw_compat_info.driver_build_low = TW_BASE_FW_BUILD;
-+ tw_dev->tw_compat_info.fw_on_ctlr_srl = fw_on_ctlr_srl;
-+ tw_dev->tw_compat_info.fw_on_ctlr_branch = fw_on_ctlr_branch;
-+ tw_dev->tw_compat_info.fw_on_ctlr_build = fw_on_ctlr_build;
-+
-+ /* If we got here, controller is in a good state */
-+ retval = 0;
-+ goto out;
-+ }
-+out:
-+ return retval;
-+} /* End twl_reset_sequence() */
-+
-+/* This function will reset a device extension */
-+static int twl_reset_device_extension(TW_Device_Extension *tw_dev, int ioctl_reset)
-+{
-+ int i = 0, retval = 1;
-+ unsigned long flags = 0;
-+
-+ /* Block SCSI requests while we are resetting */
-+ if (ioctl_reset)
-+ scsi_block_requests(tw_dev->host);
-+
-+ set_bit(TW_IN_RESET, &tw_dev->flags);
-+ TWL_MASK_INTERRUPTS(tw_dev);
-+ TWL_CLEAR_DB_INTERRUPT(tw_dev);
-+
-+ spin_lock_irqsave(tw_dev->host->host_lock, flags);
-+
-+ /* Abort all requests that are in progress */
-+ for (i = 0; i < TW_Q_LENGTH; i++) {
-+ if ((tw_dev->state[i] != TW_S_FINISHED) &&
-+ (tw_dev->state[i] != TW_S_INITIAL) &&
-+ (tw_dev->state[i] != TW_S_COMPLETED)) {
-+ if (tw_dev->srb[i]) {
-+ tw_dev->srb[i]->result = (DID_RESET << 16);
-+ tw_dev->srb[i]->scsi_done(tw_dev->srb[i]);
-+ twl_unmap_scsi_data(tw_dev, i);
-+ }
-+ }
-+ }
-+
-+ /* Reset queues and counts */
-+ for (i = 0; i < TW_Q_LENGTH; i++) {
-+ tw_dev->free_queue[i] = i;
-+ tw_dev->state[i] = TW_S_INITIAL;
-+ }
-+ tw_dev->free_head = TW_Q_START;
-+ tw_dev->free_tail = TW_Q_START;
-+ tw_dev->posted_request_count = 0;
-+
-+ spin_unlock_irqrestore(tw_dev->host->host_lock, flags);
-+
-+ if (twl_reset_sequence(tw_dev, 1))
-+ goto out;
-+
-+ TWL_UNMASK_INTERRUPTS(tw_dev);
-+
-+ clear_bit(TW_IN_RESET, &tw_dev->flags);
-+ tw_dev->chrdev_request_id = TW_IOCTL_CHRDEV_FREE;
-+
-+ retval = 0;
-+out:
-+ if (ioctl_reset)
-+ scsi_unblock_requests(tw_dev->host);
-+ return retval;
-+} /* End twl_reset_device_extension() */
-+
-+/* This funciton returns unit geometry in cylinders/heads/sectors */
-+static int twl_scsi_biosparam(struct scsi_device *sdev, struct block_device *bdev, sector_t capacity, int geom[])
-+{
-+ int heads, sectors, cylinders;
-+ TW_Device_Extension *tw_dev;
-+
-+ tw_dev = (TW_Device_Extension *)sdev->host->hostdata;
-+
-+ if (capacity >= 0x200000) {
-+ heads = 255;
-+ sectors = 63;
-+ cylinders = sector_div(capacity, heads * sectors);
-+ } else {
-+ heads = 64;
-+ sectors = 32;
-+ cylinders = sector_div(capacity, heads * sectors);
-+ }
-+
-+ geom[0] = heads;
-+ geom[1] = sectors;
-+ geom[2] = cylinders;
-+
-+ return 0;
-+} /* End twl_scsi_biosparam() */
-+
-+/* This is the new scsi eh reset function */
-+static int twl_scsi_eh_reset(struct scsi_cmnd *SCpnt)
-+{
-+ TW_Device_Extension *tw_dev = NULL;
-+ int retval = FAILED;
-+
-+ tw_dev = (TW_Device_Extension *)SCpnt->device->host->hostdata;
-+
-+ tw_dev->num_resets++;
-+
-+ sdev_printk(KERN_WARNING, SCpnt->device,
-+ "WARNING: (0x%02X:0x%04X): Command (0x%x) timed out, resetting card.\n",
-+ TW_DRIVER, 0x2c, SCpnt->cmnd[0]);
-+
-+ /* Make sure we are not issuing an ioctl or resetting from ioctl */
-+ mutex_lock(&tw_dev->ioctl_lock);
-+
-+ /* Now reset the card and some of the device extension data */
-+ if (twl_reset_device_extension(tw_dev, 0)) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x15, "Controller reset failed during scsi host reset");
-+ goto out;
-+ }
-+
-+ retval = SUCCESS;
-+out:
-+ mutex_unlock(&tw_dev->ioctl_lock);
-+ return retval;
-+} /* End twl_scsi_eh_reset() */
-+
-+/* This is the main scsi queue function to handle scsi opcodes */
-+static int twl_scsi_queue(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_cmnd *))
-+{
-+ int request_id, retval;
-+ TW_Device_Extension *tw_dev = (TW_Device_Extension *)SCpnt->device->host->hostdata;
-+
-+ /* If we are resetting due to timed out ioctl, report as busy */
-+ if (test_bit(TW_IN_RESET, &tw_dev->flags)) {
-+ retval = SCSI_MLQUEUE_HOST_BUSY;
-+ goto out;
-+ }
-+
-+ /* Save done function into scsi_cmnd struct */
-+ SCpnt->scsi_done = done;
-+
-+ /* Get a free request id */
-+ twl_get_request_id(tw_dev, &request_id);
-+
-+ /* Save the scsi command for use by the ISR */
-+ tw_dev->srb[request_id] = SCpnt;
-+
-+ /* Initialize phase to zero */
-+ SCpnt->SCp.phase = TW_PHASE_INITIAL;
-+
-+ retval = twl_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL);
-+ if (retval) {
-+ tw_dev->state[request_id] = TW_S_COMPLETED;
-+ twl_free_request_id(tw_dev, request_id);
-+ SCpnt->result = (DID_ERROR << 16);
-+ done(SCpnt);
-+ retval = 0;
-+ }
-+out:
-+ return retval;
-+} /* End twl_scsi_queue() */
-+
-+/* This function tells the controller to shut down */
-+static void __twl_shutdown(TW_Device_Extension *tw_dev)
-+{
-+ /* Disable interrupts */
-+ TWL_MASK_INTERRUPTS(tw_dev);
-+
-+ /* Free up the IRQ */
-+ free_irq(tw_dev->tw_pci_dev->irq, tw_dev);
-+
-+ printk(KERN_WARNING "3w-sas: Shutting down host %d.\n", tw_dev->host->host_no);
-+
-+ /* Tell the card we are shutting down */
-+ if (twl_initconnection(tw_dev, 1, 0, 0, 0, 0, 0, NULL, NULL, NULL, NULL, NULL)) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x16, "Connection shutdown failed");
-+ } else {
-+ printk(KERN_WARNING "3w-sas: Shutdown complete.\n");
-+ }
-+
-+ /* Clear doorbell interrupt just before exit */
-+ TWL_CLEAR_DB_INTERRUPT(tw_dev);
-+} /* End __twl_shutdown() */
-+
-+/* Wrapper for __twl_shutdown */
-+static void twl_shutdown(struct pci_dev *pdev)
-+{
-+ struct Scsi_Host *host = pci_get_drvdata(pdev);
-+ TW_Device_Extension *tw_dev;
-+
-+ if (!host)
-+ return;
-+
-+ tw_dev = (TW_Device_Extension *)host->hostdata;
-+
-+ if (tw_dev->online)
-+ __twl_shutdown(tw_dev);
-+} /* End twl_shutdown() */
-+
-+/* This function configures unit settings when a unit is coming on-line */
-+static int twl_slave_configure(struct scsi_device *sdev)
-+{
-+ /* Force 60 second timeout */
-+ blk_queue_rq_timeout(sdev->request_queue, 60 * HZ);
-+
-+ return 0;
-+} /* End twl_slave_configure() */
-+
-+/* scsi_host_template initializer */
-+static struct scsi_host_template driver_template = {
-+ .module = THIS_MODULE,
-+ .name = "3w-sas",
-+ .queuecommand = twl_scsi_queue,
-+ .eh_host_reset_handler = twl_scsi_eh_reset,
-+ .bios_param = twl_scsi_biosparam,
-+ .change_queue_depth = twl_change_queue_depth,
-+ .can_queue = TW_Q_LENGTH-2,
-+ .slave_configure = twl_slave_configure,
-+ .this_id = -1,
-+ .sg_tablesize = TW_LIBERATOR_MAX_SGL_LENGTH,
-+ .max_sectors = TW_MAX_SECTORS,
-+ .cmd_per_lun = TW_MAX_CMDS_PER_LUN,
-+ .use_clustering = ENABLE_CLUSTERING,
-+ .shost_attrs = twl_host_attrs,
-+ .emulated = 1
-+};
-+
-+/* This function will probe and initialize a card */
-+static int __devinit twl_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id)
-+{
-+ struct Scsi_Host *host = NULL;
-+ TW_Device_Extension *tw_dev;
-+ resource_size_t mem_addr, mem_len;
-+ int retval = -ENODEV;
-+ int *ptr_phycount, phycount=0;
-+
-+ retval = pci_enable_device(pdev);
-+ if (retval) {
-+ TW_PRINTK(host, TW_DRIVER, 0x17, "Failed to enable pci device");
-+ goto out_disable_device;
-+ }
-+
-+ pci_set_master(pdev);
-+ pci_try_set_mwi(pdev);
-+
-+ if (pci_set_dma_mask(pdev, DMA_BIT_MASK(64))
-+ || pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64)))
-+ if (pci_set_dma_mask(pdev, DMA_BIT_MASK(32))
-+ || pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32))) {
-+ TW_PRINTK(host, TW_DRIVER, 0x18, "Failed to set dma mask");
-+ retval = -ENODEV;
-+ goto out_disable_device;
-+ }
-+
-+ host = scsi_host_alloc(&driver_template, sizeof(TW_Device_Extension));
-+ if (!host) {
-+ TW_PRINTK(host, TW_DRIVER, 0x19, "Failed to allocate memory for device extension");
-+ retval = -ENOMEM;
-+ goto out_disable_device;
-+ }
-+ tw_dev = (TW_Device_Extension *)host->hostdata;
-+
-+ /* Save values to device extension */
-+ tw_dev->host = host;
-+ tw_dev->tw_pci_dev = pdev;
-+
-+ if (twl_initialize_device_extension(tw_dev)) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1a, "Failed to initialize device extension");
-+ goto out_free_device_extension;
-+ }
-+
-+ /* Request IO regions */
-+ retval = pci_request_regions(pdev, "3w-sas");
-+ if (retval) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1b, "Failed to get mem region");
-+ goto out_free_device_extension;
-+ }
-+
-+ /* Use region 1 */
-+ mem_addr = pci_resource_start(pdev, 1);
-+ mem_len = pci_resource_len(pdev, 1);
-+
-+ /* Save base address */
-+ tw_dev->base_addr = ioremap(mem_addr, mem_len);
-+
-+ if (!tw_dev->base_addr) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1c, "Failed to ioremap");
-+ goto out_release_mem_region;
-+ }
-+
-+ /* Disable interrupts on the card */
-+ TWL_MASK_INTERRUPTS(tw_dev);
-+
-+ /* Initialize the card */
-+ if (twl_reset_sequence(tw_dev, 0)) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1d, "Controller reset failed during probe");
-+ goto out_iounmap;
-+ }
-+
-+ /* Set host specific parameters */
-+ host->max_id = TW_MAX_UNITS;
-+ host->max_cmd_len = TW_MAX_CDB_LEN;
-+ host->max_lun = TW_MAX_LUNS;
-+ host->max_channel = 0;
-+
-+ /* Register the card with the kernel SCSI layer */
-+ retval = scsi_add_host(host, &pdev->dev);
-+ if (retval) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1e, "scsi add host failed");
-+ goto out_iounmap;
-+ }
-+
-+ pci_set_drvdata(pdev, host);
-+
-+ printk(KERN_WARNING "3w-sas: scsi%d: Found an LSI 3ware %s Controller at 0x%llx, IRQ: %d.\n",
-+ host->host_no,
-+ (char *)twl_get_param(tw_dev, 1, TW_VERSION_TABLE,
-+ TW_PARAM_MODEL, TW_PARAM_MODEL_LENGTH),
-+ (u64)mem_addr, pdev->irq);
-+
-+ ptr_phycount = twl_get_param(tw_dev, 2, TW_PARAM_PHY_SUMMARY_TABLE,
-+ TW_PARAM_PHYCOUNT, TW_PARAM_PHYCOUNT_LENGTH);
-+ if (ptr_phycount)
-+ phycount = le32_to_cpu(*(int *)ptr_phycount);
-+
-+ printk(KERN_WARNING "3w-sas: scsi%d: Firmware %s, BIOS %s, Phys: %d.\n",
-+ host->host_no,
-+ (char *)twl_get_param(tw_dev, 1, TW_VERSION_TABLE,
-+ TW_PARAM_FWVER, TW_PARAM_FWVER_LENGTH),
-+ (char *)twl_get_param(tw_dev, 2, TW_VERSION_TABLE,
-+ TW_PARAM_BIOSVER, TW_PARAM_BIOSVER_LENGTH),
-+ phycount);
-+
-+ /* Try to enable MSI */
-+ if (use_msi && !pci_enable_msi(pdev))
-+ set_bit(TW_USING_MSI, &tw_dev->flags);
-+
-+ /* Now setup the interrupt handler */
-+ retval = request_irq(pdev->irq, twl_interrupt, IRQF_SHARED, "3w-sas", tw_dev);
-+ if (retval) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1f, "Error requesting IRQ");
-+ goto out_remove_host;
-+ }
-+
-+ twl_device_extension_list[twl_device_extension_count] = tw_dev;
-+ twl_device_extension_count++;
-+
-+ /* Re-enable interrupts on the card */
-+ TWL_UNMASK_INTERRUPTS(tw_dev);
-+
-+ /* Finally, scan the host */
-+ scsi_scan_host(host);
-+
-+ /* Add sysfs binary files */
-+ if (sysfs_create_bin_file(&host->shost_dev.kobj, &twl_sysfs_aen_read_attr))
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x20, "Failed to create sysfs binary file: 3ware_aen_read");
-+ if (sysfs_create_bin_file(&host->shost_dev.kobj, &twl_sysfs_compat_info_attr))
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x21, "Failed to create sysfs binary file: 3ware_compat_info");
-+
-+ if (twl_major == -1) {
-+ if ((twl_major = register_chrdev (0, "twl", &twl_fops)) < 0)
-+ TW_PRINTK(host, TW_DRIVER, 0x22, "Failed to register character device");
-+ }
-+ tw_dev->online = 1;
-+ return 0;
-+
-+out_remove_host:
-+ if (test_bit(TW_USING_MSI, &tw_dev->flags))
-+ pci_disable_msi(pdev);
-+ scsi_remove_host(host);
-+out_iounmap:
-+ iounmap(tw_dev->base_addr);
-+out_release_mem_region:
-+ pci_release_regions(pdev);
-+out_free_device_extension:
-+ twl_free_device_extension(tw_dev);
-+ scsi_host_put(host);
-+out_disable_device:
-+ pci_disable_device(pdev);
-+
-+ return retval;
-+} /* End twl_probe() */
-+
-+/* This function is called to remove a device */
-+static void twl_remove(struct pci_dev *pdev)
-+{
-+ struct Scsi_Host *host = pci_get_drvdata(pdev);
-+ TW_Device_Extension *tw_dev;
-+
-+ if (!host)
-+ return;
-+
-+ tw_dev = (TW_Device_Extension *)host->hostdata;
-+
-+ if (!tw_dev->online)
-+ return;
-+
-+ /* Remove sysfs binary files */
-+ sysfs_remove_bin_file(&host->shost_dev.kobj, &twl_sysfs_aen_read_attr);
-+ sysfs_remove_bin_file(&host->shost_dev.kobj, &twl_sysfs_compat_info_attr);
-+
-+ scsi_remove_host(tw_dev->host);
-+
-+ /* Unregister character device */
-+ if (twl_major >= 0) {
-+ unregister_chrdev(twl_major, "twl");
-+ twl_major = -1;
-+ }
-+
-+ /* Shutdown the card */
-+ __twl_shutdown(tw_dev);
-+
-+ /* Disable MSI if enabled */
-+ if (test_bit(TW_USING_MSI, &tw_dev->flags))
-+ pci_disable_msi(pdev);
-+
-+ /* Free IO remapping */
-+ iounmap(tw_dev->base_addr);
-+
-+ /* Free up the mem region */
-+ pci_release_regions(pdev);
-+
-+ /* Free up device extension resources */
-+ twl_free_device_extension(tw_dev);
-+
-+ scsi_host_put(tw_dev->host);
-+ pci_disable_device(pdev);
-+ twl_device_extension_count--;
-+} /* End twl_remove() */
-+
-+#ifdef CONFIG_PM
-+/* This function is called on PCI suspend */
-+static int twl_suspend(struct pci_dev *pdev, pm_message_t state)
-+{
-+ struct Scsi_Host *host = pci_get_drvdata(pdev);
-+ TW_Device_Extension *tw_dev = (TW_Device_Extension *)host->hostdata;
-+
-+ printk(KERN_WARNING "3w-sas: Suspending host %d.\n", tw_dev->host->host_no);
-+ /* Disable interrupts */
-+ TWL_MASK_INTERRUPTS(tw_dev);
-+
-+ free_irq(tw_dev->tw_pci_dev->irq, tw_dev);
-+
-+ /* Tell the card we are shutting down */
-+ if (twl_initconnection(tw_dev, 1, 0, 0, 0, 0, 0, NULL, NULL, NULL, NULL, NULL)) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x23, "Connection shutdown failed during suspend");
-+ } else {
-+ printk(KERN_WARNING "3w-sas: Suspend complete.\n");
-+ }
-+
-+ /* Clear doorbell interrupt */
-+ TWL_CLEAR_DB_INTERRUPT(tw_dev);
-+
-+ pci_save_state(pdev);
-+ pci_disable_device(pdev);
-+ pci_set_power_state(pdev, pci_choose_state(pdev, state));
-+
-+ return 0;
-+} /* End twl_suspend() */
-+
-+/* This function is called on PCI resume */
-+static int twl_resume(struct pci_dev *pdev)
-+{
-+ int retval = 0;
-+ struct Scsi_Host *host = pci_get_drvdata(pdev);
-+ TW_Device_Extension *tw_dev = (TW_Device_Extension *)host->hostdata;
-+
-+ printk(KERN_WARNING "3w-sas: Resuming host %d.\n", tw_dev->host->host_no);
-+ pci_set_power_state(pdev, PCI_D0);
-+ pci_enable_wake(pdev, PCI_D0, 0);
-+ pci_restore_state(pdev);
-+
-+ retval = pci_enable_device(pdev);
-+ if (retval) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x24, "Enable device failed during resume");
-+ return retval;
-+ }
-+
-+ pci_set_master(pdev);
-+ pci_try_set_mwi(pdev);
-+
-+ if (pci_set_dma_mask(pdev, DMA_BIT_MASK(64))
-+ || pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64)))
-+ if (pci_set_dma_mask(pdev, DMA_BIT_MASK(32))
-+ || pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32))) {
-+ TW_PRINTK(host, TW_DRIVER, 0x25, "Failed to set dma mask during resume");
-+ retval = -ENODEV;
-+ goto out_disable_device;
-+ }
-+
-+ /* Initialize the card */
-+ if (twl_reset_sequence(tw_dev, 0)) {
-+ retval = -ENODEV;
-+ goto out_disable_device;
-+ }
-+
-+ /* Now setup the interrupt handler */
-+ retval = request_irq(pdev->irq, twl_interrupt, IRQF_SHARED, "3w-sas", tw_dev);
-+ if (retval) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x26, "Error requesting IRQ during resume");
-+ retval = -ENODEV;
-+ goto out_disable_device;
-+ }
-+
-+ /* Now enable MSI if enabled */
-+ if (test_bit(TW_USING_MSI, &tw_dev->flags))
-+ pci_enable_msi(pdev);
-+
-+ /* Re-enable interrupts on the card */
-+ TWL_UNMASK_INTERRUPTS(tw_dev);
-+
-+ printk(KERN_WARNING "3w-sas: Resume complete.\n");
-+ return 0;
-+
-+out_disable_device:
-+ scsi_remove_host(host);
-+ pci_disable_device(pdev);
-+
-+ return retval;
-+} /* End twl_resume() */
-+#endif
-+
-+/* PCI Devices supported by this driver */
-+static struct pci_device_id twl_pci_tbl[] __devinitdata = {
-+ { PCI_VENDOR_ID_3WARE, PCI_DEVICE_ID_3WARE_9750,
-+ PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
-+ { }
-+};
-+MODULE_DEVICE_TABLE(pci, twl_pci_tbl);
-+
-+/* pci_driver initializer */
-+static struct pci_driver twl_driver = {
-+ .name = "3w-sas",
-+ .id_table = twl_pci_tbl,
-+ .probe = twl_probe,
-+ .remove = twl_remove,
-+#ifdef CONFIG_PM
-+ .suspend = twl_suspend,
-+ .resume = twl_resume,
-+#endif
-+ .shutdown = twl_shutdown
-+};
-+
-+/* This function is called on driver initialization */
-+static int __init twl_init(void)
-+{
-+ printk(KERN_WARNING "LSI 3ware SAS/SATA-RAID Controller device driver for Linux v%s.\n", TW_DRIVER_VERSION);
-+
-+ return pci_register_driver(&twl_driver);
-+} /* End twl_init() */
-+
-+/* This function is called on driver exit */
-+static void __exit twl_exit(void)
-+{
-+ pci_unregister_driver(&twl_driver);
-+} /* End twl_exit() */
-+
-+module_init(twl_init);
-+module_exit(twl_exit);
-+
-diff --git a/drivers/scsi/3w-sas.h b/drivers/scsi/3w-sas.h
-new file mode 100644
-index 0000000..e620505
---- /dev/null
-+++ b/drivers/scsi/3w-sas.h
-@@ -0,0 +1,396 @@
-+/*
-+ 3w-sas.h -- LSI 3ware SAS/SATA-RAID Controller device driver for Linux.
-+
-+ Written By: Adam Radford <linuxraid@lsi.com>
-+
-+ Copyright (C) 2009 LSI Corporation.
-+
-+ This program is free software; you can redistribute it and/or modify
-+ it under the terms of the GNU General Public License as published by
-+ the Free Software Foundation; version 2 of the License.
-+
-+ This program is distributed in the hope that it will be useful,
-+ but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-+ GNU General Public License for more details.
-+
-+ NO WARRANTY
-+ THE PROGRAM IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OR
-+ CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED INCLUDING, WITHOUT
-+ LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE, NON-INFRINGEMENT,
-+ MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each Recipient is
-+ solely responsible for determining the appropriateness of using and
-+ distributing the Program and assumes all risks associated with its
-+ exercise of rights under this Agreement, including but not limited to
-+ the risks and costs of program errors, damage to or loss of data,
-+ programs or equipment, and unavailability or interruption of operations.
-+
-+ DISCLAIMER OF LIABILITY
-+ NEITHER RECIPIENT NOR ANY CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY
-+ DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-+ DAMAGES (INCLUDING WITHOUT LIMITATION LOST PROFITS), HOWEVER CAUSED AND
-+ ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
-+ TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
-+ USE OR DISTRIBUTION OF THE PROGRAM OR THE EXERCISE OF ANY RIGHTS GRANTED
-+ HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES
-+
-+ You should have received a copy of the GNU General Public License
-+ along with this program; if not, write to the Free Software
-+ Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
-+
-+ Bugs/Comments/Suggestions should be mailed to:
-+ linuxraid@lsi.com
-+
-+ For more information, goto:
-+ http://www.lsi.com
-+*/
-+
-+#ifndef _3W_SAS_H
-+#define _3W_SAS_H
-+
-+/* AEN severity table */
-+static char *twl_aen_severity_table[] =
-+{
-+ "None", "ERROR", "WARNING", "INFO", "DEBUG", (char*) 0
-+};
-+
-+/* Liberator register offsets */
-+#define TWL_STATUS 0x0 /* Status */
-+#define TWL_HIBDB 0x20 /* Inbound doorbell */
-+#define TWL_HISTAT 0x30 /* Host interrupt status */
-+#define TWL_HIMASK 0x34 /* Host interrupt mask */
-+#define TWL_HOBDB 0x9C /* Outbound doorbell */
-+#define TWL_HOBDBC 0xA0 /* Outbound doorbell clear */
-+#define TWL_SCRPD3 0xBC /* Scratchpad */
-+#define TWL_HIBQPL 0xC0 /* Host inbound Q low */
-+#define TWL_HIBQPH 0xC4 /* Host inbound Q high */
-+#define TWL_HOBQPL 0xC8 /* Host outbound Q low */
-+#define TWL_HOBQPH 0xCC /* Host outbound Q high */
-+#define TWL_HISTATUS_VALID_INTERRUPT 0xC
-+#define TWL_HISTATUS_ATTENTION_INTERRUPT 0x4
-+#define TWL_HISTATUS_RESPONSE_INTERRUPT 0x8
-+#define TWL_STATUS_OVERRUN_SUBMIT 0x2000
-+#define TWL_ISSUE_SOFT_RESET 0x100
-+#define TWL_CONTROLLER_READY 0x2000
-+#define TWL_DOORBELL_CONTROLLER_ERROR 0x200000
-+#define TWL_DOORBELL_ATTENTION_INTERRUPT 0x40000
-+#define TWL_PULL_MODE 0x1
-+
-+/* Command packet opcodes used by the driver */
-+#define TW_OP_INIT_CONNECTION 0x1
-+#define TW_OP_GET_PARAM 0x12
-+#define TW_OP_SET_PARAM 0x13
-+#define TW_OP_EXECUTE_SCSI 0x10
-+
-+/* Asynchronous Event Notification (AEN) codes used by the driver */
-+#define TW_AEN_QUEUE_EMPTY 0x0000
-+#define TW_AEN_SOFT_RESET 0x0001
-+#define TW_AEN_SYNC_TIME_WITH_HOST 0x031
-+#define TW_AEN_SEVERITY_ERROR 0x1
-+#define TW_AEN_SEVERITY_DEBUG 0x4
-+#define TW_AEN_NOT_RETRIEVED 0x1
-+
-+/* Command state defines */
-+#define TW_S_INITIAL 0x1 /* Initial state */
-+#define TW_S_STARTED 0x2 /* Id in use */
-+#define TW_S_POSTED 0x4 /* Posted to the controller */
-+#define TW_S_COMPLETED 0x8 /* Completed by isr */
-+#define TW_S_FINISHED 0x10 /* I/O completely done */
-+
-+/* Compatibility defines */
-+#define TW_9750_ARCH_ID 10
-+#define TW_CURRENT_DRIVER_SRL 40
-+#define TW_CURRENT_DRIVER_BUILD 0
-+#define TW_CURRENT_DRIVER_BRANCH 0
-+
-+/* Phase defines */
-+#define TW_PHASE_INITIAL 0
-+#define TW_PHASE_SGLIST 2
-+
-+/* Misc defines */
-+#define TW_SECTOR_SIZE 512
-+#define TW_MAX_UNITS 32
-+#define TW_INIT_MESSAGE_CREDITS 0x100
-+#define TW_INIT_COMMAND_PACKET_SIZE 0x3
-+#define TW_INIT_COMMAND_PACKET_SIZE_EXTENDED 0x6
-+#define TW_EXTENDED_INIT_CONNECT 0x2
-+#define TW_BASE_FW_SRL 24
-+#define TW_BASE_FW_BRANCH 0
-+#define TW_BASE_FW_BUILD 1
-+#define TW_Q_LENGTH 256
-+#define TW_Q_START 0
-+#define TW_MAX_SLOT 32
-+#define TW_MAX_RESET_TRIES 2
-+#define TW_MAX_CMDS_PER_LUN 254
-+#define TW_MAX_AEN_DRAIN 255
-+#define TW_IN_RESET 2
-+#define TW_USING_MSI 3
-+#define TW_IN_ATTENTION_LOOP 4
-+#define TW_MAX_SECTORS 256
-+#define TW_MAX_CDB_LEN 16
-+#define TW_IOCTL_CHRDEV_TIMEOUT 60 /* 60 seconds */
-+#define TW_IOCTL_CHRDEV_FREE -1
-+#define TW_COMMAND_OFFSET 128 /* 128 bytes */
-+#define TW_VERSION_TABLE 0x0402
-+#define TW_TIMEKEEP_TABLE 0x040A
-+#define TW_INFORMATION_TABLE 0x0403
-+#define TW_PARAM_FWVER 3
-+#define TW_PARAM_FWVER_LENGTH 16
-+#define TW_PARAM_BIOSVER 4
-+#define TW_PARAM_BIOSVER_LENGTH 16
-+#define TW_PARAM_MODEL 8
-+#define TW_PARAM_MODEL_LENGTH 16
-+#define TW_PARAM_PHY_SUMMARY_TABLE 1
-+#define TW_PARAM_PHYCOUNT 2
-+#define TW_PARAM_PHYCOUNT_LENGTH 1
-+#define TW_IOCTL_FIRMWARE_PASS_THROUGH 0x108 // Used by smartmontools
-+#define TW_ALLOCATION_LENGTH 128
-+#define TW_SENSE_DATA_LENGTH 18
-+#define TW_ERROR_LOGICAL_UNIT_NOT_SUPPORTED 0x10a
-+#define TW_ERROR_INVALID_FIELD_IN_CDB 0x10d
-+#define TW_ERROR_UNIT_OFFLINE 0x128
-+#define TW_MESSAGE_SOURCE_CONTROLLER_ERROR 3
-+#define TW_MESSAGE_SOURCE_CONTROLLER_EVENT 4
-+#define TW_DRIVER 6
-+#ifndef PCI_DEVICE_ID_3WARE_9750
-+#define PCI_DEVICE_ID_3WARE_9750 0x1010
-+#endif
-+
-+/* Bitmask macros to eliminate bitfields */
-+
-+/* opcode: 5, reserved: 3 */
-+#define TW_OPRES_IN(x,y) ((x << 5) | (y & 0x1f))
-+#define TW_OP_OUT(x) (x & 0x1f)
-+
-+/* opcode: 5, sgloffset: 3 */
-+#define TW_OPSGL_IN(x,y) ((x << 5) | (y & 0x1f))
-+#define TW_SGL_OUT(x) ((x >> 5) & 0x7)
-+
-+/* severity: 3, reserved: 5 */
-+#define TW_SEV_OUT(x) (x & 0x7)
-+
-+/* not_mfa: 1, reserved: 7, status: 8, request_id: 16 */
-+#define TW_RESID_OUT(x) ((x >> 16) & 0xffff)
-+#define TW_NOTMFA_OUT(x) (x & 0x1)
-+
-+/* request_id: 12, lun: 4 */
-+#define TW_REQ_LUN_IN(lun, request_id) (((lun << 12) & 0xf000) | (request_id & 0xfff))
-+#define TW_LUN_OUT(lun) ((lun >> 12) & 0xf)
-+
-+/* Register access macros */
-+#define TWL_STATUS_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_STATUS)
-+#define TWL_HOBQPL_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HOBQPL)
-+#define TWL_HOBQPH_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HOBQPH)
-+#define TWL_HOBDB_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HOBDB)
-+#define TWL_HOBDBC_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HOBDBC)
-+#define TWL_HIMASK_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HIMASK)
-+#define TWL_HISTAT_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HISTAT)
-+#define TWL_HIBQPH_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HIBQPH)
-+#define TWL_HIBQPL_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HIBQPL)
-+#define TWL_HIBDB_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HIBDB)
-+#define TWL_SCRPD3_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_SCRPD3)
-+#define TWL_MASK_INTERRUPTS(x) (writel(~0, TWL_HIMASK_REG_ADDR(tw_dev)))
-+#define TWL_UNMASK_INTERRUPTS(x) (writel(~TWL_HISTATUS_VALID_INTERRUPT, TWL_HIMASK_REG_ADDR(tw_dev)))
-+#define TWL_CLEAR_DB_INTERRUPT(x) (writel(~0, TWL_HOBDBC_REG_ADDR(tw_dev)))
-+#define TWL_SOFT_RESET(x) (writel(TWL_ISSUE_SOFT_RESET, TWL_HIBDB_REG_ADDR(tw_dev)))
-+
-+/* Macros */
-+#define TW_PRINTK(h,a,b,c) { \
-+if (h) \
-+printk(KERN_WARNING "3w-sas: scsi%d: ERROR: (0x%02X:0x%04X): %s.\n",h->host_no,a,b,c); \
-+else \
-+printk(KERN_WARNING "3w-sas: ERROR: (0x%02X:0x%04X): %s.\n",a,b,c); \
-+}
-+#define TW_MAX_LUNS 16
-+#define TW_COMMAND_SIZE (sizeof(dma_addr_t) > 4 ? 6 : 4)
-+#define TW_LIBERATOR_MAX_SGL_LENGTH (sizeof(dma_addr_t) > 4 ? 46 : 92)
-+#define TW_LIBERATOR_MAX_SGL_LENGTH_OLD (sizeof(dma_addr_t) > 4 ? 47 : 94)
-+#define TW_PADDING_LENGTH_LIBERATOR 136
-+#define TW_PADDING_LENGTH_LIBERATOR_OLD 132
-+#define TW_CPU_TO_SGL(x) (sizeof(dma_addr_t) > 4 ? cpu_to_le64(x) : cpu_to_le32(x))
-+
-+#pragma pack(1)
-+
-+/* SGL entry */
-+typedef struct TAG_TW_SG_Entry_ISO {
-+ dma_addr_t address;
-+ dma_addr_t length;
-+} TW_SG_Entry_ISO;
-+
-+/* Old Command Packet with ISO SGL */
-+typedef struct TW_Command {
-+ unsigned char opcode__sgloffset;
-+ unsigned char size;
-+ unsigned char request_id;
-+ unsigned char unit__hostid;
-+ /* Second DWORD */
-+ unsigned char status;
-+ unsigned char flags;
-+ union {
-+ unsigned short block_count;
-+ unsigned short parameter_count;
-+ } byte6_offset;
-+ union {
-+ struct {
-+ u32 lba;
-+ TW_SG_Entry_ISO sgl[TW_LIBERATOR_MAX_SGL_LENGTH_OLD];
-+ unsigned char padding[TW_PADDING_LENGTH_LIBERATOR_OLD];
-+ } io;
-+ struct {
-+ TW_SG_Entry_ISO sgl[TW_LIBERATOR_MAX_SGL_LENGTH_OLD];
-+ u32 padding;
-+ unsigned char padding2[TW_PADDING_LENGTH_LIBERATOR_OLD];
-+ } param;
-+ } byte8_offset;
-+} TW_Command;
-+
-+/* New Command Packet with ISO SGL */
-+typedef struct TAG_TW_Command_Apache {
-+ unsigned char opcode__reserved;
-+ unsigned char unit;
-+ unsigned short request_id__lunl;
-+ unsigned char status;
-+ unsigned char sgl_offset;
-+ unsigned short sgl_entries__lunh;
-+ unsigned char cdb[16];
-+ TW_SG_Entry_ISO sg_list[TW_LIBERATOR_MAX_SGL_LENGTH];
-+ unsigned char padding[TW_PADDING_LENGTH_LIBERATOR];
-+} TW_Command_Apache;
-+
-+/* New command packet header */
-+typedef struct TAG_TW_Command_Apache_Header {
-+ unsigned char sense_data[TW_SENSE_DATA_LENGTH];
-+ struct {
-+ char reserved[4];
-+ unsigned short error;
-+ unsigned char padding;
-+ unsigned char severity__reserved;
-+ } status_block;
-+ unsigned char err_specific_desc[98];
-+ struct {
-+ unsigned char size_header;
-+ unsigned short request_id;
-+ unsigned char size_sense;
-+ } header_desc;
-+} TW_Command_Apache_Header;
-+
-+/* This struct is a union of the 2 command packets */
-+typedef struct TAG_TW_Command_Full {
-+ TW_Command_Apache_Header header;
-+ union {
-+ TW_Command oldcommand;
-+ TW_Command_Apache newcommand;
-+ } command;
-+} TW_Command_Full;
-+
-+/* Initconnection structure */
-+typedef struct TAG_TW_Initconnect {
-+ unsigned char opcode__reserved;
-+ unsigned char size;
-+ unsigned char request_id;
-+ unsigned char res2;
-+ unsigned char status;
-+ unsigned char flags;
-+ unsigned short message_credits;
-+ u32 features;
-+ unsigned short fw_srl;
-+ unsigned short fw_arch_id;
-+ unsigned short fw_branch;
-+ unsigned short fw_build;
-+ u32 result;
-+} TW_Initconnect;
-+
-+/* Event info structure */
-+typedef struct TAG_TW_Event
-+{
-+ unsigned int sequence_id;
-+ unsigned int time_stamp_sec;
-+ unsigned short aen_code;
-+ unsigned char severity;
-+ unsigned char retrieved;
-+ unsigned char repeat_count;
-+ unsigned char parameter_len;
-+ unsigned char parameter_data[98];
-+} TW_Event;
-+
-+typedef struct TAG_TW_Ioctl_Driver_Command {
-+ unsigned int control_code;
-+ unsigned int status;
-+ unsigned int unique_id;
-+ unsigned int sequence_id;
-+ unsigned int os_specific;
-+ unsigned int buffer_length;
-+} TW_Ioctl_Driver_Command;
-+
-+typedef struct TAG_TW_Ioctl_Apache {
-+ TW_Ioctl_Driver_Command driver_command;
-+ char padding[488];
-+ TW_Command_Full firmware_command;
-+ char data_buffer[1];
-+} TW_Ioctl_Buf_Apache;
-+
-+/* GetParam descriptor */
-+typedef struct {
-+ unsigned short table_id;
-+ unsigned short parameter_id;
-+ unsigned short parameter_size_bytes;
-+ unsigned short actual_parameter_size_bytes;
-+ unsigned char data[1];
-+} TW_Param_Apache;
-+
-+/* Compatibility information structure */
-+typedef struct TAG_TW_Compatibility_Info
-+{
-+ char driver_version[32];
-+ unsigned short working_srl;
-+ unsigned short working_branch;
-+ unsigned short working_build;
-+ unsigned short driver_srl_high;
-+ unsigned short driver_branch_high;
-+ unsigned short driver_build_high;
-+ unsigned short driver_srl_low;
-+ unsigned short driver_branch_low;
-+ unsigned short driver_build_low;
-+ unsigned short fw_on_ctlr_srl;
-+ unsigned short fw_on_ctlr_branch;
-+ unsigned short fw_on_ctlr_build;
-+} TW_Compatibility_Info;
-+
-+#pragma pack()
-+
-+typedef struct TAG_TW_Device_Extension {
-+ void __iomem *base_addr;
-+ unsigned long *generic_buffer_virt[TW_Q_LENGTH];
-+ dma_addr_t generic_buffer_phys[TW_Q_LENGTH];
-+ TW_Command_Full *command_packet_virt[TW_Q_LENGTH];
-+ dma_addr_t command_packet_phys[TW_Q_LENGTH];
-+ TW_Command_Apache_Header *sense_buffer_virt[TW_Q_LENGTH];
-+ dma_addr_t sense_buffer_phys[TW_Q_LENGTH];
-+ struct pci_dev *tw_pci_dev;
-+ struct scsi_cmnd *srb[TW_Q_LENGTH];
-+ unsigned char free_queue[TW_Q_LENGTH];
-+ unsigned char free_head;
-+ unsigned char free_tail;
-+ int state[TW_Q_LENGTH];
-+ unsigned int posted_request_count;
-+ unsigned int max_posted_request_count;
-+ unsigned int max_sgl_entries;
-+ unsigned int sgl_entries;
-+ unsigned int num_resets;
-+ unsigned int sector_count;
-+ unsigned int max_sector_count;
-+ unsigned int aen_count;
-+ struct Scsi_Host *host;
-+ long flags;
-+ TW_Event *event_queue[TW_Q_LENGTH];
-+ unsigned char error_index;
-+ unsigned int error_sequence_id;
-+ int chrdev_request_id;
-+ wait_queue_head_t ioctl_wqueue;
-+ struct mutex ioctl_lock;
-+ TW_Compatibility_Info tw_compat_info;
-+ char online;
-+} TW_Device_Extension;
-+
-+#endif /* _3W_SAS_H */
-+
-diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c
-index 1ddcf40..a85f062 100644
---- a/drivers/scsi/BusLogic.c
-+++ b/drivers/scsi/BusLogic.c
-@@ -961,6 +961,8 @@ static int __init BusLogic_InitializeFlashPointProbeInfo(struct BusLogic_HostAda
- static void __init BusLogic_InitializeProbeInfoList(struct BusLogic_HostAdapter
- *PrototypeHostAdapter)
- {
-+ pax_track_stack();
-+
- /*
- If a PCI BIOS is present, interrogate it for MultiMaster and FlashPoint
- Host Adapters; otherwise, default to the standard ISA MultiMaster probe.
-diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
-index e11cca4..4295679 100644
---- a/drivers/scsi/Kconfig
-+++ b/drivers/scsi/Kconfig
-@@ -399,6 +399,17 @@ config SCSI_3W_9XXX
- Please read the comments at the top of
- <file:drivers/scsi/3w-9xxx.c>.
-
-+config SCSI_3W_SAS
-+ tristate "3ware 97xx SAS/SATA-RAID support"
-+ depends on PCI && SCSI
-+ help
-+ This driver supports the LSI 3ware 9750 6Gb/s SAS/SATA-RAID cards.
-+
-+ <http://www.lsi.com>
-+
-+ Please read the comments at the top of
-+ <file:drivers/scsi/3w-sas.c>.
-+
- config SCSI_7000FASST
- tristate "7000FASST SCSI support"
- depends on ISA && SCSI && ISA_DMA_API
-@@ -621,6 +632,14 @@ config SCSI_FLASHPOINT
- substantial, so users of MultiMaster Host Adapters may not
- wish to include it.
-
-+config VMWARE_PVSCSI
-+ tristate "VMware PVSCSI driver support"
-+ depends on PCI && SCSI && X86
-+ help
-+ This driver supports VMware's para virtualized SCSI HBA.
-+ To compile this driver as a module, choose M here: the
-+ module will be called vmw_pvscsi.
-+
- config LIBFC
- tristate "LibFC module"
- select SCSI_FC_ATTRS
-diff --git a/drivers/scsi/Makefile b/drivers/scsi/Makefile
-index 3ad61db..c938975 100644
---- a/drivers/scsi/Makefile
-+++ b/drivers/scsi/Makefile
-@@ -113,6 +113,7 @@ obj-$(CONFIG_SCSI_MESH) += mesh.o
- obj-$(CONFIG_SCSI_MAC53C94) += mac53c94.o
- obj-$(CONFIG_BLK_DEV_3W_XXXX_RAID) += 3w-xxxx.o
- obj-$(CONFIG_SCSI_3W_9XXX) += 3w-9xxx.o
-+obj-$(CONFIG_SCSI_3W_SAS) += 3w-sas.o
- obj-$(CONFIG_SCSI_PPA) += ppa.o
- obj-$(CONFIG_SCSI_IMM) += imm.o
- obj-$(CONFIG_JAZZ_ESP) += esp_scsi.o jazz_esp.o
-@@ -133,6 +134,7 @@ obj-$(CONFIG_SCSI_CXGB3_ISCSI) += libiscsi.o libiscsi_tcp.o cxgb3i/
- obj-$(CONFIG_SCSI_BNX2_ISCSI) += libiscsi.o bnx2i/
- obj-$(CONFIG_BE2ISCSI) += libiscsi.o be2iscsi/
- obj-$(CONFIG_SCSI_PMCRAID) += pmcraid.o
-+obj-$(CONFIG_VMWARE_PVSCSI) += vmw_pvscsi.o
-
- obj-$(CONFIG_ARM) += arm/
-
-diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c
-index a5b8e7b..ec62be5 100644
---- a/drivers/scsi/aacraid/commctrl.c
-+++ b/drivers/scsi/aacraid/commctrl.c
-@@ -481,6 +481,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
- u32 actual_fibsize64, actual_fibsize = 0;
- int i;
-
-+ pax_track_stack();
-
- if (dev->in_reset) {
- dprintk((KERN_DEBUG"aacraid: send raw srb -EBUSY\n"));
-@@ -507,7 +508,8 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
- goto cleanup;
- }
-
-- if (fibsize > (dev->max_fib_size - sizeof(struct aac_fibhdr))) {
-+ if ((fibsize < (sizeof(struct user_aac_srb) - sizeof(struct user_sgentry))) ||
-+ (fibsize > (dev->max_fib_size - sizeof(struct aac_fibhdr)))) {
- rcode = -EINVAL;
- goto cleanup;
- }
-diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
-index 9b97c3e..f099725 100644
---- a/drivers/scsi/aacraid/linit.c
-+++ b/drivers/scsi/aacraid/linit.c
-@@ -91,7 +91,7 @@ static DECLARE_PCI_DEVICE_TABLE(aac_pci_tbl) = {
- #elif defined(__devinitconst)
- static const struct pci_device_id aac_pci_tbl[] __devinitconst = {
- #else
--static const struct pci_device_id aac_pci_tbl[] __devinitdata = {
-+static const struct pci_device_id aac_pci_tbl[] __devinitconst = {
- #endif
- { 0x1028, 0x0001, 0x1028, 0x0001, 0, 0, 0 }, /* PERC 2/Si (Iguana/PERC2Si) */
- { 0x1028, 0x0002, 0x1028, 0x0002, 0, 0, 1 }, /* PERC 3/Di (Opal/PERC3Di) */
-diff --git a/drivers/scsi/aic94xx/aic94xx_init.c b/drivers/scsi/aic94xx/aic94xx_init.c
-index 996f722..9127845 100644
---- a/drivers/scsi/aic94xx/aic94xx_init.c
-+++ b/drivers/scsi/aic94xx/aic94xx_init.c
-@@ -485,7 +485,7 @@ static ssize_t asd_show_update_bios(struct device *dev,
- flash_error_table[i].reason);
- }
-
--static DEVICE_ATTR(update_bios, S_IRUGO|S_IWUGO,
-+static DEVICE_ATTR(update_bios, S_IRUGO|S_IWUSR,
- asd_show_update_bios, asd_store_update_bios);
-
- static int asd_create_dev_attrs(struct asd_ha_struct *asd_ha)
-@@ -1011,7 +1011,7 @@ static struct sas_domain_function_template aic94xx_transport_functions = {
- .lldd_control_phy = asd_control_phy,
- };
-
--static const struct pci_device_id aic94xx_pci_table[] __devinitdata = {
-+static const struct pci_device_id aic94xx_pci_table[] __devinitconst = {
- {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, 0x410),0, 0, 1},
- {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, 0x412),0, 0, 1},
- {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, 0x416),0, 0, 1},
-diff --git a/drivers/scsi/bfa/bfa_ioc.h b/drivers/scsi/bfa/bfa_ioc.h
-index 58efd4b..cb48dc7 100644
---- a/drivers/scsi/bfa/bfa_ioc.h
-+++ b/drivers/scsi/bfa/bfa_ioc.h
-@@ -127,7 +127,7 @@ struct bfa_ioc_cbfn_s {
- bfa_ioc_disable_cbfn_t disable_cbfn;
- bfa_ioc_hbfail_cbfn_t hbfail_cbfn;
- bfa_ioc_reset_cbfn_t reset_cbfn;
--};
-+} __no_const;
-
- /**
- * Heartbeat failure notification queue element.
-diff --git a/drivers/scsi/bfa/bfa_iocfc.h b/drivers/scsi/bfa/bfa_iocfc.h
-index 7ad177e..5503586 100644
---- a/drivers/scsi/bfa/bfa_iocfc.h
-+++ b/drivers/scsi/bfa/bfa_iocfc.h
-@@ -61,7 +61,7 @@ struct bfa_hwif_s {
- void (*hw_isr_mode_set)(struct bfa_s *bfa, bfa_boolean_t msix);
- void (*hw_msix_getvecs)(struct bfa_s *bfa, u32 *vecmap,
- u32 *nvecs, u32 *maxvec);
--};
-+} __no_const;
- typedef void (*bfa_cb_iocfc_t) (void *cbarg, enum bfa_status status);
-
- struct bfa_iocfc_s {
-diff --git a/drivers/scsi/dc395x.c b/drivers/scsi/dc395x.c
-index 075e239..85a1eaf 100644
---- a/drivers/scsi/dc395x.c
-+++ b/drivers/scsi/dc395x.c
-@@ -3746,13 +3746,13 @@ static struct DeviceCtlBlk *device_alloc(struct AdapterCtlBlk *acb,
- dcb->max_command = 1;
- dcb->target_id = target;
- dcb->target_lun = lun;
-+ dcb->dev_mode = eeprom->target[target].cfg0;
- #ifndef DC395x_NO_DISCONNECT
- dcb->identify_msg =
- IDENTIFY(dcb->dev_mode & NTC_DO_DISCONNECT, lun);
- #else
- dcb->identify_msg = IDENTIFY(0, lun);
- #endif
-- dcb->dev_mode = eeprom->target[target].cfg0;
- dcb->inquiry7 = 0;
- dcb->sync_mode = 0;
- dcb->min_nego_period = clock_period[period_index];
-diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c
-index 4967643..cbec06b 100644
---- a/drivers/scsi/dpt_i2o.c
-+++ b/drivers/scsi/dpt_i2o.c
-@@ -1804,6 +1804,8 @@ static int adpt_i2o_passthru(adpt_hba* pHba, u32 __user *arg)
- dma_addr_t addr;
- ulong flags = 0;
-
-+ pax_track_stack();
-+
- memset(&msg, 0, MAX_MESSAGE_SIZE*4);
- // get user msg size in u32s
- if(get_user(size, &user_msg[0])){
-@@ -2297,6 +2299,8 @@ static s32 adpt_scsi_to_i2o(adpt_hba* pHba, struct scsi_cmnd* cmd, struct adpt_d
- s32 rcode;
- dma_addr_t addr;
-
-+ pax_track_stack();
-+
- memset(msg, 0 , sizeof(msg));
- len = scsi_bufflen(cmd);
- direction = 0x00000000;
-diff --git a/drivers/scsi/eata.c b/drivers/scsi/eata.c
-index c7076ce..e20c67c 100644
---- a/drivers/scsi/eata.c
-+++ b/drivers/scsi/eata.c
-@@ -1087,6 +1087,8 @@ static int port_detect(unsigned long port_base, unsigned int j,
- struct hostdata *ha;
- char name[16];
-
-+ pax_track_stack();
-+
- sprintf(name, "%s%d", driver_name, j);
-
- if (!request_region(port_base, REGION_SIZE, driver_name)) {
-diff --git a/drivers/scsi/fcoe/libfcoe.c b/drivers/scsi/fcoe/libfcoe.c
-index 11ae5c9..891daec 100644
---- a/drivers/scsi/fcoe/libfcoe.c
-+++ b/drivers/scsi/fcoe/libfcoe.c
-@@ -809,6 +809,8 @@ static void fcoe_ctlr_recv_els(struct fcoe_ctlr *fip, struct sk_buff *skb)
- size_t rlen;
- size_t dlen;
-
-+ pax_track_stack();
-+
- fiph = (struct fip_header *)skb->data;
- sub = fiph->fip_subcode;
- if (sub != FIP_SC_REQ && sub != FIP_SC_REP)
-diff --git a/drivers/scsi/fnic/fnic_main.c b/drivers/scsi/fnic/fnic_main.c
-index 71c7bbe..e93088a 100644
---- a/drivers/scsi/fnic/fnic_main.c
-+++ b/drivers/scsi/fnic/fnic_main.c
-@@ -669,7 +669,7 @@ static int __devinit fnic_probe(struct pci_dev *pdev,
- /* Start local port initiatialization */
-
- lp->link_up = 0;
-- lp->tt = fnic_transport_template;
-+ memcpy((void *)&lp->tt, &fnic_transport_template, sizeof(fnic_transport_template));
-
- lp->max_retry_count = fnic->config.flogi_retries;
- lp->max_rport_retry_count = fnic->config.plogi_retries;
-diff --git a/drivers/scsi/gdth.c b/drivers/scsi/gdth.c
-index bb96d74..9ec3ce4 100644
---- a/drivers/scsi/gdth.c
-+++ b/drivers/scsi/gdth.c
-@@ -4102,6 +4102,8 @@ static int ioc_lockdrv(void __user *arg)
- ulong flags;
- gdth_ha_str *ha;
-
-+ pax_track_stack();
-+
- if (copy_from_user(&ldrv, arg, sizeof(gdth_ioctl_lockdrv)))
- return -EFAULT;
- ha = gdth_find_ha(ldrv.ionode);
-@@ -4134,6 +4136,8 @@ static int ioc_resetdrv(void __user *arg, char *cmnd)
- gdth_ha_str *ha;
- int rval;
-
-+ pax_track_stack();
-+
- if (copy_from_user(&res, arg, sizeof(gdth_ioctl_reset)) ||
- res.number >= MAX_HDRIVES)
- return -EFAULT;
-@@ -4169,6 +4173,8 @@ static int ioc_general(void __user *arg, char *cmnd)
- gdth_ha_str *ha;
- int rval;
-
-+ pax_track_stack();
-+
- if (copy_from_user(&gen, arg, sizeof(gdth_ioctl_general)))
- return -EFAULT;
- ha = gdth_find_ha(gen.ionode);
-@@ -4625,6 +4631,9 @@ static void gdth_flush(gdth_ha_str *ha)
- int i;
- gdth_cmd_str gdtcmd;
- char cmnd[MAX_COMMAND_SIZE];
-+
-+ pax_track_stack();
-+
- memset(cmnd, 0xff, MAX_COMMAND_SIZE);
-
- TRACE2(("gdth_flush() hanum %d\n", ha->hanum));
-diff --git a/drivers/scsi/gdth_proc.c b/drivers/scsi/gdth_proc.c
-index 1258da3..20d8ae6 100644
---- a/drivers/scsi/gdth_proc.c
-+++ b/drivers/scsi/gdth_proc.c
-@@ -46,6 +46,9 @@ static int gdth_set_asc_info(struct Scsi_Host *host, char *buffer,
- ulong64 paddr;
-
- char cmnd[MAX_COMMAND_SIZE];
-+
-+ pax_track_stack();
-+
- memset(cmnd, 0xff, 12);
- memset(&gdtcmd, 0, sizeof(gdth_cmd_str));
-
-@@ -174,6 +177,8 @@ static int gdth_get_info(char *buffer,char **start,off_t offset,int length,
- gdth_hget_str *phg;
- char cmnd[MAX_COMMAND_SIZE];
-
-+ pax_track_stack();
-+
- gdtcmd = kmalloc(sizeof(*gdtcmd), GFP_KERNEL);
- estr = kmalloc(sizeof(*estr), GFP_KERNEL);
- if (!gdtcmd || !estr)
-diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
-index d03a926..f324286 100644
---- a/drivers/scsi/hosts.c
-+++ b/drivers/scsi/hosts.c
-@@ -40,7 +40,7 @@
- #include "scsi_logging.h"
-
-
--static atomic_t scsi_host_next_hn; /* host_no for next new host */
-+static atomic_unchecked_t scsi_host_next_hn; /* host_no for next new host */
-
-
- static void scsi_host_cls_release(struct device *dev)
-@@ -347,7 +347,7 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize)
- * subtract one because we increment first then return, but we need to
- * know what the next host number was before increment
- */
-- shost->host_no = atomic_inc_return(&scsi_host_next_hn) - 1;
-+ shost->host_no = atomic_inc_return_unchecked(&scsi_host_next_hn) - 1;
- shost->dma_channel = 0xff;
-
- /* These three are default values which can be overridden */
-diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
-index a601159..55e19d2 100644
---- a/drivers/scsi/ipr.c
-+++ b/drivers/scsi/ipr.c
-@@ -5286,7 +5286,7 @@ static bool ipr_qc_fill_rtf(struct ata_queued_cmd *qc)
- return true;
- }
-
--static struct ata_port_operations ipr_sata_ops = {
-+static const struct ata_port_operations ipr_sata_ops = {
- .phy_reset = ipr_ata_phy_reset,
- .hardreset = ipr_sata_reset,
- .post_internal_cmd = ipr_ata_post_internal,
-diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c
-index c1c1574..a9c9348 100644
---- a/drivers/scsi/libfc/fc_exch.c
-+++ b/drivers/scsi/libfc/fc_exch.c
-@@ -86,12 +86,12 @@ struct fc_exch_mgr {
- * all together if not used XXX
- */
- struct {
-- atomic_t no_free_exch;
-- atomic_t no_free_exch_xid;
-- atomic_t xid_not_found;
-- atomic_t xid_busy;
-- atomic_t seq_not_found;
-- atomic_t non_bls_resp;
-+ atomic_unchecked_t no_free_exch;
-+ atomic_unchecked_t no_free_exch_xid;
-+ atomic_unchecked_t xid_not_found;
-+ atomic_unchecked_t xid_busy;
-+ atomic_unchecked_t seq_not_found;
-+ atomic_unchecked_t non_bls_resp;
- } stats;
- };
- #define fc_seq_exch(sp) container_of(sp, struct fc_exch, seq)
-@@ -510,7 +510,7 @@ static struct fc_exch *fc_exch_em_alloc(struct fc_lport *lport,
- /* allocate memory for exchange */
- ep = mempool_alloc(mp->ep_pool, GFP_ATOMIC);
- if (!ep) {
-- atomic_inc(&mp->stats.no_free_exch);
-+ atomic_inc_unchecked(&mp->stats.no_free_exch);
- goto out;
- }
- memset(ep, 0, sizeof(*ep));
-@@ -557,7 +557,7 @@ out:
- return ep;
- err:
- spin_unlock_bh(&pool->lock);
-- atomic_inc(&mp->stats.no_free_exch_xid);
-+ atomic_inc_unchecked(&mp->stats.no_free_exch_xid);
- mempool_free(ep, mp->ep_pool);
- return NULL;
- }
-@@ -690,7 +690,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
- xid = ntohs(fh->fh_ox_id); /* we originated exch */
- ep = fc_exch_find(mp, xid);
- if (!ep) {
-- atomic_inc(&mp->stats.xid_not_found);
-+ atomic_inc_unchecked(&mp->stats.xid_not_found);
- reject = FC_RJT_OX_ID;
- goto out;
- }
-@@ -720,7 +720,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
- ep = fc_exch_find(mp, xid);
- if ((f_ctl & FC_FC_FIRST_SEQ) && fc_sof_is_init(fr_sof(fp))) {
- if (ep) {
-- atomic_inc(&mp->stats.xid_busy);
-+ atomic_inc_unchecked(&mp->stats.xid_busy);
- reject = FC_RJT_RX_ID;
- goto rel;
- }
-@@ -731,7 +731,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
- }
- xid = ep->xid; /* get our XID */
- } else if (!ep) {
-- atomic_inc(&mp->stats.xid_not_found);
-+ atomic_inc_unchecked(&mp->stats.xid_not_found);
- reject = FC_RJT_RX_ID; /* XID not found */
- goto out;
- }
-@@ -752,7 +752,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
- } else {
- sp = &ep->seq;
- if (sp->id != fh->fh_seq_id) {
-- atomic_inc(&mp->stats.seq_not_found);
-+ atomic_inc_unchecked(&mp->stats.seq_not_found);
- reject = FC_RJT_SEQ_ID; /* sequence/exch should exist */
- goto rel;
- }
-@@ -1163,22 +1163,22 @@ static void fc_exch_recv_seq_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
-
- ep = fc_exch_find(mp, ntohs(fh->fh_ox_id));
- if (!ep) {
-- atomic_inc(&mp->stats.xid_not_found);
-+ atomic_inc_unchecked(&mp->stats.xid_not_found);
- goto out;
- }
- if (ep->esb_stat & ESB_ST_COMPLETE) {
-- atomic_inc(&mp->stats.xid_not_found);
-+ atomic_inc_unchecked(&mp->stats.xid_not_found);
- goto out;
- }
- if (ep->rxid == FC_XID_UNKNOWN)
- ep->rxid = ntohs(fh->fh_rx_id);
- if (ep->sid != 0 && ep->sid != ntoh24(fh->fh_d_id)) {
-- atomic_inc(&mp->stats.xid_not_found);
-+ atomic_inc_unchecked(&mp->stats.xid_not_found);
- goto rel;
- }
- if (ep->did != ntoh24(fh->fh_s_id) &&
- ep->did != FC_FID_FLOGI) {
-- atomic_inc(&mp->stats.xid_not_found);
-+ atomic_inc_unchecked(&mp->stats.xid_not_found);
- goto rel;
- }
- sof = fr_sof(fp);
-@@ -1189,7 +1189,7 @@ static void fc_exch_recv_seq_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
- } else {
- sp = &ep->seq;
- if (sp->id != fh->fh_seq_id) {
-- atomic_inc(&mp->stats.seq_not_found);
-+ atomic_inc_unchecked(&mp->stats.seq_not_found);
- goto rel;
- }
- }
-@@ -1249,9 +1249,9 @@ static void fc_exch_recv_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
- sp = fc_seq_lookup_orig(mp, fp); /* doesn't hold sequence */
-
- if (!sp)
-- atomic_inc(&mp->stats.xid_not_found);
-+ atomic_inc_unchecked(&mp->stats.xid_not_found);
- else
-- atomic_inc(&mp->stats.non_bls_resp);
-+ atomic_inc_unchecked(&mp->stats.non_bls_resp);
-
- fc_frame_free(fp);
- }
-diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
-index 0ee989f..a582241 100644
---- a/drivers/scsi/libsas/sas_ata.c
-+++ b/drivers/scsi/libsas/sas_ata.c
-@@ -343,7 +343,7 @@ static int sas_ata_scr_read(struct ata_link *link, unsigned int sc_reg_in,
- }
- }
-
--static struct ata_port_operations sas_sata_ops = {
-+static const struct ata_port_operations sas_sata_ops = {
- .phy_reset = sas_ata_phy_reset,
- .post_internal_cmd = sas_ata_post_internal,
- .qc_defer = ata_std_qc_defer,
-diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
-index aa10f79..5cc79e4 100644
---- a/drivers/scsi/lpfc/lpfc.h
-+++ b/drivers/scsi/lpfc/lpfc.h
-@@ -400,7 +400,7 @@ struct lpfc_vport {
- struct dentry *debug_nodelist;
- struct dentry *vport_debugfs_root;
- struct lpfc_debugfs_trc *disc_trc;
-- atomic_t disc_trc_cnt;
-+ atomic_unchecked_t disc_trc_cnt;
- #endif
- uint8_t stat_data_enabled;
- uint8_t stat_data_blocked;
-@@ -725,8 +725,8 @@ struct lpfc_hba {
- struct timer_list fabric_block_timer;
- unsigned long bit_flags;
- #define FABRIC_COMANDS_BLOCKED 0
-- atomic_t num_rsrc_err;
-- atomic_t num_cmd_success;
-+ atomic_unchecked_t num_rsrc_err;
-+ atomic_unchecked_t num_cmd_success;
- unsigned long last_rsrc_error_time;
- unsigned long last_ramp_down_time;
- unsigned long last_ramp_up_time;
-@@ -740,7 +740,7 @@ struct lpfc_hba {
- struct dentry *debug_dumpDif; /* BlockGuard BPL*/
- struct dentry *debug_slow_ring_trc;
- struct lpfc_debugfs_trc *slow_ring_trc;
-- atomic_t slow_ring_trc_cnt;
-+ atomic_unchecked_t slow_ring_trc_cnt;
- #endif
-
- /* Used for deferred freeing of ELS data buffers */
-diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
-index 8d0f0de..e679b1e 100644
---- a/drivers/scsi/lpfc/lpfc_debugfs.c
-+++ b/drivers/scsi/lpfc/lpfc_debugfs.c
-@@ -124,7 +124,7 @@ struct lpfc_debug {
- int len;
- };
-
--static atomic_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
-+static atomic_unchecked_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
- static unsigned long lpfc_debugfs_start_time = 0L;
-
- /**
-@@ -158,7 +158,7 @@ lpfc_debugfs_disc_trc_data(struct lpfc_vport *vport, char *buf, int size)
- lpfc_debugfs_enable = 0;
-
- len = 0;
-- index = (atomic_read(&vport->disc_trc_cnt) + 1) &
-+ index = (atomic_read_unchecked(&vport->disc_trc_cnt) + 1) &
- (lpfc_debugfs_max_disc_trc - 1);
- for (i = index; i < lpfc_debugfs_max_disc_trc; i++) {
- dtp = vport->disc_trc + i;
-@@ -219,7 +219,7 @@ lpfc_debugfs_slow_ring_trc_data(struct lpfc_hba *phba, char *buf, int size)
- lpfc_debugfs_enable = 0;
-
- len = 0;
-- index = (atomic_read(&phba->slow_ring_trc_cnt) + 1) &
-+ index = (atomic_read_unchecked(&phba->slow_ring_trc_cnt) + 1) &
- (lpfc_debugfs_max_slow_ring_trc - 1);
- for (i = index; i < lpfc_debugfs_max_slow_ring_trc; i++) {
- dtp = phba->slow_ring_trc + i;
-@@ -397,6 +397,8 @@ lpfc_debugfs_dumpHBASlim_data(struct lpfc_hba *phba, char *buf, int size)
- uint32_t *ptr;
- char buffer[1024];
-
-+ pax_track_stack();
-+
- off = 0;
- spin_lock_irq(&phba->hbalock);
-
-@@ -634,14 +636,14 @@ lpfc_debugfs_disc_trc(struct lpfc_vport *vport, int mask, char *fmt,
- !vport || !vport->disc_trc)
- return;
-
-- index = atomic_inc_return(&vport->disc_trc_cnt) &
-+ index = atomic_inc_return_unchecked(&vport->disc_trc_cnt) &
- (lpfc_debugfs_max_disc_trc - 1);
- dtp = vport->disc_trc + index;
- dtp->fmt = fmt;
- dtp->data1 = data1;
- dtp->data2 = data2;
- dtp->data3 = data3;
-- dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
-+ dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
- dtp->jif = jiffies;
- #endif
- return;
-@@ -672,14 +674,14 @@ lpfc_debugfs_slow_ring_trc(struct lpfc_hba *phba, char *fmt,
- !phba || !phba->slow_ring_trc)
- return;
-
-- index = atomic_inc_return(&phba->slow_ring_trc_cnt) &
-+ index = atomic_inc_return_unchecked(&phba->slow_ring_trc_cnt) &
- (lpfc_debugfs_max_slow_ring_trc - 1);
- dtp = phba->slow_ring_trc + index;
- dtp->fmt = fmt;
- dtp->data1 = data1;
- dtp->data2 = data2;
- dtp->data3 = data3;
-- dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
-+ dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
- dtp->jif = jiffies;
- #endif
- return;
-@@ -1072,7 +1074,7 @@ lpfc_debugfs_lseek(struct file *file, loff_t off, int whence)
- pos = file->f_pos + off;
- break;
- case 2:
-- pos = debug->len - off;
-+ pos = debug->len + off;
- }
- return (pos < 0 || pos > debug->len) ? -EINVAL : (file->f_pos = pos);
- }
-@@ -1364,7 +1366,7 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport)
- "slow_ring buffer\n");
- goto debug_failed;
- }
-- atomic_set(&phba->slow_ring_trc_cnt, 0);
-+ atomic_set_unchecked(&phba->slow_ring_trc_cnt, 0);
- memset(phba->slow_ring_trc, 0,
- (sizeof(struct lpfc_debugfs_trc) *
- lpfc_debugfs_max_slow_ring_trc));
-@@ -1410,7 +1412,7 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport)
- "buffer\n");
- goto debug_failed;
- }
-- atomic_set(&vport->disc_trc_cnt, 0);
-+ atomic_set_unchecked(&vport->disc_trc_cnt, 0);
-
- snprintf(name, sizeof(name), "discovery_trace");
- vport->debug_disc_trc =
-diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
-index 549bc7d..8189dbb 100644
---- a/drivers/scsi/lpfc/lpfc_init.c
-+++ b/drivers/scsi/lpfc/lpfc_init.c
-@@ -8021,8 +8021,10 @@ lpfc_init(void)
- printk(LPFC_COPYRIGHT "\n");
-
- if (lpfc_enable_npiv) {
-- lpfc_transport_functions.vport_create = lpfc_vport_create;
-- lpfc_transport_functions.vport_delete = lpfc_vport_delete;
-+ pax_open_kernel();
-+ *(void **)&lpfc_transport_functions.vport_create = lpfc_vport_create;
-+ *(void **)&lpfc_transport_functions.vport_delete = lpfc_vport_delete;
-+ pax_close_kernel();
- }
- lpfc_transport_template =
- fc_attach_transport(&lpfc_transport_functions);
-diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
-index c88f59f..ff2a42f 100644
---- a/drivers/scsi/lpfc/lpfc_scsi.c
-+++ b/drivers/scsi/lpfc/lpfc_scsi.c
-@@ -259,7 +259,7 @@ lpfc_rampdown_queue_depth(struct lpfc_hba *phba)
- uint32_t evt_posted;
-
- spin_lock_irqsave(&phba->hbalock, flags);
-- atomic_inc(&phba->num_rsrc_err);
-+ atomic_inc_unchecked(&phba->num_rsrc_err);
- phba->last_rsrc_error_time = jiffies;
-
- if ((phba->last_ramp_down_time + QUEUE_RAMP_DOWN_INTERVAL) > jiffies) {
-@@ -300,7 +300,7 @@ lpfc_rampup_queue_depth(struct lpfc_vport *vport,
- unsigned long flags;
- struct lpfc_hba *phba = vport->phba;
- uint32_t evt_posted;
-- atomic_inc(&phba->num_cmd_success);
-+ atomic_inc_unchecked(&phba->num_cmd_success);
-
- if (vport->cfg_lun_queue_depth <= queue_depth)
- return;
-@@ -343,8 +343,8 @@ lpfc_ramp_down_queue_handler(struct lpfc_hba *phba)
- int i;
- struct lpfc_rport_data *rdata;
-
-- num_rsrc_err = atomic_read(&phba->num_rsrc_err);
-- num_cmd_success = atomic_read(&phba->num_cmd_success);
-+ num_rsrc_err = atomic_read_unchecked(&phba->num_rsrc_err);
-+ num_cmd_success = atomic_read_unchecked(&phba->num_cmd_success);
-
- vports = lpfc_create_vport_work_array(phba);
- if (vports != NULL)
-@@ -378,8 +378,8 @@ lpfc_ramp_down_queue_handler(struct lpfc_hba *phba)
- }
- }
- lpfc_destroy_vport_work_array(phba, vports);
-- atomic_set(&phba->num_rsrc_err, 0);
-- atomic_set(&phba->num_cmd_success, 0);
-+ atomic_set_unchecked(&phba->num_rsrc_err, 0);
-+ atomic_set_unchecked(&phba->num_cmd_success, 0);
- }
-
- /**
-@@ -427,8 +427,8 @@ lpfc_ramp_up_queue_handler(struct lpfc_hba *phba)
- }
- }
- lpfc_destroy_vport_work_array(phba, vports);
-- atomic_set(&phba->num_rsrc_err, 0);
-- atomic_set(&phba->num_cmd_success, 0);
-+ atomic_set_unchecked(&phba->num_rsrc_err, 0);
-+ atomic_set_unchecked(&phba->num_cmd_success, 0);
- }
-
- /**
-diff --git a/drivers/scsi/megaraid/megaraid_mbox.c b/drivers/scsi/megaraid/megaraid_mbox.c
-index 234f0b7..3020aea 100644
---- a/drivers/scsi/megaraid/megaraid_mbox.c
-+++ b/drivers/scsi/megaraid/megaraid_mbox.c
-@@ -3503,6 +3503,8 @@ megaraid_cmm_register(adapter_t *adapter)
- int rval;
- int i;
-
-+ pax_track_stack();
-+
- // Allocate memory for the base list of scb for management module.
- adapter->uscb_list = kcalloc(MBOX_MAX_USER_CMDS, sizeof(scb_t), GFP_KERNEL);
-
-diff --git a/drivers/scsi/osd/osd_initiator.c b/drivers/scsi/osd/osd_initiator.c
-index 7a117c1..ee01e9e 100644
---- a/drivers/scsi/osd/osd_initiator.c
-+++ b/drivers/scsi/osd/osd_initiator.c
-@@ -94,6 +94,8 @@ static int _osd_print_system_info(struct osd_dev *od, void *caps)
- int nelem = ARRAY_SIZE(get_attrs), a = 0;
- int ret;
-
-+ pax_track_stack();
-+
- or = osd_start_request(od, GFP_KERNEL);
- if (!or)
- return -ENOMEM;
-diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
-index 9ab8c86..9425ad3 100644
---- a/drivers/scsi/pmcraid.c
-+++ b/drivers/scsi/pmcraid.c
-@@ -189,8 +189,8 @@ static int pmcraid_slave_alloc(struct scsi_device *scsi_dev)
- res->scsi_dev = scsi_dev;
- scsi_dev->hostdata = res;
- res->change_detected = 0;
-- atomic_set(&res->read_failures, 0);
-- atomic_set(&res->write_failures, 0);
-+ atomic_set_unchecked(&res->read_failures, 0);
-+ atomic_set_unchecked(&res->write_failures, 0);
- rc = 0;
- }
- spin_unlock_irqrestore(&pinstance->resource_lock, lock_flags);
-@@ -2396,9 +2396,9 @@ static int pmcraid_error_handler(struct pmcraid_cmd *cmd)
-
- /* If this was a SCSI read/write command keep count of errors */
- if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_READ_CMD)
-- atomic_inc(&res->read_failures);
-+ atomic_inc_unchecked(&res->read_failures);
- else if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_WRITE_CMD)
-- atomic_inc(&res->write_failures);
-+ atomic_inc_unchecked(&res->write_failures);
-
- if (!RES_IS_GSCSI(res->cfg_entry) &&
- masked_ioasc != PMCRAID_IOASC_HW_DEVICE_BUS_STATUS_ERROR) {
-@@ -4116,7 +4116,7 @@ static void pmcraid_worker_function(struct work_struct *workp)
-
- pinstance = container_of(workp, struct pmcraid_instance, worker_q);
- /* add resources only after host is added into system */
-- if (!atomic_read(&pinstance->expose_resources))
-+ if (!atomic_read_unchecked(&pinstance->expose_resources))
- return;
-
- spin_lock_irqsave(&pinstance->resource_lock, lock_flags);
-@@ -4850,7 +4850,7 @@ static int __devinit pmcraid_init_instance(
- init_waitqueue_head(&pinstance->reset_wait_q);
-
- atomic_set(&pinstance->outstanding_cmds, 0);
-- atomic_set(&pinstance->expose_resources, 0);
-+ atomic_set_unchecked(&pinstance->expose_resources, 0);
-
- INIT_LIST_HEAD(&pinstance->free_res_q);
- INIT_LIST_HEAD(&pinstance->used_res_q);
-@@ -5502,7 +5502,7 @@ static int __devinit pmcraid_probe(
- /* Schedule worker thread to handle CCN and take care of adding and
- * removing devices to OS
- */
-- atomic_set(&pinstance->expose_resources, 1);
-+ atomic_set_unchecked(&pinstance->expose_resources, 1);
- schedule_work(&pinstance->worker_q);
- return rc;
-
-diff --git a/drivers/scsi/pmcraid.h b/drivers/scsi/pmcraid.h
-index 3441b3f..6cbe8f7 100644
---- a/drivers/scsi/pmcraid.h
-+++ b/drivers/scsi/pmcraid.h
-@@ -690,7 +690,7 @@ struct pmcraid_instance {
- atomic_t outstanding_cmds;
-
- /* should add/delete resources to mid-layer now ?*/
-- atomic_t expose_resources;
-+ atomic_unchecked_t expose_resources;
-
- /* Tasklet to handle deferred processing */
- struct tasklet_struct isr_tasklet[PMCRAID_NUM_MSIX_VECTORS];
-@@ -727,8 +727,8 @@ struct pmcraid_resource_entry {
- struct list_head queue; /* link to "to be exposed" resources */
- struct pmcraid_config_table_entry cfg_entry;
- struct scsi_device *scsi_dev; /* Link scsi_device structure */
-- atomic_t read_failures; /* count of failed READ commands */
-- atomic_t write_failures; /* count of failed WRITE commands */
-+ atomic_unchecked_t read_failures; /* count of failed READ commands */
-+ atomic_unchecked_t write_failures; /* count of failed WRITE commands */
-
- /* To indicate add/delete/modify during CCN */
- u8 change_detected;
-diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
-index 06bbe0d..4b5dc65 100644
---- a/drivers/scsi/qla2xxx/qla_os.c
-+++ b/drivers/scsi/qla2xxx/qla_os.c
-@@ -1274,8 +1274,10 @@ qla2x00_config_dma_addressing(struct qla_hw_data *ha)
- !pci_set_consistent_dma_mask(ha->pdev, DMA_BIT_MASK(64))) {
- /* Ok, a 64bit DMA mask is applicable. */
- ha->flags.enable_64bit_addressing = 1;
-- ha->isp_ops->calc_req_entries = qla2x00_calc_iocbs_64;
-- ha->isp_ops->build_iocbs = qla2x00_build_scsi_iocbs_64;
-+ pax_open_kernel();
-+ *(void **)&ha->isp_ops->calc_req_entries = qla2x00_calc_iocbs_64;
-+ *(void **)&ha->isp_ops->build_iocbs = qla2x00_build_scsi_iocbs_64;
-+ pax_close_kernel();
- return;
- }
- }
-diff --git a/drivers/scsi/qla4xxx/ql4_def.h b/drivers/scsi/qla4xxx/ql4_def.h
-index 81b5f29..2ae1fad 100644
---- a/drivers/scsi/qla4xxx/ql4_def.h
-+++ b/drivers/scsi/qla4xxx/ql4_def.h
-@@ -240,7 +240,7 @@ struct ddb_entry {
- atomic_t retry_relogin_timer; /* Min Time between relogins
- * (4000 only) */
- atomic_t relogin_timer; /* Max Time to wait for relogin to complete */
-- atomic_t relogin_retry_count; /* Num of times relogin has been
-+ atomic_unchecked_t relogin_retry_count; /* Num of times relogin has been
- * retried */
-
- uint16_t port;
-diff --git a/drivers/scsi/qla4xxx/ql4_init.c b/drivers/scsi/qla4xxx/ql4_init.c
-index af8c323..515dd51 100644
---- a/drivers/scsi/qla4xxx/ql4_init.c
-+++ b/drivers/scsi/qla4xxx/ql4_init.c
-@@ -482,7 +482,7 @@ static struct ddb_entry * qla4xxx_alloc_ddb(struct scsi_qla_host *ha,
- atomic_set(&ddb_entry->port_down_timer, ha->port_down_retry_count);
- atomic_set(&ddb_entry->retry_relogin_timer, INVALID_ENTRY);
- atomic_set(&ddb_entry->relogin_timer, 0);
-- atomic_set(&ddb_entry->relogin_retry_count, 0);
-+ atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
- atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
- list_add_tail(&ddb_entry->list, &ha->ddb_list);
- ha->fw_ddb_index_map[fw_ddb_index] = ddb_entry;
-@@ -1308,7 +1308,7 @@ int qla4xxx_process_ddb_changed(struct scsi_qla_host *ha,
- atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
- atomic_set(&ddb_entry->port_down_timer,
- ha->port_down_retry_count);
-- atomic_set(&ddb_entry->relogin_retry_count, 0);
-+ atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
- atomic_set(&ddb_entry->relogin_timer, 0);
- clear_bit(DF_RELOGIN, &ddb_entry->flags);
- clear_bit(DF_NO_RELOGIN, &ddb_entry->flags);
-diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
-index 83c8b5e..a82b348 100644
---- a/drivers/scsi/qla4xxx/ql4_os.c
-+++ b/drivers/scsi/qla4xxx/ql4_os.c
-@@ -641,13 +641,13 @@ static void qla4xxx_timer(struct scsi_qla_host *ha)
- ddb_entry->fw_ddb_device_state ==
- DDB_DS_SESSION_FAILED) {
- /* Reset retry relogin timer */
-- atomic_inc(&ddb_entry->relogin_retry_count);
-+ atomic_inc_unchecked(&ddb_entry->relogin_retry_count);
- DEBUG2(printk("scsi%ld: index[%d] relogin"
- " timed out-retrying"
- " relogin (%d)\n",
- ha->host_no,
- ddb_entry->fw_ddb_index,
-- atomic_read(&ddb_entry->
-+ atomic_read_unchecked(&ddb_entry->
- relogin_retry_count))
- );
- start_dpc++;
-diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
-index dd098ca..686ce01 100644
---- a/drivers/scsi/scsi.c
-+++ b/drivers/scsi/scsi.c
-@@ -652,7 +652,7 @@ int scsi_dispatch_cmd(struct scsi_cmnd *cmd)
- unsigned long timeout;
- int rtn = 0;
-
-- atomic_inc(&cmd->device->iorequest_cnt);
-+ atomic_inc_unchecked(&cmd->device->iorequest_cnt);
-
- /* check if the device is still usable */
- if (unlikely(cmd->device->sdev_state == SDEV_DEL)) {
-diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
-index bc3e363..e1a8e50 100644
---- a/drivers/scsi/scsi_debug.c
-+++ b/drivers/scsi/scsi_debug.c
-@@ -1395,6 +1395,8 @@ static int resp_mode_select(struct scsi_cmnd * scp, int mselect6,
- unsigned char arr[SDEBUG_MAX_MSELECT_SZ];
- unsigned char *cmd = (unsigned char *)scp->cmnd;
-
-+ pax_track_stack();
-+
- if ((errsts = check_readiness(scp, 1, devip)))
- return errsts;
- memset(arr, 0, sizeof(arr));
-@@ -1492,6 +1494,8 @@ static int resp_log_sense(struct scsi_cmnd * scp,
- unsigned char arr[SDEBUG_MAX_LSENSE_SZ];
- unsigned char *cmd = (unsigned char *)scp->cmnd;
-
-+ pax_track_stack();
-+
- if ((errsts = check_readiness(scp, 1, devip)))
- return errsts;
- memset(arr, 0, sizeof(arr));
-diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
-index 933f1c5..268b9fc 100644
---- a/drivers/scsi/scsi_lib.c
-+++ b/drivers/scsi/scsi_lib.c
-@@ -1402,7 +1402,7 @@ static void scsi_kill_request(struct request *req, struct request_queue *q)
- shost = sdev->host;
- scsi_init_cmd_errh(cmd);
- cmd->result = DID_NO_CONNECT << 16;
-- atomic_inc(&cmd->device->iorequest_cnt);
-+ atomic_inc_unchecked(&cmd->device->iorequest_cnt);
-
- /*
- * SCSI request completion path will do scsi_device_unbusy(),
-@@ -1433,9 +1433,9 @@ static void scsi_softirq_done(struct request *rq)
- */
- cmd->serial_number = 0;
-
-- atomic_inc(&cmd->device->iodone_cnt);
-+ atomic_inc_unchecked(&cmd->device->iodone_cnt);
- if (cmd->result)
-- atomic_inc(&cmd->device->ioerr_cnt);
-+ atomic_inc_unchecked(&cmd->device->ioerr_cnt);
-
- disposition = scsi_decide_disposition(cmd);
- if (disposition != SUCCESS &&
-diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
-index 91a93e0..eae0fe3 100644
---- a/drivers/scsi/scsi_sysfs.c
-+++ b/drivers/scsi/scsi_sysfs.c
-@@ -662,7 +662,7 @@ show_iostat_##field(struct device *dev, struct device_attribute *attr, \
- char *buf) \
- { \
- struct scsi_device *sdev = to_scsi_device(dev); \
-- unsigned long long count = atomic_read(&sdev->field); \
-+ unsigned long long count = atomic_read_unchecked(&sdev->field); \
- return snprintf(buf, 20, "0x%llx\n", count); \
- } \
- static DEVICE_ATTR(field, S_IRUGO, show_iostat_##field, NULL)
-diff --git a/drivers/scsi/scsi_tgt_lib.c b/drivers/scsi/scsi_tgt_lib.c
-index 1030327..f91fd30 100644
---- a/drivers/scsi/scsi_tgt_lib.c
-+++ b/drivers/scsi/scsi_tgt_lib.c
-@@ -362,7 +362,7 @@ static int scsi_map_user_pages(struct scsi_tgt_cmd *tcmd, struct scsi_cmnd *cmd,
- int err;
-
- dprintk("%lx %u\n", uaddr, len);
-- err = blk_rq_map_user(q, rq, NULL, (void *)uaddr, len, GFP_KERNEL);
-+ err = blk_rq_map_user(q, rq, NULL, (void __user *)uaddr, len, GFP_KERNEL);
- if (err) {
- /*
- * TODO: need to fixup sg_tablesize, max_segment_size,
-diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
-index db02e31..1b42ea9 100644
---- a/drivers/scsi/scsi_transport_fc.c
-+++ b/drivers/scsi/scsi_transport_fc.c
-@@ -480,7 +480,7 @@ MODULE_PARM_DESC(dev_loss_tmo,
- * Netlink Infrastructure
- */
-
--static atomic_t fc_event_seq;
-+static atomic_unchecked_t fc_event_seq;
-
- /**
- * fc_get_event_number - Obtain the next sequential FC event number
-@@ -493,7 +493,7 @@ static atomic_t fc_event_seq;
- u32
- fc_get_event_number(void)
- {
-- return atomic_add_return(1, &fc_event_seq);
-+ return atomic_add_return_unchecked(1, &fc_event_seq);
- }
- EXPORT_SYMBOL(fc_get_event_number);
-
-@@ -641,7 +641,7 @@ static __init int fc_transport_init(void)
- {
- int error;
-
-- atomic_set(&fc_event_seq, 0);
-+ atomic_set_unchecked(&fc_event_seq, 0);
-
- error = transport_class_register(&fc_host_class);
- if (error)
-diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
-index de2f8c4..63c5278 100644
---- a/drivers/scsi/scsi_transport_iscsi.c
-+++ b/drivers/scsi/scsi_transport_iscsi.c
-@@ -81,7 +81,7 @@ struct iscsi_internal {
- struct device_attribute *session_attrs[ISCSI_SESSION_ATTRS + 1];
- };
-
--static atomic_t iscsi_session_nr; /* sysfs session id for next new session */
-+static atomic_unchecked_t iscsi_session_nr; /* sysfs session id for next new session */
- static struct workqueue_struct *iscsi_eh_timer_workq;
-
- /*
-@@ -728,7 +728,7 @@ int iscsi_add_session(struct iscsi_cls_session *session, unsigned int target_id)
- int err;
-
- ihost = shost->shost_data;
-- session->sid = atomic_add_return(1, &iscsi_session_nr);
-+ session->sid = atomic_add_return_unchecked(1, &iscsi_session_nr);
-
- if (id == ISCSI_MAX_TARGET) {
- for (id = 0; id < ISCSI_MAX_TARGET; id++) {
-@@ -2060,7 +2060,7 @@ static __init int iscsi_transport_init(void)
- printk(KERN_INFO "Loading iSCSI transport class v%s.\n",
- ISCSI_TRANSPORT_VERSION);
-
-- atomic_set(&iscsi_session_nr, 0);
-+ atomic_set_unchecked(&iscsi_session_nr, 0);
-
- err = class_register(&iscsi_transport_class);
- if (err)
-diff --git a/drivers/scsi/scsi_transport_srp.c b/drivers/scsi/scsi_transport_srp.c
-index 21a045e..ec89e03 100644
---- a/drivers/scsi/scsi_transport_srp.c
-+++ b/drivers/scsi/scsi_transport_srp.c
-@@ -33,7 +33,7 @@
- #include "scsi_transport_srp_internal.h"
-
- struct srp_host_attrs {
-- atomic_t next_port_id;
-+ atomic_unchecked_t next_port_id;
- };
- #define to_srp_host_attrs(host) ((struct srp_host_attrs *)(host)->shost_data)
-
-@@ -62,7 +62,7 @@ static int srp_host_setup(struct transport_container *tc, struct device *dev,
- struct Scsi_Host *shost = dev_to_shost(dev);
- struct srp_host_attrs *srp_host = to_srp_host_attrs(shost);
-
-- atomic_set(&srp_host->next_port_id, 0);
-+ atomic_set_unchecked(&srp_host->next_port_id, 0);
- return 0;
- }
-
-@@ -211,7 +211,7 @@ struct srp_rport *srp_rport_add(struct Scsi_Host *shost,
- memcpy(rport->port_id, ids->port_id, sizeof(rport->port_id));
- rport->roles = ids->roles;
-
-- id = atomic_inc_return(&to_srp_host_attrs(shost)->next_port_id);
-+ id = atomic_inc_return_unchecked(&to_srp_host_attrs(shost)->next_port_id);
- dev_set_name(&rport->dev, "port-%d:%d", shost->host_no, id);
-
- transport_setup_device(&rport->dev);
-diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
-index 040f751..98a5ed2 100644
---- a/drivers/scsi/sg.c
-+++ b/drivers/scsi/sg.c
-@@ -1064,7 +1064,7 @@ sg_ioctl(struct inode *inode, struct file *filp,
- sdp->disk->disk_name,
- MKDEV(SCSI_GENERIC_MAJOR, sdp->index),
- NULL,
-- (char *)arg);
-+ (char __user *)arg);
- case BLKTRACESTART:
- return blk_trace_startstop(sdp->device->request_queue, 1);
- case BLKTRACESTOP:
-@@ -2292,7 +2292,7 @@ struct sg_proc_leaf {
- const struct file_operations * fops;
- };
-
--static struct sg_proc_leaf sg_proc_leaf_arr[] = {
-+static const struct sg_proc_leaf sg_proc_leaf_arr[] = {
- {"allow_dio", &adio_fops},
- {"debug", &debug_fops},
- {"def_reserved_size", &dressz_fops},
-@@ -2307,7 +2307,7 @@ sg_proc_init(void)
- {
- int k, mask;
- int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
-- struct sg_proc_leaf * leaf;
-+ const struct sg_proc_leaf * leaf;
-
- sg_proc_sgp = proc_mkdir(sg_proc_sg_dirname, NULL);
- if (!sg_proc_sgp)
-diff --git a/drivers/scsi/sym53c8xx_2/sym_glue.c b/drivers/scsi/sym53c8xx_2/sym_glue.c
-index c19ca5e..3eb5959 100644
---- a/drivers/scsi/sym53c8xx_2/sym_glue.c
-+++ b/drivers/scsi/sym53c8xx_2/sym_glue.c
-@@ -1758,6 +1758,8 @@ static int __devinit sym2_probe(struct pci_dev *pdev,
- int do_iounmap = 0;
- int do_disable_device = 1;
-
-+ pax_track_stack();
-+
- memset(&sym_dev, 0, sizeof(sym_dev));
- memset(&nvram, 0, sizeof(nvram));
- sym_dev.pdev = pdev;
-diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c
-new file mode 100644
-index 0000000..eabb432
---- /dev/null
-+++ b/drivers/scsi/vmw_pvscsi.c
-@@ -0,0 +1,1401 @@
-+/*
-+ * Linux driver for VMware's para-virtualized SCSI HBA.
-+ *
-+ * Copyright (C) 2008-2009, VMware, Inc. All Rights Reserved.
-+ *
-+ * This program is free software; you can redistribute it and/or modify it
-+ * under the terms of the GNU General Public License as published by the
-+ * Free Software Foundation; version 2 of the License and no later version.
-+ *
-+ * This program is distributed in the hope that it will be useful, but
-+ * WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
-+ * NON INFRINGEMENT. See the GNU General Public License for more
-+ * details.
-+ *
-+ * You should have received a copy of the GNU General Public License
-+ * along with this program; if not, write to the Free Software
-+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
-+ *
-+ * Maintained by: Alok N Kataria <akataria@vmware.com>
-+ *
-+ */
-+
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/moduleparam.h>
-+#include <linux/types.h>
-+#include <linux/interrupt.h>
-+#include <linux/workqueue.h>
-+#include <linux/pci.h>
-+
-+#include <scsi/scsi.h>
-+#include <scsi/scsi_host.h>
-+#include <scsi/scsi_cmnd.h>
-+#include <scsi/scsi_device.h>
-+
-+#include "vmw_pvscsi.h"
-+
-+#define PVSCSI_LINUX_DRIVER_DESC "VMware PVSCSI driver"
-+
-+MODULE_DESCRIPTION(PVSCSI_LINUX_DRIVER_DESC);
-+MODULE_AUTHOR("VMware, Inc.");
-+MODULE_LICENSE("GPL");
-+MODULE_VERSION(PVSCSI_DRIVER_VERSION_STRING);
-+
-+#define PVSCSI_DEFAULT_NUM_PAGES_PER_RING 8
-+#define PVSCSI_DEFAULT_NUM_PAGES_MSG_RING 1
-+#define PVSCSI_DEFAULT_QUEUE_DEPTH 64
-+#define SGL_SIZE PAGE_SIZE
-+
-+#define pvscsi_dev(adapter) (&(adapter->dev->dev))
-+
-+struct pvscsi_sg_list {
-+ struct PVSCSISGElement sge[PVSCSI_MAX_NUM_SG_ENTRIES_PER_SEGMENT];
-+};
-+
-+struct pvscsi_ctx {
-+ /*
-+ * The index of the context in cmd_map serves as the context ID for a
-+ * 1-to-1 mapping completions back to requests.
-+ */
-+ struct scsi_cmnd *cmd;
-+ struct pvscsi_sg_list *sgl;
-+ struct list_head list;
-+ dma_addr_t dataPA;
-+ dma_addr_t sensePA;
-+ dma_addr_t sglPA;
-+};
-+
-+struct pvscsi_adapter {
-+ char *mmioBase;
-+ unsigned int irq;
-+ u8 rev;
-+ bool use_msi;
-+ bool use_msix;
-+ bool use_msg;
-+
-+ spinlock_t hw_lock;
-+
-+ struct workqueue_struct *workqueue;
-+ struct work_struct work;
-+
-+ struct PVSCSIRingReqDesc *req_ring;
-+ unsigned req_pages;
-+ unsigned req_depth;
-+ dma_addr_t reqRingPA;
-+
-+ struct PVSCSIRingCmpDesc *cmp_ring;
-+ unsigned cmp_pages;
-+ dma_addr_t cmpRingPA;
-+
-+ struct PVSCSIRingMsgDesc *msg_ring;
-+ unsigned msg_pages;
-+ dma_addr_t msgRingPA;
-+
-+ struct PVSCSIRingsState *rings_state;
-+ dma_addr_t ringStatePA;
-+
-+ struct pci_dev *dev;
-+ struct Scsi_Host *host;
-+
-+ struct list_head cmd_pool;
-+ struct pvscsi_ctx *cmd_map;
-+};
-+
-+
-+/* Command line parameters */
-+static int pvscsi_ring_pages = PVSCSI_DEFAULT_NUM_PAGES_PER_RING;
-+static int pvscsi_msg_ring_pages = PVSCSI_DEFAULT_NUM_PAGES_MSG_RING;
-+static int pvscsi_cmd_per_lun = PVSCSI_DEFAULT_QUEUE_DEPTH;
-+static bool pvscsi_disable_msi;
-+static bool pvscsi_disable_msix;
-+static bool pvscsi_use_msg = true;
-+
-+#define PVSCSI_RW (S_IRUSR | S_IWUSR)
-+
-+module_param_named(ring_pages, pvscsi_ring_pages, int, PVSCSI_RW);
-+MODULE_PARM_DESC(ring_pages, "Number of pages per req/cmp ring - (default="
-+ __stringify(PVSCSI_DEFAULT_NUM_PAGES_PER_RING) ")");
-+
-+module_param_named(msg_ring_pages, pvscsi_msg_ring_pages, int, PVSCSI_RW);
-+MODULE_PARM_DESC(msg_ring_pages, "Number of pages for the msg ring - (default="
-+ __stringify(PVSCSI_DEFAULT_NUM_PAGES_MSG_RING) ")");
-+
-+module_param_named(cmd_per_lun, pvscsi_cmd_per_lun, int, PVSCSI_RW);
-+MODULE_PARM_DESC(cmd_per_lun, "Maximum commands per lun - (default="
-+ __stringify(PVSCSI_MAX_REQ_QUEUE_DEPTH) ")");
-+
-+module_param_named(disable_msi, pvscsi_disable_msi, bool, PVSCSI_RW);
-+MODULE_PARM_DESC(disable_msi, "Disable MSI use in driver - (default=0)");
-+
-+module_param_named(disable_msix, pvscsi_disable_msix, bool, PVSCSI_RW);
-+MODULE_PARM_DESC(disable_msix, "Disable MSI-X use in driver - (default=0)");
-+
-+module_param_named(use_msg, pvscsi_use_msg, bool, PVSCSI_RW);
-+MODULE_PARM_DESC(use_msg, "Use msg ring when available - (default=1)");
-+
-+static const struct pci_device_id pvscsi_pci_tbl[] = {
-+ { PCI_VDEVICE(VMWARE, PCI_DEVICE_ID_VMWARE_PVSCSI) },
-+ { 0 }
-+};
-+
-+MODULE_DEVICE_TABLE(pci, pvscsi_pci_tbl);
-+
-+static struct pvscsi_ctx *
-+pvscsi_find_context(const struct pvscsi_adapter *adapter, struct scsi_cmnd *cmd)
-+{
-+ struct pvscsi_ctx *ctx, *end;
-+
-+ end = &adapter->cmd_map[adapter->req_depth];
-+ for (ctx = adapter->cmd_map; ctx < end; ctx++)
-+ if (ctx->cmd == cmd)
-+ return ctx;
-+
-+ return NULL;
-+}
-+
-+static struct pvscsi_ctx *
-+pvscsi_acquire_context(struct pvscsi_adapter *adapter, struct scsi_cmnd *cmd)
-+{
-+ struct pvscsi_ctx *ctx;
-+
-+ if (list_empty(&adapter->cmd_pool))
-+ return NULL;
-+
-+ ctx = list_first_entry(&adapter->cmd_pool, struct pvscsi_ctx, list);
-+ ctx->cmd = cmd;
-+ list_del(&ctx->list);
-+
-+ return ctx;
-+}
-+
-+static void pvscsi_release_context(struct pvscsi_adapter *adapter,
-+ struct pvscsi_ctx *ctx)
-+{
-+ ctx->cmd = NULL;
-+ list_add(&ctx->list, &adapter->cmd_pool);
-+}
-+
-+/*
-+ * Map a pvscsi_ctx struct to a context ID field value; we map to a simple
-+ * non-zero integer. ctx always points to an entry in cmd_map array, hence
-+ * the return value is always >=1.
-+ */
-+static u64 pvscsi_map_context(const struct pvscsi_adapter *adapter,
-+ const struct pvscsi_ctx *ctx)
-+{
-+ return ctx - adapter->cmd_map + 1;
-+}
-+
-+static struct pvscsi_ctx *
-+pvscsi_get_context(const struct pvscsi_adapter *adapter, u64 context)
-+{
-+ return &adapter->cmd_map[context - 1];
-+}
-+
-+static void pvscsi_reg_write(const struct pvscsi_adapter *adapter,
-+ u32 offset, u32 val)
-+{
-+ writel(val, adapter->mmioBase + offset);
-+}
-+
-+static u32 pvscsi_reg_read(const struct pvscsi_adapter *adapter, u32 offset)
-+{
-+ return readl(adapter->mmioBase + offset);
-+}
-+
-+static u32 pvscsi_read_intr_status(const struct pvscsi_adapter *adapter)
-+{
-+ return pvscsi_reg_read(adapter, PVSCSI_REG_OFFSET_INTR_STATUS);
-+}
-+
-+static void pvscsi_write_intr_status(const struct pvscsi_adapter *adapter,
-+ u32 val)
-+{
-+ pvscsi_reg_write(adapter, PVSCSI_REG_OFFSET_INTR_STATUS, val);
-+}
-+
-+static void pvscsi_unmask_intr(const struct pvscsi_adapter *adapter)
-+{
-+ u32 intr_bits;
-+
-+ intr_bits = PVSCSI_INTR_CMPL_MASK;
-+ if (adapter->use_msg)
-+ intr_bits |= PVSCSI_INTR_MSG_MASK;
-+
-+ pvscsi_reg_write(adapter, PVSCSI_REG_OFFSET_INTR_MASK, intr_bits);
-+}
-+
-+static void pvscsi_mask_intr(const struct pvscsi_adapter *adapter)
-+{
-+ pvscsi_reg_write(adapter, PVSCSI_REG_OFFSET_INTR_MASK, 0);
-+}
-+
-+static void pvscsi_write_cmd_desc(const struct pvscsi_adapter *adapter,
-+ u32 cmd, const void *desc, size_t len)
-+{
-+ const u32 *ptr = desc;
-+ size_t i;
-+
-+ len /= sizeof(*ptr);
-+ pvscsi_reg_write(adapter, PVSCSI_REG_OFFSET_COMMAND, cmd);
-+ for (i = 0; i < len; i++)
-+ pvscsi_reg_write(adapter,
-+ PVSCSI_REG_OFFSET_COMMAND_DATA, ptr[i]);
-+}
-+
-+static void pvscsi_abort_cmd(const struct pvscsi_adapter *adapter,
-+ const struct pvscsi_ctx *ctx)
-+{
-+ struct PVSCSICmdDescAbortCmd cmd = { 0 };
-+
-+ cmd.target = ctx->cmd->device->id;
-+ cmd.context = pvscsi_map_context(adapter, ctx);
-+
-+ pvscsi_write_cmd_desc(adapter, PVSCSI_CMD_ABORT_CMD, &cmd, sizeof(cmd));
-+}
-+
-+static void pvscsi_kick_rw_io(const struct pvscsi_adapter *adapter)
-+{
-+ pvscsi_reg_write(adapter, PVSCSI_REG_OFFSET_KICK_RW_IO, 0);
-+}
-+
-+static void pvscsi_process_request_ring(const struct pvscsi_adapter *adapter)
-+{
-+ pvscsi_reg_write(adapter, PVSCSI_REG_OFFSET_KICK_NON_RW_IO, 0);
-+}
-+
-+static int scsi_is_rw(unsigned char op)
-+{
-+ return op == READ_6 || op == WRITE_6 ||
-+ op == READ_10 || op == WRITE_10 ||
-+ op == READ_12 || op == WRITE_12 ||
-+ op == READ_16 || op == WRITE_16;
-+}
-+
-+static void pvscsi_kick_io(const struct pvscsi_adapter *adapter,
-+ unsigned char op)
-+{
-+ if (scsi_is_rw(op))
-+ pvscsi_kick_rw_io(adapter);
-+ else
-+ pvscsi_process_request_ring(adapter);
-+}
-+
-+static void ll_adapter_reset(const struct pvscsi_adapter *adapter)
-+{
-+ dev_dbg(pvscsi_dev(adapter), "Adapter Reset on %p\n", adapter);
-+
-+ pvscsi_write_cmd_desc(adapter, PVSCSI_CMD_ADAPTER_RESET, NULL, 0);
-+}
-+
-+static void ll_bus_reset(const struct pvscsi_adapter *adapter)
-+{
-+ dev_dbg(pvscsi_dev(adapter), "Reseting bus on %p\n", adapter);
-+
-+ pvscsi_write_cmd_desc(adapter, PVSCSI_CMD_RESET_BUS, NULL, 0);
-+}
-+
-+static void ll_device_reset(const struct pvscsi_adapter *adapter, u32 target)
-+{
-+ struct PVSCSICmdDescResetDevice cmd = { 0 };
-+
-+ dev_dbg(pvscsi_dev(adapter), "Reseting device: target=%u\n", target);
-+
-+ cmd.target = target;
-+
-+ pvscsi_write_cmd_desc(adapter, PVSCSI_CMD_RESET_DEVICE,
-+ &cmd, sizeof(cmd));
-+}
-+
-+static void pvscsi_create_sg(struct pvscsi_ctx *ctx,
-+ struct scatterlist *sg, unsigned count)
-+{
-+ unsigned i;
-+ struct PVSCSISGElement *sge;
-+
-+ BUG_ON(count > PVSCSI_MAX_NUM_SG_ENTRIES_PER_SEGMENT);
-+
-+ sge = &ctx->sgl->sge[0];
-+ for (i = 0; i < count; i++, sg++) {
-+ sge[i].addr = sg_dma_address(sg);
-+ sge[i].length = sg_dma_len(sg);
-+ sge[i].flags = 0;
-+ }
-+}
-+
-+/*
-+ * Map all data buffers for a command into PCI space and
-+ * setup the scatter/gather list if needed.
-+ */
-+static void pvscsi_map_buffers(struct pvscsi_adapter *adapter,
-+ struct pvscsi_ctx *ctx, struct scsi_cmnd *cmd,
-+ struct PVSCSIRingReqDesc *e)
-+{
-+ unsigned count;
-+ unsigned bufflen = scsi_bufflen(cmd);
-+ struct scatterlist *sg;
-+
-+ e->dataLen = bufflen;
-+ e->dataAddr = 0;
-+ if (bufflen == 0)
-+ return;
-+
-+ sg = scsi_sglist(cmd);
-+ count = scsi_sg_count(cmd);
-+ if (count != 0) {
-+ int segs = scsi_dma_map(cmd);
-+ if (segs > 1) {
-+ pvscsi_create_sg(ctx, sg, segs);
-+
-+ e->flags |= PVSCSI_FLAG_CMD_WITH_SG_LIST;
-+ ctx->sglPA = pci_map_single(adapter->dev, ctx->sgl,
-+ SGL_SIZE, PCI_DMA_TODEVICE);
-+ e->dataAddr = ctx->sglPA;
-+ } else
-+ e->dataAddr = sg_dma_address(sg);
-+ } else {
-+ /*
-+ * In case there is no S/G list, scsi_sglist points
-+ * directly to the buffer.
-+ */
-+ ctx->dataPA = pci_map_single(adapter->dev, sg, bufflen,
-+ cmd->sc_data_direction);
-+ e->dataAddr = ctx->dataPA;
-+ }
-+}
-+
-+static void pvscsi_unmap_buffers(const struct pvscsi_adapter *adapter,
-+ struct pvscsi_ctx *ctx)
-+{
-+ struct scsi_cmnd *cmd;
-+ unsigned bufflen;
-+
-+ cmd = ctx->cmd;
-+ bufflen = scsi_bufflen(cmd);
-+
-+ if (bufflen != 0) {
-+ unsigned count = scsi_sg_count(cmd);
-+
-+ if (count != 0) {
-+ scsi_dma_unmap(cmd);
-+ if (ctx->sglPA) {
-+ pci_unmap_single(adapter->dev, ctx->sglPA,
-+ SGL_SIZE, PCI_DMA_TODEVICE);
-+ ctx->sglPA = 0;
-+ }
-+ } else
-+ pci_unmap_single(adapter->dev, ctx->dataPA, bufflen,
-+ cmd->sc_data_direction);
-+ }
-+ if (cmd->sense_buffer)
-+ pci_unmap_single(adapter->dev, ctx->sensePA,
-+ SCSI_SENSE_BUFFERSIZE, PCI_DMA_FROMDEVICE);
-+}
-+
-+static int __devinit pvscsi_allocate_rings(struct pvscsi_adapter *adapter)
-+{
-+ adapter->rings_state = pci_alloc_consistent(adapter->dev, PAGE_SIZE,
-+ &adapter->ringStatePA);
-+ if (!adapter->rings_state)
-+ return -ENOMEM;
-+
-+ adapter->req_pages = min(PVSCSI_MAX_NUM_PAGES_REQ_RING,
-+ pvscsi_ring_pages);
-+ adapter->req_depth = adapter->req_pages
-+ * PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE;
-+ adapter->req_ring = pci_alloc_consistent(adapter->dev,
-+ adapter->req_pages * PAGE_SIZE,
-+ &adapter->reqRingPA);
-+ if (!adapter->req_ring)
-+ return -ENOMEM;
-+
-+ adapter->cmp_pages = min(PVSCSI_MAX_NUM_PAGES_CMP_RING,
-+ pvscsi_ring_pages);
-+ adapter->cmp_ring = pci_alloc_consistent(adapter->dev,
-+ adapter->cmp_pages * PAGE_SIZE,
-+ &adapter->cmpRingPA);
-+ if (!adapter->cmp_ring)
-+ return -ENOMEM;
-+
-+ BUG_ON(!IS_ALIGNED(adapter->ringStatePA, PAGE_SIZE));
-+ BUG_ON(!IS_ALIGNED(adapter->reqRingPA, PAGE_SIZE));
-+ BUG_ON(!IS_ALIGNED(adapter->cmpRingPA, PAGE_SIZE));
-+
-+ if (!adapter->use_msg)
-+ return 0;
-+
-+ adapter->msg_pages = min(PVSCSI_MAX_NUM_PAGES_MSG_RING,
-+ pvscsi_msg_ring_pages);
-+ adapter->msg_ring = pci_alloc_consistent(adapter->dev,
-+ adapter->msg_pages * PAGE_SIZE,
-+ &adapter->msgRingPA);
-+ if (!adapter->msg_ring)
-+ return -ENOMEM;
-+ BUG_ON(!IS_ALIGNED(adapter->msgRingPA, PAGE_SIZE));
-+
-+ return 0;
-+}
-+
-+static void pvscsi_setup_all_rings(const struct pvscsi_adapter *adapter)
-+{
-+ struct PVSCSICmdDescSetupRings cmd = { 0 };
-+ dma_addr_t base;
-+ unsigned i;
-+
-+ cmd.ringsStatePPN = adapter->ringStatePA >> PAGE_SHIFT;
-+ cmd.reqRingNumPages = adapter->req_pages;
-+ cmd.cmpRingNumPages = adapter->cmp_pages;
-+
-+ base = adapter->reqRingPA;
-+ for (i = 0; i < adapter->req_pages; i++) {
-+ cmd.reqRingPPNs[i] = base >> PAGE_SHIFT;
-+ base += PAGE_SIZE;
-+ }
-+
-+ base = adapter->cmpRingPA;
-+ for (i = 0; i < adapter->cmp_pages; i++) {
-+ cmd.cmpRingPPNs[i] = base >> PAGE_SHIFT;
-+ base += PAGE_SIZE;
-+ }
-+
-+ memset(adapter->rings_state, 0, PAGE_SIZE);
-+ memset(adapter->req_ring, 0, adapter->req_pages * PAGE_SIZE);
-+ memset(adapter->cmp_ring, 0, adapter->cmp_pages * PAGE_SIZE);
-+
-+ pvscsi_write_cmd_desc(adapter, PVSCSI_CMD_SETUP_RINGS,
-+ &cmd, sizeof(cmd));
-+
-+ if (adapter->use_msg) {
-+ struct PVSCSICmdDescSetupMsgRing cmd_msg = { 0 };
-+
-+ cmd_msg.numPages = adapter->msg_pages;
-+
-+ base = adapter->msgRingPA;
-+ for (i = 0; i < adapter->msg_pages; i++) {
-+ cmd_msg.ringPPNs[i] = base >> PAGE_SHIFT;
-+ base += PAGE_SIZE;
-+ }
-+ memset(adapter->msg_ring, 0, adapter->msg_pages * PAGE_SIZE);
-+
-+ pvscsi_write_cmd_desc(adapter, PVSCSI_CMD_SETUP_MSG_RING,
-+ &cmd_msg, sizeof(cmd_msg));
-+ }
-+}
-+
-+/*
-+ * Pull a completion descriptor off and pass the completion back
-+ * to the SCSI mid layer.
-+ */
-+static void pvscsi_complete_request(struct pvscsi_adapter *adapter,
-+ const struct PVSCSIRingCmpDesc *e)
-+{
-+ struct pvscsi_ctx *ctx;
-+ struct scsi_cmnd *cmd;
-+ u32 btstat = e->hostStatus;
-+ u32 sdstat = e->scsiStatus;
-+
-+ ctx = pvscsi_get_context(adapter, e->context);
-+ cmd = ctx->cmd;
-+ pvscsi_unmap_buffers(adapter, ctx);
-+ pvscsi_release_context(adapter, ctx);
-+ cmd->result = 0;
-+
-+ if (sdstat != SAM_STAT_GOOD &&
-+ (btstat == BTSTAT_SUCCESS ||
-+ btstat == BTSTAT_LINKED_COMMAND_COMPLETED ||
-+ btstat == BTSTAT_LINKED_COMMAND_COMPLETED_WITH_FLAG)) {
-+ cmd->result = (DID_OK << 16) | sdstat;
-+ if (sdstat == SAM_STAT_CHECK_CONDITION && cmd->sense_buffer)
-+ cmd->result |= (DRIVER_SENSE << 24);
-+ } else
-+ switch (btstat) {
-+ case BTSTAT_SUCCESS:
-+ case BTSTAT_LINKED_COMMAND_COMPLETED:
-+ case BTSTAT_LINKED_COMMAND_COMPLETED_WITH_FLAG:
-+ /* If everything went fine, let's move on.. */
-+ cmd->result = (DID_OK << 16);
-+ break;
-+
-+ case BTSTAT_DATARUN:
-+ case BTSTAT_DATA_UNDERRUN:
-+ /* Report residual data in underruns */
-+ scsi_set_resid(cmd, scsi_bufflen(cmd) - e->dataLen);
-+ cmd->result = (DID_ERROR << 16);
-+ break;
-+
-+ case BTSTAT_SELTIMEO:
-+ /* Our emulation returns this for non-connected devs */
-+ cmd->result = (DID_BAD_TARGET << 16);
-+ break;
-+
-+ case BTSTAT_LUNMISMATCH:
-+ case BTSTAT_TAGREJECT:
-+ case BTSTAT_BADMSG:
-+ cmd->result = (DRIVER_INVALID << 24);
-+ /* fall through */
-+
-+ case BTSTAT_HAHARDWARE:
-+ case BTSTAT_INVPHASE:
-+ case BTSTAT_HATIMEOUT:
-+ case BTSTAT_NORESPONSE:
-+ case BTSTAT_DISCONNECT:
-+ case BTSTAT_HASOFTWARE:
-+ case BTSTAT_BUSFREE:
-+ case BTSTAT_SENSFAILED:
-+ cmd->result |= (DID_ERROR << 16);
-+ break;
-+
-+ case BTSTAT_SENTRST:
-+ case BTSTAT_RECVRST:
-+ case BTSTAT_BUSRESET:
-+ cmd->result = (DID_RESET << 16);
-+ break;
-+
-+ case BTSTAT_ABORTQUEUE:
-+ cmd->result = (DID_ABORT << 16);
-+ break;
-+
-+ case BTSTAT_SCSIPARITY:
-+ cmd->result = (DID_PARITY << 16);
-+ break;
-+
-+ default:
-+ cmd->result = (DID_ERROR << 16);
-+ scmd_printk(KERN_DEBUG, cmd,
-+ "Unknown completion status: 0x%x\n",
-+ btstat);
-+ }
-+
-+ dev_dbg(&cmd->device->sdev_gendev,
-+ "cmd=%p %x ctx=%p result=0x%x status=0x%x,%x\n",
-+ cmd, cmd->cmnd[0], ctx, cmd->result, btstat, sdstat);
-+
-+ cmd->scsi_done(cmd);
-+}
-+
-+/*
-+ * barrier usage : Since the PVSCSI device is emulated, there could be cases
-+ * where we may want to serialize some accesses between the driver and the
-+ * emulation layer. We use compiler barriers instead of the more expensive
-+ * memory barriers because PVSCSI is only supported on X86 which has strong
-+ * memory access ordering.
-+ */
-+static void pvscsi_process_completion_ring(struct pvscsi_adapter *adapter)
-+{
-+ struct PVSCSIRingsState *s = adapter->rings_state;
-+ struct PVSCSIRingCmpDesc *ring = adapter->cmp_ring;
-+ u32 cmp_entries = s->cmpNumEntriesLog2;
-+
-+ while (s->cmpConsIdx != s->cmpProdIdx) {
-+ struct PVSCSIRingCmpDesc *e = ring + (s->cmpConsIdx &
-+ MASK(cmp_entries));
-+ /*
-+ * This barrier() ensures that *e is not dereferenced while
-+ * the device emulation still writes data into the slot.
-+ * Since the device emulation advances s->cmpProdIdx only after
-+ * updating the slot we want to check it first.
-+ */
-+ barrier();
-+ pvscsi_complete_request(adapter, e);
-+ /*
-+ * This barrier() ensures that compiler doesn't reorder write
-+ * to s->cmpConsIdx before the read of (*e) inside
-+ * pvscsi_complete_request. Otherwise, device emulation may
-+ * overwrite *e before we had a chance to read it.
-+ */
-+ barrier();
-+ s->cmpConsIdx++;
-+ }
-+}
-+
-+/*
-+ * Translate a Linux SCSI request into a request ring entry.
-+ */
-+static int pvscsi_queue_ring(struct pvscsi_adapter *adapter,
-+ struct pvscsi_ctx *ctx, struct scsi_cmnd *cmd)
-+{
-+ struct PVSCSIRingsState *s;
-+ struct PVSCSIRingReqDesc *e;
-+ struct scsi_device *sdev;
-+ u32 req_entries;
-+
-+ s = adapter->rings_state;
-+ sdev = cmd->device;
-+ req_entries = s->reqNumEntriesLog2;
-+
-+ /*
-+ * If this condition holds, we might have room on the request ring, but
-+ * we might not have room on the completion ring for the response.
-+ * However, we have already ruled out this possibility - we would not
-+ * have successfully allocated a context if it were true, since we only
-+ * have one context per request entry. Check for it anyway, since it
-+ * would be a serious bug.
-+ */
-+ if (s->reqProdIdx - s->cmpConsIdx >= 1 << req_entries) {
-+ scmd_printk(KERN_ERR, cmd, "vmw_pvscsi: "
-+ "ring full: reqProdIdx=%d cmpConsIdx=%d\n",
-+ s->reqProdIdx, s->cmpConsIdx);
-+ return -1;
-+ }
-+
-+ e = adapter->req_ring + (s->reqProdIdx & MASK(req_entries));
-+
-+ e->bus = sdev->channel;
-+ e->target = sdev->id;
-+ memset(e->lun, 0, sizeof(e->lun));
-+ e->lun[1] = sdev->lun;
-+
-+ if (cmd->sense_buffer) {
-+ ctx->sensePA = pci_map_single(adapter->dev, cmd->sense_buffer,
-+ SCSI_SENSE_BUFFERSIZE,
-+ PCI_DMA_FROMDEVICE);
-+ e->senseAddr = ctx->sensePA;
-+ e->senseLen = SCSI_SENSE_BUFFERSIZE;
-+ } else {
-+ e->senseLen = 0;
-+ e->senseAddr = 0;
-+ }
-+ e->cdbLen = cmd->cmd_len;
-+ e->vcpuHint = smp_processor_id();
-+ memcpy(e->cdb, cmd->cmnd, e->cdbLen);
-+
-+ e->tag = SIMPLE_QUEUE_TAG;
-+ if (sdev->tagged_supported &&
-+ (cmd->tag == HEAD_OF_QUEUE_TAG ||
-+ cmd->tag == ORDERED_QUEUE_TAG))
-+ e->tag = cmd->tag;
-+
-+ if (cmd->sc_data_direction == DMA_FROM_DEVICE)
-+ e->flags = PVSCSI_FLAG_CMD_DIR_TOHOST;
-+ else if (cmd->sc_data_direction == DMA_TO_DEVICE)
-+ e->flags = PVSCSI_FLAG_CMD_DIR_TODEVICE;
-+ else if (cmd->sc_data_direction == DMA_NONE)
-+ e->flags = PVSCSI_FLAG_CMD_DIR_NONE;
-+ else
-+ e->flags = 0;
-+
-+ pvscsi_map_buffers(adapter, ctx, cmd, e);
-+
-+ e->context = pvscsi_map_context(adapter, ctx);
-+
-+ barrier();
-+
-+ s->reqProdIdx++;
-+
-+ return 0;
-+}
-+
-+static int pvscsi_queue(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *))
-+{
-+ struct Scsi_Host *host = cmd->device->host;
-+ struct pvscsi_adapter *adapter = shost_priv(host);
-+ struct pvscsi_ctx *ctx;
-+ unsigned long flags;
-+
-+ spin_lock_irqsave(&adapter->hw_lock, flags);
-+
-+ ctx = pvscsi_acquire_context(adapter, cmd);
-+ if (!ctx || pvscsi_queue_ring(adapter, ctx, cmd) != 0) {
-+ if (ctx)
-+ pvscsi_release_context(adapter, ctx);
-+ spin_unlock_irqrestore(&adapter->hw_lock, flags);
-+ return SCSI_MLQUEUE_HOST_BUSY;
-+ }
-+
-+ cmd->scsi_done = done;
-+
-+ dev_dbg(&cmd->device->sdev_gendev,
-+ "queued cmd %p, ctx %p, op=%x\n", cmd, ctx, cmd->cmnd[0]);
-+
-+ spin_unlock_irqrestore(&adapter->hw_lock, flags);
-+
-+ pvscsi_kick_io(adapter, cmd->cmnd[0]);
-+
-+ return 0;
-+}
-+
-+static int pvscsi_abort(struct scsi_cmnd *cmd)
-+{
-+ struct pvscsi_adapter *adapter = shost_priv(cmd->device->host);
-+ struct pvscsi_ctx *ctx;
-+ unsigned long flags;
-+
-+ scmd_printk(KERN_DEBUG, cmd, "task abort on host %u, %p\n",
-+ adapter->host->host_no, cmd);
-+
-+ spin_lock_irqsave(&adapter->hw_lock, flags);
-+
-+ /*
-+ * Poll the completion ring first - we might be trying to abort
-+ * a command that is waiting to be dispatched in the completion ring.
-+ */
-+ pvscsi_process_completion_ring(adapter);
-+
-+ /*
-+ * If there is no context for the command, it either already succeeded
-+ * or else was never properly issued. Not our problem.
-+ */
-+ ctx = pvscsi_find_context(adapter, cmd);
-+ if (!ctx) {
-+ scmd_printk(KERN_DEBUG, cmd, "Failed to abort cmd %p\n", cmd);
-+ goto out;
-+ }
-+
-+ pvscsi_abort_cmd(adapter, ctx);
-+
-+ pvscsi_process_completion_ring(adapter);
-+
-+out:
-+ spin_unlock_irqrestore(&adapter->hw_lock, flags);
-+ return SUCCESS;
-+}
-+
-+/*
-+ * Abort all outstanding requests. This is only safe to use if the completion
-+ * ring will never be walked again or the device has been reset, because it
-+ * destroys the 1-1 mapping between context field passed to emulation and our
-+ * request structure.
-+ */
-+static void pvscsi_reset_all(struct pvscsi_adapter *adapter)
-+{
-+ unsigned i;
-+
-+ for (i = 0; i < adapter->req_depth; i++) {
-+ struct pvscsi_ctx *ctx = &adapter->cmd_map[i];
-+ struct scsi_cmnd *cmd = ctx->cmd;
-+ if (cmd) {
-+ scmd_printk(KERN_ERR, cmd,
-+ "Forced reset on cmd %p\n", cmd);
-+ pvscsi_unmap_buffers(adapter, ctx);
-+ pvscsi_release_context(adapter, ctx);
-+ cmd->result = (DID_RESET << 16);
-+ cmd->scsi_done(cmd);
-+ }
-+ }
-+}
-+
-+static int pvscsi_host_reset(struct scsi_cmnd *cmd)
-+{
-+ struct Scsi_Host *host = cmd->device->host;
-+ struct pvscsi_adapter *adapter = shost_priv(host);
-+ unsigned long flags;
-+ bool use_msg;
-+
-+ scmd_printk(KERN_INFO, cmd, "SCSI Host reset\n");
-+
-+ spin_lock_irqsave(&adapter->hw_lock, flags);
-+
-+ use_msg = adapter->use_msg;
-+
-+ if (use_msg) {
-+ adapter->use_msg = 0;
-+ spin_unlock_irqrestore(&adapter->hw_lock, flags);
-+
-+ /*
-+ * Now that we know that the ISR won't add more work on the
-+ * workqueue we can safely flush any outstanding work.
-+ */
-+ flush_workqueue(adapter->workqueue);
-+ spin_lock_irqsave(&adapter->hw_lock, flags);
-+ }
-+
-+ /*
-+ * We're going to tear down the entire ring structure and set it back
-+ * up, so stalling new requests until all completions are flushed and
-+ * the rings are back in place.
-+ */
-+
-+ pvscsi_process_request_ring(adapter);
-+
-+ ll_adapter_reset(adapter);
-+
-+ /*
-+ * Now process any completions. Note we do this AFTER adapter reset,
-+ * which is strange, but stops races where completions get posted
-+ * between processing the ring and issuing the reset. The backend will
-+ * not touch the ring memory after reset, so the immediately pre-reset
-+ * completion ring state is still valid.
-+ */
-+ pvscsi_process_completion_ring(adapter);
-+
-+ pvscsi_reset_all(adapter);
-+ adapter->use_msg = use_msg;
-+ pvscsi_setup_all_rings(adapter);
-+ pvscsi_unmask_intr(adapter);
-+
-+ spin_unlock_irqrestore(&adapter->hw_lock, flags);
-+
-+ return SUCCESS;
-+}
-+
-+static int pvscsi_bus_reset(struct scsi_cmnd *cmd)
-+{
-+ struct Scsi_Host *host = cmd->device->host;
-+ struct pvscsi_adapter *adapter = shost_priv(host);
-+ unsigned long flags;
-+
-+ scmd_printk(KERN_INFO, cmd, "SCSI Bus reset\n");
-+
-+ /*
-+ * We don't want to queue new requests for this bus after
-+ * flushing all pending requests to emulation, since new
-+ * requests could then sneak in during this bus reset phase,
-+ * so take the lock now.
-+ */
-+ spin_lock_irqsave(&adapter->hw_lock, flags);
-+
-+ pvscsi_process_request_ring(adapter);
-+ ll_bus_reset(adapter);
-+ pvscsi_process_completion_ring(adapter);
-+
-+ spin_unlock_irqrestore(&adapter->hw_lock, flags);
-+
-+ return SUCCESS;
-+}
-+
-+static int pvscsi_device_reset(struct scsi_cmnd *cmd)
-+{
-+ struct Scsi_Host *host = cmd->device->host;
-+ struct pvscsi_adapter *adapter = shost_priv(host);
-+ unsigned long flags;
-+
-+ scmd_printk(KERN_INFO, cmd, "SCSI device reset on scsi%u:%u\n",
-+ host->host_no, cmd->device->id);
-+
-+ /*
-+ * We don't want to queue new requests for this device after flushing
-+ * all pending requests to emulation, since new requests could then
-+ * sneak in during this device reset phase, so take the lock now.
-+ */
-+ spin_lock_irqsave(&adapter->hw_lock, flags);
-+
-+ pvscsi_process_request_ring(adapter);
-+ ll_device_reset(adapter, cmd->device->id);
-+ pvscsi_process_completion_ring(adapter);
-+
-+ spin_unlock_irqrestore(&adapter->hw_lock, flags);
-+
-+ return SUCCESS;
-+}
-+
-+static struct scsi_host_template pvscsi_template;
-+
-+static const char *pvscsi_info(struct Scsi_Host *host)
-+{
-+ struct pvscsi_adapter *adapter = shost_priv(host);
-+ static char buf[256];
-+
-+ sprintf(buf, "VMware PVSCSI storage adapter rev %d, req/cmp/msg rings: "
-+ "%u/%u/%u pages, cmd_per_lun=%u", adapter->rev,
-+ adapter->req_pages, adapter->cmp_pages, adapter->msg_pages,
-+ pvscsi_template.cmd_per_lun);
-+
-+ return buf;
-+}
-+
-+static struct scsi_host_template pvscsi_template = {
-+ .module = THIS_MODULE,
-+ .name = "VMware PVSCSI Host Adapter",
-+ .proc_name = "vmw_pvscsi",
-+ .info = pvscsi_info,
-+ .queuecommand = pvscsi_queue,
-+ .this_id = -1,
-+ .sg_tablesize = PVSCSI_MAX_NUM_SG_ENTRIES_PER_SEGMENT,
-+ .dma_boundary = UINT_MAX,
-+ .max_sectors = 0xffff,
-+ .use_clustering = ENABLE_CLUSTERING,
-+ .eh_abort_handler = pvscsi_abort,
-+ .eh_device_reset_handler = pvscsi_device_reset,
-+ .eh_bus_reset_handler = pvscsi_bus_reset,
-+ .eh_host_reset_handler = pvscsi_host_reset,
-+};
-+
-+static void pvscsi_process_msg(const struct pvscsi_adapter *adapter,
-+ const struct PVSCSIRingMsgDesc *e)
-+{
-+ struct PVSCSIRingsState *s = adapter->rings_state;
-+ struct Scsi_Host *host = adapter->host;
-+ struct scsi_device *sdev;
-+
-+ printk(KERN_INFO "vmw_pvscsi: msg type: 0x%x - MSG RING: %u/%u (%u) \n",
-+ e->type, s->msgProdIdx, s->msgConsIdx, s->msgNumEntriesLog2);
-+
-+ BUILD_BUG_ON(PVSCSI_MSG_LAST != 2);
-+
-+ if (e->type == PVSCSI_MSG_DEV_ADDED) {
-+ struct PVSCSIMsgDescDevStatusChanged *desc;
-+ desc = (struct PVSCSIMsgDescDevStatusChanged *)e;
-+
-+ printk(KERN_INFO
-+ "vmw_pvscsi: msg: device added at scsi%u:%u:%u\n",
-+ desc->bus, desc->target, desc->lun[1]);
-+
-+ if (!scsi_host_get(host))
-+ return;
-+
-+ sdev = scsi_device_lookup(host, desc->bus, desc->target,
-+ desc->lun[1]);
-+ if (sdev) {
-+ printk(KERN_INFO "vmw_pvscsi: device already exists\n");
-+ scsi_device_put(sdev);
-+ } else
-+ scsi_add_device(adapter->host, desc->bus,
-+ desc->target, desc->lun[1]);
-+
-+ scsi_host_put(host);
-+ } else if (e->type == PVSCSI_MSG_DEV_REMOVED) {
-+ struct PVSCSIMsgDescDevStatusChanged *desc;
-+ desc = (struct PVSCSIMsgDescDevStatusChanged *)e;
-+
-+ printk(KERN_INFO
-+ "vmw_pvscsi: msg: device removed at scsi%u:%u:%u\n",
-+ desc->bus, desc->target, desc->lun[1]);
-+
-+ if (!scsi_host_get(host))
-+ return;
-+
-+ sdev = scsi_device_lookup(host, desc->bus, desc->target,
-+ desc->lun[1]);
-+ if (sdev) {
-+ scsi_remove_device(sdev);
-+ scsi_device_put(sdev);
-+ } else
-+ printk(KERN_INFO
-+ "vmw_pvscsi: failed to lookup scsi%u:%u:%u\n",
-+ desc->bus, desc->target, desc->lun[1]);
-+
-+ scsi_host_put(host);
-+ }
-+}
-+
-+static int pvscsi_msg_pending(const struct pvscsi_adapter *adapter)
-+{
-+ struct PVSCSIRingsState *s = adapter->rings_state;
-+
-+ return s->msgProdIdx != s->msgConsIdx;
-+}
-+
-+static void pvscsi_process_msg_ring(const struct pvscsi_adapter *adapter)
-+{
-+ struct PVSCSIRingsState *s = adapter->rings_state;
-+ struct PVSCSIRingMsgDesc *ring = adapter->msg_ring;
-+ u32 msg_entries = s->msgNumEntriesLog2;
-+
-+ while (pvscsi_msg_pending(adapter)) {
-+ struct PVSCSIRingMsgDesc *e = ring + (s->msgConsIdx &
-+ MASK(msg_entries));
-+
-+ barrier();
-+ pvscsi_process_msg(adapter, e);
-+ barrier();
-+ s->msgConsIdx++;
-+ }
-+}
-+
-+static void pvscsi_msg_workqueue_handler(struct work_struct *data)
-+{
-+ struct pvscsi_adapter *adapter;
-+
-+ adapter = container_of(data, struct pvscsi_adapter, work);
-+
-+ pvscsi_process_msg_ring(adapter);
-+}
-+
-+static int pvscsi_setup_msg_workqueue(struct pvscsi_adapter *adapter)
-+{
-+ char name[32];
-+
-+ if (!pvscsi_use_msg)
-+ return 0;
-+
-+ pvscsi_reg_write(adapter, PVSCSI_REG_OFFSET_COMMAND,
-+ PVSCSI_CMD_SETUP_MSG_RING);
-+
-+ if (pvscsi_reg_read(adapter, PVSCSI_REG_OFFSET_COMMAND_STATUS) == -1)
-+ return 0;
-+
-+ snprintf(name, sizeof(name),
-+ "vmw_pvscsi_wq_%u", adapter->host->host_no);
-+
-+ adapter->workqueue = create_singlethread_workqueue(name);
-+ if (!adapter->workqueue) {
-+ printk(KERN_ERR "vmw_pvscsi: failed to create work queue\n");
-+ return 0;
-+ }
-+ INIT_WORK(&adapter->work, pvscsi_msg_workqueue_handler);
-+
-+ return 1;
-+}
-+
-+static irqreturn_t pvscsi_isr(int irq, void *devp)
-+{
-+ struct pvscsi_adapter *adapter = devp;
-+ int handled;
-+
-+ if (adapter->use_msi || adapter->use_msix)
-+ handled = true;
-+ else {
-+ u32 val = pvscsi_read_intr_status(adapter);
-+ handled = (val & PVSCSI_INTR_ALL_SUPPORTED) != 0;
-+ if (handled)
-+ pvscsi_write_intr_status(devp, val);
-+ }
-+
-+ if (handled) {
-+ unsigned long flags;
-+
-+ spin_lock_irqsave(&adapter->hw_lock, flags);
-+
-+ pvscsi_process_completion_ring(adapter);
-+ if (adapter->use_msg && pvscsi_msg_pending(adapter))
-+ queue_work(adapter->workqueue, &adapter->work);
-+
-+ spin_unlock_irqrestore(&adapter->hw_lock, flags);
-+ }
-+
-+ return IRQ_RETVAL(handled);
-+}
-+
-+static void pvscsi_free_sgls(const struct pvscsi_adapter *adapter)
-+{
-+ struct pvscsi_ctx *ctx = adapter->cmd_map;
-+ unsigned i;
-+
-+ for (i = 0; i < adapter->req_depth; ++i, ++ctx)
-+ kfree(ctx->sgl);
-+}
-+
-+static int pvscsi_setup_msix(const struct pvscsi_adapter *adapter, int *irq)
-+{
-+ struct msix_entry entry = { 0, PVSCSI_VECTOR_COMPLETION };
-+ int ret;
-+
-+ ret = pci_enable_msix(adapter->dev, &entry, 1);
-+ if (ret)
-+ return ret;
-+
-+ *irq = entry.vector;
-+
-+ return 0;
-+}
-+
-+static void pvscsi_shutdown_intr(struct pvscsi_adapter *adapter)
-+{
-+ if (adapter->irq) {
-+ free_irq(adapter->irq, adapter);
-+ adapter->irq = 0;
-+ }
-+ if (adapter->use_msi) {
-+ pci_disable_msi(adapter->dev);
-+ adapter->use_msi = 0;
-+ } else if (adapter->use_msix) {
-+ pci_disable_msix(adapter->dev);
-+ adapter->use_msix = 0;
-+ }
-+}
-+
-+static void pvscsi_release_resources(struct pvscsi_adapter *adapter)
-+{
-+ pvscsi_shutdown_intr(adapter);
-+
-+ if (adapter->workqueue)
-+ destroy_workqueue(adapter->workqueue);
-+
-+ if (adapter->mmioBase)
-+ pci_iounmap(adapter->dev, adapter->mmioBase);
-+
-+ pci_release_regions(adapter->dev);
-+
-+ if (adapter->cmd_map) {
-+ pvscsi_free_sgls(adapter);
-+ kfree(adapter->cmd_map);
-+ }
-+
-+ if (adapter->rings_state)
-+ pci_free_consistent(adapter->dev, PAGE_SIZE,
-+ adapter->rings_state, adapter->ringStatePA);
-+
-+ if (adapter->req_ring)
-+ pci_free_consistent(adapter->dev,
-+ adapter->req_pages * PAGE_SIZE,
-+ adapter->req_ring, adapter->reqRingPA);
-+
-+ if (adapter->cmp_ring)
-+ pci_free_consistent(adapter->dev,
-+ adapter->cmp_pages * PAGE_SIZE,
-+ adapter->cmp_ring, adapter->cmpRingPA);
-+
-+ if (adapter->msg_ring)
-+ pci_free_consistent(adapter->dev,
-+ adapter->msg_pages * PAGE_SIZE,
-+ adapter->msg_ring, adapter->msgRingPA);
-+}
-+
-+/*
-+ * Allocate scatter gather lists.
-+ *
-+ * These are statically allocated. Trying to be clever was not worth it.
-+ *
-+ * Dynamic allocation can fail, and we can't go deeep into the memory
-+ * allocator, since we're a SCSI driver, and trying too hard to allocate
-+ * memory might generate disk I/O. We also don't want to fail disk I/O
-+ * in that case because we can't get an allocation - the I/O could be
-+ * trying to swap out data to free memory. Since that is pathological,
-+ * just use a statically allocated scatter list.
-+ *
-+ */
-+static int __devinit pvscsi_allocate_sg(struct pvscsi_adapter *adapter)
-+{
-+ struct pvscsi_ctx *ctx;
-+ int i;
-+
-+ ctx = adapter->cmd_map;
-+ BUILD_BUG_ON(sizeof(struct pvscsi_sg_list) > SGL_SIZE);
-+
-+ for (i = 0; i < adapter->req_depth; ++i, ++ctx) {
-+ ctx->sgl = kmalloc(SGL_SIZE, GFP_KERNEL);
-+ ctx->sglPA = 0;
-+ BUG_ON(!IS_ALIGNED(((unsigned long)ctx->sgl), PAGE_SIZE));
-+ if (!ctx->sgl) {
-+ for (; i >= 0; --i, --ctx) {
-+ kfree(ctx->sgl);
-+ ctx->sgl = NULL;
-+ }
-+ return -ENOMEM;
-+ }
-+ }
-+
-+ return 0;
-+}
-+
-+static int __devinit pvscsi_probe(struct pci_dev *pdev,
-+ const struct pci_device_id *id)
-+{
-+ struct pvscsi_adapter *adapter;
-+ struct Scsi_Host *host;
-+ unsigned int i;
-+ int error;
-+
-+ error = -ENODEV;
-+
-+ if (pci_enable_device(pdev))
-+ return error;
-+
-+ if (pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) == 0 &&
-+ pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64)) == 0) {
-+ printk(KERN_INFO "vmw_pvscsi: using 64bit dma\n");
-+ } else if (pci_set_dma_mask(pdev, DMA_BIT_MASK(32)) == 0 &&
-+ pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32)) == 0) {
-+ printk(KERN_INFO "vmw_pvscsi: using 32bit dma\n");
-+ } else {
-+ printk(KERN_ERR "vmw_pvscsi: failed to set DMA mask\n");
-+ goto out_disable_device;
-+ }
-+
-+ pvscsi_template.can_queue =
-+ min(PVSCSI_MAX_NUM_PAGES_REQ_RING, pvscsi_ring_pages) *
-+ PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE;
-+ pvscsi_template.cmd_per_lun =
-+ min(pvscsi_template.can_queue, pvscsi_cmd_per_lun);
-+ host = scsi_host_alloc(&pvscsi_template, sizeof(struct pvscsi_adapter));
-+ if (!host) {
-+ printk(KERN_ERR "vmw_pvscsi: failed to allocate host\n");
-+ goto out_disable_device;
-+ }
-+
-+ adapter = shost_priv(host);
-+ memset(adapter, 0, sizeof(*adapter));
-+ adapter->dev = pdev;
-+ adapter->host = host;
-+
-+ spin_lock_init(&adapter->hw_lock);
-+
-+ host->max_channel = 0;
-+ host->max_id = 16;
-+ host->max_lun = 1;
-+ host->max_cmd_len = 16;
-+
-+ adapter->rev = pdev->revision;
-+
-+ if (pci_request_regions(pdev, "vmw_pvscsi")) {
-+ printk(KERN_ERR "vmw_pvscsi: pci memory selection failed\n");
-+ goto out_free_host;
-+ }
-+
-+ for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
-+ if ((pci_resource_flags(pdev, i) & PCI_BASE_ADDRESS_SPACE_IO))
-+ continue;
-+
-+ if (pci_resource_len(pdev, i) < PVSCSI_MEM_SPACE_SIZE)
-+ continue;
-+
-+ break;
-+ }
-+
-+ if (i == DEVICE_COUNT_RESOURCE) {
-+ printk(KERN_ERR
-+ "vmw_pvscsi: adapter has no suitable MMIO region\n");
-+ goto out_release_resources;
-+ }
-+
-+ adapter->mmioBase = pci_iomap(pdev, i, PVSCSI_MEM_SPACE_SIZE);
-+
-+ if (!adapter->mmioBase) {
-+ printk(KERN_ERR
-+ "vmw_pvscsi: can't iomap for BAR %d memsize %lu\n",
-+ i, PVSCSI_MEM_SPACE_SIZE);
-+ goto out_release_resources;
-+ }
-+
-+ pci_set_master(pdev);
-+ pci_set_drvdata(pdev, host);
-+
-+ ll_adapter_reset(adapter);
-+
-+ adapter->use_msg = pvscsi_setup_msg_workqueue(adapter);
-+
-+ error = pvscsi_allocate_rings(adapter);
-+ if (error) {
-+ printk(KERN_ERR "vmw_pvscsi: unable to allocate ring memory\n");
-+ goto out_release_resources;
-+ }
-+
-+ /*
-+ * From this point on we should reset the adapter if anything goes
-+ * wrong.
-+ */
-+ pvscsi_setup_all_rings(adapter);
-+
-+ adapter->cmd_map = kcalloc(adapter->req_depth,
-+ sizeof(struct pvscsi_ctx), GFP_KERNEL);
-+ if (!adapter->cmd_map) {
-+ printk(KERN_ERR "vmw_pvscsi: failed to allocate memory.\n");
-+ error = -ENOMEM;
-+ goto out_reset_adapter;
-+ }
-+
-+ INIT_LIST_HEAD(&adapter->cmd_pool);
-+ for (i = 0; i < adapter->req_depth; i++) {
-+ struct pvscsi_ctx *ctx = adapter->cmd_map + i;
-+ list_add(&ctx->list, &adapter->cmd_pool);
-+ }
-+
-+ error = pvscsi_allocate_sg(adapter);
-+ if (error) {
-+ printk(KERN_ERR "vmw_pvscsi: unable to allocate s/g table\n");
-+ goto out_reset_adapter;
-+ }
-+
-+ if (!pvscsi_disable_msix &&
-+ pvscsi_setup_msix(adapter, &adapter->irq) == 0) {
-+ printk(KERN_INFO "vmw_pvscsi: using MSI-X\n");
-+ adapter->use_msix = 1;
-+ } else if (!pvscsi_disable_msi && pci_enable_msi(pdev) == 0) {
-+ printk(KERN_INFO "vmw_pvscsi: using MSI\n");
-+ adapter->use_msi = 1;
-+ adapter->irq = pdev->irq;
-+ } else {
-+ printk(KERN_INFO "vmw_pvscsi: using INTx\n");
-+ adapter->irq = pdev->irq;
-+ }
-+
-+ error = request_irq(adapter->irq, pvscsi_isr, IRQF_SHARED,
-+ "vmw_pvscsi", adapter);
-+ if (error) {
-+ printk(KERN_ERR
-+ "vmw_pvscsi: unable to request IRQ: %d\n", error);
-+ adapter->irq = 0;
-+ goto out_reset_adapter;
-+ }
-+
-+ error = scsi_add_host(host, &pdev->dev);
-+ if (error) {
-+ printk(KERN_ERR
-+ "vmw_pvscsi: scsi_add_host failed: %d\n", error);
-+ goto out_reset_adapter;
-+ }
-+
-+ dev_info(&pdev->dev, "VMware PVSCSI rev %d host #%u\n",
-+ adapter->rev, host->host_no);
-+
-+ pvscsi_unmask_intr(adapter);
-+
-+ scsi_scan_host(host);
-+
-+ return 0;
-+
-+out_reset_adapter:
-+ ll_adapter_reset(adapter);
-+out_release_resources:
-+ pvscsi_release_resources(adapter);
-+out_free_host:
-+ scsi_host_put(host);
-+out_disable_device:
-+ pci_set_drvdata(pdev, NULL);
-+ pci_disable_device(pdev);
-+
-+ return error;
-+}
-+
-+static void __pvscsi_shutdown(struct pvscsi_adapter *adapter)
-+{
-+ pvscsi_mask_intr(adapter);
-+
-+ if (adapter->workqueue)
-+ flush_workqueue(adapter->workqueue);
-+
-+ pvscsi_shutdown_intr(adapter);
-+
-+ pvscsi_process_request_ring(adapter);
-+ pvscsi_process_completion_ring(adapter);
-+ ll_adapter_reset(adapter);
-+}
-+
-+static void pvscsi_shutdown(struct pci_dev *dev)
-+{
-+ struct Scsi_Host *host = pci_get_drvdata(dev);
-+ struct pvscsi_adapter *adapter = shost_priv(host);
-+
-+ __pvscsi_shutdown(adapter);
-+}
-+
-+static void pvscsi_remove(struct pci_dev *pdev)
-+{
-+ struct Scsi_Host *host = pci_get_drvdata(pdev);
-+ struct pvscsi_adapter *adapter = shost_priv(host);
-+
-+ scsi_remove_host(host);
-+
-+ __pvscsi_shutdown(adapter);
-+ pvscsi_release_resources(adapter);
-+
-+ scsi_host_put(host);
-+
-+ pci_set_drvdata(pdev, NULL);
-+ pci_disable_device(pdev);
-+}
-+
-+static struct pci_driver pvscsi_pci_driver = {
-+ .name = "vmw_pvscsi",
-+ .id_table = pvscsi_pci_tbl,
-+ .probe = pvscsi_probe,
-+ .remove = __devexit_p(pvscsi_remove),
-+ .shutdown = pvscsi_shutdown,
-+};
-+
-+static int __init pvscsi_init(void)
-+{
-+ pr_info("%s - version %s\n",
-+ PVSCSI_LINUX_DRIVER_DESC, PVSCSI_DRIVER_VERSION_STRING);
-+ return pci_register_driver(&pvscsi_pci_driver);
-+}
-+
-+static void __exit pvscsi_exit(void)
-+{
-+ pci_unregister_driver(&pvscsi_pci_driver);
-+}
-+
-+module_init(pvscsi_init);
-+module_exit(pvscsi_exit);
-diff --git a/drivers/scsi/vmw_pvscsi.h b/drivers/scsi/vmw_pvscsi.h
-new file mode 100644
-index 0000000..62e36e7
---- /dev/null
-+++ b/drivers/scsi/vmw_pvscsi.h
-@@ -0,0 +1,397 @@
-+/*
-+ * VMware PVSCSI header file
-+ *
-+ * Copyright (C) 2008-2009, VMware, Inc. All Rights Reserved.
-+ *
-+ * This program is free software; you can redistribute it and/or modify it
-+ * under the terms of the GNU General Public License as published by the
-+ * Free Software Foundation; version 2 of the License and no later version.
-+ *
-+ * This program is distributed in the hope that it will be useful, but
-+ * WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
-+ * NON INFRINGEMENT. See the GNU General Public License for more
-+ * details.
-+ *
-+ * You should have received a copy of the GNU General Public License
-+ * along with this program; if not, write to the Free Software
-+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
-+ *
-+ * Maintained by: Alok N Kataria <akataria@vmware.com>
-+ *
-+ */
-+
-+#ifndef _VMW_PVSCSI_H_
-+#define _VMW_PVSCSI_H_
-+
-+#include <linux/types.h>
-+
-+#define PVSCSI_DRIVER_VERSION_STRING "1.0.1.0-k"
-+
-+#define PVSCSI_MAX_NUM_SG_ENTRIES_PER_SEGMENT 128
-+
-+#define MASK(n) ((1 << (n)) - 1) /* make an n-bit mask */
-+
-+#define PCI_VENDOR_ID_VMWARE 0x15AD
-+#define PCI_DEVICE_ID_VMWARE_PVSCSI 0x07C0
-+
-+/*
-+ * host adapter status/error codes
-+ */
-+enum HostBusAdapterStatus {
-+ BTSTAT_SUCCESS = 0x00, /* CCB complete normally with no errors */
-+ BTSTAT_LINKED_COMMAND_COMPLETED = 0x0a,
-+ BTSTAT_LINKED_COMMAND_COMPLETED_WITH_FLAG = 0x0b,
-+ BTSTAT_DATA_UNDERRUN = 0x0c,
-+ BTSTAT_SELTIMEO = 0x11, /* SCSI selection timeout */
-+ BTSTAT_DATARUN = 0x12, /* data overrun/underrun */
-+ BTSTAT_BUSFREE = 0x13, /* unexpected bus free */
-+ BTSTAT_INVPHASE = 0x14, /* invalid bus phase or sequence requested by target */
-+ BTSTAT_LUNMISMATCH = 0x17, /* linked CCB has different LUN from first CCB */
-+ BTSTAT_SENSFAILED = 0x1b, /* auto request sense failed */
-+ BTSTAT_TAGREJECT = 0x1c, /* SCSI II tagged queueing message rejected by target */
-+ BTSTAT_BADMSG = 0x1d, /* unsupported message received by the host adapter */
-+ BTSTAT_HAHARDWARE = 0x20, /* host adapter hardware failed */
-+ BTSTAT_NORESPONSE = 0x21, /* target did not respond to SCSI ATN, sent a SCSI RST */
-+ BTSTAT_SENTRST = 0x22, /* host adapter asserted a SCSI RST */
-+ BTSTAT_RECVRST = 0x23, /* other SCSI devices asserted a SCSI RST */
-+ BTSTAT_DISCONNECT = 0x24, /* target device reconnected improperly (w/o tag) */
-+ BTSTAT_BUSRESET = 0x25, /* host adapter issued BUS device reset */
-+ BTSTAT_ABORTQUEUE = 0x26, /* abort queue generated */
-+ BTSTAT_HASOFTWARE = 0x27, /* host adapter software error */
-+ BTSTAT_HATIMEOUT = 0x30, /* host adapter hardware timeout error */
-+ BTSTAT_SCSIPARITY = 0x34, /* SCSI parity error detected */
-+};
-+
-+/*
-+ * Register offsets.
-+ *
-+ * These registers are accessible both via i/o space and mm i/o.
-+ */
-+
-+enum PVSCSIRegOffset {
-+ PVSCSI_REG_OFFSET_COMMAND = 0x0,
-+ PVSCSI_REG_OFFSET_COMMAND_DATA = 0x4,
-+ PVSCSI_REG_OFFSET_COMMAND_STATUS = 0x8,
-+ PVSCSI_REG_OFFSET_LAST_STS_0 = 0x100,
-+ PVSCSI_REG_OFFSET_LAST_STS_1 = 0x104,
-+ PVSCSI_REG_OFFSET_LAST_STS_2 = 0x108,
-+ PVSCSI_REG_OFFSET_LAST_STS_3 = 0x10c,
-+ PVSCSI_REG_OFFSET_INTR_STATUS = 0x100c,
-+ PVSCSI_REG_OFFSET_INTR_MASK = 0x2010,
-+ PVSCSI_REG_OFFSET_KICK_NON_RW_IO = 0x3014,
-+ PVSCSI_REG_OFFSET_DEBUG = 0x3018,
-+ PVSCSI_REG_OFFSET_KICK_RW_IO = 0x4018,
-+};
-+
-+/*
-+ * Virtual h/w commands.
-+ */
-+
-+enum PVSCSICommands {
-+ PVSCSI_CMD_FIRST = 0, /* has to be first */
-+
-+ PVSCSI_CMD_ADAPTER_RESET = 1,
-+ PVSCSI_CMD_ISSUE_SCSI = 2,
-+ PVSCSI_CMD_SETUP_RINGS = 3,
-+ PVSCSI_CMD_RESET_BUS = 4,
-+ PVSCSI_CMD_RESET_DEVICE = 5,
-+ PVSCSI_CMD_ABORT_CMD = 6,
-+ PVSCSI_CMD_CONFIG = 7,
-+ PVSCSI_CMD_SETUP_MSG_RING = 8,
-+ PVSCSI_CMD_DEVICE_UNPLUG = 9,
-+
-+ PVSCSI_CMD_LAST = 10 /* has to be last */
-+};
-+
-+/*
-+ * Command descriptor for PVSCSI_CMD_RESET_DEVICE --
-+ */
-+
-+struct PVSCSICmdDescResetDevice {
-+ u32 target;
-+ u8 lun[8];
-+} __packed;
-+
-+/*
-+ * Command descriptor for PVSCSI_CMD_ABORT_CMD --
-+ *
-+ * - currently does not support specifying the LUN.
-+ * - _pad should be 0.
-+ */
-+
-+struct PVSCSICmdDescAbortCmd {
-+ u64 context;
-+ u32 target;
-+ u32 _pad;
-+} __packed;
-+
-+/*
-+ * Command descriptor for PVSCSI_CMD_SETUP_RINGS --
-+ *
-+ * Notes:
-+ * - reqRingNumPages and cmpRingNumPages need to be power of two.
-+ * - reqRingNumPages and cmpRingNumPages need to be different from 0,
-+ * - reqRingNumPages and cmpRingNumPages need to be inferior to
-+ * PVSCSI_SETUP_RINGS_MAX_NUM_PAGES.
-+ */
-+
-+#define PVSCSI_SETUP_RINGS_MAX_NUM_PAGES 32
-+struct PVSCSICmdDescSetupRings {
-+ u32 reqRingNumPages;
-+ u32 cmpRingNumPages;
-+ u64 ringsStatePPN;
-+ u64 reqRingPPNs[PVSCSI_SETUP_RINGS_MAX_NUM_PAGES];
-+ u64 cmpRingPPNs[PVSCSI_SETUP_RINGS_MAX_NUM_PAGES];
-+} __packed;
-+
-+/*
-+ * Command descriptor for PVSCSI_CMD_SETUP_MSG_RING --
-+ *
-+ * Notes:
-+ * - this command was not supported in the initial revision of the h/w
-+ * interface. Before using it, you need to check that it is supported by
-+ * writing PVSCSI_CMD_SETUP_MSG_RING to the 'command' register, then
-+ * immediately after read the 'command status' register:
-+ * * a value of -1 means that the cmd is NOT supported,
-+ * * a value != -1 means that the cmd IS supported.
-+ * If it's supported the 'command status' register should return:
-+ * sizeof(PVSCSICmdDescSetupMsgRing) / sizeof(u32).
-+ * - this command should be issued _after_ the usual SETUP_RINGS so that the
-+ * RingsState page is already setup. If not, the command is a nop.
-+ * - numPages needs to be a power of two,
-+ * - numPages needs to be different from 0,
-+ * - _pad should be zero.
-+ */
-+
-+#define PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES 16
-+
-+struct PVSCSICmdDescSetupMsgRing {
-+ u32 numPages;
-+ u32 _pad;
-+ u64 ringPPNs[PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES];
-+} __packed;
-+
-+enum PVSCSIMsgType {
-+ PVSCSI_MSG_DEV_ADDED = 0,
-+ PVSCSI_MSG_DEV_REMOVED = 1,
-+ PVSCSI_MSG_LAST = 2,
-+};
-+
-+/*
-+ * Msg descriptor.
-+ *
-+ * sizeof(struct PVSCSIRingMsgDesc) == 128.
-+ *
-+ * - type is of type enum PVSCSIMsgType.
-+ * - the content of args depend on the type of event being delivered.
-+ */
-+
-+struct PVSCSIRingMsgDesc {
-+ u32 type;
-+ u32 args[31];
-+} __packed;
-+
-+struct PVSCSIMsgDescDevStatusChanged {
-+ u32 type; /* PVSCSI_MSG_DEV _ADDED / _REMOVED */
-+ u32 bus;
-+ u32 target;
-+ u8 lun[8];
-+ u32 pad[27];
-+} __packed;
-+
-+/*
-+ * Rings state.
-+ *
-+ * - the fields:
-+ * . msgProdIdx,
-+ * . msgConsIdx,
-+ * . msgNumEntriesLog2,
-+ * .. are only used once the SETUP_MSG_RING cmd has been issued.
-+ * - '_pad' helps to ensure that the msg related fields are on their own
-+ * cache-line.
-+ */
-+
-+struct PVSCSIRingsState {
-+ u32 reqProdIdx;
-+ u32 reqConsIdx;
-+ u32 reqNumEntriesLog2;
-+
-+ u32 cmpProdIdx;
-+ u32 cmpConsIdx;
-+ u32 cmpNumEntriesLog2;
-+
-+ u8 _pad[104];
-+
-+ u32 msgProdIdx;
-+ u32 msgConsIdx;
-+ u32 msgNumEntriesLog2;
-+} __packed;
-+
-+/*
-+ * Request descriptor.
-+ *
-+ * sizeof(RingReqDesc) = 128
-+ *
-+ * - context: is a unique identifier of a command. It could normally be any
-+ * 64bit value, however we currently store it in the serialNumber variable
-+ * of struct SCSI_Command, so we have the following restrictions due to the
-+ * way this field is handled in the vmkernel storage stack:
-+ * * this value can't be 0,
-+ * * the upper 32bit need to be 0 since serialNumber is as a u32.
-+ * Currently tracked as PR 292060.
-+ * - dataLen: contains the total number of bytes that need to be transferred.
-+ * - dataAddr:
-+ * * if PVSCSI_FLAG_CMD_WITH_SG_LIST is set: dataAddr is the PA of the first
-+ * s/g table segment, each s/g segment is entirely contained on a single
-+ * page of physical memory,
-+ * * if PVSCSI_FLAG_CMD_WITH_SG_LIST is NOT set, then dataAddr is the PA of
-+ * the buffer used for the DMA transfer,
-+ * - flags:
-+ * * PVSCSI_FLAG_CMD_WITH_SG_LIST: see dataAddr above,
-+ * * PVSCSI_FLAG_CMD_DIR_NONE: no DMA involved,
-+ * * PVSCSI_FLAG_CMD_DIR_TOHOST: transfer from device to main memory,
-+ * * PVSCSI_FLAG_CMD_DIR_TODEVICE: transfer from main memory to device,
-+ * * PVSCSI_FLAG_CMD_OUT_OF_BAND_CDB: reserved to handle CDBs larger than
-+ * 16bytes. To be specified.
-+ * - vcpuHint: vcpuId of the processor that will be most likely waiting for the
-+ * completion of the i/o. For guest OSes that use lowest priority message
-+ * delivery mode (such as windows), we use this "hint" to deliver the
-+ * completion action to the proper vcpu. For now, we can use the vcpuId of
-+ * the processor that initiated the i/o as a likely candidate for the vcpu
-+ * that will be waiting for the completion..
-+ * - bus should be 0: we currently only support bus 0 for now.
-+ * - unused should be zero'd.
-+ */
-+
-+#define PVSCSI_FLAG_CMD_WITH_SG_LIST (1 << 0)
-+#define PVSCSI_FLAG_CMD_OUT_OF_BAND_CDB (1 << 1)
-+#define PVSCSI_FLAG_CMD_DIR_NONE (1 << 2)
-+#define PVSCSI_FLAG_CMD_DIR_TOHOST (1 << 3)
-+#define PVSCSI_FLAG_CMD_DIR_TODEVICE (1 << 4)
-+
-+struct PVSCSIRingReqDesc {
-+ u64 context;
-+ u64 dataAddr;
-+ u64 dataLen;
-+ u64 senseAddr;
-+ u32 senseLen;
-+ u32 flags;
-+ u8 cdb[16];
-+ u8 cdbLen;
-+ u8 lun[8];
-+ u8 tag;
-+ u8 bus;
-+ u8 target;
-+ u8 vcpuHint;
-+ u8 unused[59];
-+} __packed;
-+
-+/*
-+ * Scatter-gather list management.
-+ *
-+ * As described above, when PVSCSI_FLAG_CMD_WITH_SG_LIST is set in the
-+ * RingReqDesc.flags, then RingReqDesc.dataAddr is the PA of the first s/g
-+ * table segment.
-+ *
-+ * - each segment of the s/g table contain a succession of struct
-+ * PVSCSISGElement.
-+ * - each segment is entirely contained on a single physical page of memory.
-+ * - a "chain" s/g element has the flag PVSCSI_SGE_FLAG_CHAIN_ELEMENT set in
-+ * PVSCSISGElement.flags and in this case:
-+ * * addr is the PA of the next s/g segment,
-+ * * length is undefined, assumed to be 0.
-+ */
-+
-+struct PVSCSISGElement {
-+ u64 addr;
-+ u32 length;
-+ u32 flags;
-+} __packed;
-+
-+/*
-+ * Completion descriptor.
-+ *
-+ * sizeof(RingCmpDesc) = 32
-+ *
-+ * - context: identifier of the command. The same thing that was specified
-+ * under "context" as part of struct RingReqDesc at initiation time,
-+ * - dataLen: number of bytes transferred for the actual i/o operation,
-+ * - senseLen: number of bytes written into the sense buffer,
-+ * - hostStatus: adapter status,
-+ * - scsiStatus: device status,
-+ * - _pad should be zero.
-+ */
-+
-+struct PVSCSIRingCmpDesc {
-+ u64 context;
-+ u64 dataLen;
-+ u32 senseLen;
-+ u16 hostStatus;
-+ u16 scsiStatus;
-+ u32 _pad[2];
-+} __packed;
-+
-+/*
-+ * Interrupt status / IRQ bits.
-+ */
-+
-+#define PVSCSI_INTR_CMPL_0 (1 << 0)
-+#define PVSCSI_INTR_CMPL_1 (1 << 1)
-+#define PVSCSI_INTR_CMPL_MASK MASK(2)
-+
-+#define PVSCSI_INTR_MSG_0 (1 << 2)
-+#define PVSCSI_INTR_MSG_1 (1 << 3)
-+#define PVSCSI_INTR_MSG_MASK (MASK(2) << 2)
-+
-+#define PVSCSI_INTR_ALL_SUPPORTED MASK(4)
-+
-+/*
-+ * Number of MSI-X vectors supported.
-+ */
-+#define PVSCSI_MAX_INTRS 24
-+
-+/*
-+ * Enumeration of supported MSI-X vectors
-+ */
-+#define PVSCSI_VECTOR_COMPLETION 0
-+
-+/*
-+ * Misc constants for the rings.
-+ */
-+
-+#define PVSCSI_MAX_NUM_PAGES_REQ_RING PVSCSI_SETUP_RINGS_MAX_NUM_PAGES
-+#define PVSCSI_MAX_NUM_PAGES_CMP_RING PVSCSI_SETUP_RINGS_MAX_NUM_PAGES
-+#define PVSCSI_MAX_NUM_PAGES_MSG_RING PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES
-+
-+#define PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE \
-+ (PAGE_SIZE / sizeof(struct PVSCSIRingReqDesc))
-+
-+#define PVSCSI_MAX_REQ_QUEUE_DEPTH \
-+ (PVSCSI_MAX_NUM_PAGES_REQ_RING * PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE)
-+
-+#define PVSCSI_MEM_SPACE_COMMAND_NUM_PAGES 1
-+#define PVSCSI_MEM_SPACE_INTR_STATUS_NUM_PAGES 1
-+#define PVSCSI_MEM_SPACE_MISC_NUM_PAGES 2
-+#define PVSCSI_MEM_SPACE_KICK_IO_NUM_PAGES 2
-+#define PVSCSI_MEM_SPACE_MSIX_NUM_PAGES 2
-+
-+enum PVSCSIMemSpace {
-+ PVSCSI_MEM_SPACE_COMMAND_PAGE = 0,
-+ PVSCSI_MEM_SPACE_INTR_STATUS_PAGE = 1,
-+ PVSCSI_MEM_SPACE_MISC_PAGE = 2,
-+ PVSCSI_MEM_SPACE_KICK_IO_PAGE = 4,
-+ PVSCSI_MEM_SPACE_MSIX_TABLE_PAGE = 6,
-+ PVSCSI_MEM_SPACE_MSIX_PBA_PAGE = 7,
-+};
-+
-+#define PVSCSI_MEM_SPACE_NUM_PAGES \
-+ (PVSCSI_MEM_SPACE_COMMAND_NUM_PAGES + \
-+ PVSCSI_MEM_SPACE_INTR_STATUS_NUM_PAGES + \
-+ PVSCSI_MEM_SPACE_MISC_NUM_PAGES + \
-+ PVSCSI_MEM_SPACE_KICK_IO_NUM_PAGES + \
-+ PVSCSI_MEM_SPACE_MSIX_NUM_PAGES)
-+
-+#define PVSCSI_MEM_SPACE_SIZE (PVSCSI_MEM_SPACE_NUM_PAGES * PAGE_SIZE)
-+
-+#endif /* _VMW_PVSCSI_H_ */
-diff --git a/drivers/serial/kgdboc.c b/drivers/serial/kgdboc.c
-index eadc1ab..2d81457 100644
---- a/drivers/serial/kgdboc.c
-+++ b/drivers/serial/kgdboc.c
-@@ -18,7 +18,7 @@
-
- #define MAX_CONFIG_LEN 40
-
--static struct kgdb_io kgdboc_io_ops;
-+static const struct kgdb_io kgdboc_io_ops;
-
- /* -1 = init not run yet, 0 = unconfigured, 1 = configured. */
- static int configured = -1;
-@@ -154,7 +154,7 @@ static void kgdboc_post_exp_handler(void)
- module_put(THIS_MODULE);
- }
-
--static struct kgdb_io kgdboc_io_ops = {
-+static const struct kgdb_io kgdboc_io_ops = {
- .name = "kgdboc",
- .read_char = kgdboc_get_char,
- .write_char = kgdboc_put_char,
-diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
-index b76f246..7f41af7 100644
---- a/drivers/spi/spi.c
-+++ b/drivers/spi/spi.c
-@@ -774,7 +774,7 @@ int spi_sync(struct spi_device *spi, struct spi_message *message)
- EXPORT_SYMBOL_GPL(spi_sync);
-
- /* portable code must never pass more than 32 bytes */
--#define SPI_BUFSIZ max(32,SMP_CACHE_BYTES)
-+#define SPI_BUFSIZ max(32U,SMP_CACHE_BYTES)
-
- static u8 *buf;
-
-diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c
-index b9b37ff..19dfa23 100644
---- a/drivers/staging/android/binder.c
-+++ b/drivers/staging/android/binder.c
-@@ -2761,7 +2761,7 @@ static void binder_vma_close(struct vm_area_struct *vma)
- binder_defer_work(proc, BINDER_DEFERRED_PUT_FILES);
- }
-
--static struct vm_operations_struct binder_vm_ops = {
-+static const struct vm_operations_struct binder_vm_ops = {
- .open = binder_vma_open,
- .close = binder_vma_close,
- };
-diff --git a/drivers/staging/b3dfg/b3dfg.c b/drivers/staging/b3dfg/b3dfg.c
-index cda26bb4..39fed3f 100644
---- a/drivers/staging/b3dfg/b3dfg.c
-+++ b/drivers/staging/b3dfg/b3dfg.c
-@@ -455,7 +455,7 @@ static int b3dfg_vma_fault(struct vm_area_struct *vma,
- return VM_FAULT_NOPAGE;
- }
-
--static struct vm_operations_struct b3dfg_vm_ops = {
-+static const struct vm_operations_struct b3dfg_vm_ops = {
- .fault = b3dfg_vma_fault,
- };
-
-@@ -848,7 +848,7 @@ static int b3dfg_mmap(struct file *filp, struct vm_area_struct *vma)
- return r;
- }
-
--static struct file_operations b3dfg_fops = {
-+static const struct file_operations b3dfg_fops = {
- .owner = THIS_MODULE,
- .open = b3dfg_open,
- .release = b3dfg_release,
-diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
-index 90810e8..e0b398d 100644
---- a/drivers/staging/comedi/comedi_fops.c
-+++ b/drivers/staging/comedi/comedi_fops.c
-@@ -1388,7 +1388,7 @@ void comedi_unmap(struct vm_area_struct *area)
- mutex_unlock(&dev->mutex);
- }
-
--static struct vm_operations_struct comedi_vm_ops = {
-+static const struct vm_operations_struct comedi_vm_ops = {
- .close = comedi_unmap,
- };
-
-diff --git a/drivers/staging/dream/qdsp5/adsp_driver.c b/drivers/staging/dream/qdsp5/adsp_driver.c
-index e55a0db..577b776 100644
---- a/drivers/staging/dream/qdsp5/adsp_driver.c
-+++ b/drivers/staging/dream/qdsp5/adsp_driver.c
-@@ -576,7 +576,7 @@ static struct adsp_device *inode_to_device(struct inode *inode)
- static dev_t adsp_devno;
- static struct class *adsp_class;
-
--static struct file_operations adsp_fops = {
-+static const struct file_operations adsp_fops = {
- .owner = THIS_MODULE,
- .open = adsp_open,
- .unlocked_ioctl = adsp_ioctl,
-diff --git a/drivers/staging/dream/qdsp5/audio_aac.c b/drivers/staging/dream/qdsp5/audio_aac.c
-index ad2390f..4116ee8 100644
---- a/drivers/staging/dream/qdsp5/audio_aac.c
-+++ b/drivers/staging/dream/qdsp5/audio_aac.c
-@@ -1022,7 +1022,7 @@ done:
- return rc;
- }
-
--static struct file_operations audio_aac_fops = {
-+static const struct file_operations audio_aac_fops = {
- .owner = THIS_MODULE,
- .open = audio_open,
- .release = audio_release,
-diff --git a/drivers/staging/dream/qdsp5/audio_amrnb.c b/drivers/staging/dream/qdsp5/audio_amrnb.c
-index cd818a5..870b37b 100644
---- a/drivers/staging/dream/qdsp5/audio_amrnb.c
-+++ b/drivers/staging/dream/qdsp5/audio_amrnb.c
-@@ -833,7 +833,7 @@ done:
- return rc;
- }
-
--static struct file_operations audio_amrnb_fops = {
-+static const struct file_operations audio_amrnb_fops = {
- .owner = THIS_MODULE,
- .open = audamrnb_open,
- .release = audamrnb_release,
-diff --git a/drivers/staging/dream/qdsp5/audio_evrc.c b/drivers/staging/dream/qdsp5/audio_evrc.c
-index 4b43e18..cedafda 100644
---- a/drivers/staging/dream/qdsp5/audio_evrc.c
-+++ b/drivers/staging/dream/qdsp5/audio_evrc.c
-@@ -805,7 +805,7 @@ dma_fail:
- return rc;
- }
-
--static struct file_operations audio_evrc_fops = {
-+static const struct file_operations audio_evrc_fops = {
- .owner = THIS_MODULE,
- .open = audevrc_open,
- .release = audevrc_release,
-diff --git a/drivers/staging/dream/qdsp5/audio_in.c b/drivers/staging/dream/qdsp5/audio_in.c
-index 3d950a2..9431118 100644
---- a/drivers/staging/dream/qdsp5/audio_in.c
-+++ b/drivers/staging/dream/qdsp5/audio_in.c
-@@ -913,7 +913,7 @@ static int audpre_open(struct inode *inode, struct file *file)
- return 0;
- }
-
--static struct file_operations audio_fops = {
-+static const struct file_operations audio_fops = {
- .owner = THIS_MODULE,
- .open = audio_in_open,
- .release = audio_in_release,
-@@ -922,7 +922,7 @@ static struct file_operations audio_fops = {
- .unlocked_ioctl = audio_in_ioctl,
- };
-
--static struct file_operations audpre_fops = {
-+static const struct file_operations audpre_fops = {
- .owner = THIS_MODULE,
- .open = audpre_open,
- .unlocked_ioctl = audpre_ioctl,
-diff --git a/drivers/staging/dream/qdsp5/audio_mp3.c b/drivers/staging/dream/qdsp5/audio_mp3.c
-index b95574f..286c2f4 100644
---- a/drivers/staging/dream/qdsp5/audio_mp3.c
-+++ b/drivers/staging/dream/qdsp5/audio_mp3.c
-@@ -941,7 +941,7 @@ done:
- return rc;
- }
-
--static struct file_operations audio_mp3_fops = {
-+static const struct file_operations audio_mp3_fops = {
- .owner = THIS_MODULE,
- .open = audio_open,
- .release = audio_release,
-diff --git a/drivers/staging/dream/qdsp5/audio_out.c b/drivers/staging/dream/qdsp5/audio_out.c
-index d1adcf6..f8f9833 100644
---- a/drivers/staging/dream/qdsp5/audio_out.c
-+++ b/drivers/staging/dream/qdsp5/audio_out.c
-@@ -810,7 +810,7 @@ static int audpp_open(struct inode *inode, struct file *file)
- return 0;
- }
-
--static struct file_operations audio_fops = {
-+static const struct file_operations audio_fops = {
- .owner = THIS_MODULE,
- .open = audio_open,
- .release = audio_release,
-@@ -819,7 +819,7 @@ static struct file_operations audio_fops = {
- .unlocked_ioctl = audio_ioctl,
- };
-
--static struct file_operations audpp_fops = {
-+static const struct file_operations audpp_fops = {
- .owner = THIS_MODULE,
- .open = audpp_open,
- .unlocked_ioctl = audpp_ioctl,
-diff --git a/drivers/staging/dream/qdsp5/audio_qcelp.c b/drivers/staging/dream/qdsp5/audio_qcelp.c
-index f0f50e3..f6b9dbc 100644
---- a/drivers/staging/dream/qdsp5/audio_qcelp.c
-+++ b/drivers/staging/dream/qdsp5/audio_qcelp.c
-@@ -816,7 +816,7 @@ err:
- return rc;
- }
-
--static struct file_operations audio_qcelp_fops = {
-+static const struct file_operations audio_qcelp_fops = {
- .owner = THIS_MODULE,
- .open = audqcelp_open,
- .release = audqcelp_release,
-diff --git a/drivers/staging/dream/qdsp5/snd.c b/drivers/staging/dream/qdsp5/snd.c
-index 037d7ff..5469ec3 100644
---- a/drivers/staging/dream/qdsp5/snd.c
-+++ b/drivers/staging/dream/qdsp5/snd.c
-@@ -242,7 +242,7 @@ err:
- return rc;
- }
-
--static struct file_operations snd_fops = {
-+static const struct file_operations snd_fops = {
- .owner = THIS_MODULE,
- .open = snd_open,
- .release = snd_release,
-diff --git a/drivers/staging/dream/smd/smd_qmi.c b/drivers/staging/dream/smd/smd_qmi.c
-index d4e7d88..0ea632a 100644
---- a/drivers/staging/dream/smd/smd_qmi.c
-+++ b/drivers/staging/dream/smd/smd_qmi.c
-@@ -793,7 +793,7 @@ static int qmi_release(struct inode *ip, struct file *fp)
- return 0;
- }
-
--static struct file_operations qmi_fops = {
-+static const struct file_operations qmi_fops = {
- .owner = THIS_MODULE,
- .read = qmi_read,
- .write = qmi_write,
-diff --git a/drivers/staging/dream/smd/smd_rpcrouter_device.c b/drivers/staging/dream/smd/smd_rpcrouter_device.c
-index cd3910b..ff053d3 100644
---- a/drivers/staging/dream/smd/smd_rpcrouter_device.c
-+++ b/drivers/staging/dream/smd/smd_rpcrouter_device.c
-@@ -214,7 +214,7 @@ static long rpcrouter_ioctl(struct file *filp, unsigned int cmd,
- return rc;
- }
-
--static struct file_operations rpcrouter_server_fops = {
-+static const struct file_operations rpcrouter_server_fops = {
- .owner = THIS_MODULE,
- .open = rpcrouter_open,
- .release = rpcrouter_release,
-@@ -224,7 +224,7 @@ static struct file_operations rpcrouter_server_fops = {
- .unlocked_ioctl = rpcrouter_ioctl,
- };
-
--static struct file_operations rpcrouter_router_fops = {
-+static const struct file_operations rpcrouter_router_fops = {
- .owner = THIS_MODULE,
- .open = rpcrouter_open,
- .release = rpcrouter_release,
-diff --git a/drivers/staging/dst/dcore.c b/drivers/staging/dst/dcore.c
-index c24e4e0..629999b 100644
---- a/drivers/staging/dst/dcore.c
-+++ b/drivers/staging/dst/dcore.c
-@@ -149,7 +149,7 @@ static int dst_bdev_release(struct gendisk *disk, fmode_t mode)
- return 0;
- }
-
--static struct block_device_operations dst_blk_ops = {
-+static const struct block_device_operations dst_blk_ops = {
- .open = dst_bdev_open,
- .release = dst_bdev_release,
- .owner = THIS_MODULE,
-@@ -588,7 +588,7 @@ static struct dst_node *dst_alloc_node(struct dst_ctl *ctl,
- n->size = ctl->size;
-
- atomic_set(&n->refcnt, 1);
-- atomic_long_set(&n->gen, 0);
-+ atomic_long_set_unchecked(&n->gen, 0);
- snprintf(n->name, sizeof(n->name), "%s", ctl->name);
-
- err = dst_node_sysfs_init(n);
-@@ -855,7 +855,7 @@ static void cn_dst_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
- struct dst_node *n = NULL, *tmp;
- unsigned int hash;
-
-- if (!cap_raised(nsp->eff_cap, CAP_SYS_ADMIN)) {
-+ if (!capable(CAP_SYS_ADMIN)) {
- err = -EPERM;
- goto out;
- }
-diff --git a/drivers/staging/dst/trans.c b/drivers/staging/dst/trans.c
-index 557d372..8d84422 100644
---- a/drivers/staging/dst/trans.c
-+++ b/drivers/staging/dst/trans.c
-@@ -169,7 +169,7 @@ int dst_process_bio(struct dst_node *n, struct bio *bio)
- t->error = 0;
- t->retries = 0;
- atomic_set(&t->refcnt, 1);
-- t->gen = atomic_long_inc_return(&n->gen);
-+ t->gen = atomic_long_inc_return_unchecked(&n->gen);
-
- t->enc = bio_data_dir(bio);
- dst_bio_to_cmd(bio, &t->cmd, DST_IO, t->gen);
-diff --git a/drivers/staging/et131x/et1310_tx.c b/drivers/staging/et131x/et1310_tx.c
-index 94f7752..d051514 100644
---- a/drivers/staging/et131x/et1310_tx.c
-+++ b/drivers/staging/et131x/et1310_tx.c
-@@ -710,11 +710,11 @@ inline void et131x_free_send_packet(struct et131x_adapter *etdev,
- struct net_device_stats *stats = &etdev->net_stats;
-
- if (pMpTcb->Flags & fMP_DEST_BROAD)
-- atomic_inc(&etdev->Stats.brdcstxmt);
-+ atomic_inc_unchecked(&etdev->Stats.brdcstxmt);
- else if (pMpTcb->Flags & fMP_DEST_MULTI)
-- atomic_inc(&etdev->Stats.multixmt);
-+ atomic_inc_unchecked(&etdev->Stats.multixmt);
- else
-- atomic_inc(&etdev->Stats.unixmt);
-+ atomic_inc_unchecked(&etdev->Stats.unixmt);
-
- if (pMpTcb->Packet) {
- stats->tx_bytes += pMpTcb->Packet->len;
-diff --git a/drivers/staging/et131x/et131x_adapter.h b/drivers/staging/et131x/et131x_adapter.h
-index 1dfe06f..f469b4d 100644
---- a/drivers/staging/et131x/et131x_adapter.h
-+++ b/drivers/staging/et131x/et131x_adapter.h
-@@ -145,11 +145,11 @@ typedef struct _ce_stats_t {
- * operations
- */
- u32 unircv; /* # multicast packets received */
-- atomic_t unixmt; /* # multicast packets for Tx */
-+ atomic_unchecked_t unixmt; /* # multicast packets for Tx */
- u32 multircv; /* # multicast packets received */
-- atomic_t multixmt; /* # multicast packets for Tx */
-+ atomic_unchecked_t multixmt; /* # multicast packets for Tx */
- u32 brdcstrcv; /* # broadcast packets received */
-- atomic_t brdcstxmt; /* # broadcast packets for Tx */
-+ atomic_unchecked_t brdcstxmt; /* # broadcast packets for Tx */
- u32 norcvbuf; /* # Rx packets discarded */
- u32 noxmtbuf; /* # Tx packets discarded */
-
-diff --git a/drivers/staging/go7007/go7007-v4l2.c b/drivers/staging/go7007/go7007-v4l2.c
-index 4bd353a..e28f455 100644
---- a/drivers/staging/go7007/go7007-v4l2.c
-+++ b/drivers/staging/go7007/go7007-v4l2.c
-@@ -1700,7 +1700,7 @@ static int go7007_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
- return 0;
- }
-
--static struct vm_operations_struct go7007_vm_ops = {
-+static const struct vm_operations_struct go7007_vm_ops = {
- .open = go7007_vm_open,
- .close = go7007_vm_close,
- .fault = go7007_vm_fault,
-diff --git a/drivers/staging/hv/Channel.c b/drivers/staging/hv/Channel.c
-index 366dc95..b974d87 100644
---- a/drivers/staging/hv/Channel.c
-+++ b/drivers/staging/hv/Channel.c
-@@ -464,8 +464,8 @@ int VmbusChannelEstablishGpadl(struct vmbus_channel *Channel, void *Kbuffer,
-
- DPRINT_ENTER(VMBUS);
-
-- nextGpadlHandle = atomic_read(&gVmbusConnection.NextGpadlHandle);
-- atomic_inc(&gVmbusConnection.NextGpadlHandle);
-+ nextGpadlHandle = atomic_read_unchecked(&gVmbusConnection.NextGpadlHandle);
-+ atomic_inc_unchecked(&gVmbusConnection.NextGpadlHandle);
-
- VmbusChannelCreateGpadlHeader(Kbuffer, Size, &msgInfo, &msgCount);
- ASSERT(msgInfo != NULL);
-diff --git a/drivers/staging/hv/Hv.c b/drivers/staging/hv/Hv.c
-index b12237f..01ae28a 100644
---- a/drivers/staging/hv/Hv.c
-+++ b/drivers/staging/hv/Hv.c
-@@ -161,7 +161,7 @@ static u64 HvDoHypercall(u64 Control, void *Input, void *Output)
- u64 outputAddress = (Output) ? virt_to_phys(Output) : 0;
- u32 outputAddressHi = outputAddress >> 32;
- u32 outputAddressLo = outputAddress & 0xFFFFFFFF;
-- volatile void *hypercallPage = gHvContext.HypercallPage;
-+ volatile void *hypercallPage = ktva_ktla(gHvContext.HypercallPage);
-
- DPRINT_DBG(VMBUS, "Hypercall <control %llx input %p output %p>",
- Control, Input, Output);
-diff --git a/drivers/staging/hv/VmbusApi.h b/drivers/staging/hv/VmbusApi.h
-index d089bb1..2ebc158 100644
---- a/drivers/staging/hv/VmbusApi.h
-+++ b/drivers/staging/hv/VmbusApi.h
-@@ -109,7 +109,7 @@ struct vmbus_channel_interface {
- u32 *GpadlHandle);
- int (*TeardownGpadl)(struct hv_device *device, u32 GpadlHandle);
- void (*GetInfo)(struct hv_device *dev, struct hv_device_info *devinfo);
--};
-+} __no_const;
-
- /* Base driver object */
- struct hv_driver {
-diff --git a/drivers/staging/hv/VmbusPrivate.h b/drivers/staging/hv/VmbusPrivate.h
-index 5a37cce..6ecc88c 100644
---- a/drivers/staging/hv/VmbusPrivate.h
-+++ b/drivers/staging/hv/VmbusPrivate.h
-@@ -59,7 +59,7 @@ enum VMBUS_CONNECT_STATE {
- struct VMBUS_CONNECTION {
- enum VMBUS_CONNECT_STATE ConnectState;
-
-- atomic_t NextGpadlHandle;
-+ atomic_unchecked_t NextGpadlHandle;
-
- /*
- * Represents channel interrupts. Each bit position represents a
-diff --git a/drivers/staging/hv/blkvsc_drv.c b/drivers/staging/hv/blkvsc_drv.c
-index 871a202..ca50ddf 100644
---- a/drivers/staging/hv/blkvsc_drv.c
-+++ b/drivers/staging/hv/blkvsc_drv.c
-@@ -153,7 +153,7 @@ static int blkvsc_ringbuffer_size = BLKVSC_RING_BUFFER_SIZE;
- /* The one and only one */
- static struct blkvsc_driver_context g_blkvsc_drv;
-
--static struct block_device_operations block_ops = {
-+static const struct block_device_operations block_ops = {
- .owner = THIS_MODULE,
- .open = blkvsc_open,
- .release = blkvsc_release,
-diff --git a/drivers/staging/hv/vmbus_drv.c b/drivers/staging/hv/vmbus_drv.c
-index 6acc49a..fbc8d46 100644
---- a/drivers/staging/hv/vmbus_drv.c
-+++ b/drivers/staging/hv/vmbus_drv.c
-@@ -532,7 +532,7 @@ static int vmbus_child_device_register(struct hv_device *root_device_obj,
- to_device_context(root_device_obj);
- struct device_context *child_device_ctx =
- to_device_context(child_device_obj);
-- static atomic_t device_num = ATOMIC_INIT(0);
-+ static atomic_unchecked_t device_num = ATOMIC_INIT(0);
-
- DPRINT_ENTER(VMBUS_DRV);
-
-@@ -541,7 +541,7 @@ static int vmbus_child_device_register(struct hv_device *root_device_obj,
-
- /* Set the device name. Otherwise, device_register() will fail. */
- dev_set_name(&child_device_ctx->device, "vmbus_0_%d",
-- atomic_inc_return(&device_num));
-+ atomic_inc_return_unchecked(&device_num));
-
- /* The new device belongs to this bus */
- child_device_ctx->device.bus = &g_vmbus_drv.bus; /* device->dev.bus; */
-diff --git a/drivers/staging/iio/ring_generic.h b/drivers/staging/iio/ring_generic.h
-index d926189..17b19fd 100644
---- a/drivers/staging/iio/ring_generic.h
-+++ b/drivers/staging/iio/ring_generic.h
-@@ -87,7 +87,7 @@ struct iio_ring_access_funcs {
-
- int (*is_enabled)(struct iio_ring_buffer *ring);
- int (*enable)(struct iio_ring_buffer *ring);
--};
-+} __no_const;
-
- /**
- * struct iio_ring_buffer - general ring buffer structure
-diff --git a/drivers/staging/octeon/ethernet-rx.c b/drivers/staging/octeon/ethernet-rx.c
-index 1b237b7..88c624e 100644
---- a/drivers/staging/octeon/ethernet-rx.c
-+++ b/drivers/staging/octeon/ethernet-rx.c
-@@ -406,11 +406,11 @@ void cvm_oct_tasklet_rx(unsigned long unused)
- /* Increment RX stats for virtual ports */
- if (work->ipprt >= CVMX_PIP_NUM_INPUT_PORTS) {
- #ifdef CONFIG_64BIT
-- atomic64_add(1, (atomic64_t *)&priv->stats.rx_packets);
-- atomic64_add(skb->len, (atomic64_t *)&priv->stats.rx_bytes);
-+ atomic64_add_unchecked(1, (atomic64_unchecked_t *)&priv->stats.rx_packets);
-+ atomic64_add_unchecked(skb->len, (atomic64_unchecked_t *)&priv->stats.rx_bytes);
- #else
-- atomic_add(1, (atomic_t *)&priv->stats.rx_packets);
-- atomic_add(skb->len, (atomic_t *)&priv->stats.rx_bytes);
-+ atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_packets);
-+ atomic_add_unchecked(skb->len, (atomic_unchecked_t *)&priv->stats.rx_bytes);
- #endif
- }
- netif_receive_skb(skb);
-@@ -424,9 +424,9 @@ void cvm_oct_tasklet_rx(unsigned long unused)
- dev->name);
- */
- #ifdef CONFIG_64BIT
-- atomic64_add(1, (atomic64_t *)&priv->stats.rx_dropped);
-+ atomic64_add_unchecked(1, (atomic64_t *)&priv->stats.rx_dropped);
- #else
-- atomic_add(1, (atomic_t *)&priv->stats.rx_dropped);
-+ atomic_add_unchecked(1, (atomic_t *)&priv->stats.rx_dropped);
- #endif
- dev_kfree_skb_irq(skb);
- }
-diff --git a/drivers/staging/octeon/ethernet.c b/drivers/staging/octeon/ethernet.c
-index 492c502..d9909f1 100644
---- a/drivers/staging/octeon/ethernet.c
-+++ b/drivers/staging/octeon/ethernet.c
-@@ -294,11 +294,11 @@ static struct net_device_stats *cvm_oct_common_get_stats(struct net_device *dev)
- * since the RX tasklet also increments it.
- */
- #ifdef CONFIG_64BIT
-- atomic64_add(rx_status.dropped_packets,
-- (atomic64_t *)&priv->stats.rx_dropped);
-+ atomic64_add_unchecked(rx_status.dropped_packets,
-+ (atomic64_unchecked_t *)&priv->stats.rx_dropped);
- #else
-- atomic_add(rx_status.dropped_packets,
-- (atomic_t *)&priv->stats.rx_dropped);
-+ atomic_add_unchecked(rx_status.dropped_packets,
-+ (atomic_unchecked_t *)&priv->stats.rx_dropped);
- #endif
- }
-
-diff --git a/drivers/staging/otus/80211core/pub_zfi.h b/drivers/staging/otus/80211core/pub_zfi.h
-index a35bd5d..28fff45 100644
---- a/drivers/staging/otus/80211core/pub_zfi.h
-+++ b/drivers/staging/otus/80211core/pub_zfi.h
-@@ -531,7 +531,7 @@ struct zsCbFuncTbl
- u8_t (*zfcbClassifyTxPacket)(zdev_t* dev, zbuf_t* buf);
-
- void (*zfcbHwWatchDogNotify)(zdev_t* dev);
--};
-+} __no_const;
-
- extern void zfZeroMemory(u8_t* va, u16_t length);
- #define ZM_INIT_CB_FUNC_TABLE(p) zfZeroMemory((u8_t *)p, sizeof(struct zsCbFuncTbl));
-diff --git a/drivers/staging/panel/panel.c b/drivers/staging/panel/panel.c
-index c39a25f..696f5aa 100644
---- a/drivers/staging/panel/panel.c
-+++ b/drivers/staging/panel/panel.c
-@@ -1305,7 +1305,7 @@ static int lcd_release(struct inode *inode, struct file *file)
- return 0;
- }
-
--static struct file_operations lcd_fops = {
-+static const struct file_operations lcd_fops = {
- .write = lcd_write,
- .open = lcd_open,
- .release = lcd_release,
-@@ -1565,7 +1565,7 @@ static int keypad_release(struct inode *inode, struct file *file)
- return 0;
- }
-
--static struct file_operations keypad_fops = {
-+static const struct file_operations keypad_fops = {
- .read = keypad_read, /* read */
- .open = keypad_open, /* open */
- .release = keypad_release, /* close */
-diff --git a/drivers/staging/phison/phison.c b/drivers/staging/phison/phison.c
-index 270ebcb..37e46af 100644
---- a/drivers/staging/phison/phison.c
-+++ b/drivers/staging/phison/phison.c
-@@ -43,7 +43,7 @@ static struct scsi_host_template phison_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations phison_ops = {
-+static const struct ata_port_operations phison_ops = {
- .inherits = &ata_bmdma_port_ops,
- .prereset = phison_pre_reset,
- };
-diff --git a/drivers/staging/poch/poch.c b/drivers/staging/poch/poch.c
-index 2eb8e3d..57616a7 100644
---- a/drivers/staging/poch/poch.c
-+++ b/drivers/staging/poch/poch.c
-@@ -1057,7 +1057,7 @@ static int poch_ioctl(struct inode *inode, struct file *filp,
- return 0;
- }
-
--static struct file_operations poch_fops = {
-+static const struct file_operations poch_fops = {
- .owner = THIS_MODULE,
- .open = poch_open,
- .release = poch_release,
-diff --git a/drivers/staging/pohmelfs/config.c b/drivers/staging/pohmelfs/config.c
-index 5d04bf5..d4baff2 100644
---- a/drivers/staging/pohmelfs/config.c
-+++ b/drivers/staging/pohmelfs/config.c
-@@ -531,7 +531,7 @@ static void pohmelfs_cn_callback(struct cn_msg *msg, struct netlink_skb_parms *n
- {
- int err;
-
-- if (!cap_raised(nsp->eff_cap, CAP_SYS_ADMIN))
-+ if (!capable(CAP_SYS_ADMIN))
- return;
-
- switch (msg->flags) {
-diff --git a/drivers/staging/pohmelfs/inode.c b/drivers/staging/pohmelfs/inode.c
-index c94de31..19402bc 100644
---- a/drivers/staging/pohmelfs/inode.c
-+++ b/drivers/staging/pohmelfs/inode.c
-@@ -1850,7 +1850,7 @@ static int pohmelfs_fill_super(struct super_block *sb, void *data, int silent)
- mutex_init(&psb->mcache_lock);
- psb->mcache_root = RB_ROOT;
- psb->mcache_timeout = msecs_to_jiffies(5000);
-- atomic_long_set(&psb->mcache_gen, 0);
-+ atomic_long_set_unchecked(&psb->mcache_gen, 0);
-
- psb->trans_max_pages = 100;
-
-@@ -1865,7 +1865,7 @@ static int pohmelfs_fill_super(struct super_block *sb, void *data, int silent)
- INIT_LIST_HEAD(&psb->crypto_ready_list);
- INIT_LIST_HEAD(&psb->crypto_active_list);
-
-- atomic_set(&psb->trans_gen, 1);
-+ atomic_set_unchecked(&psb->trans_gen, 1);
- atomic_long_set(&psb->total_inodes, 0);
-
- mutex_init(&psb->state_lock);
-diff --git a/drivers/staging/pohmelfs/mcache.c b/drivers/staging/pohmelfs/mcache.c
-index e22665c..a2a9390 100644
---- a/drivers/staging/pohmelfs/mcache.c
-+++ b/drivers/staging/pohmelfs/mcache.c
-@@ -121,7 +121,7 @@ struct pohmelfs_mcache *pohmelfs_mcache_alloc(struct pohmelfs_sb *psb, u64 start
- m->data = data;
- m->start = start;
- m->size = size;
-- m->gen = atomic_long_inc_return(&psb->mcache_gen);
-+ m->gen = atomic_long_inc_return_unchecked(&psb->mcache_gen);
-
- mutex_lock(&psb->mcache_lock);
- err = pohmelfs_mcache_insert(psb, m);
-diff --git a/drivers/staging/pohmelfs/netfs.h b/drivers/staging/pohmelfs/netfs.h
-index 623a07d..4035c19 100644
---- a/drivers/staging/pohmelfs/netfs.h
-+++ b/drivers/staging/pohmelfs/netfs.h
-@@ -570,14 +570,14 @@ struct pohmelfs_config;
- struct pohmelfs_sb {
- struct rb_root mcache_root;
- struct mutex mcache_lock;
-- atomic_long_t mcache_gen;
-+ atomic_long_unchecked_t mcache_gen;
- unsigned long mcache_timeout;
-
- unsigned int idx;
-
- unsigned int trans_retries;
-
-- atomic_t trans_gen;
-+ atomic_unchecked_t trans_gen;
-
- unsigned int crypto_attached_size;
- unsigned int crypto_align_size;
-diff --git a/drivers/staging/pohmelfs/trans.c b/drivers/staging/pohmelfs/trans.c
-index 36a2535..0591bf4 100644
---- a/drivers/staging/pohmelfs/trans.c
-+++ b/drivers/staging/pohmelfs/trans.c
-@@ -492,7 +492,7 @@ int netfs_trans_finish(struct netfs_trans *t, struct pohmelfs_sb *psb)
- int err;
- struct netfs_cmd *cmd = t->iovec.iov_base;
-
-- t->gen = atomic_inc_return(&psb->trans_gen);
-+ t->gen = atomic_inc_return_unchecked(&psb->trans_gen);
-
- cmd->size = t->iovec.iov_len - sizeof(struct netfs_cmd) +
- t->attached_size + t->attached_pages * sizeof(struct netfs_cmd);
-diff --git a/drivers/staging/sep/sep_driver.c b/drivers/staging/sep/sep_driver.c
-index f890a16..509ece8 100644
---- a/drivers/staging/sep/sep_driver.c
-+++ b/drivers/staging/sep/sep_driver.c
-@@ -2603,7 +2603,7 @@ static struct pci_driver sep_pci_driver = {
- static dev_t sep_devno;
-
- /* the files operations structure of the driver */
--static struct file_operations sep_file_operations = {
-+static const struct file_operations sep_file_operations = {
- .owner = THIS_MODULE,
- .ioctl = sep_ioctl,
- .poll = sep_poll,
-diff --git a/drivers/staging/usbip/vhci.h b/drivers/staging/usbip/vhci.h
-index 57f7946..d9df23d 100644
---- a/drivers/staging/usbip/vhci.h
-+++ b/drivers/staging/usbip/vhci.h
-@@ -92,7 +92,7 @@ struct vhci_hcd {
- unsigned resuming:1;
- unsigned long re_timeout;
-
-- atomic_t seqnum;
-+ atomic_unchecked_t seqnum;
-
- /*
- * NOTE:
-diff --git a/drivers/staging/usbip/vhci_hcd.c b/drivers/staging/usbip/vhci_hcd.c
-index 20cd7db..c2693ff 100644
---- a/drivers/staging/usbip/vhci_hcd.c
-+++ b/drivers/staging/usbip/vhci_hcd.c
-@@ -534,7 +534,7 @@ static void vhci_tx_urb(struct urb *urb)
- return;
- }
-
-- priv->seqnum = atomic_inc_return(&the_controller->seqnum);
-+ priv->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
- if (priv->seqnum == 0xffff)
- usbip_uinfo("seqnum max\n");
-
-@@ -793,7 +793,7 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
- return -ENOMEM;
- }
-
-- unlink->seqnum = atomic_inc_return(&the_controller->seqnum);
-+ unlink->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
- if (unlink->seqnum == 0xffff)
- usbip_uinfo("seqnum max\n");
-
-@@ -988,7 +988,7 @@ static int vhci_start(struct usb_hcd *hcd)
- vdev->rhport = rhport;
- }
-
-- atomic_set(&vhci->seqnum, 0);
-+ atomic_set_unchecked(&vhci->seqnum, 0);
- spin_lock_init(&vhci->lock);
-
-
-diff --git a/drivers/staging/usbip/vhci_rx.c b/drivers/staging/usbip/vhci_rx.c
-index 7fd76fe..673695a 100644
---- a/drivers/staging/usbip/vhci_rx.c
-+++ b/drivers/staging/usbip/vhci_rx.c
-@@ -79,7 +79,7 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev,
- usbip_uerr("cannot find a urb of seqnum %u\n",
- pdu->base.seqnum);
- usbip_uinfo("max seqnum %d\n",
-- atomic_read(&the_controller->seqnum));
-+ atomic_read_unchecked(&the_controller->seqnum));
- usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
- return;
- }
-diff --git a/drivers/staging/vme/devices/vme_user.c b/drivers/staging/vme/devices/vme_user.c
-index 7891288..8e31300 100644
---- a/drivers/staging/vme/devices/vme_user.c
-+++ b/drivers/staging/vme/devices/vme_user.c
-@@ -136,7 +136,7 @@ static int vme_user_ioctl(struct inode *, struct file *, unsigned int,
- static int __init vme_user_probe(struct device *, int, int);
- static int __exit vme_user_remove(struct device *, int, int);
-
--static struct file_operations vme_user_fops = {
-+static const struct file_operations vme_user_fops = {
- .open = vme_user_open,
- .release = vme_user_release,
- .read = vme_user_read,
-diff --git a/drivers/staging/vt6655/hostap.c b/drivers/staging/vt6655/hostap.c
-index 58abf44..00c1fc8 100644
---- a/drivers/staging/vt6655/hostap.c
-+++ b/drivers/staging/vt6655/hostap.c
-@@ -84,7 +84,7 @@ static int hostap_enable_hostapd(PSDevice pDevice, int rtnl_locked)
- PSDevice apdev_priv;
- struct net_device *dev = pDevice->dev;
- int ret;
-- const struct net_device_ops apdev_netdev_ops = {
-+ net_device_ops_no_const apdev_netdev_ops = {
- .ndo_start_xmit = pDevice->tx_80211,
- };
-
-diff --git a/drivers/staging/vt6656/hostap.c b/drivers/staging/vt6656/hostap.c
-index 0c8267a..db1f363 100644
---- a/drivers/staging/vt6656/hostap.c
-+++ b/drivers/staging/vt6656/hostap.c
-@@ -86,7 +86,7 @@ static int hostap_enable_hostapd(PSDevice pDevice, int rtnl_locked)
- PSDevice apdev_priv;
- struct net_device *dev = pDevice->dev;
- int ret;
-- const struct net_device_ops apdev_netdev_ops = {
-+ net_device_ops_no_const apdev_netdev_ops = {
- .ndo_start_xmit = pDevice->tx_80211,
- };
-
-diff --git a/drivers/telephony/ixj.c b/drivers/telephony/ixj.c
-index 56eb6cc..fabe98a 100644
---- a/drivers/telephony/ixj.c
-+++ b/drivers/telephony/ixj.c
-@@ -4976,6 +4976,8 @@ static int ixj_daa_cid_read(IXJ *j)
- bool mContinue;
- char *pIn, *pOut;
-
-+ pax_track_stack();
-+
- if (!SCI_Prepare(j))
- return 0;
-
-diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
-index e941367..deb21b5 100644
---- a/drivers/uio/uio.c
-+++ b/drivers/uio/uio.c
-@@ -23,6 +23,7 @@
- #include <linux/string.h>
- #include <linux/kobject.h>
- #include <linux/uio_driver.h>
-+#include <asm/local.h>
-
- #define UIO_MAX_DEVICES 255
-
-@@ -30,10 +31,10 @@ struct uio_device {
- struct module *owner;
- struct device *dev;
- int minor;
-- atomic_t event;
-+ atomic_unchecked_t event;
- struct fasync_struct *async_queue;
- wait_queue_head_t wait;
-- int vma_count;
-+ local_t vma_count;
- struct uio_info *info;
- struct kobject *map_dir;
- struct kobject *portio_dir;
-@@ -129,7 +130,7 @@ static ssize_t map_type_show(struct kobject *kobj, struct attribute *attr,
- return entry->show(mem, buf);
- }
-
--static struct sysfs_ops map_sysfs_ops = {
-+static const struct sysfs_ops map_sysfs_ops = {
- .show = map_type_show,
- };
-
-@@ -217,7 +218,7 @@ static ssize_t portio_type_show(struct kobject *kobj, struct attribute *attr,
- return entry->show(port, buf);
- }
-
--static struct sysfs_ops portio_sysfs_ops = {
-+static const struct sysfs_ops portio_sysfs_ops = {
- .show = portio_type_show,
- };
-
-@@ -255,7 +256,7 @@ static ssize_t show_event(struct device *dev,
- struct uio_device *idev = dev_get_drvdata(dev);
- if (idev)
- return sprintf(buf, "%u\n",
-- (unsigned int)atomic_read(&idev->event));
-+ (unsigned int)atomic_read_unchecked(&idev->event));
- else
- return -ENODEV;
- }
-@@ -424,7 +425,7 @@ void uio_event_notify(struct uio_info *info)
- {
- struct uio_device *idev = info->uio_dev;
-
-- atomic_inc(&idev->event);
-+ atomic_inc_unchecked(&idev->event);
- wake_up_interruptible(&idev->wait);
- kill_fasync(&idev->async_queue, SIGIO, POLL_IN);
- }
-@@ -477,7 +478,7 @@ static int uio_open(struct inode *inode, struct file *filep)
- }
-
- listener->dev = idev;
-- listener->event_count = atomic_read(&idev->event);
-+ listener->event_count = atomic_read_unchecked(&idev->event);
- filep->private_data = listener;
-
- if (idev->info->open) {
-@@ -528,7 +529,7 @@ static unsigned int uio_poll(struct file *filep, poll_table *wait)
- return -EIO;
-
- poll_wait(filep, &idev->wait, wait);
-- if (listener->event_count != atomic_read(&idev->event))
-+ if (listener->event_count != atomic_read_unchecked(&idev->event))
- return POLLIN | POLLRDNORM;
- return 0;
- }
-@@ -553,7 +554,7 @@ static ssize_t uio_read(struct file *filep, char __user *buf,
- do {
- set_current_state(TASK_INTERRUPTIBLE);
-
-- event_count = atomic_read(&idev->event);
-+ event_count = atomic_read_unchecked(&idev->event);
- if (event_count != listener->event_count) {
- if (copy_to_user(buf, &event_count, count))
- retval = -EFAULT;
-@@ -609,14 +610,16 @@ static ssize_t uio_write(struct file *filep, const char __user *buf,
-
- static int uio_find_mem_index(struct vm_area_struct *vma)
- {
-- int mi;
- struct uio_device *idev = vma->vm_private_data;
-+ unsigned long size;
-
-- for (mi = 0; mi < MAX_UIO_MAPS; mi++) {
-- if (idev->info->mem[mi].size == 0)
-+ if (vma->vm_pgoff < MAX_UIO_MAPS) {
-+ size = idev->info->mem[vma->vm_pgoff].size;
-+ if (size == 0)
- return -1;
-- if (vma->vm_pgoff == mi)
-- return mi;
-+ if (vma->vm_end - vma->vm_start > size)
-+ return -1;
-+ return (int)vma->vm_pgoff;
- }
- return -1;
- }
-@@ -624,13 +627,13 @@ static int uio_find_mem_index(struct vm_area_struct *vma)
- static void uio_vma_open(struct vm_area_struct *vma)
- {
- struct uio_device *idev = vma->vm_private_data;
-- idev->vma_count++;
-+ local_inc(&idev->vma_count);
- }
-
- static void uio_vma_close(struct vm_area_struct *vma)
- {
- struct uio_device *idev = vma->vm_private_data;
-- idev->vma_count--;
-+ local_dec(&idev->vma_count);
- }
-
- static int uio_vma_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
-@@ -669,16 +672,30 @@ static int uio_mmap_physical(struct vm_area_struct *vma)
- {
- struct uio_device *idev = vma->vm_private_data;
- int mi = uio_find_mem_index(vma);
-+ struct uio_mem *mem;
- if (mi < 0)
- return -EINVAL;
-+ mem = idev->info->mem + mi;
-
-- vma->vm_flags |= VM_IO | VM_RESERVED;
-+ if (mem->addr & ~PAGE_MASK)
-+ return -ENODEV;
-+ if (vma->vm_end - vma->vm_start > mem->size)
-+ return -EINVAL;
-
- vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
-
-+ /*
-+ * We cannot use the vm_iomap_memory() helper here,
-+ * because vma->vm_pgoff is the map index we looked
-+ * up above in uio_find_mem_index(), rather than an
-+ * actual page offset into the mmap.
-+ *
-+ * So we just do the physical mmap without a page
-+ * offset.
-+ */
- return remap_pfn_range(vma,
- vma->vm_start,
-- idev->info->mem[mi].addr >> PAGE_SHIFT,
-+ mem->addr >> PAGE_SHIFT,
- vma->vm_end - vma->vm_start,
- vma->vm_page_prot);
- }
-@@ -840,7 +857,7 @@ int __uio_register_device(struct module *owner,
- idev->owner = owner;
- idev->info = info;
- init_waitqueue_head(&idev->wait);
-- atomic_set(&idev->event, 0);
-+ atomic_set_unchecked(&idev->event, 0);
-
- ret = uio_get_minor(idev);
- if (ret)
-diff --git a/drivers/usb/atm/cxacru.c b/drivers/usb/atm/cxacru.c
-index 56802d2..420c771 100644
---- a/drivers/usb/atm/cxacru.c
-+++ b/drivers/usb/atm/cxacru.c
-@@ -580,7 +580,8 @@ static int cxacru_cm_get_array(struct cxacru_data *instance, enum cxacru_cm_requ
- {
- int ret, len;
- __le32 *buf;
-- int offb, offd;
-+ int offb;
-+ unsigned int offd;
- const int stride = CMD_PACKET_SIZE / (4 * 2) - 1;
- int buflen = ((size - 1) / stride + 1 + size * 2) * 4;
-
-diff --git a/drivers/usb/atm/usbatm.c b/drivers/usb/atm/usbatm.c
-index fbea856..06efea6 100644
---- a/drivers/usb/atm/usbatm.c
-+++ b/drivers/usb/atm/usbatm.c
-@@ -333,7 +333,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
- if (printk_ratelimit())
- atm_warn(instance, "%s: OAM not supported (vpi %d, vci %d)!\n",
- __func__, vpi, vci);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- return;
- }
-
-@@ -361,7 +361,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
- if (length > ATM_MAX_AAL5_PDU) {
- atm_rldbg(instance, "%s: bogus length %u (vcc: 0x%p)!\n",
- __func__, length, vcc);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- goto out;
- }
-
-@@ -370,14 +370,14 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
- if (sarb->len < pdu_length) {
- atm_rldbg(instance, "%s: bogus pdu_length %u (sarb->len: %u, vcc: 0x%p)!\n",
- __func__, pdu_length, sarb->len, vcc);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- goto out;
- }
-
- if (crc32_be(~0, skb_tail_pointer(sarb) - pdu_length, pdu_length) != 0xc704dd7b) {
- atm_rldbg(instance, "%s: packet failed crc check (vcc: 0x%p)!\n",
- __func__, vcc);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- goto out;
- }
-
-@@ -387,7 +387,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
- if (printk_ratelimit())
- atm_err(instance, "%s: no memory for skb (length: %u)!\n",
- __func__, length);
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- goto out;
- }
-
-@@ -412,7 +412,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
-
- vcc->push(vcc, skb);
-
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
- out:
- skb_trim(sarb, 0);
- }
-@@ -616,7 +616,7 @@ static void usbatm_tx_process(unsigned long data)
- struct atm_vcc *vcc = UDSL_SKB(skb)->atm.vcc;
-
- usbatm_pop(vcc, skb);
-- atomic_inc(&vcc->stats->tx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
-
- skb = skb_dequeue(&instance->sndqueue);
- }
-@@ -775,11 +775,11 @@ static int usbatm_atm_proc_read(struct atm_dev *atm_dev, loff_t * pos, char *pag
- if (!left--)
- return sprintf(page,
- "AAL5: tx %d ( %d err ), rx %d ( %d err, %d drop )\n",
-- atomic_read(&atm_dev->stats.aal5.tx),
-- atomic_read(&atm_dev->stats.aal5.tx_err),
-- atomic_read(&atm_dev->stats.aal5.rx),
-- atomic_read(&atm_dev->stats.aal5.rx_err),
-- atomic_read(&atm_dev->stats.aal5.rx_drop));
-+ atomic_read_unchecked(&atm_dev->stats.aal5.tx),
-+ atomic_read_unchecked(&atm_dev->stats.aal5.tx_err),
-+ atomic_read_unchecked(&atm_dev->stats.aal5.rx),
-+ atomic_read_unchecked(&atm_dev->stats.aal5.rx_err),
-+ atomic_read_unchecked(&atm_dev->stats.aal5.rx_drop));
-
- if (!left--) {
- if (instance->disconnected)
-diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
-index 24e6205..b94523b 100644
---- a/drivers/usb/core/hcd.c
-+++ b/drivers/usb/core/hcd.c
-@@ -1373,7 +1373,7 @@ int usb_hcd_submit_urb (struct urb *urb, gfp_t mem_flags)
- */
- usb_get_urb(urb);
- atomic_inc(&urb->use_count);
-- atomic_inc(&urb->dev->urbnum);
-+ atomic_inc_unchecked(&urb->dev->urbnum);
- usbmon_urb_submit(&hcd->self, urb);
-
- /* NOTE requirements on root-hub callers (usbfs and the hub
-@@ -1401,7 +1401,7 @@ int usb_hcd_submit_urb (struct urb *urb, gfp_t mem_flags)
- urb->hcpriv = NULL;
- INIT_LIST_HEAD(&urb->urb_list);
- atomic_dec(&urb->use_count);
-- atomic_dec(&urb->dev->urbnum);
-+ atomic_dec_unchecked(&urb->dev->urbnum);
- if (atomic_read(&urb->reject))
- wake_up(&usb_kill_urb_queue);
- usb_put_urb(urb);
-@@ -2216,7 +2216,7 @@ EXPORT_SYMBOL_GPL(usb_hcd_platform_shutdown);
-
- #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
-
--struct usb_mon_operations *mon_ops;
-+const struct usb_mon_operations *mon_ops;
-
- /*
- * The registration is unlocked.
-@@ -2226,7 +2226,7 @@ struct usb_mon_operations *mon_ops;
- * symbols from usbcore, usbcore gets referenced and cannot be unloaded first.
- */
-
--int usb_mon_register (struct usb_mon_operations *ops)
-+int usb_mon_register (const struct usb_mon_operations *ops)
- {
-
- if (mon_ops)
-diff --git a/drivers/usb/core/hcd.h b/drivers/usb/core/hcd.h
-index bcbe104..9cfd1c6 100644
---- a/drivers/usb/core/hcd.h
-+++ b/drivers/usb/core/hcd.h
-@@ -486,13 +486,13 @@ static inline void usbfs_cleanup(void) { }
- #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
-
- struct usb_mon_operations {
-- void (*urb_submit)(struct usb_bus *bus, struct urb *urb);
-- void (*urb_submit_error)(struct usb_bus *bus, struct urb *urb, int err);
-- void (*urb_complete)(struct usb_bus *bus, struct urb *urb, int status);
-+ void (* const urb_submit)(struct usb_bus *bus, struct urb *urb);
-+ void (* const urb_submit_error)(struct usb_bus *bus, struct urb *urb, int err);
-+ void (* const urb_complete)(struct usb_bus *bus, struct urb *urb, int status);
- /* void (*urb_unlink)(struct usb_bus *bus, struct urb *urb); */
- };
-
--extern struct usb_mon_operations *mon_ops;
-+extern const struct usb_mon_operations *mon_ops;
-
- static inline void usbmon_urb_submit(struct usb_bus *bus, struct urb *urb)
- {
-@@ -514,7 +514,7 @@ static inline void usbmon_urb_complete(struct usb_bus *bus, struct urb *urb,
- (*mon_ops->urb_complete)(bus, urb, status);
- }
-
--int usb_mon_register(struct usb_mon_operations *ops);
-+int usb_mon_register(const struct usb_mon_operations *ops);
- void usb_mon_deregister(void);
-
- #else
-diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
-index 02aad50..12a5df8 100644
---- a/drivers/usb/core/hub.c
-+++ b/drivers/usb/core/hub.c
-@@ -24,6 +24,7 @@
- #include <linux/freezer.h>
- #include <linux/usb/quirks.h>
- #include <linux/random.h>
-+#include <linux/grsecurity.h>
-
- #include <asm/uaccess.h>
- #include <asm/byteorder.h>
-@@ -3079,6 +3080,9 @@ static void hub_port_connect_change(struct usb_hub *hub, int port1,
- return;
- }
-
-+ if (gr_handle_new_usb())
-+ goto done;
-+
- for (i = 0; i < SET_CONFIG_TRIES; i++) {
-
- /* reallocate for each attempt, since references
-diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c
-index fcdcad4..cf1aadd 100644
---- a/drivers/usb/core/sysfs.c
-+++ b/drivers/usb/core/sysfs.c
-@@ -186,7 +186,7 @@ show_urbnum(struct device *dev, struct device_attribute *attr, char *buf)
- struct usb_device *udev;
-
- udev = to_usb_device(dev);
-- return sprintf(buf, "%d\n", atomic_read(&udev->urbnum));
-+ return sprintf(buf, "%d\n", atomic_read_unchecked(&udev->urbnum));
- }
- static DEVICE_ATTR(urbnum, S_IRUGO, show_urbnum, NULL);
-
-diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
-index ab2d3e7..9c5dffe 100644
---- a/drivers/usb/core/usb.c
-+++ b/drivers/usb/core/usb.c
-@@ -377,7 +377,7 @@ struct usb_device *usb_alloc_dev(struct usb_device *parent,
- dev->dev.dma_mask = bus->controller->dma_mask;
- set_dev_node(&dev->dev, dev_to_node(bus->controller));
- dev->state = USB_STATE_ATTACHED;
-- atomic_set(&dev->urbnum, 0);
-+ atomic_set_unchecked(&dev->urbnum, 0);
-
- INIT_LIST_HEAD(&dev->ep0.urb_list);
- dev->ep0.desc.bLength = USB_DT_ENDPOINT_SIZE;
-diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c
-index 62ff5e7..530b74e 100644
---- a/drivers/usb/misc/appledisplay.c
-+++ b/drivers/usb/misc/appledisplay.c
-@@ -178,7 +178,7 @@ static int appledisplay_bl_get_brightness(struct backlight_device *bd)
- return pdata->msgdata[1];
- }
-
--static struct backlight_ops appledisplay_bl_data = {
-+static const struct backlight_ops appledisplay_bl_data = {
- .get_brightness = appledisplay_bl_get_brightness,
- .update_status = appledisplay_bl_update_status,
- };
-diff --git a/drivers/usb/mon/mon_main.c b/drivers/usb/mon/mon_main.c
-index e0c2db3..bd8cb66 100644
---- a/drivers/usb/mon/mon_main.c
-+++ b/drivers/usb/mon/mon_main.c
-@@ -238,7 +238,7 @@ static struct notifier_block mon_nb = {
- /*
- * Ops
- */
--static struct usb_mon_operations mon_ops_0 = {
-+static const struct usb_mon_operations mon_ops_0 = {
- .urb_submit = mon_submit,
- .urb_submit_error = mon_submit_error,
- .urb_complete = mon_complete,
-diff --git a/drivers/usb/wusbcore/wa-hc.h b/drivers/usb/wusbcore/wa-hc.h
-index d6bea3e..60b250e 100644
---- a/drivers/usb/wusbcore/wa-hc.h
-+++ b/drivers/usb/wusbcore/wa-hc.h
-@@ -192,7 +192,7 @@ struct wahc {
- struct list_head xfer_delayed_list;
- spinlock_t xfer_list_lock;
- struct work_struct xfer_work;
-- atomic_t xfer_id_count;
-+ atomic_unchecked_t xfer_id_count;
- };
-
-
-@@ -246,7 +246,7 @@ static inline void wa_init(struct wahc *wa)
- INIT_LIST_HEAD(&wa->xfer_delayed_list);
- spin_lock_init(&wa->xfer_list_lock);
- INIT_WORK(&wa->xfer_work, wa_urb_enqueue_run);
-- atomic_set(&wa->xfer_id_count, 1);
-+ atomic_set_unchecked(&wa->xfer_id_count, 1);
- }
-
- /**
-diff --git a/drivers/usb/wusbcore/wa-xfer.c b/drivers/usb/wusbcore/wa-xfer.c
-index 613a5fc..3174865 100644
---- a/drivers/usb/wusbcore/wa-xfer.c
-+++ b/drivers/usb/wusbcore/wa-xfer.c
-@@ -293,7 +293,7 @@ out:
- */
- static void wa_xfer_id_init(struct wa_xfer *xfer)
- {
-- xfer->id = atomic_add_return(1, &xfer->wa->xfer_id_count);
-+ xfer->id = atomic_add_return_unchecked(1, &xfer->wa->xfer_id_count);
- }
-
- /*
-diff --git a/drivers/uwb/wlp/messages.c b/drivers/uwb/wlp/messages.c
-index aa42fce..f8a828c 100644
---- a/drivers/uwb/wlp/messages.c
-+++ b/drivers/uwb/wlp/messages.c
-@@ -903,7 +903,7 @@ int wlp_parse_f0(struct wlp *wlp, struct sk_buff *skb)
- size_t len = skb->len;
- size_t used;
- ssize_t result;
-- struct wlp_nonce enonce, rnonce;
-+ struct wlp_nonce enonce = {{0}}, rnonce = {{0}};
- enum wlp_assc_error assc_err;
- char enonce_buf[WLP_WSS_NONCE_STRSIZE];
- char rnonce_buf[WLP_WSS_NONCE_STRSIZE];
-diff --git a/drivers/uwb/wlp/sysfs.c b/drivers/uwb/wlp/sysfs.c
-index 0370399..6627c94 100644
---- a/drivers/uwb/wlp/sysfs.c
-+++ b/drivers/uwb/wlp/sysfs.c
-@@ -615,8 +615,7 @@ ssize_t wlp_wss_attr_store(struct kobject *kobj, struct attribute *attr,
- return ret;
- }
-
--static
--struct sysfs_ops wss_sysfs_ops = {
-+static const struct sysfs_ops wss_sysfs_ops = {
- .show = wlp_wss_attr_show,
- .store = wlp_wss_attr_store,
- };
-diff --git a/drivers/video/arcfb.c b/drivers/video/arcfb.c
-index c343169..afe71b3 100644
---- a/drivers/video/arcfb.c
-+++ b/drivers/video/arcfb.c
-@@ -460,7 +460,7 @@ static ssize_t arcfb_write(struct fb_info *info, const char __user *buf,
- return -ENOSPC;
-
- err = 0;
-- if ((count + p) > fbmemlength) {
-+ if (count > (fbmemlength - p)) {
- count = fbmemlength - p;
- err = -ENOSPC;
- }
-diff --git a/drivers/video/atmel_lcdfb.c b/drivers/video/atmel_lcdfb.c
-index 8c5e432..5ee90ea 100644
---- a/drivers/video/atmel_lcdfb.c
-+++ b/drivers/video/atmel_lcdfb.c
-@@ -110,7 +110,7 @@ static int atmel_bl_get_brightness(struct backlight_device *bl)
- return lcdc_readl(sinfo, ATMEL_LCDC_CONTRAST_VAL);
- }
-
--static struct backlight_ops atmel_lcdc_bl_ops = {
-+static const struct backlight_ops atmel_lcdc_bl_ops = {
- .update_status = atmel_bl_update_status,
- .get_brightness = atmel_bl_get_brightness,
- };
-diff --git a/drivers/video/aty/aty128fb.c b/drivers/video/aty/aty128fb.c
-index e4e4d43..66bcbcc 100644
---- a/drivers/video/aty/aty128fb.c
-+++ b/drivers/video/aty/aty128fb.c
-@@ -149,7 +149,7 @@ enum {
- };
-
- /* Must match above enum */
--static const char *r128_family[] __devinitdata = {
-+static const char *r128_family[] __devinitconst = {
- "AGP",
- "PCI",
- "PRO AGP",
-@@ -1787,7 +1787,7 @@ static int aty128_bl_get_brightness(struct backlight_device *bd)
- return bd->props.brightness;
- }
-
--static struct backlight_ops aty128_bl_data = {
-+static const struct backlight_ops aty128_bl_data = {
- .get_brightness = aty128_bl_get_brightness,
- .update_status = aty128_bl_update_status,
- };
-diff --git a/drivers/video/aty/atyfb_base.c b/drivers/video/aty/atyfb_base.c
-index 913b4a4..4de325a9 100644
---- a/drivers/video/aty/atyfb_base.c
-+++ b/drivers/video/aty/atyfb_base.c
-@@ -2225,7 +2225,7 @@ static int aty_bl_get_brightness(struct backlight_device *bd)
- return bd->props.brightness;
- }
-
--static struct backlight_ops aty_bl_data = {
-+static const struct backlight_ops aty_bl_data = {
- .get_brightness = aty_bl_get_brightness,
- .update_status = aty_bl_update_status,
- };
-@@ -2970,9 +2970,8 @@ static int __devinit atyfb_setup_sparc(struct pci_dev *pdev,
- {
- struct atyfb_par *par = info->par;
- struct device_node *dp;
-- char prop[128];
-- int node, len, i, j, ret;
- u32 mem, chip_id;
-+ int i, j, ret;
-
- /*
- * Map memory-mapped registers.
-@@ -3088,23 +3087,8 @@ static int __devinit atyfb_setup_sparc(struct pci_dev *pdev,
- aty_st_le32(MEM_CNTL, mem, par);
- }
-
-- /*
-- * If this is the console device, we will set default video
-- * settings to what the PROM left us with.
-- */
-- node = prom_getchild(prom_root_node);
-- node = prom_searchsiblings(node, "aliases");
-- if (node) {
-- len = prom_getproperty(node, "screen", prop, sizeof(prop));
-- if (len > 0) {
-- prop[len] = '\0';
-- node = prom_finddevice(prop);
-- } else
-- node = 0;
-- }
--
- dp = pci_device_to_OF_node(pdev);
-- if (node == dp->node) {
-+ if (dp == of_console_device) {
- struct fb_var_screeninfo *var = &default_var;
- unsigned int N, P, Q, M, T, R;
- u32 v_total, h_total;
-@@ -3112,9 +3096,9 @@ static int __devinit atyfb_setup_sparc(struct pci_dev *pdev,
- u8 pll_regs[16];
- u8 clock_cntl;
-
-- crtc.vxres = prom_getintdefault(node, "width", 1024);
-- crtc.vyres = prom_getintdefault(node, "height", 768);
-- var->bits_per_pixel = prom_getintdefault(node, "depth", 8);
-+ crtc.vxres = of_getintprop_default(dp, "width", 1024);
-+ crtc.vyres = of_getintprop_default(dp, "height", 768);
-+ var->bits_per_pixel = of_getintprop_default(dp, "depth", 8);
- var->xoffset = var->yoffset = 0;
- crtc.h_tot_disp = aty_ld_le32(CRTC_H_TOTAL_DISP, par);
- crtc.h_sync_strt_wid = aty_ld_le32(CRTC_H_SYNC_STRT_WID, par);
-diff --git a/drivers/video/aty/radeon_backlight.c b/drivers/video/aty/radeon_backlight.c
-index 1a056ad..221bd6ae 100644
---- a/drivers/video/aty/radeon_backlight.c
-+++ b/drivers/video/aty/radeon_backlight.c
-@@ -127,7 +127,7 @@ static int radeon_bl_get_brightness(struct backlight_device *bd)
- return bd->props.brightness;
- }
-
--static struct backlight_ops radeon_bl_data = {
-+static const struct backlight_ops radeon_bl_data = {
- .get_brightness = radeon_bl_get_brightness,
- .update_status = radeon_bl_update_status,
- };
-diff --git a/drivers/video/au1100fb.c b/drivers/video/au1100fb.c
-index a699aab..3042400 100644
---- a/drivers/video/au1100fb.c
-+++ b/drivers/video/au1100fb.c
-@@ -392,39 +392,13 @@ void au1100fb_fb_rotate(struct fb_info *fbi, int angle)
- int au1100fb_fb_mmap(struct fb_info *fbi, struct vm_area_struct *vma)
- {
- struct au1100fb_device *fbdev;
-- unsigned int len;
-- unsigned long start=0, off;
-
- fbdev = to_au1100fb_device(fbi);
-
-- if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT)) {
-- return -EINVAL;
-- }
--
-- start = fbdev->fb_phys & PAGE_MASK;
-- len = PAGE_ALIGN((start & ~PAGE_MASK) + fbdev->fb_len);
--
-- off = vma->vm_pgoff << PAGE_SHIFT;
--
-- if ((vma->vm_end - vma->vm_start + off) > len) {
-- return -EINVAL;
-- }
--
-- off += start;
-- vma->vm_pgoff = off >> PAGE_SHIFT;
--
- vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
- pgprot_val(vma->vm_page_prot) |= (6 << 9); //CCA=6
-
-- vma->vm_flags |= VM_IO;
--
-- if (io_remap_pfn_range(vma, vma->vm_start, off >> PAGE_SHIFT,
-- vma->vm_end - vma->vm_start,
-- vma->vm_page_prot)) {
-- return -EAGAIN;
-- }
--
-- return 0;
-+ return vm_iomap_memory(vma, fbdev->fb_phys, fbdev->fb_len);
- }
-
- /* fb_cursor
-diff --git a/drivers/video/au1200fb.c b/drivers/video/au1200fb.c
-index 0d96f1d..1c33b79 100644
---- a/drivers/video/au1200fb.c
-+++ b/drivers/video/au1200fb.c
-@@ -1241,42 +1241,17 @@ static int au1200fb_fb_blank(int blank_mode, struct fb_info *fbi)
- * method mainly to allow the use of the TLB streaming flag (CCA=6)
- */
- static int au1200fb_fb_mmap(struct fb_info *info, struct vm_area_struct *vma)
--
- {
-- unsigned int len;
-- unsigned long start=0, off;
- struct au1200fb_device *fbdev = (struct au1200fb_device *) info;
-
- #ifdef CONFIG_PM
- au1xxx_pm_access(LCD_pm_dev);
- #endif
-
-- if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT)) {
-- return -EINVAL;
-- }
--
-- start = fbdev->fb_phys & PAGE_MASK;
-- len = PAGE_ALIGN((start & ~PAGE_MASK) + fbdev->fb_len);
--
-- off = vma->vm_pgoff << PAGE_SHIFT;
--
-- if ((vma->vm_end - vma->vm_start + off) > len) {
-- return -EINVAL;
-- }
--
-- off += start;
-- vma->vm_pgoff = off >> PAGE_SHIFT;
--
- vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
- pgprot_val(vma->vm_page_prot) |= _CACHE_MASK; /* CCA=7 */
-
-- vma->vm_flags |= VM_IO;
--
-- return io_remap_pfn_range(vma, vma->vm_start, off >> PAGE_SHIFT,
-- vma->vm_end - vma->vm_start,
-- vma->vm_page_prot);
--
-- return 0;
-+ return vm_iomap_memory(vma, fbdev->fb_phys, fbdev->fb_len);
- }
-
- static void set_global(u_int cmd, struct au1200_lcd_global_regs_t *pdata)
-diff --git a/drivers/video/backlight/adp5520_bl.c b/drivers/video/backlight/adp5520_bl.c
-index ad05da5..3cb2cb9 100644
---- a/drivers/video/backlight/adp5520_bl.c
-+++ b/drivers/video/backlight/adp5520_bl.c
-@@ -84,7 +84,7 @@ static int adp5520_bl_get_brightness(struct backlight_device *bl)
- return error ? data->current_brightness : reg_val;
- }
-
--static struct backlight_ops adp5520_bl_ops = {
-+static const struct backlight_ops adp5520_bl_ops = {
- .update_status = adp5520_bl_update_status,
- .get_brightness = adp5520_bl_get_brightness,
- };
-diff --git a/drivers/video/backlight/adx_bl.c b/drivers/video/backlight/adx_bl.c
-index 2c3bdfc..d769b0b 100644
---- a/drivers/video/backlight/adx_bl.c
-+++ b/drivers/video/backlight/adx_bl.c
-@@ -61,7 +61,7 @@ static int adx_backlight_check_fb(struct fb_info *fb)
- return 1;
- }
-
--static struct backlight_ops adx_backlight_ops = {
-+static const struct backlight_ops adx_backlight_ops = {
- .options = 0,
- .update_status = adx_backlight_update_status,
- .get_brightness = adx_backlight_get_brightness,
-diff --git a/drivers/video/backlight/atmel-pwm-bl.c b/drivers/video/backlight/atmel-pwm-bl.c
-index 505c082..6b6b3cc 100644
---- a/drivers/video/backlight/atmel-pwm-bl.c
-+++ b/drivers/video/backlight/atmel-pwm-bl.c
-@@ -113,7 +113,7 @@ static int atmel_pwm_bl_init_pwm(struct atmel_pwm_bl *pwmbl)
- return pwm_channel_enable(&pwmbl->pwmc);
- }
-
--static struct backlight_ops atmel_pwm_bl_ops = {
-+static const struct backlight_ops atmel_pwm_bl_ops = {
- .get_brightness = atmel_pwm_bl_get_intensity,
- .update_status = atmel_pwm_bl_set_intensity,
- };
-diff --git a/drivers/video/backlight/backlight.c b/drivers/video/backlight/backlight.c
-index 5e20e6e..89025e6 100644
---- a/drivers/video/backlight/backlight.c
-+++ b/drivers/video/backlight/backlight.c
-@@ -269,7 +269,7 @@ EXPORT_SYMBOL(backlight_force_update);
- * ERR_PTR() or a pointer to the newly allocated device.
- */
- struct backlight_device *backlight_device_register(const char *name,
-- struct device *parent, void *devdata, struct backlight_ops *ops)
-+ struct device *parent, void *devdata, const struct backlight_ops *ops)
- {
- struct backlight_device *new_bd;
- int rc;
-diff --git a/drivers/video/backlight/corgi_lcd.c b/drivers/video/backlight/corgi_lcd.c
-index 9677494..b4bcf80 100644
---- a/drivers/video/backlight/corgi_lcd.c
-+++ b/drivers/video/backlight/corgi_lcd.c
-@@ -451,7 +451,7 @@ void corgi_lcd_limit_intensity(int limit)
- }
- EXPORT_SYMBOL(corgi_lcd_limit_intensity);
-
--static struct backlight_ops corgi_bl_ops = {
-+static const struct backlight_ops corgi_bl_ops = {
- .get_brightness = corgi_bl_get_intensity,
- .update_status = corgi_bl_update_status,
- };
-diff --git a/drivers/video/backlight/cr_bllcd.c b/drivers/video/backlight/cr_bllcd.c
-index b9fe62b..2914bf1 100644
---- a/drivers/video/backlight/cr_bllcd.c
-+++ b/drivers/video/backlight/cr_bllcd.c
-@@ -108,7 +108,7 @@ static int cr_backlight_get_intensity(struct backlight_device *bd)
- return intensity;
- }
-
--static struct backlight_ops cr_backlight_ops = {
-+static const struct backlight_ops cr_backlight_ops = {
- .get_brightness = cr_backlight_get_intensity,
- .update_status = cr_backlight_set_intensity,
- };
-diff --git a/drivers/video/backlight/da903x_bl.c b/drivers/video/backlight/da903x_bl.c
-index 701a108..feacfd5 100644
---- a/drivers/video/backlight/da903x_bl.c
-+++ b/drivers/video/backlight/da903x_bl.c
-@@ -94,7 +94,7 @@ static int da903x_backlight_get_brightness(struct backlight_device *bl)
- return data->current_brightness;
- }
-
--static struct backlight_ops da903x_backlight_ops = {
-+static const struct backlight_ops da903x_backlight_ops = {
- .update_status = da903x_backlight_update_status,
- .get_brightness = da903x_backlight_get_brightness,
- };
-diff --git a/drivers/video/backlight/generic_bl.c b/drivers/video/backlight/generic_bl.c
-index 6d27f62..e6d348e 100644
---- a/drivers/video/backlight/generic_bl.c
-+++ b/drivers/video/backlight/generic_bl.c
-@@ -70,7 +70,7 @@ void corgibl_limit_intensity(int limit)
- }
- EXPORT_SYMBOL(corgibl_limit_intensity);
-
--static struct backlight_ops genericbl_ops = {
-+static const struct backlight_ops genericbl_ops = {
- .options = BL_CORE_SUSPENDRESUME,
- .get_brightness = genericbl_get_intensity,
- .update_status = genericbl_send_intensity,
-diff --git a/drivers/video/backlight/hp680_bl.c b/drivers/video/backlight/hp680_bl.c
-index 7fb4eef..f7cc528 100644
---- a/drivers/video/backlight/hp680_bl.c
-+++ b/drivers/video/backlight/hp680_bl.c
-@@ -98,7 +98,7 @@ static int hp680bl_get_intensity(struct backlight_device *bd)
- return current_intensity;
- }
-
--static struct backlight_ops hp680bl_ops = {
-+static const struct backlight_ops hp680bl_ops = {
- .get_brightness = hp680bl_get_intensity,
- .update_status = hp680bl_set_intensity,
- };
-diff --git a/drivers/video/backlight/jornada720_bl.c b/drivers/video/backlight/jornada720_bl.c
-index 7aed256..db9071f 100644
---- a/drivers/video/backlight/jornada720_bl.c
-+++ b/drivers/video/backlight/jornada720_bl.c
-@@ -93,7 +93,7 @@ out:
- return ret;
- }
-
--static struct backlight_ops jornada_bl_ops = {
-+static const struct backlight_ops jornada_bl_ops = {
- .get_brightness = jornada_bl_get_brightness,
- .update_status = jornada_bl_update_status,
- .options = BL_CORE_SUSPENDRESUME,
-diff --git a/drivers/video/backlight/kb3886_bl.c b/drivers/video/backlight/kb3886_bl.c
-index a38fda1..939e7b8 100644
---- a/drivers/video/backlight/kb3886_bl.c
-+++ b/drivers/video/backlight/kb3886_bl.c
-@@ -134,7 +134,7 @@ static int kb3886bl_get_intensity(struct backlight_device *bd)
- return kb3886bl_intensity;
- }
-
--static struct backlight_ops kb3886bl_ops = {
-+static const struct backlight_ops kb3886bl_ops = {
- .get_brightness = kb3886bl_get_intensity,
- .update_status = kb3886bl_send_intensity,
- };
-diff --git a/drivers/video/backlight/locomolcd.c b/drivers/video/backlight/locomolcd.c
-index 6b488b8..00a9591 100644
---- a/drivers/video/backlight/locomolcd.c
-+++ b/drivers/video/backlight/locomolcd.c
-@@ -141,7 +141,7 @@ static int locomolcd_get_intensity(struct backlight_device *bd)
- return current_intensity;
- }
-
--static struct backlight_ops locomobl_data = {
-+static const struct backlight_ops locomobl_data = {
- .get_brightness = locomolcd_get_intensity,
- .update_status = locomolcd_set_intensity,
- };
-diff --git a/drivers/video/backlight/mbp_nvidia_bl.c b/drivers/video/backlight/mbp_nvidia_bl.c
-index 99bdfa8..3dac448 100644
---- a/drivers/video/backlight/mbp_nvidia_bl.c
-+++ b/drivers/video/backlight/mbp_nvidia_bl.c
-@@ -33,7 +33,7 @@ struct dmi_match_data {
- unsigned long iostart;
- unsigned long iolen;
- /* Backlight operations structure. */
-- struct backlight_ops backlight_ops;
-+ const struct backlight_ops backlight_ops;
- };
-
- /* Module parameters. */
-diff --git a/drivers/video/backlight/omap1_bl.c b/drivers/video/backlight/omap1_bl.c
-index cbad67e8..3cf900e 100644
---- a/drivers/video/backlight/omap1_bl.c
-+++ b/drivers/video/backlight/omap1_bl.c
-@@ -125,7 +125,7 @@ static int omapbl_get_intensity(struct backlight_device *dev)
- return bl->current_intensity;
- }
-
--static struct backlight_ops omapbl_ops = {
-+static const struct backlight_ops omapbl_ops = {
- .get_brightness = omapbl_get_intensity,
- .update_status = omapbl_update_status,
- };
-diff --git a/drivers/video/backlight/progear_bl.c b/drivers/video/backlight/progear_bl.c
-index 9edaf24f..075786e 100644
---- a/drivers/video/backlight/progear_bl.c
-+++ b/drivers/video/backlight/progear_bl.c
-@@ -54,7 +54,7 @@ static int progearbl_get_intensity(struct backlight_device *bd)
- return intensity - HW_LEVEL_MIN;
- }
-
--static struct backlight_ops progearbl_ops = {
-+static const struct backlight_ops progearbl_ops = {
- .get_brightness = progearbl_get_intensity,
- .update_status = progearbl_set_intensity,
- };
-diff --git a/drivers/video/backlight/pwm_bl.c b/drivers/video/backlight/pwm_bl.c
-index 8871662..df9e0b3 100644
---- a/drivers/video/backlight/pwm_bl.c
-+++ b/drivers/video/backlight/pwm_bl.c
-@@ -56,7 +56,7 @@ static int pwm_backlight_get_brightness(struct backlight_device *bl)
- return bl->props.brightness;
- }
-
--static struct backlight_ops pwm_backlight_ops = {
-+static const struct backlight_ops pwm_backlight_ops = {
- .update_status = pwm_backlight_update_status,
- .get_brightness = pwm_backlight_get_brightness,
- };
-diff --git a/drivers/video/backlight/tosa_bl.c b/drivers/video/backlight/tosa_bl.c
-index 43edbad..e14ce4d 100644
---- a/drivers/video/backlight/tosa_bl.c
-+++ b/drivers/video/backlight/tosa_bl.c
-@@ -72,7 +72,7 @@ static int tosa_bl_get_brightness(struct backlight_device *dev)
- return props->brightness;
- }
-
--static struct backlight_ops bl_ops = {
-+static const struct backlight_ops bl_ops = {
- .get_brightness = tosa_bl_get_brightness,
- .update_status = tosa_bl_update_status,
- };
-diff --git a/drivers/video/backlight/wm831x_bl.c b/drivers/video/backlight/wm831x_bl.c
-index 467bdb7..e32add3 100644
---- a/drivers/video/backlight/wm831x_bl.c
-+++ b/drivers/video/backlight/wm831x_bl.c
-@@ -112,7 +112,7 @@ static int wm831x_backlight_get_brightness(struct backlight_device *bl)
- return data->current_brightness;
- }
-
--static struct backlight_ops wm831x_backlight_ops = {
-+static const struct backlight_ops wm831x_backlight_ops = {
- .options = BL_CORE_SUSPENDRESUME,
- .update_status = wm831x_backlight_update_status,
- .get_brightness = wm831x_backlight_get_brightness,
-diff --git a/drivers/video/bf54x-lq043fb.c b/drivers/video/bf54x-lq043fb.c
-index e49ae5e..db4e6f7 100644
---- a/drivers/video/bf54x-lq043fb.c
-+++ b/drivers/video/bf54x-lq043fb.c
-@@ -463,7 +463,7 @@ static int bl_get_brightness(struct backlight_device *bd)
- return 0;
- }
-
--static struct backlight_ops bfin_lq043fb_bl_ops = {
-+static const struct backlight_ops bfin_lq043fb_bl_ops = {
- .get_brightness = bl_get_brightness,
- };
-
-diff --git a/drivers/video/bfin-t350mcqb-fb.c b/drivers/video/bfin-t350mcqb-fb.c
-index 2c72a7c..d523e52 100644
---- a/drivers/video/bfin-t350mcqb-fb.c
-+++ b/drivers/video/bfin-t350mcqb-fb.c
-@@ -381,7 +381,7 @@ static int bl_get_brightness(struct backlight_device *bd)
- return 0;
- }
-
--static struct backlight_ops bfin_lq043fb_bl_ops = {
-+static const struct backlight_ops bfin_lq043fb_bl_ops = {
- .get_brightness = bl_get_brightness,
- };
-
-diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
-index 3681c6a..a0169fb 100644
---- a/drivers/video/console/fbcon.c
-+++ b/drivers/video/console/fbcon.c
-@@ -444,7 +444,7 @@ static int __init fb_console_setup(char *this_opt)
-
- while ((options = strsep(&this_opt, ",")) != NULL) {
- if (!strncmp(options, "font:", 5))
-- strcpy(fontname, options + 5);
-+ strlcpy(fontname, options + 5, sizeof(fontname));
-
- if (!strncmp(options, "scrollback:", 11)) {
- options += 11;
-diff --git a/drivers/video/fbcmap.c b/drivers/video/fbcmap.c
-index f53b9f1..958bf4e 100644
---- a/drivers/video/fbcmap.c
-+++ b/drivers/video/fbcmap.c
-@@ -266,8 +266,7 @@ int fb_set_user_cmap(struct fb_cmap_user *cmap, struct fb_info *info)
- rc = -ENODEV;
- goto out;
- }
-- if (cmap->start < 0 || (!info->fbops->fb_setcolreg &&
-- !info->fbops->fb_setcmap)) {
-+ if (!info->fbops->fb_setcolreg && !info->fbops->fb_setcmap) {
- rc = -EINVAL;
- goto out1;
- }
-diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
-index 99bbd28..73f1778 100644
---- a/drivers/video/fbmem.c
-+++ b/drivers/video/fbmem.c
-@@ -403,7 +403,7 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image,
- image->dx += image->width + 8;
- }
- } else if (rotate == FB_ROTATE_UD) {
-- for (x = 0; x < num && image->dx >= 0; x++) {
-+ for (x = 0; x < num && (__s32)image->dx >= 0; x++) {
- info->fbops->fb_imageblit(info, image);
- image->dx -= image->width + 8;
- }
-@@ -415,7 +415,7 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image,
- image->dy += image->height + 8;
- }
- } else if (rotate == FB_ROTATE_CCW) {
-- for (x = 0; x < num && image->dy >= 0; x++) {
-+ for (x = 0; x < num && (__s32)image->dy >= 0; x++) {
- info->fbops->fb_imageblit(info, image);
- image->dy -= image->height + 8;
- }
-@@ -915,6 +915,8 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var)
- int flags = info->flags;
- int ret = 0;
-
-+ pax_track_stack();
-+
- if (var->activate & FB_ACTIVATE_INV_MODE) {
- struct fb_videomode mode1, mode2;
-
-@@ -1040,6 +1042,8 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
- void __user *argp = (void __user *)arg;
- long ret = 0;
-
-+ pax_track_stack();
-+
- switch (cmd) {
- case FBIOGET_VSCREENINFO:
- if (!lock_fb_info(info))
-@@ -1119,7 +1123,7 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
- return -EFAULT;
- if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
- return -EINVAL;
-- if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX)
-+ if (con2fb.framebuffer >= FB_MAX)
- return -EINVAL;
- if (!registered_fb[con2fb.framebuffer])
- request_module("fb%d", con2fb.framebuffer);
-@@ -1323,14 +1327,14 @@ fb_mmap(struct file *file, struct vm_area_struct * vma)
- {
- int fbidx = iminor(file->f_path.dentry->d_inode);
- struct fb_info *info = registered_fb[fbidx];
-- struct fb_ops *fb = info->fbops;
-- unsigned long off;
-+ struct fb_ops *fb;
-+ unsigned long mmio_pgoff;
- unsigned long start;
- u32 len;
-
-- if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
-- return -EINVAL;
-- off = vma->vm_pgoff << PAGE_SHIFT;
-+ if (!info || info != file->private_data)
-+ return -ENODEV;
-+ fb = info->fbops;
- if (!fb)
- return -ENODEV;
- mutex_lock(&info->mm_lock);
-@@ -1341,32 +1345,24 @@ fb_mmap(struct file *file, struct vm_area_struct * vma)
- return res;
- }
-
-- /* frame buffer memory */
-+ /*
-+ * Ugh. This can be either the frame buffer mapping, or
-+ * if pgoff points past it, the mmio mapping.
-+ */
- start = info->fix.smem_start;
-- len = PAGE_ALIGN((start & ~PAGE_MASK) + info->fix.smem_len);
-- if (off >= len) {
-- /* memory mapped io */
-- off -= len;
-- if (info->var.accel_flags) {
-- mutex_unlock(&info->mm_lock);
-- return -EINVAL;
-- }
-+ len = info->fix.smem_len;
-+ mmio_pgoff = PAGE_ALIGN((start & ~PAGE_MASK) + len) >> PAGE_SHIFT;
-+ if (vma->vm_pgoff >= mmio_pgoff) {
-+ vma->vm_pgoff -= mmio_pgoff;
- start = info->fix.mmio_start;
-- len = PAGE_ALIGN((start & ~PAGE_MASK) + info->fix.mmio_len);
-+ len = info->fix.mmio_len;
- }
- mutex_unlock(&info->mm_lock);
-- start &= PAGE_MASK;
-- if ((vma->vm_end - vma->vm_start + off) > len)
-- return -EINVAL;
-- off += start;
-- vma->vm_pgoff = off >> PAGE_SHIFT;
-- /* This is an IO map - tell maydump to skip this VMA */
-- vma->vm_flags |= VM_IO | VM_RESERVED;
-- fb_pgprotect(file, vma, off);
-- if (io_remap_pfn_range(vma, vma->vm_start, off >> PAGE_SHIFT,
-- vma->vm_end - vma->vm_start, vma->vm_page_prot))
-- return -EAGAIN;
-- return 0;
-+
-+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
-+ fb_pgprotect(file, vma, start);
-+
-+ return vm_iomap_memory(vma, start, len);
- }
-
- static int
-diff --git a/drivers/video/geode/gx1fb_core.c b/drivers/video/geode/gx1fb_core.c
-index f20eff8..3e4f622 100644
---- a/drivers/video/geode/gx1fb_core.c
-+++ b/drivers/video/geode/gx1fb_core.c
-@@ -30,7 +30,7 @@ static int crt_option = 1;
- static char panel_option[32] = "";
-
- /* Modes relevant to the GX1 (taken from modedb.c) */
--static const struct fb_videomode __initdata gx1_modedb[] = {
-+static const struct fb_videomode __initconst gx1_modedb[] = {
- /* 640x480-60 VESA */
- { NULL, 60, 640, 480, 39682, 48, 16, 33, 10, 96, 2,
- 0, FB_VMODE_NONINTERLACED, FB_MODE_IS_VESA },
-diff --git a/drivers/video/gxt4500.c b/drivers/video/gxt4500.c
-index 896e53d..4d87d0b 100644
---- a/drivers/video/gxt4500.c
-+++ b/drivers/video/gxt4500.c
-@@ -156,7 +156,7 @@ struct gxt4500_par {
- static char *mode_option;
-
- /* default mode: 1280x1024 @ 60 Hz, 8 bpp */
--static const struct fb_videomode defaultmode __devinitdata = {
-+static const struct fb_videomode defaultmode __devinitconst = {
- .refresh = 60,
- .xres = 1280,
- .yres = 1024,
-@@ -581,7 +581,7 @@ static int gxt4500_blank(int blank, struct fb_info *info)
- return 0;
- }
-
--static const struct fb_fix_screeninfo gxt4500_fix __devinitdata = {
-+static const struct fb_fix_screeninfo gxt4500_fix __devinitconst = {
- .id = "IBM GXT4500P",
- .type = FB_TYPE_PACKED_PIXELS,
- .visual = FB_VISUAL_PSEUDOCOLOR,
-diff --git a/drivers/video/i810/i810_accel.c b/drivers/video/i810/i810_accel.c
-index f5bedee..28c6028 100644
---- a/drivers/video/i810/i810_accel.c
-+++ b/drivers/video/i810/i810_accel.c
-@@ -73,6 +73,7 @@ static inline int wait_for_space(struct fb_info *info, u32 space)
- }
- }
- printk("ringbuffer lockup!!!\n");
-+ printk("head:%u tail:%u iring.size:%u space:%u\n", head, tail, par->iring.size, space);
- i810_report_error(mmio);
- par->dev_flags |= LOCKUP;
- info->pixmap.scan_align = 1;
-diff --git a/drivers/video/i810/i810_main.c b/drivers/video/i810/i810_main.c
-index 5743ea2..457f82c 100644
---- a/drivers/video/i810/i810_main.c
-+++ b/drivers/video/i810/i810_main.c
-@@ -97,7 +97,7 @@ static int i810fb_blank (int blank_mode, struct fb_info *info);
- static void i810fb_release_resource (struct fb_info *info, struct i810fb_par *par);
-
- /* PCI */
--static const char *i810_pci_list[] __devinitdata = {
-+static const char *i810_pci_list[] __devinitconst = {
- "Intel(R) 810 Framebuffer Device" ,
- "Intel(R) 810-DC100 Framebuffer Device" ,
- "Intel(R) 810E Framebuffer Device" ,
-diff --git a/drivers/video/logo/logo_linux_clut224.ppm b/drivers/video/logo/logo_linux_clut224.ppm
-index 3c14e43..eafa544 100644
---- a/drivers/video/logo/logo_linux_clut224.ppm
-+++ b/drivers/video/logo/logo_linux_clut224.ppm
-@@ -1,1604 +1,1123 @@
- P3
--# Standard 224-color Linux logo
- 80 80
- 255
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 6 6 6 6 6 6 10 10 10 10 10 10
-- 10 10 10 6 6 6 6 6 6 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 6 6 6 10 10 10 14 14 14
-- 22 22 22 26 26 26 30 30 30 34 34 34
-- 30 30 30 30 30 30 26 26 26 18 18 18
-- 14 14 14 10 10 10 6 6 6 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 1 0 0 1 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 6 6 6 14 14 14 26 26 26 42 42 42
-- 54 54 54 66 66 66 78 78 78 78 78 78
-- 78 78 78 74 74 74 66 66 66 54 54 54
-- 42 42 42 26 26 26 18 18 18 10 10 10
-- 6 6 6 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 1 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 10 10 10
-- 22 22 22 42 42 42 66 66 66 86 86 86
-- 66 66 66 38 38 38 38 38 38 22 22 22
-- 26 26 26 34 34 34 54 54 54 66 66 66
-- 86 86 86 70 70 70 46 46 46 26 26 26
-- 14 14 14 6 6 6 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 1 0 0 1 0 0 1 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 10 10 10 26 26 26
-- 50 50 50 82 82 82 58 58 58 6 6 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 6 6 6 54 54 54 86 86 86 66 66 66
-- 38 38 38 18 18 18 6 6 6 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 6 6 6 22 22 22 50 50 50
-- 78 78 78 34 34 34 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 6 6 6 70 70 70
-- 78 78 78 46 46 46 22 22 22 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 1 0 0 1 0 0 1 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 6 6 6 18 18 18 42 42 42 82 82 82
-- 26 26 26 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 14 14 14
-- 46 46 46 34 34 34 6 6 6 2 2 6
-- 42 42 42 78 78 78 42 42 42 18 18 18
-- 6 6 6 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 1 0 0 0 0 0 1 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 10 10 10 30 30 30 66 66 66 58 58 58
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 26 26 26
-- 86 86 86 101 101 101 46 46 46 10 10 10
-- 2 2 6 58 58 58 70 70 70 34 34 34
-- 10 10 10 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 1 0 0 1 0 0 1 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 14 14 14 42 42 42 86 86 86 10 10 10
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 30 30 30
-- 94 94 94 94 94 94 58 58 58 26 26 26
-- 2 2 6 6 6 6 78 78 78 54 54 54
-- 22 22 22 6 6 6 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 6 6 6
-- 22 22 22 62 62 62 62 62 62 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 26 26 26
-- 54 54 54 38 38 38 18 18 18 10 10 10
-- 2 2 6 2 2 6 34 34 34 82 82 82
-- 38 38 38 14 14 14 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 1 0 0 1 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 6 6 6
-- 30 30 30 78 78 78 30 30 30 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 10 10 10
-- 10 10 10 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 78 78 78
-- 50 50 50 18 18 18 6 6 6 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 1 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 10 10 10
-- 38 38 38 86 86 86 14 14 14 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 54 54 54
-- 66 66 66 26 26 26 6 6 6 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 1 0 0 1 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 14 14 14
-- 42 42 42 82 82 82 2 2 6 2 2 6
-- 2 2 6 6 6 6 10 10 10 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 6 6 6
-- 14 14 14 10 10 10 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 18 18 18
-- 82 82 82 34 34 34 10 10 10 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 1 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 14 14 14
-- 46 46 46 86 86 86 2 2 6 2 2 6
-- 6 6 6 6 6 6 22 22 22 34 34 34
-- 6 6 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 18 18 18 34 34 34
-- 10 10 10 50 50 50 22 22 22 2 2 6
-- 2 2 6 2 2 6 2 2 6 10 10 10
-- 86 86 86 42 42 42 14 14 14 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 1 0 0 1 0 0 1 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 14 14 14
-- 46 46 46 86 86 86 2 2 6 2 2 6
-- 38 38 38 116 116 116 94 94 94 22 22 22
-- 22 22 22 2 2 6 2 2 6 2 2 6
-- 14 14 14 86 86 86 138 138 138 162 162 162
--154 154 154 38 38 38 26 26 26 6 6 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 86 86 86 46 46 46 14 14 14 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 14 14 14
-- 46 46 46 86 86 86 2 2 6 14 14 14
--134 134 134 198 198 198 195 195 195 116 116 116
-- 10 10 10 2 2 6 2 2 6 6 6 6
--101 98 89 187 187 187 210 210 210 218 218 218
--214 214 214 134 134 134 14 14 14 6 6 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 86 86 86 50 50 50 18 18 18 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 1 0 0 0
-- 0 0 1 0 0 1 0 0 1 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 14 14 14
-- 46 46 46 86 86 86 2 2 6 54 54 54
--218 218 218 195 195 195 226 226 226 246 246 246
-- 58 58 58 2 2 6 2 2 6 30 30 30
--210 210 210 253 253 253 174 174 174 123 123 123
--221 221 221 234 234 234 74 74 74 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 70 70 70 58 58 58 22 22 22 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 14 14 14
-- 46 46 46 82 82 82 2 2 6 106 106 106
--170 170 170 26 26 26 86 86 86 226 226 226
--123 123 123 10 10 10 14 14 14 46 46 46
--231 231 231 190 190 190 6 6 6 70 70 70
-- 90 90 90 238 238 238 158 158 158 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 70 70 70 58 58 58 22 22 22 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 1 0 0 0
-- 0 0 1 0 0 1 0 0 1 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 14 14 14
-- 42 42 42 86 86 86 6 6 6 116 116 116
--106 106 106 6 6 6 70 70 70 149 149 149
--128 128 128 18 18 18 38 38 38 54 54 54
--221 221 221 106 106 106 2 2 6 14 14 14
-- 46 46 46 190 190 190 198 198 198 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 74 74 74 62 62 62 22 22 22 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 1 0 0 0
-- 0 0 1 0 0 0 0 0 1 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 14 14 14
-- 42 42 42 94 94 94 14 14 14 101 101 101
--128 128 128 2 2 6 18 18 18 116 116 116
--118 98 46 121 92 8 121 92 8 98 78 10
--162 162 162 106 106 106 2 2 6 2 2 6
-- 2 2 6 195 195 195 195 195 195 6 6 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 74 74 74 62 62 62 22 22 22 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 1 0 0 1
-- 0 0 1 0 0 0 0 0 1 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 10 10 10
-- 38 38 38 90 90 90 14 14 14 58 58 58
--210 210 210 26 26 26 54 38 6 154 114 10
--226 170 11 236 186 11 225 175 15 184 144 12
--215 174 15 175 146 61 37 26 9 2 2 6
-- 70 70 70 246 246 246 138 138 138 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 70 70 70 66 66 66 26 26 26 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 10 10 10
-- 38 38 38 86 86 86 14 14 14 10 10 10
--195 195 195 188 164 115 192 133 9 225 175 15
--239 182 13 234 190 10 232 195 16 232 200 30
--245 207 45 241 208 19 232 195 16 184 144 12
--218 194 134 211 206 186 42 42 42 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 50 50 50 74 74 74 30 30 30 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 10 10 10
-- 34 34 34 86 86 86 14 14 14 2 2 6
--121 87 25 192 133 9 219 162 10 239 182 13
--236 186 11 232 195 16 241 208 19 244 214 54
--246 218 60 246 218 38 246 215 20 241 208 19
--241 208 19 226 184 13 121 87 25 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 50 50 50 82 82 82 34 34 34 10 10 10
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 10 10 10
-- 34 34 34 82 82 82 30 30 30 61 42 6
--180 123 7 206 145 10 230 174 11 239 182 13
--234 190 10 238 202 15 241 208 19 246 218 74
--246 218 38 246 215 20 246 215 20 246 215 20
--226 184 13 215 174 15 184 144 12 6 6 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 26 26 26 94 94 94 42 42 42 14 14 14
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 10 10 10
-- 30 30 30 78 78 78 50 50 50 104 69 6
--192 133 9 216 158 10 236 178 12 236 186 11
--232 195 16 241 208 19 244 214 54 245 215 43
--246 215 20 246 215 20 241 208 19 198 155 10
--200 144 11 216 158 10 156 118 10 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 6 6 6 90 90 90 54 54 54 18 18 18
-- 6 6 6 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 10 10 10
-- 30 30 30 78 78 78 46 46 46 22 22 22
--137 92 6 210 162 10 239 182 13 238 190 10
--238 202 15 241 208 19 246 215 20 246 215 20
--241 208 19 203 166 17 185 133 11 210 150 10
--216 158 10 210 150 10 102 78 10 2 2 6
-- 6 6 6 54 54 54 14 14 14 2 2 6
-- 2 2 6 62 62 62 74 74 74 30 30 30
-- 10 10 10 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 10 10 10
-- 34 34 34 78 78 78 50 50 50 6 6 6
-- 94 70 30 139 102 15 190 146 13 226 184 13
--232 200 30 232 195 16 215 174 15 190 146 13
--168 122 10 192 133 9 210 150 10 213 154 11
--202 150 34 182 157 106 101 98 89 2 2 6
-- 2 2 6 78 78 78 116 116 116 58 58 58
-- 2 2 6 22 22 22 90 90 90 46 46 46
-- 18 18 18 6 6 6 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 10 10 10
-- 38 38 38 86 86 86 50 50 50 6 6 6
--128 128 128 174 154 114 156 107 11 168 122 10
--198 155 10 184 144 12 197 138 11 200 144 11
--206 145 10 206 145 10 197 138 11 188 164 115
--195 195 195 198 198 198 174 174 174 14 14 14
-- 2 2 6 22 22 22 116 116 116 116 116 116
-- 22 22 22 2 2 6 74 74 74 70 70 70
-- 30 30 30 10 10 10 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 6 6 6 18 18 18
-- 50 50 50 101 101 101 26 26 26 10 10 10
--138 138 138 190 190 190 174 154 114 156 107 11
--197 138 11 200 144 11 197 138 11 192 133 9
--180 123 7 190 142 34 190 178 144 187 187 187
--202 202 202 221 221 221 214 214 214 66 66 66
-- 2 2 6 2 2 6 50 50 50 62 62 62
-- 6 6 6 2 2 6 10 10 10 90 90 90
-- 50 50 50 18 18 18 6 6 6 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 10 10 10 34 34 34
-- 74 74 74 74 74 74 2 2 6 6 6 6
--144 144 144 198 198 198 190 190 190 178 166 146
--154 121 60 156 107 11 156 107 11 168 124 44
--174 154 114 187 187 187 190 190 190 210 210 210
--246 246 246 253 253 253 253 253 253 182 182 182
-- 6 6 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 62 62 62
-- 74 74 74 34 34 34 14 14 14 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 10 10 10 22 22 22 54 54 54
-- 94 94 94 18 18 18 2 2 6 46 46 46
--234 234 234 221 221 221 190 190 190 190 190 190
--190 190 190 187 187 187 187 187 187 190 190 190
--190 190 190 195 195 195 214 214 214 242 242 242
--253 253 253 253 253 253 253 253 253 253 253 253
-- 82 82 82 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 14 14 14
-- 86 86 86 54 54 54 22 22 22 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 6 6 6 18 18 18 46 46 46 90 90 90
-- 46 46 46 18 18 18 6 6 6 182 182 182
--253 253 253 246 246 246 206 206 206 190 190 190
--190 190 190 190 190 190 190 190 190 190 190 190
--206 206 206 231 231 231 250 250 250 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--202 202 202 14 14 14 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 42 42 42 86 86 86 42 42 42 18 18 18
-- 6 6 6 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 6 6 6
-- 14 14 14 38 38 38 74 74 74 66 66 66
-- 2 2 6 6 6 6 90 90 90 250 250 250
--253 253 253 253 253 253 238 238 238 198 198 198
--190 190 190 190 190 190 195 195 195 221 221 221
--246 246 246 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 82 82 82 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 78 78 78 70 70 70 34 34 34
-- 14 14 14 6 6 6 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 14 14 14
-- 34 34 34 66 66 66 78 78 78 6 6 6
-- 2 2 6 18 18 18 218 218 218 253 253 253
--253 253 253 253 253 253 253 253 253 246 246 246
--226 226 226 231 231 231 246 246 246 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 178 178 178 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 18 18 18 90 90 90 62 62 62
-- 30 30 30 10 10 10 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 10 10 10 26 26 26
-- 58 58 58 90 90 90 18 18 18 2 2 6
-- 2 2 6 110 110 110 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--250 250 250 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 231 231 231 18 18 18 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 18 18 18 94 94 94
-- 54 54 54 26 26 26 10 10 10 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 6 6 6 22 22 22 50 50 50
-- 90 90 90 26 26 26 2 2 6 2 2 6
-- 14 14 14 195 195 195 250 250 250 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--250 250 250 242 242 242 54 54 54 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 38 38 38
-- 86 86 86 50 50 50 22 22 22 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 6 6 6 14 14 14 38 38 38 82 82 82
-- 34 34 34 2 2 6 2 2 6 2 2 6
-- 42 42 42 195 195 195 246 246 246 253 253 253
--253 253 253 253 253 253 253 253 253 250 250 250
--242 242 242 242 242 242 250 250 250 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 250 250 250 246 246 246 238 238 238
--226 226 226 231 231 231 101 101 101 6 6 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 38 38 38 82 82 82 42 42 42 14 14 14
-- 6 6 6 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 10 10 10 26 26 26 62 62 62 66 66 66
-- 2 2 6 2 2 6 2 2 6 6 6 6
-- 70 70 70 170 170 170 206 206 206 234 234 234
--246 246 246 250 250 250 250 250 250 238 238 238
--226 226 226 231 231 231 238 238 238 250 250 250
--250 250 250 250 250 250 246 246 246 231 231 231
--214 214 214 206 206 206 202 202 202 202 202 202
--198 198 198 202 202 202 182 182 182 18 18 18
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 62 62 62 66 66 66 30 30 30
-- 10 10 10 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 14 14 14 42 42 42 82 82 82 18 18 18
-- 2 2 6 2 2 6 2 2 6 10 10 10
-- 94 94 94 182 182 182 218 218 218 242 242 242
--250 250 250 253 253 253 253 253 253 250 250 250
--234 234 234 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 246 246 246
--238 238 238 226 226 226 210 210 210 202 202 202
--195 195 195 195 195 195 210 210 210 158 158 158
-- 6 6 6 14 14 14 50 50 50 14 14 14
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 6 6 6 86 86 86 46 46 46
-- 18 18 18 6 6 6 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 6 6 6
-- 22 22 22 54 54 54 70 70 70 2 2 6
-- 2 2 6 10 10 10 2 2 6 22 22 22
--166 166 166 231 231 231 250 250 250 253 253 253
--253 253 253 253 253 253 253 253 253 250 250 250
--242 242 242 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 246 246 246
--231 231 231 206 206 206 198 198 198 226 226 226
-- 94 94 94 2 2 6 6 6 6 38 38 38
-- 30 30 30 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 62 62 62 66 66 66
-- 26 26 26 10 10 10 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 10 10 10
-- 30 30 30 74 74 74 50 50 50 2 2 6
-- 26 26 26 26 26 26 2 2 6 106 106 106
--238 238 238 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 246 246 246 218 218 218 202 202 202
--210 210 210 14 14 14 2 2 6 2 2 6
-- 30 30 30 22 22 22 2 2 6 2 2 6
-- 2 2 6 2 2 6 18 18 18 86 86 86
-- 42 42 42 14 14 14 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 14 14 14
-- 42 42 42 90 90 90 22 22 22 2 2 6
-- 42 42 42 2 2 6 18 18 18 218 218 218
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 250 250 250 221 221 221
--218 218 218 101 101 101 2 2 6 14 14 14
-- 18 18 18 38 38 38 10 10 10 2 2 6
-- 2 2 6 2 2 6 2 2 6 78 78 78
-- 58 58 58 22 22 22 6 6 6 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 6 6 6 18 18 18
-- 54 54 54 82 82 82 2 2 6 26 26 26
-- 22 22 22 2 2 6 123 123 123 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 250 250 250
--238 238 238 198 198 198 6 6 6 38 38 38
-- 58 58 58 26 26 26 38 38 38 2 2 6
-- 2 2 6 2 2 6 2 2 6 46 46 46
-- 78 78 78 30 30 30 10 10 10 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 10 10 10 30 30 30
-- 74 74 74 58 58 58 2 2 6 42 42 42
-- 2 2 6 22 22 22 231 231 231 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 250 250 250
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 246 246 246 46 46 46 38 38 38
-- 42 42 42 14 14 14 38 38 38 14 14 14
-- 2 2 6 2 2 6 2 2 6 6 6 6
-- 86 86 86 46 46 46 14 14 14 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 6 6 6 14 14 14 42 42 42
-- 90 90 90 18 18 18 18 18 18 26 26 26
-- 2 2 6 116 116 116 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 250 250 250 238 238 238
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 94 94 94 6 6 6
-- 2 2 6 2 2 6 10 10 10 34 34 34
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 74 74 74 58 58 58 22 22 22 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 10 10 10 26 26 26 66 66 66
-- 82 82 82 2 2 6 38 38 38 6 6 6
-- 14 14 14 210 210 210 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 246 246 246 242 242 242
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 144 144 144 2 2 6
-- 2 2 6 2 2 6 2 2 6 46 46 46
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 42 42 42 74 74 74 30 30 30 10 10 10
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 6 6 6 14 14 14 42 42 42 90 90 90
-- 26 26 26 6 6 6 42 42 42 2 2 6
-- 74 74 74 250 250 250 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 242 242 242 242 242 242
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 182 182 182 2 2 6
-- 2 2 6 2 2 6 2 2 6 46 46 46
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 10 10 10 86 86 86 38 38 38 10 10 10
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 10 10 10 26 26 26 66 66 66 82 82 82
-- 2 2 6 22 22 22 18 18 18 2 2 6
--149 149 149 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 234 234 234 242 242 242
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 206 206 206 2 2 6
-- 2 2 6 2 2 6 2 2 6 38 38 38
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 6 6 6 86 86 86 46 46 46 14 14 14
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 6 6 6
-- 18 18 18 46 46 46 86 86 86 18 18 18
-- 2 2 6 34 34 34 10 10 10 6 6 6
--210 210 210 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 234 234 234 242 242 242
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 221 221 221 6 6 6
-- 2 2 6 2 2 6 6 6 6 30 30 30
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 82 82 82 54 54 54 18 18 18
-- 6 6 6 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 10 10 10
-- 26 26 26 66 66 66 62 62 62 2 2 6
-- 2 2 6 38 38 38 10 10 10 26 26 26
--238 238 238 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 231 231 231 238 238 238
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 231 231 231 6 6 6
-- 2 2 6 2 2 6 10 10 10 30 30 30
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 66 66 66 58 58 58 22 22 22
-- 6 6 6 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 10 10 10
-- 38 38 38 78 78 78 6 6 6 2 2 6
-- 2 2 6 46 46 46 14 14 14 42 42 42
--246 246 246 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 231 231 231 242 242 242
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 234 234 234 10 10 10
-- 2 2 6 2 2 6 22 22 22 14 14 14
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 66 66 66 62 62 62 22 22 22
-- 6 6 6 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 6 6 6 18 18 18
-- 50 50 50 74 74 74 2 2 6 2 2 6
-- 14 14 14 70 70 70 34 34 34 62 62 62
--250 250 250 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 231 231 231 246 246 246
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 234 234 234 14 14 14
-- 2 2 6 2 2 6 30 30 30 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 66 66 66 62 62 62 22 22 22
-- 6 6 6 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 6 6 6 18 18 18
-- 54 54 54 62 62 62 2 2 6 2 2 6
-- 2 2 6 30 30 30 46 46 46 70 70 70
--250 250 250 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 231 231 231 246 246 246
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 226 226 226 10 10 10
-- 2 2 6 6 6 6 30 30 30 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 66 66 66 58 58 58 22 22 22
-- 6 6 6 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 6 6 6 22 22 22
-- 58 58 58 62 62 62 2 2 6 2 2 6
-- 2 2 6 2 2 6 30 30 30 78 78 78
--250 250 250 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 231 231 231 246 246 246
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 206 206 206 2 2 6
-- 22 22 22 34 34 34 18 14 6 22 22 22
-- 26 26 26 18 18 18 6 6 6 2 2 6
-- 2 2 6 82 82 82 54 54 54 18 18 18
-- 6 6 6 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 6 6 6 26 26 26
-- 62 62 62 106 106 106 74 54 14 185 133 11
--210 162 10 121 92 8 6 6 6 62 62 62
--238 238 238 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 231 231 231 246 246 246
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 158 158 158 18 18 18
-- 14 14 14 2 2 6 2 2 6 2 2 6
-- 6 6 6 18 18 18 66 66 66 38 38 38
-- 6 6 6 94 94 94 50 50 50 18 18 18
-- 6 6 6 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 6 6 6
-- 10 10 10 10 10 10 18 18 18 38 38 38
-- 78 78 78 142 134 106 216 158 10 242 186 14
--246 190 14 246 190 14 156 118 10 10 10 10
-- 90 90 90 238 238 238 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 231 231 231 250 250 250
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 246 230 190
--238 204 91 238 204 91 181 142 44 37 26 9
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 38 38 38 46 46 46
-- 26 26 26 106 106 106 54 54 54 18 18 18
-- 6 6 6 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 6 6 6 14 14 14 22 22 22
-- 30 30 30 38 38 38 50 50 50 70 70 70
--106 106 106 190 142 34 226 170 11 242 186 14
--246 190 14 246 190 14 246 190 14 154 114 10
-- 6 6 6 74 74 74 226 226 226 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 231 231 231 250 250 250
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 228 184 62
--241 196 14 241 208 19 232 195 16 38 30 10
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 6 6 6 30 30 30 26 26 26
--203 166 17 154 142 90 66 66 66 26 26 26
-- 6 6 6 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 6 6 6 18 18 18 38 38 38 58 58 58
-- 78 78 78 86 86 86 101 101 101 123 123 123
--175 146 61 210 150 10 234 174 13 246 186 14
--246 190 14 246 190 14 246 190 14 238 190 10
--102 78 10 2 2 6 46 46 46 198 198 198
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 234 234 234 242 242 242
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 224 178 62
--242 186 14 241 196 14 210 166 10 22 18 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 6 6 6 121 92 8
--238 202 15 232 195 16 82 82 82 34 34 34
-- 10 10 10 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 14 14 14 38 38 38 70 70 70 154 122 46
--190 142 34 200 144 11 197 138 11 197 138 11
--213 154 11 226 170 11 242 186 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--225 175 15 46 32 6 2 2 6 22 22 22
--158 158 158 250 250 250 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 250 250 250 242 242 242 224 178 62
--239 182 13 236 186 11 213 154 11 46 32 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 61 42 6 225 175 15
--238 190 10 236 186 11 112 100 78 42 42 42
-- 14 14 14 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 6 6 6
-- 22 22 22 54 54 54 154 122 46 213 154 11
--226 170 11 230 174 11 226 170 11 226 170 11
--236 178 12 242 186 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--241 196 14 184 144 12 10 10 10 2 2 6
-- 6 6 6 116 116 116 242 242 242 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 231 231 231 198 198 198 214 170 54
--236 178 12 236 178 12 210 150 10 137 92 6
-- 18 14 6 2 2 6 2 2 6 2 2 6
-- 6 6 6 70 47 6 200 144 11 236 178 12
--239 182 13 239 182 13 124 112 88 58 58 58
-- 22 22 22 6 6 6 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 10 10 10
-- 30 30 30 70 70 70 180 133 36 226 170 11
--239 182 13 242 186 14 242 186 14 246 186 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 232 195 16 98 70 6 2 2 6
-- 2 2 6 2 2 6 66 66 66 221 221 221
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 206 206 206 198 198 198 214 166 58
--230 174 11 230 174 11 216 158 10 192 133 9
--163 110 8 116 81 8 102 78 10 116 81 8
--167 114 7 197 138 11 226 170 11 239 182 13
--242 186 14 242 186 14 162 146 94 78 78 78
-- 34 34 34 14 14 14 6 6 6 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 6 6 6
-- 30 30 30 78 78 78 190 142 34 226 170 11
--239 182 13 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 241 196 14 203 166 17 22 18 6
-- 2 2 6 2 2 6 2 2 6 38 38 38
--218 218 218 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--250 250 250 206 206 206 198 198 198 202 162 69
--226 170 11 236 178 12 224 166 10 210 150 10
--200 144 11 197 138 11 192 133 9 197 138 11
--210 150 10 226 170 11 242 186 14 246 190 14
--246 190 14 246 186 14 225 175 15 124 112 88
-- 62 62 62 30 30 30 14 14 14 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 10 10 10
-- 30 30 30 78 78 78 174 135 50 224 166 10
--239 182 13 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 241 196 14 139 102 15
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 78 78 78 250 250 250 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--250 250 250 214 214 214 198 198 198 190 150 46
--219 162 10 236 178 12 234 174 13 224 166 10
--216 158 10 213 154 11 213 154 11 216 158 10
--226 170 11 239 182 13 246 190 14 246 190 14
--246 190 14 246 190 14 242 186 14 206 162 42
--101 101 101 58 58 58 30 30 30 14 14 14
-- 6 6 6 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 10 10 10
-- 30 30 30 74 74 74 174 135 50 216 158 10
--236 178 12 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 241 196 14 226 184 13
-- 61 42 6 2 2 6 2 2 6 2 2 6
-- 22 22 22 238 238 238 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 226 226 226 187 187 187 180 133 36
--216 158 10 236 178 12 239 182 13 236 178 12
--230 174 11 226 170 11 226 170 11 230 174 11
--236 178 12 242 186 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 186 14 239 182 13
--206 162 42 106 106 106 66 66 66 34 34 34
-- 14 14 14 6 6 6 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 6 6 6
-- 26 26 26 70 70 70 163 133 67 213 154 11
--236 178 12 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 241 196 14
--190 146 13 18 14 6 2 2 6 2 2 6
-- 46 46 46 246 246 246 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 221 221 221 86 86 86 156 107 11
--216 158 10 236 178 12 242 186 14 246 186 14
--242 186 14 239 182 13 239 182 13 242 186 14
--242 186 14 246 186 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--242 186 14 225 175 15 142 122 72 66 66 66
-- 30 30 30 10 10 10 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 6 6 6
-- 26 26 26 70 70 70 163 133 67 210 150 10
--236 178 12 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--232 195 16 121 92 8 34 34 34 106 106 106
--221 221 221 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--242 242 242 82 82 82 18 14 6 163 110 8
--216 158 10 236 178 12 242 186 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 242 186 14 163 133 67
-- 46 46 46 18 18 18 6 6 6 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 10 10 10
-- 30 30 30 78 78 78 163 133 67 210 150 10
--236 178 12 246 186 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--241 196 14 215 174 15 190 178 144 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 218 218 218
-- 58 58 58 2 2 6 22 18 6 167 114 7
--216 158 10 236 178 12 246 186 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 186 14 242 186 14 190 150 46
-- 54 54 54 22 22 22 6 6 6 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 14 14 14
-- 38 38 38 86 86 86 180 133 36 213 154 11
--236 178 12 246 186 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 232 195 16 190 146 13 214 214 214
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 250 250 250 170 170 170 26 26 26
-- 2 2 6 2 2 6 37 26 9 163 110 8
--219 162 10 239 182 13 246 186 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 186 14 236 178 12 224 166 10 142 122 72
-- 46 46 46 18 18 18 6 6 6 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 6 6 6 18 18 18
-- 50 50 50 109 106 95 192 133 9 224 166 10
--242 186 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--242 186 14 226 184 13 210 162 10 142 110 46
--226 226 226 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--198 198 198 66 66 66 2 2 6 2 2 6
-- 2 2 6 2 2 6 50 34 6 156 107 11
--219 162 10 239 182 13 246 186 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 242 186 14
--234 174 13 213 154 11 154 122 46 66 66 66
-- 30 30 30 10 10 10 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 6 6 6 22 22 22
-- 58 58 58 154 121 60 206 145 10 234 174 13
--242 186 14 246 186 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 186 14 236 178 12 210 162 10 163 110 8
-- 61 42 6 138 138 138 218 218 218 250 250 250
--253 253 253 253 253 253 253 253 253 250 250 250
--242 242 242 210 210 210 144 144 144 66 66 66
-- 6 6 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 61 42 6 163 110 8
--216 158 10 236 178 12 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 239 182 13 230 174 11 216 158 10
--190 142 34 124 112 88 70 70 70 38 38 38
-- 18 18 18 6 6 6 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 6 6 6 22 22 22
-- 62 62 62 168 124 44 206 145 10 224 166 10
--236 178 12 239 182 13 242 186 14 242 186 14
--246 186 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 236 178 12 216 158 10 175 118 6
-- 80 54 7 2 2 6 6 6 6 30 30 30
-- 54 54 54 62 62 62 50 50 50 38 38 38
-- 14 14 14 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 6 6 6 80 54 7 167 114 7
--213 154 11 236 178 12 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 242 186 14 239 182 13 239 182 13
--230 174 11 210 150 10 174 135 50 124 112 88
-- 82 82 82 54 54 54 34 34 34 18 18 18
-- 6 6 6 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 6 6 6 18 18 18
-- 50 50 50 158 118 36 192 133 9 200 144 11
--216 158 10 219 162 10 224 166 10 226 170 11
--230 174 11 236 178 12 239 182 13 239 182 13
--242 186 14 246 186 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 186 14 230 174 11 210 150 10 163 110 8
--104 69 6 10 10 10 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 6 6 6 91 60 6 167 114 7
--206 145 10 230 174 11 242 186 14 246 190 14
--246 190 14 246 190 14 246 186 14 242 186 14
--239 182 13 230 174 11 224 166 10 213 154 11
--180 133 36 124 112 88 86 86 86 58 58 58
-- 38 38 38 22 22 22 10 10 10 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 14 14 14
-- 34 34 34 70 70 70 138 110 50 158 118 36
--167 114 7 180 123 7 192 133 9 197 138 11
--200 144 11 206 145 10 213 154 11 219 162 10
--224 166 10 230 174 11 239 182 13 242 186 14
--246 186 14 246 186 14 246 186 14 246 186 14
--239 182 13 216 158 10 185 133 11 152 99 6
--104 69 6 18 14 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 6 6 6 80 54 7 152 99 6
--192 133 9 219 162 10 236 178 12 239 182 13
--246 186 14 242 186 14 239 182 13 236 178 12
--224 166 10 206 145 10 192 133 9 154 121 60
-- 94 94 94 62 62 62 42 42 42 22 22 22
-- 14 14 14 6 6 6 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 6 6 6
-- 18 18 18 34 34 34 58 58 58 78 78 78
--101 98 89 124 112 88 142 110 46 156 107 11
--163 110 8 167 114 7 175 118 6 180 123 7
--185 133 11 197 138 11 210 150 10 219 162 10
--226 170 11 236 178 12 236 178 12 234 174 13
--219 162 10 197 138 11 163 110 8 130 83 6
-- 91 60 6 10 10 10 2 2 6 2 2 6
-- 18 18 18 38 38 38 38 38 38 38 38 38
-- 38 38 38 38 38 38 38 38 38 38 38 38
-- 38 38 38 38 38 38 26 26 26 2 2 6
-- 2 2 6 6 6 6 70 47 6 137 92 6
--175 118 6 200 144 11 219 162 10 230 174 11
--234 174 13 230 174 11 219 162 10 210 150 10
--192 133 9 163 110 8 124 112 88 82 82 82
-- 50 50 50 30 30 30 14 14 14 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 6 6 6 14 14 14 22 22 22 34 34 34
-- 42 42 42 58 58 58 74 74 74 86 86 86
--101 98 89 122 102 70 130 98 46 121 87 25
--137 92 6 152 99 6 163 110 8 180 123 7
--185 133 11 197 138 11 206 145 10 200 144 11
--180 123 7 156 107 11 130 83 6 104 69 6
-- 50 34 6 54 54 54 110 110 110 101 98 89
-- 86 86 86 82 82 82 78 78 78 78 78 78
-- 78 78 78 78 78 78 78 78 78 78 78 78
-- 78 78 78 82 82 82 86 86 86 94 94 94
--106 106 106 101 101 101 86 66 34 124 80 6
--156 107 11 180 123 7 192 133 9 200 144 11
--206 145 10 200 144 11 192 133 9 175 118 6
--139 102 15 109 106 95 70 70 70 42 42 42
-- 22 22 22 10 10 10 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 6 6 6 10 10 10
-- 14 14 14 22 22 22 30 30 30 38 38 38
-- 50 50 50 62 62 62 74 74 74 90 90 90
--101 98 89 112 100 78 121 87 25 124 80 6
--137 92 6 152 99 6 152 99 6 152 99 6
--138 86 6 124 80 6 98 70 6 86 66 30
--101 98 89 82 82 82 58 58 58 46 46 46
-- 38 38 38 34 34 34 34 34 34 34 34 34
-- 34 34 34 34 34 34 34 34 34 34 34 34
-- 34 34 34 34 34 34 38 38 38 42 42 42
-- 54 54 54 82 82 82 94 86 76 91 60 6
--134 86 6 156 107 11 167 114 7 175 118 6
--175 118 6 167 114 7 152 99 6 121 87 25
--101 98 89 62 62 62 34 34 34 18 18 18
-- 6 6 6 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 6 6 6 6 6 6 10 10 10
-- 18 18 18 22 22 22 30 30 30 42 42 42
-- 50 50 50 66 66 66 86 86 86 101 98 89
--106 86 58 98 70 6 104 69 6 104 69 6
--104 69 6 91 60 6 82 62 34 90 90 90
-- 62 62 62 38 38 38 22 22 22 14 14 14
-- 10 10 10 10 10 10 10 10 10 10 10 10
-- 10 10 10 10 10 10 6 6 6 10 10 10
-- 10 10 10 10 10 10 10 10 10 14 14 14
-- 22 22 22 42 42 42 70 70 70 89 81 66
-- 80 54 7 104 69 6 124 80 6 137 92 6
--134 86 6 116 81 8 100 82 52 86 86 86
-- 58 58 58 30 30 30 14 14 14 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 6 6 6 10 10 10 14 14 14
-- 18 18 18 26 26 26 38 38 38 54 54 54
-- 70 70 70 86 86 86 94 86 76 89 81 66
-- 89 81 66 86 86 86 74 74 74 50 50 50
-- 30 30 30 14 14 14 6 6 6 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 6 6 6 18 18 18 34 34 34 58 58 58
-- 82 82 82 89 81 66 89 81 66 89 81 66
-- 94 86 66 94 86 76 74 74 74 50 50 50
-- 26 26 26 14 14 14 6 6 6 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 6 6 6 6 6 6 14 14 14 18 18 18
-- 30 30 30 38 38 38 46 46 46 54 54 54
-- 50 50 50 42 42 42 30 30 30 18 18 18
-- 10 10 10 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 6 6 6 14 14 14 26 26 26
-- 38 38 38 50 50 50 58 58 58 58 58 58
-- 54 54 54 42 42 42 30 30 30 18 18 18
-- 10 10 10 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 6 6 6
-- 6 6 6 10 10 10 14 14 14 18 18 18
-- 18 18 18 14 14 14 10 10 10 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 6 6 6
-- 14 14 14 18 18 18 22 22 22 22 22 22
-- 18 18 18 14 14 14 10 10 10 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 3 3 3 0 0 0 0 0 0
-+0 0 0 0 0 0 0 0 0 0 0 0 3 3 3 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 1 1 1 0 0 0
-+0 0 0 3 3 3 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 2 1 0 2 1 0 3 2 2
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 2 2 2 0 0 0 3 4 3 26 28 28
-+37 38 37 37 38 37 14 17 19 2 2 2 0 0 0 2 2 2
-+5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 3 3 3 0 0 0 1 1 1 6 6 6
-+2 2 2 0 0 0 3 3 3 4 4 4 4 4 4 4 4 4
-+4 4 5 3 3 3 1 0 0 0 0 0 1 0 0 0 0 0
-+1 1 1 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+2 2 2 0 0 0 0 0 0 14 17 19 60 74 84 137 136 137
-+153 152 153 137 136 137 125 124 125 60 73 81 6 6 6 3 1 0
-+0 0 0 3 3 3 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 0 0 0 4 4 4 41 54 63 125 124 125
-+60 73 81 6 6 6 4 0 0 3 3 3 4 4 4 4 4 4
-+4 4 4 0 0 0 6 9 11 41 54 63 41 65 82 22 30 35
-+2 2 2 2 1 0 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 5 5 5 5 5 5 2 2 2 0 0 0
-+4 0 0 6 6 6 41 54 63 137 136 137 174 174 174 167 166 167
-+165 164 165 165 164 165 163 162 163 163 162 163 125 124 125 41 54 63
-+1 1 1 0 0 0 0 0 0 3 3 3 5 5 5 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 5 5 5
-+3 3 3 2 0 0 4 0 0 60 73 81 156 155 156 167 166 167
-+163 162 163 85 115 134 5 7 8 0 0 0 4 4 4 5 5 5
-+0 0 0 2 5 5 55 98 126 90 154 193 90 154 193 72 125 159
-+37 51 59 2 0 0 1 1 1 4 5 5 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 5 5 5 4 4 4 1 1 1 0 0 0 3 3 3
-+37 38 37 125 124 125 163 162 163 174 174 174 158 157 158 158 157 158
-+156 155 156 156 155 156 158 157 158 165 164 165 174 174 174 166 165 166
-+125 124 125 16 19 21 1 0 0 0 0 0 0 0 0 4 4 4
-+5 5 5 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 1 1 1
-+0 0 0 0 0 0 37 38 37 153 152 153 174 174 174 158 157 158
-+174 174 174 163 162 163 37 38 37 4 3 3 4 0 0 1 1 1
-+0 0 0 22 40 52 101 161 196 101 161 196 90 154 193 101 161 196
-+64 123 161 14 17 19 0 0 0 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
-+5 5 5 2 2 2 0 0 0 4 0 0 24 26 27 85 115 134
-+156 155 156 174 174 174 167 166 167 156 155 156 154 153 154 157 156 157
-+156 155 156 156 155 156 155 154 155 153 152 153 158 157 158 167 166 167
-+174 174 174 156 155 156 60 74 84 16 19 21 0 0 0 0 0 0
-+1 1 1 5 5 5 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 5 5 5 6 6 6 3 3 3 0 0 0 4 0 0
-+13 16 17 60 73 81 137 136 137 165 164 165 156 155 156 153 152 153
-+174 174 174 177 184 187 60 73 81 3 1 0 0 0 0 1 1 2
-+22 30 35 64 123 161 136 185 209 90 154 193 90 154 193 90 154 193
-+90 154 193 21 29 34 0 0 0 3 2 2 4 4 5 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 3 3 3
-+0 0 0 0 0 0 10 13 16 60 74 84 157 156 157 174 174 174
-+174 174 174 158 157 158 153 152 153 154 153 154 156 155 156 155 154 155
-+156 155 156 155 154 155 154 153 154 157 156 157 154 153 154 153 152 153
-+163 162 163 174 174 174 177 184 187 137 136 137 60 73 81 13 16 17
-+4 0 0 0 0 0 3 3 3 5 5 5 4 4 4 4 4 4
-+5 5 5 4 4 4 1 1 1 0 0 0 3 3 3 41 54 63
-+131 129 131 174 174 174 174 174 174 174 174 174 167 166 167 174 174 174
-+190 197 201 137 136 137 24 26 27 4 0 0 16 21 25 50 82 103
-+90 154 193 136 185 209 90 154 193 101 161 196 101 161 196 101 161 196
-+31 91 132 3 6 7 0 0 0 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 2 2 2 0 0 0 4 0 0
-+4 0 0 43 57 68 137 136 137 177 184 187 174 174 174 163 162 163
-+155 154 155 155 154 155 156 155 156 155 154 155 158 157 158 165 164 165
-+167 166 167 166 165 166 163 162 163 157 156 157 155 154 155 155 154 155
-+153 152 153 156 155 156 167 166 167 174 174 174 174 174 174 131 129 131
-+41 54 63 5 5 5 0 0 0 0 0 0 3 3 3 4 4 4
-+1 1 1 0 0 0 1 0 0 26 28 28 125 124 125 174 174 174
-+177 184 187 174 174 174 174 174 174 156 155 156 131 129 131 137 136 137
-+125 124 125 24 26 27 4 0 0 41 65 82 90 154 193 136 185 209
-+136 185 209 101 161 196 53 118 160 37 112 160 90 154 193 34 86 122
-+7 12 15 0 0 0 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 3 3 3 0 0 0 0 0 0 5 5 5 37 38 37
-+125 124 125 167 166 167 174 174 174 167 166 167 158 157 158 155 154 155
-+156 155 156 156 155 156 156 155 156 163 162 163 167 166 167 155 154 155
-+137 136 137 153 152 153 156 155 156 165 164 165 163 162 163 156 155 156
-+156 155 156 156 155 156 155 154 155 158 157 158 166 165 166 174 174 174
-+167 166 167 125 124 125 37 38 37 1 0 0 0 0 0 0 0 0
-+0 0 0 24 26 27 60 74 84 158 157 158 174 174 174 174 174 174
-+166 165 166 158 157 158 125 124 125 41 54 63 13 16 17 6 6 6
-+6 6 6 37 38 37 80 127 157 136 185 209 101 161 196 101 161 196
-+90 154 193 28 67 93 6 10 14 13 20 25 13 20 25 6 10 14
-+1 1 2 4 3 3 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+1 1 1 1 0 0 4 3 3 37 38 37 60 74 84 153 152 153
-+167 166 167 167 166 167 158 157 158 154 153 154 155 154 155 156 155 156
-+157 156 157 158 157 158 167 166 167 167 166 167 131 129 131 43 57 68
-+26 28 28 37 38 37 60 73 81 131 129 131 165 164 165 166 165 166
-+158 157 158 155 154 155 156 155 156 156 155 156 156 155 156 158 157 158
-+165 164 165 174 174 174 163 162 163 60 74 84 16 19 21 13 16 17
-+60 73 81 131 129 131 174 174 174 174 174 174 167 166 167 165 164 165
-+137 136 137 60 73 81 24 26 27 4 0 0 4 0 0 16 19 21
-+52 104 138 101 161 196 136 185 209 136 185 209 90 154 193 27 99 146
-+13 20 25 4 5 7 2 5 5 4 5 7 1 1 2 0 0 0
-+4 4 4 4 4 4 3 3 3 2 2 2 2 2 2 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 3 3 3 0 0 0
-+0 0 0 13 16 17 60 73 81 137 136 137 174 174 174 166 165 166
-+158 157 158 156 155 156 157 156 157 156 155 156 155 154 155 158 157 158
-+167 166 167 174 174 174 153 152 153 60 73 81 16 19 21 4 0 0
-+4 0 0 4 0 0 6 6 6 26 28 28 60 74 84 158 157 158
-+174 174 174 166 165 166 157 156 157 155 154 155 156 155 156 156 155 156
-+155 154 155 158 157 158 167 166 167 167 166 167 131 129 131 125 124 125
-+137 136 137 167 166 167 167 166 167 174 174 174 158 157 158 125 124 125
-+16 19 21 4 0 0 4 0 0 10 13 16 49 76 92 107 159 188
-+136 185 209 136 185 209 90 154 193 26 108 161 22 40 52 6 10 14
-+2 3 3 1 1 2 1 1 2 4 4 5 4 4 5 4 4 5
-+4 4 5 2 2 1 0 0 0 0 0 0 0 0 0 2 2 2
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 5 5 5 3 3 3 0 0 0 1 0 0 4 0 0
-+37 51 59 131 129 131 167 166 167 167 166 167 163 162 163 157 156 157
-+157 156 157 155 154 155 153 152 153 157 156 157 167 166 167 174 174 174
-+153 152 153 125 124 125 37 38 37 4 0 0 4 0 0 4 0 0
-+4 3 3 4 3 3 4 0 0 6 6 6 4 0 0 37 38 37
-+125 124 125 174 174 174 174 174 174 165 164 165 156 155 156 154 153 154
-+156 155 156 156 155 156 155 154 155 163 162 163 158 157 158 163 162 163
-+174 174 174 174 174 174 174 174 174 125 124 125 37 38 37 0 0 0
-+4 0 0 6 9 11 41 54 63 90 154 193 136 185 209 146 190 211
-+136 185 209 37 112 160 22 40 52 6 10 14 3 6 7 1 1 2
-+1 1 2 3 3 3 1 1 2 3 3 3 4 4 4 4 4 4
-+2 2 2 2 0 0 16 19 21 37 38 37 24 26 27 0 0 0
-+0 0 0 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 5 5 5
-+4 4 4 0 0 0 0 0 0 0 0 0 26 28 28 120 125 127
-+158 157 158 174 174 174 165 164 165 157 156 157 155 154 155 156 155 156
-+153 152 153 153 152 153 167 166 167 174 174 174 174 174 174 125 124 125
-+37 38 37 4 0 0 0 0 0 4 0 0 4 3 3 4 4 4
-+4 4 4 4 4 4 5 5 5 4 0 0 4 0 0 4 0 0
-+4 3 3 43 57 68 137 136 137 174 174 174 174 174 174 165 164 165
-+154 153 154 153 152 153 153 152 153 153 152 153 163 162 163 174 174 174
-+174 174 174 153 152 153 60 73 81 6 6 6 4 0 0 4 3 3
-+32 43 50 80 127 157 136 185 209 146 190 211 146 190 211 90 154 193
-+28 67 93 28 67 93 40 71 93 3 6 7 1 1 2 2 5 5
-+50 82 103 79 117 143 26 37 45 0 0 0 3 3 3 1 1 1
-+0 0 0 41 54 63 137 136 137 174 174 174 153 152 153 60 73 81
-+2 0 0 0 0 0
-+4 4 4 4 4 4 4 4 4 4 4 4 6 6 6 2 2 2
-+0 0 0 2 0 0 24 26 27 60 74 84 153 152 153 174 174 174
-+174 174 174 157 156 157 154 153 154 156 155 156 154 153 154 153 152 153
-+165 164 165 174 174 174 177 184 187 137 136 137 43 57 68 6 6 6
-+4 0 0 2 0 0 3 3 3 5 5 5 5 5 5 4 4 4
-+4 4 4 4 4 4 4 4 4 5 5 5 6 6 6 4 3 3
-+4 0 0 4 0 0 24 26 27 60 73 81 153 152 153 174 174 174
-+174 174 174 158 157 158 158 157 158 174 174 174 174 174 174 158 157 158
-+60 74 84 24 26 27 4 0 0 4 0 0 17 23 27 59 113 148
-+136 185 209 191 222 234 146 190 211 136 185 209 31 91 132 7 11 13
-+22 40 52 101 161 196 90 154 193 6 9 11 3 4 4 43 95 132
-+136 185 209 172 205 220 55 98 126 0 0 0 0 0 0 2 0 0
-+26 28 28 153 152 153 177 184 187 167 166 167 177 184 187 165 164 165
-+37 38 37 0 0 0
-+4 4 4 4 4 4 5 5 5 5 5 5 1 1 1 0 0 0
-+13 16 17 60 73 81 137 136 137 174 174 174 174 174 174 165 164 165
-+153 152 153 153 152 153 155 154 155 154 153 154 158 157 158 174 174 174
-+177 184 187 163 162 163 60 73 81 16 19 21 4 0 0 4 0 0
-+4 3 3 4 4 4 5 5 5 5 5 5 4 4 4 5 5 5
-+5 5 5 5 5 5 5 5 5 4 4 4 4 4 4 5 5 5
-+6 6 6 4 0 0 4 0 0 4 0 0 24 26 27 60 74 84
-+166 165 166 174 174 174 177 184 187 165 164 165 125 124 125 24 26 27
-+4 0 0 4 0 0 5 5 5 50 82 103 136 185 209 172 205 220
-+146 190 211 136 185 209 26 108 161 22 40 52 7 12 15 44 81 103
-+71 116 144 28 67 93 37 51 59 41 65 82 100 139 164 101 161 196
-+90 154 193 90 154 193 28 67 93 0 0 0 0 0 0 26 28 28
-+125 124 125 167 166 167 163 162 163 153 152 153 163 162 163 174 174 174
-+85 115 134 4 0 0
-+4 4 4 5 5 5 4 4 4 1 0 0 4 0 0 34 47 55
-+125 124 125 174 174 174 174 174 174 167 166 167 157 156 157 153 152 153
-+155 154 155 155 154 155 158 157 158 166 165 166 167 166 167 154 153 154
-+125 124 125 26 28 28 4 0 0 4 0 0 4 0 0 5 5 5
-+5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 1 1 1
-+0 0 0 0 0 0 1 1 1 4 4 4 4 4 4 4 4 4
-+5 5 5 5 5 5 4 3 3 4 0 0 4 0 0 6 6 6
-+37 38 37 131 129 131 137 136 137 37 38 37 0 0 0 4 0 0
-+4 5 5 43 61 72 90 154 193 172 205 220 146 190 211 136 185 209
-+90 154 193 28 67 93 13 20 25 43 61 72 71 116 144 44 81 103
-+2 5 5 7 11 13 59 113 148 101 161 196 90 154 193 28 67 93
-+13 20 25 6 10 14 0 0 0 13 16 17 60 73 81 137 136 137
-+166 165 166 158 157 158 156 155 156 154 153 154 167 166 167 174 174 174
-+60 73 81 4 0 0
-+4 4 4 4 4 4 0 0 0 3 3 3 60 74 84 174 174 174
-+174 174 174 167 166 167 163 162 163 155 154 155 157 156 157 155 154 155
-+156 155 156 163 162 163 167 166 167 158 157 158 125 124 125 37 38 37
-+4 3 3 4 0 0 4 0 0 6 6 6 6 6 6 5 5 5
-+4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 2 3 3
-+10 13 16 7 11 13 1 0 0 0 0 0 2 2 1 4 4 4
-+4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 4 0 0
-+4 0 0 7 11 13 13 16 17 4 0 0 3 3 3 34 47 55
-+80 127 157 146 190 211 172 205 220 136 185 209 136 185 209 136 185 209
-+28 67 93 22 40 52 55 98 126 55 98 126 21 29 34 7 11 13
-+50 82 103 101 161 196 101 161 196 35 83 115 13 20 25 2 2 1
-+1 1 2 1 1 2 37 51 59 131 129 131 174 174 174 174 174 174
-+167 166 167 163 162 163 163 162 163 167 166 167 174 174 174 125 124 125
-+16 19 21 4 0 0
-+4 4 4 4 0 0 4 0 0 60 74 84 174 174 174 174 174 174
-+158 157 158 155 154 155 155 154 155 156 155 156 155 154 155 158 157 158
-+167 166 167 165 164 165 131 129 131 60 73 81 13 16 17 4 0 0
-+4 0 0 4 3 3 6 6 6 4 3 3 5 5 5 4 4 4
-+4 4 4 3 2 2 0 0 0 0 0 0 7 11 13 45 69 86
-+80 127 157 71 116 144 43 61 72 7 11 13 0 0 0 1 1 1
-+4 3 3 4 4 4 4 4 4 4 4 4 6 6 6 5 5 5
-+3 2 2 4 0 0 1 0 0 21 29 34 59 113 148 136 185 209
-+146 190 211 136 185 209 136 185 209 136 185 209 136 185 209 136 185 209
-+68 124 159 44 81 103 22 40 52 13 16 17 43 61 72 90 154 193
-+136 185 209 59 113 148 21 29 34 3 4 3 1 1 1 0 0 0
-+24 26 27 125 124 125 163 162 163 174 174 174 166 165 166 165 164 165
-+163 162 163 125 124 125 125 124 125 125 124 125 125 124 125 26 28 28
-+4 0 0 4 3 3
-+3 3 3 0 0 0 24 26 27 153 152 153 177 184 187 158 157 158
-+156 155 156 156 155 156 155 154 155 155 154 155 165 164 165 174 174 174
-+155 154 155 60 74 84 26 28 28 4 0 0 4 0 0 3 1 0
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 3 3
-+2 0 0 0 0 0 0 0 0 32 43 50 72 125 159 101 161 196
-+136 185 209 101 161 196 101 161 196 79 117 143 32 43 50 0 0 0
-+0 0 0 2 2 2 4 4 4 4 4 4 3 3 3 1 0 0
-+0 0 0 4 5 5 49 76 92 101 161 196 146 190 211 146 190 211
-+136 185 209 136 185 209 136 185 209 136 185 209 136 185 209 90 154 193
-+28 67 93 13 16 17 37 51 59 80 127 157 136 185 209 90 154 193
-+22 40 52 6 9 11 3 4 3 2 2 1 16 19 21 60 73 81
-+137 136 137 163 162 163 158 157 158 166 165 166 167 166 167 153 152 153
-+60 74 84 37 38 37 6 6 6 13 16 17 4 0 0 1 0 0
-+3 2 2 4 4 4
-+3 2 2 4 0 0 37 38 37 137 136 137 167 166 167 158 157 158
-+157 156 157 154 153 154 157 156 157 167 166 167 174 174 174 125 124 125
-+37 38 37 4 0 0 4 0 0 4 0 0 4 3 3 4 4 4
-+4 4 4 4 4 4 5 5 5 5 5 5 1 1 1 0 0 0
-+0 0 0 16 21 25 55 98 126 90 154 193 136 185 209 101 161 196
-+101 161 196 101 161 196 136 185 209 136 185 209 101 161 196 55 98 126
-+14 17 19 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
-+22 40 52 90 154 193 146 190 211 146 190 211 136 185 209 136 185 209
-+136 185 209 136 185 209 136 185 209 101 161 196 35 83 115 7 11 13
-+17 23 27 59 113 148 136 185 209 101 161 196 34 86 122 7 12 15
-+2 5 5 3 4 3 6 6 6 60 73 81 131 129 131 163 162 163
-+166 165 166 174 174 174 174 174 174 163 162 163 125 124 125 41 54 63
-+13 16 17 4 0 0 4 0 0 4 0 0 1 0 0 2 2 2
-+4 4 4 4 4 4
-+1 1 1 2 1 0 43 57 68 137 136 137 153 152 153 153 152 153
-+163 162 163 156 155 156 165 164 165 167 166 167 60 74 84 6 6 6
-+4 0 0 4 0 0 5 5 5 4 4 4 4 4 4 4 4 4
-+4 5 5 6 6 6 4 3 3 0 0 0 0 0 0 11 15 18
-+40 71 93 100 139 164 101 161 196 101 161 196 101 161 196 101 161 196
-+101 161 196 101 161 196 101 161 196 101 161 196 136 185 209 136 185 209
-+101 161 196 45 69 86 6 6 6 0 0 0 17 23 27 55 98 126
-+136 185 209 146 190 211 136 185 209 136 185 209 136 185 209 136 185 209
-+136 185 209 136 185 209 90 154 193 22 40 52 7 11 13 50 82 103
-+136 185 209 136 185 209 53 118 160 22 40 52 7 11 13 2 5 5
-+3 4 3 37 38 37 125 124 125 157 156 157 166 165 166 167 166 167
-+174 174 174 174 174 174 137 136 137 60 73 81 4 0 0 4 0 0
-+4 0 0 4 0 0 5 5 5 3 3 3 3 3 3 4 4 4
-+4 4 4 4 4 4
-+4 0 0 4 0 0 41 54 63 137 136 137 125 124 125 131 129 131
-+155 154 155 167 166 167 174 174 174 60 74 84 6 6 6 4 0 0
-+4 3 3 6 6 6 4 4 4 4 4 4 4 4 4 5 5 5
-+4 4 4 1 1 1 0 0 0 3 6 7 41 65 82 72 125 159
-+101 161 196 101 161 196 101 161 196 90 154 193 90 154 193 101 161 196
-+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 136 185 209
-+136 185 209 136 185 209 80 127 157 55 98 126 101 161 196 146 190 211
-+136 185 209 136 185 209 136 185 209 101 161 196 136 185 209 101 161 196
-+136 185 209 101 161 196 35 83 115 22 30 35 101 161 196 172 205 220
-+90 154 193 28 67 93 7 11 13 2 5 5 3 4 3 13 16 17
-+85 115 134 167 166 167 174 174 174 174 174 174 174 174 174 174 174 174
-+167 166 167 60 74 84 13 16 17 4 0 0 4 0 0 4 3 3
-+6 6 6 5 5 5 4 4 4 5 5 5 4 4 4 5 5 5
-+5 5 5 5 5 5
-+1 1 1 4 0 0 41 54 63 137 136 137 137 136 137 125 124 125
-+131 129 131 167 166 167 157 156 157 37 38 37 6 6 6 4 0 0
-+6 6 6 5 5 5 4 4 4 4 4 4 4 5 5 2 2 1
-+0 0 0 0 0 0 26 37 45 58 111 146 101 161 196 101 161 196
-+101 161 196 90 154 193 90 154 193 90 154 193 101 161 196 101 161 196
-+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
-+101 161 196 136 185 209 136 185 209 136 185 209 146 190 211 136 185 209
-+136 185 209 101 161 196 136 185 209 136 185 209 101 161 196 136 185 209
-+101 161 196 136 185 209 136 185 209 136 185 209 136 185 209 16 89 141
-+7 11 13 2 5 5 2 5 5 13 16 17 60 73 81 154 154 154
-+174 174 174 174 174 174 174 174 174 174 174 174 163 162 163 125 124 125
-+24 26 27 4 0 0 4 0 0 4 0 0 5 5 5 5 5 5
-+4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 5 5 5
-+5 5 5 4 4 4
-+4 0 0 6 6 6 37 38 37 137 136 137 137 136 137 131 129 131
-+131 129 131 153 152 153 131 129 131 26 28 28 4 0 0 4 3 3
-+6 6 6 4 4 4 4 4 4 4 4 4 0 0 0 0 0 0
-+13 20 25 51 88 114 90 154 193 101 161 196 101 161 196 90 154 193
-+90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
-+101 161 196 101 161 196 101 161 196 101 161 196 136 185 209 101 161 196
-+101 161 196 136 185 209 101 161 196 136 185 209 136 185 209 101 161 196
-+136 185 209 101 161 196 136 185 209 101 161 196 101 161 196 101 161 196
-+136 185 209 136 185 209 136 185 209 37 112 160 21 29 34 5 7 8
-+2 5 5 13 16 17 43 57 68 131 129 131 174 174 174 174 174 174
-+174 174 174 167 166 167 157 156 157 125 124 125 37 38 37 4 0 0
-+4 0 0 4 0 0 5 5 5 5 5 5 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+1 1 1 4 0 0 41 54 63 153 152 153 137 136 137 137 136 137
-+137 136 137 153 152 153 125 124 125 24 26 27 4 0 0 3 2 2
-+4 4 4 4 4 4 4 3 3 4 0 0 3 6 7 43 61 72
-+64 123 161 101 161 196 90 154 193 90 154 193 90 154 193 90 154 193
-+90 154 193 90 154 193 90 154 193 90 154 193 101 161 196 90 154 193
-+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
-+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
-+136 185 209 101 161 196 101 161 196 136 185 209 136 185 209 101 161 196
-+101 161 196 90 154 193 28 67 93 13 16 17 7 11 13 3 6 7
-+37 51 59 125 124 125 163 162 163 174 174 174 167 166 167 166 165 166
-+167 166 167 131 129 131 60 73 81 4 0 0 4 0 0 4 0 0
-+3 3 3 5 5 5 6 6 6 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 0 0 4 0 0 41 54 63 137 136 137 153 152 153 137 136 137
-+153 152 153 157 156 157 125 124 125 24 26 27 0 0 0 2 2 2
-+4 4 4 4 4 4 2 0 0 0 0 0 28 67 93 90 154 193
-+90 154 193 90 154 193 90 154 193 90 154 193 64 123 161 90 154 193
-+90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
-+90 154 193 101 161 196 101 161 196 101 161 196 90 154 193 136 185 209
-+101 161 196 101 161 196 136 185 209 101 161 196 136 185 209 101 161 196
-+101 161 196 101 161 196 136 185 209 101 161 196 101 161 196 90 154 193
-+35 83 115 13 16 17 3 6 7 2 5 5 13 16 17 60 74 84
-+154 154 154 166 165 166 165 164 165 158 157 158 163 162 163 157 156 157
-+60 74 84 13 16 17 4 0 0 4 0 0 3 2 2 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+1 1 1 4 0 0 41 54 63 157 156 157 155 154 155 137 136 137
-+153 152 153 158 157 158 137 136 137 26 28 28 2 0 0 2 2 2
-+4 4 4 4 4 4 1 0 0 6 10 14 34 86 122 90 154 193
-+64 123 161 90 154 193 64 123 161 90 154 193 90 154 193 90 154 193
-+64 123 161 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
-+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
-+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
-+136 185 209 101 161 196 136 185 209 90 154 193 26 108 161 22 40 52
-+13 16 17 5 7 8 2 5 5 2 5 5 37 38 37 165 164 165
-+174 174 174 163 162 163 154 154 154 165 164 165 167 166 167 60 73 81
-+6 6 6 4 0 0 4 0 0 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 0 0 6 6 6 41 54 63 156 155 156 158 157 158 153 152 153
-+156 155 156 165 164 165 137 136 137 26 28 28 0 0 0 2 2 2
-+4 4 5 4 4 4 2 0 0 7 12 15 31 96 139 64 123 161
-+90 154 193 64 123 161 90 154 193 90 154 193 64 123 161 90 154 193
-+90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
-+90 154 193 90 154 193 90 154 193 101 161 196 101 161 196 101 161 196
-+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 136 185 209
-+101 161 196 136 185 209 26 108 161 22 40 52 7 11 13 5 7 8
-+2 5 5 2 5 5 2 5 5 2 2 1 37 38 37 158 157 158
-+174 174 174 154 154 154 156 155 156 167 166 167 165 164 165 37 38 37
-+4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+3 1 0 4 0 0 60 73 81 157 156 157 163 162 163 153 152 153
-+158 157 158 167 166 167 137 136 137 26 28 28 2 0 0 2 2 2
-+4 5 5 4 4 4 4 0 0 7 12 15 24 86 132 26 108 161
-+37 112 160 64 123 161 90 154 193 64 123 161 90 154 193 90 154 193
-+90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
-+90 154 193 101 161 196 90 154 193 101 161 196 101 161 196 101 161 196
-+101 161 196 101 161 196 101 161 196 136 185 209 101 161 196 136 185 209
-+90 154 193 35 83 115 13 16 17 13 16 17 7 11 13 3 6 7
-+5 7 8 6 6 6 3 4 3 2 2 1 30 32 34 154 154 154
-+167 166 167 154 154 154 154 154 154 174 174 174 165 164 165 37 38 37
-+6 6 6 4 0 0 6 6 6 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 0 0 4 0 0 41 54 63 163 162 163 166 165 166 154 154 154
-+163 162 163 174 174 174 137 136 137 26 28 28 0 0 0 2 2 2
-+4 5 5 4 4 5 1 1 2 6 10 14 28 67 93 18 97 151
-+18 97 151 18 97 151 26 108 161 37 112 160 37 112 160 90 154 193
-+64 123 161 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
-+90 154 193 101 161 196 101 161 196 90 154 193 101 161 196 101 161 196
-+101 161 196 101 161 196 101 161 196 136 185 209 90 154 193 16 89 141
-+13 20 25 7 11 13 5 7 8 5 7 8 2 5 5 4 5 5
-+3 4 3 4 5 5 3 4 3 0 0 0 37 38 37 158 157 158
-+174 174 174 158 157 158 158 157 158 167 166 167 174 174 174 41 54 63
-+4 0 0 3 2 2 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+1 1 1 4 0 0 60 73 81 165 164 165 174 174 174 158 157 158
-+167 166 167 174 174 174 153 152 153 26 28 28 2 0 0 2 2 2
-+4 5 5 4 4 4 4 0 0 7 12 15 10 87 144 10 87 144
-+18 97 151 18 97 151 18 97 151 26 108 161 26 108 161 26 108 161
-+26 108 161 37 112 160 53 118 160 90 154 193 90 154 193 90 154 193
-+90 154 193 90 154 193 101 161 196 101 161 196 101 161 196 101 161 196
-+101 161 196 136 185 209 90 154 193 26 108 161 22 40 52 13 16 17
-+7 11 13 3 6 7 5 7 8 5 7 8 2 5 5 4 5 5
-+4 5 5 6 6 6 3 4 3 0 0 0 30 32 34 158 157 158
-+174 174 174 156 155 156 155 154 155 165 164 165 154 153 154 37 38 37
-+4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 0 0 4 0 0 60 73 81 167 166 167 174 174 174 163 162 163
-+174 174 174 174 174 174 153 152 153 26 28 28 0 0 0 3 3 3
-+5 5 5 4 4 4 1 1 2 7 12 15 28 67 93 18 97 151
-+18 97 151 18 97 151 18 97 151 18 97 151 18 97 151 26 108 161
-+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
-+90 154 193 26 108 161 90 154 193 90 154 193 90 154 193 101 161 196
-+101 161 196 26 108 161 22 40 52 13 16 17 7 11 13 2 5 5
-+2 5 5 6 6 6 2 5 5 4 5 5 4 5 5 4 5 5
-+3 4 3 5 5 5 3 4 3 2 0 0 30 32 34 137 136 137
-+153 152 153 137 136 137 131 129 131 137 136 137 131 129 131 37 38 37
-+4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+1 1 1 4 0 0 60 73 81 167 166 167 174 174 174 166 165 166
-+174 174 174 177 184 187 153 152 153 30 32 34 1 0 0 3 3 3
-+5 5 5 4 3 3 4 0 0 7 12 15 10 87 144 10 87 144
-+18 97 151 18 97 151 18 97 151 26 108 161 26 108 161 26 108 161
-+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
-+26 108 161 26 108 161 26 108 161 90 154 193 90 154 193 26 108 161
-+35 83 115 13 16 17 7 11 13 5 7 8 3 6 7 5 7 8
-+2 5 5 6 6 6 4 5 5 4 5 5 3 4 3 4 5 5
-+3 4 3 6 6 6 3 4 3 0 0 0 26 28 28 125 124 125
-+131 129 131 125 124 125 125 124 125 131 129 131 131 129 131 37 38 37
-+4 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+3 1 0 4 0 0 60 73 81 174 174 174 177 184 187 167 166 167
-+174 174 174 177 184 187 153 152 153 30 32 34 0 0 0 3 3 3
-+5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 18 97 151
-+18 97 151 18 97 151 18 97 151 18 97 151 18 97 151 26 108 161
-+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
-+26 108 161 90 154 193 26 108 161 26 108 161 24 86 132 13 20 25
-+7 11 13 13 20 25 22 40 52 5 7 8 3 4 3 3 4 3
-+4 5 5 3 4 3 4 5 5 3 4 3 4 5 5 3 4 3
-+4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 125 124 125
-+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
-+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+1 1 1 4 0 0 60 73 81 174 174 174 177 184 187 174 174 174
-+174 174 174 190 197 201 157 156 157 30 32 34 1 0 0 3 3 3
-+5 5 5 4 3 3 4 0 0 7 12 15 10 87 144 10 87 144
-+18 97 151 19 95 150 19 95 150 18 97 151 18 97 151 26 108 161
-+18 97 151 26 108 161 26 108 161 26 108 161 26 108 161 90 154 193
-+26 108 161 26 108 161 26 108 161 22 40 52 2 5 5 3 4 3
-+28 67 93 37 112 160 34 86 122 2 5 5 3 4 3 3 4 3
-+3 4 3 3 4 3 3 4 3 2 2 1 3 4 3 4 4 4
-+4 5 5 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
-+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
-+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 0 0 4 0 0 60 73 81 174 174 174 177 184 187 174 174 174
-+174 174 174 190 197 201 158 157 158 30 32 34 0 0 0 2 2 2
-+5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 18 97 151
-+10 87 144 19 95 150 19 95 150 18 97 151 18 97 151 18 97 151
-+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
-+18 97 151 22 40 52 2 5 5 2 2 1 22 40 52 26 108 161
-+90 154 193 37 112 160 22 40 52 3 4 3 13 20 25 22 30 35
-+3 6 7 1 1 1 2 2 2 6 9 11 5 5 5 4 3 3
-+4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
-+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
-+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+1 1 1 4 0 0 60 73 81 177 184 187 193 200 203 174 174 174
-+177 184 187 193 200 203 163 162 163 30 32 34 4 0 0 2 2 2
-+5 5 5 4 3 3 4 0 0 6 10 14 24 86 132 10 87 144
-+10 87 144 10 87 144 19 95 150 19 95 150 19 95 150 18 97 151
-+26 108 161 26 108 161 26 108 161 90 154 193 26 108 161 28 67 93
-+6 10 14 2 5 5 13 20 25 24 86 132 37 112 160 90 154 193
-+10 87 144 7 12 15 2 5 5 28 67 93 37 112 160 28 67 93
-+2 2 1 7 12 15 35 83 115 28 67 93 3 6 7 1 0 0
-+4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
-+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
-+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 0 0 4 0 0 60 73 81 174 174 174 190 197 201 174 174 174
-+177 184 187 193 200 203 163 162 163 30 32 34 0 0 0 2 2 2
-+5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
-+10 87 144 16 89 141 19 95 150 10 87 144 26 108 161 26 108 161
-+26 108 161 26 108 161 26 108 161 28 67 93 6 10 14 1 1 2
-+7 12 15 28 67 93 26 108 161 16 89 141 24 86 132 21 29 34
-+3 4 3 21 29 34 37 112 160 37 112 160 27 99 146 21 29 34
-+21 29 34 26 108 161 90 154 193 35 83 115 1 1 2 2 0 0
-+4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 125 124 125
-+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
-+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+3 1 0 4 0 0 60 73 81 193 200 203 193 200 203 174 174 174
-+190 197 201 193 200 203 165 164 165 37 38 37 4 0 0 2 2 2
-+5 5 5 4 3 3 4 0 0 6 10 14 24 86 132 10 87 144
-+10 87 144 10 87 144 16 89 141 18 97 151 18 97 151 10 87 144
-+24 86 132 24 86 132 13 20 25 4 5 7 4 5 7 22 40 52
-+18 97 151 37 112 160 26 108 161 7 12 15 1 1 1 0 0 0
-+28 67 93 37 112 160 26 108 161 28 67 93 22 40 52 28 67 93
-+26 108 161 90 154 193 26 108 161 10 87 144 0 0 0 2 0 0
-+4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
-+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
-+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 0 0 6 6 6 60 73 81 174 174 174 193 200 203 174 174 174
-+190 197 201 193 200 203 165 164 165 30 32 34 0 0 0 2 2 2
-+5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
-+10 87 144 10 87 144 10 87 144 18 97 151 28 67 93 6 10 14
-+0 0 0 1 1 2 4 5 7 13 20 25 16 89 141 26 108 161
-+26 108 161 26 108 161 24 86 132 6 9 11 2 3 3 22 40 52
-+37 112 160 16 89 141 22 40 52 28 67 93 26 108 161 26 108 161
-+90 154 193 26 108 161 26 108 161 28 67 93 1 1 1 4 0 0
-+4 4 4 5 5 5 3 3 3 4 0 0 26 28 28 124 126 130
-+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
-+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 0 0 4 0 0 60 73 81 193 200 203 193 200 203 174 174 174
-+193 200 203 193 200 203 167 166 167 37 38 37 4 0 0 2 2 2
-+5 5 5 4 4 4 4 0 0 6 10 14 28 67 93 10 87 144
-+10 87 144 10 87 144 18 97 151 10 87 144 13 20 25 4 5 7
-+1 1 2 1 1 1 22 40 52 26 108 161 26 108 161 26 108 161
-+26 108 161 26 108 161 26 108 161 24 86 132 22 40 52 22 40 52
-+22 40 52 22 40 52 10 87 144 26 108 161 26 108 161 26 108 161
-+26 108 161 26 108 161 90 154 193 10 87 144 0 0 0 4 0 0
-+4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
-+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
-+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
-+190 197 201 205 212 215 167 166 167 30 32 34 0 0 0 2 2 2
-+5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
-+10 87 144 10 87 144 10 87 144 10 87 144 22 40 52 1 1 2
-+2 0 0 1 1 2 24 86 132 26 108 161 26 108 161 26 108 161
-+26 108 161 19 95 150 16 89 141 10 87 144 22 40 52 22 40 52
-+10 87 144 26 108 161 37 112 160 26 108 161 26 108 161 26 108 161
-+26 108 161 26 108 161 26 108 161 28 67 93 2 0 0 3 1 0
-+4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
-+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
-+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 0 0 4 0 0 60 73 81 220 221 221 190 197 201 174 174 174
-+193 200 203 193 200 203 174 174 174 37 38 37 4 0 0 2 2 2
-+5 5 5 4 4 4 3 2 2 1 1 2 13 20 25 10 87 144
-+10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 13 20 25
-+13 20 25 22 40 52 10 87 144 18 97 151 18 97 151 26 108 161
-+10 87 144 13 20 25 6 10 14 21 29 34 24 86 132 18 97 151
-+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
-+26 108 161 90 154 193 18 97 151 13 20 25 0 0 0 4 3 3
-+4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
-+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
-+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
-+190 197 201 220 221 221 167 166 167 30 32 34 1 0 0 2 2 2
-+5 5 5 4 4 4 4 4 5 2 5 5 4 5 7 13 20 25
-+28 67 93 10 87 144 10 87 144 10 87 144 10 87 144 10 87 144
-+10 87 144 10 87 144 18 97 151 10 87 144 18 97 151 18 97 151
-+28 67 93 2 3 3 0 0 0 28 67 93 26 108 161 26 108 161
-+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
-+26 108 161 10 87 144 13 20 25 1 1 2 3 2 2 4 4 4
-+4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
-+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
-+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 0 0 4 0 0 60 73 81 220 221 221 190 197 201 174 174 174
-+193 200 203 193 200 203 174 174 174 26 28 28 4 0 0 4 3 3
-+5 5 5 4 4 4 4 4 4 4 4 5 1 1 2 2 5 5
-+4 5 7 22 40 52 10 87 144 10 87 144 18 97 151 10 87 144
-+10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 18 97 151
-+10 87 144 28 67 93 22 40 52 10 87 144 26 108 161 18 97 151
-+18 97 151 18 97 151 26 108 161 26 108 161 26 108 161 26 108 161
-+22 40 52 1 1 2 0 0 0 2 3 3 4 4 4 4 4 4
-+4 4 4 5 5 5 4 4 4 0 0 0 26 28 28 131 129 131
-+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
-+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
-+190 197 201 220 221 221 190 197 201 41 54 63 4 0 0 2 2 2
-+6 6 6 4 4 4 4 4 4 4 4 5 4 4 5 3 3 3
-+1 1 2 1 1 2 6 10 14 22 40 52 10 87 144 18 97 151
-+18 97 151 10 87 144 10 87 144 10 87 144 18 97 151 10 87 144
-+10 87 144 18 97 151 26 108 161 18 97 151 18 97 151 10 87 144
-+26 108 161 26 108 161 26 108 161 10 87 144 28 67 93 6 10 14
-+1 1 2 1 1 2 4 3 3 4 4 5 4 4 4 4 4 4
-+5 5 5 5 5 5 1 1 1 4 0 0 37 51 59 137 136 137
-+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
-+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 0 0 4 0 0 60 73 81 220 221 221 193 200 203 174 174 174
-+193 200 203 193 200 203 220 221 221 137 136 137 13 16 17 4 0 0
-+2 2 2 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5
-+4 4 5 4 3 3 1 1 2 4 5 7 13 20 25 28 67 93
-+10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 10 87 144
-+10 87 144 18 97 151 18 97 151 10 87 144 18 97 151 26 108 161
-+26 108 161 18 97 151 28 67 93 6 10 14 0 0 0 0 0 0
-+2 3 3 4 5 5 4 4 5 4 4 4 4 4 4 5 5 5
-+3 3 3 1 1 1 0 0 0 16 19 21 125 124 125 137 136 137
-+131 129 131 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
-+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
-+193 200 203 190 197 201 220 221 221 220 221 221 153 152 153 30 32 34
-+0 0 0 0 0 0 2 2 2 4 4 4 4 4 4 4 4 4
-+4 4 4 4 5 5 4 5 7 1 1 2 1 1 2 4 5 7
-+13 20 25 28 67 93 10 87 144 18 97 151 10 87 144 10 87 144
-+10 87 144 10 87 144 10 87 144 18 97 151 26 108 161 18 97 151
-+28 67 93 7 12 15 0 0 0 0 0 0 2 2 1 4 4 4
-+4 5 5 4 5 5 4 4 4 4 4 4 3 3 3 0 0 0
-+0 0 0 0 0 0 37 38 37 125 124 125 158 157 158 131 129 131
-+125 124 125 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
-+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 3 3 4 0 0 41 54 63 193 200 203 220 221 221 174 174 174
-+193 200 203 193 200 203 193 200 203 220 221 221 244 246 246 193 200 203
-+120 125 127 5 5 5 1 0 0 0 0 0 1 1 1 4 4 4
-+4 4 4 4 4 4 4 5 5 4 5 5 4 4 5 1 1 2
-+4 5 7 4 5 7 22 40 52 10 87 144 10 87 144 10 87 144
-+10 87 144 10 87 144 18 97 151 10 87 144 10 87 144 13 20 25
-+4 5 7 2 3 3 1 1 2 4 4 4 4 5 5 4 4 4
-+4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 1 1 2
-+24 26 27 60 74 84 153 152 153 163 162 163 137 136 137 125 124 125
-+125 124 125 125 124 125 125 124 125 137 136 137 125 124 125 26 28 28
-+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 0 0 6 6 6 26 28 28 156 155 156 220 221 221 220 221 221
-+174 174 174 193 200 203 193 200 203 193 200 203 205 212 215 220 221 221
-+220 221 221 167 166 167 60 73 81 7 11 13 0 0 0 0 0 0
-+3 3 3 4 4 4 4 4 4 4 4 4 4 4 5 4 4 5
-+4 4 5 1 1 2 1 1 2 4 5 7 22 40 52 10 87 144
-+10 87 144 10 87 144 10 87 144 22 40 52 4 5 7 1 1 2
-+1 1 2 4 4 5 4 4 4 4 4 4 4 4 4 4 4 4
-+5 5 5 2 2 2 0 0 0 4 0 0 16 19 21 60 73 81
-+137 136 137 167 166 167 158 157 158 137 136 137 131 129 131 131 129 131
-+125 124 125 125 124 125 131 129 131 155 154 155 60 74 84 5 7 8
-+0 0 0 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+5 5 5 4 0 0 4 0 0 60 73 81 193 200 203 220 221 221
-+193 200 203 193 200 203 193 200 203 193 200 203 205 212 215 220 221 221
-+220 221 221 220 221 221 220 221 221 137 136 137 43 57 68 6 6 6
-+4 0 0 1 1 1 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 5 4 4 5 3 2 2 1 1 2 2 5 5 13 20 25
-+22 40 52 22 40 52 13 20 25 2 3 3 1 1 2 3 3 3
-+4 5 7 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+1 1 1 0 0 0 2 3 3 41 54 63 131 129 131 166 165 166
-+166 165 166 155 154 155 153 152 153 137 136 137 137 136 137 125 124 125
-+125 124 125 137 136 137 137 136 137 125 124 125 37 38 37 4 3 3
-+4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 3 3 6 6 6 6 6 6 13 16 17 60 73 81 167 166 167
-+220 221 221 220 221 221 220 221 221 193 200 203 193 200 203 193 200 203
-+205 212 215 220 221 221 220 221 221 244 246 246 205 212 215 125 124 125
-+24 26 27 0 0 0 0 0 0 2 2 2 5 5 5 5 5 5
-+4 4 4 4 4 4 4 4 4 4 4 5 1 1 2 4 5 7
-+4 5 7 4 5 7 1 1 2 3 2 2 4 4 5 4 4 4
-+4 4 4 4 4 4 5 5 5 4 4 4 0 0 0 0 0 0
-+2 0 0 26 28 28 125 124 125 174 174 174 174 174 174 166 165 166
-+156 155 156 153 152 153 137 136 137 137 136 137 131 129 131 137 136 137
-+137 136 137 137 136 137 60 74 84 30 32 34 4 0 0 4 0 0
-+5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+5 5 5 6 6 6 4 0 0 4 0 0 6 6 6 26 28 28
-+125 124 125 174 174 174 220 221 221 220 221 221 220 221 221 193 200 203
-+205 212 215 220 221 221 205 212 215 220 221 221 220 221 221 244 246 246
-+193 200 203 60 74 84 13 16 17 4 0 0 0 0 0 3 3 3
-+5 5 5 5 5 5 4 4 4 4 4 4 4 4 5 3 3 3
-+1 1 2 3 3 3 4 4 5 4 4 5 4 4 4 4 4 4
-+5 5 5 5 5 5 2 2 2 0 0 0 0 0 0 13 16 17
-+60 74 84 174 174 174 193 200 203 174 174 174 167 166 167 163 162 163
-+153 152 153 153 152 153 137 136 137 137 136 137 153 152 153 137 136 137
-+125 124 125 41 54 63 24 26 27 4 0 0 4 0 0 5 5 5
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 3 3 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
-+6 6 6 37 38 37 131 129 131 220 221 221 220 221 221 220 221 221
-+193 200 203 193 200 203 220 221 221 205 212 215 220 221 221 244 246 246
-+244 246 246 244 246 246 174 174 174 41 54 63 0 0 0 0 0 0
-+0 0 0 4 4 4 5 5 5 5 5 5 4 4 4 4 4 5
-+4 4 5 4 4 5 4 4 4 4 4 4 6 6 6 6 6 6
-+3 3 3 0 0 0 2 0 0 13 16 17 60 73 81 156 155 156
-+220 221 221 193 200 203 174 174 174 165 164 165 163 162 163 154 153 154
-+153 152 153 153 152 153 158 157 158 163 162 163 137 136 137 60 73 81
-+13 16 17 4 0 0 4 0 0 4 3 3 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+5 5 5 4 3 3 4 3 3 6 6 6 6 6 6 6 6 6
-+6 6 6 6 6 6 6 6 6 37 38 37 167 166 167 244 246 246
-+244 246 246 220 221 221 205 212 215 205 212 215 220 221 221 193 200 203
-+220 221 221 244 246 246 244 246 246 244 246 246 137 136 137 37 38 37
-+3 2 2 0 0 0 1 1 1 5 5 5 5 5 5 4 4 4
-+4 4 4 4 4 4 4 4 4 5 5 5 4 4 4 1 1 1
-+0 0 0 5 5 5 43 57 68 153 152 153 193 200 203 220 221 221
-+177 184 187 174 174 174 167 166 167 166 165 166 158 157 158 157 156 157
-+158 157 158 166 165 166 156 155 156 85 115 134 13 16 17 4 0 0
-+4 0 0 4 0 0 5 5 5 5 5 5 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+5 5 5 4 3 3 6 6 6 6 6 6 4 0 0 6 6 6
-+6 6 6 6 6 6 6 6 6 6 6 6 13 16 17 60 73 81
-+177 184 187 220 221 221 220 221 221 220 221 221 205 212 215 220 221 221
-+220 221 221 205 212 215 220 221 221 244 246 246 244 246 246 205 212 215
-+125 124 125 30 32 34 0 0 0 0 0 0 2 2 2 5 5 5
-+4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 1 0 0
-+37 38 37 131 129 131 205 212 215 220 221 221 193 200 203 174 174 174
-+174 174 174 174 174 174 167 166 167 165 164 165 166 165 166 167 166 167
-+158 157 158 125 124 125 37 38 37 4 0 0 4 0 0 4 0 0
-+4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 5 5 5 4 3 3 4 3 3 6 6 6 6 6 6
-+4 0 0 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
-+26 28 28 125 124 125 205 212 215 220 221 221 220 221 221 220 221 221
-+205 212 215 220 221 221 205 212 215 220 221 221 220 221 221 244 246 246
-+244 246 246 190 197 201 60 74 84 16 19 21 4 0 0 0 0 0
-+0 0 0 0 0 0 0 0 0 0 0 0 16 19 21 120 125 127
-+177 184 187 220 221 221 205 212 215 177 184 187 174 174 174 177 184 187
-+174 174 174 174 174 174 167 166 167 174 174 174 166 165 166 137 136 137
-+60 73 81 13 16 17 4 0 0 4 0 0 4 3 3 6 6 6
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+5 5 5 4 3 3 5 5 5 4 3 3 6 6 6 4 0 0
-+6 6 6 6 6 6 4 0 0 6 6 6 4 0 0 6 6 6
-+6 6 6 6 6 6 37 38 37 137 136 137 193 200 203 220 221 221
-+220 221 221 205 212 215 220 221 221 205 212 215 205 212 215 220 221 221
-+220 221 221 220 221 221 244 246 246 166 165 166 43 57 68 2 2 2
-+0 0 0 4 0 0 16 19 21 60 73 81 157 156 157 202 210 214
-+220 221 221 193 200 203 177 184 187 177 184 187 177 184 187 174 174 174
-+174 174 174 174 174 174 174 174 174 157 156 157 60 74 84 24 26 27
-+4 0 0 4 0 0 4 0 0 6 6 6 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 5 5 5 4 3 3 5 5 5 6 6 6
-+6 6 6 4 0 0 6 6 6 6 6 6 6 6 6 4 0 0
-+4 0 0 4 0 0 6 6 6 24 26 27 60 73 81 167 166 167
-+220 221 221 220 221 221 220 221 221 205 212 215 205 212 215 205 212 215
-+205 212 215 220 221 221 220 221 221 220 221 221 205 212 215 137 136 137
-+60 74 84 125 124 125 137 136 137 190 197 201 220 221 221 193 200 203
-+177 184 187 177 184 187 177 184 187 174 174 174 174 174 174 177 184 187
-+190 197 201 174 174 174 125 124 125 37 38 37 6 6 6 4 0 0
-+4 0 0 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 5 5 5 5 5 5 4 3 3 6 6 6
-+4 0 0 6 6 6 6 6 6 6 6 6 4 0 0 6 6 6
-+6 6 6 6 6 6 4 0 0 4 0 0 6 6 6 6 6 6
-+125 124 125 193 200 203 244 246 246 220 221 221 205 212 215 205 212 215
-+205 212 215 193 200 203 205 212 215 205 212 215 220 221 221 220 221 221
-+193 200 203 193 200 203 205 212 215 193 200 203 193 200 203 177 184 187
-+190 197 201 190 197 201 174 174 174 190 197 201 193 200 203 190 197 201
-+153 152 153 60 73 81 4 0 0 4 0 0 4 0 0 3 2 2
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 4 3 3
-+6 6 6 4 3 3 4 3 3 4 3 3 6 6 6 6 6 6
-+4 0 0 6 6 6 6 6 6 6 6 6 4 0 0 4 0 0
-+4 0 0 26 28 28 131 129 131 220 221 221 244 246 246 220 221 221
-+205 212 215 193 200 203 205 212 215 193 200 203 193 200 203 205 212 215
-+220 221 221 193 200 203 193 200 203 193 200 203 190 197 201 174 174 174
-+174 174 174 190 197 201 193 200 203 193 200 203 167 166 167 125 124 125
-+6 6 6 4 0 0 4 0 0 4 3 3 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
-+5 5 5 4 3 3 5 5 5 6 6 6 4 3 3 5 5 5
-+6 6 6 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
-+4 0 0 4 0 0 6 6 6 41 54 63 158 157 158 220 221 221
-+220 221 221 220 221 221 193 200 203 193 200 203 193 200 203 190 197 201
-+190 197 201 190 197 201 190 197 201 190 197 201 174 174 174 193 200 203
-+193 200 203 220 221 221 174 174 174 125 124 125 37 38 37 4 0 0
-+4 0 0 4 3 3 6 6 6 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 5 5 5 4 3 3 4 3 3 4 3 3 5 5 5
-+4 3 3 6 6 6 5 5 5 4 3 3 6 6 6 6 6 6
-+6 6 6 6 6 6 4 0 0 4 0 0 13 16 17 60 73 81
-+174 174 174 220 221 221 220 221 221 205 212 215 190 197 201 174 174 174
-+193 200 203 174 174 174 190 197 201 174 174 174 193 200 203 220 221 221
-+193 200 203 131 129 131 37 38 37 6 6 6 4 0 0 4 0 0
-+6 6 6 6 6 6 4 3 3 5 5 5 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 5 5 5
-+5 5 5 4 3 3 4 3 3 5 5 5 4 3 3 4 3 3
-+5 5 5 6 6 6 6 6 6 4 0 0 6 6 6 6 6 6
-+6 6 6 125 124 125 174 174 174 220 221 221 220 221 221 193 200 203
-+193 200 203 193 200 203 193 200 203 193 200 203 220 221 221 158 157 158
-+60 73 81 6 6 6 4 0 0 4 0 0 5 5 5 6 6 6
-+5 5 5 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 5 5 5 5 5 5 4 3 3 5 5 5 4 3 3
-+5 5 5 5 5 5 6 6 6 6 6 6 4 0 0 4 0 0
-+4 0 0 4 0 0 26 28 28 125 124 125 174 174 174 193 200 203
-+193 200 203 174 174 174 193 200 203 167 166 167 125 124 125 6 6 6
-+6 6 6 6 6 6 4 0 0 6 6 6 6 6 6 5 5 5
-+4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
-+4 3 3 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
-+6 6 6 4 0 0 4 0 0 6 6 6 37 38 37 125 124 125
-+153 152 153 131 129 131 125 124 125 37 38 37 6 6 6 6 6 6
-+6 6 6 4 0 0 6 6 6 6 6 6 4 3 3 5 5 5
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 5 5 5 5 5 5 4 3 3 5 5 5 4 3 3
-+6 6 6 6 6 6 4 0 0 4 0 0 6 6 6 6 6 6
-+24 26 27 24 26 27 6 6 6 6 6 6 6 6 6 4 0 0
-+6 6 6 6 6 6 4 0 0 6 6 6 5 5 5 4 3 3
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 5 5 5 4 3 3 5 5 5 6 6 6
-+4 0 0 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
-+6 6 6 6 6 6 6 6 6 4 0 0 6 6 6 6 6 6
-+4 0 0 6 6 6 6 6 6 4 3 3 5 5 5 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 5 5 5
-+5 5 5 5 5 5 4 0 0 6 6 6 4 0 0 6 6 6
-+6 6 6 6 6 6 6 6 6 4 0 0 6 6 6 4 0 0
-+6 6 6 4 3 3 5 5 5 4 3 3 5 5 5 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
-+4 3 3 6 6 6 4 3 3 6 6 6 6 6 6 6 6 6
-+4 0 0 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
-+6 6 6 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 5 5 5 4 3 3 5 5 5 4 0 0 6 6 6
-+6 6 6 4 0 0 6 6 6 6 6 6 4 0 0 6 6 6
-+4 3 3 5 5 5 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 5 5 5 4 3 3 5 5 5 6 6 6 4 3 3
-+4 3 3 6 6 6 6 6 6 4 3 3 6 6 6 4 3 3
-+5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 6 6 6
-+5 5 5 4 3 3 4 3 3 4 3 3 5 5 5 5 5 5
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 4 3 3
-+5 5 5 4 3 3 5 5 5 5 5 5 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-diff --git a/drivers/video/nvidia/nv_backlight.c b/drivers/video/nvidia/nv_backlight.c
-index 443e3c8..c443d6a 100644
---- a/drivers/video/nvidia/nv_backlight.c
-+++ b/drivers/video/nvidia/nv_backlight.c
-@@ -87,7 +87,7 @@ static int nvidia_bl_get_brightness(struct backlight_device *bd)
- return bd->props.brightness;
- }
-
--static struct backlight_ops nvidia_bl_ops = {
-+static const struct backlight_ops nvidia_bl_ops = {
- .get_brightness = nvidia_bl_get_brightness,
- .update_status = nvidia_bl_update_status,
- };
-diff --git a/drivers/video/riva/fbdev.c b/drivers/video/riva/fbdev.c
-index d94c57f..912984c 100644
---- a/drivers/video/riva/fbdev.c
-+++ b/drivers/video/riva/fbdev.c
-@@ -331,7 +331,7 @@ static int riva_bl_get_brightness(struct backlight_device *bd)
- return bd->props.brightness;
- }
-
--static struct backlight_ops riva_bl_ops = {
-+static const struct backlight_ops riva_bl_ops = {
- .get_brightness = riva_bl_get_brightness,
- .update_status = riva_bl_update_status,
- };
-diff --git a/drivers/video/uvesafb.c b/drivers/video/uvesafb.c
-index 6623a2e..d748f10 100644
---- a/drivers/video/uvesafb.c
-+++ b/drivers/video/uvesafb.c
-@@ -18,6 +18,7 @@
- #include <linux/fb.h>
- #include <linux/io.h>
- #include <linux/mutex.h>
-+#include <linux/moduleloader.h>
- #include <video/edid.h>
- #include <video/uvesafb.h>
- #ifdef CONFIG_X86
-@@ -72,7 +73,7 @@ static void uvesafb_cn_callback(struct cn_msg *msg, struct netlink_skb_parms *ns
- struct uvesafb_task *utask;
- struct uvesafb_ktask *task;
-
-- if (!cap_raised(nsp->eff_cap, CAP_SYS_ADMIN))
-+ if (!capable(CAP_SYS_ADMIN))
- return;
-
- if (msg->seq >= UVESAFB_TASKS_MAX)
-@@ -120,7 +121,7 @@ static int uvesafb_helper_start(void)
- NULL,
- };
-
-- return call_usermodehelper(v86d_path, argv, envp, 1);
-+ return call_usermodehelper(v86d_path, argv, envp, UMH_WAIT_PROC);
- }
-
- /*
-@@ -568,10 +569,32 @@ static int __devinit uvesafb_vbe_getpmi(struct uvesafb_ktask *task,
- if ((task->t.regs.eax & 0xffff) != 0x4f || task->t.regs.es < 0xc000) {
- par->pmi_setpal = par->ypan = 0;
- } else {
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+#ifdef CONFIG_MODULES
-+ par->pmi_code = module_alloc_exec((u16)task->t.regs.ecx);
-+#endif
-+ if (!par->pmi_code) {
-+ par->pmi_setpal = par->ypan = 0;
-+ return 0;
-+ }
-+#endif
-+
- par->pmi_base = (u16 *)phys_to_virt(((u32)task->t.regs.es << 4)
- + task->t.regs.edi);
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+ pax_open_kernel();
-+ memcpy(par->pmi_code, par->pmi_base, (u16)task->t.regs.ecx);
-+ pax_close_kernel();
-+
-+ par->pmi_start = ktva_ktla(par->pmi_code + par->pmi_base[1]);
-+ par->pmi_pal = ktva_ktla(par->pmi_code + par->pmi_base[2]);
-+#else
- par->pmi_start = (u8 *)par->pmi_base + par->pmi_base[1];
- par->pmi_pal = (u8 *)par->pmi_base + par->pmi_base[2];
-+#endif
-+
- printk(KERN_INFO "uvesafb: protected mode interface info at "
- "%04x:%04x\n",
- (u16)task->t.regs.es, (u16)task->t.regs.edi);
-@@ -1806,6 +1829,11 @@ out:
- if (par->vbe_modes)
- kfree(par->vbe_modes);
-
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+ if (par->pmi_code)
-+ module_free_exec(NULL, par->pmi_code);
-+#endif
-+
- framebuffer_release(info);
- return err;
- }
-@@ -1832,6 +1860,12 @@ static int uvesafb_remove(struct platform_device *dev)
- kfree(par->vbe_state_orig);
- if (par->vbe_state_saved)
- kfree(par->vbe_state_saved);
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+ if (par->pmi_code)
-+ module_free_exec(NULL, par->pmi_code);
-+#endif
-+
- }
-
- framebuffer_release(info);
-diff --git a/drivers/video/vesafb.c b/drivers/video/vesafb.c
-index bd37ee1..cb827e8 100644
---- a/drivers/video/vesafb.c
-+++ b/drivers/video/vesafb.c
-@@ -9,6 +9,7 @@
- */
-
- #include <linux/module.h>
-+#include <linux/moduleloader.h>
- #include <linux/kernel.h>
- #include <linux/errno.h>
- #include <linux/string.h>
-@@ -53,8 +54,8 @@ static int vram_remap __initdata; /* Set amount of memory to be used */
- static int vram_total __initdata; /* Set total amount of memory */
- static int pmi_setpal __read_mostly = 1; /* pmi for palette changes ??? */
- static int ypan __read_mostly; /* 0..nothing, 1..ypan, 2..ywrap */
--static void (*pmi_start)(void) __read_mostly;
--static void (*pmi_pal) (void) __read_mostly;
-+static void (*pmi_start)(void) __read_only;
-+static void (*pmi_pal) (void) __read_only;
- static int depth __read_mostly;
- static int vga_compat __read_mostly;
- /* --------------------------------------------------------------------- */
-@@ -233,6 +234,7 @@ static int __init vesafb_probe(struct platform_device *dev)
- unsigned int size_vmode;
- unsigned int size_remap;
- unsigned int size_total;
-+ void *pmi_code = NULL;
-
- if (screen_info.orig_video_isVGA != VIDEO_TYPE_VLFB)
- return -ENODEV;
-@@ -275,10 +277,6 @@ static int __init vesafb_probe(struct platform_device *dev)
- size_remap = size_total;
- vesafb_fix.smem_len = size_remap;
-
--#ifndef __i386__
-- screen_info.vesapm_seg = 0;
--#endif
--
- if (!request_mem_region(vesafb_fix.smem_start, size_total, "vesafb")) {
- printk(KERN_WARNING
- "vesafb: cannot reserve video memory at 0x%lx\n",
-@@ -315,9 +313,21 @@ static int __init vesafb_probe(struct platform_device *dev)
- printk(KERN_INFO "vesafb: mode is %dx%dx%d, linelength=%d, pages=%d\n",
- vesafb_defined.xres, vesafb_defined.yres, vesafb_defined.bits_per_pixel, vesafb_fix.line_length, screen_info.pages);
-
-+#ifdef __i386__
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+ pmi_code = module_alloc_exec(screen_info.vesapm_size);
-+ if (!pmi_code)
-+#elif !defined(CONFIG_PAX_KERNEXEC)
-+ if (0)
-+#endif
-+
-+#endif
-+ screen_info.vesapm_seg = 0;
-+
- if (screen_info.vesapm_seg) {
-- printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x\n",
-- screen_info.vesapm_seg,screen_info.vesapm_off);
-+ printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x %04x bytes\n",
-+ screen_info.vesapm_seg,screen_info.vesapm_off,screen_info.vesapm_size);
- }
-
- if (screen_info.vesapm_seg < 0xc000)
-@@ -325,9 +335,25 @@ static int __init vesafb_probe(struct platform_device *dev)
-
- if (ypan || pmi_setpal) {
- unsigned short *pmi_base;
-+
- pmi_base = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
-- pmi_start = (void*)((char*)pmi_base + pmi_base[1]);
-- pmi_pal = (void*)((char*)pmi_base + pmi_base[2]);
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+ pax_open_kernel();
-+ memcpy(pmi_code, pmi_base, screen_info.vesapm_size);
-+#else
-+ pmi_code = pmi_base;
-+#endif
-+
-+ pmi_start = (void*)((char*)pmi_code + pmi_base[1]);
-+ pmi_pal = (void*)((char*)pmi_code + pmi_base[2]);
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+ pmi_start = ktva_ktla(pmi_start);
-+ pmi_pal = ktva_ktla(pmi_pal);
-+ pax_close_kernel();
-+#endif
-+
- printk(KERN_INFO "vesafb: pmi: set display start = %p, set palette = %p\n",pmi_start,pmi_pal);
- if (pmi_base[3]) {
- printk(KERN_INFO "vesafb: pmi: ports = ");
-@@ -469,6 +495,11 @@ static int __init vesafb_probe(struct platform_device *dev)
- info->node, info->fix.id);
- return 0;
- err:
-+
-+#if defined(__i386__) && defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+ module_free_exec(NULL, pmi_code);
-+#endif
-+
- if (info->screen_base)
- iounmap(info->screen_base);
- framebuffer_release(info);
-diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
-index 1f6bb28..bd773f4 100644
---- a/drivers/watchdog/hpwdt.c
-+++ b/drivers/watchdog/hpwdt.c
-@@ -725,8 +725,11 @@ static int __devinit hpwdt_init_one(struct pci_dev *dev,
- * die notify list to handle a critical NMI. The default is to
- * be last so other users of the NMI signal can function.
- */
-- if (priority)
-- die_notifier.priority = 0x7FFFFFFF;
-+ if (priority) {
-+ pax_open_kernel();
-+ *(void **)&die_notifier.priority = 0x7FFFFFFF;
-+ pax_close_kernel();
-+ }
-
- retval = register_die_notifier(&die_notifier);
- if (retval != 0) {
-diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
-index 4204336..d2f0824 100644
---- a/drivers/xen/balloon.c
-+++ b/drivers/xen/balloon.c
-@@ -395,7 +395,9 @@ static int balloon_init_watcher(struct notifier_block *notifier,
- return NOTIFY_DONE;
- }
-
--static struct notifier_block xenstore_notifier;
-+static struct notifier_block xenstore_notifier = {
-+ .notifier_call = balloon_init_watcher,
-+};
-
- static int __init balloon_init(void)
- {
-@@ -427,7 +429,6 @@ static int __init balloon_init(void)
- }
-
- target_watch.callback = watch_target;
-- xenstore_notifier.notifier_call = balloon_init_watcher;
-
- register_xenstore_notifier(&xenstore_notifier);
-
-diff --git a/drivers/xen/sys-hypervisor.c b/drivers/xen/sys-hypervisor.c
-index 88a60e0..6783cc2 100644
---- a/drivers/xen/sys-hypervisor.c
-+++ b/drivers/xen/sys-hypervisor.c
-@@ -425,7 +425,7 @@ static ssize_t hyp_sysfs_store(struct kobject *kobj,
- return 0;
- }
-
--static struct sysfs_ops hyp_sysfs_ops = {
-+static const struct sysfs_ops hyp_sysfs_ops = {
- .show = hyp_sysfs_show,
- .store = hyp_sysfs_store,
- };
-diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
-index 18f74ec..3227009 100644
---- a/fs/9p/vfs_inode.c
-+++ b/fs/9p/vfs_inode.c
-@@ -1079,7 +1079,7 @@ static void *v9fs_vfs_follow_link(struct dentry *dentry, struct nameidata *nd)
- static void
- v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
- {
-- char *s = nd_get_link(nd);
-+ const char *s = nd_get_link(nd);
-
- P9_DPRINTK(P9_DEBUG_VFS, " %s %s\n", dentry->d_name.name,
- IS_ERR(s) ? "<error>" : s);
-diff --git a/fs/Kconfig.binfmt b/fs/Kconfig.binfmt
-index bb4cc5b..df5eaa0 100644
---- a/fs/Kconfig.binfmt
-+++ b/fs/Kconfig.binfmt
-@@ -86,7 +86,7 @@ config HAVE_AOUT
-
- config BINFMT_AOUT
- tristate "Kernel support for a.out and ECOFF binaries"
-- depends on HAVE_AOUT
-+ depends on HAVE_AOUT && BROKEN
- ---help---
- A.out (Assembler.OUTput) is a set of formats for libraries and
- executables used in the earliest versions of UNIX. Linux used
-diff --git a/fs/aio.c b/fs/aio.c
-index 22a19ad..d484e5b 100644
---- a/fs/aio.c
-+++ b/fs/aio.c
-@@ -115,7 +115,7 @@ static int aio_setup_ring(struct kioctx *ctx)
- size += sizeof(struct io_event) * nr_events;
- nr_pages = (size + PAGE_SIZE-1) >> PAGE_SHIFT;
-
-- if (nr_pages < 0)
-+ if (nr_pages <= 0)
- return -EINVAL;
-
- nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
-@@ -1089,6 +1089,8 @@ static int read_events(struct kioctx *ctx,
- struct aio_timeout to;
- int retry = 0;
-
-+ pax_track_stack();
-+
- /* needed to zero any padding within an entry (there shouldn't be
- * any, but C is fun!
- */
-@@ -1382,13 +1384,18 @@ static ssize_t aio_fsync(struct kiocb *iocb)
- static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb)
- {
- ssize_t ret;
-+ struct iovec iovstack;
-
- ret = rw_copy_check_uvector(type, (struct iovec __user *)kiocb->ki_buf,
- kiocb->ki_nbytes, 1,
-- &kiocb->ki_inline_vec, &kiocb->ki_iovec);
-+ &iovstack, &kiocb->ki_iovec);
- if (ret < 0)
- goto out;
-
-+ if (kiocb->ki_iovec == &iovstack) {
-+ kiocb->ki_inline_vec = iovstack;
-+ kiocb->ki_iovec = &kiocb->ki_inline_vec;
-+ }
- kiocb->ki_nr_segs = kiocb->ki_nbytes;
- kiocb->ki_cur_seg = 0;
- /* ki_nbytes/left now reflect bytes instead of segs */
-diff --git a/fs/attr.c b/fs/attr.c
-index 96d394b..33cf5b4 100644
---- a/fs/attr.c
-+++ b/fs/attr.c
-@@ -83,6 +83,7 @@ int inode_newsize_ok(const struct inode *inode, loff_t offset)
- unsigned long limit;
-
- limit = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
-+ gr_learn_resource(current, RLIMIT_FSIZE, (unsigned long)offset, 1);
- if (limit != RLIM_INFINITY && offset > limit)
- goto out_sig;
- if (offset > inode->i_sb->s_maxbytes)
-diff --git a/fs/autofs4/symlink.c b/fs/autofs4/symlink.c
-index b4ea829..e63ef18 100644
---- a/fs/autofs4/symlink.c
-+++ b/fs/autofs4/symlink.c
-@@ -15,7 +15,7 @@
- static void *autofs4_follow_link(struct dentry *dentry, struct nameidata *nd)
- {
- struct autofs_info *ino = autofs4_dentry_ino(dentry);
-- nd_set_link(nd, (char *)ino->u.symlink);
-+ nd_set_link(nd, ino->u.symlink);
- return NULL;
- }
-
-diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
-index 136a0d6..3330341 100644
---- a/fs/autofs4/waitq.c
-+++ b/fs/autofs4/waitq.c
-@@ -60,7 +60,7 @@ static int autofs4_write(struct file *file, const void *addr, int bytes)
- {
- unsigned long sigpipe, flags;
- mm_segment_t fs;
-- const char *data = (const char *)addr;
-+ const char __user *data = (const char __force_user *)addr;
- ssize_t wr = 0;
-
- /** WARNING: this is not safe for writing more than PIPE_BUF bytes! **/
-@@ -326,6 +326,10 @@ static int validate_request(struct autofs_wait_queue **wait,
- return 1;
- }
-
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+static atomic_unchecked_t autofs_dummy_name_id = ATOMIC_INIT(0);
-+#endif
-+
- int autofs4_wait(struct autofs_sb_info *sbi, struct dentry *dentry,
- enum autofs_notify notify)
- {
-@@ -359,7 +363,12 @@ int autofs4_wait(struct autofs_sb_info *sbi, struct dentry *dentry,
-
- /* If this is a direct mount request create a dummy name */
- if (IS_ROOT(dentry) && autofs_type_trigger(sbi->type))
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ /* this name does get written to userland via autofs4_write() */
-+ qstr.len = sprintf(name, "%08x", atomic_inc_return_unchecked(&autofs_dummy_name_id));
-+#else
- qstr.len = sprintf(name, "%p", dentry);
-+#endif
- else {
- qstr.len = autofs4_getpath(sbi, dentry, &name);
- if (!qstr.len) {
-diff --git a/fs/befs/linuxvfs.c b/fs/befs/linuxvfs.c
-index 9158c07..3f06659 100644
---- a/fs/befs/linuxvfs.c
-+++ b/fs/befs/linuxvfs.c
-@@ -498,7 +498,7 @@ static void befs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
- {
- befs_inode_info *befs_ino = BEFS_I(dentry->d_inode);
- if (befs_ino->i_flags & BEFS_LONG_SYMLINK) {
-- char *link = nd_get_link(nd);
-+ const char *link = nd_get_link(nd);
- if (!IS_ERR(link))
- kfree(link);
- }
-diff --git a/fs/binfmt_aout.c b/fs/binfmt_aout.c
-index 0133b5a..3710d09 100644
---- a/fs/binfmt_aout.c
-+++ b/fs/binfmt_aout.c
-@@ -16,6 +16,7 @@
- #include <linux/string.h>
- #include <linux/fs.h>
- #include <linux/file.h>
-+#include <linux/security.h>
- #include <linux/stat.h>
- #include <linux/fcntl.h>
- #include <linux/ptrace.h>
-@@ -102,6 +103,8 @@ static int aout_core_dump(long signr, struct pt_regs *regs, struct file *file, u
- #endif
- # define START_STACK(u) (u.start_stack)
-
-+ memset(&dump, 0, sizeof(dump));
-+
- fs = get_fs();
- set_fs(KERNEL_DS);
- has_dumped = 1;
-@@ -113,10 +116,12 @@ static int aout_core_dump(long signr, struct pt_regs *regs, struct file *file, u
-
- /* If the size of the dump file exceeds the rlimit, then see what would happen
- if we wrote the stack, but not the data area. */
-+ gr_learn_resource(current, RLIMIT_CORE, (dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE, 1);
- if ((dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE > limit)
- dump.u_dsize = 0;
-
- /* Make sure we have enough room to write the stack and data areas. */
-+ gr_learn_resource(current, RLIMIT_CORE, (dump.u_ssize + 1) * PAGE_SIZE, 1);
- if ((dump.u_ssize + 1) * PAGE_SIZE > limit)
- dump.u_ssize = 0;
-
-@@ -146,9 +151,7 @@ static int aout_core_dump(long signr, struct pt_regs *regs, struct file *file, u
- dump_size = dump.u_ssize << PAGE_SHIFT;
- DUMP_WRITE(dump_start,dump_size);
- }
--/* Finally dump the task struct. Not be used by gdb, but could be useful */
-- set_fs(KERNEL_DS);
-- DUMP_WRITE(current,sizeof(*current));
-+/* Finally, let's not dump the task struct. Not be used by gdb, but could be useful to an attacker */
- end_coredump:
- set_fs(fs);
- return has_dumped;
-@@ -249,6 +252,8 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
- rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
- if (rlim >= RLIM_INFINITY)
- rlim = ~0;
-+
-+ gr_learn_resource(current, RLIMIT_DATA, ex.a_data + ex.a_bss, 1);
- if (ex.a_data + ex.a_bss > rlim)
- return -ENOMEM;
-
-@@ -274,9 +279,37 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
- current->mm->free_area_cache = current->mm->mmap_base;
- current->mm->cached_hole_size = 0;
-
-+ retval = setup_arg_pages(bprm, STACK_TOP, EXSTACK_DEFAULT);
-+ if (retval < 0) {
-+ /* Someone check-me: is this error path enough? */
-+ send_sig(SIGKILL, current, 0);
-+ return retval;
-+ }
-+
- install_exec_creds(bprm);
- current->flags &= ~PF_FORKNOEXEC;
-
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+ current->mm->pax_flags = 0UL;
-+#endif
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (!(N_FLAGS(ex) & F_PAX_PAGEEXEC)) {
-+ current->mm->pax_flags |= MF_PAX_PAGEEXEC;
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+ if (N_FLAGS(ex) & F_PAX_EMUTRAMP)
-+ current->mm->pax_flags |= MF_PAX_EMUTRAMP;
-+#endif
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (!(N_FLAGS(ex) & F_PAX_MPROTECT))
-+ current->mm->pax_flags |= MF_PAX_MPROTECT;
-+#endif
-+
-+ }
-+#endif
-+
- if (N_MAGIC(ex) == OMAGIC) {
- unsigned long text_addr, map_size;
- loff_t pos;
-@@ -349,7 +382,7 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
-
- down_write(¤t->mm->mmap_sem);
- error = do_mmap(bprm->file, N_DATADDR(ex), ex.a_data,
-- PROT_READ | PROT_WRITE | PROT_EXEC,
-+ PROT_READ | PROT_WRITE,
- MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE,
- fd_offset + ex.a_text);
- up_write(¤t->mm->mmap_sem);
-@@ -367,13 +400,6 @@ beyond_if:
- return retval;
- }
-
-- retval = setup_arg_pages(bprm, STACK_TOP, EXSTACK_DEFAULT);
-- if (retval < 0) {
-- /* Someone check-me: is this error path enough? */
-- send_sig(SIGKILL, current, 0);
-- return retval;
-- }
--
- current->mm->start_stack =
- (unsigned long) create_aout_tables((char __user *) bprm->p, bprm);
- #ifdef __alpha__
-diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
-index c564293..ff3b755 100644
---- a/fs/binfmt_elf.c
-+++ b/fs/binfmt_elf.c
-@@ -31,6 +31,7 @@
- #include <linux/random.h>
- #include <linux/elf.h>
- #include <linux/utsname.h>
-+#include <linux/xattr.h>
- #include <asm/uaccess.h>
- #include <asm/param.h>
- #include <asm/page.h>
-@@ -50,6 +51,10 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file, un
- #define elf_core_dump NULL
- #endif
-
-+#ifdef CONFIG_PAX_MPROTECT
-+static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags);
-+#endif
-+
- #if ELF_EXEC_PAGESIZE > PAGE_SIZE
- #define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE
- #else
-@@ -69,6 +74,11 @@ static struct linux_binfmt elf_format = {
- .load_binary = load_elf_binary,
- .load_shlib = load_elf_library,
- .core_dump = elf_core_dump,
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ .handle_mprotect= elf_handle_mprotect,
-+#endif
-+
- .min_coredump = ELF_EXEC_PAGESIZE,
- .hasvdso = 1
- };
-@@ -77,6 +87,8 @@ static struct linux_binfmt elf_format = {
-
- static int set_brk(unsigned long start, unsigned long end)
- {
-+ unsigned long e = end;
-+
- start = ELF_PAGEALIGN(start);
- end = ELF_PAGEALIGN(end);
- if (end > start) {
-@@ -87,7 +99,7 @@ static int set_brk(unsigned long start, unsigned long end)
- if (BAD_ADDR(addr))
- return addr;
- }
-- current->mm->start_brk = current->mm->brk = end;
-+ current->mm->start_brk = current->mm->brk = e;
- return 0;
- }
-
-@@ -148,12 +160,15 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
- elf_addr_t __user *u_rand_bytes;
- const char *k_platform = ELF_PLATFORM;
- const char *k_base_platform = ELF_BASE_PLATFORM;
-- unsigned char k_rand_bytes[16];
-+ u32 k_rand_bytes[4];
- int items;
- elf_addr_t *elf_info;
- int ei_index = 0;
- const struct cred *cred = current_cred();
- struct vm_area_struct *vma;
-+ unsigned long saved_auxv[AT_VECTOR_SIZE];
-+
-+ pax_track_stack();
-
- /*
- * In some cases (e.g. Hyper-Threading), we want to avoid L1
-@@ -195,8 +210,12 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
- * Generate 16 random bytes for userspace PRNG seeding.
- */
- get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
-- u_rand_bytes = (elf_addr_t __user *)
-- STACK_ALLOC(p, sizeof(k_rand_bytes));
-+ srandom32(k_rand_bytes[0] ^ random32());
-+ srandom32(k_rand_bytes[1] ^ random32());
-+ srandom32(k_rand_bytes[2] ^ random32());
-+ srandom32(k_rand_bytes[3] ^ random32());
-+ p = STACK_ROUND(p, sizeof(k_rand_bytes));
-+ u_rand_bytes = (elf_addr_t __user *) p;
- if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
- return -EFAULT;
-
-@@ -308,9 +327,11 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
- return -EFAULT;
- current->mm->env_end = p;
-
-+ memcpy(saved_auxv, elf_info, ei_index * sizeof(elf_addr_t));
-+
- /* Put the elf_info on the stack in the right place. */
- sp = (elf_addr_t __user *)envp + 1;
-- if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
-+ if (copy_to_user(sp, saved_auxv, ei_index * sizeof(elf_addr_t)))
- return -EFAULT;
- return 0;
- }
-@@ -380,15 +401,14 @@ static unsigned long total_mapping_size(struct elf_phdr *cmds, int nr)
- an ELF header */
-
- static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
-- struct file *interpreter, unsigned long *interp_map_addr,
-- unsigned long no_base)
-+ struct file *interpreter, unsigned long no_base)
- {
- struct elf_phdr *elf_phdata;
- struct elf_phdr *eppnt;
-- unsigned long load_addr = 0;
-+ unsigned long load_addr = 0, pax_task_size = TASK_SIZE;
- int load_addr_set = 0;
- unsigned long last_bss = 0, elf_bss = 0;
-- unsigned long error = ~0UL;
-+ unsigned long error = -EINVAL;
- unsigned long total_size;
- int retval, i, size;
-
-@@ -434,6 +454,11 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
- goto out_close;
- }
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
-+ pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
- eppnt = elf_phdata;
- for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
- if (eppnt->p_type == PT_LOAD) {
-@@ -457,8 +482,6 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
- map_addr = elf_map(interpreter, load_addr + vaddr,
- eppnt, elf_prot, elf_type, total_size);
- total_size = 0;
-- if (!*interp_map_addr)
-- *interp_map_addr = map_addr;
- error = map_addr;
- if (BAD_ADDR(map_addr))
- goto out_close;
-@@ -477,8 +500,8 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
- k = load_addr + eppnt->p_vaddr;
- if (BAD_ADDR(k) ||
- eppnt->p_filesz > eppnt->p_memsz ||
-- eppnt->p_memsz > TASK_SIZE ||
-- TASK_SIZE - eppnt->p_memsz < k) {
-+ eppnt->p_memsz > pax_task_size ||
-+ pax_task_size - eppnt->p_memsz < k) {
- error = -ENOMEM;
- goto out_close;
- }
-@@ -532,6 +555,315 @@ out:
- return error;
- }
-
-+#ifdef CONFIG_PAX_PT_PAX_FLAGS
-+#ifdef CONFIG_PAX_SOFTMODE
-+static unsigned long pax_parse_pt_pax_softmode(const struct elf_phdr * const elf_phdata)
-+{
-+ unsigned long pax_flags = 0UL;
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (elf_phdata->p_flags & PF_PAGEEXEC)
-+ pax_flags |= MF_PAX_PAGEEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (elf_phdata->p_flags & PF_SEGMEXEC)
-+ pax_flags |= MF_PAX_SEGMEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+ if ((elf_phdata->p_flags & PF_EMUTRAMP) && (pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)))
-+ pax_flags |= MF_PAX_EMUTRAMP;
-+#endif
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (elf_phdata->p_flags & PF_MPROTECT)
-+ pax_flags |= MF_PAX_MPROTECT;
-+#endif
-+
-+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
-+ if (randomize_va_space && (elf_phdata->p_flags & PF_RANDMMAP))
-+ pax_flags |= MF_PAX_RANDMMAP;
-+#endif
-+
-+ return pax_flags;
-+}
-+#endif
-+
-+static unsigned long pax_parse_pt_pax_hardmode(const struct elf_phdr * const elf_phdata)
-+{
-+ unsigned long pax_flags = 0UL;
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (!(elf_phdata->p_flags & PF_NOPAGEEXEC))
-+ pax_flags |= MF_PAX_PAGEEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (!(elf_phdata->p_flags & PF_NOSEGMEXEC))
-+ pax_flags |= MF_PAX_SEGMEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+ if (!(elf_phdata->p_flags & PF_NOEMUTRAMP))
-+ pax_flags |= MF_PAX_EMUTRAMP;
-+#endif
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (!(elf_phdata->p_flags & PF_NOMPROTECT))
-+ pax_flags |= MF_PAX_MPROTECT;
-+#endif
-+
-+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
-+ if (randomize_va_space && !(elf_phdata->p_flags & PF_NORANDMMAP))
-+ pax_flags |= MF_PAX_RANDMMAP;
-+#endif
-+
-+ return pax_flags;
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_XATTR_PAX_FLAGS
-+#ifdef CONFIG_PAX_SOFTMODE
-+static unsigned long pax_parse_xattr_pax_softmode(unsigned long pax_flags_softmode)
-+{
-+ unsigned long pax_flags = 0UL;
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (pax_flags_softmode & MF_PAX_PAGEEXEC)
-+ pax_flags |= MF_PAX_PAGEEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (pax_flags_softmode & MF_PAX_SEGMEXEC)
-+ pax_flags |= MF_PAX_SEGMEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+ if (pax_flags_softmode & MF_PAX_EMUTRAMP)
-+ pax_flags |= MF_PAX_EMUTRAMP;
-+#endif
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (pax_flags_softmode & MF_PAX_MPROTECT)
-+ pax_flags |= MF_PAX_MPROTECT;
-+#endif
-+
-+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
-+ if (randomize_va_space && (pax_flags_softmode & MF_PAX_RANDMMAP))
-+ pax_flags |= MF_PAX_RANDMMAP;
-+#endif
-+
-+ return pax_flags;
-+}
-+#endif
-+
-+static unsigned long pax_parse_xattr_pax_hardmode(unsigned long pax_flags_hardmode)
-+{
-+ unsigned long pax_flags = 0UL;
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (!(pax_flags_hardmode & MF_PAX_PAGEEXEC))
-+ pax_flags |= MF_PAX_PAGEEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (!(pax_flags_hardmode & MF_PAX_SEGMEXEC))
-+ pax_flags |= MF_PAX_SEGMEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+ if (!(pax_flags_hardmode & MF_PAX_EMUTRAMP))
-+ pax_flags |= MF_PAX_EMUTRAMP;
-+#endif
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (!(pax_flags_hardmode & MF_PAX_MPROTECT))
-+ pax_flags |= MF_PAX_MPROTECT;
-+#endif
-+
-+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
-+ if (randomize_va_space && !(pax_flags_hardmode & MF_PAX_RANDMMAP))
-+ pax_flags |= MF_PAX_RANDMMAP;
-+#endif
-+
-+ return pax_flags;
-+}
-+#endif
-+
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+static unsigned long pax_parse_ei_pax(const struct elfhdr * const elf_ex)
-+{
-+ unsigned long pax_flags = 0UL;
-+
-+#ifdef CONFIG_PAX_EI_PAX
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_PAGEEXEC))
-+ pax_flags |= MF_PAX_PAGEEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_SEGMEXEC))
-+ pax_flags |= MF_PAX_SEGMEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && (elf_ex->e_ident[EI_PAX] & EF_PAX_EMUTRAMP))
-+ pax_flags |= MF_PAX_EMUTRAMP;
-+#endif
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && !(elf_ex->e_ident[EI_PAX] & EF_PAX_MPROTECT))
-+ pax_flags |= MF_PAX_MPROTECT;
-+#endif
-+
-+#ifdef CONFIG_PAX_ASLR
-+ if (randomize_va_space && !(elf_ex->e_ident[EI_PAX] & EF_PAX_RANDMMAP))
-+ pax_flags |= MF_PAX_RANDMMAP;
-+#endif
-+
-+#else
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ pax_flags |= MF_PAX_PAGEEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ pax_flags |= MF_PAX_SEGMEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ pax_flags |= MF_PAX_MPROTECT;
-+#endif
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (randomize_va_space)
-+ pax_flags |= MF_PAX_RANDMMAP;
-+#endif
-+
-+#endif
-+
-+ return pax_flags;
-+}
-+
-+static unsigned long pax_parse_pt_pax(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata)
-+{
-+
-+#ifdef CONFIG_PAX_PT_PAX_FLAGS
-+ unsigned long i;
-+
-+ for (i = 0UL; i < elf_ex->e_phnum; i++)
-+ if (elf_phdata[i].p_type == PT_PAX_FLAGS) {
-+ if (((elf_phdata[i].p_flags & PF_PAGEEXEC) && (elf_phdata[i].p_flags & PF_NOPAGEEXEC)) ||
-+ ((elf_phdata[i].p_flags & PF_SEGMEXEC) && (elf_phdata[i].p_flags & PF_NOSEGMEXEC)) ||
-+ ((elf_phdata[i].p_flags & PF_EMUTRAMP) && (elf_phdata[i].p_flags & PF_NOEMUTRAMP)) ||
-+ ((elf_phdata[i].p_flags & PF_MPROTECT) && (elf_phdata[i].p_flags & PF_NOMPROTECT)) ||
-+ ((elf_phdata[i].p_flags & PF_RANDMMAP) && (elf_phdata[i].p_flags & PF_NORANDMMAP)))
-+ return ~0UL;
-+
-+#ifdef CONFIG_PAX_SOFTMODE
-+ if (pax_softmode)
-+ return pax_parse_pt_pax_softmode(&elf_phdata[i]);
-+ else
-+#endif
-+
-+ return pax_parse_pt_pax_hardmode(&elf_phdata[i]);
-+ break;
-+ }
-+#endif
-+
-+ return ~0UL;
-+}
-+
-+static unsigned long pax_parse_xattr_pax(struct file * const file)
-+{
-+
-+#ifdef CONFIG_PAX_XATTR_PAX_FLAGS
-+ ssize_t xattr_size, i;
-+ unsigned char xattr_value[5];
-+ unsigned long pax_flags_hardmode = 0UL, pax_flags_softmode = 0UL;
-+
-+ xattr_size = vfs_getxattr(file->f_path.dentry, XATTR_NAME_PAX_FLAGS, xattr_value, sizeof xattr_value);
-+ if (xattr_size <= 0 || xattr_size > 5)
-+ return ~0UL;
-+
-+ for (i = 0; i < xattr_size; i++)
-+ switch (xattr_value[i]) {
-+ default:
-+ return ~0UL;
-+
-+#define parse_flag(option1, option2, flag) \
-+ case option1: \
-+ if (pax_flags_hardmode & MF_PAX_##flag) \
-+ return ~0UL; \
-+ pax_flags_hardmode |= MF_PAX_##flag; \
-+ break; \
-+ case option2: \
-+ if (pax_flags_softmode & MF_PAX_##flag) \
-+ return ~0UL; \
-+ pax_flags_softmode |= MF_PAX_##flag; \
-+ break;
-+
-+ parse_flag('p', 'P', PAGEEXEC);
-+ parse_flag('e', 'E', EMUTRAMP);
-+ parse_flag('m', 'M', MPROTECT);
-+ parse_flag('r', 'R', RANDMMAP);
-+ parse_flag('s', 'S', SEGMEXEC);
-+
-+#undef parse_flag
-+ }
-+
-+ if (pax_flags_hardmode & pax_flags_softmode)
-+ return ~0UL;
-+
-+#ifdef CONFIG_PAX_SOFTMODE
-+ if (pax_softmode)
-+ return pax_parse_xattr_pax_softmode(pax_flags_softmode);
-+ else
-+#endif
-+
-+ return pax_parse_xattr_pax_hardmode(pax_flags_hardmode);
-+#else
-+ return ~0UL;
-+#endif
-+
-+}
-+
-+static long pax_parse_pax_flags(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata, struct file * const file)
-+{
-+ unsigned long pax_flags, pt_pax_flags, xattr_pax_flags;
-+
-+ pax_flags = pax_parse_ei_pax(elf_ex);
-+ pt_pax_flags = pax_parse_pt_pax(elf_ex, elf_phdata);
-+ xattr_pax_flags = pax_parse_xattr_pax(file);
-+
-+ if (pt_pax_flags == ~0UL)
-+ pt_pax_flags = xattr_pax_flags;
-+ else if (xattr_pax_flags == ~0UL)
-+ xattr_pax_flags = pt_pax_flags;
-+ if (pt_pax_flags != xattr_pax_flags)
-+ return -EINVAL;
-+ if (pt_pax_flags != ~0UL)
-+ pax_flags = pt_pax_flags;
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
-+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+ if ((__supported_pte_mask & _PAGE_NX))
-+ pax_flags &= ~MF_PAX_SEGMEXEC;
-+ else
-+ pax_flags &= ~MF_PAX_PAGEEXEC;
-+ }
-+#endif
-+
-+ if (0 > pax_check_flags(&pax_flags))
-+ return -EINVAL;
-+
-+ current->mm->pax_flags = pax_flags;
-+ return 0;
-+}
-+#endif
-+
- /*
- * These are the functions used to load ELF style executables and shared
- * libraries. There is no binary dependent code anywhere else.
-@@ -548,6 +880,11 @@ static unsigned long randomize_stack_top(unsigned long stack_top)
- {
- unsigned int random_variable = 0;
-
-+#ifdef CONFIG_PAX_RANDUSTACK
-+ if (current->mm->pax_flags & MF_PAX_RANDMMAP)
-+ return stack_top - current->mm->delta_stack;
-+#endif
-+
- if ((current->flags & PF_RANDOMIZE) &&
- !(current->personality & ADDR_NO_RANDOMIZE)) {
- random_variable = get_random_int() & STACK_RND_MASK;
-@@ -566,7 +903,7 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
- unsigned long load_addr = 0, load_bias = 0;
- int load_addr_set = 0;
- char * elf_interpreter = NULL;
-- unsigned long error;
-+ unsigned long error = 0;
- struct elf_phdr *elf_ppnt, *elf_phdata;
- unsigned long elf_bss, elf_brk;
- int retval, i;
-@@ -576,11 +913,11 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
- unsigned long start_code, end_code, start_data, end_data;
- unsigned long reloc_func_desc = 0;
- int executable_stack = EXSTACK_DEFAULT;
-- unsigned long def_flags = 0;
- struct {
- struct elfhdr elf_ex;
- struct elfhdr interp_elf_ex;
- } *loc;
-+ unsigned long pax_task_size = TASK_SIZE;
-
- loc = kmalloc(sizeof(*loc), GFP_KERNEL);
- if (!loc) {
-@@ -718,11 +1055,80 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
-
- /* OK, This is the point of no return */
- current->flags &= ~PF_FORKNOEXEC;
-- current->mm->def_flags = def_flags;
-+
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+ current->mm->pax_flags = 0UL;
-+#endif
-+
-+#ifdef CONFIG_PAX_DLRESOLVE
-+ current->mm->call_dl_resolve = 0UL;
-+#endif
-+
-+#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
-+ current->mm->call_syscall = 0UL;
-+#endif
-+
-+#ifdef CONFIG_PAX_ASLR
-+ current->mm->delta_mmap = 0UL;
-+ current->mm->delta_stack = 0UL;
-+#endif
-+
-+ current->mm->def_flags = 0;
-+
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+ if (0 > pax_parse_pax_flags(&loc->elf_ex, elf_phdata, bprm->file)) {
-+ send_sig(SIGKILL, current, 0);
-+ goto out_free_dentry;
-+ }
-+#endif
-+
-+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
-+ pax_set_initial_flags(bprm);
-+#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
-+ if (pax_set_initial_flags_func)
-+ (pax_set_initial_flags_func)(bprm);
-+#endif
-+
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+ if ((current->mm->pax_flags & MF_PAX_PAGEEXEC) && !nx_enabled) {
-+ current->mm->context.user_cs_limit = PAGE_SIZE;
-+ current->mm->def_flags |= VM_PAGEEXEC;
-+ }
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
-+ current->mm->context.user_cs_base = SEGMEXEC_TASK_SIZE;
-+ current->mm->context.user_cs_limit = TASK_SIZE-SEGMEXEC_TASK_SIZE;
-+ pax_task_size = SEGMEXEC_TASK_SIZE;
-+ }
-+#endif
-+
-+#if defined(CONFIG_ARCH_TRACK_EXEC_LIMIT) || defined(CONFIG_PAX_SEGMEXEC)
-+ if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+ set_user_cs(current->mm->context.user_cs_base, current->mm->context.user_cs_limit, get_cpu());
-+ put_cpu();
-+ }
-+#endif
-
- /* Do this immediately, since STACK_TOP as used in setup_arg_pages
- may depend on the personality. */
- SET_PERSONALITY(loc->elf_ex);
-+
-+#ifdef CONFIG_PAX_ASLR
-+ if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
-+ current->mm->delta_mmap = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN)-1)) << PAGE_SHIFT;
-+ current->mm->delta_stack = (pax_get_random_long() & ((1UL << PAX_DELTA_STACK_LEN)-1)) << PAGE_SHIFT;
-+ }
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+ if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+ executable_stack = EXSTACK_DISABLE_X;
-+ current->personality &= ~READ_IMPLIES_EXEC;
-+ } else
-+#endif
-+
- if (elf_read_implies_exec(loc->elf_ex, executable_stack))
- current->personality |= READ_IMPLIES_EXEC;
-
-@@ -800,10 +1206,27 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
- * might try to exec. This is because the brk will
- * follow the loader, and is not movable. */
- #ifdef CONFIG_X86
-- load_bias = 0;
-+ if (current->flags & PF_RANDOMIZE)
-+ load_bias = 0;
-+ else
-+ load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
- #else
- load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
- #endif
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ /* PaX: randomize base address at the default exe base if requested */
-+ if ((current->mm->pax_flags & MF_PAX_RANDMMAP) && elf_interpreter) {
-+#ifdef CONFIG_SPARC64
-+ load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << (PAGE_SHIFT+1);
-+#else
-+ load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << PAGE_SHIFT;
-+#endif
-+ load_bias = ELF_PAGESTART(PAX_ELF_ET_DYN_BASE - vaddr + load_bias);
-+ elf_flags |= MAP_FIXED;
-+ }
-+#endif
-+
- }
-
- error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
-@@ -836,9 +1259,9 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
- * allowed task size. Note that p_filesz must always be
- * <= p_memsz so it is only necessary to check p_memsz.
- */
-- if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
-- elf_ppnt->p_memsz > TASK_SIZE ||
-- TASK_SIZE - elf_ppnt->p_memsz < k) {
-+ if (k >= pax_task_size || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
-+ elf_ppnt->p_memsz > pax_task_size ||
-+ pax_task_size - elf_ppnt->p_memsz < k) {
- /* set_brk can never work. Avoid overflows. */
- send_sig(SIGKILL, current, 0);
- retval = -EINVAL;
-@@ -877,17 +1300,44 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
- goto out_free_dentry;
- }
- if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
-- send_sig(SIGSEGV, current, 0);
-- retval = -EFAULT; /* Nobody gets to see this, but.. */
-- goto out_free_dentry;
-+ /*
-+ * This bss-zeroing can fail if the ELF
-+ * file specifies odd protections. So
-+ * we don't check the return value
-+ */
- }
-
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
-+ unsigned long start, size, flags, vm_flags;
-+
-+ start = ELF_PAGEALIGN(elf_brk);
-+ size = PAGE_SIZE + ((pax_get_random_long() & ((1UL << 22) - 1UL)) << 4);
-+ flags = MAP_FIXED | MAP_PRIVATE;
-+ vm_flags = VM_DONTEXPAND | VM_RESERVED;
-+
-+ down_write(¤t->mm->mmap_sem);
-+ start = get_unmapped_area(NULL, start, PAGE_ALIGN(size), 0, flags);
-+ retval = -ENOMEM;
-+ if (!IS_ERR_VALUE(start) && !find_vma_intersection(current->mm, start, start + size + PAGE_SIZE)) {
-+// if (current->personality & ADDR_NO_RANDOMIZE)
-+// prot = PROT_READ;
-+ start = mmap_region(NULL, start, PAGE_ALIGN(size), flags, vm_flags, 0);
-+ retval = IS_ERR_VALUE(start) ? start : 0;
-+ }
-+ up_write(¤t->mm->mmap_sem);
-+ if (retval == 0)
-+ retval = set_brk(start + size, start + size + PAGE_SIZE);
-+ if (retval < 0) {
-+ send_sig(SIGKILL, current, 0);
-+ goto out_free_dentry;
-+ }
-+ }
-+#endif
-+
- if (elf_interpreter) {
-- unsigned long uninitialized_var(interp_map_addr);
--
- elf_entry = load_elf_interp(&loc->interp_elf_ex,
- interpreter,
-- &interp_map_addr,
- load_bias);
- if (!IS_ERR((void *)elf_entry)) {
- /*
-@@ -1112,8 +1562,10 @@ static int dump_seek(struct file *file, loff_t off)
- unsigned long n = off;
- if (n > PAGE_SIZE)
- n = PAGE_SIZE;
-- if (!dump_write(file, buf, n))
-+ if (!dump_write(file, buf, n)) {
-+ free_page((unsigned long)buf);
- return 0;
-+ }
- off -= n;
- }
- free_page((unsigned long)buf);
-@@ -1125,7 +1577,7 @@ static int dump_seek(struct file *file, loff_t off)
- * Decide what to dump of a segment, part, all or none.
- */
- static unsigned long vma_dump_size(struct vm_area_struct *vma,
-- unsigned long mm_flags)
-+ unsigned long mm_flags, long signr)
- {
- #define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type))
-
-@@ -1159,7 +1611,7 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
- if (vma->vm_file == NULL)
- return 0;
-
-- if (FILTER(MAPPED_PRIVATE))
-+ if (signr == SIGKILL || FILTER(MAPPED_PRIVATE))
- goto whole;
-
- /*
-@@ -1255,8 +1707,11 @@ static int writenote(struct memelfnote *men, struct file *file,
- #undef DUMP_WRITE
-
- #define DUMP_WRITE(addr, nr) \
-+ do { \
-+ gr_learn_resource(current, RLIMIT_CORE, size + (nr), 1); \
- if ((size += (nr)) > limit || !dump_write(file, (addr), (nr))) \
-- goto end_coredump;
-+ goto end_coredump; \
-+ } while (0);
-
- static void fill_elf_header(struct elfhdr *elf, int segs,
- u16 machine, u32 flags, u8 osabi)
-@@ -1385,9 +1840,9 @@ static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
- {
- elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
- int i = 0;
-- do
-+ do {
- i += 2;
-- while (auxv[i - 2] != AT_NULL);
-+ } while (auxv[i - 2] != AT_NULL);
- fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
- }
-
-@@ -1962,7 +2417,7 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file, un
- phdr.p_offset = offset;
- phdr.p_vaddr = vma->vm_start;
- phdr.p_paddr = 0;
-- phdr.p_filesz = vma_dump_size(vma, mm_flags);
-+ phdr.p_filesz = vma_dump_size(vma, mm_flags, signr);
- phdr.p_memsz = vma->vm_end - vma->vm_start;
- offset += phdr.p_filesz;
- phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
-@@ -1995,7 +2450,7 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file, un
- unsigned long addr;
- unsigned long end;
-
-- end = vma->vm_start + vma_dump_size(vma, mm_flags);
-+ end = vma->vm_start + vma_dump_size(vma, mm_flags, signr);
-
- for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
- struct page *page;
-@@ -2004,6 +2459,7 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file, un
- page = get_dump_page(addr);
- if (page) {
- void *kaddr = kmap(page);
-+ gr_learn_resource(current, RLIMIT_CORE, size + PAGE_SIZE, 1);
- stop = ((size += PAGE_SIZE) > limit) ||
- !dump_write(file, kaddr, PAGE_SIZE);
- kunmap(page);
-@@ -2031,6 +2487,97 @@ out:
-
- #endif /* USE_ELF_CORE_DUMP */
-
-+#ifdef CONFIG_PAX_MPROTECT
-+/* PaX: non-PIC ELF libraries need relocations on their executable segments
-+ * therefore we'll grant them VM_MAYWRITE once during their life. Similarly
-+ * we'll remove VM_MAYWRITE for good on RELRO segments.
-+ *
-+ * The checks favour ld-linux.so behaviour which operates on a per ELF segment
-+ * basis because we want to allow the common case and not the special ones.
-+ */
-+static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags)
-+{
-+ struct elfhdr elf_h;
-+ struct elf_phdr elf_p;
-+ unsigned long i;
-+ unsigned long oldflags;
-+ bool is_textrel_rw, is_textrel_rx, is_relro;
-+
-+ if (!(vma->vm_mm->pax_flags & MF_PAX_MPROTECT))
-+ return;
-+
-+ oldflags = vma->vm_flags & (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ);
-+ newflags &= VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ;
-+
-+#ifdef CONFIG_PAX_ELFRELOCS
-+ /* possible TEXTREL */
-+ is_textrel_rw = vma->vm_file && !vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYREAD | VM_EXEC | VM_READ) && newflags == (VM_WRITE | VM_READ);
-+ is_textrel_rx = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_WRITE | VM_READ) && newflags == (VM_EXEC | VM_READ);
-+#else
-+ is_textrel_rw = false;
-+ is_textrel_rx = false;
-+#endif
-+
-+ /* possible RELRO */
-+ is_relro = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ) && newflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ);
-+
-+ if (!is_textrel_rw && !is_textrel_rx && !is_relro)
-+ return;
-+
-+ if (sizeof(elf_h) != kernel_read(vma->vm_file, 0UL, (char *)&elf_h, sizeof(elf_h)) ||
-+ memcmp(elf_h.e_ident, ELFMAG, SELFMAG) ||
-+
-+#ifdef CONFIG_PAX_ETEXECRELOCS
-+ ((is_textrel_rw || is_textrel_rx) && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
-+#else
-+ ((is_textrel_rw || is_textrel_rx) && elf_h.e_type != ET_DYN) ||
-+#endif
-+
-+ (is_relro && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
-+ !elf_check_arch(&elf_h) ||
-+ elf_h.e_phentsize != sizeof(struct elf_phdr) ||
-+ elf_h.e_phnum > 65536UL / sizeof(struct elf_phdr))
-+ return;
-+
-+ for (i = 0UL; i < elf_h.e_phnum; i++) {
-+ if (sizeof(elf_p) != kernel_read(vma->vm_file, elf_h.e_phoff + i*sizeof(elf_p), (char *)&elf_p, sizeof(elf_p)))
-+ return;
-+ switch (elf_p.p_type) {
-+ case PT_DYNAMIC:
-+ if (!is_textrel_rw && !is_textrel_rx)
-+ continue;
-+ i = 0UL;
-+ while ((i+1) * sizeof(elf_dyn) <= elf_p.p_filesz) {
-+ elf_dyn dyn;
-+
-+ if (sizeof(dyn) != kernel_read(vma->vm_file, elf_p.p_offset + i*sizeof(dyn), (char *)&dyn, sizeof(dyn)))
-+ return;
-+ if (dyn.d_tag == DT_NULL)
-+ return;
-+ if (dyn.d_tag == DT_TEXTREL || (dyn.d_tag == DT_FLAGS && (dyn.d_un.d_val & DF_TEXTREL))) {
-+ gr_log_textrel(vma);
-+ if (is_textrel_rw)
-+ vma->vm_flags |= VM_MAYWRITE;
-+ else
-+ /* PaX: disallow write access after relocs are done, hopefully noone else needs it... */
-+ vma->vm_flags &= ~VM_MAYWRITE;
-+ return;
-+ }
-+ i++;
-+ }
-+ return;
-+
-+ case PT_GNU_RELRO:
-+ if (!is_relro)
-+ continue;
-+ if ((elf_p.p_offset >> PAGE_SHIFT) == vma->vm_pgoff && ELF_PAGEALIGN(elf_p.p_memsz) == vma->vm_end - vma->vm_start)
-+ vma->vm_flags &= ~VM_MAYWRITE;
-+ return;
-+ }
-+ }
-+}
-+#endif
-+
- static int __init init_elf_binfmt(void)
- {
- return register_binfmt(&elf_format);
-diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c
-index ca88c46..f155a60 100644
---- a/fs/binfmt_flat.c
-+++ b/fs/binfmt_flat.c
-@@ -564,7 +564,9 @@ static int load_flat_file(struct linux_binprm * bprm,
- realdatastart = (unsigned long) -ENOMEM;
- printk("Unable to allocate RAM for process data, errno %d\n",
- (int)-realdatastart);
-+ down_write(¤t->mm->mmap_sem);
- do_munmap(current->mm, textpos, text_len);
-+ up_write(¤t->mm->mmap_sem);
- ret = realdatastart;
- goto err;
- }
-@@ -588,8 +590,10 @@ static int load_flat_file(struct linux_binprm * bprm,
- }
- if (IS_ERR_VALUE(result)) {
- printk("Unable to read data+bss, errno %d\n", (int)-result);
-+ down_write(¤t->mm->mmap_sem);
- do_munmap(current->mm, textpos, text_len);
- do_munmap(current->mm, realdatastart, data_len + extra);
-+ up_write(¤t->mm->mmap_sem);
- ret = result;
- goto err;
- }
-@@ -658,8 +662,10 @@ static int load_flat_file(struct linux_binprm * bprm,
- }
- if (IS_ERR_VALUE(result)) {
- printk("Unable to read code+data+bss, errno %d\n",(int)-result);
-+ down_write(¤t->mm->mmap_sem);
- do_munmap(current->mm, textpos, text_len + data_len + extra +
- MAX_SHARED_LIBS * sizeof(unsigned long));
-+ up_write(¤t->mm->mmap_sem);
- ret = result;
- goto err;
- }
-diff --git a/fs/bio.c b/fs/bio.c
-index e696713..5a85bf9 100644
---- a/fs/bio.c
-+++ b/fs/bio.c
-@@ -78,7 +78,7 @@ static struct kmem_cache *bio_find_or_create_slab(unsigned int extra_size)
-
- i = 0;
- while (i < bio_slab_nr) {
-- struct bio_slab *bslab = &bio_slabs[i];
-+ bslab = &bio_slabs[i];
-
- if (!bslab->slab && entry == -1)
- entry = i;
-@@ -841,7 +841,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
- /*
- * Overflow, abort
- */
-- if (end < start)
-+ if (end < start || end - start > INT_MAX - nr_pages)
- return ERR_PTR(-EINVAL);
-
- nr_pages += end - start;
-@@ -974,7 +974,7 @@ static struct bio *__bio_map_user_iov(struct request_queue *q,
- /*
- * Overflow, abort
- */
-- if (end < start)
-+ if (end < start || end - start > INT_MAX - nr_pages)
- return ERR_PTR(-EINVAL);
-
- nr_pages += end - start;
-@@ -1236,7 +1236,7 @@ static void bio_copy_kern_endio(struct bio *bio, int err)
- const int read = bio_data_dir(bio) == READ;
- struct bio_map_data *bmd = bio->bi_private;
- int i;
-- char *p = bmd->sgvecs[0].iov_base;
-+ char *p = (char __force_kernel *)bmd->sgvecs[0].iov_base;
-
- __bio_for_each_segment(bvec, bio, i, 0) {
- char *addr = page_address(bvec->bv_page);
-diff --git a/fs/block_dev.c b/fs/block_dev.c
-index e65efa2..d5ce33a 100644
---- a/fs/block_dev.c
-+++ b/fs/block_dev.c
-@@ -48,7 +48,7 @@ inline struct block_device *I_BDEV(struct inode *inode)
-
- EXPORT_SYMBOL(I_BDEV);
-
--static sector_t max_block(struct block_device *bdev)
-+sector_t blkdev_max_block(struct block_device *bdev)
- {
- sector_t retval = ~((sector_t)0);
- loff_t sz = i_size_read(bdev->bd_inode);
-@@ -119,7 +119,7 @@ static int
- blkdev_get_block(struct inode *inode, sector_t iblock,
- struct buffer_head *bh, int create)
- {
-- if (iblock >= max_block(I_BDEV(inode))) {
-+ if (iblock >= blkdev_max_block(I_BDEV(inode))) {
- if (create)
- return -EIO;
-
-@@ -141,7 +141,7 @@ static int
- blkdev_get_blocks(struct inode *inode, sector_t iblock,
- struct buffer_head *bh, int create)
- {
-- sector_t end_block = max_block(I_BDEV(inode));
-+ sector_t end_block = blkdev_max_block(I_BDEV(inode));
- unsigned long max_blocks = bh->b_size >> inode->i_blkbits;
-
- if ((iblock + max_blocks) > end_block) {
-@@ -664,7 +664,7 @@ int bd_claim(struct block_device *bdev, void *holder)
- else if (bdev->bd_contains == bdev)
- res = 0; /* is a whole device which isn't held */
-
-- else if (bdev->bd_contains->bd_holder == bd_claim)
-+ else if (bdev->bd_contains->bd_holder == (void *)bd_claim)
- res = 0; /* is a partition of a device that is being partitioned */
- else if (bdev->bd_contains->bd_holder != NULL)
- res = -EBUSY; /* is a partition of a held device */
-diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
-index c4bc570..42acd8d 100644
---- a/fs/btrfs/ctree.c
-+++ b/fs/btrfs/ctree.c
-@@ -461,9 +461,12 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
- free_extent_buffer(buf);
- add_root_to_dirty_list(root);
- } else {
-- if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID)
-- parent_start = parent->start;
-- else
-+ if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) {
-+ if (parent)
-+ parent_start = parent->start;
-+ else
-+ parent_start = 0;
-+ } else
- parent_start = 0;
-
- WARN_ON(trans->transid != btrfs_header_generation(parent));
-@@ -3645,7 +3648,6 @@ setup_items_for_insert(struct btrfs_trans_handle *trans,
-
- ret = 0;
- if (slot == 0) {
-- struct btrfs_disk_key disk_key;
- btrfs_cpu_key_to_disk(&disk_key, cpu_key);
- ret = fixup_low_keys(trans, root, path, &disk_key, 1);
- }
-diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
-index f447188..59c17c5 100644
---- a/fs/btrfs/disk-io.c
-+++ b/fs/btrfs/disk-io.c
-@@ -39,7 +39,7 @@
- #include "tree-log.h"
- #include "free-space-cache.h"
-
--static struct extent_io_ops btree_extent_io_ops;
-+static const struct extent_io_ops btree_extent_io_ops;
- static void end_workqueue_fn(struct btrfs_work *work);
- static void free_fs_root(struct btrfs_root *root);
-
-@@ -2607,7 +2607,7 @@ out:
- return 0;
- }
-
--static struct extent_io_ops btree_extent_io_ops = {
-+static const struct extent_io_ops btree_extent_io_ops = {
- .write_cache_pages_lock_hook = btree_lock_page_hook,
- .readpage_end_io_hook = btree_readpage_end_io_hook,
- .submit_bio_hook = btree_submit_bio_hook,
-diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
-index 559f724..a026171 100644
---- a/fs/btrfs/extent-tree.c
-+++ b/fs/btrfs/extent-tree.c
-@@ -7141,6 +7141,10 @@ static noinline int relocate_one_extent(struct btrfs_root *extent_root,
- u64 group_start = group->key.objectid;
- new_extents = kmalloc(sizeof(*new_extents),
- GFP_NOFS);
-+ if (!new_extents) {
-+ ret = -ENOMEM;
-+ goto out;
-+ }
- nr_extents = 1;
- ret = get_new_locations(reloc_inode,
- extent_key,
-diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
-index 36de250..7ec75c7 100644
---- a/fs/btrfs/extent_io.h
-+++ b/fs/btrfs/extent_io.h
-@@ -49,36 +49,36 @@ typedef int (extent_submit_bio_hook_t)(struct inode *inode, int rw,
- struct bio *bio, int mirror_num,
- unsigned long bio_flags);
- struct extent_io_ops {
-- int (*fill_delalloc)(struct inode *inode, struct page *locked_page,
-+ int (* const fill_delalloc)(struct inode *inode, struct page *locked_page,
- u64 start, u64 end, int *page_started,
- unsigned long *nr_written);
-- int (*writepage_start_hook)(struct page *page, u64 start, u64 end);
-- int (*writepage_io_hook)(struct page *page, u64 start, u64 end);
-+ int (* const writepage_start_hook)(struct page *page, u64 start, u64 end);
-+ int (* const writepage_io_hook)(struct page *page, u64 start, u64 end);
- extent_submit_bio_hook_t *submit_bio_hook;
-- int (*merge_bio_hook)(struct page *page, unsigned long offset,
-+ int (* const merge_bio_hook)(struct page *page, unsigned long offset,
- size_t size, struct bio *bio,
- unsigned long bio_flags);
-- int (*readpage_io_hook)(struct page *page, u64 start, u64 end);
-- int (*readpage_io_failed_hook)(struct bio *bio, struct page *page,
-+ int (* const readpage_io_hook)(struct page *page, u64 start, u64 end);
-+ int (* const readpage_io_failed_hook)(struct bio *bio, struct page *page,
- u64 start, u64 end,
- struct extent_state *state);
-- int (*writepage_io_failed_hook)(struct bio *bio, struct page *page,
-+ int (* const writepage_io_failed_hook)(struct bio *bio, struct page *page,
- u64 start, u64 end,
- struct extent_state *state);
-- int (*readpage_end_io_hook)(struct page *page, u64 start, u64 end,
-+ int (* const readpage_end_io_hook)(struct page *page, u64 start, u64 end,
- struct extent_state *state);
-- int (*writepage_end_io_hook)(struct page *page, u64 start, u64 end,
-+ int (* const writepage_end_io_hook)(struct page *page, u64 start, u64 end,
- struct extent_state *state, int uptodate);
-- int (*set_bit_hook)(struct inode *inode, u64 start, u64 end,
-+ int (* const set_bit_hook)(struct inode *inode, u64 start, u64 end,
- unsigned long old, unsigned long bits);
-- int (*clear_bit_hook)(struct inode *inode, struct extent_state *state,
-+ int (* const clear_bit_hook)(struct inode *inode, struct extent_state *state,
- unsigned long bits);
-- int (*merge_extent_hook)(struct inode *inode,
-+ int (* const merge_extent_hook)(struct inode *inode,
- struct extent_state *new,
- struct extent_state *other);
-- int (*split_extent_hook)(struct inode *inode,
-+ int (* const split_extent_hook)(struct inode *inode,
- struct extent_state *orig, u64 split);
-- int (*write_cache_pages_lock_hook)(struct page *page);
-+ int (* const write_cache_pages_lock_hook)(struct page *page);
- };
-
- struct extent_io_tree {
-@@ -88,7 +88,7 @@ struct extent_io_tree {
- u64 dirty_bytes;
- spinlock_t lock;
- spinlock_t buffer_lock;
-- struct extent_io_ops *ops;
-+ const struct extent_io_ops *ops;
- };
-
- struct extent_state {
-diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
-index cb2849f..3718fb4 100644
---- a/fs/btrfs/free-space-cache.c
-+++ b/fs/btrfs/free-space-cache.c
-@@ -1074,8 +1074,6 @@ u64 btrfs_alloc_from_cluster(struct btrfs_block_group_cache *block_group,
-
- while(1) {
- if (entry->bytes < bytes || entry->offset < min_start) {
-- struct rb_node *node;
--
- node = rb_next(&entry->offset_index);
- if (!node)
- break;
-@@ -1226,7 +1224,7 @@ again:
- */
- while (entry->bitmap || found_bitmap ||
- (!entry->bitmap && entry->bytes < min_bytes)) {
-- struct rb_node *node = rb_next(&entry->offset_index);
-+ node = rb_next(&entry->offset_index);
-
- if (entry->bitmap && entry->bytes > bytes + empty_size) {
- ret = btrfs_bitmap_cluster(block_group, entry, cluster,
-diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
-index e03a836..e786215 100644
---- a/fs/btrfs/inode.c
-+++ b/fs/btrfs/inode.c
-@@ -63,7 +63,7 @@ static const struct inode_operations btrfs_file_inode_operations;
- static const struct address_space_operations btrfs_aops;
- static const struct address_space_operations btrfs_symlink_aops;
- static const struct file_operations btrfs_dir_file_operations;
--static struct extent_io_ops btrfs_extent_io_ops;
-+static const struct extent_io_ops btrfs_extent_io_ops;
-
- static struct kmem_cache *btrfs_inode_cachep;
- struct kmem_cache *btrfs_trans_handle_cachep;
-@@ -925,6 +925,7 @@ static int cow_file_range_async(struct inode *inode, struct page *locked_page,
- 1, 0, NULL, GFP_NOFS);
- while (start < end) {
- async_cow = kmalloc(sizeof(*async_cow), GFP_NOFS);
-+ BUG_ON(!async_cow);
- async_cow->inode = inode;
- async_cow->root = root;
- async_cow->locked_page = locked_page;
-@@ -4591,6 +4592,8 @@ static noinline int uncompress_inline(struct btrfs_path *path,
- inline_size = btrfs_file_extent_inline_item_len(leaf,
- btrfs_item_nr(leaf, path->slots[0]));
- tmp = kmalloc(inline_size, GFP_NOFS);
-+ if (!tmp)
-+ return -ENOMEM;
- ptr = btrfs_file_extent_inline_start(item);
-
- read_extent_buffer(leaf, tmp, ptr, inline_size);
-@@ -5972,7 +5975,7 @@ static const struct file_operations btrfs_dir_file_operations = {
- .fsync = btrfs_sync_file,
- };
-
--static struct extent_io_ops btrfs_extent_io_ops = {
-+static const struct extent_io_ops btrfs_extent_io_ops = {
- .fill_delalloc = run_delalloc_range,
- .submit_bio_hook = btrfs_submit_bio_hook,
- .merge_bio_hook = btrfs_merge_bio_hook,
-diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
-index ab7ab53..94e0781 100644
---- a/fs/btrfs/relocation.c
-+++ b/fs/btrfs/relocation.c
-@@ -884,7 +884,7 @@ static int __update_reloc_root(struct btrfs_root *root, int del)
- }
- spin_unlock(&rc->reloc_root_tree.lock);
-
-- BUG_ON((struct btrfs_root *)node->data != root);
-+ BUG_ON(!node || (struct btrfs_root *)node->data != root);
-
- if (!del) {
- spin_lock(&rc->reloc_root_tree.lock);
-diff --git a/fs/btrfs/sysfs.c b/fs/btrfs/sysfs.c
-index a240b6f..4ce16ef7 100644
---- a/fs/btrfs/sysfs.c
-+++ b/fs/btrfs/sysfs.c
-@@ -164,12 +164,12 @@ static void btrfs_root_release(struct kobject *kobj)
- complete(&root->kobj_unregister);
- }
-
--static struct sysfs_ops btrfs_super_attr_ops = {
-+static const struct sysfs_ops btrfs_super_attr_ops = {
- .show = btrfs_super_attr_show,
- .store = btrfs_super_attr_store,
- };
-
--static struct sysfs_ops btrfs_root_attr_ops = {
-+static const struct sysfs_ops btrfs_root_attr_ops = {
- .show = btrfs_root_attr_show,
- .store = btrfs_root_attr_store,
- };
-diff --git a/fs/buffer.c b/fs/buffer.c
-index 6fa5302..183550e 100644
---- a/fs/buffer.c
-+++ b/fs/buffer.c
-@@ -25,6 +25,7 @@
- #include <linux/percpu.h>
- #include <linux/slab.h>
- #include <linux/capability.h>
-+#include <linux/security.h>
- #include <linux/blkdev.h>
- #include <linux/file.h>
- #include <linux/quotaops.h>
-@@ -970,13 +971,14 @@ link_dev_buffers(struct page *page, struct buffer_head *head)
- /*
- * Initialise the state of a blockdev page's buffers.
- */
--static void
-+static sector_t
- init_page_buffers(struct page *page, struct block_device *bdev,
- sector_t block, int size)
- {
- struct buffer_head *head = page_buffers(page);
- struct buffer_head *bh = head;
- int uptodate = PageUptodate(page);
-+ sector_t end_block = blkdev_max_block(I_BDEV(bdev->bd_inode));
-
- do {
- if (!buffer_mapped(bh)) {
-@@ -985,38 +987,47 @@ init_page_buffers(struct page *page, struct block_device *bdev,
- bh->b_blocknr = block;
- if (uptodate)
- set_buffer_uptodate(bh);
-- set_buffer_mapped(bh);
-+ if (block < end_block)
-+ set_buffer_mapped(bh);
- }
- block++;
- bh = bh->b_this_page;
- } while (bh != head);
-+
-+ /*
-+ * Caller needs to validate requested block against end of device.
-+ */
-+ return end_block;
- }
-
- /*
- * Create the page-cache page that contains the requested block.
- *
-- * This is user purely for blockdev mappings.
-+ * This is used purely for blockdev mappings.
- */
--static struct page *
-+static int
- grow_dev_page(struct block_device *bdev, sector_t block,
-- pgoff_t index, int size)
-+ pgoff_t index, int size, int sizebits)
- {
- struct inode *inode = bdev->bd_inode;
- struct page *page;
- struct buffer_head *bh;
-+ sector_t end_block;
-+ int ret = 0; /* Will call free_more_memory() */
-
- page = find_or_create_page(inode->i_mapping, index,
- (mapping_gfp_mask(inode->i_mapping) & ~__GFP_FS)|__GFP_MOVABLE);
- if (!page)
-- return NULL;
-+ return ret;
-
- BUG_ON(!PageLocked(page));
-
- if (page_has_buffers(page)) {
- bh = page_buffers(page);
- if (bh->b_size == size) {
-- init_page_buffers(page, bdev, block, size);
-- return page;
-+ end_block = init_page_buffers(page, bdev,
-+ index << sizebits, size);
-+ goto done;
- }
- if (!try_to_free_buffers(page))
- goto failed;
-@@ -1036,15 +1047,15 @@ grow_dev_page(struct block_device *bdev, sector_t block,
- */
- spin_lock(&inode->i_mapping->private_lock);
- link_dev_buffers(page, bh);
-- init_page_buffers(page, bdev, block, size);
-+ end_block = init_page_buffers(page, bdev, index << sizebits, size);
- spin_unlock(&inode->i_mapping->private_lock);
-- return page;
-+done:
-+ ret = (block < end_block) ? 1 : -ENXIO;
-
- failed:
-- BUG();
- unlock_page(page);
- page_cache_release(page);
-- return NULL;
-+ return ret;
- }
-
- /*
-@@ -1054,7 +1065,6 @@ failed:
- static int
- grow_buffers(struct block_device *bdev, sector_t block, int size)
- {
-- struct page *page;
- pgoff_t index;
- int sizebits;
-
-@@ -1078,14 +1088,9 @@ grow_buffers(struct block_device *bdev, sector_t block, int size)
- bdevname(bdev, b));
- return -EIO;
- }
-- block = index << sizebits;
-+
- /* Create a page with the proper size buffers.. */
-- page = grow_dev_page(bdev, block, index, size);
-- if (!page)
-- return 0;
-- unlock_page(page);
-- page_cache_release(page);
-- return 1;
-+ return grow_dev_page(bdev, block, index, size, sizebits);
- }
-
- static struct buffer_head *
-@@ -1104,7 +1109,7 @@ __getblk_slow(struct block_device *bdev, sector_t block, int size)
- }
-
- for (;;) {
-- struct buffer_head * bh;
-+ struct buffer_head *bh;
- int ret;
-
- bh = __find_get_block(bdev, block, size);
-@@ -1374,10 +1379,6 @@ EXPORT_SYMBOL(__find_get_block);
- * which corresponds to the passed block_device, block and size. The
- * returned buffer has its reference count incremented.
- *
-- * __getblk() cannot fail - it just keeps trying. If you pass it an
-- * illegal block number, __getblk() will happily return a buffer_head
-- * which represents the non-existent block. Very weird.
-- *
- * __getblk() will lock up the machine if grow_dev_page's try_to_free_buffers()
- * attempt is failing. FIXME, perhaps?
- */
-diff --git a/fs/cachefiles/bind.c b/fs/cachefiles/bind.c
-index 3797e00..ce776f6 100644
---- a/fs/cachefiles/bind.c
-+++ b/fs/cachefiles/bind.c
-@@ -39,13 +39,11 @@ int cachefiles_daemon_bind(struct cachefiles_cache *cache, char *args)
- args);
-
- /* start by checking things over */
-- ASSERT(cache->fstop_percent >= 0 &&
-- cache->fstop_percent < cache->fcull_percent &&
-+ ASSERT(cache->fstop_percent < cache->fcull_percent &&
- cache->fcull_percent < cache->frun_percent &&
- cache->frun_percent < 100);
-
-- ASSERT(cache->bstop_percent >= 0 &&
-- cache->bstop_percent < cache->bcull_percent &&
-+ ASSERT(cache->bstop_percent < cache->bcull_percent &&
- cache->bcull_percent < cache->brun_percent &&
- cache->brun_percent < 100);
-
-diff --git a/fs/cachefiles/daemon.c b/fs/cachefiles/daemon.c
-index 4618516..bb30d01 100644
---- a/fs/cachefiles/daemon.c
-+++ b/fs/cachefiles/daemon.c
-@@ -220,7 +220,7 @@ static ssize_t cachefiles_daemon_write(struct file *file,
- if (test_bit(CACHEFILES_DEAD, &cache->flags))
- return -EIO;
-
-- if (datalen < 0 || datalen > PAGE_SIZE - 1)
-+ if (datalen > PAGE_SIZE - 1)
- return -EOPNOTSUPP;
-
- /* drag the command string into the kernel so we can parse it */
-@@ -385,7 +385,7 @@ static int cachefiles_daemon_fstop(struct cachefiles_cache *cache, char *args)
- if (args[0] != '%' || args[1] != '\0')
- return -EINVAL;
-
-- if (fstop < 0 || fstop >= cache->fcull_percent)
-+ if (fstop >= cache->fcull_percent)
- return cachefiles_daemon_range_error(cache, args);
-
- cache->fstop_percent = fstop;
-@@ -457,7 +457,7 @@ static int cachefiles_daemon_bstop(struct cachefiles_cache *cache, char *args)
- if (args[0] != '%' || args[1] != '\0')
- return -EINVAL;
-
-- if (bstop < 0 || bstop >= cache->bcull_percent)
-+ if (bstop >= cache->bcull_percent)
- return cachefiles_daemon_range_error(cache, args);
-
- cache->bstop_percent = bstop;
-diff --git a/fs/cachefiles/internal.h b/fs/cachefiles/internal.h
-index f7c255f..fcd61de 100644
---- a/fs/cachefiles/internal.h
-+++ b/fs/cachefiles/internal.h
-@@ -56,7 +56,7 @@ struct cachefiles_cache {
- wait_queue_head_t daemon_pollwq; /* poll waitqueue for daemon */
- struct rb_root active_nodes; /* active nodes (can't be culled) */
- rwlock_t active_lock; /* lock for active_nodes */
-- atomic_t gravecounter; /* graveyard uniquifier */
-+ atomic_unchecked_t gravecounter; /* graveyard uniquifier */
- unsigned frun_percent; /* when to stop culling (% files) */
- unsigned fcull_percent; /* when to start culling (% files) */
- unsigned fstop_percent; /* when to stop allocating (% files) */
-@@ -168,19 +168,19 @@ extern int cachefiles_check_in_use(struct cachefiles_cache *cache,
- * proc.c
- */
- #ifdef CONFIG_CACHEFILES_HISTOGRAM
--extern atomic_t cachefiles_lookup_histogram[HZ];
--extern atomic_t cachefiles_mkdir_histogram[HZ];
--extern atomic_t cachefiles_create_histogram[HZ];
-+extern atomic_unchecked_t cachefiles_lookup_histogram[HZ];
-+extern atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
-+extern atomic_unchecked_t cachefiles_create_histogram[HZ];
-
- extern int __init cachefiles_proc_init(void);
- extern void cachefiles_proc_cleanup(void);
- static inline
--void cachefiles_hist(atomic_t histogram[], unsigned long start_jif)
-+void cachefiles_hist(atomic_unchecked_t histogram[], unsigned long start_jif)
- {
- unsigned long jif = jiffies - start_jif;
- if (jif >= HZ)
- jif = HZ - 1;
-- atomic_inc(&histogram[jif]);
-+ atomic_inc_unchecked(&histogram[jif]);
- }
-
- #else
-diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c
-index 14ac480..a62766c 100644
---- a/fs/cachefiles/namei.c
-+++ b/fs/cachefiles/namei.c
-@@ -250,7 +250,7 @@ try_again:
- /* first step is to make up a grave dentry in the graveyard */
- sprintf(nbuffer, "%08x%08x",
- (uint32_t) get_seconds(),
-- (uint32_t) atomic_inc_return(&cache->gravecounter));
-+ (uint32_t) atomic_inc_return_unchecked(&cache->gravecounter));
-
- /* do the multiway lock magic */
- trap = lock_rename(cache->graveyard, dir);
-diff --git a/fs/cachefiles/proc.c b/fs/cachefiles/proc.c
-index eccd339..4c1d995 100644
---- a/fs/cachefiles/proc.c
-+++ b/fs/cachefiles/proc.c
-@@ -14,9 +14,9 @@
- #include <linux/seq_file.h>
- #include "internal.h"
-
--atomic_t cachefiles_lookup_histogram[HZ];
--atomic_t cachefiles_mkdir_histogram[HZ];
--atomic_t cachefiles_create_histogram[HZ];
-+atomic_unchecked_t cachefiles_lookup_histogram[HZ];
-+atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
-+atomic_unchecked_t cachefiles_create_histogram[HZ];
-
- /*
- * display the latency histogram
-@@ -35,9 +35,9 @@ static int cachefiles_histogram_show(struct seq_file *m, void *v)
- return 0;
- default:
- index = (unsigned long) v - 3;
-- x = atomic_read(&cachefiles_lookup_histogram[index]);
-- y = atomic_read(&cachefiles_mkdir_histogram[index]);
-- z = atomic_read(&cachefiles_create_histogram[index]);
-+ x = atomic_read_unchecked(&cachefiles_lookup_histogram[index]);
-+ y = atomic_read_unchecked(&cachefiles_mkdir_histogram[index]);
-+ z = atomic_read_unchecked(&cachefiles_create_histogram[index]);
- if (x == 0 && y == 0 && z == 0)
- return 0;
-
-diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c
-index a6c8c6f..5cf8517 100644
---- a/fs/cachefiles/rdwr.c
-+++ b/fs/cachefiles/rdwr.c
-@@ -946,7 +946,7 @@ int cachefiles_write_page(struct fscache_storage *op, struct page *page)
- old_fs = get_fs();
- set_fs(KERNEL_DS);
- ret = file->f_op->write(
-- file, (const void __user *) data, len, &pos);
-+ file, (const void __force_user *) data, len, &pos);
- set_fs(old_fs);
- kunmap(page);
- if (ret != len)
-diff --git a/fs/cifs/asn1.c b/fs/cifs/asn1.c
-index 20692fb..3b41113 100644
---- a/fs/cifs/asn1.c
-+++ b/fs/cifs/asn1.c
-@@ -492,17 +492,13 @@ compare_oid(unsigned long *oid1, unsigned int oid1len,
-
- int
- decode_negTokenInit(unsigned char *security_blob, int length,
-- enum securityEnum *secType)
-+ struct TCP_Server_Info *server)
- {
- struct asn1_ctx ctx;
- unsigned char *end;
- unsigned char *sequence_end;
- unsigned long *oid = NULL;
- unsigned int cls, con, tag, oidlen, rc;
-- bool use_ntlmssp = false;
-- bool use_kerberos = false;
-- bool use_kerberosu2u = false;
-- bool use_mskerberos = false;
-
- /* cifs_dump_mem(" Received SecBlob ", security_blob, length); */
-
-@@ -604,20 +600,17 @@ decode_negTokenInit(unsigned char *security_blob, int length,
- *(oid + 1), *(oid + 2), *(oid + 3)));
-
- if (compare_oid(oid, oidlen, MSKRB5_OID,
-- MSKRB5_OID_LEN) &&
-- !use_mskerberos)
-- use_mskerberos = true;
-+ MSKRB5_OID_LEN))
-+ server->sec_mskerberos = true;
- else if (compare_oid(oid, oidlen, KRB5U2U_OID,
-- KRB5U2U_OID_LEN) &&
-- !use_kerberosu2u)
-- use_kerberosu2u = true;
-+ KRB5U2U_OID_LEN))
-+ server->sec_kerberosu2u = true;
- else if (compare_oid(oid, oidlen, KRB5_OID,
-- KRB5_OID_LEN) &&
-- !use_kerberos)
-- use_kerberos = true;
-+ KRB5_OID_LEN))
-+ server->sec_kerberos = true;
- else if (compare_oid(oid, oidlen, NTLMSSP_OID,
- NTLMSSP_OID_LEN))
-- use_ntlmssp = true;
-+ server->sec_ntlmssp = true;
-
- kfree(oid);
- }
-@@ -626,60 +619,10 @@ decode_negTokenInit(unsigned char *security_blob, int length,
- }
- }
-
-- /* mechlistMIC */
-- if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
-- /* Check if we have reached the end of the blob, but with
-- no mechListMic (e.g. NTLMSSP instead of KRB5) */
-- if (ctx.error == ASN1_ERR_DEC_EMPTY)
-- goto decode_negtoken_exit;
-- cFYI(1, ("Error decoding last part negTokenInit exit3"));
-- return 0;
-- } else if ((cls != ASN1_CTX) || (con != ASN1_CON)) {
-- /* tag = 3 indicating mechListMIC */
-- cFYI(1, ("Exit 4 cls = %d con = %d tag = %d end = %p (%d)",
-- cls, con, tag, end, *end));
-- return 0;
-- }
--
-- /* sequence */
-- if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
-- cFYI(1, ("Error decoding last part negTokenInit exit5"));
-- return 0;
-- } else if ((cls != ASN1_UNI) || (con != ASN1_CON)
-- || (tag != ASN1_SEQ)) {
-- cFYI(1, ("cls = %d con = %d tag = %d end = %p (%d)",
-- cls, con, tag, end, *end));
-- }
--
-- /* sequence of */
-- if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
-- cFYI(1, ("Error decoding last part negTokenInit exit 7"));
-- return 0;
-- } else if ((cls != ASN1_CTX) || (con != ASN1_CON)) {
-- cFYI(1, ("Exit 8 cls = %d con = %d tag = %d end = %p (%d)",
-- cls, con, tag, end, *end));
-- return 0;
-- }
--
-- /* general string */
-- if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
-- cFYI(1, ("Error decoding last part negTokenInit exit9"));
-- return 0;
-- } else if ((cls != ASN1_UNI) || (con != ASN1_PRI)
-- || (tag != ASN1_GENSTR)) {
-- cFYI(1, ("Exit10 cls = %d con = %d tag = %d end = %p (%d)",
-- cls, con, tag, end, *end));
-- return 0;
-- }
-- cFYI(1, ("Need to call asn1_octets_decode() function for %s",
-- ctx.pointer)); /* is this UTF-8 or ASCII? */
--decode_negtoken_exit:
-- if (use_kerberos)
-- *secType = Kerberos;
-- else if (use_mskerberos)
-- *secType = MSKerberos;
-- else if (use_ntlmssp)
-- *secType = RawNTLMSSP;
--
-+ /*
-+ * We currently ignore anything at the end of the SPNEGO blob after
-+ * the mechTypes have been parsed, since none of that info is
-+ * used at the moment.
-+ */
- return 1;
- }
-diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
-index 42cec2a..dfdf3d2 100644
---- a/fs/cifs/cifs_debug.c
-+++ b/fs/cifs/cifs_debug.c
-@@ -242,8 +242,8 @@ static ssize_t cifs_stats_proc_write(struct file *file,
-
- if (c == '1' || c == 'y' || c == 'Y' || c == '0') {
- #ifdef CONFIG_CIFS_STATS2
-- atomic_set(&totBufAllocCount, 0);
-- atomic_set(&totSmBufAllocCount, 0);
-+ atomic_set_unchecked(&totBufAllocCount, 0);
-+ atomic_set_unchecked(&totSmBufAllocCount, 0);
- #endif /* CONFIG_CIFS_STATS2 */
- read_lock(&cifs_tcp_ses_lock);
- list_for_each(tmp1, &cifs_tcp_ses_list) {
-@@ -256,25 +256,25 @@ static ssize_t cifs_stats_proc_write(struct file *file,
- tcon = list_entry(tmp3,
- struct cifsTconInfo,
- tcon_list);
-- atomic_set(&tcon->num_smbs_sent, 0);
-- atomic_set(&tcon->num_writes, 0);
-- atomic_set(&tcon->num_reads, 0);
-- atomic_set(&tcon->num_oplock_brks, 0);
-- atomic_set(&tcon->num_opens, 0);
-- atomic_set(&tcon->num_posixopens, 0);
-- atomic_set(&tcon->num_posixmkdirs, 0);
-- atomic_set(&tcon->num_closes, 0);
-- atomic_set(&tcon->num_deletes, 0);
-- atomic_set(&tcon->num_mkdirs, 0);
-- atomic_set(&tcon->num_rmdirs, 0);
-- atomic_set(&tcon->num_renames, 0);
-- atomic_set(&tcon->num_t2renames, 0);
-- atomic_set(&tcon->num_ffirst, 0);
-- atomic_set(&tcon->num_fnext, 0);
-- atomic_set(&tcon->num_fclose, 0);
-- atomic_set(&tcon->num_hardlinks, 0);
-- atomic_set(&tcon->num_symlinks, 0);
-- atomic_set(&tcon->num_locks, 0);
-+ atomic_set_unchecked(&tcon->num_smbs_sent, 0);
-+ atomic_set_unchecked(&tcon->num_writes, 0);
-+ atomic_set_unchecked(&tcon->num_reads, 0);
-+ atomic_set_unchecked(&tcon->num_oplock_brks, 0);
-+ atomic_set_unchecked(&tcon->num_opens, 0);
-+ atomic_set_unchecked(&tcon->num_posixopens, 0);
-+ atomic_set_unchecked(&tcon->num_posixmkdirs, 0);
-+ atomic_set_unchecked(&tcon->num_closes, 0);
-+ atomic_set_unchecked(&tcon->num_deletes, 0);
-+ atomic_set_unchecked(&tcon->num_mkdirs, 0);
-+ atomic_set_unchecked(&tcon->num_rmdirs, 0);
-+ atomic_set_unchecked(&tcon->num_renames, 0);
-+ atomic_set_unchecked(&tcon->num_t2renames, 0);
-+ atomic_set_unchecked(&tcon->num_ffirst, 0);
-+ atomic_set_unchecked(&tcon->num_fnext, 0);
-+ atomic_set_unchecked(&tcon->num_fclose, 0);
-+ atomic_set_unchecked(&tcon->num_hardlinks, 0);
-+ atomic_set_unchecked(&tcon->num_symlinks, 0);
-+ atomic_set_unchecked(&tcon->num_locks, 0);
- }
- }
- }
-@@ -304,8 +304,8 @@ static int cifs_stats_proc_show(struct seq_file *m, void *v)
- smBufAllocCount.counter, cifs_min_small);
- #ifdef CONFIG_CIFS_STATS2
- seq_printf(m, "Total Large %d Small %d Allocations\n",
-- atomic_read(&totBufAllocCount),
-- atomic_read(&totSmBufAllocCount));
-+ atomic_read_unchecked(&totBufAllocCount),
-+ atomic_read_unchecked(&totSmBufAllocCount));
- #endif /* CONFIG_CIFS_STATS2 */
-
- seq_printf(m, "Operations (MIDs): %d\n", midCount.counter);
-@@ -334,41 +334,41 @@ static int cifs_stats_proc_show(struct seq_file *m, void *v)
- if (tcon->need_reconnect)
- seq_puts(m, "\tDISCONNECTED ");
- seq_printf(m, "\nSMBs: %d Oplock Breaks: %d",
-- atomic_read(&tcon->num_smbs_sent),
-- atomic_read(&tcon->num_oplock_brks));
-+ atomic_read_unchecked(&tcon->num_smbs_sent),
-+ atomic_read_unchecked(&tcon->num_oplock_brks));
- seq_printf(m, "\nReads: %d Bytes: %lld",
-- atomic_read(&tcon->num_reads),
-+ atomic_read_unchecked(&tcon->num_reads),
- (long long)(tcon->bytes_read));
- seq_printf(m, "\nWrites: %d Bytes: %lld",
-- atomic_read(&tcon->num_writes),
-+ atomic_read_unchecked(&tcon->num_writes),
- (long long)(tcon->bytes_written));
- seq_printf(m, "\nFlushes: %d",
-- atomic_read(&tcon->num_flushes));
-+ atomic_read_unchecked(&tcon->num_flushes));
- seq_printf(m, "\nLocks: %d HardLinks: %d "
- "Symlinks: %d",
-- atomic_read(&tcon->num_locks),
-- atomic_read(&tcon->num_hardlinks),
-- atomic_read(&tcon->num_symlinks));
-+ atomic_read_unchecked(&tcon->num_locks),
-+ atomic_read_unchecked(&tcon->num_hardlinks),
-+ atomic_read_unchecked(&tcon->num_symlinks));
- seq_printf(m, "\nOpens: %d Closes: %d "
- "Deletes: %d",
-- atomic_read(&tcon->num_opens),
-- atomic_read(&tcon->num_closes),
-- atomic_read(&tcon->num_deletes));
-+ atomic_read_unchecked(&tcon->num_opens),
-+ atomic_read_unchecked(&tcon->num_closes),
-+ atomic_read_unchecked(&tcon->num_deletes));
- seq_printf(m, "\nPosix Opens: %d "
- "Posix Mkdirs: %d",
-- atomic_read(&tcon->num_posixopens),
-- atomic_read(&tcon->num_posixmkdirs));
-+ atomic_read_unchecked(&tcon->num_posixopens),
-+ atomic_read_unchecked(&tcon->num_posixmkdirs));
- seq_printf(m, "\nMkdirs: %d Rmdirs: %d",
-- atomic_read(&tcon->num_mkdirs),
-- atomic_read(&tcon->num_rmdirs));
-+ atomic_read_unchecked(&tcon->num_mkdirs),
-+ atomic_read_unchecked(&tcon->num_rmdirs));
- seq_printf(m, "\nRenames: %d T2 Renames %d",
-- atomic_read(&tcon->num_renames),
-- atomic_read(&tcon->num_t2renames));
-+ atomic_read_unchecked(&tcon->num_renames),
-+ atomic_read_unchecked(&tcon->num_t2renames));
- seq_printf(m, "\nFindFirst: %d FNext %d "
- "FClose %d",
-- atomic_read(&tcon->num_ffirst),
-- atomic_read(&tcon->num_fnext),
-- atomic_read(&tcon->num_fclose));
-+ atomic_read_unchecked(&tcon->num_ffirst),
-+ atomic_read_unchecked(&tcon->num_fnext),
-+ atomic_read_unchecked(&tcon->num_fclose));
- }
- }
- }
-diff --git a/fs/cifs/cifs_spnego.c b/fs/cifs/cifs_spnego.c
-index 8ec7736..691f70a 100644
---- a/fs/cifs/cifs_spnego.c
-+++ b/fs/cifs/cifs_spnego.c
-@@ -132,9 +132,9 @@ cifs_get_spnego_key(struct cifsSesInfo *sesInfo)
- dp = description + strlen(description);
-
- /* for now, only sec=krb5 and sec=mskrb5 are valid */
-- if (server->secType == Kerberos)
-+ if (server->sec_kerberos)
- sprintf(dp, ";sec=krb5");
-- else if (server->secType == MSKerberos)
-+ else if (server->sec_mskerberos)
- sprintf(dp, ";sec=mskrb5");
- else
- goto out;
-diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
-index 1445407..68cb0dc 100644
---- a/fs/cifs/cifsfs.c
-+++ b/fs/cifs/cifsfs.c
-@@ -869,7 +869,7 @@ cifs_init_request_bufs(void)
- cifs_req_cachep = kmem_cache_create("cifs_request",
- CIFSMaxBufSize +
- MAX_CIFS_HDR_SIZE, 0,
-- SLAB_HWCACHE_ALIGN, NULL);
-+ SLAB_HWCACHE_ALIGN | SLAB_USERCOPY, NULL);
- if (cifs_req_cachep == NULL)
- return -ENOMEM;
-
-@@ -896,7 +896,7 @@ cifs_init_request_bufs(void)
- efficient to alloc 1 per page off the slab compared to 17K (5page)
- alloc of large cifs buffers even when page debugging is on */
- cifs_sm_req_cachep = kmem_cache_create("cifs_small_rq",
-- MAX_CIFS_SMALL_BUFFER_SIZE, 0, SLAB_HWCACHE_ALIGN,
-+ MAX_CIFS_SMALL_BUFFER_SIZE, 0, SLAB_HWCACHE_ALIGN | SLAB_USERCOPY,
- NULL);
- if (cifs_sm_req_cachep == NULL) {
- mempool_destroy(cifs_req_poolp);
-@@ -991,8 +991,8 @@ init_cifs(void)
- atomic_set(&bufAllocCount, 0);
- atomic_set(&smBufAllocCount, 0);
- #ifdef CONFIG_CIFS_STATS2
-- atomic_set(&totBufAllocCount, 0);
-- atomic_set(&totSmBufAllocCount, 0);
-+ atomic_set_unchecked(&totBufAllocCount, 0);
-+ atomic_set_unchecked(&totSmBufAllocCount, 0);
- #endif /* CONFIG_CIFS_STATS2 */
-
- atomic_set(&midCount, 0);
-diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
-index e29581e..cb1cb71 100644
---- a/fs/cifs/cifsglob.h
-+++ b/fs/cifs/cifsglob.h
-@@ -86,7 +86,6 @@ enum securityEnum {
- RawNTLMSSP, /* NTLMSSP without SPNEGO, NTLMv2 hash */
- /* NTLMSSP, */ /* can use rawNTLMSSP instead of NTLMSSP via SPNEGO */
- Kerberos, /* Kerberos via SPNEGO */
-- MSKerberos, /* MS Kerberos via SPNEGO */
- };
-
- enum protocolEnum {
-@@ -183,6 +182,11 @@ struct TCP_Server_Info {
- struct mac_key mac_signing_key;
- char ntlmv2_hash[16];
- unsigned long lstrp; /* when we got last response from this server */
-+ /* extended security flavors that server supports */
-+ bool sec_kerberos; /* supports plain Kerberos */
-+ bool sec_mskerberos; /* supports legacy MS Kerberos */
-+ bool sec_kerberosu2u; /* supports U2U Kerberos */
-+ bool sec_ntlmssp; /* supports NTLMSSP */
- };
-
- /*
-@@ -252,28 +256,28 @@ struct cifsTconInfo {
- __u16 Flags; /* optional support bits */
- enum statusEnum tidStatus;
- #ifdef CONFIG_CIFS_STATS
-- atomic_t num_smbs_sent;
-- atomic_t num_writes;
-- atomic_t num_reads;
-- atomic_t num_flushes;
-- atomic_t num_oplock_brks;
-- atomic_t num_opens;
-- atomic_t num_closes;
-- atomic_t num_deletes;
-- atomic_t num_mkdirs;
-- atomic_t num_posixopens;
-- atomic_t num_posixmkdirs;
-- atomic_t num_rmdirs;
-- atomic_t num_renames;
-- atomic_t num_t2renames;
-- atomic_t num_ffirst;
-- atomic_t num_fnext;
-- atomic_t num_fclose;
-- atomic_t num_hardlinks;
-- atomic_t num_symlinks;
-- atomic_t num_locks;
-- atomic_t num_acl_get;
-- atomic_t num_acl_set;
-+ atomic_unchecked_t num_smbs_sent;
-+ atomic_unchecked_t num_writes;
-+ atomic_unchecked_t num_reads;
-+ atomic_unchecked_t num_flushes;
-+ atomic_unchecked_t num_oplock_brks;
-+ atomic_unchecked_t num_opens;
-+ atomic_unchecked_t num_closes;
-+ atomic_unchecked_t num_deletes;
-+ atomic_unchecked_t num_mkdirs;
-+ atomic_unchecked_t num_posixopens;
-+ atomic_unchecked_t num_posixmkdirs;
-+ atomic_unchecked_t num_rmdirs;
-+ atomic_unchecked_t num_renames;
-+ atomic_unchecked_t num_t2renames;
-+ atomic_unchecked_t num_ffirst;
-+ atomic_unchecked_t num_fnext;
-+ atomic_unchecked_t num_fclose;
-+ atomic_unchecked_t num_hardlinks;
-+ atomic_unchecked_t num_symlinks;
-+ atomic_unchecked_t num_locks;
-+ atomic_unchecked_t num_acl_get;
-+ atomic_unchecked_t num_acl_set;
- #ifdef CONFIG_CIFS_STATS2
- unsigned long long time_writes;
- unsigned long long time_reads;
-@@ -414,7 +418,7 @@ static inline char CIFS_DIR_SEP(const struct cifs_sb_info *cifs_sb)
- }
-
- #ifdef CONFIG_CIFS_STATS
--#define cifs_stats_inc atomic_inc
-+#define cifs_stats_inc atomic_inc_unchecked
-
- static inline void cifs_stats_bytes_written(struct cifsTconInfo *tcon,
- unsigned int bytes)
-@@ -701,8 +705,8 @@ GLOBAL_EXTERN atomic_t tconInfoReconnectCount;
- /* Various Debug counters */
- GLOBAL_EXTERN atomic_t bufAllocCount; /* current number allocated */
- #ifdef CONFIG_CIFS_STATS2
--GLOBAL_EXTERN atomic_t totBufAllocCount; /* total allocated over all time */
--GLOBAL_EXTERN atomic_t totSmBufAllocCount;
-+GLOBAL_EXTERN atomic_unchecked_t totBufAllocCount; /* total allocated over all time */
-+GLOBAL_EXTERN atomic_unchecked_t totSmBufAllocCount;
- #endif
- GLOBAL_EXTERN atomic_t smBufAllocCount;
- GLOBAL_EXTERN atomic_t midCount;
-diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
-index 76d9f64..ff7f42f 100644
---- a/fs/cifs/cifsproto.h
-+++ b/fs/cifs/cifsproto.h
-@@ -73,7 +73,7 @@ extern struct cifsFileInfo *find_readable_file(struct cifsInodeInfo *);
- extern unsigned int smbCalcSize(struct smb_hdr *ptr);
- extern unsigned int smbCalcSize_LE(struct smb_hdr *ptr);
- extern int decode_negTokenInit(unsigned char *security_blob, int length,
-- enum securityEnum *secType);
-+ struct TCP_Server_Info *server);
- extern int cifs_convert_address(char *src, void *dst);
- extern int map_smb_to_linux_error(struct smb_hdr *smb, int logErr);
- extern void header_assemble(struct smb_hdr *, char /* command */ ,
-diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
-index 665b128..a8642cb 100644
---- a/fs/cifs/cifssmb.c
-+++ b/fs/cifs/cifssmb.c
-@@ -596,13 +596,19 @@ CIFSSMBNegotiate(unsigned int xid, struct cifsSesInfo *ses)
- server->secType = RawNTLMSSP;
- } else {
- rc = decode_negTokenInit(pSMBr->u.extended_response.
-- SecurityBlob,
-- count - 16,
-- &server->secType);
-+ SecurityBlob, count - 16,
-+ server);
- if (rc == 1)
- rc = 0;
- else
- rc = -EINVAL;
-+
-+ if (server->sec_kerberos || server->sec_mskerberos)
-+ server->secType = Kerberos;
-+ else if (server->sec_ntlmssp)
-+ server->secType = RawNTLMSSP;
-+ else
-+ rc = -EOPNOTSUPP;
- }
- } else
- server->capabilities &= ~CAP_EXTENDED_SECURITY;
-diff --git a/fs/cifs/link.c b/fs/cifs/link.c
-index fc1e048..28b3441 100644
---- a/fs/cifs/link.c
-+++ b/fs/cifs/link.c
-@@ -215,7 +215,7 @@ cifs_symlink(struct inode *inode, struct dentry *direntry, const char *symname)
-
- void cifs_put_link(struct dentry *direntry, struct nameidata *nd, void *cookie)
- {
-- char *p = nd_get_link(nd);
-+ const char *p = nd_get_link(nd);
- if (!IS_ERR(p))
- kfree(p);
- }
-diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
-index 95b82e8..12a538d 100644
---- a/fs/cifs/misc.c
-+++ b/fs/cifs/misc.c
-@@ -155,7 +155,7 @@ cifs_buf_get(void)
- memset(ret_buf, 0, sizeof(struct smb_hdr) + 3);
- atomic_inc(&bufAllocCount);
- #ifdef CONFIG_CIFS_STATS2
-- atomic_inc(&totBufAllocCount);
-+ atomic_inc_unchecked(&totBufAllocCount);
- #endif /* CONFIG_CIFS_STATS2 */
- }
-
-@@ -190,7 +190,7 @@ cifs_small_buf_get(void)
- /* memset(ret_buf, 0, sizeof(struct smb_hdr) + 27);*/
- atomic_inc(&smBufAllocCount);
- #ifdef CONFIG_CIFS_STATS2
-- atomic_inc(&totSmBufAllocCount);
-+ atomic_inc_unchecked(&totSmBufAllocCount);
- #endif /* CONFIG_CIFS_STATS2 */
-
- }
-diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
-index f5618f8..fd7b4d0 100644
---- a/fs/cifs/readdir.c
-+++ b/fs/cifs/readdir.c
-@@ -79,11 +79,17 @@ cifs_readdir_lookup(struct dentry *parent, struct qstr *name,
-
- dentry = d_lookup(parent, name);
- if (dentry) {
-- /* FIXME: check for inode number changes? */
-- if (dentry->d_inode != NULL)
-+ int err;
-+ inode = dentry->d_inode;
-+ /* update inode in place if i_ino didn't change */
-+ if (inode && CIFS_I(inode)->uniqueid == fattr->cf_uniqueid) {
-+ cifs_fattr_to_inode(inode, fattr);
- return dentry;
-- d_drop(dentry);
-+ }
-+ err = d_invalidate(dentry);
- dput(dentry);
-+ if (err)
-+ return NULL;
- }
-
- dentry = d_alloc(parent, name);
-diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
-index 20ae71b..77b3c35 100644
---- a/fs/cifs/sess.c
-+++ b/fs/cifs/sess.c
-@@ -736,7 +736,7 @@ ssetup_ntlmssp_authenticate:
- unicode_ssetup_strings(&bcc_ptr, ses, nls_cp);
- } else
- ascii_ssetup_strings(&bcc_ptr, ses, nls_cp);
-- } else if (type == Kerberos || type == MSKerberos) {
-+ } else if (type == Kerberos) {
- #ifdef CONFIG_CIFS_UPCALL
- struct cifs_spnego_msg *msg;
- spnego_key = cifs_get_spnego_key(ses);
-diff --git a/fs/coda/cache.c b/fs/coda/cache.c
-index a5bf577..6d19845 100644
---- a/fs/coda/cache.c
-+++ b/fs/coda/cache.c
-@@ -24,14 +24,14 @@
- #include <linux/coda_fs_i.h>
- #include <linux/coda_cache.h>
-
--static atomic_t permission_epoch = ATOMIC_INIT(0);
-+static atomic_unchecked_t permission_epoch = ATOMIC_INIT(0);
-
- /* replace or extend an acl cache hit */
- void coda_cache_enter(struct inode *inode, int mask)
- {
- struct coda_inode_info *cii = ITOC(inode);
-
-- cii->c_cached_epoch = atomic_read(&permission_epoch);
-+ cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch);
- if (cii->c_uid != current_fsuid()) {
- cii->c_uid = current_fsuid();
- cii->c_cached_perm = mask;
-@@ -43,13 +43,13 @@ void coda_cache_enter(struct inode *inode, int mask)
- void coda_cache_clear_inode(struct inode *inode)
- {
- struct coda_inode_info *cii = ITOC(inode);
-- cii->c_cached_epoch = atomic_read(&permission_epoch) - 1;
-+ cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch) - 1;
- }
-
- /* remove all acl caches */
- void coda_cache_clear_all(struct super_block *sb)
- {
-- atomic_inc(&permission_epoch);
-+ atomic_inc_unchecked(&permission_epoch);
- }
-
-
-@@ -61,7 +61,7 @@ int coda_cache_check(struct inode *inode, int mask)
-
- hit = (mask & cii->c_cached_perm) == mask &&
- cii->c_uid == current_fsuid() &&
-- cii->c_cached_epoch == atomic_read(&permission_epoch);
-+ cii->c_cached_epoch == atomic_read_unchecked(&permission_epoch);
-
- return hit;
- }
-diff --git a/fs/compat.c b/fs/compat.c
-index 46b93d1..06d6d11 100644
---- a/fs/compat.c
-+++ b/fs/compat.c
-@@ -71,6 +71,9 @@ int compat_printk(const char *fmt, ...)
- return ret;
- }
-
-+extern int gr_process_kernel_exec_ban(void);
-+extern int gr_process_suid_exec_ban(const struct linux_binprm *bprm);
-+
- #include "read_write.h"
-
- /*
-@@ -133,8 +136,8 @@ asmlinkage long compat_sys_utimes(char __user *filename, struct compat_timeval _
- static int cp_compat_stat(struct kstat *stat, struct compat_stat __user *ubuf)
- {
- compat_ino_t ino = stat->ino;
-- typeof(ubuf->st_uid) uid = 0;
-- typeof(ubuf->st_gid) gid = 0;
-+ typeof(((struct compat_stat *)0)->st_uid) uid = 0;
-+ typeof(((struct compat_stat *)0)->st_gid) gid = 0;
- int err;
-
- SET_UID(uid, stat->uid);
-@@ -533,7 +536,7 @@ compat_sys_io_setup(unsigned nr_reqs, u32 __user *ctx32p)
-
- set_fs(KERNEL_DS);
- /* The __user pointer cast is valid because of the set_fs() */
-- ret = sys_io_setup(nr_reqs, (aio_context_t __user *) &ctx64);
-+ ret = sys_io_setup(nr_reqs, (aio_context_t __force_user *) &ctx64);
- set_fs(oldfs);
- /* truncating is ok because it's a user address */
- if (!ret)
-@@ -830,6 +833,7 @@ struct compat_old_linux_dirent {
-
- struct compat_readdir_callback {
- struct compat_old_linux_dirent __user *dirent;
-+ struct file * file;
- int result;
- };
-
-@@ -847,6 +851,10 @@ static int compat_fillonedir(void *__buf, const char *name, int namlen,
- buf->result = -EOVERFLOW;
- return -EOVERFLOW;
- }
-+
-+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
-+ return 0;
-+
- buf->result++;
- dirent = buf->dirent;
- if (!access_ok(VERIFY_WRITE, dirent,
-@@ -879,6 +887,7 @@ asmlinkage long compat_sys_old_readdir(unsigned int fd,
-
- buf.result = 0;
- buf.dirent = dirent;
-+ buf.file = file;
-
- error = vfs_readdir(file, compat_fillonedir, &buf);
- if (buf.result)
-@@ -899,6 +908,7 @@ struct compat_linux_dirent {
- struct compat_getdents_callback {
- struct compat_linux_dirent __user *current_dir;
- struct compat_linux_dirent __user *previous;
-+ struct file * file;
- int count;
- int error;
- };
-@@ -919,6 +929,10 @@ static int compat_filldir(void *__buf, const char *name, int namlen,
- buf->error = -EOVERFLOW;
- return -EOVERFLOW;
- }
-+
-+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
-+ return 0;
-+
- dirent = buf->previous;
- if (dirent) {
- if (__put_user(offset, &dirent->d_off))
-@@ -966,6 +980,7 @@ asmlinkage long compat_sys_getdents(unsigned int fd,
- buf.previous = NULL;
- buf.count = count;
- buf.error = 0;
-+ buf.file = file;
-
- error = vfs_readdir(file, compat_filldir, &buf);
- if (error >= 0)
-@@ -987,6 +1002,7 @@ out:
- struct compat_getdents_callback64 {
- struct linux_dirent64 __user *current_dir;
- struct linux_dirent64 __user *previous;
-+ struct file * file;
- int count;
- int error;
- };
-@@ -1003,6 +1019,10 @@ static int compat_filldir64(void * __buf, const char * name, int namlen, loff_t
- buf->error = -EINVAL; /* only used if we fail.. */
- if (reclen > buf->count)
- return -EINVAL;
-+
-+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
-+ return 0;
-+
- dirent = buf->previous;
-
- if (dirent) {
-@@ -1054,13 +1074,14 @@ asmlinkage long compat_sys_getdents64(unsigned int fd,
- buf.previous = NULL;
- buf.count = count;
- buf.error = 0;
-+ buf.file = file;
-
- error = vfs_readdir(file, compat_filldir64, &buf);
- if (error >= 0)
- error = buf.error;
- lastdirent = buf.previous;
- if (lastdirent) {
-- typeof(lastdirent->d_off) d_off = file->f_pos;
-+ typeof(((struct linux_dirent64 *)0)->d_off) d_off = file->f_pos;
- if (__put_user_unaligned(d_off, &lastdirent->d_off))
- error = -EFAULT;
- else
-@@ -1098,7 +1119,7 @@ static ssize_t compat_do_readv_writev(int type, struct file *file,
- * verify all the pointers
- */
- ret = -EINVAL;
-- if ((nr_segs > UIO_MAXIOV) || (nr_segs <= 0))
-+ if (nr_segs > UIO_MAXIOV)
- goto out;
- if (!file->f_op)
- goto out;
-@@ -1460,6 +1481,9 @@ out:
- return ret;
- }
-
-+extern void gr_handle_exec_args_compat(struct linux_binprm *bprm,
-+ compat_uptr_t __user *argv);
-+
- /*
- * compat_do_execve() is mostly a copy of do_execve(), with the exception
- * that it processes 32 bit argv and envp pointers.
-@@ -1469,11 +1493,35 @@ int compat_do_execve(char * filename,
- compat_uptr_t __user *envp,
- struct pt_regs * regs)
- {
-+#ifdef CONFIG_GRKERNSEC
-+ struct file *old_exec_file;
-+ struct acl_subject_label *old_acl;
-+ struct rlimit old_rlim[RLIM_NLIMITS];
-+#endif
- struct linux_binprm *bprm;
- struct file *file;
- struct files_struct *displaced;
- bool clear_in_exec;
- int retval;
-+ const struct cred *cred = current_cred();
-+
-+ /*
-+ * We move the actual failure in case of RLIMIT_NPROC excess from
-+ * set*uid() to execve() because too many poorly written programs
-+ * don't check setuid() return code. Here we additionally recheck
-+ * whether NPROC limit is still exceeded.
-+ */
-+ gr_learn_resource(current, RLIMIT_NPROC, atomic_read(¤t->cred->user->processes), 1);
-+
-+ if ((current->flags & PF_NPROC_EXCEEDED) &&
-+ atomic_read(&cred->user->processes) > current->signal->rlim[RLIMIT_NPROC].rlim_cur) {
-+ retval = -EAGAIN;
-+ goto out_ret;
-+ }
-+
-+ /* We're below the limit (still or again), so we don't want to make
-+ * further execve() calls fail. */
-+ current->flags &= ~PF_NPROC_EXCEEDED;
-
- retval = unshare_files(&displaced);
- if (retval)
-@@ -1499,12 +1547,21 @@ int compat_do_execve(char * filename,
- if (IS_ERR(file))
- goto out_unmark;
-
-+ if (gr_ptrace_readexec(file, bprm->unsafe)) {
-+ retval = -EPERM;
-+ goto out_file;
-+ }
-+
- sched_exec();
-
- bprm->file = file;
- bprm->filename = filename;
- bprm->interp = filename;
-
-+ retval = -EACCES;
-+ if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt))
-+ goto out_file;
-+
- retval = bprm_mm_init(bprm);
- if (retval)
- goto out_file;
-@@ -1521,24 +1578,68 @@ int compat_do_execve(char * filename,
- if (retval < 0)
- goto out;
-
-+#ifdef CONFIG_GRKERNSEC
-+ old_acl = current->acl;
-+ memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
-+ old_exec_file = current->exec_file;
-+ get_file(file);
-+ current->exec_file = file;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ /* limit suid stack to 8MB
-+ we saved the old limits above and will restore them if this exec fails
-+ */
-+ if ((bprm->cred->euid != current_euid()) || (bprm->cred->egid != current_egid()))
-+ current->signal->rlim[RLIMIT_STACK].rlim_cur = 8 * 1024 * 1024;
-+#endif
-+
-+ if (gr_process_kernel_exec_ban() || gr_process_suid_exec_ban(bprm)) {
-+ retval = -EPERM;
-+ goto out_fail;
-+ }
-+
-+ if (!gr_tpe_allow(file)) {
-+ retval = -EACCES;
-+ goto out_fail;
-+ }
-+
-+ if (gr_check_crash_exec(file)) {
-+ retval = -EACCES;
-+ goto out_fail;
-+ }
-+
-+ retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
-+ bprm->unsafe);
-+ if (retval < 0)
-+ goto out_fail;
-+
- retval = copy_strings_kernel(1, &bprm->filename, bprm);
- if (retval < 0)
-- goto out;
-+ goto out_fail;
-
- bprm->exec = bprm->p;
- retval = compat_copy_strings(bprm->envc, envp, bprm);
- if (retval < 0)
-- goto out;
-+ goto out_fail;
-
- retval = compat_copy_strings(bprm->argc, argv, bprm);
- if (retval < 0)
-- goto out;
-+ goto out_fail;
-+
-+ gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
-+
-+ gr_handle_exec_args_compat(bprm, argv);
-
- retval = search_binary_handler(bprm, regs);
- if (retval < 0)
-- goto out;
-+ goto out_fail;
-+#ifdef CONFIG_GRKERNSEC
-+ if (old_exec_file)
-+ fput(old_exec_file);
-+#endif
-
- /* execve succeeded */
-+ increment_exec_counter();
- current->fs->in_exec = 0;
- current->in_execve = 0;
- acct_update_integrals(current);
-@@ -1547,6 +1648,14 @@ int compat_do_execve(char * filename,
- put_files_struct(displaced);
- return retval;
-
-+out_fail:
-+#ifdef CONFIG_GRKERNSEC
-+ current->acl = old_acl;
-+ memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
-+ fput(current->exec_file);
-+ current->exec_file = old_exec_file;
-+#endif
-+
- out:
- if (bprm->mm) {
- acct_arg_size(bprm, 0);
-@@ -1717,6 +1826,8 @@ int compat_core_sys_select(int n, compat_ulong_t __user *inp,
- struct fdtable *fdt;
- long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
-
-+ pax_track_stack();
-+
- if (n < 0)
- goto out_nofds;
-
-@@ -2157,7 +2268,7 @@ asmlinkage long compat_sys_nfsservctl(int cmd,
- oldfs = get_fs();
- set_fs(KERNEL_DS);
- /* The __user pointer casts are valid because of the set_fs() */
-- err = sys_nfsservctl(cmd, (void __user *) karg, (void __user *) kres);
-+ err = sys_nfsservctl(cmd, (void __force_user *) karg, (void __force_user *) kres);
- set_fs(oldfs);
-
- if (err)
-diff --git a/fs/compat_binfmt_elf.c b/fs/compat_binfmt_elf.c
-index 0adced2..bbb1b0d 100644
---- a/fs/compat_binfmt_elf.c
-+++ b/fs/compat_binfmt_elf.c
-@@ -29,10 +29,12 @@
- #undef elfhdr
- #undef elf_phdr
- #undef elf_note
-+#undef elf_dyn
- #undef elf_addr_t
- #define elfhdr elf32_hdr
- #define elf_phdr elf32_phdr
- #define elf_note elf32_note
-+#define elf_dyn Elf32_Dyn
- #define elf_addr_t Elf32_Addr
-
- /*
-diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
-index 98d3c58..cca44ae 100644
---- a/fs/compat_ioctl.c
-+++ b/fs/compat_ioctl.c
-@@ -1516,7 +1516,7 @@ static int serial_struct_ioctl(unsigned fd, unsigned cmd, unsigned long arg)
- return -EFAULT;
- if (__get_user(udata, &ss32->iomem_base))
- return -EFAULT;
-- ss.iomem_base = compat_ptr(udata);
-+ ss.iomem_base = (unsigned char __force_kernel *)compat_ptr(udata);
- if (__get_user(ss.iomem_reg_shift, &ss32->iomem_reg_shift) ||
- __get_user(ss.port_high, &ss32->port_high))
- return -EFAULT;
-@@ -1812,7 +1812,7 @@ static int compat_ioctl_preallocate(struct file *file, unsigned long arg)
- copy_in_user(&p->l_len, &p32->l_len, sizeof(s64)) ||
- copy_in_user(&p->l_sysid, &p32->l_sysid, sizeof(s32)) ||
- copy_in_user(&p->l_pid, &p32->l_pid, sizeof(u32)) ||
-- copy_in_user(&p->l_pad, &p32->l_pad, 4*sizeof(u32)))
-+ copy_in_user(p->l_pad, &p32->l_pad, 4*sizeof(u32)))
- return -EFAULT;
-
- return ioctl_preallocate(file, p);
-diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
-index 8e48b52..2c592f8 100644
---- a/fs/configfs/dir.c
-+++ b/fs/configfs/dir.c
-@@ -1044,10 +1044,11 @@ static int configfs_dump(struct configfs_dirent *sd, int level)
- static int configfs_depend_prep(struct dentry *origin,
- struct config_item *target)
- {
-- struct configfs_dirent *child_sd, *sd = origin->d_fsdata;
-+ struct configfs_dirent *child_sd, *sd;
- int ret = 0;
-
-- BUG_ON(!origin || !sd);
-+ BUG_ON(!origin || !origin->d_fsdata);
-+ sd = origin->d_fsdata;
-
- if (sd->s_element == target) /* Boo-yah */
- goto out;
-@@ -1572,7 +1573,8 @@ static int configfs_readdir(struct file * filp, void * dirent, filldir_t filldir
- }
- for (p=q->next; p!= &parent_sd->s_children; p=p->next) {
- struct configfs_dirent *next;
-- const char * name;
-+ const unsigned char * name;
-+ char d_name[sizeof(next->s_dentry->d_iname)];
- int len;
-
- next = list_entry(p, struct configfs_dirent,
-@@ -1581,7 +1583,12 @@ static int configfs_readdir(struct file * filp, void * dirent, filldir_t filldir
- continue;
-
- name = configfs_get_name(next);
-- len = strlen(name);
-+ if (next->s_dentry && name == next->s_dentry->d_iname) {
-+ len = next->s_dentry->d_name.len;
-+ memcpy(d_name, name, len);
-+ name = d_name;
-+ } else
-+ len = strlen(name);
- if (next->s_dentry)
- ino = next->s_dentry->d_inode->i_ino;
- else
-diff --git a/fs/dcache.c b/fs/dcache.c
-index 44c0aea..a663f95 100644
---- a/fs/dcache.c
-+++ b/fs/dcache.c
-@@ -45,8 +45,6 @@ EXPORT_SYMBOL(dcache_lock);
-
- static struct kmem_cache *dentry_cache __read_mostly;
-
--#define DNAME_INLINE_LEN (sizeof(struct dentry)-offsetof(struct dentry,d_iname))
--
- /*
- * This is the single most critical data structure when it comes
- * to the dcache: the hashtable for lookups. Somebody should try
-@@ -1108,11 +1106,11 @@ struct dentry * d_alloc_root(struct inode * root_inode)
- return res;
- }
-
--static inline struct hlist_head *d_hash(struct dentry *parent,
-- unsigned long hash)
-+static inline struct hlist_head *d_hash(const struct dentry *parent,
-+ unsigned int hash)
- {
-- hash += ((unsigned long) parent ^ GOLDEN_RATIO_PRIME) / L1_CACHE_BYTES;
-- hash = hash ^ ((hash ^ GOLDEN_RATIO_PRIME) >> D_HASHBITS);
-+ hash += (unsigned long) parent / L1_CACHE_BYTES;
-+ hash = hash + (hash >> D_HASHBITS);
- return dentry_hashtable + (hash & D_HASHMASK);
- }
-
-@@ -2319,7 +2317,7 @@ void __init vfs_caches_init(unsigned long mempages)
- mempages -= reserve;
-
- names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
-- SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
-+ SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_USERCOPY, NULL);
-
- dcache_init();
- inode_init();
-diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
-index 39c6ee8..dcee0f1 100644
---- a/fs/debugfs/inode.c
-+++ b/fs/debugfs/inode.c
-@@ -269,7 +269,11 @@ EXPORT_SYMBOL_GPL(debugfs_create_file);
- struct dentry *debugfs_create_dir(const char *name, struct dentry *parent)
- {
- return debugfs_create_file(name,
-+#ifdef CONFIG_GRKERNSEC_SYSFS_RESTRICT
-+ S_IFDIR | S_IRWXU,
-+#else
- S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO,
-+#endif
- parent, NULL, NULL);
- }
- EXPORT_SYMBOL_GPL(debugfs_create_dir);
-diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c
-index c010ecf..a8d8c59 100644
---- a/fs/dlm/lockspace.c
-+++ b/fs/dlm/lockspace.c
-@@ -148,7 +148,7 @@ static void lockspace_kobj_release(struct kobject *k)
- kfree(ls);
- }
-
--static struct sysfs_ops dlm_attr_ops = {
-+static const struct sysfs_ops dlm_attr_ops = {
- .show = dlm_attr_show,
- .store = dlm_attr_store,
- };
-diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
-index 7e164bb..62fa913 100644
---- a/fs/ecryptfs/crypto.c
-+++ b/fs/ecryptfs/crypto.c
-@@ -418,17 +418,6 @@ static int ecryptfs_encrypt_extent(struct page *enc_extent_page,
- rc);
- goto out;
- }
-- if (unlikely(ecryptfs_verbosity > 0)) {
-- ecryptfs_printk(KERN_DEBUG, "Encrypting extent "
-- "with iv:\n");
-- ecryptfs_dump_hex(extent_iv, crypt_stat->iv_bytes);
-- ecryptfs_printk(KERN_DEBUG, "First 8 bytes before "
-- "encryption:\n");
-- ecryptfs_dump_hex((char *)
-- (page_address(page)
-- + (extent_offset * crypt_stat->extent_size)),
-- 8);
-- }
- rc = ecryptfs_encrypt_page_offset(crypt_stat, enc_extent_page, 0,
- page, (extent_offset
- * crypt_stat->extent_size),
-@@ -441,14 +430,6 @@ static int ecryptfs_encrypt_extent(struct page *enc_extent_page,
- goto out;
- }
- rc = 0;
-- if (unlikely(ecryptfs_verbosity > 0)) {
-- ecryptfs_printk(KERN_DEBUG, "Encrypt extent [0x%.16x]; "
-- "rc = [%d]\n", (extent_base + extent_offset),
-- rc);
-- ecryptfs_printk(KERN_DEBUG, "First 8 bytes after "
-- "encryption:\n");
-- ecryptfs_dump_hex((char *)(page_address(enc_extent_page)), 8);
-- }
- out:
- return rc;
- }
-@@ -545,17 +526,6 @@ static int ecryptfs_decrypt_extent(struct page *page,
- rc);
- goto out;
- }
-- if (unlikely(ecryptfs_verbosity > 0)) {
-- ecryptfs_printk(KERN_DEBUG, "Decrypting extent "
-- "with iv:\n");
-- ecryptfs_dump_hex(extent_iv, crypt_stat->iv_bytes);
-- ecryptfs_printk(KERN_DEBUG, "First 8 bytes before "
-- "decryption:\n");
-- ecryptfs_dump_hex((char *)
-- (page_address(enc_extent_page)
-- + (extent_offset * crypt_stat->extent_size)),
-- 8);
-- }
- rc = ecryptfs_decrypt_page_offset(crypt_stat, page,
- (extent_offset
- * crypt_stat->extent_size),
-@@ -569,16 +539,6 @@ static int ecryptfs_decrypt_extent(struct page *page,
- goto out;
- }
- rc = 0;
-- if (unlikely(ecryptfs_verbosity > 0)) {
-- ecryptfs_printk(KERN_DEBUG, "Decrypt extent [0x%.16x]; "
-- "rc = [%d]\n", (extent_base + extent_offset),
-- rc);
-- ecryptfs_printk(KERN_DEBUG, "First 8 bytes after "
-- "decryption:\n");
-- ecryptfs_dump_hex((char *)(page_address(page)
-- + (extent_offset
-- * crypt_stat->extent_size)), 8);
-- }
- out:
- return rc;
- }
-diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
-index 502b09f..49129f4 100644
---- a/fs/ecryptfs/file.c
-+++ b/fs/ecryptfs/file.c
-@@ -348,7 +348,6 @@ const struct file_operations ecryptfs_main_fops = {
- #ifdef CONFIG_COMPAT
- .compat_ioctl = ecryptfs_compat_ioctl,
- #endif
-- .mmap = generic_file_mmap,
- .open = ecryptfs_open,
- .flush = ecryptfs_flush,
- .release = ecryptfs_release,
-diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
-index 3c1dbc0..250e1b4 100644
---- a/fs/ecryptfs/inode.c
-+++ b/fs/ecryptfs/inode.c
-@@ -647,7 +647,7 @@ static int ecryptfs_readlink_lower(struct dentry *dentry, char **buf,
- old_fs = get_fs();
- set_fs(get_ds());
- rc = lower_dentry->d_inode->i_op->readlink(lower_dentry,
-- (char __user *)lower_buf,
-+ (char __force_user *)lower_buf,
- lower_bufsiz);
- set_fs(old_fs);
- if (rc < 0)
-@@ -693,7 +693,7 @@ static void *ecryptfs_follow_link(struct dentry *dentry, struct nameidata *nd)
- }
- old_fs = get_fs();
- set_fs(get_ds());
-- rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
-+ rc = dentry->d_inode->i_op->readlink(dentry, (__force char __user *)buf, len);
- set_fs(old_fs);
- if (rc < 0)
- goto out_free;
-diff --git a/fs/eventpoll.c b/fs/eventpoll.c
-index 83fbd64..8353dce 100644
---- a/fs/eventpoll.c
-+++ b/fs/eventpoll.c
-@@ -1508,8 +1508,8 @@ SYSCALL_DEFINE1(epoll_create1, int, flags)
- error = PTR_ERR(file);
- goto out_free_fd;
- }
-- fd_install(fd, file);
- ep->file = file;
-+ fd_install(fd, file);
- return fd;
-
- out_free_fd:
-diff --git a/fs/exec.c b/fs/exec.c
-index feb2435..0d2ad2b 100644
---- a/fs/exec.c
-+++ b/fs/exec.c
-@@ -56,12 +56,34 @@
- #include <linux/fsnotify.h>
- #include <linux/fs_struct.h>
- #include <linux/pipe_fs_i.h>
-+#include <linux/random.h>
-+#include <linux/seq_file.h>
-+#include <linux/mman.h>
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#include <linux/kallsyms.h>
-+#include <linux/kdebug.h>
-+#endif
-+
-+#include <trace/events/fs.h>
-
- #include <asm/uaccess.h>
- #include <asm/mmu_context.h>
- #include <asm/tlb.h>
- #include "internal.h"
-
-+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
-+void __weak pax_set_initial_flags(struct linux_binprm *bprm)
-+{
-+ printk_once(KERN_WARNING "PAX: PAX_HAVE_ACL_FLAGS was enabled without providing the pax_set_initial_flags callback, this is probably not what you wanted.\n");
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_HOOK_ACL_FLAGS
-+void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
-+EXPORT_SYMBOL(pax_set_initial_flags_func);
-+#endif
-+
- int core_uses_pid;
- char core_pattern[CORENAME_MAX_SIZE] = "core";
- unsigned int core_pipe_limit;
-@@ -72,6 +94,9 @@ int suid_dumpable = 0;
- static LIST_HEAD(formats);
- static DEFINE_RWLOCK(binfmt_lock);
-
-+extern int gr_process_kernel_exec_ban(void);
-+extern int gr_process_suid_exec_ban(const struct linux_binprm *bprm);
-+
- int __register_binfmt(struct linux_binfmt * fmt, int insert)
- {
- if (!fmt)
-@@ -178,18 +203,10 @@ struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
- int write)
- {
- struct page *page;
-- int ret;
-
--#ifdef CONFIG_STACK_GROWSUP
-- if (write) {
-- ret = expand_stack_downwards(bprm->vma, pos);
-- if (ret < 0)
-- return NULL;
-- }
--#endif
-- ret = get_user_pages(current, bprm->mm, pos,
-- 1, write, 1, &page, NULL);
-- if (ret <= 0)
-+ if (0 > expand_stack_downwards(bprm->vma, pos))
-+ return NULL;
-+ if (0 >= get_user_pages(current, bprm->mm, pos, 1, write, 1, &page, NULL))
- return NULL;
-
- if (write) {
-@@ -205,6 +222,17 @@ struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
- if (size <= ARG_MAX)
- return page;
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ // only allow 512KB for argv+env on suid/sgid binaries
-+ // to prevent easy ASLR exhaustion
-+ if (((bprm->cred->euid != current_euid()) ||
-+ (bprm->cred->egid != current_egid())) &&
-+ (size > (512 * 1024))) {
-+ put_page(page);
-+ return NULL;
-+ }
-+#endif
-+
- /*
- * Limit to 1/4-th the stack size for the argv+env strings.
- * This ensures that:
-@@ -263,6 +291,11 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
- vma->vm_end = STACK_TOP_MAX;
- vma->vm_start = vma->vm_end - PAGE_SIZE;
- vma->vm_flags = VM_STACK_FLAGS;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ vma->vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
-+#endif
-+
- vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
-
- err = security_file_mmap(NULL, 0, 0, 0, vma->vm_start, 1);
-@@ -276,6 +309,12 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
- mm->stack_vm = mm->total_vm = 1;
- up_write(&mm->mmap_sem);
- bprm->p = vma->vm_end - sizeof(void *);
-+
-+#ifdef CONFIG_PAX_RANDUSTACK
-+ if (randomize_va_space)
-+ bprm->p ^= random32() & ~PAGE_MASK;
-+#endif
-+
- return 0;
- err:
- up_write(&mm->mmap_sem);
-@@ -400,8 +439,9 @@ static int count(char __user * __user * argv, int max)
- if (!p)
- break;
- argv++;
-- if (i++ >= max)
-+ if (i >= max)
- return -E2BIG;
-+ ++i;
-
- if (fatal_signal_pending(current))
- return -ERESTARTNOHAND;
-@@ -510,7 +550,7 @@ int copy_strings_kernel(int argc,char ** argv, struct linux_binprm *bprm)
- int r;
- mm_segment_t oldfs = get_fs();
- set_fs(KERNEL_DS);
-- r = copy_strings(argc, (char __user * __user *)argv, bprm);
-+ r = copy_strings(argc, (__force char __user * __user *)argv, bprm);
- set_fs(oldfs);
- return r;
- }
-@@ -540,7 +580,8 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
- unsigned long new_end = old_end - shift;
- struct mmu_gather *tlb;
-
-- BUG_ON(new_start > new_end);
-+ if (new_start >= new_end || new_start < mmap_min_addr)
-+ return -ENOMEM;
-
- /*
- * ensure there are no vmas between where we want to go
-@@ -549,6 +590,10 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
- if (vma != find_vma(mm, new_start))
- return -EFAULT;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ BUG_ON(pax_find_mirror_vma(vma));
-+#endif
-+
- /*
- * cover the whole range: [new_start, old_end)
- */
-@@ -630,10 +675,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
- stack_top = arch_align_stack(stack_top);
- stack_top = PAGE_ALIGN(stack_top);
-
-- if (unlikely(stack_top < mmap_min_addr) ||
-- unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr))
-- return -ENOMEM;
--
- stack_shift = vma->vm_end - stack_top;
-
- bprm->p -= stack_shift;
-@@ -645,6 +686,14 @@ int setup_arg_pages(struct linux_binprm *bprm,
- bprm->exec -= stack_shift;
-
- down_write(&mm->mmap_sem);
-+
-+ /* Move stack pages down in memory. */
-+ if (stack_shift) {
-+ ret = shift_arg_pages(vma, stack_shift);
-+ if (ret)
-+ goto out_unlock;
-+ }
-+
- vm_flags = VM_STACK_FLAGS;
-
- /*
-@@ -658,19 +707,24 @@ int setup_arg_pages(struct linux_binprm *bprm,
- vm_flags &= ~VM_EXEC;
- vm_flags |= mm->def_flags;
-
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+ if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+ vm_flags &= ~VM_EXEC;
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (mm->pax_flags & MF_PAX_MPROTECT)
-+ vm_flags &= ~VM_MAYEXEC;
-+#endif
-+
-+ }
-+#endif
-+
- ret = mprotect_fixup(vma, &prev, vma->vm_start, vma->vm_end,
- vm_flags);
- if (ret)
- goto out_unlock;
- BUG_ON(prev != vma);
-
-- /* Move stack pages down in memory. */
-- if (stack_shift) {
-- ret = shift_arg_pages(vma, stack_shift);
-- if (ret)
-- goto out_unlock;
-- }
--
- stack_expand = EXTRA_STACK_VM_PAGES * PAGE_SIZE;
- stack_size = vma->vm_end - vma->vm_start;
- /*
-@@ -690,6 +744,27 @@ int setup_arg_pages(struct linux_binprm *bprm,
- stack_base = vma->vm_start - stack_expand;
- #endif
- ret = expand_stack(vma, stack_base);
-+
-+#if !defined(CONFIG_STACK_GROWSUP) && defined(CONFIG_PAX_RANDMMAP)
-+ if (!ret && (mm->pax_flags & MF_PAX_RANDMMAP) && STACK_TOP <= 0xFFFFFFFFU && STACK_TOP > vma->vm_end) {
-+ unsigned long size, flags, vm_flags;
-+
-+ size = STACK_TOP - vma->vm_end;
-+ flags = MAP_FIXED | MAP_PRIVATE;
-+ vm_flags = VM_DONTEXPAND | VM_RESERVED;
-+
-+ ret = vma->vm_end != mmap_region(NULL, vma->vm_end, size, flags, vm_flags, 0);
-+
-+#ifdef CONFIG_X86
-+ if (!ret) {
-+ size = mmap_min_addr + ((mm->delta_mmap ^ mm->delta_stack) & (0xFFUL << PAGE_SHIFT));
-+ ret = 0 != mmap_region(NULL, 0, PAGE_ALIGN(size), flags, vm_flags, 0);
-+ }
-+#endif
-+
-+ }
-+#endif
-+
- if (ret)
- ret = -EFAULT;
-
-@@ -721,6 +796,8 @@ struct file *open_exec(const char *name)
-
- fsnotify_open(file->f_path.dentry);
-
-+ trace_open_exec(name);
-+
- err = deny_write_access(file);
- if (err)
- goto exit;
-@@ -744,7 +821,7 @@ int kernel_read(struct file *file, loff_t offset,
- old_fs = get_fs();
- set_fs(get_ds());
- /* The cast to a user pointer is valid due to the set_fs() */
-- result = vfs_read(file, (void __user *)addr, count, &pos);
-+ result = vfs_read(file, (void __force_user *)addr, count, &pos);
- set_fs(old_fs);
- return result;
- }
-@@ -985,6 +1062,21 @@ void set_task_comm(struct task_struct *tsk, char *buf)
- perf_event_comm(tsk);
- }
-
-+static void filename_to_taskname(char *tcomm, const char *fn, unsigned int len)
-+{
-+ int i, ch;
-+
-+ /* Copies the binary name from after last slash */
-+ for (i = 0; (ch = *(fn++)) != '\0';) {
-+ if (ch == '/')
-+ i = 0; /* overwrite what we wrote */
-+ else
-+ if (i < len - 1)
-+ tcomm[i++] = ch;
-+ }
-+ tcomm[i] = '\0';
-+}
-+
- int flush_old_exec(struct linux_binprm * bprm)
- {
- int retval;
-@@ -999,6 +1091,7 @@ int flush_old_exec(struct linux_binprm * bprm)
-
- set_mm_exe_file(bprm->mm, bprm->file);
-
-+ filename_to_taskname(bprm->tcomm, bprm->filename, sizeof(bprm->tcomm));
- /*
- * Release all of the old mmap stuff
- */
-@@ -1023,10 +1116,6 @@ EXPORT_SYMBOL(flush_old_exec);
-
- void setup_new_exec(struct linux_binprm * bprm)
- {
-- int i, ch;
-- char * name;
-- char tcomm[sizeof(current->comm)];
--
- arch_pick_mmap_layout(current->mm);
-
- /* This is the point of no return */
-@@ -1037,18 +1126,7 @@ void setup_new_exec(struct linux_binprm * bprm)
- else
- set_dumpable(current->mm, suid_dumpable);
-
-- name = bprm->filename;
--
-- /* Copies the binary name from after last slash */
-- for (i=0; (ch = *(name++)) != '\0';) {
-- if (ch == '/')
-- i = 0; /* overwrite what we wrote */
-- else
-- if (i < (sizeof(tcomm) - 1))
-- tcomm[i++] = ch;
-- }
-- tcomm[i] = '\0';
-- set_task_comm(current, tcomm);
-+ set_task_comm(current, bprm->tcomm);
-
- /* Set the new mm task size. We have to do that late because it may
- * depend on TIF_32BIT which is only updated in flush_thread() on
-@@ -1065,13 +1143,6 @@ void setup_new_exec(struct linux_binprm * bprm)
- set_dumpable(current->mm, suid_dumpable);
- }
-
-- /*
-- * Flush performance counters when crossing a
-- * security domain:
-- */
-- if (!get_dumpable(current->mm))
-- perf_event_exit_task(current);
--
- /* An exec changes our domain. We are no longer part of the thread
- group */
-
-@@ -1090,14 +1161,14 @@ EXPORT_SYMBOL(setup_new_exec);
- */
- int prepare_bprm_creds(struct linux_binprm *bprm)
- {
-- if (mutex_lock_interruptible(¤t->cred_guard_mutex))
-+ if (mutex_lock_interruptible(¤t->signal->cred_guard_mutex))
- return -ERESTARTNOINTR;
-
- bprm->cred = prepare_exec_creds();
- if (likely(bprm->cred))
- return 0;
-
-- mutex_unlock(¤t->cred_guard_mutex);
-+ mutex_unlock(¤t->signal->cred_guard_mutex);
- return -ENOMEM;
- }
-
-@@ -1105,7 +1176,7 @@ void free_bprm(struct linux_binprm *bprm)
- {
- free_arg_pages(bprm);
- if (bprm->cred) {
-- mutex_unlock(¤t->cred_guard_mutex);
-+ mutex_unlock(¤t->signal->cred_guard_mutex);
- abort_creds(bprm->cred);
- }
- /* If a binfmt changed the interp, free it. */
-@@ -1135,19 +1206,28 @@ void install_exec_creds(struct linux_binprm *bprm)
-
- commit_creds(bprm->cred);
- bprm->cred = NULL;
-+
-+ /*
-+ * Disable monitoring for regular users
-+ * when executing setuid binaries. Must
-+ * wait until new credentials are committed
-+ * by commit_creds() above
-+ */
-+ if (get_dumpable(current->mm) != SUID_DUMP_USER)
-+ perf_event_exit_task(current);
- /*
- * cred_guard_mutex must be held at least to this point to prevent
- * ptrace_attach() from altering our determination of the task's
- * credentials; any time after this it may be unlocked.
- */
- security_bprm_committed_creds(bprm);
-- mutex_unlock(¤t->cred_guard_mutex);
-+ mutex_unlock(¤t->signal->cred_guard_mutex);
- }
- EXPORT_SYMBOL(install_exec_creds);
-
- /*
- * determine how safe it is to execute the proposed program
-- * - the caller must hold current->cred_guard_mutex to protect against
-+ * - the caller must hold ->cred_guard_mutex to protect against
- * PTRACE_ATTACH
- */
- int check_unsafe_exec(struct linux_binprm *bprm)
-@@ -1167,7 +1247,7 @@ int check_unsafe_exec(struct linux_binprm *bprm)
- }
- rcu_read_unlock();
-
-- if (p->fs->users > n_fs) {
-+ if (atomic_read(&p->fs->users) > n_fs) {
- bprm->unsafe |= LSM_UNSAFE_SHARE;
- } else {
- res = -EAGAIN;
-@@ -1354,6 +1434,21 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
-
- EXPORT_SYMBOL(search_binary_handler);
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+DEFINE_PER_CPU(u64, exec_counter);
-+static int __init init_exec_counters(void)
-+{
-+ unsigned int cpu;
-+
-+ for_each_possible_cpu(cpu) {
-+ per_cpu(exec_counter, cpu) = (u64)cpu;
-+ }
-+
-+ return 0;
-+}
-+early_initcall(init_exec_counters);
-+#endif
-+
- /*
- * sys_execve() executes a new program.
- */
-@@ -1362,11 +1457,35 @@ int do_execve(char * filename,
- char __user *__user *envp,
- struct pt_regs * regs)
- {
-+#ifdef CONFIG_GRKERNSEC
-+ struct file *old_exec_file;
-+ struct acl_subject_label *old_acl;
-+ struct rlimit old_rlim[RLIM_NLIMITS];
-+#endif
- struct linux_binprm *bprm;
- struct file *file;
- struct files_struct *displaced;
- bool clear_in_exec;
- int retval;
-+ const struct cred *cred = current_cred();
-+
-+ /*
-+ * We move the actual failure in case of RLIMIT_NPROC excess from
-+ * set*uid() to execve() because too many poorly written programs
-+ * don't check setuid() return code. Here we additionally recheck
-+ * whether NPROC limit is still exceeded.
-+ */
-+ gr_learn_resource(current, RLIMIT_NPROC, atomic_read(¤t->cred->user->processes), 1);
-+
-+ if ((current->flags & PF_NPROC_EXCEEDED) &&
-+ atomic_read(&cred->user->processes) > current->signal->rlim[RLIMIT_NPROC].rlim_cur) {
-+ retval = -EAGAIN;
-+ goto out_ret;
-+ }
-+
-+ /* We're below the limit (still or again), so we don't want to make
-+ * further execve() calls fail. */
-+ current->flags &= ~PF_NPROC_EXCEEDED;
-
- retval = unshare_files(&displaced);
- if (retval)
-@@ -1392,12 +1511,22 @@ int do_execve(char * filename,
- if (IS_ERR(file))
- goto out_unmark;
-
-+ if (gr_ptrace_readexec(file, bprm->unsafe)) {
-+ retval = -EPERM;
-+ goto out_file;
-+ }
-+
- sched_exec();
-
- bprm->file = file;
- bprm->filename = filename;
- bprm->interp = filename;
-
-+ if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt)) {
-+ retval = -EACCES;
-+ goto out_file;
-+ }
-+
- retval = bprm_mm_init(bprm);
- if (retval)
- goto out_file;
-@@ -1414,25 +1543,71 @@ int do_execve(char * filename,
- if (retval < 0)
- goto out;
-
-+#ifdef CONFIG_GRKERNSEC
-+ old_acl = current->acl;
-+ memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
-+ old_exec_file = current->exec_file;
-+ get_file(file);
-+ current->exec_file = file;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ /* limit suid stack to 8MB
-+ we saved the old limits above and will restore them if this exec fails
-+ */
-+ if (((bprm->cred->euid != current_euid()) || (bprm->cred->egid != current_egid())) &&
-+ (old_rlim[RLIMIT_STACK].rlim_cur > (8 * 1024 * 1024)))
-+ current->signal->rlim[RLIMIT_STACK].rlim_cur = 8 * 1024 * 1024;
-+#endif
-+
-+ if (gr_process_kernel_exec_ban() || gr_process_suid_exec_ban(bprm)) {
-+ retval = -EPERM;
-+ goto out_fail;
-+ }
-+
-+ if (!gr_tpe_allow(file)) {
-+ retval = -EACCES;
-+ goto out_fail;
-+ }
-+
-+ if (gr_check_crash_exec(file)) {
-+ retval = -EACCES;
-+ goto out_fail;
-+ }
-+
-+ retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
-+ bprm->unsafe);
-+ if (retval < 0)
-+ goto out_fail;
-+
- retval = copy_strings_kernel(1, &bprm->filename, bprm);
- if (retval < 0)
-- goto out;
-+ goto out_fail;
-
- bprm->exec = bprm->p;
- retval = copy_strings(bprm->envc, envp, bprm);
- if (retval < 0)
-- goto out;
-+ goto out_fail;
-
- retval = copy_strings(bprm->argc, argv, bprm);
- if (retval < 0)
-- goto out;
-+ goto out_fail;
-+
-+ gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
-+
-+ gr_handle_exec_args(bprm, (const char __user *const __user *)argv);
-
- current->flags &= ~PF_KTHREAD;
- retval = search_binary_handler(bprm,regs);
- if (retval < 0)
-- goto out;
-+ goto out_fail;
-+#ifdef CONFIG_GRKERNSEC
-+ if (old_exec_file)
-+ fput(old_exec_file);
-+#endif
-
- /* execve succeeded */
-+
-+ increment_exec_counter();
- current->fs->in_exec = 0;
- current->in_execve = 0;
- acct_update_integrals(current);
-@@ -1441,6 +1616,14 @@ int do_execve(char * filename,
- put_files_struct(displaced);
- return retval;
-
-+out_fail:
-+#ifdef CONFIG_GRKERNSEC
-+ current->acl = old_acl;
-+ memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
-+ fput(current->exec_file);
-+ current->exec_file = old_exec_file;
-+#endif
-+
- out:
- if (bprm->mm) {
- acct_arg_size(bprm, 0);
-@@ -1606,6 +1789,251 @@ out:
- return ispipe;
- }
-
-+int pax_check_flags(unsigned long *flags)
-+{
-+ int retval = 0;
-+
-+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_SEGMEXEC)
-+ if (*flags & MF_PAX_SEGMEXEC)
-+ {
-+ *flags &= ~MF_PAX_SEGMEXEC;
-+ retval = -EINVAL;
-+ }
-+#endif
-+
-+ if ((*flags & MF_PAX_PAGEEXEC)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ && (*flags & MF_PAX_SEGMEXEC)
-+#endif
-+
-+ )
-+ {
-+ *flags &= ~MF_PAX_PAGEEXEC;
-+ retval = -EINVAL;
-+ }
-+
-+ if ((*flags & MF_PAX_MPROTECT)
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
-+#endif
-+
-+ )
-+ {
-+ *flags &= ~MF_PAX_MPROTECT;
-+ retval = -EINVAL;
-+ }
-+
-+ if ((*flags & MF_PAX_EMUTRAMP)
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+ && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
-+#endif
-+
-+ )
-+ {
-+ *flags &= ~MF_PAX_EMUTRAMP;
-+ retval = -EINVAL;
-+ }
-+
-+ return retval;
-+}
-+
-+EXPORT_SYMBOL(pax_check_flags);
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+void pax_report_fault(struct pt_regs *regs, void *pc, void *sp)
-+{
-+ struct task_struct *tsk = current;
-+ struct mm_struct *mm = current->mm;
-+ char *buffer_exec = (char *)__get_free_page(GFP_KERNEL);
-+ char *buffer_fault = (char *)__get_free_page(GFP_KERNEL);
-+ char *path_exec = NULL;
-+ char *path_fault = NULL;
-+ unsigned long start = 0UL, end = 0UL, offset = 0UL;
-+
-+ if (buffer_exec && buffer_fault) {
-+ struct vm_area_struct *vma, *vma_exec = NULL, *vma_fault = NULL;
-+
-+ down_read(&mm->mmap_sem);
-+ vma = mm->mmap;
-+ while (vma && (!vma_exec || !vma_fault)) {
-+ if ((vma->vm_flags & VM_EXECUTABLE) && vma->vm_file)
-+ vma_exec = vma;
-+ if (vma->vm_start <= (unsigned long)pc && (unsigned long)pc < vma->vm_end)
-+ vma_fault = vma;
-+ vma = vma->vm_next;
-+ }
-+ if (vma_exec) {
-+ path_exec = d_path(&vma_exec->vm_file->f_path, buffer_exec, PAGE_SIZE);
-+ if (IS_ERR(path_exec))
-+ path_exec = "<path too long>";
-+ else {
-+ path_exec = mangle_path(buffer_exec, path_exec, "\t\n\\");
-+ if (path_exec) {
-+ *path_exec = 0;
-+ path_exec = buffer_exec;
-+ } else
-+ path_exec = "<path too long>";
-+ }
-+ }
-+ if (vma_fault) {
-+ start = vma_fault->vm_start;
-+ end = vma_fault->vm_end;
-+ offset = vma_fault->vm_pgoff << PAGE_SHIFT;
-+ if (vma_fault->vm_file) {
-+ path_fault = d_path(&vma_fault->vm_file->f_path, buffer_fault, PAGE_SIZE);
-+ if (IS_ERR(path_fault))
-+ path_fault = "<path too long>";
-+ else {
-+ path_fault = mangle_path(buffer_fault, path_fault, "\t\n\\");
-+ if (path_fault) {
-+ *path_fault = 0;
-+ path_fault = buffer_fault;
-+ } else
-+ path_fault = "<path too long>";
-+ }
-+ } else
-+ path_fault = "<anonymous mapping>";
-+ }
-+ up_read(&mm->mmap_sem);
-+ }
-+ if (tsk->signal->curr_ip)
-+ printk(KERN_ERR "PAX: From %pI4: execution attempt in: %s, %08lx-%08lx %08lx\n", &tsk->signal->curr_ip, path_fault, start, end, offset);
-+ else
-+ printk(KERN_ERR "PAX: execution attempt in: %s, %08lx-%08lx %08lx\n", path_fault, start, end, offset);
-+ printk(KERN_ERR "PAX: terminating task: %s(%s):%d, uid/euid: %u/%u, "
-+ "PC: %p, SP: %p\n", path_exec, tsk->comm, task_pid_nr(tsk),
-+ task_uid(tsk), task_euid(tsk), pc, sp);
-+ free_page((unsigned long)buffer_exec);
-+ free_page((unsigned long)buffer_fault);
-+ pax_report_insns(regs, pc, sp);
-+ do_coredump(SIGKILL, SIGKILL, regs);
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+void pax_report_refcount_overflow(struct pt_regs *regs)
-+{
-+ if (current->signal->curr_ip)
-+ printk(KERN_ERR "PAX: From %pI4: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
-+ ¤t->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
-+ else
-+ printk(KERN_ERR "PAX: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
-+ current->comm, task_pid_nr(current), current_uid(), current_euid());
-+ print_symbol(KERN_ERR "PAX: refcount overflow occured at: %s\n", instruction_pointer(regs));
-+ show_regs(regs);
-+ force_sig_specific(SIGKILL, current);
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+/* 0: not at all, 1: fully, 2: fully inside frame, -1: partially (implies an error) */
-+static noinline int check_stack_object(const void *obj, unsigned long len)
-+{
-+ const void * const stack = task_stack_page(current);
-+ const void * const stackend = stack + THREAD_SIZE;
-+
-+#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
-+ const void *frame = NULL;
-+ const void *oldframe;
-+#endif
-+
-+ if (obj + len < obj)
-+ return -1;
-+
-+ if (obj + len <= stack || stackend <= obj)
-+ return 0;
-+
-+ if (obj < stack || stackend < obj + len)
-+ return -1;
-+
-+#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
-+ oldframe = __builtin_frame_address(1);
-+ if (oldframe)
-+ frame = __builtin_frame_address(2);
-+ /*
-+ low ----------------------------------------------> high
-+ [saved bp][saved ip][args][local vars][saved bp][saved ip]
-+ ^----------------^
-+ allow copies only within here
-+ */
-+ while (stack <= frame && frame < stackend) {
-+ /* if obj + len extends past the last frame, this
-+ check won't pass and the next frame will be 0,
-+ causing us to bail out and correctly report
-+ the copy as invalid
-+ */
-+ if (obj + len <= frame)
-+ return obj >= oldframe + 2 * sizeof(void *) ? 2 : -1;
-+ oldframe = frame;
-+ frame = *(const void * const *)frame;
-+ }
-+ return -1;
-+#else
-+ return 1;
-+#endif
-+}
-+
-+static __noreturn void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type)
-+{
-+ if (current->signal->curr_ip)
-+ printk(KERN_ERR "PAX: From %pI4: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
-+ ¤t->signal->curr_ip, to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
-+ else
-+ printk(KERN_ERR "PAX: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
-+ to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
-+
-+ dump_stack();
-+ gr_handle_kernel_exploit();
-+ do_group_exit(SIGKILL);
-+}
-+#endif
-+
-+void __check_object_size(const void *ptr, unsigned long n, bool to)
-+{
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+ const char *type;
-+
-+ if (!n)
-+ return;
-+
-+ type = check_heap_object(ptr, n);
-+ if (!type) {
-+ if (check_stack_object(ptr, n) != -1)
-+ return;
-+ type = "<process stack>";
-+ }
-+
-+ pax_report_usercopy(ptr, n, to, type);
-+#endif
-+
-+}
-+EXPORT_SYMBOL(__check_object_size);
-+
-+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
-+void pax_track_stack(void)
-+{
-+ unsigned long sp = (unsigned long)&sp;
-+ if (sp < current_thread_info()->lowest_stack &&
-+ sp > (unsigned long)task_stack_page(current))
-+ current_thread_info()->lowest_stack = sp;
-+}
-+EXPORT_SYMBOL(pax_track_stack);
-+#endif
-+
-+#ifdef CONFIG_PAX_SIZE_OVERFLOW
-+void report_size_overflow(const char *file, unsigned int line, const char *func, const char *ssa_name)
-+{
-+ printk(KERN_ERR "PAX: size overflow detected in function %s %s:%u %s", func, file, line, ssa_name);
-+ dump_stack();
-+ do_group_exit(SIGKILL);
-+}
-+EXPORT_SYMBOL(report_size_overflow);
-+#endif
-+
- static int zap_process(struct task_struct *start)
- {
- struct task_struct *t;
-@@ -1808,17 +2236,17 @@ static void wait_for_dump_helpers(struct file *file)
- pipe = file->f_path.dentry->d_inode->i_pipe;
-
- pipe_lock(pipe);
-- pipe->readers++;
-- pipe->writers--;
-+ atomic_inc(&pipe->readers);
-+ atomic_dec(&pipe->writers);
-
-- while ((pipe->readers > 1) && (!signal_pending(current))) {
-+ while ((atomic_read(&pipe->readers) > 1) && (!signal_pending(current))) {
- wake_up_interruptible_sync(&pipe->wait);
- kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
- pipe_wait(pipe);
- }
-
-- pipe->readers--;
-- pipe->writers++;
-+ atomic_dec(&pipe->readers);
-+ atomic_inc(&pipe->writers);
- pipe_unlock(pipe);
-
- }
-@@ -1841,10 +2269,13 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
- char **helper_argv = NULL;
- int helper_argc = 0;
- int dump_count = 0;
-- static atomic_t core_dump_count = ATOMIC_INIT(0);
-+ static atomic_unchecked_t core_dump_count = ATOMIC_INIT(0);
-
- audit_core_dumps(signr);
-
-+ if (signr == SIGSEGV || signr == SIGBUS || signr == SIGKILL || signr == SIGILL)
-+ gr_handle_brute_attach(mm->flags);
-+
- binfmt = mm->binfmt;
- if (!binfmt || !binfmt->core_dump)
- goto fail;
-@@ -1889,6 +2320,8 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
- */
- clear_thread_flag(TIF_SIGPENDING);
-
-+ gr_learn_resource(current, RLIMIT_CORE, binfmt->min_coredump, 1);
-+
- /*
- * lock_kernel() because format_corename() is controlled by sysctl, which
- * uses lock_kernel()
-@@ -1923,7 +2356,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
- goto fail_unlock;
- }
-
-- dump_count = atomic_inc_return(&core_dump_count);
-+ dump_count = atomic_inc_return_unchecked(&core_dump_count);
- if (core_pipe_limit && (core_pipe_limit < dump_count)) {
- printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
- task_tgid_vnr(current), current->comm);
-@@ -1987,7 +2420,7 @@ close_fail:
- filp_close(file, NULL);
- fail_dropcount:
- if (dump_count)
-- atomic_dec(&core_dump_count);
-+ atomic_dec_unchecked(&core_dump_count);
- fail_unlock:
- if (helper_argv)
- argv_free(helper_argv);
-diff --git a/fs/ext2/balloc.c b/fs/ext2/balloc.c
-index 7f8d2e5..a1abdbb 100644
---- a/fs/ext2/balloc.c
-+++ b/fs/ext2/balloc.c
-@@ -1192,7 +1192,7 @@ static int ext2_has_free_blocks(struct ext2_sb_info *sbi)
-
- free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
- root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
-- if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
-+ if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
- sbi->s_resuid != current_fsuid() &&
- (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
- return 0;
-diff --git a/fs/ext3/balloc.c b/fs/ext3/balloc.c
-index 27967f9..9f2a5fb 100644
---- a/fs/ext3/balloc.c
-+++ b/fs/ext3/balloc.c
-@@ -1421,7 +1421,7 @@ static int ext3_has_free_blocks(struct ext3_sb_info *sbi)
-
- free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
- root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
-- if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
-+ if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
- sbi->s_resuid != current_fsuid() &&
- (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
- return 0;
-diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
-index e85b63c..80398e6 100644
---- a/fs/ext4/balloc.c
-+++ b/fs/ext4/balloc.c
-@@ -570,7 +570,7 @@ int ext4_has_free_blocks(struct ext4_sb_info *sbi, s64 nblocks)
- /* Hm, nope. Are (enough) root reserved blocks available? */
- if (sbi->s_resuid == current_fsuid() ||
- ((sbi->s_resgid != 0) && in_group_p(sbi->s_resgid)) ||
-- capable(CAP_SYS_RESOURCE)) {
-+ capable_nolog(CAP_SYS_RESOURCE)) {
- if (free_blocks >= (nblocks + dirty_blocks))
- return 1;
- }
-diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
-index 67c46ed..1f237e5 100644
---- a/fs/ext4/ext4.h
-+++ b/fs/ext4/ext4.h
-@@ -1077,19 +1077,19 @@ struct ext4_sb_info {
-
- /* stats for buddy allocator */
- spinlock_t s_mb_pa_lock;
-- atomic_t s_bal_reqs; /* number of reqs with len > 1 */
-- atomic_t s_bal_success; /* we found long enough chunks */
-- atomic_t s_bal_allocated; /* in blocks */
-- atomic_t s_bal_ex_scanned; /* total extents scanned */
-- atomic_t s_bal_goals; /* goal hits */
-- atomic_t s_bal_breaks; /* too long searches */
-- atomic_t s_bal_2orders; /* 2^order hits */
-+ atomic_unchecked_t s_bal_reqs; /* number of reqs with len > 1 */
-+ atomic_unchecked_t s_bal_success; /* we found long enough chunks */
-+ atomic_unchecked_t s_bal_allocated; /* in blocks */
-+ atomic_unchecked_t s_bal_ex_scanned; /* total extents scanned */
-+ atomic_unchecked_t s_bal_goals; /* goal hits */
-+ atomic_unchecked_t s_bal_breaks; /* too long searches */
-+ atomic_unchecked_t s_bal_2orders; /* 2^order hits */
- spinlock_t s_bal_lock;
- unsigned long s_mb_buddies_generated;
- unsigned long long s_mb_generation_time;
-- atomic_t s_mb_lost_chunks;
-- atomic_t s_mb_preallocated;
-- atomic_t s_mb_discarded;
-+ atomic_unchecked_t s_mb_lost_chunks;
-+ atomic_unchecked_t s_mb_preallocated;
-+ atomic_unchecked_t s_mb_discarded;
- atomic_t s_lock_busy;
-
- /* locality groups */
-diff --git a/fs/ext4/file.c b/fs/ext4/file.c
-index 2a60541..7439d61 100644
---- a/fs/ext4/file.c
-+++ b/fs/ext4/file.c
-@@ -122,8 +122,8 @@ static int ext4_file_open(struct inode * inode, struct file * filp)
- cp = d_path(&path, buf, sizeof(buf));
- path_put(&path);
- if (!IS_ERR(cp)) {
-- memcpy(sbi->s_es->s_last_mounted, cp,
-- sizeof(sbi->s_es->s_last_mounted));
-+ strlcpy(sbi->s_es->s_last_mounted, cp,
-+ sizeof(sbi->s_es->s_last_mounted));
- sb->s_dirt = 1;
- }
- }
-diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
-index babf448..4200057 100644
---- a/fs/ext4/inode.c
-+++ b/fs/ext4/inode.c
-@@ -2179,6 +2179,7 @@ static void ext4_da_block_invalidatepages(struct mpage_da_data *mpd,
- index = logical >> (PAGE_CACHE_SHIFT - inode->i_blkbits);
- end = (logical + blk_cnt - 1) >>
- (PAGE_CACHE_SHIFT - inode->i_blkbits);
-+ pagevec_init(&pvec, 0);
- while (index <= end) {
- nr_pages = pagevec_lookup(&pvec, mapping, index, PAGEVEC_SIZE);
- if (nr_pages == 0)
-diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
-index cecf2a5..a79685e 100644
---- a/fs/ext4/mballoc.c
-+++ b/fs/ext4/mballoc.c
-@@ -1755,7 +1755,7 @@ void ext4_mb_simple_scan_group(struct ext4_allocation_context *ac,
- BUG_ON(ac->ac_b_ex.fe_len != ac->ac_g_ex.fe_len);
-
- if (EXT4_SB(sb)->s_mb_stats)
-- atomic_inc(&EXT4_SB(sb)->s_bal_2orders);
-+ atomic_inc_unchecked(&EXT4_SB(sb)->s_bal_2orders);
-
- break;
- }
-@@ -2135,7 +2135,7 @@ repeat:
- ac->ac_status = AC_STATUS_CONTINUE;
- ac->ac_flags |= EXT4_MB_HINT_FIRST;
- cr = 3;
-- atomic_inc(&sbi->s_mb_lost_chunks);
-+ atomic_inc_unchecked(&sbi->s_mb_lost_chunks);
- goto repeat;
- }
- }
-@@ -2178,6 +2178,8 @@ static int ext4_mb_seq_groups_show(struct seq_file *seq, void *v)
- ext4_grpblk_t counters[16];
- } sg;
-
-+ pax_track_stack();
-+
- group--;
- if (group == 0)
- seq_printf(seq, "#%-5s: %-5s %-5s %-5s "
-@@ -2538,25 +2540,25 @@ int ext4_mb_release(struct super_block *sb)
- if (sbi->s_mb_stats) {
- printk(KERN_INFO
- "EXT4-fs: mballoc: %u blocks %u reqs (%u success)\n",
-- atomic_read(&sbi->s_bal_allocated),
-- atomic_read(&sbi->s_bal_reqs),
-- atomic_read(&sbi->s_bal_success));
-+ atomic_read_unchecked(&sbi->s_bal_allocated),
-+ atomic_read_unchecked(&sbi->s_bal_reqs),
-+ atomic_read_unchecked(&sbi->s_bal_success));
- printk(KERN_INFO
- "EXT4-fs: mballoc: %u extents scanned, %u goal hits, "
- "%u 2^N hits, %u breaks, %u lost\n",
-- atomic_read(&sbi->s_bal_ex_scanned),
-- atomic_read(&sbi->s_bal_goals),
-- atomic_read(&sbi->s_bal_2orders),
-- atomic_read(&sbi->s_bal_breaks),
-- atomic_read(&sbi->s_mb_lost_chunks));
-+ atomic_read_unchecked(&sbi->s_bal_ex_scanned),
-+ atomic_read_unchecked(&sbi->s_bal_goals),
-+ atomic_read_unchecked(&sbi->s_bal_2orders),
-+ atomic_read_unchecked(&sbi->s_bal_breaks),
-+ atomic_read_unchecked(&sbi->s_mb_lost_chunks));
- printk(KERN_INFO
- "EXT4-fs: mballoc: %lu generated and it took %Lu\n",
- sbi->s_mb_buddies_generated++,
- sbi->s_mb_generation_time);
- printk(KERN_INFO
- "EXT4-fs: mballoc: %u preallocated, %u discarded\n",
-- atomic_read(&sbi->s_mb_preallocated),
-- atomic_read(&sbi->s_mb_discarded));
-+ atomic_read_unchecked(&sbi->s_mb_preallocated),
-+ atomic_read_unchecked(&sbi->s_mb_discarded));
- }
-
- free_percpu(sbi->s_locality_groups);
-@@ -3038,16 +3040,16 @@ static void ext4_mb_collect_stats(struct ext4_allocation_context *ac)
- struct ext4_sb_info *sbi = EXT4_SB(ac->ac_sb);
-
- if (sbi->s_mb_stats && ac->ac_g_ex.fe_len > 1) {
-- atomic_inc(&sbi->s_bal_reqs);
-- atomic_add(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
-+ atomic_inc_unchecked(&sbi->s_bal_reqs);
-+ atomic_add_unchecked(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
- if (ac->ac_o_ex.fe_len >= ac->ac_g_ex.fe_len)
-- atomic_inc(&sbi->s_bal_success);
-- atomic_add(ac->ac_found, &sbi->s_bal_ex_scanned);
-+ atomic_inc_unchecked(&sbi->s_bal_success);
-+ atomic_add_unchecked(ac->ac_found, &sbi->s_bal_ex_scanned);
- if (ac->ac_g_ex.fe_start == ac->ac_b_ex.fe_start &&
- ac->ac_g_ex.fe_group == ac->ac_b_ex.fe_group)
-- atomic_inc(&sbi->s_bal_goals);
-+ atomic_inc_unchecked(&sbi->s_bal_goals);
- if (ac->ac_found > sbi->s_mb_max_to_scan)
-- atomic_inc(&sbi->s_bal_breaks);
-+ atomic_inc_unchecked(&sbi->s_bal_breaks);
- }
-
- if (ac->ac_op == EXT4_MB_HISTORY_ALLOC)
-@@ -3447,7 +3449,7 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac)
- trace_ext4_mb_new_inode_pa(ac, pa);
-
- ext4_mb_use_inode_pa(ac, pa);
-- atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
-+ atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
-
- ei = EXT4_I(ac->ac_inode);
- grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
-@@ -3507,7 +3509,7 @@ ext4_mb_new_group_pa(struct ext4_allocation_context *ac)
- trace_ext4_mb_new_group_pa(ac, pa);
-
- ext4_mb_use_group_pa(ac, pa);
-- atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
-+ atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
-
- grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
- lg = ac->ac_lg;
-@@ -3611,7 +3613,7 @@ ext4_mb_release_inode_pa(struct ext4_buddy *e4b, struct buffer_head *bitmap_bh,
- * from the bitmap and continue.
- */
- }
-- atomic_add(free, &sbi->s_mb_discarded);
-+ atomic_add_unchecked(free, &sbi->s_mb_discarded);
-
- return err;
- }
-@@ -3630,7 +3632,7 @@ ext4_mb_release_group_pa(struct ext4_buddy *e4b,
- ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit);
- BUG_ON(group != e4b->bd_group && pa->pa_len != 0);
- mb_free_blocks(pa->pa_inode, e4b, bit, pa->pa_len);
-- atomic_add(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
-+ atomic_add_unchecked(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
-
- if (ac) {
- ac->ac_sb = sb;
-diff --git a/fs/ext4/super.c b/fs/ext4/super.c
-index 108515f..c53b6bd 100644
---- a/fs/ext4/super.c
-+++ b/fs/ext4/super.c
-@@ -2297,7 +2297,7 @@ static void ext4_sb_release(struct kobject *kobj)
- }
-
-
--static struct sysfs_ops ext4_attr_ops = {
-+static const struct sysfs_ops ext4_attr_ops = {
- .show = ext4_attr_show,
- .store = ext4_attr_store,
- };
-diff --git a/fs/fat/inode.c b/fs/fat/inode.c
-index c187e92..ca5f1c9 100644
---- a/fs/fat/inode.c
-+++ b/fs/fat/inode.c
-@@ -1206,6 +1206,19 @@ static int fat_read_root(struct inode *inode)
- return 0;
- }
-
-+static unsigned long calc_fat_clusters(struct super_block *sb)
-+{
-+ struct msdos_sb_info *sbi = MSDOS_SB(sb);
-+
-+ /* Divide first to avoid overflow */
-+ if (sbi->fat_bits != 12) {
-+ unsigned long ent_per_sec = sb->s_blocksize * 8 / sbi->fat_bits;
-+ return ent_per_sec * sbi->fat_length;
-+ }
-+
-+ return sbi->fat_length * sb->s_blocksize * 8 / sbi->fat_bits;
-+}
-+
- /*
- * Read the super block of an MS-DOS FS.
- */
-@@ -1400,7 +1413,7 @@ int fat_fill_super(struct super_block *sb, void *data, int silent,
- sbi->fat_bits = (total_clusters > MAX_FAT12) ? 16 : 12;
-
- /* check that FAT table does not overflow */
-- fat_clusters = sbi->fat_length * sb->s_blocksize * 8 / sbi->fat_bits;
-+ fat_clusters = calc_fat_clusters(sb);
- total_clusters = min(total_clusters, fat_clusters - FAT_START_ENT);
- if (total_clusters > MAX_FAT(sb)) {
- if (!silent)
-diff --git a/fs/fcntl.c b/fs/fcntl.c
-index 97e01dc..e9aab2d 100644
---- a/fs/fcntl.c
-+++ b/fs/fcntl.c
-@@ -223,6 +223,11 @@ int __f_setown(struct file *filp, struct pid *pid, enum pid_type type,
- if (err)
- return err;
-
-+ if (gr_handle_chroot_fowner(pid, type))
-+ return -ENOENT;
-+ if (gr_check_protected_task_fowner(pid, type))
-+ return -EACCES;
-+
- f_modown(filp, pid, type, force);
- return 0;
- }
-@@ -265,7 +270,7 @@ pid_t f_getown(struct file *filp)
-
- static int f_setown_ex(struct file *filp, unsigned long arg)
- {
-- struct f_owner_ex * __user owner_p = (void * __user)arg;
-+ struct f_owner_ex __user *owner_p = (void __user *)arg;
- struct f_owner_ex owner;
- struct pid *pid;
- int type;
-@@ -305,7 +310,7 @@ static int f_setown_ex(struct file *filp, unsigned long arg)
-
- static int f_getown_ex(struct file *filp, unsigned long arg)
- {
-- struct f_owner_ex * __user owner_p = (void * __user)arg;
-+ struct f_owner_ex __user *owner_p = (void __user *)arg;
- struct f_owner_ex owner;
- int ret = 0;
-
-@@ -344,6 +349,7 @@ static long do_fcntl(int fd, unsigned int cmd, unsigned long arg,
- switch (cmd) {
- case F_DUPFD:
- case F_DUPFD_CLOEXEC:
-+ gr_learn_resource(current, RLIMIT_NOFILE, arg, 0);
- if (arg >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
- break;
- err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
-diff --git a/fs/fifo.c b/fs/fifo.c
-index f8f97b8..401db37 100644
---- a/fs/fifo.c
-+++ b/fs/fifo.c
-@@ -15,7 +15,7 @@
- #include <linux/sched.h>
- #include <linux/pipe_fs_i.h>
-
--static void wait_for_partner(struct inode* inode, unsigned int *cnt)
-+static int wait_for_partner(struct inode* inode, unsigned int *cnt)
- {
- int cur = *cnt;
-
-@@ -24,6 +24,7 @@ static void wait_for_partner(struct inode* inode, unsigned int *cnt)
- if (signal_pending(current))
- break;
- }
-+ return cur == *cnt ? -ERESTARTSYS : 0;
- }
-
- static void wake_up_partner(struct inode* inode)
-@@ -59,18 +60,16 @@ static int fifo_open(struct inode *inode, struct file *filp)
- */
- filp->f_op = &read_pipefifo_fops;
- pipe->r_counter++;
-- if (pipe->readers++ == 0)
-+ if (atomic_inc_return(&pipe->readers) == 1)
- wake_up_partner(inode);
-
-- if (!pipe->writers) {
-+ if (!atomic_read(&pipe->writers)) {
- if ((filp->f_flags & O_NONBLOCK)) {
- /* suppress POLLHUP until we have
- * seen a writer */
- filp->f_version = pipe->w_counter;
-- } else
-- {
-- wait_for_partner(inode, &pipe->w_counter);
-- if(signal_pending(current))
-+ } else {
-+ if (wait_for_partner(inode, &pipe->w_counter))
- goto err_rd;
- }
- }
-@@ -83,17 +82,16 @@ static int fifo_open(struct inode *inode, struct file *filp)
- * errno=ENXIO when there is no process reading the FIFO.
- */
- ret = -ENXIO;
-- if ((filp->f_flags & O_NONBLOCK) && !pipe->readers)
-+ if ((filp->f_flags & O_NONBLOCK) && !atomic_read(&pipe->readers))
- goto err;
-
- filp->f_op = &write_pipefifo_fops;
- pipe->w_counter++;
-- if (!pipe->writers++)
-+ if (atomic_inc_return(&pipe->writers) == 1)
- wake_up_partner(inode);
-
-- if (!pipe->readers) {
-- wait_for_partner(inode, &pipe->r_counter);
-- if (signal_pending(current))
-+ if (!atomic_read(&pipe->readers)) {
-+ if (wait_for_partner(inode, &pipe->r_counter))
- goto err_wr;
- }
- break;
-@@ -107,11 +105,11 @@ static int fifo_open(struct inode *inode, struct file *filp)
- */
- filp->f_op = &rdwr_pipefifo_fops;
-
-- pipe->readers++;
-- pipe->writers++;
-+ atomic_inc(&pipe->readers);
-+ atomic_inc(&pipe->writers);
- pipe->r_counter++;
- pipe->w_counter++;
-- if (pipe->readers == 1 || pipe->writers == 1)
-+ if (atomic_read(&pipe->readers) == 1 || atomic_read(&pipe->writers) == 1)
- wake_up_partner(inode);
- break;
-
-@@ -125,19 +123,19 @@ static int fifo_open(struct inode *inode, struct file *filp)
- return 0;
-
- err_rd:
-- if (!--pipe->readers)
-+ if (atomic_dec_and_test(&pipe->readers))
- wake_up_interruptible(&pipe->wait);
- ret = -ERESTARTSYS;
- goto err;
-
- err_wr:
-- if (!--pipe->writers)
-+ if (atomic_dec_and_test(&pipe->writers))
- wake_up_interruptible(&pipe->wait);
- ret = -ERESTARTSYS;
- goto err;
-
- err:
-- if (!pipe->readers && !pipe->writers)
-+ if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers))
- free_pipe_info(inode);
-
- err_nocleanup:
-diff --git a/fs/file.c b/fs/file.c
-index 87e1290..a930cc4 100644
---- a/fs/file.c
-+++ b/fs/file.c
-@@ -14,6 +14,7 @@
- #include <linux/slab.h>
- #include <linux/vmalloc.h>
- #include <linux/file.h>
-+#include <linux/security.h>
- #include <linux/fdtable.h>
- #include <linux/bitops.h>
- #include <linux/interrupt.h>
-@@ -257,6 +258,8 @@ int expand_files(struct files_struct *files, int nr)
- * N.B. For clone tasks sharing a files structure, this test
- * will limit the total number of files that can be opened.
- */
-+
-+ gr_learn_resource(current, RLIMIT_NOFILE, nr, 0);
- if (nr >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
- return -EMFILE;
-
-diff --git a/fs/filesystems.c b/fs/filesystems.c
-index a24c58e..53f91ee 100644
---- a/fs/filesystems.c
-+++ b/fs/filesystems.c
-@@ -272,7 +272,12 @@ struct file_system_type *get_fs_type(const char *name)
- int len = dot ? dot - name : strlen(name);
-
- fs = __get_fs_type(name, len);
-+
-+#ifdef CONFIG_GRKERNSEC_MODHARDEN
-+ if (!fs && (___request_module(true, "grsec_modharden_fs", "%.*s", len, name) == 0))
-+#else
- if (!fs && (request_module("%.*s", len, name) == 0))
-+#endif
- fs = __get_fs_type(name, len);
-
- if (dot && fs && !(fs->fs_flags & FS_HAS_SUBTYPE)) {
-diff --git a/fs/fs_struct.c b/fs/fs_struct.c
-index eee0590..0a5b2ee 100644
---- a/fs/fs_struct.c
-+++ b/fs/fs_struct.c
-@@ -4,6 +4,7 @@
- #include <linux/path.h>
- #include <linux/slab.h>
- #include <linux/fs_struct.h>
-+#include <linux/grsecurity.h>
-
- /*
- * Replace the fs->{rootmnt,root} with {mnt,dentry}. Put the old values.
-@@ -17,6 +18,7 @@ void set_fs_root(struct fs_struct *fs, struct path *path)
- old_root = fs->root;
- fs->root = *path;
- path_get(path);
-+ gr_set_chroot_entries(current, path);
- write_unlock(&fs->lock);
- if (old_root.dentry)
- path_put(&old_root);
-@@ -56,6 +58,13 @@ void chroot_fs_refs(struct path *old_root, struct path *new_root)
- && fs->root.mnt == old_root->mnt) {
- path_get(new_root);
- fs->root = *new_root;
-+ /* This function is only called
-+ from pivot_root(). Leave our
-+ gr_chroot_dentry and is_chrooted flags
-+ as-is, so that a pivoted root isn't treated
-+ as a chroot
-+ */
-+ //gr_set_chroot_entries(p, new_root);
- count++;
- }
- if (fs->pwd.dentry == old_root->dentry
-@@ -89,7 +98,8 @@ void exit_fs(struct task_struct *tsk)
- task_lock(tsk);
- write_lock(&fs->lock);
- tsk->fs = NULL;
-- kill = !--fs->users;
-+ gr_clear_chroot_entries(tsk);
-+ kill = !atomic_dec_return(&fs->users);
- write_unlock(&fs->lock);
- task_unlock(tsk);
- if (kill)
-@@ -102,7 +112,7 @@ struct fs_struct *copy_fs_struct(struct fs_struct *old)
- struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL);
- /* We don't need to lock fs - think why ;-) */
- if (fs) {
-- fs->users = 1;
-+ atomic_set(&fs->users, 1);
- fs->in_exec = 0;
- rwlock_init(&fs->lock);
- fs->umask = old->umask;
-@@ -127,8 +137,9 @@ int unshare_fs_struct(void)
-
- task_lock(current);
- write_lock(&fs->lock);
-- kill = !--fs->users;
-+ kill = !atomic_dec_return(&fs->users);
- current->fs = new_fs;
-+ gr_set_chroot_entries(current, &new_fs->root);
- write_unlock(&fs->lock);
- task_unlock(current);
-
-@@ -141,13 +152,13 @@ EXPORT_SYMBOL_GPL(unshare_fs_struct);
-
- int current_umask(void)
- {
-- return current->fs->umask;
-+ return current->fs->umask | gr_acl_umask();
- }
- EXPORT_SYMBOL(current_umask);
-
- /* to be mentioned only in INIT_TASK */
- struct fs_struct init_fs = {
-- .users = 1,
-+ .users = ATOMIC_INIT(1),
- .lock = __RW_LOCK_UNLOCKED(init_fs.lock),
- .umask = 0022,
- };
-@@ -162,12 +173,13 @@ void daemonize_fs_struct(void)
- task_lock(current);
-
- write_lock(&init_fs.lock);
-- init_fs.users++;
-+ atomic_inc(&init_fs.users);
- write_unlock(&init_fs.lock);
-
- write_lock(&fs->lock);
- current->fs = &init_fs;
-- kill = !--fs->users;
-+ gr_set_chroot_entries(current, ¤t->fs->root);
-+ kill = !atomic_dec_return(&fs->users);
- write_unlock(&fs->lock);
-
- task_unlock(current);
-diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c
-index 9905350..02eaec4 100644
---- a/fs/fscache/cookie.c
-+++ b/fs/fscache/cookie.c
-@@ -68,11 +68,11 @@ struct fscache_cookie *__fscache_acquire_cookie(
- parent ? (char *) parent->def->name : "<no-parent>",
- def->name, netfs_data);
-
-- fscache_stat(&fscache_n_acquires);
-+ fscache_stat_unchecked(&fscache_n_acquires);
-
- /* if there's no parent cookie, then we don't create one here either */
- if (!parent) {
-- fscache_stat(&fscache_n_acquires_null);
-+ fscache_stat_unchecked(&fscache_n_acquires_null);
- _leave(" [no parent]");
- return NULL;
- }
-@@ -87,7 +87,7 @@ struct fscache_cookie *__fscache_acquire_cookie(
- /* allocate and initialise a cookie */
- cookie = kmem_cache_alloc(fscache_cookie_jar, GFP_KERNEL);
- if (!cookie) {
-- fscache_stat(&fscache_n_acquires_oom);
-+ fscache_stat_unchecked(&fscache_n_acquires_oom);
- _leave(" [ENOMEM]");
- return NULL;
- }
-@@ -109,13 +109,13 @@ struct fscache_cookie *__fscache_acquire_cookie(
-
- switch (cookie->def->type) {
- case FSCACHE_COOKIE_TYPE_INDEX:
-- fscache_stat(&fscache_n_cookie_index);
-+ fscache_stat_unchecked(&fscache_n_cookie_index);
- break;
- case FSCACHE_COOKIE_TYPE_DATAFILE:
-- fscache_stat(&fscache_n_cookie_data);
-+ fscache_stat_unchecked(&fscache_n_cookie_data);
- break;
- default:
-- fscache_stat(&fscache_n_cookie_special);
-+ fscache_stat_unchecked(&fscache_n_cookie_special);
- break;
- }
-
-@@ -126,13 +126,13 @@ struct fscache_cookie *__fscache_acquire_cookie(
- if (fscache_acquire_non_index_cookie(cookie) < 0) {
- atomic_dec(&parent->n_children);
- __fscache_cookie_put(cookie);
-- fscache_stat(&fscache_n_acquires_nobufs);
-+ fscache_stat_unchecked(&fscache_n_acquires_nobufs);
- _leave(" = NULL");
- return NULL;
- }
- }
-
-- fscache_stat(&fscache_n_acquires_ok);
-+ fscache_stat_unchecked(&fscache_n_acquires_ok);
- _leave(" = %p", cookie);
- return cookie;
- }
-@@ -168,7 +168,7 @@ static int fscache_acquire_non_index_cookie(struct fscache_cookie *cookie)
- cache = fscache_select_cache_for_object(cookie->parent);
- if (!cache) {
- up_read(&fscache_addremove_sem);
-- fscache_stat(&fscache_n_acquires_no_cache);
-+ fscache_stat_unchecked(&fscache_n_acquires_no_cache);
- _leave(" = -ENOMEDIUM [no cache]");
- return -ENOMEDIUM;
- }
-@@ -256,12 +256,12 @@ static int fscache_alloc_object(struct fscache_cache *cache,
- object = cache->ops->alloc_object(cache, cookie);
- fscache_stat_d(&fscache_n_cop_alloc_object);
- if (IS_ERR(object)) {
-- fscache_stat(&fscache_n_object_no_alloc);
-+ fscache_stat_unchecked(&fscache_n_object_no_alloc);
- ret = PTR_ERR(object);
- goto error;
- }
-
-- fscache_stat(&fscache_n_object_alloc);
-+ fscache_stat_unchecked(&fscache_n_object_alloc);
-
- object->debug_id = atomic_inc_return(&fscache_object_debug_id);
-
-@@ -377,10 +377,10 @@ void __fscache_update_cookie(struct fscache_cookie *cookie)
- struct fscache_object *object;
- struct hlist_node *_p;
-
-- fscache_stat(&fscache_n_updates);
-+ fscache_stat_unchecked(&fscache_n_updates);
-
- if (!cookie) {
-- fscache_stat(&fscache_n_updates_null);
-+ fscache_stat_unchecked(&fscache_n_updates_null);
- _leave(" [no cookie]");
- return;
- }
-@@ -414,12 +414,12 @@ void __fscache_relinquish_cookie(struct fscache_cookie *cookie, int retire)
- struct fscache_object *object;
- unsigned long event;
-
-- fscache_stat(&fscache_n_relinquishes);
-+ fscache_stat_unchecked(&fscache_n_relinquishes);
- if (retire)
-- fscache_stat(&fscache_n_relinquishes_retire);
-+ fscache_stat_unchecked(&fscache_n_relinquishes_retire);
-
- if (!cookie) {
-- fscache_stat(&fscache_n_relinquishes_null);
-+ fscache_stat_unchecked(&fscache_n_relinquishes_null);
- _leave(" [no cookie]");
- return;
- }
-@@ -435,7 +435,7 @@ void __fscache_relinquish_cookie(struct fscache_cookie *cookie, int retire)
-
- /* wait for the cookie to finish being instantiated (or to fail) */
- if (test_bit(FSCACHE_COOKIE_CREATING, &cookie->flags)) {
-- fscache_stat(&fscache_n_relinquishes_waitcrt);
-+ fscache_stat_unchecked(&fscache_n_relinquishes_waitcrt);
- wait_on_bit(&cookie->flags, FSCACHE_COOKIE_CREATING,
- fscache_wait_bit, TASK_UNINTERRUPTIBLE);
- }
-diff --git a/fs/fscache/internal.h b/fs/fscache/internal.h
-index edd7434..0725e66 100644
---- a/fs/fscache/internal.h
-+++ b/fs/fscache/internal.h
-@@ -136,94 +136,94 @@ extern void fscache_proc_cleanup(void);
- extern atomic_t fscache_n_ops_processed[FSCACHE_MAX_THREADS];
- extern atomic_t fscache_n_objs_processed[FSCACHE_MAX_THREADS];
-
--extern atomic_t fscache_n_op_pend;
--extern atomic_t fscache_n_op_run;
--extern atomic_t fscache_n_op_enqueue;
--extern atomic_t fscache_n_op_deferred_release;
--extern atomic_t fscache_n_op_release;
--extern atomic_t fscache_n_op_gc;
--extern atomic_t fscache_n_op_cancelled;
--extern atomic_t fscache_n_op_rejected;
-+extern atomic_unchecked_t fscache_n_op_pend;
-+extern atomic_unchecked_t fscache_n_op_run;
-+extern atomic_unchecked_t fscache_n_op_enqueue;
-+extern atomic_unchecked_t fscache_n_op_deferred_release;
-+extern atomic_unchecked_t fscache_n_op_release;
-+extern atomic_unchecked_t fscache_n_op_gc;
-+extern atomic_unchecked_t fscache_n_op_cancelled;
-+extern atomic_unchecked_t fscache_n_op_rejected;
-
--extern atomic_t fscache_n_attr_changed;
--extern atomic_t fscache_n_attr_changed_ok;
--extern atomic_t fscache_n_attr_changed_nobufs;
--extern atomic_t fscache_n_attr_changed_nomem;
--extern atomic_t fscache_n_attr_changed_calls;
-+extern atomic_unchecked_t fscache_n_attr_changed;
-+extern atomic_unchecked_t fscache_n_attr_changed_ok;
-+extern atomic_unchecked_t fscache_n_attr_changed_nobufs;
-+extern atomic_unchecked_t fscache_n_attr_changed_nomem;
-+extern atomic_unchecked_t fscache_n_attr_changed_calls;
-
--extern atomic_t fscache_n_allocs;
--extern atomic_t fscache_n_allocs_ok;
--extern atomic_t fscache_n_allocs_wait;
--extern atomic_t fscache_n_allocs_nobufs;
--extern atomic_t fscache_n_allocs_intr;
--extern atomic_t fscache_n_allocs_object_dead;
--extern atomic_t fscache_n_alloc_ops;
--extern atomic_t fscache_n_alloc_op_waits;
-+extern atomic_unchecked_t fscache_n_allocs;
-+extern atomic_unchecked_t fscache_n_allocs_ok;
-+extern atomic_unchecked_t fscache_n_allocs_wait;
-+extern atomic_unchecked_t fscache_n_allocs_nobufs;
-+extern atomic_unchecked_t fscache_n_allocs_intr;
-+extern atomic_unchecked_t fscache_n_allocs_object_dead;
-+extern atomic_unchecked_t fscache_n_alloc_ops;
-+extern atomic_unchecked_t fscache_n_alloc_op_waits;
-
--extern atomic_t fscache_n_retrievals;
--extern atomic_t fscache_n_retrievals_ok;
--extern atomic_t fscache_n_retrievals_wait;
--extern atomic_t fscache_n_retrievals_nodata;
--extern atomic_t fscache_n_retrievals_nobufs;
--extern atomic_t fscache_n_retrievals_intr;
--extern atomic_t fscache_n_retrievals_nomem;
--extern atomic_t fscache_n_retrievals_object_dead;
--extern atomic_t fscache_n_retrieval_ops;
--extern atomic_t fscache_n_retrieval_op_waits;
-+extern atomic_unchecked_t fscache_n_retrievals;
-+extern atomic_unchecked_t fscache_n_retrievals_ok;
-+extern atomic_unchecked_t fscache_n_retrievals_wait;
-+extern atomic_unchecked_t fscache_n_retrievals_nodata;
-+extern atomic_unchecked_t fscache_n_retrievals_nobufs;
-+extern atomic_unchecked_t fscache_n_retrievals_intr;
-+extern atomic_unchecked_t fscache_n_retrievals_nomem;
-+extern atomic_unchecked_t fscache_n_retrievals_object_dead;
-+extern atomic_unchecked_t fscache_n_retrieval_ops;
-+extern atomic_unchecked_t fscache_n_retrieval_op_waits;
-
--extern atomic_t fscache_n_stores;
--extern atomic_t fscache_n_stores_ok;
--extern atomic_t fscache_n_stores_again;
--extern atomic_t fscache_n_stores_nobufs;
--extern atomic_t fscache_n_stores_oom;
--extern atomic_t fscache_n_store_ops;
--extern atomic_t fscache_n_store_calls;
--extern atomic_t fscache_n_store_pages;
--extern atomic_t fscache_n_store_radix_deletes;
--extern atomic_t fscache_n_store_pages_over_limit;
-+extern atomic_unchecked_t fscache_n_stores;
-+extern atomic_unchecked_t fscache_n_stores_ok;
-+extern atomic_unchecked_t fscache_n_stores_again;
-+extern atomic_unchecked_t fscache_n_stores_nobufs;
-+extern atomic_unchecked_t fscache_n_stores_oom;
-+extern atomic_unchecked_t fscache_n_store_ops;
-+extern atomic_unchecked_t fscache_n_store_calls;
-+extern atomic_unchecked_t fscache_n_store_pages;
-+extern atomic_unchecked_t fscache_n_store_radix_deletes;
-+extern atomic_unchecked_t fscache_n_store_pages_over_limit;
-
--extern atomic_t fscache_n_store_vmscan_not_storing;
--extern atomic_t fscache_n_store_vmscan_gone;
--extern atomic_t fscache_n_store_vmscan_busy;
--extern atomic_t fscache_n_store_vmscan_cancelled;
-+extern atomic_unchecked_t fscache_n_store_vmscan_not_storing;
-+extern atomic_unchecked_t fscache_n_store_vmscan_gone;
-+extern atomic_unchecked_t fscache_n_store_vmscan_busy;
-+extern atomic_unchecked_t fscache_n_store_vmscan_cancelled;
-
--extern atomic_t fscache_n_marks;
--extern atomic_t fscache_n_uncaches;
-+extern atomic_unchecked_t fscache_n_marks;
-+extern atomic_unchecked_t fscache_n_uncaches;
-
--extern atomic_t fscache_n_acquires;
--extern atomic_t fscache_n_acquires_null;
--extern atomic_t fscache_n_acquires_no_cache;
--extern atomic_t fscache_n_acquires_ok;
--extern atomic_t fscache_n_acquires_nobufs;
--extern atomic_t fscache_n_acquires_oom;
-+extern atomic_unchecked_t fscache_n_acquires;
-+extern atomic_unchecked_t fscache_n_acquires_null;
-+extern atomic_unchecked_t fscache_n_acquires_no_cache;
-+extern atomic_unchecked_t fscache_n_acquires_ok;
-+extern atomic_unchecked_t fscache_n_acquires_nobufs;
-+extern atomic_unchecked_t fscache_n_acquires_oom;
-
--extern atomic_t fscache_n_updates;
--extern atomic_t fscache_n_updates_null;
--extern atomic_t fscache_n_updates_run;
-+extern atomic_unchecked_t fscache_n_updates;
-+extern atomic_unchecked_t fscache_n_updates_null;
-+extern atomic_unchecked_t fscache_n_updates_run;
-
--extern atomic_t fscache_n_relinquishes;
--extern atomic_t fscache_n_relinquishes_null;
--extern atomic_t fscache_n_relinquishes_waitcrt;
--extern atomic_t fscache_n_relinquishes_retire;
-+extern atomic_unchecked_t fscache_n_relinquishes;
-+extern atomic_unchecked_t fscache_n_relinquishes_null;
-+extern atomic_unchecked_t fscache_n_relinquishes_waitcrt;
-+extern atomic_unchecked_t fscache_n_relinquishes_retire;
-
--extern atomic_t fscache_n_cookie_index;
--extern atomic_t fscache_n_cookie_data;
--extern atomic_t fscache_n_cookie_special;
-+extern atomic_unchecked_t fscache_n_cookie_index;
-+extern atomic_unchecked_t fscache_n_cookie_data;
-+extern atomic_unchecked_t fscache_n_cookie_special;
-
--extern atomic_t fscache_n_object_alloc;
--extern atomic_t fscache_n_object_no_alloc;
--extern atomic_t fscache_n_object_lookups;
--extern atomic_t fscache_n_object_lookups_negative;
--extern atomic_t fscache_n_object_lookups_positive;
--extern atomic_t fscache_n_object_lookups_timed_out;
--extern atomic_t fscache_n_object_created;
--extern atomic_t fscache_n_object_avail;
--extern atomic_t fscache_n_object_dead;
-+extern atomic_unchecked_t fscache_n_object_alloc;
-+extern atomic_unchecked_t fscache_n_object_no_alloc;
-+extern atomic_unchecked_t fscache_n_object_lookups;
-+extern atomic_unchecked_t fscache_n_object_lookups_negative;
-+extern atomic_unchecked_t fscache_n_object_lookups_positive;
-+extern atomic_unchecked_t fscache_n_object_lookups_timed_out;
-+extern atomic_unchecked_t fscache_n_object_created;
-+extern atomic_unchecked_t fscache_n_object_avail;
-+extern atomic_unchecked_t fscache_n_object_dead;
-
--extern atomic_t fscache_n_checkaux_none;
--extern atomic_t fscache_n_checkaux_okay;
--extern atomic_t fscache_n_checkaux_update;
--extern atomic_t fscache_n_checkaux_obsolete;
-+extern atomic_unchecked_t fscache_n_checkaux_none;
-+extern atomic_unchecked_t fscache_n_checkaux_okay;
-+extern atomic_unchecked_t fscache_n_checkaux_update;
-+extern atomic_unchecked_t fscache_n_checkaux_obsolete;
-
- extern atomic_t fscache_n_cop_alloc_object;
- extern atomic_t fscache_n_cop_lookup_object;
-@@ -247,6 +247,11 @@ static inline void fscache_stat(atomic_t *stat)
- atomic_inc(stat);
- }
-
-+static inline void fscache_stat_unchecked(atomic_unchecked_t *stat)
-+{
-+ atomic_inc_unchecked(stat);
-+}
-+
- static inline void fscache_stat_d(atomic_t *stat)
- {
- atomic_dec(stat);
-@@ -259,6 +264,7 @@ extern const struct file_operations fscache_stats_fops;
-
- #define __fscache_stat(stat) (NULL)
- #define fscache_stat(stat) do {} while (0)
-+#define fscache_stat_unchecked(stat) do {} while (0)
- #define fscache_stat_d(stat) do {} while (0)
- #endif
-
-diff --git a/fs/fscache/object.c b/fs/fscache/object.c
-index e513ac5..e888d34 100644
---- a/fs/fscache/object.c
-+++ b/fs/fscache/object.c
-@@ -144,7 +144,7 @@ static void fscache_object_state_machine(struct fscache_object *object)
- /* update the object metadata on disk */
- case FSCACHE_OBJECT_UPDATING:
- clear_bit(FSCACHE_OBJECT_EV_UPDATE, &object->events);
-- fscache_stat(&fscache_n_updates_run);
-+ fscache_stat_unchecked(&fscache_n_updates_run);
- fscache_stat(&fscache_n_cop_update_object);
- object->cache->ops->update_object(object);
- fscache_stat_d(&fscache_n_cop_update_object);
-@@ -233,7 +233,7 @@ static void fscache_object_state_machine(struct fscache_object *object)
- spin_lock(&object->lock);
- object->state = FSCACHE_OBJECT_DEAD;
- spin_unlock(&object->lock);
-- fscache_stat(&fscache_n_object_dead);
-+ fscache_stat_unchecked(&fscache_n_object_dead);
- goto terminal_transit;
-
- /* handle the parent cache of this object being withdrawn from
-@@ -248,7 +248,7 @@ static void fscache_object_state_machine(struct fscache_object *object)
- spin_lock(&object->lock);
- object->state = FSCACHE_OBJECT_DEAD;
- spin_unlock(&object->lock);
-- fscache_stat(&fscache_n_object_dead);
-+ fscache_stat_unchecked(&fscache_n_object_dead);
- goto terminal_transit;
-
- /* complain about the object being woken up once it is
-@@ -492,7 +492,7 @@ static void fscache_lookup_object(struct fscache_object *object)
- parent->cookie->def->name, cookie->def->name,
- object->cache->tag->name);
-
-- fscache_stat(&fscache_n_object_lookups);
-+ fscache_stat_unchecked(&fscache_n_object_lookups);
- fscache_stat(&fscache_n_cop_lookup_object);
- ret = object->cache->ops->lookup_object(object);
- fscache_stat_d(&fscache_n_cop_lookup_object);
-@@ -503,7 +503,7 @@ static void fscache_lookup_object(struct fscache_object *object)
- if (ret == -ETIMEDOUT) {
- /* probably stuck behind another object, so move this one to
- * the back of the queue */
-- fscache_stat(&fscache_n_object_lookups_timed_out);
-+ fscache_stat_unchecked(&fscache_n_object_lookups_timed_out);
- set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
- }
-
-@@ -526,7 +526,7 @@ void fscache_object_lookup_negative(struct fscache_object *object)
-
- spin_lock(&object->lock);
- if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
-- fscache_stat(&fscache_n_object_lookups_negative);
-+ fscache_stat_unchecked(&fscache_n_object_lookups_negative);
-
- /* transit here to allow write requests to begin stacking up
- * and read requests to begin returning ENODATA */
-@@ -572,7 +572,7 @@ void fscache_obtained_object(struct fscache_object *object)
- * result, in which case there may be data available */
- spin_lock(&object->lock);
- if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
-- fscache_stat(&fscache_n_object_lookups_positive);
-+ fscache_stat_unchecked(&fscache_n_object_lookups_positive);
-
- clear_bit(FSCACHE_COOKIE_NO_DATA_YET, &cookie->flags);
-
-@@ -586,7 +586,7 @@ void fscache_obtained_object(struct fscache_object *object)
- set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
- } else {
- ASSERTCMP(object->state, ==, FSCACHE_OBJECT_CREATING);
-- fscache_stat(&fscache_n_object_created);
-+ fscache_stat_unchecked(&fscache_n_object_created);
-
- object->state = FSCACHE_OBJECT_AVAILABLE;
- spin_unlock(&object->lock);
-@@ -633,7 +633,7 @@ static void fscache_object_available(struct fscache_object *object)
- fscache_enqueue_dependents(object);
-
- fscache_hist(fscache_obj_instantiate_histogram, object->lookup_jif);
-- fscache_stat(&fscache_n_object_avail);
-+ fscache_stat_unchecked(&fscache_n_object_avail);
-
- _leave("");
- }
-@@ -861,7 +861,7 @@ enum fscache_checkaux fscache_check_aux(struct fscache_object *object,
- enum fscache_checkaux result;
-
- if (!object->cookie->def->check_aux) {
-- fscache_stat(&fscache_n_checkaux_none);
-+ fscache_stat_unchecked(&fscache_n_checkaux_none);
- return FSCACHE_CHECKAUX_OKAY;
- }
-
-@@ -870,17 +870,17 @@ enum fscache_checkaux fscache_check_aux(struct fscache_object *object,
- switch (result) {
- /* entry okay as is */
- case FSCACHE_CHECKAUX_OKAY:
-- fscache_stat(&fscache_n_checkaux_okay);
-+ fscache_stat_unchecked(&fscache_n_checkaux_okay);
- break;
-
- /* entry requires update */
- case FSCACHE_CHECKAUX_NEEDS_UPDATE:
-- fscache_stat(&fscache_n_checkaux_update);
-+ fscache_stat_unchecked(&fscache_n_checkaux_update);
- break;
-
- /* entry requires deletion */
- case FSCACHE_CHECKAUX_OBSOLETE:
-- fscache_stat(&fscache_n_checkaux_obsolete);
-+ fscache_stat_unchecked(&fscache_n_checkaux_obsolete);
- break;
-
- default:
-diff --git a/fs/fscache/operation.c b/fs/fscache/operation.c
-index 313e79a..775240f 100644
---- a/fs/fscache/operation.c
-+++ b/fs/fscache/operation.c
-@@ -16,7 +16,7 @@
- #include <linux/seq_file.h>
- #include "internal.h"
-
--atomic_t fscache_op_debug_id;
-+atomic_unchecked_t fscache_op_debug_id;
- EXPORT_SYMBOL(fscache_op_debug_id);
-
- /**
-@@ -39,7 +39,7 @@ void fscache_enqueue_operation(struct fscache_operation *op)
- ASSERTCMP(op->object->state, >=, FSCACHE_OBJECT_AVAILABLE);
- ASSERTCMP(atomic_read(&op->usage), >, 0);
-
-- fscache_stat(&fscache_n_op_enqueue);
-+ fscache_stat_unchecked(&fscache_n_op_enqueue);
- switch (op->flags & FSCACHE_OP_TYPE) {
- case FSCACHE_OP_FAST:
- _debug("queue fast");
-@@ -76,7 +76,7 @@ static void fscache_run_op(struct fscache_object *object,
- wake_up_bit(&op->flags, FSCACHE_OP_WAITING);
- if (op->processor)
- fscache_enqueue_operation(op);
-- fscache_stat(&fscache_n_op_run);
-+ fscache_stat_unchecked(&fscache_n_op_run);
- }
-
- /*
-@@ -107,11 +107,11 @@ int fscache_submit_exclusive_op(struct fscache_object *object,
- if (object->n_ops > 0) {
- atomic_inc(&op->usage);
- list_add_tail(&op->pend_link, &object->pending_ops);
-- fscache_stat(&fscache_n_op_pend);
-+ fscache_stat_unchecked(&fscache_n_op_pend);
- } else if (!list_empty(&object->pending_ops)) {
- atomic_inc(&op->usage);
- list_add_tail(&op->pend_link, &object->pending_ops);
-- fscache_stat(&fscache_n_op_pend);
-+ fscache_stat_unchecked(&fscache_n_op_pend);
- fscache_start_operations(object);
- } else {
- ASSERTCMP(object->n_in_progress, ==, 0);
-@@ -127,7 +127,7 @@ int fscache_submit_exclusive_op(struct fscache_object *object,
- object->n_exclusive++; /* reads and writes must wait */
- atomic_inc(&op->usage);
- list_add_tail(&op->pend_link, &object->pending_ops);
-- fscache_stat(&fscache_n_op_pend);
-+ fscache_stat_unchecked(&fscache_n_op_pend);
- ret = 0;
- } else {
- /* not allowed to submit ops in any other state */
-@@ -214,11 +214,11 @@ int fscache_submit_op(struct fscache_object *object,
- if (object->n_exclusive > 0) {
- atomic_inc(&op->usage);
- list_add_tail(&op->pend_link, &object->pending_ops);
-- fscache_stat(&fscache_n_op_pend);
-+ fscache_stat_unchecked(&fscache_n_op_pend);
- } else if (!list_empty(&object->pending_ops)) {
- atomic_inc(&op->usage);
- list_add_tail(&op->pend_link, &object->pending_ops);
-- fscache_stat(&fscache_n_op_pend);
-+ fscache_stat_unchecked(&fscache_n_op_pend);
- fscache_start_operations(object);
- } else {
- ASSERTCMP(object->n_exclusive, ==, 0);
-@@ -230,12 +230,12 @@ int fscache_submit_op(struct fscache_object *object,
- object->n_ops++;
- atomic_inc(&op->usage);
- list_add_tail(&op->pend_link, &object->pending_ops);
-- fscache_stat(&fscache_n_op_pend);
-+ fscache_stat_unchecked(&fscache_n_op_pend);
- ret = 0;
- } else if (object->state == FSCACHE_OBJECT_DYING ||
- object->state == FSCACHE_OBJECT_LC_DYING ||
- object->state == FSCACHE_OBJECT_WITHDRAWING) {
-- fscache_stat(&fscache_n_op_rejected);
-+ fscache_stat_unchecked(&fscache_n_op_rejected);
- ret = -ENOBUFS;
- } else if (!test_bit(FSCACHE_IOERROR, &object->cache->flags)) {
- fscache_report_unexpected_submission(object, op, ostate);
-@@ -305,7 +305,7 @@ int fscache_cancel_op(struct fscache_operation *op)
-
- ret = -EBUSY;
- if (!list_empty(&op->pend_link)) {
-- fscache_stat(&fscache_n_op_cancelled);
-+ fscache_stat_unchecked(&fscache_n_op_cancelled);
- list_del_init(&op->pend_link);
- object->n_ops--;
- if (test_bit(FSCACHE_OP_EXCLUSIVE, &op->flags))
-@@ -344,7 +344,7 @@ void fscache_put_operation(struct fscache_operation *op)
- if (test_and_set_bit(FSCACHE_OP_DEAD, &op->flags))
- BUG();
-
-- fscache_stat(&fscache_n_op_release);
-+ fscache_stat_unchecked(&fscache_n_op_release);
-
- if (op->release) {
- op->release(op);
-@@ -361,7 +361,7 @@ void fscache_put_operation(struct fscache_operation *op)
- * lock, and defer it otherwise */
- if (!spin_trylock(&object->lock)) {
- _debug("defer put");
-- fscache_stat(&fscache_n_op_deferred_release);
-+ fscache_stat_unchecked(&fscache_n_op_deferred_release);
-
- cache = object->cache;
- spin_lock(&cache->op_gc_list_lock);
-@@ -423,7 +423,7 @@ void fscache_operation_gc(struct work_struct *work)
-
- _debug("GC DEFERRED REL OBJ%x OP%x",
- object->debug_id, op->debug_id);
-- fscache_stat(&fscache_n_op_gc);
-+ fscache_stat_unchecked(&fscache_n_op_gc);
-
- ASSERTCMP(atomic_read(&op->usage), ==, 0);
-
-diff --git a/fs/fscache/page.c b/fs/fscache/page.c
-index c598ea4..6aac13e 100644
---- a/fs/fscache/page.c
-+++ b/fs/fscache/page.c
-@@ -59,7 +59,7 @@ bool __fscache_maybe_release_page(struct fscache_cookie *cookie,
- val = radix_tree_lookup(&cookie->stores, page->index);
- if (!val) {
- rcu_read_unlock();
-- fscache_stat(&fscache_n_store_vmscan_not_storing);
-+ fscache_stat_unchecked(&fscache_n_store_vmscan_not_storing);
- __fscache_uncache_page(cookie, page);
- return true;
- }
-@@ -89,11 +89,11 @@ bool __fscache_maybe_release_page(struct fscache_cookie *cookie,
- spin_unlock(&cookie->stores_lock);
-
- if (xpage) {
-- fscache_stat(&fscache_n_store_vmscan_cancelled);
-- fscache_stat(&fscache_n_store_radix_deletes);
-+ fscache_stat_unchecked(&fscache_n_store_vmscan_cancelled);
-+ fscache_stat_unchecked(&fscache_n_store_radix_deletes);
- ASSERTCMP(xpage, ==, page);
- } else {
-- fscache_stat(&fscache_n_store_vmscan_gone);
-+ fscache_stat_unchecked(&fscache_n_store_vmscan_gone);
- }
-
- wake_up_bit(&cookie->flags, 0);
-@@ -106,7 +106,7 @@ page_busy:
- /* we might want to wait here, but that could deadlock the allocator as
- * the slow-work threads writing to the cache may all end up sleeping
- * on memory allocation */
-- fscache_stat(&fscache_n_store_vmscan_busy);
-+ fscache_stat_unchecked(&fscache_n_store_vmscan_busy);
- return false;
- }
- EXPORT_SYMBOL(__fscache_maybe_release_page);
-@@ -130,7 +130,7 @@ static void fscache_end_page_write(struct fscache_object *object,
- FSCACHE_COOKIE_STORING_TAG);
- if (!radix_tree_tag_get(&cookie->stores, page->index,
- FSCACHE_COOKIE_PENDING_TAG)) {
-- fscache_stat(&fscache_n_store_radix_deletes);
-+ fscache_stat_unchecked(&fscache_n_store_radix_deletes);
- xpage = radix_tree_delete(&cookie->stores, page->index);
- }
- spin_unlock(&cookie->stores_lock);
-@@ -151,7 +151,7 @@ static void fscache_attr_changed_op(struct fscache_operation *op)
-
- _enter("{OBJ%x OP%x}", object->debug_id, op->debug_id);
-
-- fscache_stat(&fscache_n_attr_changed_calls);
-+ fscache_stat_unchecked(&fscache_n_attr_changed_calls);
-
- if (fscache_object_is_active(object)) {
- fscache_set_op_state(op, "CallFS");
-@@ -178,11 +178,11 @@ int __fscache_attr_changed(struct fscache_cookie *cookie)
-
- ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
-
-- fscache_stat(&fscache_n_attr_changed);
-+ fscache_stat_unchecked(&fscache_n_attr_changed);
-
- op = kzalloc(sizeof(*op), GFP_KERNEL);
- if (!op) {
-- fscache_stat(&fscache_n_attr_changed_nomem);
-+ fscache_stat_unchecked(&fscache_n_attr_changed_nomem);
- _leave(" = -ENOMEM");
- return -ENOMEM;
- }
-@@ -202,7 +202,7 @@ int __fscache_attr_changed(struct fscache_cookie *cookie)
- if (fscache_submit_exclusive_op(object, op) < 0)
- goto nobufs;
- spin_unlock(&cookie->lock);
-- fscache_stat(&fscache_n_attr_changed_ok);
-+ fscache_stat_unchecked(&fscache_n_attr_changed_ok);
- fscache_put_operation(op);
- _leave(" = 0");
- return 0;
-@@ -210,7 +210,7 @@ int __fscache_attr_changed(struct fscache_cookie *cookie)
- nobufs:
- spin_unlock(&cookie->lock);
- kfree(op);
-- fscache_stat(&fscache_n_attr_changed_nobufs);
-+ fscache_stat_unchecked(&fscache_n_attr_changed_nobufs);
- _leave(" = %d", -ENOBUFS);
- return -ENOBUFS;
- }
-@@ -264,7 +264,7 @@ static struct fscache_retrieval *fscache_alloc_retrieval(
- /* allocate a retrieval operation and attempt to submit it */
- op = kzalloc(sizeof(*op), GFP_NOIO);
- if (!op) {
-- fscache_stat(&fscache_n_retrievals_nomem);
-+ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
- return NULL;
- }
-
-@@ -294,13 +294,13 @@ static int fscache_wait_for_deferred_lookup(struct fscache_cookie *cookie)
- return 0;
- }
-
-- fscache_stat(&fscache_n_retrievals_wait);
-+ fscache_stat_unchecked(&fscache_n_retrievals_wait);
-
- jif = jiffies;
- if (wait_on_bit(&cookie->flags, FSCACHE_COOKIE_LOOKING_UP,
- fscache_wait_bit_interruptible,
- TASK_INTERRUPTIBLE) != 0) {
-- fscache_stat(&fscache_n_retrievals_intr);
-+ fscache_stat_unchecked(&fscache_n_retrievals_intr);
- _leave(" = -ERESTARTSYS");
- return -ERESTARTSYS;
- }
-@@ -318,8 +318,8 @@ static int fscache_wait_for_deferred_lookup(struct fscache_cookie *cookie)
- */
- static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
- struct fscache_retrieval *op,
-- atomic_t *stat_op_waits,
-- atomic_t *stat_object_dead)
-+ atomic_unchecked_t *stat_op_waits,
-+ atomic_unchecked_t *stat_object_dead)
- {
- int ret;
-
-@@ -327,7 +327,7 @@ static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
- goto check_if_dead;
-
- _debug(">>> WT");
-- fscache_stat(stat_op_waits);
-+ fscache_stat_unchecked(stat_op_waits);
- if (wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
- fscache_wait_bit_interruptible,
- TASK_INTERRUPTIBLE) < 0) {
-@@ -344,7 +344,7 @@ static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
-
- check_if_dead:
- if (unlikely(fscache_object_is_dead(object))) {
-- fscache_stat(stat_object_dead);
-+ fscache_stat_unchecked(stat_object_dead);
- return -ENOBUFS;
- }
- return 0;
-@@ -371,7 +371,7 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
-
- _enter("%p,%p,,,", cookie, page);
-
-- fscache_stat(&fscache_n_retrievals);
-+ fscache_stat_unchecked(&fscache_n_retrievals);
-
- if (hlist_empty(&cookie->backing_objects))
- goto nobufs;
-@@ -405,7 +405,7 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
- goto nobufs_unlock;
- spin_unlock(&cookie->lock);
-
-- fscache_stat(&fscache_n_retrieval_ops);
-+ fscache_stat_unchecked(&fscache_n_retrieval_ops);
-
- /* pin the netfs read context in case we need to do the actual netfs
- * read because we've encountered a cache read failure */
-@@ -435,15 +435,15 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
-
- error:
- if (ret == -ENOMEM)
-- fscache_stat(&fscache_n_retrievals_nomem);
-+ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
- else if (ret == -ERESTARTSYS)
-- fscache_stat(&fscache_n_retrievals_intr);
-+ fscache_stat_unchecked(&fscache_n_retrievals_intr);
- else if (ret == -ENODATA)
-- fscache_stat(&fscache_n_retrievals_nodata);
-+ fscache_stat_unchecked(&fscache_n_retrievals_nodata);
- else if (ret < 0)
-- fscache_stat(&fscache_n_retrievals_nobufs);
-+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
- else
-- fscache_stat(&fscache_n_retrievals_ok);
-+ fscache_stat_unchecked(&fscache_n_retrievals_ok);
-
- fscache_put_retrieval(op);
- _leave(" = %d", ret);
-@@ -453,7 +453,7 @@ nobufs_unlock:
- spin_unlock(&cookie->lock);
- kfree(op);
- nobufs:
-- fscache_stat(&fscache_n_retrievals_nobufs);
-+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
- _leave(" = -ENOBUFS");
- return -ENOBUFS;
- }
-@@ -491,7 +491,7 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
-
- _enter("%p,,%d,,,", cookie, *nr_pages);
-
-- fscache_stat(&fscache_n_retrievals);
-+ fscache_stat_unchecked(&fscache_n_retrievals);
-
- if (hlist_empty(&cookie->backing_objects))
- goto nobufs;
-@@ -522,7 +522,7 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
- goto nobufs_unlock;
- spin_unlock(&cookie->lock);
-
-- fscache_stat(&fscache_n_retrieval_ops);
-+ fscache_stat_unchecked(&fscache_n_retrieval_ops);
-
- /* pin the netfs read context in case we need to do the actual netfs
- * read because we've encountered a cache read failure */
-@@ -552,15 +552,15 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
-
- error:
- if (ret == -ENOMEM)
-- fscache_stat(&fscache_n_retrievals_nomem);
-+ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
- else if (ret == -ERESTARTSYS)
-- fscache_stat(&fscache_n_retrievals_intr);
-+ fscache_stat_unchecked(&fscache_n_retrievals_intr);
- else if (ret == -ENODATA)
-- fscache_stat(&fscache_n_retrievals_nodata);
-+ fscache_stat_unchecked(&fscache_n_retrievals_nodata);
- else if (ret < 0)
-- fscache_stat(&fscache_n_retrievals_nobufs);
-+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
- else
-- fscache_stat(&fscache_n_retrievals_ok);
-+ fscache_stat_unchecked(&fscache_n_retrievals_ok);
-
- fscache_put_retrieval(op);
- _leave(" = %d", ret);
-@@ -570,7 +570,7 @@ nobufs_unlock:
- spin_unlock(&cookie->lock);
- kfree(op);
- nobufs:
-- fscache_stat(&fscache_n_retrievals_nobufs);
-+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
- _leave(" = -ENOBUFS");
- return -ENOBUFS;
- }
-@@ -594,7 +594,7 @@ int __fscache_alloc_page(struct fscache_cookie *cookie,
-
- _enter("%p,%p,,,", cookie, page);
-
-- fscache_stat(&fscache_n_allocs);
-+ fscache_stat_unchecked(&fscache_n_allocs);
-
- if (hlist_empty(&cookie->backing_objects))
- goto nobufs;
-@@ -621,7 +621,7 @@ int __fscache_alloc_page(struct fscache_cookie *cookie,
- goto nobufs_unlock;
- spin_unlock(&cookie->lock);
-
-- fscache_stat(&fscache_n_alloc_ops);
-+ fscache_stat_unchecked(&fscache_n_alloc_ops);
-
- ret = fscache_wait_for_retrieval_activation(
- object, op,
-@@ -637,11 +637,11 @@ int __fscache_alloc_page(struct fscache_cookie *cookie,
-
- error:
- if (ret == -ERESTARTSYS)
-- fscache_stat(&fscache_n_allocs_intr);
-+ fscache_stat_unchecked(&fscache_n_allocs_intr);
- else if (ret < 0)
-- fscache_stat(&fscache_n_allocs_nobufs);
-+ fscache_stat_unchecked(&fscache_n_allocs_nobufs);
- else
-- fscache_stat(&fscache_n_allocs_ok);
-+ fscache_stat_unchecked(&fscache_n_allocs_ok);
-
- fscache_put_retrieval(op);
- _leave(" = %d", ret);
-@@ -651,7 +651,7 @@ nobufs_unlock:
- spin_unlock(&cookie->lock);
- kfree(op);
- nobufs:
-- fscache_stat(&fscache_n_allocs_nobufs);
-+ fscache_stat_unchecked(&fscache_n_allocs_nobufs);
- _leave(" = -ENOBUFS");
- return -ENOBUFS;
- }
-@@ -694,7 +694,7 @@ static void fscache_write_op(struct fscache_operation *_op)
-
- spin_lock(&cookie->stores_lock);
-
-- fscache_stat(&fscache_n_store_calls);
-+ fscache_stat_unchecked(&fscache_n_store_calls);
-
- /* find a page to store */
- page = NULL;
-@@ -705,7 +705,7 @@ static void fscache_write_op(struct fscache_operation *_op)
- page = results[0];
- _debug("gang %d [%lx]", n, page->index);
- if (page->index > op->store_limit) {
-- fscache_stat(&fscache_n_store_pages_over_limit);
-+ fscache_stat_unchecked(&fscache_n_store_pages_over_limit);
- goto superseded;
- }
-
-@@ -721,7 +721,7 @@ static void fscache_write_op(struct fscache_operation *_op)
-
- if (page) {
- fscache_set_op_state(&op->op, "Store");
-- fscache_stat(&fscache_n_store_pages);
-+ fscache_stat_unchecked(&fscache_n_store_pages);
- fscache_stat(&fscache_n_cop_write_page);
- ret = object->cache->ops->write_page(op, page);
- fscache_stat_d(&fscache_n_cop_write_page);
-@@ -792,7 +792,7 @@ int __fscache_write_page(struct fscache_cookie *cookie,
- ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
- ASSERT(PageFsCache(page));
-
-- fscache_stat(&fscache_n_stores);
-+ fscache_stat_unchecked(&fscache_n_stores);
-
- op = kzalloc(sizeof(*op), GFP_NOIO);
- if (!op)
-@@ -844,7 +844,7 @@ int __fscache_write_page(struct fscache_cookie *cookie,
- spin_unlock(&cookie->stores_lock);
- spin_unlock(&object->lock);
-
-- op->op.debug_id = atomic_inc_return(&fscache_op_debug_id);
-+ op->op.debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
- op->store_limit = object->store_limit;
-
- if (fscache_submit_op(object, &op->op) < 0)
-@@ -852,8 +852,8 @@ int __fscache_write_page(struct fscache_cookie *cookie,
-
- spin_unlock(&cookie->lock);
- radix_tree_preload_end();
-- fscache_stat(&fscache_n_store_ops);
-- fscache_stat(&fscache_n_stores_ok);
-+ fscache_stat_unchecked(&fscache_n_store_ops);
-+ fscache_stat_unchecked(&fscache_n_stores_ok);
-
- /* the slow work queue now carries its own ref on the object */
- fscache_put_operation(&op->op);
-@@ -861,14 +861,14 @@ int __fscache_write_page(struct fscache_cookie *cookie,
- return 0;
-
- already_queued:
-- fscache_stat(&fscache_n_stores_again);
-+ fscache_stat_unchecked(&fscache_n_stores_again);
- already_pending:
- spin_unlock(&cookie->stores_lock);
- spin_unlock(&object->lock);
- spin_unlock(&cookie->lock);
- radix_tree_preload_end();
- kfree(op);
-- fscache_stat(&fscache_n_stores_ok);
-+ fscache_stat_unchecked(&fscache_n_stores_ok);
- _leave(" = 0");
- return 0;
-
-@@ -886,14 +886,14 @@ nobufs:
- spin_unlock(&cookie->lock);
- radix_tree_preload_end();
- kfree(op);
-- fscache_stat(&fscache_n_stores_nobufs);
-+ fscache_stat_unchecked(&fscache_n_stores_nobufs);
- _leave(" = -ENOBUFS");
- return -ENOBUFS;
-
- nomem_free:
- kfree(op);
- nomem:
-- fscache_stat(&fscache_n_stores_oom);
-+ fscache_stat_unchecked(&fscache_n_stores_oom);
- _leave(" = -ENOMEM");
- return -ENOMEM;
- }
-@@ -911,7 +911,7 @@ void __fscache_uncache_page(struct fscache_cookie *cookie, struct page *page)
- ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
- ASSERTCMP(page, !=, NULL);
-
-- fscache_stat(&fscache_n_uncaches);
-+ fscache_stat_unchecked(&fscache_n_uncaches);
-
- /* cache withdrawal may beat us to it */
- if (!PageFsCache(page))
-@@ -964,7 +964,7 @@ void fscache_mark_pages_cached(struct fscache_retrieval *op,
- unsigned long loop;
-
- #ifdef CONFIG_FSCACHE_STATS
-- atomic_add(pagevec->nr, &fscache_n_marks);
-+ atomic_add_unchecked(pagevec->nr, &fscache_n_marks);
- #endif
-
- for (loop = 0; loop < pagevec->nr; loop++) {
-diff --git a/fs/fscache/stats.c b/fs/fscache/stats.c
-index 4fd7e1c..85f33b3 100644
---- a/fs/fscache/stats.c
-+++ b/fs/fscache/stats.c
-@@ -18,95 +18,95 @@
- /*
- * operation counters
- */
--atomic_t fscache_n_op_pend;
--atomic_t fscache_n_op_run;
--atomic_t fscache_n_op_enqueue;
--atomic_t fscache_n_op_requeue;
--atomic_t fscache_n_op_deferred_release;
--atomic_t fscache_n_op_release;
--atomic_t fscache_n_op_gc;
--atomic_t fscache_n_op_cancelled;
--atomic_t fscache_n_op_rejected;
-+atomic_unchecked_t fscache_n_op_pend;
-+atomic_unchecked_t fscache_n_op_run;
-+atomic_unchecked_t fscache_n_op_enqueue;
-+atomic_unchecked_t fscache_n_op_requeue;
-+atomic_unchecked_t fscache_n_op_deferred_release;
-+atomic_unchecked_t fscache_n_op_release;
-+atomic_unchecked_t fscache_n_op_gc;
-+atomic_unchecked_t fscache_n_op_cancelled;
-+atomic_unchecked_t fscache_n_op_rejected;
-
--atomic_t fscache_n_attr_changed;
--atomic_t fscache_n_attr_changed_ok;
--atomic_t fscache_n_attr_changed_nobufs;
--atomic_t fscache_n_attr_changed_nomem;
--atomic_t fscache_n_attr_changed_calls;
-+atomic_unchecked_t fscache_n_attr_changed;
-+atomic_unchecked_t fscache_n_attr_changed_ok;
-+atomic_unchecked_t fscache_n_attr_changed_nobufs;
-+atomic_unchecked_t fscache_n_attr_changed_nomem;
-+atomic_unchecked_t fscache_n_attr_changed_calls;
-
--atomic_t fscache_n_allocs;
--atomic_t fscache_n_allocs_ok;
--atomic_t fscache_n_allocs_wait;
--atomic_t fscache_n_allocs_nobufs;
--atomic_t fscache_n_allocs_intr;
--atomic_t fscache_n_allocs_object_dead;
--atomic_t fscache_n_alloc_ops;
--atomic_t fscache_n_alloc_op_waits;
-+atomic_unchecked_t fscache_n_allocs;
-+atomic_unchecked_t fscache_n_allocs_ok;
-+atomic_unchecked_t fscache_n_allocs_wait;
-+atomic_unchecked_t fscache_n_allocs_nobufs;
-+atomic_unchecked_t fscache_n_allocs_intr;
-+atomic_unchecked_t fscache_n_allocs_object_dead;
-+atomic_unchecked_t fscache_n_alloc_ops;
-+atomic_unchecked_t fscache_n_alloc_op_waits;
-
--atomic_t fscache_n_retrievals;
--atomic_t fscache_n_retrievals_ok;
--atomic_t fscache_n_retrievals_wait;
--atomic_t fscache_n_retrievals_nodata;
--atomic_t fscache_n_retrievals_nobufs;
--atomic_t fscache_n_retrievals_intr;
--atomic_t fscache_n_retrievals_nomem;
--atomic_t fscache_n_retrievals_object_dead;
--atomic_t fscache_n_retrieval_ops;
--atomic_t fscache_n_retrieval_op_waits;
-+atomic_unchecked_t fscache_n_retrievals;
-+atomic_unchecked_t fscache_n_retrievals_ok;
-+atomic_unchecked_t fscache_n_retrievals_wait;
-+atomic_unchecked_t fscache_n_retrievals_nodata;
-+atomic_unchecked_t fscache_n_retrievals_nobufs;
-+atomic_unchecked_t fscache_n_retrievals_intr;
-+atomic_unchecked_t fscache_n_retrievals_nomem;
-+atomic_unchecked_t fscache_n_retrievals_object_dead;
-+atomic_unchecked_t fscache_n_retrieval_ops;
-+atomic_unchecked_t fscache_n_retrieval_op_waits;
-
--atomic_t fscache_n_stores;
--atomic_t fscache_n_stores_ok;
--atomic_t fscache_n_stores_again;
--atomic_t fscache_n_stores_nobufs;
--atomic_t fscache_n_stores_oom;
--atomic_t fscache_n_store_ops;
--atomic_t fscache_n_store_calls;
--atomic_t fscache_n_store_pages;
--atomic_t fscache_n_store_radix_deletes;
--atomic_t fscache_n_store_pages_over_limit;
-+atomic_unchecked_t fscache_n_stores;
-+atomic_unchecked_t fscache_n_stores_ok;
-+atomic_unchecked_t fscache_n_stores_again;
-+atomic_unchecked_t fscache_n_stores_nobufs;
-+atomic_unchecked_t fscache_n_stores_oom;
-+atomic_unchecked_t fscache_n_store_ops;
-+atomic_unchecked_t fscache_n_store_calls;
-+atomic_unchecked_t fscache_n_store_pages;
-+atomic_unchecked_t fscache_n_store_radix_deletes;
-+atomic_unchecked_t fscache_n_store_pages_over_limit;
-
--atomic_t fscache_n_store_vmscan_not_storing;
--atomic_t fscache_n_store_vmscan_gone;
--atomic_t fscache_n_store_vmscan_busy;
--atomic_t fscache_n_store_vmscan_cancelled;
-+atomic_unchecked_t fscache_n_store_vmscan_not_storing;
-+atomic_unchecked_t fscache_n_store_vmscan_gone;
-+atomic_unchecked_t fscache_n_store_vmscan_busy;
-+atomic_unchecked_t fscache_n_store_vmscan_cancelled;
-
--atomic_t fscache_n_marks;
--atomic_t fscache_n_uncaches;
-+atomic_unchecked_t fscache_n_marks;
-+atomic_unchecked_t fscache_n_uncaches;
-
--atomic_t fscache_n_acquires;
--atomic_t fscache_n_acquires_null;
--atomic_t fscache_n_acquires_no_cache;
--atomic_t fscache_n_acquires_ok;
--atomic_t fscache_n_acquires_nobufs;
--atomic_t fscache_n_acquires_oom;
-+atomic_unchecked_t fscache_n_acquires;
-+atomic_unchecked_t fscache_n_acquires_null;
-+atomic_unchecked_t fscache_n_acquires_no_cache;
-+atomic_unchecked_t fscache_n_acquires_ok;
-+atomic_unchecked_t fscache_n_acquires_nobufs;
-+atomic_unchecked_t fscache_n_acquires_oom;
-
--atomic_t fscache_n_updates;
--atomic_t fscache_n_updates_null;
--atomic_t fscache_n_updates_run;
-+atomic_unchecked_t fscache_n_updates;
-+atomic_unchecked_t fscache_n_updates_null;
-+atomic_unchecked_t fscache_n_updates_run;
-
--atomic_t fscache_n_relinquishes;
--atomic_t fscache_n_relinquishes_null;
--atomic_t fscache_n_relinquishes_waitcrt;
--atomic_t fscache_n_relinquishes_retire;
-+atomic_unchecked_t fscache_n_relinquishes;
-+atomic_unchecked_t fscache_n_relinquishes_null;
-+atomic_unchecked_t fscache_n_relinquishes_waitcrt;
-+atomic_unchecked_t fscache_n_relinquishes_retire;
-
--atomic_t fscache_n_cookie_index;
--atomic_t fscache_n_cookie_data;
--atomic_t fscache_n_cookie_special;
-+atomic_unchecked_t fscache_n_cookie_index;
-+atomic_unchecked_t fscache_n_cookie_data;
-+atomic_unchecked_t fscache_n_cookie_special;
-
--atomic_t fscache_n_object_alloc;
--atomic_t fscache_n_object_no_alloc;
--atomic_t fscache_n_object_lookups;
--atomic_t fscache_n_object_lookups_negative;
--atomic_t fscache_n_object_lookups_positive;
--atomic_t fscache_n_object_lookups_timed_out;
--atomic_t fscache_n_object_created;
--atomic_t fscache_n_object_avail;
--atomic_t fscache_n_object_dead;
-+atomic_unchecked_t fscache_n_object_alloc;
-+atomic_unchecked_t fscache_n_object_no_alloc;
-+atomic_unchecked_t fscache_n_object_lookups;
-+atomic_unchecked_t fscache_n_object_lookups_negative;
-+atomic_unchecked_t fscache_n_object_lookups_positive;
-+atomic_unchecked_t fscache_n_object_lookups_timed_out;
-+atomic_unchecked_t fscache_n_object_created;
-+atomic_unchecked_t fscache_n_object_avail;
-+atomic_unchecked_t fscache_n_object_dead;
-
--atomic_t fscache_n_checkaux_none;
--atomic_t fscache_n_checkaux_okay;
--atomic_t fscache_n_checkaux_update;
--atomic_t fscache_n_checkaux_obsolete;
-+atomic_unchecked_t fscache_n_checkaux_none;
-+atomic_unchecked_t fscache_n_checkaux_okay;
-+atomic_unchecked_t fscache_n_checkaux_update;
-+atomic_unchecked_t fscache_n_checkaux_obsolete;
-
- atomic_t fscache_n_cop_alloc_object;
- atomic_t fscache_n_cop_lookup_object;
-@@ -133,113 +133,113 @@ static int fscache_stats_show(struct seq_file *m, void *v)
- seq_puts(m, "FS-Cache statistics\n");
-
- seq_printf(m, "Cookies: idx=%u dat=%u spc=%u\n",
-- atomic_read(&fscache_n_cookie_index),
-- atomic_read(&fscache_n_cookie_data),
-- atomic_read(&fscache_n_cookie_special));
-+ atomic_read_unchecked(&fscache_n_cookie_index),
-+ atomic_read_unchecked(&fscache_n_cookie_data),
-+ atomic_read_unchecked(&fscache_n_cookie_special));
-
- seq_printf(m, "Objects: alc=%u nal=%u avl=%u ded=%u\n",
-- atomic_read(&fscache_n_object_alloc),
-- atomic_read(&fscache_n_object_no_alloc),
-- atomic_read(&fscache_n_object_avail),
-- atomic_read(&fscache_n_object_dead));
-+ atomic_read_unchecked(&fscache_n_object_alloc),
-+ atomic_read_unchecked(&fscache_n_object_no_alloc),
-+ atomic_read_unchecked(&fscache_n_object_avail),
-+ atomic_read_unchecked(&fscache_n_object_dead));
- seq_printf(m, "ChkAux : non=%u ok=%u upd=%u obs=%u\n",
-- atomic_read(&fscache_n_checkaux_none),
-- atomic_read(&fscache_n_checkaux_okay),
-- atomic_read(&fscache_n_checkaux_update),
-- atomic_read(&fscache_n_checkaux_obsolete));
-+ atomic_read_unchecked(&fscache_n_checkaux_none),
-+ atomic_read_unchecked(&fscache_n_checkaux_okay),
-+ atomic_read_unchecked(&fscache_n_checkaux_update),
-+ atomic_read_unchecked(&fscache_n_checkaux_obsolete));
-
- seq_printf(m, "Pages : mrk=%u unc=%u\n",
-- atomic_read(&fscache_n_marks),
-- atomic_read(&fscache_n_uncaches));
-+ atomic_read_unchecked(&fscache_n_marks),
-+ atomic_read_unchecked(&fscache_n_uncaches));
-
- seq_printf(m, "Acquire: n=%u nul=%u noc=%u ok=%u nbf=%u"
- " oom=%u\n",
-- atomic_read(&fscache_n_acquires),
-- atomic_read(&fscache_n_acquires_null),
-- atomic_read(&fscache_n_acquires_no_cache),
-- atomic_read(&fscache_n_acquires_ok),
-- atomic_read(&fscache_n_acquires_nobufs),
-- atomic_read(&fscache_n_acquires_oom));
-+ atomic_read_unchecked(&fscache_n_acquires),
-+ atomic_read_unchecked(&fscache_n_acquires_null),
-+ atomic_read_unchecked(&fscache_n_acquires_no_cache),
-+ atomic_read_unchecked(&fscache_n_acquires_ok),
-+ atomic_read_unchecked(&fscache_n_acquires_nobufs),
-+ atomic_read_unchecked(&fscache_n_acquires_oom));
-
- seq_printf(m, "Lookups: n=%u neg=%u pos=%u crt=%u tmo=%u\n",
-- atomic_read(&fscache_n_object_lookups),
-- atomic_read(&fscache_n_object_lookups_negative),
-- atomic_read(&fscache_n_object_lookups_positive),
-- atomic_read(&fscache_n_object_lookups_timed_out),
-- atomic_read(&fscache_n_object_created));
-+ atomic_read_unchecked(&fscache_n_object_lookups),
-+ atomic_read_unchecked(&fscache_n_object_lookups_negative),
-+ atomic_read_unchecked(&fscache_n_object_lookups_positive),
-+ atomic_read_unchecked(&fscache_n_object_lookups_timed_out),
-+ atomic_read_unchecked(&fscache_n_object_created));
-
- seq_printf(m, "Updates: n=%u nul=%u run=%u\n",
-- atomic_read(&fscache_n_updates),
-- atomic_read(&fscache_n_updates_null),
-- atomic_read(&fscache_n_updates_run));
-+ atomic_read_unchecked(&fscache_n_updates),
-+ atomic_read_unchecked(&fscache_n_updates_null),
-+ atomic_read_unchecked(&fscache_n_updates_run));
-
- seq_printf(m, "Relinqs: n=%u nul=%u wcr=%u rtr=%u\n",
-- atomic_read(&fscache_n_relinquishes),
-- atomic_read(&fscache_n_relinquishes_null),
-- atomic_read(&fscache_n_relinquishes_waitcrt),
-- atomic_read(&fscache_n_relinquishes_retire));
-+ atomic_read_unchecked(&fscache_n_relinquishes),
-+ atomic_read_unchecked(&fscache_n_relinquishes_null),
-+ atomic_read_unchecked(&fscache_n_relinquishes_waitcrt),
-+ atomic_read_unchecked(&fscache_n_relinquishes_retire));
-
- seq_printf(m, "AttrChg: n=%u ok=%u nbf=%u oom=%u run=%u\n",
-- atomic_read(&fscache_n_attr_changed),
-- atomic_read(&fscache_n_attr_changed_ok),
-- atomic_read(&fscache_n_attr_changed_nobufs),
-- atomic_read(&fscache_n_attr_changed_nomem),
-- atomic_read(&fscache_n_attr_changed_calls));
-+ atomic_read_unchecked(&fscache_n_attr_changed),
-+ atomic_read_unchecked(&fscache_n_attr_changed_ok),
-+ atomic_read_unchecked(&fscache_n_attr_changed_nobufs),
-+ atomic_read_unchecked(&fscache_n_attr_changed_nomem),
-+ atomic_read_unchecked(&fscache_n_attr_changed_calls));
-
- seq_printf(m, "Allocs : n=%u ok=%u wt=%u nbf=%u int=%u\n",
-- atomic_read(&fscache_n_allocs),
-- atomic_read(&fscache_n_allocs_ok),
-- atomic_read(&fscache_n_allocs_wait),
-- atomic_read(&fscache_n_allocs_nobufs),
-- atomic_read(&fscache_n_allocs_intr));
-+ atomic_read_unchecked(&fscache_n_allocs),
-+ atomic_read_unchecked(&fscache_n_allocs_ok),
-+ atomic_read_unchecked(&fscache_n_allocs_wait),
-+ atomic_read_unchecked(&fscache_n_allocs_nobufs),
-+ atomic_read_unchecked(&fscache_n_allocs_intr));
- seq_printf(m, "Allocs : ops=%u owt=%u abt=%u\n",
-- atomic_read(&fscache_n_alloc_ops),
-- atomic_read(&fscache_n_alloc_op_waits),
-- atomic_read(&fscache_n_allocs_object_dead));
-+ atomic_read_unchecked(&fscache_n_alloc_ops),
-+ atomic_read_unchecked(&fscache_n_alloc_op_waits),
-+ atomic_read_unchecked(&fscache_n_allocs_object_dead));
-
- seq_printf(m, "Retrvls: n=%u ok=%u wt=%u nod=%u nbf=%u"
- " int=%u oom=%u\n",
-- atomic_read(&fscache_n_retrievals),
-- atomic_read(&fscache_n_retrievals_ok),
-- atomic_read(&fscache_n_retrievals_wait),
-- atomic_read(&fscache_n_retrievals_nodata),
-- atomic_read(&fscache_n_retrievals_nobufs),
-- atomic_read(&fscache_n_retrievals_intr),
-- atomic_read(&fscache_n_retrievals_nomem));
-+ atomic_read_unchecked(&fscache_n_retrievals),
-+ atomic_read_unchecked(&fscache_n_retrievals_ok),
-+ atomic_read_unchecked(&fscache_n_retrievals_wait),
-+ atomic_read_unchecked(&fscache_n_retrievals_nodata),
-+ atomic_read_unchecked(&fscache_n_retrievals_nobufs),
-+ atomic_read_unchecked(&fscache_n_retrievals_intr),
-+ atomic_read_unchecked(&fscache_n_retrievals_nomem));
- seq_printf(m, "Retrvls: ops=%u owt=%u abt=%u\n",
-- atomic_read(&fscache_n_retrieval_ops),
-- atomic_read(&fscache_n_retrieval_op_waits),
-- atomic_read(&fscache_n_retrievals_object_dead));
-+ atomic_read_unchecked(&fscache_n_retrieval_ops),
-+ atomic_read_unchecked(&fscache_n_retrieval_op_waits),
-+ atomic_read_unchecked(&fscache_n_retrievals_object_dead));
-
- seq_printf(m, "Stores : n=%u ok=%u agn=%u nbf=%u oom=%u\n",
-- atomic_read(&fscache_n_stores),
-- atomic_read(&fscache_n_stores_ok),
-- atomic_read(&fscache_n_stores_again),
-- atomic_read(&fscache_n_stores_nobufs),
-- atomic_read(&fscache_n_stores_oom));
-+ atomic_read_unchecked(&fscache_n_stores),
-+ atomic_read_unchecked(&fscache_n_stores_ok),
-+ atomic_read_unchecked(&fscache_n_stores_again),
-+ atomic_read_unchecked(&fscache_n_stores_nobufs),
-+ atomic_read_unchecked(&fscache_n_stores_oom));
- seq_printf(m, "Stores : ops=%u run=%u pgs=%u rxd=%u olm=%u\n",
-- atomic_read(&fscache_n_store_ops),
-- atomic_read(&fscache_n_store_calls),
-- atomic_read(&fscache_n_store_pages),
-- atomic_read(&fscache_n_store_radix_deletes),
-- atomic_read(&fscache_n_store_pages_over_limit));
-+ atomic_read_unchecked(&fscache_n_store_ops),
-+ atomic_read_unchecked(&fscache_n_store_calls),
-+ atomic_read_unchecked(&fscache_n_store_pages),
-+ atomic_read_unchecked(&fscache_n_store_radix_deletes),
-+ atomic_read_unchecked(&fscache_n_store_pages_over_limit));
-
- seq_printf(m, "VmScan : nos=%u gon=%u bsy=%u can=%u\n",
-- atomic_read(&fscache_n_store_vmscan_not_storing),
-- atomic_read(&fscache_n_store_vmscan_gone),
-- atomic_read(&fscache_n_store_vmscan_busy),
-- atomic_read(&fscache_n_store_vmscan_cancelled));
-+ atomic_read_unchecked(&fscache_n_store_vmscan_not_storing),
-+ atomic_read_unchecked(&fscache_n_store_vmscan_gone),
-+ atomic_read_unchecked(&fscache_n_store_vmscan_busy),
-+ atomic_read_unchecked(&fscache_n_store_vmscan_cancelled));
-
- seq_printf(m, "Ops : pend=%u run=%u enq=%u can=%u rej=%u\n",
-- atomic_read(&fscache_n_op_pend),
-- atomic_read(&fscache_n_op_run),
-- atomic_read(&fscache_n_op_enqueue),
-- atomic_read(&fscache_n_op_cancelled),
-- atomic_read(&fscache_n_op_rejected));
-+ atomic_read_unchecked(&fscache_n_op_pend),
-+ atomic_read_unchecked(&fscache_n_op_run),
-+ atomic_read_unchecked(&fscache_n_op_enqueue),
-+ atomic_read_unchecked(&fscache_n_op_cancelled),
-+ atomic_read_unchecked(&fscache_n_op_rejected));
- seq_printf(m, "Ops : dfr=%u rel=%u gc=%u\n",
-- atomic_read(&fscache_n_op_deferred_release),
-- atomic_read(&fscache_n_op_release),
-- atomic_read(&fscache_n_op_gc));
-+ atomic_read_unchecked(&fscache_n_op_deferred_release),
-+ atomic_read_unchecked(&fscache_n_op_release),
-+ atomic_read_unchecked(&fscache_n_op_gc));
-
- seq_printf(m, "CacheOp: alo=%d luo=%d luc=%d gro=%d\n",
- atomic_read(&fscache_n_cop_alloc_object),
-diff --git a/fs/fuse/cuse.c b/fs/fuse/cuse.c
-index de792dc..448b532 100644
---- a/fs/fuse/cuse.c
-+++ b/fs/fuse/cuse.c
-@@ -576,10 +576,12 @@ static int __init cuse_init(void)
- INIT_LIST_HEAD(&cuse_conntbl[i]);
-
- /* inherit and extend fuse_dev_operations */
-- cuse_channel_fops = fuse_dev_operations;
-- cuse_channel_fops.owner = THIS_MODULE;
-- cuse_channel_fops.open = cuse_channel_open;
-- cuse_channel_fops.release = cuse_channel_release;
-+ pax_open_kernel();
-+ memcpy((void *)&cuse_channel_fops, &fuse_dev_operations, sizeof(fuse_dev_operations));
-+ *(void **)&cuse_channel_fops.owner = THIS_MODULE;
-+ *(void **)&cuse_channel_fops.open = cuse_channel_open;
-+ *(void **)&cuse_channel_fops.release = cuse_channel_release;
-+ pax_close_kernel();
-
- cuse_class = class_create(THIS_MODULE, "cuse");
- if (IS_ERR(cuse_class))
-diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
-index 1facb395..7f48557 100644
---- a/fs/fuse/dev.c
-+++ b/fs/fuse/dev.c
-@@ -885,7 +885,7 @@ static int fuse_notify_inval_entry(struct fuse_conn *fc, unsigned int size,
- {
- struct fuse_notify_inval_entry_out outarg;
- int err = -EINVAL;
-- char buf[FUSE_NAME_MAX+1];
-+ char *buf = NULL;
- struct qstr name;
-
- if (size < sizeof(outarg))
-@@ -899,6 +899,11 @@ static int fuse_notify_inval_entry(struct fuse_conn *fc, unsigned int size,
- if (outarg.namelen > FUSE_NAME_MAX)
- goto err;
-
-+ err = -ENOMEM;
-+ buf = kmalloc(FUSE_NAME_MAX+1, GFP_KERNEL);
-+ if (!buf)
-+ goto err;
-+
- err = -EINVAL;
- if (size != sizeof(outarg) + outarg.namelen + 1)
- goto err;
-@@ -914,17 +919,15 @@ static int fuse_notify_inval_entry(struct fuse_conn *fc, unsigned int size,
-
- down_read(&fc->killsb);
- err = -ENOENT;
-- if (!fc->sb)
-- goto err_unlock;
--
-- err = fuse_reverse_inval_entry(fc->sb, outarg.parent, &name);
--
--err_unlock:
-+ if (fc->sb)
-+ err = fuse_reverse_inval_entry(fc->sb, outarg.parent, &name);
- up_read(&fc->killsb);
-+ kfree(buf);
- return err;
-
- err:
- fuse_copy_finish(cs);
-+ kfree(buf);
- return err;
- }
-
-diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
-index b359543..d212be4 100644
---- a/fs/fuse/dir.c
-+++ b/fs/fuse/dir.c
-@@ -1128,7 +1128,7 @@ static char *read_link(struct dentry *dentry)
- return link;
- }
-
--static void free_link(char *link)
-+static void free_link(const char *link)
- {
- if (!IS_ERR(link))
- free_page((unsigned long) link);
-diff --git a/fs/gfs2/dir.c b/fs/gfs2/dir.c
-index 0bb3129..6904644 100644
---- a/fs/gfs2/dir.c
-+++ b/fs/gfs2/dir.c
-@@ -1095,7 +1095,7 @@ static int dir_double_exhash(struct gfs2_inode *dip)
-
- /* Allocate both the "from" and "to" buffers in one big chunk */
-
-- buf = kcalloc(3, sdp->sd_hash_bsize, GFP_NOFS | __GFP_NOFAIL);
-+ buf = kcalloc(sdp->sd_hash_bsize, 3, GFP_NOFS | __GFP_NOFAIL);
-
- for (block = dip->i_disksize >> sdp->sd_hash_bsize_shift; block--;) {
- error = gfs2_dir_read_data(dip, (char *)buf,
-diff --git a/fs/gfs2/ops_inode.c b/fs/gfs2/ops_inode.c
-index 247436c..e650ccb 100644
---- a/fs/gfs2/ops_inode.c
-+++ b/fs/gfs2/ops_inode.c
-@@ -752,6 +752,8 @@ static int gfs2_rename(struct inode *odir, struct dentry *odentry,
- unsigned int x;
- int error;
-
-+ pax_track_stack();
-+
- if (ndentry->d_inode) {
- nip = GFS2_I(ndentry->d_inode);
- if (ip == nip)
-diff --git a/fs/gfs2/sys.c b/fs/gfs2/sys.c
-index 4463297..4fed53b 100644
---- a/fs/gfs2/sys.c
-+++ b/fs/gfs2/sys.c
-@@ -49,7 +49,7 @@ static ssize_t gfs2_attr_store(struct kobject *kobj, struct attribute *attr,
- return a->store ? a->store(sdp, buf, len) : len;
- }
-
--static struct sysfs_ops gfs2_attr_ops = {
-+static const struct sysfs_ops gfs2_attr_ops = {
- .show = gfs2_attr_show,
- .store = gfs2_attr_store,
- };
-@@ -584,7 +584,7 @@ static int gfs2_uevent(struct kset *kset, struct kobject *kobj,
- return 0;
- }
-
--static struct kset_uevent_ops gfs2_uevent_ops = {
-+static const struct kset_uevent_ops gfs2_uevent_ops = {
- .uevent = gfs2_uevent,
- };
-
-diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c
-index a0786c6..46904bd 100644
---- a/fs/hfsplus/catalog.c
-+++ b/fs/hfsplus/catalog.c
-@@ -157,6 +157,8 @@ int hfsplus_find_cat(struct super_block *sb, u32 cnid,
- int err;
- u16 type;
-
-+ pax_track_stack();
-+
- hfsplus_cat_build_key(sb, fd->search_key, cnid, NULL);
- err = hfs_brec_read(fd, &tmp, sizeof(hfsplus_cat_entry));
- if (err)
-@@ -186,6 +188,8 @@ int hfsplus_create_cat(u32 cnid, struct inode *dir, struct qstr *str, struct ino
- int entry_size;
- int err;
-
-+ pax_track_stack();
-+
- dprint(DBG_CAT_MOD, "create_cat: %s,%u(%d)\n", str->name, cnid, inode->i_nlink);
- sb = dir->i_sb;
- hfs_find_init(HFSPLUS_SB(sb).cat_tree, &fd);
-@@ -318,6 +322,8 @@ int hfsplus_rename_cat(u32 cnid,
- int entry_size, type;
- int err = 0;
-
-+ pax_track_stack();
-+
- dprint(DBG_CAT_MOD, "rename_cat: %u - %lu,%s - %lu,%s\n", cnid, src_dir->i_ino, src_name->name,
- dst_dir->i_ino, dst_name->name);
- sb = src_dir->i_sb;
-diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c
-index f4300ff7..6ec38b2 100644
---- a/fs/hfsplus/dir.c
-+++ b/fs/hfsplus/dir.c
-@@ -121,6 +121,8 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir)
- struct hfsplus_readdir_data *rd;
- u16 type;
-
-+ pax_track_stack();
-+
- if (filp->f_pos >= inode->i_size)
- return 0;
-
-diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c
-index 1bcf597..905a251 100644
---- a/fs/hfsplus/inode.c
-+++ b/fs/hfsplus/inode.c
-@@ -399,6 +399,8 @@ int hfsplus_cat_read_inode(struct inode *inode, struct hfs_find_data *fd)
- int res = 0;
- u16 type;
-
-+ pax_track_stack();
-+
- type = hfs_bnode_read_u16(fd->bnode, fd->entryoffset);
-
- HFSPLUS_I(inode).dev = 0;
-@@ -461,6 +463,8 @@ int hfsplus_cat_write_inode(struct inode *inode)
- struct hfs_find_data fd;
- hfsplus_cat_entry entry;
-
-+ pax_track_stack();
-+
- if (HFSPLUS_IS_RSRC(inode))
- main_inode = HFSPLUS_I(inode).rsrc_inode;
-
-diff --git a/fs/hfsplus/ioctl.c b/fs/hfsplus/ioctl.c
-index f457d2c..7ef4ad5 100644
---- a/fs/hfsplus/ioctl.c
-+++ b/fs/hfsplus/ioctl.c
-@@ -101,6 +101,8 @@ int hfsplus_setxattr(struct dentry *dentry, const char *name,
- struct hfsplus_cat_file *file;
- int res;
-
-+ pax_track_stack();
-+
- if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
- return -EOPNOTSUPP;
-
-@@ -143,6 +145,8 @@ ssize_t hfsplus_getxattr(struct dentry *dentry, const char *name,
- struct hfsplus_cat_file *file;
- ssize_t res = 0;
-
-+ pax_track_stack();
-+
- if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
- return -EOPNOTSUPP;
-
-diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
-index 43022f3..7298079 100644
---- a/fs/hfsplus/super.c
-+++ b/fs/hfsplus/super.c
-@@ -312,6 +312,8 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
- struct nls_table *nls = NULL;
- int err = -EINVAL;
-
-+ pax_track_stack();
-+
- sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
- if (!sbi)
- return -ENOMEM;
-diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
-index 2179de8..78ccc77 100644
---- a/fs/hugetlbfs/inode.c
-+++ b/fs/hugetlbfs/inode.c
-@@ -134,6 +134,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
- struct vm_area_struct *vma;
- unsigned long start_addr;
- struct hstate *h = hstate_file(file);
-+ unsigned long offset = gr_rand_threadstack_offset(mm, file, flags);
-
- if (len & ~huge_page_mask(h))
- return -EINVAL;
-@@ -146,6 +147,10 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
- return addr;
- }
-
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- if (addr) {
- addr = ALIGN(addr, huge_page_size(h));
- vma = find_vma(mm, addr);
-@@ -157,7 +162,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
- start_addr = mm->free_area_cache;
-
- if (len <= mm->cached_hole_size)
-- start_addr = TASK_UNMAPPED_BASE;
-+ start_addr = mm->mmap_base;
-
- full_search:
- addr = ALIGN(start_addr, huge_page_size(h));
-@@ -169,15 +174,17 @@ full_search:
- * Start a new search - just in case we missed
- * some holes.
- */
-- if (start_addr != TASK_UNMAPPED_BASE) {
-- start_addr = TASK_UNMAPPED_BASE;
-+ if (start_addr != mm->mmap_base) {
-+ start_addr = mm->mmap_base;
- goto full_search;
- }
- return -ENOMEM;
- }
-
-- if (!vma || addr + len <= vma->vm_start)
-+ if (check_heap_stack_gap(vma, &addr, len, offset)) {
-+ mm->free_area_cache = addr + len;
- return addr;
-+ }
- addr = ALIGN(vma->vm_end, huge_page_size(h));
- }
- }
-@@ -897,7 +904,7 @@ static struct file_system_type hugetlbfs_fs_type = {
- .kill_sb = kill_litter_super,
- };
-
--static struct vfsmount *hugetlbfs_vfsmount;
-+struct vfsmount *hugetlbfs_vfsmount;
-
- static int can_do_hugetlb_shm(void)
- {
-diff --git a/fs/ioctl.c b/fs/ioctl.c
-index 6c75110..19d2c3c 100644
---- a/fs/ioctl.c
-+++ b/fs/ioctl.c
-@@ -97,7 +97,7 @@ int fiemap_fill_next_extent(struct fiemap_extent_info *fieinfo, u64 logical,
- u64 phys, u64 len, u32 flags)
- {
- struct fiemap_extent extent;
-- struct fiemap_extent *dest = fieinfo->fi_extents_start;
-+ struct fiemap_extent __user *dest = fieinfo->fi_extents_start;
-
- /* only count the extents */
- if (fieinfo->fi_extents_max == 0) {
-@@ -207,7 +207,7 @@ static int ioctl_fiemap(struct file *filp, unsigned long arg)
-
- fieinfo.fi_flags = fiemap.fm_flags;
- fieinfo.fi_extents_max = fiemap.fm_extent_count;
-- fieinfo.fi_extents_start = (struct fiemap_extent *)(arg + sizeof(fiemap));
-+ fieinfo.fi_extents_start = (struct fiemap_extent __user *)(arg + sizeof(fiemap));
-
- if (fiemap.fm_extent_count != 0 &&
- !access_ok(VERIFY_WRITE, fieinfo.fi_extents_start,
-@@ -220,7 +220,7 @@ static int ioctl_fiemap(struct file *filp, unsigned long arg)
- error = inode->i_op->fiemap(inode, &fieinfo, fiemap.fm_start, len);
- fiemap.fm_flags = fieinfo.fi_flags;
- fiemap.fm_mapped_extents = fieinfo.fi_extents_mapped;
-- if (copy_to_user((char *)arg, &fiemap, sizeof(fiemap)))
-+ if (copy_to_user((__force char __user *)arg, &fiemap, sizeof(fiemap)))
- error = -EFAULT;
-
- return error;
-diff --git a/fs/jbd/checkpoint.c b/fs/jbd/checkpoint.c
-index b0435dd..81ee0be 100644
---- a/fs/jbd/checkpoint.c
-+++ b/fs/jbd/checkpoint.c
-@@ -348,6 +348,8 @@ int log_do_checkpoint(journal_t *journal)
- tid_t this_tid;
- int result;
-
-+ pax_track_stack();
-+
- jbd_debug(1, "Start checkpoint\n");
-
- /*
-diff --git a/fs/jffs2/compr_rtime.c b/fs/jffs2/compr_rtime.c
-index 546d153..736896c 100644
---- a/fs/jffs2/compr_rtime.c
-+++ b/fs/jffs2/compr_rtime.c
-@@ -37,6 +37,8 @@ static int jffs2_rtime_compress(unsigned char *data_in,
- int outpos = 0;
- int pos=0;
-
-+ pax_track_stack();
-+
- memset(positions,0,sizeof(positions));
-
- while (pos < (*sourcelen) && outpos <= (*dstlen)-2) {
-@@ -79,6 +81,8 @@ static int jffs2_rtime_decompress(unsigned char *data_in,
- int outpos = 0;
- int pos=0;
-
-+ pax_track_stack();
-+
- memset(positions,0,sizeof(positions));
-
- while (outpos<destlen) {
-diff --git a/fs/jffs2/compr_rubin.c b/fs/jffs2/compr_rubin.c
-index 170d289..3254b98 100644
---- a/fs/jffs2/compr_rubin.c
-+++ b/fs/jffs2/compr_rubin.c
-@@ -314,6 +314,8 @@ static int jffs2_dynrubin_compress(unsigned char *data_in,
- int ret;
- uint32_t mysrclen, mydstlen;
-
-+ pax_track_stack();
-+
- mysrclen = *sourcelen;
- mydstlen = *dstlen - 8;
-
-diff --git a/fs/jffs2/erase.c b/fs/jffs2/erase.c
-index b47679b..00d65d36 100644
---- a/fs/jffs2/erase.c
-+++ b/fs/jffs2/erase.c
-@@ -434,7 +434,8 @@ static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseb
- struct jffs2_unknown_node marker = {
- .magic = cpu_to_je16(JFFS2_MAGIC_BITMASK),
- .nodetype = cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
-- .totlen = cpu_to_je32(c->cleanmarker_size)
-+ .totlen = cpu_to_je32(c->cleanmarker_size),
-+ .hdr_crc = cpu_to_je32(0)
- };
-
- jffs2_prealloc_raw_node_refs(c, jeb, 1);
-diff --git a/fs/jffs2/wbuf.c b/fs/jffs2/wbuf.c
-index 5ef7bac..4fd1e3c 100644
---- a/fs/jffs2/wbuf.c
-+++ b/fs/jffs2/wbuf.c
-@@ -1012,7 +1012,8 @@ static const struct jffs2_unknown_node oob_cleanmarker =
- {
- .magic = constant_cpu_to_je16(JFFS2_MAGIC_BITMASK),
- .nodetype = constant_cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
-- .totlen = constant_cpu_to_je32(8)
-+ .totlen = constant_cpu_to_je32(8),
-+ .hdr_crc = constant_cpu_to_je32(0)
- };
-
- /*
-diff --git a/fs/jffs2/xattr.c b/fs/jffs2/xattr.c
-index 082e844..52012a1 100644
---- a/fs/jffs2/xattr.c
-+++ b/fs/jffs2/xattr.c
-@@ -773,6 +773,8 @@ void jffs2_build_xattr_subsystem(struct jffs2_sb_info *c)
-
- BUG_ON(!(c->flags & JFFS2_SB_FLAG_BUILDING));
-
-+ pax_track_stack();
-+
- /* Phase.1 : Merge same xref */
- for (i=0; i < XREF_TMPHASH_SIZE; i++)
- xref_tmphash[i] = NULL;
-diff --git a/fs/jfs/super.c b/fs/jfs/super.c
-index 2234c73..f6e6e6b 100644
---- a/fs/jfs/super.c
-+++ b/fs/jfs/super.c
-@@ -793,7 +793,7 @@ static int __init init_jfs_fs(void)
-
- jfs_inode_cachep =
- kmem_cache_create("jfs_ip", sizeof(struct jfs_inode_info), 0,
-- SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD,
-+ SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|SLAB_USERCOPY,
- init_once);
- if (jfs_inode_cachep == NULL)
- return -ENOMEM;
-diff --git a/fs/libfs.c b/fs/libfs.c
-index ba36e93..3153fce 100644
---- a/fs/libfs.c
-+++ b/fs/libfs.c
-@@ -157,12 +157,20 @@ int dcache_readdir(struct file * filp, void * dirent, filldir_t filldir)
-
- for (p=q->next; p != &dentry->d_subdirs; p=p->next) {
- struct dentry *next;
-+ char d_name[sizeof(next->d_iname)];
-+ const unsigned char *name;
-+
- next = list_entry(p, struct dentry, d_u.d_child);
- if (d_unhashed(next) || !next->d_inode)
- continue;
-
- spin_unlock(&dcache_lock);
-- if (filldir(dirent, next->d_name.name,
-+ name = next->d_name.name;
-+ if (name == next->d_iname) {
-+ memcpy(d_name, name, next->d_name.len);
-+ name = d_name;
-+ }
-+ if (filldir(dirent, name,
- next->d_name.len, filp->f_pos,
- next->d_inode->i_ino,
- dt_type(next->d_inode)) < 0)
-diff --git a/fs/lockd/clntproc.c b/fs/lockd/clntproc.c
-index c325a83..d15b07b 100644
---- a/fs/lockd/clntproc.c
-+++ b/fs/lockd/clntproc.c
-@@ -36,11 +36,11 @@ static const struct rpc_call_ops nlmclnt_cancel_ops;
- /*
- * Cookie counter for NLM requests
- */
--static atomic_t nlm_cookie = ATOMIC_INIT(0x1234);
-+static atomic_unchecked_t nlm_cookie = ATOMIC_INIT(0x1234);
-
- void nlmclnt_next_cookie(struct nlm_cookie *c)
- {
-- u32 cookie = atomic_inc_return(&nlm_cookie);
-+ u32 cookie = atomic_inc_return_unchecked(&nlm_cookie);
-
- memcpy(c->data, &cookie, 4);
- c->len=4;
-@@ -621,6 +621,8 @@ nlmclnt_reclaim(struct nlm_host *host, struct file_lock *fl)
- struct nlm_rqst reqst, *req;
- int status;
-
-+ pax_track_stack();
-+
- req = &reqst;
- memset(req, 0, sizeof(*req));
- locks_init_lock(&req->a_args.lock.fl);
-diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c
-index 1a54ae1..6a16c27 100644
---- a/fs/lockd/svc.c
-+++ b/fs/lockd/svc.c
-@@ -43,7 +43,7 @@
-
- static struct svc_program nlmsvc_program;
-
--struct nlmsvc_binding * nlmsvc_ops;
-+const struct nlmsvc_binding * nlmsvc_ops;
- EXPORT_SYMBOL_GPL(nlmsvc_ops);
-
- static DEFINE_MUTEX(nlmsvc_mutex);
-diff --git a/fs/locks.c b/fs/locks.c
-index fde92d1..6256b88 100644
---- a/fs/locks.c
-+++ b/fs/locks.c
-@@ -145,10 +145,28 @@ static LIST_HEAD(blocked_list);
-
- static struct kmem_cache *filelock_cache __read_mostly;
-
-+static void locks_init_lock_always(struct file_lock *fl)
-+{
-+ fl->fl_next = NULL;
-+ fl->fl_fasync = NULL;
-+ fl->fl_owner = NULL;
-+ fl->fl_pid = 0;
-+ fl->fl_nspid = NULL;
-+ fl->fl_file = NULL;
-+ fl->fl_flags = 0;
-+ fl->fl_type = 0;
-+ fl->fl_start = fl->fl_end = 0;
-+}
-+
- /* Allocate an empty lock structure. */
- static struct file_lock *locks_alloc_lock(void)
- {
-- return kmem_cache_alloc(filelock_cache, GFP_KERNEL);
-+ struct file_lock *fl = kmem_cache_alloc(filelock_cache, GFP_KERNEL);
-+
-+ if (fl)
-+ locks_init_lock_always(fl);
-+
-+ return fl;
- }
-
- void locks_release_private(struct file_lock *fl)
-@@ -183,17 +201,9 @@ void locks_init_lock(struct file_lock *fl)
- INIT_LIST_HEAD(&fl->fl_link);
- INIT_LIST_HEAD(&fl->fl_block);
- init_waitqueue_head(&fl->fl_wait);
-- fl->fl_next = NULL;
-- fl->fl_fasync = NULL;
-- fl->fl_owner = NULL;
-- fl->fl_pid = 0;
-- fl->fl_nspid = NULL;
-- fl->fl_file = NULL;
-- fl->fl_flags = 0;
-- fl->fl_type = 0;
-- fl->fl_start = fl->fl_end = 0;
- fl->fl_ops = NULL;
- fl->fl_lmops = NULL;
-+ locks_init_lock_always(fl);
- }
-
- EXPORT_SYMBOL(locks_init_lock);
-@@ -2007,16 +2017,16 @@ void locks_remove_flock(struct file *filp)
- return;
-
- if (filp->f_op && filp->f_op->flock) {
-- struct file_lock fl = {
-+ struct file_lock flock = {
- .fl_pid = current->tgid,
- .fl_file = filp,
- .fl_flags = FL_FLOCK,
- .fl_type = F_UNLCK,
- .fl_end = OFFSET_MAX,
- };
-- filp->f_op->flock(filp, F_SETLKW, &fl);
-- if (fl.fl_ops && fl.fl_ops->fl_release_private)
-- fl.fl_ops->fl_release_private(&fl);
-+ filp->f_op->flock(filp, F_SETLKW, &flock);
-+ if (flock.fl_ops && flock.fl_ops->fl_release_private)
-+ flock.fl_ops->fl_release_private(&flock);
- }
-
- lock_kernel();
-diff --git a/fs/namei.c b/fs/namei.c
-index b0afbd4..a4dd3a0 100644
---- a/fs/namei.c
-+++ b/fs/namei.c
-@@ -224,6 +224,14 @@ int generic_permission(struct inode *inode, int mask,
- return ret;
-
- /*
-+ * Searching includes executable on directories, else just read.
-+ */
-+ mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
-+ if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE)))
-+ if (capable(CAP_DAC_READ_SEARCH))
-+ return 0;
-+
-+ /*
- * Read/write DACs are always overridable.
- * Executable DACs are overridable if at least one exec bit is set.
- */
-@@ -231,14 +239,6 @@ int generic_permission(struct inode *inode, int mask,
- if (capable(CAP_DAC_OVERRIDE))
- return 0;
-
-- /*
-- * Searching includes executable on directories, else just read.
-- */
-- mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
-- if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE)))
-- if (capable(CAP_DAC_READ_SEARCH))
-- return 0;
--
- return -EACCES;
- }
-
-@@ -458,7 +458,8 @@ static int exec_permission_lite(struct inode *inode)
- if (!ret)
- goto ok;
-
-- if (capable(CAP_DAC_OVERRIDE) || capable(CAP_DAC_READ_SEARCH))
-+ if (capable_nolog(CAP_DAC_OVERRIDE) || capable(CAP_DAC_READ_SEARCH) ||
-+ capable(CAP_DAC_OVERRIDE))
- goto ok;
-
- return ret;
-@@ -638,13 +639,17 @@ static __always_inline int __do_follow_link(struct path *path, struct nameidata
- cookie = dentry->d_inode->i_op->follow_link(dentry, nd);
- error = PTR_ERR(cookie);
- if (!IS_ERR(cookie)) {
-- char *s = nd_get_link(nd);
-+ const char *s = nd_get_link(nd);
- error = 0;
- if (s)
- error = __vfs_follow_link(nd, s);
- if (dentry->d_inode->i_op->put_link)
- dentry->d_inode->i_op->put_link(dentry, nd, cookie);
- }
-+
-+ if (!error && (nd->flags & LOOKUP_SYMLINKOWN) && gr_handle_symlink_owner(path, nd->path.dentry->d_inode))
-+ error = -EACCES;
-+
- path_put(path);
-
- return error;
-@@ -669,9 +674,17 @@ static inline int do_follow_link(struct path *path, struct nameidata *nd)
- err = security_inode_follow_link(path->dentry, nd);
- if (err)
- goto loop;
-+
-+ if (gr_handle_follow_link(path->dentry->d_parent->d_inode,
-+ path->dentry->d_inode, path->dentry, nd->path.mnt)) {
-+ err = -EACCES;
-+ goto loop;
-+ }
-+
- current->link_count++;
- current->total_link_count++;
- nd->depth++;
-+ nd->flags |= LOOKUP_SYMLINKOWN;
- err = __do_follow_link(path, nd);
- current->link_count--;
- nd->depth--;
-@@ -1016,11 +1029,19 @@ return_reval:
- break;
- }
- return_base:
-+ if (!(nd->flags & (LOOKUP_CONTINUE | LOOKUP_PARENT)) &&
-+ !gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
-+ path_put(&nd->path);
-+ return -ENOENT;
-+ }
- return 0;
- out_dput:
- path_put_conditional(&next, nd);
- break;
- }
-+ if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt))
-+ err = -ENOENT;
-+
- path_put(&nd->path);
- return_err:
- return err;
-@@ -1091,13 +1112,22 @@ static int do_path_lookup(int dfd, const char *name,
- int retval = path_init(dfd, name, flags, nd);
- if (!retval)
- retval = path_walk(name, nd);
-- if (unlikely(!retval && !audit_dummy_context() && nd->path.dentry &&
-- nd->path.dentry->d_inode))
-- audit_inode(name, nd->path.dentry);
-+
-+ if (likely(!retval)) {
-+ if (nd->path.dentry && nd->path.dentry->d_inode) {
-+ if (!audit_dummy_context())
-+ audit_inode(name, nd->path.dentry);
-+ if (*name != '/' && !gr_chroot_fchdir(nd->path.dentry, nd->path.mnt)) {
-+ path_put(&nd->path);
-+ retval = -ENOENT;
-+ }
-+ }
-+ }
- if (nd->root.mnt) {
- path_put(&nd->root);
- nd->root.mnt = NULL;
- }
-+
- return retval;
- }
-
-@@ -1251,6 +1281,11 @@ static int __lookup_one_len(const char *name, struct qstr *this,
- if (!len)
- return -EACCES;
-
-+ if (unlikely(name[0] == '.')) {
-+ if (len < 2 || (len == 2 && name[1] == '.'))
-+ return -EACCES;
-+ }
-+
- hash = init_name_hash();
- while (len--) {
- c = *(const unsigned char *)name++;
-@@ -1576,6 +1611,20 @@ int may_open(struct path *path, int acc_mode, int flag)
- if (error)
- goto err_out;
-
-+
-+ if (gr_handle_rofs_blockwrite(dentry, path->mnt, acc_mode)) {
-+ error = -EPERM;
-+ goto err_out;
-+ }
-+ if (gr_handle_rawio(inode)) {
-+ error = -EPERM;
-+ goto err_out;
-+ }
-+ if (!gr_acl_handle_open(dentry, path->mnt, acc_mode)) {
-+ error = -EACCES;
-+ goto err_out;
-+ }
-+
- if (flag & O_TRUNC) {
- error = get_write_access(inode);
- if (error)
-@@ -1620,6 +1669,17 @@ static int __open_namei_create(struct nameidata *nd, struct path *path,
- {
- int error;
- struct dentry *dir = nd->path.dentry;
-+ int acc_mode = ACC_MODE(flag);
-+
-+ if (flag & O_TRUNC)
-+ acc_mode |= MAY_WRITE;
-+ if (flag & O_APPEND)
-+ acc_mode |= MAY_APPEND;
-+
-+ if (!gr_acl_handle_creat(path->dentry, dir, nd->path.mnt, flag, acc_mode, mode)) {
-+ error = -EACCES;
-+ goto out_unlock;
-+ }
-
- if (!IS_POSIXACL(dir->d_inode))
- mode &= ~current_umask();
-@@ -1627,6 +1687,8 @@ static int __open_namei_create(struct nameidata *nd, struct path *path,
- if (error)
- goto out_unlock;
- error = vfs_create(dir->d_inode, path->dentry, mode, nd);
-+ if (!error)
-+ gr_handle_create(path->dentry, nd->path.mnt);
- out_unlock:
- mutex_unlock(&dir->d_inode->i_mutex);
- dput(nd->path.dentry);
-@@ -1684,6 +1746,7 @@ struct file *do_filp_open(int dfd, const char *pathname,
- struct nameidata nd;
- int error;
- struct path path;
-+ struct path link_path;
- struct dentry *dir;
- int count = 0;
- int will_write;
-@@ -1709,6 +1772,22 @@ struct file *do_filp_open(int dfd, const char *pathname,
- &nd, flag);
- if (error)
- return ERR_PTR(error);
-+
-+ if (gr_handle_rofs_blockwrite(nd.path.dentry, nd.path.mnt, acc_mode)) {
-+ error = -EPERM;
-+ goto exit;
-+ }
-+
-+ if (gr_handle_rawio(nd.path.dentry->d_inode)) {
-+ error = -EPERM;
-+ goto exit;
-+ }
-+
-+ if (!gr_acl_handle_open(nd.path.dentry, nd.path.mnt, acc_mode)) {
-+ error = -EACCES;
-+ goto exit;
-+ }
-+
- goto ok;
- }
-
-@@ -1795,6 +1874,19 @@ do_last:
- /*
- * It already exists.
- */
-+
-+ if (!gr_acl_handle_hidden_file(path.dentry, path.mnt)) {
-+ error = -ENOENT;
-+ goto exit_mutex_unlock;
-+ }
-+
-+ /* only check if O_CREAT is specified, all other checks need
-+ to go into may_open */
-+ if (gr_handle_fifo(path.dentry, path.mnt, dir, flag, acc_mode)) {
-+ error = -EACCES;
-+ goto exit_mutex_unlock;
-+ }
-+
- mutex_unlock(&dir->d_inode->i_mutex);
- audit_inode(pathname, path.dentry);
-
-@@ -1887,6 +1979,14 @@ do_link:
- error = security_inode_follow_link(path.dentry, &nd);
- if (error)
- goto exit_dput;
-+
-+ if (gr_handle_follow_link(path.dentry->d_parent->d_inode, path.dentry->d_inode,
-+ path.dentry, nd.path.mnt)) {
-+ error = -EACCES;
-+ goto exit_dput;
-+ }
-+
-+ nd.flags &= ~LOOKUP_SYMLINKOWN;
- error = __do_follow_link(&path, &nd);
- if (error) {
- /* Does someone understand code flow here? Or it is only
-@@ -1915,9 +2015,24 @@ do_link:
- }
- dir = nd.path.dentry;
- mutex_lock(&dir->d_inode->i_mutex);
-+ link_path.dentry = path.dentry;
-+ link_path.mnt = path.mnt;
- path.dentry = lookup_hash(&nd);
- path.mnt = nd.path.mnt;
- __putname(nd.last.name);
-+
-+ /* if the last path component resolved by the symlink exists, then check ownership against that
-+ if it doesn't, we're trying to create it, check ownership against its directory
-+ */
-+ if (!IS_ERR(path.dentry) && !IS_ERR(nd.intent.open.file)) {
-+ if (path.dentry->d_inode && gr_handle_symlink_owner(&link_path, path.dentry->d_inode)) {
-+ error = -EACCES;
-+ goto exit_mutex_unlock;
-+ } else if (!path.dentry->d_inode && gr_handle_symlink_owner(&link_path, dir->d_inode)) {
-+ error = -EACCES;
-+ goto exit_mutex_unlock;
-+ }
-+ }
- goto do_last;
- }
-
-@@ -1984,6 +2099,10 @@ struct dentry *lookup_create(struct nameidata *nd, int is_dir)
- }
- return dentry;
- eexist:
-+ if (!gr_acl_handle_hidden_file(dentry, nd->path.mnt)) {
-+ dput(dentry);
-+ return ERR_PTR(-ENOENT);
-+ }
- dput(dentry);
- dentry = ERR_PTR(-EEXIST);
- fail:
-@@ -2061,6 +2180,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, int, mode,
- error = may_mknod(mode);
- if (error)
- goto out_dput;
-+
-+ if (gr_handle_chroot_mknod(dentry, nd.path.mnt, mode)) {
-+ error = -EPERM;
-+ goto out_dput;
-+ }
-+
-+ if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
-+ error = -EACCES;
-+ goto out_dput;
-+ }
-+
- error = mnt_want_write(nd.path.mnt);
- if (error)
- goto out_dput;
-@@ -2081,6 +2211,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, int, mode,
- }
- out_drop_write:
- mnt_drop_write(nd.path.mnt);
-+
-+ if (!error)
-+ gr_handle_create(dentry, nd.path.mnt);
- out_dput:
- dput(dentry);
- out_unlock:
-@@ -2134,6 +2267,11 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, int, mode)
- if (IS_ERR(dentry))
- goto out_unlock;
-
-+ if (!gr_acl_handle_mkdir(dentry, nd.path.dentry, nd.path.mnt)) {
-+ error = -EACCES;
-+ goto out_dput;
-+ }
-+
- if (!IS_POSIXACL(nd.path.dentry->d_inode))
- mode &= ~current_umask();
- error = mnt_want_write(nd.path.mnt);
-@@ -2145,6 +2283,10 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, int, mode)
- error = vfs_mkdir(nd.path.dentry->d_inode, dentry, mode);
- out_drop_write:
- mnt_drop_write(nd.path.mnt);
-+
-+ if (!error)
-+ gr_handle_create(dentry, nd.path.mnt);
-+
- out_dput:
- dput(dentry);
- out_unlock:
-@@ -2226,6 +2368,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
- char * name;
- struct dentry *dentry;
- struct nameidata nd;
-+ ino_t saved_ino = 0;
-+ dev_t saved_dev = 0;
-
- error = user_path_parent(dfd, pathname, &nd, &name);
- if (error)
-@@ -2250,6 +2394,17 @@ static long do_rmdir(int dfd, const char __user *pathname)
- error = PTR_ERR(dentry);
- if (IS_ERR(dentry))
- goto exit2;
-+
-+ if (dentry->d_inode != NULL) {
-+ saved_ino = dentry->d_inode->i_ino;
-+ saved_dev = gr_get_dev_from_dentry(dentry);
-+
-+ if (!gr_acl_handle_rmdir(dentry, nd.path.mnt)) {
-+ error = -EACCES;
-+ goto exit3;
-+ }
-+ }
-+
- error = mnt_want_write(nd.path.mnt);
- if (error)
- goto exit3;
-@@ -2257,6 +2412,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
- if (error)
- goto exit4;
- error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
-+ if (!error && (saved_dev || saved_ino))
-+ gr_handle_delete(saved_ino, saved_dev);
- exit4:
- mnt_drop_write(nd.path.mnt);
- exit3:
-@@ -2318,6 +2475,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
- struct dentry *dentry;
- struct nameidata nd;
- struct inode *inode = NULL;
-+ ino_t saved_ino = 0;
-+ dev_t saved_dev = 0;
-
- error = user_path_parent(dfd, pathname, &nd, &name);
- if (error)
-@@ -2337,8 +2496,19 @@ static long do_unlinkat(int dfd, const char __user *pathname)
- if (nd.last.name[nd.last.len])
- goto slashes;
- inode = dentry->d_inode;
-- if (inode)
-+ if (inode) {
-+ if (inode->i_nlink <= 1) {
-+ saved_ino = inode->i_ino;
-+ saved_dev = gr_get_dev_from_dentry(dentry);
-+ }
-+
- atomic_inc(&inode->i_count);
-+
-+ if (!gr_acl_handle_unlink(dentry, nd.path.mnt)) {
-+ error = -EACCES;
-+ goto exit2;
-+ }
-+ }
- error = mnt_want_write(nd.path.mnt);
- if (error)
- goto exit2;
-@@ -2346,6 +2516,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
- if (error)
- goto exit3;
- error = vfs_unlink(nd.path.dentry->d_inode, dentry);
-+ if (!error && (saved_ino || saved_dev))
-+ gr_handle_delete(saved_ino, saved_dev);
- exit3:
- mnt_drop_write(nd.path.mnt);
- exit2:
-@@ -2424,6 +2596,11 @@ SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
- if (IS_ERR(dentry))
- goto out_unlock;
-
-+ if (!gr_acl_handle_symlink(dentry, nd.path.dentry, nd.path.mnt, from)) {
-+ error = -EACCES;
-+ goto out_dput;
-+ }
-+
- error = mnt_want_write(nd.path.mnt);
- if (error)
- goto out_dput;
-@@ -2431,6 +2608,8 @@ SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
- if (error)
- goto out_drop_write;
- error = vfs_symlink(nd.path.dentry->d_inode, dentry, from);
-+ if (!error)
-+ gr_handle_create(dentry, nd.path.mnt);
- out_drop_write:
- mnt_drop_write(nd.path.mnt);
- out_dput:
-@@ -2524,6 +2703,20 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
- error = PTR_ERR(new_dentry);
- if (IS_ERR(new_dentry))
- goto out_unlock;
-+
-+ if (gr_handle_hardlink(old_path.dentry, old_path.mnt,
-+ old_path.dentry->d_inode,
-+ old_path.dentry->d_inode->i_mode, to)) {
-+ error = -EACCES;
-+ goto out_dput;
-+ }
-+
-+ if (!gr_acl_handle_link(new_dentry, nd.path.dentry, nd.path.mnt,
-+ old_path.dentry, old_path.mnt, to)) {
-+ error = -EACCES;
-+ goto out_dput;
-+ }
-+
- error = mnt_want_write(nd.path.mnt);
- if (error)
- goto out_dput;
-@@ -2531,6 +2724,8 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
- if (error)
- goto out_drop_write;
- error = vfs_link(old_path.dentry, nd.path.dentry->d_inode, new_dentry);
-+ if (!error)
-+ gr_handle_create(new_dentry, nd.path.mnt);
- out_drop_write:
- mnt_drop_write(nd.path.mnt);
- out_dput:
-@@ -2708,6 +2903,8 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
- char *to;
- int error;
-
-+ pax_track_stack();
-+
- error = user_path_parent(olddfd, oldname, &oldnd, &from);
- if (error)
- goto exit;
-@@ -2764,6 +2961,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
- if (new_dentry == trap)
- goto exit5;
-
-+ error = gr_acl_handle_rename(new_dentry, new_dir, newnd.path.mnt,
-+ old_dentry, old_dir->d_inode, oldnd.path.mnt,
-+ to);
-+ if (error)
-+ goto exit5;
-+
- error = mnt_want_write(oldnd.path.mnt);
- if (error)
- goto exit5;
-@@ -2773,6 +2976,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
- goto exit6;
- error = vfs_rename(old_dir->d_inode, old_dentry,
- new_dir->d_inode, new_dentry);
-+ if (!error)
-+ gr_handle_rename(old_dir->d_inode, new_dir->d_inode, old_dentry,
-+ new_dentry, oldnd.path.mnt, new_dentry->d_inode ? 1 : 0);
- exit6:
- mnt_drop_write(oldnd.path.mnt);
- exit5:
-@@ -2798,6 +3004,8 @@ SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newna
-
- int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
- {
-+ char tmpbuf[64];
-+ const char *newlink;
- int len;
-
- len = PTR_ERR(link);
-@@ -2807,7 +3015,14 @@ int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const c
- len = strlen(link);
- if (len > (unsigned) buflen)
- len = buflen;
-- if (copy_to_user(buffer, link, len))
-+
-+ if (len < sizeof(tmpbuf)) {
-+ memcpy(tmpbuf, link, len);
-+ newlink = tmpbuf;
-+ } else
-+ newlink = link;
-+
-+ if (copy_to_user(buffer, newlink, len))
- len = -EFAULT;
- out:
- return len;
-diff --git a/fs/namespace.c b/fs/namespace.c
-index 2beb0fb..11a95a5 100644
---- a/fs/namespace.c
-+++ b/fs/namespace.c
-@@ -1083,6 +1083,9 @@ static int do_umount(struct vfsmount *mnt, int flags)
- if (!(sb->s_flags & MS_RDONLY))
- retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
- up_write(&sb->s_umount);
-+
-+ gr_log_remount(mnt->mnt_devname, retval);
-+
- return retval;
- }
-
-@@ -1104,6 +1107,9 @@ static int do_umount(struct vfsmount *mnt, int flags)
- security_sb_umount_busy(mnt);
- up_write(&namespace_sem);
- release_mounts(&umount_list);
-+
-+ gr_log_unmount(mnt->mnt_devname, retval);
-+
- return retval;
- }
-
-@@ -1962,6 +1968,16 @@ long do_mount(char *dev_name, char *dir_name, char *type_page,
- if (retval)
- goto dput_out;
-
-+ if (gr_handle_rofs_mount(path.dentry, path.mnt, mnt_flags)) {
-+ retval = -EPERM;
-+ goto dput_out;
-+ }
-+
-+ if (gr_handle_chroot_mount(path.dentry, path.mnt, dev_name)) {
-+ retval = -EPERM;
-+ goto dput_out;
-+ }
-+
- if (flags & MS_REMOUNT)
- retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
- data_page);
-@@ -1976,6 +1992,9 @@ long do_mount(char *dev_name, char *dir_name, char *type_page,
- dev_name, data_page);
- dput_out:
- path_put(&path);
-+
-+ gr_log_mount(dev_name, dir_name, retval);
-+
- return retval;
- }
-
-@@ -2182,6 +2201,12 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
- goto out1;
- }
-
-+ if (gr_handle_chroot_pivot()) {
-+ error = -EPERM;
-+ path_put(&old);
-+ goto out1;
-+ }
-+
- read_lock(¤t->fs->lock);
- root = current->fs->root;
- path_get(¤t->fs->root);
-diff --git a/fs/ncpfs/dir.c b/fs/ncpfs/dir.c
-index b8b5b30..2bd9ccb 100644
---- a/fs/ncpfs/dir.c
-+++ b/fs/ncpfs/dir.c
-@@ -275,6 +275,8 @@ __ncp_lookup_validate(struct dentry *dentry)
- int res, val = 0, len;
- __u8 __name[NCP_MAXPATHLEN + 1];
-
-+ pax_track_stack();
-+
- parent = dget_parent(dentry);
- dir = parent->d_inode;
-
-@@ -799,6 +801,8 @@ static struct dentry *ncp_lookup(struct inode *dir, struct dentry *dentry, struc
- int error, res, len;
- __u8 __name[NCP_MAXPATHLEN + 1];
-
-+ pax_track_stack();
-+
- lock_kernel();
- error = -EIO;
- if (!ncp_conn_valid(server))
-@@ -883,10 +887,12 @@ int ncp_create_new(struct inode *dir, struct dentry *dentry, int mode,
- int error, result, len;
- int opmode;
- __u8 __name[NCP_MAXPATHLEN + 1];
--
-+
- PPRINTK("ncp_create_new: creating %s/%s, mode=%x\n",
- dentry->d_parent->d_name.name, dentry->d_name.name, mode);
-
-+ pax_track_stack();
-+
- error = -EIO;
- lock_kernel();
- if (!ncp_conn_valid(server))
-@@ -952,6 +958,8 @@ static int ncp_mkdir(struct inode *dir, struct dentry *dentry, int mode)
- int error, len;
- __u8 __name[NCP_MAXPATHLEN + 1];
-
-+ pax_track_stack();
-+
- DPRINTK("ncp_mkdir: making %s/%s\n",
- dentry->d_parent->d_name.name, dentry->d_name.name);
-
-@@ -960,6 +968,8 @@ static int ncp_mkdir(struct inode *dir, struct dentry *dentry, int mode)
- if (!ncp_conn_valid(server))
- goto out;
-
-+ pax_track_stack();
-+
- ncp_age_dentry(server, dentry);
- len = sizeof(__name);
- error = ncp_io2vol(server, __name, &len, dentry->d_name.name,
-@@ -1114,6 +1124,8 @@ static int ncp_rename(struct inode *old_dir, struct dentry *old_dentry,
- int old_len, new_len;
- __u8 __old_name[NCP_MAXPATHLEN + 1], __new_name[NCP_MAXPATHLEN + 1];
-
-+ pax_track_stack();
-+
- DPRINTK("ncp_rename: %s/%s to %s/%s\n",
- old_dentry->d_parent->d_name.name, old_dentry->d_name.name,
- new_dentry->d_parent->d_name.name, new_dentry->d_name.name);
-diff --git a/fs/ncpfs/inode.c b/fs/ncpfs/inode.c
-index cf98da1..da890a9 100644
---- a/fs/ncpfs/inode.c
-+++ b/fs/ncpfs/inode.c
-@@ -445,6 +445,8 @@ static int ncp_fill_super(struct super_block *sb, void *raw_data, int silent)
- #endif
- struct ncp_entry_info finfo;
-
-+ pax_track_stack();
-+
- data.wdog_pid = NULL;
- server = kzalloc(sizeof(struct ncp_server), GFP_KERNEL);
- if (!server)
-diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
-index bfaef7b..e9d03ca0 100644
---- a/fs/nfs/inode.c
-+++ b/fs/nfs/inode.c
-@@ -156,7 +156,7 @@ static void nfs_zap_caches_locked(struct inode *inode)
- nfsi->attrtimeo = NFS_MINATTRTIMEO(inode);
- nfsi->attrtimeo_timestamp = jiffies;
-
-- memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_COOKIEVERF(inode)));
-+ memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_I(inode)->cookieverf));
- if (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))
- nfsi->cache_validity |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL|NFS_INO_REVAL_PAGECACHE;
- else
-@@ -973,16 +973,16 @@ static int nfs_size_need_update(const struct inode *inode, const struct nfs_fatt
- return nfs_size_to_loff_t(fattr->size) > i_size_read(inode);
- }
-
--static atomic_long_t nfs_attr_generation_counter;
-+static atomic_long_unchecked_t nfs_attr_generation_counter;
-
- static unsigned long nfs_read_attr_generation_counter(void)
- {
-- return atomic_long_read(&nfs_attr_generation_counter);
-+ return atomic_long_read_unchecked(&nfs_attr_generation_counter);
- }
-
- unsigned long nfs_inc_attr_generation_counter(void)
- {
-- return atomic_long_inc_return(&nfs_attr_generation_counter);
-+ return atomic_long_inc_return_unchecked(&nfs_attr_generation_counter);
- }
-
- void nfs_fattr_init(struct nfs_fattr *fattr)
-diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
-index 21c7190..22688d5 100644
---- a/fs/nfs/nfs4proc.c
-+++ b/fs/nfs/nfs4proc.c
-@@ -915,7 +915,7 @@ static struct nfs4_state *nfs4_try_open_cached(struct nfs4_opendata *opendata)
- struct nfs4_state *state = opendata->state;
- struct nfs_inode *nfsi = NFS_I(state->inode);
- struct nfs_delegation *delegation;
-- int open_mode = opendata->o_arg.open_flags & O_EXCL;
-+ int open_mode = opendata->o_arg.open_flags;
- fmode_t fmode = opendata->o_arg.fmode;
- nfs4_stateid stateid;
- int ret = -EAGAIN;
-diff --git a/fs/nfsd/lockd.c b/fs/nfsd/lockd.c
-index cc2f505..f6a236f 100644
---- a/fs/nfsd/lockd.c
-+++ b/fs/nfsd/lockd.c
-@@ -66,7 +66,7 @@ nlm_fclose(struct file *filp)
- fput(filp);
- }
-
--static struct nlmsvc_binding nfsd_nlm_ops = {
-+static const struct nlmsvc_binding nfsd_nlm_ops = {
- .fopen = nlm_fopen, /* open file for locking */
- .fclose = nlm_fclose, /* close file */
- };
-diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
-index cfc3391..dcc083a 100644
---- a/fs/nfsd/nfs4state.c
-+++ b/fs/nfsd/nfs4state.c
-@@ -3459,6 +3459,8 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
- unsigned int cmd;
- int err;
-
-+ pax_track_stack();
-+
- dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n",
- (long long) lock->lk_offset,
- (long long) lock->lk_length);
-diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
-index ab87b05..40e41fe 100644
---- a/fs/nfsd/nfs4xdr.c
-+++ b/fs/nfsd/nfs4xdr.c
-@@ -268,7 +268,7 @@ nfsd4_decode_fattr(struct nfsd4_compoundargs *argp, u32 *bmval,
- iattr->ia_valid |= ATTR_SIZE;
- }
- if (bmval[0] & FATTR4_WORD0_ACL) {
-- int nace;
-+ u32 nace;
- struct nfs4_ace *ace;
-
- READ_BUF(4); len += 4;
-@@ -1751,6 +1751,8 @@ nfsd4_encode_fattr(struct svc_fh *fhp, struct svc_export *exp,
- struct nfsd4_compoundres *resp = rqstp->rq_resp;
- u32 minorversion = resp->cstate.minorversion;
-
-+ pax_track_stack();
-+
- BUG_ON(bmval1 & NFSD_WRITEONLY_ATTRS_WORD1);
- BUG_ON(bmval0 & ~nfsd_suppattrs0(minorversion));
- BUG_ON(bmval1 & ~nfsd_suppattrs1(minorversion));
-diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
-index 2e09588..596421d 100644
---- a/fs/nfsd/vfs.c
-+++ b/fs/nfsd/vfs.c
-@@ -937,7 +937,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
- } else {
- oldfs = get_fs();
- set_fs(KERNEL_DS);
-- host_err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset);
-+ host_err = vfs_readv(file, (struct iovec __force_user *)vec, vlen, &offset);
- set_fs(oldfs);
- }
-
-@@ -1060,7 +1060,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
-
- /* Write the data. */
- oldfs = get_fs(); set_fs(KERNEL_DS);
-- host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
-+ host_err = vfs_writev(file, (struct iovec __force_user *)vec, vlen, &offset);
- set_fs(oldfs);
- if (host_err < 0)
- goto out_nfserr;
-@@ -1542,7 +1542,7 @@ nfsd_readlink(struct svc_rqst *rqstp, struct svc_fh *fhp, char *buf, int *lenp)
- */
-
- oldfs = get_fs(); set_fs(KERNEL_DS);
-- host_err = inode->i_op->readlink(dentry, buf, *lenp);
-+ host_err = inode->i_op->readlink(dentry, (char __force_user *)buf, *lenp);
- set_fs(oldfs);
-
- if (host_err < 0)
-diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
-index f6af760..d0adf34 100644
---- a/fs/nilfs2/ioctl.c
-+++ b/fs/nilfs2/ioctl.c
-@@ -480,7 +480,7 @@ static int nilfs_ioctl_clean_segments(struct inode *inode, struct file *filp,
- unsigned int cmd, void __user *argp)
- {
- struct nilfs_argv argv[5];
-- const static size_t argsz[5] = {
-+ static const size_t argsz[5] = {
- sizeof(struct nilfs_vdesc),
- sizeof(struct nilfs_period),
- sizeof(__u64),
-@@ -522,6 +522,9 @@ static int nilfs_ioctl_clean_segments(struct inode *inode, struct file *filp,
- if (argv[n].v_nmembs > nsegs * nilfs->ns_blocks_per_segment)
- goto out_free;
-
-+ if (argv[n].v_nmembs >= UINT_MAX / argv[n].v_size)
-+ goto out_free;
-+
- len = argv[n].v_size * argv[n].v_nmembs;
- base = (void __user *)(unsigned long)argv[n].v_base;
- if (len == 0) {
-diff --git a/fs/notify/dnotify/dnotify.c b/fs/notify/dnotify/dnotify.c
-index 7e54e52..9337248 100644
---- a/fs/notify/dnotify/dnotify.c
-+++ b/fs/notify/dnotify/dnotify.c
-@@ -173,7 +173,7 @@ static void dnotify_free_mark(struct fsnotify_mark_entry *entry)
- kmem_cache_free(dnotify_mark_entry_cache, dnentry);
- }
-
--static struct fsnotify_ops dnotify_fsnotify_ops = {
-+static const struct fsnotify_ops dnotify_fsnotify_ops = {
- .handle_event = dnotify_handle_event,
- .should_send_event = dnotify_should_send_event,
- .free_group_priv = NULL,
-diff --git a/fs/notify/notification.c b/fs/notify/notification.c
-index b8bf53b..c518688 100644
---- a/fs/notify/notification.c
-+++ b/fs/notify/notification.c
-@@ -57,7 +57,7 @@ static struct kmem_cache *fsnotify_event_holder_cachep;
- * get set to 0 so it will never get 'freed'
- */
- static struct fsnotify_event q_overflow_event;
--static atomic_t fsnotify_sync_cookie = ATOMIC_INIT(0);
-+static atomic_unchecked_t fsnotify_sync_cookie = ATOMIC_INIT(0);
-
- /**
- * fsnotify_get_cookie - return a unique cookie for use in synchronizing events.
-@@ -65,7 +65,7 @@ static atomic_t fsnotify_sync_cookie = ATOMIC_INIT(0);
- */
- u32 fsnotify_get_cookie(void)
- {
-- return atomic_inc_return(&fsnotify_sync_cookie);
-+ return atomic_inc_return_unchecked(&fsnotify_sync_cookie);
- }
- EXPORT_SYMBOL_GPL(fsnotify_get_cookie);
-
-diff --git a/fs/ntfs/dir.c b/fs/ntfs/dir.c
-index 5a9e344..0f8cd28 100644
---- a/fs/ntfs/dir.c
-+++ b/fs/ntfs/dir.c
-@@ -1328,7 +1328,7 @@ find_next_index_buffer:
- ia = (INDEX_ALLOCATION*)(kaddr + (ia_pos & ~PAGE_CACHE_MASK &
- ~(s64)(ndir->itype.index.block_size - 1)));
- /* Bounds checks. */
-- if (unlikely((u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
-+ if (unlikely(!kaddr || (u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
- ntfs_error(sb, "Out of bounds check failed. Corrupt directory "
- "inode 0x%lx or driver bug.", vdir->i_ino);
- goto err_out;
-diff --git a/fs/ntfs/file.c b/fs/ntfs/file.c
-index 663c0e3..b6868e9 100644
---- a/fs/ntfs/file.c
-+++ b/fs/ntfs/file.c
-@@ -2243,6 +2243,6 @@ const struct inode_operations ntfs_file_inode_ops = {
- #endif /* NTFS_RW */
- };
-
--const struct file_operations ntfs_empty_file_ops = {};
-+const struct file_operations ntfs_empty_file_ops __read_only;
-
--const struct inode_operations ntfs_empty_inode_ops = {};
-+const struct inode_operations ntfs_empty_inode_ops __read_only;
-diff --git a/fs/ocfs2/cluster/masklog.c b/fs/ocfs2/cluster/masklog.c
-index 1cd2934..880b5d2 100644
---- a/fs/ocfs2/cluster/masklog.c
-+++ b/fs/ocfs2/cluster/masklog.c
-@@ -135,7 +135,7 @@ static ssize_t mlog_store(struct kobject *obj, struct attribute *attr,
- return mlog_mask_store(mlog_attr->mask, buf, count);
- }
-
--static struct sysfs_ops mlog_attr_ops = {
-+static const struct sysfs_ops mlog_attr_ops = {
- .show = mlog_show,
- .store = mlog_store,
- };
-diff --git a/fs/ocfs2/localalloc.c b/fs/ocfs2/localalloc.c
-index ac10f83..2cd2607 100644
---- a/fs/ocfs2/localalloc.c
-+++ b/fs/ocfs2/localalloc.c
-@@ -1188,7 +1188,7 @@ static int ocfs2_local_alloc_slide_window(struct ocfs2_super *osb,
- goto bail;
- }
-
-- atomic_inc(&osb->alloc_stats.moves);
-+ atomic_inc_unchecked(&osb->alloc_stats.moves);
-
- status = 0;
- bail:
-diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
-index f010b22..9f9ed34 100644
---- a/fs/ocfs2/namei.c
-+++ b/fs/ocfs2/namei.c
-@@ -1043,6 +1043,8 @@ static int ocfs2_rename(struct inode *old_dir,
- struct ocfs2_dir_lookup_result orphan_insert = { NULL, };
- struct ocfs2_dir_lookup_result target_insert = { NULL, };
-
-+ pax_track_stack();
-+
- /* At some point it might be nice to break this function up a
- * bit. */
-
-diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
-index d963d86..914cfbd 100644
---- a/fs/ocfs2/ocfs2.h
-+++ b/fs/ocfs2/ocfs2.h
-@@ -217,11 +217,11 @@ enum ocfs2_vol_state
-
- struct ocfs2_alloc_stats
- {
-- atomic_t moves;
-- atomic_t local_data;
-- atomic_t bitmap_data;
-- atomic_t bg_allocs;
-- atomic_t bg_extends;
-+ atomic_unchecked_t moves;
-+ atomic_unchecked_t local_data;
-+ atomic_unchecked_t bitmap_data;
-+ atomic_unchecked_t bg_allocs;
-+ atomic_unchecked_t bg_extends;
- };
-
- enum ocfs2_local_alloc_state
-diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
-index 79b5dac..d322952 100644
---- a/fs/ocfs2/suballoc.c
-+++ b/fs/ocfs2/suballoc.c
-@@ -623,7 +623,7 @@ static int ocfs2_reserve_suballoc_bits(struct ocfs2_super *osb,
- mlog_errno(status);
- goto bail;
- }
-- atomic_inc(&osb->alloc_stats.bg_extends);
-+ atomic_inc_unchecked(&osb->alloc_stats.bg_extends);
-
- /* You should never ask for this much metadata */
- BUG_ON(bits_wanted >
-@@ -1654,7 +1654,7 @@ int ocfs2_claim_metadata(struct ocfs2_super *osb,
- mlog_errno(status);
- goto bail;
- }
-- atomic_inc(&osb->alloc_stats.bg_allocs);
-+ atomic_inc_unchecked(&osb->alloc_stats.bg_allocs);
-
- *blkno_start = bg_blkno + (u64) *suballoc_bit_start;
- ac->ac_bits_given += (*num_bits);
-@@ -1728,7 +1728,7 @@ int ocfs2_claim_new_inode(struct ocfs2_super *osb,
- mlog_errno(status);
- goto bail;
- }
-- atomic_inc(&osb->alloc_stats.bg_allocs);
-+ atomic_inc_unchecked(&osb->alloc_stats.bg_allocs);
-
- BUG_ON(num_bits != 1);
-
-@@ -1830,7 +1830,7 @@ int __ocfs2_claim_clusters(struct ocfs2_super *osb,
- cluster_start,
- num_clusters);
- if (!status)
-- atomic_inc(&osb->alloc_stats.local_data);
-+ atomic_inc_unchecked(&osb->alloc_stats.local_data);
- } else {
- if (min_clusters > (osb->bitmap_cpg - 1)) {
- /* The only paths asking for contiguousness
-@@ -1858,7 +1858,7 @@ int __ocfs2_claim_clusters(struct ocfs2_super *osb,
- ocfs2_desc_bitmap_to_cluster_off(ac->ac_inode,
- bg_blkno,
- bg_bit_off);
-- atomic_inc(&osb->alloc_stats.bitmap_data);
-+ atomic_inc_unchecked(&osb->alloc_stats.bitmap_data);
- }
- }
- if (status < 0) {
-diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
-index 9f55be4..a3f8048 100644
---- a/fs/ocfs2/super.c
-+++ b/fs/ocfs2/super.c
-@@ -284,11 +284,11 @@ static int ocfs2_osb_dump(struct ocfs2_super *osb, char *buf, int len)
- "%10s => GlobalAllocs: %d LocalAllocs: %d "
- "SubAllocs: %d LAWinMoves: %d SAExtends: %d\n",
- "Stats",
-- atomic_read(&osb->alloc_stats.bitmap_data),
-- atomic_read(&osb->alloc_stats.local_data),
-- atomic_read(&osb->alloc_stats.bg_allocs),
-- atomic_read(&osb->alloc_stats.moves),
-- atomic_read(&osb->alloc_stats.bg_extends));
-+ atomic_read_unchecked(&osb->alloc_stats.bitmap_data),
-+ atomic_read_unchecked(&osb->alloc_stats.local_data),
-+ atomic_read_unchecked(&osb->alloc_stats.bg_allocs),
-+ atomic_read_unchecked(&osb->alloc_stats.moves),
-+ atomic_read_unchecked(&osb->alloc_stats.bg_extends));
-
- out += snprintf(buf + out, len - out,
- "%10s => State: %u Descriptor: %llu Size: %u bits "
-@@ -2002,11 +2002,11 @@ static int ocfs2_initialize_super(struct super_block *sb,
- spin_lock_init(&osb->osb_xattr_lock);
- ocfs2_init_inode_steal_slot(osb);
-
-- atomic_set(&osb->alloc_stats.moves, 0);
-- atomic_set(&osb->alloc_stats.local_data, 0);
-- atomic_set(&osb->alloc_stats.bitmap_data, 0);
-- atomic_set(&osb->alloc_stats.bg_allocs, 0);
-- atomic_set(&osb->alloc_stats.bg_extends, 0);
-+ atomic_set_unchecked(&osb->alloc_stats.moves, 0);
-+ atomic_set_unchecked(&osb->alloc_stats.local_data, 0);
-+ atomic_set_unchecked(&osb->alloc_stats.bitmap_data, 0);
-+ atomic_set_unchecked(&osb->alloc_stats.bg_allocs, 0);
-+ atomic_set_unchecked(&osb->alloc_stats.bg_extends, 0);
-
- /* Copy the blockcheck stats from the superblock probe */
- osb->osb_ecc_stats = *stats;
-diff --git a/fs/open.c b/fs/open.c
-index 4f01e06..b8a21b3 100644
---- a/fs/open.c
-+++ b/fs/open.c
-@@ -31,6 +31,9 @@
- #include <linux/falloc.h>
- #include <linux/fs_struct.h>
-
-+#define CREATE_TRACE_POINTS
-+#include <trace/events/fs.h>
-+
- int vfs_statfs(struct dentry *dentry, struct kstatfs *buf)
- {
- int retval = -ENODEV;
-@@ -275,6 +278,10 @@ static long do_sys_truncate(const char __user *pathname, loff_t length)
- error = locks_verify_truncate(inode, NULL, length);
- if (!error)
- error = security_path_truncate(&path, length, 0);
-+
-+ if (!error && !gr_acl_handle_truncate(path.dentry, path.mnt))
-+ error = -EACCES;
-+
- if (!error) {
- vfs_dq_init(inode);
- error = do_truncate(path.dentry, length, 0, NULL);
-@@ -511,6 +518,9 @@ SYSCALL_DEFINE3(faccessat, int, dfd, const char __user *, filename, int, mode)
- if (__mnt_is_readonly(path.mnt))
- res = -EROFS;
-
-+ if (!res && !gr_acl_handle_access(path.dentry, path.mnt, mode))
-+ res = -EACCES;
-+
- out_path_release:
- path_put(&path);
- out:
-@@ -537,6 +547,8 @@ SYSCALL_DEFINE1(chdir, const char __user *, filename)
- if (error)
- goto dput_and_out;
-
-+ gr_log_chdir(path.dentry, path.mnt);
-+
- set_fs_pwd(current->fs, &path);
-
- dput_and_out:
-@@ -563,6 +575,13 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd)
- goto out_putf;
-
- error = inode_permission(inode, MAY_EXEC | MAY_ACCESS);
-+
-+ if (!error && !gr_chroot_fchdir(file->f_path.dentry, file->f_path.mnt))
-+ error = -EPERM;
-+
-+ if (!error)
-+ gr_log_chdir(file->f_path.dentry, file->f_path.mnt);
-+
- if (!error)
- set_fs_pwd(current->fs, &file->f_path);
- out_putf:
-@@ -588,7 +607,13 @@ SYSCALL_DEFINE1(chroot, const char __user *, filename)
- if (!capable(CAP_SYS_CHROOT))
- goto dput_and_out;
-
-+ if (gr_handle_chroot_chroot(path.dentry, path.mnt))
-+ goto dput_and_out;
-+
- set_fs_root(current->fs, &path);
-+
-+ gr_handle_chroot_chdir(&path);
-+
- error = 0;
- dput_and_out:
- path_put(&path);
-@@ -596,66 +621,57 @@ out:
- return error;
- }
-
-+static int chmod_common(struct path *path, umode_t mode)
-+{
-+ struct inode *inode = path->dentry->d_inode;
-+ struct iattr newattrs;
-+ int error;
-+
-+ error = mnt_want_write(path->mnt);
-+ if (error)
-+ return error;
-+ mutex_lock(&inode->i_mutex);
-+ if (!gr_acl_handle_chmod(path->dentry, path->mnt, &mode)) {
-+ error = -EACCES;
-+ goto out_unlock;
-+ }
-+ if (gr_handle_chroot_chmod(path->dentry, path->mnt, mode)) {
-+ error = -EPERM;
-+ goto out_unlock;
-+ }
-+ newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
-+ newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
-+ error = notify_change(path->dentry, &newattrs);
-+out_unlock:
-+ mutex_unlock(&inode->i_mutex);
-+ mnt_drop_write(path->mnt);
-+ return error;
-+}
-+
- SYSCALL_DEFINE2(fchmod, unsigned int, fd, mode_t, mode)
- {
-- struct inode * inode;
-- struct dentry * dentry;
- struct file * file;
- int err = -EBADF;
-- struct iattr newattrs;
-
- file = fget(fd);
-- if (!file)
-- goto out;
--
-- dentry = file->f_path.dentry;
-- inode = dentry->d_inode;
--
-- audit_inode(NULL, dentry);
--
-- err = mnt_want_write_file(file);
-- if (err)
-- goto out_putf;
-- mutex_lock(&inode->i_mutex);
-- if (mode == (mode_t) -1)
-- mode = inode->i_mode;
-- newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
-- newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
-- err = notify_change(dentry, &newattrs);
-- mutex_unlock(&inode->i_mutex);
-- mnt_drop_write(file->f_path.mnt);
--out_putf:
-- fput(file);
--out:
-+ if (file) {
-+ audit_inode(NULL, file->f_path.dentry);
-+ err = chmod_common(&file->f_path, mode);
-+ fput(file);
-+ }
- return err;
- }
-
- SYSCALL_DEFINE3(fchmodat, int, dfd, const char __user *, filename, mode_t, mode)
- {
- struct path path;
-- struct inode *inode;
- int error;
-- struct iattr newattrs;
-
- error = user_path_at(dfd, filename, LOOKUP_FOLLOW, &path);
-- if (error)
-- goto out;
-- inode = path.dentry->d_inode;
--
-- error = mnt_want_write(path.mnt);
-- if (error)
-- goto dput_and_out;
-- mutex_lock(&inode->i_mutex);
-- if (mode == (mode_t) -1)
-- mode = inode->i_mode;
-- newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
-- newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
-- error = notify_change(path.dentry, &newattrs);
-- mutex_unlock(&inode->i_mutex);
-- mnt_drop_write(path.mnt);
--dput_and_out:
-- path_put(&path);
--out:
-+ if (!error) {
-+ error = chmod_common(&path, mode);
-+ path_put(&path);
-+ }
- return error;
- }
-
-@@ -664,12 +680,15 @@ SYSCALL_DEFINE2(chmod, const char __user *, filename, mode_t, mode)
- return sys_fchmodat(AT_FDCWD, filename, mode);
- }
-
--static int chown_common(struct dentry * dentry, uid_t user, gid_t group)
-+static int chown_common(struct dentry * dentry, uid_t user, gid_t group, struct vfsmount *mnt)
- {
- struct inode *inode = dentry->d_inode;
- int error;
- struct iattr newattrs;
-
-+ if (!gr_acl_handle_chown(dentry, mnt))
-+ return -EACCES;
-+
- newattrs.ia_valid = ATTR_CTIME;
- if (user != (uid_t) -1) {
- newattrs.ia_valid |= ATTR_UID;
-@@ -700,7 +719,7 @@ SYSCALL_DEFINE3(chown, const char __user *, filename, uid_t, user, gid_t, group)
- error = mnt_want_write(path.mnt);
- if (error)
- goto out_release;
-- error = chown_common(path.dentry, user, group);
-+ error = chown_common(path.dentry, user, group, path.mnt);
- mnt_drop_write(path.mnt);
- out_release:
- path_put(&path);
-@@ -725,7 +744,7 @@ SYSCALL_DEFINE5(fchownat, int, dfd, const char __user *, filename, uid_t, user,
- error = mnt_want_write(path.mnt);
- if (error)
- goto out_release;
-- error = chown_common(path.dentry, user, group);
-+ error = chown_common(path.dentry, user, group, path.mnt);
- mnt_drop_write(path.mnt);
- out_release:
- path_put(&path);
-@@ -744,7 +763,7 @@ SYSCALL_DEFINE3(lchown, const char __user *, filename, uid_t, user, gid_t, group
- error = mnt_want_write(path.mnt);
- if (error)
- goto out_release;
-- error = chown_common(path.dentry, user, group);
-+ error = chown_common(path.dentry, user, group, path.mnt);
- mnt_drop_write(path.mnt);
- out_release:
- path_put(&path);
-@@ -767,7 +786,7 @@ SYSCALL_DEFINE3(fchown, unsigned int, fd, uid_t, user, gid_t, group)
- goto out_fput;
- dentry = file->f_path.dentry;
- audit_inode(NULL, dentry);
-- error = chown_common(dentry, user, group);
-+ error = chown_common(dentry, user, group, file->f_path.mnt);
- mnt_drop_write(file->f_path.mnt);
- out_fput:
- fput(file);
-@@ -1036,13 +1055,14 @@ long do_sys_open(int dfd, const char __user *filename, int flags, int mode)
- if (!IS_ERR(tmp)) {
- fd = get_unused_fd_flags(flags);
- if (fd >= 0) {
-- struct file *f = do_filp_open(dfd, tmp, flags, mode, 0);
-+ struct file *f = do_filp_open(dfd, tmp, flags, mode, 0);
- if (IS_ERR(f)) {
- put_unused_fd(fd);
- fd = PTR_ERR(f);
- } else {
- fsnotify_open(f->f_path.dentry);
- fd_install(fd, f);
-+ trace_do_sys_open(tmp, flags, mode);
- }
- }
- putname(tmp);
-diff --git a/fs/partitions/efi.c b/fs/partitions/efi.c
-index 6ab70f4..f4103d1 100644
---- a/fs/partitions/efi.c
-+++ b/fs/partitions/efi.c
-@@ -231,14 +231,14 @@ alloc_read_gpt_entries(struct block_device *bdev, gpt_header *gpt)
- if (!bdev || !gpt)
- return NULL;
-
-+ if (!le32_to_cpu(gpt->num_partition_entries))
-+ return NULL;
-+ pte = kcalloc(le32_to_cpu(gpt->num_partition_entries), le32_to_cpu(gpt->sizeof_partition_entry), GFP_KERNEL);
-+ if (!pte)
-+ return NULL;
-+
- count = le32_to_cpu(gpt->num_partition_entries) *
- le32_to_cpu(gpt->sizeof_partition_entry);
-- if (!count)
-- return NULL;
-- pte = kzalloc(count, GFP_KERNEL);
-- if (!pte)
-- return NULL;
--
- if (read_lba(bdev, le64_to_cpu(gpt->partition_entry_lba),
- (u8 *) pte,
- count) < count) {
-diff --git a/fs/partitions/ldm.c b/fs/partitions/ldm.c
-index dd6efdb..3babc6c 100644
---- a/fs/partitions/ldm.c
-+++ b/fs/partitions/ldm.c
-@@ -1311,6 +1311,7 @@ static bool ldm_frag_add (const u8 *data, int size, struct list_head *frags)
- ldm_error ("A VBLK claims to have %d parts.", num);
- return false;
- }
-+
- if (rec >= num) {
- ldm_error("REC value (%d) exceeds NUM value (%d)", rec, num);
- return false;
-@@ -1322,7 +1323,7 @@ static bool ldm_frag_add (const u8 *data, int size, struct list_head *frags)
- goto found;
- }
-
-- f = kmalloc (sizeof (*f) + size*num, GFP_KERNEL);
-+ f = kmalloc (size*num + sizeof (*f), GFP_KERNEL);
- if (!f) {
- ldm_crit ("Out of memory.");
- return false;
-diff --git a/fs/partitions/mac.c b/fs/partitions/mac.c
-index 5765198..7f8e9e0 100644
---- a/fs/partitions/mac.c
-+++ b/fs/partitions/mac.c
-@@ -59,11 +59,11 @@ int mac_partition(struct parsed_partitions *state, struct block_device *bdev)
- return 0; /* not a MacOS disk */
- }
- blocks_in_map = be32_to_cpu(part->map_count);
-- if (blocks_in_map < 0 || blocks_in_map >= DISK_MAX_PARTS) {
-- put_dev_sector(sect);
-- return 0;
-- }
- printk(" [mac]");
-+ if (blocks_in_map < 0 || blocks_in_map >= DISK_MAX_PARTS) {
-+ put_dev_sector(sect);
-+ return 0;
-+ }
- for (slot = 1; slot <= blocks_in_map; ++slot) {
- int pos = slot * secsize;
- put_dev_sector(sect);
-diff --git a/fs/pipe.c b/fs/pipe.c
-index d0cc080..b63ef40 100644
---- a/fs/pipe.c
-+++ b/fs/pipe.c
-@@ -401,9 +401,9 @@ redo:
- }
- if (bufs) /* More to do? */
- continue;
-- if (!pipe->writers)
-+ if (!atomic_read(&pipe->writers))
- break;
-- if (!pipe->waiting_writers) {
-+ if (!atomic_read(&pipe->waiting_writers)) {
- /* syscall merging: Usually we must not sleep
- * if O_NONBLOCK is set, or if we got some data.
- * But if a writer sleeps in kernel space, then
-@@ -462,7 +462,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
- mutex_lock(&inode->i_mutex);
- pipe = inode->i_pipe;
-
-- if (!pipe->readers) {
-+ if (!atomic_read(&pipe->readers)) {
- send_sig(SIGPIPE, current, 0);
- ret = -EPIPE;
- goto out;
-@@ -511,7 +511,7 @@ redo1:
- for (;;) {
- int bufs;
-
-- if (!pipe->readers) {
-+ if (!atomic_read(&pipe->readers)) {
- send_sig(SIGPIPE, current, 0);
- if (!ret)
- ret = -EPIPE;
-@@ -597,9 +597,9 @@ redo2:
- kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
- do_wakeup = 0;
- }
-- pipe->waiting_writers++;
-+ atomic_inc(&pipe->waiting_writers);
- pipe_wait(pipe);
-- pipe->waiting_writers--;
-+ atomic_dec(&pipe->waiting_writers);
- }
- out:
- mutex_unlock(&inode->i_mutex);
-@@ -666,7 +666,7 @@ pipe_poll(struct file *filp, poll_table *wait)
- mask = 0;
- if (filp->f_mode & FMODE_READ) {
- mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0;
-- if (!pipe->writers && filp->f_version != pipe->w_counter)
-+ if (!atomic_read(&pipe->writers) && filp->f_version != pipe->w_counter)
- mask |= POLLHUP;
- }
-
-@@ -676,7 +676,7 @@ pipe_poll(struct file *filp, poll_table *wait)
- * Most Unices do not set POLLERR for FIFOs but on Linux they
- * behave exactly like pipes for poll().
- */
-- if (!pipe->readers)
-+ if (!atomic_read(&pipe->readers))
- mask |= POLLERR;
- }
-
-@@ -690,10 +690,10 @@ pipe_release(struct inode *inode, int decr, int decw)
-
- mutex_lock(&inode->i_mutex);
- pipe = inode->i_pipe;
-- pipe->readers -= decr;
-- pipe->writers -= decw;
-+ atomic_sub(decr, &pipe->readers);
-+ atomic_sub(decw, &pipe->writers);
-
-- if (!pipe->readers && !pipe->writers) {
-+ if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers)) {
- free_pipe_info(inode);
- } else {
- wake_up_interruptible_sync(&pipe->wait);
-@@ -783,7 +783,7 @@ pipe_read_open(struct inode *inode, struct file *filp)
-
- if (inode->i_pipe) {
- ret = 0;
-- inode->i_pipe->readers++;
-+ atomic_inc(&inode->i_pipe->readers);
- }
-
- mutex_unlock(&inode->i_mutex);
-@@ -800,7 +800,7 @@ pipe_write_open(struct inode *inode, struct file *filp)
-
- if (inode->i_pipe) {
- ret = 0;
-- inode->i_pipe->writers++;
-+ atomic_inc(&inode->i_pipe->writers);
- }
-
- mutex_unlock(&inode->i_mutex);
-@@ -813,14 +813,17 @@ pipe_rdwr_open(struct inode *inode, struct file *filp)
- {
- int ret = -ENOENT;
-
-+ if (!(filp->f_mode & (FMODE_READ|FMODE_WRITE)))
-+ return -EINVAL;
-+
- mutex_lock(&inode->i_mutex);
-
- if (inode->i_pipe) {
- ret = 0;
- if (filp->f_mode & FMODE_READ)
-- inode->i_pipe->readers++;
-+ atomic_inc(&inode->i_pipe->readers);
- if (filp->f_mode & FMODE_WRITE)
-- inode->i_pipe->writers++;
-+ atomic_inc(&inode->i_pipe->writers);
- }
-
- mutex_unlock(&inode->i_mutex);
-@@ -905,7 +908,7 @@ void free_pipe_info(struct inode *inode)
- inode->i_pipe = NULL;
- }
-
--static struct vfsmount *pipe_mnt __read_mostly;
-+struct vfsmount *pipe_mnt __read_mostly;
- static int pipefs_delete_dentry(struct dentry *dentry)
- {
- /*
-@@ -945,7 +948,8 @@ static struct inode * get_pipe_inode(void)
- goto fail_iput;
- inode->i_pipe = pipe;
-
-- pipe->readers = pipe->writers = 1;
-+ atomic_set(&pipe->readers, 1);
-+ atomic_set(&pipe->writers, 1);
- inode->i_fop = &rdwr_pipefifo_fops;
-
- /*
-diff --git a/fs/proc/Kconfig b/fs/proc/Kconfig
-index 50f8f06..c5755df 100644
---- a/fs/proc/Kconfig
-+++ b/fs/proc/Kconfig
-@@ -30,12 +30,12 @@ config PROC_FS
-
- config PROC_KCORE
- bool "/proc/kcore support" if !ARM
-- depends on PROC_FS && MMU
-+ depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
-
- config PROC_VMCORE
- bool "/proc/vmcore support (EXPERIMENTAL)"
-- depends on PROC_FS && CRASH_DUMP
-- default y
-+ depends on PROC_FS && CRASH_DUMP && !GRKERNSEC
-+ default n
- help
- Exports the dump image of crashed kernel in ELF format.
-
-@@ -59,8 +59,8 @@ config PROC_SYSCTL
- limited in memory.
-
- config PROC_PAGE_MONITOR
-- default y
-- depends on PROC_FS && MMU
-+ default n
-+ depends on PROC_FS && MMU && !GRKERNSEC
- bool "Enable /proc page monitoring" if EMBEDDED
- help
- Various /proc files exist to monitor process memory utilization:
-diff --git a/fs/proc/array.c b/fs/proc/array.c
-index c5ef152..28c94f7 100644
---- a/fs/proc/array.c
-+++ b/fs/proc/array.c
-@@ -60,6 +60,7 @@
- #include <linux/tty.h>
- #include <linux/string.h>
- #include <linux/mman.h>
-+#include <linux/grsecurity.h>
- #include <linux/proc_fs.h>
- #include <linux/ioport.h>
- #include <linux/uaccess.h>
-@@ -321,6 +322,21 @@ static inline void task_context_switch_counts(struct seq_file *m,
- p->nivcsw);
- }
-
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+static inline void task_pax(struct seq_file *m, struct task_struct *p)
-+{
-+ if (p->mm)
-+ seq_printf(m, "PaX:\t%c%c%c%c%c\n",
-+ p->mm->pax_flags & MF_PAX_PAGEEXEC ? 'P' : 'p',
-+ p->mm->pax_flags & MF_PAX_EMUTRAMP ? 'E' : 'e',
-+ p->mm->pax_flags & MF_PAX_MPROTECT ? 'M' : 'm',
-+ p->mm->pax_flags & MF_PAX_RANDMMAP ? 'R' : 'r',
-+ p->mm->pax_flags & MF_PAX_SEGMEXEC ? 'S' : 's');
-+ else
-+ seq_printf(m, "PaX:\t-----\n");
-+}
-+#endif
-+
- int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
- struct pid *pid, struct task_struct *task)
- {
-@@ -337,9 +353,24 @@ int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
- task_cap(m, task);
- cpuset_task_status_allowed(m, task);
- task_context_switch_counts(m, task);
-+
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+ task_pax(m, task);
-+#endif
-+
-+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
-+ task_grsec_rbac(m, task);
-+#endif
-+
- return 0;
- }
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
-+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
-+ _mm->pax_flags & MF_PAX_SEGMEXEC))
-+#endif
-+
- static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
- struct pid *pid, struct task_struct *task, int whole)
- {
-@@ -358,9 +389,18 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
- cputime_t cutime, cstime, utime, stime;
- cputime_t cgtime, gtime;
- unsigned long rsslim = 0;
-- char tcomm[sizeof(task->comm)];
-+ char tcomm[sizeof(task->comm)] = { 0 };
- unsigned long flags;
-
-+ pax_track_stack();
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ if (current->exec_id != m->exec_id) {
-+ gr_log_badprocpid("stat");
-+ return 0;
-+ }
-+#endif
-+
- state = *get_task_state(task);
- vsize = eip = esp = 0;
- permitted = ptrace_may_access(task, PTRACE_MODE_READ);
-@@ -433,6 +473,19 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
- gtime = task_gtime(task);
- }
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ if (PAX_RAND_FLAGS(mm)) {
-+ eip = 0;
-+ esp = 0;
-+ wchan = 0;
-+ }
-+#endif
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ wchan = 0;
-+ eip =0;
-+ esp =0;
-+#endif
-+
- /* scale priority and nice values from timeslices to -20..20 */
- /* to make it look like a "normal" Unix priority/nice value */
- priority = task_prio(task);
-@@ -473,9 +526,15 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
- vsize,
- mm ? get_mm_rss(mm) : 0,
- rsslim,
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->start_code : 1) : 0),
-+ PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->end_code : 1) : 0),
-+ PAX_RAND_FLAGS(mm) ? 0 : ((permitted && mm) ? mm->start_stack : 0),
-+#else
- mm ? (permitted ? mm->start_code : 1) : 0,
- mm ? (permitted ? mm->end_code : 1) : 0,
- (permitted && mm) ? mm->start_stack : 0,
-+#endif
- esp,
- eip,
- /* The signal information here is obsolete.
-@@ -517,8 +576,16 @@ int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
- struct pid *pid, struct task_struct *task)
- {
- int size = 0, resident = 0, shared = 0, text = 0, lib = 0, data = 0;
-- struct mm_struct *mm = get_task_mm(task);
-+ struct mm_struct *mm;
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ if (current->exec_id != m->exec_id) {
-+ gr_log_badprocpid("statm");
-+ return 0;
-+ }
-+#endif
-+
-+ mm = get_task_mm(task);
- if (mm) {
- size = task_statm(mm, &shared, &text, &data, &resident);
- mmput(mm);
-@@ -528,3 +595,18 @@ int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
-
- return 0;
- }
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
-+int proc_pid_ipaddr(struct task_struct *task, char *buffer)
-+{
-+ u32 curr_ip = 0;
-+ unsigned long flags;
-+
-+ if (lock_task_sighand(task, &flags)) {
-+ curr_ip = task->signal->curr_ip;
-+ unlock_task_sighand(task, &flags);
-+ }
-+
-+ return sprintf(buffer, "%pI4\n", &curr_ip);
-+}
-+#endif
-diff --git a/fs/proc/base.c b/fs/proc/base.c
-index 67f7dc0..a6663de 100644
---- a/fs/proc/base.c
-+++ b/fs/proc/base.c
-@@ -102,6 +102,22 @@ struct pid_entry {
- union proc_op op;
- };
-
-+struct getdents_callback {
-+ struct linux_dirent __user * current_dir;
-+ struct linux_dirent __user * previous;
-+ struct file * file;
-+ int count;
-+ int error;
-+};
-+
-+static int gr_fake_filldir(void * __buf, const char *name, int namlen,
-+ loff_t offset, u64 ino, unsigned int d_type)
-+{
-+ struct getdents_callback * buf = (struct getdents_callback *) __buf;
-+ buf->error = -EINVAL;
-+ return 0;
-+}
-+
- #define NOD(NAME, MODE, IOP, FOP, OP) { \
- .name = (NAME), \
- .len = sizeof(NAME) - 1, \
-@@ -213,6 +229,9 @@ static int check_mem_permission(struct task_struct *task)
- if (task == current)
- return 0;
-
-+ if (gr_handle_proc_ptrace(task) || gr_acl_handle_procpidmem(task))
-+ return -EPERM;
-+
- /*
- * If current is actively ptrace'ing, and would also be
- * permitted to freshly attach with ptrace now, permit it.
-@@ -236,7 +255,7 @@ struct mm_struct *mm_for_maps(struct task_struct *task)
- {
- struct mm_struct *mm;
-
-- if (mutex_lock_killable(&task->cred_guard_mutex))
-+ if (mutex_lock_killable(&task->signal->cred_guard_mutex))
- return NULL;
-
- mm = get_task_mm(task);
-@@ -245,7 +264,7 @@ struct mm_struct *mm_for_maps(struct task_struct *task)
- mmput(mm);
- mm = NULL;
- }
-- mutex_unlock(&task->cred_guard_mutex);
-+ mutex_unlock(&task->signal->cred_guard_mutex);
-
- return mm;
- }
-@@ -260,6 +279,9 @@ static int proc_pid_cmdline(struct task_struct *task, char * buffer)
- if (!mm->arg_end)
- goto out_mm; /* Shh! No looking before we're done */
-
-+ if (gr_acl_handle_procpidmem(task))
-+ goto out_mm;
-+
- len = mm->arg_end - mm->arg_start;
-
- if (len > PAGE_SIZE)
-@@ -287,12 +309,28 @@ out:
- return res;
- }
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
-+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
-+ _mm->pax_flags & MF_PAX_SEGMEXEC))
-+#endif
-+
- static int proc_pid_auxv(struct task_struct *task, char *buffer)
- {
- int res = 0;
- struct mm_struct *mm = get_task_mm(task);
- if (mm) {
- unsigned int nwords = 0;
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ /* allow if we're currently ptracing this task */
-+ if (PAX_RAND_FLAGS(mm) &&
-+ (!(task->ptrace & PT_PTRACED) || (task->parent != current))) {
-+ mmput(mm);
-+ return 0;
-+ }
-+#endif
-+
- do {
- nwords += 2;
- } while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
-@@ -306,7 +344,7 @@ static int proc_pid_auxv(struct task_struct *task, char *buffer)
- }
-
-
--#ifdef CONFIG_KALLSYMS
-+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
- /*
- * Provides a wchan file via kallsyms in a proper one-value-per-file format.
- * Returns the resolved symbol. If that fails, simply return the address.
-@@ -330,11 +368,11 @@ static int proc_pid_wchan(struct task_struct *task, char *buffer)
-
- static int lock_trace(struct task_struct *task)
- {
-- int err = mutex_lock_killable(&task->cred_guard_mutex);
-+ int err = mutex_lock_killable(&task->signal->cred_guard_mutex);
- if (err)
- return err;
- if (!ptrace_may_access(task, PTRACE_MODE_ATTACH)) {
-- mutex_unlock(&task->cred_guard_mutex);
-+ mutex_unlock(&task->signal->cred_guard_mutex);
- return -EPERM;
- }
- return 0;
-@@ -342,10 +380,10 @@ static int lock_trace(struct task_struct *task)
-
- static void unlock_trace(struct task_struct *task)
- {
-- mutex_unlock(&task->cred_guard_mutex);
-+ mutex_unlock(&task->signal->cred_guard_mutex);
- }
-
--#ifdef CONFIG_STACKTRACE
-+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
-
- #define MAX_STACK_TRACE_DEPTH 64
-
-@@ -545,7 +583,7 @@ static int proc_pid_limits(struct task_struct *task, char *buffer)
- return count;
- }
-
--#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
-+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
- static int proc_pid_syscall(struct task_struct *task, char *buffer)
- {
- long nr;
-@@ -574,7 +612,7 @@ static int proc_pid_syscall(struct task_struct *task, char *buffer)
- /************************************************************************/
-
- /* permission checks */
--static int proc_fd_access_allowed(struct inode *inode)
-+static int proc_fd_access_allowed(struct inode *inode, unsigned int log)
- {
- struct task_struct *task;
- int allowed = 0;
-@@ -584,7 +622,10 @@ static int proc_fd_access_allowed(struct inode *inode)
- */
- task = get_proc_task(inode);
- if (task) {
-- allowed = ptrace_may_access(task, PTRACE_MODE_READ);
-+ if (log)
-+ allowed = ptrace_may_access_log(task, PTRACE_MODE_READ);
-+ else
-+ allowed = ptrace_may_access(task, PTRACE_MODE_READ);
- put_task_struct(task);
- }
- return allowed;
-@@ -806,9 +847,16 @@ static const struct file_operations proc_single_file_operations = {
- static int mem_open(struct inode* inode, struct file* file)
- {
- file->private_data = (void*)((long)current->self_exec_id);
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ file->f_version = current->exec_id;
-+#endif
-+
- return 0;
- }
-
-+static int task_dumpable(struct task_struct *task);
-+
- static ssize_t mem_read(struct file * file, char __user * buf,
- size_t count, loff_t *ppos)
- {
-@@ -818,6 +866,13 @@ static ssize_t mem_read(struct file * file, char __user * buf,
- int ret = -ESRCH;
- struct mm_struct *mm;
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ if (file->f_version != current->exec_id) {
-+ gr_log_badprocpid("mem");
-+ return 0;
-+ }
-+#endif
-+
- if (!task)
- goto out_no_task;
-
-@@ -960,9 +1015,18 @@ static ssize_t environ_read(struct file *file, char __user *buf,
- int ret = -ESRCH;
- struct mm_struct *mm;
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ if (file->f_version != current->exec_id) {
-+ gr_log_badprocpid("environ");
-+ return ret;
-+ }
-+#endif
- if (!task)
- goto out_no_task;
-
-+ if (gr_acl_handle_procpidmem(task))
-+ goto out;
-+
- if (!ptrace_may_access(task, PTRACE_MODE_READ))
- goto out;
-
-@@ -978,15 +1042,16 @@ static ssize_t environ_read(struct file *file, char __user *buf,
- goto out_free;
-
- while (count > 0) {
-- int this_len, retval, max_len;
-+ size_t this_len, max_len;
-+ int retval;
-+
-+ if (src >= (mm->env_end - mm->env_start))
-+ break;
-
- this_len = mm->env_end - (mm->env_start + src);
-
-- if (this_len <= 0)
-- break;
--
-- max_len = (count > PAGE_SIZE) ? PAGE_SIZE : count;
-- this_len = (this_len > max_len) ? max_len : this_len;
-+ max_len = min_t(size_t, PAGE_SIZE, count);
-+ this_len = min(max_len, this_len);
-
- retval = access_process_vm(task, (mm->env_start + src),
- page, this_len, 0);
-@@ -1019,6 +1084,7 @@ out_no_task:
-
- static const struct file_operations proc_environ_operations = {
- .read = environ_read,
-+ .open = mem_open,
- };
-
- static ssize_t oom_adjust_read(struct file *file, char __user *buf,
-@@ -1377,7 +1443,7 @@ static void *proc_pid_follow_link(struct dentry *dentry, struct nameidata *nd)
- path_put(&nd->path);
-
- /* Are we allowed to snoop on the tasks file descriptors? */
-- if (!proc_fd_access_allowed(inode))
-+ if (!proc_fd_access_allowed(inode,0))
- goto out;
-
- error = PROC_I(inode)->op.proc_get_link(inode, &nd->path);
-@@ -1417,8 +1483,18 @@ static int proc_pid_readlink(struct dentry * dentry, char __user * buffer, int b
- struct path path;
-
- /* Are we allowed to snoop on the tasks file descriptors? */
-- if (!proc_fd_access_allowed(inode))
-- goto out;
-+ /* logging this is needed for learning on chromium to work properly,
-+ but we don't want to flood the logs from 'ps' which does a readlink
-+ on /proc/fd/2 of tasks in the listing, nor do we want 'ps' to learn
-+ CAP_SYS_PTRACE as it's not necessary for its basic functionality
-+ */
-+ if (dentry->d_name.name[0] == '2' && dentry->d_name.name[1] == '\0') {
-+ if (!proc_fd_access_allowed(inode,0))
-+ goto out;
-+ } else {
-+ if (!proc_fd_access_allowed(inode,1))
-+ goto out;
-+ }
-
- error = PROC_I(inode)->op.proc_get_link(inode, &path);
- if (error)
-@@ -1483,7 +1559,11 @@ static struct inode *proc_pid_make_inode(struct super_block * sb, struct task_st
- rcu_read_lock();
- cred = __task_cred(task);
- inode->i_uid = cred->euid;
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+ inode->i_gid = grsec_proc_gid;
-+#else
- inode->i_gid = cred->egid;
-+#endif
- rcu_read_unlock();
- }
- security_task_to_inode(task, inode);
-@@ -1501,6 +1581,9 @@ static int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat
- struct inode *inode = dentry->d_inode;
- struct task_struct *task;
- const struct cred *cred;
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ const struct cred *tmpcred = current_cred();
-+#endif
-
- generic_fillattr(inode, stat);
-
-@@ -1508,13 +1591,41 @@ static int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat
- stat->uid = 0;
- stat->gid = 0;
- task = pid_task(proc_pid(inode), PIDTYPE_PID);
-+
-+ if (task && (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))) {
-+ rcu_read_unlock();
-+ return -ENOENT;
-+ }
-+
- if (task) {
-+ cred = __task_cred(task);
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ if (!tmpcred->uid || (tmpcred->uid == cred->uid)
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+ || in_group_p(grsec_proc_gid)
-+#endif
-+ ) {
-+#endif
- if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
-+#endif
- task_dumpable(task)) {
-- cred = __task_cred(task);
- stat->uid = cred->euid;
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+ stat->gid = grsec_proc_gid;
-+#else
- stat->gid = cred->egid;
-+#endif
- }
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ } else {
-+ rcu_read_unlock();
-+ return -ENOENT;
-+ }
-+#endif
- }
- rcu_read_unlock();
- return 0;
-@@ -1545,11 +1656,20 @@ static int pid_revalidate(struct dentry *dentry, struct nameidata *nd)
-
- if (task) {
- if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
-+#endif
- task_dumpable(task)) {
- rcu_read_lock();
- cred = __task_cred(task);
- inode->i_uid = cred->euid;
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+ inode->i_gid = grsec_proc_gid;
-+#else
- inode->i_gid = cred->egid;
-+#endif
- rcu_read_unlock();
- } else {
- inode->i_uid = 0;
-@@ -1670,7 +1790,8 @@ static int proc_fd_info(struct inode *inode, struct path *path, char *info)
- int fd = proc_fd(inode);
-
- if (task) {
-- files = get_files_struct(task);
-+ if (!gr_acl_handle_procpidmem(task))
-+ files = get_files_struct(task);
- put_task_struct(task);
- }
- if (files) {
-@@ -1922,12 +2043,22 @@ static const struct file_operations proc_fd_operations = {
- static int proc_fd_permission(struct inode *inode, int mask)
- {
- int rv;
-+ struct task_struct *task;
-
- rv = generic_permission(inode, mask, NULL);
-- if (rv == 0)
-- return 0;
-+
- if (task_pid(current) == proc_pid(inode))
- rv = 0;
-+
-+ task = get_proc_task(inode);
-+ if (task == NULL)
-+ return rv;
-+
-+ if (gr_acl_handle_procpidmem(task))
-+ rv = -EACCES;
-+
-+ put_task_struct(task);
-+
- return rv;
- }
-
-@@ -2036,6 +2167,9 @@ static struct dentry *proc_pident_lookup(struct inode *dir,
- if (!task)
- goto out_no_task;
-
-+ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
-+ goto out;
-+
- /*
- * Yes, it does not scale. And it should not. Don't add
- * new entries into /proc/<tgid>/ without very good reasons.
-@@ -2080,6 +2214,9 @@ static int proc_pident_readdir(struct file *filp,
- if (!task)
- goto out_no_task;
-
-+ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
-+ goto out;
-+
- ret = 0;
- i = filp->f_pos;
- switch (i) {
-@@ -2171,14 +2308,14 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf,
- goto out_free;
-
- /* Guard against adverse ptrace interaction */
-- length = mutex_lock_interruptible(&task->cred_guard_mutex);
-+ length = mutex_lock_interruptible(&task->signal->cred_guard_mutex);
- if (length < 0)
- goto out_free;
-
- length = security_setprocattr(task,
- (char*)file->f_path.dentry->d_name.name,
- (void*)page, count);
-- mutex_unlock(&task->cred_guard_mutex);
-+ mutex_unlock(&task->signal->cred_guard_mutex);
- out_free:
- free_page((unsigned long) page);
- out:
-@@ -2347,7 +2484,7 @@ static void *proc_self_follow_link(struct dentry *dentry, struct nameidata *nd)
- static void proc_self_put_link(struct dentry *dentry, struct nameidata *nd,
- void *cookie)
- {
-- char *s = nd_get_link(nd);
-+ const char *s = nd_get_link(nd);
- if (!IS_ERR(s))
- __putname(s);
- }
-@@ -2480,6 +2617,11 @@ static int do_io_accounting(struct task_struct *task, char *buffer, int whole)
- {
- struct task_io_accounting acct = task->ioac;
- unsigned long flags;
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ u64 saved_exec_id;
-+
-+ saved_exec_id = task->exec_id;
-+#endif
-
- if (!ptrace_may_access(task, PTRACE_MODE_READ))
- return -EACCES;
-@@ -2493,6 +2635,13 @@ static int do_io_accounting(struct task_struct *task, char *buffer, int whole)
-
- unlock_task_sighand(task, &flags);
- }
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ /* clear the info if an exec occured during its processing*/
-+ if (saved_exec_id != task->exec_id)
-+ memset(&acct, 0, sizeof(acct));
-+#endif
-+
- return sprintf(buffer,
- "rchar: %llu\n"
- "wchar: %llu\n"
-@@ -2524,12 +2673,8 @@ static int proc_tgid_io_accounting(struct task_struct *task, char *buffer)
- static int proc_pid_personality(struct seq_file *m, struct pid_namespace *ns,
- struct pid *pid, struct task_struct *task)
- {
-- int err = lock_trace(task);
-- if (!err) {
-- seq_printf(m, "%08x\n", task->personality);
-- unlock_trace(task);
-- }
-- return err;
-+ seq_printf(m, "%08x\n", task->personality);
-+ return 0;
- }
-
- /*
-@@ -2553,7 +2698,7 @@ static const struct pid_entry tgid_base_stuff[] = {
- #ifdef CONFIG_SCHED_DEBUG
- REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations),
- #endif
--#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
-+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
- INF("syscall", S_IRUGO, proc_pid_syscall),
- #endif
- INF("cmdline", S_IRUGO, proc_pid_cmdline),
-@@ -2578,10 +2723,10 @@ static const struct pid_entry tgid_base_stuff[] = {
- #ifdef CONFIG_SECURITY
- DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
- #endif
--#ifdef CONFIG_KALLSYMS
-+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
- INF("wchan", S_IRUGO, proc_pid_wchan),
- #endif
--#ifdef CONFIG_STACKTRACE
-+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
- ONE("stack", S_IRUGO, proc_pid_stack),
- #endif
- #ifdef CONFIG_SCHEDSTATS
-@@ -2611,6 +2756,9 @@ static const struct pid_entry tgid_base_stuff[] = {
- #ifdef CONFIG_TASK_IO_ACCOUNTING
- INF("io", S_IRUSR, proc_tgid_io_accounting),
- #endif
-+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
-+ INF("ipaddr", S_IRUSR, proc_pid_ipaddr),
-+#endif
- };
-
- static int proc_tgid_base_readdir(struct file * filp,
-@@ -2735,7 +2883,14 @@ static struct dentry *proc_pid_instantiate(struct inode *dir,
- if (!inode)
- goto out;
-
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+ inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ inode->i_gid = grsec_proc_gid;
-+ inode->i_mode = S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP;
-+#else
- inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
-+#endif
- inode->i_op = &proc_tgid_base_inode_operations;
- inode->i_fop = &proc_tgid_base_operations;
- inode->i_flags|=S_IMMUTABLE;
-@@ -2777,7 +2932,11 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, struct
- if (!task)
- goto out;
-
-+ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
-+ goto out_put_task;
-+
- result = proc_pid_instantiate(dir, dentry, task, NULL);
-+out_put_task:
- put_task_struct(task);
- out:
- return result;
-@@ -2842,6 +3001,11 @@ int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
- {
- unsigned int nr;
- struct task_struct *reaper;
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ const struct cred *tmpcred = current_cred();
-+ const struct cred *itercred;
-+#endif
-+ filldir_t __filldir = filldir;
- struct tgid_iter iter;
- struct pid_namespace *ns;
-
-@@ -2865,8 +3029,27 @@ int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
- for (iter = next_tgid(ns, iter);
- iter.task;
- iter.tgid += 1, iter = next_tgid(ns, iter)) {
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ rcu_read_lock();
-+ itercred = __task_cred(iter.task);
-+#endif
-+ if (gr_pid_is_chrooted(iter.task) || gr_check_hidden_task(iter.task)
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ || (tmpcred->uid && (itercred->uid != tmpcred->uid)
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+ && !in_group_p(grsec_proc_gid)
-+#endif
-+ )
-+#endif
-+ )
-+ __filldir = &gr_fake_filldir;
-+ else
-+ __filldir = filldir;
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ rcu_read_unlock();
-+#endif
- filp->f_pos = iter.tgid + TGID_OFFSET;
-- if (proc_pid_fill_cache(filp, dirent, filldir, iter) < 0) {
-+ if (proc_pid_fill_cache(filp, dirent, __filldir, iter) < 0) {
- put_task_struct(iter.task);
- goto out;
- }
-@@ -2892,7 +3075,7 @@ static const struct pid_entry tid_base_stuff[] = {
- #ifdef CONFIG_SCHED_DEBUG
- REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations),
- #endif
--#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
-+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
- INF("syscall", S_IRUGO, proc_pid_syscall),
- #endif
- INF("cmdline", S_IRUGO, proc_pid_cmdline),
-@@ -2916,10 +3099,10 @@ static const struct pid_entry tid_base_stuff[] = {
- #ifdef CONFIG_SECURITY
- DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
- #endif
--#ifdef CONFIG_KALLSYMS
-+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
- INF("wchan", S_IRUGO, proc_pid_wchan),
- #endif
--#ifdef CONFIG_STACKTRACE
-+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
- ONE("stack", S_IRUGO, proc_pid_stack),
- #endif
- #ifdef CONFIG_SCHEDSTATS
-diff --git a/fs/proc/cmdline.c b/fs/proc/cmdline.c
-index 82676e3..5f8518a 100644
---- a/fs/proc/cmdline.c
-+++ b/fs/proc/cmdline.c
-@@ -23,7 +23,11 @@ static const struct file_operations cmdline_proc_fops = {
-
- static int __init proc_cmdline_init(void)
- {
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+ proc_create_grsec("cmdline", 0, NULL, &cmdline_proc_fops);
-+#else
- proc_create("cmdline", 0, NULL, &cmdline_proc_fops);
-+#endif
- return 0;
- }
- module_init(proc_cmdline_init);
-diff --git a/fs/proc/devices.c b/fs/proc/devices.c
-index 59ee7da..469b4b6 100644
---- a/fs/proc/devices.c
-+++ b/fs/proc/devices.c
-@@ -64,7 +64,11 @@ static const struct file_operations proc_devinfo_operations = {
-
- static int __init proc_devices_init(void)
- {
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+ proc_create_grsec("devices", 0, NULL, &proc_devinfo_operations);
-+#else
- proc_create("devices", 0, NULL, &proc_devinfo_operations);
-+#endif
- return 0;
- }
- module_init(proc_devices_init);
-diff --git a/fs/proc/inode.c b/fs/proc/inode.c
-index d78ade3..6820c1b 100644
---- a/fs/proc/inode.c
-+++ b/fs/proc/inode.c
-@@ -18,12 +18,19 @@
- #include <linux/module.h>
- #include <linux/smp_lock.h>
- #include <linux/sysctl.h>
-+#include <linux/grsecurity.h>
-
- #include <asm/system.h>
- #include <asm/uaccess.h>
-
- #include "internal.h"
-
-+#ifdef CONFIG_PROC_SYSCTL
-+extern const struct inode_operations proc_sys_inode_operations;
-+extern const struct inode_operations proc_sys_dir_operations;
-+#endif
-+
-+
- struct proc_dir_entry *de_get(struct proc_dir_entry *de)
- {
- atomic_inc(&de->count);
-@@ -62,6 +69,13 @@ static void proc_delete_inode(struct inode *inode)
- de_put(de);
- if (PROC_I(inode)->sysctl)
- sysctl_head_put(PROC_I(inode)->sysctl);
-+
-+#ifdef CONFIG_PROC_SYSCTL
-+ if (inode->i_op == &proc_sys_inode_operations ||
-+ inode->i_op == &proc_sys_dir_operations)
-+ gr_handle_delete(inode->i_ino, inode->i_sb->s_dev);
-+#endif
-+
- clear_inode(inode);
- }
-
-@@ -457,7 +471,11 @@ struct inode *proc_get_inode(struct super_block *sb, unsigned int ino,
- if (de->mode) {
- inode->i_mode = de->mode;
- inode->i_uid = de->uid;
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+ inode->i_gid = grsec_proc_gid;
-+#else
- inode->i_gid = de->gid;
-+#endif
- }
- if (de->size)
- inode->i_size = de->size;
-diff --git a/fs/proc/internal.h b/fs/proc/internal.h
-index 753ca37..26bcf3b 100644
---- a/fs/proc/internal.h
-+++ b/fs/proc/internal.h
-@@ -51,6 +51,9 @@ extern int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
- struct pid *pid, struct task_struct *task);
- extern int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
- struct pid *pid, struct task_struct *task);
-+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
-+extern int proc_pid_ipaddr(struct task_struct *task, char *buffer);
-+#endif
- extern loff_t mem_lseek(struct file *file, loff_t offset, int orig);
-
- extern const struct file_operations proc_maps_operations;
-diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
-index b442dac..aab29cb 100644
---- a/fs/proc/kcore.c
-+++ b/fs/proc/kcore.c
-@@ -320,6 +320,8 @@ static void elf_kcore_store_hdr(char *bufp, int nphdr, int dataoff)
- off_t offset = 0;
- struct kcore_list *m;
-
-+ pax_track_stack();
-+
- /* setup ELF header */
- elf = (struct elfhdr *) bufp;
- bufp += sizeof(struct elfhdr);
-@@ -477,9 +479,10 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
- * the addresses in the elf_phdr on our list.
- */
- start = kc_offset_to_vaddr(*fpos - elf_buflen);
-- if ((tsz = (PAGE_SIZE - (start & ~PAGE_MASK))) > buflen)
-+ tsz = PAGE_SIZE - (start & ~PAGE_MASK);
-+ if (tsz > buflen)
- tsz = buflen;
--
-+
- while (buflen) {
- struct kcore_list *m;
-
-@@ -508,20 +511,23 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
- kfree(elf_buf);
- } else {
- if (kern_addr_valid(start)) {
-- unsigned long n;
-+ char *elf_buf;
-+ mm_segment_t oldfs;
-
-- n = copy_to_user(buffer, (char *)start, tsz);
-- /*
-- * We cannot distingush between fault on source
-- * and fault on destination. When this happens
-- * we clear too and hope it will trigger the
-- * EFAULT again.
-- */
-- if (n) {
-- if (clear_user(buffer + tsz - n,
-- n))
-+ elf_buf = kmalloc(tsz, GFP_KERNEL);
-+ if (!elf_buf)
-+ return -ENOMEM;
-+ oldfs = get_fs();
-+ set_fs(KERNEL_DS);
-+ if (!__copy_from_user(elf_buf, (const void __user *)start, tsz)) {
-+ set_fs(oldfs);
-+ if (copy_to_user(buffer, elf_buf, tsz)) {
-+ kfree(elf_buf);
- return -EFAULT;
-+ }
- }
-+ set_fs(oldfs);
-+ kfree(elf_buf);
- } else {
- if (clear_user(buffer, tsz))
- return -EFAULT;
-@@ -541,6 +547,9 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
-
- static int open_kcore(struct inode *inode, struct file *filp)
- {
-+#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
-+ return -EPERM;
-+#endif
- if (!capable(CAP_SYS_RAWIO))
- return -EPERM;
- if (kcore_need_update)
-diff --git a/fs/proc/kmsg.c b/fs/proc/kmsg.c
-index 7ca7834..cfe90a4 100644
---- a/fs/proc/kmsg.c
-+++ b/fs/proc/kmsg.c
-@@ -12,37 +12,37 @@
- #include <linux/poll.h>
- #include <linux/proc_fs.h>
- #include <linux/fs.h>
-+#include <linux/syslog.h>
-
- #include <asm/uaccess.h>
- #include <asm/io.h>
-
- extern wait_queue_head_t log_wait;
-
--extern int do_syslog(int type, char __user *bug, int count);
--
- static int kmsg_open(struct inode * inode, struct file * file)
- {
-- return do_syslog(1,NULL,0);
-+ return do_syslog(SYSLOG_ACTION_OPEN, NULL, 0, SYSLOG_FROM_FILE);
- }
-
- static int kmsg_release(struct inode * inode, struct file * file)
- {
-- (void) do_syslog(0,NULL,0);
-+ (void) do_syslog(SYSLOG_ACTION_CLOSE, NULL, 0, SYSLOG_FROM_FILE);
- return 0;
- }
-
- static ssize_t kmsg_read(struct file *file, char __user *buf,
- size_t count, loff_t *ppos)
- {
-- if ((file->f_flags & O_NONBLOCK) && !do_syslog(9, NULL, 0))
-+ if ((file->f_flags & O_NONBLOCK) &&
-+ !do_syslog(SYSLOG_ACTION_SIZE_UNREAD, NULL, 0, SYSLOG_FROM_FILE))
- return -EAGAIN;
-- return do_syslog(2, buf, count);
-+ return do_syslog(SYSLOG_ACTION_READ, buf, count, SYSLOG_FROM_FILE);
- }
-
- static unsigned int kmsg_poll(struct file *file, poll_table *wait)
- {
- poll_wait(file, &log_wait, wait);
-- if (do_syslog(9, NULL, 0))
-+ if (do_syslog(SYSLOG_ACTION_SIZE_UNREAD, NULL, 0, SYSLOG_FROM_FILE))
- return POLLIN | POLLRDNORM;
- return 0;
- }
-diff --git a/fs/proc/meminfo.c b/fs/proc/meminfo.c
-index a65239c..ad1182a 100644
---- a/fs/proc/meminfo.c
-+++ b/fs/proc/meminfo.c
-@@ -29,6 +29,8 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
- unsigned long pages[NR_LRU_LISTS];
- int lru;
-
-+ pax_track_stack();
-+
- /*
- * display in kilobytes.
- */
-@@ -149,7 +151,7 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
- vmi.used >> 10,
- vmi.largest_chunk >> 10
- #ifdef CONFIG_MEMORY_FAILURE
-- ,atomic_long_read(&mce_bad_pages) << (PAGE_SHIFT - 10)
-+ ,atomic_long_read_unchecked(&mce_bad_pages) << (PAGE_SHIFT - 10)
- #endif
- );
-
-diff --git a/fs/proc/nommu.c b/fs/proc/nommu.c
-index 9fe7d7e..cdb62c9 100644
---- a/fs/proc/nommu.c
-+++ b/fs/proc/nommu.c
-@@ -67,7 +67,7 @@ static int nommu_region_show(struct seq_file *m, struct vm_region *region)
- if (len < 1)
- len = 1;
- seq_printf(m, "%*c", len, ' ');
-- seq_path(m, &file->f_path, "");
-+ seq_path(m, &file->f_path, "\n\\");
- }
-
- seq_putc(m, '\n');
-diff --git a/fs/proc/proc_net.c b/fs/proc/proc_net.c
-index 04d1270..9dbd384 100644
---- a/fs/proc/proc_net.c
-+++ b/fs/proc/proc_net.c
-@@ -22,6 +22,7 @@
- #include <linux/nsproxy.h>
- #include <net/net_namespace.h>
- #include <linux/seq_file.h>
-+#include <linux/grsecurity.h>
-
- #include "internal.h"
-
-@@ -104,6 +105,17 @@ static struct net *get_proc_task_net(struct inode *dir)
- struct task_struct *task;
- struct nsproxy *ns;
- struct net *net = NULL;
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ const struct cred *cred = current_cred();
-+#endif
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+ if (cred->fsuid)
-+ return net;
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ if (cred->fsuid && !in_group_p(grsec_proc_gid))
-+ return net;
-+#endif
-
- rcu_read_lock();
- task = pid_task(proc_pid(dir), PIDTYPE_PID);
-diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
-index f667e8a..e48c0c2 100644
---- a/fs/proc/proc_sysctl.c
-+++ b/fs/proc/proc_sysctl.c
-@@ -7,11 +7,13 @@
- #include <linux/security.h>
- #include "internal.h"
-
-+extern __u32 gr_handle_sysctl(const struct ctl_table *table, const int op);
-+
- static const struct dentry_operations proc_sys_dentry_operations;
- static const struct file_operations proc_sys_file_operations;
--static const struct inode_operations proc_sys_inode_operations;
-+const struct inode_operations proc_sys_inode_operations;
- static const struct file_operations proc_sys_dir_file_operations;
--static const struct inode_operations proc_sys_dir_operations;
-+const struct inode_operations proc_sys_dir_operations;
-
- static struct inode *proc_sys_make_inode(struct super_block *sb,
- struct ctl_table_header *head, struct ctl_table *table)
-@@ -109,6 +111,9 @@ static struct dentry *proc_sys_lookup(struct inode *dir, struct dentry *dentry,
- if (!p)
- goto out;
-
-+ if (gr_handle_sysctl(p, MAY_EXEC))
-+ goto out;
-+
- err = ERR_PTR(-ENOMEM);
- inode = proc_sys_make_inode(dir->i_sb, h ? h : head, p);
- if (h)
-@@ -119,6 +124,9 @@ static struct dentry *proc_sys_lookup(struct inode *dir, struct dentry *dentry,
-
- err = NULL;
- dentry->d_op = &proc_sys_dentry_operations;
-+
-+ gr_handle_proc_create(dentry, inode);
-+
- d_add(dentry, inode);
-
- out:
-@@ -151,6 +159,12 @@ static ssize_t proc_sys_call_handler(struct file *filp, void __user *buf,
- if (!table->proc_handler)
- goto out;
-
-+#ifdef CONFIG_GRKERNSEC
-+ error = -EPERM;
-+ if (write && !capable(CAP_SYS_ADMIN))
-+ goto out;
-+#endif
-+
- /* careful: calling conventions are nasty here */
- res = count;
- error = table->proc_handler(table, write, buf, &res, ppos);
-@@ -200,6 +214,9 @@ static int proc_sys_fill_cache(struct file *filp, void *dirent,
- return -ENOMEM;
- } else {
- child->d_op = &proc_sys_dentry_operations;
-+
-+ gr_handle_proc_create(child, inode);
-+
- d_add(child, inode);
- }
- } else {
-@@ -228,6 +245,9 @@ static int scan(struct ctl_table_header *head, ctl_table *table,
- if (*pos < file->f_pos)
- continue;
-
-+ if (gr_handle_sysctl(table, 0))
-+ continue;
-+
- res = proc_sys_fill_cache(file, dirent, filldir, head, table);
- if (res)
- return res;
-@@ -344,6 +364,9 @@ static int proc_sys_getattr(struct vfsmount *mnt, struct dentry *dentry, struct
- if (IS_ERR(head))
- return PTR_ERR(head);
-
-+ if (table && gr_handle_sysctl(table, MAY_EXEC))
-+ return -ENOENT;
-+
- generic_fillattr(inode, stat);
- if (table)
- stat->mode = (stat->mode & S_IFMT) | table->mode;
-@@ -358,17 +381,18 @@ static const struct file_operations proc_sys_file_operations = {
- };
-
- static const struct file_operations proc_sys_dir_file_operations = {
-+ .read = generic_read_dir,
- .readdir = proc_sys_readdir,
- .llseek = generic_file_llseek,
- };
-
--static const struct inode_operations proc_sys_inode_operations = {
-+const struct inode_operations proc_sys_inode_operations = {
- .permission = proc_sys_permission,
- .setattr = proc_sys_setattr,
- .getattr = proc_sys_getattr,
- };
-
--static const struct inode_operations proc_sys_dir_operations = {
-+const struct inode_operations proc_sys_dir_operations = {
- .lookup = proc_sys_lookup,
- .permission = proc_sys_permission,
- .setattr = proc_sys_setattr,
-diff --git a/fs/proc/root.c b/fs/proc/root.c
-index b080b79..d957e63 100644
---- a/fs/proc/root.c
-+++ b/fs/proc/root.c
-@@ -134,7 +134,15 @@ void __init proc_root_init(void)
- #ifdef CONFIG_PROC_DEVICETREE
- proc_device_tree_init();
- #endif
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+ proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
-+#endif
-+#else
- proc_mkdir("bus", NULL);
-+#endif
- proc_sys_init();
- }
-
-diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
-index 3b7b82a..43956d4 100644
---- a/fs/proc/task_mmu.c
-+++ b/fs/proc/task_mmu.c
-@@ -8,12 +8,19 @@
- #include <linux/mempolicy.h>
- #include <linux/swap.h>
- #include <linux/swapops.h>
-+#include <linux/grsecurity.h>
-
- #include <asm/elf.h>
- #include <asm/uaccess.h>
- #include <asm/tlbflush.h>
- #include "internal.h"
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
-+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
-+ _mm->pax_flags & MF_PAX_SEGMEXEC))
-+#endif
-+
- void task_mem(struct seq_file *m, struct mm_struct *mm)
- {
- unsigned long data, text, lib;
-@@ -46,15 +53,32 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
- "VmStk:\t%8lu kB\n"
- "VmExe:\t%8lu kB\n"
- "VmLib:\t%8lu kB\n"
-- "VmPTE:\t%8lu kB\n",
-- hiwater_vm << (PAGE_SHIFT-10),
-+ "VmPTE:\t%8lu kB\n"
-+
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+ "CsBase:\t%8lx\nCsLim:\t%8lx\n"
-+#endif
-+
-+ ,hiwater_vm << (PAGE_SHIFT-10),
- (total_vm - mm->reserved_vm) << (PAGE_SHIFT-10),
- mm->locked_vm << (PAGE_SHIFT-10),
- hiwater_rss << (PAGE_SHIFT-10),
- total_rss << (PAGE_SHIFT-10),
- data << (PAGE_SHIFT-10),
- mm->stack_vm << (PAGE_SHIFT-10), text, lib,
-- (PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10);
-+ (PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10
-+
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ , PAX_RAND_FLAGS(mm) ? 0 : mm->context.user_cs_base
-+ , PAX_RAND_FLAGS(mm) ? 0 : mm->context.user_cs_limit
-+#else
-+ , mm->context.user_cs_base
-+ , mm->context.user_cs_limit
-+#endif
-+#endif
-+
-+ );
- }
-
- unsigned long task_vsize(struct mm_struct *mm)
-@@ -175,7 +199,8 @@ static void m_stop(struct seq_file *m, void *v)
- struct proc_maps_private *priv = m->private;
- struct vm_area_struct *vma = v;
-
-- vma_stop(priv, vma);
-+ if (!IS_ERR(vma))
-+ vma_stop(priv, vma);
- if (priv->task)
- put_task_struct(priv->task);
- }
-@@ -206,7 +231,6 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
- int flags = vma->vm_flags;
- unsigned long ino = 0;
- unsigned long long pgoff = 0;
-- unsigned long start;
- dev_t dev = 0;
- int len;
-
-@@ -217,20 +241,23 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
- pgoff = ((loff_t)vma->vm_pgoff) << PAGE_SHIFT;
- }
-
-- /* We don't show the stack guard page in /proc/maps */
-- start = vma->vm_start;
-- if (vma->vm_flags & VM_GROWSDOWN)
-- if (!vma_stack_continue(vma->vm_prev, vma->vm_start))
-- start += PAGE_SIZE;
--
- seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
-- start,
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_start,
-+ PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_end,
-+#else
-+ vma->vm_start,
- vma->vm_end,
-+#endif
- flags & VM_READ ? 'r' : '-',
- flags & VM_WRITE ? 'w' : '-',
- flags & VM_EXEC ? 'x' : '-',
- flags & VM_MAYSHARE ? 's' : 'p',
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ PAX_RAND_FLAGS(mm) ? 0UL : pgoff,
-+#else
- pgoff,
-+#endif
- MAJOR(dev), MINOR(dev), ino, &len);
-
- /*
-@@ -239,7 +266,7 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
- */
- if (file) {
- pad_len_spaces(m, len);
-- seq_path(m, &file->f_path, "\n");
-+ seq_path(m, &file->f_path, "\n\\");
- } else {
- const char *name = arch_vma_name(vma);
- if (!name) {
-@@ -247,8 +274,9 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
- if (vma->vm_start <= mm->brk &&
- vma->vm_end >= mm->start_brk) {
- name = "[heap]";
-- } else if (vma->vm_start <= mm->start_stack &&
-- vma->vm_end >= mm->start_stack) {
-+ } else if ((vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP)) ||
-+ (vma->vm_start <= mm->start_stack &&
-+ vma->vm_end >= mm->start_stack)) {
- name = "[stack]";
- }
- } else {
-@@ -269,6 +297,13 @@ static int show_map(struct seq_file *m, void *v)
- struct proc_maps_private *priv = m->private;
- struct task_struct *task = priv->task;
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ if (current->exec_id != m->exec_id) {
-+ gr_log_badprocpid("maps");
-+ return 0;
-+ }
-+#endif
-+
- show_map_vma(m, vma);
-
- if (m->count < m->size) /* vma is copied successfully */
-@@ -390,10 +425,23 @@ static int show_smap(struct seq_file *m, void *v)
- .private = &mss,
- };
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ if (current->exec_id != m->exec_id) {
-+ gr_log_badprocpid("smaps");
-+ return 0;
-+ }
-+#endif
- memset(&mss, 0, sizeof mss);
-- mss.vma = vma;
-- if (vma->vm_mm && !is_vm_hugetlb_page(vma))
-- walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ if (!PAX_RAND_FLAGS(vma->vm_mm)) {
-+#endif
-+ mss.vma = vma;
-+ if (vma->vm_mm && !is_vm_hugetlb_page(vma))
-+ walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ }
-+#endif
-
- show_map_vma(m, vma);
-
-@@ -409,7 +457,11 @@ static int show_smap(struct seq_file *m, void *v)
- "Swap: %8lu kB\n"
- "KernelPageSize: %8lu kB\n"
- "MMUPageSize: %8lu kB\n",
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ PAX_RAND_FLAGS(vma->vm_mm) ? 0UL : (vma->vm_end - vma->vm_start) >> 10,
-+#else
- (vma->vm_end - vma->vm_start) >> 10,
-+#endif
- mss.resident >> 10,
- (unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
- mss.shared_clean >> 10,
-diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c
-index 8f5c05d..c99c76d 100644
---- a/fs/proc/task_nommu.c
-+++ b/fs/proc/task_nommu.c
-@@ -50,7 +50,7 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
- else
- bytes += kobjsize(mm);
-
-- if (current->fs && current->fs->users > 1)
-+ if (current->fs && atomic_read(¤t->fs->users) > 1)
- sbytes += kobjsize(current->fs);
- else
- bytes += kobjsize(current->fs);
-@@ -154,7 +154,7 @@ static int nommu_vma_show(struct seq_file *m, struct vm_area_struct *vma)
- if (len < 1)
- len = 1;
- seq_printf(m, "%*c", len, ' ');
-- seq_path(m, &file->f_path, "");
-+ seq_path(m, &file->f_path, "\n\\");
- }
-
- seq_putc(m, '\n');
-diff --git a/fs/read_write.c b/fs/read_write.c
-index b7f4a1f..d40066d 100644
---- a/fs/read_write.c
-+++ b/fs/read_write.c
-@@ -860,6 +860,8 @@ static ssize_t do_sendfile(int out_fd, int in_fd, loff_t *ppos,
- if (retval > 0) {
- add_rchar(current, retval);
- add_wchar(current, retval);
-+ fsnotify_access(in_file->f_path.dentry);
-+ fsnotify_modify(out_file->f_path.dentry);
- }
-
- inc_syscr(current);
-diff --git a/fs/readdir.c b/fs/readdir.c
-index 7723401..30059a6 100644
---- a/fs/readdir.c
-+++ b/fs/readdir.c
-@@ -16,6 +16,7 @@
- #include <linux/security.h>
- #include <linux/syscalls.h>
- #include <linux/unistd.h>
-+#include <linux/namei.h>
-
- #include <asm/uaccess.h>
-
-@@ -67,6 +68,7 @@ struct old_linux_dirent {
-
- struct readdir_callback {
- struct old_linux_dirent __user * dirent;
-+ struct file * file;
- int result;
- };
-
-@@ -84,6 +86,10 @@ static int fillonedir(void * __buf, const char * name, int namlen, loff_t offset
- buf->result = -EOVERFLOW;
- return -EOVERFLOW;
- }
-+
-+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
-+ return 0;
-+
- buf->result++;
- dirent = buf->dirent;
- if (!access_ok(VERIFY_WRITE, dirent,
-@@ -116,6 +122,7 @@ SYSCALL_DEFINE3(old_readdir, unsigned int, fd,
-
- buf.result = 0;
- buf.dirent = dirent;
-+ buf.file = file;
-
- error = vfs_readdir(file, fillonedir, &buf);
- if (buf.result)
-@@ -142,6 +149,7 @@ struct linux_dirent {
- struct getdents_callback {
- struct linux_dirent __user * current_dir;
- struct linux_dirent __user * previous;
-+ struct file * file;
- int count;
- int error;
- };
-@@ -162,6 +170,10 @@ static int filldir(void * __buf, const char * name, int namlen, loff_t offset,
- buf->error = -EOVERFLOW;
- return -EOVERFLOW;
- }
-+
-+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
-+ return 0;
-+
- dirent = buf->previous;
- if (dirent) {
- if (__put_user(offset, &dirent->d_off))
-@@ -209,6 +221,7 @@ SYSCALL_DEFINE3(getdents, unsigned int, fd,
- buf.previous = NULL;
- buf.count = count;
- buf.error = 0;
-+ buf.file = file;
-
- error = vfs_readdir(file, filldir, &buf);
- if (error >= 0)
-@@ -228,6 +241,7 @@ out:
- struct getdents_callback64 {
- struct linux_dirent64 __user * current_dir;
- struct linux_dirent64 __user * previous;
-+ struct file *file;
- int count;
- int error;
- };
-@@ -242,6 +256,10 @@ static int filldir64(void * __buf, const char * name, int namlen, loff_t offset,
- buf->error = -EINVAL; /* only used if we fail.. */
- if (reclen > buf->count)
- return -EINVAL;
-+
-+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
-+ return 0;
-+
- dirent = buf->previous;
- if (dirent) {
- if (__put_user(offset, &dirent->d_off))
-@@ -289,6 +307,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int, fd,
-
- buf.current_dir = dirent;
- buf.previous = NULL;
-+ buf.file = file;
- buf.count = count;
- buf.error = 0;
-
-@@ -297,7 +316,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int, fd,
- error = buf.error;
- lastdirent = buf.previous;
- if (lastdirent) {
-- typeof(lastdirent->d_off) d_off = file->f_pos;
-+ typeof(((struct linux_dirent64 *)0)->d_off) d_off = file->f_pos;
- if (__put_user(d_off, &lastdirent->d_off))
- error = -EFAULT;
- else
-diff --git a/fs/reiserfs/dir.c b/fs/reiserfs/dir.c
-index d42c30c..153b170 100644
---- a/fs/reiserfs/dir.c
-+++ b/fs/reiserfs/dir.c
-@@ -66,6 +66,8 @@ int reiserfs_readdir_dentry(struct dentry *dentry, void *dirent,
- struct reiserfs_dir_entry de;
- int ret = 0;
-
-+ pax_track_stack();
-+
- reiserfs_write_lock(inode->i_sb);
-
- reiserfs_check_lock_depth(inode->i_sb, "readdir");
-@@ -187,6 +189,8 @@ int reiserfs_readdir_dentry(struct dentry *dentry, void *dirent,
- next_pos = deh_offset(deh) + 1;
-
- if (item_moved(&tmp_ih, &path_to_entry)) {
-+ set_cpu_key_k_offset(&pos_key,
-+ next_pos);
- goto research;
- }
- } /* for */
-diff --git a/fs/reiserfs/do_balan.c b/fs/reiserfs/do_balan.c
-index 128d3f7c..8840d44 100644
---- a/fs/reiserfs/do_balan.c
-+++ b/fs/reiserfs/do_balan.c
-@@ -2058,7 +2058,7 @@ void do_balance(struct tree_balance *tb, /* tree_balance structure */
- return;
- }
-
-- atomic_inc(&(fs_generation(tb->tb_sb)));
-+ atomic_inc_unchecked(&(fs_generation(tb->tb_sb)));
- do_balance_starts(tb);
-
- /* balance leaf returns 0 except if combining L R and S into
-diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c
-index d240c15..c38a41a 100644
---- a/fs/reiserfs/inode.c
-+++ b/fs/reiserfs/inode.c
-@@ -1786,11 +1786,16 @@ int reiserfs_new_inode(struct reiserfs_transaction_handle *th,
- TYPE_STAT_DATA, SD_SIZE, MAX_US_INT);
- memcpy(INODE_PKEY(inode), &(ih.ih_key), KEY_SIZE);
- args.dirid = le32_to_cpu(ih.ih_key.k_dir_id);
-- if (insert_inode_locked4(inode, args.objectid,
-- reiserfs_find_actor, &args) < 0) {
-+
-+ reiserfs_write_unlock(inode->i_sb);
-+ err = insert_inode_locked4(inode, args.objectid,
-+ reiserfs_find_actor, &args);
-+ reiserfs_write_lock(inode->i_sb);
-+ if (err) {
- err = -EINVAL;
- goto out_bad_inode;
- }
-+
- if (old_format_only(sb))
- /* not a perfect generation count, as object ids can be reused, but
- ** this is as good as reiserfs can do right now.
-diff --git a/fs/reiserfs/item_ops.c b/fs/reiserfs/item_ops.c
-index 72cb1cc..d0e3181 100644
---- a/fs/reiserfs/item_ops.c
-+++ b/fs/reiserfs/item_ops.c
-@@ -102,7 +102,7 @@ static void sd_print_vi(struct virtual_item *vi)
- vi->vi_index, vi->vi_type, vi->vi_ih);
- }
-
--static struct item_operations stat_data_ops = {
-+static const struct item_operations stat_data_ops = {
- .bytes_number = sd_bytes_number,
- .decrement_key = sd_decrement_key,
- .is_left_mergeable = sd_is_left_mergeable,
-@@ -196,7 +196,7 @@ static void direct_print_vi(struct virtual_item *vi)
- vi->vi_index, vi->vi_type, vi->vi_ih);
- }
-
--static struct item_operations direct_ops = {
-+static const struct item_operations direct_ops = {
- .bytes_number = direct_bytes_number,
- .decrement_key = direct_decrement_key,
- .is_left_mergeable = direct_is_left_mergeable,
-@@ -341,7 +341,7 @@ static void indirect_print_vi(struct virtual_item *vi)
- vi->vi_index, vi->vi_type, vi->vi_ih);
- }
-
--static struct item_operations indirect_ops = {
-+static const struct item_operations indirect_ops = {
- .bytes_number = indirect_bytes_number,
- .decrement_key = indirect_decrement_key,
- .is_left_mergeable = indirect_is_left_mergeable,
-@@ -628,7 +628,7 @@ static void direntry_print_vi(struct virtual_item *vi)
- printk("\n");
- }
-
--static struct item_operations direntry_ops = {
-+static const struct item_operations direntry_ops = {
- .bytes_number = direntry_bytes_number,
- .decrement_key = direntry_decrement_key,
- .is_left_mergeable = direntry_is_left_mergeable,
-@@ -724,7 +724,7 @@ static void errcatch_print_vi(struct virtual_item *vi)
- "Invalid item type observed, run fsck ASAP");
- }
-
--static struct item_operations errcatch_ops = {
-+static const struct item_operations errcatch_ops = {
- errcatch_bytes_number,
- errcatch_decrement_key,
- errcatch_is_left_mergeable,
-@@ -746,7 +746,7 @@ static struct item_operations errcatch_ops = {
- #error Item types must use disk-format assigned values.
- #endif
-
--struct item_operations *item_ops[TYPE_ANY + 1] = {
-+const struct item_operations * const item_ops[TYPE_ANY + 1] = {
- &stat_data_ops,
- &indirect_ops,
- &direct_ops,
-diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
-index b5fe0aa..e0e25c4 100644
---- a/fs/reiserfs/journal.c
-+++ b/fs/reiserfs/journal.c
-@@ -2329,6 +2329,8 @@ static struct buffer_head *reiserfs_breada(struct block_device *dev,
- struct buffer_head *bh;
- int i, j;
-
-+ pax_track_stack();
-+
- bh = __getblk(dev, block, bufsize);
- if (buffer_uptodate(bh))
- return (bh);
-diff --git a/fs/reiserfs/namei.c b/fs/reiserfs/namei.c
-index 2715791..b8996db 100644
---- a/fs/reiserfs/namei.c
-+++ b/fs/reiserfs/namei.c
-@@ -1214,6 +1214,8 @@ static int reiserfs_rename(struct inode *old_dir, struct dentry *old_dentry,
- unsigned long savelink = 1;
- struct timespec ctime;
-
-+ pax_track_stack();
-+
- /* three balancings: (1) old name removal, (2) new name insertion
- and (3) maybe "save" link insertion
- stat data updates: (1) old directory,
-diff --git a/fs/reiserfs/procfs.c b/fs/reiserfs/procfs.c
-index 9229e55..3d2e3b7 100644
---- a/fs/reiserfs/procfs.c
-+++ b/fs/reiserfs/procfs.c
-@@ -123,7 +123,7 @@ static int show_super(struct seq_file *m, struct super_block *sb)
- "SMALL_TAILS " : "NO_TAILS ",
- replay_only(sb) ? "REPLAY_ONLY " : "",
- convert_reiserfs(sb) ? "CONV " : "",
-- atomic_read(&r->s_generation_counter),
-+ atomic_read_unchecked(&r->s_generation_counter),
- SF(s_disk_reads), SF(s_disk_writes), SF(s_fix_nodes),
- SF(s_do_balance), SF(s_unneeded_left_neighbor),
- SF(s_good_search_by_key_reada), SF(s_bmaps),
-@@ -309,6 +309,8 @@ static int show_journal(struct seq_file *m, struct super_block *sb)
- struct journal_params *jp = &rs->s_v1.s_journal;
- char b[BDEVNAME_SIZE];
-
-+ pax_track_stack();
-+
- seq_printf(m, /* on-disk fields */
- "jp_journal_1st_block: \t%i\n"
- "jp_journal_dev: \t%s[%x]\n"
-diff --git a/fs/reiserfs/stree.c b/fs/reiserfs/stree.c
-index d036ee5..4c7dca1 100644
---- a/fs/reiserfs/stree.c
-+++ b/fs/reiserfs/stree.c
-@@ -1159,6 +1159,8 @@ int reiserfs_delete_item(struct reiserfs_transaction_handle *th,
- int iter = 0;
- #endif
-
-+ pax_track_stack();
-+
- BUG_ON(!th->t_trans_id);
-
- init_tb_struct(th, &s_del_balance, sb, path,
-@@ -1296,6 +1298,8 @@ void reiserfs_delete_solid_item(struct reiserfs_transaction_handle *th,
- int retval;
- int quota_cut_bytes = 0;
-
-+ pax_track_stack();
-+
- BUG_ON(!th->t_trans_id);
-
- le_key2cpu_key(&cpu_key, key);
-@@ -1525,6 +1529,8 @@ int reiserfs_cut_from_item(struct reiserfs_transaction_handle *th,
- int quota_cut_bytes;
- loff_t tail_pos = 0;
-
-+ pax_track_stack();
-+
- BUG_ON(!th->t_trans_id);
-
- init_tb_struct(th, &s_cut_balance, inode->i_sb, path,
-@@ -1920,6 +1926,8 @@ int reiserfs_paste_into_item(struct reiserfs_transaction_handle *th, struct tree
- int retval;
- int fs_gen;
-
-+ pax_track_stack();
-+
- BUG_ON(!th->t_trans_id);
-
- fs_gen = get_generation(inode->i_sb);
-@@ -2007,6 +2015,8 @@ int reiserfs_insert_item(struct reiserfs_transaction_handle *th,
- int fs_gen = 0;
- int quota_bytes = 0;
-
-+ pax_track_stack();
-+
- BUG_ON(!th->t_trans_id);
-
- if (inode) { /* Do we count quotas for item? */
-diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
-index 7cb1285..c726cd0 100644
---- a/fs/reiserfs/super.c
-+++ b/fs/reiserfs/super.c
-@@ -916,6 +916,8 @@ static int reiserfs_parse_options(struct super_block *s, char *options, /* strin
- {.option_name = NULL}
- };
-
-+ pax_track_stack();
-+
- *blocks = 0;
- if (!options || !*options)
- /* use default configuration: create tails, journaling on, no
-diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c
-index cc1caa2..c0f6046 100644
---- a/fs/reiserfs/xattr.c
-+++ b/fs/reiserfs/xattr.c
-@@ -189,8 +189,8 @@ fill_with_dentries(void *buf, const char *name, int namelen, loff_t offset,
- if (dbuf->count == ARRAY_SIZE(dbuf->dentries))
- return -ENOSPC;
-
-- if (name[0] == '.' && (name[1] == '\0' ||
-- (name[1] == '.' && name[2] == '\0')))
-+ if (name[0] == '.' && (namelen < 2 ||
-+ (namelen == 2 && name[1] == '.')))
- return 0;
-
- dentry = lookup_one_len(name, dbuf->xadir, namelen);
-diff --git a/fs/select.c b/fs/select.c
-index fd38ce2..f5381b8 100644
---- a/fs/select.c
-+++ b/fs/select.c
-@@ -20,6 +20,7 @@
- #include <linux/module.h>
- #include <linux/slab.h>
- #include <linux/poll.h>
-+#include <linux/security.h>
- #include <linux/personality.h> /* for STICKY_TIMEOUTS */
- #include <linux/file.h>
- #include <linux/fdtable.h>
-@@ -401,6 +402,8 @@ int do_select(int n, fd_set_bits *fds, struct timespec *end_time)
- int retval, i, timed_out = 0;
- unsigned long slack = 0;
-
-+ pax_track_stack();
-+
- rcu_read_lock();
- retval = max_select_fd(n, fds);
- rcu_read_unlock();
-@@ -529,6 +532,8 @@ int core_sys_select(int n, fd_set __user *inp, fd_set __user *outp,
- /* Allocate small arguments on the stack to save memory and be faster */
- long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
-
-+ pax_track_stack();
-+
- ret = -EINVAL;
- if (n < 0)
- goto out_nofds;
-@@ -821,6 +826,9 @@ int do_sys_poll(struct pollfd __user *ufds, unsigned int nfds,
- struct poll_list *walk = head;
- unsigned long todo = nfds;
-
-+ pax_track_stack();
-+
-+ gr_learn_resource(current, RLIMIT_NOFILE, nfds, 1);
- if (nfds > current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
- return -EINVAL;
-
-diff --git a/fs/seq_file.c b/fs/seq_file.c
-index eae7d9d..69ac0fd 100644
---- a/fs/seq_file.c
-+++ b/fs/seq_file.c
-@@ -9,6 +9,7 @@
- #include <linux/module.h>
- #include <linux/seq_file.h>
- #include <linux/slab.h>
-+#include <linux/sched.h>
-
- #include <asm/uaccess.h>
- #include <asm/page.h>
-@@ -40,6 +41,9 @@ int seq_open(struct file *file, const struct seq_operations *op)
- memset(p, 0, sizeof(*p));
- mutex_init(&p->lock);
- p->op = op;
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ p->exec_id = current->exec_id;
-+#endif
-
- /*
- * Wrappers around seq_open(e.g. swaps_open) need to be
-@@ -76,7 +80,11 @@ static int traverse(struct seq_file *m, loff_t offset)
- return 0;
- }
- if (!m->buf) {
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL | GFP_USERCOPY);
-+#else
- m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
-+#endif
- if (!m->buf)
- return -ENOMEM;
- }
-@@ -116,7 +124,11 @@ static int traverse(struct seq_file *m, loff_t offset)
- Eoverflow:
- m->op->stop(m, p);
- kfree(m->buf);
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ m->buf = kmalloc(m->size <<= 1, GFP_KERNEL | GFP_USERCOPY);
-+#else
- m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
-+#endif
- return !m->buf ? -ENOMEM : -EAGAIN;
- }
-
-@@ -169,7 +181,11 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
- m->version = file->f_version;
- /* grab buffer if we didn't have one */
- if (!m->buf) {
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL | GFP_USERCOPY);
-+#else
- m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
-+#endif
- if (!m->buf)
- goto Enomem;
- }
-@@ -210,7 +226,11 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
- goto Fill;
- m->op->stop(m, p);
- kfree(m->buf);
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ m->buf = kmalloc(m->size <<= 1, GFP_KERNEL | GFP_USERCOPY);
-+#else
- m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
-+#endif
- if (!m->buf)
- goto Enomem;
- m->count = 0;
-@@ -551,7 +571,7 @@ static void single_stop(struct seq_file *p, void *v)
- int single_open(struct file *file, int (*show)(struct seq_file *, void *),
- void *data)
- {
-- struct seq_operations *op = kmalloc(sizeof(*op), GFP_KERNEL);
-+ seq_operations_no_const *op = kzalloc(sizeof(*op), GFP_KERNEL);
- int res = -ENOMEM;
-
- if (op) {
-diff --git a/fs/smbfs/proc.c b/fs/smbfs/proc.c
-index 71c29b6..54694dd 100644
---- a/fs/smbfs/proc.c
-+++ b/fs/smbfs/proc.c
-@@ -266,9 +266,9 @@ int smb_setcodepage(struct smb_sb_info *server, struct smb_nls_codepage *cp)
-
- out:
- if (server->local_nls != NULL && server->remote_nls != NULL)
-- server->ops->convert = convert_cp;
-+ *(void **)&server->ops->convert = convert_cp;
- else
-- server->ops->convert = convert_memcpy;
-+ *(void **)&server->ops->convert = convert_memcpy;
-
- smb_unlock_server(server);
- return n;
-@@ -933,9 +933,9 @@ smb_newconn(struct smb_sb_info *server, struct smb_conn_opt *opt)
-
- /* FIXME: the win9x code wants to modify these ... (seek/trunc bug) */
- if (server->mnt->flags & SMB_MOUNT_OLDATTR) {
-- server->ops->getattr = smb_proc_getattr_core;
-+ *(void **)&server->ops->getattr = smb_proc_getattr_core;
- } else if (server->mnt->flags & SMB_MOUNT_DIRATTR) {
-- server->ops->getattr = smb_proc_getattr_ff;
-+ *(void **)&server->ops->getattr = smb_proc_getattr_ff;
- }
-
- /* Decode server capabilities */
-@@ -3439,7 +3439,7 @@ out:
- static void
- install_ops(struct smb_ops *dst, struct smb_ops *src)
- {
-- memcpy(dst, src, sizeof(void *) * SMB_OPS_NUM_STATIC);
-+ memcpy((void *)dst, src, sizeof(void *) * SMB_OPS_NUM_STATIC);
- }
-
- /* < LANMAN2 */
-diff --git a/fs/smbfs/symlink.c b/fs/smbfs/symlink.c
-index 00b2909..2ace383 100644
---- a/fs/smbfs/symlink.c
-+++ b/fs/smbfs/symlink.c
-@@ -55,7 +55,7 @@ static void *smb_follow_link(struct dentry *dentry, struct nameidata *nd)
-
- static void smb_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
- {
-- char *s = nd_get_link(nd);
-+ const char *s = nd_get_link(nd);
- if (!IS_ERR(s))
- __putname(s);
- }
-diff --git a/fs/splice.c b/fs/splice.c
-index cdad986..a0ea75c 100644
---- a/fs/splice.c
-+++ b/fs/splice.c
-@@ -186,7 +186,7 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
- pipe_lock(pipe);
-
- for (;;) {
-- if (!pipe->readers) {
-+ if (!atomic_read(&pipe->readers)) {
- send_sig(SIGPIPE, current, 0);
- if (!ret)
- ret = -EPIPE;
-@@ -240,9 +240,9 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
- do_wakeup = 0;
- }
-
-- pipe->waiting_writers++;
-+ atomic_inc(&pipe->waiting_writers);
- pipe_wait(pipe);
-- pipe->waiting_writers--;
-+ atomic_dec(&pipe->waiting_writers);
- }
-
- pipe_unlock(pipe);
-@@ -286,6 +286,8 @@ __generic_file_splice_read(struct file *in, loff_t *ppos,
- .spd_release = spd_release_page,
- };
-
-+ pax_track_stack();
-+
- index = *ppos >> PAGE_CACHE_SHIFT;
- loff = *ppos & ~PAGE_CACHE_MASK;
- req_pages = (len + loff + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
-@@ -522,7 +524,7 @@ static ssize_t kernel_readv(struct file *file, const struct iovec *vec,
- old_fs = get_fs();
- set_fs(get_ds());
- /* The cast to a user pointer is valid due to the set_fs() */
-- res = vfs_readv(file, (const struct iovec __user *)vec, vlen, &pos);
-+ res = vfs_readv(file, (const struct iovec __force_user *)vec, vlen, &pos);
- set_fs(old_fs);
-
- return res;
-@@ -537,7 +539,7 @@ static ssize_t kernel_write(struct file *file, const char *buf, size_t count,
- old_fs = get_fs();
- set_fs(get_ds());
- /* The cast to a user pointer is valid due to the set_fs() */
-- res = vfs_write(file, (const char __user *)buf, count, &pos);
-+ res = vfs_write(file, (const char __force_user *)buf, count, &pos);
- set_fs(old_fs);
-
- return res;
-@@ -566,6 +568,8 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
- .spd_release = spd_release_page,
- };
-
-+ pax_track_stack();
-+
- index = *ppos >> PAGE_CACHE_SHIFT;
- offset = *ppos & ~PAGE_CACHE_MASK;
- nr_pages = (len + offset + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
-@@ -579,7 +583,7 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
- goto err;
-
- this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset);
-- vec[i].iov_base = (void __user *) page_address(page);
-+ vec[i].iov_base = (__force void __user *) page_address(page);
- vec[i].iov_len = this_len;
- pages[i] = page;
- spd.nr_pages++;
-@@ -805,10 +809,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
- int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
- {
- while (!pipe->nrbufs) {
-- if (!pipe->writers)
-+ if (!atomic_read(&pipe->writers))
- return 0;
-
-- if (!pipe->waiting_writers && sd->num_spliced)
-+ if (!atomic_read(&pipe->waiting_writers) && sd->num_spliced)
- return 0;
-
- if (sd->flags & SPLICE_F_NONBLOCK)
-@@ -1145,7 +1149,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
- * out of the pipe right after the splice_to_pipe(). So set
- * PIPE_READERS appropriately.
- */
-- pipe->readers = 1;
-+ atomic_set(&pipe->readers, 1);
-
- current->splice_pipe = pipe;
- }
-@@ -1598,6 +1602,8 @@ static long vmsplice_to_pipe(struct file *file, const struct iovec __user *iov,
- .spd_release = spd_release_page,
- };
-
-+ pax_track_stack();
-+
- pipe = pipe_info(file->f_path.dentry->d_inode);
- if (!pipe)
- return -EBADF;
-@@ -1706,9 +1712,9 @@ static int ipipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
- ret = -ERESTARTSYS;
- break;
- }
-- if (!pipe->writers)
-+ if (!atomic_read(&pipe->writers))
- break;
-- if (!pipe->waiting_writers) {
-+ if (!atomic_read(&pipe->waiting_writers)) {
- if (flags & SPLICE_F_NONBLOCK) {
- ret = -EAGAIN;
- break;
-@@ -1740,7 +1746,7 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
- pipe_lock(pipe);
-
- while (pipe->nrbufs >= PIPE_BUFFERS) {
-- if (!pipe->readers) {
-+ if (!atomic_read(&pipe->readers)) {
- send_sig(SIGPIPE, current, 0);
- ret = -EPIPE;
- break;
-@@ -1753,9 +1759,9 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
- ret = -ERESTARTSYS;
- break;
- }
-- pipe->waiting_writers++;
-+ atomic_inc(&pipe->waiting_writers);
- pipe_wait(pipe);
-- pipe->waiting_writers--;
-+ atomic_dec(&pipe->waiting_writers);
- }
-
- pipe_unlock(pipe);
-@@ -1791,14 +1797,14 @@ retry:
- pipe_double_lock(ipipe, opipe);
-
- do {
-- if (!opipe->readers) {
-+ if (!atomic_read(&opipe->readers)) {
- send_sig(SIGPIPE, current, 0);
- if (!ret)
- ret = -EPIPE;
- break;
- }
-
-- if (!ipipe->nrbufs && !ipipe->writers)
-+ if (!ipipe->nrbufs && !atomic_read(&ipipe->writers))
- break;
-
- /*
-@@ -1898,7 +1904,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
- pipe_double_lock(ipipe, opipe);
-
- do {
-- if (!opipe->readers) {
-+ if (!atomic_read(&opipe->readers)) {
- send_sig(SIGPIPE, current, 0);
- if (!ret)
- ret = -EPIPE;
-@@ -1943,7 +1949,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
- * return EAGAIN if we have the potential of some data in the
- * future, otherwise just return 0
- */
-- if (!ret && ipipe->waiting_writers && (flags & SPLICE_F_NONBLOCK))
-+ if (!ret && atomic_read(&ipipe->waiting_writers) && (flags & SPLICE_F_NONBLOCK))
- ret = -EAGAIN;
-
- pipe_unlock(ipipe);
-diff --git a/fs/stat.c b/fs/stat.c
-index c4ecd52..a8fca7d 100644
---- a/fs/stat.c
-+++ b/fs/stat.c
-@@ -27,8 +27,14 @@ void generic_fillattr(struct inode *inode, struct kstat *stat)
- stat->uid = inode->i_uid;
- stat->gid = inode->i_gid;
- stat->rdev = inode->i_rdev;
-- stat->atime = inode->i_atime;
-- stat->mtime = inode->i_mtime;
-+ stat->size = i_size_read(inode);
-+ if (is_sidechannel_device(inode) && !capable_nolog(CAP_MKNOD)) {
-+ stat->atime = inode->i_ctime;
-+ stat->mtime = inode->i_ctime;
-+ } else {
-+ stat->atime = inode->i_atime;
-+ stat->mtime = inode->i_mtime;
-+ }
- stat->ctime = inode->i_ctime;
- stat->size = i_size_read(inode);
- stat->blocks = inode->i_blocks;
-@@ -46,8 +52,14 @@ int vfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
- if (retval)
- return retval;
-
-- if (inode->i_op->getattr)
-- return inode->i_op->getattr(mnt, dentry, stat);
-+ if (inode->i_op->getattr) {
-+ retval = inode->i_op->getattr(mnt, dentry, stat);
-+ if (!retval && is_sidechannel_device(inode) && !capable_nolog(CAP_MKNOD)) {
-+ stat->atime = stat->ctime;
-+ stat->mtime = stat->ctime;
-+ }
-+ return retval;
-+ }
-
- generic_fillattr(inode, stat);
- return 0;
-diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
-index 5e7279a..25a2b1e 100644
---- a/fs/sysfs/dir.c
-+++ b/fs/sysfs/dir.c
-@@ -678,6 +678,18 @@ static int create_dir(struct kobject *kobj, struct sysfs_dirent *parent_sd,
- struct sysfs_dirent *sd;
- int rc;
-
-+#ifdef CONFIG_GRKERNSEC_SYSFS_RESTRICT
-+ const char *parent_name = parent_sd->s_name;
-+
-+ mode = S_IFDIR | S_IRWXU;
-+
-+ if ((!strcmp(parent_name, "") && (!strcmp(name, "devices") || !strcmp(name, "fs"))) ||
-+ (!strcmp(parent_name, "devices") && !strcmp(name, "system")) ||
-+ (!strcmp(parent_name, "fs") && (!strcmp(name, "selinux") || !strcmp(name, "fuse") || !strcmp(name, "ecryptfs"))) ||
-+ (!strcmp(parent_name, "system") && !strcmp(name, "cpu")))
-+ mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO;
-+#endif
-+
- /* allocate */
- sd = sysfs_new_dirent(name, mode, SYSFS_DIR);
- if (!sd)
-diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
-index 7118a38..70af853 100644
---- a/fs/sysfs/file.c
-+++ b/fs/sysfs/file.c
-@@ -44,7 +44,7 @@ static DEFINE_SPINLOCK(sysfs_open_dirent_lock);
-
- struct sysfs_open_dirent {
- atomic_t refcnt;
-- atomic_t event;
-+ atomic_unchecked_t event;
- wait_queue_head_t poll;
- struct list_head buffers; /* goes through sysfs_buffer.list */
- };
-@@ -53,7 +53,7 @@ struct sysfs_buffer {
- size_t count;
- loff_t pos;
- char * page;
-- struct sysfs_ops * ops;
-+ const struct sysfs_ops * ops;
- struct mutex mutex;
- int needs_read_fill;
- int event;
-@@ -75,7 +75,7 @@ static int fill_read_buffer(struct dentry * dentry, struct sysfs_buffer * buffer
- {
- struct sysfs_dirent *attr_sd = dentry->d_fsdata;
- struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
-- struct sysfs_ops * ops = buffer->ops;
-+ const struct sysfs_ops * ops = buffer->ops;
- int ret = 0;
- ssize_t count;
-
-@@ -88,7 +88,7 @@ static int fill_read_buffer(struct dentry * dentry, struct sysfs_buffer * buffer
- if (!sysfs_get_active_two(attr_sd))
- return -ENODEV;
-
-- buffer->event = atomic_read(&attr_sd->s_attr.open->event);
-+ buffer->event = atomic_read_unchecked(&attr_sd->s_attr.open->event);
- count = ops->show(kobj, attr_sd->s_attr.attr, buffer->page);
-
- sysfs_put_active_two(attr_sd);
-@@ -199,7 +199,7 @@ flush_write_buffer(struct dentry * dentry, struct sysfs_buffer * buffer, size_t
- {
- struct sysfs_dirent *attr_sd = dentry->d_fsdata;
- struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
-- struct sysfs_ops * ops = buffer->ops;
-+ const struct sysfs_ops * ops = buffer->ops;
- int rc;
-
- /* need attr_sd for attr and ops, its parent for kobj */
-@@ -294,7 +294,7 @@ static int sysfs_get_open_dirent(struct sysfs_dirent *sd,
- return -ENOMEM;
-
- atomic_set(&new_od->refcnt, 0);
-- atomic_set(&new_od->event, 1);
-+ atomic_set_unchecked(&new_od->event, 1);
- init_waitqueue_head(&new_od->poll);
- INIT_LIST_HEAD(&new_od->buffers);
- goto retry;
-@@ -335,7 +335,7 @@ static int sysfs_open_file(struct inode *inode, struct file *file)
- struct sysfs_dirent *attr_sd = file->f_path.dentry->d_fsdata;
- struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
- struct sysfs_buffer *buffer;
-- struct sysfs_ops *ops;
-+ const struct sysfs_ops *ops;
- int error = -EACCES;
- char *p;
-
-@@ -444,7 +444,7 @@ static unsigned int sysfs_poll(struct file *filp, poll_table *wait)
-
- sysfs_put_active_two(attr_sd);
-
-- if (buffer->event != atomic_read(&od->event))
-+ if (buffer->event != atomic_read_unchecked(&od->event))
- goto trigger;
-
- return DEFAULT_POLLMASK;
-@@ -463,7 +463,7 @@ void sysfs_notify_dirent(struct sysfs_dirent *sd)
-
- od = sd->s_attr.open;
- if (od) {
-- atomic_inc(&od->event);
-+ atomic_inc_unchecked(&od->event);
- wake_up_interruptible(&od->poll);
- }
-
-diff --git a/fs/sysfs/symlink.c b/fs/sysfs/symlink.c
-index c5081ad..342ea86 100644
---- a/fs/sysfs/symlink.c
-+++ b/fs/sysfs/symlink.c
-@@ -204,7 +204,7 @@ static void *sysfs_follow_link(struct dentry *dentry, struct nameidata *nd)
-
- static void sysfs_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
- {
-- char *page = nd_get_link(nd);
-+ const char *page = nd_get_link(nd);
- if (!IS_ERR(page))
- free_page((unsigned long)page);
- }
-diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c
-index 552fb01..2cff69a 100644
---- a/fs/ubifs/dir.c
-+++ b/fs/ubifs/dir.c
-@@ -377,6 +377,24 @@ static int ubifs_readdir(struct file *file, void *dirent, filldir_t filldir)
- */
- return 0;
-
-+ if (file->f_version == 0) {
-+ /*
-+ * The file was seek'ed, which means that @file->private_data
-+ * is now invalid. This may also be just the first
-+ * 'ubifs_readdir()' invocation, in which case
-+ * @file->private_data is NULL, and the below code is
-+ * basically a no-op.
-+ */
-+ kfree(file->private_data);
-+ file->private_data = NULL;
-+ }
-+
-+ /*
-+ * 'generic_file_llseek()' unconditionally sets @file->f_version to
-+ * zero, and we use this for detecting whether the file was seek'ed.
-+ */
-+ file->f_version = 1;
-+
- /* File positions 0 and 1 correspond to "." and ".." */
- if (file->f_pos == 0) {
- ubifs_assert(!file->private_data);
-@@ -451,6 +469,14 @@ static int ubifs_readdir(struct file *file, void *dirent, filldir_t filldir)
- file->f_pos = key_hash_flash(c, &dent->key);
- file->private_data = dent;
- cond_resched();
-+
-+ if (file->f_version == 0)
-+ /*
-+ * The file was seek'ed meanwhile, lets return and start
-+ * reading direntries from the new position on the next
-+ * invocation.
-+ */
-+ return 0;
- }
-
- out:
-@@ -461,16 +487,14 @@ out:
-
- kfree(file->private_data);
- file->private_data = NULL;
-+ /* 2 is a special value indicating that there are no more direntries */
- file->f_pos = 2;
- return 0;
- }
-
--/* If a directory is seeked, we have to free saved readdir() state */
--static loff_t ubifs_dir_llseek(struct file *file, loff_t offset, int origin)
-+static loff_t ubifs_dir_llseek(struct file *file, loff_t offset, int whence)
- {
-- kfree(file->private_data);
-- file->private_data = NULL;
-- return generic_file_llseek(file, offset, origin);
-+ return generic_file_llseek(file, offset, whence);
- }
-
- /* Free saved readdir() state when the directory is closed */
-diff --git a/fs/udf/balloc.c b/fs/udf/balloc.c
-index 1e06853..b06d325 100644
---- a/fs/udf/balloc.c
-+++ b/fs/udf/balloc.c
-@@ -172,9 +172,7 @@ static void udf_bitmap_free_blocks(struct super_block *sb,
-
- mutex_lock(&sbi->s_alloc_mutex);
- partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
-- if (bloc->logicalBlockNum < 0 ||
-- (bloc->logicalBlockNum + count) >
-- partmap->s_partition_len) {
-+ if ((bloc->logicalBlockNum + count) > partmap->s_partition_len) {
- udf_debug("%d < %d || %d + %d > %d\n",
- bloc->logicalBlockNum, 0, bloc->logicalBlockNum,
- count, partmap->s_partition_len);
-@@ -436,9 +434,7 @@ static void udf_table_free_blocks(struct super_block *sb,
-
- mutex_lock(&sbi->s_alloc_mutex);
- partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
-- if (bloc->logicalBlockNum < 0 ||
-- (bloc->logicalBlockNum + count) >
-- partmap->s_partition_len) {
-+ if ((bloc->logicalBlockNum + count) > partmap->s_partition_len) {
- udf_debug("%d < %d || %d + %d > %d\n",
- bloc.logicalBlockNum, 0, bloc.logicalBlockNum, count,
- partmap->s_partition_len);
-diff --git a/fs/udf/inode.c b/fs/udf/inode.c
-index 3c4ffb2..d0a9d92 100644
---- a/fs/udf/inode.c
-+++ b/fs/udf/inode.c
-@@ -484,6 +484,8 @@ static struct buffer_head *inode_getblk(struct inode *inode, sector_t block,
- int goal = 0, pgoal = iinfo->i_location.logicalBlockNum;
- int lastblock = 0;
-
-+ pax_track_stack();
-+
- prev_epos.offset = udf_file_entry_alloc_offset(inode);
- prev_epos.block = iinfo->i_location;
- prev_epos.bh = NULL;
-diff --git a/fs/udf/misc.c b/fs/udf/misc.c
-index 9215700..bf1f68e 100644
---- a/fs/udf/misc.c
-+++ b/fs/udf/misc.c
-@@ -286,7 +286,7 @@ void udf_new_tag(char *data, uint16_t ident, uint16_t version, uint16_t snum,
-
- u8 udf_tag_checksum(const struct tag *t)
- {
-- u8 *data = (u8 *)t;
-+ const u8 *data = (const u8 *)t;
- u8 checksum = 0;
- int i;
- for (i = 0; i < sizeof(struct tag); ++i)
-diff --git a/fs/udf/super.c b/fs/udf/super.c
-index 0045ebc..d069fda 100644
---- a/fs/udf/super.c
-+++ b/fs/udf/super.c
-@@ -1306,6 +1306,13 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block,
- return 1;
- BUG_ON(ident != TAG_IDENT_LVD);
- lvd = (struct logicalVolDesc *)bh->b_data;
-+ table_len = le32_to_cpu(lvd->mapTableLength);
-+ if (sizeof(*lvd) + table_len > sb->s_blocksize) {
-+ udf_error(sb, __func__, "error loading logical volume descriptor: "
-+ "Partition table too long (%u > %lu)\n", table_len,
-+ sb->s_blocksize - sizeof(*lvd));
-+ goto out_bh;
-+ }
-
- table_len = le32_to_cpu(lvd->mapTableLength);
- if (table_len > sb->s_blocksize - sizeof(*lvd)) {
-diff --git a/fs/utimes.c b/fs/utimes.c
-index e4c75db..b4df0e0 100644
---- a/fs/utimes.c
-+++ b/fs/utimes.c
-@@ -1,6 +1,7 @@
- #include <linux/compiler.h>
- #include <linux/file.h>
- #include <linux/fs.h>
-+#include <linux/security.h>
- #include <linux/linkage.h>
- #include <linux/mount.h>
- #include <linux/namei.h>
-@@ -101,6 +102,12 @@ static int utimes_common(struct path *path, struct timespec *times)
- goto mnt_drop_write_and_out;
- }
- }
-+
-+ if (!gr_acl_handle_utime(path->dentry, path->mnt)) {
-+ error = -EACCES;
-+ goto mnt_drop_write_and_out;
-+ }
-+
- mutex_lock(&inode->i_mutex);
- error = notify_change(path->dentry, &newattrs);
- mutex_unlock(&inode->i_mutex);
-diff --git a/fs/xattr.c b/fs/xattr.c
-index 6d4f6d3..c3ae0e3 100644
---- a/fs/xattr.c
-+++ b/fs/xattr.c
-@@ -247,7 +247,7 @@ EXPORT_SYMBOL_GPL(vfs_removexattr);
- * Extended attribute SET operations
- */
- static long
--setxattr(struct dentry *d, const char __user *name, const void __user *value,
-+setxattr(struct path *path, const char __user *name, const void __user *value,
- size_t size, int flags)
- {
- int error;
-@@ -271,7 +271,13 @@ setxattr(struct dentry *d, const char __user *name, const void __user *value,
- return PTR_ERR(kvalue);
- }
-
-- error = vfs_setxattr(d, kname, kvalue, size, flags);
-+ if (!gr_acl_handle_setxattr(path->dentry, path->mnt)) {
-+ error = -EACCES;
-+ goto out;
-+ }
-+
-+ error = vfs_setxattr(path->dentry, kname, kvalue, size, flags);
-+out:
- kfree(kvalue);
- return error;
- }
-@@ -288,7 +294,7 @@ SYSCALL_DEFINE5(setxattr, const char __user *, pathname,
- return error;
- error = mnt_want_write(path.mnt);
- if (!error) {
-- error = setxattr(path.dentry, name, value, size, flags);
-+ error = setxattr(&path, name, value, size, flags);
- mnt_drop_write(path.mnt);
- }
- path_put(&path);
-@@ -307,7 +313,7 @@ SYSCALL_DEFINE5(lsetxattr, const char __user *, pathname,
- return error;
- error = mnt_want_write(path.mnt);
- if (!error) {
-- error = setxattr(path.dentry, name, value, size, flags);
-+ error = setxattr(&path, name, value, size, flags);
- mnt_drop_write(path.mnt);
- }
- path_put(&path);
-@@ -318,17 +324,15 @@ SYSCALL_DEFINE5(fsetxattr, int, fd, const char __user *, name,
- const void __user *,value, size_t, size, int, flags)
- {
- struct file *f;
-- struct dentry *dentry;
- int error = -EBADF;
-
- f = fget(fd);
- if (!f)
- return error;
-- dentry = f->f_path.dentry;
-- audit_inode(NULL, dentry);
-+ audit_inode(NULL, f->f_path.dentry);
- error = mnt_want_write_file(f);
- if (!error) {
-- error = setxattr(dentry, name, value, size, flags);
-+ error = setxattr(&f->f_path, name, value, size, flags);
- mnt_drop_write(f->f_path.mnt);
- }
- fput(f);
-@@ -492,7 +496,7 @@ SYSCALL_DEFINE3(flistxattr, int, fd, char __user *, list, size_t, size)
- * Extended attribute REMOVE operations
- */
- static long
--removexattr(struct dentry *d, const char __user *name)
-+removexattr(struct path *path, const char __user *name)
- {
- int error;
- char kname[XATTR_NAME_MAX + 1];
-@@ -503,7 +507,10 @@ removexattr(struct dentry *d, const char __user *name)
- if (error < 0)
- return error;
-
-- return vfs_removexattr(d, kname);
-+ if (!gr_acl_handle_removexattr(path->dentry, path->mnt))
-+ return -EACCES;
-+
-+ return vfs_removexattr(path->dentry, kname);
- }
-
- SYSCALL_DEFINE2(removexattr, const char __user *, pathname,
-@@ -517,7 +524,7 @@ SYSCALL_DEFINE2(removexattr, const char __user *, pathname,
- return error;
- error = mnt_want_write(path.mnt);
- if (!error) {
-- error = removexattr(path.dentry, name);
-+ error = removexattr(&path, name);
- mnt_drop_write(path.mnt);
- }
- path_put(&path);
-@@ -535,7 +542,7 @@ SYSCALL_DEFINE2(lremovexattr, const char __user *, pathname,
- return error;
- error = mnt_want_write(path.mnt);
- if (!error) {
-- error = removexattr(path.dentry, name);
-+ error = removexattr(&path, name);
- mnt_drop_write(path.mnt);
- }
- path_put(&path);
-@@ -545,17 +552,17 @@ SYSCALL_DEFINE2(lremovexattr, const char __user *, pathname,
- SYSCALL_DEFINE2(fremovexattr, int, fd, const char __user *, name)
- {
- struct file *f;
-- struct dentry *dentry;
-+ struct path *path;
- int error = -EBADF;
-
- f = fget(fd);
- if (!f)
- return error;
-- dentry = f->f_path.dentry;
-- audit_inode(NULL, dentry);
-+ path = &f->f_path;
-+ audit_inode(NULL, path->dentry);
- error = mnt_want_write_file(f);
- if (!error) {
-- error = removexattr(dentry, name);
-+ error = removexattr(path, name);
- mnt_drop_write(f->f_path.mnt);
- }
- fput(f);
-diff --git a/fs/xattr_acl.c b/fs/xattr_acl.c
-index c6ad7c7..f2847a7 100644
---- a/fs/xattr_acl.c
-+++ b/fs/xattr_acl.c
-@@ -17,8 +17,8 @@
- struct posix_acl *
- posix_acl_from_xattr(const void *value, size_t size)
- {
-- posix_acl_xattr_header *header = (posix_acl_xattr_header *)value;
-- posix_acl_xattr_entry *entry = (posix_acl_xattr_entry *)(header+1), *end;
-+ const posix_acl_xattr_header *header = (const posix_acl_xattr_header *)value;
-+ const posix_acl_xattr_entry *entry = (const posix_acl_xattr_entry *)(header+1), *end;
- int count;
- struct posix_acl *acl;
- struct posix_acl_entry *acl_e;
-diff --git a/fs/xfs/linux-2.6/xfs_ioctl.c b/fs/xfs/linux-2.6/xfs_ioctl.c
-index 942362f..c34007f 100644
---- a/fs/xfs/linux-2.6/xfs_ioctl.c
-+++ b/fs/xfs/linux-2.6/xfs_ioctl.c
-@@ -134,7 +134,7 @@ xfs_find_handle(
- }
-
- error = -EFAULT;
-- if (copy_to_user(hreq->ohandle, &handle, hsize) ||
-+ if (hsize > sizeof handle || copy_to_user(hreq->ohandle, &handle, hsize) ||
- copy_to_user(hreq->ohandlen, &hsize, sizeof(__s32)))
- goto out_put;
-
-@@ -410,7 +410,8 @@ xfs_attrlist_by_handle(
- return -XFS_ERROR(EPERM);
- if (copy_from_user(&al_hreq, arg, sizeof(xfs_fsop_attrlist_handlereq_t)))
- return -XFS_ERROR(EFAULT);
-- if (al_hreq.buflen > XATTR_LIST_MAX)
-+ if (al_hreq.buflen < sizeof(struct attrlist) ||
-+ al_hreq.buflen > XATTR_LIST_MAX)
- return -XFS_ERROR(EINVAL);
-
- /*
-@@ -423,7 +424,7 @@ xfs_attrlist_by_handle(
- if (IS_ERR(dentry))
- return PTR_ERR(dentry);
-
-- kbuf = kmalloc(al_hreq.buflen, GFP_KERNEL);
-+ kbuf = kzalloc(al_hreq.buflen, GFP_KERNEL);
- if (!kbuf)
- goto out_dput;
-
-@@ -697,7 +698,7 @@ xfs_ioc_fsgeometry_v1(
- xfs_mount_t *mp,
- void __user *arg)
- {
-- xfs_fsop_geom_t fsgeo;
-+ xfs_fsop_geom_t fsgeo;
- int error;
-
- error = xfs_fs_geometry(mp, &fsgeo, 3);
-diff --git a/fs/xfs/linux-2.6/xfs_ioctl32.c b/fs/xfs/linux-2.6/xfs_ioctl32.c
-index bad485a..93cf913 100644
---- a/fs/xfs/linux-2.6/xfs_ioctl32.c
-+++ b/fs/xfs/linux-2.6/xfs_ioctl32.c
-@@ -75,6 +75,7 @@ xfs_compat_ioc_fsgeometry_v1(
- xfs_fsop_geom_t fsgeo;
- int error;
-
-+ memset(&fsgeo, 0, sizeof(fsgeo));
- error = xfs_fs_geometry(mp, &fsgeo, 3);
- if (error)
- return -error;
-@@ -361,7 +362,8 @@ xfs_compat_attrlist_by_handle(
- if (copy_from_user(&al_hreq, arg,
- sizeof(compat_xfs_fsop_attrlist_handlereq_t)))
- return -XFS_ERROR(EFAULT);
-- if (al_hreq.buflen > XATTR_LIST_MAX)
-+ if (al_hreq.buflen < sizeof(struct attrlist) ||
-+ al_hreq.buflen > XATTR_LIST_MAX)
- return -XFS_ERROR(EINVAL);
-
- /*
-diff --git a/fs/xfs/linux-2.6/xfs_iops.c b/fs/xfs/linux-2.6/xfs_iops.c
-index 1f3b4b8..6102f6d 100644
---- a/fs/xfs/linux-2.6/xfs_iops.c
-+++ b/fs/xfs/linux-2.6/xfs_iops.c
-@@ -468,7 +468,7 @@ xfs_vn_put_link(
- struct nameidata *nd,
- void *p)
- {
-- char *s = nd_get_link(nd);
-+ const char *s = nd_get_link(nd);
-
- if (!IS_ERR(s))
- kfree(s);
-diff --git a/fs/xfs/xfs_bmap.c b/fs/xfs/xfs_bmap.c
-index 8971fb0..5fc1eb2 100644
---- a/fs/xfs/xfs_bmap.c
-+++ b/fs/xfs/xfs_bmap.c
-@@ -360,7 +360,7 @@ xfs_bmap_validate_ret(
- int nmap,
- int ret_nmap);
- #else
--#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap)
-+#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap) do {} while (0)
- #endif /* DEBUG */
-
- #if defined(XFS_RW_TRACE)
-diff --git a/fs/xfs/xfs_dir2_sf.c b/fs/xfs/xfs_dir2_sf.c
-index e89734e..5e84d8d 100644
---- a/fs/xfs/xfs_dir2_sf.c
-+++ b/fs/xfs/xfs_dir2_sf.c
-@@ -779,7 +779,15 @@ xfs_dir2_sf_getdents(
- }
-
- ino = xfs_dir2_sf_get_inumber(sfp, xfs_dir2_sf_inumberp(sfep));
-- if (filldir(dirent, sfep->name, sfep->namelen,
-+ if (dp->i_df.if_u1.if_data == dp->i_df.if_u2.if_inline_data) {
-+ char name[sfep->namelen];
-+ memcpy(name, sfep->name, sfep->namelen);
-+ if (filldir(dirent, name, sfep->namelen,
-+ off & 0x7fffffff, ino, DT_UNKNOWN)) {
-+ *offset = off & 0x7fffffff;
-+ return 0;
-+ }
-+ } else if (filldir(dirent, sfep->name, sfep->namelen,
- off & 0x7fffffff, ino, DT_UNKNOWN)) {
- *offset = off & 0x7fffffff;
- return 0;
-diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig
-new file mode 100644
-index 0000000..9712ce3
---- /dev/null
-+++ b/grsecurity/Kconfig
-@@ -0,0 +1,1055 @@
-+#
-+# grecurity configuration
-+#
-+menu "Memory Protections"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_KMEM
-+ bool "Deny reading/writing to /dev/kmem, /dev/mem, and /dev/port"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ select STRICT_DEVMEM if (X86 || ARM || TILE || S390)
-+ help
-+ If you say Y here, /dev/kmem and /dev/mem won't be allowed to
-+ be written to or read from to modify or leak the contents of the running
-+ kernel. /dev/port will also not be allowed to be opened and support
-+ for /dev/cpu/*/msr will be removed. If you have module
-+ support disabled, enabling this will close up five ways that are
-+ currently used to insert malicious code into the running kernel.
-+
-+ Even with all these features enabled, we still highly recommend that
-+ you use the RBAC system, as it is still possible for an attacker to
-+ modify the running kernel through privileged I/O granted by ioperm/iopl.
-+
-+ If you are not using XFree86, you may be able to stop this additional
-+ case by enabling the 'Disable privileged I/O' option. Though nothing
-+ legitimately writes to /dev/kmem, XFree86 does need to write to /dev/mem,
-+ but only to video memory, which is the only writing we allow in this
-+ case. If /dev/kmem or /dev/mem are mmaped without PROT_WRITE, they will
-+ not be allowed to mprotect it with PROT_WRITE later.
-+ Enabling this feature will prevent the "cpupower" and "powertop" tools
-+ from working.
-+
-+ It is highly recommended that you say Y here if you meet all the
-+ conditions above.
-+
-+config GRKERNSEC_VM86
-+ bool "Restrict VM86 mode"
-+ default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_SERVER)
-+ depends on X86_32
-+
-+ help
-+ If you say Y here, only processes with CAP_SYS_RAWIO will be able to
-+ make use of a special execution mode on 32bit x86 processors called
-+ Virtual 8086 (VM86) mode. XFree86 may need vm86 mode for certain
-+ video cards and will still work with this option enabled. The purpose
-+ of the option is to prevent exploitation of emulation errors in
-+ virtualization of vm86 mode like the one discovered in VMWare in 2009.
-+ Nearly all users should be able to enable this option.
-+
-+config GRKERNSEC_IO
-+ bool "Disable privileged I/O"
-+ default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_SERVER)
-+ depends on X86
-+ select RTC_CLASS
-+ select RTC_INTF_DEV
-+ select RTC_DRV_CMOS
-+
-+ help
-+ If you say Y here, all ioperm and iopl calls will return an error.
-+ Ioperm and iopl can be used to modify the running kernel.
-+ Unfortunately, some programs need this access to operate properly,
-+ the most notable of which are XFree86 and hwclock. hwclock can be
-+ remedied by having RTC support in the kernel, so real-time
-+ clock support is enabled if this option is enabled, to ensure
-+ that hwclock operates correctly. XFree86 still will not
-+ operate correctly with this option enabled, so DO NOT CHOOSE Y
-+ IF YOU USE XFree86. If you use XFree86 and you still want to
-+ protect your kernel against modification, use the RBAC system.
-+
-+config GRKERNSEC_RAND_THREADSTACK
-+ bool "Insert random gaps between thread stacks"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on PAX_RANDMMAP && !PPC
-+ help
-+ If you say Y here, a random-sized gap will be enforced between allocated
-+ thread stacks. Glibc's NPTL and other threading libraries that
-+ pass MAP_STACK to the kernel for thread stack allocation are supported.
-+ The implementation currently provides 8 bits of entropy for the gap.
-+
-+ Many distributions do not compile threaded remote services with the
-+ -fstack-check argument to GCC, causing the variable-sized stack-based
-+ allocator, alloca(), to not probe the stack on allocation. This
-+ permits an unbounded alloca() to skip over any guard page and potentially
-+ modify another thread's stack reliably. An enforced random gap
-+ reduces the reliability of such an attack and increases the chance
-+ that such a read/write to another thread's stack instead lands in
-+ an unmapped area, causing a crash and triggering grsecurity's
-+ anti-bruteforcing logic.
-+
-+config GRKERNSEC_PROC_MEMMAP
-+ bool "Harden ASLR against information leaks and entropy reduction"
-+ default y if (GRKERNSEC_CONFIG_AUTO || PAX_NOEXEC || PAX_ASLR)
-+ depends on PAX_NOEXEC || PAX_ASLR
-+ help
-+ If you say Y here, the /proc/<pid>/maps and /proc/<pid>/stat files will
-+ give no information about the addresses of its mappings if
-+ PaX features that rely on random addresses are enabled on the task.
-+ In addition to sanitizing this information and disabling other
-+ dangerous sources of information, this option causes reads of sensitive
-+ /proc/<pid> entries where the file descriptor was opened in a different
-+ task than the one performing the read. Such attempts are logged.
-+ This option also limits argv/env strings for suid/sgid binaries
-+ to 512KB to prevent a complete exhaustion of the stack entropy provided
-+ by ASLR. Finally, it places an 8MB stack resource limit on suid/sgid
-+ binaries to prevent alternative mmap layouts from being abused.
-+
-+ If you use PaX it is essential that you say Y here as it closes up
-+ several holes that make full ASLR useless locally.
-+
-+config GRKERNSEC_BRUTE
-+ bool "Deter exploit bruteforcing"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ If you say Y here, attempts to bruteforce exploits against forking
-+ daemons such as apache or sshd, as well as against suid/sgid binaries
-+ will be deterred. When a child of a forking daemon is killed by PaX
-+ or crashes due to an illegal instruction or other suspicious signal,
-+ the parent process will be delayed 30 seconds upon every subsequent
-+ fork until the administrator is able to assess the situation and
-+ restart the daemon.
-+ In the suid/sgid case, the attempt is logged, the user has all their
-+ existing instances of the suid/sgid binary terminated and will
-+ be unable to execute any suid/sgid binaries for 15 minutes.
-+
-+ It is recommended that you also enable signal logging in the auditing
-+ section so that logs are generated when a process triggers a suspicious
-+ signal.
-+ If the sysctl option is enabled, a sysctl option with name
-+ "deter_bruteforce" is created.
-+
-+config GRKERNSEC_MODHARDEN
-+ bool "Harden module auto-loading"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on MODULES
-+ help
-+ If you say Y here, module auto-loading in response to use of some
-+ feature implemented by an unloaded module will be restricted to
-+ root users. Enabling this option helps defend against attacks
-+ by unprivileged users who abuse the auto-loading behavior to
-+ cause a vulnerable module to load that is then exploited.
-+
-+ If this option prevents a legitimate use of auto-loading for a
-+ non-root user, the administrator can execute modprobe manually
-+ with the exact name of the module mentioned in the alert log.
-+ Alternatively, the administrator can add the module to the list
-+ of modules loaded at boot by modifying init scripts.
-+
-+ Modification of init scripts will most likely be needed on
-+ Ubuntu servers with encrypted home directory support enabled,
-+ as the first non-root user logging in will cause the ecb(aes),
-+ ecb(aes)-all, cbc(aes), and cbc(aes)-all modules to be loaded.
-+
-+config GRKERNSEC_HIDESYM
-+ bool "Hide kernel symbols"
-+ select PAX_USERCOPY_SLABS
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ If you say Y here, getting information on loaded modules, and
-+ displaying all kernel symbols through a syscall will be restricted
-+ to users with CAP_SYS_MODULE. For software compatibility reasons,
-+ /proc/kallsyms will be restricted to the root user. The RBAC
-+ system can hide that entry even from root.
-+
-+ This option also prevents leaking of kernel addresses through
-+ several /proc entries.
-+
-+ Note that this option is only effective provided the following
-+ conditions are met:
-+ 1) The kernel using grsecurity is not precompiled by some distribution
-+ 2) You have also enabled GRKERNSEC_DMESG
-+ 3) You are using the RBAC system and hiding other files such as your
-+ kernel image and System.map. Alternatively, enabling this option
-+ causes the permissions on /boot, /lib/modules, and the kernel
-+ source directory to change at compile time to prevent
-+ reading by non-root users.
-+ If the above conditions are met, this option will aid in providing a
-+ useful protection against local kernel exploitation of overflows
-+ and arbitrary read/write vulnerabilities.
-+
-+config GRKERNSEC_KERN_LOCKOUT
-+ bool "Active kernel exploit response"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on X86 || ARM || PPC || SPARC
-+ help
-+ If you say Y here, when a PaX alert is triggered due to suspicious
-+ activity in the kernel (from KERNEXEC/UDEREF/USERCOPY)
-+ or an OOPS occurs due to bad memory accesses, instead of just
-+ terminating the offending process (and potentially allowing
-+ a subsequent exploit from the same user), we will take one of two
-+ actions:
-+ If the user was root, we will panic the system
-+ If the user was non-root, we will log the attempt, terminate
-+ all processes owned by the user, then prevent them from creating
-+ any new processes until the system is restarted
-+ This deters repeated kernel exploitation/bruteforcing attempts
-+ and is useful for later forensics.
-+
-+endmenu
-+menu "Role Based Access Control Options"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_RBAC_DEBUG
-+ bool
-+
-+config GRKERNSEC_NO_RBAC
-+ bool "Disable RBAC system"
-+ help
-+ If you say Y here, the /dev/grsec device will be removed from the kernel,
-+ preventing the RBAC system from being enabled. You should only say Y
-+ here if you have no intention of using the RBAC system, so as to prevent
-+ an attacker with root access from misusing the RBAC system to hide files
-+ and processes when loadable module support and /dev/[k]mem have been
-+ locked down.
-+
-+config GRKERNSEC_ACL_HIDEKERN
-+ bool "Hide kernel processes"
-+ help
-+ If you say Y here, all kernel threads will be hidden to all
-+ processes but those whose subject has the "view hidden processes"
-+ flag.
-+
-+config GRKERNSEC_ACL_MAXTRIES
-+ int "Maximum tries before password lockout"
-+ default 3
-+ help
-+ This option enforces the maximum number of times a user can attempt
-+ to authorize themselves with the grsecurity RBAC system before being
-+ denied the ability to attempt authorization again for a specified time.
-+ The lower the number, the harder it will be to brute-force a password.
-+
-+config GRKERNSEC_ACL_TIMEOUT
-+ int "Time to wait after max password tries, in seconds"
-+ default 30
-+ help
-+ This option specifies the time the user must wait after attempting to
-+ authorize to the RBAC system with the maximum number of invalid
-+ passwords. The higher the number, the harder it will be to brute-force
-+ a password.
-+
-+endmenu
-+menu "Filesystem Protections"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_PROC
-+ bool "Proc restrictions"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ If you say Y here, the permissions of the /proc filesystem
-+ will be altered to enhance system security and privacy. You MUST
-+ choose either a user only restriction or a user and group restriction.
-+ Depending upon the option you choose, you can either restrict users to
-+ see only the processes they themselves run, or choose a group that can
-+ view all processes and files normally restricted to root if you choose
-+ the "restrict to user only" option. NOTE: If you're running identd or
-+ ntpd as a non-root user, you will have to run it as the group you
-+ specify here.
-+
-+config GRKERNSEC_PROC_USER
-+ bool "Restrict /proc to user only"
-+ depends on GRKERNSEC_PROC
-+ help
-+ If you say Y here, non-root users will only be able to view their own
-+ processes, and restricts them from viewing network-related information,
-+ and viewing kernel symbol and module information.
-+
-+config GRKERNSEC_PROC_USERGROUP
-+ bool "Allow special group"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
-+ help
-+ If you say Y here, you will be able to select a group that will be
-+ able to view all processes and network-related information. If you've
-+ enabled GRKERNSEC_HIDESYM, kernel and symbol information may still
-+ remain hidden. This option is useful if you want to run identd as
-+ a non-root user. The group you select may also be chosen at boot time
-+ via "grsec_proc_gid=" on the kernel commandline.
-+
-+config GRKERNSEC_PROC_GID
-+ int "GID for special group"
-+ depends on GRKERNSEC_PROC_USERGROUP
-+ default 1001
-+
-+config GRKERNSEC_PROC_ADD
-+ bool "Additional restrictions"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
-+ help
-+ If you say Y here, additional restrictions will be placed on
-+ /proc that keep normal users from viewing device information and
-+ slabinfo information that could be useful for exploits.
-+
-+config GRKERNSEC_LINK
-+ bool "Linking restrictions"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ If you say Y here, /tmp race exploits will be prevented, since users
-+ will no longer be able to follow symlinks owned by other users in
-+ world-writable +t directories (e.g. /tmp), unless the owner of the
-+ symlink is the owner of the directory. users will also not be
-+ able to hardlink to files they do not own. If the sysctl option is
-+ enabled, a sysctl option with name "linking_restrictions" is created.
-+
-+config GRKERNSEC_SYMLINKOWN
-+ bool "Kernel-enforced SymlinksIfOwnerMatch"
-+ default y if GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_SERVER
-+ help
-+ Apache's SymlinksIfOwnerMatch option has an inherent race condition
-+ that prevents it from being used as a security feature. As Apache
-+ verifies the symlink by performing a stat() against the target of
-+ the symlink before it is followed, an attacker can setup a symlink
-+ to point to a same-owned file, then replace the symlink with one
-+ that targets another user's file just after Apache "validates" the
-+ symlink -- a classic TOCTOU race. If you say Y here, a complete,
-+ race-free replacement for Apache's "SymlinksIfOwnerMatch" option
-+ will be in place for the group you specify. If the sysctl option
-+ is enabled, a sysctl option with name "enforce_symlinksifowner" is
-+ created.
-+
-+config GRKERNSEC_SYMLINKOWN_GID
-+ int "GID for users with kernel-enforced SymlinksIfOwnerMatch"
-+ depends on GRKERNSEC_SYMLINKOWN
-+ default 1006
-+ help
-+ Setting this GID determines what group kernel-enforced
-+ SymlinksIfOwnerMatch will be enabled for. If the sysctl option
-+ is enabled, a sysctl option with name "symlinkown_gid" is created.
-+
-+config GRKERNSEC_FIFO
-+ bool "FIFO restrictions"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ If you say Y here, users will not be able to write to FIFOs they don't
-+ own in world-writable +t directories (e.g. /tmp), unless the owner of
-+ the FIFO is the same owner of the directory it's held in. If the sysctl
-+ option is enabled, a sysctl option with name "fifo_restrictions" is
-+ created.
-+
-+config GRKERNSEC_SYSFS_RESTRICT
-+ bool "Sysfs/debugfs restriction"
-+ default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_SERVER)
-+ depends on SYSFS
-+ help
-+ If you say Y here, sysfs (the pseudo-filesystem mounted at /sys) and
-+ any filesystem normally mounted under it (e.g. debugfs) will be
-+ mostly accessible only by root. These filesystems generally provide access
-+ to hardware and debug information that isn't appropriate for unprivileged
-+ users of the system. Sysfs and debugfs have also become a large source
-+ of new vulnerabilities, ranging from infoleaks to local compromise.
-+ There has been very little oversight with an eye toward security involved
-+ in adding new exporters of information to these filesystems, so their
-+ use is discouraged.
-+ For reasons of compatibility, a few directories have been whitelisted
-+ for access by non-root users:
-+ /sys/fs/selinux
-+ /sys/fs/fuse
-+ /sys/devices/system/cpu
-+
-+config GRKERNSEC_ROFS
-+ bool "Runtime read-only mount protection"
-+ depends on SYSCTL
-+ help
-+ If you say Y here, a sysctl option with name "romount_protect" will
-+ be created. By setting this option to 1 at runtime, filesystems
-+ will be protected in the following ways:
-+ * No new writable mounts will be allowed
-+ * Existing read-only mounts won't be able to be remounted read/write
-+ * Write operations will be denied on all block devices
-+ This option acts independently of grsec_lock: once it is set to 1,
-+ it cannot be turned off. Therefore, please be mindful of the resulting
-+ behavior if this option is enabled in an init script on a read-only
-+ filesystem.
-+ Also be aware that as with other root-focused features, GRKERNSEC_KMEM
-+ and GRKERNSEC_IO should be enabled and module loading disabled via
-+ config or at runtime.
-+ This feature is mainly intended for secure embedded systems.
-+
-+
-+config GRKERNSEC_DEVICE_SIDECHANNEL
-+ bool "Eliminate stat/notify-based device sidechannels"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ If you say Y here, timing analyses on block or character
-+ devices like /dev/ptmx using stat or inotify/dnotify/fanotify
-+ will be thwarted for unprivileged users. If a process without
-+ CAP_MKNOD stats such a device, the last access and last modify times
-+ will match the device's create time. No access or modify events
-+ will be triggered through inotify/dnotify/fanotify for such devices.
-+ This feature will prevent attacks that may at a minimum
-+ allow an attacker to determine the administrator's password length.
-+
-+config GRKERNSEC_CHROOT
-+ bool "Chroot jail restrictions"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ If you say Y here, you will be able to choose several options that will
-+ make breaking out of a chrooted jail much more difficult. If you
-+ encounter no software incompatibilities with the following options, it
-+ is recommended that you enable each one.
-+
-+config GRKERNSEC_CHROOT_MOUNT
-+ bool "Deny mounts"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, processes inside a chroot will not be able to
-+ mount or remount filesystems. If the sysctl option is enabled, a
-+ sysctl option with name "chroot_deny_mount" is created.
-+
-+config GRKERNSEC_CHROOT_DOUBLE
-+ bool "Deny double-chroots"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, processes inside a chroot will not be able to chroot
-+ again outside the chroot. This is a widely used method of breaking
-+ out of a chroot jail and should not be allowed. If the sysctl
-+ option is enabled, a sysctl option with name
-+ "chroot_deny_chroot" is created.
-+
-+config GRKERNSEC_CHROOT_PIVOT
-+ bool "Deny pivot_root in chroot"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, processes inside a chroot will not be able to use
-+ a function called pivot_root() that was introduced in Linux 2.3.41. It
-+ works similar to chroot in that it changes the root filesystem. This
-+ function could be misused in a chrooted process to attempt to break out
-+ of the chroot, and therefore should not be allowed. If the sysctl
-+ option is enabled, a sysctl option with name "chroot_deny_pivot" is
-+ created.
-+
-+config GRKERNSEC_CHROOT_CHDIR
-+ bool "Enforce chdir(\"/\") on all chroots"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, the current working directory of all newly-chrooted
-+ applications will be set to the the root directory of the chroot.
-+ The man page on chroot(2) states:
-+ Note that this call does not change the current working
-+ directory, so that `.' can be outside the tree rooted at
-+ `/'. In particular, the super-user can escape from a
-+ `chroot jail' by doing `mkdir foo; chroot foo; cd ..'.
-+
-+ It is recommended that you say Y here, since it's not known to break
-+ any software. If the sysctl option is enabled, a sysctl option with
-+ name "chroot_enforce_chdir" is created.
-+
-+config GRKERNSEC_CHROOT_CHMOD
-+ bool "Deny (f)chmod +s"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, processes inside a chroot will not be able to chmod
-+ or fchmod files to make them have suid or sgid bits. This protects
-+ against another published method of breaking a chroot. If the sysctl
-+ option is enabled, a sysctl option with name "chroot_deny_chmod" is
-+ created.
-+
-+config GRKERNSEC_CHROOT_FCHDIR
-+ bool "Deny fchdir out of chroot"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, a well-known method of breaking chroots by fchdir'ing
-+ to a file descriptor of the chrooting process that points to a directory
-+ outside the filesystem will be stopped. If the sysctl option
-+ is enabled, a sysctl option with name "chroot_deny_fchdir" is created.
-+
-+config GRKERNSEC_CHROOT_MKNOD
-+ bool "Deny mknod"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, processes inside a chroot will not be allowed to
-+ mknod. The problem with using mknod inside a chroot is that it
-+ would allow an attacker to create a device entry that is the same
-+ as one on the physical root of your system, which could range from
-+ anything from the console device to a device for your harddrive (which
-+ they could then use to wipe the drive or steal data). It is recommended
-+ that you say Y here, unless you run into software incompatibilities.
-+ If the sysctl option is enabled, a sysctl option with name
-+ "chroot_deny_mknod" is created.
-+
-+config GRKERNSEC_CHROOT_SHMAT
-+ bool "Deny shmat() out of chroot"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, processes inside a chroot will not be able to attach
-+ to shared memory segments that were created outside of the chroot jail.
-+ It is recommended that you say Y here. If the sysctl option is enabled,
-+ a sysctl option with name "chroot_deny_shmat" is created.
-+
-+config GRKERNSEC_CHROOT_UNIX
-+ bool "Deny access to abstract AF_UNIX sockets out of chroot"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, processes inside a chroot will not be able to
-+ connect to abstract (meaning not belonging to a filesystem) Unix
-+ domain sockets that were bound outside of a chroot. It is recommended
-+ that you say Y here. If the sysctl option is enabled, a sysctl option
-+ with name "chroot_deny_unix" is created.
-+
-+config GRKERNSEC_CHROOT_FINDTASK
-+ bool "Protect outside processes"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, processes inside a chroot will not be able to
-+ kill, send signals with fcntl, ptrace, capget, getpgid, setpgid,
-+ getsid, or view any process outside of the chroot. If the sysctl
-+ option is enabled, a sysctl option with name "chroot_findtask" is
-+ created.
-+
-+config GRKERNSEC_CHROOT_NICE
-+ bool "Restrict priority changes"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, processes inside a chroot will not be able to raise
-+ the priority of processes in the chroot, or alter the priority of
-+ processes outside the chroot. This provides more security than simply
-+ removing CAP_SYS_NICE from the process' capability set. If the
-+ sysctl option is enabled, a sysctl option with name "chroot_restrict_nice"
-+ is created.
-+
-+config GRKERNSEC_CHROOT_SYSCTL
-+ bool "Deny sysctl writes"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, an attacker in a chroot will not be able to
-+ write to sysctl entries, either by sysctl(2) or through a /proc
-+ interface. It is strongly recommended that you say Y here. If the
-+ sysctl option is enabled, a sysctl option with name
-+ "chroot_deny_sysctl" is created.
-+
-+config GRKERNSEC_CHROOT_CAPS
-+ bool "Capability restrictions"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, the capabilities on all processes within a
-+ chroot jail will be lowered to stop module insertion, raw i/o,
-+ system and net admin tasks, rebooting the system, modifying immutable
-+ files, modifying IPC owned by another, and changing the system time.
-+ This is left an option because it can break some apps. Disable this
-+ if your chrooted apps are having problems performing those kinds of
-+ tasks. If the sysctl option is enabled, a sysctl option with
-+ name "chroot_caps" is created.
-+
-+config GRKERNSEC_CHROOT_INITRD
-+ bool "Exempt initrd tasks from restrictions"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC_CHROOT && BLK_DEV_RAM
-+ help
-+ If you say Y here, tasks started prior to init will be exempted from
-+ grsecurity's chroot restrictions. This option is mainly meant to
-+ resolve Plymouth's performing privileged operations unnecessarily
-+ in a chroot.
-+
-+endmenu
-+menu "Kernel Auditing"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_AUDIT_GROUP
-+ bool "Single group for auditing"
-+ help
-+ If you say Y here, the exec and chdir logging features will only operate
-+ on a group you specify. This option is recommended if you only want to
-+ watch certain users instead of having a large amount of logs from the
-+ entire system. If the sysctl option is enabled, a sysctl option with
-+ name "audit_group" is created.
-+
-+config GRKERNSEC_AUDIT_GID
-+ int "GID for auditing"
-+ depends on GRKERNSEC_AUDIT_GROUP
-+ default 1007
-+
-+config GRKERNSEC_EXECLOG
-+ bool "Exec logging"
-+ help
-+ If you say Y here, all execve() calls will be logged (since the
-+ other exec*() calls are frontends to execve(), all execution
-+ will be logged). Useful for shell-servers that like to keep track
-+ of their users. If the sysctl option is enabled, a sysctl option with
-+ name "exec_logging" is created.
-+ WARNING: This option when enabled will produce a LOT of logs, especially
-+ on an active system.
-+
-+config GRKERNSEC_RESLOG
-+ bool "Resource logging"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ If you say Y here, all attempts to overstep resource limits will
-+ be logged with the resource name, the requested size, and the current
-+ limit. It is highly recommended that you say Y here. If the sysctl
-+ option is enabled, a sysctl option with name "resource_logging" is
-+ created. If the RBAC system is enabled, the sysctl value is ignored.
-+
-+config GRKERNSEC_CHROOT_EXECLOG
-+ bool "Log execs within chroot"
-+ help
-+ If you say Y here, all executions inside a chroot jail will be logged
-+ to syslog. This can cause a large amount of logs if certain
-+ applications (eg. djb's daemontools) are installed on the system, and
-+ is therefore left as an option. If the sysctl option is enabled, a
-+ sysctl option with name "chroot_execlog" is created.
-+
-+config GRKERNSEC_AUDIT_PTRACE
-+ bool "Ptrace logging"
-+ help
-+ If you say Y here, all attempts to attach to a process via ptrace
-+ will be logged. If the sysctl option is enabled, a sysctl option
-+ with name "audit_ptrace" is created.
-+
-+config GRKERNSEC_AUDIT_CHDIR
-+ bool "Chdir logging"
-+ help
-+ If you say Y here, all chdir() calls will be logged. If the sysctl
-+ option is enabled, a sysctl option with name "audit_chdir" is created.
-+
-+config GRKERNSEC_AUDIT_MOUNT
-+ bool "(Un)Mount logging"
-+ help
-+ If you say Y here, all mounts and unmounts will be logged. If the
-+ sysctl option is enabled, a sysctl option with name "audit_mount" is
-+ created.
-+
-+config GRKERNSEC_SIGNAL
-+ bool "Signal logging"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ If you say Y here, certain important signals will be logged, such as
-+ SIGSEGV, which will as a result inform you of when a error in a program
-+ occurred, which in some cases could mean a possible exploit attempt.
-+ If the sysctl option is enabled, a sysctl option with name
-+ "signal_logging" is created.
-+
-+config GRKERNSEC_FORKFAIL
-+ bool "Fork failure logging"
-+ help
-+ If you say Y here, all failed fork() attempts will be logged.
-+ This could suggest a fork bomb, or someone attempting to overstep
-+ their process limit. If the sysctl option is enabled, a sysctl option
-+ with name "forkfail_logging" is created.
-+
-+config GRKERNSEC_TIME
-+ bool "Time change logging"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ If you say Y here, any changes of the system clock will be logged.
-+ If the sysctl option is enabled, a sysctl option with name
-+ "timechange_logging" is created.
-+
-+config GRKERNSEC_PROC_IPADDR
-+ bool "/proc/<pid>/ipaddr support"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ If you say Y here, a new entry will be added to each /proc/<pid>
-+ directory that contains the IP address of the person using the task.
-+ The IP is carried across local TCP and AF_UNIX stream sockets.
-+ This information can be useful for IDS/IPSes to perform remote response
-+ to a local attack. The entry is readable by only the owner of the
-+ process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
-+ the RBAC system), and thus does not create privacy concerns.
-+
-+config GRKERNSEC_RWXMAP_LOG
-+ bool 'Denied RWX mmap/mprotect logging'
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on PAX_MPROTECT && !PAX_EMUPLT && !PAX_EMUSIGRT
-+ help
-+ If you say Y here, calls to mmap() and mprotect() with explicit
-+ usage of PROT_WRITE and PROT_EXEC together will be logged when
-+ denied by the PAX_MPROTECT feature. If the sysctl option is
-+ enabled, a sysctl option with name "rwxmap_logging" is created.
-+
-+config GRKERNSEC_AUDIT_TEXTREL
-+ bool 'ELF text relocations logging (READ HELP)'
-+ depends on PAX_MPROTECT
-+ help
-+ If you say Y here, text relocations will be logged with the filename
-+ of the offending library or binary. The purpose of the feature is
-+ to help Linux distribution developers get rid of libraries and
-+ binaries that need text relocations which hinder the future progress
-+ of PaX. Only Linux distribution developers should say Y here, and
-+ never on a production machine, as this option creates an information
-+ leak that could aid an attacker in defeating the randomization of
-+ a single memory region. If the sysctl option is enabled, a sysctl
-+ option with name "audit_textrel" is created.
-+
-+endmenu
-+
-+menu "Executable Protections"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_DMESG
-+ bool "Dmesg(8) restriction"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ If you say Y here, non-root users will not be able to use dmesg(8)
-+ to view the contents of the kernel's circular log buffer.
-+ The kernel's log buffer often contains kernel addresses and other
-+ identifying information useful to an attacker in fingerprinting a
-+ system for a targeted exploit.
-+ If the sysctl option is enabled, a sysctl option with name "dmesg" is
-+ created.
-+
-+config GRKERNSEC_HARDEN_PTRACE
-+ bool "Deter ptrace-based process snooping"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ If you say Y here, TTY sniffers and other malicious monitoring
-+ programs implemented through ptrace will be defeated. If you
-+ have been using the RBAC system, this option has already been
-+ enabled for several years for all users, with the ability to make
-+ fine-grained exceptions.
-+
-+ This option only affects the ability of non-root users to ptrace
-+ processes that are not a descendent of the ptracing process.
-+ This means that strace ./binary and gdb ./binary will still work,
-+ but attaching to arbitrary processes will not. If the sysctl
-+ option is enabled, a sysctl option with name "harden_ptrace" is
-+ created.
-+
-+config GRKERNSEC_PTRACE_READEXEC
-+ bool "Require read access to ptrace sensitive binaries"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ If you say Y here, unprivileged users will not be able to ptrace unreadable
-+ binaries. This option is useful in environments that
-+ remove the read bits (e.g. file mode 4711) from suid binaries to
-+ prevent infoleaking of their contents. This option adds
-+ consistency to the use of that file mode, as the binary could normally
-+ be read out when run without privileges while ptracing.
-+
-+ If the sysctl option is enabled, a sysctl option with name "ptrace_readexec"
-+ is created.
-+
-+config GRKERNSEC_SETXID
-+ bool "Enforce consistent multithreaded privileges"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on (X86 || SPARC64 || PPC || ARM || MIPS)
-+ help
-+ If you say Y here, a change from a root uid to a non-root uid
-+ in a multithreaded application will cause the resulting uids,
-+ gids, supplementary groups, and capabilities in that thread
-+ to be propagated to the other threads of the process. In most
-+ cases this is unnecessary, as glibc will emulate this behavior
-+ on behalf of the application. Other libcs do not act in the
-+ same way, allowing the other threads of the process to continue
-+ running with root privileges. If the sysctl option is enabled,
-+ a sysctl option with name "consistent_setxid" is created.
-+
-+config GRKERNSEC_TPE
-+ bool "Trusted Path Execution (TPE)"
-+ default y if GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_SERVER
-+ help
-+ If you say Y here, you will be able to choose a gid to add to the
-+ supplementary groups of users you want to mark as "untrusted."
-+ These users will not be able to execute any files that are not in
-+ root-owned directories writable only by root. If the sysctl option
-+ is enabled, a sysctl option with name "tpe" is created.
-+
-+config GRKERNSEC_TPE_ALL
-+ bool "Partially restrict all non-root users"
-+ depends on GRKERNSEC_TPE
-+ help
-+ If you say Y here, all non-root users will be covered under
-+ a weaker TPE restriction. This is separate from, and in addition to,
-+ the main TPE options that you have selected elsewhere. Thus, if a
-+ "trusted" GID is chosen, this restriction applies to even that GID.
-+ Under this restriction, all non-root users will only be allowed to
-+ execute files in directories they own that are not group or
-+ world-writable, or in directories owned by root and writable only by
-+ root. If the sysctl option is enabled, a sysctl option with name
-+ "tpe_restrict_all" is created.
-+
-+config GRKERNSEC_TPE_INVERT
-+ bool "Invert GID option"
-+ depends on GRKERNSEC_TPE
-+ help
-+ If you say Y here, the group you specify in the TPE configuration will
-+ decide what group TPE restrictions will be *disabled* for. This
-+ option is useful if you want TPE restrictions to be applied to most
-+ users on the system. If the sysctl option is enabled, a sysctl option
-+ with name "tpe_invert" is created. Unlike other sysctl options, this
-+ entry will default to on for backward-compatibility.
-+
-+config GRKERNSEC_TPE_GID
-+ int
-+ default GRKERNSEC_TPE_UNTRUSTED_GID if (GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT)
-+ default GRKERNSEC_TPE_TRUSTED_GID if (GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT)
-+
-+config GRKERNSEC_TPE_UNTRUSTED_GID
-+ int "GID for TPE-untrusted users"
-+ depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
-+ default 1005
-+ help
-+ Setting this GID determines what group TPE restrictions will be
-+ *enabled* for. If the sysctl option is enabled, a sysctl option
-+ with name "tpe_gid" is created.
-+
-+config GRKERNSEC_TPE_TRUSTED_GID
-+ int "GID for TPE-trusted users"
-+ depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
-+ default 1005
-+ help
-+ Setting this GID determines what group TPE restrictions will be
-+ *disabled* for. If the sysctl option is enabled, a sysctl option
-+ with name "tpe_gid" is created.
-+
-+endmenu
-+menu "Network Protections"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_RANDNET
-+ bool "Larger entropy pools"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ If you say Y here, the entropy pools used for many features of Linux
-+ and grsecurity will be doubled in size. Since several grsecurity
-+ features use additional randomness, it is recommended that you say Y
-+ here. Saying Y here has a similar effect as modifying
-+ /proc/sys/kernel/random/poolsize.
-+
-+config GRKERNSEC_BLACKHOLE
-+ bool "TCP/UDP blackhole and LAST_ACK DoS prevention"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on NET
-+ help
-+ If you say Y here, neither TCP resets nor ICMP
-+ destination-unreachable packets will be sent in response to packets
-+ sent to ports for which no associated listening process exists.
-+ This feature supports both IPV4 and IPV6 and exempts the
-+ loopback interface from blackholing. Enabling this feature
-+ makes a host more resilient to DoS attacks and reduces network
-+ visibility against scanners.
-+
-+ The blackhole feature as-implemented is equivalent to the FreeBSD
-+ blackhole feature, as it prevents RST responses to all packets, not
-+ just SYNs. Under most application behavior this causes no
-+ problems, but applications (like haproxy) may not close certain
-+ connections in a way that cleanly terminates them on the remote
-+ end, leaving the remote host in LAST_ACK state. Because of this
-+ side-effect and to prevent intentional LAST_ACK DoSes, this
-+ feature also adds automatic mitigation against such attacks.
-+ The mitigation drastically reduces the amount of time a socket
-+ can spend in LAST_ACK state. If you're using haproxy and not
-+ all servers it connects to have this option enabled, consider
-+ disabling this feature on the haproxy host.
-+
-+ If the sysctl option is enabled, two sysctl options with names
-+ "ip_blackhole" and "lastack_retries" will be created.
-+ While "ip_blackhole" takes the standard zero/non-zero on/off
-+ toggle, "lastack_retries" uses the same kinds of values as
-+ "tcp_retries1" and "tcp_retries2". The default value of 4
-+ prevents a socket from lasting more than 45 seconds in LAST_ACK
-+ state.
-+
-+config GRKERNSEC_NO_SIMULT_CONNECT
-+ bool "Disable TCP Simultaneous Connect"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on NET
-+ help
-+ If you say Y here, a feature by Willy Tarreau will be enabled that
-+ removes a weakness in Linux's strict implementation of TCP that
-+ allows two clients to connect to each other without either entering
-+ a listening state. The weakness allows an attacker to easily prevent
-+ a client from connecting to a known server provided the source port
-+ for the connection is guessed correctly.
-+
-+ As the weakness could be used to prevent an antivirus or IPS from
-+ fetching updates, or prevent an SSL gateway from fetching a CRL,
-+ it should be eliminated by enabling this option. Though Linux is
-+ one of few operating systems supporting simultaneous connect, it
-+ has no legitimate use in practice and is rarely supported by firewalls.
-+
-+config GRKERNSEC_SOCKET
-+ bool "Socket restrictions"
-+ depends on NET
-+ help
-+ If you say Y here, you will be able to choose from several options.
-+ If you assign a GID on your system and add it to the supplementary
-+ groups of users you want to restrict socket access to, this patch
-+ will perform up to three things, based on the option(s) you choose.
-+
-+config GRKERNSEC_SOCKET_ALL
-+ bool "Deny any sockets to group"
-+ depends on GRKERNSEC_SOCKET
-+ help
-+ If you say Y here, you will be able to choose a GID of whose users will
-+ be unable to connect to other hosts from your machine or run server
-+ applications from your machine. If the sysctl option is enabled, a
-+ sysctl option with name "socket_all" is created.
-+
-+config GRKERNSEC_SOCKET_ALL_GID
-+ int "GID to deny all sockets for"
-+ depends on GRKERNSEC_SOCKET_ALL
-+ default 1004
-+ help
-+ Here you can choose the GID to disable socket access for. Remember to
-+ add the users you want socket access disabled for to the GID
-+ specified here. If the sysctl option is enabled, a sysctl option
-+ with name "socket_all_gid" is created.
-+
-+config GRKERNSEC_SOCKET_CLIENT
-+ bool "Deny client sockets to group"
-+ depends on GRKERNSEC_SOCKET
-+ help
-+ If you say Y here, you will be able to choose a GID of whose users will
-+ be unable to connect to other hosts from your machine, but will be
-+ able to run servers. If this option is enabled, all users in the group
-+ you specify will have to use passive mode when initiating ftp transfers
-+ from the shell on your machine. If the sysctl option is enabled, a
-+ sysctl option with name "socket_client" is created.
-+
-+config GRKERNSEC_SOCKET_CLIENT_GID
-+ int "GID to deny client sockets for"
-+ depends on GRKERNSEC_SOCKET_CLIENT
-+ default 1003
-+ help
-+ Here you can choose the GID to disable client socket access for.
-+ Remember to add the users you want client socket access disabled for to
-+ the GID specified here. If the sysctl option is enabled, a sysctl
-+ option with name "socket_client_gid" is created.
-+
-+config GRKERNSEC_SOCKET_SERVER
-+ bool "Deny server sockets to group"
-+ depends on GRKERNSEC_SOCKET
-+ help
-+ If you say Y here, you will be able to choose a GID of whose users will
-+ be unable to run server applications from your machine. If the sysctl
-+ option is enabled, a sysctl option with name "socket_server" is created.
-+
-+config GRKERNSEC_SOCKET_SERVER_GID
-+ int "GID to deny server sockets for"
-+ depends on GRKERNSEC_SOCKET_SERVER
-+ default 1002
-+ help
-+ Here you can choose the GID to disable server socket access for.
-+ Remember to add the users you want server socket access disabled for to
-+ the GID specified here. If the sysctl option is enabled, a sysctl
-+ option with name "socket_server_gid" is created.
-+
-+endmenu
-+
-+menu "Physical Protections"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_DENYUSB
-+ bool "Deny new USB connections after toggle"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ If you say Y here, a new sysctl option with name "deny_new_usb"
-+ will be created. Setting its value to 1 will prevent any new
-+ USB devices from being recognized by the OS. Any attempted USB
-+ device insertion will be logged. This option is intended to be
-+ used against custom USB devices designed to exploit vulnerabilities
-+ in various USB device drivers.
-+
-+ For greatest effectiveness, this sysctl should be set after any
-+ relevant init scripts. This option is safe to enable in distros
-+ as each user can choose whether or not to toggle the sysctl.
-+
-+config GRKERNSEC_DENYUSB_FORCE
-+ bool "Reject all USB devices not connected at boot"
-+ select USB
-+ depends on SYSCTL && GRKERNSEC_DENYUSB
-+ help
-+ If you say Y here, a variant of GRKERNSEC_DENYUSB will be enabled
-+ that doesn't involve a sysctl entry. This option should only be
-+ enabled if you're sure you want to deny all new USB connections
-+ at runtime and don't want to modify init scripts. This should not
-+ be enabled by distros. It forces the core USB code to be built
-+ into the kernel image so that all devices connected at boot time
-+ can be recognized and new USB device connections can be prevented
-+ prior to init running.
-+
-+endmenu
-+
-+menu "Sysctl Support"
-+depends on GRKERNSEC && SYSCTL
-+
-+config GRKERNSEC_SYSCTL
-+ bool "Sysctl support"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ If you say Y here, you will be able to change the options that
-+ grsecurity runs with at bootup, without having to recompile your
-+ kernel. You can echo values to files in /proc/sys/kernel/grsecurity
-+ to enable (1) or disable (0) various features. All the sysctl entries
-+ are mutable until the "grsec_lock" entry is set to a non-zero value.
-+ All features enabled in the kernel configuration are disabled at boot
-+ if you do not say Y to the "Turn on features by default" option.
-+ All options should be set at startup, and the grsec_lock entry should
-+ be set to a non-zero value after all the options are set.
-+ *THIS IS EXTREMELY IMPORTANT*
-+
-+config GRKERNSEC_SYSCTL_DISTRO
-+ bool "Extra sysctl support for distro makers (READ HELP)"
-+ depends on GRKERNSEC_SYSCTL && GRKERNSEC_IO
-+ help
-+ If you say Y here, additional sysctl options will be created
-+ for features that affect processes running as root. Therefore,
-+ it is critical when using this option that the grsec_lock entry be
-+ enabled after boot. Only distros with prebuilt kernel packages
-+ with this option enabled that can ensure grsec_lock is enabled
-+ after boot should use this option.
-+ *Failure to set grsec_lock after boot makes all grsec features
-+ this option covers useless*
-+
-+ Currently this option creates the following sysctl entries:
-+ "Disable Privileged I/O": "disable_priv_io"
-+
-+config GRKERNSEC_SYSCTL_ON
-+ bool "Turn on features by default"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC_SYSCTL
-+ help
-+ If you say Y here, instead of having all features enabled in the
-+ kernel configuration disabled at boot time, the features will be
-+ enabled at boot time. It is recommended you say Y here unless
-+ there is some reason you would want all sysctl-tunable features to
-+ be disabled by default. As mentioned elsewhere, it is important
-+ to enable the grsec_lock entry once you have finished modifying
-+ the sysctl entries.
-+
-+endmenu
-+menu "Logging Options"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_FLOODTIME
-+ int "Seconds in between log messages (minimum)"
-+ default 10
-+ help
-+ This option allows you to enforce the number of seconds between
-+ grsecurity log messages. The default should be suitable for most
-+ people, however, if you choose to change it, choose a value small enough
-+ to allow informative logs to be produced, but large enough to
-+ prevent flooding.
-+
-+config GRKERNSEC_FLOODBURST
-+ int "Number of messages in a burst (maximum)"
-+ default 6
-+ help
-+ This option allows you to choose the maximum number of messages allowed
-+ within the flood time interval you chose in a separate option. The
-+ default should be suitable for most people, however if you find that
-+ many of your logs are being interpreted as flooding, you may want to
-+ raise this value.
-+
-+endmenu
-diff --git a/grsecurity/Makefile b/grsecurity/Makefile
-new file mode 100644
-index 0000000..b0b77d5
---- /dev/null
-+++ b/grsecurity/Makefile
-@@ -0,0 +1,43 @@
-+# grsecurity's ACL system was originally written in 2001 by Michael Dalton
-+# during 2001-2009 it has been completely redesigned by Brad Spengler
-+# into an RBAC system
-+#
-+# All code in this directory and various hooks inserted throughout the kernel
-+# are copyright Brad Spengler - Open Source Security, Inc., and released
-+# under the GPL v2 or higher
-+
-+KBUILD_CFLAGS += -Werror
-+
-+obj-y = grsec_chdir.o grsec_chroot.o grsec_exec.o grsec_fifo.o grsec_fork.o \
-+ grsec_mount.o grsec_sig.o grsec_sysctl.o \
-+ grsec_time.o grsec_tpe.o grsec_link.o grsec_pax.o grsec_ptrace.o \
-+ grsec_usb.o
-+
-+obj-$(CONFIG_GRKERNSEC) += grsec_init.o grsum.o gracl.o gracl_segv.o \
-+ gracl_cap.o gracl_alloc.o gracl_shm.o grsec_mem.o gracl_fs.o \
-+ gracl_learn.o grsec_log.o
-+ifdef CONFIG_COMPAT
-+obj-$(CONFIG_GRKERNSEC) += gracl_compat.o
-+endif
-+
-+obj-$(CONFIG_GRKERNSEC_RESLOG) += gracl_res.o
-+
-+ifdef CONFIG_NET
-+obj-y += grsec_sock.o
-+obj-$(CONFIG_GRKERNSEC) += gracl_ip.o
-+endif
-+
-+ifndef CONFIG_GRKERNSEC
-+obj-y += grsec_disabled.o
-+endif
-+
-+ifdef CONFIG_GRKERNSEC_HIDESYM
-+extra-y := grsec_hidesym.o
-+$(obj)/grsec_hidesym.o:
-+ @-chmod -f 500 /boot
-+ @-chmod -f 500 /lib/modules
-+ @-chmod -f 500 /lib64/modules
-+ @-chmod -f 500 /lib32/modules
-+ @-chmod -f 700 .
-+ @echo ' grsec: protected kernel image paths'
-+endif
-diff --git a/grsecurity/gracl.c b/grsecurity/gracl.c
-new file mode 100644
-index 0000000..a24562a
---- /dev/null
-+++ b/grsecurity/gracl.c
-@@ -0,0 +1,4309 @@
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/sched.h>
-+#include <linux/mm.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/namei.h>
-+#include <linux/mount.h>
-+#include <linux/tty.h>
-+#include <linux/proc_fs.h>
-+#include <linux/smp_lock.h>
-+#include <linux/slab.h>
-+#include <linux/vmalloc.h>
-+#include <linux/types.h>
-+#include <linux/sysctl.h>
-+#include <linux/netdevice.h>
-+#include <linux/ptrace.h>
-+#include <linux/gracl.h>
-+#include <linux/gralloc.h>
-+#include <linux/security.h>
-+#include <linux/grinternal.h>
-+#include <linux/pid_namespace.h>
-+#include <linux/stop_machine.h>
-+#include <linux/fdtable.h>
-+#include <linux/percpu.h>
-+#include <linux/posix-timers.h>
-+#if defined(CONFIG_BTRFS_FS) || defined(CONFIG_BTRFS_FS_MODULE)
-+#include <linux/magic.h>
-+#include <linux/pagemap.h>
-+#include "../fs/btrfs/async-thread.h"
-+#include "../fs/btrfs/ctree.h"
-+#include "../fs/btrfs/btrfs_inode.h"
-+#endif
-+#include <linux/compat.h>
-+
-+#include <asm/uaccess.h>
-+#include <asm/errno.h>
-+#include <asm/mman.h>
-+
-+static struct acl_role_db acl_role_set;
-+static struct name_db name_set;
-+static struct inodev_db inodev_set;
-+
-+/* for keeping track of userspace pointers used for subjects, so we
-+ can share references in the kernel as well
-+*/
-+
-+static struct dentry *real_root;
-+static struct vfsmount *real_root_mnt;
-+
-+static struct acl_subj_map_db subj_map_set;
-+
-+static struct acl_role_label *default_role;
-+
-+static struct acl_role_label *role_list;
-+
-+static u16 acl_sp_role_value;
-+
-+extern char *gr_shared_page[4];
-+static DEFINE_MUTEX(gr_dev_mutex);
-+DEFINE_RWLOCK(gr_inode_lock);
-+
-+struct gr_arg *gr_usermode;
-+
-+static unsigned int gr_status __read_only = GR_STATUS_INIT;
-+
-+extern int chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum);
-+extern void gr_clear_learn_entries(void);
-+
-+#ifdef CONFIG_GRKERNSEC_RESLOG
-+extern void gr_log_resource(const struct task_struct *task,
-+ const int res, const unsigned long wanted, const int gt);
-+#endif
-+
-+unsigned char *gr_system_salt;
-+unsigned char *gr_system_sum;
-+
-+static struct sprole_pw **acl_special_roles = NULL;
-+static __u16 num_sprole_pws = 0;
-+
-+static struct acl_role_label *kernel_role = NULL;
-+
-+static unsigned int gr_auth_attempts = 0;
-+static unsigned long gr_auth_expires = 0UL;
-+
-+#ifdef CONFIG_NET
-+extern struct vfsmount *sock_mnt;
-+#endif
-+extern struct vfsmount *pipe_mnt;
-+extern struct vfsmount *shm_mnt;
-+#ifdef CONFIG_HUGETLBFS
-+extern struct vfsmount *hugetlbfs_vfsmount;
-+#endif
-+
-+static struct acl_object_label *fakefs_obj_rw;
-+static struct acl_object_label *fakefs_obj_rwx;
-+
-+extern int gr_init_uidset(void);
-+extern void gr_free_uidset(void);
-+extern void gr_remove_uid(uid_t uid);
-+extern int gr_find_uid(uid_t uid);
-+
-+static int copy_acl_object_label_normal(struct acl_object_label *obj, const struct acl_object_label *userp)
-+{
-+ if (copy_from_user(obj, userp, sizeof(struct acl_object_label)))
-+ return -EFAULT;
-+
-+ return 0;
-+}
-+
-+static int copy_acl_ip_label_normal(struct acl_ip_label *ip, const struct acl_ip_label *userp)
-+{
-+ if (copy_from_user(ip, userp, sizeof(struct acl_ip_label)))
-+ return -EFAULT;
-+
-+ return 0;
-+}
-+
-+static int copy_acl_subject_label_normal(struct acl_subject_label *subj, const struct acl_subject_label *userp)
-+{
-+ if (copy_from_user(subj, userp, sizeof(struct acl_subject_label)))
-+ return -EFAULT;
-+
-+ return 0;
-+}
-+
-+static int copy_acl_role_label_normal(struct acl_role_label *role, const struct acl_role_label *userp)
-+{
-+ if (copy_from_user(role, userp, sizeof(struct acl_role_label)))
-+ return -EFAULT;
-+
-+ return 0;
-+}
-+
-+static int copy_role_allowed_ip_normal(struct role_allowed_ip *roleip, const struct role_allowed_ip *userp)
-+{
-+ if (copy_from_user(roleip, userp, sizeof(struct role_allowed_ip)))
-+ return -EFAULT;
-+
-+ return 0;
-+}
-+
-+static int copy_sprole_pw_normal(struct sprole_pw *pw, unsigned long idx, const struct sprole_pw *userp)
-+{
-+ if (copy_from_user(pw, userp + idx, sizeof(struct sprole_pw)))
-+ return -EFAULT;
-+
-+ return 0;
-+}
-+
-+static int copy_gr_hash_struct_normal(struct gr_hash_struct *hash, const struct gr_hash_struct *userp)
-+{
-+ if (copy_from_user(hash, userp, sizeof(struct gr_hash_struct)))
-+ return -EFAULT;
-+
-+ return 0;
-+}
-+
-+static int copy_role_transition_normal(struct role_transition *trans, const struct role_transition *userp)
-+{
-+ if (copy_from_user(trans, userp, sizeof(struct role_transition)))
-+ return -EFAULT;
-+
-+ return 0;
-+}
-+
-+int copy_pointer_from_array_normal(void *ptr, unsigned long idx, const void *userp)
-+{
-+ if (copy_from_user(ptr, userp + (idx * sizeof(void *)), sizeof(void *)))
-+ return -EFAULT;
-+
-+ return 0;
-+}
-+
-+static int copy_gr_arg_wrapper_normal(const char __user *buf, struct gr_arg_wrapper *uwrap)
-+{
-+ if (copy_from_user(uwrap, buf, sizeof (struct gr_arg_wrapper)))
-+ return -EFAULT;
-+
-+ if ((uwrap->version != GRSECURITY_VERSION) || (uwrap->size != sizeof(struct gr_arg)))
-+ return -EINVAL;
-+
-+ return 0;
-+}
-+
-+static int copy_gr_arg_normal(const struct gr_arg __user *buf, struct gr_arg *arg)
-+{
-+ if (copy_from_user(arg, buf, sizeof (struct gr_arg)))
-+ return -EFAULT;
-+
-+ return 0;
-+}
-+
-+static size_t get_gr_arg_wrapper_size_normal(void)
-+{
-+ return sizeof(struct gr_arg_wrapper);
-+}
-+
-+#ifdef CONFIG_COMPAT
-+extern int copy_gr_arg_wrapper_compat(const char *buf, struct gr_arg_wrapper *uwrap);
-+extern int copy_gr_arg_compat(const struct gr_arg __user *buf, struct gr_arg *arg);
-+extern int copy_acl_object_label_compat(struct acl_object_label *obj, const struct acl_object_label *userp);
-+extern int copy_acl_subject_label_compat(struct acl_subject_label *subj, const struct acl_subject_label *userp);
-+extern int copy_acl_role_label_compat(struct acl_role_label *role, const struct acl_role_label *userp);
-+extern int copy_role_allowed_ip_compat(struct role_allowed_ip *roleip, const struct role_allowed_ip *userp);
-+extern int copy_role_transition_compat(struct role_transition *trans, const struct role_transition *userp);
-+extern int copy_gr_hash_struct_compat(struct gr_hash_struct *hash, const struct gr_hash_struct *userp);
-+extern int copy_pointer_from_array_compat(void *ptr, unsigned long idx, const void *userp);
-+extern int copy_acl_ip_label_compat(struct acl_ip_label *ip, const struct acl_ip_label *userp);
-+extern int copy_sprole_pw_compat(struct sprole_pw *pw, unsigned long idx, const struct sprole_pw *userp);
-+extern size_t get_gr_arg_wrapper_size_compat(void);
-+
-+int (* copy_gr_arg_wrapper)(const char *buf, struct gr_arg_wrapper *uwrap) __read_only;
-+int (* copy_gr_arg)(const struct gr_arg *buf, struct gr_arg *arg) __read_only;
-+int (* copy_acl_object_label)(struct acl_object_label *obj, const struct acl_object_label *userp) __read_only;
-+int (* copy_acl_subject_label)(struct acl_subject_label *subj, const struct acl_subject_label *userp) __read_only;
-+int (* copy_acl_role_label)(struct acl_role_label *role, const struct acl_role_label *userp) __read_only;
-+int (* copy_acl_ip_label)(struct acl_ip_label *ip, const struct acl_ip_label *userp) __read_only;
-+int (* copy_pointer_from_array)(void *ptr, unsigned long idx, const void *userp) __read_only;
-+int (* copy_sprole_pw)(struct sprole_pw *pw, unsigned long idx, const struct sprole_pw *userp) __read_only;
-+int (* copy_gr_hash_struct)(struct gr_hash_struct *hash, const struct gr_hash_struct *userp) __read_only;
-+int (* copy_role_transition)(struct role_transition *trans, const struct role_transition *userp) __read_only;
-+int (* copy_role_allowed_ip)(struct role_allowed_ip *roleip, const struct role_allowed_ip *userp) __read_only;
-+size_t (* get_gr_arg_wrapper_size)(void) __read_only;
-+
-+#else
-+#define copy_gr_arg_wrapper copy_gr_arg_wrapper_normal
-+#define copy_gr_arg copy_gr_arg_normal
-+#define copy_gr_hash_struct copy_gr_hash_struct_normal
-+#define copy_acl_object_label copy_acl_object_label_normal
-+#define copy_acl_subject_label copy_acl_subject_label_normal
-+#define copy_acl_role_label copy_acl_role_label_normal
-+#define copy_acl_ip_label copy_acl_ip_label_normal
-+#define copy_pointer_from_array copy_pointer_from_array_normal
-+#define copy_sprole_pw copy_sprole_pw_normal
-+#define copy_role_transition copy_role_transition_normal
-+#define copy_role_allowed_ip copy_role_allowed_ip_normal
-+#define get_gr_arg_wrapper_size get_gr_arg_wrapper_size_normal
-+#endif
-+
-+__inline__ int
-+gr_acl_is_enabled(void)
-+{
-+ return (gr_status & GR_READY);
-+}
-+
-+static inline dev_t __get_dev(const struct dentry *dentry)
-+{
-+#if defined(CONFIG_BTRFS_FS) || defined(CONFIG_BTRFS_FS_MODULE)
-+ if (dentry->d_sb->s_magic == BTRFS_SUPER_MAGIC)
-+ return BTRFS_I(dentry->d_inode)->root->anon_super.s_dev;
-+ else
-+#endif
-+ return dentry->d_sb->s_dev;
-+}
-+
-+dev_t gr_get_dev_from_dentry(struct dentry *dentry)
-+{
-+ return __get_dev(dentry);
-+}
-+
-+static char gr_task_roletype_to_char(struct task_struct *task)
-+{
-+ switch (task->role->roletype &
-+ (GR_ROLE_DEFAULT | GR_ROLE_USER | GR_ROLE_GROUP |
-+ GR_ROLE_SPECIAL)) {
-+ case GR_ROLE_DEFAULT:
-+ return 'D';
-+ case GR_ROLE_USER:
-+ return 'U';
-+ case GR_ROLE_GROUP:
-+ return 'G';
-+ case GR_ROLE_SPECIAL:
-+ return 'S';
-+ }
-+
-+ return 'X';
-+}
-+
-+char gr_roletype_to_char(void)
-+{
-+ return gr_task_roletype_to_char(current);
-+}
-+
-+__inline__ int
-+gr_acl_tpe_check(void)
-+{
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return 0;
-+ if (current->role->roletype & GR_ROLE_TPE)
-+ return 1;
-+ else
-+ return 0;
-+}
-+
-+int
-+gr_handle_rawio(const struct inode *inode)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
-+ if (inode && (S_ISBLK(inode->i_mode) || (S_ISCHR(inode->i_mode) && imajor(inode) == RAW_MAJOR)) &&
-+ grsec_enable_chroot_caps && proc_is_chrooted(current) &&
-+ !capable(CAP_SYS_RAWIO))
-+ return 1;
-+#endif
-+ return 0;
-+}
-+
-+static int
-+gr_streq(const char *a, const char *b, const unsigned int lena, const unsigned int lenb)
-+{
-+ if (likely(lena != lenb))
-+ return 0;
-+
-+ return !memcmp(a, b, lena);
-+}
-+
-+static int prepend(char **buffer, int *buflen, const char *str, int namelen)
-+{
-+ *buflen -= namelen;
-+ if (*buflen < 0)
-+ return -ENAMETOOLONG;
-+ *buffer -= namelen;
-+ memcpy(*buffer, str, namelen);
-+ return 0;
-+}
-+
-+/* this must be called with vfsmount_lock and dcache_lock held */
-+
-+static char * __our_d_path(struct dentry *dentry, struct vfsmount *vfsmnt,
-+ struct dentry *root, struct vfsmount *rootmnt,
-+ char *buffer, int buflen)
-+{
-+ char * end = buffer+buflen;
-+ char * retval;
-+ int namelen;
-+
-+ *--end = '\0';
-+ buflen--;
-+
-+ if (buflen < 1)
-+ goto Elong;
-+ /* Get '/' right */
-+ retval = end-1;
-+ *retval = '/';
-+
-+ for (;;) {
-+ struct dentry * parent;
-+
-+ if (dentry == root && vfsmnt == rootmnt)
-+ break;
-+ if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
-+ /* Global root? */
-+ if (vfsmnt->mnt_parent == vfsmnt)
-+ goto global_root;
-+ dentry = vfsmnt->mnt_mountpoint;
-+ vfsmnt = vfsmnt->mnt_parent;
-+ continue;
-+ }
-+ parent = dentry->d_parent;
-+ prefetch(parent);
-+ namelen = dentry->d_name.len;
-+ buflen -= namelen + 1;
-+ if (buflen < 0)
-+ goto Elong;
-+ end -= namelen;
-+ memcpy(end, dentry->d_name.name, namelen);
-+ *--end = '/';
-+ retval = end;
-+ dentry = parent;
-+ }
-+
-+out:
-+ return retval;
-+
-+global_root:
-+ namelen = dentry->d_name.len;
-+ buflen -= namelen;
-+ if (buflen < 0)
-+ goto Elong;
-+ retval -= namelen-1; /* hit the slash */
-+ memcpy(retval, dentry->d_name.name, namelen);
-+ goto out;
-+Elong:
-+ retval = ERR_PTR(-ENAMETOOLONG);
-+ goto out;
-+}
-+
-+static char *
-+gen_full_path(struct dentry *dentry, struct vfsmount *vfsmnt,
-+ struct dentry *root, struct vfsmount *rootmnt, char *buf, int buflen)
-+{
-+ char *retval;
-+
-+ retval = __our_d_path(dentry, vfsmnt, root, rootmnt, buf, buflen);
-+ if (unlikely(IS_ERR(retval)))
-+ retval = strcpy(buf, "<path too long>");
-+ else if (unlikely(retval[1] == '/' && retval[2] == '\0'))
-+ retval[1] = '\0';
-+
-+ return retval;
-+}
-+
-+static char *
-+__d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
-+ char *buf, int buflen)
-+{
-+ char *res;
-+
-+ /* we can use real_root, real_root_mnt, because this is only called
-+ by the RBAC system */
-+ res = gen_full_path((struct dentry *)dentry, (struct vfsmount *)vfsmnt, real_root, real_root_mnt, buf, buflen);
-+
-+ return res;
-+}
-+
-+static char *
-+d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
-+ char *buf, int buflen)
-+{
-+ char *res;
-+ struct dentry *root;
-+ struct vfsmount *rootmnt;
-+ struct task_struct *reaper = &init_task;
-+
-+ /* we can't use real_root, real_root_mnt, because they belong only to the RBAC system */
-+ read_lock(&reaper->fs->lock);
-+ root = dget(reaper->fs->root.dentry);
-+ rootmnt = mntget(reaper->fs->root.mnt);
-+ read_unlock(&reaper->fs->lock);
-+
-+ spin_lock(&dcache_lock);
-+ spin_lock(&vfsmount_lock);
-+ res = gen_full_path((struct dentry *)dentry, (struct vfsmount *)vfsmnt, root, rootmnt, buf, buflen);
-+ spin_unlock(&vfsmount_lock);
-+ spin_unlock(&dcache_lock);
-+
-+ dput(root);
-+ mntput(rootmnt);
-+ return res;
-+}
-+
-+static char *
-+gr_to_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ char *ret;
-+ spin_lock(&dcache_lock);
-+ spin_lock(&vfsmount_lock);
-+ ret = __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
-+ PAGE_SIZE);
-+ spin_unlock(&vfsmount_lock);
-+ spin_unlock(&dcache_lock);
-+ return ret;
-+}
-+
-+static char *
-+gr_to_proc_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ char *ret;
-+ char *buf;
-+ int buflen;
-+
-+ spin_lock(&dcache_lock);
-+ spin_lock(&vfsmount_lock);
-+ buf = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
-+ ret = __d_real_path(dentry, mnt, buf, PAGE_SIZE - 6);
-+ buflen = (int)(ret - buf);
-+ if (buflen >= 5)
-+ prepend(&ret, &buflen, "/proc", 5);
-+ else
-+ ret = strcpy(buf, "<path too long>");
-+ spin_unlock(&vfsmount_lock);
-+ spin_unlock(&dcache_lock);
-+ return ret;
-+}
-+
-+char *
-+gr_to_filename_nolock(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
-+ PAGE_SIZE);
-+}
-+
-+char *
-+gr_to_filename(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
-+ PAGE_SIZE);
-+}
-+
-+char *
-+gr_to_filename1(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[1], smp_processor_id()),
-+ PAGE_SIZE);
-+}
-+
-+char *
-+gr_to_filename2(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[2], smp_processor_id()),
-+ PAGE_SIZE);
-+}
-+
-+char *
-+gr_to_filename3(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[3], smp_processor_id()),
-+ PAGE_SIZE);
-+}
-+
-+__inline__ __u32
-+to_gr_audit(const __u32 reqmode)
-+{
-+ /* masks off auditable permission flags, then shifts them to create
-+ auditing flags, and adds the special case of append auditing if
-+ we're requesting write */
-+ return (((reqmode & ~GR_AUDITS) << 10) | ((reqmode & GR_WRITE) ? GR_AUDIT_APPEND : 0));
-+}
-+
-+struct acl_subject_label *
-+lookup_subject_map(const struct acl_subject_label *userp)
-+{
-+ unsigned int index = gr_shash(userp, subj_map_set.s_size);
-+ struct subject_map *match;
-+
-+ match = subj_map_set.s_hash[index];
-+
-+ while (match && match->user != userp)
-+ match = match->next;
-+
-+ if (match != NULL)
-+ return match->kernel;
-+ else
-+ return NULL;
-+}
-+
-+static void
-+insert_subj_map_entry(struct subject_map *subjmap)
-+{
-+ unsigned int index = gr_shash(subjmap->user, subj_map_set.s_size);
-+ struct subject_map **curr;
-+
-+ subjmap->prev = NULL;
-+
-+ curr = &subj_map_set.s_hash[index];
-+ if (*curr != NULL)
-+ (*curr)->prev = subjmap;
-+
-+ subjmap->next = *curr;
-+ *curr = subjmap;
-+
-+ return;
-+}
-+
-+static struct acl_role_label *
-+lookup_acl_role_label(const struct task_struct *task, const uid_t uid,
-+ const gid_t gid)
-+{
-+ unsigned int index = gr_rhash(uid, GR_ROLE_USER, acl_role_set.r_size);
-+ struct acl_role_label *match;
-+ struct role_allowed_ip *ipp;
-+ unsigned int x;
-+ u32 curr_ip = task->signal->curr_ip;
-+
-+ task->signal->saved_ip = curr_ip;
-+
-+ match = acl_role_set.r_hash[index];
-+
-+ while (match) {
-+ if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_USER)) == (GR_ROLE_DOMAIN | GR_ROLE_USER)) {
-+ for (x = 0; x < match->domain_child_num; x++) {
-+ if (match->domain_children[x] == uid)
-+ goto found;
-+ }
-+ } else if (match->uidgid == uid && match->roletype & GR_ROLE_USER)
-+ break;
-+ match = match->next;
-+ }
-+found:
-+ if (match == NULL) {
-+ try_group:
-+ index = gr_rhash(gid, GR_ROLE_GROUP, acl_role_set.r_size);
-+ match = acl_role_set.r_hash[index];
-+
-+ while (match) {
-+ if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) == (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) {
-+ for (x = 0; x < match->domain_child_num; x++) {
-+ if (match->domain_children[x] == gid)
-+ goto found2;
-+ }
-+ } else if (match->uidgid == gid && match->roletype & GR_ROLE_GROUP)
-+ break;
-+ match = match->next;
-+ }
-+found2:
-+ if (match == NULL)
-+ match = default_role;
-+ if (match->allowed_ips == NULL)
-+ return match;
-+ else {
-+ for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
-+ if (likely
-+ ((ntohl(curr_ip) & ipp->netmask) ==
-+ (ntohl(ipp->addr) & ipp->netmask)))
-+ return match;
-+ }
-+ match = default_role;
-+ }
-+ } else if (match->allowed_ips == NULL) {
-+ return match;
-+ } else {
-+ for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
-+ if (likely
-+ ((ntohl(curr_ip) & ipp->netmask) ==
-+ (ntohl(ipp->addr) & ipp->netmask)))
-+ return match;
-+ }
-+ goto try_group;
-+ }
-+
-+ return match;
-+}
-+
-+struct acl_subject_label *
-+lookup_acl_subj_label(const ino_t ino, const dev_t dev,
-+ const struct acl_role_label *role)
-+{
-+ unsigned int index = gr_fhash(ino, dev, role->subj_hash_size);
-+ struct acl_subject_label *match;
-+
-+ match = role->subj_hash[index];
-+
-+ while (match && (match->inode != ino || match->device != dev ||
-+ (match->mode & GR_DELETED))) {
-+ match = match->next;
-+ }
-+
-+ if (match && !(match->mode & GR_DELETED))
-+ return match;
-+ else
-+ return NULL;
-+}
-+
-+struct acl_subject_label *
-+lookup_acl_subj_label_deleted(const ino_t ino, const dev_t dev,
-+ const struct acl_role_label *role)
-+{
-+ unsigned int index = gr_fhash(ino, dev, role->subj_hash_size);
-+ struct acl_subject_label *match;
-+
-+ match = role->subj_hash[index];
-+
-+ while (match && (match->inode != ino || match->device != dev ||
-+ !(match->mode & GR_DELETED))) {
-+ match = match->next;
-+ }
-+
-+ if (match && (match->mode & GR_DELETED))
-+ return match;
-+ else
-+ return NULL;
-+}
-+
-+static struct acl_object_label *
-+lookup_acl_obj_label(const ino_t ino, const dev_t dev,
-+ const struct acl_subject_label *subj)
-+{
-+ unsigned int index = gr_fhash(ino, dev, subj->obj_hash_size);
-+ struct acl_object_label *match;
-+
-+ match = subj->obj_hash[index];
-+
-+ while (match && (match->inode != ino || match->device != dev ||
-+ (match->mode & GR_DELETED))) {
-+ match = match->next;
-+ }
-+
-+ if (match && !(match->mode & GR_DELETED))
-+ return match;
-+ else
-+ return NULL;
-+}
-+
-+static struct acl_object_label *
-+lookup_acl_obj_label_create(const ino_t ino, const dev_t dev,
-+ const struct acl_subject_label *subj)
-+{
-+ unsigned int index = gr_fhash(ino, dev, subj->obj_hash_size);
-+ struct acl_object_label *match;
-+
-+ match = subj->obj_hash[index];
-+
-+ while (match && (match->inode != ino || match->device != dev ||
-+ !(match->mode & GR_DELETED))) {
-+ match = match->next;
-+ }
-+
-+ if (match && (match->mode & GR_DELETED))
-+ return match;
-+
-+ match = subj->obj_hash[index];
-+
-+ while (match && (match->inode != ino || match->device != dev ||
-+ (match->mode & GR_DELETED))) {
-+ match = match->next;
-+ }
-+
-+ if (match && !(match->mode & GR_DELETED))
-+ return match;
-+ else
-+ return NULL;
-+}
-+
-+static struct name_entry *
-+lookup_name_entry(const char *name)
-+{
-+ unsigned int len = strlen(name);
-+ unsigned int key = full_name_hash(name, len);
-+ unsigned int index = key % name_set.n_size;
-+ struct name_entry *match;
-+
-+ match = name_set.n_hash[index];
-+
-+ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len)))
-+ match = match->next;
-+
-+ return match;
-+}
-+
-+static struct name_entry *
-+lookup_name_entry_create(const char *name)
-+{
-+ unsigned int len = strlen(name);
-+ unsigned int key = full_name_hash(name, len);
-+ unsigned int index = key % name_set.n_size;
-+ struct name_entry *match;
-+
-+ match = name_set.n_hash[index];
-+
-+ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
-+ !match->deleted))
-+ match = match->next;
-+
-+ if (match && match->deleted)
-+ return match;
-+
-+ match = name_set.n_hash[index];
-+
-+ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
-+ match->deleted))
-+ match = match->next;
-+
-+ if (match && !match->deleted)
-+ return match;
-+ else
-+ return NULL;
-+}
-+
-+static struct inodev_entry *
-+lookup_inodev_entry(const ino_t ino, const dev_t dev)
-+{
-+ unsigned int index = gr_fhash(ino, dev, inodev_set.i_size);
-+ struct inodev_entry *match;
-+
-+ match = inodev_set.i_hash[index];
-+
-+ while (match && (match->nentry->inode != ino || match->nentry->device != dev))
-+ match = match->next;
-+
-+ return match;
-+}
-+
-+static void
-+insert_inodev_entry(struct inodev_entry *entry)
-+{
-+ unsigned int index = gr_fhash(entry->nentry->inode, entry->nentry->device,
-+ inodev_set.i_size);
-+ struct inodev_entry **curr;
-+
-+ entry->prev = NULL;
-+
-+ curr = &inodev_set.i_hash[index];
-+ if (*curr != NULL)
-+ (*curr)->prev = entry;
-+
-+ entry->next = *curr;
-+ *curr = entry;
-+
-+ return;
-+}
-+
-+static void
-+__insert_acl_role_label(struct acl_role_label *role, uid_t uidgid)
-+{
-+ unsigned int index =
-+ gr_rhash(uidgid, role->roletype & (GR_ROLE_USER | GR_ROLE_GROUP), acl_role_set.r_size);
-+ struct acl_role_label **curr;
-+ struct acl_role_label *tmp, *tmp2;
-+
-+ curr = &acl_role_set.r_hash[index];
-+
-+ /* simple case, slot is empty, just set it to our role */
-+ if (*curr == NULL) {
-+ *curr = role;
-+ } else {
-+ /* example:
-+ 1 -> 2 -> 3 (adding 2 -> 3 to here)
-+ 2 -> 3
-+ */
-+ /* first check to see if we can already be reached via this slot */
-+ tmp = *curr;
-+ while (tmp && tmp != role)
-+ tmp = tmp->next;
-+ if (tmp == role) {
-+ /* we don't need to add ourselves to this slot's chain */
-+ return;
-+ }
-+ /* we need to add ourselves to this chain, two cases */
-+ if (role->next == NULL) {
-+ /* simple case, append the current chain to our role */
-+ role->next = *curr;
-+ *curr = role;
-+ } else {
-+ /* 1 -> 2 -> 3 -> 4
-+ 2 -> 3 -> 4
-+ 3 -> 4 (adding 1 -> 2 -> 3 -> 4 to here)
-+ */
-+ /* trickier case: walk our role's chain until we find
-+ the role for the start of the current slot's chain */
-+ tmp = role;
-+ tmp2 = *curr;
-+ while (tmp->next && tmp->next != tmp2)
-+ tmp = tmp->next;
-+ if (tmp->next == tmp2) {
-+ /* from example above, we found 3, so just
-+ replace this slot's chain with ours */
-+ *curr = role;
-+ } else {
-+ /* we didn't find a subset of our role's chain
-+ in the current slot's chain, so append their
-+ chain to ours, and set us as the first role in
-+ the slot's chain
-+
-+ we could fold this case with the case above,
-+ but making it explicit for clarity
-+ */
-+ tmp->next = tmp2;
-+ *curr = role;
-+ }
-+ }
-+ }
-+
-+ return;
-+}
-+
-+static void
-+insert_acl_role_label(struct acl_role_label *role)
-+{
-+ int i;
-+
-+ if (role_list == NULL) {
-+ role_list = role;
-+ role->prev = NULL;
-+ } else {
-+ role->prev = role_list;
-+ role_list = role;
-+ }
-+
-+ /* used for hash chains */
-+ role->next = NULL;
-+
-+ if (role->roletype & GR_ROLE_DOMAIN) {
-+ for (i = 0; i < role->domain_child_num; i++)
-+ __insert_acl_role_label(role, role->domain_children[i]);
-+ } else
-+ __insert_acl_role_label(role, role->uidgid);
-+}
-+
-+static int
-+insert_name_entry(char *name, const ino_t inode, const dev_t device, __u8 deleted)
-+{
-+ struct name_entry **curr, *nentry;
-+ struct inodev_entry *ientry;
-+ unsigned int len = strlen(name);
-+ unsigned int key = full_name_hash(name, len);
-+ unsigned int index = key % name_set.n_size;
-+
-+ curr = &name_set.n_hash[index];
-+
-+ while (*curr && ((*curr)->key != key || !gr_streq((*curr)->name, name, (*curr)->len, len)))
-+ curr = &((*curr)->next);
-+
-+ if (*curr != NULL)
-+ return 1;
-+
-+ nentry = acl_alloc(sizeof (struct name_entry));
-+ if (nentry == NULL)
-+ return 0;
-+ ientry = acl_alloc(sizeof (struct inodev_entry));
-+ if (ientry == NULL)
-+ return 0;
-+ ientry->nentry = nentry;
-+
-+ nentry->key = key;
-+ nentry->name = name;
-+ nentry->inode = inode;
-+ nentry->device = device;
-+ nentry->len = len;
-+ nentry->deleted = deleted;
-+
-+ nentry->prev = NULL;
-+ curr = &name_set.n_hash[index];
-+ if (*curr != NULL)
-+ (*curr)->prev = nentry;
-+ nentry->next = *curr;
-+ *curr = nentry;
-+
-+ /* insert us into the table searchable by inode/dev */
-+ insert_inodev_entry(ientry);
-+
-+ return 1;
-+}
-+
-+static void
-+insert_acl_obj_label(struct acl_object_label *obj,
-+ struct acl_subject_label *subj)
-+{
-+ unsigned int index =
-+ gr_fhash(obj->inode, obj->device, subj->obj_hash_size);
-+ struct acl_object_label **curr;
-+
-+
-+ obj->prev = NULL;
-+
-+ curr = &subj->obj_hash[index];
-+ if (*curr != NULL)
-+ (*curr)->prev = obj;
-+
-+ obj->next = *curr;
-+ *curr = obj;
-+
-+ return;
-+}
-+
-+static void
-+insert_acl_subj_label(struct acl_subject_label *obj,
-+ struct acl_role_label *role)
-+{
-+ unsigned int index = gr_fhash(obj->inode, obj->device, role->subj_hash_size);
-+ struct acl_subject_label **curr;
-+
-+ obj->prev = NULL;
-+
-+ curr = &role->subj_hash[index];
-+ if (*curr != NULL)
-+ (*curr)->prev = obj;
-+
-+ obj->next = *curr;
-+ *curr = obj;
-+
-+ return;
-+}
-+
-+/* allocating chained hash tables, so optimal size is where lambda ~ 1 */
-+
-+static void *
-+create_table(__u32 * len, int elementsize)
-+{
-+ unsigned int table_sizes[] = {
-+ 7, 13, 31, 61, 127, 251, 509, 1021, 2039, 4093, 8191, 16381,
-+ 32749, 65521, 131071, 262139, 524287, 1048573, 2097143,
-+ 4194301, 8388593, 16777213, 33554393, 67108859
-+ };
-+ void *newtable = NULL;
-+ unsigned int pwr = 0;
-+
-+ while ((pwr < ((sizeof (table_sizes) / sizeof (table_sizes[0])) - 1)) &&
-+ table_sizes[pwr] <= *len)
-+ pwr++;
-+
-+ if (table_sizes[pwr] <= *len || (table_sizes[pwr] > ULONG_MAX / elementsize))
-+ return newtable;
-+
-+ if ((table_sizes[pwr] * elementsize) <= PAGE_SIZE)
-+ newtable =
-+ kmalloc(table_sizes[pwr] * elementsize, GFP_KERNEL);
-+ else
-+ newtable = vmalloc(table_sizes[pwr] * elementsize);
-+
-+ *len = table_sizes[pwr];
-+
-+ return newtable;
-+}
-+
-+static int
-+init_variables(const struct gr_arg *arg)
-+{
-+ struct task_struct *reaper = &init_task;
-+ unsigned int stacksize;
-+
-+ subj_map_set.s_size = arg->role_db.num_subjects;
-+ acl_role_set.r_size = arg->role_db.num_roles + arg->role_db.num_domain_children;
-+ name_set.n_size = arg->role_db.num_objects;
-+ inodev_set.i_size = arg->role_db.num_objects;
-+
-+ if (!subj_map_set.s_size || !acl_role_set.r_size ||
-+ !name_set.n_size || !inodev_set.i_size)
-+ return 1;
-+
-+ if (!gr_init_uidset())
-+ return 1;
-+
-+ /* set up the stack that holds allocation info */
-+
-+ stacksize = arg->role_db.num_pointers + 5;
-+
-+ if (!acl_alloc_stack_init(stacksize))
-+ return 1;
-+
-+ /* grab reference for the real root dentry and vfsmount */
-+ read_lock(&reaper->fs->lock);
-+ real_root = dget(reaper->fs->root.dentry);
-+ real_root_mnt = mntget(reaper->fs->root.mnt);
-+ read_unlock(&reaper->fs->lock);
-+
-+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
-+ printk(KERN_ALERT "Obtained real root device=%d, inode=%lu\n", __get_dev(real_root), real_root->d_inode->i_ino);
-+#endif
-+
-+ fakefs_obj_rw = acl_alloc(sizeof(struct acl_object_label));
-+ if (fakefs_obj_rw == NULL)
-+ return 1;
-+ fakefs_obj_rw->mode = GR_FIND | GR_READ | GR_WRITE;
-+
-+ fakefs_obj_rwx = acl_alloc(sizeof(struct acl_object_label));
-+ if (fakefs_obj_rwx == NULL)
-+ return 1;
-+ fakefs_obj_rwx->mode = GR_FIND | GR_READ | GR_WRITE | GR_EXEC;
-+
-+ subj_map_set.s_hash =
-+ (struct subject_map **) create_table(&subj_map_set.s_size, sizeof(void *));
-+ acl_role_set.r_hash =
-+ (struct acl_role_label **) create_table(&acl_role_set.r_size, sizeof(void *));
-+ name_set.n_hash = (struct name_entry **) create_table(&name_set.n_size, sizeof(void *));
-+ inodev_set.i_hash =
-+ (struct inodev_entry **) create_table(&inodev_set.i_size, sizeof(void *));
-+
-+ if (!subj_map_set.s_hash || !acl_role_set.r_hash ||
-+ !name_set.n_hash || !inodev_set.i_hash)
-+ return 1;
-+
-+ memset(subj_map_set.s_hash, 0,
-+ sizeof(struct subject_map *) * subj_map_set.s_size);
-+ memset(acl_role_set.r_hash, 0,
-+ sizeof (struct acl_role_label *) * acl_role_set.r_size);
-+ memset(name_set.n_hash, 0,
-+ sizeof (struct name_entry *) * name_set.n_size);
-+ memset(inodev_set.i_hash, 0,
-+ sizeof (struct inodev_entry *) * inodev_set.i_size);
-+
-+ return 0;
-+}
-+
-+/* free information not needed after startup
-+ currently contains user->kernel pointer mappings for subjects
-+*/
-+
-+static void
-+free_init_variables(void)
-+{
-+ __u32 i;
-+
-+ if (subj_map_set.s_hash) {
-+ for (i = 0; i < subj_map_set.s_size; i++) {
-+ if (subj_map_set.s_hash[i]) {
-+ kfree(subj_map_set.s_hash[i]);
-+ subj_map_set.s_hash[i] = NULL;
-+ }
-+ }
-+
-+ if ((subj_map_set.s_size * sizeof (struct subject_map *)) <=
-+ PAGE_SIZE)
-+ kfree(subj_map_set.s_hash);
-+ else
-+ vfree(subj_map_set.s_hash);
-+ }
-+
-+ return;
-+}
-+
-+static void
-+free_variables(void)
-+{
-+ struct acl_subject_label *s;
-+ struct acl_role_label *r;
-+ struct task_struct *task, *task2;
-+ unsigned int x;
-+
-+ gr_clear_learn_entries();
-+
-+ read_lock(&tasklist_lock);
-+ do_each_thread(task2, task) {
-+ task->acl_sp_role = 0;
-+ task->acl_role_id = 0;
-+ task->acl = NULL;
-+ task->role = NULL;
-+ } while_each_thread(task2, task);
-+ read_unlock(&tasklist_lock);
-+
-+ /* release the reference to the real root dentry and vfsmount */
-+ if (real_root)
-+ dput(real_root);
-+ real_root = NULL;
-+ if (real_root_mnt)
-+ mntput(real_root_mnt);
-+ real_root_mnt = NULL;
-+
-+ /* free all object hash tables */
-+
-+ FOR_EACH_ROLE_START(r)
-+ if (r->subj_hash == NULL)
-+ goto next_role;
-+ FOR_EACH_SUBJECT_START(r, s, x)
-+ if (s->obj_hash == NULL)
-+ break;
-+ if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
-+ kfree(s->obj_hash);
-+ else
-+ vfree(s->obj_hash);
-+ FOR_EACH_SUBJECT_END(s, x)
-+ FOR_EACH_NESTED_SUBJECT_START(r, s)
-+ if (s->obj_hash == NULL)
-+ break;
-+ if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
-+ kfree(s->obj_hash);
-+ else
-+ vfree(s->obj_hash);
-+ FOR_EACH_NESTED_SUBJECT_END(s)
-+ if ((r->subj_hash_size * sizeof (struct acl_subject_label *)) <= PAGE_SIZE)
-+ kfree(r->subj_hash);
-+ else
-+ vfree(r->subj_hash);
-+ r->subj_hash = NULL;
-+next_role:
-+ FOR_EACH_ROLE_END(r)
-+
-+ acl_free_all();
-+
-+ if (acl_role_set.r_hash) {
-+ if ((acl_role_set.r_size * sizeof (struct acl_role_label *)) <=
-+ PAGE_SIZE)
-+ kfree(acl_role_set.r_hash);
-+ else
-+ vfree(acl_role_set.r_hash);
-+ }
-+ if (name_set.n_hash) {
-+ if ((name_set.n_size * sizeof (struct name_entry *)) <=
-+ PAGE_SIZE)
-+ kfree(name_set.n_hash);
-+ else
-+ vfree(name_set.n_hash);
-+ }
-+
-+ if (inodev_set.i_hash) {
-+ if ((inodev_set.i_size * sizeof (struct inodev_entry *)) <=
-+ PAGE_SIZE)
-+ kfree(inodev_set.i_hash);
-+ else
-+ vfree(inodev_set.i_hash);
-+ }
-+
-+ gr_free_uidset();
-+
-+ memset(&name_set, 0, sizeof (struct name_db));
-+ memset(&inodev_set, 0, sizeof (struct inodev_db));
-+ memset(&acl_role_set, 0, sizeof (struct acl_role_db));
-+ memset(&subj_map_set, 0, sizeof (struct acl_subj_map_db));
-+
-+ default_role = NULL;
-+ kernel_role = NULL;
-+ role_list = NULL;
-+
-+ return;
-+}
-+
-+static struct acl_subject_label *
-+do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role, int *already_copied);
-+
-+static int alloc_and_copy_string(char **name, unsigned int maxlen)
-+{
-+ unsigned int len = strnlen_user(*name, maxlen);
-+ char *tmp;
-+
-+ if (!len || len >= maxlen)
-+ return -EINVAL;
-+
-+ if ((tmp = (char *) acl_alloc(len)) == NULL)
-+ return -ENOMEM;
-+
-+ if (copy_from_user(tmp, *name, len))
-+ return -EFAULT;
-+
-+ tmp[len-1] = '\0';
-+ *name = tmp;
-+
-+ return 0;
-+}
-+
-+static int
-+copy_user_glob(struct acl_object_label *obj)
-+{
-+ struct acl_object_label *g_tmp, **guser;
-+ int error;
-+
-+ if (obj->globbed == NULL)
-+ return 0;
-+
-+ guser = &obj->globbed;
-+ while (*guser) {
-+ g_tmp = (struct acl_object_label *)
-+ acl_alloc(sizeof (struct acl_object_label));
-+ if (g_tmp == NULL)
-+ return -ENOMEM;
-+
-+ if (copy_acl_object_label(g_tmp, *guser))
-+ return -EFAULT;
-+
-+ error = alloc_and_copy_string(&g_tmp->filename, PATH_MAX);
-+ if (error)
-+ return error;
-+
-+ *guser = g_tmp;
-+ guser = &(g_tmp->next);
-+ }
-+
-+ return 0;
-+}
-+
-+static int
-+copy_user_objs(struct acl_object_label *userp, struct acl_subject_label *subj,
-+ struct acl_role_label *role)
-+{
-+ struct acl_object_label *o_tmp;
-+ int ret;
-+
-+ while (userp) {
-+ if ((o_tmp = (struct acl_object_label *)
-+ acl_alloc(sizeof (struct acl_object_label))) == NULL)
-+ return -ENOMEM;
-+
-+ if (copy_acl_object_label(o_tmp, userp))
-+ return -EFAULT;
-+
-+ userp = o_tmp->prev;
-+
-+ ret = alloc_and_copy_string(&o_tmp->filename, PATH_MAX);
-+ if (ret)
-+ return ret;
-+
-+ insert_acl_obj_label(o_tmp, subj);
-+ if (!insert_name_entry(o_tmp->filename, o_tmp->inode,
-+ o_tmp->device, (o_tmp->mode & GR_DELETED) ? 1 : 0))
-+ return -ENOMEM;
-+
-+ ret = copy_user_glob(o_tmp);
-+ if (ret)
-+ return ret;
-+
-+ if (o_tmp->nested) {
-+ int already_copied;
-+
-+ o_tmp->nested = do_copy_user_subj(o_tmp->nested, role, &already_copied);
-+ if (IS_ERR(o_tmp->nested))
-+ return PTR_ERR(o_tmp->nested);
-+
-+ /* insert into nested subject list if we haven't copied this one yet
-+ to prevent duplicate entries */
-+ if (!already_copied) {
-+ o_tmp->nested->next = role->hash->first;
-+ role->hash->first = o_tmp->nested;
-+ }
-+ }
-+ }
-+
-+ return 0;
-+}
-+
-+static __u32
-+count_user_subjs(struct acl_subject_label *userp)
-+{
-+ struct acl_subject_label s_tmp;
-+ __u32 num = 0;
-+
-+ while (userp) {
-+ if (copy_acl_subject_label(&s_tmp, userp))
-+ break;
-+
-+ userp = s_tmp.prev;
-+ }
-+
-+ return num;
-+}
-+
-+static int
-+copy_user_allowedips(struct acl_role_label *rolep)
-+{
-+ struct role_allowed_ip *ruserip, *rtmp = NULL, *rlast;
-+
-+ ruserip = rolep->allowed_ips;
-+
-+ while (ruserip) {
-+ rlast = rtmp;
-+
-+ if ((rtmp = (struct role_allowed_ip *)
-+ acl_alloc(sizeof (struct role_allowed_ip))) == NULL)
-+ return -ENOMEM;
-+
-+ if (copy_role_allowed_ip(rtmp, ruserip))
-+ return -EFAULT;
-+
-+ ruserip = rtmp->prev;
-+
-+ if (!rlast) {
-+ rtmp->prev = NULL;
-+ rolep->allowed_ips = rtmp;
-+ } else {
-+ rlast->next = rtmp;
-+ rtmp->prev = rlast;
-+ }
-+
-+ if (!ruserip)
-+ rtmp->next = NULL;
-+ }
-+
-+ return 0;
-+}
-+
-+static int
-+copy_user_transitions(struct acl_role_label *rolep)
-+{
-+ struct role_transition *rusertp, *rtmp = NULL, *rlast;
-+ int error;
-+
-+ rusertp = rolep->transitions;
-+
-+ while (rusertp) {
-+ rlast = rtmp;
-+
-+ if ((rtmp = (struct role_transition *)
-+ acl_alloc(sizeof (struct role_transition))) == NULL)
-+ return -ENOMEM;
-+
-+ if (copy_role_transition(rtmp, rusertp))
-+ return -EFAULT;
-+
-+ rusertp = rtmp->prev;
-+
-+ error = alloc_and_copy_string(&rtmp->rolename, GR_SPROLE_LEN);
-+ if (error)
-+ return error;
-+
-+ if (!rlast) {
-+ rtmp->prev = NULL;
-+ rolep->transitions = rtmp;
-+ } else {
-+ rlast->next = rtmp;
-+ rtmp->prev = rlast;
-+ }
-+
-+ if (!rusertp)
-+ rtmp->next = NULL;
-+ }
-+
-+ return 0;
-+}
-+
-+static __u32 count_user_objs(const struct acl_object_label __user *userp)
-+{
-+ struct acl_object_label o_tmp;
-+ __u32 num = 0;
-+
-+ while (userp) {
-+ if (copy_acl_object_label(&o_tmp, userp))
-+ break;
-+
-+ userp = o_tmp.prev;
-+ num++;
-+ }
-+
-+ return num;
-+}
-+
-+static struct acl_subject_label *
-+do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role, int *already_copied)
-+{
-+ struct acl_subject_label *s_tmp = NULL, *s_tmp2;
-+ __u32 num_objs;
-+ struct acl_ip_label **i_tmp, *i_utmp2;
-+ struct gr_hash_struct ghash;
-+ struct subject_map *subjmap;
-+ unsigned int i_num;
-+ int err;
-+
-+ if (already_copied != NULL)
-+ *already_copied = 0;
-+
-+ s_tmp = lookup_subject_map(userp);
-+
-+ /* we've already copied this subject into the kernel, just return
-+ the reference to it, and don't copy it over again
-+ */
-+ if (s_tmp) {
-+ if (already_copied != NULL)
-+ *already_copied = 1;
-+ return(s_tmp);
-+ }
-+
-+ if ((s_tmp = (struct acl_subject_label *)
-+ acl_alloc(sizeof (struct acl_subject_label))) == NULL)
-+ return ERR_PTR(-ENOMEM);
-+
-+ subjmap = (struct subject_map *)kmalloc(sizeof (struct subject_map), GFP_KERNEL);
-+ if (subjmap == NULL)
-+ return ERR_PTR(-ENOMEM);
-+
-+ subjmap->user = userp;
-+ subjmap->kernel = s_tmp;
-+ insert_subj_map_entry(subjmap);
-+
-+ if (copy_acl_subject_label(s_tmp, userp))
-+ return ERR_PTR(-EFAULT);
-+
-+ err = alloc_and_copy_string(&s_tmp->filename, PATH_MAX);
-+ if (err)
-+ return ERR_PTR(err);
-+
-+ if (!strcmp(s_tmp->filename, "/"))
-+ role->root_label = s_tmp;
-+
-+ if (copy_gr_hash_struct(&ghash, s_tmp->hash))
-+ return ERR_PTR(-EFAULT);
-+
-+ /* copy user and group transition tables */
-+
-+ if (s_tmp->user_trans_num) {
-+ uid_t *uidlist;
-+
-+ uidlist = (uid_t *)acl_alloc_num(s_tmp->user_trans_num, sizeof(uid_t));
-+ if (uidlist == NULL)
-+ return ERR_PTR(-ENOMEM);
-+ if (copy_from_user(uidlist, s_tmp->user_transitions, s_tmp->user_trans_num * sizeof(uid_t)))
-+ return ERR_PTR(-EFAULT);
-+
-+ s_tmp->user_transitions = uidlist;
-+ }
-+
-+ if (s_tmp->group_trans_num) {
-+ gid_t *gidlist;
-+
-+ gidlist = (gid_t *)acl_alloc_num(s_tmp->group_trans_num, sizeof(gid_t));
-+ if (gidlist == NULL)
-+ return ERR_PTR(-ENOMEM);
-+ if (copy_from_user(gidlist, s_tmp->group_transitions, s_tmp->group_trans_num * sizeof(gid_t)))
-+ return ERR_PTR(-EFAULT);
-+
-+ s_tmp->group_transitions = gidlist;
-+ }
-+
-+ /* set up object hash table */
-+ num_objs = count_user_objs(ghash.first);
-+
-+ s_tmp->obj_hash_size = num_objs;
-+ s_tmp->obj_hash =
-+ (struct acl_object_label **)
-+ create_table(&(s_tmp->obj_hash_size), sizeof(void *));
-+
-+ if (!s_tmp->obj_hash)
-+ return ERR_PTR(-ENOMEM);
-+
-+ memset(s_tmp->obj_hash, 0,
-+ s_tmp->obj_hash_size *
-+ sizeof (struct acl_object_label *));
-+
-+ /* add in objects */
-+ err = copy_user_objs(ghash.first, s_tmp, role);
-+
-+ if (err)
-+ return ERR_PTR(err);
-+
-+ /* set pointer for parent subject */
-+ if (s_tmp->parent_subject) {
-+ s_tmp2 = do_copy_user_subj(s_tmp->parent_subject, role, NULL);
-+
-+ if (IS_ERR(s_tmp2))
-+ return s_tmp2;
-+
-+ s_tmp->parent_subject = s_tmp2;
-+ }
-+
-+ /* add in ip acls */
-+
-+ if (!s_tmp->ip_num) {
-+ s_tmp->ips = NULL;
-+ goto insert;
-+ }
-+
-+ i_tmp =
-+ (struct acl_ip_label **) acl_alloc_num(s_tmp->ip_num,
-+ sizeof (struct acl_ip_label *));
-+
-+ if (!i_tmp)
-+ return ERR_PTR(-ENOMEM);
-+
-+ for (i_num = 0; i_num < s_tmp->ip_num; i_num++) {
-+ *(i_tmp + i_num) =
-+ (struct acl_ip_label *)
-+ acl_alloc(sizeof (struct acl_ip_label));
-+ if (!*(i_tmp + i_num))
-+ return ERR_PTR(-ENOMEM);
-+
-+ if (copy_pointer_from_array(&i_utmp2, i_num, s_tmp->ips))
-+ return ERR_PTR(-EFAULT);
-+
-+ if (copy_acl_ip_label(*(i_tmp + i_num), i_utmp2))
-+ return ERR_PTR(-EFAULT);
-+
-+ if ((*(i_tmp + i_num))->iface == NULL)
-+ continue;
-+
-+ err = alloc_and_copy_string(&(*(i_tmp + i_num))->iface, IFNAMSIZ);
-+ if (err)
-+ return ERR_PTR(err);
-+ }
-+
-+ s_tmp->ips = i_tmp;
-+
-+insert:
-+ if (!insert_name_entry(s_tmp->filename, s_tmp->inode,
-+ s_tmp->device, (s_tmp->mode & GR_DELETED) ? 1 : 0))
-+ return ERR_PTR(-ENOMEM);
-+
-+ return s_tmp;
-+}
-+
-+static int
-+copy_user_subjs(struct acl_subject_label *userp, struct acl_role_label *role)
-+{
-+ struct acl_subject_label s_pre;
-+ struct acl_subject_label * ret;
-+ int err;
-+
-+ while (userp) {
-+ if (copy_acl_subject_label(&s_pre, userp))
-+ return -EFAULT;
-+
-+ ret = do_copy_user_subj(userp, role, NULL);
-+
-+ err = PTR_ERR(ret);
-+ if (IS_ERR(ret))
-+ return err;
-+
-+ insert_acl_subj_label(ret, role);
-+
-+ userp = s_pre.prev;
-+ }
-+
-+ return 0;
-+}
-+
-+static int
-+copy_user_acl(struct gr_arg *arg)
-+{
-+ struct acl_role_label *r_tmp = NULL, **r_utmp, *r_utmp2;
-+ struct acl_subject_label *subj_list;
-+ struct sprole_pw *sptmp;
-+ struct gr_hash_struct *ghash;
-+ uid_t *domainlist;
-+ unsigned int r_num;
-+ int err = 0;
-+ __u16 i;
-+ __u32 num_subjs;
-+
-+ /* we need a default and kernel role */
-+ if (arg->role_db.num_roles < 2)
-+ return -EINVAL;
-+
-+ /* copy special role authentication info from userspace */
-+
-+ num_sprole_pws = arg->num_sprole_pws;
-+ acl_special_roles = (struct sprole_pw **) acl_alloc_num(num_sprole_pws, sizeof(struct sprole_pw *));
-+
-+ if (!acl_special_roles && num_sprole_pws)
-+ return -ENOMEM;
-+
-+ for (i = 0; i < num_sprole_pws; i++) {
-+ sptmp = (struct sprole_pw *) acl_alloc(sizeof(struct sprole_pw));
-+ if (!sptmp)
-+ return -ENOMEM;
-+ if (copy_sprole_pw(sptmp, i, arg->sprole_pws))
-+ return -EFAULT;
-+
-+ err = alloc_and_copy_string((char **)&sptmp->rolename, GR_SPROLE_LEN);
-+ if (err)
-+ return err;
-+
-+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
-+ printk(KERN_ALERT "Copying special role %s\n", sptmp->rolename);
-+#endif
-+
-+ acl_special_roles[i] = sptmp;
-+ }
-+
-+ r_utmp = (struct acl_role_label **) arg->role_db.r_table;
-+
-+ for (r_num = 0; r_num < arg->role_db.num_roles; r_num++) {
-+ r_tmp = acl_alloc(sizeof (struct acl_role_label));
-+
-+ if (!r_tmp)
-+ return -ENOMEM;
-+
-+ if (copy_pointer_from_array(&r_utmp2, r_num, r_utmp))
-+ return -EFAULT;
-+
-+ if (copy_acl_role_label(r_tmp, r_utmp2))
-+ return -EFAULT;
-+
-+ err = alloc_and_copy_string(&r_tmp->rolename, GR_SPROLE_LEN);
-+ if (err)
-+ return err;
-+
-+ if (!strcmp(r_tmp->rolename, "default")
-+ && (r_tmp->roletype & GR_ROLE_DEFAULT)) {
-+ default_role = r_tmp;
-+ } else if (!strcmp(r_tmp->rolename, ":::kernel:::")) {
-+ kernel_role = r_tmp;
-+ }
-+
-+ if ((ghash = (struct gr_hash_struct *) acl_alloc(sizeof(struct gr_hash_struct))) == NULL)
-+ return -ENOMEM;
-+
-+ if (copy_gr_hash_struct(ghash, r_tmp->hash))
-+ return -EFAULT;
-+
-+ r_tmp->hash = ghash;
-+
-+ num_subjs = count_user_subjs(r_tmp->hash->first);
-+
-+ r_tmp->subj_hash_size = num_subjs;
-+ r_tmp->subj_hash =
-+ (struct acl_subject_label **)
-+ create_table(&(r_tmp->subj_hash_size), sizeof(void *));
-+
-+ if (!r_tmp->subj_hash)
-+ return -ENOMEM;
-+
-+ err = copy_user_allowedips(r_tmp);
-+ if (err)
-+ return err;
-+
-+ /* copy domain info */
-+ if (r_tmp->domain_children != NULL) {
-+ domainlist = acl_alloc_num(r_tmp->domain_child_num, sizeof(uid_t));
-+ if (domainlist == NULL)
-+ return -ENOMEM;
-+
-+ if (copy_from_user(domainlist, r_tmp->domain_children, r_tmp->domain_child_num * sizeof(uid_t)))
-+ return -EFAULT;
-+
-+ r_tmp->domain_children = domainlist;
-+ }
-+
-+ err = copy_user_transitions(r_tmp);
-+ if (err)
-+ return err;
-+
-+ memset(r_tmp->subj_hash, 0,
-+ r_tmp->subj_hash_size *
-+ sizeof (struct acl_subject_label *));
-+
-+ /* acquire the list of subjects, then NULL out
-+ the list prior to parsing the subjects for this role,
-+ as during this parsing the list is replaced with a list
-+ of *nested* subjects for the role
-+ */
-+ subj_list = r_tmp->hash->first;
-+
-+ /* set nested subject list to null */
-+ r_tmp->hash->first = NULL;
-+
-+ err = copy_user_subjs(subj_list, r_tmp);
-+
-+ if (err)
-+ return err;
-+
-+ insert_acl_role_label(r_tmp);
-+ }
-+
-+ if (default_role == NULL || kernel_role == NULL)
-+ return -EINVAL;
-+
-+ return err;
-+}
-+
-+static int
-+gracl_init(struct gr_arg *args)
-+{
-+ int error = 0;
-+
-+ memcpy(gr_system_salt, args->salt, GR_SALT_LEN);
-+ memcpy(gr_system_sum, args->sum, GR_SHA_LEN);
-+
-+ if (init_variables(args)) {
-+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_INITF_ACL_MSG, GR_VERSION);
-+ error = -ENOMEM;
-+ free_variables();
-+ goto out;
-+ }
-+
-+ error = copy_user_acl(args);
-+ free_init_variables();
-+ if (error) {
-+ free_variables();
-+ goto out;
-+ }
-+
-+ if ((error = gr_set_acls(0))) {
-+ free_variables();
-+ goto out;
-+ }
-+
-+ pax_open_kernel();
-+ gr_status |= GR_READY;
-+ pax_close_kernel();
-+
-+ out:
-+ return error;
-+}
-+
-+/* derived from glibc fnmatch() 0: match, 1: no match*/
-+
-+static int
-+glob_match(const char *p, const char *n)
-+{
-+ char c;
-+
-+ while ((c = *p++) != '\0') {
-+ switch (c) {
-+ case '?':
-+ if (*n == '\0')
-+ return 1;
-+ else if (*n == '/')
-+ return 1;
-+ break;
-+ case '\\':
-+ if (*n != c)
-+ return 1;
-+ break;
-+ case '*':
-+ for (c = *p++; c == '?' || c == '*'; c = *p++) {
-+ if (*n == '/')
-+ return 1;
-+ else if (c == '?') {
-+ if (*n == '\0')
-+ return 1;
-+ else
-+ ++n;
-+ }
-+ }
-+ if (c == '\0') {
-+ return 0;
-+ } else {
-+ const char *endp;
-+
-+ if ((endp = strchr(n, '/')) == NULL)
-+ endp = n + strlen(n);
-+
-+ if (c == '[') {
-+ for (--p; n < endp; ++n)
-+ if (!glob_match(p, n))
-+ return 0;
-+ } else if (c == '/') {
-+ while (*n != '\0' && *n != '/')
-+ ++n;
-+ if (*n == '/' && !glob_match(p, n + 1))
-+ return 0;
-+ } else {
-+ for (--p; n < endp; ++n)
-+ if (*n == c && !glob_match(p, n))
-+ return 0;
-+ }
-+
-+ return 1;
-+ }
-+ case '[':
-+ {
-+ int not;
-+ char cold;
-+
-+ if (*n == '\0' || *n == '/')
-+ return 1;
-+
-+ not = (*p == '!' || *p == '^');
-+ if (not)
-+ ++p;
-+
-+ c = *p++;
-+ for (;;) {
-+ unsigned char fn = (unsigned char)*n;
-+
-+ if (c == '\0')
-+ return 1;
-+ else {
-+ if (c == fn)
-+ goto matched;
-+ cold = c;
-+ c = *p++;
-+
-+ if (c == '-' && *p != ']') {
-+ unsigned char cend = *p++;
-+
-+ if (cend == '\0')
-+ return 1;
-+
-+ if (cold <= fn && fn <= cend)
-+ goto matched;
-+
-+ c = *p++;
-+ }
-+ }
-+
-+ if (c == ']')
-+ break;
-+ }
-+ if (!not)
-+ return 1;
-+ break;
-+ matched:
-+ while (c != ']') {
-+ if (c == '\0')
-+ return 1;
-+
-+ c = *p++;
-+ }
-+ if (not)
-+ return 1;
-+ }
-+ break;
-+ default:
-+ if (c != *n)
-+ return 1;
-+ }
-+
-+ ++n;
-+ }
-+
-+ if (*n == '\0')
-+ return 0;
-+
-+ if (*n == '/')
-+ return 0;
-+
-+ return 1;
-+}
-+
-+static struct acl_object_label *
-+chk_glob_label(struct acl_object_label *globbed,
-+ const struct dentry *dentry, const struct vfsmount *mnt, char **path)
-+{
-+ struct acl_object_label *tmp;
-+
-+ if (*path == NULL)
-+ *path = gr_to_filename_nolock(dentry, mnt);
-+
-+ tmp = globbed;
-+
-+ while (tmp) {
-+ if (!glob_match(tmp->filename, *path))
-+ return tmp;
-+ tmp = tmp->next;
-+ }
-+
-+ return NULL;
-+}
-+
-+static struct acl_object_label *
-+__full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
-+ const ino_t curr_ino, const dev_t curr_dev,
-+ const struct acl_subject_label *subj, char **path, const int checkglob)
-+{
-+ struct acl_subject_label *tmpsubj;
-+ struct acl_object_label *retval;
-+ struct acl_object_label *retval2;
-+
-+ tmpsubj = (struct acl_subject_label *) subj;
-+ read_lock(&gr_inode_lock);
-+ do {
-+ retval = lookup_acl_obj_label(curr_ino, curr_dev, tmpsubj);
-+ if (retval) {
-+ if (checkglob && retval->globbed) {
-+ retval2 = chk_glob_label(retval->globbed, orig_dentry, orig_mnt, path);
-+ if (retval2)
-+ retval = retval2;
-+ }
-+ break;
-+ }
-+ } while ((tmpsubj = tmpsubj->parent_subject));
-+ read_unlock(&gr_inode_lock);
-+
-+ return retval;
-+}
-+
-+static __inline__ struct acl_object_label *
-+full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
-+ const struct dentry *curr_dentry,
-+ const struct acl_subject_label *subj, char **path, const int checkglob)
-+{
-+ int newglob = checkglob;
-+
-+ /* if we aren't checking a subdirectory of the original path yet, don't do glob checking
-+ as we don't want a / * rule to match instead of the / object
-+ don't do this for create lookups that call this function though, since they're looking up
-+ on the parent and thus need globbing checks on all paths
-+ */
-+ if (orig_dentry == curr_dentry && newglob != GR_CREATE_GLOB)
-+ newglob = GR_NO_GLOB;
-+
-+ return __full_lookup(orig_dentry, orig_mnt,
-+ curr_dentry->d_inode->i_ino,
-+ __get_dev(curr_dentry), subj, path, newglob);
-+}
-+
-+static struct acl_object_label *
-+__chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
-+ const struct acl_subject_label *subj, char *path, const int checkglob)
-+{
-+ struct dentry *dentry = (struct dentry *) l_dentry;
-+ struct vfsmount *mnt = (struct vfsmount *) l_mnt;
-+ struct acl_object_label *retval;
-+
-+ spin_lock(&dcache_lock);
-+ spin_lock(&vfsmount_lock);
-+
-+ if (unlikely((mnt == shm_mnt && dentry->d_inode->i_nlink == 0) || mnt == pipe_mnt ||
-+#ifdef CONFIG_NET
-+ mnt == sock_mnt ||
-+#endif
-+#ifdef CONFIG_HUGETLBFS
-+ (mnt == hugetlbfs_vfsmount && dentry->d_inode->i_nlink == 0) ||
-+#endif
-+ /* ignore Eric Biederman */
-+ IS_PRIVATE(l_dentry->d_inode))) {
-+ retval = (subj->mode & GR_SHMEXEC) ? fakefs_obj_rwx : fakefs_obj_rw;
-+ goto out;
-+ }
-+
-+ for (;;) {
-+ if (dentry == real_root && mnt == real_root_mnt)
-+ break;
-+
-+ if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
-+ if (mnt->mnt_parent == mnt)
-+ break;
-+
-+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
-+ if (retval != NULL)
-+ goto out;
-+
-+ dentry = mnt->mnt_mountpoint;
-+ mnt = mnt->mnt_parent;
-+ continue;
-+ }
-+
-+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
-+ if (retval != NULL)
-+ goto out;
-+
-+ dentry = dentry->d_parent;
-+ }
-+
-+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
-+
-+ if (retval == NULL)
-+ retval = full_lookup(l_dentry, l_mnt, real_root, subj, &path, checkglob);
-+out:
-+ spin_unlock(&vfsmount_lock);
-+ spin_unlock(&dcache_lock);
-+
-+ BUG_ON(retval == NULL);
-+
-+ return retval;
-+}
-+
-+static __inline__ struct acl_object_label *
-+chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
-+ const struct acl_subject_label *subj)
-+{
-+ char *path = NULL;
-+ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_REG_GLOB);
-+}
-+
-+static __inline__ struct acl_object_label *
-+chk_obj_label_noglob(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
-+ const struct acl_subject_label *subj)
-+{
-+ char *path = NULL;
-+ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_NO_GLOB);
-+}
-+
-+static __inline__ struct acl_object_label *
-+chk_obj_create_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
-+ const struct acl_subject_label *subj, char *path)
-+{
-+ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_CREATE_GLOB);
-+}
-+
-+static struct acl_subject_label *
-+chk_subj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
-+ const struct acl_role_label *role)
-+{
-+ struct dentry *dentry = (struct dentry *) l_dentry;
-+ struct vfsmount *mnt = (struct vfsmount *) l_mnt;
-+ struct acl_subject_label *retval;
-+
-+ spin_lock(&dcache_lock);
-+ spin_lock(&vfsmount_lock);
-+
-+ for (;;) {
-+ if (dentry == real_root && mnt == real_root_mnt)
-+ break;
-+ if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
-+ if (mnt->mnt_parent == mnt)
-+ break;
-+
-+ read_lock(&gr_inode_lock);
-+ retval =
-+ lookup_acl_subj_label(dentry->d_inode->i_ino,
-+ __get_dev(dentry), role);
-+ read_unlock(&gr_inode_lock);
-+ if (retval != NULL)
-+ goto out;
-+
-+ dentry = mnt->mnt_mountpoint;
-+ mnt = mnt->mnt_parent;
-+ continue;
-+ }
-+
-+ read_lock(&gr_inode_lock);
-+ retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
-+ __get_dev(dentry), role);
-+ read_unlock(&gr_inode_lock);
-+ if (retval != NULL)
-+ goto out;
-+
-+ dentry = dentry->d_parent;
-+ }
-+
-+ read_lock(&gr_inode_lock);
-+ retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
-+ __get_dev(dentry), role);
-+ read_unlock(&gr_inode_lock);
-+
-+ if (unlikely(retval == NULL)) {
-+ read_lock(&gr_inode_lock);
-+ retval = lookup_acl_subj_label(real_root->d_inode->i_ino,
-+ __get_dev(real_root), role);
-+ read_unlock(&gr_inode_lock);
-+ }
-+out:
-+ spin_unlock(&vfsmount_lock);
-+ spin_unlock(&dcache_lock);
-+
-+ BUG_ON(retval == NULL);
-+
-+ return retval;
-+}
-+
-+static void
-+gr_log_learn(const struct dentry *dentry, const struct vfsmount *mnt, const __u32 mode)
-+{
-+ struct task_struct *task = current;
-+ const struct cred *cred = current_cred();
-+
-+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
-+ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
-+ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
-+ 1UL, 1UL, gr_to_filename(dentry, mnt), (unsigned long) mode, &task->signal->saved_ip);
-+
-+ return;
-+}
-+
-+static void
-+gr_log_learn_sysctl(const char *path, const __u32 mode)
-+{
-+ struct task_struct *task = current;
-+ const struct cred *cred = current_cred();
-+
-+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
-+ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
-+ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
-+ 1UL, 1UL, path, (unsigned long) mode, &task->signal->saved_ip);
-+
-+ return;
-+}
-+
-+static void
-+gr_log_learn_id_change(const char type, const unsigned int real,
-+ const unsigned int effective, const unsigned int fs)
-+{
-+ struct task_struct *task = current;
-+ const struct cred *cred = current_cred();
-+
-+ security_learn(GR_ID_LEARN_MSG, task->role->rolename, task->role->roletype,
-+ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
-+ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
-+ type, real, effective, fs, &task->signal->saved_ip);
-+
-+ return;
-+}
-+
-+__u32
-+gr_search_file(const struct dentry * dentry, const __u32 mode,
-+ const struct vfsmount * mnt)
-+{
-+ __u32 retval = mode;
-+ struct acl_subject_label *curracl;
-+ struct acl_object_label *currobj;
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return (mode & ~GR_AUDITS);
-+
-+ curracl = current->acl;
-+
-+ currobj = chk_obj_label(dentry, mnt, curracl);
-+ retval = currobj->mode & mode;
-+
-+ /* if we're opening a specified transfer file for writing
-+ (e.g. /dev/initctl), then transfer our role to init
-+ */
-+ if (unlikely(currobj->mode & GR_INIT_TRANSFER && retval & GR_WRITE &&
-+ current->role->roletype & GR_ROLE_PERSIST)) {
-+ struct task_struct *task = init_pid_ns.child_reaper;
-+
-+ if (task->role != current->role) {
-+ task->acl_sp_role = 0;
-+ task->acl_role_id = current->acl_role_id;
-+ task->role = current->role;
-+ rcu_read_lock();
-+ read_lock(&grsec_exec_file_lock);
-+ gr_apply_subject_to_task(task);
-+ read_unlock(&grsec_exec_file_lock);
-+ rcu_read_unlock();
-+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_INIT_TRANSFER_MSG);
-+ }
-+ }
-+
-+ if (unlikely
-+ ((curracl->mode & (GR_LEARN | GR_INHERITLEARN)) && !(mode & GR_NOPTRACE)
-+ && (retval != (mode & ~(GR_AUDITS | GR_SUPPRESS))))) {
-+ __u32 new_mode = mode;
-+
-+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
-+
-+ retval = new_mode;
-+
-+ if (new_mode & GR_EXEC && curracl->mode & GR_INHERITLEARN)
-+ new_mode |= GR_INHERIT;
-+
-+ if (!(mode & GR_NOLEARN))
-+ gr_log_learn(dentry, mnt, new_mode);
-+ }
-+
-+ return retval;
-+}
-+
-+struct acl_object_label *gr_get_create_object(const struct dentry *new_dentry,
-+ const struct dentry *parent,
-+ const struct vfsmount *mnt)
-+{
-+ struct name_entry *match;
-+ struct acl_object_label *matchpo;
-+ struct acl_subject_label *curracl;
-+ char *path;
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return NULL;
-+
-+ preempt_disable();
-+ path = gr_to_filename_rbac(new_dentry, mnt);
-+ match = lookup_name_entry_create(path);
-+
-+ curracl = current->acl;
-+
-+ if (match) {
-+ read_lock(&gr_inode_lock);
-+ matchpo = lookup_acl_obj_label_create(match->inode, match->device, curracl);
-+ read_unlock(&gr_inode_lock);
-+
-+ if (matchpo) {
-+ preempt_enable();
-+ return matchpo;
-+ }
-+ }
-+
-+ // lookup parent
-+
-+ matchpo = chk_obj_create_label(parent, mnt, curracl, path);
-+
-+ preempt_enable();
-+ return matchpo;
-+}
-+
-+__u32
-+gr_check_create(const struct dentry * new_dentry, const struct dentry * parent,
-+ const struct vfsmount * mnt, const __u32 mode)
-+{
-+ struct acl_object_label *matchpo;
-+ __u32 retval;
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return (mode & ~GR_AUDITS);
-+
-+ matchpo = gr_get_create_object(new_dentry, parent, mnt);
-+
-+ retval = matchpo->mode & mode;
-+
-+ if ((retval != (mode & ~(GR_AUDITS | GR_SUPPRESS)))
-+ && (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))) {
-+ __u32 new_mode = mode;
-+
-+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
-+
-+ gr_log_learn(new_dentry, mnt, new_mode);
-+ return new_mode;
-+ }
-+
-+ return retval;
-+}
-+
-+__u32
-+gr_check_link(const struct dentry * new_dentry,
-+ const struct dentry * parent_dentry,
-+ const struct vfsmount * parent_mnt,
-+ const struct dentry * old_dentry, const struct vfsmount * old_mnt)
-+{
-+ struct acl_object_label *obj;
-+ __u32 oldmode, newmode;
-+ __u32 needmode;
-+ __u32 checkmodes = GR_FIND | GR_APPEND | GR_WRITE | GR_EXEC | GR_SETID | GR_READ |
-+ GR_DELETE | GR_INHERIT;
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return (GR_CREATE | GR_LINK);
-+
-+ obj = chk_obj_label(old_dentry, old_mnt, current->acl);
-+ oldmode = obj->mode;
-+
-+ obj = gr_get_create_object(new_dentry, parent_dentry, parent_mnt);
-+ newmode = obj->mode;
-+
-+ needmode = newmode & checkmodes;
-+
-+ // old name for hardlink must have at least the permissions of the new name
-+ if ((oldmode & needmode) != needmode)
-+ goto bad;
-+
-+ // if old name had restrictions/auditing, make sure the new name does as well
-+ needmode = oldmode & (GR_NOPTRACE | GR_PTRACERD | GR_INHERIT | GR_AUDITS);
-+
-+ // don't allow hardlinking of suid/sgid/fcapped files without permission
-+ if (is_privileged_binary(old_dentry))
-+ needmode |= GR_SETID;
-+
-+ if ((newmode & needmode) != needmode)
-+ goto bad;
-+
-+ // enforce minimum permissions
-+ if ((newmode & (GR_CREATE | GR_LINK)) == (GR_CREATE | GR_LINK))
-+ return newmode;
-+bad:
-+ needmode = oldmode;
-+ if (is_privileged_binary(old_dentry))
-+ needmode |= GR_SETID;
-+
-+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) {
-+ gr_log_learn(old_dentry, old_mnt, needmode | GR_CREATE | GR_LINK);
-+ return (GR_CREATE | GR_LINK);
-+ } else if (newmode & GR_SUPPRESS)
-+ return GR_SUPPRESS;
-+ else
-+ return 0;
-+}
-+
-+int
-+gr_check_hidden_task(const struct task_struct *task)
-+{
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return 0;
-+
-+ if (!(task->acl->mode & GR_PROCFIND) && !(current->acl->mode & GR_VIEW))
-+ return 1;
-+
-+ return 0;
-+}
-+
-+int
-+gr_check_protected_task(const struct task_struct *task)
-+{
-+ if (unlikely(!(gr_status & GR_READY) || !task))
-+ return 0;
-+
-+ if ((task->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
-+ task->acl != current->acl)
-+ return 1;
-+
-+ return 0;
-+}
-+
-+int
-+gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
-+{
-+ struct task_struct *p;
-+ int ret = 0;
-+
-+ if (unlikely(!(gr_status & GR_READY) || !pid))
-+ return ret;
-+
-+ read_lock(&tasklist_lock);
-+ do_each_pid_task(pid, type, p) {
-+ if ((p->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
-+ p->acl != current->acl) {
-+ ret = 1;
-+ goto out;
-+ }
-+ } while_each_pid_task(pid, type, p);
-+out:
-+ read_unlock(&tasklist_lock);
-+
-+ return ret;
-+}
-+
-+void
-+gr_copy_label(struct task_struct *tsk)
-+{
-+ tsk->signal->used_accept = 0;
-+ tsk->acl_sp_role = 0;
-+ tsk->acl_role_id = current->acl_role_id;
-+ tsk->acl = current->acl;
-+ tsk->role = current->role;
-+ tsk->signal->curr_ip = current->signal->curr_ip;
-+ tsk->signal->saved_ip = current->signal->saved_ip;
-+ if (current->exec_file)
-+ get_file(current->exec_file);
-+ tsk->exec_file = current->exec_file;
-+ tsk->is_writable = current->is_writable;
-+ if (unlikely(current->signal->used_accept)) {
-+ current->signal->curr_ip = 0;
-+ current->signal->saved_ip = 0;
-+ }
-+
-+ return;
-+}
-+
-+static void
-+gr_set_proc_res(struct task_struct *task)
-+{
-+ struct acl_subject_label *proc;
-+ unsigned short i;
-+
-+ proc = task->acl;
-+
-+ if (proc->mode & (GR_LEARN | GR_INHERITLEARN))
-+ return;
-+
-+ for (i = 0; i < RLIM_NLIMITS; i++) {
-+ if (!(proc->resmask & (1U << i)))
-+ continue;
-+
-+ task->signal->rlim[i].rlim_cur = proc->res[i].rlim_cur;
-+ task->signal->rlim[i].rlim_max = proc->res[i].rlim_max;
-+
-+ if (i == RLIMIT_CPU)
-+ update_rlimit_cpu(task, proc->res[i].rlim_cur);
-+ }
-+
-+ return;
-+}
-+
-+extern int gr_process_kernel_setuid_ban(struct user_struct *user);
-+
-+int
-+gr_check_user_change(int real, int effective, int fs)
-+{
-+ unsigned int i;
-+ __u16 num;
-+ uid_t *uidlist;
-+ int curuid;
-+ int realok = 0;
-+ int effectiveok = 0;
-+ int fsok = 0;
-+
-+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT)
-+ struct user_struct *user;
-+
-+ if (real == -1)
-+ goto skipit;
-+
-+ user = find_user(real);
-+ if (user == NULL)
-+ goto skipit;
-+
-+ if (gr_process_kernel_setuid_ban(user)) {
-+ /* for find_user */
-+ free_uid(user);
-+ return 1;
-+ }
-+
-+ /* for find_user */
-+ free_uid(user);
-+
-+skipit:
-+#endif
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return 0;
-+
-+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
-+ gr_log_learn_id_change('u', real, effective, fs);
-+
-+ num = current->acl->user_trans_num;
-+ uidlist = current->acl->user_transitions;
-+
-+ if (uidlist == NULL)
-+ return 0;
-+
-+ if (real == -1)
-+ realok = 1;
-+ if (effective == -1)
-+ effectiveok = 1;
-+ if (fs == -1)
-+ fsok = 1;
-+
-+ if (current->acl->user_trans_type & GR_ID_ALLOW) {
-+ for (i = 0; i < num; i++) {
-+ curuid = (int)uidlist[i];
-+ if (real == curuid)
-+ realok = 1;
-+ if (effective == curuid)
-+ effectiveok = 1;
-+ if (fs == curuid)
-+ fsok = 1;
-+ }
-+ } else if (current->acl->user_trans_type & GR_ID_DENY) {
-+ for (i = 0; i < num; i++) {
-+ curuid = (int)uidlist[i];
-+ if (real == curuid)
-+ break;
-+ if (effective == curuid)
-+ break;
-+ if (fs == curuid)
-+ break;
-+ }
-+ /* not in deny list */
-+ if (i == num) {
-+ realok = 1;
-+ effectiveok = 1;
-+ fsok = 1;
-+ }
-+ }
-+
-+ if (realok && effectiveok && fsok)
-+ return 0;
-+ else {
-+ gr_log_int(GR_DONT_AUDIT, GR_USRCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
-+ return 1;
-+ }
-+}
-+
-+int
-+gr_check_group_change(int real, int effective, int fs)
-+{
-+ unsigned int i;
-+ __u16 num;
-+ gid_t *gidlist;
-+ int curgid;
-+ int realok = 0;
-+ int effectiveok = 0;
-+ int fsok = 0;
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return 0;
-+
-+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
-+ gr_log_learn_id_change('g', real, effective, fs);
-+
-+ num = current->acl->group_trans_num;
-+ gidlist = current->acl->group_transitions;
-+
-+ if (gidlist == NULL)
-+ return 0;
-+
-+ if (real == -1)
-+ realok = 1;
-+ if (effective == -1)
-+ effectiveok = 1;
-+ if (fs == -1)
-+ fsok = 1;
-+
-+ if (current->acl->group_trans_type & GR_ID_ALLOW) {
-+ for (i = 0; i < num; i++) {
-+ curgid = (int)gidlist[i];
-+ if (real == curgid)
-+ realok = 1;
-+ if (effective == curgid)
-+ effectiveok = 1;
-+ if (fs == curgid)
-+ fsok = 1;
-+ }
-+ } else if (current->acl->group_trans_type & GR_ID_DENY) {
-+ for (i = 0; i < num; i++) {
-+ curgid = (int)gidlist[i];
-+ if (real == curgid)
-+ break;
-+ if (effective == curgid)
-+ break;
-+ if (fs == curgid)
-+ break;
-+ }
-+ /* not in deny list */
-+ if (i == num) {
-+ realok = 1;
-+ effectiveok = 1;
-+ fsok = 1;
-+ }
-+ }
-+
-+ if (realok && effectiveok && fsok)
-+ return 0;
-+ else {
-+ gr_log_int(GR_DONT_AUDIT, GR_GRPCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
-+ return 1;
-+ }
-+}
-+
-+extern int gr_acl_is_capable(const int cap);
-+
-+void
-+gr_set_role_label(struct task_struct *task, const uid_t uid, const uid_t gid)
-+{
-+ struct acl_role_label *role = task->role;
-+ struct acl_subject_label *subj = NULL;
-+ struct acl_object_label *obj;
-+ struct file *filp;
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return;
-+
-+ filp = task->exec_file;
-+
-+ /* kernel process, we'll give them the kernel role */
-+ if (unlikely(!filp)) {
-+ task->role = kernel_role;
-+ task->acl = kernel_role->root_label;
-+ return;
-+ } else if (!task->role || !(task->role->roletype & GR_ROLE_SPECIAL))
-+ role = lookup_acl_role_label(task, uid, gid);
-+
-+ /* don't change the role if we're not a privileged process */
-+ if (role && task->role != role &&
-+ (((role->roletype & GR_ROLE_USER) && !gr_acl_is_capable(CAP_SETUID)) ||
-+ ((role->roletype & GR_ROLE_GROUP) && !gr_acl_is_capable(CAP_SETGID))))
-+ return;
-+
-+ /* perform subject lookup in possibly new role
-+ we can use this result below in the case where role == task->role
-+ */
-+ subj = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, role);
-+
-+ /* if we changed uid/gid, but result in the same role
-+ and are using inheritance, don't lose the inherited subject
-+ if current subject is other than what normal lookup
-+ would result in, we arrived via inheritance, don't
-+ lose subject
-+ */
-+ if (role != task->role || (!(task->acl->mode & GR_INHERITLEARN) &&
-+ (subj == task->acl)))
-+ task->acl = subj;
-+
-+ task->role = role;
-+
-+ task->is_writable = 0;
-+
-+ /* ignore additional mmap checks for processes that are writable
-+ by the default ACL */
-+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
-+ if (unlikely(obj->mode & GR_WRITE))
-+ task->is_writable = 1;
-+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
-+ if (unlikely(obj->mode & GR_WRITE))
-+ task->is_writable = 1;
-+
-+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
-+ printk(KERN_ALERT "Set role label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
-+#endif
-+
-+ gr_set_proc_res(task);
-+
-+ return;
-+}
-+
-+int
-+gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
-+ const int unsafe_flags)
-+{
-+ struct task_struct *task = current;
-+ struct acl_subject_label *newacl;
-+ struct acl_object_label *obj;
-+ __u32 retmode;
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return 0;
-+
-+ newacl = chk_subj_label(dentry, mnt, task->role);
-+
-+ /* special handling for if we did an strace -f -p <pid> from an admin role, where pid then
-+ did an exec
-+ */
-+ rcu_read_lock();
-+ read_lock(&tasklist_lock);
-+ if (task->ptrace && task->parent && ((task->parent->role->roletype & GR_ROLE_GOD) ||
-+ (task->parent->acl->mode & GR_POVERRIDE))) {
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+ goto skip_check;
-+ }
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+
-+ if (unsafe_flags && !(task->acl->mode & GR_POVERRIDE) && (task->acl != newacl) &&
-+ !(task->role->roletype & GR_ROLE_GOD) &&
-+ !gr_search_file(dentry, GR_PTRACERD, mnt) &&
-+ !(task->acl->mode & (GR_LEARN | GR_INHERITLEARN))) {
-+ if (unsafe_flags & LSM_UNSAFE_SHARE)
-+ gr_log_fs_generic(GR_DONT_AUDIT, GR_UNSAFESHARE_EXEC_ACL_MSG, dentry, mnt);
-+ else
-+ gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_EXEC_ACL_MSG, dentry, mnt);
-+ return -EACCES;
-+ }
-+
-+skip_check:
-+
-+ obj = chk_obj_label(dentry, mnt, task->acl);
-+ retmode = obj->mode & (GR_INHERIT | GR_AUDIT_INHERIT);
-+
-+ if (!(task->acl->mode & GR_INHERITLEARN) &&
-+ ((newacl->mode & GR_LEARN) || !(retmode & GR_INHERIT))) {
-+ if (obj->nested)
-+ task->acl = obj->nested;
-+ else
-+ task->acl = newacl;
-+ } else if (retmode & GR_INHERIT && retmode & GR_AUDIT_INHERIT)
-+ gr_log_str_fs(GR_DO_AUDIT, GR_INHERIT_ACL_MSG, task->acl->filename, dentry, mnt);
-+
-+ task->is_writable = 0;
-+
-+ /* ignore additional mmap checks for processes that are writable
-+ by the default ACL */
-+ obj = chk_obj_label(dentry, mnt, default_role->root_label);
-+ if (unlikely(obj->mode & GR_WRITE))
-+ task->is_writable = 1;
-+ obj = chk_obj_label(dentry, mnt, task->role->root_label);
-+ if (unlikely(obj->mode & GR_WRITE))
-+ task->is_writable = 1;
-+
-+ gr_set_proc_res(task);
-+
-+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
-+ printk(KERN_ALERT "Set subject label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
-+#endif
-+ return 0;
-+}
-+
-+/* always called with valid inodev ptr */
-+static void
-+do_handle_delete(struct inodev_entry *inodev, const ino_t ino, const dev_t dev)
-+{
-+ struct acl_object_label *matchpo;
-+ struct acl_subject_label *matchps;
-+ struct acl_subject_label *subj;
-+ struct acl_role_label *role;
-+ unsigned int x;
-+
-+ FOR_EACH_ROLE_START(role)
-+ FOR_EACH_SUBJECT_START(role, subj, x)
-+ if ((matchpo = lookup_acl_obj_label(ino, dev, subj)) != NULL)
-+ matchpo->mode |= GR_DELETED;
-+ FOR_EACH_SUBJECT_END(subj,x)
-+ FOR_EACH_NESTED_SUBJECT_START(role, subj)
-+ /* nested subjects aren't in the role's subj_hash table */
-+ if ((matchpo = lookup_acl_obj_label(ino, dev, subj)) != NULL)
-+ matchpo->mode |= GR_DELETED;
-+ FOR_EACH_NESTED_SUBJECT_END(subj)
-+ if ((matchps = lookup_acl_subj_label(ino, dev, role)) != NULL)
-+ matchps->mode |= GR_DELETED;
-+ FOR_EACH_ROLE_END(role)
-+
-+ inodev->nentry->deleted = 1;
-+
-+ return;
-+}
-+
-+void
-+gr_handle_delete(const ino_t ino, const dev_t dev)
-+{
-+ struct inodev_entry *inodev;
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return;
-+
-+ write_lock(&gr_inode_lock);
-+ inodev = lookup_inodev_entry(ino, dev);
-+ if (inodev != NULL)
-+ do_handle_delete(inodev, ino, dev);
-+ write_unlock(&gr_inode_lock);
-+
-+ return;
-+}
-+
-+static void
-+update_acl_obj_label(const ino_t oldinode, const dev_t olddevice,
-+ const ino_t newinode, const dev_t newdevice,
-+ struct acl_subject_label *subj)
-+{
-+ unsigned int index = gr_fhash(oldinode, olddevice, subj->obj_hash_size);
-+ struct acl_object_label *match;
-+
-+ match = subj->obj_hash[index];
-+
-+ while (match && (match->inode != oldinode ||
-+ match->device != olddevice ||
-+ !(match->mode & GR_DELETED)))
-+ match = match->next;
-+
-+ if (match && (match->inode == oldinode)
-+ && (match->device == olddevice)
-+ && (match->mode & GR_DELETED)) {
-+ if (match->prev == NULL) {
-+ subj->obj_hash[index] = match->next;
-+ if (match->next != NULL)
-+ match->next->prev = NULL;
-+ } else {
-+ match->prev->next = match->next;
-+ if (match->next != NULL)
-+ match->next->prev = match->prev;
-+ }
-+ match->prev = NULL;
-+ match->next = NULL;
-+ match->inode = newinode;
-+ match->device = newdevice;
-+ match->mode &= ~GR_DELETED;
-+
-+ insert_acl_obj_label(match, subj);
-+ }
-+
-+ return;
-+}
-+
-+static void
-+update_acl_subj_label(const ino_t oldinode, const dev_t olddevice,
-+ const ino_t newinode, const dev_t newdevice,
-+ struct acl_role_label *role)
-+{
-+ unsigned int index = gr_fhash(oldinode, olddevice, role->subj_hash_size);
-+ struct acl_subject_label *match;
-+
-+ match = role->subj_hash[index];
-+
-+ while (match && (match->inode != oldinode ||
-+ match->device != olddevice ||
-+ !(match->mode & GR_DELETED)))
-+ match = match->next;
-+
-+ if (match && (match->inode == oldinode)
-+ && (match->device == olddevice)
-+ && (match->mode & GR_DELETED)) {
-+ if (match->prev == NULL) {
-+ role->subj_hash[index] = match->next;
-+ if (match->next != NULL)
-+ match->next->prev = NULL;
-+ } else {
-+ match->prev->next = match->next;
-+ if (match->next != NULL)
-+ match->next->prev = match->prev;
-+ }
-+ match->prev = NULL;
-+ match->next = NULL;
-+ match->inode = newinode;
-+ match->device = newdevice;
-+ match->mode &= ~GR_DELETED;
-+
-+ insert_acl_subj_label(match, role);
-+ }
-+
-+ return;
-+}
-+
-+static void
-+update_inodev_entry(const ino_t oldinode, const dev_t olddevice,
-+ const ino_t newinode, const dev_t newdevice)
-+{
-+ unsigned int index = gr_fhash(oldinode, olddevice, inodev_set.i_size);
-+ struct inodev_entry *match;
-+
-+ match = inodev_set.i_hash[index];
-+
-+ while (match && (match->nentry->inode != oldinode ||
-+ match->nentry->device != olddevice || !match->nentry->deleted))
-+ match = match->next;
-+
-+ if (match && (match->nentry->inode == oldinode)
-+ && (match->nentry->device == olddevice) &&
-+ match->nentry->deleted) {
-+ if (match->prev == NULL) {
-+ inodev_set.i_hash[index] = match->next;
-+ if (match->next != NULL)
-+ match->next->prev = NULL;
-+ } else {
-+ match->prev->next = match->next;
-+ if (match->next != NULL)
-+ match->next->prev = match->prev;
-+ }
-+ match->prev = NULL;
-+ match->next = NULL;
-+ match->nentry->inode = newinode;
-+ match->nentry->device = newdevice;
-+ match->nentry->deleted = 0;
-+
-+ insert_inodev_entry(match);
-+ }
-+
-+ return;
-+}
-+
-+static void
-+__do_handle_create(const struct name_entry *matchn, ino_t inode, dev_t dev)
-+{
-+ struct acl_subject_label *subj;
-+ struct acl_role_label *role;
-+ unsigned int x;
-+
-+ FOR_EACH_ROLE_START(role)
-+ update_acl_subj_label(matchn->inode, matchn->device,
-+ inode, dev, role);
-+
-+ FOR_EACH_NESTED_SUBJECT_START(role, subj)
-+ if ((subj->inode == inode) && (subj->device == dev)) {
-+ subj->inode = inode;
-+ subj->device = dev;
-+ }
-+ /* nested subjects aren't in the role's subj_hash table */
-+ update_acl_obj_label(matchn->inode, matchn->device,
-+ inode, dev, subj);
-+ FOR_EACH_NESTED_SUBJECT_END(subj)
-+ FOR_EACH_SUBJECT_START(role, subj, x)
-+ update_acl_obj_label(matchn->inode, matchn->device,
-+ inode, dev, subj);
-+ FOR_EACH_SUBJECT_END(subj,x)
-+ FOR_EACH_ROLE_END(role)
-+
-+ update_inodev_entry(matchn->inode, matchn->device, inode, dev);
-+
-+ return;
-+}
-+
-+static void
-+do_handle_create(const struct name_entry *matchn, const struct dentry *dentry,
-+ const struct vfsmount *mnt)
-+{
-+ ino_t ino = dentry->d_inode->i_ino;
-+ dev_t dev = __get_dev(dentry);
-+
-+ __do_handle_create(matchn, ino, dev);
-+
-+ return;
-+}
-+
-+void
-+gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ struct name_entry *matchn;
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return;
-+
-+ preempt_disable();
-+ matchn = lookup_name_entry(gr_to_filename_rbac(dentry, mnt));
-+
-+ if (unlikely((unsigned long)matchn)) {
-+ write_lock(&gr_inode_lock);
-+ do_handle_create(matchn, dentry, mnt);
-+ write_unlock(&gr_inode_lock);
-+ }
-+ preempt_enable();
-+
-+ return;
-+}
-+
-+void
-+gr_handle_proc_create(const struct dentry *dentry, const struct inode *inode)
-+{
-+ struct name_entry *matchn;
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return;
-+
-+ preempt_disable();
-+ matchn = lookup_name_entry(gr_to_proc_filename_rbac(dentry, init_pid_ns.proc_mnt));
-+
-+ if (unlikely((unsigned long)matchn)) {
-+ write_lock(&gr_inode_lock);
-+ __do_handle_create(matchn, inode->i_ino, inode->i_sb->s_dev);
-+ write_unlock(&gr_inode_lock);
-+ }
-+ preempt_enable();
-+
-+ return;
-+}
-+
-+void
-+gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
-+ struct dentry *old_dentry,
-+ struct dentry *new_dentry,
-+ struct vfsmount *mnt, const __u8 replace)
-+{
-+ struct name_entry *matchn;
-+ struct inodev_entry *inodev;
-+ struct inode *inode = new_dentry->d_inode;
-+ ino_t oldinode = old_dentry->d_inode->i_ino;
-+ dev_t olddev = __get_dev(old_dentry);
-+
-+ /* vfs_rename swaps the name and parent link for old_dentry and
-+ new_dentry
-+ at this point, old_dentry has the new name, parent link, and inode
-+ for the renamed file
-+ if a file is being replaced by a rename, new_dentry has the inode
-+ and name for the replaced file
-+ */
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return;
-+
-+ preempt_disable();
-+ matchn = lookup_name_entry(gr_to_filename_rbac(old_dentry, mnt));
-+
-+ /* we wouldn't have to check d_inode if it weren't for
-+ NFS silly-renaming
-+ */
-+
-+ write_lock(&gr_inode_lock);
-+ if (unlikely(replace && inode)) {
-+ ino_t newinode = inode->i_ino;
-+ dev_t newdev = __get_dev(new_dentry);
-+ inodev = lookup_inodev_entry(newinode, newdev);
-+ if (inodev != NULL && ((inode->i_nlink <= 1) || S_ISDIR(inode->i_mode)))
-+ do_handle_delete(inodev, newinode, newdev);
-+ }
-+
-+ inodev = lookup_inodev_entry(oldinode, olddev);
-+ if (inodev != NULL && ((old_dentry->d_inode->i_nlink <= 1) || S_ISDIR(old_dentry->d_inode->i_mode)))
-+ do_handle_delete(inodev, oldinode, olddev);
-+
-+ if (unlikely((unsigned long)matchn))
-+ do_handle_create(matchn, old_dentry, mnt);
-+
-+ write_unlock(&gr_inode_lock);
-+ preempt_enable();
-+
-+ return;
-+}
-+
-+static int
-+lookup_special_role_auth(__u16 mode, const char *rolename, unsigned char **salt,
-+ unsigned char **sum)
-+{
-+ struct acl_role_label *r;
-+ struct role_allowed_ip *ipp;
-+ struct role_transition *trans;
-+ unsigned int i;
-+ int found = 0;
-+ u32 curr_ip = current->signal->curr_ip;
-+
-+ current->signal->saved_ip = curr_ip;
-+
-+ /* check transition table */
-+
-+ for (trans = current->role->transitions; trans; trans = trans->next) {
-+ if (!strcmp(rolename, trans->rolename)) {
-+ found = 1;
-+ break;
-+ }
-+ }
-+
-+ if (!found)
-+ return 0;
-+
-+ /* handle special roles that do not require authentication
-+ and check ip */
-+
-+ FOR_EACH_ROLE_START(r)
-+ if (!strcmp(rolename, r->rolename) &&
-+ (r->roletype & GR_ROLE_SPECIAL)) {
-+ found = 0;
-+ if (r->allowed_ips != NULL) {
-+ for (ipp = r->allowed_ips; ipp; ipp = ipp->next) {
-+ if ((ntohl(curr_ip) & ipp->netmask) ==
-+ (ntohl(ipp->addr) & ipp->netmask))
-+ found = 1;
-+ }
-+ } else
-+ found = 2;
-+ if (!found)
-+ return 0;
-+
-+ if (((mode == GR_SPROLE) && (r->roletype & GR_ROLE_NOPW)) ||
-+ ((mode == GR_SPROLEPAM) && (r->roletype & GR_ROLE_PAM))) {
-+ *salt = NULL;
-+ *sum = NULL;
-+ return 1;
-+ }
-+ }
-+ FOR_EACH_ROLE_END(r)
-+
-+ for (i = 0; i < num_sprole_pws; i++) {
-+ if (!strcmp(rolename, acl_special_roles[i]->rolename)) {
-+ *salt = acl_special_roles[i]->salt;
-+ *sum = acl_special_roles[i]->sum;
-+ return 1;
-+ }
-+ }
-+
-+ return 0;
-+}
-+
-+static void
-+assign_special_role(char *rolename)
-+{
-+ struct acl_object_label *obj;
-+ struct acl_role_label *r;
-+ struct acl_role_label *assigned = NULL;
-+ struct task_struct *tsk;
-+ struct file *filp;
-+
-+ FOR_EACH_ROLE_START(r)
-+ if (!strcmp(rolename, r->rolename) &&
-+ (r->roletype & GR_ROLE_SPECIAL)) {
-+ assigned = r;
-+ break;
-+ }
-+ FOR_EACH_ROLE_END(r)
-+
-+ if (!assigned)
-+ return;
-+
-+ read_lock(&tasklist_lock);
-+ read_lock(&grsec_exec_file_lock);
-+
-+ tsk = current->real_parent;
-+ if (tsk == NULL)
-+ goto out_unlock;
-+
-+ filp = tsk->exec_file;
-+ if (filp == NULL)
-+ goto out_unlock;
-+
-+ tsk->is_writable = 0;
-+
-+ tsk->acl_sp_role = 1;
-+ tsk->acl_role_id = ++acl_sp_role_value;
-+ tsk->role = assigned;
-+ tsk->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role);
-+
-+ /* ignore additional mmap checks for processes that are writable
-+ by the default ACL */
-+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
-+ if (unlikely(obj->mode & GR_WRITE))
-+ tsk->is_writable = 1;
-+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role->root_label);
-+ if (unlikely(obj->mode & GR_WRITE))
-+ tsk->is_writable = 1;
-+
-+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
-+ printk(KERN_ALERT "Assigning special role:%s subject:%s to process (%s:%d)\n", tsk->role->rolename, tsk->acl->filename, tsk->comm, tsk->pid);
-+#endif
-+
-+out_unlock:
-+ read_unlock(&grsec_exec_file_lock);
-+ read_unlock(&tasklist_lock);
-+ return;
-+}
-+
-+int gr_check_secure_terminal(struct task_struct *task)
-+{
-+ struct task_struct *p, *p2, *p3;
-+ struct files_struct *files;
-+ struct fdtable *fdt;
-+ struct file *our_file = NULL, *file;
-+ int i;
-+
-+ if (task->signal->tty == NULL)
-+ return 1;
-+
-+ files = get_files_struct(task);
-+ if (files != NULL) {
-+ rcu_read_lock();
-+ fdt = files_fdtable(files);
-+ for (i=0; i < fdt->max_fds; i++) {
-+ file = fcheck_files(files, i);
-+ if (file && (our_file == NULL) && (file->private_data == task->signal->tty)) {
-+ get_file(file);
-+ our_file = file;
-+ }
-+ }
-+ rcu_read_unlock();
-+ put_files_struct(files);
-+ }
-+
-+ if (our_file == NULL)
-+ return 1;
-+
-+ read_lock(&tasklist_lock);
-+ do_each_thread(p2, p) {
-+ files = get_files_struct(p);
-+ if (files == NULL ||
-+ (p->signal && p->signal->tty == task->signal->tty)) {
-+ if (files != NULL)
-+ put_files_struct(files);
-+ continue;
-+ }
-+ rcu_read_lock();
-+ fdt = files_fdtable(files);
-+ for (i=0; i < fdt->max_fds; i++) {
-+ file = fcheck_files(files, i);
-+ if (file && S_ISCHR(file->f_path.dentry->d_inode->i_mode) &&
-+ file->f_path.dentry->d_inode->i_rdev == our_file->f_path.dentry->d_inode->i_rdev) {
-+ p3 = task;
-+ while (p3->pid > 0) {
-+ if (p3 == p)
-+ break;
-+ p3 = p3->real_parent;
-+ }
-+ if (p3 == p)
-+ break;
-+ gr_log_ttysniff(GR_DONT_AUDIT_GOOD, GR_TTYSNIFF_ACL_MSG, p);
-+ gr_handle_alertkill(p);
-+ rcu_read_unlock();
-+ put_files_struct(files);
-+ read_unlock(&tasklist_lock);
-+ fput(our_file);
-+ return 0;
-+ }
-+ }
-+ rcu_read_unlock();
-+ put_files_struct(files);
-+ } while_each_thread(p2, p);
-+ read_unlock(&tasklist_lock);
-+
-+ fput(our_file);
-+ return 1;
-+}
-+
-+static int gr_rbac_disable(void *unused)
-+{
-+ pax_open_kernel();
-+ gr_status &= ~GR_READY;
-+ pax_close_kernel();
-+
-+ return 0;
-+}
-+
-+ssize_t
-+write_grsec_handler(struct file *file, const char __user * buf, size_t count, loff_t *ppos)
-+{
-+ struct gr_arg_wrapper uwrap;
-+ unsigned char *sprole_salt = NULL;
-+ unsigned char *sprole_sum = NULL;
-+ int error = 0;
-+ int error2 = 0;
-+ size_t req_count = 0;
-+
-+ mutex_lock(&gr_dev_mutex);
-+
-+ if ((gr_status & GR_READY) && !(current->acl->mode & GR_KERNELAUTH)) {
-+ error = -EPERM;
-+ goto out;
-+ }
-+
-+#ifdef CONFIG_COMPAT
-+ pax_open_kernel();
-+ if (is_compat_task()) {
-+ copy_gr_arg_wrapper = ©_gr_arg_wrapper_compat;
-+ copy_gr_arg = ©_gr_arg_compat;
-+ copy_acl_object_label = ©_acl_object_label_compat;
-+ copy_acl_subject_label = ©_acl_subject_label_compat;
-+ copy_acl_role_label = ©_acl_role_label_compat;
-+ copy_acl_ip_label = ©_acl_ip_label_compat;
-+ copy_role_allowed_ip = ©_role_allowed_ip_compat;
-+ copy_role_transition = ©_role_transition_compat;
-+ copy_sprole_pw = ©_sprole_pw_compat;
-+ copy_gr_hash_struct = ©_gr_hash_struct_compat;
-+ copy_pointer_from_array = ©_pointer_from_array_compat;
-+ get_gr_arg_wrapper_size = &get_gr_arg_wrapper_size_compat;
-+ } else {
-+ copy_gr_arg_wrapper = ©_gr_arg_wrapper_normal;
-+ copy_gr_arg = ©_gr_arg_normal;
-+ copy_acl_object_label = ©_acl_object_label_normal;
-+ copy_acl_subject_label = ©_acl_subject_label_normal;
-+ copy_acl_role_label = ©_acl_role_label_normal;
-+ copy_acl_ip_label = ©_acl_ip_label_normal;
-+ copy_role_allowed_ip = ©_role_allowed_ip_normal;
-+ copy_role_transition = ©_role_transition_normal;
-+ copy_sprole_pw = ©_sprole_pw_normal;
-+ copy_gr_hash_struct = ©_gr_hash_struct_normal;
-+ copy_pointer_from_array = ©_pointer_from_array_normal;
-+ get_gr_arg_wrapper_size = &get_gr_arg_wrapper_size_normal;
-+ }
-+ pax_close_kernel();
-+#endif
-+
-+ req_count = get_gr_arg_wrapper_size();
-+
-+ if (count != req_count) {
-+ gr_log_int_int(GR_DONT_AUDIT_GOOD, GR_DEV_ACL_MSG, (int)count, (int)req_count);
-+ error = -EINVAL;
-+ goto out;
-+ }
-+
-+
-+ if (gr_auth_expires && time_after_eq(get_seconds(), gr_auth_expires)) {
-+ gr_auth_expires = 0;
-+ gr_auth_attempts = 0;
-+ }
-+
-+ error = copy_gr_arg_wrapper(buf, &uwrap);
-+ if (error)
-+ goto out;
-+
-+ error = copy_gr_arg(uwrap.arg, gr_usermode);
-+ if (error)
-+ goto out;
-+
-+ if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_SPROLEPAM &&
-+ gr_auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
-+ time_after(gr_auth_expires, get_seconds())) {
-+ error = -EBUSY;
-+ goto out;
-+ }
-+
-+ /* if non-root trying to do anything other than use a special role,
-+ do not attempt authentication, do not count towards authentication
-+ locking
-+ */
-+
-+ if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_STATUS &&
-+ gr_usermode->mode != GR_UNSPROLE && gr_usermode->mode != GR_SPROLEPAM &&
-+ current_uid()) {
-+ error = -EPERM;
-+ goto out;
-+ }
-+
-+ /* ensure pw and special role name are null terminated */
-+
-+ gr_usermode->pw[GR_PW_LEN - 1] = '\0';
-+ gr_usermode->sp_role[GR_SPROLE_LEN - 1] = '\0';
-+
-+ /* Okay.
-+ * We have our enough of the argument structure..(we have yet
-+ * to copy_from_user the tables themselves) . Copy the tables
-+ * only if we need them, i.e. for loading operations. */
-+
-+ switch (gr_usermode->mode) {
-+ case GR_STATUS:
-+ if (gr_status & GR_READY) {
-+ error = 1;
-+ if (!gr_check_secure_terminal(current))
-+ error = 3;
-+ } else
-+ error = 2;
-+ goto out;
-+ case GR_SHUTDOWN:
-+ if ((gr_status & GR_READY)
-+ && !(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
-+ stop_machine(gr_rbac_disable, NULL, NULL);
-+ free_variables();
-+ memset(gr_usermode, 0, sizeof (struct gr_arg));
-+ memset(gr_system_salt, 0, GR_SALT_LEN);
-+ memset(gr_system_sum, 0, GR_SHA_LEN);
-+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG);
-+ } else if (gr_status & GR_READY) {
-+ gr_log_noargs(GR_DONT_AUDIT, GR_SHUTF_ACL_MSG);
-+ error = -EPERM;
-+ } else {
-+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTI_ACL_MSG);
-+ error = -EAGAIN;
-+ }
-+ break;
-+ case GR_ENABLE:
-+ if (!(gr_status & GR_READY) && !(error2 = gracl_init(gr_usermode)))
-+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_ENABLE_ACL_MSG, GR_VERSION);
-+ else {
-+ if (gr_status & GR_READY)
-+ error = -EAGAIN;
-+ else
-+ error = error2;
-+ gr_log_str(GR_DONT_AUDIT, GR_ENABLEF_ACL_MSG, GR_VERSION);
-+ }
-+ break;
-+ case GR_RELOAD:
-+ if (!(gr_status & GR_READY)) {
-+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOADI_ACL_MSG, GR_VERSION);
-+ error = -EAGAIN;
-+ } else if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
-+ stop_machine(gr_rbac_disable, NULL, NULL);
-+ free_variables();
-+ error2 = gracl_init(gr_usermode);
-+ if (!error2)
-+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOAD_ACL_MSG, GR_VERSION);
-+ else {
-+ gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
-+ error = error2;
-+ }
-+ } else {
-+ gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
-+ error = -EPERM;
-+ }
-+ break;
-+ case GR_SEGVMOD:
-+ if (unlikely(!(gr_status & GR_READY))) {
-+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODI_ACL_MSG);
-+ error = -EAGAIN;
-+ break;
-+ }
-+
-+ if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
-+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODS_ACL_MSG);
-+ if (gr_usermode->segv_device && gr_usermode->segv_inode) {
-+ struct acl_subject_label *segvacl;
-+ segvacl =
-+ lookup_acl_subj_label(gr_usermode->segv_inode,
-+ gr_usermode->segv_device,
-+ current->role);
-+ if (segvacl) {
-+ segvacl->crashes = 0;
-+ segvacl->expires = 0;
-+ }
-+ } else if (gr_find_uid(gr_usermode->segv_uid) >= 0) {
-+ gr_remove_uid(gr_usermode->segv_uid);
-+ }
-+ } else {
-+ gr_log_noargs(GR_DONT_AUDIT, GR_SEGVMODF_ACL_MSG);
-+ error = -EPERM;
-+ }
-+ break;
-+ case GR_SPROLE:
-+ case GR_SPROLEPAM:
-+ if (unlikely(!(gr_status & GR_READY))) {
-+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SPROLEI_ACL_MSG);
-+ error = -EAGAIN;
-+ break;
-+ }
-+
-+ if (current->role->expires && time_after_eq(get_seconds(), current->role->expires)) {
-+ current->role->expires = 0;
-+ current->role->auth_attempts = 0;
-+ }
-+
-+ if (current->role->auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
-+ time_after(current->role->expires, get_seconds())) {
-+ error = -EBUSY;
-+ goto out;
-+ }
-+
-+ if (lookup_special_role_auth
-+ (gr_usermode->mode, gr_usermode->sp_role, &sprole_salt, &sprole_sum)
-+ && ((!sprole_salt && !sprole_sum)
-+ || !(chkpw(gr_usermode, sprole_salt, sprole_sum)))) {
-+ char *p = "";
-+ assign_special_role(gr_usermode->sp_role);
-+ read_lock(&tasklist_lock);
-+ if (current->real_parent)
-+ p = current->real_parent->role->rolename;
-+ read_unlock(&tasklist_lock);
-+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLES_ACL_MSG,
-+ p, acl_sp_role_value);
-+ } else {
-+ gr_log_str(GR_DONT_AUDIT, GR_SPROLEF_ACL_MSG, gr_usermode->sp_role);
-+ error = -EPERM;
-+ if(!(current->role->auth_attempts++))
-+ current->role->expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
-+
-+ goto out;
-+ }
-+ break;
-+ case GR_UNSPROLE:
-+ if (unlikely(!(gr_status & GR_READY))) {
-+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_UNSPROLEI_ACL_MSG);
-+ error = -EAGAIN;
-+ break;
-+ }
-+
-+ if (current->role->roletype & GR_ROLE_SPECIAL) {
-+ char *p = "";
-+ int i = 0;
-+
-+ read_lock(&tasklist_lock);
-+ if (current->real_parent) {
-+ p = current->real_parent->role->rolename;
-+ i = current->real_parent->acl_role_id;
-+ }
-+ read_unlock(&tasklist_lock);
-+
-+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_UNSPROLES_ACL_MSG, p, i);
-+ gr_set_acls(1);
-+ } else {
-+ error = -EPERM;
-+ goto out;
-+ }
-+ break;
-+ default:
-+ gr_log_int(GR_DONT_AUDIT, GR_INVMODE_ACL_MSG, gr_usermode->mode);
-+ error = -EINVAL;
-+ break;
-+ }
-+
-+ if (error != -EPERM)
-+ goto out;
-+
-+ if(!(gr_auth_attempts++))
-+ gr_auth_expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
-+
-+ out:
-+ mutex_unlock(&gr_dev_mutex);
-+
-+ if (!error)
-+ error = req_count;
-+
-+ return error;
-+}
-+
-+/* must be called with
-+ rcu_read_lock();
-+ read_lock(&tasklist_lock);
-+ read_lock(&grsec_exec_file_lock);
-+*/
-+int gr_apply_subject_to_task(struct task_struct *task)
-+{
-+ struct acl_object_label *obj;
-+ char *tmpname;
-+ struct acl_subject_label *tmpsubj;
-+ struct file *filp;
-+ struct name_entry *nmatch;
-+
-+ filp = task->exec_file;
-+ if (filp == NULL)
-+ return 0;
-+
-+ /* the following is to apply the correct subject
-+ on binaries running when the RBAC system
-+ is enabled, when the binaries have been
-+ replaced or deleted since their execution
-+ -----
-+ when the RBAC system starts, the inode/dev
-+ from exec_file will be one the RBAC system
-+ is unaware of. It only knows the inode/dev
-+ of the present file on disk, or the absence
-+ of it.
-+ */
-+ preempt_disable();
-+ tmpname = gr_to_filename_rbac(filp->f_path.dentry, filp->f_path.mnt);
-+
-+ nmatch = lookup_name_entry(tmpname);
-+ preempt_enable();
-+ tmpsubj = NULL;
-+ if (nmatch) {
-+ if (nmatch->deleted)
-+ tmpsubj = lookup_acl_subj_label_deleted(nmatch->inode, nmatch->device, task->role);
-+ else
-+ tmpsubj = lookup_acl_subj_label(nmatch->inode, nmatch->device, task->role);
-+ if (tmpsubj != NULL)
-+ task->acl = tmpsubj;
-+ }
-+ if (tmpsubj == NULL)
-+ task->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt,
-+ task->role);
-+ if (task->acl) {
-+ task->is_writable = 0;
-+ /* ignore additional mmap checks for processes that are writable
-+ by the default ACL */
-+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
-+ if (unlikely(obj->mode & GR_WRITE))
-+ task->is_writable = 1;
-+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
-+ if (unlikely(obj->mode & GR_WRITE))
-+ task->is_writable = 1;
-+
-+ gr_set_proc_res(task);
-+
-+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
-+ printk(KERN_ALERT "gr_set_acls for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
-+#endif
-+ } else {
-+ return 1;
-+ }
-+
-+ return 0;
-+}
-+
-+int
-+gr_set_acls(const int type)
-+{
-+ struct task_struct *task, *task2;
-+ struct acl_role_label *role = current->role;
-+ __u16 acl_role_id = current->acl_role_id;
-+ const struct cred *cred;
-+ int ret;
-+
-+ rcu_read_lock();
-+ read_lock(&tasklist_lock);
-+ read_lock(&grsec_exec_file_lock);
-+ do_each_thread(task2, task) {
-+ /* check to see if we're called from the exit handler,
-+ if so, only replace ACLs that have inherited the admin
-+ ACL */
-+
-+ if (type && (task->role != role ||
-+ task->acl_role_id != acl_role_id))
-+ continue;
-+
-+ task->acl_role_id = 0;
-+ task->acl_sp_role = 0;
-+
-+ if (task->exec_file) {
-+ cred = __task_cred(task);
-+ task->role = lookup_acl_role_label(task, cred->uid, cred->gid);
-+
-+ ret = gr_apply_subject_to_task(task);
-+ if (ret) {
-+ read_unlock(&grsec_exec_file_lock);
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_DEFACL_MSG, task->comm, task->pid);
-+ return ret;
-+ }
-+ } else {
-+ // it's a kernel process
-+ task->role = kernel_role;
-+ task->acl = kernel_role->root_label;
-+#ifdef CONFIG_GRKERNSEC_ACL_HIDEKERN
-+ task->acl->mode &= ~GR_PROCFIND;
-+#endif
-+ }
-+ } while_each_thread(task2, task);
-+ read_unlock(&grsec_exec_file_lock);
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+
-+ return 0;
-+}
-+
-+void
-+gr_learn_resource(const struct task_struct *task,
-+ const int res, const unsigned long wanted, const int gt)
-+{
-+ struct acl_subject_label *acl;
-+ const struct cred *cred;
-+
-+ if (unlikely((gr_status & GR_READY) &&
-+ task->acl && (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))))
-+ goto skip_reslog;
-+
-+#ifdef CONFIG_GRKERNSEC_RESLOG
-+ gr_log_resource(task, res, wanted, gt);
-+#endif
-+ skip_reslog:
-+
-+ if (unlikely(!(gr_status & GR_READY) || !wanted || res >= GR_NLIMITS))
-+ return;
-+
-+ acl = task->acl;
-+
-+ if (likely(!acl || !(acl->mode & (GR_LEARN | GR_INHERITLEARN)) ||
-+ !(acl->resmask & (1U << (unsigned short) res))))
-+ return;
-+
-+ if (wanted >= acl->res[res].rlim_cur) {
-+ unsigned long res_add;
-+
-+ res_add = wanted;
-+ switch (res) {
-+ case RLIMIT_CPU:
-+ res_add += GR_RLIM_CPU_BUMP;
-+ break;
-+ case RLIMIT_FSIZE:
-+ res_add += GR_RLIM_FSIZE_BUMP;
-+ break;
-+ case RLIMIT_DATA:
-+ res_add += GR_RLIM_DATA_BUMP;
-+ break;
-+ case RLIMIT_STACK:
-+ res_add += GR_RLIM_STACK_BUMP;
-+ break;
-+ case RLIMIT_CORE:
-+ res_add += GR_RLIM_CORE_BUMP;
-+ break;
-+ case RLIMIT_RSS:
-+ res_add += GR_RLIM_RSS_BUMP;
-+ break;
-+ case RLIMIT_NPROC:
-+ res_add += GR_RLIM_NPROC_BUMP;
-+ break;
-+ case RLIMIT_NOFILE:
-+ res_add += GR_RLIM_NOFILE_BUMP;
-+ break;
-+ case RLIMIT_MEMLOCK:
-+ res_add += GR_RLIM_MEMLOCK_BUMP;
-+ break;
-+ case RLIMIT_AS:
-+ res_add += GR_RLIM_AS_BUMP;
-+ break;
-+ case RLIMIT_LOCKS:
-+ res_add += GR_RLIM_LOCKS_BUMP;
-+ break;
-+ case RLIMIT_SIGPENDING:
-+ res_add += GR_RLIM_SIGPENDING_BUMP;
-+ break;
-+ case RLIMIT_MSGQUEUE:
-+ res_add += GR_RLIM_MSGQUEUE_BUMP;
-+ break;
-+ case RLIMIT_NICE:
-+ res_add += GR_RLIM_NICE_BUMP;
-+ break;
-+ case RLIMIT_RTPRIO:
-+ res_add += GR_RLIM_RTPRIO_BUMP;
-+ break;
-+ case RLIMIT_RTTIME:
-+ res_add += GR_RLIM_RTTIME_BUMP;
-+ break;
-+ }
-+
-+ acl->res[res].rlim_cur = res_add;
-+
-+ if (wanted > acl->res[res].rlim_max)
-+ acl->res[res].rlim_max = res_add;
-+
-+ /* only log the subject filename, since resource logging is supported for
-+ single-subject learning only */
-+ rcu_read_lock();
-+ cred = __task_cred(task);
-+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
-+ task->role->roletype, cred->uid, cred->gid, acl->filename,
-+ acl->filename, acl->res[res].rlim_cur, acl->res[res].rlim_max,
-+ "", (unsigned long) res, &task->signal->saved_ip);
-+ rcu_read_unlock();
-+ }
-+
-+ return;
-+}
-+
-+#if defined(CONFIG_PAX_HAVE_ACL_FLAGS) && (defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR))
-+void
-+pax_set_initial_flags(struct linux_binprm *bprm)
-+{
-+ struct task_struct *task = current;
-+ struct acl_subject_label *proc;
-+ unsigned long flags;
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return;
-+
-+ flags = pax_get_flags(task);
-+
-+ proc = task->acl;
-+
-+ if (proc->pax_flags & GR_PAX_DISABLE_PAGEEXEC)
-+ flags &= ~MF_PAX_PAGEEXEC;
-+ if (proc->pax_flags & GR_PAX_DISABLE_SEGMEXEC)
-+ flags &= ~MF_PAX_SEGMEXEC;
-+ if (proc->pax_flags & GR_PAX_DISABLE_RANDMMAP)
-+ flags &= ~MF_PAX_RANDMMAP;
-+ if (proc->pax_flags & GR_PAX_DISABLE_EMUTRAMP)
-+ flags &= ~MF_PAX_EMUTRAMP;
-+ if (proc->pax_flags & GR_PAX_DISABLE_MPROTECT)
-+ flags &= ~MF_PAX_MPROTECT;
-+
-+ if (proc->pax_flags & GR_PAX_ENABLE_PAGEEXEC)
-+ flags |= MF_PAX_PAGEEXEC;
-+ if (proc->pax_flags & GR_PAX_ENABLE_SEGMEXEC)
-+ flags |= MF_PAX_SEGMEXEC;
-+ if (proc->pax_flags & GR_PAX_ENABLE_RANDMMAP)
-+ flags |= MF_PAX_RANDMMAP;
-+ if (proc->pax_flags & GR_PAX_ENABLE_EMUTRAMP)
-+ flags |= MF_PAX_EMUTRAMP;
-+ if (proc->pax_flags & GR_PAX_ENABLE_MPROTECT)
-+ flags |= MF_PAX_MPROTECT;
-+
-+ pax_set_flags(task, flags);
-+
-+ return;
-+}
-+#endif
-+
-+#ifdef CONFIG_SYSCTL
-+/* Eric Biederman likes breaking userland ABI and every inode-based security
-+ system to save 35kb of memory */
-+
-+/* we modify the passed in filename, but adjust it back before returning */
-+static struct acl_object_label *gr_lookup_by_name(char *name, unsigned int len)
-+{
-+ struct name_entry *nmatch;
-+ char *p, *lastp = NULL;
-+ struct acl_object_label *obj = NULL, *tmp;
-+ struct acl_subject_label *tmpsubj;
-+ char c = '\0';
-+
-+ read_lock(&gr_inode_lock);
-+
-+ p = name + len - 1;
-+ do {
-+ nmatch = lookup_name_entry(name);
-+ if (lastp != NULL)
-+ *lastp = c;
-+
-+ if (nmatch == NULL)
-+ goto next_component;
-+ tmpsubj = current->acl;
-+ do {
-+ obj = lookup_acl_obj_label(nmatch->inode, nmatch->device, tmpsubj);
-+ if (obj != NULL) {
-+ tmp = obj->globbed;
-+ while (tmp) {
-+ if (!glob_match(tmp->filename, name)) {
-+ obj = tmp;
-+ goto found_obj;
-+ }
-+ tmp = tmp->next;
-+ }
-+ goto found_obj;
-+ }
-+ } while ((tmpsubj = tmpsubj->parent_subject));
-+next_component:
-+ /* end case */
-+ if (p == name)
-+ break;
-+
-+ while (*p != '/')
-+ p--;
-+ if (p == name)
-+ lastp = p + 1;
-+ else {
-+ lastp = p;
-+ p--;
-+ }
-+ c = *lastp;
-+ *lastp = '\0';
-+ } while (1);
-+found_obj:
-+ read_unlock(&gr_inode_lock);
-+ /* obj returned will always be non-null */
-+ return obj;
-+}
-+
-+/* returns 0 when allowing, non-zero on error
-+ op of 0 is used for readdir, so we don't log the names of hidden files
-+*/
-+__u32
-+gr_handle_sysctl(const struct ctl_table *table, const int op)
-+{
-+ ctl_table *tmp;
-+ const char *proc_sys = "/proc/sys";
-+ char *path;
-+ struct acl_object_label *obj;
-+ unsigned short len = 0, pos = 0, depth = 0, i;
-+ __u32 err = 0;
-+ __u32 mode = 0;
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return 0;
-+
-+ /* for now, ignore operations on non-sysctl entries if it's not a
-+ readdir*/
-+ if (table->child != NULL && op != 0)
-+ return 0;
-+
-+ mode |= GR_FIND;
-+ /* it's only a read if it's an entry, read on dirs is for readdir */
-+ if (op & MAY_READ)
-+ mode |= GR_READ;
-+ if (op & MAY_WRITE)
-+ mode |= GR_WRITE;
-+
-+ preempt_disable();
-+
-+ path = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
-+
-+ /* it's only a read/write if it's an actual entry, not a dir
-+ (which are opened for readdir)
-+ */
-+
-+ /* convert the requested sysctl entry into a pathname */
-+
-+ for (tmp = (ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
-+ len += strlen(tmp->procname);
-+ len++;
-+ depth++;
-+ }
-+
-+ if ((len + depth + strlen(proc_sys) + 1) > PAGE_SIZE) {
-+ /* deny */
-+ goto out;
-+ }
-+
-+ memset(path, 0, PAGE_SIZE);
-+
-+ memcpy(path, proc_sys, strlen(proc_sys));
-+
-+ pos += strlen(proc_sys);
-+
-+ for (; depth > 0; depth--) {
-+ path[pos] = '/';
-+ pos++;
-+ for (i = 1, tmp = (ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
-+ if (depth == i) {
-+ memcpy(path + pos, tmp->procname,
-+ strlen(tmp->procname));
-+ pos += strlen(tmp->procname);
-+ }
-+ i++;
-+ }
-+ }
-+
-+ obj = gr_lookup_by_name(path, pos);
-+ err = obj->mode & (mode | to_gr_audit(mode) | GR_SUPPRESS);
-+
-+ if (unlikely((current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) &&
-+ ((err & mode) != mode))) {
-+ __u32 new_mode = mode;
-+
-+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
-+
-+ err = 0;
-+ gr_log_learn_sysctl(path, new_mode);
-+ } else if (!(err & GR_FIND) && !(err & GR_SUPPRESS) && op != 0) {
-+ gr_log_hidden_sysctl(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, path);
-+ err = -ENOENT;
-+ } else if (!(err & GR_FIND)) {
-+ err = -ENOENT;
-+ } else if (((err & mode) & ~GR_FIND) != (mode & ~GR_FIND) && !(err & GR_SUPPRESS)) {
-+ gr_log_str4(GR_DONT_AUDIT, GR_SYSCTL_ACL_MSG, "denied",
-+ path, (mode & GR_READ) ? " reading" : "",
-+ (mode & GR_WRITE) ? " writing" : "");
-+ err = -EACCES;
-+ } else if ((err & mode) != mode) {
-+ err = -EACCES;
-+ } else if ((((err & mode) & ~GR_FIND) == (mode & ~GR_FIND)) && (err & GR_AUDITS)) {
-+ gr_log_str4(GR_DO_AUDIT, GR_SYSCTL_ACL_MSG, "successful",
-+ path, (mode & GR_READ) ? " reading" : "",
-+ (mode & GR_WRITE) ? " writing" : "");
-+ err = 0;
-+ } else
-+ err = 0;
-+
-+ out:
-+ preempt_enable();
-+
-+ return err;
-+}
-+#endif
-+
-+int
-+gr_handle_proc_ptrace(struct task_struct *task)
-+{
-+ struct file *filp;
-+ struct task_struct *tmp = task;
-+ struct task_struct *curtemp = current;
-+ __u32 retmode;
-+
-+#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return 0;
-+#endif
-+
-+ read_lock(&tasklist_lock);
-+ read_lock(&grsec_exec_file_lock);
-+ filp = task->exec_file;
-+
-+ while (tmp->pid > 0) {
-+ if (tmp == curtemp)
-+ break;
-+ tmp = tmp->real_parent;
-+ }
-+
-+ if (!filp || (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
-+ ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE))))) {
-+ read_unlock(&grsec_exec_file_lock);
-+ read_unlock(&tasklist_lock);
-+ return 1;
-+ }
-+
-+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+ if (!(gr_status & GR_READY)) {
-+ read_unlock(&grsec_exec_file_lock);
-+ read_unlock(&tasklist_lock);
-+ return 0;
-+ }
-+#endif
-+
-+ retmode = gr_search_file(filp->f_path.dentry, GR_NOPTRACE, filp->f_path.mnt);
-+ read_unlock(&grsec_exec_file_lock);
-+ read_unlock(&tasklist_lock);
-+
-+ if (retmode & GR_NOPTRACE)
-+ return 1;
-+
-+ if (!(current->acl->mode & GR_POVERRIDE) && !(current->role->roletype & GR_ROLE_GOD)
-+ && (current->acl != task->acl || (current->acl != current->role->root_label
-+ && current->pid != task->pid)))
-+ return 1;
-+
-+ return 0;
-+}
-+
-+void task_grsec_rbac(struct seq_file *m, struct task_struct *p)
-+{
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return;
-+
-+ if (!(current->role->roletype & GR_ROLE_GOD))
-+ return;
-+
-+ seq_printf(m, "RBAC:\t%.64s:%c:%.950s\n",
-+ p->role->rolename, gr_task_roletype_to_char(p),
-+ p->acl->filename);
-+}
-+
-+int
-+gr_handle_ptrace(struct task_struct *task, const long request)
-+{
-+ struct task_struct *tmp = task;
-+ struct task_struct *curtemp = current;
-+ __u32 retmode;
-+
-+#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return 0;
-+#endif
-+
-+ if (request == PTRACE_ATTACH) {
-+ read_lock(&tasklist_lock);
-+ while (tmp->pid > 0) {
-+ if (tmp == curtemp)
-+ break;
-+ tmp = tmp->real_parent;
-+ }
-+
-+ if (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
-+ ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE)))) {
-+ read_unlock(&tasklist_lock);
-+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
-+ return 1;
-+ }
-+ read_unlock(&tasklist_lock);
-+ }
-+
-+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+ if (!(gr_status & GR_READY))
-+ return 0;
-+#endif
-+
-+ read_lock(&grsec_exec_file_lock);
-+ if (unlikely(!task->exec_file)) {
-+ read_unlock(&grsec_exec_file_lock);
-+ return 0;
-+ }
-+
-+ retmode = gr_search_file(task->exec_file->f_path.dentry, GR_PTRACERD | GR_NOPTRACE, task->exec_file->f_path.mnt);
-+ read_unlock(&grsec_exec_file_lock);
-+
-+ if (retmode & GR_NOPTRACE) {
-+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
-+ return 1;
-+ }
-+
-+ if (retmode & GR_PTRACERD) {
-+ switch (request) {
-+ case PTRACE_POKETEXT:
-+ case PTRACE_POKEDATA:
-+ case PTRACE_POKEUSR:
-+#if !defined(CONFIG_PPC32) && !defined(CONFIG_PPC64) && !defined(CONFIG_PARISC) && !defined(CONFIG_ALPHA) && !defined(CONFIG_IA64)
-+ case PTRACE_SETREGS:
-+ case PTRACE_SETFPREGS:
-+#endif
-+#ifdef CONFIG_X86
-+ case PTRACE_SETFPXREGS:
-+#endif
-+#ifdef CONFIG_ALTIVEC
-+ case PTRACE_SETVRREGS:
-+#endif
-+ return 1;
-+ default:
-+ return 0;
-+ }
-+ } else if (!(current->acl->mode & GR_POVERRIDE) &&
-+ !(current->role->roletype & GR_ROLE_GOD) &&
-+ (current->acl != task->acl)) {
-+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
-+ return 1;
-+ }
-+
-+ return 0;
-+}
-+
-+static int is_writable_mmap(const struct file *filp)
-+{
-+ struct task_struct *task = current;
-+ struct acl_object_label *obj, *obj2;
-+
-+ if (gr_status & GR_READY && !(task->acl->mode & GR_OVERRIDE) &&
-+ !task->is_writable && S_ISREG(filp->f_path.dentry->d_inode->i_mode) && (filp->f_path.mnt != shm_mnt || (filp->f_path.dentry->d_inode->i_nlink > 0))) {
-+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
-+ obj2 = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt,
-+ task->role->root_label);
-+ if (unlikely((obj->mode & GR_WRITE) || (obj2->mode & GR_WRITE))) {
-+ gr_log_fs_generic(GR_DONT_AUDIT, GR_WRITLIB_ACL_MSG, filp->f_path.dentry, filp->f_path.mnt);
-+ return 1;
-+ }
-+ }
-+ return 0;
-+}
-+
-+int
-+gr_acl_handle_mmap(const struct file *file, const unsigned long prot)
-+{
-+ __u32 mode;
-+
-+ if (unlikely(!file || !(prot & PROT_EXEC)))
-+ return 1;
-+
-+ if (is_writable_mmap(file))
-+ return 0;
-+
-+ mode =
-+ gr_search_file(file->f_path.dentry,
-+ GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
-+ file->f_path.mnt);
-+
-+ if (!gr_tpe_allow(file))
-+ return 0;
-+
-+ if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
-+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
-+ return 0;
-+ } else if (unlikely(!(mode & GR_EXEC))) {
-+ return 0;
-+ } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
-+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
-+ return 1;
-+ }
-+
-+ return 1;
-+}
-+
-+int
-+gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
-+{
-+ __u32 mode;
-+
-+ if (unlikely(!file || !(prot & PROT_EXEC)))
-+ return 1;
-+
-+ if (is_writable_mmap(file))
-+ return 0;
-+
-+ mode =
-+ gr_search_file(file->f_path.dentry,
-+ GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
-+ file->f_path.mnt);
-+
-+ if (!gr_tpe_allow(file))
-+ return 0;
-+
-+ if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
-+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
-+ return 0;
-+ } else if (unlikely(!(mode & GR_EXEC))) {
-+ return 0;
-+ } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
-+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
-+ return 1;
-+ }
-+
-+ return 1;
-+}
-+
-+void
-+gr_acl_handle_psacct(struct task_struct *task, const long code)
-+{
-+ unsigned long runtime;
-+ unsigned long cputime;
-+ unsigned int wday, cday;
-+ __u8 whr, chr;
-+ __u8 wmin, cmin;
-+ __u8 wsec, csec;
-+ struct timespec timeval;
-+
-+ if (unlikely(!(gr_status & GR_READY) || !task->acl ||
-+ !(task->acl->mode & GR_PROCACCT)))
-+ return;
-+
-+ do_posix_clock_monotonic_gettime(&timeval);
-+ runtime = timeval.tv_sec - task->start_time.tv_sec;
-+ wday = runtime / (3600 * 24);
-+ runtime -= wday * (3600 * 24);
-+ whr = runtime / 3600;
-+ runtime -= whr * 3600;
-+ wmin = runtime / 60;
-+ runtime -= wmin * 60;
-+ wsec = runtime;
-+
-+ cputime = (task->utime + task->stime) / HZ;
-+ cday = cputime / (3600 * 24);
-+ cputime -= cday * (3600 * 24);
-+ chr = cputime / 3600;
-+ cputime -= chr * 3600;
-+ cmin = cputime / 60;
-+ cputime -= cmin * 60;
-+ csec = cputime;
-+
-+ gr_log_procacct(GR_DO_AUDIT, GR_ACL_PROCACCT_MSG, task, wday, whr, wmin, wsec, cday, chr, cmin, csec, code);
-+
-+ return;
-+}
-+
-+void gr_set_kernel_label(struct task_struct *task)
-+{
-+ if (gr_status & GR_READY) {
-+ task->role = kernel_role;
-+ task->acl = kernel_role->root_label;
-+ }
-+ return;
-+}
-+
-+#ifdef CONFIG_TASKSTATS
-+int gr_is_taskstats_denied(int pid)
-+{
-+ struct task_struct *task;
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ const struct cred *cred;
-+#endif
-+ int ret = 0;
-+
-+ /* restrict taskstats viewing to un-chrooted root users
-+ who have the 'view' subject flag if the RBAC system is enabled
-+ */
-+
-+ rcu_read_lock();
-+ read_lock(&tasklist_lock);
-+ task = find_task_by_vpid(pid);
-+ if (task) {
-+#ifdef CONFIG_GRKERNSEC_CHROOT
-+ if (proc_is_chrooted(task))
-+ ret = -EACCES;
-+#endif
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ cred = __task_cred(task);
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+ if (cred->uid != 0)
-+ ret = -EACCES;
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ if (cred->uid != 0 && !groups_search(cred->group_info, grsec_proc_gid))
-+ ret = -EACCES;
-+#endif
-+#endif
-+ if (gr_status & GR_READY) {
-+ if (!(task->acl->mode & GR_VIEW))
-+ ret = -EACCES;
-+ }
-+ } else
-+ ret = -ENOENT;
-+
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+
-+ return ret;
-+}
-+#endif
-+
-+/* AUXV entries are filled via a descendant of search_binary_handler
-+ after we've already applied the subject for the target
-+*/
-+int gr_acl_enable_at_secure(void)
-+{
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return 0;
-+
-+ if (current->acl->mode & GR_ATSECURE)
-+ return 1;
-+
-+ return 0;
-+}
-+
-+int gr_acl_handle_filldir(const struct file *file, const char *name, const unsigned int namelen, const ino_t ino)
-+{
-+ struct task_struct *task = current;
-+ struct dentry *dentry = file->f_path.dentry;
-+ struct vfsmount *mnt = file->f_path.mnt;
-+ struct acl_object_label *obj, *tmp;
-+ struct acl_subject_label *subj;
-+ unsigned int bufsize;
-+ int is_not_root;
-+ char *path;
-+ dev_t dev = __get_dev(dentry);
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return 1;
-+
-+ if (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))
-+ return 1;
-+
-+ /* ignore Eric Biederman */
-+ if (IS_PRIVATE(dentry->d_inode))
-+ return 1;
-+
-+ subj = task->acl;
-+ read_lock(&gr_inode_lock);
-+ do {
-+ obj = lookup_acl_obj_label(ino, dev, subj);
-+ if (obj != NULL) {
-+ read_unlock(&gr_inode_lock);
-+ return (obj->mode & GR_FIND) ? 1 : 0;
-+ }
-+ } while ((subj = subj->parent_subject));
-+ read_unlock(&gr_inode_lock);
-+
-+ /* this is purely an optimization since we're looking for an object
-+ for the directory we're doing a readdir on
-+ if it's possible for any globbed object to match the entry we're
-+ filling into the directory, then the object we find here will be
-+ an anchor point with attached globbed objects
-+ */
-+ obj = chk_obj_label_noglob(dentry, mnt, task->acl);
-+ if (obj->globbed == NULL)
-+ return (obj->mode & GR_FIND) ? 1 : 0;
-+
-+ is_not_root = ((obj->filename[0] == '/') &&
-+ (obj->filename[1] == '\0')) ? 0 : 1;
-+ bufsize = PAGE_SIZE - namelen - is_not_root;
-+
-+ /* check bufsize > PAGE_SIZE || bufsize == 0 */
-+ if (unlikely((bufsize - 1) > (PAGE_SIZE - 1)))
-+ return 1;
-+
-+ preempt_disable();
-+ path = d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
-+ bufsize);
-+
-+ bufsize = strlen(path);
-+
-+ /* if base is "/", don't append an additional slash */
-+ if (is_not_root)
-+ *(path + bufsize) = '/';
-+ memcpy(path + bufsize + is_not_root, name, namelen);
-+ *(path + bufsize + namelen + is_not_root) = '\0';
-+
-+ tmp = obj->globbed;
-+ while (tmp) {
-+ if (!glob_match(tmp->filename, path)) {
-+ preempt_enable();
-+ return (tmp->mode & GR_FIND) ? 1 : 0;
-+ }
-+ tmp = tmp->next;
-+ }
-+ preempt_enable();
-+ return (obj->mode & GR_FIND) ? 1 : 0;
-+}
-+
-+void gr_put_exec_file(struct task_struct *task)
-+{
-+ struct file *filp;
-+
-+ write_lock(&grsec_exec_file_lock);
-+ filp = task->exec_file;
-+ task->exec_file = NULL;
-+ write_unlock(&grsec_exec_file_lock);
-+
-+ if (filp)
-+ fput(filp);
-+
-+ return;
-+}
-+
-+
-+#ifdef CONFIG_NETFILTER_XT_MATCH_GRADM_MODULE
-+EXPORT_SYMBOL(gr_acl_is_enabled);
-+#endif
-+EXPORT_SYMBOL(gr_learn_resource);
-+EXPORT_SYMBOL(gr_set_kernel_label);
-+#ifdef CONFIG_SECURITY
-+EXPORT_SYMBOL(gr_check_user_change);
-+EXPORT_SYMBOL(gr_check_group_change);
-+#endif
-+
-diff --git a/grsecurity/gracl_alloc.c b/grsecurity/gracl_alloc.c
-new file mode 100644
-index 0000000..34fefda
---- /dev/null
-+++ b/grsecurity/gracl_alloc.c
-@@ -0,0 +1,105 @@
-+#include <linux/kernel.h>
-+#include <linux/mm.h>
-+#include <linux/slab.h>
-+#include <linux/vmalloc.h>
-+#include <linux/gracl.h>
-+#include <linux/grsecurity.h>
-+
-+static unsigned long alloc_stack_next = 1;
-+static unsigned long alloc_stack_size = 1;
-+static void **alloc_stack;
-+
-+static __inline__ int
-+alloc_pop(void)
-+{
-+ if (alloc_stack_next == 1)
-+ return 0;
-+
-+ kfree(alloc_stack[alloc_stack_next - 2]);
-+
-+ alloc_stack_next--;
-+
-+ return 1;
-+}
-+
-+static __inline__ int
-+alloc_push(void *buf)
-+{
-+ if (alloc_stack_next >= alloc_stack_size)
-+ return 1;
-+
-+ alloc_stack[alloc_stack_next - 1] = buf;
-+
-+ alloc_stack_next++;
-+
-+ return 0;
-+}
-+
-+void *
-+acl_alloc(unsigned long len)
-+{
-+ void *ret = NULL;
-+
-+ if (!len || len > PAGE_SIZE)
-+ goto out;
-+
-+ ret = kmalloc(len, GFP_KERNEL);
-+
-+ if (ret) {
-+ if (alloc_push(ret)) {
-+ kfree(ret);
-+ ret = NULL;
-+ }
-+ }
-+
-+out:
-+ return ret;
-+}
-+
-+void *
-+acl_alloc_num(unsigned long num, unsigned long len)
-+{
-+ if (!len || (num > (PAGE_SIZE / len)))
-+ return NULL;
-+
-+ return acl_alloc(num * len);
-+}
-+
-+void
-+acl_free_all(void)
-+{
-+ if (gr_acl_is_enabled() || !alloc_stack)
-+ return;
-+
-+ while (alloc_pop()) ;
-+
-+ if (alloc_stack) {
-+ if ((alloc_stack_size * sizeof (void *)) <= PAGE_SIZE)
-+ kfree(alloc_stack);
-+ else
-+ vfree(alloc_stack);
-+ }
-+
-+ alloc_stack = NULL;
-+ alloc_stack_size = 1;
-+ alloc_stack_next = 1;
-+
-+ return;
-+}
-+
-+int
-+acl_alloc_stack_init(unsigned long size)
-+{
-+ if ((size * sizeof (void *)) <= PAGE_SIZE)
-+ alloc_stack =
-+ (void **) kmalloc(size * sizeof (void *), GFP_KERNEL);
-+ else
-+ alloc_stack = (void **) vmalloc(size * sizeof (void *));
-+
-+ alloc_stack_size = size;
-+
-+ if (!alloc_stack)
-+ return 0;
-+ else
-+ return 1;
-+}
-diff --git a/grsecurity/gracl_cap.c b/grsecurity/gracl_cap.c
-new file mode 100644
-index 0000000..955ddfb
---- /dev/null
-+++ b/grsecurity/gracl_cap.c
-@@ -0,0 +1,101 @@
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/sched.h>
-+#include <linux/gracl.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+extern const char *captab_log[];
-+extern int captab_log_entries;
-+
-+int
-+gr_acl_is_capable(const int cap)
-+{
-+ struct task_struct *task = current;
-+ const struct cred *cred = current_cred();
-+ struct acl_subject_label *curracl;
-+ kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
-+ kernel_cap_t cap_audit = __cap_empty_set;
-+
-+ if (!gr_acl_is_enabled())
-+ return 1;
-+
-+ curracl = task->acl;
-+
-+ cap_drop = curracl->cap_lower;
-+ cap_mask = curracl->cap_mask;
-+ cap_audit = curracl->cap_invert_audit;
-+
-+ while ((curracl = curracl->parent_subject)) {
-+ /* if the cap isn't specified in the current computed mask but is specified in the
-+ current level subject, and is lowered in the current level subject, then add
-+ it to the set of dropped capabilities
-+ otherwise, add the current level subject's mask to the current computed mask
-+ */
-+ if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
-+ cap_raise(cap_mask, cap);
-+ if (cap_raised(curracl->cap_lower, cap))
-+ cap_raise(cap_drop, cap);
-+ if (cap_raised(curracl->cap_invert_audit, cap))
-+ cap_raise(cap_audit, cap);
-+ }
-+ }
-+
-+ if (!cap_raised(cap_drop, cap)) {
-+ if (cap_raised(cap_audit, cap))
-+ gr_log_cap(GR_DO_AUDIT, GR_CAP_ACL_MSG2, task, captab_log[cap]);
-+ return 1;
-+ }
-+
-+ curracl = task->acl;
-+
-+ if ((curracl->mode & (GR_LEARN | GR_INHERITLEARN))
-+ && cap_raised(cred->cap_effective, cap)) {
-+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
-+ task->role->roletype, cred->uid,
-+ cred->gid, task->exec_file ?
-+ gr_to_filename(task->exec_file->f_path.dentry,
-+ task->exec_file->f_path.mnt) : curracl->filename,
-+ curracl->filename, 0UL,
-+ 0UL, "", (unsigned long) cap, &task->signal->saved_ip);
-+ return 1;
-+ }
-+
-+ if ((cap >= 0) && (cap < captab_log_entries) && cap_raised(cred->cap_effective, cap) && !cap_raised(cap_audit, cap))
-+ gr_log_cap(GR_DONT_AUDIT, GR_CAP_ACL_MSG, task, captab_log[cap]);
-+ return 0;
-+}
-+
-+int
-+gr_acl_is_capable_nolog(const int cap)
-+{
-+ struct acl_subject_label *curracl;
-+ kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
-+
-+ if (!gr_acl_is_enabled())
-+ return 1;
-+
-+ curracl = current->acl;
-+
-+ cap_drop = curracl->cap_lower;
-+ cap_mask = curracl->cap_mask;
-+
-+ while ((curracl = curracl->parent_subject)) {
-+ /* if the cap isn't specified in the current computed mask but is specified in the
-+ current level subject, and is lowered in the current level subject, then add
-+ it to the set of dropped capabilities
-+ otherwise, add the current level subject's mask to the current computed mask
-+ */
-+ if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
-+ cap_raise(cap_mask, cap);
-+ if (cap_raised(curracl->cap_lower, cap))
-+ cap_raise(cap_drop, cap);
-+ }
-+ }
-+
-+ if (!cap_raised(cap_drop, cap))
-+ return 1;
-+
-+ return 0;
-+}
-+
-diff --git a/grsecurity/gracl_compat.c b/grsecurity/gracl_compat.c
-new file mode 100644
-index 0000000..a43dd06
---- /dev/null
-+++ b/grsecurity/gracl_compat.c
-@@ -0,0 +1,269 @@
-+#include <linux/kernel.h>
-+#include <linux/gracl.h>
-+#include <linux/compat.h>
-+#include <linux/gracl_compat.h>
-+
-+#include <asm/uaccess.h>
-+
-+int copy_gr_arg_wrapper_compat(const char *buf, struct gr_arg_wrapper *uwrap)
-+{
-+ struct gr_arg_wrapper_compat uwrapcompat;
-+
-+ if (copy_from_user(&uwrapcompat, buf, sizeof(uwrapcompat)))
-+ return -EFAULT;
-+
-+ if ((uwrapcompat.version != GRSECURITY_VERSION) ||
-+ (uwrapcompat.size != sizeof(struct gr_arg_compat)))
-+ return -EINVAL;
-+
-+ uwrap->arg = compat_ptr(uwrapcompat.arg);
-+ uwrap->version = uwrapcompat.version;
-+ uwrap->size = sizeof(struct gr_arg);
-+
-+ return 0;
-+}
-+
-+int copy_gr_arg_compat(const struct gr_arg __user *buf, struct gr_arg *arg)
-+{
-+ struct gr_arg_compat argcompat;
-+
-+ if (copy_from_user(&argcompat, buf, sizeof(argcompat)))
-+ return -EFAULT;
-+
-+ arg->role_db.r_table = compat_ptr(argcompat.role_db.r_table);
-+ arg->role_db.num_pointers = argcompat.role_db.num_pointers;
-+ arg->role_db.num_roles = argcompat.role_db.num_roles;
-+ arg->role_db.num_domain_children = argcompat.role_db.num_domain_children;
-+ arg->role_db.num_subjects = argcompat.role_db.num_subjects;
-+ arg->role_db.num_objects = argcompat.role_db.num_objects;
-+
-+ memcpy(&arg->pw, &argcompat.pw, sizeof(arg->pw));
-+ memcpy(&arg->salt, &argcompat.salt, sizeof(arg->salt));
-+ memcpy(&arg->sum, &argcompat.sum, sizeof(arg->sum));
-+ memcpy(&arg->sp_role, &argcompat.sp_role, sizeof(arg->sp_role));
-+ arg->sprole_pws = compat_ptr(argcompat.sprole_pws);
-+ arg->segv_device = argcompat.segv_device;
-+ arg->segv_inode = argcompat.segv_inode;
-+ arg->segv_uid = argcompat.segv_uid;
-+ arg->num_sprole_pws = argcompat.num_sprole_pws;
-+ arg->mode = argcompat.mode;
-+
-+ return 0;
-+}
-+
-+int copy_acl_object_label_compat(struct acl_object_label *obj, const struct acl_object_label *userp)
-+{
-+ struct acl_object_label_compat objcompat;
-+
-+ if (copy_from_user(&objcompat, userp, sizeof(objcompat)))
-+ return -EFAULT;
-+
-+ obj->filename = compat_ptr(objcompat.filename);
-+ obj->inode = objcompat.inode;
-+ obj->device = objcompat.device;
-+ obj->mode = objcompat.mode;
-+
-+ obj->nested = compat_ptr(objcompat.nested);
-+ obj->globbed = compat_ptr(objcompat.globbed);
-+
-+ obj->prev = compat_ptr(objcompat.prev);
-+ obj->next = compat_ptr(objcompat.next);
-+
-+ return 0;
-+}
-+
-+int copy_acl_subject_label_compat(struct acl_subject_label *subj, const struct acl_subject_label *userp)
-+{
-+ unsigned int i;
-+ struct acl_subject_label_compat subjcompat;
-+
-+ if (copy_from_user(&subjcompat, userp, sizeof(subjcompat)))
-+ return -EFAULT;
-+
-+ subj->filename = compat_ptr(subjcompat.filename);
-+ subj->inode = subjcompat.inode;
-+ subj->device = subjcompat.device;
-+ subj->mode = subjcompat.mode;
-+ subj->cap_mask = subjcompat.cap_mask;
-+ subj->cap_lower = subjcompat.cap_lower;
-+ subj->cap_invert_audit = subjcompat.cap_invert_audit;
-+
-+ for (i = 0; i < GR_NLIMITS; i++) {
-+ if (subjcompat.res[i].rlim_cur == COMPAT_RLIM_INFINITY)
-+ subj->res[i].rlim_cur = RLIM_INFINITY;
-+ else
-+ subj->res[i].rlim_cur = subjcompat.res[i].rlim_cur;
-+ if (subjcompat.res[i].rlim_max == COMPAT_RLIM_INFINITY)
-+ subj->res[i].rlim_max = RLIM_INFINITY;
-+ else
-+ subj->res[i].rlim_max = subjcompat.res[i].rlim_max;
-+ }
-+ subj->resmask = subjcompat.resmask;
-+
-+ subj->user_trans_type = subjcompat.user_trans_type;
-+ subj->group_trans_type = subjcompat.group_trans_type;
-+ subj->user_transitions = compat_ptr(subjcompat.user_transitions);
-+ subj->group_transitions = compat_ptr(subjcompat.group_transitions);
-+ subj->user_trans_num = subjcompat.user_trans_num;
-+ subj->group_trans_num = subjcompat.group_trans_num;
-+
-+ memcpy(&subj->sock_families, &subjcompat.sock_families, sizeof(subj->sock_families));
-+ memcpy(&subj->ip_proto, &subjcompat.ip_proto, sizeof(subj->ip_proto));
-+ subj->ip_type = subjcompat.ip_type;
-+ subj->ips = compat_ptr(subjcompat.ips);
-+ subj->ip_num = subjcompat.ip_num;
-+ subj->inaddr_any_override = subjcompat.inaddr_any_override;
-+
-+ subj->crashes = subjcompat.crashes;
-+ subj->expires = subjcompat.expires;
-+
-+ subj->parent_subject = compat_ptr(subjcompat.parent_subject);
-+ subj->hash = compat_ptr(subjcompat.hash);
-+ subj->prev = compat_ptr(subjcompat.prev);
-+ subj->next = compat_ptr(subjcompat.next);
-+
-+ subj->obj_hash = compat_ptr(subjcompat.obj_hash);
-+ subj->obj_hash_size = subjcompat.obj_hash_size;
-+ subj->pax_flags = subjcompat.pax_flags;
-+
-+ return 0;
-+}
-+
-+int copy_acl_role_label_compat(struct acl_role_label *role, const struct acl_role_label *userp)
-+{
-+ struct acl_role_label_compat rolecompat;
-+
-+ if (copy_from_user(&rolecompat, userp, sizeof(rolecompat)))
-+ return -EFAULT;
-+
-+ role->rolename = compat_ptr(rolecompat.rolename);
-+ role->uidgid = rolecompat.uidgid;
-+ role->roletype = rolecompat.roletype;
-+
-+ role->auth_attempts = rolecompat.auth_attempts;
-+ role->expires = rolecompat.expires;
-+
-+ role->root_label = compat_ptr(rolecompat.root_label);
-+ role->hash = compat_ptr(rolecompat.hash);
-+
-+ role->prev = compat_ptr(rolecompat.prev);
-+ role->next = compat_ptr(rolecompat.next);
-+
-+ role->transitions = compat_ptr(rolecompat.transitions);
-+ role->allowed_ips = compat_ptr(rolecompat.allowed_ips);
-+ role->domain_children = compat_ptr(rolecompat.domain_children);
-+ role->domain_child_num = rolecompat.domain_child_num;
-+
-+ role->umask = rolecompat.umask;
-+
-+ role->subj_hash = compat_ptr(rolecompat.subj_hash);
-+ role->subj_hash_size = rolecompat.subj_hash_size;
-+
-+ return 0;
-+}
-+
-+int copy_role_allowed_ip_compat(struct role_allowed_ip *roleip, const struct role_allowed_ip *userp)
-+{
-+ struct role_allowed_ip_compat roleip_compat;
-+
-+ if (copy_from_user(&roleip_compat, userp, sizeof(roleip_compat)))
-+ return -EFAULT;
-+
-+ roleip->addr = roleip_compat.addr;
-+ roleip->netmask = roleip_compat.netmask;
-+
-+ roleip->prev = compat_ptr(roleip_compat.prev);
-+ roleip->next = compat_ptr(roleip_compat.next);
-+
-+ return 0;
-+}
-+
-+int copy_role_transition_compat(struct role_transition *trans, const struct role_transition *userp)
-+{
-+ struct role_transition_compat trans_compat;
-+
-+ if (copy_from_user(&trans_compat, userp, sizeof(trans_compat)))
-+ return -EFAULT;
-+
-+ trans->rolename = compat_ptr(trans_compat.rolename);
-+
-+ trans->prev = compat_ptr(trans_compat.prev);
-+ trans->next = compat_ptr(trans_compat.next);
-+
-+ return 0;
-+
-+}
-+
-+int copy_gr_hash_struct_compat(struct gr_hash_struct *hash, const struct gr_hash_struct *userp)
-+{
-+ struct gr_hash_struct_compat hash_compat;
-+
-+ if (copy_from_user(&hash_compat, userp, sizeof(hash_compat)))
-+ return -EFAULT;
-+
-+ hash->table = compat_ptr(hash_compat.table);
-+ hash->nametable = compat_ptr(hash_compat.nametable);
-+ hash->first = compat_ptr(hash_compat.first);
-+
-+ hash->table_size = hash_compat.table_size;
-+ hash->used_size = hash_compat.used_size;
-+
-+ hash->type = hash_compat.type;
-+
-+ return 0;
-+}
-+
-+int copy_pointer_from_array_compat(void *ptr, unsigned long idx, const void *userp)
-+{
-+ compat_uptr_t ptrcompat;
-+
-+ if (copy_from_user(&ptrcompat, userp + (idx * sizeof(ptrcompat)), sizeof(ptrcompat)))
-+ return -EFAULT;
-+
-+ *(void **)ptr = compat_ptr(ptrcompat);
-+
-+ return 0;
-+}
-+
-+int copy_acl_ip_label_compat(struct acl_ip_label *ip, const struct acl_ip_label *userp)
-+{
-+ struct acl_ip_label_compat ip_compat;
-+
-+ if (copy_from_user(&ip_compat, userp, sizeof(ip_compat)))
-+ return -EFAULT;
-+
-+ ip->iface = compat_ptr(ip_compat.iface);
-+ ip->addr = ip_compat.addr;
-+ ip->netmask = ip_compat.netmask;
-+ ip->low = ip_compat.low;
-+ ip->high = ip_compat.high;
-+ ip->mode = ip_compat.mode;
-+ ip->type = ip_compat.type;
-+
-+ memcpy(&ip->proto, &ip_compat.proto, sizeof(ip->proto));
-+
-+ ip->prev = compat_ptr(ip_compat.prev);
-+ ip->next = compat_ptr(ip_compat.next);
-+
-+ return 0;
-+}
-+
-+int copy_sprole_pw_compat(struct sprole_pw *pw, unsigned long idx, const struct sprole_pw *userp)
-+{
-+ struct sprole_pw_compat pw_compat;
-+
-+ if (copy_from_user(&pw_compat, (const void *)userp + (sizeof(pw_compat) * idx), sizeof(pw_compat)))
-+ return -EFAULT;
-+
-+ pw->rolename = compat_ptr(pw_compat.rolename);
-+ memcpy(&pw->salt, pw_compat.salt, sizeof(pw->salt));
-+ memcpy(&pw->sum, pw_compat.sum, sizeof(pw->sum));
-+
-+ return 0;
-+}
-+
-+size_t get_gr_arg_wrapper_size_compat(void)
-+{
-+ return sizeof(struct gr_arg_wrapper_compat);
-+}
-+
-diff --git a/grsecurity/gracl_fs.c b/grsecurity/gracl_fs.c
-new file mode 100644
-index 0000000..3179e16
---- /dev/null
-+++ b/grsecurity/gracl_fs.c
-@@ -0,0 +1,437 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/types.h>
-+#include <linux/fs.h>
-+#include <linux/file.h>
-+#include <linux/stat.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+#include <linux/gracl.h>
-+
-+umode_t
-+gr_acl_umask(void)
-+{
-+ if (unlikely(!gr_acl_is_enabled()))
-+ return 0;
-+
-+ return current->role->umask;
-+}
-+
-+__u32
-+gr_acl_handle_hidden_file(const struct dentry * dentry,
-+ const struct vfsmount * mnt)
-+{
-+ __u32 mode;
-+
-+ if (unlikely(!dentry->d_inode))
-+ return GR_FIND;
-+
-+ mode =
-+ gr_search_file(dentry, GR_FIND | GR_AUDIT_FIND | GR_SUPPRESS, mnt);
-+
-+ if (unlikely(mode & GR_FIND && mode & GR_AUDIT_FIND)) {
-+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
-+ return mode;
-+ } else if (unlikely(!(mode & GR_FIND) && !(mode & GR_SUPPRESS))) {
-+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
-+ return 0;
-+ } else if (unlikely(!(mode & GR_FIND)))
-+ return 0;
-+
-+ return GR_FIND;
-+}
-+
-+__u32
-+gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
-+ int acc_mode)
-+{
-+ __u32 reqmode = GR_FIND;
-+ __u32 mode;
-+
-+ if (unlikely(!dentry->d_inode))
-+ return reqmode;
-+
-+ if (acc_mode & MAY_APPEND)
-+ reqmode |= GR_APPEND;
-+ else if (acc_mode & MAY_WRITE)
-+ reqmode |= GR_WRITE;
-+ if ((acc_mode & MAY_READ) && !S_ISDIR(dentry->d_inode->i_mode))
-+ reqmode |= GR_READ;
-+
-+ mode =
-+ gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
-+ mnt);
-+
-+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
-+ gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
-+ reqmode & GR_READ ? " reading" : "",
-+ reqmode & GR_WRITE ? " writing" : reqmode &
-+ GR_APPEND ? " appending" : "");
-+ return reqmode;
-+ } else
-+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
-+ {
-+ gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
-+ reqmode & GR_READ ? " reading" : "",
-+ reqmode & GR_WRITE ? " writing" : reqmode &
-+ GR_APPEND ? " appending" : "");
-+ return 0;
-+ } else if (unlikely((mode & reqmode) != reqmode))
-+ return 0;
-+
-+ return reqmode;
-+}
-+
-+__u32
-+gr_acl_handle_creat(const struct dentry * dentry,
-+ const struct dentry * p_dentry,
-+ const struct vfsmount * p_mnt, int open_flags, int acc_mode,
-+ const int imode)
-+{
-+ __u32 reqmode = GR_WRITE | GR_CREATE;
-+ __u32 mode;
-+
-+ if (acc_mode & MAY_APPEND)
-+ reqmode |= GR_APPEND;
-+ // if a directory was required or the directory already exists, then
-+ // don't count this open as a read
-+ if ((acc_mode & MAY_READ) &&
-+ !((open_flags & O_DIRECTORY) || (dentry->d_inode && S_ISDIR(dentry->d_inode->i_mode))))
-+ reqmode |= GR_READ;
-+ if ((open_flags & O_CREAT) &&
-+ ((imode & S_ISUID) || ((imode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))))
-+ reqmode |= GR_SETID;
-+
-+ mode =
-+ gr_check_create(dentry, p_dentry, p_mnt,
-+ reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
-+
-+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
-+ gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
-+ reqmode & GR_READ ? " reading" : "",
-+ reqmode & GR_WRITE ? " writing" : reqmode &
-+ GR_APPEND ? " appending" : "");
-+ return reqmode;
-+ } else
-+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
-+ {
-+ gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
-+ reqmode & GR_READ ? " reading" : "",
-+ reqmode & GR_WRITE ? " writing" : reqmode &
-+ GR_APPEND ? " appending" : "");
-+ return 0;
-+ } else if (unlikely((mode & reqmode) != reqmode))
-+ return 0;
-+
-+ return reqmode;
-+}
-+
-+__u32
-+gr_acl_handle_access(const struct dentry * dentry, const struct vfsmount * mnt,
-+ const int fmode)
-+{
-+ __u32 mode, reqmode = GR_FIND;
-+
-+ if ((fmode & S_IXOTH) && !S_ISDIR(dentry->d_inode->i_mode))
-+ reqmode |= GR_EXEC;
-+ if (fmode & S_IWOTH)
-+ reqmode |= GR_WRITE;
-+ if (fmode & S_IROTH)
-+ reqmode |= GR_READ;
-+
-+ mode =
-+ gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
-+ mnt);
-+
-+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
-+ gr_log_fs_rbac_mode3(GR_DO_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
-+ reqmode & GR_READ ? " reading" : "",
-+ reqmode & GR_WRITE ? " writing" : "",
-+ reqmode & GR_EXEC ? " executing" : "");
-+ return reqmode;
-+ } else
-+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
-+ {
-+ gr_log_fs_rbac_mode3(GR_DONT_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
-+ reqmode & GR_READ ? " reading" : "",
-+ reqmode & GR_WRITE ? " writing" : "",
-+ reqmode & GR_EXEC ? " executing" : "");
-+ return 0;
-+ } else if (unlikely((mode & reqmode) != reqmode))
-+ return 0;
-+
-+ return reqmode;
-+}
-+
-+static __u32 generic_fs_handler(const struct dentry *dentry, const struct vfsmount *mnt, __u32 reqmode, const char *fmt)
-+{
-+ __u32 mode;
-+
-+ mode = gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS, mnt);
-+
-+ if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
-+ gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, dentry, mnt);
-+ return mode;
-+ } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
-+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, dentry, mnt);
-+ return 0;
-+ } else if (unlikely((mode & (reqmode)) != (reqmode)))
-+ return 0;
-+
-+ return (reqmode);
-+}
-+
-+__u32
-+gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_RMDIR_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_unlink(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_UNLINK_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_truncate(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_TRUNCATE_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_utime(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_ATIME_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_chmod(const struct dentry *dentry, const struct vfsmount *mnt,
-+ umode_t *modeptr)
-+{
-+ umode_t mode;
-+
-+ *modeptr &= ~gr_acl_umask();
-+ mode = *modeptr;
-+
-+ if (unlikely(dentry->d_inode && S_ISSOCK(dentry->d_inode->i_mode)))
-+ return 1;
-+
-+ if (unlikely(dentry->d_inode && !S_ISDIR(dentry->d_inode->i_mode) &&
-+ ((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))))) {
-+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
-+ GR_CHMOD_ACL_MSG);
-+ } else {
-+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHMOD_ACL_MSG);
-+ }
-+}
-+
-+__u32
-+gr_acl_handle_chown(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHOWN_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_setxattr(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_SETXATTR_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_removexattr(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_REMOVEXATTR_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_execve(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return generic_fs_handler(dentry, mnt, GR_EXEC, GR_EXEC_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_unix(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return generic_fs_handler(dentry, mnt, GR_READ | GR_WRITE,
-+ GR_UNIXCONNECT_ACL_MSG);
-+}
-+
-+/* hardlinks require at minimum create and link permission,
-+ any additional privilege required is based on the
-+ privilege of the file being linked to
-+*/
-+__u32
-+gr_acl_handle_link(const struct dentry * new_dentry,
-+ const struct dentry * parent_dentry,
-+ const struct vfsmount * parent_mnt,
-+ const struct dentry * old_dentry,
-+ const struct vfsmount * old_mnt, const char *to)
-+{
-+ __u32 mode;
-+ __u32 needmode = GR_CREATE | GR_LINK;
-+ __u32 needaudit = GR_AUDIT_CREATE | GR_AUDIT_LINK;
-+
-+ mode =
-+ gr_check_link(new_dentry, parent_dentry, parent_mnt, old_dentry,
-+ old_mnt);
-+
-+ if (unlikely(((mode & needmode) == needmode) && (mode & needaudit))) {
-+ gr_log_fs_rbac_str(GR_DO_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
-+ return mode;
-+ } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
-+ gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
-+ return 0;
-+ } else if (unlikely((mode & needmode) != needmode))
-+ return 0;
-+
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_symlink(const struct dentry * new_dentry,
-+ const struct dentry * parent_dentry,
-+ const struct vfsmount * parent_mnt, const char *from)
-+{
-+ __u32 needmode = GR_WRITE | GR_CREATE;
-+ __u32 mode;
-+
-+ mode =
-+ gr_check_create(new_dentry, parent_dentry, parent_mnt,
-+ GR_CREATE | GR_AUDIT_CREATE |
-+ GR_WRITE | GR_AUDIT_WRITE | GR_SUPPRESS);
-+
-+ if (unlikely(mode & GR_WRITE && mode & GR_AUDITS)) {
-+ gr_log_fs_str_rbac(GR_DO_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
-+ return mode;
-+ } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
-+ gr_log_fs_str_rbac(GR_DONT_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
-+ return 0;
-+ } else if (unlikely((mode & needmode) != needmode))
-+ return 0;
-+
-+ return (GR_WRITE | GR_CREATE);
-+}
-+
-+static __u32 generic_fs_create_handler(const struct dentry *new_dentry, const struct dentry *parent_dentry, const struct vfsmount *parent_mnt, __u32 reqmode, const char *fmt)
-+{
-+ __u32 mode;
-+
-+ mode = gr_check_create(new_dentry, parent_dentry, parent_mnt, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
-+
-+ if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
-+ gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, new_dentry, parent_mnt);
-+ return mode;
-+ } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
-+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, new_dentry, parent_mnt);
-+ return 0;
-+ } else if (unlikely((mode & (reqmode)) != (reqmode)))
-+ return 0;
-+
-+ return (reqmode);
-+}
-+
-+__u32
-+gr_acl_handle_mknod(const struct dentry * new_dentry,
-+ const struct dentry * parent_dentry,
-+ const struct vfsmount * parent_mnt,
-+ const int mode)
-+{
-+ __u32 reqmode = GR_WRITE | GR_CREATE;
-+ if (unlikely((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))))
-+ reqmode |= GR_SETID;
-+
-+ return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
-+ reqmode, GR_MKNOD_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_mkdir(const struct dentry *new_dentry,
-+ const struct dentry *parent_dentry,
-+ const struct vfsmount *parent_mnt)
-+{
-+ return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
-+ GR_WRITE | GR_CREATE, GR_MKDIR_ACL_MSG);
-+}
-+
-+#define RENAME_CHECK_SUCCESS(old, new) \
-+ (((old & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)) && \
-+ ((new & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)))
-+
-+int
-+gr_acl_handle_rename(struct dentry *new_dentry,
-+ struct dentry *parent_dentry,
-+ const struct vfsmount *parent_mnt,
-+ struct dentry *old_dentry,
-+ struct inode *old_parent_inode,
-+ struct vfsmount *old_mnt, const char *newname)
-+{
-+ __u32 comp1, comp2;
-+ int error = 0;
-+
-+ if (unlikely(!gr_acl_is_enabled()))
-+ return 0;
-+
-+ if (!new_dentry->d_inode) {
-+ comp1 = gr_check_create(new_dentry, parent_dentry, parent_mnt,
-+ GR_READ | GR_WRITE | GR_CREATE | GR_AUDIT_READ |
-+ GR_AUDIT_WRITE | GR_AUDIT_CREATE | GR_SUPPRESS);
-+ comp2 = gr_search_file(old_dentry, GR_READ | GR_WRITE |
-+ GR_DELETE | GR_AUDIT_DELETE |
-+ GR_AUDIT_READ | GR_AUDIT_WRITE |
-+ GR_SUPPRESS, old_mnt);
-+ } else {
-+ comp1 = gr_search_file(new_dentry, GR_READ | GR_WRITE |
-+ GR_CREATE | GR_DELETE |
-+ GR_AUDIT_CREATE | GR_AUDIT_DELETE |
-+ GR_AUDIT_READ | GR_AUDIT_WRITE |
-+ GR_SUPPRESS, parent_mnt);
-+ comp2 =
-+ gr_search_file(old_dentry,
-+ GR_READ | GR_WRITE | GR_AUDIT_READ |
-+ GR_DELETE | GR_AUDIT_DELETE |
-+ GR_AUDIT_WRITE | GR_SUPPRESS, old_mnt);
-+ }
-+
-+ if (RENAME_CHECK_SUCCESS(comp1, comp2) &&
-+ ((comp1 & GR_AUDITS) || (comp2 & GR_AUDITS)))
-+ gr_log_fs_rbac_str(GR_DO_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
-+ else if (!RENAME_CHECK_SUCCESS(comp1, comp2) && !(comp1 & GR_SUPPRESS)
-+ && !(comp2 & GR_SUPPRESS)) {
-+ gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
-+ error = -EACCES;
-+ } else if (unlikely(!RENAME_CHECK_SUCCESS(comp1, comp2)))
-+ error = -EACCES;
-+
-+ return error;
-+}
-+
-+void
-+gr_acl_handle_exit(void)
-+{
-+ u16 id;
-+ char *rolename;
-+
-+ if (unlikely(current->acl_sp_role && gr_acl_is_enabled() &&
-+ !(current->role->roletype & GR_ROLE_PERSIST))) {
-+ id = current->acl_role_id;
-+ rolename = current->role->rolename;
-+ gr_set_acls(1);
-+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLEL_ACL_MSG, rolename, id);
-+ }
-+
-+ gr_put_exec_file(current);
-+ return;
-+}
-+
-+int
-+gr_acl_handle_procpidmem(const struct task_struct *task)
-+{
-+ if (unlikely(!gr_acl_is_enabled()))
-+ return 0;
-+
-+ if (task != current && task->acl->mode & GR_PROTPROCFD)
-+ return -EACCES;
-+
-+ return 0;
-+}
-diff --git a/grsecurity/gracl_ip.c b/grsecurity/gracl_ip.c
-new file mode 100644
-index 0000000..462a28e
---- /dev/null
-+++ b/grsecurity/gracl_ip.c
-@@ -0,0 +1,387 @@
-+#include <linux/kernel.h>
-+#include <asm/uaccess.h>
-+#include <asm/errno.h>
-+#include <net/sock.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/net.h>
-+#include <linux/in.h>
-+#include <linux/skbuff.h>
-+#include <linux/ip.h>
-+#include <linux/udp.h>
-+#include <linux/smp_lock.h>
-+#include <linux/types.h>
-+#include <linux/sched.h>
-+#include <linux/netdevice.h>
-+#include <linux/inetdevice.h>
-+#include <linux/gracl.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+#define GR_BIND 0x01
-+#define GR_CONNECT 0x02
-+#define GR_INVERT 0x04
-+#define GR_BINDOVERRIDE 0x08
-+#define GR_CONNECTOVERRIDE 0x10
-+#define GR_SOCK_FAMILY 0x20
-+
-+static const char * gr_protocols[IPPROTO_MAX] = {
-+ "ip", "icmp", "igmp", "ggp", "ipencap", "st", "tcp", "cbt",
-+ "egp", "igp", "bbn-rcc", "nvp", "pup", "argus", "emcon", "xnet",
-+ "chaos", "udp", "mux", "dcn", "hmp", "prm", "xns-idp", "trunk-1",
-+ "trunk-2", "leaf-1", "leaf-2", "rdp", "irtp", "iso-tp4", "netblt", "mfe-nsp",
-+ "merit-inp", "sep", "3pc", "idpr", "xtp", "ddp", "idpr-cmtp", "tp++",
-+ "il", "ipv6", "sdrp", "ipv6-route", "ipv6-frag", "idrp", "rsvp", "gre",
-+ "mhrp", "bna", "ipv6-crypt", "ipv6-auth", "i-nlsp", "swipe", "narp", "mobile",
-+ "tlsp", "skip", "ipv6-icmp", "ipv6-nonxt", "ipv6-opts", "unknown:61", "cftp", "unknown:63",
-+ "sat-expak", "kryptolan", "rvd", "ippc", "unknown:68", "sat-mon", "visa", "ipcv",
-+ "cpnx", "cphb", "wsn", "pvp", "br-sat-mon", "sun-nd", "wb-mon", "wb-expak",
-+ "iso-ip", "vmtp", "secure-vmtp", "vines", "ttp", "nfsnet-igp", "dgp", "tcf",
-+ "eigrp", "ospf", "sprite-rpc", "larp", "mtp", "ax.25", "ipip", "micp",
-+ "scc-sp", "etherip", "encap", "unknown:99", "gmtp", "ifmp", "pnni", "pim",
-+ "aris", "scps", "qnx", "a/n", "ipcomp", "snp", "compaq-peer", "ipx-in-ip",
-+ "vrrp", "pgm", "unknown:114", "l2tp", "ddx", "iatp", "stp", "srp",
-+ "uti", "smp", "sm", "ptp", "isis", "fire", "crtp", "crdup",
-+ "sscopmce", "iplt", "sps", "pipe", "sctp", "fc", "unkown:134", "unknown:135",
-+ "unknown:136", "unknown:137", "unknown:138", "unknown:139", "unknown:140", "unknown:141", "unknown:142", "unknown:143",
-+ "unknown:144", "unknown:145", "unknown:146", "unknown:147", "unknown:148", "unknown:149", "unknown:150", "unknown:151",
-+ "unknown:152", "unknown:153", "unknown:154", "unknown:155", "unknown:156", "unknown:157", "unknown:158", "unknown:159",
-+ "unknown:160", "unknown:161", "unknown:162", "unknown:163", "unknown:164", "unknown:165", "unknown:166", "unknown:167",
-+ "unknown:168", "unknown:169", "unknown:170", "unknown:171", "unknown:172", "unknown:173", "unknown:174", "unknown:175",
-+ "unknown:176", "unknown:177", "unknown:178", "unknown:179", "unknown:180", "unknown:181", "unknown:182", "unknown:183",
-+ "unknown:184", "unknown:185", "unknown:186", "unknown:187", "unknown:188", "unknown:189", "unknown:190", "unknown:191",
-+ "unknown:192", "unknown:193", "unknown:194", "unknown:195", "unknown:196", "unknown:197", "unknown:198", "unknown:199",
-+ "unknown:200", "unknown:201", "unknown:202", "unknown:203", "unknown:204", "unknown:205", "unknown:206", "unknown:207",
-+ "unknown:208", "unknown:209", "unknown:210", "unknown:211", "unknown:212", "unknown:213", "unknown:214", "unknown:215",
-+ "unknown:216", "unknown:217", "unknown:218", "unknown:219", "unknown:220", "unknown:221", "unknown:222", "unknown:223",
-+ "unknown:224", "unknown:225", "unknown:226", "unknown:227", "unknown:228", "unknown:229", "unknown:230", "unknown:231",
-+ "unknown:232", "unknown:233", "unknown:234", "unknown:235", "unknown:236", "unknown:237", "unknown:238", "unknown:239",
-+ "unknown:240", "unknown:241", "unknown:242", "unknown:243", "unknown:244", "unknown:245", "unknown:246", "unknown:247",
-+ "unknown:248", "unknown:249", "unknown:250", "unknown:251", "unknown:252", "unknown:253", "unknown:254", "unknown:255",
-+ };
-+
-+static const char * gr_socktypes[SOCK_MAX] = {
-+ "unknown:0", "stream", "dgram", "raw", "rdm", "seqpacket", "unknown:6",
-+ "unknown:7", "unknown:8", "unknown:9", "packet"
-+ };
-+
-+static const char * gr_sockfamilies[AF_MAX+1] = {
-+ "unspec", "unix", "inet", "ax25", "ipx", "appletalk", "netrom", "bridge", "atmpvc", "x25",
-+ "inet6", "rose", "decnet", "netbeui", "security", "key", "netlink", "packet", "ash",
-+ "econet", "atmsvc", "rds", "sna", "irda", "ppox", "wanpipe", "llc", "fam_27", "fam_28",
-+ "tipc", "bluetooth", "iucv", "rxrpc", "isdn", "phonet", "ieee802154"
-+ };
-+
-+const char *
-+gr_proto_to_name(unsigned char proto)
-+{
-+ return gr_protocols[proto];
-+}
-+
-+const char *
-+gr_socktype_to_name(unsigned char type)
-+{
-+ return gr_socktypes[type];
-+}
-+
-+const char *
-+gr_sockfamily_to_name(unsigned char family)
-+{
-+ return gr_sockfamilies[family];
-+}
-+
-+extern const struct net_proto_family *net_families[NPROTO] __read_mostly;
-+
-+int
-+gr_search_socket(const int domain, const int type, const int protocol)
-+{
-+ struct acl_subject_label *curr;
-+ const struct cred *cred = current_cred();
-+
-+ if (unlikely(!gr_acl_is_enabled()))
-+ goto exit;
-+
-+ if ((domain < 0) || (type < 0) || (protocol < 0) ||
-+ (domain >= AF_MAX) || (type >= SOCK_MAX) || (protocol >= IPPROTO_MAX))
-+ goto exit; // let the kernel handle it
-+
-+ curr = current->acl;
-+
-+ if (curr->sock_families[domain / 32] & (1U << (domain % 32))) {
-+ /* the family is allowed, if this is PF_INET allow it only if
-+ the extra sock type/protocol checks pass */
-+ if (domain == PF_INET)
-+ goto inet_check;
-+ goto exit;
-+ } else {
-+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
-+ __u32 fakeip = 0;
-+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
-+ current->role->roletype, cred->uid,
-+ cred->gid, current->exec_file ?
-+ gr_to_filename(current->exec_file->f_path.dentry,
-+ current->exec_file->f_path.mnt) :
-+ curr->filename, curr->filename,
-+ &fakeip, domain, 0, 0, GR_SOCK_FAMILY,
-+ ¤t->signal->saved_ip);
-+ goto exit;
-+ }
-+ goto exit_fail;
-+ }
-+
-+inet_check:
-+ /* the rest of this checking is for IPv4 only */
-+ if (!curr->ips)
-+ goto exit;
-+
-+ if ((curr->ip_type & (1U << type)) &&
-+ (curr->ip_proto[protocol / 32] & (1U << (protocol % 32))))
-+ goto exit;
-+
-+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
-+ /* we don't place acls on raw sockets , and sometimes
-+ dgram/ip sockets are opened for ioctl and not
-+ bind/connect, so we'll fake a bind learn log */
-+ if (type == SOCK_RAW || type == SOCK_PACKET) {
-+ __u32 fakeip = 0;
-+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
-+ current->role->roletype, cred->uid,
-+ cred->gid, current->exec_file ?
-+ gr_to_filename(current->exec_file->f_path.dentry,
-+ current->exec_file->f_path.mnt) :
-+ curr->filename, curr->filename,
-+ &fakeip, 0, type,
-+ protocol, GR_CONNECT, ¤t->signal->saved_ip);
-+ } else if ((type == SOCK_DGRAM) && (protocol == IPPROTO_IP)) {
-+ __u32 fakeip = 0;
-+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
-+ current->role->roletype, cred->uid,
-+ cred->gid, current->exec_file ?
-+ gr_to_filename(current->exec_file->f_path.dentry,
-+ current->exec_file->f_path.mnt) :
-+ curr->filename, curr->filename,
-+ &fakeip, 0, type,
-+ protocol, GR_BIND, ¤t->signal->saved_ip);
-+ }
-+ /* we'll log when they use connect or bind */
-+ goto exit;
-+ }
-+
-+exit_fail:
-+ if (domain == PF_INET)
-+ gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(domain),
-+ gr_socktype_to_name(type), gr_proto_to_name(protocol));
-+ else if (net_families[domain] != NULL)
-+ gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(domain),
-+ gr_socktype_to_name(type), protocol);
-+
-+ return 0;
-+exit:
-+ return 1;
-+}
-+
-+int check_ip_policy(struct acl_ip_label *ip, __u32 ip_addr, __u16 ip_port, __u8 protocol, const int mode, const int type, __u32 our_addr, __u32 our_netmask)
-+{
-+ if ((ip->mode & mode) &&
-+ (ip_port >= ip->low) &&
-+ (ip_port <= ip->high) &&
-+ ((ntohl(ip_addr) & our_netmask) ==
-+ (ntohl(our_addr) & our_netmask))
-+ && (ip->proto[protocol / 32] & (1U << (protocol % 32)))
-+ && (ip->type & (1U << type))) {
-+ if (ip->mode & GR_INVERT)
-+ return 2; // specifically denied
-+ else
-+ return 1; // allowed
-+ }
-+
-+ return 0; // not specifically allowed, may continue parsing
-+}
-+
-+static int
-+gr_search_connectbind(const int full_mode, struct sock *sk,
-+ struct sockaddr_in *addr, const int type)
-+{
-+ char iface[IFNAMSIZ] = {0};
-+ struct acl_subject_label *curr;
-+ struct acl_ip_label *ip;
-+ struct inet_sock *isk;
-+ struct net_device *dev;
-+ struct in_device *idev;
-+ unsigned long i;
-+ int ret;
-+ int mode = full_mode & (GR_BIND | GR_CONNECT);
-+ __u32 ip_addr = 0;
-+ __u32 our_addr;
-+ __u32 our_netmask;
-+ char *p;
-+ __u16 ip_port = 0;
-+ const struct cred *cred = current_cred();
-+
-+ if (unlikely(!gr_acl_is_enabled() || sk->sk_family != PF_INET))
-+ return 0;
-+
-+ curr = current->acl;
-+ isk = inet_sk(sk);
-+
-+ /* INADDR_ANY overriding for binds, inaddr_any_override is already in network order */
-+ if ((full_mode & GR_BINDOVERRIDE) && addr->sin_addr.s_addr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0)
-+ addr->sin_addr.s_addr = curr->inaddr_any_override;
-+ if ((full_mode & GR_CONNECT) && isk->saddr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0) {
-+ struct sockaddr_in saddr;
-+ int err;
-+
-+ saddr.sin_family = AF_INET;
-+ saddr.sin_addr.s_addr = curr->inaddr_any_override;
-+ saddr.sin_port = isk->sport;
-+
-+ err = security_socket_bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
-+ if (err)
-+ return err;
-+
-+ err = sk->sk_socket->ops->bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
-+ if (err)
-+ return err;
-+ }
-+
-+ if (!curr->ips)
-+ return 0;
-+
-+ ip_addr = addr->sin_addr.s_addr;
-+ ip_port = ntohs(addr->sin_port);
-+
-+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
-+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
-+ current->role->roletype, cred->uid,
-+ cred->gid, current->exec_file ?
-+ gr_to_filename(current->exec_file->f_path.dentry,
-+ current->exec_file->f_path.mnt) :
-+ curr->filename, curr->filename,
-+ &ip_addr, ip_port, type,
-+ sk->sk_protocol, mode, ¤t->signal->saved_ip);
-+ return 0;
-+ }
-+
-+ for (i = 0; i < curr->ip_num; i++) {
-+ ip = *(curr->ips + i);
-+ if (ip->iface != NULL) {
-+ strncpy(iface, ip->iface, IFNAMSIZ - 1);
-+ p = strchr(iface, ':');
-+ if (p != NULL)
-+ *p = '\0';
-+ dev = dev_get_by_name(sock_net(sk), iface);
-+ if (dev == NULL)
-+ continue;
-+ idev = in_dev_get(dev);
-+ if (idev == NULL) {
-+ dev_put(dev);
-+ continue;
-+ }
-+ rcu_read_lock();
-+ for_ifa(idev) {
-+ if (!strcmp(ip->iface, ifa->ifa_label)) {
-+ our_addr = ifa->ifa_address;
-+ our_netmask = 0xffffffff;
-+ ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
-+ if (ret == 1) {
-+ rcu_read_unlock();
-+ in_dev_put(idev);
-+ dev_put(dev);
-+ return 0;
-+ } else if (ret == 2) {
-+ rcu_read_unlock();
-+ in_dev_put(idev);
-+ dev_put(dev);
-+ goto denied;
-+ }
-+ }
-+ } endfor_ifa(idev);
-+ rcu_read_unlock();
-+ in_dev_put(idev);
-+ dev_put(dev);
-+ } else {
-+ our_addr = ip->addr;
-+ our_netmask = ip->netmask;
-+ ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
-+ if (ret == 1)
-+ return 0;
-+ else if (ret == 2)
-+ goto denied;
-+ }
-+ }
-+
-+denied:
-+ if (mode == GR_BIND)
-+ gr_log_int5_str2(GR_DONT_AUDIT, GR_BIND_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
-+ else if (mode == GR_CONNECT)
-+ gr_log_int5_str2(GR_DONT_AUDIT, GR_CONNECT_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
-+
-+ return -EACCES;
-+}
-+
-+int
-+gr_search_connect(struct socket *sock, struct sockaddr_in *addr)
-+{
-+ /* always allow disconnection of dgram sockets with connect */
-+ if (addr->sin_family == AF_UNSPEC)
-+ return 0;
-+ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sock->sk, addr, sock->type);
-+}
-+
-+int
-+gr_search_bind(struct socket *sock, struct sockaddr_in *addr)
-+{
-+ return gr_search_connectbind(GR_BIND | GR_BINDOVERRIDE, sock->sk, addr, sock->type);
-+}
-+
-+int gr_search_listen(struct socket *sock)
-+{
-+ struct sock *sk = sock->sk;
-+ struct sockaddr_in addr;
-+
-+ addr.sin_addr.s_addr = inet_sk(sk)->saddr;
-+ addr.sin_port = inet_sk(sk)->sport;
-+
-+ return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
-+}
-+
-+int gr_search_accept(struct socket *sock)
-+{
-+ struct sock *sk = sock->sk;
-+ struct sockaddr_in addr;
-+
-+ addr.sin_addr.s_addr = inet_sk(sk)->saddr;
-+ addr.sin_port = inet_sk(sk)->sport;
-+
-+ return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
-+}
-+
-+int
-+gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr)
-+{
-+ if (addr)
-+ return gr_search_connectbind(GR_CONNECT, sk, addr, SOCK_DGRAM);
-+ else {
-+ struct sockaddr_in sin;
-+ const struct inet_sock *inet = inet_sk(sk);
-+
-+ sin.sin_addr.s_addr = inet->daddr;
-+ sin.sin_port = inet->dport;
-+
-+ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
-+ }
-+}
-+
-+int
-+gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb)
-+{
-+ struct sockaddr_in sin;
-+
-+ if (unlikely(skb->len < sizeof (struct udphdr)))
-+ return 0; // skip this packet
-+
-+ sin.sin_addr.s_addr = ip_hdr(skb)->saddr;
-+ sin.sin_port = udp_hdr(skb)->source;
-+
-+ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
-+}
-diff --git a/grsecurity/gracl_learn.c b/grsecurity/gracl_learn.c
-new file mode 100644
-index 0000000..34bdd46
---- /dev/null
-+++ b/grsecurity/gracl_learn.c
-@@ -0,0 +1,208 @@
-+#include <linux/kernel.h>
-+#include <linux/mm.h>
-+#include <linux/sched.h>
-+#include <linux/poll.h>
-+#include <linux/smp_lock.h>
-+#include <linux/string.h>
-+#include <linux/file.h>
-+#include <linux/types.h>
-+#include <linux/vmalloc.h>
-+#include <linux/grinternal.h>
-+
-+extern ssize_t write_grsec_handler(struct file * file, const char __user * buf,
-+ size_t count, loff_t *ppos);
-+extern int gr_acl_is_enabled(void);
-+
-+static DECLARE_WAIT_QUEUE_HEAD(learn_wait);
-+static int gr_learn_attached;
-+
-+/* use a 512k buffer */
-+#define LEARN_BUFFER_SIZE (512 * 1024)
-+
-+static DEFINE_SPINLOCK(gr_learn_lock);
-+static DEFINE_MUTEX(gr_learn_user_mutex);
-+
-+/* we need to maintain two buffers, so that the kernel context of grlearn
-+ uses a semaphore around the userspace copying, and the other kernel contexts
-+ use a spinlock when copying into the buffer, since they cannot sleep
-+*/
-+static char *learn_buffer;
-+static char *learn_buffer_user;
-+static int learn_buffer_len;
-+static int learn_buffer_user_len;
-+
-+static ssize_t
-+read_learn(struct file *file, char __user * buf, size_t count, loff_t * ppos)
-+{
-+ DECLARE_WAITQUEUE(wait, current);
-+ ssize_t retval = 0;
-+
-+ add_wait_queue(&learn_wait, &wait);
-+ set_current_state(TASK_INTERRUPTIBLE);
-+ do {
-+ mutex_lock(&gr_learn_user_mutex);
-+ spin_lock(&gr_learn_lock);
-+ if (learn_buffer_len)
-+ break;
-+ spin_unlock(&gr_learn_lock);
-+ mutex_unlock(&gr_learn_user_mutex);
-+ if (file->f_flags & O_NONBLOCK) {
-+ retval = -EAGAIN;
-+ goto out;
-+ }
-+ if (signal_pending(current)) {
-+ retval = -ERESTARTSYS;
-+ goto out;
-+ }
-+
-+ schedule();
-+ } while (1);
-+
-+ memcpy(learn_buffer_user, learn_buffer, learn_buffer_len);
-+ learn_buffer_user_len = learn_buffer_len;
-+ retval = learn_buffer_len;
-+ learn_buffer_len = 0;
-+
-+ spin_unlock(&gr_learn_lock);
-+
-+ if (copy_to_user(buf, learn_buffer_user, learn_buffer_user_len))
-+ retval = -EFAULT;
-+
-+ mutex_unlock(&gr_learn_user_mutex);
-+out:
-+ set_current_state(TASK_RUNNING);
-+ remove_wait_queue(&learn_wait, &wait);
-+ return retval;
-+}
-+
-+static unsigned int
-+poll_learn(struct file * file, poll_table * wait)
-+{
-+ poll_wait(file, &learn_wait, wait);
-+
-+ if (learn_buffer_len)
-+ return (POLLIN | POLLRDNORM);
-+
-+ return 0;
-+}
-+
-+void
-+gr_clear_learn_entries(void)
-+{
-+ char *tmp;
-+
-+ mutex_lock(&gr_learn_user_mutex);
-+ spin_lock(&gr_learn_lock);
-+ tmp = learn_buffer;
-+ learn_buffer = NULL;
-+ spin_unlock(&gr_learn_lock);
-+ if (tmp)
-+ vfree(tmp);
-+ if (learn_buffer_user != NULL) {
-+ vfree(learn_buffer_user);
-+ learn_buffer_user = NULL;
-+ }
-+ learn_buffer_len = 0;
-+ mutex_unlock(&gr_learn_user_mutex);
-+
-+ return;
-+}
-+
-+void
-+gr_add_learn_entry(const char *fmt, ...)
-+{
-+ va_list args;
-+ unsigned int len;
-+
-+ if (!gr_learn_attached)
-+ return;
-+
-+ spin_lock(&gr_learn_lock);
-+
-+ /* leave a gap at the end so we know when it's "full" but don't have to
-+ compute the exact length of the string we're trying to append
-+ */
-+ if (learn_buffer_len > LEARN_BUFFER_SIZE - 16384) {
-+ spin_unlock(&gr_learn_lock);
-+ wake_up_interruptible(&learn_wait);
-+ return;
-+ }
-+ if (learn_buffer == NULL) {
-+ spin_unlock(&gr_learn_lock);
-+ return;
-+ }
-+
-+ va_start(args, fmt);
-+ len = vsnprintf(learn_buffer + learn_buffer_len, LEARN_BUFFER_SIZE - learn_buffer_len, fmt, args);
-+ va_end(args);
-+
-+ learn_buffer_len += len + 1;
-+
-+ spin_unlock(&gr_learn_lock);
-+ wake_up_interruptible(&learn_wait);
-+
-+ return;
-+}
-+
-+static int
-+open_learn(struct inode *inode, struct file *file)
-+{
-+ if (file->f_mode & FMODE_READ && gr_learn_attached)
-+ return -EBUSY;
-+ if (file->f_mode & FMODE_READ) {
-+ int retval = 0;
-+ mutex_lock(&gr_learn_user_mutex);
-+ if (learn_buffer == NULL)
-+ learn_buffer = vmalloc(LEARN_BUFFER_SIZE);
-+ if (learn_buffer_user == NULL)
-+ learn_buffer_user = vmalloc(LEARN_BUFFER_SIZE);
-+ if (learn_buffer == NULL) {
-+ retval = -ENOMEM;
-+ goto out_error;
-+ }
-+ if (learn_buffer_user == NULL) {
-+ retval = -ENOMEM;
-+ goto out_error;
-+ }
-+ learn_buffer_len = 0;
-+ learn_buffer_user_len = 0;
-+ gr_learn_attached = 1;
-+out_error:
-+ mutex_unlock(&gr_learn_user_mutex);
-+ return retval;
-+ }
-+ return 0;
-+}
-+
-+static int
-+close_learn(struct inode *inode, struct file *file)
-+{
-+ if (file->f_mode & FMODE_READ) {
-+ char *tmp = NULL;
-+ mutex_lock(&gr_learn_user_mutex);
-+ spin_lock(&gr_learn_lock);
-+ tmp = learn_buffer;
-+ learn_buffer = NULL;
-+ spin_unlock(&gr_learn_lock);
-+ if (tmp)
-+ vfree(tmp);
-+ if (learn_buffer_user != NULL) {
-+ vfree(learn_buffer_user);
-+ learn_buffer_user = NULL;
-+ }
-+ learn_buffer_len = 0;
-+ learn_buffer_user_len = 0;
-+ gr_learn_attached = 0;
-+ mutex_unlock(&gr_learn_user_mutex);
-+ }
-+
-+ return 0;
-+}
-+
-+const struct file_operations grsec_fops = {
-+ .read = read_learn,
-+ .write = write_grsec_handler,
-+ .open = open_learn,
-+ .release = close_learn,
-+ .poll = poll_learn,
-+};
-diff --git a/grsecurity/gracl_res.c b/grsecurity/gracl_res.c
-new file mode 100644
-index 0000000..70b2179
---- /dev/null
-+++ b/grsecurity/gracl_res.c
-@@ -0,0 +1,67 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/gracl.h>
-+#include <linux/grinternal.h>
-+
-+static const char *restab_log[] = {
-+ [RLIMIT_CPU] = "RLIMIT_CPU",
-+ [RLIMIT_FSIZE] = "RLIMIT_FSIZE",
-+ [RLIMIT_DATA] = "RLIMIT_DATA",
-+ [RLIMIT_STACK] = "RLIMIT_STACK",
-+ [RLIMIT_CORE] = "RLIMIT_CORE",
-+ [RLIMIT_RSS] = "RLIMIT_RSS",
-+ [RLIMIT_NPROC] = "RLIMIT_NPROC",
-+ [RLIMIT_NOFILE] = "RLIMIT_NOFILE",
-+ [RLIMIT_MEMLOCK] = "RLIMIT_MEMLOCK",
-+ [RLIMIT_AS] = "RLIMIT_AS",
-+ [RLIMIT_LOCKS] = "RLIMIT_LOCKS",
-+ [RLIMIT_SIGPENDING] = "RLIMIT_SIGPENDING",
-+ [RLIMIT_MSGQUEUE] = "RLIMIT_MSGQUEUE",
-+ [RLIMIT_NICE] = "RLIMIT_NICE",
-+ [RLIMIT_RTPRIO] = "RLIMIT_RTPRIO",
-+ [RLIMIT_RTTIME] = "RLIMIT_RTTIME",
-+ [GR_CRASH_RES] = "RLIMIT_CRASH"
-+};
-+
-+void
-+gr_log_resource(const struct task_struct *task,
-+ const int res, const unsigned long wanted, const int gt)
-+{
-+ const struct cred *cred;
-+ unsigned long rlim;
-+
-+ if (!gr_acl_is_enabled() && !grsec_resource_logging)
-+ return;
-+
-+ // not yet supported resource
-+ if (unlikely(!restab_log[res]))
-+ return;
-+
-+ if (res == RLIMIT_CPU || res == RLIMIT_RTTIME)
-+ rlim = task->signal->rlim[res].rlim_max;
-+ else
-+ rlim = task->signal->rlim[res].rlim_cur;
-+ if (likely((rlim == RLIM_INFINITY) || (gt && wanted <= rlim) || (!gt && wanted < rlim)))
-+ return;
-+
-+ rcu_read_lock();
-+ cred = __task_cred(task);
-+
-+ if (res == RLIMIT_NPROC &&
-+ (cap_raised(cred->cap_effective, CAP_SYS_ADMIN) ||
-+ cap_raised(cred->cap_effective, CAP_SYS_RESOURCE)))
-+ goto out_rcu_unlock;
-+ else if (res == RLIMIT_MEMLOCK &&
-+ cap_raised(cred->cap_effective, CAP_IPC_LOCK))
-+ goto out_rcu_unlock;
-+ else if (res == RLIMIT_NICE && cap_raised(cred->cap_effective, CAP_SYS_NICE))
-+ goto out_rcu_unlock;
-+ rcu_read_unlock();
-+
-+ gr_log_res_ulong2_str(GR_DONT_AUDIT, GR_RESOURCE_MSG, task, wanted, restab_log[res], rlim);
-+
-+ return;
-+out_rcu_unlock:
-+ rcu_read_unlock();
-+ return;
-+}
-diff --git a/grsecurity/gracl_segv.c b/grsecurity/gracl_segv.c
-new file mode 100644
-index 0000000..bfbe602
---- /dev/null
-+++ b/grsecurity/gracl_segv.c
-@@ -0,0 +1,301 @@
-+#include <linux/kernel.h>
-+#include <linux/mm.h>
-+#include <asm/uaccess.h>
-+#include <asm/errno.h>
-+#include <asm/mman.h>
-+#include <net/sock.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/net.h>
-+#include <linux/in.h>
-+#include <linux/smp_lock.h>
-+#include <linux/slab.h>
-+#include <linux/types.h>
-+#include <linux/sched.h>
-+#include <linux/timer.h>
-+#include <linux/gracl.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+#if defined(CONFIG_BTRFS_FS) || defined(CONFIG_BTRFS_FS_MODULE)
-+#include <linux/magic.h>
-+#include <linux/pagemap.h>
-+#include "../fs/btrfs/async-thread.h"
-+#include "../fs/btrfs/ctree.h"
-+#include "../fs/btrfs/btrfs_inode.h"
-+#endif
-+
-+static struct crash_uid *uid_set;
-+static unsigned short uid_used;
-+static DEFINE_SPINLOCK(gr_uid_lock);
-+extern rwlock_t gr_inode_lock;
-+extern struct acl_subject_label *
-+ lookup_acl_subj_label(const ino_t inode, const dev_t dev,
-+ struct acl_role_label *role);
-+extern int gr_fake_force_sig(int sig, struct task_struct *t);
-+
-+static inline dev_t __get_dev(const struct dentry *dentry)
-+{
-+#if defined(CONFIG_BTRFS_FS) || defined(CONFIG_BTRFS_FS_MODULE)
-+ if (dentry->d_sb->s_magic == BTRFS_SUPER_MAGIC)
-+ return BTRFS_I(dentry->d_inode)->root->anon_super.s_dev;
-+ else
-+#endif
-+ return dentry->d_sb->s_dev;
-+}
-+
-+int
-+gr_init_uidset(void)
-+{
-+ uid_set =
-+ kmalloc(GR_UIDTABLE_MAX * sizeof (struct crash_uid), GFP_KERNEL);
-+ uid_used = 0;
-+
-+ return uid_set ? 1 : 0;
-+}
-+
-+void
-+gr_free_uidset(void)
-+{
-+ if (uid_set)
-+ kfree(uid_set);
-+
-+ return;
-+}
-+
-+int
-+gr_find_uid(const uid_t uid)
-+{
-+ struct crash_uid *tmp = uid_set;
-+ uid_t buid;
-+ int low = 0, high = uid_used - 1, mid;
-+
-+ while (high >= low) {
-+ mid = (low + high) >> 1;
-+ buid = tmp[mid].uid;
-+ if (buid == uid)
-+ return mid;
-+ if (buid > uid)
-+ high = mid - 1;
-+ if (buid < uid)
-+ low = mid + 1;
-+ }
-+
-+ return -1;
-+}
-+
-+static __inline__ void
-+gr_insertsort(void)
-+{
-+ unsigned short i, j;
-+ struct crash_uid index;
-+
-+ for (i = 1; i < uid_used; i++) {
-+ index = uid_set[i];
-+ j = i;
-+ while ((j > 0) && uid_set[j - 1].uid > index.uid) {
-+ uid_set[j] = uid_set[j - 1];
-+ j--;
-+ }
-+ uid_set[j] = index;
-+ }
-+
-+ return;
-+}
-+
-+static __inline__ void
-+gr_insert_uid(const uid_t uid, const unsigned long expires)
-+{
-+ int loc;
-+
-+ if (uid_used == GR_UIDTABLE_MAX)
-+ return;
-+
-+ loc = gr_find_uid(uid);
-+
-+ if (loc >= 0) {
-+ uid_set[loc].expires = expires;
-+ return;
-+ }
-+
-+ uid_set[uid_used].uid = uid;
-+ uid_set[uid_used].expires = expires;
-+ uid_used++;
-+
-+ gr_insertsort();
-+
-+ return;
-+}
-+
-+void
-+gr_remove_uid(const unsigned short loc)
-+{
-+ unsigned short i;
-+
-+ for (i = loc + 1; i < uid_used; i++)
-+ uid_set[i - 1] = uid_set[i];
-+
-+ uid_used--;
-+
-+ return;
-+}
-+
-+int
-+gr_check_crash_uid(const uid_t uid)
-+{
-+ int loc;
-+ int ret = 0;
-+
-+ if (unlikely(!gr_acl_is_enabled()))
-+ return 0;
-+
-+ spin_lock(&gr_uid_lock);
-+ loc = gr_find_uid(uid);
-+
-+ if (loc < 0)
-+ goto out_unlock;
-+
-+ if (time_before_eq(uid_set[loc].expires, get_seconds()))
-+ gr_remove_uid(loc);
-+ else
-+ ret = 1;
-+
-+out_unlock:
-+ spin_unlock(&gr_uid_lock);
-+ return ret;
-+}
-+
-+static __inline__ int
-+proc_is_setxid(const struct cred *cred)
-+{
-+ if (cred->uid != cred->euid || cred->uid != cred->suid ||
-+ cred->uid != cred->fsuid)
-+ return 1;
-+ if (cred->gid != cred->egid || cred->gid != cred->sgid ||
-+ cred->gid != cred->fsgid)
-+ return 1;
-+
-+ return 0;
-+}
-+
-+void
-+gr_handle_crash(struct task_struct *task, const int sig)
-+{
-+ struct acl_subject_label *curr;
-+ struct task_struct *tsk, *tsk2;
-+ const struct cred *cred;
-+ const struct cred *cred2;
-+
-+ if (sig != SIGSEGV && sig != SIGKILL && sig != SIGBUS && sig != SIGILL)
-+ return;
-+
-+ if (unlikely(!gr_acl_is_enabled()))
-+ return;
-+
-+ curr = task->acl;
-+
-+ if (!(curr->resmask & (1U << GR_CRASH_RES)))
-+ return;
-+
-+ if (time_before_eq(curr->expires, get_seconds())) {
-+ curr->expires = 0;
-+ curr->crashes = 0;
-+ }
-+
-+ curr->crashes++;
-+
-+ if (!curr->expires)
-+ curr->expires = get_seconds() + curr->res[GR_CRASH_RES].rlim_max;
-+
-+ if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
-+ time_after(curr->expires, get_seconds())) {
-+ rcu_read_lock();
-+ cred = __task_cred(task);
-+ if (cred->uid && proc_is_setxid(cred)) {
-+ gr_log_crash1(GR_DONT_AUDIT, GR_SEGVSTART_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
-+ spin_lock(&gr_uid_lock);
-+ gr_insert_uid(cred->uid, curr->expires);
-+ spin_unlock(&gr_uid_lock);
-+ curr->expires = 0;
-+ curr->crashes = 0;
-+ read_lock(&tasklist_lock);
-+ do_each_thread(tsk2, tsk) {
-+ cred2 = __task_cred(tsk);
-+ if (tsk != task && cred2->uid == cred->uid)
-+ gr_fake_force_sig(SIGKILL, tsk);
-+ } while_each_thread(tsk2, tsk);
-+ read_unlock(&tasklist_lock);
-+ } else {
-+ gr_log_crash2(GR_DONT_AUDIT, GR_SEGVNOSUID_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
-+ read_lock(&tasklist_lock);
-+ read_lock(&grsec_exec_file_lock);
-+ do_each_thread(tsk2, tsk) {
-+ if (likely(tsk != task)) {
-+ // if this thread has the same subject as the one that triggered
-+ // RES_CRASH and it's the same binary, kill it
-+ if (tsk->acl == task->acl && gr_is_same_file(tsk->exec_file, task->exec_file))
-+ gr_fake_force_sig(SIGKILL, tsk);
-+ }
-+ } while_each_thread(tsk2, tsk);
-+ read_unlock(&grsec_exec_file_lock);
-+ read_unlock(&tasklist_lock);
-+ }
-+ rcu_read_unlock();
-+ }
-+
-+ return;
-+}
-+
-+int
-+gr_check_crash_exec(const struct file *filp)
-+{
-+ struct acl_subject_label *curr;
-+
-+ if (unlikely(!gr_acl_is_enabled()))
-+ return 0;
-+
-+ read_lock(&gr_inode_lock);
-+ curr = lookup_acl_subj_label(filp->f_path.dentry->d_inode->i_ino,
-+ __get_dev(filp->f_path.dentry),
-+ current->role);
-+ read_unlock(&gr_inode_lock);
-+
-+ if (!curr || !(curr->resmask & (1U << GR_CRASH_RES)) ||
-+ (!curr->crashes && !curr->expires))
-+ return 0;
-+
-+ if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
-+ time_after(curr->expires, get_seconds()))
-+ return 1;
-+ else if (time_before_eq(curr->expires, get_seconds())) {
-+ curr->crashes = 0;
-+ curr->expires = 0;
-+ }
-+
-+ return 0;
-+}
-+
-+void
-+gr_handle_alertkill(struct task_struct *task)
-+{
-+ struct acl_subject_label *curracl;
-+ __u32 curr_ip;
-+ struct task_struct *p, *p2;
-+
-+ if (unlikely(!gr_acl_is_enabled()))
-+ return;
-+
-+ curracl = task->acl;
-+ curr_ip = task->signal->curr_ip;
-+
-+ if ((curracl->mode & GR_KILLIPPROC) && curr_ip) {
-+ read_lock(&tasklist_lock);
-+ do_each_thread(p2, p) {
-+ if (p->signal->curr_ip == curr_ip)
-+ gr_fake_force_sig(SIGKILL, p);
-+ } while_each_thread(p2, p);
-+ read_unlock(&tasklist_lock);
-+ } else if (curracl->mode & GR_KILLPROC)
-+ gr_fake_force_sig(SIGKILL, task);
-+
-+ return;
-+}
-diff --git a/grsecurity/gracl_shm.c b/grsecurity/gracl_shm.c
-new file mode 100644
-index 0000000..9d83a69
---- /dev/null
-+++ b/grsecurity/gracl_shm.c
-@@ -0,0 +1,40 @@
-+#include <linux/kernel.h>
-+#include <linux/mm.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/ipc.h>
-+#include <linux/gracl.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+int
-+gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
-+ const time_t shm_createtime, const uid_t cuid, const int shmid)
-+{
-+ struct task_struct *task;
-+
-+ if (!gr_acl_is_enabled())
-+ return 1;
-+
-+ rcu_read_lock();
-+ read_lock(&tasklist_lock);
-+
-+ task = find_task_by_vpid(shm_cprid);
-+
-+ if (unlikely(!task))
-+ task = find_task_by_vpid(shm_lapid);
-+
-+ if (unlikely(task && (time_before_eq((unsigned long)task->start_time.tv_sec, (unsigned long)shm_createtime) ||
-+ (task->pid == shm_lapid)) &&
-+ (task->acl->mode & GR_PROTSHM) &&
-+ (task->acl != current->acl))) {
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+ gr_log_int3(GR_DONT_AUDIT, GR_SHMAT_ACL_MSG, cuid, shm_cprid, shmid);
-+ return 0;
-+ }
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+
-+ return 1;
-+}
-diff --git a/grsecurity/grsec_chdir.c b/grsecurity/grsec_chdir.c
-new file mode 100644
-index 0000000..bc0be01
---- /dev/null
-+++ b/grsecurity/grsec_chdir.c
-@@ -0,0 +1,19 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/fs.h>
-+#include <linux/file.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+void
-+gr_log_chdir(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
-+ if ((grsec_enable_chdir && grsec_enable_group &&
-+ in_group_p(grsec_audit_gid)) || (grsec_enable_chdir &&
-+ !grsec_enable_group)) {
-+ gr_log_fs_generic(GR_DO_AUDIT, GR_CHDIR_AUDIT_MSG, dentry, mnt);
-+ }
-+#endif
-+ return;
-+}
-diff --git a/grsecurity/grsec_chroot.c b/grsecurity/grsec_chroot.c
-new file mode 100644
-index 0000000..bc7b3635
---- /dev/null
-+++ b/grsecurity/grsec_chroot.c
-@@ -0,0 +1,388 @@
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/mount.h>
-+#include <linux/types.h>
-+#include <linux/pid_namespace.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+#ifdef CONFIG_GRKERNSEC_CHROOT_INITRD
-+static int gr_init_ran;
-+#endif
-+
-+void gr_set_chroot_entries(struct task_struct *task, struct path *path)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+ if (task->pid > 1 && path->dentry != init_task.fs->root.dentry &&
-+ path->dentry != task->nsproxy->mnt_ns->root->mnt_root
-+#ifdef CONFIG_GRKERNSEC_CHROOT_INITRD
-+ && gr_init_ran
-+#endif
-+ )
-+ task->gr_is_chrooted = 1;
-+ else {
-+#ifdef CONFIG_GRKERNSEC_CHROOT_INITRD
-+ if (task->pid == 1 && !gr_init_ran)
-+ gr_init_ran = 1;
-+#endif
-+ task->gr_is_chrooted = 0;
-+ }
-+
-+ task->gr_chroot_dentry = path->dentry;
-+#endif
-+ return;
-+}
-+
-+void gr_clear_chroot_entries(struct task_struct *task)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+ task->gr_is_chrooted = 0;
-+ task->gr_chroot_dentry = NULL;
-+#endif
-+ return;
-+}
-+
-+int
-+gr_handle_chroot_unix(const pid_t pid)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
-+ struct task_struct *p;
-+
-+ if (unlikely(!grsec_enable_chroot_unix))
-+ return 1;
-+
-+ if (likely(!proc_is_chrooted(current)))
-+ return 1;
-+
-+ rcu_read_lock();
-+ read_lock(&tasklist_lock);
-+
-+ p = find_task_by_vpid_unrestricted(pid);
-+ if (unlikely(p && !have_same_root(current, p))) {
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+ gr_log_noargs(GR_DONT_AUDIT, GR_UNIX_CHROOT_MSG);
-+ return 0;
-+ }
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+#endif
-+ return 1;
-+}
-+
-+int
-+gr_handle_chroot_nice(void)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
-+ if (grsec_enable_chroot_nice && proc_is_chrooted(current)) {
-+ gr_log_noargs(GR_DONT_AUDIT, GR_NICE_CHROOT_MSG);
-+ return -EPERM;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_handle_chroot_setpriority(struct task_struct *p, const int niceval)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
-+ if (grsec_enable_chroot_nice && (niceval < task_nice(p))
-+ && proc_is_chrooted(current)) {
-+ gr_log_str_int(GR_DONT_AUDIT, GR_PRIORITY_CHROOT_MSG, p->comm, p->pid);
-+ return -EACCES;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_handle_chroot_fowner(struct pid *pid, enum pid_type type)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
-+ struct task_struct *p;
-+ int ret = 0;
-+ if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || !pid)
-+ return ret;
-+
-+ read_lock(&tasklist_lock);
-+ do_each_pid_task(pid, type, p) {
-+ if (!have_same_root(current, p)) {
-+ ret = 1;
-+ goto out;
-+ }
-+ } while_each_pid_task(pid, type, p);
-+out:
-+ read_unlock(&tasklist_lock);
-+ return ret;
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_pid_is_chrooted(struct task_struct *p)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
-+ if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || p == NULL)
-+ return 0;
-+
-+ if ((p->exit_state & (EXIT_ZOMBIE | EXIT_DEAD)) ||
-+ !have_same_root(current, p)) {
-+ return 1;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+EXPORT_SYMBOL(gr_pid_is_chrooted);
-+
-+#if defined(CONFIG_GRKERNSEC_CHROOT_DOUBLE) || defined(CONFIG_GRKERNSEC_CHROOT_FCHDIR)
-+int gr_is_outside_chroot(const struct dentry *u_dentry, const struct vfsmount *u_mnt)
-+{
-+ struct dentry *dentry = (struct dentry *)u_dentry;
-+ struct vfsmount *mnt = (struct vfsmount *)u_mnt;
-+ struct dentry *realroot;
-+ struct vfsmount *realrootmnt;
-+ struct dentry *currentroot;
-+ struct vfsmount *currentmnt;
-+ struct task_struct *reaper = &init_task;
-+ int ret = 1;
-+
-+ read_lock(&reaper->fs->lock);
-+ realrootmnt = mntget(reaper->fs->root.mnt);
-+ realroot = dget(reaper->fs->root.dentry);
-+ read_unlock(&reaper->fs->lock);
-+
-+ read_lock(¤t->fs->lock);
-+ currentmnt = mntget(current->fs->root.mnt);
-+ currentroot = dget(current->fs->root.dentry);
-+ read_unlock(¤t->fs->lock);
-+
-+ spin_lock(&dcache_lock);
-+ for (;;) {
-+ if (unlikely((dentry == realroot && mnt == realrootmnt)
-+ || (dentry == currentroot && mnt == currentmnt)))
-+ break;
-+ if (unlikely(dentry == mnt->mnt_root || IS_ROOT(dentry))) {
-+ if (mnt->mnt_parent == mnt)
-+ break;
-+ dentry = mnt->mnt_mountpoint;
-+ mnt = mnt->mnt_parent;
-+ continue;
-+ }
-+ dentry = dentry->d_parent;
-+ }
-+ spin_unlock(&dcache_lock);
-+
-+ dput(currentroot);
-+ mntput(currentmnt);
-+
-+ /* access is outside of chroot */
-+ if (dentry == realroot && mnt == realrootmnt)
-+ ret = 0;
-+
-+ dput(realroot);
-+ mntput(realrootmnt);
-+ return ret;
-+}
-+#endif
-+
-+int
-+gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
-+ if (!grsec_enable_chroot_fchdir)
-+ return 1;
-+
-+ if (!proc_is_chrooted(current))
-+ return 1;
-+ else if (!gr_is_outside_chroot(u_dentry, u_mnt)) {
-+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_FCHDIR_MSG, u_dentry, u_mnt);
-+ return 0;
-+ }
-+#endif
-+ return 1;
-+}
-+
-+int
-+gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
-+ const time_t shm_createtime)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
-+ struct task_struct *p;
-+ time_t starttime;
-+
-+ if (unlikely(!grsec_enable_chroot_shmat))
-+ return 1;
-+
-+ if (likely(!proc_is_chrooted(current)))
-+ return 1;
-+
-+ rcu_read_lock();
-+ read_lock(&tasklist_lock);
-+
-+ if ((p = find_task_by_vpid_unrestricted(shm_cprid))) {
-+ starttime = p->start_time.tv_sec;
-+ if (time_before_eq((unsigned long)starttime, (unsigned long)shm_createtime)) {
-+ if (have_same_root(current, p)) {
-+ goto allow;
-+ } else {
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+ gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
-+ return 0;
-+ }
-+ }
-+ /* creator exited, pid reuse, fall through to next check */
-+ }
-+ if ((p = find_task_by_vpid_unrestricted(shm_lapid))) {
-+ if (unlikely(!have_same_root(current, p))) {
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+ gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
-+ return 0;
-+ }
-+ }
-+
-+allow:
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+#endif
-+ return 1;
-+}
-+
-+void
-+gr_log_chroot_exec(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
-+ if (grsec_enable_chroot_execlog && proc_is_chrooted(current))
-+ gr_log_fs_generic(GR_DO_AUDIT, GR_EXEC_CHROOT_MSG, dentry, mnt);
-+#endif
-+ return;
-+}
-+
-+int
-+gr_handle_chroot_mknod(const struct dentry *dentry,
-+ const struct vfsmount *mnt, const int mode)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
-+ if (grsec_enable_chroot_mknod && !S_ISFIFO(mode) && !S_ISREG(mode) &&
-+ proc_is_chrooted(current)) {
-+ gr_log_fs_generic(GR_DONT_AUDIT, GR_MKNOD_CHROOT_MSG, dentry, mnt);
-+ return -EPERM;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_handle_chroot_mount(const struct dentry *dentry,
-+ const struct vfsmount *mnt, const char *dev_name)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
-+ if (grsec_enable_chroot_mount && proc_is_chrooted(current)) {
-+ gr_log_str_fs(GR_DONT_AUDIT, GR_MOUNT_CHROOT_MSG, dev_name ? dev_name : "none" , dentry, mnt);
-+ return -EPERM;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_handle_chroot_pivot(void)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
-+ if (grsec_enable_chroot_pivot && proc_is_chrooted(current)) {
-+ gr_log_noargs(GR_DONT_AUDIT, GR_PIVOT_CHROOT_MSG);
-+ return -EPERM;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_handle_chroot_chroot(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
-+ if (grsec_enable_chroot_double && proc_is_chrooted(current) &&
-+ !gr_is_outside_chroot(dentry, mnt)) {
-+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_CHROOT_MSG, dentry, mnt);
-+ return -EPERM;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+extern const char *captab_log[];
-+extern int captab_log_entries;
-+
-+int
-+gr_chroot_is_capable(const int cap)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
-+ if (grsec_enable_chroot_caps && proc_is_chrooted(current)) {
-+ kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
-+ if (cap_raised(chroot_caps, cap)) {
-+ const struct cred *creds = current_cred();
-+ if (cap_raised(creds->cap_effective, cap) && cap < captab_log_entries) {
-+ gr_log_cap(GR_DONT_AUDIT, GR_CAP_CHROOT_MSG, current, captab_log[cap]);
-+ }
-+ return 0;
-+ }
-+ }
-+#endif
-+ return 1;
-+}
-+
-+int
-+gr_chroot_is_capable_nolog(const int cap)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
-+ if (grsec_enable_chroot_caps && proc_is_chrooted(current)) {
-+ kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
-+ if (cap_raised(chroot_caps, cap)) {
-+ return 0;
-+ }
-+ }
-+#endif
-+ return 1;
-+}
-+
-+int
-+gr_handle_chroot_sysctl(const int op)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
-+ if (grsec_enable_chroot_sysctl && proc_is_chrooted(current)
-+ && (op & MAY_WRITE))
-+ return -EACCES;
-+#endif
-+ return 0;
-+}
-+
-+void
-+gr_handle_chroot_chdir(struct path *path)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
-+ if (grsec_enable_chroot_chdir)
-+ set_fs_pwd(current->fs, path);
-+#endif
-+ return;
-+}
-+
-+int
-+gr_handle_chroot_chmod(const struct dentry *dentry,
-+ const struct vfsmount *mnt, const int mode)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
-+ /* allow chmod +s on directories, but not on files */
-+ if (grsec_enable_chroot_chmod && !S_ISDIR(dentry->d_inode->i_mode) &&
-+ ((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))) &&
-+ proc_is_chrooted(current)) {
-+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHMOD_CHROOT_MSG, dentry, mnt);
-+ return -EPERM;
-+ }
-+#endif
-+ return 0;
-+}
-diff --git a/grsecurity/grsec_disabled.c b/grsecurity/grsec_disabled.c
-new file mode 100644
-index 0000000..6b00c2a
---- /dev/null
-+++ b/grsecurity/grsec_disabled.c
-@@ -0,0 +1,448 @@
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/kdev_t.h>
-+#include <linux/net.h>
-+#include <linux/in.h>
-+#include <linux/ip.h>
-+#include <linux/skbuff.h>
-+#include <linux/sysctl.h>
-+
-+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
-+void
-+pax_set_initial_flags(struct linux_binprm *bprm)
-+{
-+ return;
-+}
-+#endif
-+
-+#ifdef CONFIG_SYSCTL
-+__u32
-+gr_handle_sysctl(const struct ctl_table * table, const int op)
-+{
-+ return 0;
-+}
-+#endif
-+
-+#ifdef CONFIG_TASKSTATS
-+int gr_is_taskstats_denied(int pid)
-+{
-+ return 0;
-+}
-+#endif
-+
-+int
-+gr_acl_is_enabled(void)
-+{
-+ return 0;
-+}
-+
-+void
-+gr_handle_proc_create(const struct dentry *dentry, const struct inode *inode)
-+{
-+ return;
-+}
-+
-+int
-+gr_handle_rawio(const struct inode *inode)
-+{
-+ return 0;
-+}
-+
-+void
-+gr_acl_handle_psacct(struct task_struct *task, const long code)
-+{
-+ return;
-+}
-+
-+int
-+gr_handle_ptrace(struct task_struct *task, const long request)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_handle_proc_ptrace(struct task_struct *task)
-+{
-+ return 0;
-+}
-+
-+void
-+gr_learn_resource(const struct task_struct *task,
-+ const int res, const unsigned long wanted, const int gt)
-+{
-+ return;
-+}
-+
-+int
-+gr_set_acls(const int type)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_check_hidden_task(const struct task_struct *tsk)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_check_protected_task(const struct task_struct *task)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
-+{
-+ return 0;
-+}
-+
-+void
-+gr_copy_label(struct task_struct *tsk)
-+{
-+ return;
-+}
-+
-+void
-+gr_set_pax_flags(struct task_struct *task)
-+{
-+ return;
-+}
-+
-+int
-+gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
-+ const int unsafe_share)
-+{
-+ return 0;
-+}
-+
-+void
-+gr_handle_delete(const ino_t ino, const dev_t dev)
-+{
-+ return;
-+}
-+
-+void
-+gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return;
-+}
-+
-+void
-+gr_handle_crash(struct task_struct *task, const int sig)
-+{
-+ return;
-+}
-+
-+int
-+gr_check_crash_exec(const struct file *filp)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_check_crash_uid(const uid_t uid)
-+{
-+ return 0;
-+}
-+
-+void
-+gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
-+ struct dentry *old_dentry,
-+ struct dentry *new_dentry,
-+ struct vfsmount *mnt, const __u8 replace)
-+{
-+ return;
-+}
-+
-+int
-+gr_search_socket(const int family, const int type, const int protocol)
-+{
-+ return 1;
-+}
-+
-+int
-+gr_search_connectbind(const int mode, const struct socket *sock,
-+ const struct sockaddr_in *addr)
-+{
-+ return 0;
-+}
-+
-+void
-+gr_handle_alertkill(struct task_struct *task)
-+{
-+ return;
-+}
-+
-+__u32
-+gr_acl_handle_execve(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_hidden_file(const struct dentry * dentry,
-+ const struct vfsmount * mnt)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
-+ int acc_mode)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_unlink(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+ return 1;
-+}
-+
-+int
-+gr_acl_handle_mmap(const struct file *file, const unsigned long prot,
-+ unsigned int *vm_flags)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_truncate(const struct dentry * dentry,
-+ const struct vfsmount * mnt)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_utime(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_access(const struct dentry * dentry,
-+ const struct vfsmount * mnt, const int fmode)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_chmod(const struct dentry * dentry, const struct vfsmount * mnt,
-+ umode_t *mode)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_chown(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_setxattr(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_removexattr(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+ return 1;
-+}
-+
-+void
-+grsecurity_init(void)
-+{
-+ return;
-+}
-+
-+umode_t gr_acl_umask(void)
-+{
-+ return 0;
-+}
-+
-+__u32
-+gr_acl_handle_mknod(const struct dentry * new_dentry,
-+ const struct dentry * parent_dentry,
-+ const struct vfsmount * parent_mnt,
-+ const int mode)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_mkdir(const struct dentry * new_dentry,
-+ const struct dentry * parent_dentry,
-+ const struct vfsmount * parent_mnt)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_symlink(const struct dentry * new_dentry,
-+ const struct dentry * parent_dentry,
-+ const struct vfsmount * parent_mnt, const char *from)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_link(const struct dentry * new_dentry,
-+ const struct dentry * parent_dentry,
-+ const struct vfsmount * parent_mnt,
-+ const struct dentry * old_dentry,
-+ const struct vfsmount * old_mnt, const char *to)
-+{
-+ return 1;
-+}
-+
-+int
-+gr_acl_handle_rename(const struct dentry *new_dentry,
-+ const struct dentry *parent_dentry,
-+ const struct vfsmount *parent_mnt,
-+ const struct dentry *old_dentry,
-+ const struct inode *old_parent_inode,
-+ const struct vfsmount *old_mnt, const char *newname)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_acl_handle_filldir(const struct file *file, const char *name,
-+ const int namelen, const ino_t ino)
-+{
-+ return 1;
-+}
-+
-+int
-+gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
-+ const time_t shm_createtime, const uid_t cuid, const int shmid)
-+{
-+ return 1;
-+}
-+
-+int
-+gr_search_bind(const struct socket *sock, const struct sockaddr_in *addr)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_search_accept(const struct socket *sock)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_search_listen(const struct socket *sock)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_search_connect(const struct socket *sock, const struct sockaddr_in *addr)
-+{
-+ return 0;
-+}
-+
-+__u32
-+gr_acl_handle_unix(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_creat(const struct dentry * dentry,
-+ const struct dentry * p_dentry,
-+ const struct vfsmount * p_mnt, int open_flags, int acc_mode,
-+ const int imode)
-+{
-+ return 1;
-+}
-+
-+void
-+gr_acl_handle_exit(void)
-+{
-+ return;
-+}
-+
-+int
-+gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
-+{
-+ return 1;
-+}
-+
-+void
-+gr_set_role_label(const uid_t uid, const gid_t gid)
-+{
-+ return;
-+}
-+
-+int
-+gr_acl_handle_procpidmem(const struct task_struct *task)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr)
-+{
-+ return 0;
-+}
-+
-+void
-+gr_set_kernel_label(struct task_struct *task)
-+{
-+ return;
-+}
-+
-+int
-+gr_check_user_change(int real, int effective, int fs)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_check_group_change(int real, int effective, int fs)
-+{
-+ return 0;
-+}
-+
-+int gr_acl_enable_at_secure(void)
-+{
-+ return 0;
-+}
-+
-+dev_t gr_get_dev_from_dentry(struct dentry *dentry)
-+{
-+ return dentry->d_sb->s_dev;
-+}
-+
-+void gr_put_exec_file(struct task_struct *task)
-+{
-+ return;
-+}
-+
-+EXPORT_SYMBOL(gr_learn_resource);
-+EXPORT_SYMBOL(gr_set_kernel_label);
-+#ifdef CONFIG_SECURITY
-+EXPORT_SYMBOL(gr_check_user_change);
-+EXPORT_SYMBOL(gr_check_group_change);
-+#endif
-diff --git a/grsecurity/grsec_exec.c b/grsecurity/grsec_exec.c
-new file mode 100644
-index 0000000..a96e155
---- /dev/null
-+++ b/grsecurity/grsec_exec.c
-@@ -0,0 +1,204 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/binfmts.h>
-+#include <linux/smp_lock.h>
-+#include <linux/fs.h>
-+#include <linux/types.h>
-+#include <linux/grdefs.h>
-+#include <linux/grinternal.h>
-+#include <linux/capability.h>
-+#include <linux/compat.h>
-+#include <linux/module.h>
-+
-+#include <asm/uaccess.h>
-+
-+#ifdef CONFIG_GRKERNSEC_EXECLOG
-+static char gr_exec_arg_buf[132];
-+static DEFINE_MUTEX(gr_exec_arg_mutex);
-+#endif
-+
-+void
-+gr_handle_exec_args(struct linux_binprm *bprm, const char __user *const __user *argv)
-+{
-+#ifdef CONFIG_GRKERNSEC_EXECLOG
-+ char *grarg = gr_exec_arg_buf;
-+ unsigned int i, x, execlen = 0;
-+ char c;
-+
-+ if (!((grsec_enable_execlog && grsec_enable_group &&
-+ in_group_p(grsec_audit_gid))
-+ || (grsec_enable_execlog && !grsec_enable_group)))
-+ return;
-+
-+ mutex_lock(&gr_exec_arg_mutex);
-+ memset(grarg, 0, sizeof(gr_exec_arg_buf));
-+
-+ if (unlikely(argv == NULL))
-+ goto log;
-+
-+ for (i = 0; i < bprm->argc && execlen < 128; i++) {
-+ const char __user *p;
-+ unsigned int len;
-+
-+ if (copy_from_user(&p, argv + i, sizeof(p)))
-+ goto log;
-+ if (!p)
-+ goto log;
-+ len = strnlen_user(p, 128 - execlen);
-+ if (len > 128 - execlen)
-+ len = 128 - execlen;
-+ else if (len > 0)
-+ len--;
-+ if (copy_from_user(grarg + execlen, p, len))
-+ goto log;
-+
-+ /* rewrite unprintable characters */
-+ for (x = 0; x < len; x++) {
-+ c = *(grarg + execlen + x);
-+ if (c < 32 || c > 126)
-+ *(grarg + execlen + x) = ' ';
-+ }
-+
-+ execlen += len;
-+ *(grarg + execlen) = ' ';
-+ *(grarg + execlen + 1) = '\0';
-+ execlen++;
-+ }
-+
-+ log:
-+ gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
-+ bprm->file->f_path.mnt, grarg);
-+ mutex_unlock(&gr_exec_arg_mutex);
-+#endif
-+ return;
-+}
-+
-+#ifdef CONFIG_COMPAT
-+void
-+gr_handle_exec_args_compat(struct linux_binprm *bprm, compat_uptr_t __user *argv)
-+{
-+#ifdef CONFIG_GRKERNSEC_EXECLOG
-+ char *grarg = gr_exec_arg_buf;
-+ unsigned int i, x, execlen = 0;
-+ char c;
-+
-+ if (!((grsec_enable_execlog && grsec_enable_group &&
-+ in_group_p(grsec_audit_gid))
-+ || (grsec_enable_execlog && !grsec_enable_group)))
-+ return;
-+
-+ mutex_lock(&gr_exec_arg_mutex);
-+ memset(grarg, 0, sizeof(gr_exec_arg_buf));
-+
-+ if (unlikely(argv == NULL))
-+ goto log;
-+
-+ for (i = 0; i < bprm->argc && execlen < 128; i++) {
-+ compat_uptr_t p;
-+ unsigned int len;
-+
-+ if (get_user(p, argv + i))
-+ goto log;
-+ len = strnlen_user(compat_ptr(p), 128 - execlen);
-+ if (len > 128 - execlen)
-+ len = 128 - execlen;
-+ else if (len > 0)
-+ len--;
-+ else
-+ goto log;
-+ if (copy_from_user(grarg + execlen, compat_ptr(p), len))
-+ goto log;
-+
-+ /* rewrite unprintable characters */
-+ for (x = 0; x < len; x++) {
-+ c = *(grarg + execlen + x);
-+ if (c < 32 || c > 126)
-+ *(grarg + execlen + x) = ' ';
-+ }
-+
-+ execlen += len;
-+ *(grarg + execlen) = ' ';
-+ *(grarg + execlen + 1) = '\0';
-+ execlen++;
-+ }
-+
-+ log:
-+ gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
-+ bprm->file->f_path.mnt, grarg);
-+ mutex_unlock(&gr_exec_arg_mutex);
-+#endif
-+ return;
-+}
-+#endif
-+
-+#ifdef CONFIG_GRKERNSEC
-+extern int gr_acl_is_capable(const int cap);
-+extern int gr_acl_is_capable_nolog(const int cap);
-+extern int gr_chroot_is_capable(const int cap);
-+extern int gr_chroot_is_capable_nolog(const int cap);
-+#endif
-+
-+const char *captab_log[] = {
-+ "CAP_CHOWN",
-+ "CAP_DAC_OVERRIDE",
-+ "CAP_DAC_READ_SEARCH",
-+ "CAP_FOWNER",
-+ "CAP_FSETID",
-+ "CAP_KILL",
-+ "CAP_SETGID",
-+ "CAP_SETUID",
-+ "CAP_SETPCAP",
-+ "CAP_LINUX_IMMUTABLE",
-+ "CAP_NET_BIND_SERVICE",
-+ "CAP_NET_BROADCAST",
-+ "CAP_NET_ADMIN",
-+ "CAP_NET_RAW",
-+ "CAP_IPC_LOCK",
-+ "CAP_IPC_OWNER",
-+ "CAP_SYS_MODULE",
-+ "CAP_SYS_RAWIO",
-+ "CAP_SYS_CHROOT",
-+ "CAP_SYS_PTRACE",
-+ "CAP_SYS_PACCT",
-+ "CAP_SYS_ADMIN",
-+ "CAP_SYS_BOOT",
-+ "CAP_SYS_NICE",
-+ "CAP_SYS_RESOURCE",
-+ "CAP_SYS_TIME",
-+ "CAP_SYS_TTY_CONFIG",
-+ "CAP_MKNOD",
-+ "CAP_LEASE",
-+ "CAP_AUDIT_WRITE",
-+ "CAP_AUDIT_CONTROL",
-+ "CAP_SETFCAP",
-+ "CAP_MAC_OVERRIDE",
-+ "CAP_MAC_ADMIN"
-+};
-+
-+int captab_log_entries = sizeof(captab_log)/sizeof(captab_log[0]);
-+
-+int gr_is_capable(const int cap)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+ if (gr_acl_is_capable(cap) && gr_chroot_is_capable(cap))
-+ return 1;
-+ return 0;
-+#else
-+ return 1;
-+#endif
-+}
-+
-+int gr_is_capable_nolog(const int cap)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+ if (gr_acl_is_capable_nolog(cap) && gr_chroot_is_capable_nolog(cap))
-+ return 1;
-+ return 0;
-+#else
-+ return 1;
-+#endif
-+}
-+
-+EXPORT_SYMBOL(gr_is_capable);
-+EXPORT_SYMBOL(gr_is_capable_nolog);
-diff --git a/grsecurity/grsec_fifo.c b/grsecurity/grsec_fifo.c
-new file mode 100644
-index 0000000..d3ee748
---- /dev/null
-+++ b/grsecurity/grsec_fifo.c
-@@ -0,0 +1,24 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/fs.h>
-+#include <linux/file.h>
-+#include <linux/grinternal.h>
-+
-+int
-+gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
-+ const struct dentry *dir, const int flag, const int acc_mode)
-+{
-+#ifdef CONFIG_GRKERNSEC_FIFO
-+ const struct cred *cred = current_cred();
-+
-+ if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
-+ !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
-+ (dentry->d_inode->i_uid != dir->d_inode->i_uid) &&
-+ (cred->fsuid != dentry->d_inode->i_uid)) {
-+ if (!inode_permission(dentry->d_inode, acc_mode))
-+ gr_log_fs_int2(GR_DONT_AUDIT, GR_FIFO_MSG, dentry, mnt, dentry->d_inode->i_uid, dentry->d_inode->i_gid);
-+ return -EACCES;
-+ }
-+#endif
-+ return 0;
-+}
-diff --git a/grsecurity/grsec_fork.c b/grsecurity/grsec_fork.c
-new file mode 100644
-index 0000000..8ca18bf
---- /dev/null
-+++ b/grsecurity/grsec_fork.c
-@@ -0,0 +1,23 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+#include <linux/errno.h>
-+
-+void
-+gr_log_forkfail(const int retval)
-+{
-+#ifdef CONFIG_GRKERNSEC_FORKFAIL
-+ if (grsec_enable_forkfail && (retval == -EAGAIN || retval == -ENOMEM)) {
-+ switch (retval) {
-+ case -EAGAIN:
-+ gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "EAGAIN");
-+ break;
-+ case -ENOMEM:
-+ gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "ENOMEM");
-+ break;
-+ }
-+ }
-+#endif
-+ return;
-+}
-diff --git a/grsecurity/grsec_init.c b/grsecurity/grsec_init.c
-new file mode 100644
-index 0000000..e2f1239
---- /dev/null
-+++ b/grsecurity/grsec_init.c
-@@ -0,0 +1,288 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/mm.h>
-+#include <linux/smp_lock.h>
-+#include <linux/gracl.h>
-+#include <linux/slab.h>
-+#include <linux/vmalloc.h>
-+#include <linux/percpu.h>
-+#include <linux/module.h>
-+
-+int grsec_enable_ptrace_readexec;
-+int grsec_enable_setxid;
-+int grsec_enable_symlinkown;
-+int grsec_symlinkown_gid;
-+int grsec_enable_brute;
-+int grsec_enable_link;
-+int grsec_enable_dmesg;
-+int grsec_enable_harden_ptrace;
-+int grsec_enable_fifo;
-+int grsec_enable_execlog;
-+int grsec_enable_signal;
-+int grsec_enable_forkfail;
-+int grsec_enable_audit_ptrace;
-+int grsec_enable_time;
-+int grsec_enable_audit_textrel;
-+int grsec_enable_group;
-+int grsec_audit_gid;
-+int grsec_enable_chdir;
-+int grsec_enable_mount;
-+int grsec_enable_rofs;
-+int grsec_deny_new_usb;
-+int grsec_enable_chroot_findtask;
-+int grsec_enable_chroot_mount;
-+int grsec_enable_chroot_shmat;
-+int grsec_enable_chroot_fchdir;
-+int grsec_enable_chroot_double;
-+int grsec_enable_chroot_pivot;
-+int grsec_enable_chroot_chdir;
-+int grsec_enable_chroot_chmod;
-+int grsec_enable_chroot_mknod;
-+int grsec_enable_chroot_nice;
-+int grsec_enable_chroot_execlog;
-+int grsec_enable_chroot_caps;
-+int grsec_enable_chroot_sysctl;
-+int grsec_enable_chroot_unix;
-+int grsec_enable_tpe;
-+int grsec_tpe_gid;
-+int grsec_enable_blackhole;
-+#ifdef CONFIG_IPV6_MODULE
-+EXPORT_SYMBOL(grsec_enable_blackhole);
-+#endif
-+int grsec_lastack_retries;
-+int grsec_enable_tpe_all;
-+int grsec_enable_tpe_invert;
-+int grsec_enable_socket_all;
-+int grsec_socket_all_gid;
-+int grsec_enable_socket_client;
-+int grsec_socket_client_gid;
-+int grsec_enable_socket_server;
-+int grsec_socket_server_gid;
-+int grsec_resource_logging;
-+int grsec_disable_privio;
-+int grsec_enable_log_rwxmaps;
-+int grsec_lock;
-+
-+DEFINE_SPINLOCK(grsec_alert_lock);
-+unsigned long grsec_alert_wtime = 0;
-+unsigned long grsec_alert_fyet = 0;
-+
-+DEFINE_SPINLOCK(grsec_audit_lock);
-+
-+DEFINE_RWLOCK(grsec_exec_file_lock);
-+
-+char *gr_shared_page[4];
-+
-+char *gr_alert_log_fmt;
-+char *gr_audit_log_fmt;
-+char *gr_alert_log_buf;
-+char *gr_audit_log_buf;
-+
-+extern struct gr_arg *gr_usermode;
-+extern unsigned char *gr_system_salt;
-+extern unsigned char *gr_system_sum;
-+
-+void __init
-+grsecurity_init(void)
-+{
-+ int j;
-+ /* create the per-cpu shared pages */
-+
-+#ifdef CONFIG_X86
-+ memset((char *)(0x41a + PAGE_OFFSET), 0, 36);
-+#endif
-+
-+ for (j = 0; j < 4; j++) {
-+ gr_shared_page[j] = (char *)__alloc_percpu(PAGE_SIZE, __alignof__(unsigned long long));
-+ if (gr_shared_page[j] == NULL) {
-+ panic("Unable to allocate grsecurity shared page");
-+ return;
-+ }
-+ }
-+
-+ /* allocate log buffers */
-+ gr_alert_log_fmt = kmalloc(512, GFP_KERNEL);
-+ if (!gr_alert_log_fmt) {
-+ panic("Unable to allocate grsecurity alert log format buffer");
-+ return;
-+ }
-+ gr_audit_log_fmt = kmalloc(512, GFP_KERNEL);
-+ if (!gr_audit_log_fmt) {
-+ panic("Unable to allocate grsecurity audit log format buffer");
-+ return;
-+ }
-+ gr_alert_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
-+ if (!gr_alert_log_buf) {
-+ panic("Unable to allocate grsecurity alert log buffer");
-+ return;
-+ }
-+ gr_audit_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
-+ if (!gr_audit_log_buf) {
-+ panic("Unable to allocate grsecurity audit log buffer");
-+ return;
-+ }
-+
-+ /* allocate memory for authentication structure */
-+ gr_usermode = kmalloc(sizeof(struct gr_arg), GFP_KERNEL);
-+ gr_system_salt = kmalloc(GR_SALT_LEN, GFP_KERNEL);
-+ gr_system_sum = kmalloc(GR_SHA_LEN, GFP_KERNEL);
-+
-+ if (!gr_usermode || !gr_system_salt || !gr_system_sum) {
-+ panic("Unable to allocate grsecurity authentication structure");
-+ return;
-+ }
-+
-+
-+#ifdef CONFIG_GRKERNSEC_IO
-+#if !defined(CONFIG_GRKERNSEC_SYSCTL_DISTRO)
-+ grsec_disable_privio = 1;
-+#elif defined(CONFIG_GRKERNSEC_SYSCTL_ON)
-+ grsec_disable_privio = 1;
-+#else
-+ grsec_disable_privio = 0;
-+#endif
-+#endif
-+
-+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
-+ /* for backward compatibility, tpe_invert always defaults to on if
-+ enabled in the kernel
-+ */
-+ grsec_enable_tpe_invert = 1;
-+#endif
-+
-+#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
-+#ifndef CONFIG_GRKERNSEC_SYSCTL
-+ grsec_lock = 1;
-+#endif
-+
-+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
-+ grsec_enable_audit_textrel = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
-+ grsec_enable_log_rwxmaps = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
-+ grsec_enable_group = 1;
-+ grsec_audit_gid = CONFIG_GRKERNSEC_AUDIT_GID;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
-+ grsec_enable_chdir = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+ grsec_enable_harden_ptrace = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
-+ grsec_enable_mount = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_LINK
-+ grsec_enable_link = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_BRUTE
-+ grsec_enable_brute = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_DMESG
-+ grsec_enable_dmesg = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ grsec_enable_blackhole = 1;
-+ grsec_lastack_retries = 4;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_FIFO
-+ grsec_enable_fifo = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_EXECLOG
-+ grsec_enable_execlog = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+ grsec_enable_setxid = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_PTRACE_READEXEC
-+ grsec_enable_ptrace_readexec = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SIGNAL
-+ grsec_enable_signal = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_FORKFAIL
-+ grsec_enable_forkfail = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_TIME
-+ grsec_enable_time = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_RESLOG
-+ grsec_resource_logging = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
-+ grsec_enable_chroot_findtask = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
-+ grsec_enable_chroot_unix = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
-+ grsec_enable_chroot_mount = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
-+ grsec_enable_chroot_fchdir = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
-+ grsec_enable_chroot_shmat = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
-+ grsec_enable_audit_ptrace = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
-+ grsec_enable_chroot_double = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
-+ grsec_enable_chroot_pivot = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
-+ grsec_enable_chroot_chdir = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
-+ grsec_enable_chroot_chmod = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
-+ grsec_enable_chroot_mknod = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
-+ grsec_enable_chroot_nice = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
-+ grsec_enable_chroot_execlog = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
-+ grsec_enable_chroot_caps = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
-+ grsec_enable_chroot_sysctl = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SYMLINKOWN
-+ grsec_enable_symlinkown = 1;
-+ grsec_symlinkown_gid = CONFIG_GRKERNSEC_SYMLINKOWN_GID;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_TPE
-+ grsec_enable_tpe = 1;
-+ grsec_tpe_gid = CONFIG_GRKERNSEC_TPE_GID;
-+#ifdef CONFIG_GRKERNSEC_TPE_ALL
-+ grsec_enable_tpe_all = 1;
-+#endif
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
-+ grsec_enable_socket_all = 1;
-+ grsec_socket_all_gid = CONFIG_GRKERNSEC_SOCKET_ALL_GID;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
-+ grsec_enable_socket_client = 1;
-+ grsec_socket_client_gid = CONFIG_GRKERNSEC_SOCKET_CLIENT_GID;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
-+ grsec_enable_socket_server = 1;
-+ grsec_socket_server_gid = CONFIG_GRKERNSEC_SOCKET_SERVER_GID;
-+#endif
-+#endif
-+#ifdef CONFIG_GRKERNSEC_DENYUSB_FORCE
-+ grsec_deny_new_usb = 1;
-+#endif
-+
-+ return;
-+}
-diff --git a/grsecurity/grsec_link.c b/grsecurity/grsec_link.c
-new file mode 100644
-index 0000000..8598e7f
---- /dev/null
-+++ b/grsecurity/grsec_link.c
-@@ -0,0 +1,58 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/fs.h>
-+#include <linux/file.h>
-+#include <linux/grinternal.h>
-+
-+int gr_handle_symlink_owner(const struct path *link, const struct inode *target)
-+{
-+#ifdef CONFIG_GRKERNSEC_SYMLINKOWN
-+ const struct inode *link_inode = link->dentry->d_inode;
-+
-+ if (grsec_enable_symlinkown && in_group_p(grsec_symlinkown_gid) &&
-+ /* ignore root-owned links, e.g. /proc/self */
-+ link_inode->i_uid && target &&
-+ link_inode->i_uid != target->i_uid) {
-+ gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINKOWNER_MSG, link->dentry, link->mnt, link_inode->i_uid, target->i_uid);
-+ return 1;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_handle_follow_link(const struct inode *parent,
-+ const struct inode *inode,
-+ const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+#ifdef CONFIG_GRKERNSEC_LINK
-+ const struct cred *cred = current_cred();
-+
-+ if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
-+ (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) &&
-+ (parent->i_mode & S_IWOTH) && (cred->fsuid != inode->i_uid)) {
-+ gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid);
-+ return -EACCES;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_handle_hardlink(const struct dentry *dentry,
-+ const struct vfsmount *mnt,
-+ struct inode *inode, const int mode, const char *to)
-+{
-+#ifdef CONFIG_GRKERNSEC_LINK
-+ const struct cred *cred = current_cred();
-+
-+ if (grsec_enable_link && cred->fsuid != inode->i_uid &&
-+ (!S_ISREG(mode) || is_privileged_binary(dentry) ||
-+ (inode_permission(inode, MAY_READ | MAY_WRITE))) &&
-+ !capable(CAP_FOWNER) && cred->uid) {
-+ gr_log_fs_int2_str(GR_DONT_AUDIT, GR_HARDLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid, to);
-+ return -EPERM;
-+ }
-+#endif
-+ return 0;
-+}
-diff --git a/grsecurity/grsec_log.c b/grsecurity/grsec_log.c
-new file mode 100644
-index 0000000..a45d2e9
---- /dev/null
-+++ b/grsecurity/grsec_log.c
-@@ -0,0 +1,322 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/tty.h>
-+#include <linux/fs.h>
-+#include <linux/grinternal.h>
-+
-+#ifdef CONFIG_TREE_PREEMPT_RCU
-+#define DISABLE_PREEMPT() preempt_disable()
-+#define ENABLE_PREEMPT() preempt_enable()
-+#else
-+#define DISABLE_PREEMPT()
-+#define ENABLE_PREEMPT()
-+#endif
-+
-+#define BEGIN_LOCKS(x) \
-+ DISABLE_PREEMPT(); \
-+ rcu_read_lock(); \
-+ read_lock(&tasklist_lock); \
-+ read_lock(&grsec_exec_file_lock); \
-+ if (x != GR_DO_AUDIT) \
-+ spin_lock(&grsec_alert_lock); \
-+ else \
-+ spin_lock(&grsec_audit_lock)
-+
-+#define END_LOCKS(x) \
-+ if (x != GR_DO_AUDIT) \
-+ spin_unlock(&grsec_alert_lock); \
-+ else \
-+ spin_unlock(&grsec_audit_lock); \
-+ read_unlock(&grsec_exec_file_lock); \
-+ read_unlock(&tasklist_lock); \
-+ rcu_read_unlock(); \
-+ ENABLE_PREEMPT(); \
-+ if (x == GR_DONT_AUDIT) \
-+ gr_handle_alertkill(current)
-+
-+enum {
-+ FLOODING,
-+ NO_FLOODING
-+};
-+
-+extern char *gr_alert_log_fmt;
-+extern char *gr_audit_log_fmt;
-+extern char *gr_alert_log_buf;
-+extern char *gr_audit_log_buf;
-+
-+static int gr_log_start(int audit)
-+{
-+ char *loglevel = (audit == GR_DO_AUDIT) ? KERN_INFO : KERN_ALERT;
-+ char *fmt = (audit == GR_DO_AUDIT) ? gr_audit_log_fmt : gr_alert_log_fmt;
-+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
-+#if (CONFIG_GRKERNSEC_FLOODTIME > 0 && CONFIG_GRKERNSEC_FLOODBURST > 0)
-+ unsigned long curr_secs = get_seconds();
-+
-+ if (audit == GR_DO_AUDIT)
-+ goto set_fmt;
-+
-+ if (!grsec_alert_wtime || time_after(curr_secs, grsec_alert_wtime + CONFIG_GRKERNSEC_FLOODTIME)) {
-+ grsec_alert_wtime = curr_secs;
-+ grsec_alert_fyet = 0;
-+ } else if (time_before_eq(curr_secs, grsec_alert_wtime + CONFIG_GRKERNSEC_FLOODTIME)
-+ && (grsec_alert_fyet < CONFIG_GRKERNSEC_FLOODBURST)) {
-+ grsec_alert_fyet++;
-+ } else if (grsec_alert_fyet == CONFIG_GRKERNSEC_FLOODBURST) {
-+ grsec_alert_wtime = curr_secs;
-+ grsec_alert_fyet++;
-+ printk(KERN_ALERT "grsec: more alerts, logging disabled for %d seconds\n", CONFIG_GRKERNSEC_FLOODTIME);
-+ return FLOODING;
-+ }
-+ else return FLOODING;
-+
-+set_fmt:
-+#endif
-+ memset(buf, 0, PAGE_SIZE);
-+ if (current->signal->curr_ip && gr_acl_is_enabled()) {
-+ sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: (%.64s:%c:%.950s) ");
-+ snprintf(buf, PAGE_SIZE - 1, fmt, ¤t->signal->curr_ip, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
-+ } else if (current->signal->curr_ip) {
-+ sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: ");
-+ snprintf(buf, PAGE_SIZE - 1, fmt, ¤t->signal->curr_ip);
-+ } else if (gr_acl_is_enabled()) {
-+ sprintf(fmt, "%s%s", loglevel, "grsec: (%.64s:%c:%.950s) ");
-+ snprintf(buf, PAGE_SIZE - 1, fmt, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
-+ } else {
-+ sprintf(fmt, "%s%s", loglevel, "grsec: ");
-+ strcpy(buf, fmt);
-+ }
-+
-+ return NO_FLOODING;
-+}
-+
-+static void gr_log_middle(int audit, const char *msg, va_list ap)
-+ __attribute__ ((format (printf, 2, 0)));
-+
-+static void gr_log_middle(int audit, const char *msg, va_list ap)
-+{
-+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
-+ unsigned int len = strlen(buf);
-+
-+ vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
-+
-+ return;
-+}
-+
-+static void gr_log_middle_varargs(int audit, const char *msg, ...)
-+ __attribute__ ((format (printf, 2, 3)));
-+
-+static void gr_log_middle_varargs(int audit, const char *msg, ...)
-+{
-+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
-+ unsigned int len = strlen(buf);
-+ va_list ap;
-+
-+ va_start(ap, msg);
-+ vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
-+ va_end(ap);
-+
-+ return;
-+}
-+
-+static void gr_log_end(int audit, int append_default)
-+{
-+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
-+
-+ if (append_default) {
-+ unsigned int len = strlen(buf);
-+ snprintf(buf + len, PAGE_SIZE - len - 1, DEFAULTSECMSG, DEFAULTSECARGS(current, current_cred(), __task_cred(current->real_parent)));
-+ }
-+
-+ printk("%s\n", buf);
-+
-+ return;
-+}
-+
-+void gr_log_varargs(int audit, const char *msg, int argtypes, ...)
-+{
-+ int logtype;
-+ char *result = (audit == GR_DO_AUDIT) ? "successful" : "denied";
-+ char *str1 = NULL, *str2 = NULL, *str3 = NULL;
-+ void *voidptr = NULL;
-+ int num1 = 0, num2 = 0;
-+ unsigned long ulong1 = 0, ulong2 = 0;
-+ struct dentry *dentry = NULL;
-+ struct vfsmount *mnt = NULL;
-+ struct file *file = NULL;
-+ struct task_struct *task = NULL;
-+ const struct cred *cred, *pcred;
-+ va_list ap;
-+
-+ BEGIN_LOCKS(audit);
-+ logtype = gr_log_start(audit);
-+ if (logtype == FLOODING) {
-+ END_LOCKS(audit);
-+ return;
-+ }
-+ va_start(ap, argtypes);
-+ switch (argtypes) {
-+ case GR_TTYSNIFF:
-+ task = va_arg(ap, struct task_struct *);
-+ gr_log_middle_varargs(audit, msg, &task->signal->curr_ip, gr_task_fullpath0(task), task->comm, task->pid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid);
-+ break;
-+ case GR_SYSCTL_HIDDEN:
-+ str1 = va_arg(ap, char *);
-+ gr_log_middle_varargs(audit, msg, result, str1);
-+ break;
-+ case GR_RBAC:
-+ dentry = va_arg(ap, struct dentry *);
-+ mnt = va_arg(ap, struct vfsmount *);
-+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt));
-+ break;
-+ case GR_RBAC_STR:
-+ dentry = va_arg(ap, struct dentry *);
-+ mnt = va_arg(ap, struct vfsmount *);
-+ str1 = va_arg(ap, char *);
-+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1);
-+ break;
-+ case GR_STR_RBAC:
-+ str1 = va_arg(ap, char *);
-+ dentry = va_arg(ap, struct dentry *);
-+ mnt = va_arg(ap, struct vfsmount *);
-+ gr_log_middle_varargs(audit, msg, result, str1, gr_to_filename(dentry, mnt));
-+ break;
-+ case GR_RBAC_MODE2:
-+ dentry = va_arg(ap, struct dentry *);
-+ mnt = va_arg(ap, struct vfsmount *);
-+ str1 = va_arg(ap, char *);
-+ str2 = va_arg(ap, char *);
-+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2);
-+ break;
-+ case GR_RBAC_MODE3:
-+ dentry = va_arg(ap, struct dentry *);
-+ mnt = va_arg(ap, struct vfsmount *);
-+ str1 = va_arg(ap, char *);
-+ str2 = va_arg(ap, char *);
-+ str3 = va_arg(ap, char *);
-+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2, str3);
-+ break;
-+ case GR_FILENAME:
-+ dentry = va_arg(ap, struct dentry *);
-+ mnt = va_arg(ap, struct vfsmount *);
-+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt));
-+ break;
-+ case GR_STR_FILENAME:
-+ str1 = va_arg(ap, char *);
-+ dentry = va_arg(ap, struct dentry *);
-+ mnt = va_arg(ap, struct vfsmount *);
-+ gr_log_middle_varargs(audit, msg, str1, gr_to_filename(dentry, mnt));
-+ break;
-+ case GR_FILENAME_STR:
-+ dentry = va_arg(ap, struct dentry *);
-+ mnt = va_arg(ap, struct vfsmount *);
-+ str1 = va_arg(ap, char *);
-+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), str1);
-+ break;
-+ case GR_FILENAME_TWO_INT:
-+ dentry = va_arg(ap, struct dentry *);
-+ mnt = va_arg(ap, struct vfsmount *);
-+ num1 = va_arg(ap, int);
-+ num2 = va_arg(ap, int);
-+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2);
-+ break;
-+ case GR_FILENAME_TWO_INT_STR:
-+ dentry = va_arg(ap, struct dentry *);
-+ mnt = va_arg(ap, struct vfsmount *);
-+ num1 = va_arg(ap, int);
-+ num2 = va_arg(ap, int);
-+ str1 = va_arg(ap, char *);
-+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2, str1);
-+ break;
-+ case GR_TEXTREL:
-+ file = va_arg(ap, struct file *);
-+ ulong1 = va_arg(ap, unsigned long);
-+ ulong2 = va_arg(ap, unsigned long);
-+ gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>", ulong1, ulong2);
-+ break;
-+ case GR_PTRACE:
-+ task = va_arg(ap, struct task_struct *);
-+ gr_log_middle_varargs(audit, msg, task->exec_file ? gr_to_filename(task->exec_file->f_path.dentry, task->exec_file->f_path.mnt) : "(none)", task->comm, task->pid);
-+ break;
-+ case GR_RESOURCE:
-+ task = va_arg(ap, struct task_struct *);
-+ cred = __task_cred(task);
-+ pcred = __task_cred(task->real_parent);
-+ ulong1 = va_arg(ap, unsigned long);
-+ str1 = va_arg(ap, char *);
-+ ulong2 = va_arg(ap, unsigned long);
-+ gr_log_middle_varargs(audit, msg, ulong1, str1, ulong2, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
-+ break;
-+ case GR_CAP:
-+ task = va_arg(ap, struct task_struct *);
-+ cred = __task_cred(task);
-+ pcred = __task_cred(task->real_parent);
-+ str1 = va_arg(ap, char *);
-+ gr_log_middle_varargs(audit, msg, str1, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
-+ break;
-+ case GR_SIG:
-+ str1 = va_arg(ap, char *);
-+ voidptr = va_arg(ap, void *);
-+ gr_log_middle_varargs(audit, msg, str1, voidptr);
-+ break;
-+ case GR_SIG2:
-+ task = va_arg(ap, struct task_struct *);
-+ cred = __task_cred(task);
-+ pcred = __task_cred(task->real_parent);
-+ num1 = va_arg(ap, int);
-+ gr_log_middle_varargs(audit, msg, num1, gr_task_fullpath0(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
-+ break;
-+ case GR_CRASH1:
-+ task = va_arg(ap, struct task_struct *);
-+ cred = __task_cred(task);
-+ pcred = __task_cred(task->real_parent);
-+ ulong1 = va_arg(ap, unsigned long);
-+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, cred->uid, ulong1);
-+ break;
-+ case GR_CRASH2:
-+ task = va_arg(ap, struct task_struct *);
-+ cred = __task_cred(task);
-+ pcred = __task_cred(task->real_parent);
-+ ulong1 = va_arg(ap, unsigned long);
-+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, ulong1);
-+ break;
-+ case GR_RWXMAP:
-+ file = va_arg(ap, struct file *);
-+ gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>");
-+ break;
-+ case GR_PSACCT:
-+ {
-+ unsigned int wday, cday;
-+ __u8 whr, chr;
-+ __u8 wmin, cmin;
-+ __u8 wsec, csec;
-+ char cur_tty[64] = { 0 };
-+ char parent_tty[64] = { 0 };
-+
-+ task = va_arg(ap, struct task_struct *);
-+ wday = va_arg(ap, unsigned int);
-+ cday = va_arg(ap, unsigned int);
-+ whr = va_arg(ap, int);
-+ chr = va_arg(ap, int);
-+ wmin = va_arg(ap, int);
-+ cmin = va_arg(ap, int);
-+ wsec = va_arg(ap, int);
-+ csec = va_arg(ap, int);
-+ ulong1 = va_arg(ap, unsigned long);
-+ cred = __task_cred(task);
-+ pcred = __task_cred(task->real_parent);
-+
-+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, &task->signal->curr_ip, tty_name(task->signal->tty, cur_tty), cred->uid, cred->euid, cred->gid, cred->egid, wday, whr, wmin, wsec, cday, chr, cmin, csec, (task->flags & PF_SIGNALED) ? "killed by signal" : "exited", ulong1, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, &task->real_parent->signal->curr_ip, tty_name(task->real_parent->signal->tty, parent_tty), pcred->uid, pcred->euid, pcred->gid, pcred->egid);
-+ }
-+ break;
-+ default:
-+ gr_log_middle(audit, msg, ap);
-+ }
-+ va_end(ap);
-+ // these don't need DEFAULTSECARGS printed on the end
-+ if (argtypes == GR_CRASH1 || argtypes == GR_CRASH2)
-+ gr_log_end(audit, 0);
-+ else
-+ gr_log_end(audit, 1);
-+ END_LOCKS(audit);
-+}
-diff --git a/grsecurity/grsec_mem.c b/grsecurity/grsec_mem.c
-new file mode 100644
-index 0000000..f536303
---- /dev/null
-+++ b/grsecurity/grsec_mem.c
-@@ -0,0 +1,40 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/mm.h>
-+#include <linux/mman.h>
-+#include <linux/grinternal.h>
-+
-+void
-+gr_handle_ioperm(void)
-+{
-+ gr_log_noargs(GR_DONT_AUDIT, GR_IOPERM_MSG);
-+ return;
-+}
-+
-+void
-+gr_handle_iopl(void)
-+{
-+ gr_log_noargs(GR_DONT_AUDIT, GR_IOPL_MSG);
-+ return;
-+}
-+
-+void
-+gr_handle_mem_readwrite(u64 from, u64 to)
-+{
-+ gr_log_two_u64(GR_DONT_AUDIT, GR_MEM_READWRITE_MSG, from, to);
-+ return;
-+}
-+
-+void
-+gr_handle_vm86(void)
-+{
-+ gr_log_noargs(GR_DONT_AUDIT, GR_VM86_MSG);
-+ return;
-+}
-+
-+void
-+gr_log_badprocpid(const char *entry)
-+{
-+ gr_log_str(GR_DONT_AUDIT, GR_BADPROCPID_MSG, entry);
-+ return;
-+}
-diff --git a/grsecurity/grsec_mount.c b/grsecurity/grsec_mount.c
-new file mode 100644
-index 0000000..cd9e124
---- /dev/null
-+++ b/grsecurity/grsec_mount.c
-@@ -0,0 +1,65 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/mount.h>
-+#include <linux/major.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+void
-+gr_log_remount(const char *devname, const int retval)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
-+ if (grsec_enable_mount && (retval >= 0))
-+ gr_log_str(GR_DO_AUDIT, GR_REMOUNT_AUDIT_MSG, devname ? devname : "none");
-+#endif
-+ return;
-+}
-+
-+void
-+gr_log_unmount(const char *devname, const int retval)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
-+ if (grsec_enable_mount && (retval >= 0))
-+ gr_log_str(GR_DO_AUDIT, GR_UNMOUNT_AUDIT_MSG, devname ? devname : "none");
-+#endif
-+ return;
-+}
-+
-+void
-+gr_log_mount(const char *from, const char *to, const int retval)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
-+ if (grsec_enable_mount && (retval >= 0))
-+ gr_log_str_str(GR_DO_AUDIT, GR_MOUNT_AUDIT_MSG, from ? from : "none", to);
-+#endif
-+ return;
-+}
-+
-+int
-+gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags)
-+{
-+#ifdef CONFIG_GRKERNSEC_ROFS
-+ if (grsec_enable_rofs && !(mnt_flags & MNT_READONLY)) {
-+ gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_MOUNT_MSG, dentry, mnt);
-+ return -EPERM;
-+ } else
-+ return 0;
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode)
-+{
-+#ifdef CONFIG_GRKERNSEC_ROFS
-+ struct inode *inode = dentry->d_inode;
-+
-+ if (grsec_enable_rofs && (acc_mode & MAY_WRITE) &&
-+ inode && (S_ISBLK(inode->i_mode) || (S_ISCHR(inode->i_mode) && imajor(inode) == RAW_MAJOR))) {
-+ gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_BLOCKWRITE_MSG, dentry, mnt);
-+ return -EPERM;
-+ } else
-+ return 0;
-+#endif
-+ return 0;
-+}
-diff --git a/grsecurity/grsec_pax.c b/grsecurity/grsec_pax.c
-new file mode 100644
-index 0000000..a3b12a0
---- /dev/null
-+++ b/grsecurity/grsec_pax.c
-@@ -0,0 +1,36 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/mm.h>
-+#include <linux/file.h>
-+#include <linux/grinternal.h>
-+#include <linux/grsecurity.h>
-+
-+void
-+gr_log_textrel(struct vm_area_struct * vma)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
-+ if (grsec_enable_audit_textrel)
-+ gr_log_textrel_ulong_ulong(GR_DO_AUDIT, GR_TEXTREL_AUDIT_MSG, vma->vm_file, vma->vm_start, vma->vm_pgoff);
-+#endif
-+ return;
-+}
-+
-+void
-+gr_log_rwxmmap(struct file *file)
-+{
-+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
-+ if (grsec_enable_log_rwxmaps)
-+ gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMMAP_MSG, file);
-+#endif
-+ return;
-+}
-+
-+void
-+gr_log_rwxmprotect(struct file *file)
-+{
-+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
-+ if (grsec_enable_log_rwxmaps)
-+ gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMPROTECT_MSG, file);
-+#endif
-+ return;
-+}
-diff --git a/grsecurity/grsec_ptrace.c b/grsecurity/grsec_ptrace.c
-new file mode 100644
-index 0000000..78f8733
---- /dev/null
-+++ b/grsecurity/grsec_ptrace.c
-@@ -0,0 +1,30 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/grinternal.h>
-+#include <linux/security.h>
-+
-+void
-+gr_audit_ptrace(struct task_struct *task)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
-+ if (grsec_enable_audit_ptrace)
-+ gr_log_ptrace(GR_DO_AUDIT, GR_PTRACE_AUDIT_MSG, task);
-+#endif
-+ return;
-+}
-+
-+int
-+gr_ptrace_readexec(struct file *file, int unsafe_flags)
-+{
-+#ifdef CONFIG_GRKERNSEC_PTRACE_READEXEC
-+ const struct dentry *dentry = file->f_path.dentry;
-+ const struct vfsmount *mnt = file->f_path.mnt;
-+
-+ if (grsec_enable_ptrace_readexec && (unsafe_flags & LSM_UNSAFE_PTRACE) &&
-+ (inode_permission(dentry->d_inode, MAY_READ) || !gr_acl_handle_open(dentry, mnt, MAY_READ))) {
-+ gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_READEXEC_MSG, dentry, mnt);
-+ return -EACCES;
-+ }
-+#endif
-+ return 0;
-+}
-diff --git a/grsecurity/grsec_sig.c b/grsecurity/grsec_sig.c
-new file mode 100644
-index 0000000..1571426
---- /dev/null
-+++ b/grsecurity/grsec_sig.c
-@@ -0,0 +1,244 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/delay.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+#include <linux/hardirq.h>
-+
-+char *signames[] = {
-+ [SIGSEGV] = "Segmentation fault",
-+ [SIGILL] = "Illegal instruction",
-+ [SIGABRT] = "Abort",
-+ [SIGBUS] = "Invalid alignment/Bus error"
-+};
-+
-+void
-+gr_log_signal(const int sig, const void *addr, const struct task_struct *t)
-+{
-+#ifdef CONFIG_GRKERNSEC_SIGNAL
-+ if (grsec_enable_signal && ((sig == SIGSEGV) || (sig == SIGILL) ||
-+ (sig == SIGABRT) || (sig == SIGBUS))) {
-+ if (t->pid == current->pid) {
-+ gr_log_sig_addr(GR_DONT_AUDIT_GOOD, GR_UNISIGLOG_MSG, signames[sig], addr);
-+ } else {
-+ gr_log_sig_task(GR_DONT_AUDIT_GOOD, GR_DUALSIGLOG_MSG, t, sig);
-+ }
-+ }
-+#endif
-+ return;
-+}
-+
-+int
-+gr_handle_signal(const struct task_struct *p, const int sig)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+ /* ignore the 0 signal for protected task checks */
-+ if (current->pid > 1 && sig && gr_check_protected_task(p)) {
-+ gr_log_sig_task(GR_DONT_AUDIT, GR_SIG_ACL_MSG, p, sig);
-+ return -EPERM;
-+ } else if (gr_pid_is_chrooted((struct task_struct *)p)) {
-+ return -EPERM;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+#ifdef CONFIG_GRKERNSEC
-+extern int specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t);
-+
-+int gr_fake_force_sig(int sig, struct task_struct *t)
-+{
-+ unsigned long int flags;
-+ int ret, blocked, ignored;
-+ struct k_sigaction *action;
-+
-+ spin_lock_irqsave(&t->sighand->siglock, flags);
-+ action = &t->sighand->action[sig-1];
-+ ignored = action->sa.sa_handler == SIG_IGN;
-+ blocked = sigismember(&t->blocked, sig);
-+ if (blocked || ignored) {
-+ action->sa.sa_handler = SIG_DFL;
-+ if (blocked) {
-+ sigdelset(&t->blocked, sig);
-+ recalc_sigpending_and_wake(t);
-+ }
-+ }
-+ if (action->sa.sa_handler == SIG_DFL)
-+ t->signal->flags &= ~SIGNAL_UNKILLABLE;
-+ ret = specific_send_sig_info(sig, SEND_SIG_PRIV, t);
-+
-+ spin_unlock_irqrestore(&t->sighand->siglock, flags);
-+
-+ return ret;
-+}
-+#endif
-+
-+#ifdef CONFIG_GRKERNSEC_BRUTE
-+#define GR_USER_BAN_TIME (15 * 60)
-+#define GR_DAEMON_BRUTE_TIME (30 * 60)
-+
-+static int __get_dumpable(unsigned long mm_flags)
-+{
-+ int ret;
-+
-+ ret = mm_flags & MMF_DUMPABLE_MASK;
-+ return (ret >= 2) ? 2 : ret;
-+}
-+#endif
-+
-+void gr_handle_brute_attach(unsigned long mm_flags)
-+{
-+#ifdef CONFIG_GRKERNSEC_BRUTE
-+ struct task_struct *p = current;
-+ uid_t uid = 0;
-+ int daemon = 0;
-+
-+ if (!grsec_enable_brute)
-+ return;
-+
-+ rcu_read_lock();
-+ read_lock(&tasklist_lock);
-+ read_lock(&grsec_exec_file_lock);
-+ if (p->real_parent && gr_is_same_file(p->real_parent->exec_file, p->exec_file)) {
-+ p->real_parent->brute_expires = get_seconds() + GR_DAEMON_BRUTE_TIME;
-+ p->real_parent->brute = 1;
-+ daemon = 1;
-+ } else {
-+ const struct cred *cred = __task_cred(p), *cred2;
-+ struct task_struct *tsk, *tsk2;
-+ int dumpable = __get_dumpable(mm_flags);
-+
-+ if (dumpable != SUID_DUMP_USER && cred->uid) {
-+ struct user_struct *user;
-+
-+ uid = cred->uid;
-+
-+ /* this is put upon execution past expiration */
-+ user = find_user(uid);
-+ if (user == NULL)
-+ goto unlock;
-+ user->suid_banned = 1;
-+ user->suid_ban_expires = get_seconds() + GR_USER_BAN_TIME;
-+ if (user->suid_ban_expires == ~0UL)
-+ user->suid_ban_expires--;
-+
-+ /* only kill other threads of the same binary, from the same user */
-+ do_each_thread(tsk2, tsk) {
-+ cred2 = __task_cred(tsk);
-+ if (tsk != p && cred2->uid == uid && gr_is_same_file(tsk->exec_file, p->exec_file))
-+ gr_fake_force_sig(SIGKILL, tsk);
-+ } while_each_thread(tsk2, tsk);
-+ }
-+ }
-+unlock:
-+ read_unlock(&grsec_exec_file_lock);
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+
-+ if (uid)
-+ gr_log_fs_int2(GR_DONT_AUDIT, GR_BRUTE_SUID_MSG, p->exec_file->f_path.dentry, p->exec_file->f_path.mnt, uid, GR_USER_BAN_TIME / 60);
-+ else if (daemon)
-+ gr_log_noargs(GR_DONT_AUDIT, GR_BRUTE_DAEMON_MSG);
-+#endif
-+ return;
-+}
-+
-+void gr_handle_brute_check(void)
-+{
-+#ifdef CONFIG_GRKERNSEC_BRUTE
-+ struct task_struct *p = current;
-+
-+ if (unlikely(p->brute)) {
-+ if (!grsec_enable_brute)
-+ p->brute = 0;
-+ else if (time_before(get_seconds(), p->brute_expires))
-+ msleep(30 * 1000);
-+ }
-+#endif
-+ return;
-+}
-+
-+void gr_handle_kernel_exploit(void)
-+{
-+#ifdef CONFIG_GRKERNSEC_KERN_LOCKOUT
-+ const struct cred *cred;
-+ struct task_struct *tsk, *tsk2;
-+ struct user_struct *user;
-+ uid_t uid;
-+
-+ if (in_irq() || in_serving_softirq() || in_nmi())
-+ panic("grsec: halting the system due to suspicious kernel crash caused in interrupt context");
-+
-+ uid = current_uid();
-+
-+ if (uid == 0)
-+ panic("grsec: halting the system due to suspicious kernel crash caused by root");
-+ else {
-+ /* kill all the processes of this user, hold a reference
-+ to their creds struct, and prevent them from creating
-+ another process until system reset
-+ */
-+ printk(KERN_ALERT "grsec: banning user with uid %u until system restart for suspicious kernel crash\n", uid);
-+ /* we intentionally leak this ref */
-+ user = get_uid(current->cred->user);
-+ if (user)
-+ user->kernel_banned = 1;
-+
-+ /* kill all processes of this user */
-+ read_lock(&tasklist_lock);
-+ do_each_thread(tsk2, tsk) {
-+ cred = __task_cred(tsk);
-+ if (cred->uid == uid)
-+ gr_fake_force_sig(SIGKILL, tsk);
-+ } while_each_thread(tsk2, tsk);
-+ read_unlock(&tasklist_lock);
-+ }
-+#endif
-+}
-+
-+#ifdef CONFIG_GRKERNSEC_BRUTE
-+static bool suid_ban_expired(struct user_struct *user)
-+{
-+ if (user->suid_ban_expires != ~0UL && time_after_eq(get_seconds(), user->suid_ban_expires)) {
-+ user->suid_banned = 0;
-+ user->suid_ban_expires = 0;
-+ free_uid(user);
-+ return true;
-+ }
-+
-+ return false;
-+}
-+#endif
-+
-+int gr_process_kernel_exec_ban(void)
-+{
-+#ifdef CONFIG_GRKERNSEC_KERN_LOCKOUT
-+ if (unlikely(current->cred->user->kernel_banned))
-+ return -EPERM;
-+#endif
-+ return 0;
-+}
-+
-+int gr_process_kernel_setuid_ban(struct user_struct *user)
-+{
-+#ifdef CONFIG_GRKERNSEC_KERN_LOCKOUT
-+ if (unlikely(user->kernel_banned))
-+ gr_fake_force_sig(SIGKILL, current);
-+#endif
-+ return 0;
-+}
-+
-+int gr_process_suid_exec_ban(const struct linux_binprm *bprm)
-+{
-+#ifdef CONFIG_GRKERNSEC_BRUTE
-+ struct user_struct *user = current->cred->user;
-+ if (unlikely(user->suid_banned)) {
-+ if (suid_ban_expired(user))
-+ return 0;
-+ /* disallow execution of suid binaries only */
-+ else if (bprm->cred->euid != current->cred->uid)
-+ return -EPERM;
-+ }
-+#endif
-+ return 0;
-+}
-diff --git a/grsecurity/grsec_sock.c b/grsecurity/grsec_sock.c
-new file mode 100644
-index 0000000..7512ea9
---- /dev/null
-+++ b/grsecurity/grsec_sock.c
-@@ -0,0 +1,275 @@
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/net.h>
-+#include <linux/in.h>
-+#include <linux/ip.h>
-+#include <net/sock.h>
-+#include <net/inet_sock.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+#include <linux/gracl.h>
-+
-+kernel_cap_t gr_cap_rtnetlink(struct sock *sock);
-+EXPORT_SYMBOL(gr_cap_rtnetlink);
-+
-+extern int gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb);
-+extern int gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr);
-+
-+EXPORT_SYMBOL(gr_search_udp_recvmsg);
-+EXPORT_SYMBOL(gr_search_udp_sendmsg);
-+
-+#ifdef CONFIG_UNIX_MODULE
-+EXPORT_SYMBOL(gr_acl_handle_unix);
-+EXPORT_SYMBOL(gr_acl_handle_mknod);
-+EXPORT_SYMBOL(gr_handle_chroot_unix);
-+EXPORT_SYMBOL(gr_handle_create);
-+#endif
-+
-+#ifdef CONFIG_GRKERNSEC
-+#define gr_conn_table_size 32749
-+struct conn_table_entry {
-+ struct conn_table_entry *next;
-+ struct signal_struct *sig;
-+};
-+
-+struct conn_table_entry *gr_conn_table[gr_conn_table_size];
-+DEFINE_SPINLOCK(gr_conn_table_lock);
-+
-+extern const char * gr_socktype_to_name(unsigned char type);
-+extern const char * gr_proto_to_name(unsigned char proto);
-+extern const char * gr_sockfamily_to_name(unsigned char family);
-+
-+static __inline__ int
-+conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
-+{
-+ return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
-+}
-+
-+static __inline__ int
-+conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr,
-+ __u16 sport, __u16 dport)
-+{
-+ if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
-+ sig->gr_sport == sport && sig->gr_dport == dport))
-+ return 1;
-+ else
-+ return 0;
-+}
-+
-+static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
-+{
-+ struct conn_table_entry **match;
-+ unsigned int index;
-+
-+ index = conn_hash(sig->gr_saddr, sig->gr_daddr,
-+ sig->gr_sport, sig->gr_dport,
-+ gr_conn_table_size);
-+
-+ newent->sig = sig;
-+
-+ match = &gr_conn_table[index];
-+ newent->next = *match;
-+ *match = newent;
-+
-+ return;
-+}
-+
-+static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
-+{
-+ struct conn_table_entry *match, *last = NULL;
-+ unsigned int index;
-+
-+ index = conn_hash(sig->gr_saddr, sig->gr_daddr,
-+ sig->gr_sport, sig->gr_dport,
-+ gr_conn_table_size);
-+
-+ match = gr_conn_table[index];
-+ while (match && !conn_match(match->sig,
-+ sig->gr_saddr, sig->gr_daddr, sig->gr_sport,
-+ sig->gr_dport)) {
-+ last = match;
-+ match = match->next;
-+ }
-+
-+ if (match) {
-+ if (last)
-+ last->next = match->next;
-+ else
-+ gr_conn_table[index] = NULL;
-+ kfree(match);
-+ }
-+
-+ return;
-+}
-+
-+static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
-+ __u16 sport, __u16 dport)
-+{
-+ struct conn_table_entry *match;
-+ unsigned int index;
-+
-+ index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
-+
-+ match = gr_conn_table[index];
-+ while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
-+ match = match->next;
-+
-+ if (match)
-+ return match->sig;
-+ else
-+ return NULL;
-+}
-+
-+#endif
-+
-+void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+ struct signal_struct *sig = task->signal;
-+ struct conn_table_entry *newent;
-+
-+ newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
-+ if (newent == NULL)
-+ return;
-+ /* no bh lock needed since we are called with bh disabled */
-+ spin_lock(&gr_conn_table_lock);
-+ gr_del_task_from_ip_table_nolock(sig);
-+ sig->gr_saddr = inet->rcv_saddr;
-+ sig->gr_daddr = inet->daddr;
-+ sig->gr_sport = inet->sport;
-+ sig->gr_dport = inet->dport;
-+ gr_add_to_task_ip_table_nolock(sig, newent);
-+ spin_unlock(&gr_conn_table_lock);
-+#endif
-+ return;
-+}
-+
-+void gr_del_task_from_ip_table(struct task_struct *task)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+ spin_lock_bh(&gr_conn_table_lock);
-+ gr_del_task_from_ip_table_nolock(task->signal);
-+ spin_unlock_bh(&gr_conn_table_lock);
-+#endif
-+ return;
-+}
-+
-+void
-+gr_attach_curr_ip(const struct sock *sk)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+ struct signal_struct *p, *set;
-+ const struct inet_sock *inet = inet_sk(sk);
-+
-+ if (unlikely(sk->sk_protocol != IPPROTO_TCP))
-+ return;
-+
-+ set = current->signal;
-+
-+ spin_lock_bh(&gr_conn_table_lock);
-+ p = gr_lookup_task_ip_table(inet->daddr, inet->rcv_saddr,
-+ inet->dport, inet->sport);
-+ if (unlikely(p != NULL)) {
-+ set->curr_ip = p->curr_ip;
-+ set->used_accept = 1;
-+ gr_del_task_from_ip_table_nolock(p);
-+ spin_unlock_bh(&gr_conn_table_lock);
-+ return;
-+ }
-+ spin_unlock_bh(&gr_conn_table_lock);
-+
-+ set->curr_ip = inet->daddr;
-+ set->used_accept = 1;
-+#endif
-+ return;
-+}
-+
-+int
-+gr_handle_sock_all(const int family, const int type, const int protocol)
-+{
-+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
-+ if (grsec_enable_socket_all && in_group_p(grsec_socket_all_gid) &&
-+ (family != AF_UNIX)) {
-+ if (family == AF_INET)
-+ gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), gr_proto_to_name(protocol));
-+ else
-+ gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), protocol);
-+ return -EACCES;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_handle_sock_server(const struct sockaddr *sck)
-+{
-+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
-+ if (grsec_enable_socket_server &&
-+ in_group_p(grsec_socket_server_gid) &&
-+ sck && (sck->sa_family != AF_UNIX) &&
-+ (sck->sa_family != AF_LOCAL)) {
-+ gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
-+ return -EACCES;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_handle_sock_server_other(const struct sock *sck)
-+{
-+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
-+ if (grsec_enable_socket_server &&
-+ in_group_p(grsec_socket_server_gid) &&
-+ sck && (sck->sk_family != AF_UNIX) &&
-+ (sck->sk_family != AF_LOCAL)) {
-+ gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
-+ return -EACCES;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_handle_sock_client(const struct sockaddr *sck)
-+{
-+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
-+ if (grsec_enable_socket_client && in_group_p(grsec_socket_client_gid) &&
-+ sck && (sck->sa_family != AF_UNIX) &&
-+ (sck->sa_family != AF_LOCAL)) {
-+ gr_log_noargs(GR_DONT_AUDIT, GR_CONNECT_MSG);
-+ return -EACCES;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+kernel_cap_t
-+gr_cap_rtnetlink(struct sock *sock)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+ if (!gr_acl_is_enabled())
-+ return current_cap();
-+ else if (sock->sk_protocol == NETLINK_ISCSI &&
-+ cap_raised(current_cap(), CAP_SYS_ADMIN) &&
-+ gr_is_capable(CAP_SYS_ADMIN))
-+ return current_cap();
-+ else if (sock->sk_protocol == NETLINK_AUDIT &&
-+ cap_raised(current_cap(), CAP_AUDIT_WRITE) &&
-+ gr_is_capable(CAP_AUDIT_WRITE) &&
-+ cap_raised(current_cap(), CAP_AUDIT_CONTROL) &&
-+ gr_is_capable(CAP_AUDIT_CONTROL))
-+ return current_cap();
-+ else if (cap_raised(current_cap(), CAP_NET_ADMIN) &&
-+ ((sock->sk_protocol == NETLINK_ROUTE) ?
-+ gr_is_capable_nolog(CAP_NET_ADMIN) :
-+ gr_is_capable(CAP_NET_ADMIN)))
-+ return current_cap();
-+ else
-+ return __cap_empty_set;
-+#else
-+ return current_cap();
-+#endif
-+}
-diff --git a/grsecurity/grsec_sysctl.c b/grsecurity/grsec_sysctl.c
-new file mode 100644
-index 0000000..5a6d4bc1
---- /dev/null
-+++ b/grsecurity/grsec_sysctl.c
-@@ -0,0 +1,527 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/sysctl.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+int
-+gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
-+{
-+#ifdef CONFIG_GRKERNSEC_SYSCTL
-+ if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & MAY_WRITE)) {
-+ gr_log_str(GR_DONT_AUDIT, GR_SYSCTL_MSG, name);
-+ return -EACCES;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+#if defined(CONFIG_GRKERNSEC_ROFS) || defined(CONFIG_GRKERNSEC_DENYUSB)
-+static int __maybe_unused __read_only one = 1;
-+#endif
-+
-+#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS) || \
-+ defined(CONFIG_GRKERNSEC_DENYUSB)
-+ctl_table grsecurity_table[] = {
-+#ifdef CONFIG_GRKERNSEC_SYSCTL
-+#ifdef CONFIG_GRKERNSEC_SYSCTL_DISTRO
-+#ifdef CONFIG_GRKERNSEC_IO
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "disable_priv_io",
-+ .data = &grsec_disable_privio,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#endif
-+#ifdef CONFIG_GRKERNSEC_LINK
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "linking_restrictions",
-+ .data = &grsec_enable_link,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SYMLINKOWN
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "enforce_symlinksifowner",
-+ .data = &grsec_enable_symlinkown,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "symlinkown_gid",
-+ .data = &grsec_symlinkown_gid,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_BRUTE
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "deter_bruteforce",
-+ .data = &grsec_enable_brute,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_FIFO
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "fifo_restrictions",
-+ .data = &grsec_enable_fifo,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_PTRACE_READEXEC
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "ptrace_readexec",
-+ .data = &grsec_enable_ptrace_readexec,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "consistent_setxid",
-+ .data = &grsec_enable_setxid,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "ip_blackhole",
-+ .data = &grsec_enable_blackhole,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "lastack_retries",
-+ .data = &grsec_lastack_retries,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_EXECLOG
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "exec_logging",
-+ .data = &grsec_enable_execlog,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "rwxmap_logging",
-+ .data = &grsec_enable_log_rwxmaps,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SIGNAL
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "signal_logging",
-+ .data = &grsec_enable_signal,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_FORKFAIL
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "forkfail_logging",
-+ .data = &grsec_enable_forkfail,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_TIME
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "timechange_logging",
-+ .data = &grsec_enable_time,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_deny_shmat",
-+ .data = &grsec_enable_chroot_shmat,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_deny_unix",
-+ .data = &grsec_enable_chroot_unix,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_deny_mount",
-+ .data = &grsec_enable_chroot_mount,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_deny_fchdir",
-+ .data = &grsec_enable_chroot_fchdir,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_deny_chroot",
-+ .data = &grsec_enable_chroot_double,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_deny_pivot",
-+ .data = &grsec_enable_chroot_pivot,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_enforce_chdir",
-+ .data = &grsec_enable_chroot_chdir,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_deny_chmod",
-+ .data = &grsec_enable_chroot_chmod,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_deny_mknod",
-+ .data = &grsec_enable_chroot_mknod,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_restrict_nice",
-+ .data = &grsec_enable_chroot_nice,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_execlog",
-+ .data = &grsec_enable_chroot_execlog,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_caps",
-+ .data = &grsec_enable_chroot_caps,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_deny_sysctl",
-+ .data = &grsec_enable_chroot_sysctl,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_TPE
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "tpe",
-+ .data = &grsec_enable_tpe,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "tpe_gid",
-+ .data = &grsec_tpe_gid,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "tpe_invert",
-+ .data = &grsec_enable_tpe_invert,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_TPE_ALL
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "tpe_restrict_all",
-+ .data = &grsec_enable_tpe_all,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "socket_all",
-+ .data = &grsec_enable_socket_all,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "socket_all_gid",
-+ .data = &grsec_socket_all_gid,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "socket_client",
-+ .data = &grsec_enable_socket_client,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "socket_client_gid",
-+ .data = &grsec_socket_client_gid,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "socket_server",
-+ .data = &grsec_enable_socket_server,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "socket_server_gid",
-+ .data = &grsec_socket_server_gid,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "audit_group",
-+ .data = &grsec_enable_group,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "audit_gid",
-+ .data = &grsec_audit_gid,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "audit_chdir",
-+ .data = &grsec_enable_chdir,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "audit_mount",
-+ .data = &grsec_enable_mount,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "audit_textrel",
-+ .data = &grsec_enable_audit_textrel,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_DMESG
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "dmesg",
-+ .data = &grsec_enable_dmesg,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_findtask",
-+ .data = &grsec_enable_chroot_findtask,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_RESLOG
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "resource_logging",
-+ .data = &grsec_resource_logging,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "audit_ptrace",
-+ .data = &grsec_enable_audit_ptrace,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "harden_ptrace",
-+ .data = &grsec_enable_harden_ptrace,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "grsec_lock",
-+ .data = &grsec_lock,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_ROFS
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "romount_protect",
-+ .data = &grsec_enable_rofs,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec_minmax,
-+ .extra1 = &one,
-+ .extra2 = &one,
-+ },
-+#endif
-+#if defined(CONFIG_GRKERNSEC_DENYUSB) && !defined(CONFIG_GRKERNSEC_DENYUSB_FORCE)
-+ {
-+ .procname = "deny_new_usb",
-+ .data = &grsec_deny_new_usb,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+ { .ctl_name = 0 }
-+};
-+#endif
-diff --git a/grsecurity/grsec_time.c b/grsecurity/grsec_time.c
-new file mode 100644
-index 0000000..0dc13c3
---- /dev/null
-+++ b/grsecurity/grsec_time.c
-@@ -0,0 +1,16 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/grinternal.h>
-+#include <linux/module.h>
-+
-+void
-+gr_log_timechange(void)
-+{
-+#ifdef CONFIG_GRKERNSEC_TIME
-+ if (grsec_enable_time)
-+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_TIME_MSG);
-+#endif
-+ return;
-+}
-+
-+EXPORT_SYMBOL(gr_log_timechange);
-diff --git a/grsecurity/grsec_tpe.c b/grsecurity/grsec_tpe.c
-new file mode 100644
-index 0000000..07e0dc0
---- /dev/null
-+++ b/grsecurity/grsec_tpe.c
-@@ -0,0 +1,73 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/grinternal.h>
-+
-+extern int gr_acl_tpe_check(void);
-+
-+int
-+gr_tpe_allow(const struct file *file)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+ struct inode *inode = file->f_path.dentry->d_parent->d_inode;
-+ const struct cred *cred = current_cred();
-+ char *msg = NULL;
-+ char *msg2 = NULL;
-+
-+ // never restrict root
-+ if (!cred->uid)
-+ return 1;
-+
-+ if (grsec_enable_tpe) {
-+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
-+ if (grsec_enable_tpe_invert && !in_group_p(grsec_tpe_gid))
-+ msg = "not being in trusted group";
-+ else if (!grsec_enable_tpe_invert && in_group_p(grsec_tpe_gid))
-+ msg = "being in untrusted group";
-+#else
-+ if (in_group_p(grsec_tpe_gid))
-+ msg = "being in untrusted group";
-+#endif
-+ }
-+ if (!msg && gr_acl_tpe_check())
-+ msg = "being in untrusted role";
-+
-+ // not in any affected group/role
-+ if (!msg)
-+ goto next_check;
-+
-+ if (inode->i_uid)
-+ msg2 = "file in non-root-owned directory";
-+ else if (inode->i_mode & S_IWOTH)
-+ msg2 = "file in world-writable directory";
-+ else if (inode->i_mode & S_IWGRP)
-+ msg2 = "file in group-writable directory";
-+
-+ if (msg && msg2) {
-+ char fullmsg[70] = {0};
-+ snprintf(fullmsg, sizeof(fullmsg)-1, "%s and %s", msg, msg2);
-+ gr_log_str_fs(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, fullmsg, file->f_path.dentry, file->f_path.mnt);
-+ return 0;
-+ }
-+ msg = NULL;
-+next_check:
-+#ifdef CONFIG_GRKERNSEC_TPE_ALL
-+ if (!grsec_enable_tpe || !grsec_enable_tpe_all)
-+ return 1;
-+
-+ if (inode->i_uid && (inode->i_uid != cred->uid))
-+ msg = "directory not owned by user";
-+ else if (inode->i_mode & S_IWOTH)
-+ msg = "file in world-writable directory";
-+ else if (inode->i_mode & S_IWGRP)
-+ msg = "file in group-writable directory";
-+
-+ if (msg) {
-+ gr_log_str_fs(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, msg, file->f_path.dentry, file->f_path.mnt);
-+ return 0;
-+ }
-+#endif
-+#endif
-+ return 1;
-+}
-diff --git a/grsecurity/grsec_usb.c b/grsecurity/grsec_usb.c
-new file mode 100644
-index 0000000..ae02d8e
---- /dev/null
-+++ b/grsecurity/grsec_usb.c
-@@ -0,0 +1,15 @@
-+#include <linux/kernel.h>
-+#include <linux/grinternal.h>
-+#include <linux/module.h>
-+
-+int gr_handle_new_usb(void)
-+{
-+#ifdef CONFIG_GRKERNSEC_DENYUSB
-+ if (grsec_deny_new_usb) {
-+ printk(KERN_ALERT "grsec: denied insert of new USB device\n");
-+ return 1;
-+ }
-+#endif
-+ return 0;
-+}
-+EXPORT_SYMBOL_GPL(gr_handle_new_usb);
-diff --git a/grsecurity/grsum.c b/grsecurity/grsum.c
-new file mode 100644
-index 0000000..9f7b1ac
---- /dev/null
-+++ b/grsecurity/grsum.c
-@@ -0,0 +1,61 @@
-+#include <linux/err.h>
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/mm.h>
-+#include <linux/scatterlist.h>
-+#include <linux/crypto.h>
-+#include <linux/gracl.h>
-+
-+
-+#if !defined(CONFIG_CRYPTO) || defined(CONFIG_CRYPTO_MODULE) || !defined(CONFIG_CRYPTO_SHA256) || defined(CONFIG_CRYPTO_SHA256_MODULE)
-+#error "crypto and sha256 must be built into the kernel"
-+#endif
-+
-+int
-+chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum)
-+{
-+ char *p;
-+ struct crypto_hash *tfm;
-+ struct hash_desc desc;
-+ struct scatterlist sg;
-+ unsigned char temp_sum[GR_SHA_LEN];
-+ volatile int retval = 0;
-+ volatile int dummy = 0;
-+ unsigned int i;
-+
-+ sg_init_table(&sg, 1);
-+
-+ tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
-+ if (IS_ERR(tfm)) {
-+ /* should never happen, since sha256 should be built in */
-+ return 1;
-+ }
-+
-+ desc.tfm = tfm;
-+ desc.flags = 0;
-+
-+ crypto_hash_init(&desc);
-+
-+ p = salt;
-+ sg_set_buf(&sg, p, GR_SALT_LEN);
-+ crypto_hash_update(&desc, &sg, sg.length);
-+
-+ p = entry->pw;
-+ sg_set_buf(&sg, p, strlen(p));
-+
-+ crypto_hash_update(&desc, &sg, sg.length);
-+
-+ crypto_hash_final(&desc, temp_sum);
-+
-+ memset(entry->pw, 0, GR_PW_LEN);
-+
-+ for (i = 0; i < GR_SHA_LEN; i++)
-+ if (sum[i] != temp_sum[i])
-+ retval = 1;
-+ else
-+ dummy = 1; // waste a cycle
-+
-+ crypto_free_hash(tfm);
-+
-+ return retval;
-+}
-diff --git a/include/acpi/acpi_drivers.h b/include/acpi/acpi_drivers.h
-index f4906f6..71feb73 100644
---- a/include/acpi/acpi_drivers.h
-+++ b/include/acpi/acpi_drivers.h
-@@ -119,8 +119,8 @@ int acpi_processor_set_thermal_limit(acpi_handle handle, int type);
- Dock Station
- -------------------------------------------------------------------------- */
- struct acpi_dock_ops {
-- acpi_notify_handler handler;
-- acpi_notify_handler uevent;
-+ const acpi_notify_handler handler;
-+ const acpi_notify_handler uevent;
- };
-
- #if defined(CONFIG_ACPI_DOCK) || defined(CONFIG_ACPI_DOCK_MODULE)
-@@ -128,7 +128,7 @@ extern int is_dock_device(acpi_handle handle);
- extern int register_dock_notifier(struct notifier_block *nb);
- extern void unregister_dock_notifier(struct notifier_block *nb);
- extern int register_hotplug_dock_device(acpi_handle handle,
-- struct acpi_dock_ops *ops,
-+ const struct acpi_dock_ops *ops,
- void *context);
- extern void unregister_hotplug_dock_device(acpi_handle handle);
- #else
-@@ -144,7 +144,7 @@ static inline void unregister_dock_notifier(struct notifier_block *nb)
- {
- }
- static inline int register_hotplug_dock_device(acpi_handle handle,
-- struct acpi_dock_ops *ops,
-+ const struct acpi_dock_ops *ops,
- void *context)
- {
- return -ENODEV;
-diff --git a/include/asm-generic/4level-fixup.h b/include/asm-generic/4level-fixup.h
-index 77ff547..181834f 100644
---- a/include/asm-generic/4level-fixup.h
-+++ b/include/asm-generic/4level-fixup.h
-@@ -13,8 +13,10 @@
- #define pmd_alloc(mm, pud, address) \
- ((unlikely(pgd_none(*(pud))) && __pmd_alloc(mm, pud, address))? \
- NULL: pmd_offset(pud, address))
-+#define pmd_alloc_kernel(mm, pud, address) pmd_alloc((mm), (pud), (address))
-
- #define pud_alloc(mm, pgd, address) (pgd)
-+#define pud_alloc_kernel(mm, pgd, address) pud_alloc((mm), (pgd), (address))
- #define pud_offset(pgd, start) (pgd)
- #define pud_none(pud) 0
- #define pud_bad(pud) 0
-diff --git a/include/asm-generic/atomic-long.h b/include/asm-generic/atomic-long.h
-index b7babf0..755fb22 100644
---- a/include/asm-generic/atomic-long.h
-+++ b/include/asm-generic/atomic-long.h
-@@ -22,6 +22,12 @@
-
- typedef atomic64_t atomic_long_t;
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+typedef atomic64_unchecked_t atomic_long_unchecked_t;
-+#else
-+typedef atomic64_t atomic_long_unchecked_t;
-+#endif
-+
- #define ATOMIC_LONG_INIT(i) ATOMIC64_INIT(i)
-
- static inline long atomic_long_read(atomic_long_t *l)
-@@ -31,6 +37,15 @@ static inline long atomic_long_read(atomic_long_t *l)
- return (long)atomic64_read(v);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
-+{
-+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
-+
-+ return (long)atomic64_read_unchecked(v);
-+}
-+#endif
-+
- static inline void atomic_long_set(atomic_long_t *l, long i)
- {
- atomic64_t *v = (atomic64_t *)l;
-@@ -38,6 +53,15 @@ static inline void atomic_long_set(atomic_long_t *l, long i)
- atomic64_set(v, i);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
-+{
-+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
-+
-+ atomic64_set_unchecked(v, i);
-+}
-+#endif
-+
- static inline void atomic_long_inc(atomic_long_t *l)
- {
- atomic64_t *v = (atomic64_t *)l;
-@@ -45,6 +69,15 @@ static inline void atomic_long_inc(atomic_long_t *l)
- atomic64_inc(v);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
-+{
-+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
-+
-+ atomic64_inc_unchecked(v);
-+}
-+#endif
-+
- static inline void atomic_long_dec(atomic_long_t *l)
- {
- atomic64_t *v = (atomic64_t *)l;
-@@ -52,6 +85,15 @@ static inline void atomic_long_dec(atomic_long_t *l)
- atomic64_dec(v);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
-+{
-+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
-+
-+ atomic64_dec_unchecked(v);
-+}
-+#endif
-+
- static inline void atomic_long_add(long i, atomic_long_t *l)
- {
- atomic64_t *v = (atomic64_t *)l;
-@@ -59,6 +101,15 @@ static inline void atomic_long_add(long i, atomic_long_t *l)
- atomic64_add(i, v);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
-+{
-+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
-+
-+ atomic64_add_unchecked(i, v);
-+}
-+#endif
-+
- static inline void atomic_long_sub(long i, atomic_long_t *l)
- {
- atomic64_t *v = (atomic64_t *)l;
-@@ -101,6 +152,15 @@ static inline long atomic_long_add_return(long i, atomic_long_t *l)
- return (long)atomic64_add_return(i, v);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline long atomic_long_add_return_unchecked(long i, atomic_long_unchecked_t *l)
-+{
-+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
-+
-+ return (long)atomic64_add_return_unchecked(i, v);
-+}
-+#endif
-+
- static inline long atomic_long_sub_return(long i, atomic_long_t *l)
- {
- atomic64_t *v = (atomic64_t *)l;
-@@ -115,6 +175,15 @@ static inline long atomic_long_inc_return(atomic_long_t *l)
- return (long)atomic64_inc_return(v);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
-+{
-+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
-+
-+ return (long)atomic64_inc_return_unchecked(v);
-+}
-+#endif
-+
- static inline long atomic_long_dec_return(atomic_long_t *l)
- {
- atomic64_t *v = (atomic64_t *)l;
-@@ -140,6 +209,12 @@ static inline long atomic_long_add_unless(atomic_long_t *l, long a, long u)
-
- typedef atomic_t atomic_long_t;
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+typedef atomic_unchecked_t atomic_long_unchecked_t;
-+#else
-+typedef atomic_t atomic_long_unchecked_t;
-+#endif
-+
- #define ATOMIC_LONG_INIT(i) ATOMIC_INIT(i)
- static inline long atomic_long_read(atomic_long_t *l)
- {
-@@ -148,6 +223,15 @@ static inline long atomic_long_read(atomic_long_t *l)
- return (long)atomic_read(v);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
-+{
-+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
-+
-+ return (long)atomic_read_unchecked(v);
-+}
-+#endif
-+
- static inline void atomic_long_set(atomic_long_t *l, long i)
- {
- atomic_t *v = (atomic_t *)l;
-@@ -155,6 +239,15 @@ static inline void atomic_long_set(atomic_long_t *l, long i)
- atomic_set(v, i);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
-+{
-+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
-+
-+ atomic_set_unchecked(v, i);
-+}
-+#endif
-+
- static inline void atomic_long_inc(atomic_long_t *l)
- {
- atomic_t *v = (atomic_t *)l;
-@@ -162,6 +255,15 @@ static inline void atomic_long_inc(atomic_long_t *l)
- atomic_inc(v);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
-+{
-+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
-+
-+ atomic_inc_unchecked(v);
-+}
-+#endif
-+
- static inline void atomic_long_dec(atomic_long_t *l)
- {
- atomic_t *v = (atomic_t *)l;
-@@ -169,6 +271,15 @@ static inline void atomic_long_dec(atomic_long_t *l)
- atomic_dec(v);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
-+{
-+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
-+
-+ atomic_dec_unchecked(v);
-+}
-+#endif
-+
- static inline void atomic_long_add(long i, atomic_long_t *l)
- {
- atomic_t *v = (atomic_t *)l;
-@@ -176,6 +287,15 @@ static inline void atomic_long_add(long i, atomic_long_t *l)
- atomic_add(i, v);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
-+{
-+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
-+
-+ atomic_add_unchecked(i, v);
-+}
-+#endif
-+
- static inline void atomic_long_sub(long i, atomic_long_t *l)
- {
- atomic_t *v = (atomic_t *)l;
-@@ -218,6 +338,16 @@ static inline long atomic_long_add_return(long i, atomic_long_t *l)
- return (long)atomic_add_return(i, v);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline long atomic_long_add_return_unchecked(long i, atomic_long_unchecked_t *l)
-+{
-+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
-+
-+ return (long)atomic_add_return_unchecked(i, v);
-+}
-+
-+#endif
-+
- static inline long atomic_long_sub_return(long i, atomic_long_t *l)
- {
- atomic_t *v = (atomic_t *)l;
-@@ -232,6 +362,15 @@ static inline long atomic_long_inc_return(atomic_long_t *l)
- return (long)atomic_inc_return(v);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
-+{
-+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
-+
-+ return (long)atomic_inc_return_unchecked(v);
-+}
-+#endif
-+
- static inline long atomic_long_dec_return(atomic_long_t *l)
- {
- atomic_t *v = (atomic_t *)l;
-@@ -255,4 +394,55 @@ static inline long atomic_long_add_unless(atomic_long_t *l, long a, long u)
-
- #endif /* BITS_PER_LONG == 64 */
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void pax_refcount_needs_these_functions(void)
-+{
-+ atomic_read_unchecked((atomic_unchecked_t *)NULL);
-+ atomic_set_unchecked((atomic_unchecked_t *)NULL, 0);
-+ atomic_add_unchecked(0, (atomic_unchecked_t *)NULL);
-+ atomic_sub_unchecked(0, (atomic_unchecked_t *)NULL);
-+ atomic_inc_unchecked((atomic_unchecked_t *)NULL);
-+ (void)atomic_inc_and_test_unchecked((atomic_unchecked_t *)NULL);
-+ atomic_inc_return_unchecked((atomic_unchecked_t *)NULL);
-+ atomic_add_return_unchecked(0, (atomic_unchecked_t *)NULL);
-+ atomic_dec_unchecked((atomic_unchecked_t *)NULL);
-+ atomic_cmpxchg_unchecked((atomic_unchecked_t *)NULL, 0, 0);
-+ (void)atomic_xchg_unchecked((atomic_unchecked_t *)NULL, 0);
-+#ifdef CONFIG_X86
-+ atomic_clear_mask_unchecked(0, NULL);
-+ atomic_set_mask_unchecked(0, NULL);
-+#endif
-+
-+ atomic_long_read_unchecked((atomic_long_unchecked_t *)NULL);
-+ atomic_long_set_unchecked((atomic_long_unchecked_t *)NULL, 0);
-+ atomic_long_add_unchecked(0, (atomic_long_unchecked_t *)NULL);
-+ atomic_long_inc_unchecked((atomic_long_unchecked_t *)NULL);
-+ atomic_long_add_return_unchecked(0, (atomic_long_unchecked_t *)NULL);
-+ atomic_long_inc_return_unchecked((atomic_long_unchecked_t *)NULL);
-+ atomic_long_dec_unchecked((atomic_long_unchecked_t *)NULL);
-+}
-+#else
-+#define atomic_read_unchecked(v) atomic_read(v)
-+#define atomic_set_unchecked(v, i) atomic_set((v), (i))
-+#define atomic_add_unchecked(i, v) atomic_add((i), (v))
-+#define atomic_sub_unchecked(i, v) atomic_sub((i), (v))
-+#define atomic_inc_unchecked(v) atomic_inc(v)
-+#define atomic_inc_and_test_unchecked(v) atomic_inc_and_test(v)
-+#define atomic_inc_return_unchecked(v) atomic_inc_return(v)
-+#define atomic_add_return_unchecked(i, v) atomic_add_return((i), (v))
-+#define atomic_dec_unchecked(v) atomic_dec(v)
-+#define atomic_cmpxchg_unchecked(v, o, n) atomic_cmpxchg((v), (o), (n))
-+#define atomic_xchg_unchecked(v, i) atomic_xchg((v), (i))
-+#define atomic_clear_mask_unchecked(mask, v) atomic_clear_mask((mask), (v))
-+#define atomic_set_mask_unchecked(mask, v) atomic_set_mask((mask), (v))
-+
-+#define atomic_long_read_unchecked(v) atomic_long_read(v)
-+#define atomic_long_set_unchecked(v, i) atomic_long_set((v), (i))
-+#define atomic_long_add_unchecked(i, v) atomic_long_add((i), (v))
-+#define atomic_long_inc_unchecked(v) atomic_long_inc(v)
-+#define atomic_long_add_return_unchecked(i, v) atomic_long_add_return((i), (v))
-+#define atomic_long_inc_return_unchecked(v) atomic_long_inc_return(v)
-+#define atomic_long_dec_unchecked(v) atomic_long_dec(v)
-+#endif
-+
- #endif /* _ASM_GENERIC_ATOMIC_LONG_H */
-diff --git a/include/asm-generic/atomic.h b/include/asm-generic/atomic.h
-index c99c64d..f173e40 100644
---- a/include/asm-generic/atomic.h
-+++ b/include/asm-generic/atomic.h
-@@ -134,7 +134,7 @@ static inline void atomic_dec(atomic_t *v)
-
- #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
-
--static inline void atomic_clear_mask(unsigned long mask, unsigned long *addr)
-+static inline void atomic_clear_mask(unsigned int mask, atomic_t *v)
- {
- unsigned long flags;
-
-diff --git a/include/asm-generic/atomic64.h b/include/asm-generic/atomic64.h
-index b18ce4f..2ee2843 100644
---- a/include/asm-generic/atomic64.h
-+++ b/include/asm-generic/atomic64.h
-@@ -16,6 +16,8 @@ typedef struct {
- long long counter;
- } atomic64_t;
-
-+typedef atomic64_t atomic64_unchecked_t;
-+
- #define ATOMIC64_INIT(i) { (i) }
-
- extern long long atomic64_read(const atomic64_t *v);
-@@ -39,4 +41,14 @@ extern int atomic64_add_unless(atomic64_t *v, long long a, long long u);
- #define atomic64_dec_and_test(v) (atomic64_dec_return((v)) == 0)
- #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1LL, 0LL)
-
-+#define atomic64_read_unchecked(v) atomic64_read(v)
-+#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
-+#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
-+#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
-+#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
-+#define atomic64_inc_unchecked(v) atomic64_inc(v)
-+#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
-+#define atomic64_dec_unchecked(v) atomic64_dec(v)
-+#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
-+
- #endif /* _ASM_GENERIC_ATOMIC64_H */
-diff --git a/include/asm-generic/bug.h b/include/asm-generic/bug.h
-index d48ddf0..656a0ac 100644
---- a/include/asm-generic/bug.h
-+++ b/include/asm-generic/bug.h
-@@ -105,11 +105,11 @@ extern void warn_slowpath_null(const char *file, const int line);
-
- #else /* !CONFIG_BUG */
- #ifndef HAVE_ARCH_BUG
--#define BUG() do {} while(0)
-+#define BUG() do { for (;;) ; } while(0)
- #endif
-
- #ifndef HAVE_ARCH_BUG_ON
--#define BUG_ON(condition) do { if (condition) ; } while(0)
-+#define BUG_ON(condition) do { if (condition) for (;;) ; } while(0)
- #endif
-
- #ifndef HAVE_ARCH_WARN_ON
-diff --git a/include/asm-generic/cache.h b/include/asm-generic/cache.h
-index 1bfcfe5..e04c5c9 100644
---- a/include/asm-generic/cache.h
-+++ b/include/asm-generic/cache.h
-@@ -6,7 +6,7 @@
- * cache lines need to provide their own cache.h.
- */
-
--#define L1_CACHE_SHIFT 5
--#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_SHIFT 5UL
-+#define L1_CACHE_BYTES (1UL << L1_CACHE_SHIFT)
-
- #endif /* __ASM_GENERIC_CACHE_H */
-diff --git a/include/asm-generic/dma-mapping-common.h b/include/asm-generic/dma-mapping-common.h
-index 6920695..41038bc 100644
---- a/include/asm-generic/dma-mapping-common.h
-+++ b/include/asm-generic/dma-mapping-common.h
-@@ -11,7 +11,7 @@ static inline dma_addr_t dma_map_single_attrs(struct device *dev, void *ptr,
- enum dma_data_direction dir,
- struct dma_attrs *attrs)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
- dma_addr_t addr;
-
- kmemcheck_mark_initialized(ptr, size);
-@@ -30,7 +30,7 @@ static inline void dma_unmap_single_attrs(struct device *dev, dma_addr_t addr,
- enum dma_data_direction dir,
- struct dma_attrs *attrs)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- BUG_ON(!valid_dma_direction(dir));
- if (ops->unmap_page)
-@@ -42,7 +42,7 @@ static inline int dma_map_sg_attrs(struct device *dev, struct scatterlist *sg,
- int nents, enum dma_data_direction dir,
- struct dma_attrs *attrs)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
- int i, ents;
- struct scatterlist *s;
-
-@@ -59,7 +59,7 @@ static inline void dma_unmap_sg_attrs(struct device *dev, struct scatterlist *sg
- int nents, enum dma_data_direction dir,
- struct dma_attrs *attrs)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- BUG_ON(!valid_dma_direction(dir));
- debug_dma_unmap_sg(dev, sg, nents, dir);
-@@ -71,7 +71,7 @@ static inline dma_addr_t dma_map_page(struct device *dev, struct page *page,
- size_t offset, size_t size,
- enum dma_data_direction dir)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
- dma_addr_t addr;
-
- kmemcheck_mark_initialized(page_address(page) + offset, size);
-@@ -85,7 +85,7 @@ static inline dma_addr_t dma_map_page(struct device *dev, struct page *page,
- static inline void dma_unmap_page(struct device *dev, dma_addr_t addr,
- size_t size, enum dma_data_direction dir)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- BUG_ON(!valid_dma_direction(dir));
- if (ops->unmap_page)
-@@ -97,7 +97,7 @@ static inline void dma_sync_single_for_cpu(struct device *dev, dma_addr_t addr,
- size_t size,
- enum dma_data_direction dir)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- BUG_ON(!valid_dma_direction(dir));
- if (ops->sync_single_for_cpu)
-@@ -109,7 +109,7 @@ static inline void dma_sync_single_for_device(struct device *dev,
- dma_addr_t addr, size_t size,
- enum dma_data_direction dir)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- BUG_ON(!valid_dma_direction(dir));
- if (ops->sync_single_for_device)
-@@ -123,7 +123,7 @@ static inline void dma_sync_single_range_for_cpu(struct device *dev,
- size_t size,
- enum dma_data_direction dir)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- BUG_ON(!valid_dma_direction(dir));
- if (ops->sync_single_range_for_cpu) {
-@@ -140,7 +140,7 @@ static inline void dma_sync_single_range_for_device(struct device *dev,
- size_t size,
- enum dma_data_direction dir)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- BUG_ON(!valid_dma_direction(dir));
- if (ops->sync_single_range_for_device) {
-@@ -155,7 +155,7 @@ static inline void
- dma_sync_sg_for_cpu(struct device *dev, struct scatterlist *sg,
- int nelems, enum dma_data_direction dir)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- BUG_ON(!valid_dma_direction(dir));
- if (ops->sync_sg_for_cpu)
-@@ -167,7 +167,7 @@ static inline void
- dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg,
- int nelems, enum dma_data_direction dir)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- BUG_ON(!valid_dma_direction(dir));
- if (ops->sync_sg_for_device)
-diff --git a/include/asm-generic/emergency-restart.h b/include/asm-generic/emergency-restart.h
-index 0d68a1e..b74a761 100644
---- a/include/asm-generic/emergency-restart.h
-+++ b/include/asm-generic/emergency-restart.h
-@@ -1,7 +1,7 @@
- #ifndef _ASM_GENERIC_EMERGENCY_RESTART_H
- #define _ASM_GENERIC_EMERGENCY_RESTART_H
-
--static inline void machine_emergency_restart(void)
-+static inline __noreturn void machine_emergency_restart(void)
- {
- machine_restart(NULL);
- }
-diff --git a/include/asm-generic/futex.h b/include/asm-generic/futex.h
-index 3c2344f..4590a7d 100644
---- a/include/asm-generic/futex.h
-+++ b/include/asm-generic/futex.h
-@@ -6,7 +6,7 @@
- #include <asm/errno.h>
-
- static inline int
--futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
-+futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
- {
- int op = (encoded_op >> 28) & 7;
- int cmp = (encoded_op >> 24) & 15;
-@@ -48,7 +48,7 @@ futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
- }
-
- static inline int
--futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval, int newval)
-+futex_atomic_cmpxchg_inatomic(u32 __user *uaddr, int oldval, int newval)
- {
- return -ENOSYS;
- }
-diff --git a/include/asm-generic/kmap_types.h b/include/asm-generic/kmap_types.h
-index e5f234a..cdb16b3 100644
---- a/include/asm-generic/kmap_types.h
-+++ b/include/asm-generic/kmap_types.h
-@@ -28,7 +28,8 @@ KMAP_D(15) KM_UML_USERCOPY,
- KMAP_D(16) KM_IRQ_PTE,
- KMAP_D(17) KM_NMI,
- KMAP_D(18) KM_NMI_PTE,
--KMAP_D(19) KM_TYPE_NR
-+KMAP_D(19) KM_CLEARPAGE,
-+KMAP_D(20) KM_TYPE_NR
- };
-
- #undef KMAP_D
-diff --git a/include/asm-generic/local.h b/include/asm-generic/local.h
-index fc21844..c2c4ea2 100644
---- a/include/asm-generic/local.h
-+++ b/include/asm-generic/local.h
-@@ -23,24 +23,37 @@ typedef struct
- atomic_long_t a;
- } local_t;
-
-+typedef struct {
-+ atomic_long_unchecked_t a;
-+} local_unchecked_t;
-+
- #define LOCAL_INIT(i) { ATOMIC_LONG_INIT(i) }
-
- #define local_read(l) atomic_long_read(&(l)->a)
-+#define local_read_unchecked(l) atomic_long_read_unchecked(&(l)->a)
- #define local_set(l,i) atomic_long_set((&(l)->a),(i))
-+#define local_set_unchecked(l,i) atomic_long_set_unchecked((&(l)->a),(i))
- #define local_inc(l) atomic_long_inc(&(l)->a)
-+#define local_inc_unchecked(l) atomic_long_inc_unchecked(&(l)->a)
- #define local_dec(l) atomic_long_dec(&(l)->a)
-+#define local_dec_unchecked(l) atomic_long_dec_unchecked(&(l)->a)
- #define local_add(i,l) atomic_long_add((i),(&(l)->a))
-+#define local_add_unchecked(i,l) atomic_long_add_unchecked((i),(&(l)->a))
- #define local_sub(i,l) atomic_long_sub((i),(&(l)->a))
-+#define local_sub_unchecked(i,l) atomic_long_sub_unchecked((i),(&(l)->a))
-
- #define local_sub_and_test(i, l) atomic_long_sub_and_test((i), (&(l)->a))
- #define local_dec_and_test(l) atomic_long_dec_and_test(&(l)->a)
- #define local_inc_and_test(l) atomic_long_inc_and_test(&(l)->a)
- #define local_add_negative(i, l) atomic_long_add_negative((i), (&(l)->a))
- #define local_add_return(i, l) atomic_long_add_return((i), (&(l)->a))
-+#define local_add_return_unchecked(i, l) atomic_long_add_return_unchecked((i), (&(l)->a))
- #define local_sub_return(i, l) atomic_long_sub_return((i), (&(l)->a))
- #define local_inc_return(l) atomic_long_inc_return(&(l)->a)
-+#define local_dec_return(l) atomic_long_dec_return(&(l)->a)
-
- #define local_cmpxchg(l, o, n) atomic_long_cmpxchg((&(l)->a), (o), (n))
-+#define local_cmpxchg_unchecked(l, o, n) atomic_long_cmpxchg((&(l)->a), (o), (n))
- #define local_xchg(l, n) atomic_long_xchg((&(l)->a), (n))
- #define local_add_unless(l, _a, u) atomic_long_add_unless((&(l)->a), (_a), (u))
- #define local_inc_not_zero(l) atomic_long_inc_not_zero(&(l)->a)
-diff --git a/include/asm-generic/pgtable-nopmd.h b/include/asm-generic/pgtable-nopmd.h
-index 725612b..9cc513a 100644
---- a/include/asm-generic/pgtable-nopmd.h
-+++ b/include/asm-generic/pgtable-nopmd.h
-@@ -1,14 +1,19 @@
- #ifndef _PGTABLE_NOPMD_H
- #define _PGTABLE_NOPMD_H
-
--#ifndef __ASSEMBLY__
--
- #include <asm-generic/pgtable-nopud.h>
-
--struct mm_struct;
--
- #define __PAGETABLE_PMD_FOLDED
-
-+#define PMD_SHIFT PUD_SHIFT
-+#define PTRS_PER_PMD 1
-+#define PMD_SIZE (_AC(1,UL) << PMD_SHIFT)
-+#define PMD_MASK (~(PMD_SIZE-1))
-+
-+#ifndef __ASSEMBLY__
-+
-+struct mm_struct;
-+
- /*
- * Having the pmd type consist of a pud gets the size right, and allows
- * us to conceptually access the pud entry that this pmd is folded into
-@@ -16,11 +21,6 @@ struct mm_struct;
- */
- typedef struct { pud_t pud; } pmd_t;
-
--#define PMD_SHIFT PUD_SHIFT
--#define PTRS_PER_PMD 1
--#define PMD_SIZE (1UL << PMD_SHIFT)
--#define PMD_MASK (~(PMD_SIZE-1))
--
- /*
- * The "pud_xxx()" functions here are trivial for a folded two-level
- * setup: the pmd is never bad, and a pmd always exists (as it's folded
-diff --git a/include/asm-generic/pgtable-nopud.h b/include/asm-generic/pgtable-nopud.h
-index 810431d..0ec4804f 100644
---- a/include/asm-generic/pgtable-nopud.h
-+++ b/include/asm-generic/pgtable-nopud.h
-@@ -1,10 +1,15 @@
- #ifndef _PGTABLE_NOPUD_H
- #define _PGTABLE_NOPUD_H
-
--#ifndef __ASSEMBLY__
--
- #define __PAGETABLE_PUD_FOLDED
-
-+#define PUD_SHIFT PGDIR_SHIFT
-+#define PTRS_PER_PUD 1
-+#define PUD_SIZE (_AC(1,UL) << PUD_SHIFT)
-+#define PUD_MASK (~(PUD_SIZE-1))
-+
-+#ifndef __ASSEMBLY__
-+
- /*
- * Having the pud type consist of a pgd gets the size right, and allows
- * us to conceptually access the pgd entry that this pud is folded into
-@@ -12,11 +17,6 @@
- */
- typedef struct { pgd_t pgd; } pud_t;
-
--#define PUD_SHIFT PGDIR_SHIFT
--#define PTRS_PER_PUD 1
--#define PUD_SIZE (1UL << PUD_SHIFT)
--#define PUD_MASK (~(PUD_SIZE-1))
--
- /*
- * The "pgd_xxx()" functions here are trivial for a folded two-level
- * setup: the pud is never bad, and a pud always exists (as it's folded
-@@ -29,6 +29,7 @@ static inline void pgd_clear(pgd_t *pgd) { }
- #define pud_ERROR(pud) (pgd_ERROR((pud).pgd))
-
- #define pgd_populate(mm, pgd, pud) do { } while (0)
-+#define pgd_populate_kernel(mm, pgd, pud) do { } while (0)
- /*
- * (puds are folded into pgds so this doesn't get actually called,
- * but the define is needed for a generic inline function.)
-diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
-index e2bd73e..fea8ed3 100644
---- a/include/asm-generic/pgtable.h
-+++ b/include/asm-generic/pgtable.h
-@@ -344,6 +344,14 @@ extern void untrack_pfn_vma(struct vm_area_struct *vma, unsigned long pfn,
- unsigned long size);
- #endif
-
-+#ifndef __HAVE_ARCH_PAX_OPEN_KERNEL
-+static inline unsigned long pax_open_kernel(void) { return 0; }
-+#endif
-+
-+#ifndef __HAVE_ARCH_PAX_CLOSE_KERNEL
-+static inline unsigned long pax_close_kernel(void) { return 0; }
-+#endif
-+
- #endif /* !__ASSEMBLY__ */
-
- #endif /* _ASM_GENERIC_PGTABLE_H */
-diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
-index b6e818f..21aa58a 100644
---- a/include/asm-generic/vmlinux.lds.h
-+++ b/include/asm-generic/vmlinux.lds.h
-@@ -199,6 +199,7 @@
- .rodata : AT(ADDR(.rodata) - LOAD_OFFSET) { \
- VMLINUX_SYMBOL(__start_rodata) = .; \
- *(.rodata) *(.rodata.*) \
-+ *(.data.read_only) \
- *(__vermagic) /* Kernel version magic */ \
- *(__markers_strings) /* Markers: strings */ \
- *(__tracepoints_strings)/* Tracepoints: strings */ \
-@@ -656,22 +657,24 @@
- * section in the linker script will go there too. @phdr should have
- * a leading colon.
- *
-- * Note that this macros defines __per_cpu_load as an absolute symbol.
-+ * Note that this macros defines per_cpu_load as an absolute symbol.
- * If there is no need to put the percpu section at a predetermined
- * address, use PERCPU().
- */
- #define PERCPU_VADDR(vaddr, phdr) \
-- VMLINUX_SYMBOL(__per_cpu_load) = .; \
-- .data.percpu vaddr : AT(VMLINUX_SYMBOL(__per_cpu_load) \
-+ per_cpu_load = .; \
-+ .data.percpu vaddr : AT(VMLINUX_SYMBOL(per_cpu_load) \
- - LOAD_OFFSET) { \
-+ VMLINUX_SYMBOL(__per_cpu_load) = . + per_cpu_load; \
- VMLINUX_SYMBOL(__per_cpu_start) = .; \
- *(.data.percpu.first) \
-- *(.data.percpu.page_aligned) \
- *(.data.percpu) \
-+ . = ALIGN(PAGE_SIZE); \
-+ *(.data.percpu.page_aligned) \
- *(.data.percpu.shared_aligned) \
- VMLINUX_SYMBOL(__per_cpu_end) = .; \
- } phdr \
-- . = VMLINUX_SYMBOL(__per_cpu_load) + SIZEOF(.data.percpu);
-+ . = VMLINUX_SYMBOL(per_cpu_load) + SIZEOF(.data.percpu);
-
- /**
- * PERCPU - define output section for percpu area, simple version
-diff --git a/include/crypto/algapi.h b/include/crypto/algapi.h
-index 1ffb53f..b156927 100644
---- a/include/crypto/algapi.h
-+++ b/include/crypto/algapi.h
-@@ -32,7 +32,7 @@ struct crypto_type {
- unsigned int maskclear;
- unsigned int maskset;
- unsigned int tfmsize;
--};
-+} __do_const;
-
- struct crypto_instance {
- struct crypto_alg alg;
-diff --git a/include/drm/drmP.h b/include/drm/drmP.h
-index ebab6a6..351dba1 100644
---- a/include/drm/drmP.h
-+++ b/include/drm/drmP.h
-@@ -71,6 +71,7 @@
- #include <linux/workqueue.h>
- #include <linux/poll.h>
- #include <asm/pgalloc.h>
-+#include <asm/local.h>
- #include "drm.h"
-
- #include <linux/idr.h>
-@@ -814,7 +815,7 @@ struct drm_driver {
- void (*vgaarb_irq)(struct drm_device *dev, bool state);
-
- /* Driver private ops for this object */
-- struct vm_operations_struct *gem_vm_ops;
-+ const struct vm_operations_struct *gem_vm_ops;
-
- int major;
- int minor;
-@@ -917,7 +918,7 @@ struct drm_device {
-
- /** \name Usage Counters */
- /*@{ */
-- int open_count; /**< Outstanding files open */
-+ local_t open_count; /**< Outstanding files open */
- atomic_t ioctl_count; /**< Outstanding IOCTLs pending */
- atomic_t vma_count; /**< Outstanding vma areas open */
- int buf_use; /**< Buffers in use -- cannot alloc */
-@@ -928,7 +929,7 @@ struct drm_device {
- /*@{ */
- unsigned long counters;
- enum drm_stat_type types[15];
-- atomic_t counts[15];
-+ atomic_unchecked_t counts[15];
- /*@} */
-
- struct list_head filelist;
-@@ -1016,7 +1017,7 @@ struct drm_device {
- struct pci_controller *hose;
- #endif
- struct drm_sg_mem *sg; /**< Scatter gather memory */
-- unsigned int num_crtcs; /**< Number of CRTCs on this device */
-+ unsigned int num_crtcs; /**< Number of CRTCs on this device */
- void *dev_private; /**< device private data */
- void *mm_private;
- struct address_space *dev_mapping;
-@@ -1042,11 +1043,11 @@ struct drm_device {
- spinlock_t object_name_lock;
- struct idr object_name_idr;
- atomic_t object_count;
-- atomic_t object_memory;
-+ atomic_unchecked_t object_memory;
- atomic_t pin_count;
-- atomic_t pin_memory;
-+ atomic_unchecked_t pin_memory;
- atomic_t gtt_count;
-- atomic_t gtt_memory;
-+ atomic_unchecked_t gtt_memory;
- uint32_t gtt_total;
- uint32_t invalidate_domains; /* domains pending invalidation */
- uint32_t flush_domains; /* domains pending flush */
-diff --git a/include/drm/drm_crtc_helper.h b/include/drm/drm_crtc_helper.h
-index b29e201..c4825f4 100644
---- a/include/drm/drm_crtc_helper.h
-+++ b/include/drm/drm_crtc_helper.h
-@@ -85,7 +85,7 @@ struct drm_encoder_helper_funcs {
- struct drm_connector *connector);
- /* disable encoder when not in use - more explicit than dpms off */
- void (*disable)(struct drm_encoder *encoder);
--};
-+} __no_const;
-
- struct drm_connector_helper_funcs {
- int (*get_modes)(struct drm_connector *connector);
-diff --git a/include/drm/ttm/ttm_memory.h b/include/drm/ttm/ttm_memory.h
-index b199170..6f9e64c 100644
---- a/include/drm/ttm/ttm_memory.h
-+++ b/include/drm/ttm/ttm_memory.h
-@@ -47,7 +47,7 @@
-
- struct ttm_mem_shrink {
- int (*do_shrink) (struct ttm_mem_shrink *);
--};
-+} __no_const;
-
- /**
- * struct ttm_mem_global - Global memory accounting structure.
-diff --git a/include/linux/Kbuild b/include/linux/Kbuild
-index 1feed71..4d4cbbb 100644
---- a/include/linux/Kbuild
-+++ b/include/linux/Kbuild
-@@ -187,6 +187,7 @@ unifdef-y += blktrace_api.h
- unifdef-y += capability.h
- unifdef-y += capi.h
- unifdef-y += cciss_ioctl.h
-+unifdef-y += cciss_defs.h
- unifdef-y += cdrom.h
- unifdef-y += cm4000_cs.h
- unifdef-y += cn_proc.h
-diff --git a/include/linux/a.out.h b/include/linux/a.out.h
-index e86dfca..40cc55f 100644
---- a/include/linux/a.out.h
-+++ b/include/linux/a.out.h
-@@ -39,6 +39,14 @@ enum machine_type {
- M_MIPS2 = 152 /* MIPS R6000/R4000 binary */
- };
-
-+/* Constants for the N_FLAGS field */
-+#define F_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
-+#define F_PAX_EMUTRAMP 2 /* Emulate trampolines */
-+#define F_PAX_MPROTECT 4 /* Restrict mprotect() */
-+#define F_PAX_RANDMMAP 8 /* Randomize mmap() base */
-+/*#define F_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
-+#define F_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
-+
- #if !defined (N_MAGIC)
- #define N_MAGIC(exec) ((exec).a_info & 0xffff)
- #endif
-diff --git a/include/linux/atmdev.h b/include/linux/atmdev.h
-index 817b237..62c10bc 100644
---- a/include/linux/atmdev.h
-+++ b/include/linux/atmdev.h
-@@ -237,7 +237,7 @@ struct compat_atm_iobuf {
- #endif
-
- struct k_atm_aal_stats {
--#define __HANDLE_ITEM(i) atomic_t i
-+#define __HANDLE_ITEM(i) atomic_unchecked_t i
- __AAL_STAT_ITEMS
- #undef __HANDLE_ITEM
- };
-diff --git a/include/linux/backlight.h b/include/linux/backlight.h
-index 0f5f578..8c4f884 100644
---- a/include/linux/backlight.h
-+++ b/include/linux/backlight.h
-@@ -36,18 +36,18 @@ struct backlight_device;
- struct fb_info;
-
- struct backlight_ops {
-- unsigned int options;
-+ const unsigned int options;
-
- #define BL_CORE_SUSPENDRESUME (1 << 0)
-
- /* Notify the backlight driver some property has changed */
-- int (*update_status)(struct backlight_device *);
-+ int (* const update_status)(struct backlight_device *);
- /* Return the current backlight brightness (accounting for power,
- fb_blank etc.) */
-- int (*get_brightness)(struct backlight_device *);
-+ int (* const get_brightness)(struct backlight_device *);
- /* Check if given framebuffer device is the one bound to this backlight;
- return 0 if not, !=0 if it is. If NULL, backlight always matches the fb. */
-- int (*check_fb)(struct fb_info *);
-+ int (* const check_fb)(struct fb_info *);
- };
-
- /* This structure defines all the properties of a backlight */
-@@ -86,7 +86,7 @@ struct backlight_device {
- registered this device has been unloaded, and if class_get_devdata()
- points to something in the body of that driver, it is also invalid. */
- struct mutex ops_lock;
-- struct backlight_ops *ops;
-+ const struct backlight_ops *ops;
-
- /* The framebuffer notifier block */
- struct notifier_block fb_notif;
-@@ -103,7 +103,7 @@ static inline void backlight_update_status(struct backlight_device *bd)
- }
-
- extern struct backlight_device *backlight_device_register(const char *name,
-- struct device *dev, void *devdata, struct backlight_ops *ops);
-+ struct device *dev, void *devdata, const struct backlight_ops *ops);
- extern void backlight_device_unregister(struct backlight_device *bd);
- extern void backlight_force_update(struct backlight_device *bd,
- enum backlight_update_reason reason);
-diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
-index 9ffffec..34819e4 100644
---- a/include/linux/binfmts.h
-+++ b/include/linux/binfmts.h
-@@ -18,7 +18,7 @@ struct pt_regs;
- #define BINPRM_BUF_SIZE 128
-
- #ifdef __KERNEL__
--#include <linux/list.h>
-+#include <linux/sched.h>
-
- #define CORENAME_MAX_SIZE 128
-
-@@ -58,6 +58,7 @@ struct linux_binprm{
- unsigned interp_flags;
- unsigned interp_data;
- unsigned long loader, exec;
-+ char tcomm[TASK_COMM_LEN];
- };
-
- extern void acct_arg_size(struct linux_binprm *bprm, unsigned long pages);
-@@ -81,6 +82,7 @@ struct linux_binfmt {
- int (*load_binary)(struct linux_binprm *, struct pt_regs * regs);
- int (*load_shlib)(struct file *);
- int (*core_dump)(long signr, struct pt_regs *regs, struct file *file, unsigned long limit);
-+ void (*handle_mprotect)(struct vm_area_struct *vma, unsigned long newflags);
- unsigned long min_coredump; /* minimal dump size */
- int hasvdso;
- };
-@@ -107,9 +109,6 @@ extern int flush_old_exec(struct linux_binprm * bprm);
- extern void setup_new_exec(struct linux_binprm * bprm);
-
- extern int suid_dumpable;
--#define SUID_DUMP_DISABLE 0 /* No setuid dumping */
--#define SUID_DUMP_USER 1 /* Dump as user of process */
--#define SUID_DUMP_ROOT 2 /* Dump as root */
-
- /* Stack area protections */
- #define EXSTACK_DEFAULT 0 /* Whatever the arch defaults to */
-diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
-index ec9c10b..dc26428 100644
---- a/include/linux/blkdev.h
-+++ b/include/linux/blkdev.h
-@@ -1279,7 +1279,7 @@ struct block_device_operations {
- int (*revalidate_disk) (struct gendisk *);
- int (*getgeo)(struct block_device *, struct hd_geometry *);
- struct module *owner;
--};
-+} __do_const;
-
- extern int __blkdev_driver_ioctl(struct block_device *, fmode_t, unsigned int,
- unsigned long);
-diff --git a/include/linux/blktrace_api.h b/include/linux/blktrace_api.h
-index 3b73b99..629d21b 100644
---- a/include/linux/blktrace_api.h
-+++ b/include/linux/blktrace_api.h
-@@ -160,7 +160,7 @@ struct blk_trace {
- struct dentry *dir;
- struct dentry *dropped_file;
- struct dentry *msg_file;
-- atomic_t dropped;
-+ atomic_unchecked_t dropped;
- };
-
- extern int blk_trace_ioctl(struct block_device *, unsigned, char __user *);
-diff --git a/include/linux/byteorder/little_endian.h b/include/linux/byteorder/little_endian.h
-index 83195fb..0b0f77d 100644
---- a/include/linux/byteorder/little_endian.h
-+++ b/include/linux/byteorder/little_endian.h
-@@ -42,51 +42,51 @@
-
- static inline __le64 __cpu_to_le64p(const __u64 *p)
- {
-- return (__force __le64)*p;
-+ return (__force const __le64)*p;
- }
- static inline __u64 __le64_to_cpup(const __le64 *p)
- {
-- return (__force __u64)*p;
-+ return (__force const __u64)*p;
- }
- static inline __le32 __cpu_to_le32p(const __u32 *p)
- {
-- return (__force __le32)*p;
-+ return (__force const __le32)*p;
- }
- static inline __u32 __le32_to_cpup(const __le32 *p)
- {
-- return (__force __u32)*p;
-+ return (__force const __u32)*p;
- }
- static inline __le16 __cpu_to_le16p(const __u16 *p)
- {
-- return (__force __le16)*p;
-+ return (__force const __le16)*p;
- }
- static inline __u16 __le16_to_cpup(const __le16 *p)
- {
-- return (__force __u16)*p;
-+ return (__force const __u16)*p;
- }
- static inline __be64 __cpu_to_be64p(const __u64 *p)
- {
-- return (__force __be64)__swab64p(p);
-+ return (__force const __be64)__swab64p(p);
- }
- static inline __u64 __be64_to_cpup(const __be64 *p)
- {
-- return __swab64p((__u64 *)p);
-+ return __swab64p((const __u64 *)p);
- }
- static inline __be32 __cpu_to_be32p(const __u32 *p)
- {
-- return (__force __be32)__swab32p(p);
-+ return (__force const __be32)__swab32p(p);
- }
- static inline __u32 __be32_to_cpup(const __be32 *p)
- {
-- return __swab32p((__u32 *)p);
-+ return __swab32p((const __u32 *)p);
- }
- static inline __be16 __cpu_to_be16p(const __u16 *p)
- {
-- return (__force __be16)__swab16p(p);
-+ return (__force const __be16)__swab16p(p);
- }
- static inline __u16 __be16_to_cpup(const __be16 *p)
- {
-- return __swab16p((__u16 *)p);
-+ return __swab16p((const __u16 *)p);
- }
- #define __cpu_to_le64s(x) do { (void)(x); } while (0)
- #define __le64_to_cpus(x) do { (void)(x); } while (0)
-diff --git a/include/linux/cache.h b/include/linux/cache.h
-index 97e2488..e7576b9 100644
---- a/include/linux/cache.h
-+++ b/include/linux/cache.h
-@@ -16,6 +16,10 @@
- #define __read_mostly
- #endif
-
-+#ifndef __read_only
-+#define __read_only __read_mostly
-+#endif
-+
- #ifndef ____cacheline_aligned
- #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
- #endif
-diff --git a/include/linux/capability.h b/include/linux/capability.h
-index c8f2a5f7..78ffdf5 100644
---- a/include/linux/capability.h
-+++ b/include/linux/capability.h
-@@ -563,11 +563,15 @@ extern const kernel_cap_t __cap_init_eff_set;
- (security_real_capable_noaudit((t), (cap)) == 0)
-
- extern int capable(int cap);
-+int capable_nolog(int cap);
-
- /* audit system wants to get cap info from files as well */
- struct dentry;
- extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps);
-
-+extern int is_privileged_binary(const struct dentry *dentry);
-+extern int is_root_privileged_binary(const struct dentry *dentry);
-+
- #endif /* __KERNEL__ */
-
- #endif /* !_LINUX_CAPABILITY_H */
-diff --git a/include/linux/cciss_defs.h b/include/linux/cciss_defs.h
-new file mode 100644
-index 0000000..316b670
---- /dev/null
-+++ b/include/linux/cciss_defs.h
-@@ -0,0 +1,130 @@
-+#ifndef CCISS_DEFS_H
-+#define CCISS_DEFS_H
-+
-+#include <linux/types.h>
-+
-+/* general boundary definitions */
-+#define SENSEINFOBYTES 32 /* note that this value may vary
-+ between host implementations */
-+
-+/* Command Status value */
-+#define CMD_SUCCESS 0x0000
-+#define CMD_TARGET_STATUS 0x0001
-+#define CMD_DATA_UNDERRUN 0x0002
-+#define CMD_DATA_OVERRUN 0x0003
-+#define CMD_INVALID 0x0004
-+#define CMD_PROTOCOL_ERR 0x0005
-+#define CMD_HARDWARE_ERR 0x0006
-+#define CMD_CONNECTION_LOST 0x0007
-+#define CMD_ABORTED 0x0008
-+#define CMD_ABORT_FAILED 0x0009
-+#define CMD_UNSOLICITED_ABORT 0x000A
-+#define CMD_TIMEOUT 0x000B
-+#define CMD_UNABORTABLE 0x000C
-+
-+/* transfer direction */
-+#define XFER_NONE 0x00
-+#define XFER_WRITE 0x01
-+#define XFER_READ 0x02
-+#define XFER_RSVD 0x03
-+
-+/* task attribute */
-+#define ATTR_UNTAGGED 0x00
-+#define ATTR_SIMPLE 0x04
-+#define ATTR_HEADOFQUEUE 0x05
-+#define ATTR_ORDERED 0x06
-+#define ATTR_ACA 0x07
-+
-+/* cdb type */
-+#define TYPE_CMD 0x00
-+#define TYPE_MSG 0x01
-+
-+/* Type defs used in the following structs */
-+#define BYTE __u8
-+#define WORD __u16
-+#define HWORD __u16
-+#define DWORD __u32
-+
-+#define CISS_MAX_LUN 1024
-+
-+#define LEVEL2LUN 1 /* index into Target(x) structure, due to byte swapping */
-+#define LEVEL3LUN 0
-+
-+#pragma pack(1)
-+
-+/* Command List Structure */
-+typedef union _SCSI3Addr_struct {
-+ struct {
-+ BYTE Dev;
-+ BYTE Bus:6;
-+ BYTE Mode:2; /* b00 */
-+ } PeripDev;
-+ struct {
-+ BYTE DevLSB;
-+ BYTE DevMSB:6;
-+ BYTE Mode:2; /* b01 */
-+ } LogDev;
-+ struct {
-+ BYTE Dev:5;
-+ BYTE Bus:3;
-+ BYTE Targ:6;
-+ BYTE Mode:2; /* b10 */
-+ } LogUnit;
-+} SCSI3Addr_struct;
-+
-+typedef struct _PhysDevAddr_struct {
-+ DWORD TargetId:24;
-+ DWORD Bus:6;
-+ DWORD Mode:2;
-+ SCSI3Addr_struct Target[2]; /* 2 level target device addr */
-+} PhysDevAddr_struct;
-+
-+typedef struct _LogDevAddr_struct {
-+ DWORD VolId:30;
-+ DWORD Mode:2;
-+ BYTE reserved[4];
-+} LogDevAddr_struct;
-+
-+typedef union _LUNAddr_struct {
-+ BYTE LunAddrBytes[8];
-+ SCSI3Addr_struct SCSI3Lun[4];
-+ PhysDevAddr_struct PhysDev;
-+ LogDevAddr_struct LogDev;
-+} LUNAddr_struct;
-+
-+typedef struct _RequestBlock_struct {
-+ BYTE CDBLen;
-+ struct {
-+ BYTE Type:3;
-+ BYTE Attribute:3;
-+ BYTE Direction:2;
-+ } Type;
-+ HWORD Timeout;
-+ BYTE CDB[16];
-+} RequestBlock_struct;
-+
-+typedef union _MoreErrInfo_struct{
-+ struct {
-+ BYTE Reserved[3];
-+ BYTE Type;
-+ DWORD ErrorInfo;
-+ } Common_Info;
-+ struct{
-+ BYTE Reserved[2];
-+ BYTE offense_size; /* size of offending entry */
-+ BYTE offense_num; /* byte # of offense 0-base */
-+ DWORD offense_value;
-+ } Invalid_Cmd;
-+} MoreErrInfo_struct;
-+typedef struct _ErrorInfo_struct {
-+ BYTE ScsiStatus;
-+ BYTE SenseLen;
-+ HWORD CommandStatus;
-+ DWORD ResidualCnt;
-+ MoreErrInfo_struct MoreErrInfo;
-+ BYTE SenseInfo[SENSEINFOBYTES];
-+} ErrorInfo_struct;
-+
-+#pragma pack()
-+
-+#endif /* CCISS_DEFS_H */
-diff --git a/include/linux/cciss_ioctl.h b/include/linux/cciss_ioctl.h
-index cb57c30..48078c3 100644
---- a/include/linux/cciss_ioctl.h
-+++ b/include/linux/cciss_ioctl.h
-@@ -3,6 +3,7 @@
-
- #include <linux/types.h>
- #include <linux/ioctl.h>
-+#include <linux/cciss_defs.h>
-
- #define CCISS_IOC_MAGIC 'B'
-
-@@ -13,7 +14,7 @@ typedef struct _cciss_pci_info_struct
- unsigned char dev_fn;
- unsigned short domain;
- __u32 board_id;
--} cciss_pci_info_struct;
-+} cciss_pci_info_struct;
-
- typedef struct _cciss_coalint_struct
- {
-@@ -36,137 +37,10 @@ typedef __u32 DriverVer_type;
-
- #define MAX_KMALLOC_SIZE 128000
-
--#ifndef CCISS_CMD_H
--// This defines are duplicated in cciss_cmd.h in the driver directory
--
--//general boundary defintions
--#define SENSEINFOBYTES 32//note that this value may vary between host implementations
--
--//Command Status value
--#define CMD_SUCCESS 0x0000
--#define CMD_TARGET_STATUS 0x0001
--#define CMD_DATA_UNDERRUN 0x0002
--#define CMD_DATA_OVERRUN 0x0003
--#define CMD_INVALID 0x0004
--#define CMD_PROTOCOL_ERR 0x0005
--#define CMD_HARDWARE_ERR 0x0006
--#define CMD_CONNECTION_LOST 0x0007
--#define CMD_ABORTED 0x0008
--#define CMD_ABORT_FAILED 0x0009
--#define CMD_UNSOLICITED_ABORT 0x000A
--#define CMD_TIMEOUT 0x000B
--#define CMD_UNABORTABLE 0x000C
--
--//transfer direction
--#define XFER_NONE 0x00
--#define XFER_WRITE 0x01
--#define XFER_READ 0x02
--#define XFER_RSVD 0x03
--
--//task attribute
--#define ATTR_UNTAGGED 0x00
--#define ATTR_SIMPLE 0x04
--#define ATTR_HEADOFQUEUE 0x05
--#define ATTR_ORDERED 0x06
--#define ATTR_ACA 0x07
--
--//cdb type
--#define TYPE_CMD 0x00
--#define TYPE_MSG 0x01
--
--// Type defs used in the following structs
--#define BYTE __u8
--#define WORD __u16
--#define HWORD __u16
--#define DWORD __u32
--
--#define CISS_MAX_LUN 1024
--
--#define LEVEL2LUN 1 // index into Target(x) structure, due to byte swapping
--#define LEVEL3LUN 0
--
--#pragma pack(1)
--
--//Command List Structure
--typedef union _SCSI3Addr_struct {
-- struct {
-- BYTE Dev;
-- BYTE Bus:6;
-- BYTE Mode:2; // b00
-- } PeripDev;
-- struct {
-- BYTE DevLSB;
-- BYTE DevMSB:6;
-- BYTE Mode:2; // b01
-- } LogDev;
-- struct {
-- BYTE Dev:5;
-- BYTE Bus:3;
-- BYTE Targ:6;
-- BYTE Mode:2; // b10
-- } LogUnit;
--} SCSI3Addr_struct;
--
--typedef struct _PhysDevAddr_struct {
-- DWORD TargetId:24;
-- DWORD Bus:6;
-- DWORD Mode:2;
-- SCSI3Addr_struct Target[2]; //2 level target device addr
--} PhysDevAddr_struct;
--
--typedef struct _LogDevAddr_struct {
-- DWORD VolId:30;
-- DWORD Mode:2;
-- BYTE reserved[4];
--} LogDevAddr_struct;
--
--typedef union _LUNAddr_struct {
-- BYTE LunAddrBytes[8];
-- SCSI3Addr_struct SCSI3Lun[4];
-- PhysDevAddr_struct PhysDev;
-- LogDevAddr_struct LogDev;
--} LUNAddr_struct;
--
--typedef struct _RequestBlock_struct {
-- BYTE CDBLen;
-- struct {
-- BYTE Type:3;
-- BYTE Attribute:3;
-- BYTE Direction:2;
-- } Type;
-- HWORD Timeout;
-- BYTE CDB[16];
--} RequestBlock_struct;
--
--typedef union _MoreErrInfo_struct{
-- struct {
-- BYTE Reserved[3];
-- BYTE Type;
-- DWORD ErrorInfo;
-- }Common_Info;
-- struct{
-- BYTE Reserved[2];
-- BYTE offense_size;//size of offending entry
-- BYTE offense_num; //byte # of offense 0-base
-- DWORD offense_value;
-- }Invalid_Cmd;
--}MoreErrInfo_struct;
--typedef struct _ErrorInfo_struct {
-- BYTE ScsiStatus;
-- BYTE SenseLen;
-- HWORD CommandStatus;
-- DWORD ResidualCnt;
-- MoreErrInfo_struct MoreErrInfo;
-- BYTE SenseInfo[SENSEINFOBYTES];
--} ErrorInfo_struct;
--
--#pragma pack()
--#endif /* CCISS_CMD_H */
--
- typedef struct _IOCTL_Command_struct {
- LUNAddr_struct LUN_info;
- RequestBlock_struct Request;
-- ErrorInfo_struct error_info;
-+ ErrorInfo_struct error_info;
- WORD buf_size; /* size in bytes of the buf */
- BYTE __user *buf;
- } IOCTL_Command_struct;
-@@ -203,7 +77,7 @@ typedef struct _LogvolInfo_struct{
- #define CCISS_PASSTHRU _IOWR(CCISS_IOC_MAGIC, 11, IOCTL_Command_struct)
- #define CCISS_DEREGDISK _IO(CCISS_IOC_MAGIC, 12)
-
--/* no longer used... use REGNEWD instead */
-+/* no longer used... use REGNEWD instead */
- #define CCISS_REGNEWDISK _IOW(CCISS_IOC_MAGIC, 13, int)
-
- #define CCISS_REGNEWD _IO(CCISS_IOC_MAGIC, 14)
-@@ -238,4 +112,4 @@ typedef struct _BIG_IOCTL32_Command_struct {
-
- #endif /* CONFIG_COMPAT */
- #endif /* __KERNEL__ */
--#endif
-+#endif
-diff --git a/include/linux/cdrom.h b/include/linux/cdrom.h
-index 78e9047..ff39f6b 100644
---- a/include/linux/cdrom.h
-+++ b/include/linux/cdrom.h
-@@ -981,7 +981,6 @@ struct cdrom_device_ops {
-
- /* driver specifications */
- const int capability; /* capability flags */
-- int n_minors; /* number of active minor devices */
- /* handle uniform packets for scsi type devices (scsi,atapi) */
- int (*generic_packet) (struct cdrom_device_info *,
- struct packet_command *);
-diff --git a/include/linux/compat.h b/include/linux/compat.h
-index 510266f..9d64053 100644
---- a/include/linux/compat.h
-+++ b/include/linux/compat.h
-@@ -271,7 +271,7 @@ extern int compat_ptrace_request(struct task_struct *child,
- extern long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
- compat_ulong_t addr, compat_ulong_t data);
- asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
-- compat_long_t addr, compat_long_t data);
-+ compat_ulong_t addr, compat_ulong_t data);
-
- /*
- * epoll (fs/eventpoll.c) compat bits follow ...
-diff --git a/include/linux/compiler-gcc4.h b/include/linux/compiler-gcc4.h
-index 450fa59..16b904d 100644
---- a/include/linux/compiler-gcc4.h
-+++ b/include/linux/compiler-gcc4.h
-@@ -14,6 +14,15 @@
- #define __compiler_offsetof(a,b) __builtin_offsetof(a,b)
- #define __always_inline inline __attribute__((always_inline))
-
-+#ifdef SIZE_OVERFLOW_PLUGIN
-+#define __size_overflow(...) __attribute__((size_overflow(__VA_ARGS__)))
-+#define __intentional_overflow(...) __attribute__((intentional_overflow(__VA_ARGS__)))
-+#endif
-+
-+#ifdef LATENT_ENTROPY_PLUGIN
-+#define __latent_entropy __attribute__((latent_entropy))
-+#endif
-+
- /*
- * A trick to suppress uninitialized variable warning without generating any
- * code
-@@ -36,4 +45,23 @@
- the kernel context */
- #define __cold __attribute__((__cold__))
-
-+#define __alloc_size(...) __attribute((alloc_size(__VA_ARGS__)))
-+#define __bos(ptr, arg) __builtin_object_size((ptr), (arg))
-+#define __bos0(ptr) __bos((ptr), 0)
-+#define __bos1(ptr) __bos((ptr), 1)
-+#endif
-+
-+#if __GNUC_MINOR__ >= 5
-+#ifdef CONSTIFY_PLUGIN
-+#define __no_const __attribute__((no_const))
-+#define __do_const __attribute__((do_const))
-+#endif
-+#endif
-+
-+#if __GNUC_MINOR__ > 0
-+#define __compiletime_object_size(obj) __builtin_object_size(obj, 0)
-+#endif
-+#if __GNUC_MINOR__ >= 4 && !defined(__CHECKER__)
-+#define __compiletime_warning(message) __attribute__((warning(message)))
-+#define __compiletime_error(message) __attribute__((error(message)))
- #endif
-diff --git a/include/linux/compiler.h b/include/linux/compiler.h
-index 04fb513..225dd4d 100644
---- a/include/linux/compiler.h
-+++ b/include/linux/compiler.h
-@@ -5,11 +5,14 @@
-
- #ifdef __CHECKER__
- # define __user __attribute__((noderef, address_space(1)))
-+# define __force_user __force __user
- # define __kernel /* default address space */
-+# define __force_kernel __force __kernel
- # define __safe __attribute__((safe))
- # define __force __attribute__((force))
- # define __nocast __attribute__((nocast))
- # define __iomem __attribute__((noderef, address_space(2)))
-+# define __force_iomem __force __iomem
- # define __acquires(x) __attribute__((context(x,0,1)))
- # define __releases(x) __attribute__((context(x,1,0)))
- # define __acquire(x) __context__(x,1)
-@@ -17,13 +20,34 @@
- # define __cond_lock(x,c) ((c) ? ({ __acquire(x); 1; }) : 0)
- extern void __chk_user_ptr(const volatile void __user *);
- extern void __chk_io_ptr(const volatile void __iomem *);
-+#elif defined(CHECKER_PLUGIN)
-+//# define __user
-+//# define __force_user
-+//# define __kernel
-+//# define __force_kernel
-+# define __safe
-+# define __force
-+# define __nocast
-+# define __iomem
-+# define __force_iomem
-+# define __chk_user_ptr(x) (void)0
-+# define __chk_io_ptr(x) (void)0
-+# define __builtin_warning(x, y...) (1)
-+# define __acquires(x)
-+# define __releases(x)
-+# define __acquire(x) (void)0
-+# define __release(x) (void)0
-+# define __cond_lock(x,c) (c)
- #else
- # define __user
-+# define __force_user
- # define __kernel
-+# define __force_kernel
- # define __safe
- # define __force
- # define __nocast
- # define __iomem
-+# define __force_iomem
- # define __chk_user_ptr(x) (void)0
- # define __chk_io_ptr(x) (void)0
- # define __builtin_warning(x, y...) (1)
-@@ -247,6 +271,26 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
- # define __attribute_const__ /* unimplemented */
- #endif
-
-+#ifndef __no_const
-+# define __no_const
-+#endif
-+
-+#ifndef __do_const
-+# define __do_const
-+#endif
-+
-+#ifndef __size_overflow
-+# define __size_overflow(...)
-+#endif
-+
-+#ifndef __intentional_overflow
-+# define __intentional_overflow(...)
-+#endif
-+
-+#ifndef __latent_entropy
-+# define __latent_entropy
-+#endif
-+
- /*
- * Tell gcc if a function is cold. The compiler will assume any path
- * directly leading to the call is unlikely.
-@@ -256,6 +300,22 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
- #define __cold
- #endif
-
-+#ifndef __alloc_size
-+#define __alloc_size(...)
-+#endif
-+
-+#ifndef __bos
-+#define __bos(ptr, arg)
-+#endif
-+
-+#ifndef __bos0
-+#define __bos0(ptr)
-+#endif
-+
-+#ifndef __bos1
-+#define __bos1(ptr)
-+#endif
-+
- /* Simple shorthand for a section definition */
- #ifndef __section
- # define __section(S) __attribute__ ((__section__(#S)))
-@@ -266,6 +326,19 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
- # define __same_type(a, b) __builtin_types_compatible_p(typeof(a), typeof(b))
- #endif
-
-+/* Compile time object size, -1 for unknown */
-+#ifndef __compiletime_object_size
-+# define __compiletime_object_size(obj) -1
-+#endif
-+#ifndef __compiletime_warning
-+# define __compiletime_warning(message)
-+#endif
-+#ifndef __compiletime_error
-+# define __compiletime_error(message)
-+#endif
-+#ifndef __linktime_error
-+# define __linktime_error(message)
-+#endif
- /*
- * Prevent the compiler from merging or refetching accesses. The compiler
- * is also forbidden from reordering successive instances of ACCESS_ONCE(),
-@@ -278,6 +351,7 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
- * use is to mediate communication between process-level code and irq/NMI
- * handlers, all running on the same CPU.
- */
--#define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x))
-+#define ACCESS_ONCE(x) (*(volatile const typeof(x) *)&(x))
-+#define ACCESS_ONCE_RW(x) (*(volatile typeof(x) *)&(x))
-
- #endif /* __LINUX_COMPILER_H */
-diff --git a/include/linux/crypto.h b/include/linux/crypto.h
-index fd92988..a3164bd 100644
---- a/include/linux/crypto.h
-+++ b/include/linux/crypto.h
-@@ -394,7 +394,7 @@ struct cipher_tfm {
- const u8 *key, unsigned int keylen);
- void (*cit_encrypt_one)(struct crypto_tfm *tfm, u8 *dst, const u8 *src);
- void (*cit_decrypt_one)(struct crypto_tfm *tfm, u8 *dst, const u8 *src);
--};
-+} __no_const;
-
- struct hash_tfm {
- int (*init)(struct hash_desc *desc);
-@@ -415,13 +415,13 @@ struct compress_tfm {
- int (*cot_decompress)(struct crypto_tfm *tfm,
- const u8 *src, unsigned int slen,
- u8 *dst, unsigned int *dlen);
--};
-+} __no_const;
-
- struct rng_tfm {
- int (*rng_gen_random)(struct crypto_rng *tfm, u8 *rdata,
- unsigned int dlen);
- int (*rng_reset)(struct crypto_rng *tfm, u8 *seed, unsigned int slen);
--};
-+} __no_const;
-
- #define crt_ablkcipher crt_u.ablkcipher
- #define crt_aead crt_u.aead
-diff --git a/include/linux/dcache.h b/include/linux/dcache.h
-index 30b93b2..cd7a8db 100644
---- a/include/linux/dcache.h
-+++ b/include/linux/dcache.h
-@@ -119,6 +119,8 @@ struct dentry {
- unsigned char d_iname[DNAME_INLINE_LEN_MIN]; /* small names */
- };
-
-+#define DNAME_INLINE_LEN (sizeof(struct dentry)-offsetof(struct dentry,d_iname))
-+
- /*
- * dentry->d_lock spinlock nesting subclasses:
- *
-diff --git a/include/linux/decompress/mm.h b/include/linux/decompress/mm.h
-index 3e9bd6a..f4e1aa0 100644
---- a/include/linux/decompress/mm.h
-+++ b/include/linux/decompress/mm.h
-@@ -78,7 +78,7 @@ static void free(void *where)
- * warnings when not needed (indeed large_malloc / large_free are not
- * needed by inflate */
-
--#define malloc(a) kmalloc(a, GFP_KERNEL)
-+#define malloc(a) kmalloc((a), GFP_KERNEL)
- #define free(a) kfree(a)
-
- #define large_malloc(a) vmalloc(a)
-diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
-index 91b7618..92a93d32 100644
---- a/include/linux/dma-mapping.h
-+++ b/include/linux/dma-mapping.h
-@@ -16,51 +16,51 @@ enum dma_data_direction {
- };
-
- struct dma_map_ops {
-- void* (*alloc_coherent)(struct device *dev, size_t size,
-+ void* (* const alloc_coherent)(struct device *dev, size_t size,
- dma_addr_t *dma_handle, gfp_t gfp);
-- void (*free_coherent)(struct device *dev, size_t size,
-+ void (* const free_coherent)(struct device *dev, size_t size,
- void *vaddr, dma_addr_t dma_handle);
-- dma_addr_t (*map_page)(struct device *dev, struct page *page,
-+ dma_addr_t (* const map_page)(struct device *dev, struct page *page,
- unsigned long offset, size_t size,
- enum dma_data_direction dir,
- struct dma_attrs *attrs);
-- void (*unmap_page)(struct device *dev, dma_addr_t dma_handle,
-+ void (* const unmap_page)(struct device *dev, dma_addr_t dma_handle,
- size_t size, enum dma_data_direction dir,
- struct dma_attrs *attrs);
-- int (*map_sg)(struct device *dev, struct scatterlist *sg,
-+ int (* const map_sg)(struct device *dev, struct scatterlist *sg,
- int nents, enum dma_data_direction dir,
- struct dma_attrs *attrs);
-- void (*unmap_sg)(struct device *dev,
-+ void (* const unmap_sg)(struct device *dev,
- struct scatterlist *sg, int nents,
- enum dma_data_direction dir,
- struct dma_attrs *attrs);
-- void (*sync_single_for_cpu)(struct device *dev,
-+ void (* const sync_single_for_cpu)(struct device *dev,
- dma_addr_t dma_handle, size_t size,
- enum dma_data_direction dir);
-- void (*sync_single_for_device)(struct device *dev,
-+ void (* const sync_single_for_device)(struct device *dev,
- dma_addr_t dma_handle, size_t size,
- enum dma_data_direction dir);
-- void (*sync_single_range_for_cpu)(struct device *dev,
-+ void (* const sync_single_range_for_cpu)(struct device *dev,
- dma_addr_t dma_handle,
- unsigned long offset,
- size_t size,
- enum dma_data_direction dir);
-- void (*sync_single_range_for_device)(struct device *dev,
-+ void (* const sync_single_range_for_device)(struct device *dev,
- dma_addr_t dma_handle,
- unsigned long offset,
- size_t size,
- enum dma_data_direction dir);
-- void (*sync_sg_for_cpu)(struct device *dev,
-+ void (* const sync_sg_for_cpu)(struct device *dev,
- struct scatterlist *sg, int nents,
- enum dma_data_direction dir);
-- void (*sync_sg_for_device)(struct device *dev,
-+ void (* const sync_sg_for_device)(struct device *dev,
- struct scatterlist *sg, int nents,
- enum dma_data_direction dir);
-- int (*mapping_error)(struct device *dev, dma_addr_t dma_addr);
-- int (*dma_supported)(struct device *dev, u64 mask);
-+ int (* const mapping_error)(struct device *dev, dma_addr_t dma_addr);
-+ int (* const dma_supported)(struct device *dev, u64 mask);
- int (*set_dma_mask)(struct device *dev, u64 mask);
- int is_phys;
--};
-+} __do_const;
-
- #define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
-
-diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
-index 2b9f2ac..287034f 100644
---- a/include/linux/dmaengine.h
-+++ b/include/linux/dmaengine.h
-@@ -625,9 +625,9 @@ struct dma_pinned_list {
- struct dma_pinned_list *dma_pin_iovec_pages(struct iovec *iov, size_t len);
- void dma_unpin_iovec_pages(struct dma_pinned_list* pinned_list);
-
--dma_cookie_t dma_memcpy_to_iovec(struct dma_chan *chan, struct iovec *iov,
-+dma_cookie_t __intentional_overflow(0) dma_memcpy_to_iovec(struct dma_chan *chan, struct iovec *iov,
- struct dma_pinned_list *pinned_list, unsigned char *kdata, size_t len);
--dma_cookie_t dma_memcpy_pg_to_iovec(struct dma_chan *chan, struct iovec *iov,
-+dma_cookie_t __intentional_overflow(0) dma_memcpy_pg_to_iovec(struct dma_chan *chan, struct iovec *iov,
- struct dma_pinned_list *pinned_list, struct page *page,
- unsigned int offset, size_t len);
-
-diff --git a/include/linux/dst.h b/include/linux/dst.h
-index e26fed8..b976d9f 100644
---- a/include/linux/dst.h
-+++ b/include/linux/dst.h
-@@ -380,7 +380,7 @@ struct dst_node
- struct thread_pool *pool;
-
- /* Transaction IDs live here */
-- atomic_long_t gen;
-+ atomic_long_unchecked_t gen;
-
- /*
- * How frequently and how many times transaction
-diff --git a/include/linux/elf.h b/include/linux/elf.h
-index 90a4ed0..d652617 100644
---- a/include/linux/elf.h
-+++ b/include/linux/elf.h
-@@ -49,6 +49,17 @@ typedef __s64 Elf64_Sxword;
- #define PT_GNU_EH_FRAME 0x6474e550
-
- #define PT_GNU_STACK (PT_LOOS + 0x474e551)
-+#define PT_GNU_RELRO (PT_LOOS + 0x474e552)
-+
-+#define PT_PAX_FLAGS (PT_LOOS + 0x5041580)
-+
-+/* Constants for the e_flags field */
-+#define EF_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
-+#define EF_PAX_EMUTRAMP 2 /* Emulate trampolines */
-+#define EF_PAX_MPROTECT 4 /* Restrict mprotect() */
-+#define EF_PAX_RANDMMAP 8 /* Randomize mmap() base */
-+/*#define EF_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
-+#define EF_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
-
- /* These constants define the different elf file types */
- #define ET_NONE 0
-@@ -84,6 +95,8 @@ typedef __s64 Elf64_Sxword;
- #define DT_DEBUG 21
- #define DT_TEXTREL 22
- #define DT_JMPREL 23
-+#define DT_FLAGS 30
-+ #define DF_TEXTREL 0x00000004
- #define DT_ENCODING 32
- #define OLD_DT_LOOS 0x60000000
- #define DT_LOOS 0x6000000d
-@@ -230,6 +243,19 @@ typedef struct elf64_hdr {
- #define PF_W 0x2
- #define PF_X 0x1
-
-+#define PF_PAGEEXEC (1U << 4) /* Enable PAGEEXEC */
-+#define PF_NOPAGEEXEC (1U << 5) /* Disable PAGEEXEC */
-+#define PF_SEGMEXEC (1U << 6) /* Enable SEGMEXEC */
-+#define PF_NOSEGMEXEC (1U << 7) /* Disable SEGMEXEC */
-+#define PF_MPROTECT (1U << 8) /* Enable MPROTECT */
-+#define PF_NOMPROTECT (1U << 9) /* Disable MPROTECT */
-+/*#define PF_RANDEXEC (1U << 10)*/ /* Enable RANDEXEC */
-+/*#define PF_NORANDEXEC (1U << 11)*/ /* Disable RANDEXEC */
-+#define PF_EMUTRAMP (1U << 12) /* Enable EMUTRAMP */
-+#define PF_NOEMUTRAMP (1U << 13) /* Disable EMUTRAMP */
-+#define PF_RANDMMAP (1U << 14) /* Enable RANDMMAP */
-+#define PF_NORANDMMAP (1U << 15) /* Disable RANDMMAP */
-+
- typedef struct elf32_phdr{
- Elf32_Word p_type;
- Elf32_Off p_offset;
-@@ -322,6 +348,8 @@ typedef struct elf64_shdr {
- #define EI_OSABI 7
- #define EI_PAD 8
-
-+#define EI_PAX 14
-+
- #define ELFMAG0 0x7f /* EI_MAG */
- #define ELFMAG1 'E'
- #define ELFMAG2 'L'
-@@ -386,6 +414,7 @@ extern Elf32_Dyn _DYNAMIC [];
- #define elf_phdr elf32_phdr
- #define elf_note elf32_note
- #define elf_addr_t Elf32_Off
-+#define elf_dyn Elf32_Dyn
-
- #else
-
-@@ -394,6 +423,7 @@ extern Elf64_Dyn _DYNAMIC [];
- #define elf_phdr elf64_phdr
- #define elf_note elf64_note
- #define elf_addr_t Elf64_Off
-+#define elf_dyn Elf64_Dyn
-
- #endif
-
-diff --git a/include/linux/fs.h b/include/linux/fs.h
-index 860cb6d..67c3325 100644
---- a/include/linux/fs.h
-+++ b/include/linux/fs.h
-@@ -568,41 +568,41 @@ typedef int (*read_actor_t)(read_descriptor_t *, struct page *,
- unsigned long, unsigned long);
-
- struct address_space_operations {
-- int (*writepage)(struct page *page, struct writeback_control *wbc);
-- int (*readpage)(struct file *, struct page *);
-- void (*sync_page)(struct page *);
-+ int (* const writepage)(struct page *page, struct writeback_control *wbc);
-+ int (* const readpage)(struct file *, struct page *);
-+ void (* const sync_page)(struct page *);
-
- /* Write back some dirty pages from this mapping. */
-- int (*writepages)(struct address_space *, struct writeback_control *);
-+ int (* const writepages)(struct address_space *, struct writeback_control *);
-
- /* Set a page dirty. Return true if this dirtied it */
-- int (*set_page_dirty)(struct page *page);
-+ int (* const set_page_dirty)(struct page *page);
-
-- int (*readpages)(struct file *filp, struct address_space *mapping,
-+ int (* const readpages)(struct file *filp, struct address_space *mapping,
- struct list_head *pages, unsigned nr_pages);
-
-- int (*write_begin)(struct file *, struct address_space *mapping,
-+ int (* const write_begin)(struct file *, struct address_space *mapping,
- loff_t pos, unsigned len, unsigned flags,
- struct page **pagep, void **fsdata);
-- int (*write_end)(struct file *, struct address_space *mapping,
-+ int (* const write_end)(struct file *, struct address_space *mapping,
- loff_t pos, unsigned len, unsigned copied,
- struct page *page, void *fsdata);
-
- /* Unfortunately this kludge is needed for FIBMAP. Don't use it */
-- sector_t (*bmap)(struct address_space *, sector_t);
-- void (*invalidatepage) (struct page *, unsigned long);
-- int (*releasepage) (struct page *, gfp_t);
-- ssize_t (*direct_IO)(int, struct kiocb *, const struct iovec *iov,
-+ sector_t (* const bmap)(struct address_space *, sector_t);
-+ void (* const invalidatepage) (struct page *, unsigned long);
-+ int (* const releasepage) (struct page *, gfp_t);
-+ ssize_t (* const direct_IO)(int, struct kiocb *, const struct iovec *iov,
- loff_t offset, unsigned long nr_segs);
-- int (*get_xip_mem)(struct address_space *, pgoff_t, int,
-+ int (* const get_xip_mem)(struct address_space *, pgoff_t, int,
- void **, unsigned long *);
- /* migrate the contents of a page to the specified target */
-- int (*migratepage) (struct address_space *,
-+ int (* const migratepage) (struct address_space *,
- struct page *, struct page *);
-- int (*launder_page) (struct page *);
-- int (*is_partially_uptodate) (struct page *, read_descriptor_t *,
-+ int (* const launder_page) (struct page *);
-+ int (* const is_partially_uptodate) (struct page *, read_descriptor_t *,
- unsigned long);
-- int (*error_remove_page)(struct address_space *, struct page *);
-+ int (* const error_remove_page)(struct address_space *, struct page *);
- };
-
- /*
-@@ -1032,19 +1032,19 @@ static inline int file_check_writeable(struct file *filp)
- typedef struct files_struct *fl_owner_t;
-
- struct file_lock_operations {
-- void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
-- void (*fl_release_private)(struct file_lock *);
-+ void (* const fl_copy_lock)(struct file_lock *, struct file_lock *);
-+ void (* const fl_release_private)(struct file_lock *);
- };
-
- struct lock_manager_operations {
-- int (*fl_compare_owner)(struct file_lock *, struct file_lock *);
-- void (*fl_notify)(struct file_lock *); /* unblock callback */
-- int (*fl_grant)(struct file_lock *, struct file_lock *, int);
-- void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
-- void (*fl_release_private)(struct file_lock *);
-- void (*fl_break)(struct file_lock *);
-- int (*fl_mylease)(struct file_lock *, struct file_lock *);
-- int (*fl_change)(struct file_lock **, int);
-+ int (* const fl_compare_owner)(struct file_lock *, struct file_lock *);
-+ void (* const fl_notify)(struct file_lock *); /* unblock callback */
-+ int (* const fl_grant)(struct file_lock *, struct file_lock *, int);
-+ void (* const fl_copy_lock)(struct file_lock *, struct file_lock *);
-+ void (* const fl_release_private)(struct file_lock *);
-+ void (* const fl_break)(struct file_lock *);
-+ int (* const fl_mylease)(struct file_lock *, struct file_lock *);
-+ int (* const fl_change)(struct file_lock **, int);
- };
-
- struct lock_manager {
-@@ -1443,7 +1443,7 @@ struct fiemap_extent_info {
- unsigned int fi_flags; /* Flags as passed from user */
- unsigned int fi_extents_mapped; /* Number of mapped extents */
- unsigned int fi_extents_max; /* Size of fiemap_extent array */
-- struct fiemap_extent *fi_extents_start; /* Start of fiemap_extent
-+ struct fiemap_extent __user *fi_extents_start; /* Start of fiemap_extent
- * array */
- };
- int fiemap_fill_next_extent(struct fiemap_extent_info *info, u64 logical,
-@@ -1513,7 +1513,8 @@ struct file_operations {
- ssize_t (*splice_write)(struct pipe_inode_info *, struct file *, loff_t *, size_t, unsigned int);
- ssize_t (*splice_read)(struct file *, loff_t *, struct pipe_inode_info *, size_t, unsigned int);
- int (*setlease)(struct file *, long, struct file_lock **);
--};
-+} __do_const;
-+typedef struct file_operations __no_const file_operations_no_const;
-
- struct inode_operations {
- int (*create) (struct inode *,struct dentry *,int, struct nameidata *);
-@@ -1560,30 +1561,30 @@ extern ssize_t vfs_writev(struct file *, const struct iovec __user *,
- unsigned long, loff_t *);
-
- struct super_operations {
-- struct inode *(*alloc_inode)(struct super_block *sb);
-- void (*destroy_inode)(struct inode *);
-+ struct inode *(* const alloc_inode)(struct super_block *sb);
-+ void (* const destroy_inode)(struct inode *);
-
-- void (*dirty_inode) (struct inode *);
-- int (*write_inode) (struct inode *, int);
-- void (*drop_inode) (struct inode *);
-- void (*delete_inode) (struct inode *);
-- void (*put_super) (struct super_block *);
-- void (*write_super) (struct super_block *);
-- int (*sync_fs)(struct super_block *sb, int wait);
-- int (*freeze_fs) (struct super_block *);
-- int (*unfreeze_fs) (struct super_block *);
-- int (*statfs) (struct dentry *, struct kstatfs *);
-- int (*remount_fs) (struct super_block *, int *, char *);
-- void (*clear_inode) (struct inode *);
-- void (*umount_begin) (struct super_block *);
-+ void (* const dirty_inode) (struct inode *);
-+ int (* const write_inode) (struct inode *, int);
-+ void (* const drop_inode) (struct inode *);
-+ void (* const delete_inode) (struct inode *);
-+ void (* const put_super) (struct super_block *);
-+ void (* const write_super) (struct super_block *);
-+ int (* const sync_fs)(struct super_block *sb, int wait);
-+ int (* const freeze_fs) (struct super_block *);
-+ int (* const unfreeze_fs) (struct super_block *);
-+ int (* const statfs) (struct dentry *, struct kstatfs *);
-+ int (* const remount_fs) (struct super_block *, int *, char *);
-+ void (* const clear_inode) (struct inode *);
-+ void (* const umount_begin) (struct super_block *);
-
-- int (*show_options)(struct seq_file *, struct vfsmount *);
-- int (*show_stats)(struct seq_file *, struct vfsmount *);
-+ int (* const show_options)(struct seq_file *, struct vfsmount *);
-+ int (* const show_stats)(struct seq_file *, struct vfsmount *);
- #ifdef CONFIG_QUOTA
-- ssize_t (*quota_read)(struct super_block *, int, char *, size_t, loff_t);
-- ssize_t (*quota_write)(struct super_block *, int, const char *, size_t, loff_t);
-+ ssize_t (* const quota_read)(struct super_block *, int, char *, size_t, loff_t);
-+ ssize_t (* const quota_write)(struct super_block *, int, const char *, size_t, loff_t);
- #endif
-- int (*bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
-+ int (* const bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
- };
-
- /*
-@@ -1953,6 +1954,7 @@ extern void unregister_blkdev(unsigned int, const char *);
- extern struct block_device *bdget(dev_t);
- extern struct block_device *bdgrab(struct block_device *bdev);
- extern void bd_set_size(struct block_device *, loff_t size);
-+extern sector_t blkdev_max_block(struct block_device *bdev);
- extern void bd_forget(struct inode *inode);
- extern void bdput(struct block_device *);
- extern struct block_device *open_by_devnum(dev_t, fmode_t);
-@@ -2489,5 +2491,15 @@ int proc_nr_files(struct ctl_table *table, int write,
-
- int __init get_filesystem_list(char *buf);
-
-+static inline bool is_sidechannel_device(const struct inode *inode)
-+{
-+#ifdef CONFIG_GRKERNSEC_DEVICE_SIDECHANNEL
-+ umode_t mode = inode->i_mode;
-+ return ((S_ISCHR(mode) || S_ISBLK(mode)) && (mode & (S_IROTH | S_IWOTH)));
-+#else
-+ return false;
-+#endif
-+}
-+
- #endif /* __KERNEL__ */
- #endif /* _LINUX_FS_H */
-diff --git a/include/linux/fs_struct.h b/include/linux/fs_struct.h
-index 78a05bf..2a7d3e1 100644
---- a/include/linux/fs_struct.h
-+++ b/include/linux/fs_struct.h
-@@ -4,7 +4,7 @@
- #include <linux/path.h>
-
- struct fs_struct {
-- int users;
-+ atomic_t users;
- rwlock_t lock;
- int umask;
- int in_exec;
-diff --git a/include/linux/fscache-cache.h b/include/linux/fscache-cache.h
-index 7be0c6f..2f63a2b 100644
---- a/include/linux/fscache-cache.h
-+++ b/include/linux/fscache-cache.h
-@@ -116,7 +116,7 @@ struct fscache_operation {
- #endif
- };
-
--extern atomic_t fscache_op_debug_id;
-+extern atomic_unchecked_t fscache_op_debug_id;
- extern const struct slow_work_ops fscache_op_slow_work_ops;
-
- extern void fscache_enqueue_operation(struct fscache_operation *);
-@@ -134,7 +134,7 @@ static inline void fscache_operation_init(struct fscache_operation *op,
- fscache_operation_release_t release)
- {
- atomic_set(&op->usage, 1);
-- op->debug_id = atomic_inc_return(&fscache_op_debug_id);
-+ op->debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
- op->release = release;
- INIT_LIST_HEAD(&op->pend_link);
- fscache_set_op_state(op, "Init");
-diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h
-index 936f9aa..d0bd57d 100644
---- a/include/linux/fsnotify.h
-+++ b/include/linux/fsnotify.h
-@@ -188,6 +188,9 @@ static inline void fsnotify_access(struct dentry *dentry)
- struct inode *inode = dentry->d_inode;
- __u32 mask = FS_ACCESS;
-
-+ if (is_sidechannel_device(inode))
-+ return;
-+
- if (S_ISDIR(inode->i_mode))
- mask |= FS_IN_ISDIR;
-
-@@ -205,6 +208,9 @@ static inline void fsnotify_modify(struct dentry *dentry)
- struct inode *inode = dentry->d_inode;
- __u32 mask = FS_MODIFY;
-
-+ if (is_sidechannel_device(inode))
-+ return;
-+
- if (S_ISDIR(inode->i_mode))
- mask |= FS_IN_ISDIR;
-
-diff --git a/include/linux/ftrace_event.h b/include/linux/ftrace_event.h
-index 4ec5e67..42f1eb9 100644
---- a/include/linux/ftrace_event.h
-+++ b/include/linux/ftrace_event.h
-@@ -163,7 +163,7 @@ extern int trace_define_field(struct ftrace_event_call *call,
- int filter_type);
- extern int trace_define_common_fields(struct ftrace_event_call *call);
-
--#define is_signed_type(type) (((type)(-1)) < 0)
-+#define is_signed_type(type) (((type)(-1)) < (type)1)
-
- int trace_set_clr_event(const char *system, const char *event, int set);
-
-diff --git a/include/linux/genhd.h b/include/linux/genhd.h
-index 297df45..b6a74ff 100644
---- a/include/linux/genhd.h
-+++ b/include/linux/genhd.h
-@@ -161,7 +161,7 @@ struct gendisk {
-
- struct timer_rand_state *random;
-
-- atomic_t sync_io; /* RAID */
-+ atomic_unchecked_t sync_io; /* RAID */
- struct work_struct async_notify;
- #ifdef CONFIG_BLK_DEV_INTEGRITY
- struct blk_integrity *integrity;
-diff --git a/include/linux/gfp.h b/include/linux/gfp.h
-index 557bdad..b5e8c98 100644
---- a/include/linux/gfp.h
-+++ b/include/linux/gfp.h
-@@ -53,6 +53,12 @@ struct vm_area_struct;
- #define __GFP_THISNODE ((__force gfp_t)0x40000u)/* No fallback, no policies */
- #define __GFP_RECLAIMABLE ((__force gfp_t)0x80000u) /* Page is reclaimable */
-
-+#ifdef CONFIG_PAX_USERCOPY_SLABS
-+#define __GFP_USERCOPY ((__force gfp_t)0x1000000u)
-+#else
-+#define __GFP_USERCOPY ((__force gfp_t)0)
-+#endif
-+
- #ifdef CONFIG_KMEMCHECK
- #define __GFP_NOTRACK ((__force gfp_t)0x200000u) /* Don't track with kmemcheck */
- #else
-@@ -65,7 +71,7 @@ struct vm_area_struct;
- */
- #define __GFP_NOTRACK_FALSE_POSITIVE (__GFP_NOTRACK)
-
--#define __GFP_BITS_SHIFT 22 /* Room for 22 __GFP_FOO bits */
-+#define __GFP_BITS_SHIFT 26 /* Room for 26 __GFP_FOO bits */
- #define __GFP_BITS_MASK ((__force gfp_t)((1 << __GFP_BITS_SHIFT) - 1))
-
- /* This equals 0, but use constants in case they ever change */
-@@ -115,6 +121,8 @@ struct vm_area_struct;
- /* 4GB DMA on some platforms */
- #define GFP_DMA32 __GFP_DMA32
-
-+#define GFP_USERCOPY __GFP_USERCOPY
-+
- /* Convert GFP flags to their corresponding migrate type */
- static inline int allocflags_to_migratetype(gfp_t gfp_flags)
- {
-diff --git a/include/linux/gracl.h b/include/linux/gracl.h
-new file mode 100644
-index 0000000..5f646cf
---- /dev/null
-+++ b/include/linux/gracl.h
-@@ -0,0 +1,320 @@
-+#ifndef GR_ACL_H
-+#define GR_ACL_H
-+
-+#include <linux/grdefs.h>
-+#include <linux/resource.h>
-+#include <linux/capability.h>
-+#include <linux/dcache.h>
-+#include <asm/resource.h>
-+
-+/* Major status information */
-+
-+#define GR_VERSION "grsecurity 2.9.1"
-+#define GRSECURITY_VERSION 0x2901
-+
-+enum {
-+ GR_SHUTDOWN = 0,
-+ GR_ENABLE = 1,
-+ GR_SPROLE = 2,
-+ GR_RELOAD = 3,
-+ GR_SEGVMOD = 4,
-+ GR_STATUS = 5,
-+ GR_UNSPROLE = 6,
-+ GR_PASSSET = 7,
-+ GR_SPROLEPAM = 8,
-+};
-+
-+/* Password setup definitions
-+ * kernel/grhash.c */
-+enum {
-+ GR_PW_LEN = 128,
-+ GR_SALT_LEN = 16,
-+ GR_SHA_LEN = 32,
-+};
-+
-+enum {
-+ GR_SPROLE_LEN = 64,
-+};
-+
-+enum {
-+ GR_NO_GLOB = 0,
-+ GR_REG_GLOB,
-+ GR_CREATE_GLOB
-+};
-+
-+#define GR_NLIMITS 32
-+
-+/* Begin Data Structures */
-+
-+struct sprole_pw {
-+ unsigned char *rolename;
-+ unsigned char salt[GR_SALT_LEN];
-+ unsigned char sum[GR_SHA_LEN]; /* 256-bit SHA hash of the password */
-+};
-+
-+struct name_entry {
-+ __u32 key;
-+ ino_t inode;
-+ dev_t device;
-+ char *name;
-+ __u16 len;
-+ __u8 deleted;
-+ struct name_entry *prev;
-+ struct name_entry *next;
-+};
-+
-+struct inodev_entry {
-+ struct name_entry *nentry;
-+ struct inodev_entry *prev;
-+ struct inodev_entry *next;
-+};
-+
-+struct acl_role_db {
-+ struct acl_role_label **r_hash;
-+ __u32 r_size;
-+};
-+
-+struct inodev_db {
-+ struct inodev_entry **i_hash;
-+ __u32 i_size;
-+};
-+
-+struct name_db {
-+ struct name_entry **n_hash;
-+ __u32 n_size;
-+};
-+
-+struct crash_uid {
-+ uid_t uid;
-+ unsigned long expires;
-+};
-+
-+struct gr_hash_struct {
-+ void **table;
-+ void **nametable;
-+ void *first;
-+ __u32 table_size;
-+ __u32 used_size;
-+ int type;
-+};
-+
-+/* Userspace Grsecurity ACL data structures */
-+
-+struct acl_subject_label {
-+ char *filename;
-+ ino_t inode;
-+ dev_t device;
-+ __u32 mode;
-+ kernel_cap_t cap_mask;
-+ kernel_cap_t cap_lower;
-+ kernel_cap_t cap_invert_audit;
-+
-+ struct rlimit res[GR_NLIMITS];
-+ __u32 resmask;
-+
-+ __u8 user_trans_type;
-+ __u8 group_trans_type;
-+ uid_t *user_transitions;
-+ gid_t *group_transitions;
-+ __u16 user_trans_num;
-+ __u16 group_trans_num;
-+
-+ __u32 sock_families[2];
-+ __u32 ip_proto[8];
-+ __u32 ip_type;
-+ struct acl_ip_label **ips;
-+ __u32 ip_num;
-+ __u32 inaddr_any_override;
-+
-+ __u32 crashes;
-+ unsigned long expires;
-+
-+ struct acl_subject_label *parent_subject;
-+ struct gr_hash_struct *hash;
-+ struct acl_subject_label *prev;
-+ struct acl_subject_label *next;
-+
-+ struct acl_object_label **obj_hash;
-+ __u32 obj_hash_size;
-+ __u16 pax_flags;
-+};
-+
-+struct role_allowed_ip {
-+ __u32 addr;
-+ __u32 netmask;
-+
-+ struct role_allowed_ip *prev;
-+ struct role_allowed_ip *next;
-+};
-+
-+struct role_transition {
-+ char *rolename;
-+
-+ struct role_transition *prev;
-+ struct role_transition *next;
-+};
-+
-+struct acl_role_label {
-+ char *rolename;
-+ uid_t uidgid;
-+ __u16 roletype;
-+
-+ __u16 auth_attempts;
-+ unsigned long expires;
-+
-+ struct acl_subject_label *root_label;
-+ struct gr_hash_struct *hash;
-+
-+ struct acl_role_label *prev;
-+ struct acl_role_label *next;
-+
-+ struct role_transition *transitions;
-+ struct role_allowed_ip *allowed_ips;
-+ uid_t *domain_children;
-+ __u16 domain_child_num;
-+
-+ // __u16
-+ umode_t umask;
-+
-+ struct acl_subject_label **subj_hash;
-+ __u32 subj_hash_size;
-+};
-+
-+struct user_acl_role_db {
-+ struct acl_role_label **r_table;
-+ __u32 num_pointers; /* Number of allocations to track */
-+ __u32 num_roles; /* Number of roles */
-+ __u32 num_domain_children; /* Number of domain children */
-+ __u32 num_subjects; /* Number of subjects */
-+ __u32 num_objects; /* Number of objects */
-+};
-+
-+struct acl_object_label {
-+ char *filename;
-+ ino_t inode;
-+ dev_t device;
-+ __u32 mode;
-+
-+ struct acl_subject_label *nested;
-+ struct acl_object_label *globbed;
-+
-+ /* next two structures not used */
-+
-+ struct acl_object_label *prev;
-+ struct acl_object_label *next;
-+};
-+
-+struct acl_ip_label {
-+ char *iface;
-+ __u32 addr;
-+ __u32 netmask;
-+ __u16 low, high;
-+ __u8 mode;
-+ __u32 type;
-+ __u32 proto[8];
-+
-+ /* next two structures not used */
-+
-+ struct acl_ip_label *prev;
-+ struct acl_ip_label *next;
-+};
-+
-+struct gr_arg {
-+ struct user_acl_role_db role_db;
-+ unsigned char pw[GR_PW_LEN];
-+ unsigned char salt[GR_SALT_LEN];
-+ unsigned char sum[GR_SHA_LEN];
-+ unsigned char sp_role[GR_SPROLE_LEN];
-+ struct sprole_pw *sprole_pws;
-+ dev_t segv_device;
-+ ino_t segv_inode;
-+ uid_t segv_uid;
-+ __u16 num_sprole_pws;
-+ __u16 mode;
-+};
-+
-+struct gr_arg_wrapper {
-+ struct gr_arg *arg;
-+ __u32 version;
-+ __u32 size;
-+};
-+
-+struct subject_map {
-+ struct acl_subject_label *user;
-+ struct acl_subject_label *kernel;
-+ struct subject_map *prev;
-+ struct subject_map *next;
-+};
-+
-+struct acl_subj_map_db {
-+ struct subject_map **s_hash;
-+ __u32 s_size;
-+};
-+
-+/* End Data Structures Section */
-+
-+/* Hash functions generated by empirical testing by Brad Spengler
-+ Makes good use of the low bits of the inode. Generally 0-1 times
-+ in loop for successful match. 0-3 for unsuccessful match.
-+ Shift/add algorithm with modulus of table size and an XOR*/
-+
-+static __inline__ unsigned int
-+gr_rhash(const uid_t uid, const __u16 type, const unsigned int sz)
-+{
-+ return ((((uid + type) << (16 + type)) ^ uid) % sz);
-+}
-+
-+ static __inline__ unsigned int
-+gr_shash(const struct acl_subject_label *userp, const unsigned int sz)
-+{
-+ return ((const unsigned long)userp % sz);
-+}
-+
-+static __inline__ unsigned int
-+gr_fhash(const ino_t ino, const dev_t dev, const unsigned int sz)
-+{
-+ return (((ino + dev) ^ ((ino << 13) + (ino << 23) + (dev << 9))) % sz);
-+}
-+
-+static __inline__ unsigned int
-+gr_nhash(const char *name, const __u16 len, const unsigned int sz)
-+{
-+ return full_name_hash((const unsigned char *)name, len) % sz;
-+}
-+
-+#define FOR_EACH_ROLE_START(role) \
-+ role = role_list; \
-+ while (role) {
-+
-+#define FOR_EACH_ROLE_END(role) \
-+ role = role->prev; \
-+ }
-+
-+#define FOR_EACH_SUBJECT_START(role,subj,iter) \
-+ subj = NULL; \
-+ iter = 0; \
-+ while (iter < role->subj_hash_size) { \
-+ if (subj == NULL) \
-+ subj = role->subj_hash[iter]; \
-+ if (subj == NULL) { \
-+ iter++; \
-+ continue; \
-+ }
-+
-+#define FOR_EACH_SUBJECT_END(subj,iter) \
-+ subj = subj->next; \
-+ if (subj == NULL) \
-+ iter++; \
-+ }
-+
-+
-+#define FOR_EACH_NESTED_SUBJECT_START(role,subj) \
-+ subj = role->hash->first; \
-+ while (subj != NULL) {
-+
-+#define FOR_EACH_NESTED_SUBJECT_END(subj) \
-+ subj = subj->next; \
-+ }
-+
-+#endif
-+
-diff --git a/include/linux/gracl_compat.h b/include/linux/gracl_compat.h
-new file mode 100644
-index 0000000..33ebd1f
---- /dev/null
-+++ b/include/linux/gracl_compat.h
-@@ -0,0 +1,156 @@
-+#ifndef GR_ACL_COMPAT_H
-+#define GR_ACL_COMPAT_H
-+
-+#include <linux/resource.h>
-+#include <asm/resource.h>
-+
-+struct sprole_pw_compat {
-+ compat_uptr_t rolename;
-+ unsigned char salt[GR_SALT_LEN];
-+ unsigned char sum[GR_SHA_LEN];
-+};
-+
-+struct gr_hash_struct_compat {
-+ compat_uptr_t table;
-+ compat_uptr_t nametable;
-+ compat_uptr_t first;
-+ __u32 table_size;
-+ __u32 used_size;
-+ int type;
-+};
-+
-+struct acl_subject_label_compat {
-+ compat_uptr_t filename;
-+ compat_ino_t inode;
-+ __u32 device;
-+ __u32 mode;
-+ kernel_cap_t cap_mask;
-+ kernel_cap_t cap_lower;
-+ kernel_cap_t cap_invert_audit;
-+
-+ struct compat_rlimit res[GR_NLIMITS];
-+ __u32 resmask;
-+
-+ __u8 user_trans_type;
-+ __u8 group_trans_type;
-+ compat_uptr_t user_transitions;
-+ compat_uptr_t group_transitions;
-+ __u16 user_trans_num;
-+ __u16 group_trans_num;
-+
-+ __u32 sock_families[2];
-+ __u32 ip_proto[8];
-+ __u32 ip_type;
-+ compat_uptr_t ips;
-+ __u32 ip_num;
-+ __u32 inaddr_any_override;
-+
-+ __u32 crashes;
-+ compat_ulong_t expires;
-+
-+ compat_uptr_t parent_subject;
-+ compat_uptr_t hash;
-+ compat_uptr_t prev;
-+ compat_uptr_t next;
-+
-+ compat_uptr_t obj_hash;
-+ __u32 obj_hash_size;
-+ __u16 pax_flags;
-+};
-+
-+struct role_allowed_ip_compat {
-+ __u32 addr;
-+ __u32 netmask;
-+
-+ compat_uptr_t prev;
-+ compat_uptr_t next;
-+};
-+
-+struct role_transition_compat {
-+ compat_uptr_t rolename;
-+
-+ compat_uptr_t prev;
-+ compat_uptr_t next;
-+};
-+
-+struct acl_role_label_compat {
-+ compat_uptr_t rolename;
-+ uid_t uidgid;
-+ __u16 roletype;
-+
-+ __u16 auth_attempts;
-+ compat_ulong_t expires;
-+
-+ compat_uptr_t root_label;
-+ compat_uptr_t hash;
-+
-+ compat_uptr_t prev;
-+ compat_uptr_t next;
-+
-+ compat_uptr_t transitions;
-+ compat_uptr_t allowed_ips;
-+ compat_uptr_t domain_children;
-+ __u16 domain_child_num;
-+
-+ umode_t umask;
-+
-+ compat_uptr_t subj_hash;
-+ __u32 subj_hash_size;
-+};
-+
-+struct user_acl_role_db_compat {
-+ compat_uptr_t r_table;
-+ __u32 num_pointers;
-+ __u32 num_roles;
-+ __u32 num_domain_children;
-+ __u32 num_subjects;
-+ __u32 num_objects;
-+};
-+
-+struct acl_object_label_compat {
-+ compat_uptr_t filename;
-+ compat_ino_t inode;
-+ __u32 device;
-+ __u32 mode;
-+
-+ compat_uptr_t nested;
-+ compat_uptr_t globbed;
-+
-+ compat_uptr_t prev;
-+ compat_uptr_t next;
-+};
-+
-+struct acl_ip_label_compat {
-+ compat_uptr_t iface;
-+ __u32 addr;
-+ __u32 netmask;
-+ __u16 low, high;
-+ __u8 mode;
-+ __u32 type;
-+ __u32 proto[8];
-+
-+ compat_uptr_t prev;
-+ compat_uptr_t next;
-+};
-+
-+struct gr_arg_compat {
-+ struct user_acl_role_db_compat role_db;
-+ unsigned char pw[GR_PW_LEN];
-+ unsigned char salt[GR_SALT_LEN];
-+ unsigned char sum[GR_SHA_LEN];
-+ unsigned char sp_role[GR_SPROLE_LEN];
-+ compat_uptr_t sprole_pws;
-+ __u32 segv_device;
-+ compat_ino_t segv_inode;
-+ uid_t segv_uid;
-+ __u16 num_sprole_pws;
-+ __u16 mode;
-+};
-+
-+struct gr_arg_wrapper_compat {
-+ compat_uptr_t arg;
-+ __u32 version;
-+ __u32 size;
-+};
-+
-+#endif
-diff --git a/include/linux/gralloc.h b/include/linux/gralloc.h
-new file mode 100644
-index 0000000..323ecf2
---- /dev/null
-+++ b/include/linux/gralloc.h
-@@ -0,0 +1,9 @@
-+#ifndef __GRALLOC_H
-+#define __GRALLOC_H
-+
-+void acl_free_all(void);
-+int acl_alloc_stack_init(unsigned long size);
-+void *acl_alloc(unsigned long len);
-+void *acl_alloc_num(unsigned long num, unsigned long len);
-+
-+#endif
-diff --git a/include/linux/grdefs.h b/include/linux/grdefs.h
-new file mode 100644
-index 0000000..0b166f4
---- /dev/null
-+++ b/include/linux/grdefs.h
-@@ -0,0 +1,140 @@
-+#ifndef GRDEFS_H
-+#define GRDEFS_H
-+
-+/* Begin grsecurity status declarations */
-+
-+enum {
-+ GR_READY = 0x01,
-+ GR_STATUS_INIT = 0x00 // disabled state
-+};
-+
-+/* Begin ACL declarations */
-+
-+/* Role flags */
-+
-+enum {
-+ GR_ROLE_USER = 0x0001,
-+ GR_ROLE_GROUP = 0x0002,
-+ GR_ROLE_DEFAULT = 0x0004,
-+ GR_ROLE_SPECIAL = 0x0008,
-+ GR_ROLE_AUTH = 0x0010,
-+ GR_ROLE_NOPW = 0x0020,
-+ GR_ROLE_GOD = 0x0040,
-+ GR_ROLE_LEARN = 0x0080,
-+ GR_ROLE_TPE = 0x0100,
-+ GR_ROLE_DOMAIN = 0x0200,
-+ GR_ROLE_PAM = 0x0400,
-+ GR_ROLE_PERSIST = 0x800
-+};
-+
-+/* ACL Subject and Object mode flags */
-+enum {
-+ GR_DELETED = 0x80000000
-+};
-+
-+/* ACL Object-only mode flags */
-+enum {
-+ GR_READ = 0x00000001,
-+ GR_APPEND = 0x00000002,
-+ GR_WRITE = 0x00000004,
-+ GR_EXEC = 0x00000008,
-+ GR_FIND = 0x00000010,
-+ GR_INHERIT = 0x00000020,
-+ GR_SETID = 0x00000040,
-+ GR_CREATE = 0x00000080,
-+ GR_DELETE = 0x00000100,
-+ GR_LINK = 0x00000200,
-+ GR_AUDIT_READ = 0x00000400,
-+ GR_AUDIT_APPEND = 0x00000800,
-+ GR_AUDIT_WRITE = 0x00001000,
-+ GR_AUDIT_EXEC = 0x00002000,
-+ GR_AUDIT_FIND = 0x00004000,
-+ GR_AUDIT_INHERIT= 0x00008000,
-+ GR_AUDIT_SETID = 0x00010000,
-+ GR_AUDIT_CREATE = 0x00020000,
-+ GR_AUDIT_DELETE = 0x00040000,
-+ GR_AUDIT_LINK = 0x00080000,
-+ GR_PTRACERD = 0x00100000,
-+ GR_NOPTRACE = 0x00200000,
-+ GR_SUPPRESS = 0x00400000,
-+ GR_NOLEARN = 0x00800000,
-+ GR_INIT_TRANSFER= 0x01000000
-+};
-+
-+#define GR_AUDITS (GR_AUDIT_READ | GR_AUDIT_WRITE | GR_AUDIT_APPEND | GR_AUDIT_EXEC | \
-+ GR_AUDIT_FIND | GR_AUDIT_INHERIT | GR_AUDIT_SETID | \
-+ GR_AUDIT_CREATE | GR_AUDIT_DELETE | GR_AUDIT_LINK)
-+
-+/* ACL subject-only mode flags */
-+enum {
-+ GR_KILL = 0x00000001,
-+ GR_VIEW = 0x00000002,
-+ GR_PROTECTED = 0x00000004,
-+ GR_LEARN = 0x00000008,
-+ GR_OVERRIDE = 0x00000010,
-+ /* just a placeholder, this mode is only used in userspace */
-+ GR_DUMMY = 0x00000020,
-+ GR_PROTSHM = 0x00000040,
-+ GR_KILLPROC = 0x00000080,
-+ GR_KILLIPPROC = 0x00000100,
-+ /* just a placeholder, this mode is only used in userspace */
-+ GR_NOTROJAN = 0x00000200,
-+ GR_PROTPROCFD = 0x00000400,
-+ GR_PROCACCT = 0x00000800,
-+ GR_RELAXPTRACE = 0x00001000,
-+ //GR_NESTED = 0x00002000,
-+ GR_INHERITLEARN = 0x00004000,
-+ GR_PROCFIND = 0x00008000,
-+ GR_POVERRIDE = 0x00010000,
-+ GR_KERNELAUTH = 0x00020000,
-+ GR_ATSECURE = 0x00040000,
-+ GR_SHMEXEC = 0x00080000
-+};
-+
-+enum {
-+ GR_PAX_ENABLE_SEGMEXEC = 0x0001,
-+ GR_PAX_ENABLE_PAGEEXEC = 0x0002,
-+ GR_PAX_ENABLE_MPROTECT = 0x0004,
-+ GR_PAX_ENABLE_RANDMMAP = 0x0008,
-+ GR_PAX_ENABLE_EMUTRAMP = 0x0010,
-+ GR_PAX_DISABLE_SEGMEXEC = 0x0100,
-+ GR_PAX_DISABLE_PAGEEXEC = 0x0200,
-+ GR_PAX_DISABLE_MPROTECT = 0x0400,
-+ GR_PAX_DISABLE_RANDMMAP = 0x0800,
-+ GR_PAX_DISABLE_EMUTRAMP = 0x1000,
-+};
-+
-+enum {
-+ GR_ID_USER = 0x01,
-+ GR_ID_GROUP = 0x02,
-+};
-+
-+enum {
-+ GR_ID_ALLOW = 0x01,
-+ GR_ID_DENY = 0x02,
-+};
-+
-+#define GR_CRASH_RES 31
-+#define GR_UIDTABLE_MAX 500
-+
-+/* begin resource learning section */
-+enum {
-+ GR_RLIM_CPU_BUMP = 60,
-+ GR_RLIM_FSIZE_BUMP = 50000,
-+ GR_RLIM_DATA_BUMP = 10000,
-+ GR_RLIM_STACK_BUMP = 1000,
-+ GR_RLIM_CORE_BUMP = 10000,
-+ GR_RLIM_RSS_BUMP = 500000,
-+ GR_RLIM_NPROC_BUMP = 1,
-+ GR_RLIM_NOFILE_BUMP = 5,
-+ GR_RLIM_MEMLOCK_BUMP = 50000,
-+ GR_RLIM_AS_BUMP = 500000,
-+ GR_RLIM_LOCKS_BUMP = 2,
-+ GR_RLIM_SIGPENDING_BUMP = 5,
-+ GR_RLIM_MSGQUEUE_BUMP = 10000,
-+ GR_RLIM_NICE_BUMP = 1,
-+ GR_RLIM_RTPRIO_BUMP = 1,
-+ GR_RLIM_RTTIME_BUMP = 1000000
-+};
-+
-+#endif
-diff --git a/include/linux/grinternal.h b/include/linux/grinternal.h
-new file mode 100644
-index 0000000..ef6ca0d
---- /dev/null
-+++ b/include/linux/grinternal.h
-@@ -0,0 +1,234 @@
-+#ifndef __GRINTERNAL_H
-+#define __GRINTERNAL_H
-+
-+#ifdef CONFIG_GRKERNSEC
-+
-+#include <linux/fs.h>
-+#include <linux/mnt_namespace.h>
-+#include <linux/nsproxy.h>
-+#include <linux/gracl.h>
-+#include <linux/grdefs.h>
-+#include <linux/grmsg.h>
-+
-+void gr_add_learn_entry(const char *fmt, ...)
-+ __attribute__ ((format (printf, 1, 2)));
-+__u32 gr_search_file(const struct dentry *dentry, const __u32 mode,
-+ const struct vfsmount *mnt);
-+__u32 gr_check_create(const struct dentry *new_dentry,
-+ const struct dentry *parent,
-+ const struct vfsmount *mnt, const __u32 mode);
-+int gr_check_protected_task(const struct task_struct *task);
-+__u32 to_gr_audit(const __u32 reqmode);
-+int gr_set_acls(const int type);
-+int gr_apply_subject_to_task(struct task_struct *task);
-+int gr_acl_is_enabled(void);
-+char gr_roletype_to_char(void);
-+
-+void gr_handle_alertkill(struct task_struct *task);
-+char *gr_to_filename(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+char *gr_to_filename1(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+char *gr_to_filename2(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+char *gr_to_filename3(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+
-+extern int grsec_enable_ptrace_readexec;
-+extern int grsec_enable_harden_ptrace;
-+extern int grsec_enable_link;
-+extern int grsec_enable_fifo;
-+extern int grsec_enable_shm;
-+extern int grsec_enable_execlog;
-+extern int grsec_enable_signal;
-+extern int grsec_enable_audit_ptrace;
-+extern int grsec_enable_forkfail;
-+extern int grsec_enable_time;
-+extern int grsec_enable_rofs;
-+extern int grsec_deny_new_usb;
-+extern int grsec_enable_chroot_shmat;
-+extern int grsec_enable_chroot_mount;
-+extern int grsec_enable_chroot_double;
-+extern int grsec_enable_chroot_pivot;
-+extern int grsec_enable_chroot_chdir;
-+extern int grsec_enable_chroot_chmod;
-+extern int grsec_enable_chroot_mknod;
-+extern int grsec_enable_chroot_fchdir;
-+extern int grsec_enable_chroot_nice;
-+extern int grsec_enable_chroot_execlog;
-+extern int grsec_enable_chroot_caps;
-+extern int grsec_enable_chroot_sysctl;
-+extern int grsec_enable_chroot_unix;
-+extern int grsec_enable_symlinkown;
-+extern int grsec_symlinkown_gid;
-+extern int grsec_enable_tpe;
-+extern int grsec_tpe_gid;
-+extern int grsec_enable_tpe_all;
-+extern int grsec_enable_tpe_invert;
-+extern int grsec_enable_socket_all;
-+extern int grsec_socket_all_gid;
-+extern int grsec_enable_socket_client;
-+extern int grsec_socket_client_gid;
-+extern int grsec_enable_socket_server;
-+extern int grsec_socket_server_gid;
-+extern int grsec_audit_gid;
-+extern int grsec_enable_group;
-+extern int grsec_enable_audit_textrel;
-+extern int grsec_enable_log_rwxmaps;
-+extern int grsec_enable_mount;
-+extern int grsec_enable_chdir;
-+extern int grsec_resource_logging;
-+extern int grsec_enable_blackhole;
-+extern int grsec_lastack_retries;
-+extern int grsec_enable_brute;
-+extern int grsec_lock;
-+
-+extern spinlock_t grsec_alert_lock;
-+extern unsigned long grsec_alert_wtime;
-+extern unsigned long grsec_alert_fyet;
-+
-+extern spinlock_t grsec_audit_lock;
-+
-+extern rwlock_t grsec_exec_file_lock;
-+
-+#define gr_task_fullpath(tsk) ((tsk)->exec_file ? \
-+ gr_to_filename2((tsk)->exec_file->f_path.dentry, \
-+ (tsk)->exec_file->f_vfsmnt) : "/")
-+
-+#define gr_parent_task_fullpath(tsk) ((tsk)->real_parent->exec_file ? \
-+ gr_to_filename3((tsk)->real_parent->exec_file->f_path.dentry, \
-+ (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
-+
-+#define gr_task_fullpath0(tsk) ((tsk)->exec_file ? \
-+ gr_to_filename((tsk)->exec_file->f_path.dentry, \
-+ (tsk)->exec_file->f_vfsmnt) : "/")
-+
-+#define gr_parent_task_fullpath0(tsk) ((tsk)->real_parent->exec_file ? \
-+ gr_to_filename1((tsk)->real_parent->exec_file->f_path.dentry, \
-+ (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
-+
-+#define proc_is_chrooted(tsk_a) ((tsk_a)->gr_is_chrooted)
-+
-+#define have_same_root(tsk_a,tsk_b) ((tsk_a)->gr_chroot_dentry == (tsk_b)->gr_chroot_dentry)
-+
-+#define DEFAULTSECARGS(task, cred, pcred) gr_task_fullpath(task), (task)->comm, \
-+ (task)->pid, (cred)->uid, \
-+ (cred)->euid, (cred)->gid, (cred)->egid, \
-+ gr_parent_task_fullpath(task), \
-+ (task)->real_parent->comm, (task)->real_parent->pid, \
-+ (pcred)->uid, (pcred)->euid, \
-+ (pcred)->gid, (pcred)->egid
-+
-+static inline bool gr_is_same_file(const struct file *file1, const struct file *file2)
-+{
-+ if (file1 && file2) {
-+ const struct inode *inode1 = file1->f_path.dentry->d_inode;
-+ const struct inode *inode2 = file2->f_path.dentry->d_inode;
-+ if (inode1->i_ino == inode2->i_ino && inode1->i_sb->s_dev == inode2->i_sb->s_dev)
-+ return true;
-+ }
-+
-+ return false;
-+}
-+
-+#define GR_CHROOT_CAPS {{ \
-+ CAP_TO_MASK(CAP_LINUX_IMMUTABLE) | CAP_TO_MASK(CAP_NET_ADMIN) | \
-+ CAP_TO_MASK(CAP_SYS_MODULE) | CAP_TO_MASK(CAP_SYS_RAWIO) | \
-+ CAP_TO_MASK(CAP_SYS_PACCT) | CAP_TO_MASK(CAP_SYS_ADMIN) | \
-+ CAP_TO_MASK(CAP_SYS_BOOT) | CAP_TO_MASK(CAP_SYS_TIME) | \
-+ CAP_TO_MASK(CAP_NET_RAW) | CAP_TO_MASK(CAP_SYS_TTY_CONFIG) | \
-+ CAP_TO_MASK(CAP_IPC_OWNER) | CAP_TO_MASK(CAP_SETFCAP), \
-+ CAP_TO_MASK(CAP_MAC_ADMIN) }}
-+
-+#define security_learn(normal_msg,args...) \
-+({ \
-+ read_lock(&grsec_exec_file_lock); \
-+ gr_add_learn_entry(normal_msg "\n", ## args); \
-+ read_unlock(&grsec_exec_file_lock); \
-+})
-+
-+enum {
-+ GR_DO_AUDIT,
-+ GR_DONT_AUDIT,
-+ GR_DONT_AUDIT_GOOD
-+};
-+
-+enum {
-+ GR_TTYSNIFF,
-+ GR_RBAC,
-+ GR_RBAC_STR,
-+ GR_STR_RBAC,
-+ GR_RBAC_MODE2,
-+ GR_RBAC_MODE3,
-+ GR_FILENAME,
-+ GR_SYSCTL_HIDDEN,
-+ GR_NOARGS,
-+ GR_ONE_INT,
-+ GR_ONE_INT_TWO_STR,
-+ GR_ONE_STR,
-+ GR_STR_INT,
-+ GR_TWO_STR_INT,
-+ GR_TWO_INT,
-+ GR_TWO_U64,
-+ GR_THREE_INT,
-+ GR_FIVE_INT_TWO_STR,
-+ GR_TWO_STR,
-+ GR_THREE_STR,
-+ GR_FOUR_STR,
-+ GR_STR_FILENAME,
-+ GR_FILENAME_STR,
-+ GR_FILENAME_TWO_INT,
-+ GR_FILENAME_TWO_INT_STR,
-+ GR_TEXTREL,
-+ GR_PTRACE,
-+ GR_RESOURCE,
-+ GR_CAP,
-+ GR_SIG,
-+ GR_SIG2,
-+ GR_CRASH1,
-+ GR_CRASH2,
-+ GR_PSACCT,
-+ GR_RWXMAP
-+};
-+
-+#define gr_log_hidden_sysctl(audit, msg, str) gr_log_varargs(audit, msg, GR_SYSCTL_HIDDEN, str)
-+#define gr_log_ttysniff(audit, msg, task) gr_log_varargs(audit, msg, GR_TTYSNIFF, task)
-+#define gr_log_fs_rbac_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_RBAC, dentry, mnt)
-+#define gr_log_fs_rbac_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_RBAC_STR, dentry, mnt, str)
-+#define gr_log_fs_str_rbac(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_RBAC, str, dentry, mnt)
-+#define gr_log_fs_rbac_mode2(audit, msg, dentry, mnt, str1, str2) gr_log_varargs(audit, msg, GR_RBAC_MODE2, dentry, mnt, str1, str2)
-+#define gr_log_fs_rbac_mode3(audit, msg, dentry, mnt, str1, str2, str3) gr_log_varargs(audit, msg, GR_RBAC_MODE3, dentry, mnt, str1, str2, str3)
-+#define gr_log_fs_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_FILENAME, dentry, mnt)
-+#define gr_log_noargs(audit, msg) gr_log_varargs(audit, msg, GR_NOARGS)
-+#define gr_log_int(audit, msg, num) gr_log_varargs(audit, msg, GR_ONE_INT, num)
-+#define gr_log_int_str2(audit, msg, num, str1, str2) gr_log_varargs(audit, msg, GR_ONE_INT_TWO_STR, num, str1, str2)
-+#define gr_log_str(audit, msg, str) gr_log_varargs(audit, msg, GR_ONE_STR, str)
-+#define gr_log_str_int(audit, msg, str, num) gr_log_varargs(audit, msg, GR_STR_INT, str, num)
-+#define gr_log_int_int(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_INT, num1, num2)
-+#define gr_log_two_u64(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_U64, num1, num2)
-+#define gr_log_int3(audit, msg, num1, num2, num3) gr_log_varargs(audit, msg, GR_THREE_INT, num1, num2, num3)
-+#define gr_log_int5_str2(audit, msg, num1, num2, str1, str2) gr_log_varargs(audit, msg, GR_FIVE_INT_TWO_STR, num1, num2, str1, str2)
-+#define gr_log_str_str(audit, msg, str1, str2) gr_log_varargs(audit, msg, GR_TWO_STR, str1, str2)
-+#define gr_log_str2_int(audit, msg, str1, str2, num) gr_log_varargs(audit, msg, GR_TWO_STR_INT, str1, str2, num)
-+#define gr_log_str3(audit, msg, str1, str2, str3) gr_log_varargs(audit, msg, GR_THREE_STR, str1, str2, str3)
-+#define gr_log_str4(audit, msg, str1, str2, str3, str4) gr_log_varargs(audit, msg, GR_FOUR_STR, str1, str2, str3, str4)
-+#define gr_log_str_fs(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_FILENAME, str, dentry, mnt)
-+#define gr_log_fs_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_FILENAME_STR, dentry, mnt, str)
-+#define gr_log_fs_int2(audit, msg, dentry, mnt, num1, num2) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT, dentry, mnt, num1, num2)
-+#define gr_log_fs_int2_str(audit, msg, dentry, mnt, num1, num2, str) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT_STR, dentry, mnt, num1, num2, str)
-+#define gr_log_textrel_ulong_ulong(audit, msg, file, ulong1, ulong2) gr_log_varargs(audit, msg, GR_TEXTREL, file, ulong1, ulong2)
-+#define gr_log_ptrace(audit, msg, task) gr_log_varargs(audit, msg, GR_PTRACE, task)
-+#define gr_log_res_ulong2_str(audit, msg, task, ulong1, str, ulong2) gr_log_varargs(audit, msg, GR_RESOURCE, task, ulong1, str, ulong2)
-+#define gr_log_cap(audit, msg, task, str) gr_log_varargs(audit, msg, GR_CAP, task, str)
-+#define gr_log_sig_addr(audit, msg, str, addr) gr_log_varargs(audit, msg, GR_SIG, str, addr)
-+#define gr_log_sig_task(audit, msg, task, num) gr_log_varargs(audit, msg, GR_SIG2, task, num)
-+#define gr_log_crash1(audit, msg, task, ulong) gr_log_varargs(audit, msg, GR_CRASH1, task, ulong)
-+#define gr_log_crash2(audit, msg, task, ulong1) gr_log_varargs(audit, msg, GR_CRASH2, task, ulong1)
-+#define gr_log_procacct(audit, msg, task, num1, num2, num3, num4, num5, num6, num7, num8, num9) gr_log_varargs(audit, msg, GR_PSACCT, task, num1, num2, num3, num4, num5, num6, num7, num8, num9)
-+#define gr_log_rwxmap(audit, msg, str) gr_log_varargs(audit, msg, GR_RWXMAP, str)
-+
-+void gr_log_varargs(int audit, const char *msg, int argtypes, ...);
-+
-+#endif
-+
-+#endif
-diff --git a/include/linux/grmsg.h b/include/linux/grmsg.h
-new file mode 100644
-index 0000000..f38323e
---- /dev/null
-+++ b/include/linux/grmsg.h
-@@ -0,0 +1,113 @@
-+#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
-+#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
-+#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
-+#define GR_STOPMOD_MSG "denied modification of module state by "
-+#define GR_ROFS_BLOCKWRITE_MSG "denied write to block device %.950s by "
-+#define GR_ROFS_MOUNT_MSG "denied writable mount of %.950s by "
-+#define GR_IOPERM_MSG "denied use of ioperm() by "
-+#define GR_IOPL_MSG "denied use of iopl() by "
-+#define GR_SHMAT_ACL_MSG "denied attach of shared memory of UID %u, PID %d, ID %u by "
-+#define GR_UNIX_CHROOT_MSG "denied connect() to abstract AF_UNIX socket outside of chroot by "
-+#define GR_SHMAT_CHROOT_MSG "denied attach of shared memory outside of chroot by "
-+#define GR_MEM_READWRITE_MSG "denied access of range %Lx -> %Lx in /dev/mem by "
-+#define GR_SYMLINK_MSG "not following symlink %.950s owned by %d.%d by "
-+#define GR_LEARN_AUDIT_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%lu\t%lu\t%.4095s\t%lu\t%pI4"
-+#define GR_ID_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%c\t%d\t%d\t%d\t%pI4"
-+#define GR_HIDDEN_ACL_MSG "%s access to hidden file %.950s by "
-+#define GR_OPEN_ACL_MSG "%s open of %.950s for%s%s by "
-+#define GR_CREATE_ACL_MSG "%s create of %.950s for%s%s by "
-+#define GR_FIFO_MSG "denied writing FIFO %.950s of %d.%d by "
-+#define GR_MKNOD_CHROOT_MSG "denied mknod of %.950s from chroot by "
-+#define GR_MKNOD_ACL_MSG "%s mknod of %.950s by "
-+#define GR_UNIXCONNECT_ACL_MSG "%s connect() to the unix domain socket %.950s by "
-+#define GR_TTYSNIFF_ACL_MSG "terminal being sniffed by IP:%pI4 %.480s[%.16s:%d], parent %.480s[%.16s:%d] against "
-+#define GR_MKDIR_ACL_MSG "%s mkdir of %.950s by "
-+#define GR_RMDIR_ACL_MSG "%s rmdir of %.950s by "
-+#define GR_UNLINK_ACL_MSG "%s unlink of %.950s by "
-+#define GR_SYMLINK_ACL_MSG "%s symlink from %.480s to %.480s by "
-+#define GR_HARDLINK_MSG "denied hardlink of %.930s (owned by %d.%d) to %.30s for "
-+#define GR_LINK_ACL_MSG "%s link of %.480s to %.480s by "
-+#define GR_INHERIT_ACL_MSG "successful inherit of %.480s's ACL for %.480s by "
-+#define GR_RENAME_ACL_MSG "%s rename of %.480s to %.480s by "
-+#define GR_UNSAFESHARE_EXEC_ACL_MSG "denied exec with cloned fs of %.950s by "
-+#define GR_PTRACE_EXEC_ACL_MSG "denied ptrace of %.950s by "
-+#define GR_EXEC_ACL_MSG "%s execution of %.950s by "
-+#define GR_EXEC_TPE_MSG "denied untrusted exec (due to %.70s) of %.950s by "
-+#define GR_SEGVSTART_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning uid %u from login for %lu seconds"
-+#define GR_SEGVNOSUID_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning execution for %lu seconds"
-+#define GR_MOUNT_CHROOT_MSG "denied mount of %.256s as %.930s from chroot by "
-+#define GR_PIVOT_CHROOT_MSG "denied pivot_root from chroot by "
-+#define GR_TRUNCATE_ACL_MSG "%s truncate of %.950s by "
-+#define GR_ATIME_ACL_MSG "%s access time change of %.950s by "
-+#define GR_ACCESS_ACL_MSG "%s access of %.950s for%s%s%s by "
-+#define GR_CHROOT_CHROOT_MSG "denied double chroot to %.950s by "
-+#define GR_CHMOD_CHROOT_MSG "denied chmod +s of %.950s by "
-+#define GR_CHMOD_ACL_MSG "%s chmod of %.950s by "
-+#define GR_CHROOT_FCHDIR_MSG "denied fchdir outside of chroot to %.950s by "
-+#define GR_CHOWN_ACL_MSG "%s chown of %.950s by "
-+#define GR_SETXATTR_ACL_MSG "%s setting extended attribute of %.950s by "
-+#define GR_REMOVEXATTR_ACL_MSG "%s removing extended attribute of %.950s by "
-+#define GR_WRITLIB_ACL_MSG "denied load of writable library %.950s by "
-+#define GR_INITF_ACL_MSG "init_variables() failed %s by "
-+#define GR_DISABLED_ACL_MSG "Error loading %s, trying to run kernel with acls disabled. To disable acls at startup use <kernel image name> gracl=off from your boot loader"
-+#define GR_DEV_ACL_MSG "/dev/grsec: %d bytes sent %d required, being fed garbaged by "
-+#define GR_SHUTS_ACL_MSG "shutdown auth success for "
-+#define GR_SHUTF_ACL_MSG "shutdown auth failure for "
-+#define GR_SHUTI_ACL_MSG "ignoring shutdown for disabled RBAC system for "
-+#define GR_SEGVMODS_ACL_MSG "segvmod auth success for "
-+#define GR_SEGVMODF_ACL_MSG "segvmod auth failure for "
-+#define GR_SEGVMODI_ACL_MSG "ignoring segvmod for disabled RBAC system for "
-+#define GR_ENABLE_ACL_MSG "%s RBAC system loaded by "
-+#define GR_ENABLEF_ACL_MSG "unable to load %s for "
-+#define GR_RELOADI_ACL_MSG "ignoring reload request for disabled RBAC system"
-+#define GR_RELOAD_ACL_MSG "%s RBAC system reloaded by "
-+#define GR_RELOADF_ACL_MSG "failed reload of %s for "
-+#define GR_SPROLEI_ACL_MSG "ignoring change to special role for disabled RBAC system for "
-+#define GR_SPROLES_ACL_MSG "successful change to special role %s (id %d) by "
-+#define GR_SPROLEL_ACL_MSG "special role %s (id %d) exited by "
-+#define GR_SPROLEF_ACL_MSG "special role %s failure for "
-+#define GR_UNSPROLEI_ACL_MSG "ignoring unauth of special role for disabled RBAC system for "
-+#define GR_UNSPROLES_ACL_MSG "successful unauth of special role %s (id %d) by "
-+#define GR_INVMODE_ACL_MSG "invalid mode %d by "
-+#define GR_PRIORITY_CHROOT_MSG "denied priority change of process (%.16s:%d) by "
-+#define GR_FAILFORK_MSG "failed fork with errno %s by "
-+#define GR_NICE_CHROOT_MSG "denied priority change by "
-+#define GR_UNISIGLOG_MSG "%.32s occurred at %p in "
-+#define GR_DUALSIGLOG_MSG "signal %d sent to " DEFAULTSECMSG " by "
-+#define GR_SIG_ACL_MSG "denied send of signal %d to protected task " DEFAULTSECMSG " by "
-+#define GR_SYSCTL_MSG "denied modification of grsecurity sysctl value : %.32s by "
-+#define GR_SYSCTL_ACL_MSG "%s sysctl of %.950s for%s%s by "
-+#define GR_TIME_MSG "time set by "
-+#define GR_DEFACL_MSG "fatal: unable to find subject for (%.16s:%d), loaded by "
-+#define GR_MMAP_ACL_MSG "%s executable mmap of %.950s by "
-+#define GR_MPROTECT_ACL_MSG "%s executable mprotect of %.950s by "
-+#define GR_SOCK_MSG "denied socket(%.16s,%.16s,%.16s) by "
-+#define GR_SOCK_NOINET_MSG "denied socket(%.16s,%.16s,%d) by "
-+#define GR_BIND_MSG "denied bind() by "
-+#define GR_CONNECT_MSG "denied connect() by "
-+#define GR_BIND_ACL_MSG "denied bind() to %pI4 port %u sock type %.16s protocol %.16s by "
-+#define GR_CONNECT_ACL_MSG "denied connect() to %pI4 port %u sock type %.16s protocol %.16s by "
-+#define GR_IP_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%pI4\t%u\t%u\t%u\t%u\t%pI4"
-+#define GR_EXEC_CHROOT_MSG "exec of %.980s within chroot by process "
-+#define GR_CAP_ACL_MSG "use of %s denied for "
-+#define GR_CAP_CHROOT_MSG "use of %s in chroot denied for "
-+#define GR_CAP_ACL_MSG2 "use of %s permitted for "
-+#define GR_USRCHANGE_ACL_MSG "change to uid %u denied for "
-+#define GR_GRPCHANGE_ACL_MSG "change to gid %u denied for "
-+#define GR_REMOUNT_AUDIT_MSG "remount of %.256s by "
-+#define GR_UNMOUNT_AUDIT_MSG "unmount of %.256s by "
-+#define GR_MOUNT_AUDIT_MSG "mount of %.256s to %.256s by "
-+#define GR_CHDIR_AUDIT_MSG "chdir to %.980s by "
-+#define GR_EXEC_AUDIT_MSG "exec of %.930s (%.128s) by "
-+#define GR_RESOURCE_MSG "denied resource overstep by requesting %lu for %.16s against limit %lu for "
-+#define GR_RWXMMAP_MSG "denied RWX mmap of %.950s by "
-+#define GR_RWXMPROTECT_MSG "denied RWX mprotect of %.950s by "
-+#define GR_TEXTREL_AUDIT_MSG "text relocation in %s, VMA:0x%08lx 0x%08lx by "
-+#define GR_VM86_MSG "denied use of vm86 by "
-+#define GR_PTRACE_AUDIT_MSG "process %.950s(%.16s:%d) attached to via ptrace by "
-+#define GR_PTRACE_READEXEC_MSG "denied ptrace of unreadable binary %.950s by "
-+#define GR_INIT_TRANSFER_MSG "persistent special role transferred privilege to init by "
-+#define GR_BADPROCPID_MSG "denied read of sensitive /proc/pid/%s entry via fd passed across exec by "
-+#define GR_SYMLINKOWNER_MSG "denied following symlink %.950s since symlink owner %u does not match target owner %u, by "
-+#define GR_BRUTE_DAEMON_MSG "bruteforce prevention initiated for the next 30 minutes or until service restarted, stalling each fork 30 seconds. Please investigate the crash report for "
-+#define GR_BRUTE_SUID_MSG "bruteforce prevention initiated due to crash of %.950s against uid %u, banning suid/sgid execs for %u minutes. Please investigate the crash report for "
-diff --git a/include/linux/grsecurity.h b/include/linux/grsecurity.h
-new file mode 100644
-index 0000000..401ce92
---- /dev/null
-+++ b/include/linux/grsecurity.h
-@@ -0,0 +1,225 @@
-+#ifndef GR_SECURITY_H
-+#define GR_SECURITY_H
-+#include <linux/fs.h>
-+#include <linux/fs_struct.h>
-+#include <linux/binfmts.h>
-+#include <linux/gracl.h>
-+
-+/* notify of brain-dead configs */
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) && defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+#error "CONFIG_GRKERNSEC_PROC_USER and CONFIG_GRKERNSEC_PROC_USERGROUP cannot both be enabled."
-+#endif
-+#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_PAGEEXEC) && !defined(CONFIG_PAX_SEGMEXEC) && !defined(CONFIG_PAX_KERNEXEC)
-+#error "CONFIG_PAX_NOEXEC enabled, but PAGEEXEC, SEGMEXEC, and KERNEXEC are disabled."
-+#endif
-+#if defined(CONFIG_PAX_ASLR) && !defined(CONFIG_PAX_RANDKSTACK) && !defined(CONFIG_PAX_RANDUSTACK) && !defined(CONFIG_PAX_RANDMMAP)
-+#error "CONFIG_PAX_ASLR enabled, but RANDKSTACK, RANDUSTACK, and RANDMMAP are disabled."
-+#endif
-+#if defined(CONFIG_PAX) && !defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_ASLR)
-+#error "CONFIG_PAX enabled, but no PaX options are enabled."
-+#endif
-+
-+int gr_handle_new_usb(void);
-+
-+void gr_handle_brute_attach(unsigned long mm_flags);
-+void gr_handle_brute_check(void);
-+void gr_handle_kernel_exploit(void);
-+
-+char gr_roletype_to_char(void);
-+
-+int gr_acl_enable_at_secure(void);
-+
-+int gr_check_user_change(int real, int effective, int fs);
-+int gr_check_group_change(int real, int effective, int fs);
-+
-+void gr_del_task_from_ip_table(struct task_struct *p);
-+
-+int gr_pid_is_chrooted(struct task_struct *p);
-+int gr_handle_chroot_fowner(struct pid *pid, enum pid_type type);
-+int gr_handle_chroot_nice(void);
-+int gr_handle_chroot_sysctl(const int op);
-+int gr_handle_chroot_setpriority(struct task_struct *p,
-+ const int niceval);
-+int gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt);
-+int gr_handle_chroot_chroot(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+void gr_handle_chroot_chdir(struct path *path);
-+int gr_handle_chroot_chmod(const struct dentry *dentry,
-+ const struct vfsmount *mnt, const int mode);
-+int gr_handle_chroot_mknod(const struct dentry *dentry,
-+ const struct vfsmount *mnt, const int mode);
-+int gr_handle_chroot_mount(const struct dentry *dentry,
-+ const struct vfsmount *mnt,
-+ const char *dev_name);
-+int gr_handle_chroot_pivot(void);
-+int gr_handle_chroot_unix(const pid_t pid);
-+
-+int gr_handle_rawio(const struct inode *inode);
-+
-+void gr_handle_ioperm(void);
-+void gr_handle_iopl(void);
-+
-+umode_t gr_acl_umask(void);
-+
-+int gr_tpe_allow(const struct file *file);
-+
-+void gr_set_chroot_entries(struct task_struct *task, struct path *path);
-+void gr_clear_chroot_entries(struct task_struct *task);
-+
-+void gr_log_forkfail(const int retval);
-+void gr_log_timechange(void);
-+void gr_log_signal(const int sig, const void *addr, const struct task_struct *t);
-+void gr_log_chdir(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+void gr_log_chroot_exec(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+void gr_handle_exec_args(struct linux_binprm *bprm, const char __user *const __user *argv);
-+void gr_log_remount(const char *devname, const int retval);
-+void gr_log_unmount(const char *devname, const int retval);
-+void gr_log_mount(const char *from, const char *to, const int retval);
-+void gr_log_textrel(struct vm_area_struct *vma);
-+void gr_log_rwxmmap(struct file *file);
-+void gr_log_rwxmprotect(struct file *file);
-+
-+int gr_handle_follow_link(const struct inode *parent,
-+ const struct inode *inode,
-+ const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+int gr_handle_fifo(const struct dentry *dentry,
-+ const struct vfsmount *mnt,
-+ const struct dentry *dir, const int flag,
-+ const int acc_mode);
-+int gr_handle_hardlink(const struct dentry *dentry,
-+ const struct vfsmount *mnt,
-+ struct inode *inode,
-+ const int mode, const char *to);
-+
-+int gr_is_capable(const int cap);
-+int gr_is_capable_nolog(const int cap);
-+void gr_learn_resource(const struct task_struct *task, const int limit,
-+ const unsigned long wanted, const int gt);
-+void gr_copy_label(struct task_struct *tsk);
-+void gr_handle_crash(struct task_struct *task, const int sig);
-+int gr_handle_signal(const struct task_struct *p, const int sig);
-+int gr_check_crash_uid(const uid_t uid);
-+int gr_check_protected_task(const struct task_struct *task);
-+int gr_check_protected_task_fowner(struct pid *pid, enum pid_type type);
-+int gr_acl_handle_mmap(const struct file *file,
-+ const unsigned long prot);
-+int gr_acl_handle_mprotect(const struct file *file,
-+ const unsigned long prot);
-+int gr_check_hidden_task(const struct task_struct *tsk);
-+__u32 gr_acl_handle_truncate(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+__u32 gr_acl_handle_utime(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+__u32 gr_acl_handle_access(const struct dentry *dentry,
-+ const struct vfsmount *mnt, const int fmode);
-+__u32 gr_acl_handle_chmod(const struct dentry *dentry,
-+ const struct vfsmount *mnt, umode_t *mode);
-+__u32 gr_acl_handle_chown(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+__u32 gr_acl_handle_setxattr(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+__u32 gr_acl_handle_removexattr(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+int gr_handle_ptrace(struct task_struct *task, const long request);
-+int gr_handle_proc_ptrace(struct task_struct *task);
-+__u32 gr_acl_handle_execve(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+int gr_check_crash_exec(const struct file *filp);
-+int gr_acl_is_enabled(void);
-+void gr_set_kernel_label(struct task_struct *task);
-+void gr_set_role_label(struct task_struct *task, const uid_t uid,
-+ const gid_t gid);
-+int gr_set_proc_label(const struct dentry *dentry,
-+ const struct vfsmount *mnt,
-+ const int unsafe_flags);
-+__u32 gr_acl_handle_hidden_file(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+__u32 gr_acl_handle_open(const struct dentry *dentry,
-+ const struct vfsmount *mnt, int acc_mode);
-+__u32 gr_acl_handle_creat(const struct dentry *dentry,
-+ const struct dentry *p_dentry,
-+ const struct vfsmount *p_mnt,
-+ int open_flags, int acc_mode, const int imode);
-+void gr_handle_create(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+void gr_handle_proc_create(const struct dentry *dentry,
-+ const struct inode *inode);
-+__u32 gr_acl_handle_mknod(const struct dentry *new_dentry,
-+ const struct dentry *parent_dentry,
-+ const struct vfsmount *parent_mnt,
-+ const int mode);
-+__u32 gr_acl_handle_mkdir(const struct dentry *new_dentry,
-+ const struct dentry *parent_dentry,
-+ const struct vfsmount *parent_mnt);
-+__u32 gr_acl_handle_rmdir(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+void gr_handle_delete(const ino_t ino, const dev_t dev);
-+__u32 gr_acl_handle_unlink(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+__u32 gr_acl_handle_symlink(const struct dentry *new_dentry,
-+ const struct dentry *parent_dentry,
-+ const struct vfsmount *parent_mnt,
-+ const char *from);
-+__u32 gr_acl_handle_link(const struct dentry *new_dentry,
-+ const struct dentry *parent_dentry,
-+ const struct vfsmount *parent_mnt,
-+ const struct dentry *old_dentry,
-+ const struct vfsmount *old_mnt, const char *to);
-+int gr_handle_symlink_owner(const struct path *link, const struct inode *target);
-+int gr_acl_handle_rename(struct dentry *new_dentry,
-+ struct dentry *parent_dentry,
-+ const struct vfsmount *parent_mnt,
-+ struct dentry *old_dentry,
-+ struct inode *old_parent_inode,
-+ struct vfsmount *old_mnt, const char *newname);
-+void gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
-+ struct dentry *old_dentry,
-+ struct dentry *new_dentry,
-+ struct vfsmount *mnt, const __u8 replace);
-+__u32 gr_check_link(const struct dentry *new_dentry,
-+ const struct dentry *parent_dentry,
-+ const struct vfsmount *parent_mnt,
-+ const struct dentry *old_dentry,
-+ const struct vfsmount *old_mnt);
-+int gr_acl_handle_filldir(const struct file *file, const char *name,
-+ const unsigned int namelen, const ino_t ino);
-+
-+__u32 gr_acl_handle_unix(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+void gr_acl_handle_exit(void);
-+void gr_acl_handle_psacct(struct task_struct *task, const long code);
-+int gr_acl_handle_procpidmem(const struct task_struct *task);
-+int gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags);
-+int gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode);
-+void gr_audit_ptrace(struct task_struct *task);
-+dev_t gr_get_dev_from_dentry(struct dentry *dentry);
-+void gr_put_exec_file(struct task_struct *task);
-+
-+int gr_ptrace_readexec(struct file *file, int unsafe_flags);
-+
-+#ifdef CONFIG_GRKERNSEC
-+void task_grsec_rbac(struct seq_file *m, struct task_struct *p);
-+void gr_handle_vm86(void);
-+void gr_handle_mem_readwrite(u64 from, u64 to);
-+
-+void gr_log_badprocpid(const char *entry);
-+
-+extern int grsec_enable_dmesg;
-+extern int grsec_disable_privio;
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+extern int grsec_proc_gid;
-+#endif
-+
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
-+extern int grsec_enable_chroot_findtask;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+extern int grsec_enable_setxid;
-+#endif
-+#endif
-+
-+#endif
-diff --git a/include/linux/hdpu_features.h b/include/linux/hdpu_features.h
-index 6a87154..a3ce57b 100644
---- a/include/linux/hdpu_features.h
-+++ b/include/linux/hdpu_features.h
-@@ -3,7 +3,7 @@
- struct cpustate_t {
- spinlock_t lock;
- int excl;
-- int open_count;
-+ atomic_t open_count;
- unsigned char cached_val;
- int inited;
- unsigned long *set_addr;
-diff --git a/include/linux/highmem.h b/include/linux/highmem.h
-index 211ff44..00ab6d7 100644
---- a/include/linux/highmem.h
-+++ b/include/linux/highmem.h
-@@ -137,6 +137,18 @@ static inline void clear_highpage(struct page *page)
- kunmap_atomic(kaddr, KM_USER0);
- }
-
-+static inline void sanitize_highpage(struct page *page)
-+{
-+ void *kaddr;
-+ unsigned long flags;
-+
-+ local_irq_save(flags);
-+ kaddr = kmap_atomic(page, KM_CLEARPAGE);
-+ clear_page(kaddr);
-+ kunmap_atomic(kaddr, KM_CLEARPAGE);
-+ local_irq_restore(flags);
-+}
-+
- static inline void zero_user_segments(struct page *page,
- unsigned start1, unsigned end1,
- unsigned start2, unsigned end2)
-diff --git a/include/linux/i2c.h b/include/linux/i2c.h
-index 7b40cda..24eb44e 100644
---- a/include/linux/i2c.h
-+++ b/include/linux/i2c.h
-@@ -325,6 +325,7 @@ struct i2c_algorithm {
- /* To determine what the adapter supports */
- u32 (*functionality) (struct i2c_adapter *);
- };
-+typedef struct i2c_algorithm __no_const i2c_algorithm_no_const;
-
- /*
- * i2c_adapter is the structure used to identify a physical i2c bus along
-diff --git a/include/linux/i2o.h b/include/linux/i2o.h
-index 4c4e57d..f3c5303 100644
---- a/include/linux/i2o.h
-+++ b/include/linux/i2o.h
-@@ -564,7 +564,7 @@ struct i2o_controller {
- struct i2o_device *exec; /* Executive */
- #if BITS_PER_LONG == 64
- spinlock_t context_list_lock; /* lock for context_list */
-- atomic_t context_list_counter; /* needed for unique contexts */
-+ atomic_unchecked_t context_list_counter; /* needed for unique contexts */
- struct list_head context_list; /* list of context id's
- and pointers */
- #endif
-diff --git a/include/linux/if_pppox.h b/include/linux/if_pppox.h
-index 90b5fae..a11a48e 100644
---- a/include/linux/if_pppox.h
-+++ b/include/linux/if_pppox.h
-@@ -175,7 +175,7 @@ struct pppox_proto {
- int (*ioctl)(struct socket *sock, unsigned int cmd,
- unsigned long arg);
- struct module *owner;
--};
-+} __do_const;
-
- extern int register_pppox_proto(int proto_num, struct pppox_proto *pp);
- extern void unregister_pppox_proto(int proto_num);
-diff --git a/include/linux/init.h b/include/linux/init.h
-index ff8bde5..ed08ca7 100644
---- a/include/linux/init.h
-+++ b/include/linux/init.h
-@@ -38,9 +38,36 @@
- * Also note, that this data cannot be "const".
- */
-
-+#ifdef MODULE
-+#define add_init_latent_entropy
-+#define add_devinit_latent_entropy
-+#define add_cpuinit_latent_entropy
-+#define add_meminit_latent_entropy
-+#else
-+#define add_init_latent_entropy __latent_entropy
-+
-+#ifdef CONFIG_HOTPLUG
-+#define add_devinit_latent_entropy
-+#else
-+#define add_devinit_latent_entropy __latent_entropy
-+#endif
-+
-+#ifdef CONFIG_HOTPLUG_CPU
-+#define add_cpuinit_latent_entropy
-+#else
-+#define add_cpuinit_latent_entropy __latent_entropy
-+#endif
-+
-+#ifdef CONFIG_MEMORY_HOTPLUG
-+#define add_meminit_latent_entropy
-+#else
-+#define add_meminit_latent_entropy __latent_entropy
-+#endif
-+#endif
-+
- /* These are for everybody (although not all archs will actually
- discard it in modules) */
--#define __init __section(.init.text) __cold notrace
-+#define __init __section(.init.text) __cold notrace add_init_latent_entropy
- #define __initdata __section(.init.data)
- #define __initconst __section(.init.rodata)
- #define __exitdata __section(.exit.data)
-@@ -75,7 +102,7 @@
- #define __exit __section(.exit.text) __exitused __cold
-
- /* Used for HOTPLUG */
--#define __devinit __section(.devinit.text) __cold
-+#define __devinit __section(.devinit.text) __cold add_devinit_latent_entropy
- #define __devinitdata __section(.devinit.data)
- #define __devinitconst __section(.devinit.rodata)
- #define __devexit __section(.devexit.text) __exitused __cold
-@@ -83,7 +110,7 @@
- #define __devexitconst __section(.devexit.rodata)
-
- /* Used for HOTPLUG_CPU */
--#define __cpuinit __section(.cpuinit.text) __cold
-+#define __cpuinit __section(.cpuinit.text) __cold add_cpuinit_latent_entropy
- #define __cpuinitdata __section(.cpuinit.data)
- #define __cpuinitconst __section(.cpuinit.rodata)
- #define __cpuexit __section(.cpuexit.text) __exitused __cold
-@@ -91,7 +118,7 @@
- #define __cpuexitconst __section(.cpuexit.rodata)
-
- /* Used for MEMORY_HOTPLUG */
--#define __meminit __section(.meminit.text) __cold
-+#define __meminit __section(.meminit.text) __cold add_meminit_latent_entropy
- #define __meminitdata __section(.meminit.data)
- #define __meminitconst __section(.meminit.rodata)
- #define __memexit __section(.memexit.text) __exitused __cold
-diff --git a/include/linux/init_task.h b/include/linux/init_task.h
-index 21a6f5d..7c7d19f 100644
---- a/include/linux/init_task.h
-+++ b/include/linux/init_task.h
-@@ -29,6 +29,8 @@ extern struct fs_struct init_fs;
- .running = 0, \
- .lock = __SPIN_LOCK_UNLOCKED(sig.cputimer.lock), \
- }, \
-+ .cred_guard_mutex = \
-+ __MUTEX_INITIALIZER(sig.cred_guard_mutex), \
- }
-
- extern struct nsproxy init_nsproxy;
-@@ -83,6 +85,12 @@ extern struct group_info init_groups;
- #define INIT_IDS
- #endif
-
-+#ifdef CONFIG_X86
-+#define INIT_TASK_THREAD_INFO .tinfo = INIT_THREAD_INFO,
-+#else
-+#define INIT_TASK_THREAD_INFO
-+#endif
-+
- #ifdef CONFIG_SECURITY_FILE_CAPABILITIES
- /*
- * Because of the reduced scope of CAP_SETPCAP when filesystem
-@@ -152,10 +160,9 @@ extern struct cred init_cred;
- .group_leader = &tsk, \
- .real_cred = &init_cred, \
- .cred = &init_cred, \
-- .cred_guard_mutex = \
-- __MUTEX_INITIALIZER(tsk.cred_guard_mutex), \
- .comm = "swapper", \
- .thread = INIT_THREAD, \
-+ INIT_TASK_THREAD_INFO \
- .fs = &init_fs, \
- .files = &init_files, \
- .signal = &init_signals, \
-diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
-index c739150..ab83f58 100644
---- a/include/linux/interrupt.h
-+++ b/include/linux/interrupt.h
-@@ -369,7 +369,7 @@ enum
- /* map softirq index to softirq name. update 'softirq_to_name' in
- * kernel/softirq.c when adding a new softirq.
- */
--extern char *softirq_to_name[NR_SOFTIRQS];
-+extern const char * const softirq_to_name[NR_SOFTIRQS];
-
- /* softirq mask and active fields moved to irq_cpustat_t in
- * asm/hardirq.h to get better cache usage. KAO
-@@ -377,12 +377,12 @@ extern char *softirq_to_name[NR_SOFTIRQS];
-
- struct softirq_action
- {
-- void (*action)(struct softirq_action *);
--};
-+ void (*action)(void);
-+} __no_const;
-
- asmlinkage void do_softirq(void);
- asmlinkage void __do_softirq(void);
--extern void open_softirq(int nr, void (*action)(struct softirq_action *));
-+extern void open_softirq(int nr, void (*action)(void));
- extern void softirq_init(void);
- #define __raise_softirq_irqoff(nr) do { or_softirq_pending(1UL << (nr)); } while (0)
- extern void raise_softirq_irqoff(unsigned int nr);
-diff --git a/include/linux/irq.h b/include/linux/irq.h
-index 2333710..74767a7 100644
---- a/include/linux/irq.h
-+++ b/include/linux/irq.h
-@@ -437,12 +437,12 @@ extern int set_irq_msi(unsigned int irq, struct msi_desc *entry);
- static inline bool alloc_desc_masks(struct irq_desc *desc, int node,
- bool boot)
- {
-+#ifdef CONFIG_CPUMASK_OFFSTACK
- gfp_t gfp = GFP_ATOMIC;
-
- if (boot)
- gfp = GFP_NOWAIT;
-
--#ifdef CONFIG_CPUMASK_OFFSTACK
- if (!alloc_cpumask_var_node(&desc->affinity, gfp, node))
- return false;
-
-diff --git a/include/linux/kallsyms.h b/include/linux/kallsyms.h
-index 7922742..54e4350 100644
---- a/include/linux/kallsyms.h
-+++ b/include/linux/kallsyms.h
-@@ -15,7 +15,8 @@
-
- struct module;
-
--#ifdef CONFIG_KALLSYMS
-+#if !defined(__INCLUDED_BY_HIDESYM) || !defined(CONFIG_KALLSYMS)
-+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
- /* Lookup the address for a symbol. Returns 0 if not found. */
- unsigned long kallsyms_lookup_name(const char *name);
-
-@@ -92,6 +93,19 @@ static inline int lookup_symbol_attrs(unsigned long addr, unsigned long *size, u
- /* Stupid that this does nothing, but I didn't create this mess. */
- #define __print_symbol(fmt, addr)
- #endif /*CONFIG_KALLSYMS*/
-+#else /* when included by kallsyms.c, vsnprintf.c, kprobes.c, or
-+ arch/x86/kernel/dumpstack.c, with HIDESYM enabled */
-+extern unsigned long kallsyms_lookup_name(const char *name);
-+extern void __print_symbol(const char *fmt, unsigned long address);
-+extern int sprint_symbol(char *buffer, unsigned long address);
-+const char *kallsyms_lookup(unsigned long addr,
-+ unsigned long *symbolsize,
-+ unsigned long *offset,
-+ char **modname, char *namebuf);
-+extern int kallsyms_lookup_size_offset(unsigned long addr,
-+ unsigned long *symbolsize,
-+ unsigned long *offset);
-+#endif
-
- /* This macro allows us to keep printk typechecking */
- static void __check_printsym_format(const char *fmt, ...)
-diff --git a/include/linux/kernel.h b/include/linux/kernel.h
-index 3526cd4..6835d45 100644
---- a/include/linux/kernel.h
-+++ b/include/linux/kernel.h
-@@ -45,6 +45,16 @@ extern const char linux_proc_banner[];
-
- #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]) + __must_be_array(arr))
-
-+/*
-+ * This looks more complex than it should be. But we need to
-+ * get the type for the ~ right in round_down (it needs to be
-+ * as wide as the result!), and we want to evaluate the macro
-+ * arguments just once each.
-+ */
-+#define __round_mask(x, y) ((__typeof__(x))((y)-1))
-+#define round_up(x, y) ((((x)-1) | __round_mask(x, y))+1)
-+#define round_down(x, y) ((x) & ~__round_mask(x, y))
-+
- #define FIELD_SIZEOF(t, f) (sizeof(((t*)0)->f))
- #define DIV_ROUND_UP(n,d) (((n) + (d) - 1) / (d))
- #define roundup(x, y) ((((x) + ((y) - 1)) / (y)) * (y))
-@@ -163,6 +173,11 @@ extern int _cond_resched(void);
- (__x < 0) ? -__x : __x; \
- })
-
-+#define abs64(x) ({ \
-+ s64 __x = (x); \
-+ (__x < 0) ? -__x : __x; \
-+ })
-+
- #ifdef CONFIG_PROVE_LOCKING
- void might_fault(void);
- #else
-diff --git a/include/linux/kgdb.h b/include/linux/kgdb.h
-index 6adcc29..13369e8 100644
---- a/include/linux/kgdb.h
-+++ b/include/linux/kgdb.h
-@@ -74,8 +74,8 @@ void kgdb_breakpoint(void);
-
- extern int kgdb_connected;
-
--extern atomic_t kgdb_setting_breakpoint;
--extern atomic_t kgdb_cpu_doing_single_step;
-+extern atomic_unchecked_t kgdb_setting_breakpoint;
-+extern atomic_unchecked_t kgdb_cpu_doing_single_step;
-
- extern struct task_struct *kgdb_usethread;
- extern struct task_struct *kgdb_contthread;
-@@ -235,7 +235,7 @@ struct kgdb_arch {
- int (*remove_hw_breakpoint)(unsigned long, int, enum kgdb_bptype);
- void (*remove_all_hw_break)(void);
- void (*correct_hw_break)(void);
--};
-+} __do_const;
-
- /**
- * struct kgdb_io - Describe the interface for an I/O driver to talk with KGDB.
-@@ -257,14 +257,14 @@ struct kgdb_io {
- int (*init) (void);
- void (*pre_exception) (void);
- void (*post_exception) (void);
--};
-+} __do_const;
-
--extern struct kgdb_arch arch_kgdb_ops;
-+extern const struct kgdb_arch arch_kgdb_ops;
-
- extern unsigned long __weak kgdb_arch_pc(int exception, struct pt_regs *regs);
-
--extern int kgdb_register_io_module(struct kgdb_io *local_kgdb_io_ops);
--extern void kgdb_unregister_io_module(struct kgdb_io *local_kgdb_io_ops);
-+extern int kgdb_register_io_module(const struct kgdb_io *local_kgdb_io_ops);
-+extern void kgdb_unregister_io_module(const struct kgdb_io *local_kgdb_io_ops);
-
- extern int kgdb_hex2long(char **ptr, unsigned long *long_val);
- extern int kgdb_mem2hex(char *mem, char *buf, int count);
-diff --git a/include/linux/kmod.h b/include/linux/kmod.h
-index 93e732e..e86feaf 100644
---- a/include/linux/kmod.h
-+++ b/include/linux/kmod.h
-@@ -31,6 +31,8 @@
- * usually useless though. */
- extern int __request_module(bool wait, const char *name, ...) \
- __attribute__((format(printf, 2, 3)));
-+extern int ___request_module(bool wait, char *param_name, const char *name, ...) \
-+ __attribute__((format(printf, 3, 4)));
- #define request_module(mod...) __request_module(true, mod)
- #define request_module_nowait(mod...) __request_module(false, mod)
- #define try_then_request_module(x, mod...) \
-diff --git a/include/linux/kobject.h b/include/linux/kobject.h
-index 58ae8e0..8ce9617 100644
---- a/include/linux/kobject.h
-+++ b/include/linux/kobject.h
-@@ -106,9 +106,9 @@ extern char *kobject_get_path(struct kobject *kobj, gfp_t flag);
-
- struct kobj_type {
- void (*release)(struct kobject *kobj);
-- struct sysfs_ops *sysfs_ops;
-+ const struct sysfs_ops *sysfs_ops;
- struct attribute **default_attrs;
--};
-+} __do_const;
-
- struct kobj_uevent_env {
- char *envp[UEVENT_NUM_ENVP];
-@@ -118,9 +118,9 @@ struct kobj_uevent_env {
- };
-
- struct kset_uevent_ops {
-- int (*filter)(struct kset *kset, struct kobject *kobj);
-- const char *(*name)(struct kset *kset, struct kobject *kobj);
-- int (*uevent)(struct kset *kset, struct kobject *kobj,
-+ int (* const filter)(struct kset *kset, struct kobject *kobj);
-+ const char *(* const name)(struct kset *kset, struct kobject *kobj);
-+ int (* const uevent)(struct kset *kset, struct kobject *kobj,
- struct kobj_uevent_env *env);
- };
-
-@@ -132,7 +132,7 @@ struct kobj_attribute {
- const char *buf, size_t count);
- };
-
--extern struct sysfs_ops kobj_sysfs_ops;
-+extern const struct sysfs_ops kobj_sysfs_ops;
-
- /**
- * struct kset - a set of kobjects of a specific type, belonging to a specific subsystem.
-@@ -155,14 +155,14 @@ struct kset {
- struct list_head list;
- spinlock_t list_lock;
- struct kobject kobj;
-- struct kset_uevent_ops *uevent_ops;
-+ const struct kset_uevent_ops *uevent_ops;
- };
-
- extern void kset_init(struct kset *kset);
- extern int __must_check kset_register(struct kset *kset);
- extern void kset_unregister(struct kset *kset);
- extern struct kset * __must_check kset_create_and_add(const char *name,
-- struct kset_uevent_ops *u,
-+ const struct kset_uevent_ops *u,
- struct kobject *parent_kobj);
-
- static inline struct kset *to_kset(struct kobject *kobj)
-diff --git a/include/linux/kref.h b/include/linux/kref.h
-index b0cb0eb..26fd888 100644
---- a/include/linux/kref.h
-+++ b/include/linux/kref.h
-@@ -16,6 +16,7 @@
- #define _KREF_H_
-
- #include <linux/types.h>
-+#include <asm/atomic.h>
-
- struct kref {
- atomic_t refcount;
-@@ -26,4 +27,24 @@ void kref_init(struct kref *kref);
- void kref_get(struct kref *kref);
- int kref_put(struct kref *kref, void (*release) (struct kref *kref));
-
-+/**
-+ * kref_get_unless_zero - Increment refcount for object unless it is zero.
-+ * @kref: object.
-+ *
-+ * Return non-zero if the increment succeeded. Otherwise return 0.
-+ *
-+ * This function is intended to simplify locking around refcounting for
-+ * objects that can be looked up from a lookup structure, and which are
-+ * removed from that lookup structure in the object destructor.
-+ * Operations on such objects require at least a read lock around
-+ * lookup + kref_get, and a write lock around kref_put + remove from lookup
-+ * structure. Furthermore, RCU implementations become extremely tricky.
-+ * With a lookup followed by a kref_get_unless_zero *with return value check*
-+ * locking in the kref_put path can be deferred to the actual removal from
-+ * the lookup structure and RCU lookups become trivial.
-+ */
-+static inline int __must_check kref_get_unless_zero(struct kref *kref)
-+{
-+ return atomic_add_unless(&kref->refcount, 1, 0);
-+}
- #endif /* _KREF_H_ */
-diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
-index 8bfed57..07be660 100644
---- a/include/linux/kvm_host.h
-+++ b/include/linux/kvm_host.h
-@@ -210,7 +210,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vcpu);
- void vcpu_load(struct kvm_vcpu *vcpu);
- void vcpu_put(struct kvm_vcpu *vcpu);
-
--int kvm_init(void *opaque, unsigned int vcpu_size,
-+int kvm_init(const void *opaque, unsigned int vcpu_size,
- struct module *module);
- void kvm_exit(void);
-
-@@ -316,7 +316,7 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(struct kvm_vcpu *vcpu,
- struct kvm_guest_debug *dbg);
- int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run);
-
--int kvm_arch_init(void *opaque);
-+int kvm_arch_init(const void *opaque);
- void kvm_arch_exit(void);
-
- int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
-diff --git a/include/linux/libata.h b/include/linux/libata.h
-index a069916..223edde 100644
---- a/include/linux/libata.h
-+++ b/include/linux/libata.h
-@@ -525,11 +525,11 @@ struct ata_ioports {
-
- struct ata_host {
- spinlock_t lock;
-- struct device *dev;
-+ struct device *dev;
- void __iomem * const *iomap;
- unsigned int n_ports;
- void *private_data;
-- struct ata_port_operations *ops;
-+ const struct ata_port_operations *ops;
- unsigned long flags;
- #ifdef CONFIG_ATA_ACPI
- acpi_handle acpi_handle;
-@@ -710,7 +710,7 @@ struct ata_link {
-
- struct ata_port {
- struct Scsi_Host *scsi_host; /* our co-allocated scsi host */
-- struct ata_port_operations *ops;
-+ const struct ata_port_operations *ops;
- spinlock_t *lock;
- /* Flags owned by the EH context. Only EH should touch these once the
- port is active */
-@@ -884,7 +884,7 @@ struct ata_port_operations {
- * fields must be pointers.
- */
- const struct ata_port_operations *inherits;
--};
-+} __do_const;
-
- struct ata_port_info {
- unsigned long flags;
-@@ -892,7 +892,7 @@ struct ata_port_info {
- unsigned long pio_mask;
- unsigned long mwdma_mask;
- unsigned long udma_mask;
-- struct ata_port_operations *port_ops;
-+ const struct ata_port_operations *port_ops;
- void *private_data;
- };
-
-@@ -916,7 +916,7 @@ extern const unsigned long sata_deb_timing_normal[];
- extern const unsigned long sata_deb_timing_hotplug[];
- extern const unsigned long sata_deb_timing_long[];
-
--extern struct ata_port_operations ata_dummy_port_ops;
-+extern const struct ata_port_operations ata_dummy_port_ops;
- extern const struct ata_port_info ata_dummy_port_info;
-
- static inline const unsigned long *
-@@ -962,7 +962,7 @@ extern int ata_host_activate(struct ata_host *host, int irq,
- struct scsi_host_template *sht);
- extern void ata_host_detach(struct ata_host *host);
- extern void ata_host_init(struct ata_host *, struct device *,
-- unsigned long, struct ata_port_operations *);
-+ unsigned long, const struct ata_port_operations *);
- extern int ata_scsi_detect(struct scsi_host_template *sht);
- extern int ata_scsi_ioctl(struct scsi_device *dev, int cmd, void __user *arg);
- extern int ata_scsi_queuecmd(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *));
-diff --git a/include/linux/list.h b/include/linux/list.h
-index 969f6e9..0327c33 100644
---- a/include/linux/list.h
-+++ b/include/linux/list.h
-@@ -110,6 +110,9 @@ static inline void list_del(struct list_head *entry)
- extern void list_del(struct list_head *entry);
- #endif
-
-+extern void pax_list_add_tail(struct list_head *new, struct list_head *head);
-+extern void pax_list_del(struct list_head *entry);
-+
- /**
- * list_replace - replace old entry by new one
- * @old : the element to be replaced
-diff --git a/include/linux/lockd/bind.h b/include/linux/lockd/bind.h
-index fbc48f8..0886e57 100644
---- a/include/linux/lockd/bind.h
-+++ b/include/linux/lockd/bind.h
-@@ -23,13 +23,13 @@ struct svc_rqst;
- * This is the set of functions for lockd->nfsd communication
- */
- struct nlmsvc_binding {
-- __be32 (*fopen)(struct svc_rqst *,
-+ __be32 (* const fopen)(struct svc_rqst *,
- struct nfs_fh *,
- struct file **);
-- void (*fclose)(struct file *);
-+ void (* const fclose)(struct file *);
- };
-
--extern struct nlmsvc_binding * nlmsvc_ops;
-+extern const struct nlmsvc_binding * nlmsvc_ops;
-
- /*
- * Similar to nfs_client_initdata, but without the NFS-specific
-diff --git a/include/linux/math64.h b/include/linux/math64.h
-index c87f152..23fcdfc 100644
---- a/include/linux/math64.h
-+++ b/include/linux/math64.h
-@@ -35,6 +35,14 @@ static inline u64 div64_u64(u64 dividend, u64 divisor)
- return dividend / divisor;
- }
-
-+/**
-+ * div64_s64 - signed 64bit divide with 64bit divisor
-+ */
-+static inline s64 div64_s64(s64 dividend, s64 divisor)
-+{
-+ return dividend / divisor;
-+}
-+
- #elif BITS_PER_LONG == 32
-
- #ifndef div_u64_rem
-@@ -53,6 +61,10 @@ extern s64 div_s64_rem(s64 dividend, s32 divisor, s32 *remainder);
- extern u64 div64_u64(u64 dividend, u64 divisor);
- #endif
-
-+#ifndef div64_s64
-+extern s64 div64_s64(s64 dividend, s64 divisor);
-+#endif
-+
- #endif /* BITS_PER_LONG */
-
- /**
-diff --git a/include/linux/mca.h b/include/linux/mca.h
-index 3797270..7765ede 100644
---- a/include/linux/mca.h
-+++ b/include/linux/mca.h
-@@ -80,7 +80,7 @@ struct mca_bus_accessor_functions {
- int region);
- void * (*mca_transform_memory)(struct mca_device *,
- void *memory);
--};
-+} __no_const;
-
- struct mca_bus {
- u64 default_dma_mask;
-diff --git a/include/linux/mm.h b/include/linux/mm.h
-index 11e5be6..947f41d 100644
---- a/include/linux/mm.h
-+++ b/include/linux/mm.h
-@@ -106,7 +106,14 @@ extern unsigned int kobjsize(const void *objp);
-
- #define VM_CAN_NONLINEAR 0x08000000 /* Has ->fault & does nonlinear pages */
- #define VM_MIXEDMAP 0x10000000 /* Can contain "struct page" and pure PFN pages */
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
-+#define VM_SAO 0x00000000 /* Strong Access Ordering (powerpc) */
-+#define VM_PAGEEXEC 0x20000000 /* vma->vm_page_prot needs special handling */
-+#else
- #define VM_SAO 0x20000000 /* Strong Access Ordering (powerpc) */
-+#endif
-+
- #define VM_PFN_AT_MMAP 0x40000000 /* PFNMAP vma that is fully mapped at mmap time */
- #define VM_MERGEABLE 0x80000000 /* KSM may merge identical pages */
-
-@@ -841,12 +848,6 @@ int set_page_dirty(struct page *page);
- int set_page_dirty_lock(struct page *page);
- int clear_page_dirty_for_io(struct page *page);
-
--/* Is the vma a continuation of the stack vma above it? */
--static inline int vma_stack_continue(struct vm_area_struct *vma, unsigned long addr)
--{
-- return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN);
--}
--
- extern unsigned long move_page_tables(struct vm_area_struct *vma,
- unsigned long old_addr, struct vm_area_struct *new_vma,
- unsigned long new_addr, unsigned long len);
-@@ -890,6 +891,8 @@ struct shrinker {
- extern void register_shrinker(struct shrinker *);
- extern void unregister_shrinker(struct shrinker *);
-
-+pgprot_t vm_get_page_prot(unsigned long vm_flags);
-+
- int vma_wants_writenotify(struct vm_area_struct *vma);
-
- extern pte_t *get_locked_pte(struct mm_struct *mm, unsigned long addr, spinlock_t **ptl);
-@@ -900,8 +903,15 @@ static inline int __pud_alloc(struct mm_struct *mm, pgd_t *pgd,
- {
- return 0;
- }
-+
-+static inline int __pud_alloc_kernel(struct mm_struct *mm, pgd_t *pgd,
-+ unsigned long address)
-+{
-+ return 0;
-+}
- #else
- int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address);
-+int __pud_alloc_kernel(struct mm_struct *mm, pgd_t *pgd, unsigned long address);
- #endif
-
- #ifdef __PAGETABLE_PMD_FOLDED
-@@ -910,8 +920,15 @@ static inline int __pmd_alloc(struct mm_struct *mm, pud_t *pud,
- {
- return 0;
- }
-+
-+static inline int __pmd_alloc_kernel(struct mm_struct *mm, pud_t *pud,
-+ unsigned long address)
-+{
-+ return 0;
-+}
- #else
- int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address);
-+int __pmd_alloc_kernel(struct mm_struct *mm, pud_t *pud, unsigned long address);
- #endif
-
- int __pte_alloc(struct mm_struct *mm, pmd_t *pmd, unsigned long address);
-@@ -928,11 +945,23 @@ static inline pud_t *pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long a
- NULL: pud_offset(pgd, address);
- }
-
-+static inline pud_t *pud_alloc_kernel(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
-+{
-+ return (unlikely(pgd_none(*pgd)) && __pud_alloc_kernel(mm, pgd, address))?
-+ NULL: pud_offset(pgd, address);
-+}
-+
- static inline pmd_t *pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
- {
- return (unlikely(pud_none(*pud)) && __pmd_alloc(mm, pud, address))?
- NULL: pmd_offset(pud, address);
- }
-+
-+static inline pmd_t *pmd_alloc_kernel(struct mm_struct *mm, pud_t *pud, unsigned long address)
-+{
-+ return (unlikely(pud_none(*pud)) && __pmd_alloc_kernel(mm, pud, address))?
-+ NULL: pmd_offset(pud, address);
-+}
- #endif /* CONFIG_MMU && !__ARCH_HAS_4LEVEL_HACK */
-
- #if USE_SPLIT_PTLOCKS
-@@ -1162,6 +1191,7 @@ out:
- }
-
- extern int do_munmap(struct mm_struct *, unsigned long, size_t);
-+extern int __do_munmap(struct mm_struct *, unsigned long, size_t);
-
- extern unsigned long do_brk(unsigned long, unsigned long);
-
-@@ -1218,6 +1248,10 @@ extern struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long add
- extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
- struct vm_area_struct **pprev);
-
-+extern struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma);
-+extern void pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma);
-+extern void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl);
-+
- /* Look up the first VMA which intersects the interval start_addr..end_addr-1,
- NULL if none. Assume start_addr < end_addr. */
- static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr)
-@@ -1234,7 +1268,6 @@ static inline unsigned long vma_pages(struct vm_area_struct *vma)
- return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
- }
-
--pgprot_t vm_get_page_prot(unsigned long vm_flags);
- struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr);
- int remap_pfn_range(struct vm_area_struct *, unsigned long addr,
- unsigned long pfn, unsigned long size, pgprot_t);
-@@ -1243,6 +1276,8 @@ int vm_insert_pfn(struct vm_area_struct *vma, unsigned long addr,
- unsigned long pfn);
- int vm_insert_mixed(struct vm_area_struct *vma, unsigned long addr,
- unsigned long pfn);
-+int vm_iomap_memory(struct vm_area_struct *vma, phys_addr_t start, unsigned long len);
-+
-
- struct page *follow_page(struct vm_area_struct *, unsigned long address,
- unsigned int foll_flags);
-@@ -1263,6 +1298,11 @@ void vm_stat_account(struct mm_struct *, unsigned long, struct file *, long);
- static inline void vm_stat_account(struct mm_struct *mm,
- unsigned long flags, struct file *file, long pages)
- {
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(mm->pax_flags & MF_PAX_RANDMMAP) || (flags & (VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)))
-+#endif
-+
-+ mm->total_vm += pages;
- }
- #endif /* CONFIG_PROC_FS */
-
-@@ -1332,7 +1372,13 @@ extern void memory_failure(unsigned long pfn, int trapno);
- extern int __memory_failure(unsigned long pfn, int trapno, int ref);
- extern int sysctl_memory_failure_early_kill;
- extern int sysctl_memory_failure_recovery;
--extern atomic_long_t mce_bad_pages;
-+extern atomic_long_unchecked_t mce_bad_pages;
-+
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+extern void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot);
-+#else
-+static inline void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot) {}
-+#endif
-
- #endif /* __KERNEL__ */
- #endif /* _LINUX_MM_H */
-diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
-index 9d12ed5..6d9707a 100644
---- a/include/linux/mm_types.h
-+++ b/include/linux/mm_types.h
-@@ -186,6 +186,8 @@ struct vm_area_struct {
- #ifdef CONFIG_NUMA
- struct mempolicy *vm_policy; /* NUMA policy for the VMA */
- #endif
-+
-+ struct vm_area_struct *vm_mirror;/* PaX: mirror vma or NULL */
- };
-
- struct core_thread {
-@@ -287,6 +289,24 @@ struct mm_struct {
- #ifdef CONFIG_MMU_NOTIFIER
- struct mmu_notifier_mm *mmu_notifier_mm;
- #endif
-+
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+ unsigned long pax_flags;
-+#endif
-+
-+#ifdef CONFIG_PAX_DLRESOLVE
-+ unsigned long call_dl_resolve;
-+#endif
-+
-+#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
-+ unsigned long call_syscall;
-+#endif
-+
-+#ifdef CONFIG_PAX_ASLR
-+ unsigned long delta_mmap; /* randomized offset */
-+ unsigned long delta_stack; /* randomized offset */
-+#endif
-+
- };
-
- /* Future-safe accessor for struct mm_struct's cpu_vm_mask. */
-diff --git a/include/linux/mmiotrace.h b/include/linux/mmiotrace.h
-index 97491f7..2265523 100644
---- a/include/linux/mmiotrace.h
-+++ b/include/linux/mmiotrace.h
-@@ -46,7 +46,7 @@ extern int kmmio_handler(struct pt_regs *regs, unsigned long addr);
- /* Called from ioremap.c */
- extern void mmiotrace_ioremap(resource_size_t offset, unsigned long size,
- void __iomem *addr);
--extern void mmiotrace_iounmap(volatile void __iomem *addr);
-+extern void mmiotrace_iounmap(const volatile void __iomem *addr);
-
- /* For anyone to insert markers. Remember trailing newline. */
- extern int mmiotrace_printk(const char *fmt, ...)
-@@ -67,7 +67,7 @@ static inline void mmiotrace_ioremap(resource_size_t offset,
- {
- }
-
--static inline void mmiotrace_iounmap(volatile void __iomem *addr)
-+static inline void mmiotrace_iounmap(const volatile void __iomem *addr)
- {
- }
-
-diff --git a/include/linux/mmu_notifier.h b/include/linux/mmu_notifier.h
-index 4e02ee2..afb159e 100644
---- a/include/linux/mmu_notifier.h
-+++ b/include/linux/mmu_notifier.h
-@@ -235,12 +235,12 @@ static inline void mmu_notifier_mm_destroy(struct mm_struct *mm)
- */
- #define ptep_clear_flush_notify(__vma, __address, __ptep) \
- ({ \
-- pte_t __pte; \
-+ pte_t ___pte; \
- struct vm_area_struct *___vma = __vma; \
- unsigned long ___address = __address; \
-- __pte = ptep_clear_flush(___vma, ___address, __ptep); \
-+ ___pte = ptep_clear_flush(___vma, ___address, __ptep); \
- mmu_notifier_invalidate_page(___vma->vm_mm, ___address); \
-- __pte; \
-+ ___pte; \
- })
-
- #define ptep_clear_flush_young_notify(__vma, __address, __ptep) \
-diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
-index 6c31a2a..4b0e930 100644
---- a/include/linux/mmzone.h
-+++ b/include/linux/mmzone.h
-@@ -350,7 +350,7 @@ struct zone {
- unsigned long flags; /* zone flags, see below */
-
- /* Zone statistics */
-- atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
-+ atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
-
- /*
- * prev_priority holds the scanning priority for this zone. It is
-diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
-index f58e9d83..3503935 100644
---- a/include/linux/mod_devicetable.h
-+++ b/include/linux/mod_devicetable.h
-@@ -12,7 +12,7 @@
- typedef unsigned long kernel_ulong_t;
- #endif
-
--#define PCI_ANY_ID (~0)
-+#define PCI_ANY_ID ((__u16)~0)
-
- struct pci_device_id {
- __u32 vendor, device; /* Vendor and device ID or PCI_ANY_ID*/
-@@ -131,7 +131,7 @@ struct usb_device_id {
- #define USB_DEVICE_ID_MATCH_INT_SUBCLASS 0x0100
- #define USB_DEVICE_ID_MATCH_INT_PROTOCOL 0x0200
-
--#define HID_ANY_ID (~0)
-+#define HID_ANY_ID (~0U)
-
- struct hid_device_id {
- __u16 bus;
-diff --git a/include/linux/module.h b/include/linux/module.h
-index 482efc8..4ba6781 100644
---- a/include/linux/module.h
-+++ b/include/linux/module.h
-@@ -16,9 +16,11 @@
- #include <linux/kobject.h>
- #include <linux/moduleparam.h>
- #include <linux/tracepoint.h>
-+#include <linux/fs.h>
-
- #include <asm/local.h>
- #include <asm/module.h>
-+#include <asm/pgtable.h>
-
- #include <trace/events/module.h>
-
-@@ -287,16 +289,16 @@ struct module
- int (*init)(void);
-
- /* If this is non-NULL, vfree after init() returns */
-- void *module_init;
-+ void *module_init_rx, *module_init_rw;
-
- /* Here is the actual code + data, vfree'd on unload. */
-- void *module_core;
-+ void *module_core_rx, *module_core_rw;
-
- /* Here are the sizes of the init and core sections */
-- unsigned int init_size, core_size;
-+ unsigned int init_size_rw, core_size_rw;
-
- /* The size of the executable code in each section. */
-- unsigned int init_text_size, core_text_size;
-+ unsigned int init_size_rx, core_size_rx;
-
- /* Arch-specific module values */
- struct mod_arch_specific arch;
-@@ -345,6 +347,10 @@ struct module
- #ifdef CONFIG_EVENT_TRACING
- struct ftrace_event_call *trace_events;
- unsigned int num_trace_events;
-+ struct file_operations trace_id;
-+ struct file_operations trace_enable;
-+ struct file_operations trace_format;
-+ struct file_operations trace_filter;
- #endif
- #ifdef CONFIG_FTRACE_MCOUNT_RECORD
- unsigned long *ftrace_callsites;
-@@ -393,16 +399,46 @@ struct module *__module_address(unsigned long addr);
- bool is_module_address(unsigned long addr);
- bool is_module_text_address(unsigned long addr);
-
-+static inline int within_module_range(unsigned long addr, void *start, unsigned long size)
-+{
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ if (ktla_ktva(addr) >= (unsigned long)start &&
-+ ktla_ktva(addr) < (unsigned long)start + size)
-+ return 1;
-+#endif
-+
-+ return ((void *)addr >= start && (void *)addr < start + size);
-+}
-+
-+static inline int within_module_core_rx(unsigned long addr, struct module *mod)
-+{
-+ return within_module_range(addr, mod->module_core_rx, mod->core_size_rx);
-+}
-+
-+static inline int within_module_core_rw(unsigned long addr, struct module *mod)
-+{
-+ return within_module_range(addr, mod->module_core_rw, mod->core_size_rw);
-+}
-+
-+static inline int within_module_init_rx(unsigned long addr, struct module *mod)
-+{
-+ return within_module_range(addr, mod->module_init_rx, mod->init_size_rx);
-+}
-+
-+static inline int within_module_init_rw(unsigned long addr, struct module *mod)
-+{
-+ return within_module_range(addr, mod->module_init_rw, mod->init_size_rw);
-+}
-+
- static inline int within_module_core(unsigned long addr, struct module *mod)
- {
-- return (unsigned long)mod->module_core <= addr &&
-- addr < (unsigned long)mod->module_core + mod->core_size;
-+ return within_module_core_rx(addr, mod) || within_module_core_rw(addr, mod);
- }
-
- static inline int within_module_init(unsigned long addr, struct module *mod)
- {
-- return (unsigned long)mod->module_init <= addr &&
-- addr < (unsigned long)mod->module_init + mod->init_size;
-+ return within_module_init_rx(addr, mod) || within_module_init_rw(addr, mod);
- }
-
- /* Search for module by name: must hold module_mutex. */
-diff --git a/include/linux/moduleloader.h b/include/linux/moduleloader.h
-index c1f40c2..f26b93c 100644
---- a/include/linux/moduleloader.h
-+++ b/include/linux/moduleloader.h
-@@ -20,9 +20,21 @@ unsigned int arch_mod_section_prepend(struct module *mod, unsigned int section);
- sections. Returns NULL on failure. */
- void *module_alloc(unsigned long size);
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+void *module_alloc_exec(unsigned long size) __size_overflow(1);
-+#else
-+#define module_alloc_exec(x) module_alloc(x)
-+#endif
-+
- /* Free memory returned from module_alloc. */
- void module_free(struct module *mod, void *module_region);
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+void module_free_exec(struct module *mod, void *module_region);
-+#else
-+#define module_free_exec(x, y) module_free((x), (y))
-+#endif
-+
- /* Apply the given relocation to the (simplified) ELF. Return -error
- or 0. */
- int apply_relocate(Elf_Shdr *sechdrs,
-diff --git a/include/linux/moduleparam.h b/include/linux/moduleparam.h
-index 82a9124..8a5f622 100644
---- a/include/linux/moduleparam.h
-+++ b/include/linux/moduleparam.h
-@@ -132,7 +132,7 @@ struct kparam_array
-
- /* Actually copy string: maxlen param is usually sizeof(string). */
- #define module_param_string(name, string, len, perm) \
-- static const struct kparam_string __param_string_##name \
-+ static const struct kparam_string __param_string_##name __used \
- = { len, string }; \
- __module_param_call(MODULE_PARAM_PREFIX, name, \
- param_set_copystring, param_get_string, \
-@@ -211,7 +211,7 @@ extern int param_get_invbool(char *buffer, struct kernel_param *kp);
-
- /* Comma-separated array: *nump is set to number they actually specified. */
- #define module_param_array_named(name, array, type, nump, perm) \
-- static const struct kparam_array __param_arr_##name \
-+ static const struct kparam_array __param_arr_##name __used \
- = { ARRAY_SIZE(array), nump, param_set_##type, param_get_##type,\
- sizeof(array[0]), array }; \
- __module_param_call(MODULE_PARAM_PREFIX, name, \
-diff --git a/include/linux/mutex.h b/include/linux/mutex.h
-index 878cab4..c92cb3e 100644
---- a/include/linux/mutex.h
-+++ b/include/linux/mutex.h
-@@ -51,7 +51,7 @@ struct mutex {
- spinlock_t wait_lock;
- struct list_head wait_list;
- #if defined(CONFIG_DEBUG_MUTEXES) || defined(CONFIG_SMP)
-- struct thread_info *owner;
-+ struct task_struct *owner;
- #endif
- #ifdef CONFIG_DEBUG_MUTEXES
- const char *name;
-diff --git a/include/linux/namei.h b/include/linux/namei.h
-index ec0f607..fa088ac4 100644
---- a/include/linux/namei.h
-+++ b/include/linux/namei.h
-@@ -22,7 +22,7 @@ struct nameidata {
- unsigned int flags;
- int last_type;
- unsigned depth;
-- char *saved_names[MAX_NESTED_LINKS + 1];
-+ const char *saved_names[MAX_NESTED_LINKS + 1];
-
- /* Intent data */
- union {
-@@ -49,6 +49,8 @@ enum {LAST_NORM, LAST_ROOT, LAST_DOT, LAST_DOTDOT, LAST_BIND};
- #define LOOKUP_CONTINUE 4
- #define LOOKUP_PARENT 16
- #define LOOKUP_REVAL 64
-+#define LOOKUP_SYMLINKOWN 128
-+
- /*
- * Intent data
- */
-@@ -84,12 +86,12 @@ extern int follow_up(struct path *);
- extern struct dentry *lock_rename(struct dentry *, struct dentry *);
- extern void unlock_rename(struct dentry *, struct dentry *);
-
--static inline void nd_set_link(struct nameidata *nd, char *path)
-+static inline void nd_set_link(struct nameidata *nd, const char *path)
- {
- nd->saved_names[nd->depth] = path;
- }
-
--static inline char *nd_get_link(struct nameidata *nd)
-+static inline const char *nd_get_link(const struct nameidata *nd)
- {
- return nd->saved_names[nd->depth];
- }
-diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
-index 9d7e8f7..04428c5 100644
---- a/include/linux/netdevice.h
-+++ b/include/linux/netdevice.h
-@@ -637,6 +637,7 @@ struct net_device_ops {
- u16 xid);
- #endif
- };
-+typedef struct net_device_ops __no_const net_device_ops_no_const;
-
- /*
- * The DEVICE structure.
-diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h
-index 9f00da2..8304ebc 100644
---- a/include/linux/netfilter/nfnetlink.h
-+++ b/include/linux/netfilter/nfnetlink.h
-@@ -62,7 +62,7 @@ struct nfnl_callback
- const struct nlattr * const cda[]);
- const struct nla_policy *policy; /* netlink attribute policy */
- const u_int16_t attr_count; /* number of nlattr's */
--};
-+} __do_const;
-
- struct nfnetlink_subsystem
- {
-diff --git a/include/linux/netfilter/xt_gradm.h b/include/linux/netfilter/xt_gradm.h
-new file mode 100644
-index 0000000..33f4af8
---- /dev/null
-+++ b/include/linux/netfilter/xt_gradm.h
-@@ -0,0 +1,9 @@
-+#ifndef _LINUX_NETFILTER_XT_GRADM_H
-+#define _LINUX_NETFILTER_XT_GRADM_H 1
-+
-+struct xt_gradm_mtinfo {
-+ __u16 flags;
-+ __u16 invflags;
-+};
-+
-+#endif
-diff --git a/include/linux/nodemask.h b/include/linux/nodemask.h
-index b359c4a..c08b334 100644
---- a/include/linux/nodemask.h
-+++ b/include/linux/nodemask.h
-@@ -464,11 +464,11 @@ static inline int num_node_state(enum node_states state)
-
- #define any_online_node(mask) \
- ({ \
-- int node; \
-- for_each_node_mask(node, (mask)) \
-- if (node_online(node)) \
-+ int __node; \
-+ for_each_node_mask(__node, (mask)) \
-+ if (node_online(__node)) \
- break; \
-- node; \
-+ __node; \
- })
-
- #define num_online_nodes() num_node_state(N_ONLINE)
-diff --git a/include/linux/notifier.h b/include/linux/notifier.h
-index 5ecdb50..7b98d41 100644
---- a/include/linux/notifier.h
-+++ b/include/linux/notifier.h
-@@ -51,7 +51,8 @@ struct notifier_block {
- int (*notifier_call)(struct notifier_block *, unsigned long, void *);
- struct notifier_block *next;
- int priority;
--};
-+} __do_const;
-+typedef struct notifier_block __no_const notifier_block_no_const;
-
- struct atomic_notifier_head {
- spinlock_t lock;
-diff --git a/include/linux/oprofile.h b/include/linux/oprofile.h
-index 5171639..7cf4235 100644
---- a/include/linux/oprofile.h
-+++ b/include/linux/oprofile.h
-@@ -129,9 +129,9 @@ int oprofilefs_create_ulong(struct super_block * sb, struct dentry * root,
- int oprofilefs_create_ro_ulong(struct super_block * sb, struct dentry * root,
- char const * name, ulong * val);
-
--/** Create a file for read-only access to an atomic_t. */
-+/** Create a file for read-only access to an atomic_unchecked_t. */
- int oprofilefs_create_ro_atomic(struct super_block * sb, struct dentry * root,
-- char const * name, atomic_t * val);
-+ char const * name, atomic_unchecked_t * val);
-
- /** create a directory */
- struct dentry * oprofilefs_mkdir(struct super_block * sb, struct dentry * root,
-diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h
-index 3c62ed4..8924c7c 100644
---- a/include/linux/pagemap.h
-+++ b/include/linux/pagemap.h
-@@ -425,7 +425,9 @@ static inline int fault_in_pages_readable(const char __user *uaddr, int size)
- if (((unsigned long)uaddr & PAGE_MASK) !=
- ((unsigned long)end & PAGE_MASK))
- ret = __get_user(c, end);
-+ (void)c;
- }
-+ (void)c;
- return ret;
- }
-
-diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
-index 81c9689..a567a55 100644
---- a/include/linux/perf_event.h
-+++ b/include/linux/perf_event.h
-@@ -476,7 +476,7 @@ struct hw_perf_event {
- struct hrtimer hrtimer;
- };
- };
-- atomic64_t prev_count;
-+ atomic64_unchecked_t prev_count;
- u64 sample_period;
- u64 last_period;
- atomic64_t period_left;
-@@ -557,7 +557,7 @@ struct perf_event {
- const struct pmu *pmu;
-
- enum perf_event_active_state state;
-- atomic64_t count;
-+ atomic64_unchecked_t count;
-
- /*
- * These are the total time in nanoseconds that the event
-@@ -595,8 +595,8 @@ struct perf_event {
- * These accumulate total time (in nanoseconds) that children
- * events have been enabled and running, respectively.
- */
-- atomic64_t child_total_time_enabled;
-- atomic64_t child_total_time_running;
-+ atomic64_unchecked_t child_total_time_enabled;
-+ atomic64_unchecked_t child_total_time_running;
-
- /*
- * Protect attach/detach and child_list:
-diff --git a/include/linux/personality.h b/include/linux/personality.h
-index 1261208..ddef96fb 100644
---- a/include/linux/personality.h
-+++ b/include/linux/personality.h
-@@ -43,6 +43,7 @@ enum {
- #define PER_CLEAR_ON_SETID (READ_IMPLIES_EXEC | \
- ADDR_NO_RANDOMIZE | \
- ADDR_COMPAT_LAYOUT | \
-+ ADDR_LIMIT_3GB | \
- MMAP_PAGE_ZERO)
-
- /*
-diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
-index b43a9e0..b77d869 100644
---- a/include/linux/pipe_fs_i.h
-+++ b/include/linux/pipe_fs_i.h
-@@ -46,9 +46,9 @@ struct pipe_inode_info {
- wait_queue_head_t wait;
- unsigned int nrbufs, curbuf;
- struct page *tmp_page;
-- unsigned int readers;
-- unsigned int writers;
-- unsigned int waiting_writers;
-+ atomic_t readers;
-+ atomic_t writers;
-+ atomic_t waiting_writers;
- unsigned int r_counter;
- unsigned int w_counter;
- struct fasync_struct *fasync_readers;
-diff --git a/include/linux/poison.h b/include/linux/poison.h
-index 34066ff..e95d744 100644
---- a/include/linux/poison.h
-+++ b/include/linux/poison.h
-@@ -19,8 +19,8 @@
- * under normal circumstances, used to verify that nobody uses
- * non-initialized list entries.
- */
--#define LIST_POISON1 ((void *) 0x00100100 + POISON_POINTER_DELTA)
--#define LIST_POISON2 ((void *) 0x00200200 + POISON_POINTER_DELTA)
-+#define LIST_POISON1 ((void *) (long)0xFFFFFF01)
-+#define LIST_POISON2 ((void *) (long)0xFFFFFF02)
-
- /********** include/linux/timer.h **********/
- /*
-diff --git a/include/linux/posix-timers.h b/include/linux/posix-timers.h
-index 4f71bf4..724d413 100644
---- a/include/linux/posix-timers.h
-+++ b/include/linux/posix-timers.h
-@@ -82,7 +82,8 @@ struct k_clock {
- #define TIMER_RETRY 1
- void (*timer_get) (struct k_itimer * timr,
- struct itimerspec * cur_setting);
--};
-+} __do_const;
-+typedef struct k_clock __no_const k_clock_no_const;
-
- void register_posix_clock(const clockid_t clock_id, struct k_clock *new_clock);
-
-@@ -117,6 +118,6 @@ void set_process_cpu_timer(struct task_struct *task, unsigned int clock_idx,
-
- long clock_nanosleep_restart(struct restart_block *restart_block);
-
--void update_rlimit_cpu(unsigned long rlim_new);
-+void update_rlimit_cpu(struct task_struct *task, unsigned long rlim_new);
-
- #endif
-diff --git a/include/linux/prefetch.h b/include/linux/prefetch.h
-index af7c36a..a93005c 100644
---- a/include/linux/prefetch.h
-+++ b/include/linux/prefetch.h
-@@ -11,6 +11,7 @@
- #define _LINUX_PREFETCH_H
-
- #include <linux/types.h>
-+#include <linux/const.h>
- #include <asm/processor.h>
- #include <asm/cache.h>
-
-diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h
-index 379eaed..3471a57 100644
---- a/include/linux/proc_fs.h
-+++ b/include/linux/proc_fs.h
-@@ -155,6 +155,19 @@ static inline struct proc_dir_entry *proc_create(const char *name, mode_t mode,
- return proc_create_data(name, mode, parent, proc_fops, NULL);
- }
-
-+static inline struct proc_dir_entry *proc_create_grsec(const char *name, mode_t mode,
-+ struct proc_dir_entry *parent, const struct file_operations *proc_fops)
-+{
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+ return proc_create_data(name, S_IRUSR, parent, proc_fops, NULL);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ return proc_create_data(name, S_IRUSR | S_IRGRP, parent, proc_fops, NULL);
-+#else
-+ return proc_create_data(name, mode, parent, proc_fops, NULL);
-+#endif
-+}
-+
-+
- static inline struct proc_dir_entry *create_proc_read_entry(const char *name,
- mode_t mode, struct proc_dir_entry *base,
- read_proc_t *read_proc, void * data)
-diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h
-index 7456d7d..6c1cfc9 100644
---- a/include/linux/ptrace.h
-+++ b/include/linux/ptrace.h
-@@ -96,10 +96,10 @@ extern void __ptrace_unlink(struct task_struct *child);
- extern void exit_ptrace(struct task_struct *tracer);
- #define PTRACE_MODE_READ 1
- #define PTRACE_MODE_ATTACH 2
--/* Returns 0 on success, -errno on denial. */
--extern int __ptrace_may_access(struct task_struct *task, unsigned int mode);
- /* Returns true on success, false on denial. */
- extern bool ptrace_may_access(struct task_struct *task, unsigned int mode);
-+/* Returns true on success, false on denial. */
-+extern bool ptrace_may_access_log(struct task_struct *task, unsigned int mode);
-
- static inline int ptrace_reparented(struct task_struct *child)
- {
-diff --git a/include/linux/random.h b/include/linux/random.h
-index 1864957..491144d 100644
---- a/include/linux/random.h
-+++ b/include/linux/random.h
-@@ -76,6 +76,11 @@ static inline int arch_get_random_int(unsigned int *v)
- }
- #endif
-
-+static inline unsigned long pax_get_random_long(void)
-+{
-+ return random32() + (sizeof(long) > 4 ? (unsigned long)random32() << 32 : 0);
-+}
-+
- #endif /* __KERNEL___ */
-
- #endif /* _LINUX_RANDOM_H */
-diff --git a/include/linux/reboot.h b/include/linux/reboot.h
-index 988e55f..17cb4ef 100644
---- a/include/linux/reboot.h
-+++ b/include/linux/reboot.h
-@@ -47,9 +47,9 @@ extern int unregister_reboot_notifier(struct notifier_block *);
- * Architecture-specific implementations of sys_reboot commands.
- */
-
--extern void machine_restart(char *cmd);
--extern void machine_halt(void);
--extern void machine_power_off(void);
-+extern void machine_restart(char *cmd) __noreturn;
-+extern void machine_halt(void) __noreturn;
-+extern void machine_power_off(void) __noreturn;
-
- extern void machine_shutdown(void);
- struct pt_regs;
-@@ -60,9 +60,9 @@ extern void machine_crash_shutdown(struct pt_regs *);
- */
-
- extern void kernel_restart_prepare(char *cmd);
--extern void kernel_restart(char *cmd);
--extern void kernel_halt(void);
--extern void kernel_power_off(void);
-+extern void kernel_restart(char *cmd) __noreturn;
-+extern void kernel_halt(void) __noreturn;
-+extern void kernel_power_off(void) __noreturn;
-
- void ctrl_alt_del(void);
-
-@@ -75,7 +75,7 @@ extern int orderly_poweroff(bool force);
- * Emergency restart, callable from an interrupt handler.
- */
-
--extern void emergency_restart(void);
-+extern void emergency_restart(void) __noreturn;
- #include <asm/emergency-restart.h>
-
- #endif
-diff --git a/include/linux/regset.h b/include/linux/regset.h
-index 686f373..a72ed78 100644
---- a/include/linux/regset.h
-+++ b/include/linux/regset.h
-@@ -160,7 +160,7 @@ struct user_regset {
- unsigned int align;
- unsigned int bias;
- unsigned int core_note_type;
--};
-+} __do_const;
-
- /**
- * struct user_regset_view - available regsets
-diff --git a/include/linux/reiserfs_fs.h b/include/linux/reiserfs_fs.h
-index dd31e7b..5b03c5c 100644
---- a/include/linux/reiserfs_fs.h
-+++ b/include/linux/reiserfs_fs.h
-@@ -1326,7 +1326,7 @@ static inline loff_t max_reiserfs_offset(struct inode *inode)
- #define REISERFS_USER_MEM 1 /* reiserfs user memory mode */
-
- #define fs_generation(s) (REISERFS_SB(s)->s_generation_counter)
--#define get_generation(s) atomic_read (&fs_generation(s))
-+#define get_generation(s) atomic_read_unchecked (&fs_generation(s))
- #define FILESYSTEM_CHANGED_TB(tb) (get_generation((tb)->tb_sb) != (tb)->fs_gen)
- #define __fs_changed(gen,s) (gen != get_generation (s))
- #define fs_changed(gen,s) ({cond_resched(); __fs_changed(gen, s);})
-@@ -1534,24 +1534,24 @@ static inline struct super_block *sb_from_bi(struct buffer_info *bi)
- */
-
- struct item_operations {
-- int (*bytes_number) (struct item_head * ih, int block_size);
-- void (*decrement_key) (struct cpu_key *);
-- int (*is_left_mergeable) (struct reiserfs_key * ih,
-+ int (* const bytes_number) (struct item_head * ih, int block_size);
-+ void (* const decrement_key) (struct cpu_key *);
-+ int (* const is_left_mergeable) (struct reiserfs_key * ih,
- unsigned long bsize);
-- void (*print_item) (struct item_head *, char *item);
-- void (*check_item) (struct item_head *, char *item);
-+ void (* const print_item) (struct item_head *, char *item);
-+ void (* const check_item) (struct item_head *, char *item);
-
-- int (*create_vi) (struct virtual_node * vn, struct virtual_item * vi,
-+ int (* const create_vi) (struct virtual_node * vn, struct virtual_item * vi,
- int is_affected, int insert_size);
-- int (*check_left) (struct virtual_item * vi, int free,
-+ int (* const check_left) (struct virtual_item * vi, int free,
- int start_skip, int end_skip);
-- int (*check_right) (struct virtual_item * vi, int free);
-- int (*part_size) (struct virtual_item * vi, int from, int to);
-- int (*unit_num) (struct virtual_item * vi);
-- void (*print_vi) (struct virtual_item * vi);
-+ int (* const check_right) (struct virtual_item * vi, int free);
-+ int (* const part_size) (struct virtual_item * vi, int from, int to);
-+ int (* const unit_num) (struct virtual_item * vi);
-+ void (* const print_vi) (struct virtual_item * vi);
- };
-
--extern struct item_operations *item_ops[TYPE_ANY + 1];
-+extern const struct item_operations * const item_ops[TYPE_ANY + 1];
-
- #define op_bytes_number(ih,bsize) item_ops[le_ih_k_type (ih)]->bytes_number (ih, bsize)
- #define op_is_left_mergeable(key,bsize) item_ops[le_key_k_type (le_key_version (key), key)]->is_left_mergeable (key, bsize)
-diff --git a/include/linux/reiserfs_fs_sb.h b/include/linux/reiserfs_fs_sb.h
-index dab68bb..0688727 100644
---- a/include/linux/reiserfs_fs_sb.h
-+++ b/include/linux/reiserfs_fs_sb.h
-@@ -377,7 +377,7 @@ struct reiserfs_sb_info {
- /* Comment? -Hans */
- wait_queue_head_t s_wait;
- /* To be obsoleted soon by per buffer seals.. -Hans */
-- atomic_t s_generation_counter; // increased by one every time the
-+ atomic_unchecked_t s_generation_counter; // increased by one every time the
- // tree gets re-balanced
- unsigned long s_properties; /* File system properties. Currently holds
- on-disk FS format */
-diff --git a/include/linux/relay.h b/include/linux/relay.h
-index 14a86bc..17d0700 100644
---- a/include/linux/relay.h
-+++ b/include/linux/relay.h
-@@ -159,7 +159,7 @@ struct rchan_callbacks
- * The callback should return 0 if successful, negative if not.
- */
- int (*remove_buf_file)(struct dentry *dentry);
--};
-+} __no_const;
-
- /*
- * CONFIG_RELAY kernel API, kernel/relay.c
-diff --git a/include/linux/sched.h b/include/linux/sched.h
-index 73c3b9b..3bdf669 100644
---- a/include/linux/sched.h
-+++ b/include/linux/sched.h
-@@ -101,6 +101,7 @@ struct bio;
- struct fs_struct;
- struct bts_context;
- struct perf_event_context;
-+struct linux_binprm;
-
- /*
- * List of flags we want to share for kernel threads,
-@@ -350,7 +351,7 @@ extern signed long schedule_timeout_killable(signed long timeout);
- extern signed long schedule_timeout_uninterruptible(signed long timeout);
- asmlinkage void __schedule(void);
- asmlinkage void schedule(void);
--extern int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner);
-+extern int mutex_spin_on_owner(struct mutex *lock, struct task_struct *owner);
-
- struct nsproxy;
- struct user_namespace;
-@@ -371,9 +372,21 @@ struct user_namespace;
- #define DEFAULT_MAX_MAP_COUNT (USHORT_MAX - MAPCOUNT_ELF_CORE_MARGIN)
-
- extern int sysctl_max_map_count;
-+extern unsigned long sysctl_heap_stack_gap;
-
- #include <linux/aio.h>
-
-+#ifdef CONFIG_GRKERNSEC_RAND_THREADSTACK
-+extern unsigned long gr_rand_threadstack_offset(const struct mm_struct *mm, const struct file *filp, unsigned long flags);
-+#else
-+static inline unsigned long gr_rand_threadstack_offset(const struct mm_struct *mm, const struct file *filp, unsigned long flags)
-+{
-+ return 0;
-+}
-+#endif
-+
-+extern bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long *addr, unsigned long len, unsigned long offset);
-+extern unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len, unsigned long offset);
- extern unsigned long
- arch_get_unmapped_area(struct file *, unsigned long, unsigned long,
- unsigned long, unsigned long);
-@@ -442,6 +455,10 @@ static inline unsigned long get_mm_hiwater_vm(struct mm_struct *mm)
- extern void set_dumpable(struct mm_struct *mm, int value);
- extern int get_dumpable(struct mm_struct *mm);
-
-+#define SUID_DUMP_DISABLE 0 /* No setuid dumping */
-+#define SUID_DUMP_USER 1 /* Dump as user of process */
-+#define SUID_DUMP_ROOT 2 /* Dump as root */
-+
- /* mm flags */
- /* dumpable bits */
- #define MMF_DUMPABLE 0 /* core dump is permitted */
-@@ -666,7 +683,20 @@ struct signal_struct {
- struct tty_audit_buf *tty_audit_buf;
- #endif
-
-+#ifdef CONFIG_GRKERNSEC
-+ u32 curr_ip;
-+ u32 saved_ip;
-+ u32 gr_saddr;
-+ u32 gr_daddr;
-+ u16 gr_sport;
-+ u16 gr_dport;
-+ u8 used_accept:1;
-+#endif
-+
- int oom_adj; /* OOM kill score adjustment (bit shift) */
-+ struct mutex cred_guard_mutex; /* guard against foreign influences on
-+ * credential calculations
-+ * (notably. ptrace) */
- };
-
- /* Context switch must be unlocked if interrupts are to be enabled */
-@@ -723,6 +753,14 @@ struct user_struct {
- struct key *session_keyring; /* UID's default session keyring */
- #endif
-
-+#ifdef CONFIG_GRKERNSEC_KERN_LOCKOUT
-+ unsigned char kernel_banned;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_BRUTE
-+ unsigned char suid_banned;
-+ unsigned long suid_ban_expires;
-+#endif
-+
- /* Hash table maintenance information */
- struct hlist_node uidhash_node;
- uid_t uid;
-@@ -1328,8 +1366,8 @@ struct task_struct {
- struct list_head thread_group;
-
- struct completion *vfork_done; /* for vfork() */
-- int __user *set_child_tid; /* CLONE_CHILD_SETTID */
-- int __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
-+ pid_t __user *set_child_tid; /* CLONE_CHILD_SETTID */
-+ pid_t __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
-
- cputime_t utime, stime, utimescaled, stimescaled;
- cputime_t gtime;
-@@ -1343,16 +1381,6 @@ struct task_struct {
- struct task_cputime cputime_expires;
- struct list_head cpu_timers[3];
-
--/* process credentials */
-- const struct cred *real_cred; /* objective and real subjective task
-- * credentials (COW) */
-- const struct cred *cred; /* effective (overridable) subjective task
-- * credentials (COW) */
-- struct mutex cred_guard_mutex; /* guard against foreign influences on
-- * credential calculations
-- * (notably. ptrace) */
-- struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
--
- char comm[TASK_COMM_LEN]; /* executable name excluding path
- - access with [gs]et_task_comm (which lock
- it with task_lock())
-@@ -1369,6 +1397,10 @@ struct task_struct {
- #endif
- /* CPU-specific state of this task */
- struct thread_struct thread;
-+/* thread_info moved to task_struct */
-+#ifdef CONFIG_X86
-+ struct thread_info tinfo;
-+#endif
- /* filesystem information */
- struct fs_struct *fs;
- /* open file information */
-@@ -1436,6 +1468,12 @@ struct task_struct {
- int hardirq_context;
- int softirq_context;
- #endif
-+
-+/* process credentials */
-+ const struct cred *real_cred; /* objective and real subjective task
-+ * credentials (COW) */
-+ struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
-+
- #ifdef CONFIG_LOCKDEP
- # define MAX_LOCK_DEPTH 48UL
- u64 curr_chain_key;
-@@ -1456,6 +1494,9 @@ struct task_struct {
-
- struct backing_dev_info *backing_dev_info;
-
-+ const struct cred *cred; /* effective (overridable) subjective task
-+ * credentials (COW) */
-+
- struct io_context *io_context;
-
- unsigned long ptrace_message;
-@@ -1519,6 +1560,28 @@ struct task_struct {
- unsigned long default_timer_slack_ns;
-
- struct list_head *scm_work_list;
-+
-+#ifdef CONFIG_GRKERNSEC
-+ /* grsecurity */
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ u64 exec_id;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+ const struct cred *delayed_cred;
-+#endif
-+ struct dentry *gr_chroot_dentry;
-+ struct acl_subject_label *acl;
-+ struct acl_role_label *role;
-+ struct file *exec_file;
-+ unsigned long brute_expires;
-+ u16 acl_role_id;
-+ /* is this the task that authenticated to the special role */
-+ u8 acl_sp_role;
-+ u8 is_writable;
-+ u8 brute;
-+ u8 gr_is_chrooted;
-+#endif
-+
- #ifdef CONFIG_FUNCTION_GRAPH_TRACER
- /* Index of current stored adress in ret_stack */
- int curr_ret_stack;
-@@ -1542,6 +1605,56 @@ struct task_struct {
- #endif /* CONFIG_TRACING */
- };
-
-+#define MF_PAX_PAGEEXEC 0x01000000 /* Paging based non-executable pages */
-+#define MF_PAX_EMUTRAMP 0x02000000 /* Emulate trampolines */
-+#define MF_PAX_MPROTECT 0x04000000 /* Restrict mprotect() */
-+#define MF_PAX_RANDMMAP 0x08000000 /* Randomize mmap() base */
-+/*#define MF_PAX_RANDEXEC 0x10000000*/ /* Randomize ET_EXEC base */
-+#define MF_PAX_SEGMEXEC 0x20000000 /* Segmentation based non-executable pages */
-+
-+#ifdef CONFIG_PAX_SOFTMODE
-+extern int pax_softmode;
-+#endif
-+
-+extern int pax_check_flags(unsigned long *);
-+
-+/* if tsk != current then task_lock must be held on it */
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+static inline unsigned long pax_get_flags(struct task_struct *tsk)
-+{
-+ if (likely(tsk->mm))
-+ return tsk->mm->pax_flags;
-+ else
-+ return 0UL;
-+}
-+
-+/* if tsk != current then task_lock must be held on it */
-+static inline long pax_set_flags(struct task_struct *tsk, unsigned long flags)
-+{
-+ if (likely(tsk->mm)) {
-+ tsk->mm->pax_flags = flags;
-+ return 0;
-+ }
-+ return -EINVAL;
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
-+extern void pax_set_initial_flags(struct linux_binprm *bprm);
-+#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
-+extern void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
-+#endif
-+
-+extern void pax_report_fault(struct pt_regs *regs, void *pc, void *sp);
-+extern void pax_report_insns(struct pt_regs *regs, void *pc, void *sp);
-+extern void pax_report_refcount_overflow(struct pt_regs *regs);
-+
-+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
-+extern void pax_track_stack(void);
-+#else
-+static inline void pax_track_stack(void) {}
-+#endif
-+
- /* Future-safe accessor for struct task_struct's cpus_allowed. */
- #define tsk_cpumask(tsk) (&(tsk)->cpus_allowed)
-
-@@ -1740,7 +1853,7 @@ extern void thread_group_times(struct task_struct *p, cputime_t *ut, cputime_t *
- #define PF_DUMPCORE 0x00000200 /* dumped core */
- #define PF_SIGNALED 0x00000400 /* killed by a signal */
- #define PF_MEMALLOC 0x00000800 /* Allocating memory */
--#define PF_FLUSHER 0x00001000 /* responsible for disk writeback */
-+#define PF_NPROC_EXCEEDED 0x00001000 /* set_user noticed that RLIMIT_NPROC was exceeded */
- #define PF_USED_MATH 0x00002000 /* if unset the fpu must be initialized before use */
- #define PF_FREEZING 0x00004000 /* freeze in progress. do not account to load */
- #define PF_NOFREEZE 0x00008000 /* this thread should not be frozen */
-@@ -1978,7 +2091,9 @@ void yield(void);
- extern struct exec_domain default_exec_domain;
-
- union thread_union {
-+#ifndef CONFIG_X86
- struct thread_info thread_info;
-+#endif
- unsigned long stack[THREAD_SIZE/sizeof(long)];
- };
-
-@@ -2011,6 +2126,7 @@ extern struct pid_namespace init_pid_ns;
- */
-
- extern struct task_struct *find_task_by_vpid(pid_t nr);
-+extern struct task_struct *find_task_by_vpid_unrestricted(pid_t nr);
- extern struct task_struct *find_task_by_pid_ns(pid_t nr,
- struct pid_namespace *ns);
-
-@@ -2155,7 +2271,7 @@ extern void __cleanup_sighand(struct sighand_struct *);
- extern void exit_itimers(struct signal_struct *);
- extern void flush_itimer_signals(void);
-
--extern NORET_TYPE void do_group_exit(int);
-+extern __noreturn void do_group_exit(int);
-
- extern void daemonize(const char *, ...);
- extern int allow_signal(int);
-@@ -2284,9 +2400,9 @@ static inline unsigned long *end_of_stack(struct task_struct *p)
-
- #endif
-
--static inline int object_is_on_stack(void *obj)
-+static inline int object_starts_on_stack(void *obj)
- {
-- void *stack = task_stack_page(current);
-+ const void *stack = task_stack_page(current);
-
- return (obj >= stack) && (obj < (stack + THREAD_SIZE));
- }
-@@ -2625,6 +2741,23 @@ static inline unsigned long rlimit_max(unsigned int limit)
- return task_rlimit_max(current, limit);
- }
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+DECLARE_PER_CPU(u64, exec_counter);
-+static inline void increment_exec_counter(void)
-+{
-+ unsigned int cpu;
-+ u64 *exec_id_ptr;
-+ BUILD_BUG_ON(NR_CPUS > (1 << 16));
-+ cpu = get_cpu();
-+ exec_id_ptr = &per_cpu(exec_counter, cpu);
-+ *exec_id_ptr += 1ULL << 16;
-+ current->exec_id = *exec_id_ptr;
-+ put_cpu();
-+}
-+#else
-+static inline void increment_exec_counter(void) {}
-+#endif
-+
- #endif /* __KERNEL__ */
-
- #endif
-diff --git a/include/linux/screen_info.h b/include/linux/screen_info.h
-index 1ee2c05..81b7ec4 100644
---- a/include/linux/screen_info.h
-+++ b/include/linux/screen_info.h
-@@ -42,7 +42,8 @@ struct screen_info {
- __u16 pages; /* 0x32 */
- __u16 vesa_attributes; /* 0x34 */
- __u32 capabilities; /* 0x36 */
-- __u8 _reserved[6]; /* 0x3a */
-+ __u16 vesapm_size; /* 0x3a */
-+ __u8 _reserved[4]; /* 0x3c */
- } __attribute__((packed));
-
- #define VIDEO_TYPE_MDA 0x10 /* Monochrome Text Display */
-diff --git a/include/linux/security.h b/include/linux/security.h
-index d40d23f..7bef69e 100644
---- a/include/linux/security.h
-+++ b/include/linux/security.h
-@@ -34,6 +34,7 @@
- #include <linux/key.h>
- #include <linux/xfrm.h>
- #include <linux/gfp.h>
-+#include <linux/grsecurity.h>
- #include <net/flow.h>
-
- /* Maximum number of letters for an LSM name string */
-@@ -76,7 +77,7 @@ extern int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
- extern int cap_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp);
- extern int cap_task_setioprio(struct task_struct *p, int ioprio);
- extern int cap_task_setnice(struct task_struct *p, int nice);
--extern int cap_syslog(int type);
-+extern int cap_syslog(int type, bool from_file);
- extern int cap_vm_enough_memory(struct mm_struct *mm, long pages);
-
- struct msghdr;
-@@ -1331,6 +1332,7 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
- * logging to the console.
- * See the syslog(2) manual page for an explanation of the @type values.
- * @type contains the type of action.
-+ * @from_file indicates the context of action (if it came from /proc).
- * Return 0 if permission is granted.
- * @settime:
- * Check permission to change the system time.
-@@ -1445,7 +1447,7 @@ struct security_operations {
- int (*sysctl) (struct ctl_table *table, int op);
- int (*quotactl) (int cmds, int type, int id, struct super_block *sb);
- int (*quota_on) (struct dentry *dentry);
-- int (*syslog) (int type);
-+ int (*syslog) (int type, bool from_file);
- int (*settime) (struct timespec *ts, struct timezone *tz);
- int (*vm_enough_memory) (struct mm_struct *mm, long pages);
-
-@@ -1734,13 +1736,14 @@ int security_capset(struct cred *new, const struct cred *old,
- const kernel_cap_t *inheritable,
- const kernel_cap_t *permitted);
- int security_capable(int cap);
-+int security_capable_noaudit(int cap);
- int security_real_capable(struct task_struct *tsk, int cap);
- int security_real_capable_noaudit(struct task_struct *tsk, int cap);
- int security_acct(struct file *file);
- int security_sysctl(struct ctl_table *table, int op);
- int security_quotactl(int cmds, int type, int id, struct super_block *sb);
- int security_quota_on(struct dentry *dentry);
--int security_syslog(int type);
-+int security_syslog(int type, bool from_file);
- int security_settime(struct timespec *ts, struct timezone *tz);
- int security_vm_enough_memory(long pages);
- int security_vm_enough_memory_mm(struct mm_struct *mm, long pages);
-@@ -1943,6 +1946,11 @@ static inline int security_capable(int cap)
- return cap_capable(current, current_cred(), cap, SECURITY_CAP_AUDIT);
- }
-
-+static inline int security_capable_noaudit(int cap)
-+{
-+ return cap_capable(current, current_cred(), cap, SECURITY_CAP_NOAUDIT);
-+}
-+
- static inline int security_real_capable(struct task_struct *tsk, int cap)
- {
- int ret;
-@@ -1986,9 +1994,9 @@ static inline int security_quota_on(struct dentry *dentry)
- return 0;
- }
-
--static inline int security_syslog(int type)
-+static inline int security_syslog(int type, bool from_file)
- {
-- return cap_syslog(type);
-+ return cap_syslog(type, from_file);
- }
-
- static inline int security_settime(struct timespec *ts, struct timezone *tz)
-diff --git a/include/linux/seq_file.h b/include/linux/seq_file.h
-index 8366d8f..cc5f9d6 100644
---- a/include/linux/seq_file.h
-+++ b/include/linux/seq_file.h
-@@ -23,6 +23,9 @@ struct seq_file {
- u64 version;
- struct mutex lock;
- const struct seq_operations *op;
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ u64 exec_id;
-+#endif
- void *private;
- };
-
-@@ -32,6 +35,7 @@ struct seq_operations {
- void * (*next) (struct seq_file *m, void *v, loff_t *pos);
- int (*show) (struct seq_file *m, void *v);
- };
-+typedef struct seq_operations __no_const seq_operations_no_const;
-
- #define SEQ_SKIP 1
-
-diff --git a/include/linux/shm.h b/include/linux/shm.h
-index eca6235..c7417ed 100644
---- a/include/linux/shm.h
-+++ b/include/linux/shm.h
-@@ -95,6 +95,10 @@ struct shmid_kernel /* private to the kernel */
- pid_t shm_cprid;
- pid_t shm_lprid;
- struct user_struct *mlock_user;
-+#ifdef CONFIG_GRKERNSEC
-+ time_t shm_createtime;
-+ pid_t shm_lapid;
-+#endif
- };
-
- /* shm_mode upper byte flags */
-diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
-index 4e647bb..e33c585 100644
---- a/include/linux/skbuff.h
-+++ b/include/linux/skbuff.h
-@@ -14,6 +14,7 @@
- #ifndef _LINUX_SKBUFF_H
- #define _LINUX_SKBUFF_H
-
-+#include <linux/const.h>
- #include <linux/kernel.h>
- #include <linux/kmemcheck.h>
- #include <linux/compiler.h>
-@@ -442,7 +443,7 @@ extern void consume_skb(struct sk_buff *skb);
- extern void __kfree_skb(struct sk_buff *skb);
- extern struct sk_buff *__alloc_skb(unsigned int size,
- gfp_t priority, int fclone, int node);
--static inline struct sk_buff *alloc_skb(unsigned int size,
-+static inline struct sk_buff * __intentional_overflow(0) alloc_skb(unsigned int size,
- gfp_t priority)
- {
- return __alloc_skb(size, priority, 0, -1);
-@@ -544,7 +545,7 @@ static inline union skb_shared_tx *skb_tx(struct sk_buff *skb)
- */
- static inline int skb_queue_empty(const struct sk_buff_head *list)
- {
-- return list->next == (struct sk_buff *)list;
-+ return list->next == (const struct sk_buff *)list;
- }
-
- /**
-@@ -557,7 +558,7 @@ static inline int skb_queue_empty(const struct sk_buff_head *list)
- static inline bool skb_queue_is_last(const struct sk_buff_head *list,
- const struct sk_buff *skb)
- {
-- return (skb->next == (struct sk_buff *) list);
-+ return (skb->next == (const struct sk_buff *) list);
- }
-
- /**
-@@ -570,7 +571,7 @@ static inline bool skb_queue_is_last(const struct sk_buff_head *list,
- static inline bool skb_queue_is_first(const struct sk_buff_head *list,
- const struct sk_buff *skb)
- {
-- return (skb->prev == (struct sk_buff *) list);
-+ return (skb->prev == (const struct sk_buff *) list);
- }
-
- /**
-@@ -1377,7 +1378,7 @@ static inline int skb_network_offset(const struct sk_buff *skb)
- * headroom, you should not reduce this.
- */
- #ifndef NET_SKB_PAD
--#define NET_SKB_PAD 32
-+#define NET_SKB_PAD (_AC(32,UL))
- #endif
-
- extern int ___pskb_trim(struct sk_buff *skb, unsigned int len);
-@@ -1499,6 +1500,22 @@ static inline struct sk_buff *netdev_alloc_skb(struct net_device *dev,
- return __netdev_alloc_skb(dev, length, GFP_ATOMIC);
- }
-
-+static inline struct sk_buff *__netdev_alloc_skb_ip_align(struct net_device *dev,
-+ unsigned int length, gfp_t gfp)
-+{
-+ struct sk_buff *skb = __netdev_alloc_skb(dev, length + NET_IP_ALIGN, gfp);
-+
-+ if (NET_IP_ALIGN && skb)
-+ skb_reserve(skb, NET_IP_ALIGN);
-+ return skb;
-+}
-+
-+static inline struct sk_buff *netdev_alloc_skb_ip_align(struct net_device *dev,
-+ unsigned int length)
-+{
-+ return __netdev_alloc_skb_ip_align(dev, length, GFP_ATOMIC);
-+}
-+
- extern struct page *__netdev_alloc_page(struct net_device *dev, gfp_t gfp_mask);
-
- /**
-@@ -1750,7 +1767,7 @@ extern struct sk_buff *skb_recv_datagram(struct sock *sk, unsigned flags,
- int noblock, int *err);
- extern unsigned int datagram_poll(struct file *file, struct socket *sock,
- struct poll_table_struct *wait);
--extern int skb_copy_datagram_iovec(const struct sk_buff *from,
-+extern int __intentional_overflow(0) skb_copy_datagram_iovec(const struct sk_buff *from,
- int offset, struct iovec *to,
- int size);
- extern int skb_copy_and_csum_datagram_iovec(struct sk_buff *skb,
-@@ -1970,6 +1987,9 @@ static inline void nf_reset(struct sk_buff *skb)
- nf_bridge_put(skb->nf_bridge);
- skb->nf_bridge = NULL;
- #endif
-+#if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
-+ skb->nf_trace = 0;
-+#endif
- }
-
- /* Note: This doesn't put any conntrack and bridge info in dst. */
-diff --git a/include/linux/slab.h b/include/linux/slab.h
-index 2da8372..aa58826 100644
---- a/include/linux/slab.h
-+++ b/include/linux/slab.h
-@@ -11,12 +11,20 @@
-
- #include <linux/gfp.h>
- #include <linux/types.h>
-+#include <linux/err.h>
-
- /*
- * Flags to pass to kmem_cache_create().
- * The ones marked DEBUG are only valid if CONFIG_SLAB_DEBUG is set.
- */
- #define SLAB_DEBUG_FREE 0x00000100UL /* DEBUG: Perform (expensive) checks on free */
-+
-+#ifdef CONFIG_PAX_USERCOPY_SLABS
-+#define SLAB_USERCOPY 0x00000200UL /* PaX: Allow copying objs to/from userland */
-+#else
-+#define SLAB_USERCOPY 0x00000000UL
-+#endif
-+
- #define SLAB_RED_ZONE 0x00000400UL /* DEBUG: Red zone objs in a cache */
- #define SLAB_POISON 0x00000800UL /* DEBUG: Poison objects */
- #define SLAB_HWCACHE_ALIGN 0x00002000UL /* Align objs on cache lines */
-@@ -82,10 +90,13 @@
- * ZERO_SIZE_PTR can be passed to kfree though in the same way that NULL can.
- * Both make kfree a no-op.
- */
--#define ZERO_SIZE_PTR ((void *)16)
-+#define ZERO_SIZE_PTR \
-+({ \
-+ BUILD_BUG_ON(!(MAX_ERRNO & ~PAGE_MASK));\
-+ (void *)(-MAX_ERRNO-1L); \
-+})
-
--#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) <= \
-- (unsigned long)ZERO_SIZE_PTR)
-+#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) - 1 >= (unsigned long)ZERO_SIZE_PTR - 1)
-
- /*
- * struct kmem_cache related prototypes
-@@ -138,6 +149,8 @@ void * __must_check krealloc(const void *, size_t, gfp_t);
- void kfree(const void *);
- void kzfree(const void *);
- size_t ksize(const void *);
-+const char *check_heap_object(const void *ptr, unsigned long n);
-+bool is_usercopy_object(const void *ptr);
-
- /*
- * Allocator specific definitions. These are mainly used to establish optimized
-@@ -217,6 +230,7 @@ size_t ksize(const void *);
- * for general use, and so are not documented here. For a full list of
- * potential flags, always refer to linux/gfp.h.
- */
-+
- static inline void *kcalloc(size_t n, size_t size, gfp_t flags)
- {
- if (size != 0 && n > ULONG_MAX / size)
-@@ -263,7 +277,7 @@ static inline void *kmem_cache_alloc_node(struct kmem_cache *cachep,
- * request comes from.
- */
- #if defined(CONFIG_DEBUG_SLAB) || defined(CONFIG_SLUB)
--extern void *__kmalloc_track_caller(size_t, gfp_t, unsigned long);
-+extern void *__kmalloc_track_caller(size_t, gfp_t, unsigned long) __size_overflow(1);
- #define kmalloc_track_caller(size, flags) \
- __kmalloc_track_caller(size, flags, _RET_IP_)
- #else
-@@ -281,7 +295,7 @@ extern void *__kmalloc_track_caller(size_t, gfp_t, unsigned long);
- * allocation request comes from.
- */
- #if defined(CONFIG_DEBUG_SLAB) || defined(CONFIG_SLUB)
--extern void *__kmalloc_node_track_caller(size_t, gfp_t, int, unsigned long);
-+extern void *__kmalloc_node_track_caller(size_t, gfp_t, int, unsigned long) __size_overflow(1);
- #define kmalloc_node_track_caller(size, flags, node) \
- __kmalloc_node_track_caller(size, flags, node, \
- _RET_IP_)
-diff --git a/include/linux/slab_def.h b/include/linux/slab_def.h
-index 850d057..aa58075 100644
---- a/include/linux/slab_def.h
-+++ b/include/linux/slab_def.h
-@@ -69,10 +69,10 @@ struct kmem_cache {
- unsigned long node_allocs;
- unsigned long node_frees;
- unsigned long node_overflow;
-- atomic_t allochit;
-- atomic_t allocmiss;
-- atomic_t freehit;
-- atomic_t freemiss;
-+ atomic_unchecked_t allochit;
-+ atomic_unchecked_t allocmiss;
-+ atomic_unchecked_t freehit;
-+ atomic_unchecked_t freemiss;
-
- /*
- * If debugging is enabled, then the allocator can add additional
-@@ -104,11 +104,16 @@ struct cache_sizes {
- #ifdef CONFIG_ZONE_DMA
- struct kmem_cache *cs_dmacachep;
- #endif
-+
-+#ifdef CONFIG_PAX_USERCOPY_SLABS
-+ struct kmem_cache *cs_usercopycachep;
-+#endif
-+
- };
- extern struct cache_sizes malloc_sizes[];
-
- void *kmem_cache_alloc(struct kmem_cache *, gfp_t);
--void *__kmalloc(size_t size, gfp_t flags);
-+void *__kmalloc(size_t size, gfp_t flags) __size_overflow(1);
-
- #ifdef CONFIG_KMEMTRACE
- extern void *kmem_cache_alloc_notrace(struct kmem_cache *cachep, gfp_t flags);
-@@ -150,6 +155,13 @@ found:
- cachep = malloc_sizes[i].cs_dmacachep;
- else
- #endif
-+
-+#ifdef CONFIG_PAX_USERCOPY_SLABS
-+ if (flags & GFP_USERCOPY)
-+ cachep = malloc_sizes[i].cs_usercopycachep;
-+ else
-+#endif
-+
- cachep = malloc_sizes[i].cs_cachep;
-
- ret = kmem_cache_alloc_notrace(cachep, flags);
-@@ -163,7 +175,7 @@ found:
- }
-
- #ifdef CONFIG_NUMA
--extern void *__kmalloc_node(size_t size, gfp_t flags, int node);
-+extern void *__kmalloc_node(size_t size, gfp_t flags, int node) __size_overflow(1);
- extern void *kmem_cache_alloc_node(struct kmem_cache *, gfp_t flags, int node);
-
- #ifdef CONFIG_KMEMTRACE
-@@ -205,6 +217,13 @@ found:
- cachep = malloc_sizes[i].cs_dmacachep;
- else
- #endif
-+
-+#ifdef CONFIG_PAX_USERCOPY_SLABS
-+ if (flags & GFP_USERCOPY)
-+ cachep = malloc_sizes[i].cs_usercopycachep;
-+ else
-+#endif
-+
- cachep = malloc_sizes[i].cs_cachep;
-
- ret = kmem_cache_alloc_node_notrace(cachep, flags, node);
-diff --git a/include/linux/slob_def.h b/include/linux/slob_def.h
-index 0ec00b3..22b4715 100644
---- a/include/linux/slob_def.h
-+++ b/include/linux/slob_def.h
-@@ -9,7 +9,7 @@ static __always_inline void *kmem_cache_alloc(struct kmem_cache *cachep,
- return kmem_cache_alloc_node(cachep, flags, -1);
- }
-
--void *__kmalloc_node(size_t size, gfp_t flags, int node);
-+void *__kmalloc_node(size_t size, gfp_t flags, int node) __size_overflow(1);
-
- static __always_inline void *kmalloc_node(size_t size, gfp_t flags, int node)
- {
-@@ -29,7 +29,7 @@ static __always_inline void *kmalloc(size_t size, gfp_t flags)
- return __kmalloc_node(size, flags, -1);
- }
-
--static __always_inline void *__kmalloc(size_t size, gfp_t flags)
-+static __always_inline __size_overflow(1) void *__kmalloc(size_t size, gfp_t flags)
- {
- return kmalloc(size, flags);
- }
-diff --git a/include/linux/slub_def.h b/include/linux/slub_def.h
-index 5ad70a6..108e1dc 100644
---- a/include/linux/slub_def.h
-+++ b/include/linux/slub_def.h
-@@ -86,7 +86,7 @@ struct kmem_cache {
- struct kmem_cache_order_objects max;
- struct kmem_cache_order_objects min;
- gfp_t allocflags; /* gfp flags to use on each alloc */
-- int refcount; /* Refcount for slab cache destroy */
-+ atomic_t refcount; /* Refcount for slab cache destroy */
- void (*ctor)(void *);
- int inuse; /* Offset to metadata */
- int align; /* Alignment */
-@@ -145,7 +145,7 @@ extern struct kmem_cache kmalloc_caches[SLUB_PAGE_SHIFT];
- * Sorry that the following has to be that ugly but some versions of GCC
- * have trouble with constant propagation and loops.
- */
--static __always_inline int kmalloc_index(size_t size)
-+static __always_inline __size_overflow(1) int kmalloc_index(size_t size)
- {
- if (!size)
- return 0;
-@@ -215,7 +215,7 @@ static __always_inline struct kmem_cache *kmalloc_slab(size_t size)
- #endif
-
- void *kmem_cache_alloc(struct kmem_cache *, gfp_t);
--void *__kmalloc(size_t size, gfp_t flags);
-+void *__kmalloc(size_t size, gfp_t flags) __alloc_size(1);
-
- #ifdef CONFIG_KMEMTRACE
- extern void *kmem_cache_alloc_notrace(struct kmem_cache *s, gfp_t gfpflags);
-@@ -227,7 +227,7 @@ kmem_cache_alloc_notrace(struct kmem_cache *s, gfp_t gfpflags)
- }
- #endif
-
--static __always_inline void *kmalloc_large(size_t size, gfp_t flags)
-+static __always_inline __size_overflow(1) void *kmalloc_large(size_t size, gfp_t flags)
- {
- unsigned int order = get_order(size);
- void *ret = (void *) __get_free_pages(flags | __GFP_COMP, order);
-@@ -263,7 +263,7 @@ static __always_inline void *kmalloc(size_t size, gfp_t flags)
- }
-
- #ifdef CONFIG_NUMA
--void *__kmalloc_node(size_t size, gfp_t flags, int node);
-+void *__kmalloc_node(size_t size, gfp_t flags, int node) __size_overflow(1);
- void *kmem_cache_alloc_node(struct kmem_cache *, gfp_t flags, int node);
-
- #ifdef CONFIG_KMEMTRACE
-diff --git a/include/linux/snmp.h b/include/linux/snmp.h
-index 0f953fe4..05d45da 100644
---- a/include/linux/snmp.h
-+++ b/include/linux/snmp.h
-@@ -208,7 +208,6 @@ enum
- LINUX_MIB_TCPDSACKOFOSENT, /* TCPDSACKOfoSent */
- LINUX_MIB_TCPDSACKRECV, /* TCPDSACKRecv */
- LINUX_MIB_TCPDSACKOFORECV, /* TCPDSACKOfoRecv */
-- LINUX_MIB_TCPABORTONSYN, /* TCPAbortOnSyn */
- LINUX_MIB_TCPABORTONDATA, /* TCPAbortOnData */
- LINUX_MIB_TCPABORTONCLOSE, /* TCPAbortOnClose */
- LINUX_MIB_TCPABORTONMEMORY, /* TCPAbortOnMemory */
-@@ -225,6 +224,8 @@ enum
- LINUX_MIB_SACKSHIFTED,
- LINUX_MIB_SACKMERGED,
- LINUX_MIB_SACKSHIFTFALLBACK,
-+ LINUX_MIB_TCPCHALLENGEACK, /* TCPChallengeACK */
-+ LINUX_MIB_TCPSYNCHALLENGE, /* TCPSYNChallenge */
- __LINUX_MIB_MAX
- };
-
-diff --git a/include/linux/sonet.h b/include/linux/sonet.h
-index 67ad11f..0bbd8af 100644
---- a/include/linux/sonet.h
-+++ b/include/linux/sonet.h
-@@ -61,7 +61,7 @@ struct sonet_stats {
- #include <asm/atomic.h>
-
- struct k_sonet_stats {
--#define __HANDLE_ITEM(i) atomic_t i
-+#define __HANDLE_ITEM(i) atomic_unchecked_t i
- __SONET_ITEMS
- #undef __HANDLE_ITEM
- };
-diff --git a/include/linux/stddef.h b/include/linux/stddef.h
-index 6a40c76..1747b67 100644
---- a/include/linux/stddef.h
-+++ b/include/linux/stddef.h
-@@ -3,14 +3,10 @@
-
- #include <linux/compiler.h>
-
-+#ifdef __KERNEL__
-+
- #undef NULL
--#if defined(__cplusplus)
--#define NULL 0
--#else
- #define NULL ((void *)0)
--#endif
--
--#ifdef __KERNEL__
-
- enum {
- false = 0,
-diff --git a/include/linux/sunrpc/cache.h b/include/linux/sunrpc/cache.h
-index 6f52b4d..5500323 100644
---- a/include/linux/sunrpc/cache.h
-+++ b/include/linux/sunrpc/cache.h
-@@ -125,7 +125,7 @@ struct cache_detail {
- */
- struct cache_req {
- struct cache_deferred_req *(*defer)(struct cache_req *req);
--};
-+} __no_const;
- /* this must be embedded in a deferred_request that is being
- * delayed awaiting cache-fill
- */
-diff --git a/include/linux/sunrpc/clnt.h b/include/linux/sunrpc/clnt.h
-index 8ed9642..101ceab 100644
---- a/include/linux/sunrpc/clnt.h
-+++ b/include/linux/sunrpc/clnt.h
-@@ -167,9 +167,9 @@ static inline unsigned short rpc_get_port(const struct sockaddr *sap)
- {
- switch (sap->sa_family) {
- case AF_INET:
-- return ntohs(((struct sockaddr_in *)sap)->sin_port);
-+ return ntohs(((const struct sockaddr_in *)sap)->sin_port);
- case AF_INET6:
-- return ntohs(((struct sockaddr_in6 *)sap)->sin6_port);
-+ return ntohs(((const struct sockaddr_in6 *)sap)->sin6_port);
- }
- return 0;
- }
-@@ -202,7 +202,7 @@ static inline bool __rpc_cmp_addr4(const struct sockaddr *sap1,
- static inline bool __rpc_copy_addr4(struct sockaddr *dst,
- const struct sockaddr *src)
- {
-- const struct sockaddr_in *ssin = (struct sockaddr_in *) src;
-+ const struct sockaddr_in *ssin = (const struct sockaddr_in *) src;
- struct sockaddr_in *dsin = (struct sockaddr_in *) dst;
-
- dsin->sin_family = ssin->sin_family;
-@@ -299,7 +299,7 @@ static inline u32 rpc_get_scope_id(const struct sockaddr *sa)
- if (sa->sa_family != AF_INET6)
- return 0;
-
-- return ((struct sockaddr_in6 *) sa)->sin6_scope_id;
-+ return ((const struct sockaddr_in6 *) sa)->sin6_scope_id;
- }
-
- #endif /* __KERNEL__ */
-diff --git a/include/linux/sunrpc/svc_rdma.h b/include/linux/sunrpc/svc_rdma.h
-index c14fe86..393245e 100644
---- a/include/linux/sunrpc/svc_rdma.h
-+++ b/include/linux/sunrpc/svc_rdma.h
-@@ -53,15 +53,15 @@ extern unsigned int svcrdma_ord;
- extern unsigned int svcrdma_max_requests;
- extern unsigned int svcrdma_max_req_size;
-
--extern atomic_t rdma_stat_recv;
--extern atomic_t rdma_stat_read;
--extern atomic_t rdma_stat_write;
--extern atomic_t rdma_stat_sq_starve;
--extern atomic_t rdma_stat_rq_starve;
--extern atomic_t rdma_stat_rq_poll;
--extern atomic_t rdma_stat_rq_prod;
--extern atomic_t rdma_stat_sq_poll;
--extern atomic_t rdma_stat_sq_prod;
-+extern atomic_unchecked_t rdma_stat_recv;
-+extern atomic_unchecked_t rdma_stat_read;
-+extern atomic_unchecked_t rdma_stat_write;
-+extern atomic_unchecked_t rdma_stat_sq_starve;
-+extern atomic_unchecked_t rdma_stat_rq_starve;
-+extern atomic_unchecked_t rdma_stat_rq_poll;
-+extern atomic_unchecked_t rdma_stat_rq_prod;
-+extern atomic_unchecked_t rdma_stat_sq_poll;
-+extern atomic_unchecked_t rdma_stat_sq_prod;
-
- #define RPCRDMA_VERSION 1
-
-diff --git a/include/linux/suspend.h b/include/linux/suspend.h
-index 5e781d8..1e62818 100644
---- a/include/linux/suspend.h
-+++ b/include/linux/suspend.h
-@@ -104,15 +104,15 @@ typedef int __bitwise suspend_state_t;
- * which require special recovery actions in that situation.
- */
- struct platform_suspend_ops {
-- int (*valid)(suspend_state_t state);
-- int (*begin)(suspend_state_t state);
-- int (*prepare)(void);
-- int (*prepare_late)(void);
-- int (*enter)(suspend_state_t state);
-- void (*wake)(void);
-- void (*finish)(void);
-- void (*end)(void);
-- void (*recover)(void);
-+ int (* const valid)(suspend_state_t state);
-+ int (* const begin)(suspend_state_t state);
-+ int (* const prepare)(void);
-+ int (* const prepare_late)(void);
-+ int (* const enter)(suspend_state_t state);
-+ void (* const wake)(void);
-+ void (* const finish)(void);
-+ void (* const end)(void);
-+ void (* const recover)(void);
- };
-
- #ifdef CONFIG_SUSPEND
-@@ -120,7 +120,7 @@ struct platform_suspend_ops {
- * suspend_set_ops - set platform dependent suspend operations
- * @ops: The new suspend operations to set.
- */
--extern void suspend_set_ops(struct platform_suspend_ops *ops);
-+extern void suspend_set_ops(const struct platform_suspend_ops *ops);
- extern int suspend_valid_only_mem(suspend_state_t state);
-
- /**
-@@ -145,7 +145,7 @@ extern int pm_suspend(suspend_state_t state);
- #else /* !CONFIG_SUSPEND */
- #define suspend_valid_only_mem NULL
-
--static inline void suspend_set_ops(struct platform_suspend_ops *ops) {}
-+static inline void suspend_set_ops(const struct platform_suspend_ops *ops) {}
- static inline int pm_suspend(suspend_state_t state) { return -ENOSYS; }
- #endif /* !CONFIG_SUSPEND */
-
-@@ -215,16 +215,16 @@ extern void mark_free_pages(struct zone *zone);
- * platforms which require special recovery actions in that situation.
- */
- struct platform_hibernation_ops {
-- int (*begin)(void);
-- void (*end)(void);
-- int (*pre_snapshot)(void);
-- void (*finish)(void);
-- int (*prepare)(void);
-- int (*enter)(void);
-- void (*leave)(void);
-- int (*pre_restore)(void);
-- void (*restore_cleanup)(void);
-- void (*recover)(void);
-+ int (* const begin)(void);
-+ void (* const end)(void);
-+ int (* const pre_snapshot)(void);
-+ void (* const finish)(void);
-+ int (* const prepare)(void);
-+ int (* const enter)(void);
-+ void (* const leave)(void);
-+ int (* const pre_restore)(void);
-+ void (* const restore_cleanup)(void);
-+ void (* const recover)(void);
- };
-
- #ifdef CONFIG_HIBERNATION
-@@ -243,7 +243,7 @@ extern void swsusp_set_page_free(struct page *);
- extern void swsusp_unset_page_free(struct page *);
- extern unsigned long get_safe_page(gfp_t gfp_mask);
-
--extern void hibernation_set_ops(struct platform_hibernation_ops *ops);
-+extern void hibernation_set_ops(const struct platform_hibernation_ops *ops);
- extern int hibernate(void);
- extern bool system_entering_hibernation(void);
- #else /* CONFIG_HIBERNATION */
-@@ -251,7 +251,7 @@ static inline int swsusp_page_is_forbidden(struct page *p) { return 0; }
- static inline void swsusp_set_page_free(struct page *p) {}
- static inline void swsusp_unset_page_free(struct page *p) {}
-
--static inline void hibernation_set_ops(struct platform_hibernation_ops *ops) {}
-+static inline void hibernation_set_ops(const struct platform_hibernation_ops *ops) {}
- static inline int hibernate(void) { return -ENOSYS; }
- static inline bool system_entering_hibernation(void) { return false; }
- #endif /* CONFIG_HIBERNATION */
-diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
-index 0eb6942..a805cb6 100644
---- a/include/linux/sysctl.h
-+++ b/include/linux/sysctl.h
-@@ -164,7 +164,11 @@ enum
- KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
- };
-
--
-+#ifdef CONFIG_PAX_SOFTMODE
-+enum {
-+ PAX_SOFTMODE=1 /* PaX: disable/enable soft mode */
-+};
-+#endif
-
- /* CTL_VM names: */
- enum
-@@ -982,6 +986,8 @@ typedef int proc_handler (struct ctl_table *ctl, int write,
-
- extern int proc_dostring(struct ctl_table *, int,
- void __user *, size_t *, loff_t *);
-+extern int proc_dostring_modpriv(struct ctl_table *, int,
-+ void __user *, size_t *, loff_t *);
- extern int proc_dointvec(struct ctl_table *, int,
- void __user *, size_t *, loff_t *);
- extern int proc_dointvec_minmax(struct ctl_table *, int,
-@@ -1003,6 +1009,7 @@ extern int do_sysctl (int __user *name, int nlen,
-
- extern ctl_handler sysctl_data;
- extern ctl_handler sysctl_string;
-+extern ctl_handler sysctl_string_modpriv;
- extern ctl_handler sysctl_intvec;
- extern ctl_handler sysctl_jiffies;
- extern ctl_handler sysctl_ms_jiffies;
-diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h
-index 9d68fed..71f02cc 100644
---- a/include/linux/sysfs.h
-+++ b/include/linux/sysfs.h
-@@ -75,8 +75,8 @@ struct bin_attribute {
- };
-
- struct sysfs_ops {
-- ssize_t (*show)(struct kobject *, struct attribute *,char *);
-- ssize_t (*store)(struct kobject *,struct attribute *,const char *, size_t);
-+ ssize_t (* const show)(struct kobject *, struct attribute *,char *);
-+ ssize_t (* const store)(struct kobject *,struct attribute *,const char *, size_t);
- };
-
- struct sysfs_dirent;
-diff --git a/include/linux/syslog.h b/include/linux/syslog.h
-new file mode 100644
-index 0000000..3891139
---- /dev/null
-+++ b/include/linux/syslog.h
-@@ -0,0 +1,52 @@
-+/* Syslog internals
-+ *
-+ * Copyright 2010 Canonical, Ltd.
-+ * Author: Kees Cook <kees.cook@canonical.com>
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License as published by
-+ * the Free Software Foundation; either version 2, or (at your option)
-+ * any later version.
-+ *
-+ * This program is distributed in the hope that it will be useful,
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-+ * GNU General Public License for more details.
-+ *
-+ * You should have received a copy of the GNU General Public License
-+ * along with this program; see the file COPYING. If not, write to
-+ * the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
-+ */
-+
-+#ifndef _LINUX_SYSLOG_H
-+#define _LINUX_SYSLOG_H
-+
-+/* Close the log. Currently a NOP. */
-+#define SYSLOG_ACTION_CLOSE 0
-+/* Open the log. Currently a NOP. */
-+#define SYSLOG_ACTION_OPEN 1
-+/* Read from the log. */
-+#define SYSLOG_ACTION_READ 2
-+/* Read all messages remaining in the ring buffer. */
-+#define SYSLOG_ACTION_READ_ALL 3
-+/* Read and clear all messages remaining in the ring buffer */
-+#define SYSLOG_ACTION_READ_CLEAR 4
-+/* Clear ring buffer. */
-+#define SYSLOG_ACTION_CLEAR 5
-+/* Disable printk's to console */
-+#define SYSLOG_ACTION_CONSOLE_OFF 6
-+/* Enable printk's to console */
-+#define SYSLOG_ACTION_CONSOLE_ON 7
-+/* Set level of messages printed to console */
-+#define SYSLOG_ACTION_CONSOLE_LEVEL 8
-+/* Return number of unread characters in the log buffer */
-+#define SYSLOG_ACTION_SIZE_UNREAD 9
-+/* Return size of the log buffer */
-+#define SYSLOG_ACTION_SIZE_BUFFER 10
-+
-+#define SYSLOG_FROM_CALL 0
-+#define SYSLOG_FROM_FILE 1
-+
-+int do_syslog(int type, char __user *buf, int count, bool from_file);
-+
-+#endif /* _LINUX_SYSLOG_H */
-diff --git a/include/linux/sysrq.h b/include/linux/sysrq.h
-index 99adcdc..377249a 100644
---- a/include/linux/sysrq.h
-+++ b/include/linux/sysrq.h
-@@ -15,6 +15,7 @@
- #define _LINUX_SYSRQ_H
-
- #include <linux/errno.h>
-+#include <linux/compiler.h>
-
- struct pt_regs;
- struct tty_struct;
-@@ -35,7 +36,7 @@ struct sysrq_key_op {
- char *help_msg;
- char *action_msg;
- int enable_mask;
--};
-+} __do_const;
-
- #ifdef CONFIG_MAGIC_SYSRQ
-
-diff --git a/include/linux/thread_info.h b/include/linux/thread_info.h
-index a8cc4e1..6708eb2 100644
---- a/include/linux/thread_info.h
-+++ b/include/linux/thread_info.h
-@@ -23,7 +23,7 @@ struct restart_block {
- };
- /* For futex_wait and futex_wait_requeue_pi */
- struct {
-- u32 *uaddr;
-+ u32 __user *uaddr;
- u32 val;
- u32 flags;
- u32 bitset;
-@@ -126,6 +126,13 @@ static inline void set_restore_sigmask(void)
- }
- #endif /* TIF_RESTORE_SIGMASK && !HAVE_SET_RESTORE_SIGMASK */
-
-+extern void __check_object_size(const void *ptr, unsigned long n, bool to);
-+static inline void check_object_size(const void *ptr, unsigned long n, bool to)
-+{
-+ if (!__builtin_constant_p(n))
-+ __check_object_size(ptr, n, to);
-+}
-+
- #endif /* __KERNEL__ */
-
- #endif /* _LINUX_THREAD_INFO_H */
-diff --git a/include/linux/tracehook.h b/include/linux/tracehook.h
-index 1eb44a9..77ac9f4 100644
---- a/include/linux/tracehook.h
-+++ b/include/linux/tracehook.h
-@@ -69,12 +69,12 @@ static inline int tracehook_expect_breakpoints(struct task_struct *task)
- /*
- * ptrace report for syscall entry and exit looks identical.
- */
--static inline void ptrace_report_syscall(struct pt_regs *regs)
-+static inline int ptrace_report_syscall(struct pt_regs *regs)
- {
- int ptrace = task_ptrace(current);
-
- if (!(ptrace & PT_PTRACED))
-- return;
-+ return 0;
-
- ptrace_notify(SIGTRAP | ((ptrace & PT_TRACESYSGOOD) ? 0x80 : 0));
-
-@@ -87,6 +87,8 @@ static inline void ptrace_report_syscall(struct pt_regs *regs)
- send_sig(current->exit_code, current, 1);
- current->exit_code = 0;
- }
-+
-+ return fatal_signal_pending(current);
- }
-
- /**
-@@ -111,8 +113,7 @@ static inline void ptrace_report_syscall(struct pt_regs *regs)
- static inline __must_check int tracehook_report_syscall_entry(
- struct pt_regs *regs)
- {
-- ptrace_report_syscall(regs);
-- return 0;
-+ return ptrace_report_syscall(regs);
- }
-
- /**
-@@ -143,7 +144,7 @@ static inline void tracehook_report_syscall_exit(struct pt_regs *regs, int step)
- *
- * Return %LSM_UNSAFE_* bits applied to an exec because of tracing.
- *
-- * @task->cred_guard_mutex is held by the caller through the do_execve().
-+ * @task->signal->cred_guard_mutex is held by the caller through the do_execve().
- */
- static inline int tracehook_unsafe_exec(struct task_struct *task)
- {
-diff --git a/include/linux/tty.h b/include/linux/tty.h
-index e9c57e9..ee6d489 100644
---- a/include/linux/tty.h
-+++ b/include/linux/tty.h
-@@ -493,7 +493,6 @@ extern void tty_ldisc_begin(void);
- /* This last one is just for the tty layer internals and shouldn't be used elsewhere */
- extern void tty_ldisc_enable(struct tty_struct *tty);
-
--
- /* n_tty.c */
- extern struct tty_ldisc_ops tty_ldisc_N_TTY;
-
-diff --git a/include/linux/tty_driver.h b/include/linux/tty_driver.h
-index db2d227..ea28ae8 100644
---- a/include/linux/tty_driver.h
-+++ b/include/linux/tty_driver.h
-@@ -283,7 +283,7 @@ struct tty_operations {
- void (*poll_put_char)(struct tty_driver *driver, int line, char ch);
- #endif
- const struct file_operations *proc_fops;
--};
-+} __do_const;
-
- struct tty_driver {
- int magic; /* magic number for this structure */
-diff --git a/include/linux/tty_ldisc.h b/include/linux/tty_ldisc.h
-index 0c4ee9b..9f7c426 100644
---- a/include/linux/tty_ldisc.h
-+++ b/include/linux/tty_ldisc.h
-@@ -139,7 +139,7 @@ struct tty_ldisc_ops {
-
- struct module *owner;
-
-- int refcount;
-+ atomic_t refcount;
- };
-
- struct tty_ldisc {
-diff --git a/include/linux/types.h b/include/linux/types.h
-index c42724f..d190eee 100644
---- a/include/linux/types.h
-+++ b/include/linux/types.h
-@@ -191,10 +191,26 @@ typedef struct {
- volatile int counter;
- } atomic_t;
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+typedef struct {
-+ volatile int counter;
-+} atomic_unchecked_t;
-+#else
-+typedef atomic_t atomic_unchecked_t;
-+#endif
-+
- #ifdef CONFIG_64BIT
- typedef struct {
- volatile long counter;
- } atomic64_t;
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+typedef struct {
-+ volatile long counter;
-+} atomic64_unchecked_t;
-+#else
-+typedef atomic64_t atomic64_unchecked_t;
-+#endif
- #endif
-
- struct ustat {
-diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h
-index 6b58367..57b150e 100644
---- a/include/linux/uaccess.h
-+++ b/include/linux/uaccess.h
-@@ -76,11 +76,11 @@ static inline unsigned long __copy_from_user_nocache(void *to,
- long ret; \
- mm_segment_t old_fs = get_fs(); \
- \
-- set_fs(KERNEL_DS); \
- pagefault_disable(); \
-- ret = __copy_from_user_inatomic(&(retval), (__force typeof(retval) __user *)(addr), sizeof(retval)); \
-- pagefault_enable(); \
-+ set_fs(KERNEL_DS); \
-+ ret = __copy_from_user_inatomic(&(retval), (typeof(retval) __force_user *)(addr), sizeof(retval)); \
- set_fs(old_fs); \
-+ pagefault_enable(); \
- ret; \
- })
-
-@@ -93,7 +93,7 @@ static inline unsigned long __copy_from_user_nocache(void *to,
- * Safely read from address @src to the buffer at @dst. If a kernel fault
- * happens, handle that and return -EFAULT.
- */
--extern long probe_kernel_read(void *dst, void *src, size_t size);
-+extern long probe_kernel_read(void *dst, const void *src, size_t size);
-
- /*
- * probe_kernel_write(): safely attempt to write to a location
-@@ -104,6 +104,6 @@ extern long probe_kernel_read(void *dst, void *src, size_t size);
- * Safely write to address @dst from the buffer at @src. If a kernel fault
- * happens, handle that and return -EFAULT.
- */
--extern long probe_kernel_write(void *dst, void *src, size_t size);
-+extern long probe_kernel_write(void *dst, const void *src, size_t size) __size_overflow(3);
-
- #endif /* __LINUX_UACCESS_H__ */
-diff --git a/include/linux/unaligned/access_ok.h b/include/linux/unaligned/access_ok.h
-index 99c1b4d..bb94261 100644
---- a/include/linux/unaligned/access_ok.h
-+++ b/include/linux/unaligned/access_ok.h
-@@ -6,32 +6,32 @@
-
- static inline u16 get_unaligned_le16(const void *p)
- {
-- return le16_to_cpup((__le16 *)p);
-+ return le16_to_cpup((const __le16 *)p);
- }
-
- static inline u32 get_unaligned_le32(const void *p)
- {
-- return le32_to_cpup((__le32 *)p);
-+ return le32_to_cpup((const __le32 *)p);
- }
-
- static inline u64 get_unaligned_le64(const void *p)
- {
-- return le64_to_cpup((__le64 *)p);
-+ return le64_to_cpup((const __le64 *)p);
- }
-
- static inline u16 get_unaligned_be16(const void *p)
- {
-- return be16_to_cpup((__be16 *)p);
-+ return be16_to_cpup((const __be16 *)p);
- }
-
- static inline u32 get_unaligned_be32(const void *p)
- {
-- return be32_to_cpup((__be32 *)p);
-+ return be32_to_cpup((const __be32 *)p);
- }
-
- static inline u64 get_unaligned_be64(const void *p)
- {
-- return be64_to_cpup((__be64 *)p);
-+ return be64_to_cpup((const __be64 *)p);
- }
-
- static inline void put_unaligned_le16(u16 val, void *p)
-diff --git a/include/linux/usb.h b/include/linux/usb.h
-index a34fa89..ef176bc 100644
---- a/include/linux/usb.h
-+++ b/include/linux/usb.h
-@@ -500,7 +500,7 @@ struct usb_device {
-
- int pm_usage_cnt;
- u32 quirks;
-- atomic_t urbnum;
-+ atomic_unchecked_t urbnum;
-
- unsigned long active_duration;
-
-diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
-index f814730..61d9ec3 100644
---- a/include/linux/usb/usbnet.h
-+++ b/include/linux/usb/usbnet.h
-@@ -33,6 +33,7 @@ struct usbnet {
- wait_queue_head_t *wait;
- struct mutex phy_mutex;
- unsigned char suspend_count;
-+ unsigned char pkt_cnt, pkt_err;
-
- /* i/o info: pipes etc */
- unsigned in, out;
-@@ -65,6 +66,7 @@ struct usbnet {
- # define EVENT_STS_SPLIT 3
- # define EVENT_LINK_RESET 4
- # define EVENT_RX_PAUSED 5
-+# define EVENT_RX_KILL 10
- };
-
- static inline struct usb_driver *driver_of(struct usb_interface *intf)
-diff --git a/include/linux/vermagic.h b/include/linux/vermagic.h
-index 79b9837..b5a56f9 100644
---- a/include/linux/vermagic.h
-+++ b/include/linux/vermagic.h
-@@ -26,9 +26,35 @@
- #define MODULE_ARCH_VERMAGIC ""
- #endif
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+#define MODULE_PAX_REFCOUNT "REFCOUNT "
-+#else
-+#define MODULE_PAX_REFCOUNT ""
-+#endif
-+
-+#ifdef CONSTIFY_PLUGIN
-+#define MODULE_CONSTIFY_PLUGIN "CONSTIFY_PLUGIN "
-+#else
-+#define MODULE_CONSTIFY_PLUGIN ""
-+#endif
-+
-+#ifdef STACKLEAK_PLUGIN
-+#define MODULE_STACKLEAK_PLUGIN "STACKLEAK_PLUGIN "
-+#else
-+#define MODULE_STACKLEAK_PLUGIN ""
-+#endif
-+
-+#ifdef CONFIG_GRKERNSEC
-+#define MODULE_GRSEC "GRSEC "
-+#else
-+#define MODULE_GRSEC ""
-+#endif
-+
- #define VERMAGIC_STRING \
- UTS_RELEASE " " \
- MODULE_VERMAGIC_SMP MODULE_VERMAGIC_PREEMPT \
- MODULE_VERMAGIC_MODULE_UNLOAD MODULE_VERMAGIC_MODVERSIONS \
-- MODULE_ARCH_VERMAGIC
-+ MODULE_ARCH_VERMAGIC \
-+ MODULE_PAX_REFCOUNT MODULE_CONSTIFY_PLUGIN MODULE_STACKLEAK_PLUGIN \
-+ MODULE_GRSEC
-
-diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h
-index 819a634..dcc51e98 100644
---- a/include/linux/vmalloc.h
-+++ b/include/linux/vmalloc.h
-@@ -14,6 +14,11 @@ struct vm_area_struct; /* vma defining user mapping in mm_types.h */
- #define VM_USERMAP 0x00000008 /* suitable for remap_vmalloc_range */
- #define VM_VPAGES 0x00000010 /* buffer for pages was vmalloc'ed */
- #define VM_UNLIST 0x00000020 /* vm_struct is not listed in vmlist */
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
-+#define VM_KERNEXEC 0x00000040 /* allocate from executable kernel memory range */
-+#endif
-+
- /* bits [20..32] reserved for arch specific ioremap internals */
-
- /*
-@@ -106,8 +111,8 @@ extern struct vm_struct *alloc_vm_area(size_t size);
- extern void free_vm_area(struct vm_struct *area);
-
- /* for /dev/kmem */
--extern long vread(char *buf, char *addr, unsigned long count);
--extern long vwrite(char *buf, char *addr, unsigned long count);
-+extern long vread(char *buf, char *addr, unsigned long count) __size_overflow(3);
-+extern long vwrite(char *buf, char *addr, unsigned long count) __size_overflow(3);
-
- /*
- * Internals. Dont't use..
-diff --git a/include/linux/vmstat.h b/include/linux/vmstat.h
-index 13070d6..aa4159a 100644
---- a/include/linux/vmstat.h
-+++ b/include/linux/vmstat.h
-@@ -136,18 +136,18 @@ static inline void vm_events_fold_cpu(int cpu)
- /*
- * Zone based page accounting with per cpu differentials.
- */
--extern atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
-+extern atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
-
- static inline void zone_page_state_add(long x, struct zone *zone,
- enum zone_stat_item item)
- {
-- atomic_long_add(x, &zone->vm_stat[item]);
-- atomic_long_add(x, &vm_stat[item]);
-+ atomic_long_add_unchecked(x, &zone->vm_stat[item]);
-+ atomic_long_add_unchecked(x, &vm_stat[item]);
- }
-
- static inline unsigned long global_page_state(enum zone_stat_item item)
- {
-- long x = atomic_long_read(&vm_stat[item]);
-+ long x = atomic_long_read_unchecked(&vm_stat[item]);
- #ifdef CONFIG_SMP
- if (x < 0)
- x = 0;
-@@ -158,7 +158,7 @@ static inline unsigned long global_page_state(enum zone_stat_item item)
- static inline unsigned long zone_page_state(struct zone *zone,
- enum zone_stat_item item)
- {
-- long x = atomic_long_read(&zone->vm_stat[item]);
-+ long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
- #ifdef CONFIG_SMP
- if (x < 0)
- x = 0;
-@@ -175,7 +175,7 @@ static inline unsigned long zone_page_state(struct zone *zone,
- static inline unsigned long zone_page_state_snapshot(struct zone *zone,
- enum zone_stat_item item)
- {
-- long x = atomic_long_read(&zone->vm_stat[item]);
-+ long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
-
- #ifdef CONFIG_SMP
- int cpu;
-@@ -264,8 +264,8 @@ static inline void __mod_zone_page_state(struct zone *zone,
-
- static inline void __inc_zone_state(struct zone *zone, enum zone_stat_item item)
- {
-- atomic_long_inc(&zone->vm_stat[item]);
-- atomic_long_inc(&vm_stat[item]);
-+ atomic_long_inc_unchecked(&zone->vm_stat[item]);
-+ atomic_long_inc_unchecked(&vm_stat[item]);
- }
-
- static inline void __inc_zone_page_state(struct page *page,
-@@ -276,8 +276,8 @@ static inline void __inc_zone_page_state(struct page *page,
-
- static inline void __dec_zone_state(struct zone *zone, enum zone_stat_item item)
- {
-- atomic_long_dec(&zone->vm_stat[item]);
-- atomic_long_dec(&vm_stat[item]);
-+ atomic_long_dec_unchecked(&zone->vm_stat[item]);
-+ atomic_long_dec_unchecked(&vm_stat[item]);
- }
-
- static inline void __dec_zone_page_state(struct page *page,
-diff --git a/include/linux/xattr.h b/include/linux/xattr.h
-index 5c84af8..1a3b6e2 100644
---- a/include/linux/xattr.h
-+++ b/include/linux/xattr.h
-@@ -33,6 +33,11 @@
- #define XATTR_USER_PREFIX "user."
- #define XATTR_USER_PREFIX_LEN (sizeof (XATTR_USER_PREFIX) - 1)
-
-+/* User namespace */
-+#define XATTR_PAX_PREFIX XATTR_USER_PREFIX "pax."
-+#define XATTR_PAX_FLAGS_SUFFIX "flags"
-+#define XATTR_NAME_PAX_FLAGS XATTR_PAX_PREFIX XATTR_PAX_FLAGS_SUFFIX
-+
- struct inode;
- struct dentry;
-
-diff --git a/include/media/v4l2-dev.h b/include/media/v4l2-dev.h
-index 73c9867..14cc2cd 100644
---- a/include/media/v4l2-dev.h
-+++ b/include/media/v4l2-dev.h
-@@ -34,7 +34,7 @@ struct v4l2_device;
- #define V4L2_FL_UNREGISTERED (0)
-
- struct v4l2_file_operations {
-- struct module *owner;
-+ struct module * const owner;
- ssize_t (*read) (struct file *, char __user *, size_t, loff_t *);
- ssize_t (*write) (struct file *, const char __user *, size_t, loff_t *);
- unsigned int (*poll) (struct file *, struct poll_table_struct *);
-diff --git a/include/media/v4l2-device.h b/include/media/v4l2-device.h
-index 5d5d550..f559ef1 100644
---- a/include/media/v4l2-device.h
-+++ b/include/media/v4l2-device.h
-@@ -71,7 +71,7 @@ int __must_check v4l2_device_register(struct device *dev, struct v4l2_device *v4
- this function returns 0. If the name ends with a digit (e.g. cx18),
- then the name will be set to cx18-0 since cx180 looks really odd. */
- int v4l2_device_set_name(struct v4l2_device *v4l2_dev, const char *basename,
-- atomic_t *instance);
-+ atomic_unchecked_t *instance);
-
- /* Set v4l2_dev->dev to NULL. Call when the USB parent disconnects.
- Since the parent disappears this ensures that v4l2_dev doesn't have an
-diff --git a/include/net/flow.h b/include/net/flow.h
-index 809970b..c3df4f3 100644
---- a/include/net/flow.h
-+++ b/include/net/flow.h
-@@ -92,7 +92,7 @@ typedef int (*flow_resolve_t)(struct net *net, struct flowi *key, u16 family,
- extern void *flow_cache_lookup(struct net *net, struct flowi *key, u16 family,
- u8 dir, flow_resolve_t resolver);
- extern void flow_cache_flush(void);
--extern atomic_t flow_cache_genid;
-+extern atomic_unchecked_t flow_cache_genid;
-
- static inline int flow_cache_uli_match(struct flowi *fl1, struct flowi *fl2)
- {
-diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
-index 696d6e4..9259a0f 100644
---- a/include/net/inet_connection_sock.h
-+++ b/include/net/inet_connection_sock.h
-@@ -62,7 +62,7 @@ struct inet_connection_sock_af_ops {
- void (*addr2sockaddr)(struct sock *sk, struct sockaddr *);
- int (*bind_conflict)(const struct sock *sk,
- const struct inet_bind_bucket *tb);
--};
-+} __do_const;
-
- /** inet_connection_sock - INET connection oriented sock
- *
-diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
-index 15e1f8fe..668837c 100644
---- a/include/net/inetpeer.h
-+++ b/include/net/inetpeer.h
-@@ -24,7 +24,7 @@ struct inet_peer
- __u32 dtime; /* the time of last use of not
- * referenced entries */
- atomic_t refcnt;
-- atomic_t rid; /* Frag reception counter */
-+ atomic_unchecked_t rid; /* Frag reception counter */
- __u32 tcp_ts;
- unsigned long tcp_ts_stamp;
- };
-diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
-index 98978e7..2243a3d 100644
---- a/include/net/ip_vs.h
-+++ b/include/net/ip_vs.h
-@@ -365,7 +365,7 @@ struct ip_vs_conn {
- struct ip_vs_conn *control; /* Master control connection */
- atomic_t n_control; /* Number of controlled ones */
- struct ip_vs_dest *dest; /* real server */
-- atomic_t in_pkts; /* incoming packet counter */
-+ atomic_unchecked_t in_pkts; /* incoming packet counter */
-
- /* packet transmitter for different forwarding methods. If it
- mangles the packet, it must return NF_DROP or better NF_STOLEN,
-@@ -466,7 +466,7 @@ struct ip_vs_dest {
- union nf_inet_addr addr; /* IP address of the server */
- __be16 port; /* port number of the server */
- volatile unsigned flags; /* dest status flags */
-- atomic_t conn_flags; /* flags to copy to conn */
-+ atomic_unchecked_t conn_flags; /* flags to copy to conn */
- atomic_t weight; /* server weight */
-
- atomic_t refcnt; /* reference counter */
-diff --git a/include/net/irda/ircomm_tty.h b/include/net/irda/ircomm_tty.h
-index eea2e61..08c692d 100644
---- a/include/net/irda/ircomm_tty.h
-+++ b/include/net/irda/ircomm_tty.h
-@@ -35,6 +35,7 @@
- #include <linux/termios.h>
- #include <linux/timer.h>
- #include <linux/tty.h> /* struct tty_struct */
-+#include <asm/local.h>
-
- #include <net/irda/irias_object.h>
- #include <net/irda/ircomm_core.h>
-@@ -105,8 +106,8 @@ struct ircomm_tty_cb {
- unsigned short close_delay;
- unsigned short closing_wait; /* time to wait before closing */
-
-- int open_count;
-- int blocked_open; /* # of blocked opens */
-+ local_t open_count;
-+ local_t blocked_open; /* # of blocked opens */
-
- /* Protect concurent access to :
- * o self->open_count
-diff --git a/include/net/iucv/af_iucv.h b/include/net/iucv/af_iucv.h
-index f82a1e8..82d81e8 100644
---- a/include/net/iucv/af_iucv.h
-+++ b/include/net/iucv/af_iucv.h
-@@ -87,7 +87,7 @@ struct iucv_sock {
- struct iucv_sock_list {
- struct hlist_head head;
- rwlock_t lock;
-- atomic_t autobind_name;
-+ atomic_unchecked_t autobind_name;
- };
-
- unsigned int iucv_sock_poll(struct file *file, struct socket *sock,
-diff --git a/include/net/lapb.h b/include/net/lapb.h
-index 96cb5dd..25e8d4f 100644
---- a/include/net/lapb.h
-+++ b/include/net/lapb.h
-@@ -95,7 +95,7 @@ struct lapb_cb {
- struct sk_buff_head write_queue;
- struct sk_buff_head ack_queue;
- unsigned char window;
-- struct lapb_register_struct callbacks;
-+ struct lapb_register_struct *callbacks;
-
- /* FRMR control information */
- struct lapb_frame frmr_data;
-diff --git a/include/net/neighbour.h b/include/net/neighbour.h
-index 3817fda..cdb2343 100644
---- a/include/net/neighbour.h
-+++ b/include/net/neighbour.h
-@@ -131,7 +131,7 @@ struct neigh_ops
- int (*connected_output)(struct sk_buff*);
- int (*hh_output)(struct sk_buff*);
- int (*queue_xmit)(struct sk_buff*);
--};
-+} __do_const;
-
- struct pneigh_entry
- {
-diff --git a/include/net/netdma.h b/include/net/netdma.h
-index 8ba8ce2..99b7fff 100644
---- a/include/net/netdma.h
-+++ b/include/net/netdma.h
-@@ -24,7 +24,7 @@
- #include <linux/dmaengine.h>
- #include <linux/skbuff.h>
-
--int dma_skb_copy_datagram_iovec(struct dma_chan* chan,
-+int __intentional_overflow(3,5) dma_skb_copy_datagram_iovec(struct dma_chan* chan,
- struct sk_buff *skb, int offset, struct iovec *to,
- size_t len, struct dma_pinned_list *pinned_list);
-
-diff --git a/include/net/netfilter/nf_queue.h b/include/net/netfilter/nf_queue.h
-index 252fd10..aa1421f 100644
---- a/include/net/netfilter/nf_queue.h
-+++ b/include/net/netfilter/nf_queue.h
-@@ -22,7 +22,7 @@ struct nf_queue_handler {
- int (*outfn)(struct nf_queue_entry *entry,
- unsigned int queuenum);
- char *name;
--};
-+} __do_const;
-
- extern int nf_register_queue_handler(u_int8_t pf,
- const struct nf_queue_handler *qh);
-diff --git a/include/net/netlink.h b/include/net/netlink.h
-index c344646..4778c71 100644
---- a/include/net/netlink.h
-+++ b/include/net/netlink.h
-@@ -335,7 +335,7 @@ static inline int nlmsg_ok(const struct nlmsghdr *nlh, int remaining)
- {
- return (remaining >= (int) sizeof(struct nlmsghdr) &&
- nlh->nlmsg_len >= sizeof(struct nlmsghdr) &&
-- nlh->nlmsg_len <= remaining);
-+ nlh->nlmsg_len <= (unsigned int)remaining);
- }
-
- /**
-@@ -558,7 +558,7 @@ static inline void *nlmsg_get_pos(struct sk_buff *skb)
- static inline void nlmsg_trim(struct sk_buff *skb, const void *mark)
- {
- if (mark)
-- skb_trim(skb, (unsigned char *) mark - skb->data);
-+ skb_trim(skb, (const unsigned char *) mark - skb->data);
- }
-
- /**
-diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
-index 9a4b8b7..e49e077 100644
---- a/include/net/netns/ipv4.h
-+++ b/include/net/netns/ipv4.h
-@@ -54,7 +54,7 @@ struct netns_ipv4 {
- int current_rt_cache_rebuild_count;
-
- struct timer_list rt_secret_timer;
-- atomic_t rt_genid;
-+ atomic_unchecked_t rt_genid;
-
- #ifdef CONFIG_IP_MROUTE
- struct sock *mroute_sk;
-diff --git a/include/net/protocol.h b/include/net/protocol.h
-index 60249e5..f9c3724 100644
---- a/include/net/protocol.h
-+++ b/include/net/protocol.h
-@@ -44,7 +44,7 @@ struct net_protocol {
- int (*gro_complete)(struct sk_buff *skb);
- unsigned int no_policy:1,
- netns_ok:1;
--};
-+} __do_const;
-
- #if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
- struct inet6_protocol
-@@ -64,7 +64,7 @@ struct inet6_protocol
- int (*gro_complete)(struct sk_buff *skb);
-
- unsigned int flags; /* INET6_PROTO_xxx */
--};
-+} __do_const;
-
- #define INET6_PROTO_NOPOLICY 0x1
- #define INET6_PROTO_FINAL 0x2
-diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
-index 8a6d529..171f401 100644
---- a/include/net/sctp/sctp.h
-+++ b/include/net/sctp/sctp.h
-@@ -305,8 +305,8 @@ extern int sctp_debug_flag;
-
- #else /* SCTP_DEBUG */
-
--#define SCTP_DEBUG_PRINTK(whatever...)
--#define SCTP_DEBUG_PRINTK_IPADDR(whatever...)
-+#define SCTP_DEBUG_PRINTK(whatever...) do {} while (0)
-+#define SCTP_DEBUG_PRINTK_IPADDR(whatever...) do {} while (0)
- #define SCTP_ENABLE_DEBUG
- #define SCTP_DISABLE_DEBUG
- #define SCTP_ASSERT(expr, str, func)
-diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
-index 88daa54..9013116 100644
---- a/include/net/sctp/structs.h
-+++ b/include/net/sctp/structs.h
-@@ -608,7 +608,7 @@ struct sctp_af {
- int sockaddr_len;
- sa_family_t sa_family;
- struct list_head list;
--};
-+} __do_const;
-
- struct sctp_af *sctp_get_af_specific(sa_family_t);
- int sctp_register_af(struct sctp_af *);
-@@ -628,7 +628,7 @@ struct sctp_pf {
- struct sctp_association *asoc);
- void (*addr_v4map) (struct sctp_sock *, union sctp_addr *);
- struct sctp_af *af;
--};
-+} __do_const;
-
-
- /* Structure to track chunk fragments that have been acked, but peer
-diff --git a/include/net/secure_seq.h b/include/net/secure_seq.h
-index d97f689..f3b90ab 100644
---- a/include/net/secure_seq.h
-+++ b/include/net/secure_seq.h
-@@ -7,14 +7,14 @@ extern __u32 secure_ip_id(__be32 daddr);
- extern __u32 secure_ipv6_id(const __be32 daddr[4]);
- extern u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport);
- extern u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
-- __be16 dport);
-+ __be16 dport);
- extern __u32 secure_tcp_sequence_number(__be32 saddr, __be32 daddr,
- __be16 sport, __be16 dport);
- extern __u32 secure_tcpv6_sequence_number(__be32 *saddr, __be32 *daddr,
-- __be16 sport, __be16 dport);
-+ __be16 sport, __be16 dport);
- extern u64 secure_dccp_sequence_number(__be32 saddr, __be32 daddr,
-- __be16 sport, __be16 dport);
-+ __be16 sport, __be16 dport);
- extern u64 secure_dccpv6_sequence_number(__be32 *saddr, __be32 *daddr,
-- __be16 sport, __be16 dport);
-+ __be16 sport, __be16 dport);
-
- #endif /* _NET_SECURE_SEQ */
-diff --git a/include/net/sock.h b/include/net/sock.h
-index 78adf52..32bb160 100644
---- a/include/net/sock.h
-+++ b/include/net/sock.h
-@@ -272,7 +272,7 @@ struct sock {
- rwlock_t sk_callback_lock;
- int sk_err,
- sk_err_soft;
-- atomic_t sk_drops;
-+ atomic_unchecked_t sk_drops;
- unsigned short sk_ack_backlog;
- unsigned short sk_max_ack_backlog;
- __u32 sk_priority;
-@@ -737,7 +737,7 @@ static inline void sk_refcnt_debug_release(const struct sock *sk)
- extern void sock_prot_inuse_add(struct net *net, struct proto *prot, int inc);
- extern int sock_prot_inuse_get(struct net *net, struct proto *proto);
- #else
--static void inline sock_prot_inuse_add(struct net *net, struct proto *prot,
-+static inline void sock_prot_inuse_add(struct net *net, struct proto *prot,
- int inc)
- {
- }
-@@ -1398,7 +1398,7 @@ static inline void sk_stream_moderate_sndbuf(struct sock *sk)
- }
- }
-
--struct sk_buff *sk_stream_alloc_skb(struct sock *sk, int size, gfp_t gfp);
-+struct sk_buff * __intentional_overflow(0) sk_stream_alloc_skb(struct sock *sk, int size, gfp_t gfp);
-
- static inline struct page *sk_stream_alloc_page(struct sock *sk)
- {
-diff --git a/include/net/tcp.h b/include/net/tcp.h
-index 6cfe18b..5f08ff0 100644
---- a/include/net/tcp.h
-+++ b/include/net/tcp.h
-@@ -237,6 +237,7 @@ extern int sysctl_tcp_base_mss;
- extern int sysctl_tcp_workaround_signed_windows;
- extern int sysctl_tcp_slow_start_after_idle;
- extern int sysctl_tcp_max_ssthresh;
-+extern int sysctl_tcp_challenge_ack_limit;
-
- extern atomic_t tcp_memory_allocated;
- extern struct percpu_counter tcp_sockets_allocated;
-@@ -483,7 +484,7 @@ extern void tcp_retransmit_timer(struct sock *sk);
- extern void tcp_xmit_retransmit_queue(struct sock *);
- extern void tcp_simple_retransmit(struct sock *);
- extern int tcp_trim_head(struct sock *, struct sk_buff *, u32);
--extern int tcp_fragment(struct sock *, struct sk_buff *, u32, unsigned int);
-+extern int __intentional_overflow(3) tcp_fragment(struct sock *, struct sk_buff *, u32, unsigned int);
-
- extern void tcp_send_probe0(struct sock *);
- extern void tcp_send_partial(struct sock *);
-@@ -632,8 +633,8 @@ struct tcp_skb_cb {
- struct inet6_skb_parm h6;
- #endif
- } header; /* For incoming frames */
-- __u32 seq; /* Starting sequence number */
-- __u32 end_seq; /* SEQ + FIN + SYN + datalen */
-+ __u32 seq __intentional_overflow(0); /* Starting sequence number */
-+ __u32 end_seq __intentional_overflow(0); /* SEQ + FIN + SYN + datalen */
- __u32 when; /* used to compute rtt's */
- __u8 flags; /* TCP header flags. */
-
-@@ -658,7 +659,7 @@ struct tcp_skb_cb {
- #define TCPCB_EVER_RETRANS 0x80 /* Ever retransmitted frame */
- #define TCPCB_RETRANS (TCPCB_SACKED_RETRANS|TCPCB_EVER_RETRANS)
-
-- __u32 ack_seq; /* Sequence number ACK'd */
-+ __u32 ack_seq __intentional_overflow(0); /* Sequence number ACK'd */
- };
-
- #define TCP_SKB_CB(__skb) ((struct tcp_skb_cb *)&((__skb)->cb[0]))
-diff --git a/include/net/xfrm.h b/include/net/xfrm.h
-index 223e90a..d652d35 100644
---- a/include/net/xfrm.h
-+++ b/include/net/xfrm.h
-@@ -389,7 +389,7 @@ struct xfrm_mode {
- struct module *owner;
- unsigned int encap;
- int flags;
--};
-+} __do_const;
-
- /* Flags for xfrm_mode. */
- enum {
-diff --git a/include/rdma/iw_cm.h b/include/rdma/iw_cm.h
-index cbb822e..e9c1cbe 100644
---- a/include/rdma/iw_cm.h
-+++ b/include/rdma/iw_cm.h
-@@ -129,7 +129,7 @@ struct iw_cm_verbs {
- int backlog);
-
- int (*destroy_listen)(struct iw_cm_id *cm_id);
--};
-+} __no_const;
-
- /**
- * iw_create_cm_id - Create an IW CM identifier.
-diff --git a/include/scsi/libfc.h b/include/scsi/libfc.h
-index 09a124b..caa8ca8 100644
---- a/include/scsi/libfc.h
-+++ b/include/scsi/libfc.h
-@@ -675,6 +675,7 @@ struct libfc_function_template {
- */
- void (*disc_stop_final) (struct fc_lport *);
- };
-+typedef struct libfc_function_template __no_const libfc_function_template_no_const;
-
- /* information used by the discovery layer */
- struct fc_disc {
-@@ -707,7 +708,7 @@ struct fc_lport {
- struct fc_disc disc;
-
- /* Operational Information */
-- struct libfc_function_template tt;
-+ libfc_function_template_no_const tt;
- u8 link_up;
- u8 qfull;
- enum fc_lport_state state;
-diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
-index de8e180..f15e0d7 100644
---- a/include/scsi/scsi_device.h
-+++ b/include/scsi/scsi_device.h
-@@ -156,9 +156,9 @@ struct scsi_device {
- unsigned int max_device_blocked; /* what device_blocked counts down from */
- #define SCSI_DEFAULT_DEVICE_BLOCKED 3
-
-- atomic_t iorequest_cnt;
-- atomic_t iodone_cnt;
-- atomic_t ioerr_cnt;
-+ atomic_unchecked_t iorequest_cnt;
-+ atomic_unchecked_t iodone_cnt;
-+ atomic_unchecked_t ioerr_cnt;
-
- struct device sdev_gendev,
- sdev_dev;
-diff --git a/include/scsi/scsi_host.h b/include/scsi/scsi_host.h
-index 0b4baba..0106e9e 100644
---- a/include/scsi/scsi_host.h
-+++ b/include/scsi/scsi_host.h
-@@ -43,6 +43,12 @@ struct blk_queue_tags;
- #define DISABLE_CLUSTERING 0
- #define ENABLE_CLUSTERING 1
-
-+enum {
-+ SCSI_QDEPTH_DEFAULT, /* default requested change, e.g. from sysfs */
-+ SCSI_QDEPTH_QFULL, /* scsi-ml requested due to queue full */
-+ SCSI_QDEPTH_RAMP_UP, /* scsi-ml requested due to threshhold event */
-+};
-+
- struct scsi_host_template {
- struct module *module;
- const char *name;
-diff --git a/include/scsi/scsi_netlink.h b/include/scsi/scsi_netlink.h
-index 58ce8fe..4db1438 100644
---- a/include/scsi/scsi_netlink.h
-+++ b/include/scsi/scsi_netlink.h
-@@ -22,6 +22,7 @@
- #ifndef SCSI_NETLINK_H
- #define SCSI_NETLINK_H
-
-+#include <linux/types.h>
- #include <linux/netlink.h>
-
-
-diff --git a/include/scsi/scsi_transport_fc.h b/include/scsi/scsi_transport_fc.h
-index fc50bd6..81ba9cb 100644
---- a/include/scsi/scsi_transport_fc.h
-+++ b/include/scsi/scsi_transport_fc.h
-@@ -708,7 +708,7 @@ struct fc_function_template {
- unsigned long show_host_system_hostname:1;
-
- unsigned long disable_target_scan:1;
--};
-+} __do_const;
-
-
- /**
-diff --git a/include/sound/ac97_codec.h b/include/sound/ac97_codec.h
-index 3dae3f7..8440d6f 100644
---- a/include/sound/ac97_codec.h
-+++ b/include/sound/ac97_codec.h
-@@ -419,15 +419,15 @@
- struct snd_ac97;
-
- struct snd_ac97_build_ops {
-- int (*build_3d) (struct snd_ac97 *ac97);
-- int (*build_specific) (struct snd_ac97 *ac97);
-- int (*build_spdif) (struct snd_ac97 *ac97);
-- int (*build_post_spdif) (struct snd_ac97 *ac97);
-+ int (* const build_3d) (struct snd_ac97 *ac97);
-+ int (* const build_specific) (struct snd_ac97 *ac97);
-+ int (* const build_spdif) (struct snd_ac97 *ac97);
-+ int (* const build_post_spdif) (struct snd_ac97 *ac97);
- #ifdef CONFIG_PM
-- void (*suspend) (struct snd_ac97 *ac97);
-- void (*resume) (struct snd_ac97 *ac97);
-+ void (* const suspend) (struct snd_ac97 *ac97);
-+ void (* const resume) (struct snd_ac97 *ac97);
- #endif
-- void (*update_jacks) (struct snd_ac97 *ac97); /* for jack-sharing */
-+ void (* const update_jacks) (struct snd_ac97 *ac97); /* for jack-sharing */
- };
-
- struct snd_ac97_bus_ops {
-@@ -477,7 +477,7 @@ struct snd_ac97_template {
-
- struct snd_ac97 {
- /* -- lowlevel (hardware) driver specific -- */
-- struct snd_ac97_build_ops * build_ops;
-+ const struct snd_ac97_build_ops * build_ops;
- void *private_data;
- void (*private_free) (struct snd_ac97 *ac97);
- /* --- */
-diff --git a/include/sound/ymfpci.h b/include/sound/ymfpci.h
-index 444cd6b..3327cc5 100644
---- a/include/sound/ymfpci.h
-+++ b/include/sound/ymfpci.h
-@@ -358,7 +358,7 @@ struct snd_ymfpci {
- spinlock_t reg_lock;
- spinlock_t voice_lock;
- wait_queue_head_t interrupt_sleep;
-- atomic_t interrupt_sleep_count;
-+ atomic_unchecked_t interrupt_sleep_count;
- struct snd_info_entry *proc_entry;
- const struct firmware *dsp_microcode;
- const struct firmware *controller_microcode;
-diff --git a/include/trace/events/fs.h b/include/trace/events/fs.h
-new file mode 100644
-index 0000000..2efe49d
---- /dev/null
-+++ b/include/trace/events/fs.h
-@@ -0,0 +1,53 @@
-+#undef TRACE_SYSTEM
-+#define TRACE_SYSTEM fs
-+
-+#if !defined(_TRACE_FS_H) || defined(TRACE_HEADER_MULTI_READ)
-+#define _TRACE_FS_H
-+
-+#include <linux/fs.h>
-+#include <linux/tracepoint.h>
-+
-+TRACE_EVENT(do_sys_open,
-+
-+ TP_PROTO(char *filename, int flags, int mode),
-+
-+ TP_ARGS(filename, flags, mode),
-+
-+ TP_STRUCT__entry(
-+ __string( filename, filename )
-+ __field( int, flags )
-+ __field( int, mode )
-+ ),
-+
-+ TP_fast_assign(
-+ __assign_str(filename, filename);
-+ __entry->flags = flags;
-+ __entry->mode = mode;
-+ ),
-+
-+ TP_printk("\"%s\" %x %o",
-+ __get_str(filename), __entry->flags, __entry->mode)
-+);
-+
-+TRACE_EVENT(open_exec,
-+
-+ TP_PROTO(const char *filename),
-+
-+ TP_ARGS(filename),
-+
-+ TP_STRUCT__entry(
-+ __string( filename, filename )
-+ ),
-+
-+ TP_fast_assign(
-+ __assign_str(filename, filename);
-+ ),
-+
-+ TP_printk("\"%s\"",
-+ __get_str(filename))
-+);
-+
-+#endif /* _TRACE_FS_H */
-+
-+/* This part must be outside protection */
-+#include <trace/define_trace.h>
-diff --git a/include/trace/events/irq.h b/include/trace/events/irq.h
-index b89f9db..f097b38 100644
---- a/include/trace/events/irq.h
-+++ b/include/trace/events/irq.h
-@@ -34,7 +34,7 @@
- */
- TRACE_EVENT(irq_handler_entry,
-
-- TP_PROTO(int irq, struct irqaction *action),
-+ TP_PROTO(int irq, const struct irqaction *action),
-
- TP_ARGS(irq, action),
-
-@@ -64,7 +64,7 @@ TRACE_EVENT(irq_handler_entry,
- */
- TRACE_EVENT(irq_handler_exit,
-
-- TP_PROTO(int irq, struct irqaction *action, int ret),
-+ TP_PROTO(int irq, const struct irqaction *action, int ret),
-
- TP_ARGS(irq, action, ret),
-
-@@ -95,7 +95,7 @@ TRACE_EVENT(irq_handler_exit,
- */
- TRACE_EVENT(softirq_entry,
-
-- TP_PROTO(struct softirq_action *h, struct softirq_action *vec),
-+ TP_PROTO(const struct softirq_action *h, const struct softirq_action *vec),
-
- TP_ARGS(h, vec),
-
-@@ -124,7 +124,7 @@ TRACE_EVENT(softirq_entry,
- */
- TRACE_EVENT(softirq_exit,
-
-- TP_PROTO(struct softirq_action *h, struct softirq_action *vec),
-+ TP_PROTO(const struct softirq_action *h, const struct softirq_action *vec),
-
- TP_ARGS(h, vec),
-
-diff --git a/include/video/uvesafb.h b/include/video/uvesafb.h
-index 0993a22..32ba2fe 100644
---- a/include/video/uvesafb.h
-+++ b/include/video/uvesafb.h
-@@ -177,6 +177,7 @@ struct uvesafb_par {
- u8 ypan; /* 0 - nothing, 1 - ypan, 2 - ywrap */
- u8 pmi_setpal; /* PMI for palette changes */
- u16 *pmi_base; /* protected mode interface location */
-+ u8 *pmi_code; /* protected mode code location */
- void *pmi_start;
- void *pmi_pal;
- u8 *vbe_state_orig; /*
-diff --git a/init/Kconfig b/init/Kconfig
-index d72691b..b21f901 100644
---- a/init/Kconfig
-+++ b/init/Kconfig
-@@ -1004,7 +1004,7 @@ config SLUB_DEBUG
-
- config COMPAT_BRK
- bool "Disable heap randomization"
-- default y
-+ default n
- help
- Randomizing heap placement makes heap exploits harder, but it
- also breaks ancient binaries (including anything libc5 based).
-@@ -1190,7 +1190,7 @@ config INIT_ALL_POSSIBLE
- config STOP_MACHINE
- bool
- default y
-- depends on (SMP && MODULE_UNLOAD) || HOTPLUG_CPU
-+ depends on (SMP && MODULE_UNLOAD) || HOTPLUG_CPU || GRKERNSEC
- help
- Need stop_machine() primitive.
-
-diff --git a/init/do_mounts.c b/init/do_mounts.c
-index bb008d0..4fa3933 100644
---- a/init/do_mounts.c
-+++ b/init/do_mounts.c
-@@ -216,11 +216,11 @@ static void __init get_fs_names(char *page)
-
- static int __init do_mount_root(char *name, char *fs, int flags, void *data)
- {
-- int err = sys_mount(name, "/root", fs, flags, data);
-+ int err = sys_mount((__force char __user *)name, (__force char __user *)"/root", (__force char __user *)fs, flags, (__force void __user *)data);
- if (err)
- return err;
-
-- sys_chdir("/root");
-+ sys_chdir((__force const char __user *)"/root");
- ROOT_DEV = current->fs->pwd.mnt->mnt_sb->s_dev;
- printk("VFS: Mounted root (%s filesystem)%s on device %u:%u.\n",
- current->fs->pwd.mnt->mnt_sb->s_type->name,
-@@ -311,18 +311,18 @@ void __init change_floppy(char *fmt, ...)
- va_start(args, fmt);
- vsprintf(buf, fmt, args);
- va_end(args);
-- fd = sys_open("/dev/root", O_RDWR | O_NDELAY, 0);
-+ fd = sys_open((char __user *)"/dev/root", O_RDWR | O_NDELAY, 0);
- if (fd >= 0) {
- sys_ioctl(fd, FDEJECT, 0);
- sys_close(fd);
- }
- printk(KERN_NOTICE "VFS: Insert %s and press ENTER\n", buf);
-- fd = sys_open("/dev/console", O_RDWR, 0);
-+ fd = sys_open((char __user *)"/dev/console", O_RDWR, 0);
- if (fd >= 0) {
- sys_ioctl(fd, TCGETS, (long)&termios);
- termios.c_lflag &= ~ICANON;
- sys_ioctl(fd, TCSETSF, (long)&termios);
-- sys_read(fd, &c, 1);
-+ sys_read(fd, (char __user *)&c, 1);
- termios.c_lflag |= ICANON;
- sys_ioctl(fd, TCSETSF, (long)&termios);
- sys_close(fd);
-@@ -416,6 +416,6 @@ void __init prepare_namespace(void)
- mount_root();
- out:
- devtmpfs_mount("dev");
-- sys_mount(".", "/", NULL, MS_MOVE, NULL);
-- sys_chroot(".");
-+ sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
-+ sys_chroot((__force char __user *)".");
- }
-diff --git a/init/do_mounts.h b/init/do_mounts.h
-index f5b978a..a34abde 100644
---- a/init/do_mounts.h
-+++ b/init/do_mounts.h
-@@ -15,15 +15,15 @@ extern int root_mountflags;
-
- static inline int create_dev(char *name, dev_t dev)
- {
-- sys_unlink(name);
-- return sys_mknod(name, S_IFBLK|0600, new_encode_dev(dev));
-+ sys_unlink((char __force_user *)name);
-+ return sys_mknod((char __force_user *)name, S_IFBLK|0600, new_encode_dev(dev));
- }
-
- #if BITS_PER_LONG == 32
- static inline u32 bstat(char *name)
- {
- struct stat64 stat;
-- if (sys_stat64(name, &stat) != 0)
-+ if (sys_stat64((char __force_user *)name, (struct stat64 __force_user *)&stat) != 0)
- return 0;
- if (!S_ISBLK(stat.st_mode))
- return 0;
-@@ -35,7 +35,7 @@ static inline u32 bstat(char *name)
- static inline u32 bstat(char *name)
- {
- struct stat stat;
-- if (sys_newstat(name, &stat) != 0)
-+ if (sys_newstat((char __force_user *)name, (struct stat __force_user *)&stat) != 0)
- return 0;
- if (!S_ISBLK(stat.st_mode))
- return 0;
-diff --git a/init/do_mounts_initrd.c b/init/do_mounts_initrd.c
-index 614241b..4da046b 100644
---- a/init/do_mounts_initrd.c
-+++ b/init/do_mounts_initrd.c
-@@ -32,7 +32,7 @@ static int __init do_linuxrc(void * shell)
- sys_close(old_fd);sys_close(root_fd);
- sys_close(0);sys_close(1);sys_close(2);
- sys_setsid();
-- (void) sys_open("/dev/console",O_RDWR,0);
-+ (void) sys_open((__force const char __user *)"/dev/console",O_RDWR,0);
- (void) sys_dup(0);
- (void) sys_dup(0);
- return kernel_execve(shell, argv, envp_init);
-@@ -47,13 +47,13 @@ static void __init handle_initrd(void)
- create_dev("/dev/root.old", Root_RAM0);
- /* mount initrd on rootfs' /root */
- mount_block_root("/dev/root.old", root_mountflags & ~MS_RDONLY);
-- sys_mkdir("/old", 0700);
-- root_fd = sys_open("/", 0, 0);
-- old_fd = sys_open("/old", 0, 0);
-+ sys_mkdir((const char __force_user *)"/old", 0700);
-+ root_fd = sys_open((const char __force_user *)"/", 0, 0);
-+ old_fd = sys_open((const char __force_user *)"/old", 0, 0);
- /* move initrd over / and chdir/chroot in initrd root */
-- sys_chdir("/root");
-- sys_mount(".", "/", NULL, MS_MOVE, NULL);
-- sys_chroot(".");
-+ sys_chdir((const char __force_user *)"/root");
-+ sys_mount((char __force_user *)".", (char __force_user *)"/", NULL, MS_MOVE, NULL);
-+ sys_chroot((const char __force_user *)".");
-
- /*
- * In case that a resume from disk is carried out by linuxrc or one of
-@@ -70,15 +70,15 @@ static void __init handle_initrd(void)
-
- /* move initrd to rootfs' /old */
- sys_fchdir(old_fd);
-- sys_mount("/", ".", NULL, MS_MOVE, NULL);
-+ sys_mount((char __force_user *)"/", (char __force_user *)".", NULL, MS_MOVE, NULL);
- /* switch root and cwd back to / of rootfs */
- sys_fchdir(root_fd);
-- sys_chroot(".");
-+ sys_chroot((const char __force_user *)".");
- sys_close(old_fd);
- sys_close(root_fd);
-
- if (new_decode_dev(real_root_dev) == Root_RAM0) {
-- sys_chdir("/old");
-+ sys_chdir((const char __force_user *)"/old");
- return;
- }
-
-@@ -86,17 +86,17 @@ static void __init handle_initrd(void)
- mount_root();
-
- printk(KERN_NOTICE "Trying to move old root to /initrd ... ");
-- error = sys_mount("/old", "/root/initrd", NULL, MS_MOVE, NULL);
-+ error = sys_mount((char __force_user *)"/old", (char __force_user *)"/root/initrd", NULL, MS_MOVE, NULL);
- if (!error)
- printk("okay\n");
- else {
-- int fd = sys_open("/dev/root.old", O_RDWR, 0);
-+ int fd = sys_open((const char __force_user *)"/dev/root.old", O_RDWR, 0);
- if (error == -ENOENT)
- printk("/initrd does not exist. Ignored.\n");
- else
- printk("failed\n");
- printk(KERN_NOTICE "Unmounting old root\n");
-- sys_umount("/old", MNT_DETACH);
-+ sys_umount((char __force_user *)"/old", MNT_DETACH);
- printk(KERN_NOTICE "Trying to free ramdisk memory ... ");
- if (fd < 0) {
- error = fd;
-@@ -119,11 +119,11 @@ int __init initrd_load(void)
- * mounted in the normal path.
- */
- if (rd_load_image("/initrd.image") && ROOT_DEV != Root_RAM0) {
-- sys_unlink("/initrd.image");
-+ sys_unlink((const char __force_user *)"/initrd.image");
- handle_initrd();
- return 1;
- }
- }
-- sys_unlink("/initrd.image");
-+ sys_unlink((const char __force_user *)"/initrd.image");
- return 0;
- }
-diff --git a/init/do_mounts_md.c b/init/do_mounts_md.c
-index 69aebbf..c0bf6a7 100644
---- a/init/do_mounts_md.c
-+++ b/init/do_mounts_md.c
-@@ -170,7 +170,7 @@ static void __init md_setup_drive(void)
- partitioned ? "_d" : "", minor,
- md_setup_args[ent].device_names);
-
-- fd = sys_open(name, 0, 0);
-+ fd = sys_open((char __force_user *)name, 0, 0);
- if (fd < 0) {
- printk(KERN_ERR "md: open failed - cannot start "
- "array %s\n", name);
-@@ -233,7 +233,7 @@ static void __init md_setup_drive(void)
- * array without it
- */
- sys_close(fd);
-- fd = sys_open(name, 0, 0);
-+ fd = sys_open((char __force_user *)name, 0, 0);
- sys_ioctl(fd, BLKRRPART, 0);
- }
- sys_close(fd);
-@@ -283,7 +283,7 @@ static void __init autodetect_raid(void)
-
- wait_for_device_probe();
-
-- fd = sys_open("/dev/md0", 0, 0);
-+ fd = sys_open((__force char __user *)"/dev/md0", 0, 0);
- if (fd >= 0) {
- sys_ioctl(fd, RAID_AUTORUN, raid_autopart);
- sys_close(fd);
-diff --git a/init/initramfs.c b/init/initramfs.c
-index 1fd59b8..a01b079 100644
---- a/init/initramfs.c
-+++ b/init/initramfs.c
-@@ -74,7 +74,7 @@ static void __init free_hash(void)
- }
- }
-
--static long __init do_utime(char __user *filename, time_t mtime)
-+static long __init do_utime(__force char __user *filename, time_t mtime)
- {
- struct timespec t[2];
-
-@@ -109,7 +109,7 @@ static void __init dir_utime(void)
- struct dir_entry *de, *tmp;
- list_for_each_entry_safe(de, tmp, &dir_list, list) {
- list_del(&de->list);
-- do_utime(de->name, de->mtime);
-+ do_utime((char __force_user *)de->name, de->mtime);
- kfree(de->name);
- kfree(de);
- }
-@@ -271,7 +271,7 @@ static int __init maybe_link(void)
- if (nlink >= 2) {
- char *old = find_link(major, minor, ino, mode, collected);
- if (old)
-- return (sys_link(old, collected) < 0) ? -1 : 1;
-+ return (sys_link((char __force_user *)old, (char __force_user *)collected) < 0) ? -1 : 1;
- }
- return 0;
- }
-@@ -280,11 +280,11 @@ static void __init clean_path(char *path, mode_t mode)
- {
- struct stat st;
-
-- if (!sys_newlstat(path, &st) && (st.st_mode^mode) & S_IFMT) {
-+ if (!sys_newlstat((char __force_user *)path, (struct stat __force_user *)&st) && (st.st_mode^mode) & S_IFMT) {
- if (S_ISDIR(st.st_mode))
-- sys_rmdir(path);
-+ sys_rmdir((char __force_user *)path);
- else
-- sys_unlink(path);
-+ sys_unlink((char __force_user *)path);
- }
- }
-
-@@ -305,7 +305,7 @@ static int __init do_name(void)
- int openflags = O_WRONLY|O_CREAT;
- if (ml != 1)
- openflags |= O_TRUNC;
-- wfd = sys_open(collected, openflags, mode);
-+ wfd = sys_open((char __force_user *)collected, openflags, mode);
-
- if (wfd >= 0) {
- sys_fchown(wfd, uid, gid);
-@@ -317,17 +317,17 @@ static int __init do_name(void)
- }
- }
- } else if (S_ISDIR(mode)) {
-- sys_mkdir(collected, mode);
-- sys_chown(collected, uid, gid);
-- sys_chmod(collected, mode);
-+ sys_mkdir((char __force_user *)collected, mode);
-+ sys_chown((char __force_user *)collected, uid, gid);
-+ sys_chmod((char __force_user *)collected, mode);
- dir_add(collected, mtime);
- } else if (S_ISBLK(mode) || S_ISCHR(mode) ||
- S_ISFIFO(mode) || S_ISSOCK(mode)) {
- if (maybe_link() == 0) {
-- sys_mknod(collected, mode, rdev);
-- sys_chown(collected, uid, gid);
-- sys_chmod(collected, mode);
-- do_utime(collected, mtime);
-+ sys_mknod((char __force_user *)collected, mode, rdev);
-+ sys_chown((char __force_user *)collected, uid, gid);
-+ sys_chmod((char __force_user *)collected, mode);
-+ do_utime((char __force_user *)collected, mtime);
- }
- }
- return 0;
-@@ -336,15 +336,15 @@ static int __init do_name(void)
- static int __init do_copy(void)
- {
- if (count >= body_len) {
-- sys_write(wfd, victim, body_len);
-+ sys_write(wfd, (char __force_user *)victim, body_len);
- sys_close(wfd);
-- do_utime(vcollected, mtime);
-+ do_utime((char __force_user *)vcollected, mtime);
- kfree(vcollected);
- eat(body_len);
- state = SkipIt;
- return 0;
- } else {
-- sys_write(wfd, victim, count);
-+ sys_write(wfd, (char __force_user *)victim, count);
- body_len -= count;
- eat(count);
- return 1;
-@@ -355,9 +355,9 @@ static int __init do_symlink(void)
- {
- collected[N_ALIGN(name_len) + body_len] = '\0';
- clean_path(collected, 0);
-- sys_symlink(collected + N_ALIGN(name_len), collected);
-- sys_lchown(collected, uid, gid);
-- do_utime(collected, mtime);
-+ sys_symlink((char __force_user *)collected + N_ALIGN(name_len), (char __force_user *)collected);
-+ sys_lchown((char __force_user *)collected, uid, gid);
-+ do_utime((char __force_user *)collected, mtime);
- state = SkipIt;
- next_state = Reset;
- return 0;
-diff --git a/init/main.c b/init/main.c
-index 1eb4bd5..24fe9c2 100644
---- a/init/main.c
-+++ b/init/main.c
-@@ -97,6 +97,7 @@ static inline void mark_rodata_ro(void) { }
- #ifdef CONFIG_TC
- extern void tc_init(void);
- #endif
-+extern void grsecurity_init(void);
-
- enum system_states system_state __read_mostly;
- EXPORT_SYMBOL(system_state);
-@@ -183,6 +184,61 @@ static int __init set_reset_devices(char *str)
-
- __setup("reset_devices", set_reset_devices);
-
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+int grsec_proc_gid = CONFIG_GRKERNSEC_PROC_GID;
-+static int __init setup_grsec_proc_gid(char *str)
-+{
-+ grsec_proc_gid = (int)simple_strtol(str, NULL, 0);
-+ return 1;
-+}
-+__setup("grsec_proc_gid=", setup_grsec_proc_gid);
-+#endif
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+extern char pax_enter_kernel_user[];
-+extern char pax_exit_kernel_user[];
-+extern pgdval_t clone_pgd_mask;
-+#endif
-+
-+#if defined(CONFIG_X86) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+static int __init setup_pax_nouderef(char *str)
-+{
-+#ifdef CONFIG_X86_32
-+ unsigned int cpu;
-+ struct desc_struct *gdt;
-+
-+ for (cpu = 0; cpu < nr_cpu_ids; cpu++) {
-+ gdt = get_cpu_gdt_table(cpu);
-+ gdt[GDT_ENTRY_KERNEL_DS].type = 3;
-+ gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
-+ gdt[GDT_ENTRY_DEFAULT_USER_CS].limit = 0xf;
-+ gdt[GDT_ENTRY_DEFAULT_USER_DS].limit = 0xf;
-+ }
-+ loadsegment(ds, __KERNEL_DS);
-+ loadsegment(es, __KERNEL_DS);
-+ loadsegment(ss, __KERNEL_DS);
-+#else
-+ memcpy(pax_enter_kernel_user, (unsigned char []){0xc3}, 1);
-+ memcpy(pax_exit_kernel_user, (unsigned char []){0xc3}, 1);
-+ clone_pgd_mask = ~(pgdval_t)0UL;
-+#endif
-+
-+ return 0;
-+}
-+early_param("pax_nouderef", setup_pax_nouderef);
-+#endif
-+
-+#ifdef CONFIG_PAX_SOFTMODE
-+int pax_softmode;
-+
-+static int __init setup_pax_softmode(char *str)
-+{
-+ get_option(&str, &pax_softmode);
-+ return 1;
-+}
-+__setup("pax_softmode=", setup_pax_softmode);
-+#endif
-+
- static char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
- char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
- static const char *panic_later, *panic_param;
-@@ -705,64 +761,75 @@ int initcall_debug;
- core_param(initcall_debug, initcall_debug, bool, 0644);
-
- static char msgbuf[64];
--static struct boot_trace_call call;
--static struct boot_trace_ret ret;
-+static struct boot_trace_call trace_call;
-+static struct boot_trace_ret trace_ret;
-
- int do_one_initcall(initcall_t fn)
- {
- int count = preempt_count();
- ktime_t calltime, delta, rettime;
-+ const char *msg1 = "", *msg2 = "";
-
- if (initcall_debug) {
-- call.caller = task_pid_nr(current);
-- printk("calling %pF @ %i\n", fn, call.caller);
-+ trace_call.caller = task_pid_nr(current);
-+ printk("calling %pF @ %i\n", fn, trace_call.caller);
- calltime = ktime_get();
-- trace_boot_call(&call, fn);
-+ trace_boot_call(&trace_call, fn);
- enable_boot_trace();
- }
-
-- ret.result = fn();
-+ trace_ret.result = fn();
-
- if (initcall_debug) {
- disable_boot_trace();
- rettime = ktime_get();
- delta = ktime_sub(rettime, calltime);
-- ret.duration = (unsigned long long) ktime_to_ns(delta) >> 10;
-- trace_boot_ret(&ret, fn);
-+ trace_ret.duration = (unsigned long long) ktime_to_ns(delta) >> 10;
-+ trace_boot_ret(&trace_ret, fn);
- printk("initcall %pF returned %d after %Ld usecs\n", fn,
-- ret.result, ret.duration);
-+ trace_ret.result, trace_ret.duration);
- }
-
- msgbuf[0] = 0;
-
-- if (ret.result && ret.result != -ENODEV && initcall_debug)
-- sprintf(msgbuf, "error code %d ", ret.result);
-+ if (trace_ret.result && trace_ret.result != -ENODEV && initcall_debug)
-+ sprintf(msgbuf, "error code %d ", trace_ret.result);
-
- if (preempt_count() != count) {
-- strlcat(msgbuf, "preemption imbalance ", sizeof(msgbuf));
-+ msg1 = " preemption imbalance";
- preempt_count() = count;
- }
- if (irqs_disabled()) {
-- strlcat(msgbuf, "disabled interrupts ", sizeof(msgbuf));
-+ msg2 = " disabled interrupts";
- local_irq_enable();
- }
-- if (msgbuf[0]) {
-- printk("initcall %pF returned with %s\n", fn, msgbuf);
-+ if (msgbuf[0] || *msg1 || *msg2) {
-+ printk("initcall %pF returned with %s%s%s\n", fn, msgbuf, msg1, msg2);
- }
-
-- return ret.result;
-+ return trace_ret.result;
- }
-
-
- extern initcall_t __initcall_start[], __initcall_end[], __early_initcall_end[];
-
-+#ifdef CONFIG_PAX_LATENT_ENTROPY
-+u64 latent_entropy;
-+#endif
-+
- static void __init do_initcalls(void)
- {
- initcall_t *call;
-
-- for (call = __early_initcall_end; call < __initcall_end; call++)
-+ for (call = __early_initcall_end; call < __initcall_end; call++) {
- do_one_initcall(*call);
-
-+#ifdef CONFIG_PAX_LATENT_ENTROPY
-+ add_device_randomness(&latent_entropy, sizeof(latent_entropy));
-+#endif
-+
-+ }
-+
- /* Make sure there is no pending stuff from the initcall sequence */
- flush_scheduled_work();
- }
-@@ -790,8 +857,14 @@ static void __init do_pre_smp_initcalls(void)
- {
- initcall_t *call;
-
-- for (call = __initcall_start; call < __early_initcall_end; call++)
-+ for (call = __initcall_start; call < __early_initcall_end; call++) {
- do_one_initcall(*call);
-+
-+#ifdef CONFIG_PAX_LATENT_ENTROPY
-+ add_device_randomness(&latent_entropy, sizeof(latent_entropy));
-+#endif
-+
-+ }
- }
-
- static void run_init_process(char *init_filename)
-@@ -893,11 +966,13 @@ static int __init kernel_init(void * unused)
- if (!ramdisk_execute_command)
- ramdisk_execute_command = "/init";
-
-- if (sys_access((const char __user *) ramdisk_execute_command, 0) != 0) {
-+ if (sys_access((const char __force_user *) ramdisk_execute_command, 0) != 0) {
- ramdisk_execute_command = NULL;
- prepare_namespace();
- }
-
-+ grsecurity_init();
-+
- /*
- * Ok, we have completed the initial bootup, and
- * we're essentially up and running. Get rid of the
-diff --git a/init/noinitramfs.c b/init/noinitramfs.c
-index f4c1a3a..96c19bd 100644
---- a/init/noinitramfs.c
-+++ b/init/noinitramfs.c
-@@ -29,7 +29,7 @@ static int __init default_rootfs(void)
- {
- int err;
-
-- err = sys_mkdir("/dev", 0755);
-+ err = sys_mkdir((const char __user *)"/dev", 0755);
- if (err < 0)
- goto out;
-
-@@ -39,7 +39,7 @@ static int __init default_rootfs(void)
- if (err < 0)
- goto out;
-
-- err = sys_mkdir("/root", 0700);
-+ err = sys_mkdir((const char __user *)"/root", 0700);
- if (err < 0)
- goto out;
-
-diff --git a/ipc/mqueue.c b/ipc/mqueue.c
-index d01bc14..8df81db 100644
---- a/ipc/mqueue.c
-+++ b/ipc/mqueue.c
-@@ -150,6 +150,7 @@ static struct inode *mqueue_get_inode(struct super_block *sb,
- mq_bytes = (mq_msg_tblsz +
- (info->attr.mq_maxmsg * info->attr.mq_msgsize));
-
-+ gr_learn_resource(current, RLIMIT_MSGQUEUE, u->mq_bytes + mq_bytes, 1);
- spin_lock(&mq_lock);
- if (u->mq_bytes + mq_bytes < u->mq_bytes ||
- u->mq_bytes + mq_bytes >
-diff --git a/ipc/msg.c b/ipc/msg.c
-index 779f762..4af9e36 100644
---- a/ipc/msg.c
-+++ b/ipc/msg.c
-@@ -310,18 +310,19 @@ static inline int msg_security(struct kern_ipc_perm *ipcp, int msgflg)
- return security_msg_queue_associate(msq, msgflg);
- }
-
-+static struct ipc_ops msg_ops = {
-+ .getnew = newque,
-+ .associate = msg_security,
-+ .more_checks = NULL
-+};
-+
- SYSCALL_DEFINE2(msgget, key_t, key, int, msgflg)
- {
- struct ipc_namespace *ns;
-- struct ipc_ops msg_ops;
- struct ipc_params msg_params;
-
- ns = current->nsproxy->ipc_ns;
-
-- msg_ops.getnew = newque;
-- msg_ops.associate = msg_security;
-- msg_ops.more_checks = NULL;
--
- msg_params.key = key;
- msg_params.flg = msgflg;
-
-diff --git a/ipc/sem.c b/ipc/sem.c
-index b781007..f738b04 100644
---- a/ipc/sem.c
-+++ b/ipc/sem.c
-@@ -309,10 +309,15 @@ static inline int sem_more_checks(struct kern_ipc_perm *ipcp,
- return 0;
- }
-
-+static struct ipc_ops sem_ops = {
-+ .getnew = newary,
-+ .associate = sem_security,
-+ .more_checks = sem_more_checks
-+};
-+
- SYSCALL_DEFINE3(semget, key_t, key, int, nsems, int, semflg)
- {
- struct ipc_namespace *ns;
-- struct ipc_ops sem_ops;
- struct ipc_params sem_params;
-
- ns = current->nsproxy->ipc_ns;
-@@ -320,10 +325,6 @@ SYSCALL_DEFINE3(semget, key_t, key, int, nsems, int, semflg)
- if (nsems < 0 || nsems > ns->sc_semmsl)
- return -EINVAL;
-
-- sem_ops.getnew = newary;
-- sem_ops.associate = sem_security;
-- sem_ops.more_checks = sem_more_checks;
--
- sem_params.key = key;
- sem_params.flg = semflg;
- sem_params.u.nsems = nsems;
-@@ -671,6 +672,8 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
- ushort* sem_io = fast_sem_io;
- int nsems;
-
-+ pax_track_stack();
-+
- sma = sem_lock_check(ns, semid);
- if (IS_ERR(sma))
- return PTR_ERR(sma);
-@@ -1071,6 +1074,8 @@ SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops,
- unsigned long jiffies_left = 0;
- struct ipc_namespace *ns;
-
-+ pax_track_stack();
-+
- ns = current->nsproxy->ipc_ns;
-
- if (nsops < 1 || semid < 0)
-diff --git a/ipc/shm.c b/ipc/shm.c
-index d30732c..e4992cd 100644
---- a/ipc/shm.c
-+++ b/ipc/shm.c
-@@ -70,6 +70,14 @@ static void shm_destroy (struct ipc_namespace *ns, struct shmid_kernel *shp);
- static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
- #endif
-
-+#ifdef CONFIG_GRKERNSEC
-+extern int gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
-+ const time_t shm_createtime, const uid_t cuid,
-+ const int shmid);
-+extern int gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
-+ const time_t shm_createtime);
-+#endif
-+
- void shm_init_ns(struct ipc_namespace *ns)
- {
- ns->shm_ctlmax = SHMMAX;
-@@ -396,6 +404,14 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
- shp->shm_lprid = 0;
- shp->shm_atim = shp->shm_dtim = 0;
- shp->shm_ctim = get_seconds();
-+#ifdef CONFIG_GRKERNSEC
-+ {
-+ struct timespec timeval;
-+ do_posix_clock_monotonic_gettime(&timeval);
-+
-+ shp->shm_createtime = timeval.tv_sec;
-+ }
-+#endif
- shp->shm_segsz = size;
- shp->shm_nattch = 0;
- shp->shm_file = file;
-@@ -446,18 +462,19 @@ static inline int shm_more_checks(struct kern_ipc_perm *ipcp,
- return 0;
- }
-
-+static struct ipc_ops shm_ops = {
-+ .getnew = newseg,
-+ .associate = shm_security,
-+ .more_checks = shm_more_checks
-+};
-+
- SYSCALL_DEFINE3(shmget, key_t, key, size_t, size, int, shmflg)
- {
- struct ipc_namespace *ns;
-- struct ipc_ops shm_ops;
- struct ipc_params shm_params;
-
- ns = current->nsproxy->ipc_ns;
-
-- shm_ops.getnew = newseg;
-- shm_ops.associate = shm_security;
-- shm_ops.more_checks = shm_more_checks;
--
- shm_params.key = key;
- shm_params.flg = shmflg;
- shm_params.u.size = size;
-@@ -857,6 +874,12 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr)
- f_mode = FMODE_READ | FMODE_WRITE;
- }
- if (shmflg & SHM_EXEC) {
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (current->mm->pax_flags & MF_PAX_MPROTECT)
-+ goto out;
-+#endif
-+
- prot |= PROT_EXEC;
- acc_mode |= S_IXUGO;
- }
-@@ -880,9 +903,21 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr)
- if (err)
- goto out_unlock;
-
-+#ifdef CONFIG_GRKERNSEC
-+ if (!gr_handle_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime,
-+ shp->shm_perm.cuid, shmid) ||
-+ !gr_chroot_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime)) {
-+ err = -EACCES;
-+ goto out_unlock;
-+ }
-+#endif
-+
- path.dentry = dget(shp->shm_file->f_path.dentry);
- path.mnt = shp->shm_file->f_path.mnt;
- shp->shm_nattch++;
-+#ifdef CONFIG_GRKERNSEC
-+ shp->shm_lapid = current->pid;
-+#endif
- size = i_size_read(path.dentry->d_inode);
- shm_unlock(shp);
-
-diff --git a/kernel/Makefile b/kernel/Makefile
-index d7c13d2..13de8d7 100644
---- a/kernel/Makefile
-+++ b/kernel/Makefile
-@@ -66,7 +66,9 @@ obj-$(CONFIG_USER_NS) += user_namespace.o
- obj-$(CONFIG_PID_NS) += pid_namespace.o
- obj-$(CONFIG_IKCONFIG) += configs.o
- obj-$(CONFIG_RESOURCE_COUNTERS) += res_counter.o
-+ifeq ($(CONFIG_SMP),y)
- obj-$(CONFIG_STOP_MACHINE) += stop_machine.o
-+endif
- obj-$(CONFIG_KPROBES_SANITY_TEST) += test_kprobes.o
- obj-$(CONFIG_AUDIT) += audit.o auditfilter.o audit_watch.o
- obj-$(CONFIG_AUDITSYSCALL) += auditsc.o
-diff --git a/kernel/acct.c b/kernel/acct.c
-index a6605ca..ca91111 100644
---- a/kernel/acct.c
-+++ b/kernel/acct.c
-@@ -579,7 +579,7 @@ static void do_acct_process(struct bsd_acct_struct *acct,
- */
- flim = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
- current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY;
-- file->f_op->write(file, (char *)&ac,
-+ file->f_op->write(file, (char __force_user *)&ac,
- sizeof(acct_t), &file->f_pos);
- current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
- set_fs(fs);
-diff --git a/kernel/audit.c b/kernel/audit.c
-index 5feed23..48415fd 100644
---- a/kernel/audit.c
-+++ b/kernel/audit.c
-@@ -110,7 +110,7 @@ u32 audit_sig_sid = 0;
- 3) suppressed due to audit_rate_limit
- 4) suppressed due to audit_backlog_limit
- */
--static atomic_t audit_lost = ATOMIC_INIT(0);
-+static atomic_unchecked_t audit_lost = ATOMIC_INIT(0);
-
- /* The netlink socket. */
- static struct sock *audit_sock;
-@@ -232,7 +232,7 @@ void audit_log_lost(const char *message)
- unsigned long now;
- int print;
-
-- atomic_inc(&audit_lost);
-+ atomic_inc_unchecked(&audit_lost);
-
- print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit);
-
-@@ -251,7 +251,7 @@ void audit_log_lost(const char *message)
- printk(KERN_WARNING
- "audit: audit_lost=%d audit_rate_limit=%d "
- "audit_backlog_limit=%d\n",
-- atomic_read(&audit_lost),
-+ atomic_read_unchecked(&audit_lost),
- audit_rate_limit,
- audit_backlog_limit);
- audit_panic(message);
-@@ -691,7 +691,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
- status_set.pid = audit_pid;
- status_set.rate_limit = audit_rate_limit;
- status_set.backlog_limit = audit_backlog_limit;
-- status_set.lost = atomic_read(&audit_lost);
-+ status_set.lost = atomic_read_unchecked(&audit_lost);
- status_set.backlog = skb_queue_len(&audit_skb_queue);
- audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_GET, 0, 0,
- &status_set, sizeof(status_set));
-@@ -891,8 +891,10 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
- spin_unlock_irq(&tsk->sighand->siglock);
- }
- read_unlock(&tasklist_lock);
-- audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_TTY_GET, 0, 0,
-- &s, sizeof(s));
-+
-+ if (!err)
-+ audit_send_reply(NETLINK_CB(skb).pid, seq,
-+ AUDIT_TTY_GET, 0, 0, &s, sizeof(s));
- break;
- }
- case AUDIT_TTY_SET: {
-@@ -1262,12 +1264,13 @@ static void audit_log_vformat(struct audit_buffer *ab, const char *fmt,
- avail = audit_expand(ab,
- max_t(unsigned, AUDIT_BUFSIZ, 1+len-avail));
- if (!avail)
-- goto out;
-+ goto out_va_end;
- len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args2);
- }
-- va_end(args2);
- if (len > 0)
- skb_put(skb, len);
-+out_va_end:
-+ va_end(args2);
- out:
- return;
- }
-diff --git a/kernel/auditsc.c b/kernel/auditsc.c
-index 267e484..ac41bc3 100644
---- a/kernel/auditsc.c
-+++ b/kernel/auditsc.c
-@@ -1157,8 +1157,8 @@ static void audit_log_execve_info(struct audit_context *context,
- struct audit_buffer **ab,
- struct audit_aux_data_execve *axi)
- {
-- int i;
-- size_t len, len_sent = 0;
-+ int i, len;
-+ size_t len_sent = 0;
- const char __user *p;
- char *buf;
-
-@@ -2113,7 +2113,7 @@ int auditsc_get_stamp(struct audit_context *ctx,
- }
-
- /* global counter which is incremented every time something logs in */
--static atomic_t session_id = ATOMIC_INIT(0);
-+static atomic_unchecked_t session_id = ATOMIC_INIT(0);
-
- /**
- * audit_set_loginuid - set a task's audit_context loginuid
-@@ -2126,7 +2126,7 @@ static atomic_t session_id = ATOMIC_INIT(0);
- */
- int audit_set_loginuid(struct task_struct *task, uid_t loginuid)
- {
-- unsigned int sessionid = atomic_inc_return(&session_id);
-+ unsigned int sessionid = atomic_inc_return_unchecked(&session_id);
- struct audit_context *context = task->audit_context;
-
- if (context && context->in_syscall) {
-diff --git a/kernel/capability.c b/kernel/capability.c
-index 8a944f5..7c9e099 100644
---- a/kernel/capability.c
-+++ b/kernel/capability.c
-@@ -254,7 +254,7 @@ SYSCALL_DEFINE2(capset, cap_user_header_t, header, const cap_user_data_t, data)
- if (pid != 0 && pid != task_pid_vnr(current))
- return -EPERM;
-
-- if (copy_from_user(&kdata, data,
-+ if (tocopy > _KERNEL_CAPABILITY_U32S || copy_from_user(&kdata, data,
- tocopy * sizeof(struct __user_cap_data_struct)))
- return -EFAULT;
-
-@@ -305,10 +305,26 @@ int capable(int cap)
- BUG();
- }
-
-- if (security_capable(cap) == 0) {
-+ if (security_capable(cap) == 0 && gr_is_capable(cap)) {
- current->flags |= PF_SUPERPRIV;
- return 1;
- }
- return 0;
- }
-+
-+int capable_nolog(int cap)
-+{
-+ if (unlikely(!cap_valid(cap))) {
-+ printk(KERN_CRIT "capable_nolog() called with invalid cap=%u\n", cap);
-+ BUG();
-+ }
-+
-+ if (security_capable_noaudit(cap) == 0 && gr_is_capable_nolog(cap)) {
-+ current->flags |= PF_SUPERPRIV;
-+ return 1;
-+ }
-+ return 0;
-+}
-+
- EXPORT_SYMBOL(capable);
-+EXPORT_SYMBOL(capable_nolog);
-diff --git a/kernel/cgroup.c b/kernel/cgroup.c
-index 04a9704..76c3dd1 100644
---- a/kernel/cgroup.c
-+++ b/kernel/cgroup.c
-@@ -536,6 +536,8 @@ static struct css_set *find_css_set(
- struct hlist_head *hhead;
- struct cg_cgroup_link *link;
-
-+ pax_track_stack();
-+
- /* First see if we already have a cgroup group that matches
- * the desired set */
- read_lock(&css_set_lock);
-@@ -4122,7 +4124,7 @@ static int cgroup_css_links_read(struct cgroup *cont,
- struct css_set *cg = link->cg;
- struct task_struct *task;
- int count = 0;
-- seq_printf(seq, "css_set %p\n", cg);
-+ seq_printf(seq, "css_set %pK\n", cg);
- list_for_each_entry(task, &cg->tasks, cg_list) {
- if (count++ > MAX_TASKS_SHOWN_PER_CSS) {
- seq_puts(seq, " ...\n");
-diff --git a/kernel/compat.c b/kernel/compat.c
-index 8bc5578..186e44a 100644
---- a/kernel/compat.c
-+++ b/kernel/compat.c
-@@ -108,7 +108,7 @@ static long compat_nanosleep_restart(struct restart_block *restart)
- mm_segment_t oldfs;
- long ret;
-
-- restart->nanosleep.rmtp = (struct timespec __user *) &rmt;
-+ restart->nanosleep.rmtp = (struct timespec __force_user *) &rmt;
- oldfs = get_fs();
- set_fs(KERNEL_DS);
- ret = hrtimer_nanosleep_restart(restart);
-@@ -140,7 +140,7 @@ asmlinkage long compat_sys_nanosleep(struct compat_timespec __user *rqtp,
- oldfs = get_fs();
- set_fs(KERNEL_DS);
- ret = hrtimer_nanosleep(&tu,
-- rmtp ? (struct timespec __user *)&rmt : NULL,
-+ rmtp ? (struct timespec __force_user *)&rmt : NULL,
- HRTIMER_MODE_REL, CLOCK_MONOTONIC);
- set_fs(oldfs);
-
-@@ -247,7 +247,7 @@ asmlinkage long compat_sys_sigpending(compat_old_sigset_t __user *set)
- mm_segment_t old_fs = get_fs();
-
- set_fs(KERNEL_DS);
-- ret = sys_sigpending((old_sigset_t __user *) &s);
-+ ret = sys_sigpending((old_sigset_t __force_user *) &s);
- set_fs(old_fs);
- if (ret == 0)
- ret = put_user(s, set);
-@@ -266,8 +266,8 @@ asmlinkage long compat_sys_sigprocmask(int how, compat_old_sigset_t __user *set,
- old_fs = get_fs();
- set_fs(KERNEL_DS);
- ret = sys_sigprocmask(how,
-- set ? (old_sigset_t __user *) &s : NULL,
-- oset ? (old_sigset_t __user *) &s : NULL);
-+ set ? (old_sigset_t __force_user *) &s : NULL,
-+ oset ? (old_sigset_t __force_user *) &s : NULL);
- set_fs(old_fs);
- if (ret == 0)
- if (oset)
-@@ -310,7 +310,7 @@ asmlinkage long compat_sys_old_getrlimit(unsigned int resource,
- mm_segment_t old_fs = get_fs();
-
- set_fs(KERNEL_DS);
-- ret = sys_old_getrlimit(resource, &r);
-+ ret = sys_old_getrlimit(resource, (struct rlimit __force_user *)&r);
- set_fs(old_fs);
-
- if (!ret) {
-@@ -385,7 +385,7 @@ asmlinkage long compat_sys_getrusage(int who, struct compat_rusage __user *ru)
- mm_segment_t old_fs = get_fs();
-
- set_fs(KERNEL_DS);
-- ret = sys_getrusage(who, (struct rusage __user *) &r);
-+ ret = sys_getrusage(who, (struct rusage __force_user *) &r);
- set_fs(old_fs);
-
- if (ret)
-@@ -412,8 +412,8 @@ compat_sys_wait4(compat_pid_t pid, compat_uint_t __user *stat_addr, int options,
- set_fs (KERNEL_DS);
- ret = sys_wait4(pid,
- (stat_addr ?
-- (unsigned int __user *) &status : NULL),
-- options, (struct rusage __user *) &r);
-+ (unsigned int __force_user *) &status : NULL),
-+ options, (struct rusage __force_user *) &r);
- set_fs (old_fs);
-
- if (ret > 0) {
-@@ -438,8 +438,8 @@ asmlinkage long compat_sys_waitid(int which, compat_pid_t pid,
- memset(&info, 0, sizeof(info));
-
- set_fs(KERNEL_DS);
-- ret = sys_waitid(which, pid, (siginfo_t __user *)&info, options,
-- uru ? (struct rusage __user *)&ru : NULL);
-+ ret = sys_waitid(which, pid, (siginfo_t __force_user *)&info, options,
-+ uru ? (struct rusage __force_user *)&ru : NULL);
- set_fs(old_fs);
-
- if ((ret < 0) || (info.si_signo == 0))
-@@ -569,8 +569,8 @@ long compat_sys_timer_settime(timer_t timer_id, int flags,
- oldfs = get_fs();
- set_fs(KERNEL_DS);
- err = sys_timer_settime(timer_id, flags,
-- (struct itimerspec __user *) &newts,
-- (struct itimerspec __user *) &oldts);
-+ (struct itimerspec __force_user *) &newts,
-+ (struct itimerspec __force_user *) &oldts);
- set_fs(oldfs);
- if (!err && old && put_compat_itimerspec(old, &oldts))
- return -EFAULT;
-@@ -587,7 +587,7 @@ long compat_sys_timer_gettime(timer_t timer_id,
- oldfs = get_fs();
- set_fs(KERNEL_DS);
- err = sys_timer_gettime(timer_id,
-- (struct itimerspec __user *) &ts);
-+ (struct itimerspec __force_user *) &ts);
- set_fs(oldfs);
- if (!err && put_compat_itimerspec(setting, &ts))
- return -EFAULT;
-@@ -606,7 +606,7 @@ long compat_sys_clock_settime(clockid_t which_clock,
- oldfs = get_fs();
- set_fs(KERNEL_DS);
- err = sys_clock_settime(which_clock,
-- (struct timespec __user *) &ts);
-+ (struct timespec __force_user *) &ts);
- set_fs(oldfs);
- return err;
- }
-@@ -621,7 +621,7 @@ long compat_sys_clock_gettime(clockid_t which_clock,
- oldfs = get_fs();
- set_fs(KERNEL_DS);
- err = sys_clock_gettime(which_clock,
-- (struct timespec __user *) &ts);
-+ (struct timespec __force_user *) &ts);
- set_fs(oldfs);
- if (!err && put_compat_timespec(&ts, tp))
- return -EFAULT;
-@@ -638,7 +638,7 @@ long compat_sys_clock_getres(clockid_t which_clock,
- oldfs = get_fs();
- set_fs(KERNEL_DS);
- err = sys_clock_getres(which_clock,
-- (struct timespec __user *) &ts);
-+ (struct timespec __force_user *) &ts);
- set_fs(oldfs);
- if (!err && tp && put_compat_timespec(&ts, tp))
- return -EFAULT;
-@@ -650,9 +650,9 @@ static long compat_clock_nanosleep_restart(struct restart_block *restart)
- long err;
- mm_segment_t oldfs;
- struct timespec tu;
-- struct compat_timespec *rmtp = restart->nanosleep.compat_rmtp;
-+ struct compat_timespec __user *rmtp = restart->nanosleep.compat_rmtp;
-
-- restart->nanosleep.rmtp = (struct timespec __user *) &tu;
-+ restart->nanosleep.rmtp = (struct timespec __force_user *) &tu;
- oldfs = get_fs();
- set_fs(KERNEL_DS);
- err = clock_nanosleep_restart(restart);
-@@ -684,8 +684,8 @@ long compat_sys_clock_nanosleep(clockid_t which_clock, int flags,
- oldfs = get_fs();
- set_fs(KERNEL_DS);
- err = sys_clock_nanosleep(which_clock, flags,
-- (struct timespec __user *) &in,
-- (struct timespec __user *) &out);
-+ (struct timespec __force_user *) &in,
-+ (struct timespec __force_user *) &out);
- set_fs(oldfs);
-
- if ((err == -ERESTART_RESTARTBLOCK) && rmtp &&
-diff --git a/kernel/configs.c b/kernel/configs.c
-index abaee68..047facd 100644
---- a/kernel/configs.c
-+++ b/kernel/configs.c
-@@ -73,8 +73,19 @@ static int __init ikconfig_init(void)
- struct proc_dir_entry *entry;
-
- /* create the current config file */
-+#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_HIDESYM)
-+ entry = proc_create("config.gz", S_IFREG | S_IRUSR, NULL,
-+ &ikconfig_file_ops);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ entry = proc_create("config.gz", S_IFREG | S_IRUSR | S_IRGRP, NULL,
-+ &ikconfig_file_ops);
-+#endif
-+#else
- entry = proc_create("config.gz", S_IFREG | S_IRUGO, NULL,
- &ikconfig_file_ops);
-+#endif
-+
- if (!entry)
- return -ENOMEM;
-
-diff --git a/kernel/cpu.c b/kernel/cpu.c
-index 3f2f04f..4e53ded 100644
---- a/kernel/cpu.c
-+++ b/kernel/cpu.c
-@@ -20,7 +20,7 @@
- /* Serializes the updates to cpu_online_mask, cpu_present_mask */
- static DEFINE_MUTEX(cpu_add_remove_lock);
-
--static __cpuinitdata RAW_NOTIFIER_HEAD(cpu_chain);
-+static RAW_NOTIFIER_HEAD(cpu_chain);
-
- /* If set, cpu_up and cpu_down will return -EBUSY and do nothing.
- * Should always be manipulated under cpu_add_remove_lock
-diff --git a/kernel/cred.c b/kernel/cred.c
-index 9c06d10..5b211dc 100644
---- a/kernel/cred.c
-+++ b/kernel/cred.c
-@@ -160,6 +160,8 @@ static void put_cred_rcu(struct rcu_head *rcu)
- */
- void __put_cred(struct cred *cred)
- {
-+ pax_track_stack();
-+
- kdebug("__put_cred(%p{%d,%d})", cred,
- atomic_read(&cred->usage),
- read_cred_subscribers(cred));
-@@ -184,6 +186,8 @@ void exit_creds(struct task_struct *tsk)
- {
- struct cred *cred;
-
-+ pax_track_stack();
-+
- kdebug("exit_creds(%u,%p,%p,{%d,%d})", tsk->pid, tsk->real_cred, tsk->cred,
- atomic_read(&tsk->cred->usage),
- read_cred_subscribers(tsk->cred));
-@@ -206,6 +210,15 @@ void exit_creds(struct task_struct *tsk)
- validate_creds(cred);
- put_cred(cred);
- }
-+
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+ cred = (struct cred *) tsk->delayed_cred;
-+ if (cred) {
-+ tsk->delayed_cred = NULL;
-+ validate_creds(cred);
-+ put_cred(cred);
-+ }
-+#endif
- }
-
- /**
-@@ -222,6 +235,8 @@ const struct cred *get_task_cred(struct task_struct *task)
- {
- const struct cred *cred;
-
-+ pax_track_stack();
-+
- rcu_read_lock();
-
- do {
-@@ -241,6 +256,8 @@ struct cred *cred_alloc_blank(void)
- {
- struct cred *new;
-
-+ pax_track_stack();
-+
- new = kmem_cache_zalloc(cred_jar, GFP_KERNEL);
- if (!new)
- return NULL;
-@@ -289,6 +306,8 @@ struct cred *prepare_creds(void)
- const struct cred *old;
- struct cred *new;
-
-+ pax_track_stack();
-+
- validate_process_creds();
-
- new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
-@@ -328,13 +347,15 @@ EXPORT_SYMBOL(prepare_creds);
-
- /*
- * Prepare credentials for current to perform an execve()
-- * - The caller must hold current->cred_guard_mutex
-+ * - The caller must hold ->cred_guard_mutex
- */
- struct cred *prepare_exec_creds(void)
- {
- struct thread_group_cred *tgcred = NULL;
- struct cred *new;
-
-+ pax_track_stack();
-+
- #ifdef CONFIG_KEYS
- tgcred = kmalloc(sizeof(*tgcred), GFP_KERNEL);
- if (!tgcred)
-@@ -441,7 +462,9 @@ int copy_creds(struct task_struct *p, unsigned long clone_flags)
- struct cred *new;
- int ret;
-
-- mutex_init(&p->cred_guard_mutex);
-+ pax_track_stack();
-+
-+ p->replacement_session_keyring = NULL;
-
- p->replacement_session_keyring = NULL;
-
-@@ -525,11 +548,13 @@ error_put:
- * Always returns 0 thus allowing this function to be tail-called at the end
- * of, say, sys_setgid().
- */
--int commit_creds(struct cred *new)
-+static int __commit_creds(struct cred *new)
- {
- struct task_struct *task = current;
- const struct cred *old = task->real_cred;
-
-+ pax_track_stack();
-+
- kdebug("commit_creds(%p{%d,%d})", new,
- atomic_read(&new->usage),
- read_cred_subscribers(new));
-@@ -546,6 +571,8 @@ int commit_creds(struct cred *new)
-
- get_cred(new); /* we will require a ref for the subj creds too */
-
-+ gr_set_role_label(task, new->uid, new->gid);
-+
- /* dumpability changes */
- if (old->euid != new->euid ||
- old->egid != new->egid ||
-@@ -565,10 +592,8 @@ int commit_creds(struct cred *new)
- key_fsgid_changed(task);
-
- /* do it
-- * - What if a process setreuid()'s and this brings the
-- * new uid over his NPROC rlimit? We can check this now
-- * cheaply with the new uid cache, so if it matters
-- * we should be checking for it. -DaveM
-+ * RLIMIT_NPROC limits on user->processes have already been checked
-+ * in set_user().
- */
- alter_cred_subscribers(new, 2);
- if (new->user != old->user)
-@@ -597,8 +622,105 @@ int commit_creds(struct cred *new)
- put_cred(old);
- return 0;
- }
-+
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+extern int set_user(struct cred *new);
-+
-+void gr_delayed_cred_worker(void)
-+{
-+ const struct cred *new = current->delayed_cred;
-+ struct cred *ncred;
-+
-+ current->delayed_cred = NULL;
-+
-+ if (current_uid() && new != NULL) {
-+ // from doing get_cred on it when queueing this
-+ put_cred(new);
-+ return;
-+ } else if (new == NULL)
-+ return;
-+
-+ ncred = prepare_creds();
-+ if (!ncred)
-+ goto die;
-+ // uids
-+ ncred->uid = new->uid;
-+ ncred->euid = new->euid;
-+ ncred->suid = new->suid;
-+ ncred->fsuid = new->fsuid;
-+ // gids
-+ ncred->gid = new->gid;
-+ ncred->egid = new->egid;
-+ ncred->sgid = new->sgid;
-+ ncred->fsgid = new->fsgid;
-+ // groups
-+ if (set_groups(ncred, new->group_info) < 0) {
-+ abort_creds(ncred);
-+ goto die;
-+ }
-+ // caps
-+ ncred->securebits = new->securebits;
-+ ncred->cap_inheritable = new->cap_inheritable;
-+ ncred->cap_permitted = new->cap_permitted;
-+ ncred->cap_effective = new->cap_effective;
-+ ncred->cap_bset = new->cap_bset;
-+
-+ if (set_user(ncred)) {
-+ abort_creds(ncred);
-+ goto die;
-+ }
-+
-+ // from doing get_cred on it when queueing this
-+ put_cred(new);
-+
-+ __commit_creds(ncred);
-+ return;
-+die:
-+ // from doing get_cred on it when queueing this
-+ put_cred(new);
-+ do_group_exit(SIGKILL);
-+}
-+#endif
-+
-+int commit_creds(struct cred *new)
-+{
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+ int ret;
-+ int schedule_it = 0;
-+ struct task_struct *t;
-+
-+ /* we won't get called with tasklist_lock held for writing
-+ and interrupts disabled as the cred struct in that case is
-+ init_cred
-+ */
-+ if (grsec_enable_setxid && !current_is_single_threaded() &&
-+ !current_uid() && new->uid) {
-+ schedule_it = 1;
-+ }
-+ ret = __commit_creds(new);
-+ if (schedule_it) {
-+ rcu_read_lock();
-+ read_lock(&tasklist_lock);
-+ for (t = next_thread(current); t != current;
-+ t = next_thread(t)) {
-+ if (t->delayed_cred == NULL) {
-+ t->delayed_cred = get_cred(new);
-+ set_tsk_thread_flag(t, TIF_GRSEC_SETXID);
-+ set_tsk_need_resched(t);
-+ }
-+ }
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+ }
-+ return ret;
-+#else
-+ return __commit_creds(new);
-+#endif
-+}
-+
- EXPORT_SYMBOL(commit_creds);
-
-+
- /**
- * abort_creds - Discard a set of credentials and unlock the current task
- * @new: The credentials that were going to be applied
-@@ -608,6 +730,8 @@ EXPORT_SYMBOL(commit_creds);
- */
- void abort_creds(struct cred *new)
- {
-+ pax_track_stack();
-+
- kdebug("abort_creds(%p{%d,%d})", new,
- atomic_read(&new->usage),
- read_cred_subscribers(new));
-@@ -631,6 +755,8 @@ const struct cred *override_creds(const struct cred *new)
- {
- const struct cred *old = current->cred;
-
-+ pax_track_stack();
-+
- kdebug("override_creds(%p{%d,%d})", new,
- atomic_read(&new->usage),
- read_cred_subscribers(new));
-@@ -660,6 +786,8 @@ void revert_creds(const struct cred *old)
- {
- const struct cred *override = current->cred;
-
-+ pax_track_stack();
-+
- kdebug("revert_creds(%p{%d,%d})", old,
- atomic_read(&old->usage),
- read_cred_subscribers(old));
-@@ -706,6 +834,8 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
- const struct cred *old;
- struct cred *new;
-
-+ pax_track_stack();
-+
- new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
- if (!new)
- return NULL;
-@@ -760,6 +890,8 @@ EXPORT_SYMBOL(prepare_kernel_cred);
- */
- int set_security_override(struct cred *new, u32 secid)
- {
-+ pax_track_stack();
-+
- return security_kernel_act_as(new, secid);
- }
- EXPORT_SYMBOL(set_security_override);
-@@ -779,6 +911,8 @@ int set_security_override_from_ctx(struct cred *new, const char *secctx)
- u32 secid;
- int ret;
-
-+ pax_track_stack();
-+
- ret = security_secctx_to_secid(secctx, strlen(secctx), &secid);
- if (ret < 0)
- return ret;
-diff --git a/kernel/exit.c b/kernel/exit.c
-index a2a1659..df8479c 100644
---- a/kernel/exit.c
-+++ b/kernel/exit.c
-@@ -174,6 +174,10 @@ void release_task(struct task_struct * p)
- struct task_struct *leader;
- int zap_leader;
- repeat:
-+#ifdef CONFIG_NET
-+ gr_del_task_from_ip_table(p);
-+#endif
-+
- tracehook_prepare_release_task(p);
- /* don't need to get the RCU readlock here - the process is dead and
- * can't be modifying its own credentials */
-@@ -397,7 +401,7 @@ int allow_signal(int sig)
- * know it'll be handled, so that they don't get converted to
- * SIGKILL or just silently dropped.
- */
-- current->sighand->action[(sig)-1].sa.sa_handler = (void __user *)2;
-+ current->sighand->action[(sig)-1].sa.sa_handler = (__force void __user *)2;
- recalc_sigpending();
- spin_unlock_irq(¤t->sighand->siglock);
- return 0;
-@@ -433,6 +437,9 @@ void daemonize(const char *name, ...)
- vsnprintf(current->comm, sizeof(current->comm), name, args);
- va_end(args);
-
-+ gr_put_exec_file(current);
-+ gr_set_kernel_label(current);
-+
- /*
- * If we were started as result of loading a module, close all of the
- * user space pages. We don't need them, and if we didn't close them
-@@ -897,17 +904,17 @@ NORET_TYPE void do_exit(long code)
- struct task_struct *tsk = current;
- int group_dead;
-
-- profile_task_exit(tsk);
--
-- WARN_ON(atomic_read(&tsk->fs_excl));
--
-+ /*
-+ * Check this first since set_fs() below depends on
-+ * current_thread_info(), which we better not access when we're in
-+ * interrupt context. Other than that, we want to do the set_fs()
-+ * as early as possible.
-+ */
- if (unlikely(in_interrupt()))
- panic("Aiee, killing interrupt handler!");
-- if (unlikely(!tsk->pid))
-- panic("Attempted to kill the idle task!");
-
- /*
-- * If do_exit is called because this processes oopsed, it's possible
-+ * If do_exit is called because this processes Oops'ed, it's possible
- * that get_fs() was left as KERNEL_DS, so reset it to USER_DS before
- * continuing. Amongst other possible reasons, this is to prevent
- * mm_release()->clear_child_tid() from writing to a user-controlled
-@@ -915,6 +922,13 @@ NORET_TYPE void do_exit(long code)
- */
- set_fs(USER_DS);
-
-+ profile_task_exit(tsk);
-+
-+ WARN_ON(atomic_read(&tsk->fs_excl));
-+
-+ if (unlikely(!tsk->pid))
-+ panic("Attempted to kill the idle task!");
-+
- tracehook_report_exit(&code);
-
- validate_creds_for_do_exit(tsk);
-@@ -973,6 +987,9 @@ NORET_TYPE void do_exit(long code)
- tsk->exit_code = code;
- taskstats_exit(tsk, group_dead);
-
-+ gr_acl_handle_psacct(tsk, code);
-+ gr_acl_handle_exit();
-+
- exit_mm(tsk);
-
- if (group_dead)
-@@ -1059,7 +1076,7 @@ SYSCALL_DEFINE1(exit, int, error_code)
- * Take down every thread in the group. This is called by fatal signals
- * as well as by sys_exit_group (below).
- */
--NORET_TYPE void
-+__noreturn void
- do_group_exit(int exit_code)
- {
- struct signal_struct *sig = current->signal;
-@@ -1188,7 +1205,7 @@ static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p)
-
- if (unlikely(wo->wo_flags & WNOWAIT)) {
- int exit_code = p->exit_code;
-- int why, status;
-+ int why;
-
- get_task_struct(p);
- read_unlock(&tasklist_lock);
-diff --git a/kernel/fork.c b/kernel/fork.c
-index c28f804..4f038a3 100644
---- a/kernel/fork.c
-+++ b/kernel/fork.c
-@@ -240,21 +240,26 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
- }
-
- err = arch_dup_task_struct(tsk, orig);
-- if (err)
-- goto out;
-+ /*
-+ * We defer looking at err, because we will need this setup
-+ * for the clean up path to work correctly.
-+ */
-
- tsk->stack = ti;
--
-- err = prop_local_init_single(&tsk->dirties);
-- if (err)
-- goto out;
--
- setup_thread_stack(tsk, orig);
-+
-+ if (err)
-+ goto out;
-+
-+ err = prop_local_init_single(&tsk->dirties);
-+ if (err)
-+ goto out;
-+
- stackend = end_of_stack(tsk);
- *stackend = STACK_END_MAGIC; /* for overflow detection */
-
- #ifdef CONFIG_CC_STACKPROTECTOR
-- tsk->stack_canary = get_random_int();
-+ tsk->stack_canary = pax_get_random_long();
- #endif
-
- /* One for us, one for whoever does the "release_task()" (usually parent) */
-@@ -294,8 +299,8 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
- mm->locked_vm = 0;
- mm->mmap = NULL;
- mm->mmap_cache = NULL;
-- mm->free_area_cache = oldmm->mmap_base;
-- mm->cached_hole_size = ~0UL;
-+ mm->free_area_cache = oldmm->free_area_cache;
-+ mm->cached_hole_size = oldmm->cached_hole_size;
- mm->map_count = 0;
- cpumask_clear(mm_cpumask(mm));
- mm->mm_rb = RB_ROOT;
-@@ -311,15 +316,13 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
- struct file *file;
-
- if (mpnt->vm_flags & VM_DONTCOPY) {
-- long pages = vma_pages(mpnt);
-- mm->total_vm -= pages;
- vm_stat_account(mm, mpnt->vm_flags, mpnt->vm_file,
-- -pages);
-+ -vma_pages(mpnt));
- continue;
- }
- charge = 0;
- if (mpnt->vm_flags & VM_ACCOUNT) {
-- unsigned int len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
-+ unsigned long len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
- if (security_vm_enough_memory(len))
- goto fail_nomem;
- charge = len;
-@@ -336,6 +339,7 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
- tmp->vm_flags &= ~VM_LOCKED;
- tmp->vm_mm = mm;
- tmp->vm_next = tmp->vm_prev = NULL;
-+ tmp->vm_mirror = NULL;
- anon_vma_link(tmp);
- file = tmp->vm_file;
- if (file) {
-@@ -385,6 +389,31 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
- if (retval)
- goto out;
- }
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (oldmm->pax_flags & MF_PAX_SEGMEXEC) {
-+ struct vm_area_struct *mpnt_m;
-+
-+ for (mpnt = oldmm->mmap, mpnt_m = mm->mmap; mpnt; mpnt = mpnt->vm_next, mpnt_m = mpnt_m->vm_next) {
-+ BUG_ON(!mpnt_m || mpnt_m->vm_mirror || mpnt->vm_mm != oldmm || mpnt_m->vm_mm != mm);
-+
-+ if (!mpnt->vm_mirror)
-+ continue;
-+
-+ if (mpnt->vm_end <= SEGMEXEC_TASK_SIZE) {
-+ BUG_ON(mpnt->vm_mirror->vm_mirror != mpnt);
-+ mpnt->vm_mirror = mpnt_m;
-+ } else {
-+ BUG_ON(mpnt->vm_mirror->vm_mirror == mpnt || mpnt->vm_mirror->vm_mirror->vm_mm != mm);
-+ mpnt_m->vm_mirror = mpnt->vm_mirror->vm_mirror;
-+ mpnt_m->vm_mirror->vm_mirror = mpnt_m;
-+ mpnt->vm_mirror->vm_mirror = mpnt;
-+ }
-+ }
-+ BUG_ON(mpnt_m);
-+ }
-+#endif
-+
- /* a new mm has just been created */
- arch_dup_mmap(oldmm, mm);
- retval = 0;
-@@ -735,13 +764,20 @@ static int copy_fs(unsigned long clone_flags, struct task_struct *tsk)
- write_unlock(&fs->lock);
- return -EAGAIN;
- }
-- fs->users++;
-+ atomic_inc(&fs->users);
- write_unlock(&fs->lock);
- return 0;
- }
- tsk->fs = copy_fs_struct(fs);
- if (!tsk->fs)
- return -ENOMEM;
-+ /* Carry through gr_chroot_dentry and is_chrooted instead
-+ of recomputing it here. Already copied when the task struct
-+ is duplicated. This allows pivot_root to not be treated as
-+ a chroot
-+ */
-+ //gr_set_chroot_entries(tsk, &tsk->fs->root);
-+
- return 0;
- }
-
-@@ -913,6 +949,8 @@ static int copy_signal(unsigned long clone_flags, struct task_struct *tsk)
-
- sig->oom_adj = current->signal->oom_adj;
-
-+ mutex_init(&sig->cred_guard_mutex);
-+
- return 0;
- }
-
-@@ -1036,12 +1074,16 @@ static struct task_struct *copy_process(unsigned long clone_flags,
- DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
- #endif
- retval = -EAGAIN;
-+
-+ gr_learn_resource(p, RLIMIT_NPROC, atomic_read(&p->real_cred->user->processes), 0);
-+
- if (atomic_read(&p->real_cred->user->processes) >=
- p->signal->rlim[RLIMIT_NPROC].rlim_cur) {
-- if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
-- p->real_cred->user != INIT_USER)
-+ if (p->real_cred->user != INIT_USER &&
-+ !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN))
- goto bad_fork_free;
- }
-+ current->flags &= ~PF_NPROC_EXCEEDED;
-
- retval = copy_creds(p, clone_flags);
- if (retval < 0)
-@@ -1263,6 +1305,11 @@ static struct task_struct *copy_process(unsigned long clone_flags,
- goto bad_fork_free_pid;
- }
-
-+ /* synchronizes with gr_set_acls()
-+ we need to call this past the point of no return for fork()
-+ */
-+ gr_copy_label(p);
-+
- if (clone_flags & CLONE_THREAD) {
- atomic_inc(¤t->signal->count);
- atomic_inc(¤t->signal->live);
-@@ -1337,6 +1384,8 @@ bad_fork_cleanup_count:
- bad_fork_free:
- free_task(p);
- fork_out:
-+ gr_log_forkfail(retval);
-+
- return ERR_PTR(retval);
- }
-
-@@ -1430,6 +1479,8 @@ long do_fork(unsigned long clone_flags,
- if (clone_flags & CLONE_PARENT_SETTID)
- put_user(nr, parent_tidptr);
-
-+ gr_handle_brute_check();
-+
- if (clone_flags & CLONE_VFORK) {
- p->vfork_done = &vfork;
- init_completion(&vfork);
-@@ -1562,7 +1613,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
- return 0;
-
- /* don't need lock here; in the worst case we'll do useless copy */
-- if (fs->users == 1)
-+ if (atomic_read(&fs->users) == 1)
- return 0;
-
- *new_fsp = copy_fs_struct(fs);
-@@ -1685,7 +1736,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
- fs = current->fs;
- write_lock(&fs->lock);
- current->fs = new_fs;
-- if (--fs->users)
-+ gr_set_chroot_entries(current, ¤t->fs->root);
-+ if (atomic_dec_return(&fs->users))
- new_fs = NULL;
- else
- new_fs = fs;
-diff --git a/kernel/futex.c b/kernel/futex.c
-index 9c5ffe1..7c85216 100644
---- a/kernel/futex.c
-+++ b/kernel/futex.c
-@@ -54,6 +54,7 @@
- #include <linux/mount.h>
- #include <linux/pagemap.h>
- #include <linux/syscalls.h>
-+#include <linux/ptrace.h>
- #include <linux/signal.h>
- #include <linux/module.h>
- #include <linux/magic.h>
-@@ -223,6 +224,11 @@ get_futex_key(u32 __user *uaddr, int fshared, union futex_key *key, int rw)
- struct page *page;
- int err, ro = 0;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && address >= SEGMEXEC_TASK_SIZE)
-+ return -EFAULT;
-+#endif
-+
- /*
- * The futex address must be "naturally" aligned.
- */
-@@ -665,8 +671,8 @@ static int futex_lock_pi_atomic(u32 __user *uaddr, struct futex_hash_bucket *hb,
- struct futex_pi_state **ps,
- struct task_struct *task, int set_waiters)
- {
-- int lock_taken, ret, ownerdied = 0;
-- u32 uval, newval, curval;
-+ int lock_taken, ret, force_take = 0;
-+ u32 uval, newval, curval, vpid = task_pid_vnr(task);
-
- retry:
- ret = lock_taken = 0;
-@@ -676,7 +682,7 @@ retry:
- * (by doing a 0 -> TID atomic cmpxchg), while holding all
- * the locks. It will most likely not succeed.
- */
-- newval = task_pid_vnr(task);
-+ newval = vpid;
- if (set_waiters)
- newval |= FUTEX_WAITERS;
-
-@@ -688,7 +694,7 @@ retry:
- /*
- * Detect deadlocks.
- */
-- if ((unlikely((curval & FUTEX_TID_MASK) == task_pid_vnr(task))))
-+ if ((unlikely((curval & FUTEX_TID_MASK) == vpid)))
- return -EDEADLK;
-
- /*
-@@ -706,17 +712,15 @@ retry:
- newval = curval | FUTEX_WAITERS;
-
- /*
-- * There are two cases, where a futex might have no owner (the
-- * owner TID is 0): OWNER_DIED. We take over the futex in this
-- * case. We also do an unconditional take over, when the owner
-- * of the futex died.
-- *
-- * This is safe as we are protected by the hash bucket lock !
-+ * Should we force take the futex? See below.
- */
-- if (unlikely(ownerdied || !(curval & FUTEX_TID_MASK))) {
-- /* Keep the OWNER_DIED bit */
-- newval = (curval & ~FUTEX_TID_MASK) | task_pid_vnr(task);
-- ownerdied = 0;
-+ if (unlikely(force_take)) {
-+ /*
-+ * Keep the OWNER_DIED and the WAITERS bit and set the
-+ * new TID value.
-+ */
-+ newval = (curval & ~FUTEX_TID_MASK) | vpid;
-+ force_take = 0;
- lock_taken = 1;
- }
-
-@@ -728,7 +732,7 @@ retry:
- goto retry;
-
- /*
-- * We took the lock due to owner died take over.
-+ * We took the lock due to forced take over.
- */
- if (unlikely(lock_taken))
- return 1;
-@@ -743,20 +747,25 @@ retry:
- switch (ret) {
- case -ESRCH:
- /*
-- * No owner found for this futex. Check if the
-- * OWNER_DIED bit is set to figure out whether
-- * this is a robust futex or not.
-+ * We failed to find an owner for this
-+ * futex. So we have no pi_state to block
-+ * on. This can happen in two cases:
-+ *
-+ * 1) The owner died
-+ * 2) A stale FUTEX_WAITERS bit
-+ *
-+ * Re-read the futex value.
- */
- if (get_futex_value_locked(&curval, uaddr))
- return -EFAULT;
-
- /*
-- * We simply start over in case of a robust
-- * futex. The code above will take the futex
-- * and return happy.
-+ * If the owner died or we have a stale
-+ * WAITERS bit the owner TID in the user space
-+ * futex is 0.
- */
-- if (curval & FUTEX_OWNER_DIED) {
-- ownerdied = 1;
-+ if (!(curval & FUTEX_TID_MASK)) {
-+ force_take = 1;
- goto retry;
- }
- default:
-@@ -775,6 +784,9 @@ static void wake_futex(struct futex_q *q)
- {
- struct task_struct *p = q->task;
-
-+ if (WARN(q->pi_state || q->rt_waiter, "refusing to wake PI futex\n"))
-+ return;
-+
- /*
- * We set q->lock_ptr = NULL _before_ we wake up the task. If
- * a non futex wake up happens on another CPU then the task
-@@ -1014,6 +1026,10 @@ retry_private:
-
- plist_for_each_entry_safe(this, next, head, list) {
- if (match_futex (&this->key, &key1)) {
-+ if (this->pi_state || this->rt_waiter) {
-+ ret = -EINVAL;
-+ goto out_unlock;
-+ }
- wake_futex(this);
- if (++ret >= nr_wake)
- break;
-@@ -1026,6 +1042,10 @@ retry_private:
- op_ret = 0;
- plist_for_each_entry_safe(this, next, head, list) {
- if (match_futex (&this->key, &key2)) {
-+ if (this->pi_state || this->rt_waiter) {
-+ ret = -EINVAL;
-+ goto out_unlock;
-+ }
- wake_futex(this);
- if (++op_ret >= nr_wake2)
- break;
-@@ -1034,6 +1054,7 @@ retry_private:
- ret += op_ret;
- }
-
-+out_unlock:
- double_unlock_hb(hb1, hb2);
- out_put_keys:
- put_futex_key(fshared, &key2);
-@@ -1328,9 +1349,13 @@ retry_private:
- /*
- * FUTEX_WAIT_REQEUE_PI and FUTEX_CMP_REQUEUE_PI should always
- * be paired with each other and no other futex ops.
-+ *
-+ * We should never be requeueing a futex_q with a pi_state,
-+ * which is awaiting a futex_unlock_pi().
- */
- if ((requeue_pi && !this->rt_waiter) ||
-- (!requeue_pi && this->rt_waiter)) {
-+ (!requeue_pi && this->rt_waiter) ||
-+ this->pi_state) {
- ret = -EINVAL;
- break;
- }
-@@ -1831,6 +1856,8 @@ static int futex_wait(u32 __user *uaddr, int fshared,
- struct futex_q q;
- int ret;
-
-+ pax_track_stack();
-+
- if (!bitset)
- return -EINVAL;
-
-@@ -1883,7 +1910,7 @@ retry:
-
- restart = ¤t_thread_info()->restart_block;
- restart->fn = futex_wait_restart;
-- restart->futex.uaddr = (u32 *)uaddr;
-+ restart->futex.uaddr = uaddr;
- restart->futex.val = val;
- restart->futex.time = abs_time->tv64;
- restart->futex.bitset = bitset;
-@@ -2245,6 +2272,8 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, int fshared,
- struct futex_q q;
- int res, ret;
-
-+ pax_track_stack();
-+
- if (uaddr == uaddr2)
- return -EINVAL;
-
-@@ -2438,6 +2467,10 @@ SYSCALL_DEFINE3(get_robust_list, int, pid,
- if (!p)
- goto err_unlock;
- ret = -EPERM;
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ if (!ptrace_may_access(p, PTRACE_MODE_READ))
-+ goto err_unlock;
-+#endif
- pcred = __task_cred(p);
- if (cred->euid != pcred->euid &&
- cred->euid != pcred->uid &&
-@@ -2504,7 +2537,7 @@ retry:
- */
- static inline int fetch_robust_entry(struct robust_list __user **entry,
- struct robust_list __user * __user *head,
-- int *pi)
-+ unsigned int *pi)
- {
- unsigned long uentry;
-
-@@ -2685,6 +2718,7 @@ static int __init futex_init(void)
- {
- u32 curval;
- int i;
-+ mm_segment_t oldfs;
-
- /*
- * This will fail and we want it. Some arch implementations do
-@@ -2696,7 +2730,10 @@ static int __init futex_init(void)
- * implementation, the non functional ones will return
- * -ENOSYS.
- */
-+ oldfs = get_fs();
-+ set_fs(USER_DS);
- curval = cmpxchg_futex_value_locked(NULL, 0, 0);
-+ set_fs(oldfs);
- if (curval == -EFAULT)
- futex_cmpxchg_enabled = 1;
-
-diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c
-index 2357165..eb25501b 100644
---- a/kernel/futex_compat.c
-+++ b/kernel/futex_compat.c
-@@ -10,6 +10,7 @@
- #include <linux/compat.h>
- #include <linux/nsproxy.h>
- #include <linux/futex.h>
-+#include <linux/ptrace.h>
-
- #include <asm/uaccess.h>
-
-@@ -135,7 +136,8 @@ compat_sys_get_robust_list(int pid, compat_uptr_t __user *head_ptr,
- {
- struct compat_robust_list_head __user *head;
- unsigned long ret;
-- const struct cred *cred = current_cred(), *pcred;
-+ const struct cred *cred = current_cred();
-+ const struct cred *pcred;
-
- if (!futex_cmpxchg_enabled)
- return -ENOSYS;
-@@ -151,6 +153,10 @@ compat_sys_get_robust_list(int pid, compat_uptr_t __user *head_ptr,
- if (!p)
- goto err_unlock;
- ret = -EPERM;
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ if (!ptrace_may_access(p, PTRACE_MODE_READ))
-+ goto err_unlock;
-+#endif
- pcred = __task_cred(p);
- if (cred->euid != pcred->euid &&
- cred->euid != pcred->uid &&
-diff --git a/kernel/gcov/base.c b/kernel/gcov/base.c
-index 9b22d03..6295b62 100644
---- a/kernel/gcov/base.c
-+++ b/kernel/gcov/base.c
-@@ -102,11 +102,6 @@ void gcov_enable_events(void)
- }
-
- #ifdef CONFIG_MODULES
--static inline int within(void *addr, void *start, unsigned long size)
--{
-- return ((addr >= start) && (addr < start + size));
--}
--
- /* Update list and generate events when modules are unloaded. */
- static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
- void *data)
-@@ -121,7 +116,7 @@ static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
- prev = NULL;
- /* Remove entries located in module from linked list. */
- for (info = gcov_info_head; info; info = info->next) {
-- if (within(info, mod->module_core, mod->core_size)) {
-+ if (within_module_core_rw((unsigned long)info, mod)) {
- if (prev)
- prev->next = info->next;
- else
-diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
-index 2818422..b63eb19 100644
---- a/kernel/hrtimer.c
-+++ b/kernel/hrtimer.c
-@@ -1402,7 +1402,7 @@ void hrtimer_peek_ahead_timers(void)
- local_irq_restore(flags);
- }
-
--static void run_hrtimer_softirq(struct softirq_action *h)
-+static void run_hrtimer_softirq(void)
- {
- struct hrtimer_cpu_base *cpu_base = &__get_cpu_var(hrtimer_bases);
-
-diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
-index 8b6b8b6..6bc87df 100644
---- a/kernel/kallsyms.c
-+++ b/kernel/kallsyms.c
-@@ -11,6 +11,9 @@
- * Changed the compression method from stem compression to "table lookup"
- * compression (see scripts/kallsyms.c for a more complete description)
- */
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+#define __INCLUDED_BY_HIDESYM 1
-+#endif
- #include <linux/kallsyms.h>
- #include <linux/module.h>
- #include <linux/init.h>
-@@ -51,12 +54,33 @@ extern const unsigned long kallsyms_markers[] __attribute__((weak));
-
- static inline int is_kernel_inittext(unsigned long addr)
- {
-+ if (system_state != SYSTEM_BOOTING)
-+ return 0;
-+
- if (addr >= (unsigned long)_sinittext
- && addr <= (unsigned long)_einittext)
- return 1;
- return 0;
- }
-
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+#ifdef CONFIG_MODULES
-+static inline int is_module_text(unsigned long addr)
-+{
-+ if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END)
-+ return 1;
-+
-+ addr = ktla_ktva(addr);
-+ return (unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END;
-+}
-+#else
-+static inline int is_module_text(unsigned long addr)
-+{
-+ return 0;
-+}
-+#endif
-+#endif
-+
- static inline int is_kernel_text(unsigned long addr)
- {
- if ((addr >= (unsigned long)_stext && addr <= (unsigned long)_etext) ||
-@@ -67,13 +91,28 @@ static inline int is_kernel_text(unsigned long addr)
-
- static inline int is_kernel(unsigned long addr)
- {
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ if (is_kernel_text(addr) || is_kernel_inittext(addr))
-+ return 1;
-+
-+ if (ktla_ktva((unsigned long)_text) <= addr && addr < (unsigned long)_end)
-+#else
- if (addr >= (unsigned long)_stext && addr <= (unsigned long)_end)
-+#endif
-+
- return 1;
- return in_gate_area_no_task(addr);
- }
-
- static int is_ksym_addr(unsigned long addr)
- {
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ if (is_module_text(addr))
-+ return 0;
-+#endif
-+
- if (all_var)
- return is_kernel(addr);
-
-@@ -413,7 +452,6 @@ static unsigned long get_ksymbol_core(struct kallsym_iter *iter)
-
- static void reset_iter(struct kallsym_iter *iter, loff_t new_pos)
- {
-- iter->name[0] = '\0';
- iter->nameoff = get_symbol_offset(new_pos);
- iter->pos = new_pos;
- }
-@@ -461,6 +499,11 @@ static int s_show(struct seq_file *m, void *p)
- {
- struct kallsym_iter *iter = m->private;
-
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ if (current_uid())
-+ return 0;
-+#endif
-+
- /* Some debugging symbols have no name. Ignore them. */
- if (!iter->name[0])
- return 0;
-@@ -501,7 +544,7 @@ static int kallsyms_open(struct inode *inode, struct file *file)
- struct kallsym_iter *iter;
- int ret;
-
-- iter = kmalloc(sizeof(*iter), GFP_KERNEL);
-+ iter = kzalloc(sizeof(*iter), GFP_KERNEL);
- if (!iter)
- return -ENOMEM;
- reset_iter(iter, 0);
-diff --git a/kernel/kexec.c b/kernel/kexec.c
-index f336e21..9c1c20b 100644
---- a/kernel/kexec.c
-+++ b/kernel/kexec.c
-@@ -1028,7 +1028,8 @@ asmlinkage long compat_sys_kexec_load(unsigned long entry,
- unsigned long flags)
- {
- struct compat_kexec_segment in;
-- struct kexec_segment out, __user *ksegments;
-+ struct kexec_segment out;
-+ struct kexec_segment __user *ksegments;
- unsigned long i, result;
-
- /* Don't allow clients that don't understand the native
-diff --git a/kernel/kgdb.c b/kernel/kgdb.c
-index 53dae4b..9ba3743 100644
---- a/kernel/kgdb.c
-+++ b/kernel/kgdb.c
-@@ -86,7 +86,7 @@ static int kgdb_io_module_registered;
- /* Guard for recursive entry */
- static int exception_level;
-
--static struct kgdb_io *kgdb_io_ops;
-+static const struct kgdb_io *kgdb_io_ops;
- static DEFINE_SPINLOCK(kgdb_registration_lock);
-
- /* kgdb console driver is loaded */
-@@ -123,7 +123,7 @@ atomic_t kgdb_active = ATOMIC_INIT(-1);
- */
- static atomic_t passive_cpu_wait[NR_CPUS];
- static atomic_t cpu_in_kgdb[NR_CPUS];
--atomic_t kgdb_setting_breakpoint;
-+atomic_unchecked_t kgdb_setting_breakpoint;
-
- struct task_struct *kgdb_usethread;
- struct task_struct *kgdb_contthread;
-@@ -140,7 +140,7 @@ static unsigned long gdb_regs[(NUMREGBYTES +
- sizeof(unsigned long)];
-
- /* to keep track of the CPU which is doing the single stepping*/
--atomic_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
-+atomic_unchecked_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
-
- /*
- * If you are debugging a problem where roundup (the collection of
-@@ -815,7 +815,7 @@ static int kgdb_io_ready(int print_wait)
- return 0;
- if (kgdb_connected)
- return 1;
-- if (atomic_read(&kgdb_setting_breakpoint))
-+ if (atomic_read_unchecked(&kgdb_setting_breakpoint))
- return 1;
- if (print_wait)
- printk(KERN_CRIT "KGDB: Waiting for remote debugger\n");
-@@ -1426,8 +1426,8 @@ acquirelock:
- * instance of the exception handler wanted to come into the
- * debugger on a different CPU via a single step
- */
-- if (atomic_read(&kgdb_cpu_doing_single_step) != -1 &&
-- atomic_read(&kgdb_cpu_doing_single_step) != cpu) {
-+ if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1 &&
-+ atomic_read_unchecked(&kgdb_cpu_doing_single_step) != cpu) {
-
- atomic_set(&kgdb_active, -1);
- touch_softlockup_watchdog();
-@@ -1634,7 +1634,7 @@ static void kgdb_initial_breakpoint(void)
- *
- * Register it with the KGDB core.
- */
--int kgdb_register_io_module(struct kgdb_io *new_kgdb_io_ops)
-+int kgdb_register_io_module(const struct kgdb_io *new_kgdb_io_ops)
- {
- int err;
-
-@@ -1679,7 +1679,7 @@ EXPORT_SYMBOL_GPL(kgdb_register_io_module);
- *
- * Unregister it with the KGDB core.
- */
--void kgdb_unregister_io_module(struct kgdb_io *old_kgdb_io_ops)
-+void kgdb_unregister_io_module(const struct kgdb_io *old_kgdb_io_ops)
- {
- BUG_ON(kgdb_connected);
-
-@@ -1712,11 +1712,11 @@ EXPORT_SYMBOL_GPL(kgdb_unregister_io_module);
- */
- void kgdb_breakpoint(void)
- {
-- atomic_set(&kgdb_setting_breakpoint, 1);
-+ atomic_set_unchecked(&kgdb_setting_breakpoint, 1);
- wmb(); /* Sync point before breakpoint */
- arch_kgdb_breakpoint();
- wmb(); /* Sync point after breakpoint */
-- atomic_set(&kgdb_setting_breakpoint, 0);
-+ atomic_set_unchecked(&kgdb_setting_breakpoint, 0);
- }
- EXPORT_SYMBOL_GPL(kgdb_breakpoint);
-
-diff --git a/kernel/kmod.c b/kernel/kmod.c
-index 8ecc509..98fcf05 100644
---- a/kernel/kmod.c
-+++ b/kernel/kmod.c
-@@ -59,7 +59,7 @@ static void free_modprobe_argv(char **argv, char **envp)
- kfree(argv);
- }
-
--static int call_modprobe(char *module_name, int wait)
-+static int call_modprobe(char *module_name, char *module_param, int wait)
- {
- static char *envp[] = { "HOME=/",
- "TERM=linux",
-@@ -67,7 +67,7 @@ static int call_modprobe(char *module_name, int wait)
- NULL };
- struct subprocess_info *info;
-
-- char **argv = kmalloc(sizeof(char *[5]), GFP_KERNEL);
-+ char **argv = kmalloc(sizeof(char *[6]), GFP_KERNEL);
- if (!argv)
- goto out;
-
-@@ -79,7 +79,8 @@ static int call_modprobe(char *module_name, int wait)
- argv[1] = "-q";
- argv[2] = "--";
- argv[3] = module_name; /* check free_modprobe_argv() */
-- argv[4] = NULL;
-+ argv[4] = module_param;
-+ argv[5] = NULL;
-
- info = call_usermodehelper_setup(argv[0], argv, envp, GFP_ATOMIC);
- if (!info)
-@@ -112,9 +113,8 @@ out:
- * If module auto-loading support is disabled then this function
- * becomes a no-operation.
- */
--int __request_module(bool wait, const char *fmt, ...)
-+static int ____request_module(bool wait, char *module_param, const char *fmt, va_list ap)
- {
-- va_list args;
- char module_name[MODULE_NAME_LEN];
- unsigned int max_modprobes;
- int ret;
-@@ -126,12 +126,24 @@ int __request_module(bool wait, const char *fmt, ...)
- if (ret)
- return ret;
-
-- va_start(args, fmt);
-- ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
-- va_end(args);
-+ ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, ap);
- if (ret >= MODULE_NAME_LEN)
- return -ENAMETOOLONG;
-
-+#ifdef CONFIG_GRKERNSEC_MODHARDEN
-+ if (!current_uid()) {
-+ /* hack to workaround consolekit/udisks stupidity */
-+ read_lock(&tasklist_lock);
-+ if (!strcmp(current->comm, "mount") &&
-+ current->real_parent && !strncmp(current->real_parent->comm, "udisk", 5)) {
-+ read_unlock(&tasklist_lock);
-+ printk(KERN_ALERT "grsec: denied attempt to auto-load fs module %.64s by udisks\n", module_name);
-+ return -EPERM;
-+ }
-+ read_unlock(&tasklist_lock);
-+ }
-+#endif
-+
- /* If modprobe needs a service that is in a module, we get a recursive
- * loop. Limit the number of running kmod threads to max_threads/2 or
- * MAX_KMOD_CONCURRENT, whichever is the smaller. A cleaner method
-@@ -160,11 +172,53 @@ int __request_module(bool wait, const char *fmt, ...)
-
- trace_module_request(module_name, wait, _RET_IP_);
-
-- ret = call_modprobe(module_name, wait ? UMH_WAIT_PROC : UMH_WAIT_EXEC);
-+ ret = call_modprobe(module_name, module_param, wait ? UMH_WAIT_PROC : UMH_WAIT_EXEC);
-
- atomic_dec(&kmod_concurrent);
- return ret;
- }
-+
-+int ___request_module(bool wait, char *module_param, const char *fmt, ...)
-+{
-+ va_list args;
-+ int ret;
-+
-+ va_start(args, fmt);
-+ ret = ____request_module(wait, module_param, fmt, args);
-+ va_end(args);
-+
-+ return ret;
-+}
-+
-+int __request_module(bool wait, const char *fmt, ...)
-+{
-+ va_list args;
-+ int ret;
-+
-+#ifdef CONFIG_GRKERNSEC_MODHARDEN
-+ if (current_uid()) {
-+ char module_param[MODULE_NAME_LEN];
-+
-+ memset(module_param, 0, sizeof(module_param));
-+
-+ snprintf(module_param, sizeof(module_param) - 1, "grsec_modharden_normal%u_", current_uid());
-+
-+ va_start(args, fmt);
-+ ret = ____request_module(wait, module_param, fmt, args);
-+ va_end(args);
-+
-+ return ret;
-+ }
-+#endif
-+
-+ va_start(args, fmt);
-+ ret = ____request_module(wait, NULL, fmt, args);
-+ va_end(args);
-+
-+ return ret;
-+}
-+
-+
- EXPORT_SYMBOL(__request_module);
- #endif /* CONFIG_MODULES */
-
-@@ -283,7 +337,7 @@ static int wait_for_helper(void *data)
- *
- * Thus the __user pointer cast is valid here.
- */
-- sys_wait4(pid, (int __user *)&ret, 0, NULL);
-+ sys_wait4(pid, (int __force_user *)&ret, 0, NULL);
-
- /*
- * If ret is 0, either ____call_usermodehelper failed and the
-@@ -561,6 +615,11 @@ int call_usermodehelper_exec(struct subprocess_info *sub_info,
- validate_creds(sub_info->cred);
-
- helper_lock();
-+ if (!sub_info->path) {
-+ retval = -EINVAL;
-+ goto out;
-+ }
-+
- if (sub_info->path[0] == '\0')
- goto out;
-
-diff --git a/kernel/kprobes.c b/kernel/kprobes.c
-index 176d825..af5d481 100644
---- a/kernel/kprobes.c
-+++ b/kernel/kprobes.c
-@@ -31,6 +31,9 @@
- * <jkenisto@us.ibm.com> and Prasanna S Panchamukhi
- * <prasanna@in.ibm.com> added function-return probes.
- */
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+#define __INCLUDED_BY_HIDESYM 1
-+#endif
- #include <linux/kprobes.h>
- #include <linux/hash.h>
- #include <linux/init.h>
-@@ -183,7 +186,7 @@ static kprobe_opcode_t __kprobes *__get_insn_slot(void)
- * kernel image and loaded module images reside. This is required
- * so x86_64 can correctly handle the %rip-relative fixups.
- */
-- kip->insns = module_alloc(PAGE_SIZE);
-+ kip->insns = module_alloc_exec(PAGE_SIZE);
- if (!kip->insns) {
- kfree(kip);
- return NULL;
-@@ -220,7 +223,7 @@ static int __kprobes collect_one_slot(struct kprobe_insn_page *kip, int idx)
- */
- if (!list_is_singular(&kprobe_insn_pages)) {
- list_del(&kip->list);
-- module_free(NULL, kip->insns);
-+ module_free_exec(NULL, kip->insns);
- kfree(kip);
- }
- return 1;
-@@ -1189,7 +1192,7 @@ static int __init init_kprobes(void)
- {
- int i, err = 0;
- unsigned long offset = 0, size = 0;
-- char *modname, namebuf[128];
-+ char *modname, namebuf[KSYM_NAME_LEN];
- const char *symbol_name;
- void *addr;
- struct kprobe_blackpoint *kb;
-@@ -1264,14 +1267,14 @@ static void __kprobes report_probe(struct seq_file *pi, struct kprobe *p,
- else
- kprobe_type = "k";
- if (sym)
-- seq_printf(pi, "%p %s %s+0x%x %s %s%s\n",
-+ seq_printf(pi, "%pK %s %s+0x%x %s %s%s\n",
- p->addr, kprobe_type, sym, offset,
- (modname ? modname : " "),
- (kprobe_gone(p) ? "[GONE]" : ""),
- ((kprobe_disabled(p) && !kprobe_gone(p)) ?
- "[DISABLED]" : ""));
- else
-- seq_printf(pi, "%p %s %p %s%s\n",
-+ seq_printf(pi, "%pK %s %pK %s%s\n",
- p->addr, kprobe_type, p->addr,
- (kprobe_gone(p) ? "[GONE]" : ""),
- ((kprobe_disabled(p) && !kprobe_gone(p)) ?
-@@ -1304,7 +1307,7 @@ static int __kprobes show_kprobe_addr(struct seq_file *pi, void *v)
- const char *sym = NULL;
- unsigned int i = *(loff_t *) v;
- unsigned long offset = 0;
-- char *modname, namebuf[128];
-+ char *modname, namebuf[KSYM_NAME_LEN];
-
- head = &kprobe_table[i];
- preempt_disable();
-diff --git a/kernel/ksysfs.c b/kernel/ksysfs.c
-index 9cd2b1c..ab201ef 100644
---- a/kernel/ksysfs.c
-+++ b/kernel/ksysfs.c
-@@ -45,6 +45,8 @@ static ssize_t uevent_helper_store(struct kobject *kobj,
- {
- if (count+1 > UEVENT_HELPER_PATH_LEN)
- return -ENOENT;
-+ if (!capable(CAP_SYS_ADMIN))
-+ return -EPERM;
- memcpy(uevent_helper, buf, count);
- uevent_helper[count] = '\0';
- if (count && uevent_helper[count-1] == '\n')
-diff --git a/kernel/lockdep.c b/kernel/lockdep.c
-index d86fe89..d12fc66 100644
---- a/kernel/lockdep.c
-+++ b/kernel/lockdep.c
-@@ -421,20 +421,20 @@ static struct stack_trace lockdep_init_trace = {
- /*
- * Various lockdep statistics:
- */
--atomic_t chain_lookup_hits;
--atomic_t chain_lookup_misses;
--atomic_t hardirqs_on_events;
--atomic_t hardirqs_off_events;
--atomic_t redundant_hardirqs_on;
--atomic_t redundant_hardirqs_off;
--atomic_t softirqs_on_events;
--atomic_t softirqs_off_events;
--atomic_t redundant_softirqs_on;
--atomic_t redundant_softirqs_off;
--atomic_t nr_unused_locks;
--atomic_t nr_cyclic_checks;
--atomic_t nr_find_usage_forwards_checks;
--atomic_t nr_find_usage_backwards_checks;
-+atomic_unchecked_t chain_lookup_hits;
-+atomic_unchecked_t chain_lookup_misses;
-+atomic_unchecked_t hardirqs_on_events;
-+atomic_unchecked_t hardirqs_off_events;
-+atomic_unchecked_t redundant_hardirqs_on;
-+atomic_unchecked_t redundant_hardirqs_off;
-+atomic_unchecked_t softirqs_on_events;
-+atomic_unchecked_t softirqs_off_events;
-+atomic_unchecked_t redundant_softirqs_on;
-+atomic_unchecked_t redundant_softirqs_off;
-+atomic_unchecked_t nr_unused_locks;
-+atomic_unchecked_t nr_cyclic_checks;
-+atomic_unchecked_t nr_find_usage_forwards_checks;
-+atomic_unchecked_t nr_find_usage_backwards_checks;
- #endif
-
- /*
-@@ -577,6 +577,10 @@ static int static_obj(void *obj)
- int i;
- #endif
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+ start = ktla_ktva(start);
-+#endif
-+
- /*
- * static variable?
- */
-@@ -592,8 +596,7 @@ static int static_obj(void *obj)
- */
- for_each_possible_cpu(i) {
- start = (unsigned long) &__per_cpu_start + per_cpu_offset(i);
-- end = (unsigned long) &__per_cpu_start + PERCPU_ENOUGH_ROOM
-- + per_cpu_offset(i);
-+ end = start + PERCPU_ENOUGH_ROOM;
-
- if ((addr >= start) && (addr < end))
- return 1;
-@@ -710,6 +713,7 @@ register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force)
- if (!static_obj(lock->key)) {
- debug_locks_off();
- printk("INFO: trying to register non-static key.\n");
-+ printk("lock:%pS key:%pS.\n", lock, lock->key);
- printk("the code is fine but needs lockdep annotation.\n");
- printk("turning off the locking correctness validator.\n");
- dump_stack();
-@@ -2751,7 +2755,7 @@ static int __lock_acquire(struct lockdep_map *lock, unsigned int subclass,
- if (!class)
- return 0;
- }
-- debug_atomic_inc((atomic_t *)&class->ops);
-+ debug_atomic_inc((atomic_unchecked_t *)&class->ops);
- if (very_verbose(class)) {
- printk("\nacquire class [%p] %s", class->key, class->name);
- if (class->name_version > 1)
-diff --git a/kernel/lockdep_internals.h b/kernel/lockdep_internals.h
-index a2ee95a..092f0f2 100644
---- a/kernel/lockdep_internals.h
-+++ b/kernel/lockdep_internals.h
-@@ -113,26 +113,26 @@ lockdep_count_backward_deps(struct lock_class *class)
- /*
- * Various lockdep statistics:
- */
--extern atomic_t chain_lookup_hits;
--extern atomic_t chain_lookup_misses;
--extern atomic_t hardirqs_on_events;
--extern atomic_t hardirqs_off_events;
--extern atomic_t redundant_hardirqs_on;
--extern atomic_t redundant_hardirqs_off;
--extern atomic_t softirqs_on_events;
--extern atomic_t softirqs_off_events;
--extern atomic_t redundant_softirqs_on;
--extern atomic_t redundant_softirqs_off;
--extern atomic_t nr_unused_locks;
--extern atomic_t nr_cyclic_checks;
--extern atomic_t nr_cyclic_check_recursions;
--extern atomic_t nr_find_usage_forwards_checks;
--extern atomic_t nr_find_usage_forwards_recursions;
--extern atomic_t nr_find_usage_backwards_checks;
--extern atomic_t nr_find_usage_backwards_recursions;
--# define debug_atomic_inc(ptr) atomic_inc(ptr)
--# define debug_atomic_dec(ptr) atomic_dec(ptr)
--# define debug_atomic_read(ptr) atomic_read(ptr)
-+extern atomic_unchecked_t chain_lookup_hits;
-+extern atomic_unchecked_t chain_lookup_misses;
-+extern atomic_unchecked_t hardirqs_on_events;
-+extern atomic_unchecked_t hardirqs_off_events;
-+extern atomic_unchecked_t redundant_hardirqs_on;
-+extern atomic_unchecked_t redundant_hardirqs_off;
-+extern atomic_unchecked_t softirqs_on_events;
-+extern atomic_unchecked_t softirqs_off_events;
-+extern atomic_unchecked_t redundant_softirqs_on;
-+extern atomic_unchecked_t redundant_softirqs_off;
-+extern atomic_unchecked_t nr_unused_locks;
-+extern atomic_unchecked_t nr_cyclic_checks;
-+extern atomic_unchecked_t nr_cyclic_check_recursions;
-+extern atomic_unchecked_t nr_find_usage_forwards_checks;
-+extern atomic_unchecked_t nr_find_usage_forwards_recursions;
-+extern atomic_unchecked_t nr_find_usage_backwards_checks;
-+extern atomic_unchecked_t nr_find_usage_backwards_recursions;
-+# define debug_atomic_inc(ptr) atomic_inc_unchecked(ptr)
-+# define debug_atomic_dec(ptr) atomic_dec_unchecked(ptr)
-+# define debug_atomic_read(ptr) atomic_read_unchecked(ptr)
- #else
- # define debug_atomic_inc(ptr) do { } while (0)
- # define debug_atomic_dec(ptr) do { } while (0)
-diff --git a/kernel/lockdep_proc.c b/kernel/lockdep_proc.c
-index d4aba4f..0bb4763 100644
---- a/kernel/lockdep_proc.c
-+++ b/kernel/lockdep_proc.c
-@@ -39,7 +39,7 @@ static void l_stop(struct seq_file *m, void *v)
-
- static void print_name(struct seq_file *m, struct lock_class *class)
- {
-- char str[128];
-+ char str[KSYM_NAME_LEN];
- const char *name = class->name;
-
- if (!name) {
-@@ -65,7 +65,7 @@ static int l_show(struct seq_file *m, void *v)
- return 0;
- }
-
-- seq_printf(m, "%p", class->key);
-+ seq_printf(m, "%pK", class->key);
- #ifdef CONFIG_DEBUG_LOCKDEP
- seq_printf(m, " OPS:%8ld", class->ops);
- #endif
-@@ -83,7 +83,7 @@ static int l_show(struct seq_file *m, void *v)
-
- list_for_each_entry(entry, &class->locks_after, entry) {
- if (entry->distance == 1) {
-- seq_printf(m, " -> [%p] ", entry->class->key);
-+ seq_printf(m, " -> [%pK] ", entry->class->key);
- print_name(m, entry->class);
- seq_puts(m, "\n");
- }
-@@ -152,7 +152,7 @@ static int lc_show(struct seq_file *m, void *v)
- if (!class->key)
- continue;
-
-- seq_printf(m, "[%p] ", class->key);
-+ seq_printf(m, "[%pK] ", class->key);
- print_name(m, class);
- seq_puts(m, "\n");
- }
-@@ -504,7 +504,7 @@ static void seq_stats(struct seq_file *m, struct lock_stat_data *data)
- seq_line(m, '-', 40-namelen, namelen);
-
- sprint_symbol(sym, class->contention_point[i]);
-- snprintf(ip, sizeof(ip), "[<%p>]",
-+ snprintf(ip, sizeof(ip), "[<%pK>]",
- (void *)class->contention_point[i]);
- seq_printf(m, "%40s %14lu %29s %s\n", name,
- stats->contention_point[i],
-@@ -521,7 +521,7 @@ static void seq_stats(struct seq_file *m, struct lock_stat_data *data)
- seq_line(m, '-', 40-namelen, namelen);
-
- sprint_symbol(sym, class->contending_point[i]);
-- snprintf(ip, sizeof(ip), "[<%p>]",
-+ snprintf(ip, sizeof(ip), "[<%pK>]",
- (void *)class->contending_point[i]);
- seq_printf(m, "%40s %14lu %29s %s\n", name,
- stats->contending_point[i],
-diff --git a/kernel/module.c b/kernel/module.c
-index 4b270e6..6e0aa89 100644
---- a/kernel/module.c
-+++ b/kernel/module.c
-@@ -55,6 +55,7 @@
- #include <linux/async.h>
- #include <linux/percpu.h>
- #include <linux/kmemleak.h>
-+#include <linux/grsecurity.h>
-
- #define CREATE_TRACE_POINTS
- #include <trace/events/module.h>
-@@ -89,7 +90,8 @@ static DECLARE_WAIT_QUEUE_HEAD(module_wq);
- static BLOCKING_NOTIFIER_HEAD(module_notify_list);
-
- /* Bounds of module allocation, for speeding __module_address */
--static unsigned long module_addr_min = -1UL, module_addr_max = 0;
-+static unsigned long module_addr_min_rw = -1UL, module_addr_max_rw = 0;
-+static unsigned long module_addr_min_rx = -1UL, module_addr_max_rx = 0;
-
- int register_module_notifier(struct notifier_block * nb)
- {
-@@ -245,7 +247,7 @@ bool each_symbol(bool (*fn)(const struct symsearch *arr, struct module *owner,
- return true;
-
- list_for_each_entry_rcu(mod, &modules, list) {
-- struct symsearch arr[] = {
-+ struct symsearch modarr[] = {
- { mod->syms, mod->syms + mod->num_syms, mod->crcs,
- NOT_GPL_ONLY, false },
- { mod->gpl_syms, mod->gpl_syms + mod->num_gpl_syms,
-@@ -267,7 +269,7 @@ bool each_symbol(bool (*fn)(const struct symsearch *arr, struct module *owner,
- #endif
- };
-
-- if (each_symbol_in_section(arr, ARRAY_SIZE(arr), mod, fn, data))
-+ if (each_symbol_in_section(modarr, ARRAY_SIZE(modarr), mod, fn, data))
- return true;
- }
- return false;
-@@ -442,7 +444,7 @@ static void *percpu_modalloc(unsigned long size, unsigned long align,
- void *ptr;
- int cpu;
-
-- if (align > PAGE_SIZE) {
-+ if (align-1 >= PAGE_SIZE) {
- printk(KERN_WARNING "%s: per-cpu alignment %li > %li\n",
- name, align, PAGE_SIZE);
- align = PAGE_SIZE;
-@@ -1158,7 +1160,7 @@ static const struct kernel_symbol *resolve_symbol(Elf_Shdr *sechdrs,
- * /sys/module/foo/sections stuff
- * J. Corbet <corbet@lwn.net>
- */
--#if defined(CONFIG_KALLSYMS) && defined(CONFIG_SYSFS)
-+#if defined(CONFIG_KALLSYMS) && defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
-
- static inline bool sect_empty(const Elf_Shdr *sect)
- {
-@@ -1545,7 +1547,8 @@ static void free_module(struct module *mod)
- destroy_params(mod->kp, mod->num_kp);
-
- /* This may be NULL, but that's OK */
-- module_free(mod, mod->module_init);
-+ module_free(mod, mod->module_init_rw);
-+ module_free_exec(mod, mod->module_init_rx);
- kfree(mod->args);
- if (mod->percpu)
- percpu_modfree(mod->percpu);
-@@ -1554,10 +1557,12 @@ static void free_module(struct module *mod)
- percpu_modfree(mod->refptr);
- #endif
- /* Free lock-classes: */
-- lockdep_free_key_range(mod->module_core, mod->core_size);
-+ lockdep_free_key_range(mod->module_core_rx, mod->core_size_rx);
-+ lockdep_free_key_range(mod->module_core_rw, mod->core_size_rw);
-
- /* Finally, free the core (containing the module structure) */
-- module_free(mod, mod->module_core);
-+ module_free_exec(mod, mod->module_core_rx);
-+ module_free(mod, mod->module_core_rw);
-
- #ifdef CONFIG_MPU
- update_protections(current->mm);
-@@ -1628,8 +1633,32 @@ static int simplify_symbols(Elf_Shdr *sechdrs,
- unsigned int i, n = sechdrs[symindex].sh_size / sizeof(Elf_Sym);
- int ret = 0;
- const struct kernel_symbol *ksym;
-+#ifdef CONFIG_GRKERNSEC_MODHARDEN
-+ int is_fs_load = 0;
-+ int register_filesystem_found = 0;
-+ char *p;
-+
-+ p = strstr(mod->args, "grsec_modharden_fs");
-+
-+ if (p) {
-+ char *endptr = p + sizeof("grsec_modharden_fs") - 1;
-+ /* copy \0 as well */
-+ memmove(p, endptr, strlen(mod->args) - (unsigned int)(endptr - mod->args) + 1);
-+ is_fs_load = 1;
-+ }
-+#endif
-+
-
- for (i = 1; i < n; i++) {
-+#ifdef CONFIG_GRKERNSEC_MODHARDEN
-+ const char *name = strtab + sym[i].st_name;
-+
-+ /* it's a real shame this will never get ripped and copied
-+ upstream! ;(
-+ */
-+ if (is_fs_load && !strcmp(name, "register_filesystem"))
-+ register_filesystem_found = 1;
-+#endif
- switch (sym[i].st_shndx) {
- case SHN_COMMON:
- /* We compiled with -fno-common. These are not
-@@ -1651,7 +1680,9 @@ static int simplify_symbols(Elf_Shdr *sechdrs,
- strtab + sym[i].st_name, mod);
- /* Ok if resolved. */
- if (ksym) {
-+ pax_open_kernel();
- sym[i].st_value = ksym->value;
-+ pax_close_kernel();
- break;
- }
-
-@@ -1670,11 +1701,20 @@ static int simplify_symbols(Elf_Shdr *sechdrs,
- secbase = (unsigned long)mod->percpu;
- else
- secbase = sechdrs[sym[i].st_shndx].sh_addr;
-+ pax_open_kernel();
- sym[i].st_value += secbase;
-+ pax_close_kernel();
- break;
- }
- }
-
-+#ifdef CONFIG_GRKERNSEC_MODHARDEN
-+ if (is_fs_load && !register_filesystem_found) {
-+ printk(KERN_ALERT "grsec: Denied attempt to load non-fs module %.64s through mount\n", mod->name);
-+ ret = -EPERM;
-+ }
-+#endif
-+
- return ret;
- }
-
-@@ -1731,11 +1771,12 @@ static void layout_sections(struct module *mod,
- || s->sh_entsize != ~0UL
- || strstarts(secstrings + s->sh_name, ".init"))
- continue;
-- s->sh_entsize = get_offset(mod, &mod->core_size, s, i);
-+ if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
-+ s->sh_entsize = get_offset(mod, &mod->core_size_rw, s, i);
-+ else
-+ s->sh_entsize = get_offset(mod, &mod->core_size_rx, s, i);
- DEBUGP("\t%s\n", secstrings + s->sh_name);
- }
-- if (m == 0)
-- mod->core_text_size = mod->core_size;
- }
-
- DEBUGP("Init section allocation order:\n");
-@@ -1748,12 +1789,13 @@ static void layout_sections(struct module *mod,
- || s->sh_entsize != ~0UL
- || !strstarts(secstrings + s->sh_name, ".init"))
- continue;
-- s->sh_entsize = (get_offset(mod, &mod->init_size, s, i)
-- | INIT_OFFSET_MASK);
-+ if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
-+ s->sh_entsize = get_offset(mod, &mod->init_size_rw, s, i);
-+ else
-+ s->sh_entsize = get_offset(mod, &mod->init_size_rx, s, i);
-+ s->sh_entsize |= INIT_OFFSET_MASK;
- DEBUGP("\t%s\n", secstrings + s->sh_name);
- }
-- if (m == 0)
-- mod->init_text_size = mod->init_size;
- }
- }
-
-@@ -1857,9 +1899,8 @@ static int is_exported(const char *name, unsigned long value,
-
- /* As per nm */
- static char elf_type(const Elf_Sym *sym,
-- Elf_Shdr *sechdrs,
-- const char *secstrings,
-- struct module *mod)
-+ const Elf_Shdr *sechdrs,
-+ const char *secstrings)
- {
- if (ELF_ST_BIND(sym->st_info) == STB_WEAK) {
- if (ELF_ST_TYPE(sym->st_info) == STT_OBJECT)
-@@ -1934,7 +1975,7 @@ static unsigned long layout_symtab(struct module *mod,
-
- /* Put symbol section at end of init part of module. */
- symsect->sh_flags |= SHF_ALLOC;
-- symsect->sh_entsize = get_offset(mod, &mod->init_size, symsect,
-+ symsect->sh_entsize = get_offset(mod, &mod->init_size_rx, symsect,
- symindex) | INIT_OFFSET_MASK;
- DEBUGP("\t%s\n", secstrings + symsect->sh_name);
-
-@@ -1951,19 +1992,19 @@ static unsigned long layout_symtab(struct module *mod,
- }
-
- /* Append room for core symbols at end of core part. */
-- symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1);
-- mod->core_size = symoffs + ndst * sizeof(Elf_Sym);
-+ symoffs = ALIGN(mod->core_size_rx, symsect->sh_addralign ?: 1);
-+ mod->core_size_rx = symoffs + ndst * sizeof(Elf_Sym);
-
- /* Put string table section at end of init part of module. */
- strsect->sh_flags |= SHF_ALLOC;
-- strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect,
-+ strsect->sh_entsize = get_offset(mod, &mod->init_size_rx, strsect,
- strindex) | INIT_OFFSET_MASK;
- DEBUGP("\t%s\n", secstrings + strsect->sh_name);
-
- /* Append room for core symbols' strings at end of core part. */
-- *pstroffs = mod->core_size;
-+ *pstroffs = mod->core_size_rx;
- __set_bit(0, strmap);
-- mod->core_size += bitmap_weight(strmap, strsect->sh_size);
-+ mod->core_size_rx += bitmap_weight(strmap, strsect->sh_size);
-
- return symoffs;
- }
-@@ -1987,12 +2028,14 @@ static void add_kallsyms(struct module *mod,
- mod->num_symtab = sechdrs[symindex].sh_size / sizeof(Elf_Sym);
- mod->strtab = (void *)sechdrs[strindex].sh_addr;
-
-+ pax_open_kernel();
-+
- /* Set types up while we still have access to sections. */
- for (i = 0; i < mod->num_symtab; i++)
- mod->symtab[i].st_info
-- = elf_type(&mod->symtab[i], sechdrs, secstrings, mod);
-+ = elf_type(&mod->symtab[i], sechdrs, secstrings);
-
-- mod->core_symtab = dst = mod->module_core + symoffs;
-+ mod->core_symtab = dst = mod->module_core_rx + symoffs;
- src = mod->symtab;
- *dst = *src;
- for (ndst = i = 1; i < mod->num_symtab; ++i, ++src) {
-@@ -2004,10 +2047,12 @@ static void add_kallsyms(struct module *mod,
- }
- mod->core_num_syms = ndst;
-
-- mod->core_strtab = s = mod->module_core + stroffs;
-+ mod->core_strtab = s = mod->module_core_rx + stroffs;
- for (*s = 0, i = 1; i < sechdrs[strindex].sh_size; ++i)
- if (test_bit(i, strmap))
- *++s = mod->strtab[i];
-+
-+ pax_close_kernel();
- }
- #else
- static inline unsigned long layout_symtab(struct module *mod,
-@@ -2044,16 +2089,30 @@ static void dynamic_debug_setup(struct _ddebug *debug, unsigned int num)
- #endif
- }
-
--static void *module_alloc_update_bounds(unsigned long size)
-+static void *module_alloc_update_bounds_rw(unsigned long size)
- {
- void *ret = module_alloc(size);
-
- if (ret) {
- /* Update module bounds. */
-- if ((unsigned long)ret < module_addr_min)
-- module_addr_min = (unsigned long)ret;
-- if ((unsigned long)ret + size > module_addr_max)
-- module_addr_max = (unsigned long)ret + size;
-+ if ((unsigned long)ret < module_addr_min_rw)
-+ module_addr_min_rw = (unsigned long)ret;
-+ if ((unsigned long)ret + size > module_addr_max_rw)
-+ module_addr_max_rw = (unsigned long)ret + size;
-+ }
-+ return ret;
-+}
-+
-+static void *module_alloc_update_bounds_rx(unsigned long size)
-+{
-+ void *ret = module_alloc_exec(size);
-+
-+ if (ret) {
-+ /* Update module bounds. */
-+ if ((unsigned long)ret < module_addr_min_rx)
-+ module_addr_min_rx = (unsigned long)ret;
-+ if ((unsigned long)ret + size > module_addr_max_rx)
-+ module_addr_max_rx = (unsigned long)ret + size;
- }
- return ret;
- }
-@@ -2065,8 +2124,8 @@ static void kmemleak_load_module(struct module *mod, Elf_Ehdr *hdr,
- unsigned int i;
-
- /* only scan the sections containing data */
-- kmemleak_scan_area(mod->module_core, (unsigned long)mod -
-- (unsigned long)mod->module_core,
-+ kmemleak_scan_area(mod->module_core_rw, (unsigned long)mod -
-+ (unsigned long)mod->module_core_rw,
- sizeof(struct module), GFP_KERNEL);
-
- for (i = 1; i < hdr->e_shnum; i++) {
-@@ -2076,8 +2135,8 @@ static void kmemleak_load_module(struct module *mod, Elf_Ehdr *hdr,
- && strncmp(secstrings + sechdrs[i].sh_name, ".bss", 4) != 0)
- continue;
-
-- kmemleak_scan_area(mod->module_core, sechdrs[i].sh_addr -
-- (unsigned long)mod->module_core,
-+ kmemleak_scan_area(mod->module_core_rw, sechdrs[i].sh_addr -
-+ (unsigned long)mod->module_core_rw,
- sechdrs[i].sh_size, GFP_KERNEL);
- }
- }
-@@ -2097,7 +2156,7 @@ static noinline struct module *load_module(void __user *umod,
- Elf_Ehdr *hdr;
- Elf_Shdr *sechdrs;
- char *secstrings, *args, *modmagic, *strtab = NULL;
-- char *staging;
-+ char *staging, *license;
- unsigned int i;
- unsigned int symindex = 0;
- unsigned int strindex = 0;
-@@ -2195,6 +2254,14 @@ static noinline struct module *load_module(void __user *umod,
- goto free_hdr;
- }
-
-+ license = get_modinfo(sechdrs, infoindex, "license");
-+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR
-+ if (!license || !license_is_gpl_compatible(license)) {
-+ err = -ENOEXEC;
-+ goto free_hdr;
-+ }
-+#endif
-+
- modmagic = get_modinfo(sechdrs, infoindex, "vermagic");
- /* This is allowed: modprobe --force will invalidate it. */
- if (!modmagic) {
-@@ -2263,7 +2330,7 @@ static noinline struct module *load_module(void __user *umod,
- secstrings, &stroffs, strmap);
-
- /* Do the allocs. */
-- ptr = module_alloc_update_bounds(mod->core_size);
-+ ptr = module_alloc_update_bounds_rw(mod->core_size_rw);
- /*
- * The pointer to this block is stored in the module structure
- * which is inside the block. Just mark it as not being a
-@@ -2274,10 +2341,10 @@ static noinline struct module *load_module(void __user *umod,
- err = -ENOMEM;
- goto free_percpu;
- }
-- memset(ptr, 0, mod->core_size);
-- mod->module_core = ptr;
-+ memset(ptr, 0, mod->core_size_rw);
-+ mod->module_core_rw = ptr;
-
-- ptr = module_alloc_update_bounds(mod->init_size);
-+ ptr = module_alloc_update_bounds_rw(mod->init_size_rw);
- /*
- * The pointer to this block is stored in the module structure
- * which is inside the block. This block doesn't need to be
-@@ -2285,12 +2352,36 @@ static noinline struct module *load_module(void __user *umod,
- * after the module is initialized.
- */
- kmemleak_ignore(ptr);
-- if (!ptr && mod->init_size) {
-+ if (!ptr && mod->init_size_rw) {
- err = -ENOMEM;
-- goto free_core;
-+ goto free_core_rw;
- }
-- memset(ptr, 0, mod->init_size);
-- mod->module_init = ptr;
-+ memset(ptr, 0, mod->init_size_rw);
-+ mod->module_init_rw = ptr;
-+
-+ ptr = module_alloc_update_bounds_rx(mod->core_size_rx);
-+ kmemleak_not_leak(ptr);
-+ if (!ptr) {
-+ err = -ENOMEM;
-+ goto free_init_rw;
-+ }
-+
-+ pax_open_kernel();
-+ memset(ptr, 0, mod->core_size_rx);
-+ pax_close_kernel();
-+ mod->module_core_rx = ptr;
-+
-+ ptr = module_alloc_update_bounds_rx(mod->init_size_rx);
-+ kmemleak_ignore(ptr);
-+ if (!ptr && mod->init_size_rx) {
-+ err = -ENOMEM;
-+ goto free_core_rx;
-+ }
-+
-+ pax_open_kernel();
-+ memset(ptr, 0, mod->init_size_rx);
-+ pax_close_kernel();
-+ mod->module_init_rx = ptr;
-
- /* Transfer each section which specifies SHF_ALLOC */
- DEBUGP("final section addresses:\n");
-@@ -2300,17 +2391,45 @@ static noinline struct module *load_module(void __user *umod,
- if (!(sechdrs[i].sh_flags & SHF_ALLOC))
- continue;
-
-- if (sechdrs[i].sh_entsize & INIT_OFFSET_MASK)
-- dest = mod->module_init
-- + (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
-- else
-- dest = mod->module_core + sechdrs[i].sh_entsize;
-+ if (sechdrs[i].sh_entsize & INIT_OFFSET_MASK) {
-+ if ((sechdrs[i].sh_flags & SHF_WRITE) || !(sechdrs[i].sh_flags & SHF_ALLOC))
-+ dest = mod->module_init_rw
-+ + (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
-+ else
-+ dest = mod->module_init_rx
-+ + (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
-+ } else {
-+ if ((sechdrs[i].sh_flags & SHF_WRITE) || !(sechdrs[i].sh_flags & SHF_ALLOC))
-+ dest = mod->module_core_rw + sechdrs[i].sh_entsize;
-+ else
-+ dest = mod->module_core_rx + sechdrs[i].sh_entsize;
-+ }
-
-- if (sechdrs[i].sh_type != SHT_NOBITS)
-- memcpy(dest, (void *)sechdrs[i].sh_addr,
-- sechdrs[i].sh_size);
-+ if (sechdrs[i].sh_type != SHT_NOBITS) {
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+#ifdef CONFIG_X86_64
-+ if ((sechdrs[i].sh_flags & SHF_WRITE) && (sechdrs[i].sh_flags & SHF_EXECINSTR))
-+ set_memory_x((unsigned long)dest, (sechdrs[i].sh_size + PAGE_SIZE) >> PAGE_SHIFT);
-+#endif
-+ if (!(sechdrs[i].sh_flags & SHF_WRITE) && (sechdrs[i].sh_flags & SHF_ALLOC)) {
-+ pax_open_kernel();
-+ memcpy(dest, (void *)sechdrs[i].sh_addr, sechdrs[i].sh_size);
-+ pax_close_kernel();
-+ } else
-+#endif
-+
-+ memcpy(dest, (void *)sechdrs[i].sh_addr, sechdrs[i].sh_size);
-+ }
- /* Update sh_addr to point to copy in image. */
-- sechdrs[i].sh_addr = (unsigned long)dest;
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ if (sechdrs[i].sh_flags & SHF_EXECINSTR)
-+ sechdrs[i].sh_addr = ktva_ktla((unsigned long)dest);
-+ else
-+#endif
-+
-+ sechdrs[i].sh_addr = (unsigned long)dest;
- DEBUGP("\t0x%lx %s\n", sechdrs[i].sh_addr, secstrings + sechdrs[i].sh_name);
- }
- /* Module has been moved. */
-@@ -2322,7 +2441,7 @@ static noinline struct module *load_module(void __user *umod,
- mod->name);
- if (!mod->refptr) {
- err = -ENOMEM;
-- goto free_init;
-+ goto free_init_rx;
- }
- #endif
- /* Now we've moved module, initialize linked lists, etc. */
-@@ -2334,7 +2453,7 @@ static noinline struct module *load_module(void __user *umod,
- goto free_unload;
-
- /* Set up license info based on the info section */
-- set_license(mod, get_modinfo(sechdrs, infoindex, "license"));
-+ set_license(mod, license);
-
- /*
- * ndiswrapper is under GPL by itself, but loads proprietary modules.
-@@ -2351,6 +2470,31 @@ static noinline struct module *load_module(void __user *umod,
- /* Set up MODINFO_ATTR fields */
- setup_modinfo(mod, sechdrs, infoindex);
-
-+ mod->args = args;
-+
-+#ifdef CONFIG_GRKERNSEC_MODHARDEN
-+ {
-+ char *p, *p2;
-+
-+ if (strstr(mod->args, "grsec_modharden_netdev")) {
-+ printk(KERN_ALERT "grsec: denied auto-loading kernel module for a network device with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%.64s instead.", mod->name);
-+ err = -EPERM;
-+ goto cleanup;
-+ } else if ((p = strstr(mod->args, "grsec_modharden_normal"))) {
-+ p += sizeof("grsec_modharden_normal") - 1;
-+ p2 = strstr(p, "_");
-+ if (p2) {
-+ *p2 = '\0';
-+ printk(KERN_ALERT "grsec: denied kernel module auto-load of %.64s by uid %.9s\n", mod->name, p);
-+ *p2 = '_';
-+ }
-+ err = -EPERM;
-+ goto cleanup;
-+ }
-+ }
-+#endif
-+
-+
- /* Fix up syms, so that st_value is a pointer to location. */
- err = simplify_symbols(sechdrs, symindex, strtab, versindex, pcpuindex,
- mod);
-@@ -2431,8 +2575,8 @@ static noinline struct module *load_module(void __user *umod,
-
- /* Now do relocations. */
- for (i = 1; i < hdr->e_shnum; i++) {
-- const char *strtab = (char *)sechdrs[strindex].sh_addr;
- unsigned int info = sechdrs[i].sh_info;
-+ strtab = (char *)sechdrs[strindex].sh_addr;
-
- /* Not a valid relocation section? */
- if (info >= hdr->e_shnum)
-@@ -2493,16 +2637,15 @@ static noinline struct module *load_module(void __user *umod,
- * Do it before processing of module parameters, so the module
- * can provide parameter accessor functions of its own.
- */
-- if (mod->module_init)
-- flush_icache_range((unsigned long)mod->module_init,
-- (unsigned long)mod->module_init
-- + mod->init_size);
-- flush_icache_range((unsigned long)mod->module_core,
-- (unsigned long)mod->module_core + mod->core_size);
-+ if (mod->module_init_rx)
-+ flush_icache_range((unsigned long)mod->module_init_rx,
-+ (unsigned long)mod->module_init_rx
-+ + mod->init_size_rx);
-+ flush_icache_range((unsigned long)mod->module_core_rx,
-+ (unsigned long)mod->module_core_rx + mod->core_size_rx);
-
- set_fs(old_fs);
-
-- mod->args = args;
- if (section_addr(hdr, sechdrs, secstrings, "__obsparm"))
- printk(KERN_WARNING "%s: Ignoring obsolete parameters\n",
- mod->name);
-@@ -2546,12 +2689,16 @@ static noinline struct module *load_module(void __user *umod,
- free_unload:
- module_unload_free(mod);
- #if defined(CONFIG_MODULE_UNLOAD) && defined(CONFIG_SMP)
-+ free_init_rx:
- percpu_modfree(mod->refptr);
-- free_init:
- #endif
-- module_free(mod, mod->module_init);
-- free_core:
-- module_free(mod, mod->module_core);
-+ module_free_exec(mod, mod->module_init_rx);
-+ free_core_rx:
-+ module_free_exec(mod, mod->module_core_rx);
-+ free_init_rw:
-+ module_free(mod, mod->module_init_rw);
-+ free_core_rw:
-+ module_free(mod, mod->module_core_rw);
- /* mod will be freed with core. Don't access it beyond this line! */
- free_percpu:
- if (percpu)
-@@ -2653,10 +2800,12 @@ SYSCALL_DEFINE3(init_module, void __user *, umod,
- mod->symtab = mod->core_symtab;
- mod->strtab = mod->core_strtab;
- #endif
-- module_free(mod, mod->module_init);
-- mod->module_init = NULL;
-- mod->init_size = 0;
-- mod->init_text_size = 0;
-+ module_free(mod, mod->module_init_rw);
-+ module_free_exec(mod, mod->module_init_rx);
-+ mod->module_init_rw = NULL;
-+ mod->module_init_rx = NULL;
-+ mod->init_size_rw = 0;
-+ mod->init_size_rx = 0;
- mutex_unlock(&module_mutex);
-
- return 0;
-@@ -2687,10 +2836,16 @@ static const char *get_ksymbol(struct module *mod,
- unsigned long nextval;
-
- /* At worse, next value is at end of module */
-- if (within_module_init(addr, mod))
-- nextval = (unsigned long)mod->module_init+mod->init_text_size;
-+ if (within_module_init_rx(addr, mod))
-+ nextval = (unsigned long)mod->module_init_rx+mod->init_size_rx;
-+ else if (within_module_init_rw(addr, mod))
-+ nextval = (unsigned long)mod->module_init_rw+mod->init_size_rw;
-+ else if (within_module_core_rx(addr, mod))
-+ nextval = (unsigned long)mod->module_core_rx+mod->core_size_rx;
-+ else if (within_module_core_rw(addr, mod))
-+ nextval = (unsigned long)mod->module_core_rw+mod->core_size_rw;
- else
-- nextval = (unsigned long)mod->module_core+mod->core_text_size;
-+ return NULL;
-
- /* Scan for closest preceeding symbol, and next symbol. (ELF
- starts real symbols at 1). */
-@@ -2936,7 +3091,7 @@ static int m_show(struct seq_file *m, void *p)
- char buf[8];
-
- seq_printf(m, "%s %u",
-- mod->name, mod->init_size + mod->core_size);
-+ mod->name, mod->init_size_rx + mod->init_size_rw + mod->core_size_rx + mod->core_size_rw);
- print_unload_info(m, mod);
-
- /* Informative for users. */
-@@ -2945,7 +3100,7 @@ static int m_show(struct seq_file *m, void *p)
- mod->state == MODULE_STATE_COMING ? "Loading":
- "Live");
- /* Used by oprofile and other similar tools. */
-- seq_printf(m, " 0x%p", mod->module_core);
-+ seq_printf(m, " 0x%pP 0x%pP", mod->module_core_rx, mod->module_core_rw);
-
- /* Taints info */
- if (mod->taints)
-@@ -2981,7 +3136,17 @@ static const struct file_operations proc_modules_operations = {
-
- static int __init proc_modules_init(void)
- {
-+#ifndef CONFIG_GRKERNSEC_HIDESYM
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+ proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ proc_create("modules", S_IRUSR | S_IRGRP, NULL, &proc_modules_operations);
-+#else
- proc_create("modules", 0, NULL, &proc_modules_operations);
-+#endif
-+#else
-+ proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
-+#endif
- return 0;
- }
- module_init(proc_modules_init);
-@@ -3040,12 +3205,12 @@ struct module *__module_address(unsigned long addr)
- {
- struct module *mod;
-
-- if (addr < module_addr_min || addr > module_addr_max)
-+ if ((addr < module_addr_min_rx || addr > module_addr_max_rx) &&
-+ (addr < module_addr_min_rw || addr > module_addr_max_rw))
- return NULL;
-
- list_for_each_entry_rcu(mod, &modules, list)
-- if (within_module_core(addr, mod)
-- || within_module_init(addr, mod))
-+ if (within_module_init(addr, mod) || within_module_core(addr, mod))
- return mod;
- return NULL;
- }
-@@ -3079,11 +3244,20 @@ bool is_module_text_address(unsigned long addr)
- */
- struct module *__module_text_address(unsigned long addr)
- {
-- struct module *mod = __module_address(addr);
-+ struct module *mod;
-+
-+#ifdef CONFIG_X86_32
-+ addr = ktla_ktva(addr);
-+#endif
-+
-+ if (addr < module_addr_min_rx || addr > module_addr_max_rx)
-+ return NULL;
-+
-+ mod = __module_address(addr);
-+
- if (mod) {
- /* Make sure it's within the text section. */
-- if (!within(addr, mod->module_init, mod->init_text_size)
-- && !within(addr, mod->module_core, mod->core_text_size))
-+ if (!within_module_init_rx(addr, mod) && !within_module_core_rx(addr, mod))
- mod = NULL;
- }
- return mod;
-diff --git a/kernel/mutex-debug.c b/kernel/mutex-debug.c
-index ec815a9..fe46e99 100644
---- a/kernel/mutex-debug.c
-+++ b/kernel/mutex-debug.c
-@@ -49,21 +49,21 @@ void debug_mutex_free_waiter(struct mutex_waiter *waiter)
- }
-
- void debug_mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter,
-- struct thread_info *ti)
-+ struct task_struct *task)
- {
- SMP_DEBUG_LOCKS_WARN_ON(!spin_is_locked(&lock->wait_lock));
-
- /* Mark the current thread as blocked on the lock: */
-- ti->task->blocked_on = waiter;
-+ task->blocked_on = waiter;
- }
-
- void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
-- struct thread_info *ti)
-+ struct task_struct *task)
- {
- DEBUG_LOCKS_WARN_ON(list_empty(&waiter->list));
-- DEBUG_LOCKS_WARN_ON(waiter->task != ti->task);
-- DEBUG_LOCKS_WARN_ON(ti->task->blocked_on != waiter);
-- ti->task->blocked_on = NULL;
-+ DEBUG_LOCKS_WARN_ON(waiter->task != task);
-+ DEBUG_LOCKS_WARN_ON(task->blocked_on != waiter);
-+ task->blocked_on = NULL;
-
- list_del_init(&waiter->list);
- waiter->task = NULL;
-@@ -75,7 +75,7 @@ void debug_mutex_unlock(struct mutex *lock)
- return;
-
- DEBUG_LOCKS_WARN_ON(lock->magic != lock);
-- DEBUG_LOCKS_WARN_ON(lock->owner != current_thread_info());
-+ DEBUG_LOCKS_WARN_ON(lock->owner != current);
- DEBUG_LOCKS_WARN_ON(!lock->wait_list.prev && !lock->wait_list.next);
- mutex_clear_owner(lock);
- }
-diff --git a/kernel/mutex-debug.h b/kernel/mutex-debug.h
-index 6b2d735..372d3c4 100644
---- a/kernel/mutex-debug.h
-+++ b/kernel/mutex-debug.h
-@@ -20,16 +20,16 @@ extern void debug_mutex_wake_waiter(struct mutex *lock,
- extern void debug_mutex_free_waiter(struct mutex_waiter *waiter);
- extern void debug_mutex_add_waiter(struct mutex *lock,
- struct mutex_waiter *waiter,
-- struct thread_info *ti);
-+ struct task_struct *task);
- extern void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
-- struct thread_info *ti);
-+ struct task_struct *task);
- extern void debug_mutex_unlock(struct mutex *lock);
- extern void debug_mutex_init(struct mutex *lock, const char *name,
- struct lock_class_key *key);
-
- static inline void mutex_set_owner(struct mutex *lock)
- {
-- lock->owner = current_thread_info();
-+ lock->owner = current;
- }
-
- static inline void mutex_clear_owner(struct mutex *lock)
-diff --git a/kernel/mutex.c b/kernel/mutex.c
-index f85644c..5ee9f77 100644
---- a/kernel/mutex.c
-+++ b/kernel/mutex.c
-@@ -169,7 +169,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
- */
-
- for (;;) {
-- struct thread_info *owner;
-+ struct task_struct *owner;
-
- /*
- * If we own the BKL, then don't spin. The owner of
-@@ -214,7 +214,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
- spin_lock_mutex(&lock->wait_lock, flags);
-
- debug_mutex_lock_common(lock, &waiter);
-- debug_mutex_add_waiter(lock, &waiter, task_thread_info(task));
-+ debug_mutex_add_waiter(lock, &waiter, task);
-
- /* add waiting tasks to the end of the waitqueue (FIFO): */
- list_add_tail(&waiter.list, &lock->wait_list);
-@@ -243,8 +243,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
- * TASK_UNINTERRUPTIBLE case.)
- */
- if (unlikely(signal_pending_state(state, task))) {
-- mutex_remove_waiter(lock, &waiter,
-- task_thread_info(task));
-+ mutex_remove_waiter(lock, &waiter, task);
- mutex_release(&lock->dep_map, 1, ip);
- spin_unlock_mutex(&lock->wait_lock, flags);
-
-@@ -265,7 +264,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
- done:
- lock_acquired(&lock->dep_map, ip);
- /* got the lock - rejoice! */
-- mutex_remove_waiter(lock, &waiter, current_thread_info());
-+ mutex_remove_waiter(lock, &waiter, task);
- mutex_set_owner(lock);
-
- /* set it to 0 if there are no waiters left: */
-diff --git a/kernel/mutex.h b/kernel/mutex.h
-index 67578ca..4115fbf 100644
---- a/kernel/mutex.h
-+++ b/kernel/mutex.h
-@@ -19,7 +19,7 @@
- #ifdef CONFIG_SMP
- static inline void mutex_set_owner(struct mutex *lock)
- {
-- lock->owner = current_thread_info();
-+ lock->owner = current;
- }
-
- static inline void mutex_clear_owner(struct mutex *lock)
-diff --git a/kernel/notifier.c b/kernel/notifier.c
-index 61d5aa5..451d460 100644
---- a/kernel/notifier.c
-+++ b/kernel/notifier.c
-@@ -5,6 +5,7 @@
- #include <linux/rcupdate.h>
- #include <linux/vmalloc.h>
- #include <linux/reboot.h>
-+#include <linux/mm.h>
-
- /*
- * Notifier list for kernel code which wants to be called
-@@ -24,10 +25,12 @@ static int notifier_chain_register(struct notifier_block **nl,
- while ((*nl) != NULL) {
- if (n->priority > (*nl)->priority)
- break;
-- nl = &((*nl)->next);
-+ nl = (struct notifier_block **)&((*nl)->next);
- }
-- n->next = *nl;
-+ pax_open_kernel();
-+ *(const void **)&n->next = *nl;
- rcu_assign_pointer(*nl, n);
-+ pax_close_kernel();
- return 0;
- }
-
-@@ -39,10 +42,12 @@ static int notifier_chain_cond_register(struct notifier_block **nl,
- return 0;
- if (n->priority > (*nl)->priority)
- break;
-- nl = &((*nl)->next);
-+ nl = (struct notifier_block **)&((*nl)->next);
- }
-- n->next = *nl;
-+ pax_open_kernel();
-+ *(const void **)&n->next = *nl;
- rcu_assign_pointer(*nl, n);
-+ pax_close_kernel();
- return 0;
- }
-
-@@ -51,10 +56,12 @@ static int notifier_chain_unregister(struct notifier_block **nl,
- {
- while ((*nl) != NULL) {
- if ((*nl) == n) {
-+ pax_open_kernel();
- rcu_assign_pointer(*nl, n->next);
-+ pax_close_kernel();
- return 0;
- }
-- nl = &((*nl)->next);
-+ nl = (struct notifier_block **)&((*nl)->next);
- }
- return -ENOENT;
- }
-diff --git a/kernel/panic.c b/kernel/panic.c
-index 96b45d0..98fb1c3 100644
---- a/kernel/panic.c
-+++ b/kernel/panic.c
-@@ -59,6 +59,14 @@ NORET_TYPE void panic(const char * fmt, ...)
- long i;
-
- /*
-+ * Disable local interrupts. This will prevent panic_smp_self_stop
-+ * from deadlocking the first cpu that invokes the panic, since
-+ * there is nothing to prevent an interrupt handler (that runs
-+ * after the panic_lock is acquired) from invoking panic again.
-+ */
-+ local_irq_disable();
-+
-+ /*
- * It's possible to come here directly from a panic-assertion and
- * not have preempt disabled. Some functions called from here want
- * preempt to be disabled. No point enabling it later though...
-@@ -71,7 +79,11 @@ NORET_TYPE void panic(const char * fmt, ...)
- va_end(args);
- printk(KERN_EMERG "Kernel panic - not syncing: %s\n",buf);
- #ifdef CONFIG_DEBUG_BUGVERBOSE
-- dump_stack();
-+ /*
-+ * Avoid nested stack-dumping if a panic occurs during oops processing
-+ */
-+ if (!test_taint(TAINT_DIE) && oops_in_progress <= 1)
-+ dump_stack();
- #endif
-
- /*
-@@ -352,7 +364,7 @@ static void warn_slowpath_common(const char *file, int line, void *caller, struc
- const char *board;
-
- printk(KERN_WARNING "------------[ cut here ]------------\n");
-- printk(KERN_WARNING "WARNING: at %s:%d %pS()\n", file, line, caller);
-+ printk(KERN_WARNING "WARNING: at %s:%d %pA()\n", file, line, caller);
- board = dmi_get_system_info(DMI_PRODUCT_NAME);
- if (board)
- printk(KERN_WARNING "Hardware name: %s\n", board);
-@@ -392,7 +404,8 @@ EXPORT_SYMBOL(warn_slowpath_null);
- */
- void __stack_chk_fail(void)
- {
-- panic("stack-protector: Kernel stack is corrupted in: %p\n",
-+ dump_stack();
-+ panic("stack-protector: Kernel stack is corrupted in: %pA\n",
- __builtin_return_address(0));
- }
- EXPORT_SYMBOL(__stack_chk_fail);
-diff --git a/kernel/params.c b/kernel/params.c
-index d656c27..21e452c 100644
---- a/kernel/params.c
-+++ b/kernel/params.c
-@@ -725,7 +725,7 @@ static ssize_t module_attr_store(struct kobject *kobj,
- return ret;
- }
-
--static struct sysfs_ops module_sysfs_ops = {
-+static const struct sysfs_ops module_sysfs_ops = {
- .show = module_attr_show,
- .store = module_attr_store,
- };
-@@ -739,7 +739,7 @@ static int uevent_filter(struct kset *kset, struct kobject *kobj)
- return 0;
- }
-
--static struct kset_uevent_ops module_uevent_ops = {
-+static const struct kset_uevent_ops module_uevent_ops = {
- .filter = uevent_filter,
- };
-
-diff --git a/kernel/perf_event.c b/kernel/perf_event.c
-index 37ebc14..4596080 100644
---- a/kernel/perf_event.c
-+++ b/kernel/perf_event.c
-@@ -52,7 +52,11 @@ static atomic_t nr_task_events __read_mostly;
- * 1 - disallow cpu events for unpriv
- * 2 - disallow kernel profiling for unpriv
- */
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+int sysctl_perf_event_paranoid __read_mostly = 2;
-+#else
- int sysctl_perf_event_paranoid __read_mostly = 1;
-+#endif
-
- static inline bool perf_paranoid_tracepoint_raw(void)
- {
-@@ -77,7 +81,7 @@ int sysctl_perf_event_mlock __read_mostly = 516; /* 'free' kb per user */
- */
- int sysctl_perf_event_sample_rate __read_mostly = 100000;
-
--static atomic64_t perf_event_id;
-+static atomic64_unchecked_t perf_event_id;
-
- /*
- * Lock for (sysadmin-configurable) event reservations:
-@@ -1094,9 +1098,9 @@ static void __perf_event_sync_stat(struct perf_event *event,
- * In order to keep per-task stats reliable we need to flip the event
- * values when we flip the contexts.
- */
-- value = atomic64_read(&next_event->count);
-- value = atomic64_xchg(&event->count, value);
-- atomic64_set(&next_event->count, value);
-+ value = atomic64_read_unchecked(&next_event->count);
-+ value = atomic64_xchg_unchecked(&event->count, value);
-+ atomic64_set_unchecked(&next_event->count, value);
-
- swap(event->total_time_enabled, next_event->total_time_enabled);
- swap(event->total_time_running, next_event->total_time_running);
-@@ -1552,7 +1556,7 @@ static u64 perf_event_read(struct perf_event *event)
- update_event_times(event);
- }
-
-- return atomic64_read(&event->count);
-+ return atomic64_read_unchecked(&event->count);
- }
-
- /*
-@@ -1790,11 +1794,11 @@ static int perf_event_read_group(struct perf_event *event,
- values[n++] = 1 + leader->nr_siblings;
- if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
- values[n++] = leader->total_time_enabled +
-- atomic64_read(&leader->child_total_time_enabled);
-+ atomic64_read_unchecked(&leader->child_total_time_enabled);
- }
- if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
- values[n++] = leader->total_time_running +
-- atomic64_read(&leader->child_total_time_running);
-+ atomic64_read_unchecked(&leader->child_total_time_running);
- }
-
- size = n * sizeof(u64);
-@@ -1829,11 +1833,11 @@ static int perf_event_read_one(struct perf_event *event,
- values[n++] = perf_event_read_value(event);
- if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
- values[n++] = event->total_time_enabled +
-- atomic64_read(&event->child_total_time_enabled);
-+ atomic64_read_unchecked(&event->child_total_time_enabled);
- }
- if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
- values[n++] = event->total_time_running +
-- atomic64_read(&event->child_total_time_running);
-+ atomic64_read_unchecked(&event->child_total_time_running);
- }
- if (read_format & PERF_FORMAT_ID)
- values[n++] = primary_event_id(event);
-@@ -1903,7 +1907,7 @@ static unsigned int perf_poll(struct file *file, poll_table *wait)
- static void perf_event_reset(struct perf_event *event)
- {
- (void)perf_event_read(event);
-- atomic64_set(&event->count, 0);
-+ atomic64_set_unchecked(&event->count, 0);
- perf_event_update_userpage(event);
- }
-
-@@ -2079,15 +2083,15 @@ void perf_event_update_userpage(struct perf_event *event)
- ++userpg->lock;
- barrier();
- userpg->index = perf_event_index(event);
-- userpg->offset = atomic64_read(&event->count);
-+ userpg->offset = atomic64_read_unchecked(&event->count);
- if (event->state == PERF_EVENT_STATE_ACTIVE)
-- userpg->offset -= atomic64_read(&event->hw.prev_count);
-+ userpg->offset -= atomic64_read_unchecked(&event->hw.prev_count);
-
- userpg->time_enabled = event->total_time_enabled +
-- atomic64_read(&event->child_total_time_enabled);
-+ atomic64_read_unchecked(&event->child_total_time_enabled);
-
- userpg->time_running = event->total_time_running +
-- atomic64_read(&event->child_total_time_running);
-+ atomic64_read_unchecked(&event->child_total_time_running);
-
- barrier();
- ++userpg->lock;
-@@ -2903,14 +2907,14 @@ static void perf_output_read_one(struct perf_output_handle *handle,
- u64 values[4];
- int n = 0;
-
-- values[n++] = atomic64_read(&event->count);
-+ values[n++] = atomic64_read_unchecked(&event->count);
- if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
- values[n++] = event->total_time_enabled +
-- atomic64_read(&event->child_total_time_enabled);
-+ atomic64_read_unchecked(&event->child_total_time_enabled);
- }
- if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
- values[n++] = event->total_time_running +
-- atomic64_read(&event->child_total_time_running);
-+ atomic64_read_unchecked(&event->child_total_time_running);
- }
- if (read_format & PERF_FORMAT_ID)
- values[n++] = primary_event_id(event);
-@@ -2940,7 +2944,7 @@ static void perf_output_read_group(struct perf_output_handle *handle,
- if (leader != event)
- leader->pmu->read(leader);
-
-- values[n++] = atomic64_read(&leader->count);
-+ values[n++] = atomic64_read_unchecked(&leader->count);
- if (read_format & PERF_FORMAT_ID)
- values[n++] = primary_event_id(leader);
-
-@@ -2952,7 +2956,7 @@ static void perf_output_read_group(struct perf_output_handle *handle,
- if (sub != event)
- sub->pmu->read(sub);
-
-- values[n++] = atomic64_read(&sub->count);
-+ values[n++] = atomic64_read_unchecked(&sub->count);
- if (read_format & PERF_FORMAT_ID)
- values[n++] = primary_event_id(sub);
-
-@@ -3525,12 +3529,12 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event)
- * need to add enough zero bytes after the string to handle
- * the 64bit alignment we do later.
- */
-- buf = kzalloc(PATH_MAX + sizeof(u64), GFP_KERNEL);
-+ buf = kzalloc(PATH_MAX, GFP_KERNEL);
- if (!buf) {
- name = strncpy(tmp, "//enomem", sizeof(tmp));
- goto got_name;
- }
-- name = d_path(&file->f_path, buf, PATH_MAX);
-+ name = d_path(&file->f_path, buf, PATH_MAX - sizeof(u64));
- if (IS_ERR(name)) {
- name = strncpy(tmp, "//toolong", sizeof(tmp));
- goto got_name;
-@@ -3783,7 +3787,7 @@ static void perf_swevent_add(struct perf_event *event, u64 nr,
- {
- struct hw_perf_event *hwc = &event->hw;
-
-- atomic64_add(nr, &event->count);
-+ atomic64_add_unchecked(nr, &event->count);
-
- if (!hwc->sample_period)
- return;
-@@ -4040,9 +4044,9 @@ static void cpu_clock_perf_event_update(struct perf_event *event)
- u64 now;
-
- now = cpu_clock(cpu);
-- prev = atomic64_read(&event->hw.prev_count);
-- atomic64_set(&event->hw.prev_count, now);
-- atomic64_add(now - prev, &event->count);
-+ prev = atomic64_read_unchecked(&event->hw.prev_count);
-+ atomic64_set_unchecked(&event->hw.prev_count, now);
-+ atomic64_add_unchecked(now - prev, &event->count);
- }
-
- static int cpu_clock_perf_event_enable(struct perf_event *event)
-@@ -4050,7 +4054,7 @@ static int cpu_clock_perf_event_enable(struct perf_event *event)
- struct hw_perf_event *hwc = &event->hw;
- int cpu = raw_smp_processor_id();
-
-- atomic64_set(&hwc->prev_count, cpu_clock(cpu));
-+ atomic64_set_unchecked(&hwc->prev_count, cpu_clock(cpu));
- perf_swevent_start_hrtimer(event);
-
- return 0;
-@@ -4082,9 +4086,9 @@ static void task_clock_perf_event_update(struct perf_event *event, u64 now)
- u64 prev;
- s64 delta;
-
-- prev = atomic64_xchg(&event->hw.prev_count, now);
-+ prev = atomic64_xchg_unchecked(&event->hw.prev_count, now);
- delta = now - prev;
-- atomic64_add(delta, &event->count);
-+ atomic64_add_unchecked(delta, &event->count);
- }
-
- static int task_clock_perf_event_enable(struct perf_event *event)
-@@ -4094,7 +4098,7 @@ static int task_clock_perf_event_enable(struct perf_event *event)
-
- now = event->ctx->time;
-
-- atomic64_set(&hwc->prev_count, now);
-+ atomic64_set_unchecked(&hwc->prev_count, now);
-
- perf_swevent_start_hrtimer(event);
-
-@@ -4289,7 +4293,7 @@ perf_event_alloc(struct perf_event_attr *attr,
- event->parent = parent_event;
-
- event->ns = get_pid_ns(current->nsproxy->pid_ns);
-- event->id = atomic64_inc_return(&perf_event_id);
-+ event->id = atomic64_inc_return_unchecked(&perf_event_id);
-
- event->state = PERF_EVENT_STATE_INACTIVE;
-
-@@ -4720,15 +4724,15 @@ static void sync_child_event(struct perf_event *child_event,
- if (child_event->attr.inherit_stat)
- perf_event_read_event(child_event, child);
-
-- child_val = atomic64_read(&child_event->count);
-+ child_val = atomic64_read_unchecked(&child_event->count);
-
- /*
- * Add back the child's count to the parent's count:
- */
-- atomic64_add(child_val, &parent_event->count);
-- atomic64_add(child_event->total_time_enabled,
-+ atomic64_add_unchecked(child_val, &parent_event->count);
-+ atomic64_add_unchecked(child_event->total_time_enabled,
- &parent_event->child_total_time_enabled);
-- atomic64_add(child_event->total_time_running,
-+ atomic64_add_unchecked(child_event->total_time_running,
- &parent_event->child_total_time_running);
-
- /*
-diff --git a/kernel/pid.c b/kernel/pid.c
-index fce7198..4f23a7e 100644
---- a/kernel/pid.c
-+++ b/kernel/pid.c
-@@ -33,6 +33,7 @@
- #include <linux/rculist.h>
- #include <linux/bootmem.h>
- #include <linux/hash.h>
-+#include <linux/security.h>
- #include <linux/pid_namespace.h>
- #include <linux/init_task.h>
- #include <linux/syscalls.h>
-@@ -45,7 +46,7 @@ struct pid init_struct_pid = INIT_STRUCT_PID;
-
- int pid_max = PID_MAX_DEFAULT;
-
--#define RESERVED_PIDS 300
-+#define RESERVED_PIDS 500
-
- int pid_max_min = RESERVED_PIDS + 1;
- int pid_max_max = PID_MAX_LIMIT;
-@@ -383,7 +384,14 @@ EXPORT_SYMBOL(pid_task);
- */
- struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
- {
-- return pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
-+ struct task_struct *task;
-+
-+ task = pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
-+
-+ if (gr_pid_is_chrooted(task))
-+ return NULL;
-+
-+ return task;
- }
-
- struct task_struct *find_task_by_vpid(pid_t vnr)
-@@ -391,6 +399,11 @@ struct task_struct *find_task_by_vpid(pid_t vnr)
- return find_task_by_pid_ns(vnr, current->nsproxy->pid_ns);
- }
-
-+struct task_struct *find_task_by_vpid_unrestricted(pid_t vnr)
-+{
-+ return pid_task(find_pid_ns(vnr, current->nsproxy->pid_ns), PIDTYPE_PID);
-+}
-+
- struct pid *get_task_pid(struct task_struct *task, enum pid_type type)
- {
- struct pid *pid;
-diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c
-index ea83f5d..daca15b 100644
---- a/kernel/posix-cpu-timers.c
-+++ b/kernel/posix-cpu-timers.c
-@@ -6,23 +6,25 @@
- #include <linux/posix-timers.h>
- #include <linux/errno.h>
- #include <linux/math64.h>
-+#include <linux/security.h>
- #include <asm/uaccess.h>
- #include <linux/kernel_stat.h>
- #include <trace/events/timer.h>
-+#include <linux/random.h>
-
- /*
- * Called after updating RLIMIT_CPU to set timer expiration if necessary.
- */
--void update_rlimit_cpu(unsigned long rlim_new)
-+void update_rlimit_cpu(struct task_struct *task, unsigned long rlim_new)
- {
- cputime_t cputime = secs_to_cputime(rlim_new);
-- struct signal_struct *const sig = current->signal;
-+ struct signal_struct *const sig = task->signal;
-
- if (cputime_eq(sig->it[CPUCLOCK_PROF].expires, cputime_zero) ||
- cputime_gt(sig->it[CPUCLOCK_PROF].expires, cputime)) {
-- spin_lock_irq(¤t->sighand->siglock);
-- set_process_cpu_timer(current, CPUCLOCK_PROF, &cputime, NULL);
-- spin_unlock_irq(¤t->sighand->siglock);
-+ spin_lock_irq(&task->sighand->siglock);
-+ set_process_cpu_timer(task, CPUCLOCK_PROF, &cputime, NULL);
-+ spin_unlock_irq(&task->sighand->siglock);
- }
- }
-
-@@ -516,6 +518,8 @@ static void cleanup_timers(struct list_head *head,
- */
- void posix_cpu_timers_exit(struct task_struct *tsk)
- {
-+ add_device_randomness((const void*) &tsk->se.sum_exec_runtime,
-+ sizeof(unsigned long long));
- cleanup_timers(tsk->cpu_timers,
- tsk->utime, tsk->stime, tsk->se.sum_exec_runtime);
-
-@@ -1716,7 +1720,7 @@ static long thread_cpu_nsleep_restart(struct restart_block *restart_block)
-
- static __init int init_posix_cpu_timers(void)
- {
-- struct k_clock process = {
-+ static struct k_clock process = {
- .clock_getres = process_cpu_clock_getres,
- .clock_get = process_cpu_clock_get,
- .clock_set = do_posix_clock_nosettime,
-@@ -1724,7 +1728,7 @@ static __init int init_posix_cpu_timers(void)
- .nsleep = process_cpu_nsleep,
- .nsleep_restart = process_cpu_nsleep_restart,
- };
-- struct k_clock thread = {
-+ static struct k_clock thread = {
- .clock_getres = thread_cpu_clock_getres,
- .clock_get = thread_cpu_clock_get,
- .clock_set = do_posix_clock_nosettime,
-diff --git a/kernel/posix-timers.c b/kernel/posix-timers.c
-index 5e76d22..f2d062c 100644
---- a/kernel/posix-timers.c
-+++ b/kernel/posix-timers.c
-@@ -42,6 +42,7 @@
- #include <linux/compiler.h>
- #include <linux/idr.h>
- #include <linux/posix-timers.h>
-+#include <linux/grsecurity.h>
- #include <linux/syscalls.h>
- #include <linux/wait.h>
- #include <linux/workqueue.h>
-@@ -131,7 +132,7 @@ static DEFINE_SPINLOCK(idr_lock);
- * which we beg off on and pass to do_sys_settimeofday().
- */
-
--static struct k_clock posix_clocks[MAX_CLOCKS];
-+static struct k_clock *posix_clocks[MAX_CLOCKS];
-
- /*
- * These ones are defined below.
-@@ -157,8 +158,8 @@ static inline void unlock_timer(struct k_itimer *timr, unsigned long flags)
- */
- #define CLOCK_DISPATCH(clock, call, arglist) \
- ((clock) < 0 ? posix_cpu_##call arglist : \
-- (posix_clocks[clock].call != NULL \
-- ? (*posix_clocks[clock].call) arglist : common_##call arglist))
-+ (posix_clocks[clock]->call != NULL \
-+ ? (*posix_clocks[clock]->call) arglist : common_##call arglist))
-
- /*
- * Default clock hook functions when the struct k_clock passed
-@@ -172,7 +173,7 @@ static inline int common_clock_getres(const clockid_t which_clock,
- struct timespec *tp)
- {
- tp->tv_sec = 0;
-- tp->tv_nsec = posix_clocks[which_clock].res;
-+ tp->tv_nsec = posix_clocks[which_clock]->res;
- return 0;
- }
-
-@@ -217,9 +218,11 @@ static inline int invalid_clockid(const clockid_t which_clock)
- return 0;
- if ((unsigned) which_clock >= MAX_CLOCKS)
- return 1;
-- if (posix_clocks[which_clock].clock_getres != NULL)
-+ if (posix_clocks[which_clock] == NULL)
-+ return 1;
-+ if (posix_clocks[which_clock]->clock_getres != NULL)
- return 0;
-- if (posix_clocks[which_clock].res != 0)
-+ if (posix_clocks[which_clock]->res != 0)
- return 0;
- return 1;
- }
-@@ -266,29 +269,29 @@ int posix_get_coarse_res(const clockid_t which_clock, struct timespec *tp)
- */
- static __init int init_posix_timers(void)
- {
-- struct k_clock clock_realtime = {
-+ static struct k_clock clock_realtime = {
- .clock_getres = hrtimer_get_res,
- };
-- struct k_clock clock_monotonic = {
-+ static struct k_clock clock_monotonic = {
- .clock_getres = hrtimer_get_res,
- .clock_get = posix_ktime_get_ts,
- .clock_set = do_posix_clock_nosettime,
- };
-- struct k_clock clock_monotonic_raw = {
-+ static struct k_clock clock_monotonic_raw = {
- .clock_getres = hrtimer_get_res,
- .clock_get = posix_get_monotonic_raw,
- .clock_set = do_posix_clock_nosettime,
- .timer_create = no_timer_create,
- .nsleep = no_nsleep,
- };
-- struct k_clock clock_realtime_coarse = {
-+ static struct k_clock clock_realtime_coarse = {
- .clock_getres = posix_get_coarse_res,
- .clock_get = posix_get_realtime_coarse,
- .clock_set = do_posix_clock_nosettime,
- .timer_create = no_timer_create,
- .nsleep = no_nsleep,
- };
-- struct k_clock clock_monotonic_coarse = {
-+ static struct k_clock clock_monotonic_coarse = {
- .clock_getres = posix_get_coarse_res,
- .clock_get = posix_get_monotonic_coarse,
- .clock_set = do_posix_clock_nosettime,
-@@ -296,6 +299,8 @@ static __init int init_posix_timers(void)
- .nsleep = no_nsleep,
- };
-
-+ pax_track_stack();
-+
- register_posix_clock(CLOCK_REALTIME, &clock_realtime);
- register_posix_clock(CLOCK_MONOTONIC, &clock_monotonic);
- register_posix_clock(CLOCK_MONOTONIC_RAW, &clock_monotonic_raw);
-@@ -484,7 +489,7 @@ void register_posix_clock(const clockid_t clock_id, struct k_clock *new_clock)
- return;
- }
-
-- posix_clocks[clock_id] = *new_clock;
-+ posix_clocks[clock_id] = new_clock;
- }
- EXPORT_SYMBOL_GPL(register_posix_clock);
-
-@@ -948,6 +953,13 @@ SYSCALL_DEFINE2(clock_settime, const clockid_t, which_clock,
- if (copy_from_user(&new_tp, tp, sizeof (*tp)))
- return -EFAULT;
-
-+ /* only the CLOCK_REALTIME clock can be set, all other clocks
-+ have their clock_set fptr set to a nosettime dummy function
-+ CLOCK_REALTIME has a NULL clock_set fptr which causes it to
-+ call common_clock_set, which calls do_sys_settimeofday, which
-+ we hook
-+ */
-+
- return CLOCK_DISPATCH(which_clock, clock_set, (which_clock, &new_tp));
- }
-
-diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
-index 04a9e90..bc355aa 100644
---- a/kernel/power/hibernate.c
-+++ b/kernel/power/hibernate.c
-@@ -48,14 +48,14 @@ enum {
-
- static int hibernation_mode = HIBERNATION_SHUTDOWN;
-
--static struct platform_hibernation_ops *hibernation_ops;
-+static const struct platform_hibernation_ops *hibernation_ops;
-
- /**
- * hibernation_set_ops - set the global hibernate operations
- * @ops: the hibernation operations to use in subsequent hibernation transitions
- */
-
--void hibernation_set_ops(struct platform_hibernation_ops *ops)
-+void hibernation_set_ops(const struct platform_hibernation_ops *ops)
- {
- if (ops && !(ops->begin && ops->end && ops->pre_snapshot
- && ops->prepare && ops->finish && ops->enter && ops->pre_restore
-diff --git a/kernel/power/poweroff.c b/kernel/power/poweroff.c
-index e8b3370..484c2e4 100644
---- a/kernel/power/poweroff.c
-+++ b/kernel/power/poweroff.c
-@@ -37,7 +37,7 @@ static struct sysrq_key_op sysrq_poweroff_op = {
- .enable_mask = SYSRQ_ENABLE_BOOT,
- };
-
--static int pm_sysrq_init(void)
-+static int __init pm_sysrq_init(void)
- {
- register_sysrq_key('o', &sysrq_poweroff_op);
- return 0;
-diff --git a/kernel/power/process.c b/kernel/power/process.c
-index e7cd671..56d5f459 100644
---- a/kernel/power/process.c
-+++ b/kernel/power/process.c
-@@ -37,12 +37,15 @@ static int try_to_freeze_tasks(bool sig_only)
- struct timeval start, end;
- u64 elapsed_csecs64;
- unsigned int elapsed_csecs;
-+ bool timedout = false;
-
- do_gettimeofday(&start);
-
- end_time = jiffies + TIMEOUT;
- do {
- todo = 0;
-+ if (time_after(jiffies, end_time))
-+ timedout = true;
- read_lock(&tasklist_lock);
- do_each_thread(g, p) {
- if (frozen(p) || !freezeable(p))
-@@ -57,15 +60,17 @@ static int try_to_freeze_tasks(bool sig_only)
- * It is "frozen enough". If the task does wake
- * up, it will immediately call try_to_freeze.
- */
-- if (!task_is_stopped_or_traced(p) &&
-- !freezer_should_skip(p))
-+ if (!task_is_stopped_or_traced(p) && !freezer_should_skip(p)) {
- todo++;
-+ if (timedout) {
-+ printk(KERN_ERR "Task refusing to freeze:\n");
-+ sched_show_task(p);
-+ }
-+ }
- } while_each_thread(g, p);
- read_unlock(&tasklist_lock);
- yield(); /* Yield is okay here */
-- if (time_after(jiffies, end_time))
-- break;
-- } while (todo);
-+ } while (todo && !timedout);
-
- do_gettimeofday(&end);
- elapsed_csecs64 = timeval_to_ns(&end) - timeval_to_ns(&start);
-diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c
-index 40dd021..fb30ceb 100644
---- a/kernel/power/suspend.c
-+++ b/kernel/power/suspend.c
-@@ -23,13 +23,13 @@ const char *const pm_states[PM_SUSPEND_MAX] = {
- [PM_SUSPEND_MEM] = "mem",
- };
-
--static struct platform_suspend_ops *suspend_ops;
-+static const struct platform_suspend_ops *suspend_ops;
-
- /**
- * suspend_set_ops - Set the global suspend method table.
- * @ops: Pointer to ops structure.
- */
--void suspend_set_ops(struct platform_suspend_ops *ops)
-+void suspend_set_ops(const struct platform_suspend_ops *ops)
- {
- mutex_lock(&pm_mutex);
- suspend_ops = ops;
-diff --git a/kernel/printk.c b/kernel/printk.c
-index 4cade47..4ddd097 100644
---- a/kernel/printk.c
-+++ b/kernel/printk.c
-@@ -33,6 +33,7 @@
- #include <linux/bootmem.h>
- #include <linux/syscalls.h>
- #include <linux/kexec.h>
-+#include <linux/syslog.h>
-
- #include <asm/uaccess.h>
-
-@@ -256,38 +257,30 @@ static inline void boot_delay_msec(void)
- }
- #endif
-
--/*
-- * Commands to do_syslog:
-- *
-- * 0 -- Close the log. Currently a NOP.
-- * 1 -- Open the log. Currently a NOP.
-- * 2 -- Read from the log.
-- * 3 -- Read all messages remaining in the ring buffer.
-- * 4 -- Read and clear all messages remaining in the ring buffer
-- * 5 -- Clear ring buffer.
-- * 6 -- Disable printk's to console
-- * 7 -- Enable printk's to console
-- * 8 -- Set level of messages printed to console
-- * 9 -- Return number of unread characters in the log buffer
-- * 10 -- Return size of the log buffer
-- */
--int do_syslog(int type, char __user *buf, int len)
-+int do_syslog(int type, char __user *buf, int len, bool from_file)
- {
- unsigned i, j, limit, count;
- int do_clear = 0;
- char c;
- int error = 0;
-
-- error = security_syslog(type);
-+#ifdef CONFIG_GRKERNSEC_DMESG
-+ if (grsec_enable_dmesg &&
-+ (!from_file || (from_file && type == SYSLOG_ACTION_OPEN)) &&
-+ !capable(CAP_SYS_ADMIN))
-+ return -EPERM;
-+#endif
-+
-+ error = security_syslog(type, from_file);
- if (error)
- return error;
-
- switch (type) {
-- case 0: /* Close log */
-+ case SYSLOG_ACTION_CLOSE: /* Close log */
- break;
-- case 1: /* Open log */
-+ case SYSLOG_ACTION_OPEN: /* Open log */
- break;
-- case 2: /* Read from log */
-+ case SYSLOG_ACTION_READ: /* Read from log */
- error = -EINVAL;
- if (!buf || len < 0)
- goto out;
-@@ -318,10 +311,12 @@ int do_syslog(int type, char __user *buf, int len)
- if (!error)
- error = i;
- break;
-- case 4: /* Read/clear last kernel messages */
-+ /* Read/clear last kernel messages */
-+ case SYSLOG_ACTION_READ_CLEAR:
- do_clear = 1;
- /* FALL THRU */
-- case 3: /* Read last kernel messages */
-+ /* Read last kernel messages */
-+ case SYSLOG_ACTION_READ_ALL:
- error = -EINVAL;
- if (!buf || len < 0)
- goto out;
-@@ -374,21 +369,25 @@ int do_syslog(int type, char __user *buf, int len)
- }
- }
- break;
-- case 5: /* Clear ring buffer */
-+ /* Clear ring buffer */
-+ case SYSLOG_ACTION_CLEAR:
- logged_chars = 0;
- break;
-- case 6: /* Disable logging to console */
-+ /* Disable logging to console */
-+ case SYSLOG_ACTION_CONSOLE_OFF:
- if (saved_console_loglevel == -1)
- saved_console_loglevel = console_loglevel;
- console_loglevel = minimum_console_loglevel;
- break;
-- case 7: /* Enable logging to console */
-+ /* Enable logging to console */
-+ case SYSLOG_ACTION_CONSOLE_ON:
- if (saved_console_loglevel != -1) {
- console_loglevel = saved_console_loglevel;
- saved_console_loglevel = -1;
- }
- break;
-- case 8: /* Set level of messages printed to console */
-+ /* Set level of messages printed to console */
-+ case SYSLOG_ACTION_CONSOLE_LEVEL:
- error = -EINVAL;
- if (len < 1 || len > 8)
- goto out;
-@@ -399,10 +398,12 @@ int do_syslog(int type, char __user *buf, int len)
- saved_console_loglevel = -1;
- error = 0;
- break;
-- case 9: /* Number of chars in the log buffer */
-+ /* Number of chars in the log buffer */
-+ case SYSLOG_ACTION_SIZE_UNREAD:
- error = log_end - log_start;
- break;
-- case 10: /* Size of the log buffer */
-+ /* Size of the log buffer */
-+ case SYSLOG_ACTION_SIZE_BUFFER:
- error = log_buf_len;
- break;
- default:
-@@ -415,7 +416,7 @@ out:
-
- SYSCALL_DEFINE3(syslog, int, type, char __user *, buf, int, len)
- {
-- return do_syslog(type, buf, len);
-+ return do_syslog(type, buf, len, SYSLOG_FROM_CALL);
- }
-
- /*
-@@ -1153,6 +1154,18 @@ void console_start(struct console *console)
- }
- EXPORT_SYMBOL(console_start);
-
-+static int __read_mostly keep_bootcon = 0;
-+
-+static int __init keep_bootcon_setup(char *str)
-+{
-+ keep_bootcon = 1;
-+ printk(KERN_INFO "debug: skip boot console de-registration.\n");
-+
-+ return 0;
-+}
-+
-+early_param("keep_bootcon", keep_bootcon_setup);
-+
- /*
- * The console driver calls this routine during kernel initialization
- * to register the console printing procedure with printk() and to
-@@ -1299,7 +1312,9 @@ void register_console(struct console *newcon)
- * users know there might be something in the kernel's log buffer that
- * went to the bootconsole (that they do not see on the real console)
- */
-- if (bcon && ((newcon->flags & (CON_CONSDEV | CON_BOOT)) == CON_CONSDEV)) {
-+ if (bcon &&
-+ ((newcon->flags & (CON_CONSDEV | CON_BOOT)) == CON_CONSDEV) &&
-+ !keep_bootcon) {
- /* we need to iterate through twice, to make sure we print
- * everything out, before we unregister the console(s)
- */
-diff --git a/kernel/profile.c b/kernel/profile.c
-index dfadc5b..7f59404 100644
---- a/kernel/profile.c
-+++ b/kernel/profile.c
-@@ -39,7 +39,7 @@ struct profile_hit {
- /* Oprofile timer tick hook */
- static int (*timer_hook)(struct pt_regs *) __read_mostly;
-
--static atomic_t *prof_buffer;
-+static atomic_unchecked_t *prof_buffer;
- static unsigned long prof_len, prof_shift;
-
- int prof_on __read_mostly;
-@@ -283,7 +283,7 @@ static void profile_flip_buffers(void)
- hits[i].pc = 0;
- continue;
- }
-- atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
-+ atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
- hits[i].hits = hits[i].pc = 0;
- }
- }
-@@ -346,9 +346,9 @@ void profile_hits(int type, void *__pc, unsigned int nr_hits)
- * Add the current hit(s) and flush the write-queue out
- * to the global buffer:
- */
-- atomic_add(nr_hits, &prof_buffer[pc]);
-+ atomic_add_unchecked(nr_hits, &prof_buffer[pc]);
- for (i = 0; i < NR_PROFILE_HIT; ++i) {
-- atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
-+ atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
- hits[i].pc = hits[i].hits = 0;
- }
- out:
-@@ -426,7 +426,7 @@ void profile_hits(int type, void *__pc, unsigned int nr_hits)
- if (prof_on != type || !prof_buffer)
- return;
- pc = ((unsigned long)__pc - (unsigned long)_stext) >> prof_shift;
-- atomic_add(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
-+ atomic_add_unchecked(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
- }
- #endif /* !CONFIG_SMP */
- EXPORT_SYMBOL_GPL(profile_hits);
-@@ -517,7 +517,7 @@ read_profile(struct file *file, char __user *buf, size_t count, loff_t *ppos)
- return -EFAULT;
- buf++; p++; count--; read++;
- }
-- pnt = (char *)prof_buffer + p - sizeof(atomic_t);
-+ pnt = (char *)prof_buffer + p - sizeof(atomic_unchecked_t);
- if (copy_to_user(buf, (void *)pnt, count))
- return -EFAULT;
- read += count;
-@@ -548,7 +548,7 @@ static ssize_t write_profile(struct file *file, const char __user *buf,
- }
- #endif
- profile_discard_flip_buffers();
-- memset(prof_buffer, 0, prof_len * sizeof(atomic_t));
-+ memset(prof_buffer, 0, prof_len * sizeof(atomic_unchecked_t));
- return count;
- }
-
-diff --git a/kernel/ptrace.c b/kernel/ptrace.c
-index d9c8c47..5186770 100644
---- a/kernel/ptrace.c
-+++ b/kernel/ptrace.c
-@@ -155,7 +155,8 @@ int ptrace_check_attach(struct task_struct *child, int kill)
- return ret;
- }
-
--int __ptrace_may_access(struct task_struct *task, unsigned int mode)
-+static int __ptrace_may_access(struct task_struct *task, unsigned int mode,
-+ unsigned int log)
- {
- const struct cred *cred = current_cred(), *tcred;
-
-@@ -179,7 +180,9 @@ int __ptrace_may_access(struct task_struct *task, unsigned int mode)
- cred->gid != tcred->egid ||
- cred->gid != tcred->sgid ||
- cred->gid != tcred->gid) &&
-- !capable(CAP_SYS_PTRACE)) {
-+ ((!log && !capable_nolog(CAP_SYS_PTRACE)) ||
-+ (log && !capable(CAP_SYS_PTRACE)))
-+ ) {
- rcu_read_unlock();
- return -EPERM;
- }
-@@ -187,7 +190,9 @@ int __ptrace_may_access(struct task_struct *task, unsigned int mode)
- smp_rmb();
- if (task->mm)
- dumpable = get_dumpable(task->mm);
-- if (!dumpable && !capable(CAP_SYS_PTRACE))
-+ if (dumpable != SUID_DUMP_USER &&
-+ ((!log && !capable_nolog(CAP_SYS_PTRACE)) ||
-+ (log && !capable(CAP_SYS_PTRACE))))
- return -EPERM;
-
- return security_ptrace_access_check(task, mode);
-@@ -197,7 +202,16 @@ bool ptrace_may_access(struct task_struct *task, unsigned int mode)
- {
- int err;
- task_lock(task);
-- err = __ptrace_may_access(task, mode);
-+ err = __ptrace_may_access(task, mode, 0);
-+ task_unlock(task);
-+ return !err;
-+}
-+
-+bool ptrace_may_access_log(struct task_struct *task, unsigned int mode)
-+{
-+ int err;
-+ task_lock(task);
-+ err = __ptrace_may_access(task, mode, 1);
- task_unlock(task);
- return !err;
- }
-@@ -220,11 +234,11 @@ int ptrace_attach(struct task_struct *task)
- * under ptrace.
- */
- retval = -ERESTARTNOINTR;
-- if (mutex_lock_interruptible(&task->cred_guard_mutex))
-+ if (mutex_lock_interruptible(&task->signal->cred_guard_mutex))
- goto out;
-
- task_lock(task);
-- retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH);
-+ retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH, 1);
- task_unlock(task);
- if (retval)
- goto unlock_creds;
-@@ -237,7 +251,7 @@ int ptrace_attach(struct task_struct *task)
- goto unlock_tasklist;
-
- task->ptrace = PT_PTRACED;
-- if (capable(CAP_SYS_PTRACE))
-+ if (capable_nolog(CAP_SYS_PTRACE))
- task->ptrace |= PT_PTRACE_CAP;
-
- __ptrace_link(task, current);
-@@ -247,7 +261,7 @@ int ptrace_attach(struct task_struct *task)
- unlock_tasklist:
- write_unlock_irq(&tasklist_lock);
- unlock_creds:
-- mutex_unlock(&task->cred_guard_mutex);
-+ mutex_unlock(&task->signal->cred_guard_mutex);
- out:
- return retval;
- }
-@@ -389,6 +403,8 @@ int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __user *dst
- {
- int copied = 0;
-
-+ pax_track_stack();
-+
- while (len > 0) {
- char buf[128];
- int this_len, retval;
-@@ -414,6 +430,8 @@ int ptrace_writedata(struct task_struct *tsk, char __user *src, unsigned long ds
- {
- int copied = 0;
-
-+ pax_track_stack();
-+
- while (len > 0) {
- char buf[128];
- int this_len, retval;
-@@ -555,6 +573,8 @@ int ptrace_request(struct task_struct *child, long request,
- int ret = -EIO;
- siginfo_t siginfo;
-
-+ pax_track_stack();
-+
- switch (request) {
- case PTRACE_PEEKTEXT:
- case PTRACE_PEEKDATA:
-@@ -570,18 +590,18 @@ int ptrace_request(struct task_struct *child, long request,
- ret = ptrace_setoptions(child, data);
- break;
- case PTRACE_GETEVENTMSG:
-- ret = put_user(child->ptrace_message, (unsigned long __user *) data);
-+ ret = put_user(child->ptrace_message, (__force unsigned long __user *) data);
- break;
-
- case PTRACE_GETSIGINFO:
- ret = ptrace_getsiginfo(child, &siginfo);
- if (!ret)
-- ret = copy_siginfo_to_user((siginfo_t __user *) data,
-+ ret = copy_siginfo_to_user((__force siginfo_t __user *) data,
- &siginfo);
- break;
-
- case PTRACE_SETSIGINFO:
-- if (copy_from_user(&siginfo, (siginfo_t __user *) data,
-+ if (copy_from_user(&siginfo, (__force siginfo_t __user *) data,
- sizeof siginfo))
- ret = -EFAULT;
- else
-@@ -659,14 +679,21 @@ SYSCALL_DEFINE4(ptrace, long, request, long, pid, long, addr, long, data)
- goto out;
- }
-
-+ if (gr_handle_ptrace(child, request)) {
-+ ret = -EPERM;
-+ goto out_put_task_struct;
-+ }
-+
- if (request == PTRACE_ATTACH) {
- ret = ptrace_attach(child);
- /*
- * Some architectures need to do book-keeping after
- * a ptrace attach.
- */
-- if (!ret)
-+ if (!ret) {
- arch_ptrace_attach(child);
-+ gr_audit_ptrace(child);
-+ }
- goto out_put_task_struct;
- }
-
-@@ -693,7 +720,7 @@ int generic_ptrace_peekdata(struct task_struct *tsk, long addr, long data)
- copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
- if (copied != sizeof(tmp))
- return -EIO;
-- return put_user(tmp, (unsigned long __user *)data);
-+ return put_user(tmp, (__force unsigned long __user *)data);
- }
-
- int generic_ptrace_pokedata(struct task_struct *tsk, long addr, long data)
-@@ -715,6 +742,8 @@ int compat_ptrace_request(struct task_struct *child, compat_long_t request,
- siginfo_t siginfo;
- int ret;
-
-+ pax_track_stack();
-+
- switch (request) {
- case PTRACE_PEEKTEXT:
- case PTRACE_PEEKDATA:
-@@ -760,7 +789,7 @@ int compat_ptrace_request(struct task_struct *child, compat_long_t request,
- }
-
- asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
-- compat_long_t addr, compat_long_t data)
-+ compat_ulong_t addr, compat_ulong_t data)
- {
- struct task_struct *child;
- long ret;
-@@ -780,14 +809,21 @@ asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
- goto out;
- }
-
-+ if (gr_handle_ptrace(child, request)) {
-+ ret = -EPERM;
-+ goto out_put_task_struct;
-+ }
-+
- if (request == PTRACE_ATTACH) {
- ret = ptrace_attach(child);
- /*
- * Some architectures need to do book-keeping after
- * a ptrace attach.
- */
-- if (!ret)
-+ if (!ret) {
- arch_ptrace_attach(child);
-+ gr_audit_ptrace(child);
-+ }
- goto out_put_task_struct;
- }
-
-diff --git a/kernel/rcutorture.c b/kernel/rcutorture.c
-index 697c0a0..2402696 100644
---- a/kernel/rcutorture.c
-+++ b/kernel/rcutorture.c
-@@ -118,12 +118,12 @@ static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_count) =
- { 0 };
- static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_batch) =
- { 0 };
--static atomic_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
--static atomic_t n_rcu_torture_alloc;
--static atomic_t n_rcu_torture_alloc_fail;
--static atomic_t n_rcu_torture_free;
--static atomic_t n_rcu_torture_mberror;
--static atomic_t n_rcu_torture_error;
-+static atomic_unchecked_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
-+static atomic_unchecked_t n_rcu_torture_alloc;
-+static atomic_unchecked_t n_rcu_torture_alloc_fail;
-+static atomic_unchecked_t n_rcu_torture_free;
-+static atomic_unchecked_t n_rcu_torture_mberror;
-+static atomic_unchecked_t n_rcu_torture_error;
- static long n_rcu_torture_timers;
- static struct list_head rcu_torture_removed;
- static cpumask_var_t shuffle_tmp_mask;
-@@ -187,11 +187,11 @@ rcu_torture_alloc(void)
-
- spin_lock_bh(&rcu_torture_lock);
- if (list_empty(&rcu_torture_freelist)) {
-- atomic_inc(&n_rcu_torture_alloc_fail);
-+ atomic_inc_unchecked(&n_rcu_torture_alloc_fail);
- spin_unlock_bh(&rcu_torture_lock);
- return NULL;
- }
-- atomic_inc(&n_rcu_torture_alloc);
-+ atomic_inc_unchecked(&n_rcu_torture_alloc);
- p = rcu_torture_freelist.next;
- list_del_init(p);
- spin_unlock_bh(&rcu_torture_lock);
-@@ -204,7 +204,7 @@ rcu_torture_alloc(void)
- static void
- rcu_torture_free(struct rcu_torture *p)
- {
-- atomic_inc(&n_rcu_torture_free);
-+ atomic_inc_unchecked(&n_rcu_torture_free);
- spin_lock_bh(&rcu_torture_lock);
- list_add_tail(&p->rtort_free, &rcu_torture_freelist);
- spin_unlock_bh(&rcu_torture_lock);
-@@ -319,7 +319,7 @@ rcu_torture_cb(struct rcu_head *p)
- i = rp->rtort_pipe_count;
- if (i > RCU_TORTURE_PIPE_LEN)
- i = RCU_TORTURE_PIPE_LEN;
-- atomic_inc(&rcu_torture_wcount[i]);
-+ atomic_inc_unchecked(&rcu_torture_wcount[i]);
- if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
- rp->rtort_mbtest = 0;
- rcu_torture_free(rp);
-@@ -359,7 +359,7 @@ static void rcu_sync_torture_deferred_free(struct rcu_torture *p)
- i = rp->rtort_pipe_count;
- if (i > RCU_TORTURE_PIPE_LEN)
- i = RCU_TORTURE_PIPE_LEN;
-- atomic_inc(&rcu_torture_wcount[i]);
-+ atomic_inc_unchecked(&rcu_torture_wcount[i]);
- if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
- rp->rtort_mbtest = 0;
- list_del(&rp->rtort_free);
-@@ -653,7 +653,7 @@ rcu_torture_writer(void *arg)
- i = old_rp->rtort_pipe_count;
- if (i > RCU_TORTURE_PIPE_LEN)
- i = RCU_TORTURE_PIPE_LEN;
-- atomic_inc(&rcu_torture_wcount[i]);
-+ atomic_inc_unchecked(&rcu_torture_wcount[i]);
- old_rp->rtort_pipe_count++;
- cur_ops->deferred_free(old_rp);
- }
-@@ -718,7 +718,7 @@ static void rcu_torture_timer(unsigned long unused)
- return;
- }
- if (p->rtort_mbtest == 0)
-- atomic_inc(&n_rcu_torture_mberror);
-+ atomic_inc_unchecked(&n_rcu_torture_mberror);
- spin_lock(&rand_lock);
- cur_ops->read_delay(&rand);
- n_rcu_torture_timers++;
-@@ -776,7 +776,7 @@ rcu_torture_reader(void *arg)
- continue;
- }
- if (p->rtort_mbtest == 0)
-- atomic_inc(&n_rcu_torture_mberror);
-+ atomic_inc_unchecked(&n_rcu_torture_mberror);
- cur_ops->read_delay(&rand);
- preempt_disable();
- pipe_count = p->rtort_pipe_count;
-@@ -834,17 +834,17 @@ rcu_torture_printk(char *page)
- rcu_torture_current,
- rcu_torture_current_version,
- list_empty(&rcu_torture_freelist),
-- atomic_read(&n_rcu_torture_alloc),
-- atomic_read(&n_rcu_torture_alloc_fail),
-- atomic_read(&n_rcu_torture_free),
-- atomic_read(&n_rcu_torture_mberror),
-+ atomic_read_unchecked(&n_rcu_torture_alloc),
-+ atomic_read_unchecked(&n_rcu_torture_alloc_fail),
-+ atomic_read_unchecked(&n_rcu_torture_free),
-+ atomic_read_unchecked(&n_rcu_torture_mberror),
- n_rcu_torture_timers);
-- if (atomic_read(&n_rcu_torture_mberror) != 0)
-+ if (atomic_read_unchecked(&n_rcu_torture_mberror) != 0)
- cnt += sprintf(&page[cnt], " !!!");
- cnt += sprintf(&page[cnt], "\n%s%s ", torture_type, TORTURE_FLAG);
- if (i > 1) {
- cnt += sprintf(&page[cnt], "!!! ");
-- atomic_inc(&n_rcu_torture_error);
-+ atomic_inc_unchecked(&n_rcu_torture_error);
- WARN_ON_ONCE(1);
- }
- cnt += sprintf(&page[cnt], "Reader Pipe: ");
-@@ -858,7 +858,7 @@ rcu_torture_printk(char *page)
- cnt += sprintf(&page[cnt], "Free-Block Circulation: ");
- for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
- cnt += sprintf(&page[cnt], " %d",
-- atomic_read(&rcu_torture_wcount[i]));
-+ atomic_read_unchecked(&rcu_torture_wcount[i]));
- }
- cnt += sprintf(&page[cnt], "\n");
- if (cur_ops->stats)
-@@ -1084,7 +1084,7 @@ rcu_torture_cleanup(void)
-
- if (cur_ops->cleanup)
- cur_ops->cleanup();
-- if (atomic_read(&n_rcu_torture_error))
-+ if (atomic_read_unchecked(&n_rcu_torture_error))
- rcu_torture_print_module_parms("End of test: FAILURE");
- else
- rcu_torture_print_module_parms("End of test: SUCCESS");
-@@ -1138,13 +1138,13 @@ rcu_torture_init(void)
-
- rcu_torture_current = NULL;
- rcu_torture_current_version = 0;
-- atomic_set(&n_rcu_torture_alloc, 0);
-- atomic_set(&n_rcu_torture_alloc_fail, 0);
-- atomic_set(&n_rcu_torture_free, 0);
-- atomic_set(&n_rcu_torture_mberror, 0);
-- atomic_set(&n_rcu_torture_error, 0);
-+ atomic_set_unchecked(&n_rcu_torture_alloc, 0);
-+ atomic_set_unchecked(&n_rcu_torture_alloc_fail, 0);
-+ atomic_set_unchecked(&n_rcu_torture_free, 0);
-+ atomic_set_unchecked(&n_rcu_torture_mberror, 0);
-+ atomic_set_unchecked(&n_rcu_torture_error, 0);
- for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++)
-- atomic_set(&rcu_torture_wcount[i], 0);
-+ atomic_set_unchecked(&rcu_torture_wcount[i], 0);
- for_each_possible_cpu(cpu) {
- for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
- per_cpu(rcu_torture_count, cpu)[i] = 0;
-diff --git a/kernel/rcutree.c b/kernel/rcutree.c
-index 683c4f3..97f54c6 100644
---- a/kernel/rcutree.c
-+++ b/kernel/rcutree.c
-@@ -1303,7 +1303,7 @@ __rcu_process_callbacks(struct rcu_state *rsp, struct rcu_data *rdp)
- /*
- * Do softirq processing for the current CPU.
- */
--static void rcu_process_callbacks(struct softirq_action *unused)
-+static void rcu_process_callbacks(void)
- {
- /*
- * Memory references from any prior RCU read-side critical sections
-diff --git a/kernel/rcutree_plugin.h b/kernel/rcutree_plugin.h
-index c03edf7..ac1b341 100644
---- a/kernel/rcutree_plugin.h
-+++ b/kernel/rcutree_plugin.h
-@@ -145,7 +145,7 @@ static void rcu_preempt_note_context_switch(int cpu)
- */
- void __rcu_read_lock(void)
- {
-- ACCESS_ONCE(current->rcu_read_lock_nesting)++;
-+ ACCESS_ONCE_RW(current->rcu_read_lock_nesting)++;
- barrier(); /* needed if we ever invoke rcu_read_lock in rcutree.c */
- }
- EXPORT_SYMBOL_GPL(__rcu_read_lock);
-@@ -251,7 +251,7 @@ void __rcu_read_unlock(void)
- struct task_struct *t = current;
-
- barrier(); /* needed if we ever invoke rcu_read_unlock in rcutree.c */
-- if (--ACCESS_ONCE(t->rcu_read_lock_nesting) == 0 &&
-+ if (--ACCESS_ONCE_RW(t->rcu_read_lock_nesting) == 0 &&
- unlikely(ACCESS_ONCE(t->rcu_read_unlock_special)))
- rcu_read_unlock_special(t);
- }
-diff --git a/kernel/relay.c b/kernel/relay.c
-index bf343f5..908e9ee 100644
---- a/kernel/relay.c
-+++ b/kernel/relay.c
-@@ -1228,7 +1228,7 @@ static int subbuf_splice_actor(struct file *in,
- unsigned int flags,
- int *nonpad_ret)
- {
-- unsigned int pidx, poff, total_len, subbuf_pages, nr_pages, ret;
-+ unsigned int pidx, poff, total_len, subbuf_pages, nr_pages;
- struct rchan_buf *rbuf = in->private_data;
- unsigned int subbuf_size = rbuf->chan->subbuf_size;
- uint64_t pos = (uint64_t) *ppos;
-@@ -1247,6 +1247,9 @@ static int subbuf_splice_actor(struct file *in,
- .ops = &relay_pipe_buf_ops,
- .spd_release = relay_page_release,
- };
-+ ssize_t ret;
-+
-+ pax_track_stack();
-
- if (rbuf->subbufs_produced == rbuf->subbufs_consumed)
- return 0;
-diff --git a/kernel/resource.c b/kernel/resource.c
-index 207915a..ab64869 100644
---- a/kernel/resource.c
-+++ b/kernel/resource.c
-@@ -132,8 +132,18 @@ static const struct file_operations proc_iomem_operations = {
-
- static int __init ioresources_init(void)
- {
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+ proc_create("ioports", S_IRUSR, NULL, &proc_ioports_operations);
-+ proc_create("iomem", S_IRUSR, NULL, &proc_iomem_operations);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ proc_create("ioports", S_IRUSR | S_IRGRP, NULL, &proc_ioports_operations);
-+ proc_create("iomem", S_IRUSR | S_IRGRP, NULL, &proc_iomem_operations);
-+#endif
-+#else
- proc_create("ioports", 0, NULL, &proc_ioports_operations);
- proc_create("iomem", 0, NULL, &proc_iomem_operations);
-+#endif
- return 0;
- }
- __initcall(ioresources_init);
-diff --git a/kernel/rtmutex-tester.c b/kernel/rtmutex-tester.c
-index a56f629..1fc4989 100644
---- a/kernel/rtmutex-tester.c
-+++ b/kernel/rtmutex-tester.c
-@@ -21,7 +21,7 @@
- #define MAX_RT_TEST_MUTEXES 8
-
- static spinlock_t rttest_lock;
--static atomic_t rttest_event;
-+static atomic_unchecked_t rttest_event;
-
- struct test_thread_data {
- int opcode;
-@@ -64,7 +64,7 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
-
- case RTTEST_LOCKCONT:
- td->mutexes[td->opdata] = 1;
-- td->event = atomic_add_return(1, &rttest_event);
-+ td->event = atomic_add_return_unchecked(1, &rttest_event);
- return 0;
-
- case RTTEST_RESET:
-@@ -82,7 +82,7 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
- return 0;
-
- case RTTEST_RESETEVENT:
-- atomic_set(&rttest_event, 0);
-+ atomic_set_unchecked(&rttest_event, 0);
- return 0;
-
- default:
-@@ -99,9 +99,9 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
- return ret;
-
- td->mutexes[id] = 1;
-- td->event = atomic_add_return(1, &rttest_event);
-+ td->event = atomic_add_return_unchecked(1, &rttest_event);
- rt_mutex_lock(&mutexes[id]);
-- td->event = atomic_add_return(1, &rttest_event);
-+ td->event = atomic_add_return_unchecked(1, &rttest_event);
- td->mutexes[id] = 4;
- return 0;
-
-@@ -112,9 +112,9 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
- return ret;
-
- td->mutexes[id] = 1;
-- td->event = atomic_add_return(1, &rttest_event);
-+ td->event = atomic_add_return_unchecked(1, &rttest_event);
- ret = rt_mutex_lock_interruptible(&mutexes[id], 0);
-- td->event = atomic_add_return(1, &rttest_event);
-+ td->event = atomic_add_return_unchecked(1, &rttest_event);
- td->mutexes[id] = ret ? 0 : 4;
- return ret ? -EINTR : 0;
-
-@@ -123,9 +123,9 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
- if (id < 0 || id >= MAX_RT_TEST_MUTEXES || td->mutexes[id] != 4)
- return ret;
-
-- td->event = atomic_add_return(1, &rttest_event);
-+ td->event = atomic_add_return_unchecked(1, &rttest_event);
- rt_mutex_unlock(&mutexes[id]);
-- td->event = atomic_add_return(1, &rttest_event);
-+ td->event = atomic_add_return_unchecked(1, &rttest_event);
- td->mutexes[id] = 0;
- return 0;
-
-@@ -187,7 +187,7 @@ void schedule_rt_mutex_test(struct rt_mutex *mutex)
- break;
-
- td->mutexes[dat] = 2;
-- td->event = atomic_add_return(1, &rttest_event);
-+ td->event = atomic_add_return_unchecked(1, &rttest_event);
- break;
-
- case RTTEST_LOCKBKL:
-@@ -208,7 +208,7 @@ void schedule_rt_mutex_test(struct rt_mutex *mutex)
- return;
-
- td->mutexes[dat] = 3;
-- td->event = atomic_add_return(1, &rttest_event);
-+ td->event = atomic_add_return_unchecked(1, &rttest_event);
- break;
-
- case RTTEST_LOCKNOWAIT:
-@@ -220,7 +220,7 @@ void schedule_rt_mutex_test(struct rt_mutex *mutex)
- return;
-
- td->mutexes[dat] = 1;
-- td->event = atomic_add_return(1, &rttest_event);
-+ td->event = atomic_add_return_unchecked(1, &rttest_event);
- return;
-
- case RTTEST_LOCKBKL:
-diff --git a/kernel/rtmutex.c b/kernel/rtmutex.c
-index 29bd4ba..8c5de90 100644
---- a/kernel/rtmutex.c
-+++ b/kernel/rtmutex.c
-@@ -511,7 +511,7 @@ static void wakeup_next_waiter(struct rt_mutex *lock)
- */
- spin_lock_irqsave(&pendowner->pi_lock, flags);
-
-- WARN_ON(!pendowner->pi_blocked_on);
-+ BUG_ON(!pendowner->pi_blocked_on);
- WARN_ON(pendowner->pi_blocked_on != waiter);
- WARN_ON(pendowner->pi_blocked_on->lock != lock);
-
-diff --git a/kernel/sched.c b/kernel/sched.c
-index 42bf6a6..dcf3f9f 100644
---- a/kernel/sched.c
-+++ b/kernel/sched.c
-@@ -5044,7 +5044,7 @@ out:
- * In CONFIG_NO_HZ case, the idle load balance owner will do the
- * rebalancing for all the cpus for whom scheduler ticks are stopped.
- */
--static void run_rebalance_domains(struct softirq_action *h)
-+static void run_rebalance_domains(void)
- {
- int this_cpu = smp_processor_id();
- struct rq *this_rq = cpu_rq(this_cpu);
-@@ -5701,6 +5701,8 @@ asmlinkage void __sched schedule(void)
- struct rq *rq;
- int cpu;
-
-+ pax_track_stack();
-+
- need_resched:
- preempt_disable();
- cpu = smp_processor_id();
-@@ -5771,7 +5773,7 @@ EXPORT_SYMBOL(schedule);
- * Look out! "owner" is an entirely speculative pointer
- * access and not reliable.
- */
--int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner)
-+int mutex_spin_on_owner(struct mutex *lock, struct task_struct *owner)
- {
- unsigned int cpu;
- struct rq *rq;
-@@ -5785,10 +5787,10 @@ int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner)
- * DEBUG_PAGEALLOC could have unmapped it if
- * the mutex owner just released it and exited.
- */
-- if (probe_kernel_address(&owner->cpu, cpu))
-+ if (probe_kernel_address(&task_thread_info(owner)->cpu, cpu))
- return 0;
- #else
-- cpu = owner->cpu;
-+ cpu = task_thread_info(owner)->cpu;
- #endif
-
- /*
-@@ -5817,7 +5819,7 @@ int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner)
- /*
- * Is that owner really running on that cpu?
- */
-- if (task_thread_info(rq->curr) != owner || need_resched())
-+ if (rq->curr != owner || need_resched())
- return 0;
-
- cpu_relax();
-@@ -6360,6 +6362,8 @@ int can_nice(const struct task_struct *p, const int nice)
- /* convert nice value [19,-20] to rlimit style value [1,40] */
- int nice_rlim = 20 - nice;
-
-+ gr_learn_resource(p, RLIMIT_NICE, nice_rlim, 1);
-+
- return (nice_rlim <= p->signal->rlim[RLIMIT_NICE].rlim_cur ||
- capable(CAP_SYS_NICE));
- }
-@@ -6393,7 +6397,8 @@ SYSCALL_DEFINE1(nice, int, increment)
- if (nice > 19)
- nice = 19;
-
-- if (increment < 0 && !can_nice(current, nice))
-+ if (increment < 0 && (!can_nice(current, nice) ||
-+ gr_handle_chroot_nice()))
- return -EPERM;
-
- retval = security_task_setnice(current, nice);
-@@ -8775,7 +8780,7 @@ static void init_sched_groups_power(int cpu, struct sched_domain *sd)
- long power;
- int weight;
-
-- WARN_ON(!sd || !sd->groups);
-+ BUG_ON(!sd || !sd->groups);
-
- if (cpu != group_first_cpu(sd->groups))
- return;
-diff --git a/kernel/signal.c b/kernel/signal.c
-index fb7e242..c97ee29 100644
---- a/kernel/signal.c
-+++ b/kernel/signal.c
-@@ -41,12 +41,12 @@
-
- static struct kmem_cache *sigqueue_cachep;
-
--static void __user *sig_handler(struct task_struct *t, int sig)
-+static __sighandler_t sig_handler(struct task_struct *t, int sig)
- {
- return t->sighand->action[sig - 1].sa.sa_handler;
- }
-
--static int sig_handler_ignored(void __user *handler, int sig)
-+static int sig_handler_ignored(__sighandler_t handler, int sig)
- {
- /* Is it explicitly or implicitly ignored? */
- return handler == SIG_IGN ||
-@@ -56,7 +56,7 @@ static int sig_handler_ignored(void __user *handler, int sig)
- static int sig_task_ignored(struct task_struct *t, int sig,
- int from_ancestor_ns)
- {
-- void __user *handler;
-+ __sighandler_t handler;
-
- handler = sig_handler(t, sig);
-
-@@ -207,6 +207,9 @@ static struct sigqueue *__sigqueue_alloc(struct task_struct *t, gfp_t flags,
- */
- user = get_uid(__task_cred(t)->user);
- atomic_inc(&user->sigpending);
-+
-+ if (!override_rlimit)
-+ gr_learn_resource(t, RLIMIT_SIGPENDING, atomic_read(&user->sigpending), 1);
- if (override_rlimit ||
- atomic_read(&user->sigpending) <=
- t->signal->rlim[RLIMIT_SIGPENDING].rlim_cur)
-@@ -330,7 +333,7 @@ flush_signal_handlers(struct task_struct *t, int force_default)
-
- int unhandled_signal(struct task_struct *tsk, int sig)
- {
-- void __user *handler = tsk->sighand->action[sig-1].sa.sa_handler;
-+ __sighandler_t handler = tsk->sighand->action[sig-1].sa.sa_handler;
- if (is_global_init(tsk))
- return 1;
- if (handler != SIG_IGN && handler != SIG_DFL)
-@@ -624,6 +627,13 @@ static int check_kill_permission(int sig, struct siginfo *info,
- }
- }
-
-+ /* allow glibc communication via tgkill to other threads in our
-+ thread group */
-+ if ((info == SEND_SIG_NOINFO || info->si_code != SI_TKILL ||
-+ sig != (SIGRTMIN+1) || task_tgid_vnr(t) != info->si_pid)
-+ && gr_handle_signal(t, sig))
-+ return -EPERM;
-+
- return security_task_kill(t, info, sig, 0);
- }
-
-@@ -965,7 +975,7 @@ __group_send_sig_info(int sig, struct siginfo *info, struct task_struct *p)
- return send_signal(sig, info, p, 1);
- }
-
--static int
-+int
- specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t)
- {
- return send_signal(sig, info, t, 0);
-@@ -1002,6 +1012,7 @@ force_sig_info(int sig, struct siginfo *info, struct task_struct *t)
- unsigned long int flags;
- int ret, blocked, ignored;
- struct k_sigaction *action;
-+ int is_unhandled = 0;
-
- spin_lock_irqsave(&t->sighand->siglock, flags);
- action = &t->sighand->action[sig-1];
-@@ -1016,9 +1027,18 @@ force_sig_info(int sig, struct siginfo *info, struct task_struct *t)
- }
- if (action->sa.sa_handler == SIG_DFL)
- t->signal->flags &= ~SIGNAL_UNKILLABLE;
-+ if (action->sa.sa_handler == SIG_IGN || action->sa.sa_handler == SIG_DFL)
-+ is_unhandled = 1;
- ret = specific_send_sig_info(sig, info, t);
- spin_unlock_irqrestore(&t->sighand->siglock, flags);
-
-+ /* only deal with unhandled signals, java etc trigger SIGSEGV during
-+ normal operation */
-+ if (is_unhandled) {
-+ gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, t);
-+ gr_handle_crash(t, sig);
-+ }
-+
- return ret;
- }
-
-@@ -1078,8 +1098,11 @@ int group_send_sig_info(int sig, struct siginfo *info, struct task_struct *p)
- {
- int ret = check_kill_permission(sig, info, p);
-
-- if (!ret && sig)
-+ if (!ret && sig) {
- ret = do_send_sig_info(sig, info, p, true);
-+ if (!ret)
-+ gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, p);
-+ }
-
- return ret;
- }
-@@ -1612,6 +1635,8 @@ static void ptrace_stop(int exit_code, int clear_code, siginfo_t *info)
- * By the time we got the lock, our tracer went away.
- * Don't drop the lock yet, another tracer may come.
- */
-+
-+ /* tasklist protects us from ptrace_freeze_traced() */
- __set_current_state(TASK_RUNNING);
- if (clear_code)
- current->exit_code = 0;
-@@ -1645,6 +1670,8 @@ void ptrace_notify(int exit_code)
- {
- siginfo_t info;
-
-+ pax_track_stack();
-+
- BUG_ON((exit_code & (0x7f | ~0xffff)) != SIGTRAP);
-
- memset(&info, 0, sizeof info);
-@@ -2276,7 +2303,15 @@ do_send_specific(pid_t tgid, pid_t pid, int sig, struct siginfo *info)
- int error = -ESRCH;
-
- rcu_read_lock();
-- p = find_task_by_vpid(pid);
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
-+ /* allow glibc communication via tgkill to other threads in our
-+ thread group */
-+ if (grsec_enable_chroot_findtask && info->si_code == SI_TKILL &&
-+ sig == (SIGRTMIN+1) && tgid == info->si_pid)
-+ p = find_task_by_vpid_unrestricted(pid);
-+ else
-+#endif
-+ p = find_task_by_vpid(pid);
- if (p && (tgid <= 0 || task_tgid_vnr(p) == tgid)) {
- error = check_kill_permission(sig, info, p);
- /*
-diff --git a/kernel/smp.c b/kernel/smp.c
-index aa9cff3..631a0de 100644
---- a/kernel/smp.c
-+++ b/kernel/smp.c
-@@ -522,22 +522,22 @@ int smp_call_function(void (*func)(void *), void *info, int wait)
- }
- EXPORT_SYMBOL(smp_call_function);
-
--void ipi_call_lock(void)
-+void ipi_call_lock(void) __acquires(call_function.lock)
- {
- spin_lock(&call_function.lock);
- }
-
--void ipi_call_unlock(void)
-+void ipi_call_unlock(void) __releases(call_function.lock)
- {
- spin_unlock(&call_function.lock);
- }
-
--void ipi_call_lock_irq(void)
-+void ipi_call_lock_irq(void) __acquires(call_function.lock)
- {
- spin_lock_irq(&call_function.lock);
- }
-
--void ipi_call_unlock_irq(void)
-+void ipi_call_unlock_irq(void) __releases(call_function.lock)
- {
- spin_unlock_irq(&call_function.lock);
- }
-diff --git a/kernel/softirq.c b/kernel/softirq.c
-index d75c136..d935240 100644
---- a/kernel/softirq.c
-+++ b/kernel/softirq.c
-@@ -52,11 +52,11 @@ irq_cpustat_t irq_stat[NR_CPUS] ____cacheline_aligned;
- EXPORT_SYMBOL(irq_stat);
- #endif
-
--static struct softirq_action softirq_vec[NR_SOFTIRQS] __cacheline_aligned_in_smp;
-+static struct softirq_action softirq_vec[NR_SOFTIRQS] __read_only __aligned(PAGE_SIZE);
-
- static DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
-
--char *softirq_to_name[NR_SOFTIRQS] = {
-+const char * const softirq_to_name[NR_SOFTIRQS] = {
- "HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL",
- "TASKLET", "SCHED", "HRTIMER", "RCU"
- };
-@@ -206,7 +206,7 @@ EXPORT_SYMBOL(local_bh_enable_ip);
-
- asmlinkage void __do_softirq(void)
- {
-- struct softirq_action *h;
-+ const struct softirq_action *h;
- __u32 pending;
- unsigned long end = jiffies + MAX_SOFTIRQ_TIME;
- int cpu;
-@@ -233,7 +233,7 @@ restart:
- kstat_incr_softirqs_this_cpu(h - softirq_vec);
-
- trace_softirq_entry(h, softirq_vec);
-- h->action(h);
-+ h->action();
- trace_softirq_exit(h, softirq_vec);
- if (unlikely(prev_count != preempt_count())) {
- printk(KERN_ERR "huh, entered softirq %td %s %p"
-@@ -364,7 +364,7 @@ void raise_softirq(unsigned int nr)
- local_irq_restore(flags);
- }
-
--void open_softirq(int nr, void (*action)(struct softirq_action *))
-+void open_softirq(int nr, void (*action)(void))
- {
- softirq_vec[nr].action = action;
- }
-@@ -420,7 +420,7 @@ void __tasklet_hi_schedule_first(struct tasklet_struct *t)
-
- EXPORT_SYMBOL(__tasklet_hi_schedule_first);
-
--static void tasklet_action(struct softirq_action *a)
-+static void tasklet_action(void)
- {
- struct tasklet_struct *list;
-
-@@ -455,7 +455,7 @@ static void tasklet_action(struct softirq_action *a)
- }
- }
-
--static void tasklet_hi_action(struct softirq_action *a)
-+static void tasklet_hi_action(void)
- {
- struct tasklet_struct *list;
-
-diff --git a/kernel/sys.c b/kernel/sys.c
-index 5a381e6..5d65044 100644
---- a/kernel/sys.c
-+++ b/kernel/sys.c
-@@ -133,6 +133,12 @@ static int set_one_prio(struct task_struct *p, int niceval, int error)
- error = -EACCES;
- goto out;
- }
-+
-+ if (gr_handle_chroot_setpriority(p, niceval)) {
-+ error = -EACCES;
-+ goto out;
-+ }
-+
- no_nice = security_task_setnice(p, niceval);
- if (no_nice) {
- error = no_nice;
-@@ -190,10 +196,10 @@ SYSCALL_DEFINE3(setpriority, int, which, int, who, int, niceval)
- !(user = find_user(who)))
- goto out_unlock; /* No processes for this user */
-
-- do_each_thread(g, p)
-+ do_each_thread(g, p) {
- if (__task_cred(p)->uid == who)
- error = set_one_prio(p, niceval, error);
-- while_each_thread(g, p);
-+ } while_each_thread(g, p);
- if (who != cred->uid)
- free_uid(user); /* For find_user() */
- break;
-@@ -253,13 +259,13 @@ SYSCALL_DEFINE2(getpriority, int, which, int, who)
- !(user = find_user(who)))
- goto out_unlock; /* No processes for this user */
-
-- do_each_thread(g, p)
-+ do_each_thread(g, p) {
- if (__task_cred(p)->uid == who) {
- niceval = 20 - task_nice(p);
- if (niceval > retval)
- retval = niceval;
- }
-- while_each_thread(g, p);
-+ } while_each_thread(g, p);
- if (who != cred->uid)
- free_uid(user); /* for find_user() */
- break;
-@@ -510,6 +516,9 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, gid_t, egid)
- goto error;
- }
-
-+ if (gr_check_group_change(new->gid, new->egid, -1))
-+ goto error;
-+
- if (rgid != (gid_t) -1 ||
- (egid != (gid_t) -1 && egid != old->gid))
- new->sgid = new->egid;
-@@ -543,6 +552,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
- goto error;
-
- retval = -EPERM;
-+
-+ if (gr_check_group_change(gid, gid, gid))
-+ goto error;
-+
- if (capable(CAP_SETGID))
- new->gid = new->egid = new->sgid = new->fsgid = gid;
- else if (gid == old->gid || gid == old->sgid)
-@@ -560,7 +573,7 @@ error:
- /*
- * change the user struct in a credentials set to match the new UID
- */
--static int set_user(struct cred *new)
-+int set_user(struct cred *new)
- {
- struct user_struct *new_user;
-
-@@ -568,12 +581,19 @@ static int set_user(struct cred *new)
- if (!new_user)
- return -EAGAIN;
-
-+ /*
-+ * We don't fail in case of NPROC limit excess here because too many
-+ * poorly written programs don't check set*uid() return code, assuming
-+ * it never fails if called by root. We may still enforce NPROC limit
-+ * for programs doing set*uid()+execve() by harmlessly deferring the
-+ * failure to the execve() stage.
-+ */
- if (atomic_read(&new_user->processes) >=
- current->signal->rlim[RLIMIT_NPROC].rlim_cur &&
-- new_user != INIT_USER) {
-- free_uid(new_user);
-- return -EAGAIN;
-- }
-+ new_user != INIT_USER)
-+ current->flags |= PF_NPROC_EXCEEDED;
-+ else
-+ current->flags &= ~PF_NPROC_EXCEEDED;
-
- free_uid(new->user);
- new->user = new_user;
-@@ -628,6 +648,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, uid_t, euid)
- goto error;
- }
-
-+ if (gr_check_user_change(new->uid, new->euid, -1))
-+ goto error;
-+
- if (new->uid != old->uid) {
- retval = set_user(new);
- if (retval < 0)
-@@ -676,6 +699,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
- goto error;
-
- retval = -EPERM;
-+
-+ if (gr_check_crash_uid(uid))
-+ goto error;
-+ if (gr_check_user_change(uid, uid, uid))
-+ goto error;
-+
- if (capable(CAP_SETUID)) {
- new->suid = new->uid = uid;
- if (uid != old->uid) {
-@@ -733,6 +762,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid, uid_t, euid, uid_t, suid)
- goto error;
- }
-
-+ if (gr_check_user_change(ruid, euid, -1))
-+ goto error;
-+
- if (ruid != (uid_t) -1) {
- new->uid = ruid;
- if (ruid != old->uid) {
-@@ -801,6 +833,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid, gid_t, egid, gid_t, sgid)
- goto error;
- }
-
-+ if (gr_check_group_change(rgid, egid, -1))
-+ goto error;
-+
- if (rgid != (gid_t) -1)
- new->gid = rgid;
- if (egid != (gid_t) -1)
-@@ -854,6 +889,9 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
- uid == old->suid || uid == old->fsuid ||
- capable(CAP_SETUID)) {
- if (uid != old_fsuid) {
-+ if (gr_check_user_change(-1, -1, uid))
-+ goto error;
-+
- new->fsuid = uid;
- if (security_task_fix_setuid(new, old, LSM_SETID_FS) == 0)
- goto change_okay;
-@@ -890,6 +928,9 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
- if (gid == old->gid || gid == old->egid ||
- gid == old->sgid || gid == old->fsgid ||
- capable(CAP_SETGID)) {
-+ if (gr_check_group_change(-1, -1, gid))
-+ goto error;
-+
- if (gid != old_fsgid) {
- new->fsgid = gid;
- goto change_okay;
-@@ -1274,6 +1315,14 @@ SYSCALL_DEFINE2(setrlimit, unsigned int, resource, struct rlimit __user *, rlim)
- if (resource != RLIMIT_CPU)
- goto out;
-
-+ /* Handle the case where a fork and setuid occur and then RLIMIT_NPROC
-+ is changed to a lower value. Since tasks can be created by the same
-+ user in between this limit change and an execve by this task, force
-+ a recheck only for this task by setting PF_NPROC_EXCEEDED
-+ */
-+ if (resource == RLIMIT_NPROC && current->real_cred->user != INIT_USER)
-+ current->flags |= PF_NPROC_EXCEEDED;
-+
- /*
- * RLIMIT_CPU handling. Note that the kernel fails to return an error
- * code if it rejected the user's attempt to set RLIMIT_CPU. This is a
-@@ -1283,7 +1332,7 @@ SYSCALL_DEFINE2(setrlimit, unsigned int, resource, struct rlimit __user *, rlim)
- if (new_rlim.rlim_cur == RLIM_INFINITY)
- goto out;
-
-- update_rlimit_cpu(new_rlim.rlim_cur);
-+ update_rlimit_cpu(current, new_rlim.rlim_cur);
- out:
- return 0;
- }
-@@ -1455,7 +1504,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
- error = get_dumpable(me->mm);
- break;
- case PR_SET_DUMPABLE:
-- if (arg2 < 0 || arg2 > 1) {
-+ if (arg2 > 1) {
- error = -EINVAL;
- break;
- }
-diff --git a/kernel/sysctl.c b/kernel/sysctl.c
-index b8bd058..0158df1 100644
---- a/kernel/sysctl.c
-+++ b/kernel/sysctl.c
-@@ -63,6 +63,13 @@
- static int deprecated_sysctl_warning(struct __sysctl_args *args);
-
- #if defined(CONFIG_SYSCTL)
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+extern __u32 gr_handle_sysctl(const ctl_table *table, const int op);
-+extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
-+ const int op);
-+extern int gr_handle_chroot_sysctl(const int op);
-
- /* External variables not in a header file. */
- extern int C_A_D;
-@@ -168,6 +175,7 @@ static int proc_do_cad_pid(struct ctl_table *table, int write,
- static int proc_taint(struct ctl_table *table, int write,
- void __user *buffer, size_t *lenp, loff_t *ppos);
- #endif
-+extern ctl_table grsecurity_table[];
-
- static struct ctl_table root_table[];
- static struct ctl_table_root sysctl_table_root;
-@@ -200,6 +208,21 @@ extern struct ctl_table epoll_table[];
- int sysctl_legacy_va_layout;
- #endif
-
-+#ifdef CONFIG_PAX_SOFTMODE
-+static ctl_table pax_table[] = {
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "softmode",
-+ .data = &pax_softmode,
-+ .maxlen = sizeof(unsigned int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+
-+ { .ctl_name = 0 }
-+};
-+#endif
-+
- extern int prove_locking;
- extern int lock_stat;
-
-@@ -251,6 +274,24 @@ static int max_wakeup_granularity_ns = NSEC_PER_SEC; /* 1 second */
- #endif
-
- static struct ctl_table kern_table[] = {
-+#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "grsecurity",
-+ .mode = 0500,
-+ .child = grsecurity_table,
-+ },
-+#endif
-+
-+#ifdef CONFIG_PAX_SOFTMODE
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "pax",
-+ .mode = 0500,
-+ .child = pax_table,
-+ },
-+#endif
-+
- {
- .ctl_name = CTL_UNNUMBERED,
- .procname = "sched_child_runs_first",
-@@ -567,8 +608,8 @@ static struct ctl_table kern_table[] = {
- .data = &modprobe_path,
- .maxlen = KMOD_PATH_LEN,
- .mode = 0644,
-- .proc_handler = &proc_dostring,
-- .strategy = &sysctl_string,
-+ .proc_handler = &proc_dostring_modpriv,
-+ .strategy = &sysctl_string_modpriv,
- },
- {
- .ctl_name = CTL_UNNUMBERED,
-@@ -1247,6 +1288,13 @@ static struct ctl_table vm_table[] = {
- .mode = 0644,
- .proc_handler = &proc_dointvec
- },
-+ {
-+ .procname = "heap_stack_gap",
-+ .data = &sysctl_heap_stack_gap,
-+ .maxlen = sizeof(sysctl_heap_stack_gap),
-+ .mode = 0644,
-+ .proc_handler = proc_doulongvec_minmax,
-+ },
- #else
- {
- .ctl_name = CTL_UNNUMBERED,
-@@ -1803,6 +1851,8 @@ static int do_sysctl_strategy(struct ctl_table_root *root,
- return 0;
- }
-
-+static int sysctl_perm_nochk(struct ctl_table_root *root, struct ctl_table *table, int op);
-+
- static int parse_table(int __user *name, int nlen,
- void __user *oldval, size_t __user *oldlenp,
- void __user *newval, size_t newlen,
-@@ -1821,7 +1871,7 @@ repeat:
- if (n == table->ctl_name) {
- int error;
- if (table->child) {
-- if (sysctl_perm(root, table, MAY_EXEC))
-+ if (sysctl_perm_nochk(root, table, MAY_EXEC))
- return -EPERM;
- name++;
- nlen--;
-@@ -1906,6 +1956,36 @@ int sysctl_perm(struct ctl_table_root *root, struct ctl_table *table, int op)
- int error;
- int mode;
-
-+ if (table->parent != NULL && table->parent->procname != NULL &&
-+ table->procname != NULL &&
-+ gr_handle_sysctl_mod(table->parent->procname, table->procname, op))
-+ return -EACCES;
-+ if (gr_handle_chroot_sysctl(op))
-+ return -EACCES;
-+ if ((op & MAY_WRITE) && !capable(CAP_SYS_ADMIN))
-+ return -EPERM;
-+
-+ error = gr_handle_sysctl(table, op);
-+ if (error)
-+ return error;
-+
-+ error = security_sysctl(table, op & (MAY_READ | MAY_WRITE | MAY_EXEC));
-+ if (error)
-+ return error;
-+
-+ if (root->permissions)
-+ mode = root->permissions(root, current->nsproxy, table);
-+ else
-+ mode = table->mode;
-+
-+ return test_perm(mode, op);
-+}
-+
-+int sysctl_perm_nochk(struct ctl_table_root *root, struct ctl_table *table, int op)
-+{
-+ int error;
-+ int mode;
-+
- error = security_sysctl(table, op & (MAY_READ | MAY_WRITE | MAY_EXEC));
- if (error)
- return error;
-@@ -2335,6 +2415,16 @@ int proc_dostring(struct ctl_table *table, int write,
- buffer, lenp, ppos);
- }
-
-+int proc_dostring_modpriv(struct ctl_table *table, int write,
-+ void __user *buffer, size_t *lenp, loff_t *ppos)
-+{
-+ if (write && !capable(CAP_SYS_MODULE))
-+ return -EPERM;
-+
-+ return _proc_do_string(table->data, table->maxlen, write,
-+ buffer, lenp, ppos);
-+}
-+
-
- static int do_proc_dointvec_conv(int *negp, unsigned long *lvalp,
- int *valp,
-@@ -2609,7 +2699,7 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
- vleft = table->maxlen / sizeof(unsigned long);
- left = *lenp;
-
-- for (; left && vleft--; i++, min++, max++, first=0) {
-+ for (; left && vleft--; i++, first=0) {
- if (write) {
- while (left) {
- char c;
-@@ -2910,6 +3000,12 @@ int proc_dostring(struct ctl_table *table, int write,
- return -ENOSYS;
- }
-
-+int proc_dostring_modpriv(struct ctl_table *table, int write,
-+ void __user *buffer, size_t *lenp, loff_t *ppos)
-+{
-+ return -ENOSYS;
-+}
-+
- int proc_dointvec(struct ctl_table *table, int write,
- void __user *buffer, size_t *lenp, loff_t *ppos)
- {
-@@ -3038,6 +3134,16 @@ int sysctl_string(struct ctl_table *table,
- return 1;
- }
-
-+int sysctl_string_modpriv(struct ctl_table *table,
-+ void __user *oldval, size_t __user *oldlenp,
-+ void __user *newval, size_t newlen)
-+{
-+ if (newval && newlen && !capable(CAP_SYS_MODULE))
-+ return -EPERM;
-+
-+ return sysctl_string(table, oldval, oldlenp, newval, newlen);
-+}
-+
- /*
- * This function makes sure that all of the integers in the vector
- * are between the minimum and maximum values given in the arrays
-@@ -3182,6 +3288,13 @@ int sysctl_string(struct ctl_table *table,
- return -ENOSYS;
- }
-
-+int sysctl_string_modpriv(struct ctl_table *table,
-+ void __user *oldval, size_t __user *oldlenp,
-+ void __user *newval, size_t newlen)
-+{
-+ return -ENOSYS;
-+}
-+
- int sysctl_intvec(struct ctl_table *table,
- void __user *oldval, size_t __user *oldlenp,
- void __user *newval, size_t newlen)
-@@ -3246,6 +3359,7 @@ EXPORT_SYMBOL(proc_dointvec_minmax);
- EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
- EXPORT_SYMBOL(proc_dointvec_ms_jiffies);
- EXPORT_SYMBOL(proc_dostring);
-+EXPORT_SYMBOL(proc_dostring_modpriv);
- EXPORT_SYMBOL(proc_doulongvec_minmax);
- EXPORT_SYMBOL(proc_doulongvec_ms_jiffies_minmax);
- EXPORT_SYMBOL(register_sysctl_table);
-@@ -3254,5 +3368,6 @@ EXPORT_SYMBOL(sysctl_intvec);
- EXPORT_SYMBOL(sysctl_jiffies);
- EXPORT_SYMBOL(sysctl_ms_jiffies);
- EXPORT_SYMBOL(sysctl_string);
-+EXPORT_SYMBOL(sysctl_string_modpriv);
- EXPORT_SYMBOL(sysctl_data);
- EXPORT_SYMBOL(unregister_sysctl_table);
-diff --git a/kernel/sysctl_check.c b/kernel/sysctl_check.c
-index 469193c..ea3ecb2 100644
---- a/kernel/sysctl_check.c
-+++ b/kernel/sysctl_check.c
-@@ -1489,10 +1489,12 @@ int sysctl_check_table(struct nsproxy *namespaces, struct ctl_table *table)
- } else {
- if ((table->strategy == sysctl_data) ||
- (table->strategy == sysctl_string) ||
-+ (table->strategy == sysctl_string_modpriv) ||
- (table->strategy == sysctl_intvec) ||
- (table->strategy == sysctl_jiffies) ||
- (table->strategy == sysctl_ms_jiffies) ||
- (table->proc_handler == proc_dostring) ||
-+ (table->proc_handler == proc_dostring_modpriv) ||
- (table->proc_handler == proc_dointvec) ||
- (table->proc_handler == proc_dointvec_minmax) ||
- (table->proc_handler == proc_dointvec_jiffies) ||
-diff --git a/kernel/taskstats.c b/kernel/taskstats.c
-index a4ef542..798bcd7 100644
---- a/kernel/taskstats.c
-+++ b/kernel/taskstats.c
-@@ -26,9 +26,12 @@
- #include <linux/cgroup.h>
- #include <linux/fs.h>
- #include <linux/file.h>
-+#include <linux/grsecurity.h>
- #include <net/genetlink.h>
- #include <asm/atomic.h>
-
-+extern int gr_is_taskstats_denied(int pid);
-+
- /*
- * Maximum length of a cpumask that can be specified in
- * the TASKSTATS_CMD_ATTR_REGISTER/DEREGISTER_CPUMASK attribute
-@@ -442,6 +445,9 @@ static int taskstats_user_cmd(struct sk_buff *skb, struct genl_info *info)
- size_t size;
- cpumask_var_t mask;
-
-+ if (gr_is_taskstats_denied(current->pid))
-+ return -EACCES;
-+
- if (!alloc_cpumask_var(&mask, GFP_KERNEL))
- return -ENOMEM;
-
-diff --git a/kernel/time.c b/kernel/time.c
-index 33df60e..ca768bd 100644
---- a/kernel/time.c
-+++ b/kernel/time.c
-@@ -165,6 +165,11 @@ int do_sys_settimeofday(struct timespec *tv, struct timezone *tz)
- return error;
-
- if (tz) {
-+ /* we log in do_settimeofday called below, so don't log twice
-+ */
-+ if (!tv)
-+ gr_log_timechange();
-+
- /* SMP safe, global irq locking makes it work. */
- sys_tz = *tz;
- update_vsyscall_tz();
-@@ -240,7 +245,7 @@ EXPORT_SYMBOL(current_fs_time);
- * Avoid unnecessary multiplications/divisions in the
- * two most common HZ cases:
- */
--unsigned int inline jiffies_to_msecs(const unsigned long j)
-+inline unsigned int jiffies_to_msecs(const unsigned long j)
- {
- #if HZ <= MSEC_PER_SEC && !(MSEC_PER_SEC % HZ)
- return (MSEC_PER_SEC / HZ) * j;
-@@ -256,7 +261,7 @@ unsigned int inline jiffies_to_msecs(const unsigned long j)
- }
- EXPORT_SYMBOL(jiffies_to_msecs);
-
--unsigned int inline jiffies_to_usecs(const unsigned long j)
-+inline unsigned int jiffies_to_usecs(const unsigned long j)
- {
- #if HZ <= USEC_PER_SEC && !(USEC_PER_SEC % HZ)
- return (USEC_PER_SEC / HZ) * j;
-diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
-index 67fe3d9..1196e5f 100644
---- a/kernel/time/tick-broadcast.c
-+++ b/kernel/time/tick-broadcast.c
-@@ -117,7 +117,7 @@ int tick_device_uses_broadcast(struct clock_event_device *dev, int cpu)
- * then clear the broadcast bit.
- */
- if (!(dev->features & CLOCK_EVT_FEAT_C3STOP)) {
-- int cpu = smp_processor_id();
-+ cpu = smp_processor_id();
-
- cpumask_clear_cpu(cpu, tick_get_broadcast_mask());
- tick_broadcast_clear_oneshot(cpu);
-diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
-index f65a0fb..39e0ff0 100644
---- a/kernel/time/timekeeping.c
-+++ b/kernel/time/timekeeping.c
-@@ -14,6 +14,7 @@
- #include <linux/init.h>
- #include <linux/mm.h>
- #include <linux/sched.h>
-+#include <linux/grsecurity.h>
- #include <linux/sysdev.h>
- #include <linux/clocksource.h>
- #include <linux/jiffies.h>
-@@ -208,7 +209,7 @@ void update_xtime_cache(u64 nsec)
- */
- struct timespec ts = xtime;
- timespec_add_ns(&ts, nsec);
-- ACCESS_ONCE(xtime_cache) = ts;
-+ ACCESS_ONCE_RW(xtime_cache) = ts;
- }
-
- #ifdef CONFIG_GENERIC_TIME
-@@ -357,6 +358,8 @@ int do_settimeofday(struct timespec *tv)
- if (!timespec_valid_strict(tv))
- return -EINVAL;
-
-+ gr_log_timechange();
-+
- write_seqlock_irqsave(&xtime_lock, flags);
-
- timekeeping_forward_now();
-diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c
-index 54c0dda..e9095d9 100644
---- a/kernel/time/timer_list.c
-+++ b/kernel/time/timer_list.c
-@@ -38,12 +38,16 @@ DECLARE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases);
-
- static void print_name_offset(struct seq_file *m, void *sym)
- {
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ SEQ_printf(m, "<%p>", NULL);
-+#else
- char symname[KSYM_NAME_LEN];
-
- if (lookup_symbol_name((unsigned long)sym, symname) < 0)
- SEQ_printf(m, "<%p>", sym);
- else
- SEQ_printf(m, "%s", symname);
-+#endif
- }
-
- static void
-@@ -112,7 +116,11 @@ next_one:
- static void
- print_base(struct seq_file *m, struct hrtimer_clock_base *base, u64 now)
- {
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ SEQ_printf(m, " .base: %p\n", NULL);
-+#else
- SEQ_printf(m, " .base: %p\n", base);
-+#endif
- SEQ_printf(m, " .index: %d\n",
- base->index);
- SEQ_printf(m, " .resolution: %Lu nsecs\n",
-@@ -289,7 +297,11 @@ static int __init init_timer_list_procfs(void)
- {
- struct proc_dir_entry *pe;
-
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+ pe = proc_create("timer_list", 0400, NULL, &timer_list_fops);
-+#else
- pe = proc_create("timer_list", 0444, NULL, &timer_list_fops);
-+#endif
- if (!pe)
- return -ENOMEM;
- return 0;
-diff --git a/kernel/time/timer_stats.c b/kernel/time/timer_stats.c
-index ee5681f..862e921 100644
---- a/kernel/time/timer_stats.c
-+++ b/kernel/time/timer_stats.c
-@@ -116,7 +116,7 @@ static ktime_t time_start, time_stop;
- static unsigned long nr_entries;
- static struct entry entries[MAX_ENTRIES];
-
--static atomic_t overflow_count;
-+static atomic_unchecked_t overflow_count;
-
- /*
- * The entries are in a hash-table, for fast lookup:
-@@ -140,7 +140,7 @@ static void reset_entries(void)
- nr_entries = 0;
- memset(entries, 0, sizeof(entries));
- memset(tstat_hash_table, 0, sizeof(tstat_hash_table));
-- atomic_set(&overflow_count, 0);
-+ atomic_set_unchecked(&overflow_count, 0);
- }
-
- static struct entry *alloc_entry(void)
-@@ -261,7 +261,7 @@ void timer_stats_update_stats(void *timer, pid_t pid, void *startf,
- if (likely(entry))
- entry->count++;
- else
-- atomic_inc(&overflow_count);
-+ atomic_inc_unchecked(&overflow_count);
-
- out_unlock:
- spin_unlock_irqrestore(lock, flags);
-@@ -269,12 +269,16 @@ void timer_stats_update_stats(void *timer, pid_t pid, void *startf,
-
- static void print_name_offset(struct seq_file *m, unsigned long addr)
- {
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ seq_printf(m, "<%p>", NULL);
-+#else
- char symname[KSYM_NAME_LEN];
-
- if (lookup_symbol_name(addr, symname) < 0)
-- seq_printf(m, "<%p>", (void *)addr);
-+ seq_printf(m, "<%pK>", (void *)addr);
- else
- seq_printf(m, "%s", symname);
-+#endif
- }
-
- static int tstats_show(struct seq_file *m, void *v)
-@@ -300,9 +304,9 @@ static int tstats_show(struct seq_file *m, void *v)
-
- seq_puts(m, "Timer Stats Version: v0.2\n");
- seq_printf(m, "Sample period: %ld.%03ld s\n", period.tv_sec, ms);
-- if (atomic_read(&overflow_count))
-+ if (atomic_read_unchecked(&overflow_count))
- seq_printf(m, "Overflow: %d entries\n",
-- atomic_read(&overflow_count));
-+ atomic_read_unchecked(&overflow_count));
-
- for (i = 0; i < nr_entries; i++) {
- entry = entries + i;
-@@ -415,7 +419,11 @@ static int __init init_tstats_procfs(void)
- {
- struct proc_dir_entry *pe;
-
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+ pe = proc_create("timer_stats", 0600, NULL, &tstats_fops);
-+#else
- pe = proc_create("timer_stats", 0644, NULL, &tstats_fops);
-+#endif
- if (!pe)
- return -ENOMEM;
- return 0;
-diff --git a/kernel/timer.c b/kernel/timer.c
-index 8123679..8fbf105 100644
---- a/kernel/timer.c
-+++ b/kernel/timer.c
-@@ -1213,7 +1213,7 @@ void update_process_times(int user_tick)
- /*
- * This function runs timers and the timer-tq in bottom half context.
- */
--static void run_timer_softirq(struct softirq_action *h)
-+static void run_timer_softirq(void)
- {
- struct tvec_base *base = __get_cpu_var(tvec_bases);
-
-@@ -1645,7 +1645,7 @@ static int __cpuinit timer_cpu_notify(struct notifier_block *self,
- return NOTIFY_OK;
- }
-
--static struct notifier_block __cpuinitdata timers_nb = {
-+static struct notifier_block __cpuinitconst timers_nb = {
- .notifier_call = timer_cpu_notify,
- };
-
-diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
-index d9d6206..f19467e 100644
---- a/kernel/trace/blktrace.c
-+++ b/kernel/trace/blktrace.c
-@@ -313,7 +313,7 @@ static ssize_t blk_dropped_read(struct file *filp, char __user *buffer,
- struct blk_trace *bt = filp->private_data;
- char buf[16];
-
-- snprintf(buf, sizeof(buf), "%u\n", atomic_read(&bt->dropped));
-+ snprintf(buf, sizeof(buf), "%u\n", atomic_read_unchecked(&bt->dropped));
-
- return simple_read_from_buffer(buffer, count, ppos, buf, strlen(buf));
- }
-@@ -376,7 +376,7 @@ static int blk_subbuf_start_callback(struct rchan_buf *buf, void *subbuf,
- return 1;
-
- bt = buf->chan->private_data;
-- atomic_inc(&bt->dropped);
-+ atomic_inc_unchecked(&bt->dropped);
- return 0;
- }
-
-@@ -477,7 +477,7 @@ int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
-
- bt->dir = dir;
- bt->dev = dev;
-- atomic_set(&bt->dropped, 0);
-+ atomic_set_unchecked(&bt->dropped, 0);
-
- ret = -EIO;
- bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt,
-diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
-index c5f8ab9..9c613c4 100644
---- a/kernel/trace/ftrace.c
-+++ b/kernel/trace/ftrace.c
-@@ -1099,13 +1099,18 @@ ftrace_code_disable(struct module *mod, struct dyn_ftrace *rec)
-
- ip = rec->ip;
-
-+ ret = ftrace_arch_code_modify_prepare();
-+ FTRACE_WARN_ON(ret);
-+ if (ret)
-+ return 0;
-+
- ret = ftrace_make_nop(mod, rec, MCOUNT_ADDR);
-+ FTRACE_WARN_ON(ftrace_arch_code_modify_post_process());
- if (ret) {
- ftrace_bug(ret, ip);
- rec->flags |= FTRACE_FL_FAILED;
-- return 0;
- }
-- return 1;
-+ return ret ? 0 : 1;
- }
-
- /*
-@@ -2725,7 +2730,7 @@ static int ftrace_module_notify(struct notifier_block *self,
-
- struct notifier_block ftrace_module_nb = {
- .notifier_call = ftrace_module_notify,
-- .priority = 0,
-+ .priority = INT_MAX, /* Run before anything that can use kprobes */
- };
-
- extern unsigned long __start_mcount_loc[];
-@@ -3067,8 +3072,6 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,
- #ifdef CONFIG_FUNCTION_GRAPH_TRACER
-
- static int ftrace_graph_active;
--static struct notifier_block ftrace_suspend_notifier;
--
- int ftrace_graph_entry_stub(struct ftrace_graph_ent *trace)
- {
- return 0;
-@@ -3212,6 +3215,10 @@ ftrace_suspend_notifier_call(struct notifier_block *bl, unsigned long state,
- return NOTIFY_DONE;
- }
-
-+static struct notifier_block ftrace_suspend_notifier = {
-+ .notifier_call = ftrace_suspend_notifier_call
-+};
-+
- int register_ftrace_graph(trace_func_graph_ret_t retfunc,
- trace_func_graph_ent_t entryfunc)
- {
-@@ -3225,7 +3232,6 @@ int register_ftrace_graph(trace_func_graph_ret_t retfunc,
- goto out;
- }
-
-- ftrace_suspend_notifier.notifier_call = ftrace_suspend_notifier_call;
- register_pm_notifier(&ftrace_suspend_notifier);
-
- ftrace_graph_active++;
-diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
-index 6024960..854be1f 100644
---- a/kernel/trace/ring_buffer.c
-+++ b/kernel/trace/ring_buffer.c
-@@ -325,9 +325,9 @@ struct buffer_data_page {
- */
- struct buffer_page {
- struct list_head list; /* list of buffer pages */
-- local_t write; /* index for next write */
-+ local_unchecked_t write; /* index for next write */
- unsigned read; /* index for next read */
-- local_t entries; /* entries on this page */
-+ local_unchecked_t entries; /* entries on this page */
- struct buffer_data_page *page; /* Actual data page */
- };
-
-@@ -427,8 +427,8 @@ struct ring_buffer_per_cpu {
- struct buffer_page *tail_page; /* write to tail */
- struct buffer_page *commit_page; /* committed pages */
- struct buffer_page *reader_page;
-- local_t commit_overrun;
-- local_t overrun;
-+ local_unchecked_t commit_overrun;
-+ local_unchecked_t overrun;
- local_t entries;
- local_t committing;
- local_t commits;
-@@ -606,7 +606,7 @@ static struct list_head *rb_list_head(struct list_head *list)
- * the reader page). But if the next page is a header page,
- * its flags will be non zero.
- */
--static int inline
-+static inline int
- rb_is_head_page(struct ring_buffer_per_cpu *cpu_buffer,
- struct buffer_page *page, struct list_head *list)
- {
-@@ -820,8 +820,8 @@ static int rb_tail_page_update(struct ring_buffer_per_cpu *cpu_buffer,
- *
- * We add a counter to the write field to denote this.
- */
-- old_write = local_add_return(RB_WRITE_INTCNT, &next_page->write);
-- old_entries = local_add_return(RB_WRITE_INTCNT, &next_page->entries);
-+ old_write = local_add_return_unchecked(RB_WRITE_INTCNT, &next_page->write);
-+ old_entries = local_add_return_unchecked(RB_WRITE_INTCNT, &next_page->entries);
-
- /*
- * Just make sure we have seen our old_write and synchronize
-@@ -849,8 +849,8 @@ static int rb_tail_page_update(struct ring_buffer_per_cpu *cpu_buffer,
- * cmpxchg to only update if an interrupt did not already
- * do it for us. If the cmpxchg fails, we don't care.
- */
-- (void)local_cmpxchg(&next_page->write, old_write, val);
-- (void)local_cmpxchg(&next_page->entries, old_entries, eval);
-+ (void)local_cmpxchg_unchecked(&next_page->write, old_write, val);
-+ (void)local_cmpxchg_unchecked(&next_page->entries, old_entries, eval);
-
- /*
- * No need to worry about races with clearing out the commit.
-@@ -1397,7 +1397,7 @@ rb_iter_head_event(struct ring_buffer_iter *iter)
-
- static inline unsigned long rb_page_write(struct buffer_page *bpage)
- {
-- return local_read(&bpage->write) & RB_WRITE_MASK;
-+ return local_read_unchecked(&bpage->write) & RB_WRITE_MASK;
- }
-
- static inline unsigned rb_page_commit(struct buffer_page *bpage)
-@@ -1407,7 +1407,7 @@ static inline unsigned rb_page_commit(struct buffer_page *bpage)
-
- static inline unsigned long rb_page_entries(struct buffer_page *bpage)
- {
-- return local_read(&bpage->entries) & RB_WRITE_MASK;
-+ return local_read_unchecked(&bpage->entries) & RB_WRITE_MASK;
- }
-
- /* Size is determined by what has been commited */
-@@ -1603,7 +1603,7 @@ rb_handle_head_page(struct ring_buffer_per_cpu *cpu_buffer,
- * it is our responsibility to update
- * the counters.
- */
-- local_add(entries, &cpu_buffer->overrun);
-+ local_add_unchecked(entries, &cpu_buffer->overrun);
-
- /*
- * The entries will be zeroed out when we move the
-@@ -1744,7 +1744,7 @@ rb_reset_tail(struct ring_buffer_per_cpu *cpu_buffer,
- * must fill the old tail_page with padding.
- */
- if (tail >= BUF_PAGE_SIZE) {
-- local_sub(length, &tail_page->write);
-+ local_sub_unchecked(length, &tail_page->write);
- return;
- }
-
-@@ -1769,7 +1769,7 @@ rb_reset_tail(struct ring_buffer_per_cpu *cpu_buffer,
- rb_event_set_padding(event);
-
- /* Set the write back to the previous setting */
-- local_sub(length, &tail_page->write);
-+ local_sub_unchecked(length, &tail_page->write);
- return;
- }
-
-@@ -1781,7 +1781,7 @@ rb_reset_tail(struct ring_buffer_per_cpu *cpu_buffer,
-
- /* Set write to end of buffer */
- length = (tail + length) - BUF_PAGE_SIZE;
-- local_sub(length, &tail_page->write);
-+ local_sub_unchecked(length, &tail_page->write);
- }
-
- static struct ring_buffer_event *
-@@ -1804,7 +1804,7 @@ rb_move_tail(struct ring_buffer_per_cpu *cpu_buffer,
- * about it.
- */
- if (unlikely(next_page == commit_page)) {
-- local_inc(&cpu_buffer->commit_overrun);
-+ local_inc_unchecked(&cpu_buffer->commit_overrun);
- goto out_reset;
- }
-
-@@ -1858,7 +1858,7 @@ rb_move_tail(struct ring_buffer_per_cpu *cpu_buffer,
- cpu_buffer->tail_page) &&
- (cpu_buffer->commit_page ==
- cpu_buffer->reader_page))) {
-- local_inc(&cpu_buffer->commit_overrun);
-+ local_inc_unchecked(&cpu_buffer->commit_overrun);
- goto out_reset;
- }
- }
-@@ -1900,7 +1900,7 @@ __rb_reserve_next(struct ring_buffer_per_cpu *cpu_buffer,
- /* we just need to protect against interrupts */
- barrier();
- tail_page = cpu_buffer->tail_page;
-- write = local_add_return(length, &tail_page->write);
-+ write = local_add_return_unchecked(length, &tail_page->write);
-
- /* set write to only the index of the write */
- write &= RB_WRITE_MASK;
-@@ -1919,7 +1919,7 @@ __rb_reserve_next(struct ring_buffer_per_cpu *cpu_buffer,
-
- /* The passed in type is zero for DATA */
- if (likely(!type))
-- local_inc(&tail_page->entries);
-+ local_inc_unchecked(&tail_page->entries);
-
- /*
- * If this is the first commit on the page, then update
-@@ -1949,7 +1949,7 @@ rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer,
-
- if (bpage->page == (void *)addr && rb_page_write(bpage) == old_index) {
- unsigned long write_mask =
-- local_read(&bpage->write) & ~RB_WRITE_MASK;
-+ local_read_unchecked(&bpage->write) & ~RB_WRITE_MASK;
- /*
- * This is on the tail page. It is possible that
- * a write could come in and move the tail page
-@@ -1958,7 +1958,7 @@ rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer,
- */
- old_index += write_mask;
- new_index += write_mask;
-- index = local_cmpxchg(&bpage->write, old_index, new_index);
-+ index = local_cmpxchg_unchecked(&bpage->write, old_index, new_index);
- if (index == old_index)
- return 1;
- }
-@@ -2363,7 +2363,7 @@ rb_decrement_entry(struct ring_buffer_per_cpu *cpu_buffer,
-
- /* Do the likely case first */
- if (likely(bpage->page == (void *)addr)) {
-- local_dec(&bpage->entries);
-+ local_dec_unchecked(&bpage->entries);
- return;
- }
-
-@@ -2375,7 +2375,7 @@ rb_decrement_entry(struct ring_buffer_per_cpu *cpu_buffer,
- start = bpage;
- do {
- if (bpage->page == (void *)addr) {
-- local_dec(&bpage->entries);
-+ local_dec_unchecked(&bpage->entries);
- return;
- }
- rb_inc_page(cpu_buffer, &bpage);
-@@ -2610,7 +2610,7 @@ unsigned long ring_buffer_entries_cpu(struct ring_buffer *buffer, int cpu)
- return 0;
-
- cpu_buffer = buffer->buffers[cpu];
-- ret = (local_read(&cpu_buffer->entries) - local_read(&cpu_buffer->overrun))
-+ ret = (local_read(&cpu_buffer->entries) - local_read_unchecked(&cpu_buffer->overrun))
- - cpu_buffer->read;
-
- return ret;
-@@ -2631,7 +2631,7 @@ unsigned long ring_buffer_overrun_cpu(struct ring_buffer *buffer, int cpu)
- return 0;
-
- cpu_buffer = buffer->buffers[cpu];
-- ret = local_read(&cpu_buffer->overrun);
-+ ret = local_read_unchecked(&cpu_buffer->overrun);
-
- return ret;
- }
-@@ -2652,7 +2652,7 @@ ring_buffer_commit_overrun_cpu(struct ring_buffer *buffer, int cpu)
- return 0;
-
- cpu_buffer = buffer->buffers[cpu];
-- ret = local_read(&cpu_buffer->commit_overrun);
-+ ret = local_read_unchecked(&cpu_buffer->commit_overrun);
-
- return ret;
- }
-@@ -2675,7 +2675,7 @@ unsigned long ring_buffer_entries(struct ring_buffer *buffer)
- for_each_buffer_cpu(buffer, cpu) {
- cpu_buffer = buffer->buffers[cpu];
- entries += (local_read(&cpu_buffer->entries) -
-- local_read(&cpu_buffer->overrun)) - cpu_buffer->read;
-+ local_read_unchecked(&cpu_buffer->overrun)) - cpu_buffer->read;
- }
-
- return entries;
-@@ -2698,7 +2698,7 @@ unsigned long ring_buffer_overruns(struct ring_buffer *buffer)
- /* if you care about this being correct, lock the buffer */
- for_each_buffer_cpu(buffer, cpu) {
- cpu_buffer = buffer->buffers[cpu];
-- overruns += local_read(&cpu_buffer->overrun);
-+ overruns += local_read_unchecked(&cpu_buffer->overrun);
- }
-
- return overruns;
-@@ -2867,8 +2867,8 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
- /*
- * Reset the reader page to size zero.
- */
-- local_set(&cpu_buffer->reader_page->write, 0);
-- local_set(&cpu_buffer->reader_page->entries, 0);
-+ local_set_unchecked(&cpu_buffer->reader_page->write, 0);
-+ local_set_unchecked(&cpu_buffer->reader_page->entries, 0);
- local_set(&cpu_buffer->reader_page->page->commit, 0);
-
- spin:
-@@ -3362,8 +3362,8 @@ rb_reset_cpu(struct ring_buffer_per_cpu *cpu_buffer)
-
- cpu_buffer->head_page
- = list_entry(cpu_buffer->pages, struct buffer_page, list);
-- local_set(&cpu_buffer->head_page->write, 0);
-- local_set(&cpu_buffer->head_page->entries, 0);
-+ local_set_unchecked(&cpu_buffer->head_page->write, 0);
-+ local_set_unchecked(&cpu_buffer->head_page->entries, 0);
- local_set(&cpu_buffer->head_page->page->commit, 0);
-
- cpu_buffer->head_page->read = 0;
-@@ -3372,13 +3372,13 @@ rb_reset_cpu(struct ring_buffer_per_cpu *cpu_buffer)
- cpu_buffer->commit_page = cpu_buffer->head_page;
-
- INIT_LIST_HEAD(&cpu_buffer->reader_page->list);
-- local_set(&cpu_buffer->reader_page->write, 0);
-- local_set(&cpu_buffer->reader_page->entries, 0);
-+ local_set_unchecked(&cpu_buffer->reader_page->write, 0);
-+ local_set_unchecked(&cpu_buffer->reader_page->entries, 0);
- local_set(&cpu_buffer->reader_page->page->commit, 0);
- cpu_buffer->reader_page->read = 0;
-
-- local_set(&cpu_buffer->commit_overrun, 0);
-- local_set(&cpu_buffer->overrun, 0);
-+ local_set_unchecked(&cpu_buffer->commit_overrun, 0);
-+ local_set_unchecked(&cpu_buffer->overrun, 0);
- local_set(&cpu_buffer->entries, 0);
- local_set(&cpu_buffer->committing, 0);
- local_set(&cpu_buffer->commits, 0);
-@@ -3754,8 +3754,8 @@ int ring_buffer_read_page(struct ring_buffer *buffer,
- rb_init_page(bpage);
- bpage = reader->page;
- reader->page = *data_page;
-- local_set(&reader->write, 0);
-- local_set(&reader->entries, 0);
-+ local_set_unchecked(&reader->write, 0);
-+ local_set_unchecked(&reader->entries, 0);
- reader->read = 0;
- *data_page = bpage;
- }
-diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
-index a2a2d1f..7f32b09 100644
---- a/kernel/trace/trace.c
-+++ b/kernel/trace/trace.c
-@@ -3193,6 +3193,8 @@ static ssize_t tracing_splice_read_pipe(struct file *filp,
- size_t rem;
- unsigned int i;
-
-+ pax_track_stack();
-+
- /* copy the tracer to avoid using a global lock all around */
- mutex_lock(&trace_types_lock);
- if (unlikely(old_tracer != current_trace && current_trace)) {
-@@ -3659,6 +3661,8 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
- int entries, size, i;
- size_t ret;
-
-+ pax_track_stack();
-+
- if (*ppos & (PAGE_SIZE - 1)) {
- WARN_ONCE(1, "Ftrace: previous read must page-align\n");
- return -EINVAL;
-@@ -3816,10 +3820,9 @@ static const struct file_operations tracing_dyn_info_fops = {
- };
- #endif
-
--static struct dentry *d_tracer;
--
- struct dentry *tracing_init_dentry(void)
- {
-+ static struct dentry *d_tracer;
- static int once;
-
- if (d_tracer)
-@@ -3839,10 +3842,9 @@ struct dentry *tracing_init_dentry(void)
- return d_tracer;
- }
-
--static struct dentry *d_percpu;
--
- struct dentry *tracing_dentry_percpu(void)
- {
-+ static struct dentry *d_percpu;
- static int once;
- struct dentry *d_tracer;
-
-diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
-index d128f65..4ab26e4 100644
---- a/kernel/trace/trace_events.c
-+++ b/kernel/trace/trace_events.c
-@@ -951,13 +951,10 @@ static LIST_HEAD(ftrace_module_file_list);
- * Modules must own their file_operations to keep up with
- * reference counting.
- */
-+
- struct ftrace_module_file_ops {
- struct list_head list;
- struct module *mod;
-- struct file_operations id;
-- struct file_operations enable;
-- struct file_operations format;
-- struct file_operations filter;
- };
-
- static void remove_subsystem_dir(const char *name)
-@@ -1004,17 +1001,12 @@ trace_create_file_ops(struct module *mod)
-
- file_ops->mod = mod;
-
-- file_ops->id = ftrace_event_id_fops;
-- file_ops->id.owner = mod;
--
-- file_ops->enable = ftrace_enable_fops;
-- file_ops->enable.owner = mod;
--
-- file_ops->filter = ftrace_event_filter_fops;
-- file_ops->filter.owner = mod;
--
-- file_ops->format = ftrace_event_format_fops;
-- file_ops->format.owner = mod;
-+ pax_open_kernel();
-+ mod->trace_id.owner = mod;
-+ mod->trace_enable.owner = mod;
-+ mod->trace_filter.owner = mod;
-+ mod->trace_format.owner = mod;
-+ pax_close_kernel();
-
- list_add(&file_ops->list, &ftrace_module_file_list);
-
-@@ -1063,8 +1055,8 @@ static void trace_module_add_events(struct module *mod)
- call->mod = mod;
- list_add(&call->list, &ftrace_events);
- event_create_dir(call, d_events,
-- &file_ops->id, &file_ops->enable,
-- &file_ops->filter, &file_ops->format);
-+ &mod->trace_id, &mod->trace_enable,
-+ &mod->trace_filter, &mod->trace_format);
- }
- }
-
-diff --git a/kernel/trace/trace_mmiotrace.c b/kernel/trace/trace_mmiotrace.c
-index 0acd834..b800b56 100644
---- a/kernel/trace/trace_mmiotrace.c
-+++ b/kernel/trace/trace_mmiotrace.c
-@@ -23,7 +23,7 @@ struct header_iter {
- static struct trace_array *mmio_trace_array;
- static bool overrun_detected;
- static unsigned long prev_overruns;
--static atomic_t dropped_count;
-+static atomic_unchecked_t dropped_count;
-
- static void mmio_reset_data(struct trace_array *tr)
- {
-@@ -126,7 +126,7 @@ static void mmio_close(struct trace_iterator *iter)
-
- static unsigned long count_overruns(struct trace_iterator *iter)
- {
-- unsigned long cnt = atomic_xchg(&dropped_count, 0);
-+ unsigned long cnt = atomic_xchg_unchecked(&dropped_count, 0);
- unsigned long over = ring_buffer_overruns(iter->tr->buffer);
-
- if (over > prev_overruns)
-@@ -316,7 +316,7 @@ static void __trace_mmiotrace_rw(struct trace_array *tr,
- event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_RW,
- sizeof(*entry), 0, pc);
- if (!event) {
-- atomic_inc(&dropped_count);
-+ atomic_inc_unchecked(&dropped_count);
- return;
- }
- entry = ring_buffer_event_data(event);
-@@ -346,7 +346,7 @@ static void __trace_mmiotrace_map(struct trace_array *tr,
- event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_MAP,
- sizeof(*entry), 0, pc);
- if (!event) {
-- atomic_inc(&dropped_count);
-+ atomic_inc_unchecked(&dropped_count);
- return;
- }
- entry = ring_buffer_event_data(event);
-diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
-index b6c12c6..e61376e 100644
---- a/kernel/trace/trace_output.c
-+++ b/kernel/trace/trace_output.c
-@@ -237,7 +237,7 @@ int trace_seq_path(struct trace_seq *s, struct path *path)
- return 0;
- p = d_path(path, s->buffer + s->len, PAGE_SIZE - s->len);
- if (!IS_ERR(p)) {
-- p = mangle_path(s->buffer + s->len, p, "\n");
-+ p = mangle_path(s->buffer + s->len, p, "\n\\");
- if (p) {
- s->len = p - s->buffer;
- return 1;
-@@ -711,14 +711,16 @@ int register_ftrace_event(struct trace_event *event)
- goto out;
- }
-
-+ pax_open_kernel();
- if (event->trace == NULL)
-- event->trace = trace_nop_print;
-+ *(void **)&event->trace = trace_nop_print;
- if (event->raw == NULL)
-- event->raw = trace_nop_print;
-+ *(void **)&event->raw = trace_nop_print;
- if (event->hex == NULL)
-- event->hex = trace_nop_print;
-+ *(void **)&event->hex = trace_nop_print;
- if (event->binary == NULL)
-- event->binary = trace_nop_print;
-+ *(void **)&event->binary = trace_nop_print;
-+ pax_close_kernel();
-
- key = event->type & (EVENT_HASHSIZE - 1);
-
-diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
-index 8504ac7..ecf0adb 100644
---- a/kernel/trace/trace_stack.c
-+++ b/kernel/trace/trace_stack.c
-@@ -50,7 +50,7 @@ static inline void check_stack(void)
- return;
-
- /* we do not handle interrupt stacks yet */
-- if (!object_is_on_stack(&this_size))
-+ if (!object_starts_on_stack(&this_size))
- return;
-
- local_irq_save(flags);
-diff --git a/kernel/trace/trace_workqueue.c b/kernel/trace/trace_workqueue.c
-index 40cafb0..d5ead43 100644
---- a/kernel/trace/trace_workqueue.c
-+++ b/kernel/trace/trace_workqueue.c
-@@ -21,7 +21,7 @@ struct cpu_workqueue_stats {
- int cpu;
- pid_t pid;
- /* Can be inserted from interrupt or user context, need to be atomic */
-- atomic_t inserted;
-+ atomic_unchecked_t inserted;
- /*
- * Don't need to be atomic, works are serialized in a single workqueue thread
- * on a single CPU.
-@@ -58,7 +58,7 @@ probe_workqueue_insertion(struct task_struct *wq_thread,
- spin_lock_irqsave(&workqueue_cpu_stat(cpu)->lock, flags);
- list_for_each_entry(node, &workqueue_cpu_stat(cpu)->list, list) {
- if (node->pid == wq_thread->pid) {
-- atomic_inc(&node->inserted);
-+ atomic_inc_unchecked(&node->inserted);
- goto found;
- }
- }
-@@ -205,7 +205,7 @@ static int workqueue_stat_show(struct seq_file *s, void *p)
- tsk = get_pid_task(pid, PIDTYPE_PID);
- if (tsk) {
- seq_printf(s, "%3d %6d %6u %s\n", cws->cpu,
-- atomic_read(&cws->inserted), cws->executed,
-+ atomic_read_unchecked(&cws->inserted), cws->executed,
- tsk->comm);
- put_task_struct(tsk);
- }
-diff --git a/kernel/user.c b/kernel/user.c
-index 1b91701..8795237 100644
---- a/kernel/user.c
-+++ b/kernel/user.c
-@@ -159,6 +159,7 @@ struct user_struct *alloc_uid(struct user_namespace *ns, uid_t uid)
- spin_lock_irq(&uidhash_lock);
- up = uid_hash_find(uid, hashent);
- if (up) {
-+ put_user_ns(ns);
- key_put(new->uid_keyring);
- key_put(new->session_keyring);
- kmem_cache_free(uid_cachep, new);
-diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
-index 234ceb1..ad74049 100644
---- a/lib/Kconfig.debug
-+++ b/lib/Kconfig.debug
-@@ -905,7 +905,7 @@ config LATENCYTOP
- select STACKTRACE
- select SCHEDSTATS
- select SCHED_DEBUG
-- depends on HAVE_LATENCYTOP_SUPPORT
-+ depends on HAVE_LATENCYTOP_SUPPORT && !GRKERNSEC_HIDESYM
- help
- Enable this option if you want to use the LatencyTOP tool
- to find out which userspace is blocking on what kernel operations.
-diff --git a/lib/Makefile b/lib/Makefile
-index 5ecf2ba..dcd31ba 100644
---- a/lib/Makefile
-+++ b/lib/Makefile
-@@ -42,7 +42,7 @@ obj-$(CONFIG_GENERIC_FIND_LAST_BIT) += find_last_bit.o
- obj-$(CONFIG_GENERIC_HWEIGHT) += hweight.o
- obj-$(CONFIG_LOCK_KERNEL) += kernel_lock.o
- obj-$(CONFIG_DEBUG_PREEMPT) += smp_processor_id.o
--obj-$(CONFIG_DEBUG_LIST) += list_debug.o
-+obj-y += list_debug.o
- obj-$(CONFIG_DEBUG_OBJECTS) += debugobjects.o
-
- ifneq ($(CONFIG_HAVE_DEC_LOCK),y)
-diff --git a/lib/bitmap.c b/lib/bitmap.c
-index 7025658..8d14cab 100644
---- a/lib/bitmap.c
-+++ b/lib/bitmap.c
-@@ -341,7 +341,7 @@ int __bitmap_parse(const char *buf, unsigned int buflen,
- {
- int c, old_c, totaldigits, ndigits, nchunks, nbits;
- u32 chunk;
-- const char __user *ubuf = buf;
-+ const char __user *ubuf = (const char __force_user *)buf;
-
- bitmap_zero(maskp, nmaskbits);
-
-@@ -426,7 +426,7 @@ int bitmap_parse_user(const char __user *ubuf,
- {
- if (!access_ok(VERIFY_READ, ubuf, ulen))
- return -EFAULT;
-- return __bitmap_parse((const char *)ubuf, ulen, 1, maskp, nmaskbits);
-+ return __bitmap_parse((const char __force_kernel *)ubuf, ulen, 1, maskp, nmaskbits);
- }
- EXPORT_SYMBOL(bitmap_parse_user);
-
-diff --git a/lib/bug.c b/lib/bug.c
-index 300e41a..2779eb0 100644
---- a/lib/bug.c
-+++ b/lib/bug.c
-@@ -135,6 +135,8 @@ enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs)
- return BUG_TRAP_TYPE_NONE;
-
- bug = find_bug(bugaddr);
-+ if (!bug)
-+ return BUG_TRAP_TYPE_NONE;
-
- printk(KERN_EMERG "------------[ cut here ]------------\n");
-
-diff --git a/lib/debugobjects.c b/lib/debugobjects.c
-index 2b413db..e21d207 100644
---- a/lib/debugobjects.c
-+++ b/lib/debugobjects.c
-@@ -277,7 +277,7 @@ static void debug_object_is_on_stack(void *addr, int onstack)
- if (limit > 4)
- return;
-
-- is_on_stack = object_is_on_stack(addr);
-+ is_on_stack = object_starts_on_stack(addr);
- if (is_on_stack == onstack)
- return;
-
-diff --git a/lib/devres.c b/lib/devres.c
-index 72c8909..7543868 100644
---- a/lib/devres.c
-+++ b/lib/devres.c
-@@ -80,7 +80,7 @@ void devm_iounmap(struct device *dev, void __iomem *addr)
- {
- iounmap(addr);
- WARN_ON(devres_destroy(dev, devm_ioremap_release, devm_ioremap_match,
-- (void *)addr));
-+ (void __force *)addr));
- }
- EXPORT_SYMBOL(devm_iounmap);
-
-@@ -140,7 +140,7 @@ void devm_ioport_unmap(struct device *dev, void __iomem *addr)
- {
- ioport_unmap(addr);
- WARN_ON(devres_destroy(dev, devm_ioport_map_release,
-- devm_ioport_map_match, (void *)addr));
-+ devm_ioport_map_match, (void __force *)addr));
- }
- EXPORT_SYMBOL(devm_ioport_unmap);
-
-diff --git a/lib/div64.c b/lib/div64.c
-index a111eb8..5b49191 100644
---- a/lib/div64.c
-+++ b/lib/div64.c
-@@ -77,26 +77,58 @@ s64 div_s64_rem(s64 dividend, s32 divisor, s32 *remainder)
- EXPORT_SYMBOL(div_s64_rem);
- #endif
-
--/* 64bit divisor, dividend and result. dynamic precision */
-+/**
-+ * div64_u64 - unsigned 64bit divide with 64bit divisor
-+ * @dividend: 64bit dividend
-+ * @divisor: 64bit divisor
-+ *
-+ * This implementation is a modified version of the algorithm proposed
-+ * by the book 'Hacker's Delight'. The original source and full proof
-+ * can be found here and is available for use without restriction.
-+ *
-+ * 'http://www.hackersdelight.org/HDcode/newCode/divDouble.c'
-+ */
- #ifndef div64_u64
- u64 div64_u64(u64 dividend, u64 divisor)
- {
-- u32 high, d;
-+ u32 high = divisor >> 32;
-+ u64 quot;
-
-- high = divisor >> 32;
-- if (high) {
-- unsigned int shift = fls(high);
-+ if (high == 0) {
-+ quot = div_u64(dividend, divisor);
-+ } else {
-+ int n = 1 + fls(high);
-+ quot = div_u64(dividend >> n, divisor >> n);
-
-- d = divisor >> shift;
-- dividend >>= shift;
-- } else
-- d = divisor;
-+ if (quot != 0)
-+ quot--;
-+ if ((dividend - quot * divisor) >= divisor)
-+ quot++;
-+ }
-
-- return div_u64(dividend, d);
-+ return quot;
- }
- EXPORT_SYMBOL(div64_u64);
- #endif
-
-+/**
-+ * div64_s64 - signed 64bit divide with 64bit divisor
-+ * @dividend: 64bit dividend
-+ * @divisor: 64bit divisor
-+ */
-+#ifndef div64_s64
-+s64 div64_s64(s64 dividend, s64 divisor)
-+{
-+ s64 quot, t;
-+
-+ quot = div64_u64(abs64(dividend), abs64(divisor));
-+ t = (dividend ^ divisor) >> 63;
-+
-+ return (quot ^ t) - t;
-+}
-+EXPORT_SYMBOL(div64_s64);
-+#endif
-+
- #endif /* BITS_PER_LONG == 32 */
-
- /*
-diff --git a/lib/dma-debug.c b/lib/dma-debug.c
-index 084e879..4f85cf6 100644
---- a/lib/dma-debug.c
-+++ b/lib/dma-debug.c
-@@ -696,7 +696,7 @@ static int dma_debug_device_change(struct notifier_block *nb, unsigned long acti
-
- void dma_debug_add_bus(struct bus_type *bus)
- {
-- struct notifier_block *nb;
-+ notifier_block_no_const *nb;
-
- if (global_disable)
- return;
-@@ -861,7 +861,7 @@ out:
-
- static void check_for_stack(struct device *dev, void *addr)
- {
-- if (object_is_on_stack(addr))
-+ if (object_starts_on_stack(addr))
- err_printk(dev, NULL, "DMA-API: device driver maps memory from"
- "stack [addr=%p]\n", addr);
- }
-diff --git a/lib/idr.c b/lib/idr.c
-index eda7ba3..915dfae 100644
---- a/lib/idr.c
-+++ b/lib/idr.c
-@@ -156,7 +156,7 @@ static int sub_alloc(struct idr *idp, int *starting_id, struct idr_layer **pa)
- id = (id | ((1 << (IDR_BITS * l)) - 1)) + 1;
-
- /* if already at the top layer, we need to grow */
-- if (id >= 1 << (idp->layers * IDR_BITS)) {
-+ if (id >= (1 << (idp->layers * IDR_BITS))) {
- *starting_id = id;
- return IDR_NEED_TO_GROW;
- }
-diff --git a/lib/inflate.c b/lib/inflate.c
-index d102559..4215f31 100644
---- a/lib/inflate.c
-+++ b/lib/inflate.c
-@@ -266,7 +266,7 @@ static void free(void *where)
- malloc_ptr = free_mem_ptr;
- }
- #else
--#define malloc(a) kmalloc(a, GFP_KERNEL)
-+#define malloc(a) kmalloc((a), GFP_KERNEL)
- #define free(a) kfree(a)
- #endif
-
-diff --git a/lib/ioremap.c b/lib/ioremap.c
-index 14c6078..65526a1 100644
---- a/lib/ioremap.c
-+++ b/lib/ioremap.c
-@@ -37,7 +37,7 @@ static inline int ioremap_pmd_range(pud_t *pud, unsigned long addr,
- unsigned long next;
-
- phys_addr -= addr;
-- pmd = pmd_alloc(&init_mm, pud, addr);
-+ pmd = pmd_alloc_kernel(&init_mm, pud, addr);
- if (!pmd)
- return -ENOMEM;
- do {
-@@ -55,7 +55,7 @@ static inline int ioremap_pud_range(pgd_t *pgd, unsigned long addr,
- unsigned long next;
-
- phys_addr -= addr;
-- pud = pud_alloc(&init_mm, pgd, addr);
-+ pud = pud_alloc_kernel(&init_mm, pgd, addr);
- if (!pud)
- return -ENOMEM;
- do {
-diff --git a/lib/is_single_threaded.c b/lib/is_single_threaded.c
-index bd2bea9..6b3c95e 100644
---- a/lib/is_single_threaded.c
-+++ b/lib/is_single_threaded.c
-@@ -22,6 +22,9 @@ bool current_is_single_threaded(void)
- struct task_struct *p, *t;
- bool ret;
-
-+ if (!mm)
-+ return true;
-+
- if (atomic_read(&task->signal->live) != 1)
- return false;
-
-diff --git a/lib/kobject.c b/lib/kobject.c
-index b512b74..ba78866 100644
---- a/lib/kobject.c
-+++ b/lib/kobject.c
-@@ -531,6 +531,13 @@ struct kobject *kobject_get(struct kobject *kobj)
- return kobj;
- }
-
-+static struct kobject *kobject_get_unless_zero(struct kobject *kobj)
-+{
-+ if (!kref_get_unless_zero(&kobj->kref))
-+ kobj = NULL;
-+ return kobj;
-+}
-+
- /*
- * kobject_cleanup - free kobject resources.
- * @kobj: object to cleanup
-@@ -700,7 +707,7 @@ static ssize_t kobj_attr_store(struct kobject *kobj, struct attribute *attr,
- return ret;
- }
-
--struct sysfs_ops kobj_sysfs_ops = {
-+const struct sysfs_ops kobj_sysfs_ops = {
- .show = kobj_attr_show,
- .store = kobj_attr_store,
- };
-@@ -752,7 +759,7 @@ struct kobject *kset_find_obj(struct kset *kset, const char *name)
- spin_lock(&kset->list_lock);
- list_for_each_entry(k, &kset->list, entry) {
- if (kobject_name(k) && !strcmp(kobject_name(k), name)) {
-- ret = kobject_get(k);
-+ ret = kobject_get_unless_zero(k);
- break;
- }
- }
-@@ -789,7 +796,7 @@ static struct kobj_type kset_ktype = {
- * If the kset was not able to be created, NULL will be returned.
- */
- static struct kset *kset_create(const char *name,
-- struct kset_uevent_ops *uevent_ops,
-+ const struct kset_uevent_ops *uevent_ops,
- struct kobject *parent_kobj)
- {
- struct kset *kset;
-@@ -832,7 +839,7 @@ static struct kset *kset_create(const char *name,
- * If the kset was not able to be created, NULL will be returned.
- */
- struct kset *kset_create_and_add(const char *name,
-- struct kset_uevent_ops *uevent_ops,
-+ const struct kset_uevent_ops *uevent_ops,
- struct kobject *parent_kobj)
- {
- struct kset *kset;
-diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
-index 507b821..0bf8ed0 100644
---- a/lib/kobject_uevent.c
-+++ b/lib/kobject_uevent.c
-@@ -95,7 +95,7 @@ int kobject_uevent_env(struct kobject *kobj, enum kobject_action action,
- const char *subsystem;
- struct kobject *top_kobj;
- struct kset *kset;
-- struct kset_uevent_ops *uevent_ops;
-+ const struct kset_uevent_ops *uevent_ops;
- u64 seq;
- int i = 0;
- int retval = 0;
-diff --git a/lib/kref.c b/lib/kref.c
-index 9ecd6e8..12c94c1 100644
---- a/lib/kref.c
-+++ b/lib/kref.c
-@@ -61,7 +61,7 @@ void kref_get(struct kref *kref)
- */
- int kref_put(struct kref *kref, void (*release)(struct kref *kref))
- {
-- WARN_ON(release == NULL);
-+ BUG_ON(release == NULL);
- WARN_ON(release == (void (*)(struct kref *))kfree);
-
- if (atomic_dec_and_test(&kref->refcount)) {
-diff --git a/lib/list_debug.c b/lib/list_debug.c
-index 1a39f4e..f5349ec 100644
---- a/lib/list_debug.c
-+++ b/lib/list_debug.c
-@@ -8,7 +8,9 @@
-
- #include <linux/module.h>
- #include <linux/list.h>
-+#include <linux/mm.h>
-
-+#ifdef CONFIG_DEBUG_LIST
- /*
- * Insert a new entry between two known consecutive entries.
- *
-@@ -16,18 +18,39 @@
- * the prev/next entries already!
- */
-
-+static bool __list_add_debug(struct list_head *new,
-+ struct list_head *prev,
-+ struct list_head *next)
-+{
-+ if (unlikely(next->prev != prev)) {
-+ printk(KERN_ERR "list_add corruption. next->prev should be "
-+ "prev (%p), but was %p. (next=%p).\n",
-+ prev, next->prev, next);
-+ BUG();
-+ return false;
-+ }
-+ if (unlikely(prev->next != next)) {
-+ printk(KERN_ERR "list_add corruption. prev->next should be "
-+ "next (%p), but was %p. (prev=%p).\n",
-+ next, prev->next, prev);
-+ BUG();
-+ return false;
-+ }
-+ if (unlikely(new == prev || new == next)) {
-+ printk(KERN_ERR "list_add double add: new=%p, prev=%p, next=%p.\n",
-+ new, prev, next);
-+ BUG();
-+ return false;
-+ }
-+ return true;
-+}
-+
- void __list_add(struct list_head *new,
-- struct list_head *prev,
-- struct list_head *next)
-+ struct list_head *prev,
-+ struct list_head *next)
- {
-- WARN(next->prev != prev,
-- "list_add corruption. next->prev should be "
-- "prev (%p), but was %p. (next=%p).\n",
-- prev, next->prev, next);
-- WARN(prev->next != next,
-- "list_add corruption. prev->next should be "
-- "next (%p), but was %p. (prev=%p).\n",
-- next, prev->next, prev);
-+ if (!__list_add_debug(new, prev, next))
-+ return;
- next->prev = new;
- new->next = next;
- new->prev = prev;
-@@ -41,16 +64,66 @@ EXPORT_SYMBOL(__list_add);
- * Note: list_empty on entry does not return true after this, the entry is
- * in an undefined state.
- */
-+static bool list_del_debug(struct list_head *entry)
-+{
-+ if (unlikely(entry->prev->next != entry)) {
-+ printk(KERN_ERR "list_del corruption. prev->next should be %p, "
-+ "but was %p\n", entry, entry->prev->next);
-+ BUG();
-+ return false;
-+ }
-+ if (unlikely(entry->next->prev != entry)) {
-+ printk(KERN_ERR "list_del corruption. next->prev should be %p, "
-+ "but was %p\n", entry, entry->next->prev);
-+ BUG();
-+ return false;
-+ }
-+ return true;
-+}
-+
- void list_del(struct list_head *entry)
- {
-- WARN(entry->prev->next != entry,
-- "list_del corruption. prev->next should be %p, "
-- "but was %p\n", entry, entry->prev->next);
-- WARN(entry->next->prev != entry,
-- "list_del corruption. next->prev should be %p, "
-- "but was %p\n", entry, entry->next->prev);
-+ if (!list_del_debug(entry))
-+ return;
- __list_del(entry->prev, entry->next);
- entry->next = LIST_POISON1;
- entry->prev = LIST_POISON2;
- }
- EXPORT_SYMBOL(list_del);
-+#endif
-+
-+void pax_list_add_tail(struct list_head *new, struct list_head *head)
-+{
-+ struct list_head *prev, *next;
-+
-+ prev = head->prev;
-+ next = head;
-+
-+#ifdef CONFIG_DEBUG_LIST
-+ if (!__list_add_debug(new, prev, next))
-+ return;
-+#endif
-+
-+ pax_open_kernel();
-+ next->prev = new;
-+ new->next = next;
-+ new->prev = prev;
-+ prev->next = new;
-+ pax_close_kernel();
-+}
-+EXPORT_SYMBOL(pax_list_add_tail);
-+
-+void pax_list_del(struct list_head *entry)
-+{
-+#ifdef CONFIG_DEBUG_LIST
-+ if (!list_del_debug(entry))
-+ return;
-+#endif
-+
-+ pax_open_kernel();
-+ __list_del(entry->prev, entry->next);
-+ entry->next = LIST_POISON1;
-+ entry->prev = LIST_POISON2;
-+ pax_close_kernel();
-+}
-+EXPORT_SYMBOL(pax_list_del);
-diff --git a/lib/radix-tree.c b/lib/radix-tree.c
-index 92cdd99..a8149d7 100644
---- a/lib/radix-tree.c
-+++ b/lib/radix-tree.c
-@@ -81,7 +81,7 @@ struct radix_tree_preload {
- int nr;
- struct radix_tree_node *nodes[RADIX_TREE_MAX_PATH];
- };
--static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads) = { 0, };
-+static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads);
-
- static inline gfp_t root_gfp_mask(struct radix_tree_root *root)
- {
-diff --git a/lib/random32.c b/lib/random32.c
-index 217d5c4..45aba8a 100644
---- a/lib/random32.c
-+++ b/lib/random32.c
-@@ -61,7 +61,7 @@ static u32 __random32(struct rnd_state *state)
- */
- static inline u32 __seed(u32 x, u32 m)
- {
-- return (x < m) ? x + m : x;
-+ return (x <= m) ? x + m + 1 : x;
- }
-
- /**
-diff --git a/lib/vsprintf.c b/lib/vsprintf.c
-index 33bed5e..8a1afdf 100644
---- a/lib/vsprintf.c
-+++ b/lib/vsprintf.c
-@@ -16,6 +16,9 @@
- * - scnprintf and vscnprintf
- */
-
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+#define __INCLUDED_BY_HIDESYM 1
-+#endif
- #include <stdarg.h>
- #include <linux/module.h>
- #include <linux/types.h>
-@@ -546,12 +549,12 @@ static char *number(char *buf, char *end, unsigned long long num,
- return buf;
- }
-
--static char *string(char *buf, char *end, char *s, struct printf_spec spec)
-+static char *string(char *buf, char *end, const char *s, struct printf_spec spec)
- {
- int len, i;
-
- if ((unsigned long)s < PAGE_SIZE)
-- s = "<NULL>";
-+ s = "(null)";
-
- len = strnlen(s, spec.precision);
-
-@@ -581,7 +584,7 @@ static char *symbol_string(char *buf, char *end, void *ptr,
- unsigned long value = (unsigned long) ptr;
- #ifdef CONFIG_KALLSYMS
- char sym[KSYM_SYMBOL_LEN];
-- if (ext != 'f' && ext != 's')
-+ if (ext != 'f' && ext != 's' && ext != 'a')
- sprint_symbol(sym, value);
- else
- kallsyms_lookup(value, NULL, NULL, NULL, sym);
-@@ -801,6 +804,8 @@ static char *ip4_addr_string(char *buf, char *end, const u8 *addr,
- * - 'f' For simple symbolic function names without offset
- * - 'S' For symbolic direct pointers with offset
- * - 's' For symbolic direct pointers without offset
-+ * - 'A' For symbolic direct pointers with offset approved for use with GRKERNSEC_HIDESYM
-+ * - 'a' For symbolic direct pointers without offset approved for use with GRKERNSEC_HIDESYM
- * - 'R' For a struct resource pointer, it prints the range of
- * addresses (not the name nor the flags)
- * - 'M' For a 6-byte MAC address, it prints the address in the
-@@ -822,7 +827,7 @@ static char *pointer(const char *fmt, char *buf, char *end, void *ptr,
- struct printf_spec spec)
- {
- if (!ptr)
-- return string(buf, end, "(null)", spec);
-+ return string(buf, end, "(nil)", spec);
-
- switch (*fmt) {
- case 'F':
-@@ -831,6 +836,14 @@ static char *pointer(const char *fmt, char *buf, char *end, void *ptr,
- case 's':
- /* Fallthrough */
- case 'S':
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ break;
-+#else
-+ return symbol_string(buf, end, ptr, spec, *fmt);
-+#endif
-+ case 'a':
-+ /* Fallthrough */
-+ case 'A':
- return symbol_string(buf, end, ptr, spec, *fmt);
- case 'R':
- return resource_string(buf, end, ptr, spec);
-@@ -853,7 +866,22 @@ static char *pointer(const char *fmt, char *buf, char *end, void *ptr,
- return ip4_addr_string(buf, end, ptr, spec, fmt);
- }
- break;
-+ case 'P':
-+ break;
- }
-+
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ /* 'P' = approved pointers to copy to userland,
-+ as in the /proc/kallsyms case, as we make it display nothing
-+ for non-root users, and the real contents for root users
-+ */
-+ if ((unsigned long)ptr > TASK_SIZE && *fmt != 'P' && is_usercopy_object(buf)) {
-+ printk(KERN_ALERT "grsec: kernel infoleak detected! Please report this log to spender@grsecurity.net.\n");
-+ dump_stack();
-+ ptr = NULL;
-+ }
-+#endif
-+
- spec.flags |= SMALL;
- if (spec.field_width == -1) {
- spec.field_width = 2*sizeof(void *);
-@@ -1445,7 +1473,7 @@ do { \
- size_t len;
- if ((unsigned long)save_str > (unsigned long)-PAGE_SIZE
- || (unsigned long)save_str < PAGE_SIZE)
-- save_str = "<NULL>";
-+ save_str = "(null)";
- len = strlen(save_str);
- if (str + len + 1 < end)
- memcpy(str, save_str, len + 1);
-@@ -1555,11 +1583,11 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
- typeof(type) value; \
- if (sizeof(type) == 8) { \
- args = PTR_ALIGN(args, sizeof(u32)); \
-- *(u32 *)&value = *(u32 *)args; \
-- *((u32 *)&value + 1) = *(u32 *)(args + 4); \
-+ *(u32 *)&value = *(const u32 *)args; \
-+ *((u32 *)&value + 1) = *(const u32 *)(args + 4); \
- } else { \
- args = PTR_ALIGN(args, sizeof(type)); \
-- value = *(typeof(type) *)args; \
-+ value = *(const typeof(type) *)args; \
- } \
- args += sizeof(type); \
- value; \
-@@ -1622,7 +1650,7 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
- const char *str_arg = args;
- size_t len = strlen(str_arg);
- args += len + 1;
-- str = string(str, end, (char *)str_arg, spec);
-+ str = string(str, end, str_arg, spec);
- break;
- }
-
-diff --git a/localversion-grsec b/localversion-grsec
-new file mode 100644
-index 0000000..7cd6065
---- /dev/null
-+++ b/localversion-grsec
-@@ -0,0 +1 @@
-+-grsec
-diff --git a/mm/Kconfig b/mm/Kconfig
-index 2c19c0b..713bf49 100644
---- a/mm/Kconfig
-+++ b/mm/Kconfig
-@@ -228,8 +228,9 @@ config KSM
- config DEFAULT_MMAP_MIN_ADDR
- int "Low address space to protect from user allocation"
- depends on MMU
-- default 4096
-- help
-+ default 32768 if ALPHA || ARM || PARISC || SPARC32
-+ default 65536
-+ help
- This is the portion of low virtual memory which should be protected
- from userspace allocation. Keeping a user from writing to low pages
- can help reduce the impact of kernel NULL pointer bugs.
-diff --git a/mm/backing-dev.c b/mm/backing-dev.c
-index d824401..9f5244a 100644
---- a/mm/backing-dev.c
-+++ b/mm/backing-dev.c
-@@ -271,7 +271,7 @@ static void bdi_task_init(struct backing_dev_info *bdi,
- list_add_tail_rcu(&wb->list, &bdi->wb_list);
- spin_unlock(&bdi->wb_lock);
-
-- tsk->flags |= PF_FLUSHER | PF_SWAPWRITE;
-+ tsk->flags |= PF_SWAPWRITE;
- set_freezable();
-
- /*
-@@ -489,7 +489,7 @@ static void bdi_add_to_pending(struct rcu_head *head)
- * Add the default flusher task that gets created for any bdi
- * that has dirty data pending writeout
- */
--void static bdi_add_default_flusher_task(struct backing_dev_info *bdi)
-+static void bdi_add_default_flusher_task(struct backing_dev_info *bdi)
- {
- if (!bdi_cap_writeback_dirty(bdi))
- return;
-diff --git a/mm/filemap.c b/mm/filemap.c
-index a1fe378..e26702f 100644
---- a/mm/filemap.c
-+++ b/mm/filemap.c
-@@ -1631,7 +1631,7 @@ int generic_file_mmap(struct file * file, struct vm_area_struct * vma)
- struct address_space *mapping = file->f_mapping;
-
- if (!mapping->a_ops->readpage)
-- return -ENOEXEC;
-+ return -ENODEV;
- file_accessed(file);
- vma->vm_ops = &generic_file_vm_ops;
- vma->vm_flags |= VM_CAN_NONLINEAR;
-@@ -2024,6 +2024,7 @@ inline int generic_write_checks(struct file *file, loff_t *pos, size_t *count, i
- *pos = i_size_read(inode);
-
- if (limit != RLIM_INFINITY) {
-+ gr_learn_resource(current, RLIMIT_FSIZE,*pos, 0);
- if (*pos >= limit) {
- send_sig(SIGXFSZ, current, 0);
- return -EFBIG;
-diff --git a/mm/fremap.c b/mm/fremap.c
-index b6ec85a..a24ac22 100644
---- a/mm/fremap.c
-+++ b/mm/fremap.c
-@@ -153,6 +153,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
- retry:
- vma = find_vma(mm, start);
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (vma && (mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_MAYEXEC))
-+ goto out;
-+#endif
-+
- /*
- * Make sure the vma is shared, that it supports prefaulting,
- * and that the remapped range is valid and fully within
-@@ -221,7 +226,7 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
- /*
- * drop PG_Mlocked flag for over-mapped range
- */
-- unsigned int saved_flags = vma->vm_flags;
-+ unsigned long saved_flags = vma->vm_flags;
- munlock_vma_pages_range(vma, start, start + size);
- vma->vm_flags = saved_flags;
- }
-diff --git a/mm/highmem.c b/mm/highmem.c
-index 9c1e627..5ca9447 100644
---- a/mm/highmem.c
-+++ b/mm/highmem.c
-@@ -116,9 +116,10 @@ static void flush_all_zero_pkmaps(void)
- * So no dangers, even with speculative execution.
- */
- page = pte_page(pkmap_page_table[i]);
-+ pax_open_kernel();
- pte_clear(&init_mm, (unsigned long)page_address(page),
- &pkmap_page_table[i]);
--
-+ pax_close_kernel();
- set_page_address(page, NULL);
- need_flush = 1;
- }
-@@ -177,9 +178,11 @@ start:
- }
- }
- vaddr = PKMAP_ADDR(last_pkmap_nr);
-+
-+ pax_open_kernel();
- set_pte_at(&init_mm, vaddr,
- &(pkmap_page_table[last_pkmap_nr]), mk_pte(page, kmap_prot));
--
-+ pax_close_kernel();
- pkmap_count[last_pkmap_nr] = 1;
- set_page_address(page, (void *)vaddr);
-
-diff --git a/mm/hugetlb.c b/mm/hugetlb.c
-index b435d1f..0c488e1 100644
---- a/mm/hugetlb.c
-+++ b/mm/hugetlb.c
-@@ -2021,6 +2021,26 @@ static int unmap_ref_private(struct mm_struct *mm, struct vm_area_struct *vma,
- return 1;
- }
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+static void pax_mirror_huge_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m)
-+{
-+ struct mm_struct *mm = vma->vm_mm;
-+ struct vm_area_struct *vma_m;
-+ unsigned long address_m;
-+ pte_t *ptep_m;
-+
-+ vma_m = pax_find_mirror_vma(vma);
-+ if (!vma_m)
-+ return;
-+
-+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
-+ address_m = address + SEGMEXEC_TASK_SIZE;
-+ ptep_m = huge_pte_offset(mm, address_m & HPAGE_MASK);
-+ get_page(page_m);
-+ set_huge_pte_at(mm, address_m, ptep_m, make_huge_pte(vma_m, page_m, 0));
-+}
-+#endif
-+
- static int hugetlb_cow(struct mm_struct *mm, struct vm_area_struct *vma,
- unsigned long address, pte_t *ptep, pte_t pte,
- struct page *pagecache_page)
-@@ -2092,6 +2112,11 @@ retry_avoidcopy:
- huge_ptep_clear_flush(vma, address, ptep);
- set_huge_pte_at(mm, address, ptep,
- make_huge_pte(vma, new_page, 1));
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ pax_mirror_huge_pte(vma, address, new_page);
-+#endif
-+
- /* Make the old page be freed below */
- new_page = old_page;
- }
-@@ -2223,6 +2248,10 @@ retry:
- && (vma->vm_flags & VM_SHARED)));
- set_huge_pte_at(mm, address, ptep, new_pte);
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ pax_mirror_huge_pte(vma, address, page);
-+#endif
-+
- if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) {
- /* Optimization, do the COW without a second fault */
- ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page);
-@@ -2251,6 +2280,28 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
- static DEFINE_MUTEX(hugetlb_instantiation_mutex);
- struct hstate *h = hstate_vma(vma);
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m;
-+
-+ vma_m = pax_find_mirror_vma(vma);
-+ if (vma_m) {
-+ unsigned long address_m;
-+
-+ if (vma->vm_start > vma_m->vm_start) {
-+ address_m = address;
-+ address -= SEGMEXEC_TASK_SIZE;
-+ vma = vma_m;
-+ h = hstate_vma(vma);
-+ } else
-+ address_m = address + SEGMEXEC_TASK_SIZE;
-+
-+ if (!huge_pte_alloc(mm, address_m, huge_page_size(h)))
-+ return VM_FAULT_OOM;
-+ address_m &= HPAGE_MASK;
-+ unmap_hugepage_range(vma, address_m, address_m + HPAGE_SIZE, NULL);
-+ }
-+#endif
-+
- ptep = huge_pte_alloc(mm, address, huge_page_size(h));
- if (!ptep)
- return VM_FAULT_OOM;
-diff --git a/mm/internal.h b/mm/internal.h
-index f03e8e2..7354343 100644
---- a/mm/internal.h
-+++ b/mm/internal.h
-@@ -49,6 +49,7 @@ extern void putback_lru_page(struct page *page);
- * in mm/page_alloc.c
- */
- extern void __free_pages_bootmem(struct page *page, unsigned int order);
-+extern void free_compound_page(struct page *page);
- extern void prep_compound_page(struct page *page, unsigned long order);
-
-
-diff --git a/mm/kmemleak.c b/mm/kmemleak.c
-index c346660..33486fe 100644
---- a/mm/kmemleak.c
-+++ b/mm/kmemleak.c
-@@ -358,7 +358,7 @@ static void print_unreferenced(struct seq_file *seq,
-
- for (i = 0; i < object->trace_len; i++) {
- void *ptr = (void *)object->trace[i];
-- seq_printf(seq, " [<%p>] %pS\n", ptr, ptr);
-+ seq_printf(seq, " [<%pP>] %pA\n", ptr, ptr);
- }
- }
-
-@@ -1677,7 +1677,7 @@ static int __init kmemleak_late_init(void)
- return -ENOMEM;
- }
-
-- dentry = debugfs_create_file("kmemleak", S_IRUGO, NULL, NULL,
-+ dentry = debugfs_create_file("kmemleak", S_IRUSR, NULL, NULL,
- &kmemleak_fops);
- if (!dentry)
- pr_warning("Failed to create the debugfs kmemleak file\n");
-diff --git a/mm/maccess.c b/mm/maccess.c
-index 9073695..1127f348 100644
---- a/mm/maccess.c
-+++ b/mm/maccess.c
-@@ -14,7 +14,7 @@
- * Safely read from address @src to the buffer at @dst. If a kernel fault
- * happens, handle that and return -EFAULT.
- */
--long probe_kernel_read(void *dst, void *src, size_t size)
-+long probe_kernel_read(void *dst, const void *src, size_t size)
- {
- long ret;
- mm_segment_t old_fs = get_fs();
-@@ -22,7 +22,7 @@ long probe_kernel_read(void *dst, void *src, size_t size)
- set_fs(KERNEL_DS);
- pagefault_disable();
- ret = __copy_from_user_inatomic(dst,
-- (__force const void __user *)src, size);
-+ (const void __force_user *)src, size);
- pagefault_enable();
- set_fs(old_fs);
-
-@@ -39,14 +39,14 @@ EXPORT_SYMBOL_GPL(probe_kernel_read);
- * Safely write to address @dst from the buffer at @src. If a kernel fault
- * happens, handle that and return -EFAULT.
- */
--long notrace __weak probe_kernel_write(void *dst, void *src, size_t size)
-+long notrace __weak probe_kernel_write(void *dst, const void *src, size_t size)
- {
- long ret;
- mm_segment_t old_fs = get_fs();
-
- set_fs(KERNEL_DS);
- pagefault_disable();
-- ret = __copy_to_user_inatomic((__force void __user *)dst, src, size);
-+ ret = __copy_to_user_inatomic((void __force_user *)dst, src, size);
- pagefault_enable();
- set_fs(old_fs);
-
-diff --git a/mm/madvise.c b/mm/madvise.c
-index e405c5f..c96726f 100644
---- a/mm/madvise.c
-+++ b/mm/madvise.c
-@@ -12,6 +12,7 @@
- #include <linux/hugetlb.h>
- #include <linux/sched.h>
- #include <linux/ksm.h>
-+#include <linux/fs.h>
- #include <linux/file.h>
-
- /*
-@@ -45,6 +46,10 @@ static long madvise_behavior(struct vm_area_struct * vma,
- pgoff_t pgoff;
- unsigned long new_flags = vma->vm_flags;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m;
-+#endif
-+
- switch (behavior) {
- case MADV_NORMAL:
- new_flags = new_flags & ~VM_RAND_READ & ~VM_SEQ_READ;
-@@ -104,6 +109,13 @@ success:
- /*
- * vm_flags is protected by the mmap_sem held in write mode.
- */
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ vma_m = pax_find_mirror_vma(vma);
-+ if (vma_m)
-+ vma_m->vm_flags = new_flags & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT);
-+#endif
-+
- vma->vm_flags = new_flags;
-
- out:
-@@ -162,6 +174,11 @@ static long madvise_dontneed(struct vm_area_struct * vma,
- struct vm_area_struct ** prev,
- unsigned long start, unsigned long end)
- {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m;
-+#endif
-+
- *prev = vma;
- if (vma->vm_flags & (VM_LOCKED|VM_HUGETLB|VM_PFNMAP))
- return -EINVAL;
-@@ -174,6 +191,21 @@ static long madvise_dontneed(struct vm_area_struct * vma,
- zap_page_range(vma, start, end - start, &details);
- } else
- zap_page_range(vma, start, end - start, NULL);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ vma_m = pax_find_mirror_vma(vma);
-+ if (vma_m) {
-+ if (unlikely(vma->vm_flags & VM_NONLINEAR)) {
-+ struct zap_details details = {
-+ .nonlinear_vma = vma_m,
-+ .last_index = ULONG_MAX,
-+ };
-+ zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, &details);
-+ } else
-+ zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, NULL);
-+ }
-+#endif
-+
- return 0;
- }
-
-@@ -225,6 +257,7 @@ static long madvise_remove(struct vm_area_struct *vma,
- error = vmtruncate_range(mapping->host, offset, endoff);
- fput(f);
- down_read(¤t->mm->mmap_sem);
-+ fput(f);
- return error;
- }
-
-@@ -369,6 +402,16 @@ SYSCALL_DEFINE3(madvise, unsigned long, start, size_t, len_in, int, behavior)
- if (end < start)
- goto out;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
-+ if (end > SEGMEXEC_TASK_SIZE)
-+ goto out;
-+ } else
-+#endif
-+
-+ if (end > TASK_SIZE)
-+ goto out;
-+
- error = 0;
- if (end == start)
- goto out;
-diff --git a/mm/memory-failure.c b/mm/memory-failure.c
-index 8aeba53..b4a4198 100644
---- a/mm/memory-failure.c
-+++ b/mm/memory-failure.c
-@@ -46,7 +46,7 @@ int sysctl_memory_failure_early_kill __read_mostly = 0;
-
- int sysctl_memory_failure_recovery __read_mostly = 1;
-
--atomic_long_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
-+atomic_long_unchecked_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
-
- /*
- * Send all the processes who have the page mapped an ``action optional''
-@@ -64,7 +64,7 @@ static int kill_proc_ao(struct task_struct *t, unsigned long addr, int trapno,
- si.si_signo = SIGBUS;
- si.si_errno = 0;
- si.si_code = BUS_MCEERR_AO;
-- si.si_addr = (void *)addr;
-+ si.si_addr = (void __user *)addr;
- #ifdef __ARCH_SI_TRAPNO
- si.si_trapno = trapno;
- #endif
-@@ -745,7 +745,7 @@ int __memory_failure(unsigned long pfn, int trapno, int ref)
- return 0;
- }
-
-- atomic_long_add(1, &mce_bad_pages);
-+ atomic_long_add_unchecked(1, &mce_bad_pages);
-
- /*
- * We need/can do nothing about count=0 pages.
-diff --git a/mm/memory.c b/mm/memory.c
-index 6c836d3..831af24 100644
---- a/mm/memory.c
-+++ b/mm/memory.c
-@@ -187,8 +187,12 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
- return;
-
- pmd = pmd_offset(pud, start);
-+
-+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_PER_CPU_PGD)
- pud_clear(pud);
- pmd_free_tlb(tlb, pmd, start);
-+#endif
-+
- }
-
- static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
-@@ -219,9 +223,12 @@ static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
- if (end - 1 > ceiling - 1)
- return;
-
-+#if !defined(CONFIG_X86_64) || !defined(CONFIG_PAX_PER_CPU_PGD)
- pud = pud_offset(pgd, start);
- pgd_clear(pgd);
- pud_free_tlb(tlb, pud, start);
-+#endif
-+
- }
-
- /*
-@@ -1251,10 +1258,10 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
- (VM_MAYREAD | VM_MAYWRITE) : (VM_READ | VM_WRITE);
- i = 0;
-
-- do {
-+ while (nr_pages) {
- struct vm_area_struct *vma;
-
-- vma = find_extend_vma(mm, start);
-+ vma = find_vma(mm, start);
- if (!vma && in_gate_area(tsk, start)) {
- unsigned long pg = start & PAGE_MASK;
- struct vm_area_struct *gate_vma = get_gate_vma(tsk);
-@@ -1306,7 +1313,7 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
- continue;
- }
-
-- if (!vma ||
-+ if (!vma || start < vma->vm_start ||
- (vma->vm_flags & (VM_IO | VM_PFNMAP)) ||
- !(vm_flags & vma->vm_flags))
- return i ? : -EFAULT;
-@@ -1381,7 +1388,7 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
- start += PAGE_SIZE;
- nr_pages--;
- } while (nr_pages && start < vma->vm_end);
-- } while (nr_pages);
-+ }
- return i;
- }
-
-@@ -1526,6 +1533,10 @@ static int insert_page(struct vm_area_struct *vma, unsigned long addr,
- page_add_file_rmap(page);
- set_pte_at(mm, addr, pte, mk_pte(page, prot));
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ pax_mirror_file_pte(vma, addr, page, ptl);
-+#endif
-+
- retval = 0;
- pte_unmap_unlock(pte, ptl);
- return retval;
-@@ -1560,10 +1571,22 @@ out:
- int vm_insert_page(struct vm_area_struct *vma, unsigned long addr,
- struct page *page)
- {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m;
-+#endif
-+
- if (addr < vma->vm_start || addr >= vma->vm_end)
- return -EFAULT;
- if (!page_count(page))
- return -EINVAL;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ vma_m = pax_find_mirror_vma(vma);
-+ if (vma_m)
-+ vma_m->vm_flags |= VM_INSERTPAGE;
-+#endif
-+
- vma->vm_flags |= VM_INSERTPAGE;
- return insert_page(vma, addr, page, vma->vm_page_prot);
- }
-@@ -1649,6 +1672,7 @@ int vm_insert_mixed(struct vm_area_struct *vma, unsigned long addr,
- unsigned long pfn)
- {
- BUG_ON(!(vma->vm_flags & VM_MIXEDMAP));
-+ BUG_ON(vma->vm_mirror);
-
- if (addr < vma->vm_start || addr >= vma->vm_end)
- return -EFAULT;
-@@ -1811,6 +1835,53 @@ int remap_pfn_range(struct vm_area_struct *vma, unsigned long addr,
- }
- EXPORT_SYMBOL(remap_pfn_range);
-
-+/**
-+ * vm_iomap_memory - remap memory to userspace
-+ * @vma: user vma to map to
-+ * @start: start of area
-+ * @len: size of area
-+ *
-+ * This is a simplified io_remap_pfn_range() for common driver use. The
-+ * driver just needs to give us the physical memory range to be mapped,
-+ * we'll figure out the rest from the vma information.
-+ *
-+ * NOTE! Some drivers might want to tweak vma->vm_page_prot first to get
-+ * whatever write-combining details or similar.
-+ */
-+int vm_iomap_memory(struct vm_area_struct *vma, phys_addr_t start, unsigned long len)
-+{
-+ unsigned long vm_len, pfn, pages;
-+
-+ /* Check that the physical memory area passed in looks valid */
-+ if (start + len < start)
-+ return -EINVAL;
-+ /*
-+ * You *really* shouldn't map things that aren't page-aligned,
-+ * but we've historically allowed it because IO memory might
-+ * just have smaller alignment.
-+ */
-+ len += start & ~PAGE_MASK;
-+ pfn = start >> PAGE_SHIFT;
-+ pages = (len + ~PAGE_MASK) >> PAGE_SHIFT;
-+ if (pfn + pages < pfn)
-+ return -EINVAL;
-+
-+ /* We start the mapping 'vm_pgoff' pages into the area */
-+ if (vma->vm_pgoff > pages)
-+ return -EINVAL;
-+ pfn += vma->vm_pgoff;
-+ pages -= vma->vm_pgoff;
-+
-+ /* Can we fit all of the mapping? */
-+ vm_len = vma->vm_end - vma->vm_start;
-+ if (vm_len >> PAGE_SHIFT > pages)
-+ return -EINVAL;
-+
-+ /* Ok, let it rip */
-+ return io_remap_pfn_range(vma, vma->vm_start, pfn, vm_len, vma->vm_page_prot);
-+}
-+EXPORT_SYMBOL(vm_iomap_memory);
-+
- static int apply_to_pte_range(struct mm_struct *mm, pmd_t *pmd,
- unsigned long addr, unsigned long end,
- pte_fn_t fn, void *data)
-@@ -1855,7 +1926,9 @@ static int apply_to_pmd_range(struct mm_struct *mm, pud_t *pud,
-
- BUG_ON(pud_huge(*pud));
-
-- pmd = pmd_alloc(mm, pud, addr);
-+ pmd = (mm == &init_mm) ?
-+ pmd_alloc_kernel(mm, pud, addr) :
-+ pmd_alloc(mm, pud, addr);
- if (!pmd)
- return -ENOMEM;
- do {
-@@ -1875,7 +1948,9 @@ static int apply_to_pud_range(struct mm_struct *mm, pgd_t *pgd,
- unsigned long next;
- int err;
-
-- pud = pud_alloc(mm, pgd, addr);
-+ pud = (mm == &init_mm) ?
-+ pud_alloc_kernel(mm, pgd, addr) :
-+ pud_alloc(mm, pgd, addr);
- if (!pud)
- return -ENOMEM;
- do {
-@@ -1977,6 +2052,186 @@ static inline void cow_user_page(struct page *dst, struct page *src, unsigned lo
- copy_user_highpage(dst, src, va, vma);
- }
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+static void pax_unmap_mirror_pte(struct vm_area_struct *vma, unsigned long address, pmd_t *pmd)
-+{
-+ struct mm_struct *mm = vma->vm_mm;
-+ spinlock_t *ptl;
-+ pte_t *pte, entry;
-+
-+ pte = pte_offset_map_lock(mm, pmd, address, &ptl);
-+ entry = *pte;
-+ if (!pte_present(entry)) {
-+ if (!pte_none(entry)) {
-+ BUG_ON(pte_file(entry));
-+ free_swap_and_cache(pte_to_swp_entry(entry));
-+ pte_clear_not_present_full(mm, address, pte, 0);
-+ }
-+ } else {
-+ struct page *page;
-+
-+ flush_cache_page(vma, address, pte_pfn(entry));
-+ entry = ptep_clear_flush(vma, address, pte);
-+ BUG_ON(pte_dirty(entry));
-+ page = vm_normal_page(vma, address, entry);
-+ if (page) {
-+ update_hiwater_rss(mm);
-+ if (PageAnon(page))
-+ dec_mm_counter(mm, anon_rss);
-+ else
-+ dec_mm_counter(mm, file_rss);
-+ page_remove_rmap(page);
-+ page_cache_release(page);
-+ }
-+ }
-+ pte_unmap_unlock(pte, ptl);
-+}
-+
-+/* PaX: if vma is mirrored, synchronize the mirror's PTE
-+ *
-+ * the ptl of the lower mapped page is held on entry and is not released on exit
-+ * or inside to ensure atomic changes to the PTE states (swapout, mremap, munmap, etc)
-+ */
-+static void pax_mirror_anon_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
-+{
-+ struct mm_struct *mm = vma->vm_mm;
-+ unsigned long address_m;
-+ spinlock_t *ptl_m;
-+ struct vm_area_struct *vma_m;
-+ pmd_t *pmd_m;
-+ pte_t *pte_m, entry_m;
-+
-+ BUG_ON(!page_m || !PageAnon(page_m));
-+
-+ vma_m = pax_find_mirror_vma(vma);
-+ if (!vma_m)
-+ return;
-+
-+ BUG_ON(!PageLocked(page_m));
-+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
-+ address_m = address + SEGMEXEC_TASK_SIZE;
-+ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
-+ pte_m = pte_offset_map_nested(pmd_m, address_m);
-+ ptl_m = pte_lockptr(mm, pmd_m);
-+ if (ptl != ptl_m) {
-+ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
-+ if (!pte_none(*pte_m))
-+ goto out;
-+ }
-+
-+ entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
-+ page_cache_get(page_m);
-+ page_add_anon_rmap(page_m, vma_m, address_m);
-+ inc_mm_counter(mm, anon_rss);
-+ set_pte_at(mm, address_m, pte_m, entry_m);
-+ update_mmu_cache(vma_m, address_m, entry_m);
-+out:
-+ if (ptl != ptl_m)
-+ spin_unlock(ptl_m);
-+ pte_unmap_nested(pte_m);
-+ unlock_page(page_m);
-+}
-+
-+void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
-+{
-+ struct mm_struct *mm = vma->vm_mm;
-+ unsigned long address_m;
-+ spinlock_t *ptl_m;
-+ struct vm_area_struct *vma_m;
-+ pmd_t *pmd_m;
-+ pte_t *pte_m, entry_m;
-+
-+ BUG_ON(!page_m || PageAnon(page_m));
-+
-+ vma_m = pax_find_mirror_vma(vma);
-+ if (!vma_m)
-+ return;
-+
-+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
-+ address_m = address + SEGMEXEC_TASK_SIZE;
-+ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
-+ pte_m = pte_offset_map_nested(pmd_m, address_m);
-+ ptl_m = pte_lockptr(mm, pmd_m);
-+ if (ptl != ptl_m) {
-+ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
-+ if (!pte_none(*pte_m))
-+ goto out;
-+ }
-+
-+ entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
-+ page_cache_get(page_m);
-+ page_add_file_rmap(page_m);
-+ inc_mm_counter(mm, file_rss);
-+ set_pte_at(mm, address_m, pte_m, entry_m);
-+ update_mmu_cache(vma_m, address_m, entry_m);
-+out:
-+ if (ptl != ptl_m)
-+ spin_unlock(ptl_m);
-+ pte_unmap_nested(pte_m);
-+}
-+
-+static void pax_mirror_pfn_pte(struct vm_area_struct *vma, unsigned long address, unsigned long pfn_m, spinlock_t *ptl)
-+{
-+ struct mm_struct *mm = vma->vm_mm;
-+ unsigned long address_m;
-+ spinlock_t *ptl_m;
-+ struct vm_area_struct *vma_m;
-+ pmd_t *pmd_m;
-+ pte_t *pte_m, entry_m;
-+
-+ vma_m = pax_find_mirror_vma(vma);
-+ if (!vma_m)
-+ return;
-+
-+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
-+ address_m = address + SEGMEXEC_TASK_SIZE;
-+ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
-+ pte_m = pte_offset_map_nested(pmd_m, address_m);
-+ ptl_m = pte_lockptr(mm, pmd_m);
-+ if (ptl != ptl_m) {
-+ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
-+ if (!pte_none(*pte_m))
-+ goto out;
-+ }
-+
-+ entry_m = pfn_pte(pfn_m, vma_m->vm_page_prot);
-+ set_pte_at(mm, address_m, pte_m, entry_m);
-+out:
-+ if (ptl != ptl_m)
-+ spin_unlock(ptl_m);
-+ pte_unmap_nested(pte_m);
-+}
-+
-+static void pax_mirror_pte(struct vm_area_struct *vma, unsigned long address, pte_t *pte, pmd_t *pmd, spinlock_t *ptl)
-+{
-+ struct page *page_m;
-+ pte_t entry;
-+
-+ if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC))
-+ goto out;
-+
-+ entry = *pte;
-+ page_m = vm_normal_page(vma, address, entry);
-+ if (!page_m)
-+ pax_mirror_pfn_pte(vma, address, pte_pfn(entry), ptl);
-+ else if (PageAnon(page_m)) {
-+ if (pax_find_mirror_vma(vma)) {
-+ pte_unmap_unlock(pte, ptl);
-+ lock_page(page_m);
-+ pte = pte_offset_map_lock(vma->vm_mm, pmd, address, &ptl);
-+ if (pte_same(entry, *pte))
-+ pax_mirror_anon_pte(vma, address, page_m, ptl);
-+ else
-+ unlock_page(page_m);
-+ }
-+ } else
-+ pax_mirror_file_pte(vma, address, page_m, ptl);
-+
-+out:
-+ pte_unmap_unlock(pte, ptl);
-+}
-+#endif
-+
- /*
- * This routine handles present pages, when users try to write
- * to a shared page. It is done by copying the page to a new address
-@@ -2156,6 +2411,12 @@ gotten:
- */
- page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
- if (likely(pte_same(*page_table, orig_pte))) {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (pax_find_mirror_vma(vma))
-+ BUG_ON(!trylock_page(new_page));
-+#endif
-+
- if (old_page) {
- if (!PageAnon(old_page)) {
- dec_mm_counter(mm, file_rss);
-@@ -2207,6 +2468,10 @@ gotten:
- page_remove_rmap(old_page);
- }
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ pax_mirror_anon_pte(vma, address, new_page, ptl);
-+#endif
-+
- /* Free the old page.. */
- new_page = old_page;
- ret |= VM_FAULT_WRITE;
-@@ -2606,6 +2871,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
- swap_free(entry);
- if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
- try_to_free_swap(page);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((flags & FAULT_FLAG_WRITE) || !pax_find_mirror_vma(vma))
-+#endif
-+
- unlock_page(page);
-
- if (flags & FAULT_FLAG_WRITE) {
-@@ -2617,6 +2887,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
-
- /* No need to invalidate - it was non-present before */
- update_mmu_cache(vma, address, pte);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ pax_mirror_anon_pte(vma, address, page, ptl);
-+#endif
-+
- unlock:
- pte_unmap_unlock(page_table, ptl);
- out:
-@@ -2632,40 +2907,6 @@ out_release:
- }
-
- /*
-- * This is like a special single-page "expand_{down|up}wards()",
-- * except we must first make sure that 'address{-|+}PAGE_SIZE'
-- * doesn't hit another vma.
-- */
--static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address)
--{
-- address &= PAGE_MASK;
-- if ((vma->vm_flags & VM_GROWSDOWN) && address == vma->vm_start) {
-- struct vm_area_struct *prev = vma->vm_prev;
--
-- /*
-- * Is there a mapping abutting this one below?
-- *
-- * That's only ok if it's the same stack mapping
-- * that has gotten split..
-- */
-- if (prev && prev->vm_end == address)
-- return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
--
-- expand_stack(vma, address - PAGE_SIZE);
-- }
-- if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
-- struct vm_area_struct *next = vma->vm_next;
--
-- /* As VM_GROWSDOWN but s/below/above/ */
-- if (next && next->vm_start == address + PAGE_SIZE)
-- return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
--
-- expand_upwards(vma, address + PAGE_SIZE);
-- }
-- return 0;
--}
--
--/*
- * We enter with non-exclusive mmap_sem (to exclude vma changes,
- * but allow concurrent faults), and pte mapped but not yet locked.
- * We return with mmap_sem still held, but pte unmapped and unlocked.
-@@ -2674,27 +2915,23 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
- unsigned long address, pte_t *page_table, pmd_t *pmd,
- unsigned int flags)
- {
-- struct page *page;
-+ struct page *page = NULL;
- spinlock_t *ptl;
- pte_t entry;
-
-- pte_unmap(page_table);
--
-- /* Check if we need to add a guard page to the stack */
-- if (check_stack_guard_page(vma, address) < 0)
-- return VM_FAULT_SIGBUS;
--
-- /* Use the zero-page for reads */
- if (!(flags & FAULT_FLAG_WRITE)) {
- entry = pte_mkspecial(pfn_pte(my_zero_pfn(address),
- vma->vm_page_prot));
-- page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
-+ ptl = pte_lockptr(mm, pmd);
-+ spin_lock(ptl);
- if (!pte_none(*page_table))
- goto unlock;
- goto setpte;
- }
-
- /* Allocate our own private page. */
-+ pte_unmap(page_table);
-+
- if (unlikely(anon_vma_prepare(vma)))
- goto oom;
- page = alloc_zeroed_user_highpage_movable(vma, address);
-@@ -2713,6 +2950,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
- if (!pte_none(*page_table))
- goto release;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (pax_find_mirror_vma(vma))
-+ BUG_ON(!trylock_page(page));
-+#endif
-+
- inc_mm_counter(mm, anon_rss);
- page_add_new_anon_rmap(page, vma, address);
- setpte:
-@@ -2720,6 +2962,12 @@ setpte:
-
- /* No need to invalidate - it was non-present before */
- update_mmu_cache(vma, address, entry);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (page)
-+ pax_mirror_anon_pte(vma, address, page, ptl);
-+#endif
-+
- unlock:
- pte_unmap_unlock(page_table, ptl);
- return 0;
-@@ -2862,6 +3110,12 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
- */
- /* Only go through if we didn't race with anybody else... */
- if (likely(pte_same(*page_table, orig_pte))) {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (anon && pax_find_mirror_vma(vma))
-+ BUG_ON(!trylock_page(page));
-+#endif
-+
- flush_icache_page(vma, page);
- entry = mk_pte(page, vma->vm_page_prot);
- if (flags & FAULT_FLAG_WRITE)
-@@ -2881,6 +3135,14 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
-
- /* no need to invalidate: a not-present page won't be cached */
- update_mmu_cache(vma, address, entry);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (anon)
-+ pax_mirror_anon_pte(vma, address, page, ptl);
-+ else
-+ pax_mirror_file_pte(vma, address, page, ptl);
-+#endif
-+
- } else {
- if (charged)
- mem_cgroup_uncharge_page(page);
-@@ -3028,6 +3290,12 @@ static inline int handle_pte_fault(struct mm_struct *mm,
- if (flags & FAULT_FLAG_WRITE)
- flush_tlb_page(vma, address);
- }
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ pax_mirror_pte(vma, address, pte, pmd, ptl);
-+ return 0;
-+#endif
-+
- unlock:
- pte_unmap_unlock(pte, ptl);
- return 0;
-@@ -3044,6 +3312,10 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
- pmd_t *pmd;
- pte_t *pte;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m;
-+#endif
-+
- __set_current_state(TASK_RUNNING);
-
- count_vm_event(PGFAULT);
-@@ -3051,6 +3323,34 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
- if (unlikely(is_vm_hugetlb_page(vma)))
- return hugetlb_fault(mm, vma, address, flags);
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ vma_m = pax_find_mirror_vma(vma);
-+ if (vma_m) {
-+ unsigned long address_m;
-+ pgd_t *pgd_m;
-+ pud_t *pud_m;
-+ pmd_t *pmd_m;
-+
-+ if (vma->vm_start > vma_m->vm_start) {
-+ address_m = address;
-+ address -= SEGMEXEC_TASK_SIZE;
-+ vma = vma_m;
-+ } else
-+ address_m = address + SEGMEXEC_TASK_SIZE;
-+
-+ pgd_m = pgd_offset(mm, address_m);
-+ pud_m = pud_alloc(mm, pgd_m, address_m);
-+ if (!pud_m)
-+ return VM_FAULT_OOM;
-+ pmd_m = pmd_alloc(mm, pud_m, address_m);
-+ if (!pmd_m)
-+ return VM_FAULT_OOM;
-+ if (!pmd_present(*pmd_m) && __pte_alloc(mm, pmd_m, address_m))
-+ return VM_FAULT_OOM;
-+ pax_unmap_mirror_pte(vma_m, address_m, pmd_m);
-+ }
-+#endif
-+
- pgd = pgd_offset(mm, address);
- pud = pud_alloc(mm, pgd, address);
- if (!pud)
-@@ -3086,6 +3386,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
- spin_unlock(&mm->page_table_lock);
- return 0;
- }
-+
-+int __pud_alloc_kernel(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
-+{
-+ pud_t *new = pud_alloc_one(mm, address);
-+ if (!new)
-+ return -ENOMEM;
-+
-+ smp_wmb(); /* See comment in __pte_alloc */
-+
-+ spin_lock(&mm->page_table_lock);
-+ if (pgd_present(*pgd)) /* Another has populated it */
-+ pud_free(mm, new);
-+ else
-+ pgd_populate_kernel(mm, pgd, new);
-+ spin_unlock(&mm->page_table_lock);
-+ return 0;
-+}
- #endif /* __PAGETABLE_PUD_FOLDED */
-
- #ifndef __PAGETABLE_PMD_FOLDED
-@@ -3116,6 +3433,30 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
- spin_unlock(&mm->page_table_lock);
- return 0;
- }
-+
-+int __pmd_alloc_kernel(struct mm_struct *mm, pud_t *pud, unsigned long address)
-+{
-+ pmd_t *new = pmd_alloc_one(mm, address);
-+ if (!new)
-+ return -ENOMEM;
-+
-+ smp_wmb(); /* See comment in __pte_alloc */
-+
-+ spin_lock(&mm->page_table_lock);
-+#ifndef __ARCH_HAS_4LEVEL_HACK
-+ if (pud_present(*pud)) /* Another has populated it */
-+ pmd_free(mm, new);
-+ else
-+ pud_populate_kernel(mm, pud, new);
-+#else
-+ if (pgd_present(*pud)) /* Another has populated it */
-+ pmd_free(mm, new);
-+ else
-+ pgd_populate_kernel(mm, pud, new);
-+#endif /* __ARCH_HAS_4LEVEL_HACK */
-+ spin_unlock(&mm->page_table_lock);
-+ return 0;
-+}
- #endif /* __PAGETABLE_PMD_FOLDED */
-
- int make_pages_present(unsigned long addr, unsigned long end)
-@@ -3148,7 +3489,7 @@ static int __init gate_vma_init(void)
- gate_vma.vm_start = FIXADDR_USER_START;
- gate_vma.vm_end = FIXADDR_USER_END;
- gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
-- gate_vma.vm_page_prot = __P101;
-+ gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
- /*
- * Make sure the vDSO gets into every core dump.
- * Dumping its contents makes post-mortem fully interpretable later
-diff --git a/mm/mempolicy.c b/mm/mempolicy.c
-index df6602f..72643c6 100644
---- a/mm/mempolicy.c
-+++ b/mm/mempolicy.c
-@@ -573,6 +573,10 @@ static int mbind_range(struct vm_area_struct *vma, unsigned long start,
- struct vm_area_struct *next;
- int err;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m;
-+#endif
-+
- err = 0;
- for (; vma && vma->vm_start < end; vma = next) {
- next = vma->vm_next;
-@@ -584,6 +588,16 @@ static int mbind_range(struct vm_area_struct *vma, unsigned long start,
- err = policy_vma(vma, new);
- if (err)
- break;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ vma_m = pax_find_mirror_vma(vma);
-+ if (vma_m) {
-+ err = policy_vma(vma_m, new);
-+ if (err)
-+ break;
-+ }
-+#endif
-+
- }
- return err;
- }
-@@ -1002,6 +1016,17 @@ static long do_mbind(unsigned long start, unsigned long len,
-
- if (end < start)
- return -EINVAL;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC) {
-+ if (end > SEGMEXEC_TASK_SIZE)
-+ return -EINVAL;
-+ } else
-+#endif
-+
-+ if (end > TASK_SIZE)
-+ return -EINVAL;
-+
- if (end == start)
- return 0;
-
-@@ -1207,6 +1232,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
- if (!mm)
- return -EINVAL;
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ if (mm != current->mm &&
-+ (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
-+ err = -EPERM;
-+ goto out;
-+ }
-+#endif
-+
- /*
- * Check if this process has the right to modify the specified
- * process. The right exists if the process has administrative
-@@ -1216,8 +1249,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
- rcu_read_lock();
- tcred = __task_cred(task);
- if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
-- cred->uid != tcred->suid && cred->uid != tcred->uid &&
-- !capable(CAP_SYS_NICE)) {
-+ cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
- rcu_read_unlock();
- err = -EPERM;
- goto out;
-@@ -2362,6 +2394,12 @@ static inline void check_huge_range(struct vm_area_struct *vma,
- }
- #endif
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
-+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
-+ _mm->pax_flags & MF_PAX_SEGMEXEC))
-+#endif
-+
- /*
- * Display pages allocated per node and memory policy via /proc.
- */
-@@ -2376,6 +2414,13 @@ int show_numa_map(struct seq_file *m, void *v)
- int n;
- char buffer[50];
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ if (current->exec_id != m->exec_id) {
-+ gr_log_badprocpid("numa_maps");
-+ return 0;
-+ }
-+#endif
-+
- if (!mm)
- return 0;
-
-@@ -2387,11 +2432,15 @@ int show_numa_map(struct seq_file *m, void *v)
- mpol_to_str(buffer, sizeof(buffer), pol, 0);
- mpol_cond_put(pol);
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ seq_printf(m, "%08lx %s", PAX_RAND_FLAGS(vma->vm_mm) ? 0UL : vma->vm_start, buffer);
-+#else
- seq_printf(m, "%08lx %s", vma->vm_start, buffer);
-+#endif
-
- if (file) {
- seq_printf(m, " file=");
-- seq_path(m, &file->f_path, "\n\t= ");
-+ seq_path(m, &file->f_path, "\n\t\\= ");
- } else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
- seq_printf(m, " heap");
- } else if (vma->vm_start <= mm->start_stack &&
-diff --git a/mm/migrate.c b/mm/migrate.c
-index aaca868..2ebecdc 100644
---- a/mm/migrate.c
-+++ b/mm/migrate.c
-@@ -916,6 +916,8 @@ static int do_pages_move(struct mm_struct *mm, struct task_struct *task,
- unsigned long chunk_start;
- int err;
-
-+ pax_track_stack();
-+
- task_nodes = cpuset_mems_allowed(task);
-
- err = -ENOMEM;
-@@ -1106,6 +1108,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
- if (!mm)
- return -EINVAL;
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ if (mm != current->mm &&
-+ (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
-+ err = -EPERM;
-+ goto out;
-+ }
-+#endif
-+
- /*
- * Check if this process has the right to modify the specified
- * process. The right exists if the process has administrative
-@@ -1115,8 +1125,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
- rcu_read_lock();
- tcred = __task_cred(task);
- if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
-- cred->uid != tcred->suid && cred->uid != tcred->uid &&
-- !capable(CAP_SYS_NICE)) {
-+ cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
- rcu_read_unlock();
- err = -EPERM;
- goto out;
-diff --git a/mm/mlock.c b/mm/mlock.c
-index 2d846cf..1183f13 100644
---- a/mm/mlock.c
-+++ b/mm/mlock.c
-@@ -13,6 +13,7 @@
- #include <linux/pagemap.h>
- #include <linux/mempolicy.h>
- #include <linux/syscalls.h>
-+#include <linux/security.h>
- #include <linux/sched.h>
- #include <linux/module.h>
- #include <linux/rmap.h>
-@@ -138,13 +139,6 @@ void munlock_vma_page(struct page *page)
- }
- }
-
--static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
--{
-- return (vma->vm_flags & VM_GROWSDOWN) &&
-- (vma->vm_start == addr) &&
-- !vma_stack_continue(vma->vm_prev, addr);
--}
--
- /**
- * __mlock_vma_pages_range() - mlock a range of pages in the vma.
- * @vma: target vma
-@@ -177,12 +171,6 @@ static long __mlock_vma_pages_range(struct vm_area_struct *vma,
- if (vma->vm_flags & VM_WRITE)
- gup_flags |= FOLL_WRITE;
-
-- /* We don't try to access the guard page of a stack vma */
-- if (stack_guard_page(vma, start)) {
-- addr += PAGE_SIZE;
-- nr_pages--;
-- }
--
- while (nr_pages > 0) {
- int i;
-
-@@ -440,7 +428,7 @@ static int do_mlock(unsigned long start, size_t len, int on)
- {
- unsigned long nstart, end, tmp;
- struct vm_area_struct * vma, * prev;
-- int error;
-+ int error = 0;
-
- len = PAGE_ALIGN(len);
- end = start + len;
-@@ -448,6 +436,9 @@ static int do_mlock(unsigned long start, size_t len, int on)
- return -EINVAL;
- if (end == start)
- return 0;
-+ if (end > TASK_SIZE)
-+ return -EINVAL;
-+
- vma = find_vma_prev(current->mm, start, &prev);
- if (!vma || vma->vm_start > start)
- return -ENOMEM;
-@@ -458,6 +449,11 @@ static int do_mlock(unsigned long start, size_t len, int on)
- for (nstart = start ; ; ) {
- unsigned int newflags;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
-+ break;
-+#endif
-+
- /* Here we know that vma->vm_start <= nstart < vma->vm_end. */
-
- newflags = vma->vm_flags | VM_LOCKED;
-@@ -507,6 +503,7 @@ SYSCALL_DEFINE2(mlock, unsigned long, start, size_t, len)
- lock_limit >>= PAGE_SHIFT;
-
- /* check against resource limits */
-+ gr_learn_resource(current, RLIMIT_MEMLOCK, (current->mm->locked_vm << PAGE_SHIFT) + len, 1);
- if ((locked <= lock_limit) || capable(CAP_IPC_LOCK))
- error = do_mlock(start, len, 1);
- up_write(¤t->mm->mmap_sem);
-@@ -528,16 +525,21 @@ SYSCALL_DEFINE2(munlock, unsigned long, start, size_t, len)
- static int do_mlockall(int flags)
- {
- struct vm_area_struct * vma, * prev = NULL;
-- unsigned int def_flags = 0;
-
- if (flags & MCL_FUTURE)
-- def_flags = VM_LOCKED;
-- current->mm->def_flags = def_flags;
-+ current->mm->def_flags |= VM_LOCKED;
-+ else
-+ current->mm->def_flags &= ~VM_LOCKED;
- if (flags == MCL_FUTURE)
- goto out;
-
- for (vma = current->mm->mmap; vma ; vma = prev->vm_next) {
-- unsigned int newflags;
-+ unsigned long newflags;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
-+ break;
-+#endif
-
- newflags = vma->vm_flags | VM_LOCKED;
- if (!(flags & MCL_CURRENT))
-@@ -545,6 +547,7 @@ static int do_mlockall(int flags)
-
- /* Ignore errors */
- mlock_fixup(vma, &prev, vma->vm_start, vma->vm_end, newflags);
-+ cond_resched();
- }
- out:
- return 0;
-@@ -570,6 +573,7 @@ SYSCALL_DEFINE1(mlockall, int, flags)
- lock_limit >>= PAGE_SHIFT;
-
- ret = -ENOMEM;
-+ gr_learn_resource(current, RLIMIT_MEMLOCK, current->mm->total_vm << PAGE_SHIFT, 1);
- if (!(flags & MCL_CURRENT) || (current->mm->total_vm <= lock_limit) ||
- capable(CAP_IPC_LOCK))
- ret = do_mlockall(flags);
-diff --git a/mm/mmap.c b/mm/mmap.c
-index 4b80cbf..5121f9e 100644
---- a/mm/mmap.c
-+++ b/mm/mmap.c
-@@ -29,6 +29,7 @@
- #include <linux/rmap.h>
- #include <linux/mmu_notifier.h>
- #include <linux/perf_event.h>
-+#include <linux/random.h>
-
- #include <asm/uaccess.h>
- #include <asm/cacheflush.h>
-@@ -45,6 +46,16 @@
- #define arch_rebalance_pgtables(addr, len) (addr)
- #endif
-
-+static inline void verify_mm_writelocked(struct mm_struct *mm)
-+{
-+#if defined(CONFIG_DEBUG_VM) || defined(CONFIG_PAX)
-+ if (unlikely(down_read_trylock(&mm->mmap_sem))) {
-+ up_read(&mm->mmap_sem);
-+ BUG();
-+ }
-+#endif
-+}
-+
- static void unmap_region(struct mm_struct *mm,
- struct vm_area_struct *vma, struct vm_area_struct *prev,
- unsigned long start, unsigned long end);
-@@ -70,22 +81,32 @@ static void unmap_region(struct mm_struct *mm,
- * x: (no) no x: (no) yes x: (no) yes x: (yes) yes
- *
- */
--pgprot_t protection_map[16] = {
-+pgprot_t protection_map[16] __read_only = {
- __P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111,
- __S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111
- };
-
- pgprot_t vm_get_page_prot(unsigned long vm_flags)
- {
-- return __pgprot(pgprot_val(protection_map[vm_flags &
-+ pgprot_t prot = __pgprot(pgprot_val(protection_map[vm_flags &
- (VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |
- pgprot_val(arch_vm_get_page_prot(vm_flags)));
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
-+ if (!nx_enabled &&
-+ (vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC &&
-+ (vm_flags & (VM_READ | VM_WRITE)))
-+ prot = __pgprot(pte_val(pte_exprotect(__pte(pgprot_val(prot)))));
-+#endif
-+
-+ return prot;
- }
- EXPORT_SYMBOL(vm_get_page_prot);
-
- int sysctl_overcommit_memory = OVERCOMMIT_GUESS; /* heuristic overcommit */
- int sysctl_overcommit_ratio = 50; /* default is 50% */
- int sysctl_max_map_count __read_mostly = DEFAULT_MAX_MAP_COUNT;
-+unsigned long sysctl_heap_stack_gap __read_mostly = 64*1024;
- struct percpu_counter vm_committed_as;
-
- /*
-@@ -231,6 +252,7 @@ static struct vm_area_struct *remove_vma(struct vm_area_struct *vma)
- struct vm_area_struct *next = vma->vm_next;
-
- might_sleep();
-+ BUG_ON(vma->vm_mirror);
- if (vma->vm_ops && vma->vm_ops->close)
- vma->vm_ops->close(vma);
- if (vma->vm_file) {
-@@ -267,6 +289,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
- * not page aligned -Ram Gupta
- */
- rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
-+ gr_learn_resource(current, RLIMIT_DATA, (brk - mm->start_brk) + (mm->end_data - mm->start_data), 1);
- if (rlim < RLIM_INFINITY && (brk - mm->start_brk) +
- (mm->end_data - mm->start_data) > rlim)
- goto out;
-@@ -704,6 +727,12 @@ static int
- can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
- struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
- {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_start == SEGMEXEC_TASK_SIZE)
-+ return 0;
-+#endif
-+
- if (is_mergeable_vma(vma, file, vm_flags) &&
- is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
- if (vma->vm_pgoff == vm_pgoff)
-@@ -723,6 +752,12 @@ static int
- can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
- struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
- {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end == SEGMEXEC_TASK_SIZE)
-+ return 0;
-+#endif
-+
- if (is_mergeable_vma(vma, file, vm_flags) &&
- is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
- pgoff_t vm_pglen;
-@@ -765,12 +800,19 @@ can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
- struct vm_area_struct *vma_merge(struct mm_struct *mm,
- struct vm_area_struct *prev, unsigned long addr,
- unsigned long end, unsigned long vm_flags,
-- struct anon_vma *anon_vma, struct file *file,
-+ struct anon_vma *anon_vma, struct file *file,
- pgoff_t pgoff, struct mempolicy *policy)
- {
- pgoff_t pglen = (end - addr) >> PAGE_SHIFT;
- struct vm_area_struct *area, *next;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE, end_m = end + SEGMEXEC_TASK_SIZE;
-+ struct vm_area_struct *area_m = NULL, *next_m = NULL, *prev_m = NULL;
-+
-+ BUG_ON((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE < end);
-+#endif
-+
- /*
- * We later require that vma->vm_flags == vm_flags,
- * so this tests vma->vm_flags & VM_SPECIAL, too.
-@@ -786,6 +828,15 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
- if (next && next->vm_end == end) /* cases 6, 7, 8 */
- next = next->vm_next;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (prev)
-+ prev_m = pax_find_mirror_vma(prev);
-+ if (area)
-+ area_m = pax_find_mirror_vma(area);
-+ if (next)
-+ next_m = pax_find_mirror_vma(next);
-+#endif
-+
- /*
- * Can it merge with the predecessor?
- */
-@@ -805,9 +856,24 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
- /* cases 1, 6 */
- vma_adjust(prev, prev->vm_start,
- next->vm_end, prev->vm_pgoff, NULL);
-- } else /* cases 2, 5, 7 */
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (prev_m)
-+ vma_adjust(prev_m, prev_m->vm_start,
-+ next_m->vm_end, prev_m->vm_pgoff, NULL);
-+#endif
-+
-+ } else { /* cases 2, 5, 7 */
- vma_adjust(prev, prev->vm_start,
- end, prev->vm_pgoff, NULL);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (prev_m)
-+ vma_adjust(prev_m, prev_m->vm_start,
-+ end_m, prev_m->vm_pgoff, NULL);
-+#endif
-+
-+ }
- return prev;
- }
-
-@@ -818,12 +884,27 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
- mpol_equal(policy, vma_policy(next)) &&
- can_vma_merge_before(next, vm_flags,
- anon_vma, file, pgoff+pglen)) {
-- if (prev && addr < prev->vm_end) /* case 4 */
-+ if (prev && addr < prev->vm_end) { /* case 4 */
- vma_adjust(prev, prev->vm_start,
- addr, prev->vm_pgoff, NULL);
-- else /* cases 3, 8 */
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (prev_m)
-+ vma_adjust(prev_m, prev_m->vm_start,
-+ addr_m, prev_m->vm_pgoff, NULL);
-+#endif
-+
-+ } else { /* cases 3, 8 */
- vma_adjust(area, addr, next->vm_end,
- next->vm_pgoff - pglen, NULL);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (area_m)
-+ vma_adjust(area_m, addr_m, next_m->vm_end,
-+ next_m->vm_pgoff - pglen, NULL);
-+#endif
-+
-+ }
- return area;
- }
-
-@@ -898,15 +979,22 @@ none:
- void vm_stat_account(struct mm_struct *mm, unsigned long flags,
- struct file *file, long pages)
- {
-- const unsigned long stack_flags
-- = VM_STACK_FLAGS & (VM_GROWSUP|VM_GROWSDOWN);
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(mm->pax_flags & MF_PAX_RANDMMAP) || (flags & (VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)))
-+#endif
-+
-+ mm->total_vm += pages;
-
- if (file) {
- mm->shared_vm += pages;
- if ((flags & (VM_EXEC|VM_WRITE)) == VM_EXEC)
- mm->exec_vm += pages;
-- } else if (flags & stack_flags)
-+ } else if (flags & (VM_GROWSUP|VM_GROWSDOWN))
- mm->stack_vm += pages;
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(mm->pax_flags & MF_PAX_RANDMMAP) || (flags & (VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)))
-+#endif
- if (flags & (VM_RESERVED|VM_IO))
- mm->reserved_vm += pages;
- }
-@@ -932,7 +1020,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
- * (the exception is when the underlying filesystem is noexec
- * mounted, in which case we dont add PROT_EXEC.)
- */
-- if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
-+ if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
- if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC)))
- prot |= PROT_EXEC;
-
-@@ -958,7 +1046,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
- /* Obtain the address to map to. we verify (or select) it and ensure
- * that it represents a valid section of the address space.
- */
-- addr = get_unmapped_area(file, addr, len, pgoff, flags);
-+ addr = get_unmapped_area(file, addr, len, pgoff, flags | ((prot & PROT_EXEC) ? MAP_EXECUTABLE : 0));
- if (addr & ~PAGE_MASK)
- return addr;
-
-@@ -969,6 +1057,36 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
- vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |
- mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
-
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (mm->pax_flags & MF_PAX_MPROTECT) {
-+#ifndef CONFIG_PAX_MPROTECT_COMPAT
-+ if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC)) {
-+ gr_log_rwxmmap(file);
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+ vm_flags &= ~VM_EXEC;
-+#else
-+ return -EPERM;
-+#endif
-+
-+ }
-+
-+ if (!(vm_flags & VM_EXEC))
-+ vm_flags &= ~VM_MAYEXEC;
-+#else
-+ if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
-+ vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
-+#endif
-+ else
-+ vm_flags &= ~VM_MAYWRITE;
-+ }
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
-+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && file)
-+ vm_flags &= ~VM_PAGEEXEC;
-+#endif
-+
- if (flags & MAP_LOCKED)
- if (!can_do_mlock())
- return -EPERM;
-@@ -980,6 +1098,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
- locked += mm->locked_vm;
- lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
- lock_limit >>= PAGE_SHIFT;
-+ gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
- if (locked > lock_limit && !capable(CAP_IPC_LOCK))
- return -EAGAIN;
- }
-@@ -1053,6 +1172,9 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
- if (error)
- return error;
-
-+ if (!gr_acl_handle_mmap(file, prot))
-+ return -EACCES;
-+
- return mmap_region(file, addr, len, flags, vm_flags, pgoff);
- }
- EXPORT_SYMBOL(do_mmap_pgoff);
-@@ -1065,10 +1187,10 @@ EXPORT_SYMBOL(do_mmap_pgoff);
- */
- int vma_wants_writenotify(struct vm_area_struct *vma)
- {
-- unsigned int vm_flags = vma->vm_flags;
-+ unsigned long vm_flags = vma->vm_flags;
-
- /* If it was private or non-writable, the write bit is already clear */
-- if ((vm_flags & (VM_WRITE|VM_SHARED)) != ((VM_WRITE|VM_SHARED)))
-+ if ((vm_flags & (VM_WRITE|VM_SHARED)) != (VM_WRITE|VM_SHARED))
- return 0;
-
- /* The backer wishes to know when pages are first written to? */
-@@ -1117,17 +1239,32 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
- unsigned long charged = 0;
- struct inode *inode = file ? file->f_path.dentry->d_inode : NULL;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m = NULL;
-+#endif
-+
-+ /*
-+ * mm->mmap_sem is required to protect against another thread
-+ * changing the mappings in case we sleep.
-+ */
-+ verify_mm_writelocked(mm);
-+
- /* Clear old maps */
- error = -ENOMEM;
--munmap_back:
- vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
- if (vma && vma->vm_start < addr + len) {
- if (do_munmap(mm, addr, len))
- return -ENOMEM;
-- goto munmap_back;
-+ vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
-+ BUG_ON(vma && vma->vm_start < addr + len);
- }
-
- /* Check against address space limit. */
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(mm->pax_flags & MF_PAX_RANDMMAP) || (vm_flags & (VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)))
-+#endif
-+
- if (!may_expand_vm(mm, len >> PAGE_SHIFT))
- return -ENOMEM;
-
-@@ -1173,6 +1310,16 @@ munmap_back:
- goto unacct_error;
- }
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vm_flags & VM_EXEC)) {
-+ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
-+ if (!vma_m) {
-+ error = -ENOMEM;
-+ goto free_vma;
-+ }
-+ }
-+#endif
-+
- vma->vm_mm = mm;
- vma->vm_start = addr;
- vma->vm_end = addr + len;
-@@ -1180,8 +1327,9 @@ munmap_back:
- vma->vm_page_prot = vm_get_page_prot(vm_flags);
- vma->vm_pgoff = pgoff;
-
-+ error = -EINVAL; /* when rejecting VM_GROWSDOWN|VM_GROWSUP */
-+
- if (file) {
-- error = -EINVAL;
- if (vm_flags & (VM_GROWSDOWN|VM_GROWSUP))
- goto free_vma;
- if (vm_flags & VM_DENYWRITE) {
-@@ -1195,6 +1343,19 @@ munmap_back:
- error = file->f_op->mmap(file, vma);
- if (error)
- goto unmap_and_free_vma;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (vma_m && (vm_flags & VM_EXECUTABLE))
-+ added_exe_file_vma(mm);
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
-+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && !(vma->vm_flags & VM_SPECIAL)) {
-+ vma->vm_flags |= VM_PAGEEXEC;
-+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
-+ }
-+#endif
-+
- if (vm_flags & VM_EXECUTABLE)
- added_exe_file_vma(mm);
-
-@@ -1207,6 +1368,8 @@ munmap_back:
- pgoff = vma->vm_pgoff;
- vm_flags = vma->vm_flags;
- } else if (vm_flags & VM_SHARED) {
-+ if (unlikely(vm_flags & (VM_GROWSDOWN|VM_GROWSUP)))
-+ goto free_vma;
- error = shmem_zero_setup(vma);
- if (error)
- goto free_vma;
-@@ -1218,14 +1381,19 @@ munmap_back:
- vma_link(mm, vma, prev, rb_link, rb_parent);
- file = vma->vm_file;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (vma_m)
-+ pax_mirror_vma(vma_m, vma);
-+#endif
-+
- /* Once vma denies write, undo our temporary denial count */
- if (correct_wcount)
- atomic_inc(&inode->i_writecount);
- out:
- perf_event_mmap(vma);
-
-- mm->total_vm += len >> PAGE_SHIFT;
- vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
-+ track_exec_limit(mm, addr, addr + len, vm_flags);
- if (vm_flags & VM_LOCKED) {
- /*
- * makes pages present; downgrades, drops, reacquires mmap_sem
-@@ -1248,6 +1416,12 @@ unmap_and_free_vma:
- unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
- charged = 0;
- free_vma:
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (vma_m)
-+ kmem_cache_free(vm_area_cachep, vma_m);
-+#endif
-+
- kmem_cache_free(vm_area_cachep, vma);
- unacct_error:
- if (charged)
-@@ -1255,6 +1429,73 @@ unacct_error:
- return error;
- }
-
-+#ifdef CONFIG_GRKERNSEC_RAND_THREADSTACK
-+unsigned long gr_rand_threadstack_offset(const struct mm_struct *mm, const struct file *filp, unsigned long flags)
-+{
-+ if ((mm->pax_flags & MF_PAX_RANDMMAP) && !filp && (flags & MAP_STACK))
-+ return ((random32() & 0xFF) + 1) << PAGE_SHIFT;
-+
-+ return 0;
-+}
-+#endif
-+
-+bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long *addr, unsigned long len, unsigned long offset)
-+{
-+ if (!vma) {
-+#ifdef CONFIG_STACK_GROWSUP
-+ if (*addr > sysctl_heap_stack_gap)
-+ vma = find_vma(current->mm, *addr - sysctl_heap_stack_gap);
-+ else
-+ vma = find_vma(current->mm, 0);
-+ if (vma && (vma->vm_flags & VM_GROWSUP))
-+ return false;
-+#endif
-+ return true;
-+ }
-+
-+ if (*addr + len > vma->vm_start)
-+ return false;
-+
-+ if (offset) {
-+ if (vma->vm_prev && *addr == vma->vm_prev->vm_end && (vma->vm_start - len - vma->vm_prev->vm_end >= offset)) {
-+ *addr = vma->vm_prev->vm_end + offset;
-+ return true;
-+ }
-+ return offset <= vma->vm_start - *addr - len;
-+ } else if (vma->vm_flags & VM_GROWSDOWN)
-+ return sysctl_heap_stack_gap <= vma->vm_start - *addr - len;
-+#ifdef CONFIG_STACK_GROWSUP
-+ else if (vma->vm_prev && (vma->vm_prev->vm_flags & VM_GROWSUP)) {
-+ if (*addr - vma->vm_prev->vm_end >= sysctl_heap_stack_gap)
-+ return true;
-+ if (vma->vm_start - len - vma->vm_prev->vm_end >= sysctl_heap_stack_gap) {
-+ *addr = vma->vm_start - len;
-+ return true;
-+ }
-+ return false;
-+ }
-+#endif
-+
-+ return true;
-+}
-+
-+unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len, unsigned long offset)
-+{
-+ if (vma->vm_start < len)
-+ return -ENOMEM;
-+
-+ if (!(vma->vm_flags & VM_GROWSDOWN)) {
-+ if (offset <= vma->vm_start - len)
-+ return vma->vm_start - len - offset;
-+ else
-+ return -ENOMEM;
-+ }
-+
-+ if (sysctl_heap_stack_gap <= vma->vm_start - len)
-+ return vma->vm_start - len - sysctl_heap_stack_gap;
-+ return -ENOMEM;
-+}
-+
- /* Get an address range which is currently unmapped.
- * For shmat() with addr=0.
- *
-@@ -1274,6 +1515,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
- struct mm_struct *mm = current->mm;
- struct vm_area_struct *vma;
- unsigned long start_addr;
-+ unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
-
- if (len > TASK_SIZE)
- return -ENOMEM;
-@@ -1281,18 +1523,23 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
- if (flags & MAP_FIXED)
- return addr;
-
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- if (addr) {
- addr = PAGE_ALIGN(addr);
-- vma = find_vma(mm, addr);
-- if (TASK_SIZE - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-- return addr;
-+ if (TASK_SIZE - len >= addr) {
-+ vma = find_vma(mm, addr);
-+ if (check_heap_stack_gap(vma, &addr, len, offset))
-+ return addr;
-+ }
- }
- if (len > mm->cached_hole_size) {
-- start_addr = addr = mm->free_area_cache;
-+ start_addr = addr = mm->free_area_cache;
- } else {
-- start_addr = addr = TASK_UNMAPPED_BASE;
-- mm->cached_hole_size = 0;
-+ start_addr = addr = mm->mmap_base;
-+ mm->cached_hole_size = 0;
- }
-
- full_search:
-@@ -1303,34 +1550,40 @@ full_search:
- * Start a new search - just in case we missed
- * some holes.
- */
-- if (start_addr != TASK_UNMAPPED_BASE) {
-- addr = TASK_UNMAPPED_BASE;
-- start_addr = addr;
-+ if (start_addr != mm->mmap_base) {
-+ start_addr = addr = mm->mmap_base;
- mm->cached_hole_size = 0;
- goto full_search;
- }
- return -ENOMEM;
- }
-- if (!vma || addr + len <= vma->vm_start) {
-- /*
-- * Remember the place where we stopped the search:
-- */
-- mm->free_area_cache = addr + len;
-- return addr;
-- }
-+ if (check_heap_stack_gap(vma, &addr, len, offset))
-+ break;
- if (addr + mm->cached_hole_size < vma->vm_start)
- mm->cached_hole_size = vma->vm_start - addr;
- addr = vma->vm_end;
- }
-+
-+ /*
-+ * Remember the place where we stopped the search:
-+ */
-+ mm->free_area_cache = addr + len;
-+ return addr;
- }
- #endif
-
- void arch_unmap_area(struct mm_struct *mm, unsigned long addr)
- {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
-+ return;
-+#endif
-+
- /*
- * Is this a new hole at the lowest possible address?
- */
-- if (addr >= TASK_UNMAPPED_BASE && addr < mm->free_area_cache) {
-+ if (addr >= mm->mmap_base && addr < mm->free_area_cache) {
- mm->free_area_cache = addr;
- mm->cached_hole_size = ~0UL;
- }
-@@ -1348,7 +1601,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- {
- struct vm_area_struct *vma;
- struct mm_struct *mm = current->mm;
-- unsigned long addr = addr0;
-+ unsigned long base = mm->mmap_base, addr = addr0;
-+ unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
-
- /* requested length too big for entire address space */
- if (len > TASK_SIZE)
-@@ -1357,13 +1611,18 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- if (flags & MAP_FIXED)
- return addr;
-
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- /* requesting a specific address */
- if (addr) {
- addr = PAGE_ALIGN(addr);
-- vma = find_vma(mm, addr);
-- if (TASK_SIZE - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-- return addr;
-+ if (TASK_SIZE - len >= addr) {
-+ vma = find_vma(mm, addr);
-+ if (check_heap_stack_gap(vma, &addr, len, offset))
-+ return addr;
-+ }
- }
-
- /* check if free_area_cache is useful for us */
-@@ -1377,10 +1636,11 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
-
- /* make sure it can fit in the remaining address space */
- if (addr > len) {
-- vma = find_vma(mm, addr-len);
-- if (!vma || addr <= vma->vm_start)
-+ addr -= len;
-+ vma = find_vma(mm, addr);
-+ if (check_heap_stack_gap(vma, &addr, len, offset))
- /* remember the address as a hint for next time */
-- return (mm->free_area_cache = addr-len);
-+ return (mm->free_area_cache = addr);
- }
-
- if (mm->mmap_base < len)
-@@ -1395,7 +1655,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- * return with success:
- */
- vma = find_vma(mm, addr);
-- if (!vma || addr+len <= vma->vm_start)
-+ if (check_heap_stack_gap(vma, &addr, len, offset))
- /* remember the address as a hint for next time */
- return (mm->free_area_cache = addr);
-
-@@ -1404,8 +1664,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- mm->cached_hole_size = vma->vm_start - addr;
-
- /* try just below the current vma->vm_start */
-- addr = vma->vm_start-len;
-- } while (len < vma->vm_start);
-+ addr = skip_heap_stack_gap(vma, len, offset);
-+ } while (!IS_ERR_VALUE(addr));
-
- bottomup:
- /*
-@@ -1414,13 +1674,21 @@ bottomup:
- * can happen with large stack limits and large mmap()
- * allocations.
- */
-+ mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base += mm->delta_mmap;
-+#endif
-+
-+ mm->free_area_cache = mm->mmap_base;
- mm->cached_hole_size = ~0UL;
-- mm->free_area_cache = TASK_UNMAPPED_BASE;
- addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
- /*
- * Restore the topdown base:
- */
-- mm->free_area_cache = mm->mmap_base;
-+ mm->mmap_base = base;
-+ mm->free_area_cache = base;
- mm->cached_hole_size = ~0UL;
-
- return addr;
-@@ -1429,6 +1697,12 @@ bottomup:
-
- void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
- {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
-+ return;
-+#endif
-+
- /*
- * Is this a new hole at the highest possible address?
- */
-@@ -1436,8 +1710,10 @@ void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
- mm->free_area_cache = addr;
-
- /* dont allow allocations above current base */
-- if (mm->free_area_cache > mm->mmap_base)
-+ if (mm->free_area_cache > mm->mmap_base) {
- mm->free_area_cache = mm->mmap_base;
-+ mm->cached_hole_size = ~0UL;
-+ }
- }
-
- unsigned long
-@@ -1480,7 +1756,7 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
- if (mm) {
- /* Check the cache first. */
- /* (Cache hit rate is typically around 35%.) */
-- vma = mm->mmap_cache;
-+ vma = ACCESS_ONCE(mm->mmap_cache);
- if (!(vma && vma->vm_end > addr && vma->vm_start <= addr)) {
- struct rb_node * rb_node;
-
-@@ -1510,40 +1786,49 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
-
- EXPORT_SYMBOL(find_vma);
-
--/* Same as find_vma, but also return a pointer to the previous VMA in *pprev. */
-+/*
-+ * Same as find_vma, but also return a pointer to the previous VMA in *pprev.
-+ */
- struct vm_area_struct *
- find_vma_prev(struct mm_struct *mm, unsigned long addr,
- struct vm_area_struct **pprev)
- {
-- struct vm_area_struct *vma = NULL, *prev = NULL;
-- struct rb_node *rb_node;
-- if (!mm)
-- goto out;
--
-- /* Guard against addr being lower than the first VMA */
-- vma = mm->mmap;
--
-- /* Go through the RB tree quickly. */
-- rb_node = mm->mm_rb.rb_node;
--
-- while (rb_node) {
-- struct vm_area_struct *vma_tmp;
-- vma_tmp = rb_entry(rb_node, struct vm_area_struct, vm_rb);
--
-- if (addr < vma_tmp->vm_end) {
-- rb_node = rb_node->rb_left;
-- } else {
-- prev = vma_tmp;
-- if (!prev->vm_next || (addr < prev->vm_next->vm_end))
-- break;
-+ struct vm_area_struct *vma;
-+
-+ vma = find_vma(mm, addr);
-+ if (vma) {
-+ *pprev = vma->vm_prev;
-+ } else {
-+ struct rb_node *rb_node = mm->mm_rb.rb_node;
-+ *pprev = NULL;
-+ while (rb_node) {
-+ *pprev = rb_entry(rb_node, struct vm_area_struct, vm_rb);
- rb_node = rb_node->rb_right;
- }
- }
-+ return vma;
-+}
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma)
-+{
-+ struct vm_area_struct *vma_m;
-
--out:
-- *pprev = prev;
-- return prev ? prev->vm_next : vma;
-+ BUG_ON(!vma || vma->vm_start >= vma->vm_end);
-+ if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC)) {
-+ BUG_ON(vma->vm_mirror);
-+ return NULL;
-+ }
-+ BUG_ON(vma->vm_start < SEGMEXEC_TASK_SIZE && SEGMEXEC_TASK_SIZE < vma->vm_end);
-+ vma_m = vma->vm_mirror;
-+ BUG_ON(!vma_m || vma_m->vm_mirror != vma);
-+ BUG_ON(vma->vm_file != vma_m->vm_file);
-+ BUG_ON(vma->vm_end - vma->vm_start != vma_m->vm_end - vma_m->vm_start);
-+ BUG_ON(vma->vm_pgoff != vma_m->vm_pgoff || vma->anon_vma != vma_m->anon_vma);
-+ BUG_ON((vma->vm_flags ^ vma_m->vm_flags) & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED | VM_RESERVED));
-+ return vma_m;
- }
-+#endif
-
- /*
- * Verify that the stack growth is acceptable and
-@@ -1561,6 +1846,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
- return -ENOMEM;
-
- /* Stack limit test */
-+ gr_learn_resource(current, RLIMIT_STACK, size, 1);
- if (size > rlim[RLIMIT_STACK].rlim_cur)
- return -ENOMEM;
-
-@@ -1570,6 +1856,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
- unsigned long limit;
- locked = mm->locked_vm + grow;
- limit = rlim[RLIMIT_MEMLOCK].rlim_cur >> PAGE_SHIFT;
-+ gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
- if (locked > limit && !capable(CAP_IPC_LOCK))
- return -ENOMEM;
- }
-@@ -1588,7 +1875,6 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
- return -ENOMEM;
-
- /* Ok, everything looks good - let it rip */
-- mm->total_vm += grow;
- if (vma->vm_flags & VM_LOCKED)
- mm->locked_vm += grow;
- vm_stat_account(mm, vma->vm_flags, vma->vm_file, grow);
-@@ -1600,37 +1886,48 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
- * PA-RISC uses this for its stack; IA64 for its Register Backing Store.
- * vma is the last one with address > vma->vm_end. Have to extend vma.
- */
-+#ifndef CONFIG_IA64
-+static
-+#endif
- int expand_upwards(struct vm_area_struct *vma, unsigned long address)
- {
- int error;
-+ bool locknext;
-
- if (!(vma->vm_flags & VM_GROWSUP))
- return -EFAULT;
-
-+ /* Also guard against wrapping around to address 0. */
-+ if (address < PAGE_ALIGN(address+1))
-+ address = PAGE_ALIGN(address+1);
-+ else
-+ return -ENOMEM;
-+
- /*
- * We must make sure the anon_vma is allocated
- * so that the anon_vma locking is not a noop.
- */
- if (unlikely(anon_vma_prepare(vma)))
- return -ENOMEM;
-+ locknext = vma->vm_next && (vma->vm_next->vm_flags & VM_GROWSDOWN);
-+ if (locknext && anon_vma_prepare(vma->vm_next))
-+ return -ENOMEM;
- anon_vma_lock(vma);
-+ if (locknext)
-+ anon_vma_lock(vma->vm_next);
-
- /*
- * vma->vm_start/vm_end cannot change under us because the caller
- * is required to hold the mmap_sem in read mode. We need the
-- * anon_vma lock to serialize against concurrent expand_stacks.
-- * Also guard against wrapping around to address 0.
-+ * anon_vma locks to serialize against concurrent expand_stacks
-+ * and expand_upwards.
- */
-- if (address < PAGE_ALIGN(address+4))
-- address = PAGE_ALIGN(address+4);
-- else {
-- anon_vma_unlock(vma);
-- return -ENOMEM;
-- }
- error = 0;
-
- /* Somebody else might have raced and expanded it already */
-- if (address > vma->vm_end) {
-+ if (vma->vm_next && (vma->vm_next->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && vma->vm_next->vm_start - address < sysctl_heap_stack_gap)
-+ error = -ENOMEM;
-+ else if (address > vma->vm_end && (!locknext || vma->vm_next->vm_start >= address)) {
- unsigned long size, grow;
-
- size = address - vma->vm_start;
-@@ -1643,6 +1940,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
- vma->vm_end = address;
- }
- }
-+ if (locknext)
-+ anon_vma_unlock(vma->vm_next);
- anon_vma_unlock(vma);
- return error;
- }
-@@ -1655,6 +1954,8 @@ static int expand_downwards(struct vm_area_struct *vma,
- unsigned long address)
- {
- int error;
-+ bool lockprev = false;
-+ struct vm_area_struct *prev;
-
- /*
- * We must make sure the anon_vma is allocated
-@@ -1668,6 +1969,15 @@ static int expand_downwards(struct vm_area_struct *vma,
- if (error)
- return error;
-
-+ prev = vma->vm_prev;
-+#if defined(CONFIG_STACK_GROWSUP) || defined(CONFIG_IA64)
-+ lockprev = prev && (prev->vm_flags & VM_GROWSUP);
-+#endif
-+ if (lockprev && anon_vma_prepare(prev))
-+ return -ENOMEM;
-+ if (lockprev)
-+ anon_vma_lock(prev);
-+
- anon_vma_lock(vma);
-
- /*
-@@ -1677,9 +1987,17 @@ static int expand_downwards(struct vm_area_struct *vma,
- */
-
- /* Somebody else might have raced and expanded it already */
-- if (address < vma->vm_start) {
-+ if (prev && (prev->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && address - prev->vm_end < sysctl_heap_stack_gap)
-+ error = -ENOMEM;
-+ else if (address < vma->vm_start && (!lockprev || prev->vm_end <= address)) {
- unsigned long size, grow;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m;
-+
-+ vma_m = pax_find_mirror_vma(vma);
-+#endif
-+
- size = vma->vm_end - address;
- grow = (vma->vm_start - address) >> PAGE_SHIFT;
-
-@@ -1689,21 +2007,60 @@ static int expand_downwards(struct vm_area_struct *vma,
- if (!error) {
- vma->vm_start = address;
- vma->vm_pgoff -= grow;
-+ track_exec_limit(vma->vm_mm, vma->vm_start, vma->vm_end, vma->vm_flags);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (vma_m) {
-+ vma_m->vm_start -= grow << PAGE_SHIFT;
-+ vma_m->vm_pgoff -= grow;
-+ }
-+#endif
-+
-+
- }
- }
- }
- anon_vma_unlock(vma);
-+ if (lockprev)
-+ anon_vma_unlock(prev);
- return error;
- }
-
- int expand_stack_downwards(struct vm_area_struct *vma, unsigned long address)
- {
-+ struct vm_area_struct *prev;
-+
-+ address &= PAGE_MASK;
-+ prev = vma->vm_prev;
-+ if (prev && prev->vm_end == address) {
-+ if (!(prev->vm_flags & VM_GROWSDOWN))
-+ return -ENOMEM;
-+ }
- return expand_downwards(vma, address);
- }
-
-+/*
-+ * Note how expand_stack() refuses to expand the stack all the way to
-+ * abut the next virtual mapping, *unless* that mapping itself is also
-+ * a stack mapping. We want to leave room for a guard page, after all
-+ * (the guard page itself is not added here, that is done by the
-+ * actual page faulting logic)
-+ *
-+ * This matches the behavior of the guard page logic (see mm/memory.c:
-+ * check_stack_guard_page()), which only allows the guard page to be
-+ * removed under these circumstances.
-+ */
- #ifdef CONFIG_STACK_GROWSUP
- int expand_stack(struct vm_area_struct *vma, unsigned long address)
- {
-+ struct vm_area_struct *next;
-+
-+ address &= PAGE_MASK;
-+ next = vma->vm_next;
-+ if (next && next->vm_start == address + PAGE_SIZE) {
-+ if (!(next->vm_flags & VM_GROWSUP))
-+ return -ENOMEM;
-+ }
- return expand_upwards(vma, address);
- }
-
-@@ -1727,6 +2084,14 @@ find_extend_vma(struct mm_struct *mm, unsigned long addr)
- #else
- int expand_stack(struct vm_area_struct *vma, unsigned long address)
- {
-+ struct vm_area_struct *prev;
-+
-+ address &= PAGE_MASK;
-+ prev = vma->vm_prev;
-+ if (prev && prev->vm_end == address) {
-+ if (!(prev->vm_flags & VM_GROWSDOWN))
-+ return -ENOMEM;
-+ }
- return expand_downwards(vma, address);
- }
-
-@@ -1768,7 +2133,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
- do {
- long nrpages = vma_pages(vma);
-
-- mm->total_vm -= nrpages;
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE)) {
-+ vma = remove_vma(vma);
-+ continue;
-+ }
-+#endif
-+
- vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
- vma = remove_vma(vma);
- } while (vma);
-@@ -1813,6 +2184,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
- insertion_point = (prev ? &prev->vm_next : &mm->mmap);
- vma->vm_prev = NULL;
- do {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (vma->vm_mirror) {
-+ BUG_ON(!vma->vm_mirror->vm_mirror || vma->vm_mirror->vm_mirror != vma);
-+ vma->vm_mirror->vm_mirror = NULL;
-+ vma->vm_mirror->vm_flags &= ~VM_EXEC;
-+ vma->vm_mirror = NULL;
-+ }
-+#endif
-+
- rb_erase(&vma->vm_rb, &mm->mm_rb);
- mm->map_count--;
- tail_vma = vma;
-@@ -1840,10 +2221,25 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
- struct mempolicy *pol;
- struct vm_area_struct *new;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m, *new_m = NULL;
-+ unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE;
-+#endif
-+
- if (is_vm_hugetlb_page(vma) && (addr &
- ~(huge_page_mask(hstate_vma(vma)))))
- return -EINVAL;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ vma_m = pax_find_mirror_vma(vma);
-+
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC) {
-+ BUG_ON(vma->vm_end > SEGMEXEC_TASK_SIZE);
-+ if (mm->map_count >= sysctl_max_map_count-1)
-+ return -ENOMEM;
-+ } else
-+#endif
-+
- if (mm->map_count >= sysctl_max_map_count)
- return -ENOMEM;
-
-@@ -1851,6 +2247,16 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
- if (!new)
- return -ENOMEM;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (vma_m) {
-+ new_m = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
-+ if (!new_m) {
-+ kmem_cache_free(vm_area_cachep, new);
-+ return -ENOMEM;
-+ }
-+ }
-+#endif
-+
- /* most fields are the same, copy all, and then fixup */
- *new = *vma;
-
-@@ -1861,8 +2267,29 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
- new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
- }
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (vma_m) {
-+ *new_m = *vma_m;
-+ new_m->vm_mirror = new;
-+ new->vm_mirror = new_m;
-+
-+ if (new_below)
-+ new_m->vm_end = addr_m;
-+ else {
-+ new_m->vm_start = addr_m;
-+ new_m->vm_pgoff += ((addr_m - vma_m->vm_start) >> PAGE_SHIFT);
-+ }
-+ }
-+#endif
-+
- pol = mpol_dup(vma_policy(vma));
- if (IS_ERR(pol)) {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (new_m)
-+ kmem_cache_free(vm_area_cachep, new_m);
-+#endif
-+
- kmem_cache_free(vm_area_cachep, new);
- return PTR_ERR(pol);
- }
-@@ -1883,6 +2310,28 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
- else
- vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (vma_m) {
-+ mpol_get(pol);
-+ vma_set_policy(new_m, pol);
-+
-+ if (new_m->vm_file) {
-+ get_file(new_m->vm_file);
-+ if (vma_m->vm_flags & VM_EXECUTABLE)
-+ added_exe_file_vma(mm);
-+ }
-+
-+ if (new_m->vm_ops && new_m->vm_ops->open)
-+ new_m->vm_ops->open(new_m);
-+
-+ if (new_below)
-+ vma_adjust(vma_m, addr_m, vma_m->vm_end, vma_m->vm_pgoff +
-+ ((addr_m - new_m->vm_start) >> PAGE_SHIFT), new_m);
-+ else
-+ vma_adjust(vma_m, vma_m->vm_start, addr_m, vma_m->vm_pgoff, new_m);
-+ }
-+#endif
-+
- return 0;
- }
-
-@@ -1891,11 +2340,30 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
- * work. This now handles partial unmappings.
- * Jeremy Fitzhardinge <jeremy@goop.org>
- */
-+#ifdef CONFIG_PAX_SEGMEXEC
- int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
- {
-+ int ret = __do_munmap(mm, start, len);
-+ if (ret || !(mm->pax_flags & MF_PAX_SEGMEXEC))
-+ return ret;
-+
-+ return __do_munmap(mm, start + SEGMEXEC_TASK_SIZE, len);
-+}
-+
-+int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
-+#else
-+int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
-+#endif
-+{
- unsigned long end;
- struct vm_area_struct *vma, *prev, *last;
-
-+ /*
-+ * mm->mmap_sem is required to protect against another thread
-+ * changing the mappings in case we sleep.
-+ */
-+ verify_mm_writelocked(mm);
-+
- if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
- return -EINVAL;
-
-@@ -1959,6 +2427,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
- /* Fix up all other VM information */
- remove_vma_list(mm, vma);
-
-+ track_exec_limit(mm, start, end, 0UL);
-+
- return 0;
- }
-
-@@ -1971,22 +2441,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
-
- profile_munmap(addr);
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) &&
-+ (len > SEGMEXEC_TASK_SIZE || addr > SEGMEXEC_TASK_SIZE-len))
-+ return -EINVAL;
-+#endif
-+
- down_write(&mm->mmap_sem);
- ret = do_munmap(mm, addr, len);
- up_write(&mm->mmap_sem);
- return ret;
- }
-
--static inline void verify_mm_writelocked(struct mm_struct *mm)
--{
--#ifdef CONFIG_DEBUG_VM
-- if (unlikely(down_read_trylock(&mm->mmap_sem))) {
-- WARN_ON(1);
-- up_read(&mm->mmap_sem);
-- }
--#endif
--}
--
- /*
- * this is really a simplified "do_mmap". it only handles
- * anonymous maps. eventually we may be able to do some
-@@ -2000,6 +2466,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
- struct rb_node ** rb_link, * rb_parent;
- pgoff_t pgoff = addr >> PAGE_SHIFT;
- int error;
-+ unsigned long charged;
-
- len = PAGE_ALIGN(len);
- if (!len)
-@@ -2011,16 +2478,30 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
-
- flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
-
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+ if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+ flags &= ~VM_EXEC;
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (mm->pax_flags & MF_PAX_MPROTECT)
-+ flags &= ~VM_MAYEXEC;
-+#endif
-+
-+ }
-+#endif
-+
- error = get_unmapped_area(NULL, addr, len, 0, MAP_FIXED);
- if (error & ~PAGE_MASK)
- return error;
-
-+ charged = len >> PAGE_SHIFT;
-+
- /*
- * mlock MCL_FUTURE?
- */
- if (mm->def_flags & VM_LOCKED) {
- unsigned long locked, lock_limit;
-- locked = len >> PAGE_SHIFT;
-+ locked = charged;
- locked += mm->locked_vm;
- lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
- lock_limit >>= PAGE_SHIFT;
-@@ -2037,22 +2518,22 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
- /*
- * Clear old maps. this also does some error checking for us
- */
-- munmap_back:
- vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
- if (vma && vma->vm_start < addr + len) {
- if (do_munmap(mm, addr, len))
- return -ENOMEM;
-- goto munmap_back;
-+ vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
-+ BUG_ON(vma && vma->vm_start < addr + len);
- }
-
- /* Check against address space limits *after* clearing old maps... */
-- if (!may_expand_vm(mm, len >> PAGE_SHIFT))
-+ if (!may_expand_vm(mm, charged))
- return -ENOMEM;
-
- if (mm->map_count > sysctl_max_map_count)
- return -ENOMEM;
-
-- if (security_vm_enough_memory(len >> PAGE_SHIFT))
-+ if (security_vm_enough_memory(charged))
- return -ENOMEM;
-
- /* Can we just expand an old private anonymous mapping? */
-@@ -2066,7 +2547,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
- */
- vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
- if (!vma) {
-- vm_unacct_memory(len >> PAGE_SHIFT);
-+ vm_unacct_memory(charged);
- return -ENOMEM;
- }
-
-@@ -2078,11 +2559,12 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
- vma->vm_page_prot = vm_get_page_prot(flags);
- vma_link(mm, vma, prev, rb_link, rb_parent);
- out:
-- mm->total_vm += len >> PAGE_SHIFT;
-+ mm->total_vm += charged;
- if (flags & VM_LOCKED) {
- if (!mlock_vma_pages_range(vma, addr, addr + len))
-- mm->locked_vm += (len >> PAGE_SHIFT);
-+ mm->locked_vm += charged;
- }
-+ track_exec_limit(mm, addr, addr + len, flags);
- return addr;
- }
-
-@@ -2129,8 +2611,10 @@ void exit_mmap(struct mm_struct *mm)
- * Walk the list again, actually closing and freeing it,
- * with preemption enabled, without holding any MM locks.
- */
-- while (vma)
-+ while (vma) {
-+ vma->vm_mirror = NULL;
- vma = remove_vma(vma);
-+ }
-
- BUG_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT);
- }
-@@ -2144,6 +2628,10 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
- struct vm_area_struct * __vma, * prev;
- struct rb_node ** rb_link, * rb_parent;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m = NULL;
-+#endif
-+
- /*
- * The vm_pgoff of a purely anonymous vma should be irrelevant
- * until its first write fault, when page's anon_vma and index
-@@ -2166,7 +2654,22 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
- if ((vma->vm_flags & VM_ACCOUNT) &&
- security_vm_enough_memory_mm(mm, vma_pages(vma)))
- return -ENOMEM;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_EXEC)) {
-+ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
-+ if (!vma_m)
-+ return -ENOMEM;
-+ }
-+#endif
-+
- vma_link(mm, vma, prev, rb_link, rb_parent);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (vma_m)
-+ pax_mirror_vma(vma_m, vma);
-+#endif
-+
- return 0;
- }
-
-@@ -2184,6 +2687,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
- struct rb_node **rb_link, *rb_parent;
- struct mempolicy *pol;
-
-+ BUG_ON(vma->vm_mirror);
-+
- /*
- * If anonymous vma has not yet been faulted, update new pgoff
- * to match new location, to increase its chance of merging.
-@@ -2227,6 +2732,35 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
- return new_vma;
- }
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+void pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma)
-+{
-+ struct vm_area_struct *prev_m;
-+ struct rb_node **rb_link_m, *rb_parent_m;
-+ struct mempolicy *pol_m;
-+
-+ BUG_ON(!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC));
-+ BUG_ON(vma->vm_mirror || vma_m->vm_mirror);
-+ BUG_ON(!mpol_equal(vma_policy(vma), vma_policy(vma_m)));
-+ *vma_m = *vma;
-+ pol_m = vma_policy(vma_m);
-+ mpol_get(pol_m);
-+ vma_set_policy(vma_m, pol_m);
-+ vma_m->vm_start += SEGMEXEC_TASK_SIZE;
-+ vma_m->vm_end += SEGMEXEC_TASK_SIZE;
-+ vma_m->vm_flags &= ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED);
-+ vma_m->vm_page_prot = vm_get_page_prot(vma_m->vm_flags);
-+ if (vma_m->vm_file)
-+ get_file(vma_m->vm_file);
-+ if (vma_m->vm_ops && vma_m->vm_ops->open)
-+ vma_m->vm_ops->open(vma_m);
-+ find_vma_prepare(vma->vm_mm, vma_m->vm_start, &prev_m, &rb_link_m, &rb_parent_m);
-+ vma_link(vma->vm_mm, vma_m, prev_m, rb_link_m, rb_parent_m);
-+ vma_m->vm_mirror = vma;
-+ vma->vm_mirror = vma_m;
-+}
-+#endif
-+
- /*
- * Return true if the calling process may expand its vm space by the passed
- * number of pages
-@@ -2238,6 +2772,7 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages)
-
- lim = current->signal->rlim[RLIMIT_AS].rlim_cur >> PAGE_SHIFT;
-
-+ gr_learn_resource(current, RLIMIT_AS, (cur + npages) << PAGE_SHIFT, 1);
- if (cur + npages > lim)
- return 0;
- return 1;
-@@ -2307,6 +2842,22 @@ int install_special_mapping(struct mm_struct *mm,
- vma->vm_start = addr;
- vma->vm_end = addr + len;
-
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (mm->pax_flags & MF_PAX_MPROTECT) {
-+#ifndef CONFIG_PAX_MPROTECT_COMPAT
-+ if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC))
-+ return -EPERM;
-+ if (!(vm_flags & VM_EXEC))
-+ vm_flags &= ~VM_MAYEXEC;
-+#else
-+ if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
-+ vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
-+#endif
-+ else
-+ vm_flags &= ~VM_MAYWRITE;
-+ }
-+#endif
-+
- vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND;
- vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
-
-diff --git a/mm/mprotect.c b/mm/mprotect.c
-index 1737c7e..c7faeb4 100644
---- a/mm/mprotect.c
-+++ b/mm/mprotect.c
-@@ -24,10 +24,16 @@
- #include <linux/mmu_notifier.h>
- #include <linux/migrate.h>
- #include <linux/perf_event.h>
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+#include <linux/elf.h>
-+#endif
-+
- #include <asm/uaccess.h>
- #include <asm/pgtable.h>
- #include <asm/cacheflush.h>
- #include <asm/tlbflush.h>
-+#include <asm/mmu_context.h>
-
- #ifndef pgprot_modify
- static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
-@@ -132,6 +138,48 @@ static void change_protection(struct vm_area_struct *vma,
- flush_tlb_range(vma, start, end);
- }
-
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+/* called while holding the mmap semaphor for writing except stack expansion */
-+void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot)
-+{
-+ unsigned long oldlimit, newlimit = 0UL;
-+
-+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || nx_enabled)
-+ return;
-+
-+ spin_lock(&mm->page_table_lock);
-+ oldlimit = mm->context.user_cs_limit;
-+ if ((prot & VM_EXEC) && oldlimit < end)
-+ /* USER_CS limit moved up */
-+ newlimit = end;
-+ else if (!(prot & VM_EXEC) && start < oldlimit && oldlimit <= end)
-+ /* USER_CS limit moved down */
-+ newlimit = start;
-+
-+ if (newlimit) {
-+ mm->context.user_cs_limit = newlimit;
-+
-+#ifdef CONFIG_SMP
-+ wmb();
-+ cpus_clear(mm->context.cpu_user_cs_mask);
-+ cpu_set(smp_processor_id(), mm->context.cpu_user_cs_mask);
-+#endif
-+
-+ set_user_cs(mm->context.user_cs_base, mm->context.user_cs_limit, smp_processor_id());
-+ }
-+ spin_unlock(&mm->page_table_lock);
-+ if (newlimit == end) {
-+ struct vm_area_struct *vma = find_vma(mm, oldlimit);
-+
-+ for (; vma && vma->vm_start < end; vma = vma->vm_next)
-+ if (is_vm_hugetlb_page(vma))
-+ hugetlb_change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot);
-+ else
-+ change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot, vma_wants_writenotify(vma));
-+ }
-+}
-+#endif
-+
- int
- mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
- unsigned long start, unsigned long end, unsigned long newflags)
-@@ -144,11 +192,29 @@ mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
- int error;
- int dirty_accountable = 0;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m = NULL;
-+ unsigned long start_m, end_m;
-+
-+ start_m = start + SEGMEXEC_TASK_SIZE;
-+ end_m = end + SEGMEXEC_TASK_SIZE;
-+#endif
-+
- if (newflags == oldflags) {
- *pprev = vma;
- return 0;
- }
-
-+ if (newflags & (VM_READ | VM_WRITE | VM_EXEC)) {
-+ struct vm_area_struct *prev = vma->vm_prev, *next = vma->vm_next;
-+
-+ if (next && (next->vm_flags & VM_GROWSDOWN) && sysctl_heap_stack_gap > next->vm_start - end)
-+ return -ENOMEM;
-+
-+ if (prev && (prev->vm_flags & VM_GROWSUP) && sysctl_heap_stack_gap > start - prev->vm_end)
-+ return -ENOMEM;
-+ }
-+
- /*
- * If we make a private mapping writable we increase our commit;
- * but (without finer accounting) cannot reduce our commit if we
-@@ -165,6 +231,38 @@ mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
- }
- }
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && ((oldflags ^ newflags) & VM_EXEC)) {
-+ if (start != vma->vm_start) {
-+ error = split_vma(mm, vma, start, 1);
-+ if (error)
-+ goto fail;
-+ BUG_ON(!*pprev || (*pprev)->vm_next == vma);
-+ *pprev = (*pprev)->vm_next;
-+ }
-+
-+ if (end != vma->vm_end) {
-+ error = split_vma(mm, vma, end, 0);
-+ if (error)
-+ goto fail;
-+ }
-+
-+ if (pax_find_mirror_vma(vma)) {
-+ error = __do_munmap(mm, start_m, end_m - start_m);
-+ if (error)
-+ goto fail;
-+ } else {
-+ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
-+ if (!vma_m) {
-+ error = -ENOMEM;
-+ goto fail;
-+ }
-+ vma->vm_flags = newflags;
-+ pax_mirror_vma(vma_m, vma);
-+ }
-+ }
-+#endif
-+
- /*
- * First try to merge with previous and/or next vma.
- */
-@@ -195,9 +293,21 @@ success:
- * vm_flags and vm_page_prot are protected by the mmap_sem
- * held in write mode.
- */
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (newflags & VM_EXEC) && ((vma->vm_flags ^ newflags) & VM_READ))
-+ pax_find_mirror_vma(vma)->vm_flags ^= VM_READ;
-+#endif
-+
- vma->vm_flags = newflags;
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (mm->binfmt && mm->binfmt->handle_mprotect)
-+ mm->binfmt->handle_mprotect(vma, newflags);
-+#endif
-+
- vma->vm_page_prot = pgprot_modify(vma->vm_page_prot,
-- vm_get_page_prot(newflags));
-+ vm_get_page_prot(vma->vm_flags));
-
- if (vma_wants_writenotify(vma)) {
- vma->vm_page_prot = vm_get_page_prot(newflags & ~VM_SHARED);
-@@ -239,6 +349,17 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
- end = start + len;
- if (end <= start)
- return -ENOMEM;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
-+ if (end > SEGMEXEC_TASK_SIZE)
-+ return -EINVAL;
-+ } else
-+#endif
-+
-+ if (end > TASK_SIZE)
-+ return -EINVAL;
-+
- if (!arch_validate_prot(prot))
- return -EINVAL;
-
-@@ -246,7 +367,7 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
- /*
- * Does the application expect PROT_READ to imply PROT_EXEC:
- */
-- if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
-+ if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
- prot |= PROT_EXEC;
-
- vm_flags = calc_vm_prot_bits(prot);
-@@ -278,6 +399,11 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
- if (start > vma->vm_start)
- prev = vma;
-
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (current->mm->binfmt && current->mm->binfmt->handle_mprotect)
-+ current->mm->binfmt->handle_mprotect(vma, vm_flags);
-+#endif
-+
- for (nstart = start ; ; ) {
- unsigned long newflags;
-
-@@ -287,6 +413,14 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
-
- /* newflags >> 4 shift VM_MAY% in place of VM_% */
- if ((newflags & ~(newflags >> 4)) & (VM_READ | VM_WRITE | VM_EXEC)) {
-+ if (prot & (PROT_WRITE | PROT_EXEC))
-+ gr_log_rwxmprotect(vma->vm_file);
-+
-+ error = -EACCES;
-+ goto out;
-+ }
-+
-+ if (!gr_acl_handle_mprotect(vma->vm_file, prot)) {
- error = -EACCES;
- goto out;
- }
-@@ -301,6 +435,9 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
- error = mprotect_fixup(vma, &prev, nstart, tmp, newflags);
- if (error)
- goto out;
-+
-+ track_exec_limit(current->mm, nstart, tmp, vm_flags);
-+
- nstart = tmp;
-
- if (nstart < prev->vm_end)
-diff --git a/mm/mremap.c b/mm/mremap.c
-index 3e98d79..36c2b5d 100644
---- a/mm/mremap.c
-+++ b/mm/mremap.c
-@@ -112,6 +112,12 @@ static void move_ptes(struct vm_area_struct *vma, pmd_t *old_pmd,
- continue;
- pte = ptep_clear_flush(vma, old_addr, old_pte);
- pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
-+
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+ if (!nx_enabled && (new_vma->vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC)
-+ pte = pte_exprotect(pte);
-+#endif
-+
- set_pte_at(mm, new_addr, new_pte, pte);
- }
-
-@@ -232,7 +238,6 @@ static unsigned long move_vma(struct vm_area_struct *vma,
- * If this were a serious issue, we'd add a flag to do_munmap().
- */
- hiwater_vm = mm->hiwater_vm;
-- mm->total_vm += new_len >> PAGE_SHIFT;
- vm_stat_account(mm, vma->vm_flags, vma->vm_file, new_len>>PAGE_SHIFT);
-
- if (do_munmap(mm, old_addr, old_len) < 0) {
-@@ -271,6 +276,11 @@ static struct vm_area_struct *vma_to_resize(unsigned long addr,
- if (is_vm_hugetlb_page(vma))
- goto Einval;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (pax_find_mirror_vma(vma))
-+ goto Einval;
-+#endif
-+
- /* We can't remap across vm area boundaries */
- if (old_len > vma->vm_end - addr)
- goto Efault;
-@@ -327,20 +337,25 @@ static unsigned long mremap_to(unsigned long addr,
- unsigned long ret = -EINVAL;
- unsigned long charged = 0;
- unsigned long map_flags;
-+ unsigned long pax_task_size = TASK_SIZE;
-
- if (new_addr & ~PAGE_MASK)
- goto out;
-
-- if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len)
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+ pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+ pax_task_size -= PAGE_SIZE;
-+
-+ if (new_len > TASK_SIZE || new_addr > pax_task_size - new_len)
- goto out;
-
- /* Check if the location we're moving into overlaps the
- * old location at all, and fail if it does.
- */
-- if ((new_addr <= addr) && (new_addr+new_len) > addr)
-- goto out;
--
-- if ((addr <= new_addr) && (addr+old_len) > new_addr)
-+ if (addr + old_len > new_addr && new_addr + new_len > addr)
- goto out;
-
- ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
-@@ -412,6 +427,7 @@ unsigned long do_mremap(unsigned long addr,
- struct vm_area_struct *vma;
- unsigned long ret = -EINVAL;
- unsigned long charged = 0;
-+ unsigned long pax_task_size = TASK_SIZE;
-
- if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
- goto out;
-@@ -430,6 +446,17 @@ unsigned long do_mremap(unsigned long addr,
- if (!new_len)
- goto out;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+ pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+ pax_task_size -= PAGE_SIZE;
-+
-+ if (new_len > pax_task_size || addr > pax_task_size-new_len ||
-+ old_len > pax_task_size || addr > pax_task_size-old_len)
-+ goto out;
-+
- if (flags & MREMAP_FIXED) {
- if (flags & MREMAP_MAYMOVE)
- ret = mremap_to(addr, old_len, new_addr, new_len);
-@@ -468,7 +495,6 @@ unsigned long do_mremap(unsigned long addr,
- vma_adjust(vma, vma->vm_start,
- addr + new_len, vma->vm_pgoff, NULL);
-
-- mm->total_vm += pages;
- vm_stat_account(mm, vma->vm_flags, vma->vm_file, pages);
- if (vma->vm_flags & VM_LOCKED) {
- mm->locked_vm += pages;
-@@ -476,6 +502,7 @@ unsigned long do_mremap(unsigned long addr,
- addr + new_len);
- }
- ret = addr;
-+ track_exec_limit(vma->vm_mm, vma->vm_start, addr + new_len, vma->vm_flags);
- goto out;
- }
- }
-@@ -502,7 +529,13 @@ unsigned long do_mremap(unsigned long addr,
- ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
- if (ret)
- goto out;
-+
-+ map_flags = vma->vm_flags;
- ret = move_vma(vma, addr, old_len, new_len, new_addr);
-+ if (!(ret & ~PAGE_MASK)) {
-+ track_exec_limit(current->mm, addr, addr + old_len, 0UL);
-+ track_exec_limit(current->mm, new_addr, new_addr + new_len, map_flags);
-+ }
- }
- out:
- if (ret & ~PAGE_MASK)
-diff --git a/mm/nommu.c b/mm/nommu.c
-index 406e8d4..2d13998 100644
---- a/mm/nommu.c
-+++ b/mm/nommu.c
-@@ -67,7 +67,6 @@ int sysctl_overcommit_memory = OVERCOMMIT_GUESS; /* heuristic overcommit */
- int sysctl_overcommit_ratio = 50; /* default is 50% */
- int sysctl_max_map_count = DEFAULT_MAX_MAP_COUNT;
- int sysctl_nr_trim_pages = CONFIG_NOMMU_INITIAL_TRIM_EXCESS;
--int heap_stack_gap = 0;
-
- atomic_long_t mmap_pages_allocated;
-
-@@ -740,7 +739,7 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
- struct rb_node *n = mm->mm_rb.rb_node;
-
- /* check the cache first */
-- vma = mm->mmap_cache;
-+ vma = ACCESS_ONCE(mm->mmap_cache);
- if (vma && vma->vm_start <= addr && vma->vm_end > addr)
- return vma;
-
-@@ -761,15 +760,6 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
- EXPORT_SYMBOL(find_vma);
-
- /*
-- * find a VMA
-- * - we don't extend stack VMAs under NOMMU conditions
-- */
--struct vm_area_struct *find_extend_vma(struct mm_struct *mm, unsigned long addr)
--{
-- return find_vma(mm, addr);
--}
--
--/*
- * expand a stack to a given address
- * - not supported under NOMMU conditions
- */
-diff --git a/mm/page_alloc.c b/mm/page_alloc.c
-index 3ecab7e..be580fc 100644
---- a/mm/page_alloc.c
-+++ b/mm/page_alloc.c
-@@ -289,7 +289,7 @@ out:
- * This usage means that zero-order pages may not be compound.
- */
-
--static void free_compound_page(struct page *page)
-+void free_compound_page(struct page *page)
- {
- __free_pages_ok(page, compound_order(page));
- }
-@@ -587,6 +587,10 @@ static void __free_pages_ok(struct page *page, unsigned int order)
- int bad = 0;
- int wasMlocked = __TestClearPageMlocked(page);
-
-+#ifdef CONFIG_PAX_MEMORY_SANITIZE
-+ unsigned long index = 1UL << order;
-+#endif
-+
- kmemcheck_free_shadow(page, order);
-
- for (i = 0 ; i < (1 << order) ; ++i)
-@@ -599,6 +603,12 @@ static void __free_pages_ok(struct page *page, unsigned int order)
- debug_check_no_obj_freed(page_address(page),
- PAGE_SIZE << order);
- }
-+
-+#ifdef CONFIG_PAX_MEMORY_SANITIZE
-+ for (; index; --index)
-+ sanitize_highpage(page + index - 1);
-+#endif
-+
- arch_free_page(page, order);
- kernel_map_pages(page, 1 << order, 0);
-
-@@ -702,8 +712,10 @@ static int prep_new_page(struct page *page, int order, gfp_t gfp_flags)
- arch_alloc_page(page, order);
- kernel_map_pages(page, 1 << order, 1);
-
-+#ifndef CONFIG_PAX_MEMORY_SANITIZE
- if (gfp_flags & __GFP_ZERO)
- prep_zero_page(page, order, gfp_flags);
-+#endif
-
- if (order && (gfp_flags & __GFP_COMP))
- prep_compound_page(page, order);
-@@ -1097,6 +1109,11 @@ static void free_hot_cold_page(struct page *page, int cold)
- debug_check_no_locks_freed(page_address(page), PAGE_SIZE);
- debug_check_no_obj_freed(page_address(page), PAGE_SIZE);
- }
-+
-+#ifdef CONFIG_PAX_MEMORY_SANITIZE
-+ sanitize_highpage(page);
-+#endif
-+
- arch_free_page(page, 0);
- kernel_map_pages(page, 1, 0);
-
-@@ -2179,6 +2196,8 @@ void show_free_areas(void)
- int cpu;
- struct zone *zone;
-
-+ pax_track_stack();
-+
- for_each_populated_zone(zone) {
- show_node(zone);
- printk("%s per-cpu:\n", zone->name);
-@@ -3715,10 +3734,11 @@ static void __meminit calculate_node_totalpages(struct pglist_data *pgdat,
- * round what is now in bits to nearest long in bits, then return it in
- * bytes.
- */
--static unsigned long __init usemap_size(unsigned long zonesize)
-+static unsigned long __init usemap_size(unsigned long zone_start_pfn, unsigned long zonesize)
- {
- unsigned long usemapsize;
-
-+ zonesize += zone_start_pfn & (pageblock_nr_pages-1);
- usemapsize = roundup(zonesize, pageblock_nr_pages);
- usemapsize = usemapsize >> pageblock_order;
- usemapsize *= NR_PAGEBLOCK_BITS;
-@@ -3728,16 +3748,18 @@ static unsigned long __init usemap_size(unsigned long zonesize)
- }
-
- static void __init setup_usemap(struct pglist_data *pgdat,
-- struct zone *zone, unsigned long zonesize)
-+ struct zone *zone,
-+ unsigned long zone_start_pfn,
-+ unsigned long zonesize)
- {
-- unsigned long usemapsize = usemap_size(zonesize);
-+ unsigned long usemapsize = usemap_size(zone_start_pfn, zonesize);
- zone->pageblock_flags = NULL;
- if (usemapsize)
- zone->pageblock_flags = alloc_bootmem_node(pgdat, usemapsize);
- }
- #else
--static void inline setup_usemap(struct pglist_data *pgdat,
-- struct zone *zone, unsigned long zonesize) {}
-+static inline void setup_usemap(struct pglist_data *pgdat, struct zone *zone,
-+ unsigned long zone_start_pfn, unsigned long zonesize) {}
- #endif /* CONFIG_SPARSEMEM */
-
- #ifdef CONFIG_HUGETLB_PAGE_SIZE_VARIABLE
-@@ -3869,7 +3891,7 @@ static void __paginginit free_area_init_core(struct pglist_data *pgdat,
- continue;
-
- set_pageblock_order(pageblock_default_order());
-- setup_usemap(pgdat, zone, size);
-+ setup_usemap(pgdat, zone, zone_start_pfn, size);
- ret = init_currently_empty_zone(zone, zone_start_pfn,
- size, MEMMAP_EARLY);
- BUG_ON(ret);
-@@ -4945,7 +4967,7 @@ static inline int pfn_to_bitidx(struct zone *zone, unsigned long pfn)
- pfn &= (PAGES_PER_SECTION-1);
- return (pfn >> pageblock_order) * NR_PAGEBLOCK_BITS;
- #else
-- pfn = pfn - zone->zone_start_pfn;
-+ pfn = pfn - round_down(zone->zone_start_pfn, pageblock_nr_pages);
- return (pfn >> pageblock_order) * NR_PAGEBLOCK_BITS;
- #endif /* CONFIG_SPARSEMEM */
- }
-diff --git a/mm/percpu.c b/mm/percpu.c
-index c90614a..5f7b7b8 100644
---- a/mm/percpu.c
-+++ b/mm/percpu.c
-@@ -115,7 +115,7 @@ static unsigned int pcpu_low_unit_cpu __read_mostly;
- static unsigned int pcpu_high_unit_cpu __read_mostly;
-
- /* the address of the first chunk which starts with the kernel static area */
--void *pcpu_base_addr __read_mostly;
-+void *pcpu_base_addr __read_only;
- EXPORT_SYMBOL_GPL(pcpu_base_addr);
-
- static const int *pcpu_unit_map __read_mostly; /* cpu -> unit */
-diff --git a/mm/rmap.c b/mm/rmap.c
-index dd43373..d848cd7 100644
---- a/mm/rmap.c
-+++ b/mm/rmap.c
-@@ -121,6 +121,17 @@ int anon_vma_prepare(struct vm_area_struct *vma)
- /* page_table_lock to protect against threads */
- spin_lock(&mm->page_table_lock);
- if (likely(!vma->anon_vma)) {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m = pax_find_mirror_vma(vma);
-+
-+ if (vma_m) {
-+ BUG_ON(vma_m->anon_vma);
-+ vma_m->anon_vma = anon_vma;
-+ list_add_tail(&vma_m->anon_vma_node, &anon_vma->head);
-+ }
-+#endif
-+
- vma->anon_vma = anon_vma;
- list_add_tail(&vma->anon_vma_node, &anon_vma->head);
- allocated = NULL;
-diff --git a/mm/shmem.c b/mm/shmem.c
-index e6a0c72..eac2525 100644
---- a/mm/shmem.c
-+++ b/mm/shmem.c
-@@ -31,7 +31,7 @@
- #include <linux/swap.h>
- #include <linux/ima.h>
-
--static struct vfsmount *shm_mnt;
-+struct vfsmount *shm_mnt;
-
- #ifdef CONFIG_SHMEM
- /*
-@@ -1061,6 +1061,8 @@ static int shmem_writepage(struct page *page, struct writeback_control *wbc)
- goto unlock;
- }
- entry = shmem_swp_entry(info, index, NULL);
-+ if (!entry)
-+ goto unlock;
- if (entry->val) {
- /*
- * The more uptodate page coming down from a stacked
-@@ -1144,6 +1146,8 @@ static struct page *shmem_swapin(swp_entry_t entry, gfp_t gfp,
- struct vm_area_struct pvma;
- struct page *page;
-
-+ pax_track_stack();
-+
- spol = mpol_cond_copy(&mpol,
- mpol_shared_policy_lookup(&info->policy, idx));
-
-@@ -1962,7 +1966,7 @@ static int shmem_symlink(struct inode *dir, struct dentry *dentry, const char *s
-
- info = SHMEM_I(inode);
- inode->i_size = len-1;
-- if (len <= (char *)inode - (char *)info) {
-+ if (len <= (char *)inode - (char *)info && len <= 64) {
- /* do it inline */
- memcpy(info, symname, len);
- inode->i_op = &shmem_symlink_inline_operations;
-@@ -2316,8 +2320,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent)
- int err = -ENOMEM;
-
- /* Round up to L1_CACHE_BYTES to resist false sharing */
-- sbinfo = kzalloc(max((int)sizeof(struct shmem_sb_info),
-- L1_CACHE_BYTES), GFP_KERNEL);
-+ sbinfo = kzalloc(max(sizeof(struct shmem_sb_info), L1_CACHE_BYTES), GFP_KERNEL);
- if (!sbinfo)
- return -ENOMEM;
-
-diff --git a/mm/slab.c b/mm/slab.c
-index c8d466a..a2cb875 100644
---- a/mm/slab.c
-+++ b/mm/slab.c
-@@ -174,7 +174,7 @@
-
- /* Legal flag mask for kmem_cache_create(). */
- #if DEBUG
--# define CREATE_MASK (SLAB_RED_ZONE | \
-+# define CREATE_MASK (SLAB_USERCOPY | SLAB_RED_ZONE | \
- SLAB_POISON | SLAB_HWCACHE_ALIGN | \
- SLAB_CACHE_DMA | \
- SLAB_STORE_USER | \
-@@ -182,7 +182,7 @@
- SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
- SLAB_DEBUG_OBJECTS | SLAB_NOLEAKTRACE | SLAB_NOTRACK)
- #else
--# define CREATE_MASK (SLAB_HWCACHE_ALIGN | \
-+# define CREATE_MASK (SLAB_USERCOPY | SLAB_HWCACHE_ALIGN | \
- SLAB_CACHE_DMA | \
- SLAB_RECLAIM_ACCOUNT | SLAB_PANIC | \
- SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
-@@ -308,7 +308,7 @@ struct kmem_list3 {
- * Need this for bootstrapping a per node allocator.
- */
- #define NUM_INIT_LISTS (3 * MAX_NUMNODES)
--struct kmem_list3 __initdata initkmem_list3[NUM_INIT_LISTS];
-+struct kmem_list3 initkmem_list3[NUM_INIT_LISTS];
- #define CACHE_CACHE 0
- #define SIZE_AC MAX_NUMNODES
- #define SIZE_L3 (2 * MAX_NUMNODES)
-@@ -409,10 +409,10 @@ static void kmem_list3_init(struct kmem_list3 *parent)
- if ((x)->max_freeable < i) \
- (x)->max_freeable = i; \
- } while (0)
--#define STATS_INC_ALLOCHIT(x) atomic_inc(&(x)->allochit)
--#define STATS_INC_ALLOCMISS(x) atomic_inc(&(x)->allocmiss)
--#define STATS_INC_FREEHIT(x) atomic_inc(&(x)->freehit)
--#define STATS_INC_FREEMISS(x) atomic_inc(&(x)->freemiss)
-+#define STATS_INC_ALLOCHIT(x) atomic_inc_unchecked(&(x)->allochit)
-+#define STATS_INC_ALLOCMISS(x) atomic_inc_unchecked(&(x)->allocmiss)
-+#define STATS_INC_FREEHIT(x) atomic_inc_unchecked(&(x)->freehit)
-+#define STATS_INC_FREEMISS(x) atomic_inc_unchecked(&(x)->freemiss)
- #else
- #define STATS_INC_ACTIVE(x) do { } while (0)
- #define STATS_DEC_ACTIVE(x) do { } while (0)
-@@ -558,7 +558,7 @@ static inline void *index_to_obj(struct kmem_cache *cache, struct slab *slab,
- * reciprocal_divide(offset, cache->reciprocal_buffer_size)
- */
- static inline unsigned int obj_to_index(const struct kmem_cache *cache,
-- const struct slab *slab, void *obj)
-+ const struct slab *slab, const void *obj)
- {
- u32 offset = (obj - slab->s_mem);
- return reciprocal_divide(offset, cache->reciprocal_buffer_size);
-@@ -579,10 +579,11 @@ EXPORT_SYMBOL(malloc_sizes);
- struct cache_names {
- char *name;
- char *name_dma;
-+ char *name_usercopy;
- };
-
- static struct cache_names __initdata cache_names[] = {
--#define CACHE(x) { .name = "size-" #x, .name_dma = "size-" #x "(DMA)" },
-+#define CACHE(x) { .name = "size-" #x, .name_dma = "size-" #x "(DMA)", .name_usercopy = "size-" #x "(USERCOPY)" },
- #include <linux/kmalloc_sizes.h>
- {NULL,}
- #undef CACHE
-@@ -719,6 +720,12 @@ static inline struct kmem_cache *__find_general_cachep(size_t size,
- if (unlikely(gfpflags & GFP_DMA))
- return csizep->cs_dmacachep;
- #endif
-+
-+#ifdef CONFIG_PAX_USERCOPY_SLABS
-+ if (unlikely(gfpflags & GFP_USERCOPY))
-+ return csizep->cs_usercopycachep;
-+#endif
-+
- return csizep->cs_cachep;
- }
-
-@@ -1453,7 +1460,7 @@ void __init kmem_cache_init(void)
- sizes[INDEX_AC].cs_cachep = kmem_cache_create(names[INDEX_AC].name,
- sizes[INDEX_AC].cs_size,
- ARCH_KMALLOC_MINALIGN,
-- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
-+ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
- NULL);
-
- if (INDEX_AC != INDEX_L3) {
-@@ -1461,7 +1468,7 @@ void __init kmem_cache_init(void)
- kmem_cache_create(names[INDEX_L3].name,
- sizes[INDEX_L3].cs_size,
- ARCH_KMALLOC_MINALIGN,
-- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
-+ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
- NULL);
- }
-
-@@ -1479,7 +1486,7 @@ void __init kmem_cache_init(void)
- sizes->cs_cachep = kmem_cache_create(names->name,
- sizes->cs_size,
- ARCH_KMALLOC_MINALIGN,
-- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
-+ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
- NULL);
- }
- #ifdef CONFIG_ZONE_DMA
-@@ -1491,6 +1498,16 @@ void __init kmem_cache_init(void)
- SLAB_PANIC,
- NULL);
- #endif
-+
-+#ifdef CONFIG_PAX_USERCOPY_SLABS
-+ sizes->cs_usercopycachep = kmem_cache_create(
-+ names->name_usercopy,
-+ sizes->cs_size,
-+ ARCH_KMALLOC_MINALIGN,
-+ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
-+ NULL);
-+#endif
-+
- sizes++;
- names++;
- }
-@@ -4211,10 +4228,10 @@ static int s_show(struct seq_file *m, void *p)
- }
- /* cpu stats */
- {
-- unsigned long allochit = atomic_read(&cachep->allochit);
-- unsigned long allocmiss = atomic_read(&cachep->allocmiss);
-- unsigned long freehit = atomic_read(&cachep->freehit);
-- unsigned long freemiss = atomic_read(&cachep->freemiss);
-+ unsigned long allochit = atomic_read_unchecked(&cachep->allochit);
-+ unsigned long allocmiss = atomic_read_unchecked(&cachep->allocmiss);
-+ unsigned long freehit = atomic_read_unchecked(&cachep->freehit);
-+ unsigned long freemiss = atomic_read_unchecked(&cachep->freemiss);
-
- seq_printf(m, " : cpustat %6lu %6lu %6lu %6lu",
- allochit, allocmiss, freehit, freemiss);
-@@ -4471,15 +4488,79 @@ static const struct file_operations proc_slabstats_operations = {
-
- static int __init slab_proc_init(void)
- {
-- proc_create("slabinfo",S_IWUSR|S_IRUGO,NULL,&proc_slabinfo_operations);
-+ mode_t gr_mode = S_IRUGO;
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+ gr_mode = S_IRUSR;
-+#endif
-+
-+ proc_create("slabinfo",S_IWUSR|gr_mode,NULL,&proc_slabinfo_operations);
- #ifdef CONFIG_DEBUG_SLAB_LEAK
-- proc_create("slab_allocators", 0, NULL, &proc_slabstats_operations);
-+ proc_create("slab_allocators", gr_mode, NULL, &proc_slabstats_operations);
- #endif
- return 0;
- }
- module_init(slab_proc_init);
- #endif
-
-+bool is_usercopy_object(const void *ptr)
-+{
-+ struct page *page;
-+ struct kmem_cache *cachep;
-+
-+ if (ZERO_OR_NULL_PTR(ptr))
-+ return false;
-+
-+ if (!slab_is_available())
-+ return false;
-+
-+ if (!virt_addr_valid(ptr))
-+ return false;
-+
-+ page = virt_to_head_page(ptr);
-+
-+ if (!PageSlab(page))
-+ return false;
-+
-+ cachep = page_get_cache(page);
-+ return cachep->flags & SLAB_USERCOPY;
-+}
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+const char *check_heap_object(const void *ptr, unsigned long n)
-+{
-+ struct page *page;
-+ struct kmem_cache *cachep;
-+ struct slab *slabp;
-+ unsigned int objnr;
-+ unsigned long offset;
-+
-+ if (ZERO_OR_NULL_PTR(ptr))
-+ return "<null>";
-+
-+ if (!virt_addr_valid(ptr))
-+ return NULL;
-+
-+ page = virt_to_head_page(ptr);
-+
-+ if (!PageSlab(page))
-+ return NULL;
-+
-+ cachep = page_get_cache(page);
-+ if (!(cachep->flags & SLAB_USERCOPY))
-+ return cachep->name;
-+
-+ slabp = page_get_slab(page);
-+ objnr = obj_to_index(cachep, slabp, ptr);
-+ BUG_ON(objnr >= cachep->num);
-+ offset = ptr - index_to_obj(cachep, slabp, objnr) - obj_offset(cachep);
-+ if (offset <= obj_size(cachep) && n <= obj_size(cachep) - offset)
-+ return NULL;
-+
-+ return cachep->name;
-+}
-+#endif
-+
- /**
- * ksize - get the actual amount of memory allocated for a given object
- * @objp: Pointer to the object
-diff --git a/mm/slob.c b/mm/slob.c
-index 837ebd6..1ef41ba 100644
---- a/mm/slob.c
-+++ b/mm/slob.c
-@@ -29,7 +29,7 @@
- * If kmalloc is asked for objects of PAGE_SIZE or larger, it calls
- * alloc_pages() directly, allocating compound pages so the page order
- * does not have to be separately tracked, and also stores the exact
-- * allocation size in page->private so that it can be used to accurately
-+ * allocation size in slob_page->size so that it can be used to accurately
- * provide ksize(). These objects are detected in kfree() because slob_page()
- * is false for them.
- *
-@@ -58,6 +58,7 @@
- */
-
- #include <linux/kernel.h>
-+#include <linux/sched.h>
- #include <linux/slab.h>
- #include <linux/mm.h>
- #include <linux/swap.h> /* struct reclaim_state */
-@@ -100,7 +101,8 @@ struct slob_page {
- unsigned long flags; /* mandatory */
- atomic_t _count; /* mandatory */
- slobidx_t units; /* free units left in page */
-- unsigned long pad[2];
-+ unsigned long pad[1];
-+ unsigned long size; /* size when >=PAGE_SIZE */
- slob_t *free; /* first free slob_t in page */
- struct list_head list; /* linked list of free pages */
- };
-@@ -133,7 +135,7 @@ static LIST_HEAD(free_slob_large);
- */
- static inline int is_slob_page(struct slob_page *sp)
- {
-- return PageSlab((struct page *)sp);
-+ return PageSlab((struct page *)sp) && !sp->size;
- }
-
- static inline void set_slob_page(struct slob_page *sp)
-@@ -148,7 +150,7 @@ static inline void clear_slob_page(struct slob_page *sp)
-
- static inline struct slob_page *slob_page(const void *addr)
- {
-- return (struct slob_page *)virt_to_page(addr);
-+ return (struct slob_page *)virt_to_head_page(addr);
- }
-
- /*
-@@ -208,7 +210,7 @@ static void set_slob(slob_t *s, slobidx_t size, slob_t *next)
- /*
- * Return the size of a slob block.
- */
--static slobidx_t slob_units(slob_t *s)
-+static slobidx_t slob_units(const slob_t *s)
- {
- if (s->units > 0)
- return s->units;
-@@ -218,7 +220,7 @@ static slobidx_t slob_units(slob_t *s)
- /*
- * Return the next free slob block pointer after this one.
- */
--static slob_t *slob_next(slob_t *s)
-+static slob_t *slob_next(const slob_t *s)
- {
- slob_t *base = (slob_t *)((unsigned long)s & PAGE_MASK);
- slobidx_t next;
-@@ -233,7 +235,7 @@ static slob_t *slob_next(slob_t *s)
- /*
- * Returns true if s is the last free block in its page.
- */
--static int slob_last(slob_t *s)
-+static int slob_last(const slob_t *s)
- {
- return !((unsigned long)slob_next(s) & ~PAGE_MASK);
- }
-@@ -252,6 +254,7 @@ static void *slob_new_pages(gfp_t gfp, int order, int node)
- if (!page)
- return NULL;
-
-+ set_slob_page(page);
- return page_address(page);
- }
-
-@@ -368,11 +371,11 @@ static void *slob_alloc(size_t size, gfp_t gfp, int align, int node)
- if (!b)
- return NULL;
- sp = slob_page(b);
-- set_slob_page(sp);
-
- spin_lock_irqsave(&slob_lock, flags);
- sp->units = SLOB_UNITS(PAGE_SIZE);
- sp->free = b;
-+ sp->size = 0;
- INIT_LIST_HEAD(&sp->list);
- set_slob(b, SLOB_UNITS(PAGE_SIZE), b + SLOB_UNITS(PAGE_SIZE));
- set_slob_page_free(sp, slob_list);
-@@ -475,10 +478,9 @@ out:
- #define ARCH_SLAB_MINALIGN __alignof__(unsigned long)
- #endif
-
--void *__kmalloc_node(size_t size, gfp_t gfp, int node)
-+static void *__kmalloc_node_align(size_t size, gfp_t gfp, int node, int align)
- {
-- unsigned int *m;
-- int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
-+ slob_t *m;
- void *ret;
-
- lockdep_trace_alloc(gfp);
-@@ -491,7 +493,10 @@ void *__kmalloc_node(size_t size, gfp_t gfp, int node)
-
- if (!m)
- return NULL;
-- *m = size;
-+ BUILD_BUG_ON(ARCH_KMALLOC_MINALIGN < 2 * SLOB_UNIT);
-+ BUILD_BUG_ON(ARCH_SLAB_MINALIGN < 2 * SLOB_UNIT);
-+ m[0].units = size;
-+ m[1].units = align;
- ret = (void *)m + align;
-
- trace_kmalloc_node(_RET_IP_, ret,
-@@ -501,16 +506,25 @@ void *__kmalloc_node(size_t size, gfp_t gfp, int node)
-
- ret = slob_new_pages(gfp | __GFP_COMP, get_order(size), node);
- if (ret) {
-- struct page *page;
-- page = virt_to_page(ret);
-- page->private = size;
-+ struct slob_page *sp;
-+ sp = slob_page(ret);
-+ sp->size = size;
- }
-
- trace_kmalloc_node(_RET_IP_, ret,
- size, PAGE_SIZE << order, gfp, node);
- }
-
-- kmemleak_alloc(ret, size, 1, gfp);
-+ return ret;
-+}
-+
-+void *__kmalloc_node(size_t size, gfp_t gfp, int node)
-+{
-+ int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
-+ void *ret = __kmalloc_node_align(size, gfp, node, align);
-+
-+ if (!ZERO_OR_NULL_PTR(ret))
-+ kmemleak_alloc(ret, size, 1, gfp);
- return ret;
- }
- EXPORT_SYMBOL(__kmalloc_node);
-@@ -528,13 +542,88 @@ void kfree(const void *block)
- sp = slob_page(block);
- if (is_slob_page(sp)) {
- int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
-- unsigned int *m = (unsigned int *)(block - align);
-- slob_free(m, *m + align);
-- } else
-+ slob_t *m = (slob_t *)(block - align);
-+ slob_free(m, m[0].units + align);
-+ } else {
-+ clear_slob_page(sp);
-+ free_slob_page(sp);
-+ sp->size = 0;
- put_page(&sp->page);
-+ }
- }
- EXPORT_SYMBOL(kfree);
-
-+bool is_usercopy_object(const void *ptr)
-+{
-+ if (!slab_is_available())
-+ return false;
-+
-+ // PAX: TODO
-+
-+ return false;
-+}
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+const char *check_heap_object(const void *ptr, unsigned long n)
-+{
-+ struct slob_page *sp;
-+ const slob_t *free;
-+ const void *base;
-+ unsigned long flags;
-+
-+ if (ZERO_OR_NULL_PTR(ptr))
-+ return "<null>";
-+
-+ if (!virt_addr_valid(ptr))
-+ return NULL;
-+
-+ sp = slob_page(ptr);
-+ if (!PageSlab((struct page *)sp))
-+ return NULL;
-+
-+ if (sp->size) {
-+ base = page_address(&sp->page);
-+ if (base <= ptr && n <= sp->size - (ptr - base))
-+ return NULL;
-+ return "<slob>";
-+ }
-+
-+ /* some tricky double walking to find the chunk */
-+ spin_lock_irqsave(&slob_lock, flags);
-+ base = (void *)((unsigned long)ptr & PAGE_MASK);
-+ free = sp->free;
-+
-+ while ((void *)free <= ptr) {
-+ base = free + slob_units(free);
-+ free = slob_next(free);
-+ }
-+
-+ while (base < (void *)free) {
-+ slobidx_t m = ((slob_t *)base)[0].units, align = ((slob_t *)base)[1].units;
-+ int size = SLOB_UNIT * SLOB_UNITS(m + align);
-+ int offset;
-+
-+ if (ptr < base + align)
-+ break;
-+
-+ offset = ptr - base - align;
-+ if (offset >= m) {
-+ base += size;
-+ continue;
-+ }
-+
-+ if (n > m - offset)
-+ break;
-+
-+ spin_unlock_irqrestore(&slob_lock, flags);
-+ return NULL;
-+ }
-+
-+ spin_unlock_irqrestore(&slob_lock, flags);
-+ return "<slob>";
-+}
-+#endif
-+
- /* can't use ksize for kmem_cache_alloc memory, only kmalloc */
- size_t ksize(const void *block)
- {
-@@ -547,10 +636,10 @@ size_t ksize(const void *block)
- sp = slob_page(block);
- if (is_slob_page(sp)) {
- int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
-- unsigned int *m = (unsigned int *)(block - align);
-- return SLOB_UNITS(*m) * SLOB_UNIT;
-+ slob_t *m = (slob_t *)(block - align);
-+ return SLOB_UNITS(m[0].units) * SLOB_UNIT;
- } else
-- return sp->page.private;
-+ return sp->size;
- }
- EXPORT_SYMBOL(ksize);
-
-@@ -566,8 +655,13 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
- {
- struct kmem_cache *c;
-
-+#ifdef CONFIG_PAX_USERCOPY_SLABS
-+ c = __kmalloc_node_align(sizeof(struct kmem_cache),
-+ GFP_KERNEL, -1, ARCH_KMALLOC_MINALIGN);
-+#else
- c = slob_alloc(sizeof(struct kmem_cache),
- GFP_KERNEL, ARCH_KMALLOC_MINALIGN, -1);
-+#endif
-
- if (c) {
- c->name = name;
-@@ -605,17 +699,25 @@ void *kmem_cache_alloc_node(struct kmem_cache *c, gfp_t flags, int node)
- {
- void *b;
-
-+#ifdef CONFIG_PAX_USERCOPY_SLABS
-+ b = __kmalloc_node_align(c->size, flags, node, c->align);
-+#else
- if (c->size < PAGE_SIZE) {
- b = slob_alloc(c->size, flags, c->align, node);
- trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
- SLOB_UNITS(c->size) * SLOB_UNIT,
- flags, node);
- } else {
-+ struct slob_page *sp;
-+
- b = slob_new_pages(flags, get_order(c->size), node);
-+ sp = slob_page(b);
-+ sp->size = c->size;
- trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
- PAGE_SIZE << get_order(c->size),
- flags, node);
- }
-+#endif
-
- if (c->ctor)
- c->ctor(b);
-@@ -627,10 +729,16 @@ EXPORT_SYMBOL(kmem_cache_alloc_node);
-
- static void __kmem_cache_free(void *b, int size)
- {
-- if (size < PAGE_SIZE)
-+ struct slob_page *sp = slob_page(b);
-+
-+ if (is_slob_page(sp))
- slob_free(b, size);
-- else
-+ else {
-+ clear_slob_page(sp);
-+ free_slob_page(sp);
-+ sp->size = 0;
- slob_free_pages(b, get_order(size));
-+ }
- }
-
- static void kmem_rcu_free(struct rcu_head *head)
-@@ -643,18 +751,32 @@ static void kmem_rcu_free(struct rcu_head *head)
-
- void kmem_cache_free(struct kmem_cache *c, void *b)
- {
-+ int size = c->size;
-+
-+#ifdef CONFIG_PAX_USERCOPY_SLABS
-+ if (size + c->align < PAGE_SIZE) {
-+ size += c->align;
-+ b -= c->align;
-+ }
-+#endif
-+
- kmemleak_free_recursive(b, c->flags);
- if (unlikely(c->flags & SLAB_DESTROY_BY_RCU)) {
- struct slob_rcu *slob_rcu;
-- slob_rcu = b + (c->size - sizeof(struct slob_rcu));
-+ slob_rcu = b + (size - sizeof(struct slob_rcu));
- INIT_RCU_HEAD(&slob_rcu->head);
-- slob_rcu->size = c->size;
-+ slob_rcu->size = size;
- call_rcu(&slob_rcu->head, kmem_rcu_free);
- } else {
-- __kmem_cache_free(b, c->size);
-+ __kmem_cache_free(b, size);
- }
-
-+#ifdef CONFIG_PAX_USERCOPY_SLABS
-+ trace_kfree(_RET_IP_, b);
-+#else
- trace_kmem_cache_free(_RET_IP_, b);
-+#endif
-+
- }
- EXPORT_SYMBOL(kmem_cache_free);
-
-diff --git a/mm/slub.c b/mm/slub.c
-index 4996fc7..2ecab0a 100644
---- a/mm/slub.c
-+++ b/mm/slub.c
-@@ -201,7 +201,7 @@ struct track {
-
- enum track_item { TRACK_ALLOC, TRACK_FREE };
-
--#ifdef CONFIG_SLUB_DEBUG
-+#if defined(CONFIG_SLUB_DEBUG) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
- static int sysfs_slab_add(struct kmem_cache *);
- static int sysfs_slab_alias(struct kmem_cache *, const char *);
- static void sysfs_slab_remove(struct kmem_cache *);
-@@ -410,7 +410,7 @@ static void print_track(const char *s, struct track *t)
- if (!t->addr)
- return;
-
-- printk(KERN_ERR "INFO: %s in %pS age=%lu cpu=%u pid=%d\n",
-+ printk(KERN_ERR "INFO: %s in %pA age=%lu cpu=%u pid=%d\n",
- s, (void *)t->addr, jiffies - t->when, t->cpu, t->pid);
- }
-
-@@ -1893,6 +1893,8 @@ void kmem_cache_free(struct kmem_cache *s, void *x)
-
- page = virt_to_head_page(x);
-
-+ BUG_ON(!PageSlab(page));
-+
- slab_free(s, page, x, _RET_IP_);
-
- trace_kmem_cache_free(_RET_IP_, x);
-@@ -1937,7 +1939,7 @@ static int slub_min_objects;
- * Merge control. If this is set then no merging of slab caches will occur.
- * (Could be removed. This was introduced to pacify the merge skeptics.)
- */
--static int slub_nomerge;
-+static int slub_nomerge = 1;
-
- /*
- * Calculate the order of allocation given an slab object size.
-@@ -2493,7 +2495,7 @@ static int kmem_cache_open(struct kmem_cache *s, gfp_t gfpflags,
- * list to avoid pounding the page allocator excessively.
- */
- set_min_partial(s, ilog2(s->size));
-- s->refcount = 1;
-+ atomic_set(&s->refcount, 1);
- #ifdef CONFIG_NUMA
- s->remote_node_defrag_ratio = 1000;
- #endif
-@@ -2630,8 +2632,7 @@ static inline int kmem_cache_close(struct kmem_cache *s)
- void kmem_cache_destroy(struct kmem_cache *s)
- {
- down_write(&slub_lock);
-- s->refcount--;
-- if (!s->refcount) {
-+ if (atomic_dec_and_test(&s->refcount)) {
- list_del(&s->list);
- up_write(&slub_lock);
- if (kmem_cache_close(s)) {
-@@ -2691,12 +2692,10 @@ static int __init setup_slub_nomerge(char *str)
- __setup("slub_nomerge", setup_slub_nomerge);
-
- static struct kmem_cache *create_kmalloc_cache(struct kmem_cache *s,
-- const char *name, int size, gfp_t gfp_flags)
-+ const char *name, int size, gfp_t gfp_flags, unsigned int flags)
- {
-- unsigned int flags = 0;
--
- if (gfp_flags & SLUB_DMA)
-- flags = SLAB_CACHE_DMA;
-+ flags |= SLAB_CACHE_DMA;
-
- /*
- * This function is called with IRQs disabled during early-boot on
-@@ -2792,6 +2791,10 @@ out:
- }
- #endif
-
-+#ifdef CONFIG_PAX_USERCOPY_SLABS
-+static struct kmem_cache kmalloc_caches_usercopy[SLUB_PAGE_SHIFT];
-+#endif
-+
- /*
- * Conversion table for small slabs sizes / 8 to the index in the
- * kmalloc array. This is necessary for slabs < 192 since we have non power
-@@ -2847,6 +2850,13 @@ static struct kmem_cache *get_slab(size_t size, gfp_t flags)
- return dma_kmalloc_cache(index, flags);
-
- #endif
-+
-+#ifdef CONFIG_PAX_USERCOPY_SLABS
-+ if (flags & SLAB_USERCOPY)
-+ return &kmalloc_caches_usercopy[index];
-+
-+#endif
-+
- return &kmalloc_caches[index];
- }
-
-@@ -2915,6 +2925,59 @@ void *__kmalloc_node(size_t size, gfp_t flags, int node)
- EXPORT_SYMBOL(__kmalloc_node);
- #endif
-
-+bool is_usercopy_object(const void *ptr)
-+{
-+ struct page *page;
-+ struct kmem_cache *s;
-+
-+ if (ZERO_OR_NULL_PTR(ptr))
-+ return false;
-+
-+ if (!slab_is_available())
-+ return false;
-+
-+ if (!virt_addr_valid(ptr))
-+ return false;
-+
-+ page = virt_to_head_page(ptr);
-+
-+ if (!PageSlab(page))
-+ return false;
-+
-+ s = page->slab;
-+ return s->flags & SLAB_USERCOPY;
-+}
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+const char *check_heap_object(const void *ptr, unsigned long n)
-+{
-+ struct page *page;
-+ struct kmem_cache *s;
-+ unsigned long offset;
-+
-+ if (ZERO_OR_NULL_PTR(ptr))
-+ return "<null>";
-+
-+ if (!virt_addr_valid(ptr))
-+ return NULL;
-+
-+ page = get_object_page(ptr);
-+
-+ if (!page)
-+ return NULL;
-+
-+ s = page->slab;
-+ if (!(s->flags & SLAB_USERCOPY))
-+ return s->name;
-+
-+ offset = (ptr - page_address(page)) % s->size;
-+ if (offset <= s->objsize && n <= s->objsize - offset)
-+ return NULL;
-+
-+ return s->name;
-+}
-+#endif
-+
- size_t ksize(const void *object)
- {
- struct page *page;
-@@ -3185,8 +3248,8 @@ void __init kmem_cache_init(void)
- * kmem_cache_open for slab_state == DOWN.
- */
- create_kmalloc_cache(&kmalloc_caches[0], "kmem_cache_node",
-- sizeof(struct kmem_cache_node), GFP_NOWAIT);
-- kmalloc_caches[0].refcount = -1;
-+ sizeof(struct kmem_cache_node), GFP_NOWAIT, 0);
-+ atomic_set(&kmalloc_caches[0].refcount, -1);
- caches++;
-
- hotplug_memory_notifier(slab_memory_callback, SLAB_CALLBACK_PRI);
-@@ -3198,18 +3261,18 @@ void __init kmem_cache_init(void)
- /* Caches that are not of the two-to-the-power-of size */
- if (KMALLOC_MIN_SIZE <= 32) {
- create_kmalloc_cache(&kmalloc_caches[1],
-- "kmalloc-96", 96, GFP_NOWAIT);
-+ "kmalloc-96", 96, GFP_NOWAIT, SLAB_USERCOPY);
- caches++;
- }
- if (KMALLOC_MIN_SIZE <= 64) {
- create_kmalloc_cache(&kmalloc_caches[2],
-- "kmalloc-192", 192, GFP_NOWAIT);
-+ "kmalloc-192", 192, GFP_NOWAIT, SLAB_USERCOPY);
- caches++;
- }
-
- for (i = KMALLOC_SHIFT_LOW; i < SLUB_PAGE_SHIFT; i++) {
- create_kmalloc_cache(&kmalloc_caches[i],
-- "kmalloc", 1 << i, GFP_NOWAIT);
-+ "kmalloc", 1 << i, GFP_NOWAIT, SLAB_USERCOPY);
- caches++;
- }
-
-@@ -3267,6 +3330,20 @@ void __init kmem_cache_init(void)
- kmem_size = sizeof(struct kmem_cache);
- #endif
-
-+#ifdef CONFIG_PAX_USERCOPY_SLABS
-+ for (i = 0; i < SLUB_PAGE_SHIFT; i++) {
-+ struct kmem_cache *s = &kmalloc_caches[i];
-+
-+ if (s->size) {
-+ char *name = kasprintf(GFP_NOWAIT, "kmalloc-usercopy-%d", s->objsize);
-+
-+ BUG_ON(!name);
-+ create_kmalloc_cache(&kmalloc_caches_usercopy[i], name,
-+ s->objsize, GFP_NOWAIT, SLAB_USERCOPY);
-+ }
-+ }
-+#endif
-+
- printk(KERN_INFO
- "SLUB: Genslabs=%d, HWalign=%d, Order=%d-%d, MinObjects=%d,"
- " CPUs=%d, Nodes=%d\n",
-@@ -3293,7 +3370,7 @@ static int slab_unmergeable(struct kmem_cache *s)
- /*
- * We may have set a slab to be unmergeable during bootstrap.
- */
-- if (s->refcount < 0)
-+ if (atomic_read(&s->refcount) < 0)
- return 1;
-
- return 0;
-@@ -3353,7 +3430,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
- if (s) {
- int cpu;
-
-- s->refcount++;
-+ atomic_inc(&s->refcount);
- /*
- * Adjust the object sizes so that we clear
- * the complete object on kzalloc.
-@@ -3372,7 +3449,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
-
- if (sysfs_slab_alias(s, name)) {
- down_write(&slub_lock);
-- s->refcount--;
-+ atomic_dec(&s->refcount);
- up_write(&slub_lock);
- goto err;
- }
-@@ -4101,7 +4178,7 @@ SLAB_ATTR_RO(ctor);
-
- static ssize_t aliases_show(struct kmem_cache *s, char *buf)
- {
-- return sprintf(buf, "%d\n", s->refcount - 1);
-+ return sprintf(buf, "%d\n", atomic_read(&s->refcount) - 1);
- }
- SLAB_ATTR_RO(aliases);
-
-@@ -4503,7 +4580,7 @@ static void kmem_cache_release(struct kobject *kobj)
- kfree(s);
- }
-
--static struct sysfs_ops slab_sysfs_ops = {
-+static const struct sysfs_ops slab_sysfs_ops = {
- .show = slab_attr_show,
- .store = slab_attr_store,
- };
-@@ -4522,7 +4599,7 @@ static int uevent_filter(struct kset *kset, struct kobject *kobj)
- return 0;
- }
-
--static struct kset_uevent_ops slab_uevent_ops = {
-+static const struct kset_uevent_ops slab_uevent_ops = {
- .filter = uevent_filter,
- };
-
-@@ -4564,6 +4641,7 @@ static char *create_unique_id(struct kmem_cache *s)
- return name;
- }
-
-+#if defined(CONFIG_SLUB_DEBUG) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
- static int sysfs_slab_add(struct kmem_cache *s)
- {
- int err;
-@@ -4619,6 +4697,7 @@ static void sysfs_slab_remove(struct kmem_cache *s)
- kobject_del(&s->kobj);
- kobject_put(&s->kobj);
- }
-+#endif
-
- /*
- * Need to buffer aliases during bootup until sysfs becomes
-@@ -4632,6 +4711,7 @@ struct saved_alias {
-
- static struct saved_alias *alias_list;
-
-+#if defined(CONFIG_SLUB_DEBUG) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
- static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
- {
- struct saved_alias *al;
-@@ -4654,6 +4734,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
- alias_list = al;
- return 0;
- }
-+#endif
-
- static int __init slab_sysfs_init(void)
- {
-@@ -4785,7 +4866,13 @@ static const struct file_operations proc_slabinfo_operations = {
-
- static int __init slab_proc_init(void)
- {
-- proc_create("slabinfo", S_IRUGO, NULL, &proc_slabinfo_operations);
-+ mode_t gr_mode = S_IRUGO;
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+ gr_mode = S_IRUSR;
-+#endif
-+
-+ proc_create("slabinfo", gr_mode, NULL, &proc_slabinfo_operations);
- return 0;
- }
- module_init(slab_proc_init);
-diff --git a/mm/sparse-vmemmap.c b/mm/sparse-vmemmap.c
-index d9714bd..ce08e28 100644
---- a/mm/sparse-vmemmap.c
-+++ b/mm/sparse-vmemmap.c
-@@ -108,7 +108,7 @@ pud_t * __meminit vmemmap_pud_populate(pgd_t *pgd, unsigned long addr, int node)
- void *p = vmemmap_alloc_block(PAGE_SIZE, node);
- if (!p)
- return NULL;
-- pud_populate(&init_mm, pud, p);
-+ pud_populate_kernel(&init_mm, pud, p);
- }
- return pud;
- }
-@@ -120,7 +120,7 @@ pgd_t * __meminit vmemmap_pgd_populate(unsigned long addr, int node)
- void *p = vmemmap_alloc_block(PAGE_SIZE, node);
- if (!p)
- return NULL;
-- pgd_populate(&init_mm, pgd, p);
-+ pgd_populate_kernel(&init_mm, pgd, p);
- }
- return pgd;
- }
-diff --git a/mm/swap.c b/mm/swap.c
-index 308e57d..5de19c0 100644
---- a/mm/swap.c
-+++ b/mm/swap.c
-@@ -30,6 +30,7 @@
- #include <linux/notifier.h>
- #include <linux/backing-dev.h>
- #include <linux/memcontrol.h>
-+#include <linux/hugetlb.h>
-
- #include "internal.h"
-
-@@ -65,6 +66,8 @@ static void put_compound_page(struct page *page)
- compound_page_dtor *dtor;
-
- dtor = get_compound_page_dtor(page);
-+ if (!PageHuge(page))
-+ BUG_ON(dtor != free_compound_page);
- (*dtor)(page);
- }
- }
-diff --git a/mm/util.c b/mm/util.c
-index e48b493..24a601d 100644
---- a/mm/util.c
-+++ b/mm/util.c
-@@ -228,6 +228,12 @@ EXPORT_SYMBOL(strndup_user);
- void arch_pick_mmap_layout(struct mm_struct *mm)
- {
- mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- mm->get_unmapped_area = arch_get_unmapped_area;
- mm->unmap_area = arch_unmap_area;
- }
-diff --git a/mm/vmalloc.c b/mm/vmalloc.c
-index f34ffd0..1251316 100644
---- a/mm/vmalloc.c
-+++ b/mm/vmalloc.c
-@@ -40,8 +40,19 @@ static void vunmap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end)
-
- pte = pte_offset_kernel(pmd, addr);
- do {
-- pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
-- WARN_ON(!pte_none(ptent) && !pte_present(ptent));
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr < (unsigned long)MODULES_EXEC_END) {
-+ BUG_ON(!pte_exec(*pte));
-+ set_pte_at(&init_mm, addr, pte, pfn_pte(__pa(addr) >> PAGE_SHIFT, PAGE_KERNEL_EXEC));
-+ continue;
-+ }
-+#endif
-+
-+ {
-+ pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
-+ WARN_ON(!pte_none(ptent) && !pte_present(ptent));
-+ }
- } while (pte++, addr += PAGE_SIZE, addr != end);
- }
-
-@@ -101,16 +112,31 @@ static int vmap_pte_range(pmd_t *pmd, unsigned long addr,
- pte = pte_alloc_kernel(pmd, addr);
- if (!pte)
- return -ENOMEM;
-+
-+ pax_open_kernel();
- do {
- struct page *page = pages[*nr];
-
-- if (WARN_ON(!pte_none(*pte)))
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ if (!(pgprot_val(prot) & _PAGE_NX))
-+ BUG_ON(!pte_exec(*pte) || pte_pfn(*pte) != __pa(addr) >> PAGE_SHIFT);
-+ else
-+#endif
-+
-+ if (!pte_none(*pte)) {
-+ pax_close_kernel();
-+ WARN_ON(1);
- return -EBUSY;
-- if (WARN_ON(!page))
-+ }
-+ if (!page) {
-+ pax_close_kernel();
-+ WARN_ON(1);
- return -ENOMEM;
-+ }
- set_pte_at(&init_mm, addr, pte, mk_pte(page, prot));
- (*nr)++;
- } while (pte++, addr += PAGE_SIZE, addr != end);
-+ pax_close_kernel();
- return 0;
- }
-
-@@ -120,7 +146,7 @@ static int vmap_pmd_range(pud_t *pud, unsigned long addr,
- pmd_t *pmd;
- unsigned long next;
-
-- pmd = pmd_alloc(&init_mm, pud, addr);
-+ pmd = pmd_alloc_kernel(&init_mm, pud, addr);
- if (!pmd)
- return -ENOMEM;
- do {
-@@ -137,7 +163,7 @@ static int vmap_pud_range(pgd_t *pgd, unsigned long addr,
- pud_t *pud;
- unsigned long next;
-
-- pud = pud_alloc(&init_mm, pgd, addr);
-+ pud = pud_alloc_kernel(&init_mm, pgd, addr);
- if (!pud)
- return -ENOMEM;
- do {
-@@ -192,11 +218,20 @@ int is_vmalloc_or_module_addr(const void *x)
- * and fall back on vmalloc() if that fails. Others
- * just put it in the vmalloc space.
- */
--#if defined(CONFIG_MODULES) && defined(MODULES_VADDR)
-+#ifdef CONFIG_MODULES
-+#ifdef MODULES_VADDR
- unsigned long addr = (unsigned long)x;
- if (addr >= MODULES_VADDR && addr < MODULES_END)
- return 1;
- #endif
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ if (x >= (const void *)MODULES_EXEC_VADDR && x < (const void *)MODULES_EXEC_END)
-+ return 1;
-+#endif
-+
-+#endif
-+
- return is_vmalloc_addr(x);
- }
-
-@@ -217,8 +252,14 @@ struct page *vmalloc_to_page(const void *vmalloc_addr)
-
- if (!pgd_none(*pgd)) {
- pud_t *pud = pud_offset(pgd, addr);
-+#ifdef CONFIG_X86
-+ if (!pud_large(*pud))
-+#endif
- if (!pud_none(*pud)) {
- pmd_t *pmd = pmd_offset(pud, addr);
-+#ifdef CONFIG_X86
-+ if (!pmd_large(*pmd))
-+#endif
- if (!pmd_none(*pmd)) {
- pte_t *ptep, pte;
-
-@@ -292,13 +333,13 @@ static void __insert_vmap_area(struct vmap_area *va)
- struct rb_node *tmp;
-
- while (*p) {
-- struct vmap_area *tmp;
-+ struct vmap_area *varea;
-
- parent = *p;
-- tmp = rb_entry(parent, struct vmap_area, rb_node);
-- if (va->va_start < tmp->va_end)
-+ varea = rb_entry(parent, struct vmap_area, rb_node);
-+ if (va->va_start < varea->va_end)
- p = &(*p)->rb_left;
-- else if (va->va_end > tmp->va_start)
-+ else if (va->va_end > varea->va_start)
- p = &(*p)->rb_right;
- else
- BUG();
-@@ -323,7 +364,7 @@ static void purge_vmap_area_lazy(void);
- * Allocate a region of KVA of the specified size and alignment, within the
- * vstart and vend.
- */
--static struct vmap_area *alloc_vmap_area(unsigned long size,
-+static __size_overflow(1) struct vmap_area *alloc_vmap_area(unsigned long size,
- unsigned long align,
- unsigned long vstart, unsigned long vend,
- int node, gfp_t gfp_mask)
-@@ -1245,6 +1286,16 @@ static struct vm_struct *__get_vm_area_node(unsigned long size,
- struct vm_struct *area;
-
- BUG_ON(in_interrupt());
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
-+ if (flags & VM_KERNEXEC) {
-+ if (start != VMALLOC_START || end != VMALLOC_END)
-+ return NULL;
-+ start = (unsigned long)MODULES_EXEC_VADDR;
-+ end = (unsigned long)MODULES_EXEC_END;
-+ }
-+#endif
-+
- if (flags & VM_IOREMAP) {
- int bit = fls(size);
-
-@@ -1484,6 +1535,11 @@ void *vmap(struct page **pages, unsigned int count,
- if (count > totalram_pages)
- return NULL;
-
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
-+ if (!(pgprot_val(prot) & _PAGE_NX))
-+ flags |= VM_KERNEXEC;
-+#endif
-+
- area = get_vm_area_caller((count << PAGE_SHIFT), flags,
- __builtin_return_address(0));
- if (!area)
-@@ -1594,6 +1650,14 @@ static void *__vmalloc_node(unsigned long size, unsigned long align,
- if (!size || (size >> PAGE_SHIFT) > totalram_pages)
- return NULL;
-
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
-+ if (!(pgprot_val(prot) & _PAGE_NX))
-+ area = __get_vm_area_node(size, align, VM_ALLOC | VM_UNLIST | VM_KERNEXEC,
-+ VMALLOC_START, VMALLOC_END, node,
-+ gfp_mask, caller);
-+ else
-+#endif
-+
- area = __get_vm_area_node(size, align, VM_ALLOC | VM_UNLIST,
- VMALLOC_START, VMALLOC_END, node,
- gfp_mask, caller);
-@@ -1698,10 +1762,9 @@ EXPORT_SYMBOL(vmalloc_node);
- * For tight control over page level allocator and protection flags
- * use __vmalloc() instead.
- */
--
- void *vmalloc_exec(unsigned long size)
- {
-- return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
-+ return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, PAGE_KERNEL_EXEC,
- -1, __builtin_return_address(0));
- }
-
-@@ -1998,6 +2061,8 @@ int remap_vmalloc_range(struct vm_area_struct *vma, void *addr,
- unsigned long uaddr = vma->vm_start;
- unsigned long usize = vma->vm_end - vma->vm_start;
-
-+ BUG_ON(vma->vm_mirror);
-+
- if ((PAGE_SIZE-1) & (unsigned long)addr)
- return -EINVAL;
-
-@@ -2250,8 +2315,8 @@ struct vm_struct **pcpu_get_vm_areas(const unsigned long *offsets,
- return NULL;
- }
-
-- vms = kzalloc(sizeof(vms[0]) * nr_vms, gfp_mask);
-- vas = kzalloc(sizeof(vas[0]) * nr_vms, gfp_mask);
-+ vms = kcalloc(nr_vms, sizeof(vms[0]), gfp_mask);
-+ vas = kcalloc(nr_vms, sizeof(vas[0]), gfp_mask);
- if (!vas || !vms)
- goto err_free;
-
-@@ -2433,7 +2498,7 @@ static int s_show(struct seq_file *m, void *p)
- {
- struct vm_struct *v = p;
-
-- seq_printf(m, "0x%p-0x%p %7ld",
-+ seq_printf(m, "0x%pP-0x%pP %7ld",
- v->addr, v->addr + v->size, v->size);
-
- if (v->caller) {
-diff --git a/mm/vmstat.c b/mm/vmstat.c
-index 42d76c6..5643dc4 100644
---- a/mm/vmstat.c
-+++ b/mm/vmstat.c
-@@ -74,7 +74,7 @@ void vm_events_fold_cpu(int cpu)
- *
- * vm_stat contains the global counters
- */
--atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
-+atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
- EXPORT_SYMBOL(vm_stat);
-
- #ifdef CONFIG_SMP
-@@ -324,7 +324,7 @@ void refresh_cpu_vm_stats(int cpu)
- v = p->vm_stat_diff[i];
- p->vm_stat_diff[i] = 0;
- local_irq_restore(flags);
-- atomic_long_add(v, &zone->vm_stat[i]);
-+ atomic_long_add_unchecked(v, &zone->vm_stat[i]);
- global_diff[i] += v;
- #ifdef CONFIG_NUMA
- /* 3 seconds idle till flush */
-@@ -362,7 +362,7 @@ void refresh_cpu_vm_stats(int cpu)
-
- for (i = 0; i < NR_VM_ZONE_STAT_ITEMS; i++)
- if (global_diff[i])
-- atomic_long_add(global_diff[i], &vm_stat[i]);
-+ atomic_long_add_unchecked(global_diff[i], &vm_stat[i]);
- }
-
- #endif
-@@ -953,10 +953,20 @@ static int __init setup_vmstat(void)
- start_cpu_timer(cpu);
- #endif
- #ifdef CONFIG_PROC_FS
-- proc_create("buddyinfo", S_IRUGO, NULL, &fragmentation_file_operations);
-- proc_create("pagetypeinfo", S_IRUGO, NULL, &pagetypeinfo_file_ops);
-- proc_create("vmstat", S_IRUGO, NULL, &proc_vmstat_file_operations);
-- proc_create("zoneinfo", S_IRUGO, NULL, &proc_zoneinfo_file_operations);
-+ {
-+ mode_t gr_mode = S_IRUGO;
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+ gr_mode = S_IRUSR;
-+#endif
-+ proc_create("buddyinfo", gr_mode, NULL, &fragmentation_file_operations);
-+ proc_create("pagetypeinfo", gr_mode, NULL, &pagetypeinfo_file_ops);
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+ proc_create("vmstat", gr_mode | S_IRGRP, NULL, &proc_vmstat_file_operations);
-+#else
-+ proc_create("vmstat", gr_mode, NULL, &proc_vmstat_file_operations);
-+#endif
-+ proc_create("zoneinfo", gr_mode, NULL, &proc_zoneinfo_file_operations);
-+ }
- #endif
- return 0;
- }
-diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
-index a29c5ab..d841655 100644
---- a/net/8021q/vlan.c
-+++ b/net/8021q/vlan.c
-@@ -547,7 +547,7 @@ out:
- return NOTIFY_DONE;
- }
-
--static struct notifier_block vlan_notifier_block __read_mostly = {
-+static struct notifier_block vlan_notifier_block = {
- .notifier_call = vlan_device_event,
- };
-
-@@ -622,8 +622,7 @@ static int vlan_ioctl_handler(struct net *net, void __user *arg)
- err = -EPERM;
- if (!capable(CAP_NET_ADMIN))
- break;
-- if ((args.u.name_type >= 0) &&
-- (args.u.name_type < VLAN_NAME_TYPE_HIGHEST)) {
-+ if (args.u.name_type < VLAN_NAME_TYPE_HIGHEST) {
- struct vlan_net *vn;
-
- vn = net_generic(net, vlan_net_id);
-diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
-index a2d2984..f9eb711 100644
---- a/net/9p/trans_fd.c
-+++ b/net/9p/trans_fd.c
-@@ -419,7 +419,7 @@ static int p9_fd_write(struct p9_client *client, void *v, int len)
- oldfs = get_fs();
- set_fs(get_ds());
- /* The cast to a user pointer is valid due to the set_fs() */
-- ret = vfs_write(ts->wr, (__force void __user *)v, len, &ts->wr->f_pos);
-+ ret = vfs_write(ts->wr, (void __force_user *)v, len, &ts->wr->f_pos);
- set_fs(oldfs);
-
- if (ret <= 0 && ret != -ERESTARTSYS && ret != -EAGAIN)
-diff --git a/net/atm/atm_misc.c b/net/atm/atm_misc.c
-index 02cc7e7..4514f1b 100644
---- a/net/atm/atm_misc.c
-+++ b/net/atm/atm_misc.c
-@@ -19,7 +19,7 @@ int atm_charge(struct atm_vcc *vcc,int truesize)
- if (atomic_read(&sk_atm(vcc)->sk_rmem_alloc) <= sk_atm(vcc)->sk_rcvbuf)
- return 1;
- atm_return(vcc,truesize);
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- return 0;
- }
-
-@@ -41,7 +41,7 @@ struct sk_buff *atm_alloc_charge(struct atm_vcc *vcc,int pdu_size,
- }
- }
- atm_return(vcc,guess);
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- return NULL;
- }
-
-@@ -88,7 +88,7 @@ int atm_pcr_goal(const struct atm_trafprm *tp)
-
- void sonet_copy_stats(struct k_sonet_stats *from,struct sonet_stats *to)
- {
--#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
-+#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
- __SONET_ITEMS
- #undef __HANDLE_ITEM
- }
-@@ -96,7 +96,7 @@ void sonet_copy_stats(struct k_sonet_stats *from,struct sonet_stats *to)
-
- void sonet_subtract_stats(struct k_sonet_stats *from,struct sonet_stats *to)
- {
--#define __HANDLE_ITEM(i) atomic_sub(to->i,&from->i)
-+#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i,&from->i)
- __SONET_ITEMS
- #undef __HANDLE_ITEM
- }
-diff --git a/net/atm/lec.h b/net/atm/lec.h
-index 9d14d19..5c145f3 100644
---- a/net/atm/lec.h
-+++ b/net/atm/lec.h
-@@ -48,7 +48,7 @@ struct lane2_ops {
- const u8 *tlvs, u32 sizeoftlvs);
- void (*associate_indicator) (struct net_device *dev, const u8 *mac_addr,
- const u8 *tlvs, u32 sizeoftlvs);
--};
-+} __no_const;
-
- /*
- * ATM LAN Emulation supports both LLC & Dix Ethernet EtherType
-diff --git a/net/atm/mpoa_caches.c b/net/atm/mpoa_caches.c
-index 4504a4b..1733f1e 100644
---- a/net/atm/mpoa_caches.c
-+++ b/net/atm/mpoa_caches.c
-@@ -498,6 +498,8 @@ static void clear_expired(struct mpoa_client *client)
- struct timeval now;
- struct k_message msg;
-
-+ pax_track_stack();
-+
- do_gettimeofday(&now);
-
- write_lock_irq(&client->egress_lock);
-diff --git a/net/atm/proc.c b/net/atm/proc.c
-index ab8419a..aa91497 100644
---- a/net/atm/proc.c
-+++ b/net/atm/proc.c
-@@ -43,9 +43,9 @@ static void add_stats(struct seq_file *seq, const char *aal,
- const struct k_atm_aal_stats *stats)
- {
- seq_printf(seq, "%s ( %d %d %d %d %d )", aal,
-- atomic_read(&stats->tx),atomic_read(&stats->tx_err),
-- atomic_read(&stats->rx),atomic_read(&stats->rx_err),
-- atomic_read(&stats->rx_drop));
-+ atomic_read_unchecked(&stats->tx),atomic_read_unchecked(&stats->tx_err),
-+ atomic_read_unchecked(&stats->rx),atomic_read_unchecked(&stats->rx_err),
-+ atomic_read_unchecked(&stats->rx_drop));
- }
-
- static void atm_dev_info(struct seq_file *seq, const struct atm_dev *dev)
-@@ -188,7 +188,12 @@ static void vcc_info(struct seq_file *seq, struct atm_vcc *vcc)
- {
- struct sock *sk = sk_atm(vcc);
-
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ seq_printf(seq, "%p ", NULL);
-+#else
- seq_printf(seq, "%p ", vcc);
-+#endif
-+
- if (!vcc->dev)
- seq_printf(seq, "Unassigned ");
- else
-@@ -214,7 +219,11 @@ static void svc_info(struct seq_file *seq, struct atm_vcc *vcc)
- {
- if (!vcc->dev)
- seq_printf(seq, sizeof(void *) == 4 ?
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ "N/A@%p%10s" : "N/A@%p%2s", NULL, "");
-+#else
- "N/A@%p%10s" : "N/A@%p%2s", vcc, "");
-+#endif
- else
- seq_printf(seq, "%3d %3d %5d ",
- vcc->dev->number, vcc->vpi, vcc->vci);
-diff --git a/net/atm/resources.c b/net/atm/resources.c
-index 56b7322..c48b84e 100644
---- a/net/atm/resources.c
-+++ b/net/atm/resources.c
-@@ -161,7 +161,7 @@ void atm_dev_deregister(struct atm_dev *dev)
- static void copy_aal_stats(struct k_atm_aal_stats *from,
- struct atm_aal_stats *to)
- {
--#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
-+#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
- __AAL_STAT_ITEMS
- #undef __HANDLE_ITEM
- }
-@@ -170,7 +170,7 @@ static void copy_aal_stats(struct k_atm_aal_stats *from,
- static void subtract_aal_stats(struct k_atm_aal_stats *from,
- struct atm_aal_stats *to)
- {
--#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
-+#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i, &from->i)
- __AAL_STAT_ITEMS
- #undef __HANDLE_ITEM
- }
-diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
-index 45caaaa..09e36d3 100644
---- a/net/bluetooth/hci_sock.c
-+++ b/net/bluetooth/hci_sock.c
-@@ -511,7 +511,7 @@ static int hci_sock_setsockopt(struct socket *sock, int level, int optname, char
- uf.event_mask[1] = *((u32 *) f->event_mask + 1);
- }
-
-- len = min_t(unsigned int, len, sizeof(uf));
-+ len = min((size_t)len, sizeof(uf));
- if (copy_from_user(&uf, optval, len)) {
- err = -EFAULT;
- break;
-diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
-index 0c2c59d..6b0a111 100644
---- a/net/bluetooth/hidp/core.c
-+++ b/net/bluetooth/hidp/core.c
-@@ -778,9 +778,9 @@ static int hidp_setup_hid(struct hidp_session *session,
- hid->version = req->version;
- hid->country = req->country;
-
-- strncpy(hid->name, req->name, sizeof(req->name) - 1);
-- strncpy(hid->phys, batostr(&src), 64);
-- strncpy(hid->uniq, batostr(&dst), 64);
-+ strncpy(hid->name, req->name, sizeof(hid->name) - 1);
-+ strncpy(hid->phys, batostr(&src), sizeof(hid->phys) - 1);
-+ strncpy(hid->uniq, batostr(&dst), sizeof(hid->uniq) - 1);
-
- hid->dev.parent = hidp_get_device(session);
- hid->ll_driver = &hidp_hid_driver;
-diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
-index 1c20bd9..9d36d02 100644
---- a/net/bluetooth/l2cap.c
-+++ b/net/bluetooth/l2cap.c
-@@ -2063,6 +2063,9 @@ static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
- BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %d",
- conn, code, ident, dlen);
-
-+ if (conn->mtu < L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE)
-+ return NULL;
-+
- len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
- count = min_t(unsigned int, conn->mtu, len);
-
-diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
-index 1db0132..5e0453d 100644
---- a/net/bluetooth/rfcomm/sock.c
-+++ b/net/bluetooth/rfcomm/sock.c
-@@ -794,7 +794,7 @@ static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, c
-
- sec.level = BT_SECURITY_LOW;
-
-- len = min_t(unsigned int, sizeof(sec), optlen);
-+ len = min(sizeof(sec), len);
- if (copy_from_user((char *) &sec, optval, len)) {
- err = -EFAULT;
- break;
-diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
-index 5f6a305..00b8f21 100644
---- a/net/bluetooth/rfcomm/tty.c
-+++ b/net/bluetooth/rfcomm/tty.c
-@@ -472,7 +472,8 @@ static int rfcomm_get_dev_list(void __user *arg)
-
- size = sizeof(*dl) + dev_num * sizeof(*di);
-
-- if (!(dl = kmalloc(size, GFP_KERNEL)))
-+ dl = kzalloc(size, GFP_KERNEL);
-+ if (!dl)
- return -ENOMEM;
-
- di = dl->dev_info;
-diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
-index 8567d47..bba2292 100644
---- a/net/bridge/br_private.h
-+++ b/net/bridge/br_private.h
-@@ -255,7 +255,7 @@ extern void br_ifinfo_notify(int event, struct net_bridge_port *port);
-
- #ifdef CONFIG_SYSFS
- /* br_sysfs_if.c */
--extern struct sysfs_ops brport_sysfs_ops;
-+extern const struct sysfs_ops brport_sysfs_ops;
- extern int br_sysfs_addif(struct net_bridge_port *p);
-
- /* br_sysfs_br.c */
-diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
-index 9a52ac5..c97538e 100644
---- a/net/bridge/br_stp_if.c
-+++ b/net/bridge/br_stp_if.c
-@@ -146,7 +146,7 @@ static void br_stp_stop(struct net_bridge *br)
- char *envp[] = { NULL };
-
- if (br->stp_enabled == BR_USER_STP) {
-- r = call_usermodehelper(BR_STP_PROG, argv, envp, 1);
-+ r = call_usermodehelper(BR_STP_PROG, argv, envp, UMH_WAIT_PROC);
- printk(KERN_INFO "%s: userspace STP stopped, return code %d\n",
- br->dev->name, r);
-
-diff --git a/net/bridge/br_sysfs_if.c b/net/bridge/br_sysfs_if.c
-index 820643a..ce77fb3 100644
---- a/net/bridge/br_sysfs_if.c
-+++ b/net/bridge/br_sysfs_if.c
-@@ -220,7 +220,7 @@ static ssize_t brport_store(struct kobject * kobj,
- return ret;
- }
-
--struct sysfs_ops brport_sysfs_ops = {
-+const struct sysfs_ops brport_sysfs_ops = {
- .show = brport_show,
- .store = brport_store,
- };
-diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
-index d73d47f..72df42a 100644
---- a/net/bridge/netfilter/ebtables.c
-+++ b/net/bridge/netfilter/ebtables.c
-@@ -1337,6 +1337,8 @@ static int copy_everything_to_user(struct ebt_table *t, void __user *user,
- unsigned int entries_size, nentries;
- char *entries;
-
-+ pax_track_stack();
-+
- if (cmd == EBT_SO_GET_ENTRIES) {
- entries_size = t->private->entries_size;
- nentries = t->private->nentries;
-diff --git a/net/can/af_can.c b/net/can/af_can.c
-index 6068321..a460dd0 100644
---- a/net/can/af_can.c
-+++ b/net/can/af_can.c
-@@ -849,7 +849,7 @@ static struct net_proto_family can_family_ops __read_mostly = {
- };
-
- /* notifier block for netdevice event */
--static struct notifier_block can_netdev_notifier __read_mostly = {
-+static struct notifier_block can_netdev_notifier = {
- .notifier_call = can_notifier,
- };
-
-diff --git a/net/can/bcm.c b/net/can/bcm.c
-index 2ffd2e0..e002f92 100644
---- a/net/can/bcm.c
-+++ b/net/can/bcm.c
-@@ -164,9 +164,15 @@ static int bcm_proc_show(struct seq_file *m, void *v)
- struct bcm_sock *bo = bcm_sk(sk);
- struct bcm_op *op;
-
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ seq_printf(m, ">>> socket %p", NULL);
-+ seq_printf(m, " / sk %p", NULL);
-+ seq_printf(m, " / bo %p", NULL);
-+#else
- seq_printf(m, ">>> socket %p", sk->sk_socket);
- seq_printf(m, " / sk %p", sk);
- seq_printf(m, " / bo %p", bo);
-+#endif
- seq_printf(m, " / dropped %lu", bo->dropped_usr_msgs);
- seq_printf(m, " / bound %s", bcm_proc_getifname(ifname, bo->ifindex));
- seq_printf(m, " <<<\n");
-@@ -1091,6 +1097,9 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
- op->sk = sk;
- op->ifindex = ifindex;
-
-+ /* ifindex for timeout events w/o previous frame reception */
-+ op->rx_ifindex = ifindex;
-+
- /* initialize uninitialized (kzalloc) structure */
- hrtimer_init(&op->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
- op->timer.function = bcm_rx_timeout_handler;
-diff --git a/net/compat.c b/net/compat.c
-index 9559afc..6c62f69 100644
---- a/net/compat.c
-+++ b/net/compat.c
-@@ -69,9 +69,9 @@ int get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr __user *umsg)
- __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
- __get_user(kmsg->msg_flags, &umsg->msg_flags))
- return -EFAULT;
-- kmsg->msg_name = compat_ptr(tmp1);
-- kmsg->msg_iov = compat_ptr(tmp2);
-- kmsg->msg_control = compat_ptr(tmp3);
-+ kmsg->msg_name = (void __force_kernel *)compat_ptr(tmp1);
-+ kmsg->msg_iov = (void __force_kernel *)compat_ptr(tmp2);
-+ kmsg->msg_control = (void __force_kernel *)compat_ptr(tmp3);
- return 0;
- }
-
-@@ -94,7 +94,7 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
- kern_msg->msg_name = NULL;
-
- tot_len = iov_from_user_compat_to_kern(kern_iov,
-- (struct compat_iovec __user *)kern_msg->msg_iov,
-+ (struct compat_iovec __force_user *)kern_msg->msg_iov,
- kern_msg->msg_iovlen);
- if (tot_len >= 0)
- kern_msg->msg_iov = kern_iov;
-@@ -114,20 +114,20 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
-
- #define CMSG_COMPAT_FIRSTHDR(msg) \
- (((msg)->msg_controllen) >= sizeof(struct compat_cmsghdr) ? \
-- (struct compat_cmsghdr __user *)((msg)->msg_control) : \
-+ (struct compat_cmsghdr __force_user *)((msg)->msg_control) : \
- (struct compat_cmsghdr __user *)NULL)
-
- #define CMSG_COMPAT_OK(ucmlen, ucmsg, mhdr) \
- ((ucmlen) >= sizeof(struct compat_cmsghdr) && \
- (ucmlen) <= (unsigned long) \
- ((mhdr)->msg_controllen - \
-- ((char *)(ucmsg) - (char *)(mhdr)->msg_control)))
-+ ((char __force_kernel *)(ucmsg) - (char *)(mhdr)->msg_control)))
-
- static inline struct compat_cmsghdr __user *cmsg_compat_nxthdr(struct msghdr *msg,
- struct compat_cmsghdr __user *cmsg, int cmsg_len)
- {
- char __user *ptr = (char __user *)cmsg + CMSG_COMPAT_ALIGN(cmsg_len);
-- if ((unsigned long)(ptr + 1 - (char __user *)msg->msg_control) >
-+ if ((unsigned long)(ptr + 1 - (char __force_user *)msg->msg_control) >
- msg->msg_controllen)
- return NULL;
- return (struct compat_cmsghdr __user *)ptr;
-@@ -219,7 +219,7 @@ int put_cmsg_compat(struct msghdr *kmsg, int level, int type, int len, void *dat
- {
- struct compat_timeval ctv;
- struct compat_timespec cts[3];
-- struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __user *) kmsg->msg_control;
-+ struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __force_user *) kmsg->msg_control;
- struct compat_cmsghdr cmhdr;
- int cmlen;
-
-@@ -271,7 +271,7 @@ int put_cmsg_compat(struct msghdr *kmsg, int level, int type, int len, void *dat
-
- void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm)
- {
-- struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __user *) kmsg->msg_control;
-+ struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __force_user *) kmsg->msg_control;
- int fdmax = (kmsg->msg_controllen - sizeof(struct compat_cmsghdr)) / sizeof(int);
- int fdnum = scm->fp->count;
- struct file **fp = scm->fp->fp;
-@@ -433,7 +433,7 @@ static int do_get_sock_timeout(struct socket *sock, int level, int optname,
- len = sizeof(ktime);
- old_fs = get_fs();
- set_fs(KERNEL_DS);
-- err = sock_getsockopt(sock, level, optname, (char *) &ktime, &len);
-+ err = sock_getsockopt(sock, level, optname, (char __force_user *) &ktime, (int __force_user *)&len);
- set_fs(old_fs);
-
- if (!err) {
-@@ -570,7 +570,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
- case MCAST_JOIN_GROUP:
- case MCAST_LEAVE_GROUP:
- {
-- struct compat_group_req __user *gr32 = (void *)optval;
-+ struct compat_group_req __user *gr32 = (void __user *)optval;
- struct group_req __user *kgr =
- compat_alloc_user_space(sizeof(struct group_req));
- u32 interface;
-@@ -591,7 +591,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
- case MCAST_BLOCK_SOURCE:
- case MCAST_UNBLOCK_SOURCE:
- {
-- struct compat_group_source_req __user *gsr32 = (void *)optval;
-+ struct compat_group_source_req __user *gsr32 = (void __user *)optval;
- struct group_source_req __user *kgsr = compat_alloc_user_space(
- sizeof(struct group_source_req));
- u32 interface;
-@@ -612,7 +612,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
- }
- case MCAST_MSFILTER:
- {
-- struct compat_group_filter __user *gf32 = (void *)optval;
-+ struct compat_group_filter __user *gf32 = (void __user *)optval;
- struct group_filter __user *kgf;
- u32 interface, fmode, numsrc;
-
-@@ -765,7 +765,7 @@ asmlinkage long compat_sys_socketcall(int call, u32 __user *args)
-
- if (call < SYS_SOCKET || call > SYS_ACCEPT4)
- return -EINVAL;
-- if (copy_from_user(a, args, nas[call]))
-+ if (nas[call] > sizeof a || copy_from_user(a, args, nas[call]))
- return -EFAULT;
- a0 = a[0];
- a1 = a[1];
-diff --git a/net/core/dev.c b/net/core/dev.c
-index d775563..7eb1c8d 100644
---- a/net/core/dev.c
-+++ b/net/core/dev.c
-@@ -1050,10 +1050,14 @@ void dev_load(struct net *net, const char *name)
- if (no_module && capable(CAP_NET_ADMIN))
- no_module = request_module("netdev-%s", name);
- if (no_module && capable(CAP_SYS_MODULE)) {
-+#ifdef CONFIG_GRKERNSEC_MODHARDEN
-+ ___request_module(true, "grsec_modharden_netdev", "%s", name);
-+#else
- if (!request_module("%s", name))
- pr_err("Loading kernel module for a network device "
- "with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%s "
- "instead\n", name);
-+#endif
- }
- }
- EXPORT_SYMBOL(dev_load);
-@@ -1658,7 +1662,7 @@ static inline int illegal_highdma(struct net_device *dev, struct sk_buff *skb)
-
- struct dev_gso_cb {
- void (*destructor)(struct sk_buff *skb);
--};
-+} __no_const;
-
- #define DEV_GSO_CB(skb) ((struct dev_gso_cb *)(skb)->cb)
-
-@@ -2067,7 +2071,7 @@ int netif_rx_ni(struct sk_buff *skb)
- }
- EXPORT_SYMBOL(netif_rx_ni);
-
--static void net_tx_action(struct softirq_action *h)
-+static void net_tx_action(void)
- {
- struct softnet_data *sd = &__get_cpu_var(softnet_data);
-
-@@ -2831,7 +2835,7 @@ void netif_napi_del(struct napi_struct *napi)
- EXPORT_SYMBOL(netif_napi_del);
-
-
--static void net_rx_action(struct softirq_action *h)
-+static void net_rx_action(void)
- {
- struct list_head *list = &__get_cpu_var(softnet_data).poll_list;
- unsigned long time_limit = jiffies + 2;
-@@ -3267,8 +3271,13 @@ static int ptype_seq_show(struct seq_file *seq, void *v)
- else
- seq_printf(seq, "%04x", ntohs(pt->type));
-
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ seq_printf(seq, " %-8s %p\n",
-+ pt->dev ? pt->dev->name : "", NULL);
-+#else
- seq_printf(seq, " %-8s %pF\n",
- pt->dev ? pt->dev->name : "", pt->func);
-+#endif
- }
-
- return 0;
-diff --git a/net/core/flow.c b/net/core/flow.c
-index 9601587..8c4824e 100644
---- a/net/core/flow.c
-+++ b/net/core/flow.c
-@@ -35,11 +35,11 @@ struct flow_cache_entry {
- atomic_t *object_ref;
- };
-
--atomic_t flow_cache_genid = ATOMIC_INIT(0);
-+atomic_unchecked_t flow_cache_genid = ATOMIC_INIT(0);
-
- static u32 flow_hash_shift;
- #define flow_hash_size (1 << flow_hash_shift)
--static DEFINE_PER_CPU(struct flow_cache_entry **, flow_tables) = { NULL };
-+static DEFINE_PER_CPU(struct flow_cache_entry **, flow_tables);
-
- #define flow_table(cpu) (per_cpu(flow_tables, cpu))
-
-@@ -52,7 +52,7 @@ struct flow_percpu_info {
- u32 hash_rnd;
- int count;
- };
--static DEFINE_PER_CPU(struct flow_percpu_info, flow_hash_info) = { 0 };
-+static DEFINE_PER_CPU(struct flow_percpu_info, flow_hash_info);
-
- #define flow_hash_rnd_recalc(cpu) \
- (per_cpu(flow_hash_info, cpu).hash_rnd_recalc)
-@@ -69,7 +69,7 @@ struct flow_flush_info {
- atomic_t cpuleft;
- struct completion completion;
- };
--static DEFINE_PER_CPU(struct tasklet_struct, flow_flush_tasklets) = { NULL };
-+static DEFINE_PER_CPU(struct tasklet_struct, flow_flush_tasklets);
-
- #define flow_flush_tasklet(cpu) (&per_cpu(flow_flush_tasklets, cpu))
-
-@@ -190,7 +190,7 @@ void *flow_cache_lookup(struct net *net, struct flowi *key, u16 family, u8 dir,
- if (fle->family == family &&
- fle->dir == dir &&
- flow_key_compare(key, &fle->key) == 0) {
-- if (fle->genid == atomic_read(&flow_cache_genid)) {
-+ if (fle->genid == atomic_read_unchecked(&flow_cache_genid)) {
- void *ret = fle->object;
-
- if (ret)
-@@ -228,7 +228,7 @@ nocache:
- err = resolver(net, key, family, dir, &obj, &obj_ref);
-
- if (fle && !err) {
-- fle->genid = atomic_read(&flow_cache_genid);
-+ fle->genid = atomic_read_unchecked(&flow_cache_genid);
-
- if (fle->object)
- atomic_dec(fle->object_ref);
-@@ -258,7 +258,7 @@ static void flow_cache_flush_tasklet(unsigned long data)
-
- fle = flow_table(cpu)[i];
- for (; fle; fle = fle->next) {
-- unsigned genid = atomic_read(&flow_cache_genid);
-+ unsigned genid = atomic_read_unchecked(&flow_cache_genid);
-
- if (!fle->object || fle->genid == genid)
- continue;
-diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
-index 9d70042..9adcdc5 100644
---- a/net/core/rtnetlink.c
-+++ b/net/core/rtnetlink.c
-@@ -57,7 +57,7 @@ struct rtnl_link
- {
- rtnl_doit_func doit;
- rtnl_dumpit_func dumpit;
--};
-+} __no_const;
-
- static DEFINE_MUTEX(rtnl_mutex);
-
-diff --git a/net/core/scm.c b/net/core/scm.c
-index d98eafc..1a190a9 100644
---- a/net/core/scm.c
-+++ b/net/core/scm.c
-@@ -191,7 +191,7 @@ error:
- int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
- {
- struct cmsghdr __user *cm
-- = (__force struct cmsghdr __user *)msg->msg_control;
-+ = (struct cmsghdr __force_user *)msg->msg_control;
- struct cmsghdr cmhdr;
- int cmlen = CMSG_LEN(len);
- int err;
-@@ -214,7 +214,7 @@ int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
- err = -EFAULT;
- if (copy_to_user(cm, &cmhdr, sizeof cmhdr))
- goto out;
-- if (copy_to_user(CMSG_DATA(cm), data, cmlen - sizeof(struct cmsghdr)))
-+ if (copy_to_user((void __force_user *)CMSG_DATA((void __force_kernel *)cm), data, cmlen - sizeof(struct cmsghdr)))
- goto out;
- cmlen = CMSG_SPACE(len);
- if (msg->msg_controllen < cmlen)
-@@ -229,7 +229,7 @@ out:
- void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
- {
- struct cmsghdr __user *cm
-- = (__force struct cmsghdr __user*)msg->msg_control;
-+ = (struct cmsghdr __force_user *)msg->msg_control;
-
- int fdmax = 0;
- int fdnum = scm->fp->count;
-@@ -249,7 +249,7 @@ void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
- if (fdnum < fdmax)
- fdmax = fdnum;
-
-- for (i=0, cmfptr=(__force int __user *)CMSG_DATA(cm); i<fdmax;
-+ for (i=0, cmfptr=(int __force_user *)CMSG_DATA((void __force_kernel *)cm); i<fdmax;
- i++, cmfptr++)
- {
- int new_fd;
-diff --git a/net/core/secure_seq.c b/net/core/secure_seq.c
-index 45329d7..626aaa6 100644
---- a/net/core/secure_seq.c
-+++ b/net/core/secure_seq.c
-@@ -57,7 +57,7 @@ __u32 secure_tcpv6_sequence_number(__be32 *saddr, __be32 *daddr,
- EXPORT_SYMBOL(secure_tcpv6_sequence_number);
-
- u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
-- __be16 dport)
-+ __be16 dport)
- {
- u32 secret[MD5_MESSAGE_BYTES / 4];
- u32 hash[MD5_DIGEST_WORDS];
-@@ -71,7 +71,6 @@ u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
- secret[i] = net_secret[i];
-
- md5_transform(hash, secret);
--
- return hash[0];
- }
- #endif
-diff --git a/net/core/skbuff.c b/net/core/skbuff.c
-index 72ff527..a014894 100644
---- a/net/core/skbuff.c
-+++ b/net/core/skbuff.c
-@@ -1544,6 +1544,8 @@ int skb_splice_bits(struct sk_buff *skb, unsigned int offset,
- struct sk_buff *frag_iter;
- struct sock *sk = skb->sk;
-
-+ pax_track_stack();
-+
- /*
- * __skb_splice_bits() only fails if the output has no room left,
- * so no point in going over the frag_list for the error case.
-diff --git a/net/core/sock.c b/net/core/sock.c
-index eafa660..d53ed34 100644
---- a/net/core/sock.c
-+++ b/net/core/sock.c
-@@ -865,11 +865,15 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
- break;
-
- case SO_PEERCRED:
-+ {
-+ struct ucred peercred;
- if (len > sizeof(sk->sk_peercred))
- len = sizeof(sk->sk_peercred);
-- if (copy_to_user(optval, &sk->sk_peercred, len))
-+ peercred = sk->sk_peercred;
-+ if (copy_to_user(optval, &peercred, len))
- return -EFAULT;
- goto lenout;
-+ }
-
- case SO_PEERNAME:
- {
-@@ -1896,7 +1900,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
- */
- smp_wmb();
- atomic_set(&sk->sk_refcnt, 1);
-- atomic_set(&sk->sk_drops, 0);
-+ atomic_set_unchecked(&sk->sk_drops, 0);
- }
- EXPORT_SYMBOL(sock_init_data);
-
-diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c
-index 34dcc79..f51ed45 100644
---- a/net/dccp/ccids/ccid3.c
-+++ b/net/dccp/ccids/ccid3.c
-@@ -604,20 +604,29 @@ static void ccid3_hc_tx_get_info(struct sock *sk, struct tcp_info *info)
- static int ccid3_hc_tx_getsockopt(struct sock *sk, const int optname, int len,
- u32 __user *optval, int __user *optlen)
- {
-- const struct ccid3_hc_tx_sock *hctx;
-+ const struct ccid3_hc_tx_sock *hc = ccid3_hc_tx_sk(sk);
-+ struct tfrc_tx_info tfrc;
- const void *val;
-
- /* Listen socks doesn't have a private CCID block */
- if (sk->sk_state == DCCP_LISTEN)
- return -EINVAL;
-
-- hctx = ccid3_hc_tx_sk(sk);
- switch (optname) {
- case DCCP_SOCKOPT_CCID_TX_INFO:
-- if (len < sizeof(hctx->ccid3hctx_tfrc))
-+ if (len < sizeof(tfrc))
- return -EINVAL;
-- len = sizeof(hctx->ccid3hctx_tfrc);
-- val = &hctx->ccid3hctx_tfrc;
-+
-+ memset(&tfrc, 0, sizeof(tfrc));
-+ tfrc.tfrctx_x = hc->ccid3hctx_x;
-+ tfrc.tfrctx_x_recv = hc->ccid3hctx_x_recv;
-+ tfrc.tfrctx_x_calc = hc->ccid3hctx_x_calc;
-+ tfrc.tfrctx_rtt = hc->ccid3hctx_rtt;
-+ tfrc.tfrctx_p = hc->ccid3hctx_p;
-+ tfrc.tfrctx_rto = hc->ccid3hctx_t_rto;
-+ tfrc.tfrctx_ipi = hc->ccid3hctx_t_ipi;
-+ len = sizeof(tfrc);
-+ val = &tfrc;
- break;
- default:
- return -ENOPROTOOPT;
-diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
-index 5df7b54..af2376e 100644
---- a/net/decnet/af_decnet.c
-+++ b/net/decnet/af_decnet.c
-@@ -469,6 +469,7 @@ static struct proto dn_proto = {
- .sysctl_rmem = sysctl_decnet_rmem,
- .max_header = DN_MAX_NSP_DATA_HEADER + 64,
- .obj_size = sizeof(struct dn_sock),
-+ .slab_flags = SLAB_USERCOPY,
- };
-
- static struct sock *dn_alloc_sock(struct net *net, struct socket *sock, gfp_t gfp)
-diff --git a/net/decnet/sysctl_net_decnet.c b/net/decnet/sysctl_net_decnet.c
-index 2036568..c55883d 100644
---- a/net/decnet/sysctl_net_decnet.c
-+++ b/net/decnet/sysctl_net_decnet.c
-@@ -206,7 +206,7 @@ static int dn_node_address_handler(ctl_table *table, int write,
-
- if (len > *lenp) len = *lenp;
-
-- if (copy_to_user(buffer, addr, len))
-+ if (len > sizeof addr || copy_to_user(buffer, addr, len))
- return -EFAULT;
-
- *lenp = len;
-@@ -327,7 +327,7 @@ static int dn_def_dev_handler(ctl_table *table, int write,
-
- if (len > *lenp) len = *lenp;
-
-- if (copy_to_user(buffer, devname, len))
-+ if (len > sizeof devname || copy_to_user(buffer, devname, len))
- return -EFAULT;
-
- *lenp = len;
-diff --git a/net/econet/Kconfig b/net/econet/Kconfig
-index 39a2d29..f39c0fe 100644
---- a/net/econet/Kconfig
-+++ b/net/econet/Kconfig
-@@ -4,7 +4,7 @@
-
- config ECONET
- tristate "Acorn Econet/AUN protocols (EXPERIMENTAL)"
-- depends on EXPERIMENTAL && INET
-+ depends on EXPERIMENTAL && INET && BROKEN
- ---help---
- Econet is a fairly old and slow networking protocol mainly used by
- Acorn computers to access file and print servers. It uses native
-diff --git a/net/ieee802154/dgram.c b/net/ieee802154/dgram.c
-index a413b1b..380849c 100644
---- a/net/ieee802154/dgram.c
-+++ b/net/ieee802154/dgram.c
-@@ -318,7 +318,7 @@ out:
- static int dgram_rcv_skb(struct sock *sk, struct sk_buff *skb)
- {
- if (sock_queue_rcv_skb(sk, skb) < 0) {
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- kfree_skb(skb);
- return NET_RX_DROP;
- }
-diff --git a/net/ieee802154/raw.c b/net/ieee802154/raw.c
-index 30e74ee..bfc6ee0 100644
---- a/net/ieee802154/raw.c
-+++ b/net/ieee802154/raw.c
-@@ -206,7 +206,7 @@ out:
- static int raw_rcv_skb(struct sock *sk, struct sk_buff *skb)
- {
- if (sock_queue_rcv_skb(sk, skb) < 0) {
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- kfree_skb(skb);
- return NET_RX_DROP;
- }
-diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
-index 4e80f33..a815e4e 100644
---- a/net/ipv4/arp.c
-+++ b/net/ipv4/arp.c
-@@ -909,23 +909,25 @@ static void parp_redo(struct sk_buff *skb)
- static int arp_rcv(struct sk_buff *skb, struct net_device *dev,
- struct packet_type *pt, struct net_device *orig_dev)
- {
-- struct arphdr *arp;
-+ const struct arphdr *arp;
-
-- /* ARP header, plus 2 device addresses, plus 2 IP addresses. */
-- if (!pskb_may_pull(skb, arp_hdr_len(dev)))
-- goto freeskb;
--
-- arp = arp_hdr(skb);
-- if (arp->ar_hln != dev->addr_len ||
-- dev->flags & IFF_NOARP ||
-+ if (dev->flags & IFF_NOARP ||
- skb->pkt_type == PACKET_OTHERHOST ||
-- skb->pkt_type == PACKET_LOOPBACK ||
-- arp->ar_pln != 4)
-+ skb->pkt_type == PACKET_LOOPBACK)
- goto freeskb;
-
-- if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
-+ skb = skb_share_check(skb, GFP_ATOMIC);
-+ if (!skb)
- goto out_of_mem;
-
-+ /* ARP header, plus 2 device addresses, plus 2 IP addresses. */
-+ if (!pskb_may_pull(skb, arp_hdr_len(dev)))
-+ goto freeskb;
-+
-+ arp = arp_hdr(skb);
-+ if (arp->ar_hln != dev->addr_len || arp->ar_pln != 4)
-+ goto freeskb;
-+
- memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
-
- return NF_HOOK(NFPROTO_ARP, NF_ARP_IN, skb, dev, NULL, arp_process);
-diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c
-index 5e6c5a0..30aeb26 100644
---- a/net/ipv4/datagram.c
-+++ b/net/ipv4/datagram.c
-@@ -52,7 +52,7 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
- inet->sport, usin->sin_port, sk, 1);
- if (err) {
- if (err == -ENETUNREACH)
-- IP_INC_STATS_BH(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
-+ IP_INC_STATS(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
- return err;
- }
-
-diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
-index dba56d2..b1b4cdd 100644
---- a/net/ipv4/inet_diag.c
-+++ b/net/ipv4/inet_diag.c
-@@ -113,11 +113,20 @@ static int inet_csk_diag_fill(struct sock *sk,
- r->idiag_retrans = 0;
-
- r->id.idiag_if = sk->sk_bound_dev_if;
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ r->id.idiag_cookie[0] = 0;
-+ r->id.idiag_cookie[1] = 0;
-+#else
- r->id.idiag_cookie[0] = (u32)(unsigned long)sk;
- r->id.idiag_cookie[1] = (u32)(((unsigned long)sk >> 31) >> 1);
-+#endif
-
- r->id.idiag_sport = inet->sport;
- r->id.idiag_dport = inet->dport;
-+
-+ memset(&r->id.idiag_src, 0, sizeof(r->id.idiag_src));
-+ memset(&r->id.idiag_dst, 0, sizeof(r->id.idiag_dst));
-+
- r->id.idiag_src[0] = inet->rcv_saddr;
- r->id.idiag_dst[0] = inet->daddr;
-
-@@ -199,13 +208,26 @@ static int inet_twsk_diag_fill(struct inet_timewait_sock *tw,
-
- r->idiag_family = tw->tw_family;
- r->idiag_retrans = 0;
-+
- r->id.idiag_if = tw->tw_bound_dev_if;
-+
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ r->id.idiag_cookie[0] = 0;
-+ r->id.idiag_cookie[1] = 0;
-+#else
- r->id.idiag_cookie[0] = (u32)(unsigned long)tw;
- r->id.idiag_cookie[1] = (u32)(((unsigned long)tw >> 31) >> 1);
-+#endif
-+
- r->id.idiag_sport = tw->tw_sport;
- r->id.idiag_dport = tw->tw_dport;
-+
-+ memset(&r->id.idiag_src, 0, sizeof(r->id.idiag_src));
-+ memset(&r->id.idiag_dst, 0, sizeof(r->id.idiag_dst));
-+
- r->id.idiag_src[0] = tw->tw_rcv_saddr;
- r->id.idiag_dst[0] = tw->tw_daddr;
-+
- r->idiag_state = tw->tw_substate;
- r->idiag_timer = 3;
- r->idiag_expires = DIV_ROUND_UP(tmo * 1000, HZ);
-@@ -284,12 +306,14 @@ static int inet_diag_get_exact(struct sk_buff *in_skb,
- if (sk == NULL)
- goto unlock;
-
-+#ifndef CONFIG_GRKERNSEC_HIDESYM
- err = -ESTALE;
- if ((req->id.idiag_cookie[0] != INET_DIAG_NOCOOKIE ||
- req->id.idiag_cookie[1] != INET_DIAG_NOCOOKIE) &&
- ((u32)(unsigned long)sk != req->id.idiag_cookie[0] ||
- (u32)((((unsigned long)sk) >> 31) >> 1) != req->id.idiag_cookie[1]))
- goto out;
-+#endif
-
- err = -ENOMEM;
- rep = alloc_skb(NLMSG_SPACE((sizeof(struct inet_diag_msg) +
-@@ -579,8 +603,14 @@ static int inet_diag_fill_req(struct sk_buff *skb, struct sock *sk,
- r->idiag_retrans = req->retrans;
-
- r->id.idiag_if = sk->sk_bound_dev_if;
-+
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ r->id.idiag_cookie[0] = 0;
-+ r->id.idiag_cookie[1] = 0;
-+#else
- r->id.idiag_cookie[0] = (u32)(unsigned long)req;
- r->id.idiag_cookie[1] = (u32)(((unsigned long)req >> 31) >> 1);
-+#endif
-
- tmo = req->expires - jiffies;
- if (tmo < 0)
-@@ -588,8 +618,13 @@ static int inet_diag_fill_req(struct sk_buff *skb, struct sock *sk,
-
- r->id.idiag_sport = inet->sport;
- r->id.idiag_dport = ireq->rmt_port;
-+
-+ memset(&r->id.idiag_src, 0, sizeof(r->id.idiag_src));
-+ memset(&r->id.idiag_dst, 0, sizeof(r->id.idiag_dst));
-+
- r->id.idiag_src[0] = ireq->loc_addr;
- r->id.idiag_dst[0] = ireq->rmt_addr;
-+
- r->idiag_expires = jiffies_to_msecs(tmo);
- r->idiag_rqueue = 0;
- r->idiag_wqueue = 0;
-diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
-index d717267..f9707ae 100644
---- a/net/ipv4/inet_hashtables.c
-+++ b/net/ipv4/inet_hashtables.c
-@@ -18,12 +18,15 @@
- #include <linux/sched.h>
- #include <linux/slab.h>
- #include <linux/wait.h>
-+#include <linux/security.h>
-
- #include <net/inet_connection_sock.h>
- #include <net/inet_hashtables.h>
- #include <net/secure_seq.h>
- #include <net/ip.h>
-
-+extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
-+
- /*
- * Allocate and initialize a new local port bind bucket.
- * The bindhash mutex for snum's hash chain must be held here.
-@@ -247,7 +250,7 @@ begintw:
- }
- if (unlikely(!INET_TW_MATCH(sk, net, hash, acookie,
- saddr, daddr, ports, dif))) {
-- sock_put(sk);
-+ inet_twsk_put(inet_twsk(sk));
- goto begintw;
- }
- goto out;
-@@ -491,6 +494,8 @@ ok:
- }
- spin_unlock(&head->lock);
-
-+ gr_update_task_in_ip_table(current, inet_sk(sk));
-+
- if (tw) {
- inet_twsk_deschedule(tw, death_row);
- inet_twsk_put(tw);
-diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
-index 13b229f..6956484 100644
---- a/net/ipv4/inetpeer.c
-+++ b/net/ipv4/inetpeer.c
-@@ -367,6 +367,8 @@ struct inet_peer *inet_getpeer(__be32 daddr, int create)
- struct inet_peer *p, *n;
- struct inet_peer **stack[PEER_MAXDEPTH], ***stackptr;
-
-+ pax_track_stack();
-+
- /* Look up for the address quickly. */
- read_lock_bh(&peer_pool_lock);
- p = lookup(daddr, NULL);
-@@ -390,7 +392,7 @@ struct inet_peer *inet_getpeer(__be32 daddr, int create)
- return NULL;
- n->v4daddr = daddr;
- atomic_set(&n->refcnt, 1);
-- atomic_set(&n->rid, 0);
-+ atomic_set_unchecked(&n->rid, 0);
- n->ip_id_count = secure_ip_id(daddr);
- n->tcp_ts_stamp = 0;
-
-diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
-index d3fe10b..feeafc9 100644
---- a/net/ipv4/ip_fragment.c
-+++ b/net/ipv4/ip_fragment.c
-@@ -255,7 +255,7 @@ static inline int ip_frag_too_far(struct ipq *qp)
- return 0;
-
- start = qp->rid;
-- end = atomic_inc_return(&peer->rid);
-+ end = atomic_inc_return_unchecked(&peer->rid);
- qp->rid = end;
-
- rc = qp->q.fragments && (end - start) > max;
-diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
-index 099e6c3..57092e1 100644
---- a/net/ipv4/ip_sockglue.c
-+++ b/net/ipv4/ip_sockglue.c
-@@ -1023,6 +1023,8 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
- int val;
- int len;
-
-+ pax_track_stack();
-+
- if (level != SOL_IP)
- return -EOPNOTSUPP;
-
-@@ -1184,7 +1186,7 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
- if (sk->sk_type != SOCK_STREAM)
- return -ENOPROTOOPT;
-
-- msg.msg_control = optval;
-+ msg.msg_control = (void __force_kernel *)optval;
- msg.msg_controllen = len;
- msg.msg_flags = 0;
-
-diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
-index f8d04c2..c1188f2 100644
---- a/net/ipv4/ipconfig.c
-+++ b/net/ipv4/ipconfig.c
-@@ -295,7 +295,7 @@ static int __init ic_devinet_ioctl(unsigned int cmd, struct ifreq *arg)
-
- mm_segment_t oldfs = get_fs();
- set_fs(get_ds());
-- res = devinet_ioctl(&init_net, cmd, (struct ifreq __user *) arg);
-+ res = devinet_ioctl(&init_net, cmd, (struct ifreq __force_user *) arg);
- set_fs(oldfs);
- return res;
- }
-@@ -306,7 +306,7 @@ static int __init ic_dev_ioctl(unsigned int cmd, struct ifreq *arg)
-
- mm_segment_t oldfs = get_fs();
- set_fs(get_ds());
-- res = dev_ioctl(&init_net, cmd, (struct ifreq __user *) arg);
-+ res = dev_ioctl(&init_net, cmd, (struct ifreq __force_user *) arg);
- set_fs(oldfs);
- return res;
- }
-@@ -317,7 +317,7 @@ static int __init ic_route_ioctl(unsigned int cmd, struct rtentry *arg)
-
- mm_segment_t oldfs = get_fs();
- set_fs(get_ds());
-- res = ip_rt_ioctl(&init_net, cmd, (void __user *) arg);
-+ res = ip_rt_ioctl(&init_net, cmd, (void __force_user *) arg);
- set_fs(oldfs);
- return res;
- }
-diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
-index c8b0cc3..df2154c 100644
---- a/net/ipv4/netfilter/arp_tables.c
-+++ b/net/ipv4/netfilter/arp_tables.c
-@@ -900,14 +900,14 @@ static int compat_table_info(const struct xt_table_info *info,
- }
- #endif
-
--static int get_info(struct net *net, void __user *user, int *len, int compat)
-+static int get_info(struct net *net, void __user *user, int len, int compat)
- {
- char name[ARPT_TABLE_MAXNAMELEN];
- struct xt_table *t;
- int ret;
-
-- if (*len != sizeof(struct arpt_getinfo)) {
-- duprintf("length %u != %Zu\n", *len,
-+ if (len != sizeof(struct arpt_getinfo)) {
-+ duprintf("length %u != %Zu\n", len,
- sizeof(struct arpt_getinfo));
- return -EINVAL;
- }
-@@ -934,6 +934,7 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
- private = &tmp;
- }
- #endif
-+ memset(&info, 0, sizeof(info));
- info.valid_hooks = t->valid_hooks;
- memcpy(info.hook_entry, private->hook_entry,
- sizeof(info.hook_entry));
-@@ -943,7 +944,7 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
- info.size = private->size;
- strcpy(info.name, name);
-
-- if (copy_to_user(user, &info, *len) != 0)
-+ if (copy_to_user(user, &info, len) != 0)
- ret = -EFAULT;
- else
- ret = 0;
-@@ -1702,7 +1703,7 @@ static int compat_do_arpt_get_ctl(struct sock *sk, int cmd, void __user *user,
-
- switch (cmd) {
- case ARPT_SO_GET_INFO:
-- ret = get_info(sock_net(sk), user, len, 1);
-+ ret = get_info(sock_net(sk), user, *len, 1);
- break;
- case ARPT_SO_GET_ENTRIES:
- ret = compat_get_entries(sock_net(sk), user, len);
-@@ -1747,7 +1748,7 @@ static int do_arpt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len
-
- switch (cmd) {
- case ARPT_SO_GET_INFO:
-- ret = get_info(sock_net(sk), user, len, 0);
-+ ret = get_info(sock_net(sk), user, *len, 0);
- break;
-
- case ARPT_SO_GET_ENTRIES:
-diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
-index c156db2..e772975 100644
---- a/net/ipv4/netfilter/ip_queue.c
-+++ b/net/ipv4/netfilter/ip_queue.c
-@@ -286,6 +286,9 @@ ipq_mangle_ipv4(ipq_verdict_msg_t *v, struct nf_queue_entry *e)
-
- if (v->data_len < sizeof(*user_iph))
- return 0;
-+ if (v->data_len > 65535)
-+ return -EMSGSIZE;
-+
- diff = v->data_len - e->skb->len;
- if (diff < 0) {
- if (pskb_trim(e->skb, v->data_len))
-@@ -409,7 +412,8 @@ ipq_dev_drop(int ifindex)
- static inline void
- __ipq_rcv_skb(struct sk_buff *skb)
- {
-- int status, type, pid, flags, nlmsglen, skblen;
-+ int status, type, pid, flags;
-+ unsigned int nlmsglen, skblen;
- struct nlmsghdr *nlh;
-
- skblen = skb->len;
-diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
-index 0606db1..2f32531 100644
---- a/net/ipv4/netfilter/ip_tables.c
-+++ b/net/ipv4/netfilter/ip_tables.c
-@@ -1107,14 +1107,14 @@ static int compat_table_info(const struct xt_table_info *info,
- }
- #endif
-
--static int get_info(struct net *net, void __user *user, int *len, int compat)
-+static int get_info(struct net *net, void __user *user, int len, int compat)
- {
- char name[IPT_TABLE_MAXNAMELEN];
- struct xt_table *t;
- int ret;
-
-- if (*len != sizeof(struct ipt_getinfo)) {
-- duprintf("length %u != %zu\n", *len,
-+ if (len != sizeof(struct ipt_getinfo)) {
-+ duprintf("length %u != %zu\n", len,
- sizeof(struct ipt_getinfo));
- return -EINVAL;
- }
-@@ -1141,6 +1141,7 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
- private = &tmp;
- }
- #endif
-+ memset(&info, 0, sizeof(info));
- info.valid_hooks = t->valid_hooks;
- memcpy(info.hook_entry, private->hook_entry,
- sizeof(info.hook_entry));
-@@ -1150,7 +1151,7 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
- info.size = private->size;
- strcpy(info.name, name);
-
-- if (copy_to_user(user, &info, *len) != 0)
-+ if (copy_to_user(user, &info, len) != 0)
- ret = -EFAULT;
- else
- ret = 0;
-@@ -1979,7 +1980,7 @@ compat_do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
-
- switch (cmd) {
- case IPT_SO_GET_INFO:
-- ret = get_info(sock_net(sk), user, len, 1);
-+ ret = get_info(sock_net(sk), user, *len, 1);
- break;
- case IPT_SO_GET_ENTRIES:
- ret = compat_get_entries(sock_net(sk), user, len);
-@@ -2026,7 +2027,7 @@ do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
-
- switch (cmd) {
- case IPT_SO_GET_INFO:
-- ret = get_info(sock_net(sk), user, len, 0);
-+ ret = get_info(sock_net(sk), user, *len, 0);
- break;
-
- case IPT_SO_GET_ENTRIES:
-diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
-index f25542c..5a0b902 100644
---- a/net/ipv4/proc.c
-+++ b/net/ipv4/proc.c
-@@ -232,7 +232,6 @@ static const struct snmp_mib snmp4_net_list[] = {
- SNMP_MIB_ITEM("TCPDSACKOfoSent", LINUX_MIB_TCPDSACKOFOSENT),
- SNMP_MIB_ITEM("TCPDSACKRecv", LINUX_MIB_TCPDSACKRECV),
- SNMP_MIB_ITEM("TCPDSACKOfoRecv", LINUX_MIB_TCPDSACKOFORECV),
-- SNMP_MIB_ITEM("TCPAbortOnSyn", LINUX_MIB_TCPABORTONSYN),
- SNMP_MIB_ITEM("TCPAbortOnData", LINUX_MIB_TCPABORTONDATA),
- SNMP_MIB_ITEM("TCPAbortOnClose", LINUX_MIB_TCPABORTONCLOSE),
- SNMP_MIB_ITEM("TCPAbortOnMemory", LINUX_MIB_TCPABORTONMEMORY),
-@@ -249,6 +248,8 @@ static const struct snmp_mib snmp4_net_list[] = {
- SNMP_MIB_ITEM("TCPSackShifted", LINUX_MIB_SACKSHIFTED),
- SNMP_MIB_ITEM("TCPSackMerged", LINUX_MIB_SACKMERGED),
- SNMP_MIB_ITEM("TCPSackShiftFallback", LINUX_MIB_SACKSHIFTFALLBACK),
-+ SNMP_MIB_ITEM("TCPChallengeACK", LINUX_MIB_TCPCHALLENGEACK),
-+ SNMP_MIB_ITEM("TCPSYNChallenge", LINUX_MIB_TCPSYNCHALLENGE),
- SNMP_MIB_SENTINEL
- };
-
-diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
-index 07ab583..a4ef948 100644
---- a/net/ipv4/raw.c
-+++ b/net/ipv4/raw.c
-@@ -292,7 +292,7 @@ static int raw_rcv_skb(struct sock * sk, struct sk_buff * skb)
- /* Charge it to the socket. */
-
- if (sock_queue_rcv_skb(sk, skb) < 0) {
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- kfree_skb(skb);
- return NET_RX_DROP;
- }
-@@ -303,7 +303,7 @@ static int raw_rcv_skb(struct sock * sk, struct sk_buff * skb)
- int raw_rcv(struct sock *sk, struct sk_buff *skb)
- {
- if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb)) {
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- kfree_skb(skb);
- return NET_RX_DROP;
- }
-@@ -735,16 +735,23 @@ static int raw_init(struct sock *sk)
-
- static int raw_seticmpfilter(struct sock *sk, char __user *optval, int optlen)
- {
-+ struct icmp_filter filter;
-+
-+ if (optlen < 0)
-+ return -EINVAL;
- if (optlen > sizeof(struct icmp_filter))
- optlen = sizeof(struct icmp_filter);
-- if (copy_from_user(&raw_sk(sk)->filter, optval, optlen))
-+ if (copy_from_user(&filter, optval, optlen))
- return -EFAULT;
-+ raw_sk(sk)->filter = filter;
-+
- return 0;
- }
-
- static int raw_geticmpfilter(struct sock *sk, char __user *optval, int __user *optlen)
- {
- int len, ret = -EFAULT;
-+ struct icmp_filter filter;
-
- if (get_user(len, optlen))
- goto out;
-@@ -754,8 +761,9 @@ static int raw_geticmpfilter(struct sock *sk, char __user *optval, int __user *o
- if (len > sizeof(struct icmp_filter))
- len = sizeof(struct icmp_filter);
- ret = -EFAULT;
-- if (put_user(len, optlen) ||
-- copy_to_user(optval, &raw_sk(sk)->filter, len))
-+ filter = raw_sk(sk)->filter;
-+ if (put_user(len, optlen) || len > sizeof filter ||
-+ copy_to_user(optval, &filter, len))
- goto out;
- ret = 0;
- out: return ret;
-@@ -965,7 +973,13 @@ static void raw_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
- sk_wmem_alloc_get(sp),
- sk_rmem_alloc_get(sp),
- 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
-- atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
-+ atomic_read(&sp->sk_refcnt),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
-+ sp,
-+#endif
-+ atomic_read_unchecked(&sp->sk_drops));
- }
-
- static int raw_seq_show(struct seq_file *seq, void *v)
-diff --git a/net/ipv4/route.c b/net/ipv4/route.c
-index f16d19b..9734113 100644
---- a/net/ipv4/route.c
-+++ b/net/ipv4/route.c
-@@ -269,7 +269,7 @@ static inline unsigned int rt_hash(__be32 daddr, __be32 saddr, int idx,
-
- static inline int rt_genid(struct net *net)
- {
-- return atomic_read(&net->ipv4.rt_genid);
-+ return atomic_read_unchecked(&net->ipv4.rt_genid);
- }
-
- #ifdef CONFIG_PROC_FS
-@@ -889,7 +889,7 @@ static void rt_cache_invalidate(struct net *net)
- unsigned char shuffle;
-
- get_random_bytes(&shuffle, sizeof(shuffle));
-- atomic_add(shuffle + 1U, &net->ipv4.rt_genid);
-+ atomic_add_unchecked(shuffle + 1U, &net->ipv4.rt_genid);
- }
-
- /*
-@@ -3364,7 +3364,7 @@ static __net_initdata struct pernet_operations sysctl_route_ops = {
-
- static __net_init int rt_secret_timer_init(struct net *net)
- {
-- atomic_set(&net->ipv4.rt_genid,
-+ atomic_set_unchecked(&net->ipv4.rt_genid,
- (int) ((num_physpages ^ (num_physpages>>8)) ^
- (jiffies ^ (jiffies >> 7))));
-
-diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
-index 2dcf04d..4656638 100644
---- a/net/ipv4/sysctl_net_ipv4.c
-+++ b/net/ipv4/sysctl_net_ipv4.c
-@@ -638,6 +638,13 @@ static struct ctl_table ipv4_table[] = {
- .mode = 0644,
- .proc_handler = proc_dointvec
- },
-+ {
-+ .procname = "tcp_challenge_ack_limit",
-+ .data = &sysctl_tcp_challenge_ack_limit,
-+ .maxlen = sizeof(int),
-+ .mode = 0644,
-+ .proc_handler = proc_dointvec
-+ },
- #ifdef CONFIG_NET_DMA
- {
- .ctl_name = NET_TCP_DMA_COPYBREAK,
-diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
-index 6232462..2973061 100644
---- a/net/ipv4/tcp.c
-+++ b/net/ipv4/tcp.c
-@@ -2084,6 +2084,8 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
- int val;
- int err = 0;
-
-+ pax_track_stack();
-+
- /* This is a string value all the others are int's */
- if (optname == TCP_CONGESTION) {
- char name[TCP_CA_NAME_MAX];
-@@ -2354,6 +2356,8 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
- struct tcp_sock *tp = tcp_sk(sk);
- int val, len;
-
-+ pax_track_stack();
-+
- if (get_user(len, optlen))
- return -EFAULT;
-
-@@ -2826,7 +2830,11 @@ int tcp_md5_hash_skb_data(struct tcp_md5sig_pool *hp,
-
- for (i = 0; i < shi->nr_frags; ++i) {
- const struct skb_frag_struct *f = &shi->frags[i];
-- sg_set_page(&sg, f->page, f->size, f->page_offset);
-+ unsigned int offset = f->page_offset;
-+ struct page *page = f->page + (offset >> PAGE_SHIFT);
-+
-+ sg_set_page(&sg, page, f->size,
-+ offset_in_page(offset));
- if (crypto_hash_update(desc, &sg, f->size))
- return 1;
- }
-diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
-index db755c4..4cf3b9d 100644
---- a/net/ipv4/tcp_input.c
-+++ b/net/ipv4/tcp_input.c
-@@ -82,6 +82,9 @@ int sysctl_tcp_dsack __read_mostly = 1;
- int sysctl_tcp_app_win __read_mostly = 31;
- int sysctl_tcp_adv_win_scale __read_mostly = 2;
-
-+/* rfc5961 challenge ack rate limiting */
-+int sysctl_tcp_challenge_ack_limit = 100;
-+
- int sysctl_tcp_stdurg __read_mostly;
- int sysctl_tcp_rfc1337 __read_mostly;
- int sysctl_tcp_max_orphans __read_mostly = NR_FILE;
-@@ -3564,6 +3567,24 @@ static int tcp_process_frto(struct sock *sk, int flag)
- return 0;
- }
-
-+/* RFC 5961 7 [ACK Throttling] */
-+static void tcp_send_challenge_ack(struct sock *sk)
-+{
-+ /* unprotected vars, we dont care of overwrites */
-+ static u32 challenge_timestamp;
-+ static unsigned int challenge_count;
-+ u32 now = jiffies / HZ;
-+
-+ if (now != challenge_timestamp) {
-+ challenge_timestamp = now;
-+ challenge_count = 0;
-+ }
-+ if (++challenge_count <= sysctl_tcp_challenge_ack_limit) {
-+ NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPCHALLENGEACK);
-+ tcp_send_ack(sk);
-+ }
-+}
-+
- /* This routine deals with incoming acks, but not outgoing ones. */
- static int tcp_ack(struct sock *sk, struct sk_buff *skb, int flag)
- {
-@@ -3580,8 +3601,14 @@ static int tcp_ack(struct sock *sk, struct sk_buff *skb, int flag)
- /* If the ack is older than previous acks
- * then we can probably ignore it.
- */
-- if (before(ack, prior_snd_una))
-+ if (before(ack, prior_snd_una)) {
-+ /* RFC 5961 5.2 [Blind Data Injection Attack].[Mitigation] */
-+ if (before(ack, prior_snd_una - tp->max_window)) {
-+ tcp_send_challenge_ack(sk);
-+ return -1;
-+ }
- goto old_ack;
-+ }
-
- /* If the ack includes data we haven't sent yet, discard
- * this segment (RFC793 Section 3.9).
-@@ -4528,7 +4555,7 @@ static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb,
- * simplifies code)
- */
- static void
--tcp_collapse(struct sock *sk, struct sk_buff_head *list,
-+__intentional_overflow(5,6) tcp_collapse(struct sock *sk, struct sk_buff_head *list,
- struct sk_buff *head, struct sk_buff *tail,
- u32 start, u32 end)
- {
-@@ -5069,8 +5096,8 @@ out:
- /* Does PAWS and seqno based validation of an incoming segment, flags will
- * play significant role here.
- */
--static int tcp_validate_incoming(struct sock *sk, struct sk_buff *skb,
-- struct tcphdr *th, int syn_inerr)
-+static bool tcp_validate_incoming(struct sock *sk, struct sk_buff *skb,
-+ const struct tcphdr *th, int syn_inerr)
- {
- struct tcp_sock *tp = tcp_sk(sk);
-
-@@ -5093,38 +5120,48 @@ static int tcp_validate_incoming(struct sock *sk, struct sk_buff *skb,
- * an acknowledgment should be sent in reply (unless the RST
- * bit is set, if so drop the segment and return)".
- */
-- if (!th->rst)
-+ if (!th->rst) {
-+ if (th->syn)
-+ goto syn_challenge;
- tcp_send_dupack(sk, skb);
-+ }
- goto discard;
- }
-
- /* Step 2: check RST bit */
- if (th->rst) {
-- tcp_reset(sk);
-+ /* RFC 5961 3.2 :
-+ * If sequence number exactly matches RCV.NXT, then
-+ * RESET the connection
-+ * else
-+ * Send a challenge ACK
-+ */
-+ if (TCP_SKB_CB(skb)->seq == tp->rcv_nxt)
-+ tcp_reset(sk);
-+ else
-+ tcp_send_challenge_ack(sk);
- goto discard;
- }
-
-- /* ts_recent update must be made after we are sure that the packet
-- * is in window.
-- */
-- tcp_replace_ts_recent(tp, TCP_SKB_CB(skb)->seq);
--
- /* step 3: check security and precedence [ignored] */
-
-- /* step 4: Check for a SYN in window. */
-- if (th->syn && !before(TCP_SKB_CB(skb)->seq, tp->rcv_nxt)) {
-+ /* step 4: Check for a SYN
-+ * RFC 5691 4.2 : Send a challenge ack
-+ */
-+ if (th->syn) {
-+syn_challenge:
- if (syn_inerr)
- TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
-- NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPABORTONSYN);
-- tcp_reset(sk);
-- return -1;
-+ NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPSYNCHALLENGE);
-+ tcp_send_challenge_ack(sk);
-+ goto discard;
- }
-
-- return 1;
-+ return true;
-
- discard:
- __kfree_skb(skb);
-- return 0;
-+ return false;
- }
-
- /*
-@@ -5154,7 +5191,6 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
- struct tcphdr *th, unsigned len)
- {
- struct tcp_sock *tp = tcp_sk(sk);
-- int res;
-
- /*
- * Header prediction.
-@@ -5330,18 +5366,25 @@ slow_path:
- if (len < (th->doff << 2) || tcp_checksum_complete_user(sk, skb))
- goto csum_error;
-
-+ if (!th->ack && !th->rst)
-+ goto discard;
-+
- /*
- * Standard slow path.
- */
-
-- res = tcp_validate_incoming(sk, skb, th, 1);
-- if (res <= 0)
-- return -res;
-+ if (!tcp_validate_incoming(sk, skb, th, 1))
-+ return 0;
-
- step5:
-- if (th->ack && tcp_ack(sk, skb, FLAG_SLOWPATH) < 0)
-+ if (tcp_ack(sk, skb, FLAG_SLOWPATH) < 0)
- goto discard;
-
-+ /* ts_recent update must be made after we are sure that the packet
-+ * is in window.
-+ */
-+ tcp_replace_ts_recent(tp, TCP_SKB_CB(skb)->seq);
-+
- tcp_rcv_rtt_measure_ts(sk, skb);
-
- /* Process urgent data. */
-@@ -5542,6 +5585,7 @@ discard:
- tcp_paws_reject(&tp->rx_opt, 0))
- goto discard_and_undo;
-
-+#ifndef CONFIG_GRKERNSEC_NO_SIMULT_CONNECT
- if (th->syn) {
- /* We see SYN without ACK. It is attempt of
- * simultaneous connect with crossed SYNs.
-@@ -5590,6 +5634,7 @@ discard:
- goto discard;
- #endif
- }
-+#endif
- /* "fifth, if neither of the SYN or RST bits is set then
- * drop the segment and return."
- */
-@@ -5618,7 +5663,6 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
- struct tcp_sock *tp = tcp_sk(sk);
- struct inet_connection_sock *icsk = inet_csk(sk);
- int queued = 0;
-- int res;
-
- tp->rx_opt.saw_tstamp = 0;
-
-@@ -5634,7 +5678,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
- goto discard;
-
- if (th->syn) {
-- if (th->fin)
-+ if (th->fin || th->urg || th->psh)
- goto discard;
- if (icsk->icsk_af_ops->conn_request(sk, skb) < 0)
- return 1;
-@@ -5673,12 +5717,14 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
- return 0;
- }
-
-- res = tcp_validate_incoming(sk, skb, th, 0);
-- if (res <= 0)
-- return -res;
-+ if (!th->ack && !th->rst)
-+ goto discard;
-+
-+ if (!tcp_validate_incoming(sk, skb, th, 0))
-+ return 0;
-
- /* step 5: check the ACK field */
-- if (th->ack) {
-+ if (true) {
- int acceptable = tcp_ack(sk, skb, FLAG_SLOWPATH) > 0;
-
- switch (sk->sk_state) {
-@@ -5789,8 +5835,12 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
- }
- break;
- }
-- } else
-- goto discard;
-+ }
-+
-+ /* ts_recent update must be made after we are sure that the packet
-+ * is in window.
-+ */
-+ tcp_replace_ts_recent(tp, TCP_SKB_CB(skb)->seq);
-
- /* step 6: check the URG bit */
- tcp_urg(sk, skb, th);
-diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
-index d746d3b3..6eafd4a 100644
---- a/net/ipv4/tcp_ipv4.c
-+++ b/net/ipv4/tcp_ipv4.c
-@@ -85,6 +85,9 @@
- int sysctl_tcp_tw_reuse __read_mostly;
- int sysctl_tcp_low_latency __read_mostly;
-
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+extern int grsec_enable_blackhole;
-+#endif
-
- #ifdef CONFIG_TCP_MD5SIG
- static struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk,
-@@ -1546,6 +1549,9 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
- return 0;
-
- reset:
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ if (!grsec_enable_blackhole)
-+#endif
- tcp_v4_send_reset(rsk, skb);
- discard:
- kfree_skb(skb);
-@@ -1607,12 +1613,20 @@ int tcp_v4_rcv(struct sk_buff *skb)
- TCP_SKB_CB(skb)->sacked = 0;
-
- sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
-- if (!sk)
-+ if (!sk) {
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ ret = 1;
-+#endif
- goto no_tcp_socket;
-+ }
-
- process:
-- if (sk->sk_state == TCP_TIME_WAIT)
-+ if (sk->sk_state == TCP_TIME_WAIT) {
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ ret = 2;
-+#endif
- goto do_time_wait;
-+ }
-
- if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
- goto discard_and_relse;
-@@ -1654,6 +1668,10 @@ no_tcp_socket:
- bad_packet:
- TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
- } else {
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ if (!grsec_enable_blackhole || (ret == 1 &&
-+ (skb->dev->flags & IFF_LOOPBACK)))
-+#endif
- tcp_v4_send_reset(NULL, skb);
- }
-
-@@ -2241,7 +2259,11 @@ static void get_openreq4(struct sock *sk, struct request_sock *req,
- 0, /* non standard timer */
- 0, /* open_requests have no inode */
- atomic_read(&sk->sk_refcnt),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
- req,
-+#endif
- len);
- }
-
-@@ -2283,7 +2305,12 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
- sock_i_uid(sk),
- icsk->icsk_probes_out,
- sock_i_ino(sk),
-- atomic_read(&sk->sk_refcnt), sk,
-+ atomic_read(&sk->sk_refcnt),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
-+ sk,
-+#endif
- jiffies_to_clock_t(icsk->icsk_rto),
- jiffies_to_clock_t(icsk->icsk_ack.ato),
- (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
-@@ -2311,7 +2338,13 @@ static void get_timewait4_sock(struct inet_timewait_sock *tw,
- " %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p%n",
- i, src, srcp, dest, destp, tw->tw_substate, 0, 0,
- 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
-- atomic_read(&tw->tw_refcnt), tw, len);
-+ atomic_read(&tw->tw_refcnt),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
-+ tw,
-+#endif
-+ len);
- }
-
- #define TMPSZ 150
-diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
-index 4c03598..e09a8e8 100644
---- a/net/ipv4/tcp_minisocks.c
-+++ b/net/ipv4/tcp_minisocks.c
-@@ -26,6 +26,10 @@
- #include <net/inet_common.h>
- #include <net/xfrm.h>
-
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+extern int grsec_enable_blackhole;
-+#endif
-+
- #ifdef CONFIG_SYSCTL
- #define SYNC_INIT 0 /* let the user enable it */
- #else
-@@ -672,6 +676,10 @@ listen_overflow:
-
- embryonic_reset:
- NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
-+
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ if (!grsec_enable_blackhole)
-+#endif
- if (!(flg & TCP_FLAG_RST))
- req->rsk_ops->send_reset(sk, skb);
-
-diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
-index 38a23e4..24f71b0 100644
---- a/net/ipv4/tcp_output.c
-+++ b/net/ipv4/tcp_output.c
-@@ -2237,6 +2237,8 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
- __u8 *md5_hash_location;
- int mss;
-
-+ pax_track_stack();
-+
- skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15, 1, GFP_ATOMIC);
- if (skb == NULL)
- return NULL;
-diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
-index 59f5b5e..193860f 100644
---- a/net/ipv4/tcp_probe.c
-+++ b/net/ipv4/tcp_probe.c
-@@ -200,7 +200,7 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf,
- if (cnt + width >= len)
- break;
-
-- if (copy_to_user(buf + cnt, tbuf, width))
-+ if (width > sizeof tbuf || copy_to_user(buf + cnt, tbuf, width))
- return -EFAULT;
- cnt += width;
- }
-diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
-index 57d5501..a9ed13a 100644
---- a/net/ipv4/tcp_timer.c
-+++ b/net/ipv4/tcp_timer.c
-@@ -21,6 +21,10 @@
- #include <linux/module.h>
- #include <net/tcp.h>
-
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+extern int grsec_lastack_retries;
-+#endif
-+
- int sysctl_tcp_syn_retries __read_mostly = TCP_SYN_RETRIES;
- int sysctl_tcp_synack_retries __read_mostly = TCP_SYNACK_RETRIES;
- int sysctl_tcp_keepalive_time __read_mostly = TCP_KEEPALIVE_TIME;
-@@ -164,6 +168,13 @@ static int tcp_write_timeout(struct sock *sk)
- }
- }
-
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ if ((sk->sk_state == TCP_LAST_ACK) &&
-+ (grsec_lastack_retries > 0) &&
-+ (grsec_lastack_retries < retry_until))
-+ retry_until = grsec_lastack_retries;
-+#endif
-+
- if (retransmits_timed_out(sk, retry_until)) {
- /* Has it gone just too far? */
- tcp_write_err(sk);
-diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
-index af559e0..00f5a91 100644
---- a/net/ipv4/udp.c
-+++ b/net/ipv4/udp.c
-@@ -86,6 +86,7 @@
- #include <linux/types.h>
- #include <linux/fcntl.h>
- #include <linux/module.h>
-+#include <linux/security.h>
- #include <linux/socket.h>
- #include <linux/sockios.h>
- #include <linux/igmp.h>
-@@ -106,6 +107,10 @@
- #include <net/xfrm.h>
- #include "udp_impl.h"
-
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+extern int grsec_enable_blackhole;
-+#endif
-+
- struct udp_table udp_table;
- EXPORT_SYMBOL(udp_table);
-
-@@ -371,6 +376,9 @@ found:
- return s;
- }
-
-+extern int gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb);
-+extern int gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr);
-+
- /*
- * This routine is called by the ICMP module when it gets some
- * sort of error condition. If err < 0 then the socket should
-@@ -640,9 +648,18 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
- dport = usin->sin_port;
- if (dport == 0)
- return -EINVAL;
-+
-+ err = gr_search_udp_sendmsg(sk, usin);
-+ if (err)
-+ return err;
- } else {
- if (sk->sk_state != TCP_ESTABLISHED)
- return -EDESTADDRREQ;
-+
-+ err = gr_search_udp_sendmsg(sk, NULL);
-+ if (err)
-+ return err;
-+
- daddr = inet->daddr;
- dport = inet->dport;
- /* Open fast path for connected socket.
-@@ -956,6 +973,10 @@ try_again:
- if (!skb)
- goto out;
-
-+ err = gr_search_udp_recvmsg(sk, skb);
-+ if (err)
-+ goto out_free;
-+
- ulen = skb->len - sizeof(struct udphdr);
- copied = len;
- if (copied > ulen)
-@@ -1079,7 +1100,7 @@ static int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
- if (rc == -ENOMEM) {
- UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
- is_udplite);
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- }
- goto drop;
- }
-@@ -1349,6 +1370,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
- goto csum_error;
-
- UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
-+#endif
- icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
-
- /*
-@@ -1769,8 +1793,13 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
- sk_wmem_alloc_get(sp),
- sk_rmem_alloc_get(sp),
- 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
-- atomic_read(&sp->sk_refcnt), sp,
-- atomic_read(&sp->sk_drops), len);
-+ atomic_read(&sp->sk_refcnt),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
-+ sp,
-+#endif
-+ atomic_read_unchecked(&sp->sk_drops), len);
- }
-
- int udp4_seq_show(struct seq_file *seq, void *v)
-diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
-index 8ac3d09..fc58c5f 100644
---- a/net/ipv6/addrconf.c
-+++ b/net/ipv6/addrconf.c
-@@ -2053,7 +2053,7 @@ int addrconf_set_dstaddr(struct net *net, void __user *arg)
- p.iph.ihl = 5;
- p.iph.protocol = IPPROTO_IPV6;
- p.iph.ttl = 64;
-- ifr.ifr_ifru.ifru_data = (__force void __user *)&p;
-+ ifr.ifr_ifru.ifru_data = (void __force_user *)&p;
-
- if (ops->ndo_do_ioctl) {
- mm_segment_t oldfs = get_fs();
-diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
-index af597c7..a3c5697 100644
---- a/net/ipv6/esp6.c
-+++ b/net/ipv6/esp6.c
-@@ -146,7 +146,6 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
- struct esp_data *esp = x->data;
-
- /* skb is pure payload to encrypt */
-- err = -ENOMEM;
-
- /* Round to block size */
- clen = skb->len;
-@@ -164,8 +163,10 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
- nfrags = err;
-
- tmp = esp_alloc_tmp(aead, nfrags + 1);
-- if (!tmp)
-+ if (!tmp) {
-+ err = -ENOMEM;
- goto error;
-+ }
-
- iv = esp_tmp_iv(aead, tmp);
- req = esp_tmp_givreq(aead, iv);
-diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
-index cc4797d..7cfdfcc 100644
---- a/net/ipv6/inet6_connection_sock.c
-+++ b/net/ipv6/inet6_connection_sock.c
-@@ -152,7 +152,7 @@ void __inet6_csk_dst_store(struct sock *sk, struct dst_entry *dst,
- #ifdef CONFIG_XFRM
- {
- struct rt6_info *rt = (struct rt6_info *)dst;
-- rt->rt6i_flow_cache_genid = atomic_read(&flow_cache_genid);
-+ rt->rt6i_flow_cache_genid = atomic_read_unchecked(&flow_cache_genid);
- }
- #endif
- }
-@@ -167,7 +167,7 @@ struct dst_entry *__inet6_csk_dst_check(struct sock *sk, u32 cookie)
- #ifdef CONFIG_XFRM
- if (dst) {
- struct rt6_info *rt = (struct rt6_info *)dst;
-- if (rt->rt6i_flow_cache_genid != atomic_read(&flow_cache_genid)) {
-+ if (rt->rt6i_flow_cache_genid != atomic_read_unchecked(&flow_cache_genid)) {
- sk->sk_dst_cache = NULL;
- dst_release(dst);
- dst = NULL;
-diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
-index 093e9b2..d6dbc3f 100644
---- a/net/ipv6/inet6_hashtables.c
-+++ b/net/ipv6/inet6_hashtables.c
-@@ -104,7 +104,7 @@ begintw:
- goto out;
- }
- if (!INET6_TW_MATCH(sk, net, hash, saddr, daddr, ports, dif)) {
-- sock_put(sk);
-+ inet_twsk_put(inet_twsk(sk));
- goto begintw;
- }
- goto out;
-@@ -119,7 +119,7 @@ out:
- }
- EXPORT_SYMBOL(__inet6_lookup_established);
-
--static int inline compute_score(struct sock *sk, struct net *net,
-+static inline int compute_score(struct sock *sk, struct net *net,
- const unsigned short hnum,
- const struct in6_addr *daddr,
- const int dif)
-diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
-index 6ba0fe2..bb63ffc 100644
---- a/net/ipv6/ip6_output.c
-+++ b/net/ipv6/ip6_output.c
-@@ -920,11 +920,17 @@ static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
- struct flowi *fl)
- {
- struct ipv6_pinfo *np = inet6_sk(sk);
-- struct rt6_info *rt = (struct rt6_info *)dst;
-+ struct rt6_info *rt;
-
- if (!dst)
- goto out;
-
-+ if (dst->ops->family != AF_INET6) {
-+ dst_release(dst);
-+ return NULL;
-+ }
-+
-+ rt = (struct rt6_info *)dst;
- /* Yes, checking route validity in not connected
- * case is not very simple. Take into account,
- * that we do not support routing by source, TOS,
-@@ -1168,7 +1174,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
- if (WARN_ON(np->cork.opt))
- return -EINVAL;
-
-- np->cork.opt = kmalloc(opt->tot_len, sk->sk_allocation);
-+ np->cork.opt = kzalloc(opt->tot_len, sk->sk_allocation);
- if (unlikely(np->cork.opt == NULL))
- return -ENOBUFS;
-
-diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
-index 4f7aaf6..f7acf45 100644
---- a/net/ipv6/ipv6_sockglue.c
-+++ b/net/ipv6/ipv6_sockglue.c
-@@ -130,6 +130,8 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
- int val, valbool;
- int retv = -ENOPROTOOPT;
-
-+ pax_track_stack();
-+
- if (optval == NULL)
- val=0;
- else {
-@@ -881,6 +883,8 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
- int len;
- int val;
-
-+ pax_track_stack();
-+
- if (ip6_mroute_opt(optname))
- return ip6_mroute_getsockopt(sk, optname, optval, optlen);
-
-@@ -922,7 +926,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
- if (sk->sk_type != SOCK_STREAM)
- return -ENOPROTOOPT;
-
-- msg.msg_control = optval;
-+ msg.msg_control = (void __force_kernel *)optval;
- msg.msg_controllen = len;
- msg.msg_flags = 0;
-
-diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
-index 1cf3f0c..1d4376f 100644
---- a/net/ipv6/netfilter/ip6_queue.c
-+++ b/net/ipv6/netfilter/ip6_queue.c
-@@ -287,6 +287,9 @@ ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct nf_queue_entry *e)
-
- if (v->data_len < sizeof(*user_iph))
- return 0;
-+ if (v->data_len > 65535)
-+ return -EMSGSIZE;
-+
- diff = v->data_len - e->skb->len;
- if (diff < 0) {
- if (pskb_trim(e->skb, v->data_len))
-@@ -411,7 +414,8 @@ ipq_dev_drop(int ifindex)
- static inline void
- __ipq_rcv_skb(struct sk_buff *skb)
- {
-- int status, type, pid, flags, nlmsglen, skblen;
-+ int status, type, pid, flags;
-+ unsigned int nlmsglen, skblen;
- struct nlmsghdr *nlh;
-
- skblen = skb->len;
-diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
-index 78b5a36..4a6941c 100644
---- a/net/ipv6/netfilter/ip6_tables.c
-+++ b/net/ipv6/netfilter/ip6_tables.c
-@@ -1139,14 +1139,14 @@ static int compat_table_info(const struct xt_table_info *info,
- }
- #endif
-
--static int get_info(struct net *net, void __user *user, int *len, int compat)
-+static int get_info(struct net *net, void __user *user, int len, int compat)
- {
- char name[IP6T_TABLE_MAXNAMELEN];
- struct xt_table *t;
- int ret;
-
-- if (*len != sizeof(struct ip6t_getinfo)) {
-- duprintf("length %u != %zu\n", *len,
-+ if (len != sizeof(struct ip6t_getinfo)) {
-+ duprintf("length %u != %zu\n", len,
- sizeof(struct ip6t_getinfo));
- return -EINVAL;
- }
-@@ -1173,6 +1173,7 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
- private = &tmp;
- }
- #endif
-+ memset(&info, 0, sizeof(info));
- info.valid_hooks = t->valid_hooks;
- memcpy(info.hook_entry, private->hook_entry,
- sizeof(info.hook_entry));
-@@ -1182,7 +1183,7 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
- info.size = private->size;
- strcpy(info.name, name);
-
-- if (copy_to_user(user, &info, *len) != 0)
-+ if (copy_to_user(user, &info, len) != 0)
- ret = -EFAULT;
- else
- ret = 0;
-@@ -2014,7 +2015,7 @@ compat_do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
-
- switch (cmd) {
- case IP6T_SO_GET_INFO:
-- ret = get_info(sock_net(sk), user, len, 1);
-+ ret = get_info(sock_net(sk), user, *len, 1);
- break;
- case IP6T_SO_GET_ENTRIES:
- ret = compat_get_entries(sock_net(sk), user, len);
-@@ -2061,7 +2062,7 @@ do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
-
- switch (cmd) {
- case IP6T_SO_GET_INFO:
-- ret = get_info(sock_net(sk), user, len, 0);
-+ ret = get_info(sock_net(sk), user, *len, 0);
- break;
-
- case IP6T_SO_GET_ENTRIES:
-diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
-index 4f24570..b813b34 100644
---- a/net/ipv6/raw.c
-+++ b/net/ipv6/raw.c
-@@ -375,14 +375,14 @@ static inline int rawv6_rcv_skb(struct sock * sk, struct sk_buff * skb)
- {
- if ((raw6_sk(sk)->checksum || sk->sk_filter) &&
- skb_checksum_complete(skb)) {
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- kfree_skb(skb);
- return NET_RX_DROP;
- }
-
- /* Charge it to the socket. */
- if (sock_queue_rcv_skb(sk,skb)<0) {
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- kfree_skb(skb);
- return NET_RX_DROP;
- }
-@@ -403,7 +403,7 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
- struct raw6_sock *rp = raw6_sk(sk);
-
- if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) {
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- kfree_skb(skb);
- return NET_RX_DROP;
- }
-@@ -427,7 +427,7 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
-
- if (inet->hdrincl) {
- if (skb_checksum_complete(skb)) {
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- kfree_skb(skb);
- return NET_RX_DROP;
- }
-@@ -518,7 +518,7 @@ csum_copy_err:
- as some normal condition.
- */
- err = (flags&MSG_DONTWAIT) ? -EAGAIN : -EHOSTUNREACH;
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- goto out;
- }
-
-@@ -600,7 +600,7 @@ out:
- return err;
- }
-
--static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
-+static int rawv6_send_hdrinc(struct sock *sk, void *from, unsigned int length,
- struct flowi *fl, struct rt6_info *rt,
- unsigned int flags)
- {
-@@ -738,6 +738,8 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
- u16 proto;
- int err;
-
-+ pax_track_stack();
-+
- /* Rough check on arithmetic overflow,
- better check is made in ip6_append_data().
- */
-@@ -916,12 +918,17 @@ do_confirm:
- static int rawv6_seticmpfilter(struct sock *sk, int level, int optname,
- char __user *optval, int optlen)
- {
-+ struct icmp6_filter filter;
-+
- switch (optname) {
- case ICMPV6_FILTER:
-+ if (optlen < 0)
-+ return -EINVAL;
- if (optlen > sizeof(struct icmp6_filter))
- optlen = sizeof(struct icmp6_filter);
-- if (copy_from_user(&raw6_sk(sk)->filter, optval, optlen))
-+ if (copy_from_user(&filter, optval, optlen))
- return -EFAULT;
-+ raw6_sk(sk)->filter = filter;
- return 0;
- default:
- return -ENOPROTOOPT;
-@@ -934,6 +941,7 @@ static int rawv6_geticmpfilter(struct sock *sk, int level, int optname,
- char __user *optval, int __user *optlen)
- {
- int len;
-+ struct icmp6_filter filter;
-
- switch (optname) {
- case ICMPV6_FILTER:
-@@ -945,7 +953,8 @@ static int rawv6_geticmpfilter(struct sock *sk, int level, int optname,
- len = sizeof(struct icmp6_filter);
- if (put_user(len, optlen))
- return -EFAULT;
-- if (copy_to_user(optval, &raw6_sk(sk)->filter, len))
-+ filter = raw6_sk(sk)->filter;
-+ if (len > sizeof filter || copy_to_user(optval, &filter, len))
- return -EFAULT;
- return 0;
- default:
-@@ -1241,7 +1250,13 @@ static void raw6_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
- 0, 0L, 0,
- sock_i_uid(sp), 0,
- sock_i_ino(sp),
-- atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
-+ atomic_read(&sp->sk_refcnt),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
-+ sp,
-+#endif
-+ atomic_read_unchecked(&sp->sk_drops));
- }
-
- static int raw6_seq_show(struct seq_file *seq, void *v)
-diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
-index 1b25191..34c509c 100644
---- a/net/ipv6/tcp_ipv6.c
-+++ b/net/ipv6/tcp_ipv6.c
-@@ -89,6 +89,10 @@ static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
- }
- #endif
-
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+extern int grsec_enable_blackhole;
-+#endif
-+
- static void tcp_v6_hash(struct sock *sk)
- {
- if (sk->sk_state != TCP_CLOSE) {
-@@ -1579,6 +1583,9 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
- return 0;
-
- reset:
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ if (!grsec_enable_blackhole)
-+#endif
- tcp_v6_send_reset(sk, skb);
- discard:
- if (opt_skb)
-@@ -1656,12 +1663,20 @@ static int tcp_v6_rcv(struct sk_buff *skb)
- TCP_SKB_CB(skb)->sacked = 0;
-
- sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
-- if (!sk)
-+ if (!sk) {
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ ret = 1;
-+#endif
- goto no_tcp_socket;
-+ }
-
- process:
-- if (sk->sk_state == TCP_TIME_WAIT)
-+ if (sk->sk_state == TCP_TIME_WAIT) {
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ ret = 2;
-+#endif
- goto do_time_wait;
-+ }
-
- if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
- goto discard_and_relse;
-@@ -1701,6 +1716,10 @@ no_tcp_socket:
- bad_packet:
- TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
- } else {
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ if (!grsec_enable_blackhole || (ret == 1 &&
-+ (skb->dev->flags & IFF_LOOPBACK)))
-+#endif
- tcp_v6_send_reset(NULL, skb);
- }
-
-@@ -1916,7 +1935,13 @@ static void get_openreq6(struct seq_file *seq,
- uid,
- 0, /* non standard timer */
- 0, /* open_requests have no inode */
-- 0, req);
-+ 0,
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL
-+#else
-+ req
-+#endif
-+ );
- }
-
- static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
-@@ -1966,7 +1991,12 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
- sock_i_uid(sp),
- icsk->icsk_probes_out,
- sock_i_ino(sp),
-- atomic_read(&sp->sk_refcnt), sp,
-+ atomic_read(&sp->sk_refcnt),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
-+ sp,
-+#endif
- jiffies_to_clock_t(icsk->icsk_rto),
- jiffies_to_clock_t(icsk->icsk_ack.ato),
- (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
-@@ -2001,7 +2031,13 @@ static void get_timewait6_sock(struct seq_file *seq,
- dest->s6_addr32[2], dest->s6_addr32[3], destp,
- tw->tw_substate, 0, 0,
- 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
-- atomic_read(&tw->tw_refcnt), tw);
-+ atomic_read(&tw->tw_refcnt),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL
-+#else
-+ tw
-+#endif
-+ );
- }
-
- static int tcp6_seq_show(struct seq_file *seq, void *v)
-diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
-index d8c0374..b82b590 100644
---- a/net/ipv6/udp.c
-+++ b/net/ipv6/udp.c
-@@ -49,6 +49,10 @@
- #include <linux/seq_file.h>
- #include "udp_impl.h"
-
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+extern int grsec_enable_blackhole;
-+#endif
-+
- int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
- {
- const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr;
-@@ -391,7 +395,7 @@ int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
- if (rc == -ENOMEM) {
- UDP6_INC_STATS_BH(sock_net(sk),
- UDP_MIB_RCVBUFERRORS, is_udplite);
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- }
- goto drop;
- }
-@@ -590,6 +594,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
- UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
- proto == IPPROTO_UDPLITE);
-
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
-+#endif
- icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0, dev);
-
- kfree_skb(skb);
-@@ -1209,8 +1216,13 @@ static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket
- 0, 0L, 0,
- sock_i_uid(sp), 0,
- sock_i_ino(sp),
-- atomic_read(&sp->sk_refcnt), sp,
-- atomic_read(&sp->sk_drops));
-+ atomic_read(&sp->sk_refcnt),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
-+ sp,
-+#endif
-+ atomic_read_unchecked(&sp->sk_drops));
- }
-
- int udp6_seq_show(struct seq_file *seq, void *v)
-diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
-index 48bb1e3..5980e6e 100644
---- a/net/ipv6/xfrm6_tunnel.c
-+++ b/net/ipv6/xfrm6_tunnel.c
-@@ -258,7 +258,7 @@ static int xfrm6_tunnel_rcv(struct sk_buff *skb)
- __be32 spi;
-
- spi = xfrm6_tunnel_spi_lookup((xfrm_address_t *)&iph->saddr);
-- return xfrm6_rcv_spi(skb, IPPROTO_IPV6, spi) > 0 ? : 0;
-+ return xfrm6_rcv_spi(skb, IPPROTO_IPV6, spi);
- }
-
- static int xfrm6_tunnel_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
-diff --git a/net/irda/ircomm/ircomm_tty.c b/net/irda/ircomm/ircomm_tty.c
-index 811984d..11f59b7 100644
---- a/net/irda/ircomm/ircomm_tty.c
-+++ b/net/irda/ircomm/ircomm_tty.c
-@@ -280,16 +280,16 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
- add_wait_queue(&self->open_wait, &wait);
-
- IRDA_DEBUG(2, "%s(%d):block_til_ready before block on %s open_count=%d\n",
-- __FILE__,__LINE__, tty->driver->name, self->open_count );
-+ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
-
- /* As far as I can see, we protect open_count - Jean II */
- spin_lock_irqsave(&self->spinlock, flags);
- if (!tty_hung_up_p(filp)) {
- extra_count = 1;
-- self->open_count--;
-+ local_dec(&self->open_count);
- }
- spin_unlock_irqrestore(&self->spinlock, flags);
-- self->blocked_open++;
-+ local_inc(&self->blocked_open);
-
- while (1) {
- if (tty->termios->c_cflag & CBAUD) {
-@@ -329,7 +329,7 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
- }
-
- IRDA_DEBUG(1, "%s(%d):block_til_ready blocking on %s open_count=%d\n",
-- __FILE__,__LINE__, tty->driver->name, self->open_count );
-+ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
-
- schedule();
- }
-@@ -340,13 +340,13 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
- if (extra_count) {
- /* ++ is not atomic, so this should be protected - Jean II */
- spin_lock_irqsave(&self->spinlock, flags);
-- self->open_count++;
-+ local_inc(&self->open_count);
- spin_unlock_irqrestore(&self->spinlock, flags);
- }
-- self->blocked_open--;
-+ local_dec(&self->blocked_open);
-
- IRDA_DEBUG(1, "%s(%d):block_til_ready after blocking on %s open_count=%d\n",
-- __FILE__,__LINE__, tty->driver->name, self->open_count);
-+ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count));
-
- if (!retval)
- self->flags |= ASYNC_NORMAL_ACTIVE;
-@@ -415,14 +415,14 @@ static int ircomm_tty_open(struct tty_struct *tty, struct file *filp)
- }
- /* ++ is not atomic, so this should be protected - Jean II */
- spin_lock_irqsave(&self->spinlock, flags);
-- self->open_count++;
-+ local_inc(&self->open_count);
-
- tty->driver_data = self;
- self->tty = tty;
- spin_unlock_irqrestore(&self->spinlock, flags);
-
- IRDA_DEBUG(1, "%s(), %s%d, count = %d\n", __func__ , tty->driver->name,
-- self->line, self->open_count);
-+ self->line, local_read(&self->open_count));
-
- /* Not really used by us, but lets do it anyway */
- self->tty->low_latency = (self->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
-@@ -511,7 +511,7 @@ static void ircomm_tty_close(struct tty_struct *tty, struct file *filp)
- return;
- }
-
-- if ((tty->count == 1) && (self->open_count != 1)) {
-+ if ((tty->count == 1) && (local_read(&self->open_count) != 1)) {
- /*
- * Uh, oh. tty->count is 1, which means that the tty
- * structure will be freed. state->count should always
-@@ -521,16 +521,16 @@ static void ircomm_tty_close(struct tty_struct *tty, struct file *filp)
- */
- IRDA_DEBUG(0, "%s(), bad serial port count; "
- "tty->count is 1, state->count is %d\n", __func__ ,
-- self->open_count);
-- self->open_count = 1;
-+ local_read(&self->open_count));
-+ local_set(&self->open_count, 1);
- }
-
-- if (--self->open_count < 0) {
-+ if (local_dec_return(&self->open_count) < 0) {
- IRDA_ERROR("%s(), bad serial port count for ttys%d: %d\n",
-- __func__, self->line, self->open_count);
-- self->open_count = 0;
-+ __func__, self->line, local_read(&self->open_count));
-+ local_set(&self->open_count, 0);
- }
-- if (self->open_count) {
-+ if (local_read(&self->open_count)) {
- spin_unlock_irqrestore(&self->spinlock, flags);
-
- IRDA_DEBUG(0, "%s(), open count > 0\n", __func__ );
-@@ -562,7 +562,7 @@ static void ircomm_tty_close(struct tty_struct *tty, struct file *filp)
- tty->closing = 0;
- self->tty = NULL;
-
-- if (self->blocked_open) {
-+ if (local_read(&self->blocked_open)) {
- if (self->close_delay)
- schedule_timeout_interruptible(self->close_delay);
- wake_up_interruptible(&self->open_wait);
-@@ -1017,7 +1017,7 @@ static void ircomm_tty_hangup(struct tty_struct *tty)
- spin_lock_irqsave(&self->spinlock, flags);
- self->flags &= ~ASYNC_NORMAL_ACTIVE;
- self->tty = NULL;
-- self->open_count = 0;
-+ local_set(&self->open_count, 0);
- spin_unlock_irqrestore(&self->spinlock, flags);
-
- wake_up_interruptible(&self->open_wait);
-@@ -1369,7 +1369,7 @@ static void ircomm_tty_line_info(struct ircomm_tty_cb *self, struct seq_file *m)
- seq_putc(m, '\n');
-
- seq_printf(m, "Role: %s\n", self->client ? "client" : "server");
-- seq_printf(m, "Open count: %d\n", self->open_count);
-+ seq_printf(m, "Open count: %d\n", local_read(&self->open_count));
- seq_printf(m, "Max data size: %d\n", self->max_data_size);
- seq_printf(m, "Max header size: %d\n", self->max_header_size);
-
-diff --git a/net/irda/iriap.c b/net/irda/iriap.c
-index 35a338b..62102d6 100644
---- a/net/irda/iriap.c
-+++ b/net/irda/iriap.c
-@@ -489,8 +489,11 @@ static void iriap_getvaluebyclass_confirm(struct iriap_cb *self,
- /* case CS_ISO_8859_9: */
- /* case CS_UNICODE: */
- default:
-- IRDA_DEBUG(0, "%s(), charset %s, not supported\n",
-- __func__, ias_charset_types[charset]);
-+ IRDA_DEBUG(0, "%s(), charset [%d] %s, not supported\n",
-+ __func__, charset,
-+ charset < ARRAY_SIZE(ias_charset_types) ?
-+ ias_charset_types[charset] :
-+ "(unknown)");
-
- /* Aborting, close connection! */
- iriap_disconnect_request(self);
-diff --git a/net/irda/irlap_frame.c b/net/irda/irlap_frame.c
-index 7af2e74..143ae58 100644
---- a/net/irda/irlap_frame.c
-+++ b/net/irda/irlap_frame.c
-@@ -543,7 +543,7 @@ static void irlap_recv_discovery_xid_cmd(struct irlap_cb *self,
- /*
- * We now have some discovery info to deliver!
- */
-- discovery = kmalloc(sizeof(discovery_t), GFP_ATOMIC);
-+ discovery = kzalloc(sizeof(discovery_t), GFP_ATOMIC);
- if (!discovery) {
- IRDA_WARNING("%s: unable to malloc!\n", __func__);
- return;
-diff --git a/net/irda/irttp.c b/net/irda/irttp.c
-index 9cb79f9..d35d057 100644
---- a/net/irda/irttp.c
-+++ b/net/irda/irttp.c
-@@ -439,6 +439,7 @@ struct tsap_cb *irttp_open_tsap(__u8 stsap_sel, int credit, notify_t *notify)
- lsap = irlmp_open_lsap(stsap_sel, &ttp_notify, 0);
- if (lsap == NULL) {
- IRDA_WARNING("%s: unable to allocate LSAP!!\n", __func__);
-+ __irttp_close_tsap(self);
- return NULL;
- }
-
-diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
-index f605b23..9e339dc 100644
---- a/net/iucv/af_iucv.c
-+++ b/net/iucv/af_iucv.c
-@@ -651,10 +651,10 @@ static int iucv_sock_autobind(struct sock *sk)
-
- write_lock_bh(&iucv_sk_list.lock);
-
-- sprintf(name, "%08x", atomic_inc_return(&iucv_sk_list.autobind_name));
-+ sprintf(name, "%08x", atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
- while (__iucv_get_sock_by_name(name)) {
- sprintf(name, "%08x",
-- atomic_inc_return(&iucv_sk_list.autobind_name));
-+ atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
- }
-
- write_unlock_bh(&iucv_sk_list.lock);
-diff --git a/net/key/af_key.c b/net/key/af_key.c
-index 4e98193..37072bd 100644
---- a/net/key/af_key.c
-+++ b/net/key/af_key.c
-@@ -1726,6 +1726,7 @@ static int key_notify_sa_flush(struct km_event *c)
- hdr->sadb_msg_version = PF_KEY_V2;
- hdr->sadb_msg_errno = (uint8_t) 0;
- hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
-+ hdr->sadb_msg_reserved = 0;
-
- pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
-
-@@ -2489,6 +2490,8 @@ static int pfkey_migrate(struct sock *sk, struct sk_buff *skb,
- struct xfrm_migrate m[XFRM_MAX_DEPTH];
- struct xfrm_kmaddress k;
-
-+ pax_track_stack();
-+
- if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC - 1],
- ext_hdrs[SADB_EXT_ADDRESS_DST - 1]) ||
- !ext_hdrs[SADB_X_EXT_POLICY - 1]) {
-@@ -2694,6 +2697,7 @@ static int key_notify_policy_flush(struct km_event *c)
- hdr->sadb_msg_version = PF_KEY_V2;
- hdr->sadb_msg_errno = (uint8_t) 0;
- hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
-+ hdr->sadb_msg_reserved = 0;
- pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
- return 0;
-
-@@ -3660,7 +3664,11 @@ static int pfkey_seq_show(struct seq_file *f, void *v)
- seq_printf(f ,"sk RefCnt Rmem Wmem User Inode\n");
- else
- seq_printf(f ,"%p %-6d %-6u %-6u %-6u %-6lu\n",
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
- s,
-+#endif
- atomic_read(&s->sk_refcnt),
- sk_rmem_alloc_get(s),
- sk_wmem_alloc_get(s),
-diff --git a/net/lapb/lapb_iface.c b/net/lapb/lapb_iface.c
-index bda96d1..c038b72 100644
---- a/net/lapb/lapb_iface.c
-+++ b/net/lapb/lapb_iface.c
-@@ -157,7 +157,7 @@ int lapb_register(struct net_device *dev, struct lapb_register_struct *callbacks
- goto out;
-
- lapb->dev = dev;
-- lapb->callbacks = *callbacks;
-+ lapb->callbacks = callbacks;
-
- __lapb_insert_cb(lapb);
-
-@@ -379,32 +379,32 @@ int lapb_data_received(struct net_device *dev, struct sk_buff *skb)
-
- void lapb_connect_confirmation(struct lapb_cb *lapb, int reason)
- {
-- if (lapb->callbacks.connect_confirmation)
-- lapb->callbacks.connect_confirmation(lapb->dev, reason);
-+ if (lapb->callbacks->connect_confirmation)
-+ lapb->callbacks->connect_confirmation(lapb->dev, reason);
- }
-
- void lapb_connect_indication(struct lapb_cb *lapb, int reason)
- {
-- if (lapb->callbacks.connect_indication)
-- lapb->callbacks.connect_indication(lapb->dev, reason);
-+ if (lapb->callbacks->connect_indication)
-+ lapb->callbacks->connect_indication(lapb->dev, reason);
- }
-
- void lapb_disconnect_confirmation(struct lapb_cb *lapb, int reason)
- {
-- if (lapb->callbacks.disconnect_confirmation)
-- lapb->callbacks.disconnect_confirmation(lapb->dev, reason);
-+ if (lapb->callbacks->disconnect_confirmation)
-+ lapb->callbacks->disconnect_confirmation(lapb->dev, reason);
- }
-
- void lapb_disconnect_indication(struct lapb_cb *lapb, int reason)
- {
-- if (lapb->callbacks.disconnect_indication)
-- lapb->callbacks.disconnect_indication(lapb->dev, reason);
-+ if (lapb->callbacks->disconnect_indication)
-+ lapb->callbacks->disconnect_indication(lapb->dev, reason);
- }
-
- int lapb_data_indication(struct lapb_cb *lapb, struct sk_buff *skb)
- {
-- if (lapb->callbacks.data_indication)
-- return lapb->callbacks.data_indication(lapb->dev, skb);
-+ if (lapb->callbacks->data_indication)
-+ return lapb->callbacks->data_indication(lapb->dev, skb);
-
- kfree_skb(skb);
- return NET_RX_SUCCESS; /* For now; must be != NET_RX_DROP */
-@@ -414,8 +414,8 @@ int lapb_data_transmit(struct lapb_cb *lapb, struct sk_buff *skb)
- {
- int used = 0;
-
-- if (lapb->callbacks.data_transmit) {
-- lapb->callbacks.data_transmit(lapb->dev, skb);
-+ if (lapb->callbacks->data_transmit) {
-+ lapb->callbacks->data_transmit(lapb->dev, skb);
- used = 1;
- }
-
-diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
-index fe2d3f8..e57f683 100644
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -1369,7 +1369,7 @@ static int ieee80211_set_bitrate_mask(struct wiphy *wiphy,
- return err;
- }
-
--struct cfg80211_ops mac80211_config_ops = {
-+const struct cfg80211_ops mac80211_config_ops = {
- .add_virtual_intf = ieee80211_add_iface,
- .del_virtual_intf = ieee80211_del_iface,
- .change_virtual_intf = ieee80211_change_iface,
-diff --git a/net/mac80211/cfg.h b/net/mac80211/cfg.h
-index 7d7879f..2d51f62 100644
---- a/net/mac80211/cfg.h
-+++ b/net/mac80211/cfg.h
-@@ -4,6 +4,6 @@
- #ifndef __CFG_H
- #define __CFG_H
-
--extern struct cfg80211_ops mac80211_config_ops;
-+extern const struct cfg80211_ops mac80211_config_ops;
-
- #endif /* __CFG_H */
-diff --git a/net/mac80211/debugfs_key.c b/net/mac80211/debugfs_key.c
-index 99c7525..9cb4937 100644
---- a/net/mac80211/debugfs_key.c
-+++ b/net/mac80211/debugfs_key.c
-@@ -211,9 +211,13 @@ static ssize_t key_key_read(struct file *file, char __user *userbuf,
- size_t count, loff_t *ppos)
- {
- struct ieee80211_key *key = file->private_data;
-- int i, res, bufsize = 2 * key->conf.keylen + 2;
-+ int i, bufsize = 2 * key->conf.keylen + 2;
- char *buf = kmalloc(bufsize, GFP_KERNEL);
- char *p = buf;
-+ ssize_t res;
-+
-+ if (buf == NULL)
-+ return -ENOMEM;
-
- for (i = 0; i < key->conf.keylen; i++)
- p += scnprintf(p, bufsize + buf - p, "%02x", key->conf.key[i]);
-diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
-index 33a2e89..08650c8 100644
---- a/net/mac80211/debugfs_sta.c
-+++ b/net/mac80211/debugfs_sta.c
-@@ -124,6 +124,8 @@ static ssize_t sta_agg_status_read(struct file *file, char __user *userbuf,
- int i;
- struct sta_info *sta = file->private_data;
-
-+ pax_track_stack();
-+
- spin_lock_bh(&sta->lock);
- p += scnprintf(p, sizeof(buf)+buf-p, "next dialog_token is %#02x\n",
- sta->ampdu_mlme.dialog_token_allocator + 1);
-diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
-index ca62bfe..6657a03 100644
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -25,6 +25,7 @@
- #include <linux/etherdevice.h>
- #include <net/cfg80211.h>
- #include <net/mac80211.h>
-+#include <asm/local.h>
- #include "key.h"
- #include "sta_info.h"
-
-@@ -635,7 +636,7 @@ struct ieee80211_local {
- /* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
- spinlock_t queue_stop_reason_lock;
-
-- int open_count;
-+ local_t open_count;
- int monitors, cooked_mntrs;
- /* number of interfaces with corresponding FIF_ flags */
- int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll;
-diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
-index 079c500..eb3c6d4 100644
---- a/net/mac80211/iface.c
-+++ b/net/mac80211/iface.c
-@@ -166,7 +166,7 @@ static int ieee80211_open(struct net_device *dev)
- break;
- }
-
-- if (local->open_count == 0) {
-+ if (local_read(&local->open_count) == 0) {
- res = drv_start(local);
- if (res)
- goto err_del_bss;
-@@ -196,7 +196,7 @@ static int ieee80211_open(struct net_device *dev)
- * Validate the MAC address for this device.
- */
- if (!is_valid_ether_addr(dev->dev_addr)) {
-- if (!local->open_count)
-+ if (!local_read(&local->open_count))
- drv_stop(local);
- return -EADDRNOTAVAIL;
- }
-@@ -292,7 +292,7 @@ static int ieee80211_open(struct net_device *dev)
-
- hw_reconf_flags |= __ieee80211_recalc_idle(local);
-
-- local->open_count++;
-+ local_inc(&local->open_count);
- if (hw_reconf_flags) {
- ieee80211_hw_config(local, hw_reconf_flags);
- /*
-@@ -320,7 +320,7 @@ static int ieee80211_open(struct net_device *dev)
- err_del_interface:
- drv_remove_interface(local, &conf);
- err_stop:
-- if (!local->open_count)
-+ if (!local_read(&local->open_count))
- drv_stop(local);
- err_del_bss:
- sdata->bss = NULL;
-@@ -420,7 +420,7 @@ static int ieee80211_stop(struct net_device *dev)
- WARN_ON(!list_empty(&sdata->u.ap.vlans));
- }
-
-- local->open_count--;
-+ local_dec(&local->open_count);
-
- switch (sdata->vif.type) {
- case NL80211_IFTYPE_AP_VLAN:
-@@ -526,7 +526,7 @@ static int ieee80211_stop(struct net_device *dev)
-
- ieee80211_recalc_ps(local, -1);
-
-- if (local->open_count == 0) {
-+ if (local_read(&local->open_count) == 0) {
- ieee80211_clear_tx_pending(local);
- ieee80211_stop_device(local);
-
-diff --git a/net/mac80211/main.c b/net/mac80211/main.c
-index 2dfe176..74e4388 100644
---- a/net/mac80211/main.c
-+++ b/net/mac80211/main.c
-@@ -145,7 +145,7 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
- local->hw.conf.power_level = power;
- }
-
-- if (changed && local->open_count) {
-+ if (changed && local_read(&local->open_count)) {
- ret = drv_config(local, changed);
- /*
- * Goal:
-diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
-index e67eea7..fcc227e 100644
---- a/net/mac80211/mlme.c
-+++ b/net/mac80211/mlme.c
-@@ -1438,6 +1438,8 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
- bool have_higher_than_11mbit = false, newsta = false;
- u16 ap_ht_cap_flags;
-
-+ pax_track_stack();
-+
- /*
- * AssocResp and ReassocResp have identical structure, so process both
- * of them in this function.
-diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
-index e535f1c..4d733d1 100644
---- a/net/mac80211/pm.c
-+++ b/net/mac80211/pm.c
-@@ -107,7 +107,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
- }
-
- /* stop hardware - this must stop RX */
-- if (local->open_count)
-+ if (local_read(&local->open_count))
- ieee80211_stop_device(local);
-
- local->suspended = true;
-diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
-index b33efc4..0a2efb6 100644
---- a/net/mac80211/rate.c
-+++ b/net/mac80211/rate.c
-@@ -287,7 +287,7 @@ int ieee80211_init_rate_ctrl_alg(struct ieee80211_local *local,
- struct rate_control_ref *ref, *old;
-
- ASSERT_RTNL();
-- if (local->open_count)
-+ if (local_read(&local->open_count))
- return -EBUSY;
-
- ref = rate_control_alloc(name, local);
-diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
-index b1d7904..57e4da7 100644
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -173,7 +173,7 @@ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr,
- return cpu_to_le16(dur);
- }
-
--static int inline is_ieee80211_device(struct ieee80211_local *local,
-+static inline int is_ieee80211_device(struct ieee80211_local *local,
- struct net_device *dev)
- {
- return local == wdev_priv(dev->ieee80211_ptr);
-diff --git a/net/mac80211/util.c b/net/mac80211/util.c
-index 31b1085..48fb26d 100644
---- a/net/mac80211/util.c
-+++ b/net/mac80211/util.c
-@@ -1042,7 +1042,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
- local->resuming = true;
-
- /* restart hardware */
-- if (local->open_count) {
-+ if (local_read(&local->open_count)) {
- /*
- * Upon resume hardware can sometimes be goofy due to
- * various platform / driver / bus issues, so restarting
-diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
-index 634d14a..b35a608 100644
---- a/net/netfilter/Kconfig
-+++ b/net/netfilter/Kconfig
-@@ -635,6 +635,16 @@ config NETFILTER_XT_MATCH_ESP
-
- To compile it as a module, choose M here. If unsure, say N.
-
-+config NETFILTER_XT_MATCH_GRADM
-+ tristate '"gradm" match support'
-+ depends on NETFILTER_XTABLES && NETFILTER_ADVANCED
-+ depends on GRKERNSEC && !GRKERNSEC_NO_RBAC
-+ ---help---
-+ The gradm match allows to match on grsecurity RBAC being enabled.
-+ It is useful when iptables rules are applied early on bootup to
-+ prevent connections to the machine (except from a trusted host)
-+ while the RBAC system is disabled.
-+
- config NETFILTER_XT_MATCH_HASHLIMIT
- tristate '"hashlimit" match support'
- depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
-diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
-index 49f62ee..a17b2c6 100644
---- a/net/netfilter/Makefile
-+++ b/net/netfilter/Makefile
-@@ -68,6 +68,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_CONNTRACK) += xt_conntrack.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_DCCP) += xt_dccp.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_DSCP) += xt_dscp.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) += xt_esp.o
-+obj-$(CONFIG_NETFILTER_XT_MATCH_GRADM) += xt_gradm.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o
-diff --git a/net/netfilter/ipvs/ip_vs_app.c b/net/netfilter/ipvs/ip_vs_app.c
-index 3c7e427..724043c 100644
---- a/net/netfilter/ipvs/ip_vs_app.c
-+++ b/net/netfilter/ipvs/ip_vs_app.c
-@@ -564,7 +564,7 @@ static const struct file_operations ip_vs_app_fops = {
- .open = ip_vs_app_open,
- .read = seq_read,
- .llseek = seq_lseek,
-- .release = seq_release,
-+ .release = seq_release_net,
- };
- #endif
-
-diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
-index 95682e5..457dbac 100644
---- a/net/netfilter/ipvs/ip_vs_conn.c
-+++ b/net/netfilter/ipvs/ip_vs_conn.c
-@@ -453,10 +453,10 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, struct ip_vs_dest *dest)
- /* if the connection is not template and is created
- * by sync, preserve the activity flag.
- */
-- cp->flags |= atomic_read(&dest->conn_flags) &
-+ cp->flags |= atomic_read_unchecked(&dest->conn_flags) &
- (~IP_VS_CONN_F_INACTIVE);
- else
-- cp->flags |= atomic_read(&dest->conn_flags);
-+ cp->flags |= atomic_read_unchecked(&dest->conn_flags);
- cp->dest = dest;
-
- IP_VS_DBG_BUF(7, "Bind-dest %s c:%s:%d v:%s:%d "
-@@ -723,7 +723,7 @@ ip_vs_conn_new(int af, int proto, const union nf_inet_addr *caddr, __be16 cport,
- atomic_set(&cp->refcnt, 1);
-
- atomic_set(&cp->n_control, 0);
-- atomic_set(&cp->in_pkts, 0);
-+ atomic_set_unchecked(&cp->in_pkts, 0);
-
- atomic_inc(&ip_vs_conn_count);
- if (flags & IP_VS_CONN_F_NO_CPORT)
-@@ -871,7 +871,7 @@ static const struct file_operations ip_vs_conn_fops = {
- .open = ip_vs_conn_open,
- .read = seq_read,
- .llseek = seq_lseek,
-- .release = seq_release,
-+ .release = seq_release_net,
- };
-
- static const char *ip_vs_origin_name(unsigned flags)
-@@ -934,7 +934,7 @@ static const struct file_operations ip_vs_conn_sync_fops = {
- .open = ip_vs_conn_sync_open,
- .read = seq_read,
- .llseek = seq_lseek,
-- .release = seq_release,
-+ .release = seq_release_net,
- };
-
- #endif
-@@ -961,7 +961,7 @@ static inline int todrop_entry(struct ip_vs_conn *cp)
-
- /* Don't drop the entry if its number of incoming packets is not
- located in [0, 8] */
-- i = atomic_read(&cp->in_pkts);
-+ i = atomic_read_unchecked(&cp->in_pkts);
- if (i > 8 || i < 0) return 0;
-
- if (!todrop_rate[i]) return 0;
-diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
-index b95699f..5fee919 100644
---- a/net/netfilter/ipvs/ip_vs_core.c
-+++ b/net/netfilter/ipvs/ip_vs_core.c
-@@ -485,7 +485,7 @@ int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,
- ret = cp->packet_xmit(skb, cp, pp);
- /* do not touch skb anymore */
-
-- atomic_inc(&cp->in_pkts);
-+ atomic_inc_unchecked(&cp->in_pkts);
- ip_vs_conn_put(cp);
- return ret;
- }
-@@ -1357,7 +1357,7 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb,
- * Sync connection if it is about to close to
- * encorage the standby servers to update the connections timeout
- */
-- pkts = atomic_add_return(1, &cp->in_pkts);
-+ pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
- if (af == AF_INET &&
- (ip_vs_sync_state & IP_VS_STATE_MASTER) &&
- (((cp->protocol != IPPROTO_TCP ||
-diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
-index 9bcd972..513b1e3 100644
---- a/net/netfilter/ipvs/ip_vs_ctl.c
-+++ b/net/netfilter/ipvs/ip_vs_ctl.c
-@@ -792,7 +792,7 @@ __ip_vs_update_dest(struct ip_vs_service *svc,
- ip_vs_rs_hash(dest);
- write_unlock_bh(&__ip_vs_rs_lock);
- }
-- atomic_set(&dest->conn_flags, conn_flags);
-+ atomic_set_unchecked(&dest->conn_flags, conn_flags);
-
- /* bind the service */
- if (!dest->svc) {
-@@ -1888,7 +1888,7 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
- " %-7s %-6d %-10d %-10d\n",
- &dest->addr.in6,
- ntohs(dest->port),
-- ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
-+ ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
- atomic_read(&dest->weight),
- atomic_read(&dest->activeconns),
- atomic_read(&dest->inactconns));
-@@ -1899,7 +1899,7 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
- "%-7s %-6d %-10d %-10d\n",
- ntohl(dest->addr.ip),
- ntohs(dest->port),
-- ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
-+ ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
- atomic_read(&dest->weight),
- atomic_read(&dest->activeconns),
- atomic_read(&dest->inactconns));
-@@ -1927,7 +1927,7 @@ static const struct file_operations ip_vs_info_fops = {
- .open = ip_vs_info_open,
- .read = seq_read,
- .llseek = seq_lseek,
-- .release = seq_release_private,
-+ .release = seq_release_net,
- };
-
- #endif
-@@ -1976,7 +1976,7 @@ static const struct file_operations ip_vs_stats_fops = {
- .open = ip_vs_stats_seq_open,
- .read = seq_read,
- .llseek = seq_lseek,
-- .release = single_release,
-+ .release = single_release_net,
- };
-
- #endif
-@@ -2077,6 +2077,10 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
- if (!capable(CAP_NET_ADMIN))
- return -EPERM;
-
-+ if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_SET_MAX)
-+ return -EINVAL;
-+ if (len > MAX_ARG_LEN)
-+ return -EINVAL;
- if (len != set_arglen[SET_CMDID(cmd)]) {
- pr_err("set_ctl: len %u != %u\n",
- len, set_arglen[SET_CMDID(cmd)]);
-@@ -2286,13 +2290,14 @@ __ip_vs_get_dest_entries(const struct ip_vs_get_dests *get,
- struct ip_vs_dest *dest;
- struct ip_vs_dest_entry entry;
-
-+ memset(&entry, 0, sizeof(entry));
- list_for_each_entry(dest, &svc->destinations, n_list) {
- if (count >= get->num_dests)
- break;
-
- entry.addr = dest->addr.ip;
- entry.port = dest->port;
-- entry.conn_flags = atomic_read(&dest->conn_flags);
-+ entry.conn_flags = atomic_read_unchecked(&dest->conn_flags);
- entry.weight = atomic_read(&dest->weight);
- entry.u_threshold = dest->u_threshold;
- entry.l_threshold = dest->l_threshold;
-@@ -2352,17 +2357,27 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
- {
- unsigned char arg[128];
- int ret = 0;
-+ unsigned int copylen;
-+
-+ pax_track_stack();
-
- if (!capable(CAP_NET_ADMIN))
- return -EPERM;
-
-+ if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_GET_MAX)
-+ return -EINVAL;
-+
- if (*len < get_arglen[GET_CMDID(cmd)]) {
- pr_err("get_ctl: len %u < %u\n",
- *len, get_arglen[GET_CMDID(cmd)]);
- return -EINVAL;
- }
-
-- if (copy_from_user(arg, user, get_arglen[GET_CMDID(cmd)]) != 0)
-+ copylen = get_arglen[GET_CMDID(cmd)];
-+ if (copylen > 128)
-+ return -EINVAL;
-+
-+ if (copy_from_user(arg, user, copylen) != 0)
- return -EFAULT;
-
- if (mutex_lock_interruptible(&__ip_vs_mutex))
-@@ -2803,7 +2818,7 @@ static int ip_vs_genl_fill_dest(struct sk_buff *skb, struct ip_vs_dest *dest)
- NLA_PUT_U16(skb, IPVS_DEST_ATTR_PORT, dest->port);
-
- NLA_PUT_U32(skb, IPVS_DEST_ATTR_FWD_METHOD,
-- atomic_read(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
-+ atomic_read_unchecked(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
- NLA_PUT_U32(skb, IPVS_DEST_ATTR_WEIGHT, atomic_read(&dest->weight));
- NLA_PUT_U32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold);
- NLA_PUT_U32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold);
-diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
-index e177f0d..55e8581 100644
---- a/net/netfilter/ipvs/ip_vs_sync.c
-+++ b/net/netfilter/ipvs/ip_vs_sync.c
-@@ -438,7 +438,7 @@ static void ip_vs_process_message(const char *buffer, const size_t buflen)
-
- if (opt)
- memcpy(&cp->in_seq, opt, sizeof(*opt));
-- atomic_set(&cp->in_pkts, sysctl_ip_vs_sync_threshold[0]);
-+ atomic_set_unchecked(&cp->in_pkts, sysctl_ip_vs_sync_threshold[0]);
- cp->state = state;
- cp->old_state = cp->state;
- /*
-diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
-index 5be9140..660bb6d 100644
---- a/net/netfilter/ipvs/ip_vs_xmit.c
-+++ b/net/netfilter/ipvs/ip_vs_xmit.c
-@@ -886,7 +886,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
- else
- rc = NF_ACCEPT;
- /* do not touch skb anymore */
-- atomic_inc(&cp->in_pkts);
-+ atomic_inc_unchecked(&cp->in_pkts);
- goto out;
- }
-
-@@ -960,7 +960,7 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
- else
- rc = NF_ACCEPT;
- /* do not touch skb anymore */
-- atomic_inc(&cp->in_pkts);
-+ atomic_inc_unchecked(&cp->in_pkts);
- goto out;
- }
-
-diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
-index 8df3477..ec49230 100644
---- a/net/netfilter/nf_conntrack_core.c
-+++ b/net/netfilter/nf_conntrack_core.c
-@@ -1298,6 +1298,10 @@ err_proto:
- #define UNCONFIRMED_NULLS_VAL ((1<<30)+0)
- #define DYING_NULLS_VAL ((1<<30)+1)
-
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+static atomic_unchecked_t conntrack_cache_id = ATOMIC_INIT(0);
-+#endif
-+
- static int nf_conntrack_init_net(struct net *net)
- {
- int ret;
-@@ -1311,7 +1315,11 @@ static int nf_conntrack_init_net(struct net *net)
- goto err_stat;
- }
-
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ net->ct.slabname = kasprintf(GFP_KERNEL, "nf_conntrack_%08lx", atomic_inc_return_unchecked(&conntrack_cache_id));
-+#else
- net->ct.slabname = kasprintf(GFP_KERNEL, "nf_conntrack_%p", net);
-+#endif
- if (!net->ct.slabname) {
- ret = -ENOMEM;
- goto err_slabname;
-diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
-index d521718..d0fd7a1 100644
---- a/net/netfilter/nf_conntrack_netlink.c
-+++ b/net/netfilter/nf_conntrack_netlink.c
-@@ -706,7 +706,7 @@ ctnetlink_parse_tuple_proto(struct nlattr *attr,
- static int
- ctnetlink_parse_tuple(const struct nlattr * const cda[],
- struct nf_conntrack_tuple *tuple,
-- enum ctattr_tuple type, u_int8_t l3num)
-+ enum ctattr_type type, u_int8_t l3num)
- {
- struct nlattr *tb[CTA_TUPLE_MAX+1];
- int err;
-diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
-index f900dc3..5e45346 100644
---- a/net/netfilter/nfnetlink_log.c
-+++ b/net/netfilter/nfnetlink_log.c
-@@ -68,7 +68,7 @@ struct nfulnl_instance {
- };
-
- static DEFINE_RWLOCK(instances_lock);
--static atomic_t global_seq;
-+static atomic_unchecked_t global_seq;
-
- #define INSTANCE_BUCKETS 16
- static struct hlist_head instance_table[INSTANCE_BUCKETS];
-@@ -493,7 +493,7 @@ __build_packet_message(struct nfulnl_instance *inst,
- /* global sequence number */
- if (inst->flags & NFULNL_CFG_F_SEQ_GLOBAL)
- NLA_PUT_BE32(inst->skb, NFULA_SEQ_GLOBAL,
-- htonl(atomic_inc_return(&global_seq)));
-+ htonl(atomic_inc_return_unchecked(&global_seq)));
-
- if (data_len) {
- struct nlattr *nla;
-diff --git a/net/netfilter/xt_gradm.c b/net/netfilter/xt_gradm.c
-new file mode 100644
-index 0000000..725bece
---- /dev/null
-+++ b/net/netfilter/xt_gradm.c
-@@ -0,0 +1,51 @@
-+/*
-+ * gradm match for netfilter
-+ * Copyright © Zbigniew Krzystolik, 2010
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License; either version
-+ * 2 or 3 as published by the Free Software Foundation.
-+ */
-+#include <linux/module.h>
-+#include <linux/moduleparam.h>
-+#include <linux/skbuff.h>
-+#include <linux/netfilter/x_tables.h>
-+#include <linux/grsecurity.h>
-+#include <linux/netfilter/xt_gradm.h>
-+
-+static bool
-+gradm_mt(const struct sk_buff *skb, const struct xt_match_param *par)
-+{
-+ const struct xt_gradm_mtinfo *info = par->matchinfo;
-+ bool retval = false;
-+ if (gr_acl_is_enabled())
-+ retval = true;
-+ return retval ^ info->invflags;
-+}
-+
-+static struct xt_match gradm_mt_reg __read_mostly = {
-+ .name = "gradm",
-+ .revision = 0,
-+ .family = NFPROTO_UNSPEC,
-+ .match = gradm_mt,
-+ .matchsize = XT_ALIGN(sizeof(struct xt_gradm_mtinfo)),
-+ .me = THIS_MODULE,
-+};
-+
-+static int __init gradm_mt_init(void)
-+{
-+ return xt_register_match(&gradm_mt_reg);
-+}
-+
-+static void __exit gradm_mt_exit(void)
-+{
-+ xt_unregister_match(&gradm_mt_reg);
-+}
-+
-+module_init(gradm_mt_init);
-+module_exit(gradm_mt_exit);
-+MODULE_AUTHOR("Zbigniew Krzystolik <zbyniu@destrukcja.pl>");
-+MODULE_DESCRIPTION("Xtables: Grsecurity RBAC match");
-+MODULE_LICENSE("GPL");
-+MODULE_ALIAS("ipt_gradm");
-+MODULE_ALIAS("ip6t_gradm");
-diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
-index fc91ff6..2458eea 100644
---- a/net/netlink/af_netlink.c
-+++ b/net/netlink/af_netlink.c
-@@ -733,7 +733,7 @@ static void netlink_overrun(struct sock *sk)
- sk->sk_error_report(sk);
- }
- }
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- }
-
- static struct sock *netlink_getsockbypid(struct sock *ssk, u32 pid)
-@@ -1303,8 +1303,10 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
- return -EINVAL;
- dst_pid = addr->nl_pid;
- dst_group = ffs(addr->nl_groups);
-- if (dst_group && !netlink_capable(sock, NL_NONROOT_SEND))
-- return -EPERM;
-+ err = -EPERM;
-+ if ((dst_group || dst_pid) &&
-+ !netlink_capable(sock, NL_NONROOT_SEND))
-+ goto out;
- } else {
- dst_pid = nlk->dst_pid;
- dst_group = nlk->dst_group;
-@@ -1966,15 +1968,23 @@ static int netlink_seq_show(struct seq_file *seq, void *v)
- struct netlink_sock *nlk = nlk_sk(s);
-
- seq_printf(seq, "%p %-3d %-6d %08x %-8d %-8d %p %-8d %-8d\n",
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
- s,
-+#endif
- s->sk_protocol,
- nlk->pid,
- nlk->groups ? (u32)nlk->groups[0] : 0,
- sk_rmem_alloc_get(s),
- sk_wmem_alloc_get(s),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
- nlk->cb,
-+#endif
- atomic_read(&s->sk_refcnt),
-- atomic_read(&s->sk_drops)
-+ atomic_read_unchecked(&s->sk_drops)
- );
-
- }
-@@ -2060,6 +2070,27 @@ static void __net_exit netlink_net_exit(struct net *net)
- #endif
- }
-
-+static void __init netlink_add_usersock_entry(void)
-+{
-+ unsigned long *listeners;
-+ int groups = 32;
-+
-+ listeners = kzalloc(NLGRPSZ(groups) + sizeof(struct listeners_rcu_head),
-+ GFP_KERNEL);
-+ if (!listeners)
-+ panic("netlink_add_usersock_entry: Cannot allocate listneres\n");
-+
-+ netlink_table_grab();
-+
-+ nl_table[NETLINK_USERSOCK].groups = groups;
-+ nl_table[NETLINK_USERSOCK].listeners = listeners;
-+ nl_table[NETLINK_USERSOCK].module = THIS_MODULE;
-+ nl_table[NETLINK_USERSOCK].registered = 1;
-+ nl_table[NETLINK_USERSOCK].nl_nonroot = NL_NONROOT_SEND;
-+
-+ netlink_table_ungrab();
-+}
-+
- static struct pernet_operations __net_initdata netlink_net_ops = {
- .init = netlink_net_init,
- .exit = netlink_net_exit,
-@@ -2108,6 +2139,8 @@ static int __init netlink_proto_init(void)
- hash->rehash_time = jiffies;
- }
-
-+ netlink_add_usersock_entry();
-+
- sock_register(&netlink_family_ops);
- register_pernet_subsys(&netlink_net_ops);
- /* The netlink device handler may be needed early. */
-diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
-index 7a83495..ab0062f 100644
---- a/net/netrom/af_netrom.c
-+++ b/net/netrom/af_netrom.c
-@@ -838,6 +838,7 @@ static int nr_getname(struct socket *sock, struct sockaddr *uaddr,
- struct sock *sk = sock->sk;
- struct nr_sock *nr = nr_sk(sk);
-
-+ memset(sax, 0, sizeof(*sax));
- lock_sock(sk);
- if (peer != 0) {
- if (sk->sk_state != TCP_ESTABLISHED) {
-@@ -852,7 +853,6 @@ static int nr_getname(struct socket *sock, struct sockaddr *uaddr,
- *uaddr_len = sizeof(struct full_sockaddr_ax25);
- } else {
- sax->fsa_ax25.sax25_family = AF_NETROM;
-- sax->fsa_ax25.sax25_ndigis = 0;
- sax->fsa_ax25.sax25_call = nr->source_addr;
- *uaddr_len = sizeof(struct sockaddr_ax25);
- }
-diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
-index 728c080..ee6ea78 100644
---- a/net/packet/af_packet.c
-+++ b/net/packet/af_packet.c
-@@ -1525,12 +1525,10 @@ static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr,
- return -EOPNOTSUPP;
-
- uaddr->sa_family = AF_PACKET;
-+ memset(uaddr->sa_data, 0, sizeof(uaddr->sa_data));
- dev = dev_get_by_index(sock_net(sk), pkt_sk(sk)->ifindex);
-- if (dev) {
-- strncpy(uaddr->sa_data, dev->name, 14);
-- dev_put(dev);
-- } else
-- memset(uaddr->sa_data, 0, 14);
-+ if (dev)
-+ strlcpy(uaddr->sa_data, dev->name, sizeof(uaddr->sa_data));
- *uaddr_len = sizeof(*uaddr);
-
- return 0;
-@@ -1723,7 +1721,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
- case PACKET_DROP_MEMBERSHIP:
- {
- struct packet_mreq_max mreq;
-- int len = optlen;
-+ unsigned int len = optlen;
- memset(&mreq, 0, sizeof(mreq));
- if (len < sizeof(struct packet_mreq))
- return -EINVAL;
-@@ -1894,7 +1892,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
- case PACKET_HDRLEN:
- if (len > sizeof(int))
- len = sizeof(int);
-- if (copy_from_user(&val, optval, len))
-+ if (len > sizeof(val) || copy_from_user(&val, optval, len))
- return -EFAULT;
- switch (val) {
- case TPACKET_V1:
-@@ -2428,7 +2426,11 @@ static int packet_seq_show(struct seq_file *seq, void *v)
-
- seq_printf(seq,
- "%p %-6d %-4d %04x %-5d %1d %-6u %-6u %-6lu\n",
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
- s,
-+#endif
- atomic_read(&s->sk_refcnt),
- s->sk_type,
- ntohs(po->num),
-diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
-index 519ff9d..a422a90 100644
---- a/net/phonet/af_phonet.c
-+++ b/net/phonet/af_phonet.c
-@@ -41,7 +41,7 @@ static struct phonet_protocol *phonet_proto_get(int protocol)
- {
- struct phonet_protocol *pp;
-
-- if (protocol >= PHONET_NPROTO)
-+ if (protocol < 0 || protocol >= PHONET_NPROTO)
- return NULL;
-
- spin_lock(&proto_tab_lock);
-@@ -402,7 +402,7 @@ int __init_or_module phonet_proto_register(int protocol,
- {
- int err = 0;
-
-- if (protocol >= PHONET_NPROTO)
-+ if (protocol < 0 || protocol >= PHONET_NPROTO)
- return -EINVAL;
-
- err = proto_register(pp->prot, 1);
-diff --git a/net/phonet/datagram.c b/net/phonet/datagram.c
-index ef5c75c..2b6c2fa 100644
---- a/net/phonet/datagram.c
-+++ b/net/phonet/datagram.c
-@@ -162,7 +162,7 @@ static int pn_backlog_rcv(struct sock *sk, struct sk_buff *skb)
- if (err < 0) {
- kfree_skb(skb);
- if (err == -ENOMEM)
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- }
- return err ? NET_RX_DROP : NET_RX_SUCCESS;
- }
-diff --git a/net/phonet/pep.c b/net/phonet/pep.c
-index 7481d70..6957dbf 100644
---- a/net/phonet/pep.c
-+++ b/net/phonet/pep.c
-@@ -348,7 +348,7 @@ static int pipe_do_rcv(struct sock *sk, struct sk_buff *skb)
-
- case PNS_PEP_CTRL_REQ:
- if (skb_queue_len(&pn->ctrlreq_queue) >= PNPIPE_CTRLREQ_MAX) {
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- break;
- }
- __skb_pull(skb, 4);
-@@ -362,12 +362,12 @@ static int pipe_do_rcv(struct sock *sk, struct sk_buff *skb)
- if (!err)
- return 0;
- if (err == -ENOMEM)
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- break;
- }
-
- if (pn->rx_credits == 0) {
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- err = -ENOBUFS;
- break;
- }
-diff --git a/net/phonet/socket.c b/net/phonet/socket.c
-index aa5b5a9..c09b4f8 100644
---- a/net/phonet/socket.c
-+++ b/net/phonet/socket.c
-@@ -482,8 +482,13 @@ static int pn_sock_seq_show(struct seq_file *seq, void *v)
- sk->sk_state,
- sk_wmem_alloc_get(sk), sk_rmem_alloc_get(sk),
- sock_i_uid(sk), sock_i_ino(sk),
-- atomic_read(&sk->sk_refcnt), sk,
-- atomic_read(&sk->sk_drops), &len);
-+ atomic_read(&sk->sk_refcnt),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
-+ sk,
-+#endif
-+ atomic_read_unchecked(&sk->sk_drops), &len);
- }
- seq_printf(seq, "%*s\n", 127 - len, "");
- return 0;
-diff --git a/net/rds/Kconfig b/net/rds/Kconfig
-index ec753b3..821187c 100644
---- a/net/rds/Kconfig
-+++ b/net/rds/Kconfig
-@@ -1,7 +1,7 @@
-
- config RDS
- tristate "The RDS Protocol (EXPERIMENTAL)"
-- depends on INET && EXPERIMENTAL
-+ depends on INET && EXPERIMENTAL && BROKEN
- ---help---
- The RDS (Reliable Datagram Sockets) protocol provides reliable,
- sequenced delivery of datagrams over Infiniband, iWARP,
-diff --git a/net/rds/cong.c b/net/rds/cong.c
-index dd2711d..1c7ed12 100644
---- a/net/rds/cong.c
-+++ b/net/rds/cong.c
-@@ -77,7 +77,7 @@
- * finds that the saved generation number is smaller than the global generation
- * number, it wakes up the process.
- */
--static atomic_t rds_cong_generation = ATOMIC_INIT(0);
-+static atomic_unchecked_t rds_cong_generation = ATOMIC_INIT(0);
-
- /*
- * Congestion monitoring
-@@ -232,7 +232,7 @@ void rds_cong_map_updated(struct rds_cong_map *map, uint64_t portmask)
- rdsdebug("waking map %p for %pI4\n",
- map, &map->m_addr);
- rds_stats_inc(s_cong_update_received);
-- atomic_inc(&rds_cong_generation);
-+ atomic_inc_unchecked(&rds_cong_generation);
- if (waitqueue_active(&map->m_waitq))
- wake_up(&map->m_waitq);
- if (waitqueue_active(&rds_poll_waitq))
-@@ -258,7 +258,7 @@ EXPORT_SYMBOL_GPL(rds_cong_map_updated);
-
- int rds_cong_updated_since(unsigned long *recent)
- {
-- unsigned long gen = atomic_read(&rds_cong_generation);
-+ unsigned long gen = atomic_read_unchecked(&rds_cong_generation);
-
- if (likely(*recent == gen))
- return 0;
-diff --git a/net/rds/iw_rdma.c b/net/rds/iw_rdma.c
-index de4a1b1..94ec861 100644
---- a/net/rds/iw_rdma.c
-+++ b/net/rds/iw_rdma.c
-@@ -181,6 +181,8 @@ int rds_iw_update_cm_id(struct rds_iw_device *rds_iwdev, struct rdma_cm_id *cm_i
- struct rdma_cm_id *pcm_id;
- int rc;
-
-+ pax_track_stack();
-+
- src_addr = (struct sockaddr_in *)&cm_id->route.addr.src_addr;
- dst_addr = (struct sockaddr_in *)&cm_id->route.addr.dst_addr;
-
-diff --git a/net/rds/tcp.c b/net/rds/tcp.c
-index b5198ae..8b9fb90 100644
---- a/net/rds/tcp.c
-+++ b/net/rds/tcp.c
-@@ -57,7 +57,7 @@ void rds_tcp_nonagle(struct socket *sock)
- int val = 1;
-
- set_fs(KERNEL_DS);
-- sock->ops->setsockopt(sock, SOL_TCP, TCP_NODELAY, (char __user *)&val,
-+ sock->ops->setsockopt(sock, SOL_TCP, TCP_NODELAY, (char __force_user *)&val,
- sizeof(val));
- set_fs(oldfs);
- }
-diff --git a/net/rds/tcp_send.c b/net/rds/tcp_send.c
-index ab545e0..4079b3b 100644
---- a/net/rds/tcp_send.c
-+++ b/net/rds/tcp_send.c
-@@ -43,7 +43,7 @@ static void rds_tcp_cork(struct socket *sock, int val)
-
- oldfs = get_fs();
- set_fs(KERNEL_DS);
-- sock->ops->setsockopt(sock, SOL_TCP, TCP_CORK, (char __user *)&val,
-+ sock->ops->setsockopt(sock, SOL_TCP, TCP_CORK, (char __force_user *)&val,
- sizeof(val));
- set_fs(oldfs);
- }
-diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
-index a86afce..8657bce 100644
---- a/net/rxrpc/af_rxrpc.c
-+++ b/net/rxrpc/af_rxrpc.c
-@@ -38,7 +38,7 @@ static const struct proto_ops rxrpc_rpc_ops;
- __be32 rxrpc_epoch;
-
- /* current debugging ID */
--atomic_t rxrpc_debug_id;
-+atomic_unchecked_t rxrpc_debug_id;
-
- /* count of skbs currently in use */
- atomic_t rxrpc_n_skbs;
-diff --git a/net/rxrpc/ar-ack.c b/net/rxrpc/ar-ack.c
-index b4a2209..539106c 100644
---- a/net/rxrpc/ar-ack.c
-+++ b/net/rxrpc/ar-ack.c
-@@ -174,7 +174,7 @@ static void rxrpc_resend(struct rxrpc_call *call)
-
- _enter("{%d,%d,%d,%d},",
- call->acks_hard, call->acks_unacked,
-- atomic_read(&call->sequence),
-+ atomic_read_unchecked(&call->sequence),
- CIRC_CNT(call->acks_head, call->acks_tail, call->acks_winsz));
-
- stop = 0;
-@@ -198,7 +198,7 @@ static void rxrpc_resend(struct rxrpc_call *call)
-
- /* each Tx packet has a new serial number */
- sp->hdr.serial =
-- htonl(atomic_inc_return(&call->conn->serial));
-+ htonl(atomic_inc_return_unchecked(&call->conn->serial));
-
- hdr = (struct rxrpc_header *) txb->head;
- hdr->serial = sp->hdr.serial;
-@@ -401,7 +401,7 @@ static void rxrpc_rotate_tx_window(struct rxrpc_call *call, u32 hard)
- */
- static void rxrpc_clear_tx_window(struct rxrpc_call *call)
- {
-- rxrpc_rotate_tx_window(call, atomic_read(&call->sequence));
-+ rxrpc_rotate_tx_window(call, atomic_read_unchecked(&call->sequence));
- }
-
- /*
-@@ -627,7 +627,7 @@ process_further:
-
- latest = ntohl(sp->hdr.serial);
- hard = ntohl(ack.firstPacket);
-- tx = atomic_read(&call->sequence);
-+ tx = atomic_read_unchecked(&call->sequence);
-
- _proto("Rx ACK %%%u { m=%hu f=#%u p=#%u s=%%%u r=%s n=%u }",
- latest,
-@@ -840,6 +840,8 @@ void rxrpc_process_call(struct work_struct *work)
- u32 abort_code = RX_PROTOCOL_ERROR;
- u8 *acks = NULL;
-
-+ pax_track_stack();
-+
- //printk("\n--------------------\n");
- _enter("{%d,%s,%lx} [%lu]",
- call->debug_id, rxrpc_call_states[call->state], call->events,
-@@ -1159,7 +1161,7 @@ void rxrpc_process_call(struct work_struct *work)
- goto maybe_reschedule;
-
- send_ACK_with_skew:
-- ack.maxSkew = htons(atomic_read(&call->conn->hi_serial) -
-+ ack.maxSkew = htons(atomic_read_unchecked(&call->conn->hi_serial) -
- ntohl(ack.serial));
- send_ACK:
- mtu = call->conn->trans->peer->if_mtu;
-@@ -1171,7 +1173,7 @@ send_ACK:
- ackinfo.rxMTU = htonl(5692);
- ackinfo.jumbo_max = htonl(4);
-
-- hdr.serial = htonl(atomic_inc_return(&call->conn->serial));
-+ hdr.serial = htonl(atomic_inc_return_unchecked(&call->conn->serial));
- _proto("Tx ACK %%%u { m=%hu f=#%u p=#%u s=%%%u r=%s n=%u }",
- ntohl(hdr.serial),
- ntohs(ack.maxSkew),
-@@ -1189,7 +1191,7 @@ send_ACK:
- send_message:
- _debug("send message");
-
-- hdr.serial = htonl(atomic_inc_return(&call->conn->serial));
-+ hdr.serial = htonl(atomic_inc_return_unchecked(&call->conn->serial));
- _proto("Tx %s %%%u", rxrpc_pkts[hdr.type], ntohl(hdr.serial));
- send_message_2:
-
-diff --git a/net/rxrpc/ar-call.c b/net/rxrpc/ar-call.c
-index bc0019f..e1b4b24 100644
---- a/net/rxrpc/ar-call.c
-+++ b/net/rxrpc/ar-call.c
-@@ -82,7 +82,7 @@ static struct rxrpc_call *rxrpc_alloc_call(gfp_t gfp)
- spin_lock_init(&call->lock);
- rwlock_init(&call->state_lock);
- atomic_set(&call->usage, 1);
-- call->debug_id = atomic_inc_return(&rxrpc_debug_id);
-+ call->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
- call->state = RXRPC_CALL_CLIENT_SEND_REQUEST;
-
- memset(&call->sock_node, 0xed, sizeof(call->sock_node));
-diff --git a/net/rxrpc/ar-connection.c b/net/rxrpc/ar-connection.c
-index 9f1ce84..ff8d061 100644
---- a/net/rxrpc/ar-connection.c
-+++ b/net/rxrpc/ar-connection.c
-@@ -205,7 +205,7 @@ static struct rxrpc_connection *rxrpc_alloc_connection(gfp_t gfp)
- rwlock_init(&conn->lock);
- spin_lock_init(&conn->state_lock);
- atomic_set(&conn->usage, 1);
-- conn->debug_id = atomic_inc_return(&rxrpc_debug_id);
-+ conn->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
- conn->avail_calls = RXRPC_MAXCALLS;
- conn->size_align = 4;
- conn->header_size = sizeof(struct rxrpc_header);
-diff --git a/net/rxrpc/ar-connevent.c b/net/rxrpc/ar-connevent.c
-index 0505cdc..f0748ce 100644
---- a/net/rxrpc/ar-connevent.c
-+++ b/net/rxrpc/ar-connevent.c
-@@ -109,7 +109,7 @@ static int rxrpc_abort_connection(struct rxrpc_connection *conn,
-
- len = iov[0].iov_len + iov[1].iov_len;
-
-- hdr.serial = htonl(atomic_inc_return(&conn->serial));
-+ hdr.serial = htonl(atomic_inc_return_unchecked(&conn->serial));
- _proto("Tx CONN ABORT %%%u { %d }", ntohl(hdr.serial), abort_code);
-
- ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 2, len);
-diff --git a/net/rxrpc/ar-input.c b/net/rxrpc/ar-input.c
-index f98c802..9e8488e 100644
---- a/net/rxrpc/ar-input.c
-+++ b/net/rxrpc/ar-input.c
-@@ -339,9 +339,9 @@ void rxrpc_fast_process_packet(struct rxrpc_call *call, struct sk_buff *skb)
- /* track the latest serial number on this connection for ACK packet
- * information */
- serial = ntohl(sp->hdr.serial);
-- hi_serial = atomic_read(&call->conn->hi_serial);
-+ hi_serial = atomic_read_unchecked(&call->conn->hi_serial);
- while (serial > hi_serial)
-- hi_serial = atomic_cmpxchg(&call->conn->hi_serial, hi_serial,
-+ hi_serial = atomic_cmpxchg_unchecked(&call->conn->hi_serial, hi_serial,
- serial);
-
- /* request ACK generation for any ACK or DATA packet that requests
-diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
-index 7043b29..06edcdf 100644
---- a/net/rxrpc/ar-internal.h
-+++ b/net/rxrpc/ar-internal.h
-@@ -272,8 +272,8 @@ struct rxrpc_connection {
- int error; /* error code for local abort */
- int debug_id; /* debug ID for printks */
- unsigned call_counter; /* call ID counter */
-- atomic_t serial; /* packet serial number counter */
-- atomic_t hi_serial; /* highest serial number received */
-+ atomic_unchecked_t serial; /* packet serial number counter */
-+ atomic_unchecked_t hi_serial; /* highest serial number received */
- u8 avail_calls; /* number of calls available */
- u8 size_align; /* data size alignment (for security) */
- u8 header_size; /* rxrpc + security header size */
-@@ -346,7 +346,7 @@ struct rxrpc_call {
- spinlock_t lock;
- rwlock_t state_lock; /* lock for state transition */
- atomic_t usage;
-- atomic_t sequence; /* Tx data packet sequence counter */
-+ atomic_unchecked_t sequence; /* Tx data packet sequence counter */
- u32 abort_code; /* local/remote abort code */
- enum { /* current state of call */
- RXRPC_CALL_CLIENT_SEND_REQUEST, /* - client sending request phase */
-@@ -420,7 +420,7 @@ static inline void rxrpc_abort_call(struct rxrpc_call *call, u32 abort_code)
- */
- extern atomic_t rxrpc_n_skbs;
- extern __be32 rxrpc_epoch;
--extern atomic_t rxrpc_debug_id;
-+extern atomic_unchecked_t rxrpc_debug_id;
- extern struct workqueue_struct *rxrpc_workqueue;
-
- /*
-diff --git a/net/rxrpc/ar-key.c b/net/rxrpc/ar-key.c
-index 74697b2..5006c23 100644
---- a/net/rxrpc/ar-key.c
-+++ b/net/rxrpc/ar-key.c
-@@ -88,11 +88,11 @@ static int rxrpc_instantiate_xdr_rxkad(struct key *key, const __be32 *xdr,
- return ret;
-
- plen -= sizeof(*token);
-- token = kmalloc(sizeof(*token), GFP_KERNEL);
-+ token = kzalloc(sizeof(*token), GFP_KERNEL);
- if (!token)
- return -ENOMEM;
-
-- token->kad = kmalloc(plen, GFP_KERNEL);
-+ token->kad = kzalloc(plen, GFP_KERNEL);
- if (!token->kad) {
- kfree(token);
- return -ENOMEM;
-@@ -212,7 +212,7 @@ static int rxrpc_krb5_decode_principal(struct krb5_principal *princ,
- if (toklen <= (n_parts + 1) * 4)
- return -EINVAL;
-
-- princ->name_parts = kcalloc(sizeof(char *), n_parts, GFP_KERNEL);
-+ princ->name_parts = kcalloc(n_parts, sizeof(char *), GFP_KERNEL);
- if (!princ->name_parts)
- return -ENOMEM;
-
-@@ -336,7 +336,7 @@ static int rxrpc_krb5_decode_tagged_array(struct krb5_tagged_data **_td,
-
- _debug("n_elem %d", n_elem);
-
-- td = kcalloc(sizeof(struct krb5_tagged_data), n_elem,
-+ td = kcalloc(n_elem, sizeof(struct krb5_tagged_data),
- GFP_KERNEL);
- if (!td)
- return -ENOMEM;
-@@ -730,10 +730,10 @@ static int rxrpc_instantiate(struct key *key, const void *data, size_t datalen)
- goto error;
-
- ret = -ENOMEM;
-- token = kmalloc(sizeof(*token), GFP_KERNEL);
-+ token = kzalloc(sizeof(*token), GFP_KERNEL);
- if (!token)
- goto error;
-- token->kad = kmalloc(plen, GFP_KERNEL);
-+ token->kad = kzalloc(plen, GFP_KERNEL);
- if (!token->kad)
- goto error_free;
-
-diff --git a/net/rxrpc/ar-local.c b/net/rxrpc/ar-local.c
-index 807535f..5b7f19e 100644
---- a/net/rxrpc/ar-local.c
-+++ b/net/rxrpc/ar-local.c
-@@ -44,7 +44,7 @@ struct rxrpc_local *rxrpc_alloc_local(struct sockaddr_rxrpc *srx)
- spin_lock_init(&local->lock);
- rwlock_init(&local->services_lock);
- atomic_set(&local->usage, 1);
-- local->debug_id = atomic_inc_return(&rxrpc_debug_id);
-+ local->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
- memcpy(&local->srx, srx, sizeof(*srx));
- }
-
-diff --git a/net/rxrpc/ar-output.c b/net/rxrpc/ar-output.c
-index cc9102c..7d3888e 100644
---- a/net/rxrpc/ar-output.c
-+++ b/net/rxrpc/ar-output.c
-@@ -680,9 +680,9 @@ static int rxrpc_send_data(struct kiocb *iocb,
- sp->hdr.cid = call->cid;
- sp->hdr.callNumber = call->call_id;
- sp->hdr.seq =
-- htonl(atomic_inc_return(&call->sequence));
-+ htonl(atomic_inc_return_unchecked(&call->sequence));
- sp->hdr.serial =
-- htonl(atomic_inc_return(&conn->serial));
-+ htonl(atomic_inc_return_unchecked(&conn->serial));
- sp->hdr.type = RXRPC_PACKET_TYPE_DATA;
- sp->hdr.userStatus = 0;
- sp->hdr.securityIndex = conn->security_ix;
-diff --git a/net/rxrpc/ar-peer.c b/net/rxrpc/ar-peer.c
-index edc026c..4bd4e2d 100644
---- a/net/rxrpc/ar-peer.c
-+++ b/net/rxrpc/ar-peer.c
-@@ -86,7 +86,7 @@ static struct rxrpc_peer *rxrpc_alloc_peer(struct sockaddr_rxrpc *srx,
- INIT_LIST_HEAD(&peer->error_targets);
- spin_lock_init(&peer->lock);
- atomic_set(&peer->usage, 1);
-- peer->debug_id = atomic_inc_return(&rxrpc_debug_id);
-+ peer->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
- memcpy(&peer->srx, srx, sizeof(*srx));
-
- rxrpc_assess_MTU_size(peer);
-diff --git a/net/rxrpc/ar-proc.c b/net/rxrpc/ar-proc.c
-index 38047f7..9f48511 100644
---- a/net/rxrpc/ar-proc.c
-+++ b/net/rxrpc/ar-proc.c
-@@ -164,8 +164,8 @@ static int rxrpc_connection_seq_show(struct seq_file *seq, void *v)
- atomic_read(&conn->usage),
- rxrpc_conn_states[conn->state],
- key_serial(conn->key),
-- atomic_read(&conn->serial),
-- atomic_read(&conn->hi_serial));
-+ atomic_read_unchecked(&conn->serial),
-+ atomic_read_unchecked(&conn->hi_serial));
-
- return 0;
- }
-diff --git a/net/rxrpc/ar-transport.c b/net/rxrpc/ar-transport.c
-index 0936e1a..437c640 100644
---- a/net/rxrpc/ar-transport.c
-+++ b/net/rxrpc/ar-transport.c
-@@ -46,7 +46,7 @@ static struct rxrpc_transport *rxrpc_alloc_transport(struct rxrpc_local *local,
- spin_lock_init(&trans->client_lock);
- rwlock_init(&trans->conn_lock);
- atomic_set(&trans->usage, 1);
-- trans->debug_id = atomic_inc_return(&rxrpc_debug_id);
-+ trans->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
-
- if (peer->srx.transport.family == AF_INET) {
- switch (peer->srx.transport_type) {
-diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c
-index 713ac59..306f6ae 100644
---- a/net/rxrpc/rxkad.c
-+++ b/net/rxrpc/rxkad.c
-@@ -210,6 +210,8 @@ static int rxkad_secure_packet_encrypt(const struct rxrpc_call *call,
- u16 check;
- int nsg;
-
-+ pax_track_stack();
-+
- sp = rxrpc_skb(skb);
-
- _enter("");
-@@ -337,6 +339,8 @@ static int rxkad_verify_packet_auth(const struct rxrpc_call *call,
- u16 check;
- int nsg;
-
-+ pax_track_stack();
-+
- _enter("");
-
- sp = rxrpc_skb(skb);
-@@ -609,7 +613,7 @@ static int rxkad_issue_challenge(struct rxrpc_connection *conn)
-
- len = iov[0].iov_len + iov[1].iov_len;
-
-- hdr.serial = htonl(atomic_inc_return(&conn->serial));
-+ hdr.serial = htonl(atomic_inc_return_unchecked(&conn->serial));
- _proto("Tx CHALLENGE %%%u", ntohl(hdr.serial));
-
- ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 2, len);
-@@ -659,7 +663,7 @@ static int rxkad_send_response(struct rxrpc_connection *conn,
-
- len = iov[0].iov_len + iov[1].iov_len + iov[2].iov_len;
-
-- hdr->serial = htonl(atomic_inc_return(&conn->serial));
-+ hdr->serial = htonl(atomic_inc_return_unchecked(&conn->serial));
- _proto("Tx RESPONSE %%%u", ntohl(hdr->serial));
-
- ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 3, len);
-diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
-index ab82f14..b022c59 100644
---- a/net/sched/sch_atm.c
-+++ b/net/sched/sch_atm.c
-@@ -628,6 +628,7 @@ static int atm_tc_dump_class(struct Qdisc *sch, unsigned long cl,
- struct sockaddr_atmpvc pvc;
- int state;
-
-+ memset(&pvc, 0, sizeof(pvc));
- pvc.sap_family = AF_ATMPVC;
- pvc.sap_addr.itf = flow->vcc->dev ? flow->vcc->dev->number : -1;
- pvc.sap_addr.vpi = flow->vcc->vpi;
-diff --git a/net/sctp/auth.c b/net/sctp/auth.c
-index 7363b9f..1b055b5 100644
---- a/net/sctp/auth.c
-+++ b/net/sctp/auth.c
-@@ -81,7 +81,7 @@ static struct sctp_auth_bytes *sctp_auth_create_key(__u32 key_len, gfp_t gfp)
- struct sctp_auth_bytes *key;
-
- /* Verify that we are not going to overflow INT_MAX */
-- if ((INT_MAX - key_len) < sizeof(struct sctp_auth_bytes))
-+ if (key_len > (INT_MAX - sizeof(struct sctp_auth_bytes)))
- return NULL;
-
- /* Allocate the shared key */
-diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
-index bb280e6..747720f 100644
---- a/net/sctp/ipv6.c
-+++ b/net/sctp/ipv6.c
-@@ -1013,7 +1013,7 @@ void sctp_v6_pf_init(void)
-
- void sctp_v6_pf_exit(void)
- {
-- list_del(&sctp_af_inet6.list);
-+ pax_list_del((struct list_head *)&sctp_af_inet6.list);
- }
-
- /* Initialize IPv6 support and register with socket layer. */
-diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
-index 23e5e97..bc423b4 100644
---- a/net/sctp/outqueue.c
-+++ b/net/sctp/outqueue.c
-@@ -203,6 +203,8 @@ static inline int sctp_cacc_skip(struct sctp_transport *primary,
- */
- void sctp_outq_init(struct sctp_association *asoc, struct sctp_outq *q)
- {
-+ memset(q, 0, sizeof(struct sctp_outq));
-+
- q->asoc = asoc;
- INIT_LIST_HEAD(&q->out_chunk_list);
- INIT_LIST_HEAD(&q->control_chunk_list);
-@@ -210,13 +212,7 @@ void sctp_outq_init(struct sctp_association *asoc, struct sctp_outq *q)
- INIT_LIST_HEAD(&q->sacked);
- INIT_LIST_HEAD(&q->abandoned);
-
-- q->fast_rtx = 0;
-- q->outstanding_bytes = 0;
- q->empty = 1;
-- q->cork = 0;
--
-- q->malloced = 0;
-- q->out_qlen = 0;
- }
-
- /* Free the outqueue structure and any related pending chunks.
-diff --git a/net/sctp/proc.c b/net/sctp/proc.c
-index d093cbf..9fc36fc 100644
---- a/net/sctp/proc.c
-+++ b/net/sctp/proc.c
-@@ -213,7 +213,12 @@ static int sctp_eps_seq_show(struct seq_file *seq, void *v)
- sctp_for_each_hentry(epb, node, &head->chain) {
- ep = sctp_ep(epb);
- sk = epb->sk;
-- seq_printf(seq, "%8p %8p %-3d %-3d %-4d %-5d %5d %5lu ", ep, sk,
-+ seq_printf(seq, "%8p %8p %-3d %-3d %-4d %-5d %5d %5lu ",
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL, NULL,
-+#else
-+ ep, sk,
-+#endif
- sctp_sk(sk)->type, sk->sk_state, hash,
- epb->bind_addr.port,
- sock_i_uid(sk), sock_i_ino(sk));
-@@ -320,7 +325,12 @@ static int sctp_assocs_seq_show(struct seq_file *seq, void *v)
- seq_printf(seq,
- "%8p %8p %-3d %-3d %-2d %-4d "
- "%4d %8d %8d %7d %5lu %-5d %5d ",
-- assoc, sk, sctp_sk(sk)->type, sk->sk_state,
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL, NULL,
-+#else
-+ assoc, sk,
-+#endif
-+ sctp_sk(sk)->type, sk->sk_state,
- assoc->state, hash,
- assoc->assoc_id,
- assoc->sndbuf_used,
-diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
-index 619f965..bed845a 100644
---- a/net/sctp/protocol.c
-+++ b/net/sctp/protocol.c
-@@ -727,8 +727,10 @@ int sctp_register_af(struct sctp_af *af)
- return 0;
- }
-
-- INIT_LIST_HEAD(&af->list);
-- list_add_tail(&af->list, &sctp_address_families);
-+ pax_open_kernel();
-+ INIT_LIST_HEAD((struct list_head *)&af->list);
-+ pax_close_kernel();
-+ pax_list_add_tail((struct list_head *)&af->list, &sctp_address_families);
- return 1;
- }
-
-@@ -1015,7 +1017,7 @@ static void sctp_v4_pf_init(void)
-
- static void sctp_v4_pf_exit(void)
- {
-- list_del(&sctp_af_inet.list);
-+ pax_list_del((struct list_head *)&sctp_af_inet.list);
- }
-
- static int sctp_v4_protosw_init(void)
-diff --git a/net/sctp/socket.c b/net/sctp/socket.c
-index 26ffae2..5e9fd60 100644
---- a/net/sctp/socket.c
-+++ b/net/sctp/socket.c
-@@ -5810,7 +5810,6 @@ pp_found:
- */
- int reuse = sk->sk_reuse;
- struct sock *sk2;
-- struct hlist_node *node;
-
- SCTP_DEBUG_PRINTK("sctp_get_port() found a possible match\n");
- if (pp->fastreuse && sk->sk_reuse &&
-diff --git a/net/sctp/ssnmap.c b/net/sctp/ssnmap.c
-index 737d330..2e7f089 100644
---- a/net/sctp/ssnmap.c
-+++ b/net/sctp/ssnmap.c
-@@ -40,8 +40,6 @@
- #include <net/sctp/sctp.h>
- #include <net/sctp/sm.h>
-
--#define MAX_KMALLOC_SIZE 131072
--
- static struct sctp_ssnmap *sctp_ssnmap_init(struct sctp_ssnmap *map, __u16 in,
- __u16 out);
-
-@@ -64,7 +62,7 @@ struct sctp_ssnmap *sctp_ssnmap_new(__u16 in, __u16 out,
- int size;
-
- size = sctp_ssnmap_size(in, out);
-- if (size <= MAX_KMALLOC_SIZE)
-+ if (size <= KMALLOC_MAX_SIZE)
- retval = kmalloc(size, gfp);
- else
- retval = (struct sctp_ssnmap *)
-@@ -81,7 +79,7 @@ struct sctp_ssnmap *sctp_ssnmap_new(__u16 in, __u16 out,
- return retval;
-
- fail_map:
-- if (size <= MAX_KMALLOC_SIZE)
-+ if (size <= KMALLOC_MAX_SIZE)
- kfree(retval);
- else
- free_pages((unsigned long)retval, get_order(size));
-@@ -123,7 +121,7 @@ void sctp_ssnmap_free(struct sctp_ssnmap *map)
- int size;
-
- size = sctp_ssnmap_size(map->in.len, map->out.len);
-- if (size <= MAX_KMALLOC_SIZE)
-+ if (size <= KMALLOC_MAX_SIZE)
- kfree(map);
- else
- free_pages((unsigned long)map, get_order(size));
-diff --git a/net/sctp/transport.c b/net/sctp/transport.c
-index e04c9f8..51bc18e 100644
---- a/net/sctp/transport.c
-+++ b/net/sctp/transport.c
-@@ -355,7 +355,7 @@ void sctp_transport_update_rto(struct sctp_transport *tp, __u32 rtt)
- * 1/8, rto_alpha would be expressed as 3.
- */
- tp->rttvar = tp->rttvar - (tp->rttvar >> sctp_rto_beta)
-- + ((abs(tp->srtt - rtt)) >> sctp_rto_beta);
-+ + (((__u32)abs64((__s64)tp->srtt - (__s64)rtt)) >> sctp_rto_beta);
- tp->srtt = tp->srtt - (tp->srtt >> sctp_rto_alpha)
- + (rtt >> sctp_rto_alpha);
- } else {
-diff --git a/net/socket.c b/net/socket.c
-index bf9fc68..27b436e 100644
---- a/net/socket.c
-+++ b/net/socket.c
-@@ -87,6 +87,7 @@
- #include <linux/wireless.h>
- #include <linux/nsproxy.h>
- #include <linux/magic.h>
-+#include <linux/in.h>
-
- #include <asm/uaccess.h>
- #include <asm/unistd.h>
-@@ -97,6 +98,21 @@
- #include <net/sock.h>
- #include <linux/netfilter.h>
-
-+extern void gr_attach_curr_ip(const struct sock *sk);
-+extern int gr_handle_sock_all(const int family, const int type,
-+ const int protocol);
-+extern int gr_handle_sock_server(const struct sockaddr *sck);
-+extern int gr_handle_sock_server_other(const struct sock *sck);
-+extern int gr_handle_sock_client(const struct sockaddr *sck);
-+extern int gr_search_connect(struct socket * sock,
-+ struct sockaddr_in * addr);
-+extern int gr_search_bind(struct socket * sock,
-+ struct sockaddr_in * addr);
-+extern int gr_search_listen(struct socket * sock);
-+extern int gr_search_accept(struct socket * sock);
-+extern int gr_search_socket(const int domain, const int type,
-+ const int protocol);
-+
- static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
- static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
- unsigned long nr_segs, loff_t pos);
-@@ -148,7 +164,7 @@ static const struct file_operations socket_file_ops = {
- */
-
- static DEFINE_SPINLOCK(net_family_lock);
--static const struct net_proto_family *net_families[NPROTO] __read_mostly;
-+const struct net_proto_family *net_families[NPROTO] __read_mostly;
-
- /*
- * Statistics counters of the socket lists
-@@ -298,7 +314,7 @@ static int sockfs_get_sb(struct file_system_type *fs_type,
- mnt);
- }
-
--static struct vfsmount *sock_mnt __read_mostly;
-+struct vfsmount *sock_mnt __read_mostly;
-
- static struct file_system_type sock_fs_type = {
- .name = "sockfs",
-@@ -1154,6 +1170,8 @@ static int __sock_create(struct net *net, int family, int type, int protocol,
- return -EAFNOSUPPORT;
- if (type < 0 || type >= SOCK_MAX)
- return -EINVAL;
-+ if (protocol < 0)
-+ return -EINVAL;
-
- /* Compatibility.
-
-@@ -1174,6 +1192,20 @@ static int __sock_create(struct net *net, int family, int type, int protocol,
- if (err)
- return err;
-
-+ if(!kern && !gr_search_socket(family, type, protocol)) {
-+ if (net_families[family] == NULL)
-+ return -EAFNOSUPPORT;
-+ else
-+ return -EACCES;
-+ }
-+
-+ if (!kern && gr_handle_sock_all(family, type, protocol)) {
-+ if (net_families[family] == NULL)
-+ return -EAFNOSUPPORT;
-+ else
-+ return -EACCES;
-+ }
-+
- /*
- * Allocate the socket and allow the family to set things up. if
- * the protocol is 0, the family is instructed to select an appropriate
-@@ -1415,6 +1447,14 @@ SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
- if (sock) {
- err = move_addr_to_kernel(umyaddr, addrlen, (struct sockaddr *)&address);
- if (err >= 0) {
-+ if (gr_handle_sock_server((struct sockaddr *)&address)) {
-+ err = -EACCES;
-+ goto error;
-+ }
-+ err = gr_search_bind(sock, (struct sockaddr_in *)&address);
-+ if (err)
-+ goto error;
-+
- err = security_socket_bind(sock,
- (struct sockaddr *)&address,
- addrlen);
-@@ -1423,6 +1463,7 @@ SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
- (struct sockaddr *)
- &address, addrlen);
- }
-+error:
- fput_light(sock->file, fput_needed);
- }
- return err;
-@@ -1446,10 +1487,20 @@ SYSCALL_DEFINE2(listen, int, fd, int, backlog)
- if ((unsigned)backlog > somaxconn)
- backlog = somaxconn;
-
-+ if (gr_handle_sock_server_other(sock->sk)) {
-+ err = -EPERM;
-+ goto error;
-+ }
-+
-+ err = gr_search_listen(sock);
-+ if (err)
-+ goto error;
-+
- err = security_socket_listen(sock, backlog);
- if (!err)
- err = sock->ops->listen(sock, backlog);
-
-+error:
- fput_light(sock->file, fput_needed);
- }
- return err;
-@@ -1492,6 +1543,18 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
- newsock->type = sock->type;
- newsock->ops = sock->ops;
-
-+ if (gr_handle_sock_server_other(sock->sk)) {
-+ err = -EPERM;
-+ sock_release(newsock);
-+ goto out_put;
-+ }
-+
-+ err = gr_search_accept(sock);
-+ if (err) {
-+ sock_release(newsock);
-+ goto out_put;
-+ }
-+
- /*
- * We don't need try_module_get here, as the listening socket (sock)
- * has the protocol module (sock->ops->owner) held.
-@@ -1534,6 +1597,8 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
- fd_install(newfd, newfile);
- err = newfd;
-
-+ gr_attach_curr_ip(newsock->sk);
-+
- out_put:
- fput_light(sock->file, fput_needed);
- out:
-@@ -1571,6 +1636,7 @@ SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
- int, addrlen)
- {
- struct socket *sock;
-+ struct sockaddr *sck;
- struct sockaddr_storage address;
- int err, fput_needed;
-
-@@ -1581,6 +1647,17 @@ SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
- if (err < 0)
- goto out_put;
-
-+ sck = (struct sockaddr *)&address;
-+
-+ if (gr_handle_sock_client(sck)) {
-+ err = -EACCES;
-+ goto out_put;
-+ }
-+
-+ err = gr_search_connect(sock, (struct sockaddr_in *)sck);
-+ if (err)
-+ goto out_put;
-+
- err =
- security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
- if (err)
-@@ -1728,7 +1805,7 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
- struct socket *sock;
- struct iovec iov;
- struct msghdr msg;
-- struct sockaddr_storage address;
-+ struct sockaddr_storage address = { };
- int err, err2;
- int fput_needed;
-
-@@ -1882,6 +1959,8 @@ SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned, flags)
- int err, ctl_len, iov_size, total_len;
- int fput_needed;
-
-+ pax_track_stack();
-+
- err = -EFAULT;
- if (MSG_CMSG_COMPAT & flags) {
- if (get_compat_msghdr(&msg_sys, msg_compat))
-@@ -1987,7 +2066,7 @@ SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
- int fput_needed;
-
- /* kernel mode address */
-- struct sockaddr_storage addr;
-+ struct sockaddr_storage addr = { };
-
- /* user mode address pointers */
- struct sockaddr __user *uaddr;
-@@ -2022,7 +2101,7 @@ SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
- * kernel msghdr to use the kernel address space)
- */
-
-- uaddr = (__force void __user *)msg_sys.msg_name;
-+ uaddr = (void __force_user *)msg_sys.msg_name;
- uaddr_len = COMPAT_NAMELEN(msg);
- if (MSG_CMSG_COMPAT & flags) {
- err = verify_compat_iovec(&msg_sys, iov,
-diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
-index b0c5646..f7b3ca7 100644
---- a/net/sunrpc/clnt.c
-+++ b/net/sunrpc/clnt.c
-@@ -166,10 +166,8 @@ static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args, stru
- err = rpciod_up();
- if (err)
- goto out_no_rpciod;
-- err = -EINVAL;
-- if (!xprt)
-- goto out_no_xprt;
-
-+ err = -EINVAL;
- if (args->version >= program->nrvers)
- goto out_err;
- version = program->version[args->version];
-@@ -262,10 +260,9 @@ out_no_stats:
- kfree(clnt->cl_server);
- kfree(clnt);
- out_err:
-- xprt_put(xprt);
--out_no_xprt:
- rpciod_down();
- out_no_rpciod:
-+ xprt_put(xprt);
- return ERR_PTR(err);
- }
-
-diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
-index 9b3941d..d80b670 100644
---- a/net/sunrpc/sched.c
-+++ b/net/sunrpc/sched.c
-@@ -234,10 +234,10 @@ static int rpc_wait_bit_killable(void *word)
- #ifdef RPC_DEBUG
- static void rpc_task_set_debuginfo(struct rpc_task *task)
- {
-- static atomic_t rpc_pid;
-+ static atomic_unchecked_t rpc_pid;
-
- task->tk_magic = RPC_TASK_MAGIC_ID;
-- task->tk_pid = atomic_inc_return(&rpc_pid);
-+ task->tk_pid = atomic_inc_return_unchecked(&rpc_pid);
- }
- #else
- static inline void rpc_task_set_debuginfo(struct rpc_task *task)
-diff --git a/net/sunrpc/xprtrdma/svc_rdma.c b/net/sunrpc/xprtrdma/svc_rdma.c
-index 35fb68b..236a8bf 100644
---- a/net/sunrpc/xprtrdma/svc_rdma.c
-+++ b/net/sunrpc/xprtrdma/svc_rdma.c
-@@ -59,15 +59,15 @@ unsigned int svcrdma_max_req_size = RPCRDMA_MAX_REQ_SIZE;
- static unsigned int min_max_inline = 4096;
- static unsigned int max_max_inline = 65536;
-
--atomic_t rdma_stat_recv;
--atomic_t rdma_stat_read;
--atomic_t rdma_stat_write;
--atomic_t rdma_stat_sq_starve;
--atomic_t rdma_stat_rq_starve;
--atomic_t rdma_stat_rq_poll;
--atomic_t rdma_stat_rq_prod;
--atomic_t rdma_stat_sq_poll;
--atomic_t rdma_stat_sq_prod;
-+atomic_unchecked_t rdma_stat_recv;
-+atomic_unchecked_t rdma_stat_read;
-+atomic_unchecked_t rdma_stat_write;
-+atomic_unchecked_t rdma_stat_sq_starve;
-+atomic_unchecked_t rdma_stat_rq_starve;
-+atomic_unchecked_t rdma_stat_rq_poll;
-+atomic_unchecked_t rdma_stat_rq_prod;
-+atomic_unchecked_t rdma_stat_sq_poll;
-+atomic_unchecked_t rdma_stat_sq_prod;
-
- /* Temporary NFS request map and context caches */
- struct kmem_cache *svc_rdma_map_cachep;
-@@ -105,7 +105,7 @@ static int read_reset_stat(ctl_table *table, int write,
- len -= *ppos;
- if (len > *lenp)
- len = *lenp;
-- if (len && copy_to_user(buffer, str_buf, len))
-+ if (len > sizeof str_buf || (len && copy_to_user(buffer, str_buf, len)))
- return -EFAULT;
- *lenp = len;
- *ppos += len;
-@@ -149,63 +149,63 @@ static ctl_table svcrdma_parm_table[] = {
- {
- .procname = "rdma_stat_read",
- .data = &rdma_stat_read,
-- .maxlen = sizeof(atomic_t),
-+ .maxlen = sizeof(atomic_unchecked_t),
- .mode = 0644,
- .proc_handler = &read_reset_stat,
- },
- {
- .procname = "rdma_stat_recv",
- .data = &rdma_stat_recv,
-- .maxlen = sizeof(atomic_t),
-+ .maxlen = sizeof(atomic_unchecked_t),
- .mode = 0644,
- .proc_handler = &read_reset_stat,
- },
- {
- .procname = "rdma_stat_write",
- .data = &rdma_stat_write,
-- .maxlen = sizeof(atomic_t),
-+ .maxlen = sizeof(atomic_unchecked_t),
- .mode = 0644,
- .proc_handler = &read_reset_stat,
- },
- {
- .procname = "rdma_stat_sq_starve",
- .data = &rdma_stat_sq_starve,
-- .maxlen = sizeof(atomic_t),
-+ .maxlen = sizeof(atomic_unchecked_t),
- .mode = 0644,
- .proc_handler = &read_reset_stat,
- },
- {
- .procname = "rdma_stat_rq_starve",
- .data = &rdma_stat_rq_starve,
-- .maxlen = sizeof(atomic_t),
-+ .maxlen = sizeof(atomic_unchecked_t),
- .mode = 0644,
- .proc_handler = &read_reset_stat,
- },
- {
- .procname = "rdma_stat_rq_poll",
- .data = &rdma_stat_rq_poll,
-- .maxlen = sizeof(atomic_t),
-+ .maxlen = sizeof(atomic_unchecked_t),
- .mode = 0644,
- .proc_handler = &read_reset_stat,
- },
- {
- .procname = "rdma_stat_rq_prod",
- .data = &rdma_stat_rq_prod,
-- .maxlen = sizeof(atomic_t),
-+ .maxlen = sizeof(atomic_unchecked_t),
- .mode = 0644,
- .proc_handler = &read_reset_stat,
- },
- {
- .procname = "rdma_stat_sq_poll",
- .data = &rdma_stat_sq_poll,
-- .maxlen = sizeof(atomic_t),
-+ .maxlen = sizeof(atomic_unchecked_t),
- .mode = 0644,
- .proc_handler = &read_reset_stat,
- },
- {
- .procname = "rdma_stat_sq_prod",
- .data = &rdma_stat_sq_prod,
-- .maxlen = sizeof(atomic_t),
-+ .maxlen = sizeof(atomic_unchecked_t),
- .mode = 0644,
- .proc_handler = &read_reset_stat,
- },
-diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
-index 9e88438..8ed5cf0 100644
---- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
-+++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
-@@ -495,7 +495,7 @@ next_sge:
- svc_rdma_put_context(ctxt, 0);
- goto out;
- }
-- atomic_inc(&rdma_stat_read);
-+ atomic_inc_unchecked(&rdma_stat_read);
-
- if (read_wr.num_sge < chl_map->ch[ch_no].count) {
- chl_map->ch[ch_no].count -= read_wr.num_sge;
-@@ -606,7 +606,7 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp)
- dto_q);
- list_del_init(&ctxt->dto_q);
- } else {
-- atomic_inc(&rdma_stat_rq_starve);
-+ atomic_inc_unchecked(&rdma_stat_rq_starve);
- clear_bit(XPT_DATA, &xprt->xpt_flags);
- ctxt = NULL;
- }
-@@ -626,7 +626,7 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp)
- dprintk("svcrdma: processing ctxt=%p on xprt=%p, rqstp=%p, status=%d\n",
- ctxt, rdma_xprt, rqstp, ctxt->wc_status);
- BUG_ON(ctxt->wc_status != IB_WC_SUCCESS);
-- atomic_inc(&rdma_stat_recv);
-+ atomic_inc_unchecked(&rdma_stat_recv);
-
- /* Build up the XDR from the receive buffers. */
- rdma_build_arg_xdr(rqstp, ctxt, ctxt->byte_len);
-diff --git a/net/sunrpc/xprtrdma/svc_rdma_sendto.c b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
-index f11be72..7aad4e8 100644
---- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
-+++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
-@@ -328,7 +328,7 @@ static int send_write(struct svcxprt_rdma *xprt, struct svc_rqst *rqstp,
- write_wr.wr.rdma.remote_addr = to;
-
- /* Post It */
-- atomic_inc(&rdma_stat_write);
-+ atomic_inc_unchecked(&rdma_stat_write);
- if (svc_rdma_send(xprt, &write_wr))
- goto err;
- return 0;
-diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
-index 3fa5751..030ba89 100644
---- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
-+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
-@@ -292,7 +292,7 @@ static void rq_cq_reap(struct svcxprt_rdma *xprt)
- return;
-
- ib_req_notify_cq(xprt->sc_rq_cq, IB_CQ_NEXT_COMP);
-- atomic_inc(&rdma_stat_rq_poll);
-+ atomic_inc_unchecked(&rdma_stat_rq_poll);
-
- while ((ret = ib_poll_cq(xprt->sc_rq_cq, 1, &wc)) > 0) {
- ctxt = (struct svc_rdma_op_ctxt *)(unsigned long)wc.wr_id;
-@@ -314,7 +314,7 @@ static void rq_cq_reap(struct svcxprt_rdma *xprt)
- }
-
- if (ctxt)
-- atomic_inc(&rdma_stat_rq_prod);
-+ atomic_inc_unchecked(&rdma_stat_rq_prod);
-
- set_bit(XPT_DATA, &xprt->sc_xprt.xpt_flags);
- /*
-@@ -386,7 +386,7 @@ static void sq_cq_reap(struct svcxprt_rdma *xprt)
- return;
-
- ib_req_notify_cq(xprt->sc_sq_cq, IB_CQ_NEXT_COMP);
-- atomic_inc(&rdma_stat_sq_poll);
-+ atomic_inc_unchecked(&rdma_stat_sq_poll);
- while ((ret = ib_poll_cq(cq, 1, &wc)) > 0) {
- if (wc.status != IB_WC_SUCCESS)
- /* Close the transport */
-@@ -404,7 +404,7 @@ static void sq_cq_reap(struct svcxprt_rdma *xprt)
- }
-
- if (ctxt)
-- atomic_inc(&rdma_stat_sq_prod);
-+ atomic_inc_unchecked(&rdma_stat_sq_prod);
- }
-
- static void sq_comp_handler(struct ib_cq *cq, void *cq_context)
-@@ -1260,7 +1260,7 @@ int svc_rdma_send(struct svcxprt_rdma *xprt, struct ib_send_wr *wr)
- spin_lock_bh(&xprt->sc_lock);
- if (xprt->sc_sq_depth < atomic_read(&xprt->sc_sq_count) + wr_count) {
- spin_unlock_bh(&xprt->sc_lock);
-- atomic_inc(&rdma_stat_sq_starve);
-+ atomic_inc_unchecked(&rdma_stat_sq_starve);
-
- /* See if we can opportunistically reap SQ WR to make room */
- sq_cq_reap(xprt);
-diff --git a/net/sysctl_net.c b/net/sysctl_net.c
-index 0b15d72..7934fbb 100644
---- a/net/sysctl_net.c
-+++ b/net/sysctl_net.c
-@@ -46,7 +46,7 @@ static int net_ctl_permissions(struct ctl_table_root *root,
- struct ctl_table *table)
- {
- /* Allow network administrator to have same access as root. */
-- if (capable(CAP_NET_ADMIN)) {
-+ if (capable_nolog(CAP_NET_ADMIN)) {
- int mode = (table->mode >> 6) & 7;
- return (mode << 6) | (mode << 3) | mode;
- }
-diff --git a/net/tipc/eth_media.c b/net/tipc/eth_media.c
-index 524ba56..8f2f836 100644
---- a/net/tipc/eth_media.c
-+++ b/net/tipc/eth_media.c
-@@ -60,7 +60,6 @@ struct eth_bearer {
-
- static struct eth_bearer eth_bearers[MAX_ETH_BEARERS];
- static int eth_started = 0;
--static struct notifier_block notifier;
-
- /**
- * send_msg - send a TIPC message out over an Ethernet interface
-@@ -258,6 +257,11 @@ static char *eth_addr2str(struct tipc_media_addr *a, char *str_buf, int str_size
- * with OS for notifications about device state changes.
- */
-
-+static struct notifier_block notifier = {
-+ .notifier_call = &recv_notification,
-+ .priority = 0,
-+};
-+
- int tipc_eth_media_start(void)
- {
- struct tipc_media_addr bcast_addr;
-@@ -278,8 +282,6 @@ int tipc_eth_media_start(void)
- if (res)
- return res;
-
-- notifier.notifier_call = &recv_notification;
-- notifier.priority = 0;
- res = register_netdevice_notifier(¬ifier);
- if (!res)
- eth_started = 1;
-diff --git a/net/tipc/link.c b/net/tipc/link.c
-index dd4c18b..356b07d 100644
---- a/net/tipc/link.c
-+++ b/net/tipc/link.c
-@@ -1418,7 +1418,7 @@ again:
-
- if (!sect_rest) {
- sect_rest = msg_sect[++curr_sect].iov_len;
-- sect_crs = (const unchar *)msg_sect[curr_sect].iov_base;
-+ sect_crs = (const unchar __user *)msg_sect[curr_sect].iov_base;
- }
-
- if (sect_rest < fragm_rest)
-@@ -1437,7 +1437,7 @@ error:
- }
- } else
- skb_copy_to_linear_data_offset(buf, fragm_crs,
-- sect_crs, sz);
-+ (const void __force_kernel *)sect_crs, sz);
- sect_crs += sz;
- sect_rest -= sz;
- fragm_crs += sz;
-@@ -2551,12 +2551,13 @@ static int link_recv_changeover_msg(struct link **l_ptr,
- struct tipc_msg *tunnel_msg = buf_msg(tunnel_buf);
- u32 msg_typ = msg_type(tunnel_msg);
- u32 msg_count = msg_msgcnt(tunnel_msg);
-+ u32 bearer_id = msg_bearer_id(tunnel_msg);
-
-- dest_link = (*l_ptr)->owner->links[msg_bearer_id(tunnel_msg)];
-- if (!dest_link) {
-- msg_dbg(tunnel_msg, "NOLINK/<REC<");
-+ if (bearer_id >= MAX_BEARERS)
-+ goto exit;
-+ dest_link = (*l_ptr)->owner->links[bearer_id];
-+ if (!dest_link)
- goto exit;
-- }
- if (dest_link == *l_ptr) {
- err("Unexpected changeover message on link <%s>\n",
- (*l_ptr)->name);
-@@ -2798,15 +2799,16 @@ int tipc_link_recv_fragment(struct sk_buff **pending, struct sk_buff **fb,
- struct tipc_msg *imsg = (struct tipc_msg *)msg_data(fragm);
- u32 msg_sz = msg_size(imsg);
- u32 fragm_sz = msg_data_sz(fragm);
-- u32 exp_fragm_cnt = msg_sz/fragm_sz + !!(msg_sz % fragm_sz);
-+ u32 exp_fragm_cnt;
- u32 max = TIPC_MAX_USER_MSG_SIZE + LONG_H_SIZE;
-+
- if (msg_type(imsg) == TIPC_MCAST_MSG)
- max = TIPC_MAX_USER_MSG_SIZE + MCAST_H_SIZE;
-- if (msg_size(imsg) > max) {
-- msg_dbg(fragm,"<REC<Oversized: ");
-+ if (fragm_sz == 0 || msg_size(imsg) > max) {
- buf_discard(fbuf);
- return 0;
- }
-+ exp_fragm_cnt = msg_sz / fragm_sz + !!(msg_sz % fragm_sz);
- pbuf = buf_acquire(msg_size(imsg));
- if (pbuf != NULL) {
- pbuf->next = *pending;
-diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
-index 0747d8a..e8bf3f3 100644
---- a/net/tipc/subscr.c
-+++ b/net/tipc/subscr.c
-@@ -104,7 +104,7 @@ static void subscr_send_event(struct subscription *sub,
- {
- struct iovec msg_sect;
-
-- msg_sect.iov_base = (void *)&sub->evt;
-+ msg_sect.iov_base = (void __force_user *)&sub->evt;
- msg_sect.iov_len = sizeof(struct tipc_event);
-
- sub->evt.event = htohl(event, sub->swap);
-diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index d146b76..621ceb3 100644
---- a/net/unix/af_unix.c
-+++ b/net/unix/af_unix.c
-@@ -744,6 +744,12 @@ static struct sock *unix_find_other(struct net *net,
- err = -ECONNREFUSED;
- if (!S_ISSOCK(inode->i_mode))
- goto put_fail;
-+
-+ if (!gr_acl_handle_unix(path.dentry, path.mnt)) {
-+ err = -EACCES;
-+ goto put_fail;
-+ }
-+
- u = unix_find_socket_byinode(net, inode);
- if (!u)
- goto put_fail;
-@@ -764,6 +770,13 @@ static struct sock *unix_find_other(struct net *net,
- if (u) {
- struct dentry *dentry;
- dentry = unix_sk(u)->dentry;
-+
-+ if (!gr_handle_chroot_unix(u->sk_peercred.pid)) {
-+ err = -EPERM;
-+ sock_put(u);
-+ goto fail;
-+ }
-+
- if (dentry)
- touch_atime(unix_sk(u)->mnt, dentry);
- } else
-@@ -849,11 +862,18 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
- err = security_path_mknod(&nd.path, dentry, mode, 0);
- if (err)
- goto out_mknod_drop_write;
-+ if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
-+ err = -EACCES;
-+ goto out_mknod_drop_write;
-+ }
- err = vfs_mknod(nd.path.dentry->d_inode, dentry, mode, 0);
- out_mknod_drop_write:
- mnt_drop_write(nd.path.mnt);
- if (err)
- goto out_mknod_dput;
-+
-+ gr_handle_create(dentry, nd.path.mnt);
-+
- mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
- dput(nd.path.dentry);
- nd.path.dentry = dentry;
-@@ -2205,12 +2225,20 @@ static int unix_seq_show(struct seq_file *seq, void *v)
- seq_puts(seq, "Num RefCount Protocol Flags Type St "
- "Inode Path\n");
- else {
-- struct sock *s = v;
-+ struct sock *s = v, *peer;
- struct unix_sock *u = unix_sk(s);
- unix_state_lock(s);
-+ peer = unix_peer(s);
-+ unix_state_unlock(s);
-+
-+ unix_state_double_lock(s, peer);
-
- seq_printf(seq, "%p: %08X %08X %08X %04X %02X %5lu",
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
- s,
-+#endif
- atomic_read(&s->sk_refcnt),
- 0,
- s->sk_state == TCP_LISTEN ? __SO_ACCEPTCON : 0,
-@@ -2234,8 +2262,10 @@ static int unix_seq_show(struct seq_file *seq, void *v)
- }
- for ( ; i < len; i++)
- seq_putc(seq, u->addr->name->sun_path[i]);
-- }
-- unix_state_unlock(s);
-+ } else if (peer)
-+ seq_printf(seq, " P%lu", sock_i_ino(peer));
-+
-+ unix_state_double_unlock(s, peer);
- seq_putc(seq, '\n');
- }
-
-diff --git a/net/wireless/wext.c b/net/wireless/wext.c
-index a2e4c60..0979cbe 100644
---- a/net/wireless/wext.c
-+++ b/net/wireless/wext.c
-@@ -816,8 +816,7 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
- */
-
- /* Support for very large requests */
-- if ((descr->flags & IW_DESCR_FLAG_NOMAX) &&
-- (user_length > descr->max_tokens)) {
-+ if (user_length > descr->max_tokens) {
- /* Allow userspace to GET more than max so
- * we can support any size GET requests.
- * There is still a limit : -ENOMEM.
-@@ -854,22 +853,6 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
- }
- }
-
-- if (IW_IS_GET(cmd) && !(descr->flags & IW_DESCR_FLAG_NOMAX)) {
-- /*
-- * If this is a GET, but not NOMAX, it means that the extra
-- * data is not bounded by userspace, but by max_tokens. Thus
-- * set the length to max_tokens. This matches the extra data
-- * allocation.
-- * The driver should fill it with the number of tokens it
-- * provided, and it may check iwp->length rather than having
-- * knowledge of max_tokens. If the driver doesn't change the
-- * iwp->length, this ioctl just copies back max_token tokens
-- * filled with zeroes. Hopefully the driver isn't claiming
-- * them to be valid data.
-- */
-- iwp->length = descr->max_tokens;
-- }
--
- err = handler(dev, info, (union iwreq_data *) iwp, extra);
-
- iwp->length += essid_compat;
-diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
-index cb81ca3..e15d49a 100644
---- a/net/xfrm/xfrm_policy.c
-+++ b/net/xfrm/xfrm_policy.c
-@@ -586,7 +586,7 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
- hlist_add_head(&policy->bydst, chain);
- xfrm_pol_hold(policy);
- net->xfrm.policy_count[dir]++;
-- atomic_inc(&flow_cache_genid);
-+ atomic_inc_unchecked(&flow_cache_genid);
- if (delpol)
- __xfrm_policy_unlink(delpol, dir);
- policy->index = delpol ? delpol->index : xfrm_gen_index(net, dir);
-@@ -669,7 +669,7 @@ struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u8 type, int dir,
- write_unlock_bh(&xfrm_policy_lock);
-
- if (ret && delete) {
-- atomic_inc(&flow_cache_genid);
-+ atomic_inc_unchecked(&flow_cache_genid);
- xfrm_policy_kill(ret);
- }
- return ret;
-@@ -710,7 +710,7 @@ struct xfrm_policy *xfrm_policy_byid(struct net *net, u8 type, int dir, u32 id,
- write_unlock_bh(&xfrm_policy_lock);
-
- if (ret && delete) {
-- atomic_inc(&flow_cache_genid);
-+ atomic_inc_unchecked(&flow_cache_genid);
- xfrm_policy_kill(ret);
- }
- return ret;
-@@ -824,7 +824,7 @@ int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info)
- }
-
- }
-- atomic_inc(&flow_cache_genid);
-+ atomic_inc_unchecked(&flow_cache_genid);
- out:
- write_unlock_bh(&xfrm_policy_lock);
- return err;
-@@ -1088,7 +1088,7 @@ int xfrm_policy_delete(struct xfrm_policy *pol, int dir)
- write_unlock_bh(&xfrm_policy_lock);
- if (pol) {
- if (dir < XFRM_POLICY_MAX)
-- atomic_inc(&flow_cache_genid);
-+ atomic_inc_unchecked(&flow_cache_genid);
- xfrm_policy_kill(pol);
- return 0;
- }
-@@ -1477,7 +1477,7 @@ free_dst:
- goto out;
- }
-
--static int inline
-+static inline int
- xfrm_dst_alloc_copy(void **target, void *src, int size)
- {
- if (!*target) {
-@@ -1489,7 +1489,7 @@ xfrm_dst_alloc_copy(void **target, void *src, int size)
- return 0;
- }
-
--static int inline
-+static inline int
- xfrm_dst_update_parent(struct dst_entry *dst, struct xfrm_selector *sel)
- {
- #ifdef CONFIG_XFRM_SUB_POLICY
-@@ -1501,7 +1501,7 @@ xfrm_dst_update_parent(struct dst_entry *dst, struct xfrm_selector *sel)
- #endif
- }
-
--static int inline
-+static inline int
- xfrm_dst_update_origin(struct dst_entry *dst, struct flowi *fl)
- {
- #ifdef CONFIG_XFRM_SUB_POLICY
-@@ -1537,7 +1537,7 @@ int __xfrm_lookup(struct net *net, struct dst_entry **dst_p, struct flowi *fl,
- u8 dir = policy_to_flow_dir(XFRM_POLICY_OUT);
-
- restart:
-- genid = atomic_read(&flow_cache_genid);
-+ genid = atomic_read_unchecked(&flow_cache_genid);
- policy = NULL;
- for (pi = 0; pi < ARRAY_SIZE(pols); pi++)
- pols[pi] = NULL;
-@@ -1680,7 +1680,7 @@ restart:
- goto error;
- }
- if (nx == -EAGAIN ||
-- genid != atomic_read(&flow_cache_genid)) {
-+ genid != atomic_read_unchecked(&flow_cache_genid)) {
- xfrm_pols_put(pols, npols);
- goto restart;
- }
-diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
-index f2f7c63..9e0e8cf 100644
---- a/net/xfrm/xfrm_state.c
-+++ b/net/xfrm/xfrm_state.c
-@@ -281,7 +281,9 @@ int xfrm_register_mode(struct xfrm_mode *mode, int family)
- if (!try_module_get(afinfo->owner))
- goto out;
-
-- mode->afinfo = afinfo;
-+ pax_open_kernel();
-+ *(void **)&mode->afinfo = afinfo;
-+ pax_close_kernel();
- modemap[mode->encap] = mode;
- err = 0;
-
-@@ -2040,8 +2042,10 @@ int xfrm_init_state(struct xfrm_state *x)
- goto error;
-
- x->outer_mode = xfrm_get_mode(x->props.mode, family);
-- if (x->outer_mode == NULL)
-+ if (x->outer_mode == NULL) {
-+ err = -EPROTONOSUPPORT;
- goto error;
-+ }
-
- x->km.state = XFRM_STATE_VALID;
-
-diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
-index 06f42f6..5f968fb 100644
---- a/net/xfrm/xfrm_user.c
-+++ b/net/xfrm/xfrm_user.c
-@@ -224,7 +224,7 @@ static int attach_one_algo(struct xfrm_algo **algpp, u8 *props,
- if (!p)
- return -ENOMEM;
-
-- strcpy(p->alg_name, algo->name);
-+ strncpy(p->alg_name, algo->name, sizeof(p->alg_name));
- *algpp = p;
- return 0;
- }
-@@ -1173,6 +1173,8 @@ static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb)
- struct xfrm_user_tmpl vec[XFRM_MAX_DEPTH];
- int i;
-
-+ pax_track_stack();
-+
- if (xp->xfrm_nr == 0)
- return 0;
-
-@@ -1791,6 +1793,8 @@ static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
- int err;
- int n = 0;
-
-+ pax_track_stack();
-+
- if (attrs[XFRMA_MIGRATE] == NULL)
- return -EINVAL;
-
-diff --git a/samples/kobject/kset-example.c b/samples/kobject/kset-example.c
-index 45b7d56..19e828c 100644
---- a/samples/kobject/kset-example.c
-+++ b/samples/kobject/kset-example.c
-@@ -87,7 +87,7 @@ static ssize_t foo_attr_store(struct kobject *kobj,
- }
-
- /* Our custom sysfs_ops that we will associate with our ktype later on */
--static struct sysfs_ops foo_sysfs_ops = {
-+static const struct sysfs_ops foo_sysfs_ops = {
- .show = foo_attr_show,
- .store = foo_attr_store,
- };
-diff --git a/scripts/Makefile.build b/scripts/Makefile.build
-index 341b589..29fffe0 100644
---- a/scripts/Makefile.build
-+++ b/scripts/Makefile.build
-@@ -59,7 +59,7 @@ endif
- endif
-
- # Do not include host rules unless needed
--ifneq ($(hostprogs-y)$(hostprogs-m),)
-+ifneq ($(hostprogs-y)$(hostprogs-m)$(hostlibs-y)$(hostlibs-m)$(hostcxxlibs-y)$(hostcxxlibs-m),)
- include scripts/Makefile.host
- endif
-
-diff --git a/scripts/Makefile.clean b/scripts/Makefile.clean
-index 6f89fbb..53adc9c 100644
---- a/scripts/Makefile.clean
-+++ b/scripts/Makefile.clean
-@@ -43,7 +43,8 @@ subdir-ymn := $(addprefix $(obj)/,$(subdir-ymn))
- __clean-files := $(extra-y) $(always) \
- $(targets) $(clean-files) \
- $(host-progs) \
-- $(hostprogs-y) $(hostprogs-m) $(hostprogs-)
-+ $(hostprogs-y) $(hostprogs-m) $(hostprogs-) \
-+ $(hostlibs-y) $(hostlibs-m) $(hostlibs-)
-
- # as clean-files is given relative to the current directory, this adds
- # a $(obj) prefix, except for absolute paths
-diff --git a/scripts/Makefile.host b/scripts/Makefile.host
-index 1ac414f..38575f7 100644
---- a/scripts/Makefile.host
-+++ b/scripts/Makefile.host
-@@ -31,6 +31,8 @@
- # Note: Shared libraries consisting of C++ files are not supported
-
- __hostprogs := $(sort $(hostprogs-y) $(hostprogs-m))
-+__hostlibs := $(sort $(hostlibs-y) $(hostlibs-m))
-+__hostcxxlibs := $(sort $(hostcxxlibs-y) $(hostcxxlibs-m))
-
- # C code
- # Executables compiled from a single .c file
-@@ -54,11 +56,15 @@ host-cxxobjs := $(sort $(foreach m,$(host-cxxmulti),$($(m)-cxxobjs)))
- # Shared libaries (only .c supported)
- # Shared libraries (.so) - all .so files referenced in "xxx-objs"
- host-cshlib := $(sort $(filter %.so, $(host-cobjs)))
-+host-cshlib += $(sort $(filter %.so, $(__hostlibs)))
-+host-cxxshlib := $(sort $(filter %.so, $(__hostcxxlibs)))
- # Remove .so files from "xxx-objs"
- host-cobjs := $(filter-out %.so,$(host-cobjs))
-+host-cxxobjs := $(filter-out %.so,$(host-cxxobjs))
-
--#Object (.o) files used by the shared libaries
-+# Object (.o) files used by the shared libaries
- host-cshobjs := $(sort $(foreach m,$(host-cshlib),$($(m:.so=-objs))))
-+host-cxxshobjs := $(sort $(foreach m,$(host-cxxshlib),$($(m:.so=-objs))))
-
- # output directory for programs/.o files
- # hostprogs-y := tools/build may have been specified. Retrieve directory
-@@ -82,7 +88,9 @@ host-cobjs := $(addprefix $(obj)/,$(host-cobjs))
- host-cxxmulti := $(addprefix $(obj)/,$(host-cxxmulti))
- host-cxxobjs := $(addprefix $(obj)/,$(host-cxxobjs))
- host-cshlib := $(addprefix $(obj)/,$(host-cshlib))
-+host-cxxshlib := $(addprefix $(obj)/,$(host-cxxshlib))
- host-cshobjs := $(addprefix $(obj)/,$(host-cshobjs))
-+host-cxxshobjs := $(addprefix $(obj)/,$(host-cxxshobjs))
- host-objdirs := $(addprefix $(obj)/,$(host-objdirs))
-
- obj-dirs += $(host-objdirs)
-@@ -156,6 +164,13 @@ quiet_cmd_host-cshobjs = HOSTCC -fPIC $@
- $(host-cshobjs): $(obj)/%.o: $(src)/%.c FORCE
- $(call if_changed_dep,host-cshobjs)
-
-+# Compile .c file, create position independent .o file
-+# host-cxxshobjs -> .o
-+quiet_cmd_host-cxxshobjs = HOSTCXX -fPIC $@
-+ cmd_host-cxxshobjs = $(HOSTCXX) $(hostcxx_flags) -fPIC -c -o $@ $<
-+$(host-cxxshobjs): $(obj)/%.o: $(src)/%.c FORCE
-+ $(call if_changed_dep,host-cxxshobjs)
-+
- # Link a shared library, based on position independent .o files
- # *.o -> .so shared library (host-cshlib)
- quiet_cmd_host-cshlib = HOSTLLD -shared $@
-@@ -165,6 +180,15 @@ quiet_cmd_host-cshlib = HOSTLLD -shared $@
- $(host-cshlib): $(obj)/%: $(host-cshobjs) FORCE
- $(call if_changed,host-cshlib)
-
-+# Link a shared library, based on position independent .o files
-+# *.o -> .so shared library (host-cxxshlib)
-+quiet_cmd_host-cxxshlib = HOSTLLD -shared $@
-+ cmd_host-cxxshlib = $(HOSTCXX) $(HOSTLDFLAGS) -shared -o $@ \
-+ $(addprefix $(obj)/,$($(@F:.so=-objs))) \
-+ $(HOST_LOADLIBES) $(HOSTLOADLIBES_$(@F))
-+$(host-cxxshlib): $(obj)/%: $(host-cxxshobjs) FORCE
-+ $(call if_changed,host-cxxshlib)
-+
- targets += $(host-csingle) $(host-cmulti) $(host-cobjs)\
-- $(host-cxxmulti) $(host-cxxobjs) $(host-cshlib) $(host-cshobjs)
-+ $(host-cxxmulti) $(host-cxxobjs) $(host-cshlib) $(host-cshobjs) $(host-cxxshlib) $(host-cxxshobjs)
-
-diff --git a/scripts/basic/fixdep.c b/scripts/basic/fixdep.c
-index 6bf21f8..c0546b3 100644
---- a/scripts/basic/fixdep.c
-+++ b/scripts/basic/fixdep.c
-@@ -162,7 +162,7 @@ static void grow_config(int len)
- /*
- * Lookup a value in the configuration string.
- */
--static int is_defined_config(const char * name, int len)
-+static int is_defined_config(const char * name, unsigned int len)
- {
- const char * pconfig;
- const char * plast = str_config + len_config - len;
-@@ -199,7 +199,7 @@ static void clear_config(void)
- /*
- * Record the use of a CONFIG_* word.
- */
--static void use_config(char *m, int slen)
-+static void use_config(char *m, unsigned int slen)
- {
- char s[PATH_MAX];
- char *p;
-@@ -222,9 +222,9 @@ static void use_config(char *m, int slen)
-
- static void parse_config_file(char *map, size_t len)
- {
-- int *end = (int *) (map + len);
-+ unsigned int *end = (unsigned int *) (map + len);
- /* start at +1, so that p can never be < map */
-- int *m = (int *) map + 1;
-+ unsigned int *m = (unsigned int *) map + 1;
- char *p, *q;
-
- for (; m < end; m++) {
-@@ -371,7 +371,7 @@ static void print_deps(void)
- static void traps(void)
- {
- static char test[] __attribute__((aligned(sizeof(int)))) = "CONF";
-- int *p = (int *)test;
-+ unsigned int *p = (unsigned int *)test;
-
- if (*p != INT_CONF) {
- fprintf(stderr, "fixdep: sizeof(int) != 4 or wrong endianess? %#x\n",
-diff --git a/scripts/gcc-plugin.sh b/scripts/gcc-plugin.sh
-new file mode 100644
-index 0000000..5e0222d
---- /dev/null
-+++ b/scripts/gcc-plugin.sh
-@@ -0,0 +1,17 @@
-+#!/bin/bash
-+plugincc=`$1 -E -shared - -o /dev/null -I\`$3 -print-file-name=plugin\`/include 2>&1 <<EOF
-+#include "gcc-plugin.h"
-+#include "tree.h"
-+#include "tm.h"
-+#include "rtl.h"
-+#ifdef ENABLE_BUILD_WITH_CXX
-+#warning $2
-+#else
-+#warning $1
-+#endif
-+EOF`
-+if [ $? -eq 0 ]
-+then
-+ [[ "$plugincc" =~ "$1" ]] && echo "$1"
-+ [[ "$plugincc" =~ "$2" ]] && echo "$2"
-+fi
-diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
-index 62a9025..65b82ad 100644
---- a/scripts/mod/file2alias.c
-+++ b/scripts/mod/file2alias.c
-@@ -72,7 +72,7 @@ static void device_id_check(const char *modname, const char *device_id,
- unsigned long size, unsigned long id_size,
- void *symval)
- {
-- int i;
-+ unsigned int i;
-
- if (size % id_size || size < id_size) {
- if (cross_build != 0)
-@@ -102,7 +102,7 @@ static void device_id_check(const char *modname, const char *device_id,
- /* USB is special because the bcdDevice can be matched against a numeric range */
- /* Looks like "usb:vNpNdNdcNdscNdpNicNiscNipN" */
- static void do_usb_entry(struct usb_device_id *id,
-- unsigned int bcdDevice_initial, int bcdDevice_initial_digits,
-+ unsigned int bcdDevice_initial, unsigned int bcdDevice_initial_digits,
- unsigned char range_lo, unsigned char range_hi,
- struct module *mod)
- {
-@@ -151,7 +151,7 @@ static void do_usb_entry_multi(struct usb_device_id *id, struct module *mod)
- {
- unsigned int devlo, devhi;
- unsigned char chi, clo;
-- int ndigits;
-+ unsigned int ndigits;
-
- id->match_flags = TO_NATIVE(id->match_flags);
- id->idVendor = TO_NATIVE(id->idVendor);
-@@ -368,7 +368,7 @@ static void do_pnp_device_entry(void *symval, unsigned long size,
- for (i = 0; i < count; i++) {
- const char *id = (char *)devs[i].id;
- char acpi_id[sizeof(devs[0].id)];
-- int j;
-+ unsigned int j;
-
- buf_printf(&mod->dev_table_buf,
- "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
-@@ -398,7 +398,7 @@ static void do_pnp_card_entries(void *symval, unsigned long size,
-
- for (j = 0; j < PNP_MAX_DEVICES; j++) {
- const char *id = (char *)card->devs[j].id;
-- int i2, j2;
-+ unsigned int i2, j2;
- int dup = 0;
-
- if (!id[0])
-@@ -424,7 +424,7 @@ static void do_pnp_card_entries(void *symval, unsigned long size,
- /* add an individual alias for every device entry */
- if (!dup) {
- char acpi_id[sizeof(card->devs[0].id)];
-- int k;
-+ unsigned int k;
-
- buf_printf(&mod->dev_table_buf,
- "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
-@@ -699,7 +699,7 @@ static void dmi_ascii_filter(char *d, const char *s)
- static int do_dmi_entry(const char *filename, struct dmi_system_id *id,
- char *alias)
- {
-- int i, j;
-+ unsigned int i, j;
-
- sprintf(alias, "dmi*");
-
-diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
-index 03efeab..35e35ff 100644
---- a/scripts/mod/modpost.c
-+++ b/scripts/mod/modpost.c
-@@ -764,7 +764,7 @@ static void check_section(const char *modname, struct elf_info *elf,
-
- #define ALL_INIT_DATA_SECTIONS \
- ".init.setup$", ".init.rodata$", \
-- ".devinit.rodata$", ".cpuinit.rodata$", ".meminit.rodata$" \
-+ ".devinit.rodata$", ".cpuinit.rodata$", ".meminit.rodata$", \
- ".init.data$", ".devinit.data$", ".cpuinit.data$", ".meminit.data$"
- #define ALL_EXIT_DATA_SECTIONS \
- ".exit.data$", ".devexit.data$", ".cpuexit.data$", ".memexit.data$"
-@@ -835,6 +835,7 @@ enum mismatch {
- INIT_TO_EXIT,
- EXIT_TO_INIT,
- EXPORT_TO_INIT_EXIT,
-+ DATA_TO_TEXT
- };
-
- struct sectioncheck {
-@@ -920,6 +921,12 @@ const struct sectioncheck sectioncheck[] = {
- .fromsec = { "__ksymtab*", NULL },
- .tosec = { INIT_SECTIONS, EXIT_SECTIONS, NULL },
- .mismatch = EXPORT_TO_INIT_EXIT
-+},
-+/* Do not reference code from writable data */
-+{
-+ .fromsec = { DATA_SECTIONS, NULL },
-+ .tosec = { TEXT_SECTIONS, NULL },
-+ .mismatch = DATA_TO_TEXT
- }
- };
-
-@@ -1024,10 +1031,10 @@ static Elf_Sym *find_elf_symbol(struct elf_info *elf, Elf64_Sword addr,
- continue;
- if (ELF_ST_TYPE(sym->st_info) == STT_SECTION)
- continue;
-- if (sym->st_value == addr)
-- return sym;
- /* Find a symbol nearby - addr are maybe negative */
- d = sym->st_value - addr;
-+ if (d == 0)
-+ return sym;
- if (d < 0)
- d = addr - sym->st_value;
- if (d < distance) {
-@@ -1268,6 +1275,14 @@ static void report_sec_mismatch(const char *modname, enum mismatch mismatch,
- "Fix this by removing the %sannotation of %s "
- "or drop the export.\n",
- tosym, sec2annotation(tosec), sec2annotation(tosec), tosym);
-+ case DATA_TO_TEXT:
-+#if 0
-+ fprintf(stderr,
-+ "The %s %s:%s references\n"
-+ "the %s %s:%s%s\n",
-+ from, fromsec, fromsym, to, tosec, tosym, to_p);
-+#endif
-+ break;
- case NO_MISMATCH:
- /* To get warnings on missing members */
- break;
-@@ -1495,7 +1510,7 @@ static void section_rel(const char *modname, struct elf_info *elf,
- static void check_sec_ref(struct module *mod, const char *modname,
- struct elf_info *elf)
- {
-- int i;
-+ unsigned int i;
- Elf_Shdr *sechdrs = elf->sechdrs;
-
- /* Walk through all sections */
-@@ -1651,7 +1666,7 @@ void __attribute__((format(printf, 2, 3))) buf_printf(struct buffer *buf,
- va_end(ap);
- }
-
--void buf_write(struct buffer *buf, const char *s, int len)
-+void buf_write(struct buffer *buf, const char *s, unsigned int len)
- {
- if (buf->size - buf->pos < len) {
- buf->size += len + SZ;
-@@ -1863,7 +1878,7 @@ static void write_if_changed(struct buffer *b, const char *fname)
- if (fstat(fileno(file), &st) < 0)
- goto close_write;
-
-- if (st.st_size != b->pos)
-+ if (st.st_size != (off_t)b->pos)
- goto close_write;
-
- tmp = NOFAIL(malloc(b->pos));
-diff --git a/scripts/mod/modpost.h b/scripts/mod/modpost.h
-index 09f58e3..4b66092 100644
---- a/scripts/mod/modpost.h
-+++ b/scripts/mod/modpost.h
-@@ -92,15 +92,15 @@ void *do_nofail(void *ptr, const char *expr);
-
- struct buffer {
- char *p;
-- int pos;
-- int size;
-+ unsigned int pos;
-+ unsigned int size;
- };
-
- void __attribute__((format(printf, 2, 3)))
- buf_printf(struct buffer *buf, const char *fmt, ...);
-
- void
--buf_write(struct buffer *buf, const char *s, int len);
-+buf_write(struct buffer *buf, const char *s, unsigned int len);
-
- struct module {
- struct module *next;
-diff --git a/scripts/mod/sumversion.c b/scripts/mod/sumversion.c
-index ecf9c7d..d52b38e 100644
---- a/scripts/mod/sumversion.c
-+++ b/scripts/mod/sumversion.c
-@@ -455,7 +455,7 @@ static void write_version(const char *filename, const char *sum,
- goto out;
- }
-
-- if (write(fd, sum, strlen(sum)+1) != strlen(sum)+1) {
-+ if (write(fd, sum, strlen(sum)+1) != (ssize_t)strlen(sum)+1) {
- warn("writing sum in %s failed: %s\n",
- filename, strerror(errno));
- goto out;
-diff --git a/scripts/package/mkspec b/scripts/package/mkspec
-index 47bdd2f..d4d4e93 100755
---- a/scripts/package/mkspec
-+++ b/scripts/package/mkspec
-@@ -70,7 +70,7 @@ echo 'mkdir -p $RPM_BUILD_ROOT/boot $RPM_BUILD_ROOT/lib/modules'
- echo 'mkdir -p $RPM_BUILD_ROOT/lib/firmware'
- echo "%endif"
-
--echo 'INSTALL_MOD_PATH=$RPM_BUILD_ROOT make %{_smp_mflags} KBUILD_SRC= modules_install'
-+echo 'INSTALL_MOD_PATH=$RPM_BUILD_ROOT make %{?_smp_mflags} KBUILD_SRC= modules_install'
- echo "%ifarch ia64"
- echo 'cp $KBUILD_IMAGE $RPM_BUILD_ROOT'"/boot/efi/vmlinuz-$KERNELRELEASE"
- echo 'ln -s '"efi/vmlinuz-$KERNELRELEASE" '$RPM_BUILD_ROOT'"/boot/"
-diff --git a/scripts/pnmtologo.c b/scripts/pnmtologo.c
-index 5c11312..72742b5 100644
---- a/scripts/pnmtologo.c
-+++ b/scripts/pnmtologo.c
-@@ -237,14 +237,14 @@ static void write_header(void)
- fprintf(out, " * Linux logo %s\n", logoname);
- fputs(" */\n\n", out);
- fputs("#include <linux/linux_logo.h>\n\n", out);
-- fprintf(out, "static unsigned char %s_data[] __initdata = {\n",
-+ fprintf(out, "static unsigned char %s_data[] = {\n",
- logoname);
- }
-
- static void write_footer(void)
- {
- fputs("\n};\n\n", out);
-- fprintf(out, "const struct linux_logo %s __initconst = {\n", logoname);
-+ fprintf(out, "const struct linux_logo %s = {\n", logoname);
- fprintf(out, "\t.type\t\t= %s,\n", logo_types[logo_type]);
- fprintf(out, "\t.width\t\t= %d,\n", logo_width);
- fprintf(out, "\t.height\t\t= %d,\n", logo_height);
-@@ -374,7 +374,7 @@ static void write_logo_clut224(void)
- fputs("\n};\n\n", out);
-
- /* write logo clut */
-- fprintf(out, "static unsigned char %s_clut[] __initdata = {\n",
-+ fprintf(out, "static unsigned char %s_clut[] = {\n",
- logoname);
- write_hex_cnt = 0;
- for (i = 0; i < logo_clutsize; i++) {
-diff --git a/scripts/tags.sh b/scripts/tags.sh
-index d52f7a0..b66cdd9 100755
---- a/scripts/tags.sh
-+++ b/scripts/tags.sh
-@@ -93,6 +93,11 @@ docscope()
- cscope -b -f cscope.out
- }
-
-+dogtags()
-+{
-+ all_sources | gtags -i -f -
-+}
-+
- exuberant()
- {
- all_sources | xargs $1 -a \
-@@ -164,6 +169,10 @@ case "$1" in
- docscope
- ;;
-
-+ "gtags")
-+ dogtags
-+ ;;
-+
- "tags")
- rm -f tags
- xtags ctags
-diff --git a/security/Kconfig b/security/Kconfig
-index fb363cd..1d2c23f 100644
---- a/security/Kconfig
-+++ b/security/Kconfig
-@@ -4,6 +4,897 @@
-
- menu "Security options"
-
-+menu "Grsecurity"
-+
-+ config ARCH_TRACK_EXEC_LIMIT
-+ bool
-+
-+ config PAX_KERNEXEC_PLUGIN
-+ bool
-+
-+ config PAX_PER_CPU_PGD
-+ bool
-+
-+ config TASK_SIZE_MAX_SHIFT
-+ int
-+ depends on X86_64
-+ default 47 if !PAX_PER_CPU_PGD
-+ default 42 if PAX_PER_CPU_PGD
-+
-+ config PAX_ENABLE_PAE
-+ bool
-+ default y if (X86_32 && (MPENTIUM4 || MK8 || MPSC || MCORE2 || MATOM))
-+
-+ config PAX_USERCOPY_SLABS
-+ bool
-+
-+config GRKERNSEC
-+ bool "Grsecurity"
-+ select CRYPTO
-+ select CRYPTO_SHA256
-+ select PROC_FS
-+ select STOP_MACHINE
-+ select DEBUG_LIST
-+ help
-+ If you say Y here, you will be able to configure many features
-+ that will enhance the security of your system. It is highly
-+ recommended that you say Y here and read through the help
-+ for each option so that you fully understand the features and
-+ can evaluate their usefulness for your machine.
-+
-+choice
-+ prompt "Configuration Method"
-+ depends on GRKERNSEC
-+ default GRKERNSEC_CONFIG_CUSTOM
-+ help
-+
-+config GRKERNSEC_CONFIG_AUTO
-+ bool "Automatic"
-+ help
-+ If you choose this configuration method, you'll be able to answer a small
-+ number of simple questions about how you plan to use this kernel.
-+ The settings of grsecurity and PaX will be automatically configured for
-+ the highest commonly-used settings within the provided constraints.
-+
-+ If you require additional configuration, custom changes can still be made
-+ from the "custom configuration" menu.
-+
-+config GRKERNSEC_CONFIG_CUSTOM
-+ bool "Custom"
-+ help
-+ If you choose this configuration method, you'll be able to configure all
-+ grsecurity and PaX settings manually. Via this method, no options are
-+ automatically enabled.
-+
-+endchoice
-+
-+choice
-+ prompt "Usage Type"
-+ depends on (GRKERNSEC && GRKERNSEC_CONFIG_AUTO)
-+ default GRKERNSEC_CONFIG_SERVER
-+ help
-+
-+config GRKERNSEC_CONFIG_SERVER
-+ bool "Server"
-+ help
-+ Choose this option if you plan to use this kernel on a server.
-+
-+config GRKERNSEC_CONFIG_DESKTOP
-+ bool "Desktop"
-+ help
-+ Choose this option if you plan to use this kernel on a desktop.
-+
-+endchoice
-+
-+choice
-+ prompt "Virtualization Type"
-+ depends on (GRKERNSEC && X86 && GRKERNSEC_CONFIG_AUTO)
-+ default GRKERNSEC_CONFIG_VIRT_NONE
-+ help
-+
-+config GRKERNSEC_CONFIG_VIRT_NONE
-+ bool "None"
-+ help
-+ Choose this option if this kernel will be run on bare metal.
-+
-+config GRKERNSEC_CONFIG_VIRT_GUEST
-+ bool "Guest"
-+ help
-+ Choose this option if this kernel will be run as a VM guest.
-+
-+config GRKERNSEC_CONFIG_VIRT_HOST
-+ bool "Host"
-+ help
-+ Choose this option if this kernel will be run as a VM host.
-+
-+endchoice
-+
-+choice
-+ prompt "Virtualization Hardware"
-+ depends on (GRKERNSEC && X86 && GRKERNSEC_CONFIG_AUTO && (GRKERNSEC_CONFIG_VIRT_GUEST || GRKERNSEC_CONFIG_VIRT_HOST))
-+ help
-+
-+config GRKERNSEC_CONFIG_VIRT_EPT
-+ bool "EPT/RVI Processor Support"
-+ depends on X86
-+ help
-+ Choose this option if your CPU supports the EPT or RVI features of 2nd-gen
-+ hardware virtualization. This allows for additional kernel hardening protections
-+ to operate without additional performance impact.
-+
-+ To see if your Intel processor supports EPT, see:
-+ http://ark.intel.com/Products/VirtualizationTechnology
-+ (Most Core i3/5/7 support EPT)
-+
-+ To see if your AMD processor supports RVI, see:
-+ http://support.amd.com/us/kbarticles/Pages/GPU120AMDRVICPUsHyperVWin8.aspx
-+
-+config GRKERNSEC_CONFIG_VIRT_SOFT
-+ bool "First-gen/No Hardware Virtualization"
-+ help
-+ Choose this option if you use an Atom/Pentium/Core 2 processor that either doesn't
-+ support hardware virtualization or doesn't support the EPT/RVI extensions.
-+
-+endchoice
-+
-+choice
-+ prompt "Virtualization Software"
-+ depends on (GRKERNSEC && GRKERNSEC_CONFIG_AUTO && (GRKERNSEC_CONFIG_VIRT_GUEST || GRKERNSEC_CONFIG_VIRT_HOST))
-+ help
-+
-+config GRKERNSEC_CONFIG_VIRT_XEN
-+ bool "Xen"
-+ help
-+ Choose this option if this kernel is running as a Xen guest or host.
-+
-+config GRKERNSEC_CONFIG_VIRT_VMWARE
-+ bool "VMWare"
-+ help
-+ Choose this option if this kernel is running as a VMWare guest or host.
-+
-+config GRKERNSEC_CONFIG_VIRT_KVM
-+ bool "KVM"
-+ help
-+ Choose this option if this kernel is running as a KVM guest or host.
-+
-+config GRKERNSEC_CONFIG_VIRT_VIRTUALBOX
-+ bool "VirtualBox"
-+ help
-+ Choose this option if this kernel is running as a VirtualBox guest or host.
-+
-+endchoice
-+
-+choice
-+ prompt "Required Priorities"
-+ depends on (GRKERNSEC && GRKERNSEC_CONFIG_AUTO)
-+ default GRKERNSEC_CONFIG_PRIORITY_PERF
-+ help
-+
-+config GRKERNSEC_CONFIG_PRIORITY_PERF
-+ bool "Performance"
-+ help
-+ Choose this option if performance is of highest priority for this deployment
-+ of grsecurity. Features like UDEREF on a 64bit kernel, kernel stack clearing,
-+ and freed memory sanitizing will be disabled.
-+
-+config GRKERNSEC_CONFIG_PRIORITY_SECURITY
-+ bool "Security"
-+ help
-+ Choose this option if security is of highest priority for this deployment of
-+ grsecurity. UDEREF, kernel stack clearing, and freed memory sanitizing will
-+ be enabled for this kernel. In a worst-case scenario, these features can
-+ introduce a 20% performance hit (UDEREF on x64 contributing half of this hit).
-+
-+endchoice
-+
-+menu "Default Special Groups"
-+depends on (GRKERNSEC && GRKERNSEC_CONFIG_AUTO)
-+
-+config GRKERNSEC_PROC_GID
-+ int "GID exempted from /proc restrictions"
-+ default 1001
-+ help
-+ Setting this GID determines which group will be exempted from
-+ grsecurity's /proc restrictions, allowing users of the specified
-+ group to view network statistics and the existence of other users'
-+ processes on the system. This GID may also be chosen at boot time
-+ via "grsec_proc_gid=" on the kernel commandline.
-+
-+config GRKERNSEC_TPE_UNTRUSTED_GID
-+ int "GID for TPE-untrusted users"
-+ depends on GRKERNSEC_CONFIG_SERVER && GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
-+ default 1005
-+ help
-+ Setting this GID determines which group untrusted users should
-+ be added to. These users will be placed under grsecurity's Trusted Path
-+ Execution mechanism, preventing them from executing their own binaries.
-+ The users will only be able to execute binaries in directories owned and
-+ writable only by the root user. If the sysctl option is enabled, a sysctl
-+ option with name "tpe_gid" is created.
-+
-+config GRKERNSEC_TPE_TRUSTED_GID
-+ int "GID for TPE-trusted users"
-+ depends on GRKERNSEC_CONFIG_SERVER && GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
-+ default 1005
-+ help
-+ Setting this GID determines what group TPE restrictions will be
-+ *disabled* for. If the sysctl option is enabled, a sysctl option
-+ with name "tpe_gid" is created.
-+
-+config GRKERNSEC_SYMLINKOWN_GID
-+ int "GID for users with kernel-enforced SymlinksIfOwnerMatch"
-+ depends on GRKERNSEC_CONFIG_SERVER
-+ default 1006
-+ help
-+ Setting this GID determines what group kernel-enforced
-+ SymlinksIfOwnerMatch will be enabled for. If the sysctl option
-+ is enabled, a sysctl option with name "symlinkown_gid" is created.
-+
-+
-+endmenu
-+
-+menu "Customize Configuration"
-+depends on GRKERNSEC
-+
-+menu "PaX"
-+
-+config PAX
-+ bool "Enable various PaX features"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC && (ALPHA || ARM || AVR32 || IA64 || MIPS || PARISC || PPC || SPARC || X86)
-+ help
-+ This allows you to enable various PaX features. PaX adds
-+ intrusion prevention mechanisms to the kernel that reduce
-+ the risks posed by exploitable memory corruption bugs.
-+
-+menu "PaX Control"
-+ depends on PAX
-+
-+config PAX_SOFTMODE
-+ bool 'Support soft mode'
-+ help
-+ Enabling this option will allow you to run PaX in soft mode, that
-+ is, PaX features will not be enforced by default, only on executables
-+ marked explicitly. You must also enable PT_PAX_FLAGS or XATTR_PAX_FLAGS
-+ support as they are the only way to mark executables for soft mode use.
-+
-+ Soft mode can be activated by using the "pax_softmode=1" kernel command
-+ line option on boot. Furthermore you can control various PaX features
-+ at runtime via the entries in /proc/sys/kernel/pax.
-+
-+config PAX_EI_PAX
-+ bool 'Use legacy ELF header marking'
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ Enabling this option will allow you to control PaX features on
-+ a per executable basis via the 'chpax' utility available at
-+ http://pax.grsecurity.net/. The control flags will be read from
-+ an otherwise reserved part of the ELF header. This marking has
-+ numerous drawbacks (no support for soft-mode, toolchain does not
-+ know about the non-standard use of the ELF header) therefore it
-+ has been deprecated in favour of PT_PAX_FLAGS and XATTR_PAX_FLAGS
-+ support.
-+
-+ Note that if you enable PT_PAX_FLAGS or XATTR_PAX_FLAGS marking
-+ support as well, they will override the legacy EI_PAX marks.
-+
-+ If you enable none of the marking options then all applications
-+ will run with PaX enabled on them by default.
-+
-+config PAX_PT_PAX_FLAGS
-+ bool 'Use ELF program header marking'
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ Enabling this option will allow you to control PaX features on
-+ a per executable basis via the 'paxctl' utility available at
-+ http://pax.grsecurity.net/. The control flags will be read from
-+ a PaX specific ELF program header (PT_PAX_FLAGS). This marking
-+ has the benefits of supporting both soft mode and being fully
-+ integrated into the toolchain (the binutils patch is available
-+ from http://pax.grsecurity.net).
-+
-+ Note that if you enable the legacy EI_PAX marking support as well,
-+ the EI_PAX marks will be overridden by the PT_PAX_FLAGS marks.
-+
-+ If you enable both PT_PAX_FLAGS and XATTR_PAX_FLAGS support then you
-+ must make sure that the marks are the same if a binary has both marks.
-+
-+ If you enable none of the marking options then all applications
-+ will run with PaX enabled on them by default.
-+
-+config PAX_XATTR_PAX_FLAGS
-+ bool 'Use filesystem extended attributes marking'
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ select CIFS_XATTR if CIFS
-+ select EXT2_FS_XATTR if EXT2_FS
-+ select EXT3_FS_XATTR if EXT3_FS
-+ select EXT4_FS_XATTR if EXT4_FS
-+ select JFFS2_FS_XATTR if JFFS2_FS
-+ select REISERFS_FS_XATTR if REISERFS_FS
-+ select UBIFS_FS_XATTR if UBIFS_FS
-+ help
-+ Enabling this option will allow you to control PaX features on
-+ a per executable basis via the 'setfattr' utility. The control
-+ flags will be read from the user.pax.flags extended attribute of
-+ the file. This marking has the benefit of supporting binary-only
-+ applications that self-check themselves (e.g., skype) and would
-+ not tolerate chpax/paxctl changes. The main drawback is that
-+ extended attributes are not supported by some filesystems (e.g.,
-+ isofs, squashfs, tmpfs, udf, vfat) so copying files through such
-+ filesystems will lose the extended attributes and these PaX markings.
-+
-+ Note that if you enable the legacy EI_PAX marking support as well,
-+ the EI_PAX marks will be overridden by the XATTR_PAX_FLAGS marks.
-+
-+ If you enable both PT_PAX_FLAGS and XATTR_PAX_FLAGS support then you
-+ must make sure that the marks are the same if a binary has both marks.
-+
-+ If you enable none of the marking options then all applications
-+ will run with PaX enabled on them by default.
-+
-+choice
-+ prompt 'MAC system integration'
-+ default PAX_HAVE_ACL_FLAGS
-+ help
-+ Mandatory Access Control systems have the option of controlling
-+ PaX flags on a per executable basis, choose the method supported
-+ by your particular system.
-+
-+ - "none": if your MAC system does not interact with PaX,
-+ - "direct": if your MAC system defines pax_set_initial_flags() itself,
-+ - "hook": if your MAC system uses the pax_set_initial_flags_func callback.
-+
-+ NOTE: this option is for developers/integrators only.
-+
-+ config PAX_NO_ACL_FLAGS
-+ bool 'none'
-+
-+ config PAX_HAVE_ACL_FLAGS
-+ bool 'direct'
-+
-+ config PAX_HOOK_ACL_FLAGS
-+ bool 'hook'
-+endchoice
-+
-+endmenu
-+
-+menu "Non-executable pages"
-+ depends on PAX
-+
-+config PAX_NOEXEC
-+ bool "Enforce non-executable pages"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on ALPHA || (ARM && (CPU_V6 || CPU_V7)) || IA64 || MIPS || PARISC || PPC || S390 || SPARC || X86
-+ help
-+ By design some architectures do not allow for protecting memory
-+ pages against execution or even if they do, Linux does not make
-+ use of this feature. In practice this means that if a page is
-+ readable (such as the stack or heap) it is also executable.
-+
-+ There is a well known exploit technique that makes use of this
-+ fact and a common programming mistake where an attacker can
-+ introduce code of his choice somewhere in the attacked program's
-+ memory (typically the stack or the heap) and then execute it.
-+
-+ If the attacked program was running with different (typically
-+ higher) privileges than that of the attacker, then he can elevate
-+ his own privilege level (e.g. get a root shell, write to files for
-+ which he does not have write access to, etc).
-+
-+ Enabling this option will let you choose from various features
-+ that prevent the injection and execution of 'foreign' code in
-+ a program.
-+
-+ This will also break programs that rely on the old behaviour and
-+ expect that dynamically allocated memory via the malloc() family
-+ of functions is executable (which it is not). Notable examples
-+ are the XFree86 4.x server, the java runtime and wine.
-+
-+config PAX_PAGEEXEC
-+ bool "Paging based non-executable pages"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on PAX_NOEXEC && (!X86_32 || M586 || M586TSC || M586MMX || M686 || MPENTIUMII || MPENTIUMIII || MPENTIUMM || MCORE2 || MATOM || MPENTIUM4 || MPSC || MK7 || MK8 || MWINCHIPC6 || MWINCHIP2 || MWINCHIP3D || MVIAC3_2 || MVIAC7)
-+ select S390_SWITCH_AMODE if S390
-+ select S390_EXEC_PROTECT if S390
-+ select ARCH_TRACK_EXEC_LIMIT if X86_32
-+ help
-+ This implementation is based on the paging feature of the CPU.
-+ On i386 without hardware non-executable bit support there is a
-+ variable but usually low performance impact, however on Intel's
-+ P4 core based CPUs it is very high so you should not enable this
-+ for kernels meant to be used on such CPUs.
-+
-+ On alpha, avr32, ia64, parisc, sparc, sparc64, x86_64 and i386
-+ with hardware non-executable bit support there is no performance
-+ impact, on ppc the impact is negligible.
-+
-+ Note that several architectures require various emulations due to
-+ badly designed userland ABIs, this will cause a performance impact
-+ but will disappear as soon as userland is fixed. For example, ppc
-+ userland MUST have been built with secure-plt by a recent toolchain.
-+
-+config PAX_SEGMEXEC
-+ bool "Segmentation based non-executable pages"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on PAX_NOEXEC && X86_32
-+ help
-+ This implementation is based on the segmentation feature of the
-+ CPU and has a very small performance impact, however applications
-+ will be limited to a 1.5 GB address space instead of the normal
-+ 3 GB.
-+
-+config PAX_EMUTRAMP
-+ bool "Emulate trampolines" if (PAX_PAGEEXEC || PAX_SEGMEXEC) && (PARISC || X86)
-+ default y if PARISC
-+ help
-+ There are some programs and libraries that for one reason or
-+ another attempt to execute special small code snippets from
-+ non-executable memory pages. Most notable examples are the
-+ signal handler return code generated by the kernel itself and
-+ the GCC trampolines.
-+
-+ If you enabled CONFIG_PAX_PAGEEXEC or CONFIG_PAX_SEGMEXEC then
-+ such programs will no longer work under your kernel.
-+
-+ As a remedy you can say Y here and use the 'chpax' or 'paxctl'
-+ utilities to enable trampoline emulation for the affected programs
-+ yet still have the protection provided by the non-executable pages.
-+
-+ On parisc you MUST enable this option and EMUSIGRT as well, otherwise
-+ your system will not even boot.
-+
-+ Alternatively you can say N here and use the 'chpax' or 'paxctl'
-+ utilities to disable CONFIG_PAX_PAGEEXEC and CONFIG_PAX_SEGMEXEC
-+ for the affected files.
-+
-+ NOTE: enabling this feature *may* open up a loophole in the
-+ protection provided by non-executable pages that an attacker
-+ could abuse. Therefore the best solution is to not have any
-+ files on your system that would require this option. This can
-+ be achieved by not using libc5 (which relies on the kernel
-+ signal handler return code) and not using or rewriting programs
-+ that make use of the nested function implementation of GCC.
-+ Skilled users can just fix GCC itself so that it implements
-+ nested function calls in a way that does not interfere with PaX.
-+
-+config PAX_EMUSIGRT
-+ bool "Automatically emulate sigreturn trampolines"
-+ depends on PAX_EMUTRAMP && PARISC
-+ default y
-+ help
-+ Enabling this option will have the kernel automatically detect
-+ and emulate signal return trampolines executing on the stack
-+ that would otherwise lead to task termination.
-+
-+ This solution is intended as a temporary one for users with
-+ legacy versions of libc (libc5, glibc 2.0, uClibc before 0.9.17,
-+ Modula-3 runtime, etc) or executables linked to such, basically
-+ everything that does not specify its own SA_RESTORER function in
-+ normal executable memory like glibc 2.1+ does.
-+
-+ On parisc you MUST enable this option, otherwise your system will
-+ not even boot.
-+
-+ NOTE: this feature cannot be disabled on a per executable basis
-+ and since it *does* open up a loophole in the protection provided
-+ by non-executable pages, the best solution is to not have any
-+ files on your system that would require this option.
-+
-+config PAX_MPROTECT
-+ bool "Restrict mprotect()"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on (PAX_PAGEEXEC || PAX_SEGMEXEC)
-+ help
-+ Enabling this option will prevent programs from
-+ - changing the executable status of memory pages that were
-+ not originally created as executable,
-+ - making read-only executable pages writable again,
-+ - creating executable pages from anonymous memory,
-+ - making read-only-after-relocations (RELRO) data pages writable again.
-+
-+ You should say Y here to complete the protection provided by
-+ the enforcement of non-executable pages.
-+
-+ NOTE: you can use the 'chpax' or 'paxctl' utilities to control
-+ this feature on a per file basis.
-+
-+config PAX_MPROTECT_COMPAT
-+ bool "Use legacy/compat protection demoting (read help)"
-+ default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_DESKTOP)
-+ depends on PAX_MPROTECT
-+ help
-+ The current implementation of PAX_MPROTECT denies RWX allocations/mprotects
-+ by sending the proper error code to the application. For some broken
-+ userland, this can cause problems with Python or other applications. The
-+ current implementation however allows for applications like clamav to
-+ detect if JIT compilation/execution is allowed and to fall back gracefully
-+ to an interpreter-based mode if it does not. While we encourage everyone
-+ to use the current implementation as-is and push upstream to fix broken
-+ userland (note that the RWX logging option can assist with this), in some
-+ environments this may not be possible. Having to disable MPROTECT
-+ completely on certain binaries reduces the security benefit of PaX,
-+ so this option is provided for those environments to revert to the old
-+ behavior.
-+
-+config PAX_ELFRELOCS
-+ bool "Allow ELF text relocations (read help)"
-+ depends on PAX_MPROTECT
-+ default n
-+ help
-+ Non-executable pages and mprotect() restrictions are effective
-+ in preventing the introduction of new executable code into an
-+ attacked task's address space. There remain only two venues
-+ for this kind of attack: if the attacker can execute already
-+ existing code in the attacked task then he can either have it
-+ create and mmap() a file containing his code or have it mmap()
-+ an already existing ELF library that does not have position
-+ independent code in it and use mprotect() on it to make it
-+ writable and copy his code there. While protecting against
-+ the former approach is beyond PaX, the latter can be prevented
-+ by having only PIC ELF libraries on one's system (which do not
-+ need to relocate their code). If you are sure this is your case,
-+ as is the case with all modern Linux distributions, then leave
-+ this option disabled. You should say 'n' here.
-+
-+config PAX_ETEXECRELOCS
-+ bool "Allow ELF ET_EXEC text relocations"
-+ depends on PAX_MPROTECT && (ALPHA || IA64 || PARISC)
-+ select PAX_ELFRELOCS
-+ default y
-+ help
-+ On some architectures there are incorrectly created applications
-+ that require text relocations and would not work without enabling
-+ this option. If you are an alpha, ia64 or parisc user, you should
-+ enable this option and disable it once you have made sure that
-+ none of your applications need it.
-+
-+config PAX_EMUPLT
-+ bool "Automatically emulate ELF PLT"
-+ depends on PAX_MPROTECT && (ALPHA || PARISC || SPARC)
-+ default y
-+ help
-+ Enabling this option will have the kernel automatically detect
-+ and emulate the Procedure Linkage Table entries in ELF files.
-+ On some architectures such entries are in writable memory, and
-+ become non-executable leading to task termination. Therefore
-+ it is mandatory that you enable this option on alpha, parisc,
-+ sparc and sparc64, otherwise your system would not even boot.
-+
-+ NOTE: this feature *does* open up a loophole in the protection
-+ provided by the non-executable pages, therefore the proper
-+ solution is to modify the toolchain to produce a PLT that does
-+ not need to be writable.
-+
-+config PAX_DLRESOLVE
-+ bool 'Emulate old glibc resolver stub'
-+ depends on PAX_EMUPLT && SPARC
-+ default n
-+ help
-+ This option is needed if userland has an old glibc (before 2.4)
-+ that puts a 'save' instruction into the runtime generated resolver
-+ stub that needs special emulation.
-+
-+config PAX_KERNEXEC
-+ bool "Enforce non-executable kernel pages"
-+ default y if GRKERNSEC_CONFIG_AUTO && (GRKERNSEC_CONFIG_VIRT_NONE || (GRKERNSEC_CONFIG_VIRT_EPT && GRKERNSEC_CONFIG_VIRT_GUEST) || (GRKERNSEC_CONFIG_VIRT_EPT && GRKERNSEC_CONFIG_VIRT_KVM))
-+ depends on X86 && !XEN && (!X86_32 || X86_WP_WORKS_OK)
-+ select PAX_PER_CPU_PGD if X86_64 || (X86_32 && X86_PAE)
-+ select PAX_KERNEXEC_PLUGIN if X86_64
-+ help
-+ This is the kernel land equivalent of PAGEEXEC and MPROTECT,
-+ that is, enabling this option will make it harder to inject
-+ and execute 'foreign' code in kernel memory itself.
-+
-+choice
-+ prompt "Return Address Instrumentation Method"
-+ default PAX_KERNEXEC_PLUGIN_METHOD_BTS
-+ depends on PAX_KERNEXEC_PLUGIN
-+ help
-+ Select the method used to instrument function pointer dereferences.
-+ Note that binary modules cannot be instrumented by this approach.
-+
-+ Note that the implementation requires a gcc with plugin support,
-+ i.e., gcc 4.5 or newer. You may need to install the supporting
-+ headers explicitly in addition to the normal gcc package.
-+
-+ config PAX_KERNEXEC_PLUGIN_METHOD_BTS
-+ bool "bts"
-+ help
-+ This method is compatible with binary only modules but has
-+ a higher runtime overhead.
-+
-+ config PAX_KERNEXEC_PLUGIN_METHOD_OR
-+ bool "or"
-+ depends on !PARAVIRT
-+ help
-+ This method is incompatible with binary only modules but has
-+ a lower runtime overhead.
-+endchoice
-+
-+config PAX_KERNEXEC_PLUGIN_METHOD
-+ string
-+ default "bts" if PAX_KERNEXEC_PLUGIN_METHOD_BTS
-+ default "or" if PAX_KERNEXEC_PLUGIN_METHOD_OR
-+ default ""
-+
-+config PAX_KERNEXEC_MODULE_TEXT
-+ int "Minimum amount of memory reserved for module code"
-+ default "4" if (!GRKERNSEC_CONFIG_AUTO || GRKERNSEC_CONFIG_SERVER)
-+ default "12" if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_DESKTOP)
-+ depends on PAX_KERNEXEC && X86_32 && MODULES
-+ help
-+ Due to implementation details the kernel must reserve a fixed
-+ amount of memory for module code at compile time that cannot be
-+ changed at runtime. Here you can specify the minimum amount
-+ in MB that will be reserved. Due to the same implementation
-+ details this size will always be rounded up to the next 2/4 MB
-+ boundary (depends on PAE) so the actually available memory for
-+ module code will usually be more than this minimum.
-+
-+ The default 4 MB should be enough for most users but if you have
-+ an excessive number of modules (e.g., most distribution configs
-+ compile many drivers as modules) or use huge modules such as
-+ nvidia's kernel driver, you will need to adjust this amount.
-+ A good rule of thumb is to look at your currently loaded kernel
-+ modules and add up their sizes.
-+
-+endmenu
-+
-+menu "Address Space Layout Randomization"
-+ depends on PAX
-+
-+config PAX_ASLR
-+ bool "Address Space Layout Randomization"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ Many if not most exploit techniques rely on the knowledge of
-+ certain addresses in the attacked program. The following options
-+ will allow the kernel to apply a certain amount of randomization
-+ to specific parts of the program thereby forcing an attacker to
-+ guess them in most cases. Any failed guess will most likely crash
-+ the attacked program which allows the kernel to detect such attempts
-+ and react on them. PaX itself provides no reaction mechanisms,
-+ instead it is strongly encouraged that you make use of Nergal's
-+ segvguard (ftp://ftp.pl.openwall.com/misc/segvguard/) or grsecurity's
-+ (http://www.grsecurity.net/) built-in crash detection features or
-+ develop one yourself.
-+
-+ By saying Y here you can choose to randomize the following areas:
-+ - top of the task's kernel stack
-+ - top of the task's userland stack
-+ - base address for mmap() requests that do not specify one
-+ (this includes all libraries)
-+ - base address of the main executable
-+
-+ It is strongly recommended to say Y here as address space layout
-+ randomization has negligible impact on performance yet it provides
-+ a very effective protection.
-+
-+ NOTE: you can use the 'chpax' or 'paxctl' utilities to control
-+ this feature on a per file basis.
-+
-+config PAX_RANDKSTACK
-+ bool "Randomize kernel stack base"
-+ default y if GRKERNSEC_CONFIG_AUTO && !(GRKERNSEC_CONFIG_VIRT_HOST && GRKERNSEC_CONFIG_VIRT_VIRTUALBOX)
-+ depends on X86_TSC && X86
-+ help
-+ By saying Y here the kernel will randomize every task's kernel
-+ stack on every system call. This will not only force an attacker
-+ to guess it but also prevent him from making use of possible
-+ leaked information about it.
-+
-+ Since the kernel stack is a rather scarce resource, randomization
-+ may cause unexpected stack overflows, therefore you should very
-+ carefully test your system. Note that once enabled in the kernel
-+ configuration, this feature cannot be disabled on a per file basis.
-+
-+config PAX_RANDUSTACK
-+ bool "Randomize user stack base"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on PAX_ASLR
-+ help
-+ By saying Y here the kernel will randomize every task's userland
-+ stack. The randomization is done in two steps where the second
-+ one may apply a big amount of shift to the top of the stack and
-+ cause problems for programs that want to use lots of memory (more
-+ than 2.5 GB if SEGMEXEC is not active, or 1.25 GB when it is).
-+ For this reason the second step can be controlled by 'chpax' or
-+ 'paxctl' on a per file basis.
-+
-+config PAX_RANDMMAP
-+ bool "Randomize mmap() base"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on PAX_ASLR
-+ help
-+ By saying Y here the kernel will use a randomized base address for
-+ mmap() requests that do not specify one themselves. As a result
-+ all dynamically loaded libraries will appear at random addresses
-+ and therefore be harder to exploit by a technique where an attacker
-+ attempts to execute library code for his purposes (e.g. spawn a
-+ shell from an exploited program that is running at an elevated
-+ privilege level).
-+
-+ Furthermore, if a program is relinked as a dynamic ELF file, its
-+ base address will be randomized as well, completing the full
-+ randomization of the address space layout. Attacking such programs
-+ becomes a guess game. You can find an example of doing this at
-+ http://pax.grsecurity.net/et_dyn.tar.gz and practical samples at
-+ http://www.grsecurity.net/grsec-gcc-specs.tar.gz .
-+
-+ NOTE: you can use the 'chpax' or 'paxctl' utilities to control this
-+ feature on a per file basis.
-+
-+endmenu
-+
-+menu "Miscellaneous hardening features"
-+
-+config PAX_MEMORY_SANITIZE
-+ bool "Sanitize all freed memory"
-+ default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_PRIORITY_SECURITY)
-+ depends on !HIBERNATION
-+ help
-+ By saying Y here the kernel will erase memory pages as soon as they
-+ are freed. This in turn reduces the lifetime of data stored in the
-+ pages, making it less likely that sensitive information such as
-+ passwords, cryptographic secrets, etc stay in memory for too long.
-+
-+ This is especially useful for programs whose runtime is short, long
-+ lived processes and the kernel itself benefit from this as long as
-+ they operate on whole memory pages and ensure timely freeing of pages
-+ that may hold sensitive information.
-+
-+ The tradeoff is performance impact, on a single CPU system kernel
-+ compilation sees a 3% slowdown, other systems and workloads may vary
-+ and you are advised to test this feature on your expected workload
-+ before deploying it.
-+
-+ Note that this feature does not protect data stored in live pages,
-+ e.g., process memory swapped to disk may stay there for a long time.
-+
-+config PAX_MEMORY_STACKLEAK
-+ bool "Sanitize kernel stack"
-+ default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_PRIORITY_SECURITY)
-+ depends on X86
-+ help
-+ By saying Y here the kernel will erase the kernel stack before it
-+ returns from a system call. This in turn reduces the information
-+ that a kernel stack leak bug can reveal.
-+
-+ Note that such a bug can still leak information that was put on
-+ the stack by the current system call (the one eventually triggering
-+ the bug) but traces of earlier system calls on the kernel stack
-+ cannot leak anymore.
-+
-+ The tradeoff is performance impact, on a single CPU system kernel
-+ compilation sees a 1% slowdown, other systems and workloads may vary
-+ and you are advised to test this feature on your expected workload
-+ before deploying it.
-+
-+ Note that the full feature requires a gcc with plugin support,
-+ i.e., gcc 4.5 or newer. You may need to install the supporting
-+ headers explicitly in addition to the normal gcc package. Using
-+ older gcc versions means that functions with large enough stack
-+ frames may leave uninitialized memory behind that may be exposed
-+ to a later syscall leaking the stack.
-+
-+config PAX_MEMORY_UDEREF
-+ bool "Prevent invalid userland pointer dereference"
-+ default y if GRKERNSEC_CONFIG_AUTO && (X86_32 || (X86_64 && GRKERNSEC_CONFIG_PRIORITY_SECURITY)) && (GRKERNSEC_CONFIG_VIRT_NONE || GRKERNSEC_CONFIG_VIRT_EPT)
-+ depends on X86 && !UML_X86 && !XEN
-+ select PAX_PER_CPU_PGD if X86_64
-+ help
-+ By saying Y here the kernel will be prevented from dereferencing
-+ userland pointers in contexts where the kernel expects only kernel
-+ pointers. This is both a useful runtime debugging feature and a
-+ security measure that prevents exploiting a class of kernel bugs.
-+
-+ The tradeoff is that some virtualization solutions may experience
-+ a huge slowdown and therefore you should not enable this feature
-+ for kernels meant to run in such environments. Whether a given VM
-+ solution is affected or not is best determined by simply trying it
-+ out, the performance impact will be obvious right on boot as this
-+ mechanism engages from very early on. A good rule of thumb is that
-+ VMs running on CPUs without hardware virtualization support (i.e.,
-+ the majority of IA-32 CPUs) will likely experience the slowdown.
-+
-+config PAX_REFCOUNT
-+ bool "Prevent various kernel object reference counter overflows"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC && ((ARM && (CPU_32v6 || CPU_32v6K || CPU_32v7)) || SPARC64 || X86)
-+ help
-+ By saying Y here the kernel will detect and prevent overflowing
-+ various (but not all) kinds of object reference counters. Such
-+ overflows can normally occur due to bugs only and are often, if
-+ not always, exploitable.
-+
-+ The tradeoff is that data structures protected by an overflowed
-+ refcount will never be freed and therefore will leak memory. Note
-+ that this leak also happens even without this protection but in
-+ that case the overflow can eventually trigger the freeing of the
-+ data structure while it is still being used elsewhere, resulting
-+ in the exploitable situation that this feature prevents.
-+
-+ Since this has a negligible performance impact, you should enable
-+ this feature.
-+
-+config PAX_USERCOPY
-+ bool "Harden heap object copies between kernel and userland"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on ARM || IA64 || PPC || SPARC || X86
-+ depends on GRKERNSEC && (SLAB || SLUB || SLOB)
-+ select PAX_USERCOPY_SLABS
-+ help
-+ By saying Y here the kernel will enforce the size of heap objects
-+ when they are copied in either direction between the kernel and
-+ userland, even if only a part of the heap object is copied.
-+
-+ Specifically, this checking prevents information leaking from the
-+ kernel heap during kernel to userland copies (if the kernel heap
-+ object is otherwise fully initialized) and prevents kernel heap
-+ overflows during userland to kernel copies.
-+
-+ Note that the current implementation provides the strictest bounds
-+ checks for the SLUB allocator.
-+
-+ Enabling this option also enables per-slab cache protection against
-+ data in a given cache being copied into/out of via userland
-+ accessors. Though the whitelist of regions will be reduced over
-+ time, it notably protects important data structures like task structs.
-+
-+ Since this has a negligible performance impact, you should enable
-+ this feature.
-+
-+
-+config PAX_USERCOPY_DEBUG
-+ bool
-+ depends on X86 && PAX_USERCOPY
-+ default n
-+
-+config PAX_SIZE_OVERFLOW
-+ bool "Prevent various integer overflows in function size parameters"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on X86
-+ help
-+ By saying Y here the kernel recomputes expressions of function
-+ arguments marked by a size_overflow attribute with double integer
-+ precision (DImode/TImode for 32/64 bit integer types).
-+
-+ The recomputed argument is checked against TYPE_MAX and an event
-+ is logged on overflow and the triggering process is killed.
-+
-+ Homepage: http://www.grsecurity.net/~ephox/overflow_plugin/
-+
-+ Note that the implementation requires a gcc with plugin support,
-+ i.e., gcc 4.5 or newer. You may need to install the supporting
-+ headers explicitly in addition to the normal gcc package.
-+
-+config PAX_LATENT_ENTROPY
-+ bool "Generate some entropy during boot"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ By saying Y here the kernel will instrument early boot code to
-+ extract some entropy from both original and artificially created
-+ program state. This will help especially embedded systems where
-+ there is little 'natural' source of entropy normally. The cost
-+ is some slowdown of the boot process.
-+
-+ Note that the implementation requires a gcc with plugin support,
-+ i.e., gcc 4.5 or newer. You may need to install the supporting
-+ headers explicitly in addition to the normal gcc package.
-+
-+ Note that entropy extracted this way is not cryptographically
-+ secure!
-+
-+endmenu
-+
-+endmenu
-+
-+source grsecurity/Kconfig
-+
-+endmenu
-+
-+endmenu
-+
- config KEYS
- bool "Enable access key retention support"
- help
-@@ -146,7 +1037,7 @@ config INTEL_TXT
- config LSM_MMAP_MIN_ADDR
- int "Low address space for LSM to protect from user allocation"
- depends on SECURITY && SECURITY_SELINUX
-- default 65536
-+ default 32768
- help
- This is the portion of low virtual memory which should be protected
- from userspace allocation. Keeping a user from writing to low pages
-diff --git a/security/capability.c b/security/capability.c
-index fce07a7..5f12858 100644
---- a/security/capability.c
-+++ b/security/capability.c
-@@ -890,7 +890,7 @@ static void cap_audit_rule_free(void *lsmrule)
- }
- #endif /* CONFIG_AUDIT */
-
--struct security_operations default_security_ops = {
-+struct security_operations default_security_ops __read_only = {
- .name = "default",
- };
-
-diff --git a/security/commoncap.c b/security/commoncap.c
-index ee9d623..11b4a78 100644
---- a/security/commoncap.c
-+++ b/security/commoncap.c
-@@ -27,7 +27,9 @@
- #include <linux/sched.h>
- #include <linux/prctl.h>
- #include <linux/securebits.h>
-+#include <linux/syslog.h>
- #include <linux/personality.h>
-+#include <net/sock.h>
-
- /*
- * If a non-root user executes a setuid-root binary in
-@@ -51,9 +53,18 @@ static void warn_setuid_and_fcaps_mixed(char *fname)
- }
- }
-
-+#ifdef CONFIG_NET
-+extern kernel_cap_t gr_cap_rtnetlink(struct sock *sk);
-+#endif
-+
- int cap_netlink_send(struct sock *sk, struct sk_buff *skb)
- {
-+#ifdef CONFIG_NET
-+ NETLINK_CB(skb).eff_cap = gr_cap_rtnetlink(sk);
-+#else
- NETLINK_CB(skb).eff_cap = current_cap();
-+#endif
-+
- return 0;
- }
-
-@@ -240,6 +251,45 @@ static inline void bprm_clear_caps(struct linux_binprm *bprm)
- bprm->cap_effective = false;
- }
-
-+/* returns:
-+ 1 for suid privilege
-+ 2 for sgid privilege
-+ 3 for fscap privilege
-+*/
-+int is_privileged_binary(const struct dentry *dentry)
-+{
-+ struct cpu_vfs_cap_data capdata;
-+ struct inode *inode = dentry->d_inode;
-+
-+ if (!inode || S_ISDIR(inode->i_mode))
-+ return 0;
-+
-+ if (inode->i_mode & S_ISUID)
-+ return 1;
-+ if ((inode->i_mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))
-+ return 2;
-+
-+ if (!get_vfs_caps_from_disk(dentry, &capdata)) {
-+ if (!cap_isclear(capdata.inheritable) || !cap_isclear(capdata.permitted))
-+ return 3;
-+ }
-+
-+ return 0;
-+}
-+
-+/* returns 1 for suid root privilege
-+ returns 3 for fscap privilege
-+*/
-+int is_root_privileged_binary(const struct dentry *dentry)
-+{
-+ int ret = is_privileged_binary(dentry);
-+ if (ret == 3)
-+ return ret;
-+ if (ret == 1 && dentry->d_inode->i_uid == 0)
-+ return ret;
-+ return 0;
-+}
-+
- #ifdef CONFIG_SECURITY_FILE_CAPABILITIES
-
- /**
-@@ -588,6 +638,9 @@ int cap_bprm_secureexec(struct linux_binprm *bprm)
- {
- const struct cred *cred = current_cred();
-
-+ if (gr_acl_enable_at_secure())
-+ return 1;
-+
- if (cred->uid != 0) {
- if (bprm->cap_effective)
- return 1;
-@@ -962,13 +1015,18 @@ error:
- /**
- * cap_syslog - Determine whether syslog function is permitted
- * @type: Function requested
-+ * @from_file: Whether this request came from an open file (i.e. /proc)
- *
- * Determine whether the current process is permitted to use a particular
- * syslog function, returning 0 if permission is granted, -ve if not.
- */
--int cap_syslog(int type)
-+int cap_syslog(int type, bool from_file)
- {
-- if ((type != 3 && type != 10) && !capable(CAP_SYS_ADMIN))
-+ /* /proc/kmsg can open be opened by CAP_SYS_ADMIN */
-+ if (type != SYSLOG_ACTION_OPEN && from_file)
-+ return 0;
-+ if ((type != SYSLOG_ACTION_READ_ALL &&
-+ type != SYSLOG_ACTION_SIZE_BUFFER) && !capable(CAP_SYS_ADMIN))
- return -EPERM;
- return 0;
- }
-diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
-index 165eb53..b1db4eb 100644
---- a/security/integrity/ima/ima.h
-+++ b/security/integrity/ima/ima.h
-@@ -84,8 +84,8 @@ void ima_add_violation(struct inode *inode, const unsigned char *filename,
- extern spinlock_t ima_queue_lock;
-
- struct ima_h_table {
-- atomic_long_t len; /* number of stored measurements in the list */
-- atomic_long_t violations;
-+ atomic_long_unchecked_t len; /* number of stored measurements in the list */
-+ atomic_long_unchecked_t violations;
- struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE];
- };
- extern struct ima_h_table ima_htable;
-diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
-index 852bf85..35d6df3 100644
---- a/security/integrity/ima/ima_api.c
-+++ b/security/integrity/ima/ima_api.c
-@@ -74,7 +74,7 @@ void ima_add_violation(struct inode *inode, const unsigned char *filename,
- int result;
-
- /* can overflow, only indicator */
-- atomic_long_inc(&ima_htable.violations);
-+ atomic_long_inc_unchecked(&ima_htable.violations);
-
- entry = kmalloc(sizeof(*entry), GFP_KERNEL);
- if (!entry) {
-diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
-index 0c72c9c..433e29b 100644
---- a/security/integrity/ima/ima_fs.c
-+++ b/security/integrity/ima/ima_fs.c
-@@ -27,12 +27,12 @@
- static int valid_policy = 1;
- #define TMPBUFLEN 12
- static ssize_t ima_show_htable_value(char __user *buf, size_t count,
-- loff_t *ppos, atomic_long_t *val)
-+ loff_t *ppos, atomic_long_unchecked_t *val)
- {
- char tmpbuf[TMPBUFLEN];
- ssize_t len;
-
-- len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read(val));
-+ len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read_unchecked(val));
- return simple_read_from_buffer(buf, count, ppos, tmpbuf, len);
- }
-
-diff --git a/security/integrity/ima/ima_queue.c b/security/integrity/ima/ima_queue.c
-index e19316d..339f7ae 100644
---- a/security/integrity/ima/ima_queue.c
-+++ b/security/integrity/ima/ima_queue.c
-@@ -78,7 +78,7 @@ static int ima_add_digest_entry(struct ima_template_entry *entry)
- INIT_LIST_HEAD(&qe->later);
- list_add_tail_rcu(&qe->later, &ima_measurements);
-
-- atomic_long_inc(&ima_htable.len);
-+ atomic_long_inc_unchecked(&ima_htable.len);
- key = ima_hash_key(entry->digest);
- hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]);
- return 0;
-diff --git a/security/keys/keyring.c b/security/keys/keyring.c
-index e031952..c9a535d 100644
---- a/security/keys/keyring.c
-+++ b/security/keys/keyring.c
-@@ -214,15 +214,15 @@ static long keyring_read(const struct key *keyring,
- ret = -EFAULT;
-
- for (loop = 0; loop < klist->nkeys; loop++) {
-+ key_serial_t serial;
- key = klist->keys[loop];
-+ serial = key->serial;
-
- tmp = sizeof(key_serial_t);
- if (tmp > buflen)
- tmp = buflen;
-
-- if (copy_to_user(buffer,
-- &key->serial,
-- tmp) != 0)
-+ if (copy_to_user(buffer, &serial, tmp))
- goto error;
-
- buflen -= tmp;
-diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
-index 75fb18c..01983fb 100644
---- a/security/keys/process_keys.c
-+++ b/security/keys/process_keys.c
-@@ -208,7 +208,7 @@ static int install_process_keyring(void)
- ret = install_process_keyring_to_cred(new);
- if (ret < 0) {
- abort_creds(new);
-- return ret != -EEXIST ?: 0;
-+ return ret != -EEXIST ? ret : 0;
- }
-
- return commit_creds(new);
-diff --git a/security/min_addr.c b/security/min_addr.c
-index d9f9425..c28cef4 100644
---- a/security/min_addr.c
-+++ b/security/min_addr.c
-@@ -14,6 +14,7 @@ unsigned long dac_mmap_min_addr = CONFIG_DEFAULT_MMAP_MIN_ADDR;
- */
- static void update_mmap_min_addr(void)
- {
-+#ifndef SPARC
- #ifdef CONFIG_LSM_MMAP_MIN_ADDR
- if (dac_mmap_min_addr > CONFIG_LSM_MMAP_MIN_ADDR)
- mmap_min_addr = dac_mmap_min_addr;
-@@ -22,6 +23,7 @@ static void update_mmap_min_addr(void)
- #else
- mmap_min_addr = dac_mmap_min_addr;
- #endif
-+#endif
- }
-
- /*
-diff --git a/security/root_plug.c b/security/root_plug.c
-index 2f7ffa6..0455400 100644
---- a/security/root_plug.c
-+++ b/security/root_plug.c
-@@ -70,7 +70,7 @@ static int rootplug_bprm_check_security (struct linux_binprm *bprm)
- return 0;
- }
-
--static struct security_operations rootplug_security_ops = {
-+static struct security_operations rootplug_security_ops __read_only = {
- .bprm_check_security = rootplug_bprm_check_security,
- };
-
-diff --git a/security/security.c b/security/security.c
-index c4c6732..5ee1542 100644
---- a/security/security.c
-+++ b/security/security.c
-@@ -24,7 +24,7 @@ static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1];
- extern struct security_operations default_security_ops;
- extern void security_fixup_ops(struct security_operations *ops);
-
--struct security_operations *security_ops; /* Initialized to NULL */
-+struct security_operations *security_ops __read_only; /* Initialized to NULL */
-
- static inline int verify(struct security_operations *ops)
- {
-@@ -106,7 +106,7 @@ int __init security_module_enable(struct security_operations *ops)
- * If there is already a security module registered with the kernel,
- * an error will be returned. Otherwise %0 is returned on success.
- */
--int register_security(struct security_operations *ops)
-+int __init register_security(struct security_operations *ops)
- {
- if (verify(ops)) {
- printk(KERN_DEBUG "%s could not verify "
-@@ -157,6 +157,12 @@ int security_capable(int cap)
- SECURITY_CAP_AUDIT);
- }
-
-+int security_capable_noaudit(int cap)
-+{
-+ return security_ops->capable(current, current_cred(), cap,
-+ SECURITY_CAP_NOAUDIT);
-+}
-+
- int security_real_capable(struct task_struct *tsk, int cap)
- {
- const struct cred *cred;
-@@ -199,9 +205,9 @@ int security_quota_on(struct dentry *dentry)
- return security_ops->quota_on(dentry);
- }
-
--int security_syslog(int type)
-+int security_syslog(int type, bool from_file)
- {
-- return security_ops->syslog(type);
-+ return security_ops->syslog(type, from_file);
- }
-
- int security_settime(struct timespec *ts, struct timezone *tz)
-diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
-index a106754..2e5d3f8 100644
---- a/security/selinux/hooks.c
-+++ b/security/selinux/hooks.c
-@@ -76,6 +76,7 @@
- #include <linux/selinux.h>
- #include <linux/mutex.h>
- #include <linux/posix-timers.h>
-+#include <linux/syslog.h>
-
- #include "avc.h"
- #include "objsec.h"
-@@ -131,7 +132,7 @@ int selinux_enabled = 1;
- * Minimal support for a secondary security module,
- * just to allow the use of the capability module.
- */
--static struct security_operations *secondary_ops;
-+static struct security_operations *secondary_ops __read_only;
-
- /* Lists of inode and superblock security structures initialized
- before the policy was loaded. */
-@@ -2050,29 +2051,30 @@ static int selinux_quota_on(struct dentry *dentry)
- return dentry_has_perm(cred, NULL, dentry, FILE__QUOTAON);
- }
-
--static int selinux_syslog(int type)
-+static int selinux_syslog(int type, bool from_file)
- {
- int rc;
-
-- rc = cap_syslog(type);
-+ rc = cap_syslog(type, from_file);
- if (rc)
- return rc;
-
- switch (type) {
-- case 3: /* Read last kernel messages */
-- case 10: /* Return size of the log buffer */
-+ case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
-+ case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
- rc = task_has_system(current, SYSTEM__SYSLOG_READ);
- break;
-- case 6: /* Disable logging to console */
-- case 7: /* Enable logging to console */
-- case 8: /* Set level of messages printed to console */
-+ case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
-+ case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
-+ /* Set level of messages printed to console */
-+ case SYSLOG_ACTION_CONSOLE_LEVEL:
- rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
- break;
-- case 0: /* Close log */
-- case 1: /* Open log */
-- case 2: /* Read from log */
-- case 4: /* Read/clear last kernel messages */
-- case 5: /* Clear ring buffer */
-+ case SYSLOG_ACTION_CLOSE: /* Close log */
-+ case SYSLOG_ACTION_OPEN: /* Open log */
-+ case SYSLOG_ACTION_READ: /* Read from log */
-+ case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
-+ case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
- default:
- rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
- break;
-@@ -2366,7 +2368,7 @@ static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
- initrlim = init_task.signal->rlim + i;
- rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
- }
-- update_rlimit_cpu(current->signal->rlim[RLIMIT_CPU].rlim_cur);
-+ update_rlimit_cpu(current, current->signal->rlim[RLIMIT_CPU].rlim_cur);
- }
- }
-
-@@ -4174,8 +4176,10 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
- }
- err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
- PEER__RECV, &ad);
-- if (err)
-+ if (err) {
- selinux_netlbl_err(skb, err, 0);
-+ return err;
-+ }
- }
-
- if (secmark_active) {
-@@ -5321,11 +5325,11 @@ static int selinux_setprocattr(struct task_struct *p,
- /* Check for ptracing, and update the task SID if ok.
- Otherwise, leave SID unchanged and fail. */
- ptsid = 0;
-- task_lock(p);
-+ rcu_read_lock();
- tracer = tracehook_tracer_task(p);
- if (tracer)
- ptsid = task_sid(tracer);
-- task_unlock(p);
-+ rcu_read_unlock();
-
- if (tracer) {
- error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
-@@ -5457,7 +5461,7 @@ static int selinux_key_getsecurity(struct key *key, char **_buffer)
-
- #endif
-
--static struct security_operations selinux_ops = {
-+static struct security_operations selinux_ops __read_only = {
- .name = "selinux",
-
- .ptrace_access_check = selinux_ptrace_access_check,
-@@ -5841,7 +5845,9 @@ int selinux_disable(void)
- avc_disable();
-
- /* Reset security_ops to the secondary module, dummy or capability. */
-+ pax_open_kernel();
- security_ops = secondary_ops;
-+ pax_close_kernel();
-
- /* Unregister netfilter hooks. */
- selinux_nf_ip_exit();
-diff --git a/security/selinux/include/xfrm.h b/security/selinux/include/xfrm.h
-index 13128f9..c23c736 100644
---- a/security/selinux/include/xfrm.h
-+++ b/security/selinux/include/xfrm.h
-@@ -48,7 +48,7 @@ int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall);
-
- static inline void selinux_xfrm_notify_policyload(void)
- {
-- atomic_inc(&flow_cache_genid);
-+ atomic_inc_unchecked(&flow_cache_genid);
- }
- #else
- static inline int selinux_xfrm_enabled(void)
-diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
-index ff17820..d68084c 100644
---- a/security/selinux/ss/services.c
-+++ b/security/selinux/ss/services.c
-@@ -1715,6 +1715,8 @@ int security_load_policy(void *data, size_t len)
- int rc = 0;
- struct policy_file file = { data, len }, *fp = &file;
-
-+ pax_track_stack();
-+
- if (!ss_initialized) {
- avtab_cache_init();
- if (policydb_read(&policydb, fp)) {
-diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c
-index f3cb9ed..22c91e3 100644
---- a/security/selinux/xfrm.c
-+++ b/security/selinux/xfrm.c
-@@ -309,7 +309,7 @@ int selinux_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,
-
- if (old_ctx) {
- new_ctx = kmalloc(sizeof(*old_ctx) + old_ctx->ctx_len,
-- GFP_KERNEL);
-+ GFP_ATOMIC);
- if (!new_ctx)
- return -ENOMEM;
-
-diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
-index c33b6bb..b51f19e 100644
---- a/security/smack/smack_lsm.c
-+++ b/security/smack/smack_lsm.c
-@@ -157,12 +157,12 @@ static int smack_ptrace_traceme(struct task_struct *ptp)
- *
- * Returns 0 on success, error code otherwise.
- */
--static int smack_syslog(int type)
-+static int smack_syslog(int type, bool from_file)
- {
- int rc;
- char *sp = current_security();
-
-- rc = cap_syslog(type);
-+ rc = cap_syslog(type, from_file);
- if (rc != 0)
- return rc;
-
-@@ -3073,7 +3073,7 @@ static int smack_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
- return 0;
- }
-
--struct security_operations smack_ops = {
-+struct security_operations smack_ops __read_only = {
- .name = "smack",
-
- .ptrace_access_check = smack_ptrace_access_check,
-diff --git a/security/tomoyo/tomoyo.c b/security/tomoyo/tomoyo.c
-index 9548a09..9a5f384 100644
---- a/security/tomoyo/tomoyo.c
-+++ b/security/tomoyo/tomoyo.c
-@@ -275,7 +275,7 @@ static int tomoyo_dentry_open(struct file *f, const struct cred *cred)
- * tomoyo_security_ops is a "struct security_operations" which is used for
- * registering TOMOYO.
- */
--static struct security_operations tomoyo_security_ops = {
-+static struct security_operations tomoyo_security_ops __read_only = {
- .name = "tomoyo",
- .cred_alloc_blank = tomoyo_cred_alloc_blank,
- .cred_prepare = tomoyo_cred_prepare,
-diff --git a/sound/aoa/codecs/onyx.c b/sound/aoa/codecs/onyx.c
-index 84bb07d..c2ab6b6 100644
---- a/sound/aoa/codecs/onyx.c
-+++ b/sound/aoa/codecs/onyx.c
-@@ -53,7 +53,7 @@ struct onyx {
- spdif_locked:1,
- analog_locked:1,
- original_mute:2;
-- int open_count;
-+ local_t open_count;
- struct codec_info *codec_info;
-
- /* mutex serializes concurrent access to the device
-@@ -752,7 +752,7 @@ static int onyx_open(struct codec_info_item *cii,
- struct onyx *onyx = cii->codec_data;
-
- mutex_lock(&onyx->mutex);
-- onyx->open_count++;
-+ local_inc(&onyx->open_count);
- mutex_unlock(&onyx->mutex);
-
- return 0;
-@@ -764,8 +764,7 @@ static int onyx_close(struct codec_info_item *cii,
- struct onyx *onyx = cii->codec_data;
-
- mutex_lock(&onyx->mutex);
-- onyx->open_count--;
-- if (!onyx->open_count)
-+ if (local_dec_and_test(&onyx->open_count))
- onyx->spdif_locked = onyx->analog_locked = 0;
- mutex_unlock(&onyx->mutex);
-
-diff --git a/sound/aoa/codecs/onyx.h b/sound/aoa/codecs/onyx.h
-index ffd2025..df062c9 100644
---- a/sound/aoa/codecs/onyx.h
-+++ b/sound/aoa/codecs/onyx.h
-@@ -11,6 +11,7 @@
- #include <linux/i2c.h>
- #include <asm/pmac_low_i2c.h>
- #include <asm/prom.h>
-+#include <asm/local.h>
-
- /* PCM3052 register definitions */
-
-diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
-index d9c9635..bc0a5a2 100644
---- a/sound/core/oss/pcm_oss.c
-+++ b/sound/core/oss/pcm_oss.c
-@@ -1395,7 +1395,7 @@ static ssize_t snd_pcm_oss_write1(struct snd_pcm_substream *substream, const cha
- }
- } else {
- tmp = snd_pcm_oss_write2(substream,
-- (const char __force *)buf,
-+ (const char __force_kernel *)buf,
- runtime->oss.period_bytes, 0);
- if (tmp <= 0)
- goto err;
-@@ -1483,7 +1483,7 @@ static ssize_t snd_pcm_oss_read1(struct snd_pcm_substream *substream, char __use
- xfer += tmp;
- runtime->oss.buffer_used -= tmp;
- } else {
-- tmp = snd_pcm_oss_read2(substream, (char __force *)buf,
-+ tmp = snd_pcm_oss_read2(substream, (char __force_kernel *)buf,
- runtime->oss.period_bytes, 0);
- if (tmp <= 0)
- goto err;
-diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c
-index 038232d..7dd9e5c 100644
---- a/sound/core/pcm_compat.c
-+++ b/sound/core/pcm_compat.c
-@@ -30,7 +30,7 @@ static int snd_pcm_ioctl_delay_compat(struct snd_pcm_substream *substream,
- int err;
-
- fs = snd_enter_user();
-- err = snd_pcm_delay(substream, &delay);
-+ err = snd_pcm_delay(substream, (snd_pcm_sframes_t __force_user *)&delay);
- snd_leave_user(fs);
- if (err < 0)
- return err;
-diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
-index e6d2d97..4843949 100644
---- a/sound/core/pcm_native.c
-+++ b/sound/core/pcm_native.c
-@@ -2747,11 +2747,11 @@ int snd_pcm_kernel_ioctl(struct snd_pcm_substream *substream,
- switch (substream->stream) {
- case SNDRV_PCM_STREAM_PLAYBACK:
- result = snd_pcm_playback_ioctl1(NULL, substream, cmd,
-- (void __user *)arg);
-+ (void __force_user *)arg);
- break;
- case SNDRV_PCM_STREAM_CAPTURE:
- result = snd_pcm_capture_ioctl1(NULL, substream, cmd,
-- (void __user *)arg);
-+ (void __force_user *)arg);
- break;
- default:
- result = -EINVAL;
-diff --git a/sound/core/seq/seq_device.c b/sound/core/seq/seq_device.c
-index 1f99767..14636533 100644
---- a/sound/core/seq/seq_device.c
-+++ b/sound/core/seq/seq_device.c
-@@ -63,7 +63,7 @@ struct ops_list {
- int argsize; /* argument size */
-
- /* operators */
-- struct snd_seq_dev_ops ops;
-+ struct snd_seq_dev_ops *ops;
-
- /* registred devices */
- struct list_head dev_list; /* list of devices */
-@@ -332,7 +332,7 @@ int snd_seq_device_register_driver(char *id, struct snd_seq_dev_ops *entry,
-
- mutex_lock(&ops->reg_mutex);
- /* copy driver operators */
-- ops->ops = *entry;
-+ ops->ops = entry;
- ops->driver |= DRIVER_LOADED;
- ops->argsize = argsize;
-
-@@ -462,7 +462,7 @@ static int init_device(struct snd_seq_device *dev, struct ops_list *ops)
- dev->name, ops->id, ops->argsize, dev->argsize);
- return -EINVAL;
- }
-- if (ops->ops.init_device(dev) >= 0) {
-+ if (ops->ops->init_device(dev) >= 0) {
- dev->status = SNDRV_SEQ_DEVICE_REGISTERED;
- ops->num_init_devices++;
- } else {
-@@ -489,7 +489,7 @@ static int free_device(struct snd_seq_device *dev, struct ops_list *ops)
- dev->name, ops->id, ops->argsize, dev->argsize);
- return -EINVAL;
- }
-- if ((result = ops->ops.free_device(dev)) >= 0 || result == -ENXIO) {
-+ if ((result = ops->ops->free_device(dev)) >= 0 || result == -ENXIO) {
- dev->status = SNDRV_SEQ_DEVICE_FREE;
- dev->driver_data = NULL;
- ops->num_init_devices--;
-diff --git a/sound/drivers/mts64.c b/sound/drivers/mts64.c
-index 9284829..ac8e8b2 100644
---- a/sound/drivers/mts64.c
-+++ b/sound/drivers/mts64.c
-@@ -27,6 +27,7 @@
- #include <sound/initval.h>
- #include <sound/rawmidi.h>
- #include <sound/control.h>
-+#include <asm/local.h>
-
- #define CARD_NAME "Miditerminal 4140"
- #define DRIVER_NAME "MTS64"
-@@ -65,7 +66,7 @@ struct mts64 {
- struct pardevice *pardev;
- int pardev_claimed;
-
-- int open_count;
-+ local_t open_count;
- int current_midi_output_port;
- int current_midi_input_port;
- u8 mode[MTS64_NUM_INPUT_PORTS];
-@@ -695,7 +696,7 @@ static int snd_mts64_rawmidi_open(struct snd_rawmidi_substream *substream)
- {
- struct mts64 *mts = substream->rmidi->private_data;
-
-- if (mts->open_count == 0) {
-+ if (local_read(&mts->open_count) == 0) {
- /* We don't need a spinlock here, because this is just called
- if the device has not been opened before.
- So there aren't any IRQs from the device */
-@@ -703,7 +704,7 @@ static int snd_mts64_rawmidi_open(struct snd_rawmidi_substream *substream)
-
- msleep(50);
- }
-- ++(mts->open_count);
-+ local_inc(&mts->open_count);
-
- return 0;
- }
-@@ -713,8 +714,7 @@ static int snd_mts64_rawmidi_close(struct snd_rawmidi_substream *substream)
- struct mts64 *mts = substream->rmidi->private_data;
- unsigned long flags;
-
-- --(mts->open_count);
-- if (mts->open_count == 0) {
-+ if (local_dec_return(&mts->open_count) == 0) {
- /* We need the spinlock_irqsave here because we can still
- have IRQs at this point */
- spin_lock_irqsave(&mts->lock, flags);
-@@ -723,8 +723,8 @@ static int snd_mts64_rawmidi_close(struct snd_rawmidi_substream *substream)
-
- msleep(500);
-
-- } else if (mts->open_count < 0)
-- mts->open_count = 0;
-+ } else if (local_read(&mts->open_count) < 0)
-+ local_set(&mts->open_count, 0);
-
- return 0;
- }
-diff --git a/sound/drivers/opl4/opl4_lib.c b/sound/drivers/opl4/opl4_lib.c
-index 01997f2..cbc1195 100644
---- a/sound/drivers/opl4/opl4_lib.c
-+++ b/sound/drivers/opl4/opl4_lib.c
-@@ -27,7 +27,7 @@ MODULE_AUTHOR("Clemens Ladisch <clemens@ladisch.de>");
- MODULE_DESCRIPTION("OPL4 driver");
- MODULE_LICENSE("GPL");
-
--static void inline snd_opl4_wait(struct snd_opl4 *opl4)
-+static inline void snd_opl4_wait(struct snd_opl4 *opl4)
- {
- int timeout = 10;
- while ((inb(opl4->fm_port) & OPL4_STATUS_BUSY) && --timeout > 0)
-diff --git a/sound/drivers/portman2x4.c b/sound/drivers/portman2x4.c
-index 60158e2..0a0cc1a 100644
---- a/sound/drivers/portman2x4.c
-+++ b/sound/drivers/portman2x4.c
-@@ -46,6 +46,7 @@
- #include <sound/initval.h>
- #include <sound/rawmidi.h>
- #include <sound/control.h>
-+#include <asm/local.h>
-
- #define CARD_NAME "Portman 2x4"
- #define DRIVER_NAME "portman"
-@@ -83,7 +84,7 @@ struct portman {
- struct pardevice *pardev;
- int pardev_claimed;
-
-- int open_count;
-+ local_t open_count;
- int mode[PORTMAN_NUM_INPUT_PORTS];
- struct snd_rawmidi_substream *midi_input[PORTMAN_NUM_INPUT_PORTS];
- };
-diff --git a/sound/oss/sb_audio.c b/sound/oss/sb_audio.c
-index 733b014..56ce96f 100644
---- a/sound/oss/sb_audio.c
-+++ b/sound/oss/sb_audio.c
-@@ -901,7 +901,7 @@ sb16_copy_from_user(int dev,
- buf16 = (signed short *)(localbuf + localoffs);
- while (c)
- {
-- locallen = (c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
-+ locallen = ((unsigned)c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
- if (copy_from_user(lbuf8,
- userbuf+useroffs + p,
- locallen))
-diff --git a/sound/oss/swarm_cs4297a.c b/sound/oss/swarm_cs4297a.c
-index 3136c88..28ad950 100644
---- a/sound/oss/swarm_cs4297a.c
-+++ b/sound/oss/swarm_cs4297a.c
-@@ -2577,7 +2577,6 @@ static int __init cs4297a_init(void)
- {
- struct cs4297a_state *s;
- u32 pwr, id;
-- mm_segment_t fs;
- int rval;
- #ifndef CONFIG_BCM_CS4297A_CSWARM
- u64 cfg;
-@@ -2667,22 +2666,23 @@ static int __init cs4297a_init(void)
- if (!rval) {
- char *sb1250_duart_present;
-
-+#if 0
-+ mm_segment_t fs;
- fs = get_fs();
- set_fs(KERNEL_DS);
--#if 0
- val = SOUND_MASK_LINE;
- mixer_ioctl(s, SOUND_MIXER_WRITE_RECSRC, (unsigned long) &val);
- for (i = 0; i < ARRAY_SIZE(initvol); i++) {
- val = initvol[i].vol;
- mixer_ioctl(s, initvol[i].mixch, (unsigned long) &val);
- }
-+ set_fs(fs);
- // cs4297a_write_ac97(s, 0x18, 0x0808);
- #else
- // cs4297a_write_ac97(s, 0x5e, 0x180);
- cs4297a_write_ac97(s, 0x02, 0x0808);
- cs4297a_write_ac97(s, 0x18, 0x0808);
- #endif
-- set_fs(fs);
-
- list_add(&s->list, &cs4297a_devs);
-
-diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c
-index 5f295f7..c5e763c 100644
---- a/sound/pci/ac97/ac97_codec.c
-+++ b/sound/pci/ac97/ac97_codec.c
-@@ -1954,7 +1954,7 @@ static int snd_ac97_dev_disconnect(struct snd_device *device)
- }
-
- /* build_ops to do nothing */
--static struct snd_ac97_build_ops null_build_ops;
-+static const struct snd_ac97_build_ops null_build_ops;
-
- #ifdef CONFIG_SND_AC97_POWER_SAVE
- static void do_update_power(struct work_struct *work)
-diff --git a/sound/pci/ac97/ac97_patch.c b/sound/pci/ac97/ac97_patch.c
-index eeb2e23..82bf625 100644
---- a/sound/pci/ac97/ac97_patch.c
-+++ b/sound/pci/ac97/ac97_patch.c
-@@ -371,7 +371,7 @@ static int patch_yamaha_ymf743_build_spdif(struct snd_ac97 *ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_yamaha_ymf743_ops = {
-+static const struct snd_ac97_build_ops patch_yamaha_ymf743_ops = {
- .build_spdif = patch_yamaha_ymf743_build_spdif,
- .build_3d = patch_yamaha_ymf7x3_3d,
- };
-@@ -455,7 +455,7 @@ static int patch_yamaha_ymf753_post_spdif(struct snd_ac97 * ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_yamaha_ymf753_ops = {
-+static const struct snd_ac97_build_ops patch_yamaha_ymf753_ops = {
- .build_3d = patch_yamaha_ymf7x3_3d,
- .build_post_spdif = patch_yamaha_ymf753_post_spdif
- };
-@@ -502,7 +502,7 @@ static int patch_wolfson_wm9703_specific(struct snd_ac97 * ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_wolfson_wm9703_ops = {
-+static const struct snd_ac97_build_ops patch_wolfson_wm9703_ops = {
- .build_specific = patch_wolfson_wm9703_specific,
- };
-
-@@ -533,7 +533,7 @@ static int patch_wolfson_wm9704_specific(struct snd_ac97 * ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_wolfson_wm9704_ops = {
-+static const struct snd_ac97_build_ops patch_wolfson_wm9704_ops = {
- .build_specific = patch_wolfson_wm9704_specific,
- };
-
-@@ -555,7 +555,7 @@ static int patch_wolfson_wm9705_specific(struct snd_ac97 * ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_wolfson_wm9705_ops = {
-+static const struct snd_ac97_build_ops patch_wolfson_wm9705_ops = {
- .build_specific = patch_wolfson_wm9705_specific,
- };
-
-@@ -692,7 +692,7 @@ static int patch_wolfson_wm9711_specific(struct snd_ac97 * ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_wolfson_wm9711_ops = {
-+static const struct snd_ac97_build_ops patch_wolfson_wm9711_ops = {
- .build_specific = patch_wolfson_wm9711_specific,
- };
-
-@@ -886,7 +886,7 @@ static void patch_wolfson_wm9713_resume (struct snd_ac97 * ac97)
- }
- #endif
-
--static struct snd_ac97_build_ops patch_wolfson_wm9713_ops = {
-+static const struct snd_ac97_build_ops patch_wolfson_wm9713_ops = {
- .build_specific = patch_wolfson_wm9713_specific,
- .build_3d = patch_wolfson_wm9713_3d,
- #ifdef CONFIG_PM
-@@ -991,7 +991,7 @@ static int patch_sigmatel_stac97xx_specific(struct snd_ac97 * ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_sigmatel_stac9700_ops = {
-+static const struct snd_ac97_build_ops patch_sigmatel_stac9700_ops = {
- .build_3d = patch_sigmatel_stac9700_3d,
- .build_specific = patch_sigmatel_stac97xx_specific
- };
-@@ -1038,7 +1038,7 @@ static int patch_sigmatel_stac9708_specific(struct snd_ac97 *ac97)
- return patch_sigmatel_stac97xx_specific(ac97);
- }
-
--static struct snd_ac97_build_ops patch_sigmatel_stac9708_ops = {
-+static const struct snd_ac97_build_ops patch_sigmatel_stac9708_ops = {
- .build_3d = patch_sigmatel_stac9708_3d,
- .build_specific = patch_sigmatel_stac9708_specific
- };
-@@ -1267,7 +1267,7 @@ static int patch_sigmatel_stac9758_specific(struct snd_ac97 *ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_sigmatel_stac9758_ops = {
-+static const struct snd_ac97_build_ops patch_sigmatel_stac9758_ops = {
- .build_3d = patch_sigmatel_stac9700_3d,
- .build_specific = patch_sigmatel_stac9758_specific
- };
-@@ -1342,7 +1342,7 @@ static int patch_cirrus_build_spdif(struct snd_ac97 * ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_cirrus_ops = {
-+static const struct snd_ac97_build_ops patch_cirrus_ops = {
- .build_spdif = patch_cirrus_build_spdif
- };
-
-@@ -1399,7 +1399,7 @@ static int patch_conexant_build_spdif(struct snd_ac97 * ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_conexant_ops = {
-+static const struct snd_ac97_build_ops patch_conexant_ops = {
- .build_spdif = patch_conexant_build_spdif
- };
-
-@@ -1575,7 +1575,7 @@ static void patch_ad1881_chained(struct snd_ac97 * ac97, int unchained_idx, int
- }
- }
-
--static struct snd_ac97_build_ops patch_ad1881_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1881_build_ops = {
- #ifdef CONFIG_PM
- .resume = ad18xx_resume
- #endif
-@@ -1662,7 +1662,7 @@ static int patch_ad1885_specific(struct snd_ac97 * ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_ad1885_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1885_build_ops = {
- .build_specific = &patch_ad1885_specific,
- #ifdef CONFIG_PM
- .resume = ad18xx_resume
-@@ -1689,7 +1689,7 @@ static int patch_ad1886_specific(struct snd_ac97 * ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_ad1886_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1886_build_ops = {
- .build_specific = &patch_ad1886_specific,
- #ifdef CONFIG_PM
- .resume = ad18xx_resume
-@@ -1896,7 +1896,7 @@ static int patch_ad1981a_specific(struct snd_ac97 * ac97)
- ARRAY_SIZE(snd_ac97_ad1981x_jack_sense));
- }
-
--static struct snd_ac97_build_ops patch_ad1981a_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1981a_build_ops = {
- .build_post_spdif = patch_ad198x_post_spdif,
- .build_specific = patch_ad1981a_specific,
- #ifdef CONFIG_PM
-@@ -1952,7 +1952,7 @@ static int patch_ad1981b_specific(struct snd_ac97 *ac97)
- ARRAY_SIZE(snd_ac97_ad1981x_jack_sense));
- }
-
--static struct snd_ac97_build_ops patch_ad1981b_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1981b_build_ops = {
- .build_post_spdif = patch_ad198x_post_spdif,
- .build_specific = patch_ad1981b_specific,
- #ifdef CONFIG_PM
-@@ -2091,7 +2091,7 @@ static int patch_ad1888_specific(struct snd_ac97 *ac97)
- return patch_build_controls(ac97, snd_ac97_ad1888_controls, ARRAY_SIZE(snd_ac97_ad1888_controls));
- }
-
--static struct snd_ac97_build_ops patch_ad1888_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1888_build_ops = {
- .build_post_spdif = patch_ad198x_post_spdif,
- .build_specific = patch_ad1888_specific,
- #ifdef CONFIG_PM
-@@ -2140,7 +2140,7 @@ static int patch_ad1980_specific(struct snd_ac97 *ac97)
- return patch_build_controls(ac97, &snd_ac97_ad198x_2cmic, 1);
- }
-
--static struct snd_ac97_build_ops patch_ad1980_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1980_build_ops = {
- .build_post_spdif = patch_ad198x_post_spdif,
- .build_specific = patch_ad1980_specific,
- #ifdef CONFIG_PM
-@@ -2255,7 +2255,7 @@ static int patch_ad1985_specific(struct snd_ac97 *ac97)
- ARRAY_SIZE(snd_ac97_ad1985_controls));
- }
-
--static struct snd_ac97_build_ops patch_ad1985_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1985_build_ops = {
- .build_post_spdif = patch_ad198x_post_spdif,
- .build_specific = patch_ad1985_specific,
- #ifdef CONFIG_PM
-@@ -2547,7 +2547,7 @@ static int patch_ad1986_specific(struct snd_ac97 *ac97)
- ARRAY_SIZE(snd_ac97_ad1985_controls));
- }
-
--static struct snd_ac97_build_ops patch_ad1986_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1986_build_ops = {
- .build_post_spdif = patch_ad198x_post_spdif,
- .build_specific = patch_ad1986_specific,
- #ifdef CONFIG_PM
-@@ -2652,7 +2652,7 @@ static int patch_alc650_specific(struct snd_ac97 * ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_alc650_ops = {
-+static const struct snd_ac97_build_ops patch_alc650_ops = {
- .build_specific = patch_alc650_specific,
- .update_jacks = alc650_update_jacks
- };
-@@ -2804,7 +2804,7 @@ static int patch_alc655_specific(struct snd_ac97 * ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_alc655_ops = {
-+static const struct snd_ac97_build_ops patch_alc655_ops = {
- .build_specific = patch_alc655_specific,
- .update_jacks = alc655_update_jacks
- };
-@@ -2916,7 +2916,7 @@ static int patch_alc850_specific(struct snd_ac97 *ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_alc850_ops = {
-+static const struct snd_ac97_build_ops patch_alc850_ops = {
- .build_specific = patch_alc850_specific,
- .update_jacks = alc850_update_jacks
- };
-@@ -2978,7 +2978,7 @@ static int patch_cm9738_specific(struct snd_ac97 * ac97)
- return patch_build_controls(ac97, snd_ac97_cm9738_controls, ARRAY_SIZE(snd_ac97_cm9738_controls));
- }
-
--static struct snd_ac97_build_ops patch_cm9738_ops = {
-+static const struct snd_ac97_build_ops patch_cm9738_ops = {
- .build_specific = patch_cm9738_specific,
- .update_jacks = cm9738_update_jacks
- };
-@@ -3069,7 +3069,7 @@ static int patch_cm9739_post_spdif(struct snd_ac97 * ac97)
- return patch_build_controls(ac97, snd_ac97_cm9739_controls_spdif, ARRAY_SIZE(snd_ac97_cm9739_controls_spdif));
- }
-
--static struct snd_ac97_build_ops patch_cm9739_ops = {
-+static const struct snd_ac97_build_ops patch_cm9739_ops = {
- .build_specific = patch_cm9739_specific,
- .build_post_spdif = patch_cm9739_post_spdif,
- .update_jacks = cm9739_update_jacks
-@@ -3243,7 +3243,7 @@ static int patch_cm9761_specific(struct snd_ac97 * ac97)
- return patch_build_controls(ac97, snd_ac97_cm9761_controls, ARRAY_SIZE(snd_ac97_cm9761_controls));
- }
-
--static struct snd_ac97_build_ops patch_cm9761_ops = {
-+static const struct snd_ac97_build_ops patch_cm9761_ops = {
- .build_specific = patch_cm9761_specific,
- .build_post_spdif = patch_cm9761_post_spdif,
- .update_jacks = cm9761_update_jacks
-@@ -3339,7 +3339,7 @@ static int patch_cm9780_specific(struct snd_ac97 *ac97)
- return patch_build_controls(ac97, cm9780_controls, ARRAY_SIZE(cm9780_controls));
- }
-
--static struct snd_ac97_build_ops patch_cm9780_ops = {
-+static const struct snd_ac97_build_ops patch_cm9780_ops = {
- .build_specific = patch_cm9780_specific,
- .build_post_spdif = patch_cm9761_post_spdif /* identical with CM9761 */
- };
-@@ -3459,7 +3459,7 @@ static int patch_vt1616_specific(struct snd_ac97 * ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_vt1616_ops = {
-+static const struct snd_ac97_build_ops patch_vt1616_ops = {
- .build_specific = patch_vt1616_specific
- };
-
-@@ -3813,7 +3813,7 @@ static int patch_it2646_specific(struct snd_ac97 * ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_it2646_ops = {
-+static const struct snd_ac97_build_ops patch_it2646_ops = {
- .build_specific = patch_it2646_specific,
- .update_jacks = it2646_update_jacks
- };
-@@ -3847,7 +3847,7 @@ static int patch_si3036_specific(struct snd_ac97 * ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_si3036_ops = {
-+static const struct snd_ac97_build_ops patch_si3036_ops = {
- .build_specific = patch_si3036_specific,
- };
-
-@@ -3914,7 +3914,7 @@ static int patch_ucb1400_specific(struct snd_ac97 * ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_ucb1400_ops = {
-+static const struct snd_ac97_build_ops patch_ucb1400_ops = {
- .build_specific = patch_ucb1400_specific,
- };
-
-diff --git a/sound/pci/hda/patch_atihdmi.c b/sound/pci/hda/patch_atihdmi.c
-index fb684f0..2b11cea 100644
---- a/sound/pci/hda/patch_atihdmi.c
-+++ b/sound/pci/hda/patch_atihdmi.c
-@@ -177,7 +177,7 @@ static int patch_atihdmi(struct hda_codec *codec)
- */
- spec->multiout.dig_out_nid = CVT_NID;
-
-- codec->patch_ops = atihdmi_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &atihdmi_patch_ops, sizeof(atihdmi_patch_ops));
-
- return 0;
- }
-diff --git a/sound/pci/hda/patch_intelhdmi.c b/sound/pci/hda/patch_intelhdmi.c
-index 7c23016..c5bfdd7 100644
---- a/sound/pci/hda/patch_intelhdmi.c
-+++ b/sound/pci/hda/patch_intelhdmi.c
-@@ -511,10 +511,10 @@ static void hdmi_non_intrinsic_event(struct hda_codec *codec, unsigned int res)
- cp_ready);
-
- /* TODO */
-- if (cp_state)
-- ;
-- if (cp_ready)
-- ;
-+ if (cp_state) {
-+ }
-+ if (cp_ready) {
-+ }
- }
-
-
-@@ -656,7 +656,7 @@ static int do_patch_intel_hdmi(struct hda_codec *codec)
- spec->multiout.dig_out_nid = cvt_nid;
-
- codec->spec = spec;
-- codec->patch_ops = intel_hdmi_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &intel_hdmi_patch_ops, sizeof(intel_hdmi_patch_ops));
-
- snd_hda_eld_proc_new(codec, &spec->sink_eld);
-
-diff --git a/sound/pci/hda/patch_nvhdmi.c b/sound/pci/hda/patch_nvhdmi.c
-index 6afdab0..68ed352 100644
---- a/sound/pci/hda/patch_nvhdmi.c
-+++ b/sound/pci/hda/patch_nvhdmi.c
-@@ -367,7 +367,7 @@ static int patch_nvhdmi_8ch(struct hda_codec *codec)
- spec->multiout.max_channels = 8;
- spec->multiout.dig_out_nid = Nv_Master_Convert_nid;
-
-- codec->patch_ops = nvhdmi_patch_ops_8ch;
-+ memcpy((void *)&codec->patch_ops, &nvhdmi_patch_ops_8ch, sizeof(nvhdmi_patch_ops_8ch));
-
- return 0;
- }
-@@ -386,7 +386,7 @@ static int patch_nvhdmi_2ch(struct hda_codec *codec)
- spec->multiout.max_channels = 2;
- spec->multiout.dig_out_nid = Nv_Master_Convert_nid;
-
-- codec->patch_ops = nvhdmi_patch_ops_2ch;
-+ memcpy((void *)&codec->patch_ops, &nvhdmi_patch_ops_2ch, sizeof(nvhdmi_patch_ops_2ch));
-
- return 0;
- }
-diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
-index 2fcd70d..a143eaf 100644
---- a/sound/pci/hda/patch_sigmatel.c
-+++ b/sound/pci/hda/patch_sigmatel.c
-@@ -5220,7 +5220,7 @@ again:
- snd_hda_codec_write_cache(codec, nid, 0,
- AC_VERB_SET_CONNECT_SEL, num_dacs);
-
-- codec->patch_ops = stac92xx_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &stac92xx_patch_ops, sizeof(stac92xx_patch_ops));
-
- codec->proc_widget_hook = stac92hd_proc_hook;
-
-@@ -5294,7 +5294,7 @@ static int patch_stac92hd71bxx(struct hda_codec *codec)
- return -ENOMEM;
-
- codec->spec = spec;
-- codec->patch_ops = stac92xx_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &stac92xx_patch_ops, sizeof(stac92xx_patch_ops));
- spec->num_pins = STAC92HD71BXX_NUM_PINS;
- switch (codec->vendor_id) {
- case 0x111d76b6:
-diff --git a/sound/pci/intel8x0m.c b/sound/pci/intel8x0m.c
-index 9e7d12e..3e3bc64 100644
---- a/sound/pci/intel8x0m.c
-+++ b/sound/pci/intel8x0m.c
-@@ -1264,7 +1264,7 @@ static struct shortname_table {
- { 0x5455, "ALi M5455" },
- { 0x746d, "AMD AMD8111" },
- #endif
-- { 0 },
-+ { 0, },
- };
-
- static int __devinit snd_intel8x0m_probe(struct pci_dev *pci,
-diff --git a/sound/pci/ymfpci/ymfpci_main.c b/sound/pci/ymfpci/ymfpci_main.c
-index 5518371..45cf7ac 100644
---- a/sound/pci/ymfpci/ymfpci_main.c
-+++ b/sound/pci/ymfpci/ymfpci_main.c
-@@ -202,8 +202,8 @@ static void snd_ymfpci_hw_stop(struct snd_ymfpci *chip)
- if ((snd_ymfpci_readl(chip, YDSXGR_STATUS) & 2) == 0)
- break;
- }
-- if (atomic_read(&chip->interrupt_sleep_count)) {
-- atomic_set(&chip->interrupt_sleep_count, 0);
-+ if (atomic_read_unchecked(&chip->interrupt_sleep_count)) {
-+ atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
- wake_up(&chip->interrupt_sleep);
- }
- __end:
-@@ -787,7 +787,7 @@ static void snd_ymfpci_irq_wait(struct snd_ymfpci *chip)
- continue;
- init_waitqueue_entry(&wait, current);
- add_wait_queue(&chip->interrupt_sleep, &wait);
-- atomic_inc(&chip->interrupt_sleep_count);
-+ atomic_inc_unchecked(&chip->interrupt_sleep_count);
- schedule_timeout_uninterruptible(msecs_to_jiffies(50));
- remove_wait_queue(&chip->interrupt_sleep, &wait);
- }
-@@ -825,8 +825,8 @@ static irqreturn_t snd_ymfpci_interrupt(int irq, void *dev_id)
- snd_ymfpci_writel(chip, YDSXGR_MODE, mode);
- spin_unlock(&chip->reg_lock);
-
-- if (atomic_read(&chip->interrupt_sleep_count)) {
-- atomic_set(&chip->interrupt_sleep_count, 0);
-+ if (atomic_read_unchecked(&chip->interrupt_sleep_count)) {
-+ atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
- wake_up(&chip->interrupt_sleep);
- }
- }
-@@ -2369,7 +2369,7 @@ int __devinit snd_ymfpci_create(struct snd_card *card,
- spin_lock_init(&chip->reg_lock);
- spin_lock_init(&chip->voice_lock);
- init_waitqueue_head(&chip->interrupt_sleep);
-- atomic_set(&chip->interrupt_sleep_count, 0);
-+ atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
- chip->card = card;
- chip->pci = pci;
- chip->irq = -1;
-diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
-index 0a1b2f6..d999b21 100644
---- a/sound/soc/soc-core.c
-+++ b/sound/soc/soc-core.c
-@@ -1107,13 +1107,15 @@ static int soc_new_pcm(struct snd_soc_device *socdev,
-
- dai_link->pcm = pcm;
- pcm->private_data = rtd;
-- soc_pcm_ops.mmap = platform->pcm_ops->mmap;
-- soc_pcm_ops.pointer = platform->pcm_ops->pointer;
-- soc_pcm_ops.ioctl = platform->pcm_ops->ioctl;
-- soc_pcm_ops.copy = platform->pcm_ops->copy;
-- soc_pcm_ops.silence = platform->pcm_ops->silence;
-- soc_pcm_ops.ack = platform->pcm_ops->ack;
-- soc_pcm_ops.page = platform->pcm_ops->page;
-+ pax_open_kernel();
-+ *(void **)&soc_pcm_ops.mmap = platform->pcm_ops->mmap;
-+ *(void **)&soc_pcm_ops.pointer = platform->pcm_ops->pointer;
-+ *(void **)&soc_pcm_ops.ioctl = platform->pcm_ops->ioctl;
-+ *(void **)&soc_pcm_ops.copy = platform->pcm_ops->copy;
-+ *(void **)&soc_pcm_ops.silence = platform->pcm_ops->silence;
-+ *(void **)&soc_pcm_ops.ack = platform->pcm_ops->ack;
-+ *(void **)&soc_pcm_ops.page = platform->pcm_ops->page;
-+ pax_close_kernel();
-
- if (playback)
- snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_PLAYBACK, &soc_pcm_ops);
-diff --git a/sound/usb/usbaudio.c b/sound/usb/usbaudio.c
-index 79633ea..e92baee 100644
---- a/sound/usb/usbaudio.c
-+++ b/sound/usb/usbaudio.c
-@@ -2228,9 +2228,9 @@ static void init_substream(struct snd_usb_stream *as, int stream, struct audiofo
- subs->direction = stream;
- subs->dev = as->chip->dev;
- if (snd_usb_get_speed(subs->dev) == USB_SPEED_FULL) {
-- subs->ops = audio_urb_ops[stream];
-+ memcpy((void *)&subs->ops, &audio_urb_ops[stream], sizeof(subs->ops));
- } else {
-- subs->ops = audio_urb_ops_high_speed[stream];
-+ memcpy((void *)&subs->ops, &audio_urb_ops_high_speed[stream], sizeof(subs->ops));
- switch (as->chip->usb_id) {
- case USB_ID(0x041e, 0x3f02): /* E-Mu 0202 USB */
- case USB_ID(0x041e, 0x3f04): /* E-Mu 0404 USB */
-diff --git a/tools/gcc/.gitignore b/tools/gcc/.gitignore
-new file mode 100644
-index 0000000..50f2f2f
---- /dev/null
-+++ b/tools/gcc/.gitignore
-@@ -0,0 +1 @@
-+size_overflow_hash.h
-diff --git a/tools/gcc/Makefile b/tools/gcc/Makefile
-new file mode 100644
-index 0000000..1d09b7e
---- /dev/null
-+++ b/tools/gcc/Makefile
-@@ -0,0 +1,43 @@
-+#CC := gcc
-+#PLUGIN_SOURCE_FILES := pax_plugin.c
-+#PLUGIN_OBJECT_FILES := $(patsubst %.c,%.o,$(PLUGIN_SOURCE_FILES))
-+GCCPLUGINS_DIR := $(shell $(CC) -print-file-name=plugin)
-+#CFLAGS += -I$(GCCPLUGINS_DIR)/include -fPIC -O2 -Wall -W -std=gnu99
-+
-+ifeq ($(PLUGINCC),$(HOSTCC))
-+HOSTLIBS := hostlibs
-+HOST_EXTRACFLAGS += -I$(GCCPLUGINS_DIR)/include -I$(GCCPLUGINS_DIR)/include/c-family -std=gnu99 -ggdb
-+else
-+HOSTLIBS := hostcxxlibs
-+HOST_EXTRACXXFLAGS += -I$(GCCPLUGINS_DIR)/include -I$(GCCPLUGINS_DIR)/include/c-family -std=gnu++98 -ggdb -Wno-unused-parameter
-+endif
-+
-+$(HOSTLIBS)-y := constify_plugin.so
-+$(HOSTLIBS)-$(CONFIG_PAX_MEMORY_STACKLEAK) += stackleak_plugin.so
-+$(HOSTLIBS)-$(CONFIG_KALLOCSTAT_PLUGIN) += kallocstat_plugin.so
-+$(HOSTLIBS)-$(CONFIG_PAX_KERNEXEC_PLUGIN) += kernexec_plugin.so
-+$(HOSTLIBS)-$(CONFIG_CHECKER_PLUGIN) += checker_plugin.so
-+$(HOSTLIBS)-y += colorize_plugin.so
-+$(HOSTLIBS)-$(CONFIG_PAX_SIZE_OVERFLOW) += size_overflow_plugin.so
-+$(HOSTLIBS)-$(CONFIG_PAX_LATENT_ENTROPY) += latent_entropy_plugin.so
-+
-+always := $($(HOSTLIBS)-y)
-+
-+constify_plugin-objs := constify_plugin.o
-+stackleak_plugin-objs := stackleak_plugin.o
-+kallocstat_plugin-objs := kallocstat_plugin.o
-+kernexec_plugin-objs := kernexec_plugin.o
-+checker_plugin-objs := checker_plugin.o
-+colorize_plugin-objs := colorize_plugin.o
-+size_overflow_plugin-objs := size_overflow_plugin.o
-+latent_entropy_plugin-objs := latent_entropy_plugin.o
-+
-+$(obj)/size_overflow_plugin.o: $(objtree)/$(obj)/size_overflow_hash.h
-+
-+quiet_cmd_build_size_overflow_hash = GENHASH $@
-+ cmd_build_size_overflow_hash = \
-+ $(CONFIG_SHELL) $(srctree)/$(src)/generate_size_overflow_hash.sh -d $< -o $@
-+$(objtree)/$(obj)/size_overflow_hash.h: $(src)/size_overflow_hash.data FORCE
-+ $(call if_changed,build_size_overflow_hash)
-+
-+targets += size_overflow_hash.h
-diff --git a/tools/gcc/checker_plugin.c b/tools/gcc/checker_plugin.c
-new file mode 100644
-index 0000000..d41b5af
---- /dev/null
-+++ b/tools/gcc/checker_plugin.c
-@@ -0,0 +1,171 @@
-+/*
-+ * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
-+ * Licensed under the GPL v2
-+ *
-+ * Note: the choice of the license means that the compilation process is
-+ * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
-+ * but for the kernel it doesn't matter since it doesn't link against
-+ * any of the gcc libraries
-+ *
-+ * gcc plugin to implement various sparse (source code checker) features
-+ *
-+ * TODO:
-+ * - define separate __iomem, __percpu and __rcu address spaces (lots of code to patch)
-+ *
-+ * BUGS:
-+ * - none known
-+ */
-+#include "gcc-plugin.h"
-+#include "config.h"
-+#include "system.h"
-+#include "coretypes.h"
-+#include "tree.h"
-+#include "tree-pass.h"
-+#include "flags.h"
-+#include "intl.h"
-+#include "toplev.h"
-+#include "plugin.h"
-+//#include "expr.h" where are you...
-+#include "diagnostic.h"
-+#include "plugin-version.h"
-+#include "tm.h"
-+#include "function.h"
-+#include "basic-block.h"
-+#include "gimple.h"
-+#include "rtl.h"
-+#include "emit-rtl.h"
-+#include "tree-flow.h"
-+#include "target.h"
-+
-+extern void c_register_addr_space (const char *str, addr_space_t as);
-+extern enum machine_mode default_addr_space_pointer_mode (addr_space_t);
-+extern enum machine_mode default_addr_space_address_mode (addr_space_t);
-+extern bool default_addr_space_valid_pointer_mode(enum machine_mode mode, addr_space_t as);
-+extern bool default_addr_space_legitimate_address_p(enum machine_mode mode, rtx mem, bool strict, addr_space_t as);
-+extern rtx default_addr_space_legitimize_address(rtx x, rtx oldx, enum machine_mode mode, addr_space_t as);
-+
-+extern void print_gimple_stmt(FILE *, gimple, int, int);
-+extern rtx emit_move_insn(rtx x, rtx y);
-+
-+int plugin_is_GPL_compatible;
-+
-+static struct plugin_info checker_plugin_info = {
-+ .version = "201111150100",
-+};
-+
-+#define ADDR_SPACE_KERNEL 0
-+#define ADDR_SPACE_FORCE_KERNEL 1
-+#define ADDR_SPACE_USER 2
-+#define ADDR_SPACE_FORCE_USER 3
-+#define ADDR_SPACE_IOMEM 0
-+#define ADDR_SPACE_FORCE_IOMEM 0
-+#define ADDR_SPACE_PERCPU 0
-+#define ADDR_SPACE_FORCE_PERCPU 0
-+#define ADDR_SPACE_RCU 0
-+#define ADDR_SPACE_FORCE_RCU 0
-+
-+static enum machine_mode checker_addr_space_pointer_mode(addr_space_t addrspace)
-+{
-+ return default_addr_space_pointer_mode(ADDR_SPACE_GENERIC);
-+}
-+
-+static enum machine_mode checker_addr_space_address_mode(addr_space_t addrspace)
-+{
-+ return default_addr_space_address_mode(ADDR_SPACE_GENERIC);
-+}
-+
-+static bool checker_addr_space_valid_pointer_mode(enum machine_mode mode, addr_space_t as)
-+{
-+ return default_addr_space_valid_pointer_mode(mode, as);
-+}
-+
-+static bool checker_addr_space_legitimate_address_p(enum machine_mode mode, rtx mem, bool strict, addr_space_t as)
-+{
-+ return default_addr_space_legitimate_address_p(mode, mem, strict, ADDR_SPACE_GENERIC);
-+}
-+
-+static rtx checker_addr_space_legitimize_address(rtx x, rtx oldx, enum machine_mode mode, addr_space_t as)
-+{
-+ return default_addr_space_legitimize_address(x, oldx, mode, as);
-+}
-+
-+static bool checker_addr_space_subset_p(addr_space_t subset, addr_space_t superset)
-+{
-+ if (subset == ADDR_SPACE_FORCE_KERNEL && superset == ADDR_SPACE_KERNEL)
-+ return true;
-+
-+ if (subset == ADDR_SPACE_FORCE_USER && superset == ADDR_SPACE_USER)
-+ return true;
-+
-+ if (subset == ADDR_SPACE_FORCE_IOMEM && superset == ADDR_SPACE_IOMEM)
-+ return true;
-+
-+ if (subset == ADDR_SPACE_KERNEL && superset == ADDR_SPACE_FORCE_USER)
-+ return true;
-+
-+ if (subset == ADDR_SPACE_KERNEL && superset == ADDR_SPACE_FORCE_IOMEM)
-+ return true;
-+
-+ if (subset == ADDR_SPACE_USER && superset == ADDR_SPACE_FORCE_KERNEL)
-+ return true;
-+
-+ if (subset == ADDR_SPACE_IOMEM && superset == ADDR_SPACE_FORCE_KERNEL)
-+ return true;
-+
-+ return subset == superset;
-+}
-+
-+static rtx checker_addr_space_convert(rtx op, tree from_type, tree to_type)
-+{
-+// addr_space_t from_as = TYPE_ADDR_SPACE(TREE_TYPE(from_type));
-+// addr_space_t to_as = TYPE_ADDR_SPACE(TREE_TYPE(to_type));
-+
-+ return op;
-+}
-+
-+static void register_checker_address_spaces(void *event_data, void *data)
-+{
-+ c_register_addr_space("__kernel", ADDR_SPACE_KERNEL);
-+ c_register_addr_space("__force_kernel", ADDR_SPACE_FORCE_KERNEL);
-+ c_register_addr_space("__user", ADDR_SPACE_USER);
-+ c_register_addr_space("__force_user", ADDR_SPACE_FORCE_USER);
-+// c_register_addr_space("__iomem", ADDR_SPACE_IOMEM);
-+// c_register_addr_space("__force_iomem", ADDR_SPACE_FORCE_IOMEM);
-+// c_register_addr_space("__percpu", ADDR_SPACE_PERCPU);
-+// c_register_addr_space("__force_percpu", ADDR_SPACE_FORCE_PERCPU);
-+// c_register_addr_space("__rcu", ADDR_SPACE_RCU);
-+// c_register_addr_space("__force_rcu", ADDR_SPACE_FORCE_RCU);
-+
-+ targetm.addr_space.pointer_mode = checker_addr_space_pointer_mode;
-+ targetm.addr_space.address_mode = checker_addr_space_address_mode;
-+ targetm.addr_space.valid_pointer_mode = checker_addr_space_valid_pointer_mode;
-+ targetm.addr_space.legitimate_address_p = checker_addr_space_legitimate_address_p;
-+// targetm.addr_space.legitimize_address = checker_addr_space_legitimize_address;
-+ targetm.addr_space.subset_p = checker_addr_space_subset_p;
-+ targetm.addr_space.convert = checker_addr_space_convert;
-+}
-+
-+int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
-+{
-+ const char * const plugin_name = plugin_info->base_name;
-+ const int argc = plugin_info->argc;
-+ const struct plugin_argument * const argv = plugin_info->argv;
-+ int i;
-+
-+ if (!plugin_default_version_check(version, &gcc_version)) {
-+ error(G_("incompatible gcc/plugin versions"));
-+ return 1;
-+ }
-+
-+ register_callback(plugin_name, PLUGIN_INFO, NULL, &checker_plugin_info);
-+
-+ for (i = 0; i < argc; ++i)
-+ error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
-+
-+ if (TARGET_64BIT == 0)
-+ return 0;
-+
-+ register_callback(plugin_name, PLUGIN_PRAGMAS, register_checker_address_spaces, NULL);
-+
-+ return 0;
-+}
-diff --git a/tools/gcc/colorize_plugin.c b/tools/gcc/colorize_plugin.c
-new file mode 100644
-index 0000000..414fe5e
---- /dev/null
-+++ b/tools/gcc/colorize_plugin.c
-@@ -0,0 +1,151 @@
-+/*
-+ * Copyright 2012-2013 by PaX Team <pageexec@freemail.hu>
-+ * Licensed under the GPL v2
-+ *
-+ * Note: the choice of the license means that the compilation process is
-+ * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
-+ * but for the kernel it doesn't matter since it doesn't link against
-+ * any of the gcc libraries
-+ *
-+ * gcc plugin to colorize diagnostic output
-+ *
-+ */
-+
-+#include "gcc-plugin.h"
-+#include "config.h"
-+#include "system.h"
-+#include "coretypes.h"
-+#include "tree.h"
-+#include "tree-pass.h"
-+#include "flags.h"
-+#include "intl.h"
-+#include "toplev.h"
-+#include "plugin.h"
-+#include "diagnostic.h"
-+#include "plugin-version.h"
-+#include "tm.h"
-+
-+int plugin_is_GPL_compatible;
-+
-+static struct plugin_info colorize_plugin_info = {
-+ .version = "201302112000",
-+ .help = NULL,
-+};
-+
-+#define GREEN "\033[32m\033[2m"
-+#define LIGHTGREEN "\033[32m\033[1m"
-+#define YELLOW "\033[33m\033[2m"
-+#define LIGHTYELLOW "\033[33m\033[1m"
-+#define RED "\033[31m\033[2m"
-+#define LIGHTRED "\033[31m\033[1m"
-+#define BLUE "\033[34m\033[2m"
-+#define LIGHTBLUE "\033[34m\033[1m"
-+#define BRIGHT "\033[m\033[1m"
-+#define NORMAL "\033[m"
-+
-+static diagnostic_starter_fn old_starter;
-+static diagnostic_finalizer_fn old_finalizer;
-+
-+static void start_colorize(diagnostic_context *context, diagnostic_info *diagnostic)
-+{
-+ const char *color;
-+ char *newprefix;
-+
-+ switch (diagnostic->kind) {
-+ case DK_NOTE:
-+ color = LIGHTBLUE;
-+ break;
-+
-+ case DK_PEDWARN:
-+ case DK_WARNING:
-+ color = LIGHTYELLOW;
-+ break;
-+
-+ case DK_ERROR:
-+ case DK_FATAL:
-+ case DK_ICE:
-+ case DK_PERMERROR:
-+ case DK_SORRY:
-+ color = LIGHTRED;
-+ break;
-+
-+ default:
-+ color = NORMAL;
-+ }
-+
-+ old_starter(context, diagnostic);
-+ if (-1 == asprintf(&newprefix, "%s%s" NORMAL, color, context->printer->prefix))
-+ return;
-+ pp_destroy_prefix(context->printer);
-+ pp_set_prefix(context->printer, newprefix);
-+}
-+
-+static void finalize_colorize(diagnostic_context *context, diagnostic_info *diagnostic)
-+{
-+ old_finalizer(context, diagnostic);
-+}
-+
-+static void colorize_arm(void)
-+{
-+ old_starter = diagnostic_starter(global_dc);
-+ old_finalizer = diagnostic_finalizer(global_dc);
-+
-+ diagnostic_starter(global_dc) = start_colorize;
-+ diagnostic_finalizer(global_dc) = finalize_colorize;
-+}
-+
-+static unsigned int execute_colorize_rearm(void)
-+{
-+ if (diagnostic_starter(global_dc) == start_colorize)
-+ return 0;
-+
-+ colorize_arm();
-+ return 0;
-+}
-+
-+struct simple_ipa_opt_pass pass_ipa_colorize_rearm = {
-+ .pass = {
-+ .type = SIMPLE_IPA_PASS,
-+ .name = "colorize_rearm",
-+#if BUILDING_GCC_VERSION >= 4008
-+ .optinfo_flags = OPTGROUP_NONE,
-+#endif
-+ .gate = NULL,
-+ .execute = execute_colorize_rearm,
-+ .sub = NULL,
-+ .next = NULL,
-+ .static_pass_number = 0,
-+ .tv_id = TV_NONE,
-+ .properties_required = 0,
-+ .properties_provided = 0,
-+ .properties_destroyed = 0,
-+ .todo_flags_start = 0,
-+ .todo_flags_finish = 0
-+ }
-+};
-+
-+static void colorize_start_unit(void *gcc_data, void *user_data)
-+{
-+ colorize_arm();
-+}
-+
-+int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
-+{
-+ const char * const plugin_name = plugin_info->base_name;
-+ struct register_pass_info colorize_rearm_pass_info = {
-+ .pass = &pass_ipa_colorize_rearm.pass,
-+ .reference_pass_name = "*free_lang_data",
-+ .ref_pass_instance_number = 1,
-+ .pos_op = PASS_POS_INSERT_AFTER
-+ };
-+
-+ if (!plugin_default_version_check(version, &gcc_version)) {
-+ error(G_("incompatible gcc/plugin versions"));
-+ return 1;
-+ }
-+
-+ register_callback(plugin_name, PLUGIN_INFO, NULL, &colorize_plugin_info);
-+ register_callback(plugin_name, PLUGIN_START_UNIT, &colorize_start_unit, NULL);
-+ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &colorize_rearm_pass_info);
-+ return 0;
-+}
-diff --git a/tools/gcc/constify_plugin.c b/tools/gcc/constify_plugin.c
-new file mode 100644
-index 0000000..c415c9d
---- /dev/null
-+++ b/tools/gcc/constify_plugin.c
-@@ -0,0 +1,359 @@
-+/*
-+ * Copyright 2011 by Emese Revfy <re.emese@gmail.com>
-+ * Copyright 2011-2013 by PaX Team <pageexec@freemail.hu>
-+ * Licensed under the GPL v2, or (at your option) v3
-+ *
-+ * This gcc plugin constifies all structures which contain only function pointers or are explicitly marked for constification.
-+ *
-+ * Homepage:
-+ * http://www.grsecurity.net/~ephox/const_plugin/
-+ *
-+ * Usage:
-+ * $ gcc -I`gcc -print-file-name=plugin`/include -fPIC -shared -O2 -o constify_plugin.so constify_plugin.c
-+ * $ gcc -fplugin=constify_plugin.so test.c -O2
-+ */
-+
-+#include "gcc-plugin.h"
-+#include "config.h"
-+#include "system.h"
-+#include "coretypes.h"
-+#include "tree.h"
-+#include "tree-pass.h"
-+#include "flags.h"
-+#include "intl.h"
-+#include "toplev.h"
-+#include "plugin.h"
-+#include "diagnostic.h"
-+#include "plugin-version.h"
-+#include "tm.h"
-+#include "function.h"
-+#include "basic-block.h"
-+#include "gimple.h"
-+#include "rtl.h"
-+#include "emit-rtl.h"
-+#include "tree-flow.h"
-+
-+#define C_TYPE_FIELDS_READONLY(TYPE) TREE_LANG_FLAG_1(TYPE)
-+
-+int plugin_is_GPL_compatible;
-+
-+static struct plugin_info const_plugin_info = {
-+ .version = "201302112000",
-+ .help = "no-constify\tturn off constification\n",
-+};
-+
-+static tree get_field_type(tree field)
-+{
-+ return strip_array_types(TREE_TYPE(field));
-+}
-+
-+static bool walk_struct(tree node);
-+static void deconstify_tree(tree node);
-+
-+static void deconstify_type(tree type)
-+{
-+ tree field;
-+
-+ for (field = TYPE_FIELDS(type); field; field = TREE_CHAIN(field)) {
-+ tree fieldtype = get_field_type(field);
-+
-+ if (TREE_CODE(fieldtype) != RECORD_TYPE && TREE_CODE(fieldtype) != UNION_TYPE)
-+ continue;
-+ if (!TYPE_READONLY(fieldtype))
-+ continue;
-+ if (!walk_struct(fieldtype))
-+ continue;
-+
-+ deconstify_tree(field);
-+ TREE_READONLY(field) = 0;
-+ }
-+ TYPE_READONLY(type) = 0;
-+ C_TYPE_FIELDS_READONLY(type) = 0;
-+}
-+
-+static void deconstify_tree(tree node)
-+{
-+ tree old_type, new_type, field;
-+
-+// TREE_READONLY(node) = 0;
-+ old_type = TREE_TYPE(node);
-+ while (TREE_CODE(old_type) == ARRAY_TYPE && TREE_CODE(TREE_TYPE(old_type)) != ARRAY_TYPE) {
-+ node = old_type;
-+ old_type = TREE_TYPE(old_type);
-+ }
-+
-+ gcc_assert(TREE_CODE(old_type) == RECORD_TYPE || TREE_CODE(old_type) == UNION_TYPE);
-+ gcc_assert(TYPE_READONLY(old_type) && (TYPE_QUALS(old_type) & TYPE_QUAL_CONST));
-+
-+ new_type = build_qualified_type(old_type, TYPE_QUALS(old_type) & ~TYPE_QUAL_CONST);
-+ TYPE_FIELDS(new_type) = copy_list(TYPE_FIELDS(new_type));
-+ for (field = TYPE_FIELDS(new_type); field; field = TREE_CHAIN(field))
-+ DECL_FIELD_CONTEXT(field) = new_type;
-+
-+ deconstify_type(new_type);
-+
-+ TREE_TYPE(node) = new_type;
-+}
-+
-+static tree handle_no_const_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
-+{
-+ tree type;
-+
-+ *no_add_attrs = true;
-+ if (TREE_CODE(*node) == FUNCTION_DECL) {
-+ error("%qE attribute does not apply to functions", name);
-+ return NULL_TREE;
-+ }
-+
-+ if (TREE_CODE(*node) == VAR_DECL) {
-+ error("%qE attribute does not apply to variables", name);
-+ return NULL_TREE;
-+ }
-+
-+ if (TYPE_P(*node)) {
-+ if (TREE_CODE(*node) == RECORD_TYPE || TREE_CODE(*node) == UNION_TYPE)
-+ *no_add_attrs = false;
-+ else
-+ error("%qE attribute applies to struct and union types only", name);
-+ return NULL_TREE;
-+ }
-+
-+ type = TREE_TYPE(*node);
-+
-+ if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE) {
-+ error("%qE attribute applies to struct and union types only", name);
-+ return NULL_TREE;
-+ }
-+
-+ if (lookup_attribute(IDENTIFIER_POINTER(name), TYPE_ATTRIBUTES(type))) {
-+ error("%qE attribute is already applied to the type", name);
-+ return NULL_TREE;
-+ }
-+
-+ if (TREE_CODE(*node) == TYPE_DECL && !TYPE_READONLY(type)) {
-+ error("%qE attribute used on type that is not constified", name);
-+ return NULL_TREE;
-+ }
-+
-+ if (TREE_CODE(*node) == TYPE_DECL) {
-+ deconstify_tree(*node);
-+ return NULL_TREE;
-+ }
-+
-+ return NULL_TREE;
-+}
-+
-+static void constify_type(tree type)
-+{
-+ TYPE_READONLY(type) = 1;
-+ C_TYPE_FIELDS_READONLY(type) = 1;
-+}
-+
-+static tree handle_do_const_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
-+{
-+ *no_add_attrs = true;
-+ if (!TYPE_P(*node)) {
-+ error("%qE attribute applies to types only", name);
-+ return NULL_TREE;
-+ }
-+
-+ if (TREE_CODE(*node) != RECORD_TYPE && TREE_CODE(*node) != UNION_TYPE) {
-+ error("%qE attribute applies to struct and union types only", name);
-+ return NULL_TREE;
-+ }
-+
-+ *no_add_attrs = false;
-+ constify_type(*node);
-+ return NULL_TREE;
-+}
-+
-+static struct attribute_spec no_const_attr = {
-+ .name = "no_const",
-+ .min_length = 0,
-+ .max_length = 0,
-+ .decl_required = false,
-+ .type_required = false,
-+ .function_type_required = false,
-+ .handler = handle_no_const_attribute,
-+#if BUILDING_GCC_VERSION >= 4007
-+ .affects_type_identity = true
-+#endif
-+};
-+
-+static struct attribute_spec do_const_attr = {
-+ .name = "do_const",
-+ .min_length = 0,
-+ .max_length = 0,
-+ .decl_required = false,
-+ .type_required = false,
-+ .function_type_required = false,
-+ .handler = handle_do_const_attribute,
-+#if BUILDING_GCC_VERSION >= 4007
-+ .affects_type_identity = true
-+#endif
-+};
-+
-+static void register_attributes(void *event_data, void *data)
-+{
-+ register_attribute(&no_const_attr);
-+ register_attribute(&do_const_attr);
-+}
-+
-+static bool is_fptr(tree field)
-+{
-+ tree ptr = get_field_type(field);
-+
-+ if (TREE_CODE(ptr) != POINTER_TYPE)
-+ return false;
-+
-+ return TREE_CODE(TREE_TYPE(ptr)) == FUNCTION_TYPE;
-+}
-+
-+static bool walk_struct(tree node)
-+{
-+ tree field;
-+
-+ if (TYPE_FIELDS(node) == NULL_TREE)
-+ return false;
-+
-+ if (lookup_attribute("do_const", TYPE_ATTRIBUTES(node)))
-+ return true;
-+
-+ if (lookup_attribute("no_const", TYPE_ATTRIBUTES(node))) {
-+ gcc_assert(!TYPE_READONLY(node));
-+ deconstify_type(node);
-+ return false;
-+ }
-+
-+ for (field = TYPE_FIELDS(node); field; field = TREE_CHAIN(field)) {
-+ tree type = get_field_type(field);
-+ enum tree_code code = TREE_CODE(type);
-+
-+ if (node == type)
-+ return false;
-+ if (code == RECORD_TYPE || code == UNION_TYPE) {
-+ if (!(walk_struct(type)))
-+ return false;
-+ } else if (!is_fptr(field) && !TREE_READONLY(field))
-+ return false;
-+ }
-+ return true;
-+}
-+
-+static void finish_type(void *event_data, void *data)
-+{
-+ tree type = (tree)event_data;
-+
-+ if (type == NULL_TREE || type == error_mark_node)
-+ return;
-+
-+ if (TYPE_READONLY(type))
-+ return;
-+
-+ if (walk_struct(type))
-+ constify_type(type);
-+ else
-+ deconstify_type(type);
-+}
-+
-+static unsigned int check_local_variables(void)
-+{
-+ unsigned int ret = 0;
-+ tree var;
-+
-+#if BUILDING_GCC_VERSION == 4005
-+ tree vars;
-+#else
-+ unsigned int i;
-+#endif
-+
-+#if BUILDING_GCC_VERSION == 4005
-+ for (vars = cfun->local_decls; vars; vars = TREE_CHAIN(vars)) {
-+ var = TREE_VALUE(vars);
-+#else
-+ FOR_EACH_LOCAL_DECL(cfun, i, var) {
-+#endif
-+ tree type = TREE_TYPE(var);
-+
-+ gcc_assert(DECL_P(var));
-+ if (is_global_var(var))
-+ continue;
-+
-+ if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE)
-+ continue;
-+
-+ if (!TYPE_READONLY(type))
-+ continue;
-+
-+// if (lookup_attribute("no_const", DECL_ATTRIBUTES(var)))
-+// continue;
-+
-+ if (lookup_attribute("no_const", TYPE_ATTRIBUTES(type)))
-+ continue;
-+
-+ if (walk_struct(type)) {
-+ error_at(DECL_SOURCE_LOCATION(var), "constified variable %qE cannot be local", var);
-+ ret = 1;
-+ }
-+ }
-+ return ret;
-+}
-+
-+struct gimple_opt_pass pass_local_variable = {
-+ {
-+ .type = GIMPLE_PASS,
-+ .name = "check_local_variables",
-+#if BUILDING_GCC_VERSION >= 4008
-+ .optinfo_flags = OPTGROUP_NONE,
-+#endif
-+ .gate = NULL,
-+ .execute = check_local_variables,
-+ .sub = NULL,
-+ .next = NULL,
-+ .static_pass_number = 0,
-+ .tv_id = TV_NONE,
-+ .properties_required = 0,
-+ .properties_provided = 0,
-+ .properties_destroyed = 0,
-+ .todo_flags_start = 0,
-+ .todo_flags_finish = 0
-+ }
-+};
-+
-+int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
-+{
-+ const char * const plugin_name = plugin_info->base_name;
-+ const int argc = plugin_info->argc;
-+ const struct plugin_argument * const argv = plugin_info->argv;
-+ int i;
-+ bool constify = true;
-+
-+ struct register_pass_info local_variable_pass_info = {
-+ .pass = &pass_local_variable.pass,
-+ .reference_pass_name = "ssa",
-+ .ref_pass_instance_number = 1,
-+ .pos_op = PASS_POS_INSERT_BEFORE
-+ };
-+
-+ if (!plugin_default_version_check(version, &gcc_version)) {
-+ error(G_("incompatible gcc/plugin versions"));
-+ return 1;
-+ }
-+
-+ for (i = 0; i < argc; ++i) {
-+ if (!(strcmp(argv[i].key, "no-constify"))) {
-+ constify = false;
-+ continue;
-+ }
-+ error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
-+ }
-+
-+ register_callback(plugin_name, PLUGIN_INFO, NULL, &const_plugin_info);
-+ if (constify) {
-+ register_callback(plugin_name, PLUGIN_FINISH_TYPE, finish_type, NULL);
-+ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &local_variable_pass_info);
-+ }
-+ register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
-+
-+ return 0;
-+}
-diff --git a/tools/gcc/generate_size_overflow_hash.sh b/tools/gcc/generate_size_overflow_hash.sh
-new file mode 100644
-index 0000000..e518932
---- /dev/null
-+++ b/tools/gcc/generate_size_overflow_hash.sh
-@@ -0,0 +1,94 @@
-+#!/bin/bash
-+
-+# This script generates the hash table (size_overflow_hash.h) for the size_overflow gcc plugin (size_overflow_plugin.c).
-+
-+header1="size_overflow_hash.h"
-+database="size_overflow_hash.data"
-+n=65536
-+
-+usage() {
-+cat <<EOF
-+usage: $0 options
-+OPTIONS:
-+ -h|--help help
-+ -o header file
-+ -d database file
-+ -n hash array size
-+EOF
-+ return 0
-+}
-+
-+while true
-+do
-+ case "$1" in
-+ -h|--help) usage && exit 0;;
-+ -n) n=$2; shift 2;;
-+ -o) header1="$2"; shift 2;;
-+ -d) database="$2"; shift 2;;
-+ --) shift 1; break ;;
-+ *) break ;;
-+ esac
-+done
-+
-+create_defines() {
-+ for i in `seq 0 31`
-+ do
-+ echo -e "#define PARAM"$i" (1U << "$i")" >> "$header1"
-+ done
-+ echo >> "$header1"
-+}
-+
-+create_structs() {
-+ rm -f "$header1"
-+
-+ create_defines
-+
-+ cat "$database" | while read data
-+ do
-+ data_array=($data)
-+ struct_hash_name="${data_array[0]}"
-+ funcn="${data_array[1]}"
-+ params="${data_array[2]}"
-+ next="${data_array[4]}"
-+
-+ echo "const struct size_overflow_hash $struct_hash_name = {" >> "$header1"
-+
-+ echo -e "\t.next\t= $next,\n\t.name\t= \"$funcn\"," >> "$header1"
-+ echo -en "\t.param\t= " >> "$header1"
-+ line=
-+ for param_num in ${params//-/ };
-+ do
-+ line="${line}PARAM"$param_num"|"
-+ done
-+
-+ echo -e "${line%?},\n};\n" >> "$header1"
-+ done
-+}
-+
-+create_headers() {
-+ echo "const struct size_overflow_hash * const size_overflow_hash[$n] = {" >> "$header1"
-+}
-+
-+create_array_elements() {
-+ index=0
-+ grep -v "nohasharray" $database | sort -n -k 4 | while read data
-+ do
-+ data_array=($data)
-+ i="${data_array[3]}"
-+ hash="${data_array[0]}"
-+ while [[ $index -lt $i ]]
-+ do
-+ echo -e "\t["$index"]\t= NULL," >> "$header1"
-+ index=$(($index + 1))
-+ done
-+ index=$(($index + 1))
-+ echo -e "\t["$i"]\t= &"$hash"," >> "$header1"
-+ done
-+ echo '};' >> $header1
-+}
-+
-+create_structs
-+create_headers
-+create_array_elements
-+
-+exit 0
-diff --git a/tools/gcc/kallocstat_plugin.c b/tools/gcc/kallocstat_plugin.c
-new file mode 100644
-index 0000000..568b360
---- /dev/null
-+++ b/tools/gcc/kallocstat_plugin.c
-@@ -0,0 +1,170 @@
-+/*
-+ * Copyright 2011-2013 by the PaX Team <pageexec@freemail.hu>
-+ * Licensed under the GPL v2
-+ *
-+ * Note: the choice of the license means that the compilation process is
-+ * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
-+ * but for the kernel it doesn't matter since it doesn't link against
-+ * any of the gcc libraries
-+ *
-+ * gcc plugin to find the distribution of k*alloc sizes
-+ *
-+ * TODO:
-+ *
-+ * BUGS:
-+ * - none known
-+ */
-+#include "gcc-plugin.h"
-+#include "config.h"
-+#include "system.h"
-+#include "coretypes.h"
-+#include "tree.h"
-+#include "tree-pass.h"
-+#include "flags.h"
-+#include "intl.h"
-+#include "toplev.h"
-+#include "plugin.h"
-+//#include "expr.h" where are you...
-+#include "diagnostic.h"
-+#include "plugin-version.h"
-+#include "tm.h"
-+#include "function.h"
-+#include "basic-block.h"
-+#include "gimple.h"
-+#include "rtl.h"
-+#include "emit-rtl.h"
-+
-+extern void print_gimple_stmt(FILE *, gimple, int, int);
-+
-+int plugin_is_GPL_compatible;
-+
-+static const char * const kalloc_functions[] = {
-+ "__kmalloc",
-+ "kmalloc",
-+ "kmalloc_large",
-+ "kmalloc_node",
-+ "kmalloc_order",
-+ "kmalloc_order_trace",
-+ "kmalloc_slab",
-+ "kzalloc",
-+ "kzalloc_node",
-+};
-+
-+static struct plugin_info kallocstat_plugin_info = {
-+ .version = "201302112000",
-+};
-+
-+static unsigned int execute_kallocstat(void);
-+
-+static struct gimple_opt_pass kallocstat_pass = {
-+ .pass = {
-+ .type = GIMPLE_PASS,
-+ .name = "kallocstat",
-+#if BUILDING_GCC_VERSION >= 4008
-+ .optinfo_flags = OPTGROUP_NONE,
-+#endif
-+ .gate = NULL,
-+ .execute = execute_kallocstat,
-+ .sub = NULL,
-+ .next = NULL,
-+ .static_pass_number = 0,
-+ .tv_id = TV_NONE,
-+ .properties_required = 0,
-+ .properties_provided = 0,
-+ .properties_destroyed = 0,
-+ .todo_flags_start = 0,
-+ .todo_flags_finish = 0
-+ }
-+};
-+
-+static bool is_kalloc(const char *fnname)
-+{
-+ size_t i;
-+
-+ for (i = 0; i < ARRAY_SIZE(kalloc_functions); i++)
-+ if (!strcmp(fnname, kalloc_functions[i]))
-+ return true;
-+ return false;
-+}
-+
-+static unsigned int execute_kallocstat(void)
-+{
-+ basic_block bb;
-+
-+ // 1. loop through BBs and GIMPLE statements
-+ FOR_EACH_BB(bb) {
-+ gimple_stmt_iterator gsi;
-+ for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
-+ // gimple match:
-+ tree fndecl, size;
-+ gimple call_stmt;
-+ const char *fnname;
-+
-+ // is it a call
-+ call_stmt = gsi_stmt(gsi);
-+ if (!is_gimple_call(call_stmt))
-+ continue;
-+ fndecl = gimple_call_fndecl(call_stmt);
-+ if (fndecl == NULL_TREE)
-+ continue;
-+ if (TREE_CODE(fndecl) != FUNCTION_DECL)
-+ continue;
-+
-+ // is it a call to k*alloc
-+ fnname = IDENTIFIER_POINTER(DECL_NAME(fndecl));
-+ if (!is_kalloc(fnname))
-+ continue;
-+
-+ // is the size arg the result of a simple const assignment
-+ size = gimple_call_arg(call_stmt, 0);
-+ while (true) {
-+ gimple def_stmt;
-+ expanded_location xloc;
-+ size_t size_val;
-+
-+ if (TREE_CODE(size) != SSA_NAME)
-+ break;
-+ def_stmt = SSA_NAME_DEF_STMT(size);
-+ if (!def_stmt || !is_gimple_assign(def_stmt))
-+ break;
-+ if (gimple_num_ops(def_stmt) != 2)
-+ break;
-+ size = gimple_assign_rhs1(def_stmt);
-+ if (!TREE_CONSTANT(size))
-+ continue;
-+ xloc = expand_location(gimple_location(def_stmt));
-+ if (!xloc.file)
-+ xloc = expand_location(DECL_SOURCE_LOCATION(current_function_decl));
-+ size_val = TREE_INT_CST_LOW(size);
-+ fprintf(stderr, "kallocsize: %8zu %8zx %s %s:%u\n", size_val, size_val, fnname, xloc.file, xloc.line);
-+ break;
-+ }
-+//print_gimple_stmt(stderr, call_stmt, 0, TDF_LINENO);
-+//debug_tree(gimple_call_fn(call_stmt));
-+//print_node(stderr, "pax", fndecl, 4);
-+ }
-+ }
-+
-+ return 0;
-+}
-+
-+int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
-+{
-+ const char * const plugin_name = plugin_info->base_name;
-+ struct register_pass_info kallocstat_pass_info = {
-+ .pass = &kallocstat_pass.pass,
-+ .reference_pass_name = "ssa",
-+ .ref_pass_instance_number = 1,
-+ .pos_op = PASS_POS_INSERT_AFTER
-+ };
-+
-+ if (!plugin_default_version_check(version, &gcc_version)) {
-+ error(G_("incompatible gcc/plugin versions"));
-+ return 1;
-+ }
-+
-+ register_callback(plugin_name, PLUGIN_INFO, NULL, &kallocstat_plugin_info);
-+ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kallocstat_pass_info);
-+
-+ return 0;
-+}
-diff --git a/tools/gcc/kernexec_plugin.c b/tools/gcc/kernexec_plugin.c
-new file mode 100644
-index 0000000..0408e06
---- /dev/null
-+++ b/tools/gcc/kernexec_plugin.c
-@@ -0,0 +1,465 @@
-+/*
-+ * Copyright 2011-2013 by the PaX Team <pageexec@freemail.hu>
-+ * Licensed under the GPL v2
-+ *
-+ * Note: the choice of the license means that the compilation process is
-+ * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
-+ * but for the kernel it doesn't matter since it doesn't link against
-+ * any of the gcc libraries
-+ *
-+ * gcc plugin to make KERNEXEC/amd64 almost as good as it is on i386
-+ *
-+ * TODO:
-+ *
-+ * BUGS:
-+ * - none known
-+ */
-+#include "gcc-plugin.h"
-+#include "config.h"
-+#include "system.h"
-+#include "coretypes.h"
-+#include "tree.h"
-+#include "tree-pass.h"
-+#include "flags.h"
-+#include "intl.h"
-+#include "toplev.h"
-+#include "plugin.h"
-+//#include "expr.h" where are you...
-+#include "diagnostic.h"
-+#include "plugin-version.h"
-+#include "tm.h"
-+#include "function.h"
-+#include "basic-block.h"
-+#include "gimple.h"
-+#include "rtl.h"
-+#include "emit-rtl.h"
-+#include "tree-flow.h"
-+
-+extern void print_gimple_stmt(FILE *, gimple, int, int);
-+extern rtx emit_move_insn(rtx x, rtx y);
-+
-+#if BUILDING_GCC_VERSION <= 4006
-+#define ANY_RETURN_P(rtx) (GET_CODE(rtx) == RETURN)
-+#endif
-+
-+#if BUILDING_GCC_VERSION >= 4008
-+#define TODO_dump_func 0
-+#endif
-+
-+int plugin_is_GPL_compatible;
-+
-+static struct plugin_info kernexec_plugin_info = {
-+ .version = "201302112000",
-+ .help = "method=[bts|or]\tinstrumentation method\n"
-+};
-+
-+static unsigned int execute_kernexec_reload(void);
-+static unsigned int execute_kernexec_fptr(void);
-+static unsigned int execute_kernexec_retaddr(void);
-+static bool kernexec_cmodel_check(void);
-+
-+static void (*kernexec_instrument_fptr)(gimple_stmt_iterator *);
-+static void (*kernexec_instrument_retaddr)(rtx);
-+
-+static struct gimple_opt_pass kernexec_reload_pass = {
-+ .pass = {
-+ .type = GIMPLE_PASS,
-+ .name = "kernexec_reload",
-+#if BUILDING_GCC_VERSION >= 4008
-+ .optinfo_flags = OPTGROUP_NONE,
-+#endif
-+ .gate = kernexec_cmodel_check,
-+ .execute = execute_kernexec_reload,
-+ .sub = NULL,
-+ .next = NULL,
-+ .static_pass_number = 0,
-+ .tv_id = TV_NONE,
-+ .properties_required = 0,
-+ .properties_provided = 0,
-+ .properties_destroyed = 0,
-+ .todo_flags_start = 0,
-+ .todo_flags_finish = TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_remove_unused_locals | TODO_update_ssa_no_phi
-+ }
-+};
-+
-+static struct gimple_opt_pass kernexec_fptr_pass = {
-+ .pass = {
-+ .type = GIMPLE_PASS,
-+ .name = "kernexec_fptr",
-+#if BUILDING_GCC_VERSION >= 4008
-+ .optinfo_flags = OPTGROUP_NONE,
-+#endif
-+ .gate = kernexec_cmodel_check,
-+ .execute = execute_kernexec_fptr,
-+ .sub = NULL,
-+ .next = NULL,
-+ .static_pass_number = 0,
-+ .tv_id = TV_NONE,
-+ .properties_required = 0,
-+ .properties_provided = 0,
-+ .properties_destroyed = 0,
-+ .todo_flags_start = 0,
-+ .todo_flags_finish = TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_remove_unused_locals | TODO_update_ssa_no_phi
-+ }
-+};
-+
-+static struct rtl_opt_pass kernexec_retaddr_pass = {
-+ .pass = {
-+ .type = RTL_PASS,
-+ .name = "kernexec_retaddr",
-+#if BUILDING_GCC_VERSION >= 4008
-+ .optinfo_flags = OPTGROUP_NONE,
-+#endif
-+ .gate = kernexec_cmodel_check,
-+ .execute = execute_kernexec_retaddr,
-+ .sub = NULL,
-+ .next = NULL,
-+ .static_pass_number = 0,
-+ .tv_id = TV_NONE,
-+ .properties_required = 0,
-+ .properties_provided = 0,
-+ .properties_destroyed = 0,
-+ .todo_flags_start = 0,
-+ .todo_flags_finish = TODO_dump_func | TODO_ggc_collect
-+ }
-+};
-+
-+static bool kernexec_cmodel_check(void)
-+{
-+ tree section;
-+
-+ if (ix86_cmodel != CM_KERNEL)
-+ return false;
-+
-+ section = lookup_attribute("section", DECL_ATTRIBUTES(current_function_decl));
-+ if (!section || !TREE_VALUE(section))
-+ return true;
-+
-+ section = TREE_VALUE(TREE_VALUE(section));
-+ if (strncmp(TREE_STRING_POINTER(section), ".vsyscall_", 10))
-+ return true;
-+
-+ return false;
-+}
-+
-+/*
-+ * add special KERNEXEC instrumentation: reload %r10 after it has been clobbered
-+ */
-+static void kernexec_reload_fptr_mask(gimple_stmt_iterator *gsi)
-+{
-+ gimple asm_movabs_stmt;
-+
-+ // build asm volatile("movabs $0x8000000000000000, %%r10\n\t" : : : );
-+ asm_movabs_stmt = gimple_build_asm_vec("movabs $0x8000000000000000, %%r10\n\t", NULL, NULL, NULL, NULL);
-+ gimple_asm_set_volatile(asm_movabs_stmt, true);
-+ gsi_insert_after(gsi, asm_movabs_stmt, GSI_CONTINUE_LINKING);
-+ update_stmt(asm_movabs_stmt);
-+}
-+
-+/*
-+ * find all asm() stmts that clobber r10 and add a reload of r10
-+ */
-+static unsigned int execute_kernexec_reload(void)
-+{
-+ basic_block bb;
-+
-+ // 1. loop through BBs and GIMPLE statements
-+ FOR_EACH_BB(bb) {
-+ gimple_stmt_iterator gsi;
-+
-+ for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
-+ // gimple match: __asm__ ("" : : : "r10");
-+ gimple asm_stmt;
-+ size_t nclobbers;
-+
-+ // is it an asm ...
-+ asm_stmt = gsi_stmt(gsi);
-+ if (gimple_code(asm_stmt) != GIMPLE_ASM)
-+ continue;
-+
-+ // ... clobbering r10
-+ nclobbers = gimple_asm_nclobbers(asm_stmt);
-+ while (nclobbers--) {
-+ tree op = gimple_asm_clobber_op(asm_stmt, nclobbers);
-+ if (strcmp(TREE_STRING_POINTER(TREE_VALUE(op)), "r10"))
-+ continue;
-+ kernexec_reload_fptr_mask(&gsi);
-+//print_gimple_stmt(stderr, asm_stmt, 0, TDF_LINENO);
-+ break;
-+ }
-+ }
-+ }
-+
-+ return 0;
-+}
-+
-+/*
-+ * add special KERNEXEC instrumentation: force MSB of fptr to 1, which will produce
-+ * a non-canonical address from a userland ptr and will just trigger a GPF on dereference
-+ */
-+static void kernexec_instrument_fptr_bts(gimple_stmt_iterator *gsi)
-+{
-+ gimple assign_intptr, assign_new_fptr, call_stmt;
-+ tree intptr, old_fptr, new_fptr, kernexec_mask;
-+
-+ call_stmt = gsi_stmt(*gsi);
-+ old_fptr = gimple_call_fn(call_stmt);
-+
-+ // create temporary unsigned long variable used for bitops and cast fptr to it
-+ intptr = create_tmp_var(long_unsigned_type_node, "kernexec_bts");
-+#if BUILDING_GCC_VERSION <= 4007
-+ add_referenced_var(intptr);
-+ mark_sym_for_renaming(intptr);
-+#endif
-+ assign_intptr = gimple_build_assign(intptr, fold_convert(long_unsigned_type_node, old_fptr));
-+ gsi_insert_before(gsi, assign_intptr, GSI_SAME_STMT);
-+ update_stmt(assign_intptr);
-+
-+ // apply logical or to temporary unsigned long and bitmask
-+ kernexec_mask = build_int_cstu(long_long_unsigned_type_node, 0x8000000000000000LL);
-+// kernexec_mask = build_int_cstu(long_long_unsigned_type_node, 0xffffffff80000000LL);
-+ assign_intptr = gimple_build_assign(intptr, fold_build2(BIT_IOR_EXPR, long_long_unsigned_type_node, intptr, kernexec_mask));
-+ gsi_insert_before(gsi, assign_intptr, GSI_SAME_STMT);
-+ update_stmt(assign_intptr);
-+
-+ // cast temporary unsigned long back to a temporary fptr variable
-+ new_fptr = create_tmp_var(TREE_TYPE(old_fptr), "kernexec_fptr");
-+#if BUILDING_GCC_VERSION <= 4007
-+ add_referenced_var(new_fptr);
-+ mark_sym_for_renaming(new_fptr);
-+#endif
-+ assign_new_fptr = gimple_build_assign(new_fptr, fold_convert(TREE_TYPE(old_fptr), intptr));
-+ gsi_insert_before(gsi, assign_new_fptr, GSI_SAME_STMT);
-+ update_stmt(assign_new_fptr);
-+
-+ // replace call stmt fn with the new fptr
-+ gimple_call_set_fn(call_stmt, new_fptr);
-+ update_stmt(call_stmt);
-+}
-+
-+static void kernexec_instrument_fptr_or(gimple_stmt_iterator *gsi)
-+{
-+ gimple asm_or_stmt, call_stmt;
-+ tree old_fptr, new_fptr, input, output;
-+#if BUILDING_GCC_VERSION <= 4007
-+ VEC(tree, gc) *inputs = NULL;
-+ VEC(tree, gc) *outputs = NULL;
-+#else
-+ vec<tree, va_gc> *inputs = NULL;
-+ vec<tree, va_gc> *outputs = NULL;
-+#endif
-+
-+ call_stmt = gsi_stmt(*gsi);
-+ old_fptr = gimple_call_fn(call_stmt);
-+
-+ // create temporary fptr variable
-+ new_fptr = create_tmp_var(TREE_TYPE(old_fptr), "kernexec_or");
-+#if BUILDING_GCC_VERSION <= 4007
-+ add_referenced_var(new_fptr);
-+ mark_sym_for_renaming(new_fptr);
-+#endif
-+
-+ // build asm volatile("orq %%r10, %0\n\t" : "=r"(new_fptr) : "0"(old_fptr));
-+ input = build_tree_list(NULL_TREE, build_string(2, "0"));
-+ input = chainon(NULL_TREE, build_tree_list(input, old_fptr));
-+ output = build_tree_list(NULL_TREE, build_string(3, "=r"));
-+ output = chainon(NULL_TREE, build_tree_list(output, new_fptr));
-+#if BUILDING_GCC_VERSION <= 4007
-+ VEC_safe_push(tree, gc, inputs, input);
-+ VEC_safe_push(tree, gc, outputs, output);
-+#else
-+ vec_safe_push(inputs, input);
-+ vec_safe_push(outputs, output);
-+#endif
-+ asm_or_stmt = gimple_build_asm_vec("orq %%r10, %0\n\t", inputs, outputs, NULL, NULL);
-+ gimple_asm_set_volatile(asm_or_stmt, true);
-+ gsi_insert_before(gsi, asm_or_stmt, GSI_SAME_STMT);
-+ update_stmt(asm_or_stmt);
-+
-+ // replace call stmt fn with the new fptr
-+ gimple_call_set_fn(call_stmt, new_fptr);
-+ update_stmt(call_stmt);
-+}
-+
-+/*
-+ * find all C level function pointer dereferences and forcibly set the highest bit of the pointer
-+ */
-+static unsigned int execute_kernexec_fptr(void)
-+{
-+ basic_block bb;
-+
-+ // 1. loop through BBs and GIMPLE statements
-+ FOR_EACH_BB(bb) {
-+ gimple_stmt_iterator gsi;
-+
-+ for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
-+ // gimple match: h_1 = get_fptr (); D.2709_3 = h_1 (x_2(D));
-+ tree fn;
-+ gimple call_stmt;
-+
-+ // is it a call ...
-+ call_stmt = gsi_stmt(gsi);
-+ if (!is_gimple_call(call_stmt))
-+ continue;
-+ fn = gimple_call_fn(call_stmt);
-+ if (TREE_CODE(fn) == ADDR_EXPR)
-+ continue;
-+ if (TREE_CODE(fn) != SSA_NAME)
-+ gcc_unreachable();
-+
-+ // ... through a function pointer
-+ if (SSA_NAME_VAR(fn) != NULL_TREE) {
-+ fn = SSA_NAME_VAR(fn);
-+ if (TREE_CODE(fn) != VAR_DECL && TREE_CODE(fn) != PARM_DECL) {
-+ debug_tree(fn);
-+ gcc_unreachable();
-+ }
-+ }
-+ fn = TREE_TYPE(fn);
-+ if (TREE_CODE(fn) != POINTER_TYPE)
-+ continue;
-+ fn = TREE_TYPE(fn);
-+ if (TREE_CODE(fn) != FUNCTION_TYPE)
-+ continue;
-+
-+ kernexec_instrument_fptr(&gsi);
-+
-+//debug_tree(gimple_call_fn(call_stmt));
-+//print_gimple_stmt(stderr, call_stmt, 0, TDF_LINENO);
-+ }
-+ }
-+
-+ return 0;
-+}
-+
-+// add special KERNEXEC instrumentation: btsq $63,(%rsp) just before retn
-+static void kernexec_instrument_retaddr_bts(rtx insn)
-+{
-+ rtx btsq;
-+ rtvec argvec, constraintvec, labelvec;
-+ int line;
-+
-+ // create asm volatile("btsq $63,(%%rsp)":::)
-+ argvec = rtvec_alloc(0);
-+ constraintvec = rtvec_alloc(0);
-+ labelvec = rtvec_alloc(0);
-+ line = expand_location(RTL_LOCATION(insn)).line;
-+ btsq = gen_rtx_ASM_OPERANDS(VOIDmode, "btsq $63,(%%rsp)", empty_string, 0, argvec, constraintvec, labelvec, line);
-+ MEM_VOLATILE_P(btsq) = 1;
-+// RTX_FRAME_RELATED_P(btsq) = 1; // not for ASM_OPERANDS
-+ emit_insn_before(btsq, insn);
-+}
-+
-+// add special KERNEXEC instrumentation: orq %r10,(%rsp) just before retn
-+static void kernexec_instrument_retaddr_or(rtx insn)
-+{
-+ rtx orq;
-+ rtvec argvec, constraintvec, labelvec;
-+ int line;
-+
-+ // create asm volatile("orq %%r10,(%%rsp)":::)
-+ argvec = rtvec_alloc(0);
-+ constraintvec = rtvec_alloc(0);
-+ labelvec = rtvec_alloc(0);
-+ line = expand_location(RTL_LOCATION(insn)).line;
-+ orq = gen_rtx_ASM_OPERANDS(VOIDmode, "orq %%r10,(%%rsp)", empty_string, 0, argvec, constraintvec, labelvec, line);
-+ MEM_VOLATILE_P(orq) = 1;
-+// RTX_FRAME_RELATED_P(orq) = 1; // not for ASM_OPERANDS
-+ emit_insn_before(orq, insn);
-+}
-+
-+/*
-+ * find all asm level function returns and forcibly set the highest bit of the return address
-+ */
-+static unsigned int execute_kernexec_retaddr(void)
-+{
-+ rtx insn;
-+
-+ // 1. find function returns
-+ for (insn = get_insns(); insn; insn = NEXT_INSN(insn)) {
-+ // rtl match: (jump_insn 41 40 42 2 (return) fptr.c:42 634 {return_internal} (nil))
-+ // (jump_insn 12 9 11 2 (parallel [ (return) (unspec [ (0) ] UNSPEC_REP) ]) fptr.c:46 635 {return_internal_long} (nil))
-+ // (jump_insn 97 96 98 6 (simple_return) fptr.c:50 -1 (nil) -> simple_return)
-+ rtx body;
-+
-+ // is it a retn
-+ if (!JUMP_P(insn))
-+ continue;
-+ body = PATTERN(insn);
-+ if (GET_CODE(body) == PARALLEL)
-+ body = XVECEXP(body, 0, 0);
-+ if (!ANY_RETURN_P(body))
-+ continue;
-+ kernexec_instrument_retaddr(insn);
-+ }
-+
-+// print_simple_rtl(stderr, get_insns());
-+// print_rtl(stderr, get_insns());
-+
-+ return 0;
-+}
-+
-+int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
-+{
-+ const char * const plugin_name = plugin_info->base_name;
-+ const int argc = plugin_info->argc;
-+ const struct plugin_argument * const argv = plugin_info->argv;
-+ int i;
-+ struct register_pass_info kernexec_reload_pass_info = {
-+ .pass = &kernexec_reload_pass.pass,
-+ .reference_pass_name = "ssa",
-+ .ref_pass_instance_number = 1,
-+ .pos_op = PASS_POS_INSERT_AFTER
-+ };
-+ struct register_pass_info kernexec_fptr_pass_info = {
-+ .pass = &kernexec_fptr_pass.pass,
-+ .reference_pass_name = "ssa",
-+ .ref_pass_instance_number = 1,
-+ .pos_op = PASS_POS_INSERT_AFTER
-+ };
-+ struct register_pass_info kernexec_retaddr_pass_info = {
-+ .pass = &kernexec_retaddr_pass.pass,
-+ .reference_pass_name = "pro_and_epilogue",
-+ .ref_pass_instance_number = 1,
-+ .pos_op = PASS_POS_INSERT_AFTER
-+ };
-+
-+ if (!plugin_default_version_check(version, &gcc_version)) {
-+ error(G_("incompatible gcc/plugin versions"));
-+ return 1;
-+ }
-+
-+ register_callback(plugin_name, PLUGIN_INFO, NULL, &kernexec_plugin_info);
-+
-+ if (TARGET_64BIT == 0)
-+ return 0;
-+
-+ for (i = 0; i < argc; ++i) {
-+ if (!strcmp(argv[i].key, "method")) {
-+ if (!argv[i].value) {
-+ error(G_("no value supplied for option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
-+ continue;
-+ }
-+ if (!strcmp(argv[i].value, "bts")) {
-+ kernexec_instrument_fptr = kernexec_instrument_fptr_bts;
-+ kernexec_instrument_retaddr = kernexec_instrument_retaddr_bts;
-+ } else if (!strcmp(argv[i].value, "or")) {
-+ kernexec_instrument_fptr = kernexec_instrument_fptr_or;
-+ kernexec_instrument_retaddr = kernexec_instrument_retaddr_or;
-+ fix_register("r10", 1, 1);
-+ } else
-+ error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
-+ continue;
-+ }
-+ error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
-+ }
-+ if (!kernexec_instrument_fptr || !kernexec_instrument_retaddr)
-+ error(G_("no instrumentation method was selected via '-fplugin-arg-%s-method'"), plugin_name);
-+
-+ if (kernexec_instrument_fptr == kernexec_instrument_fptr_or)
-+ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kernexec_reload_pass_info);
-+ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kernexec_fptr_pass_info);
-+ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kernexec_retaddr_pass_info);
-+
-+ return 0;
-+}
-diff --git a/tools/gcc/latent_entropy_plugin.c b/tools/gcc/latent_entropy_plugin.c
-new file mode 100644
-index 0000000..1276616
---- /dev/null
-+++ b/tools/gcc/latent_entropy_plugin.c
-@@ -0,0 +1,321 @@
-+/*
-+ * Copyright 2012-2013 by the PaX Team <pageexec@freemail.hu>
-+ * Licensed under the GPL v2
-+ *
-+ * Note: the choice of the license means that the compilation process is
-+ * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
-+ * but for the kernel it doesn't matter since it doesn't link against
-+ * any of the gcc libraries
-+ *
-+ * gcc plugin to help generate a little bit of entropy from program state,
-+ * used during boot in the kernel
-+ *
-+ * TODO:
-+ * - add ipa pass to identify not explicitly marked candidate functions
-+ * - mix in more program state (function arguments/return values, loop variables, etc)
-+ * - more instrumentation control via attribute parameters
-+ *
-+ * BUGS:
-+ * - LTO needs -flto-partition=none for now
-+ */
-+#include "gcc-plugin.h"
-+#include "config.h"
-+#include "system.h"
-+#include "coretypes.h"
-+#include "tree.h"
-+#include "tree-pass.h"
-+#include "flags.h"
-+#include "intl.h"
-+#include "toplev.h"
-+#include "plugin.h"
-+//#include "expr.h" where are you...
-+#include "diagnostic.h"
-+#include "plugin-version.h"
-+#include "tm.h"
-+#include "function.h"
-+#include "basic-block.h"
-+#include "gimple.h"
-+#include "rtl.h"
-+#include "emit-rtl.h"
-+#include "tree-flow.h"
-+
-+#if BUILDING_GCC_VERSION >= 4008
-+#define TODO_dump_func 0
-+#endif
-+
-+int plugin_is_GPL_compatible;
-+
-+static tree latent_entropy_decl;
-+
-+static struct plugin_info latent_entropy_plugin_info = {
-+ .version = "201302112000",
-+ .help = NULL
-+};
-+
-+static unsigned int execute_latent_entropy(void);
-+static bool gate_latent_entropy(void);
-+
-+static struct gimple_opt_pass latent_entropy_pass = {
-+ .pass = {
-+ .type = GIMPLE_PASS,
-+ .name = "latent_entropy",
-+#if BUILDING_GCC_VERSION >= 4008
-+ .optinfo_flags = OPTGROUP_NONE,
-+#endif
-+ .gate = gate_latent_entropy,
-+ .execute = execute_latent_entropy,
-+ .sub = NULL,
-+ .next = NULL,
-+ .static_pass_number = 0,
-+ .tv_id = TV_NONE,
-+ .properties_required = PROP_gimple_leh | PROP_cfg,
-+ .properties_provided = 0,
-+ .properties_destroyed = 0,
-+ .todo_flags_start = 0, //TODO_verify_ssa | TODO_verify_flow | TODO_verify_stmts,
-+ .todo_flags_finish = TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_update_ssa
-+ }
-+};
-+
-+static tree handle_latent_entropy_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
-+{
-+ if (TREE_CODE(*node) != FUNCTION_DECL) {
-+ *no_add_attrs = true;
-+ error("%qE attribute only applies to functions", name);
-+ }
-+ return NULL_TREE;
-+}
-+
-+static struct attribute_spec latent_entropy_attr = {
-+ .name = "latent_entropy",
-+ .min_length = 0,
-+ .max_length = 0,
-+ .decl_required = true,
-+ .type_required = false,
-+ .function_type_required = false,
-+ .handler = handle_latent_entropy_attribute,
-+#if BUILDING_GCC_VERSION >= 4007
-+ .affects_type_identity = false
-+#endif
-+};
-+
-+static void register_attributes(void *event_data, void *data)
-+{
-+ register_attribute(&latent_entropy_attr);
-+}
-+
-+static bool gate_latent_entropy(void)
-+{
-+ tree latent_entropy_attr;
-+
-+ latent_entropy_attr = lookup_attribute("latent_entropy", DECL_ATTRIBUTES(current_function_decl));
-+ return latent_entropy_attr != NULL_TREE;
-+}
-+
-+static unsigned HOST_WIDE_INT seed;
-+static unsigned HOST_WIDE_INT get_random_const(void)
-+{
-+ seed = (seed >> 1U) ^ (-(seed & 1ULL) & 0xD800000000000000ULL);
-+ return seed;
-+}
-+
-+static enum tree_code get_op(tree *rhs)
-+{
-+ static enum tree_code op;
-+ unsigned HOST_WIDE_INT random_const;
-+
-+ random_const = get_random_const();
-+
-+ switch (op) {
-+ case BIT_XOR_EXPR:
-+ op = PLUS_EXPR;
-+ break;
-+
-+ case PLUS_EXPR:
-+ if (rhs) {
-+ op = LROTATE_EXPR;
-+ random_const &= HOST_BITS_PER_WIDE_INT - 1;
-+ break;
-+ }
-+
-+ case LROTATE_EXPR:
-+ default:
-+ op = BIT_XOR_EXPR;
-+ break;
-+ }
-+ if (rhs)
-+ *rhs = build_int_cstu(unsigned_intDI_type_node, random_const);
-+ return op;
-+}
-+
-+static void perturb_local_entropy(basic_block bb, tree local_entropy)
-+{
-+ gimple_stmt_iterator gsi;
-+ gimple assign;
-+ tree addxorrol, rhs;
-+ enum tree_code op;
-+
-+ op = get_op(&rhs);
-+ addxorrol = fold_build2_loc(UNKNOWN_LOCATION, op, unsigned_intDI_type_node, local_entropy, rhs);
-+ assign = gimple_build_assign(local_entropy, addxorrol);
-+#if BUILDING_GCC_VERSION <= 4007
-+ find_referenced_vars_in(assign);
-+#endif
-+//debug_bb(bb);
-+ gsi = gsi_after_labels(bb);
-+ gsi_insert_before(&gsi, assign, GSI_NEW_STMT);
-+ update_stmt(assign);
-+}
-+
-+static void perturb_latent_entropy(basic_block bb, tree rhs)
-+{
-+ gimple_stmt_iterator gsi;
-+ gimple assign;
-+ tree addxorrol, temp;
-+
-+ // 1. create temporary copy of latent_entropy
-+ temp = create_tmp_var(unsigned_intDI_type_node, "temp_latent_entropy");
-+#if BUILDING_GCC_VERSION <= 4007
-+ add_referenced_var(temp);
-+ mark_sym_for_renaming(temp);
-+#endif
-+
-+ // 2. read...
-+ assign = gimple_build_assign(temp, latent_entropy_decl);
-+#if BUILDING_GCC_VERSION <= 4007
-+ find_referenced_vars_in(assign);
-+#endif
-+ gsi = gsi_after_labels(bb);
-+ gsi_insert_after(&gsi, assign, GSI_NEW_STMT);
-+ update_stmt(assign);
-+
-+ // 3. ...modify...
-+ addxorrol = fold_build2_loc(UNKNOWN_LOCATION, get_op(NULL), unsigned_intDI_type_node, temp, rhs);
-+ assign = gimple_build_assign(temp, addxorrol);
-+#if BUILDING_GCC_VERSION <= 4007
-+ find_referenced_vars_in(assign);
-+#endif
-+ gsi_insert_after(&gsi, assign, GSI_NEW_STMT);
-+ update_stmt(assign);
-+
-+ // 4. ...write latent_entropy
-+ assign = gimple_build_assign(latent_entropy_decl, temp);
-+#if BUILDING_GCC_VERSION <= 4007
-+ find_referenced_vars_in(assign);
-+#endif
-+ gsi_insert_after(&gsi, assign, GSI_NEW_STMT);
-+ update_stmt(assign);
-+}
-+
-+static unsigned int execute_latent_entropy(void)
-+{
-+ basic_block bb;
-+ gimple assign;
-+ gimple_stmt_iterator gsi;
-+ tree local_entropy;
-+
-+ if (!latent_entropy_decl) {
-+ struct varpool_node *node;
-+
-+#if BUILDING_GCC_VERSION <= 4007
-+ for (node = varpool_nodes; node; node = node->next) {
-+ tree var = node->decl;
-+#else
-+ FOR_EACH_VARIABLE(node) {
-+ tree var = node->symbol.decl;
-+#endif
-+ if (strcmp(IDENTIFIER_POINTER(DECL_NAME(var)), "latent_entropy"))
-+ continue;
-+ latent_entropy_decl = var;
-+// debug_tree(var);
-+ break;
-+ }
-+ if (!latent_entropy_decl) {
-+// debug_tree(current_function_decl);
-+ return 0;
-+ }
-+ }
-+
-+//fprintf(stderr, "latent_entropy: %s\n", IDENTIFIER_POINTER(DECL_NAME(current_function_decl)));
-+
-+ // 1. create local entropy variable
-+ local_entropy = create_tmp_var(unsigned_intDI_type_node, "local_entropy");
-+#if BUILDING_GCC_VERSION <= 4007
-+ add_referenced_var(local_entropy);
-+ mark_sym_for_renaming(local_entropy);
-+#endif
-+
-+ // 2. initialize local entropy variable
-+ bb = split_block_after_labels(ENTRY_BLOCK_PTR)->dest;
-+ if (dom_info_available_p(CDI_DOMINATORS))
-+ set_immediate_dominator(CDI_DOMINATORS, bb, ENTRY_BLOCK_PTR);
-+ gsi = gsi_start_bb(bb);
-+
-+ assign = gimple_build_assign(local_entropy, build_int_cstu(unsigned_intDI_type_node, get_random_const()));
-+// gimple_set_location(assign, loc);
-+#if BUILDING_GCC_VERSION <= 4007
-+ find_referenced_vars_in(assign);
-+#endif
-+ gsi_insert_after(&gsi, assign, GSI_NEW_STMT);
-+ update_stmt(assign);
-+ bb = bb->next_bb;
-+
-+ // 3. instrument each BB with an operation on the local entropy variable
-+ while (bb != EXIT_BLOCK_PTR) {
-+ perturb_local_entropy(bb, local_entropy);
-+ bb = bb->next_bb;
-+ };
-+
-+ // 4. mix local entropy into the global entropy variable
-+ perturb_latent_entropy(EXIT_BLOCK_PTR->prev_bb, local_entropy);
-+ return 0;
-+}
-+
-+static void start_unit_callback(void *gcc_data, void *user_data)
-+{
-+#if BUILDING_GCC_VERSION >= 4007
-+ seed = get_random_seed(false);
-+#else
-+ sscanf(get_random_seed(false), "%" HOST_WIDE_INT_PRINT "x", &seed);
-+ seed *= seed;
-+#endif
-+
-+ if (in_lto_p)
-+ return;
-+
-+ // extern u64 latent_entropy
-+ latent_entropy_decl = build_decl(UNKNOWN_LOCATION, VAR_DECL, get_identifier("latent_entropy"), unsigned_intDI_type_node);
-+
-+ TREE_STATIC(latent_entropy_decl) = 1;
-+ TREE_PUBLIC(latent_entropy_decl) = 1;
-+ TREE_USED(latent_entropy_decl) = 1;
-+ TREE_THIS_VOLATILE(latent_entropy_decl) = 1;
-+ DECL_EXTERNAL(latent_entropy_decl) = 1;
-+ DECL_ARTIFICIAL(latent_entropy_decl) = 0;
-+ DECL_INITIAL(latent_entropy_decl) = NULL;
-+// DECL_ASSEMBLER_NAME(latent_entropy_decl);
-+// varpool_finalize_decl(latent_entropy_decl);
-+// varpool_mark_needed_node(latent_entropy_decl);
-+}
-+
-+int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
-+{
-+ const char * const plugin_name = plugin_info->base_name;
-+ struct register_pass_info latent_entropy_pass_info = {
-+ .pass = &latent_entropy_pass.pass,
-+ .reference_pass_name = "optimized",
-+ .ref_pass_instance_number = 1,
-+ .pos_op = PASS_POS_INSERT_BEFORE
-+ };
-+
-+ if (!plugin_default_version_check(version, &gcc_version)) {
-+ error(G_("incompatible gcc/plugin versions"));
-+ return 1;
-+ }
-+
-+ register_callback(plugin_name, PLUGIN_INFO, NULL, &latent_entropy_plugin_info);
-+ register_callback ("start_unit", PLUGIN_START_UNIT, &start_unit_callback, NULL);
-+ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &latent_entropy_pass_info);
-+ register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
-+
-+ return 0;
-+}
-diff --git a/tools/gcc/size_overflow_hash.data b/tools/gcc/size_overflow_hash.data
-new file mode 100644
-index 0000000..d5a4dd9
---- /dev/null
-+++ b/tools/gcc/size_overflow_hash.data
-@@ -0,0 +1,2581 @@
-+compat_sock_setsockopt_23 compat_sock_setsockopt 5 23 NULL
-+sel_read_policyvers_55 sel_read_policyvers 3 55 NULL nohasharray
-+padzero_55 padzero 1 55 &sel_read_policyvers_55
-+cfg80211_disconnected_57 cfg80211_disconnected 4 57 NULL
-+DepcaSignature_80 DepcaSignature 2 80 NULL nohasharray
-+crypto_authenc_setkey_80 crypto_authenc_setkey 3 80 &DepcaSignature_80
-+snd_korg1212_copy_to_92 snd_korg1212_copy_to 6 92 NULL
-+load_msg_95 load_msg 2 95 NULL
-+init_q_132 init_q 4 132 NULL
-+memstick_alloc_host_142 memstick_alloc_host 1 142 NULL
-+btrfs_mksubvol_150 btrfs_mksubvol 3 150 NULL
-+tracing_trace_options_write_153 tracing_trace_options_write 3 153 NULL
-+iscsi_session_setup_196 iscsi_session_setup 4-5 196 NULL
-+decode_asn1_bitstring_198 decode_asn1_bitstring 4 198 NULL
-+store_cpufv_215 store_cpufv 4 215 NULL
-+proc_scsi_write_proc_267 proc_scsi_write_proc 3 267 NULL
-+platform_device_add_data_310 platform_device_add_data 3 310 NULL
-+iwl_dbgfs_tx_statistics_read_314 iwl_dbgfs_tx_statistics_read 3 314 NULL nohasharray
-+dn_setsockopt_314 dn_setsockopt 5 314 &iwl_dbgfs_tx_statistics_read_314
-+cmtp_send_interopmsg_376 cmtp_send_interopmsg 7 376 NULL
-+btmrvl_txdnldready_read_413 btmrvl_txdnldready_read 3 413 NULL
-+lbs_rdmac_read_418 lbs_rdmac_read 3 418 NULL
-+_alloc_get_attr_desc_470 _alloc_get_attr_desc 2 470 NULL
-+pidlist_resize_496 pidlist_resize 2 496 NULL
-+devres_alloc_551 devres_alloc 2 551 NULL
-+start_isoc_chain_565 start_isoc_chain 2 565 NULL
-+compat_sys_preadv_583 compat_sys_preadv 3 583 NULL
-+proc_write_wled_592 proc_write_wled 3 592 NULL
-+viafb_dfpl_proc_write_627 viafb_dfpl_proc_write 3 627 NULL
-+ipath_resize_cq_712 ipath_resize_cq 2 712 NULL
-+sctp_setsockopt_peer_addr_params_734 sctp_setsockopt_peer_addr_params 3 734 NULL
-+dvb_video_write_754 dvb_video_write 3 754 NULL
-+deliver_packet_767 deliver_packet 3 767 NULL
-+if_writecmd_815 if_writecmd 2 815 NULL
-+read_fifo_826 read_fifo 3 826 NULL
-+um_idi_read_850 um_idi_read 3 850 NULL
-+o2net_send_message_vec_879 o2net_send_message_vec 4 879 NULL
-+btmrvl_hsstate_read_920 btmrvl_hsstate_read 3 920 NULL
-+sctp_make_heartbeat_958 sctp_make_heartbeat 4 958 NULL
-+sys_msgrcv_959 sys_msgrcv 3 959 NULL
-+hdlcdev_rx_997 hdlcdev_rx 3 997 NULL
-+gigaset_initdriver_1060 gigaset_initdriver 2 1060 NULL
-+agp_create_memory_1075 agp_create_memory 1 1075 NULL
-+vmalloc_32_1135 vmalloc_32 1 1135 NULL
-+ipc_alloc_1192 ipc_alloc 1 1192 NULL
-+ib_create_send_mad_1196 ib_create_send_mad 5 1196 NULL
-+i2cdev_read_1206 i2cdev_read 3 1206 NULL
-+ipw_packet_received_skb_1230 ipw_packet_received_skb 2 1230 NULL
-+acpi_battery_write_alarm_1240 acpi_battery_write_alarm 3 1240 NULL
-+ioctl_private_iw_point_1273 ioctl_private_iw_point 7 1273 NULL
-+neigh_hash_grow_1324 neigh_hash_grow 2 1324 NULL
-+io_mapping_create_wc_1354 io_mapping_create_wc 1-2 1354 NULL
-+ipx_sendmsg_1362 ipx_sendmsg 4 1362 NULL
-+sctp_setsockopt_initmsg_1383 sctp_setsockopt_initmsg 3 1383 NULL
-+do_msgsnd_1387 do_msgsnd 4 1387 NULL
-+file_read_actor_1401 file_read_actor 4 1401 NULL
-+hci_si_event_1404 hci_si_event 3 1404 NULL
-+stack_max_size_read_1445 stack_max_size_read 3 1445 NULL
-+__videobuf_copy_to_user_1454 __videobuf_copy_to_user 3 1454 NULL
-+tx_queue_len_read_1463 tx_queue_len_read 3 1463 NULL
-+sta_num_ps_buf_frames_read_1488 sta_num_ps_buf_frames_read 3 1488 NULL
-+kgdb_mem2hex_1578 kgdb_mem2hex 3 1578 NULL
-+ieee80211_if_read_dot11MeshHWMPnetDiameterTraversalTime_1589 ieee80211_if_read_dot11MeshHWMPnetDiameterTraversalTime 3 1589 NULL
-+fc_frame_alloc_1596 fc_frame_alloc 2 1596 NULL
-+btmrvl_hscmd_read_1614 btmrvl_hscmd_read 3 1614 NULL
-+cifs_write_end_1643 cifs_write_end 5 1643 NULL
-+btmrvl_hsmode_read_1647 btmrvl_hsmode_read 3 1647 NULL
-+ikconfig_read_current_1658 ikconfig_read_current 3 1658 NULL
-+configfs_read_file_1683 configfs_read_file 3 1683 NULL
-+pdu_write_u_1710 pdu_write_u 3 1710 NULL
-+coda_psdev_write_1711 coda_psdev_write 3 1711 NULL
-+dma_memcpy_pg_to_iovec_1725 dma_memcpy_pg_to_iovec 6 1725 NULL
-+cafe_deliver_buffer_1755 cafe_deliver_buffer 3 1755 NULL
-+cosa_write_1774 cosa_write 3 1774 NULL
-+hidp_queue_report_1881 hidp_queue_report 3 1881 NULL
-+ivtv_v4l2_read_1964 ivtv_v4l2_read 3 1964 NULL
-+sel_read_avc_hash_stats_1984 sel_read_avc_hash_stats 3 1984 NULL
-+__alloc_bootmem_node_1992 __alloc_bootmem_node 2 1992 NULL
-+write_flush_pipefs_2021 write_flush_pipefs 3 2021 NULL
-+devm_ioremap_nocache_2036 devm_ioremap_nocache 3-2 2036 NULL
-+acpi_video_bus_write_DOS_2064 acpi_video_bus_write_DOS 3 2064 NULL
-+subbuf_read_actor_2071 subbuf_read_actor 3 2071 NULL
-+iwl_dbgfs_current_sleep_command_read_2081 iwl_dbgfs_current_sleep_command_read 3 2081 NULL
-+idetape_chrdev_read_2097 idetape_chrdev_read 3 2097 NULL
-+audit_expand_2098 audit_expand 2 2098 NULL
-+ecryptfs_encrypt_and_encode_filename_2109 ecryptfs_encrypt_and_encode_filename 6 2109 NULL
-+enable_read_2117 enable_read 3 2117 NULL
-+mlx4_init_icm_table_2151 mlx4_init_icm_table 4-5 2151 NULL
-+get_scq_2177 get_scq 1 2177 NULL
-+ssb_bus_ssbbus_register_2217 ssb_bus_ssbbus_register 2 2217 NULL
-+u32_array_read_2219 u32_array_read 3 2219 NULL
-+vhci_write_2224 vhci_write 3 2224 NULL
-+alloc_etherdev_mq_compat_2247 alloc_etherdev_mq_compat 1 2247 NULL
-+sel_write_avc_cache_threshold_2256 sel_write_avc_cache_threshold 3 2256 NULL
-+kvm_clear_guest_page_2308 kvm_clear_guest_page 4 2308 NULL
-+rose_recvmsg_2368 rose_recvmsg 4 2368 NULL
-+rxpipe_rx_prep_beacon_drop_read_2403 rxpipe_rx_prep_beacon_drop_read 3 2403 NULL
-+isdn_v110_open_2418 isdn_v110_open 3 2418 NULL
-+hfcpci_empty_fifo_2427 hfcpci_empty_fifo 4 2427 NULL
-+ioremap_nocache_2439 ioremap_nocache 2-1 2439 NULL
-+tty_buffer_find_2443 tty_buffer_find 2 2443 NULL
-+b43legacy_debugfs_read_2473 b43legacy_debugfs_read 3 2473 NULL
-+ether1394_data_handler_2481 ether1394_data_handler 5 2481 NULL
-+wiphy_new_2482 wiphy_new 2 2482 NULL
-+dm_write_2513 dm_write 3 2513 NULL
-+gspca_dev_probe_2570 gspca_dev_probe 4 2570 NULL
-+store_pwm1_enable_2577 store_pwm1_enable 4 2577 NULL
-+smk_write_logging_2618 smk_write_logging 3 2618 NULL
-+lro_gen_skb_2644 lro_gen_skb 6 2644 NULL
-+memcpy_fromiovecend_2707 memcpy_fromiovecend 3-4 2707 NULL
-+__xip_file_write_2733 __xip_file_write 3-4 2733 NULL
-+fast_shmem_read_2823 fast_shmem_read 5 2823 NULL
-+sel_read_enforce_2828 sel_read_enforce 3 2828 NULL
-+move_addr_to_user_2868 move_addr_to_user 2 2868 NULL
-+cmm_write_2896 cmm_write 3 2896 NULL
-+vicam_read_2904 vicam_read 3 2904 NULL
-+ppp_cp_event_2965 ppp_cp_event 6 2965 NULL
-+store_cardr_2997 store_cardr 4 2997 NULL
-+depth_write_3021 depth_write 3 3021 NULL
-+xfrm_dst_alloc_copy_3034 xfrm_dst_alloc_copy 3 3034 NULL
-+iwl_dbgfs_sleep_level_override_read_3038 iwl_dbgfs_sleep_level_override_read 3 3038 NULL
-+dac960_user_command_proc_write_3071 dac960_user_command_proc_write 3 3071 NULL
-+ip_vs_skb_replace_3083 ip_vs_skb_replace 4-6 3083 NULL
-+proc_write_brn_3084 proc_write_brn 3 3084 NULL
-+fill_write_buffer_3142 fill_write_buffer 3 3142 NULL
-+compat_sys_migrate_pages_3157 compat_sys_migrate_pages 2 3157 NULL
-+compat_do_ip6t_set_ctl_3184 compat_do_ip6t_set_ctl 4 3184 NULL
-+alloc_context_3194 alloc_context 1 3194 NULL
-+kimage_crash_alloc_3233 kimage_crash_alloc 3 3233 NULL
-+key_key_read_3241 key_key_read 3 3241 NULL
-+dvb_generic_ioctl_3257 dvb_generic_ioctl 3 3257 NULL
-+stats_rx_handlers_drop_read_3284 stats_rx_handlers_drop_read 3 3284 NULL
-+compat_sys_setsockopt_3326 compat_sys_setsockopt 5 3326 NULL
-+aac_rkt_ioremap_3333 aac_rkt_ioremap 2 3333 NULL
-+sctp_make_init_ack_3335 sctp_make_init_ack 4 3335 NULL
-+read_from_oldmem_3337 read_from_oldmem 2 3337 NULL
-+msix_map_region_3411 msix_map_region 3 3411 NULL
-+pci_add_cap_save_buffer_3426 pci_add_cap_save_buffer 3 3426 NULL
-+pipe_iov_copy_to_user_3447 pipe_iov_copy_to_user 3 3447 NULL
-+alloc_skb_fclone_3467 alloc_skb_fclone 1 3467 NULL
-+security_context_to_sid_default_3492 security_context_to_sid_default 2 3492 NULL nohasharray
-+efi_ioremap_3492 efi_ioremap 2-1 3492 &security_context_to_sid_default_3492
-+ql_dump_hw_cb_3518 ql_dump_hw_cb 2 3518 NULL
-+hpsb_alloc_host_3562 hpsb_alloc_host 2 3562 NULL
-+alloc_smp_resp_3566 alloc_smp_resp 1 3566 NULL
-+evtchn_read_3569 evtchn_read 3 3569 NULL
-+vc_resize_3585 vc_resize 2-3 3585 NULL
-+compat_sys_semtimedop_3606 compat_sys_semtimedop 3 3606 NULL
-+sctp_getsockopt_events_3607 sctp_getsockopt_events 2 3607 NULL
-+aligned_kmalloc_3628 aligned_kmalloc 1 3628 NULL
-+cm_copy_private_data_3649 cm_copy_private_data 2 3649 NULL
-+i915_compat_ioctl_3656 i915_compat_ioctl 2 3656 NULL
-+l2cap_send_cmd_3678 l2cap_send_cmd 4 3678 NULL
-+btmrvl_psmode_write_3703 btmrvl_psmode_write 3 3703 NULL
-+buf_acquire_3736 buf_acquire 1 3736 NULL
-+ci_ll_write_3740 ci_ll_write 4 3740 NULL
-+sctp_setsockopt_auth_key_3793 sctp_setsockopt_auth_key 3 3793 NULL
-+ncp_file_write_3813 ncp_file_write 3 3813 NULL
-+llc_ui_recvmsg_3826 llc_ui_recvmsg 4 3826 NULL
-+smk_read_onlycap_3855 smk_read_onlycap 3 3855 NULL
-+get_fd_set_3866 get_fd_set 1 3866 NULL
-+ubi_dbg_dump_flash_3870 ubi_dbg_dump_flash 4 3870 NULL
-+acpi_system_read_fadt_3876 acpi_system_read_fadt 3 3876 NULL
-+garp_attr_create_3883 garp_attr_create 3 3883 NULL
-+uea_send_modem_cmd_3888 uea_send_modem_cmd 3 3888 NULL
-+nvram_write_3894 nvram_write 3 3894 NULL
-+sysctl_ipc_data_3903 sysctl_ipc_data 5 3903 NULL
-+vcs_write_3910 vcs_write 3 3910 NULL
-+proc_write_tled_3947 proc_write_tled 3 3947 NULL
-+pcpu_mem_alloc_3987 pcpu_mem_alloc 1 3987 NULL
-+do_add_counters_3992 do_add_counters 3 3992 NULL
-+snd_hdsp_capture_copy_4011 snd_hdsp_capture_copy 5 4011 NULL
-+sctp_make_asconf_4078 sctp_make_asconf 3 4078 NULL
-+fbcon_do_set_font_4079 fbcon_do_set_font 2-3 4079 NULL
-+allocate_buffers_4113 allocate_buffers 2 4113 NULL
-+get_alua_req_4166 get_alua_req 3 4166 NULL
-+blk_dropped_read_4168 blk_dropped_read 3 4168 NULL
-+read_file_bool_4180 read_file_bool 3 4180 NULL
-+_osd_req_list_objects_4204 _osd_req_list_objects 6 4204 NULL
-+sctp_getsockopt_local_addrs_old_4220 sctp_getsockopt_local_addrs_old 2 4220 NULL
-+vring_add_indirect_4224 vring_add_indirect 3-4 4224 NULL
-+dvb_ringbuffer_pkt_read_user_4303 dvb_ringbuffer_pkt_read_user 3-5-2 4303 NULL
-+snd_rawmidi_kernel_read_4328 snd_rawmidi_kernel_read 3 4328 NULL
-+ar9170_alloc_4355 ar9170_alloc 1 4355 NULL
-+__copy_from_user_inatomic_4365 __copy_from_user_inatomic 3 4365 NULL
-+sys_setdomainname_4373 sys_setdomainname 2 4373 NULL
-+irda_sendmsg_4388 irda_sendmsg 4 4388 NULL
-+cxacru_cm_get_array_4412 cxacru_cm_get_array 4 4412 NULL
-+do_pages_stat_4437 do_pages_stat 2 4437 NULL
-+dn_alloc_send_pskb_4465 dn_alloc_send_pskb 2 4465 NULL
-+at76_set_card_command_4471 at76_set_card_command 4 4471 NULL
-+recv_control_msg_4476 recv_control_msg 5 4476 NULL
-+sys_semtimedop_4486 sys_semtimedop 3 4486 NULL
-+udp_sendmsg_4492 udp_sendmsg 4 4492 NULL
-+l1oip_socket_parse_4507 l1oip_socket_parse 4 4507 NULL
-+sys_llistxattr_4532 sys_llistxattr 3 4532 NULL
-+videobuf_vmalloc_to_sg_4548 videobuf_vmalloc_to_sg 2 4548 NULL
-+iwl_dbgfs_tx_queue_read_4635 iwl_dbgfs_tx_queue_read 3 4635 NULL
-+cx18_read_pos_4683 cx18_read_pos 3 4683 NULL
-+short_retry_limit_read_4687 short_retry_limit_read 3 4687 NULL
-+btmrvl_gpiogap_read_4718 btmrvl_gpiogap_read 3 4718 NULL
-+ati_create_gatt_pages_4722 ati_create_gatt_pages 1 4722 NULL nohasharray
-+show_header_4722 show_header 3 4722 &ati_create_gatt_pages_4722
-+ip6_ufo_append_data_4780 ip6_ufo_append_data 5-6-7 4780 NULL
-+ncp__vol2io_4804 ncp__vol2io 5 4804 NULL
-+iwl_tx_queue_init_4807 iwl_tx_queue_init 3 4807 NULL
-+key_tx_spec_read_4862 key_tx_spec_read 3 4862 NULL
-+hid_register_field_4874 hid_register_field 2-3 4874 NULL
-+vga_arb_read_4886 vga_arb_read 3 4886 NULL
-+sys_ipc_4889 sys_ipc 3 4889 NULL
-+ntfs_rl_insert_4931 ntfs_rl_insert 2-4 4931 NULL
-+devm_kzalloc_4966 devm_kzalloc 2 4966 NULL
-+compat_rawv6_setsockopt_4967 compat_rawv6_setsockopt 5 4967 NULL
-+handle_eviocgbit_4991 handle_eviocgbit 2 4991 NULL
-+asn1_oid_decode_4999 asn1_oid_decode 2 4999 NULL
-+snd_mixart_BA1_read_5082 snd_mixart_BA1_read 5-6 5082 NULL
-+sound_write_5102 sound_write 3 5102 NULL
-+iwl_dbgfs_status_read_5171 iwl_dbgfs_status_read 3 5171 NULL
-+sfi_map_memory_5183 sfi_map_memory 2-1 5183 NULL
-+ppp_cp_parse_cr_5214 ppp_cp_parse_cr 4 5214 NULL
-+ssb_ioremap_5228 ssb_ioremap 2 5228 NULL
-+isdn_ppp_skb_push_5236 isdn_ppp_skb_push 2 5236 NULL
-+pwr_elp_enter_read_5324 pwr_elp_enter_read 3 5324 NULL
-+allocate_cnodes_5329 allocate_cnodes 1 5329 NULL
-+ps_pspoll_utilization_read_5361 ps_pspoll_utilization_read 3 5361 NULL
-+cciss_allocate_sg_chain_blocks_5368 cciss_allocate_sg_chain_blocks 3-2 5368 NULL
-+squashfs_read_id_index_table_5394 squashfs_read_id_index_table 3 5394 NULL
-+sfi_map_table_5462 sfi_map_table 1 5462 NULL
-+xfs_efd_init_5463 xfs_efd_init 3 5463 NULL
-+xfs_efi_init_5476 xfs_efi_init 2 5476 NULL
-+cifs_security_flags_proc_write_5484 cifs_security_flags_proc_write 3 5484 NULL
-+tty_write_5494 tty_write 3 5494 NULL
-+spidev_message_5518 spidev_message 3 5518 NULL
-+sctp_make_op_error_space_5528 sctp_make_op_error_space 3 5528 NULL
-+bioset_create_5580 bioset_create 1 5580 NULL
-+do_msgrcv_5590 do_msgrcv 4 5590 NULL
-+ldm_frag_add_5611 ldm_frag_add 2 5611 NULL
-+parse_arg_5657 parse_arg 2 5657 NULL
-+mthca_map_reg_5664 mthca_map_reg 3-2 5664 NULL
-+gigaset_write_cmd_5693 gigaset_write_cmd 3 5693 NULL
-+get_arg_5694 get_arg 3 5694 NULL
-+get_packet_5747 get_packet 3 5747 NULL
-+sctp_setsockopt_autoclose_5775 sctp_setsockopt_autoclose 3 5775 NULL
-+compat_sys_writev_5784 compat_sys_writev 3 5784 NULL
-+__vxge_hw_blockpool_malloc_5786 __vxge_hw_blockpool_malloc 2 5786 NULL
-+skb_copy_datagram_iovec_5806 skb_copy_datagram_iovec 2-4 5806 NULL
-+setup_req_5848 setup_req 3 5848 NULL
-+compat_sys_move_pages_5861 compat_sys_move_pages 2 5861 NULL
-+uhci_debug_read_5911 uhci_debug_read 3 5911 NULL
-+stats_rx_handlers_queued_read_5922 stats_rx_handlers_queued_read 3 5922 NULL nohasharray
-+ttm_bo_kmap_ttm_5922 ttm_bo_kmap_ttm 3 5922 &stats_rx_handlers_queued_read_5922
-+lbs_highsnr_read_5931 lbs_highsnr_read 3 5931 NULL
-+edac_device_alloc_ctl_info_5941 edac_device_alloc_ctl_info 1 5941 NULL
-+tipc_subseq_alloc_5957 tipc_subseq_alloc 1 5957 NULL
-+sctp_getsockopt_peer_addr_info_6024 sctp_getsockopt_peer_addr_info 2 6024 NULL
-+ntfs_rl_append_6037 ntfs_rl_append 2-4 6037 NULL
-+send_video_command_6073 send_video_command 4 6073 NULL nohasharray
-+sctp_setsockopt_connectx_6073 sctp_setsockopt_connectx 3 6073 &send_video_command_6073
-+ivtv_copy_buf_to_user_6159 ivtv_copy_buf_to_user 4 6159 NULL
-+vdma_mem_alloc_6171 vdma_mem_alloc 1 6171 NULL
-+wl1251_cmd_template_set_6172 wl1251_cmd_template_set 4 6172 NULL
-+ether1394_write_6180 ether1394_write 6 6180 NULL
-+mqueue_read_file_6228 mqueue_read_file 3 6228 NULL
-+fbcon_prepare_logo_6246 fbcon_prepare_logo 5 6246 NULL
-+xenbus_file_write_6282 xenbus_file_write 3 6282 NULL
-+_proc_do_string_6376 _proc_do_string 2 6376 NULL
-+sctp_getsockopt_assoc_number_6384 sctp_getsockopt_assoc_number 2 6384 NULL
-+bt_skb_alloc_6404 bt_skb_alloc 1 6404 NULL
-+l2up_create_6430 l2up_create 3 6430 NULL
-+__alloc_bootmem_node_nopanic_6432 __alloc_bootmem_node_nopanic 2 6432 NULL
-+rndis_set_oid_6547 rndis_set_oid 4 6547 NULL
-+wdm_read_6549 wdm_read 3 6549 NULL
-+fb_alloc_cmap_6554 fb_alloc_cmap 2 6554 NULL
-+bt_skb_send_alloc_6581 bt_skb_send_alloc 2 6581 NULL
-+ecryptfs_filldir_6622 ecryptfs_filldir 3 6622 NULL
-+dn_alloc_skb_6631 dn_alloc_skb 2 6631 NULL
-+process_rcvd_data_6679 process_rcvd_data 3 6679 NULL
-+ps_pspoll_max_apturn_read_6699 ps_pspoll_max_apturn_read 3 6699 NULL
-+sfi_check_table_6772 sfi_check_table 1 6772 NULL
-+iwl_dbgfs_channels_read_6784 iwl_dbgfs_channels_read 3 6784 NULL
-+ieee80211_if_read_6785 ieee80211_if_read 3 6785 NULL
-+create_reply_packet_6789 create_reply_packet 3 6789 NULL
-+hdlcdrv_register_6792 hdlcdrv_register 2 6792 NULL
-+mon_bin_read_6841 mon_bin_read 3 6841 NULL
-+snd_cs4281_BA0_read_6847 snd_cs4281_BA0_read 5-6 6847 NULL
-+raw_seticmpfilter_6888 raw_seticmpfilter 3 6888 NULL
-+dlmfs_file_write_6892 dlmfs_file_write 3 6892 NULL
-+proc_sessionid_read_6911 proc_sessionid_read 3 6911 NULL
-+ieee80211_rx_mgmt_probe_resp_6918 ieee80211_rx_mgmt_probe_resp 3 6918 NULL
-+cache_do_downcall_6926 cache_do_downcall 3 6926 NULL
-+videobuf_dma_init_kernel_6963 videobuf_dma_init_kernel 3 6963 NULL
-+sta_tx_filtered_read_6973 sta_tx_filtered_read 3 6973 NULL
-+request_key_async_6990 request_key_async 4 6990 NULL
-+tracing_cpumask_read_7010 tracing_cpumask_read 3 7010 NULL
-+hid_report_raw_event_7024 hid_report_raw_event 4 7024 NULL
-+ipath_get_base_info_7043 ipath_get_base_info 3 7043 NULL
-+hci_sock_recvmsg_7072 hci_sock_recvmsg 4 7072 NULL
-+event_enable_read_7074 event_enable_read 3 7074 NULL
-+zd_ioread16v_locked_7082 zd_ioread16v_locked 4 7082 NULL
-+store_status_7088 store_status 2 7088 NULL
-+send_mpa_reject_7135 send_mpa_reject 3 7135 NULL
-+squashfs_read_inode_lookup_table_7160 squashfs_read_inode_lookup_table 3 7160 NULL
-+HDLC_Encode_7186 HDLC_Encode 2-3 7186 NULL
-+sys32_ipc_7238 sys32_ipc 3 7238 NULL
-+ieee80211_if_read_dot11MeshHWMPactivePathTimeout_7368 ieee80211_if_read_dot11MeshHWMPactivePathTimeout 3 7368 NULL
-+sl_change_mtu_7396 sl_change_mtu 2 7396 NULL
-+drm_property_create_blob_7414 drm_property_create_blob 2 7414 NULL
-+ip_options_get_alloc_7448 ip_options_get_alloc 1 7448 NULL
-+garp_request_join_7471 garp_request_join 4 7471 NULL
-+compat_sys_msgrcv_7482 compat_sys_msgrcv 2 7482 NULL
-+sdhci_alloc_host_7509 sdhci_alloc_host 2 7509 NULL
-+sbp2util_node_write_no_wait_7510 sbp2util_node_write_no_wait 4 7510 NULL
-+groups_alloc_7614 groups_alloc 1 7614 NULL
-+skb_copy_expand_7685 skb_copy_expand 2-3 7685 NULL nohasharray
-+acpi_ex_allocate_name_string_7685 acpi_ex_allocate_name_string 2-1 7685 &skb_copy_expand_7685
-+dev_write_7708 dev_write 3 7708 NULL
-+manip_pkt_7741 manip_pkt 3 7741 NULL
-+vxge_device_register_7752 vxge_device_register 4 7752 NULL
-+bnx2_nvram_write_7790 bnx2_nvram_write 4-2 7790 NULL
-+diva_os_copy_from_user_7792 diva_os_copy_from_user 4 7792 NULL
-+dvb_dmxdev_read_sec_7892 dvb_dmxdev_read_sec 4 7892 NULL
-+xfs_trans_get_efi_7898 xfs_trans_get_efi 2 7898 NULL
-+libfc_host_alloc_7917 libfc_host_alloc 2 7917 NULL
-+raw_send_hdrinc_7937 raw_send_hdrinc 3 7937 NULL
-+arch_gnttab_map_shared_7970 arch_gnttab_map_shared 3 7970 NULL
-+sys_mbind_7990 sys_mbind 5 7990 NULL
-+vcs_read_8017 vcs_read 3 8017 NULL
-+skb_copy_to_page_8071 skb_copy_to_page 6 8071 NULL
-+alloc_targets_8074 alloc_targets 2 8074 NULL
-+venus_lookup_8121 venus_lookup 4 8121 NULL
-+dlm_user_request_8131 dlm_user_request 6 8131 NULL
-+recent_mt_proc_write_8206 recent_mt_proc_write 3 8206 NULL
-+rt2x00debug_write_bbp_8212 rt2x00debug_write_bbp 3 8212 NULL
-+play_iframe_8219 play_iframe 3 8219 NULL
-+add_rx_skb_8257 add_rx_skb 3 8257 NULL
-+t3_init_l2t_8261 t3_init_l2t 1 8261 NULL
-+init_cdev_8274 init_cdev 1 8274 NULL
-+construct_key_and_link_8321 construct_key_and_link 4 8321 NULL
-+ipwireless_send_packet_8328 ipwireless_send_packet 4 8328 NULL
-+tracing_entries_read_8345 tracing_entries_read 3 8345 NULL
-+xdi_copy_from_user_8395 xdi_copy_from_user 4 8395 NULL
-+dev_config_8506 dev_config 3 8506 NULL
-+cache_slow_downcall_8570 cache_slow_downcall 2 8570 NULL
-+mga_ioremap_8571 mga_ioremap 2-1 8571 NULL
-+isr_dma0_done_read_8574 isr_dma0_done_read 3 8574 NULL
-+tower_write_8580 tower_write 3 8580 NULL
-+shash_setkey_unaligned_8620 shash_setkey_unaligned 3 8620 NULL
-+it821x_firmware_command_8628 it821x_firmware_command 3 8628 NULL
-+nf_nat_mangle_tcp_packet_8643 nf_nat_mangle_tcp_packet 5-7 8643 NULL
-+lbs_bcnmiss_read_8678 lbs_bcnmiss_read 3 8678 NULL
-+arcfb_write_8702 arcfb_write 3 8702 NULL
-+tracing_max_lat_write_8728 tracing_max_lat_write 3 8728 NULL
-+em28xx_init_isoc_8755 em28xx_init_isoc 2-3 8755 NULL
-+joydev_compat_ioctl_8765 joydev_compat_ioctl 2 8765 NULL
-+cpuset_common_file_read_8800 cpuset_common_file_read 5 8800 NULL
-+metronomefb_write_8823 metronomefb_write 3 8823 NULL
-+wa_nep_queue_8858 wa_nep_queue 2 8858 NULL
-+tracing_max_lat_read_8890 tracing_max_lat_read 3 8890 NULL
-+fast_shmem_write_8942 fast_shmem_write 5 8942 NULL
-+usb_allocate_stream_buffers_8964 usb_allocate_stream_buffers 3 8964 NULL
-+venus_mkdir_8967 venus_mkdir 4 8967 NULL
-+seq_open_net_8968 seq_open_net 4 8968 NULL nohasharray
-+vol_cdev_read_8968 vol_cdev_read 3 8968 &seq_open_net_8968
-+snd_emu10k1_synth_copy_from_user_9061 snd_emu10k1_synth_copy_from_user 3-5 9061 NULL
-+snd_gus_dram_peek_9062 snd_gus_dram_peek 4 9062 NULL
-+create_queues_9088 create_queues 2-3 9088 NULL
-+isr_irqs_read_9181 isr_irqs_read 3 9181 NULL
-+alloc_group_attrs_9194 alloc_group_attrs 2 9194 NULL
-+l2cap_create_connless_pdu_9222 l2cap_create_connless_pdu 3 9222 NULL
-+sctp_getsockopt_delayed_ack_9232 sctp_getsockopt_delayed_ack 2 9232 NULL
-+stats_failed_count_read_9244 stats_failed_count_read 3 9244 NULL
-+cmtp_add_msgpart_9252 cmtp_add_msgpart 4 9252 NULL
-+hdpvr_read_9273 hdpvr_read 3 9273 NULL
-+iwl_dbgfs_stations_read_9309 iwl_dbgfs_stations_read 3 9309 NULL
-+read_9397 read 3 9397 NULL
-+mcs_unwrap_mir_9455 mcs_unwrap_mir 3 9455 NULL
-+agp_generic_alloc_user_9470 agp_generic_alloc_user 1 9470 NULL
-+lp_write_9511 lp_write 3 9511 NULL
-+scsi_tgt_kspace_exec_9522 scsi_tgt_kspace_exec 8 9522 NULL
-+read_file_dma_9530 read_file_dma 3 9530 NULL
-+audit_log_n_untrustedstring_9548 audit_log_n_untrustedstring 3 9548 NULL
-+fw_node_create_9559 fw_node_create 2 9559 NULL
-+sctp_getsockopt_nodelay_9560 sctp_getsockopt_nodelay 2 9560 NULL
-+kobj_map_9566 kobj_map 2-3 9566 NULL
-+btrfs_copy_from_user_9568 btrfs_copy_from_user 3-1 9568 NULL
-+biovec_create_pools_9575 biovec_create_pools 2 9575 NULL
-+do_sync_9604 do_sync 1 9604 NULL
-+snd_emu10k1_fx8010_read_9605 snd_emu10k1_fx8010_read 5-6 9605 NULL nohasharray
-+sysprof_sample_read_9605 sysprof_sample_read 3 9605 &snd_emu10k1_fx8010_read_9605
-+uvc_alloc_buffers_9656 uvc_alloc_buffers 2-3 9656 NULL
-+queue_received_packet_9657 queue_received_packet 5 9657 NULL
-+snd_opl4_mem_proc_write_9670 snd_opl4_mem_proc_write 5-6 9670 NULL
-+cifs_write_9687 cifs_write 3 9687 NULL
-+ieee80211_if_read_aid_9705 ieee80211_if_read_aid 3 9705 NULL
-+__alloc_percpu_9764 __alloc_percpu 1 9764 NULL
-+do_sigpending_9766 do_sigpending 2 9766 NULL
-+__blk_queue_init_tags_9778 __blk_queue_init_tags 2 9778 NULL
-+snd_mem_proc_write_9786 snd_mem_proc_write 3 9786 NULL
-+ttm_bo_fbdev_io_9805 ttm_bo_fbdev_io 4 9805 NULL
-+udpv6_recvmsg_9813 udpv6_recvmsg 4 9813 NULL
-+dvb_dvr_set_buffer_size_9840 dvb_dvr_set_buffer_size 2 9840 NULL
-+pmcraid_alloc_sglist_9864 pmcraid_alloc_sglist 1 9864 NULL
-+bm_register_write_9893 bm_register_write 3 9893 NULL nohasharray
-+snd_midi_event_new_9893 snd_midi_event_new 1 9893 &bm_register_write_9893
-+iwm_rx_packet_alloc_9898 iwm_rx_packet_alloc 3 9898 NULL
-+set_rxd_buffer_pointer_9950 set_rxd_buffer_pointer 8 9950 NULL
-+csum_partial_copy_fromiovecend_9957 csum_partial_copy_fromiovecend 3-4 9957 NULL
-+nfs_readdata_alloc_9990 nfs_readdata_alloc 1 9990 NULL
-+asn1_octets_decode_9991 asn1_octets_decode 2 9991 NULL
-+pccard_store_cis_10094 pccard_store_cis 5 10094 NULL
-+aes_decrypt_packets_read_10155 aes_decrypt_packets_read 3 10155 NULL
-+rx_out_of_mem_read_10157 rx_out_of_mem_read 3 10157 NULL
-+asd_store_update_bios_10165 asd_store_update_bios 4 10165 NULL
-+proc_pid_attr_read_10173 proc_pid_attr_read 3 10173 NULL
-+arlan_rx_interrupt_10184 arlan_rx_interrupt 4 10184 NULL
-+cciss_proc_write_10259 cciss_proc_write 3 10259 NULL
-+stats_tx_status_drop_read_10279 stats_tx_status_drop_read 3 10279 NULL
-+snd_rme9652_capture_copy_10287 snd_rme9652_capture_copy 5 10287 NULL
-+wl1251_build_probe_req_10318 wl1251_build_probe_req 3 10318 NULL
-+stats_rx_handlers_fragments_read_10356 stats_rx_handlers_fragments_read 3 10356 NULL
-+ecryptfs_decode_and_decrypt_filename_10379 ecryptfs_decode_and_decrypt_filename 5 10379 NULL
-+sta_tx_retry_failed_read_10381 sta_tx_retry_failed_read 3 10381 NULL
-+do_compat_pselect_10398 do_compat_pselect 1 10398 NULL
-+event_phy_transmit_error_read_10471 event_phy_transmit_error_read 3 10471 NULL
-+sel_write_disable_10511 sel_write_disable 3 10511 NULL
-+rds_message_alloc_10517 rds_message_alloc 1 10517 NULL
-+snmp_mib_init_10526 snmp_mib_init 2 10526 NULL
-+get_vm_area_caller_10527 get_vm_area_caller 1 10527 NULL
-+otp_read_10594 otp_read 2-5-4 10594 NULL
-+ima_show_htable_violations_10619 ima_show_htable_violations 3 10619 NULL
-+cxgb3_get_cpl_reply_skb_10620 cxgb3_get_cpl_reply_skb 2 10620 NULL
-+ni65_alloc_mem_10664 ni65_alloc_mem 3 10664 NULL
-+tcp_push_10680 tcp_push 3 10680 NULL
-+selinux_inode_setxattr_10708 selinux_inode_setxattr 4 10708 NULL
-+pvr2_ioread_read_10720 pvr2_ioread_read 3 10720 NULL nohasharray
-+shash_async_setkey_10720 shash_async_setkey 3 10720 &pvr2_ioread_read_10720
-+__iscsi_complete_pdu_10726 __iscsi_complete_pdu 4 10726 NULL
-+sctp_getsockopt_maxseg_10737 sctp_getsockopt_maxseg 2 10737 NULL
-+compat_sys_msgsnd_10738 compat_sys_msgsnd 2 10738 NULL
-+kvm_read_guest_atomic_10765 kvm_read_guest_atomic 4 10765 NULL
-+sys_bind_10799 sys_bind 3 10799 NULL
-+aun_incoming_10814 aun_incoming 3 10814 NULL
-+send_command_10832 send_command 4 10832 NULL
-+lbs_sleepparams_read_10840 lbs_sleepparams_read 3 10840 NULL
-+fuse_conn_max_background_read_10855 fuse_conn_max_background_read 3 10855 NULL
-+snd_pcm_oss_write1_10872 snd_pcm_oss_write1 3 10872 NULL
-+cgroup_write_string_10900 cgroup_write_string 5 10900 NULL
-+tifm_alloc_adapter_10903 tifm_alloc_adapter 1 10903 NULL
-+__copy_from_user_10918 __copy_from_user 3 10918 NULL
-+iwl_calib_set_10944 iwl_calib_set 3 10944 NULL
-+gfs2_readlink_10958 gfs2_readlink 3 10958 NULL
-+bm_entry_read_10976 bm_entry_read 3 10976 NULL
-+xfrm_hash_alloc_10997 xfrm_hash_alloc 1 10997 NULL
-+tda10048_writeregbulk_11050 tda10048_writeregbulk 4 11050 NULL
-+stats_tx_expand_skb_head_cloned_read_11107 stats_tx_expand_skb_head_cloned_read 3 11107 NULL
-+tracing_buffers_read_11124 tracing_buffers_read 3 11124 NULL
-+alloc_alien_cache_11127 alloc_alien_cache 2 11127 NULL
-+acpi_os_map_memory_11161 acpi_os_map_memory 2-1 11161 NULL
-+ioat2_alloc_ring_11172 ioat2_alloc_ring 2 11172 NULL
-+__videobuf_alloc_11253 __videobuf_alloc 1 11253 NULL
-+hugetlbfs_read_11268 hugetlbfs_read 3 11268 NULL
-+cru_detect_11272 cru_detect 1 11272 NULL
-+construct_key_11329 construct_key 3 11329 NULL
-+sel_write_create_11353 sel_write_create 3 11353 NULL
-+drm_vblank_init_11362 drm_vblank_init 2 11362 NULL
-+ieee80211_key_alloc_11373 ieee80211_key_alloc 3 11373 NULL
-+dev_irnet_write_11398 dev_irnet_write 3 11398 NULL
-+___alloc_bootmem_11410 ___alloc_bootmem 1 11410 NULL
-+str_to_user_11411 str_to_user 2 11411 NULL
-+trace_options_read_11419 trace_options_read 3 11419 NULL
-+sd_do_mode_sense_11507 sd_do_mode_sense 5 11507 NULL
-+kmem_zalloc_11510 kmem_zalloc 1 11510 NULL
-+do_sysctl_strategy_11541 do_sysctl_strategy 6 11541 NULL
-+sctp_getsockopt_peer_addrs_old_11565 sctp_getsockopt_peer_addrs_old 2 11565 NULL nohasharray
-+skb_cow_data_11565 skb_cow_data 2 11565 &sctp_getsockopt_peer_addrs_old_11565
-+mlx4_init_cmpt_table_11569 mlx4_init_cmpt_table 3 11569 NULL
-+oprofilefs_ulong_to_user_11582 oprofilefs_ulong_to_user 3 11582 NULL
-+fw_device_op_ioctl_11595 fw_device_op_ioctl 2 11595 NULL
-+hycapi_rx_capipkt_11602 hycapi_rx_capipkt 3 11602 NULL
-+sisusb_send_bridge_packet_11649 sisusb_send_bridge_packet 2 11649 NULL
-+ide_queue_pc_tail_11673 ide_queue_pc_tail 5 11673 NULL
-+iwm_ntf_calib_res_11686 iwm_ntf_calib_res 3 11686 NULL
-+sctp_setsockopt_hmac_ident_11687 sctp_setsockopt_hmac_ident 3 11687 NULL
-+split_11691 split 2 11691 NULL
-+snd_ctl_elem_user_tlv_11695 snd_ctl_elem_user_tlv 3 11695 NULL
-+ttm_agp_populate_11718 ttm_agp_populate 2 11718 NULL
-+iwl_dbgfs_qos_read_11753 iwl_dbgfs_qos_read 3 11753 NULL
-+ps_pspoll_timeouts_read_11776 ps_pspoll_timeouts_read 3 11776 NULL
-+pcpu_fc_alloc_11818 pcpu_fc_alloc 2 11818 NULL
-+sctp_setsockopt_maxseg_11829 sctp_setsockopt_maxseg 3 11829 NULL
-+ecryptfs_copy_filename_11868 ecryptfs_copy_filename 4 11868 NULL
-+_l2_alloc_skb_11883 _l2_alloc_skb 1 11883 NULL
-+kmalloc_slab_11917 kmalloc_slab 1 11917 NULL
-+dccp_feat_clone_sp_val_11942 dccp_feat_clone_sp_val 3 11942 NULL
-+ubifs_recover_log_leb_12079 ubifs_recover_log_leb 3 12079 NULL
-+xfs_handle_to_dentry_12135 xfs_handle_to_dentry 3 12135 NULL
-+rawv6_seticmpfilter_12137 rawv6_seticmpfilter 5 12137 NULL
-+btmrvl_sdio_host_to_card_12152 btmrvl_sdio_host_to_card 3 12152 NULL
-+dma_memcpy_to_iovec_12173 dma_memcpy_to_iovec 5 12173 NULL
-+compat_do_arpt_set_ctl_12184 compat_do_arpt_set_ctl 4 12184 NULL
-+ip_generic_getfrag_12187 ip_generic_getfrag 3-4 12187 NULL
-+receive_copy_12216 receive_copy 3 12216 NULL
-+ib_uverbs_unmarshall_recv_12251 ib_uverbs_unmarshall_recv 5 12251 NULL
-+shash_compat_setkey_12267 shash_compat_setkey 3 12267 NULL
-+add_sctp_bind_addr_12269 add_sctp_bind_addr 3 12269 NULL
-+iwm_notif_send_12295 iwm_notif_send 6 12295 NULL
-+bt_sock_recvmsg_12316 bt_sock_recvmsg 4 12316 NULL
-+pwc_rvmalloc_12325 pwc_rvmalloc 1 12325 NULL
-+sctp_getsockopt_disable_fragments_12330 sctp_getsockopt_disable_fragments 2 12330 NULL
-+pcbit_writecmd_12332 pcbit_writecmd 2 12332 NULL
-+mptctl_ioctl_12355 mptctl_ioctl 2 12355 NULL
-+receive_packet_12367 receive_packet 2 12367 NULL
-+xfs_iext_inline_to_direct_12384 xfs_iext_inline_to_direct 2 12384 NULL
-+x25_sendmsg_12487 x25_sendmsg 4 12487 NULL
-+tso_fragment_12539 tso_fragment 3 12539 NULL
-+hvc_alloc_12579 hvc_alloc 4 12579 NULL
-+snd_pcm_plugin_alloc_12580 snd_pcm_plugin_alloc 2 12580 NULL
-+pcpu_extend_area_map_12589 pcpu_extend_area_map 2 12589 NULL
-+vhci_put_user_12604 vhci_put_user 4 12604 NULL
-+ieee80211_rx_mgmt_probe_resp_12634 ieee80211_rx_mgmt_probe_resp 4 12634 NULL
-+pn_sendmsg_12640 pn_sendmsg 4 12640 NULL
-+nr_recvmsg_12649 nr_recvmsg 4 12649 NULL
-+sel_read_class_12669 sel_read_class 3 12669 NULL
-+ieee80211_if_read_num_buffered_multicast_12716 ieee80211_if_read_num_buffered_multicast 3 12716 NULL
-+key_rx_spec_read_12736 key_rx_spec_read 3 12736 NULL
-+ieee80211_if_read_dot11MeshMaxRetries_12756 ieee80211_if_read_dot11MeshMaxRetries 3 12756 NULL
-+listxattr_12769 listxattr 3 12769 NULL
-+scsi_adjust_queue_depth_12802 scsi_adjust_queue_depth 3 12802 NULL
-+xfs_inumbers_fmt_12817 xfs_inumbers_fmt 3 12817 NULL
-+spidev_ioctl_12846 spidev_ioctl 2 12846 NULL
-+ci_ll_init_12930 ci_ll_init 3 12930 NULL
-+bcsp_prepare_pkt_12961 bcsp_prepare_pkt 3 12961 NULL
-+bm_status_write_12964 bm_status_write 3 12964 NULL
-+sctp_make_chunk_12986 sctp_make_chunk 4 12986 NULL
-+acpi_tb_install_table_12988 acpi_tb_install_table 1 12988 NULL
-+subsystem_filter_write_13022 subsystem_filter_write 3 13022 NULL
-+ubi_eba_atomic_leb_change_13041 ubi_eba_atomic_leb_change 5 13041 NULL
-+__dn_setsockopt_13060 __dn_setsockopt 5 13060 NULL
-+snd_rme96_playback_copy_13111 snd_rme96_playback_copy 5 13111 NULL
-+pwr_disable_ps_read_13176 pwr_disable_ps_read 3 13176 NULL
-+mmc_ext_csd_read_13205 mmc_ext_csd_read 3 13205 NULL
-+asix_read_cmd_13245 asix_read_cmd 5 13245 NULL
-+init_tid_tabs_13252 init_tid_tabs 2-4-3 13252 NULL
-+smctr_process_rx_packet_13270 smctr_process_rx_packet 2 13270 NULL
-+platform_device_add_resources_13289 platform_device_add_resources 3 13289 NULL
-+nf_nat_mangle_udp_packet_13321 nf_nat_mangle_udp_packet 5-7 13321 NULL
-+us122l_ctl_msg_13330 us122l_ctl_msg 8 13330 NULL
-+megaraid_change_queue_depth_13375 megaraid_change_queue_depth 2 13375 NULL
-+iso_sched_alloc_13377 iso_sched_alloc 1 13377 NULL nohasharray
-+wep_key_not_found_read_13377 wep_key_not_found_read 3 13377 &iso_sched_alloc_13377
-+sky2_receive_13407 sky2_receive 2 13407 NULL
-+netxen_alloc_sds_rings_13417 netxen_alloc_sds_rings 2 13417 NULL
-+keyring_read_13438 keyring_read 3 13438 NULL
-+sctp_setsockopt_peer_primary_addr_13440 sctp_setsockopt_peer_primary_addr 3 13440 NULL
-+sctp_tsnmap_mark_13527 sctp_tsnmap_mark 2 13527 NULL
-+bm_init_13529 bm_init 2 13529 NULL
-+cache_write_13589 cache_write 3 13589 NULL
-+mpt_lan_receive_post_turbo_13592 mpt_lan_receive_post_turbo 2 13592 NULL
-+aac_sa_ioremap_13596 aac_sa_ioremap 2 13596 NULL nohasharray
-+irias_new_octseq_value_13596 irias_new_octseq_value 2 13596 &aac_sa_ioremap_13596
-+swap_cgroup_swapon_13614 swap_cgroup_swapon 2 13614 NULL
-+packet_snd_13634 packet_snd 3 13634 NULL
-+blk_msg_write_13655 blk_msg_write 3 13655 NULL
-+cache_downcall_13666 cache_downcall 3 13666 NULL
-+audit_unpack_string_13748 audit_unpack_string 3 13748 NULL
-+fb_sys_read_13778 fb_sys_read 3 13778 NULL
-+random_read_13815 random_read 3 13815 NULL
-+evdev_ioctl_compat_13851 evdev_ioctl_compat 2 13851 NULL
-+compat_ip_setsockopt_13870 compat_ip_setsockopt 5 13870 NULL
-+snd_pcm_aio_read_13900 snd_pcm_aio_read 3 13900 NULL
-+qla2x00_get_ctx_sp_13912 qla2x00_get_ctx_sp 3 13912 NULL
-+sysctl_string_13937 sysctl_string 5 13937 NULL
-+ieee80211_if_read_min_discovery_timeout_13946 ieee80211_if_read_min_discovery_timeout 3 13946 NULL
-+com90xx_found_13974 com90xx_found 3 13974 NULL
-+qcam_read_13977 qcam_read 3 13977 NULL
-+dvb_demux_read_13981 dvb_demux_read 3 13981 NULL
-+ieee80211_bss_info_update_13991 ieee80211_bss_info_update 4 13991 NULL
-+sta_agg_status_read_14058 sta_agg_status_read 3 14058 NULL
-+do_proc_readlink_14096 do_proc_readlink 3 14096 NULL
-+compat_sys_pselect6_14105 compat_sys_pselect6 1 14105 NULL
-+ntfs_rl_replace_14136 ntfs_rl_replace 2-4 14136 NULL
-+tcp_manip_pkt_14202 tcp_manip_pkt 2 14202 NULL
-+alloc_async_14208 alloc_async 1 14208 NULL
-+sys_kexec_load_14222 sys_kexec_load 2 14222 NULL
-+dma_declare_coherent_memory_14244 dma_declare_coherent_memory 4-2 14244 NULL
-+add_numbered_child_14273 add_numbered_child 5 14273 NULL
-+extend_mmcfg_14282 extend_mmcfg 1 14282 NULL
-+snd_seq_oss_readq_new_14283 snd_seq_oss_readq_new 2 14283 NULL
-+iwl_dbgfs_tx_power_read_14285 iwl_dbgfs_tx_power_read 3 14285 NULL
-+read_default_ldt_14302 read_default_ldt 2 14302 NULL
-+smk_write_onlycap_14400 smk_write_onlycap 3 14400 NULL
-+isp1760_register_14408 isp1760_register 2-1 14408 NULL
-+mtd_concat_create_14416 mtd_concat_create 2 14416 NULL
-+udplite_getfrag_14479 udplite_getfrag 3-4 14479 NULL
-+store_sys_acpi_14503 store_sys_acpi 3 14503 NULL
-+ocfs2_debug_read_14507 ocfs2_debug_read 3 14507 NULL
-+ep0_write_14536 ep0_write 3 14536 NULL nohasharray
-+dataflash_read_user_otp_14536 dataflash_read_user_otp 3-2 14536 &ep0_write_14536
-+drm_vmalloc_dma_14550 drm_vmalloc_dma 1 14550 NULL
-+nfqnl_mangle_14583 nfqnl_mangle 2 14583 NULL
-+idmap_pipe_downcall_14591 idmap_pipe_downcall 3 14591 NULL
-+inet_listen_14723 inet_listen 2 14723 NULL
-+store_camera_14751 store_camera 4 14751 NULL
-+sta_dev_read_14782 sta_dev_read 3 14782 NULL
-+do_tune_cpucache_14828 do_tune_cpucache 2 14828 NULL
-+lcd_write_14857 lcd_write 3 14857 NULL nohasharray
-+__krealloc_14857 __krealloc 2 14857 &lcd_write_14857
-+get_user_cpu_mask_14861 get_user_cpu_mask 2 14861 NULL
-+sriov_enable_migration_14889 sriov_enable_migration 2 14889 NULL
-+acpi_os_allocate_14892 acpi_os_allocate 1 14892 NULL
-+ubi_leb_change_14899 ubi_leb_change 4 14899 NULL
-+krealloc_14908 krealloc 2 14908 NULL
-+unix_dgram_recvmsg_14952 unix_dgram_recvmsg 4 14952 NULL
-+ftrace_pid_read_14970 ftrace_pid_read 3 14970 NULL
-+help_14971 help 4 14971 NULL
-+setkey_14987 setkey 3 14987 NULL
-+cistpl_vers_1_15023 cistpl_vers_1 4 15023 NULL
-+vmap_15025 vmap 2 15025 NULL
-+store_lslvl_15059 store_lslvl 4 15059 NULL
-+ntfs_copy_from_user_15072 ntfs_copy_from_user 3-5 15072 NULL
-+pppoe_recvmsg_15073 pppoe_recvmsg 4 15073 NULL
-+ubifs_write_node_15088 ubifs_write_node 5-3 15088 NULL
-+iscsi_create_endpoint_15193 iscsi_create_endpoint 1 15193 NULL
-+sys_connect_15291 sys_connect 3 15291 NULL nohasharray
-+xlate_dev_mem_ptr_15291 xlate_dev_mem_ptr 1 15291 &sys_connect_15291
-+tpm_tis_init_15304 tpm_tis_init 3-2 15304 NULL
-+acpi_ut_create_string_object_15360 acpi_ut_create_string_object 1 15360 NULL
-+slow_kernel_write_15362 slow_kernel_write 6 15362 NULL
-+alloc_fddidev_15382 alloc_fddidev 1 15382 NULL
-+vmalloc_15464 vmalloc 1 15464 NULL
-+add_partition_15515 add_partition 2 15515 NULL
-+compat_fillonedir_15620 compat_fillonedir 3 15620 NULL
-+proc_write_node_15624 proc_write_node 3 15624 NULL
-+dsp_cmx_send_member_15625 dsp_cmx_send_member 2 15625 NULL
-+proc_loginuid_read_15631 proc_loginuid_read 3 15631 NULL
-+joydev_handle_JSIOCSBTNMAP_15643 joydev_handle_JSIOCSBTNMAP 3 15643 NULL
-+compat_sys_fcntl_15654 compat_sys_fcntl 3 15654 NULL
-+unix_bind_15668 unix_bind 3 15668 NULL
-+dm_read_15674 dm_read 3 15674 NULL
-+drm_agp_allocate_memory_15738 drm_agp_allocate_memory 2 15738 NULL
-+HiSax_readstatus_15752 HiSax_readstatus 2 15752 NULL
-+do_test_15766 do_test 1 15766 NULL
-+smk_read_direct_15803 smk_read_direct 3 15803 NULL
-+gnttab_expand_15817 gnttab_expand 1 15817 NULL
-+afs_proc_rootcell_write_15822 afs_proc_rootcell_write 3 15822 NULL
-+ubi_io_write_15870 ubi_io_write 5 15870 NULL
-+__mptctl_ioctl_15875 __mptctl_ioctl 2 15875 NULL
-+remap_pci_mem_15966 remap_pci_mem 1-2 15966 NULL
-+get_entry_16003 get_entry 4 16003 NULL nohasharray
-+alloc_vm_area_16003 alloc_vm_area 1 16003 &get_entry_16003
-+viafb_vt1636_proc_write_16018 viafb_vt1636_proc_write 3 16018 NULL
-+got_frame_16028 got_frame 2 16028 NULL
-+dccp_recvmsg_16056 dccp_recvmsg 4 16056 NULL
-+isr_tx_exch_complete_read_16103 isr_tx_exch_complete_read 3 16103 NULL
-+dma_tx_requested_read_16110 dma_tx_requested_read 3 16110 NULL nohasharray
-+isr_hw_pm_mode_changes_read_16110 isr_hw_pm_mode_changes_read 3 16110 &dma_tx_requested_read_16110
-+dvb_ca_en50221_io_ioctl_16113 dvb_ca_en50221_io_ioctl 3 16113 NULL
-+compat_sys_select_16131 compat_sys_select 1 16131 NULL
-+fsm_init_16134 fsm_init 2 16134 NULL
-+hysdn_rx_netpkt_16136 hysdn_rx_netpkt 3 16136 NULL
-+stats_tx_handlers_drop_unauth_port_read_16139 stats_tx_handlers_drop_unauth_port_read 3 16139 NULL
-+proc_write_disp_16184 proc_write_disp 3 16184 NULL
-+create_table_16213 create_table 2 16213 NULL
-+atomic_read_file_16227 atomic_read_file 3 16227 NULL
-+stk_allocate_buffers_16291 stk_allocate_buffers 2 16291 NULL
-+__cxio_init_resource_fifo_16295 __cxio_init_resource_fifo 3 16295 NULL
-+rsc_mgr_init_16299 rsc_mgr_init 3 16299 NULL
-+ccid3_hc_tx_getsockopt_16314 ccid3_hc_tx_getsockopt 3 16314 NULL
-+total_ps_buffered_read_16365 total_ps_buffered_read 3 16365 NULL
-+iscsi_tcp_conn_setup_16376 iscsi_tcp_conn_setup 2 16376 NULL
-+scsi_nl_send_vendor_msg_16394 scsi_nl_send_vendor_msg 5 16394 NULL
-+alloc_trdev_16399 alloc_trdev 1 16399 NULL
-+diva_os_malloc_16406 diva_os_malloc 2 16406 NULL
-+rxrpc_server_keyring_16431 rxrpc_server_keyring 3 16431 NULL
-+netlink_change_ngroups_16457 netlink_change_ngroups 2 16457 NULL
-+sock_wmalloc_16472 sock_wmalloc 2 16472 NULL
-+tracing_readme_read_16493 tracing_readme_read 3 16493 NULL
-+lpfc_debugfs_read_16566 lpfc_debugfs_read 3 16566 NULL
-+agp_allocate_memory_wrap_16576 agp_allocate_memory_wrap 1 16576 NULL nohasharray
-+new_partial_datagram_16576 new_partial_datagram 4 16576 &agp_allocate_memory_wrap_16576
-+dvb_usercopy_16640 dvb_usercopy 3 16640 NULL
-+platform_device_register_data_16660 platform_device_register_data 5 16660 NULL
-+dlm_new_lockspace_16688 dlm_new_lockspace 2 16688 NULL
-+acpi_processor_write_throttling_16712 acpi_processor_write_throttling 3 16712 NULL
-+iscsi_recv_pdu_16755 iscsi_recv_pdu 4 16755 NULL
-+blk_rq_map_user_iov_16772 blk_rq_map_user_iov 5 16772 NULL
-+dm_vcalloc_16814 dm_vcalloc 1-2 16814 NULL
-+scsi_mode_sense_16835 scsi_mode_sense 5 16835 NULL
-+st_write_16874 st_write 3 16874 NULL
-+mangle_eprt_packet_16882 mangle_eprt_packet 5 16882 NULL
-+snd_gf1_mem_proc_dump_16926 snd_gf1_mem_proc_dump 5-6 16926 NULL
-+iwm_if_alloc_17027 iwm_if_alloc 1 17027 NULL
-+read_cis_cache_17069 read_cis_cache 4 17069 NULL
-+dvb_dvr_read_17073 dvb_dvr_read 3 17073 NULL
-+simple_transaction_read_17076 simple_transaction_read 3 17076 NULL
-+expand_files_17080 expand_files 2 17080 NULL
-+sys_preadv_17100 sys_preadv 3 17100 NULL
-+write_mem_17114 write_mem 3 17114 NULL
-+befs_nls2utf_17163 befs_nls2utf 3 17163 NULL
-+dn_recvmsg_17213 dn_recvmsg 4 17213 NULL
-+enic_rq_alloc_skb_17220 enic_rq_alloc_skb 2 17220 NULL
-+alloc_ep_17269 alloc_ep 1 17269 NULL
-+pg_read_17276 pg_read 3 17276 NULL
-+raw_recvmsg_17277 raw_recvmsg 4 17277 NULL
-+minstrel_stats_read_17290 minstrel_stats_read 3 17290 NULL
-+skb_pad_17302 skb_pad 2 17302 NULL
-+iwm_umac_set_config_var_17320 iwm_umac_set_config_var 4 17320 NULL
-+ata_host_alloc_pinfo_17325 ata_host_alloc_pinfo 3 17325 NULL
-+dispatch_write_17361 dispatch_write 3 17361 NULL
-+zd_rfwrite_locked_17381 zd_rfwrite_locked 3 17381 NULL
-+alloc_fdtable_17389 alloc_fdtable 1 17389 NULL
-+probe_bios_17467 probe_bios 1 17467 NULL
-+restore_i387_fxsave_17528 restore_i387_fxsave 2 17528 NULL
-+xlog_do_log_recovery_17550 xlog_do_log_recovery 3 17550 NULL
-+__copy_to_user_17551 __copy_to_user 3 17551 NULL
-+copy_from_user_17559 copy_from_user 3 17559 NULL
-+acpi_ut_create_package_object_17594 acpi_ut_create_package_object 1 17594 NULL
-+osst_execute_17607 osst_execute 7-6 17607 NULL
-+packet_setsockopt_17662 packet_setsockopt 5 17662 NULL
-+dsp_tone_hw_message_17678 dsp_tone_hw_message 3 17678 NULL
-+pwr_enable_ps_read_17686 pwr_enable_ps_read 3 17686 NULL
-+venus_rename_17707 venus_rename 4-5 17707 NULL
-+zd_usb_ioread16v_17715 zd_usb_ioread16v 4 17715 NULL
-+usbvideo_rvmalloc_17758 usbvideo_rvmalloc 1 17758 NULL
-+ip_nat_sdp_port_17763 ip_nat_sdp_port 5 17763 NULL
-+sysctl_uts_string_17797 sysctl_uts_string 5 17797 NULL
-+sisusb_send_bulk_msg_17864 sisusb_send_bulk_msg 3 17864 NULL
-+alloc_sja1000dev_17868 alloc_sja1000dev 1 17868 NULL
-+orinoco_set_key_17878 orinoco_set_key 5-7 17878 NULL
-+compat_sys_pwritev_17886 compat_sys_pwritev 3 17886 NULL
-+recover_head_17904 recover_head 3 17904 NULL
-+dccp_feat_register_sp_17914 dccp_feat_register_sp 5 17914 NULL
-+xfs_buf_associate_memory_17915 xfs_buf_associate_memory 3 17915 NULL
-+srp_iu_pool_alloc_17920 srp_iu_pool_alloc 2 17920 NULL
-+smk_write_cipso_17989 smk_write_cipso 3 17989 NULL
-+pvr2_v4l2_read_18006 pvr2_v4l2_read 3 18006 NULL
-+ip_vs_icmp_xmit_v6_18045 ip_vs_icmp_xmit_v6 4 18045 NULL
-+cryptd_alloc_instance_18048 cryptd_alloc_instance 2-3 18048 NULL
-+ddebug_proc_write_18055 ddebug_proc_write 3 18055 NULL
-+kvm_read_guest_page_18074 kvm_read_guest_page 5 18074 NULL
-+get_vm_area_18080 get_vm_area 1 18080 NULL
-+iraw_encode_18099 iraw_encode 2-3 18099 NULL
-+netlink_kernel_create_18110 netlink_kernel_create 3 18110 NULL
-+selinux_inode_setsecurity_18148 selinux_inode_setsecurity 4 18148 NULL
-+fc_change_queue_depth_18169 fc_change_queue_depth 2 18169 NULL
-+orinoco_add_extscan_result_18207 orinoco_add_extscan_result 3 18207 NULL
-+do_ipv6_setsockopt_18215 do_ipv6_setsockopt 5 18215 NULL
-+gnttab_alloc_grant_references_18240 gnttab_alloc_grant_references 1 18240 NULL
-+rfcomm_sock_setsockopt_18254 rfcomm_sock_setsockopt 5 18254 NULL
-+qdisc_class_hash_alloc_18262 qdisc_class_hash_alloc 1 18262 NULL
-+cxgb3i_alloc_big_mem_18283 cxgb3i_alloc_big_mem 1 18283 NULL
-+um_idi_write_18293 um_idi_write 3 18293 NULL
-+ip6ip6_err_18308 ip6ip6_err 5 18308 NULL
-+ecryptfs_send_message_18322 ecryptfs_send_message 2 18322 NULL
-+pwr_power_save_off_read_18355 pwr_power_save_off_read 3 18355 NULL
-+fuse_perform_write_18457 fuse_perform_write 4 18457 NULL
-+regset_tls_set_18459 regset_tls_set 4 18459 NULL
-+udpv6_setsockopt_18487 udpv6_setsockopt 5 18487 NULL
-+snd_gus_dram_poke_18525 snd_gus_dram_poke 4 18525 NULL
-+seq_copy_in_user_18543 seq_copy_in_user 3 18543 NULL
-+dv1394_write_18547 dv1394_write 3 18547 NULL
-+debug_output_18575 debug_output 3 18575 NULL
-+__netdev_alloc_skb_18595 __netdev_alloc_skb 2 18595 NULL
-+slabinfo_write_18600 slabinfo_write 3 18600 NULL
-+iowarrior_write_18604 iowarrior_write 3 18604 NULL
-+from_buffer_18625 from_buffer 3 18625 NULL
-+edge_tty_recv_18667 edge_tty_recv 4 18667 NULL
-+replay_log_leb_18704 replay_log_leb 3 18704 NULL
-+init_kstat_irqs_18740 init_kstat_irqs 3 18740 NULL
-+wep_packets_read_18751 wep_packets_read 3 18751 NULL
-+alloc_fcdev_18780 alloc_fcdev 1 18780 NULL
-+sys_modify_ldt_18824 sys_modify_ldt 3 18824 NULL
-+sctp_setsockopt_events_18862 sctp_setsockopt_events 3 18862 NULL
-+xlog_find_verify_log_record_18870 xlog_find_verify_log_record 2 18870 NULL
-+___alloc_bootmem_node_18882 ___alloc_bootmem_node 2 18882 NULL
-+revalidate_19043 revalidate 2 19043 NULL
-+sta_last_seq_ctrl_read_19106 sta_last_seq_ctrl_read 3 19106 NULL
-+alloc_irdadev_19140 alloc_irdadev 1 19140 NULL
-+__copy_to_user_inatomic_19214 __copy_to_user_inatomic 3 19214 NULL
-+acpi_system_read_dsdt_19261 acpi_system_read_dsdt 3 19261 NULL
-+sys_fcntl_19267 sys_fcntl 3 19267 NULL
-+hpsb_iso_xmit_init_19277 hpsb_iso_xmit_init 3 19277 NULL
-+qc_capture_19298 qc_capture 3 19298 NULL
-+event_tx_stuck_read_19305 event_tx_stuck_read 3 19305 NULL
-+cfg80211_inform_bss_19332 cfg80211_inform_bss 8 19332 NULL
-+read_zero_19366 read_zero 3 19366 NULL
-+uv_ptc_proc_write_19394 uv_ptc_proc_write 3 19394 NULL
-+pep_recvmsg_19402 pep_recvmsg 4 19402 NULL
-+dvbdmx_write_19423 dvbdmx_write 3 19423 NULL
-+refill_pool_19477 refill_pool 2 19477 NULL
-+skb_realloc_headroom_19516 skb_realloc_headroom 2 19516 NULL
-+atm_alloc_charge_19517 atm_alloc_charge 2 19517 NULL nohasharray
-+dev_alloc_skb_19517 dev_alloc_skb 1 19517 &atm_alloc_charge_19517
-+ocfs2_control_message_19564 ocfs2_control_message 3 19564 NULL
-+cgroup_read_s64_19570 cgroup_read_s64 5 19570 NULL
-+bm_status_read_19583 bm_status_read 3 19583 NULL
-+usbvision_rvmalloc_19655 usbvision_rvmalloc 1 19655 NULL
-+LoadBitmap_19658 LoadBitmap 2 19658 NULL
-+memcpy_toiovecend_19736 memcpy_toiovecend 3-4 19736 NULL
-+p9_client_read_19750 p9_client_read 5 19750 NULL
-+saa7146_vmalloc_build_pgtable_19780 saa7146_vmalloc_build_pgtable 2 19780 NULL
-+irda_setsockopt_19824 irda_setsockopt 5 19824 NULL
-+ubi_eba_write_leb_19826 ubi_eba_write_leb 6-5 19826 NULL
-+security_context_to_sid_19839 security_context_to_sid 2 19839 NULL
-+dlm_lock_19858 dlm_lock 6 19858 NULL
-+aes_decrypt_interrupt_read_19910 aes_decrypt_interrupt_read 3 19910 NULL
-+ps_upsd_max_apturn_read_19918 ps_upsd_max_apturn_read 3 19918 NULL
-+iwl_dbgfs_rx_queue_read_19943 iwl_dbgfs_rx_queue_read 3 19943 NULL
-+zd_ioread32v_locked_19953 zd_ioread32v_locked 4 19953 NULL
-+ax25_send_frame_19964 ax25_send_frame 2 19964 NULL
-+dbg_leb_change_19969 dbg_leb_change 4 19969 NULL
-+attach_hdlc_protocol_19986 attach_hdlc_protocol 3 19986 NULL
-+sctp_getsockopt_mappedv4_20044 sctp_getsockopt_mappedv4 2 20044 NULL
-+alloc_ieee80211_20063 alloc_ieee80211 1 20063 NULL
-+rawv6_sendmsg_20080 rawv6_sendmsg 4 20080 NULL
-+fuse_conn_limit_read_20084 fuse_conn_limit_read 3 20084 NULL
-+read_flush_pipefs_20171 read_flush_pipefs 3 20171 NULL
-+wep_addr_key_count_read_20174 wep_addr_key_count_read 3 20174 NULL
-+rose_sendmsg_20249 rose_sendmsg 4 20249 NULL
-+jffs2_security_setxattr_20253 jffs2_security_setxattr 4 20253 NULL
-+cpia_write_proc_20268 cpia_write_proc 3 20268 NULL
-+snd_cs4281_BA1_read_20323 snd_cs4281_BA1_read 5-6 20323 NULL
-+gfs2_glock_nq_m_20347 gfs2_glock_nq_m 1 20347 NULL
-+nfsd_read_20406 nfsd_read 6 20406 NULL
-+find_skb_20431 find_skb 2 20431 NULL
-+tcp_fragment_20436 tcp_fragment 3 20436 NULL
-+compat_ipv6_setsockopt_20468 compat_ipv6_setsockopt 5 20468 NULL
-+read_buf_20469 read_buf 2 20469 NULL
-+dbg_leb_write_20478 dbg_leb_write 5-4 20478 NULL
-+__videobuf_copy_stream_20490 __videobuf_copy_stream 3 20490 NULL
-+fast_user_write_20494 fast_user_write 5 20494 NULL
-+xfs_iext_realloc_direct_20521 xfs_iext_realloc_direct 2 20521 NULL
-+amd_create_gatt_pages_20537 amd_create_gatt_pages 1 20537 NULL
-+venus_create_20555 venus_create 4 20555 NULL
-+snd_hdsp_playback_copy_20676 snd_hdsp_playback_copy 5 20676 NULL
-+dvb_dmxdev_buffer_read_20682 dvb_dmxdev_buffer_read 4 20682 NULL
-+ftdi_write_20710 ftdi_write 4 20710 NULL
-+security_context_to_sid_force_20724 security_context_to_sid_force 2 20724 NULL
-+vol_cdev_direct_write_20751 vol_cdev_direct_write 3 20751 NULL
-+sys_sendto_20809 sys_sendto 6 20809 NULL
-+rb_simple_write_20890 rb_simple_write 3 20890 NULL
-+sisusb_send_packet_20891 sisusb_send_packet 2 20891 NULL
-+key_icverrors_read_20895 key_icverrors_read 3 20895 NULL
-+compat_sys_readv_20911 compat_sys_readv 3 20911 NULL
-+snd_rme9652_playback_copy_20970 snd_rme9652_playback_copy 5 20970 NULL
-+lbs_threshold_read_21046 lbs_threshold_read 5 21046 NULL
-+proc_fault_inject_write_21058 proc_fault_inject_write 3 21058 NULL
-+hpsb_make_streampacket_21071 hpsb_make_streampacket 3 21071 NULL
-+event_calibration_read_21083 event_calibration_read 3 21083 NULL
-+new_skb_21148 new_skb 1 21148 NULL
-+stats_retry_count_read_21177 stats_retry_count_read 3 21177 NULL
-+cx18_v4l2_read_21196 cx18_v4l2_read 3 21196 NULL
-+mangle_rfc959_packet_21197 mangle_rfc959_packet 5 21197 NULL
-+ipc_rcu_alloc_21208 ipc_rcu_alloc 1 21208 NULL nohasharray
-+frame_alloc_21208 frame_alloc 2 21208 &ipc_rcu_alloc_21208
-+input_ff_create_21240 input_ff_create 2 21240 NULL
-+sock_alloc_send_pskb_21246 sock_alloc_send_pskb 2 21246 NULL
-+store_bluetooth_21320 store_bluetooth 4 21320 NULL
-+ftrace_profile_read_21327 ftrace_profile_read 3 21327 NULL
-+mon_bin_ioctl_21336 mon_bin_ioctl 4 21336 NULL
-+alloc_orinocodev_21371 alloc_orinocodev 1 21371 NULL
-+tracing_saved_cmdlines_read_21434 tracing_saved_cmdlines_read 3 21434 NULL
-+concat_writev_21451 concat_writev 3 21451 NULL
-+read_file_xmit_21487 read_file_xmit 3 21487 NULL
-+dma_skb_copy_datagram_iovec_21516 dma_skb_copy_datagram_iovec 3-5 21516 NULL
-+rxrpc_send_data_21553 rxrpc_send_data 5 21553 NULL
-+ocfs2_acl_from_xattr_21604 ocfs2_acl_from_xattr 2 21604 NULL
-+xlog_do_recovery_pass_21618 xlog_do_recovery_pass 3 21618 NULL
-+tcp_update_scoreboard_21639 tcp_update_scoreboard 2 21639 NULL
-+atalk_sendmsg_21677 atalk_sendmsg 4 21677 NULL
-+tomoyo_read_control_21682 tomoyo_read_control 3 21682 NULL
-+evdev_ioctl_handler_21705 evdev_ioctl_handler 2 21705 NULL
-+drm_sman_init_21710 drm_sman_init 2 21710 NULL
-+reiserfs_allocate_list_bitmaps_21732 reiserfs_allocate_list_bitmaps 3 21732 NULL
-+mthca_alloc_init_21754 mthca_alloc_init 2 21754 NULL
-+l2down_create_21755 l2down_create 4 21755 NULL
-+aem_read_sensor_21770 aem_read_sensor 5 21770 NULL
-+gen_pool_add_21776 gen_pool_add 3 21776 NULL
-+__ioremap_caller_21800 __ioremap_caller 2-1 21800 NULL
-+acpi_tb_check_xsdt_21862 acpi_tb_check_xsdt 1 21862 NULL
-+cnic_init_id_tbl_21872 cnic_init_id_tbl 2 21872 NULL
-+sisusbcon_bmove_21873 sisusbcon_bmove 5-7-6 21873 NULL
-+dv1394_read_21920 dv1394_read 3 21920 NULL
-+alloc_ldt_21972 alloc_ldt 2 21972 NULL
-+rxpipe_descr_host_int_trig_rx_data_read_22001 rxpipe_descr_host_int_trig_rx_data_read 3 22001 NULL
-+ti_recv_22027 ti_recv 4 22027 NULL
-+zd_usb_read_fw_22049 zd_usb_read_fw 4 22049 NULL
-+atalk_recvmsg_22053 atalk_recvmsg 4 22053 NULL
-+ath_descdma_setup_22128 ath_descdma_setup 5 22128 NULL
-+rfcomm_sock_recvmsg_22227 rfcomm_sock_recvmsg 4 22227 NULL
-+mesh_table_alloc_22305 mesh_table_alloc 1 22305 NULL
-+fcp_request_22315 fcp_request 6 22315 NULL
-+udpv6_sendmsg_22316 udpv6_sendmsg 4 22316 NULL
-+alloc_candev_22356 alloc_candev 1 22356 NULL
-+evdev_ioctl_22371 evdev_ioctl 2 22371 NULL
-+btmrvl_psmode_read_22395 btmrvl_psmode_read 3 22395 NULL
-+ubifs_leb_change_22399 ubifs_leb_change 4 22399 NULL
-+zoran_write_22404 zoran_write 3 22404 NULL
-+queue_reply_22416 queue_reply 3 22416 NULL
-+handle_received_packet_22457 handle_received_packet 3 22457 NULL
-+cache_write_procfs_22491 cache_write_procfs 3 22491 NULL
-+pskb_may_pull_22546 pskb_may_pull 2 22546 NULL
-+agp_alloc_page_array_22554 agp_alloc_page_array 1 22554 NULL
-+sctp_setsockopt_connectx_old_22631 sctp_setsockopt_connectx_old 3 22631 NULL
-+pwr_wake_on_timer_exp_read_22640 pwr_wake_on_timer_exp_read 3 22640 NULL
-+usb_serial_multi_urb_write_22718 usb_serial_multi_urb_write 4 22718 NULL
-+ax25_output_22736 ax25_output 2 22736 NULL
-+sta_rx_packets_read_22788 sta_rx_packets_read 3 22788 NULL
-+read_file_rcstat_22854 read_file_rcstat 3 22854 NULL
-+create_attr_set_22861 create_attr_set 1 22861 NULL
-+usblp_new_writeurb_22894 usblp_new_writeurb 2 22894 NULL
-+mdc800_device_read_22896 mdc800_device_read 3 22896 NULL
-+alloc_sglist_22960 alloc_sglist 1-3-2 22960 NULL
-+remote_settings_file_write_22987 remote_settings_file_write 3 22987 NULL
-+viafb_dvp0_proc_write_23023 viafb_dvp0_proc_write 3 23023 NULL
-+reiserfs_add_entry_23062 reiserfs_add_entry 4 23062 NULL nohasharray
-+unix_seqpacket_recvmsg_23062 unix_seqpacket_recvmsg 4 23062 &reiserfs_add_entry_23062
-+vm_map_ram_23078 vm_map_ram 2 23078 NULL nohasharray
-+raw_sendmsg_23078 raw_sendmsg 4 23078 &vm_map_ram_23078
-+isr_tx_procs_read_23084 isr_tx_procs_read 3 23084 NULL
-+rt2x00debug_write_eeprom_23091 rt2x00debug_write_eeprom 3 23091 NULL
-+ntfs_ucstonls_23097 ntfs_ucstonls 3-5 23097 NULL
-+pipe_iov_copy_from_user_23102 pipe_iov_copy_from_user 3 23102 NULL
-+dgram_recvmsg_23104 dgram_recvmsg 4 23104 NULL
-+ip_recv_error_23109 ip_recv_error 3 23109 NULL
-+drm_mode_create_tv_properties_23122 drm_mode_create_tv_properties 2 23122 NULL
-+ioremap_23172 ioremap 2-1 23172 NULL
-+usblp_write_23178 usblp_write 3 23178 NULL
-+msnd_fifo_alloc_23179 msnd_fifo_alloc 2 23179 NULL
-+gss_pipe_downcall_23182 gss_pipe_downcall 3 23182 NULL
-+fix_unclean_leb_23188 fix_unclean_leb 3 23188 NULL
-+acpi_processor_write_limit_23201 acpi_processor_write_limit 3 23201 NULL
-+tty_buffer_request_room_23228 tty_buffer_request_room 2 23228 NULL
-+xlog_get_bp_23229 xlog_get_bp 2 23229 NULL
-+__kmalloc_23231 __kmalloc 1 23231 NULL
-+rxrpc_client_sendmsg_23236 rxrpc_client_sendmsg 5 23236 NULL
-+sctp_recvmsg_23265 sctp_recvmsg 4 23265 NULL
-+doc_probe_23285 doc_probe 1 23285 NULL
-+i2cdev_write_23310 i2cdev_write 3 23310 NULL
-+nl_pid_hash_zalloc_23314 nl_pid_hash_zalloc 1 23314 NULL
-+nfs_flush_one_23329 nfs_flush_one 3 23329 NULL
-+page_readlink_23346 page_readlink 3 23346 NULL
-+ulog_alloc_skb_23427 ulog_alloc_skb 1 23427 NULL
-+__fc_frame_alloc_23432 __fc_frame_alloc 1 23432 NULL
-+dn_nsp_send_disc_23469 dn_nsp_send_disc 2 23469 NULL
-+linear_conf_23485 linear_conf 2 23485 NULL nohasharray
-+divasa_remap_pci_bar_23485 divasa_remap_pci_bar 3-4 23485 &linear_conf_23485
-+event_filter_read_23494 event_filter_read 3 23494 NULL
-+write_led_23517 write_led 2 23517 NULL
-+ima_show_measurements_count_23536 ima_show_measurements_count 3 23536 NULL
-+tcp_match_skb_to_sack_23568 tcp_match_skb_to_sack 3-4 23568 NULL
-+venus_symlink_23570 venus_symlink 4-6 23570 NULL
-+iwl_dbgfs_interrupt_read_23574 iwl_dbgfs_interrupt_read 3 23574 NULL
-+cifs_spnego_key_instantiate_23588 cifs_spnego_key_instantiate 3 23588 NULL
-+islpci_mgt_transaction_23610 islpci_mgt_transaction 5 23610 NULL
-+__i2400mu_send_barker_23652 __i2400mu_send_barker 3 23652 NULL
-+cx18_read_23699 cx18_read 3 23699 NULL
-+sock_alloc_send_skb_23720 sock_alloc_send_skb 2 23720 NULL
-+vstusb_read_23774 vstusb_read 3 23774 NULL
-+diva_alloc_dma_map_23798 diva_alloc_dma_map 2 23798 NULL
-+rx_path_reset_read_23801 rx_path_reset_read 3 23801 NULL
-+__earlyonly_bootmem_alloc_23824 __earlyonly_bootmem_alloc 2 23824 NULL
-+xfs_dir2_leaf_getdents_23841 xfs_dir2_leaf_getdents 3 23841 NULL
-+iwl_dbgfs_nvm_read_23845 iwl_dbgfs_nvm_read 3 23845 NULL
-+p54_init_common_23850 p54_init_common 1 23850 NULL
-+ieee80211_if_read_dot11MeshMaxPeerLinks_23878 ieee80211_if_read_dot11MeshMaxPeerLinks 3 23878 NULL
-+iwch_reject_cr_23901 iwch_reject_cr 3 23901 NULL
-+ipath_reg_phys_mr_23918 ipath_reg_phys_mr 3 23918 NULL
-+__alloc_skb_23940 __alloc_skb 1 23940 NULL
-+cxgb_alloc_mem_24007 cxgb_alloc_mem 1 24007 NULL
-+alloc_netdev_mq_24028 alloc_netdev_mq 1-4 24028 NULL
-+blkcipher_copy_iv_24075 blkcipher_copy_iv 3 24075 NULL
-+stats_multicast_received_frame_count_read_24083 stats_multicast_received_frame_count_read 3 24083 NULL
-+request_key_auth_read_24109 request_key_auth_read 3 24109 NULL
-+irnet_ctrl_write_24139 irnet_ctrl_write 3 24139 NULL
-+adu_read_24177 adu_read 3 24177 NULL
-+ieee80211_if_read_dot11MeshHWMPpreqMinInterval_24208 ieee80211_if_read_dot11MeshHWMPpreqMinInterval 3 24208 NULL
-+debug_buffer_read_24220 debug_buffer_read 3 24220 NULL
-+pcpu_embed_first_chunk_24224 pcpu_embed_first_chunk 3 24224 NULL
-+sel_read_bool_24236 sel_read_bool 3 24236 NULL
-+btmrvl_pscmd_read_24308 btmrvl_pscmd_read 3 24308 NULL
-+kzalloc_node_24352 kzalloc_node 1 24352 NULL
-+cfi_read_pri_24366 cfi_read_pri 3 24366 NULL
-+getxattr_24398 getxattr 4 24398 NULL
-+b43_debugfs_read_24425 b43_debugfs_read 3 24425 NULL
-+ieee80211_rx_mgmt_beacon_24430 ieee80211_rx_mgmt_beacon 3 24430 NULL
-+evdev_do_ioctl_24459 evdev_do_ioctl 2 24459 NULL
-+skb_copy_and_csum_datagram_iovec_24466 skb_copy_and_csum_datagram_iovec 2 24466 NULL
-+request_key_with_auxdata_24515 request_key_with_auxdata 4 24515 NULL
-+named_prepare_buf_24532 named_prepare_buf 2 24532 NULL
-+sctp_getsockopt_primary_addr_24639 sctp_getsockopt_primary_addr 2 24639 NULL
-+leaf_dealloc_24706 leaf_dealloc 3 24706 NULL
-+simple_attr_read_24738 simple_attr_read 3 24738 NULL
-+ath_rxbuf_alloc_24745 ath_rxbuf_alloc 2 24745 NULL
-+kgdb_hex2mem_24755 kgdb_hex2mem 3 24755 NULL
-+mI_alloc_skb_24770 mI_alloc_skb 1 24770 NULL
-+skb_make_writable_24783 skb_make_writable 2 24783 NULL
-+cache_read_24790 cache_read 3 24790 NULL
-+pnp_alloc_24869 pnp_alloc 1 24869 NULL
-+queues_read_24877 queues_read 3 24877 NULL
-+iwm_rx_handle_24899 iwm_rx_handle 3 24899 NULL
-+packet_sendmsg_24954 packet_sendmsg 4 24954 NULL
-+lbs_getscantable_24955 lbs_getscantable 3 24955 NULL
-+sys_rt_sigpending_24961 sys_rt_sigpending 2 24961 NULL
-+llc_ui_sendmsg_24987 llc_ui_sendmsg 4 24987 NULL
-+key_conf_hw_key_idx_read_25003 key_conf_hw_key_idx_read 3 25003 NULL
-+gs_buf_alloc_25067 gs_buf_alloc 2 25067 NULL
-+cxio_hal_init_rhdl_resource_25104 cxio_hal_init_rhdl_resource 1 25104 NULL
-+snd_rawmidi_kernel_write_25106 snd_rawmidi_kernel_write 3 25106 NULL
-+oom_adjust_read_25127 oom_adjust_read 3 25127 NULL
-+sys_fgetxattr_25166 sys_fgetxattr 4 25166 NULL
-+ipath_init_qp_table_25167 ipath_init_qp_table 2 25167 NULL
-+sctp_getsockopt_local_addrs_25178 sctp_getsockopt_local_addrs 2 25178 NULL
-+mon_stat_read_25238 mon_stat_read 3 25238 NULL
-+crypto_alloc_instance2_25277 crypto_alloc_instance2 3 25277 NULL
-+vfs_writev_25278 vfs_writev 3 25278 NULL
-+sys_dup2_25284 sys_dup2 2 25284 NULL
-+xfs_da_buf_make_25303 xfs_da_buf_make 1 25303 NULL
-+sel_read_mls_25369 sel_read_mls 3 25369 NULL
-+rtl8169_alloc_rx_skb_25392 rtl8169_alloc_rx_skb 4-5 25392 NULL
-+jffs2_do_create_25404 jffs2_do_create 6 25404 NULL
-+et61x251_read_25420 et61x251_read 3 25420 NULL
-+cxio_init_resource_fifo_25429 cxio_init_resource_fifo 3 25429 NULL
-+generic_file_buffered_write_25464 generic_file_buffered_write 4 25464 NULL
-+ivtv_buf_copy_from_user_25502 ivtv_buf_copy_from_user 4 25502 NULL
-+snd_pcm_plugin_build_25505 snd_pcm_plugin_build 5 25505 NULL
-+ieee80211_if_read_path_refresh_time_25545 ieee80211_if_read_path_refresh_time 3 25545 NULL
-+__devres_alloc_25598 __devres_alloc 2 25598 NULL
-+proc_coredump_filter_write_25625 proc_coredump_filter_write 3 25625 NULL
-+befs_utf2nls_25628 befs_utf2nls 3 25628 NULL
-+sta_inactive_ms_read_25690 sta_inactive_ms_read 3 25690 NULL
-+ibmasm_new_command_25714 ibmasm_new_command 2 25714 NULL
-+sel_write_context_25726 sel_write_context 3 25726 NULL nohasharray
-+__alloc_bootmem_low_node_25726 __alloc_bootmem_low_node 2 25726 &sel_write_context_25726
-+mcs_unwrap_fir_25733 mcs_unwrap_fir 3 25733 NULL
-+event_rx_pool_read_25792 event_rx_pool_read 3 25792 NULL
-+sg_read_25799 sg_read 3 25799 NULL
-+sys32_rt_sigpending_25814 sys32_rt_sigpending 2 25814 NULL
-+system_enable_read_25815 system_enable_read 3 25815 NULL
-+realloc_buffer_25816 realloc_buffer 2 25816 NULL
-+pwr_missing_bcns_read_25824 pwr_missing_bcns_read 3 25824 NULL
-+sisusbcon_scroll_area_25899 sisusbcon_scroll_area 3-4 25899 NULL
-+do_jffs2_setxattr_25910 do_jffs2_setxattr 5 25910 NULL
-+rcname_read_25919 rcname_read 3 25919 NULL
-+snd_es1938_capture_copy_25930 snd_es1938_capture_copy 5 25930 NULL
-+key_flags_read_25931 key_flags_read 3 25931 NULL
-+sctp_make_op_error_25941 sctp_make_op_error 5 25941 NULL
-+cosa_read_25966 cosa_read 3 25966 NULL
-+udp_setsockopt_25985 udp_setsockopt 5 25985 NULL
-+selinux_inode_post_setxattr_26037 selinux_inode_post_setxattr 4 26037 NULL
-+sctp_getsockopt_initmsg_26042 sctp_getsockopt_initmsg 2 26042 NULL
-+keyctl_update_key_26061 keyctl_update_key 3 26061 NULL
-+snd_usb_ctl_msg_26092 snd_usb_ctl_msg 8 26092 NULL
-+user_instantiate_26131 user_instantiate 3 26131 NULL
-+skb_cow_26138 skb_cow 2 26138 NULL
-+copy_oldmem_page_26164 copy_oldmem_page 3-1 26164 NULL
-+get_registers_26187 get_registers 3 26187 NULL
-+xfs_idata_realloc_26199 xfs_idata_realloc 2 26199 NULL
-+mce_write_26201 mce_write 3 26201 NULL
-+store_sys_hwmon_26225 store_sys_hwmon 3 26225 NULL
-+rxrpc_recvmsg_26233 rxrpc_recvmsg 4 26233 NULL
-+pwr_wake_on_host_read_26321 pwr_wake_on_host_read 3 26321 NULL
-+tcp_sacktag_walk_26339 tcp_sacktag_walk 5-6 26339 NULL
-+hdpvr_i2c_read_26347 hdpvr_i2c_read 4 26347 NULL
-+dup_to_netobj_26363 dup_to_netobj 3 26363 NULL
-+kmsg_write_26398 kmsg_write 3 26398 NULL
-+pagemap_read_26441 pagemap_read 3 26441 NULL
-+ib_alloc_device_26483 ib_alloc_device 1 26483 NULL
-+ulong_write_file_26485 ulong_write_file 3 26485 NULL
-+read_vmcore_26501 read_vmcore 3 26501 NULL
-+pcpu_get_vm_areas_26522 pcpu_get_vm_areas 3 26522 NULL
-+rds_message_inc_copy_to_user_26540 rds_message_inc_copy_to_user 3 26540 NULL
-+zd_ioread32v_26545 zd_ioread32v 4 26545 NULL
-+pwr_fix_tsf_ps_read_26627 pwr_fix_tsf_ps_read 3 26627 NULL
-+srp_ring_alloc_26760 srp_ring_alloc 2 26760 NULL
-+smk_write_load_26829 smk_write_load 3 26829 NULL
-+ecryptfs_miscdev_write_26847 ecryptfs_miscdev_write 3 26847 NULL
-+x25_asy_change_mtu_26928 x25_asy_change_mtu 2 26928 NULL
-+scsi_tgt_copy_sense_26933 scsi_tgt_copy_sense 3 26933 NULL
-+pwr_ps_enter_read_26935 pwr_ps_enter_read 3 26935 NULL nohasharray
-+sctp_setsockopt_adaptation_layer_26935 sctp_setsockopt_adaptation_layer 3 26935 &pwr_ps_enter_read_26935
-+hecubafb_write_26942 hecubafb_write 3 26942 NULL
-+extract_entropy_user_26952 extract_entropy_user 3 26952 NULL
-+alloc_fdmem_27083 alloc_fdmem 1 27083 NULL
-+btmrvl_hscmd_write_27089 btmrvl_hscmd_write 3 27089 NULL
-+alloc_arch_preferred_bootmem_27097 alloc_arch_preferred_bootmem 2 27097 NULL
-+pms_capture_27142 pms_capture 4 27142 NULL
-+btmrvl_hscfgcmd_write_27143 btmrvl_hscfgcmd_write 3 27143 NULL
-+i2400m_net_rx_27170 i2400m_net_rx 5 27170 NULL
-+ip_ufo_append_data_27187 ip_ufo_append_data 5-7-6 27187 NULL
-+rxrpc_request_key_27235 rxrpc_request_key 3 27235 NULL
-+copy_from_buf_27308 copy_from_buf 4-2 27308 NULL
-+snd_pcm_oss_write2_27332 snd_pcm_oss_write2 3 27332 NULL
-+pcbit_stat_27364 pcbit_stat 2 27364 NULL
-+hcd_buffer_alloc_27495 hcd_buffer_alloc 2 27495 NULL
-+garmin_read_process_27509 garmin_read_process 3 27509 NULL
-+ib_copy_to_udata_27525 ib_copy_to_udata 3 27525 NULL
-+sysctl_tcp_congestion_control_27564 sysctl_tcp_congestion_control 5 27564 NULL
-+libipw_alloc_txb_27579 libipw_alloc_txb 1-3-2 27579 NULL
-+tipc_cfg_reply_alloc_27606 tipc_cfg_reply_alloc 1 27606 NULL
-+read_flush_procfs_27642 read_flush_procfs 3 27642 NULL
-+cdrom_read_cdda_old_27664 cdrom_read_cdda_old 4 27664 NULL
-+l2cap_sar_segment_sdu_27701 l2cap_sar_segment_sdu 3 27701 NULL
-+reg_w_buf_27724 reg_w_buf 3 27724 NULL
-+a4t_cs_init_27734 a4t_cs_init 3 27734 NULL
-+kcalloc_27770 kcalloc 1-2 27770 NULL
-+sta_rx_dropped_read_27830 sta_rx_dropped_read 3 27830 NULL
-+sys_listxattr_27833 sys_listxattr 3 27833 NULL
-+read_profile_27859 read_profile 3 27859 NULL
-+unix_seqpacket_sendmsg_27893 unix_seqpacket_sendmsg 4 27893 NULL
-+ubi_eba_write_leb_st_27896 ubi_eba_write_leb_st 5 27896 NULL
-+gluebi_write_27905 gluebi_write 3 27905 NULL
-+sctp_make_abort_violation_27959 sctp_make_abort_violation 4 27959 NULL
-+tracing_clock_write_27961 tracing_clock_write 3 27961 NULL
-+mic_rx_pkts_read_27972 mic_rx_pkts_read 3 27972 NULL
-+snd_rawmidi_write_28008 snd_rawmidi_write 3 28008 NULL
-+stats_tx_handlers_drop_not_assoc_read_28015 stats_tx_handlers_drop_not_assoc_read 3 28015 NULL
-+get_packet_pg_28023 get_packet_pg 4 28023 NULL
-+sctp_setsockopt_maxburst_28041 sctp_setsockopt_maxburst 3 28041 NULL
-+cx231xx_init_vbi_isoc_28053 cx231xx_init_vbi_isoc 2-3 28053 NULL
-+cfg80211_roamed_28061 cfg80211_roamed 4-6 28061 NULL
-+gdth_init_isa_28091 gdth_init_isa 1 28091 NULL
-+vgacon_adjust_height_28124 vgacon_adjust_height 2 28124 NULL
-+snd_midi_channel_alloc_set_28153 snd_midi_channel_alloc_set 1 28153 NULL
-+stats_dot11FCSErrorCount_read_28154 stats_dot11FCSErrorCount_read 3 28154 NULL
-+__hidp_send_ctrl_message_28303 __hidp_send_ctrl_message 4 28303 NULL
-+do_sysctl_28306 do_sysctl 6 28306 NULL
-+snd_pcm_oss_read_28317 snd_pcm_oss_read 3 28317 NULL
-+bm_entry_write_28338 bm_entry_write 3 28338 NULL
-+tcp_copy_to_iovec_28344 tcp_copy_to_iovec 3 28344 NULL
-+sys_writev_28384 sys_writev 3 28384 NULL
-+dlmfs_file_read_28385 dlmfs_file_read 3 28385 NULL
-+i2400m_tx_stats_read_28527 i2400m_tx_stats_read 3 28527 NULL
-+capinc_tty_write_28539 capinc_tty_write 3 28539 NULL
-+sel_read_policycap_28544 sel_read_policycap 3 28544 NULL
-+mptctl_getiocinfo_28545 mptctl_getiocinfo 2 28545 NULL
-+b43legacy_debugfs_write_28556 b43legacy_debugfs_write 3 28556 NULL
-+inet_dccp_listen_28565 inet_dccp_listen 2 28565 NULL
-+snd_nm256_capture_copy_28622 snd_nm256_capture_copy 5 28622 NULL
-+blk_queue_resize_tags_28670 blk_queue_resize_tags 2 28670 NULL
-+__dev_alloc_skb_28681 __dev_alloc_skb 1 28681 NULL
-+spi_execute_28736 spi_execute 5 28736 NULL
-+snd_pcm_aio_write_28738 snd_pcm_aio_write 3 28738 NULL
-+stats_transmitted_fragment_count_read_28770 stats_transmitted_fragment_count_read 3 28770 NULL
-+dvb_net_sec_callback_28786 dvb_net_sec_callback 2 28786 NULL
-+sel_write_member_28800 sel_write_member 3 28800 NULL
-+cgroup_file_read_28804 cgroup_file_read 3 28804 NULL
-+vp_request_msix_vectors_28849 vp_request_msix_vectors 2 28849 NULL
-+_fc_frame_alloc_28865 _fc_frame_alloc 2 28865 NULL
-+ipv6_renew_options_28867 ipv6_renew_options 5 28867 NULL
-+iwl3945_sta_dbgfs_stats_table_read_28882 iwl3945_sta_dbgfs_stats_table_read 3 28882 NULL
-+packet_sendmsg_spkt_28885 packet_sendmsg_spkt 4 28885 NULL
-+ps_upsd_timeouts_read_28924 ps_upsd_timeouts_read 3 28924 NULL
-+hci_sock_setsockopt_28993 hci_sock_setsockopt 5 28993 NULL
-+sys_fcntl64_29031 sys_fcntl64 3 29031 NULL
-+rxrpc_sendmsg_29049 rxrpc_sendmsg 4 29049 NULL nohasharray
-+hpsb_read_29049 hpsb_read 6 29049 &rxrpc_sendmsg_29049
-+isdn_ppp_write_29109 isdn_ppp_write 4 29109 NULL
-+proc_scsi_write_29142 proc_scsi_write 3 29142 NULL
-+reshape_ring_29147 reshape_ring 2 29147 NULL
-+wusb_prf_256_29203 wusb_prf_256 7 29203 NULL
-+rds_iw_inc_copy_to_user_29214 rds_iw_inc_copy_to_user 3 29214 NULL
-+devm_ioremap_29235 devm_ioremap 3-2 29235 NULL nohasharray
-+squashfs_read_table_29235 squashfs_read_table 4 29235 &devm_ioremap_29235
-+recover_peb_29238 recover_peb 6-7 29238 NULL
-+security_context_to_sid_core_29248 security_context_to_sid_core 2 29248 NULL
-+prism2_set_genericelement_29277 prism2_set_genericelement 3 29277 NULL
-+sn9c102_read_29305 sn9c102_read 3 29305 NULL
-+__alloc_ei_netdev_29338 __alloc_ei_netdev 1 29338 NULL
-+l2cap_sock_setsockopt_old_29346 l2cap_sock_setsockopt_old 4 29346 NULL
-+cifs_user_write_29424 cifs_user_write 3 29424 NULL
-+mempool_create_29437 mempool_create 1 29437 NULL
-+arm_write_29476 arm_write 6 29476 NULL
-+btmrvl_pscmd_write_29504 btmrvl_pscmd_write 3 29504 NULL
-+idetape_queue_rw_tail_29562 idetape_queue_rw_tail 3 29562 NULL
-+lbs_lowsnr_read_29571 lbs_lowsnr_read 3 29571 NULL
-+sctp_make_abort_user_29654 sctp_make_abort_user 3 29654 NULL
-+br_send_bpdu_29669 br_send_bpdu 3 29669 NULL
-+new_lockspace_29674 new_lockspace 2 29674 NULL
-+sisusb_write_mem_bulk_29678 sisusb_write_mem_bulk 4 29678 NULL
-+sd_alloc_ctl_entry_29708 sd_alloc_ctl_entry 1 29708 NULL
-+emi62_writememory_29731 emi62_writememory 4 29731 NULL
-+cxio_hal_init_resource_29771 cxio_hal_init_resource 2-7-6 29771 NULL
-+ipv6_setsockopt_29871 ipv6_setsockopt 5 29871 NULL
-+node_write_29878 node_write 4 29878 NULL
-+check586_29914 check586 2 29914 NULL
-+irias_add_octseq_attrib_29983 irias_add_octseq_attrib 4 29983 NULL
-+acpi_video_bus_write_POST_30039 acpi_video_bus_write_POST 3 30039 NULL
-+scsi_vpd_inquiry_30040 scsi_vpd_inquiry 4 30040 NULL
-+proc_write_lcd_30077 proc_write_lcd 3 30077 NULL
-+snd_midi_channel_init_set_30092 snd_midi_channel_init_set 1 30092 NULL
-+recv_stream_30138 recv_stream 4 30138 NULL
-+mempool_create_page_pool_30189 mempool_create_page_pool 1 30189 NULL
-+usblp_ioctl_30203 usblp_ioctl 2 30203 NULL
-+snd_ac97_pcm_assign_30218 snd_ac97_pcm_assign 2 30218 NULL
-+dccp_manip_pkt_30229 dccp_manip_pkt 2 30229 NULL
-+rawv6_recvmsg_30265 rawv6_recvmsg 4 30265 NULL
-+isr_pci_pm_read_30271 isr_pci_pm_read 3 30271 NULL
-+compat_readv_30273 compat_readv 3 30273 NULL
-+sys_get_mempolicy_30379 sys_get_mempolicy 3 30379 NULL
-+enable_write_30456 enable_write 3 30456 NULL
-+urandom_read_30462 urandom_read 3 30462 NULL
-+write_head_30481 write_head 4 30481 NULL
-+adu_write_30487 adu_write 3 30487 NULL
-+disk_expand_part_tbl_30561 disk_expand_part_tbl 2 30561 NULL
-+blk_init_tags_30592 blk_init_tags 1 30592 NULL
-+sgl_map_user_pages_30610 sgl_map_user_pages 2 30610 NULL
-+compat_raw_setsockopt_30634 compat_raw_setsockopt 5 30634 NULL
-+twa_change_queue_depth_30648 twa_change_queue_depth 2 30648 NULL
-+mtd_do_readoob_30654 mtd_do_readoob 3 30654 NULL
-+agp_remap_30665 agp_remap 2 30665 NULL
-+dccp_setsockopt_ccid_30701 dccp_setsockopt_ccid 4 30701 NULL
-+lbs_debugfs_read_30721 lbs_debugfs_read 3 30721 NULL
-+fuse_conn_limit_write_30777 fuse_conn_limit_write 3 30777 NULL
-+ubi_write_30809 ubi_write 5-4 30809 NULL
-+smk_read_doi_30813 smk_read_doi 3 30813 NULL
-+sctp_setsockopt_auth_chunk_30843 sctp_setsockopt_auth_chunk 3 30843 NULL
-+pn_recvmsg_30887 pn_recvmsg 4 30887 NULL
-+fc_host_post_vendor_event_30903 fc_host_post_vendor_event 3 30903 NULL
-+iommu_map_mmio_space_30919 iommu_map_mmio_space 1 30919 NULL
-+sctp_setsockopt_rtoinfo_30941 sctp_setsockopt_rtoinfo 3 30941 NULL
-+mangle_sdp_packet_30986 mangle_sdp_packet 8 30986 NULL
-+acpi_thermal_write_cooling_mode_31053 acpi_thermal_write_cooling_mode 3 31053 NULL
-+compat_sys_mq_timedsend_31060 compat_sys_mq_timedsend 3 31060 NULL
-+lbs_failcount_read_31063 lbs_failcount_read 3 31063 NULL
-+sctp_setsockopt_context_31091 sctp_setsockopt_context 3 31091 NULL
-+compat_sys_get_mempolicy_31109 compat_sys_get_mempolicy 3 31109 NULL
-+depth_read_31112 depth_read 3 31112 NULL
-+kimage_normal_alloc_31140 kimage_normal_alloc 3 31140 NULL
-+w9966_v4l_read_31148 w9966_v4l_read 3 31148 NULL
-+ch_do_scsi_31171 ch_do_scsi 4 31171 NULL
-+acpi_ex_system_memory_space_handler_31192 acpi_ex_system_memory_space_handler 2 31192 NULL
-+atm_get_addr_31221 atm_get_addr 3 31221 NULL
-+intel_i810_alloc_by_type_31226 intel_i810_alloc_by_type 1 31226 NULL
-+tcp_recvmsg_31238 tcp_recvmsg 4 31238 NULL
-+alloc_ringbuf_31251 alloc_ringbuf 1 31251 NULL
-+uvc_simplify_fraction_31303 uvc_simplify_fraction 3 31303 NULL
-+sisusbcon_scroll_31315 sisusbcon_scroll 5-3-2 31315 NULL
-+command_file_write_31318 command_file_write 3 31318 NULL
-+xprt_rdma_allocate_31372 xprt_rdma_allocate 2 31372 NULL
-+trace_parser_get_init_31379 trace_parser_get_init 2 31379 NULL
-+key_ifindex_read_31411 key_ifindex_read 3 31411 NULL
-+mcs7830_set_reg_31413 mcs7830_set_reg 3 31413 NULL
-+do_fcntl_31468 do_fcntl 3 31468 NULL
-+stv680_read_31473 stv680_read 3 31473 NULL
-+rds_message_map_pages_31487 rds_message_map_pages 2 31487 NULL
-+__alloc_bootmem_31498 __alloc_bootmem 1 31498 NULL
-+hpsb_iso_recv_init_31535 hpsb_iso_recv_init 3 31535 NULL
-+hidraw_write_31536 hidraw_write 3 31536 NULL
-+osst_write_31581 osst_write 3 31581 NULL
-+iwl_dbgfs_ucode_tx_stats_read_31611 iwl_dbgfs_ucode_tx_stats_read 3 31611 NULL
-+__lgread_31668 __lgread 4 31668 NULL
-+audit_log_n_string_31705 audit_log_n_string 3 31705 NULL
-+sctp_make_asconf_ack_31726 sctp_make_asconf_ack 3 31726 NULL
-+snd_seq_device_new_31753 snd_seq_device_new 4 31753 NULL
-+ecryptfs_send_message_locked_31801 ecryptfs_send_message_locked 2 31801 NULL
-+isr_rx_procs_read_31804 isr_rx_procs_read 3 31804 NULL
-+sta_last_signal_read_31818 sta_last_signal_read 3 31818 NULL
-+kmem_alloc_31920 kmem_alloc 1 31920 NULL
-+iov_iter_copy_from_user_31942 iov_iter_copy_from_user 4 31942 NULL nohasharray
-+read_mem_31942 read_mem 3 31942 &iov_iter_copy_from_user_31942
-+copy_from_user_toio_31966 copy_from_user_toio 3 31966 NULL
-+sys_sched_setaffinity_32046 sys_sched_setaffinity 2 32046 NULL
-+proc_scsi_devinfo_write_32064 proc_scsi_devinfo_write 3 32064 NULL
-+alloc_tx_32143 alloc_tx 2 32143 NULL
-+ieee80211_if_read_force_unicast_rateidx_32147 ieee80211_if_read_force_unicast_rateidx 3 32147 NULL
-+venus_link_32165 venus_link 5 32165 NULL
-+ntfs_rl_realloc_nofail_32173 ntfs_rl_realloc_nofail 3 32173 NULL
-+wusb_ccm_mac_32199 wusb_ccm_mac 7 32199 NULL
-+csr1212_append_new_cache_32202 csr1212_append_new_cache 2 32202 NULL
-+lbs_lowrssi_read_32242 lbs_lowrssi_read 3 32242 NULL
-+l3_alloc_skb_32289 l3_alloc_skb 1 32289 NULL
-+vmalloc_user_32308 vmalloc_user 1 32308 NULL
-+dispatch_ioctl_32357 dispatch_ioctl 2 32357 NULL
-+sel_read_initcon_32362 sel_read_initcon 3 32362 NULL
-+send_mpa_reply_32372 send_mpa_reply 3 32372 NULL
-+usbtmc_read_32377 usbtmc_read 3 32377 NULL
-+xfs_iext_add_indirect_multi_32400 xfs_iext_add_indirect_multi 3 32400 NULL
-+cypress_buf_alloc_32417 cypress_buf_alloc 1 32417 NULL
-+hid_input_report_32458 hid_input_report 4 32458 NULL
-+ide_driver_proc_write_32493 ide_driver_proc_write 3 32493 NULL
-+ilo_read_32531 ilo_read 3 32531 NULL
-+ieee80211_if_read_estab_plinks_32533 ieee80211_if_read_estab_plinks 3 32533 NULL
-+format_devstat_counter_32550 format_devstat_counter 3 32550 NULL
-+aes_encrypt_fail_read_32562 aes_encrypt_fail_read 3 32562 NULL
-+read_file_beacon_32595 read_file_beacon 3 32595 NULL
-+sys_set_mempolicy_32608 sys_set_mempolicy 3 32608 NULL
-+irda_recvmsg_dgram_32631 irda_recvmsg_dgram 4 32631 NULL
-+generic_readlink_32654 generic_readlink 3 32654 NULL
-+drm_fb_helper_init_crtc_count_32666 drm_fb_helper_init_crtc_count 2-3 32666 NULL
-+move_addr_to_kernel_32673 move_addr_to_kernel 2 32673 NULL
-+stats_read_ul_32751 stats_read_ul 3 32751 NULL
-+sctp_tsnmap_grow_32784 sctp_tsnmap_grow 2 32784 NULL
-+new_tape_buffer_32866 new_tape_buffer 2 32866 NULL
-+sysctl_string_modpriv_32895 sysctl_string_modpriv 5 32895 NULL
-+compat_filldir_32999 compat_filldir 3 32999 NULL
-+stats_dot11RTSSuccessCount_read_33065 stats_dot11RTSSuccessCount_read 3 33065 NULL
-+sel_read_checkreqprot_33068 sel_read_checkreqprot 3 33068 NULL
-+ieee80211_fragment_33112 ieee80211_fragment 4 33112 NULL
-+write_node_33121 write_node 4 33121 NULL
-+fb_sys_write_33130 fb_sys_write 3 33130 NULL
-+CIFSSMBWrite_33131 CIFSSMBWrite 4 33131 NULL
-+nfs4_init_slot_table_33152 nfs4_init_slot_table 2 33152 NULL
-+tun_get_user_33178 tun_get_user 3 33178 NULL
-+dataflash_read_fact_otp_33204 dataflash_read_fact_otp 3-2 33204 NULL
-+pp_read_33210 pp_read 3 33210 NULL
-+cachefiles_cook_key_33274 cachefiles_cook_key 2 33274 NULL
-+mcs7830_get_reg_33308 mcs7830_get_reg 3 33308 NULL
-+joydev_ioctl_33343 joydev_ioctl 2 33343 NULL
-+create_xattr_datum_33356 create_xattr_datum 5 33356 NULL
-+sctp_ulpevent_new_33377 sctp_ulpevent_new 1 33377 NULL
-+ieee80211_if_read_dropped_frames_no_route_33383 ieee80211_if_read_dropped_frames_no_route 3 33383 NULL
-+sys_dup3_33421 sys_dup3 2 33421 NULL
-+create_entry_33479 create_entry 2 33479 NULL
-+ip_setsockopt_33487 ip_setsockopt 5 33487 NULL
-+res_counter_read_33499 res_counter_read 4 33499 NULL
-+fb_read_33506 fb_read 3 33506 NULL
-+ahash_setkey_unaligned_33521 ahash_setkey_unaligned 3 33521 NULL
-+scsi_execute_33596 scsi_execute 5 33596 NULL
-+sys_keyctl_33708 sys_keyctl 4 33708 NULL nohasharray
-+netlink_sendmsg_33708 netlink_sendmsg 4 33708 &sys_keyctl_33708
-+get_free_de_33714 get_free_de 2 33714 NULL
-+pvr2_stream_buffer_count_33719 pvr2_stream_buffer_count 2 33719 NULL
-+hashtab_create_33769 hashtab_create 3 33769 NULL
-+stats_transmitted_frame_count_read_33861 stats_transmitted_frame_count_read 3 33861 NULL
-+sel_read_avc_cache_threshold_33942 sel_read_avc_cache_threshold 3 33942 NULL
-+strip_change_mtu_33968 strip_change_mtu 2 33968 NULL
-+__ntfs_malloc_34022 __ntfs_malloc 1 34022 NULL
-+ppp_write_34034 ppp_write 3 34034 NULL
-+init_exception_table_34132 init_exception_table 2 34132 NULL
-+islpci_mgt_transmit_34133 islpci_mgt_transmit 5 34133 NULL
-+cxgb3i_ddp_make_gl_34150 cxgb3i_ddp_make_gl 1 34150 NULL
-+hpsb_make_readpacket_34181 hpsb_make_readpacket 4 34181 NULL
-+mtd_write_34207 mtd_write 3 34207 NULL
-+rngapi_reset_34366 rngapi_reset 3 34366 NULL nohasharray
-+p54_alloc_skb_34366 p54_alloc_skb 3 34366 &rngapi_reset_34366
-+reiserfs_resize_34377 reiserfs_resize 2 34377 NULL
-+av7110_vbi_write_34384 av7110_vbi_write 3 34384 NULL
-+usbvision_v4l2_read_34386 usbvision_v4l2_read 3 34386 NULL
-+ivtv_read_pos_34400 ivtv_read_pos 3 34400 NULL
-+sctp_make_heartbeat_ack_34411 sctp_make_heartbeat_ack 4 34411 NULL
-+sctp_make_abort_34459 sctp_make_abort 3 34459 NULL
-+i2o_parm_field_get_34477 i2o_parm_field_get 5 34477 NULL
-+tracing_stats_read_34537 tracing_stats_read 3 34537 NULL
-+hugetlbfs_read_actor_34547 hugetlbfs_read_actor 2-5-4 34547 NULL
-+velocity_rx_copy_34583 velocity_rx_copy 2 34583 NULL
-+init_send_hfcd_34586 init_send_hfcd 1 34586 NULL
-+proc_write_bluetooth_34589 proc_write_bluetooth 3 34589 NULL
-+cnic_alloc_dma_34641 cnic_alloc_dma 3 34641 NULL
-+isr_fiqs_read_34687 isr_fiqs_read 3 34687 NULL
-+hptiop_adjust_disk_queue_depth_34698 hptiop_adjust_disk_queue_depth 2 34698 NULL
-+ieee80211_if_read_num_sta_ps_34722 ieee80211_if_read_num_sta_ps 3 34722 NULL
-+reg_w_ixbuf_34736 reg_w_ixbuf 4 34736 NULL
-+sctp_make_datafrag_empty_34737 sctp_make_datafrag_empty 3 34737 NULL
-+solos_param_store_34755 solos_param_store 4 34755 NULL
-+__copy_in_user_34790 __copy_in_user 3 34790 NULL
-+tipc_log_resize_34803 tipc_log_resize 1 34803 NULL
-+b43_debugfs_write_34838 b43_debugfs_write 3 34838 NULL
-+acpi_system_write_wakeup_device_34853 acpi_system_write_wakeup_device 3 34853 NULL
-+arcmsr_adjust_disk_queue_depth_34916 arcmsr_adjust_disk_queue_depth 2 34916 NULL
-+skb_gro_header_slow_34958 skb_gro_header_slow 2 34958 NULL
-+init_copy_kstat_irqs_34985 init_copy_kstat_irqs 4 34985 NULL
-+l2cap_skbuff_fromiovec_35003 l2cap_skbuff_fromiovec 3-4 35003 NULL
-+sisusb_copy_memory_35016 sisusb_copy_memory 4 35016 NULL
-+coda_psdev_read_35029 coda_psdev_read 3 35029 NULL
-+btmrvl_gpiogap_write_35053 btmrvl_gpiogap_write 3 35053 NULL
-+store_ifalias_35088 store_ifalias 4 35088 NULL
-+capi_write_35104 capi_write 3 35104 NULL
-+ide_settings_proc_write_35110 ide_settings_proc_write 3 35110 NULL
-+iscsi_conn_setup_35159 iscsi_conn_setup 2 35159 NULL
-+ieee80211_if_read_bssid_35161 ieee80211_if_read_bssid 3 35161 NULL
-+unix_stream_recvmsg_35210 unix_stream_recvmsg 4 35210 NULL
-+set_fd_set_35249 set_fd_set 1 35249 NULL
-+pl2303_buf_alloc_35251 pl2303_buf_alloc 1 35251 NULL
-+ioapic_setup_resources_35255 ioapic_setup_resources 1 35255 NULL
-+irda_recvmsg_stream_35280 irda_recvmsg_stream 4 35280 NULL
-+isr_rx_rdys_read_35283 isr_rx_rdys_read 3 35283 NULL
-+tracing_read_pipe_35312 tracing_read_pipe 3 35312 NULL
-+sys_setsockopt_35320 sys_setsockopt 5 35320 NULL
-+stats_tx_handlers_queued_read_35325 stats_tx_handlers_queued_read 3 35325 NULL
-+fallback_on_nodma_alloc_35332 fallback_on_nodma_alloc 2 35332 NULL
-+compat_filldir64_35354 compat_filldir64 3 35354 NULL
-+async_setkey_35521 async_setkey 3 35521 NULL
-+rxpipe_tx_xfr_host_int_trig_rx_data_read_35538 rxpipe_tx_xfr_host_int_trig_rx_data_read 3 35538 NULL
-+kernel_readv_35617 kernel_readv 3 35617 NULL
-+spi_register_board_info_35651 spi_register_board_info 2 35651 NULL
-+request_lock_35670 request_lock 4 35670 NULL
-+compat_sys_kexec_load_35674 compat_sys_kexec_load 2 35674 NULL
-+dm_table_create_35687 dm_table_create 3 35687 NULL
-+rds_page_copy_user_35691 rds_page_copy_user 4 35691 NULL
-+pci_enable_sriov_35745 pci_enable_sriov 2 35745 NULL
-+iwl_dbgfs_disable_ht40_read_35761 iwl_dbgfs_disable_ht40_read 3 35761 NULL
-+udf_alloc_i_data_35786 udf_alloc_i_data 2 35786 NULL
-+ar9170_rx_copy_data_35787 ar9170_rx_copy_data 2 35787 NULL
-+store_fan1_input_35793 store_fan1_input 4 35793 NULL
-+zd_rfwritev_locked_35812 zd_rfwritev_locked 4 35812 NULL
-+mthca_buf_alloc_35861 mthca_buf_alloc 2 35861 NULL
-+uwb_rc_cmd_done_35892 uwb_rc_cmd_done 4 35892 NULL
-+mb_cache_create_35903 mb_cache_create 4-5 35903 NULL
-+igmpv3_newpack_35912 igmpv3_newpack 2 35912 NULL
-+kernel_setsockopt_35913 kernel_setsockopt 5 35913 NULL
-+dccp_listen_start_35918 dccp_listen_start 2 35918 NULL
-+put_cmsg_compat_35937 put_cmsg_compat 4 35937 NULL
-+acl_alloc_35979 acl_alloc 1 35979 NULL
-+console_store_36007 console_store 4 36007 NULL
-+sys_init_module_36047 sys_init_module 2 36047 NULL
-+stack_max_size_write_36068 stack_max_size_write 3 36068 NULL
-+vga_arb_write_36112 vga_arb_write 3 36112 NULL
-+vmalloc_exec_36132 vmalloc_exec 1 36132 NULL
-+b1_alloc_card_36155 b1_alloc_card 1 36155 NULL
-+snd_korg1212_copy_from_36169 snd_korg1212_copy_from 6 36169 NULL
-+atomic_stats_read_36228 atomic_stats_read 3 36228 NULL
-+compat_sys_mbind_36256 compat_sys_mbind 5 36256 NULL
-+sysctl_ipc_registered_data_36266 sysctl_ipc_registered_data 5 36266 NULL
-+usb_buffer_alloc_36276 usb_buffer_alloc 2 36276 NULL
-+codec_reg_read_file_36280 codec_reg_read_file 3 36280 NULL
-+fat_compat_ioctl_filldir_36328 fat_compat_ioctl_filldir 3 36328 NULL
-+jbd2_journal_init_revoke_table_36336 jbd2_journal_init_revoke_table 1 36336 NULL
-+vring_add_buf_36348 vring_add_buf 3-4 36348 NULL
-+v9fs_file_readn_36353 v9fs_file_readn 4 36353 NULL
-+mtd_do_writeoob_36373 mtd_do_writeoob 4 36373 NULL
-+vring_new_virtqueue_36374 vring_new_virtqueue 1 36374 NULL
-+afs_alloc_flat_call_36399 afs_alloc_flat_call 2-3 36399 NULL
-+sctp_tsnmap_init_36446 sctp_tsnmap_init 2 36446 NULL
-+edge_buf_alloc_36498 edge_buf_alloc 1 36498 NULL
-+__hwahc_op_set_ptk_36510 __hwahc_op_set_ptk 5 36510 NULL
-+ieee80211_if_read_fwded_frames_36520 ieee80211_if_read_fwded_frames 3 36520 NULL
-+cpu_type_read_36540 cpu_type_read 3 36540 NULL
-+mangle_epsv_packet_36571 mangle_epsv_packet 5 36571 NULL
-+ssb_bus_scan_36578 ssb_bus_scan 2 36578 NULL
-+put_cmsg_36589 put_cmsg 4 36589 NULL
-+pcnet32_realloc_rx_ring_36598 pcnet32_realloc_rx_ring 3 36598 NULL
-+fat_ioctl_filldir_36621 fat_ioctl_filldir 3 36621 NULL
-+osd_req_list_collection_objects_36664 osd_req_list_collection_objects 5 36664 NULL
-+iscsi_host_alloc_36671 iscsi_host_alloc 2 36671 NULL
-+snd_rawmidi_kernel_read1_36740 snd_rawmidi_kernel_read1 4 36740 NULL
-+ip4ip6_err_36772 ip4ip6_err 5 36772 NULL
-+proc_fault_inject_read_36802 proc_fault_inject_read 3 36802 NULL
-+hiddev_ioctl_36816 hiddev_ioctl 2 36816 NULL
-+keyctl_describe_key_36853 keyctl_describe_key 3 36853 NULL
-+svc_setsockopt_36876 svc_setsockopt 5 36876 NULL
-+ib_ucm_alloc_data_36885 ib_ucm_alloc_data 3 36885 NULL
-+selinux_inode_notifysecctx_36896 selinux_inode_notifysecctx 3 36896 NULL
-+write_leb_36957 write_leb 5 36957 NULL
-+setxattr_37006 setxattr 4 37006 NULL
-+ieee80211_if_read_drop_unencrypted_37053 ieee80211_if_read_drop_unencrypted 3 37053 NULL
-+parse_command_37079 parse_command 2 37079 NULL
-+vcc_recvmsg_37198 vcc_recvmsg 4 37198 NULL
-+__do_replace_37227 __do_replace 5 37227 NULL
-+c101_run_37279 c101_run 2 37279 NULL
-+srp_target_alloc_37288 srp_target_alloc 3 37288 NULL
-+jffs2_write_dirent_37311 jffs2_write_dirent 5 37311 NULL
-+scsi_mode_select_37330 scsi_mode_select 6 37330 NULL
-+rxrpc_server_sendmsg_37331 rxrpc_server_sendmsg 4 37331 NULL
-+sys_getxattr_37418 sys_getxattr 4 37418 NULL
-+hci_sock_sendmsg_37420 hci_sock_sendmsg 4 37420 NULL
-+acpi_os_allocate_zeroed_37422 acpi_os_allocate_zeroed 1 37422 NULL
-+gru_alloc_gts_37453 gru_alloc_gts 2-3 37453 NULL
-+iscsi_change_queue_depth_37480 iscsi_change_queue_depth 2 37480 NULL
-+kmem_realloc_37489 kmem_realloc 2 37489 NULL
-+vmalloc_32_user_37519 vmalloc_32_user 1 37519 NULL
-+alloc_fd_37637 alloc_fd 1 37637 NULL
-+tcp_dma_try_early_copy_37651 tcp_dma_try_early_copy 3 37651 NULL
-+bio_copy_user_iov_37660 bio_copy_user_iov 4 37660 NULL
-+rfcomm_sock_sendmsg_37661 rfcomm_sock_sendmsg 4 37661 NULL
-+ata_scsi_change_queue_depth_37702 ata_scsi_change_queue_depth 2 37702 NULL
-+tomoyo_alloc_37728 tomoyo_alloc 1 37728 NULL
-+read_enabled_file_bool_37744 read_enabled_file_bool 3 37744 NULL
-+ocfs2_control_cfu_37750 ocfs2_control_cfu 2 37750 NULL
-+ipath_cdev_init_37752 ipath_cdev_init 1 37752 NULL
-+dccp_setsockopt_cscov_37766 dccp_setsockopt_cscov 2 37766 NULL
-+smk_read_logging_37804 smk_read_logging 3 37804 NULL
-+o2hb_debug_read_37851 o2hb_debug_read 3 37851 NULL
-+xfs_dir2_block_to_sf_37868 xfs_dir2_block_to_sf 3 37868 NULL
-+sys_setxattr_37880 sys_setxattr 4 37880 NULL
-+dvb_net_sec_37884 dvb_net_sec 3 37884 NULL
-+pkt_alloc_packet_data_37928 pkt_alloc_packet_data 1 37928 NULL
-+ar9170_handle_mpdu_37956 ar9170_handle_mpdu 3 37956 NULL
-+visor_write_37975 visor_write 4 37975 NULL
-+vfs_readv_38011 vfs_readv 3 38011 NULL
-+store_wlan_38040 store_wlan 4 38040 NULL
-+nsm_create_handle_38060 nsm_create_handle 4 38060 NULL
-+alloc_ltalkdev_38071 alloc_ltalkdev 1 38071 NULL
-+request_key_auth_new_38092 request_key_auth_new 3 38092 NULL
-+proc_self_readlink_38094 proc_self_readlink 3 38094 NULL
-+ep0_read_38095 ep0_read 3 38095 NULL
-+snd_pcm_oss_write_38108 snd_pcm_oss_write 3 38108 NULL
-+__ntfs_copy_from_user_iovec_inatomic_38153 __ntfs_copy_from_user_iovec_inatomic 3-4 38153 NULL
-+cdev_add_38176 cdev_add 2-3 38176 NULL
-+rt2x00debug_write_rf_38195 rt2x00debug_write_rf 3 38195 NULL
-+get_ucode_user_38202 get_ucode_user 3 38202 NULL
-+osd_req_list_partition_collections_38223 osd_req_list_partition_collections 5 38223 NULL
-+inet_csk_listen_start_38233 inet_csk_listen_start 2 38233 NULL
-+ieee80211_if_read_auto_open_plinks_38268 ieee80211_if_read_auto_open_plinks 3 38268 NULL nohasharray
-+mthca_alloc_icm_table_38268 mthca_alloc_icm_table 3-4 38268 &ieee80211_if_read_auto_open_plinks_38268
-+zd_mac_rx_38296 zd_mac_rx 3 38296 NULL
-+isr_rx_headers_read_38325 isr_rx_headers_read 3 38325 NULL
-+sctp_sf_abort_violation_38380 sctp_sf_abort_violation 6 38380 NULL
-+dn_sendmsg_38390 dn_sendmsg 4 38390 NULL
-+iwm_wdev_alloc_38415 iwm_wdev_alloc 1 38415 NULL
-+ieee80211_if_read_dtim_count_38419 ieee80211_if_read_dtim_count 3 38419 NULL
-+pcnet32_realloc_tx_ring_38428 pcnet32_realloc_tx_ring 3 38428 NULL
-+pmcraid_copy_sglist_38431 pmcraid_copy_sglist 3 38431 NULL
-+write_int_38453 write_int 3 38453 NULL
-+event_rx_mismatch_read_38518 event_rx_mismatch_read 3 38518 NULL
-+irda_sendmsg_dgram_38563 irda_sendmsg_dgram 4 38563 NULL
-+snd_nm256_playback_copy_38567 snd_nm256_playback_copy 5 38567 NULL
-+cosa_net_setup_rx_38594 cosa_net_setup_rx 2 38594 NULL
-+icn_writecmd_38629 icn_writecmd 2 38629 NULL
-+audit_init_entry_38644 audit_init_entry 1 38644 NULL
-+mmc_send_cxd_data_38655 mmc_send_cxd_data 5 38655 NULL
-+iwl_dbgfs_thermal_throttling_read_38779 iwl_dbgfs_thermal_throttling_read 3 38779 NULL
-+snd_gus_dram_write_38784 snd_gus_dram_write 4 38784 NULL
-+gre_manip_pkt_38785 gre_manip_pkt 2 38785 NULL
-+dvb_demux_do_ioctl_38811 dvb_demux_do_ioctl 4 38811 NULL
-+ipv6_renew_option_38813 ipv6_renew_option 3 38813 NULL
-+sys_select_38827 sys_select 1 38827 NULL
-+compat_udp_setsockopt_38840 compat_udp_setsockopt 5 38840 NULL
-+interfaces_38859 interfaces 2 38859 NULL
-+OSDSetBlock_38986 OSDSetBlock 2-4 38986 NULL
-+get_nodes_39012 get_nodes 3 39012 NULL
-+xfs_iext_remove_39040 xfs_iext_remove 3 39040 NULL
-+wv_packet_read_39140 wv_packet_read 3 39140 NULL
-+alloc_ring_39151 alloc_ring 2-4 39151 NULL
-+proc_coredump_filter_read_39153 proc_coredump_filter_read 3 39153 NULL
-+ubi_more_update_data_39189 ubi_more_update_data 4 39189 NULL
-+ivtv_v4l2_write_39226 ivtv_v4l2_write 3 39226 NULL
-+r128_compat_ioctl_39250 r128_compat_ioctl 2 39250 NULL
-+__skb_cow_39254 __skb_cow 2 39254 NULL
-+expand_fdtable_39273 expand_fdtable 2 39273 NULL
-+stats_rx_handlers_drop_nullfunc_read_39294 stats_rx_handlers_drop_nullfunc_read 3 39294 NULL
-+__vmalloc_node_39308 __vmalloc_node 1 39308 NULL
-+dvb_dvr_ioctl_39317 dvb_dvr_ioctl 3 39317 NULL
-+__copy_from_user_nocache_39351 __copy_from_user_nocache 3 39351 NULL
-+alloc_agpphysmem_i8xx_39427 alloc_agpphysmem_i8xx 1 39427 NULL
-+sys_semop_39457 sys_semop 3 39457 NULL
-+setkey_unaligned_39474 setkey_unaligned 3 39474 NULL
-+jffs2_user_setxattr_39488 jffs2_user_setxattr 4 39488 NULL
-+pp_write_39554 pp_write 3 39554 NULL
-+ieee80211_if_read_fwded_mcast_39571 ieee80211_if_read_fwded_mcast 3 39571 NULL
-+handle_response_icmp_39574 handle_response_icmp 7 39574 NULL
-+find_rsb_39650 find_rsb 3 39650 NULL
-+snd_rme32_capture_copy_39653 snd_rme32_capture_copy 5 39653 NULL
-+prism2_info_hostscanresults_39657 prism2_info_hostscanresults 3 39657 NULL
-+v4l_stk_read_39672 v4l_stk_read 3 39672 NULL
-+ftrace_pid_write_39710 ftrace_pid_write 3 39710 NULL
-+tcp_write_xmit_39755 tcp_write_xmit 2 39755 NULL
-+dabusb_writemem_39764 dabusb_writemem 4 39764 NULL
-+acpi_fan_write_state_39818 acpi_fan_write_state 3 39818 NULL
-+sys_migrate_pages_39825 sys_migrate_pages 2 39825 NULL
-+beiscsi_process_async_pdu_39834 beiscsi_process_async_pdu 7 39834 NULL
-+spi_dv_device_echo_buffer_39846 spi_dv_device_echo_buffer 2-3 39846 NULL
-+pkt_add_39897 pkt_add 3 39897 NULL
-+aes_encrypt_interrupt_read_39919 aes_encrypt_interrupt_read 3 39919 NULL
-+fwnet_pd_new_39947 fwnet_pd_new 4 39947 NULL
-+tty_prepare_flip_string_39955 tty_prepare_flip_string 3 39955 NULL
-+tracing_clock_read_39975 tracing_clock_read 3 39975 NULL
-+broadsheetfb_write_39976 broadsheetfb_write 3 39976 NULL
-+mthca_array_init_39987 mthca_array_init 2 39987 NULL
-+ivtvfb_write_40023 ivtvfb_write 3 40023 NULL
-+sctp_setsockopt_delayed_ack_40129 sctp_setsockopt_delayed_ack 3 40129 NULL
-+iwch_alloc_fastreg_pbl_40153 iwch_alloc_fastreg_pbl 2 40153 NULL
-+pt_write_40159 pt_write 3 40159 NULL
-+ipr_alloc_ucode_buffer_40199 ipr_alloc_ucode_buffer 1 40199 NULL
-+allocate_probes_40204 allocate_probes 1 40204 NULL
-+osst_read_40237 osst_read 3 40237 NULL
-+rs_sta_dbgfs_scale_table_read_40262 rs_sta_dbgfs_scale_table_read 3 40262 NULL
-+reqsk_queue_alloc_40272 reqsk_queue_alloc 2 40272 NULL
-+rx_xfr_hint_trig_read_40283 rx_xfr_hint_trig_read 3 40283 NULL
-+ip6_ufo_append_data_40301 ip6_ufo_append_data 5-7-6 40301 NULL
-+ubi_io_write_data_40305 ubi_io_write_data 5 40305 NULL
-+mmio_read_40348 mmio_read 4 40348 NULL
-+event_rx_mem_empty_read_40363 event_rx_mem_empty_read 3 40363 NULL
-+fwnet_incoming_packet_40380 fwnet_incoming_packet 3 40380 NULL
-+sbp2util_notify_fetch_agent_40494 sbp2util_notify_fetch_agent 4 40494 NULL
-+ima_write_policy_40548 ima_write_policy 3 40548 NULL
-+skge_rx_get_40598 skge_rx_get 3 40598 NULL
-+sctp_manip_pkt_40620 sctp_manip_pkt 2 40620 NULL
-+__seq_open_private_40715 __seq_open_private 3 40715 NULL
-+xfs_iext_remove_direct_40744 xfs_iext_remove_direct 3 40744 NULL
-+pg_write_40766 pg_write 3 40766 NULL
-+ecryptfs_readlink_40775 ecryptfs_readlink 3 40775 NULL
-+netdev_alloc_skb_ip_align_40811 netdev_alloc_skb_ip_align 2 40811 NULL
-+ttm_bo_ioremap_40854 ttm_bo_ioremap 4-3-2 40854 NULL
-+v9fs_file_read_40858 v9fs_file_read 3 40858 NULL
-+waiters_read_40902 waiters_read 3 40902 NULL
-+isdn_add_channels_40905 isdn_add_channels 3 40905 NULL
-+vol_cdev_write_40915 vol_cdev_write 3 40915 NULL
-+intel_i830_alloc_by_type_40921 intel_i830_alloc_by_type 1 40921 NULL
-+snd_vx_create_40948 snd_vx_create 4 40948 NULL
-+rds_sendmsg_40976 rds_sendmsg 4 40976 NULL
-+econet_recvmsg_40978 econet_recvmsg 4 40978 NULL
-+_req_append_segment_41031 _req_append_segment 2 41031 NULL
-+mISDN_sock_sendmsg_41035 mISDN_sock_sendmsg 4 41035 NULL
-+i2400m_queue_work_41051 i2400m_queue_work 5 41051 NULL
-+cfg80211_inform_bss_frame_41078 cfg80211_inform_bss_frame 4 41078 NULL
-+f_audio_buffer_alloc_41110 f_audio_buffer_alloc 1 41110 NULL
-+oom_adjust_write_41116 oom_adjust_write 3 41116 NULL
-+dvb_ca_write_41171 dvb_ca_write 3 41171 NULL
-+xfs_readdir_41200 xfs_readdir 3 41200 NULL
-+tun_alloc_skb_41216 tun_alloc_skb 2-4-3 41216 NULL
-+ip_append_data_41234 ip_append_data 4-5 41234 NULL
-+hiddev_compat_ioctl_41255 hiddev_compat_ioctl 2 41255 NULL
-+alloc_context_41283 alloc_context 1 41283 NULL
-+user_update_41332 user_update 3 41332 NULL
-+twl_change_queue_depth_41342 twl_change_queue_depth 2 41342 NULL
-+kmp_init_41373 kmp_init 2 41373 NULL
-+isr_commands_read_41398 isr_commands_read 3 41398 NULL
-+sys_flistxattr_41407 sys_flistxattr 3 41407 NULL
-+xfs_iext_add_41422 xfs_iext_add 3 41422 NULL
-+isdn_ppp_fill_rq_41428 isdn_ppp_fill_rq 2 41428 NULL
-+lbs_rdrf_read_41431 lbs_rdrf_read 3 41431 NULL
-+ntfs_file_buffered_write_41442 ntfs_file_buffered_write 4-6 41442 NULL
-+pcpu_build_alloc_info_41443 pcpu_build_alloc_info 3 41443 NULL
-+wep_interrupt_read_41492 wep_interrupt_read 3 41492 NULL
-+hpfs_translate_name_41497 hpfs_translate_name 3 41497 NULL
-+mempool_create_kmalloc_pool_41650 mempool_create_kmalloc_pool 1 41650 NULL
-+squashfs_cache_init_41656 squashfs_cache_init 2 41656 NULL
-+rds_message_copy_from_user_41682 rds_message_copy_from_user 2 41682 NULL
-+ubi_leb_write_41691 ubi_leb_write 5-4 41691 NULL
-+bdx_tx_db_init_41719 bdx_tx_db_init 2 41719 NULL
-+sys_pwritev_41722 sys_pwritev 3 41722 NULL
-+fillonedir_41746 fillonedir 3 41746 NULL
-+sco_send_frame_41815 sco_send_frame 3 41815 NULL
-+do_ip_setsockopt_41852 do_ip_setsockopt 5 41852 NULL
-+keyctl_instantiate_key_41855 keyctl_instantiate_key 3 41855 NULL
-+get_packet_41914 get_packet 3 41914 NULL
-+get_fdb_entries_41916 get_fdb_entries 3 41916 NULL
-+iscsi_iser_recv_41948 iscsi_iser_recv 4 41948 NULL
-+cx24116_writeregN_41975 cx24116_writeregN 4 41975 NULL
-+lguest_map_42008 lguest_map 1-2 42008 NULL
-+pool_allocate_42012 pool_allocate 3 42012 NULL
-+acpi_ut_create_buffer_object_42030 acpi_ut_create_buffer_object 1 42030 NULL
-+__hwahc_op_set_gtk_42038 __hwahc_op_set_gtk 4 42038 NULL
-+irda_sendmsg_ultra_42047 irda_sendmsg_ultra 4 42047 NULL
-+jffs2_do_link_42048 jffs2_do_link 6 42048 NULL
-+scsi_execute_req_42088 scsi_execute_req 5 42088 NULL
-+submit_inquiry_42108 submit_inquiry 3 42108 NULL
-+sysfs_read_file_42113 sysfs_read_file 3 42113 NULL
-+store_gps_42118 store_gps 4 42118 NULL
-+oprofilefs_str_to_user_42182 oprofilefs_str_to_user 3 42182 NULL
-+btmrvl_hsmode_write_42252 btmrvl_hsmode_write 3 42252 NULL
-+zd_usb_rfwrite_42300 zd_usb_rfwrite 3 42300 NULL
-+sel_read_perm_42302 sel_read_perm 3 42302 NULL
-+sctp_setsockopt_del_key_42304 sctp_setsockopt_del_key 3 42304 NULL nohasharray
-+ulong_read_file_42304 ulong_read_file 3 42304 &sctp_setsockopt_del_key_42304
-+tracing_ctrl_write_42324 tracing_ctrl_write 3 42324 NULL nohasharray
-+hysdn_conf_read_42324 hysdn_conf_read 3 42324 &tracing_ctrl_write_42324
-+snd_pcm_plug_alloc_42339 snd_pcm_plug_alloc 2 42339 NULL
-+ide_raw_taskfile_42355 ide_raw_taskfile 4 42355 NULL
-+key_conf_keyidx_read_42443 key_conf_keyidx_read 3 42443 NULL
-+mwl8k_prepare_multicast_42499 mwl8k_prepare_multicast 2 42499 NULL
-+smk_write_netlbladdr_42525 smk_write_netlbladdr 3 42525 NULL
-+snd_emux_create_port_42533 snd_emux_create_port 3 42533 NULL
-+udp_recvmsg_42558 udp_recvmsg 4 42558 NULL
-+__pskb_pull_42602 __pskb_pull 2 42602 NULL
-+sys_move_pages_42626 sys_move_pages 2 42626 NULL
-+scsi_activate_tcq_42640 scsi_activate_tcq 2 42640 NULL
-+request_key_and_link_42693 request_key_and_link 4 42693 NULL
-+set_aoe_iflist_42737 set_aoe_iflist 2 42737 NULL
-+ax25_setsockopt_42740 ax25_setsockopt 5 42740 NULL
-+create_rsb_42744 create_rsb 3 42744 NULL
-+x25_recvmsg_42777 x25_recvmsg 4 42777 NULL
-+cryptd_hash_setkey_42781 cryptd_hash_setkey 3 42781 NULL
-+fw_device_op_compat_ioctl_42804 fw_device_op_compat_ioctl 2 42804 NULL
-+set_arg_42824 set_arg 3 42824 NULL
-+write_essid_42840 write_essid 3 42840 NULL
-+pskb_expand_head_42881 pskb_expand_head 2-3 42881 NULL
-+xpc_kmalloc_cacheline_aligned_42895 xpc_kmalloc_cacheline_aligned 1 42895 NULL
-+sctp_getsockopt_maxburst_42941 sctp_getsockopt_maxburst 2 42941 NULL
-+sys_sethostname_42962 sys_sethostname 2 42962 NULL
-+compat_udpv6_setsockopt_42981 compat_udpv6_setsockopt 5 42981 NULL
-+isr_rx_mem_overflow_read_43025 isr_rx_mem_overflow_read 3 43025 NULL
-+store_lssw_43035 store_lssw 4 43035 NULL nohasharray
-+wep_default_key_count_read_43035 wep_default_key_count_read 3 43035 &store_lssw_43035
-+tomoyo_read_43089 tomoyo_read 3 43089 NULL
-+teiup_create_43201 teiup_create 3 43201 NULL
-+uio_write_43202 uio_write 3 43202 NULL
-+iso_callback_43208 iso_callback 3 43208 NULL
-+acpi_system_debug_proc_write_43231 acpi_system_debug_proc_write 3 43231 NULL
-+vmemmap_alloc_block_43245 vmemmap_alloc_block 1 43245 NULL
-+evtchn_write_43278 evtchn_write 3 43278 NULL
-+store_ledd_43312 store_ledd 4 43312 NULL
-+perf_mmap_data_alloc_43335 perf_mmap_data_alloc 2 43335 NULL
-+xenfb_write_43412 xenfb_write 3 43412 NULL
-+__alloc_bootmem_low_43423 __alloc_bootmem_low 1 43423 NULL
-+usb_alloc_urb_43436 usb_alloc_urb 1 43436 NULL
-+qla2x00_change_queue_depth_43446 qla2x00_change_queue_depth 2 43446 NULL
-+recent_old_proc_write_43473 recent_old_proc_write 3 43473 NULL
-+dvb_net_ioctl_43516 dvb_net_ioctl 3 43516 NULL
-+do_readlink_43518 do_readlink 2 43518 NULL
-+dvb_ca_en50221_io_write_43533 dvb_ca_en50221_io_write 3 43533 NULL
-+cachefiles_daemon_write_43535 cachefiles_daemon_write 3 43535 NULL
-+ath_rx_init_43564 ath_rx_init 2 43564 NULL
-+acpi_video_device_write_brightness_43565 acpi_video_device_write_brightness 3 43565 NULL
-+rpc_malloc_43573 rpc_malloc 2 43573 NULL
-+proc_read_43614 proc_read 3 43614 NULL
-+dmam_declare_coherent_memory_43679 dmam_declare_coherent_memory 4-2 43679 NULL
-+hidp_send_ctrl_message_43702 hidp_send_ctrl_message 4 43702 NULL
-+smb_do_alloc_request_43708 smb_do_alloc_request 2 43708 NULL
-+snd_rme32_playback_copy_43732 snd_rme32_playback_copy 5 43732 NULL
-+fuse_conn_congestion_threshold_write_43736 fuse_conn_congestion_threshold_write 3 43736 NULL
-+gigaset_initcs_43753 gigaset_initcs 2 43753 NULL
-+sctp_setsockopt_active_key_43755 sctp_setsockopt_active_key 3 43755 NULL
-+store_cpufv_disabled_43809 store_cpufv_disabled 4 43809 NULL
-+hci_send_cmd_43810 hci_send_cmd 3 43810 NULL
-+cxio_init_resource_fifo_random_43814 cxio_init_resource_fifo_random 3 43814 NULL
-+ieee80211_alloc_hw_43829 ieee80211_alloc_hw 1 43829 NULL
-+p54_download_eeprom_43842 p54_download_eeprom 4 43842 NULL
-+read_flush_43851 read_flush 3 43851 NULL
-+prism2_sta_send_mgmt_43916 prism2_sta_send_mgmt 5 43916 NULL
-+stats_dot11RTSFailureCount_read_43948 stats_dot11RTSFailureCount_read 3 43948 NULL
-+bcm_recvmsg_43992 bcm_recvmsg 4 43992 NULL
-+write_flush_procfs_44011 write_flush_procfs 3 44011 NULL
-+tracing_set_trace_read_44122 tracing_set_trace_read 3 44122 NULL
-+mptscsih_change_queue_depth_44196 mptscsih_change_queue_depth 2 44196 NULL
-+srp_alloc_iu_44227 srp_alloc_iu 2 44227 NULL
-+scsi_track_queue_full_44239 scsi_track_queue_full 2 44239 NULL
-+enlarge_skb_44248 enlarge_skb 2 44248 NULL
-+dispatch_proc_write_44320 dispatch_proc_write 3 44320 NULL
-+blk_queue_init_tags_44355 blk_queue_init_tags 2 44355 NULL
-+ipx_recvmsg_44366 ipx_recvmsg 4 44366 NULL
-+rts_threshold_read_44384 rts_threshold_read 3 44384 NULL
-+aoedev_flush_44398 aoedev_flush 2 44398 NULL
-+nfs4_write_cached_acl_44402 nfs4_write_cached_acl 3 44402 NULL
-+osst_do_scsi_44410 osst_do_scsi 4 44410 NULL
-+ieee80211_if_read_dropped_frames_ttl_44500 ieee80211_if_read_dropped_frames_ttl 3 44500 NULL
-+iwl_dbgfs_sram_read_44505 iwl_dbgfs_sram_read 3 44505 NULL
-+get_vm_area_node_44507 get_vm_area_node 1 44507 NULL
-+spidev_write_44510 spidev_write 3 44510 NULL
-+sys_msgsnd_44537 sys_msgsnd 3 44537 NULL
-+snd_pcm_alloc_vmalloc_buffer_44595 snd_pcm_alloc_vmalloc_buffer 2 44595 NULL
-+stats_tx_handlers_drop_read_44654 stats_tx_handlers_drop_read 3 44654 NULL
-+alloc_ctrl_packet_44667 alloc_ctrl_packet 1 44667 NULL
-+mempool_create_node_44715 mempool_create_node 1 44715 NULL
-+_zd_iowrite32v_locked_44725 _zd_iowrite32v_locked 3 44725 NULL
-+clusterip_proc_write_44729 clusterip_proc_write 3 44729 NULL
-+key_tx_rx_count_read_44742 key_tx_rx_count_read 3 44742 NULL
-+sctp_setsockopt_44788 sctp_setsockopt 5 44788 NULL
-+rx_dropped_read_44799 rx_dropped_read 3 44799 NULL
-+sisusb_write_44834 sisusb_write 3 44834 NULL
-+sta_rx_fragments_read_44835 sta_rx_fragments_read 3 44835 NULL
-+do_tty_write_44896 do_tty_write 5 44896 NULL
-+_scsih_change_queue_depth_44902 _scsih_change_queue_depth 2 44902 NULL
-+vstusb_write_45021 vstusb_write 3 45021 NULL nohasharray
-+ptrace_writedata_45021 ptrace_writedata 4 45021 &vstusb_write_45021
-+vhci_get_user_45039 vhci_get_user 3 45039 NULL
-+sel_write_user_45060 sel_write_user 3 45060 NULL
-+snd_mixart_BA0_read_45069 snd_mixart_BA0_read 5-6 45069 NULL
-+usbdev_read_45114 usbdev_read 3 45114 NULL
-+send_to_tty_45141 send_to_tty 3 45141 NULL
-+device_write_45156 device_write 3 45156 NULL
-+snd_sb_csp_load_user_45190 snd_sb_csp_load_user 3 45190 NULL
-+add_child_45201 add_child 4 45201 NULL
-+spi_alloc_master_45223 spi_alloc_master 2 45223 NULL
-+ieee80211_if_read_peer_45233 ieee80211_if_read_peer 3 45233 NULL
-+event_enable_write_45238 event_enable_write 3 45238 NULL
-+snd_pcm_oss_sync1_45298 snd_pcm_oss_sync1 2 45298 NULL
-+copy_vm86_regs_from_user_45340 copy_vm86_regs_from_user 3 45340 NULL
-+sctp_getsockopt_adaptation_layer_45375 sctp_getsockopt_adaptation_layer 2 45375 NULL
-+stats_rx_handlers_drop_short_read_45391 stats_rx_handlers_drop_short_read 3 45391 NULL
-+lane2_associate_req_45398 lane2_associate_req 4 45398 NULL
-+tty_buffer_alloc_45437 tty_buffer_alloc 2 45437 NULL
-+stats_tx_handlers_drop_fragment_read_45464 stats_tx_handlers_drop_fragment_read 3 45464 NULL
-+tracing_read_dyn_info_45468 tracing_read_dyn_info 3 45468 NULL
-+sctp_getsockopt_active_key_45483 sctp_getsockopt_active_key 2 45483 NULL
-+kmem_zalloc_greedy_45507 kmem_zalloc_greedy 2-3 45507 NULL
-+hpsb_iso_common_init_45525 hpsb_iso_common_init 4 45525 NULL
-+sys_lgetxattr_45531 sys_lgetxattr 4 45531 NULL
-+cgroup_read_u64_45532 cgroup_read_u64 5 45532 NULL
-+copy_macs_45534 copy_macs 4 45534 NULL
-+stats_dot11ACKFailureCount_read_45558 stats_dot11ACKFailureCount_read 3 45558 NULL
-+venus_rmdir_45564 venus_rmdir 4 45564 NULL
-+ipath_create_cq_45586 ipath_create_cq 2 45586 NULL
-+rdma_set_ib_paths_45592 rdma_set_ib_paths 3 45592 NULL
-+audit_log_n_hex_45617 audit_log_n_hex 3 45617 NULL
-+saa_write_45625 saa_write 3 45625 NULL
-+node_read_45634 node_read 4 45634 NULL
-+acpi_thermal_write_polling_45660 acpi_thermal_write_polling 3 45660 NULL
-+compat_mpctl_ioctl_45671 compat_mpctl_ioctl 2 45671 NULL
-+dgram_sendmsg_45679 dgram_sendmsg 4 45679 NULL
-+smk_write_ambient_45691 smk_write_ambient 3 45691 NULL
-+unix_dgram_sendmsg_45699 unix_dgram_sendmsg 4 45699 NULL
-+sg_proc_write_adio_45704 sg_proc_write_adio 3 45704 NULL
-+dvb_ca_en50221_init_45718 dvb_ca_en50221_init 4 45718 NULL
-+snd_cs46xx_io_read_45734 snd_cs46xx_io_read 5-6 45734 NULL
-+rw_copy_check_uvector_45748 rw_copy_check_uvector 3 45748 NULL
-+alloc_ts_config_45775 alloc_ts_config 1 45775 NULL
-+raw_setsockopt_45800 raw_setsockopt 5 45800 NULL
-+lbs_rdbbp_read_45805 lbs_rdbbp_read 3 45805 NULL
-+NCR_700_change_queue_depth_45806 NCR_700_change_queue_depth 2 45806 NULL
-+pcpu_alloc_alloc_info_45813 pcpu_alloc_alloc_info 1-2 45813 NULL
-+isdn_write_45863 isdn_write 3 45863 NULL
-+get_rdac_req_45882 get_rdac_req 3 45882 NULL
-+iwl_dbgfs_led_read_45896 iwl_dbgfs_led_read 3 45896 NULL
-+alloc_mr_45935 alloc_mr 1 45935 NULL
-+ds_ioctl_45954 ds_ioctl 3 45954 NULL
-+rb_simple_read_45972 rb_simple_read 3 45972 NULL
-+ezusb_writememory_45976 ezusb_writememory 4 45976 NULL
-+sierra_setup_urb_46029 sierra_setup_urb 5 46029 NULL
-+get_free_entries_46030 get_free_entries 1 46030 NULL
-+sta_rx_bytes_read_46037 sta_rx_bytes_read 3 46037 NULL
-+fwnet_receive_packet_46054 fwnet_receive_packet 10 46054 NULL
-+dma_tx_errors_read_46060 dma_tx_errors_read 3 46060 NULL
-+sel_commit_bools_write_46077 sel_commit_bools_write 3 46077 NULL
-+ata_host_alloc_46094 ata_host_alloc 2 46094 NULL
-+mlx4_ib_alloc_fast_reg_page_list_46119 mlx4_ib_alloc_fast_reg_page_list 2 46119 NULL
-+__netlink_change_ngroups_46156 __netlink_change_ngroups 2 46156 NULL
-+vxge_os_dma_malloc_46184 vxge_os_dma_malloc 2 46184 NULL
-+dsp_write_46218 dsp_write 2 46218 NULL
-+sg_proc_write_dressz_46316 sg_proc_write_dressz 3 46316 NULL
-+__hwahc_dev_set_key_46328 __hwahc_dev_set_key 5 46328 NULL
-+csr1212_rom_cache_malloc_46339 csr1212_rom_cache_malloc 2 46339 NULL
-+iwl_dbgfs_chain_noise_read_46355 iwl_dbgfs_chain_noise_read 3 46355 NULL
-+smk_write_direct_46363 smk_write_direct 3 46363 NULL
-+fuse_file_aio_write_46399 fuse_file_aio_write 4 46399 NULL
-+cp210x_set_config_46447 cp210x_set_config 4 46447 NULL
-+filldir64_46469 filldir64 3 46469 NULL
-+mthca_alloc_cq_buf_46512 mthca_alloc_cq_buf 3 46512 NULL
-+bdx_rxdb_create_46525 bdx_rxdb_create 1 46525 NULL
-+arm_read_46556 arm_read 5 46556 NULL
-+serverworks_create_gatt_pages_46582 serverworks_create_gatt_pages 1 46582 NULL
-+_send_control_msg_46598 _send_control_msg 6 46598 NULL
-+request_key_async_with_auxdata_46624 request_key_async_with_auxdata 4 46624 NULL
-+ip_send_reply_46635 ip_send_reply 4 46635 NULL
-+av7110_ipack_init_46655 av7110_ipack_init 2 46655 NULL
-+alloc_data_packet_46698 alloc_data_packet 1 46698 NULL
-+smb_alloc_request_46798 smb_alloc_request 2 46798 NULL
-+xfs_iroot_realloc_46826 xfs_iroot_realloc 2 46826 NULL
-+dvb_dvr_do_ioctl_46839 dvb_dvr_do_ioctl 4 46839 NULL
-+rvmalloc_46873 rvmalloc 1 46873 NULL
-+stats_tx_handlers_drop_unencrypted_read_46898 stats_tx_handlers_drop_unencrypted_read 3 46898 NULL
-+tracing_ctrl_read_46922 tracing_ctrl_read 3 46922 NULL
-+fb_write_46924 fb_write 3 46924 NULL
-+btmrvl_curpsmode_read_46939 btmrvl_curpsmode_read 3 46939 NULL
-+__sctp_setsockopt_connectx_46949 __sctp_setsockopt_connectx 3 46949 NULL
-+sel_write_bool_46996 sel_write_bool 3 46996 NULL
-+ttm_bo_io_47000 ttm_bo_io 5 47000 NULL
-+blk_rq_map_kern_47004 blk_rq_map_kern 4 47004 NULL
-+scsi_deactivate_tcq_47086 scsi_deactivate_tcq 2 47086 NULL nohasharray
-+oti6858_buf_alloc_47086 oti6858_buf_alloc 1 47086 &scsi_deactivate_tcq_47086
-+mousedev_read_47123 mousedev_read 3 47123 NULL
-+ses_recv_diag_47143 ses_recv_diag 4 47143 NULL nohasharray
-+acpi_ut_initialize_buffer_47143 acpi_ut_initialize_buffer 2 47143 &ses_recv_diag_47143
-+rs_sta_dbgfs_rate_scale_data_read_47165 rs_sta_dbgfs_rate_scale_data_read 3 47165 NULL
-+svc_pool_map_alloc_arrays_47181 svc_pool_map_alloc_arrays 2 47181 NULL
-+ioremap_cache_47189 ioremap_cache 2-1 47189 NULL
-+module_alloc_update_bounds_47205 module_alloc_update_bounds 1 47205 NULL
-+options_write_47243 options_write 3 47243 NULL
-+tty_audit_log_47280 tty_audit_log 8 47280 NULL
-+tx_internal_desc_overflow_read_47300 tx_internal_desc_overflow_read 3 47300 NULL
-+ieee80211_if_read_dot11MeshHoldingTimeout_47356 ieee80211_if_read_dot11MeshHoldingTimeout 3 47356 NULL
-+__bio_map_kern_47379 __bio_map_kern 2-3 47379 NULL
-+trace_options_core_read_47390 trace_options_core_read 3 47390 NULL
-+pfkey_sendmsg_47394 pfkey_sendmsg 4 47394 NULL
-+stats_rx_expand_skb_head_read_47467 stats_rx_expand_skb_head_read 3 47467 NULL
-+newpart_47485 newpart 6 47485 NULL
-+core_sys_select_47494 core_sys_select 1 47494 NULL
-+alloc_arraycache_47505 alloc_arraycache 2 47505 NULL
-+unlink_simple_47506 unlink_simple 3 47506 NULL
-+cycx_setup_47562 cycx_setup 4 47562 NULL
-+mangle_packet_47567 mangle_packet 5-7 47567 NULL
-+read_ldt_47570 read_ldt 2 47570 NULL
-+pci_iomap_47575 pci_iomap 3 47575 NULL
-+uea_request_47613 uea_request 4 47613 NULL
-+cache_read_pipefs_47615 cache_read_pipefs 3 47615 NULL
-+sta_rx_duplicates_read_47633 sta_rx_duplicates_read 3 47633 NULL
-+packet_recvmsg_47700 packet_recvmsg 4 47700 NULL
-+bits_to_user_47733 bits_to_user 3-2 47733 NULL
-+wl1271_rx_handle_data_47827 wl1271_rx_handle_data 2 47827 NULL
-+vhci_read_47878 vhci_read 3 47878 NULL
-+timeout_read_47915 timeout_read 3 47915 NULL
-+stats_tx_handlers_drop_wep_read_47944 stats_tx_handlers_drop_wep_read 3 47944 NULL
-+mempool_resize_47983 mempool_resize 2 47983 NULL
-+ib_umad_write_47993 ib_umad_write 3 47993 NULL
-+drm_alloc_agp_48031 drm_alloc_agp 2 48031 NULL
-+pppoe_sendmsg_48039 pppoe_sendmsg 4 48039 NULL
-+wpan_phy_alloc_48056 wpan_phy_alloc 1 48056 NULL
-+posix_acl_alloc_48063 posix_acl_alloc 1 48063 NULL
-+mmc_alloc_host_48097 mmc_alloc_host 1 48097 NULL
-+skb_copy_datagram_const_iovec_48102 skb_copy_datagram_const_iovec 2-5-4 48102 NULL
-+snd_hdspm_capture_copy_48113 snd_hdspm_capture_copy 5 48113 NULL
-+__tcp_push_pending_frames_48148 __tcp_push_pending_frames 2 48148 NULL
-+isr_dma1_done_read_48159 isr_dma1_done_read 3 48159 NULL
-+nfsctl_transaction_read_48250 nfsctl_transaction_read 3 48250 NULL
-+cache_write_pipefs_48270 cache_write_pipefs 3 48270 NULL
-+usbvideo_v4l_read_48274 usbvideo_v4l_read 3 48274 NULL
-+trace_options_write_48275 trace_options_write 3 48275 NULL
-+pkt_bio_alloc_48284 pkt_bio_alloc 1 48284 NULL
-+mtd_read_48289 mtd_read 3 48289 NULL
-+skb_add_data_48363 skb_add_data 3 48363 NULL
-+iscsi_complete_pdu_48372 iscsi_complete_pdu 4 48372 NULL
-+map_addr_48373 map_addr 5 48373 NULL
-+lbs_debugfs_write_48413 lbs_debugfs_write 3 48413 NULL
-+pwr_tx_without_ps_read_48423 pwr_tx_without_ps_read 3 48423 NULL
-+send_control_msg_48498 send_control_msg 6 48498 NULL
-+diva_os_copy_to_user_48508 diva_os_copy_to_user 4 48508 NULL
-+bnx2i_send_nl_mesg_48562 bnx2i_send_nl_mesg 4 48562 NULL
-+xlog_recover_add_to_trans_48614 xlog_recover_add_to_trans 3 48614 NULL
-+do_ip_vs_set_ctl_48641 do_ip_vs_set_ctl 4 48641 NULL
-+proc_write_ledd_48644 proc_write_ledd 3 48644 NULL
-+aes_encrypt_packets_read_48666 aes_encrypt_packets_read 3 48666 NULL
-+sm501_create_subdev_48668 sm501_create_subdev 3-4 48668 NULL nohasharray
-+sys_setgroups_48668 sys_setgroups 1 48668 &sm501_create_subdev_48668
-+l2cap_build_cmd_48676 l2cap_build_cmd 4 48676 NULL
-+hysdn_log_write_48694 hysdn_log_write 3 48694 NULL
-+recv_msg_48709 recv_msg 4 48709 NULL
-+event_buffer_read_48772 event_buffer_read 3 48772 NULL
-+icmp_manip_pkt_48801 icmp_manip_pkt 2 48801 NULL
-+tcp_push_one_48816 tcp_push_one 2 48816 NULL
-+atomic_counters_read_48827 atomic_counters_read 3 48827 NULL
-+vc_do_resize_48842 vc_do_resize 3-4 48842 NULL
-+viafb_dvp1_proc_write_48864 viafb_dvp1_proc_write 3 48864 NULL
-+sys_setgroups16_48882 sys_setgroups16 1 48882 NULL
-+mac_drv_rx_init_48898 mac_drv_rx_init 2 48898 NULL nohasharray
-+joydev_handle_JSIOCSAXMAP_48898 joydev_handle_JSIOCSAXMAP 3 48898 &mac_drv_rx_init_48898
-+xdi_copy_to_user_48900 xdi_copy_to_user 4 48900 NULL
-+gdth_isa_probe_one_48925 gdth_isa_probe_one 1 48925 NULL
-+event_heart_beat_read_48961 event_heart_beat_read 3 48961 NULL
-+_alloc_set_attr_list_48991 _alloc_set_attr_list 4 48991 NULL
-+sel_write_enforce_48998 sel_write_enforce 3 48998 NULL
-+scsi_register_49094 scsi_register 2 49094 NULL
-+compat_do_readv_writev_49102 compat_do_readv_writev 4 49102 NULL
-+pt_read_49136 pt_read 3 49136 NULL
-+atyfb_setup_generic_49151 atyfb_setup_generic 3 49151 NULL
-+ipw_queue_tx_init_49161 ipw_queue_tx_init 3 49161 NULL
-+iwl_dbgfs_ucode_general_stats_read_49199 iwl_dbgfs_ucode_general_stats_read 3 49199 NULL
-+hpsb_write_49217 hpsb_write 6 49217 NULL
-+wm8400_i2c_write_49251 wm8400_i2c_write 3 49251 NULL
-+ieee80211_send_probe_req_49265 ieee80211_send_probe_req 6 49265 NULL
-+osd_req_add_get_attr_list_49278 osd_req_add_get_attr_list 3 49278 NULL
-+viafb_dfph_proc_write_49288 viafb_dfph_proc_write 3 49288 NULL
-+uio_read_49300 uio_read 3 49300 NULL
-+joydev_ioctl_common_49359 joydev_ioctl_common 2 49359 NULL
-+iscsi_alloc_session_49390 iscsi_alloc_session 3 49390 NULL
-+probe_kernel_read_49437 probe_kernel_read 3 49437 NULL
-+agp_3_5_isochronous_node_enable_49465 agp_3_5_isochronous_node_enable 3 49465 NULL
-+xfs_iformat_local_49472 xfs_iformat_local 4 49472 NULL
-+dn_nsp_do_disc_49474 dn_nsp_do_disc 2-6 49474 NULL
-+isr_decrypt_done_read_49490 isr_decrypt_done_read 3 49490 NULL
-+ntfs_malloc_nofs_49572 ntfs_malloc_nofs 1 49572 NULL
-+alloc_chunk_49575 alloc_chunk 1 49575 NULL
-+sctp_setsockopt_default_send_param_49578 sctp_setsockopt_default_send_param 3 49578 NULL nohasharray
-+hidraw_report_event_49578 hidraw_report_event 3 49578 &sctp_setsockopt_default_send_param_49578
-+isr_wakeups_read_49607 isr_wakeups_read 3 49607 NULL
-+heap_init_49617 heap_init 2 49617 NULL
-+smk_write_doi_49621 smk_write_doi 3 49621 NULL
-+sys_gethostname_49698 sys_gethostname 2 49698 NULL
-+hpsb_create_hostinfo_49717 hpsb_create_hostinfo 3 49717 NULL
-+sys_fsetxattr_49736 sys_fsetxattr 4 49736 NULL
-+zd_usb_iowrite16v_49744 zd_usb_iowrite16v 3 49744 NULL
-+key_conf_keylen_read_49758 key_conf_keylen_read 3 49758 NULL
-+fuse_conn_waiting_read_49762 fuse_conn_waiting_read 3 49762 NULL
-+hpsb_alloc_packet_49798 hpsb_alloc_packet 1 49798 NULL
-+nfs4_acl_new_49806 nfs4_acl_new 1 49806 NULL
-+ntfs_copy_from_user_iovec_49829 ntfs_copy_from_user_iovec 3-6 49829 NULL
-+sta_tx_fragments_read_49841 sta_tx_fragments_read 3 49841 NULL
-+sctp_setsockopt_bindx_49870 sctp_setsockopt_bindx 3 49870 NULL
-+__copy_from_user_inatomic_nocache_49921 __copy_from_user_inatomic_nocache 3 49921 NULL
-+__module_alloc_50004 __module_alloc 1 50004 NULL
-+isdn_read_50021 isdn_read 3 50021 NULL
-+alloc_ebda_hpc_50046 alloc_ebda_hpc 1-2 50046 NULL
-+fuse_conn_max_background_write_50061 fuse_conn_max_background_write 3 50061 NULL
-+dev_set_alias_50084 dev_set_alias 3 50084 NULL
-+tcp_mark_head_lost_50087 tcp_mark_head_lost 2 50087 NULL
-+sock_setsockopt_50088 sock_setsockopt 5 50088 NULL
-+csr1212_new_leaf_50112 csr1212_new_leaf 3 50112 NULL
-+copy_items_50140 copy_items 6 50140 NULL
-+aac_nark_ioremap_50163 aac_nark_ioremap 2 50163 NULL nohasharray
-+kmalloc_node_50163 kmalloc_node 1 50163 &aac_nark_ioremap_50163
-+ubi_resize_volume_50172 ubi_resize_volume 2 50172 NULL
-+ib_send_cm_drep_50186 ib_send_cm_drep 3 50186 NULL
-+l2cap_sock_setsockopt_50207 l2cap_sock_setsockopt 5 50207 NULL
-+ieee80211_skb_resize_50211 ieee80211_skb_resize 3 50211 NULL
-+mon_bin_compat_ioctl_50234 mon_bin_compat_ioctl 3 50234 NULL
-+sg_kmalloc_50240 sg_kmalloc 1 50240 NULL
-+afs_extract_data_50261 afs_extract_data 5 50261 NULL
-+rxrpc_setsockopt_50286 rxrpc_setsockopt 5 50286 NULL
-+tpm_read_50344 tpm_read 3 50344 NULL
-+isdn_ppp_read_50356 isdn_ppp_read 4 50356 NULL
-+sl_alloc_bufs_50380 sl_alloc_bufs 2 50380 NULL
-+iscsi_create_conn_50425 iscsi_create_conn 2 50425 NULL
-+pgctrl_write_50453 pgctrl_write 3 50453 NULL
-+cdrom_read_cdda_50478 cdrom_read_cdda 4 50478 NULL
-+pwr_rcvd_awake_beacons_read_50505 pwr_rcvd_awake_beacons_read 3 50505 NULL
-+fz_hash_alloc_50580 fz_hash_alloc 1 50580 NULL
-+pep_reply_50582 pep_reply 5 50582 NULL
-+sge_rx_50594 sge_rx 3 50594 NULL
-+simple_transaction_get_50633 simple_transaction_get 3 50633 NULL
-+ocfs2_readlink_50656 ocfs2_readlink 3 50656 NULL
-+sys_readv_50664 sys_readv 3 50664 NULL
-+btmrvl_psstate_read_50683 btmrvl_psstate_read 3 50683 NULL
-+skb_padto_50759 skb_padto 2 50759 NULL
-+udp_manip_pkt_50770 udp_manip_pkt 2 50770 NULL
-+bio_alloc_map_data_50782 bio_alloc_map_data 1-2 50782 NULL
-+tpm_write_50798 tpm_write 3 50798 NULL
-+write_flush_50803 write_flush 3 50803 NULL
-+dvb_play_50814 dvb_play 3 50814 NULL
-+sock_bindtodevice_50942 sock_bindtodevice 3 50942 NULL
-+mld_newpack_50950 mld_newpack 2 50950 NULL
-+sta_tx_packets_read_50955 sta_tx_packets_read 3 50955 NULL
-+cx18_copy_buf_to_user_50990 cx18_copy_buf_to_user 4 50990 NULL
-+timeout_write_50991 timeout_write 3 50991 NULL
-+proc_write_51003 proc_write 3 51003 NULL
-+lbs_dev_info_51023 lbs_dev_info 3 51023 NULL
-+fuse_conn_congestion_threshold_read_51028 fuse_conn_congestion_threshold_read 3 51028 NULL
-+dump_midi_51040 dump_midi 3 51040 NULL
-+do_arpt_set_ctl_51053 do_arpt_set_ctl 4 51053 NULL
-+wusb_prf_64_51065 wusb_prf_64 7 51065 NULL
-+jbd2_journal_init_revoke_51088 jbd2_journal_init_revoke 2 51088 NULL
-+read_file_wiphy_51103 read_file_wiphy 3 51103 NULL
-+iscsi_nop_out_rsp_51117 iscsi_nop_out_rsp 4 51117 NULL
-+xfs_trans_get_efd_51148 xfs_trans_get_efd 3 51148 NULL
-+proc_write_mled_51169 proc_write_mled 3 51169 NULL
-+create_snapshot_51195 create_snapshot 4 51195 NULL
-+sctp_getsockopt_fragment_interleave_51215 sctp_getsockopt_fragment_interleave 2 51215 NULL
-+drm_property_create_51239 drm_property_create 4 51239 NULL
-+st_read_51251 st_read 3 51251 NULL
-+compat_dccp_setsockopt_51263 compat_dccp_setsockopt 5 51263 NULL
-+dvb_audio_write_51275 dvb_audio_write 3 51275 NULL
-+ipwireless_network_packet_received_51277 ipwireless_network_packet_received 4 51277 NULL
-+alloc_hippi_dev_51320 alloc_hippi_dev 1 51320 NULL
-+alloc_smp_req_51337 alloc_smp_req 1 51337 NULL
-+radeon_kms_compat_ioctl_51371 radeon_kms_compat_ioctl 2 51371 NULL
-+tracing_trace_options_read_51405 tracing_trace_options_read 3 51405 NULL
-+blk_register_region_51424 blk_register_region 1-2 51424 NULL
-+econet_sendmsg_51430 econet_sendmsg 4 51430 NULL
-+____alloc_ei_netdev_51475 ____alloc_ei_netdev 1 51475 NULL
-+__alloc_eip_netdev_51549 __alloc_eip_netdev 1 51549 NULL
-+rfcomm_tty_write_51603 rfcomm_tty_write 3 51603 NULL
-+dns_resolve_server_name_to_ip_51632 dns_resolve_server_name_to_ip 1 51632 NULL
-+sctp_auth_create_key_51641 sctp_auth_create_key 1 51641 NULL
-+iscsi_create_session_51647 iscsi_create_session 3 51647 NULL
-+get_new_cssid_51665 get_new_cssid 2 51665 NULL
-+ps_upsd_utilization_read_51669 ps_upsd_utilization_read 3 51669 NULL
-+sctp_setsockopt_associnfo_51684 sctp_setsockopt_associnfo 3 51684 NULL
-+sel_write_access_51704 sel_write_access 3 51704 NULL
-+drm_compat_ioctl_51717 drm_compat_ioctl 2 51717 NULL
-+sg_read_oxfer_51724 sg_read_oxfer 3 51724 NULL
-+pwc_video_read_51735 pwc_video_read 3 51735 NULL
-+hid_parse_report_51737 hid_parse_report 3 51737 NULL
-+aac_change_queue_depth_51753 aac_change_queue_depth 2 51753 NULL
-+ioremap_prot_51764 ioremap_prot 2-1 51764 NULL
-+l2cap_create_iframe_pdu_51801 l2cap_create_iframe_pdu 3 51801 NULL
-+do_readv_writev_51849 do_readv_writev 4 51849 NULL
-+pointer_size_read_51863 pointer_size_read 3 51863 NULL
-+get_indirect_ea_51869 get_indirect_ea 4 51869 NULL
-+user_read_51881 user_read 3 51881 NULL
-+dn_def_dev_strategy_51973 dn_def_dev_strategy 5 51973 NULL
-+skb_copy_datagram_from_iovec_52014 skb_copy_datagram_from_iovec 2-5-4 52014 NULL
-+vxge_rx_alloc_52024 vxge_rx_alloc 3 52024 NULL
-+dma_rx_errors_read_52045 dma_rx_errors_read 3 52045 NULL
-+nsm_get_handle_52089 nsm_get_handle 4 52089 NULL
-+retry_count_read_52129 retry_count_read 3 52129 NULL
-+hysdn_conf_write_52145 hysdn_conf_write 3 52145 NULL
-+stats_rx_handlers_drop_passive_scan_read_52160 stats_rx_handlers_drop_passive_scan_read 3 52160 NULL
-+ieee80211_if_read_dot11MeshRetryTimeout_52168 ieee80211_if_read_dot11MeshRetryTimeout 3 52168 NULL
-+mga_compat_ioctl_52170 mga_compat_ioctl 2 52170 NULL
-+proc_pid_readlink_52186 proc_pid_readlink 3 52186 NULL
-+early_node_mem_52200 early_node_mem 4 52200 NULL
-+iscsi_if_send_reply_52219 iscsi_if_send_reply 7 52219 NULL
-+_alloc_mISDN_skb_52232 _alloc_mISDN_skb 3 52232 NULL
-+fl_create_52248 fl_create 4 52248 NULL
-+sisusbcon_do_font_op_52271 sisusbcon_do_font_op 9 52271 NULL
-+ntfs_rl_split_52328 ntfs_rl_split 2-4 52328 NULL
-+copy_entries_to_user_52367 copy_entries_to_user 1 52367 NULL
-+isdn_writebuf_stub_52383 isdn_writebuf_stub 4 52383 NULL
-+aer_inject_write_52399 aer_inject_write 3 52399 NULL
-+snd_hdspm_playback_copy_52405 snd_hdspm_playback_copy 5 52405 NULL
-+aac_rx_ioremap_52410 aac_rx_ioremap 2 52410 NULL
-+cgroup_file_write_52417 cgroup_file_write 3 52417 NULL
-+sctp_getsockopt_context_52490 sctp_getsockopt_context 2 52490 NULL
-+skb_cow_head_52495 skb_cow_head 2 52495 NULL
-+raw_recvmsg_52529 raw_recvmsg 4 52529 NULL
-+dccpprobe_read_52549 dccpprobe_read 3 52549 NULL
-+neigh_hash_alloc_52619 neigh_hash_alloc 1 52619 NULL
-+blkcipher_next_slow_52733 blkcipher_next_slow 4-3 52733 NULL
-+relay_alloc_page_array_52735 relay_alloc_page_array 1 52735 NULL
-+xfs_buf_get_noaddr_52736 xfs_buf_get_noaddr 1 52736 NULL
-+cafe_v4l_read_52766 cafe_v4l_read 3 52766 NULL
-+pwr_rcvd_beacons_read_52836 pwr_rcvd_beacons_read 3 52836 NULL
-+mon_bin_get_event_52863 mon_bin_get_event 4 52863 NULL
-+cache_read_procfs_52882 cache_read_procfs 3 52882 NULL
-+hpsb_node_write_52928 hpsb_node_write 4 52928 NULL
-+store_disp_52952 store_disp 4 52952 NULL
-+stats_tx_expand_skb_head_read_53188 stats_tx_expand_skb_head_read 3 53188 NULL
-+ipr_change_queue_depth_53263 ipr_change_queue_depth 2 53263 NULL
-+sctp_make_fwdtsn_53265 sctp_make_fwdtsn 3 53265 NULL
-+ftrace_profile_write_53327 ftrace_profile_write 3 53327 NULL
-+isr_cmd_cmplt_read_53439 isr_cmd_cmplt_read 3 53439 NULL
-+acpi_tb_parse_root_table_53455 acpi_tb_parse_root_table 1 53455 NULL
-+n2_run_53459 n2_run 3 53459 NULL
-+rds_tcp_data_recv_53476 rds_tcp_data_recv 3 53476 NULL
-+iowarrior_read_53483 iowarrior_read 3 53483 NULL
-+osd_req_write_kern_53486 osd_req_write_kern 5 53486 NULL
-+zc0301_read_53524 zc0301_read 3 53524 NULL
-+w9968cf_read_53582 w9968cf_read 3 53582 NULL nohasharray
-+set_registers_53582 set_registers 3 53582 &w9968cf_read_53582
-+pfkey_recvmsg_53604 pfkey_recvmsg 4 53604 NULL
-+___alloc_bootmem_nopanic_53626 ___alloc_bootmem_nopanic 1 53626 NULL
-+sctp_getsockopt_peer_addr_params_53645 sctp_getsockopt_peer_addr_params 2 53645 NULL
-+nr_sendmsg_53656 nr_sendmsg 4 53656 NULL
-+fuse_fill_write_pages_53682 fuse_fill_write_pages 4 53682 NULL
-+wdm_write_53735 wdm_write 3 53735 NULL
-+xfs_iext_insert_53815 xfs_iext_insert 3 53815 NULL
-+mempool_kmalloc_53831 mempool_kmalloc 2 53831 NULL
-+videobuf_pages_to_sg_53849 videobuf_pages_to_sg 2 53849 NULL
-+pms_read_53873 pms_read 3 53873 NULL
-+proc_file_read_53905 proc_file_read 3 53905 NULL
-+usb_serial_generic_write_53927 usb_serial_generic_write 4 53927 NULL
-+mthca_setup_cmd_doorbells_53954 mthca_setup_cmd_doorbells 2 53954 NULL
-+hpsb_node_read_53963 hpsb_node_read 4 53963 NULL
-+idetape_chrdev_write_53976 idetape_chrdev_write 3 53976 NULL
-+ipxrtr_route_packet_54036 ipxrtr_route_packet 4 54036 NULL
-+create_xattr_54106 create_xattr 5 54106 NULL
-+isr_host_acknowledges_read_54136 isr_host_acknowledges_read 3 54136 NULL
-+memcpy_toiovec_54166 memcpy_toiovec 3 54166 NULL
-+acpi_os_read_memory_54186 acpi_os_read_memory 3-1 54186 NULL
-+__register_chrdev_54223 __register_chrdev 2-3 54223 NULL
-+xfs_dir2_sf_addname_hard_54254 xfs_dir2_sf_addname_hard 3 54254 NULL
-+wusb_prf_54261 wusb_prf 7 54261 NULL nohasharray
-+audio_write_54261 audio_write 4 54261 &wusb_prf_54261
-+dlm_alloc_pagevec_54296 dlm_alloc_pagevec 1 54296 NULL
-+pn_raw_send_54330 pn_raw_send 2 54330 NULL
-+_osd_realloc_seg_54352 _osd_realloc_seg 3 54352 NULL
-+tcf_hash_create_54360 tcf_hash_create 4 54360 NULL
-+vfs_readlink_54368 vfs_readlink 3 54368 NULL
-+do_dccp_setsockopt_54377 do_dccp_setsockopt 5 54377 NULL
-+snd_pcm_oss_read2_54387 snd_pcm_oss_read2 3 54387 NULL
-+l2cap_create_basic_pdu_54508 l2cap_create_basic_pdu 3 54508 NULL
-+cgroup_write_X64_54514 cgroup_write_X64 5 54514 NULL
-+nfsd_vfs_write_54577 nfsd_vfs_write 6 54577 NULL
-+stats_frame_duplicate_count_read_54582 stats_frame_duplicate_count_read 3 54582 NULL nohasharray
-+fw_iso_buffer_init_54582 fw_iso_buffer_init 3 54582 &stats_frame_duplicate_count_read_54582
-+bio_kmalloc_54672 bio_kmalloc 2 54672 NULL
-+event_format_read_54674 event_format_read 3 54674 NULL
-+addtgt_54703 addtgt 3 54703 NULL
-+rfkill_fop_read_54711 rfkill_fop_read 3 54711 NULL
-+ocfs2_control_write_54737 ocfs2_control_write 3 54737 NULL
-+kzalloc_54740 kzalloc 1 54740 NULL
-+drm_mode_crtc_set_gamma_size_54742 drm_mode_crtc_set_gamma_size 2 54742 NULL
-+wep_iv_read_54744 wep_iv_read 3 54744 NULL
-+stats_multicast_transmitted_frame_count_read_54788 stats_multicast_transmitted_frame_count_read 3 54788 NULL
-+flexcop_device_kmalloc_54793 flexcop_device_kmalloc 1 54793 NULL
-+nfsd_write_54809 nfsd_write 6 54809 NULL
-+aes_decrypt_fail_read_54815 aes_decrypt_fail_read 3 54815 NULL
-+generic_perform_write_54832 generic_perform_write 3 54832 NULL
-+write_rio_54837 write_rio 3 54837 NULL
-+edac_mc_alloc_54846 edac_mc_alloc 1 54846 NULL
-+printer_read_54851 printer_read 3 54851 NULL
-+alloc_ep_req_54860 alloc_ep_req 2 54860 NULL
-+iscsi_pool_init_54913 iscsi_pool_init 2-4 54913 NULL
-+c4_add_card_54968 c4_add_card 3 54968 NULL
-+__proc_file_read_54978 __proc_file_read 3 54978 NULL
-+_queue_data_54983 _queue_data 4 54983 NULL
-+rds_ib_inc_copy_to_user_55007 rds_ib_inc_copy_to_user 3 55007 NULL
-+__netdev_alloc_skb_ip_align_55067 __netdev_alloc_skb_ip_align 2 55067 NULL
-+rxpipe_beacon_buffer_thres_host_int_trig_rx_data_read_55106 rxpipe_beacon_buffer_thres_host_int_trig_rx_data_read 3 55106 NULL
-+crypto_ahash_setkey_55134 crypto_ahash_setkey 3 55134 NULL
-+filldir_55137 filldir 3 55137 NULL
-+sysctl_data_55157 sysctl_data 5 55157 NULL
-+sel_write_relabel_55195 sel_write_relabel 3 55195 NULL
-+sta_tx_bytes_read_55197 sta_tx_bytes_read 3 55197 NULL
-+sched_feat_write_55202 sched_feat_write 3 55202 NULL
-+ht40allow_map_read_55209 ht40allow_map_read 3 55209 NULL nohasharray
-+isdn_net_ciscohdlck_alloc_skb_55209 isdn_net_ciscohdlck_alloc_skb 2 55209 &ht40allow_map_read_55209
-+do_raw_setsockopt_55215 do_raw_setsockopt 5 55215 NULL
-+sctp_abort_pkt_new_55218 sctp_abort_pkt_new 5 55218 NULL
-+memcpy_fromiovec_55247 memcpy_fromiovec 3 55247 NULL
-+ieee80211_if_read_capab_55294 ieee80211_if_read_capab 3 55294 NULL
-+__get_vm_area_node_55305 __get_vm_area_node 1 55305 NULL
-+ctrl_out_55321 ctrl_out 3 55321 NULL
-+sctp_datamsg_from_user_55342 sctp_datamsg_from_user 4 55342 NULL
-+acpi_system_read_event_55362 acpi_system_read_event 3 55362 NULL
-+alloc_skb_55439 alloc_skb 1 55439 NULL
-+__vxge_hw_channel_allocate_55462 __vxge_hw_channel_allocate 3 55462 NULL
-+rtl8169_try_rx_copy_55465 rtl8169_try_rx_copy 3 55465 NULL
-+rawv6_send_hdrinc_55480 rawv6_send_hdrinc 3 55480 NULL
-+i2o_pool_alloc_55485 i2o_pool_alloc 4 55485 NULL
-+selinux_setprocattr_55611 selinux_setprocattr 4 55611 NULL
-+pktgen_if_write_55628 pktgen_if_write 3 55628 NULL
-+dvb_dmxdev_set_buffer_size_55643 dvb_dmxdev_set_buffer_size 2 55643 NULL
-+read_oldmem_55658 read_oldmem 3 55658 NULL
-+get_info_55681 get_info 3 55681 NULL
-+esp_alloc_tmp_55741 esp_alloc_tmp 2 55741 NULL
-+uwb_rc_neh_grok_event_55799 uwb_rc_neh_grok_event 3 55799 NULL
-+sb16_copy_from_user_55836 sb16_copy_from_user 10-7-6 55836 NULL
-+hcd_alloc_coherent_55862 hcd_alloc_coherent 5 55862 NULL
-+handle_response_55951 handle_response 5 55951 NULL
-+simple_read_from_buffer_55957 simple_read_from_buffer 2-5 55957 NULL
-+ssb_bus_pcmciabus_register_56020 ssb_bus_pcmciabus_register 3 56020 NULL
-+tipc_cltr_prepare_routing_msg_56052 tipc_cltr_prepare_routing_msg 1 56052 NULL
-+dccp_sendmsg_56058 dccp_sendmsg 4 56058 NULL
-+dma_region_alloc_56079 dma_region_alloc 2 56079 NULL
-+rawv6_setsockopt_56165 rawv6_setsockopt 5 56165 NULL
-+cp210x_get_config_56229 cp210x_get_config 4 56229 NULL
-+do_ipt_set_ctl_56238 do_ipt_set_ctl 4 56238 NULL
-+fd_copyin_56247 fd_copyin 3 56247 NULL
-+dvb_aplay_56296 dvb_aplay 3 56296 NULL
-+btmrvl_hscfgcmd_read_56303 btmrvl_hscfgcmd_read 3 56303 NULL
-+journal_init_revoke_table_56331 journal_init_revoke_table 1 56331 NULL
-+snd_rawmidi_read_56337 snd_rawmidi_read 3 56337 NULL
-+ipv6_recv_error_56347 ipv6_recv_error 3 56347 NULL
-+vxge_os_dma_malloc_async_56348 vxge_os_dma_malloc_async 3 56348 NULL
-+iov_iter_copy_from_user_atomic_56368 iov_iter_copy_from_user_atomic 4 56368 NULL
-+dev_read_56369 dev_read 3 56369 NULL
-+ocfs2_control_read_56405 ocfs2_control_read 3 56405 NULL
-+__get_vm_area_caller_56416 __get_vm_area_caller 1 56416 NULL nohasharray
-+acpi_os_write_memory_56416 acpi_os_write_memory 3-1 56416 &__get_vm_area_caller_56416
-+store_msg_56417 store_msg 3 56417 NULL
-+pppol2tp_sendmsg_56420 pppol2tp_sendmsg 4 56420 NULL
-+gnttab_map_56439 gnttab_map 2 56439 NULL
-+stats_rx_handlers_drop_defrag_read_56448 stats_rx_handlers_drop_defrag_read 3 56448 NULL
-+cx231xx_init_isoc_56453 cx231xx_init_isoc 2-3 56453 NULL
-+osd_req_list_partition_objects_56464 osd_req_list_partition_objects 5 56464 NULL
-+cfg80211_connect_result_56515 cfg80211_connect_result 4-6 56515 NULL
-+l1oip_socket_recv_56537 l1oip_socket_recv 6 56537 NULL
-+ip_options_get_56538 ip_options_get 4 56538 NULL
-+sctp_getsockopt_sctp_status_56540 sctp_getsockopt_sctp_status 2 56540 NULL
-+rs_sta_dbgfs_stats_table_read_56573 rs_sta_dbgfs_stats_table_read 3 56573 NULL
-+replay_bud_56605 replay_bud 3 56605 NULL
-+event_filter_write_56609 event_filter_write 3 56609 NULL
-+dlm_dir_lookup_56662 dlm_dir_lookup 4 56662 NULL
-+user_dlm_lock_56667 user_dlm_lock 6 56667 NULL
-+snd_gus_dram_read_56686 snd_gus_dram_read 4 56686 NULL
-+alloc_etherdev_mq_56698 alloc_etherdev_mq 1-2 56698 NULL
-+dvb_ringbuffer_read_user_56702 dvb_ringbuffer_read_user 3 56702 NULL
-+sta_flags_read_56710 sta_flags_read 3 56710 NULL
-+ipv6_getsockopt_sticky_56711 ipv6_getsockopt_sticky 5 56711 NULL
-+__wa_xfer_setup_segs_56725 __wa_xfer_setup_segs 2 56725 NULL
-+drm_agp_bind_pages_56748 drm_agp_bind_pages 3 56748 NULL
-+ntfs_rl_realloc_56831 ntfs_rl_realloc 3 56831 NULL
-+snd_rawmidi_kernel_write1_56847 snd_rawmidi_kernel_write1 4 56847 NULL
-+efivar_create_sysfs_entry_56882 efivar_create_sysfs_entry 1 56882 NULL
-+journal_init_revoke_56933 journal_init_revoke 2 56933 NULL
-+dlm_allocate_rsb_56941 dlm_allocate_rsb 2 56941 NULL
-+vlsi_alloc_ring_57003 vlsi_alloc_ring 3-4 57003 NULL
-+iso_alloc_urb_57061 iso_alloc_urb 4 57061 NULL
-+pcmcia_replace_cis_57066 pcmcia_replace_cis 3 57066 NULL
-+sis190_try_rx_copy_57069 sis190_try_rx_copy 3 57069 NULL
-+tracing_set_trace_write_57096 tracing_set_trace_write 3 57096 NULL
-+sysfs_write_file_57116 sysfs_write_file 3 57116 NULL
-+csr1212_new_descriptor_leaf_57117 csr1212_new_descriptor_leaf 4 57117 NULL
-+ima_show_htable_value_57136 ima_show_htable_value 2 57136 NULL
-+stk_prepare_sio_buffers_57168 stk_prepare_sio_buffers 2 57168 NULL
-+rx_hw_stuck_read_57179 rx_hw_stuck_read 3 57179 NULL
-+oprofilefs_ulong_from_user_57251 oprofilefs_ulong_from_user 3 57251 NULL
-+ftdi_elan_write_57309 ftdi_elan_write 3 57309 NULL
-+check_mirror_57342 check_mirror 2-1 57342 NULL nohasharray
-+usblp_read_57342 usblp_read 3 57342 &check_mirror_57342
-+read_file_blob_57406 read_file_blob 3 57406 NULL
-+enclosure_register_57412 enclosure_register 3 57412 NULL
-+__mwl8k_cmd_mac_multicast_adr_57427 __mwl8k_cmd_mac_multicast_adr 2 57427 NULL
-+copy_to_user_fromio_57432 copy_to_user_fromio 3 57432 NULL
-+sys_pselect6_57449 sys_pselect6 1 57449 NULL
-+acpi_system_write_sleep_57456 acpi_system_write_sleep 3 57456 NULL
-+sisusb_clear_vram_57466 sisusb_clear_vram 2-3 57466 NULL
-+copy_in_user_57502 copy_in_user 3 57502 NULL
-+init_tag_map_57515 init_tag_map 3 57515 NULL
-+cmm_read_57520 cmm_read 3 57520 NULL
-+DoC_Probe_57534 DoC_Probe 1 57534 NULL
-+sk_stream_alloc_skb_57622 sk_stream_alloc_skb 2 57622 NULL
-+sisusbcon_putcs_57630 sisusbcon_putcs 3 57630 NULL
-+sys_mq_timedsend_57661 sys_mq_timedsend 3 57661 NULL
-+r3964_write_57662 r3964_write 4 57662 NULL
-+__lgwrite_57669 __lgwrite 4 57669 NULL
-+ip_vs_icmp_xmit_57701 ip_vs_icmp_xmit 4 57701 NULL
-+i2400m_rx_stats_read_57706 i2400m_rx_stats_read 3 57706 NULL
-+ip_nat_sip_expect_57732 ip_nat_sip_expect 6 57732 NULL
-+compat_sys_set_mempolicy_57742 compat_sys_set_mempolicy 3 57742 NULL nohasharray
-+pppol2tp_recvmsg_57742 pppol2tp_recvmsg 4 57742 &compat_sys_set_mempolicy_57742
-+ivtv_read_57796 ivtv_read 3 57796 NULL
-+copy_to_user_57835 copy_to_user 3 57835 NULL
-+flash_read_57843 flash_read 3 57843 NULL
-+xt_alloc_table_info_57903 xt_alloc_table_info 1 57903 NULL
-+emi26_writememory_57908 emi26_writememory 4 57908 NULL
-+sel_read_handle_unknown_57933 sel_read_handle_unknown 3 57933 NULL
-+rx_57944 rx 4 57944 NULL
-+key_algorithm_read_57946 key_algorithm_read 3 57946 NULL
-+hfc_empty_fifo_57972 hfc_empty_fifo 2 57972 NULL
-+tw_change_queue_depth_57980 tw_change_queue_depth 2 57980 NULL
-+rx_reset_counter_read_58001 rx_reset_counter_read 3 58001 NULL
-+iwl_dbgfs_ucode_rx_stats_read_58023 iwl_dbgfs_ucode_rx_stats_read 3 58023 NULL
-+se401_read_58074 se401_read 3 58074 NULL
-+cm4040_write_58079 cm4040_write 3 58079 NULL
-+rfcomm_wmalloc_58090 rfcomm_wmalloc 2 58090 NULL
-+savemem_58129 savemem 3 58129 NULL
-+ipv6_flowlabel_opt_58135 ipv6_flowlabel_opt 3 58135 NULL nohasharray
-+slhc_init_58135 slhc_init 1-2 58135 &ipv6_flowlabel_opt_58135
-+sctp_getsockopt_associnfo_58169 sctp_getsockopt_associnfo 2 58169 NULL
-+garmin_write_bulk_58191 garmin_write_bulk 3 58191 NULL
-+asix_write_cmd_58192 asix_write_cmd 5 58192 NULL
-+read_file_debug_58256 read_file_debug 3 58256 NULL
-+acpi_ds_build_internal_package_obj_58271 acpi_ds_build_internal_package_obj 3 58271 NULL
-+ieee80211_if_read_dot11MeshTTL_58307 ieee80211_if_read_dot11MeshTTL 3 58307 NULL
-+pcim_iomap_58334 pcim_iomap 3 58334 NULL
-+diva_init_dma_map_58336 diva_init_dma_map 3 58336 NULL
-+vmalloc_to_sg_58354 vmalloc_to_sg 2 58354 NULL
-+sctp_make_init_58401 sctp_make_init 4 58401 NULL
-+iscsi_offload_mesg_58425 iscsi_offload_mesg 5 58425 NULL
-+capabilities_read_58457 capabilities_read 3 58457 NULL
-+compat_do_ipt_set_ctl_58466 compat_do_ipt_set_ctl 4 58466 NULL
-+snd_rme96_capture_copy_58484 snd_rme96_capture_copy 5 58484 NULL
-+nfs_pagein_one_58502 nfs_pagein_one 3 58502 NULL
-+rndis_add_response_58544 rndis_add_response 2 58544 NULL
-+efx_tsoh_heap_alloc_58545 efx_tsoh_heap_alloc 2 58545 NULL
-+wep_decrypt_fail_read_58567 wep_decrypt_fail_read 3 58567 NULL
-+xlog_recover_add_to_cont_trans_58583 xlog_recover_add_to_cont_trans 3 58583 NULL
-+xip_file_read_58592 xip_file_read 3 58592 NULL
-+gdth_search_isa_58595 gdth_search_isa 1 58595 NULL
-+module_alloc_update_bounds_rx_58634 module_alloc_update_bounds_rx 1 58634 NULL
-+vmalloc_node_58700 vmalloc_node 1 58700 NULL
-+agp_allocate_memory_58761 agp_allocate_memory 2 58761 NULL
-+ep_read_58813 ep_read 3 58813 NULL
-+command_write_58841 command_write 3 58841 NULL
-+iwl_dbgfs_traffic_log_read_58870 iwl_dbgfs_traffic_log_read 3 58870 NULL
-+dabusb_read_58873 dabusb_read 3 58873 NULL
-+gs_alloc_req_58883 gs_alloc_req 2 58883 NULL
-+cs553x_init_one_58886 cs553x_init_one 3 58886 NULL
-+tsf_read_58892 tsf_read 3 58892 NULL
-+netpoll_send_udp_58955 netpoll_send_udp 3 58955 NULL
-+handle_rx_packet_58993 handle_rx_packet 3 58993 NULL
-+ep_write_59008 ep_write 3 59008 NULL
-+sta_tx_retry_count_read_59021 sta_tx_retry_count_read 3 59021 NULL
-+selinux_transaction_write_59038 selinux_transaction_write 3 59038 NULL
-+framebuffer_alloc_59145 framebuffer_alloc 1 59145 NULL
-+radeon_compat_ioctl_59150 radeon_compat_ioctl 2 59150 NULL
-+setup_window_59178 setup_window 7-5-4-2 59178 NULL
-+sctp_getsockopt_peeloff_59190 sctp_getsockopt_peeloff 2 59190 NULL
-+xfs_iext_realloc_indirect_59211 xfs_iext_realloc_indirect 2 59211 NULL
-+fast_rx_path_59214 fast_rx_path 3 59214 NULL
-+net_assign_generic_59217 net_assign_generic 2 59217 NULL
-+tty_prepare_flip_string_flags_59240 tty_prepare_flip_string_flags 4 59240 NULL
-+fd_copyout_59323 fd_copyout 3 59323 NULL
-+xfs_attrmulti_attr_set_59346 xfs_attrmulti_attr_set 4 59346 NULL
-+fc_frame_alloc_fill_59394 fc_frame_alloc_fill 2 59394 NULL
-+gem_alloc_skb_59411 gem_alloc_skb 1 59411 NULL
-+parse_table_59430 parse_table 6 59430 NULL
-+stats_rx_expand_skb_head2_read_59439 stats_rx_expand_skb_head2_read 3 59439 NULL
-+_xfs_buf_get_pages_59472 _xfs_buf_get_pages 2 59472 NULL
-+ib_copy_from_udata_59502 ib_copy_from_udata 3 59502 NULL
-+nfsd_cache_update_59574 nfsd_cache_update 3 59574 NULL
-+memdup_user_59590 memdup_user 2 59590 NULL
-+mtrr_write_59622 mtrr_write 3 59622 NULL
-+stats_received_fragment_count_read_59643 stats_received_fragment_count_read 3 59643 NULL
-+ubifs_setxattr_59650 ubifs_setxattr 4 59650 NULL nohasharray
-+hidraw_read_59650 hidraw_read 3 59650 &ubifs_setxattr_59650
-+alloc_dca_provider_59670 alloc_dca_provider 2 59670 NULL
-+sriov_enable_59689 sriov_enable 2 59689 NULL
-+mic_calc_failure_read_59700 mic_calc_failure_read 3 59700 NULL
-+prism2_info_scanresults_59729 prism2_info_scanresults 3 59729 NULL
-+sock_rmalloc_59740 sock_rmalloc 2 59740 NULL nohasharray
-+ieee80211_if_read_fwded_unicast_59740 ieee80211_if_read_fwded_unicast 3 59740 &sock_rmalloc_59740
-+long_retry_limit_read_59766 long_retry_limit_read 3 59766 NULL
-+venus_remove_59781 venus_remove 4 59781 NULL
-+xlog_do_recover_59789 xlog_do_recover 3 59789 NULL
-+ipw_write_59807 ipw_write 3 59807 NULL
-+scsi_init_shared_tag_map_59812 scsi_init_shared_tag_map 2 59812 NULL
-+ieee80211_if_read_dot11MeshHWMPmaxPREQretries_59829 ieee80211_if_read_dot11MeshHWMPmaxPREQretries 3 59829 NULL
-+tun_put_user_59849 tun_put_user 4 59849 NULL
-+pvr2_ioread_set_sync_key_59882 pvr2_ioread_set_sync_key 3 59882 NULL
-+l2cap_sock_recvmsg_59886 l2cap_sock_recvmsg 4 59886 NULL
-+dapm_widget_power_read_file_59950 dapm_widget_power_read_file 3 59950 NULL
-+usbvideo_register_59982 usbvideo_register 2 59982 NULL
-+osd_req_read_kern_59990 osd_req_read_kern 5 59990 NULL
-+mthca_init_cq_60011 mthca_init_cq 2 60011 NULL
-+register_device_60015 register_device 3-2 60015 NULL
-+osd_req_list_dev_partitions_60027 osd_req_list_dev_partitions 4 60027 NULL
-+sys_sched_getaffinity_60033 sys_sched_getaffinity 2 60033 NULL
-+do_ip6t_set_ctl_60040 do_ip6t_set_ctl 4 60040 NULL
-+pmcraid_change_queue_depth_60044 pmcraid_change_queue_depth 2 60044 NULL
-+load_module_60056 load_module 2 60056 NULL
-+compat_writev_60063 compat_writev 3 60063 NULL
-+rxrpc_kernel_send_data_60083 rxrpc_kernel_send_data 3 60083 NULL
-+ttm_bo_kmap_60118 ttm_bo_kmap 3 60118 NULL
-+init_state_60165 init_state 2 60165 NULL
-+sg_build_sgat_60179 sg_build_sgat 3 60179 NULL nohasharray
-+jffs2_alloc_full_dirent_60179 jffs2_alloc_full_dirent 1 60179 &sg_build_sgat_60179
-+ib_send_cm_mra_60202 ib_send_cm_mra 4 60202 NULL
-+compat_sys_fcntl64_60256 compat_sys_fcntl64 3 60256 NULL
-+printer_write_60276 printer_write 3 60276 NULL
-+__pskb_pull_tail_60287 __pskb_pull_tail 2 60287 NULL
-+dn_nsp_return_disc_60296 dn_nsp_return_disc 2 60296 NULL
-+do_xip_mapping_read_60297 do_xip_mapping_read 5 60297 NULL
-+stats_multiple_retry_count_read_60334 stats_multiple_retry_count_read 3 60334 NULL
-+dccp_setsockopt_60367 dccp_setsockopt 5 60367 NULL
-+mthca_alloc_resize_buf_60394 mthca_alloc_resize_buf 3 60394 NULL
-+simple_alloc_urb_60420 simple_alloc_urb 3 60420 NULL
-+excessive_retries_read_60425 excessive_retries_read 3 60425 NULL
-+tstats_write_60432 tstats_write 3 60432 NULL nohasharray
-+kmalloc_60432 kmalloc 1 60432 &tstats_write_60432
-+rx_data_60442 rx_data 4 60442 NULL
-+iwm_ntf_rx_packet_60452 iwm_ntf_rx_packet 3 60452 NULL
-+crypto_shash_setkey_60483 crypto_shash_setkey 3 60483 NULL
-+ip6_append_data_60501 ip6_append_data 4-5 60501 NULL
-+ath_tx_init_60515 ath_tx_init 2 60515 NULL
-+hysdn_sched_rx_60533 hysdn_sched_rx 3 60533 NULL
-+tracing_entries_write_60563 tracing_entries_write 3 60563 NULL
-+cifs_partialpagewrite_60612 cifs_partialpagewrite 2-3 60612 NULL
-+acl_alloc_stack_init_60630 acl_alloc_stack_init 1 60630 NULL
-+ubifs_recover_leb_60639 ubifs_recover_leb 3 60639 NULL
-+ieee80211_if_read_dot11MeshConfirmTimeout_60670 ieee80211_if_read_dot11MeshConfirmTimeout 3 60670 NULL
-+ip_nat_sdp_media_60740 ip_nat_sdp_media 7 60740 NULL
-+sel_write_checkreqprot_60774 sel_write_checkreqprot 3 60774 NULL
-+opticon_write_60775 opticon_write 4 60775 NULL
-+acl_alloc_num_60778 acl_alloc_num 1-2 60778 NULL
-+pwr_tx_with_ps_read_60851 pwr_tx_with_ps_read 3 60851 NULL
-+ieee80211_send_auth_60865 ieee80211_send_auth 5 60865 NULL
-+mgt_set_varlen_60916 mgt_set_varlen 4 60916 NULL
-+sctp_getsockopt_partial_delivery_point_60952 sctp_getsockopt_partial_delivery_point 2 60952 NULL
-+symtab_init_61050 symtab_init 2 61050 NULL
-+wl1251_hw_scan_61137 wl1251_hw_scan 3 61137 NULL nohasharray
-+squashfs_read_fragment_index_table_61137 squashfs_read_fragment_index_table 3 61137 &wl1251_hw_scan_61137
-+afs_proc_cells_write_61139 afs_proc_cells_write 3 61139 NULL
-+__vmalloc_61168 __vmalloc 1 61168 NULL
-+event_oom_late_read_61175 event_oom_late_read 3 61175 NULL
-+sys_lsetxattr_61177 sys_lsetxattr 4 61177 NULL
-+smk_read_ambient_61220 smk_read_ambient 3 61220 NULL
-+ubifs_leb_write_61226 ubifs_leb_write 5-4 61226 NULL
-+sys_add_key_61288 sys_add_key 4 61288 NULL
-+platform_device_register_simple_61290 platform_device_register_simple 4 61290 NULL
-+st5481_setup_isocpipes_61340 st5481_setup_isocpipes 6-4 61340 NULL
-+acpi_video_device_write_state_61342 acpi_video_device_write_state 3 61342 NULL
-+change_xattr_61390 change_xattr 5 61390 NULL
-+system_enable_write_61396 system_enable_write 3 61396 NULL
-+unix_stream_sendmsg_61455 unix_stream_sendmsg 4 61455 NULL
-+trace_options_core_write_61551 trace_options_core_write 3 61551 NULL
-+seq_open_private_61589 seq_open_private 3 61589 NULL
-+__get_vm_area_61599 __get_vm_area 1 61599 NULL
-+netlink_recvmsg_61600 netlink_recvmsg 4 61600 NULL
-+configfs_write_file_61621 configfs_write_file 3 61621 NULL
-+ieee80211_rx_bss_info_61630 ieee80211_rx_bss_info 3 61630 NULL
-+i2o_parm_table_get_61635 i2o_parm_table_get 6 61635 NULL
-+resize_stripes_61650 resize_stripes 2 61650 NULL
-+hpsb_make_writepacket_61656 hpsb_make_writepacket 5 61656 NULL
-+filter_read_61692 filter_read 3 61692 NULL
-+fragmentation_threshold_read_61718 fragmentation_threshold_read 3 61718 NULL
-+read_file_interrupt_61742 read_file_interrupt 3 61742 NULL
-+hdpvr_i2c_write_61816 hdpvr_i2c_write 4 61816 NULL
-+clear_refs_write_61904 clear_refs_write 3 61904 NULL
-+au0828_init_isoc_61917 au0828_init_isoc 2-3 61917 NULL
-+sctp_sendmsg_61919 sctp_sendmsg 4 61919 NULL
-+send_bulk_static_data_61932 send_bulk_static_data 3 61932 NULL
-+jffs2_do_unlink_62020 jffs2_do_unlink 4 62020 NULL
-+sctp_getsockopt_rtoinfo_62027 sctp_getsockopt_rtoinfo 2 62027 NULL
-+pmcraid_build_passthrough_ioadls_62034 pmcraid_build_passthrough_ioadls 2 62034 NULL
-+proc_fdinfo_read_62043 proc_fdinfo_read 3 62043 NULL
-+ppp_tx_cp_62044 ppp_tx_cp 5 62044 NULL
-+sctp_user_addto_chunk_62047 sctp_user_addto_chunk 2-3 62047 NULL
-+do_pselect_62061 do_pselect 1 62061 NULL
-+pcpu_alloc_bootmem_62074 pcpu_alloc_bootmem 2 62074 NULL
-+tracing_mark_write_62143 tracing_mark_write 3 62143 NULL
-+alloc_upcall_62186 alloc_upcall 2 62186 NULL
-+sock_kmalloc_62205 sock_kmalloc 2 62205 NULL
-+send_control_msg_62261 send_control_msg 5 62261 NULL
-+sta_last_qual_read_62297 sta_last_qual_read 3 62297 NULL
-+subsystem_filter_read_62310 subsystem_filter_read 3 62310 NULL
-+udf_sb_alloc_partition_maps_62313 udf_sb_alloc_partition_maps 2 62313 NULL
-+hfcpci_empty_bfifo_62323 hfcpci_empty_bfifo 4 62323 NULL
-+ccid3_hc_rx_getsockopt_62331 ccid3_hc_rx_getsockopt 3 62331 NULL
-+flash_write_62354 flash_write 3 62354 NULL
-+udplite_manip_pkt_62433 udplite_manip_pkt 2 62433 NULL
-+netdev_alloc_skb_62437 netdev_alloc_skb 2 62437 NULL
-+sta_last_noise_read_62466 sta_last_noise_read 3 62466 NULL
-+sysprof_sample_write_62489 sysprof_sample_write 3 62489 NULL
-+mlx4_en_create_rx_ring_62498 mlx4_en_create_rx_ring 3 62498 NULL
-+pep_sendmsg_62524 pep_sendmsg 4 62524 NULL
-+store_pwm1_62529 store_pwm1 4 62529 NULL
-+sco_sock_sendmsg_62542 sco_sock_sendmsg 4 62542 NULL
-+xfrm_user_policy_62573 xfrm_user_policy 4 62573 NULL
-+prism2_send_mgmt_62605 prism2_send_mgmt 4 62605 NULL nohasharray
-+nfsd_vfs_read_62605 nfsd_vfs_read 6 62605 &prism2_send_mgmt_62605
-+lpfc_sli4_queue_alloc_62646 lpfc_sli4_queue_alloc 3 62646 NULL
-+write_62671 write 3 62671 NULL
-+printer_req_alloc_62687 printer_req_alloc 2 62687 NULL nohasharray
-+iwl_dbgfs_rx_statistics_read_62687 iwl_dbgfs_rx_statistics_read 3 62687 &printer_req_alloc_62687
-+ioremap_wc_62695 ioremap_wc 2-1 62695 NULL
-+bioset_integrity_create_62708 bioset_integrity_create 2 62708 NULL
-+key_replays_read_62746 key_replays_read 3 62746 NULL
-+ax25_sendmsg_62770 ax25_sendmsg 4 62770 NULL
-+rx_fcs_err_read_62844 rx_fcs_err_read 3 62844 NULL
-+nfs_writedata_alloc_62868 nfs_writedata_alloc 1 62868 NULL
-+aoechr_write_62883 aoechr_write 3 62883 NULL
-+resize_info_buffer_62889 resize_info_buffer 2 62889 NULL
-+if_spi_host_to_card_62890 if_spi_host_to_card 4 62890 NULL
-+mempool_create_slab_pool_62907 mempool_create_slab_pool 1 62907 NULL
-+getdqbuf_62908 getdqbuf 1 62908 NULL
-+agp_create_user_memory_62955 agp_create_user_memory 1 62955 NULL
-+get_skb_63008 get_skb 2 63008 NULL
-+scsi_host_alloc_63041 scsi_host_alloc 2 63041 NULL
-+sctp_getsockopt_default_send_param_63056 sctp_getsockopt_default_send_param 2 63056 NULL
-+unlink1_63059 unlink1 3 63059 NULL
-+iwl_dbgfs_sensitivity_read_63116 iwl_dbgfs_sensitivity_read 3 63116 NULL
-+ib_send_cm_rtu_63138 ib_send_cm_rtu 3 63138 NULL
-+module_alloc_update_bounds_rw_63233 module_alloc_update_bounds_rw 1 63233 NULL
-+tcp_collapse_63294 tcp_collapse 5-6 63294 NULL
-+isdn_ppp_ccp_xmit_reset_63297 isdn_ppp_ccp_xmit_reset 6 63297 NULL
-+dns_resolver_instantiate_63314 dns_resolver_instantiate 3 63314 NULL
-+proc_info_read_63344 proc_info_read 3 63344 NULL
-+ps_upsd_max_sptime_read_63362 ps_upsd_max_sptime_read 3 63362 NULL
-+iser_rcv_completion_63364 iser_rcv_completion 2 63364 NULL
-+idmouse_read_63374 idmouse_read 3 63374 NULL
-+edac_pci_alloc_ctl_info_63388 edac_pci_alloc_ctl_info 1 63388 NULL
-+rxpipe_missed_beacon_host_int_trig_rx_data_read_63405 rxpipe_missed_beacon_host_int_trig_rx_data_read 3 63405 NULL
-+fib_hash_alloc_63412 fib_hash_alloc 1 63412 NULL
-+noack_read_63419 noack_read 3 63419 NULL
-+l2cap_sock_sendmsg_63427 l2cap_sock_sendmsg 4 63427 NULL
-+nfsd_symlink_63442 nfsd_symlink 6 63442 NULL
-+snd_info_entry_write_63474 snd_info_entry_write 3 63474 NULL
-+read_kcore_63488 read_kcore 3 63488 NULL
-+strategy_allowed_congestion_control_63497 strategy_allowed_congestion_control 5 63497 NULL
-+ubi_more_leb_change_data_63534 ubi_more_leb_change_data 4 63534 NULL
-+append_to_buffer_63550 append_to_buffer 3 63550 NULL
-+kvm_write_guest_page_63555 kvm_write_guest_page 5 63555 NULL
-+module_alloc_63630 module_alloc 1 63630 NULL
-+ntfs_malloc_nofs_nofail_63631 ntfs_malloc_nofs_nofail 1 63631 NULL
-+proc_loginuid_write_63648 proc_loginuid_write 3 63648 NULL
-+hidraw_ioctl_63658 hidraw_ioctl 2 63658 NULL
-+selinux_secctx_to_secid_63744 selinux_secctx_to_secid 2 63744 NULL
-+snd_pcm_oss_read1_63771 snd_pcm_oss_read1 3 63771 NULL
-+snd_opl4_mem_proc_read_63774 snd_opl4_mem_proc_read 5-6 63774 NULL
-+copy_nodes_to_user_63807 copy_nodes_to_user 2 63807 NULL
-+sel_write_load_63830 sel_write_load 3 63830 NULL
-+proc_pid_attr_write_63845 proc_pid_attr_write 3 63845 NULL
-+divas_write_63901 divas_write 3 63901 NULL
-+uvc_alloc_urb_buffers_63922 uvc_alloc_urb_buffers 3-2 63922 NULL
-+afs_send_simple_reply_63940 afs_send_simple_reply 3 63940 NULL
-+diva_xdi_write_63975 diva_xdi_write 4 63975 NULL
-+kmemdup_64015 kmemdup 2 64015 NULL
-+frequency_read_64031 frequency_read 3 64031 NULL
-+sta_wep_weak_iv_count_read_64069 sta_wep_weak_iv_count_read 3 64069 NULL
-+sl_realloc_bufs_64086 sl_realloc_bufs 2 64086 NULL
-+lbs_highrssi_read_64089 lbs_highrssi_read 3 64089 NULL
-+uea_idma_write_64139 uea_idma_write 3 64139 NULL
-+event_id_read_64288 event_id_read 3 64288 NULL nohasharray
-+xfs_dir_cilookup_result_64288 xfs_dir_cilookup_result 3 64288 &event_id_read_64288
-+sisusbcon_clear_64329 sisusbcon_clear 3-5-4 64329 NULL
-+usbtmc_write_64340 usbtmc_write 3 64340 NULL
-+do_write_orph_node_64343 do_write_orph_node 2 64343 NULL
-+llc_alloc_frame_64366 llc_alloc_frame 4 64366 NULL
-+ieee80211_if_read_max_ratectrl_rateidx_64369 ieee80211_if_read_max_ratectrl_rateidx 3 64369 NULL
-+ilo_write_64378 ilo_write 3 64378 NULL
-+pidlist_allocate_64404 pidlist_allocate 1 64404 NULL
-+rx_hdr_overflow_read_64407 rx_hdr_overflow_read 3 64407 NULL
-+snd_card_create_64418 snd_card_create 4 64418 NULL nohasharray
-+keyctl_get_security_64418 keyctl_get_security 3 64418 &snd_card_create_64418
-+ax25_recvmsg_64441 ax25_recvmsg 4 64441 NULL
-+ip_vs_create_timeout_table_64478 ip_vs_create_timeout_table 2 64478 NULL
-+alloc_large_system_hash_64490 alloc_large_system_hash 2 64490 NULL
-+ses_send_diag_64527 ses_send_diag 4 64527 NULL
-+diva_os_alloc_message_buffer_64568 diva_os_alloc_message_buffer 1 64568 NULL
-+use_pool_64607 use_pool 2 64607 NULL
-+ioremap_default_64667 ioremap_default 2-1 64667 NULL
-+__feat_register_sp_64712 __feat_register_sp 6 64712 NULL
-+bio_map_kern_64751 bio_map_kern 3 64751 NULL
-+rt2x00debug_write_csr_64753 rt2x00debug_write_csr 3 64753 NULL
-+mlx4_en_create_tx_ring_64756 mlx4_en_create_tx_ring 3 64756 NULL
-+isr_low_rssi_read_64789 isr_low_rssi_read 3 64789 NULL
-+nfsctl_transaction_write_64800 nfsctl_transaction_write 3 64800 NULL
-+rfkill_fop_write_64808 rfkill_fop_write 3 64808 NULL
-+ecryptfs_send_miscdev_64816 ecryptfs_send_miscdev 2 64816 NULL
-+do_kimage_alloc_64827 do_kimage_alloc 3 64827 NULL
-+ubifs_wbuf_write_nolock_64946 ubifs_wbuf_write_nolock 3 64946 NULL
-+ip_options_get_from_user_64958 ip_options_get_from_user 4 64958 NULL
-+pskb_pull_65005 pskb_pull 2 65005 NULL
-+insert_dent_65034 insert_dent 7 65034 NULL
-+ssb_bus_register_65183 ssb_bus_register 3 65183 NULL
-+drm_ioctl_65206 drm_ioctl 3 65206 NULL
-+nfulnl_alloc_skb_65207 nfulnl_alloc_skb 2 65207 NULL
-+kfifo_alloc_65242 kfifo_alloc 1 65242 NULL
-+compat_core_sys_select_65285 compat_core_sys_select 1 65285 NULL
-+redirected_tty_write_65297 redirected_tty_write 3 65297 NULL
-+jffs2_trusted_setxattr_65310 jffs2_trusted_setxattr 4 65310 NULL
-+dccp_setsockopt_service_65336 dccp_setsockopt_service 4 65336 NULL
-+dma_rx_requested_read_65354 dma_rx_requested_read 3 65354 NULL
-+dvb_demux_ioctl_65382 dvb_demux_ioctl 3 65382 NULL
-+__alloc_bootmem_nopanic_65397 __alloc_bootmem_nopanic 1 65397 NULL
-+trace_seq_to_user_65398 trace_seq_to_user 3 65398 NULL
-+drm_calloc_large_65421 drm_calloc_large 1-2 65421 NULL
-+xpc_kzalloc_cacheline_aligned_65433 xpc_kzalloc_cacheline_aligned 1 65433 NULL
-+alloc_dr_65495 alloc_dr 2 65495 NULL
-diff --git a/tools/gcc/size_overflow_plugin.c b/tools/gcc/size_overflow_plugin.c
-new file mode 100644
-index 0000000..d52f2ee
---- /dev/null
-+++ b/tools/gcc/size_overflow_plugin.c
-@@ -0,0 +1,1941 @@
-+/*
-+ * Copyright 2011, 2012 by Emese Revfy <re.emese@gmail.com>
-+ * Licensed under the GPL v2, or (at your option) v3
-+ *
-+ * Homepage:
-+ * http://www.grsecurity.net/~ephox/overflow_plugin/
-+ *
-+ * This plugin recomputes expressions of function arguments marked by a size_overflow attribute
-+ * with double integer precision (DImode/TImode for 32/64 bit integer types).
-+ * The recomputed argument is checked against TYPE_MAX and an event is logged on overflow and the triggering process is killed.
-+ *
-+ * Usage:
-+ * $ gcc -I`gcc -print-file-name=plugin`/include/c-family -I`gcc -print-file-name=plugin`/include -fPIC -shared -O2 -ggdb -Wall -W -Wno-missing-field-initializers -o size_overflow_plugin.so size_overflow_plugin.c
-+ * $ gcc -fplugin=size_overflow_plugin.so test.c -O2
-+ */
-+
-+#include "gcc-plugin.h"
-+#include "config.h"
-+#include "system.h"
-+#include "coretypes.h"
-+#include "tree.h"
-+#include "tree-pass.h"
-+#include "intl.h"
-+#include "plugin-version.h"
-+#include "tm.h"
-+#include "toplev.h"
-+#include "function.h"
-+#include "tree-flow.h"
-+#include "plugin.h"
-+#include "gimple.h"
-+#include "c-common.h"
-+#include "diagnostic.h"
-+#include "cfgloop.h"
-+
-+#if BUILDING_GCC_VERSION >= 4007
-+#include "c-tree.h"
-+#else
-+#define C_DECL_IMPLICIT(EXP) DECL_LANG_FLAG_2 (EXP)
-+#endif
-+
-+#if BUILDING_GCC_VERSION >= 4008
-+#define TODO_dump_func 0
-+#endif
-+
-+struct size_overflow_hash {
-+ const struct size_overflow_hash * const next;
-+ const char * const name;
-+ const unsigned int param;
-+};
-+
-+#include "size_overflow_hash.h"
-+
-+enum marked {
-+ MARKED_NO, MARKED_YES, MARKED_NOT_INTENTIONAL
-+};
-+
-+static unsigned int call_count = 0;
-+
-+#define __unused __attribute__((__unused__))
-+#define NAME(node) IDENTIFIER_POINTER(DECL_NAME(node))
-+#define NAME_LEN(node) IDENTIFIER_LENGTH(DECL_NAME(node))
-+#define BEFORE_STMT true
-+#define AFTER_STMT false
-+#define CREATE_NEW_VAR NULL_TREE
-+#define CODES_LIMIT 32
-+#define MAX_PARAM 32
-+#define MY_STMT GF_PLF_1
-+#define NO_CAST_CHECK GF_PLF_2
-+
-+#if BUILDING_GCC_VERSION == 4005
-+#define DECL_CHAIN(NODE) (TREE_CHAIN(DECL_MINIMAL_CHECK(NODE)))
-+#endif
-+
-+int plugin_is_GPL_compatible;
-+void debug_gimple_stmt(gimple gs);
-+
-+static tree expand(struct pointer_set_t *visited, tree lhs);
-+static bool pre_expand(struct pointer_set_t *visited, const_tree lhs);
-+static tree report_size_overflow_decl;
-+static const_tree const_char_ptr_type_node;
-+static unsigned int handle_function(void);
-+static void check_size_overflow(gimple stmt, tree size_overflow_type, tree cast_rhs, tree rhs, bool before);
-+static tree get_size_overflow_type(gimple stmt, const_tree node);
-+static tree dup_assign(struct pointer_set_t *visited, gimple oldstmt, const_tree node, tree rhs1, tree rhs2, tree __unused rhs3);
-+
-+static struct plugin_info size_overflow_plugin_info = {
-+ .version = "20130109beta",
-+ .help = "no-size-overflow\tturn off size overflow checking\n",
-+};
-+
-+static tree handle_size_overflow_attribute(tree *node, tree __unused name, tree args, int __unused flags, bool *no_add_attrs)
-+{
-+ unsigned int arg_count;
-+ enum tree_code code = TREE_CODE(*node);
-+
-+ switch (code) {
-+ case FUNCTION_DECL:
-+ arg_count = type_num_arguments(TREE_TYPE(*node));
-+ break;
-+ case FUNCTION_TYPE:
-+ case METHOD_TYPE:
-+ arg_count = type_num_arguments(*node);
-+ break;
-+ default:
-+ *no_add_attrs = true;
-+ error("%s: %qE attribute only applies to functions", __func__, name);
-+ return NULL_TREE;
-+ }
-+
-+ for (; args; args = TREE_CHAIN(args)) {
-+ tree position = TREE_VALUE(args);
-+ if (TREE_CODE(position) != INTEGER_CST || TREE_INT_CST_HIGH(position) || TREE_INT_CST_LOW(position) < 1 || TREE_INT_CST_LOW(position) > arg_count ) {
-+ error("%s: parameter %u is outside range.", __func__, (unsigned int)TREE_INT_CST_LOW(position));
-+ *no_add_attrs = true;
-+ }
-+ }
-+ return NULL_TREE;
-+}
-+
-+static const char* get_asm_name(tree node)
-+{
-+ return IDENTIFIER_POINTER(DECL_ASSEMBLER_NAME(node));
-+}
-+
-+static tree handle_intentional_overflow_attribute(tree *node, tree __unused name, tree args, int __unused flags, bool *no_add_attrs)
-+{
-+ unsigned int arg_count, arg_num;
-+ enum tree_code code = TREE_CODE(*node);
-+
-+ switch (code) {
-+ case FUNCTION_DECL:
-+ arg_count = type_num_arguments(TREE_TYPE(*node));
-+ break;
-+ case FUNCTION_TYPE:
-+ case METHOD_TYPE:
-+ arg_count = type_num_arguments(*node);
-+ break;
-+ case FIELD_DECL:
-+ arg_num = TREE_INT_CST_LOW(TREE_VALUE(args));
-+ if (arg_num != 0) {
-+ *no_add_attrs = true;
-+ error("%s: %qE attribute parameter can only be 0 in structure fields", __func__, name);
-+ }
-+ return NULL_TREE;
-+ default:
-+ *no_add_attrs = true;
-+ error("%qE attribute only applies to functions", name);
-+ return NULL_TREE;
-+ }
-+
-+ for (; args; args = TREE_CHAIN(args)) {
-+ tree position = TREE_VALUE(args);
-+ if (TREE_CODE(position) != INTEGER_CST || TREE_INT_CST_HIGH(position) || TREE_INT_CST_LOW(position) > arg_count ) {
-+ error("%s: parameter %u is outside range.", __func__, (unsigned int)TREE_INT_CST_LOW(position));
-+ *no_add_attrs = true;
-+ }
-+ }
-+ return NULL_TREE;
-+}
-+
-+static struct attribute_spec size_overflow_attr = {
-+ .name = "size_overflow",
-+ .min_length = 1,
-+ .max_length = -1,
-+ .decl_required = true,
-+ .type_required = false,
-+ .function_type_required = false,
-+ .handler = handle_size_overflow_attribute,
-+#if BUILDING_GCC_VERSION >= 4007
-+ .affects_type_identity = false
-+#endif
-+};
-+
-+static struct attribute_spec intentional_overflow_attr = {
-+ .name = "intentional_overflow",
-+ .min_length = 1,
-+ .max_length = -1,
-+ .decl_required = true,
-+ .type_required = false,
-+ .function_type_required = false,
-+ .handler = handle_intentional_overflow_attribute,
-+#if BUILDING_GCC_VERSION >= 4007
-+ .affects_type_identity = false
-+#endif
-+};
-+
-+static void register_attributes(void __unused *event_data, void __unused *data)
-+{
-+ register_attribute(&size_overflow_attr);
-+ register_attribute(&intentional_overflow_attr);
-+}
-+
-+// http://www.team5150.com/~andrew/noncryptohashzoo2~/CrapWow.html
-+static unsigned int CrapWow(const char *key, unsigned int len, unsigned int seed)
-+{
-+#define cwfold( a, b, lo, hi ) { p = (unsigned int)(a) * (unsigned long long)(b); lo ^= (unsigned int)p; hi ^= (unsigned int)(p >> 32); }
-+#define cwmixa( in ) { cwfold( in, m, k, h ); }
-+#define cwmixb( in ) { cwfold( in, n, h, k ); }
-+
-+ unsigned int m = 0x57559429;
-+ unsigned int n = 0x5052acdb;
-+ const unsigned int *key4 = (const unsigned int *)key;
-+ unsigned int h = len;
-+ unsigned int k = len + seed + n;
-+ unsigned long long p;
-+
-+ while (len >= 8) {
-+ cwmixb(key4[0]) cwmixa(key4[1]) key4 += 2;
-+ len -= 8;
-+ }
-+ if (len >= 4) {
-+ cwmixb(key4[0]) key4 += 1;
-+ len -= 4;
-+ }
-+ if (len)
-+ cwmixa(key4[0] & ((1 << (len * 8)) - 1 ));
-+ cwmixb(h ^ (k + n));
-+ return k ^ h;
-+
-+#undef cwfold
-+#undef cwmixa
-+#undef cwmixb
-+}
-+
-+static inline unsigned int get_hash_num(const char *fndecl, const char *tree_codes, unsigned int len, unsigned int seed)
-+{
-+ unsigned int fn = CrapWow(fndecl, strlen(fndecl), seed) & 0xffff;
-+ unsigned int codes = CrapWow(tree_codes, len, seed) & 0xffff;
-+ return fn ^ codes;
-+}
-+
-+static inline tree get_original_function_decl(tree fndecl)
-+{
-+ if (DECL_ABSTRACT_ORIGIN(fndecl))
-+ return DECL_ABSTRACT_ORIGIN(fndecl);
-+ return fndecl;
-+}
-+
-+static inline gimple get_def_stmt(const_tree node)
-+{
-+ gcc_assert(node != NULL_TREE);
-+ gcc_assert(TREE_CODE(node) == SSA_NAME);
-+ return SSA_NAME_DEF_STMT(node);
-+}
-+
-+static unsigned char get_tree_code(const_tree type)
-+{
-+ switch (TREE_CODE(type)) {
-+ case ARRAY_TYPE:
-+ return 0;
-+ case BOOLEAN_TYPE:
-+ return 1;
-+ case ENUMERAL_TYPE:
-+ return 2;
-+ case FUNCTION_TYPE:
-+ return 3;
-+ case INTEGER_TYPE:
-+ return 4;
-+ case POINTER_TYPE:
-+ return 5;
-+ case RECORD_TYPE:
-+ return 6;
-+ case UNION_TYPE:
-+ return 7;
-+ case VOID_TYPE:
-+ return 8;
-+ case REAL_TYPE:
-+ return 9;
-+ case VECTOR_TYPE:
-+ return 10;
-+ case REFERENCE_TYPE:
-+ return 11;
-+ case OFFSET_TYPE:
-+ return 12;
-+ case COMPLEX_TYPE:
-+ return 13;
-+ default:
-+ debug_tree((tree)type);
-+ gcc_unreachable();
-+ }
-+}
-+
-+static size_t add_type_codes(const_tree type, unsigned char *tree_codes, size_t len)
-+{
-+ gcc_assert(type != NULL_TREE);
-+
-+ while (type && len < CODES_LIMIT) {
-+ tree_codes[len] = get_tree_code(type);
-+ len++;
-+ type = TREE_TYPE(type);
-+ }
-+ return len;
-+}
-+
-+static unsigned int get_function_decl(const_tree fndecl, unsigned char *tree_codes)
-+{
-+ const_tree arg, result, arg_field, type = TREE_TYPE(fndecl);
-+ enum tree_code code = TREE_CODE(type);
-+ size_t len = 0;
-+
-+ gcc_assert(code == FUNCTION_TYPE || code == METHOD_TYPE);
-+
-+ arg = TYPE_ARG_TYPES(type);
-+ // skip builtins __builtin_constant_p
-+ if (!arg && DECL_BUILT_IN(fndecl))
-+ return 0;
-+
-+ if (TREE_CODE_CLASS(code) == tcc_type)
-+ result = type;
-+ else
-+ result = DECL_RESULT(fndecl);
-+
-+ gcc_assert(result != NULL_TREE);
-+ len = add_type_codes(TREE_TYPE(result), tree_codes, len);
-+
-+ if (arg == NULL_TREE) {
-+ gcc_assert(CODE_CONTAINS_STRUCT(TREE_CODE(fndecl), TS_DECL_NON_COMMON));
-+ arg_field = DECL_ARGUMENT_FLD(fndecl);
-+ if (arg_field == NULL_TREE)
-+ return 0;
-+ arg = TREE_TYPE(arg_field);
-+ len = add_type_codes(arg, tree_codes, len);
-+ gcc_assert(len != 0);
-+ return len;
-+ }
-+
-+ gcc_assert(arg != NULL_TREE && TREE_CODE(arg) == TREE_LIST);
-+ while (arg && len < CODES_LIMIT) {
-+ len = add_type_codes(TREE_VALUE(arg), tree_codes, len);
-+ arg = TREE_CHAIN(arg);
-+ }
-+
-+ gcc_assert(len != 0);
-+ return len;
-+}
-+
-+static const struct size_overflow_hash *get_function_hash(tree fndecl)
-+{
-+ unsigned int hash;
-+ const struct size_overflow_hash *entry;
-+ unsigned char tree_codes[CODES_LIMIT];
-+ size_t len;
-+ const char *func_name = get_asm_name(fndecl);
-+
-+ len = get_function_decl(fndecl, tree_codes);
-+ if (len == 0)
-+ return NULL;
-+
-+ hash = get_hash_num(func_name, (const char*) tree_codes, len, 0);
-+
-+ entry = size_overflow_hash[hash];
-+ while (entry) {
-+ if (!strcmp(entry->name, func_name))
-+ return entry;
-+ entry = entry->next;
-+ }
-+
-+ return NULL;
-+}
-+
-+static void check_arg_type(const_tree arg)
-+{
-+ const_tree type = TREE_TYPE(arg);
-+ enum tree_code code = TREE_CODE(type);
-+
-+ if (code == BOOLEAN_TYPE)
-+ return;
-+
-+ gcc_assert(code == INTEGER_TYPE || code == ENUMERAL_TYPE ||
-+ (code == POINTER_TYPE && TREE_CODE(TREE_TYPE(type)) == VOID_TYPE) ||
-+ (code == POINTER_TYPE && TREE_CODE(TREE_TYPE(type)) == INTEGER_TYPE));
-+}
-+
-+static unsigned int find_arg_number(const_tree arg, tree func)
-+{
-+ tree var;
-+ unsigned int argnum = 1;
-+
-+ if (TREE_CODE(arg) == SSA_NAME)
-+ arg = SSA_NAME_VAR(arg);
-+
-+ for (var = DECL_ARGUMENTS(func); var; var = TREE_CHAIN(var)) {
-+ if (strcmp(NAME(arg), NAME(var))) {
-+ argnum++;
-+ continue;
-+ }
-+ check_arg_type(var);
-+ return argnum;
-+ }
-+ gcc_unreachable();
-+}
-+
-+static tree create_new_var(tree type)
-+{
-+ tree new_var = create_tmp_var(type, "cicus");
-+
-+#if BUILDING_GCC_VERSION <= 4007
-+ add_referenced_var(new_var);
-+ mark_sym_for_renaming(new_var);
-+#endif
-+ return new_var;
-+}
-+
-+static gimple create_binary_assign(enum tree_code code, gimple stmt, tree rhs1, tree rhs2)
-+{
-+ gimple assign;
-+ gimple_stmt_iterator gsi = gsi_for_stmt(stmt);
-+ tree type = TREE_TYPE(rhs1);
-+ tree lhs = create_new_var(type);
-+
-+ gcc_assert(types_compatible_p(type, TREE_TYPE(rhs2)));
-+ assign = gimple_build_assign_with_ops(code, lhs, rhs1, rhs2);
-+ gimple_set_lhs(assign, make_ssa_name(lhs, assign));
-+
-+ gsi_insert_before(&gsi, assign, GSI_NEW_STMT);
-+ update_stmt(assign);
-+ gimple_set_plf(assign, MY_STMT, true);
-+ return assign;
-+}
-+
-+static bool is_bool(const_tree node)
-+{
-+ const_tree type;
-+
-+ if (node == NULL_TREE)
-+ return false;
-+
-+ type = TREE_TYPE(node);
-+ if (!INTEGRAL_TYPE_P(type))
-+ return false;
-+ if (TREE_CODE(type) == BOOLEAN_TYPE)
-+ return true;
-+ if (TYPE_PRECISION(type) == 1)
-+ return true;
-+ return false;
-+}
-+
-+static tree cast_a_tree(tree type, tree var)
-+{
-+ gcc_assert(type != NULL_TREE);
-+ gcc_assert(var != NULL_TREE);
-+ gcc_assert(fold_convertible_p(type, var));
-+
-+ return fold_convert(type, var);
-+}
-+
-+static gimple build_cast_stmt(tree dst_type, tree rhs, tree lhs, gimple_stmt_iterator *gsi, bool before)
-+{
-+ gimple assign;
-+
-+ gcc_assert(dst_type != NULL_TREE && rhs != NULL_TREE);
-+ if (gsi_end_p(*gsi) && before == AFTER_STMT)
-+ gcc_unreachable();
-+
-+ if (lhs == CREATE_NEW_VAR)
-+ lhs = create_new_var(dst_type);
-+
-+ assign = gimple_build_assign(lhs, cast_a_tree(dst_type, rhs));
-+
-+ if (!gsi_end_p(*gsi)) {
-+ location_t loc = gimple_location(gsi_stmt(*gsi));
-+ gimple_set_location(assign, loc);
-+ }
-+
-+ gimple_set_lhs(assign, make_ssa_name(lhs, assign));
-+
-+ if (before)
-+ gsi_insert_before(gsi, assign, GSI_NEW_STMT);
-+ else
-+ gsi_insert_after(gsi, assign, GSI_NEW_STMT);
-+ update_stmt(assign);
-+ gimple_set_plf(assign, MY_STMT, true);
-+
-+ return assign;
-+}
-+
-+static tree cast_to_new_size_overflow_type(gimple stmt, tree rhs, tree size_overflow_type, bool before)
-+{
-+ gimple assign;
-+ gimple_stmt_iterator gsi;
-+
-+ if (rhs == NULL_TREE)
-+ return NULL_TREE;
-+
-+ if (types_compatible_p(TREE_TYPE(rhs), size_overflow_type) && gimple_plf(stmt, MY_STMT))
-+ return rhs;
-+
-+ gsi = gsi_for_stmt(stmt);
-+ assign = build_cast_stmt(size_overflow_type, rhs, CREATE_NEW_VAR, &gsi, before);
-+ gimple_set_plf(assign, MY_STMT, true);
-+ return gimple_get_lhs(assign);
-+}
-+
-+static tree cast_to_TI_type(gimple stmt, tree node)
-+{
-+ gimple_stmt_iterator gsi;
-+ gimple cast_stmt;
-+ tree type = TREE_TYPE(node);
-+
-+ if (types_compatible_p(type, intTI_type_node))
-+ return node;
-+
-+ gsi = gsi_for_stmt(stmt);
-+ cast_stmt = build_cast_stmt(intTI_type_node, node, CREATE_NEW_VAR, &gsi, BEFORE_STMT);
-+ gimple_set_plf(cast_stmt, MY_STMT, true);
-+ return gimple_get_lhs(cast_stmt);
-+}
-+
-+static tree create_assign(struct pointer_set_t *visited, gimple oldstmt, tree rhs1, bool before)
-+{
-+ tree lhs;
-+ gimple_stmt_iterator gsi;
-+
-+ if (rhs1 == NULL_TREE) {
-+ debug_gimple_stmt(oldstmt);
-+ error("%s: rhs1 is NULL_TREE", __func__);
-+ gcc_unreachable();
-+ }
-+
-+ switch (gimple_code(oldstmt)) {
-+ case GIMPLE_ASM:
-+ lhs = rhs1;
-+ break;
-+ case GIMPLE_CALL:
-+ lhs = gimple_call_lhs(oldstmt);
-+ break;
-+ case GIMPLE_ASSIGN:
-+ lhs = gimple_get_lhs(oldstmt);
-+ break;
-+ default:
-+ debug_gimple_stmt(oldstmt);
-+ gcc_unreachable();
-+ }
-+
-+ gsi = gsi_for_stmt(oldstmt);
-+ pointer_set_insert(visited, oldstmt);
-+ if (lookup_stmt_eh_lp(oldstmt) != 0) {
-+ basic_block next_bb, cur_bb;
-+ const_edge e;
-+
-+ gcc_assert(before == false);
-+ gcc_assert(stmt_can_throw_internal(oldstmt));
-+ gcc_assert(gimple_code(oldstmt) == GIMPLE_CALL);
-+ gcc_assert(!gsi_end_p(gsi));
-+
-+ cur_bb = gimple_bb(oldstmt);
-+ next_bb = cur_bb->next_bb;
-+ e = find_edge(cur_bb, next_bb);
-+ gcc_assert(e != NULL);
-+ gcc_assert(e->flags & EDGE_FALLTHRU);
-+
-+ gsi = gsi_after_labels(next_bb);
-+ gcc_assert(!gsi_end_p(gsi));
-+
-+ before = true;
-+ oldstmt = gsi_stmt(gsi);
-+ }
-+
-+ return cast_to_new_size_overflow_type(oldstmt, rhs1, get_size_overflow_type(oldstmt, lhs), before);
-+}
-+
-+static tree dup_assign(struct pointer_set_t *visited, gimple oldstmt, const_tree node, tree rhs1, tree rhs2, tree __unused rhs3)
-+{
-+ gimple stmt;
-+ gimple_stmt_iterator gsi;
-+ tree size_overflow_type, new_var, lhs = gimple_get_lhs(oldstmt);
-+
-+ if (gimple_plf(oldstmt, MY_STMT))
-+ return lhs;
-+
-+ if (gimple_num_ops(oldstmt) != 4 && rhs1 == NULL_TREE) {
-+ rhs1 = gimple_assign_rhs1(oldstmt);
-+ rhs1 = create_assign(visited, oldstmt, rhs1, BEFORE_STMT);
-+ }
-+ if (gimple_num_ops(oldstmt) == 3 && rhs2 == NULL_TREE) {
-+ rhs2 = gimple_assign_rhs2(oldstmt);
-+ rhs2 = create_assign(visited, oldstmt, rhs2, BEFORE_STMT);
-+ }
-+
-+ stmt = gimple_copy(oldstmt);
-+ gimple_set_location(stmt, gimple_location(oldstmt));
-+ gimple_set_plf(stmt, MY_STMT, true);
-+
-+ if (gimple_assign_rhs_code(oldstmt) == WIDEN_MULT_EXPR)
-+ gimple_assign_set_rhs_code(stmt, MULT_EXPR);
-+
-+ size_overflow_type = get_size_overflow_type(oldstmt, node);
-+
-+ if (is_bool(lhs))
-+ new_var = SSA_NAME_VAR(lhs);
-+ else
-+ new_var = create_new_var(size_overflow_type);
-+ new_var = make_ssa_name(new_var, stmt);
-+ gimple_set_lhs(stmt, new_var);
-+
-+ if (rhs1 != NULL_TREE)
-+ gimple_assign_set_rhs1(stmt, rhs1);
-+
-+ if (rhs2 != NULL_TREE)
-+ gimple_assign_set_rhs2(stmt, rhs2);
-+#if BUILDING_GCC_VERSION >= 4007
-+ if (rhs3 != NULL_TREE)
-+ gimple_assign_set_rhs3(stmt, rhs3);
-+#endif
-+ gimple_set_vuse(stmt, gimple_vuse(oldstmt));
-+ gimple_set_vdef(stmt, gimple_vdef(oldstmt));
-+
-+ gsi = gsi_for_stmt(oldstmt);
-+ gsi_insert_after(&gsi, stmt, GSI_SAME_STMT);
-+ update_stmt(stmt);
-+ pointer_set_insert(visited, oldstmt);
-+ return gimple_get_lhs(stmt);
-+}
-+
-+static gimple overflow_create_phi_node(gimple oldstmt, tree result)
-+{
-+ basic_block bb;
-+ gimple phi;
-+ gimple_stmt_iterator gsi = gsi_for_stmt(oldstmt);
-+ gimple_seq seq;
-+
-+ bb = gsi_bb(gsi);
-+
-+ phi = create_phi_node(result, bb);
-+ seq = phi_nodes(bb);
-+ gsi = gsi_last(seq);
-+ gsi_remove(&gsi, false);
-+
-+ gsi = gsi_for_stmt(oldstmt);
-+ gsi_insert_after(&gsi, phi, GSI_NEW_STMT);
-+ gimple_set_bb(phi, bb);
-+ gimple_set_plf(phi, MY_STMT, true);
-+ return phi;
-+}
-+
-+static basic_block create_a_first_bb(void)
-+{
-+ basic_block first_bb;
-+
-+ first_bb = split_block_after_labels(ENTRY_BLOCK_PTR)->dest;
-+ gcc_assert(dom_info_available_p(CDI_DOMINATORS));
-+ set_immediate_dominator(CDI_DOMINATORS, first_bb, ENTRY_BLOCK_PTR);
-+ return first_bb;
-+}
-+
-+static tree cast_old_phi_arg(gimple oldstmt, tree size_overflow_type, tree arg, tree new_var, unsigned int i)
-+{
-+ basic_block bb;
-+ const_gimple newstmt;
-+ gimple_stmt_iterator gsi;
-+ bool before = BEFORE_STMT;
-+
-+ if (TREE_CODE(arg) == SSA_NAME && gimple_code(get_def_stmt(arg)) != GIMPLE_NOP) {
-+ gsi = gsi_for_stmt(get_def_stmt(arg));
-+ newstmt = build_cast_stmt(size_overflow_type, arg, new_var, &gsi, AFTER_STMT);
-+ return gimple_get_lhs(newstmt);
-+ }
-+
-+ bb = gimple_phi_arg_edge(oldstmt, i)->src;
-+ gsi = gsi_after_labels(bb);
-+ if (bb->index == 0) {
-+ bb = create_a_first_bb();
-+ gsi = gsi_start_bb(bb);
-+ }
-+ newstmt = build_cast_stmt(size_overflow_type, arg, new_var, &gsi, before);
-+ return gimple_get_lhs(newstmt);
-+}
-+
-+static const_gimple handle_new_phi_arg(const_tree arg, tree new_var, tree new_rhs)
-+{
-+ gimple newstmt;
-+ gimple_stmt_iterator gsi;
-+ void (*gsi_insert)(gimple_stmt_iterator *, gimple, enum gsi_iterator_update);
-+ gimple def_newstmt = get_def_stmt(new_rhs);
-+
-+ gsi_insert = gsi_insert_after;
-+ gsi = gsi_for_stmt(def_newstmt);
-+
-+ switch (gimple_code(get_def_stmt(arg))) {
-+ case GIMPLE_PHI:
-+ newstmt = gimple_build_assign(new_var, new_rhs);
-+ gsi = gsi_after_labels(gimple_bb(def_newstmt));
-+ gsi_insert = gsi_insert_before;
-+ break;
-+ case GIMPLE_ASM:
-+ case GIMPLE_CALL:
-+ newstmt = gimple_build_assign(new_var, new_rhs);
-+ break;
-+ case GIMPLE_ASSIGN:
-+ newstmt = gimple_build_assign(new_var, gimple_get_lhs(def_newstmt));
-+ break;
-+ default:
-+ /* unknown gimple_code (handle_build_new_phi_arg) */
-+ gcc_unreachable();
-+ }
-+
-+ gimple_set_lhs(newstmt, make_ssa_name(new_var, newstmt));
-+ gsi_insert(&gsi, newstmt, GSI_NEW_STMT);
-+ gimple_set_plf(newstmt, MY_STMT, true);
-+ update_stmt(newstmt);
-+ return newstmt;
-+}
-+
-+static tree build_new_phi_arg(struct pointer_set_t *visited, tree size_overflow_type, tree arg, tree new_var)
-+{
-+ const_gimple newstmt;
-+ gimple def_stmt;
-+ tree new_rhs;
-+
-+ new_rhs = expand(visited, arg);
-+ if (new_rhs == NULL_TREE)
-+ return NULL_TREE;
-+
-+ def_stmt = get_def_stmt(new_rhs);
-+ if (gimple_code(def_stmt) == GIMPLE_NOP)
-+ return NULL_TREE;
-+ new_rhs = cast_to_new_size_overflow_type(def_stmt, new_rhs, size_overflow_type, AFTER_STMT);
-+
-+ newstmt = handle_new_phi_arg(arg, new_var, new_rhs);
-+ return gimple_get_lhs(newstmt);
-+}
-+
-+static tree build_new_phi(struct pointer_set_t *visited, tree orig_result)
-+{
-+ gimple phi, oldstmt = get_def_stmt(orig_result);
-+ tree new_result, size_overflow_type;
-+ unsigned int i;
-+ unsigned int n = gimple_phi_num_args(oldstmt);
-+
-+ size_overflow_type = get_size_overflow_type(oldstmt, orig_result);
-+
-+ new_result = create_new_var(size_overflow_type);
-+
-+ pointer_set_insert(visited, oldstmt);
-+ phi = overflow_create_phi_node(oldstmt, new_result);
-+ for (i = 0; i < n; i++) {
-+ tree arg, lhs;
-+
-+ arg = gimple_phi_arg_def(oldstmt, i);
-+ if (is_gimple_constant(arg))
-+ arg = cast_a_tree(size_overflow_type, arg);
-+ lhs = build_new_phi_arg(visited, size_overflow_type, arg, new_result);
-+ if (lhs == NULL_TREE)
-+ lhs = cast_old_phi_arg(oldstmt, size_overflow_type, arg, new_result, i);
-+ add_phi_arg(phi, lhs, gimple_phi_arg_edge(oldstmt, i), gimple_location(oldstmt));
-+ }
-+
-+ update_stmt(phi);
-+ return gimple_phi_result(phi);
-+}
-+
-+static tree change_assign_rhs(gimple stmt, const_tree orig_rhs, tree new_rhs)
-+{
-+ const_gimple assign;
-+ gimple_stmt_iterator gsi = gsi_for_stmt(stmt);
-+ tree origtype = TREE_TYPE(orig_rhs);
-+
-+ gcc_assert(gimple_code(stmt) == GIMPLE_ASSIGN);
-+
-+ assign = build_cast_stmt(origtype, new_rhs, CREATE_NEW_VAR, &gsi, BEFORE_STMT);
-+ return gimple_get_lhs(assign);
-+}
-+
-+static void change_rhs1(gimple stmt, tree new_rhs1)
-+{
-+ tree assign_rhs;
-+ const_tree rhs = gimple_assign_rhs1(stmt);
-+
-+ assign_rhs = change_assign_rhs(stmt, rhs, new_rhs1);
-+ gimple_assign_set_rhs1(stmt, assign_rhs);
-+ update_stmt(stmt);
-+}
-+
-+static bool check_mode_type(const_gimple stmt)
-+{
-+ const_tree lhs = gimple_get_lhs(stmt);
-+ const_tree lhs_type = TREE_TYPE(lhs);
-+ const_tree rhs_type = TREE_TYPE(gimple_assign_rhs1(stmt));
-+ enum machine_mode lhs_mode = TYPE_MODE(lhs_type);
-+ enum machine_mode rhs_mode = TYPE_MODE(rhs_type);
-+
-+ if (rhs_mode == lhs_mode && TYPE_UNSIGNED(rhs_type) == TYPE_UNSIGNED(lhs_type))
-+ return false;
-+
-+ if (rhs_mode == SImode && lhs_mode == DImode && (TYPE_UNSIGNED(rhs_type) || !TYPE_UNSIGNED(lhs_type)))
-+ return false;
-+
-+ // skip lhs check on signed SI -> HI cast or signed SI -> QI cast
-+ if (rhs_mode == SImode && !TYPE_UNSIGNED(rhs_type) && (lhs_mode == HImode || lhs_mode == QImode))
-+ return false;
-+
-+ return true;
-+}
-+
-+static bool check_undefined_integer_operation(const_gimple stmt)
-+{
-+ const_gimple def_stmt;
-+ const_tree lhs = gimple_get_lhs(stmt);
-+ const_tree rhs1 = gimple_assign_rhs1(stmt);
-+ const_tree rhs1_type = TREE_TYPE(rhs1);
-+ const_tree lhs_type = TREE_TYPE(lhs);
-+
-+ if (TYPE_MODE(rhs1_type) != TYPE_MODE(lhs_type) || TYPE_UNSIGNED(rhs1_type) == TYPE_UNSIGNED(lhs_type))
-+ return false;
-+
-+ def_stmt = get_def_stmt(rhs1);
-+ if (gimple_code(def_stmt) != GIMPLE_ASSIGN)
-+ return false;
-+
-+ if (gimple_assign_rhs_code(def_stmt) != MINUS_EXPR)
-+ return false;
-+ return true;
-+}
-+
-+static bool is_a_cast_and_const_overflow(const_tree no_const_rhs)
-+{
-+ const_tree rhs1, lhs, rhs1_type, lhs_type;
-+ enum machine_mode lhs_mode, rhs_mode;
-+ gimple def_stmt = get_def_stmt(no_const_rhs);
-+
-+ if (!gimple_assign_cast_p(def_stmt))
-+ return false;
-+
-+ rhs1 = gimple_assign_rhs1(def_stmt);
-+ lhs = gimple_get_lhs(def_stmt);
-+ rhs1_type = TREE_TYPE(rhs1);
-+ lhs_type = TREE_TYPE(lhs);
-+ rhs_mode = TYPE_MODE(rhs1_type);
-+ lhs_mode = TYPE_MODE(lhs_type);
-+ if (TYPE_UNSIGNED(lhs_type) == TYPE_UNSIGNED(rhs1_type) || lhs_mode != rhs_mode)
-+ return false;
-+
-+ return true;
-+}
-+
-+static tree create_cast_assign(struct pointer_set_t *visited, gimple stmt)
-+{
-+ tree rhs1 = gimple_assign_rhs1(stmt);
-+ tree lhs = gimple_get_lhs(stmt);
-+ const_tree rhs1_type = TREE_TYPE(rhs1);
-+ const_tree lhs_type = TREE_TYPE(lhs);
-+
-+ if (TYPE_UNSIGNED(rhs1_type) == TYPE_UNSIGNED(lhs_type))
-+ return create_assign(visited, stmt, lhs, AFTER_STMT);
-+
-+ return create_assign(visited, stmt, rhs1, AFTER_STMT);
-+}
-+
-+static tree handle_unary_rhs(struct pointer_set_t *visited, gimple stmt)
-+{
-+ tree size_overflow_type, lhs = gimple_get_lhs(stmt);
-+ tree new_rhs1 = NULL_TREE;
-+ tree rhs1 = gimple_assign_rhs1(stmt);
-+ const_tree rhs1_type = TREE_TYPE(rhs1);
-+ const_tree lhs_type = TREE_TYPE(lhs);
-+
-+ if (gimple_plf(stmt, MY_STMT))
-+ return lhs;
-+
-+ if (TREE_CODE(rhs1_type) == POINTER_TYPE)
-+ return create_assign(visited, stmt, lhs, AFTER_STMT);
-+
-+ new_rhs1 = expand(visited, rhs1);
-+
-+ if (new_rhs1 == NULL_TREE)
-+ return create_cast_assign(visited, stmt);
-+
-+ if (gimple_plf(stmt, NO_CAST_CHECK))
-+ return dup_assign(visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
-+
-+ if (gimple_assign_rhs_code(stmt) == BIT_NOT_EXPR) {
-+ size_overflow_type = get_size_overflow_type(stmt, rhs1);
-+ new_rhs1 = cast_to_new_size_overflow_type(stmt, new_rhs1, size_overflow_type, BEFORE_STMT);
-+ check_size_overflow(stmt, size_overflow_type, new_rhs1, rhs1, BEFORE_STMT);
-+ return create_assign(visited, stmt, lhs, AFTER_STMT);
-+ }
-+
-+ if (!gimple_assign_cast_p(stmt) || check_undefined_integer_operation(stmt))
-+ return dup_assign(visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
-+
-+ if (TYPE_UNSIGNED(rhs1_type) != TYPE_UNSIGNED(lhs_type))
-+ return dup_assign(visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
-+
-+ size_overflow_type = get_size_overflow_type(stmt, rhs1);
-+ new_rhs1 = cast_to_new_size_overflow_type(stmt, new_rhs1, size_overflow_type, BEFORE_STMT);
-+
-+ check_size_overflow(stmt, size_overflow_type, new_rhs1, rhs1, BEFORE_STMT);
-+
-+ change_rhs1(stmt, new_rhs1);
-+
-+ if (!check_mode_type(stmt))
-+ return create_assign(visited, stmt, lhs, AFTER_STMT);
-+
-+ size_overflow_type = get_size_overflow_type(stmt, lhs);
-+ new_rhs1 = cast_to_new_size_overflow_type(stmt, new_rhs1, size_overflow_type, BEFORE_STMT);
-+
-+ check_size_overflow(stmt, size_overflow_type, new_rhs1, lhs, BEFORE_STMT);
-+
-+ return create_assign(visited, stmt, lhs, AFTER_STMT);
-+}
-+
-+static tree handle_unary_ops(struct pointer_set_t *visited, gimple stmt)
-+{
-+ tree rhs1, lhs = gimple_get_lhs(stmt);
-+ gimple def_stmt = get_def_stmt(lhs);
-+
-+ gcc_assert(gimple_code(def_stmt) != GIMPLE_NOP);
-+ rhs1 = gimple_assign_rhs1(def_stmt);
-+
-+ if (is_gimple_constant(rhs1))
-+ return create_assign(visited, def_stmt, lhs, AFTER_STMT);
-+
-+ gcc_assert(TREE_CODE(rhs1) != COND_EXPR);
-+ switch (TREE_CODE(rhs1)) {
-+ case SSA_NAME:
-+ return handle_unary_rhs(visited, def_stmt);
-+ case ARRAY_REF:
-+ case BIT_FIELD_REF:
-+ case ADDR_EXPR:
-+ case COMPONENT_REF:
-+ case INDIRECT_REF:
-+#if BUILDING_GCC_VERSION >= 4006
-+ case MEM_REF:
-+#endif
-+ case TARGET_MEM_REF:
-+ return create_assign(visited, def_stmt, lhs, AFTER_STMT);
-+ case PARM_DECL:
-+ case VAR_DECL:
-+ return create_assign(visited, stmt, lhs, AFTER_STMT);
-+
-+ default:
-+ debug_gimple_stmt(def_stmt);
-+ debug_tree(rhs1);
-+ gcc_unreachable();
-+ }
-+}
-+
-+static void insert_cond(basic_block cond_bb, tree arg, enum tree_code cond_code, tree type_value)
-+{
-+ gimple cond_stmt;
-+ gimple_stmt_iterator gsi = gsi_last_bb(cond_bb);
-+
-+ cond_stmt = gimple_build_cond(cond_code, arg, type_value, NULL_TREE, NULL_TREE);
-+ gsi_insert_after(&gsi, cond_stmt, GSI_CONTINUE_LINKING);
-+ update_stmt(cond_stmt);
-+}
-+
-+static tree create_string_param(tree string)
-+{
-+ tree i_type, a_type;
-+ const int length = TREE_STRING_LENGTH(string);
-+
-+ gcc_assert(length > 0);
-+
-+ i_type = build_index_type(build_int_cst(NULL_TREE, length - 1));
-+ a_type = build_array_type(char_type_node, i_type);
-+
-+ TREE_TYPE(string) = a_type;
-+ TREE_CONSTANT(string) = 1;
-+ TREE_READONLY(string) = 1;
-+
-+ return build1(ADDR_EXPR, ptr_type_node, string);
-+}
-+
-+static void insert_cond_result(basic_block bb_true, const_gimple stmt, const_tree arg, bool min)
-+{
-+ gimple func_stmt;
-+ const_gimple def_stmt;
-+ const_tree loc_line;
-+ tree loc_file, ssa_name, current_func;
-+ expanded_location xloc;
-+ char *ssa_name_buf;
-+ int len;
-+ gimple_stmt_iterator gsi = gsi_start_bb(bb_true);
-+
-+ def_stmt = get_def_stmt(arg);
-+ xloc = expand_location(gimple_location(def_stmt));
-+
-+ if (!gimple_has_location(def_stmt)) {
-+ xloc = expand_location(gimple_location(stmt));
-+ if (!gimple_has_location(stmt))
-+ xloc = expand_location(DECL_SOURCE_LOCATION(current_function_decl));
-+ }
-+
-+ loc_line = build_int_cstu(unsigned_type_node, xloc.line);
-+
-+ loc_file = build_string(strlen(xloc.file) + 1, xloc.file);
-+ loc_file = create_string_param(loc_file);
-+
-+ current_func = build_string(NAME_LEN(current_function_decl) + 1, NAME(current_function_decl));
-+ current_func = create_string_param(current_func);
-+
-+ gcc_assert(DECL_NAME(SSA_NAME_VAR(arg)) != NULL);
-+ call_count++;
-+ len = asprintf(&ssa_name_buf, "%s_%u %s, count: %u\n", NAME(SSA_NAME_VAR(arg)), SSA_NAME_VERSION(arg), min ? "min" : "max", call_count);
-+ gcc_assert(len > 0);
-+ ssa_name = build_string(len + 1, ssa_name_buf);
-+ free(ssa_name_buf);
-+ ssa_name = create_string_param(ssa_name);
-+
-+ // void report_size_overflow(const char *file, unsigned int line, const char *func, const char *ssa_name)
-+ func_stmt = gimple_build_call(report_size_overflow_decl, 4, loc_file, loc_line, current_func, ssa_name);
-+
-+ gsi_insert_after(&gsi, func_stmt, GSI_CONTINUE_LINKING);
-+}
-+
-+static void __unused print_the_code_insertions(const_gimple stmt)
-+{
-+ location_t loc = gimple_location(stmt);
-+
-+ inform(loc, "Integer size_overflow check applied here.");
-+}
-+
-+static void insert_check_size_overflow(gimple stmt, enum tree_code cond_code, tree arg, tree type_value, bool before, bool min)
-+{
-+ basic_block cond_bb, join_bb, bb_true;
-+ edge e;
-+ gimple_stmt_iterator gsi = gsi_for_stmt(stmt);
-+
-+ cond_bb = gimple_bb(stmt);
-+ if (before)
-+ gsi_prev(&gsi);
-+ if (gsi_end_p(gsi))
-+ e = split_block_after_labels(cond_bb);
-+ else
-+ e = split_block(cond_bb, gsi_stmt(gsi));
-+ cond_bb = e->src;
-+ join_bb = e->dest;
-+ e->flags = EDGE_FALSE_VALUE;
-+ e->probability = REG_BR_PROB_BASE;
-+
-+ bb_true = create_empty_bb(cond_bb);
-+ make_edge(cond_bb, bb_true, EDGE_TRUE_VALUE);
-+ make_edge(cond_bb, join_bb, EDGE_FALSE_VALUE);
-+ make_edge(bb_true, join_bb, EDGE_FALLTHRU);
-+
-+ gcc_assert(dom_info_available_p(CDI_DOMINATORS));
-+ set_immediate_dominator(CDI_DOMINATORS, bb_true, cond_bb);
-+ set_immediate_dominator(CDI_DOMINATORS, join_bb, cond_bb);
-+
-+ if (current_loops != NULL) {
-+ gcc_assert(cond_bb->loop_father == join_bb->loop_father);
-+ add_bb_to_loop(bb_true, cond_bb->loop_father);
-+ }
-+
-+ insert_cond(cond_bb, arg, cond_code, type_value);
-+ insert_cond_result(bb_true, stmt, arg, min);
-+
-+// print_the_code_insertions(stmt);
-+}
-+
-+static void check_size_overflow(gimple stmt, tree size_overflow_type, tree cast_rhs, tree rhs, bool before)
-+{
-+ const_tree rhs_type = TREE_TYPE(rhs);
-+ tree cast_rhs_type, type_max_type, type_min_type, type_max, type_min;
-+
-+ gcc_assert(rhs_type != NULL_TREE);
-+ if (TREE_CODE(rhs_type) == POINTER_TYPE)
-+ return;
-+
-+ gcc_assert(TREE_CODE(rhs_type) == INTEGER_TYPE || TREE_CODE(rhs_type) == BOOLEAN_TYPE || TREE_CODE(rhs_type) == ENUMERAL_TYPE);
-+
-+ type_max = cast_a_tree(size_overflow_type, TYPE_MAX_VALUE(rhs_type));
-+ // typemax (-1) < typemin (0)
-+ if (TREE_OVERFLOW(type_max))
-+ return;
-+
-+ type_min = cast_a_tree(size_overflow_type, TYPE_MIN_VALUE(rhs_type));
-+
-+ cast_rhs_type = TREE_TYPE(cast_rhs);
-+ type_max_type = TREE_TYPE(type_max);
-+ type_min_type = TREE_TYPE(type_min);
-+ gcc_assert(types_compatible_p(cast_rhs_type, type_max_type));
-+ gcc_assert(types_compatible_p(type_max_type, type_min_type));
-+
-+ insert_check_size_overflow(stmt, GT_EXPR, cast_rhs, type_max, before, false);
-+ insert_check_size_overflow(stmt, LT_EXPR, cast_rhs, type_min, before, true);
-+}
-+
-+static tree get_size_overflow_type_for_intentional_overflow(gimple def_stmt, tree change_rhs)
-+{
-+ gimple change_rhs_def_stmt;
-+ tree lhs = gimple_get_lhs(def_stmt);
-+ tree lhs_type = TREE_TYPE(lhs);
-+ tree rhs1_type = TREE_TYPE(gimple_assign_rhs1(def_stmt));
-+ tree rhs2_type = TREE_TYPE(gimple_assign_rhs2(def_stmt));
-+
-+ if (change_rhs == NULL_TREE)
-+ return get_size_overflow_type(def_stmt, lhs);
-+
-+ change_rhs_def_stmt = get_def_stmt(change_rhs);
-+
-+ if (TREE_CODE_CLASS(gimple_assign_rhs_code(def_stmt)) == tcc_comparison)
-+ return get_size_overflow_type(change_rhs_def_stmt, change_rhs);
-+
-+ if (gimple_assign_rhs_code(def_stmt) == LSHIFT_EXPR)
-+ return get_size_overflow_type(change_rhs_def_stmt, change_rhs);
-+
-+ if (gimple_assign_rhs_code(def_stmt) == RSHIFT_EXPR)
-+ return get_size_overflow_type(change_rhs_def_stmt, change_rhs);
-+
-+ if (!types_compatible_p(lhs_type, rhs1_type) || !types_compatible_p(rhs1_type, rhs2_type)) {
-+ debug_gimple_stmt(def_stmt);
-+ gcc_unreachable();
-+ }
-+
-+ return get_size_overflow_type(def_stmt, lhs);
-+}
-+
-+static bool is_a_constant_overflow(const_gimple stmt, const_tree rhs)
-+{
-+ if (gimple_assign_rhs_code(stmt) == MIN_EXPR)
-+ return false;
-+ if (!is_gimple_constant(rhs))
-+ return false;
-+ return true;
-+}
-+
-+static bool is_subtraction_special(const_gimple stmt)
-+{
-+ gimple rhs1_def_stmt, rhs2_def_stmt;
-+ const_tree rhs1_def_stmt_rhs1, rhs2_def_stmt_rhs1, rhs1_def_stmt_lhs, rhs2_def_stmt_lhs;
-+ enum machine_mode rhs1_def_stmt_rhs1_mode, rhs2_def_stmt_rhs1_mode, rhs1_def_stmt_lhs_mode, rhs2_def_stmt_lhs_mode;
-+ const_tree rhs1 = gimple_assign_rhs1(stmt);
-+ const_tree rhs2 = gimple_assign_rhs2(stmt);
-+
-+ if (is_gimple_constant(rhs1) || is_gimple_constant(rhs2))
-+ return false;
-+
-+ gcc_assert(TREE_CODE(rhs1) == SSA_NAME && TREE_CODE(rhs2) == SSA_NAME);
-+
-+ if (gimple_assign_rhs_code(stmt) != MINUS_EXPR)
-+ return false;
-+
-+ rhs1_def_stmt = get_def_stmt(rhs1);
-+ rhs2_def_stmt = get_def_stmt(rhs2);
-+ if (!gimple_assign_cast_p(rhs1_def_stmt) || !gimple_assign_cast_p(rhs2_def_stmt))
-+ return false;
-+
-+ rhs1_def_stmt_rhs1 = gimple_assign_rhs1(rhs1_def_stmt);
-+ rhs2_def_stmt_rhs1 = gimple_assign_rhs1(rhs2_def_stmt);
-+ rhs1_def_stmt_lhs = gimple_get_lhs(rhs1_def_stmt);
-+ rhs2_def_stmt_lhs = gimple_get_lhs(rhs2_def_stmt);
-+ rhs1_def_stmt_rhs1_mode = TYPE_MODE(TREE_TYPE(rhs1_def_stmt_rhs1));
-+ rhs2_def_stmt_rhs1_mode = TYPE_MODE(TREE_TYPE(rhs2_def_stmt_rhs1));
-+ rhs1_def_stmt_lhs_mode = TYPE_MODE(TREE_TYPE(rhs1_def_stmt_lhs));
-+ rhs2_def_stmt_lhs_mode = TYPE_MODE(TREE_TYPE(rhs2_def_stmt_lhs));
-+ if (GET_MODE_BITSIZE(rhs1_def_stmt_rhs1_mode) <= GET_MODE_BITSIZE(rhs1_def_stmt_lhs_mode))
-+ return false;
-+ if (GET_MODE_BITSIZE(rhs2_def_stmt_rhs1_mode) <= GET_MODE_BITSIZE(rhs2_def_stmt_lhs_mode))
-+ return false;
-+
-+ gimple_set_plf(rhs1_def_stmt, NO_CAST_CHECK, true);
-+ gimple_set_plf(rhs2_def_stmt, NO_CAST_CHECK, true);
-+ return true;
-+}
-+
-+static tree get_def_stmt_rhs(const_tree var)
-+{
-+ tree rhs1, def_stmt_rhs1;
-+ gimple rhs1_def_stmt, def_stmt_rhs1_def_stmt, def_stmt;
-+
-+ def_stmt = get_def_stmt(var);
-+ gcc_assert(gimple_code(def_stmt) != GIMPLE_NOP && gimple_plf(def_stmt, MY_STMT) && gimple_assign_cast_p(def_stmt));
-+
-+ rhs1 = gimple_assign_rhs1(def_stmt);
-+ rhs1_def_stmt = get_def_stmt(rhs1);
-+ if (!gimple_assign_cast_p(rhs1_def_stmt))
-+ return rhs1;
-+
-+ def_stmt_rhs1 = gimple_assign_rhs1(rhs1_def_stmt);
-+ def_stmt_rhs1_def_stmt = get_def_stmt(def_stmt_rhs1);
-+
-+ switch (gimple_code(def_stmt_rhs1_def_stmt)) {
-+ case GIMPLE_CALL:
-+ case GIMPLE_NOP:
-+ case GIMPLE_ASM:
-+ return def_stmt_rhs1;
-+ case GIMPLE_ASSIGN:
-+ return rhs1;
-+ default:
-+ debug_gimple_stmt(def_stmt_rhs1_def_stmt);
-+ gcc_unreachable();
-+ }
-+}
-+
-+static tree handle_integer_truncation(struct pointer_set_t *visited, const_tree lhs)
-+{
-+ tree new_rhs1, new_rhs2;
-+ tree new_rhs1_def_stmt_rhs1, new_rhs2_def_stmt_rhs1, new_lhs;
-+ gimple assign, stmt = get_def_stmt(lhs);
-+ tree rhs1 = gimple_assign_rhs1(stmt);
-+ tree rhs2 = gimple_assign_rhs2(stmt);
-+
-+ if (!is_subtraction_special(stmt))
-+ return NULL_TREE;
-+
-+ new_rhs1 = expand(visited, rhs1);
-+ new_rhs2 = expand(visited, rhs2);
-+
-+ new_rhs1_def_stmt_rhs1 = get_def_stmt_rhs(new_rhs1);
-+ new_rhs2_def_stmt_rhs1 = get_def_stmt_rhs(new_rhs2);
-+
-+ if (!types_compatible_p(TREE_TYPE(new_rhs1_def_stmt_rhs1), TREE_TYPE(new_rhs2_def_stmt_rhs1))) {
-+ new_rhs1_def_stmt_rhs1 = cast_to_TI_type(stmt, new_rhs1_def_stmt_rhs1);
-+ new_rhs2_def_stmt_rhs1 = cast_to_TI_type(stmt, new_rhs2_def_stmt_rhs1);
-+ }
-+
-+ assign = create_binary_assign(MINUS_EXPR, stmt, new_rhs1_def_stmt_rhs1, new_rhs2_def_stmt_rhs1);
-+ new_lhs = gimple_get_lhs(assign);
-+ check_size_overflow(assign, TREE_TYPE(new_lhs), new_lhs, rhs1, AFTER_STMT);
-+
-+ return dup_assign(visited, stmt, lhs, new_rhs1, new_rhs2, NULL_TREE);
-+}
-+
-+static bool is_a_neg_overflow(const_gimple stmt, const_tree rhs)
-+{
-+ const_gimple def_stmt;
-+
-+ if (TREE_CODE(rhs) != SSA_NAME)
-+ return false;
-+
-+ if (gimple_assign_rhs_code(stmt) != PLUS_EXPR)
-+ return false;
-+
-+ def_stmt = get_def_stmt(rhs);
-+ if (gimple_code(def_stmt) != GIMPLE_ASSIGN || gimple_assign_rhs_code(def_stmt) != BIT_NOT_EXPR)
-+ return false;
-+
-+ return true;
-+}
-+
-+static tree handle_intentional_overflow(struct pointer_set_t *visited, bool check_overflow, gimple stmt, tree change_rhs, tree new_rhs1, tree new_rhs2)
-+{
-+ tree new_rhs, size_overflow_type, orig_rhs;
-+ void (*gimple_assign_set_rhs)(gimple, tree);
-+ tree rhs1 = gimple_assign_rhs1(stmt);
-+ tree rhs2 = gimple_assign_rhs2(stmt);
-+ tree lhs = gimple_get_lhs(stmt);
-+
-+ if (change_rhs == NULL_TREE)
-+ return create_assign(visited, stmt, lhs, AFTER_STMT);
-+
-+ if (new_rhs2 == NULL_TREE) {
-+ size_overflow_type = get_size_overflow_type_for_intentional_overflow(stmt, new_rhs1);
-+ new_rhs2 = cast_a_tree(size_overflow_type, rhs2);
-+ orig_rhs = rhs1;
-+ gimple_assign_set_rhs = &gimple_assign_set_rhs1;
-+ } else {
-+ size_overflow_type = get_size_overflow_type_for_intentional_overflow(stmt, new_rhs2);
-+ new_rhs1 = cast_a_tree(size_overflow_type, rhs1);
-+ orig_rhs = rhs2;
-+ gimple_assign_set_rhs = &gimple_assign_set_rhs2;
-+ }
-+
-+ change_rhs = cast_to_new_size_overflow_type(stmt, change_rhs, size_overflow_type, BEFORE_STMT);
-+
-+ if (check_overflow)
-+ check_size_overflow(stmt, size_overflow_type, change_rhs, orig_rhs, BEFORE_STMT);
-+
-+ new_rhs = change_assign_rhs(stmt, orig_rhs, change_rhs);
-+ gimple_assign_set_rhs(stmt, new_rhs);
-+ update_stmt(stmt);
-+
-+ return create_assign(visited, stmt, lhs, AFTER_STMT);
-+}
-+
-+static tree handle_binary_ops(struct pointer_set_t *visited, tree lhs)
-+{
-+ tree rhs1, rhs2, new_lhs;
-+ gimple def_stmt = get_def_stmt(lhs);
-+ tree new_rhs1 = NULL_TREE;
-+ tree new_rhs2 = NULL_TREE;
-+
-+ rhs1 = gimple_assign_rhs1(def_stmt);
-+ rhs2 = gimple_assign_rhs2(def_stmt);
-+
-+ /* no DImode/TImode division in the 32/64 bit kernel */
-+ switch (gimple_assign_rhs_code(def_stmt)) {
-+ case RDIV_EXPR:
-+ case TRUNC_DIV_EXPR:
-+ case CEIL_DIV_EXPR:
-+ case FLOOR_DIV_EXPR:
-+ case ROUND_DIV_EXPR:
-+ case TRUNC_MOD_EXPR:
-+ case CEIL_MOD_EXPR:
-+ case FLOOR_MOD_EXPR:
-+ case ROUND_MOD_EXPR:
-+ case EXACT_DIV_EXPR:
-+ case POINTER_PLUS_EXPR:
-+ case BIT_AND_EXPR:
-+ return create_assign(visited, def_stmt, lhs, AFTER_STMT);
-+ default:
-+ break;
-+ }
-+
-+ new_lhs = handle_integer_truncation(visited, lhs);
-+ if (new_lhs != NULL_TREE)
-+ return new_lhs;
-+
-+ if (TREE_CODE(rhs1) == SSA_NAME)
-+ new_rhs1 = expand(visited, rhs1);
-+ if (TREE_CODE(rhs2) == SSA_NAME)
-+ new_rhs2 = expand(visited, rhs2);
-+
-+ if (is_a_neg_overflow(def_stmt, rhs2))
-+ return handle_intentional_overflow(visited, true, def_stmt, new_rhs1, new_rhs1, NULL_TREE);
-+ if (is_a_neg_overflow(def_stmt, rhs1))
-+ return handle_intentional_overflow(visited, true, def_stmt, new_rhs2, NULL_TREE, new_rhs2);
-+
-+ if (is_a_constant_overflow(def_stmt, rhs2))
-+ return handle_intentional_overflow(visited, !is_a_cast_and_const_overflow(rhs1), def_stmt, new_rhs1, new_rhs1, NULL_TREE);
-+ if (is_a_constant_overflow(def_stmt, rhs1))
-+ return handle_intentional_overflow(visited, !is_a_cast_and_const_overflow(rhs2), def_stmt, new_rhs2, NULL_TREE, new_rhs2);
-+
-+ return dup_assign(visited, def_stmt, lhs, new_rhs1, new_rhs2, NULL_TREE);
-+}
-+
-+#if BUILDING_GCC_VERSION >= 4007
-+static tree get_new_rhs(struct pointer_set_t *visited, tree size_overflow_type, tree rhs)
-+{
-+ if (is_gimple_constant(rhs))
-+ return cast_a_tree(size_overflow_type, rhs);
-+ if (TREE_CODE(rhs) != SSA_NAME)
-+ return NULL_TREE;
-+ return expand(visited, rhs);
-+}
-+
-+static tree handle_ternary_ops(struct pointer_set_t *visited, tree lhs)
-+{
-+ tree rhs1, rhs2, rhs3, new_rhs1, new_rhs2, new_rhs3, size_overflow_type;
-+ gimple def_stmt = get_def_stmt(lhs);
-+
-+ size_overflow_type = get_size_overflow_type(def_stmt, lhs);
-+
-+ rhs1 = gimple_assign_rhs1(def_stmt);
-+ rhs2 = gimple_assign_rhs2(def_stmt);
-+ rhs3 = gimple_assign_rhs3(def_stmt);
-+ new_rhs1 = get_new_rhs(visited, size_overflow_type, rhs1);
-+ new_rhs2 = get_new_rhs(visited, size_overflow_type, rhs2);
-+ new_rhs3 = get_new_rhs(visited, size_overflow_type, rhs3);
-+
-+ return dup_assign(visited, def_stmt, lhs, new_rhs1, new_rhs2, new_rhs3);
-+}
-+#endif
-+
-+static tree get_size_overflow_type(gimple stmt, const_tree node)
-+{
-+ const_tree type;
-+ tree new_type;
-+
-+ gcc_assert(node != NULL_TREE);
-+
-+ type = TREE_TYPE(node);
-+
-+ if (gimple_plf(stmt, MY_STMT))
-+ return TREE_TYPE(node);
-+
-+ switch (TYPE_MODE(type)) {
-+ case QImode:
-+ new_type = intHI_type_node;
-+ break;
-+ case HImode:
-+ new_type = intSI_type_node;
-+ break;
-+ case SImode:
-+ new_type = intDI_type_node;
-+ break;
-+ case DImode:
-+ if (LONG_TYPE_SIZE == GET_MODE_BITSIZE(SImode))
-+ new_type = intDI_type_node;
-+ else
-+ new_type = intTI_type_node;
-+ break;
-+ default:
-+ debug_tree((tree)node);
-+ error("%s: unsupported gcc configuration.", __func__);
-+ gcc_unreachable();
-+ }
-+
-+ if (TYPE_QUALS(type) != 0)
-+ return build_qualified_type(new_type, TYPE_QUALS(type));
-+ return new_type;
-+}
-+
-+static tree expand_visited(gimple def_stmt)
-+{
-+ const_gimple next_stmt;
-+ gimple_stmt_iterator gsi = gsi_for_stmt(def_stmt);
-+
-+ gsi_next(&gsi);
-+ next_stmt = gsi_stmt(gsi);
-+
-+ gcc_assert(gimple_plf((gimple)next_stmt, MY_STMT));
-+
-+ switch (gimple_code(next_stmt)) {
-+ case GIMPLE_ASSIGN:
-+ return gimple_get_lhs(next_stmt);
-+ case GIMPLE_PHI:
-+ return gimple_phi_result(next_stmt);
-+ case GIMPLE_CALL:
-+ return gimple_call_lhs(next_stmt);
-+ default:
-+ return NULL_TREE;
-+ }
-+}
-+
-+static tree expand(struct pointer_set_t *visited, tree lhs)
-+{
-+ gimple def_stmt;
-+ enum tree_code code = TREE_CODE(TREE_TYPE(lhs));
-+
-+ if (is_gimple_constant(lhs))
-+ return NULL_TREE;
-+
-+ if (TREE_CODE(lhs) == ADDR_EXPR)
-+ return NULL_TREE;
-+
-+ if (code == REAL_TYPE)
-+ return NULL_TREE;
-+
-+ gcc_assert(code == INTEGER_TYPE || code == POINTER_TYPE || code == BOOLEAN_TYPE || code == ENUMERAL_TYPE);
-+
-+ def_stmt = get_def_stmt(lhs);
-+
-+ if (!def_stmt || gimple_code(def_stmt) == GIMPLE_NOP)
-+ return NULL_TREE;
-+
-+ if (gimple_plf(def_stmt, MY_STMT))
-+ return lhs;
-+
-+ if (pointer_set_contains(visited, def_stmt))
-+ return expand_visited(def_stmt);
-+
-+ switch (gimple_code(def_stmt)) {
-+ case GIMPLE_PHI:
-+ return build_new_phi(visited, lhs);
-+ case GIMPLE_CALL:
-+ case GIMPLE_ASM:
-+ return create_assign(visited, def_stmt, lhs, AFTER_STMT);
-+ case GIMPLE_ASSIGN:
-+ switch (gimple_num_ops(def_stmt)) {
-+ case 2:
-+ return handle_unary_ops(visited, def_stmt);
-+ case 3:
-+ return handle_binary_ops(visited, lhs);
-+#if BUILDING_GCC_VERSION >= 4007
-+ case 4:
-+ return handle_ternary_ops(visited, lhs);
-+#endif
-+ }
-+ default:
-+ debug_gimple_stmt(def_stmt);
-+ error("%s: unknown gimple code", __func__);
-+ gcc_unreachable();
-+ }
-+}
-+
-+static void change_function_arg(gimple stmt, const_tree origarg, unsigned int argnum, tree newarg)
-+{
-+ const_gimple assign;
-+ gimple_stmt_iterator gsi = gsi_for_stmt(stmt);
-+ tree origtype = TREE_TYPE(origarg);
-+
-+ gcc_assert(gimple_code(stmt) == GIMPLE_CALL);
-+
-+ assign = build_cast_stmt(origtype, newarg, CREATE_NEW_VAR, &gsi, BEFORE_STMT);
-+
-+ gimple_call_set_arg(stmt, argnum, gimple_get_lhs(assign));
-+ update_stmt(stmt);
-+}
-+
-+static bool get_function_arg(unsigned int* argnum, const_tree fndecl)
-+{
-+ const char *origid;
-+ tree arg;
-+ const_tree origarg;
-+
-+ if (!DECL_ABSTRACT_ORIGIN(fndecl))
-+ return true;
-+
-+ origarg = DECL_ARGUMENTS(DECL_ABSTRACT_ORIGIN(fndecl));
-+ while (origarg && *argnum) {
-+ (*argnum)--;
-+ origarg = TREE_CHAIN(origarg);
-+ }
-+
-+ gcc_assert(*argnum == 0);
-+
-+ gcc_assert(origarg != NULL_TREE);
-+ origid = NAME(origarg);
-+ *argnum = 0;
-+ for (arg = DECL_ARGUMENTS(fndecl); arg; arg = TREE_CHAIN(arg)) {
-+ if (!strcmp(origid, NAME(arg)))
-+ return true;
-+ (*argnum)++;
-+ }
-+ return false;
-+}
-+
-+static bool skip_types(const_tree var)
-+{
-+ const_tree type;
-+
-+ switch (TREE_CODE(var)) {
-+ case ADDR_EXPR:
-+#if BUILDING_GCC_VERSION >= 4006
-+ case MEM_REF:
-+#endif
-+ case ARRAY_REF:
-+ case BIT_FIELD_REF:
-+ case INDIRECT_REF:
-+ case TARGET_MEM_REF:
-+ case VAR_DECL:
-+ return true;
-+ default:
-+ break;
-+ }
-+
-+ type = TREE_TYPE(TREE_TYPE(var));
-+ if (!type)
-+ return false;
-+ switch (TREE_CODE(type)) {
-+ case RECORD_TYPE:
-+ return true;
-+ default:
-+ break;
-+ }
-+
-+ return false;
-+}
-+
-+static bool walk_phi(struct pointer_set_t *visited, const_tree result)
-+{
-+ gimple phi = get_def_stmt(result);
-+ unsigned int i, n = gimple_phi_num_args(phi);
-+
-+ if (!phi)
-+ return false;
-+
-+ pointer_set_insert(visited, phi);
-+ for (i = 0; i < n; i++) {
-+ const_tree arg = gimple_phi_arg_def(phi, i);
-+ if (pre_expand(visited, arg))
-+ return true;
-+ }
-+ return false;
-+}
-+
-+static bool walk_unary_ops(struct pointer_set_t *visited, const_tree lhs)
-+{
-+ gimple def_stmt = get_def_stmt(lhs);
-+ const_tree rhs;
-+
-+ if (!def_stmt)
-+ return false;
-+
-+ rhs = gimple_assign_rhs1(def_stmt);
-+ if (pre_expand(visited, rhs))
-+ return true;
-+ return false;
-+}
-+
-+static bool walk_binary_ops(struct pointer_set_t *visited, const_tree lhs)
-+{
-+ bool rhs1_found, rhs2_found;
-+ gimple def_stmt = get_def_stmt(lhs);
-+ const_tree rhs1, rhs2;
-+
-+ if (!def_stmt)
-+ return false;
-+
-+ rhs1 = gimple_assign_rhs1(def_stmt);
-+ rhs2 = gimple_assign_rhs2(def_stmt);
-+ rhs1_found = pre_expand(visited, rhs1);
-+ rhs2_found = pre_expand(visited, rhs2);
-+
-+ return rhs1_found || rhs2_found;
-+}
-+
-+static const_tree search_field_decl(const_tree comp_ref)
-+{
-+ const_tree field = NULL_TREE;
-+ unsigned int i, len = TREE_OPERAND_LENGTH(comp_ref);
-+
-+ for (i = 0; i < len; i++) {
-+ field = TREE_OPERAND(comp_ref, i);
-+ if (TREE_CODE(field) == FIELD_DECL)
-+ break;
-+ }
-+ gcc_assert(TREE_CODE(field) == FIELD_DECL);
-+ return field;
-+}
-+
-+static enum marked mark_status(const_tree fndecl, unsigned int argnum)
-+{
-+ const_tree attr, p;
-+
-+ attr = lookup_attribute("intentional_overflow", DECL_ATTRIBUTES(fndecl));
-+ if (!attr || !TREE_VALUE(attr))
-+ return MARKED_NO;
-+
-+ p = TREE_VALUE(attr);
-+ if (!TREE_INT_CST_LOW(TREE_VALUE(p)))
-+ return MARKED_NOT_INTENTIONAL;
-+
-+ do {
-+ if (argnum == TREE_INT_CST_LOW(TREE_VALUE(p)))
-+ return MARKED_YES;
-+ p = TREE_CHAIN(p);
-+ } while (p);
-+
-+ return MARKED_NO;
-+}
-+
-+static void print_missing_msg(tree func, unsigned int argnum)
-+{
-+ unsigned int new_hash;
-+ size_t len;
-+ unsigned char tree_codes[CODES_LIMIT];
-+ location_t loc = DECL_SOURCE_LOCATION(func);
-+ const char *curfunc = get_asm_name(func);
-+
-+ len = get_function_decl(func, tree_codes);
-+ new_hash = get_hash_num(curfunc, (const char *) tree_codes, len, 0);
-+ inform(loc, "Function %s is missing from the size_overflow hash table +%s+%u+%u+", curfunc, curfunc, argnum, new_hash);
-+}
-+
-+static unsigned int search_missing_attribute(const_tree arg)
-+{
-+ const_tree type = TREE_TYPE(arg);
-+ tree func = get_original_function_decl(current_function_decl);
-+ unsigned int argnum;
-+ const struct size_overflow_hash *hash;
-+
-+ gcc_assert(TREE_CODE(arg) != COMPONENT_REF);
-+
-+ if (TREE_CODE(type) == POINTER_TYPE)
-+ return 0;
-+
-+ argnum = find_arg_number(arg, func);
-+ if (argnum == 0)
-+ return 0;
-+
-+ if (lookup_attribute("size_overflow", DECL_ATTRIBUTES(func)))
-+ return argnum;
-+
-+ hash = get_function_hash(func);
-+ if (!hash || !(hash->param & (1U << argnum))) {
-+ print_missing_msg(func, argnum);
-+ return 0;
-+ }
-+ return argnum;
-+}
-+
-+static bool is_already_marked(const_tree lhs)
-+{
-+ unsigned int argnum;
-+ const_tree fndecl;
-+
-+ argnum = search_missing_attribute(lhs);
-+ fndecl = get_original_function_decl(current_function_decl);
-+ if (argnum && mark_status(fndecl, argnum) == MARKED_YES)
-+ return true;
-+ return false;
-+}
-+
-+static bool pre_expand(struct pointer_set_t *visited, const_tree lhs)
-+{
-+ const_gimple def_stmt;
-+
-+ if (is_gimple_constant(lhs))
-+ return false;
-+
-+ if (skip_types(lhs))
-+ return false;
-+
-+ // skip char type (FIXME: only kernel)
-+ if (TYPE_MODE(TREE_TYPE(lhs)) == QImode)
-+ return false;
-+
-+ if (TREE_CODE(lhs) == PARM_DECL)
-+ return is_already_marked(lhs);
-+
-+ if (TREE_CODE(lhs) == COMPONENT_REF) {
-+ const_tree field, attr;
-+
-+ field = search_field_decl(lhs);
-+ attr = lookup_attribute("intentional_overflow", DECL_ATTRIBUTES(field));
-+ if (!attr || !TREE_VALUE(attr))
-+ return false;
-+ return true;
-+ }
-+
-+ def_stmt = get_def_stmt(lhs);
-+
-+ if (!def_stmt)
-+ return false;
-+
-+ if (pointer_set_contains(visited, def_stmt))
-+ return false;
-+
-+ switch (gimple_code(def_stmt)) {
-+ case GIMPLE_NOP:
-+ if (TREE_CODE(SSA_NAME_VAR(lhs)) == PARM_DECL)
-+ return is_already_marked(lhs);
-+ return false;
-+ case GIMPLE_PHI:
-+ return walk_phi(visited, lhs);
-+ case GIMPLE_CALL:
-+ case GIMPLE_ASM:
-+ return false;
-+ case GIMPLE_ASSIGN:
-+ switch (gimple_num_ops(def_stmt)) {
-+ case 2:
-+ return walk_unary_ops(visited, lhs);
-+ case 3:
-+ return walk_binary_ops(visited, lhs);
-+ }
-+ default:
-+ debug_gimple_stmt((gimple)def_stmt);
-+ error("%s: unknown gimple code", __func__);
-+ gcc_unreachable();
-+ }
-+}
-+
-+static bool search_attributes(tree fndecl, const_tree arg, unsigned int argnum)
-+{
-+ struct pointer_set_t *visited;
-+ bool is_found;
-+ enum marked is_marked;
-+ location_t loc;
-+
-+ visited = pointer_set_create();
-+ is_found = pre_expand(visited, arg);
-+ pointer_set_destroy(visited);
-+
-+ is_marked = mark_status(fndecl, argnum + 1);
-+ if ((is_found && is_marked == MARKED_YES) || is_marked == MARKED_NOT_INTENTIONAL)
-+ return true;
-+
-+ if (is_found) {
-+ loc = DECL_SOURCE_LOCATION(fndecl);
-+ inform(loc, "The intentional_overflow attribute is missing from +%s+%u+", get_asm_name(fndecl), argnum + 1);
-+ return true;
-+ }
-+ return false;
-+}
-+
-+static void handle_function_arg(gimple stmt, tree fndecl, unsigned int argnum)
-+{
-+ struct pointer_set_t *visited;
-+ tree arg, newarg;
-+ bool match;
-+
-+ match = get_function_arg(&argnum, fndecl);
-+ if (!match)
-+ return;
-+ gcc_assert(gimple_call_num_args(stmt) > argnum);
-+ arg = gimple_call_arg(stmt, argnum);
-+ if (arg == NULL_TREE)
-+ return;
-+
-+ if (is_gimple_constant(arg))
-+ return;
-+
-+ if (search_attributes(fndecl, arg, argnum))
-+ return;
-+
-+ if (TREE_CODE(arg) != SSA_NAME)
-+ return;
-+
-+ check_arg_type(arg);
-+
-+ visited = pointer_set_create();
-+ newarg = expand(visited, arg);
-+ pointer_set_destroy(visited);
-+
-+ if (newarg == NULL_TREE)
-+ return;
-+
-+ change_function_arg(stmt, arg, argnum, newarg);
-+
-+ check_size_overflow(stmt, TREE_TYPE(newarg), newarg, arg, BEFORE_STMT);
-+}
-+
-+static void handle_function_by_attribute(gimple stmt, const_tree attr, tree fndecl)
-+{
-+ tree p = TREE_VALUE(attr);
-+ do {
-+ handle_function_arg(stmt, fndecl, TREE_INT_CST_LOW(TREE_VALUE(p))-1);
-+ p = TREE_CHAIN(p);
-+ } while (p);
-+}
-+
-+static void handle_function_by_hash(gimple stmt, tree fndecl)
-+{
-+ tree orig_fndecl;
-+ unsigned int num;
-+ const struct size_overflow_hash *hash;
-+
-+ orig_fndecl = get_original_function_decl(fndecl);
-+ if (C_DECL_IMPLICIT(orig_fndecl))
-+ return;
-+ hash = get_function_hash(orig_fndecl);
-+ if (!hash)
-+ return;
-+
-+ for (num = 1; num <= MAX_PARAM; num++)
-+ if (hash->param & (1U << num))
-+ handle_function_arg(stmt, fndecl, num - 1);
-+}
-+
-+static void set_plf_false(void)
-+{
-+ basic_block bb;
-+
-+ FOR_ALL_BB(bb) {
-+ gimple_stmt_iterator si;
-+
-+ for (si = gsi_start_bb(bb); !gsi_end_p(si); gsi_next(&si))
-+ gimple_set_plf(gsi_stmt(si), MY_STMT, false);
-+ for (si = gsi_start_phis(bb); !gsi_end_p(si); gsi_next(&si))
-+ gimple_set_plf(gsi_stmt(si), MY_STMT, false);
-+ }
-+}
-+
-+static unsigned int handle_function(void)
-+{
-+ basic_block next, bb = ENTRY_BLOCK_PTR->next_bb;
-+
-+ set_plf_false();
-+
-+ do {
-+ gimple_stmt_iterator gsi;
-+ next = bb->next_bb;
-+
-+ for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
-+ tree fndecl, attr;
-+ gimple stmt = gsi_stmt(gsi);
-+
-+ if (!(is_gimple_call(stmt)))
-+ continue;
-+ fndecl = gimple_call_fndecl(stmt);
-+ if (fndecl == NULL_TREE)
-+ continue;
-+ if (gimple_call_num_args(stmt) == 0)
-+ continue;
-+ attr = lookup_attribute("size_overflow", DECL_ATTRIBUTES(fndecl));
-+ if (!attr || !TREE_VALUE(attr))
-+ handle_function_by_hash(stmt, fndecl);
-+ else
-+ handle_function_by_attribute(stmt, attr, fndecl);
-+ gsi = gsi_for_stmt(stmt);
-+ next = gimple_bb(stmt)->next_bb;
-+ }
-+ bb = next;
-+ } while (bb);
-+ return 0;
-+}
-+
-+static struct gimple_opt_pass size_overflow_pass = {
-+ .pass = {
-+ .type = GIMPLE_PASS,
-+ .name = "size_overflow",
-+#if BUILDING_GCC_VERSION >= 4008
-+ .optinfo_flags = OPTGROUP_NONE,
-+#endif
-+ .gate = NULL,
-+ .execute = handle_function,
-+ .sub = NULL,
-+ .next = NULL,
-+ .static_pass_number = 0,
-+ .tv_id = TV_NONE,
-+ .properties_required = PROP_cfg,
-+ .properties_provided = 0,
-+ .properties_destroyed = 0,
-+ .todo_flags_start = 0,
-+ .todo_flags_finish = TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_remove_unused_locals | TODO_update_ssa_no_phi | TODO_cleanup_cfg | TODO_ggc_collect | TODO_verify_flow
-+ }
-+};
-+
-+static void start_unit_callback(void __unused *gcc_data, void __unused *user_data)
-+{
-+ tree fntype;
-+
-+ const_char_ptr_type_node = build_pointer_type(build_type_variant(char_type_node, 1, 0));
-+
-+ // void report_size_overflow(const char *loc_file, unsigned int loc_line, const char *current_func, const char *ssa_var)
-+ fntype = build_function_type_list(void_type_node,
-+ const_char_ptr_type_node,
-+ unsigned_type_node,
-+ const_char_ptr_type_node,
-+ const_char_ptr_type_node,
-+ NULL_TREE);
-+ report_size_overflow_decl = build_fn_decl("report_size_overflow", fntype);
-+
-+ DECL_ASSEMBLER_NAME(report_size_overflow_decl);
-+ TREE_PUBLIC(report_size_overflow_decl) = 1;
-+ DECL_EXTERNAL(report_size_overflow_decl) = 1;
-+ DECL_ARTIFICIAL(report_size_overflow_decl) = 1;
-+ TREE_THIS_VOLATILE(report_size_overflow_decl) = 1;
-+}
-+
-+int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
-+{
-+ int i;
-+ const char * const plugin_name = plugin_info->base_name;
-+ const int argc = plugin_info->argc;
-+ const struct plugin_argument * const argv = plugin_info->argv;
-+ bool enable = true;
-+
-+ struct register_pass_info size_overflow_pass_info = {
-+ .pass = &size_overflow_pass.pass,
-+ .reference_pass_name = "ssa",
-+ .ref_pass_instance_number = 1,
-+ .pos_op = PASS_POS_INSERT_AFTER
-+ };
-+
-+ if (!plugin_default_version_check(version, &gcc_version)) {
-+ error(G_("incompatible gcc/plugin versions"));
-+ return 1;
-+ }
-+
-+ for (i = 0; i < argc; ++i) {
-+ if (!strcmp(argv[i].key, "no-size-overflow")) {
-+ enable = false;
-+ continue;
-+ }
-+ error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
-+ }
-+
-+ register_callback(plugin_name, PLUGIN_INFO, NULL, &size_overflow_plugin_info);
-+ if (enable) {
-+ register_callback("start_unit", PLUGIN_START_UNIT, &start_unit_callback, NULL);
-+ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &size_overflow_pass_info);
-+ }
-+ register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
-+
-+ return 0;
-+}
-diff --git a/tools/gcc/stackleak_plugin.c b/tools/gcc/stackleak_plugin.c
-new file mode 100644
-index 0000000..ac2901e
---- /dev/null
-+++ b/tools/gcc/stackleak_plugin.c
-@@ -0,0 +1,327 @@
-+/*
-+ * Copyright 2011-2013 by the PaX Team <pageexec@freemail.hu>
-+ * Licensed under the GPL v2
-+ *
-+ * Note: the choice of the license means that the compilation process is
-+ * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
-+ * but for the kernel it doesn't matter since it doesn't link against
-+ * any of the gcc libraries
-+ *
-+ * gcc plugin to help implement various PaX features
-+ *
-+ * - track lowest stack pointer
-+ *
-+ * TODO:
-+ * - initialize all local variables
-+ *
-+ * BUGS:
-+ * - none known
-+ */
-+#include "gcc-plugin.h"
-+#include "config.h"
-+#include "system.h"
-+#include "coretypes.h"
-+#include "tree.h"
-+#include "tree-pass.h"
-+#include "flags.h"
-+#include "intl.h"
-+#include "toplev.h"
-+#include "plugin.h"
-+//#include "expr.h" where are you...
-+#include "diagnostic.h"
-+#include "plugin-version.h"
-+#include "tm.h"
-+#include "function.h"
-+#include "basic-block.h"
-+#include "gimple.h"
-+#include "rtl.h"
-+#include "emit-rtl.h"
-+
-+#if BUILDING_GCC_VERSION >= 4008
-+#define TODO_dump_func 0
-+#endif
-+
-+extern void print_gimple_stmt(FILE *, gimple, int, int);
-+
-+int plugin_is_GPL_compatible;
-+
-+static int track_frame_size = -1;
-+static const char track_function[] = "pax_track_stack";
-+static const char check_function[] = "pax_check_alloca";
-+static bool init_locals;
-+
-+static struct plugin_info stackleak_plugin_info = {
-+ .version = "201302112000",
-+ .help = "track-lowest-sp=nn\ttrack sp in functions whose frame size is at least nn bytes\n"
-+// "initialize-locals\t\tforcibly initialize all stack frames\n"
-+};
-+
-+static bool gate_stackleak_track_stack(void);
-+static unsigned int execute_stackleak_tree_instrument(void);
-+static unsigned int execute_stackleak_final(void);
-+
-+static struct gimple_opt_pass stackleak_tree_instrument_pass = {
-+ .pass = {
-+ .type = GIMPLE_PASS,
-+ .name = "stackleak_tree_instrument",
-+#if BUILDING_GCC_VERSION >= 4008
-+ .optinfo_flags = OPTGROUP_NONE,
-+#endif
-+ .gate = gate_stackleak_track_stack,
-+ .execute = execute_stackleak_tree_instrument,
-+ .sub = NULL,
-+ .next = NULL,
-+ .static_pass_number = 0,
-+ .tv_id = TV_NONE,
-+ .properties_required = PROP_gimple_leh | PROP_cfg,
-+ .properties_provided = 0,
-+ .properties_destroyed = 0,
-+ .todo_flags_start = 0, //TODO_verify_ssa | TODO_verify_flow | TODO_verify_stmts,
-+ .todo_flags_finish = TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_update_ssa
-+ }
-+};
-+
-+static struct rtl_opt_pass stackleak_final_rtl_opt_pass = {
-+ .pass = {
-+ .type = RTL_PASS,
-+ .name = "stackleak_final",
-+#if BUILDING_GCC_VERSION >= 4008
-+ .optinfo_flags = OPTGROUP_NONE,
-+#endif
-+ .gate = gate_stackleak_track_stack,
-+ .execute = execute_stackleak_final,
-+ .sub = NULL,
-+ .next = NULL,
-+ .static_pass_number = 0,
-+ .tv_id = TV_NONE,
-+ .properties_required = 0,
-+ .properties_provided = 0,
-+ .properties_destroyed = 0,
-+ .todo_flags_start = 0,
-+ .todo_flags_finish = TODO_dump_func
-+ }
-+};
-+
-+static bool gate_stackleak_track_stack(void)
-+{
-+ return track_frame_size >= 0;
-+}
-+
-+static void stackleak_check_alloca(gimple_stmt_iterator *gsi)
-+{
-+ gimple check_alloca;
-+ tree fntype, fndecl, alloca_size;
-+
-+ fntype = build_function_type_list(void_type_node, long_unsigned_type_node, NULL_TREE);
-+ fndecl = build_fn_decl(check_function, fntype);
-+ DECL_ASSEMBLER_NAME(fndecl); // for LTO
-+
-+ // insert call to void pax_check_alloca(unsigned long size)
-+ alloca_size = gimple_call_arg(gsi_stmt(*gsi), 0);
-+ check_alloca = gimple_build_call(fndecl, 1, alloca_size);
-+ gsi_insert_before(gsi, check_alloca, GSI_SAME_STMT);
-+}
-+
-+static void stackleak_add_instrumentation(gimple_stmt_iterator *gsi)
-+{
-+ gimple track_stack;
-+ tree fntype, fndecl;
-+
-+ fntype = build_function_type_list(void_type_node, NULL_TREE);
-+ fndecl = build_fn_decl(track_function, fntype);
-+ DECL_ASSEMBLER_NAME(fndecl); // for LTO
-+
-+ // insert call to void pax_track_stack(void)
-+ track_stack = gimple_build_call(fndecl, 0);
-+ gsi_insert_after(gsi, track_stack, GSI_CONTINUE_LINKING);
-+}
-+
-+#if BUILDING_GCC_VERSION == 4005
-+static bool gimple_call_builtin_p(gimple stmt, enum built_in_function code)
-+{
-+ tree fndecl;
-+
-+ if (!is_gimple_call(stmt))
-+ return false;
-+ fndecl = gimple_call_fndecl(stmt);
-+ if (!fndecl)
-+ return false;
-+ if (DECL_BUILT_IN_CLASS(fndecl) != BUILT_IN_NORMAL)
-+ return false;
-+// print_node(stderr, "pax", fndecl, 4);
-+ return DECL_FUNCTION_CODE(fndecl) == code;
-+}
-+#endif
-+
-+static bool is_alloca(gimple stmt)
-+{
-+ if (gimple_call_builtin_p(stmt, BUILT_IN_ALLOCA))
-+ return true;
-+
-+#if BUILDING_GCC_VERSION >= 4007
-+ if (gimple_call_builtin_p(stmt, BUILT_IN_ALLOCA_WITH_ALIGN))
-+ return true;
-+#endif
-+
-+ return false;
-+}
-+
-+static unsigned int execute_stackleak_tree_instrument(void)
-+{
-+ basic_block bb, entry_bb;
-+ bool prologue_instrumented = false, is_leaf = true;
-+
-+ entry_bb = ENTRY_BLOCK_PTR_FOR_FUNCTION(cfun)->next_bb;
-+
-+ // 1. loop through BBs and GIMPLE statements
-+ FOR_EACH_BB(bb) {
-+ gimple_stmt_iterator gsi;
-+
-+ for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
-+ gimple stmt;
-+
-+ stmt = gsi_stmt(gsi);
-+
-+ if (is_gimple_call(stmt))
-+ is_leaf = false;
-+
-+ // gimple match: align 8 built-in BUILT_IN_NORMAL:BUILT_IN_ALLOCA attributes <tree_list 0xb7576450>
-+ if (!is_alloca(stmt))
-+ continue;
-+
-+ // 2. insert stack overflow check before each __builtin_alloca call
-+ stackleak_check_alloca(&gsi);
-+
-+ // 3. insert track call after each __builtin_alloca call
-+ stackleak_add_instrumentation(&gsi);
-+ if (bb == entry_bb)
-+ prologue_instrumented = true;
-+ }
-+ }
-+
-+ // special cases for some bad linux code: taking the address of static inline functions will materialize them
-+ // but we mustn't instrument some of them as the resulting stack alignment required by the function call ABI
-+ // will break other assumptions regarding the expected (but not otherwise enforced) register clobbering ABI.
-+ // case in point: native_save_fl on amd64 when optimized for size clobbers rdx if it were instrumented here.
-+ if (is_leaf && !TREE_PUBLIC(current_function_decl) && DECL_DECLARED_INLINE_P(current_function_decl))
-+ return 0;
-+ if (is_leaf && !strncmp(IDENTIFIER_POINTER(DECL_NAME(current_function_decl)), "_paravirt_", 10))
-+ return 0;
-+
-+ // 4. insert track call at the beginning
-+ if (!prologue_instrumented) {
-+ gimple_stmt_iterator gsi;
-+
-+ bb = split_block_after_labels(ENTRY_BLOCK_PTR)->dest;
-+ if (dom_info_available_p(CDI_DOMINATORS))
-+ set_immediate_dominator(CDI_DOMINATORS, bb, ENTRY_BLOCK_PTR);
-+ gsi = gsi_start_bb(bb);
-+ stackleak_add_instrumentation(&gsi);
-+ }
-+
-+ return 0;
-+}
-+
-+static unsigned int execute_stackleak_final(void)
-+{
-+ rtx insn, next;
-+
-+ if (cfun->calls_alloca)
-+ return 0;
-+
-+ // keep calls only if function frame is big enough
-+ if (get_frame_size() >= track_frame_size)
-+ return 0;
-+
-+ // 1. find pax_track_stack calls
-+ for (insn = get_insns(); insn; insn = next) {
-+ // rtl match: (call_insn 8 7 9 3 (call (mem (symbol_ref ("pax_track_stack") [flags 0x41] <function_decl 0xb7470e80 pax_track_stack>) [0 S1 A8]) (4)) -1 (nil) (nil))
-+ rtx body;
-+
-+ next = NEXT_INSN(insn);
-+ if (!CALL_P(insn))
-+ continue;
-+ body = PATTERN(insn);
-+ if (GET_CODE(body) != CALL)
-+ continue;
-+ body = XEXP(body, 0);
-+ if (GET_CODE(body) != MEM)
-+ continue;
-+ body = XEXP(body, 0);
-+ if (GET_CODE(body) != SYMBOL_REF)
-+ continue;
-+ if (strcmp(XSTR(body, 0), track_function))
-+ continue;
-+// warning(0, "track_frame_size: %d %ld %d", cfun->calls_alloca, get_frame_size(), track_frame_size);
-+ // 2. delete call
-+ delete_insn_and_edges(insn);
-+#if BUILDING_GCC_VERSION >= 4007
-+ if (GET_CODE(next) == NOTE && NOTE_KIND(next) == NOTE_INSN_CALL_ARG_LOCATION) {
-+ insn = next;
-+ next = NEXT_INSN(insn);
-+ delete_insn_and_edges(insn);
-+ }
-+#endif
-+ }
-+
-+// print_simple_rtl(stderr, get_insns());
-+// print_rtl(stderr, get_insns());
-+// warning(0, "track_frame_size: %d %ld %d", cfun->calls_alloca, get_frame_size(), track_frame_size);
-+
-+ return 0;
-+}
-+
-+int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
-+{
-+ const char * const plugin_name = plugin_info->base_name;
-+ const int argc = plugin_info->argc;
-+ const struct plugin_argument * const argv = plugin_info->argv;
-+ int i;
-+ struct register_pass_info stackleak_tree_instrument_pass_info = {
-+ .pass = &stackleak_tree_instrument_pass.pass,
-+// .reference_pass_name = "tree_profile",
-+ .reference_pass_name = "optimized",
-+ .ref_pass_instance_number = 1,
-+ .pos_op = PASS_POS_INSERT_BEFORE
-+ };
-+ struct register_pass_info stackleak_final_pass_info = {
-+ .pass = &stackleak_final_rtl_opt_pass.pass,
-+ .reference_pass_name = "final",
-+ .ref_pass_instance_number = 1,
-+ .pos_op = PASS_POS_INSERT_BEFORE
-+ };
-+
-+ if (!plugin_default_version_check(version, &gcc_version)) {
-+ error(G_("incompatible gcc/plugin versions"));
-+ return 1;
-+ }
-+
-+ register_callback(plugin_name, PLUGIN_INFO, NULL, &stackleak_plugin_info);
-+
-+ for (i = 0; i < argc; ++i) {
-+ if (!strcmp(argv[i].key, "track-lowest-sp")) {
-+ if (!argv[i].value) {
-+ error(G_("no value supplied for option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
-+ continue;
-+ }
-+ track_frame_size = atoi(argv[i].value);
-+ if (argv[i].value[0] < '0' || argv[i].value[0] > '9' || track_frame_size < 0)
-+ error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
-+ continue;
-+ }
-+ if (!strcmp(argv[i].key, "initialize-locals")) {
-+ if (argv[i].value) {
-+ error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
-+ continue;
-+ }
-+ init_locals = true;
-+ continue;
-+ }
-+ error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
-+ }
-+
-+ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &stackleak_tree_instrument_pass_info);
-+ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &stackleak_final_pass_info);
-+
-+ return 0;
-+}
-diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
-index 82b6fdc..57cc875 100644
---- a/virt/kvm/kvm_main.c
-+++ b/virt/kvm/kvm_main.c
-@@ -81,7 +81,12 @@ static cpumask_var_t cpus_hardware_enabled;
- struct kmem_cache *kvm_vcpu_cache;
- EXPORT_SYMBOL_GPL(kvm_vcpu_cache);
-
--static __read_mostly struct preempt_ops kvm_preempt_ops;
-+static void kvm_sched_in(struct preempt_notifier *pn, int cpu);
-+static void kvm_sched_out(struct preempt_notifier *pn, struct task_struct *next);
-+static struct preempt_ops kvm_preempt_ops = {
-+ .sched_in = kvm_sched_in,
-+ .sched_out = kvm_sched_out,
-+};
-
- struct dentry *kvm_debugfs_dir;
-
-@@ -1823,7 +1828,7 @@ static int kvm_vcpu_release(struct inode *inode, struct file *filp)
- return 0;
- }
-
--static struct file_operations kvm_vcpu_fops = {
-+static file_operations_no_const kvm_vcpu_fops __read_only = {
- .release = kvm_vcpu_release,
- .unlocked_ioctl = kvm_vcpu_ioctl,
- .compat_ioctl = kvm_vcpu_ioctl,
-@@ -2423,7 +2428,7 @@ static int kvm_vm_mmap(struct file *file, struct vm_area_struct *vma)
- return 0;
- }
-
--static struct file_operations kvm_vm_fops = {
-+static file_operations_no_const kvm_vm_fops __read_only = {
- .release = kvm_vm_release,
- .unlocked_ioctl = kvm_vm_ioctl,
- .compat_ioctl = kvm_vm_ioctl,
-@@ -2510,7 +2515,7 @@ out:
- return r;
- }
-
--static struct file_operations kvm_chardev_ops = {
-+static file_operations_no_const kvm_chardev_ops __read_only = {
- .unlocked_ioctl = kvm_dev_ioctl,
- .compat_ioctl = kvm_dev_ioctl,
- };
-@@ -2573,7 +2578,7 @@ asmlinkage void kvm_handle_fault_on_reboot(void)
- if (kvm_rebooting)
- /* spin while reset goes on */
- while (true)
-- ;
-+ cpu_relax();
- /* Fault while not rebooting. We want the trace. */
- BUG();
- }
-@@ -2793,7 +2798,7 @@ static void kvm_sched_out(struct preempt_notifier *pn,
- kvm_arch_vcpu_put(vcpu);
- }
-
--int kvm_init(void *opaque, unsigned int vcpu_size,
-+int kvm_init(const void *opaque, unsigned int vcpu_size,
- struct module *module)
- {
- int r;
-@@ -2846,15 +2851,17 @@ int kvm_init(void *opaque, unsigned int vcpu_size,
- /* A kmem cache lets us meet the alignment requirements of fx_save. */
- kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size,
- __alignof__(struct kvm_vcpu),
-- 0, NULL);
-+ SLAB_USERCOPY, NULL);
- if (!kvm_vcpu_cache) {
- r = -ENOMEM;
- goto out_free_5;
- }
-
-+ pax_open_kernel();
- kvm_chardev_ops.owner = module;
- kvm_vm_fops.owner = module;
- kvm_vcpu_fops.owner = module;
-+ pax_close_kernel();
-
- r = misc_register(&kvm_dev);
- if (r) {
-@@ -2862,9 +2869,6 @@ int kvm_init(void *opaque, unsigned int vcpu_size,
- goto out_free;
- }
-
-- kvm_preempt_ops.sched_in = kvm_sched_in;
-- kvm_preempt_ops.sched_out = kvm_sched_out;
--
- kvm_init_debug();
-
- return 0;
diff --git a/2.6.32/4430_grsec-remove-localversion-grsec.patch b/2.6.32/4430_grsec-remove-localversion-grsec.patch
deleted file mode 100644
index 31cf878..0000000
--- a/2.6.32/4430_grsec-remove-localversion-grsec.patch
+++ /dev/null
@@ -1,9 +0,0 @@
-From: Kerin Millar <kerframil@gmail.com>
-
-Remove grsecurity's localversion-grsec file as it is inconsistent with
-Gentoo's kernel practices and naming scheme.
-
---- a/localversion-grsec 2008-02-24 14:26:59.000000000 +0000
-+++ b/localversion-grsec 1970-01-01 01:00:00.000000000 +0100
-@@ -1 +0,0 @@
---grsec
diff --git a/2.6.32/4435_grsec-mute-warnings.patch b/2.6.32/4435_grsec-mute-warnings.patch
deleted file mode 100644
index 127d90d..0000000
--- a/2.6.32/4435_grsec-mute-warnings.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From: Anthony G. Basile <blueness@gentoo.org>
-Updated patch for 2.6.32.39.
-
-The credits/description from the original version of this patch remain accurate
-and are included below.
-
----
-From: Jory A. Pratt <anarchy@gentoo.org>
-Updated patch for kernel 2.6.32
-
-The credits/description from the original version of this patch remain accurate
-and are included below.
-
----
-From: Gordon Malm <gengor@gentoo.org>
-
-Updated patch for kernel series 2.6.24.
-
-The credits/description from the original version of this patch remain accurate
-and are included below.
-
----
-From: Alexander Gabert <gaberta@fh-trier.de>
-
-This patch removes the warnings introduced by grsec patch 2.1.9 and later.
-It removes the -W options added by the patch and restores the original
-warning flags of vanilla kernel versions.
-
-Acked-by: Christian Heim <phreak@gentoo.org>
----
-
---- a/Makefile 2011-12-12 15:01:59.000000000 -0500
-+++ b/Makefile 2011-12-12 15:03:19.000000000 -0500
-@@ -221,7 +221,7 @@
-
- HOSTCC = gcc
- HOSTCXX = g++
--HOSTCFLAGS = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -Wno-unused-parameter -Wno-missing-field-initializers -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
-+HOSTCFLAGS = -Wall -Wmissing-prototypes -Wstrict-prototypes -Wno-empty-body -Wno-unused-parameter -Wno-missing-field-initializers -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
- HOSTCFLAGS += $(call cc-option, -Wno-empty-body)
- HOSTCXXFLAGS = -O2 -Wall -W -fno-delete-null-pointer-checks
-
diff --git a/2.6.32/4440_grsec-remove-protected-paths.patch b/2.6.32/4440_grsec-remove-protected-paths.patch
deleted file mode 100644
index 38d465e..0000000
--- a/2.6.32/4440_grsec-remove-protected-paths.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-From: Anthony G. Basile <blueness@gentoo.org>
-
-We don't want GRSEC's Makefile to change permissions on paths in
-the filesystem.
-
-diff -Naur a/grsecurity/Makefile b/grsecurity/Makefile
---- a/grsecurity/Makefile 2011-10-19 19:48:21.000000000 -0400
-+++ b/grsecurity/Makefile 2011-10-19 19:50:44.000000000 -0400
-@@ -34,10 +34,4 @@
- ifdef CONFIG_GRKERNSEC_HIDESYM
- extra-y := grsec_hidesym.o
- $(obj)/grsec_hidesym.o:
-- @-chmod -f 500 /boot
-- @-chmod -f 500 /lib/modules
-- @-chmod -f 500 /lib64/modules
-- @-chmod -f 500 /lib32/modules
-- @-chmod -f 700 .
-- @echo ' grsec: protected kernel image paths'
- endif
diff --git a/2.6.32/4450_grsec-kconfig-default-gids.patch b/2.6.32/4450_grsec-kconfig-default-gids.patch
deleted file mode 100644
index 2de7db1..0000000
--- a/2.6.32/4450_grsec-kconfig-default-gids.patch
+++ /dev/null
@@ -1,111 +0,0 @@
-From: Anthony G. Basile <blueness@gentoo.org>
-Updated patch for the new Kconfig system in grsec 2.9.1
-
----
-From: Kerin Millar <kerframil@gmail.com>
-
-grsecurity contains a number of options which allow certain protections
-to be applied to or exempted from members of a given group. However, the
-default GIDs specified in the upstream patch are entirely arbitrary and
-there is no telling which (if any) groups the GIDs will correlate with
-on an end-user's system. Because some users don't pay a great deal of
-attention to the finer points of kernel configuration, it is probably
-wise to specify some reasonable defaults so as to stop careless users
-from shooting themselves in the foot.
-
-diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
---- a/grsecurity/Kconfig 2012-10-13 09:51:35.000000000 -0400
-+++ b/grsecurity/Kconfig 2012-10-13 09:52:32.000000000 -0400
-@@ -572,7 +572,7 @@
- config GRKERNSEC_AUDIT_GID
- int "GID for auditing"
- depends on GRKERNSEC_AUDIT_GROUP
-- default 1007
-+ default 100
-
- config GRKERNSEC_EXECLOG
- bool "Exec logging"
-@@ -792,7 +792,7 @@
- config GRKERNSEC_TPE_UNTRUSTED_GID
- int "GID for TPE-untrusted users"
- depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
-- default 1005
-+ default 100
- help
- Setting this GID determines what group TPE restrictions will be
- *enabled* for. If the sysctl option is enabled, a sysctl option
-@@ -801,7 +801,7 @@
- config GRKERNSEC_TPE_TRUSTED_GID
- int "GID for TPE-trusted users"
- depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
-- default 1005
-+ default 10
- help
- Setting this GID determines what group TPE restrictions will be
- *disabled* for. If the sysctl option is enabled, a sysctl option
-@@ -894,7 +894,7 @@
- config GRKERNSEC_SOCKET_ALL_GID
- int "GID to deny all sockets for"
- depends on GRKERNSEC_SOCKET_ALL
-- default 1004
-+ default 65534
- help
- Here you can choose the GID to disable socket access for. Remember to
- add the users you want socket access disabled for to the GID
-@@ -915,7 +915,7 @@
- config GRKERNSEC_SOCKET_CLIENT_GID
- int "GID to deny client sockets for"
- depends on GRKERNSEC_SOCKET_CLIENT
-- default 1003
-+ default 65534
- help
- Here you can choose the GID to disable client socket access for.
- Remember to add the users you want client socket access disabled for to
-@@ -933,7 +933,7 @@
- config GRKERNSEC_SOCKET_SERVER_GID
- int "GID to deny server sockets for"
- depends on GRKERNSEC_SOCKET_SERVER
-- default 1002
-+ default 65534
- help
- Here you can choose the GID to disable server socket access for.
- Remember to add the users you want server socket access disabled for to
-diff -Nuar a/security/Kconfig b/security/Kconfig
---- a/security/Kconfig 2012-10-13 09:51:35.000000000 -0400
-+++ b/security/Kconfig 2012-10-13 09:52:59.000000000 -0400
-@@ -192,7 +192,7 @@
-
- config GRKERNSEC_PROC_GID
- int "GID exempted from /proc restrictions"
-- default 1001
-+ default 10
- help
- Setting this GID determines which group will be exempted from
- grsecurity's /proc restrictions, allowing users of the specified
-@@ -203,7 +203,7 @@
- config GRKERNSEC_TPE_UNTRUSTED_GID
- int "GID for TPE-untrusted users"
- depends on GRKERNSEC_CONFIG_SERVER && GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
-- default 1005
-+ default 100
- help
- Setting this GID determines which group untrusted users should
- be added to. These users will be placed under grsecurity's Trusted Path
-@@ -215,7 +215,7 @@
- config GRKERNSEC_TPE_TRUSTED_GID
- int "GID for TPE-trusted users"
- depends on GRKERNSEC_CONFIG_SERVER && GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
-- default 1005
-+ default 10
- help
- Setting this GID determines what group TPE restrictions will be
- *disabled* for. If the sysctl option is enabled, a sysctl option
-@@ -224,7 +224,7 @@
- config GRKERNSEC_SYMLINKOWN_GID
- int "GID for users with kernel-enforced SymlinksIfOwnerMatch"
- depends on GRKERNSEC_CONFIG_SERVER
-- default 1006
-+ default 100
- help
- Setting this GID determines what group kernel-enforced
- SymlinksIfOwnerMatch will be enabled for. If the sysctl option
diff --git a/2.6.32/4465_selinux-avc_audit-log-curr_ip.patch b/2.6.32/4465_selinux-avc_audit-log-curr_ip.patch
deleted file mode 100644
index 418ae16..0000000
--- a/2.6.32/4465_selinux-avc_audit-log-curr_ip.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-From: Anthony G. Basile <blueness@gentoo.org>
-
-Removed deprecated NIPQUAD macro in favor of %pI4.
-See bug #346333.
-
----
-From: Gordon Malm <gengor@gentoo.org>
-
-This is a reworked version of the original
-*_selinux-avc_audit-log-curr_ip.patch carried in earlier releases of
-hardened-sources.
-
-Dropping the patch, or simply fixing the #ifdef of the original patch
-could break automated logging setups so this route was necessary.
-
-Suggestions for improving the help text are welcome.
-
-The original patch's description is still accurate and included below.
-
----
-Provides support for a new field ipaddr within the SELinux
-AVC audit log, relying in task_struct->curr_ip (ipv4 only)
-provided by grSecurity patch to be applied before.
-
-Signed-off-by: Lorenzo Hernandez Garcia-Hierro <lorenzo@gnu.org>
----
-
-diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
---- a/grsecurity/Kconfig 2011-04-17 18:47:02.000000000 -0400
-+++ b/grsecurity/Kconfig 2011-04-17 18:51:15.000000000 -0400
-@@ -1027,6 +1027,27 @@
- menu "Logging Options"
- depends on GRKERNSEC
-
-+config GRKERNSEC_SELINUX_AVC_LOG_IPADDR
-+ def_bool n
-+ prompt "Add source IP address to SELinux AVC log messages"
-+ depends on GRKERNSEC && SECURITY_SELINUX
-+ help
-+ If you say Y here, a new field "ipaddr=" will be added to many SELinux
-+ AVC log messages. The value of this field in any given message
-+ represents the source IP address of the remote machine/user that created
-+ the offending process.
-+
-+ This information is sourced from task_struct->curr_ip provided by
-+ grsecurity's GRKERNSEC top-level configuration option. One limitation
-+ is that only IPv4 is supported.
-+
-+ In many instances SELinux AVC log messages already log a superior level
-+ of information that also includes source port and destination ip/port.
-+ Additionally, SELinux's AVC log code supports IPv6.
-+
-+ However, grsecurity's task_struct->curr_ip will sometimes (often?)
-+ provide the offender's IP address where stock SELinux logging fails to.
-+
- config GRKERNSEC_FLOODTIME
- int "Seconds in between log messages (minimum)"
- default 10
-diff -Naur a/security/selinux/avc.c b/security/selinux/avc.c
---- a/security/selinux/avc.c 2009-12-02 22:51:21.000000000 -0500
-+++ b/security/selinux/avc.c 2011-04-17 18:51:15.000000000 -0400
-@@ -203,6 +203,11 @@
- char *scontext;
- u32 scontext_len;
-
-+#ifdef CONFIG_GRKERNSEC_SELINUX_AVC_LOG_IPADDR
-+ if (current->signal->curr_ip)
-+ audit_log_format(ab, "ipaddr=%pI4 ", ¤t->signal->curr_ip);
-+#endif
-+
- rc = security_sid_to_context(ssid, &scontext, &scontext_len);
- if (rc)
- audit_log_format(ab, "ssid=%d", ssid);
diff --git a/2.6.32/4470_disable-compat_vdso.patch b/2.6.32/4470_disable-compat_vdso.patch
deleted file mode 100644
index c3762ce..0000000
--- a/2.6.32/4470_disable-compat_vdso.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-No need to wrap vdso calls as gentoo does not use any version of
-glibc <=2.3.3
----
-From: Gordon Malm <gengor@gentoo.org>
-From: Kerin Millar <kerframil@gmail.com>
-From: Jory A. Pratt <anarchy@gentoo.org>
-
-COMPAT_VDSO is inappropriate for any modern Hardened Gentoo system. It
-conflicts with various parts of PaX, crashing the system if enabled
-while PaX's NOEXEC or UDEREF features are active. Moreover, it prevents
-a number of important PaX options from appearing in the configuration
-menu, including all PaX NOEXEC implementations. Unfortunately, the
-reason for the disappearance of these PaX configuration options is
-often far from obvious to inexperienced users.
-
-Therefore, we disable the COMPAT_VDSO menu entry entirely. However,
-COMPAT_VDSO operation can still be enabled via bootparam and sysctl
-interfaces. Consequently, we must also disable the ability to select
-COMPAT_VDSO operation at boot or runtime. Here we patch the kernel so
-that selecting COMPAT_VDSO operation at boot/runtime has no effect if
-conflicting PaX options are enabled, leaving VDSO_ENABLED operation
-intact.
-
-Closes bug: http://bugs.gentoo.org/show_bug.cgi?id=210138
-
-diff -Naur a/arch/x86/Kconfig b/arch/x86/Kconfig
---- a/arch/x86/Kconfig 2013-02-18 05:43:19.000000000 -0500
-+++ b/arch/x86/Kconfig 2013-02-18 06:08:57.000000000 -0500
-@@ -1626,17 +1626,8 @@
-
- config COMPAT_VDSO
- def_bool n
-- prompt "Compat VDSO support"
- depends on X86_32 || IA32_EMULATION
- depends on !PAX_PAGEEXEC && !PAX_SEGMEXEC && !PAX_KERNEXEC && !PAX_MEMORY_UDEREF
-- ---help---
-- Map the 32-bit VDSO to the predictable old-style address too.
-- ---help---
-- Say N here if you are running a sufficiently recent glibc
-- version (2.3.3 or later), to remove the high-mapped
-- VDSO mapping and to exclusively use the randomized VDSO.
--
-- If unsure, say Y.
-
- config CMDLINE_BOOL
- bool "Built-in kernel command line"
diff --git a/2.6.32/4475_emutramp_default_on.patch b/2.6.32/4475_emutramp_default_on.patch
deleted file mode 100644
index c7647c0..0000000
--- a/2.6.32/4475_emutramp_default_on.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-From: Anthony G. Basile <blueness@gentoo.org>
-
-PAX_EMUTRAMP is needed for libffi to avoid RWX mmap-ings using PaX emulation of trampolines.
-We default PAX_EMUTRAMP='y' since almost all hardened users will want this.
-
-See bug:
- http://bugs.gentoo.org/show_bug.cgi?id=329499
- http://bugs.gentoo.org/show_bug.cgi?id=457194
-
-diff -Naur linux-3.9.2-hardened.orig/security/Kconfig linux-3.9.2-hardened/security/Kconfig
---- linux-3.9.2-hardened.orig/security/Kconfig 2013-05-18 08:53:41.000000000 -0400
-+++ linux-3.9.2-hardened/security/Kconfig 2013-05-18 09:17:57.000000000 -0400
-@@ -425,7 +425,7 @@
-
- config PAX_EMUTRAMP
- bool "Emulate trampolines" if (PAX_PAGEEXEC || PAX_SEGMEXEC) && (PARISC || X86)
-- default y if PARISC
-+ default y
- help
- There are some programs and libraries that for one reason or
- another attempt to execute special small code snippets from
diff --git a/2.6.32/4480_check_ssp_fix.patch b/2.6.32/4480_check_ssp_fix.patch
deleted file mode 100644
index 40e0467..0000000
--- a/2.6.32/4480_check_ssp_fix.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-2010-03-31 Magnus Granberg <zorry@gentoo.org>
-
- #312335
- arch/x86/Makefile: Add KBUILD_CPPFLAGS to the SSP test
- commandline for else it build that file with -fPIE
-
---- a/arch/x86/Makefile 2010-03-31 16:39:32.000000000 +0200
-+++ b/arch/x86/Makefile 2010-03-31 16:36:53.000000000 +0200
-@@ -75,7 +75,7 @@
-
- ifdef CONFIG_CC_STACKPROTECTOR
- cc_has_sp := $(srctree)/scripts/gcc-x86_$(BITS)-has-stack-protector.sh
-- ifeq ($(shell $(CONFIG_SHELL) $(cc_has_sp) $(CC) $(biarch)),y)
-+ ifeq ($(shell $(CONFIG_SHELL) $(cc_has_sp) $(CC) $(KBUILD_CPPFLAGS) $(biarch)),y)
- stackp-y := -fstack-protector
- KBUILD_CFLAGS += $(stackp-y)
- else
^ permalink raw reply related [flat|nested] 13+ messages in thread* [gentoo-commits] proj/hardened-patchset:master commit in: 2.6.32/
@ 2013-02-19 12:54 Anthony G. Basile
0 siblings, 0 replies; 13+ messages in thread
From: Anthony G. Basile @ 2013-02-19 12:54 UTC (permalink / raw
To: gentoo-commits
commit: 61d59d38f1ed4968fcbe391e81bb7ad68cca41de
Author: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Tue Feb 19 12:54:24 2013 +0000
Commit: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Tue Feb 19 12:54:24 2013 +0000
URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-patchset.git;a=commit;h=61d59d38
grsecurity-2.9.1-2.6.32.60-201302181144: fix check_heap_stack_gap
---
..._grsecurity-2.9.1-2.6.32.60-201302181144.patch} | 38 ++++++++++++++------
1 files changed, 27 insertions(+), 11 deletions(-)
diff --git a/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201302171807.patch b/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201302181144.patch
similarity index 99%
rename from 2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201302171807.patch
rename to 2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201302181144.patch
index 7e2e5c8..88490c1 100644
--- a/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201302171807.patch
+++ b/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201302181144.patch
@@ -3388,10 +3388,18 @@ index 14dde4c..dc68acf 100644
and t0, t1, t0
bnez t0, trace_a_syscall
diff --git a/arch/mips/kernel/syscall.c b/arch/mips/kernel/syscall.c
-index 3f7f466..3abe0b5 100644
+index 3f7f466..311c777 100644
--- a/arch/mips/kernel/syscall.c
+++ b/arch/mips/kernel/syscall.c
-@@ -102,17 +102,21 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
+@@ -78,6 +78,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
+ struct vm_area_struct * vmm;
+ int do_color_align;
+ unsigned long task_size;
++ unsigned long offset = gr_rand_threadstack_offset(current->mm, filp, flags);
+
+ task_size = STACK_TOP;
+
+@@ -102,17 +103,21 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
do_color_align = 0;
if (filp || (flags & MAP_SHARED))
do_color_align = 1;
@@ -3408,7 +3416,7 @@ index 3f7f466..3abe0b5 100644
vmm = find_vma(current->mm, addr);
- if (task_size - len >= addr &&
- (!vmm || addr + len <= vmm->vm_start))
-+ if (task_size - len >= addr && check_heap_stack_gap(vmm, addr, len))
++ if (task_size - len >= addr && check_heap_stack_gap(vmm, addr, len, offset))
return addr;
}
- addr = TASK_UNMAPPED_BASE;
@@ -3416,12 +3424,12 @@ index 3f7f466..3abe0b5 100644
if (do_color_align)
addr = COLOUR_ALIGN(addr, pgoff);
else
-@@ -122,7 +126,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
+@@ -122,7 +127,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
/* At this point: (!vmm || addr < vmm->vm_end). */
if (task_size - len < addr)
return -ENOMEM;
- if (!vmm || addr + len <= vmm->vm_start)
-+ if (check_heap_stack_gap(vmm, addr, len))
++ if (check_heap_stack_gap(vmm, addr, len, offset))
return addr;
addr = vmm->vm_end;
if (do_color_align)
@@ -80324,10 +80332,18 @@ index 43022f3..7298079 100644
if (!sbi)
return -ENOMEM;
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
-index 2179de8..d1993f6 100644
+index 2179de8..2410bd6 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
-@@ -146,6 +146,10 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
+@@ -134,6 +134,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
+ struct vm_area_struct *vma;
+ unsigned long start_addr;
+ struct hstate *h = hstate_file(file);
++ unsigned long offset = gr_rand_threadstack_offset(mm, file, flags);
+
+ if (len & ~huge_page_mask(h))
+ return -EINVAL;
+@@ -146,6 +147,10 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
return addr;
}
@@ -80338,7 +80354,7 @@ index 2179de8..d1993f6 100644
if (addr) {
addr = ALIGN(addr, huge_page_size(h));
vma = find_vma(mm, addr);
-@@ -157,7 +161,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
+@@ -157,7 +162,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
start_addr = mm->free_area_cache;
if (len <= mm->cached_hole_size)
@@ -80347,7 +80363,7 @@ index 2179de8..d1993f6 100644
full_search:
addr = ALIGN(start_addr, huge_page_size(h));
-@@ -169,14 +173,14 @@ full_search:
+@@ -169,14 +174,14 @@ full_search:
* Start a new search - just in case we missed
* some holes.
*/
@@ -80361,11 +80377,11 @@ index 2179de8..d1993f6 100644
}
- if (!vma || addr + len <= vma->vm_start)
-+ if (check_heap_stack_gap(vma, addr, len))
++ if (check_heap_stack_gap(vma, addr, len, offset))
return addr;
addr = ALIGN(vma->vm_end, huge_page_size(h));
}
-@@ -897,7 +901,7 @@ static struct file_system_type hugetlbfs_fs_type = {
+@@ -897,7 +902,7 @@ static struct file_system_type hugetlbfs_fs_type = {
.kill_sb = kill_litter_super,
};
^ permalink raw reply related [flat|nested] 13+ messages in thread* [gentoo-commits] proj/hardened-patchset:master commit in: 2.6.32/
@ 2013-02-11 0:23 Anthony G. Basile
0 siblings, 0 replies; 13+ messages in thread
From: Anthony G. Basile @ 2013-02-11 0:23 UTC (permalink / raw
To: gentoo-commits
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=UTF-8, Size: 4223243 bytes --]
commit: 02d7f4adc3ff0dfce6167ba3634b645bf5971031
Author: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Mon Feb 11 00:22:51 2013 +0000
Commit: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Mon Feb 11 00:22:51 2013 +0000
URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-patchset.git;a=commit;h=02d7f4ad
remove 2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201302071937.patch
---
...0_grsecurity-2.9.1-2.6.32.60-201302071937.patch |126960 --------------------
1 files changed, 0 insertions(+), 126960 deletions(-)
diff --git a/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201302071937.patch b/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201302071937.patch
deleted file mode 100644
index ffae5a9..0000000
--- a/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201302071937.patch
+++ /dev/null
@@ -1,126960 +0,0 @@
-diff --git a/Documentation/dontdiff b/Documentation/dontdiff
-index e1efc40..3569a2f 100644
---- a/Documentation/dontdiff
-+++ b/Documentation/dontdiff
-@@ -1,15 +1,20 @@
- *.a
- *.aux
- *.bin
-+*.c.[012].*
-+*.cis
- *.cpio
- *.csp
-+*.dbg
- *.dsp
- *.dvi
- *.elf
- *.eps
- *.fw
-+*.gcno
- *.gen.S
- *.gif
-+*.gmo
- *.grep
- *.grp
- *.gz
-@@ -38,22 +43,30 @@
- *.tab.h
- *.tex
- *.ver
-+*.vim
- *.xml
- *_MODULES
-+*_reg_safe.h
- *_vga16.c
- *~
- *.9
- *.9.gz
--.*
-+.[^g]*
-+.gen*
- .mm
- 53c700_d.h
- CVS
- ChangeSet
-+GPATH
-+GRTAGS
-+GSYMS
-+GTAGS
- Image
- Kerntypes
- Module.markers
- Module.symvers
- PENDING
-+PERF*
- SCCS
- System.map*
- TAGS
-@@ -62,6 +75,7 @@ aic7*reg_print.c*
- aic7*seq.h*
- aicasm
- aicdb.h*
-+ashldi3.S
- asm-offsets.h
- asm_offsets.h
- autoconf.h*
-@@ -76,7 +90,11 @@ btfixupprep
- build
- bvmlinux
- bzImage*
-+capability_names.h
-+capflags.c
- classlist.h*
-+clut_vga16.c
-+common-cmds.h
- comp*.log
- compile.h*
- conf
-@@ -84,6 +102,8 @@ config
- config-*
- config_data.h*
- config_data.gz*
-+config.c
-+config.tmp
- conmakehash
- consolemap_deftbl.c*
- cpustr.h
-@@ -97,19 +117,23 @@ elfconfig.h*
- fixdep
- fore200e_mkfirm
- fore200e_pca_fw.c*
-+gate.lds
- gconf
- gen-devlist
- gen_crc32table
- gen_init_cpio
- genksyms
- *_gray256.c
-+hash
-+hid-example
- ihex2fw
- ikconfig.h*
- initramfs_data.cpio
-+initramfs_data.cpio.bz2
- initramfs_data.cpio.gz
- initramfs_list
- kallsyms
--kconfig
-+kern_constants.h
- keywords.c
- ksym.c*
- ksym.h*
-@@ -117,6 +141,7 @@ kxgettext
- lkc_defs.h
- lex.c
- lex.*.c
-+lib1funcs.S
- logo_*.c
- logo_*_clut224.c
- logo_*_mono.c
-@@ -127,13 +152,16 @@ machtypes.h
- map
- maui_boot.h
- mconf
-+mdp
- miboot*
- mk_elfconfig
- mkboot
- mkbugboot
- mkcpustr
- mkdep
-+mkpiggy
- mkprep
-+mkregtable
- mktables
- mktree
- modpost
-@@ -149,6 +177,7 @@ patches*
- pca200e.bin
- pca200e_ecd.bin2
- piggy.gz
-+piggy.S
- piggyback
- pnmtologo
- ppc_defs.h*
-@@ -157,12 +186,16 @@ qconf
- raid6altivec*.c
- raid6int*.c
- raid6tables.c
-+regdb.c
- relocs
-+rlim_names.h
- series
- setup
- setup.bin
- setup.elf
-+size_overflow_hash.h
- sImage
-+slabinfo
- sm_tbl*
- split-include
- syscalltab.h
-@@ -171,6 +204,7 @@ tftpboot.img
- timeconst.h
- times.h*
- trix_boot.h
-+user_constants.h
- utsrelease.h*
- vdso-syms.lds
- vdso.lds
-@@ -186,14 +220,20 @@ version.h*
- vmlinux
- vmlinux-*
- vmlinux.aout
-+vmlinux.bin.all
-+vmlinux.bin.bz2
- vmlinux.lds
-+vmlinux.relocs
-+voffset.h
- vsyscall.lds
- vsyscall_32.lds
- wanxlfw.inc
- uImage
- unifdef
-+utsrelease.h
- wakeup.bin
- wakeup.elf
- wakeup.lds
- zImage*
- zconf.hash.c
-+zoffset.h
-diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
-index 14c7fb0..0f7d099 100644
---- a/Documentation/kernel-parameters.txt
-+++ b/Documentation/kernel-parameters.txt
-@@ -806,6 +806,9 @@ and is between 256 and 4096 characters. It is defined in the file
- gpt [EFI] Forces disk with valid GPT signature but
- invalid Protective MBR to be treated as GPT.
-
-+ grsec_proc_gid= [GRKERNSEC_PROC_USERGROUP] Chooses GID to
-+ ignore grsecurity's /proc restrictions
-+
- gvp11= [HW,SCSI]
-
- hashdist= [KNL,NUMA] Large hashes allocated during boot
-@@ -856,6 +859,12 @@ and is between 256 and 4096 characters. It is defined in the file
- If specified, z/VM IUCV HVC accepts connections
- from listed z/VM user IDs only.
-
-+ keep_bootcon [KNL]
-+ Do not unregister boot console at start. This is only
-+ useful for debugging when something happens in the window
-+ between unregistering the boot console and initializing
-+ the real console.
-+
- i2c_bus= [HW] Override the default board specific I2C bus speed
- or register an additional I2C bus that is not
- registered from board initialization code.
-@@ -1842,6 +1851,13 @@ and is between 256 and 4096 characters. It is defined in the file
- the specified number of seconds. This is to be used if
- your oopses keep scrolling off the screen.
-
-+ pax_nouderef [X86] disables UDEREF. Most likely needed under certain
-+ virtualization environments that don't cope well with the
-+ expand down segment used by UDEREF on X86-32 or the frequent
-+ page table updates on X86-64.
-+
-+ pax_softmode= 0/1 to disable/enable PaX softmode on boot already.
-+
- pcbit= [HW,ISDN]
-
- pcd. [PARIDE]
-diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
-index fbe427a..195ff43 100644
---- a/Documentation/networking/ip-sysctl.txt
-+++ b/Documentation/networking/ip-sysctl.txt
-@@ -479,6 +479,11 @@ tcp_dma_copybreak - INTEGER
- and CONFIG_NET_DMA is enabled.
- Default: 4096
-
-+tcp_challenge_ack_limit - INTEGER
-+ Limits number of Challenge ACK sent per second, as recommended
-+ in RFC 5961 (Improving TCP's Robustness to Blind In-Window Attacks)
-+ Default: 100
-+
- UDP variables:
-
- udp_mem - vector of 3 INTEGERs: min, pressure, max
-diff --git a/MAINTAINERS b/MAINTAINERS
-index 334258c..1e8f4ff 100644
---- a/MAINTAINERS
-+++ b/MAINTAINERS
-@@ -5725,6 +5725,14 @@ L: netdev@vger.kernel.org
- S: Maintained
- F: drivers/net/vmxnet3/
-
-+VMware PVSCSI driver
-+M: Alok Kataria <akataria@vmware.com>
-+M: VMware PV-Drivers <pv-drivers@vmware.com>
-+L: linux-scsi@vger.kernel.org
-+S: Maintained
-+F: drivers/scsi/vmw_pvscsi.c
-+F: drivers/scsi/vmw_pvscsi.h
-+
- VOLTAGE AND CURRENT REGULATOR FRAMEWORK
- M: Liam Girdwood <lrg@slimlogic.co.uk>
- M: Mark Brown <broonie@opensource.wolfsonmicro.com>
-diff --git a/Makefile b/Makefile
-index b0e245e..e5894da 100644
---- a/Makefile
-+++ b/Makefile
-@@ -221,8 +221,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
-
- HOSTCC = gcc
- HOSTCXX = g++
--HOSTCFLAGS = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
--HOSTCXXFLAGS = -O2
-+HOSTCFLAGS = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -Wno-unused-parameter -Wno-missing-field-initializers -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
-+HOSTCFLAGS += $(call cc-option, -Wno-empty-body)
-+HOSTCXXFLAGS = -O2 -Wall -W -fno-delete-null-pointer-checks
-
- # Decide whether to build built-in, modular, or both.
- # Normally, just do built-in.
-@@ -376,8 +377,8 @@ export RCS_TAR_IGNORE := --exclude SCCS --exclude BitKeeper --exclude .svn --exc
- # Rules shared between *config targets and build targets
-
- # Basic helpers built in scripts/
--PHONY += scripts_basic
--scripts_basic:
-+PHONY += scripts_basic gcc-plugins
-+scripts_basic: gcc-plugins
- $(Q)$(MAKE) $(build)=scripts/basic
-
- # To avoid any implicit rule to kick in, define an empty command.
-@@ -403,7 +404,7 @@ endif
- # of make so .config is not included in this case either (for *config).
-
- no-dot-config-targets := clean mrproper distclean \
-- cscope TAGS tags help %docs check% \
-+ cscope gtags TAGS tags help %docs check% \
- include/linux/version.h headers_% \
- kernelrelease kernelversion
-
-@@ -526,6 +527,60 @@ else
- KBUILD_CFLAGS += -O2
- endif
-
-+ifndef DISABLE_PAX_PLUGINS
-+PLUGINCC := $(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-plugin.sh "$(HOSTCC)" "$(HOSTCXX)" "$(CC)")
-+ifneq ($(PLUGINCC),)
-+ifndef DISABLE_PAX_CONSTIFY_PLUGIN
-+ifndef CONFIG_UML
-+CONSTIFY_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/constify_plugin.so -DCONSTIFY_PLUGIN
-+endif
-+endif
-+ifdef CONFIG_PAX_MEMORY_STACKLEAK
-+STACKLEAK_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/stackleak_plugin.so -DSTACKLEAK_PLUGIN
-+STACKLEAK_PLUGIN_CFLAGS += -fplugin-arg-stackleak_plugin-track-lowest-sp=100
-+endif
-+ifdef CONFIG_KALLOCSTAT_PLUGIN
-+KALLOCSTAT_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/kallocstat_plugin.so
-+endif
-+ifdef CONFIG_PAX_KERNEXEC_PLUGIN
-+KERNEXEC_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/kernexec_plugin.so
-+KERNEXEC_PLUGIN_CFLAGS += -fplugin-arg-kernexec_plugin-method=$(CONFIG_PAX_KERNEXEC_PLUGIN_METHOD) -DKERNEXEC_PLUGIN
-+KERNEXEC_PLUGIN_AFLAGS := -DKERNEXEC_PLUGIN
-+endif
-+ifdef CONFIG_CHECKER_PLUGIN
-+ifeq ($(call cc-ifversion, -ge, 0406, y), y)
-+CHECKER_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/checker_plugin.so -DCHECKER_PLUGIN
-+endif
-+endif
-+COLORIZE_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/colorize_plugin.so
-+ifdef CONFIG_PAX_SIZE_OVERFLOW
-+SIZE_OVERFLOW_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/size_overflow_plugin.so -DSIZE_OVERFLOW_PLUGIN
-+endif
-+ifdef CONFIG_PAX_LATENT_ENTROPY
-+LATENT_ENTROPY_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/latent_entropy_plugin.so -DLATENT_ENTROPY_PLUGIN
-+endif
-+GCC_PLUGINS_CFLAGS := $(CONSTIFY_PLUGIN_CFLAGS) $(STACKLEAK_PLUGIN_CFLAGS) $(KALLOCSTAT_PLUGIN_CFLAGS)
-+GCC_PLUGINS_CFLAGS += $(KERNEXEC_PLUGIN_CFLAGS) $(CHECKER_PLUGIN_CFLAGS) $(COLORIZE_PLUGIN_CFLAGS)
-+GCC_PLUGINS_CFLAGS += $(SIZE_OVERFLOW_PLUGIN_CFLAGS) $(LATENT_ENTROPY_PLUGIN_CFLAGS)
-+GCC_PLUGINS_AFLAGS := $(KERNEXEC_PLUGIN_AFLAGS)
-+export PLUGINCC CONSTIFY_PLUGIN
-+ifeq ($(KBUILD_EXTMOD),)
-+gcc-plugins:
-+ $(Q)$(MAKE) $(build)=tools/gcc
-+else
-+gcc-plugins: ;
-+endif
-+else
-+gcc-plugins:
-+ifeq ($(call cc-ifversion, -ge, 0405, y), y)
-+ $(error Your gcc installation does not support plugins. If the necessary headers for plugin support are missing, they should be installed. On Debian, apt-get install gcc-<ver>-plugin-dev. If you choose to ignore this error and lessen the improvements provided by this patch, re-run make with the DISABLE_PAX_PLUGINS=y argument.))
-+else
-+ $(Q)echo "warning, your gcc version does not support plugins, you should upgrade it to gcc 4.5 at least"
-+endif
-+ $(Q)echo "PAX_MEMORY_STACKLEAK and constification will be less secure"
-+endif
-+endif
-+
- include $(srctree)/arch/$(SRCARCH)/Makefile
-
- ifneq ($(CONFIG_FRAME_WARN),0)
-@@ -647,7 +702,7 @@ export mod_strip_cmd
-
-
- ifeq ($(KBUILD_EXTMOD),)
--core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
-+core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
-
- vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
- $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
-@@ -868,6 +923,8 @@ vmlinux.o: $(modpost-init) $(vmlinux-main) FORCE
-
- # The actual objects are generated when descending,
- # make sure no implicit rule kicks in
-+$(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
-+$(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
- $(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): $(vmlinux-dirs) ;
-
- # Handle descending into subdirectories listed in $(vmlinux-dirs)
-@@ -877,7 +934,7 @@ $(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): $(vmlinux-dirs) ;
- # Error messages still appears in the original language
-
- PHONY += $(vmlinux-dirs)
--$(vmlinux-dirs): prepare scripts
-+$(vmlinux-dirs): gcc-plugins prepare scripts
- $(Q)$(MAKE) $(build)=$@
-
- # Build the kernel release string
-@@ -986,6 +1043,7 @@ prepare0: archprepare FORCE
- $(Q)$(MAKE) $(build)=. missing-syscalls
-
- # All the preparing..
-+prepare: KBUILD_CFLAGS := $(filter-out $(GCC_PLUGINS_CFLAGS),$(KBUILD_CFLAGS))
- prepare: prepare0
-
- # The asm symlink changes when $(ARCH) changes.
-@@ -1127,6 +1185,8 @@ all: modules
- # using awk while concatenating to the final file.
-
- PHONY += modules
-+modules: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
-+modules: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
- modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux)
- $(Q)$(AWK) '!x[$$0]++' $(vmlinux-dirs:%=$(objtree)/%/modules.order) > $(objtree)/modules.order
- @$(kecho) ' Building modules, stage 2.';
-@@ -1136,7 +1196,7 @@ modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux)
-
- # Target to prepare building external modules
- PHONY += modules_prepare
--modules_prepare: prepare scripts
-+modules_prepare: gcc-plugins prepare scripts
-
- # Target to install modules
- PHONY += modules_install
-@@ -1199,9 +1259,9 @@ CLEAN_FILES += vmlinux System.map \
- MRPROPER_DIRS += include/config include2 usr/include include/generated
- MRPROPER_FILES += .config .config.old include/asm .version .old_version \
- include/linux/autoconf.h include/linux/version.h \
-- include/linux/utsrelease.h \
-+ include/linux/utsrelease.h tools/gcc/size_overflow_hash.h \
- include/linux/bounds.h include/asm*/asm-offsets.h \
-- Module.symvers Module.markers tags TAGS cscope*
-+ Module.symvers Module.markers tags TAGS cscope* GPATH GTAGS GRTAGS GSYMS
-
- # clean - Delete most, but leave enough to build external modules
- #
-@@ -1245,7 +1305,7 @@ distclean: mrproper
- @find $(srctree) $(RCS_FIND_IGNORE) \
- \( -name '*.orig' -o -name '*.rej' -o -name '*~' \
- -o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \
-- -o -name '.*.rej' -o -size 0 \
-+ -o -name '.*.rej' -o -name '*.so' -o -size 0 \
- -o -name '*%' -o -name '.*.cmd' -o -name 'core' \) \
- -type f -print | xargs rm -f
-
-@@ -1292,6 +1352,7 @@ help:
- @echo ' modules_prepare - Set up for building external modules'
- @echo ' tags/TAGS - Generate tags file for editors'
- @echo ' cscope - Generate cscope index'
-+ @echo ' gtags - Generate GNU GLOBAL index'
- @echo ' kernelrelease - Output the release version string'
- @echo ' kernelversion - Output the version stored in Makefile'
- @echo ' headers_install - Install sanitised kernel headers to INSTALL_HDR_PATH'; \
-@@ -1393,6 +1454,8 @@ PHONY += $(module-dirs) modules
- $(module-dirs): crmodverdir $(objtree)/Module.symvers
- $(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@)
-
-+modules: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
-+modules: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
- modules: $(module-dirs)
- @$(kecho) ' Building modules, stage 2.';
- $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
-@@ -1448,7 +1511,7 @@ endif # KBUILD_EXTMOD
- quiet_cmd_tags = GEN $@
- cmd_tags = $(CONFIG_SHELL) $(srctree)/scripts/tags.sh $@
-
--tags TAGS cscope: FORCE
-+tags TAGS cscope gtags: FORCE
- $(call cmd,tags)
-
- # Scripts to check various things for consistency
-@@ -1513,17 +1576,21 @@ else
- target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@))
- endif
-
--%.s: %.c prepare scripts FORCE
-+%.s: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
-+%.s: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
-+%.s: %.c gcc-plugins prepare scripts FORCE
- $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
- %.i: %.c prepare scripts FORCE
- $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
--%.o: %.c prepare scripts FORCE
-+%.o: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
-+%.o: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
-+%.o: %.c gcc-plugins prepare scripts FORCE
- $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
- %.lst: %.c prepare scripts FORCE
- $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
--%.s: %.S prepare scripts FORCE
-+%.s: %.S gcc-plugins prepare scripts FORCE
- $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
--%.o: %.S prepare scripts FORCE
-+%.o: %.S gcc-plugins prepare scripts FORCE
- $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
- %.symtypes: %.c prepare scripts FORCE
- $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
-@@ -1533,11 +1600,15 @@ endif
- $(cmd_crmodverdir)
- $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
- $(build)=$(build-dir)
--%/: prepare scripts FORCE
-+%/: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
-+%/: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
-+%/: gcc-plugins prepare scripts FORCE
- $(cmd_crmodverdir)
- $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
- $(build)=$(build-dir)
--%.ko: prepare scripts FORCE
-+%.ko: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
-+%.ko: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
-+%.ko: gcc-plugins prepare scripts FORCE
- $(cmd_crmodverdir)
- $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
- $(build)=$(build-dir) $(@:.ko=.o)
-diff --git a/arch/alpha/include/asm/atomic.h b/arch/alpha/include/asm/atomic.h
-index 610dff44..f396854 100644
---- a/arch/alpha/include/asm/atomic.h
-+++ b/arch/alpha/include/asm/atomic.h
-@@ -251,6 +251,16 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
- #define atomic_dec(v) atomic_sub(1,(v))
- #define atomic64_dec(v) atomic64_sub(1,(v))
-
-+#define atomic64_read_unchecked(v) atomic64_read(v)
-+#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
-+#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
-+#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
-+#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
-+#define atomic64_inc_unchecked(v) atomic64_inc(v)
-+#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
-+#define atomic64_dec_unchecked(v) atomic64_dec(v)
-+#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
-+
- #define smp_mb__before_atomic_dec() smp_mb()
- #define smp_mb__after_atomic_dec() smp_mb()
- #define smp_mb__before_atomic_inc() smp_mb()
-diff --git a/arch/alpha/include/asm/cache.h b/arch/alpha/include/asm/cache.h
-index f199e69..af005f5 100644
---- a/arch/alpha/include/asm/cache.h
-+++ b/arch/alpha/include/asm/cache.h
-@@ -4,19 +4,20 @@
- #ifndef __ARCH_ALPHA_CACHE_H
- #define __ARCH_ALPHA_CACHE_H
-
-+#include <linux/const.h>
-
- /* Bytes per L1 (data) cache line. */
- #if defined(CONFIG_ALPHA_GENERIC) || defined(CONFIG_ALPHA_EV6)
--# define L1_CACHE_BYTES 64
- # define L1_CACHE_SHIFT 6
- #else
- /* Both EV4 and EV5 are write-through, read-allocate,
- direct-mapped, physical.
- */
--# define L1_CACHE_BYTES 32
- # define L1_CACHE_SHIFT 5
- #endif
-
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-+
- #define L1_CACHE_ALIGN(x) (((x)+(L1_CACHE_BYTES-1))&~(L1_CACHE_BYTES-1))
- #define SMP_CACHE_BYTES L1_CACHE_BYTES
-
-diff --git a/arch/alpha/include/asm/elf.h b/arch/alpha/include/asm/elf.h
-index 5c75c1b..c82f878 100644
---- a/arch/alpha/include/asm/elf.h
-+++ b/arch/alpha/include/asm/elf.h
-@@ -91,6 +91,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
-
- #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x1000000)
-
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE (current->personality & ADDR_LIMIT_32BIT ? 0x10000 : 0x120000000UL)
-+
-+#define PAX_DELTA_MMAP_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 28)
-+#define PAX_DELTA_STACK_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 19)
-+#endif
-+
- /* $0 is set by ld.so to a pointer to a function which might be
- registered using atexit. This provides a mean for the dynamic
- linker to call DT_FINI functions for shared libraries that have
-diff --git a/arch/alpha/include/asm/pgalloc.h b/arch/alpha/include/asm/pgalloc.h
-index bc2a0da..8ad11ee 100644
---- a/arch/alpha/include/asm/pgalloc.h
-+++ b/arch/alpha/include/asm/pgalloc.h
-@@ -29,6 +29,12 @@ pgd_populate(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmd)
- pgd_set(pgd, pmd);
- }
-
-+static inline void
-+pgd_populate_kernel(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmd)
-+{
-+ pgd_populate(mm, pgd, pmd);
-+}
-+
- extern pgd_t *pgd_alloc(struct mm_struct *mm);
-
- static inline void
-diff --git a/arch/alpha/include/asm/pgtable.h b/arch/alpha/include/asm/pgtable.h
-index 3f0c59f..cf1e100 100644
---- a/arch/alpha/include/asm/pgtable.h
-+++ b/arch/alpha/include/asm/pgtable.h
-@@ -101,6 +101,17 @@ struct vm_area_struct;
- #define PAGE_SHARED __pgprot(_PAGE_VALID | __ACCESS_BITS)
- #define PAGE_COPY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
- #define PAGE_READONLY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOE)
-+# define PAGE_COPY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
-+# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
-+#else
-+# define PAGE_SHARED_NOEXEC PAGE_SHARED
-+# define PAGE_COPY_NOEXEC PAGE_COPY
-+# define PAGE_READONLY_NOEXEC PAGE_READONLY
-+#endif
-+
- #define PAGE_KERNEL __pgprot(_PAGE_VALID | _PAGE_ASM | _PAGE_KRE | _PAGE_KWE)
-
- #define _PAGE_NORMAL(x) __pgprot(_PAGE_VALID | __ACCESS_BITS | (x))
-diff --git a/arch/alpha/kernel/module.c b/arch/alpha/kernel/module.c
-index ebc3c89..20cfa63 100644
---- a/arch/alpha/kernel/module.c
-+++ b/arch/alpha/kernel/module.c
-@@ -182,7 +182,7 @@ apply_relocate_add(Elf64_Shdr *sechdrs, const char *strtab,
-
- /* The small sections were sorted to the end of the segment.
- The following should definitely cover them. */
-- gp = (u64)me->module_core + me->core_size - 0x8000;
-+ gp = (u64)me->module_core_rw + me->core_size_rw - 0x8000;
- got = sechdrs[me->arch.gotsecindex].sh_addr;
-
- for (i = 0; i < n; i++) {
-diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
-index a94e49c..ad84d0e 100644
---- a/arch/alpha/kernel/osf_sys.c
-+++ b/arch/alpha/kernel/osf_sys.c
-@@ -1163,16 +1163,16 @@ SYSCALL_DEFINE1(old_adjtimex, struct timex32 __user *, txc_p)
- generic version except that we know how to honor ADDR_LIMIT_32BIT. */
-
- static unsigned long
--arch_get_unmapped_area_1(unsigned long addr, unsigned long len,
-- unsigned long limit)
-+arch_get_unmapped_area_1(struct file *filp, unsigned long addr, unsigned long len,
-+ unsigned long limit, unsigned long flags)
- {
- struct vm_area_struct *vma = find_vma(current->mm, addr);
--
-+ unsigned long offset = gr_rand_threadstack_offset(current->mm, filp, flags);
- while (1) {
- /* At this point: (!vma || addr < vma->vm_end). */
- if (limit - len < addr)
- return -ENOMEM;
-- if (!vma || addr + len <= vma->vm_start)
-+ if (check_heap_stack_gap(vma, addr, len, offset))
- return addr;
- addr = vma->vm_end;
- vma = vma->vm_next;
-@@ -1208,20 +1208,24 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
- merely specific addresses, but regions of memory -- perhaps
- this feature should be incorporated into all ports? */
-
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- if (addr) {
-- addr = arch_get_unmapped_area_1 (PAGE_ALIGN(addr), len, limit);
-+ addr = arch_get_unmapped_area_1 (filp, PAGE_ALIGN(addr), len, limit, flags);
- if (addr != (unsigned long) -ENOMEM)
- return addr;
- }
-
- /* Next, try allocating at TASK_UNMAPPED_BASE. */
-- addr = arch_get_unmapped_area_1 (PAGE_ALIGN(TASK_UNMAPPED_BASE),
-- len, limit);
-+ addr = arch_get_unmapped_area_1 (filp, PAGE_ALIGN(current->mm->mmap_base), len, limit, flags);
-+
- if (addr != (unsigned long) -ENOMEM)
- return addr;
-
- /* Finally, try allocating in low memory. */
-- addr = arch_get_unmapped_area_1 (PAGE_SIZE, len, limit);
-+ addr = arch_get_unmapped_area_1 (filp, PAGE_SIZE, len, limit, flags);
-
- return addr;
- }
-diff --git a/arch/alpha/mm/fault.c b/arch/alpha/mm/fault.c
-index 00a31de..2ded0f2 100644
---- a/arch/alpha/mm/fault.c
-+++ b/arch/alpha/mm/fault.c
-@@ -54,6 +54,124 @@ __load_new_mm_context(struct mm_struct *next_mm)
- __reload_thread(pcb);
- }
-
-+#ifdef CONFIG_PAX_PAGEEXEC
-+/*
-+ * PaX: decide what to do with offenders (regs->pc = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ * 2 when patched PLT trampoline was detected
-+ * 3 when unpatched PLT trampoline was detected
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+ int err;
-+
-+ do { /* PaX: patched PLT emulation #1 */
-+ unsigned int ldah, ldq, jmp;
-+
-+ err = get_user(ldah, (unsigned int *)regs->pc);
-+ err |= get_user(ldq, (unsigned int *)(regs->pc+4));
-+ err |= get_user(jmp, (unsigned int *)(regs->pc+8));
-+
-+ if (err)
-+ break;
-+
-+ if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
-+ (ldq & 0xFFFF0000U) == 0xA77B0000U &&
-+ jmp == 0x6BFB0000U)
-+ {
-+ unsigned long r27, addr;
-+ unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
-+ unsigned long addrl = ldq | 0xFFFFFFFFFFFF0000UL;
-+
-+ addr = regs->r27 + ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
-+ err = get_user(r27, (unsigned long *)addr);
-+ if (err)
-+ break;
-+
-+ regs->r27 = r27;
-+ regs->pc = r27;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: patched PLT emulation #2 */
-+ unsigned int ldah, lda, br;
-+
-+ err = get_user(ldah, (unsigned int *)regs->pc);
-+ err |= get_user(lda, (unsigned int *)(regs->pc+4));
-+ err |= get_user(br, (unsigned int *)(regs->pc+8));
-+
-+ if (err)
-+ break;
-+
-+ if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
-+ (lda & 0xFFFF0000U) == 0xA77B0000U &&
-+ (br & 0xFFE00000U) == 0xC3E00000U)
-+ {
-+ unsigned long addr = br | 0xFFFFFFFFFFE00000UL;
-+ unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
-+ unsigned long addrl = lda | 0xFFFFFFFFFFFF0000UL;
-+
-+ regs->r27 += ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
-+ regs->pc += 12 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: unpatched PLT emulation */
-+ unsigned int br;
-+
-+ err = get_user(br, (unsigned int *)regs->pc);
-+
-+ if (!err && (br & 0xFFE00000U) == 0xC3800000U) {
-+ unsigned int br2, ldq, nop, jmp;
-+ unsigned long addr = br | 0xFFFFFFFFFFE00000UL, resolver;
-+
-+ addr = regs->pc + 4 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
-+ err = get_user(br2, (unsigned int *)addr);
-+ err |= get_user(ldq, (unsigned int *)(addr+4));
-+ err |= get_user(nop, (unsigned int *)(addr+8));
-+ err |= get_user(jmp, (unsigned int *)(addr+12));
-+ err |= get_user(resolver, (unsigned long *)(addr+16));
-+
-+ if (err)
-+ break;
-+
-+ if (br2 == 0xC3600000U &&
-+ ldq == 0xA77B000CU &&
-+ nop == 0x47FF041FU &&
-+ jmp == 0x6B7B0000U)
-+ {
-+ regs->r28 = regs->pc+4;
-+ regs->r27 = addr+16;
-+ regs->pc = resolver;
-+ return 3;
-+ }
-+ }
-+ } while (0);
-+#endif
-+
-+ return 1;
-+}
-+
-+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
-+{
-+ unsigned long i;
-+
-+ printk(KERN_ERR "PAX: bytes at PC: ");
-+ for (i = 0; i < 5; i++) {
-+ unsigned int c;
-+ if (get_user(c, (unsigned int *)pc+i))
-+ printk(KERN_CONT "???????? ");
-+ else
-+ printk(KERN_CONT "%08x ", c);
-+ }
-+ printk("\n");
-+}
-+#endif
-
- /*
- * This routine handles page faults. It determines the address,
-@@ -131,8 +249,29 @@ do_page_fault(unsigned long address, unsigned long mmcsr,
- good_area:
- si_code = SEGV_ACCERR;
- if (cause < 0) {
-- if (!(vma->vm_flags & VM_EXEC))
-+ if (!(vma->vm_flags & VM_EXEC)) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->pc)
-+ goto bad_area;
-+
-+ up_read(&mm->mmap_sem);
-+ switch (pax_handle_fetch_fault(regs)) {
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+ case 2:
-+ case 3:
-+ return;
-+#endif
-+
-+ }
-+ pax_report_fault(regs, (void *)regs->pc, (void *)rdusp());
-+ do_group_exit(SIGKILL);
-+#else
- goto bad_area;
-+#endif
-+
-+ }
- } else if (!cause) {
- /* Allow reads even for write-only mappings */
- if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
-diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
-index b68faef..6dd1496 100644
---- a/arch/arm/Kconfig
-+++ b/arch/arm/Kconfig
-@@ -14,6 +14,7 @@ config ARM
- select SYS_SUPPORTS_APM_EMULATION
- select HAVE_OPROFILE
- select HAVE_ARCH_KGDB
-+ select GENERIC_ATOMIC64
- select HAVE_KPROBES if (!XIP_KERNEL)
- select HAVE_KRETPROBES if (HAVE_KPROBES)
- select HAVE_FUNCTION_TRACER if (!XIP_KERNEL)
-diff --git a/arch/arm/include/asm/atomic.h b/arch/arm/include/asm/atomic.h
-index d0daeab..638f5e8 100644
---- a/arch/arm/include/asm/atomic.h
-+++ b/arch/arm/include/asm/atomic.h
-@@ -15,6 +15,10 @@
- #include <linux/types.h>
- #include <asm/system.h>
-
-+#ifdef CONFIG_GENERIC_ATOMIC64
-+#include <asm-generic/atomic64.h>
-+#endif
-+
- #define ATOMIC_INIT(i) { (i) }
-
- #ifdef __KERNEL__
-@@ -24,8 +28,16 @@
- * strex/ldrex monitor on some implementations. The reason we can use it for
- * atomic_set() is the clrex or dummy strex done on every exception return.
- */
--#define atomic_read(v) ((v)->counter)
-+#define atomic_read(v) (*(volatile int *)&(v)->counter)
-+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
-+{
-+ return v->counter;
-+}
- #define atomic_set(v,i) (((v)->counter) = (i))
-+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
-+{
-+ v->counter = i;
-+}
-
- #if __LINUX_ARM_ARCH__ >= 6
-
-@@ -40,6 +52,35 @@ static inline void atomic_add(int i, atomic_t *v)
- int result;
-
- __asm__ __volatile__("@ atomic_add\n"
-+"1: ldrex %1, [%2]\n"
-+" add %0, %1, %3\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+" bvc 3f\n"
-+"2: bkpt 0xf103\n"
-+"3:\n"
-+#endif
-+
-+" strex %1, %0, [%2]\n"
-+" teq %1, #0\n"
-+" bne 1b"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+"\n4:\n"
-+ _ASM_EXTABLE(2b, 4b)
-+#endif
-+
-+ : "=&r" (result), "=&r" (tmp)
-+ : "r" (&v->counter), "Ir" (i)
-+ : "cc");
-+}
-+
-+static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
-+{
-+ unsigned long tmp;
-+ int result;
-+
-+ __asm__ __volatile__("@ atomic_add_unchecked\n"
- "1: ldrex %0, [%2]\n"
- " add %0, %0, %3\n"
- " strex %1, %0, [%2]\n"
-@@ -58,6 +99,42 @@ static inline int atomic_add_return(int i, atomic_t *v)
- smp_mb();
-
- __asm__ __volatile__("@ atomic_add_return\n"
-+"1: ldrex %1, [%2]\n"
-+" add %0, %1, %3\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+" bvc 3f\n"
-+" mov %0, %1\n"
-+"2: bkpt 0xf103\n"
-+"3:\n"
-+#endif
-+
-+" strex %1, %0, [%2]\n"
-+" teq %1, #0\n"
-+" bne 1b"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+"\n4:\n"
-+ _ASM_EXTABLE(2b, 4b)
-+#endif
-+
-+ : "=&r" (result), "=&r" (tmp)
-+ : "r" (&v->counter), "Ir" (i)
-+ : "cc");
-+
-+ smp_mb();
-+
-+ return result;
-+}
-+
-+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
-+{
-+ unsigned long tmp;
-+ int result;
-+
-+ smp_mb();
-+
-+ __asm__ __volatile__("@ atomic_add_return_unchecked\n"
- "1: ldrex %0, [%2]\n"
- " add %0, %0, %3\n"
- " strex %1, %0, [%2]\n"
-@@ -78,6 +155,35 @@ static inline void atomic_sub(int i, atomic_t *v)
- int result;
-
- __asm__ __volatile__("@ atomic_sub\n"
-+"1: ldrex %1, [%2]\n"
-+" sub %0, %1, %3\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+" bvc 3f\n"
-+"2: bkpt 0xf103\n"
-+"3:\n"
-+#endif
-+
-+" strex %1, %0, [%2]\n"
-+" teq %1, #0\n"
-+" bne 1b"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+"\n4:\n"
-+ _ASM_EXTABLE(2b, 4b)
-+#endif
-+
-+ : "=&r" (result), "=&r" (tmp)
-+ : "r" (&v->counter), "Ir" (i)
-+ : "cc");
-+}
-+
-+static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
-+{
-+ unsigned long tmp;
-+ int result;
-+
-+ __asm__ __volatile__("@ atomic_sub_unchecked\n"
- "1: ldrex %0, [%2]\n"
- " sub %0, %0, %3\n"
- " strex %1, %0, [%2]\n"
-@@ -96,11 +202,25 @@ static inline int atomic_sub_return(int i, atomic_t *v)
- smp_mb();
-
- __asm__ __volatile__("@ atomic_sub_return\n"
--"1: ldrex %0, [%2]\n"
--" sub %0, %0, %3\n"
-+"1: ldrex %1, [%2]\n"
-+" subs %0, %1, %3\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+" bvc 3f\n"
-+" mov %0, %1\n"
-+"2: bkpt 0xf103\n"
-+"3:\n"
-+#endif
-+
- " strex %1, %0, [%2]\n"
- " teq %1, #0\n"
- " bne 1b"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+"\n4:\n"
-+ _ASM_EXTABLE(2b, 4b)
-+#endif
-+
- : "=&r" (result), "=&r" (tmp)
- : "r" (&v->counter), "Ir" (i)
- : "cc");
-@@ -132,6 +252,28 @@ static inline int atomic_cmpxchg(atomic_t *ptr, int old, int new)
- return oldval;
- }
-
-+static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *ptr, int old, int new)
-+{
-+ unsigned long oldval, res;
-+
-+ smp_mb();
-+
-+ do {
-+ __asm__ __volatile__("@ atomic_cmpxchg_unchecked\n"
-+ "ldrex %1, [%2]\n"
-+ "mov %0, #0\n"
-+ "teq %1, %3\n"
-+ "strexeq %0, %4, [%2]\n"
-+ : "=&r" (res), "=&r" (oldval)
-+ : "r" (&ptr->counter), "Ir" (old), "r" (new)
-+ : "cc");
-+ } while (res);
-+
-+ smp_mb();
-+
-+ return oldval;
-+}
-+
- static inline void atomic_clear_mask(unsigned long mask, unsigned long *addr)
- {
- unsigned long tmp, tmp2;
-@@ -165,7 +307,17 @@ static inline int atomic_add_return(int i, atomic_t *v)
-
- return val;
- }
-+
-+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
-+{
-+ return atomic_add_return(i, v);
-+}
-+
- #define atomic_add(i, v) (void) atomic_add_return(i, v)
-+static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
-+{
-+ (void) atomic_add_return(i, v);
-+}
-
- static inline int atomic_sub_return(int i, atomic_t *v)
- {
-@@ -180,6 +332,10 @@ static inline int atomic_sub_return(int i, atomic_t *v)
- return val;
- }
- #define atomic_sub(i, v) (void) atomic_sub_return(i, v)
-+static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
-+{
-+ (void) atomic_sub_return(i, v);
-+}
-
- static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
- {
-@@ -195,6 +351,11 @@ static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
- return ret;
- }
-
-+static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
-+{
-+ return atomic_cmpxchg(v, old, new);
-+}
-+
- static inline void atomic_clear_mask(unsigned long mask, unsigned long *addr)
- {
- unsigned long flags;
-@@ -207,6 +368,10 @@ static inline void atomic_clear_mask(unsigned long mask, unsigned long *addr)
- #endif /* __LINUX_ARM_ARCH__ */
-
- #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
-+static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
-+{
-+ return xchg(&v->counter, new);
-+}
-
- static inline int atomic_add_unless(atomic_t *v, int a, int u)
- {
-@@ -220,11 +385,27 @@ static inline int atomic_add_unless(atomic_t *v, int a, int u)
- #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
-
- #define atomic_inc(v) atomic_add(1, v)
-+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
-+{
-+ atomic_add_unchecked(1, v);
-+}
- #define atomic_dec(v) atomic_sub(1, v)
-+static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
-+{
-+ atomic_sub_unchecked(1, v);
-+}
-
- #define atomic_inc_and_test(v) (atomic_add_return(1, v) == 0)
-+static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
-+{
-+ return atomic_add_return_unchecked(1, v) == 0;
-+}
- #define atomic_dec_and_test(v) (atomic_sub_return(1, v) == 0)
- #define atomic_inc_return(v) (atomic_add_return(1, v))
-+static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
-+{
-+ return atomic_add_return_unchecked(1, v);
-+}
- #define atomic_dec_return(v) (atomic_sub_return(1, v))
- #define atomic_sub_and_test(i, v) (atomic_sub_return(i, v) == 0)
-
-diff --git a/arch/arm/include/asm/cache.h b/arch/arm/include/asm/cache.h
-index 66c160b..bca1449 100644
---- a/arch/arm/include/asm/cache.h
-+++ b/arch/arm/include/asm/cache.h
-@@ -4,8 +4,10 @@
- #ifndef __ASMARM_CACHE_H
- #define __ASMARM_CACHE_H
-
-+#include <linux/const.h>
-+
- #define L1_CACHE_SHIFT CONFIG_ARM_L1_CACHE_SHIFT
--#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-
- /*
- * Memory returned by kmalloc() may be used for DMA, so we must make
-diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h
-index 3d0cdd2..19957c5 100644
---- a/arch/arm/include/asm/cacheflush.h
-+++ b/arch/arm/include/asm/cacheflush.h
-@@ -216,13 +216,13 @@ struct cpu_cache_fns {
- void (*dma_inv_range)(const void *, const void *);
- void (*dma_clean_range)(const void *, const void *);
- void (*dma_flush_range)(const void *, const void *);
--};
-+} __no_const;
-
- struct outer_cache_fns {
- void (*inv_range)(unsigned long, unsigned long);
- void (*clean_range)(unsigned long, unsigned long);
- void (*flush_range)(unsigned long, unsigned long);
--};
-+} __no_const;
-
- /*
- * Select the calling method
-diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
-index 6aac3f5..265536b 100644
---- a/arch/arm/include/asm/elf.h
-+++ b/arch/arm/include/asm/elf.h
-@@ -109,7 +109,14 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
- the loader. We need to make sure that it is out of the way of the program
- that it will "exec", and that there is sufficient room for the brk. */
-
--#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
-+#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
-+
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE 0x00008000UL
-+
-+#define PAX_DELTA_MMAP_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
-+#define PAX_DELTA_STACK_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
-+#endif
-
- /* When the program starts, a1 contains a pointer to a function to be
- registered with atexit, as per the SVR4 ABI. A value of 0 means we
-diff --git a/arch/arm/include/asm/kmap_types.h b/arch/arm/include/asm/kmap_types.h
-index c019949..388fdd1 100644
---- a/arch/arm/include/asm/kmap_types.h
-+++ b/arch/arm/include/asm/kmap_types.h
-@@ -19,6 +19,7 @@ enum km_type {
- KM_SOFTIRQ0,
- KM_SOFTIRQ1,
- KM_L2_CACHE,
-+ KM_CLEARPAGE,
- KM_TYPE_NR
- };
-
-diff --git a/arch/arm/include/asm/page.h b/arch/arm/include/asm/page.h
-index 3a32af4..c8def8a 100644
---- a/arch/arm/include/asm/page.h
-+++ b/arch/arm/include/asm/page.h
-@@ -122,7 +122,7 @@ struct cpu_user_fns {
- void (*cpu_clear_user_highpage)(struct page *page, unsigned long vaddr);
- void (*cpu_copy_user_highpage)(struct page *to, struct page *from,
- unsigned long vaddr);
--};
-+} __no_const;
-
- #ifdef MULTI_USER
- extern struct cpu_user_fns cpu_user;
-diff --git a/arch/arm/include/asm/ptrace.h b/arch/arm/include/asm/ptrace.h
-index 1df6457..c806a73 100644
---- a/arch/arm/include/asm/ptrace.h
-+++ b/arch/arm/include/asm/ptrace.h
-@@ -69,7 +69,7 @@
- /*
- * ARMv7 groups of APSR bits
- */
--#define PSR_ISET_MASK 0x01000010 /* ISA state (J, T) mask */
-+#define PSR_ISET_MASK 0x01000020 /* ISA state (J, T) mask */
- #define PSR_IT_MASK 0x0600fc00 /* If-Then execution state mask */
- #define PSR_ENDIAN_MASK 0x00000200 /* Endianness state mask */
-
-diff --git a/arch/arm/include/asm/system.h b/arch/arm/include/asm/system.h
-index d65b2f5..9d87555 100644
---- a/arch/arm/include/asm/system.h
-+++ b/arch/arm/include/asm/system.h
-@@ -86,6 +86,8 @@ void hook_fault_code(int nr, int (*fn)(unsigned long, unsigned int,
-
- #define xchg(ptr,x) \
- ((__typeof__(*(ptr)))__xchg((unsigned long)(x),(ptr),sizeof(*(ptr))))
-+#define xchg_unchecked(ptr,x) \
-+ ((__typeof__(*(ptr)))__xchg((unsigned long)(x),(ptr),sizeof(*(ptr))))
-
- extern asmlinkage void __backtrace(void);
- extern asmlinkage void c_backtrace(unsigned long fp, int pmode);
-@@ -98,7 +100,7 @@ extern int cpu_architecture(void);
- extern void cpu_init(void);
-
- void arm_machine_restart(char mode, const char *cmd);
--extern void (*arm_pm_restart)(char str, const char *cmd);
-+extern void (*arm_pm_restart)(char str, const char *cmd) __noreturn;
-
- #define UDBG_UNDEFINED (1 << 0)
- #define UDBG_SYSCALL (1 << 1)
-@@ -505,6 +507,13 @@ static inline unsigned long long __cmpxchg64_mb(volatile void *ptr,
-
- #endif /* __LINUX_ARM_ARCH__ >= 6 */
-
-+#define _ASM_EXTABLE(from, to) \
-+" .pushsection __ex_table,\"a\"\n"\
-+" .align 3\n" \
-+" .long " #from ", " #to"\n" \
-+" .popsection"
-+
-+
- #endif /* __ASSEMBLY__ */
-
- #define arch_align_stack(x) (x)
-diff --git a/arch/arm/include/asm/thread_info.h b/arch/arm/include/asm/thread_info.h
-index 2dfb7d7..8fadd73 100644
---- a/arch/arm/include/asm/thread_info.h
-+++ b/arch/arm/include/asm/thread_info.h
-@@ -138,6 +138,12 @@ extern void vfp_sync_state(struct thread_info *thread);
- #define TIF_NEED_RESCHED 1
- #define TIF_NOTIFY_RESUME 2 /* callback before returning to user */
- #define TIF_SYSCALL_TRACE 8
-+
-+/* within 8 bits of TIF_SYSCALL_TRACE
-+ to meet flexible second operand requirements
-+*/
-+#define TIF_GRSEC_SETXID 9
-+
- #define TIF_POLLING_NRFLAG 16
- #define TIF_USING_IWMMXT 17
- #define TIF_MEMDIE 18
-@@ -152,6 +158,10 @@ extern void vfp_sync_state(struct thread_info *thread);
- #define _TIF_USING_IWMMXT (1 << TIF_USING_IWMMXT)
- #define _TIF_FREEZE (1 << TIF_FREEZE)
- #define _TIF_RESTORE_SIGMASK (1 << TIF_RESTORE_SIGMASK)
-+#define _TIF_GRSEC_SETXID (1 << TIF_GRSEC_SETXID)
-+
-+/* Checks for any syscall work in entry-common.S */
-+#define _TIF_SYSCALL_WORK (_TIF_SYSCALL_TRACE | _TIF_GRSEC_SETXID)
-
- /*
- * Change these and you break ASM code in entry-common.S
-diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
-index 1d6bd40..fba0cb9 100644
---- a/arch/arm/include/asm/uaccess.h
-+++ b/arch/arm/include/asm/uaccess.h
-@@ -22,6 +22,8 @@
- #define VERIFY_READ 0
- #define VERIFY_WRITE 1
-
-+extern void check_object_size(const void *ptr, unsigned long n, bool to);
-+
- /*
- * The exception table consists of pairs of addresses: the first is the
- * address of an instruction that is allowed to fault, and the second is
-@@ -387,8 +389,23 @@ do { \
-
-
- #ifdef CONFIG_MMU
--extern unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n);
--extern unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n);
-+extern unsigned long __must_check ___copy_from_user(void *to, const void __user *from, unsigned long n);
-+extern unsigned long __must_check ___copy_to_user(void __user *to, const void *from, unsigned long n);
-+
-+static inline unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n)
-+{
-+ if (!__builtin_constant_p(n))
-+ check_object_size(to, n, false);
-+ return ___copy_from_user(to, from, n);
-+}
-+
-+static inline unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n)
-+{
-+ if (!__builtin_constant_p(n))
-+ check_object_size(from, n, true);
-+ return ___copy_to_user(to, from, n);
-+}
-+
- extern unsigned long __must_check __copy_to_user_std(void __user *to, const void *from, unsigned long n);
- extern unsigned long __must_check __clear_user(void __user *addr, unsigned long n);
- extern unsigned long __must_check __clear_user_std(void __user *addr, unsigned long n);
-@@ -403,6 +420,9 @@ extern unsigned long __must_check __strnlen_user(const char __user *s, long n);
-
- static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
- {
-+ if ((long)n < 0)
-+ return n;
-+
- if (access_ok(VERIFY_READ, from, n))
- n = __copy_from_user(to, from, n);
- else /* security hole - plug it */
-@@ -412,6 +432,9 @@ static inline unsigned long __must_check copy_from_user(void *to, const void __u
-
- static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
- {
-+ if ((long)n < 0)
-+ return n;
-+
- if (access_ok(VERIFY_WRITE, to, n))
- n = __copy_to_user(to, from, n);
- return n;
-diff --git a/arch/arm/kernel/armksyms.c b/arch/arm/kernel/armksyms.c
-index 0e62770..e2c2cd6 100644
---- a/arch/arm/kernel/armksyms.c
-+++ b/arch/arm/kernel/armksyms.c
-@@ -118,8 +118,8 @@ EXPORT_SYMBOL(__strncpy_from_user);
- #ifdef CONFIG_MMU
- EXPORT_SYMBOL(copy_page);
-
--EXPORT_SYMBOL(__copy_from_user);
--EXPORT_SYMBOL(__copy_to_user);
-+EXPORT_SYMBOL(___copy_from_user);
-+EXPORT_SYMBOL(___copy_to_user);
- EXPORT_SYMBOL(__clear_user);
-
- EXPORT_SYMBOL(__get_user_1);
-diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S
-index a6c66f5..bfdad39 100644
---- a/arch/arm/kernel/entry-common.S
-+++ b/arch/arm/kernel/entry-common.S
-@@ -77,7 +77,7 @@ ENTRY(ret_from_fork)
- get_thread_info tsk
- ldr r1, [tsk, #TI_FLAGS] @ check for syscall tracing
- mov why, #1
-- tst r1, #_TIF_SYSCALL_TRACE @ are we tracing syscalls?
-+ tst r1, #_TIF_SYSCALL_WORK @ are we tracing syscalls?
- beq ret_slow_syscall
- mov r1, sp
- mov r0, #1 @ trace exit [IP = 1]
-@@ -275,7 +275,7 @@ ENTRY(vector_swi)
- #endif
-
- stmdb sp!, {r4, r5} @ push fifth and sixth args
-- tst ip, #_TIF_SYSCALL_TRACE @ are we tracing syscalls?
-+ tst ip, #_TIF_SYSCALL_WORK @ are we tracing syscalls?
- bne __sys_trace
-
- cmp scno, #NR_syscalls @ check upper syscall limit
-diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
-index 38ccbe1..ca979b0 100644
---- a/arch/arm/kernel/head.S
-+++ b/arch/arm/kernel/head.S
-@@ -45,7 +45,9 @@
- .equ swapper_pg_dir, KERNEL_RAM_VADDR - 0x4000
-
- .macro pgtbl, rd
-- ldr \rd, =(KERNEL_RAM_PADDR - 0x4000)
-+ mov \rd, #KERNEL_RAM_PADDR
-+ sub \rd, #0x4000
-+ add \rd, \rd, \phys
- .endm
-
- #ifdef CONFIG_XIP_KERNEL
-diff --git a/arch/arm/kernel/kgdb.c b/arch/arm/kernel/kgdb.c
-index ba8ccfe..2dc34dc 100644
---- a/arch/arm/kernel/kgdb.c
-+++ b/arch/arm/kernel/kgdb.c
-@@ -190,7 +190,7 @@ void kgdb_arch_exit(void)
- * and we handle the normal undef case within the do_undefinstr
- * handler.
- */
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- #ifndef __ARMEB__
- .gdb_bpt_instr = {0xfe, 0xde, 0xff, 0xe7}
- #else /* ! __ARMEB__ */
-diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
-index 61f90d3..b1b8ab9 100644
---- a/arch/arm/kernel/process.c
-+++ b/arch/arm/kernel/process.c
-@@ -83,7 +83,7 @@ static int __init hlt_setup(char *__unused)
- __setup("nohlt", nohlt_setup);
- __setup("hlt", hlt_setup);
-
--void arm_machine_restart(char mode, const char *cmd)
-+__noreturn void arm_machine_restart(char mode, const char *cmd)
- {
- /*
- * Clean and disable cache, and turn off interrupts
-@@ -117,7 +117,7 @@ void arm_machine_restart(char mode, const char *cmd)
- void (*pm_power_off)(void);
- EXPORT_SYMBOL(pm_power_off);
-
--void (*arm_pm_restart)(char str, const char *cmd) = arm_machine_restart;
-+void (*arm_pm_restart)(char str, const char *cmd) __noreturn = arm_machine_restart;
- EXPORT_SYMBOL_GPL(arm_pm_restart);
-
-
-@@ -195,6 +195,7 @@ __setup("reboot=", reboot_setup);
-
- void machine_halt(void)
- {
-+ BUG();
- }
-
-
-@@ -202,6 +203,7 @@ void machine_power_off(void)
- {
- if (pm_power_off)
- pm_power_off();
-+ BUG();
- }
-
- void machine_restart(char *cmd)
-@@ -218,8 +220,8 @@ void __show_regs(struct pt_regs *regs)
- smp_processor_id(), print_tainted(), init_utsname()->release,
- (int)strcspn(init_utsname()->version, " "),
- init_utsname()->version);
-- print_symbol("PC is at %s\n", instruction_pointer(regs));
-- print_symbol("LR is at %s\n", regs->ARM_lr);
-+ printk("PC is at %pA\n", instruction_pointer(regs));
-+ printk("LR is at %pA\n", regs->ARM_lr);
- printk("pc : [<%08lx>] lr : [<%08lx>] psr: %08lx\n"
- "sp : %08lx ip : %08lx fp : %08lx\n",
- regs->ARM_pc, regs->ARM_lr, regs->ARM_cpsr,
-diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
-index a2ea385..4783488 100644
---- a/arch/arm/kernel/ptrace.c
-+++ b/arch/arm/kernel/ptrace.c
-@@ -847,10 +847,19 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
- return ret;
- }
-
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+extern void gr_delayed_cred_worker(void);
-+#endif
-+
- asmlinkage int syscall_trace(int why, struct pt_regs *regs, int scno)
- {
- unsigned long ip;
-
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+ if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
-+ gr_delayed_cred_worker();
-+#endif
-+
- if (!test_thread_flag(TIF_SYSCALL_TRACE))
- return scno;
- if (!(current->ptrace & PT_PTRACED))
-diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
-index c6c57b6..8ec5c3f 100644
---- a/arch/arm/kernel/setup.c
-+++ b/arch/arm/kernel/setup.c
-@@ -92,16 +92,16 @@ EXPORT_SYMBOL(elf_hwcap);
- struct processor processor;
- #endif
- #ifdef MULTI_TLB
--struct cpu_tlb_fns cpu_tlb;
-+struct cpu_tlb_fns cpu_tlb __read_mostly;
- #endif
- #ifdef MULTI_USER
--struct cpu_user_fns cpu_user;
-+struct cpu_user_fns cpu_user __read_mostly;
- #endif
- #ifdef MULTI_CACHE
--struct cpu_cache_fns cpu_cache;
-+struct cpu_cache_fns cpu_cache __read_mostly;
- #endif
- #ifdef CONFIG_OUTER_CACHE
--struct outer_cache_fns outer_cache;
-+struct outer_cache_fns outer_cache __read_mostly;
- #endif
-
- struct stack {
-diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
-index 3f361a7..aa0d108 100644
---- a/arch/arm/kernel/traps.c
-+++ b/arch/arm/kernel/traps.c
-@@ -50,10 +50,7 @@ static void dump_mem(const char *, const char *, unsigned long, unsigned long);
- void dump_backtrace_entry(unsigned long where, unsigned long from, unsigned long frame)
- {
- #ifdef CONFIG_KALLSYMS
-- char sym1[KSYM_SYMBOL_LEN], sym2[KSYM_SYMBOL_LEN];
-- sprint_symbol(sym1, where);
-- sprint_symbol(sym2, from);
-- printk("[<%08lx>] (%s) from [<%08lx>] (%s)\n", where, sym1, from, sym2);
-+ printk("[<%08lx>] (%pA) from [<%08lx>] (%pA)\n", where, (void *)where, from, (void *)from);
- #else
- printk("Function entered at [<%08lx>] from [<%08lx>]\n", where, from);
- #endif
-@@ -247,6 +244,8 @@ static void __die(const char *str, int err, struct thread_info *thread, struct p
-
- DEFINE_SPINLOCK(die_lock);
-
-+extern void gr_handle_kernel_exploit(void);
-+
- /*
- * This function is protected against re-entrancy.
- */
-@@ -271,6 +270,8 @@ NORET_TYPE void die(const char *str, struct pt_regs *regs, int err)
- if (panic_on_oops)
- panic("Fatal exception");
-
-+ gr_handle_kernel_exploit();
-+
- do_exit(SIGSEGV);
- }
-
-diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S
-index aecf87df..bed731b 100644
---- a/arch/arm/kernel/vmlinux.lds.S
-+++ b/arch/arm/kernel/vmlinux.lds.S
-@@ -74,14 +74,18 @@ SECTIONS
- #ifndef CONFIG_XIP_KERNEL
- __init_begin = _stext;
- INIT_DATA
-+ EXIT_TEXT
-+ EXIT_DATA
- . = ALIGN(PAGE_SIZE);
- __init_end = .;
- #endif
- }
-
- /DISCARD/ : { /* Exit code and data */
-+#ifdef CONFIG_XIP_KERNEL
- EXIT_TEXT
- EXIT_DATA
-+#endif
- *(.exitcall.exit)
- *(.discard)
- *(.ARM.exidx.exit.text)
-diff --git a/arch/arm/lib/copy_from_user.S b/arch/arm/lib/copy_from_user.S
-index e4fe124..0fc246b 100644
---- a/arch/arm/lib/copy_from_user.S
-+++ b/arch/arm/lib/copy_from_user.S
-@@ -16,7 +16,7 @@
- /*
- * Prototype:
- *
-- * size_t __copy_from_user(void *to, const void *from, size_t n)
-+ * size_t ___copy_from_user(void *to, const void *from, size_t n)
- *
- * Purpose:
- *
-@@ -84,11 +84,11 @@
-
- .text
-
--ENTRY(__copy_from_user)
-+ENTRY(___copy_from_user)
-
- #include "copy_template.S"
-
--ENDPROC(__copy_from_user)
-+ENDPROC(___copy_from_user)
-
- .section .fixup,"ax"
- .align 0
-diff --git a/arch/arm/lib/copy_page.S b/arch/arm/lib/copy_page.S
-index 6ee2f67..d1cce76 100644
---- a/arch/arm/lib/copy_page.S
-+++ b/arch/arm/lib/copy_page.S
-@@ -10,6 +10,7 @@
- * ASM optimised string functions
- */
- #include <linux/linkage.h>
-+#include <linux/const.h>
- #include <asm/assembler.h>
- #include <asm/asm-offsets.h>
- #include <asm/cache.h>
-diff --git a/arch/arm/lib/copy_to_user.S b/arch/arm/lib/copy_to_user.S
-index 1a71e15..ac7b258 100644
---- a/arch/arm/lib/copy_to_user.S
-+++ b/arch/arm/lib/copy_to_user.S
-@@ -16,7 +16,7 @@
- /*
- * Prototype:
- *
-- * size_t __copy_to_user(void *to, const void *from, size_t n)
-+ * size_t ___copy_to_user(void *to, const void *from, size_t n)
- *
- * Purpose:
- *
-@@ -88,11 +88,11 @@
- .text
-
- ENTRY(__copy_to_user_std)
--WEAK(__copy_to_user)
-+WEAK(___copy_to_user)
-
- #include "copy_template.S"
-
--ENDPROC(__copy_to_user)
-+ENDPROC(___copy_to_user)
-
- .section .fixup,"ax"
- .align 0
-diff --git a/arch/arm/lib/uaccess.S b/arch/arm/lib/uaccess.S
-index ffdd274..91017b6 100644
---- a/arch/arm/lib/uaccess.S
-+++ b/arch/arm/lib/uaccess.S
-@@ -19,7 +19,7 @@
-
- #define PAGE_SHIFT 12
-
--/* Prototype: int __copy_to_user(void *to, const char *from, size_t n)
-+/* Prototype: int ___copy_to_user(void *to, const char *from, size_t n)
- * Purpose : copy a block to user memory from kernel memory
- * Params : to - user memory
- * : from - kernel memory
-@@ -39,7 +39,7 @@ USER( strgtbt r3, [r0], #1) @ May fault
- sub r2, r2, ip
- b .Lc2u_dest_aligned
-
--ENTRY(__copy_to_user)
-+ENTRY(___copy_to_user)
- stmfd sp!, {r2, r4 - r7, lr}
- cmp r2, #4
- blt .Lc2u_not_enough
-@@ -277,14 +277,14 @@ USER( strgebt r3, [r0], #1) @ May fault
- ldrgtb r3, [r1], #0
- USER( strgtbt r3, [r0], #1) @ May fault
- b .Lc2u_finished
--ENDPROC(__copy_to_user)
-+ENDPROC(___copy_to_user)
-
- .section .fixup,"ax"
- .align 0
- 9001: ldmfd sp!, {r0, r4 - r7, pc}
- .previous
-
--/* Prototype: unsigned long __copy_from_user(void *to,const void *from,unsigned long n);
-+/* Prototype: unsigned long ___copy_from_user(void *to,const void *from,unsigned long n);
- * Purpose : copy a block from user memory to kernel memory
- * Params : to - kernel memory
- * : from - user memory
-@@ -303,7 +303,7 @@ USER( ldrgtbt r3, [r1], #1) @ May fault
- sub r2, r2, ip
- b .Lcfu_dest_aligned
-
--ENTRY(__copy_from_user)
-+ENTRY(___copy_from_user)
- stmfd sp!, {r0, r2, r4 - r7, lr}
- cmp r2, #4
- blt .Lcfu_not_enough
-@@ -543,7 +543,7 @@ USER( ldrgebt r3, [r1], #1) @ May fault
- USER( ldrgtbt r3, [r1], #1) @ May fault
- strgtb r3, [r0], #1
- b .Lcfu_finished
--ENDPROC(__copy_from_user)
-+ENDPROC(___copy_from_user)
-
- .section .fixup,"ax"
- .align 0
-diff --git a/arch/arm/lib/uaccess_with_memcpy.c b/arch/arm/lib/uaccess_with_memcpy.c
-index 6b967ff..67d5b2b 100644
---- a/arch/arm/lib/uaccess_with_memcpy.c
-+++ b/arch/arm/lib/uaccess_with_memcpy.c
-@@ -97,7 +97,7 @@ out:
- }
-
- unsigned long
--__copy_to_user(void __user *to, const void *from, unsigned long n)
-+___copy_to_user(void __user *to, const void *from, unsigned long n)
- {
- /*
- * This test is stubbed out of the main function above to keep
-diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
-index 4028724..beec230 100644
---- a/arch/arm/mach-at91/pm.c
-+++ b/arch/arm/mach-at91/pm.c
-@@ -348,7 +348,7 @@ static void at91_pm_end(void)
- }
-
-
--static struct platform_suspend_ops at91_pm_ops ={
-+static const struct platform_suspend_ops at91_pm_ops ={
- .valid = at91_pm_valid_state,
- .begin = at91_pm_begin,
- .enter = at91_pm_enter,
-diff --git a/arch/arm/mach-omap1/pm.c b/arch/arm/mach-omap1/pm.c
-index 5218943..0a34552 100644
---- a/arch/arm/mach-omap1/pm.c
-+++ b/arch/arm/mach-omap1/pm.c
-@@ -647,7 +647,7 @@ static struct irqaction omap_wakeup_irq = {
-
-
-
--static struct platform_suspend_ops omap_pm_ops ={
-+static const struct platform_suspend_ops omap_pm_ops ={
- .prepare = omap_pm_prepare,
- .enter = omap_pm_enter,
- .finish = omap_pm_finish,
-diff --git a/arch/arm/mach-omap2/pm24xx.c b/arch/arm/mach-omap2/pm24xx.c
-index bff5c4e..d4c649b 100644
---- a/arch/arm/mach-omap2/pm24xx.c
-+++ b/arch/arm/mach-omap2/pm24xx.c
-@@ -326,7 +326,7 @@ static void omap2_pm_finish(void)
- enable_hlt();
- }
-
--static struct platform_suspend_ops omap_pm_ops = {
-+static const struct platform_suspend_ops omap_pm_ops = {
- .prepare = omap2_pm_prepare,
- .enter = omap2_pm_enter,
- .finish = omap2_pm_finish,
-diff --git a/arch/arm/mach-omap2/pm34xx.c b/arch/arm/mach-omap2/pm34xx.c
-index 8946319..7d3e661 100644
---- a/arch/arm/mach-omap2/pm34xx.c
-+++ b/arch/arm/mach-omap2/pm34xx.c
-@@ -401,7 +401,7 @@ static void omap3_pm_end(void)
- return;
- }
-
--static struct platform_suspend_ops omap_pm_ops = {
-+static const struct platform_suspend_ops omap_pm_ops = {
- .begin = omap3_pm_begin,
- .end = omap3_pm_end,
- .prepare = omap3_pm_prepare,
-diff --git a/arch/arm/mach-pnx4008/pm.c b/arch/arm/mach-pnx4008/pm.c
-index b3d8d53..6e68ebc 100644
---- a/arch/arm/mach-pnx4008/pm.c
-+++ b/arch/arm/mach-pnx4008/pm.c
-@@ -116,7 +116,7 @@ static int pnx4008_pm_valid(suspend_state_t state)
- (state == PM_SUSPEND_MEM);
- }
-
--static struct platform_suspend_ops pnx4008_pm_ops = {
-+static const struct platform_suspend_ops pnx4008_pm_ops = {
- .enter = pnx4008_pm_enter,
- .valid = pnx4008_pm_valid,
- };
-diff --git a/arch/arm/mach-pxa/pm.c b/arch/arm/mach-pxa/pm.c
-index 7693355..9beb00a 100644
---- a/arch/arm/mach-pxa/pm.c
-+++ b/arch/arm/mach-pxa/pm.c
-@@ -95,7 +95,7 @@ void pxa_pm_finish(void)
- pxa_cpu_pm_fns->finish();
- }
-
--static struct platform_suspend_ops pxa_pm_ops = {
-+static const struct platform_suspend_ops pxa_pm_ops = {
- .valid = pxa_pm_valid,
- .enter = pxa_pm_enter,
- .prepare = pxa_pm_prepare,
-diff --git a/arch/arm/mach-pxa/sharpsl_pm.c b/arch/arm/mach-pxa/sharpsl_pm.c
-index 629e05d..06be589 100644
---- a/arch/arm/mach-pxa/sharpsl_pm.c
-+++ b/arch/arm/mach-pxa/sharpsl_pm.c
-@@ -891,7 +891,7 @@ static void sharpsl_apm_get_power_status(struct apm_power_info *info)
- }
-
- #ifdef CONFIG_PM
--static struct platform_suspend_ops sharpsl_pm_ops = {
-+static const struct platform_suspend_ops sharpsl_pm_ops = {
- .prepare = pxa_pm_prepare,
- .finish = pxa_pm_finish,
- .enter = corgi_pxa_pm_enter,
-diff --git a/arch/arm/mach-sa1100/pm.c b/arch/arm/mach-sa1100/pm.c
-index c83fdc8..ab9fc44 100644
---- a/arch/arm/mach-sa1100/pm.c
-+++ b/arch/arm/mach-sa1100/pm.c
-@@ -120,7 +120,7 @@ unsigned long sleep_phys_sp(void *sp)
- return virt_to_phys(sp);
- }
-
--static struct platform_suspend_ops sa11x0_pm_ops = {
-+static const struct platform_suspend_ops sa11x0_pm_ops = {
- .enter = sa11x0_pm_enter,
- .valid = suspend_valid_only_mem,
- };
-diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
-index 3191cd6..68bd2d7 100644
---- a/arch/arm/mm/fault.c
-+++ b/arch/arm/mm/fault.c
-@@ -569,6 +569,20 @@ do_PrefetchAbort(unsigned long addr, unsigned int ifsr, struct pt_regs *regs)
- const struct fsr_info *inf = ifsr_info + fsr_fs(ifsr);
- struct siginfo info;
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+ if (fsr_fs(ifsr) == 2) {
-+ unsigned int bkpt;
-+
-+ if (!probe_kernel_address((unsigned int *)addr, bkpt) && bkpt == 0xe12f1073) {
-+ current->thread.error_code = ifsr;
-+ current->thread.trap_no = 0;
-+ pax_report_refcount_overflow(regs);
-+ fixup_exception(regs);
-+ return;
-+ }
-+ }
-+#endif
-+
- if (!inf->fn(addr, ifsr | FSR_LNX_PF, regs))
- return;
-
-diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
-index f5abc51..5f5262a 100644
---- a/arch/arm/mm/mmap.c
-+++ b/arch/arm/mm/mmap.c
-@@ -30,6 +30,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
- struct mm_struct *mm = current->mm;
- struct vm_area_struct *vma;
- unsigned long start_addr;
-+ unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
- #ifdef CONFIG_CPU_V6
- unsigned int cache_type;
- int do_align = 0, aliasing = 0;
-@@ -63,6 +64,10 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
- if (len > TASK_SIZE)
- return -ENOMEM;
-
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- if (addr) {
- if (do_align)
- addr = COLOUR_ALIGN(addr, pgoff);
-@@ -70,15 +75,14 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
- addr = PAGE_ALIGN(addr);
-
- vma = find_vma(mm, addr);
-- if (TASK_SIZE - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
- return addr;
- }
- if (len > mm->cached_hole_size) {
-- start_addr = addr = mm->free_area_cache;
-+ start_addr = addr = mm->free_area_cache;
- } else {
-- start_addr = addr = TASK_UNMAPPED_BASE;
-- mm->cached_hole_size = 0;
-+ start_addr = addr = mm->mmap_base;
-+ mm->cached_hole_size = 0;
- }
-
- full_search:
-@@ -94,14 +98,14 @@ full_search:
- * Start a new search - just in case we missed
- * some holes.
- */
-- if (start_addr != TASK_UNMAPPED_BASE) {
-- start_addr = addr = TASK_UNMAPPED_BASE;
-+ if (start_addr != mm->mmap_base) {
-+ start_addr = addr = mm->mmap_base;
- mm->cached_hole_size = 0;
- goto full_search;
- }
- return -ENOMEM;
- }
-- if (!vma || addr + len <= vma->vm_start) {
-+ if (check_heap_stack_gap(vma, addr, len, offset)) {
- /*
- * Remember the place where we stopped the search:
- */
-@@ -116,7 +120,6 @@ full_search:
- }
- }
-
--
- /*
- * You really shouldn't be using read() or write() on /dev/mem. This
- * might go away in the future.
-diff --git a/arch/arm/plat-s3c/pm.c b/arch/arm/plat-s3c/pm.c
-index 8d97db2..b66cfa5 100644
---- a/arch/arm/plat-s3c/pm.c
-+++ b/arch/arm/plat-s3c/pm.c
-@@ -355,7 +355,7 @@ static void s3c_pm_finish(void)
- s3c_pm_check_cleanup();
- }
-
--static struct platform_suspend_ops s3c_pm_ops = {
-+static const struct platform_suspend_ops s3c_pm_ops = {
- .enter = s3c_pm_enter,
- .prepare = s3c_pm_prepare,
- .finish = s3c_pm_finish,
-diff --git a/arch/avr32/include/asm/cache.h b/arch/avr32/include/asm/cache.h
-index d3cf35a..0ba6053 100644
---- a/arch/avr32/include/asm/cache.h
-+++ b/arch/avr32/include/asm/cache.h
-@@ -1,8 +1,10 @@
- #ifndef __ASM_AVR32_CACHE_H
- #define __ASM_AVR32_CACHE_H
-
-+#include <linux/const.h>
-+
- #define L1_CACHE_SHIFT 5
--#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-
- /*
- * Memory returned by kmalloc() may be used for DMA, so we must make
-diff --git a/arch/avr32/include/asm/elf.h b/arch/avr32/include/asm/elf.h
-index d5d1d41..856e2ed 100644
---- a/arch/avr32/include/asm/elf.h
-+++ b/arch/avr32/include/asm/elf.h
-@@ -85,8 +85,14 @@ typedef struct user_fpu_struct elf_fpregset_t;
- the loader. We need to make sure that it is out of the way of the program
- that it will "exec", and that there is sufficient room for the brk. */
-
--#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
-+#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
-
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE 0x00001000UL
-+
-+#define PAX_DELTA_MMAP_LEN 15
-+#define PAX_DELTA_STACK_LEN 15
-+#endif
-
- /* This yields a mask that user programs can use to figure out what
- instruction set this CPU supports. This could be done in user space,
-diff --git a/arch/avr32/include/asm/kmap_types.h b/arch/avr32/include/asm/kmap_types.h
-index b7f5c68..556135c 100644
---- a/arch/avr32/include/asm/kmap_types.h
-+++ b/arch/avr32/include/asm/kmap_types.h
-@@ -22,7 +22,8 @@ D(10) KM_IRQ0,
- D(11) KM_IRQ1,
- D(12) KM_SOFTIRQ0,
- D(13) KM_SOFTIRQ1,
--D(14) KM_TYPE_NR
-+D(14) KM_CLEARPAGE,
-+D(15) KM_TYPE_NR
- };
-
- #undef D
-diff --git a/arch/avr32/mach-at32ap/pm.c b/arch/avr32/mach-at32ap/pm.c
-index f021edf..32d680e 100644
---- a/arch/avr32/mach-at32ap/pm.c
-+++ b/arch/avr32/mach-at32ap/pm.c
-@@ -176,7 +176,7 @@ out:
- return 0;
- }
-
--static struct platform_suspend_ops avr32_pm_ops = {
-+static const struct platform_suspend_ops avr32_pm_ops = {
- .valid = avr32_pm_valid_state,
- .enter = avr32_pm_enter,
- };
-diff --git a/arch/avr32/mm/fault.c b/arch/avr32/mm/fault.c
-index b61d86d..e292c7f 100644
---- a/arch/avr32/mm/fault.c
-+++ b/arch/avr32/mm/fault.c
-@@ -41,6 +41,23 @@ static inline int notify_page_fault(struct pt_regs *regs, int trap)
-
- int exception_trace = 1;
-
-+#ifdef CONFIG_PAX_PAGEEXEC
-+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
-+{
-+ unsigned long i;
-+
-+ printk(KERN_ERR "PAX: bytes at PC: ");
-+ for (i = 0; i < 20; i++) {
-+ unsigned char c;
-+ if (get_user(c, (unsigned char *)pc+i))
-+ printk(KERN_CONT "???????? ");
-+ else
-+ printk(KERN_CONT "%02x ", c);
-+ }
-+ printk("\n");
-+}
-+#endif
-+
- /*
- * This routine handles page faults. It determines the address and the
- * problem, and then passes it off to one of the appropriate routines.
-@@ -157,6 +174,16 @@ bad_area:
- up_read(&mm->mmap_sem);
-
- if (user_mode(regs)) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (mm->pax_flags & MF_PAX_PAGEEXEC) {
-+ if (ecr == ECR_PROTECTION_X || ecr == ECR_TLB_MISS_X) {
-+ pax_report_fault(regs, (void *)regs->pc, (void *)regs->sp);
-+ do_group_exit(SIGKILL);
-+ }
-+ }
-+#endif
-+
- if (exception_trace && printk_ratelimit())
- printk("%s%s[%d]: segfault at %08lx pc %08lx "
- "sp %08lx ecr %lu\n",
-diff --git a/arch/blackfin/include/asm/cache.h b/arch/blackfin/include/asm/cache.h
-index 93f6c63..d144953 100644
---- a/arch/blackfin/include/asm/cache.h
-+++ b/arch/blackfin/include/asm/cache.h
-@@ -7,12 +7,14 @@
- #ifndef __ARCH_BLACKFIN_CACHE_H
- #define __ARCH_BLACKFIN_CACHE_H
-
-+#include <linux/const.h>
-+
- /*
- * Bytes per L1 cache line
- * Blackfin loads 32 bytes for cache
- */
- #define L1_CACHE_SHIFT 5
--#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
- #define SMP_CACHE_BYTES L1_CACHE_BYTES
-
- #define ARCH_KMALLOC_MINALIGN L1_CACHE_BYTES
-diff --git a/arch/blackfin/kernel/kgdb.c b/arch/blackfin/kernel/kgdb.c
-index cce79d0..c406c85 100644
---- a/arch/blackfin/kernel/kgdb.c
-+++ b/arch/blackfin/kernel/kgdb.c
-@@ -428,7 +428,7 @@ int kgdb_arch_handle_exception(int vector, int signo,
- return -1; /* this means that we do not want to exit from the handler */
- }
-
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- .gdb_bpt_instr = {0xa1},
- #ifdef CONFIG_SMP
- .flags = KGDB_HW_BREAKPOINT|KGDB_THR_PROC_SWAP,
-diff --git a/arch/blackfin/mach-common/pm.c b/arch/blackfin/mach-common/pm.c
-index 8837be4..b2fb413 100644
---- a/arch/blackfin/mach-common/pm.c
-+++ b/arch/blackfin/mach-common/pm.c
-@@ -255,7 +255,7 @@ static int bfin_pm_enter(suspend_state_t state)
- return 0;
- }
-
--struct platform_suspend_ops bfin_pm_ops = {
-+const struct platform_suspend_ops bfin_pm_ops = {
- .enter = bfin_pm_enter,
- .valid = bfin_pm_valid,
- };
-diff --git a/arch/cris/include/arch-v10/arch/cache.h b/arch/cris/include/arch-v10/arch/cache.h
-index aea2718..3639a60 100644
---- a/arch/cris/include/arch-v10/arch/cache.h
-+++ b/arch/cris/include/arch-v10/arch/cache.h
-@@ -1,8 +1,9 @@
- #ifndef _ASM_ARCH_CACHE_H
- #define _ASM_ARCH_CACHE_H
-
-+#include <linux/const.h>
- /* Etrax 100LX have 32-byte cache-lines. */
--#define L1_CACHE_BYTES 32
- #define L1_CACHE_SHIFT 5
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-
- #endif /* _ASM_ARCH_CACHE_H */
-diff --git a/arch/cris/include/arch-v32/arch/cache.h b/arch/cris/include/arch-v32/arch/cache.h
-index dfc7305..417f5b3 100644
---- a/arch/cris/include/arch-v32/arch/cache.h
-+++ b/arch/cris/include/arch-v32/arch/cache.h
-@@ -1,11 +1,12 @@
- #ifndef _ASM_CRIS_ARCH_CACHE_H
- #define _ASM_CRIS_ARCH_CACHE_H
-
-+#include <linux/const.h>
- #include <arch/hwregs/dma.h>
-
- /* A cache-line is 32 bytes. */
--#define L1_CACHE_BYTES 32
- #define L1_CACHE_SHIFT 5
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-
- void flush_dma_list(dma_descr_data *descr);
- void flush_dma_descr(dma_descr_data *descr, int flush_buf);
-diff --git a/arch/frv/include/asm/atomic.h b/arch/frv/include/asm/atomic.h
-index 00a57af..c3ef0cd 100644
---- a/arch/frv/include/asm/atomic.h
-+++ b/arch/frv/include/asm/atomic.h
-@@ -241,6 +241,16 @@ extern uint32_t __xchg_32(uint32_t i, volatile void *v);
- #define atomic64_cmpxchg(v, old, new) (__cmpxchg_64(old, new, &(v)->counter))
- #define atomic64_xchg(v, new) (__xchg_64(new, &(v)->counter))
-
-+#define atomic64_read_unchecked(v) atomic64_read(v)
-+#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
-+#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
-+#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
-+#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
-+#define atomic64_inc_unchecked(v) atomic64_inc(v)
-+#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
-+#define atomic64_dec_unchecked(v) atomic64_dec(v)
-+#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
-+
- static __inline__ int atomic_add_unless(atomic_t *v, int a, int u)
- {
- int c, old;
-diff --git a/arch/frv/include/asm/cache.h b/arch/frv/include/asm/cache.h
-index 7dc0f0f..1e6a620 100644
---- a/arch/frv/include/asm/cache.h
-+++ b/arch/frv/include/asm/cache.h
-@@ -12,10 +12,11 @@
- #ifndef __ASM_CACHE_H
- #define __ASM_CACHE_H
-
-+#include <linux/const.h>
-
- /* bytes per L1 cache line */
- #define L1_CACHE_SHIFT (CONFIG_FRV_L1_CACHE_SHIFT)
--#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-
- #define ARCH_KMALLOC_MINALIGN L1_CACHE_BYTES
-
-diff --git a/arch/frv/include/asm/kmap_types.h b/arch/frv/include/asm/kmap_types.h
-index f8e16b2..c73ff79 100644
---- a/arch/frv/include/asm/kmap_types.h
-+++ b/arch/frv/include/asm/kmap_types.h
-@@ -23,6 +23,7 @@ enum km_type {
- KM_IRQ1,
- KM_SOFTIRQ0,
- KM_SOFTIRQ1,
-+ KM_CLEARPAGE,
- KM_TYPE_NR
- };
-
-diff --git a/arch/frv/mm/elf-fdpic.c b/arch/frv/mm/elf-fdpic.c
-index 385fd30..3aaf4fe 100644
---- a/arch/frv/mm/elf-fdpic.c
-+++ b/arch/frv/mm/elf-fdpic.c
-@@ -61,6 +61,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
- {
- struct vm_area_struct *vma;
- unsigned long limit;
-+ unsigned long offset = gr_rand_threadstack_offset(current->mm, filp, flags);
-
- if (len > TASK_SIZE)
- return -ENOMEM;
-@@ -73,8 +74,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
- if (addr) {
- addr = PAGE_ALIGN(addr);
- vma = find_vma(current->mm, addr);
-- if (TASK_SIZE - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
- goto success;
- }
-
-@@ -89,7 +89,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
- for (; vma; vma = vma->vm_next) {
- if (addr > limit)
- break;
-- if (addr + len <= vma->vm_start)
-+ if (check_heap_stack_gap(vma, addr, len, offset))
- goto success;
- addr = vma->vm_end;
- }
-@@ -104,7 +104,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
- for (; vma; vma = vma->vm_next) {
- if (addr > limit)
- break;
-- if (addr + len <= vma->vm_start)
-+ if (check_heap_stack_gap(vma, addr, len, offset))
- goto success;
- addr = vma->vm_end;
- }
-diff --git a/arch/h8300/include/asm/cache.h b/arch/h8300/include/asm/cache.h
-index c635028..6d9445a 100644
---- a/arch/h8300/include/asm/cache.h
-+++ b/arch/h8300/include/asm/cache.h
-@@ -1,8 +1,10 @@
- #ifndef __ARCH_H8300_CACHE_H
- #define __ARCH_H8300_CACHE_H
-
-+#include <linux/const.h>
-+
- /* bytes per L1 cache line */
--#define L1_CACHE_BYTES 4
-+#define L1_CACHE_BYTES _AC(4,UL)
-
- /* m68k-elf-gcc 2.95.2 doesn't like these */
-
-diff --git a/arch/ia64/hp/common/hwsw_iommu.c b/arch/ia64/hp/common/hwsw_iommu.c
-index e4a80d8..11a7ea1 100644
---- a/arch/ia64/hp/common/hwsw_iommu.c
-+++ b/arch/ia64/hp/common/hwsw_iommu.c
-@@ -17,7 +17,7 @@
- #include <linux/swiotlb.h>
- #include <asm/machvec.h>
-
--extern struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
-+extern const struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
-
- /* swiotlb declarations & definitions: */
- extern int swiotlb_late_init_with_default_size (size_t size);
-@@ -33,7 +33,7 @@ static inline int use_swiotlb(struct device *dev)
- !sba_dma_ops.dma_supported(dev, *dev->dma_mask);
- }
-
--struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
-+const struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
- {
- if (use_swiotlb(dev))
- return &swiotlb_dma_ops;
-diff --git a/arch/ia64/hp/common/sba_iommu.c b/arch/ia64/hp/common/sba_iommu.c
-index 01ae69b..35752fd 100644
---- a/arch/ia64/hp/common/sba_iommu.c
-+++ b/arch/ia64/hp/common/sba_iommu.c
-@@ -2097,7 +2097,7 @@ static struct acpi_driver acpi_sba_ioc_driver = {
- },
- };
-
--extern struct dma_map_ops swiotlb_dma_ops;
-+extern const struct dma_map_ops swiotlb_dma_ops;
-
- static int __init
- sba_init(void)
-@@ -2211,7 +2211,7 @@ sba_page_override(char *str)
-
- __setup("sbapagesize=",sba_page_override);
-
--struct dma_map_ops sba_dma_ops = {
-+const struct dma_map_ops sba_dma_ops = {
- .alloc_coherent = sba_alloc_coherent,
- .free_coherent = sba_free_coherent,
- .map_page = sba_map_page,
-diff --git a/arch/ia64/ia32/binfmt_elf32.c b/arch/ia64/ia32/binfmt_elf32.c
-index c69552b..c7122f4 100644
---- a/arch/ia64/ia32/binfmt_elf32.c
-+++ b/arch/ia64/ia32/binfmt_elf32.c
-@@ -45,6 +45,13 @@ randomize_stack_top(unsigned long stack_top);
-
- #define elf_read_implies_exec(ex, have_pt_gnu_stack) (!(have_pt_gnu_stack))
-
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE (current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
-+
-+#define PAX_DELTA_MMAP_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
-+#define PAX_DELTA_STACK_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
-+#endif
-+
- /* Ugly but avoids duplication */
- #include "../../../fs/binfmt_elf.c"
-
-diff --git a/arch/ia64/ia32/ia32priv.h b/arch/ia64/ia32/ia32priv.h
-index 0f15349..26b3429 100644
---- a/arch/ia64/ia32/ia32priv.h
-+++ b/arch/ia64/ia32/ia32priv.h
-@@ -296,7 +296,14 @@ typedef struct compat_siginfo {
- #define ELF_DATA ELFDATA2LSB
- #define ELF_ARCH EM_386
-
--#define IA32_STACK_TOP IA32_PAGE_OFFSET
-+#ifdef CONFIG_PAX_RANDUSTACK
-+#define __IA32_DELTA_STACK (current->mm->delta_stack)
-+#else
-+#define __IA32_DELTA_STACK 0UL
-+#endif
-+
-+#define IA32_STACK_TOP (IA32_PAGE_OFFSET - __IA32_DELTA_STACK)
-+
- #define IA32_GATE_OFFSET IA32_PAGE_OFFSET
- #define IA32_GATE_END IA32_PAGE_OFFSET + PAGE_SIZE
-
-diff --git a/arch/ia64/include/asm/atomic.h b/arch/ia64/include/asm/atomic.h
-index 88405cb..de5ca5d 100644
---- a/arch/ia64/include/asm/atomic.h
-+++ b/arch/ia64/include/asm/atomic.h
-@@ -210,6 +210,16 @@ atomic64_add_negative (__s64 i, atomic64_t *v)
- #define atomic64_inc(v) atomic64_add(1, (v))
- #define atomic64_dec(v) atomic64_sub(1, (v))
-
-+#define atomic64_read_unchecked(v) atomic64_read(v)
-+#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
-+#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
-+#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
-+#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
-+#define atomic64_inc_unchecked(v) atomic64_inc(v)
-+#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
-+#define atomic64_dec_unchecked(v) atomic64_dec(v)
-+#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
-+
- /* Atomic operations are already serializing */
- #define smp_mb__before_atomic_dec() barrier()
- #define smp_mb__after_atomic_dec() barrier()
-diff --git a/arch/ia64/include/asm/cache.h b/arch/ia64/include/asm/cache.h
-index e7482bd..d1c9b8e 100644
---- a/arch/ia64/include/asm/cache.h
-+++ b/arch/ia64/include/asm/cache.h
-@@ -1,6 +1,7 @@
- #ifndef _ASM_IA64_CACHE_H
- #define _ASM_IA64_CACHE_H
-
-+#include <linux/const.h>
-
- /*
- * Copyright (C) 1998-2000 Hewlett-Packard Co
-@@ -9,7 +10,7 @@
-
- /* Bytes per L1 (data) cache line. */
- #define L1_CACHE_SHIFT CONFIG_IA64_L1_CACHE_SHIFT
--#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-
- #ifdef CONFIG_SMP
- # define SMP_CACHE_SHIFT L1_CACHE_SHIFT
-diff --git a/arch/ia64/include/asm/dma-mapping.h b/arch/ia64/include/asm/dma-mapping.h
-index 8d3c79c..71b3af6 100644
---- a/arch/ia64/include/asm/dma-mapping.h
-+++ b/arch/ia64/include/asm/dma-mapping.h
-@@ -12,7 +12,7 @@
-
- #define ARCH_HAS_DMA_GET_REQUIRED_MASK
-
--extern struct dma_map_ops *dma_ops;
-+extern const struct dma_map_ops *dma_ops;
- extern struct ia64_machine_vector ia64_mv;
- extern void set_iommu_machvec(void);
-
-@@ -24,7 +24,7 @@ extern void machvec_dma_sync_sg(struct device *, struct scatterlist *, int,
- static inline void *dma_alloc_coherent(struct device *dev, size_t size,
- dma_addr_t *daddr, gfp_t gfp)
- {
-- struct dma_map_ops *ops = platform_dma_get_ops(dev);
-+ const struct dma_map_ops *ops = platform_dma_get_ops(dev);
- void *caddr;
-
- caddr = ops->alloc_coherent(dev, size, daddr, gfp);
-@@ -35,7 +35,7 @@ static inline void *dma_alloc_coherent(struct device *dev, size_t size,
- static inline void dma_free_coherent(struct device *dev, size_t size,
- void *caddr, dma_addr_t daddr)
- {
-- struct dma_map_ops *ops = platform_dma_get_ops(dev);
-+ const struct dma_map_ops *ops = platform_dma_get_ops(dev);
- debug_dma_free_coherent(dev, size, caddr, daddr);
- ops->free_coherent(dev, size, caddr, daddr);
- }
-@@ -49,13 +49,13 @@ static inline void dma_free_coherent(struct device *dev, size_t size,
-
- static inline int dma_mapping_error(struct device *dev, dma_addr_t daddr)
- {
-- struct dma_map_ops *ops = platform_dma_get_ops(dev);
-+ const struct dma_map_ops *ops = platform_dma_get_ops(dev);
- return ops->mapping_error(dev, daddr);
- }
-
- static inline int dma_supported(struct device *dev, u64 mask)
- {
-- struct dma_map_ops *ops = platform_dma_get_ops(dev);
-+ const struct dma_map_ops *ops = platform_dma_get_ops(dev);
- return ops->dma_supported(dev, mask);
- }
-
-diff --git a/arch/ia64/include/asm/elf.h b/arch/ia64/include/asm/elf.h
-index 86eddee..b116bb4 100644
---- a/arch/ia64/include/asm/elf.h
-+++ b/arch/ia64/include/asm/elf.h
-@@ -43,6 +43,13 @@
- */
- #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x800000000UL)
-
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE (current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
-+
-+#define PAX_DELTA_MMAP_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
-+#define PAX_DELTA_STACK_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
-+#endif
-+
- #define PT_IA_64_UNWIND 0x70000001
-
- /* IA-64 relocations: */
-diff --git a/arch/ia64/include/asm/machvec.h b/arch/ia64/include/asm/machvec.h
-index 367d299..9ad4279 100644
---- a/arch/ia64/include/asm/machvec.h
-+++ b/arch/ia64/include/asm/machvec.h
-@@ -45,7 +45,7 @@ typedef void ia64_mv_kernel_launch_event_t(void);
- /* DMA-mapping interface: */
- typedef void ia64_mv_dma_init (void);
- typedef u64 ia64_mv_dma_get_required_mask (struct device *);
--typedef struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
-+typedef const struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
-
- /*
- * WARNING: The legacy I/O space is _architected_. Platforms are
-@@ -251,7 +251,7 @@ extern void machvec_init_from_cmdline(const char *cmdline);
- # endif /* CONFIG_IA64_GENERIC */
-
- extern void swiotlb_dma_init(void);
--extern struct dma_map_ops *dma_get_ops(struct device *);
-+extern const struct dma_map_ops *dma_get_ops(struct device *);
-
- /*
- * Define default versions so we can extend machvec for new platforms without having
-diff --git a/arch/ia64/include/asm/pgalloc.h b/arch/ia64/include/asm/pgalloc.h
-index 96a8d92..617a1cf 100644
---- a/arch/ia64/include/asm/pgalloc.h
-+++ b/arch/ia64/include/asm/pgalloc.h
-@@ -39,6 +39,12 @@ pgd_populate(struct mm_struct *mm, pgd_t * pgd_entry, pud_t * pud)
- pgd_val(*pgd_entry) = __pa(pud);
- }
-
-+static inline void
-+pgd_populate_kernel(struct mm_struct *mm, pgd_t * pgd_entry, pud_t * pud)
-+{
-+ pgd_populate(mm, pgd_entry, pud);
-+}
-+
- static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr)
- {
- return quicklist_alloc(0, GFP_KERNEL, NULL);
-@@ -57,6 +63,12 @@ pud_populate(struct mm_struct *mm, pud_t * pud_entry, pmd_t * pmd)
- pud_val(*pud_entry) = __pa(pmd);
- }
-
-+static inline void
-+pud_populate_kernel(struct mm_struct *mm, pud_t * pud_entry, pmd_t * pmd)
-+{
-+ pud_populate(mm, pud_entry, pmd);
-+}
-+
- static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long addr)
- {
- return quicklist_alloc(0, GFP_KERNEL, NULL);
-diff --git a/arch/ia64/include/asm/pgtable.h b/arch/ia64/include/asm/pgtable.h
-index 8840a69..cdb63d9 100644
---- a/arch/ia64/include/asm/pgtable.h
-+++ b/arch/ia64/include/asm/pgtable.h
-@@ -12,7 +12,7 @@
- * David Mosberger-Tang <davidm@hpl.hp.com>
- */
-
--
-+#include <linux/const.h>
- #include <asm/mman.h>
- #include <asm/page.h>
- #include <asm/processor.h>
-@@ -143,6 +143,17 @@
- #define PAGE_READONLY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
- #define PAGE_COPY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
- #define PAGE_COPY_EXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RX)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+# define PAGE_SHARED_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RW)
-+# define PAGE_READONLY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
-+# define PAGE_COPY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
-+#else
-+# define PAGE_SHARED_NOEXEC PAGE_SHARED
-+# define PAGE_READONLY_NOEXEC PAGE_READONLY
-+# define PAGE_COPY_NOEXEC PAGE_COPY
-+#endif
-+
- #define PAGE_GATE __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_X_RX)
- #define PAGE_KERNEL __pgprot(__DIRTY_BITS | _PAGE_PL_0 | _PAGE_AR_RWX)
- #define PAGE_KERNELRX __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_RX)
-diff --git a/arch/ia64/include/asm/spinlock.h b/arch/ia64/include/asm/spinlock.h
-index 239ecdc..f94170e 100644
---- a/arch/ia64/include/asm/spinlock.h
-+++ b/arch/ia64/include/asm/spinlock.h
-@@ -72,7 +72,7 @@ static __always_inline void __ticket_spin_unlock(raw_spinlock_t *lock)
- unsigned short *p = (unsigned short *)&lock->lock + 1, tmp;
-
- asm volatile ("ld2.bias %0=[%1]" : "=r"(tmp) : "r"(p));
-- ACCESS_ONCE(*p) = (tmp + 2) & ~1;
-+ ACCESS_ONCE_RW(*p) = (tmp + 2) & ~1;
- }
-
- static __always_inline void __ticket_spin_unlock_wait(raw_spinlock_t *lock)
-diff --git a/arch/ia64/include/asm/uaccess.h b/arch/ia64/include/asm/uaccess.h
-index 449c8c0..50cdf87 100644
---- a/arch/ia64/include/asm/uaccess.h
-+++ b/arch/ia64/include/asm/uaccess.h
-@@ -42,6 +42,8 @@
- #include <asm/pgtable.h>
- #include <asm/io.h>
-
-+extern void check_object_size(const void *ptr, unsigned long n, bool to);
-+
- /*
- * For historical reasons, the following macros are grossly misnamed:
- */
-@@ -240,12 +242,24 @@ extern unsigned long __must_check __copy_user (void __user *to, const void __use
- static inline unsigned long
- __copy_to_user (void __user *to, const void *from, unsigned long count)
- {
-+ if (count > INT_MAX)
-+ return count;
-+
-+ if (!__builtin_constant_p(count))
-+ check_object_size(from, count, true);
-+
- return __copy_user(to, (__force void __user *) from, count);
- }
-
- static inline unsigned long
- __copy_from_user (void *to, const void __user *from, unsigned long count)
- {
-+ if (count > INT_MAX)
-+ return count;
-+
-+ if (!__builtin_constant_p(count))
-+ check_object_size(to, count, false);
-+
- return __copy_user((__force void __user *) to, from, count);
- }
-
-@@ -255,10 +269,13 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
- ({ \
- void __user *__cu_to = (to); \
- const void *__cu_from = (from); \
-- long __cu_len = (n); \
-+ unsigned long __cu_len = (n); \
- \
-- if (__access_ok(__cu_to, __cu_len, get_fs())) \
-+ if (__cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs())) { \
-+ if (!__builtin_constant_p(n)) \
-+ check_object_size(__cu_from, __cu_len, true); \
- __cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len); \
-+ } \
- __cu_len; \
- })
-
-@@ -266,11 +283,14 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
- ({ \
- void *__cu_to = (to); \
- const void __user *__cu_from = (from); \
-- long __cu_len = (n); \
-+ unsigned long __cu_len = (n); \
- \
- __chk_user_ptr(__cu_from); \
-- if (__access_ok(__cu_from, __cu_len, get_fs())) \
-+ if (__cu_len <= INT_MAX && __access_ok(__cu_from, __cu_len, get_fs())) { \
-+ if (!__builtin_constant_p(n)) \
-+ check_object_size(__cu_to, __cu_len, false); \
- __cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len); \
-+ } \
- __cu_len; \
- })
-
-diff --git a/arch/ia64/kernel/dma-mapping.c b/arch/ia64/kernel/dma-mapping.c
-index f2c1600..969398a 100644
---- a/arch/ia64/kernel/dma-mapping.c
-+++ b/arch/ia64/kernel/dma-mapping.c
-@@ -3,7 +3,7 @@
- /* Set this to 1 if there is a HW IOMMU in the system */
- int iommu_detected __read_mostly;
-
--struct dma_map_ops *dma_ops;
-+const struct dma_map_ops *dma_ops;
- EXPORT_SYMBOL(dma_ops);
-
- #define PREALLOC_DMA_DEBUG_ENTRIES (1 << 16)
-@@ -16,7 +16,7 @@ static int __init dma_init(void)
- }
- fs_initcall(dma_init);
-
--struct dma_map_ops *dma_get_ops(struct device *dev)
-+const struct dma_map_ops *dma_get_ops(struct device *dev)
- {
- return dma_ops;
- }
-diff --git a/arch/ia64/kernel/module.c b/arch/ia64/kernel/module.c
-index 1481b0a..e7d38ff 100644
---- a/arch/ia64/kernel/module.c
-+++ b/arch/ia64/kernel/module.c
-@@ -315,8 +315,7 @@ module_alloc (unsigned long size)
- void
- module_free (struct module *mod, void *module_region)
- {
-- if (mod && mod->arch.init_unw_table &&
-- module_region == mod->module_init) {
-+ if (mod && mod->arch.init_unw_table && module_region == mod->module_init_rx) {
- unw_remove_unwind_table(mod->arch.init_unw_table);
- mod->arch.init_unw_table = NULL;
- }
-@@ -502,15 +501,39 @@ module_frob_arch_sections (Elf_Ehdr *ehdr, Elf_Shdr *sechdrs, char *secstrings,
- }
-
- static inline int
-+in_init_rx (const struct module *mod, uint64_t addr)
-+{
-+ return addr - (uint64_t) mod->module_init_rx < mod->init_size_rx;
-+}
-+
-+static inline int
-+in_init_rw (const struct module *mod, uint64_t addr)
-+{
-+ return addr - (uint64_t) mod->module_init_rw < mod->init_size_rw;
-+}
-+
-+static inline int
- in_init (const struct module *mod, uint64_t addr)
- {
-- return addr - (uint64_t) mod->module_init < mod->init_size;
-+ return in_init_rx(mod, addr) || in_init_rw(mod, addr);
-+}
-+
-+static inline int
-+in_core_rx (const struct module *mod, uint64_t addr)
-+{
-+ return addr - (uint64_t) mod->module_core_rx < mod->core_size_rx;
-+}
-+
-+static inline int
-+in_core_rw (const struct module *mod, uint64_t addr)
-+{
-+ return addr - (uint64_t) mod->module_core_rw < mod->core_size_rw;
- }
-
- static inline int
- in_core (const struct module *mod, uint64_t addr)
- {
-- return addr - (uint64_t) mod->module_core < mod->core_size;
-+ return in_core_rx(mod, addr) || in_core_rw(mod, addr);
- }
-
- static inline int
-@@ -693,7 +716,14 @@ do_reloc (struct module *mod, uint8_t r_type, Elf64_Sym *sym, uint64_t addend,
- break;
-
- case RV_BDREL:
-- val -= (uint64_t) (in_init(mod, val) ? mod->module_init : mod->module_core);
-+ if (in_init_rx(mod, val))
-+ val -= (uint64_t) mod->module_init_rx;
-+ else if (in_init_rw(mod, val))
-+ val -= (uint64_t) mod->module_init_rw;
-+ else if (in_core_rx(mod, val))
-+ val -= (uint64_t) mod->module_core_rx;
-+ else if (in_core_rw(mod, val))
-+ val -= (uint64_t) mod->module_core_rw;
- break;
-
- case RV_LTV:
-@@ -828,15 +858,15 @@ apply_relocate_add (Elf64_Shdr *sechdrs, const char *strtab, unsigned int symind
- * addresses have been selected...
- */
- uint64_t gp;
-- if (mod->core_size > MAX_LTOFF)
-+ if (mod->core_size_rx + mod->core_size_rw > MAX_LTOFF)
- /*
- * This takes advantage of fact that SHF_ARCH_SMALL gets allocated
- * at the end of the module.
- */
-- gp = mod->core_size - MAX_LTOFF / 2;
-+ gp = mod->core_size_rx + mod->core_size_rw - MAX_LTOFF / 2;
- else
-- gp = mod->core_size / 2;
-- gp = (uint64_t) mod->module_core + ((gp + 7) & -8);
-+ gp = (mod->core_size_rx + mod->core_size_rw) / 2;
-+ gp = (uint64_t) mod->module_core_rx + ((gp + 7) & -8);
- mod->arch.gp = gp;
- DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp);
- }
-diff --git a/arch/ia64/kernel/pci-dma.c b/arch/ia64/kernel/pci-dma.c
-index f6b1ff0..de773fb 100644
---- a/arch/ia64/kernel/pci-dma.c
-+++ b/arch/ia64/kernel/pci-dma.c
-@@ -43,7 +43,7 @@ struct device fallback_dev = {
- .dma_mask = &fallback_dev.coherent_dma_mask,
- };
-
--extern struct dma_map_ops intel_dma_ops;
-+extern const struct dma_map_ops intel_dma_ops;
-
- static int __init pci_iommu_init(void)
- {
-@@ -96,15 +96,34 @@ int iommu_dma_supported(struct device *dev, u64 mask)
- }
- EXPORT_SYMBOL(iommu_dma_supported);
-
-+extern void *intel_alloc_coherent(struct device *hwdev, size_t size, dma_addr_t *dma_handle, gfp_t flags);
-+extern void intel_free_coherent(struct device *hwdev, size_t size, void *vaddr, dma_addr_t dma_handle);
-+extern int intel_map_sg(struct device *hwdev, struct scatterlist *sglist, int nelems, enum dma_data_direction dir, struct dma_attrs *attrs);
-+extern void intel_unmap_sg(struct device *hwdev, struct scatterlist *sglist, int nelems, enum dma_data_direction dir, struct dma_attrs *attrs);
-+extern dma_addr_t intel_map_page(struct device *dev, struct page *page, unsigned long offset, size_t size, enum dma_data_direction dir, struct dma_attrs *attrs);
-+extern void intel_unmap_page(struct device *dev, dma_addr_t dev_addr, size_t size, enum dma_data_direction dir, struct dma_attrs *attrs);
-+extern int intel_mapping_error(struct device *dev, dma_addr_t dma_addr);
-+
-+static const struct dma_map_ops intel_iommu_dma_ops = {
-+ /* from drivers/pci/intel-iommu.c:intel_dma_ops */
-+ .alloc_coherent = intel_alloc_coherent,
-+ .free_coherent = intel_free_coherent,
-+ .map_sg = intel_map_sg,
-+ .unmap_sg = intel_unmap_sg,
-+ .map_page = intel_map_page,
-+ .unmap_page = intel_unmap_page,
-+ .mapping_error = intel_mapping_error,
-+
-+ .sync_single_for_cpu = machvec_dma_sync_single,
-+ .sync_sg_for_cpu = machvec_dma_sync_sg,
-+ .sync_single_for_device = machvec_dma_sync_single,
-+ .sync_sg_for_device = machvec_dma_sync_sg,
-+ .dma_supported = iommu_dma_supported,
-+};
-+
- void __init pci_iommu_alloc(void)
- {
-- dma_ops = &intel_dma_ops;
--
-- dma_ops->sync_single_for_cpu = machvec_dma_sync_single;
-- dma_ops->sync_sg_for_cpu = machvec_dma_sync_sg;
-- dma_ops->sync_single_for_device = machvec_dma_sync_single;
-- dma_ops->sync_sg_for_device = machvec_dma_sync_sg;
-- dma_ops->dma_supported = iommu_dma_supported;
-+ dma_ops = &intel_iommu_dma_ops;
-
- /*
- * The order of these functions is important for
-diff --git a/arch/ia64/kernel/pci-swiotlb.c b/arch/ia64/kernel/pci-swiotlb.c
-index 285aae8..61dbab6 100644
---- a/arch/ia64/kernel/pci-swiotlb.c
-+++ b/arch/ia64/kernel/pci-swiotlb.c
-@@ -21,7 +21,7 @@ static void *ia64_swiotlb_alloc_coherent(struct device *dev, size_t size,
- return swiotlb_alloc_coherent(dev, size, dma_handle, gfp);
- }
-
--struct dma_map_ops swiotlb_dma_ops = {
-+const struct dma_map_ops swiotlb_dma_ops = {
- .alloc_coherent = ia64_swiotlb_alloc_coherent,
- .free_coherent = swiotlb_free_coherent,
- .map_page = swiotlb_map_page,
-diff --git a/arch/ia64/kernel/sys_ia64.c b/arch/ia64/kernel/sys_ia64.c
-index 609d500..acd0429 100644
---- a/arch/ia64/kernel/sys_ia64.c
-+++ b/arch/ia64/kernel/sys_ia64.c
-@@ -28,6 +28,7 @@ arch_get_unmapped_area (struct file *filp, unsigned long addr, unsigned long len
- unsigned long start_addr, align_mask = PAGE_SIZE - 1;
- struct mm_struct *mm = current->mm;
- struct vm_area_struct *vma;
-+ unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
-
- if (len > RGN_MAP_LIMIT)
- return -ENOMEM;
-@@ -43,6 +44,13 @@ arch_get_unmapped_area (struct file *filp, unsigned long addr, unsigned long len
- if (REGION_NUMBER(addr) == RGN_HPAGE)
- addr = 0;
- #endif
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ addr = mm->free_area_cache;
-+ else
-+#endif
-+
- if (!addr)
- addr = mm->free_area_cache;
-
-@@ -61,14 +69,14 @@ arch_get_unmapped_area (struct file *filp, unsigned long addr, unsigned long len
- for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
- /* At this point: (!vma || addr < vma->vm_end). */
- if (TASK_SIZE - len < addr || RGN_MAP_LIMIT - len < REGION_OFFSET(addr)) {
-- if (start_addr != TASK_UNMAPPED_BASE) {
-+ if (start_addr != mm->mmap_base) {
- /* Start a new search --- just in case we missed some holes. */
-- addr = TASK_UNMAPPED_BASE;
-+ addr = mm->mmap_base;
- goto full_search;
- }
- return -ENOMEM;
- }
-- if (!vma || addr + len <= vma->vm_start) {
-+ if (check_heap_stack_gap(vma, addr, len, offset)) {
- /* Remember the address where we stopped this search: */
- mm->free_area_cache = addr + len;
- return addr;
-diff --git a/arch/ia64/kernel/topology.c b/arch/ia64/kernel/topology.c
-index 8f06035..b3a5818 100644
---- a/arch/ia64/kernel/topology.c
-+++ b/arch/ia64/kernel/topology.c
-@@ -282,7 +282,7 @@ static ssize_t cache_show(struct kobject * kobj, struct attribute * attr, char *
- return ret;
- }
-
--static struct sysfs_ops cache_sysfs_ops = {
-+static const struct sysfs_ops cache_sysfs_ops = {
- .show = cache_show
- };
-
-diff --git a/arch/ia64/kernel/vmlinux.lds.S b/arch/ia64/kernel/vmlinux.lds.S
-index 0a0c77b..8e55a81 100644
---- a/arch/ia64/kernel/vmlinux.lds.S
-+++ b/arch/ia64/kernel/vmlinux.lds.S
-@@ -190,7 +190,7 @@ SECTIONS
- /* Per-cpu data: */
- . = ALIGN(PERCPU_PAGE_SIZE);
- PERCPU_VADDR(PERCPU_ADDR, :percpu)
-- __phys_per_cpu_start = __per_cpu_load;
-+ __phys_per_cpu_start = per_cpu_load;
- . = __phys_per_cpu_start + PERCPU_PAGE_SIZE; /* ensure percpu data fits
- * into percpu page size
- */
-diff --git a/arch/ia64/mm/fault.c b/arch/ia64/mm/fault.c
-index 19261a9..1611b7a 100644
---- a/arch/ia64/mm/fault.c
-+++ b/arch/ia64/mm/fault.c
-@@ -72,6 +72,23 @@ mapped_kernel_page_is_present (unsigned long address)
- return pte_present(pte);
- }
-
-+#ifdef CONFIG_PAX_PAGEEXEC
-+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
-+{
-+ unsigned long i;
-+
-+ printk(KERN_ERR "PAX: bytes at PC: ");
-+ for (i = 0; i < 8; i++) {
-+ unsigned int c;
-+ if (get_user(c, (unsigned int *)pc+i))
-+ printk(KERN_CONT "???????? ");
-+ else
-+ printk(KERN_CONT "%08x ", c);
-+ }
-+ printk("\n");
-+}
-+#endif
-+
- void __kprobes
- ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *regs)
- {
-@@ -145,9 +162,23 @@ ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *re
- mask = ( (((isr >> IA64_ISR_X_BIT) & 1UL) << VM_EXEC_BIT)
- | (((isr >> IA64_ISR_W_BIT) & 1UL) << VM_WRITE_BIT));
-
-- if ((vma->vm_flags & mask) != mask)
-+ if ((vma->vm_flags & mask) != mask) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (!(vma->vm_flags & VM_EXEC) && (mask & VM_EXEC)) {
-+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->cr_iip)
-+ goto bad_area;
-+
-+ up_read(&mm->mmap_sem);
-+ pax_report_fault(regs, (void *)regs->cr_iip, (void *)regs->r12);
-+ do_group_exit(SIGKILL);
-+ }
-+#endif
-+
- goto bad_area;
-
-+ }
-+
- survive:
- /*
- * If for any reason at all we couldn't handle the fault, make
-diff --git a/arch/ia64/mm/hugetlbpage.c b/arch/ia64/mm/hugetlbpage.c
-index b0f6157..f83c84f 100644
---- a/arch/ia64/mm/hugetlbpage.c
-+++ b/arch/ia64/mm/hugetlbpage.c
-@@ -150,6 +150,7 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr, u
- unsigned long pgoff, unsigned long flags)
- {
- struct vm_area_struct *vmm;
-+ unsigned long offset = gr_rand_threadstack_offset(current->mm, file, flags);
-
- if (len > RGN_MAP_LIMIT)
- return -ENOMEM;
-@@ -172,7 +173,7 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr, u
- /* At this point: (!vmm || addr < vmm->vm_end). */
- if (REGION_OFFSET(addr) + len > RGN_MAP_LIMIT)
- return -ENOMEM;
-- if (!vmm || (addr + len) <= vmm->vm_start)
-+ if (check_heap_stack_gap(vmm, addr, len, offset))
- return addr;
- addr = ALIGN(vmm->vm_end, HPAGE_SIZE);
- }
-diff --git a/arch/ia64/mm/init.c b/arch/ia64/mm/init.c
-index 1857766..05cc6a3 100644
---- a/arch/ia64/mm/init.c
-+++ b/arch/ia64/mm/init.c
-@@ -122,6 +122,19 @@ ia64_init_addr_space (void)
- vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
- vma->vm_end = vma->vm_start + PAGE_SIZE;
- vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT;
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (current->mm->pax_flags & MF_PAX_PAGEEXEC) {
-+ vma->vm_flags &= ~VM_EXEC;
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (current->mm->pax_flags & MF_PAX_MPROTECT)
-+ vma->vm_flags &= ~VM_MAYEXEC;
-+#endif
-+
-+ }
-+#endif
-+
- vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
- down_write(¤t->mm->mmap_sem);
- if (insert_vm_struct(current->mm, vma)) {
-diff --git a/arch/ia64/sn/pci/pci_dma.c b/arch/ia64/sn/pci/pci_dma.c
-index 98b6849..8046766 100644
---- a/arch/ia64/sn/pci/pci_dma.c
-+++ b/arch/ia64/sn/pci/pci_dma.c
-@@ -464,7 +464,7 @@ int sn_pci_legacy_write(struct pci_bus *bus, u16 port, u32 val, u8 size)
- return ret;
- }
-
--static struct dma_map_ops sn_dma_ops = {
-+static const struct dma_map_ops sn_dma_ops = {
- .alloc_coherent = sn_dma_alloc_coherent,
- .free_coherent = sn_dma_free_coherent,
- .map_page = sn_dma_map_page,
-diff --git a/arch/m32r/include/asm/cache.h b/arch/m32r/include/asm/cache.h
-index 40b3ee9..8c2c112 100644
---- a/arch/m32r/include/asm/cache.h
-+++ b/arch/m32r/include/asm/cache.h
-@@ -1,8 +1,10 @@
- #ifndef _ASM_M32R_CACHE_H
- #define _ASM_M32R_CACHE_H
-
-+#include <linux/const.h>
-+
- /* L1 cache line size */
- #define L1_CACHE_SHIFT 4
--#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-
- #endif /* _ASM_M32R_CACHE_H */
-diff --git a/arch/m32r/lib/usercopy.c b/arch/m32r/lib/usercopy.c
-index 82abd15..d95ae5d 100644
---- a/arch/m32r/lib/usercopy.c
-+++ b/arch/m32r/lib/usercopy.c
-@@ -14,6 +14,9 @@
- unsigned long
- __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
- {
-+ if ((long)n < 0)
-+ return n;
-+
- prefetch(from);
- if (access_ok(VERIFY_WRITE, to, n))
- __copy_user(to,from,n);
-@@ -23,6 +26,9 @@ __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
- unsigned long
- __generic_copy_from_user(void *to, const void __user *from, unsigned long n)
- {
-+ if ((long)n < 0)
-+ return n;
-+
- prefetchw(to);
- if (access_ok(VERIFY_READ, from, n))
- __copy_user_zeroing(to,from,n);
-diff --git a/arch/m68k/include/asm/cache.h b/arch/m68k/include/asm/cache.h
-index ecafbe1..432c3e4 100644
---- a/arch/m68k/include/asm/cache.h
-+++ b/arch/m68k/include/asm/cache.h
-@@ -4,9 +4,11 @@
- #ifndef __ARCH_M68K_CACHE_H
- #define __ARCH_M68K_CACHE_H
-
-+#include <linux/const.h>
-+
- /* bytes per L1 cache line */
- #define L1_CACHE_SHIFT 4
--#define L1_CACHE_BYTES (1<< L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-
- #define ARCH_KMALLOC_MINALIGN L1_CACHE_BYTES
-
-diff --git a/arch/microblaze/include/asm/cache.h b/arch/microblaze/include/asm/cache.h
-index c209c47..2ba96e2 100644
---- a/arch/microblaze/include/asm/cache.h
-+++ b/arch/microblaze/include/asm/cache.h
-@@ -13,11 +13,12 @@
- #ifndef _ASM_MICROBLAZE_CACHE_H
- #define _ASM_MICROBLAZE_CACHE_H
-
-+#include <linux/const.h>
- #include <asm/registers.h>
-
- #define L1_CACHE_SHIFT 2
- /* word-granular cache in microblaze */
--#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-
- #define SMP_CACHE_BYTES L1_CACHE_BYTES
-
-diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
-index fd7620f..63d73a6 100644
---- a/arch/mips/Kconfig
-+++ b/arch/mips/Kconfig
-@@ -5,6 +5,7 @@ config MIPS
- select HAVE_IDE
- select HAVE_OPROFILE
- select HAVE_ARCH_KGDB
-+ select GENERIC_ATOMIC64 if !64BIT
- # Horrible source of confusion. Die, die, die ...
- select EMBEDDED
- select RTC_LIB if !LEMOTE_FULOONG2E
-diff --git a/arch/mips/Makefile b/arch/mips/Makefile
-index 77f5021..2b1db8a 100644
---- a/arch/mips/Makefile
-+++ b/arch/mips/Makefile
-@@ -51,6 +51,8 @@ endif
- cflags-y := -ffunction-sections
- cflags-y += $(call cc-option, -mno-check-zero-division)
-
-+cflags-y += -Wno-sign-compare -Wno-extra
-+
- ifdef CONFIG_32BIT
- ld-emul = $(32bit-emul)
- vmlinux-32 = vmlinux
-diff --git a/arch/mips/alchemy/devboards/pm.c b/arch/mips/alchemy/devboards/pm.c
-index 632f986..fd0378d 100644
---- a/arch/mips/alchemy/devboards/pm.c
-+++ b/arch/mips/alchemy/devboards/pm.c
-@@ -78,7 +78,7 @@ static void db1x_pm_end(void)
-
- }
-
--static struct platform_suspend_ops db1x_pm_ops = {
-+static const struct platform_suspend_ops db1x_pm_ops = {
- .valid = suspend_valid_only_mem,
- .begin = db1x_pm_begin,
- .enter = db1x_pm_enter,
-diff --git a/arch/mips/include/asm/atomic.h b/arch/mips/include/asm/atomic.h
-index 09e7128..111035b 100644
---- a/arch/mips/include/asm/atomic.h
-+++ b/arch/mips/include/asm/atomic.h
-@@ -21,6 +21,10 @@
- #include <asm/war.h>
- #include <asm/system.h>
-
-+#ifdef CONFIG_GENERIC_ATOMIC64
-+#include <asm-generic/atomic64.h>
-+#endif
-+
- #define ATOMIC_INIT(i) { (i) }
-
- /*
-@@ -782,6 +786,16 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
- */
- #define atomic64_add_negative(i, v) (atomic64_add_return(i, (v)) < 0)
-
-+#define atomic64_read_unchecked(v) atomic64_read(v)
-+#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
-+#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
-+#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
-+#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
-+#define atomic64_inc_unchecked(v) atomic64_inc(v)
-+#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
-+#define atomic64_dec_unchecked(v) atomic64_dec(v)
-+#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
-+
- #endif /* CONFIG_64BIT */
-
- /*
-diff --git a/arch/mips/include/asm/cache.h b/arch/mips/include/asm/cache.h
-index 37f175c..c7a3065 100644
---- a/arch/mips/include/asm/cache.h
-+++ b/arch/mips/include/asm/cache.h
-@@ -9,10 +9,11 @@
- #ifndef _ASM_CACHE_H
- #define _ASM_CACHE_H
-
-+#include <linux/const.h>
- #include <kmalloc.h>
-
- #define L1_CACHE_SHIFT CONFIG_MIPS_L1_CACHE_SHIFT
--#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-
- #define SMP_CACHE_SHIFT L1_CACHE_SHIFT
- #define SMP_CACHE_BYTES L1_CACHE_BYTES
-diff --git a/arch/mips/include/asm/elf.h b/arch/mips/include/asm/elf.h
-index 7990694..4e93acf 100644
---- a/arch/mips/include/asm/elf.h
-+++ b/arch/mips/include/asm/elf.h
-@@ -368,4 +368,11 @@ extern int dump_task_fpu(struct task_struct *, elf_fpregset_t *);
- #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
- #endif
-
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
-+
-+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#endif
-+
- #endif /* _ASM_ELF_H */
-diff --git a/arch/mips/include/asm/page.h b/arch/mips/include/asm/page.h
-index f266295..627cfff 100644
---- a/arch/mips/include/asm/page.h
-+++ b/arch/mips/include/asm/page.h
-@@ -93,7 +93,7 @@ extern void copy_user_highpage(struct page *to, struct page *from,
- #ifdef CONFIG_CPU_MIPS32
- typedef struct { unsigned long pte_low, pte_high; } pte_t;
- #define pte_val(x) ((x).pte_low | ((unsigned long long)(x).pte_high << 32))
-- #define __pte(x) ({ pte_t __pte = {(x), ((unsigned long long)(x)) >> 32}; __pte; })
-+ #define __pte(x) ({ pte_t __pte = {(x), (x) >> 32}; __pte; })
- #else
- typedef struct { unsigned long long pte; } pte_t;
- #define pte_val(x) ((x).pte)
-diff --git a/arch/mips/include/asm/pgalloc.h b/arch/mips/include/asm/pgalloc.h
-index 3738f4b..9020d86 100644
---- a/arch/mips/include/asm/pgalloc.h
-+++ b/arch/mips/include/asm/pgalloc.h
-@@ -37,6 +37,11 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
- {
- set_pud(pud, __pud((unsigned long)pmd));
- }
-+
-+static inline void pud_populate_kernel(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
-+{
-+ pud_populate(mm, pud, pmd);
-+}
- #endif
-
- /*
-diff --git a/arch/mips/include/asm/reboot.h b/arch/mips/include/asm/reboot.h
-index e48c0bf..f3acf65 100644
---- a/arch/mips/include/asm/reboot.h
-+++ b/arch/mips/include/asm/reboot.h
-@@ -9,7 +9,7 @@
- #ifndef _ASM_REBOOT_H
- #define _ASM_REBOOT_H
-
--extern void (*_machine_restart)(char *command);
--extern void (*_machine_halt)(void);
-+extern void (*__noreturn _machine_restart)(char *command);
-+extern void (*__noreturn _machine_halt)(void);
-
- #endif /* _ASM_REBOOT_H */
-diff --git a/arch/mips/include/asm/system.h b/arch/mips/include/asm/system.h
-index 83b5509..9fa24a23 100644
---- a/arch/mips/include/asm/system.h
-+++ b/arch/mips/include/asm/system.h
-@@ -230,6 +230,6 @@ extern void per_cpu_trap_init(void);
- */
- #define __ARCH_WANT_UNLOCKED_CTXSW
-
--extern unsigned long arch_align_stack(unsigned long sp);
-+#define arch_align_stack(x) ((x) & ~0xfUL)
-
- #endif /* _ASM_SYSTEM_H */
-diff --git a/arch/mips/include/asm/thread_info.h b/arch/mips/include/asm/thread_info.h
-index 0e50757..4e9432c 100644
---- a/arch/mips/include/asm/thread_info.h
-+++ b/arch/mips/include/asm/thread_info.h
-@@ -120,6 +120,8 @@ register struct thread_info *__current_thread_info __asm__("$28");
- #define TIF_32BIT_ADDR 23 /* 32-bit address space (o32/n32) */
- #define TIF_FPUBOUND 24 /* thread bound to FPU-full CPU set */
- #define TIF_LOAD_WATCH 25 /* If set, load watch registers */
-+/* li takes a 32bit immediate */
-+#define TIF_GRSEC_SETXID 29 /* update credentials on syscall entry/exit */
- #define TIF_SYSCALL_TRACE 31 /* syscall trace active */
-
- #ifdef CONFIG_MIPS32_O32
-@@ -144,11 +146,14 @@ register struct thread_info *__current_thread_info __asm__("$28");
- #define _TIF_32BIT_ADDR (1<<TIF_32BIT_ADDR)
- #define _TIF_FPUBOUND (1<<TIF_FPUBOUND)
- #define _TIF_LOAD_WATCH (1<<TIF_LOAD_WATCH)
-+#define _TIF_GRSEC_SETXID (1<<TIF_GRSEC_SETXID)
-+
-+#define _TIF_SYSCALL_WORK (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | _TIF_GRSEC_SETXID)
-
- /* work to do on interrupt/exception return */
- #define _TIF_WORK_MASK (0x0000ffef & ~_TIF_SECCOMP)
- /* work to do on any return to u-space */
--#define _TIF_ALLWORK_MASK (0x8000ffff & ~_TIF_SECCOMP)
-+#define _TIF_ALLWORK_MASK ((0x8000ffff & ~_TIF_SECCOMP) | _TIF_GRSEC_SETXID)
-
- #endif /* __KERNEL__ */
-
-diff --git a/arch/mips/kernel/binfmt_elfn32.c b/arch/mips/kernel/binfmt_elfn32.c
-index 9fdd8bc..fcf9d68 100644
---- a/arch/mips/kernel/binfmt_elfn32.c
-+++ b/arch/mips/kernel/binfmt_elfn32.c
-@@ -50,6 +50,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
- #undef ELF_ET_DYN_BASE
- #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
-
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
-+
-+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#endif
-+
- #include <asm/processor.h>
- #include <linux/module.h>
- #include <linux/elfcore.h>
-diff --git a/arch/mips/kernel/binfmt_elfo32.c b/arch/mips/kernel/binfmt_elfo32.c
-index ff44823..cf0b48a 100644
---- a/arch/mips/kernel/binfmt_elfo32.c
-+++ b/arch/mips/kernel/binfmt_elfo32.c
-@@ -52,6 +52,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
- #undef ELF_ET_DYN_BASE
- #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
-
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
-+
-+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#endif
-+
- #include <asm/processor.h>
-
- /*
-diff --git a/arch/mips/kernel/entry.S b/arch/mips/kernel/entry.S
-index ffa3310..f8b1e06 100644
---- a/arch/mips/kernel/entry.S
-+++ b/arch/mips/kernel/entry.S
-@@ -167,7 +167,7 @@ work_notifysig: # deal with pending signals and
- FEXPORT(syscall_exit_work_partial)
- SAVE_STATIC
- syscall_exit_work:
-- li t0, _TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT
-+ li t0, _TIF_SYSCALL_WORK
- and t0, a2 # a2 is preloaded with TI_FLAGS
- beqz t0, work_pending # trace bit set?
- local_irq_enable # could let do_syscall_trace()
-diff --git a/arch/mips/kernel/kgdb.c b/arch/mips/kernel/kgdb.c
-index 50c9bb8..efdd5f8 100644
---- a/arch/mips/kernel/kgdb.c
-+++ b/arch/mips/kernel/kgdb.c
-@@ -245,6 +245,7 @@ int kgdb_arch_handle_exception(int vector, int signo, int err_code,
- return -1;
- }
-
-+/* cannot be const */
- struct kgdb_arch arch_kgdb_ops;
-
- /*
-diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
-index f3d73e1..bb3f57a 100644
---- a/arch/mips/kernel/process.c
-+++ b/arch/mips/kernel/process.c
-@@ -470,15 +470,3 @@ unsigned long get_wchan(struct task_struct *task)
- out:
- return pc;
- }
--
--/*
-- * Don't forget that the stack pointer must be aligned on a 8 bytes
-- * boundary for 32-bits ABI and 16 bytes for 64-bits ABI.
-- */
--unsigned long arch_align_stack(unsigned long sp)
--{
-- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
-- sp -= get_random_int() & ~PAGE_MASK;
--
-- return sp & ALMASK;
--}
-diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
-index 054861c..ddbbc7d 100644
---- a/arch/mips/kernel/ptrace.c
-+++ b/arch/mips/kernel/ptrace.c
-@@ -558,6 +558,10 @@ static inline int audit_arch(void)
- return arch;
- }
-
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+extern void gr_delayed_cred_worker(void);
-+#endif
-+
- /*
- * Notification of system call entry/exit
- * - triggered by current->work.syscall_trace
-@@ -568,6 +572,11 @@ asmlinkage void do_syscall_trace(struct pt_regs *regs, int entryexit)
- if (!entryexit)
- secure_computing(regs->regs[0]);
-
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+ if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
-+ gr_delayed_cred_worker();
-+#endif
-+
- if (unlikely(current->audit_context) && entryexit)
- audit_syscall_exit(AUDITSC_RESULT(regs->regs[2]),
- regs->regs[2]);
-diff --git a/arch/mips/kernel/reset.c b/arch/mips/kernel/reset.c
-index 060563a..7fbf310 100644
---- a/arch/mips/kernel/reset.c
-+++ b/arch/mips/kernel/reset.c
-@@ -19,8 +19,8 @@
- * So handle all using function pointers to machine specific
- * functions.
- */
--void (*_machine_restart)(char *command);
--void (*_machine_halt)(void);
-+void (*__noreturn _machine_restart)(char *command);
-+void (*__noreturn _machine_halt)(void);
- void (*pm_power_off)(void);
-
- EXPORT_SYMBOL(pm_power_off);
-@@ -29,16 +29,19 @@ void machine_restart(char *command)
- {
- if (_machine_restart)
- _machine_restart(command);
-+ BUG();
- }
-
- void machine_halt(void)
- {
- if (_machine_halt)
- _machine_halt();
-+ BUG();
- }
-
- void machine_power_off(void)
- {
- if (pm_power_off)
- pm_power_off();
-+ BUG();
- }
-diff --git a/arch/mips/kernel/scall32-o32.S b/arch/mips/kernel/scall32-o32.S
-index fd2a9bb..73ecc89 100644
---- a/arch/mips/kernel/scall32-o32.S
-+++ b/arch/mips/kernel/scall32-o32.S
-@@ -52,7 +52,7 @@ NESTED(handle_sys, PT_SIZE, sp)
-
- stack_done:
- lw t0, TI_FLAGS($28) # syscall tracing enabled?
-- li t1, _TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT
-+ li t1, _TIF_SYSCALL_WORK
- and t0, t1
- bnez t0, syscall_trace_entry # -> yes
-
-diff --git a/arch/mips/kernel/scall64-64.S b/arch/mips/kernel/scall64-64.S
-index 18bf7f3..6659dde 100644
---- a/arch/mips/kernel/scall64-64.S
-+++ b/arch/mips/kernel/scall64-64.S
-@@ -54,7 +54,7 @@ NESTED(handle_sys64, PT_SIZE, sp)
-
- sd a3, PT_R26(sp) # save a3 for syscall restarting
-
-- li t1, _TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT
-+ li t1, _TIF_SYSCALL_WORK
- LONG_L t0, TI_FLAGS($28) # syscall tracing enabled?
- and t0, t1, t0
- bnez t0, syscall_trace_entry
-diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
-index 6ebc079..a16f976 100644
---- a/arch/mips/kernel/scall64-n32.S
-+++ b/arch/mips/kernel/scall64-n32.S
-@@ -53,7 +53,7 @@ NESTED(handle_sysn32, PT_SIZE, sp)
-
- sd a3, PT_R26(sp) # save a3 for syscall restarting
-
-- li t1, _TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT
-+ li t1, _TIF_SYSCALL_WORK
- LONG_L t0, TI_FLAGS($28) # syscall tracing enabled?
- and t0, t1, t0
- bnez t0, n32_syscall_trace_entry
-diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
-index 14dde4c..dc68acf 100644
---- a/arch/mips/kernel/scall64-o32.S
-+++ b/arch/mips/kernel/scall64-o32.S
-@@ -81,7 +81,7 @@ NESTED(handle_sys, PT_SIZE, sp)
- PTR 4b, bad_stack
- .previous
-
-- li t1, _TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT
-+ li t1, _TIF_SYSCALL_WORK
- LONG_L t0, TI_FLAGS($28) # syscall tracing enabled?
- and t0, t1, t0
- bnez t0, trace_a_syscall
-diff --git a/arch/mips/kernel/syscall.c b/arch/mips/kernel/syscall.c
-index 3f7f466..3abe0b5 100644
---- a/arch/mips/kernel/syscall.c
-+++ b/arch/mips/kernel/syscall.c
-@@ -102,17 +102,21 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
- do_color_align = 0;
- if (filp || (flags & MAP_SHARED))
- do_color_align = 1;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- if (addr) {
- if (do_color_align)
- addr = COLOUR_ALIGN(addr, pgoff);
- else
- addr = PAGE_ALIGN(addr);
- vmm = find_vma(current->mm, addr);
-- if (task_size - len >= addr &&
-- (!vmm || addr + len <= vmm->vm_start))
-+ if (task_size - len >= addr && check_heap_stack_gap(vmm, addr, len))
- return addr;
- }
-- addr = TASK_UNMAPPED_BASE;
-+ addr = current->mm->mmap_base;
- if (do_color_align)
- addr = COLOUR_ALIGN(addr, pgoff);
- else
-@@ -122,7 +126,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
- /* At this point: (!vmm || addr < vmm->vm_end). */
- if (task_size - len < addr)
- return -ENOMEM;
-- if (!vmm || addr + len <= vmm->vm_start)
-+ if (check_heap_stack_gap(vmm, addr, len))
- return addr;
- addr = vmm->vm_end;
- if (do_color_align)
-diff --git a/arch/mips/mm/fault.c b/arch/mips/mm/fault.c
-index e97a7a2..f18f5b0 100644
---- a/arch/mips/mm/fault.c
-+++ b/arch/mips/mm/fault.c
-@@ -26,6 +26,23 @@
- #include <asm/ptrace.h>
- #include <asm/highmem.h> /* For VMALLOC_END */
-
-+#ifdef CONFIG_PAX_PAGEEXEC
-+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
-+{
-+ unsigned long i;
-+
-+ printk(KERN_ERR "PAX: bytes at PC: ");
-+ for (i = 0; i < 5; i++) {
-+ unsigned int c;
-+ if (get_user(c, (unsigned int *)pc+i))
-+ printk(KERN_CONT "???????? ");
-+ else
-+ printk(KERN_CONT "%08x ", c);
-+ }
-+ printk("\n");
-+}
-+#endif
-+
- /*
- * This routine handles page faults. It determines the address,
- * and the problem, and then passes it off to one of the appropriate
-diff --git a/arch/mn10300/proc-mn103e010/include/proc/cache.h b/arch/mn10300/proc-mn103e010/include/proc/cache.h
-index bdc1f9a..e8de5c5 100644
---- a/arch/mn10300/proc-mn103e010/include/proc/cache.h
-+++ b/arch/mn10300/proc-mn103e010/include/proc/cache.h
-@@ -11,12 +11,14 @@
- #ifndef _ASM_PROC_CACHE_H
- #define _ASM_PROC_CACHE_H
-
-+#include <linux/const.h>
-+
- /* L1 cache */
-
- #define L1_CACHE_NWAYS 4 /* number of ways in caches */
- #define L1_CACHE_NENTRIES 256 /* number of entries in each way */
--#define L1_CACHE_BYTES 16 /* bytes per entry */
- #define L1_CACHE_SHIFT 4 /* shift for bytes per entry */
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT) /* bytes per entry */
- #define L1_CACHE_WAYDISP 0x1000 /* displacement of one way from the next */
-
- #define L1_CACHE_TAG_VALID 0x00000001 /* cache tag valid bit */
-diff --git a/arch/parisc/include/asm/atomic.h b/arch/parisc/include/asm/atomic.h
-index 6ee459d..71c1831 100644
---- a/arch/parisc/include/asm/atomic.h
-+++ b/arch/parisc/include/asm/atomic.h
-@@ -336,6 +336,16 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
-
- #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
-
-+#define atomic64_read_unchecked(v) atomic64_read(v)
-+#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
-+#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
-+#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
-+#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
-+#define atomic64_inc_unchecked(v) atomic64_inc(v)
-+#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
-+#define atomic64_dec_unchecked(v) atomic64_dec(v)
-+#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
-+
- #else /* CONFIG_64BIT */
-
- #include <asm-generic/atomic64.h>
-diff --git a/arch/parisc/include/asm/cache.h b/arch/parisc/include/asm/cache.h
-index 32c2cca..a7b3a64 100644
---- a/arch/parisc/include/asm/cache.h
-+++ b/arch/parisc/include/asm/cache.h
-@@ -5,6 +5,7 @@
- #ifndef __ARCH_PARISC_CACHE_H
- #define __ARCH_PARISC_CACHE_H
-
-+#include <linux/const.h>
-
- /*
- * PA 2.0 processors have 64-byte cachelines; PA 1.1 processors have
-@@ -15,13 +16,13 @@
- * just ruin performance.
- */
- #ifdef CONFIG_PA20
--#define L1_CACHE_BYTES 64
- #define L1_CACHE_SHIFT 6
- #else
--#define L1_CACHE_BYTES 32
- #define L1_CACHE_SHIFT 5
- #endif
-
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-+
- #ifndef __ASSEMBLY__
-
- #define L1_CACHE_ALIGN(x) (((x)+(L1_CACHE_BYTES-1))&~(L1_CACHE_BYTES-1))
-diff --git a/arch/parisc/include/asm/elf.h b/arch/parisc/include/asm/elf.h
-index 9c802eb..0592e41 100644
---- a/arch/parisc/include/asm/elf.h
-+++ b/arch/parisc/include/asm/elf.h
-@@ -343,6 +343,13 @@ struct pt_regs; /* forward declaration... */
-
- #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x01000000)
-
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE 0x10000UL
-+
-+#define PAX_DELTA_MMAP_LEN 16
-+#define PAX_DELTA_STACK_LEN 16
-+#endif
-+
- /* This yields a mask that user programs can use to figure out what
- instruction set this CPU supports. This could be done in user space,
- but it's not easy, and we've already done it here. */
-diff --git a/arch/parisc/include/asm/pgalloc.h b/arch/parisc/include/asm/pgalloc.h
-index fc987a1..6e068ef 100644
---- a/arch/parisc/include/asm/pgalloc.h
-+++ b/arch/parisc/include/asm/pgalloc.h
-@@ -61,6 +61,11 @@ static inline void pgd_populate(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmd)
- (__u32)(__pa((unsigned long)pmd) >> PxD_VALUE_SHIFT));
- }
-
-+static inline void pgd_populate_kernel(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmd)
-+{
-+ pgd_populate(mm, pgd, pmd);
-+}
-+
- static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long address)
- {
- pmd_t *pmd = (pmd_t *)__get_free_pages(GFP_KERNEL|__GFP_REPEAT,
-@@ -93,6 +98,7 @@ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
- #define pmd_alloc_one(mm, addr) ({ BUG(); ((pmd_t *)2); })
- #define pmd_free(mm, x) do { } while (0)
- #define pgd_populate(mm, pmd, pte) BUG()
-+#define pgd_populate_kernel(mm, pmd, pte) BUG()
-
- #endif
-
-diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
-index a27d2e2..18fd845 100644
---- a/arch/parisc/include/asm/pgtable.h
-+++ b/arch/parisc/include/asm/pgtable.h
-@@ -207,6 +207,17 @@
- #define PAGE_EXECREAD __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
- #define PAGE_COPY PAGE_EXECREAD
- #define PAGE_RWX __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_ACCESSED)
-+# define PAGE_COPY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
-+# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
-+#else
-+# define PAGE_SHARED_NOEXEC PAGE_SHARED
-+# define PAGE_COPY_NOEXEC PAGE_COPY
-+# define PAGE_READONLY_NOEXEC PAGE_READONLY
-+#endif
-+
- #define PAGE_KERNEL __pgprot(_PAGE_KERNEL)
- #define PAGE_KERNEL_RO __pgprot(_PAGE_KERNEL & ~_PAGE_WRITE)
- #define PAGE_KERNEL_UNC __pgprot(_PAGE_KERNEL | _PAGE_NO_CACHE)
-diff --git a/arch/parisc/kernel/module.c b/arch/parisc/kernel/module.c
-index 2120746..8d70a5e 100644
---- a/arch/parisc/kernel/module.c
-+++ b/arch/parisc/kernel/module.c
-@@ -95,16 +95,38 @@
-
- /* three functions to determine where in the module core
- * or init pieces the location is */
-+static inline int in_init_rx(struct module *me, void *loc)
-+{
-+ return (loc >= me->module_init_rx &&
-+ loc < (me->module_init_rx + me->init_size_rx));
-+}
-+
-+static inline int in_init_rw(struct module *me, void *loc)
-+{
-+ return (loc >= me->module_init_rw &&
-+ loc < (me->module_init_rw + me->init_size_rw));
-+}
-+
- static inline int in_init(struct module *me, void *loc)
- {
-- return (loc >= me->module_init &&
-- loc <= (me->module_init + me->init_size));
-+ return in_init_rx(me, loc) || in_init_rw(me, loc);
-+}
-+
-+static inline int in_core_rx(struct module *me, void *loc)
-+{
-+ return (loc >= me->module_core_rx &&
-+ loc < (me->module_core_rx + me->core_size_rx));
-+}
-+
-+static inline int in_core_rw(struct module *me, void *loc)
-+{
-+ return (loc >= me->module_core_rw &&
-+ loc < (me->module_core_rw + me->core_size_rw));
- }
-
- static inline int in_core(struct module *me, void *loc)
- {
-- return (loc >= me->module_core &&
-- loc <= (me->module_core + me->core_size));
-+ return in_core_rx(me, loc) || in_core_rw(me, loc);
- }
-
- static inline int in_local(struct module *me, void *loc)
-@@ -364,13 +386,13 @@ int module_frob_arch_sections(CONST Elf_Ehdr *hdr,
- }
-
- /* align things a bit */
-- me->core_size = ALIGN(me->core_size, 16);
-- me->arch.got_offset = me->core_size;
-- me->core_size += gots * sizeof(struct got_entry);
-+ me->core_size_rw = ALIGN(me->core_size_rw, 16);
-+ me->arch.got_offset = me->core_size_rw;
-+ me->core_size_rw += gots * sizeof(struct got_entry);
-
-- me->core_size = ALIGN(me->core_size, 16);
-- me->arch.fdesc_offset = me->core_size;
-- me->core_size += fdescs * sizeof(Elf_Fdesc);
-+ me->core_size_rw = ALIGN(me->core_size_rw, 16);
-+ me->arch.fdesc_offset = me->core_size_rw;
-+ me->core_size_rw += fdescs * sizeof(Elf_Fdesc);
-
- me->arch.got_max = gots;
- me->arch.fdesc_max = fdescs;
-@@ -388,7 +410,7 @@ static Elf64_Word get_got(struct module *me, unsigned long value, long addend)
-
- BUG_ON(value == 0);
-
-- got = me->module_core + me->arch.got_offset;
-+ got = me->module_core_rw + me->arch.got_offset;
- for (i = 0; got[i].addr; i++)
- if (got[i].addr == value)
- goto out;
-@@ -406,7 +428,7 @@ static Elf64_Word get_got(struct module *me, unsigned long value, long addend)
- #ifdef CONFIG_64BIT
- static Elf_Addr get_fdesc(struct module *me, unsigned long value)
- {
-- Elf_Fdesc *fdesc = me->module_core + me->arch.fdesc_offset;
-+ Elf_Fdesc *fdesc = me->module_core_rw + me->arch.fdesc_offset;
-
- if (!value) {
- printk(KERN_ERR "%s: zero OPD requested!\n", me->name);
-@@ -424,7 +446,7 @@ static Elf_Addr get_fdesc(struct module *me, unsigned long value)
-
- /* Create new one */
- fdesc->addr = value;
-- fdesc->gp = (Elf_Addr)me->module_core + me->arch.got_offset;
-+ fdesc->gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
- return (Elf_Addr)fdesc;
- }
- #endif /* CONFIG_64BIT */
-@@ -848,7 +870,7 @@ register_unwind_table(struct module *me,
-
- table = (unsigned char *)sechdrs[me->arch.unwind_section].sh_addr;
- end = table + sechdrs[me->arch.unwind_section].sh_size;
-- gp = (Elf_Addr)me->module_core + me->arch.got_offset;
-+ gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
-
- DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n",
- me->arch.unwind_section, table, end, gp);
-diff --git a/arch/parisc/kernel/signal32.c b/arch/parisc/kernel/signal32.c
-index fb59852..32d43e7 100644
---- a/arch/parisc/kernel/signal32.c
-+++ b/arch/parisc/kernel/signal32.c
-@@ -68,7 +68,8 @@ put_sigset32(compat_sigset_t __user *up, sigset_t *set, size_t sz)
- {
- compat_sigset_t s;
-
-- if (sz != sizeof *set) panic("put_sigset32()");
-+ if (sz != sizeof *set)
-+ return -EINVAL;
- sigset_64to32(&s, set);
-
- return copy_to_user(up, &s, sizeof s);
-@@ -80,7 +81,8 @@ get_sigset32(compat_sigset_t __user *up, sigset_t *set, size_t sz)
- compat_sigset_t s;
- int r;
-
-- if (sz != sizeof *set) panic("put_sigset32()");
-+ if (sz != sizeof *set)
-+ return -EINVAL;
-
- if ((r = copy_from_user(&s, up, sz)) == 0) {
- sigset_32to64(set, &s);
-diff --git a/arch/parisc/kernel/sys_parisc.c b/arch/parisc/kernel/sys_parisc.c
-index 9147391..d09f456 100644
---- a/arch/parisc/kernel/sys_parisc.c
-+++ b/arch/parisc/kernel/sys_parisc.c
-@@ -33,9 +33,11 @@
- #include <linux/utsname.h>
- #include <linux/personality.h>
-
--static unsigned long get_unshared_area(unsigned long addr, unsigned long len)
-+static unsigned long get_unshared_area(struct file *filp, unsigned long addr, unsigned long len,
-+ unsigned long flags)
- {
- struct vm_area_struct *vma;
-+ unsigned long offset = gr_rand_threadstack_offset(current->mm, filp, flags);
-
- addr = PAGE_ALIGN(addr);
-
-@@ -43,7 +45,7 @@ static unsigned long get_unshared_area(unsigned long addr, unsigned long len)
- /* At this point: (!vma || addr < vma->vm_end). */
- if (TASK_SIZE - len < addr)
- return -ENOMEM;
-- if (!vma || addr + len <= vma->vm_start)
-+ if (check_heap_stack_gap(vma, addr, len, offset))
- return addr;
- addr = vma->vm_end;
- }
-@@ -67,11 +69,12 @@ static int get_offset(struct address_space *mapping)
- return offset & 0x3FF000;
- }
-
--static unsigned long get_shared_area(struct address_space *mapping,
-- unsigned long addr, unsigned long len, unsigned long pgoff)
-+static unsigned long get_shared_area(struct file *filp, struct address_space *mapping,
-+ unsigned long addr, unsigned long len, unsigned long pgoff, unsigned long flags)
- {
- struct vm_area_struct *vma;
- int offset = mapping ? get_offset(mapping) : 0;
-+ unsigned long rand_offset = gr_rand_threadstack_offset(current->mm, filp, flags);
-
- addr = DCACHE_ALIGN(addr - offset) + offset;
-
-@@ -79,7 +82,7 @@ static unsigned long get_shared_area(struct address_space *mapping,
- /* At this point: (!vma || addr < vma->vm_end). */
- if (TASK_SIZE - len < addr)
- return -ENOMEM;
-- if (!vma || addr + len <= vma->vm_start)
-+ if (check_heap_stack_gap(vma, addr, len, rand_offset))
- return addr;
- addr = DCACHE_ALIGN(vma->vm_end - offset) + offset;
- if (addr < vma->vm_end) /* handle wraparound */
-@@ -98,14 +101,14 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
- if (flags & MAP_FIXED)
- return addr;
- if (!addr)
-- addr = TASK_UNMAPPED_BASE;
-+ addr = current->mm->mmap_base;
-
- if (filp) {
-- addr = get_shared_area(filp->f_mapping, addr, len, pgoff);
-+ addr = get_shared_area(filp, filp->f_mapping, addr, len, pgoff, flags);
- } else if(flags & MAP_SHARED) {
-- addr = get_shared_area(NULL, addr, len, pgoff);
-+ addr = get_shared_area(filp, NULL, addr, len, pgoff, flags);
- } else {
-- addr = get_unshared_area(addr, len);
-+ addr = get_unshared_area(filp, addr, len, flags);
- }
- return addr;
- }
-diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
-index 8b58bf0..7afff03 100644
---- a/arch/parisc/kernel/traps.c
-+++ b/arch/parisc/kernel/traps.c
-@@ -733,9 +733,7 @@ void notrace handle_interruption(int code, struct pt_regs *regs)
-
- down_read(¤t->mm->mmap_sem);
- vma = find_vma(current->mm,regs->iaoq[0]);
-- if (vma && (regs->iaoq[0] >= vma->vm_start)
-- && (vma->vm_flags & VM_EXEC)) {
--
-+ if (vma && (regs->iaoq[0] >= vma->vm_start)) {
- fault_address = regs->iaoq[0];
- fault_space = regs->iasq[0];
-
-diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
-index c6afbfc..c5839f6 100644
---- a/arch/parisc/mm/fault.c
-+++ b/arch/parisc/mm/fault.c
-@@ -15,6 +15,7 @@
- #include <linux/sched.h>
- #include <linux/interrupt.h>
- #include <linux/module.h>
-+#include <linux/unistd.h>
-
- #include <asm/uaccess.h>
- #include <asm/traps.h>
-@@ -52,7 +53,7 @@ DEFINE_PER_CPU(struct exception_data, exception_data);
- static unsigned long
- parisc_acctyp(unsigned long code, unsigned int inst)
- {
-- if (code == 6 || code == 16)
-+ if (code == 6 || code == 7 || code == 16)
- return VM_EXEC;
-
- switch (inst & 0xf0000000) {
-@@ -138,6 +139,116 @@ parisc_acctyp(unsigned long code, unsigned int inst)
- }
- #endif
-
-+#ifdef CONFIG_PAX_PAGEEXEC
-+/*
-+ * PaX: decide what to do with offenders (instruction_pointer(regs) = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ * 2 when rt_sigreturn trampoline was detected
-+ * 3 when unpatched PLT trampoline was detected
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+ int err;
-+
-+ do { /* PaX: unpatched PLT emulation */
-+ unsigned int bl, depwi;
-+
-+ err = get_user(bl, (unsigned int *)instruction_pointer(regs));
-+ err |= get_user(depwi, (unsigned int *)(instruction_pointer(regs)+4));
-+
-+ if (err)
-+ break;
-+
-+ if (bl == 0xEA9F1FDDU && depwi == 0xD6801C1EU) {
-+ unsigned int ldw, bv, ldw2, addr = instruction_pointer(regs)-12;
-+
-+ err = get_user(ldw, (unsigned int *)addr);
-+ err |= get_user(bv, (unsigned int *)(addr+4));
-+ err |= get_user(ldw2, (unsigned int *)(addr+8));
-+
-+ if (err)
-+ break;
-+
-+ if (ldw == 0x0E801096U &&
-+ bv == 0xEAC0C000U &&
-+ ldw2 == 0x0E881095U)
-+ {
-+ unsigned int resolver, map;
-+
-+ err = get_user(resolver, (unsigned int *)(instruction_pointer(regs)+8));
-+ err |= get_user(map, (unsigned int *)(instruction_pointer(regs)+12));
-+ if (err)
-+ break;
-+
-+ regs->gr[20] = instruction_pointer(regs)+8;
-+ regs->gr[21] = map;
-+ regs->gr[22] = resolver;
-+ regs->iaoq[0] = resolver | 3UL;
-+ regs->iaoq[1] = regs->iaoq[0] + 4;
-+ return 3;
-+ }
-+ }
-+ } while (0);
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+
-+#ifndef CONFIG_PAX_EMUSIGRT
-+ if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
-+ return 1;
-+#endif
-+
-+ do { /* PaX: rt_sigreturn emulation */
-+ unsigned int ldi1, ldi2, bel, nop;
-+
-+ err = get_user(ldi1, (unsigned int *)instruction_pointer(regs));
-+ err |= get_user(ldi2, (unsigned int *)(instruction_pointer(regs)+4));
-+ err |= get_user(bel, (unsigned int *)(instruction_pointer(regs)+8));
-+ err |= get_user(nop, (unsigned int *)(instruction_pointer(regs)+12));
-+
-+ if (err)
-+ break;
-+
-+ if ((ldi1 == 0x34190000U || ldi1 == 0x34190002U) &&
-+ ldi2 == 0x3414015AU &&
-+ bel == 0xE4008200U &&
-+ nop == 0x08000240U)
-+ {
-+ regs->gr[25] = (ldi1 & 2) >> 1;
-+ regs->gr[20] = __NR_rt_sigreturn;
-+ regs->gr[31] = regs->iaoq[1] + 16;
-+ regs->sr[0] = regs->iasq[1];
-+ regs->iaoq[0] = 0x100UL;
-+ regs->iaoq[1] = regs->iaoq[0] + 4;
-+ regs->iasq[0] = regs->sr[2];
-+ regs->iasq[1] = regs->sr[2];
-+ return 2;
-+ }
-+ } while (0);
-+#endif
-+
-+ return 1;
-+}
-+
-+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
-+{
-+ unsigned long i;
-+
-+ printk(KERN_ERR "PAX: bytes at PC: ");
-+ for (i = 0; i < 5; i++) {
-+ unsigned int c;
-+ if (get_user(c, (unsigned int *)pc+i))
-+ printk(KERN_CONT "???????? ");
-+ else
-+ printk(KERN_CONT "%08x ", c);
-+ }
-+ printk("\n");
-+}
-+#endif
-+
- int fixup_exception(struct pt_regs *regs)
- {
- const struct exception_table_entry *fix;
-@@ -192,8 +303,33 @@ good_area:
-
- acc_type = parisc_acctyp(code,regs->iir);
-
-- if ((vma->vm_flags & acc_type) != acc_type)
-+ if ((vma->vm_flags & acc_type) != acc_type) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && (acc_type & VM_EXEC) &&
-+ (address & ~3UL) == instruction_pointer(regs))
-+ {
-+ up_read(&mm->mmap_sem);
-+ switch (pax_handle_fetch_fault(regs)) {
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+ case 3:
-+ return;
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+ case 2:
-+ return;
-+#endif
-+
-+ }
-+ pax_report_fault(regs, (void *)instruction_pointer(regs), (void *)regs->gr[30]);
-+ do_group_exit(SIGKILL);
-+ }
-+#endif
-+
- goto bad_area;
-+ }
-
- /*
- * If for any reason at all we couldn't handle the fault, make
-diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
-index c107b74..409dc0f 100644
---- a/arch/powerpc/Makefile
-+++ b/arch/powerpc/Makefile
-@@ -74,6 +74,8 @@ KBUILD_AFLAGS += -Iarch/$(ARCH)
- KBUILD_CFLAGS += -msoft-float -pipe -Iarch/$(ARCH) $(CFLAGS-y)
- CPP = $(CC) -E $(KBUILD_CFLAGS)
-
-+cflags-y += -Wno-sign-compare -Wno-extra
-+
- CHECKFLAGS += -m$(CONFIG_WORD_SIZE) -D__powerpc__ -D__powerpc$(CONFIG_WORD_SIZE)__
-
- ifeq ($(CONFIG_PPC64),y)
-diff --git a/arch/powerpc/include/asm/cache.h b/arch/powerpc/include/asm/cache.h
-index 81de6eb..d5d0e24 100644
---- a/arch/powerpc/include/asm/cache.h
-+++ b/arch/powerpc/include/asm/cache.h
-@@ -3,6 +3,7 @@
-
- #ifdef __KERNEL__
-
-+#include <linux/const.h>
-
- /* bytes per L1 cache line */
- #if defined(CONFIG_8xx) || defined(CONFIG_403GCX)
-@@ -18,7 +19,7 @@
- #define L1_CACHE_SHIFT 7
- #endif
-
--#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-
- #define SMP_CACHE_BYTES L1_CACHE_BYTES
-
-diff --git a/arch/powerpc/include/asm/device.h b/arch/powerpc/include/asm/device.h
-index 6d94d27..50d4cad 100644
---- a/arch/powerpc/include/asm/device.h
-+++ b/arch/powerpc/include/asm/device.h
-@@ -14,7 +14,7 @@ struct dev_archdata {
- struct device_node *of_node;
-
- /* DMA operations on that device */
-- struct dma_map_ops *dma_ops;
-+ const struct dma_map_ops *dma_ops;
-
- /*
- * When an iommu is in use, dma_data is used as a ptr to the base of the
-diff --git a/arch/powerpc/include/asm/dma-mapping.h b/arch/powerpc/include/asm/dma-mapping.h
-index e281dae..2b8a784 100644
---- a/arch/powerpc/include/asm/dma-mapping.h
-+++ b/arch/powerpc/include/asm/dma-mapping.h
-@@ -69,9 +69,9 @@ static inline unsigned long device_to_mask(struct device *dev)
- #ifdef CONFIG_PPC64
- extern struct dma_map_ops dma_iommu_ops;
- #endif
--extern struct dma_map_ops dma_direct_ops;
-+extern const struct dma_map_ops dma_direct_ops;
-
--static inline struct dma_map_ops *get_dma_ops(struct device *dev)
-+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
- {
- /* We don't handle the NULL dev case for ISA for now. We could
- * do it via an out of line call but it is not needed for now. The
-@@ -84,7 +84,7 @@ static inline struct dma_map_ops *get_dma_ops(struct device *dev)
- return dev->archdata.dma_ops;
- }
-
--static inline void set_dma_ops(struct device *dev, struct dma_map_ops *ops)
-+static inline void set_dma_ops(struct device *dev, const struct dma_map_ops *ops)
- {
- dev->archdata.dma_ops = ops;
- }
-@@ -118,7 +118,7 @@ static inline void set_dma_offset(struct device *dev, dma_addr_t off)
-
- static inline int dma_supported(struct device *dev, u64 mask)
- {
-- struct dma_map_ops *dma_ops = get_dma_ops(dev);
-+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
-
- if (unlikely(dma_ops == NULL))
- return 0;
-@@ -132,7 +132,7 @@ static inline int dma_supported(struct device *dev, u64 mask)
-
- static inline int dma_set_mask(struct device *dev, u64 dma_mask)
- {
-- struct dma_map_ops *dma_ops = get_dma_ops(dev);
-+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
-
- if (unlikely(dma_ops == NULL))
- return -EIO;
-@@ -147,7 +147,7 @@ static inline int dma_set_mask(struct device *dev, u64 dma_mask)
- static inline void *dma_alloc_coherent(struct device *dev, size_t size,
- dma_addr_t *dma_handle, gfp_t flag)
- {
-- struct dma_map_ops *dma_ops = get_dma_ops(dev);
-+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
- void *cpu_addr;
-
- BUG_ON(!dma_ops);
-@@ -162,7 +162,7 @@ static inline void *dma_alloc_coherent(struct device *dev, size_t size,
- static inline void dma_free_coherent(struct device *dev, size_t size,
- void *cpu_addr, dma_addr_t dma_handle)
- {
-- struct dma_map_ops *dma_ops = get_dma_ops(dev);
-+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
-
- BUG_ON(!dma_ops);
-
-@@ -173,7 +173,7 @@ static inline void dma_free_coherent(struct device *dev, size_t size,
-
- static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
- {
-- struct dma_map_ops *dma_ops = get_dma_ops(dev);
-+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
-
- if (dma_ops->mapping_error)
- return dma_ops->mapping_error(dev, dma_addr);
-diff --git a/arch/powerpc/include/asm/elf.h b/arch/powerpc/include/asm/elf.h
-index 5698502..5db093c 100644
---- a/arch/powerpc/include/asm/elf.h
-+++ b/arch/powerpc/include/asm/elf.h
-@@ -179,8 +179,19 @@ typedef elf_fpreg_t elf_vsrreghalf_t32[ELF_NVSRHALFREG];
- the loader. We need to make sure that it is out of the way of the program
- that it will "exec", and that there is sufficient room for the brk. */
-
--extern unsigned long randomize_et_dyn(unsigned long base);
--#define ELF_ET_DYN_BASE (randomize_et_dyn(0x20000000))
-+#define ELF_ET_DYN_BASE (0x20000000)
-+
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE (0x10000000UL)
-+
-+#ifdef __powerpc64__
-+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT) ? 16 : 28)
-+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT) ? 16 : 28)
-+#else
-+#define PAX_DELTA_MMAP_LEN 15
-+#define PAX_DELTA_STACK_LEN 15
-+#endif
-+#endif
-
- /*
- * Our registers are always unsigned longs, whether we're a 32 bit
-@@ -275,9 +286,6 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
- (0x7ff >> (PAGE_SHIFT - 12)) : \
- (0x3ffff >> (PAGE_SHIFT - 12)))
-
--extern unsigned long arch_randomize_brk(struct mm_struct *mm);
--#define arch_randomize_brk arch_randomize_brk
--
- #endif /* __KERNEL__ */
-
- /*
-diff --git a/arch/powerpc/include/asm/iommu.h b/arch/powerpc/include/asm/iommu.h
-index edfc980..1766f59 100644
---- a/arch/powerpc/include/asm/iommu.h
-+++ b/arch/powerpc/include/asm/iommu.h
-@@ -116,6 +116,9 @@ extern void iommu_init_early_iSeries(void);
- extern void iommu_init_early_dart(void);
- extern void iommu_init_early_pasemi(void);
-
-+/* dma-iommu.c */
-+extern int dma_iommu_dma_supported(struct device *dev, u64 mask);
-+
- #ifdef CONFIG_PCI
- extern void pci_iommu_init(void);
- extern void pci_direct_iommu_init(void);
-diff --git a/arch/powerpc/include/asm/kmap_types.h b/arch/powerpc/include/asm/kmap_types.h
-index 9163695..5a00112 100644
---- a/arch/powerpc/include/asm/kmap_types.h
-+++ b/arch/powerpc/include/asm/kmap_types.h
-@@ -26,6 +26,7 @@ enum km_type {
- KM_SOFTIRQ1,
- KM_PPC_SYNC_PAGE,
- KM_PPC_SYNC_ICACHE,
-+ KM_CLEARPAGE,
- KM_TYPE_NR
- };
-
-diff --git a/arch/powerpc/include/asm/page.h b/arch/powerpc/include/asm/page.h
-index ff24254..fe45b21 100644
---- a/arch/powerpc/include/asm/page.h
-+++ b/arch/powerpc/include/asm/page.h
-@@ -116,8 +116,9 @@ extern phys_addr_t kernstart_addr;
- * and needs to be executable. This means the whole heap ends
- * up being executable.
- */
--#define VM_DATA_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
-- VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-+#define VM_DATA_DEFAULT_FLAGS32 \
-+ (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
-+ VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-
- #define VM_DATA_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
- VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-@@ -145,6 +146,9 @@ extern phys_addr_t kernstart_addr;
- #define is_kernel_addr(x) ((x) >= PAGE_OFFSET)
- #endif
-
-+#define ktla_ktva(addr) (addr)
-+#define ktva_ktla(addr) (addr)
-+
- #ifndef __ASSEMBLY__
-
- #undef STRICT_MM_TYPECHECKS
-diff --git a/arch/powerpc/include/asm/page_64.h b/arch/powerpc/include/asm/page_64.h
-index 3f17b83..1f9e766 100644
---- a/arch/powerpc/include/asm/page_64.h
-+++ b/arch/powerpc/include/asm/page_64.h
-@@ -180,15 +180,18 @@ do { \
- * stack by default, so in the absense of a PT_GNU_STACK program header
- * we turn execute permission off.
- */
--#define VM_STACK_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
-- VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-+#define VM_STACK_DEFAULT_FLAGS32 \
-+ (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
-+ VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-
- #define VM_STACK_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
- VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-
-+#ifndef CONFIG_PAX_PAGEEXEC
- #define VM_STACK_DEFAULT_FLAGS \
- (test_thread_flag(TIF_32BIT) ? \
- VM_STACK_DEFAULT_FLAGS32 : VM_STACK_DEFAULT_FLAGS64)
-+#endif
-
- #include <asm-generic/getorder.h>
-
-diff --git a/arch/powerpc/include/asm/pci.h b/arch/powerpc/include/asm/pci.h
-index b5ea626..40308222 100644
---- a/arch/powerpc/include/asm/pci.h
-+++ b/arch/powerpc/include/asm/pci.h
-@@ -65,8 +65,8 @@ static inline int pci_get_legacy_ide_irq(struct pci_dev *dev, int channel)
- }
-
- #ifdef CONFIG_PCI
--extern void set_pci_dma_ops(struct dma_map_ops *dma_ops);
--extern struct dma_map_ops *get_pci_dma_ops(void);
-+extern void set_pci_dma_ops(const struct dma_map_ops *dma_ops);
-+extern const struct dma_map_ops *get_pci_dma_ops(void);
- #else /* CONFIG_PCI */
- #define set_pci_dma_ops(d)
- #define get_pci_dma_ops() NULL
-diff --git a/arch/powerpc/include/asm/pgalloc-64.h b/arch/powerpc/include/asm/pgalloc-64.h
-index e6f069c..6c7a1f8 100644
---- a/arch/powerpc/include/asm/pgalloc-64.h
-+++ b/arch/powerpc/include/asm/pgalloc-64.h
-@@ -37,6 +37,7 @@ static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
- #ifndef CONFIG_PPC_64K_PAGES
-
- #define pgd_populate(MM, PGD, PUD) pgd_set(PGD, PUD)
-+#define pgd_populate_kernel(MM, PGD, PUD) pgd_populate((MM), (PGD), (PUD))
-
- static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr)
- {
-@@ -54,6 +55,11 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
- pud_set(pud, (unsigned long)pmd);
- }
-
-+static inline void pud_populate_kernel(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
-+{
-+ pud_populate(mm, pud, pmd);
-+}
-+
- #define pmd_populate(mm, pmd, pte_page) \
- pmd_populate_kernel(mm, pmd, page_address(pte_page))
- #define pmd_populate_kernel(mm, pmd, pte) pmd_set(pmd, (unsigned long)(pte))
-@@ -63,6 +69,7 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
- #else /* CONFIG_PPC_64K_PAGES */
-
- #define pud_populate(mm, pud, pmd) pud_set(pud, (unsigned long)pmd)
-+#define pud_populate_kernel(mm, pud, pmd) pud_populate((mm), (pud), (pmd))
-
- static inline void pmd_populate_kernel(struct mm_struct *mm, pmd_t *pmd,
- pte_t *pte)
-diff --git a/arch/powerpc/include/asm/pgtable.h b/arch/powerpc/include/asm/pgtable.h
-index 2a5da06..d65bea2 100644
---- a/arch/powerpc/include/asm/pgtable.h
-+++ b/arch/powerpc/include/asm/pgtable.h
-@@ -2,6 +2,7 @@
- #define _ASM_POWERPC_PGTABLE_H
- #ifdef __KERNEL__
-
-+#include <linux/const.h>
- #ifndef __ASSEMBLY__
- #include <asm/processor.h> /* For TASK_SIZE */
- #include <asm/mmu.h>
-diff --git a/arch/powerpc/include/asm/pte-hash32.h b/arch/powerpc/include/asm/pte-hash32.h
-index 4aad413..85d86bf 100644
---- a/arch/powerpc/include/asm/pte-hash32.h
-+++ b/arch/powerpc/include/asm/pte-hash32.h
-@@ -21,6 +21,7 @@
- #define _PAGE_FILE 0x004 /* when !present: nonlinear file mapping */
- #define _PAGE_USER 0x004 /* usermode access allowed */
- #define _PAGE_GUARDED 0x008 /* G: prohibit speculative access */
-+#define _PAGE_EXEC _PAGE_GUARDED
- #define _PAGE_COHERENT 0x010 /* M: enforce memory coherence (SMP systems) */
- #define _PAGE_NO_CACHE 0x020 /* I: cache inhibit */
- #define _PAGE_WRITETHRU 0x040 /* W: cache write-through */
-diff --git a/arch/powerpc/include/asm/ptrace.h b/arch/powerpc/include/asm/ptrace.h
-index 8c34149..78f425a 100644
---- a/arch/powerpc/include/asm/ptrace.h
-+++ b/arch/powerpc/include/asm/ptrace.h
-@@ -103,7 +103,7 @@ extern unsigned long profile_pc(struct pt_regs *regs);
- } while(0)
-
- struct task_struct;
--extern unsigned long ptrace_get_reg(struct task_struct *task, int regno);
-+extern unsigned long ptrace_get_reg(struct task_struct *task, unsigned int regno);
- extern int ptrace_put_reg(struct task_struct *task, int regno,
- unsigned long data);
-
-diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
-index 6ce44dd..e054dcc 100644
---- a/arch/powerpc/include/asm/reg.h
-+++ b/arch/powerpc/include/asm/reg.h
-@@ -191,6 +191,7 @@
- #define SPRN_DBCR 0x136 /* e300 Data Breakpoint Control Reg */
- #define SPRN_DSISR 0x012 /* Data Storage Interrupt Status Register */
- #define DSISR_NOHPTE 0x40000000 /* no translation found */
-+#define DSISR_GUARDED 0x10000000 /* fetch from guarded storage */
- #define DSISR_PROTFAULT 0x08000000 /* protection fault */
- #define DSISR_ISSTORE 0x02000000 /* access was a store */
- #define DSISR_DABRMATCH 0x00400000 /* hit data breakpoint */
-diff --git a/arch/powerpc/include/asm/swiotlb.h b/arch/powerpc/include/asm/swiotlb.h
-index 8979d4c..d2fd0d3 100644
---- a/arch/powerpc/include/asm/swiotlb.h
-+++ b/arch/powerpc/include/asm/swiotlb.h
-@@ -13,7 +13,7 @@
-
- #include <linux/swiotlb.h>
-
--extern struct dma_map_ops swiotlb_dma_ops;
-+extern const struct dma_map_ops swiotlb_dma_ops;
-
- static inline void dma_mark_clean(void *addr, size_t size) {}
-
-diff --git a/arch/powerpc/include/asm/system.h b/arch/powerpc/include/asm/system.h
-index 094a12a..877a60a 100644
---- a/arch/powerpc/include/asm/system.h
-+++ b/arch/powerpc/include/asm/system.h
-@@ -531,7 +531,7 @@ __cmpxchg_local(volatile void *ptr, unsigned long old, unsigned long new,
- #define cmpxchg64_local(ptr, o, n) __cmpxchg64_local_generic((ptr), (o), (n))
- #endif
-
--extern unsigned long arch_align_stack(unsigned long sp);
-+#define arch_align_stack(x) ((x) & ~0xfUL)
-
- /* Used in very early kernel initialization. */
- extern unsigned long reloc_offset(void);
-diff --git a/arch/powerpc/include/asm/thread_info.h b/arch/powerpc/include/asm/thread_info.h
-index aa9d383..0380a05 100644
---- a/arch/powerpc/include/asm/thread_info.h
-+++ b/arch/powerpc/include/asm/thread_info.h
-@@ -110,7 +110,9 @@ static inline struct thread_info *current_thread_info(void)
- #define TIF_NOERROR 12 /* Force successful syscall return */
- #define TIF_NOTIFY_RESUME 13 /* callback before returning to user */
- #define TIF_FREEZE 14 /* Freezing for suspend */
--#define TIF_RUNLATCH 15 /* Is the runlatch enabled? */
-+/* mask must be expressable within 16 bits to satisfy 'andi' instruction reqs */
-+#define TIF_GRSEC_SETXID 15 /* update credentials on syscall entry/exit */
-+#define TIF_RUNLATCH 16 /* Is the runlatch enabled? */
-
- /* as above, but as bit values */
- #define _TIF_SYSCALL_TRACE (1<<TIF_SYSCALL_TRACE)
-@@ -128,7 +130,10 @@ static inline struct thread_info *current_thread_info(void)
- #define _TIF_NOTIFY_RESUME (1<<TIF_NOTIFY_RESUME)
- #define _TIF_FREEZE (1<<TIF_FREEZE)
- #define _TIF_RUNLATCH (1<<TIF_RUNLATCH)
--#define _TIF_SYSCALL_T_OR_A (_TIF_SYSCALL_TRACE|_TIF_SYSCALL_AUDIT|_TIF_SECCOMP)
-+#define _TIF_GRSEC_SETXID (1<<TIF_GRSEC_SETXID)
-+
-+#define _TIF_SYSCALL_T_OR_A (_TIF_SYSCALL_TRACE|_TIF_SYSCALL_AUDIT| \
-+ _TIF_SECCOMP|_TIF_GRSEC_SETXID)
-
- #define _TIF_USER_WORK_MASK (_TIF_SIGPENDING | _TIF_NEED_RESCHED | \
- _TIF_NOTIFY_RESUME)
-diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
-index bd0fb84..a42a14b 100644
---- a/arch/powerpc/include/asm/uaccess.h
-+++ b/arch/powerpc/include/asm/uaccess.h
-@@ -13,6 +13,8 @@
- #define VERIFY_READ 0
- #define VERIFY_WRITE 1
-
-+extern void check_object_size(const void *ptr, unsigned long n, bool to);
-+
- /*
- * The fs value determines whether argument validity checking should be
- * performed or not. If get_fs() == USER_DS, checking is performed, with
-@@ -327,52 +329,6 @@ do { \
- extern unsigned long __copy_tofrom_user(void __user *to,
- const void __user *from, unsigned long size);
-
--#ifndef __powerpc64__
--
--static inline unsigned long copy_from_user(void *to,
-- const void __user *from, unsigned long n)
--{
-- unsigned long over;
--
-- if (access_ok(VERIFY_READ, from, n))
-- return __copy_tofrom_user((__force void __user *)to, from, n);
-- if ((unsigned long)from < TASK_SIZE) {
-- over = (unsigned long)from + n - TASK_SIZE;
-- return __copy_tofrom_user((__force void __user *)to, from,
-- n - over) + over;
-- }
-- return n;
--}
--
--static inline unsigned long copy_to_user(void __user *to,
-- const void *from, unsigned long n)
--{
-- unsigned long over;
--
-- if (access_ok(VERIFY_WRITE, to, n))
-- return __copy_tofrom_user(to, (__force void __user *)from, n);
-- if ((unsigned long)to < TASK_SIZE) {
-- over = (unsigned long)to + n - TASK_SIZE;
-- return __copy_tofrom_user(to, (__force void __user *)from,
-- n - over) + over;
-- }
-- return n;
--}
--
--#else /* __powerpc64__ */
--
--#define __copy_in_user(to, from, size) \
-- __copy_tofrom_user((to), (from), (size))
--
--extern unsigned long copy_from_user(void *to, const void __user *from,
-- unsigned long n);
--extern unsigned long copy_to_user(void __user *to, const void *from,
-- unsigned long n);
--extern unsigned long copy_in_user(void __user *to, const void __user *from,
-- unsigned long n);
--
--#endif /* __powerpc64__ */
--
- static inline unsigned long __copy_from_user_inatomic(void *to,
- const void __user *from, unsigned long n)
- {
-@@ -396,6 +352,10 @@ static inline unsigned long __copy_from_user_inatomic(void *to,
- if (ret == 0)
- return 0;
- }
-+
-+ if (!__builtin_constant_p(n))
-+ check_object_size(to, n, false);
-+
- return __copy_tofrom_user((__force void __user *)to, from, n);
- }
-
-@@ -422,6 +382,10 @@ static inline unsigned long __copy_to_user_inatomic(void __user *to,
- if (ret == 0)
- return 0;
- }
-+
-+ if (!__builtin_constant_p(n))
-+ check_object_size(from, n, true);
-+
- return __copy_tofrom_user(to, (__force const void __user *)from, n);
- }
-
-@@ -439,6 +403,92 @@ static inline unsigned long __copy_to_user(void __user *to,
- return __copy_to_user_inatomic(to, from, size);
- }
-
-+#ifndef __powerpc64__
-+
-+static inline unsigned long __must_check copy_from_user(void *to,
-+ const void __user *from, unsigned long n)
-+{
-+ unsigned long over;
-+
-+ if ((long)n < 0)
-+ return n;
-+
-+ if (access_ok(VERIFY_READ, from, n)) {
-+ if (!__builtin_constant_p(n))
-+ check_object_size(to, n, false);
-+ return __copy_tofrom_user((__force void __user *)to, from, n);
-+ }
-+ if ((unsigned long)from < TASK_SIZE) {
-+ over = (unsigned long)from + n - TASK_SIZE;
-+ if (!__builtin_constant_p(n - over))
-+ check_object_size(to, n - over, false);
-+ return __copy_tofrom_user((__force void __user *)to, from,
-+ n - over) + over;
-+ }
-+ return n;
-+}
-+
-+static inline unsigned long __must_check copy_to_user(void __user *to,
-+ const void *from, unsigned long n)
-+{
-+ unsigned long over;
-+
-+ if ((long)n < 0)
-+ return n;
-+
-+ if (access_ok(VERIFY_WRITE, to, n)) {
-+ if (!__builtin_constant_p(n))
-+ check_object_size(from, n, true);
-+ return __copy_tofrom_user(to, (__force void __user *)from, n);
-+ }
-+ if ((unsigned long)to < TASK_SIZE) {
-+ over = (unsigned long)to + n - TASK_SIZE;
-+ if (!__builtin_constant_p(n))
-+ check_object_size(from, n - over, true);
-+ return __copy_tofrom_user(to, (__force void __user *)from,
-+ n - over) + over;
-+ }
-+ return n;
-+}
-+
-+#else /* __powerpc64__ */
-+
-+#define __copy_in_user(to, from, size) \
-+ __copy_tofrom_user((to), (from), (size))
-+
-+static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
-+{
-+ if ((long)n < 0 || n > INT_MAX)
-+ return n;
-+
-+ if (!__builtin_constant_p(n))
-+ check_object_size(to, n, false);
-+
-+ if (likely(access_ok(VERIFY_READ, from, n)))
-+ n = __copy_from_user(to, from, n);
-+ else
-+ memset(to, 0, n);
-+ return n;
-+}
-+
-+static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
-+{
-+ if ((long)n < 0 || n > INT_MAX)
-+ return n;
-+
-+ if (likely(access_ok(VERIFY_WRITE, to, n))) {
-+ if (!__builtin_constant_p(n))
-+ check_object_size(from, n, true);
-+ n = __copy_to_user(to, from, n);
-+ }
-+ return n;
-+}
-+
-+extern unsigned long copy_in_user(void __user *to, const void __user *from,
-+ unsigned long n);
-+
-+#endif /* __powerpc64__ */
-+
- extern unsigned long __clear_user(void __user *addr, unsigned long size);
-
- static inline unsigned long clear_user(void __user *addr, unsigned long size)
-diff --git a/arch/powerpc/kernel/cacheinfo.c b/arch/powerpc/kernel/cacheinfo.c
-index bb37b1d..01fe9ce 100644
---- a/arch/powerpc/kernel/cacheinfo.c
-+++ b/arch/powerpc/kernel/cacheinfo.c
-@@ -642,7 +642,7 @@ static struct kobj_attribute *cache_index_opt_attrs[] = {
- &cache_assoc_attr,
- };
-
--static struct sysfs_ops cache_index_ops = {
-+static const struct sysfs_ops cache_index_ops = {
- .show = cache_index_show,
- };
-
-diff --git a/arch/powerpc/kernel/dma-iommu.c b/arch/powerpc/kernel/dma-iommu.c
-index 37771a5..648530c 100644
---- a/arch/powerpc/kernel/dma-iommu.c
-+++ b/arch/powerpc/kernel/dma-iommu.c
-@@ -70,7 +70,7 @@ static void dma_iommu_unmap_sg(struct device *dev, struct scatterlist *sglist,
- }
-
- /* We support DMA to/from any memory page via the iommu */
--static int dma_iommu_dma_supported(struct device *dev, u64 mask)
-+int dma_iommu_dma_supported(struct device *dev, u64 mask)
- {
- struct iommu_table *tbl = get_iommu_table_base(dev);
-
-diff --git a/arch/powerpc/kernel/dma-swiotlb.c b/arch/powerpc/kernel/dma-swiotlb.c
-index e96cbbd..bdd6d41 100644
---- a/arch/powerpc/kernel/dma-swiotlb.c
-+++ b/arch/powerpc/kernel/dma-swiotlb.c
-@@ -31,7 +31,7 @@ unsigned int ppc_swiotlb_enable;
- * map_page, and unmap_page on highmem, use normal dma_ops
- * for everything else.
- */
--struct dma_map_ops swiotlb_dma_ops = {
-+const struct dma_map_ops swiotlb_dma_ops = {
- .alloc_coherent = dma_direct_alloc_coherent,
- .free_coherent = dma_direct_free_coherent,
- .map_sg = swiotlb_map_sg_attrs,
-diff --git a/arch/powerpc/kernel/dma.c b/arch/powerpc/kernel/dma.c
-index 6215062..ebea59c 100644
---- a/arch/powerpc/kernel/dma.c
-+++ b/arch/powerpc/kernel/dma.c
-@@ -134,7 +134,7 @@ static inline void dma_direct_sync_single_range(struct device *dev,
- }
- #endif
-
--struct dma_map_ops dma_direct_ops = {
-+const struct dma_map_ops dma_direct_ops = {
- .alloc_coherent = dma_direct_alloc_coherent,
- .free_coherent = dma_direct_free_coherent,
- .map_sg = dma_direct_map_sg,
-diff --git a/arch/powerpc/kernel/exceptions-64e.S b/arch/powerpc/kernel/exceptions-64e.S
-index 24dcc0e..a300455 100644
---- a/arch/powerpc/kernel/exceptions-64e.S
-+++ b/arch/powerpc/kernel/exceptions-64e.S
-@@ -455,6 +455,7 @@ storage_fault_common:
- std r14,_DAR(r1)
- std r15,_DSISR(r1)
- addi r3,r1,STACK_FRAME_OVERHEAD
-+ bl .save_nvgprs
- mr r4,r14
- mr r5,r15
- ld r14,PACA_EXGEN+EX_R14(r13)
-@@ -464,8 +465,7 @@ storage_fault_common:
- cmpdi r3,0
- bne- 1f
- b .ret_from_except_lite
--1: bl .save_nvgprs
-- mr r5,r3
-+1: mr r5,r3
- addi r3,r1,STACK_FRAME_OVERHEAD
- ld r4,_DAR(r1)
- bl .bad_page_fault
-diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
-index 1808876..9fd206a 100644
---- a/arch/powerpc/kernel/exceptions-64s.S
-+++ b/arch/powerpc/kernel/exceptions-64s.S
-@@ -818,10 +818,10 @@ handle_page_fault:
- 11: ld r4,_DAR(r1)
- ld r5,_DSISR(r1)
- addi r3,r1,STACK_FRAME_OVERHEAD
-+ bl .save_nvgprs
- bl .do_page_fault
- cmpdi r3,0
- beq+ 13f
-- bl .save_nvgprs
- mr r5,r3
- addi r3,r1,STACK_FRAME_OVERHEAD
- lwz r4,_DAR(r1)
-diff --git a/arch/powerpc/kernel/ibmebus.c b/arch/powerpc/kernel/ibmebus.c
-index a4c8b38..1b09ad9 100644
---- a/arch/powerpc/kernel/ibmebus.c
-+++ b/arch/powerpc/kernel/ibmebus.c
-@@ -127,7 +127,7 @@ static int ibmebus_dma_supported(struct device *dev, u64 mask)
- return 1;
- }
-
--static struct dma_map_ops ibmebus_dma_ops = {
-+static const struct dma_map_ops ibmebus_dma_ops = {
- .alloc_coherent = ibmebus_alloc_coherent,
- .free_coherent = ibmebus_free_coherent,
- .map_sg = ibmebus_map_sg,
-diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
-index 8564a41..67f3471 100644
---- a/arch/powerpc/kernel/irq.c
-+++ b/arch/powerpc/kernel/irq.c
-@@ -490,9 +490,6 @@ struct irq_host *irq_alloc_host(struct device_node *of_node,
- host->ops = ops;
- host->of_node = of_node_get(of_node);
-
-- if (host->ops->match == NULL)
-- host->ops->match = default_irq_host_match;
--
- spin_lock_irqsave(&irq_big_lock, flags);
-
- /* If it's a legacy controller, check for duplicates and
-@@ -567,7 +564,12 @@ struct irq_host *irq_find_host(struct device_node *node)
- */
- spin_lock_irqsave(&irq_big_lock, flags);
- list_for_each_entry(h, &irq_hosts, link)
-- if (h->ops->match(h, node)) {
-+ if (h->ops->match) {
-+ if (h->ops->match(h, node)) {
-+ found = h;
-+ break;
-+ }
-+ } else if (default_irq_host_match(h, node)) {
- found = h;
- break;
- }
-diff --git a/arch/powerpc/kernel/kgdb.c b/arch/powerpc/kernel/kgdb.c
-index 641c74b..8339ad7 100644
---- a/arch/powerpc/kernel/kgdb.c
-+++ b/arch/powerpc/kernel/kgdb.c
-@@ -126,7 +126,7 @@ static int kgdb_handle_breakpoint(struct pt_regs *regs)
- if (kgdb_handle_exception(0, SIGTRAP, 0, regs) != 0)
- return 0;
-
-- if (*(u32 *) (regs->nip) == *(u32 *) (&arch_kgdb_ops.gdb_bpt_instr))
-+ if (*(u32 *) (regs->nip) == *(const u32 *) (&arch_kgdb_ops.gdb_bpt_instr))
- regs->nip += 4;
-
- return 1;
-@@ -353,7 +353,7 @@ int kgdb_arch_handle_exception(int vector, int signo, int err_code,
- /*
- * Global data
- */
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- .gdb_bpt_instr = {0x7d, 0x82, 0x10, 0x08},
- };
-
-diff --git a/arch/powerpc/kernel/module.c b/arch/powerpc/kernel/module.c
-index 477c663..4f50234 100644
---- a/arch/powerpc/kernel/module.c
-+++ b/arch/powerpc/kernel/module.c
-@@ -31,11 +31,24 @@
-
- LIST_HEAD(module_bug_list);
-
-+#ifdef CONFIG_PAX_KERNEXEC
- void *module_alloc(unsigned long size)
- {
- if (size == 0)
- return NULL;
-
-+ return vmalloc(size);
-+}
-+
-+void *module_alloc_exec(unsigned long size)
-+#else
-+void *module_alloc(unsigned long size)
-+#endif
-+
-+{
-+ if (size == 0)
-+ return NULL;
-+
- return vmalloc_exec(size);
- }
-
-@@ -45,6 +58,13 @@ void module_free(struct module *mod, void *module_region)
- vfree(module_region);
- }
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+void module_free_exec(struct module *mod, void *module_region)
-+{
-+ module_free(mod, module_region);
-+}
-+#endif
-+
- static const Elf_Shdr *find_section(const Elf_Ehdr *hdr,
- const Elf_Shdr *sechdrs,
- const char *name)
-diff --git a/arch/powerpc/kernel/module_32.c b/arch/powerpc/kernel/module_32.c
-index 449a7e0..5cb1140 100644
---- a/arch/powerpc/kernel/module_32.c
-+++ b/arch/powerpc/kernel/module_32.c
-@@ -162,7 +162,7 @@ int module_frob_arch_sections(Elf32_Ehdr *hdr,
- me->arch.core_plt_section = i;
- }
- if (!me->arch.core_plt_section || !me->arch.init_plt_section) {
-- printk("Module doesn't contain .plt or .init.plt sections.\n");
-+ printk("Module %s doesn't contain .plt or .init.plt sections.\n", me->name);
- return -ENOEXEC;
- }
-
-@@ -203,11 +203,16 @@ static uint32_t do_plt_call(void *location,
-
- DEBUGP("Doing plt for call to 0x%x at 0x%x\n", val, (unsigned int)location);
- /* Init, or core PLT? */
-- if (location >= mod->module_core
-- && location < mod->module_core + mod->core_size)
-+ if ((location >= mod->module_core_rx && location < mod->module_core_rx + mod->core_size_rx) ||
-+ (location >= mod->module_core_rw && location < mod->module_core_rw + mod->core_size_rw))
- entry = (void *)sechdrs[mod->arch.core_plt_section].sh_addr;
-- else
-+ else if ((location >= mod->module_init_rx && location < mod->module_init_rx + mod->init_size_rx) ||
-+ (location >= mod->module_init_rw && location < mod->module_init_rw + mod->init_size_rw))
- entry = (void *)sechdrs[mod->arch.init_plt_section].sh_addr;
-+ else {
-+ printk(KERN_ERR "%s: invalid R_PPC_REL24 entry found\n", mod->name);
-+ return ~0UL;
-+ }
-
- /* Find this entry, or if that fails, the next avail. entry */
- while (entry->jump[0]) {
-diff --git a/arch/powerpc/kernel/pci-common.c b/arch/powerpc/kernel/pci-common.c
-index cadbed6..b9bbb00 100644
---- a/arch/powerpc/kernel/pci-common.c
-+++ b/arch/powerpc/kernel/pci-common.c
-@@ -50,14 +50,14 @@ resource_size_t isa_mem_base;
- unsigned int ppc_pci_flags = 0;
-
-
--static struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
-+static const struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
-
--void set_pci_dma_ops(struct dma_map_ops *dma_ops)
-+void set_pci_dma_ops(const struct dma_map_ops *dma_ops)
- {
- pci_dma_ops = dma_ops;
- }
-
--struct dma_map_ops *get_pci_dma_ops(void)
-+const struct dma_map_ops *get_pci_dma_ops(void)
- {
- return pci_dma_ops;
- }
-diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
-index 7b816da..8d5c277 100644
---- a/arch/powerpc/kernel/process.c
-+++ b/arch/powerpc/kernel/process.c
-@@ -539,8 +539,8 @@ void show_regs(struct pt_regs * regs)
- * Lookup NIP late so we have the best change of getting the
- * above info out without failing
- */
-- printk("NIP ["REG"] %pS\n", regs->nip, (void *)regs->nip);
-- printk("LR ["REG"] %pS\n", regs->link, (void *)regs->link);
-+ printk("NIP ["REG"] %pA\n", regs->nip, (void *)regs->nip);
-+ printk("LR ["REG"] %pA\n", regs->link, (void *)regs->link);
- #endif
- show_stack(current, (unsigned long *) regs->gpr[1]);
- if (!user_mode(regs))
-@@ -1034,10 +1034,10 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
- newsp = stack[0];
- ip = stack[STACK_FRAME_LR_SAVE];
- if (!firstframe || ip != lr) {
-- printk("["REG"] ["REG"] %pS", sp, ip, (void *)ip);
-+ printk("["REG"] ["REG"] %pA", sp, ip, (void *)ip);
- #ifdef CONFIG_FUNCTION_GRAPH_TRACER
- if ((ip == rth || ip == mrth) && curr_frame >= 0) {
-- printk(" (%pS)",
-+ printk(" (%pA)",
- (void *)current->ret_stack[curr_frame].ret);
- curr_frame--;
- }
-@@ -1057,7 +1057,7 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
- struct pt_regs *regs = (struct pt_regs *)
- (sp + STACK_FRAME_OVERHEAD);
- lr = regs->link;
-- printk("--- Exception: %lx at %pS\n LR = %pS\n",
-+ printk("--- Exception: %lx at %pA\n LR = %pA\n",
- regs->trap, (void *)regs->nip, (void *)lr);
- firstframe = 1;
- }
-@@ -1134,58 +1134,3 @@ void thread_info_cache_init(void)
- }
-
- #endif /* THREAD_SHIFT < PAGE_SHIFT */
--
--unsigned long arch_align_stack(unsigned long sp)
--{
-- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
-- sp -= get_random_int() & ~PAGE_MASK;
-- return sp & ~0xf;
--}
--
--static inline unsigned long brk_rnd(void)
--{
-- unsigned long rnd = 0;
--
-- /* 8MB for 32bit, 1GB for 64bit */
-- if (is_32bit_task())
-- rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
-- else
-- rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
--
-- return rnd << PAGE_SHIFT;
--}
--
--unsigned long arch_randomize_brk(struct mm_struct *mm)
--{
-- unsigned long base = mm->brk;
-- unsigned long ret;
--
--#ifdef CONFIG_PPC_STD_MMU_64
-- /*
-- * If we are using 1TB segments and we are allowed to randomise
-- * the heap, we can put it above 1TB so it is backed by a 1TB
-- * segment. Otherwise the heap will be in the bottom 1TB
-- * which always uses 256MB segments and this may result in a
-- * performance penalty.
-- */
-- if (!is_32bit_task() && (mmu_highuser_ssize == MMU_SEGSIZE_1T))
-- base = max_t(unsigned long, mm->brk, 1UL << SID_SHIFT_1T);
--#endif
--
-- ret = PAGE_ALIGN(base + brk_rnd());
--
-- if (ret < mm->brk)
-- return mm->brk;
--
-- return ret;
--}
--
--unsigned long randomize_et_dyn(unsigned long base)
--{
-- unsigned long ret = PAGE_ALIGN(base + brk_rnd());
--
-- if (ret < base)
-- return base;
--
-- return ret;
--}
-diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
-index ef14988..8a37ddb 100644
---- a/arch/powerpc/kernel/ptrace.c
-+++ b/arch/powerpc/kernel/ptrace.c
-@@ -86,7 +86,7 @@ static int set_user_trap(struct task_struct *task, unsigned long trap)
- /*
- * Get contents of register REGNO in task TASK.
- */
--unsigned long ptrace_get_reg(struct task_struct *task, int regno)
-+unsigned long ptrace_get_reg(struct task_struct *task, unsigned int regno)
- {
- if (task->thread.regs == NULL)
- return -EIO;
-@@ -894,7 +894,7 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
-
- CHECK_FULL_REGS(child->thread.regs);
- if (index < PT_FPR0) {
-- tmp = ptrace_get_reg(child, (int) index);
-+ tmp = ptrace_get_reg(child, index);
- } else {
- flush_fp_to_thread(child);
- tmp = ((unsigned long *)child->thread.fpr)
-@@ -1033,6 +1033,10 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
- return ret;
- }
-
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+extern void gr_delayed_cred_worker(void);
-+#endif
-+
- /*
- * We must return the syscall number to actually look up in the table.
- * This can be -1L to skip running any syscall at all.
-@@ -1043,6 +1047,11 @@ long do_syscall_trace_enter(struct pt_regs *regs)
-
- secure_computing(regs->gpr[0]);
-
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+ if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
-+ gr_delayed_cred_worker();
-+#endif
-+
- if (test_thread_flag(TIF_SYSCALL_TRACE) &&
- tracehook_report_syscall_entry(regs))
- /*
-@@ -1076,6 +1085,11 @@ void do_syscall_trace_leave(struct pt_regs *regs)
- {
- int step;
-
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+ if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
-+ gr_delayed_cred_worker();
-+#endif
-+
- if (unlikely(current->audit_context))
- audit_syscall_exit((regs->ccr&0x10000000)?AUDITSC_FAILURE:AUDITSC_SUCCESS,
- regs->result);
-diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
-index d670429..2bc59b2 100644
---- a/arch/powerpc/kernel/signal_32.c
-+++ b/arch/powerpc/kernel/signal_32.c
-@@ -857,7 +857,7 @@ int handle_rt_signal32(unsigned long sig, struct k_sigaction *ka,
- /* Save user registers on the stack */
- frame = &rt_sf->uc.uc_mcontext;
- addr = frame;
-- if (vdso32_rt_sigtramp && current->mm->context.vdso_base) {
-+ if (vdso32_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
- if (save_user_regs(regs, frame, 0, 1))
- goto badframe;
- regs->link = current->mm->context.vdso_base + vdso32_rt_sigtramp;
-diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
-index 2fe6fc6..ada0d96 100644
---- a/arch/powerpc/kernel/signal_64.c
-+++ b/arch/powerpc/kernel/signal_64.c
-@@ -429,7 +429,7 @@ int handle_rt_signal64(int signr, struct k_sigaction *ka, siginfo_t *info,
- current->thread.fpscr.val = 0;
-
- /* Set up to return from userspace. */
-- if (vdso64_rt_sigtramp && current->mm->context.vdso_base) {
-+ if (vdso64_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
- regs->link = current->mm->context.vdso_base + vdso64_rt_sigtramp;
- } else {
- err |= setup_trampoline(__NR_rt_sigreturn, &frame->tramp[0]);
-diff --git a/arch/powerpc/kernel/sys_ppc32.c b/arch/powerpc/kernel/sys_ppc32.c
-index b97c2d6..dd01a6a 100644
---- a/arch/powerpc/kernel/sys_ppc32.c
-+++ b/arch/powerpc/kernel/sys_ppc32.c
-@@ -563,10 +563,10 @@ asmlinkage long compat_sys_sysctl(struct __sysctl_args32 __user *args)
- if (oldlenp) {
- if (!error) {
- if (get_user(oldlen, oldlenp) ||
-- put_user(oldlen, (compat_size_t __user *)compat_ptr(tmp.oldlenp)))
-+ put_user(oldlen, (compat_size_t __user *)compat_ptr(tmp.oldlenp)) ||
-+ copy_to_user(args->__unused, tmp.__unused, sizeof(tmp.__unused)))
- error = -EFAULT;
- }
-- copy_to_user(args->__unused, tmp.__unused, sizeof(tmp.__unused));
- }
- return error;
- }
-diff --git a/arch/powerpc/kernel/syscalls.c b/arch/powerpc/kernel/syscalls.c
-index 3370e62..527c659 100644
---- a/arch/powerpc/kernel/syscalls.c
-+++ b/arch/powerpc/kernel/syscalls.c
-@@ -201,11 +201,11 @@ long ppc64_personality(unsigned long personality)
- long ret;
-
- if (personality(current->personality) == PER_LINUX32
-- && personality == PER_LINUX)
-- personality = PER_LINUX32;
-+ && personality(personality) == PER_LINUX)
-+ personality = (personality & ~PER_MASK) | PER_LINUX32;
- ret = sys_personality(personality);
-- if (ret == PER_LINUX32)
-- ret = PER_LINUX;
-+ if (personality(ret) == PER_LINUX32)
-+ ret = (ret & ~PER_MASK) | PER_LINUX;
- return ret;
- }
- #endif
-diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
-index 6f0ae1a..e4b6a56 100644
---- a/arch/powerpc/kernel/traps.c
-+++ b/arch/powerpc/kernel/traps.c
-@@ -99,6 +99,8 @@ static void pmac_backlight_unblank(void)
- static inline void pmac_backlight_unblank(void) { }
- #endif
-
-+extern void gr_handle_kernel_exploit(void);
-+
- int die(const char *str, struct pt_regs *regs, long err)
- {
- static struct {
-@@ -168,6 +170,8 @@ int die(const char *str, struct pt_regs *regs, long err)
- if (panic_on_oops)
- panic("Fatal exception");
-
-+ gr_handle_kernel_exploit();
-+
- oops_exit();
- do_exit(err);
-
-diff --git a/arch/powerpc/kernel/vdso.c b/arch/powerpc/kernel/vdso.c
-index 137dc22..fe57a79 100644
---- a/arch/powerpc/kernel/vdso.c
-+++ b/arch/powerpc/kernel/vdso.c
-@@ -36,6 +36,7 @@
- #include <asm/firmware.h>
- #include <asm/vdso.h>
- #include <asm/vdso_datapage.h>
-+#include <asm/mman.h>
-
- #include "setup.h"
-
-@@ -220,7 +221,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
- vdso_base = VDSO32_MBASE;
- #endif
-
-- current->mm->context.vdso_base = 0;
-+ current->mm->context.vdso_base = ~0UL;
-
- /* vDSO has a problem and was disabled, just don't "enable" it for the
- * process
-@@ -240,7 +241,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
- vdso_base = get_unmapped_area(NULL, vdso_base,
- (vdso_pages << PAGE_SHIFT) +
- ((VDSO_ALIGNMENT - 1) & PAGE_MASK),
-- 0, 0);
-+ 0, MAP_PRIVATE | MAP_EXECUTABLE);
- if (IS_ERR_VALUE(vdso_base)) {
- rc = vdso_base;
- goto fail_mmapsem;
-diff --git a/arch/powerpc/kernel/vio.c b/arch/powerpc/kernel/vio.c
-index 77f6421..829564a 100644
---- a/arch/powerpc/kernel/vio.c
-+++ b/arch/powerpc/kernel/vio.c
-@@ -601,11 +601,12 @@ static void vio_dma_iommu_unmap_sg(struct device *dev,
- vio_cmo_dealloc(viodev, alloc_size);
- }
-
--struct dma_map_ops vio_dma_mapping_ops = {
-+static const struct dma_map_ops vio_dma_mapping_ops = {
- .alloc_coherent = vio_dma_iommu_alloc_coherent,
- .free_coherent = vio_dma_iommu_free_coherent,
- .map_sg = vio_dma_iommu_map_sg,
- .unmap_sg = vio_dma_iommu_unmap_sg,
-+ .dma_supported = dma_iommu_dma_supported,
- .map_page = vio_dma_iommu_map_page,
- .unmap_page = vio_dma_iommu_unmap_page,
-
-@@ -857,7 +858,6 @@ static void vio_cmo_bus_remove(struct vio_dev *viodev)
-
- static void vio_cmo_set_dma_ops(struct vio_dev *viodev)
- {
-- vio_dma_mapping_ops.dma_supported = dma_iommu_ops.dma_supported;
- viodev->dev.archdata.dma_ops = &vio_dma_mapping_ops;
- }
-
-diff --git a/arch/powerpc/lib/usercopy_64.c b/arch/powerpc/lib/usercopy_64.c
-index 5eea6f3..5d10396 100644
---- a/arch/powerpc/lib/usercopy_64.c
-+++ b/arch/powerpc/lib/usercopy_64.c
-@@ -9,22 +9,6 @@
- #include <linux/module.h>
- #include <asm/uaccess.h>
-
--unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
--{
-- if (likely(access_ok(VERIFY_READ, from, n)))
-- n = __copy_from_user(to, from, n);
-- else
-- memset(to, 0, n);
-- return n;
--}
--
--unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
--{
-- if (likely(access_ok(VERIFY_WRITE, to, n)))
-- n = __copy_to_user(to, from, n);
-- return n;
--}
--
- unsigned long copy_in_user(void __user *to, const void __user *from,
- unsigned long n)
- {
-@@ -35,7 +19,5 @@ unsigned long copy_in_user(void __user *to, const void __user *from,
- return n;
- }
-
--EXPORT_SYMBOL(copy_from_user);
--EXPORT_SYMBOL(copy_to_user);
- EXPORT_SYMBOL(copy_in_user);
-
-diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
-index e7dae82..877ce0d 100644
---- a/arch/powerpc/mm/fault.c
-+++ b/arch/powerpc/mm/fault.c
-@@ -30,6 +30,10 @@
- #include <linux/kprobes.h>
- #include <linux/kdebug.h>
- #include <linux/perf_event.h>
-+#include <linux/slab.h>
-+#include <linux/pagemap.h>
-+#include <linux/compiler.h>
-+#include <linux/unistd.h>
-
- #include <asm/firmware.h>
- #include <asm/page.h>
-@@ -40,6 +44,7 @@
- #include <asm/uaccess.h>
- #include <asm/tlbflush.h>
- #include <asm/siginfo.h>
-+#include <asm/ptrace.h>
-
-
- #ifdef CONFIG_KPROBES
-@@ -64,6 +69,33 @@ static inline int notify_page_fault(struct pt_regs *regs)
- }
- #endif
-
-+#ifdef CONFIG_PAX_PAGEEXEC
-+/*
-+ * PaX: decide what to do with offenders (regs->nip = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+ return 1;
-+}
-+
-+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
-+{
-+ unsigned long i;
-+
-+ printk(KERN_ERR "PAX: bytes at PC: ");
-+ for (i = 0; i < 5; i++) {
-+ unsigned int c;
-+ if (get_user(c, (unsigned int __user *)pc+i))
-+ printk(KERN_CONT "???????? ");
-+ else
-+ printk(KERN_CONT "%08x ", c);
-+ }
-+ printk("\n");
-+}
-+#endif
-+
- /*
- * Check whether the instruction at regs->nip is a store using
- * an update addressing form which will update r1.
-@@ -134,7 +166,7 @@ int __kprobes do_page_fault(struct pt_regs *regs, unsigned long address,
- * indicate errors in DSISR but can validly be set in SRR1.
- */
- if (trap == 0x400)
-- error_code &= 0x48200000;
-+ error_code &= 0x58200000;
- else
- is_write = error_code & DSISR_ISSTORE;
- #else
-@@ -250,7 +282,7 @@ good_area:
- * "undefined". Of those that can be set, this is the only
- * one which seems bad.
- */
-- if (error_code & 0x10000000)
-+ if (error_code & DSISR_GUARDED)
- /* Guarded storage error. */
- goto bad_area;
- #endif /* CONFIG_8xx */
-@@ -265,7 +297,7 @@ good_area:
- * processors use the same I/D cache coherency mechanism
- * as embedded.
- */
-- if (error_code & DSISR_PROTFAULT)
-+ if (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))
- goto bad_area;
- #endif /* CONFIG_PPC_STD_MMU */
-
-@@ -335,6 +367,23 @@ bad_area:
- bad_area_nosemaphore:
- /* User mode accesses cause a SIGSEGV */
- if (user_mode(regs)) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (mm->pax_flags & MF_PAX_PAGEEXEC) {
-+#ifdef CONFIG_PPC_STD_MMU
-+ if (is_exec && (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))) {
-+#else
-+ if (is_exec && regs->nip == address) {
-+#endif
-+ switch (pax_handle_fetch_fault(regs)) {
-+ }
-+
-+ pax_report_fault(regs, (void *)regs->nip, (void *)regs->gpr[PT_R1]);
-+ do_group_exit(SIGKILL);
-+ }
-+ }
-+#endif
-+
- _exception(SIGSEGV, regs, code, address);
- return 0;
- }
-diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c
-index 5973631..ad617af 100644
---- a/arch/powerpc/mm/mem.c
-+++ b/arch/powerpc/mm/mem.c
-@@ -250,7 +250,7 @@ static int __init mark_nonram_nosave(void)
- {
- unsigned long lmb_next_region_start_pfn,
- lmb_region_max_pfn;
-- int i;
-+ unsigned int i;
-
- for (i = 0; i < lmb.memory.cnt - 1; i++) {
- lmb_region_max_pfn =
-diff --git a/arch/powerpc/mm/mmap_64.c b/arch/powerpc/mm/mmap_64.c
-index 0d957a4..26d968f 100644
---- a/arch/powerpc/mm/mmap_64.c
-+++ b/arch/powerpc/mm/mmap_64.c
-@@ -99,10 +99,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
- */
- if (mmap_is_legacy()) {
- mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- mm->get_unmapped_area = arch_get_unmapped_area;
- mm->unmap_area = arch_unmap_area;
- } else {
- mm->mmap_base = mmap_base();
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
-+#endif
-+
- mm->get_unmapped_area = arch_get_unmapped_area_topdown;
- mm->unmap_area = arch_unmap_area_topdown;
- }
-diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c
-index ba51948..0e45275 100644
---- a/arch/powerpc/mm/slice.c
-+++ b/arch/powerpc/mm/slice.c
-@@ -98,7 +98,7 @@ static int slice_area_is_free(struct mm_struct *mm, unsigned long addr,
- if ((mm->task_size - len) < addr)
- return 0;
- vma = find_vma(mm, addr);
-- return (!vma || (addr + len) <= vma->vm_start);
-+ return check_heap_stack_gap(vma, addr, len, 0);
- }
-
- static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice)
-@@ -256,7 +256,7 @@ full_search:
- addr = _ALIGN_UP(addr + 1, 1ul << SLICE_HIGH_SHIFT);
- continue;
- }
-- if (!vma || addr + len <= vma->vm_start) {
-+ if (check_heap_stack_gap(vma, addr, len, 0)) {
- /*
- * Remember the place where we stopped the search:
- */
-@@ -313,10 +313,14 @@ static unsigned long slice_find_area_topdown(struct mm_struct *mm,
- }
- }
-
-- addr = mm->mmap_base;
-- while (addr > len) {
-+ if (mm->mmap_base < len)
-+ addr = -ENOMEM;
-+ else
-+ addr = mm->mmap_base - len;
-+
-+ while (!IS_ERR_VALUE(addr)) {
- /* Go down by chunk size */
-- addr = _ALIGN_DOWN(addr - len, 1ul << pshift);
-+ addr = _ALIGN_DOWN(addr, 1ul << pshift);
-
- /* Check for hit with different page size */
- mask = slice_range_to_mask(addr, len);
-@@ -336,7 +340,7 @@ static unsigned long slice_find_area_topdown(struct mm_struct *mm,
- * return with success:
- */
- vma = find_vma(mm, addr);
-- if (!vma || (addr + len) <= vma->vm_start) {
-+ if (check_heap_stack_gap(vma, addr, len, 0)) {
- /* remember the address as a hint for next time */
- if (use_cache)
- mm->free_area_cache = addr;
-@@ -348,7 +352,7 @@ static unsigned long slice_find_area_topdown(struct mm_struct *mm,
- mm->cached_hole_size = vma->vm_start - addr;
-
- /* try just below the current vma->vm_start */
-- addr = vma->vm_start;
-+ addr = skip_heap_stack_gap(vma, len, 0);
- }
-
- /*
-@@ -426,6 +430,11 @@ unsigned long slice_get_unmapped_area(unsigned long addr, unsigned long len,
- if (fixed && addr > (mm->task_size - len))
- return -EINVAL;
-
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!fixed && (mm->pax_flags & MF_PAX_RANDMMAP))
-+ addr = 0;
-+#endif
-+
- /* If hint, make sure it matches our alignment restrictions */
- if (!fixed && addr) {
- addr = _ALIGN_UP(addr, 1ul << pshift);
-diff --git a/arch/powerpc/platforms/52xx/lite5200_pm.c b/arch/powerpc/platforms/52xx/lite5200_pm.c
-index b5c753d..8f01abe 100644
---- a/arch/powerpc/platforms/52xx/lite5200_pm.c
-+++ b/arch/powerpc/platforms/52xx/lite5200_pm.c
-@@ -235,7 +235,7 @@ static void lite5200_pm_end(void)
- lite5200_pm_target_state = PM_SUSPEND_ON;
- }
-
--static struct platform_suspend_ops lite5200_pm_ops = {
-+static const struct platform_suspend_ops lite5200_pm_ops = {
- .valid = lite5200_pm_valid,
- .begin = lite5200_pm_begin,
- .prepare = lite5200_pm_prepare,
-diff --git a/arch/powerpc/platforms/52xx/mpc52xx_pm.c b/arch/powerpc/platforms/52xx/mpc52xx_pm.c
-index a55b0b6..478c18e 100644
---- a/arch/powerpc/platforms/52xx/mpc52xx_pm.c
-+++ b/arch/powerpc/platforms/52xx/mpc52xx_pm.c
-@@ -180,7 +180,7 @@ void mpc52xx_pm_finish(void)
- iounmap(mbar);
- }
-
--static struct platform_suspend_ops mpc52xx_pm_ops = {
-+static const struct platform_suspend_ops mpc52xx_pm_ops = {
- .valid = mpc52xx_pm_valid,
- .prepare = mpc52xx_pm_prepare,
- .enter = mpc52xx_pm_enter,
-diff --git a/arch/powerpc/platforms/83xx/suspend.c b/arch/powerpc/platforms/83xx/suspend.c
-index 08e65fc..643d3ac 100644
---- a/arch/powerpc/platforms/83xx/suspend.c
-+++ b/arch/powerpc/platforms/83xx/suspend.c
-@@ -273,7 +273,7 @@ static int mpc83xx_is_pci_agent(void)
- return ret;
- }
-
--static struct platform_suspend_ops mpc83xx_suspend_ops = {
-+static const struct platform_suspend_ops mpc83xx_suspend_ops = {
- .valid = mpc83xx_suspend_valid,
- .begin = mpc83xx_suspend_begin,
- .enter = mpc83xx_suspend_enter,
-diff --git a/arch/powerpc/platforms/cell/iommu.c b/arch/powerpc/platforms/cell/iommu.c
-index ca5bfdf..1602e09 100644
---- a/arch/powerpc/platforms/cell/iommu.c
-+++ b/arch/powerpc/platforms/cell/iommu.c
-@@ -642,7 +642,7 @@ static int dma_fixed_dma_supported(struct device *dev, u64 mask)
-
- static int dma_set_mask_and_switch(struct device *dev, u64 dma_mask);
-
--struct dma_map_ops dma_iommu_fixed_ops = {
-+const struct dma_map_ops dma_iommu_fixed_ops = {
- .alloc_coherent = dma_fixed_alloc_coherent,
- .free_coherent = dma_fixed_free_coherent,
- .map_sg = dma_fixed_map_sg,
-diff --git a/arch/powerpc/platforms/ps3/system-bus.c b/arch/powerpc/platforms/ps3/system-bus.c
-index e34b305..20e48ec 100644
---- a/arch/powerpc/platforms/ps3/system-bus.c
-+++ b/arch/powerpc/platforms/ps3/system-bus.c
-@@ -694,7 +694,7 @@ static int ps3_dma_supported(struct device *_dev, u64 mask)
- return mask >= DMA_BIT_MASK(32);
- }
-
--static struct dma_map_ops ps3_sb_dma_ops = {
-+static const struct dma_map_ops ps3_sb_dma_ops = {
- .alloc_coherent = ps3_alloc_coherent,
- .free_coherent = ps3_free_coherent,
- .map_sg = ps3_sb_map_sg,
-@@ -704,7 +704,7 @@ static struct dma_map_ops ps3_sb_dma_ops = {
- .unmap_page = ps3_unmap_page,
- };
-
--static struct dma_map_ops ps3_ioc0_dma_ops = {
-+static const struct dma_map_ops ps3_ioc0_dma_ops = {
- .alloc_coherent = ps3_alloc_coherent,
- .free_coherent = ps3_free_coherent,
- .map_sg = ps3_ioc0_map_sg,
-diff --git a/arch/powerpc/platforms/pseries/Kconfig b/arch/powerpc/platforms/pseries/Kconfig
-index f0e6f28..60d53ed 100644
---- a/arch/powerpc/platforms/pseries/Kconfig
-+++ b/arch/powerpc/platforms/pseries/Kconfig
-@@ -2,6 +2,8 @@ config PPC_PSERIES
- depends on PPC64 && PPC_BOOK3S
- bool "IBM pSeries & new (POWER5-based) iSeries"
- select MPIC
-+ select PCI_MSI
-+ select XICS
- select PPC_I8259
- select PPC_RTAS
- select RTAS_ERROR_LOGGING
-diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
-index aca7fff..76c2b6b 100644
---- a/arch/s390/Kconfig
-+++ b/arch/s390/Kconfig
-@@ -197,28 +197,26 @@ config AUDIT_ARCH
-
- config S390_SWITCH_AMODE
- bool "Switch kernel/user addressing modes"
-+ default y
- help
- This option allows to switch the addressing modes of kernel and user
-- space. The kernel parameter switch_amode=on will enable this feature,
-- default is disabled. Enabling this (via kernel parameter) on machines
-- earlier than IBM System z9-109 EC/BC will reduce system performance.
-+ space. Enabling this on machines earlier than IBM System z9-109 EC/BC
-+ will reduce system performance.
-
- Note that this option will also be selected by selecting the execute
-- protection option below. Enabling the execute protection via the
-- noexec kernel parameter will also switch the addressing modes,
-- independent of the switch_amode kernel parameter.
-+ protection option below. Enabling the execute protection will also
-+ switch the addressing modes, independent of this option.
-
-
- config S390_EXEC_PROTECT
- bool "Data execute protection"
-+ default y
- select S390_SWITCH_AMODE
- help
- This option allows to enable a buffer overflow protection for user
- space programs and it also selects the addressing mode option above.
-- The kernel parameter noexec=on will enable this feature and also
-- switch the addressing modes, default is disabled. Enabling this (via
-- kernel parameter) on machines earlier than IBM System z9-109 EC/BC
-- will reduce system performance.
-+ Enabling this on machines earlier than IBM System z9-109 EC/BC will
-+ reduce system performance.
-
- comment "Code generation options"
-
-diff --git a/arch/s390/include/asm/atomic.h b/arch/s390/include/asm/atomic.h
-index ae7c8f9..3f01a0c 100644
---- a/arch/s390/include/asm/atomic.h
-+++ b/arch/s390/include/asm/atomic.h
-@@ -362,6 +362,16 @@ static inline int atomic64_add_unless(atomic64_t *v, long long a, long long u)
- #define atomic64_dec_and_test(_v) (atomic64_sub_return(1, _v) == 0)
- #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
-
-+#define atomic64_read_unchecked(v) atomic64_read(v)
-+#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
-+#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
-+#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
-+#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
-+#define atomic64_inc_unchecked(v) atomic64_inc(v)
-+#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
-+#define atomic64_dec_unchecked(v) atomic64_dec(v)
-+#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
-+
- #define smp_mb__before_atomic_dec() smp_mb()
- #define smp_mb__after_atomic_dec() smp_mb()
- #define smp_mb__before_atomic_inc() smp_mb()
-diff --git a/arch/s390/include/asm/cache.h b/arch/s390/include/asm/cache.h
-index 9b86681..c5140db 100644
---- a/arch/s390/include/asm/cache.h
-+++ b/arch/s390/include/asm/cache.h
-@@ -11,8 +11,10 @@
- #ifndef __ARCH_S390_CACHE_H
- #define __ARCH_S390_CACHE_H
-
--#define L1_CACHE_BYTES 256
-+#include <linux/const.h>
-+
- #define L1_CACHE_SHIFT 8
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-
- #define __read_mostly __attribute__((__section__(".data.read_mostly")))
-
-diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
-index e885442..5b0c9aa3 100644
---- a/arch/s390/include/asm/elf.h
-+++ b/arch/s390/include/asm/elf.h
-@@ -164,6 +164,13 @@ extern unsigned int vdso_enabled;
- that it will "exec", and that there is sufficient room for the brk. */
- #define ELF_ET_DYN_BASE (STACK_TOP / 3 * 2)
-
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_31BIT) ? 0x10000UL : 0x80000000UL)
-+
-+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26)
-+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26)
-+#endif
-+
- /* This yields a mask that user programs can use to figure out what
- instruction set this CPU supports. */
-
-@@ -182,7 +189,8 @@ extern char elf_platform[];
- #define ELF_PLATFORM (elf_platform)
-
- #ifndef __s390x__
--#define SET_PERSONALITY(ex) set_personality(PER_LINUX)
-+#define SET_PERSONALITY(ex) \
-+ set_personality(PER_LINUX | (current->personality & (~PER_MASK)))
- #else /* __s390x__ */
- #define SET_PERSONALITY(ex) \
- do { \
-diff --git a/arch/s390/include/asm/setup.h b/arch/s390/include/asm/setup.h
-index e37478e..9ce0e9f 100644
---- a/arch/s390/include/asm/setup.h
-+++ b/arch/s390/include/asm/setup.h
-@@ -50,13 +50,13 @@ extern unsigned long memory_end;
- void detect_memory_layout(struct mem_chunk chunk[]);
-
- #ifdef CONFIG_S390_SWITCH_AMODE
--extern unsigned int switch_amode;
-+#define switch_amode (1)
- #else
- #define switch_amode (0)
- #endif
-
- #ifdef CONFIG_S390_EXEC_PROTECT
--extern unsigned int s390_noexec;
-+#define s390_noexec (1)
- #else
- #define s390_noexec (0)
- #endif
-diff --git a/arch/s390/include/asm/uaccess.h b/arch/s390/include/asm/uaccess.h
-index 8377e91..e28e6f1 100644
---- a/arch/s390/include/asm/uaccess.h
-+++ b/arch/s390/include/asm/uaccess.h
-@@ -232,6 +232,10 @@ static inline unsigned long __must_check
- copy_to_user(void __user *to, const void *from, unsigned long n)
- {
- might_fault();
-+
-+ if ((long)n < 0)
-+ return n;
-+
- if (access_ok(VERIFY_WRITE, to, n))
- n = __copy_to_user(to, from, n);
- return n;
-@@ -257,6 +261,9 @@ copy_to_user(void __user *to, const void *from, unsigned long n)
- static inline unsigned long __must_check
- __copy_from_user(void *to, const void __user *from, unsigned long n)
- {
-+ if ((long)n < 0)
-+ return n;
-+
- if (__builtin_constant_p(n) && (n <= 256))
- return uaccess.copy_from_user_small(n, from, to);
- else
-@@ -283,6 +290,10 @@ static inline unsigned long __must_check
- copy_from_user(void *to, const void __user *from, unsigned long n)
- {
- might_fault();
-+
-+ if ((long)n < 0)
-+ return n;
-+
- if (access_ok(VERIFY_READ, from, n))
- n = __copy_from_user(to, from, n);
- else
-diff --git a/arch/s390/kernel/module.c b/arch/s390/kernel/module.c
-index 639380a..72e3c02 100644
---- a/arch/s390/kernel/module.c
-+++ b/arch/s390/kernel/module.c
-@@ -166,11 +166,11 @@ module_frob_arch_sections(Elf_Ehdr *hdr, Elf_Shdr *sechdrs,
-
- /* Increase core size by size of got & plt and set start
- offsets for got and plt. */
-- me->core_size = ALIGN(me->core_size, 4);
-- me->arch.got_offset = me->core_size;
-- me->core_size += me->arch.got_size;
-- me->arch.plt_offset = me->core_size;
-- me->core_size += me->arch.plt_size;
-+ me->core_size_rw = ALIGN(me->core_size_rw, 4);
-+ me->arch.got_offset = me->core_size_rw;
-+ me->core_size_rw += me->arch.got_size;
-+ me->arch.plt_offset = me->core_size_rx;
-+ me->core_size_rx += me->arch.plt_size;
- return 0;
- }
-
-@@ -256,7 +256,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
- if (info->got_initialized == 0) {
- Elf_Addr *gotent;
-
-- gotent = me->module_core + me->arch.got_offset +
-+ gotent = me->module_core_rw + me->arch.got_offset +
- info->got_offset;
- *gotent = val;
- info->got_initialized = 1;
-@@ -280,7 +280,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
- else if (r_type == R_390_GOTENT ||
- r_type == R_390_GOTPLTENT)
- *(unsigned int *) loc =
-- (val + (Elf_Addr) me->module_core - loc) >> 1;
-+ (val + (Elf_Addr) me->module_core_rw - loc) >> 1;
- else if (r_type == R_390_GOT64 ||
- r_type == R_390_GOTPLT64)
- *(unsigned long *) loc = val;
-@@ -294,7 +294,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
- case R_390_PLTOFF64: /* 16 bit offset from GOT to PLT. */
- if (info->plt_initialized == 0) {
- unsigned int *ip;
-- ip = me->module_core + me->arch.plt_offset +
-+ ip = me->module_core_rx + me->arch.plt_offset +
- info->plt_offset;
- #ifndef CONFIG_64BIT
- ip[0] = 0x0d105810; /* basr 1,0; l 1,6(1); br 1 */
-@@ -319,7 +319,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
- val - loc + 0xffffUL < 0x1ffffeUL) ||
- (r_type == R_390_PLT32DBL &&
- val - loc + 0xffffffffULL < 0x1fffffffeULL)))
-- val = (Elf_Addr) me->module_core +
-+ val = (Elf_Addr) me->module_core_rx +
- me->arch.plt_offset +
- info->plt_offset;
- val += rela->r_addend - loc;
-@@ -341,7 +341,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
- case R_390_GOTOFF32: /* 32 bit offset to GOT. */
- case R_390_GOTOFF64: /* 64 bit offset to GOT. */
- val = val + rela->r_addend -
-- ((Elf_Addr) me->module_core + me->arch.got_offset);
-+ ((Elf_Addr) me->module_core_rw + me->arch.got_offset);
- if (r_type == R_390_GOTOFF16)
- *(unsigned short *) loc = val;
- else if (r_type == R_390_GOTOFF32)
-@@ -351,7 +351,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
- break;
- case R_390_GOTPC: /* 32 bit PC relative offset to GOT. */
- case R_390_GOTPCDBL: /* 32 bit PC rel. off. to GOT shifted by 1. */
-- val = (Elf_Addr) me->module_core + me->arch.got_offset +
-+ val = (Elf_Addr) me->module_core_rw + me->arch.got_offset +
- rela->r_addend - loc;
- if (r_type == R_390_GOTPC)
- *(unsigned int *) loc = val;
-diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
-index 358e545..051e4f4 100644
---- a/arch/s390/kernel/setup.c
-+++ b/arch/s390/kernel/setup.c
-@@ -307,9 +307,6 @@ static int __init early_parse_mem(char *p)
- early_param("mem", early_parse_mem);
-
- #ifdef CONFIG_S390_SWITCH_AMODE
--unsigned int switch_amode = 0;
--EXPORT_SYMBOL_GPL(switch_amode);
--
- static int set_amode_and_uaccess(unsigned long user_amode,
- unsigned long user32_amode)
- {
-@@ -335,17 +332,6 @@ static int set_amode_and_uaccess(unsigned long user_amode,
- return 0;
- }
- }
--
--/*
-- * Switch kernel/user addressing modes?
-- */
--static int __init early_parse_switch_amode(char *p)
--{
-- switch_amode = 1;
-- return 0;
--}
--early_param("switch_amode", early_parse_switch_amode);
--
- #else /* CONFIG_S390_SWITCH_AMODE */
- static inline int set_amode_and_uaccess(unsigned long user_amode,
- unsigned long user32_amode)
-@@ -354,24 +340,6 @@ static inline int set_amode_and_uaccess(unsigned long user_amode,
- }
- #endif /* CONFIG_S390_SWITCH_AMODE */
-
--#ifdef CONFIG_S390_EXEC_PROTECT
--unsigned int s390_noexec = 0;
--EXPORT_SYMBOL_GPL(s390_noexec);
--
--/*
-- * Enable execute protection?
-- */
--static int __init early_parse_noexec(char *p)
--{
-- if (!strncmp(p, "off", 3))
-- return 0;
-- switch_amode = 1;
-- s390_noexec = 1;
-- return 0;
--}
--early_param("noexec", early_parse_noexec);
--#endif /* CONFIG_S390_EXEC_PROTECT */
--
- static void setup_addressing_mode(void)
- {
- if (s390_noexec) {
-diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
-index 0ab74ae..c8b68f9 100644
---- a/arch/s390/mm/mmap.c
-+++ b/arch/s390/mm/mmap.c
-@@ -78,10 +78,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
- */
- if (mmap_is_legacy()) {
- mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- mm->get_unmapped_area = arch_get_unmapped_area;
- mm->unmap_area = arch_unmap_area;
- } else {
- mm->mmap_base = mmap_base();
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
-+#endif
-+
- mm->get_unmapped_area = arch_get_unmapped_area_topdown;
- mm->unmap_area = arch_unmap_area_topdown;
- }
-@@ -153,10 +165,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
- */
- if (mmap_is_legacy()) {
- mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- mm->get_unmapped_area = s390_get_unmapped_area;
- mm->unmap_area = arch_unmap_area;
- } else {
- mm->mmap_base = mmap_base();
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
-+#endif
-+
- mm->get_unmapped_area = s390_get_unmapped_area_topdown;
- mm->unmap_area = arch_unmap_area_topdown;
- }
-diff --git a/arch/score/include/asm/cache.h b/arch/score/include/asm/cache.h
-index ae3d59f..f65f075 100644
---- a/arch/score/include/asm/cache.h
-+++ b/arch/score/include/asm/cache.h
-@@ -1,7 +1,9 @@
- #ifndef _ASM_SCORE_CACHE_H
- #define _ASM_SCORE_CACHE_H
-
-+#include <linux/const.h>
-+
- #define L1_CACHE_SHIFT 4
--#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-
- #endif /* _ASM_SCORE_CACHE_H */
-diff --git a/arch/score/include/asm/system.h b/arch/score/include/asm/system.h
-index 589d5c7..669e274 100644
---- a/arch/score/include/asm/system.h
-+++ b/arch/score/include/asm/system.h
-@@ -17,7 +17,7 @@ do { \
- #define finish_arch_switch(prev) do {} while (0)
-
- typedef void (*vi_handler_t)(void);
--extern unsigned long arch_align_stack(unsigned long sp);
-+#define arch_align_stack(x) (x)
-
- #define mb() barrier()
- #define rmb() barrier()
-diff --git a/arch/score/kernel/process.c b/arch/score/kernel/process.c
-index 25d0803..d6c8e36 100644
---- a/arch/score/kernel/process.c
-+++ b/arch/score/kernel/process.c
-@@ -161,8 +161,3 @@ unsigned long get_wchan(struct task_struct *task)
-
- return task_pt_regs(task)->cp0_epc;
- }
--
--unsigned long arch_align_stack(unsigned long sp)
--{
-- return sp;
--}
-diff --git a/arch/sh/boards/mach-hp6xx/pm.c b/arch/sh/boards/mach-hp6xx/pm.c
-index d936c1a..304a252 100644
---- a/arch/sh/boards/mach-hp6xx/pm.c
-+++ b/arch/sh/boards/mach-hp6xx/pm.c
-@@ -143,7 +143,7 @@ static int hp6x0_pm_enter(suspend_state_t state)
- return 0;
- }
-
--static struct platform_suspend_ops hp6x0_pm_ops = {
-+static const struct platform_suspend_ops hp6x0_pm_ops = {
- .enter = hp6x0_pm_enter,
- .valid = suspend_valid_only_mem,
- };
-diff --git a/arch/sh/include/asm/cache.h b/arch/sh/include/asm/cache.h
-index 02df18e..ae3a793 100644
---- a/arch/sh/include/asm/cache.h
-+++ b/arch/sh/include/asm/cache.h
-@@ -9,10 +9,11 @@
- #define __ASM_SH_CACHE_H
- #ifdef __KERNEL__
-
-+#include <linux/const.h>
- #include <linux/init.h>
- #include <cpu/cache.h>
-
--#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-
- #define __read_mostly __attribute__((__section__(".data.read_mostly")))
-
-diff --git a/arch/sh/kernel/cpu/sh4/sq.c b/arch/sh/kernel/cpu/sh4/sq.c
-index 8a8a993..7b3079b 100644
---- a/arch/sh/kernel/cpu/sh4/sq.c
-+++ b/arch/sh/kernel/cpu/sh4/sq.c
-@@ -327,7 +327,7 @@ static struct attribute *sq_sysfs_attrs[] = {
- NULL,
- };
-
--static struct sysfs_ops sq_sysfs_ops = {
-+static const struct sysfs_ops sq_sysfs_ops = {
- .show = sq_sysfs_show,
- .store = sq_sysfs_store,
- };
-diff --git a/arch/sh/kernel/cpu/shmobile/pm.c b/arch/sh/kernel/cpu/shmobile/pm.c
-index ee3c2aa..c49cee6 100644
---- a/arch/sh/kernel/cpu/shmobile/pm.c
-+++ b/arch/sh/kernel/cpu/shmobile/pm.c
-@@ -58,7 +58,7 @@ static int sh_pm_enter(suspend_state_t state)
- return 0;
- }
-
--static struct platform_suspend_ops sh_pm_ops = {
-+static const struct platform_suspend_ops sh_pm_ops = {
- .enter = sh_pm_enter,
- .valid = suspend_valid_only_mem,
- };
-diff --git a/arch/sh/kernel/kgdb.c b/arch/sh/kernel/kgdb.c
-index 3e532d0..9faa306 100644
---- a/arch/sh/kernel/kgdb.c
-+++ b/arch/sh/kernel/kgdb.c
-@@ -271,7 +271,7 @@ void kgdb_arch_exit(void)
- {
- }
-
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- /* Breakpoint instruction: trapa #0x3c */
- #ifdef CONFIG_CPU_LITTLE_ENDIAN
- .gdb_bpt_instr = { 0x3c, 0xc3 },
-diff --git a/arch/sh/mm/mmap.c b/arch/sh/mm/mmap.c
-index afeb710..e8366ef 100644
---- a/arch/sh/mm/mmap.c
-+++ b/arch/sh/mm/mmap.c
-@@ -49,6 +49,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
- struct vm_area_struct *vma;
- unsigned long start_addr;
- int do_colour_align;
-+ unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
-
- if (flags & MAP_FIXED) {
- /* We do not accept a shared mapping if it would violate
-@@ -74,8 +75,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
- addr = PAGE_ALIGN(addr);
-
- vma = find_vma(mm, addr);
-- if (TASK_SIZE - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
- return addr;
- }
-
-@@ -106,7 +106,7 @@ full_search:
- }
- return -ENOMEM;
- }
-- if (likely(!vma || addr + len <= vma->vm_start)) {
-+ if (likely(check_heap_stack_gap(vma, addr, len, offset))) {
- /*
- * Remember the place where we stopped the search:
- */
-@@ -131,6 +131,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- struct mm_struct *mm = current->mm;
- unsigned long addr = addr0;
- int do_colour_align;
-+ unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
-
- if (flags & MAP_FIXED) {
- /* We do not accept a shared mapping if it would violate
-@@ -157,8 +158,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- addr = PAGE_ALIGN(addr);
-
- vma = find_vma(mm, addr);
-- if (TASK_SIZE - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
- return addr;
- }
-
-@@ -179,7 +179,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- /* make sure it can fit in the remaining address space */
- if (likely(addr > len)) {
- vma = find_vma(mm, addr-len);
-- if (!vma || addr <= vma->vm_start) {
-+ if (check_heap_stack_gap(vma, addr - len, len, offset)) {
- /* remember the address as a hint for next time */
- return (mm->free_area_cache = addr-len);
- }
-@@ -188,18 +188,18 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- if (unlikely(mm->mmap_base < len))
- goto bottomup;
-
-- addr = mm->mmap_base-len;
-- if (do_colour_align)
-- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
-+ addr = mm->mmap_base - len;
-
- do {
-+ if (do_colour_align)
-+ addr = COLOUR_ALIGN_DOWN(addr, pgoff);
- /*
- * Lookup failure means no vma is above this address,
- * else if new region fits below vma->vm_start,
- * return with success:
- */
- vma = find_vma(mm, addr);
-- if (likely(!vma || addr+len <= vma->vm_start)) {
-+ if (likely(check_heap_stack_gap(vma, addr, len, offset))) {
- /* remember the address as a hint for next time */
- return (mm->free_area_cache = addr);
- }
-@@ -209,10 +209,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- mm->cached_hole_size = vma->vm_start - addr;
-
- /* try just below the current vma->vm_start */
-- addr = vma->vm_start-len;
-- if (do_colour_align)
-- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
-- } while (likely(len < vma->vm_start));
-+ addr = skip_heap_stack_gap(vma, len, offset);
-+ } while (!IS_ERR_VALUE(addr));
-
- bottomup:
- /*
-diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
-index 05ef538..dc9c857 100644
---- a/arch/sparc/Kconfig
-+++ b/arch/sparc/Kconfig
-@@ -32,6 +32,7 @@ config SPARC
-
- config SPARC32
- def_bool !64BIT
-+ select GENERIC_ATOMIC64
-
- config SPARC64
- def_bool 64BIT
-diff --git a/arch/sparc/Makefile b/arch/sparc/Makefile
-index 0538555..c826059 100644
---- a/arch/sparc/Makefile
-+++ b/arch/sparc/Makefile
-@@ -75,7 +75,7 @@ drivers-$(CONFIG_OPROFILE) += arch/sparc/oprofile/
- # Export what is needed by arch/sparc/boot/Makefile
- export VMLINUX_INIT VMLINUX_MAIN
- VMLINUX_INIT := $(head-y) $(init-y)
--VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/
-+VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
- VMLINUX_MAIN += $(patsubst %/, %/lib.a, $(libs-y)) $(libs-y)
- VMLINUX_MAIN += $(drivers-y) $(net-y)
-
-diff --git a/arch/sparc/include/asm/atomic_32.h b/arch/sparc/include/asm/atomic_32.h
-index f0d343c..cf36e68 100644
---- a/arch/sparc/include/asm/atomic_32.h
-+++ b/arch/sparc/include/asm/atomic_32.h
-@@ -13,6 +13,8 @@
-
- #include <linux/types.h>
-
-+#include <asm-generic/atomic64.h>
-+
- #ifdef __KERNEL__
-
- #include <asm/system.h>
-diff --git a/arch/sparc/include/asm/atomic_64.h b/arch/sparc/include/asm/atomic_64.h
-index f5cc06f..f858d47 100644
---- a/arch/sparc/include/asm/atomic_64.h
-+++ b/arch/sparc/include/asm/atomic_64.h
-@@ -14,18 +14,40 @@
- #define ATOMIC64_INIT(i) { (i) }
-
- #define atomic_read(v) ((v)->counter)
-+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
-+{
-+ return v->counter;
-+}
- #define atomic64_read(v) ((v)->counter)
-+static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
-+{
-+ return v->counter;
-+}
-
- #define atomic_set(v, i) (((v)->counter) = i)
-+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
-+{
-+ v->counter = i;
-+}
- #define atomic64_set(v, i) (((v)->counter) = i)
-+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
-+{
-+ v->counter = i;
-+}
-
- extern void atomic_add(int, atomic_t *);
-+extern void atomic_add_unchecked(int, atomic_unchecked_t *);
- extern void atomic64_add(long, atomic64_t *);
-+extern void atomic64_add_unchecked(long, atomic64_unchecked_t *);
- extern void atomic_sub(int, atomic_t *);
-+extern void atomic_sub_unchecked(int, atomic_unchecked_t *);
- extern void atomic64_sub(long, atomic64_t *);
-+extern void atomic64_sub_unchecked(long, atomic64_unchecked_t *);
-
- extern int atomic_add_ret(int, atomic_t *);
-+extern int atomic_add_ret_unchecked(int, atomic_unchecked_t *);
- extern long atomic64_add_ret(long, atomic64_t *);
-+extern long atomic64_add_ret_unchecked(long, atomic64_unchecked_t *);
- extern int atomic_sub_ret(int, atomic_t *);
- extern long atomic64_sub_ret(long, atomic64_t *);
-
-@@ -33,13 +55,29 @@ extern long atomic64_sub_ret(long, atomic64_t *);
- #define atomic64_dec_return(v) atomic64_sub_ret(1, v)
-
- #define atomic_inc_return(v) atomic_add_ret(1, v)
-+static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
-+{
-+ return atomic_add_ret_unchecked(1, v);
-+}
- #define atomic64_inc_return(v) atomic64_add_ret(1, v)
-+static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
-+{
-+ return atomic64_add_ret_unchecked(1, v);
-+}
-
- #define atomic_sub_return(i, v) atomic_sub_ret(i, v)
- #define atomic64_sub_return(i, v) atomic64_sub_ret(i, v)
-
- #define atomic_add_return(i, v) atomic_add_ret(i, v)
-+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
-+{
-+ return atomic_add_ret_unchecked(i, v);
-+}
- #define atomic64_add_return(i, v) atomic64_add_ret(i, v)
-+static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
-+{
-+ return atomic64_add_ret_unchecked(i, v);
-+}
-
- /*
- * atomic_inc_and_test - increment and test
-@@ -50,6 +88,10 @@ extern long atomic64_sub_ret(long, atomic64_t *);
- * other cases.
- */
- #define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
-+static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
-+{
-+ return atomic_inc_return_unchecked(v) == 0;
-+}
- #define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
-
- #define atomic_sub_and_test(i, v) (atomic_sub_ret(i, v) == 0)
-@@ -59,30 +101,65 @@ extern long atomic64_sub_ret(long, atomic64_t *);
- #define atomic64_dec_and_test(v) (atomic64_sub_ret(1, v) == 0)
-
- #define atomic_inc(v) atomic_add(1, v)
-+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
-+{
-+ atomic_add_unchecked(1, v);
-+}
- #define atomic64_inc(v) atomic64_add(1, v)
-+static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
-+{
-+ atomic64_add_unchecked(1, v);
-+}
-
- #define atomic_dec(v) atomic_sub(1, v)
-+static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
-+{
-+ atomic_sub_unchecked(1, v);
-+}
- #define atomic64_dec(v) atomic64_sub(1, v)
-+static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
-+{
-+ atomic64_sub_unchecked(1, v);
-+}
-
- #define atomic_add_negative(i, v) (atomic_add_ret(i, v) < 0)
- #define atomic64_add_negative(i, v) (atomic64_add_ret(i, v) < 0)
-
- #define atomic_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
-+static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
-+{
-+ return cmpxchg(&v->counter, old, new);
-+}
- #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
-+static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
-+{
-+ return xchg(&v->counter, new);
-+}
-
- static inline int atomic_add_unless(atomic_t *v, int a, int u)
- {
-- int c, old;
-+ int c, old, new;
- c = atomic_read(v);
- for (;;) {
-- if (unlikely(c == (u)))
-+ if (unlikely(c == u))
- break;
-- old = atomic_cmpxchg((v), c, c + (a));
-+
-+ asm volatile("addcc %2, %0, %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "tvs %%icc, 6\n"
-+#endif
-+
-+ : "=r" (new)
-+ : "0" (c), "ir" (a)
-+ : "cc");
-+
-+ old = atomic_cmpxchg(v, c, new);
- if (likely(old == c))
- break;
- c = old;
- }
-- return c != (u);
-+ return c != u;
- }
-
- #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
-@@ -90,20 +167,35 @@ static inline int atomic_add_unless(atomic_t *v, int a, int u)
- #define atomic64_cmpxchg(v, o, n) \
- ((__typeof__((v)->counter))cmpxchg(&((v)->counter), (o), (n)))
- #define atomic64_xchg(v, new) (xchg(&((v)->counter), new))
-+static inline long atomic64_xchg_unchecked(atomic64_unchecked_t *v, long new)
-+{
-+ return xchg(&v->counter, new);
-+}
-
- static inline long atomic64_add_unless(atomic64_t *v, long a, long u)
- {
-- long c, old;
-+ long c, old, new;
- c = atomic64_read(v);
- for (;;) {
-- if (unlikely(c == (u)))
-+ if (unlikely(c == u))
- break;
-- old = atomic64_cmpxchg((v), c, c + (a));
-+
-+ asm volatile("addcc %2, %0, %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "tvs %%xcc, 6\n"
-+#endif
-+
-+ : "=r" (new)
-+ : "0" (c), "ir" (a)
-+ : "cc");
-+
-+ old = atomic64_cmpxchg(v, c, new);
- if (likely(old == c))
- break;
- c = old;
- }
-- return c != (u);
-+ return c != u;
- }
-
- #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
-diff --git a/arch/sparc/include/asm/cache.h b/arch/sparc/include/asm/cache.h
-index 41f85ae..73b80b5 100644
---- a/arch/sparc/include/asm/cache.h
-+++ b/arch/sparc/include/asm/cache.h
-@@ -7,8 +7,10 @@
- #ifndef _SPARC_CACHE_H
- #define _SPARC_CACHE_H
-
-+#include <linux/const.h>
-+
- #define L1_CACHE_SHIFT 5
--#define L1_CACHE_BYTES 32
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
- #define L1_CACHE_ALIGN(x) ((((x)+(L1_CACHE_BYTES-1))&~(L1_CACHE_BYTES-1)))
-
- #ifdef CONFIG_SPARC32
-diff --git a/arch/sparc/include/asm/dma-mapping.h b/arch/sparc/include/asm/dma-mapping.h
-index 5a8c308..38def92 100644
---- a/arch/sparc/include/asm/dma-mapping.h
-+++ b/arch/sparc/include/asm/dma-mapping.h
-@@ -14,10 +14,10 @@ extern int dma_set_mask(struct device *dev, u64 dma_mask);
- #define dma_free_noncoherent(d, s, v, h) dma_free_coherent(d, s, v, h)
- #define dma_is_consistent(d, h) (1)
-
--extern struct dma_map_ops *dma_ops, pci32_dma_ops;
-+extern const struct dma_map_ops *dma_ops, pci32_dma_ops;
- extern struct bus_type pci_bus_type;
-
--static inline struct dma_map_ops *get_dma_ops(struct device *dev)
-+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
- {
- #if defined(CONFIG_SPARC32) && defined(CONFIG_PCI)
- if (dev->bus == &pci_bus_type)
-@@ -31,7 +31,7 @@ static inline struct dma_map_ops *get_dma_ops(struct device *dev)
- static inline void *dma_alloc_coherent(struct device *dev, size_t size,
- dma_addr_t *dma_handle, gfp_t flag)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
- void *cpu_addr;
-
- cpu_addr = ops->alloc_coherent(dev, size, dma_handle, flag);
-@@ -42,7 +42,7 @@ static inline void *dma_alloc_coherent(struct device *dev, size_t size,
- static inline void dma_free_coherent(struct device *dev, size_t size,
- void *cpu_addr, dma_addr_t dma_handle)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- debug_dma_free_coherent(dev, size, cpu_addr, dma_handle);
- ops->free_coherent(dev, size, cpu_addr, dma_handle);
-diff --git a/arch/sparc/include/asm/elf_32.h b/arch/sparc/include/asm/elf_32.h
-index 381a1b5..b97e3ff 100644
---- a/arch/sparc/include/asm/elf_32.h
-+++ b/arch/sparc/include/asm/elf_32.h
-@@ -116,6 +116,13 @@ typedef struct {
-
- #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE)
-
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE 0x10000UL
-+
-+#define PAX_DELTA_MMAP_LEN 16
-+#define PAX_DELTA_STACK_LEN 16
-+#endif
-+
- /* This yields a mask that user programs can use to figure out what
- instruction set this cpu supports. This can NOT be done in userspace
- on Sparc. */
-diff --git a/arch/sparc/include/asm/elf_64.h b/arch/sparc/include/asm/elf_64.h
-index 9968085..c2106ef 100644
---- a/arch/sparc/include/asm/elf_64.h
-+++ b/arch/sparc/include/asm/elf_64.h
-@@ -163,6 +163,12 @@ typedef struct {
- #define ELF_ET_DYN_BASE 0x0000010000000000UL
- #define COMPAT_ELF_ET_DYN_BASE 0x0000000070000000UL
-
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT) ? 0x10000UL : 0x100000UL)
-+
-+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT) ? 14 : 28)
-+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT) ? 15 : 29)
-+#endif
-
- /* This yields a mask that user programs can use to figure out what
- instruction set this cpu supports. */
-diff --git a/arch/sparc/include/asm/page_32.h b/arch/sparc/include/asm/page_32.h
-index 156707b..aefa786 100644
---- a/arch/sparc/include/asm/page_32.h
-+++ b/arch/sparc/include/asm/page_32.h
-@@ -8,6 +8,8 @@
- #ifndef _SPARC_PAGE_H
- #define _SPARC_PAGE_H
-
-+#include <linux/const.h>
-+
- #define PAGE_SHIFT 12
-
- #ifndef __ASSEMBLY__
-diff --git a/arch/sparc/include/asm/pgalloc_32.h b/arch/sparc/include/asm/pgalloc_32.h
-index ca2b344..c6084f89 100644
---- a/arch/sparc/include/asm/pgalloc_32.h
-+++ b/arch/sparc/include/asm/pgalloc_32.h
-@@ -37,6 +37,7 @@ BTFIXUPDEF_CALL(void, free_pgd_fast, pgd_t *)
- BTFIXUPDEF_CALL(void, pgd_set, pgd_t *, pmd_t *)
- #define pgd_set(pgdp,pmdp) BTFIXUP_CALL(pgd_set)(pgdp,pmdp)
- #define pgd_populate(MM, PGD, PMD) pgd_set(PGD, PMD)
-+#define pgd_populate_kernel(MM, PGD, PMD) pgd_populate((MM), (PGD), (PMD))
-
- BTFIXUPDEF_CALL(pmd_t *, pmd_alloc_one, struct mm_struct *, unsigned long)
- #define pmd_alloc_one(mm, address) BTFIXUP_CALL(pmd_alloc_one)(mm, address)
-diff --git a/arch/sparc/include/asm/pgalloc_64.h b/arch/sparc/include/asm/pgalloc_64.h
-index 5bdfa2c..92b0706 100644
---- a/arch/sparc/include/asm/pgalloc_64.h
-+++ b/arch/sparc/include/asm/pgalloc_64.h
-@@ -25,6 +25,7 @@ static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
- }
-
- #define pud_populate(MM, PUD, PMD) pud_set(PUD, PMD)
-+#define pud_populate_kernel(MM, PUD, PMD) pud_populate((MM), (PUD), (PMD))
-
- static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long addr)
- {
-diff --git a/arch/sparc/include/asm/pgtable_32.h b/arch/sparc/include/asm/pgtable_32.h
-index e0cabe7..efd60f1 100644
---- a/arch/sparc/include/asm/pgtable_32.h
-+++ b/arch/sparc/include/asm/pgtable_32.h
-@@ -43,6 +43,13 @@ BTFIXUPDEF_SIMM13(user_ptrs_per_pgd)
- BTFIXUPDEF_INT(page_none)
- BTFIXUPDEF_INT(page_copy)
- BTFIXUPDEF_INT(page_readonly)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+BTFIXUPDEF_INT(page_shared_noexec)
-+BTFIXUPDEF_INT(page_copy_noexec)
-+BTFIXUPDEF_INT(page_readonly_noexec)
-+#endif
-+
- BTFIXUPDEF_INT(page_kernel)
-
- #define PMD_SHIFT SUN4C_PMD_SHIFT
-@@ -64,6 +71,16 @@ extern pgprot_t PAGE_SHARED;
- #define PAGE_COPY __pgprot(BTFIXUP_INT(page_copy))
- #define PAGE_READONLY __pgprot(BTFIXUP_INT(page_readonly))
-
-+#ifdef CONFIG_PAX_PAGEEXEC
-+extern pgprot_t PAGE_SHARED_NOEXEC;
-+# define PAGE_COPY_NOEXEC __pgprot(BTFIXUP_INT(page_copy_noexec))
-+# define PAGE_READONLY_NOEXEC __pgprot(BTFIXUP_INT(page_readonly_noexec))
-+#else
-+# define PAGE_SHARED_NOEXEC PAGE_SHARED
-+# define PAGE_COPY_NOEXEC PAGE_COPY
-+# define PAGE_READONLY_NOEXEC PAGE_READONLY
-+#endif
-+
- extern unsigned long page_kernel;
-
- #ifdef MODULE
-diff --git a/arch/sparc/include/asm/pgtsrmmu.h b/arch/sparc/include/asm/pgtsrmmu.h
-index 1407c07..7e10231 100644
---- a/arch/sparc/include/asm/pgtsrmmu.h
-+++ b/arch/sparc/include/asm/pgtsrmmu.h
-@@ -115,6 +115,13 @@
- SRMMU_EXEC | SRMMU_REF)
- #define SRMMU_PAGE_RDONLY __pgprot(SRMMU_VALID | SRMMU_CACHE | \
- SRMMU_EXEC | SRMMU_REF)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+#define SRMMU_PAGE_SHARED_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_WRITE | SRMMU_REF)
-+#define SRMMU_PAGE_COPY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
-+#define SRMMU_PAGE_RDONLY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
-+#endif
-+
- #define SRMMU_PAGE_KERNEL __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_PRIV | \
- SRMMU_DIRTY | SRMMU_REF)
-
-diff --git a/arch/sparc/include/asm/spinlock_64.h b/arch/sparc/include/asm/spinlock_64.h
-index 43e5147..47622a1 100644
---- a/arch/sparc/include/asm/spinlock_64.h
-+++ b/arch/sparc/include/asm/spinlock_64.h
-@@ -92,14 +92,19 @@ static inline void __raw_spin_lock_flags(raw_spinlock_t *lock, unsigned long fla
-
- /* Multi-reader locks, these are much saner than the 32-bit Sparc ones... */
-
--static void inline arch_read_lock(raw_rwlock_t *lock)
-+static inline void arch_read_lock(raw_rwlock_t *lock)
- {
- unsigned long tmp1, tmp2;
-
- __asm__ __volatile__ (
- "1: ldsw [%2], %0\n"
- " brlz,pn %0, 2f\n"
--"4: add %0, 1, %1\n"
-+"4: addcc %0, 1, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+" tvs %%icc, 6\n"
-+#endif
-+
- " cas [%2], %0, %1\n"
- " cmp %0, %1\n"
- " bne,pn %%icc, 1b\n"
-@@ -112,10 +117,10 @@ static void inline arch_read_lock(raw_rwlock_t *lock)
- " .previous"
- : "=&r" (tmp1), "=&r" (tmp2)
- : "r" (lock)
-- : "memory");
-+ : "memory", "cc");
- }
-
--static int inline arch_read_trylock(raw_rwlock_t *lock)
-+static inline int arch_read_trylock(raw_rwlock_t *lock)
- {
- int tmp1, tmp2;
-
-@@ -123,7 +128,12 @@ static int inline arch_read_trylock(raw_rwlock_t *lock)
- "1: ldsw [%2], %0\n"
- " brlz,a,pn %0, 2f\n"
- " mov 0, %0\n"
--" add %0, 1, %1\n"
-+" addcc %0, 1, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+" tvs %%icc, 6\n"
-+#endif
-+
- " cas [%2], %0, %1\n"
- " cmp %0, %1\n"
- " bne,pn %%icc, 1b\n"
-@@ -136,13 +146,18 @@ static int inline arch_read_trylock(raw_rwlock_t *lock)
- return tmp1;
- }
-
--static void inline arch_read_unlock(raw_rwlock_t *lock)
-+static inline void arch_read_unlock(raw_rwlock_t *lock)
- {
- unsigned long tmp1, tmp2;
-
- __asm__ __volatile__(
- "1: lduw [%2], %0\n"
--" sub %0, 1, %1\n"
-+" subcc %0, 1, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+" tvs %%icc, 6\n"
-+#endif
-+
- " cas [%2], %0, %1\n"
- " cmp %0, %1\n"
- " bne,pn %%xcc, 1b\n"
-@@ -152,7 +167,7 @@ static void inline arch_read_unlock(raw_rwlock_t *lock)
- : "memory");
- }
-
--static void inline arch_write_lock(raw_rwlock_t *lock)
-+static inline void arch_write_lock(raw_rwlock_t *lock)
- {
- unsigned long mask, tmp1, tmp2;
-
-@@ -177,7 +192,7 @@ static void inline arch_write_lock(raw_rwlock_t *lock)
- : "memory");
- }
-
--static void inline arch_write_unlock(raw_rwlock_t *lock)
-+static inline void arch_write_unlock(raw_rwlock_t *lock)
- {
- __asm__ __volatile__(
- " stw %%g0, [%0]"
-@@ -186,7 +201,7 @@ static void inline arch_write_unlock(raw_rwlock_t *lock)
- : "memory");
- }
-
--static int inline arch_write_trylock(raw_rwlock_t *lock)
-+static inline int arch_write_trylock(raw_rwlock_t *lock)
- {
- unsigned long mask, tmp1, tmp2, result;
-
-diff --git a/arch/sparc/include/asm/thread_info_32.h b/arch/sparc/include/asm/thread_info_32.h
-index 844d73a..f787fb9 100644
---- a/arch/sparc/include/asm/thread_info_32.h
-+++ b/arch/sparc/include/asm/thread_info_32.h
-@@ -50,6 +50,8 @@ struct thread_info {
- unsigned long w_saved;
-
- struct restart_block restart_block;
-+
-+ unsigned long lowest_stack;
- };
-
- /*
-diff --git a/arch/sparc/include/asm/thread_info_64.h b/arch/sparc/include/asm/thread_info_64.h
-index f78ad9a..a3213ed 100644
---- a/arch/sparc/include/asm/thread_info_64.h
-+++ b/arch/sparc/include/asm/thread_info_64.h
-@@ -68,6 +68,8 @@ struct thread_info {
- struct pt_regs *kern_una_regs;
- unsigned int kern_una_insn;
-
-+ unsigned long lowest_stack;
-+
- unsigned long fpregs[0] __attribute__ ((aligned(64)));
- };
-
-@@ -227,6 +229,8 @@ register struct thread_info *current_thread_info_reg asm("g6");
- /* flag bit 8 is available */
- #define TIF_SECCOMP 9 /* secure computing */
- #define TIF_SYSCALL_AUDIT 10 /* syscall auditing active */
-+#define TIF_GRSEC_SETXID 11 /* update credentials on syscall entry/exit */
-+
- /* NOTE: Thread flags >= 12 should be ones we have no interest
- * in using in assembly, else we can't use the mask as
- * an immediate value in instructions such as andcc.
-@@ -247,12 +251,18 @@ register struct thread_info *current_thread_info_reg asm("g6");
- #define _TIF_SYSCALL_AUDIT (1<<TIF_SYSCALL_AUDIT)
- #define _TIF_POLLING_NRFLAG (1<<TIF_POLLING_NRFLAG)
- #define _TIF_FREEZE (1<<TIF_FREEZE)
-+#define _TIF_GRSEC_SETXID (1<<TIF_GRSEC_SETXID)
-
- #define _TIF_USER_WORK_MASK ((0xff << TI_FLAG_WSAVED_SHIFT) | \
- _TIF_DO_NOTIFY_RESUME_MASK | \
- _TIF_NEED_RESCHED | _TIF_PERFCTR)
- #define _TIF_DO_NOTIFY_RESUME_MASK (_TIF_NOTIFY_RESUME | _TIF_SIGPENDING)
-
-+#define _TIF_WORK_SYSCALL \
-+ (_TIF_SYSCALL_TRACE | _TIF_SECCOMP | _TIF_SYSCALL_AUDIT | \
-+ _TIF_GRSEC_SETXID)
-+
-+
- /*
- * Thread-synchronous status.
- *
-diff --git a/arch/sparc/include/asm/uaccess.h b/arch/sparc/include/asm/uaccess.h
-index e88fbe5..96b0ce5 100644
---- a/arch/sparc/include/asm/uaccess.h
-+++ b/arch/sparc/include/asm/uaccess.h
-@@ -1,5 +1,13 @@
- #ifndef ___ASM_SPARC_UACCESS_H
- #define ___ASM_SPARC_UACCESS_H
-+
-+#ifdef __KERNEL__
-+#ifndef __ASSEMBLY__
-+#include <linux/types.h>
-+extern void check_object_size(const void *ptr, unsigned long n, bool to);
-+#endif
-+#endif
-+
- #if defined(__sparc__) && defined(__arch64__)
- #include <asm/uaccess_64.h>
- #else
-diff --git a/arch/sparc/include/asm/uaccess_32.h b/arch/sparc/include/asm/uaccess_32.h
-index 8303ac4..07f333d 100644
---- a/arch/sparc/include/asm/uaccess_32.h
-+++ b/arch/sparc/include/asm/uaccess_32.h
-@@ -249,27 +249,46 @@ extern unsigned long __copy_user(void __user *to, const void __user *from, unsig
-
- static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
- {
-- if (n && __access_ok((unsigned long) to, n))
-+ if ((long)n < 0)
-+ return n;
-+
-+ if (n && __access_ok((unsigned long) to, n)) {
-+ if (!__builtin_constant_p(n))
-+ check_object_size(from, n, true);
- return __copy_user(to, (__force void __user *) from, n);
-- else
-+ } else
- return n;
- }
-
- static inline unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n)
- {
-+ if ((long)n < 0)
-+ return n;
-+
-+ if (!__builtin_constant_p(n))
-+ check_object_size(from, n, true);
-+
- return __copy_user(to, (__force void __user *) from, n);
- }
-
- static inline unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
- {
-- if (n && __access_ok((unsigned long) from, n))
-+ if ((long)n < 0)
-+ return n;
-+
-+ if (n && __access_ok((unsigned long) from, n)) {
-+ if (!__builtin_constant_p(n))
-+ check_object_size(to, n, false);
- return __copy_user((__force void __user *) to, from, n);
-- else
-+ } else
- return n;
- }
-
- static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
- {
-+ if ((long)n < 0)
-+ return n;
-+
- return __copy_user((__force void __user *) to, from, n);
- }
-
-diff --git a/arch/sparc/include/asm/uaccess_64.h b/arch/sparc/include/asm/uaccess_64.h
-index 9ea271e..7b8a271 100644
---- a/arch/sparc/include/asm/uaccess_64.h
-+++ b/arch/sparc/include/asm/uaccess_64.h
-@@ -9,6 +9,7 @@
- #include <linux/compiler.h>
- #include <linux/string.h>
- #include <linux/thread_info.h>
-+#include <linux/kernel.h>
- #include <asm/asi.h>
- #include <asm/system.h>
- #include <asm/spitfire.h>
-@@ -212,8 +213,15 @@ extern unsigned long copy_from_user_fixup(void *to, const void __user *from,
- static inline unsigned long __must_check
- copy_from_user(void *to, const void __user *from, unsigned long size)
- {
-- unsigned long ret = ___copy_from_user(to, from, size);
-+ unsigned long ret;
-
-+ if ((long)size < 0 || size > INT_MAX)
-+ return size;
-+
-+ if (!__builtin_constant_p(size))
-+ check_object_size(to, size, false);
-+
-+ ret = ___copy_from_user(to, from, size);
- if (unlikely(ret))
- ret = copy_from_user_fixup(to, from, size);
- return ret;
-@@ -228,8 +236,15 @@ extern unsigned long copy_to_user_fixup(void __user *to, const void *from,
- static inline unsigned long __must_check
- copy_to_user(void __user *to, const void *from, unsigned long size)
- {
-- unsigned long ret = ___copy_to_user(to, from, size);
-+ unsigned long ret;
-
-+ if ((long)size < 0 || size > INT_MAX)
-+ return size;
-+
-+ if (!__builtin_constant_p(size))
-+ check_object_size(from, size, true);
-+
-+ ret = ___copy_to_user(to, from, size);
- if (unlikely(ret))
- ret = copy_to_user_fixup(to, from, size);
- return ret;
-diff --git a/arch/sparc/kernel/Makefile b/arch/sparc/kernel/Makefile
-index 2782681..77ded84 100644
---- a/arch/sparc/kernel/Makefile
-+++ b/arch/sparc/kernel/Makefile
-@@ -3,7 +3,7 @@
- #
-
- asflags-y := -ansi
--ccflags-y := -Werror
-+#ccflags-y := -Werror
-
- extra-y := head_$(BITS).o
- extra-y += init_task.o
-diff --git a/arch/sparc/kernel/iommu.c b/arch/sparc/kernel/iommu.c
-index 7690cc2..ece64c9 100644
---- a/arch/sparc/kernel/iommu.c
-+++ b/arch/sparc/kernel/iommu.c
-@@ -826,7 +826,7 @@ static void dma_4u_sync_sg_for_cpu(struct device *dev,
- spin_unlock_irqrestore(&iommu->lock, flags);
- }
-
--static struct dma_map_ops sun4u_dma_ops = {
-+static const struct dma_map_ops sun4u_dma_ops = {
- .alloc_coherent = dma_4u_alloc_coherent,
- .free_coherent = dma_4u_free_coherent,
- .map_page = dma_4u_map_page,
-@@ -837,7 +837,7 @@ static struct dma_map_ops sun4u_dma_ops = {
- .sync_sg_for_cpu = dma_4u_sync_sg_for_cpu,
- };
-
--struct dma_map_ops *dma_ops = &sun4u_dma_ops;
-+const struct dma_map_ops *dma_ops = &sun4u_dma_ops;
- EXPORT_SYMBOL(dma_ops);
-
- extern int pci64_dma_supported(struct pci_dev *pdev, u64 device_mask);
-diff --git a/arch/sparc/kernel/ioport.c b/arch/sparc/kernel/ioport.c
-index 9f61fd8..bd048db 100644
---- a/arch/sparc/kernel/ioport.c
-+++ b/arch/sparc/kernel/ioport.c
-@@ -392,7 +392,7 @@ static void sbus_sync_sg_for_device(struct device *dev, struct scatterlist *sg,
- BUG();
- }
-
--struct dma_map_ops sbus_dma_ops = {
-+const struct dma_map_ops sbus_dma_ops = {
- .alloc_coherent = sbus_alloc_coherent,
- .free_coherent = sbus_free_coherent,
- .map_page = sbus_map_page,
-@@ -403,7 +403,7 @@ struct dma_map_ops sbus_dma_ops = {
- .sync_sg_for_device = sbus_sync_sg_for_device,
- };
-
--struct dma_map_ops *dma_ops = &sbus_dma_ops;
-+const struct dma_map_ops *dma_ops = &sbus_dma_ops;
- EXPORT_SYMBOL(dma_ops);
-
- static int __init sparc_register_ioport(void)
-@@ -640,7 +640,7 @@ static void pci32_sync_sg_for_device(struct device *device, struct scatterlist *
- }
- }
-
--struct dma_map_ops pci32_dma_ops = {
-+const struct dma_map_ops pci32_dma_ops = {
- .alloc_coherent = pci32_alloc_coherent,
- .free_coherent = pci32_free_coherent,
- .map_page = pci32_map_page,
-diff --git a/arch/sparc/kernel/kgdb_32.c b/arch/sparc/kernel/kgdb_32.c
-index 04df4ed..55c4b6e 100644
---- a/arch/sparc/kernel/kgdb_32.c
-+++ b/arch/sparc/kernel/kgdb_32.c
-@@ -158,7 +158,7 @@ void kgdb_arch_exit(void)
- {
- }
-
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- /* Breakpoint instruction: ta 0x7d */
- .gdb_bpt_instr = { 0x91, 0xd0, 0x20, 0x7d },
- };
-diff --git a/arch/sparc/kernel/kgdb_64.c b/arch/sparc/kernel/kgdb_64.c
-index f5a0fd4..d886f71 100644
---- a/arch/sparc/kernel/kgdb_64.c
-+++ b/arch/sparc/kernel/kgdb_64.c
-@@ -180,7 +180,7 @@ void kgdb_arch_exit(void)
- {
- }
-
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- /* Breakpoint instruction: ta 0x72 */
- .gdb_bpt_instr = { 0x91, 0xd0, 0x20, 0x72 },
- };
-diff --git a/arch/sparc/kernel/pci_sun4v.c b/arch/sparc/kernel/pci_sun4v.c
-index 23c33ff..d137fbd 100644
---- a/arch/sparc/kernel/pci_sun4v.c
-+++ b/arch/sparc/kernel/pci_sun4v.c
-@@ -525,7 +525,7 @@ static void dma_4v_unmap_sg(struct device *dev, struct scatterlist *sglist,
- spin_unlock_irqrestore(&iommu->lock, flags);
- }
-
--static struct dma_map_ops sun4v_dma_ops = {
-+static const struct dma_map_ops sun4v_dma_ops = {
- .alloc_coherent = dma_4v_alloc_coherent,
- .free_coherent = dma_4v_free_coherent,
- .map_page = dma_4v_map_page,
-diff --git a/arch/sparc/kernel/process_32.c b/arch/sparc/kernel/process_32.c
-index c49865b..b41a81b 100644
---- a/arch/sparc/kernel/process_32.c
-+++ b/arch/sparc/kernel/process_32.c
-@@ -196,7 +196,7 @@ void __show_backtrace(unsigned long fp)
- rw->ins[4], rw->ins[5],
- rw->ins[6],
- rw->ins[7]);
-- printk("%pS\n", (void *) rw->ins[7]);
-+ printk("%pA\n", (void *) rw->ins[7]);
- rw = (struct reg_window32 *) rw->ins[6];
- }
- spin_unlock_irqrestore(&sparc_backtrace_lock, flags);
-@@ -263,14 +263,14 @@ void show_regs(struct pt_regs *r)
-
- printk("PSR: %08lx PC: %08lx NPC: %08lx Y: %08lx %s\n",
- r->psr, r->pc, r->npc, r->y, print_tainted());
-- printk("PC: <%pS>\n", (void *) r->pc);
-+ printk("PC: <%pA>\n", (void *) r->pc);
- printk("%%G: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
- r->u_regs[0], r->u_regs[1], r->u_regs[2], r->u_regs[3],
- r->u_regs[4], r->u_regs[5], r->u_regs[6], r->u_regs[7]);
- printk("%%O: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
- r->u_regs[8], r->u_regs[9], r->u_regs[10], r->u_regs[11],
- r->u_regs[12], r->u_regs[13], r->u_regs[14], r->u_regs[15]);
-- printk("RPC: <%pS>\n", (void *) r->u_regs[15]);
-+ printk("RPC: <%pA>\n", (void *) r->u_regs[15]);
-
- printk("%%L: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
- rw->locals[0], rw->locals[1], rw->locals[2], rw->locals[3],
-@@ -305,7 +305,7 @@ void show_stack(struct task_struct *tsk, unsigned long *_ksp)
- rw = (struct reg_window32 *) fp;
- pc = rw->ins[7];
- printk("[%08lx : ", pc);
-- printk("%pS ] ", (void *) pc);
-+ printk("%pA ] ", (void *) pc);
- fp = rw->ins[6];
- } while (++count < 16);
- printk("\n");
-diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
-index cb70476..3d0c191 100644
---- a/arch/sparc/kernel/process_64.c
-+++ b/arch/sparc/kernel/process_64.c
-@@ -180,14 +180,14 @@ static void show_regwindow(struct pt_regs *regs)
- printk("i4: %016lx i5: %016lx i6: %016lx i7: %016lx\n",
- rwk->ins[4], rwk->ins[5], rwk->ins[6], rwk->ins[7]);
- if (regs->tstate & TSTATE_PRIV)
-- printk("I7: <%pS>\n", (void *) rwk->ins[7]);
-+ printk("I7: <%pA>\n", (void *) rwk->ins[7]);
- }
-
- void show_regs(struct pt_regs *regs)
- {
- printk("TSTATE: %016lx TPC: %016lx TNPC: %016lx Y: %08x %s\n", regs->tstate,
- regs->tpc, regs->tnpc, regs->y, print_tainted());
-- printk("TPC: <%pS>\n", (void *) regs->tpc);
-+ printk("TPC: <%pA>\n", (void *) regs->tpc);
- printk("g0: %016lx g1: %016lx g2: %016lx g3: %016lx\n",
- regs->u_regs[0], regs->u_regs[1], regs->u_regs[2],
- regs->u_regs[3]);
-@@ -200,7 +200,7 @@ void show_regs(struct pt_regs *regs)
- printk("o4: %016lx o5: %016lx sp: %016lx ret_pc: %016lx\n",
- regs->u_regs[12], regs->u_regs[13], regs->u_regs[14],
- regs->u_regs[15]);
-- printk("RPC: <%pS>\n", (void *) regs->u_regs[15]);
-+ printk("RPC: <%pA>\n", (void *) regs->u_regs[15]);
- show_regwindow(regs);
- }
-
-@@ -284,7 +284,7 @@ void arch_trigger_all_cpu_backtrace(void)
- ((tp && tp->task) ? tp->task->pid : -1));
-
- if (gp->tstate & TSTATE_PRIV) {
-- printk(" TPC[%pS] O7[%pS] I7[%pS] RPC[%pS]\n",
-+ printk(" TPC[%pA] O7[%pA] I7[%pA] RPC[%pA]\n",
- (void *) gp->tpc,
- (void *) gp->o7,
- (void *) gp->i7,
-diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c
-index 4ae91dc..c2e705e 100644
---- a/arch/sparc/kernel/ptrace_64.c
-+++ b/arch/sparc/kernel/ptrace_64.c
-@@ -1049,6 +1049,10 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
- return ret;
- }
-
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+extern void gr_delayed_cred_worker(void);
-+#endif
-+
- asmlinkage int syscall_trace_enter(struct pt_regs *regs)
- {
- int ret = 0;
-@@ -1056,6 +1060,11 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
- /* do the secure computing check first */
- secure_computing(regs->u_regs[UREG_G1]);
-
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+ if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
-+ gr_delayed_cred_worker();
-+#endif
-+
- if (test_thread_flag(TIF_SYSCALL_TRACE))
- ret = tracehook_report_syscall_entry(regs);
-
-@@ -1074,6 +1083,11 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
-
- asmlinkage void syscall_trace_leave(struct pt_regs *regs)
- {
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+ if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
-+ gr_delayed_cred_worker();
-+#endif
-+
- if (unlikely(current->audit_context)) {
- unsigned long tstate = regs->tstate;
- int result = AUDITSC_SUCCESS;
-diff --git a/arch/sparc/kernel/sigutil_64.c b/arch/sparc/kernel/sigutil_64.c
-index 6edc4e5..06a69b4 100644
---- a/arch/sparc/kernel/sigutil_64.c
-+++ b/arch/sparc/kernel/sigutil_64.c
-@@ -2,6 +2,7 @@
- #include <linux/types.h>
- #include <linux/thread_info.h>
- #include <linux/uaccess.h>
-+#include <linux/errno.h>
-
- #include <asm/sigcontext.h>
- #include <asm/fpumacro.h>
-diff --git a/arch/sparc/kernel/sys_sparc_32.c b/arch/sparc/kernel/sys_sparc_32.c
-index 3a82e65..ad9761e 100644
---- a/arch/sparc/kernel/sys_sparc_32.c
-+++ b/arch/sparc/kernel/sys_sparc_32.c
-@@ -40,6 +40,7 @@ asmlinkage unsigned long sys_getpagesize(void)
- unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsigned long len, unsigned long pgoff, unsigned long flags)
- {
- struct vm_area_struct * vmm;
-+ unsigned long offset = gr_rand_threadstack_offset(current->mm, filp, flags);
-
- if (flags & MAP_FIXED) {
- /* We do not accept a shared mapping if it would violate
-@@ -57,7 +58,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
- if (ARCH_SUN4C && len > 0x20000000)
- return -ENOMEM;
- if (!addr)
-- addr = TASK_UNMAPPED_BASE;
-+ addr = current->mm->mmap_base;
-
- if (flags & MAP_SHARED)
- addr = COLOUR_ALIGN(addr);
-@@ -72,7 +73,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
- }
- if (TASK_SIZE - PAGE_SIZE - len < addr)
- return -ENOMEM;
-- if (!vmm || addr + len <= vmm->vm_start)
-+ if (check_heap_stack_gap(vmm, addr, len, offset))
- return addr;
- addr = vmm->vm_end;
- if (flags & MAP_SHARED)
-diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
-index cfa0e19..6a250b0 100644
---- a/arch/sparc/kernel/sys_sparc_64.c
-+++ b/arch/sparc/kernel/sys_sparc_64.c
-@@ -120,12 +120,13 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
- unsigned long task_size = TASK_SIZE;
- unsigned long start_addr;
- int do_color_align;
-+ unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
-
- if (flags & MAP_FIXED) {
- /* We do not accept a shared mapping if it would violate
- * cache aliasing constraints.
- */
-- if ((flags & MAP_SHARED) &&
-+ if ((filp || (flags & MAP_SHARED)) &&
- ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
- return -EINVAL;
- return addr;
-@@ -140,6 +141,10 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
- if (filp || (flags & MAP_SHARED))
- do_color_align = 1;
-
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- if (addr) {
- if (do_color_align)
- addr = COLOUR_ALIGN(addr, pgoff);
-@@ -147,15 +152,14 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
- addr = PAGE_ALIGN(addr);
-
- vma = find_vma(mm, addr);
-- if (task_size - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-+ if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
- return addr;
- }
-
- if (len > mm->cached_hole_size) {
-- start_addr = addr = mm->free_area_cache;
-+ start_addr = addr = mm->free_area_cache;
- } else {
-- start_addr = addr = TASK_UNMAPPED_BASE;
-+ start_addr = addr = mm->mmap_base;
- mm->cached_hole_size = 0;
- }
-
-@@ -175,14 +179,14 @@ full_search:
- vma = find_vma(mm, VA_EXCLUDE_END);
- }
- if (unlikely(task_size < addr)) {
-- if (start_addr != TASK_UNMAPPED_BASE) {
-- start_addr = addr = TASK_UNMAPPED_BASE;
-+ if (start_addr != mm->mmap_base) {
-+ start_addr = addr = mm->mmap_base;
- mm->cached_hole_size = 0;
- goto full_search;
- }
- return -ENOMEM;
- }
-- if (likely(!vma || addr + len <= vma->vm_start)) {
-+ if (likely(check_heap_stack_gap(vma, addr, len, offset))) {
- /*
- * Remember the place where we stopped the search:
- */
-@@ -208,6 +212,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- unsigned long task_size = STACK_TOP32;
- unsigned long addr = addr0;
- int do_color_align;
-+ unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
-
- /* This should only ever run for 32-bit processes. */
- BUG_ON(!test_thread_flag(TIF_32BIT));
-@@ -216,7 +221,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- /* We do not accept a shared mapping if it would violate
- * cache aliasing constraints.
- */
-- if ((flags & MAP_SHARED) &&
-+ if ((filp || (flags & MAP_SHARED)) &&
- ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
- return -EINVAL;
- return addr;
-@@ -237,8 +242,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- addr = PAGE_ALIGN(addr);
-
- vma = find_vma(mm, addr);
-- if (task_size - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-+ if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
- return addr;
- }
-
-@@ -259,7 +263,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- /* make sure it can fit in the remaining address space */
- if (likely(addr > len)) {
- vma = find_vma(mm, addr-len);
-- if (!vma || addr <= vma->vm_start) {
-+ if (check_heap_stack_gap(vma, addr - len, len, offset)) {
- /* remember the address as a hint for next time */
- return (mm->free_area_cache = addr-len);
- }
-@@ -268,18 +272,18 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- if (unlikely(mm->mmap_base < len))
- goto bottomup;
-
-- addr = mm->mmap_base-len;
-- if (do_color_align)
-- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
-+ addr = mm->mmap_base - len;
-
- do {
-+ if (do_color_align)
-+ addr = COLOUR_ALIGN_DOWN(addr, pgoff);
- /*
- * Lookup failure means no vma is above this address,
- * else if new region fits below vma->vm_start,
- * return with success:
- */
- vma = find_vma(mm, addr);
-- if (likely(!vma || addr+len <= vma->vm_start)) {
-+ if (likely(check_heap_stack_gap(vma, addr, len, offset))) {
- /* remember the address as a hint for next time */
- return (mm->free_area_cache = addr);
- }
-@@ -289,10 +293,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- mm->cached_hole_size = vma->vm_start - addr;
-
- /* try just below the current vma->vm_start */
-- addr = vma->vm_start-len;
-- if (do_color_align)
-- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
-- } while (likely(len < vma->vm_start));
-+ addr = skip_heap_stack_gap(vma, len, offset);
-+ } while (!IS_ERR_VALUE(addr));
-
- bottomup:
- /*
-@@ -384,6 +386,12 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
- current->signal->rlim[RLIMIT_STACK].rlim_cur == RLIM_INFINITY ||
- sysctl_legacy_va_layout) {
- mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- mm->get_unmapped_area = arch_get_unmapped_area;
- mm->unmap_area = arch_unmap_area;
- } else {
-@@ -398,6 +406,12 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
- gap = (task_size / 6 * 5);
-
- mm->mmap_base = PAGE_ALIGN(task_size - gap - random_factor);
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
-+#endif
-+
- mm->get_unmapped_area = arch_get_unmapped_area_topdown;
- mm->unmap_area = arch_unmap_area_topdown;
- }
-diff --git a/arch/sparc/kernel/syscalls.S b/arch/sparc/kernel/syscalls.S
-index d150c2a..bffda9d 100644
---- a/arch/sparc/kernel/syscalls.S
-+++ b/arch/sparc/kernel/syscalls.S
-@@ -62,7 +62,7 @@ sys32_rt_sigreturn:
- #endif
- .align 32
- 1: ldx [%g6 + TI_FLAGS], %l5
-- andcc %l5, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT), %g0
-+ andcc %l5, _TIF_WORK_SYSCALL, %g0
- be,pt %icc, rtrap
- nop
- call syscall_trace_leave
-@@ -198,7 +198,7 @@ linux_sparc_syscall32:
-
- srl %i5, 0, %o5 ! IEU1
- srl %i2, 0, %o2 ! IEU0 Group
-- andcc %l0, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT), %g0
-+ andcc %l0, _TIF_WORK_SYSCALL, %g0
- bne,pn %icc, linux_syscall_trace32 ! CTI
- mov %i0, %l5 ! IEU1
- call %l7 ! CTI Group brk forced
-@@ -221,7 +221,7 @@ linux_sparc_syscall:
-
- mov %i3, %o3 ! IEU1
- mov %i4, %o4 ! IEU0 Group
-- andcc %l0, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT), %g0
-+ andcc %l0, _TIF_WORK_SYSCALL, %g0
- bne,pn %icc, linux_syscall_trace ! CTI Group
- mov %i0, %l5 ! IEU0
- 2: call %l7 ! CTI Group brk forced
-@@ -245,7 +245,7 @@ ret_sys_call:
-
- cmp %o0, -ERESTART_RESTARTBLOCK
- bgeu,pn %xcc, 1f
-- andcc %l0, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT), %l6
-+ andcc %l0, _TIF_WORK_SYSCALL, %l6
- 80:
- /* System call success, clear Carry condition code. */
- andn %g3, %g2, %g3
-@@ -260,7 +260,7 @@ ret_sys_call:
- /* System call failure, set Carry condition code.
- * Also, get abs(errno) to return to the process.
- */
-- andcc %l0, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT), %l6
-+ andcc %l0, _TIF_WORK_SYSCALL, %l6
- sub %g0, %o0, %o0
- or %g3, %g2, %g3
- stx %o0, [%sp + PTREGS_OFF + PT_V9_I0]
-diff --git a/arch/sparc/kernel/traps_32.c b/arch/sparc/kernel/traps_32.c
-index c0490c7..84959d1 100644
---- a/arch/sparc/kernel/traps_32.c
-+++ b/arch/sparc/kernel/traps_32.c
-@@ -44,6 +44,8 @@ static void instruction_dump(unsigned long *pc)
- #define __SAVE __asm__ __volatile__("save %sp, -0x40, %sp\n\t")
- #define __RESTORE __asm__ __volatile__("restore %g0, %g0, %g0\n\t")
-
-+extern void gr_handle_kernel_exploit(void);
-+
- void die_if_kernel(char *str, struct pt_regs *regs)
- {
- static int die_counter;
-@@ -76,15 +78,17 @@ void die_if_kernel(char *str, struct pt_regs *regs)
- count++ < 30 &&
- (((unsigned long) rw) >= PAGE_OFFSET) &&
- !(((unsigned long) rw) & 0x7)) {
-- printk("Caller[%08lx]: %pS\n", rw->ins[7],
-+ printk("Caller[%08lx]: %pA\n", rw->ins[7],
- (void *) rw->ins[7]);
- rw = (struct reg_window32 *)rw->ins[6];
- }
- }
- printk("Instruction DUMP:");
- instruction_dump ((unsigned long *) regs->pc);
-- if(regs->psr & PSR_PS)
-+ if(regs->psr & PSR_PS) {
-+ gr_handle_kernel_exploit();
- do_exit(SIGKILL);
-+ }
- do_exit(SIGSEGV);
- }
-
-diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c
-index 10f7bb9..cdb6793 100644
---- a/arch/sparc/kernel/traps_64.c
-+++ b/arch/sparc/kernel/traps_64.c
-@@ -73,7 +73,7 @@ static void dump_tl1_traplog(struct tl1_traplog *p)
- i + 1,
- p->trapstack[i].tstate, p->trapstack[i].tpc,
- p->trapstack[i].tnpc, p->trapstack[i].tt);
-- printk("TRAPLOG: TPC<%pS>\n", (void *) p->trapstack[i].tpc);
-+ printk("TRAPLOG: TPC<%pA>\n", (void *) p->trapstack[i].tpc);
- }
- }
-
-@@ -93,6 +93,12 @@ void bad_trap(struct pt_regs *regs, long lvl)
-
- lvl -= 0x100;
- if (regs->tstate & TSTATE_PRIV) {
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ if (lvl == 6)
-+ pax_report_refcount_overflow(regs);
-+#endif
-+
- sprintf(buffer, "Kernel bad sw trap %lx", lvl);
- die_if_kernel(buffer, regs);
- }
-@@ -111,11 +117,16 @@ void bad_trap(struct pt_regs *regs, long lvl)
- void bad_trap_tl1(struct pt_regs *regs, long lvl)
- {
- char buffer[32];
--
-+
- if (notify_die(DIE_TRAP_TL1, "bad trap tl1", regs,
- 0, lvl, SIGTRAP) == NOTIFY_STOP)
- return;
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+ if (lvl == 6)
-+ pax_report_refcount_overflow(regs);
-+#endif
-+
- dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
-
- sprintf (buffer, "Bad trap %lx at tl>0", lvl);
-@@ -1139,7 +1150,7 @@ static void cheetah_log_errors(struct pt_regs *regs, struct cheetah_err_info *in
- regs->tpc, regs->tnpc, regs->u_regs[UREG_I7], regs->tstate);
- printk("%s" "ERROR(%d): ",
- (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id());
-- printk("TPC<%pS>\n", (void *) regs->tpc);
-+ printk("TPC<%pA>\n", (void *) regs->tpc);
- printk("%s" "ERROR(%d): M_SYND(%lx), E_SYND(%lx)%s%s\n",
- (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id(),
- (afsr & CHAFSR_M_SYNDROME) >> CHAFSR_M_SYNDROME_SHIFT,
-@@ -1746,7 +1757,7 @@ void cheetah_plus_parity_error(int type, struct pt_regs *regs)
- smp_processor_id(),
- (type & 0x1) ? 'I' : 'D',
- regs->tpc);
-- printk(KERN_EMERG "TPC<%pS>\n", (void *) regs->tpc);
-+ printk(KERN_EMERG "TPC<%pA>\n", (void *) regs->tpc);
- panic("Irrecoverable Cheetah+ parity error.");
- }
-
-@@ -1754,7 +1765,7 @@ void cheetah_plus_parity_error(int type, struct pt_regs *regs)
- smp_processor_id(),
- (type & 0x1) ? 'I' : 'D',
- regs->tpc);
-- printk(KERN_WARNING "TPC<%pS>\n", (void *) regs->tpc);
-+ printk(KERN_WARNING "TPC<%pA>\n", (void *) regs->tpc);
- }
-
- struct sun4v_error_entry {
-@@ -1961,9 +1972,9 @@ void sun4v_itlb_error_report(struct pt_regs *regs, int tl)
-
- printk(KERN_EMERG "SUN4V-ITLB: Error at TPC[%lx], tl %d\n",
- regs->tpc, tl);
-- printk(KERN_EMERG "SUN4V-ITLB: TPC<%pS>\n", (void *) regs->tpc);
-+ printk(KERN_EMERG "SUN4V-ITLB: TPC<%pA>\n", (void *) regs->tpc);
- printk(KERN_EMERG "SUN4V-ITLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
-- printk(KERN_EMERG "SUN4V-ITLB: O7<%pS>\n",
-+ printk(KERN_EMERG "SUN4V-ITLB: O7<%pA>\n",
- (void *) regs->u_regs[UREG_I7]);
- printk(KERN_EMERG "SUN4V-ITLB: vaddr[%lx] ctx[%lx] "
- "pte[%lx] error[%lx]\n",
-@@ -1985,9 +1996,9 @@ void sun4v_dtlb_error_report(struct pt_regs *regs, int tl)
-
- printk(KERN_EMERG "SUN4V-DTLB: Error at TPC[%lx], tl %d\n",
- regs->tpc, tl);
-- printk(KERN_EMERG "SUN4V-DTLB: TPC<%pS>\n", (void *) regs->tpc);
-+ printk(KERN_EMERG "SUN4V-DTLB: TPC<%pA>\n", (void *) regs->tpc);
- printk(KERN_EMERG "SUN4V-DTLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
-- printk(KERN_EMERG "SUN4V-DTLB: O7<%pS>\n",
-+ printk(KERN_EMERG "SUN4V-DTLB: O7<%pA>\n",
- (void *) regs->u_regs[UREG_I7]);
- printk(KERN_EMERG "SUN4V-DTLB: vaddr[%lx] ctx[%lx] "
- "pte[%lx] error[%lx]\n",
-@@ -2191,7 +2202,7 @@ void show_stack(struct task_struct *tsk, unsigned long *_ksp)
- fp = (unsigned long)sf->fp + STACK_BIAS;
- }
-
-- printk(" [%016lx] %pS\n", pc, (void *) pc);
-+ printk(" [%016lx] %pA\n", pc, (void *) pc);
- } while (++count < 16);
- }
-
-@@ -2233,6 +2244,8 @@ static inline struct reg_window *kernel_stack_up(struct reg_window *rw)
- return (struct reg_window *) (fp + STACK_BIAS);
- }
-
-+extern void gr_handle_kernel_exploit(void);
-+
- void die_if_kernel(char *str, struct pt_regs *regs)
- {
- static int die_counter;
-@@ -2260,7 +2273,7 @@ void die_if_kernel(char *str, struct pt_regs *regs)
- while (rw &&
- count++ < 30&&
- is_kernel_stack(current, rw)) {
-- printk("Caller[%016lx]: %pS\n", rw->ins[7],
-+ printk("Caller[%016lx]: %pA\n", rw->ins[7],
- (void *) rw->ins[7]);
-
- rw = kernel_stack_up(rw);
-@@ -2273,8 +2286,11 @@ void die_if_kernel(char *str, struct pt_regs *regs)
- }
- user_instruction_dump ((unsigned int __user *) regs->tpc);
- }
-- if (regs->tstate & TSTATE_PRIV)
-+ if (regs->tstate & TSTATE_PRIV) {
-+ gr_handle_kernel_exploit();
- do_exit(SIGKILL);
-+ }
-+
- do_exit(SIGSEGV);
- }
- EXPORT_SYMBOL(die_if_kernel);
-diff --git a/arch/sparc/kernel/una_asm_64.S b/arch/sparc/kernel/una_asm_64.S
-index be183fe..1c8d332 100644
---- a/arch/sparc/kernel/una_asm_64.S
-+++ b/arch/sparc/kernel/una_asm_64.S
-@@ -127,7 +127,7 @@ do_int_load:
- wr %o5, 0x0, %asi
- retl
- mov 0, %o0
-- .size __do_int_load, .-__do_int_load
-+ .size do_int_load, .-do_int_load
-
- .section __ex_table,"a"
- .word 4b, __retl_efault
-diff --git a/arch/sparc/kernel/unaligned_64.c b/arch/sparc/kernel/unaligned_64.c
-index 3792099..2af17d8 100644
---- a/arch/sparc/kernel/unaligned_64.c
-+++ b/arch/sparc/kernel/unaligned_64.c
-@@ -288,7 +288,7 @@ static void log_unaligned(struct pt_regs *regs)
- if (count < 5) {
- last_time = jiffies;
- count++;
-- printk("Kernel unaligned access at TPC[%lx] %pS\n",
-+ printk("Kernel unaligned access at TPC[%lx] %pA\n",
- regs->tpc, (void *) regs->tpc);
- }
- }
-diff --git a/arch/sparc/lib/Makefile b/arch/sparc/lib/Makefile
-index e75faf0..24f12f9 100644
---- a/arch/sparc/lib/Makefile
-+++ b/arch/sparc/lib/Makefile
-@@ -2,7 +2,7 @@
- #
-
- asflags-y := -ansi -DST_DIV0=0x02
--ccflags-y := -Werror
-+#ccflags-y := -Werror
-
- lib-$(CONFIG_SPARC32) += mul.o rem.o sdiv.o udiv.o umul.o urem.o ashrdi3.o
- lib-$(CONFIG_SPARC32) += memcpy.o memset.o
-diff --git a/arch/sparc/lib/atomic_64.S b/arch/sparc/lib/atomic_64.S
-index 0268210..f0291ca 100644
---- a/arch/sparc/lib/atomic_64.S
-+++ b/arch/sparc/lib/atomic_64.S
-@@ -18,7 +18,12 @@
- atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
- BACKOFF_SETUP(%o2)
- 1: lduw [%o1], %g1
-- add %g1, %o0, %g7
-+ addcc %g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %icc, 6
-+#endif
-+
- cas [%o1], %g1, %g7
- cmp %g1, %g7
- bne,pn %icc, 2f
-@@ -28,12 +33,32 @@ atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
- 2: BACKOFF_SPIN(%o2, %o3, 1b)
- .size atomic_add, .-atomic_add
-
-+ .globl atomic_add_unchecked
-+ .type atomic_add_unchecked,#function
-+atomic_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
-+ BACKOFF_SETUP(%o2)
-+1: lduw [%o1], %g1
-+ add %g1, %o0, %g7
-+ cas [%o1], %g1, %g7
-+ cmp %g1, %g7
-+ bne,pn %icc, 2f
-+ nop
-+ retl
-+ nop
-+2: BACKOFF_SPIN(%o2, %o3, 1b)
-+ .size atomic_add_unchecked, .-atomic_add_unchecked
-+
- .globl atomic_sub
- .type atomic_sub,#function
- atomic_sub: /* %o0 = decrement, %o1 = atomic_ptr */
- BACKOFF_SETUP(%o2)
- 1: lduw [%o1], %g1
-- sub %g1, %o0, %g7
-+ subcc %g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %icc, 6
-+#endif
-+
- cas [%o1], %g1, %g7
- cmp %g1, %g7
- bne,pn %icc, 2f
-@@ -43,12 +68,32 @@ atomic_sub: /* %o0 = decrement, %o1 = atomic_ptr */
- 2: BACKOFF_SPIN(%o2, %o3, 1b)
- .size atomic_sub, .-atomic_sub
-
-+ .globl atomic_sub_unchecked
-+ .type atomic_sub_unchecked,#function
-+atomic_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
-+ BACKOFF_SETUP(%o2)
-+1: lduw [%o1], %g1
-+ sub %g1, %o0, %g7
-+ cas [%o1], %g1, %g7
-+ cmp %g1, %g7
-+ bne,pn %icc, 2f
-+ nop
-+ retl
-+ nop
-+2: BACKOFF_SPIN(%o2, %o3, 1b)
-+ .size atomic_sub_unchecked, .-atomic_sub_unchecked
-+
- .globl atomic_add_ret
- .type atomic_add_ret,#function
- atomic_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
- BACKOFF_SETUP(%o2)
- 1: lduw [%o1], %g1
-- add %g1, %o0, %g7
-+ addcc %g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %icc, 6
-+#endif
-+
- cas [%o1], %g1, %g7
- cmp %g1, %g7
- bne,pn %icc, 2f
-@@ -59,12 +104,33 @@ atomic_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
- 2: BACKOFF_SPIN(%o2, %o3, 1b)
- .size atomic_add_ret, .-atomic_add_ret
-
-+ .globl atomic_add_ret_unchecked
-+ .type atomic_add_ret_unchecked,#function
-+atomic_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
-+ BACKOFF_SETUP(%o2)
-+1: lduw [%o1], %g1
-+ addcc %g1, %o0, %g7
-+ cas [%o1], %g1, %g7
-+ cmp %g1, %g7
-+ bne,pn %icc, 2f
-+ add %g7, %o0, %g7
-+ sra %g7, 0, %o0
-+ retl
-+ nop
-+2: BACKOFF_SPIN(%o2, %o3, 1b)
-+ .size atomic_add_ret_unchecked, .-atomic_add_ret_unchecked
-+
- .globl atomic_sub_ret
- .type atomic_sub_ret,#function
- atomic_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
- BACKOFF_SETUP(%o2)
- 1: lduw [%o1], %g1
-- sub %g1, %o0, %g7
-+ subcc %g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %icc, 6
-+#endif
-+
- cas [%o1], %g1, %g7
- cmp %g1, %g7
- bne,pn %icc, 2f
-@@ -80,7 +146,12 @@ atomic_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
- atomic64_add: /* %o0 = increment, %o1 = atomic_ptr */
- BACKOFF_SETUP(%o2)
- 1: ldx [%o1], %g1
-- add %g1, %o0, %g7
-+ addcc %g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %xcc, 6
-+#endif
-+
- casx [%o1], %g1, %g7
- cmp %g1, %g7
- bne,pn %xcc, 2f
-@@ -90,12 +161,32 @@ atomic64_add: /* %o0 = increment, %o1 = atomic_ptr */
- 2: BACKOFF_SPIN(%o2, %o3, 1b)
- .size atomic64_add, .-atomic64_add
-
-+ .globl atomic64_add_unchecked
-+ .type atomic64_add_unchecked,#function
-+atomic64_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
-+ BACKOFF_SETUP(%o2)
-+1: ldx [%o1], %g1
-+ addcc %g1, %o0, %g7
-+ casx [%o1], %g1, %g7
-+ cmp %g1, %g7
-+ bne,pn %xcc, 2f
-+ nop
-+ retl
-+ nop
-+2: BACKOFF_SPIN(%o2, %o3, 1b)
-+ .size atomic64_add_unchecked, .-atomic64_add_unchecked
-+
- .globl atomic64_sub
- .type atomic64_sub,#function
- atomic64_sub: /* %o0 = decrement, %o1 = atomic_ptr */
- BACKOFF_SETUP(%o2)
- 1: ldx [%o1], %g1
-- sub %g1, %o0, %g7
-+ subcc %g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %xcc, 6
-+#endif
-+
- casx [%o1], %g1, %g7
- cmp %g1, %g7
- bne,pn %xcc, 2f
-@@ -105,12 +196,32 @@ atomic64_sub: /* %o0 = decrement, %o1 = atomic_ptr */
- 2: BACKOFF_SPIN(%o2, %o3, 1b)
- .size atomic64_sub, .-atomic64_sub
-
-+ .globl atomic64_sub_unchecked
-+ .type atomic64_sub_unchecked,#function
-+atomic64_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
-+ BACKOFF_SETUP(%o2)
-+1: ldx [%o1], %g1
-+ subcc %g1, %o0, %g7
-+ casx [%o1], %g1, %g7
-+ cmp %g1, %g7
-+ bne,pn %xcc, 2f
-+ nop
-+ retl
-+ nop
-+2: BACKOFF_SPIN(%o2, %o3, 1b)
-+ .size atomic64_sub_unchecked, .-atomic64_sub_unchecked
-+
- .globl atomic64_add_ret
- .type atomic64_add_ret,#function
- atomic64_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
- BACKOFF_SETUP(%o2)
- 1: ldx [%o1], %g1
-- add %g1, %o0, %g7
-+ addcc %g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %xcc, 6
-+#endif
-+
- casx [%o1], %g1, %g7
- cmp %g1, %g7
- bne,pn %xcc, 2f
-@@ -121,12 +232,33 @@ atomic64_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
- 2: BACKOFF_SPIN(%o2, %o3, 1b)
- .size atomic64_add_ret, .-atomic64_add_ret
-
-+ .globl atomic64_add_ret_unchecked
-+ .type atomic64_add_ret_unchecked,#function
-+atomic64_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
-+ BACKOFF_SETUP(%o2)
-+1: ldx [%o1], %g1
-+ addcc %g1, %o0, %g7
-+ casx [%o1], %g1, %g7
-+ cmp %g1, %g7
-+ bne,pn %xcc, 2f
-+ add %g7, %o0, %g7
-+ mov %g7, %o0
-+ retl
-+ nop
-+2: BACKOFF_SPIN(%o2, %o3, 1b)
-+ .size atomic64_add_ret_unchecked, .-atomic64_add_ret_unchecked
-+
- .globl atomic64_sub_ret
- .type atomic64_sub_ret,#function
- atomic64_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
- BACKOFF_SETUP(%o2)
- 1: ldx [%o1], %g1
-- sub %g1, %o0, %g7
-+ subcc %g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %xcc, 6
-+#endif
-+
- casx [%o1], %g1, %g7
- cmp %g1, %g7
- bne,pn %xcc, 2f
-diff --git a/arch/sparc/lib/ksyms.c b/arch/sparc/lib/ksyms.c
-index 704b126..2e79d76 100644
---- a/arch/sparc/lib/ksyms.c
-+++ b/arch/sparc/lib/ksyms.c
-@@ -144,12 +144,18 @@ EXPORT_SYMBOL(__downgrade_write);
-
- /* Atomic counter implementation. */
- EXPORT_SYMBOL(atomic_add);
-+EXPORT_SYMBOL(atomic_add_unchecked);
- EXPORT_SYMBOL(atomic_add_ret);
-+EXPORT_SYMBOL(atomic_add_ret_unchecked);
- EXPORT_SYMBOL(atomic_sub);
-+EXPORT_SYMBOL(atomic_sub_unchecked);
- EXPORT_SYMBOL(atomic_sub_ret);
- EXPORT_SYMBOL(atomic64_add);
-+EXPORT_SYMBOL(atomic64_add_unchecked);
- EXPORT_SYMBOL(atomic64_add_ret);
-+EXPORT_SYMBOL(atomic64_add_ret_unchecked);
- EXPORT_SYMBOL(atomic64_sub);
-+EXPORT_SYMBOL(atomic64_sub_unchecked);
- EXPORT_SYMBOL(atomic64_sub_ret);
-
- /* Atomic bit operations. */
-diff --git a/arch/sparc/lib/rwsem_64.S b/arch/sparc/lib/rwsem_64.S
-index 91a7d29..ce75c29 100644
---- a/arch/sparc/lib/rwsem_64.S
-+++ b/arch/sparc/lib/rwsem_64.S
-@@ -11,7 +11,12 @@
- .globl __down_read
- __down_read:
- 1: lduw [%o0], %g1
-- add %g1, 1, %g7
-+ addcc %g1, 1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %icc, 6
-+#endif
-+
- cas [%o0], %g1, %g7
- cmp %g1, %g7
- bne,pn %icc, 1b
-@@ -33,7 +38,12 @@ __down_read:
- .globl __down_read_trylock
- __down_read_trylock:
- 1: lduw [%o0], %g1
-- add %g1, 1, %g7
-+ addcc %g1, 1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %icc, 6
-+#endif
-+
- cmp %g7, 0
- bl,pn %icc, 2f
- mov 0, %o1
-@@ -51,7 +61,12 @@ __down_write:
- or %g1, %lo(RWSEM_ACTIVE_WRITE_BIAS), %g1
- 1:
- lduw [%o0], %g3
-- add %g3, %g1, %g7
-+ addcc %g3, %g1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %icc, 6
-+#endif
-+
- cas [%o0], %g3, %g7
- cmp %g3, %g7
- bne,pn %icc, 1b
-@@ -77,7 +92,12 @@ __down_write_trylock:
- cmp %g3, 0
- bne,pn %icc, 2f
- mov 0, %o1
-- add %g3, %g1, %g7
-+ addcc %g3, %g1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %icc, 6
-+#endif
-+
- cas [%o0], %g3, %g7
- cmp %g3, %g7
- bne,pn %icc, 1b
-@@ -90,7 +110,12 @@ __down_write_trylock:
- __up_read:
- 1:
- lduw [%o0], %g1
-- sub %g1, 1, %g7
-+ subcc %g1, 1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %icc, 6
-+#endif
-+
- cas [%o0], %g1, %g7
- cmp %g1, %g7
- bne,pn %icc, 1b
-@@ -118,7 +143,12 @@ __up_write:
- or %g1, %lo(RWSEM_ACTIVE_WRITE_BIAS), %g1
- 1:
- lduw [%o0], %g3
-- sub %g3, %g1, %g7
-+ subcc %g3, %g1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %icc, 6
-+#endif
-+
- cas [%o0], %g3, %g7
- cmp %g3, %g7
- bne,pn %icc, 1b
-@@ -143,7 +173,12 @@ __downgrade_write:
- or %g1, %lo(RWSEM_WAITING_BIAS), %g1
- 1:
- lduw [%o0], %g3
-- sub %g3, %g1, %g7
-+ subcc %g3, %g1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %icc, 6
-+#endif
-+
- cas [%o0], %g3, %g7
- cmp %g3, %g7
- bne,pn %icc, 1b
-diff --git a/arch/sparc/mm/Makefile b/arch/sparc/mm/Makefile
-index 79836a7..62f47a2 100644
---- a/arch/sparc/mm/Makefile
-+++ b/arch/sparc/mm/Makefile
-@@ -2,7 +2,7 @@
- #
-
- asflags-y := -ansi
--ccflags-y := -Werror
-+#ccflags-y := -Werror
-
- obj-$(CONFIG_SPARC64) += ultra.o tlb.o tsb.o
- obj-y += fault_$(BITS).o
-diff --git a/arch/sparc/mm/fault_32.c b/arch/sparc/mm/fault_32.c
-index b99f81c..0a112f6 100644
---- a/arch/sparc/mm/fault_32.c
-+++ b/arch/sparc/mm/fault_32.c
-@@ -21,6 +21,9 @@
- #include <linux/interrupt.h>
- #include <linux/module.h>
- #include <linux/kdebug.h>
-+#include <linux/slab.h>
-+#include <linux/pagemap.h>
-+#include <linux/compiler.h>
-
- #include <asm/system.h>
- #include <asm/page.h>
-@@ -167,6 +170,276 @@ static unsigned long compute_si_addr(struct pt_regs *regs, int text_fault)
- return safe_compute_effective_address(regs, insn);
- }
-
-+#ifdef CONFIG_PAX_PAGEEXEC
-+#ifdef CONFIG_PAX_DLRESOLVE
-+static void pax_emuplt_close(struct vm_area_struct *vma)
-+{
-+ vma->vm_mm->call_dl_resolve = 0UL;
-+}
-+
-+static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
-+{
-+ unsigned int *kaddr;
-+
-+ vmf->page = alloc_page(GFP_HIGHUSER);
-+ if (!vmf->page)
-+ return VM_FAULT_OOM;
-+
-+ kaddr = kmap(vmf->page);
-+ memset(kaddr, 0, PAGE_SIZE);
-+ kaddr[0] = 0x9DE3BFA8U; /* save */
-+ flush_dcache_page(vmf->page);
-+ kunmap(vmf->page);
-+ return VM_FAULT_MAJOR;
-+}
-+
-+static const struct vm_operations_struct pax_vm_ops = {
-+ .close = pax_emuplt_close,
-+ .fault = pax_emuplt_fault
-+};
-+
-+static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
-+{
-+ int ret;
-+
-+ vma->vm_mm = current->mm;
-+ vma->vm_start = addr;
-+ vma->vm_end = addr + PAGE_SIZE;
-+ vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
-+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
-+ vma->vm_ops = &pax_vm_ops;
-+
-+ ret = insert_vm_struct(current->mm, vma);
-+ if (ret)
-+ return ret;
-+
-+ ++current->mm->total_vm;
-+ return 0;
-+}
-+#endif
-+
-+/*
-+ * PaX: decide what to do with offenders (regs->pc = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ * 2 when patched PLT trampoline was detected
-+ * 3 when unpatched PLT trampoline was detected
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+ int err;
-+
-+ do { /* PaX: patched PLT emulation #1 */
-+ unsigned int sethi1, sethi2, jmpl;
-+
-+ err = get_user(sethi1, (unsigned int *)regs->pc);
-+ err |= get_user(sethi2, (unsigned int *)(regs->pc+4));
-+ err |= get_user(jmpl, (unsigned int *)(regs->pc+8));
-+
-+ if (err)
-+ break;
-+
-+ if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
-+ (sethi2 & 0xFFC00000U) == 0x03000000U &&
-+ (jmpl & 0xFFFFE000U) == 0x81C06000U)
-+ {
-+ unsigned int addr;
-+
-+ regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
-+ addr = regs->u_regs[UREG_G1];
-+ addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
-+ regs->pc = addr;
-+ regs->npc = addr+4;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: patched PLT emulation #2 */
-+ unsigned int ba;
-+
-+ err = get_user(ba, (unsigned int *)regs->pc);
-+
-+ if (err)
-+ break;
-+
-+ if ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30480000U) {
-+ unsigned int addr;
-+
-+ if ((ba & 0xFFC00000U) == 0x30800000U)
-+ addr = regs->pc + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
-+ else
-+ addr = regs->pc + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
-+ regs->pc = addr;
-+ regs->npc = addr+4;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: patched PLT emulation #3 */
-+ unsigned int sethi, bajmpl, nop;
-+
-+ err = get_user(sethi, (unsigned int *)regs->pc);
-+ err |= get_user(bajmpl, (unsigned int *)(regs->pc+4));
-+ err |= get_user(nop, (unsigned int *)(regs->pc+8));
-+
-+ if (err)
-+ break;
-+
-+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+ ((bajmpl & 0xFFFFE000U) == 0x81C06000U || (bajmpl & 0xFFF80000U) == 0x30480000U) &&
-+ nop == 0x01000000U)
-+ {
-+ unsigned int addr;
-+
-+ addr = (sethi & 0x003FFFFFU) << 10;
-+ regs->u_regs[UREG_G1] = addr;
-+ if ((bajmpl & 0xFFFFE000U) == 0x81C06000U)
-+ addr += (((bajmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
-+ else
-+ addr = regs->pc + ((((bajmpl | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
-+ regs->pc = addr;
-+ regs->npc = addr+4;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: unpatched PLT emulation step 1 */
-+ unsigned int sethi, ba, nop;
-+
-+ err = get_user(sethi, (unsigned int *)regs->pc);
-+ err |= get_user(ba, (unsigned int *)(regs->pc+4));
-+ err |= get_user(nop, (unsigned int *)(regs->pc+8));
-+
-+ if (err)
-+ break;
-+
-+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+ ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
-+ nop == 0x01000000U)
-+ {
-+ unsigned int addr, save, call;
-+
-+ if ((ba & 0xFFC00000U) == 0x30800000U)
-+ addr = regs->pc + 4 + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
-+ else
-+ addr = regs->pc + 4 + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
-+
-+ err = get_user(save, (unsigned int *)addr);
-+ err |= get_user(call, (unsigned int *)(addr+4));
-+ err |= get_user(nop, (unsigned int *)(addr+8));
-+ if (err)
-+ break;
-+
-+#ifdef CONFIG_PAX_DLRESOLVE
-+ if (save == 0x9DE3BFA8U &&
-+ (call & 0xC0000000U) == 0x40000000U &&
-+ nop == 0x01000000U)
-+ {
-+ struct vm_area_struct *vma;
-+ unsigned long call_dl_resolve;
-+
-+ down_read(¤t->mm->mmap_sem);
-+ call_dl_resolve = current->mm->call_dl_resolve;
-+ up_read(¤t->mm->mmap_sem);
-+ if (likely(call_dl_resolve))
-+ goto emulate;
-+
-+ vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
-+
-+ down_write(¤t->mm->mmap_sem);
-+ if (current->mm->call_dl_resolve) {
-+ call_dl_resolve = current->mm->call_dl_resolve;
-+ up_write(¤t->mm->mmap_sem);
-+ if (vma)
-+ kmem_cache_free(vm_area_cachep, vma);
-+ goto emulate;
-+ }
-+
-+ call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
-+ if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
-+ up_write(¤t->mm->mmap_sem);
-+ if (vma)
-+ kmem_cache_free(vm_area_cachep, vma);
-+ return 1;
-+ }
-+
-+ if (pax_insert_vma(vma, call_dl_resolve)) {
-+ up_write(¤t->mm->mmap_sem);
-+ kmem_cache_free(vm_area_cachep, vma);
-+ return 1;
-+ }
-+
-+ current->mm->call_dl_resolve = call_dl_resolve;
-+ up_write(¤t->mm->mmap_sem);
-+
-+emulate:
-+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
-+ regs->pc = call_dl_resolve;
-+ regs->npc = addr+4;
-+ return 3;
-+ }
-+#endif
-+
-+ /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
-+ if ((save & 0xFFC00000U) == 0x05000000U &&
-+ (call & 0xFFFFE000U) == 0x85C0A000U &&
-+ nop == 0x01000000U)
-+ {
-+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
-+ regs->u_regs[UREG_G2] = addr + 4;
-+ addr = (save & 0x003FFFFFU) << 10;
-+ addr += (((call | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
-+ regs->pc = addr;
-+ regs->npc = addr+4;
-+ return 3;
-+ }
-+ }
-+ } while (0);
-+
-+ do { /* PaX: unpatched PLT emulation step 2 */
-+ unsigned int save, call, nop;
-+
-+ err = get_user(save, (unsigned int *)(regs->pc-4));
-+ err |= get_user(call, (unsigned int *)regs->pc);
-+ err |= get_user(nop, (unsigned int *)(regs->pc+4));
-+ if (err)
-+ break;
-+
-+ if (save == 0x9DE3BFA8U &&
-+ (call & 0xC0000000U) == 0x40000000U &&
-+ nop == 0x01000000U)
-+ {
-+ unsigned int dl_resolve = regs->pc + ((((call | 0xC0000000U) ^ 0x20000000U) + 0x20000000U) << 2);
-+
-+ regs->u_regs[UREG_RETPC] = regs->pc;
-+ regs->pc = dl_resolve;
-+ regs->npc = dl_resolve+4;
-+ return 3;
-+ }
-+ } while (0);
-+#endif
-+
-+ return 1;
-+}
-+
-+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
-+{
-+ unsigned long i;
-+
-+ printk(KERN_ERR "PAX: bytes at PC: ");
-+ for (i = 0; i < 8; i++) {
-+ unsigned int c;
-+ if (get_user(c, (unsigned int *)pc+i))
-+ printk(KERN_CONT "???????? ");
-+ else
-+ printk(KERN_CONT "%08x ", c);
-+ }
-+ printk("\n");
-+}
-+#endif
-+
- asmlinkage void do_sparc_fault(struct pt_regs *regs, int text_fault, int write,
- unsigned long address)
- {
-@@ -231,6 +504,24 @@ good_area:
- if(!(vma->vm_flags & VM_WRITE))
- goto bad_area;
- } else {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && text_fault && !(vma->vm_flags & VM_EXEC)) {
-+ up_read(&mm->mmap_sem);
-+ switch (pax_handle_fetch_fault(regs)) {
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+ case 2:
-+ case 3:
-+ return;
-+#endif
-+
-+ }
-+ pax_report_fault(regs, (void *)regs->pc, (void *)regs->u_regs[UREG_FP]);
-+ do_group_exit(SIGKILL);
-+ }
-+#endif
-+
- /* Allow reads even for write-only mappings */
- if(!(vma->vm_flags & (VM_READ | VM_EXEC)))
- goto bad_area;
-diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c
-index 43b0da9..f9f9985 100644
---- a/arch/sparc/mm/fault_64.c
-+++ b/arch/sparc/mm/fault_64.c
-@@ -20,6 +20,9 @@
- #include <linux/kprobes.h>
- #include <linux/kdebug.h>
- #include <linux/percpu.h>
-+#include <linux/slab.h>
-+#include <linux/pagemap.h>
-+#include <linux/compiler.h>
-
- #include <asm/page.h>
- #include <asm/pgtable.h>
-@@ -78,7 +81,7 @@ static void bad_kernel_pc(struct pt_regs *regs, unsigned long vaddr)
- printk(KERN_CRIT "OOPS: Bogus kernel PC [%016lx] in fault handler\n",
- regs->tpc);
- printk(KERN_CRIT "OOPS: RPC [%016lx]\n", regs->u_regs[15]);
-- printk("OOPS: RPC <%pS>\n", (void *) regs->u_regs[15]);
-+ printk("OOPS: RPC <%pA>\n", (void *) regs->u_regs[15]);
- printk(KERN_CRIT "OOPS: Fault was to vaddr[%lx]\n", vaddr);
- dump_stack();
- unhandled_fault(regs->tpc, current, regs);
-@@ -249,6 +252,465 @@ static void noinline bogus_32bit_fault_address(struct pt_regs *regs,
- show_regs(regs);
- }
-
-+#ifdef CONFIG_PAX_PAGEEXEC
-+#ifdef CONFIG_PAX_DLRESOLVE
-+static void pax_emuplt_close(struct vm_area_struct *vma)
-+{
-+ vma->vm_mm->call_dl_resolve = 0UL;
-+}
-+
-+static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
-+{
-+ unsigned int *kaddr;
-+
-+ vmf->page = alloc_page(GFP_HIGHUSER);
-+ if (!vmf->page)
-+ return VM_FAULT_OOM;
-+
-+ kaddr = kmap(vmf->page);
-+ memset(kaddr, 0, PAGE_SIZE);
-+ kaddr[0] = 0x9DE3BFA8U; /* save */
-+ flush_dcache_page(vmf->page);
-+ kunmap(vmf->page);
-+ return VM_FAULT_MAJOR;
-+}
-+
-+static const struct vm_operations_struct pax_vm_ops = {
-+ .close = pax_emuplt_close,
-+ .fault = pax_emuplt_fault
-+};
-+
-+static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
-+{
-+ int ret;
-+
-+ vma->vm_mm = current->mm;
-+ vma->vm_start = addr;
-+ vma->vm_end = addr + PAGE_SIZE;
-+ vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
-+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
-+ vma->vm_ops = &pax_vm_ops;
-+
-+ ret = insert_vm_struct(current->mm, vma);
-+ if (ret)
-+ return ret;
-+
-+ ++current->mm->total_vm;
-+ return 0;
-+}
-+#endif
-+
-+/*
-+ * PaX: decide what to do with offenders (regs->tpc = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ * 2 when patched PLT trampoline was detected
-+ * 3 when unpatched PLT trampoline was detected
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+ int err;
-+
-+ do { /* PaX: patched PLT emulation #1 */
-+ unsigned int sethi1, sethi2, jmpl;
-+
-+ err = get_user(sethi1, (unsigned int *)regs->tpc);
-+ err |= get_user(sethi2, (unsigned int *)(regs->tpc+4));
-+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+8));
-+
-+ if (err)
-+ break;
-+
-+ if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
-+ (sethi2 & 0xFFC00000U) == 0x03000000U &&
-+ (jmpl & 0xFFFFE000U) == 0x81C06000U)
-+ {
-+ unsigned long addr;
-+
-+ regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
-+ addr = regs->u_regs[UREG_G1];
-+ addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
-+
-+ if (test_thread_flag(TIF_32BIT))
-+ addr &= 0xFFFFFFFFUL;
-+
-+ regs->tpc = addr;
-+ regs->tnpc = addr+4;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: patched PLT emulation #2 */
-+ unsigned int ba;
-+
-+ err = get_user(ba, (unsigned int *)regs->tpc);
-+
-+ if (err)
-+ break;
-+
-+ if ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30480000U) {
-+ unsigned long addr;
-+
-+ if ((ba & 0xFFC00000U) == 0x30800000U)
-+ addr = regs->tpc + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
-+ else
-+ addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
-+
-+ if (test_thread_flag(TIF_32BIT))
-+ addr &= 0xFFFFFFFFUL;
-+
-+ regs->tpc = addr;
-+ regs->tnpc = addr+4;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: patched PLT emulation #3 */
-+ unsigned int sethi, bajmpl, nop;
-+
-+ err = get_user(sethi, (unsigned int *)regs->tpc);
-+ err |= get_user(bajmpl, (unsigned int *)(regs->tpc+4));
-+ err |= get_user(nop, (unsigned int *)(regs->tpc+8));
-+
-+ if (err)
-+ break;
-+
-+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+ ((bajmpl & 0xFFFFE000U) == 0x81C06000U || (bajmpl & 0xFFF80000U) == 0x30480000U) &&
-+ nop == 0x01000000U)
-+ {
-+ unsigned long addr;
-+
-+ addr = (sethi & 0x003FFFFFU) << 10;
-+ regs->u_regs[UREG_G1] = addr;
-+ if ((bajmpl & 0xFFFFE000U) == 0x81C06000U)
-+ addr += (((bajmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
-+ else
-+ addr = regs->tpc + ((((bajmpl | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
-+
-+ if (test_thread_flag(TIF_32BIT))
-+ addr &= 0xFFFFFFFFUL;
-+
-+ regs->tpc = addr;
-+ regs->tnpc = addr+4;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: patched PLT emulation #4 */
-+ unsigned int sethi, mov1, call, mov2;
-+
-+ err = get_user(sethi, (unsigned int *)regs->tpc);
-+ err |= get_user(mov1, (unsigned int *)(regs->tpc+4));
-+ err |= get_user(call, (unsigned int *)(regs->tpc+8));
-+ err |= get_user(mov2, (unsigned int *)(regs->tpc+12));
-+
-+ if (err)
-+ break;
-+
-+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+ mov1 == 0x8210000FU &&
-+ (call & 0xC0000000U) == 0x40000000U &&
-+ mov2 == 0x9E100001U)
-+ {
-+ unsigned long addr;
-+
-+ regs->u_regs[UREG_G1] = regs->u_regs[UREG_RETPC];
-+ addr = regs->tpc + 4 + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
-+
-+ if (test_thread_flag(TIF_32BIT))
-+ addr &= 0xFFFFFFFFUL;
-+
-+ regs->tpc = addr;
-+ regs->tnpc = addr+4;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: patched PLT emulation #5 */
-+ unsigned int sethi, sethi1, sethi2, or1, or2, sllx, jmpl, nop;
-+
-+ err = get_user(sethi, (unsigned int *)regs->tpc);
-+ err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
-+ err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
-+ err |= get_user(or1, (unsigned int *)(regs->tpc+12));
-+ err |= get_user(or2, (unsigned int *)(regs->tpc+16));
-+ err |= get_user(sllx, (unsigned int *)(regs->tpc+20));
-+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+24));
-+ err |= get_user(nop, (unsigned int *)(regs->tpc+28));
-+
-+ if (err)
-+ break;
-+
-+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+ (sethi1 & 0xFFC00000U) == 0x03000000U &&
-+ (sethi2 & 0xFFC00000U) == 0x0B000000U &&
-+ (or1 & 0xFFFFE000U) == 0x82106000U &&
-+ (or2 & 0xFFFFE000U) == 0x8A116000U &&
-+ sllx == 0x83287020U &&
-+ jmpl == 0x81C04005U &&
-+ nop == 0x01000000U)
-+ {
-+ unsigned long addr;
-+
-+ regs->u_regs[UREG_G1] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
-+ regs->u_regs[UREG_G1] <<= 32;
-+ regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
-+ addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
-+ regs->tpc = addr;
-+ regs->tnpc = addr+4;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: patched PLT emulation #6 */
-+ unsigned int sethi, sethi1, sethi2, sllx, or, jmpl, nop;
-+
-+ err = get_user(sethi, (unsigned int *)regs->tpc);
-+ err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
-+ err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
-+ err |= get_user(sllx, (unsigned int *)(regs->tpc+12));
-+ err |= get_user(or, (unsigned int *)(regs->tpc+16));
-+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+20));
-+ err |= get_user(nop, (unsigned int *)(regs->tpc+24));
-+
-+ if (err)
-+ break;
-+
-+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+ (sethi1 & 0xFFC00000U) == 0x03000000U &&
-+ (sethi2 & 0xFFC00000U) == 0x0B000000U &&
-+ sllx == 0x83287020U &&
-+ (or & 0xFFFFE000U) == 0x8A116000U &&
-+ jmpl == 0x81C04005U &&
-+ nop == 0x01000000U)
-+ {
-+ unsigned long addr;
-+
-+ regs->u_regs[UREG_G1] = (sethi1 & 0x003FFFFFU) << 10;
-+ regs->u_regs[UREG_G1] <<= 32;
-+ regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or & 0x3FFU);
-+ addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
-+ regs->tpc = addr;
-+ regs->tnpc = addr+4;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: unpatched PLT emulation step 1 */
-+ unsigned int sethi, ba, nop;
-+
-+ err = get_user(sethi, (unsigned int *)regs->tpc);
-+ err |= get_user(ba, (unsigned int *)(regs->tpc+4));
-+ err |= get_user(nop, (unsigned int *)(regs->tpc+8));
-+
-+ if (err)
-+ break;
-+
-+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+ ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
-+ nop == 0x01000000U)
-+ {
-+ unsigned long addr;
-+ unsigned int save, call;
-+ unsigned int sethi1, sethi2, or1, or2, sllx, add, jmpl;
-+
-+ if ((ba & 0xFFC00000U) == 0x30800000U)
-+ addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
-+ else
-+ addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
-+
-+ if (test_thread_flag(TIF_32BIT))
-+ addr &= 0xFFFFFFFFUL;
-+
-+ err = get_user(save, (unsigned int *)addr);
-+ err |= get_user(call, (unsigned int *)(addr+4));
-+ err |= get_user(nop, (unsigned int *)(addr+8));
-+ if (err)
-+ break;
-+
-+#ifdef CONFIG_PAX_DLRESOLVE
-+ if (save == 0x9DE3BFA8U &&
-+ (call & 0xC0000000U) == 0x40000000U &&
-+ nop == 0x01000000U)
-+ {
-+ struct vm_area_struct *vma;
-+ unsigned long call_dl_resolve;
-+
-+ down_read(¤t->mm->mmap_sem);
-+ call_dl_resolve = current->mm->call_dl_resolve;
-+ up_read(¤t->mm->mmap_sem);
-+ if (likely(call_dl_resolve))
-+ goto emulate;
-+
-+ vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
-+
-+ down_write(¤t->mm->mmap_sem);
-+ if (current->mm->call_dl_resolve) {
-+ call_dl_resolve = current->mm->call_dl_resolve;
-+ up_write(¤t->mm->mmap_sem);
-+ if (vma)
-+ kmem_cache_free(vm_area_cachep, vma);
-+ goto emulate;
-+ }
-+
-+ call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
-+ if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
-+ up_write(¤t->mm->mmap_sem);
-+ if (vma)
-+ kmem_cache_free(vm_area_cachep, vma);
-+ return 1;
-+ }
-+
-+ if (pax_insert_vma(vma, call_dl_resolve)) {
-+ up_write(¤t->mm->mmap_sem);
-+ kmem_cache_free(vm_area_cachep, vma);
-+ return 1;
-+ }
-+
-+ current->mm->call_dl_resolve = call_dl_resolve;
-+ up_write(¤t->mm->mmap_sem);
-+
-+emulate:
-+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
-+ regs->tpc = call_dl_resolve;
-+ regs->tnpc = addr+4;
-+ return 3;
-+ }
-+#endif
-+
-+ /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
-+ if ((save & 0xFFC00000U) == 0x05000000U &&
-+ (call & 0xFFFFE000U) == 0x85C0A000U &&
-+ nop == 0x01000000U)
-+ {
-+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
-+ regs->u_regs[UREG_G2] = addr + 4;
-+ addr = (save & 0x003FFFFFU) << 10;
-+ addr += (((call | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
-+
-+ if (test_thread_flag(TIF_32BIT))
-+ addr &= 0xFFFFFFFFUL;
-+
-+ regs->tpc = addr;
-+ regs->tnpc = addr+4;
-+ return 3;
-+ }
-+
-+ /* PaX: 64-bit PLT stub */
-+ err = get_user(sethi1, (unsigned int *)addr);
-+ err |= get_user(sethi2, (unsigned int *)(addr+4));
-+ err |= get_user(or1, (unsigned int *)(addr+8));
-+ err |= get_user(or2, (unsigned int *)(addr+12));
-+ err |= get_user(sllx, (unsigned int *)(addr+16));
-+ err |= get_user(add, (unsigned int *)(addr+20));
-+ err |= get_user(jmpl, (unsigned int *)(addr+24));
-+ err |= get_user(nop, (unsigned int *)(addr+28));
-+ if (err)
-+ break;
-+
-+ if ((sethi1 & 0xFFC00000U) == 0x09000000U &&
-+ (sethi2 & 0xFFC00000U) == 0x0B000000U &&
-+ (or1 & 0xFFFFE000U) == 0x88112000U &&
-+ (or2 & 0xFFFFE000U) == 0x8A116000U &&
-+ sllx == 0x89293020U &&
-+ add == 0x8A010005U &&
-+ jmpl == 0x89C14000U &&
-+ nop == 0x01000000U)
-+ {
-+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
-+ regs->u_regs[UREG_G4] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
-+ regs->u_regs[UREG_G4] <<= 32;
-+ regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
-+ regs->u_regs[UREG_G5] += regs->u_regs[UREG_G4];
-+ regs->u_regs[UREG_G4] = addr + 24;
-+ addr = regs->u_regs[UREG_G5];
-+ regs->tpc = addr;
-+ regs->tnpc = addr+4;
-+ return 3;
-+ }
-+ }
-+ } while (0);
-+
-+#ifdef CONFIG_PAX_DLRESOLVE
-+ do { /* PaX: unpatched PLT emulation step 2 */
-+ unsigned int save, call, nop;
-+
-+ err = get_user(save, (unsigned int *)(regs->tpc-4));
-+ err |= get_user(call, (unsigned int *)regs->tpc);
-+ err |= get_user(nop, (unsigned int *)(regs->tpc+4));
-+ if (err)
-+ break;
-+
-+ if (save == 0x9DE3BFA8U &&
-+ (call & 0xC0000000U) == 0x40000000U &&
-+ nop == 0x01000000U)
-+ {
-+ unsigned long dl_resolve = regs->tpc + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
-+
-+ if (test_thread_flag(TIF_32BIT))
-+ dl_resolve &= 0xFFFFFFFFUL;
-+
-+ regs->u_regs[UREG_RETPC] = regs->tpc;
-+ regs->tpc = dl_resolve;
-+ regs->tnpc = dl_resolve+4;
-+ return 3;
-+ }
-+ } while (0);
-+#endif
-+
-+ do { /* PaX: patched PLT emulation #7, must be AFTER the unpatched PLT emulation */
-+ unsigned int sethi, ba, nop;
-+
-+ err = get_user(sethi, (unsigned int *)regs->tpc);
-+ err |= get_user(ba, (unsigned int *)(regs->tpc+4));
-+ err |= get_user(nop, (unsigned int *)(regs->tpc+8));
-+
-+ if (err)
-+ break;
-+
-+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+ (ba & 0xFFF00000U) == 0x30600000U &&
-+ nop == 0x01000000U)
-+ {
-+ unsigned long addr;
-+
-+ addr = (sethi & 0x003FFFFFU) << 10;
-+ regs->u_regs[UREG_G1] = addr;
-+ addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
-+
-+ if (test_thread_flag(TIF_32BIT))
-+ addr &= 0xFFFFFFFFUL;
-+
-+ regs->tpc = addr;
-+ regs->tnpc = addr+4;
-+ return 2;
-+ }
-+ } while (0);
-+
-+#endif
-+
-+ return 1;
-+}
-+
-+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
-+{
-+ unsigned long i;
-+
-+ printk(KERN_ERR "PAX: bytes at PC: ");
-+ for (i = 0; i < 8; i++) {
-+ unsigned int c;
-+ if (get_user(c, (unsigned int *)pc+i))
-+ printk(KERN_CONT "???????? ");
-+ else
-+ printk(KERN_CONT "%08x ", c);
-+ }
-+ printk("\n");
-+}
-+#endif
-+
- asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
- {
- struct mm_struct *mm = current->mm;
-@@ -315,6 +777,29 @@ asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
- if (!vma)
- goto bad_area;
-
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ /* PaX: detect ITLB misses on non-exec pages */
-+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && vma->vm_start <= address &&
-+ !(vma->vm_flags & VM_EXEC) && (fault_code & FAULT_CODE_ITLB))
-+ {
-+ if (address != regs->tpc)
-+ goto good_area;
-+
-+ up_read(&mm->mmap_sem);
-+ switch (pax_handle_fetch_fault(regs)) {
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+ case 2:
-+ case 3:
-+ return;
-+#endif
-+
-+ }
-+ pax_report_fault(regs, (void *)regs->tpc, (void *)(regs->u_regs[UREG_FP] + STACK_BIAS));
-+ do_group_exit(SIGKILL);
-+ }
-+#endif
-+
- /* Pure DTLB misses do not tell us whether the fault causing
- * load/store/atomic was a write or not, it only says that there
- * was no match. So in such a case we (carefully) read the
-diff --git a/arch/sparc/mm/hugetlbpage.c b/arch/sparc/mm/hugetlbpage.c
-index f27d103..d4fd7ba 100644
---- a/arch/sparc/mm/hugetlbpage.c
-+++ b/arch/sparc/mm/hugetlbpage.c
-@@ -36,6 +36,7 @@ static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *filp,
- struct vm_area_struct * vma;
- unsigned long task_size = TASK_SIZE;
- unsigned long start_addr;
-+ unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
-
- if (test_thread_flag(TIF_32BIT))
- task_size = STACK_TOP32;
-@@ -69,7 +70,7 @@ full_search:
- }
- return -ENOMEM;
- }
-- if (likely(!vma || addr + len <= vma->vm_start)) {
-+ if (likely(check_heap_stack_gap(vma, addr, len, offset))) {
- /*
- * Remember the place where we stopped the search:
- */
-@@ -92,6 +93,7 @@ hugetlb_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- struct vm_area_struct *vma;
- struct mm_struct *mm = current->mm;
- unsigned long addr = addr0;
-+ unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
-
- /* This should only ever run for 32-bit processes. */
- BUG_ON(!test_thread_flag(TIF_32BIT));
-@@ -108,7 +110,7 @@ hugetlb_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- /* make sure it can fit in the remaining address space */
- if (likely(addr > len)) {
- vma = find_vma(mm, addr-len);
-- if (!vma || addr <= vma->vm_start) {
-+ if (check_heap_stack_gap(vma, addr - len, len, offset)) {
- /* remember the address as a hint for next time */
- return (mm->free_area_cache = addr-len);
- }
-@@ -117,16 +119,17 @@ hugetlb_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- if (unlikely(mm->mmap_base < len))
- goto bottomup;
-
-- addr = (mm->mmap_base-len) & HPAGE_MASK;
-+ addr = mm->mmap_base - len;
-
- do {
-+ addr &= HPAGE_MASK;
- /*
- * Lookup failure means no vma is above this address,
- * else if new region fits below vma->vm_start,
- * return with success:
- */
- vma = find_vma(mm, addr);
-- if (likely(!vma || addr+len <= vma->vm_start)) {
-+ if (likely(check_heap_stack_gap(vma, addr, len, offset))) {
- /* remember the address as a hint for next time */
- return (mm->free_area_cache = addr);
- }
-@@ -136,8 +139,8 @@ hugetlb_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- mm->cached_hole_size = vma->vm_start - addr;
-
- /* try just below the current vma->vm_start */
-- addr = (vma->vm_start-len) & HPAGE_MASK;
-- } while (likely(len < vma->vm_start));
-+ addr = skip_heap_stack_gap(vma, len, offset);
-+ } while (!IS_ERR_VALUE(addr));
-
- bottomup:
- /*
-@@ -165,6 +168,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
- struct mm_struct *mm = current->mm;
- struct vm_area_struct *vma;
- unsigned long task_size = TASK_SIZE;
-+ unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
-
- if (test_thread_flag(TIF_32BIT))
- task_size = STACK_TOP32;
-@@ -183,8 +187,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
- if (addr) {
- addr = ALIGN(addr, HPAGE_SIZE);
- vma = find_vma(mm, addr);
-- if (task_size - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-+ if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
- return addr;
- }
- if (mm->get_unmapped_area == arch_get_unmapped_area)
-diff --git a/arch/sparc/mm/init_32.c b/arch/sparc/mm/init_32.c
-index dc7c3b1..34c0070 100644
---- a/arch/sparc/mm/init_32.c
-+++ b/arch/sparc/mm/init_32.c
-@@ -317,6 +317,9 @@ extern void device_scan(void);
- pgprot_t PAGE_SHARED __read_mostly;
- EXPORT_SYMBOL(PAGE_SHARED);
-
-+pgprot_t PAGE_SHARED_NOEXEC __read_mostly;
-+EXPORT_SYMBOL(PAGE_SHARED_NOEXEC);
-+
- void __init paging_init(void)
- {
- switch(sparc_cpu_model) {
-@@ -345,17 +348,17 @@ void __init paging_init(void)
-
- /* Initialize the protection map with non-constant, MMU dependent values. */
- protection_map[0] = PAGE_NONE;
-- protection_map[1] = PAGE_READONLY;
-- protection_map[2] = PAGE_COPY;
-- protection_map[3] = PAGE_COPY;
-+ protection_map[1] = PAGE_READONLY_NOEXEC;
-+ protection_map[2] = PAGE_COPY_NOEXEC;
-+ protection_map[3] = PAGE_COPY_NOEXEC;
- protection_map[4] = PAGE_READONLY;
- protection_map[5] = PAGE_READONLY;
- protection_map[6] = PAGE_COPY;
- protection_map[7] = PAGE_COPY;
- protection_map[8] = PAGE_NONE;
-- protection_map[9] = PAGE_READONLY;
-- protection_map[10] = PAGE_SHARED;
-- protection_map[11] = PAGE_SHARED;
-+ protection_map[9] = PAGE_READONLY_NOEXEC;
-+ protection_map[10] = PAGE_SHARED_NOEXEC;
-+ protection_map[11] = PAGE_SHARED_NOEXEC;
- protection_map[12] = PAGE_READONLY;
- protection_map[13] = PAGE_READONLY;
- protection_map[14] = PAGE_SHARED;
-diff --git a/arch/sparc/mm/srmmu.c b/arch/sparc/mm/srmmu.c
-index 509b1ff..bfd7118 100644
---- a/arch/sparc/mm/srmmu.c
-+++ b/arch/sparc/mm/srmmu.c
-@@ -2200,6 +2200,13 @@ void __init ld_mmu_srmmu(void)
- PAGE_SHARED = pgprot_val(SRMMU_PAGE_SHARED);
- BTFIXUPSET_INT(page_copy, pgprot_val(SRMMU_PAGE_COPY));
- BTFIXUPSET_INT(page_readonly, pgprot_val(SRMMU_PAGE_RDONLY));
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ PAGE_SHARED_NOEXEC = pgprot_val(SRMMU_PAGE_SHARED_NOEXEC);
-+ BTFIXUPSET_INT(page_copy_noexec, pgprot_val(SRMMU_PAGE_COPY_NOEXEC));
-+ BTFIXUPSET_INT(page_readonly_noexec, pgprot_val(SRMMU_PAGE_RDONLY_NOEXEC));
-+#endif
-+
- BTFIXUPSET_INT(page_kernel, pgprot_val(SRMMU_PAGE_KERNEL));
- page_kernel = pgprot_val(SRMMU_PAGE_KERNEL);
-
-diff --git a/arch/um/Makefile b/arch/um/Makefile
-index fc633db..b46e213 100644
---- a/arch/um/Makefile
-+++ b/arch/um/Makefile
-@@ -49,6 +49,10 @@ USER_CFLAGS = $(patsubst $(KERNEL_DEFINES),,$(patsubst -D__KERNEL__,,\
- $(patsubst -I%,,$(KBUILD_CFLAGS)))) $(ARCH_INCLUDE) $(MODE_INCLUDE) \
- $(filter -I%,$(CFLAGS)) -D_FILE_OFFSET_BITS=64
-
-+ifdef CONSTIFY_PLUGIN
-+USER_CFLAGS += -fplugin-arg-constify_plugin-no-constify
-+endif
-+
- include $(srctree)/$(ARCH_DIR)/Makefile-$(SUBARCH)
-
- #This will adjust *FLAGS accordingly to the platform.
-diff --git a/arch/um/include/asm/cache.h b/arch/um/include/asm/cache.h
-index 19e1bdd..3665b77 100644
---- a/arch/um/include/asm/cache.h
-+++ b/arch/um/include/asm/cache.h
-@@ -1,6 +1,7 @@
- #ifndef __UM_CACHE_H
- #define __UM_CACHE_H
-
-+#include <linux/const.h>
-
- #if defined(CONFIG_UML_X86) && !defined(CONFIG_64BIT)
- # define L1_CACHE_SHIFT (CONFIG_X86_L1_CACHE_SHIFT)
-@@ -12,6 +13,6 @@
- # define L1_CACHE_SHIFT 5
- #endif
-
--#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-
- #endif
-diff --git a/arch/um/include/asm/kmap_types.h b/arch/um/include/asm/kmap_types.h
-index 6c03acd..a5e0215 100644
---- a/arch/um/include/asm/kmap_types.h
-+++ b/arch/um/include/asm/kmap_types.h
-@@ -23,6 +23,7 @@ enum km_type {
- KM_IRQ1,
- KM_SOFTIRQ0,
- KM_SOFTIRQ1,
-+ KM_CLEARPAGE,
- KM_TYPE_NR
- };
-
-diff --git a/arch/um/include/asm/page.h b/arch/um/include/asm/page.h
-index 4cc9b6c..02e5029 100644
---- a/arch/um/include/asm/page.h
-+++ b/arch/um/include/asm/page.h
-@@ -14,6 +14,9 @@
- #define PAGE_SIZE (_AC(1, UL) << PAGE_SHIFT)
- #define PAGE_MASK (~(PAGE_SIZE-1))
-
-+#define ktla_ktva(addr) (addr)
-+#define ktva_ktla(addr) (addr)
-+
- #ifndef __ASSEMBLY__
-
- struct page;
-diff --git a/arch/um/include/asm/pgtable-3level.h b/arch/um/include/asm/pgtable-3level.h
-index 084de4a..f44d25c 100644
---- a/arch/um/include/asm/pgtable-3level.h
-+++ b/arch/um/include/asm/pgtable-3level.h
-@@ -58,6 +58,7 @@
- #define pud_present(x) (pud_val(x) & _PAGE_PRESENT)
- #define pud_populate(mm, pud, pmd) \
- set_pud(pud, __pud(_PAGE_TABLE + __pa(pmd)))
-+#define pud_populate_kernel(mm, pud, pmd) pud_populate((mm), (pud), (pmd))
-
- #ifdef CONFIG_64BIT
- #define set_pud(pudptr, pudval) set_64bit((phys_t *) (pudptr), pud_val(pudval))
-diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c
-index 4a28a15..654dc2a 100644
---- a/arch/um/kernel/process.c
-+++ b/arch/um/kernel/process.c
-@@ -393,22 +393,6 @@ int singlestepping(void * t)
- return 2;
- }
-
--/*
-- * Only x86 and x86_64 have an arch_align_stack().
-- * All other arches have "#define arch_align_stack(x) (x)"
-- * in their asm/system.h
-- * As this is included in UML from asm-um/system-generic.h,
-- * we can use it to behave as the subarch does.
-- */
--#ifndef arch_align_stack
--unsigned long arch_align_stack(unsigned long sp)
--{
-- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
-- sp -= get_random_int() % 8192;
-- return sp & ~0xf;
--}
--#endif
--
- unsigned long get_wchan(struct task_struct *p)
- {
- unsigned long stack_page, sp, ip;
-diff --git a/arch/um/sys-i386/shared/sysdep/system.h b/arch/um/sys-i386/shared/sysdep/system.h
-index d1b93c4..ae1b7fd 100644
---- a/arch/um/sys-i386/shared/sysdep/system.h
-+++ b/arch/um/sys-i386/shared/sysdep/system.h
-@@ -17,7 +17,7 @@
- # define AT_VECTOR_SIZE_ARCH 1
- #endif
-
--extern unsigned long arch_align_stack(unsigned long sp);
-+#define arch_align_stack(x) ((x) & ~0xfUL)
-
- void default_idle(void);
-
-diff --git a/arch/um/sys-i386/syscalls.c b/arch/um/sys-i386/syscalls.c
-index 857ca0b..9a2669d 100644
---- a/arch/um/sys-i386/syscalls.c
-+++ b/arch/um/sys-i386/syscalls.c
-@@ -11,6 +11,21 @@
- #include "asm/uaccess.h"
- #include "asm/unistd.h"
-
-+int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
-+{
-+ unsigned long pax_task_size = TASK_SIZE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
-+ pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+ if (len > pax_task_size || addr > pax_task_size - len)
-+ return -EINVAL;
-+
-+ return 0;
-+}
-+
- /*
- * Perform the select(nd, in, out, ex, tv) and mmap() system
- * calls. Linux/i386 didn't use to be able to handle more than
-diff --git a/arch/um/sys-x86_64/shared/sysdep/system.h b/arch/um/sys-x86_64/shared/sysdep/system.h
-index d1b93c4..ae1b7fd 100644
---- a/arch/um/sys-x86_64/shared/sysdep/system.h
-+++ b/arch/um/sys-x86_64/shared/sysdep/system.h
-@@ -17,7 +17,7 @@
- # define AT_VECTOR_SIZE_ARCH 1
- #endif
-
--extern unsigned long arch_align_stack(unsigned long sp);
-+#define arch_align_stack(x) ((x) & ~0xfUL)
-
- void default_idle(void);
-
-diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
-index aa889d6..883686f 100644
---- a/arch/x86/Kconfig
-+++ b/arch/x86/Kconfig
-@@ -223,7 +223,7 @@ config X86_TRAMPOLINE
-
- config X86_32_LAZY_GS
- def_bool y
-- depends on X86_32 && !CC_STACKPROTECTOR
-+ depends on X86_32 && !CC_STACKPROTECTOR && !PAX_MEMORY_UDEREF
-
- config KTIME_SCALAR
- def_bool X86_32
-@@ -985,6 +985,7 @@ config MICROCODE_OLD_INTERFACE
-
- config X86_MSR
- tristate "/dev/cpu/*/msr - Model-specific register support"
-+ depends on !GRKERNSEC_KMEM
- ---help---
- This device gives privileged processes access to the x86
- Model-Specific Registers (MSRs). It is a character device with
-@@ -1008,7 +1009,7 @@ choice
-
- config NOHIGHMEM
- bool "off"
-- depends on !X86_NUMAQ
-+ depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
- ---help---
- Linux can use up to 64 Gigabytes of physical memory on x86 systems.
- However, the address space of 32-bit x86 processors is only 4
-@@ -1045,7 +1046,7 @@ config NOHIGHMEM
-
- config HIGHMEM4G
- bool "4GB"
-- depends on !X86_NUMAQ
-+ depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
- ---help---
- Select this if you have a 32-bit processor and between 1 and 4
- gigabytes of physical RAM.
-@@ -1099,7 +1100,7 @@ config PAGE_OFFSET
- hex
- default 0xB0000000 if VMSPLIT_3G_OPT
- default 0x80000000 if VMSPLIT_2G
-- default 0x78000000 if VMSPLIT_2G_OPT
-+ default 0x70000000 if VMSPLIT_2G_OPT
- default 0x40000000 if VMSPLIT_1G
- default 0xC0000000
- depends on X86_32
-@@ -1469,6 +1470,7 @@ config SECCOMP
-
- config CC_STACKPROTECTOR
- bool "Enable -fstack-protector buffer overflow detection (EXPERIMENTAL)"
-+ depends on X86_64 || !PAX_MEMORY_UDEREF
- ---help---
- This option turns on the -fstack-protector GCC feature. This
- feature puts, at the beginning of functions, a canary value on
-@@ -1526,6 +1528,7 @@ config KEXEC_JUMP
- config PHYSICAL_START
- hex "Physical address where the kernel is loaded" if (EMBEDDED || CRASH_DUMP)
- default "0x1000000"
-+ range 0x400000 0x40000000
- ---help---
- This gives the physical address where the kernel is loaded.
-
-@@ -1590,6 +1593,7 @@ config PHYSICAL_ALIGN
- hex
- prompt "Alignment value to which kernel should be aligned" if X86_32
- default "0x1000000"
-+ range 0x400000 0x1000000 if PAX_KERNEXEC
- range 0x2000 0x1000000
- ---help---
- This value puts the alignment restrictions on physical address
-@@ -1621,9 +1625,10 @@ config HOTPLUG_CPU
- Say N if you want to disable CPU hotplug.
-
- config COMPAT_VDSO
-- def_bool y
-+ def_bool n
- prompt "Compat VDSO support"
- depends on X86_32 || IA32_EMULATION
-+ depends on !PAX_NOEXEC && !PAX_MEMORY_UDEREF
- ---help---
- Map the 32-bit VDSO to the predictable old-style address too.
- ---help---
-diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
-index 0e566103..1a6b57e 100644
---- a/arch/x86/Kconfig.cpu
-+++ b/arch/x86/Kconfig.cpu
-@@ -340,7 +340,7 @@ config X86_PPRO_FENCE
-
- config X86_F00F_BUG
- def_bool y
-- depends on M586MMX || M586TSC || M586 || M486 || M386
-+ depends on (M586MMX || M586TSC || M586 || M486 || M386) && !PAX_KERNEXEC
-
- config X86_WP_WORKS_OK
- def_bool y
-@@ -360,7 +360,7 @@ config X86_POPAD_OK
-
- config X86_ALIGNMENT_16
- def_bool y
-- depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK6 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
-+ depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK8 || MK7 || MK6 || MCORE2 || MPENTIUM4 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
-
- config X86_INTEL_USERCOPY
- def_bool y
-@@ -406,7 +406,7 @@ config X86_CMPXCHG64
- # generates cmov.
- config X86_CMOV
- def_bool y
-- depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM)
-+ depends on (MK8 || MK7 || MCORE2 || MPSC || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM)
-
- config X86_MINIMUM_CPU_FAMILY
- int
-diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug
-index d105f29..c928727 100644
---- a/arch/x86/Kconfig.debug
-+++ b/arch/x86/Kconfig.debug
-@@ -99,7 +99,7 @@ config X86_PTDUMP
- config DEBUG_RODATA
- bool "Write protect kernel read-only data structures"
- default y
-- depends on DEBUG_KERNEL
-+ depends on DEBUG_KERNEL && BROKEN
- ---help---
- Mark the kernel read-only data as write-protected in the pagetables,
- in order to catch accidental (and incorrect) writes to such const
-diff --git a/arch/x86/Makefile b/arch/x86/Makefile
-index d2d24c9..0f21f8d 100644
---- a/arch/x86/Makefile
-+++ b/arch/x86/Makefile
-@@ -44,6 +44,7 @@ ifeq ($(CONFIG_X86_32),y)
- else
- BITS := 64
- UTS_MACHINE := x86_64
-+ biarch := $(call cc-option,-m64)
- CHECKFLAGS += -D__x86_64__ -m64
-
- KBUILD_AFLAGS += -m64
-@@ -189,3 +190,12 @@ define archhelp
- echo ' FDARGS="..." arguments for the booted kernel'
- echo ' FDINITRD=file initrd for the booted kernel'
- endef
-+
-+define OLD_LD
-+
-+*** ${VERSION}.${PATCHLEVEL} PaX kernels no longer build correctly with old versions of binutils.
-+*** Please upgrade your binutils to 2.18 or newer
-+endef
-+
-+archprepare:
-+ $(if $(LDFLAGS_BUILD_ID),,$(error $(OLD_LD)))
-diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
-index ec749c2..c2abaf02 100644
---- a/arch/x86/boot/Makefile
-+++ b/arch/x86/boot/Makefile
-@@ -69,6 +69,9 @@ KBUILD_CFLAGS := $(LINUXINCLUDE) -g -Os -D_SETUP -D__KERNEL__ \
- $(call cc-option, -fno-stack-protector) \
- $(call cc-option, -mpreferred-stack-boundary=2)
- KBUILD_CFLAGS += $(call cc-option, -m32)
-+ifdef CONSTIFY_PLUGIN
-+KBUILD_CFLAGS += -fplugin-arg-constify_plugin-no-constify
-+endif
- KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
- GCOV_PROFILE := n
-
-diff --git a/arch/x86/boot/bitops.h b/arch/x86/boot/bitops.h
-index 878e4b9..20537ab 100644
---- a/arch/x86/boot/bitops.h
-+++ b/arch/x86/boot/bitops.h
-@@ -26,7 +26,7 @@ static inline int variable_test_bit(int nr, const void *addr)
- u8 v;
- const u32 *p = (const u32 *)addr;
-
-- asm("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
-+ asm volatile("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
- return v;
- }
-
-@@ -37,7 +37,7 @@ static inline int variable_test_bit(int nr, const void *addr)
-
- static inline void set_bit(int nr, void *addr)
- {
-- asm("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
-+ asm volatile("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
- }
-
- #endif /* BOOT_BITOPS_H */
-diff --git a/arch/x86/boot/boot.h b/arch/x86/boot/boot.h
-index 98239d2..f40214c 100644
---- a/arch/x86/boot/boot.h
-+++ b/arch/x86/boot/boot.h
-@@ -82,7 +82,7 @@ static inline void io_delay(void)
- static inline u16 ds(void)
- {
- u16 seg;
-- asm("movw %%ds,%0" : "=rm" (seg));
-+ asm volatile("movw %%ds,%0" : "=rm" (seg));
- return seg;
- }
-
-@@ -178,7 +178,7 @@ static inline void wrgs32(u32 v, addr_t addr)
- static inline int memcmp(const void *s1, const void *s2, size_t len)
- {
- u8 diff;
-- asm("repe; cmpsb; setnz %0"
-+ asm volatile("repe; cmpsb; setnz %0"
- : "=qm" (diff), "+D" (s1), "+S" (s2), "+c" (len));
- return diff;
- }
-diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
-index f8ed065..6764b5c 100644
---- a/arch/x86/boot/compressed/Makefile
-+++ b/arch/x86/boot/compressed/Makefile
-@@ -13,6 +13,9 @@ cflags-$(CONFIG_X86_64) := -mcmodel=small
- KBUILD_CFLAGS += $(cflags-y)
- KBUILD_CFLAGS += $(call cc-option,-ffreestanding)
- KBUILD_CFLAGS += $(call cc-option,-fno-stack-protector)
-+ifdef CONSTIFY_PLUGIN
-+KBUILD_CFLAGS += -fplugin-arg-constify_plugin-no-constify
-+endif
-
- KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
- GCOV_PROFILE := n
-diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S
-index f543b70..b60fba8 100644
---- a/arch/x86/boot/compressed/head_32.S
-+++ b/arch/x86/boot/compressed/head_32.S
-@@ -76,7 +76,7 @@ ENTRY(startup_32)
- notl %eax
- andl %eax, %ebx
- #else
-- movl $LOAD_PHYSICAL_ADDR, %ebx
-+ movl $____LOAD_PHYSICAL_ADDR, %ebx
- #endif
-
- /* Target address to relocate to for decompression */
-@@ -149,7 +149,7 @@ relocated:
- * and where it was actually loaded.
- */
- movl %ebp, %ebx
-- subl $LOAD_PHYSICAL_ADDR, %ebx
-+ subl $____LOAD_PHYSICAL_ADDR, %ebx
- jz 2f /* Nothing to be done if loaded at compiled addr. */
- /*
- * Process relocations.
-@@ -157,8 +157,7 @@ relocated:
-
- 1: subl $4, %edi
- movl (%edi), %ecx
-- testl %ecx, %ecx
-- jz 2f
-+ jecxz 2f
- addl %ebx, -__PAGE_OFFSET(%ebx, %ecx)
- jmp 1b
- 2:
-diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S
-index 077e1b6..2c6b13b5 100644
---- a/arch/x86/boot/compressed/head_64.S
-+++ b/arch/x86/boot/compressed/head_64.S
-@@ -91,7 +91,7 @@ ENTRY(startup_32)
- notl %eax
- andl %eax, %ebx
- #else
-- movl $LOAD_PHYSICAL_ADDR, %ebx
-+ movl $____LOAD_PHYSICAL_ADDR, %ebx
- #endif
-
- /* Target address to relocate to for decompression */
-@@ -183,7 +183,7 @@ no_longmode:
- hlt
- jmp 1b
-
--#include "../../kernel/verify_cpu_64.S"
-+#include "../../kernel/verify_cpu.S"
-
- /*
- * Be careful here startup_64 needs to be at a predictable
-@@ -234,7 +234,7 @@ ENTRY(startup_64)
- notq %rax
- andq %rax, %rbp
- #else
-- movq $LOAD_PHYSICAL_ADDR, %rbp
-+ movq $____LOAD_PHYSICAL_ADDR, %rbp
- #endif
-
- /* Target address to relocate to for decompression */
-diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
-index 842b2a3..f00178b 100644
---- a/arch/x86/boot/compressed/misc.c
-+++ b/arch/x86/boot/compressed/misc.c
-@@ -288,7 +288,7 @@ static void parse_elf(void *output)
- case PT_LOAD:
- #ifdef CONFIG_RELOCATABLE
- dest = output;
-- dest += (phdr->p_paddr - LOAD_PHYSICAL_ADDR);
-+ dest += (phdr->p_paddr - ____LOAD_PHYSICAL_ADDR);
- #else
- dest = (void *)(phdr->p_paddr);
- #endif
-@@ -335,7 +335,7 @@ asmlinkage void decompress_kernel(void *rmode, memptr heap,
- error("Destination address too large");
- #endif
- #ifndef CONFIG_RELOCATABLE
-- if ((unsigned long)output != LOAD_PHYSICAL_ADDR)
-+ if ((unsigned long)output != ____LOAD_PHYSICAL_ADDR)
- error("Wrong destination address");
- #endif
-
-diff --git a/arch/x86/boot/compressed/mkpiggy.c b/arch/x86/boot/compressed/mkpiggy.c
-index bcbd36c..b1754af 100644
---- a/arch/x86/boot/compressed/mkpiggy.c
-+++ b/arch/x86/boot/compressed/mkpiggy.c
-@@ -74,7 +74,7 @@ int main(int argc, char *argv[])
-
- offs = (olen > ilen) ? olen - ilen : 0;
- offs += olen >> 12; /* Add 8 bytes for each 32K block */
-- offs += 32*1024 + 18; /* Add 32K + 18 bytes slack */
-+ offs += 64*1024; /* Add 64K bytes slack */
- offs = (offs+4095) & ~4095; /* Round to a 4K boundary */
-
- printf(".section \".rodata.compressed\",\"a\",@progbits\n");
-diff --git a/arch/x86/boot/compressed/relocs.c b/arch/x86/boot/compressed/relocs.c
-index bbeb0c3..1eb0571 100644
---- a/arch/x86/boot/compressed/relocs.c
-+++ b/arch/x86/boot/compressed/relocs.c
-@@ -10,8 +10,11 @@
- #define USE_BSD
- #include <endian.h>
-
-+#include "../../../../include/linux/autoconf.h"
-+
- #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
- static Elf32_Ehdr ehdr;
-+static Elf32_Phdr *phdr;
- static unsigned long reloc_count, reloc_idx;
- static unsigned long *relocs;
-
-@@ -37,7 +40,7 @@ static const char* safe_abs_relocs[] = {
-
- static int is_safe_abs_reloc(const char* sym_name)
- {
-- int i;
-+ unsigned int i;
-
- for (i = 0; i < ARRAY_SIZE(safe_abs_relocs); i++) {
- if (!strcmp(sym_name, safe_abs_relocs[i]))
-@@ -245,9 +248,39 @@ static void read_ehdr(FILE *fp)
- }
- }
-
-+static void read_phdrs(FILE *fp)
-+{
-+ unsigned int i;
-+
-+ phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr));
-+ if (!phdr) {
-+ die("Unable to allocate %d program headers\n",
-+ ehdr.e_phnum);
-+ }
-+ if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) {
-+ die("Seek to %d failed: %s\n",
-+ ehdr.e_phoff, strerror(errno));
-+ }
-+ if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) {
-+ die("Cannot read ELF program headers: %s\n",
-+ strerror(errno));
-+ }
-+ for(i = 0; i < ehdr.e_phnum; i++) {
-+ phdr[i].p_type = elf32_to_cpu(phdr[i].p_type);
-+ phdr[i].p_offset = elf32_to_cpu(phdr[i].p_offset);
-+ phdr[i].p_vaddr = elf32_to_cpu(phdr[i].p_vaddr);
-+ phdr[i].p_paddr = elf32_to_cpu(phdr[i].p_paddr);
-+ phdr[i].p_filesz = elf32_to_cpu(phdr[i].p_filesz);
-+ phdr[i].p_memsz = elf32_to_cpu(phdr[i].p_memsz);
-+ phdr[i].p_flags = elf32_to_cpu(phdr[i].p_flags);
-+ phdr[i].p_align = elf32_to_cpu(phdr[i].p_align);
-+ }
-+
-+}
-+
- static void read_shdrs(FILE *fp)
- {
-- int i;
-+ unsigned int i;
- Elf32_Shdr shdr;
-
- secs = calloc(ehdr.e_shnum, sizeof(struct section));
-@@ -282,7 +315,7 @@ static void read_shdrs(FILE *fp)
-
- static void read_strtabs(FILE *fp)
- {
-- int i;
-+ unsigned int i;
- for (i = 0; i < ehdr.e_shnum; i++) {
- struct section *sec = &secs[i];
- if (sec->shdr.sh_type != SHT_STRTAB) {
-@@ -307,7 +340,7 @@ static void read_strtabs(FILE *fp)
-
- static void read_symtabs(FILE *fp)
- {
-- int i,j;
-+ unsigned int i,j;
- for (i = 0; i < ehdr.e_shnum; i++) {
- struct section *sec = &secs[i];
- if (sec->shdr.sh_type != SHT_SYMTAB) {
-@@ -340,7 +373,9 @@ static void read_symtabs(FILE *fp)
-
- static void read_relocs(FILE *fp)
- {
-- int i,j;
-+ unsigned int i,j;
-+ uint32_t base;
-+
- for (i = 0; i < ehdr.e_shnum; i++) {
- struct section *sec = &secs[i];
- if (sec->shdr.sh_type != SHT_REL) {
-@@ -360,9 +395,18 @@ static void read_relocs(FILE *fp)
- die("Cannot read symbol table: %s\n",
- strerror(errno));
- }
-+ base = 0;
-+ for (j = 0; j < ehdr.e_phnum; j++) {
-+ if (phdr[j].p_type != PT_LOAD )
-+ continue;
-+ if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz)
-+ continue;
-+ base = CONFIG_PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr;
-+ break;
-+ }
- for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
- Elf32_Rel *rel = &sec->reltab[j];
-- rel->r_offset = elf32_to_cpu(rel->r_offset);
-+ rel->r_offset = elf32_to_cpu(rel->r_offset) + base;
- rel->r_info = elf32_to_cpu(rel->r_info);
- }
- }
-@@ -371,14 +415,14 @@ static void read_relocs(FILE *fp)
-
- static void print_absolute_symbols(void)
- {
-- int i;
-+ unsigned int i;
- printf("Absolute symbols\n");
- printf(" Num: Value Size Type Bind Visibility Name\n");
- for (i = 0; i < ehdr.e_shnum; i++) {
- struct section *sec = &secs[i];
- char *sym_strtab;
- Elf32_Sym *sh_symtab;
-- int j;
-+ unsigned int j;
-
- if (sec->shdr.sh_type != SHT_SYMTAB) {
- continue;
-@@ -406,14 +450,14 @@ static void print_absolute_symbols(void)
-
- static void print_absolute_relocs(void)
- {
-- int i, printed = 0;
-+ unsigned int i, printed = 0;
-
- for (i = 0; i < ehdr.e_shnum; i++) {
- struct section *sec = &secs[i];
- struct section *sec_applies, *sec_symtab;
- char *sym_strtab;
- Elf32_Sym *sh_symtab;
-- int j;
-+ unsigned int j;
- if (sec->shdr.sh_type != SHT_REL) {
- continue;
- }
-@@ -474,13 +518,13 @@ static void print_absolute_relocs(void)
-
- static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
- {
-- int i;
-+ unsigned int i;
- /* Walk through the relocations */
- for (i = 0; i < ehdr.e_shnum; i++) {
- char *sym_strtab;
- Elf32_Sym *sh_symtab;
- struct section *sec_applies, *sec_symtab;
-- int j;
-+ unsigned int j;
- struct section *sec = &secs[i];
-
- if (sec->shdr.sh_type != SHT_REL) {
-@@ -504,6 +548,21 @@ static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
- if (sym->st_shndx == SHN_ABS) {
- continue;
- }
-+ /* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */
-+ if (!strcmp(sec_name(sym->st_shndx), ".data.percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load"))
-+ continue;
-+
-+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32)
-+ /* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
-+ if (!strcmp(sec_name(sym->st_shndx), ".text.end") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
-+ continue;
-+ if (!strcmp(sec_name(sym->st_shndx), ".init.text"))
-+ continue;
-+ if (!strcmp(sec_name(sym->st_shndx), ".exit.text"))
-+ continue;
-+ if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR"))
-+ continue;
-+#endif
- if (r_type == R_386_NONE || r_type == R_386_PC32) {
- /*
- * NONE can be ignored and and PC relative
-@@ -541,7 +600,7 @@ static int cmp_relocs(const void *va, const void *vb)
-
- static void emit_relocs(int as_text)
- {
-- int i;
-+ unsigned int i;
- /* Count how many relocations I have and allocate space for them. */
- reloc_count = 0;
- walk_relocs(count_reloc);
-@@ -634,6 +693,7 @@ int main(int argc, char **argv)
- fname, strerror(errno));
- }
- read_ehdr(fp);
-+ read_phdrs(fp);
- read_shdrs(fp);
- read_strtabs(fp);
- read_symtabs(fp);
-diff --git a/arch/x86/boot/cpucheck.c b/arch/x86/boot/cpucheck.c
-index 4d3ff03..e4972ff 100644
---- a/arch/x86/boot/cpucheck.c
-+++ b/arch/x86/boot/cpucheck.c
-@@ -74,7 +74,7 @@ static int has_fpu(void)
- u16 fcw = -1, fsw = -1;
- u32 cr0;
-
-- asm("movl %%cr0,%0" : "=r" (cr0));
-+ asm volatile("movl %%cr0,%0" : "=r" (cr0));
- if (cr0 & (X86_CR0_EM|X86_CR0_TS)) {
- cr0 &= ~(X86_CR0_EM|X86_CR0_TS);
- asm volatile("movl %0,%%cr0" : : "r" (cr0));
-@@ -90,7 +90,7 @@ static int has_eflag(u32 mask)
- {
- u32 f0, f1;
-
-- asm("pushfl ; "
-+ asm volatile("pushfl ; "
- "pushfl ; "
- "popl %0 ; "
- "movl %0,%1 ; "
-@@ -115,7 +115,7 @@ static void get_flags(void)
- set_bit(X86_FEATURE_FPU, cpu.flags);
-
- if (has_eflag(X86_EFLAGS_ID)) {
-- asm("cpuid"
-+ asm volatile("cpuid"
- : "=a" (max_intel_level),
- "=b" (cpu_vendor[0]),
- "=d" (cpu_vendor[1]),
-@@ -124,7 +124,7 @@ static void get_flags(void)
-
- if (max_intel_level >= 0x00000001 &&
- max_intel_level <= 0x0000ffff) {
-- asm("cpuid"
-+ asm volatile("cpuid"
- : "=a" (tfms),
- "=c" (cpu.flags[4]),
- "=d" (cpu.flags[0])
-@@ -136,7 +136,7 @@ static void get_flags(void)
- cpu.model += ((tfms >> 16) & 0xf) << 4;
- }
-
-- asm("cpuid"
-+ asm volatile("cpuid"
- : "=a" (max_amd_level)
- : "a" (0x80000000)
- : "ebx", "ecx", "edx");
-@@ -144,7 +144,7 @@ static void get_flags(void)
- if (max_amd_level >= 0x80000001 &&
- max_amd_level <= 0x8000ffff) {
- u32 eax = 0x80000001;
-- asm("cpuid"
-+ asm volatile("cpuid"
- : "+a" (eax),
- "=c" (cpu.flags[6]),
- "=d" (cpu.flags[1])
-@@ -203,9 +203,9 @@ int check_cpu(int *cpu_level_ptr, int *req_level_ptr, u32 **err_flags_ptr)
- u32 ecx = MSR_K7_HWCR;
- u32 eax, edx;
-
-- asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
-+ asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
- eax &= ~(1 << 15);
-- asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
-+ asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
-
- get_flags(); /* Make sure it really did something */
- err = check_flags();
-@@ -218,9 +218,9 @@ int check_cpu(int *cpu_level_ptr, int *req_level_ptr, u32 **err_flags_ptr)
- u32 ecx = MSR_VIA_FCR;
- u32 eax, edx;
-
-- asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
-+ asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
- eax |= (1<<1)|(1<<7);
-- asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
-+ asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
-
- set_bit(X86_FEATURE_CX8, cpu.flags);
- err = check_flags();
-@@ -231,12 +231,12 @@ int check_cpu(int *cpu_level_ptr, int *req_level_ptr, u32 **err_flags_ptr)
- u32 eax, edx;
- u32 level = 1;
-
-- asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
-- asm("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
-- asm("cpuid"
-+ asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
-+ asm volatile("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
-+ asm volatile("cpuid"
- : "+a" (level), "=d" (cpu.flags[0])
- : : "ecx", "ebx");
-- asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
-+ asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
-
- err = check_flags();
- }
-diff --git a/arch/x86/boot/header.S b/arch/x86/boot/header.S
-index b31cc54..afdbea1 100644
---- a/arch/x86/boot/header.S
-+++ b/arch/x86/boot/header.S
-@@ -224,10 +224,14 @@ setup_data: .quad 0 # 64-bit physical pointer to
- # single linked list of
- # struct setup_data
-
--pref_address: .quad LOAD_PHYSICAL_ADDR # preferred load addr
-+pref_address: .quad ____LOAD_PHYSICAL_ADDR # preferred load addr
-
- #define ZO_INIT_SIZE (ZO__end - ZO_startup_32 + ZO_z_extract_offset)
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+#define VO_INIT_SIZE (VO__end - VO__text - __PAGE_OFFSET - ____LOAD_PHYSICAL_ADDR)
-+#else
- #define VO_INIT_SIZE (VO__end - VO__text)
-+#endif
- #if ZO_INIT_SIZE > VO_INIT_SIZE
- #define INIT_SIZE ZO_INIT_SIZE
- #else
-diff --git a/arch/x86/boot/memory.c b/arch/x86/boot/memory.c
-index cae3feb..ff8ff2a 100644
---- a/arch/x86/boot/memory.c
-+++ b/arch/x86/boot/memory.c
-@@ -19,7 +19,7 @@
-
- static int detect_memory_e820(void)
- {
-- int count = 0;
-+ unsigned int count = 0;
- struct biosregs ireg, oreg;
- struct e820entry *desc = boot_params.e820_map;
- static struct e820entry buf; /* static so it is zeroed */
-diff --git a/arch/x86/boot/video-vesa.c b/arch/x86/boot/video-vesa.c
-index 11e8c6e..fdbb1ed 100644
---- a/arch/x86/boot/video-vesa.c
-+++ b/arch/x86/boot/video-vesa.c
-@@ -200,6 +200,7 @@ static void vesa_store_pm_info(void)
-
- boot_params.screen_info.vesapm_seg = oreg.es;
- boot_params.screen_info.vesapm_off = oreg.di;
-+ boot_params.screen_info.vesapm_size = oreg.cx;
- }
-
- /*
-diff --git a/arch/x86/boot/video-vga.c b/arch/x86/boot/video-vga.c
-index 819caa1..f32eba9 100644
---- a/arch/x86/boot/video-vga.c
-+++ b/arch/x86/boot/video-vga.c
-@@ -41,13 +41,12 @@ static __videocard video_vga;
- static u8 vga_set_basic_mode(void)
- {
- struct biosregs ireg, oreg;
-- u16 ax;
- u8 rows;
- u8 mode;
-
- initregs(&ireg);
-
-- ax = 0x0f00;
-+ ireg.ax = 0x0f00;
- intcall(0x10, &ireg, &oreg);
- mode = oreg.al;
-
-diff --git a/arch/x86/boot/video.c b/arch/x86/boot/video.c
-index d42da38..787cdf3 100644
---- a/arch/x86/boot/video.c
-+++ b/arch/x86/boot/video.c
-@@ -90,7 +90,7 @@ static void store_mode_params(void)
- static unsigned int get_entry(void)
- {
- char entry_buf[4];
-- int i, len = 0;
-+ unsigned int i, len = 0;
- int key;
- unsigned int v;
-
-diff --git a/arch/x86/crypto/aes-x86_64-asm_64.S b/arch/x86/crypto/aes-x86_64-asm_64.S
-index 5b577d5..3c1fed4 100644
---- a/arch/x86/crypto/aes-x86_64-asm_64.S
-+++ b/arch/x86/crypto/aes-x86_64-asm_64.S
-@@ -8,6 +8,8 @@
- * including this sentence is retained in full.
- */
-
-+#include <asm/alternative-asm.h>
-+
- .extern crypto_ft_tab
- .extern crypto_it_tab
- .extern crypto_fl_tab
-@@ -71,6 +73,8 @@ FUNC: movq r1,r2; \
- je B192; \
- leaq 32(r9),r9;
-
-+#define ret pax_force_retaddr 0, 1; ret
-+
- #define epilogue(r1,r2,r3,r4,r5,r6,r7,r8,r9) \
- movq r1,r2; \
- movq r3,r4; \
-diff --git a/arch/x86/crypto/aesni-intel_asm.S b/arch/x86/crypto/aesni-intel_asm.S
-index eb0566e..e3ebad8 100644
---- a/arch/x86/crypto/aesni-intel_asm.S
-+++ b/arch/x86/crypto/aesni-intel_asm.S
-@@ -16,6 +16,7 @@
- */
-
- #include <linux/linkage.h>
-+#include <asm/alternative-asm.h>
-
- .text
-
-@@ -52,6 +53,7 @@ _key_expansion_256a:
- pxor %xmm1, %xmm0
- movaps %xmm0, (%rcx)
- add $0x10, %rcx
-+ pax_force_retaddr_bts
- ret
-
- _key_expansion_192a:
-@@ -75,6 +77,7 @@ _key_expansion_192a:
- shufps $0b01001110, %xmm2, %xmm1
- movaps %xmm1, 16(%rcx)
- add $0x20, %rcx
-+ pax_force_retaddr_bts
- ret
-
- _key_expansion_192b:
-@@ -93,6 +96,7 @@ _key_expansion_192b:
-
- movaps %xmm0, (%rcx)
- add $0x10, %rcx
-+ pax_force_retaddr_bts
- ret
-
- _key_expansion_256b:
-@@ -104,6 +108,7 @@ _key_expansion_256b:
- pxor %xmm1, %xmm2
- movaps %xmm2, (%rcx)
- add $0x10, %rcx
-+ pax_force_retaddr_bts
- ret
-
- /*
-@@ -239,7 +244,9 @@ ENTRY(aesni_set_key)
- cmp %rcx, %rdi
- jb .Ldec_key_loop
- xor %rax, %rax
-+ pax_force_retaddr 0, 1
- ret
-+ENDPROC(aesni_set_key)
-
- /*
- * void aesni_enc(struct crypto_aes_ctx *ctx, u8 *dst, const u8 *src)
-@@ -249,7 +256,9 @@ ENTRY(aesni_enc)
- movups (INP), STATE # input
- call _aesni_enc1
- movups STATE, (OUTP) # output
-+ pax_force_retaddr 0, 1
- ret
-+ENDPROC(aesni_enc)
-
- /*
- * _aesni_enc1: internal ABI
-@@ -319,6 +328,7 @@ _aesni_enc1:
- movaps 0x70(TKEYP), KEY
- # aesenclast KEY, STATE # last round
- .byte 0x66, 0x0f, 0x38, 0xdd, 0xc2
-+ pax_force_retaddr_bts
- ret
-
- /*
-@@ -482,6 +492,7 @@ _aesni_enc4:
- .byte 0x66, 0x0f, 0x38, 0xdd, 0xea
- # aesenclast KEY, STATE4
- .byte 0x66, 0x0f, 0x38, 0xdd, 0xf2
-+ pax_force_retaddr_bts
- ret
-
- /*
-@@ -493,7 +504,9 @@ ENTRY(aesni_dec)
- movups (INP), STATE # input
- call _aesni_dec1
- movups STATE, (OUTP) #output
-+ pax_force_retaddr 0, 1
- ret
-+ENDPROC(aesni_dec)
-
- /*
- * _aesni_dec1: internal ABI
-@@ -563,6 +576,7 @@ _aesni_dec1:
- movaps 0x70(TKEYP), KEY
- # aesdeclast KEY, STATE # last round
- .byte 0x66, 0x0f, 0x38, 0xdf, 0xc2
-+ pax_force_retaddr_bts
- ret
-
- /*
-@@ -726,6 +740,7 @@ _aesni_dec4:
- .byte 0x66, 0x0f, 0x38, 0xdf, 0xea
- # aesdeclast KEY, STATE4
- .byte 0x66, 0x0f, 0x38, 0xdf, 0xf2
-+ pax_force_retaddr_bts
- ret
-
- /*
-@@ -769,7 +784,9 @@ ENTRY(aesni_ecb_enc)
- cmp $16, LEN
- jge .Lecb_enc_loop1
- .Lecb_enc_ret:
-+ pax_force_retaddr 0, 1
- ret
-+ENDPROC(aesni_ecb_enc)
-
- /*
- * void aesni_ecb_dec(struct crypto_aes_ctx *ctx, const u8 *dst, u8 *src,
-@@ -813,7 +830,9 @@ ENTRY(aesni_ecb_dec)
- cmp $16, LEN
- jge .Lecb_dec_loop1
- .Lecb_dec_ret:
-+ pax_force_retaddr 0, 1
- ret
-+ENDPROC(aesni_ecb_dec)
-
- /*
- * void aesni_cbc_enc(struct crypto_aes_ctx *ctx, const u8 *dst, u8 *src,
-@@ -837,7 +856,9 @@ ENTRY(aesni_cbc_enc)
- jge .Lcbc_enc_loop
- movups STATE, (IVP)
- .Lcbc_enc_ret:
-+ pax_force_retaddr 0, 1
- ret
-+ENDPROC(aesni_cbc_enc)
-
- /*
- * void aesni_cbc_dec(struct crypto_aes_ctx *ctx, const u8 *dst, u8 *src,
-@@ -894,4 +915,6 @@ ENTRY(aesni_cbc_dec)
- .Lcbc_dec_ret:
- movups IV, (IVP)
- .Lcbc_dec_just_ret:
-+ pax_force_retaddr 0, 1
- ret
-+ENDPROC(aesni_cbc_dec)
-diff --git a/arch/x86/crypto/salsa20-x86_64-asm_64.S b/arch/x86/crypto/salsa20-x86_64-asm_64.S
-index 6214a9b..1f4fc9a 100644
---- a/arch/x86/crypto/salsa20-x86_64-asm_64.S
-+++ b/arch/x86/crypto/salsa20-x86_64-asm_64.S
-@@ -1,3 +1,5 @@
-+#include <asm/alternative-asm.h>
-+
- # enter ECRYPT_encrypt_bytes
- .text
- .p2align 5
-@@ -790,6 +792,7 @@ ECRYPT_encrypt_bytes:
- add %r11,%rsp
- mov %rdi,%rax
- mov %rsi,%rdx
-+ pax_force_retaddr 0, 1
- ret
- # bytesatleast65:
- ._bytesatleast65:
-@@ -891,6 +894,7 @@ ECRYPT_keysetup:
- add %r11,%rsp
- mov %rdi,%rax
- mov %rsi,%rdx
-+ pax_force_retaddr
- ret
- # enter ECRYPT_ivsetup
- .text
-@@ -917,4 +921,5 @@ ECRYPT_ivsetup:
- add %r11,%rsp
- mov %rdi,%rax
- mov %rsi,%rdx
-+ pax_force_retaddr
- ret
-diff --git a/arch/x86/crypto/twofish-x86_64-asm_64.S b/arch/x86/crypto/twofish-x86_64-asm_64.S
-index 35974a5..5662ae2 100644
---- a/arch/x86/crypto/twofish-x86_64-asm_64.S
-+++ b/arch/x86/crypto/twofish-x86_64-asm_64.S
-@@ -21,6 +21,7 @@
- .text
-
- #include <asm/asm-offsets.h>
-+#include <asm/alternative-asm.h>
-
- #define a_offset 0
- #define b_offset 4
-@@ -269,6 +270,7 @@ twofish_enc_blk:
-
- popq R1
- movq $1,%rax
-+ pax_force_retaddr 0, 1
- ret
-
- twofish_dec_blk:
-@@ -321,4 +323,5 @@ twofish_dec_blk:
-
- popq R1
- movq $1,%rax
-+ pax_force_retaddr 0, 1
- ret
-diff --git a/arch/x86/ia32/ia32_aout.c b/arch/x86/ia32/ia32_aout.c
-index 14531ab..bc68a7b 100644
---- a/arch/x86/ia32/ia32_aout.c
-+++ b/arch/x86/ia32/ia32_aout.c
-@@ -169,6 +169,8 @@ static int aout_core_dump(long signr, struct pt_regs *regs, struct file *file,
- unsigned long dump_start, dump_size;
- struct user32 dump;
-
-+ memset(&dump, 0, sizeof(dump));
-+
- fs = get_fs();
- set_fs(KERNEL_DS);
- has_dumped = 1;
-@@ -218,12 +220,6 @@ static int aout_core_dump(long signr, struct pt_regs *regs, struct file *file,
- dump_size = dump.u_ssize << PAGE_SHIFT;
- DUMP_WRITE(dump_start, dump_size);
- }
-- /*
-- * Finally dump the task struct. Not be used by gdb, but
-- * could be useful
-- */
-- set_fs(KERNEL_DS);
-- DUMP_WRITE(current, sizeof(*current));
- end_coredump:
- set_fs(fs);
- return has_dumped;
-@@ -327,6 +323,13 @@ static int load_aout_binary(struct linux_binprm *bprm, struct pt_regs *regs)
- current->mm->free_area_cache = TASK_UNMAPPED_BASE;
- current->mm->cached_hole_size = 0;
-
-+ retval = setup_arg_pages(bprm, IA32_STACK_TOP, EXSTACK_DEFAULT);
-+ if (retval < 0) {
-+ /* Someone check-me: is this error path enough? */
-+ send_sig(SIGKILL, current, 0);
-+ return retval;
-+ }
-+
- install_exec_creds(bprm);
- current->flags &= ~PF_FORKNOEXEC;
-
-@@ -422,13 +425,6 @@ beyond_if:
-
- set_brk(current->mm->start_brk, current->mm->brk);
-
-- retval = setup_arg_pages(bprm, IA32_STACK_TOP, EXSTACK_DEFAULT);
-- if (retval < 0) {
-- /* Someone check-me: is this error path enough? */
-- send_sig(SIGKILL, current, 0);
-- return retval;
-- }
--
- current->mm->start_stack =
- (unsigned long)create_aout_tables((char __user *)bprm->p, bprm);
- /* start thread */
-diff --git a/arch/x86/ia32/ia32_signal.c b/arch/x86/ia32/ia32_signal.c
-index 588a7aa..a3468b0 100644
---- a/arch/x86/ia32/ia32_signal.c
-+++ b/arch/x86/ia32/ia32_signal.c
-@@ -167,7 +167,7 @@ asmlinkage long sys32_sigaltstack(const stack_ia32_t __user *uss_ptr,
- }
- seg = get_fs();
- set_fs(KERNEL_DS);
-- ret = do_sigaltstack(uss_ptr ? &uss : NULL, &uoss, regs->sp);
-+ ret = do_sigaltstack(uss_ptr ? (const stack_t __force_user *)&uss : NULL, (stack_t __force_user *)&uoss, regs->sp);
- set_fs(seg);
- if (ret >= 0 && uoss_ptr) {
- if (!access_ok(VERIFY_WRITE, uoss_ptr, sizeof(stack_ia32_t)))
-@@ -374,7 +374,7 @@ static int ia32_setup_sigcontext(struct sigcontext_ia32 __user *sc,
- */
- static void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
- size_t frame_size,
-- void **fpstate)
-+ void __user **fpstate)
- {
- unsigned long sp;
-
-@@ -395,7 +395,7 @@ static void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
-
- if (used_math()) {
- sp = sp - sig_xstate_ia32_size;
-- *fpstate = (struct _fpstate_ia32 *) sp;
-+ *fpstate = (struct _fpstate_ia32 __user *) sp;
- if (save_i387_xstate_ia32(*fpstate) < 0)
- return (void __user *) -1L;
- }
-@@ -403,7 +403,7 @@ static void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
- sp -= frame_size;
- /* Align the stack pointer according to the i386 ABI,
- * i.e. so that on function entry ((sp + 4) & 15) == 0. */
-- sp = ((sp + 4) & -16ul) - 4;
-+ sp = ((sp - 12) & -16ul) - 4;
- return (void __user *) sp;
- }
-
-@@ -461,7 +461,7 @@ int ia32_setup_frame(int sig, struct k_sigaction *ka,
- * These are actually not used anymore, but left because some
- * gdb versions depend on them as a marker.
- */
-- put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
-+ put_user_ex(*((const u64 *)&code), (u64 __user *)frame->retcode);
- } put_user_catch(err);
-
- if (err)
-@@ -503,7 +503,7 @@ int ia32_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
- 0xb8,
- __NR_ia32_rt_sigreturn,
- 0x80cd,
-- 0,
-+ 0
- };
-
- frame = get_sigframe(ka, regs, sizeof(*frame), &fpstate);
-@@ -533,16 +533,18 @@ int ia32_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
-
- if (ka->sa.sa_flags & SA_RESTORER)
- restorer = ka->sa.sa_restorer;
-+ else if (current->mm->context.vdso)
-+ /* Return stub is in 32bit vsyscall page */
-+ restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
- else
-- restorer = VDSO32_SYMBOL(current->mm->context.vdso,
-- rt_sigreturn);
-+ restorer = &frame->retcode;
- put_user_ex(ptr_to_compat(restorer), &frame->pretcode);
-
- /*
- * Not actually used anymore, but left because some gdb
- * versions need it.
- */
-- put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
-+ put_user_ex(*((const u64 *)&code), (u64 __user *)frame->retcode);
- } put_user_catch(err);
-
- if (err)
-diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
-index 4edd8eb..273579e 100644
---- a/arch/x86/ia32/ia32entry.S
-+++ b/arch/x86/ia32/ia32entry.S
-@@ -13,7 +13,9 @@
- #include <asm/thread_info.h>
- #include <asm/segment.h>
- #include <asm/irqflags.h>
-+#include <asm/pgtable.h>
- #include <linux/linkage.h>
-+#include <asm/alternative-asm.h>
-
- /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
- #include <linux/elf-em.h>
-@@ -93,6 +95,32 @@ ENTRY(native_irq_enable_sysexit)
- ENDPROC(native_irq_enable_sysexit)
- #endif
-
-+ .macro pax_enter_kernel_user
-+ pax_set_fptr_mask
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ call pax_enter_kernel_user
-+#endif
-+ .endm
-+
-+ .macro pax_exit_kernel_user
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ call pax_exit_kernel_user
-+#endif
-+#ifdef CONFIG_PAX_RANDKSTACK
-+ pushq %rax
-+ pushq %r11
-+ call pax_randomize_kstack
-+ popq %r11
-+ popq %rax
-+#endif
-+ .endm
-+
-+.macro pax_erase_kstack
-+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
-+ call pax_erase_kstack
-+#endif
-+.endm
-+
- /*
- * 32bit SYSENTER instruction entry.
- *
-@@ -119,12 +147,6 @@ ENTRY(ia32_sysenter_target)
- CFI_REGISTER rsp,rbp
- SWAPGS_UNSAFE_STACK
- movq PER_CPU_VAR(kernel_stack), %rsp
-- addq $(KERNEL_STACK_OFFSET),%rsp
-- /*
-- * No need to follow this irqs on/off section: the syscall
-- * disabled irqs, here we enable it straight after entry:
-- */
-- ENABLE_INTERRUPTS(CLBR_NONE)
- movl %ebp,%ebp /* zero extension */
- pushq $__USER32_DS
- CFI_ADJUST_CFA_OFFSET 8
-@@ -135,28 +157,47 @@ ENTRY(ia32_sysenter_target)
- pushfq
- CFI_ADJUST_CFA_OFFSET 8
- /*CFI_REL_OFFSET rflags,0*/
-- movl 8*3-THREAD_SIZE+TI_sysenter_return(%rsp), %r10d
-- CFI_REGISTER rip,r10
-+ orl $X86_EFLAGS_IF,(%rsp)
-+ GET_THREAD_INFO(%r11)
-+ movl TI_sysenter_return(%r11), %r11d
-+ CFI_REGISTER rip,r11
- pushq $__USER32_CS
- CFI_ADJUST_CFA_OFFSET 8
- /*CFI_REL_OFFSET cs,0*/
- movl %eax, %eax
-- pushq %r10
-+ pushq %r11
- CFI_ADJUST_CFA_OFFSET 8
- CFI_REL_OFFSET rip,0
- pushq %rax
- CFI_ADJUST_CFA_OFFSET 8
- cld
- SAVE_ARGS 0,0,1
-+ pax_enter_kernel_user
-+
-+#ifdef CONFIG_PAX_RANDKSTACK
-+ pax_erase_kstack
-+#endif
-+
-+ /*
-+ * No need to follow this irqs on/off section: the syscall
-+ * disabled irqs, here we enable it straight after entry:
-+ */
-+ ENABLE_INTERRUPTS(CLBR_NONE)
- /* no need to do an access_ok check here because rbp has been
- 32bit zero extended */
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ mov $PAX_USER_SHADOW_BASE,%r11
-+ add %r11,%rbp
-+#endif
-+
- 1: movl (%rbp),%ebp
- .section __ex_table,"a"
- .quad 1b,ia32_badarg
- .previous
-- GET_THREAD_INFO(%r10)
-- orl $TS_COMPAT,TI_status(%r10)
-- testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
-+ GET_THREAD_INFO(%r11)
-+ orl $TS_COMPAT,TI_status(%r11)
-+ testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r11)
- CFI_REMEMBER_STATE
- jnz sysenter_tracesys
- cmpq $(IA32_NR_syscalls-1),%rax
-@@ -166,13 +207,15 @@ sysenter_do_call:
- sysenter_dispatch:
- call *ia32_sys_call_table(,%rax,8)
- movq %rax,RAX-ARGOFFSET(%rsp)
-- GET_THREAD_INFO(%r10)
-+ GET_THREAD_INFO(%r11)
- DISABLE_INTERRUPTS(CLBR_NONE)
- TRACE_IRQS_OFF
-- testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
-+ testl $_TIF_ALLWORK_MASK,TI_flags(%r11)
- jnz sysexit_audit
- sysexit_from_sys_call:
-- andl $~TS_COMPAT,TI_status(%r10)
-+ pax_exit_kernel_user
-+ pax_erase_kstack
-+ andl $~TS_COMPAT,TI_status(%r11)
- /* clear IF, that popfq doesn't enable interrupts early */
- andl $~0x200,EFLAGS-R11(%rsp)
- movl RIP-R11(%rsp),%edx /* User %eip */
-@@ -200,6 +243,9 @@ sysexit_from_sys_call:
- movl %eax,%esi /* 2nd arg: syscall number */
- movl $AUDIT_ARCH_I386,%edi /* 1st arg: audit arch */
- call audit_syscall_entry
-+
-+ pax_erase_kstack
-+
- movl RAX-ARGOFFSET(%rsp),%eax /* reload syscall number */
- cmpq $(IA32_NR_syscalls-1),%rax
- ja ia32_badsys
-@@ -211,7 +257,7 @@ sysexit_from_sys_call:
- .endm
-
- .macro auditsys_exit exit
-- testl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),TI_flags(%r10)
-+ testl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),TI_flags(%r11)
- jnz ia32_ret_from_sys_call
- TRACE_IRQS_ON
- sti
-@@ -221,12 +267,12 @@ sysexit_from_sys_call:
- movzbl %al,%edi /* zero-extend that into %edi */
- inc %edi /* first arg, 0->1(AUDITSC_SUCCESS), 1->2(AUDITSC_FAILURE) */
- call audit_syscall_exit
-- GET_THREAD_INFO(%r10)
-+ GET_THREAD_INFO(%r11)
- movl RAX-ARGOFFSET(%rsp),%eax /* reload syscall return value */
- movl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),%edi
- cli
- TRACE_IRQS_OFF
-- testl %edi,TI_flags(%r10)
-+ testl %edi,TI_flags(%r11)
- jz \exit
- CLEAR_RREGS -ARGOFFSET
- jmp int_with_check
-@@ -244,7 +290,7 @@ sysexit_audit:
-
- sysenter_tracesys:
- #ifdef CONFIG_AUDITSYSCALL
-- testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%r10)
-+ testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%r11)
- jz sysenter_auditsys
- #endif
- SAVE_REST
-@@ -256,6 +302,9 @@ sysenter_tracesys:
- RESTORE_REST
- cmpq $(IA32_NR_syscalls-1),%rax
- ja int_ret_from_sys_call /* sysenter_tracesys has set RAX(%rsp) */
-+
-+ pax_erase_kstack
-+
- jmp sysenter_do_call
- CFI_ENDPROC
- ENDPROC(ia32_sysenter_target)
-@@ -283,19 +332,25 @@ ENDPROC(ia32_sysenter_target)
- ENTRY(ia32_cstar_target)
- CFI_STARTPROC32 simple
- CFI_SIGNAL_FRAME
-- CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
-+ CFI_DEF_CFA rsp,0
- CFI_REGISTER rip,rcx
- /*CFI_REGISTER rflags,r11*/
- SWAPGS_UNSAFE_STACK
- movl %esp,%r8d
- CFI_REGISTER rsp,r8
- movq PER_CPU_VAR(kernel_stack),%rsp
-+ SAVE_ARGS 8*6,1,1
-+ pax_enter_kernel_user
-+
-+#ifdef CONFIG_PAX_RANDKSTACK
-+ pax_erase_kstack
-+#endif
-+
- /*
- * No need to follow this irqs on/off section: the syscall
- * disabled irqs and here we enable it straight after entry:
- */
- ENABLE_INTERRUPTS(CLBR_NONE)
-- SAVE_ARGS 8,1,1
- movl %eax,%eax /* zero extension */
- movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
- movq %rcx,RIP-ARGOFFSET(%rsp)
-@@ -311,13 +366,19 @@ ENTRY(ia32_cstar_target)
- /* no need to do an access_ok check here because r8 has been
- 32bit zero extended */
- /* hardware stack frame is complete now */
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ mov $PAX_USER_SHADOW_BASE,%r11
-+ add %r11,%r8
-+#endif
-+
- 1: movl (%r8),%r9d
- .section __ex_table,"a"
- .quad 1b,ia32_badarg
- .previous
-- GET_THREAD_INFO(%r10)
-- orl $TS_COMPAT,TI_status(%r10)
-- testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
-+ GET_THREAD_INFO(%r11)
-+ orl $TS_COMPAT,TI_status(%r11)
-+ testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r11)
- CFI_REMEMBER_STATE
- jnz cstar_tracesys
- cmpq $IA32_NR_syscalls-1,%rax
-@@ -327,13 +388,15 @@ cstar_do_call:
- cstar_dispatch:
- call *ia32_sys_call_table(,%rax,8)
- movq %rax,RAX-ARGOFFSET(%rsp)
-- GET_THREAD_INFO(%r10)
-+ GET_THREAD_INFO(%r11)
- DISABLE_INTERRUPTS(CLBR_NONE)
- TRACE_IRQS_OFF
-- testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
-+ testl $_TIF_ALLWORK_MASK,TI_flags(%r11)
- jnz sysretl_audit
- sysretl_from_sys_call:
-- andl $~TS_COMPAT,TI_status(%r10)
-+ pax_exit_kernel_user
-+ pax_erase_kstack
-+ andl $~TS_COMPAT,TI_status(%r11)
- RESTORE_ARGS 1,-ARG_SKIP,1,1,1
- movl RIP-ARGOFFSET(%rsp),%ecx
- CFI_REGISTER rip,rcx
-@@ -361,7 +424,7 @@ sysretl_audit:
-
- cstar_tracesys:
- #ifdef CONFIG_AUDITSYSCALL
-- testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%r10)
-+ testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%r11)
- jz cstar_auditsys
- #endif
- xchgl %r9d,%ebp
-@@ -375,6 +438,9 @@ cstar_tracesys:
- xchgl %ebp,%r9d
- cmpq $(IA32_NR_syscalls-1),%rax
- ja int_ret_from_sys_call /* cstar_tracesys has set RAX(%rsp) */
-+
-+ pax_erase_kstack
-+
- jmp cstar_do_call
- END(ia32_cstar_target)
-
-@@ -415,11 +481,6 @@ ENTRY(ia32_syscall)
- CFI_REL_OFFSET rip,RIP-RIP
- PARAVIRT_ADJUST_EXCEPTION_FRAME
- SWAPGS
-- /*
-- * No need to follow this irqs on/off section: the syscall
-- * disabled irqs and here we enable it straight after entry:
-- */
-- ENABLE_INTERRUPTS(CLBR_NONE)
- movl %eax,%eax
- pushq %rax
- CFI_ADJUST_CFA_OFFSET 8
-@@ -427,9 +488,20 @@ ENTRY(ia32_syscall)
- /* note the registers are not zero extended to the sf.
- this could be a problem. */
- SAVE_ARGS 0,0,1
-- GET_THREAD_INFO(%r10)
-- orl $TS_COMPAT,TI_status(%r10)
-- testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
-+ pax_enter_kernel_user
-+
-+#ifdef CONFIG_PAX_RANDKSTACK
-+ pax_erase_kstack
-+#endif
-+
-+ /*
-+ * No need to follow this irqs on/off section: the syscall
-+ * disabled irqs and here we enable it straight after entry:
-+ */
-+ ENABLE_INTERRUPTS(CLBR_NONE)
-+ GET_THREAD_INFO(%r11)
-+ orl $TS_COMPAT,TI_status(%r11)
-+ testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r11)
- jnz ia32_tracesys
- cmpq $(IA32_NR_syscalls-1),%rax
- ja ia32_badsys
-@@ -452,6 +524,9 @@ ia32_tracesys:
- RESTORE_REST
- cmpq $(IA32_NR_syscalls-1),%rax
- ja int_ret_from_sys_call /* ia32_tracesys has set RAX(%rsp) */
-+
-+ pax_erase_kstack
-+
- jmp ia32_do_call
- END(ia32_syscall)
-
-@@ -462,6 +537,7 @@ ia32_badsys:
-
- quiet_ni_syscall:
- movq $-ENOSYS,%rax
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
-
-diff --git a/arch/x86/ia32/sys_ia32.c b/arch/x86/ia32/sys_ia32.c
-index 016218c..47ccbdd 100644
---- a/arch/x86/ia32/sys_ia32.c
-+++ b/arch/x86/ia32/sys_ia32.c
-@@ -69,8 +69,8 @@ asmlinkage long sys32_ftruncate64(unsigned int fd, unsigned long offset_low,
- */
- static int cp_stat64(struct stat64 __user *ubuf, struct kstat *stat)
- {
-- typeof(ubuf->st_uid) uid = 0;
-- typeof(ubuf->st_gid) gid = 0;
-+ typeof(((struct stat64 *)0)->st_uid) uid = 0;
-+ typeof(((struct stat64 *)0)->st_gid) gid = 0;
- SET_UID(uid, stat->uid);
- SET_GID(gid, stat->gid);
- if (!access_ok(VERIFY_WRITE, ubuf, sizeof(struct stat64)) ||
-@@ -308,8 +308,8 @@ asmlinkage long sys32_rt_sigprocmask(int how, compat_sigset_t __user *set,
- }
- set_fs(KERNEL_DS);
- ret = sys_rt_sigprocmask(how,
-- set ? (sigset_t __user *)&s : NULL,
-- oset ? (sigset_t __user *)&s : NULL,
-+ set ? (sigset_t __force_user *)&s : NULL,
-+ oset ? (sigset_t __force_user *)&s : NULL,
- sigsetsize);
- set_fs(old_fs);
- if (ret)
-@@ -371,7 +371,7 @@ asmlinkage long sys32_sched_rr_get_interval(compat_pid_t pid,
- mm_segment_t old_fs = get_fs();
-
- set_fs(KERNEL_DS);
-- ret = sys_sched_rr_get_interval(pid, (struct timespec __user *)&t);
-+ ret = sys_sched_rr_get_interval(pid, (struct timespec __force_user *)&t);
- set_fs(old_fs);
- if (put_compat_timespec(&t, interval))
- return -EFAULT;
-@@ -387,7 +387,7 @@ asmlinkage long sys32_rt_sigpending(compat_sigset_t __user *set,
- mm_segment_t old_fs = get_fs();
-
- set_fs(KERNEL_DS);
-- ret = sys_rt_sigpending((sigset_t __user *)&s, sigsetsize);
-+ ret = sys_rt_sigpending((sigset_t __force_user *)&s, sigsetsize);
- set_fs(old_fs);
- if (!ret) {
- switch (_NSIG_WORDS) {
-@@ -412,7 +412,7 @@ asmlinkage long sys32_rt_sigqueueinfo(int pid, int sig,
- if (copy_siginfo_from_user32(&info, uinfo))
- return -EFAULT;
- set_fs(KERNEL_DS);
-- ret = sys_rt_sigqueueinfo(pid, sig, (siginfo_t __user *)&info);
-+ ret = sys_rt_sigqueueinfo(pid, sig, (siginfo_t __force_user *)&info);
- set_fs(old_fs);
- return ret;
- }
-@@ -513,7 +513,7 @@ asmlinkage long sys32_sendfile(int out_fd, int in_fd,
- return -EFAULT;
-
- set_fs(KERNEL_DS);
-- ret = sys_sendfile(out_fd, in_fd, offset ? (off_t __user *)&of : NULL,
-+ ret = sys_sendfile(out_fd, in_fd, offset ? (off_t __force_user *)&of : NULL,
- count);
- set_fs(old_fs);
-
-diff --git a/arch/x86/include/asm/alternative-asm.h b/arch/x86/include/asm/alternative-asm.h
-index e2077d3..17d07ad 100644
---- a/arch/x86/include/asm/alternative-asm.h
-+++ b/arch/x86/include/asm/alternative-asm.h
-@@ -8,10 +8,10 @@
-
- #ifdef CONFIG_SMP
- .macro LOCK_PREFIX
--1: lock
-+672: lock
- .section .smp_locks,"a"
- .align 4
-- X86_ALIGN 1b
-+ X86_ALIGN 672b
- .previous
- .endm
- #else
-@@ -19,4 +19,43 @@
- .endm
- #endif
-
-+#ifdef KERNEXEC_PLUGIN
-+ .macro pax_force_retaddr_bts rip=0
-+ btsq $63,\rip(%rsp)
-+ .endm
-+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_BTS
-+ .macro pax_force_retaddr rip=0, reload=0
-+ btsq $63,\rip(%rsp)
-+ .endm
-+ .macro pax_force_fptr ptr
-+ btsq $63,\ptr
-+ .endm
-+ .macro pax_set_fptr_mask
-+ .endm
-+#endif
-+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR
-+ .macro pax_force_retaddr rip=0, reload=0
-+ .if \reload
-+ pax_set_fptr_mask
-+ .endif
-+ orq %r10,\rip(%rsp)
-+ .endm
-+ .macro pax_force_fptr ptr
-+ orq %r10,\ptr
-+ .endm
-+ .macro pax_set_fptr_mask
-+ movabs $0x8000000000000000,%r10
-+ .endm
-+#endif
-+#else
-+ .macro pax_force_retaddr rip=0, reload=0
-+ .endm
-+ .macro pax_force_fptr ptr
-+ .endm
-+ .macro pax_force_retaddr_bts rip=0
-+ .endm
-+ .macro pax_set_fptr_mask
-+ .endm
-+#endif
-+
- #endif /* __ASSEMBLY__ */
-diff --git a/arch/x86/include/asm/alternative.h b/arch/x86/include/asm/alternative.h
-index c240efc..fdfadf3 100644
---- a/arch/x86/include/asm/alternative.h
-+++ b/arch/x86/include/asm/alternative.h
-@@ -85,7 +85,7 @@ static inline void alternatives_smp_switch(int smp) {}
- " .byte 662b-661b\n" /* sourcelen */ \
- " .byte 664f-663f\n" /* replacementlen */ \
- ".previous\n" \
-- ".section .altinstr_replacement, \"ax\"\n" \
-+ ".section .altinstr_replacement, \"a\"\n" \
- "663:\n\t" newinstr "\n664:\n" /* replacement */ \
- ".previous"
-
-diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h
-index 474d80d..1f97d58 100644
---- a/arch/x86/include/asm/apic.h
-+++ b/arch/x86/include/asm/apic.h
-@@ -46,7 +46,7 @@ static inline void generic_apic_probe(void)
-
- #ifdef CONFIG_X86_LOCAL_APIC
-
--extern unsigned int apic_verbosity;
-+extern int apic_verbosity;
- extern int local_apic_timer_c2_ok;
-
- extern int disable_apic;
-diff --git a/arch/x86/include/asm/apm.h b/arch/x86/include/asm/apm.h
-index 20370c6..a2eb9b0 100644
---- a/arch/x86/include/asm/apm.h
-+++ b/arch/x86/include/asm/apm.h
-@@ -34,7 +34,7 @@ static inline void apm_bios_call_asm(u32 func, u32 ebx_in, u32 ecx_in,
- __asm__ __volatile__(APM_DO_ZERO_SEGS
- "pushl %%edi\n\t"
- "pushl %%ebp\n\t"
-- "lcall *%%cs:apm_bios_entry\n\t"
-+ "lcall *%%ss:apm_bios_entry\n\t"
- "setc %%al\n\t"
- "popl %%ebp\n\t"
- "popl %%edi\n\t"
-@@ -58,7 +58,7 @@ static inline u8 apm_bios_call_simple_asm(u32 func, u32 ebx_in,
- __asm__ __volatile__(APM_DO_ZERO_SEGS
- "pushl %%edi\n\t"
- "pushl %%ebp\n\t"
-- "lcall *%%cs:apm_bios_entry\n\t"
-+ "lcall *%%ss:apm_bios_entry\n\t"
- "setc %%bl\n\t"
- "popl %%ebp\n\t"
- "popl %%edi\n\t"
-diff --git a/arch/x86/include/asm/atomic_32.h b/arch/x86/include/asm/atomic_32.h
-index dc5a667..7a2470f 100644
---- a/arch/x86/include/asm/atomic_32.h
-+++ b/arch/x86/include/asm/atomic_32.h
-@@ -25,6 +25,17 @@ static inline int atomic_read(const atomic_t *v)
- }
-
- /**
-+ * atomic_read_unchecked - read atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically reads the value of @v.
-+ */
-+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
-+{
-+ return v->counter;
-+}
-+
-+/**
- * atomic_set - set atomic variable
- * @v: pointer of type atomic_t
- * @i: required value
-@@ -37,6 +48,18 @@ static inline void atomic_set(atomic_t *v, int i)
- }
-
- /**
-+ * atomic_set_unchecked - set atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ * @i: required value
-+ *
-+ * Atomically sets the value of @v to @i.
-+ */
-+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
-+{
-+ v->counter = i;
-+}
-+
-+/**
- * atomic_add - add integer to atomic variable
- * @i: integer value to add
- * @v: pointer of type atomic_t
-@@ -45,7 +68,29 @@ static inline void atomic_set(atomic_t *v, int i)
- */
- static inline void atomic_add(int i, atomic_t *v)
- {
-- asm volatile(LOCK_PREFIX "addl %1,%0"
-+ asm volatile(LOCK_PREFIX "addl %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "subl %1,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "+m" (v->counter)
-+ : "ir" (i));
-+}
-+
-+/**
-+ * atomic_add_unchecked - add integer to atomic variable
-+ * @i: integer value to add
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically adds @i to @v.
-+ */
-+static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "addl %1,%0\n"
- : "+m" (v->counter)
- : "ir" (i));
- }
-@@ -59,7 +104,29 @@ static inline void atomic_add(int i, atomic_t *v)
- */
- static inline void atomic_sub(int i, atomic_t *v)
- {
-- asm volatile(LOCK_PREFIX "subl %1,%0"
-+ asm volatile(LOCK_PREFIX "subl %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "addl %1,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "+m" (v->counter)
-+ : "ir" (i));
-+}
-+
-+/**
-+ * atomic_sub_unchecked - subtract integer from atomic variable
-+ * @i: integer value to subtract
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically subtracts @i from @v.
-+ */
-+static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "subl %1,%0\n"
- : "+m" (v->counter)
- : "ir" (i));
- }
-@@ -77,7 +144,16 @@ static inline int atomic_sub_and_test(int i, atomic_t *v)
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
-+ asm volatile(LOCK_PREFIX "subl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "addl %2,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
- : "+m" (v->counter), "=qm" (c)
- : "ir" (i) : "memory");
- return c;
-@@ -91,7 +167,27 @@ static inline int atomic_sub_and_test(int i, atomic_t *v)
- */
- static inline void atomic_inc(atomic_t *v)
- {
-- asm volatile(LOCK_PREFIX "incl %0"
-+ asm volatile(LOCK_PREFIX "incl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "decl %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "+m" (v->counter));
-+}
-+
-+/**
-+ * atomic_inc_unchecked - increment atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically increments @v by 1.
-+ */
-+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "incl %0\n"
- : "+m" (v->counter));
- }
-
-@@ -103,7 +199,27 @@ static inline void atomic_inc(atomic_t *v)
- */
- static inline void atomic_dec(atomic_t *v)
- {
-- asm volatile(LOCK_PREFIX "decl %0"
-+ asm volatile(LOCK_PREFIX "decl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "incl %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "+m" (v->counter));
-+}
-+
-+/**
-+ * atomic_dec_unchecked - decrement atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically decrements @v by 1.
-+ */
-+static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "decl %0\n"
- : "+m" (v->counter));
- }
-
-@@ -119,7 +235,16 @@ static inline int atomic_dec_and_test(atomic_t *v)
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "decl %0; sete %1"
-+ asm volatile(LOCK_PREFIX "decl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "incl %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
- : "+m" (v->counter), "=qm" (c)
- : : "memory");
- return c != 0;
-@@ -137,7 +262,35 @@ static inline int atomic_inc_and_test(atomic_t *v)
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "incl %0; sete %1"
-+ asm volatile(LOCK_PREFIX "incl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "decl %0\n"
-+ "into\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
-+ : "+m" (v->counter), "=qm" (c)
-+ : : "memory");
-+ return c != 0;
-+}
-+
-+/**
-+ * atomic_inc_and_test_unchecked - increment and test
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically increments @v by 1
-+ * and returns true if the result is zero, or false for all
-+ * other cases.
-+ */
-+static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
-+{
-+ unsigned char c;
-+
-+ asm volatile(LOCK_PREFIX "incl %0\n"
-+ "sete %1\n"
- : "+m" (v->counter), "=qm" (c)
- : : "memory");
- return c != 0;
-@@ -156,7 +309,16 @@ static inline int atomic_add_negative(int i, atomic_t *v)
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
-+ asm volatile(LOCK_PREFIX "addl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "subl %2,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sets %1\n"
- : "+m" (v->counter), "=qm" (c)
- : "ir" (i) : "memory");
- return c;
-@@ -179,7 +341,15 @@ static inline int atomic_add_return(int i, atomic_t *v)
- #endif
- /* Modern 486+ processor */
- __i = i;
-- asm volatile(LOCK_PREFIX "xaddl %0, %1"
-+ asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ "movl %0, %1\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- : "+r" (i), "+m" (v->counter)
- : : "memory");
- return i + __i;
-@@ -195,6 +365,38 @@ no_xadd: /* Legacy 386 processor */
- }
-
- /**
-+ * atomic_add_return_unchecked - add integer and return
-+ * @v: pointer of type atomic_unchecked_t
-+ * @i: integer value to add
-+ *
-+ * Atomically adds @i to @v and returns @i + @v
-+ */
-+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
-+{
-+ int __i;
-+#ifdef CONFIG_M386
-+ unsigned long flags;
-+ if (unlikely(boot_cpu_data.x86 <= 3))
-+ goto no_xadd;
-+#endif
-+ /* Modern 486+ processor */
-+ __i = i;
-+ asm volatile(LOCK_PREFIX "xaddl %0, %1"
-+ : "+r" (i), "+m" (v->counter)
-+ : : "memory");
-+ return i + __i;
-+
-+#ifdef CONFIG_M386
-+no_xadd: /* Legacy 386 processor */
-+ local_irq_save(flags);
-+ __i = atomic_read_unchecked(v);
-+ atomic_set_unchecked(v, i + __i);
-+ local_irq_restore(flags);
-+ return i + __i;
-+#endif
-+}
-+
-+/**
- * atomic_sub_return - subtract integer and return
- * @v: pointer of type atomic_t
- * @i: integer value to subtract
-@@ -211,11 +413,21 @@ static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
- return cmpxchg(&v->counter, old, new);
- }
-
-+static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
-+{
-+ return cmpxchg(&v->counter, old, new);
-+}
-+
- static inline int atomic_xchg(atomic_t *v, int new)
- {
- return xchg(&v->counter, new);
- }
-
-+static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
-+{
-+ return xchg(&v->counter, new);
-+}
-+
- /**
- * atomic_add_unless - add unless the number is already a given value
- * @v: pointer of type atomic_t
-@@ -227,32 +439,73 @@ static inline int atomic_xchg(atomic_t *v, int new)
- */
- static inline int atomic_add_unless(atomic_t *v, int a, int u)
- {
-- int c, old;
-+ int c, old, new;
- c = atomic_read(v);
- for (;;) {
-- if (unlikely(c == (u)))
-+ if (unlikely(c == u))
- break;
-- old = atomic_cmpxchg((v), c, c + (a));
-+
-+ asm volatile("addl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ "subl %2,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "=r" (new)
-+ : "0" (c), "ir" (a));
-+
-+ old = atomic_cmpxchg(v, c, new);
- if (likely(old == c))
- break;
- c = old;
- }
-- return c != (u);
-+ return c != u;
- }
-
- #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
-
- #define atomic_inc_return(v) (atomic_add_return(1, v))
-+static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
-+{
-+ return atomic_add_return_unchecked(1, v);
-+}
- #define atomic_dec_return(v) (atomic_sub_return(1, v))
-
- /* These are x86-specific, used by some header files */
--#define atomic_clear_mask(mask, addr) \
-- asm volatile(LOCK_PREFIX "andl %0,%1" \
-- : : "r" (~(mask)), "m" (*(addr)) : "memory")
-+static inline void atomic_clear_mask(unsigned int mask, atomic_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "andl %1,%0"
-+ : "+m" (v->counter)
-+ : "r" (~(mask))
-+ : "memory");
-+}
-
--#define atomic_set_mask(mask, addr) \
-- asm volatile(LOCK_PREFIX "orl %0,%1" \
-- : : "r" (mask), "m" (*(addr)) : "memory")
-+static inline void atomic_clear_mask_unchecked(unsigned int mask, atomic_unchecked_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "andl %1,%0"
-+ : "+m" (v->counter)
-+ : "r" (~(mask))
-+ : "memory");
-+}
-+
-+static inline void atomic_set_mask(unsigned int mask, atomic_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "orl %1,%0"
-+ : "+m" (v->counter)
-+ : "r" (mask)
-+ : "memory");
-+}
-+
-+static inline void atomic_set_mask_unchecked(unsigned int mask, atomic_unchecked_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "orl %1,%0"
-+ : "+m" (v->counter)
-+ : "r" (mask)
-+ : "memory");
-+}
-
- /* Atomic operations are already serializing on x86 */
- #define smp_mb__before_atomic_dec() barrier()
-@@ -266,9 +519,18 @@ typedef struct {
- u64 __aligned(8) counter;
- } atomic64_t;
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+typedef struct {
-+ u64 __aligned(8) counter;
-+} atomic64_unchecked_t;
-+#else
-+typedef atomic64_t atomic64_unchecked_t;
-+#endif
-+
- #define ATOMIC64_INIT(val) { (val) }
-
- extern u64 atomic64_cmpxchg(atomic64_t *ptr, u64 old_val, u64 new_val);
-+extern u64 atomic64_cmpxchg_unchecked(atomic64_unchecked_t *ptr, u64 old_val, u64 new_val);
-
- /**
- * atomic64_xchg - xchg atomic64 variable
-@@ -279,6 +541,7 @@ extern u64 atomic64_cmpxchg(atomic64_t *ptr, u64 old_val, u64 new_val);
- * the old value.
- */
- extern u64 atomic64_xchg(atomic64_t *ptr, u64 new_val);
-+extern u64 atomic64_xchg_unchecked(atomic64_unchecked_t *ptr, u64 new_val);
-
- /**
- * atomic64_set - set atomic64 variable
-@@ -290,6 +553,15 @@ extern u64 atomic64_xchg(atomic64_t *ptr, u64 new_val);
- extern void atomic64_set(atomic64_t *ptr, u64 new_val);
-
- /**
-+ * atomic64_unchecked_set - set atomic64 variable
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ * @new_val: value to assign
-+ *
-+ * Atomically sets the value of @ptr to @new_val.
-+ */
-+extern void atomic64_set_unchecked(atomic64_unchecked_t *ptr, u64 new_val);
-+
-+/**
- * atomic64_read - read atomic64 variable
- * @ptr: pointer to type atomic64_t
- *
-@@ -317,7 +589,33 @@ static inline u64 atomic64_read(atomic64_t *ptr)
- return res;
- }
-
--extern u64 atomic64_read(atomic64_t *ptr);
-+/**
-+ * atomic64_read_unchecked - read atomic64 variable
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically reads the value of @ptr and returns it.
-+ */
-+static inline u64 atomic64_read_unchecked(atomic64_unchecked_t *ptr)
-+{
-+ u64 res;
-+
-+ /*
-+ * Note, we inline this atomic64_unchecked_t primitive because
-+ * it only clobbers EAX/EDX and leaves the others
-+ * untouched. We also (somewhat subtly) rely on the
-+ * fact that cmpxchg8b returns the current 64-bit value
-+ * of the memory location we are touching:
-+ */
-+ asm volatile(
-+ "mov %%ebx, %%eax\n\t"
-+ "mov %%ecx, %%edx\n\t"
-+ LOCK_PREFIX "cmpxchg8b %1\n"
-+ : "=&A" (res)
-+ : "m" (*ptr)
-+ );
-+
-+ return res;
-+}
-
- /**
- * atomic64_add_return - add and return
-@@ -332,8 +630,11 @@ extern u64 atomic64_add_return(u64 delta, atomic64_t *ptr);
- * Other variants with different arithmetic operators:
- */
- extern u64 atomic64_sub_return(u64 delta, atomic64_t *ptr);
-+extern u64 atomic64_sub_return_unchecked(u64 delta, atomic64_unchecked_t *ptr);
- extern u64 atomic64_inc_return(atomic64_t *ptr);
-+extern u64 atomic64_inc_return_unchecked(atomic64_unchecked_t *ptr);
- extern u64 atomic64_dec_return(atomic64_t *ptr);
-+extern u64 atomic64_dec_return_unchecked(atomic64_unchecked_t *ptr);
-
- /**
- * atomic64_add - add integer to atomic64 variable
-@@ -345,6 +646,15 @@ extern u64 atomic64_dec_return(atomic64_t *ptr);
- extern void atomic64_add(u64 delta, atomic64_t *ptr);
-
- /**
-+ * atomic64_add_unchecked - add integer to atomic64 variable
-+ * @delta: integer value to add
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically adds @delta to @ptr.
-+ */
-+extern void atomic64_add_unchecked(u64 delta, atomic64_unchecked_t *ptr);
-+
-+/**
- * atomic64_sub - subtract the atomic64 variable
- * @delta: integer value to subtract
- * @ptr: pointer to type atomic64_t
-@@ -354,6 +664,15 @@ extern void atomic64_add(u64 delta, atomic64_t *ptr);
- extern void atomic64_sub(u64 delta, atomic64_t *ptr);
-
- /**
-+ * atomic64_sub_unchecked - subtract the atomic64 variable
-+ * @delta: integer value to subtract
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically subtracts @delta from @ptr.
-+ */
-+extern void atomic64_sub_unchecked(u64 delta, atomic64_unchecked_t *ptr);
-+
-+/**
- * atomic64_sub_and_test - subtract value from variable and test result
- * @delta: integer value to subtract
- * @ptr: pointer to type atomic64_t
-@@ -373,6 +692,14 @@ extern int atomic64_sub_and_test(u64 delta, atomic64_t *ptr);
- extern void atomic64_inc(atomic64_t *ptr);
-
- /**
-+ * atomic64_inc_unchecked - increment atomic64 variable
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically increments @ptr by 1.
-+ */
-+extern void atomic64_inc_unchecked(atomic64_unchecked_t *ptr);
-+
-+/**
- * atomic64_dec - decrement atomic64 variable
- * @ptr: pointer to type atomic64_t
- *
-@@ -381,6 +708,14 @@ extern void atomic64_inc(atomic64_t *ptr);
- extern void atomic64_dec(atomic64_t *ptr);
-
- /**
-+ * atomic64_dec_unchecked - decrement atomic64 variable
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically decrements @ptr by 1.
-+ */
-+extern void atomic64_dec_unchecked(atomic64_unchecked_t *ptr);
-+
-+/**
- * atomic64_dec_and_test - decrement and test
- * @ptr: pointer to type atomic64_t
- *
-diff --git a/arch/x86/include/asm/atomic_64.h b/arch/x86/include/asm/atomic_64.h
-index d605dc2..72cb5cd 100644
---- a/arch/x86/include/asm/atomic_64.h
-+++ b/arch/x86/include/asm/atomic_64.h
-@@ -24,6 +24,17 @@ static inline int atomic_read(const atomic_t *v)
- }
-
- /**
-+ * atomic_read_unchecked - read atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically reads the value of @v.
-+ */
-+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
-+{
-+ return v->counter;
-+}
-+
-+/**
- * atomic_set - set atomic variable
- * @v: pointer of type atomic_t
- * @i: required value
-@@ -36,6 +47,18 @@ static inline void atomic_set(atomic_t *v, int i)
- }
-
- /**
-+ * atomic_set_unchecked - set atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ * @i: required value
-+ *
-+ * Atomically sets the value of @v to @i.
-+ */
-+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
-+{
-+ v->counter = i;
-+}
-+
-+/**
- * atomic_add - add integer to atomic variable
- * @i: integer value to add
- * @v: pointer of type atomic_t
-@@ -44,7 +67,29 @@ static inline void atomic_set(atomic_t *v, int i)
- */
- static inline void atomic_add(int i, atomic_t *v)
- {
-- asm volatile(LOCK_PREFIX "addl %1,%0"
-+ asm volatile(LOCK_PREFIX "addl %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "subl %1,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "=m" (v->counter)
-+ : "ir" (i), "m" (v->counter));
-+}
-+
-+/**
-+ * atomic_add_unchecked - add integer to atomic variable
-+ * @i: integer value to add
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically adds @i to @v.
-+ */
-+static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "addl %1,%0\n"
- : "=m" (v->counter)
- : "ir" (i), "m" (v->counter));
- }
-@@ -58,7 +103,29 @@ static inline void atomic_add(int i, atomic_t *v)
- */
- static inline void atomic_sub(int i, atomic_t *v)
- {
-- asm volatile(LOCK_PREFIX "subl %1,%0"
-+ asm volatile(LOCK_PREFIX "subl %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "addl %1,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "=m" (v->counter)
-+ : "ir" (i), "m" (v->counter));
-+}
-+
-+/**
-+ * atomic_sub_unchecked - subtract the atomic variable
-+ * @i: integer value to subtract
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically subtracts @i from @v.
-+ */
-+static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "subl %1,%0\n"
- : "=m" (v->counter)
- : "ir" (i), "m" (v->counter));
- }
-@@ -76,7 +143,16 @@ static inline int atomic_sub_and_test(int i, atomic_t *v)
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
-+ asm volatile(LOCK_PREFIX "subl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "addl %2,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
- : "=m" (v->counter), "=qm" (c)
- : "ir" (i), "m" (v->counter) : "memory");
- return c;
-@@ -90,7 +166,28 @@ static inline int atomic_sub_and_test(int i, atomic_t *v)
- */
- static inline void atomic_inc(atomic_t *v)
- {
-- asm volatile(LOCK_PREFIX "incl %0"
-+ asm volatile(LOCK_PREFIX "incl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "decl %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "=m" (v->counter)
-+ : "m" (v->counter));
-+}
-+
-+/**
-+ * atomic_inc_unchecked - increment atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically increments @v by 1.
-+ */
-+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "incl %0\n"
- : "=m" (v->counter)
- : "m" (v->counter));
- }
-@@ -103,7 +200,28 @@ static inline void atomic_inc(atomic_t *v)
- */
- static inline void atomic_dec(atomic_t *v)
- {
-- asm volatile(LOCK_PREFIX "decl %0"
-+ asm volatile(LOCK_PREFIX "decl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "incl %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "=m" (v->counter)
-+ : "m" (v->counter));
-+}
-+
-+/**
-+ * atomic_dec_unchecked - decrement atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically decrements @v by 1.
-+ */
-+static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "decl %0\n"
- : "=m" (v->counter)
- : "m" (v->counter));
- }
-@@ -120,7 +238,16 @@ static inline int atomic_dec_and_test(atomic_t *v)
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "decl %0; sete %1"
-+ asm volatile(LOCK_PREFIX "decl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "incl %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
- : "=m" (v->counter), "=qm" (c)
- : "m" (v->counter) : "memory");
- return c != 0;
-@@ -138,7 +265,35 @@ static inline int atomic_inc_and_test(atomic_t *v)
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "incl %0; sete %1"
-+ asm volatile(LOCK_PREFIX "incl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "decl %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
-+ : "=m" (v->counter), "=qm" (c)
-+ : "m" (v->counter) : "memory");
-+ return c != 0;
-+}
-+
-+/**
-+ * atomic_inc_and_test_unchecked - increment and test
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically increments @v by 1
-+ * and returns true if the result is zero, or false for all
-+ * other cases.
-+ */
-+static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
-+{
-+ unsigned char c;
-+
-+ asm volatile(LOCK_PREFIX "incl %0\n"
-+ "sete %1\n"
- : "=m" (v->counter), "=qm" (c)
- : "m" (v->counter) : "memory");
- return c != 0;
-@@ -157,7 +312,16 @@ static inline int atomic_add_negative(int i, atomic_t *v)
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
-+ asm volatile(LOCK_PREFIX "addl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "subl %2,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sets %1\n"
- : "=m" (v->counter), "=qm" (c)
- : "ir" (i), "m" (v->counter) : "memory");
- return c;
-@@ -173,7 +337,31 @@ static inline int atomic_add_negative(int i, atomic_t *v)
- static inline int atomic_add_return(int i, atomic_t *v)
- {
- int __i = i;
-- asm volatile(LOCK_PREFIX "xaddl %0, %1"
-+ asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ "movl %0, %1\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "+r" (i), "+m" (v->counter)
-+ : : "memory");
-+ return i + __i;
-+}
-+
-+/**
-+ * atomic_add_return_unchecked - add and return
-+ * @i: integer value to add
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically adds @i to @v and returns @i + @v
-+ */
-+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
-+{
-+ int __i = i;
-+ asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
- : "+r" (i), "+m" (v->counter)
- : : "memory");
- return i + __i;
-@@ -185,6 +373,10 @@ static inline int atomic_sub_return(int i, atomic_t *v)
- }
-
- #define atomic_inc_return(v) (atomic_add_return(1, v))
-+static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
-+{
-+ return atomic_add_return_unchecked(1, v);
-+}
- #define atomic_dec_return(v) (atomic_sub_return(1, v))
-
- /* The 64-bit atomic type */
-@@ -204,6 +396,18 @@ static inline long atomic64_read(const atomic64_t *v)
- }
-
- /**
-+ * atomic64_read_unchecked - read atomic64 variable
-+ * @v: pointer of type atomic64_unchecked_t
-+ *
-+ * Atomically reads the value of @v.
-+ * Doesn't imply a read memory barrier.
-+ */
-+static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
-+{
-+ return v->counter;
-+}
-+
-+/**
- * atomic64_set - set atomic64 variable
- * @v: pointer to type atomic64_t
- * @i: required value
-@@ -216,6 +420,18 @@ static inline void atomic64_set(atomic64_t *v, long i)
- }
-
- /**
-+ * atomic64_set_unchecked - set atomic64 variable
-+ * @v: pointer to type atomic64_unchecked_t
-+ * @i: required value
-+ *
-+ * Atomically sets the value of @v to @i.
-+ */
-+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
-+{
-+ v->counter = i;
-+}
-+
-+/**
- * atomic64_add - add integer to atomic64 variable
- * @i: integer value to add
- * @v: pointer to type atomic64_t
-@@ -224,6 +440,28 @@ static inline void atomic64_set(atomic64_t *v, long i)
- */
- static inline void atomic64_add(long i, atomic64_t *v)
- {
-+ asm volatile(LOCK_PREFIX "addq %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "subq %1,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "=m" (v->counter)
-+ : "er" (i), "m" (v->counter));
-+}
-+
-+/**
-+ * atomic64_add_unchecked - add integer to atomic64 variable
-+ * @i: integer value to add
-+ * @v: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically adds @i to @v.
-+ */
-+static inline void atomic64_add_unchecked(long i, atomic64_unchecked_t *v)
-+{
- asm volatile(LOCK_PREFIX "addq %1,%0"
- : "=m" (v->counter)
- : "er" (i), "m" (v->counter));
-@@ -238,7 +476,15 @@ static inline void atomic64_add(long i, atomic64_t *v)
- */
- static inline void atomic64_sub(long i, atomic64_t *v)
- {
-- asm volatile(LOCK_PREFIX "subq %1,%0"
-+ asm volatile(LOCK_PREFIX "subq %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "addq %1,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- : "=m" (v->counter)
- : "er" (i), "m" (v->counter));
- }
-@@ -256,7 +502,16 @@ static inline int atomic64_sub_and_test(long i, atomic64_t *v)
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "subq %2,%0; sete %1"
-+ asm volatile(LOCK_PREFIX "subq %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "addq %2,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
- : "=m" (v->counter), "=qm" (c)
- : "er" (i), "m" (v->counter) : "memory");
- return c;
-@@ -270,6 +525,27 @@ static inline int atomic64_sub_and_test(long i, atomic64_t *v)
- */
- static inline void atomic64_inc(atomic64_t *v)
- {
-+ asm volatile(LOCK_PREFIX "incq %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "decq %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "=m" (v->counter)
-+ : "m" (v->counter));
-+}
-+
-+/**
-+ * atomic64_inc_unchecked - increment atomic64 variable
-+ * @v: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically increments @v by 1.
-+ */
-+static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
-+{
- asm volatile(LOCK_PREFIX "incq %0"
- : "=m" (v->counter)
- : "m" (v->counter));
-@@ -283,7 +559,28 @@ static inline void atomic64_inc(atomic64_t *v)
- */
- static inline void atomic64_dec(atomic64_t *v)
- {
-- asm volatile(LOCK_PREFIX "decq %0"
-+ asm volatile(LOCK_PREFIX "decq %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "incq %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "=m" (v->counter)
-+ : "m" (v->counter));
-+}
-+
-+/**
-+ * atomic64_dec_unchecked - decrement atomic64 variable
-+ * @v: pointer to type atomic64_t
-+ *
-+ * Atomically decrements @v by 1.
-+ */
-+static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "decq %0\n"
- : "=m" (v->counter)
- : "m" (v->counter));
- }
-@@ -300,7 +597,16 @@ static inline int atomic64_dec_and_test(atomic64_t *v)
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "decq %0; sete %1"
-+ asm volatile(LOCK_PREFIX "decq %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "incq %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
- : "=m" (v->counter), "=qm" (c)
- : "m" (v->counter) : "memory");
- return c != 0;
-@@ -318,7 +624,16 @@ static inline int atomic64_inc_and_test(atomic64_t *v)
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "incq %0; sete %1"
-+ asm volatile(LOCK_PREFIX "incq %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "decq %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
- : "=m" (v->counter), "=qm" (c)
- : "m" (v->counter) : "memory");
- return c != 0;
-@@ -337,7 +652,16 @@ static inline int atomic64_add_negative(long i, atomic64_t *v)
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "addq %2,%0; sets %1"
-+ asm volatile(LOCK_PREFIX "addq %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "subq %2,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sets %1\n"
- : "=m" (v->counter), "=qm" (c)
- : "er" (i), "m" (v->counter) : "memory");
- return c;
-@@ -353,7 +677,31 @@ static inline int atomic64_add_negative(long i, atomic64_t *v)
- static inline long atomic64_add_return(long i, atomic64_t *v)
- {
- long __i = i;
-- asm volatile(LOCK_PREFIX "xaddq %0, %1;"
-+ asm volatile(LOCK_PREFIX "xaddq %0, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ "movq %0, %1\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "+r" (i), "+m" (v->counter)
-+ : : "memory");
-+ return i + __i;
-+}
-+
-+/**
-+ * atomic64_add_return_unchecked - add and return
-+ * @i: integer value to add
-+ * @v: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically adds @i to @v and returns @i + @v
-+ */
-+static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
-+{
-+ long __i = i;
-+ asm volatile(LOCK_PREFIX "xaddq %0, %1"
- : "+r" (i), "+m" (v->counter)
- : : "memory");
- return i + __i;
-@@ -365,6 +713,10 @@ static inline long atomic64_sub_return(long i, atomic64_t *v)
- }
-
- #define atomic64_inc_return(v) (atomic64_add_return(1, (v)))
-+static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
-+{
-+ return atomic64_add_return_unchecked(1, v);
-+}
- #define atomic64_dec_return(v) (atomic64_sub_return(1, (v)))
-
- static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
-@@ -372,21 +724,41 @@ static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
- return cmpxchg(&v->counter, old, new);
- }
-
-+static inline long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long old, long new)
-+{
-+ return cmpxchg(&v->counter, old, new);
-+}
-+
- static inline long atomic64_xchg(atomic64_t *v, long new)
- {
- return xchg(&v->counter, new);
- }
-
-+static inline long atomic64_xchg_unchecked(atomic64_unchecked_t *v, long new)
-+{
-+ return xchg(&v->counter, new);
-+}
-+
- static inline long atomic_cmpxchg(atomic_t *v, int old, int new)
- {
- return cmpxchg(&v->counter, old, new);
- }
-
-+static inline long atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
-+{
-+ return cmpxchg(&v->counter, old, new);
-+}
-+
- static inline long atomic_xchg(atomic_t *v, int new)
- {
- return xchg(&v->counter, new);
- }
-
-+static inline long atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
-+{
-+ return xchg(&v->counter, new);
-+}
-+
- /**
- * atomic_add_unless - add unless the number is a given value
- * @v: pointer of type atomic_t
-@@ -398,17 +770,30 @@ static inline long atomic_xchg(atomic_t *v, int new)
- */
- static inline int atomic_add_unless(atomic_t *v, int a, int u)
- {
-- int c, old;
-+ int c, old, new;
- c = atomic_read(v);
- for (;;) {
-- if (unlikely(c == (u)))
-+ if (unlikely(c == u))
- break;
-- old = atomic_cmpxchg((v), c, c + (a));
-+
-+ asm volatile("addl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ "subl %2,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "=r" (new)
-+ : "0" (c), "ir" (a));
-+
-+ old = atomic_cmpxchg(v, c, new);
- if (likely(old == c))
- break;
- c = old;
- }
-- return c != (u);
-+ return c != u;
- }
-
- #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
-@@ -424,17 +809,30 @@ static inline int atomic_add_unless(atomic_t *v, int a, int u)
- */
- static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
- {
-- long c, old;
-+ long c, old, new;
- c = atomic64_read(v);
- for (;;) {
-- if (unlikely(c == (u)))
-+ if (unlikely(c == u))
- break;
-- old = atomic64_cmpxchg((v), c, c + (a));
-+
-+ asm volatile("addq %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ "subq %2,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "=r" (new)
-+ : "0" (c), "er" (a));
-+
-+ old = atomic64_cmpxchg(v, c, new);
- if (likely(old == c))
- break;
- c = old;
- }
-- return c != (u);
-+ return c != u;
- }
-
- /**
-@@ -466,14 +864,37 @@ static inline void atomic_or_long(unsigned long *v1, unsigned long v2)
- #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
-
- /* These are x86-specific, used by some header files */
--#define atomic_clear_mask(mask, addr) \
-- asm volatile(LOCK_PREFIX "andl %0,%1" \
-- : : "r" (~(mask)), "m" (*(addr)) : "memory")
-+static inline void atomic_clear_mask(unsigned int mask, atomic_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "andl %1,%0"
-+ : "+m" (v->counter)
-+ : "r" (~(mask))
-+ : "memory");
-+}
-
--#define atomic_set_mask(mask, addr) \
-- asm volatile(LOCK_PREFIX "orl %0,%1" \
-- : : "r" ((unsigned)(mask)), "m" (*(addr)) \
-- : "memory")
-+static inline void atomic_clear_mask_unchecked(unsigned int mask, atomic_unchecked_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "andl %1,%0"
-+ : "+m" (v->counter)
-+ : "r" (~(mask))
-+ : "memory");
-+}
-+
-+static inline void atomic_set_mask(unsigned int mask, atomic_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "orl %1,%0"
-+ : "+m" (v->counter)
-+ : "r" (mask)
-+ : "memory");
-+}
-+
-+static inline void atomic_set_mask_unchecked(unsigned int mask, atomic_unchecked_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "orl %1,%0"
-+ : "+m" (v->counter)
-+ : "r" (mask)
-+ : "memory");
-+}
-
- /* Atomic operations are already serializing on x86 */
- #define smp_mb__before_atomic_dec() barrier()
-diff --git a/arch/x86/include/asm/bitops.h b/arch/x86/include/asm/bitops.h
-index 02b47a6..d5c4b15 100644
---- a/arch/x86/include/asm/bitops.h
-+++ b/arch/x86/include/asm/bitops.h
-@@ -38,7 +38,7 @@
- * a mask operation on a byte.
- */
- #define IS_IMMEDIATE(nr) (__builtin_constant_p(nr))
--#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((void *)(addr) + ((nr)>>3))
-+#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((volatile void *)(addr) + ((nr)>>3))
- #define CONST_MASK(nr) (1 << ((nr) & 7))
-
- /**
-diff --git a/arch/x86/include/asm/boot.h b/arch/x86/include/asm/boot.h
-index 7a10659..8bbf355 100644
---- a/arch/x86/include/asm/boot.h
-+++ b/arch/x86/include/asm/boot.h
-@@ -11,10 +11,15 @@
- #include <asm/pgtable_types.h>
-
- /* Physical address where kernel should be loaded. */
--#define LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
-+#define ____LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
- + (CONFIG_PHYSICAL_ALIGN - 1)) \
- & ~(CONFIG_PHYSICAL_ALIGN - 1))
-
-+#ifndef __ASSEMBLY__
-+extern unsigned char __LOAD_PHYSICAL_ADDR[];
-+#define LOAD_PHYSICAL_ADDR ((unsigned long)__LOAD_PHYSICAL_ADDR)
-+#endif
-+
- /* Minimum kernel alignment, as a power of two */
- #ifdef CONFIG_X86_64
- #define MIN_KERNEL_ALIGN_LG2 PMD_SHIFT
-diff --git a/arch/x86/include/asm/cache.h b/arch/x86/include/asm/cache.h
-index 549860d..7d45f68 100644
---- a/arch/x86/include/asm/cache.h
-+++ b/arch/x86/include/asm/cache.h
-@@ -5,9 +5,10 @@
-
- /* L1 cache line size */
- #define L1_CACHE_SHIFT (CONFIG_X86_L1_CACHE_SHIFT)
--#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-
- #define __read_mostly __attribute__((__section__(".data.read_mostly")))
-+#define __read_only __attribute__((__section__(".data.read_only")))
-
- #ifdef CONFIG_X86_VSMP
- /* vSMP Internode cacheline shift */
-diff --git a/arch/x86/include/asm/cacheflush.h b/arch/x86/include/asm/cacheflush.h
-index b54f6af..5b376a6 100644
---- a/arch/x86/include/asm/cacheflush.h
-+++ b/arch/x86/include/asm/cacheflush.h
-@@ -60,7 +60,7 @@ PAGEFLAG(WC, WC)
- static inline unsigned long get_page_memtype(struct page *pg)
- {
- if (!PageUncached(pg) && !PageWC(pg))
-- return -1;
-+ return ~0UL;
- else if (!PageUncached(pg) && PageWC(pg))
- return _PAGE_CACHE_WC;
- else if (PageUncached(pg) && !PageWC(pg))
-@@ -85,7 +85,7 @@ static inline void set_page_memtype(struct page *pg, unsigned long memtype)
- SetPageWC(pg);
- break;
- default:
-- case -1:
-+ case ~0UL:
- ClearPageUncached(pg);
- ClearPageWC(pg);
- break;
-diff --git a/arch/x86/include/asm/calling.h b/arch/x86/include/asm/calling.h
-index 0e63c9a..ab8d972 100644
---- a/arch/x86/include/asm/calling.h
-+++ b/arch/x86/include/asm/calling.h
-@@ -52,32 +52,32 @@ For 32-bit we have the following conventions - kernel is built with
- * for assembly code:
- */
-
--#define R15 0
--#define R14 8
--#define R13 16
--#define R12 24
--#define RBP 32
--#define RBX 40
-+#define R15 (0)
-+#define R14 (8)
-+#define R13 (16)
-+#define R12 (24)
-+#define RBP (32)
-+#define RBX (40)
-
- /* arguments: interrupts/non tracing syscalls only save up to here: */
--#define R11 48
--#define R10 56
--#define R9 64
--#define R8 72
--#define RAX 80
--#define RCX 88
--#define RDX 96
--#define RSI 104
--#define RDI 112
--#define ORIG_RAX 120 /* + error_code */
-+#define R11 (48)
-+#define R10 (56)
-+#define R9 (64)
-+#define R8 (72)
-+#define RAX (80)
-+#define RCX (88)
-+#define RDX (96)
-+#define RSI (104)
-+#define RDI (112)
-+#define ORIG_RAX (120) /* + error_code */
- /* end of arguments */
-
- /* cpu exception frame or undefined in case of fast syscall: */
--#define RIP 128
--#define CS 136
--#define EFLAGS 144
--#define RSP 152
--#define SS 160
-+#define RIP (128)
-+#define CS (136)
-+#define EFLAGS (144)
-+#define RSP (152)
-+#define SS (160)
-
- #define ARGOFFSET R11
- #define SWFRAME ORIG_RAX
-diff --git a/arch/x86/include/asm/checksum_32.h b/arch/x86/include/asm/checksum_32.h
-index 46fc474..b02b0f9 100644
---- a/arch/x86/include/asm/checksum_32.h
-+++ b/arch/x86/include/asm/checksum_32.h
-@@ -31,6 +31,14 @@ asmlinkage __wsum csum_partial_copy_generic(const void *src, void *dst,
- int len, __wsum sum,
- int *src_err_ptr, int *dst_err_ptr);
-
-+asmlinkage __wsum csum_partial_copy_generic_to_user(const void *src, void *dst,
-+ int len, __wsum sum,
-+ int *src_err_ptr, int *dst_err_ptr);
-+
-+asmlinkage __wsum csum_partial_copy_generic_from_user(const void *src, void *dst,
-+ int len, __wsum sum,
-+ int *src_err_ptr, int *dst_err_ptr);
-+
- /*
- * Note: when you get a NULL pointer exception here this means someone
- * passed in an incorrect kernel address to one of these functions.
-@@ -50,7 +58,7 @@ static inline __wsum csum_partial_copy_from_user(const void __user *src,
- int *err_ptr)
- {
- might_sleep();
-- return csum_partial_copy_generic((__force void *)src, dst,
-+ return csum_partial_copy_generic_from_user((__force void *)src, dst,
- len, sum, err_ptr, NULL);
- }
-
-@@ -178,7 +186,7 @@ static inline __wsum csum_and_copy_to_user(const void *src,
- {
- might_sleep();
- if (access_ok(VERIFY_WRITE, dst, len))
-- return csum_partial_copy_generic(src, (__force void *)dst,
-+ return csum_partial_copy_generic_to_user(src, (__force void *)dst,
- len, sum, NULL, err_ptr);
-
- if (len)
-diff --git a/arch/x86/include/asm/desc.h b/arch/x86/include/asm/desc.h
-index 617bd56..7b047a1 100644
---- a/arch/x86/include/asm/desc.h
-+++ b/arch/x86/include/asm/desc.h
-@@ -4,6 +4,7 @@
- #include <asm/desc_defs.h>
- #include <asm/ldt.h>
- #include <asm/mmu.h>
-+#include <asm/pgtable.h>
- #include <linux/smp.h>
-
- static inline void fill_ldt(struct desc_struct *desc,
-@@ -15,6 +16,7 @@ static inline void fill_ldt(struct desc_struct *desc,
- desc->base1 = (info->base_addr & 0x00ff0000) >> 16;
- desc->type = (info->read_exec_only ^ 1) << 1;
- desc->type |= info->contents << 2;
-+ desc->type |= info->seg_not_present ^ 1;
- desc->s = 1;
- desc->dpl = 0x3;
- desc->p = info->seg_not_present ^ 1;
-@@ -31,16 +33,12 @@ static inline void fill_ldt(struct desc_struct *desc,
- }
-
- extern struct desc_ptr idt_descr;
--extern gate_desc idt_table[];
--
--struct gdt_page {
-- struct desc_struct gdt[GDT_ENTRIES];
--} __attribute__((aligned(PAGE_SIZE)));
--DECLARE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page);
-+extern gate_desc idt_table[256];
-
-+extern struct desc_struct cpu_gdt_table[NR_CPUS][PAGE_SIZE / sizeof(struct desc_struct)];
- static inline struct desc_struct *get_cpu_gdt_table(unsigned int cpu)
- {
-- return per_cpu(gdt_page, cpu).gdt;
-+ return cpu_gdt_table[cpu];
- }
-
- #ifdef CONFIG_X86_64
-@@ -65,9 +63,14 @@ static inline void pack_gate(gate_desc *gate, unsigned char type,
- unsigned long base, unsigned dpl, unsigned flags,
- unsigned short seg)
- {
-- gate->a = (seg << 16) | (base & 0xffff);
-- gate->b = (base & 0xffff0000) |
-- (((0x80 | type | (dpl << 5)) & 0xff) << 8);
-+ gate->gate.offset_low = base;
-+ gate->gate.seg = seg;
-+ gate->gate.reserved = 0;
-+ gate->gate.type = type;
-+ gate->gate.s = 0;
-+ gate->gate.dpl = dpl;
-+ gate->gate.p = 1;
-+ gate->gate.offset_high = base >> 16;
- }
-
- #endif
-@@ -115,13 +118,17 @@ static inline void paravirt_free_ldt(struct desc_struct *ldt, unsigned entries)
- static inline void native_write_idt_entry(gate_desc *idt, int entry,
- const gate_desc *gate)
- {
-+ pax_open_kernel();
- memcpy(&idt[entry], gate, sizeof(*gate));
-+ pax_close_kernel();
- }
-
- static inline void native_write_ldt_entry(struct desc_struct *ldt, int entry,
- const void *desc)
- {
-+ pax_open_kernel();
- memcpy(&ldt[entry], desc, 8);
-+ pax_close_kernel();
- }
-
- static inline void native_write_gdt_entry(struct desc_struct *gdt, int entry,
-@@ -139,7 +146,10 @@ static inline void native_write_gdt_entry(struct desc_struct *gdt, int entry,
- size = sizeof(struct desc_struct);
- break;
- }
-+
-+ pax_open_kernel();
- memcpy(&gdt[entry], desc, size);
-+ pax_close_kernel();
- }
-
- static inline void pack_descriptor(struct desc_struct *desc, unsigned long base,
-@@ -211,7 +221,9 @@ static inline void native_set_ldt(const void *addr, unsigned int entries)
-
- static inline void native_load_tr_desc(void)
- {
-+ pax_open_kernel();
- asm volatile("ltr %w0"::"q" (GDT_ENTRY_TSS*8));
-+ pax_close_kernel();
- }
-
- static inline void native_load_gdt(const struct desc_ptr *dtr)
-@@ -246,8 +258,10 @@ static inline void native_load_tls(struct thread_struct *t, unsigned int cpu)
- unsigned int i;
- struct desc_struct *gdt = get_cpu_gdt_table(cpu);
-
-+ pax_open_kernel();
- for (i = 0; i < GDT_ENTRY_TLS_ENTRIES; i++)
- gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i];
-+ pax_close_kernel();
- }
-
- #define _LDT_empty(info) \
-@@ -309,7 +323,7 @@ static inline void set_desc_limit(struct desc_struct *desc, unsigned long limit)
- desc->limit = (limit >> 16) & 0xf;
- }
-
--static inline void _set_gate(int gate, unsigned type, void *addr,
-+static inline void _set_gate(int gate, unsigned type, const void *addr,
- unsigned dpl, unsigned ist, unsigned seg)
- {
- gate_desc s;
-@@ -327,7 +341,7 @@ static inline void _set_gate(int gate, unsigned type, void *addr,
- * Pentium F0 0F bugfix can have resulted in the mapped
- * IDT being write-protected.
- */
--static inline void set_intr_gate(unsigned int n, void *addr)
-+static inline void set_intr_gate(unsigned int n, const void *addr)
- {
- BUG_ON((unsigned)n > 0xFF);
- _set_gate(n, GATE_INTERRUPT, addr, 0, 0, __KERNEL_CS);
-@@ -356,19 +370,19 @@ static inline void alloc_intr_gate(unsigned int n, void *addr)
- /*
- * This routine sets up an interrupt gate at directory privilege level 3.
- */
--static inline void set_system_intr_gate(unsigned int n, void *addr)
-+static inline void set_system_intr_gate(unsigned int n, const void *addr)
- {
- BUG_ON((unsigned)n > 0xFF);
- _set_gate(n, GATE_INTERRUPT, addr, 0x3, 0, __KERNEL_CS);
- }
-
--static inline void set_system_trap_gate(unsigned int n, void *addr)
-+static inline void set_system_trap_gate(unsigned int n, const void *addr)
- {
- BUG_ON((unsigned)n > 0xFF);
- _set_gate(n, GATE_TRAP, addr, 0x3, 0, __KERNEL_CS);
- }
-
--static inline void set_trap_gate(unsigned int n, void *addr)
-+static inline void set_trap_gate(unsigned int n, const void *addr)
- {
- BUG_ON((unsigned)n > 0xFF);
- _set_gate(n, GATE_TRAP, addr, 0, 0, __KERNEL_CS);
-@@ -377,19 +391,31 @@ static inline void set_trap_gate(unsigned int n, void *addr)
- static inline void set_task_gate(unsigned int n, unsigned int gdt_entry)
- {
- BUG_ON((unsigned)n > 0xFF);
-- _set_gate(n, GATE_TASK, (void *)0, 0, 0, (gdt_entry<<3));
-+ _set_gate(n, GATE_TASK, (const void *)0, 0, 0, (gdt_entry<<3));
- }
-
--static inline void set_intr_gate_ist(int n, void *addr, unsigned ist)
-+static inline void set_intr_gate_ist(int n, const void *addr, unsigned ist)
- {
- BUG_ON((unsigned)n > 0xFF);
- _set_gate(n, GATE_INTERRUPT, addr, 0, ist, __KERNEL_CS);
- }
-
--static inline void set_system_intr_gate_ist(int n, void *addr, unsigned ist)
-+static inline void set_system_intr_gate_ist(int n, const void *addr, unsigned ist)
- {
- BUG_ON((unsigned)n > 0xFF);
- _set_gate(n, GATE_INTERRUPT, addr, 0x3, ist, __KERNEL_CS);
- }
-
-+#ifdef CONFIG_X86_32
-+static inline void set_user_cs(unsigned long base, unsigned long limit, int cpu)
-+{
-+ struct desc_struct d;
-+
-+ if (likely(limit))
-+ limit = (limit - 1UL) >> PAGE_SHIFT;
-+ pack_descriptor(&d, base, limit, 0xFB, 0xC);
-+ write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_CS, &d, DESCTYPE_S);
-+}
-+#endif
-+
- #endif /* _ASM_X86_DESC_H */
-diff --git a/arch/x86/include/asm/desc_defs.h b/arch/x86/include/asm/desc_defs.h
-index 9d66848..6b4a691 100644
---- a/arch/x86/include/asm/desc_defs.h
-+++ b/arch/x86/include/asm/desc_defs.h
-@@ -31,6 +31,12 @@ struct desc_struct {
- unsigned base1: 8, type: 4, s: 1, dpl: 2, p: 1;
- unsigned limit: 4, avl: 1, l: 1, d: 1, g: 1, base2: 8;
- };
-+ struct {
-+ u16 offset_low;
-+ u16 seg;
-+ unsigned reserved: 8, type: 4, s: 1, dpl: 2, p: 1;
-+ unsigned offset_high: 16;
-+ } gate;
- };
- } __attribute__((packed));
-
-diff --git a/arch/x86/include/asm/device.h b/arch/x86/include/asm/device.h
-index cee34e9..a7c3fa2 100644
---- a/arch/x86/include/asm/device.h
-+++ b/arch/x86/include/asm/device.h
-@@ -6,7 +6,7 @@ struct dev_archdata {
- void *acpi_handle;
- #endif
- #ifdef CONFIG_X86_64
--struct dma_map_ops *dma_ops;
-+ const struct dma_map_ops *dma_ops;
- #endif
- #ifdef CONFIG_DMAR
- void *iommu; /* hook for IOMMU specific extension */
-diff --git a/arch/x86/include/asm/dma-mapping.h b/arch/x86/include/asm/dma-mapping.h
-index 6a25d5d..786b202 100644
---- a/arch/x86/include/asm/dma-mapping.h
-+++ b/arch/x86/include/asm/dma-mapping.h
-@@ -25,9 +25,9 @@ extern int iommu_merge;
- extern struct device x86_dma_fallback_dev;
- extern int panic_on_overflow;
-
--extern struct dma_map_ops *dma_ops;
-+extern const struct dma_map_ops *dma_ops;
-
--static inline struct dma_map_ops *get_dma_ops(struct device *dev)
-+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
- {
- #ifdef CONFIG_X86_32
- return dma_ops;
-@@ -44,7 +44,7 @@ static inline struct dma_map_ops *get_dma_ops(struct device *dev)
- /* Make sure we keep the same behaviour */
- static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
- if (ops->mapping_error)
- return ops->mapping_error(dev, dma_addr);
-
-@@ -122,7 +122,7 @@ static inline void *
- dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
- gfp_t gfp)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
- void *memory;
-
- gfp &= ~(__GFP_DMA | __GFP_HIGHMEM | __GFP_DMA32);
-@@ -149,7 +149,7 @@ dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
- static inline void dma_free_coherent(struct device *dev, size_t size,
- void *vaddr, dma_addr_t bus)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- WARN_ON(irqs_disabled()); /* for portability */
-
-diff --git a/arch/x86/include/asm/e820.h b/arch/x86/include/asm/e820.h
-index 40b4e61..40d8133 100644
---- a/arch/x86/include/asm/e820.h
-+++ b/arch/x86/include/asm/e820.h
-@@ -133,7 +133,7 @@ extern char *default_machine_specific_memory_setup(void);
- #define ISA_END_ADDRESS 0x100000
- #define is_ISA_range(s, e) ((s) >= ISA_START_ADDRESS && (e) < ISA_END_ADDRESS)
-
--#define BIOS_BEGIN 0x000a0000
-+#define BIOS_BEGIN 0x000c0000
- #define BIOS_END 0x00100000
-
- #ifdef __KERNEL__
-diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
-index 8ac9d9a..0a6c96e 100644
---- a/arch/x86/include/asm/elf.h
-+++ b/arch/x86/include/asm/elf.h
-@@ -257,7 +257,25 @@ extern int force_personality32;
- the loader. We need to make sure that it is out of the way of the program
- that it will "exec", and that there is sufficient room for the brk. */
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+#define ELF_ET_DYN_BASE ((current->mm->pax_flags & MF_PAX_SEGMEXEC) ? SEGMEXEC_TASK_SIZE/3*2 : TASK_SIZE/3*2)
-+#else
- #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
-+#endif
-+
-+#ifdef CONFIG_PAX_ASLR
-+#ifdef CONFIG_X86_32
-+#define PAX_ELF_ET_DYN_BASE 0x10000000UL
-+
-+#define PAX_DELTA_MMAP_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
-+#define PAX_DELTA_STACK_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
-+#else
-+#define PAX_ELF_ET_DYN_BASE 0x400000UL
-+
-+#define PAX_DELTA_MMAP_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
-+#define PAX_DELTA_STACK_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
-+#endif
-+#endif
-
- /* This yields a mask that user programs can use to figure out what
- instruction set this CPU supports. This could be done in user space,
-@@ -310,9 +328,7 @@ do { \
-
- #define ARCH_DLINFO \
- do { \
-- if (vdso_enabled) \
-- NEW_AUX_ENT(AT_SYSINFO_EHDR, \
-- (unsigned long)current->mm->context.vdso); \
-+ NEW_AUX_ENT(AT_SYSINFO_EHDR, current->mm->context.vdso); \
- } while (0)
-
- #define AT_SYSINFO 32
-@@ -323,7 +339,7 @@ do { \
-
- #endif /* !CONFIG_X86_32 */
-
--#define VDSO_CURRENT_BASE ((unsigned long)current->mm->context.vdso)
-+#define VDSO_CURRENT_BASE (current->mm->context.vdso)
-
- #define VDSO_ENTRY \
- ((unsigned long)VDSO32_SYMBOL(VDSO_CURRENT_BASE, vsyscall))
-@@ -337,7 +353,4 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
- extern int syscall32_setup_pages(struct linux_binprm *, int exstack);
- #define compat_arch_setup_additional_pages syscall32_setup_pages
-
--extern unsigned long arch_randomize_brk(struct mm_struct *mm);
--#define arch_randomize_brk arch_randomize_brk
--
- #endif /* _ASM_X86_ELF_H */
-diff --git a/arch/x86/include/asm/emergency-restart.h b/arch/x86/include/asm/emergency-restart.h
-index cc70c1c..d96d011 100644
---- a/arch/x86/include/asm/emergency-restart.h
-+++ b/arch/x86/include/asm/emergency-restart.h
-@@ -15,6 +15,6 @@ enum reboot_type {
-
- extern enum reboot_type reboot_type;
-
--extern void machine_emergency_restart(void);
-+extern void machine_emergency_restart(void) __noreturn;
-
- #endif /* _ASM_X86_EMERGENCY_RESTART_H */
-diff --git a/arch/x86/include/asm/futex.h b/arch/x86/include/asm/futex.h
-index 1f11ce4..3fed751 100644
---- a/arch/x86/include/asm/futex.h
-+++ b/arch/x86/include/asm/futex.h
-@@ -12,20 +12,22 @@
- #include <asm/system.h>
-
- #define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg) \
-+ typecheck(u32 __user *, uaddr); \
- asm volatile("1:\t" insn "\n" \
- "2:\t.section .fixup,\"ax\"\n" \
- "3:\tmov\t%3, %1\n" \
- "\tjmp\t2b\n" \
- "\t.previous\n" \
- _ASM_EXTABLE(1b, 3b) \
-- : "=r" (oldval), "=r" (ret), "+m" (*uaddr) \
-+ : "=r" (oldval), "=r" (ret), "+m" (*(u32 __user *)____m(uaddr))\
- : "i" (-EFAULT), "0" (oparg), "1" (0))
-
- #define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg) \
-+ typecheck(u32 __user *, uaddr); \
- asm volatile("1:\tmovl %2, %0\n" \
- "\tmovl\t%0, %3\n" \
- "\t" insn "\n" \
-- "2:\t" LOCK_PREFIX "cmpxchgl %3, %2\n" \
-+ "2:\t" LOCK_PREFIX __copyuser_seg"cmpxchgl %3, %2\n" \
- "\tjnz\t1b\n" \
- "3:\t.section .fixup,\"ax\"\n" \
- "4:\tmov\t%5, %1\n" \
-@@ -34,10 +36,10 @@
- _ASM_EXTABLE(1b, 4b) \
- _ASM_EXTABLE(2b, 4b) \
- : "=&a" (oldval), "=&r" (ret), \
-- "+m" (*uaddr), "=&r" (tem) \
-+ "+m" (*(u32 __user *)____m(uaddr)), "=&r" (tem) \
- : "r" (oparg), "i" (-EFAULT), "1" (0))
-
--static inline int futex_atomic_op_inuser(int encoded_op, int __user *uaddr)
-+static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
- {
- int op = (encoded_op >> 28) & 7;
- int cmp = (encoded_op >> 24) & 15;
-@@ -61,10 +63,10 @@ static inline int futex_atomic_op_inuser(int encoded_op, int __user *uaddr)
-
- switch (op) {
- case FUTEX_OP_SET:
-- __futex_atomic_op1("xchgl %0, %2", ret, oldval, uaddr, oparg);
-+ __futex_atomic_op1(__copyuser_seg"xchgl %0, %2", ret, oldval, uaddr, oparg);
- break;
- case FUTEX_OP_ADD:
-- __futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret, oldval,
-+ __futex_atomic_op1(LOCK_PREFIX __copyuser_seg"xaddl %0, %2", ret, oldval,
- uaddr, oparg);
- break;
- case FUTEX_OP_OR:
-@@ -109,7 +111,7 @@ static inline int futex_atomic_op_inuser(int encoded_op, int __user *uaddr)
- return ret;
- }
-
--static inline int futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval,
-+static inline int futex_atomic_cmpxchg_inatomic(u32 __user *uaddr, int oldval,
- int newval)
- {
-
-@@ -119,16 +121,16 @@ static inline int futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval,
- return -ENOSYS;
- #endif
-
-- if (!access_ok(VERIFY_WRITE, uaddr, sizeof(int)))
-+ if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
- return -EFAULT;
-
-- asm volatile("1:\t" LOCK_PREFIX "cmpxchgl %3, %1\n"
-+ asm volatile("1:\t" LOCK_PREFIX __copyuser_seg"cmpxchgl %3, %1\n"
- "2:\t.section .fixup, \"ax\"\n"
- "3:\tmov %2, %0\n"
- "\tjmp 2b\n"
- "\t.previous\n"
- _ASM_EXTABLE(1b, 3b)
-- : "=a" (oldval), "+m" (*uaddr)
-+ : "=a" (oldval), "+m" (*(u32 *)____m(uaddr))
- : "i" (-EFAULT), "r" (newval), "0" (oldval)
- : "memory"
- );
-diff --git a/arch/x86/include/asm/hw_irq.h b/arch/x86/include/asm/hw_irq.h
-index ba180d9..3bad351 100644
---- a/arch/x86/include/asm/hw_irq.h
-+++ b/arch/x86/include/asm/hw_irq.h
-@@ -92,8 +92,8 @@ extern void setup_ioapic_dest(void);
- extern void enable_IO_APIC(void);
-
- /* Statistics */
--extern atomic_t irq_err_count;
--extern atomic_t irq_mis_count;
-+extern atomic_unchecked_t irq_err_count;
-+extern atomic_unchecked_t irq_mis_count;
-
- /* EISA */
- extern void eisa_set_level_irq(unsigned int irq);
-diff --git a/arch/x86/include/asm/i387.h b/arch/x86/include/asm/i387.h
-index 0b20bbb..f06479b 100644
---- a/arch/x86/include/asm/i387.h
-+++ b/arch/x86/include/asm/i387.h
-@@ -56,10 +56,12 @@ static inline void tolerant_fwait(void)
- _ASM_EXTABLE(1b, 2b));
- }
-
--static inline int fxrstor_checking(struct i387_fxsave_struct *fx)
-+static inline int fxrstor_checking(struct i387_fxsave_struct __user *fx)
- {
- int err;
-
-+ fx = (struct i387_fxsave_struct __user *)____m(fx);
-+
- asm volatile("1: rex64/fxrstor (%[fx])\n\t"
- "2:\n"
- ".section .fixup,\"ax\"\n"
-@@ -105,6 +107,8 @@ static inline int fxsave_user(struct i387_fxsave_struct __user *fx)
- {
- int err;
-
-+ fx = (struct i387_fxsave_struct __user *)____m(fx);
-+
- asm volatile("1: rex64/fxsave (%[fx])\n\t"
- "2:\n"
- ".section .fixup,\"ax\"\n"
-@@ -179,15 +183,15 @@ static inline void tolerant_fwait(void)
- }
-
- /* perform fxrstor iff the processor has extended states, otherwise frstor */
--static inline int fxrstor_checking(struct i387_fxsave_struct *fx)
-+static inline int fxrstor_checking(struct i387_fxsave_struct __user *fx)
- {
- /*
- * The "nop" is needed to make the instructions the same
- * length.
- */
- alternative_input(
-- "nop ; frstor %1",
-- "fxrstor %1",
-+ __copyuser_seg" frstor %1; nop",
-+ __copyuser_seg" fxrstor %1",
- X86_FEATURE_FXSR,
- "m" (*fx));
-
-@@ -195,13 +199,8 @@ static inline int fxrstor_checking(struct i387_fxsave_struct *fx)
- }
-
- /* We need a safe address that is cheap to find and that is already
-- in L1 during context switch. The best choices are unfortunately
-- different for UP and SMP */
--#ifdef CONFIG_SMP
--#define safe_address (__per_cpu_offset[0])
--#else
--#define safe_address (kstat_cpu(0).cpustat.user)
--#endif
-+ in L1 during context switch. */
-+#define safe_address (init_tss[raw_smp_processor_id()].x86_tss.sp0)
-
- /*
- * These must be called with preempt disabled
-@@ -258,8 +257,16 @@ static inline int restore_fpu_checking(struct task_struct *tsk)
- {
- if (task_thread_info(tsk)->status & TS_XSAVE)
- return xrstor_checking(&tsk->thread.xstate->xsave);
-- else
-- return fxrstor_checking(&tsk->thread.xstate->fxsave);
-+ else {
-+ int ret;
-+ mm_segment_t fs;
-+
-+ fs = get_fs();
-+ set_fs(KERNEL_DS);
-+ ret = fxrstor_checking(&tsk->thread.xstate->fxsave);
-+ set_fs(fs);
-+ return ret;
-+ }
- }
-
- /*
-@@ -291,7 +298,7 @@ static inline void kernel_fpu_begin(void)
- struct thread_info *me = current_thread_info();
- preempt_disable();
- if (me->status & TS_USEDFPU)
-- __save_init_fpu(me->task);
-+ __save_init_fpu(current);
- else
- clts();
- }
-diff --git a/arch/x86/include/asm/io.h b/arch/x86/include/asm/io.h
-index 6a63b86..b6a731c 100644
---- a/arch/x86/include/asm/io.h
-+++ b/arch/x86/include/asm/io.h
-@@ -170,7 +170,7 @@ static inline void __iomem *ioremap(resource_size_t offset, unsigned long size)
- return ioremap_nocache(offset, size);
- }
-
--extern void iounmap(volatile void __iomem *addr);
-+extern void iounmap(const volatile void __iomem *addr);
-
- extern void set_iounmap_nonlazy(void);
-
-diff --git a/arch/x86/include/asm/io_32.h b/arch/x86/include/asm/io_32.h
-index a299900..15c5410 100644
---- a/arch/x86/include/asm/io_32.h
-+++ b/arch/x86/include/asm/io_32.h
-@@ -3,6 +3,7 @@
-
- #include <linux/string.h>
- #include <linux/compiler.h>
-+#include <asm/processor.h>
-
- /*
- * This file contains the definitions for the x86 IO instructions
-@@ -42,6 +43,17 @@
-
- #ifdef __KERNEL__
-
-+#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
-+static inline int valid_phys_addr_range(unsigned long addr, size_t count)
-+{
-+ return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
-+}
-+
-+static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
-+{
-+ return (pfn + (count >> PAGE_SHIFT)) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
-+}
-+
- #include <asm-generic/iomap.h>
-
- #include <linux/vmalloc.h>
-diff --git a/arch/x86/include/asm/io_64.h b/arch/x86/include/asm/io_64.h
-index 2440678..c158b88 100644
---- a/arch/x86/include/asm/io_64.h
-+++ b/arch/x86/include/asm/io_64.h
-@@ -140,6 +140,17 @@ __OUTS(l)
-
- #include <linux/vmalloc.h>
-
-+#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
-+static inline int valid_phys_addr_range(unsigned long addr, size_t count)
-+{
-+ return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
-+}
-+
-+static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
-+{
-+ return (pfn + (count >> PAGE_SHIFT)) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
-+}
-+
- #include <asm-generic/iomap.h>
-
- void __memcpy_fromio(void *, unsigned long, unsigned);
-diff --git a/arch/x86/include/asm/iommu.h b/arch/x86/include/asm/iommu.h
-index fd6d21b..8b13915 100644
---- a/arch/x86/include/asm/iommu.h
-+++ b/arch/x86/include/asm/iommu.h
-@@ -3,7 +3,7 @@
-
- extern void pci_iommu_shutdown(void);
- extern void no_iommu_init(void);
--extern struct dma_map_ops nommu_dma_ops;
-+extern const struct dma_map_ops nommu_dma_ops;
- extern int force_iommu, no_iommu;
- extern int iommu_detected;
- extern int iommu_pass_through;
-diff --git a/arch/x86/include/asm/irqflags.h b/arch/x86/include/asm/irqflags.h
-index 9e2b952..557206e 100644
---- a/arch/x86/include/asm/irqflags.h
-+++ b/arch/x86/include/asm/irqflags.h
-@@ -142,6 +142,11 @@ static inline unsigned long __raw_local_irq_save(void)
- sti; \
- sysexit
-
-+#define GET_CR0_INTO_RDI mov %cr0, %rdi
-+#define SET_RDI_INTO_CR0 mov %rdi, %cr0
-+#define GET_CR3_INTO_RDI mov %cr3, %rdi
-+#define SET_RDI_INTO_CR3 mov %rdi, %cr3
-+
- #else
- #define INTERRUPT_RETURN iret
- #define ENABLE_INTERRUPTS_SYSEXIT sti; sysexit
-diff --git a/arch/x86/include/asm/kprobes.h b/arch/x86/include/asm/kprobes.h
-index 4fe681d..bb6d40c 100644
---- a/arch/x86/include/asm/kprobes.h
-+++ b/arch/x86/include/asm/kprobes.h
-@@ -34,13 +34,8 @@ typedef u8 kprobe_opcode_t;
- #define BREAKPOINT_INSTRUCTION 0xcc
- #define RELATIVEJUMP_INSTRUCTION 0xe9
- #define MAX_INSN_SIZE 16
--#define MAX_STACK_SIZE 64
--#define MIN_STACK_SIZE(ADDR) \
-- (((MAX_STACK_SIZE) < (((unsigned long)current_thread_info()) + \
-- THREAD_SIZE - (unsigned long)(ADDR))) \
-- ? (MAX_STACK_SIZE) \
-- : (((unsigned long)current_thread_info()) + \
-- THREAD_SIZE - (unsigned long)(ADDR)))
-+#define MAX_STACK_SIZE 64UL
-+#define MIN_STACK_SIZE(ADDR) min(MAX_STACK_SIZE, current->thread.sp0 - (unsigned long)(ADDR))
-
- #define flush_insn_slot(p) do { } while (0)
-
-diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
-index 08bc2ff..2e88d1f 100644
---- a/arch/x86/include/asm/kvm_host.h
-+++ b/arch/x86/include/asm/kvm_host.h
-@@ -534,9 +534,9 @@ struct kvm_x86_ops {
- bool (*gb_page_enable)(void);
-
- const struct trace_print_flags *exit_reasons_str;
--};
-+} __do_const;
-
--extern struct kvm_x86_ops *kvm_x86_ops;
-+extern const struct kvm_x86_ops *kvm_x86_ops;
-
- int kvm_mmu_module_init(void);
- void kvm_mmu_module_exit(void);
-diff --git a/arch/x86/include/asm/local.h b/arch/x86/include/asm/local.h
-index 47b9b6f..17233f6 100644
---- a/arch/x86/include/asm/local.h
-+++ b/arch/x86/include/asm/local.h
-@@ -11,33 +11,97 @@ typedef struct {
- atomic_long_t a;
- } local_t;
-
-+typedef struct {
-+ atomic_long_unchecked_t a;
-+} local_unchecked_t;
-+
- #define LOCAL_INIT(i) { ATOMIC_LONG_INIT(i) }
-
- #define local_read(l) atomic_long_read(&(l)->a)
-+#define local_read_unchecked(l) atomic_long_read_unchecked(&(l)->a)
- #define local_set(l, i) atomic_long_set(&(l)->a, (i))
-+#define local_set_unchecked(l, i) atomic_long_set_unchecked(&(l)->a, (i))
-
- static inline void local_inc(local_t *l)
- {
-- asm volatile(_ASM_INC "%0"
-+ asm volatile(_ASM_INC "%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ _ASM_DEC "%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "+m" (l->a.counter));
-+}
-+
-+static inline void local_inc_unchecked(local_unchecked_t *l)
-+{
-+ asm volatile(_ASM_INC "%0\n"
- : "+m" (l->a.counter));
- }
-
- static inline void local_dec(local_t *l)
- {
-- asm volatile(_ASM_DEC "%0"
-+ asm volatile(_ASM_DEC "%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ _ASM_INC "%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "+m" (l->a.counter));
-+}
-+
-+static inline void local_dec_unchecked(local_unchecked_t *l)
-+{
-+ asm volatile(_ASM_DEC "%0\n"
- : "+m" (l->a.counter));
- }
-
- static inline void local_add(long i, local_t *l)
- {
-- asm volatile(_ASM_ADD "%1,%0"
-+ asm volatile(_ASM_ADD "%1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ _ASM_SUB "%1,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "+m" (l->a.counter)
-+ : "ir" (i));
-+}
-+
-+static inline void local_add_unchecked(long i, local_unchecked_t *l)
-+{
-+ asm volatile(_ASM_ADD "%1,%0\n"
- : "+m" (l->a.counter)
- : "ir" (i));
- }
-
- static inline void local_sub(long i, local_t *l)
- {
-- asm volatile(_ASM_SUB "%1,%0"
-+ asm volatile(_ASM_SUB "%1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ _ASM_ADD "%1,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "+m" (l->a.counter)
-+ : "ir" (i));
-+}
-+
-+static inline void local_sub_unchecked(long i, local_unchecked_t *l)
-+{
-+ asm volatile(_ASM_SUB "%1,%0\n"
- : "+m" (l->a.counter)
- : "ir" (i));
- }
-@@ -55,7 +119,16 @@ static inline int local_sub_and_test(long i, local_t *l)
- {
- unsigned char c;
-
-- asm volatile(_ASM_SUB "%2,%0; sete %1"
-+ asm volatile(_ASM_SUB "%2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ _ASM_ADD "%2,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
- : "+m" (l->a.counter), "=qm" (c)
- : "ir" (i) : "memory");
- return c;
-@@ -73,7 +146,16 @@ static inline int local_dec_and_test(local_t *l)
- {
- unsigned char c;
-
-- asm volatile(_ASM_DEC "%0; sete %1"
-+ asm volatile(_ASM_DEC "%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ _ASM_INC "%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
- : "+m" (l->a.counter), "=qm" (c)
- : : "memory");
- return c != 0;
-@@ -91,7 +173,16 @@ static inline int local_inc_and_test(local_t *l)
- {
- unsigned char c;
-
-- asm volatile(_ASM_INC "%0; sete %1"
-+ asm volatile(_ASM_INC "%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ _ASM_DEC "%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
- : "+m" (l->a.counter), "=qm" (c)
- : : "memory");
- return c != 0;
-@@ -110,7 +201,16 @@ static inline int local_add_negative(long i, local_t *l)
- {
- unsigned char c;
-
-- asm volatile(_ASM_ADD "%2,%0; sets %1"
-+ asm volatile(_ASM_ADD "%2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ _ASM_SUB "%2,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sets %1\n"
- : "+m" (l->a.counter), "=qm" (c)
- : "ir" (i) : "memory");
- return c;
-@@ -133,7 +233,15 @@ static inline long local_add_return(long i, local_t *l)
- #endif
- /* Modern 486+ processor */
- __i = i;
-- asm volatile(_ASM_XADD "%0, %1;"
-+ asm volatile(_ASM_XADD "%0, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ _ASM_MOV "%0,%1\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- : "+r" (i), "+m" (l->a.counter)
- : : "memory");
- return i + __i;
-@@ -148,6 +256,38 @@ no_xadd: /* Legacy 386 processor */
- #endif
- }
-
-+/**
-+ * local_add_return_unchecked - add and return
-+ * @i: integer value to add
-+ * @l: pointer to type local_unchecked_t
-+ *
-+ * Atomically adds @i to @l and returns @i + @l
-+ */
-+static inline long local_add_return_unchecked(long i, local_unchecked_t *l)
-+{
-+ long __i;
-+#ifdef CONFIG_M386
-+ unsigned long flags;
-+ if (unlikely(boot_cpu_data.x86 <= 3))
-+ goto no_xadd;
-+#endif
-+ /* Modern 486+ processor */
-+ __i = i;
-+ asm volatile(_ASM_XADD "%0, %1\n"
-+ : "+r" (i), "+m" (l->a.counter)
-+ : : "memory");
-+ return i + __i;
-+
-+#ifdef CONFIG_M386
-+no_xadd: /* Legacy 386 processor */
-+ local_irq_save(flags);
-+ __i = local_read_unchecked(l);
-+ local_set_unchecked(l, i + __i);
-+ local_irq_restore(flags);
-+ return i + __i;
-+#endif
-+}
-+
- static inline long local_sub_return(long i, local_t *l)
- {
- return local_add_return(-i, l);
-@@ -158,6 +298,8 @@ static inline long local_sub_return(long i, local_t *l)
-
- #define local_cmpxchg(l, o, n) \
- (cmpxchg_local(&((l)->a.counter), (o), (n)))
-+#define local_cmpxchg_unchecked(l, o, n) \
-+ (cmpxchg_local(&((l)->a.counter), (o), (n)))
- /* Always has a lock prefix */
- #define local_xchg(l, n) (xchg(&((l)->a.counter), (n)))
-
-diff --git a/arch/x86/include/asm/microcode.h b/arch/x86/include/asm/microcode.h
-index ef51b50..514ba37 100644
---- a/arch/x86/include/asm/microcode.h
-+++ b/arch/x86/include/asm/microcode.h
-@@ -12,13 +12,13 @@ struct device;
- enum ucode_state { UCODE_ERROR, UCODE_OK, UCODE_NFOUND };
-
- struct microcode_ops {
-- enum ucode_state (*request_microcode_user) (int cpu,
-+ enum ucode_state (* const request_microcode_user) (int cpu,
- const void __user *buf, size_t size);
-
-- enum ucode_state (*request_microcode_fw) (int cpu,
-+ enum ucode_state (* const request_microcode_fw) (int cpu,
- struct device *device);
-
-- void (*microcode_fini_cpu) (int cpu);
-+ void (* const microcode_fini_cpu) (int cpu);
-
- /*
- * The generic 'microcode_core' part guarantees that
-@@ -38,18 +38,18 @@ struct ucode_cpu_info {
- extern struct ucode_cpu_info ucode_cpu_info[];
-
- #ifdef CONFIG_MICROCODE_INTEL
--extern struct microcode_ops * __init init_intel_microcode(void);
-+extern const struct microcode_ops * __init init_intel_microcode(void);
- #else
--static inline struct microcode_ops * __init init_intel_microcode(void)
-+static inline const struct microcode_ops * __init init_intel_microcode(void)
- {
- return NULL;
- }
- #endif /* CONFIG_MICROCODE_INTEL */
-
- #ifdef CONFIG_MICROCODE_AMD
--extern struct microcode_ops * __init init_amd_microcode(void);
-+extern const struct microcode_ops * __init init_amd_microcode(void);
- #else
--static inline struct microcode_ops * __init init_amd_microcode(void)
-+static inline const struct microcode_ops * __init init_amd_microcode(void)
- {
- return NULL;
- }
-diff --git a/arch/x86/include/asm/mman.h b/arch/x86/include/asm/mman.h
-index 593e51d..fa69c9a 100644
---- a/arch/x86/include/asm/mman.h
-+++ b/arch/x86/include/asm/mman.h
-@@ -5,4 +5,14 @@
-
- #include <asm-generic/mman.h>
-
-+#ifdef __KERNEL__
-+#ifndef __ASSEMBLY__
-+#ifdef CONFIG_X86_32
-+#define arch_mmap_check i386_mmap_check
-+int i386_mmap_check(unsigned long addr, unsigned long len,
-+ unsigned long flags);
-+#endif
-+#endif
-+#endif
-+
- #endif /* _ASM_X86_MMAN_H */
-diff --git a/arch/x86/include/asm/mmu.h b/arch/x86/include/asm/mmu.h
-index 80a1dee..239c67d 100644
---- a/arch/x86/include/asm/mmu.h
-+++ b/arch/x86/include/asm/mmu.h
-@@ -9,10 +9,23 @@
- * we put the segment information here.
- */
- typedef struct {
-- void *ldt;
-+ struct desc_struct *ldt;
- int size;
- struct mutex lock;
-- void *vdso;
-+ unsigned long vdso;
-+
-+#ifdef CONFIG_X86_32
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+ unsigned long user_cs_base;
-+ unsigned long user_cs_limit;
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
-+ cpumask_t cpu_user_cs_mask;
-+#endif
-+
-+#endif
-+#endif
-+
- } mm_context_t;
-
- #ifdef CONFIG_SMP
-diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
-index 8b5393e..b59dac9 100644
---- a/arch/x86/include/asm/mmu_context.h
-+++ b/arch/x86/include/asm/mmu_context.h
-@@ -24,6 +24,18 @@ void destroy_context(struct mm_struct *mm);
-
- static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
- {
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ unsigned int i;
-+ pgd_t *pgd;
-+
-+ pax_open_kernel();
-+ pgd = get_cpu_pgd(smp_processor_id());
-+ for (i = USER_PGD_PTRS; i < 2 * USER_PGD_PTRS; ++i)
-+ set_pgd_batched(pgd+i, native_make_pgd(0));
-+ pax_close_kernel();
-+#endif
-+
- #ifdef CONFIG_SMP
- if (percpu_read(cpu_tlbstate.state) == TLBSTATE_OK)
- percpu_write(cpu_tlbstate.state, TLBSTATE_LAZY);
-@@ -34,16 +46,30 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
- struct task_struct *tsk)
- {
- unsigned cpu = smp_processor_id();
-+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)) && defined(CONFIG_SMP)
-+ int tlbstate = TLBSTATE_OK;
-+#endif
-
- if (likely(prev != next)) {
- #ifdef CONFIG_SMP
-+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
-+ tlbstate = percpu_read(cpu_tlbstate.state);
-+#endif
- percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
- percpu_write(cpu_tlbstate.active_mm, next);
- #endif
- cpumask_set_cpu(cpu, mm_cpumask(next));
-
- /* Re-load page tables */
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ pax_open_kernel();
-+ __clone_user_pgds(get_cpu_pgd(cpu), next->pgd);
-+ __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd);
-+ pax_close_kernel();
-+ load_cr3(get_cpu_pgd(cpu));
-+#else
- load_cr3(next->pgd);
-+#endif
-
- /* stop flush ipis for the previous mm */
- cpumask_clear_cpu(cpu, mm_cpumask(prev));
-@@ -53,9 +79,38 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
- */
- if (unlikely(prev->context.ldt != next->context.ldt))
- load_LDT_nolock(&next->context);
-- }
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
-+ if (!nx_enabled) {
-+ smp_mb__before_clear_bit();
-+ cpu_clear(cpu, prev->context.cpu_user_cs_mask);
-+ smp_mb__after_clear_bit();
-+ cpu_set(cpu, next->context.cpu_user_cs_mask);
-+ }
-+#endif
-+
-+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
-+ if (unlikely(prev->context.user_cs_base != next->context.user_cs_base ||
-+ prev->context.user_cs_limit != next->context.user_cs_limit))
-+ set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
- #ifdef CONFIG_SMP
-+ else if (unlikely(tlbstate != TLBSTATE_OK))
-+ set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
-+#endif
-+#endif
-+
-+ }
- else {
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ pax_open_kernel();
-+ __clone_user_pgds(get_cpu_pgd(cpu), next->pgd);
-+ __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd);
-+ pax_close_kernel();
-+ load_cr3(get_cpu_pgd(cpu));
-+#endif
-+
-+#ifdef CONFIG_SMP
- percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
- BUG_ON(percpu_read(cpu_tlbstate.active_mm) != next);
-
-@@ -64,11 +119,28 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
- * tlb flush IPI delivery. We must reload CR3
- * to make sure to use no freed page tables.
- */
-+
-+#ifndef CONFIG_PAX_PER_CPU_PGD
- load_cr3(next->pgd);
-+#endif
-+
- load_LDT_nolock(&next->context);
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
-+ if (!nx_enabled)
-+ cpu_set(cpu, next->context.cpu_user_cs_mask);
-+#endif
-+
-+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (!((next->pax_flags & MF_PAX_PAGEEXEC) && nx_enabled))
-+#endif
-+ set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
-+#endif
-+
- }
-+#endif
- }
--#endif
- }
-
- #define activate_mm(prev, next) \
-diff --git a/arch/x86/include/asm/module.h b/arch/x86/include/asm/module.h
-index 3e2ce58..caaf478 100644
---- a/arch/x86/include/asm/module.h
-+++ b/arch/x86/include/asm/module.h
-@@ -5,6 +5,7 @@
-
- #ifdef CONFIG_X86_64
- /* X86_64 does not define MODULE_PROC_FAMILY */
-+#define MODULE_PROC_FAMILY ""
- #elif defined CONFIG_M386
- #define MODULE_PROC_FAMILY "386 "
- #elif defined CONFIG_M486
-@@ -59,13 +60,26 @@
- #error unknown processor family
- #endif
-
--#ifdef CONFIG_X86_32
--# ifdef CONFIG_4KSTACKS
--# define MODULE_STACKSIZE "4KSTACKS "
--# else
--# define MODULE_STACKSIZE ""
--# endif
--# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_STACKSIZE
-+#if defined(CONFIG_X86_32) && defined(CONFIG_4KSTACKS)
-+#define MODULE_STACKSIZE "4KSTACKS "
-+#else
-+#define MODULE_STACKSIZE ""
- #endif
-
-+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_BTS
-+#define MODULE_PAX_KERNEXEC "KERNEXEC_BTS "
-+#elif defined(CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR)
-+#define MODULE_PAX_KERNEXEC "KERNEXEC_OR "
-+#else
-+#define MODULE_PAX_KERNEXEC ""
-+#endif
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+#define MODULE_PAX_UDEREF "UDEREF "
-+#else
-+#define MODULE_PAX_UDEREF ""
-+#endif
-+
-+#define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_STACKSIZE MODULE_PAX_KERNEXEC MODULE_PAX_UDEREF
-+
- #endif /* _ASM_X86_MODULE_H */
-diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h
-index 7639dbf..e08a58c 100644
---- a/arch/x86/include/asm/page_64_types.h
-+++ b/arch/x86/include/asm/page_64_types.h
-@@ -56,7 +56,7 @@ void copy_page(void *to, void *from);
-
- /* duplicated to the one in bootmem.h */
- extern unsigned long max_pfn;
--extern unsigned long phys_base;
-+extern const unsigned long phys_base;
-
- extern unsigned long __phys_addr(unsigned long);
- #define __phys_reloc_hide(x) (x)
-diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
-index efb3899..ef30687 100644
---- a/arch/x86/include/asm/paravirt.h
-+++ b/arch/x86/include/asm/paravirt.h
-@@ -648,6 +648,18 @@ static inline void set_pgd(pgd_t *pgdp, pgd_t pgd)
- val);
- }
-
-+static inline void set_pgd_batched(pgd_t *pgdp, pgd_t pgd)
-+{
-+ pgdval_t val = native_pgd_val(pgd);
-+
-+ if (sizeof(pgdval_t) > sizeof(long))
-+ PVOP_VCALL3(pv_mmu_ops.set_pgd_batched, pgdp,
-+ val, (u64)val >> 32);
-+ else
-+ PVOP_VCALL2(pv_mmu_ops.set_pgd_batched, pgdp,
-+ val);
-+}
-+
- static inline void pgd_clear(pgd_t *pgdp)
- {
- set_pgd(pgdp, __pgd(0));
-@@ -729,6 +741,21 @@ static inline void __set_fixmap(unsigned /* enum fixed_addresses */ idx,
- pv_mmu_ops.set_fixmap(idx, phys, flags);
- }
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+static inline unsigned long pax_open_kernel(void)
-+{
-+ return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_open_kernel);
-+}
-+
-+static inline unsigned long pax_close_kernel(void)
-+{
-+ return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_close_kernel);
-+}
-+#else
-+static inline unsigned long pax_open_kernel(void) { return 0; }
-+static inline unsigned long pax_close_kernel(void) { return 0; }
-+#endif
-+
- #if defined(CONFIG_SMP) && defined(CONFIG_PARAVIRT_SPINLOCKS)
-
- static inline int __raw_spin_is_locked(struct raw_spinlock *lock)
-@@ -945,7 +972,7 @@ extern void default_banner(void);
-
- #define PARA_PATCH(struct, off) ((PARAVIRT_PATCH_##struct + (off)) / 4)
- #define PARA_SITE(ptype, clobbers, ops) _PVSITE(ptype, clobbers, ops, .long, 4)
--#define PARA_INDIRECT(addr) *%cs:addr
-+#define PARA_INDIRECT(addr) *%ss:addr
- #endif
-
- #define INTERRUPT_RETURN \
-@@ -1022,6 +1049,21 @@ extern void default_banner(void);
- PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_irq_enable_sysexit), \
- CLBR_NONE, \
- jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_irq_enable_sysexit))
-+
-+#define GET_CR0_INTO_RDI \
-+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0); \
-+ mov %rax,%rdi
-+
-+#define SET_RDI_INTO_CR0 \
-+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
-+
-+#define GET_CR3_INTO_RDI \
-+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_read_cr3); \
-+ mov %rax,%rdi
-+
-+#define SET_RDI_INTO_CR3 \
-+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_write_cr3)
-+
- #endif /* CONFIG_X86_32 */
-
- #endif /* __ASSEMBLY__ */
-diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
-index 9357473..04fa525 100644
---- a/arch/x86/include/asm/paravirt_types.h
-+++ b/arch/x86/include/asm/paravirt_types.h
-@@ -301,6 +301,7 @@ struct pv_mmu_ops {
- struct paravirt_callee_save make_pud;
-
- void (*set_pgd)(pgd_t *pudp, pgd_t pgdval);
-+ void (*set_pgd_batched)(pgd_t *pudp, pgd_t pgdval);
- #endif /* PAGETABLE_LEVELS == 4 */
- #endif /* PAGETABLE_LEVELS >= 3 */
-
-@@ -316,6 +317,12 @@ struct pv_mmu_ops {
- an mfn. We can tell which is which from the index. */
- void (*set_fixmap)(unsigned /* enum fixed_addresses */ idx,
- phys_addr_t phys, pgprot_t flags);
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ unsigned long (*pax_open_kernel)(void);
-+ unsigned long (*pax_close_kernel)(void);
-+#endif
-+
- };
-
- struct raw_spinlock;
-diff --git a/arch/x86/include/asm/pci_x86.h b/arch/x86/include/asm/pci_x86.h
-index b399988..3f47c38 100644
---- a/arch/x86/include/asm/pci_x86.h
-+++ b/arch/x86/include/asm/pci_x86.h
-@@ -89,16 +89,16 @@ extern int (*pcibios_enable_irq)(struct pci_dev *dev);
- extern void (*pcibios_disable_irq)(struct pci_dev *dev);
-
- struct pci_raw_ops {
-- int (*read)(unsigned int domain, unsigned int bus, unsigned int devfn,
-+ int (* const read)(unsigned int domain, unsigned int bus, unsigned int devfn,
- int reg, int len, u32 *val);
-- int (*write)(unsigned int domain, unsigned int bus, unsigned int devfn,
-+ int (* const write)(unsigned int domain, unsigned int bus, unsigned int devfn,
- int reg, int len, u32 val);
- };
-
--extern struct pci_raw_ops *raw_pci_ops;
--extern struct pci_raw_ops *raw_pci_ext_ops;
-+extern const struct pci_raw_ops *raw_pci_ops;
-+extern const struct pci_raw_ops *raw_pci_ext_ops;
-
--extern struct pci_raw_ops pci_direct_conf1;
-+extern const struct pci_raw_ops pci_direct_conf1;
- extern bool port_cf9_safe;
-
- /* arch_initcall level */
-diff --git a/arch/x86/include/asm/percpu.h b/arch/x86/include/asm/percpu.h
-index b65a36d..50345a4 100644
---- a/arch/x86/include/asm/percpu.h
-+++ b/arch/x86/include/asm/percpu.h
-@@ -78,6 +78,7 @@ do { \
- if (0) { \
- T__ tmp__; \
- tmp__ = (val); \
-+ (void)tmp__; \
- } \
- switch (sizeof(var)) { \
- case 1: \
-diff --git a/arch/x86/include/asm/pgalloc.h b/arch/x86/include/asm/pgalloc.h
-index 271de94..c714995 100644
---- a/arch/x86/include/asm/pgalloc.h
-+++ b/arch/x86/include/asm/pgalloc.h
-@@ -63,6 +63,13 @@ static inline void pmd_populate_kernel(struct mm_struct *mm,
- pmd_t *pmd, pte_t *pte)
- {
- paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
-+ set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE));
-+}
-+
-+static inline void pmd_populate_user(struct mm_struct *mm,
-+ pmd_t *pmd, pte_t *pte)
-+{
-+ paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
- set_pmd(pmd, __pmd(__pa(pte) | _PAGE_TABLE));
- }
-
-@@ -99,12 +106,22 @@ static inline void __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd,
-
- #ifdef CONFIG_X86_PAE
- extern void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd);
-+static inline void pud_populate_kernel(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
-+{
-+ pud_populate(mm, pudp, pmd);
-+}
- #else /* !CONFIG_X86_PAE */
- static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
- {
- paravirt_alloc_pmd(mm, __pa(pmd) >> PAGE_SHIFT);
- set_pud(pud, __pud(_PAGE_TABLE | __pa(pmd)));
- }
-+
-+static inline void pud_populate_kernel(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
-+{
-+ paravirt_alloc_pmd(mm, __pa(pmd) >> PAGE_SHIFT);
-+ set_pud(pud, __pud(_KERNPG_TABLE | __pa(pmd)));
-+}
- #endif /* CONFIG_X86_PAE */
-
- #if PAGETABLE_LEVELS > 3
-@@ -114,6 +131,12 @@ static inline void pgd_populate(struct mm_struct *mm, pgd_t *pgd, pud_t *pud)
- set_pgd(pgd, __pgd(_PAGE_TABLE | __pa(pud)));
- }
-
-+static inline void pgd_populate_kernel(struct mm_struct *mm, pgd_t *pgd, pud_t *pud)
-+{
-+ paravirt_alloc_pud(mm, __pa(pud) >> PAGE_SHIFT);
-+ set_pgd(pgd, __pgd(_KERNPG_TABLE | __pa(pud)));
-+}
-+
- static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr)
- {
- return (pud_t *)get_zeroed_page(GFP_KERNEL|__GFP_REPEAT);
-diff --git a/arch/x86/include/asm/pgtable-2level.h b/arch/x86/include/asm/pgtable-2level.h
-index 2334982..70bc412 100644
---- a/arch/x86/include/asm/pgtable-2level.h
-+++ b/arch/x86/include/asm/pgtable-2level.h
-@@ -18,7 +18,9 @@ static inline void native_set_pte(pte_t *ptep , pte_t pte)
-
- static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
- {
-+ pax_open_kernel();
- *pmdp = pmd;
-+ pax_close_kernel();
- }
-
- static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
-diff --git a/arch/x86/include/asm/pgtable-3level.h b/arch/x86/include/asm/pgtable-3level.h
-index 33927d2..ccde329 100644
---- a/arch/x86/include/asm/pgtable-3level.h
-+++ b/arch/x86/include/asm/pgtable-3level.h
-@@ -38,12 +38,16 @@ static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
-
- static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
- {
-+ pax_open_kernel();
- set_64bit((unsigned long long *)(pmdp), native_pmd_val(pmd));
-+ pax_close_kernel();
- }
-
- static inline void native_set_pud(pud_t *pudp, pud_t pud)
- {
-+ pax_open_kernel();
- set_64bit((unsigned long long *)(pudp), native_pud_val(pud));
-+ pax_close_kernel();
- }
-
- /*
-diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
-index af6fd36..da3ffbb 100644
---- a/arch/x86/include/asm/pgtable.h
-+++ b/arch/x86/include/asm/pgtable.h
-@@ -39,6 +39,7 @@ extern struct list_head pgd_list;
-
- #ifndef __PAGETABLE_PUD_FOLDED
- #define set_pgd(pgdp, pgd) native_set_pgd(pgdp, pgd)
-+#define set_pgd_batched(pgdp, pgd) native_set_pgd_batched(pgdp, pgd)
- #define pgd_clear(pgd) native_pgd_clear(pgd)
- #endif
-
-@@ -74,12 +75,51 @@ extern struct list_head pgd_list;
-
- #define arch_end_context_switch(prev) do {} while(0)
-
-+#define pax_open_kernel() native_pax_open_kernel()
-+#define pax_close_kernel() native_pax_close_kernel()
- #endif /* CONFIG_PARAVIRT */
-
-+#define __HAVE_ARCH_PAX_OPEN_KERNEL
-+#define __HAVE_ARCH_PAX_CLOSE_KERNEL
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+static inline unsigned long native_pax_open_kernel(void)
-+{
-+ unsigned long cr0;
-+
-+ preempt_disable();
-+ barrier();
-+ cr0 = read_cr0() ^ X86_CR0_WP;
-+ BUG_ON(unlikely(cr0 & X86_CR0_WP));
-+ write_cr0(cr0);
-+ return cr0 ^ X86_CR0_WP;
-+}
-+
-+static inline unsigned long native_pax_close_kernel(void)
-+{
-+ unsigned long cr0;
-+
-+ cr0 = read_cr0() ^ X86_CR0_WP;
-+ BUG_ON(unlikely(!(cr0 & X86_CR0_WP)));
-+ write_cr0(cr0);
-+ barrier();
-+ preempt_enable_no_resched();
-+ return cr0 ^ X86_CR0_WP;
-+}
-+#else
-+static inline unsigned long native_pax_open_kernel(void) { return 0; }
-+static inline unsigned long native_pax_close_kernel(void) { return 0; }
-+#endif
-+
- /*
- * The following only work if pte_present() is true.
- * Undefined behaviour if not..
- */
-+static inline int pte_user(pte_t pte)
-+{
-+ return pte_val(pte) & _PAGE_USER;
-+}
-+
- static inline int pte_dirty(pte_t pte)
- {
- return pte_flags(pte) & _PAGE_DIRTY;
-@@ -167,9 +207,29 @@ static inline pte_t pte_wrprotect(pte_t pte)
- return pte_clear_flags(pte, _PAGE_RW);
- }
-
-+static inline pte_t pte_mkread(pte_t pte)
-+{
-+ return __pte(pte_val(pte) | _PAGE_USER);
-+}
-+
- static inline pte_t pte_mkexec(pte_t pte)
- {
-- return pte_clear_flags(pte, _PAGE_NX);
-+#ifdef CONFIG_X86_PAE
-+ if (__supported_pte_mask & _PAGE_NX)
-+ return pte_clear_flags(pte, _PAGE_NX);
-+ else
-+#endif
-+ return pte_set_flags(pte, _PAGE_USER);
-+}
-+
-+static inline pte_t pte_exprotect(pte_t pte)
-+{
-+#ifdef CONFIG_X86_PAE
-+ if (__supported_pte_mask & _PAGE_NX)
-+ return pte_set_flags(pte, _PAGE_NX);
-+ else
-+#endif
-+ return pte_clear_flags(pte, _PAGE_USER);
- }
-
- static inline pte_t pte_mkdirty(pte_t pte)
-@@ -302,6 +362,15 @@ pte_t *populate_extra_pte(unsigned long vaddr);
- #endif
-
- #ifndef __ASSEMBLY__
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+extern pgd_t cpu_pgd[NR_CPUS][PTRS_PER_PGD];
-+static inline pgd_t *get_cpu_pgd(unsigned int cpu)
-+{
-+ return cpu_pgd[cpu];
-+}
-+#endif
-+
- #include <linux/mm_types.h>
-
- static inline int pte_none(pte_t pte)
-@@ -472,7 +541,7 @@ static inline pud_t *pud_offset(pgd_t *pgd, unsigned long address)
-
- static inline int pgd_bad(pgd_t pgd)
- {
-- return (pgd_flags(pgd) & ~_PAGE_USER) != _KERNPG_TABLE;
-+ return (pgd_flags(pgd) & ~(_PAGE_USER | _PAGE_NX)) != _KERNPG_TABLE;
- }
-
- static inline int pgd_none(pgd_t pgd)
-@@ -495,7 +564,12 @@ static inline int pgd_none(pgd_t pgd)
- * pgd_offset() returns a (pgd_t *)
- * pgd_index() is used get the offset into the pgd page's array of pgd_t's;
- */
--#define pgd_offset(mm, address) ((mm)->pgd + pgd_index((address)))
-+#define pgd_offset(mm, address) ((mm)->pgd + pgd_index(address))
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+#define pgd_offset_cpu(cpu, address) (get_cpu_pgd(cpu) + pgd_index(address))
-+#endif
-+
- /*
- * a shortcut which implies the use of the kernel's pgd, instead
- * of a process's
-@@ -506,6 +580,20 @@ static inline int pgd_none(pgd_t pgd)
- #define KERNEL_PGD_BOUNDARY pgd_index(PAGE_OFFSET)
- #define KERNEL_PGD_PTRS (PTRS_PER_PGD - KERNEL_PGD_BOUNDARY)
-
-+#ifdef CONFIG_X86_32
-+#define USER_PGD_PTRS KERNEL_PGD_BOUNDARY
-+#else
-+#define TASK_SIZE_MAX_SHIFT CONFIG_TASK_SIZE_MAX_SHIFT
-+#define USER_PGD_PTRS (_AC(1,UL) << (TASK_SIZE_MAX_SHIFT - PGDIR_SHIFT))
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+#define PAX_USER_SHADOW_BASE (_AC(1,UL) << TASK_SIZE_MAX_SHIFT)
-+#else
-+#define PAX_USER_SHADOW_BASE (_AC(0,UL))
-+#endif
-+
-+#endif
-+
- #ifndef __ASSEMBLY__
-
- extern int direct_gbpages;
-@@ -611,11 +699,23 @@ static inline void ptep_set_wrprotect(struct mm_struct *mm,
- * dst and src can be on the same page, but the range must not overlap,
- * and must not cross a page boundary.
- */
--static inline void clone_pgd_range(pgd_t *dst, pgd_t *src, int count)
-+static inline void clone_pgd_range(pgd_t *dst, const pgd_t *src, int count)
- {
-- memcpy(dst, src, count * sizeof(pgd_t));
-+ pax_open_kernel();
-+ while (count--)
-+ *dst++ = *src++;
-+ pax_close_kernel();
- }
-
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+extern void __clone_user_pgds(pgd_t *dst, const pgd_t *src);
-+#endif
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+extern void __shadow_user_pgds(pgd_t *dst, const pgd_t *src);
-+#else
-+static inline void __shadow_user_pgds(pgd_t *dst, const pgd_t *src) {}
-+#endif
-
- #include <asm-generic/pgtable.h>
- #endif /* __ASSEMBLY__ */
-diff --git a/arch/x86/include/asm/pgtable_32.h b/arch/x86/include/asm/pgtable_32.h
-index 750f1bf..971e8394 100644
---- a/arch/x86/include/asm/pgtable_32.h
-+++ b/arch/x86/include/asm/pgtable_32.h
-@@ -26,9 +26,6 @@
- struct mm_struct;
- struct vm_area_struct;
-
--extern pgd_t swapper_pg_dir[1024];
--extern pgd_t trampoline_pg_dir[1024];
--
- static inline void pgtable_cache_init(void) { }
- static inline void check_pgt_cache(void) { }
- void paging_init(void);
-@@ -49,6 +46,12 @@ extern void set_pmd_pfn(unsigned long, unsigned long, pgprot_t);
- # include <asm/pgtable-2level.h>
- #endif
-
-+extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
-+extern pgd_t trampoline_pg_dir[PTRS_PER_PGD];
-+#ifdef CONFIG_X86_PAE
-+extern pmd_t swapper_pm_dir[PTRS_PER_PGD][PTRS_PER_PMD];
-+#endif
-+
- #if defined(CONFIG_HIGHPTE)
- #define __KM_PTE \
- (in_nmi() ? KM_NMI_PTE : \
-@@ -73,7 +76,9 @@ extern void set_pmd_pfn(unsigned long, unsigned long, pgprot_t);
- /* Clear a kernel PTE and flush it from the TLB */
- #define kpte_clear_flush(ptep, vaddr) \
- do { \
-+ pax_open_kernel(); \
- pte_clear(&init_mm, (vaddr), (ptep)); \
-+ pax_close_kernel(); \
- __flush_tlb_one((vaddr)); \
- } while (0)
-
-@@ -85,6 +90,9 @@ do { \
-
- #endif /* !__ASSEMBLY__ */
-
-+#define HAVE_ARCH_UNMAPPED_AREA
-+#define HAVE_ARCH_UNMAPPED_AREA_TOPDOWN
-+
- /*
- * kern_addr_valid() is (1) for FLATMEM and (0) for
- * SPARSEMEM and DISCONTIGMEM
-diff --git a/arch/x86/include/asm/pgtable_32_types.h b/arch/x86/include/asm/pgtable_32_types.h
-index 5e67c15..12d5c47 100644
---- a/arch/x86/include/asm/pgtable_32_types.h
-+++ b/arch/x86/include/asm/pgtable_32_types.h
-@@ -8,7 +8,7 @@
- */
- #ifdef CONFIG_X86_PAE
- # include <asm/pgtable-3level_types.h>
--# define PMD_SIZE (1UL << PMD_SHIFT)
-+# define PMD_SIZE (_AC(1, UL) << PMD_SHIFT)
- # define PMD_MASK (~(PMD_SIZE - 1))
- #else
- # include <asm/pgtable-2level_types.h>
-@@ -46,6 +46,19 @@ extern bool __vmalloc_start_set; /* set once high_memory is set */
- # define VMALLOC_END (FIXADDR_START - 2 * PAGE_SIZE)
- #endif
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+#ifndef __ASSEMBLY__
-+extern unsigned char MODULES_EXEC_VADDR[];
-+extern unsigned char MODULES_EXEC_END[];
-+#endif
-+#include <asm/boot.h>
-+#define ktla_ktva(addr) (addr + LOAD_PHYSICAL_ADDR + PAGE_OFFSET)
-+#define ktva_ktla(addr) (addr - LOAD_PHYSICAL_ADDR - PAGE_OFFSET)
-+#else
-+#define ktla_ktva(addr) (addr)
-+#define ktva_ktla(addr) (addr)
-+#endif
-+
- #define MODULES_VADDR VMALLOC_START
- #define MODULES_END VMALLOC_END
- #define MODULES_LEN (MODULES_VADDR - MODULES_END)
-diff --git a/arch/x86/include/asm/pgtable_64.h b/arch/x86/include/asm/pgtable_64.h
-index c57a301..5038210 100644
---- a/arch/x86/include/asm/pgtable_64.h
-+++ b/arch/x86/include/asm/pgtable_64.h
-@@ -16,10 +16,14 @@
-
- extern pud_t level3_kernel_pgt[512];
- extern pud_t level3_ident_pgt[512];
-+extern pud_t level3_vmalloc_start_pgt[512];
-+extern pud_t level3_vmalloc_end_pgt[512];
-+extern pud_t level3_vmemmap_pgt[512];
-+extern pud_t level2_vmemmap_pgt[512];
- extern pmd_t level2_kernel_pgt[512];
- extern pmd_t level2_fixmap_pgt[512];
--extern pmd_t level2_ident_pgt[512];
--extern pgd_t init_level4_pgt[];
-+extern pmd_t level2_ident_pgt[512*2];
-+extern pgd_t init_level4_pgt[512];
-
- #define swapper_pg_dir init_level4_pgt
-
-@@ -74,7 +78,9 @@ static inline pte_t native_ptep_get_and_clear(pte_t *xp)
-
- static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
- {
-+ pax_open_kernel();
- *pmdp = pmd;
-+ pax_close_kernel();
- }
-
- static inline void native_pmd_clear(pmd_t *pmd)
-@@ -84,7 +90,9 @@ static inline void native_pmd_clear(pmd_t *pmd)
-
- static inline void native_set_pud(pud_t *pudp, pud_t pud)
- {
-+ pax_open_kernel();
- *pudp = pud;
-+ pax_close_kernel();
- }
-
- static inline void native_pud_clear(pud_t *pud)
-@@ -94,6 +102,13 @@ static inline void native_pud_clear(pud_t *pud)
-
- static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)
- {
-+ pax_open_kernel();
-+ *pgdp = pgd;
-+ pax_close_kernel();
-+}
-+
-+static inline void native_set_pgd_batched(pgd_t *pgdp, pgd_t pgd)
-+{
- *pgdp = pgd;
- }
-
-diff --git a/arch/x86/include/asm/pgtable_64_types.h b/arch/x86/include/asm/pgtable_64_types.h
-index 766ea16..5b96cb3 100644
---- a/arch/x86/include/asm/pgtable_64_types.h
-+++ b/arch/x86/include/asm/pgtable_64_types.h
-@@ -59,5 +59,10 @@ typedef struct { pteval_t pte; } pte_t;
- #define MODULES_VADDR _AC(0xffffffffa0000000, UL)
- #define MODULES_END _AC(0xffffffffff000000, UL)
- #define MODULES_LEN (MODULES_END - MODULES_VADDR)
-+#define MODULES_EXEC_VADDR MODULES_VADDR
-+#define MODULES_EXEC_END MODULES_END
-+
-+#define ktla_ktva(addr) (addr)
-+#define ktva_ktla(addr) (addr)
-
- #endif /* _ASM_X86_PGTABLE_64_DEFS_H */
-diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h
-index d1f4a76..2f46ba1 100644
---- a/arch/x86/include/asm/pgtable_types.h
-+++ b/arch/x86/include/asm/pgtable_types.h
-@@ -16,12 +16,11 @@
- #define _PAGE_BIT_PSE 7 /* 4 MB (or 2MB) page */
- #define _PAGE_BIT_PAT 7 /* on 4KB pages */
- #define _PAGE_BIT_GLOBAL 8 /* Global TLB entry PPro+ */
--#define _PAGE_BIT_UNUSED1 9 /* available for programmer */
-+#define _PAGE_BIT_SPECIAL 9 /* special mappings, no associated struct page */
- #define _PAGE_BIT_IOMAP 10 /* flag used to indicate IO mapping */
- #define _PAGE_BIT_HIDDEN 11 /* hidden by kmemcheck */
- #define _PAGE_BIT_PAT_LARGE 12 /* On 2MB or 1GB pages */
--#define _PAGE_BIT_SPECIAL _PAGE_BIT_UNUSED1
--#define _PAGE_BIT_CPA_TEST _PAGE_BIT_UNUSED1
-+#define _PAGE_BIT_CPA_TEST _PAGE_BIT_SPECIAL
- #define _PAGE_BIT_NX 63 /* No execute: only valid after cpuid check */
-
- /* If _PAGE_BIT_PRESENT is clear, we use these: */
-@@ -39,7 +38,6 @@
- #define _PAGE_DIRTY (_AT(pteval_t, 1) << _PAGE_BIT_DIRTY)
- #define _PAGE_PSE (_AT(pteval_t, 1) << _PAGE_BIT_PSE)
- #define _PAGE_GLOBAL (_AT(pteval_t, 1) << _PAGE_BIT_GLOBAL)
--#define _PAGE_UNUSED1 (_AT(pteval_t, 1) << _PAGE_BIT_UNUSED1)
- #define _PAGE_IOMAP (_AT(pteval_t, 1) << _PAGE_BIT_IOMAP)
- #define _PAGE_PAT (_AT(pteval_t, 1) << _PAGE_BIT_PAT)
- #define _PAGE_PAT_LARGE (_AT(pteval_t, 1) << _PAGE_BIT_PAT_LARGE)
-@@ -55,8 +53,10 @@
-
- #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
- #define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_NX)
--#else
-+#elif defined(CONFIG_KMEMCHECK)
- #define _PAGE_NX (_AT(pteval_t, 0))
-+#else
-+#define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_HIDDEN)
- #endif
-
- #define _PAGE_FILE (_AT(pteval_t, 1) << _PAGE_BIT_FILE)
-@@ -93,6 +93,9 @@
- #define PAGE_READONLY_EXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | \
- _PAGE_ACCESSED)
-
-+#define PAGE_READONLY_NOEXEC PAGE_READONLY
-+#define PAGE_SHARED_NOEXEC PAGE_SHARED
-+
- #define __PAGE_KERNEL_EXEC \
- (_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_GLOBAL)
- #define __PAGE_KERNEL (__PAGE_KERNEL_EXEC | _PAGE_NX)
-@@ -103,8 +106,8 @@
- #define __PAGE_KERNEL_WC (__PAGE_KERNEL | _PAGE_CACHE_WC)
- #define __PAGE_KERNEL_NOCACHE (__PAGE_KERNEL | _PAGE_PCD | _PAGE_PWT)
- #define __PAGE_KERNEL_UC_MINUS (__PAGE_KERNEL | _PAGE_PCD)
--#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RX | _PAGE_USER)
--#define __PAGE_KERNEL_VSYSCALL_NOCACHE (__PAGE_KERNEL_VSYSCALL | _PAGE_PCD | _PAGE_PWT)
-+#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RO | _PAGE_USER)
-+#define __PAGE_KERNEL_VSYSCALL_NOCACHE (__PAGE_KERNEL_RO | _PAGE_PCD | _PAGE_PWT | _PAGE_USER)
- #define __PAGE_KERNEL_LARGE (__PAGE_KERNEL | _PAGE_PSE)
- #define __PAGE_KERNEL_LARGE_NOCACHE (__PAGE_KERNEL | _PAGE_CACHE_UC | _PAGE_PSE)
- #define __PAGE_KERNEL_LARGE_EXEC (__PAGE_KERNEL_EXEC | _PAGE_PSE)
-@@ -163,8 +166,8 @@
- * bits are combined, this will alow user to access the high address mapped
- * VDSO in the presence of CONFIG_COMPAT_VDSO
- */
--#define PTE_IDENT_ATTR 0x003 /* PRESENT+RW */
--#define PDE_IDENT_ATTR 0x067 /* PRESENT+RW+USER+DIRTY+ACCESSED */
-+#define PTE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
-+#define PDE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
- #define PGD_IDENT_ATTR 0x001 /* PRESENT (no other attributes) */
- #endif
-
-@@ -202,7 +205,17 @@ static inline pgdval_t pgd_flags(pgd_t pgd)
- {
- return native_pgd_val(pgd) & PTE_FLAGS_MASK;
- }
-+#endif
-
-+#if PAGETABLE_LEVELS == 3
-+#include <asm-generic/pgtable-nopud.h>
-+#endif
-+
-+#if PAGETABLE_LEVELS == 2
-+#include <asm-generic/pgtable-nopmd.h>
-+#endif
-+
-+#ifndef __ASSEMBLY__
- #if PAGETABLE_LEVELS > 3
- typedef struct { pudval_t pud; } pud_t;
-
-@@ -216,8 +229,6 @@ static inline pudval_t native_pud_val(pud_t pud)
- return pud.pud;
- }
- #else
--#include <asm-generic/pgtable-nopud.h>
--
- static inline pudval_t native_pud_val(pud_t pud)
- {
- return native_pgd_val(pud.pgd);
-@@ -237,8 +248,6 @@ static inline pmdval_t native_pmd_val(pmd_t pmd)
- return pmd.pmd;
- }
- #else
--#include <asm-generic/pgtable-nopmd.h>
--
- static inline pmdval_t native_pmd_val(pmd_t pmd)
- {
- return native_pgd_val(pmd.pud.pgd);
-@@ -278,7 +287,16 @@ typedef struct page *pgtable_t;
-
- extern pteval_t __supported_pte_mask;
- extern void set_nx(void);
-+
-+#ifdef CONFIG_X86_32
-+#ifdef CONFIG_X86_PAE
- extern int nx_enabled;
-+#else
-+#define nx_enabled (0)
-+#endif
-+#else
-+#define nx_enabled (1)
-+#endif
-
- #define pgprot_writecombine pgprot_writecombine
- extern pgprot_t pgprot_writecombine(pgprot_t prot);
-diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
-index fa04dea..5f823fc 100644
---- a/arch/x86/include/asm/processor.h
-+++ b/arch/x86/include/asm/processor.h
-@@ -272,7 +272,7 @@ struct tss_struct {
-
- } ____cacheline_aligned;
-
--DECLARE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss);
-+extern struct tss_struct init_tss[NR_CPUS];
-
- /*
- * Save the original ist values for checking stack pointers during debugging
-@@ -911,11 +911,18 @@ static inline void spin_lock_prefetch(const void *x)
- */
- #define TASK_SIZE PAGE_OFFSET
- #define TASK_SIZE_MAX TASK_SIZE
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+#define SEGMEXEC_TASK_SIZE (TASK_SIZE / 2)
-+#define STACK_TOP ((current->mm->pax_flags & MF_PAX_SEGMEXEC)?SEGMEXEC_TASK_SIZE:TASK_SIZE)
-+#else
- #define STACK_TOP TASK_SIZE
--#define STACK_TOP_MAX STACK_TOP
-+#endif
-+
-+#define STACK_TOP_MAX TASK_SIZE
-
- #define INIT_THREAD { \
-- .sp0 = sizeof(init_stack) + (long)&init_stack, \
-+ .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
- .vm86_info = NULL, \
- .sysenter_cs = __KERNEL_CS, \
- .io_bitmap_ptr = NULL, \
-@@ -929,7 +936,7 @@ static inline void spin_lock_prefetch(const void *x)
- */
- #define INIT_TSS { \
- .x86_tss = { \
-- .sp0 = sizeof(init_stack) + (long)&init_stack, \
-+ .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
- .ss0 = __KERNEL_DS, \
- .ss1 = __KERNEL_CS, \
- .io_bitmap_base = INVALID_IO_BITMAP_OFFSET, \
-@@ -940,11 +947,7 @@ static inline void spin_lock_prefetch(const void *x)
- extern unsigned long thread_saved_pc(struct task_struct *tsk);
-
- #define THREAD_SIZE_LONGS (THREAD_SIZE/sizeof(unsigned long))
--#define KSTK_TOP(info) \
--({ \
-- unsigned long *__ptr = (unsigned long *)(info); \
-- (unsigned long)(&__ptr[THREAD_SIZE_LONGS]); \
--})
-+#define KSTK_TOP(info) ((container_of(info, struct task_struct, tinfo))->thread.sp0)
-
- /*
- * The below -8 is to reserve 8 bytes on top of the ring0 stack.
-@@ -959,7 +962,7 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
- #define task_pt_regs(task) \
- ({ \
- struct pt_regs *__regs__; \
-- __regs__ = (struct pt_regs *)(KSTK_TOP(task_stack_page(task))-8); \
-+ __regs__ = (struct pt_regs *)((task)->thread.sp0); \
- __regs__ - 1; \
- })
-
-@@ -969,13 +972,13 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
- /*
- * User space process size. 47bits minus one guard page.
- */
--#define TASK_SIZE_MAX ((1UL << 47) - PAGE_SIZE)
-+#define TASK_SIZE_MAX ((1UL << TASK_SIZE_MAX_SHIFT) - PAGE_SIZE)
-
- /* This decides where the kernel will search for a free chunk of vm
- * space during mmap's.
- */
- #define IA32_PAGE_OFFSET ((current->personality & ADDR_LIMIT_3GB) ? \
-- 0xc0000000 : 0xFFFFe000)
-+ 0xc0000000 : 0xFFFFf000)
-
- #define TASK_SIZE (test_thread_flag(TIF_IA32) ? \
- IA32_PAGE_OFFSET : TASK_SIZE_MAX)
-@@ -986,11 +989,11 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
- #define STACK_TOP_MAX TASK_SIZE_MAX
-
- #define INIT_THREAD { \
-- .sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
-+ .sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
- }
-
- #define INIT_TSS { \
-- .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
-+ .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
- }
-
- /*
-@@ -1012,6 +1015,10 @@ extern void start_thread(struct pt_regs *regs, unsigned long new_ip,
- */
- #define TASK_UNMAPPED_BASE (PAGE_ALIGN(TASK_SIZE / 3))
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+#define SEGMEXEC_TASK_UNMAPPED_BASE (PAGE_ALIGN(SEGMEXEC_TASK_SIZE / 3))
-+#endif
-+
- #define KSTK_EIP(task) (task_pt_regs(task)->ip)
-
- /* Get/set a process' ability to use the timestamp counter instruction */
-diff --git a/arch/x86/include/asm/ptrace.h b/arch/x86/include/asm/ptrace.h
-index 0f0d908..f2e3da2 100644
---- a/arch/x86/include/asm/ptrace.h
-+++ b/arch/x86/include/asm/ptrace.h
-@@ -151,28 +151,29 @@ static inline unsigned long regs_return_value(struct pt_regs *regs)
- }
-
- /*
-- * user_mode_vm(regs) determines whether a register set came from user mode.
-+ * user_mode(regs) determines whether a register set came from user mode.
- * This is true if V8086 mode was enabled OR if the register set was from
- * protected mode with RPL-3 CS value. This tricky test checks that with
- * one comparison. Many places in the kernel can bypass this full check
-- * if they have already ruled out V8086 mode, so user_mode(regs) can be used.
-+ * if they have already ruled out V8086 mode, so user_mode_novm(regs) can
-+ * be used.
- */
--static inline int user_mode(struct pt_regs *regs)
-+static inline int user_mode_novm(struct pt_regs *regs)
- {
- #ifdef CONFIG_X86_32
- return (regs->cs & SEGMENT_RPL_MASK) == USER_RPL;
- #else
-- return !!(regs->cs & 3);
-+ return !!(regs->cs & SEGMENT_RPL_MASK);
- #endif
- }
-
--static inline int user_mode_vm(struct pt_regs *regs)
-+static inline int user_mode(struct pt_regs *regs)
- {
- #ifdef CONFIG_X86_32
- return ((regs->cs & SEGMENT_RPL_MASK) | (regs->flags & X86_VM_MASK)) >=
- USER_RPL;
- #else
-- return user_mode(regs);
-+ return user_mode_novm(regs);
- #endif
- }
-
-diff --git a/arch/x86/include/asm/reboot.h b/arch/x86/include/asm/reboot.h
-index 562d4fd..6e655f2 100644
---- a/arch/x86/include/asm/reboot.h
-+++ b/arch/x86/include/asm/reboot.h
-@@ -6,19 +6,19 @@
- struct pt_regs;
-
- struct machine_ops {
-- void (*restart)(char *cmd);
-- void (*halt)(void);
-- void (*power_off)(void);
-+ void (* __noreturn restart)(char *cmd);
-+ void (* __noreturn halt)(void);
-+ void (* __noreturn power_off)(void);
- void (*shutdown)(void);
- void (*crash_shutdown)(struct pt_regs *);
-- void (*emergency_restart)(void);
-+ void (* __noreturn emergency_restart)(void);
- };
-
- extern struct machine_ops machine_ops;
-
- void native_machine_crash_shutdown(struct pt_regs *regs);
- void native_machine_shutdown(void);
--void machine_real_restart(const unsigned char *code, int length);
-+void __noreturn machine_real_restart(const unsigned char *code, unsigned int length);
-
- typedef void (*nmi_shootdown_cb)(int, struct die_args*);
- void nmi_shootdown_cpus(nmi_shootdown_cb callback);
-diff --git a/arch/x86/include/asm/rwsem.h b/arch/x86/include/asm/rwsem.h
-index 606ede1..dbfff37 100644
---- a/arch/x86/include/asm/rwsem.h
-+++ b/arch/x86/include/asm/rwsem.h
-@@ -118,6 +118,14 @@ static inline void __down_read(struct rw_semaphore *sem)
- {
- asm volatile("# beginning down_read\n\t"
- LOCK_PREFIX _ASM_INC "(%1)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX _ASM_DEC "(%1)\n\t"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- /* adds 0x00000001, returns the old value */
- " jns 1f\n"
- " call call_rwsem_down_read_failed\n"
-@@ -139,6 +147,14 @@ static inline int __down_read_trylock(struct rw_semaphore *sem)
- "1:\n\t"
- " mov %1,%2\n\t"
- " add %3,%2\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ "sub %3,%2\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- " jle 2f\n\t"
- LOCK_PREFIX " cmpxchg %2,%0\n\t"
- " jnz 1b\n\t"
-@@ -160,6 +176,14 @@ static inline void __down_write_nested(struct rw_semaphore *sem, int subclass)
- tmp = RWSEM_ACTIVE_WRITE_BIAS;
- asm volatile("# beginning down_write\n\t"
- LOCK_PREFIX " xadd %1,(%2)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ "mov %1,(%2)\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- /* subtract 0x0000ffff, returns the old value */
- " test %1,%1\n\t"
- /* was the count 0 before? */
-@@ -198,6 +222,14 @@ static inline void __up_read(struct rw_semaphore *sem)
- rwsem_count_t tmp = -RWSEM_ACTIVE_READ_BIAS;
- asm volatile("# beginning __up_read\n\t"
- LOCK_PREFIX " xadd %1,(%2)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ "mov %1,(%2)\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- /* subtracts 1, returns the old value */
- " jns 1f\n\t"
- " call call_rwsem_wake\n"
-@@ -216,6 +248,14 @@ static inline void __up_write(struct rw_semaphore *sem)
- rwsem_count_t tmp;
- asm volatile("# beginning __up_write\n\t"
- LOCK_PREFIX " xadd %1,(%2)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ "mov %1,(%2)\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- /* tries to transition
- 0xffff0001 -> 0x00000000 */
- " jz 1f\n"
-@@ -234,6 +274,14 @@ static inline void __downgrade_write(struct rw_semaphore *sem)
- {
- asm volatile("# beginning __downgrade_write\n\t"
- LOCK_PREFIX _ASM_ADD "%2,(%1)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX _ASM_SUB "%2,(%1)\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- /*
- * transitions 0xZZZZ0001 -> 0xYYYY0001 (i386)
- * 0xZZZZZZZZ00000001 -> 0xYYYYYYYY00000001 (x86_64)
-@@ -253,7 +301,15 @@ static inline void __downgrade_write(struct rw_semaphore *sem)
- static inline void rwsem_atomic_add(rwsem_count_t delta,
- struct rw_semaphore *sem)
- {
-- asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0"
-+ asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX _ASM_SUB "%1,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- : "+m" (sem->count)
- : "er" (delta));
- }
-@@ -266,7 +322,15 @@ static inline rwsem_count_t rwsem_atomic_update(rwsem_count_t delta,
- {
- rwsem_count_t tmp = delta;
-
-- asm volatile(LOCK_PREFIX "xadd %0,%1"
-+ asm volatile(LOCK_PREFIX "xadd %0,%1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ "mov %0,%1\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- : "+r" (tmp), "+m" (sem->count)
- : : "memory");
-
-diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h
-index 14e0ed8..7f7dd5e 100644
---- a/arch/x86/include/asm/segment.h
-+++ b/arch/x86/include/asm/segment.h
-@@ -62,10 +62,15 @@
- * 26 - ESPFIX small SS
- * 27 - per-cpu [ offset to per-cpu data area ]
- * 28 - stack_canary-20 [ for stack protector ]
-- * 29 - unused
-- * 30 - unused
-+ * 29 - PCI BIOS CS
-+ * 30 - PCI BIOS DS
- * 31 - TSS for double fault handler
- */
-+#define GDT_ENTRY_KERNEXEC_EFI_CS (1)
-+#define GDT_ENTRY_KERNEXEC_EFI_DS (2)
-+#define __KERNEXEC_EFI_CS (GDT_ENTRY_KERNEXEC_EFI_CS*8)
-+#define __KERNEXEC_EFI_DS (GDT_ENTRY_KERNEXEC_EFI_DS*8)
-+
- #define GDT_ENTRY_TLS_MIN 6
- #define GDT_ENTRY_TLS_MAX (GDT_ENTRY_TLS_MIN + GDT_ENTRY_TLS_ENTRIES - 1)
-
-@@ -77,6 +82,8 @@
-
- #define GDT_ENTRY_KERNEL_CS (GDT_ENTRY_KERNEL_BASE + 0)
-
-+#define GDT_ENTRY_KERNEXEC_KERNEL_CS (4)
-+
- #define GDT_ENTRY_KERNEL_DS (GDT_ENTRY_KERNEL_BASE + 1)
-
- #define GDT_ENTRY_TSS (GDT_ENTRY_KERNEL_BASE + 4)
-@@ -88,7 +95,7 @@
- #define GDT_ENTRY_ESPFIX_SS (GDT_ENTRY_KERNEL_BASE + 14)
- #define __ESPFIX_SS (GDT_ENTRY_ESPFIX_SS * 8)
-
--#define GDT_ENTRY_PERCPU (GDT_ENTRY_KERNEL_BASE + 15)
-+#define GDT_ENTRY_PERCPU (GDT_ENTRY_KERNEL_BASE + 15)
- #ifdef CONFIG_SMP
- #define __KERNEL_PERCPU (GDT_ENTRY_PERCPU * 8)
- #else
-@@ -102,6 +109,12 @@
- #define __KERNEL_STACK_CANARY 0
- #endif
-
-+#define GDT_ENTRY_PCIBIOS_CS (GDT_ENTRY_KERNEL_BASE + 17)
-+#define __PCIBIOS_CS (GDT_ENTRY_PCIBIOS_CS * 8)
-+
-+#define GDT_ENTRY_PCIBIOS_DS (GDT_ENTRY_KERNEL_BASE + 18)
-+#define __PCIBIOS_DS (GDT_ENTRY_PCIBIOS_DS * 8)
-+
- #define GDT_ENTRY_DOUBLEFAULT_TSS 31
-
- /*
-@@ -139,7 +152,7 @@
- */
-
- /* Matches PNP_CS32 and PNP_CS16 (they must be consecutive) */
--#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xf4) == GDT_ENTRY_PNPBIOS_BASE * 8)
-+#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xFFFCU) == PNP_CS32 || ((x) & 0xFFFCU) == PNP_CS16)
-
-
- #else
-@@ -163,6 +176,8 @@
- #define __USER32_CS (GDT_ENTRY_DEFAULT_USER32_CS * 8 + 3)
- #define __USER32_DS __USER_DS
-
-+#define GDT_ENTRY_KERNEXEC_KERNEL_CS 7
-+
- #define GDT_ENTRY_TSS 8 /* needs two entries */
- #define GDT_ENTRY_LDT 10 /* needs two entries */
- #define GDT_ENTRY_TLS_MIN 12
-@@ -183,6 +198,7 @@
- #endif
-
- #define __KERNEL_CS (GDT_ENTRY_KERNEL_CS * 8)
-+#define __KERNEXEC_KERNEL_CS (GDT_ENTRY_KERNEXEC_KERNEL_CS * 8)
- #define __KERNEL_DS (GDT_ENTRY_KERNEL_DS * 8)
- #define __USER_DS (GDT_ENTRY_DEFAULT_USER_DS* 8 + 3)
- #define __USER_CS (GDT_ENTRY_DEFAULT_USER_CS* 8 + 3)
-diff --git a/arch/x86/include/asm/smp.h b/arch/x86/include/asm/smp.h
-index 4c2f63c..57ac225 100644
---- a/arch/x86/include/asm/smp.h
-+++ b/arch/x86/include/asm/smp.h
-@@ -24,7 +24,7 @@ extern unsigned int num_processors;
- DECLARE_PER_CPU(cpumask_var_t, cpu_sibling_map);
- DECLARE_PER_CPU(cpumask_var_t, cpu_core_map);
- DECLARE_PER_CPU(u16, cpu_llc_id);
--DECLARE_PER_CPU(int, cpu_number);
-+DECLARE_PER_CPU(unsigned int, cpu_number);
-
- static inline struct cpumask *cpu_sibling_mask(int cpu)
- {
-@@ -40,10 +40,7 @@ DECLARE_EARLY_PER_CPU(u16, x86_cpu_to_apicid);
- DECLARE_EARLY_PER_CPU(u16, x86_bios_cpu_apicid);
-
- /* Static state in head.S used to set up a CPU */
--extern struct {
-- void *sp;
-- unsigned short ss;
--} stack_start;
-+extern unsigned long stack_start; /* Initial stack pointer address */
-
- struct smp_ops {
- void (*smp_prepare_boot_cpu)(void);
-@@ -175,14 +172,8 @@ extern unsigned disabled_cpus __cpuinitdata;
- extern int safe_smp_processor_id(void);
-
- #elif defined(CONFIG_X86_64_SMP)
--#define raw_smp_processor_id() (percpu_read(cpu_number))
--
--#define stack_smp_processor_id() \
--({ \
-- struct thread_info *ti; \
-- __asm__("andq %%rsp,%0; ":"=r" (ti) : "0" (CURRENT_MASK)); \
-- ti->cpu; \
--})
-+#define raw_smp_processor_id() (percpu_read(cpu_number))
-+#define stack_smp_processor_id() raw_smp_processor_id()
- #define safe_smp_processor_id() smp_processor_id()
-
- #endif
-diff --git a/arch/x86/include/asm/spinlock.h b/arch/x86/include/asm/spinlock.h
-index 4e77853..4359783 100644
---- a/arch/x86/include/asm/spinlock.h
-+++ b/arch/x86/include/asm/spinlock.h
-@@ -249,6 +249,14 @@ static inline int __raw_write_can_lock(raw_rwlock_t *lock)
- static inline void __raw_read_lock(raw_rwlock_t *rw)
- {
- asm volatile(LOCK_PREFIX " subl $1,(%0)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX " addl $1,(%0)\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- "jns 1f\n"
- "call __read_lock_failed\n\t"
- "1:\n"
-@@ -258,6 +266,14 @@ static inline void __raw_read_lock(raw_rwlock_t *rw)
- static inline void __raw_write_lock(raw_rwlock_t *rw)
- {
- asm volatile(LOCK_PREFIX " subl %1,(%0)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX " addl %1,(%0)\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- "jz 1f\n"
- "call __write_lock_failed\n\t"
- "1:\n"
-@@ -286,12 +302,29 @@ static inline int __raw_write_trylock(raw_rwlock_t *lock)
-
- static inline void __raw_read_unlock(raw_rwlock_t *rw)
- {
-- asm volatile(LOCK_PREFIX "incl %0" :"+m" (rw->lock) : : "memory");
-+ asm volatile(LOCK_PREFIX "incl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "decl %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ :"+m" (rw->lock) : : "memory");
- }
-
- static inline void __raw_write_unlock(raw_rwlock_t *rw)
- {
-- asm volatile(LOCK_PREFIX "addl %1, %0"
-+ asm volatile(LOCK_PREFIX "addl %1, %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "subl %1, %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- : "+m" (rw->lock) : "i" (RW_LOCK_BIAS) : "memory");
- }
-
-diff --git a/arch/x86/include/asm/stackprotector.h b/arch/x86/include/asm/stackprotector.h
-index 1575177..cb23f52 100644
---- a/arch/x86/include/asm/stackprotector.h
-+++ b/arch/x86/include/asm/stackprotector.h
-@@ -48,7 +48,7 @@
- * head_32 for boot CPU and setup_per_cpu_areas() for others.
- */
- #define GDT_STACK_CANARY_INIT \
-- [GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x18),
-+ [GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x17),
-
- /*
- * Initialize the stackprotector canary value.
-@@ -113,7 +113,7 @@ static inline void setup_stack_canary_segment(int cpu)
-
- static inline void load_stack_canary_segment(void)
- {
--#ifdef CONFIG_X86_32
-+#if defined(CONFIG_X86_32) && !defined(CONFIG_PAX_MEMORY_UDEREF)
- asm volatile ("mov %0, %%gs" : : "r" (0));
- #endif
- }
-diff --git a/arch/x86/include/asm/system.h b/arch/x86/include/asm/system.h
-index e0fbf29..858ef4a 100644
---- a/arch/x86/include/asm/system.h
-+++ b/arch/x86/include/asm/system.h
-@@ -132,7 +132,7 @@ do { \
- "thread_return:\n\t" \
- "movq "__percpu_arg([current_task])",%%rsi\n\t" \
- __switch_canary \
-- "movq %P[thread_info](%%rsi),%%r8\n\t" \
-+ "movq "__percpu_arg([thread_info])",%%r8\n\t" \
- "movq %%rax,%%rdi\n\t" \
- "testl %[_tif_fork],%P[ti_flags](%%r8)\n\t" \
- "jnz ret_from_fork\n\t" \
-@@ -143,7 +143,7 @@ do { \
- [threadrsp] "i" (offsetof(struct task_struct, thread.sp)), \
- [ti_flags] "i" (offsetof(struct thread_info, flags)), \
- [_tif_fork] "i" (_TIF_FORK), \
-- [thread_info] "i" (offsetof(struct task_struct, stack)), \
-+ [thread_info] "m" (per_cpu_var(current_tinfo)), \
- [current_task] "m" (per_cpu_var(current_task)) \
- __switch_canary_iparam \
- : "memory", "cc" __EXTRA_CLOBBER)
-@@ -200,7 +200,7 @@ static inline unsigned long get_limit(unsigned long segment)
- {
- unsigned long __limit;
- asm("lsll %1,%0" : "=r" (__limit) : "r" (segment));
-- return __limit + 1;
-+ return __limit;
- }
-
- static inline void native_clts(void)
-@@ -340,12 +340,12 @@ void enable_hlt(void);
-
- void cpu_idle_wait(void);
-
--extern unsigned long arch_align_stack(unsigned long sp);
-+#define arch_align_stack(x) ((x) & ~0xfUL)
- extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
-
- void default_idle(void);
-
--void stop_this_cpu(void *dummy);
-+void stop_this_cpu(void *dummy) __noreturn;
-
- /*
- * Force strict CPU ordering.
-diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h
-index 19c3ce4..4ad5ba4 100644
---- a/arch/x86/include/asm/thread_info.h
-+++ b/arch/x86/include/asm/thread_info.h
-@@ -10,6 +10,7 @@
- #include <linux/compiler.h>
- #include <asm/page.h>
- #include <asm/types.h>
-+#include <asm/percpu.h>
-
- /*
- * low level task data that entry.S needs immediate access to
-@@ -24,7 +25,6 @@ struct exec_domain;
- #include <asm/atomic.h>
-
- struct thread_info {
-- struct task_struct *task; /* main task structure */
- struct exec_domain *exec_domain; /* execution domain */
- __u32 flags; /* low level flags */
- __u32 status; /* thread synchronous flags */
-@@ -34,18 +34,12 @@ struct thread_info {
- mm_segment_t addr_limit;
- struct restart_block restart_block;
- void __user *sysenter_return;
--#ifdef CONFIG_X86_32
-- unsigned long previous_esp; /* ESP of the previous stack in
-- case of nested (IRQ) stacks
-- */
-- __u8 supervisor_stack[0];
--#endif
-+ unsigned long lowest_stack;
- int uaccess_err;
- };
-
--#define INIT_THREAD_INFO(tsk) \
-+#define INIT_THREAD_INFO \
- { \
-- .task = &tsk, \
- .exec_domain = &default_exec_domain, \
- .flags = 0, \
- .cpu = 0, \
-@@ -56,7 +50,7 @@ struct thread_info {
- }, \
- }
-
--#define init_thread_info (init_thread_union.thread_info)
-+#define init_thread_info (init_thread_union.stack)
- #define init_stack (init_thread_union.stack)
-
- #else /* !__ASSEMBLY__ */
-@@ -95,6 +89,7 @@ struct thread_info {
- #define TIF_DS_AREA_MSR 26 /* uses thread_struct.ds_area_msr */
- #define TIF_LAZY_MMU_UPDATES 27 /* task is updating the mmu lazily */
- #define TIF_SYSCALL_TRACEPOINT 28 /* syscall tracepoint instrumentation */
-+#define TIF_GRSEC_SETXID 29 /* update credentials on syscall entry/exit */
-
- #define _TIF_SYSCALL_TRACE (1 << TIF_SYSCALL_TRACE)
- #define _TIF_NOTIFY_RESUME (1 << TIF_NOTIFY_RESUME)
-@@ -117,16 +112,17 @@ struct thread_info {
- #define _TIF_DS_AREA_MSR (1 << TIF_DS_AREA_MSR)
- #define _TIF_LAZY_MMU_UPDATES (1 << TIF_LAZY_MMU_UPDATES)
- #define _TIF_SYSCALL_TRACEPOINT (1 << TIF_SYSCALL_TRACEPOINT)
-+#define _TIF_GRSEC_SETXID (1 << TIF_GRSEC_SETXID)
-
- /* work to do in syscall_trace_enter() */
- #define _TIF_WORK_SYSCALL_ENTRY \
- (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_EMU | _TIF_SYSCALL_AUDIT | \
-- _TIF_SECCOMP | _TIF_SINGLESTEP | _TIF_SYSCALL_TRACEPOINT)
-+ _TIF_SECCOMP | _TIF_SINGLESTEP | _TIF_SYSCALL_TRACEPOINT | _TIF_GRSEC_SETXID)
-
- /* work to do in syscall_trace_leave() */
- #define _TIF_WORK_SYSCALL_EXIT \
- (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | _TIF_SINGLESTEP | \
-- _TIF_SYSCALL_TRACEPOINT)
-+ _TIF_SYSCALL_TRACEPOINT | _TIF_GRSEC_SETXID)
-
- /* work to do on interrupt/exception return */
- #define _TIF_WORK_MASK \
-@@ -136,7 +132,8 @@ struct thread_info {
-
- /* work to do on any return to user space */
- #define _TIF_ALLWORK_MASK \
-- ((0x0000FFFF & ~_TIF_SECCOMP) | _TIF_SYSCALL_TRACEPOINT)
-+ ((0x0000FFFF & ~_TIF_SECCOMP) | _TIF_SYSCALL_TRACEPOINT | \
-+ _TIF_GRSEC_SETXID)
-
- /* Only used for 64 bit */
- #define _TIF_DO_NOTIFY_MASK \
-@@ -163,45 +160,40 @@ struct thread_info {
- #define alloc_thread_info(tsk) \
- ((struct thread_info *)__get_free_pages(THREAD_FLAGS, THREAD_ORDER))
-
--#ifdef CONFIG_X86_32
--
--#define STACK_WARN (THREAD_SIZE/8)
--/*
-- * macros/functions for gaining access to the thread information structure
-- *
-- * preempt_count needs to be 1 initially, until the scheduler is functional.
-- */
--#ifndef __ASSEMBLY__
--
--
--/* how to get the current stack pointer from C */
--register unsigned long current_stack_pointer asm("esp") __used;
--
--/* how to get the thread information struct from C */
--static inline struct thread_info *current_thread_info(void)
--{
-- return (struct thread_info *)
-- (current_stack_pointer & ~(THREAD_SIZE - 1));
--}
--
--#else /* !__ASSEMBLY__ */
--
-+#ifdef __ASSEMBLY__
- /* how to get the thread information struct from ASM */
- #define GET_THREAD_INFO(reg) \
-- movl $-THREAD_SIZE, reg; \
-- andl %esp, reg
-+ mov PER_CPU_VAR(current_tinfo), reg
-
- /* use this one if reg already contains %esp */
--#define GET_THREAD_INFO_WITH_ESP(reg) \
-- andl $-THREAD_SIZE, reg
-+#define GET_THREAD_INFO_WITH_ESP(reg) GET_THREAD_INFO(reg)
-+#else
-+/* how to get the thread information struct from C */
-+DECLARE_PER_CPU(struct thread_info *, current_tinfo);
-+
-+static __always_inline struct thread_info *current_thread_info(void)
-+{
-+ return percpu_read_stable(current_tinfo);
-+}
-+#endif
-+
-+#ifdef CONFIG_X86_32
-+
-+#define STACK_WARN (THREAD_SIZE/8)
-+/*
-+ * macros/functions for gaining access to the thread information structure
-+ *
-+ * preempt_count needs to be 1 initially, until the scheduler is functional.
-+ */
-+#ifndef __ASSEMBLY__
-+
-+/* how to get the current stack pointer from C */
-+register unsigned long current_stack_pointer asm("esp") __used;
-
- #endif
-
- #else /* X86_32 */
-
--#include <asm/percpu.h>
--#define KERNEL_STACK_OFFSET (5*8)
--
- /*
- * macros/functions for gaining access to the thread information structure
- * preempt_count needs to be 1 initially, until the scheduler is functional.
-@@ -209,21 +201,8 @@ static inline struct thread_info *current_thread_info(void)
- #ifndef __ASSEMBLY__
- DECLARE_PER_CPU(unsigned long, kernel_stack);
-
--static inline struct thread_info *current_thread_info(void)
--{
-- struct thread_info *ti;
-- ti = (void *)(percpu_read_stable(kernel_stack) +
-- KERNEL_STACK_OFFSET - THREAD_SIZE);
-- return ti;
--}
--
--#else /* !__ASSEMBLY__ */
--
--/* how to get the thread information struct from ASM */
--#define GET_THREAD_INFO(reg) \
-- movq PER_CPU_VAR(kernel_stack),reg ; \
-- subq $(THREAD_SIZE-KERNEL_STACK_OFFSET),reg
--
-+/* how to get the current stack pointer from C */
-+register unsigned long current_stack_pointer asm("rsp") __used;
- #endif
-
- #endif /* !X86_32 */
-@@ -260,5 +239,16 @@ extern void arch_task_cache_init(void);
- extern void free_thread_info(struct thread_info *ti);
- extern int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src);
- #define arch_task_cache_init arch_task_cache_init
-+
-+#define __HAVE_THREAD_FUNCTIONS
-+#define task_thread_info(task) (&(task)->tinfo)
-+#define task_stack_page(task) ((task)->stack)
-+#define setup_thread_stack(p, org) do {} while (0)
-+#define end_of_stack(p) ((unsigned long *)task_stack_page(p) + 1)
-+
-+#define __HAVE_ARCH_TASK_STRUCT_ALLOCATOR
-+extern struct task_struct *alloc_task_struct(void);
-+extern void free_task_struct(struct task_struct *);
-+
- #endif
- #endif /* _ASM_X86_THREAD_INFO_H */
-diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
-index 61c5874..8a046e9 100644
---- a/arch/x86/include/asm/uaccess.h
-+++ b/arch/x86/include/asm/uaccess.h
-@@ -8,12 +8,15 @@
- #include <linux/thread_info.h>
- #include <linux/prefetch.h>
- #include <linux/string.h>
-+#include <linux/sched.h>
- #include <asm/asm.h>
- #include <asm/page.h>
-
- #define VERIFY_READ 0
- #define VERIFY_WRITE 1
-
-+extern void check_object_size(const void *ptr, unsigned long n, bool to);
-+
- /*
- * The fs value determines whether argument validity checking should be
- * performed or not. If get_fs() == USER_DS, checking is performed, with
-@@ -29,7 +32,12 @@
-
- #define get_ds() (KERNEL_DS)
- #define get_fs() (current_thread_info()->addr_limit)
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+void __set_fs(mm_segment_t x);
-+void set_fs(mm_segment_t x);
-+#else
- #define set_fs(x) (current_thread_info()->addr_limit = (x))
-+#endif
-
- #define segment_eq(a, b) ((a).seg == (b).seg)
-
-@@ -77,7 +85,33 @@
- * checks that the pointer is in the user space range - after calling
- * this function, memory access functions may still return -EFAULT.
- */
--#define access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
-+#define __access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
-+#define access_ok(type, addr, size) \
-+({ \
-+ long __size = size; \
-+ unsigned long __addr = (unsigned long)addr; \
-+ unsigned long __addr_ao = __addr & PAGE_MASK; \
-+ unsigned long __end_ao = __addr + __size - 1; \
-+ bool __ret_ao = __range_not_ok(__addr, __size) == 0; \
-+ if (__ret_ao && unlikely((__end_ao ^ __addr_ao) & PAGE_MASK)) { \
-+ while(__addr_ao <= __end_ao) { \
-+ char __c_ao; \
-+ __addr_ao += PAGE_SIZE; \
-+ if (__size > PAGE_SIZE) \
-+ cond_resched(); \
-+ if (__get_user(__c_ao, (char __user *)__addr)) \
-+ break; \
-+ if (type != VERIFY_WRITE) { \
-+ __addr = __addr_ao; \
-+ continue; \
-+ } \
-+ if (__put_user(__c_ao, (char __user *)__addr)) \
-+ break; \
-+ __addr = __addr_ao; \
-+ } \
-+ } \
-+ __ret_ao; \
-+})
-
- /*
- * The exception table consists of pairs of addresses: the first is the
-@@ -183,12 +217,20 @@ extern int __get_user_bad(void);
- asm volatile("call __put_user_" #size : "=a" (__ret_pu) \
- : "0" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
-
--
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+#define __copyuser_seg "gs;"
-+#define __COPYUSER_SET_ES "pushl %%gs; popl %%es\n"
-+#define __COPYUSER_RESTORE_ES "pushl %%ss; popl %%es\n"
-+#else
-+#define __copyuser_seg
-+#define __COPYUSER_SET_ES
-+#define __COPYUSER_RESTORE_ES
-+#endif
-
- #ifdef CONFIG_X86_32
- #define __put_user_asm_u64(x, addr, err, errret) \
-- asm volatile("1: movl %%eax,0(%2)\n" \
-- "2: movl %%edx,4(%2)\n" \
-+ asm volatile("1: "__copyuser_seg"movl %%eax,0(%2)\n" \
-+ "2: "__copyuser_seg"movl %%edx,4(%2)\n" \
- "3:\n" \
- ".section .fixup,\"ax\"\n" \
- "4: movl %3,%0\n" \
-@@ -200,8 +242,8 @@ extern int __get_user_bad(void);
- : "A" (x), "r" (addr), "i" (errret), "0" (err))
-
- #define __put_user_asm_ex_u64(x, addr) \
-- asm volatile("1: movl %%eax,0(%1)\n" \
-- "2: movl %%edx,4(%1)\n" \
-+ asm volatile("1: "__copyuser_seg"movl %%eax,0(%1)\n" \
-+ "2: "__copyuser_seg"movl %%edx,4(%1)\n" \
- "3:\n" \
- _ASM_EXTABLE(1b, 2b - 1b) \
- _ASM_EXTABLE(2b, 3b - 2b) \
-@@ -253,7 +295,7 @@ extern void __put_user_8(void);
- __typeof__(*(ptr)) __pu_val; \
- __chk_user_ptr(ptr); \
- might_fault(); \
-- __pu_val = x; \
-+ __pu_val = (x); \
- switch (sizeof(*(ptr))) { \
- case 1: \
- __put_user_x(1, __pu_val, ptr, __ret_pu); \
-@@ -374,7 +416,7 @@ do { \
- } while (0)
-
- #define __get_user_asm(x, addr, err, itype, rtype, ltype, errret) \
-- asm volatile("1: mov"itype" %2,%"rtype"1\n" \
-+ asm volatile("1: "__copyuser_seg"mov"itype" %2,%"rtype"1\n"\
- "2:\n" \
- ".section .fixup,\"ax\"\n" \
- "3: mov %3,%0\n" \
-@@ -382,7 +424,7 @@ do { \
- " jmp 2b\n" \
- ".previous\n" \
- _ASM_EXTABLE(1b, 3b) \
-- : "=r" (err), ltype(x) \
-+ : "=r" (err), ltype (x) \
- : "m" (__m(addr)), "i" (errret), "0" (err))
-
- #define __get_user_size_ex(x, ptr, size) \
-@@ -407,7 +449,7 @@ do { \
- } while (0)
-
- #define __get_user_asm_ex(x, addr, itype, rtype, ltype) \
-- asm volatile("1: mov"itype" %1,%"rtype"0\n" \
-+ asm volatile("1: "__copyuser_seg"mov"itype" %1,%"rtype"0\n"\
- "2:\n" \
- _ASM_EXTABLE(1b, 2b - 1b) \
- : ltype(x) : "m" (__m(addr)))
-@@ -424,13 +466,24 @@ do { \
- int __gu_err; \
- unsigned long __gu_val; \
- __get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT); \
-- (x) = (__force __typeof__(*(ptr)))__gu_val; \
-+ (x) = (__typeof__(*(ptr)))__gu_val; \
- __gu_err; \
- })
-
- /* FIXME: this hack is definitely wrong -AK */
- struct __large_struct { unsigned long buf[100]; };
--#define __m(x) (*(struct __large_struct __user *)(x))
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+#define ____m(x) \
-+({ \
-+ unsigned long ____x = (unsigned long)(x); \
-+ if (____x < PAX_USER_SHADOW_BASE) \
-+ ____x += PAX_USER_SHADOW_BASE; \
-+ (void __user *)____x; \
-+})
-+#else
-+#define ____m(x) (x)
-+#endif
-+#define __m(x) (*(struct __large_struct __user *)____m(x))
-
- /*
- * Tell gcc we read from memory instead of writing: this is because
-@@ -438,7 +491,7 @@ struct __large_struct { unsigned long buf[100]; };
- * aliasing issues.
- */
- #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret) \
-- asm volatile("1: mov"itype" %"rtype"1,%2\n" \
-+ asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"1,%2\n"\
- "2:\n" \
- ".section .fixup,\"ax\"\n" \
- "3: mov %3,%0\n" \
-@@ -446,10 +499,10 @@ struct __large_struct { unsigned long buf[100]; };
- ".previous\n" \
- _ASM_EXTABLE(1b, 3b) \
- : "=r"(err) \
-- : ltype(x), "m" (__m(addr)), "i" (errret), "0" (err))
-+ : ltype (x), "m" (__m(addr)), "i" (errret), "0" (err))
-
- #define __put_user_asm_ex(x, addr, itype, rtype, ltype) \
-- asm volatile("1: mov"itype" %"rtype"0,%1\n" \
-+ asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"0,%1\n"\
- "2:\n" \
- _ASM_EXTABLE(1b, 2b - 1b) \
- : : ltype(x), "m" (__m(addr)))
-@@ -488,8 +541,12 @@ struct __large_struct { unsigned long buf[100]; };
- * On error, the variable @x is set to zero.
- */
-
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+#define __get_user(x, ptr) get_user((x), (ptr))
-+#else
- #define __get_user(x, ptr) \
- __get_user_nocheck((x), (ptr), sizeof(*(ptr)))
-+#endif
-
- /**
- * __put_user: - Write a simple value into user space, with less checking.
-@@ -511,8 +568,12 @@ struct __large_struct { unsigned long buf[100]; };
- * Returns zero on success, or -EFAULT on error.
- */
-
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+#define __put_user(x, ptr) put_user((x), (ptr))
-+#else
- #define __put_user(x, ptr) \
- __put_user_nocheck((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr)))
-+#endif
-
- #define __get_user_unaligned __get_user
- #define __put_user_unaligned __put_user
-@@ -530,7 +591,7 @@ struct __large_struct { unsigned long buf[100]; };
- #define get_user_ex(x, ptr) do { \
- unsigned long __gue_val; \
- __get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr)))); \
-- (x) = (__force __typeof__(*(ptr)))__gue_val; \
-+ (x) = (__typeof__(*(ptr)))__gue_val; \
- } while (0)
-
- #ifdef CONFIG_X86_WP_WORKS_OK
-@@ -567,6 +628,7 @@ extern struct movsl_mask {
-
- #define ARCH_HAS_NOCACHE_UACCESS 1
-
-+#define ARCH_HAS_SORT_EXTABLE
- #ifdef CONFIG_X86_32
- # include "uaccess_32.h"
- #else
-diff --git a/arch/x86/include/asm/uaccess_32.h b/arch/x86/include/asm/uaccess_32.h
-index 632fb44..8bd6fa7 100644
---- a/arch/x86/include/asm/uaccess_32.h
-+++ b/arch/x86/include/asm/uaccess_32.h
-@@ -12,15 +12,15 @@
- #include <asm/page.h>
-
- unsigned long __must_check __copy_to_user_ll
-- (void __user *to, const void *from, unsigned long n);
-+ (void __user *to, const void *from, unsigned long n) __size_overflow(3);
- unsigned long __must_check __copy_from_user_ll
-- (void *to, const void __user *from, unsigned long n);
-+ (void *to, const void __user *from, unsigned long n) __size_overflow(3);
- unsigned long __must_check __copy_from_user_ll_nozero
-- (void *to, const void __user *from, unsigned long n);
-+ (void *to, const void __user *from, unsigned long n) __size_overflow(3);
- unsigned long __must_check __copy_from_user_ll_nocache
-- (void *to, const void __user *from, unsigned long n);
-+ (void *to, const void __user *from, unsigned long n) __size_overflow(3);
- unsigned long __must_check __copy_from_user_ll_nocache_nozero
-- (void *to, const void __user *from, unsigned long n);
-+ (void *to, const void __user *from, unsigned long n) __size_overflow(3);
-
- /**
- * __copy_to_user_inatomic: - Copy a block of data into user space, with less checking.
-@@ -44,6 +44,11 @@ unsigned long __must_check __copy_from_user_ll_nocache_nozero
- static __always_inline unsigned long __must_check
- __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
- {
-+ pax_track_stack();
-+
-+ if ((long)n < 0)
-+ return n;
-+
- if (__builtin_constant_p(n)) {
- unsigned long ret;
-
-@@ -62,6 +67,8 @@ __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
- return ret;
- }
- }
-+ if (!__builtin_constant_p(n))
-+ check_object_size(from, n, true);
- return __copy_to_user_ll(to, from, n);
- }
-
-@@ -83,12 +90,16 @@ static __always_inline unsigned long __must_check
- __copy_to_user(void __user *to, const void *from, unsigned long n)
- {
- might_fault();
-+
- return __copy_to_user_inatomic(to, from, n);
- }
-
- static __always_inline unsigned long
- __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
- {
-+ if ((long)n < 0)
-+ return n;
-+
- /* Avoid zeroing the tail if the copy fails..
- * If 'n' is constant and 1, 2, or 4, we do still zero on a failure,
- * but as the zeroing behaviour is only significant when n is not
-@@ -138,6 +149,12 @@ static __always_inline unsigned long
- __copy_from_user(void *to, const void __user *from, unsigned long n)
- {
- might_fault();
-+
-+ pax_track_stack();
-+
-+ if ((long)n < 0)
-+ return n;
-+
- if (__builtin_constant_p(n)) {
- unsigned long ret;
-
-@@ -153,6 +170,8 @@ __copy_from_user(void *to, const void __user *from, unsigned long n)
- return ret;
- }
- }
-+ if (!__builtin_constant_p(n))
-+ check_object_size(to, n, false);
- return __copy_from_user_ll(to, from, n);
- }
-
-@@ -160,6 +179,10 @@ static __always_inline unsigned long __copy_from_user_nocache(void *to,
- const void __user *from, unsigned long n)
- {
- might_fault();
-+
-+ if ((long)n < 0)
-+ return n;
-+
- if (__builtin_constant_p(n)) {
- unsigned long ret;
-
-@@ -182,14 +205,73 @@ static __always_inline unsigned long
- __copy_from_user_inatomic_nocache(void *to, const void __user *from,
- unsigned long n)
- {
-- return __copy_from_user_ll_nocache_nozero(to, from, n);
-+ if ((long)n < 0)
-+ return n;
-+
-+ return __copy_from_user_ll_nocache_nozero(to, from, n);
-+}
-+
-+extern void copy_to_user_overflow(void) __compiletime_warning("copy_to_user() buffer size is not provably correct");
-+extern void copy_from_user_overflow(void) __compiletime_warning("copy_from_user() buffer size is not provably correct");
-+
-+/**
-+ * copy_to_user: - Copy a block of data into user space.
-+ * @to: Destination address, in user space.
-+ * @from: Source address, in kernel space.
-+ * @n: Number of bytes to copy.
-+ *
-+ * Context: User context only. This function may sleep.
-+ *
-+ * Copy data from kernel space to user space.
-+ *
-+ * Returns number of bytes that could not be copied.
-+ * On success, this will be zero.
-+ */
-+static __always_inline unsigned long __must_check
-+copy_to_user(void __user *to, const void *from, unsigned long n)
-+{
-+ size_t sz = __compiletime_object_size(from);
-+
-+ if (unlikely(sz != (size_t)-1 && sz < n))
-+ copy_to_user_overflow();
-+ else if (access_ok(VERIFY_WRITE, to, n))
-+ n = __copy_to_user(to, from, n);
-+ return n;
-+}
-+
-+/**
-+ * copy_from_user: - Copy a block of data from user space.
-+ * @to: Destination address, in kernel space.
-+ * @from: Source address, in user space.
-+ * @n: Number of bytes to copy.
-+ *
-+ * Context: User context only. This function may sleep.
-+ *
-+ * Copy data from user space to kernel space.
-+ *
-+ * Returns number of bytes that could not be copied.
-+ * On success, this will be zero.
-+ *
-+ * If some data could not be copied, this function will pad the copied
-+ * data to the requested size using zero bytes.
-+ */
-+static __always_inline unsigned long __must_check
-+copy_from_user(void *to, const void __user *from, unsigned long n)
-+{
-+ size_t sz = __compiletime_object_size(to);
-+
-+ if (unlikely(sz != (size_t)-1 && sz < n))
-+ copy_from_user_overflow();
-+ else if (access_ok(VERIFY_READ, from, n))
-+ n = __copy_from_user(to, from, n);
-+ else if ((long)n > 0) {
-+ if (!__builtin_constant_p(n))
-+ check_object_size(to, n, false);
-+ memset(to, 0, n);
-+ }
-+ return n;
- }
-
--unsigned long __must_check copy_to_user(void __user *to,
-- const void *from, unsigned long n);
--unsigned long __must_check copy_from_user(void *to,
-- const void __user *from,
-- unsigned long n);
- long __must_check strncpy_from_user(char *dst, const char __user *src,
- long count);
- long __must_check __strncpy_from_user(char *dst,
-@@ -212,7 +294,7 @@ long __must_check __strncpy_from_user(char *dst,
- #define strlen_user(str) strnlen_user(str, LONG_MAX)
-
- long strnlen_user(const char __user *str, long n);
--unsigned long __must_check clear_user(void __user *mem, unsigned long len);
--unsigned long __must_check __clear_user(void __user *mem, unsigned long len);
-+unsigned long __must_check clear_user(void __user *mem, unsigned long len) __size_overflow(2);
-+unsigned long __must_check __clear_user(void __user *mem, unsigned long len) __size_overflow(2);
-
- #endif /* _ASM_X86_UACCESS_32_H */
-diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h
-index db24b21..73adc70 100644
---- a/arch/x86/include/asm/uaccess_64.h
-+++ b/arch/x86/include/asm/uaccess_64.h
-@@ -9,6 +9,9 @@
- #include <linux/prefetch.h>
- #include <linux/lockdep.h>
- #include <asm/page.h>
-+#include <asm/pgtable.h>
-+
-+#define set_fs(x) (current_thread_info()->addr_limit = (x))
-
- /*
- * Copy To/From Userspace
-@@ -16,116 +19,187 @@
-
- /* Handles exceptions in both to and from, but doesn't do access_ok */
- __must_check unsigned long
--copy_user_generic(void *to, const void *from, unsigned len);
-+copy_user_generic(void *to, const void *from, unsigned long len) __size_overflow(3);
-
- __must_check unsigned long
--copy_to_user(void __user *to, const void *from, unsigned len);
--__must_check unsigned long
--copy_from_user(void *to, const void __user *from, unsigned len);
--__must_check unsigned long
--copy_in_user(void __user *to, const void __user *from, unsigned len);
-+copy_in_user(void __user *to, const void __user *from, unsigned long len);
-+
-+extern void copy_to_user_overflow(void) __compiletime_warning("copy_to_user() buffer size is not provably correct");
-+extern void copy_from_user_overflow(void) __compiletime_warning("copy_from_user() buffer size is not provably correct");
-
- static __always_inline __must_check
--int __copy_from_user(void *dst, const void __user *src, unsigned size)
-+unsigned long __copy_from_user(void *dst, const void __user *src, unsigned long size)
- {
-- int ret = 0;
-+ size_t sz = __compiletime_object_size(dst);
-+ unsigned ret = 0;
-
- might_fault();
-- if (!__builtin_constant_p(size))
-- return copy_user_generic(dst, (__force void *)src, size);
-+
-+ if (size > INT_MAX)
-+ return size;
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ if (!__access_ok(VERIFY_READ, src, size))
-+ return size;
-+#endif
-+
-+ if (unlikely(sz != (size_t)-1 && sz < size)) {
-+ copy_from_user_overflow();
-+ return size;
-+ }
-+
-+ if (!__builtin_constant_p(size)) {
-+ check_object_size(dst, size, false);
-+ return copy_user_generic(dst, (__force_kernel const void *)____m(src), size);
-+ }
- switch (size) {
-- case 1:__get_user_asm(*(u8 *)dst, (u8 __user *)src,
-+ case 1:__get_user_asm(*(u8 *)dst, (const u8 __user *)src,
- ret, "b", "b", "=q", 1);
- return ret;
-- case 2:__get_user_asm(*(u16 *)dst, (u16 __user *)src,
-+ case 2:__get_user_asm(*(u16 *)dst, (const u16 __user *)src,
- ret, "w", "w", "=r", 2);
- return ret;
-- case 4:__get_user_asm(*(u32 *)dst, (u32 __user *)src,
-+ case 4:__get_user_asm(*(u32 *)dst, (const u32 __user *)src,
- ret, "l", "k", "=r", 4);
- return ret;
-- case 8:__get_user_asm(*(u64 *)dst, (u64 __user *)src,
-+ case 8:__get_user_asm(*(u64 *)dst, (const u64 __user *)src,
- ret, "q", "", "=r", 8);
- return ret;
- case 10:
-- __get_user_asm(*(u64 *)dst, (u64 __user *)src,
-+ __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
- ret, "q", "", "=r", 10);
- if (unlikely(ret))
- return ret;
- __get_user_asm(*(u16 *)(8 + (char *)dst),
-- (u16 __user *)(8 + (char __user *)src),
-+ (const u16 __user *)(8 + (const char __user *)src),
- ret, "w", "w", "=r", 2);
- return ret;
- case 16:
-- __get_user_asm(*(u64 *)dst, (u64 __user *)src,
-+ __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
- ret, "q", "", "=r", 16);
- if (unlikely(ret))
- return ret;
- __get_user_asm(*(u64 *)(8 + (char *)dst),
-- (u64 __user *)(8 + (char __user *)src),
-+ (const u64 __user *)(8 + (const char __user *)src),
- ret, "q", "", "=r", 8);
- return ret;
- default:
-- return copy_user_generic(dst, (__force void *)src, size);
-+ return copy_user_generic(dst, (__force_kernel const void *)____m(src), size);
- }
- }
-
- static __always_inline __must_check
--int __copy_to_user(void __user *dst, const void *src, unsigned size)
-+unsigned long __copy_to_user(void __user *dst, const void *src, unsigned long size)
- {
-- int ret = 0;
-+ size_t sz = __compiletime_object_size(dst);
-+ unsigned ret = 0;
-
- might_fault();
-- if (!__builtin_constant_p(size))
-- return copy_user_generic((__force void *)dst, src, size);
-+
-+ pax_track_stack();
-+
-+ if (size > INT_MAX)
-+ return size;
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ if (!__access_ok(VERIFY_WRITE, dst, size))
-+ return size;
-+#endif
-+
-+ if (unlikely(sz != (size_t)-1 && sz < size)) {
-+ copy_to_user_overflow();
-+ return size;
-+ }
-+
-+ if (!__builtin_constant_p(size)) {
-+ check_object_size(src, size, true);
-+ return copy_user_generic((__force_kernel void *)____m(dst), src, size);
-+ }
- switch (size) {
-- case 1:__put_user_asm(*(u8 *)src, (u8 __user *)dst,
-+ case 1:__put_user_asm(*(const u8 *)src, (u8 __user *)dst,
- ret, "b", "b", "iq", 1);
- return ret;
-- case 2:__put_user_asm(*(u16 *)src, (u16 __user *)dst,
-+ case 2:__put_user_asm(*(const u16 *)src, (u16 __user *)dst,
- ret, "w", "w", "ir", 2);
- return ret;
-- case 4:__put_user_asm(*(u32 *)src, (u32 __user *)dst,
-+ case 4:__put_user_asm(*(const u32 *)src, (u32 __user *)dst,
- ret, "l", "k", "ir", 4);
- return ret;
-- case 8:__put_user_asm(*(u64 *)src, (u64 __user *)dst,
-+ case 8:__put_user_asm(*(const u64 *)src, (u64 __user *)dst,
- ret, "q", "", "er", 8);
- return ret;
- case 10:
-- __put_user_asm(*(u64 *)src, (u64 __user *)dst,
-+ __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
- ret, "q", "", "er", 10);
- if (unlikely(ret))
- return ret;
- asm("":::"memory");
-- __put_user_asm(4[(u16 *)src], 4 + (u16 __user *)dst,
-+ __put_user_asm(4[(const u16 *)src], 4 + (u16 __user *)dst,
- ret, "w", "w", "ir", 2);
- return ret;
- case 16:
-- __put_user_asm(*(u64 *)src, (u64 __user *)dst,
-+ __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
- ret, "q", "", "er", 16);
- if (unlikely(ret))
- return ret;
- asm("":::"memory");
-- __put_user_asm(1[(u64 *)src], 1 + (u64 __user *)dst,
-+ __put_user_asm(1[(const u64 *)src], 1 + (u64 __user *)dst,
- ret, "q", "", "er", 8);
- return ret;
- default:
-- return copy_user_generic((__force void *)dst, src, size);
-+ return copy_user_generic((__force_kernel void *)____m(dst), src, size);
- }
- }
-
- static __always_inline __must_check
--int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
-+unsigned long copy_to_user(void __user *to, const void *from, unsigned long len)
- {
-- int ret = 0;
-+ if (access_ok(VERIFY_WRITE, to, len))
-+ len = __copy_to_user(to, from, len);
-+ return len;
-+}
-
-+static __always_inline __must_check
-+unsigned long copy_from_user(void *to, const void __user *from, unsigned long len)
-+{
- might_fault();
-+
-+ if (access_ok(VERIFY_READ, from, len))
-+ len = __copy_from_user(to, from, len);
-+ else if (len < INT_MAX) {
-+ if (!__builtin_constant_p(len))
-+ check_object_size(to, len, false);
-+ memset(to, 0, len);
-+ }
-+ return len;
-+}
-+
-+static __always_inline __must_check
-+unsigned long __copy_in_user(void __user *dst, const void __user *src, unsigned long size)
-+{
-+ unsigned ret = 0;
-+
-+ might_fault();
-+
-+ pax_track_stack();
-+
-+ if (size > INT_MAX)
-+ return size;
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ if (!__access_ok(VERIFY_READ, src, size))
-+ return size;
-+ if (!__access_ok(VERIFY_WRITE, dst, size))
-+ return size;
-+#endif
-+
- if (!__builtin_constant_p(size))
-- return copy_user_generic((__force void *)dst,
-- (__force void *)src, size);
-+ return copy_user_generic((__force_kernel void *)____m(dst),
-+ (__force_kernel const void *)____m(src), size);
- switch (size) {
- case 1: {
- u8 tmp;
-- __get_user_asm(tmp, (u8 __user *)src,
-+ __get_user_asm(tmp, (const u8 __user *)src,
- ret, "b", "b", "=q", 1);
- if (likely(!ret))
- __put_user_asm(tmp, (u8 __user *)dst,
-@@ -134,7 +208,7 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
- }
- case 2: {
- u16 tmp;
-- __get_user_asm(tmp, (u16 __user *)src,
-+ __get_user_asm(tmp, (const u16 __user *)src,
- ret, "w", "w", "=r", 2);
- if (likely(!ret))
- __put_user_asm(tmp, (u16 __user *)dst,
-@@ -144,7 +218,7 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
-
- case 4: {
- u32 tmp;
-- __get_user_asm(tmp, (u32 __user *)src,
-+ __get_user_asm(tmp, (const u32 __user *)src,
- ret, "l", "k", "=r", 4);
- if (likely(!ret))
- __put_user_asm(tmp, (u32 __user *)dst,
-@@ -153,7 +227,7 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
- }
- case 8: {
- u64 tmp;
-- __get_user_asm(tmp, (u64 __user *)src,
-+ __get_user_asm(tmp, (const u64 __user *)src,
- ret, "q", "", "=r", 8);
- if (likely(!ret))
- __put_user_asm(tmp, (u64 __user *)dst,
-@@ -161,8 +235,8 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
- return ret;
- }
- default:
-- return copy_user_generic((__force void *)dst,
-- (__force void *)src, size);
-+ return copy_user_generic((__force_kernel void *)____m(dst),
-+ (__force_kernel const void *)____m(src), size);
- }
- }
-
-@@ -173,36 +247,62 @@ __strncpy_from_user(char *dst, const char __user *src, long count);
- __must_check long strnlen_user(const char __user *str, long n);
- __must_check long __strnlen_user(const char __user *str, long n);
- __must_check long strlen_user(const char __user *str);
--__must_check unsigned long clear_user(void __user *mem, unsigned long len);
--__must_check unsigned long __clear_user(void __user *mem, unsigned long len);
-+__must_check unsigned long clear_user(void __user *mem, unsigned long len) __size_overflow(2);
-+__must_check unsigned long __clear_user(void __user *mem, unsigned long len) __size_overflow(2);
-
--__must_check long __copy_from_user_inatomic(void *dst, const void __user *src,
-- unsigned size);
-+static __must_check __always_inline unsigned long
-+__copy_from_user_inatomic(void *dst, const void __user *src, unsigned long size)
-+{
-+ pax_track_stack();
-+
-+ if (size > INT_MAX)
-+ return size;
-
--static __must_check __always_inline int
--__copy_to_user_inatomic(void __user *dst, const void *src, unsigned size)
-+ return copy_user_generic(dst, (__force_kernel const void *)____m(src), size);
-+}
-+
-+static __must_check __always_inline unsigned long
-+__copy_to_user_inatomic(void __user *dst, const void *src, unsigned long size)
- {
-- return copy_user_generic((__force void *)dst, src, size);
-+ if (size > INT_MAX)
-+ return size;
-+
-+ return copy_user_generic((__force_kernel void *)____m(dst), src, size);
- }
-
--extern long __copy_user_nocache(void *dst, const void __user *src,
-- unsigned size, int zerorest);
-+extern unsigned long __copy_user_nocache(void *dst, const void __user *src,
-+ unsigned long size, int zerorest) __size_overflow(3);
-
--static inline int
--__copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
-+static inline unsigned long __copy_from_user_nocache(void *dst, const void __user *src, unsigned long size)
- {
- might_sleep();
-+
-+ if (size > INT_MAX)
-+ return size;
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ if (!__access_ok(VERIFY_READ, src, size))
-+ return size;
-+#endif
-+
- return __copy_user_nocache(dst, src, size, 1);
- }
-
--static inline int
--__copy_from_user_inatomic_nocache(void *dst, const void __user *src,
-- unsigned size)
-+static inline unsigned long __copy_from_user_inatomic_nocache(void *dst, const void __user *src,
-+ unsigned long size)
- {
-+ if (size > INT_MAX)
-+ return size;
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ if (!__access_ok(VERIFY_READ, src, size))
-+ return size;
-+#endif
-+
- return __copy_user_nocache(dst, src, size, 0);
- }
-
--unsigned long
--copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest);
-+extern unsigned long
-+copy_user_handle_tail(char __user *to, char __user *from, unsigned long len, unsigned zerorest) __size_overflow(3);
-
- #endif /* _ASM_X86_UACCESS_64_H */
-diff --git a/arch/x86/include/asm/vdso.h b/arch/x86/include/asm/vdso.h
-index 9064052..786cfbc 100644
---- a/arch/x86/include/asm/vdso.h
-+++ b/arch/x86/include/asm/vdso.h
-@@ -25,7 +25,7 @@ extern const char VDSO32_PRELINK[];
- #define VDSO32_SYMBOL(base, name) \
- ({ \
- extern const char VDSO32_##name[]; \
-- (void *)(VDSO32_##name - VDSO32_PRELINK + (unsigned long)(base)); \
-+ (void __user *)(VDSO32_##name - VDSO32_PRELINK + (unsigned long)(base)); \
- })
- #endif
-
-diff --git a/arch/x86/include/asm/vgtod.h b/arch/x86/include/asm/vgtod.h
-index 3d61e20..9507180 100644
---- a/arch/x86/include/asm/vgtod.h
-+++ b/arch/x86/include/asm/vgtod.h
-@@ -14,6 +14,7 @@ struct vsyscall_gtod_data {
- int sysctl_enabled;
- struct timezone sys_tz;
- struct { /* extract of a clocksource struct */
-+ char name[8];
- cycle_t (*vread)(void);
- cycle_t cycle_last;
- cycle_t mask;
-diff --git a/arch/x86/include/asm/vmi.h b/arch/x86/include/asm/vmi.h
-index 61e08c0..b0da582 100644
---- a/arch/x86/include/asm/vmi.h
-+++ b/arch/x86/include/asm/vmi.h
-@@ -191,6 +191,7 @@ struct vrom_header {
- u8 reserved[96]; /* Reserved for headers */
- char vmi_init[8]; /* VMI_Init jump point */
- char get_reloc[8]; /* VMI_GetRelocationInfo jump point */
-+ char rom_data[8048]; /* rest of the option ROM */
- } __attribute__((packed));
-
- struct pnp_header {
-diff --git a/arch/x86/include/asm/vmi_time.h b/arch/x86/include/asm/vmi_time.h
-index c6e0bee..fcb9f74 100644
---- a/arch/x86/include/asm/vmi_time.h
-+++ b/arch/x86/include/asm/vmi_time.h
-@@ -43,7 +43,7 @@ extern struct vmi_timer_ops {
- int (*wallclock_updated)(void);
- void (*set_alarm)(u32 flags, u64 expiry, u64 period);
- void (*cancel_alarm)(u32 flags);
--} vmi_timer_ops;
-+} __no_const vmi_timer_ops;
-
- /* Prototypes */
- extern void __init vmi_time_init(void);
-diff --git a/arch/x86/include/asm/vsyscall.h b/arch/x86/include/asm/vsyscall.h
-index d0983d2..1f7c9e9 100644
---- a/arch/x86/include/asm/vsyscall.h
-+++ b/arch/x86/include/asm/vsyscall.h
-@@ -15,9 +15,10 @@ enum vsyscall_num {
-
- #ifdef __KERNEL__
- #include <linux/seqlock.h>
-+#include <linux/getcpu.h>
-+#include <linux/time.h>
-
- #define __section_vgetcpu_mode __attribute__ ((unused, __section__ (".vgetcpu_mode"), aligned(16)))
--#define __section_jiffies __attribute__ ((unused, __section__ (".jiffies"), aligned(16)))
-
- /* Definitions for CONFIG_GENERIC_TIME definitions */
- #define __section_vsyscall_gtod_data __attribute__ \
-@@ -31,7 +32,6 @@ enum vsyscall_num {
- #define VGETCPU_LSL 2
-
- extern int __vgetcpu_mode;
--extern volatile unsigned long __jiffies;
-
- /* kernel space (writeable) */
- extern int vgetcpu_mode;
-@@ -39,6 +39,9 @@ extern struct timezone sys_tz;
-
- extern void map_vsyscall(void);
-
-+extern int vgettimeofday(struct timeval * tv, struct timezone * tz);
-+extern time_t vtime(time_t *t);
-+extern long vgetcpu(unsigned *cpu, unsigned *node, struct getcpu_cache *tcache);
- #endif /* __KERNEL__ */
-
- #endif /* _ASM_X86_VSYSCALL_H */
-diff --git a/arch/x86/include/asm/xsave.h b/arch/x86/include/asm/xsave.h
-index 727acc1..52c9e4c 100644
---- a/arch/x86/include/asm/xsave.h
-+++ b/arch/x86/include/asm/xsave.h
-@@ -56,7 +56,12 @@ static inline int xrstor_checking(struct xsave_struct *fx)
- static inline int xsave_user(struct xsave_struct __user *buf)
- {
- int err;
-- __asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x27\n"
-+
-+ buf = (struct xsave_struct __user *)____m(buf);
-+
-+ __asm__ __volatile__("1:"
-+ __copyuser_seg
-+ ".byte " REX_PREFIX "0x0f,0xae,0x27\n"
- "2:\n"
- ".section .fixup,\"ax\"\n"
- "3: movl $-1,%[err]\n"
-@@ -78,11 +83,13 @@ static inline int xsave_user(struct xsave_struct __user *buf)
- static inline int xrestore_user(struct xsave_struct __user *buf, u64 mask)
- {
- int err;
-- struct xsave_struct *xstate = ((__force struct xsave_struct *)buf);
-+ struct xsave_struct *xstate = ((__force_kernel struct xsave_struct *)____m(buf));
- u32 lmask = mask;
- u32 hmask = mask >> 32;
-
-- __asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x2f\n"
-+ __asm__ __volatile__("1:"
-+ __copyuser_seg
-+ ".byte " REX_PREFIX "0x0f,0xae,0x2f\n"
- "2:\n"
- ".section .fixup,\"ax\"\n"
- "3: movl $-1,%[err]\n"
-diff --git a/arch/x86/kernel/acpi/realmode/Makefile b/arch/x86/kernel/acpi/realmode/Makefile
-index 6a564ac..3f3a3d7 100644
---- a/arch/x86/kernel/acpi/realmode/Makefile
-+++ b/arch/x86/kernel/acpi/realmode/Makefile
-@@ -41,6 +41,9 @@ KBUILD_CFLAGS := $(LINUXINCLUDE) -g -Os -D_SETUP -D_WAKEUP -D__KERNEL__ \
- $(call cc-option, -fno-stack-protector) \
- $(call cc-option, -mpreferred-stack-boundary=2)
- KBUILD_CFLAGS += $(call cc-option, -m32)
-+ifdef CONSTIFY_PLUGIN
-+KBUILD_CFLAGS += -fplugin-arg-constify_plugin-no-constify
-+endif
- KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
- GCOV_PROFILE := n
-
-diff --git a/arch/x86/kernel/acpi/realmode/wakeup.S b/arch/x86/kernel/acpi/realmode/wakeup.S
-index 580b4e2..d4129e4 100644
---- a/arch/x86/kernel/acpi/realmode/wakeup.S
-+++ b/arch/x86/kernel/acpi/realmode/wakeup.S
-@@ -91,6 +91,9 @@ _start:
- /* Do any other stuff... */
-
- #ifndef CONFIG_64BIT
-+ /* Recheck NX bit overrides (64bit path does this in trampoline) */
-+ call verify_cpu
-+
- /* This could also be done in C code... */
- movl pmode_cr3, %eax
- movl %eax, %cr3
-@@ -104,7 +107,7 @@ _start:
- movl %eax, %ecx
- orl %edx, %ecx
- jz 1f
-- movl $0xc0000080, %ecx
-+ mov $MSR_EFER, %ecx
- wrmsr
- 1:
-
-@@ -114,6 +117,7 @@ _start:
- movl pmode_cr0, %eax
- movl %eax, %cr0
- jmp pmode_return
-+# include "../../verify_cpu.S"
- #else
- pushw $0
- pushw trampoline_segment
-diff --git a/arch/x86/kernel/acpi/sleep.c b/arch/x86/kernel/acpi/sleep.c
-index ca93638..7042f24 100644
---- a/arch/x86/kernel/acpi/sleep.c
-+++ b/arch/x86/kernel/acpi/sleep.c
-@@ -11,11 +11,12 @@
- #include <linux/cpumask.h>
- #include <asm/segment.h>
- #include <asm/desc.h>
-+#include <asm/e820.h>
-
- #include "realmode/wakeup.h"
- #include "sleep.h"
-
--unsigned long acpi_wakeup_address;
-+unsigned long acpi_wakeup_address = 0x2000;
- unsigned long acpi_realmode_flags;
-
- /* address in low memory of the wakeup routine. */
-@@ -98,9 +99,13 @@ int acpi_save_state_mem(void)
- #else /* CONFIG_64BIT */
- header->trampoline_segment = setup_trampoline() >> 4;
- #ifdef CONFIG_SMP
-- stack_start.sp = temp_stack + sizeof(temp_stack);
-+ stack_start = (unsigned long)temp_stack + sizeof(temp_stack);
-+
-+ pax_open_kernel();
- early_gdt_descr.address =
- (unsigned long)get_cpu_gdt_table(smp_processor_id());
-+ pax_close_kernel();
-+
- initial_gs = per_cpu_offset(smp_processor_id());
- #endif
- initial_code = (unsigned long)wakeup_long64;
-@@ -134,14 +139,8 @@ void __init acpi_reserve_bootmem(void)
- return;
- }
-
-- acpi_realmode = (unsigned long)alloc_bootmem_low(WAKEUP_SIZE);
--
-- if (!acpi_realmode) {
-- printk(KERN_ERR "ACPI: Cannot allocate lowmem, S3 disabled.\n");
-- return;
-- }
--
-- acpi_wakeup_address = virt_to_phys((void *)acpi_realmode);
-+ reserve_early(acpi_wakeup_address, acpi_wakeup_address + WAKEUP_SIZE, "ACPI Wakeup Code");
-+ acpi_realmode = (unsigned long)__va(acpi_wakeup_address);;
- }
-
-
-diff --git a/arch/x86/kernel/acpi/wakeup_32.S b/arch/x86/kernel/acpi/wakeup_32.S
-index 8ded418..079961e 100644
---- a/arch/x86/kernel/acpi/wakeup_32.S
-+++ b/arch/x86/kernel/acpi/wakeup_32.S
-@@ -30,13 +30,11 @@ wakeup_pmode_return:
- # and restore the stack ... but you need gdt for this to work
- movl saved_context_esp, %esp
-
-- movl %cs:saved_magic, %eax
-- cmpl $0x12345678, %eax
-+ cmpl $0x12345678, saved_magic
- jne bogus_magic
-
- # jump to place where we left off
-- movl saved_eip, %eax
-- jmp *%eax
-+ jmp *(saved_eip)
-
- bogus_magic:
- jmp bogus_magic
-diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
-index de7353c..075da5f 100644
---- a/arch/x86/kernel/alternative.c
-+++ b/arch/x86/kernel/alternative.c
-@@ -407,7 +407,7 @@ void __init_or_module apply_paravirt(struct paravirt_patch_site *start,
-
- BUG_ON(p->len > MAX_PATCH_LEN);
- /* prep the buffer with the original instructions */
-- memcpy(insnbuf, p->instr, p->len);
-+ memcpy(insnbuf, ktla_ktva(p->instr), p->len);
- used = pv_init_ops.patch(p->instrtype, p->clobbers, insnbuf,
- (unsigned long)p->instr, p->len);
-
-@@ -475,7 +475,7 @@ void __init alternative_instructions(void)
- if (smp_alt_once)
- free_init_pages("SMP alternatives",
- (unsigned long)__smp_locks,
-- (unsigned long)__smp_locks_end);
-+ PAGE_ALIGN((unsigned long)__smp_locks_end));
-
- restart_nmi();
- }
-@@ -492,13 +492,17 @@ void __init alternative_instructions(void)
- * instructions. And on the local CPU you need to be protected again NMI or MCE
- * handlers seeing an inconsistent instruction while you patch.
- */
--static void *__init_or_module text_poke_early(void *addr, const void *opcode,
-+static void *__kprobes text_poke_early(void *addr, const void *opcode,
- size_t len)
- {
- unsigned long flags;
- local_irq_save(flags);
-- memcpy(addr, opcode, len);
-+
-+ pax_open_kernel();
-+ memcpy(ktla_ktva(addr), opcode, len);
- sync_core();
-+ pax_close_kernel();
-+
- local_irq_restore(flags);
- /* Could also do a CLFLUSH here to speed up CPU recovery; but
- that causes hangs on some VIA CPUs. */
-@@ -520,35 +524,21 @@ static void *__init_or_module text_poke_early(void *addr, const void *opcode,
- */
- void *__kprobes text_poke(void *addr, const void *opcode, size_t len)
- {
-- unsigned long flags;
-- char *vaddr;
-+ unsigned char *vaddr = ktla_ktva(addr);
- struct page *pages[2];
-- int i;
-+ size_t i;
-
- if (!core_kernel_text((unsigned long)addr)) {
-- pages[0] = vmalloc_to_page(addr);
-- pages[1] = vmalloc_to_page(addr + PAGE_SIZE);
-+ pages[0] = vmalloc_to_page(vaddr);
-+ pages[1] = vmalloc_to_page(vaddr + PAGE_SIZE);
- } else {
-- pages[0] = virt_to_page(addr);
-+ pages[0] = virt_to_page(vaddr);
- WARN_ON(!PageReserved(pages[0]));
-- pages[1] = virt_to_page(addr + PAGE_SIZE);
-+ pages[1] = virt_to_page(vaddr + PAGE_SIZE);
- }
- BUG_ON(!pages[0]);
-- local_irq_save(flags);
-- set_fixmap(FIX_TEXT_POKE0, page_to_phys(pages[0]));
-- if (pages[1])
-- set_fixmap(FIX_TEXT_POKE1, page_to_phys(pages[1]));
-- vaddr = (char *)fix_to_virt(FIX_TEXT_POKE0);
-- memcpy(&vaddr[(unsigned long)addr & ~PAGE_MASK], opcode, len);
-- clear_fixmap(FIX_TEXT_POKE0);
-- if (pages[1])
-- clear_fixmap(FIX_TEXT_POKE1);
-- local_flush_tlb();
-- sync_core();
-- /* Could also do a CLFLUSH here to speed up CPU recovery; but
-- that causes hangs on some VIA CPUs. */
-+ text_poke_early(addr, opcode, len);
- for (i = 0; i < len; i++)
-- BUG_ON(((char *)addr)[i] != ((char *)opcode)[i]);
-- local_irq_restore(flags);
-+ BUG_ON((vaddr)[i] != ((const unsigned char *)opcode)[i]);
- return addr;
- }
-diff --git a/arch/x86/kernel/amd_iommu.c b/arch/x86/kernel/amd_iommu.c
-index 3a44b75..1601800 100644
---- a/arch/x86/kernel/amd_iommu.c
-+++ b/arch/x86/kernel/amd_iommu.c
-@@ -2076,7 +2076,7 @@ static void prealloc_protection_domains(void)
- }
- }
-
--static struct dma_map_ops amd_iommu_dma_ops = {
-+static const struct dma_map_ops amd_iommu_dma_ops = {
- .alloc_coherent = alloc_coherent,
- .free_coherent = free_coherent,
- .map_page = map_page,
-diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
-index 1d2d670..8e3f477 100644
---- a/arch/x86/kernel/apic/apic.c
-+++ b/arch/x86/kernel/apic/apic.c
-@@ -170,7 +170,7 @@ int first_system_vector = 0xfe;
- /*
- * Debug level, exported for io_apic.c
- */
--unsigned int apic_verbosity;
-+int apic_verbosity;
-
- int pic_mode;
-
-@@ -1794,7 +1794,7 @@ void smp_error_interrupt(struct pt_regs *regs)
- apic_write(APIC_ESR, 0);
- v1 = apic_read(APIC_ESR);
- ack_APIC_irq();
-- atomic_inc(&irq_err_count);
-+ atomic_inc_unchecked(&irq_err_count);
-
- /*
- * Here is what the APIC error bits mean:
-@@ -2184,6 +2184,8 @@ static int __cpuinit apic_cluster_num(void)
- u16 *bios_cpu_apicid;
- DECLARE_BITMAP(clustermap, NUM_APIC_CLUSTERS);
-
-+ pax_track_stack();
-+
- bios_cpu_apicid = early_per_cpu_ptr(x86_bios_cpu_apicid);
- bitmap_zero(clustermap, NUM_APIC_CLUSTERS);
-
-diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
-index 8928d97..f799cea 100644
---- a/arch/x86/kernel/apic/io_apic.c
-+++ b/arch/x86/kernel/apic/io_apic.c
-@@ -716,7 +716,7 @@ struct IO_APIC_route_entry **alloc_ioapic_entries(void)
- ioapic_entries = kzalloc(sizeof(*ioapic_entries) * nr_ioapics,
- GFP_ATOMIC);
- if (!ioapic_entries)
-- return 0;
-+ return NULL;
-
- for (apic = 0; apic < nr_ioapics; apic++) {
- ioapic_entries[apic] =
-@@ -733,7 +733,7 @@ nomem:
- kfree(ioapic_entries[apic]);
- kfree(ioapic_entries);
-
-- return 0;
-+ return NULL;
- }
-
- /*
-@@ -1150,7 +1150,7 @@ int IO_APIC_get_PCI_irq_vector(int bus, int slot, int pin,
- }
- EXPORT_SYMBOL(IO_APIC_get_PCI_irq_vector);
-
--void lock_vector_lock(void)
-+void lock_vector_lock(void) __acquires(vector_lock)
- {
- /* Used to the online set of cpus does not change
- * during assign_irq_vector.
-@@ -1158,7 +1158,7 @@ void lock_vector_lock(void)
- spin_lock(&vector_lock);
- }
-
--void unlock_vector_lock(void)
-+void unlock_vector_lock(void) __releases(vector_lock)
- {
- spin_unlock(&vector_lock);
- }
-@@ -2542,7 +2542,7 @@ static void ack_apic_edge(unsigned int irq)
- ack_APIC_irq();
- }
-
--atomic_t irq_mis_count;
-+atomic_unchecked_t irq_mis_count;
-
- static void ack_apic_level(unsigned int irq)
- {
-@@ -2626,7 +2626,7 @@ static void ack_apic_level(unsigned int irq)
-
- /* Tail end of version 0x11 I/O APIC bug workaround */
- if (!(v & (1 << (i & 0x1f)))) {
-- atomic_inc(&irq_mis_count);
-+ atomic_inc_unchecked(&irq_mis_count);
- spin_lock(&ioapic_lock);
- __mask_and_edge_IO_APIC_irq(cfg);
- __unmask_and_level_IO_APIC_irq(cfg);
-diff --git a/arch/x86/kernel/apic/numaq_32.c b/arch/x86/kernel/apic/numaq_32.c
-index efa00e2..63f96f5 100644
---- a/arch/x86/kernel/apic/numaq_32.c
-+++ b/arch/x86/kernel/apic/numaq_32.c
-@@ -275,13 +275,13 @@ static __init void early_check_numaq(void)
- early_get_smp_config();
-
- if (found_numaq) {
-- x86_init.mpparse.mpc_record = numaq_mpc_record;
-- x86_init.mpparse.setup_ioapic_ids = x86_init_noop;
-- x86_init.mpparse.mpc_apic_id = mpc_apic_id;
-- x86_init.mpparse.smp_read_mpc_oem = smp_read_mpc_oem;
-- x86_init.mpparse.mpc_oem_pci_bus = mpc_oem_pci_bus;
-- x86_init.mpparse.mpc_oem_bus_info = mpc_oem_bus_info;
-- x86_init.timers.tsc_pre_init = numaq_tsc_init;
-+ *(void **)&x86_init.mpparse.mpc_record = numaq_mpc_record;
-+ *(void **)&x86_init.mpparse.setup_ioapic_ids = x86_init_noop;
-+ *(void **)&x86_init.mpparse.mpc_apic_id = mpc_apic_id;
-+ *(void **)&x86_init.mpparse.smp_read_mpc_oem = smp_read_mpc_oem;
-+ *(void **)&x86_init.mpparse.mpc_oem_pci_bus = mpc_oem_pci_bus;
-+ *(void **)&x86_init.mpparse.mpc_oem_bus_info = mpc_oem_bus_info;
-+ *(void **)&x86_init.timers.tsc_pre_init = numaq_tsc_init;
- }
- }
-
-diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c
-index 151ace6..f317474 100644
---- a/arch/x86/kernel/apm_32.c
-+++ b/arch/x86/kernel/apm_32.c
-@@ -410,7 +410,7 @@ static DEFINE_SPINLOCK(user_list_lock);
- * This is for buggy BIOS's that refer to (real mode) segment 0x40
- * even though they are called in protected mode.
- */
--static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
-+static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
- (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
-
- static const char driver_version[] = "1.16ac"; /* no spaces */
-@@ -588,7 +588,10 @@ static long __apm_bios_call(void *_call)
- BUG_ON(cpu != 0);
- gdt = get_cpu_gdt_table(cpu);
- save_desc_40 = gdt[0x40 / 8];
-+
-+ pax_open_kernel();
- gdt[0x40 / 8] = bad_bios_desc;
-+ pax_close_kernel();
-
- apm_irq_save(flags);
- APM_DO_SAVE_SEGS;
-@@ -597,7 +600,11 @@ static long __apm_bios_call(void *_call)
- &call->esi);
- APM_DO_RESTORE_SEGS;
- apm_irq_restore(flags);
-+
-+ pax_open_kernel();
- gdt[0x40 / 8] = save_desc_40;
-+ pax_close_kernel();
-+
- put_cpu();
-
- return call->eax & 0xff;
-@@ -664,7 +671,10 @@ static long __apm_bios_call_simple(void *_call)
- BUG_ON(cpu != 0);
- gdt = get_cpu_gdt_table(cpu);
- save_desc_40 = gdt[0x40 / 8];
-+
-+ pax_open_kernel();
- gdt[0x40 / 8] = bad_bios_desc;
-+ pax_close_kernel();
-
- apm_irq_save(flags);
- APM_DO_SAVE_SEGS;
-@@ -672,7 +682,11 @@ static long __apm_bios_call_simple(void *_call)
- &call->eax);
- APM_DO_RESTORE_SEGS;
- apm_irq_restore(flags);
-+
-+ pax_open_kernel();
- gdt[0x40 / 8] = save_desc_40;
-+ pax_close_kernel();
-+
- put_cpu();
- return error;
- }
-@@ -975,7 +989,7 @@ recalc:
-
- static void apm_power_off(void)
- {
-- unsigned char po_bios_call[] = {
-+ const unsigned char po_bios_call[] = {
- 0xb8, 0x00, 0x10, /* movw $0x1000,ax */
- 0x8e, 0xd0, /* movw ax,ss */
- 0xbc, 0x00, 0xf0, /* movw $0xf000,sp */
-@@ -2357,12 +2371,15 @@ static int __init apm_init(void)
- * code to that CPU.
- */
- gdt = get_cpu_gdt_table(0);
-+
-+ pax_open_kernel();
- set_desc_base(&gdt[APM_CS >> 3],
- (unsigned long)__va((unsigned long)apm_info.bios.cseg << 4));
- set_desc_base(&gdt[APM_CS_16 >> 3],
- (unsigned long)__va((unsigned long)apm_info.bios.cseg_16 << 4));
- set_desc_base(&gdt[APM_DS >> 3],
- (unsigned long)__va((unsigned long)apm_info.bios.dseg << 4));
-+ pax_close_kernel();
-
- proc_create("apm", 0, NULL, &apm_file_ops);
-
-diff --git a/arch/x86/kernel/asm-offsets_32.c b/arch/x86/kernel/asm-offsets_32.c
-index dfdbf64..9b2b6ce 100644
---- a/arch/x86/kernel/asm-offsets_32.c
-+++ b/arch/x86/kernel/asm-offsets_32.c
-@@ -51,7 +51,6 @@ void foo(void)
- OFFSET(CPUINFO_x86_vendor_id, cpuinfo_x86, x86_vendor_id);
- BLANK();
-
-- OFFSET(TI_task, thread_info, task);
- OFFSET(TI_exec_domain, thread_info, exec_domain);
- OFFSET(TI_flags, thread_info, flags);
- OFFSET(TI_status, thread_info, status);
-@@ -60,6 +59,8 @@ void foo(void)
- OFFSET(TI_restart_block, thread_info, restart_block);
- OFFSET(TI_sysenter_return, thread_info, sysenter_return);
- OFFSET(TI_cpu, thread_info, cpu);
-+ OFFSET(TI_lowest_stack, thread_info, lowest_stack);
-+ DEFINE(TI_task_thread_sp0, offsetof(struct task_struct, thread.sp0) - offsetof(struct task_struct, tinfo));
- BLANK();
-
- OFFSET(GDS_size, desc_ptr, size);
-@@ -99,6 +100,7 @@ void foo(void)
-
- DEFINE(PAGE_SIZE_asm, PAGE_SIZE);
- DEFINE(PAGE_SHIFT_asm, PAGE_SHIFT);
-+ DEFINE(THREAD_SIZE_asm, THREAD_SIZE);
- DEFINE(PTRS_PER_PTE, PTRS_PER_PTE);
- DEFINE(PTRS_PER_PMD, PTRS_PER_PMD);
- DEFINE(PTRS_PER_PGD, PTRS_PER_PGD);
-@@ -115,6 +117,11 @@ void foo(void)
- OFFSET(PV_CPU_iret, pv_cpu_ops, iret);
- OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
- OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
-+#endif
-+
- #endif
-
- #ifdef CONFIG_XEN
-diff --git a/arch/x86/kernel/asm-offsets_64.c b/arch/x86/kernel/asm-offsets_64.c
-index 4a6aeed..371de20 100644
---- a/arch/x86/kernel/asm-offsets_64.c
-+++ b/arch/x86/kernel/asm-offsets_64.c
-@@ -44,6 +44,8 @@ int main(void)
- ENTRY(addr_limit);
- ENTRY(preempt_count);
- ENTRY(status);
-+ ENTRY(lowest_stack);
-+ DEFINE(TI_task_thread_sp0, offsetof(struct task_struct, thread.sp0) - offsetof(struct task_struct, tinfo));
- #ifdef CONFIG_IA32_EMULATION
- ENTRY(sysenter_return);
- #endif
-@@ -63,6 +65,18 @@ int main(void)
- OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
- OFFSET(PV_CPU_swapgs, pv_cpu_ops, swapgs);
- OFFSET(PV_MMU_read_cr2, pv_mmu_ops, read_cr2);
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
-+ OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
-+#endif
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ OFFSET(PV_MMU_read_cr3, pv_mmu_ops, read_cr3);
-+ OFFSET(PV_MMU_write_cr3, pv_mmu_ops, write_cr3);
-+ OFFSET(PV_MMU_set_pgd_batched, pv_mmu_ops, set_pgd_batched);
-+#endif
-+
- #endif
-
-
-@@ -115,6 +129,7 @@ int main(void)
- ENTRY(cr8);
- BLANK();
- #undef ENTRY
-+ DEFINE(TSS_size, sizeof(struct tss_struct));
- DEFINE(TSS_ist, offsetof(struct tss_struct, x86_tss.ist));
- BLANK();
- DEFINE(crypto_tfm_ctx_offset, offsetof(struct crypto_tfm, __crt_ctx));
-@@ -130,6 +145,7 @@ int main(void)
-
- BLANK();
- DEFINE(PAGE_SIZE_asm, PAGE_SIZE);
-+ DEFINE(THREAD_SIZE_asm, THREAD_SIZE);
- #ifdef CONFIG_XEN
- BLANK();
- OFFSET(XEN_vcpu_info_mask, vcpu_info, evtchn_upcall_mask);
-diff --git a/arch/x86/kernel/cpu/Makefile b/arch/x86/kernel/cpu/Makefile
-index 1f537a2..a7cb6c6 100644
---- a/arch/x86/kernel/cpu/Makefile
-+++ b/arch/x86/kernel/cpu/Makefile
-@@ -7,10 +7,6 @@ ifdef CONFIG_FUNCTION_TRACER
- CFLAGS_REMOVE_common.o = -pg
- endif
-
--# Make sure load_percpu_segment has no stackprotector
--nostackp := $(call cc-option, -fno-stack-protector)
--CFLAGS_common.o := $(nostackp)
--
- obj-y := intel_cacheinfo.o addon_cpuid_features.o
- obj-y += proc.o capflags.o powerflags.o common.o
- obj-y += vmware.o hypervisor.o sched.o
-diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
-index 6e082dc..a0b5f36 100644
---- a/arch/x86/kernel/cpu/amd.c
-+++ b/arch/x86/kernel/cpu/amd.c
-@@ -602,7 +602,7 @@ static unsigned int __cpuinit amd_size_cache(struct cpuinfo_x86 *c,
- unsigned int size)
- {
- /* AMD errata T13 (order #21922) */
-- if ((c->x86 == 6)) {
-+ if (c->x86 == 6) {
- /* Duron Rev A0 */
- if (c->x86_model == 3 && c->x86_mask == 0)
- size = 64;
-diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
-index ba1a1dd..1a4b0af 100644
---- a/arch/x86/kernel/cpu/common.c
-+++ b/arch/x86/kernel/cpu/common.c
-@@ -84,60 +84,6 @@ static const struct cpu_dev __cpuinitconst default_cpu = {
-
- static const struct cpu_dev *this_cpu __cpuinitdata = &default_cpu;
-
--DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = {
--#ifdef CONFIG_X86_64
-- /*
-- * We need valid kernel segments for data and code in long mode too
-- * IRET will check the segment types kkeil 2000/10/28
-- * Also sysret mandates a special GDT layout
-- *
-- * TLS descriptors are currently at a different place compared to i386.
-- * Hopefully nobody expects them at a fixed place (Wine?)
-- */
-- [GDT_ENTRY_KERNEL32_CS] = GDT_ENTRY_INIT(0xc09b, 0, 0xfffff),
-- [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xa09b, 0, 0xfffff),
-- [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc093, 0, 0xfffff),
-- [GDT_ENTRY_DEFAULT_USER32_CS] = GDT_ENTRY_INIT(0xc0fb, 0, 0xfffff),
-- [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f3, 0, 0xfffff),
-- [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xa0fb, 0, 0xfffff),
--#else
-- [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xc09a, 0, 0xfffff),
-- [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
-- [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xc0fa, 0, 0xfffff),
-- [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f2, 0, 0xfffff),
-- /*
-- * Segments used for calling PnP BIOS have byte granularity.
-- * They code segments and data segments have fixed 64k limits,
-- * the transfer segment sizes are set at run time.
-- */
-- /* 32-bit code */
-- [GDT_ENTRY_PNPBIOS_CS32] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
-- /* 16-bit code */
-- [GDT_ENTRY_PNPBIOS_CS16] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
-- /* 16-bit data */
-- [GDT_ENTRY_PNPBIOS_DS] = GDT_ENTRY_INIT(0x0092, 0, 0xffff),
-- /* 16-bit data */
-- [GDT_ENTRY_PNPBIOS_TS1] = GDT_ENTRY_INIT(0x0092, 0, 0),
-- /* 16-bit data */
-- [GDT_ENTRY_PNPBIOS_TS2] = GDT_ENTRY_INIT(0x0092, 0, 0),
-- /*
-- * The APM segments have byte granularity and their bases
-- * are set at run time. All have 64k limits.
-- */
-- /* 32-bit code */
-- [GDT_ENTRY_APMBIOS_BASE] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
-- /* 16-bit code */
-- [GDT_ENTRY_APMBIOS_BASE+1] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
-- /* data */
-- [GDT_ENTRY_APMBIOS_BASE+2] = GDT_ENTRY_INIT(0x4092, 0, 0xffff),
--
-- [GDT_ENTRY_ESPFIX_SS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
-- [GDT_ENTRY_PERCPU] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
-- GDT_STACK_CANARY_INIT
--#endif
--} };
--EXPORT_PER_CPU_SYMBOL_GPL(gdt_page);
--
- static int __init x86_xsave_setup(char *s)
- {
- setup_clear_cpu_cap(X86_FEATURE_XSAVE);
-@@ -345,7 +291,7 @@ void switch_to_new_gdt(int cpu)
- {
- struct desc_ptr gdt_descr;
-
-- gdt_descr.address = (long)get_cpu_gdt_table(cpu);
-+ gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
- gdt_descr.size = GDT_SIZE - 1;
- load_gdt(&gdt_descr);
- /* Reload the per-cpu base */
-@@ -799,6 +745,10 @@ static void __cpuinit identify_cpu(struct cpuinfo_x86 *c)
- /* Filter out anything that depends on CPUID levels we don't have */
- filter_cpuid_features(c, true);
-
-+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF))
-+ setup_clear_cpu_cap(X86_FEATURE_SEP);
-+#endif
-+
- /* If the model name is still unset, do table lookup. */
- if (!c->x86_model_id[0]) {
- const char *p;
-@@ -982,6 +932,9 @@ static __init int setup_disablecpuid(char *arg)
- }
- __setup("clearcpuid=", setup_disablecpuid);
-
-+DEFINE_PER_CPU(struct thread_info *, current_tinfo) = &init_task.tinfo;
-+EXPORT_PER_CPU_SYMBOL(current_tinfo);
-+
- #ifdef CONFIG_X86_64
- struct desc_ptr idt_descr = { NR_VECTORS * 16 - 1, (unsigned long) idt_table };
-
-@@ -997,7 +950,7 @@ DEFINE_PER_CPU(struct task_struct *, current_task) ____cacheline_aligned =
- EXPORT_PER_CPU_SYMBOL(current_task);
-
- DEFINE_PER_CPU(unsigned long, kernel_stack) =
-- (unsigned long)&init_thread_union - KERNEL_STACK_OFFSET + THREAD_SIZE;
-+ (unsigned long)&init_thread_union - 16 + THREAD_SIZE;
- EXPORT_PER_CPU_SYMBOL(kernel_stack);
-
- DEFINE_PER_CPU(char *, irq_stack_ptr) =
-@@ -1062,7 +1015,7 @@ struct pt_regs * __cpuinit idle_regs(struct pt_regs *regs)
- {
- memset(regs, 0, sizeof(struct pt_regs));
- regs->fs = __KERNEL_PERCPU;
-- regs->gs = __KERNEL_STACK_CANARY;
-+ savesegment(gs, regs->gs);
-
- return regs;
- }
-@@ -1103,7 +1056,7 @@ void __cpuinit cpu_init(void)
- int i;
-
- cpu = stack_smp_processor_id();
-- t = &per_cpu(init_tss, cpu);
-+ t = init_tss + cpu;
- orig_ist = &per_cpu(orig_ist, cpu);
-
- #ifdef CONFIG_NUMA
-@@ -1129,7 +1082,7 @@ void __cpuinit cpu_init(void)
- switch_to_new_gdt(cpu);
- loadsegment(fs, 0);
-
-- load_idt((const struct desc_ptr *)&idt_descr);
-+ load_idt(&idt_descr);
-
- memset(me->thread.tls_array, 0, GDT_ENTRY_TLS_ENTRIES * 8);
- syscall_init();
-@@ -1138,7 +1091,6 @@ void __cpuinit cpu_init(void)
- wrmsrl(MSR_KERNEL_GS_BASE, 0);
- barrier();
-
-- check_efer();
- if (cpu != 0)
- enable_x2apic();
-
-@@ -1201,7 +1153,7 @@ void __cpuinit cpu_init(void)
- {
- int cpu = smp_processor_id();
- struct task_struct *curr = current;
-- struct tss_struct *t = &per_cpu(init_tss, cpu);
-+ struct tss_struct *t = init_tss + cpu;
- struct thread_struct *thread = &curr->thread;
-
- if (cpumask_test_and_set_cpu(cpu, cpu_initialized_mask)) {
-diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
-index 6a77cca..4f4fca0 100644
---- a/arch/x86/kernel/cpu/intel.c
-+++ b/arch/x86/kernel/cpu/intel.c
-@@ -162,7 +162,7 @@ static void __cpuinit trap_init_f00f_bug(void)
- * Update the IDT descriptor and reload the IDT so that
- * it uses the read-only mapped virtual address.
- */
-- idt_descr.address = fix_to_virt(FIX_F00F_IDT);
-+ idt_descr.address = (struct desc_struct *)fix_to_virt(FIX_F00F_IDT);
- load_idt(&idt_descr);
- }
- #endif
-diff --git a/arch/x86/kernel/cpu/intel_cacheinfo.c b/arch/x86/kernel/cpu/intel_cacheinfo.c
-index 417990f..8c489b8 100644
---- a/arch/x86/kernel/cpu/intel_cacheinfo.c
-+++ b/arch/x86/kernel/cpu/intel_cacheinfo.c
-@@ -921,7 +921,7 @@ static ssize_t store(struct kobject *kobj, struct attribute *attr,
- return ret;
- }
-
--static struct sysfs_ops sysfs_ops = {
-+static const struct sysfs_ops sysfs_ops = {
- .show = show,
- .store = store,
- };
-@@ -931,6 +931,11 @@ static struct kobj_type ktype_cache = {
- .default_attrs = default_attrs,
- };
-
-+static struct kobj_type ktype_l3_cache = {
-+ .sysfs_ops = &sysfs_ops,
-+ .default_attrs = default_l3_attrs,
-+};
-+
- static struct kobj_type ktype_percpu_entry = {
- .sysfs_ops = &sysfs_ops,
- };
-@@ -997,6 +1002,8 @@ static int __cpuinit cache_add_dev(struct sys_device * sys_dev)
- }
-
- for (i = 0; i < num_cache_leaves; i++) {
-+ struct kobj_type *ktype;
-+
- this_object = INDEX_KOBJECT_PTR(cpu, i);
- this_object->cpu = cpu;
- this_object->index = i;
-@@ -1004,12 +1011,12 @@ static int __cpuinit cache_add_dev(struct sys_device * sys_dev)
- this_leaf = CPUID4_INFO_IDX(cpu, i);
-
- if (this_leaf->can_disable)
-- ktype_cache.default_attrs = default_l3_attrs;
-+ ktype = &ktype_l3_cache;
- else
-- ktype_cache.default_attrs = default_attrs;
-+ ktype = &ktype_cache;
-
- retval = kobject_init_and_add(&(this_object->kobj),
-- &ktype_cache,
-+ ktype,
- per_cpu(cache_kobject, cpu),
- "index%1lu", i);
- if (unlikely(retval)) {
-diff --git a/arch/x86/kernel/cpu/mcheck/mce-inject.c b/arch/x86/kernel/cpu/mcheck/mce-inject.c
-index 472763d..9831e11 100644
---- a/arch/x86/kernel/cpu/mcheck/mce-inject.c
-+++ b/arch/x86/kernel/cpu/mcheck/mce-inject.c
-@@ -211,7 +211,9 @@ static ssize_t mce_write(struct file *filp, const char __user *ubuf,
- static int inject_init(void)
- {
- printk(KERN_INFO "Machine check injector initialized\n");
-- mce_chrdev_ops.write = mce_write;
-+ pax_open_kernel();
-+ *(void **)&mce_chrdev_ops.write = mce_write;
-+ pax_close_kernel();
- register_die_notifier(&mce_raise_nb);
- return 0;
- }
-diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
-index 0f16a2b..a4a4382 100644
---- a/arch/x86/kernel/cpu/mcheck/mce.c
-+++ b/arch/x86/kernel/cpu/mcheck/mce.c
-@@ -43,6 +43,7 @@
- #include <asm/ipi.h>
- #include <asm/mce.h>
- #include <asm/msr.h>
-+#include <asm/local.h>
-
- #include "mce-internal.h"
-
-@@ -187,7 +188,7 @@ static void print_mce(struct mce *m)
- !(m->mcgstatus & MCG_STATUS_EIPV) ? " !INEXACT!" : "",
- m->cs, m->ip);
-
-- if (m->cs == __KERNEL_CS)
-+ if (m->cs == __KERNEL_CS || m->cs == __KERNEXEC_KERNEL_CS)
- print_symbol("{%s}", m->ip);
- pr_cont("\n");
- }
-@@ -221,10 +222,10 @@ static void print_mce_tail(void)
-
- #define PANIC_TIMEOUT 5 /* 5 seconds */
-
--static atomic_t mce_paniced;
-+static atomic_unchecked_t mce_paniced;
-
- static int fake_panic;
--static atomic_t mce_fake_paniced;
-+static atomic_unchecked_t mce_fake_paniced;
-
- /* Panic in progress. Enable interrupts and wait for final IPI */
- static void wait_for_panic(void)
-@@ -248,7 +249,7 @@ static void mce_panic(char *msg, struct mce *final, char *exp)
- /*
- * Make sure only one CPU runs in machine check panic
- */
-- if (atomic_inc_return(&mce_paniced) > 1)
-+ if (atomic_inc_return_unchecked(&mce_paniced) > 1)
- wait_for_panic();
- barrier();
-
-@@ -256,7 +257,7 @@ static void mce_panic(char *msg, struct mce *final, char *exp)
- console_verbose();
- } else {
- /* Don't log too much for fake panic */
-- if (atomic_inc_return(&mce_fake_paniced) > 1)
-+ if (atomic_inc_return_unchecked(&mce_fake_paniced) > 1)
- return;
- }
- print_mce_head();
-@@ -616,7 +617,7 @@ static int mce_timed_out(u64 *t)
- * might have been modified by someone else.
- */
- rmb();
-- if (atomic_read(&mce_paniced))
-+ if (atomic_read_unchecked(&mce_paniced))
- wait_for_panic();
- if (!monarch_timeout)
- goto out;
-@@ -1394,7 +1395,7 @@ static void unexpected_machine_check(struct pt_regs *regs, long error_code)
- }
-
- /* Call the installed machine check handler for this CPU setup. */
--void (*machine_check_vector)(struct pt_regs *, long error_code) =
-+void (*machine_check_vector)(struct pt_regs *, long error_code) __read_only =
- unexpected_machine_check;
-
- /*
-@@ -1416,7 +1417,9 @@ void __cpuinit mcheck_init(struct cpuinfo_x86 *c)
- return;
- }
-
-+ pax_open_kernel();
- machine_check_vector = do_machine_check;
-+ pax_close_kernel();
-
- mce_init();
- mce_cpu_features(c);
-@@ -1429,14 +1432,14 @@ void __cpuinit mcheck_init(struct cpuinfo_x86 *c)
- */
-
- static DEFINE_SPINLOCK(mce_state_lock);
--static int open_count; /* #times opened */
-+static local_t open_count; /* #times opened */
- static int open_exclu; /* already open exclusive? */
-
- static int mce_open(struct inode *inode, struct file *file)
- {
- spin_lock(&mce_state_lock);
-
-- if (open_exclu || (open_count && (file->f_flags & O_EXCL))) {
-+ if (open_exclu || (local_read(&open_count) && (file->f_flags & O_EXCL))) {
- spin_unlock(&mce_state_lock);
-
- return -EBUSY;
-@@ -1444,7 +1447,7 @@ static int mce_open(struct inode *inode, struct file *file)
-
- if (file->f_flags & O_EXCL)
- open_exclu = 1;
-- open_count++;
-+ local_inc(&open_count);
-
- spin_unlock(&mce_state_lock);
-
-@@ -1455,7 +1458,7 @@ static int mce_release(struct inode *inode, struct file *file)
- {
- spin_lock(&mce_state_lock);
-
-- open_count--;
-+ local_dec(&open_count);
- open_exclu = 0;
-
- spin_unlock(&mce_state_lock);
-@@ -2007,7 +2010,7 @@ mce_cpu_callback(struct notifier_block *nfb, unsigned long action, void *hcpu)
- return NOTIFY_OK;
- }
-
--static struct notifier_block mce_cpu_notifier __cpuinitdata = {
-+static struct notifier_block mce_cpu_notifier __cpuinitconst = {
- .notifier_call = mce_cpu_callback,
- };
-
-@@ -2082,7 +2085,7 @@ struct dentry *mce_get_debugfs_dir(void)
- static void mce_reset(void)
- {
- cpu_missing = 0;
-- atomic_set(&mce_fake_paniced, 0);
-+ atomic_set_unchecked(&mce_fake_paniced, 0);
- atomic_set(&mce_executing, 0);
- atomic_set(&mce_callin, 0);
- atomic_set(&global_nwo, 0);
-diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c
-index ef3cd31..9d2f6ab 100644
---- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
-+++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
-@@ -385,7 +385,7 @@ static ssize_t store(struct kobject *kobj, struct attribute *attr,
- return ret;
- }
-
--static struct sysfs_ops threshold_ops = {
-+static const struct sysfs_ops threshold_ops = {
- .show = show,
- .store = store,
- };
-diff --git a/arch/x86/kernel/cpu/mcheck/p5.c b/arch/x86/kernel/cpu/mcheck/p5.c
-index 5c0e653..0882b0a 100644
---- a/arch/x86/kernel/cpu/mcheck/p5.c
-+++ b/arch/x86/kernel/cpu/mcheck/p5.c
-@@ -12,6 +12,7 @@
- #include <asm/system.h>
- #include <asm/mce.h>
- #include <asm/msr.h>
-+#include <asm/pgtable.h>
-
- /* By default disabled */
- int mce_p5_enabled __read_mostly;
-@@ -50,7 +51,9 @@ void intel_p5_mcheck_init(struct cpuinfo_x86 *c)
- if (!cpu_has(c, X86_FEATURE_MCE))
- return;
-
-+ pax_open_kernel();
- machine_check_vector = pentium_machine_check;
-+ pax_close_kernel();
- /* Make sure the vector pointer is visible before we enable MCEs: */
- wmb();
-
-diff --git a/arch/x86/kernel/cpu/mcheck/winchip.c b/arch/x86/kernel/cpu/mcheck/winchip.c
-index 54060f5..c1a7577 100644
---- a/arch/x86/kernel/cpu/mcheck/winchip.c
-+++ b/arch/x86/kernel/cpu/mcheck/winchip.c
-@@ -11,6 +11,7 @@
- #include <asm/system.h>
- #include <asm/mce.h>
- #include <asm/msr.h>
-+#include <asm/pgtable.h>
-
- /* Machine check handler for WinChip C6: */
- static void winchip_machine_check(struct pt_regs *regs, long error_code)
-@@ -24,7 +25,9 @@ void winchip_mcheck_init(struct cpuinfo_x86 *c)
- {
- u32 lo, hi;
-
-+ pax_open_kernel();
- machine_check_vector = winchip_machine_check;
-+ pax_close_kernel();
- /* Make sure the vector pointer is visible before we enable MCEs: */
- wmb();
-
-diff --git a/arch/x86/kernel/cpu/mtrr/amd.c b/arch/x86/kernel/cpu/mtrr/amd.c
-index 33af141..92ba9cd 100644
---- a/arch/x86/kernel/cpu/mtrr/amd.c
-+++ b/arch/x86/kernel/cpu/mtrr/amd.c
-@@ -108,7 +108,7 @@ amd_validate_add_page(unsigned long base, unsigned long size, unsigned int type)
- return 0;
- }
-
--static struct mtrr_ops amd_mtrr_ops = {
-+static const struct mtrr_ops amd_mtrr_ops = {
- .vendor = X86_VENDOR_AMD,
- .set = amd_set_mtrr,
- .get = amd_get_mtrr,
-diff --git a/arch/x86/kernel/cpu/mtrr/centaur.c b/arch/x86/kernel/cpu/mtrr/centaur.c
-index de89f14..316fe3e 100644
---- a/arch/x86/kernel/cpu/mtrr/centaur.c
-+++ b/arch/x86/kernel/cpu/mtrr/centaur.c
-@@ -110,7 +110,7 @@ centaur_validate_add_page(unsigned long base, unsigned long size, unsigned int t
- return 0;
- }
-
--static struct mtrr_ops centaur_mtrr_ops = {
-+static const struct mtrr_ops centaur_mtrr_ops = {
- .vendor = X86_VENDOR_CENTAUR,
- .set = centaur_set_mcr,
- .get = centaur_get_mcr,
-diff --git a/arch/x86/kernel/cpu/mtrr/cyrix.c b/arch/x86/kernel/cpu/mtrr/cyrix.c
-index 228d982..68a3343 100644
---- a/arch/x86/kernel/cpu/mtrr/cyrix.c
-+++ b/arch/x86/kernel/cpu/mtrr/cyrix.c
-@@ -265,7 +265,7 @@ static void cyrix_set_all(void)
- post_set();
- }
-
--static struct mtrr_ops cyrix_mtrr_ops = {
-+static const struct mtrr_ops cyrix_mtrr_ops = {
- .vendor = X86_VENDOR_CYRIX,
- .set_all = cyrix_set_all,
- .set = cyrix_set_arr,
-diff --git a/arch/x86/kernel/cpu/mtrr/generic.c b/arch/x86/kernel/cpu/mtrr/generic.c
-index 55da0c5..4d75584 100644
---- a/arch/x86/kernel/cpu/mtrr/generic.c
-+++ b/arch/x86/kernel/cpu/mtrr/generic.c
-@@ -752,7 +752,7 @@ int positive_have_wrcomb(void)
- /*
- * Generic structure...
- */
--struct mtrr_ops generic_mtrr_ops = {
-+const struct mtrr_ops generic_mtrr_ops = {
- .use_intel_if = 1,
- .set_all = generic_set_all,
- .get = generic_get_mtrr,
-diff --git a/arch/x86/kernel/cpu/mtrr/main.c b/arch/x86/kernel/cpu/mtrr/main.c
-index fd60f09..c94ef52 100644
---- a/arch/x86/kernel/cpu/mtrr/main.c
-+++ b/arch/x86/kernel/cpu/mtrr/main.c
-@@ -60,14 +60,14 @@ static DEFINE_MUTEX(mtrr_mutex);
- u64 size_or_mask, size_and_mask;
- static bool mtrr_aps_delayed_init;
-
--static struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM];
-+static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM] __read_only;
-
--struct mtrr_ops *mtrr_if;
-+const struct mtrr_ops *mtrr_if;
-
- static void set_mtrr(unsigned int reg, unsigned long base,
- unsigned long size, mtrr_type type);
-
--void set_mtrr_ops(struct mtrr_ops *ops)
-+void set_mtrr_ops(const struct mtrr_ops *ops)
- {
- if (ops->vendor && ops->vendor < X86_VENDOR_NUM)
- mtrr_ops[ops->vendor] = ops;
-diff --git a/arch/x86/kernel/cpu/mtrr/mtrr.h b/arch/x86/kernel/cpu/mtrr/mtrr.h
-index a501dee..816c719 100644
---- a/arch/x86/kernel/cpu/mtrr/mtrr.h
-+++ b/arch/x86/kernel/cpu/mtrr/mtrr.h
-@@ -25,14 +25,14 @@ struct mtrr_ops {
- int (*validate_add_page)(unsigned long base, unsigned long size,
- unsigned int type);
- int (*have_wrcomb)(void);
--};
-+} __do_const;
-
- extern int generic_get_free_region(unsigned long base, unsigned long size,
- int replace_reg);
- extern int generic_validate_add_page(unsigned long base, unsigned long size,
- unsigned int type);
-
--extern struct mtrr_ops generic_mtrr_ops;
-+extern const struct mtrr_ops generic_mtrr_ops;
-
- extern int positive_have_wrcomb(void);
-
-@@ -53,10 +53,10 @@ void fill_mtrr_var_range(unsigned int index,
- u32 base_lo, u32 base_hi, u32 mask_lo, u32 mask_hi);
- void get_mtrr_state(void);
-
--extern void set_mtrr_ops(struct mtrr_ops *ops);
-+extern void set_mtrr_ops(const struct mtrr_ops *ops);
-
- extern u64 size_or_mask, size_and_mask;
--extern struct mtrr_ops *mtrr_if;
-+extern const struct mtrr_ops *mtrr_if;
-
- #define is_cpu(vnd) (mtrr_if && mtrr_if->vendor == X86_VENDOR_##vnd)
- #define use_intel() (mtrr_if && mtrr_if->use_intel_if == 1)
-diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
-index 0ff02ca..9994c9d 100644
---- a/arch/x86/kernel/cpu/perf_event.c
-+++ b/arch/x86/kernel/cpu/perf_event.c
-@@ -723,10 +723,10 @@ x86_perf_event_update(struct perf_event *event,
- * count to the generic event atomically:
- */
- again:
-- prev_raw_count = atomic64_read(&hwc->prev_count);
-+ prev_raw_count = atomic64_read_unchecked(&hwc->prev_count);
- rdmsrl(hwc->event_base + idx, new_raw_count);
-
-- if (atomic64_cmpxchg(&hwc->prev_count, prev_raw_count,
-+ if (atomic64_cmpxchg_unchecked(&hwc->prev_count, prev_raw_count,
- new_raw_count) != prev_raw_count)
- goto again;
-
-@@ -741,7 +741,7 @@ again:
- delta = (new_raw_count << shift) - (prev_raw_count << shift);
- delta >>= shift;
-
-- atomic64_add(delta, &event->count);
-+ atomic64_add_unchecked(delta, &event->count);
- atomic64_sub(delta, &hwc->period_left);
-
- return new_raw_count;
-@@ -1353,7 +1353,7 @@ x86_perf_event_set_period(struct perf_event *event,
- * The hw event starts counting from this event offset,
- * mark it to be able to extra future deltas:
- */
-- atomic64_set(&hwc->prev_count, (u64)-left);
-+ atomic64_set_unchecked(&hwc->prev_count, (u64)-left);
-
- err = checking_wrmsrl(hwc->event_base + idx,
- (u64)(-left) & x86_pmu.event_mask);
-@@ -1940,7 +1940,7 @@ perf_event_nmi_handler(struct notifier_block *self,
- return NOTIFY_STOP;
- }
-
--static __read_mostly struct notifier_block perf_event_nmi_notifier = {
-+static struct notifier_block perf_event_nmi_notifier = {
- .notifier_call = perf_event_nmi_handler,
- .next = NULL,
- .priority = 1
-@@ -2357,7 +2357,7 @@ perf_callchain_user(struct pt_regs *regs, struct perf_callchain_entry *entry)
- break;
-
- callchain_store(entry, frame.return_address);
-- fp = frame.next_frame;
-+ fp = (__force const void __user *)frame.next_frame;
- }
- }
-
-diff --git a/arch/x86/kernel/cpu/perfctr-watchdog.c b/arch/x86/kernel/cpu/perfctr-watchdog.c
-index 898df97..9e82503 100644
---- a/arch/x86/kernel/cpu/perfctr-watchdog.c
-+++ b/arch/x86/kernel/cpu/perfctr-watchdog.c
-@@ -30,11 +30,11 @@ struct nmi_watchdog_ctlblk {
-
- /* Interface defining a CPU specific perfctr watchdog */
- struct wd_ops {
-- int (*reserve)(void);
-- void (*unreserve)(void);
-- int (*setup)(unsigned nmi_hz);
-- void (*rearm)(struct nmi_watchdog_ctlblk *wd, unsigned nmi_hz);
-- void (*stop)(void);
-+ int (* const reserve)(void);
-+ void (* const unreserve)(void);
-+ int (* const setup)(unsigned nmi_hz);
-+ void (* const rearm)(struct nmi_watchdog_ctlblk *wd, unsigned nmi_hz);
-+ void (* const stop)(void);
- unsigned perfctr;
- unsigned evntsel;
- u64 checkbit;
-@@ -645,6 +645,7 @@ static const struct wd_ops p4_wd_ops = {
- #define ARCH_PERFMON_NMI_EVENT_SEL ARCH_PERFMON_UNHALTED_CORE_CYCLES_SEL
- #define ARCH_PERFMON_NMI_EVENT_UMASK ARCH_PERFMON_UNHALTED_CORE_CYCLES_UMASK
-
-+/* cannot be const */
- static struct wd_ops intel_arch_wd_ops;
-
- static int setup_intel_arch_watchdog(unsigned nmi_hz)
-@@ -697,6 +698,7 @@ static int setup_intel_arch_watchdog(unsigned nmi_hz)
- return 1;
- }
-
-+/* cannot be const */
- static struct wd_ops intel_arch_wd_ops __read_mostly = {
- .reserve = single_msr_reserve,
- .unreserve = single_msr_unreserve,
-diff --git a/arch/x86/kernel/cpu/vmware.c b/arch/x86/kernel/cpu/vmware.c
-index 9580152..bca82d1 100644
---- a/arch/x86/kernel/cpu/vmware.c
-+++ b/arch/x86/kernel/cpu/vmware.c
-@@ -79,7 +79,7 @@ void __init vmware_platform_setup(void)
- VMWARE_PORT(GETHZ, eax, ebx, ecx, edx);
-
- if (ebx != UINT_MAX)
-- x86_platform.calibrate_tsc = vmware_get_tsc_khz;
-+ *(void **)&x86_platform.calibrate_tsc = vmware_get_tsc_khz;
- else
- printk(KERN_WARNING
- "Failed to get TSC freq from the hypervisor\n");
-diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c
-index ff95824..2ffdcb5 100644
---- a/arch/x86/kernel/crash.c
-+++ b/arch/x86/kernel/crash.c
-@@ -41,7 +41,7 @@ static void kdump_nmi_callback(int cpu, struct die_args *args)
- regs = args->regs;
-
- #ifdef CONFIG_X86_32
-- if (!user_mode_vm(regs)) {
-+ if (!user_mode(regs)) {
- crash_fixup_ss_esp(&fixed_regs, regs);
- regs = &fixed_regs;
- }
-diff --git a/arch/x86/kernel/doublefault_32.c b/arch/x86/kernel/doublefault_32.c
-index 37250fe..bf2ec74 100644
---- a/arch/x86/kernel/doublefault_32.c
-+++ b/arch/x86/kernel/doublefault_32.c
-@@ -11,7 +11,7 @@
-
- #define DOUBLEFAULT_STACKSIZE (1024)
- static unsigned long doublefault_stack[DOUBLEFAULT_STACKSIZE];
--#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE)
-+#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE-2)
-
- #define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + MAXMEM)
-
-@@ -21,7 +21,7 @@ static void doublefault_fn(void)
- unsigned long gdt, tss;
-
- store_gdt(&gdt_desc);
-- gdt = gdt_desc.address;
-+ gdt = (unsigned long)gdt_desc.address;
-
- printk(KERN_EMERG "PANIC: double fault, gdt at %08lx [%d bytes]\n", gdt, gdt_desc.size);
-
-@@ -58,10 +58,10 @@ struct tss_struct doublefault_tss __cacheline_aligned = {
- /* 0x2 bit is always set */
- .flags = X86_EFLAGS_SF | 0x2,
- .sp = STACK_START,
-- .es = __USER_DS,
-+ .es = __KERNEL_DS,
- .cs = __KERNEL_CS,
- .ss = __KERNEL_DS,
-- .ds = __USER_DS,
-+ .ds = __KERNEL_DS,
- .fs = __KERNEL_PERCPU,
-
- .__cr3 = __pa_nodebug(swapper_pg_dir),
-diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c
-index 2d8a371..4fa6ae6 100644
---- a/arch/x86/kernel/dumpstack.c
-+++ b/arch/x86/kernel/dumpstack.c
-@@ -2,6 +2,9 @@
- * Copyright (C) 1991, 1992 Linus Torvalds
- * Copyright (C) 2000, 2001, 2002 Andi Kleen, SuSE Labs
- */
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+#define __INCLUDED_BY_HIDESYM 1
-+#endif
- #include <linux/kallsyms.h>
- #include <linux/kprobes.h>
- #include <linux/uaccess.h>
-@@ -28,7 +31,7 @@ static int die_counter;
-
- void printk_address(unsigned long address, int reliable)
- {
-- printk(" [<%p>] %s%pS\n", (void *) address,
-+ printk(" [<%p>] %s%pA\n", (void *) address,
- reliable ? "" : "? ", (void *) address);
- }
-
-@@ -36,9 +39,8 @@ void printk_address(unsigned long address, int reliable)
- static void
- print_ftrace_graph_addr(unsigned long addr, void *data,
- const struct stacktrace_ops *ops,
-- struct thread_info *tinfo, int *graph)
-+ struct task_struct *task, int *graph)
- {
-- struct task_struct *task = tinfo->task;
- unsigned long ret_addr;
- int index = task->curr_ret_stack;
-
-@@ -59,7 +61,7 @@ print_ftrace_graph_addr(unsigned long addr, void *data,
- static inline void
- print_ftrace_graph_addr(unsigned long addr, void *data,
- const struct stacktrace_ops *ops,
-- struct thread_info *tinfo, int *graph)
-+ struct task_struct *task, int *graph)
- { }
- #endif
-
-@@ -70,10 +72,8 @@ print_ftrace_graph_addr(unsigned long addr, void *data,
- * severe exception (double fault, nmi, stack fault, debug, mce) hardware stack
- */
-
--static inline int valid_stack_ptr(struct thread_info *tinfo,
-- void *p, unsigned int size, void *end)
-+static inline int valid_stack_ptr(void *t, void *p, unsigned int size, void *end)
- {
-- void *t = tinfo;
- if (end) {
- if (p < end && p >= (end-THREAD_SIZE))
- return 1;
-@@ -84,14 +84,14 @@ static inline int valid_stack_ptr(struct thread_info *tinfo,
- }
-
- unsigned long
--print_context_stack(struct thread_info *tinfo,
-+print_context_stack(struct task_struct *task, void *stack_start,
- unsigned long *stack, unsigned long bp,
- const struct stacktrace_ops *ops, void *data,
- unsigned long *end, int *graph)
- {
- struct stack_frame *frame = (struct stack_frame *)bp;
-
-- while (valid_stack_ptr(tinfo, stack, sizeof(*stack), end)) {
-+ while (valid_stack_ptr(stack_start, stack, sizeof(*stack), end)) {
- unsigned long addr;
-
- addr = *stack;
-@@ -103,7 +103,7 @@ print_context_stack(struct thread_info *tinfo,
- } else {
- ops->address(data, addr, 0);
- }
-- print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
-+ print_ftrace_graph_addr(addr, data, ops, task, graph);
- }
- stack++;
- }
-@@ -180,7 +180,7 @@ void dump_stack(void)
- #endif
-
- printk("Pid: %d, comm: %.20s %s %s %.*s\n",
-- current->pid, current->comm, print_tainted(),
-+ task_pid_nr(current), current->comm, print_tainted(),
- init_utsname()->release,
- (int)strcspn(init_utsname()->version, " "),
- init_utsname()->version);
-@@ -220,6 +220,8 @@ unsigned __kprobes long oops_begin(void)
- return flags;
- }
-
-+extern void gr_handle_kernel_exploit(void);
-+
- void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr)
- {
- if (regs && kexec_should_crash(current))
-@@ -241,7 +243,10 @@ void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr)
- panic("Fatal exception in interrupt");
- if (panic_on_oops)
- panic("Fatal exception");
-- do_exit(signr);
-+
-+ gr_handle_kernel_exploit();
-+
-+ do_group_exit(signr);
- }
-
- int __kprobes __die(const char *str, struct pt_regs *regs, long err)
-@@ -295,7 +300,7 @@ void die(const char *str, struct pt_regs *regs, long err)
- unsigned long flags = oops_begin();
- int sig = SIGSEGV;
-
-- if (!user_mode_vm(regs))
-+ if (!user_mode(regs))
- report_bug(regs->ip, regs);
-
- if (__die(str, regs, err))
-diff --git a/arch/x86/kernel/dumpstack.h b/arch/x86/kernel/dumpstack.h
-index 81086c2..13e8b17 100644
---- a/arch/x86/kernel/dumpstack.h
-+++ b/arch/x86/kernel/dumpstack.h
-@@ -15,7 +15,7 @@
- #endif
-
- extern unsigned long
--print_context_stack(struct thread_info *tinfo,
-+print_context_stack(struct task_struct *task, void *stack_start,
- unsigned long *stack, unsigned long bp,
- const struct stacktrace_ops *ops, void *data,
- unsigned long *end, int *graph);
-diff --git a/arch/x86/kernel/dumpstack_32.c b/arch/x86/kernel/dumpstack_32.c
-index f7dd2a7..c7b8ce6 100644
---- a/arch/x86/kernel/dumpstack_32.c
-+++ b/arch/x86/kernel/dumpstack_32.c
-@@ -53,16 +53,12 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
- #endif
-
- for (;;) {
-- struct thread_info *context;
-+ void *stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
-+ bp = print_context_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
-
-- context = (struct thread_info *)
-- ((unsigned long)stack & (~(THREAD_SIZE - 1)));
-- bp = print_context_stack(context, stack, bp, ops,
-- data, NULL, &graph);
--
-- stack = (unsigned long *)context->previous_esp;
-- if (!stack)
-+ if (stack_start == task_stack_page(task))
- break;
-+ stack = *(unsigned long **)stack_start;
- if (ops->stack(data, "IRQ") < 0)
- break;
- touch_nmi_watchdog();
-@@ -112,11 +108,12 @@ void show_registers(struct pt_regs *regs)
- * When in-kernel, we also print out the stack and code at the
- * time of the fault..
- */
-- if (!user_mode_vm(regs)) {
-+ if (!user_mode(regs)) {
- unsigned int code_prologue = code_bytes * 43 / 64;
- unsigned int code_len = code_bytes;
- unsigned char c;
- u8 *ip;
-+ unsigned long cs_base = get_desc_base(&get_cpu_gdt_table(0)[(0xffff & regs->cs) >> 3]);
-
- printk(KERN_EMERG "Stack:\n");
- show_stack_log_lvl(NULL, regs, ®s->sp,
-@@ -124,10 +121,10 @@ void show_registers(struct pt_regs *regs)
-
- printk(KERN_EMERG "Code: ");
-
-- ip = (u8 *)regs->ip - code_prologue;
-+ ip = (u8 *)regs->ip - code_prologue + cs_base;
- if (ip < (u8 *)PAGE_OFFSET || probe_kernel_address(ip, c)) {
- /* try starting at IP */
-- ip = (u8 *)regs->ip;
-+ ip = (u8 *)regs->ip + cs_base;
- code_len = code_len - code_prologue + 1;
- }
- for (i = 0; i < code_len; i++, ip++) {
-@@ -136,7 +133,7 @@ void show_registers(struct pt_regs *regs)
- printk(" Bad EIP value.");
- break;
- }
-- if (ip == (u8 *)regs->ip)
-+ if (ip == (u8 *)regs->ip + cs_base)
- printk("<%02x> ", c);
- else
- printk("%02x ", c);
-@@ -145,10 +142,23 @@ void show_registers(struct pt_regs *regs)
- printk("\n");
- }
-
-+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
-+void pax_check_alloca(unsigned long size)
-+{
-+ unsigned long sp = (unsigned long)&sp, stack_left;
-+
-+ /* all kernel stacks are of the same size */
-+ stack_left = sp & (THREAD_SIZE - 1);
-+ BUG_ON(stack_left < 256 || size >= stack_left - 256);
-+}
-+EXPORT_SYMBOL(pax_check_alloca);
-+#endif
-+
- int is_valid_bugaddr(unsigned long ip)
- {
- unsigned short ud2;
-
-+ ip = ktla_ktva(ip);
- if (ip < PAGE_OFFSET)
- return 0;
- if (probe_kernel_address((unsigned short *)ip, ud2))
-diff --git a/arch/x86/kernel/dumpstack_64.c b/arch/x86/kernel/dumpstack_64.c
-index a071e6b..1ad66d7 100644
---- a/arch/x86/kernel/dumpstack_64.c
-+++ b/arch/x86/kernel/dumpstack_64.c
-@@ -116,8 +116,8 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
- unsigned long *irq_stack_end =
- (unsigned long *)per_cpu(irq_stack_ptr, cpu);
- unsigned used = 0;
-- struct thread_info *tinfo;
- int graph = 0;
-+ void *stack_start;
-
- if (!task)
- task = current;
-@@ -146,10 +146,10 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
- * current stack address. If the stacks consist of nested
- * exceptions
- */
-- tinfo = task_thread_info(task);
- for (;;) {
- char *id;
- unsigned long *estack_end;
-+
- estack_end = in_exception_stack(cpu, (unsigned long)stack,
- &used, &id);
-
-@@ -157,7 +157,7 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
- if (ops->stack(data, id) < 0)
- break;
-
-- bp = print_context_stack(tinfo, stack, bp, ops,
-+ bp = print_context_stack(task, estack_end - EXCEPTION_STKSZ, stack, bp, ops,
- data, estack_end, &graph);
- ops->stack(data, "<EOE>");
- /*
-@@ -165,6 +165,8 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
- * second-to-last pointer (index -2 to end) in the
- * exception stack:
- */
-+ if ((u16)estack_end[-1] != __KERNEL_DS)
-+ goto out;
- stack = (unsigned long *) estack_end[-2];
- continue;
- }
-@@ -176,7 +178,7 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
- if (stack >= irq_stack && stack < irq_stack_end) {
- if (ops->stack(data, "IRQ") < 0)
- break;
-- bp = print_context_stack(tinfo, stack, bp,
-+ bp = print_context_stack(task, irq_stack, stack, bp,
- ops, data, irq_stack_end, &graph);
- /*
- * We link to the next stack (which would be
-@@ -195,7 +197,9 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
- /*
- * This handles the process stack:
- */
-- bp = print_context_stack(tinfo, stack, bp, ops, data, NULL, &graph);
-+ stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
-+ bp = print_context_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
-+out:
- put_cpu();
- }
- EXPORT_SYMBOL(dump_trace);
-@@ -248,7 +252,7 @@ void show_registers(struct pt_regs *regs)
- {
- int i;
- unsigned long sp;
-- const int cpu = smp_processor_id();
-+ const int cpu = raw_smp_processor_id();
- struct task_struct *cur = current;
-
- sp = regs->sp;
-@@ -304,3 +308,50 @@ int is_valid_bugaddr(unsigned long ip)
- return ud2 == 0x0b0f;
- }
-
-+
-+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
-+void pax_check_alloca(unsigned long size)
-+{
-+ unsigned long sp = (unsigned long)&sp, stack_start, stack_end;
-+ unsigned cpu, used;
-+ char *id;
-+
-+ /* check the process stack first */
-+ stack_start = (unsigned long)task_stack_page(current);
-+ stack_end = stack_start + THREAD_SIZE;
-+ if (likely(stack_start <= sp && sp < stack_end)) {
-+ unsigned long stack_left = sp & (THREAD_SIZE - 1);
-+ BUG_ON(stack_left < 256 || size >= stack_left - 256);
-+ return;
-+ }
-+
-+ cpu = get_cpu();
-+
-+ /* check the irq stacks */
-+ stack_end = (unsigned long)per_cpu(irq_stack_ptr, cpu);
-+ stack_start = stack_end - IRQ_STACK_SIZE;
-+ if (stack_start <= sp && sp < stack_end) {
-+ unsigned long stack_left = sp & (IRQ_STACK_SIZE - 1);
-+ put_cpu();
-+ BUG_ON(stack_left < 256 || size >= stack_left - 256);
-+ return;
-+ }
-+
-+ /* check the exception stacks */
-+ used = 0;
-+ stack_end = (unsigned long)in_exception_stack(cpu, sp, &used, &id);
-+ stack_start = stack_end - EXCEPTION_STKSZ;
-+ if (stack_end && stack_start <= sp && sp < stack_end) {
-+ unsigned long stack_left = sp & (EXCEPTION_STKSZ - 1);
-+ put_cpu();
-+ BUG_ON(stack_left < 256 || size >= stack_left - 256);
-+ return;
-+ }
-+
-+ put_cpu();
-+
-+ /* unknown stack */
-+ BUG();
-+}
-+EXPORT_SYMBOL(pax_check_alloca);
-+#endif
-diff --git a/arch/x86/kernel/e820.c b/arch/x86/kernel/e820.c
-index a89739a..95e0c48 100644
---- a/arch/x86/kernel/e820.c
-+++ b/arch/x86/kernel/e820.c
-@@ -733,7 +733,7 @@ struct early_res {
- };
- static struct early_res early_res[MAX_EARLY_RES] __initdata = {
- { 0, PAGE_SIZE, "BIOS data page" }, /* BIOS data page */
-- {}
-+ { 0, 0, {0}, 0 }
- };
-
- static int __init find_overlapped_early(u64 start, u64 end)
-diff --git a/arch/x86/kernel/early_printk.c b/arch/x86/kernel/early_printk.c
-index b9c830c..1e41a96 100644
---- a/arch/x86/kernel/early_printk.c
-+++ b/arch/x86/kernel/early_printk.c
-@@ -7,6 +7,7 @@
- #include <linux/pci_regs.h>
- #include <linux/pci_ids.h>
- #include <linux/errno.h>
-+#include <linux/sched.h>
- #include <asm/io.h>
- #include <asm/processor.h>
- #include <asm/fcntl.h>
-@@ -170,6 +171,8 @@ asmlinkage void early_printk(const char *fmt, ...)
- int n;
- va_list ap;
-
-+ pax_track_stack();
-+
- va_start(ap, fmt);
- n = vscnprintf(buf, sizeof(buf), fmt, ap);
- early_console->write(early_console, buf, n);
-diff --git a/arch/x86/kernel/efi.c b/arch/x86/kernel/efi.c
-index cdcfb12..15589d9 100644
---- a/arch/x86/kernel/efi.c
-+++ b/arch/x86/kernel/efi.c
-@@ -455,8 +455,8 @@ void __init efi_init(void)
- do_add_efi_memmap();
-
- #ifdef CONFIG_X86_32
-- x86_platform.get_wallclock = efi_get_time;
-- x86_platform.set_wallclock = efi_set_rtc_mmss;
-+ *(void **)&x86_platform.get_wallclock = efi_get_time;
-+ *(void **)&x86_platform.set_wallclock = efi_set_rtc_mmss;
- #endif
-
- /* Setup for EFI runtime service */
-diff --git a/arch/x86/kernel/efi_32.c b/arch/x86/kernel/efi_32.c
-index 5cab48e..b025f9b 100644
---- a/arch/x86/kernel/efi_32.c
-+++ b/arch/x86/kernel/efi_32.c
-@@ -38,70 +38,56 @@
- */
-
- static unsigned long efi_rt_eflags;
--static pgd_t efi_bak_pg_dir_pointer[2];
-+static pgd_t __initdata efi_bak_pg_dir_pointer[KERNEL_PGD_PTRS];
-
--void efi_call_phys_prelog(void)
-+void __init efi_call_phys_prelog(void)
- {
-- unsigned long cr4;
-- unsigned long temp;
- struct desc_ptr gdt_descr;
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+ struct desc_struct d;
-+#endif
-+
- local_irq_save(efi_rt_eflags);
-
-- /*
-- * If I don't have PAE, I should just duplicate two entries in page
-- * directory. If I have PAE, I just need to duplicate one entry in
-- * page directory.
-- */
-- cr4 = read_cr4_safe();
--
-- if (cr4 & X86_CR4_PAE) {
-- efi_bak_pg_dir_pointer[0].pgd =
-- swapper_pg_dir[pgd_index(0)].pgd;
-- swapper_pg_dir[0].pgd =
-- swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
-- } else {
-- efi_bak_pg_dir_pointer[0].pgd =
-- swapper_pg_dir[pgd_index(0)].pgd;
-- efi_bak_pg_dir_pointer[1].pgd =
-- swapper_pg_dir[pgd_index(0x400000)].pgd;
-- swapper_pg_dir[pgd_index(0)].pgd =
-- swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
-- temp = PAGE_OFFSET + 0x400000;
-- swapper_pg_dir[pgd_index(0x400000)].pgd =
-- swapper_pg_dir[pgd_index(temp)].pgd;
-- }
-+ clone_pgd_range(efi_bak_pg_dir_pointer, swapper_pg_dir, KERNEL_PGD_PTRS);
-+ clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-+ min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
-
- /*
- * After the lock is released, the original page table is restored.
- */
- __flush_tlb_all();
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+ pack_descriptor(&d, 0, 0xFFFFF, 0x9B, 0xC);
-+ write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_CS, &d, DESCTYPE_S);
-+ pack_descriptor(&d, 0, 0xFFFFF, 0x93, 0xC);
-+ write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_DS, &d, DESCTYPE_S);
-+#endif
-+
- gdt_descr.address = __pa(get_cpu_gdt_table(0));
- gdt_descr.size = GDT_SIZE - 1;
- load_gdt(&gdt_descr);
- }
-
--void efi_call_phys_epilog(void)
-+void __init efi_call_phys_epilog(void)
- {
-- unsigned long cr4;
- struct desc_ptr gdt_descr;
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+ struct desc_struct d;
-+
-+ memset(&d, 0, sizeof d);
-+ write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_CS, &d, DESCTYPE_S);
-+ write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_DS, &d, DESCTYPE_S);
-+#endif
-+
- gdt_descr.address = (unsigned long)get_cpu_gdt_table(0);
- gdt_descr.size = GDT_SIZE - 1;
- load_gdt(&gdt_descr);
-
-- cr4 = read_cr4_safe();
--
-- if (cr4 & X86_CR4_PAE) {
-- swapper_pg_dir[pgd_index(0)].pgd =
-- efi_bak_pg_dir_pointer[0].pgd;
-- } else {
-- swapper_pg_dir[pgd_index(0)].pgd =
-- efi_bak_pg_dir_pointer[0].pgd;
-- swapper_pg_dir[pgd_index(0x400000)].pgd =
-- efi_bak_pg_dir_pointer[1].pgd;
-- }
-+ clone_pgd_range(swapper_pg_dir, efi_bak_pg_dir_pointer, KERNEL_PGD_PTRS);
-
- /*
- * After the lock is released, the original page table is restored.
-diff --git a/arch/x86/kernel/efi_stub_32.S b/arch/x86/kernel/efi_stub_32.S
-index fbe66e6..eae5e38 100644
---- a/arch/x86/kernel/efi_stub_32.S
-+++ b/arch/x86/kernel/efi_stub_32.S
-@@ -6,7 +6,9 @@
- */
-
- #include <linux/linkage.h>
-+#include <linux/init.h>
- #include <asm/page_types.h>
-+#include <asm/segment.h>
-
- /*
- * efi_call_phys(void *, ...) is a function with variable parameters.
-@@ -20,7 +22,7 @@
- * service functions will comply with gcc calling convention, too.
- */
-
--.text
-+__INIT
- ENTRY(efi_call_phys)
- /*
- * 0. The function can only be called in Linux kernel. So CS has been
-@@ -36,10 +38,24 @@ ENTRY(efi_call_phys)
- * The mapping of lower virtual memory has been created in prelog and
- * epilog.
- */
-- movl $1f, %edx
-- subl $__PAGE_OFFSET, %edx
-- jmp *%edx
-+#ifdef CONFIG_PAX_KERNEXEC
-+ movl $(__KERNEXEC_EFI_DS), %edx
-+ mov %edx, %ds
-+ mov %edx, %es
-+ mov %edx, %ss
-+ addl $2f,(1f)
-+ ljmp *(1f)
-+
-+__INITDATA
-+1: .long __LOAD_PHYSICAL_ADDR, __KERNEXEC_EFI_CS
-+.previous
-+
-+2:
-+ subl $2b,(1b)
-+#else
-+ jmp 1f-__PAGE_OFFSET
- 1:
-+#endif
-
- /*
- * 2. Now on the top of stack is the return
-@@ -47,14 +63,8 @@ ENTRY(efi_call_phys)
- * parameter 2, ..., param n. To make things easy, we save the return
- * address of efi_call_phys in a global variable.
- */
-- popl %edx
-- movl %edx, saved_return_addr
-- /* get the function pointer into ECX*/
-- popl %ecx
-- movl %ecx, efi_rt_function_ptr
-- movl $2f, %edx
-- subl $__PAGE_OFFSET, %edx
-- pushl %edx
-+ popl (saved_return_addr)
-+ popl (efi_rt_function_ptr)
-
- /*
- * 3. Clear PG bit in %CR0.
-@@ -73,9 +83,8 @@ ENTRY(efi_call_phys)
- /*
- * 5. Call the physical function.
- */
-- jmp *%ecx
-+ call *(efi_rt_function_ptr-__PAGE_OFFSET)
-
--2:
- /*
- * 6. After EFI runtime service returns, control will return to
- * following instruction. We'd better readjust stack pointer first.
-@@ -88,35 +97,36 @@ ENTRY(efi_call_phys)
- movl %cr0, %edx
- orl $0x80000000, %edx
- movl %edx, %cr0
-- jmp 1f
--1:
-+
- /*
- * 8. Now restore the virtual mode from flat mode by
- * adding EIP with PAGE_OFFSET.
- */
-- movl $1f, %edx
-- jmp *%edx
-+#ifdef CONFIG_PAX_KERNEXEC
-+ movl $(__KERNEL_DS), %edx
-+ mov %edx, %ds
-+ mov %edx, %es
-+ mov %edx, %ss
-+ ljmp $(__KERNEL_CS),$1f
-+#else
-+ jmp 1f+__PAGE_OFFSET
-+#endif
- 1:
-
- /*
- * 9. Balance the stack. And because EAX contain the return value,
- * we'd better not clobber it.
- */
-- leal efi_rt_function_ptr, %edx
-- movl (%edx), %ecx
-- pushl %ecx
-+ pushl (efi_rt_function_ptr)
-
- /*
-- * 10. Push the saved return address onto the stack and return.
-+ * 10. Return to the saved return address.
- */
-- leal saved_return_addr, %edx
-- movl (%edx), %ecx
-- pushl %ecx
-- ret
-+ jmpl *(saved_return_addr)
- ENDPROC(efi_call_phys)
- .previous
-
--.data
-+__INITDATA
- saved_return_addr:
- .long 0
- efi_rt_function_ptr:
-diff --git a/arch/x86/kernel/efi_stub_64.S b/arch/x86/kernel/efi_stub_64.S
-index 4c07cca..2c8427d 100644
---- a/arch/x86/kernel/efi_stub_64.S
-+++ b/arch/x86/kernel/efi_stub_64.S
-@@ -7,6 +7,7 @@
- */
-
- #include <linux/linkage.h>
-+#include <asm/alternative-asm.h>
-
- #define SAVE_XMM \
- mov %rsp, %rax; \
-@@ -40,6 +41,7 @@ ENTRY(efi_call0)
- call *%rdi
- addq $32, %rsp
- RESTORE_XMM
-+ pax_force_retaddr 0, 1
- ret
- ENDPROC(efi_call0)
-
-@@ -50,6 +52,7 @@ ENTRY(efi_call1)
- call *%rdi
- addq $32, %rsp
- RESTORE_XMM
-+ pax_force_retaddr 0, 1
- ret
- ENDPROC(efi_call1)
-
-@@ -60,6 +63,7 @@ ENTRY(efi_call2)
- call *%rdi
- addq $32, %rsp
- RESTORE_XMM
-+ pax_force_retaddr 0, 1
- ret
- ENDPROC(efi_call2)
-
-@@ -71,6 +75,7 @@ ENTRY(efi_call3)
- call *%rdi
- addq $32, %rsp
- RESTORE_XMM
-+ pax_force_retaddr 0, 1
- ret
- ENDPROC(efi_call3)
-
-@@ -83,6 +88,7 @@ ENTRY(efi_call4)
- call *%rdi
- addq $32, %rsp
- RESTORE_XMM
-+ pax_force_retaddr 0, 1
- ret
- ENDPROC(efi_call4)
-
-@@ -96,6 +102,7 @@ ENTRY(efi_call5)
- call *%rdi
- addq $48, %rsp
- RESTORE_XMM
-+ pax_force_retaddr 0, 1
- ret
- ENDPROC(efi_call5)
-
-@@ -112,5 +119,6 @@ ENTRY(efi_call6)
- call *%rdi
- addq $48, %rsp
- RESTORE_XMM
-+ pax_force_retaddr 0, 1
- ret
- ENDPROC(efi_call6)
-diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
-index c097e7d..a3f1930 100644
---- a/arch/x86/kernel/entry_32.S
-+++ b/arch/x86/kernel/entry_32.S
-@@ -95,12 +95,6 @@
- #endif
- .endm
-
--#ifdef CONFIG_VM86
--#define resume_userspace_sig check_userspace
--#else
--#define resume_userspace_sig resume_userspace
--#endif
--
- /*
- * User gs save/restore
- *
-@@ -185,13 +179,153 @@
- /*CFI_REL_OFFSET gs, PT_GS*/
- .endm
- .macro SET_KERNEL_GS reg
-+
-+#ifdef CONFIG_CC_STACKPROTECTOR
- movl $(__KERNEL_STACK_CANARY), \reg
-+#elif defined(CONFIG_PAX_MEMORY_UDEREF)
-+ movl $(__USER_DS), \reg
-+#else
-+ xorl \reg, \reg
-+#endif
-+
- movl \reg, %gs
- .endm
-
- #endif /* CONFIG_X86_32_LAZY_GS */
-
--.macro SAVE_ALL
-+.macro pax_enter_kernel
-+#ifdef CONFIG_PAX_KERNEXEC
-+ call pax_enter_kernel
-+#endif
-+.endm
-+
-+.macro pax_exit_kernel
-+#ifdef CONFIG_PAX_KERNEXEC
-+ call pax_exit_kernel
-+#endif
-+.endm
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ENTRY(pax_enter_kernel)
-+#ifdef CONFIG_PARAVIRT
-+ pushl %eax
-+ pushl %ecx
-+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0)
-+ mov %eax, %esi
-+#else
-+ mov %cr0, %esi
-+#endif
-+ bts $16, %esi
-+ jnc 1f
-+ mov %cs, %esi
-+ cmp $__KERNEL_CS, %esi
-+ jz 3f
-+ ljmp $__KERNEL_CS, $3f
-+1: ljmp $__KERNEXEC_KERNEL_CS, $2f
-+2:
-+#ifdef CONFIG_PARAVIRT
-+ mov %esi, %eax
-+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
-+#else
-+ mov %esi, %cr0
-+#endif
-+3:
-+#ifdef CONFIG_PARAVIRT
-+ popl %ecx
-+ popl %eax
-+#endif
-+ ret
-+ENDPROC(pax_enter_kernel)
-+
-+ENTRY(pax_exit_kernel)
-+#ifdef CONFIG_PARAVIRT
-+ pushl %eax
-+ pushl %ecx
-+#endif
-+ mov %cs, %esi
-+ cmp $__KERNEXEC_KERNEL_CS, %esi
-+ jnz 2f
-+#ifdef CONFIG_PARAVIRT
-+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);
-+ mov %eax, %esi
-+#else
-+ mov %cr0, %esi
-+#endif
-+ btr $16, %esi
-+ ljmp $__KERNEL_CS, $1f
-+1:
-+#ifdef CONFIG_PARAVIRT
-+ mov %esi, %eax
-+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0);
-+#else
-+ mov %esi, %cr0
-+#endif
-+2:
-+#ifdef CONFIG_PARAVIRT
-+ popl %ecx
-+ popl %eax
-+#endif
-+ ret
-+ENDPROC(pax_exit_kernel)
-+#endif
-+
-+.macro pax_erase_kstack
-+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
-+ call pax_erase_kstack
-+#endif
-+.endm
-+
-+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
-+/*
-+ * ebp: thread_info
-+ */
-+ENTRY(pax_erase_kstack)
-+ pushl %edi
-+ pushl %ecx
-+ pushl %eax
-+
-+ mov TI_lowest_stack(%ebp), %edi
-+ mov $-0xBEEF, %eax
-+ std
-+
-+1: mov %edi, %ecx
-+ and $THREAD_SIZE_asm - 1, %ecx
-+ shr $2, %ecx
-+ repne scasl
-+ jecxz 2f
-+
-+ cmp $2*16, %ecx
-+ jc 2f
-+
-+ mov $2*16, %ecx
-+ repe scasl
-+ jecxz 2f
-+ jne 1b
-+
-+2: cld
-+ mov %esp, %ecx
-+ sub %edi, %ecx
-+
-+ cmp $THREAD_SIZE_asm, %ecx
-+ jb 3f
-+ ud2
-+3:
-+
-+ shr $2, %ecx
-+ rep stosl
-+
-+ mov TI_task_thread_sp0(%ebp), %edi
-+ sub $128, %edi
-+ mov %edi, TI_lowest_stack(%ebp)
-+
-+ popl %eax
-+ popl %ecx
-+ popl %edi
-+ ret
-+ENDPROC(pax_erase_kstack)
-+#endif
-+
-+.macro __SAVE_ALL _DS
- cld
- PUSH_GS
- pushl %fs
-@@ -224,7 +358,7 @@
- pushl %ebx
- CFI_ADJUST_CFA_OFFSET 4
- CFI_REL_OFFSET ebx, 0
-- movl $(__USER_DS), %edx
-+ movl $\_DS, %edx
- movl %edx, %ds
- movl %edx, %es
- movl $(__KERNEL_PERCPU), %edx
-@@ -232,6 +366,15 @@
- SET_KERNEL_GS %edx
- .endm
-
-+.macro SAVE_ALL
-+#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
-+ __SAVE_ALL __KERNEL_DS
-+ pax_enter_kernel
-+#else
-+ __SAVE_ALL __USER_DS
-+#endif
-+.endm
-+
- .macro RESTORE_INT_REGS
- popl %ebx
- CFI_ADJUST_CFA_OFFSET -4
-@@ -331,7 +474,7 @@ ENTRY(ret_from_fork)
- CFI_ADJUST_CFA_OFFSET -4
- jmp syscall_exit
- CFI_ENDPROC
--END(ret_from_fork)
-+ENDPROC(ret_from_fork)
-
- /*
- * Return to user mode is not as complex as all this looks,
-@@ -347,12 +490,29 @@ ret_from_exception:
- preempt_stop(CLBR_ANY)
- ret_from_intr:
- GET_THREAD_INFO(%ebp)
--check_userspace:
-+resume_userspace_sig:
-+#ifdef CONFIG_VM86
- movl PT_EFLAGS(%esp), %eax # mix EFLAGS and CS
- movb PT_CS(%esp), %al
- andl $(X86_EFLAGS_VM | SEGMENT_RPL_MASK), %eax
-+#else
-+ /*
-+ * We can be coming here from a syscall done in the kernel space,
-+ * e.g. a failed kernel_execve().
-+ */
-+ movl PT_CS(%esp), %eax
-+ andl $SEGMENT_RPL_MASK, %eax
-+#endif
- cmpl $USER_RPL, %eax
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ jae resume_userspace
-+
-+ pax_exit_kernel
-+ jmp resume_kernel
-+#else
- jb resume_kernel # not returning to v8086 or userspace
-+#endif
-
- ENTRY(resume_userspace)
- LOCKDEP_SYS_EXIT
-@@ -364,8 +524,8 @@ ENTRY(resume_userspace)
- andl $_TIF_WORK_MASK, %ecx # is there any work to be done on
- # int/exception return?
- jne work_pending
-- jmp restore_all
--END(ret_from_exception)
-+ jmp restore_all_pax
-+ENDPROC(ret_from_exception)
-
- #ifdef CONFIG_PREEMPT
- ENTRY(resume_kernel)
-@@ -380,7 +540,7 @@ need_resched:
- jz restore_all
- call preempt_schedule_irq
- jmp need_resched
--END(resume_kernel)
-+ENDPROC(resume_kernel)
- #endif
- CFI_ENDPROC
-
-@@ -414,25 +574,36 @@ sysenter_past_esp:
- /*CFI_REL_OFFSET cs, 0*/
- /*
- * Push current_thread_info()->sysenter_return to the stack.
-- * A tiny bit of offset fixup is necessary - 4*4 means the 4 words
-- * pushed above; +8 corresponds to copy_thread's esp0 setting.
- */
-- pushl (TI_sysenter_return-THREAD_SIZE+8+4*4)(%esp)
-+ pushl $0
- CFI_ADJUST_CFA_OFFSET 4
- CFI_REL_OFFSET eip, 0
-
- pushl %eax
- CFI_ADJUST_CFA_OFFSET 4
- SAVE_ALL
-+ GET_THREAD_INFO(%ebp)
-+ movl TI_sysenter_return(%ebp),%ebp
-+ movl %ebp,PT_EIP(%esp)
- ENABLE_INTERRUPTS(CLBR_NONE)
-
- /*
- * Load the potential sixth argument from user stack.
- * Careful about security.
- */
-+ movl PT_OLDESP(%esp),%ebp
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ mov PT_OLDSS(%esp),%ds
-+1: movl %ds:(%ebp),%ebp
-+ push %ss
-+ pop %ds
-+#else
- cmpl $__PAGE_OFFSET-3,%ebp
- jae syscall_fault
- 1: movl (%ebp),%ebp
-+#endif
-+
- movl %ebp,PT_EBP(%esp)
- .section __ex_table,"a"
- .align 4
-@@ -441,6 +612,10 @@ sysenter_past_esp:
-
- GET_THREAD_INFO(%ebp)
-
-+#ifdef CONFIG_PAX_RANDKSTACK
-+ pax_erase_kstack
-+#endif
-+
- testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%ebp)
- jnz sysenter_audit
- sysenter_do_call:
-@@ -455,12 +630,24 @@ sysenter_do_call:
- testl $_TIF_ALLWORK_MASK, %ecx
- jne sysexit_audit
- sysenter_exit:
-+
-+#ifdef CONFIG_PAX_RANDKSTACK
-+ pushl_cfi %eax
-+ movl %esp, %eax
-+ call pax_randomize_kstack
-+ popl_cfi %eax
-+#endif
-+
-+ pax_erase_kstack
-+
- /* if something modifies registers it must also disable sysexit */
- movl PT_EIP(%esp), %edx
- movl PT_OLDESP(%esp), %ecx
- xorl %ebp,%ebp
- TRACE_IRQS_ON
- 1: mov PT_FS(%esp), %fs
-+2: mov PT_DS(%esp), %ds
-+3: mov PT_ES(%esp), %es
- PTGS_TO_GS
- ENABLE_INTERRUPTS_SYSEXIT
-
-@@ -477,6 +664,9 @@ sysenter_audit:
- movl %eax,%edx /* 2nd arg: syscall number */
- movl $AUDIT_ARCH_I386,%eax /* 1st arg: audit arch */
- call audit_syscall_entry
-+
-+ pax_erase_kstack
-+
- pushl %ebx
- CFI_ADJUST_CFA_OFFSET 4
- movl PT_EAX(%esp),%eax /* reload syscall number */
-@@ -504,11 +694,17 @@ sysexit_audit:
-
- CFI_ENDPROC
- .pushsection .fixup,"ax"
--2: movl $0,PT_FS(%esp)
-+4: movl $0,PT_FS(%esp)
-+ jmp 1b
-+5: movl $0,PT_DS(%esp)
-+ jmp 1b
-+6: movl $0,PT_ES(%esp)
- jmp 1b
- .section __ex_table,"a"
- .align 4
-- .long 1b,2b
-+ .long 1b,4b
-+ .long 2b,5b
-+ .long 3b,6b
- .popsection
- PTGS_TO_GS_EX
- ENDPROC(ia32_sysenter_target)
-@@ -520,6 +716,11 @@ ENTRY(system_call)
- CFI_ADJUST_CFA_OFFSET 4
- SAVE_ALL
- GET_THREAD_INFO(%ebp)
-+
-+#ifdef CONFIG_PAX_RANDKSTACK
-+ pax_erase_kstack
-+#endif
-+
- # system call tracing in operation / emulation
- testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%ebp)
- jnz syscall_trace_entry
-@@ -538,6 +739,15 @@ syscall_exit:
- testl $_TIF_ALLWORK_MASK, %ecx # current->work
- jne syscall_exit_work
-
-+restore_all_pax:
-+
-+#ifdef CONFIG_PAX_RANDKSTACK
-+ movl %esp, %eax
-+ call pax_randomize_kstack
-+#endif
-+
-+ pax_erase_kstack
-+
- restore_all:
- TRACE_IRQS_IRET
- restore_all_notrace:
-@@ -602,10 +812,29 @@ ldt_ss:
- mov PT_OLDESP(%esp), %eax /* load userspace esp */
- mov %dx, %ax /* eax: new kernel esp */
- sub %eax, %edx /* offset (low word is 0) */
-- PER_CPU(gdt_page, %ebx)
-+#ifdef CONFIG_SMP
-+ movl PER_CPU_VAR(cpu_number), %ebx
-+ shll $PAGE_SHIFT_asm, %ebx
-+ addl $cpu_gdt_table, %ebx
-+#else
-+ movl $cpu_gdt_table, %ebx
-+#endif
- shr $16, %edx
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ mov %cr0, %esi
-+ btr $16, %esi
-+ mov %esi, %cr0
-+#endif
-+
- mov %dl, GDT_ENTRY_ESPFIX_SS * 8 + 4(%ebx) /* bits 16..23 */
- mov %dh, GDT_ENTRY_ESPFIX_SS * 8 + 7(%ebx) /* bits 24..31 */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ bts $16, %esi
-+ mov %esi, %cr0
-+#endif
-+
- pushl $__ESPFIX_SS
- CFI_ADJUST_CFA_OFFSET 4
- push %eax /* new kernel esp */
-@@ -636,36 +865,30 @@ work_resched:
- movl TI_flags(%ebp), %ecx
- andl $_TIF_WORK_MASK, %ecx # is there any work to be done other
- # than syscall tracing?
-- jz restore_all
-+ jz restore_all_pax
- testb $_TIF_NEED_RESCHED, %cl
- jnz work_resched
-
- work_notifysig: # deal with pending signals and
- # notify-resume requests
-+ movl %esp, %eax
- #ifdef CONFIG_VM86
- testl $X86_EFLAGS_VM, PT_EFLAGS(%esp)
-- movl %esp, %eax
-- jne work_notifysig_v86 # returning to kernel-space or
-+ jz 1f # returning to kernel-space or
- # vm86-space
-- xorl %edx, %edx
-- call do_notify_resume
-- jmp resume_userspace_sig
-
-- ALIGN
--work_notifysig_v86:
- pushl %ecx # save ti_flags for do_notify_resume
- CFI_ADJUST_CFA_OFFSET 4
- call save_v86_state # %eax contains pt_regs pointer
- popl %ecx
- CFI_ADJUST_CFA_OFFSET -4
- movl %eax, %esp
--#else
-- movl %esp, %eax
-+1:
- #endif
- xorl %edx, %edx
- call do_notify_resume
- jmp resume_userspace_sig
--END(work_pending)
-+ENDPROC(work_pending)
-
- # perform syscall exit tracing
- ALIGN
-@@ -673,11 +896,14 @@ syscall_trace_entry:
- movl $-ENOSYS,PT_EAX(%esp)
- movl %esp, %eax
- call syscall_trace_enter
-+
-+ pax_erase_kstack
-+
- /* What it returned is what we'll actually use. */
- cmpl $(nr_syscalls), %eax
- jnae syscall_call
- jmp syscall_exit
--END(syscall_trace_entry)
-+ENDPROC(syscall_trace_entry)
-
- # perform syscall exit tracing
- ALIGN
-@@ -690,20 +916,24 @@ syscall_exit_work:
- movl %esp, %eax
- call syscall_trace_leave
- jmp resume_userspace
--END(syscall_exit_work)
-+ENDPROC(syscall_exit_work)
- CFI_ENDPROC
-
- RING0_INT_FRAME # can't unwind into user space anyway
- syscall_fault:
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ push %ss
-+ pop %ds
-+#endif
- GET_THREAD_INFO(%ebp)
- movl $-EFAULT,PT_EAX(%esp)
- jmp resume_userspace
--END(syscall_fault)
-+ENDPROC(syscall_fault)
-
- syscall_badsys:
- movl $-ENOSYS,PT_EAX(%esp)
- jmp resume_userspace
--END(syscall_badsys)
-+ENDPROC(syscall_badsys)
- CFI_ENDPROC
-
- /*
-@@ -726,6 +956,33 @@ PTREGSCALL(rt_sigreturn)
- PTREGSCALL(vm86)
- PTREGSCALL(vm86old)
-
-+ ALIGN;
-+ENTRY(kernel_execve)
-+ push %ebp
-+ sub $PT_OLDSS+4,%esp
-+ push %edi
-+ push %ecx
-+ push %eax
-+ lea 3*4(%esp),%edi
-+ mov $PT_OLDSS/4+1,%ecx
-+ xorl %eax,%eax
-+ rep stosl
-+ pop %eax
-+ pop %ecx
-+ pop %edi
-+ movl $X86_EFLAGS_IF,PT_EFLAGS(%esp)
-+ mov %eax,PT_EBX(%esp)
-+ mov %edx,PT_ECX(%esp)
-+ mov %ecx,PT_EDX(%esp)
-+ mov %esp,%eax
-+ call sys_execve
-+ GET_THREAD_INFO(%ebp)
-+ test %eax,%eax
-+ jz syscall_exit
-+ add $PT_OLDSS+4,%esp
-+ pop %ebp
-+ ret
-+
- .macro FIXUP_ESPFIX_STACK
- /*
- * Switch back for ESPFIX stack to the normal zerobased stack
-@@ -735,7 +992,13 @@ PTREGSCALL(vm86old)
- * normal stack and adjusts ESP with the matching offset.
- */
- /* fixup the stack */
-- PER_CPU(gdt_page, %ebx)
-+#ifdef CONFIG_SMP
-+ movl PER_CPU_VAR(cpu_number), %ebx
-+ shll $PAGE_SHIFT_asm, %ebx
-+ addl $cpu_gdt_table, %ebx
-+#else
-+ movl $cpu_gdt_table, %ebx
-+#endif
- mov GDT_ENTRY_ESPFIX_SS * 8 + 4(%ebx), %al /* bits 16..23 */
- mov GDT_ENTRY_ESPFIX_SS * 8 + 7(%ebx), %ah /* bits 24..31 */
- shl $16, %eax
-@@ -793,7 +1056,7 @@ vector=vector+1
- .endr
- 2: jmp common_interrupt
- .endr
--END(irq_entries_start)
-+ENDPROC(irq_entries_start)
-
- .previous
- END(interrupt)
-@@ -840,7 +1103,7 @@ ENTRY(coprocessor_error)
- CFI_ADJUST_CFA_OFFSET 4
- jmp error_code
- CFI_ENDPROC
--END(coprocessor_error)
-+ENDPROC(coprocessor_error)
-
- ENTRY(simd_coprocessor_error)
- RING0_INT_FRAME
-@@ -850,7 +1113,7 @@ ENTRY(simd_coprocessor_error)
- CFI_ADJUST_CFA_OFFSET 4
- jmp error_code
- CFI_ENDPROC
--END(simd_coprocessor_error)
-+ENDPROC(simd_coprocessor_error)
-
- ENTRY(device_not_available)
- RING0_INT_FRAME
-@@ -860,7 +1123,7 @@ ENTRY(device_not_available)
- CFI_ADJUST_CFA_OFFSET 4
- jmp error_code
- CFI_ENDPROC
--END(device_not_available)
-+ENDPROC(device_not_available)
-
- #ifdef CONFIG_PARAVIRT
- ENTRY(native_iret)
-@@ -869,12 +1132,12 @@ ENTRY(native_iret)
- .align 4
- .long native_iret, iret_exc
- .previous
--END(native_iret)
-+ENDPROC(native_iret)
-
- ENTRY(native_irq_enable_sysexit)
- sti
- sysexit
--END(native_irq_enable_sysexit)
-+ENDPROC(native_irq_enable_sysexit)
- #endif
-
- ENTRY(overflow)
-@@ -885,7 +1148,7 @@ ENTRY(overflow)
- CFI_ADJUST_CFA_OFFSET 4
- jmp error_code
- CFI_ENDPROC
--END(overflow)
-+ENDPROC(overflow)
-
- ENTRY(bounds)
- RING0_INT_FRAME
-@@ -895,7 +1158,7 @@ ENTRY(bounds)
- CFI_ADJUST_CFA_OFFSET 4
- jmp error_code
- CFI_ENDPROC
--END(bounds)
-+ENDPROC(bounds)
-
- ENTRY(invalid_op)
- RING0_INT_FRAME
-@@ -905,7 +1168,7 @@ ENTRY(invalid_op)
- CFI_ADJUST_CFA_OFFSET 4
- jmp error_code
- CFI_ENDPROC
--END(invalid_op)
-+ENDPROC(invalid_op)
-
- ENTRY(coprocessor_segment_overrun)
- RING0_INT_FRAME
-@@ -915,7 +1178,7 @@ ENTRY(coprocessor_segment_overrun)
- CFI_ADJUST_CFA_OFFSET 4
- jmp error_code
- CFI_ENDPROC
--END(coprocessor_segment_overrun)
-+ENDPROC(coprocessor_segment_overrun)
-
- ENTRY(invalid_TSS)
- RING0_EC_FRAME
-@@ -923,7 +1186,7 @@ ENTRY(invalid_TSS)
- CFI_ADJUST_CFA_OFFSET 4
- jmp error_code
- CFI_ENDPROC
--END(invalid_TSS)
-+ENDPROC(invalid_TSS)
-
- ENTRY(segment_not_present)
- RING0_EC_FRAME
-@@ -931,7 +1194,7 @@ ENTRY(segment_not_present)
- CFI_ADJUST_CFA_OFFSET 4
- jmp error_code
- CFI_ENDPROC
--END(segment_not_present)
-+ENDPROC(segment_not_present)
-
- ENTRY(stack_segment)
- RING0_EC_FRAME
-@@ -939,7 +1202,7 @@ ENTRY(stack_segment)
- CFI_ADJUST_CFA_OFFSET 4
- jmp error_code
- CFI_ENDPROC
--END(stack_segment)
-+ENDPROC(stack_segment)
-
- ENTRY(alignment_check)
- RING0_EC_FRAME
-@@ -947,7 +1210,7 @@ ENTRY(alignment_check)
- CFI_ADJUST_CFA_OFFSET 4
- jmp error_code
- CFI_ENDPROC
--END(alignment_check)
-+ENDPROC(alignment_check)
-
- ENTRY(divide_error)
- RING0_INT_FRAME
-@@ -957,7 +1220,7 @@ ENTRY(divide_error)
- CFI_ADJUST_CFA_OFFSET 4
- jmp error_code
- CFI_ENDPROC
--END(divide_error)
-+ENDPROC(divide_error)
-
- #ifdef CONFIG_X86_MCE
- ENTRY(machine_check)
-@@ -968,7 +1231,7 @@ ENTRY(machine_check)
- CFI_ADJUST_CFA_OFFSET 4
- jmp error_code
- CFI_ENDPROC
--END(machine_check)
-+ENDPROC(machine_check)
- #endif
-
- ENTRY(spurious_interrupt_bug)
-@@ -979,7 +1242,7 @@ ENTRY(spurious_interrupt_bug)
- CFI_ADJUST_CFA_OFFSET 4
- jmp error_code
- CFI_ENDPROC
--END(spurious_interrupt_bug)
-+ENDPROC(spurious_interrupt_bug)
-
- ENTRY(kernel_thread_helper)
- pushl $0 # fake return address for unwinder
-@@ -1095,7 +1358,7 @@ ENDPROC(xen_failsafe_callback)
-
- ENTRY(mcount)
- ret
--END(mcount)
-+ENDPROC(mcount)
-
- ENTRY(ftrace_caller)
- cmpl $0, function_trace_stop
-@@ -1124,7 +1387,7 @@ ftrace_graph_call:
- .globl ftrace_stub
- ftrace_stub:
- ret
--END(ftrace_caller)
-+ENDPROC(ftrace_caller)
-
- #else /* ! CONFIG_DYNAMIC_FTRACE */
-
-@@ -1160,7 +1423,7 @@ trace:
- popl %ecx
- popl %eax
- jmp ftrace_stub
--END(mcount)
-+ENDPROC(mcount)
- #endif /* CONFIG_DYNAMIC_FTRACE */
- #endif /* CONFIG_FUNCTION_TRACER */
-
-@@ -1181,7 +1444,7 @@ ENTRY(ftrace_graph_caller)
- popl %ecx
- popl %eax
- ret
--END(ftrace_graph_caller)
-+ENDPROC(ftrace_graph_caller)
-
- .globl return_to_handler
- return_to_handler:
-@@ -1198,7 +1461,6 @@ return_to_handler:
- ret
- #endif
-
--.section .rodata,"a"
- #include "syscall_table_32.S"
-
- syscall_table_size=(.-sys_call_table)
-@@ -1255,15 +1517,18 @@ error_code:
- movl $-1, PT_ORIG_EAX(%esp) # no syscall to restart
- REG_TO_PTGS %ecx
- SET_KERNEL_GS %ecx
-- movl $(__USER_DS), %ecx
-+ movl $(__KERNEL_DS), %ecx
- movl %ecx, %ds
- movl %ecx, %es
-+
-+ pax_enter_kernel
-+
- TRACE_IRQS_OFF
- movl %esp,%eax # pt_regs pointer
- call *%edi
- jmp ret_from_exception
- CFI_ENDPROC
--END(page_fault)
-+ENDPROC(page_fault)
-
- /*
- * Debug traps and NMI can happen at the one SYSENTER instruction
-@@ -1309,7 +1574,7 @@ debug_stack_correct:
- call do_debug
- jmp ret_from_exception
- CFI_ENDPROC
--END(debug)
-+ENDPROC(debug)
-
- /*
- * NMI is doubly nasty. It can happen _while_ we're handling
-@@ -1351,6 +1616,9 @@ nmi_stack_correct:
- xorl %edx,%edx # zero error code
- movl %esp,%eax # pt_regs pointer
- call do_nmi
-+
-+ pax_exit_kernel
-+
- jmp restore_all_notrace
- CFI_ENDPROC
-
-@@ -1391,12 +1659,15 @@ nmi_espfix_stack:
- FIXUP_ESPFIX_STACK # %eax == %esp
- xorl %edx,%edx # zero error code
- call do_nmi
-+
-+ pax_exit_kernel
-+
- RESTORE_REGS
- lss 12+4(%esp), %esp # back to espfix stack
- CFI_ADJUST_CFA_OFFSET -24
- jmp irq_return
- CFI_ENDPROC
--END(nmi)
-+ENDPROC(nmi)
-
- ENTRY(int3)
- RING0_INT_FRAME
-@@ -1409,7 +1680,7 @@ ENTRY(int3)
- call do_int3
- jmp ret_from_exception
- CFI_ENDPROC
--END(int3)
-+ENDPROC(int3)
-
- ENTRY(general_protection)
- RING0_EC_FRAME
-@@ -1417,7 +1688,7 @@ ENTRY(general_protection)
- CFI_ADJUST_CFA_OFFSET 4
- jmp error_code
- CFI_ENDPROC
--END(general_protection)
-+ENDPROC(general_protection)
-
- /*
- * End of kprobes section
-diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
-index 34a56a9..7da97ae 100644
---- a/arch/x86/kernel/entry_64.S
-+++ b/arch/x86/kernel/entry_64.S
-@@ -53,6 +53,8 @@
- #include <asm/paravirt.h>
- #include <asm/ftrace.h>
- #include <asm/percpu.h>
-+#include <asm/pgtable.h>
-+#include <asm/alternative-asm.h>
-
- /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
- #include <linux/elf-em.h>
-@@ -64,8 +66,9 @@
- #ifdef CONFIG_FUNCTION_TRACER
- #ifdef CONFIG_DYNAMIC_FTRACE
- ENTRY(mcount)
-+ pax_force_retaddr
- retq
--END(mcount)
-+ENDPROC(mcount)
-
- ENTRY(ftrace_caller)
- cmpl $0, function_trace_stop
-@@ -88,8 +91,9 @@ GLOBAL(ftrace_graph_call)
- #endif
-
- GLOBAL(ftrace_stub)
-+ pax_force_retaddr
- retq
--END(ftrace_caller)
-+ENDPROC(ftrace_caller)
-
- #else /* ! CONFIG_DYNAMIC_FTRACE */
- ENTRY(mcount)
-@@ -108,6 +112,7 @@ ENTRY(mcount)
- #endif
-
- GLOBAL(ftrace_stub)
-+ pax_force_retaddr
- retq
-
- trace:
-@@ -117,12 +122,13 @@ trace:
- movq 8(%rbp), %rsi
- subq $MCOUNT_INSN_SIZE, %rdi
-
-+ pax_force_fptr ftrace_trace_function
- call *ftrace_trace_function
-
- MCOUNT_RESTORE_FRAME
-
- jmp ftrace_stub
--END(mcount)
-+ENDPROC(mcount)
- #endif /* CONFIG_DYNAMIC_FTRACE */
- #endif /* CONFIG_FUNCTION_TRACER */
-
-@@ -142,8 +148,9 @@ ENTRY(ftrace_graph_caller)
-
- MCOUNT_RESTORE_FRAME
-
-+ pax_force_retaddr
- retq
--END(ftrace_graph_caller)
-+ENDPROC(ftrace_graph_caller)
-
- GLOBAL(return_to_handler)
- subq $24, %rsp
-@@ -159,6 +166,7 @@ GLOBAL(return_to_handler)
- movq 8(%rsp), %rdx
- movq (%rsp), %rax
- addq $16, %rsp
-+ pax_force_retaddr
- retq
- #endif
-
-@@ -174,6 +182,273 @@ ENTRY(native_usergs_sysret64)
- ENDPROC(native_usergs_sysret64)
- #endif /* CONFIG_PARAVIRT */
-
-+ .macro ljmpq sel, off
-+#if defined(CONFIG_MPSC) || defined(CONFIG_MCORE2) || defined (CONFIG_MATOM)
-+ .byte 0x48; ljmp *1234f(%rip)
-+ .pushsection .rodata
-+ .align 16
-+ 1234: .quad \off; .word \sel
-+ .popsection
-+#else
-+ pushq $\sel
-+ pushq $\off
-+ lretq
-+#endif
-+ .endm
-+
-+ .macro pax_enter_kernel
-+ pax_set_fptr_mask
-+#ifdef CONFIG_PAX_KERNEXEC
-+ call pax_enter_kernel
-+#endif
-+ .endm
-+
-+ .macro pax_exit_kernel
-+#ifdef CONFIG_PAX_KERNEXEC
-+ call pax_exit_kernel
-+#endif
-+ .endm
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ENTRY(pax_enter_kernel)
-+ pushq %rdi
-+
-+#ifdef CONFIG_PARAVIRT
-+ PV_SAVE_REGS(CLBR_RDI)
-+#endif
-+
-+ GET_CR0_INTO_RDI
-+ bts $16,%rdi
-+ jnc 3f
-+ mov %cs,%edi
-+ cmp $__KERNEL_CS,%edi
-+ jnz 2f
-+1:
-+
-+#ifdef CONFIG_PARAVIRT
-+ PV_RESTORE_REGS(CLBR_RDI)
-+#endif
-+
-+ popq %rdi
-+ pax_force_retaddr
-+ retq
-+
-+2: ljmpq __KERNEL_CS,1f
-+3: ljmpq __KERNEXEC_KERNEL_CS,4f
-+4: SET_RDI_INTO_CR0
-+ jmp 1b
-+ENDPROC(pax_enter_kernel)
-+
-+ENTRY(pax_exit_kernel)
-+ pushq %rdi
-+
-+#ifdef CONFIG_PARAVIRT
-+ PV_SAVE_REGS(CLBR_RDI)
-+#endif
-+
-+ mov %cs,%rdi
-+ cmp $__KERNEXEC_KERNEL_CS,%edi
-+ jz 2f
-+1:
-+
-+#ifdef CONFIG_PARAVIRT
-+ PV_RESTORE_REGS(CLBR_RDI);
-+#endif
-+
-+ popq %rdi
-+ pax_force_retaddr
-+ retq
-+
-+2: GET_CR0_INTO_RDI
-+ btr $16,%rdi
-+ ljmpq __KERNEL_CS,3f
-+3: SET_RDI_INTO_CR0
-+ jmp 1b
-+ENDPROC(pax_exit_kernel)
-+#endif
-+
-+ .macro pax_enter_kernel_user
-+ pax_set_fptr_mask
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ call pax_enter_kernel_user
-+#endif
-+ .endm
-+
-+ .macro pax_exit_kernel_user
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ call pax_exit_kernel_user
-+#endif
-+#ifdef CONFIG_PAX_RANDKSTACK
-+ pushq %rax
-+ call pax_randomize_kstack
-+ popq %rax
-+#endif
-+ .endm
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ENTRY(pax_enter_kernel_user)
-+ pushq %rdi
-+ pushq %rbx
-+
-+#ifdef CONFIG_PARAVIRT
-+ PV_SAVE_REGS(CLBR_RDI)
-+#endif
-+
-+ GET_CR3_INTO_RDI
-+ mov %rdi,%rbx
-+ add $__START_KERNEL_map,%rbx
-+ sub phys_base(%rip),%rbx
-+
-+#ifdef CONFIG_PARAVIRT
-+ pushq %rdi
-+ cmpl $0, pv_info+PARAVIRT_enabled
-+ jz 1f
-+ i = 0
-+ .rept USER_PGD_PTRS
-+ mov i*8(%rbx),%rsi
-+ mov $0,%sil
-+ lea i*8(%rbx),%rdi
-+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd_batched)
-+ i = i + 1
-+ .endr
-+ jmp 2f
-+1:
-+#endif
-+
-+ i = 0
-+ .rept USER_PGD_PTRS
-+ movb $0,i*8(%rbx)
-+ i = i + 1
-+ .endr
-+
-+#ifdef CONFIG_PARAVIRT
-+2: popq %rdi
-+#endif
-+ SET_RDI_INTO_CR3
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ GET_CR0_INTO_RDI
-+ bts $16,%rdi
-+ SET_RDI_INTO_CR0
-+#endif
-+
-+#ifdef CONFIG_PARAVIRT
-+ PV_RESTORE_REGS(CLBR_RDI)
-+#endif
-+
-+ popq %rbx
-+ popq %rdi
-+ pax_force_retaddr
-+ retq
-+ENDPROC(pax_enter_kernel_user)
-+
-+ENTRY(pax_exit_kernel_user)
-+ push %rdi
-+
-+#ifdef CONFIG_PARAVIRT
-+ pushq %rbx
-+ PV_SAVE_REGS(CLBR_RDI)
-+#endif
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ GET_CR0_INTO_RDI
-+ btr $16,%rdi
-+ SET_RDI_INTO_CR0
-+#endif
-+
-+ GET_CR3_INTO_RDI
-+ add $__START_KERNEL_map,%rdi
-+ sub phys_base(%rip),%rdi
-+
-+#ifdef CONFIG_PARAVIRT
-+ cmpl $0, pv_info+PARAVIRT_enabled
-+ jz 1f
-+ mov %rdi,%rbx
-+ i = 0
-+ .rept USER_PGD_PTRS
-+ mov i*8(%rbx),%rsi
-+ mov $0x67,%sil
-+ lea i*8(%rbx),%rdi
-+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd_batched)
-+ i = i + 1
-+ .endr
-+ jmp 2f
-+1:
-+#endif
-+
-+ i = 0
-+ .rept USER_PGD_PTRS
-+ movb $0x67,i*8(%rdi)
-+ i = i + 1
-+ .endr
-+
-+#ifdef CONFIG_PARAVIRT
-+2: PV_RESTORE_REGS(CLBR_RDI)
-+ popq %rbx
-+#endif
-+
-+ popq %rdi
-+ pax_force_retaddr
-+ retq
-+ENDPROC(pax_exit_kernel_user)
-+#endif
-+
-+.macro pax_erase_kstack
-+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
-+ call pax_erase_kstack
-+#endif
-+.endm
-+
-+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
-+ENTRY(pax_erase_kstack)
-+ pushq %rdi
-+ pushq %rcx
-+ pushq %rax
-+ pushq %r11
-+
-+ GET_THREAD_INFO(%r11)
-+ mov TI_lowest_stack(%r11), %rdi
-+ mov $-0xBEEF, %rax
-+ std
-+
-+1: mov %edi, %ecx
-+ and $THREAD_SIZE_asm - 1, %ecx
-+ shr $3, %ecx
-+ repne scasq
-+ jecxz 2f
-+
-+ cmp $2*8, %ecx
-+ jc 2f
-+
-+ mov $2*8, %ecx
-+ repe scasq
-+ jecxz 2f
-+ jne 1b
-+
-+2: cld
-+ mov %esp, %ecx
-+ sub %edi, %ecx
-+
-+ cmp $THREAD_SIZE_asm, %rcx
-+ jb 3f
-+ ud2
-+3:
-+
-+ shr $3, %ecx
-+ rep stosq
-+
-+ mov TI_task_thread_sp0(%r11), %rdi
-+ sub $256, %rdi
-+ mov %rdi, TI_lowest_stack(%r11)
-+
-+ popq %r11
-+ popq %rax
-+ popq %rcx
-+ popq %rdi
-+ pax_force_retaddr
-+ ret
-+ENDPROC(pax_erase_kstack)
-+#endif
-
- .macro TRACE_IRQS_IRETQ offset=ARGOFFSET
- #ifdef CONFIG_TRACE_IRQFLAGS
-@@ -233,8 +508,8 @@ ENDPROC(native_usergs_sysret64)
- .endm
-
- .macro UNFAKE_STACK_FRAME
-- addq $8*6, %rsp
-- CFI_ADJUST_CFA_OFFSET -(6*8)
-+ addq $8*6 + ARG_SKIP, %rsp
-+ CFI_ADJUST_CFA_OFFSET -(6*8 + ARG_SKIP)
- .endm
-
- /*
-@@ -317,7 +592,7 @@ ENTRY(save_args)
- leaq -ARGOFFSET+16(%rsp),%rdi /* arg1 for handler */
- movq_cfi rbp, 8 /* push %rbp */
- leaq 8(%rsp), %rbp /* mov %rsp, %ebp */
-- testl $3, CS(%rdi)
-+ testb $3, CS(%rdi)
- je 1f
- SWAPGS
- /*
-@@ -337,9 +612,10 @@ ENTRY(save_args)
- * We entered an interrupt context - irqs are off:
- */
- 2: TRACE_IRQS_OFF
-+ pax_force_retaddr_bts
- ret
- CFI_ENDPROC
--END(save_args)
-+ENDPROC(save_args)
-
- ENTRY(save_rest)
- PARTIAL_FRAME 1 REST_SKIP+8
-@@ -352,9 +628,10 @@ ENTRY(save_rest)
- movq_cfi r15, R15+16
- movq %r11, 8(%rsp) /* return address */
- FIXUP_TOP_OF_STACK %r11, 16
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
--END(save_rest)
-+ENDPROC(save_rest)
-
- /* save complete stack frame */
- .pushsection .kprobes.text, "ax"
-@@ -383,9 +660,10 @@ ENTRY(save_paranoid)
- js 1f /* negative -> in kernel */
- SWAPGS
- xorl %ebx,%ebx
--1: ret
-+1: pax_force_retaddr_bts
-+ ret
- CFI_ENDPROC
--END(save_paranoid)
-+ENDPROC(save_paranoid)
- .popsection
-
- /*
-@@ -409,7 +687,7 @@ ENTRY(ret_from_fork)
-
- RESTORE_REST
-
-- testl $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
-+ testb $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
- je int_ret_from_sys_call
-
- testl $_TIF_IA32, TI_flags(%rcx) # 32-bit compat task needs IRET
-@@ -419,7 +697,7 @@ ENTRY(ret_from_fork)
- jmp ret_from_sys_call # go to the SYSRET fastpath
-
- CFI_ENDPROC
--END(ret_from_fork)
-+ENDPROC(ret_from_fork)
-
- /*
- * System call entry. Upto 6 arguments in registers are supported.
-@@ -455,7 +733,7 @@ END(ret_from_fork)
- ENTRY(system_call)
- CFI_STARTPROC simple
- CFI_SIGNAL_FRAME
-- CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
-+ CFI_DEF_CFA rsp,0
- CFI_REGISTER rip,rcx
- /*CFI_REGISTER rflags,r11*/
- SWAPGS_UNSAFE_STACK
-@@ -468,12 +746,18 @@ ENTRY(system_call_after_swapgs)
-
- movq %rsp,PER_CPU_VAR(old_rsp)
- movq PER_CPU_VAR(kernel_stack),%rsp
-+ SAVE_ARGS 8*6,1
-+ pax_enter_kernel_user
-+
-+#ifdef CONFIG_PAX_RANDKSTACK
-+ pax_erase_kstack
-+#endif
-+
- /*
- * No need to follow this irqs off/on section - it's straight
- * and short:
- */
- ENABLE_INTERRUPTS(CLBR_NONE)
-- SAVE_ARGS 8,1
- movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
- movq %rcx,RIP-ARGOFFSET(%rsp)
- CFI_REL_OFFSET rip,RIP-ARGOFFSET
-@@ -483,7 +767,7 @@ ENTRY(system_call_after_swapgs)
- system_call_fastpath:
- cmpq $__NR_syscall_max,%rax
- ja badsys
-- movq %r10,%rcx
-+ movq R10-ARGOFFSET(%rsp),%rcx
- call *sys_call_table(,%rax,8) # XXX: rip relative
- movq %rax,RAX-ARGOFFSET(%rsp)
- /*
-@@ -502,6 +786,8 @@ sysret_check:
- andl %edi,%edx
- jnz sysret_careful
- CFI_REMEMBER_STATE
-+ pax_exit_kernel_user
-+ pax_erase_kstack
- /*
- * sysretq will re-enable interrupts:
- */
-@@ -555,14 +841,18 @@ badsys:
- * jump back to the normal fast path.
- */
- auditsys:
-- movq %r10,%r9 /* 6th arg: 4th syscall arg */
-+ movq R10-ARGOFFSET(%rsp),%r9 /* 6th arg: 4th syscall arg */
- movq %rdx,%r8 /* 5th arg: 3rd syscall arg */
- movq %rsi,%rcx /* 4th arg: 2nd syscall arg */
- movq %rdi,%rdx /* 3rd arg: 1st syscall arg */
- movq %rax,%rsi /* 2nd arg: syscall number */
- movl $AUDIT_ARCH_X86_64,%edi /* 1st arg: audit arch */
- call audit_syscall_entry
-+
-+ pax_erase_kstack
-+
- LOAD_ARGS 0 /* reload call-clobbered registers */
-+ pax_set_fptr_mask
- jmp system_call_fastpath
-
- /*
-@@ -592,16 +882,20 @@ tracesys:
- FIXUP_TOP_OF_STACK %rdi
- movq %rsp,%rdi
- call syscall_trace_enter
-+
-+ pax_erase_kstack
-+
- /*
- * Reload arg registers from stack in case ptrace changed them.
- * We don't reload %rax because syscall_trace_enter() returned
- * the value it wants us to use in the table lookup.
- */
- LOAD_ARGS ARGOFFSET, 1
-+ pax_set_fptr_mask
- RESTORE_REST
- cmpq $__NR_syscall_max,%rax
- ja int_ret_from_sys_call /* RAX(%rsp) set to -ENOSYS above */
-- movq %r10,%rcx /* fixup for C */
-+ movq R10-ARGOFFSET(%rsp),%rcx /* fixup for C */
- call *sys_call_table(,%rax,8)
- movq %rax,RAX-ARGOFFSET(%rsp)
- /* Use IRET because user could have changed frame */
-@@ -613,7 +907,7 @@ tracesys:
- GLOBAL(int_ret_from_sys_call)
- DISABLE_INTERRUPTS(CLBR_NONE)
- TRACE_IRQS_OFF
-- testl $3,CS-ARGOFFSET(%rsp)
-+ testb $3,CS-ARGOFFSET(%rsp)
- je retint_restore_args
- movl $_TIF_ALLWORK_MASK,%edi
- /* edi: mask to check */
-@@ -624,7 +918,9 @@ GLOBAL(int_with_check)
- andl %edi,%edx
- jnz int_careful
- andl $~TS_COMPAT,TI_status(%rcx)
-- jmp retint_swapgs
-+ pax_exit_kernel_user
-+ pax_erase_kstack
-+ jmp retint_swapgs_pax
-
- /* Either reschedule or signal or syscall exit tracking needed. */
- /* First do a reschedule test. */
-@@ -674,7 +970,7 @@ int_restore_rest:
- TRACE_IRQS_OFF
- jmp int_with_check
- CFI_ENDPROC
--END(system_call)
-+ENDPROC(system_call)
-
- /*
- * Certain special system calls that need to save a complete full stack frame.
-@@ -690,7 +986,7 @@ ENTRY(\label)
- call \func
- jmp ptregscall_common
- CFI_ENDPROC
--END(\label)
-+ENDPROC(\label)
- .endm
-
- PTREGSCALL stub_clone, sys_clone, %r8
-@@ -708,9 +1004,10 @@ ENTRY(ptregscall_common)
- movq_cfi_restore R12+8, r12
- movq_cfi_restore RBP+8, rbp
- movq_cfi_restore RBX+8, rbx
-+ pax_force_retaddr
- ret $REST_SKIP /* pop extended registers */
- CFI_ENDPROC
--END(ptregscall_common)
-+ENDPROC(ptregscall_common)
-
- ENTRY(stub_execve)
- CFI_STARTPROC
-@@ -726,7 +1023,7 @@ ENTRY(stub_execve)
- RESTORE_REST
- jmp int_ret_from_sys_call
- CFI_ENDPROC
--END(stub_execve)
-+ENDPROC(stub_execve)
-
- /*
- * sigreturn is special because it needs to restore all registers on return.
-@@ -744,7 +1041,7 @@ ENTRY(stub_rt_sigreturn)
- RESTORE_REST
- jmp int_ret_from_sys_call
- CFI_ENDPROC
--END(stub_rt_sigreturn)
-+ENDPROC(stub_rt_sigreturn)
-
- /*
- * Build the entry stubs and pointer table with some assembler magic.
-@@ -780,7 +1077,7 @@ vector=vector+1
- 2: jmp common_interrupt
- .endr
- CFI_ENDPROC
--END(irq_entries_start)
-+ENDPROC(irq_entries_start)
-
- .previous
- END(interrupt)
-@@ -800,6 +1097,16 @@ END(interrupt)
- CFI_ADJUST_CFA_OFFSET 10*8
- call save_args
- PARTIAL_FRAME 0
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ testb $3, CS(%rdi)
-+ jnz 1f
-+ pax_enter_kernel
-+ jmp 2f
-+1: pax_enter_kernel_user
-+2:
-+#else
-+ pax_enter_kernel
-+#endif
- call \func
- .endm
-
-@@ -822,7 +1129,7 @@ ret_from_intr:
- CFI_ADJUST_CFA_OFFSET -8
- exit_intr:
- GET_THREAD_INFO(%rcx)
-- testl $3,CS-ARGOFFSET(%rsp)
-+ testb $3,CS-ARGOFFSET(%rsp)
- je retint_kernel
-
- /* Interrupt came from user space */
-@@ -844,12 +1151,16 @@ retint_swapgs: /* return to user-space */
- * The iretq could re-enable interrupts:
- */
- DISABLE_INTERRUPTS(CLBR_ANY)
-+ pax_exit_kernel_user
-+retint_swapgs_pax:
- TRACE_IRQS_IRETQ
- SWAPGS
- jmp restore_args
-
- retint_restore_args: /* return to kernel space */
- DISABLE_INTERRUPTS(CLBR_ANY)
-+ pax_exit_kernel
-+ pax_force_retaddr (RIP-ARGOFFSET)
- /*
- * The iretq could re-enable interrupts:
- */
-@@ -940,7 +1251,7 @@ ENTRY(retint_kernel)
- #endif
-
- CFI_ENDPROC
--END(common_interrupt)
-+ENDPROC(common_interrupt)
-
- /*
- * APIC interrupts.
-@@ -953,7 +1264,7 @@ ENTRY(\sym)
- interrupt \do_sym
- jmp ret_from_intr
- CFI_ENDPROC
--END(\sym)
-+ENDPROC(\sym)
- .endm
-
- #ifdef CONFIG_SMP
-@@ -1032,12 +1343,22 @@ ENTRY(\sym)
- CFI_ADJUST_CFA_OFFSET 15*8
- call error_entry
- DEFAULT_FRAME 0
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ testb $3, CS(%rsp)
-+ jnz 1f
-+ pax_enter_kernel
-+ jmp 2f
-+1: pax_enter_kernel_user
-+2:
-+#else
-+ pax_enter_kernel
-+#endif
- movq %rsp,%rdi /* pt_regs pointer */
- xorl %esi,%esi /* no error code */
- call \do_sym
- jmp error_exit /* %ebx: no swapgs flag */
- CFI_ENDPROC
--END(\sym)
-+ENDPROC(\sym)
- .endm
-
- .macro paranoidzeroentry sym do_sym
-@@ -1049,12 +1370,22 @@ ENTRY(\sym)
- subq $15*8, %rsp
- call save_paranoid
- TRACE_IRQS_OFF
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ testb $3, CS(%rsp)
-+ jnz 1f
-+ pax_enter_kernel
-+ jmp 2f
-+1: pax_enter_kernel_user
-+2:
-+#else
-+ pax_enter_kernel
-+#endif
- movq %rsp,%rdi /* pt_regs pointer */
- xorl %esi,%esi /* no error code */
- call \do_sym
- jmp paranoid_exit /* %ebx: no swapgs flag */
- CFI_ENDPROC
--END(\sym)
-+ENDPROC(\sym)
- .endm
-
- .macro paranoidzeroentry_ist sym do_sym ist
-@@ -1066,15 +1397,30 @@ ENTRY(\sym)
- subq $15*8, %rsp
- call save_paranoid
- TRACE_IRQS_OFF
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ testb $3, CS(%rsp)
-+ jnz 1f
-+ pax_enter_kernel
-+ jmp 2f
-+1: pax_enter_kernel_user
-+2:
-+#else
-+ pax_enter_kernel
-+#endif
- movq %rsp,%rdi /* pt_regs pointer */
- xorl %esi,%esi /* no error code */
-- PER_CPU(init_tss, %rbp)
-+#ifdef CONFIG_SMP
-+ imul $TSS_size, PER_CPU_VAR(cpu_number), %ebp
-+ lea init_tss(%rbp), %rbp
-+#else
-+ lea init_tss(%rip), %rbp
-+#endif
- subq $EXCEPTION_STKSZ, TSS_ist + (\ist - 1) * 8(%rbp)
- call \do_sym
- addq $EXCEPTION_STKSZ, TSS_ist + (\ist - 1) * 8(%rbp)
- jmp paranoid_exit /* %ebx: no swapgs flag */
- CFI_ENDPROC
--END(\sym)
-+ENDPROC(\sym)
- .endm
-
- .macro errorentry sym do_sym
-@@ -1085,13 +1431,23 @@ ENTRY(\sym)
- CFI_ADJUST_CFA_OFFSET 15*8
- call error_entry
- DEFAULT_FRAME 0
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ testb $3, CS(%rsp)
-+ jnz 1f
-+ pax_enter_kernel
-+ jmp 2f
-+1: pax_enter_kernel_user
-+2:
-+#else
-+ pax_enter_kernel
-+#endif
- movq %rsp,%rdi /* pt_regs pointer */
- movq ORIG_RAX(%rsp),%rsi /* get error code */
- movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
- call \do_sym
- jmp error_exit /* %ebx: no swapgs flag */
- CFI_ENDPROC
--END(\sym)
-+ENDPROC(\sym)
- .endm
-
- /* error code is on the stack already */
-@@ -1104,13 +1460,23 @@ ENTRY(\sym)
- call save_paranoid
- DEFAULT_FRAME 0
- TRACE_IRQS_OFF
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ testb $3, CS(%rsp)
-+ jnz 1f
-+ pax_enter_kernel
-+ jmp 2f
-+1: pax_enter_kernel_user
-+2:
-+#else
-+ pax_enter_kernel
-+#endif
- movq %rsp,%rdi /* pt_regs pointer */
- movq ORIG_RAX(%rsp),%rsi /* get error code */
- movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
- call \do_sym
- jmp paranoid_exit /* %ebx: no swapgs flag */
- CFI_ENDPROC
--END(\sym)
-+ENDPROC(\sym)
- .endm
-
- zeroentry divide_error do_divide_error
-@@ -1141,9 +1507,10 @@ gs_change:
- SWAPGS
- popf
- CFI_ADJUST_CFA_OFFSET -8
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
--END(native_load_gs_index)
-+ENDPROC(native_load_gs_index)
-
- .section __ex_table,"a"
- .align 8
-@@ -1193,11 +1560,12 @@ ENTRY(kernel_thread)
- * of hacks for example to fork off the per-CPU idle tasks.
- * [Hopefully no generic code relies on the reschedule -AK]
- */
-- RESTORE_ALL
-+ RESTORE_REST
- UNFAKE_STACK_FRAME
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
--END(kernel_thread)
-+ENDPROC(kernel_thread)
-
- ENTRY(child_rip)
- pushq $0 # fake return address
-@@ -1208,13 +1576,14 @@ ENTRY(child_rip)
- */
- movq %rdi, %rax
- movq %rsi, %rdi
-+ pax_force_fptr %rax
- call *%rax
- # exit
- mov %eax, %edi
- call do_exit
- ud2 # padding for call trace
- CFI_ENDPROC
--END(child_rip)
-+ENDPROC(child_rip)
-
- /*
- * execve(). This function needs to use IRET, not SYSRET, to set up all state properly.
-@@ -1241,11 +1610,11 @@ ENTRY(kernel_execve)
- RESTORE_REST
- testq %rax,%rax
- je int_ret_from_sys_call
-- RESTORE_ARGS
- UNFAKE_STACK_FRAME
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
--END(kernel_execve)
-+ENDPROC(kernel_execve)
-
- /* Call softirq on interrupt stack. Interrupts are off. */
- ENTRY(call_softirq)
-@@ -1263,9 +1632,10 @@ ENTRY(call_softirq)
- CFI_DEF_CFA_REGISTER rsp
- CFI_ADJUST_CFA_OFFSET -8
- decl PER_CPU_VAR(irq_count)
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
--END(call_softirq)
-+ENDPROC(call_softirq)
-
- #ifdef CONFIG_XEN
- zeroentry xen_hypervisor_callback xen_do_hypervisor_callback
-@@ -1303,7 +1673,7 @@ ENTRY(xen_do_hypervisor_callback) # do_hypervisor_callback(struct *pt_regs)
- decl PER_CPU_VAR(irq_count)
- jmp error_exit
- CFI_ENDPROC
--END(xen_do_hypervisor_callback)
-+ENDPROC(xen_do_hypervisor_callback)
-
- /*
- * Hypervisor uses this for application faults while it executes.
-@@ -1362,7 +1732,7 @@ ENTRY(xen_failsafe_callback)
- SAVE_ALL
- jmp error_exit
- CFI_ENDPROC
--END(xen_failsafe_callback)
-+ENDPROC(xen_failsafe_callback)
-
- #endif /* CONFIG_XEN */
-
-@@ -1405,16 +1775,31 @@ ENTRY(paranoid_exit)
- TRACE_IRQS_OFF
- testl %ebx,%ebx /* swapgs needed? */
- jnz paranoid_restore
-- testl $3,CS(%rsp)
-+ testb $3,CS(%rsp)
- jnz paranoid_userspace
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ pax_exit_kernel
-+ TRACE_IRQS_IRETQ 0
-+ SWAPGS_UNSAFE_STACK
-+ RESTORE_ALL 8
-+ pax_force_retaddr_bts
-+ jmp irq_return
-+#endif
- paranoid_swapgs:
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ pax_exit_kernel_user
-+#else
-+ pax_exit_kernel
-+#endif
- TRACE_IRQS_IRETQ 0
- SWAPGS_UNSAFE_STACK
- RESTORE_ALL 8
- jmp irq_return
- paranoid_restore:
-+ pax_exit_kernel
- TRACE_IRQS_IRETQ 0
- RESTORE_ALL 8
-+ pax_force_retaddr_bts
- jmp irq_return
- paranoid_userspace:
- GET_THREAD_INFO(%rcx)
-@@ -1443,7 +1828,7 @@ paranoid_schedule:
- TRACE_IRQS_OFF
- jmp paranoid_userspace
- CFI_ENDPROC
--END(paranoid_exit)
-+ENDPROC(paranoid_exit)
-
- /*
- * Exception entry point. This expects an error code/orig_rax on the stack.
-@@ -1470,12 +1855,13 @@ ENTRY(error_entry)
- movq_cfi r14, R14+8
- movq_cfi r15, R15+8
- xorl %ebx,%ebx
-- testl $3,CS+8(%rsp)
-+ testb $3,CS+8(%rsp)
- je error_kernelspace
- error_swapgs:
- SWAPGS
- error_sti:
- TRACE_IRQS_OFF
-+ pax_force_retaddr_bts
- ret
- CFI_ENDPROC
-
-@@ -1497,7 +1883,7 @@ error_kernelspace:
- cmpq $gs_change,RIP+8(%rsp)
- je error_swapgs
- jmp error_sti
--END(error_entry)
-+ENDPROC(error_entry)
-
-
- /* ebx: no swapgs flag (1: don't need swapgs, 0: need it) */
-@@ -1517,7 +1903,7 @@ ENTRY(error_exit)
- jnz retint_careful
- jmp retint_swapgs
- CFI_ENDPROC
--END(error_exit)
-+ENDPROC(error_exit)
-
-
- /* runs on exception stack */
-@@ -1529,6 +1915,16 @@ ENTRY(nmi)
- CFI_ADJUST_CFA_OFFSET 15*8
- call save_paranoid
- DEFAULT_FRAME 0
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ testb $3, CS(%rsp)
-+ jnz 1f
-+ pax_enter_kernel
-+ jmp 2f
-+1: pax_enter_kernel_user
-+2:
-+#else
-+ pax_enter_kernel
-+#endif
- /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
- movq %rsp,%rdi
- movq $-1,%rsi
-@@ -1539,12 +1935,28 @@ ENTRY(nmi)
- DISABLE_INTERRUPTS(CLBR_NONE)
- testl %ebx,%ebx /* swapgs needed? */
- jnz nmi_restore
-- testl $3,CS(%rsp)
-+ testb $3,CS(%rsp)
- jnz nmi_userspace
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ pax_exit_kernel
-+ SWAPGS_UNSAFE_STACK
-+ RESTORE_ALL 8
-+ pax_force_retaddr_bts
-+ jmp irq_return
-+#endif
- nmi_swapgs:
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ pax_exit_kernel_user
-+#else
-+ pax_exit_kernel
-+#endif
- SWAPGS_UNSAFE_STACK
-+ RESTORE_ALL 8
-+ jmp irq_return
- nmi_restore:
-+ pax_exit_kernel
- RESTORE_ALL 8
-+ pax_force_retaddr_bts
- jmp irq_return
- nmi_userspace:
- GET_THREAD_INFO(%rcx)
-@@ -1573,14 +1985,14 @@ nmi_schedule:
- jmp paranoid_exit
- CFI_ENDPROC
- #endif
--END(nmi)
-+ENDPROC(nmi)
-
- ENTRY(ignore_sysret)
- CFI_STARTPROC
- mov $-ENOSYS,%eax
- sysret
- CFI_ENDPROC
--END(ignore_sysret)
-+ENDPROC(ignore_sysret)
-
- /*
- * End of kprobes section
-diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
-index 9dbb527..9fe4f21 100644
---- a/arch/x86/kernel/ftrace.c
-+++ b/arch/x86/kernel/ftrace.c
-@@ -103,7 +103,7 @@ static void *mod_code_ip; /* holds the IP to write to */
- static void *mod_code_newcode; /* holds the text to write to the IP */
-
- static unsigned nmi_wait_count;
--static atomic_t nmi_update_count = ATOMIC_INIT(0);
-+static atomic_unchecked_t nmi_update_count = ATOMIC_INIT(0);
-
- int ftrace_arch_read_dyn_info(char *buf, int size)
- {
-@@ -111,7 +111,7 @@ int ftrace_arch_read_dyn_info(char *buf, int size)
-
- r = snprintf(buf, size, "%u %u",
- nmi_wait_count,
-- atomic_read(&nmi_update_count));
-+ atomic_read_unchecked(&nmi_update_count));
- return r;
- }
-
-@@ -149,8 +149,10 @@ void ftrace_nmi_enter(void)
- {
- if (atomic_inc_return(&nmi_running) & MOD_CODE_WRITE_FLAG) {
- smp_rmb();
-+ pax_open_kernel();
- ftrace_mod_code();
-- atomic_inc(&nmi_update_count);
-+ pax_close_kernel();
-+ atomic_inc_unchecked(&nmi_update_count);
- }
- /* Must have previous changes seen before executions */
- smp_mb();
-@@ -215,7 +217,7 @@ do_ftrace_mod_code(unsigned long ip, void *new_code)
-
-
-
--static unsigned char ftrace_nop[MCOUNT_INSN_SIZE];
-+static unsigned char ftrace_nop[MCOUNT_INSN_SIZE] __read_only;
-
- static unsigned char *ftrace_nop_replace(void)
- {
-@@ -228,6 +230,8 @@ ftrace_modify_code(unsigned long ip, unsigned char *old_code,
- {
- unsigned char replaced[MCOUNT_INSN_SIZE];
-
-+ ip = ktla_ktva(ip);
-+
- /*
- * Note: Due to modules and __init, code can
- * disappear and change, we need to protect against faulting
-@@ -284,7 +288,7 @@ int ftrace_update_ftrace_func(ftrace_func_t func)
- unsigned char old[MCOUNT_INSN_SIZE], *new;
- int ret;
-
-- memcpy(old, &ftrace_call, MCOUNT_INSN_SIZE);
-+ memcpy(old, ktla_ktva((void *)ftrace_call), MCOUNT_INSN_SIZE);
- new = ftrace_call_replace(ip, (unsigned long)func);
- ret = ftrace_modify_code(ip, old, new);
-
-@@ -337,15 +341,15 @@ int __init ftrace_dyn_arch_init(void *data)
- switch (faulted) {
- case 0:
- pr_info("ftrace: converting mcount calls to 0f 1f 44 00 00\n");
-- memcpy(ftrace_nop, ftrace_test_p6nop, MCOUNT_INSN_SIZE);
-+ memcpy(ftrace_nop, ktla_ktva(ftrace_test_p6nop), MCOUNT_INSN_SIZE);
- break;
- case 1:
- pr_info("ftrace: converting mcount calls to 66 66 66 66 90\n");
-- memcpy(ftrace_nop, ftrace_test_nop5, MCOUNT_INSN_SIZE);
-+ memcpy(ftrace_nop, ktla_ktva(ftrace_test_nop5), MCOUNT_INSN_SIZE);
- break;
- case 2:
- pr_info("ftrace: converting mcount calls to jmp . + 5\n");
-- memcpy(ftrace_nop, ftrace_test_jmp, MCOUNT_INSN_SIZE);
-+ memcpy(ftrace_nop, ktla_ktva(ftrace_test_jmp), MCOUNT_INSN_SIZE);
- break;
- }
-
-@@ -366,6 +370,8 @@ static int ftrace_mod_jmp(unsigned long ip,
- {
- unsigned char code[MCOUNT_INSN_SIZE];
-
-+ ip = ktla_ktva(ip);
-+
- if (probe_kernel_read(code, (void *)ip, MCOUNT_INSN_SIZE))
- return -EFAULT;
-
-diff --git a/arch/x86/kernel/head32.c b/arch/x86/kernel/head32.c
-index 4f8e250..87a66e9 100644
---- a/arch/x86/kernel/head32.c
-+++ b/arch/x86/kernel/head32.c
-@@ -16,13 +16,14 @@
- #include <asm/apic.h>
- #include <asm/io_apic.h>
- #include <asm/bios_ebda.h>
-+#include <asm/boot.h>
-
- static void __init i386_default_early_setup(void)
- {
- /* Initilize 32bit specific setup functions */
-- x86_init.resources.probe_roms = probe_roms;
-- x86_init.resources.reserve_resources = i386_reserve_resources;
-- x86_init.mpparse.setup_ioapic_ids = setup_ioapic_ids_from_mpc;
-+ *(void **)&x86_init.resources.probe_roms = probe_roms;
-+ *(void **)&x86_init.resources.reserve_resources = i386_reserve_resources;
-+ *(void **)&x86_init.mpparse.setup_ioapic_ids = setup_ioapic_ids_from_mpc;
-
- reserve_ebda_region();
- }
-@@ -31,7 +32,7 @@ void __init i386_start_kernel(void)
- {
- reserve_trampoline_memory();
-
-- reserve_early(__pa_symbol(&_text), __pa_symbol(&__bss_stop), "TEXT DATA BSS");
-+ reserve_early(LOAD_PHYSICAL_ADDR, __pa_symbol(&__bss_stop), "TEXT DATA BSS");
-
- #ifdef CONFIG_BLK_DEV_INITRD
- /* Reserve INITRD */
-diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
-index 34c3308..162120a 100644
---- a/arch/x86/kernel/head_32.S
-+++ b/arch/x86/kernel/head_32.S
-@@ -19,10 +19,17 @@
- #include <asm/setup.h>
- #include <asm/processor-flags.h>
- #include <asm/percpu.h>
-+#include <asm/msr-index.h>
-
- /* Physical address */
- #define pa(X) ((X) - __PAGE_OFFSET)
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+#define ta(X) (X)
-+#else
-+#define ta(X) ((X) - __PAGE_OFFSET)
-+#endif
-+
- /*
- * References to members of the new_cpu_data structure.
- */
-@@ -52,11 +59,7 @@
- * and small than max_low_pfn, otherwise will waste some page table entries
- */
-
--#if PTRS_PER_PMD > 1
--#define PAGE_TABLE_SIZE(pages) (((pages) / PTRS_PER_PMD) + PTRS_PER_PGD)
--#else
--#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PGD)
--#endif
-+#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PTE)
-
- /* Enough space to fit pagetables for the low memory linear map */
- MAPPING_BEYOND_END = \
-@@ -73,6 +76,12 @@ INIT_MAP_SIZE = PAGE_TABLE_SIZE(KERNEL_PAGES) * PAGE_SIZE_asm
- RESERVE_BRK(pagetables, INIT_MAP_SIZE)
-
- /*
-+ * Real beginning of normal "text" segment
-+ */
-+ENTRY(stext)
-+ENTRY(_stext)
-+
-+/*
- * 32-bit kernel entrypoint; only used by the boot CPU. On entry,
- * %esi points to the real-mode code as a 32-bit pointer.
- * CS and DS must be 4 GB flat segments, but we don't depend on
-@@ -80,7 +89,16 @@ RESERVE_BRK(pagetables, INIT_MAP_SIZE)
- * can.
- */
- __HEAD
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ jmp startup_32
-+/* PaX: fill first page in .text with int3 to catch NULL derefs in kernel mode */
-+.fill PAGE_SIZE-5,1,0xcc
-+#endif
-+
- ENTRY(startup_32)
-+ movl pa(stack_start),%ecx
-+
- /* test KEEP_SEGMENTS flag to see if the bootloader is asking
- us to not reload segments */
- testb $(1<<6), BP_loadflags(%esi)
-@@ -95,7 +113,62 @@ ENTRY(startup_32)
- movl %eax,%es
- movl %eax,%fs
- movl %eax,%gs
-+ movl %eax,%ss
- 2:
-+ leal -__PAGE_OFFSET(%ecx),%esp
-+
-+#ifdef CONFIG_SMP
-+ movl $pa(cpu_gdt_table),%edi
-+ movl $__per_cpu_load,%eax
-+ movw %ax,GDT_ENTRY_PERCPU * 8 + 2(%edi)
-+ rorl $16,%eax
-+ movb %al,GDT_ENTRY_PERCPU * 8 + 4(%edi)
-+ movb %ah,GDT_ENTRY_PERCPU * 8 + 7(%edi)
-+ movl $__per_cpu_end - 1,%eax
-+ subl $__per_cpu_start,%eax
-+ movw %ax,GDT_ENTRY_PERCPU * 8 + 0(%edi)
-+#endif
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ movl $NR_CPUS,%ecx
-+ movl $pa(cpu_gdt_table),%edi
-+1:
-+ movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c09700),GDT_ENTRY_KERNEL_DS * 8 + 4(%edi)
-+ movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0fb00),GDT_ENTRY_DEFAULT_USER_CS * 8 + 4(%edi)
-+ movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0f300),GDT_ENTRY_DEFAULT_USER_DS * 8 + 4(%edi)
-+ addl $PAGE_SIZE_asm,%edi
-+ loop 1b
-+#endif
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ movl $pa(boot_gdt),%edi
-+ movl $__LOAD_PHYSICAL_ADDR,%eax
-+ movw %ax,GDT_ENTRY_BOOT_CS * 8 + 2(%edi)
-+ rorl $16,%eax
-+ movb %al,GDT_ENTRY_BOOT_CS * 8 + 4(%edi)
-+ movb %ah,GDT_ENTRY_BOOT_CS * 8 + 7(%edi)
-+ rorl $16,%eax
-+
-+ ljmp $(__BOOT_CS),$1f
-+1:
-+
-+ movl $NR_CPUS,%ecx
-+ movl $pa(cpu_gdt_table),%edi
-+ addl $__PAGE_OFFSET,%eax
-+1:
-+ movb $0xc0,GDT_ENTRY_KERNEL_CS * 8 + 6(%edi)
-+ movb $0xc0,GDT_ENTRY_KERNEXEC_KERNEL_CS * 8 + 6(%edi)
-+ movw %ax,GDT_ENTRY_KERNEL_CS * 8 + 2(%edi)
-+ movw %ax,GDT_ENTRY_KERNEXEC_KERNEL_CS * 8 + 2(%edi)
-+ rorl $16,%eax
-+ movb %al,GDT_ENTRY_KERNEL_CS * 8 + 4(%edi)
-+ movb %al,GDT_ENTRY_KERNEXEC_KERNEL_CS * 8 + 4(%edi)
-+ movb %ah,GDT_ENTRY_KERNEL_CS * 8 + 7(%edi)
-+ movb %ah,GDT_ENTRY_KERNEXEC_KERNEL_CS * 8 + 7(%edi)
-+ rorl $16,%eax
-+ addl $PAGE_SIZE_asm,%edi
-+ loop 1b
-+#endif
-
- /*
- * Clear BSS first so that there are no surprises...
-@@ -140,9 +213,7 @@ ENTRY(startup_32)
- cmpl $num_subarch_entries, %eax
- jae bad_subarch
-
-- movl pa(subarch_entries)(,%eax,4), %eax
-- subl $__PAGE_OFFSET, %eax
-- jmp *%eax
-+ jmp *pa(subarch_entries)(,%eax,4)
-
- bad_subarch:
- WEAK(lguest_entry)
-@@ -154,10 +225,10 @@ WEAK(xen_entry)
- __INITDATA
-
- subarch_entries:
-- .long default_entry /* normal x86/PC */
-- .long lguest_entry /* lguest hypervisor */
-- .long xen_entry /* Xen hypervisor */
-- .long default_entry /* Moorestown MID */
-+ .long ta(default_entry) /* normal x86/PC */
-+ .long ta(lguest_entry) /* lguest hypervisor */
-+ .long ta(xen_entry) /* Xen hypervisor */
-+ .long ta(default_entry) /* Moorestown MID */
- num_subarch_entries = (. - subarch_entries) / 4
- .previous
- #endif /* CONFIG_PARAVIRT */
-@@ -218,8 +289,11 @@ default_entry:
- movl %eax, pa(max_pfn_mapped)
-
- /* Do early initialization of the fixmap area */
-- movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,%eax
-- movl %eax,pa(swapper_pg_pmd+0x1000*KPMDS-8)
-+#ifdef CONFIG_COMPAT_VDSO
-+ movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(swapper_pg_pmd+0x1000*KPMDS-8)
-+#else
-+ movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,pa(swapper_pg_pmd+0x1000*KPMDS-8)
-+#endif
- #else /* Not PAE */
-
- page_pde_offset = (__PAGE_OFFSET >> 20);
-@@ -249,8 +323,11 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
- movl %eax, pa(max_pfn_mapped)
-
- /* Do early initialization of the fixmap area */
-- movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,%eax
-- movl %eax,pa(swapper_pg_dir+0xffc)
-+#ifdef CONFIG_COMPAT_VDSO
-+ movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(swapper_pg_dir+0xffc)
-+#else
-+ movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,pa(swapper_pg_dir+0xffc)
-+#endif
- #endif
- jmp 3f
- /*
-@@ -272,6 +349,9 @@ ENTRY(startup_32_smp)
- movl %eax,%es
- movl %eax,%fs
- movl %eax,%gs
-+ movl pa(stack_start),%ecx
-+ movl %eax,%ss
-+ leal -__PAGE_OFFSET(%ecx),%esp
- #endif /* CONFIG_SMP */
- 3:
-
-@@ -297,6 +377,7 @@ ENTRY(startup_32_smp)
- orl %edx,%eax
- movl %eax,%cr4
-
-+#ifdef CONFIG_X86_PAE
- btl $5, %eax # check if PAE is enabled
- jnc 6f
-
-@@ -305,6 +386,10 @@ ENTRY(startup_32_smp)
- cpuid
- cmpl $0x80000000, %eax
- jbe 6f
-+
-+ /* Clear bogus XD_DISABLE bits */
-+ call verify_cpu
-+
- mov $0x80000001, %eax
- cpuid
- /* Execute Disable bit supported? */
-@@ -312,13 +397,17 @@ ENTRY(startup_32_smp)
- jnc 6f
-
- /* Setup EFER (Extended Feature Enable Register) */
-- movl $0xc0000080, %ecx
-+ movl $MSR_EFER, %ecx
- rdmsr
-
- btsl $11, %eax
- /* Make changes effective */
- wrmsr
-
-+ btsl $_PAGE_BIT_NX-32,pa(__supported_pte_mask+4)
-+ movl $1,pa(nx_enabled)
-+#endif
-+
- 6:
-
- /*
-@@ -331,8 +420,8 @@ ENTRY(startup_32_smp)
- movl %eax,%cr0 /* ..and set paging (PG) bit */
- ljmp $__BOOT_CS,$1f /* Clear prefetch and normalize %eip */
- 1:
-- /* Set up the stack pointer */
-- lss stack_start,%esp
-+ /* Shift the stack pointer to a virtual address */
-+ addl $__PAGE_OFFSET, %esp
-
- /*
- * Initialize eflags. Some BIOS's leave bits like NT set. This would
-@@ -344,9 +433,7 @@ ENTRY(startup_32_smp)
-
- #ifdef CONFIG_SMP
- cmpb $0, ready
-- jz 1f /* Initial CPU cleans BSS */
-- jmp checkCPUtype
--1:
-+ jnz checkCPUtype
- #endif /* CONFIG_SMP */
-
- /*
-@@ -424,7 +511,7 @@ is386: movl $2,%ecx # set MP
- 1: movl $(__KERNEL_DS),%eax # reload all the segment registers
- movl %eax,%ss # after changing gdt.
-
-- movl $(__USER_DS),%eax # DS/ES contains default USER segment
-+# movl $(__KERNEL_DS),%eax # DS/ES contains default KERNEL segment
- movl %eax,%ds
- movl %eax,%es
-
-@@ -438,15 +525,22 @@ is386: movl $2,%ecx # set MP
- */
- cmpb $0,ready
- jne 1f
-- movl $per_cpu__gdt_page,%eax
-+ movl $cpu_gdt_table,%eax
- movl $per_cpu__stack_canary,%ecx
-+#ifdef CONFIG_SMP
-+ addl $__per_cpu_load,%ecx
-+#endif
- movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
- shrl $16, %ecx
- movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
- movb %ch, 8 * GDT_ENTRY_STACK_CANARY + 7(%eax)
- 1:
--#endif
- movl $(__KERNEL_STACK_CANARY),%eax
-+#elif defined(CONFIG_PAX_MEMORY_UDEREF)
-+ movl $(__USER_DS),%eax
-+#else
-+ xorl %eax,%eax
-+#endif
- movl %eax,%gs
-
- xorl %eax,%eax # Clear LDT
-@@ -454,14 +548,7 @@ is386: movl $2,%ecx # set MP
-
- cld # gcc2 wants the direction flag cleared at all times
- pushl $0 # fake return address for unwinder
--#ifdef CONFIG_SMP
-- movb ready, %cl
- movb $1, ready
-- cmpb $0,%cl # the first CPU calls start_kernel
-- je 1f
-- movl (stack_start), %esp
--1:
--#endif /* CONFIG_SMP */
- jmp *(initial_code)
-
- /*
-@@ -546,22 +633,22 @@ early_page_fault:
- jmp early_fault
-
- early_fault:
-- cld
- #ifdef CONFIG_PRINTK
-+ cmpl $1,%ss:early_recursion_flag
-+ je hlt_loop
-+ incl %ss:early_recursion_flag
-+ cld
- pusha
- movl $(__KERNEL_DS),%eax
- movl %eax,%ds
- movl %eax,%es
-- cmpl $2,early_recursion_flag
-- je hlt_loop
-- incl early_recursion_flag
- movl %cr2,%eax
- pushl %eax
- pushl %edx /* trapno */
- pushl $fault_msg
- call printk
-+; call dump_stack
- #endif
-- call dump_stack
- hlt_loop:
- hlt
- jmp hlt_loop
-@@ -569,8 +656,11 @@ hlt_loop:
- /* This is the default interrupt "handler" :-) */
- ALIGN
- ignore_int:
-- cld
- #ifdef CONFIG_PRINTK
-+ cmpl $2,%ss:early_recursion_flag
-+ je hlt_loop
-+ incl %ss:early_recursion_flag
-+ cld
- pushl %eax
- pushl %ecx
- pushl %edx
-@@ -579,9 +669,6 @@ ignore_int:
- movl $(__KERNEL_DS),%eax
- movl %eax,%ds
- movl %eax,%es
-- cmpl $2,early_recursion_flag
-- je hlt_loop
-- incl early_recursion_flag
- pushl 16(%esp)
- pushl 24(%esp)
- pushl 32(%esp)
-@@ -600,6 +687,8 @@ ignore_int:
- #endif
- iret
-
-+#include "verify_cpu.S"
-+
- __REFDATA
- .align 4
- ENTRY(initial_code)
-@@ -610,31 +699,47 @@ ENTRY(initial_page_table)
- /*
- * BSS section
- */
--__PAGE_ALIGNED_BSS
-- .align PAGE_SIZE_asm
- #ifdef CONFIG_X86_PAE
-+.section .swapper_pg_pmd,"a",@progbits
- swapper_pg_pmd:
- .fill 1024*KPMDS,4,0
- #else
-+.section .swapper_pg_dir,"a",@progbits
- ENTRY(swapper_pg_dir)
- .fill 1024,4,0
- #endif
-+.section .swapper_pg_fixmap,"a",@progbits
- swapper_pg_fixmap:
- .fill 1024,4,0
- #ifdef CONFIG_X86_TRAMPOLINE
-+.section .trampoline_pg_dir,"a",@progbits
- ENTRY(trampoline_pg_dir)
-+#ifdef CONFIG_X86_PAE
-+ .fill 4,8,0
-+#else
- .fill 1024,4,0
- #endif
-+#endif
-+
-+.section .empty_zero_page,"a",@progbits
- ENTRY(empty_zero_page)
- .fill 4096,1,0
-
- /*
-+ * The IDT has to be page-aligned to simplify the Pentium
-+ * F0 0F bug workaround.. We have a special link segment
-+ * for this.
-+ */
-+.section .idt,"a",@progbits
-+ENTRY(idt_table)
-+ .fill 256,8,0
-+
-+/*
- * This starts the data section.
- */
- #ifdef CONFIG_X86_PAE
--__PAGE_ALIGNED_DATA
-- /* Page-aligned for the benefit of paravirt? */
-- .align PAGE_SIZE_asm
-+.section .swapper_pg_dir,"a",@progbits
-+
- ENTRY(swapper_pg_dir)
- .long pa(swapper_pg_pmd+PGD_IDENT_ATTR),0 /* low identity map */
- # if KPMDS == 3
-@@ -653,15 +758,24 @@ ENTRY(swapper_pg_dir)
- # error "Kernel PMDs should be 1, 2 or 3"
- # endif
- .align PAGE_SIZE_asm /* needs to be page-sized too */
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ENTRY(cpu_pgd)
-+ .rept NR_CPUS
-+ .fill 4,8,0
-+ .endr
-+#endif
-+
- #endif
-
- .data
-+.balign 4
- ENTRY(stack_start)
-- .long init_thread_union+THREAD_SIZE
-- .long __BOOT_DS
-+ .long init_thread_union+THREAD_SIZE-8
-
- ready: .byte 0
-
-+.section .rodata,"a",@progbits
- early_recursion_flag:
- .long 0
-
-@@ -697,7 +811,7 @@ fault_msg:
- .word 0 # 32 bit align gdt_desc.address
- boot_gdt_descr:
- .word __BOOT_DS+7
-- .long boot_gdt - __PAGE_OFFSET
-+ .long pa(boot_gdt)
-
- .word 0 # 32-bit align idt_desc.address
- idt_descr:
-@@ -708,7 +822,7 @@ idt_descr:
- .word 0 # 32 bit align gdt_desc.address
- ENTRY(early_gdt_descr)
- .word GDT_ENTRIES*8-1
-- .long per_cpu__gdt_page /* Overwritten for secondary CPUs */
-+ .long cpu_gdt_table /* Overwritten for secondary CPUs */
-
- /*
- * The boot_gdt must mirror the equivalent in setup.S and is
-@@ -717,5 +831,65 @@ ENTRY(early_gdt_descr)
- .align L1_CACHE_BYTES
- ENTRY(boot_gdt)
- .fill GDT_ENTRY_BOOT_CS,8,0
-- .quad 0x00cf9a000000ffff /* kernel 4GB code at 0x00000000 */
-- .quad 0x00cf92000000ffff /* kernel 4GB data at 0x00000000 */
-+ .quad 0x00cf9b000000ffff /* kernel 4GB code at 0x00000000 */
-+ .quad 0x00cf93000000ffff /* kernel 4GB data at 0x00000000 */
-+
-+ .align PAGE_SIZE_asm
-+ENTRY(cpu_gdt_table)
-+ .rept NR_CPUS
-+ .quad 0x0000000000000000 /* NULL descriptor */
-+ .quad 0x0000000000000000 /* 0x0b reserved */
-+ .quad 0x0000000000000000 /* 0x13 reserved */
-+ .quad 0x0000000000000000 /* 0x1b reserved */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ .quad 0x00cf9b000000ffff /* 0x20 alternate kernel 4GB code at 0x00000000 */
-+#else
-+ .quad 0x0000000000000000 /* 0x20 unused */
-+#endif
-+
-+ .quad 0x0000000000000000 /* 0x28 unused */
-+ .quad 0x0000000000000000 /* 0x33 TLS entry 1 */
-+ .quad 0x0000000000000000 /* 0x3b TLS entry 2 */
-+ .quad 0x0000000000000000 /* 0x43 TLS entry 3 */
-+ .quad 0x0000000000000000 /* 0x4b reserved */
-+ .quad 0x0000000000000000 /* 0x53 reserved */
-+ .quad 0x0000000000000000 /* 0x5b reserved */
-+
-+ .quad 0x00cf9b000000ffff /* 0x60 kernel 4GB code at 0x00000000 */
-+ .quad 0x00cf93000000ffff /* 0x68 kernel 4GB data at 0x00000000 */
-+ .quad 0x00cffb000000ffff /* 0x73 user 4GB code at 0x00000000 */
-+ .quad 0x00cff3000000ffff /* 0x7b user 4GB data at 0x00000000 */
-+
-+ .quad 0x0000000000000000 /* 0x80 TSS descriptor */
-+ .quad 0x0000000000000000 /* 0x88 LDT descriptor */
-+
-+ /*
-+ * Segments used for calling PnP BIOS have byte granularity.
-+ * The code segments and data segments have fixed 64k limits,
-+ * the transfer segment sizes are set at run time.
-+ */
-+ .quad 0x00409b000000ffff /* 0x90 32-bit code */
-+ .quad 0x00009b000000ffff /* 0x98 16-bit code */
-+ .quad 0x000093000000ffff /* 0xa0 16-bit data */
-+ .quad 0x0000930000000000 /* 0xa8 16-bit data */
-+ .quad 0x0000930000000000 /* 0xb0 16-bit data */
-+
-+ /*
-+ * The APM segments have byte granularity and their bases
-+ * are set at run time. All have 64k limits.
-+ */
-+ .quad 0x00409b000000ffff /* 0xb8 APM CS code */
-+ .quad 0x00009b000000ffff /* 0xc0 APM CS 16 code (16 bit) */
-+ .quad 0x004093000000ffff /* 0xc8 APM DS data */
-+
-+ .quad 0x00c0930000000000 /* 0xd0 - ESPFIX SS */
-+ .quad 0x0040930000000000 /* 0xd8 - PERCPU */
-+ .quad 0x0040910000000017 /* 0xe0 - STACK_CANARY */
-+ .quad 0x0000000000000000 /* 0xe8 - PCIBIOS_CS */
-+ .quad 0x0000000000000000 /* 0xf0 - PCIBIOS_DS */
-+ .quad 0x0000000000000000 /* 0xf8 - GDT entry 31: double-fault TSS */
-+
-+ /* Be sure this is zeroed to avoid false validations in Xen */
-+ .fill PAGE_SIZE_asm - GDT_SIZE,1,0
-+ .endr
-diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
-index 780cd92..758b2a6 100644
---- a/arch/x86/kernel/head_64.S
-+++ b/arch/x86/kernel/head_64.S
-@@ -19,6 +19,8 @@
- #include <asm/cache.h>
- #include <asm/processor-flags.h>
- #include <asm/percpu.h>
-+#include <asm/cpufeature.h>
-+#include <asm/alternative-asm.h>
-
- #ifdef CONFIG_PARAVIRT
- #include <asm/asm-offsets.h>
-@@ -38,6 +40,12 @@ L4_PAGE_OFFSET = pgd_index(__PAGE_OFFSET)
- L3_PAGE_OFFSET = pud_index(__PAGE_OFFSET)
- L4_START_KERNEL = pgd_index(__START_KERNEL_map)
- L3_START_KERNEL = pud_index(__START_KERNEL_map)
-+L4_VMALLOC_START = pgd_index(VMALLOC_START)
-+L3_VMALLOC_START = pud_index(VMALLOC_START)
-+L4_VMALLOC_END = pgd_index(VMALLOC_END)
-+L3_VMALLOC_END = pud_index(VMALLOC_END)
-+L4_VMEMMAP_START = pgd_index(VMEMMAP_START)
-+L3_VMEMMAP_START = pud_index(VMEMMAP_START)
-
- .text
- __HEAD
-@@ -85,35 +93,23 @@ startup_64:
- */
- addq %rbp, init_level4_pgt + 0(%rip)
- addq %rbp, init_level4_pgt + (L4_PAGE_OFFSET*8)(%rip)
-+ addq %rbp, init_level4_pgt + (L4_VMALLOC_START*8)(%rip)
-+ addq %rbp, init_level4_pgt + (L4_VMALLOC_END*8)(%rip)
-+ addq %rbp, init_level4_pgt + (L4_VMEMMAP_START*8)(%rip)
- addq %rbp, init_level4_pgt + (L4_START_KERNEL*8)(%rip)
-
- addq %rbp, level3_ident_pgt + 0(%rip)
-+#ifndef CONFIG_XEN
-+ addq %rbp, level3_ident_pgt + 8(%rip)
-+#endif
-
-- addq %rbp, level3_kernel_pgt + (510*8)(%rip)
-- addq %rbp, level3_kernel_pgt + (511*8)(%rip)
-+ addq %rbp, level3_vmemmap_pgt + (L3_VMEMMAP_START*8)(%rip)
-+
-+ addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8)(%rip)
-+ addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8+8)(%rip)
-
- addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
--
-- /* Add an Identity mapping if I am above 1G */
-- leaq _text(%rip), %rdi
-- andq $PMD_PAGE_MASK, %rdi
--
-- movq %rdi, %rax
-- shrq $PUD_SHIFT, %rax
-- andq $(PTRS_PER_PUD - 1), %rax
-- jz ident_complete
--
-- leaq (level2_spare_pgt - __START_KERNEL_map + _KERNPG_TABLE)(%rbp), %rdx
-- leaq level3_ident_pgt(%rip), %rbx
-- movq %rdx, 0(%rbx, %rax, 8)
--
-- movq %rdi, %rax
-- shrq $PMD_SHIFT, %rax
-- andq $(PTRS_PER_PMD - 1), %rax
-- leaq __PAGE_KERNEL_IDENT_LARGE_EXEC(%rdi), %rdx
-- leaq level2_spare_pgt(%rip), %rbx
-- movq %rdx, 0(%rbx, %rax, 8)
--ident_complete:
-+ addq %rbp, level2_fixmap_pgt + (507*8)(%rip)
-
- /*
- * Fixup the kernel text+data virtual addresses. Note that
-@@ -161,8 +157,8 @@ ENTRY(secondary_startup_64)
- * after the boot processor executes this code.
- */
-
-- /* Enable PAE mode and PGE */
-- movl $(X86_CR4_PAE | X86_CR4_PGE), %eax
-+ /* Enable PAE mode and PSE/PGE */
-+ movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
- movq %rax, %cr4
-
- /* Setup early boot stage 4 level pagetables. */
-@@ -184,9 +180,16 @@ ENTRY(secondary_startup_64)
- movl $MSR_EFER, %ecx
- rdmsr
- btsl $_EFER_SCE, %eax /* Enable System Call */
-- btl $20,%edi /* No Execute supported? */
-+ btl $(X86_FEATURE_NX & 31),%edi /* No Execute supported? */
- jnc 1f
- btsl $_EFER_NX, %eax
-+ leaq init_level4_pgt(%rip), %rdi
-+#ifndef CONFIG_EFI
-+ btsq $_PAGE_BIT_NX, 8*L4_PAGE_OFFSET(%rdi)
-+#endif
-+ btsq $_PAGE_BIT_NX, 8*L4_VMALLOC_START(%rdi)
-+ btsq $_PAGE_BIT_NX, 8*L4_VMALLOC_END(%rdi)
-+ btsq $_PAGE_BIT_NX, 8*L4_VMEMMAP_START(%rdi)
- 1: wrmsr /* Make changes effective */
-
- /* Setup cr0 */
-@@ -249,6 +252,7 @@ ENTRY(secondary_startup_64)
- * jump. In addition we need to ensure %cs is set so we make this
- * a far return.
- */
-+ pax_set_fptr_mask
- movq initial_code(%rip),%rax
- pushq $0 # fake return address to stop unwinder
- pushq $__KERNEL_CS # set correct cs
-@@ -262,16 +266,16 @@ ENTRY(secondary_startup_64)
- .quad x86_64_start_kernel
- ENTRY(initial_gs)
- .quad INIT_PER_CPU_VAR(irq_stack_union)
-- __FINITDATA
-
- ENTRY(stack_start)
- .quad init_thread_union+THREAD_SIZE-8
- .word 0
-+ __FINITDATA
-
- bad_address:
- jmp bad_address
-
-- .section ".init.text","ax"
-+ __INIT
- #ifdef CONFIG_EARLY_PRINTK
- .globl early_idt_handlers
- early_idt_handlers:
-@@ -316,18 +320,23 @@ ENTRY(early_idt_handler)
- #endif /* EARLY_PRINTK */
- 1: hlt
- jmp 1b
-+ .previous
-
- #ifdef CONFIG_EARLY_PRINTK
-+ __INITDATA
- early_recursion_flag:
- .long 0
-+ .previous
-
-+ .section .rodata,"a",@progbits
- early_idt_msg:
- .asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n"
- early_idt_ripmsg:
- .asciz "RIP %s\n"
-+ .previous
- #endif /* CONFIG_EARLY_PRINTK */
-- .previous
-
-+ .section .rodata,"a",@progbits
- #define NEXT_PAGE(name) \
- .balign PAGE_SIZE; \
- ENTRY(name)
-@@ -350,13 +359,41 @@ NEXT_PAGE(init_level4_pgt)
- .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
- .org init_level4_pgt + L4_PAGE_OFFSET*8, 0
- .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
-+ .org init_level4_pgt + L4_VMALLOC_START*8, 0
-+ .quad level3_vmalloc_start_pgt - __START_KERNEL_map + _KERNPG_TABLE
-+ .org init_level4_pgt + L4_VMALLOC_END*8, 0
-+ .quad level3_vmalloc_end_pgt - __START_KERNEL_map + _KERNPG_TABLE
-+ .org init_level4_pgt + L4_VMEMMAP_START*8, 0
-+ .quad level3_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
- .org init_level4_pgt + L4_START_KERNEL*8, 0
- /* (2^48-(2*1024*1024*1024))/(2^39) = 511 */
- .quad level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE
-
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+NEXT_PAGE(cpu_pgd)
-+ .rept NR_CPUS
-+ .fill 512,8,0
-+ .endr
-+#endif
-+
- NEXT_PAGE(level3_ident_pgt)
- .quad level2_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
-+#ifdef CONFIG_XEN
- .fill 511,8,0
-+#else
-+ .quad level2_ident_pgt + PAGE_SIZE - __START_KERNEL_map + _KERNPG_TABLE
-+ .fill 510,8,0
-+#endif
-+
-+NEXT_PAGE(level3_vmalloc_start_pgt)
-+ .fill 512,8,0
-+
-+NEXT_PAGE(level3_vmalloc_end_pgt)
-+ .fill 512,8,0
-+
-+NEXT_PAGE(level3_vmemmap_pgt)
-+ .fill L3_VMEMMAP_START,8,0
-+ .quad level2_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
-
- NEXT_PAGE(level3_kernel_pgt)
- .fill L3_START_KERNEL,8,0
-@@ -364,20 +401,23 @@ NEXT_PAGE(level3_kernel_pgt)
- .quad level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE
- .quad level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
-
-+NEXT_PAGE(level2_vmemmap_pgt)
-+ .fill 512,8,0
-+
- NEXT_PAGE(level2_fixmap_pgt)
-- .fill 506,8,0
-- .quad level1_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
-- /* 8MB reserved for vsyscalls + a 2MB hole = 4 + 1 entries */
-- .fill 5,8,0
-+ .fill 507,8,0
-+ .quad level1_vsyscall_pgt - __START_KERNEL_map + _PAGE_TABLE
-+ /* 6MB reserved for vsyscalls + a 2MB hole = 3 + 1 entries */
-+ .fill 4,8,0
-
--NEXT_PAGE(level1_fixmap_pgt)
-+NEXT_PAGE(level1_vsyscall_pgt)
- .fill 512,8,0
-
--NEXT_PAGE(level2_ident_pgt)
-- /* Since I easily can, map the first 1G.
-+ /* Since I easily can, map the first 2G.
- * Don't set NX because code runs from these pages.
- */
-- PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, PTRS_PER_PMD)
-+NEXT_PAGE(level2_ident_pgt)
-+ PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, 2*PTRS_PER_PMD)
-
- NEXT_PAGE(level2_kernel_pgt)
- /*
-@@ -390,33 +430,55 @@ NEXT_PAGE(level2_kernel_pgt)
- * If you want to increase this then increase MODULES_VADDR
- * too.)
- */
-- PMDS(0, __PAGE_KERNEL_LARGE_EXEC,
-- KERNEL_IMAGE_SIZE/PMD_SIZE)
--
--NEXT_PAGE(level2_spare_pgt)
-- .fill 512, 8, 0
-+ PMDS(0, __PAGE_KERNEL_LARGE_EXEC, KERNEL_IMAGE_SIZE/PMD_SIZE)
-
- #undef PMDS
- #undef NEXT_PAGE
-
-- .data
-+ .align PAGE_SIZE
-+ENTRY(cpu_gdt_table)
-+ .rept NR_CPUS
-+ .quad 0x0000000000000000 /* NULL descriptor */
-+ .quad 0x00cf9b000000ffff /* __KERNEL32_CS */
-+ .quad 0x00af9b000000ffff /* __KERNEL_CS */
-+ .quad 0x00cf93000000ffff /* __KERNEL_DS */
-+ .quad 0x00cffb000000ffff /* __USER32_CS */
-+ .quad 0x00cff3000000ffff /* __USER_DS, __USER32_DS */
-+ .quad 0x00affb000000ffff /* __USER_CS */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ .quad 0x00af9b000000ffff /* __KERNEXEC_KERNEL_CS */
-+#else
-+ .quad 0x0 /* unused */
-+#endif
-+
-+ .quad 0,0 /* TSS */
-+ .quad 0,0 /* LDT */
-+ .quad 0,0,0 /* three TLS descriptors */
-+ .quad 0x0000f40000000000 /* node/CPU stored in limit */
-+ /* asm/segment.h:GDT_ENTRIES must match this */
-+
-+ /* zero the remaining page */
-+ .fill PAGE_SIZE / 8 - GDT_ENTRIES,8,0
-+ .endr
-+
- .align 16
- .globl early_gdt_descr
- early_gdt_descr:
- .word GDT_ENTRIES*8-1
- early_gdt_descr_base:
-- .quad INIT_PER_CPU_VAR(gdt_page)
-+ .quad cpu_gdt_table
-
- ENTRY(phys_base)
- /* This must match the first entry in level2_kernel_pgt */
- .quad 0x0000000000000000
-
- #include "../../x86/xen/xen-head.S"
--
-- .section .bss, "aw", @nobits
-+
-+ .section .rodata,"a",@progbits
- .align L1_CACHE_BYTES
- ENTRY(idt_table)
-- .skip IDT_ENTRIES * 16
-+ .fill 512,8,0
-
- __PAGE_ALIGNED_BSS
- .align PAGE_SIZE
-diff --git a/arch/x86/kernel/i386_ksyms_32.c b/arch/x86/kernel/i386_ksyms_32.c
-index 9c3bd4a..e1d9b35 100644
---- a/arch/x86/kernel/i386_ksyms_32.c
-+++ b/arch/x86/kernel/i386_ksyms_32.c
-@@ -20,8 +20,12 @@ extern void cmpxchg8b_emu(void);
- EXPORT_SYMBOL(cmpxchg8b_emu);
- #endif
-
-+EXPORT_SYMBOL_GPL(cpu_gdt_table);
-+
- /* Networking helper routines. */
- EXPORT_SYMBOL(csum_partial_copy_generic);
-+EXPORT_SYMBOL(csum_partial_copy_generic_to_user);
-+EXPORT_SYMBOL(csum_partial_copy_generic_from_user);
-
- EXPORT_SYMBOL(__get_user_1);
- EXPORT_SYMBOL(__get_user_2);
-@@ -36,3 +40,7 @@ EXPORT_SYMBOL(strstr);
-
- EXPORT_SYMBOL(csum_partial);
- EXPORT_SYMBOL(empty_zero_page);
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+EXPORT_SYMBOL(__LOAD_PHYSICAL_ADDR);
-+#endif
-diff --git a/arch/x86/kernel/i8259.c b/arch/x86/kernel/i8259.c
-index df89102..a244320 100644
---- a/arch/x86/kernel/i8259.c
-+++ b/arch/x86/kernel/i8259.c
-@@ -208,7 +208,7 @@ spurious_8259A_irq:
- "spurious 8259A interrupt: IRQ%d.\n", irq);
- spurious_irq_mask |= irqmask;
- }
-- atomic_inc(&irq_err_count);
-+ atomic_inc_unchecked(&irq_err_count);
- /*
- * Theoretically we do not have to handle this IRQ,
- * but in Linux this does not cause problems and is
-diff --git a/arch/x86/kernel/init_task.c b/arch/x86/kernel/init_task.c
-index 3a54dcb..1c22348 100644
---- a/arch/x86/kernel/init_task.c
-+++ b/arch/x86/kernel/init_task.c
-@@ -20,8 +20,7 @@ static struct sighand_struct init_sighand = INIT_SIGHAND(init_sighand);
- * way process stacks are handled. This is done by having a special
- * "init_task" linker map entry..
- */
--union thread_union init_thread_union __init_task_data =
-- { INIT_THREAD_INFO(init_task) };
-+union thread_union init_thread_union __init_task_data;
-
- /*
- * Initial task structure.
-@@ -38,5 +37,5 @@ EXPORT_SYMBOL(init_task);
- * section. Since TSS's are completely CPU-local, we want them
- * on exact cacheline boundaries, to eliminate cacheline ping-pong.
- */
--DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss) = INIT_TSS;
--
-+struct tss_struct init_tss[NR_CPUS] ____cacheline_internodealigned_in_smp = { [0 ... NR_CPUS-1] = INIT_TSS };
-+EXPORT_SYMBOL(init_tss);
-diff --git a/arch/x86/kernel/ioport.c b/arch/x86/kernel/ioport.c
-index 99c4d30..74c84e9 100644
---- a/arch/x86/kernel/ioport.c
-+++ b/arch/x86/kernel/ioport.c
-@@ -6,6 +6,7 @@
- #include <linux/sched.h>
- #include <linux/kernel.h>
- #include <linux/capability.h>
-+#include <linux/security.h>
- #include <linux/errno.h>
- #include <linux/types.h>
- #include <linux/ioport.h>
-@@ -41,6 +42,12 @@ asmlinkage long sys_ioperm(unsigned long from, unsigned long num, int turn_on)
-
- if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
- return -EINVAL;
-+#ifdef CONFIG_GRKERNSEC_IO
-+ if (turn_on && grsec_disable_privio) {
-+ gr_handle_ioperm();
-+ return -EPERM;
-+ }
-+#endif
- if (turn_on && !capable(CAP_SYS_RAWIO))
- return -EPERM;
-
-@@ -67,7 +74,7 @@ asmlinkage long sys_ioperm(unsigned long from, unsigned long num, int turn_on)
- * because the ->io_bitmap_max value must match the bitmap
- * contents:
- */
-- tss = &per_cpu(init_tss, get_cpu());
-+ tss = init_tss + get_cpu();
-
- set_bitmap(t->io_bitmap_ptr, from, num, !turn_on);
-
-@@ -111,6 +118,12 @@ static int do_iopl(unsigned int level, struct pt_regs *regs)
- return -EINVAL;
- /* Trying to gain more privileges? */
- if (level > old) {
-+#ifdef CONFIG_GRKERNSEC_IO
-+ if (grsec_disable_privio) {
-+ gr_handle_iopl();
-+ return -EPERM;
-+ }
-+#endif
- if (!capable(CAP_SYS_RAWIO))
- return -EPERM;
- }
-diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
-index 04bbd52..83a07d9 100644
---- a/arch/x86/kernel/irq.c
-+++ b/arch/x86/kernel/irq.c
-@@ -15,7 +15,7 @@
- #include <asm/mce.h>
- #include <asm/hw_irq.h>
-
--atomic_t irq_err_count;
-+atomic_unchecked_t irq_err_count;
-
- /* Function pointer for generic interrupt vector handling */
- void (*generic_interrupt_extension)(void) = NULL;
-@@ -114,9 +114,9 @@ static int show_other_interrupts(struct seq_file *p, int prec)
- seq_printf(p, "%10u ", per_cpu(mce_poll_count, j));
- seq_printf(p, " Machine check polls\n");
- #endif
-- seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read(&irq_err_count));
-+ seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read_unchecked(&irq_err_count));
- #if defined(CONFIG_X86_IO_APIC)
-- seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read(&irq_mis_count));
-+ seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read_unchecked(&irq_mis_count));
- #endif
- return 0;
- }
-@@ -209,10 +209,10 @@ u64 arch_irq_stat_cpu(unsigned int cpu)
-
- u64 arch_irq_stat(void)
- {
-- u64 sum = atomic_read(&irq_err_count);
-+ u64 sum = atomic_read_unchecked(&irq_err_count);
-
- #ifdef CONFIG_X86_IO_APIC
-- sum += atomic_read(&irq_mis_count);
-+ sum += atomic_read_unchecked(&irq_mis_count);
- #endif
- return sum;
- }
-diff --git a/arch/x86/kernel/irq_32.c b/arch/x86/kernel/irq_32.c
-index 7d35d0f..03f1d52 100644
---- a/arch/x86/kernel/irq_32.c
-+++ b/arch/x86/kernel/irq_32.c
-@@ -35,7 +35,7 @@ static int check_stack_overflow(void)
- __asm__ __volatile__("andl %%esp,%0" :
- "=r" (sp) : "0" (THREAD_SIZE - 1));
-
-- return sp < (sizeof(struct thread_info) + STACK_WARN);
-+ return sp < STACK_WARN;
- }
-
- static void print_stack_overflow(void)
-@@ -54,9 +54,9 @@ static inline void print_stack_overflow(void) { }
- * per-CPU IRQ handling contexts (thread information and stack)
- */
- union irq_ctx {
-- struct thread_info tinfo;
-- u32 stack[THREAD_SIZE/sizeof(u32)];
--} __attribute__((aligned(PAGE_SIZE)));
-+ unsigned long previous_esp;
-+ u32 stack[THREAD_SIZE/sizeof(u32)];
-+} __attribute__((aligned(THREAD_SIZE)));
-
- static DEFINE_PER_CPU(union irq_ctx *, hardirq_ctx);
- static DEFINE_PER_CPU(union irq_ctx *, softirq_ctx);
-@@ -78,10 +78,9 @@ static void call_on_stack(void *func, void *stack)
- static inline int
- execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
- {
-- union irq_ctx *curctx, *irqctx;
-+ union irq_ctx *irqctx;
- u32 *isp, arg1, arg2;
-
-- curctx = (union irq_ctx *) current_thread_info();
- irqctx = __get_cpu_var(hardirq_ctx);
-
- /*
-@@ -90,21 +89,16 @@ execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
- * handler) we can't do that and just have to keep using the
- * current stack (which is the irq stack already after all)
- */
-- if (unlikely(curctx == irqctx))
-+ if (unlikely((void *)current_stack_pointer - (void *)irqctx < THREAD_SIZE))
- return 0;
-
- /* build the stack frame on the IRQ stack */
-- isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
-- irqctx->tinfo.task = curctx->tinfo.task;
-- irqctx->tinfo.previous_esp = current_stack_pointer;
-+ isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
-+ irqctx->previous_esp = current_stack_pointer;
-
-- /*
-- * Copy the softirq bits in preempt_count so that the
-- * softirq checks work in the hardirq context.
-- */
-- irqctx->tinfo.preempt_count =
-- (irqctx->tinfo.preempt_count & ~SOFTIRQ_MASK) |
-- (curctx->tinfo.preempt_count & SOFTIRQ_MASK);
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ __set_fs(MAKE_MM_SEG(0));
-+#endif
-
- if (unlikely(overflow))
- call_on_stack(print_stack_overflow, isp);
-@@ -116,6 +110,11 @@ execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
- : "0" (irq), "1" (desc), "2" (isp),
- "D" (desc->handle_irq)
- : "memory", "cc", "ecx");
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ __set_fs(current_thread_info()->addr_limit);
-+#endif
-+
- return 1;
- }
-
-@@ -124,28 +123,11 @@ execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
- */
- void __cpuinit irq_ctx_init(int cpu)
- {
-- union irq_ctx *irqctx;
--
- if (per_cpu(hardirq_ctx, cpu))
- return;
-
-- irqctx = &per_cpu(hardirq_stack, cpu);
-- irqctx->tinfo.task = NULL;
-- irqctx->tinfo.exec_domain = NULL;
-- irqctx->tinfo.cpu = cpu;
-- irqctx->tinfo.preempt_count = HARDIRQ_OFFSET;
-- irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
--
-- per_cpu(hardirq_ctx, cpu) = irqctx;
--
-- irqctx = &per_cpu(softirq_stack, cpu);
-- irqctx->tinfo.task = NULL;
-- irqctx->tinfo.exec_domain = NULL;
-- irqctx->tinfo.cpu = cpu;
-- irqctx->tinfo.preempt_count = 0;
-- irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
--
-- per_cpu(softirq_ctx, cpu) = irqctx;
-+ per_cpu(hardirq_ctx, cpu) = &per_cpu(hardirq_stack, cpu);
-+ per_cpu(softirq_ctx, cpu) = &per_cpu(softirq_stack, cpu);
-
- printk(KERN_DEBUG "CPU %u irqstacks, hard=%p soft=%p\n",
- cpu, per_cpu(hardirq_ctx, cpu), per_cpu(softirq_ctx, cpu));
-@@ -159,7 +141,6 @@ void irq_ctx_exit(int cpu)
- asmlinkage void do_softirq(void)
- {
- unsigned long flags;
-- struct thread_info *curctx;
- union irq_ctx *irqctx;
- u32 *isp;
-
-@@ -169,15 +150,22 @@ asmlinkage void do_softirq(void)
- local_irq_save(flags);
-
- if (local_softirq_pending()) {
-- curctx = current_thread_info();
- irqctx = __get_cpu_var(softirq_ctx);
-- irqctx->tinfo.task = curctx->task;
-- irqctx->tinfo.previous_esp = current_stack_pointer;
-+ irqctx->previous_esp = current_stack_pointer;
-
- /* build the stack frame on the softirq stack */
-- isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
-+ isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ __set_fs(MAKE_MM_SEG(0));
-+#endif
-
- call_on_stack(__do_softirq, isp);
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ __set_fs(current_thread_info()->addr_limit);
-+#endif
-+
- /*
- * Shouldnt happen, we returned above if in_interrupt():
- */
-diff --git a/arch/x86/kernel/kdebugfs.c b/arch/x86/kernel/kdebugfs.c
-index e444357..e21e51e 100644
---- a/arch/x86/kernel/kdebugfs.c
-+++ b/arch/x86/kernel/kdebugfs.c
-@@ -26,7 +26,7 @@ struct setup_data_node {
- u32 len;
- };
-
--static ssize_t setup_data_read(struct file *file, char __user *user_buf,
-+static ssize_t __size_overflow(3) setup_data_read(struct file *file, char __user *user_buf,
- size_t count, loff_t *ppos)
- {
- struct setup_data_node *node = file->private_data;
-diff --git a/arch/x86/kernel/kgdb.c b/arch/x86/kernel/kgdb.c
-index 8d82a77..47a7f0b 100644
---- a/arch/x86/kernel/kgdb.c
-+++ b/arch/x86/kernel/kgdb.c
-@@ -42,6 +42,7 @@
- #include <linux/init.h>
- #include <linux/smp.h>
- #include <linux/nmi.h>
-+#include <linux/uaccess.h>
-
- #include <asm/apicdef.h>
- #include <asm/system.h>
-@@ -220,8 +221,12 @@ static void kgdb_correct_hw_break(void)
- dr7 |= ((breakinfo[breakno].len << 2) |
- breakinfo[breakno].type) <<
- ((breakno << 2) + 16);
-- if (breakno >= 0 && breakno <= 3)
-- set_debugreg(breakinfo[breakno].addr, breakno);
-+ if (breakno >= 0 && breakno <= 3) {
-+ if (breakinfo[breakno].type == 0)
-+ set_debugreg(ktla_ktva(breakinfo[breakno].addr), breakno);
-+ else
-+ set_debugreg(breakinfo[breakno].addr, breakno);
-+ }
-
- } else {
- if ((dr7 & breakbit) && !breakinfo[breakno].enabled) {
-@@ -390,13 +395,13 @@ int kgdb_arch_handle_exception(int e_vector, int signo, int err_code,
-
- /* clear the trace bit */
- linux_regs->flags &= ~X86_EFLAGS_TF;
-- atomic_set(&kgdb_cpu_doing_single_step, -1);
-+ atomic_set_unchecked(&kgdb_cpu_doing_single_step, -1);
-
- /* set the trace bit if we're stepping */
- if (remcomInBuffer[0] == 's') {
- linux_regs->flags |= X86_EFLAGS_TF;
- kgdb_single_step = 1;
-- atomic_set(&kgdb_cpu_doing_single_step,
-+ atomic_set_unchecked(&kgdb_cpu_doing_single_step,
- raw_smp_processor_id());
- }
-
-@@ -476,7 +481,7 @@ static int __kgdb_notify(struct die_args *args, unsigned long cmd)
- break;
-
- case DIE_DEBUG:
-- if (atomic_read(&kgdb_cpu_doing_single_step) ==
-+ if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) ==
- raw_smp_processor_id()) {
- if (user_mode(regs))
- return single_step_cont(regs, args);
-@@ -573,7 +578,27 @@ unsigned long kgdb_arch_pc(int exception, struct pt_regs *regs)
- return instruction_pointer(regs);
- }
-
--struct kgdb_arch arch_kgdb_ops = {
-+int kgdb_arch_set_breakpoint(unsigned long addr, char *saved_instr)
-+{
-+ int err;
-+
-+ addr = ktla_ktva(addr);
-+ err = probe_kernel_read(saved_instr, (char *)addr, BREAK_INSTR_SIZE);
-+ if (err)
-+ return err;
-+
-+ return probe_kernel_write((char *)addr, arch_kgdb_ops.gdb_bpt_instr,
-+ BREAK_INSTR_SIZE);
-+}
-+
-+int kgdb_arch_remove_breakpoint(unsigned long addr, char *bundle)
-+{
-+ addr = ktla_ktva(addr);
-+ return probe_kernel_write((char *)addr,
-+ (char *)bundle, BREAK_INSTR_SIZE);
-+}
-+
-+const struct kgdb_arch arch_kgdb_ops = {
- /* Breakpoint instruction: */
- .gdb_bpt_instr = { 0xcc },
- .flags = KGDB_HW_BREAKPOINT,
-diff --git a/arch/x86/kernel/kprobes.c b/arch/x86/kernel/kprobes.c
-index 7a67820..17c9752 100644
---- a/arch/x86/kernel/kprobes.c
-+++ b/arch/x86/kernel/kprobes.c
-@@ -168,9 +168,13 @@ static void __kprobes set_jmp_op(void *from, void *to)
- char op;
- s32 raddr;
- } __attribute__((packed)) * jop;
-- jop = (struct __arch_jmp_op *)from;
-+
-+ jop = (struct __arch_jmp_op *)(ktla_ktva(from));
-+
-+ pax_open_kernel();
- jop->raddr = (s32)((long)(to) - ((long)(from) + 5));
- jop->op = RELATIVEJUMP_INSTRUCTION;
-+ pax_close_kernel();
- }
-
- /*
-@@ -195,7 +199,7 @@ static int __kprobes can_boost(kprobe_opcode_t *opcodes)
- kprobe_opcode_t opcode;
- kprobe_opcode_t *orig_opcodes = opcodes;
-
-- if (search_exception_tables((unsigned long)opcodes))
-+ if (search_exception_tables(ktva_ktla((unsigned long)opcodes)))
- return 0; /* Page fault may occur on this address. */
-
- retry:
-@@ -339,7 +343,9 @@ static void __kprobes fix_riprel(struct kprobe *p)
- disp = (u8 *) p->addr + *((s32 *) insn) -
- (u8 *) p->ainsn.insn;
- BUG_ON((s64) (s32) disp != disp); /* Sanity check. */
-+ pax_open_kernel();
- *(s32 *)insn = (s32) disp;
-+ pax_close_kernel();
- }
- }
- #endif
-@@ -347,16 +353,18 @@ static void __kprobes fix_riprel(struct kprobe *p)
-
- static void __kprobes arch_copy_kprobe(struct kprobe *p)
- {
-- memcpy(p->ainsn.insn, p->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
-+ pax_open_kernel();
-+ memcpy(p->ainsn.insn, ktla_ktva(p->addr), MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
-+ pax_close_kernel();
-
- fix_riprel(p);
-
-- if (can_boost(p->addr))
-+ if (can_boost(ktla_ktva(p->addr)))
- p->ainsn.boostable = 0;
- else
- p->ainsn.boostable = -1;
-
-- p->opcode = *p->addr;
-+ p->opcode = *(ktla_ktva(p->addr));
- }
-
- int __kprobes arch_prepare_kprobe(struct kprobe *p)
-@@ -432,9 +440,9 @@ static void __kprobes prepare_singlestep(struct kprobe *p, struct pt_regs *regs)
- regs->flags &= ~X86_EFLAGS_IF;
- /* single step inline if the instruction is an int3 */
- if (p->opcode == BREAKPOINT_INSTRUCTION)
-- regs->ip = (unsigned long)p->addr;
-+ regs->ip = ktla_ktva((unsigned long)p->addr);
- else
-- regs->ip = (unsigned long)p->ainsn.insn;
-+ regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
- }
-
- void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri,
-@@ -455,7 +463,7 @@ static void __kprobes setup_singlestep(struct kprobe *p, struct pt_regs *regs,
- if (p->ainsn.boostable == 1 && !p->post_handler) {
- /* Boost up -- we can execute copied instructions directly */
- reset_current_kprobe();
-- regs->ip = (unsigned long)p->ainsn.insn;
-+ regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
- preempt_enable_no_resched();
- return;
- }
-@@ -525,7 +533,7 @@ static int __kprobes kprobe_handler(struct pt_regs *regs)
- struct kprobe_ctlblk *kcb;
-
- addr = (kprobe_opcode_t *)(regs->ip - sizeof(kprobe_opcode_t));
-- if (*addr != BREAKPOINT_INSTRUCTION) {
-+ if (*(kprobe_opcode_t *)ktla_ktva((unsigned long)addr) != BREAKPOINT_INSTRUCTION) {
- /*
- * The breakpoint instruction was removed right
- * after we hit it. Another cpu has removed
-@@ -637,6 +645,9 @@ static void __used __kprobes kretprobe_trampoline_holder(void)
- /* Skip orig_ax, ip, cs */
- " addq $24, %rsp\n"
- " popfq\n"
-+#ifdef KERNEXEC_PLUGIN
-+ " btsq $63,(%rsp)\n"
-+#endif
- #else
- " pushf\n"
- /*
-@@ -777,7 +788,7 @@ static void __kprobes resume_execution(struct kprobe *p,
- struct pt_regs *regs, struct kprobe_ctlblk *kcb)
- {
- unsigned long *tos = stack_addr(regs);
-- unsigned long copy_ip = (unsigned long)p->ainsn.insn;
-+ unsigned long copy_ip = ktva_ktla((unsigned long)p->ainsn.insn);
- unsigned long orig_ip = (unsigned long)p->addr;
- kprobe_opcode_t *insn = p->ainsn.insn;
-
-@@ -960,7 +971,7 @@ int __kprobes kprobe_exceptions_notify(struct notifier_block *self,
- struct die_args *args = data;
- int ret = NOTIFY_DONE;
-
-- if (args->regs && user_mode_vm(args->regs))
-+ if (args->regs && user_mode(args->regs))
- return ret;
-
- switch (val) {
-diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
-index 63b0ec8..4211963 100644
---- a/arch/x86/kernel/kvm.c
-+++ b/arch/x86/kernel/kvm.c
-@@ -201,7 +201,7 @@ static void __init paravirt_ops_setup(void)
- pv_info.paravirt_enabled = 1;
-
- if (kvm_para_has_feature(KVM_FEATURE_NOP_IO_DELAY))
-- pv_cpu_ops.io_delay = kvm_io_delay;
-+ *(void **)&pv_cpu_ops.io_delay = kvm_io_delay;
-
- if (kvm_para_has_feature(KVM_FEATURE_MMU_OP)) {
- pv_mmu_ops.set_pte = kvm_set_pte;
-@@ -216,6 +216,7 @@ static void __init paravirt_ops_setup(void)
- pv_mmu_ops.set_pud = kvm_set_pud;
- #if PAGETABLE_LEVELS == 4
- pv_mmu_ops.set_pgd = kvm_set_pgd;
-+ pv_mmu_ops.set_pgd_batched = kvm_set_pgd;
- #endif
- #endif
- pv_mmu_ops.flush_tlb_user = kvm_flush_tlb;
-diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c
-index feaeb0d..9c62757 100644
---- a/arch/x86/kernel/kvmclock.c
-+++ b/arch/x86/kernel/kvmclock.c
-@@ -184,20 +184,20 @@ void __init kvmclock_init(void)
- if (kvmclock && kvm_para_has_feature(KVM_FEATURE_CLOCKSOURCE)) {
- if (kvm_register_clock("boot clock"))
- return;
-- pv_time_ops.sched_clock = kvm_clock_read;
-- x86_platform.calibrate_tsc = kvm_get_tsc_khz;
-- x86_platform.get_wallclock = kvm_get_wallclock;
-- x86_platform.set_wallclock = kvm_set_wallclock;
-+ *(void **)&pv_time_ops.sched_clock = kvm_clock_read;
-+ *(void **)&x86_platform.calibrate_tsc = kvm_get_tsc_khz;
-+ *(void **)&x86_platform.get_wallclock = kvm_get_wallclock;
-+ *(void **)&x86_platform.set_wallclock = kvm_set_wallclock;
- #ifdef CONFIG_X86_LOCAL_APIC
-- x86_cpuinit.setup_percpu_clockev =
-+ *(void **)&x86_cpuinit.setup_percpu_clockev =
- kvm_setup_secondary_clock;
- #endif
- #ifdef CONFIG_SMP
-- smp_ops.smp_prepare_boot_cpu = kvm_smp_prepare_boot_cpu;
-+ *(void **)&smp_ops.smp_prepare_boot_cpu = kvm_smp_prepare_boot_cpu;
- #endif
-- machine_ops.shutdown = kvm_shutdown;
-+ *(void **)&machine_ops.shutdown = kvm_shutdown;
- #ifdef CONFIG_KEXEC
-- machine_ops.crash_shutdown = kvm_crash_shutdown;
-+ *(void **)&machine_ops.crash_shutdown = kvm_crash_shutdown;
- #endif
- kvm_get_preset_lpj();
- clocksource_register(&kvm_clock);
-diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
-index ec6ef60..ab2c824 100644
---- a/arch/x86/kernel/ldt.c
-+++ b/arch/x86/kernel/ldt.c
-@@ -66,13 +66,13 @@ static int alloc_ldt(mm_context_t *pc, int mincount, int reload)
- if (reload) {
- #ifdef CONFIG_SMP
- preempt_disable();
-- load_LDT(pc);
-+ load_LDT_nolock(pc);
- if (!cpumask_equal(mm_cpumask(current->mm),
- cpumask_of(smp_processor_id())))
- smp_call_function(flush_ldt, current->mm, 1);
- preempt_enable();
- #else
-- load_LDT(pc);
-+ load_LDT_nolock(pc);
- #endif
- }
- if (oldsize) {
-@@ -94,7 +94,7 @@ static inline int copy_ldt(mm_context_t *new, mm_context_t *old)
- return err;
-
- for (i = 0; i < old->size; i++)
-- write_ldt_entry(new->ldt, i, old->ldt + i * LDT_ENTRY_SIZE);
-+ write_ldt_entry(new->ldt, i, old->ldt + i);
- return 0;
- }
-
-@@ -115,6 +115,24 @@ int init_new_context(struct task_struct *tsk, struct mm_struct *mm)
- retval = copy_ldt(&mm->context, &old_mm->context);
- mutex_unlock(&old_mm->context.lock);
- }
-+
-+ if (tsk == current) {
-+ mm->context.vdso = 0;
-+
-+#ifdef CONFIG_X86_32
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+ mm->context.user_cs_base = 0UL;
-+ mm->context.user_cs_limit = ~0UL;
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
-+ cpus_clear(mm->context.cpu_user_cs_mask);
-+#endif
-+
-+#endif
-+#endif
-+
-+ }
-+
- return retval;
- }
-
-@@ -229,6 +247,13 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
- }
- }
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (ldt_info.contents & MODIFY_LDT_CONTENTS_CODE)) {
-+ error = -EINVAL;
-+ goto out_unlock;
-+ }
-+#endif
-+
- fill_ldt(&ldt, &ldt_info);
- if (oldmode)
- ldt.avl = 0;
-diff --git a/arch/x86/kernel/machine_kexec_32.c b/arch/x86/kernel/machine_kexec_32.c
-index c1c429d..f02eaf9 100644
---- a/arch/x86/kernel/machine_kexec_32.c
-+++ b/arch/x86/kernel/machine_kexec_32.c
-@@ -26,7 +26,7 @@
- #include <asm/system.h>
- #include <asm/cacheflush.h>
-
--static void set_idt(void *newidt, __u16 limit)
-+static void set_idt(struct desc_struct *newidt, __u16 limit)
- {
- struct desc_ptr curidt;
-
-@@ -38,7 +38,7 @@ static void set_idt(void *newidt, __u16 limit)
- }
-
-
--static void set_gdt(void *newgdt, __u16 limit)
-+static void set_gdt(struct desc_struct *newgdt, __u16 limit)
- {
- struct desc_ptr curgdt;
-
-@@ -217,7 +217,7 @@ void machine_kexec(struct kimage *image)
- }
-
- control_page = page_address(image->control_code_page);
-- memcpy(control_page, relocate_kernel, KEXEC_CONTROL_CODE_MAX_SIZE);
-+ memcpy(control_page, (void *)ktla_ktva((unsigned long)relocate_kernel), KEXEC_CONTROL_CODE_MAX_SIZE);
-
- relocate_kernel_ptr = control_page;
- page_list[PA_CONTROL_PAGE] = __pa(control_page);
-diff --git a/arch/x86/kernel/microcode_amd.c b/arch/x86/kernel/microcode_amd.c
-index 1e47679..e73449d 100644
---- a/arch/x86/kernel/microcode_amd.c
-+++ b/arch/x86/kernel/microcode_amd.c
-@@ -364,7 +364,7 @@ static void microcode_fini_cpu_amd(int cpu)
- uci->mc = NULL;
- }
-
--static struct microcode_ops microcode_amd_ops = {
-+static const struct microcode_ops microcode_amd_ops = {
- .request_microcode_user = request_microcode_user,
- .request_microcode_fw = request_microcode_fw,
- .collect_cpu_info = collect_cpu_info_amd,
-@@ -372,7 +372,7 @@ static struct microcode_ops microcode_amd_ops = {
- .microcode_fini_cpu = microcode_fini_cpu_amd,
- };
-
--struct microcode_ops * __init init_amd_microcode(void)
-+const struct microcode_ops * __init init_amd_microcode(void)
- {
- return µcode_amd_ops;
- }
-diff --git a/arch/x86/kernel/microcode_core.c b/arch/x86/kernel/microcode_core.c
-index 378e9a8..b5a6ea9 100644
---- a/arch/x86/kernel/microcode_core.c
-+++ b/arch/x86/kernel/microcode_core.c
-@@ -90,7 +90,7 @@ MODULE_LICENSE("GPL");
-
- #define MICROCODE_VERSION "2.00"
-
--static struct microcode_ops *microcode_ops;
-+static const struct microcode_ops *microcode_ops;
-
- /*
- * Synchronization.
-diff --git a/arch/x86/kernel/microcode_intel.c b/arch/x86/kernel/microcode_intel.c
-index 0d334dd..14cedaf 100644
---- a/arch/x86/kernel/microcode_intel.c
-+++ b/arch/x86/kernel/microcode_intel.c
-@@ -443,13 +443,13 @@ static enum ucode_state request_microcode_fw(int cpu, struct device *device)
-
- static int get_ucode_user(void *to, const void *from, size_t n)
- {
-- return copy_from_user(to, from, n);
-+ return copy_from_user(to, (const void __force_user *)from, n);
- }
-
- static enum ucode_state
- request_microcode_user(int cpu, const void __user *buf, size_t size)
- {
-- return generic_load_microcode(cpu, (void *)buf, size, &get_ucode_user);
-+ return generic_load_microcode(cpu, (__force_kernel void *)buf, size, &get_ucode_user);
- }
-
- static void microcode_fini_cpu(int cpu)
-@@ -460,7 +460,7 @@ static void microcode_fini_cpu(int cpu)
- uci->mc = NULL;
- }
-
--static struct microcode_ops microcode_intel_ops = {
-+static const struct microcode_ops microcode_intel_ops = {
- .request_microcode_user = request_microcode_user,
- .request_microcode_fw = request_microcode_fw,
- .collect_cpu_info = collect_cpu_info,
-@@ -468,7 +468,7 @@ static struct microcode_ops microcode_intel_ops = {
- .microcode_fini_cpu = microcode_fini_cpu,
- };
-
--struct microcode_ops * __init init_intel_microcode(void)
-+const struct microcode_ops * __init init_intel_microcode(void)
- {
- return µcode_intel_ops;
- }
-diff --git a/arch/x86/kernel/module.c b/arch/x86/kernel/module.c
-index 89f386f..9028f51 100644
---- a/arch/x86/kernel/module.c
-+++ b/arch/x86/kernel/module.c
-@@ -34,7 +34,7 @@
- #define DEBUGP(fmt...)
- #endif
-
--void *module_alloc(unsigned long size)
-+static void *__module_alloc(unsigned long size, pgprot_t prot)
- {
- struct vm_struct *area;
-
-@@ -48,8 +48,18 @@ void *module_alloc(unsigned long size)
- if (!area)
- return NULL;
-
-- return __vmalloc_area(area, GFP_KERNEL | __GFP_HIGHMEM,
-- PAGE_KERNEL_EXEC);
-+ return __vmalloc_area(area, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, prot);
-+}
-+
-+void *module_alloc(unsigned long size)
-+{
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ return __module_alloc(size, PAGE_KERNEL);
-+#else
-+ return __module_alloc(size, PAGE_KERNEL_EXEC);
-+#endif
-+
- }
-
- /* Free memory returned from module_alloc */
-@@ -58,6 +68,40 @@ void module_free(struct module *mod, void *module_region)
- vfree(module_region);
- }
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+#ifdef CONFIG_X86_32
-+void *module_alloc_exec(unsigned long size)
-+{
-+ struct vm_struct *area;
-+
-+ if (size == 0)
-+ return NULL;
-+
-+ area = __get_vm_area(size, VM_ALLOC, (unsigned long)&MODULES_EXEC_VADDR, (unsigned long)&MODULES_EXEC_END);
-+ return area ? area->addr : NULL;
-+}
-+EXPORT_SYMBOL(module_alloc_exec);
-+
-+void module_free_exec(struct module *mod, void *module_region)
-+{
-+ vunmap(module_region);
-+}
-+EXPORT_SYMBOL(module_free_exec);
-+#else
-+void module_free_exec(struct module *mod, void *module_region)
-+{
-+ module_free(mod, module_region);
-+}
-+EXPORT_SYMBOL(module_free_exec);
-+
-+void *module_alloc_exec(unsigned long size)
-+{
-+ return __module_alloc(size, PAGE_KERNEL_RX);
-+}
-+EXPORT_SYMBOL(module_alloc_exec);
-+#endif
-+#endif
-+
- /* We don't need anything special. */
- int module_frob_arch_sections(Elf_Ehdr *hdr,
- Elf_Shdr *sechdrs,
-@@ -77,14 +121,16 @@ int apply_relocate(Elf32_Shdr *sechdrs,
- unsigned int i;
- Elf32_Rel *rel = (void *)sechdrs[relsec].sh_addr;
- Elf32_Sym *sym;
-- uint32_t *location;
-+ uint32_t *plocation, location;
-
- DEBUGP("Applying relocate section %u to %u\n", relsec,
- sechdrs[relsec].sh_info);
- for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) {
- /* This is where to make the change */
-- location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr
-- + rel[i].r_offset;
-+ plocation = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr + rel[i].r_offset;
-+ location = (uint32_t)plocation;
-+ if (sechdrs[sechdrs[relsec].sh_info].sh_flags & SHF_EXECINSTR)
-+ plocation = ktla_ktva((void *)plocation);
- /* This is the symbol it is referring to. Note that all
- undefined symbols have been resolved. */
- sym = (Elf32_Sym *)sechdrs[symindex].sh_addr
-@@ -93,11 +139,15 @@ int apply_relocate(Elf32_Shdr *sechdrs,
- switch (ELF32_R_TYPE(rel[i].r_info)) {
- case R_386_32:
- /* We add the value into the location given */
-- *location += sym->st_value;
-+ pax_open_kernel();
-+ *plocation += sym->st_value;
-+ pax_close_kernel();
- break;
- case R_386_PC32:
- /* Add the value, subtract its postition */
-- *location += sym->st_value - (uint32_t)location;
-+ pax_open_kernel();
-+ *plocation += sym->st_value - location;
-+ pax_close_kernel();
- break;
- default:
- printk(KERN_ERR "module %s: Unknown relocation: %u\n",
-@@ -153,21 +203,30 @@ int apply_relocate_add(Elf64_Shdr *sechdrs,
- case R_X86_64_NONE:
- break;
- case R_X86_64_64:
-+ pax_open_kernel();
- *(u64 *)loc = val;
-+ pax_close_kernel();
- break;
- case R_X86_64_32:
-+ pax_open_kernel();
- *(u32 *)loc = val;
-+ pax_close_kernel();
- if (val != *(u32 *)loc)
- goto overflow;
- break;
- case R_X86_64_32S:
-+ pax_open_kernel();
- *(s32 *)loc = val;
-+ pax_close_kernel();
- if ((s64)val != *(s32 *)loc)
- goto overflow;
- break;
- case R_X86_64_PC32:
- val -= (u64)loc;
-+ pax_open_kernel();
- *(u32 *)loc = val;
-+ pax_close_kernel();
-+
- #if 0
- if ((s64)val != *(s32 *)loc)
- goto overflow;
-diff --git a/arch/x86/kernel/mrst.c b/arch/x86/kernel/mrst.c
-index 3b7078a..7367929 100644
---- a/arch/x86/kernel/mrst.c
-+++ b/arch/x86/kernel/mrst.c
-@@ -19,6 +19,6 @@
- */
- void __init x86_mrst_early_setup(void)
- {
-- x86_init.resources.probe_roms = x86_init_noop;
-- x86_init.resources.reserve_resources = x86_init_noop;
-+ *(void **)&x86_init.resources.probe_roms = x86_init_noop;
-+ *(void **)&x86_init.resources.reserve_resources = x86_init_noop;
- }
-diff --git a/arch/x86/kernel/msr.c b/arch/x86/kernel/msr.c
-index 5eaeb5e..63a053b 100644
---- a/arch/x86/kernel/msr.c
-+++ b/arch/x86/kernel/msr.c
-@@ -176,6 +176,9 @@ static int msr_open(struct inode *inode, struct file *file)
- struct cpuinfo_x86 *c = &cpu_data(cpu);
- int ret = 0;
-
-+ if (!capable(CAP_SYS_RAWIO))
-+ return -EPERM;
-+
- lock_kernel();
- cpu = iminor(file->f_path.dentry->d_inode);
-
-diff --git a/arch/x86/kernel/paravirt-spinlocks.c b/arch/x86/kernel/paravirt-spinlocks.c
-index 3a7c5a4..9191528 100644
---- a/arch/x86/kernel/paravirt-spinlocks.c
-+++ b/arch/x86/kernel/paravirt-spinlocks.c
-@@ -13,7 +13,7 @@ default_spin_lock_flags(raw_spinlock_t *lock, unsigned long flags)
- __raw_spin_lock(lock);
- }
-
--struct pv_lock_ops pv_lock_ops = {
-+struct pv_lock_ops pv_lock_ops __read_only = {
- #ifdef CONFIG_SMP
- .spin_is_locked = __ticket_spin_is_locked,
- .spin_is_contended = __ticket_spin_is_contended,
-diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
-index 1b1739d..e39fa7f 100644
---- a/arch/x86/kernel/paravirt.c
-+++ b/arch/x86/kernel/paravirt.c
-@@ -53,6 +53,9 @@ u64 _paravirt_ident_64(u64 x)
- {
- return x;
- }
-+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
-+PV_CALLEE_SAVE_REGS_THUNK(_paravirt_ident_64);
-+#endif
-
- void __init default_banner(void)
- {
-@@ -122,7 +125,7 @@ unsigned paravirt_patch_jmp(void *insnbuf, const void *target,
- * corresponding structure. */
- static void *get_call_destination(u8 type)
- {
-- struct paravirt_patch_template tmpl = {
-+ const struct paravirt_patch_template tmpl = {
- .pv_init_ops = pv_init_ops,
- .pv_time_ops = pv_time_ops,
- .pv_cpu_ops = pv_cpu_ops,
-@@ -133,6 +136,8 @@ static void *get_call_destination(u8 type)
- .pv_lock_ops = pv_lock_ops,
- #endif
- };
-+
-+ pax_track_stack();
- return *((void **)&tmpl + type);
- }
-
-@@ -145,15 +150,19 @@ unsigned paravirt_patch_default(u8 type, u16 clobbers, void *insnbuf,
- if (opfunc == NULL)
- /* If there's no function, patch it with a ud2a (BUG) */
- ret = paravirt_patch_insns(insnbuf, len, ud2a, ud2a+sizeof(ud2a));
-- else if (opfunc == _paravirt_nop)
-+ else if (opfunc == (void *)_paravirt_nop)
- /* If the operation is a nop, then nop the callsite */
- ret = paravirt_patch_nop();
-
- /* identity functions just return their single argument */
-- else if (opfunc == _paravirt_ident_32)
-+ else if (opfunc == (void *)_paravirt_ident_32)
- ret = paravirt_patch_ident_32(insnbuf, len);
-- else if (opfunc == _paravirt_ident_64)
-+ else if (opfunc == (void *)_paravirt_ident_64)
- ret = paravirt_patch_ident_64(insnbuf, len);
-+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
-+ else if (opfunc == (void *)__raw_callee_save__paravirt_ident_64)
-+ ret = paravirt_patch_ident_64(insnbuf, len);
-+#endif
-
- else if (type == PARAVIRT_PATCH(pv_cpu_ops.iret) ||
- type == PARAVIRT_PATCH(pv_cpu_ops.irq_enable_sysexit) ||
-@@ -178,7 +187,7 @@ unsigned paravirt_patch_insns(void *insnbuf, unsigned len,
- if (insn_len > len || start == NULL)
- insn_len = len;
- else
-- memcpy(insnbuf, start, insn_len);
-+ memcpy(insnbuf, ktla_ktva(start), insn_len);
-
- return insn_len;
- }
-@@ -294,7 +303,7 @@ void arch_flush_lazy_mmu_mode(void)
- preempt_enable();
- }
-
--struct pv_info pv_info = {
-+struct pv_info pv_info __read_only = {
- .name = "bare hardware",
- .paravirt_enabled = 0,
- .kernel_rpl = 0,
-@@ -309,7 +318,7 @@ struct pv_time_ops pv_time_ops = {
- .sched_clock = native_sched_clock,
- };
-
--struct pv_irq_ops pv_irq_ops = {
-+struct pv_irq_ops pv_irq_ops __read_only = {
- .save_fl = __PV_IS_CALLEE_SAVE(native_save_fl),
- .restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl),
- .irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable),
-@@ -388,15 +397,20 @@ struct pv_apic_ops pv_apic_ops = {
- #endif
- };
-
--#if defined(CONFIG_X86_32) && !defined(CONFIG_X86_PAE)
-+#ifdef CONFIG_X86_32
-+#ifdef CONFIG_X86_PAE
-+/* 64-bit pagetable entries */
-+#define PTE_IDENT PV_CALLEE_SAVE(_paravirt_ident_64)
-+#else
- /* 32-bit pagetable entries */
- #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_32)
-+#endif
- #else
- /* 64-bit pagetable entries */
- #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_64)
- #endif
-
--struct pv_mmu_ops pv_mmu_ops = {
-+struct pv_mmu_ops pv_mmu_ops __read_only = {
-
- .read_cr2 = native_read_cr2,
- .write_cr2 = native_write_cr2,
-@@ -448,6 +462,7 @@ struct pv_mmu_ops pv_mmu_ops = {
- .make_pud = PTE_IDENT,
-
- .set_pgd = native_set_pgd,
-+ .set_pgd_batched = native_set_pgd_batched,
- #endif
- #endif /* PAGETABLE_LEVELS >= 3 */
-
-@@ -467,6 +482,12 @@ struct pv_mmu_ops pv_mmu_ops = {
- },
-
- .set_fixmap = native_set_fixmap,
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ .pax_open_kernel = native_pax_open_kernel,
-+ .pax_close_kernel = native_pax_close_kernel,
-+#endif
-+
- };
-
- EXPORT_SYMBOL_GPL(pv_time_ops);
-diff --git a/arch/x86/kernel/pci-calgary_64.c b/arch/x86/kernel/pci-calgary_64.c
-index 1a2d4b1..6a0dd55 100644
---- a/arch/x86/kernel/pci-calgary_64.c
-+++ b/arch/x86/kernel/pci-calgary_64.c
-@@ -477,7 +477,7 @@ static void calgary_free_coherent(struct device *dev, size_t size,
- free_pages((unsigned long)vaddr, get_order(size));
- }
-
--static struct dma_map_ops calgary_dma_ops = {
-+static const struct dma_map_ops calgary_dma_ops = {
- .alloc_coherent = calgary_alloc_coherent,
- .free_coherent = calgary_free_coherent,
- .map_sg = calgary_map_sg,
-diff --git a/arch/x86/kernel/pci-dma.c b/arch/x86/kernel/pci-dma.c
-index 6ac3931..42b4414 100644
---- a/arch/x86/kernel/pci-dma.c
-+++ b/arch/x86/kernel/pci-dma.c
-@@ -14,7 +14,7 @@
-
- static int forbid_dac __read_mostly;
-
--struct dma_map_ops *dma_ops;
-+const struct dma_map_ops *dma_ops;
- EXPORT_SYMBOL(dma_ops);
-
- static int iommu_sac_force __read_mostly;
-@@ -243,7 +243,7 @@ early_param("iommu", iommu_setup);
-
- int dma_supported(struct device *dev, u64 mask)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- #ifdef CONFIG_PCI
- if (mask > 0xffffffff && forbid_dac > 0) {
-diff --git a/arch/x86/kernel/pci-gart_64.c b/arch/x86/kernel/pci-gart_64.c
-index 1c76691..e3632db 100644
---- a/arch/x86/kernel/pci-gart_64.c
-+++ b/arch/x86/kernel/pci-gart_64.c
-@@ -682,7 +682,7 @@ static __init int init_k8_gatt(struct agp_kern_info *info)
- return -1;
- }
-
--static struct dma_map_ops gart_dma_ops = {
-+static const struct dma_map_ops gart_dma_ops = {
- .map_sg = gart_map_sg,
- .unmap_sg = gart_unmap_sg,
- .map_page = gart_map_page,
-diff --git a/arch/x86/kernel/pci-nommu.c b/arch/x86/kernel/pci-nommu.c
-index a3933d4..c898869 100644
---- a/arch/x86/kernel/pci-nommu.c
-+++ b/arch/x86/kernel/pci-nommu.c
-@@ -94,7 +94,7 @@ static void nommu_sync_sg_for_device(struct device *dev,
- flush_write_buffers();
- }
-
--struct dma_map_ops nommu_dma_ops = {
-+const struct dma_map_ops nommu_dma_ops = {
- .alloc_coherent = dma_generic_alloc_coherent,
- .free_coherent = nommu_free_coherent,
- .map_sg = nommu_map_sg,
-diff --git a/arch/x86/kernel/pci-swiotlb.c b/arch/x86/kernel/pci-swiotlb.c
-index aaa6b78..4de1881 100644
---- a/arch/x86/kernel/pci-swiotlb.c
-+++ b/arch/x86/kernel/pci-swiotlb.c
-@@ -25,7 +25,7 @@ static void *x86_swiotlb_alloc_coherent(struct device *hwdev, size_t size,
- return swiotlb_alloc_coherent(hwdev, size, dma_handle, flags);
- }
-
--static struct dma_map_ops swiotlb_dma_ops = {
-+static const struct dma_map_ops swiotlb_dma_ops = {
- .mapping_error = swiotlb_dma_mapping_error,
- .alloc_coherent = x86_swiotlb_alloc_coherent,
- .free_coherent = swiotlb_free_coherent,
-diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
-index fc6c84d..0312ca2 100644
---- a/arch/x86/kernel/process.c
-+++ b/arch/x86/kernel/process.c
-@@ -51,16 +51,33 @@ void free_thread_xstate(struct task_struct *tsk)
-
- void free_thread_info(struct thread_info *ti)
- {
-- free_thread_xstate(ti->task);
- free_pages((unsigned long)ti, get_order(THREAD_SIZE));
- }
-
-+static struct kmem_cache *task_struct_cachep;
-+
- void arch_task_cache_init(void)
- {
-- task_xstate_cachep =
-- kmem_cache_create("task_xstate", xstate_size,
-+ /* create a slab on which task_structs can be allocated */
-+ task_struct_cachep =
-+ kmem_cache_create("task_struct", sizeof(struct task_struct),
-+ ARCH_MIN_TASKALIGN, SLAB_PANIC | SLAB_NOTRACK, NULL);
-+
-+ task_xstate_cachep =
-+ kmem_cache_create("task_xstate", xstate_size,
- __alignof__(union thread_xstate),
-- SLAB_PANIC | SLAB_NOTRACK, NULL);
-+ SLAB_PANIC | SLAB_NOTRACK | SLAB_USERCOPY, NULL);
-+}
-+
-+struct task_struct *alloc_task_struct(void)
-+{
-+ return kmem_cache_alloc(task_struct_cachep, GFP_KERNEL);
-+}
-+
-+void free_task_struct(struct task_struct *task)
-+{
-+ free_thread_xstate(task);
-+ kmem_cache_free(task_struct_cachep, task);
- }
-
- /*
-@@ -73,7 +90,7 @@ void exit_thread(void)
- unsigned long *bp = t->io_bitmap_ptr;
-
- if (bp) {
-- struct tss_struct *tss = &per_cpu(init_tss, get_cpu());
-+ struct tss_struct *tss = init_tss + get_cpu();
-
- t->io_bitmap_ptr = NULL;
- clear_thread_flag(TIF_IO_BITMAP);
-@@ -93,6 +110,9 @@ void flush_thread(void)
-
- clear_tsk_thread_flag(tsk, TIF_DEBUG);
-
-+#if defined(CONFIG_X86_32) && !defined(CONFIG_CC_STACKPROTECTOR) && !defined(CONFIG_PAX_MEMORY_UDEREF)
-+ loadsegment(gs, 0);
-+#endif
- tsk->thread.debugreg0 = 0;
- tsk->thread.debugreg1 = 0;
- tsk->thread.debugreg2 = 0;
-@@ -307,7 +327,7 @@ void default_idle(void)
- EXPORT_SYMBOL(default_idle);
- #endif
-
--void stop_this_cpu(void *dummy)
-+__noreturn void stop_this_cpu(void *dummy)
- {
- local_irq_disable();
- /*
-@@ -568,16 +588,38 @@ static int __init idle_setup(char *str)
- }
- early_param("idle", idle_setup);
-
--unsigned long arch_align_stack(unsigned long sp)
-+#ifdef CONFIG_PAX_RANDKSTACK
-+void pax_randomize_kstack(struct pt_regs *regs)
- {
-- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
-- sp -= get_random_int() % 8192;
-- return sp & ~0xf;
--}
-+ struct thread_struct *thread = ¤t->thread;
-+ unsigned long time;
-
--unsigned long arch_randomize_brk(struct mm_struct *mm)
--{
-- unsigned long range_end = mm->brk + 0x02000000;
-- return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
-+ if (!randomize_va_space)
-+ return;
-+
-+ if (v8086_mode(regs))
-+ return;
-+
-+ rdtscl(time);
-+
-+ /* P4 seems to return a 0 LSB, ignore it */
-+#ifdef CONFIG_MPENTIUM4
-+ time &= 0x3EUL;
-+ time <<= 2;
-+#elif defined(CONFIG_X86_64)
-+ time &= 0xFUL;
-+ time <<= 4;
-+#else
-+ time &= 0x1FUL;
-+ time <<= 3;
-+#endif
-+
-+ thread->sp0 ^= time;
-+ load_sp0(init_tss + smp_processor_id(), thread);
-+
-+#ifdef CONFIG_X86_64
-+ percpu_write(kernel_stack, thread->sp0);
-+#endif
- }
-+#endif
-
-diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
-index c40c432..e88c62c 100644
---- a/arch/x86/kernel/process_32.c
-+++ b/arch/x86/kernel/process_32.c
-@@ -67,6 +67,7 @@ asmlinkage void ret_from_fork(void) __asm__("ret_from_fork");
- unsigned long thread_saved_pc(struct task_struct *tsk)
- {
- return ((unsigned long *)tsk->thread.sp)[3];
-+//XXX return tsk->thread.eip;
- }
-
- #ifndef CONFIG_SMP
-@@ -129,15 +130,14 @@ void __show_regs(struct pt_regs *regs, int all)
- unsigned short ss, gs;
- const char *board;
-
-- if (user_mode_vm(regs)) {
-+ if (user_mode(regs)) {
- sp = regs->sp;
- ss = regs->ss & 0xffff;
-- gs = get_user_gs(regs);
- } else {
- sp = (unsigned long) (®s->sp);
- savesegment(ss, ss);
-- savesegment(gs, gs);
- }
-+ gs = get_user_gs(regs);
-
- printk("\n");
-
-@@ -152,7 +152,7 @@ void __show_regs(struct pt_regs *regs, int all)
-
- printk("EIP: %04x:[<%08lx>] EFLAGS: %08lx CPU: %d\n",
- (u16)regs->cs, regs->ip, regs->flags,
-- smp_processor_id());
-+ raw_smp_processor_id());
- print_symbol("EIP is at %s\n", regs->ip);
-
- printk("EAX: %08lx EBX: %08lx ECX: %08lx EDX: %08lx\n",
-@@ -210,10 +210,10 @@ int kernel_thread(int (*fn)(void *), void *arg, unsigned long flags)
- regs.bx = (unsigned long) fn;
- regs.dx = (unsigned long) arg;
-
-- regs.ds = __USER_DS;
-- regs.es = __USER_DS;
-+ regs.ds = __KERNEL_DS;
-+ regs.es = __KERNEL_DS;
- regs.fs = __KERNEL_PERCPU;
-- regs.gs = __KERNEL_STACK_CANARY;
-+ savesegment(gs, regs.gs);
- regs.orig_ax = -1;
- regs.ip = (unsigned long) kernel_thread_helper;
- regs.cs = __KERNEL_CS | get_kernel_rpl();
-@@ -247,13 +247,14 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
- struct task_struct *tsk;
- int err;
-
-- childregs = task_pt_regs(p);
-+ childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 8;
- *childregs = *regs;
- childregs->ax = 0;
- childregs->sp = sp;
-
- p->thread.sp = (unsigned long) childregs;
- p->thread.sp0 = (unsigned long) (childregs+1);
-+ p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
-
- p->thread.ip = (unsigned long) ret_from_fork;
-
-@@ -345,7 +346,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
- struct thread_struct *prev = &prev_p->thread,
- *next = &next_p->thread;
- int cpu = smp_processor_id();
-- struct tss_struct *tss = &per_cpu(init_tss, cpu);
-+ struct tss_struct *tss = init_tss + cpu;
- bool preload_fpu;
-
- /* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
-@@ -380,6 +381,10 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
- */
- lazy_save_gs(prev->gs);
-
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ __set_fs(task_thread_info(next_p)->addr_limit);
-+#endif
-+
- /*
- * Load the per-thread Thread-Local Storage descriptor.
- */
-@@ -415,6 +420,9 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
- */
- arch_end_context_switch(next_p);
-
-+ percpu_write(current_task, next_p);
-+ percpu_write(current_tinfo, &next_p->tinfo);
-+
- if (preload_fpu)
- __math_state_restore();
-
-@@ -424,8 +432,6 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
- if (prev->gs | next->gs)
- lazy_load_gs(next->gs);
-
-- percpu_write(current_task, next_p);
--
- return prev_p;
- }
-
-@@ -495,4 +501,3 @@ unsigned long get_wchan(struct task_struct *p)
- } while (count++ < 16);
- return 0;
- }
--
-diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
-index 39493bc..196816d 100644
---- a/arch/x86/kernel/process_64.c
-+++ b/arch/x86/kernel/process_64.c
-@@ -91,7 +91,7 @@ static void __exit_idle(void)
- void exit_idle(void)
- {
- /* idle loop has pid 0 */
-- if (current->pid)
-+ if (task_pid_nr(current))
- return;
- __exit_idle();
- }
-@@ -170,7 +170,7 @@ void __show_regs(struct pt_regs *regs, int all)
- if (!board)
- board = "";
- printk(KERN_INFO "Pid: %d, comm: %.20s %s %s %.*s %s\n",
-- current->pid, current->comm, print_tainted(),
-+ task_pid_nr(current), current->comm, print_tainted(),
- init_utsname()->release,
- (int)strcspn(init_utsname()->version, " "),
- init_utsname()->version, board);
-@@ -280,8 +280,7 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
- struct pt_regs *childregs;
- struct task_struct *me = current;
-
-- childregs = ((struct pt_regs *)
-- (THREAD_SIZE + task_stack_page(p))) - 1;
-+ childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 16;
- *childregs = *regs;
-
- childregs->ax = 0;
-@@ -292,6 +291,7 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
- p->thread.sp = (unsigned long) childregs;
- p->thread.sp0 = (unsigned long) (childregs+1);
- p->thread.usersp = me->thread.usersp;
-+ p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
-
- set_tsk_thread_flag(p, TIF_FORK);
-
-@@ -379,7 +379,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
- struct thread_struct *prev = &prev_p->thread;
- struct thread_struct *next = &next_p->thread;
- int cpu = smp_processor_id();
-- struct tss_struct *tss = &per_cpu(init_tss, cpu);
-+ struct tss_struct *tss = init_tss + cpu;
- unsigned fsindex, gsindex;
- bool preload_fpu;
-
-@@ -475,10 +475,9 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
- prev->usersp = percpu_read(old_rsp);
- percpu_write(old_rsp, next->usersp);
- percpu_write(current_task, next_p);
-+ percpu_write(current_tinfo, &next_p->tinfo);
-
-- percpu_write(kernel_stack,
-- (unsigned long)task_stack_page(next_p) +
-- THREAD_SIZE - KERNEL_STACK_OFFSET);
-+ percpu_write(kernel_stack, next->sp0);
-
- /*
- * Now maybe reload the debug registers and handle I/O bitmaps
-@@ -559,12 +558,11 @@ unsigned long get_wchan(struct task_struct *p)
- if (!p || p == current || p->state == TASK_RUNNING)
- return 0;
- stack = (unsigned long)task_stack_page(p);
-- if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
-+ if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE-16-sizeof(u64))
- return 0;
- fp = *(u64 *)(p->thread.sp);
- do {
-- if (fp < (unsigned long)stack ||
-- fp >= (unsigned long)stack+THREAD_SIZE)
-+ if (fp < stack || fp > stack+THREAD_SIZE-16-sizeof(u64))
- return 0;
- ip = *(u64 *)(fp+8);
- if (!in_sched_functions(ip))
-diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
-index c06acdd..2404a26 100644
---- a/arch/x86/kernel/ptrace.c
-+++ b/arch/x86/kernel/ptrace.c
-@@ -925,7 +925,7 @@ static const struct user_regset_view user_x86_32_view; /* Initialized below. */
- long arch_ptrace(struct task_struct *child, long request, long addr, long data)
- {
- int ret;
-- unsigned long __user *datap = (unsigned long __user *)data;
-+ unsigned long __user *datap = (__force unsigned long __user *)data;
-
- switch (request) {
- /* read the word at location addr in the USER area. */
-@@ -1012,14 +1012,14 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
- if (addr < 0)
- return -EIO;
- ret = do_get_thread_area(child, addr,
-- (struct user_desc __user *) data);
-+ (__force struct user_desc __user *) data);
- break;
-
- case PTRACE_SET_THREAD_AREA:
- if (addr < 0)
- return -EIO;
- ret = do_set_thread_area(child, addr,
-- (struct user_desc __user *) data, 0);
-+ (__force struct user_desc __user *) data, 0);
- break;
- #endif
-
-@@ -1038,12 +1038,12 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
- #ifdef CONFIG_X86_PTRACE_BTS
- case PTRACE_BTS_CONFIG:
- ret = ptrace_bts_config
-- (child, data, (struct ptrace_bts_config __user *)addr);
-+ (child, data, (__force struct ptrace_bts_config __user *)addr);
- break;
-
- case PTRACE_BTS_STATUS:
- ret = ptrace_bts_status
-- (child, data, (struct ptrace_bts_config __user *)addr);
-+ (child, data, (__force struct ptrace_bts_config __user *)addr);
- break;
-
- case PTRACE_BTS_SIZE:
-@@ -1052,7 +1052,7 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
-
- case PTRACE_BTS_GET:
- ret = ptrace_bts_read_record
-- (child, data, (struct bts_struct __user *) addr);
-+ (child, data, (__force struct bts_struct __user *) addr);
- break;
-
- case PTRACE_BTS_CLEAR:
-@@ -1061,7 +1061,7 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
-
- case PTRACE_BTS_DRAIN:
- ret = ptrace_bts_drain
-- (child, data, (struct bts_struct __user *) addr);
-+ (child, data, (__force struct bts_struct __user *) addr);
- break;
- #endif /* CONFIG_X86_PTRACE_BTS */
-
-@@ -1450,7 +1450,7 @@ void send_sigtrap(struct task_struct *tsk, struct pt_regs *regs,
- info.si_code = si_code;
-
- /* User-mode ip? */
-- info.si_addr = user_mode_vm(regs) ? (void __user *) regs->ip : NULL;
-+ info.si_addr = user_mode(regs) ? (__force void __user *) regs->ip : NULL;
-
- /* Send us the fake SIGTRAP */
- force_sig_info(SIGTRAP, &info, tsk);
-@@ -1465,14 +1465,23 @@ void send_sigtrap(struct task_struct *tsk, struct pt_regs *regs,
- # define IS_IA32 0
- #endif
-
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+extern void gr_delayed_cred_worker(void);
-+#endif
-+
- /*
- * We must return the syscall number to actually look up in the table.
- * This can be -1L to skip running any syscall at all.
- */
--asmregparm long syscall_trace_enter(struct pt_regs *regs)
-+long syscall_trace_enter(struct pt_regs *regs)
- {
- long ret = 0;
-
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+ if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
-+ gr_delayed_cred_worker();
-+#endif
-+
- /*
- * If we stepped into a sysenter/syscall insn, it trapped in
- * kernel mode; do_debug() cleared TF and set TIF_SINGLESTEP.
-@@ -1514,8 +1523,13 @@ asmregparm long syscall_trace_enter(struct pt_regs *regs)
- return ret ?: regs->orig_ax;
- }
-
--asmregparm void syscall_trace_leave(struct pt_regs *regs)
-+void syscall_trace_leave(struct pt_regs *regs)
- {
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+ if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
-+ gr_delayed_cred_worker();
-+#endif
-+
- if (unlikely(current->audit_context))
- audit_syscall_exit(AUDITSC_RESULT(regs->ax), regs->ax);
-
-diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
-index cf98100..7250c30 100644
---- a/arch/x86/kernel/reboot.c
-+++ b/arch/x86/kernel/reboot.c
-@@ -33,7 +33,7 @@ void (*pm_power_off)(void);
- EXPORT_SYMBOL(pm_power_off);
-
- static const struct desc_ptr no_idt = {};
--static int reboot_mode;
-+static unsigned short reboot_mode;
- enum reboot_type reboot_type = BOOT_KBD;
- int reboot_force;
-
-@@ -292,12 +292,12 @@ core_initcall(reboot_init);
- controller to pulse the CPU reset line, which is more thorough, but
- doesn't work with at least one type of 486 motherboard. It is easy
- to stop this code working; hence the copious comments. */
--static const unsigned long long
--real_mode_gdt_entries [3] =
-+static struct desc_struct
-+real_mode_gdt_entries [3] __read_only =
- {
-- 0x0000000000000000ULL, /* Null descriptor */
-- 0x00009b000000ffffULL, /* 16-bit real-mode 64k code at 0x00000000 */
-- 0x000093000100ffffULL /* 16-bit real-mode 64k data at 0x00000100 */
-+ GDT_ENTRY_INIT(0, 0, 0), /* Null descriptor */
-+ GDT_ENTRY_INIT(0x9b, 0, 0xffff), /* 16-bit real-mode 64k code at 0x00000000 */
-+ GDT_ENTRY_INIT(0x93, 0x100, 0xffff) /* 16-bit real-mode 64k data at 0x00000100 */
- };
-
- static const struct desc_ptr
-@@ -346,7 +346,7 @@ static const unsigned char jump_to_bios [] =
- * specified by the code and length parameters.
- * We assume that length will aways be less that 100!
- */
--void machine_real_restart(const unsigned char *code, int length)
-+__noreturn void machine_real_restart(const unsigned char *code, unsigned int length)
- {
- local_irq_disable();
-
-@@ -366,8 +366,8 @@ void machine_real_restart(const unsigned char *code, int length)
- /* Remap the kernel at virtual address zero, as well as offset zero
- from the kernel segment. This assumes the kernel segment starts at
- virtual address PAGE_OFFSET. */
-- memcpy(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-- sizeof(swapper_pg_dir [0]) * KERNEL_PGD_PTRS);
-+ clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-+ min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
-
- /*
- * Use `swapper_pg_dir' as our page directory.
-@@ -379,16 +379,15 @@ void machine_real_restart(const unsigned char *code, int length)
- boot)". This seems like a fairly standard thing that gets set by
- REBOOT.COM programs, and the previous reset routine did this
- too. */
-- *((unsigned short *)0x472) = reboot_mode;
-+ *(unsigned short *)(__va(0x472)) = reboot_mode;
-
- /* For the switch to real mode, copy some code to low memory. It has
- to be in the first 64k because it is running in 16-bit mode, and it
- has to have the same physical and virtual address, because it turns
- off paging. Copy it near the end of the first page, out of the way
- of BIOS variables. */
-- memcpy((void *)(0x1000 - sizeof(real_mode_switch) - 100),
-- real_mode_switch, sizeof (real_mode_switch));
-- memcpy((void *)(0x1000 - 100), code, length);
-+ memcpy(__va(0x1000 - sizeof (real_mode_switch) - 100), real_mode_switch, sizeof (real_mode_switch));
-+ memcpy(__va(0x1000 - 100), code, length);
-
- /* Set up the IDT for real mode. */
- load_idt(&real_mode_idt);
-@@ -416,6 +415,7 @@ void machine_real_restart(const unsigned char *code, int length)
- __asm__ __volatile__ ("ljmp $0x0008,%0"
- :
- : "i" ((void *)(0x1000 - sizeof (real_mode_switch) - 100)));
-+ do { } while (1);
- }
- #ifdef CONFIG_APM_MODULE
- EXPORT_SYMBOL(machine_real_restart);
-@@ -544,7 +544,7 @@ void __attribute__((weak)) mach_reboot_fixups(void)
- {
- }
-
--static void native_machine_emergency_restart(void)
-+static void __noreturn native_machine_emergency_restart(void)
- {
- int i;
-
-@@ -659,13 +659,13 @@ void native_machine_shutdown(void)
- #endif
- }
-
--static void __machine_emergency_restart(int emergency)
-+static __noreturn void __machine_emergency_restart(int emergency)
- {
- reboot_emergency = emergency;
- machine_ops.emergency_restart();
- }
-
--static void native_machine_restart(char *__unused)
-+static void __noreturn native_machine_restart(char *__unused)
- {
- printk("machine restart\n");
-
-@@ -674,7 +674,7 @@ static void native_machine_restart(char *__unused)
- __machine_emergency_restart(0);
- }
-
--static void native_machine_halt(void)
-+static void __noreturn native_machine_halt(void)
- {
- /* stop other cpus and apics */
- machine_shutdown();
-@@ -685,7 +685,7 @@ static void native_machine_halt(void)
- stop_this_cpu(NULL);
- }
-
--static void native_machine_power_off(void)
-+static void __noreturn native_machine_power_off(void)
- {
- if (pm_power_off) {
- if (!reboot_force)
-@@ -694,6 +694,7 @@ static void native_machine_power_off(void)
- }
- /* a fallback in case there is no PM info available */
- tboot_shutdown(TB_SHUTDOWN_HALT);
-+ do { } while (1);
- }
-
- struct machine_ops machine_ops = {
-diff --git a/arch/x86/kernel/relocate_kernel_64.S b/arch/x86/kernel/relocate_kernel_64.S
-index 7a6f3b3..976a959 100644
---- a/arch/x86/kernel/relocate_kernel_64.S
-+++ b/arch/x86/kernel/relocate_kernel_64.S
-@@ -11,6 +11,7 @@
- #include <asm/kexec.h>
- #include <asm/processor-flags.h>
- #include <asm/pgtable_types.h>
-+#include <asm/alternative-asm.h>
-
- /*
- * Must be relocatable PIC code callable as a C function
-@@ -167,6 +168,7 @@ identity_mapped:
- xorq %r14, %r14
- xorq %r15, %r15
-
-+ pax_force_retaddr 0, 1
- ret
-
- 1:
-diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
-index 5449a26..0b6c759 100644
---- a/arch/x86/kernel/setup.c
-+++ b/arch/x86/kernel/setup.c
-@@ -783,14 +783,14 @@ void __init setup_arch(char **cmdline_p)
-
- if (!boot_params.hdr.root_flags)
- root_mountflags &= ~MS_RDONLY;
-- init_mm.start_code = (unsigned long) _text;
-- init_mm.end_code = (unsigned long) _etext;
-+ init_mm.start_code = ktla_ktva((unsigned long) _text);
-+ init_mm.end_code = ktla_ktva((unsigned long) _etext);
- init_mm.end_data = (unsigned long) _edata;
- init_mm.brk = _brk_end;
-
-- code_resource.start = virt_to_phys(_text);
-- code_resource.end = virt_to_phys(_etext)-1;
-- data_resource.start = virt_to_phys(_etext);
-+ code_resource.start = virt_to_phys(ktla_ktva(_text));
-+ code_resource.end = virt_to_phys(ktla_ktva(_etext))-1;
-+ data_resource.start = virt_to_phys(_sdata);
- data_resource.end = virt_to_phys(_edata)-1;
- bss_resource.start = virt_to_phys(&__bss_start);
- bss_resource.end = virt_to_phys(&__bss_stop)-1;
-diff --git a/arch/x86/kernel/setup_percpu.c b/arch/x86/kernel/setup_percpu.c
-index d559af9..524c6ad 100644
---- a/arch/x86/kernel/setup_percpu.c
-+++ b/arch/x86/kernel/setup_percpu.c
-@@ -25,19 +25,17 @@
- # define DBG(x...)
- #endif
-
--DEFINE_PER_CPU(int, cpu_number);
-+#ifdef CONFIG_SMP
-+DEFINE_PER_CPU(unsigned int, cpu_number);
- EXPORT_PER_CPU_SYMBOL(cpu_number);
-+#endif
-
--#ifdef CONFIG_X86_64
- #define BOOT_PERCPU_OFFSET ((unsigned long)__per_cpu_load)
--#else
--#define BOOT_PERCPU_OFFSET 0
--#endif
-
- DEFINE_PER_CPU(unsigned long, this_cpu_off) = BOOT_PERCPU_OFFSET;
- EXPORT_PER_CPU_SYMBOL(this_cpu_off);
-
--unsigned long __per_cpu_offset[NR_CPUS] __read_mostly = {
-+unsigned long __per_cpu_offset[NR_CPUS] __read_only = {
- [0 ... NR_CPUS-1] = BOOT_PERCPU_OFFSET,
- };
- EXPORT_SYMBOL(__per_cpu_offset);
-@@ -159,10 +157,10 @@ static inline void setup_percpu_segment(int cpu)
- {
- #ifdef CONFIG_X86_32
- struct desc_struct gdt;
-+ unsigned long base = per_cpu_offset(cpu);
-
-- pack_descriptor(&gdt, per_cpu_offset(cpu), 0xFFFFF,
-- 0x2 | DESCTYPE_S, 0x8);
-- gdt.s = 1;
-+ pack_descriptor(&gdt, base, (VMALLOC_END - base - 1) >> PAGE_SHIFT,
-+ 0x83 | DESCTYPE_S, 0xC);
- write_gdt_entry(get_cpu_gdt_table(cpu),
- GDT_ENTRY_PERCPU, &gdt, DESCTYPE_S);
- #endif
-@@ -212,6 +210,11 @@ void __init setup_per_cpu_areas(void)
- /* alrighty, percpu areas up and running */
- delta = (unsigned long)pcpu_base_addr - (unsigned long)__per_cpu_start;
- for_each_possible_cpu(cpu) {
-+#ifdef CONFIG_CC_STACKPROTECTOR
-+#ifdef CONFIG_X86_32
-+ unsigned long canary = per_cpu(stack_canary.canary, cpu);
-+#endif
-+#endif
- per_cpu_offset(cpu) = delta + pcpu_unit_offsets[cpu];
- per_cpu(this_cpu_off, cpu) = per_cpu_offset(cpu);
- per_cpu(cpu_number, cpu) = cpu;
-@@ -239,6 +242,12 @@ void __init setup_per_cpu_areas(void)
- early_per_cpu_map(x86_cpu_to_node_map, cpu);
- #endif
- #endif
-+#ifdef CONFIG_CC_STACKPROTECTOR
-+#ifdef CONFIG_X86_32
-+ if (!cpu)
-+ per_cpu(stack_canary.canary, cpu) = canary;
-+#endif
-+#endif
- /*
- * Up to this point, the boot CPU has been using .data.init
- * area. Reload any changed state for the boot CPU.
-diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
-index 6a44a76..a9287a1 100644
---- a/arch/x86/kernel/signal.c
-+++ b/arch/x86/kernel/signal.c
-@@ -197,7 +197,7 @@ static unsigned long align_sigframe(unsigned long sp)
- * Align the stack pointer according to the i386 ABI,
- * i.e. so that on function entry ((sp + 4) & 15) == 0.
- */
-- sp = ((sp + 4) & -16ul) - 4;
-+ sp = ((sp - 12) & -16ul) - 4;
- #else /* !CONFIG_X86_32 */
- sp = round_down(sp, 16) - 8;
- #endif
-@@ -248,11 +248,11 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, size_t frame_size,
- * Return an always-bogus address instead so we will die with SIGSEGV.
- */
- if (onsigstack && !likely(on_sig_stack(sp)))
-- return (void __user *)-1L;
-+ return (__force void __user *)-1L;
-
- /* save i387 state */
- if (used_math() && save_i387_xstate(*fpstate) < 0)
-- return (void __user *)-1L;
-+ return (__force void __user *)-1L;
-
- return (void __user *)sp;
- }
-@@ -307,9 +307,9 @@ __setup_frame(int sig, struct k_sigaction *ka, sigset_t *set,
- }
-
- if (current->mm->context.vdso)
-- restorer = VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
-+ restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
- else
-- restorer = &frame->retcode;
-+ restorer = (void __user *)&frame->retcode;
- if (ka->sa.sa_flags & SA_RESTORER)
- restorer = ka->sa.sa_restorer;
-
-@@ -323,7 +323,7 @@ __setup_frame(int sig, struct k_sigaction *ka, sigset_t *set,
- * reasons and because gdb uses it as a signature to notice
- * signal handler stack frames.
- */
-- err |= __put_user(*((u64 *)&retcode), (u64 *)frame->retcode);
-+ err |= __put_user(*((u64 *)&retcode), (u64 __user *)frame->retcode);
-
- if (err)
- return -EFAULT;
-@@ -377,7 +377,10 @@ static int __setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
- err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
-
- /* Set up to return from userspace. */
-- restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
-+ if (current->mm->context.vdso)
-+ restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
-+ else
-+ restorer = (void __user *)&frame->retcode;
- if (ka->sa.sa_flags & SA_RESTORER)
- restorer = ka->sa.sa_restorer;
- put_user_ex(restorer, &frame->pretcode);
-@@ -389,7 +392,7 @@ static int __setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
- * reasons and because gdb uses it as a signature to notice
- * signal handler stack frames.
- */
-- put_user_ex(*((u64 *)&rt_retcode), (u64 *)frame->retcode);
-+ put_user_ex(*((u64 *)&rt_retcode), (u64 __user *)frame->retcode);
- } put_user_catch(err);
-
- if (err)
-@@ -782,6 +785,8 @@ static void do_signal(struct pt_regs *regs)
- int signr;
- sigset_t *oldset;
-
-+ pax_track_stack();
-+
- /*
- * We want the common case to go fast, which is why we may in certain
- * cases get here from kernel mode. Just return without doing anything
-@@ -789,7 +794,7 @@ static void do_signal(struct pt_regs *regs)
- * X86_32: vm86 regs switched out by assembly code before reaching
- * here, so testing against kernel CS suffices.
- */
-- if (!user_mode(regs))
-+ if (!user_mode_novm(regs))
- return;
-
- if (current_thread_info()->status & TS_RESTORE_SIGMASK)
-diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
-index 7e8e905..64d5c32 100644
---- a/arch/x86/kernel/smpboot.c
-+++ b/arch/x86/kernel/smpboot.c
-@@ -94,14 +94,14 @@ static DEFINE_PER_CPU(struct task_struct *, idle_thread_array);
- */
- static DEFINE_MUTEX(x86_cpu_hotplug_driver_mutex);
-
--void cpu_hotplug_driver_lock()
-+void cpu_hotplug_driver_lock(void)
- {
-- mutex_lock(&x86_cpu_hotplug_driver_mutex);
-+ mutex_lock(&x86_cpu_hotplug_driver_mutex);
- }
-
--void cpu_hotplug_driver_unlock()
-+void cpu_hotplug_driver_unlock(void)
- {
-- mutex_unlock(&x86_cpu_hotplug_driver_mutex);
-+ mutex_unlock(&x86_cpu_hotplug_driver_mutex);
- }
-
- ssize_t arch_cpu_probe(const char *buf, size_t count) { return -1; }
-@@ -625,7 +625,7 @@ wakeup_secondary_cpu_via_init(int phys_apicid, unsigned long start_eip)
- * target processor state.
- */
- startup_ipi_hook(phys_apicid, (unsigned long) start_secondary,
-- (unsigned long)stack_start.sp);
-+ stack_start);
-
- /*
- * Run STARTUP IPI loop.
-@@ -743,6 +743,7 @@ static int __cpuinit do_boot_cpu(int apicid, int cpu)
- set_idle_for_cpu(cpu, c_idle.idle);
- do_rest:
- per_cpu(current_task, cpu) = c_idle.idle;
-+ per_cpu(current_tinfo, cpu) = &c_idle.idle->tinfo;
- #ifdef CONFIG_X86_32
- /* Stack for startup_32 can be just as for start_secondary onwards */
- irq_ctx_init(cpu);
-@@ -750,13 +751,15 @@ do_rest:
- #else
- clear_tsk_thread_flag(c_idle.idle, TIF_FORK);
- initial_gs = per_cpu_offset(cpu);
-- per_cpu(kernel_stack, cpu) =
-- (unsigned long)task_stack_page(c_idle.idle) -
-- KERNEL_STACK_OFFSET + THREAD_SIZE;
-+ per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(c_idle.idle) - 16 + THREAD_SIZE;
- #endif
-+
-+ pax_open_kernel();
- early_gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
-+ pax_close_kernel();
-+
- initial_code = (unsigned long)start_secondary;
-- stack_start.sp = (void *) c_idle.idle->thread.sp;
-+ stack_start = c_idle.idle->thread.sp;
-
- /* start_ip had better be page-aligned! */
- start_ip = setup_trampoline();
-@@ -891,6 +894,12 @@ int __cpuinit native_cpu_up(unsigned int cpu)
-
- per_cpu(cpu_state, cpu) = CPU_UP_PREPARE;
-
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ clone_pgd_range(get_cpu_pgd(cpu) + KERNEL_PGD_BOUNDARY,
-+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-+ KERNEL_PGD_PTRS);
-+#endif
-+
- err = do_boot_cpu(apicid, cpu);
-
- if (err) {
-diff --git a/arch/x86/kernel/step.c b/arch/x86/kernel/step.c
-index 3149032..14f1053 100644
---- a/arch/x86/kernel/step.c
-+++ b/arch/x86/kernel/step.c
-@@ -27,10 +27,10 @@ unsigned long convert_ip_to_linear(struct task_struct *child, struct pt_regs *re
- struct desc_struct *desc;
- unsigned long base;
-
-- seg &= ~7UL;
-+ seg >>= 3;
-
- mutex_lock(&child->mm->context.lock);
-- if (unlikely((seg >> 3) >= child->mm->context.size))
-+ if (unlikely(seg >= child->mm->context.size))
- addr = -1L; /* bogus selector, access would fault */
- else {
- desc = child->mm->context.ldt + seg;
-@@ -42,7 +42,8 @@ unsigned long convert_ip_to_linear(struct task_struct *child, struct pt_regs *re
- addr += base;
- }
- mutex_unlock(&child->mm->context.lock);
-- }
-+ } else if (seg == __KERNEL_CS || seg == __KERNEXEC_KERNEL_CS)
-+ addr = ktla_ktva(addr);
-
- return addr;
- }
-@@ -53,6 +54,9 @@ static int is_setting_trap_flag(struct task_struct *child, struct pt_regs *regs)
- unsigned char opcode[15];
- unsigned long addr = convert_ip_to_linear(child, regs);
-
-+ if (addr == -EINVAL)
-+ return 0;
-+
- copied = access_process_vm(child, addr, opcode, sizeof(opcode), 0);
- for (i = 0; i < copied; i++) {
- switch (opcode[i]) {
-@@ -74,7 +78,7 @@ static int is_setting_trap_flag(struct task_struct *child, struct pt_regs *regs)
-
- #ifdef CONFIG_X86_64
- case 0x40 ... 0x4f:
-- if (regs->cs != __USER_CS)
-+ if ((regs->cs & 0xffff) != __USER_CS)
- /* 32-bit mode: register increment */
- return 0;
- /* 64-bit mode: REX prefix */
-diff --git a/arch/x86/kernel/sys_i386_32.c b/arch/x86/kernel/sys_i386_32.c
-index dee1ff7..d0e3ef7 100644
---- a/arch/x86/kernel/sys_i386_32.c
-+++ b/arch/x86/kernel/sys_i386_32.c
-@@ -24,6 +24,21 @@
-
- #include <asm/syscalls.h>
-
-+int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
-+{
-+ unsigned long pax_task_size = TASK_SIZE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
-+ pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+ if (len > pax_task_size || addr > pax_task_size - len)
-+ return -EINVAL;
-+
-+ return 0;
-+}
-+
- /*
- * Perform the select(nd, in, out, ex, tv) and mmap() system
- * calls. Linux/i386 didn't use to be able to handle more than
-@@ -58,6 +73,214 @@ out:
- return err;
- }
-
-+unsigned long
-+arch_get_unmapped_area(struct file *filp, unsigned long addr,
-+ unsigned long len, unsigned long pgoff, unsigned long flags)
-+{
-+ struct mm_struct *mm = current->mm;
-+ struct vm_area_struct *vma;
-+ unsigned long start_addr, pax_task_size = TASK_SIZE;
-+ unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+ pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+ pax_task_size -= PAGE_SIZE;
-+
-+ if (len > pax_task_size)
-+ return -ENOMEM;
-+
-+ if (flags & MAP_FIXED)
-+ return addr;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
-+ if (addr) {
-+ addr = PAGE_ALIGN(addr);
-+ if (pax_task_size - len >= addr) {
-+ vma = find_vma(mm, addr);
-+ if (check_heap_stack_gap(vma, addr, len, offset))
-+ return addr;
-+ }
-+ }
-+ if (len > mm->cached_hole_size) {
-+ start_addr = addr = mm->free_area_cache;
-+ } else {
-+ start_addr = addr = mm->mmap_base;
-+ mm->cached_hole_size = 0;
-+ }
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (!nx_enabled && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE) && start_addr >= mm->mmap_base) {
-+ start_addr = 0x00110000UL;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ start_addr += mm->delta_mmap & 0x03FFF000UL;
-+#endif
-+
-+ if (mm->start_brk <= start_addr && start_addr < mm->mmap_base)
-+ start_addr = addr = mm->mmap_base;
-+ else
-+ addr = start_addr;
-+ }
-+#endif
-+
-+full_search:
-+ for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
-+ /* At this point: (!vma || addr < vma->vm_end). */
-+ if (pax_task_size - len < addr) {
-+ /*
-+ * Start a new search - just in case we missed
-+ * some holes.
-+ */
-+ if (start_addr != mm->mmap_base) {
-+ start_addr = addr = mm->mmap_base;
-+ mm->cached_hole_size = 0;
-+ goto full_search;
-+ }
-+ return -ENOMEM;
-+ }
-+ if (check_heap_stack_gap(vma, addr, len, offset))
-+ break;
-+ if (addr + mm->cached_hole_size < vma->vm_start)
-+ mm->cached_hole_size = vma->vm_start - addr;
-+ addr = vma->vm_end;
-+ if (mm->start_brk <= addr && addr < mm->mmap_base) {
-+ start_addr = addr = mm->mmap_base;
-+ mm->cached_hole_size = 0;
-+ goto full_search;
-+ }
-+ }
-+
-+ /*
-+ * Remember the place where we stopped the search:
-+ */
-+ mm->free_area_cache = addr + len;
-+ return addr;
-+}
-+
-+unsigned long
-+arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
-+ const unsigned long len, const unsigned long pgoff,
-+ const unsigned long flags)
-+{
-+ struct vm_area_struct *vma;
-+ struct mm_struct *mm = current->mm;
-+ unsigned long base = mm->mmap_base, addr = addr0, pax_task_size = TASK_SIZE;
-+ unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+ pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+ pax_task_size -= PAGE_SIZE;
-+
-+ /* requested length too big for entire address space */
-+ if (len > pax_task_size)
-+ return -ENOMEM;
-+
-+ if (flags & MAP_FIXED)
-+ return addr;
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (!nx_enabled && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE))
-+ goto bottomup;
-+#endif
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
-+ /* requesting a specific address */
-+ if (addr) {
-+ addr = PAGE_ALIGN(addr);
-+ if (pax_task_size - len >= addr) {
-+ vma = find_vma(mm, addr);
-+ if (check_heap_stack_gap(vma, addr, len, offset))
-+ return addr;
-+ }
-+ }
-+
-+ /* check if free_area_cache is useful for us */
-+ if (len <= mm->cached_hole_size) {
-+ mm->cached_hole_size = 0;
-+ mm->free_area_cache = mm->mmap_base;
-+ }
-+
-+ /* either no address requested or can't fit in requested address hole */
-+ addr = mm->free_area_cache;
-+
-+ /* make sure it can fit in the remaining address space */
-+ if (addr > len) {
-+ vma = find_vma(mm, addr-len);
-+ if (check_heap_stack_gap(vma, addr - len, len, offset))
-+ /* remember the address as a hint for next time */
-+ return (mm->free_area_cache = addr-len);
-+ }
-+
-+ if (mm->mmap_base < len)
-+ goto bottomup;
-+
-+ addr = mm->mmap_base-len;
-+
-+ do {
-+ /*
-+ * Lookup failure means no vma is above this address,
-+ * else if new region fits below vma->vm_start,
-+ * return with success:
-+ */
-+ vma = find_vma(mm, addr);
-+ if (check_heap_stack_gap(vma, addr, len, offset))
-+ /* remember the address as a hint for next time */
-+ return (mm->free_area_cache = addr);
-+
-+ /* remember the largest hole we saw so far */
-+ if (addr + mm->cached_hole_size < vma->vm_start)
-+ mm->cached_hole_size = vma->vm_start - addr;
-+
-+ /* try just below the current vma->vm_start */
-+ addr = skip_heap_stack_gap(vma, len, offset);
-+ } while (!IS_ERR_VALUE(addr));
-+
-+bottomup:
-+ /*
-+ * A failed mmap() very likely causes application failure,
-+ * so fall back to the bottom-up function here. This scenario
-+ * can happen with large stack limits and large mmap()
-+ * allocations.
-+ */
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+ mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
-+ else
-+#endif
-+
-+ mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base += mm->delta_mmap;
-+#endif
-+
-+ mm->free_area_cache = mm->mmap_base;
-+ mm->cached_hole_size = ~0UL;
-+ addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
-+ /*
-+ * Restore the topdown base:
-+ */
-+ mm->mmap_base = base;
-+ mm->free_area_cache = base;
-+ mm->cached_hole_size = ~0UL;
-+
-+ return addr;
-+}
-
- struct sel_arg_struct {
- unsigned long n;
-@@ -93,7 +316,7 @@ asmlinkage int sys_ipc(uint call, int first, int second,
- return sys_semtimedop(first, (struct sembuf __user *)ptr, second, NULL);
- case SEMTIMEDOP:
- return sys_semtimedop(first, (struct sembuf __user *)ptr, second,
-- (const struct timespec __user *)fifth);
-+ (__force const struct timespec __user *)fifth);
-
- case SEMGET:
- return sys_semget(first, second, third);
-@@ -140,7 +363,7 @@ asmlinkage int sys_ipc(uint call, int first, int second,
- ret = do_shmat(first, (char __user *) ptr, second, &raddr);
- if (ret)
- return ret;
-- return put_user(raddr, (ulong __user *) third);
-+ return put_user(raddr, (__force ulong __user *) third);
- }
- case 1: /* iBCS2 emulator entry point */
- if (!segment_eq(get_fs(), get_ds()))
-@@ -207,17 +430,3 @@ asmlinkage int sys_olduname(struct oldold_utsname __user *name)
-
- return error;
- }
--
--
--/*
-- * Do a system call from kernel instead of calling sys_execve so we
-- * end up with proper pt_regs.
-- */
--int kernel_execve(const char *filename, char *const argv[], char *const envp[])
--{
-- long __res;
-- asm volatile ("push %%ebx ; movl %2,%%ebx ; int $0x80 ; pop %%ebx"
-- : "=a" (__res)
-- : "0" (__NR_execve), "ri" (filename), "c" (argv), "d" (envp) : "memory");
-- return __res;
--}
-diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c
-index 8aa2057..4db7318 100644
---- a/arch/x86/kernel/sys_x86_64.c
-+++ b/arch/x86/kernel/sys_x86_64.c
-@@ -32,8 +32,8 @@ out:
- return error;
- }
-
--static void find_start_end(unsigned long flags, unsigned long *begin,
-- unsigned long *end)
-+static void find_start_end(struct mm_struct *mm, unsigned long flags,
-+ unsigned long *begin, unsigned long *end)
- {
- if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT)) {
- unsigned long new_begin;
-@@ -52,7 +52,7 @@ static void find_start_end(unsigned long flags, unsigned long *begin,
- *begin = new_begin;
- }
- } else {
-- *begin = TASK_UNMAPPED_BASE;
-+ *begin = mm->mmap_base;
- *end = TASK_SIZE;
- }
- }
-@@ -65,20 +65,24 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
- struct vm_area_struct *vma;
- unsigned long start_addr;
- unsigned long begin, end;
-+ unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
-
- if (flags & MAP_FIXED)
- return addr;
-
-- find_start_end(flags, &begin, &end);
-+ find_start_end(mm, flags, &begin, &end);
-
- if (len > end)
- return -ENOMEM;
-
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- if (addr) {
- addr = PAGE_ALIGN(addr);
- vma = find_vma(mm, addr);
-- if (end - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-+ if (end - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
- return addr;
- }
- if (((flags & MAP_32BIT) || test_thread_flag(TIF_IA32))
-@@ -106,7 +110,7 @@ full_search:
- }
- return -ENOMEM;
- }
-- if (!vma || addr + len <= vma->vm_start) {
-+ if (check_heap_stack_gap(vma, addr, len, offset)) {
- /*
- * Remember the place where we stopped the search:
- */
-@@ -128,7 +132,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- {
- struct vm_area_struct *vma;
- struct mm_struct *mm = current->mm;
-- unsigned long addr = addr0;
-+ unsigned long base = mm->mmap_base, addr = addr0;
-+ unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
-
- /* requested length too big for entire address space */
- if (len > TASK_SIZE)
-@@ -141,13 +146,18 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT))
- goto bottomup;
-
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- /* requesting a specific address */
- if (addr) {
- addr = PAGE_ALIGN(addr);
-- vma = find_vma(mm, addr);
-- if (TASK_SIZE - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-- return addr;
-+ if (TASK_SIZE - len >= addr) {
-+ vma = find_vma(mm, addr);
-+ if (check_heap_stack_gap(vma, addr, len, offset))
-+ return addr;
-+ }
- }
-
- /* check if free_area_cache is useful for us */
-@@ -162,7 +172,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- /* make sure it can fit in the remaining address space */
- if (addr > len) {
- vma = find_vma(mm, addr-len);
-- if (!vma || addr <= vma->vm_start)
-+ if (check_heap_stack_gap(vma, addr - len, len, offset))
- /* remember the address as a hint for next time */
- return mm->free_area_cache = addr-len;
- }
-@@ -179,7 +189,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- * return with success:
- */
- vma = find_vma(mm, addr);
-- if (!vma || addr+len <= vma->vm_start)
-+ if (check_heap_stack_gap(vma, addr, len, offset))
- /* remember the address as a hint for next time */
- return mm->free_area_cache = addr;
-
-@@ -188,8 +198,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- mm->cached_hole_size = vma->vm_start - addr;
-
- /* try just below the current vma->vm_start */
-- addr = vma->vm_start-len;
-- } while (len < vma->vm_start);
-+ addr = skip_heap_stack_gap(vma, len, offset);
-+ } while (!IS_ERR_VALUE(addr));
-
- bottomup:
- /*
-@@ -198,13 +208,21 @@ bottomup:
- * can happen with large stack limits and large mmap()
- * allocations.
- */
-+ mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base += mm->delta_mmap;
-+#endif
-+
-+ mm->free_area_cache = mm->mmap_base;
- mm->cached_hole_size = ~0UL;
-- mm->free_area_cache = TASK_UNMAPPED_BASE;
- addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
- /*
- * Restore the topdown base:
- */
-- mm->free_area_cache = mm->mmap_base;
-+ mm->mmap_base = base;
-+ mm->free_area_cache = base;
- mm->cached_hole_size = ~0UL;
-
- return addr;
-diff --git a/arch/x86/kernel/syscall_table_32.S b/arch/x86/kernel/syscall_table_32.S
-index 76d70a4..4c94a44 100644
---- a/arch/x86/kernel/syscall_table_32.S
-+++ b/arch/x86/kernel/syscall_table_32.S
-@@ -1,3 +1,4 @@
-+.section .rodata,"a",@progbits
- ENTRY(sys_call_table)
- .long sys_restart_syscall /* 0 - old "setup()" system call, used for restarting */
- .long sys_exit
-diff --git a/arch/x86/kernel/tboot.c b/arch/x86/kernel/tboot.c
-index 46b8277..3349d55 100644
---- a/arch/x86/kernel/tboot.c
-+++ b/arch/x86/kernel/tboot.c
-@@ -216,7 +216,7 @@ static int tboot_setup_sleep(void)
-
- void tboot_shutdown(u32 shutdown_type)
- {
-- void (*shutdown)(void);
-+ void (* __noreturn shutdown)(void);
-
- if (!tboot_enabled())
- return;
-@@ -238,7 +238,7 @@ void tboot_shutdown(u32 shutdown_type)
-
- switch_to_tboot_pt();
-
-- shutdown = (void(*)(void))(unsigned long)tboot->shutdown_entry;
-+ shutdown = (void *)tboot->shutdown_entry;
- shutdown();
-
- /* should not reach here */
-@@ -295,7 +295,7 @@ void tboot_sleep(u8 sleep_state, u32 pm1a_control, u32 pm1b_control)
- tboot_shutdown(acpi_shutdown_map[sleep_state]);
- }
-
--static atomic_t ap_wfs_count;
-+static atomic_unchecked_t ap_wfs_count;
-
- static int tboot_wait_for_aps(int num_aps)
- {
-@@ -319,9 +319,9 @@ static int __cpuinit tboot_cpu_callback(struct notifier_block *nfb,
- {
- switch (action) {
- case CPU_DYING:
-- atomic_inc(&ap_wfs_count);
-+ atomic_inc_unchecked(&ap_wfs_count);
- if (num_online_cpus() == 1)
-- if (tboot_wait_for_aps(atomic_read(&ap_wfs_count)))
-+ if (tboot_wait_for_aps(atomic_read_unchecked(&ap_wfs_count)))
- return NOTIFY_BAD;
- break;
- }
-@@ -340,7 +340,7 @@ static __init int tboot_late_init(void)
-
- tboot_create_trampoline();
-
-- atomic_set(&ap_wfs_count, 0);
-+ atomic_set_unchecked(&ap_wfs_count, 0);
- register_hotcpu_notifier(&tboot_cpu_notifier);
- return 0;
- }
-diff --git a/arch/x86/kernel/time.c b/arch/x86/kernel/time.c
-index be25734..87fe232 100644
---- a/arch/x86/kernel/time.c
-+++ b/arch/x86/kernel/time.c
-@@ -26,17 +26,13 @@
- int timer_ack;
- #endif
-
--#ifdef CONFIG_X86_64
--volatile unsigned long __jiffies __section_jiffies = INITIAL_JIFFIES;
--#endif
--
- unsigned long profile_pc(struct pt_regs *regs)
- {
- unsigned long pc = instruction_pointer(regs);
-
-- if (!user_mode_vm(regs) && in_lock_functions(pc)) {
-+ if (!user_mode(regs) && in_lock_functions(pc)) {
- #ifdef CONFIG_FRAME_POINTER
-- return *(unsigned long *)(regs->bp + sizeof(long));
-+ return ktla_ktva(*(unsigned long *)(regs->bp + sizeof(long)));
- #else
- unsigned long *sp =
- (unsigned long *)kernel_stack_pointer(regs);
-@@ -45,11 +41,17 @@ unsigned long profile_pc(struct pt_regs *regs)
- * or above a saved flags. Eflags has bits 22-31 zero,
- * kernel addresses don't.
- */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ return ktla_ktva(sp[0]);
-+#else
- if (sp[0] >> 22)
- return sp[0];
- if (sp[1] >> 22)
- return sp[1];
- #endif
-+
-+#endif
- }
- return pc;
- }
-diff --git a/arch/x86/kernel/tls.c b/arch/x86/kernel/tls.c
-index bcfec2d..aeb81c2 100644
---- a/arch/x86/kernel/tls.c
-+++ b/arch/x86/kernel/tls.c
-@@ -85,6 +85,11 @@ int do_set_thread_area(struct task_struct *p, int idx,
- if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
- return -EINVAL;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((p->mm->pax_flags & MF_PAX_SEGMEXEC) && (info.contents & MODIFY_LDT_CONTENTS_CODE))
-+ return -EINVAL;
-+#endif
-+
- set_tls_desc(p, idx, &info, 1);
-
- return 0;
-@@ -205,7 +210,7 @@ int regset_tls_set(struct task_struct *target, const struct user_regset *regset,
-
- if (kbuf)
- info = kbuf;
-- else if (__copy_from_user(infobuf, ubuf, count))
-+ else if (count > sizeof infobuf || __copy_from_user(infobuf, ubuf, count))
- return -EFAULT;
- else
- info = infobuf;
-diff --git a/arch/x86/kernel/trampoline_32.S b/arch/x86/kernel/trampoline_32.S
-index 8508237..229b664 100644
---- a/arch/x86/kernel/trampoline_32.S
-+++ b/arch/x86/kernel/trampoline_32.S
-@@ -32,6 +32,12 @@
- #include <asm/segment.h>
- #include <asm/page_types.h>
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+#define ta(X) (X)
-+#else
-+#define ta(X) ((X) - __PAGE_OFFSET)
-+#endif
-+
- /* We can free up trampoline after bootup if cpu hotplug is not supported. */
- __CPUINITRODATA
- .code16
-@@ -60,7 +66,7 @@ r_base = .
- inc %ax # protected mode (PE) bit
- lmsw %ax # into protected mode
- # flush prefetch and jump to startup_32_smp in arch/i386/kernel/head.S
-- ljmpl $__BOOT_CS, $(startup_32_smp-__PAGE_OFFSET)
-+ ljmpl $__BOOT_CS, $ta(startup_32_smp)
-
- # These need to be in the same 64K segment as the above;
- # hence we don't use the boot_gdt_descr defined in head.S
-diff --git a/arch/x86/kernel/trampoline_64.S b/arch/x86/kernel/trampoline_64.S
-index 3af2dff..ba8aa49 100644
---- a/arch/x86/kernel/trampoline_64.S
-+++ b/arch/x86/kernel/trampoline_64.S
-@@ -91,7 +91,7 @@ startup_32:
- movl $__KERNEL_DS, %eax # Initialize the %ds segment register
- movl %eax, %ds
-
-- movl $X86_CR4_PAE, %eax
-+ movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
- movl %eax, %cr4 # Enable PAE mode
-
- # Setup trampoline 4 level pagetables
-@@ -127,7 +127,7 @@ startup_64:
- no_longmode:
- hlt
- jmp no_longmode
--#include "verify_cpu_64.S"
-+#include "verify_cpu.S"
-
- # Careful these need to be in the same 64K segment as the above;
- tidt:
-@@ -138,7 +138,7 @@ tidt:
- # so the kernel can live anywhere
- .balign 4
- tgdt:
-- .short tgdt_end - tgdt # gdt limit
-+ .short tgdt_end - tgdt - 1 # gdt limit
- .long tgdt - r_base
- .short 0
- .quad 0x00cf9b000000ffff # __KERNEL32_CS
-diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
-index 7e37dce..ec3f8e5 100644
---- a/arch/x86/kernel/traps.c
-+++ b/arch/x86/kernel/traps.c
-@@ -69,12 +69,6 @@ asmlinkage int system_call(void);
-
- /* Do we ignore FPU interrupts ? */
- char ignore_fpu_irq;
--
--/*
-- * The IDT has to be page-aligned to simplify the Pentium
-- * F0 0F bug workaround.
-- */
--gate_desc idt_table[NR_VECTORS] __page_aligned_data = { { { { 0, 0 } } }, };
- #endif
-
- DECLARE_BITMAP(used_vectors, NR_VECTORS);
-@@ -112,19 +106,19 @@ static inline void preempt_conditional_cli(struct pt_regs *regs)
- static inline void
- die_if_kernel(const char *str, struct pt_regs *regs, long err)
- {
-- if (!user_mode_vm(regs))
-+ if (!user_mode(regs))
- die(str, regs, err);
- }
- #endif
-
- static void __kprobes
--do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
-+do_trap(int trapnr, int signr, const char *str, struct pt_regs *regs,
- long error_code, siginfo_t *info)
- {
- struct task_struct *tsk = current;
-
- #ifdef CONFIG_X86_32
-- if (regs->flags & X86_VM_MASK) {
-+ if (v8086_mode(regs)) {
- /*
- * traps 0, 1, 3, 4, and 5 should be forwarded to vm86.
- * On nmi (interrupt 2), do_trap should not be called.
-@@ -135,7 +129,7 @@ do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
- }
- #endif
-
-- if (!user_mode(regs))
-+ if (!user_mode_novm(regs))
- goto kernel_trap;
-
- #ifdef CONFIG_X86_32
-@@ -158,7 +152,7 @@ trap_signal:
- printk_ratelimit()) {
- printk(KERN_INFO
- "%s[%d] trap %s ip:%lx sp:%lx error:%lx",
-- tsk->comm, tsk->pid, str,
-+ tsk->comm, task_pid_nr(tsk), str,
- regs->ip, regs->sp, error_code);
- print_vma_addr(" in ", regs->ip);
- printk("\n");
-@@ -175,8 +169,20 @@ kernel_trap:
- if (!fixup_exception(regs)) {
- tsk->thread.error_code = error_code;
- tsk->thread.trap_no = trapnr;
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ if (trapnr == 12 && ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS))
-+ str = "PAX: suspicious stack segment fault";
-+#endif
-+
- die(str, regs, error_code);
- }
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ if (trapnr == 4)
-+ pax_report_refcount_overflow(regs);
-+#endif
-+
- return;
-
- #ifdef CONFIG_X86_32
-@@ -265,14 +271,30 @@ do_general_protection(struct pt_regs *regs, long error_code)
- conditional_sti(regs);
-
- #ifdef CONFIG_X86_32
-- if (regs->flags & X86_VM_MASK)
-+ if (v8086_mode(regs))
- goto gp_in_vm86;
- #endif
-
- tsk = current;
-- if (!user_mode(regs))
-+ if (!user_mode_novm(regs))
- goto gp_in_kernel;
-
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
-+ if (!nx_enabled && tsk->mm && (tsk->mm->pax_flags & MF_PAX_PAGEEXEC)) {
-+ struct mm_struct *mm = tsk->mm;
-+ unsigned long limit;
-+
-+ down_write(&mm->mmap_sem);
-+ limit = mm->context.user_cs_limit;
-+ if (limit < TASK_SIZE) {
-+ track_exec_limit(mm, limit, TASK_SIZE, VM_EXEC);
-+ up_write(&mm->mmap_sem);
-+ return;
-+ }
-+ up_write(&mm->mmap_sem);
-+ }
-+#endif
-+
- tsk->thread.error_code = error_code;
- tsk->thread.trap_no = 13;
-
-@@ -305,6 +327,13 @@ gp_in_kernel:
- if (notify_die(DIE_GPF, "general protection fault", regs,
- error_code, 13, SIGSEGV) == NOTIFY_STOP)
- return;
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ if ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS)
-+ die("PAX: suspicious general protection fault", regs, error_code);
-+ else
-+#endif
-+
- die("general protection fault", regs, error_code);
- }
-
-@@ -435,6 +464,17 @@ static notrace __kprobes void default_do_nmi(struct pt_regs *regs)
- dotraplinkage notrace __kprobes void
- do_nmi(struct pt_regs *regs, long error_code)
- {
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ if (!user_mode(regs)) {
-+ unsigned long cs = regs->cs & 0xFFFF;
-+ unsigned long ip = ktva_ktla(regs->ip);
-+
-+ if ((cs == __KERNEL_CS || cs == __KERNEXEC_KERNEL_CS) && ip <= (unsigned long)_etext)
-+ regs->ip = ip;
-+ }
-+#endif
-+
- nmi_enter();
-
- inc_irq_stat(__nmi_count);
-@@ -558,7 +598,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
- }
-
- #ifdef CONFIG_X86_32
-- if (regs->flags & X86_VM_MASK)
-+ if (v8086_mode(regs))
- goto debug_vm86;
- #endif
-
-@@ -570,7 +610,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
- * kernel space (but re-enable TF when returning to user mode).
- */
- if (condition & DR_STEP) {
-- if (!user_mode(regs))
-+ if (!user_mode_novm(regs))
- goto clear_TF_reenable;
- }
-
-@@ -757,7 +797,7 @@ do_simd_coprocessor_error(struct pt_regs *regs, long error_code)
- * Handle strange cache flush from user space exception
- * in all other cases. This is undocumented behaviour.
- */
-- if (regs->flags & X86_VM_MASK) {
-+ if (v8086_mode(regs)) {
- handle_vm86_fault((struct kernel_vm86_regs *)regs, error_code);
- return;
- }
-@@ -798,7 +838,7 @@ asmlinkage void __attribute__((weak)) smp_threshold_interrupt(void)
- void __math_state_restore(void)
- {
- struct thread_info *thread = current_thread_info();
-- struct task_struct *tsk = thread->task;
-+ struct task_struct *tsk = current;
-
- /*
- * Paranoid restore. send a SIGSEGV if we fail to restore the state.
-@@ -825,8 +865,7 @@ void __math_state_restore(void)
- */
- asmlinkage void math_state_restore(void)
- {
-- struct thread_info *thread = current_thread_info();
-- struct task_struct *tsk = thread->task;
-+ struct task_struct *tsk = current;
-
- if (!tsk_used_math(tsk)) {
- local_irq_enable();
-diff --git a/arch/x86/kernel/verify_cpu.S b/arch/x86/kernel/verify_cpu.S
-new file mode 100644
-index 0000000..50c5edd
---- /dev/null
-+++ b/arch/x86/kernel/verify_cpu.S
-@@ -0,0 +1,140 @@
-+/*
-+ *
-+ * verify_cpu.S - Code for cpu long mode and SSE verification. This
-+ * code has been borrowed from boot/setup.S and was introduced by
-+ * Andi Kleen.
-+ *
-+ * Copyright (c) 2007 Andi Kleen (ak@suse.de)
-+ * Copyright (c) 2007 Eric Biederman (ebiederm@xmission.com)
-+ * Copyright (c) 2007 Vivek Goyal (vgoyal@in.ibm.com)
-+ * Copyright (c) 2010 Kees Cook (kees.cook@canonical.com)
-+ *
-+ * This source code is licensed under the GNU General Public License,
-+ * Version 2. See the file COPYING for more details.
-+ *
-+ * This is a common code for verification whether CPU supports
-+ * long mode and SSE or not. It is not called directly instead this
-+ * file is included at various places and compiled in that context.
-+ * This file is expected to run in 32bit code. Currently:
-+ *
-+ * arch/x86/boot/compressed/head_64.S: Boot cpu verification
-+ * arch/x86/kernel/trampoline_64.S: secondary processor verification
-+ * arch/x86/kernel/head_32.S: processor startup
-+ * arch/x86/kernel/acpi/realmode/wakeup.S: 32bit processor resume
-+ *
-+ * verify_cpu, returns the status of longmode and SSE in register %eax.
-+ * 0: Success 1: Failure
-+ *
-+ * On Intel, the XD_DISABLE flag will be cleared as a side-effect.
-+ *
-+ * The caller needs to check for the error code and take the action
-+ * appropriately. Either display a message or halt.
-+ */
-+
-+#include <asm/cpufeature.h>
-+#include <asm/msr-index.h>
-+
-+verify_cpu:
-+ pushfl # Save caller passed flags
-+ pushl $0 # Kill any dangerous flags
-+ popfl
-+
-+ pushfl # standard way to check for cpuid
-+ popl %eax
-+ movl %eax,%ebx
-+ xorl $0x200000,%eax
-+ pushl %eax
-+ popfl
-+ pushfl
-+ popl %eax
-+ cmpl %eax,%ebx
-+ jz verify_cpu_no_longmode # cpu has no cpuid
-+
-+ movl $0x0,%eax # See if cpuid 1 is implemented
-+ cpuid
-+ cmpl $0x1,%eax
-+ jb verify_cpu_no_longmode # no cpuid 1
-+
-+ xor %di,%di
-+ cmpl $0x68747541,%ebx # AuthenticAMD
-+ jnz verify_cpu_noamd
-+ cmpl $0x69746e65,%edx
-+ jnz verify_cpu_noamd
-+ cmpl $0x444d4163,%ecx
-+ jnz verify_cpu_noamd
-+ mov $1,%di # cpu is from AMD
-+ jmp verify_cpu_check
-+
-+verify_cpu_noamd:
-+ cmpl $0x756e6547,%ebx # GenuineIntel?
-+ jnz verify_cpu_check
-+ cmpl $0x49656e69,%edx
-+ jnz verify_cpu_check
-+ cmpl $0x6c65746e,%ecx
-+ jnz verify_cpu_check
-+
-+ # only call IA32_MISC_ENABLE when:
-+ # family > 6 || (family == 6 && model >= 0xd)
-+ movl $0x1, %eax # check CPU family and model
-+ cpuid
-+ movl %eax, %ecx
-+
-+ andl $0x0ff00f00, %eax # mask family and extended family
-+ shrl $8, %eax
-+ cmpl $6, %eax
-+ ja verify_cpu_clear_xd # family > 6, ok
-+ jb verify_cpu_check # family < 6, skip
-+
-+ andl $0x000f00f0, %ecx # mask model and extended model
-+ shrl $4, %ecx
-+ cmpl $0xd, %ecx
-+ jb verify_cpu_check # family == 6, model < 0xd, skip
-+
-+verify_cpu_clear_xd:
-+ movl $MSR_IA32_MISC_ENABLE, %ecx
-+ rdmsr
-+ btrl $2, %edx # clear MSR_IA32_MISC_ENABLE_XD_DISABLE
-+ jnc verify_cpu_check # only write MSR if bit was changed
-+ wrmsr
-+
-+verify_cpu_check:
-+ movl $0x1,%eax # Does the cpu have what it takes
-+ cpuid
-+ andl $REQUIRED_MASK0,%edx
-+ xorl $REQUIRED_MASK0,%edx
-+ jnz verify_cpu_no_longmode
-+
-+ movl $0x80000000,%eax # See if extended cpuid is implemented
-+ cpuid
-+ cmpl $0x80000001,%eax
-+ jb verify_cpu_no_longmode # no extended cpuid
-+
-+ movl $0x80000001,%eax # Does the cpu have what it takes
-+ cpuid
-+ andl $REQUIRED_MASK1,%edx
-+ xorl $REQUIRED_MASK1,%edx
-+ jnz verify_cpu_no_longmode
-+
-+verify_cpu_sse_test:
-+ movl $1,%eax
-+ cpuid
-+ andl $SSE_MASK,%edx
-+ cmpl $SSE_MASK,%edx
-+ je verify_cpu_sse_ok
-+ test %di,%di
-+ jz verify_cpu_no_longmode # only try to force SSE on AMD
-+ movl $MSR_K7_HWCR,%ecx
-+ rdmsr
-+ btr $15,%eax # enable SSE
-+ wrmsr
-+ xor %di,%di # don't loop
-+ jmp verify_cpu_sse_test # try again
-+
-+verify_cpu_no_longmode:
-+ popfl # Restore caller passed flags
-+ movl $1,%eax
-+ ret
-+verify_cpu_sse_ok:
-+ popfl # Restore caller passed flags
-+ xorl %eax, %eax
-+ ret
-diff --git a/arch/x86/kernel/verify_cpu_64.S b/arch/x86/kernel/verify_cpu_64.S
-deleted file mode 100644
-index 45b6f8a..0000000
---- a/arch/x86/kernel/verify_cpu_64.S
-+++ /dev/null
-@@ -1,105 +0,0 @@
--/*
-- *
-- * verify_cpu.S - Code for cpu long mode and SSE verification. This
-- * code has been borrowed from boot/setup.S and was introduced by
-- * Andi Kleen.
-- *
-- * Copyright (c) 2007 Andi Kleen (ak@suse.de)
-- * Copyright (c) 2007 Eric Biederman (ebiederm@xmission.com)
-- * Copyright (c) 2007 Vivek Goyal (vgoyal@in.ibm.com)
-- *
-- * This source code is licensed under the GNU General Public License,
-- * Version 2. See the file COPYING for more details.
-- *
-- * This is a common code for verification whether CPU supports
-- * long mode and SSE or not. It is not called directly instead this
-- * file is included at various places and compiled in that context.
-- * Following are the current usage.
-- *
-- * This file is included by both 16bit and 32bit code.
-- *
-- * arch/x86_64/boot/setup.S : Boot cpu verification (16bit)
-- * arch/x86_64/boot/compressed/head.S: Boot cpu verification (32bit)
-- * arch/x86_64/kernel/trampoline.S: secondary processor verfication (16bit)
-- * arch/x86_64/kernel/acpi/wakeup.S:Verfication at resume (16bit)
-- *
-- * verify_cpu, returns the status of cpu check in register %eax.
-- * 0: Success 1: Failure
-- *
-- * The caller needs to check for the error code and take the action
-- * appropriately. Either display a message or halt.
-- */
--
--#include <asm/cpufeature.h>
--
--verify_cpu:
-- pushfl # Save caller passed flags
-- pushl $0 # Kill any dangerous flags
-- popfl
--
-- pushfl # standard way to check for cpuid
-- popl %eax
-- movl %eax,%ebx
-- xorl $0x200000,%eax
-- pushl %eax
-- popfl
-- pushfl
-- popl %eax
-- cmpl %eax,%ebx
-- jz verify_cpu_no_longmode # cpu has no cpuid
--
-- movl $0x0,%eax # See if cpuid 1 is implemented
-- cpuid
-- cmpl $0x1,%eax
-- jb verify_cpu_no_longmode # no cpuid 1
--
-- xor %di,%di
-- cmpl $0x68747541,%ebx # AuthenticAMD
-- jnz verify_cpu_noamd
-- cmpl $0x69746e65,%edx
-- jnz verify_cpu_noamd
-- cmpl $0x444d4163,%ecx
-- jnz verify_cpu_noamd
-- mov $1,%di # cpu is from AMD
--
--verify_cpu_noamd:
-- movl $0x1,%eax # Does the cpu have what it takes
-- cpuid
-- andl $REQUIRED_MASK0,%edx
-- xorl $REQUIRED_MASK0,%edx
-- jnz verify_cpu_no_longmode
--
-- movl $0x80000000,%eax # See if extended cpuid is implemented
-- cpuid
-- cmpl $0x80000001,%eax
-- jb verify_cpu_no_longmode # no extended cpuid
--
-- movl $0x80000001,%eax # Does the cpu have what it takes
-- cpuid
-- andl $REQUIRED_MASK1,%edx
-- xorl $REQUIRED_MASK1,%edx
-- jnz verify_cpu_no_longmode
--
--verify_cpu_sse_test:
-- movl $1,%eax
-- cpuid
-- andl $SSE_MASK,%edx
-- cmpl $SSE_MASK,%edx
-- je verify_cpu_sse_ok
-- test %di,%di
-- jz verify_cpu_no_longmode # only try to force SSE on AMD
-- movl $0xc0010015,%ecx # HWCR
-- rdmsr
-- btr $15,%eax # enable SSE
-- wrmsr
-- xor %di,%di # don't loop
-- jmp verify_cpu_sse_test # try again
--
--verify_cpu_no_longmode:
-- popfl # Restore caller passed flags
-- movl $1,%eax
-- ret
--verify_cpu_sse_ok:
-- popfl # Restore caller passed flags
-- xorl %eax, %eax
-- ret
-diff --git a/arch/x86/kernel/vm86_32.c b/arch/x86/kernel/vm86_32.c
-index 9c4e625..c992817 100644
---- a/arch/x86/kernel/vm86_32.c
-+++ b/arch/x86/kernel/vm86_32.c
-@@ -41,6 +41,7 @@
- #include <linux/ptrace.h>
- #include <linux/audit.h>
- #include <linux/stddef.h>
-+#include <linux/grsecurity.h>
-
- #include <asm/uaccess.h>
- #include <asm/io.h>
-@@ -148,7 +149,7 @@ struct pt_regs *save_v86_state(struct kernel_vm86_regs *regs)
- do_exit(SIGSEGV);
- }
-
-- tss = &per_cpu(init_tss, get_cpu());
-+ tss = init_tss + get_cpu();
- current->thread.sp0 = current->thread.saved_sp0;
- current->thread.sysenter_cs = __KERNEL_CS;
- load_sp0(tss, ¤t->thread);
-@@ -208,6 +209,13 @@ int sys_vm86old(struct pt_regs *regs)
- struct task_struct *tsk;
- int tmp, ret = -EPERM;
-
-+#ifdef CONFIG_GRKERNSEC_VM86
-+ if (!capable(CAP_SYS_RAWIO)) {
-+ gr_handle_vm86();
-+ goto out;
-+ }
-+#endif
-+
- tsk = current;
- if (tsk->thread.saved_sp0)
- goto out;
-@@ -238,6 +246,14 @@ int sys_vm86(struct pt_regs *regs)
- int tmp, ret;
- struct vm86plus_struct __user *v86;
-
-+#ifdef CONFIG_GRKERNSEC_VM86
-+ if (!capable(CAP_SYS_RAWIO)) {
-+ gr_handle_vm86();
-+ ret = -EPERM;
-+ goto out;
-+ }
-+#endif
-+
- tsk = current;
- switch (regs->bx) {
- case VM86_REQUEST_IRQ:
-@@ -324,7 +340,7 @@ static void do_sys_vm86(struct kernel_vm86_struct *info, struct task_struct *tsk
- tsk->thread.saved_fs = info->regs32->fs;
- tsk->thread.saved_gs = get_user_gs(info->regs32);
-
-- tss = &per_cpu(init_tss, get_cpu());
-+ tss = init_tss + get_cpu();
- tsk->thread.sp0 = (unsigned long) &info->VM86_TSS_ESP0;
- if (cpu_has_sep)
- tsk->thread.sysenter_cs = 0;
-@@ -529,7 +545,7 @@ static void do_int(struct kernel_vm86_regs *regs, int i,
- goto cannot_handle;
- if (i == 0x21 && is_revectored(AH(regs), &KVM86->int21_revectored))
- goto cannot_handle;
-- intr_ptr = (unsigned long __user *) (i << 2);
-+ intr_ptr = (__force unsigned long __user *) (i << 2);
- if (get_user(segoffs, intr_ptr))
- goto cannot_handle;
- if ((segoffs >> 16) == BIOSSEG)
-diff --git a/arch/x86/kernel/vmi_32.c b/arch/x86/kernel/vmi_32.c
-index d430e4c..9efc93d 100644
---- a/arch/x86/kernel/vmi_32.c
-+++ b/arch/x86/kernel/vmi_32.c
-@@ -44,12 +44,17 @@ typedef u32 __attribute__((regparm(1))) (VROMFUNC)(void);
- typedef u64 __attribute__((regparm(2))) (VROMLONGFUNC)(int);
-
- #define call_vrom_func(rom,func) \
-- (((VROMFUNC *)(rom->func))())
-+ (((VROMFUNC *)(ktva_ktla(rom.func)))())
-
- #define call_vrom_long_func(rom,func,arg) \
-- (((VROMLONGFUNC *)(rom->func)) (arg))
-+({\
-+ u64 __reloc = ((VROMLONGFUNC *)(ktva_ktla(rom.func))) (arg);\
-+ struct vmi_relocation_info *const __rel = (struct vmi_relocation_info *)&__reloc;\
-+ __rel->eip = (unsigned char *)ktva_ktla((unsigned long)__rel->eip);\
-+ __reloc;\
-+})
-
--static struct vrom_header *vmi_rom;
-+static struct vrom_header vmi_rom __attribute((__section__(".vmi.rom"), __aligned__(PAGE_SIZE)));
- static int disable_pge;
- static int disable_pse;
- static int disable_sep;
-@@ -76,10 +81,10 @@ static struct {
- void (*set_initial_ap_state)(int, int);
- void (*halt)(void);
- void (*set_lazy_mode)(int mode);
--} vmi_ops;
-+} __no_const vmi_ops __read_only;
-
- /* Cached VMI operations */
--struct vmi_timer_ops vmi_timer_ops;
-+struct vmi_timer_ops vmi_timer_ops __read_only;
-
- /*
- * VMI patching routines.
-@@ -94,7 +99,7 @@ struct vmi_timer_ops vmi_timer_ops;
- static inline void patch_offset(void *insnbuf,
- unsigned long ip, unsigned long dest)
- {
-- *(unsigned long *)(insnbuf+1) = dest-ip-5;
-+ *(unsigned long *)(insnbuf+1) = dest-ip-5;
- }
-
- static unsigned patch_internal(int call, unsigned len, void *insnbuf,
-@@ -102,6 +107,7 @@ static unsigned patch_internal(int call, unsigned len, void *insnbuf,
- {
- u64 reloc;
- struct vmi_relocation_info *const rel = (struct vmi_relocation_info *)&reloc;
-+
- reloc = call_vrom_long_func(vmi_rom, get_reloc, call);
- switch(rel->type) {
- case VMI_RELOCATION_CALL_REL:
-@@ -404,13 +410,13 @@ static void vmi_set_pud(pud_t *pudp, pud_t pudval)
-
- static void vmi_pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
- {
-- const pte_t pte = { .pte = 0 };
-+ const pte_t pte = __pte(0ULL);
- vmi_ops.set_pte(pte, ptep, vmi_flags_addr(mm, addr, VMI_PAGE_PT, 0));
- }
-
- static void vmi_pmd_clear(pmd_t *pmd)
- {
-- const pte_t pte = { .pte = 0 };
-+ const pte_t pte = __pte(0ULL);
- vmi_ops.set_pte(pte, (pte_t *)pmd, VMI_PAGE_PD);
- }
- #endif
-@@ -438,10 +444,10 @@ vmi_startup_ipi_hook(int phys_apicid, unsigned long start_eip,
- ap.ss = __KERNEL_DS;
- ap.esp = (unsigned long) start_esp;
-
-- ap.ds = __USER_DS;
-- ap.es = __USER_DS;
-+ ap.ds = __KERNEL_DS;
-+ ap.es = __KERNEL_DS;
- ap.fs = __KERNEL_PERCPU;
-- ap.gs = __KERNEL_STACK_CANARY;
-+ savesegment(gs, ap.gs);
-
- ap.eflags = 0;
-
-@@ -486,6 +492,18 @@ static void vmi_leave_lazy_mmu(void)
- paravirt_leave_lazy_mmu();
- }
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+static unsigned long vmi_pax_open_kernel(void)
-+{
-+ return 0;
-+}
-+
-+static unsigned long vmi_pax_close_kernel(void)
-+{
-+ return 0;
-+}
-+#endif
-+
- static inline int __init check_vmi_rom(struct vrom_header *rom)
- {
- struct pci_header *pci;
-@@ -498,6 +516,10 @@ static inline int __init check_vmi_rom(struct vrom_header *rom)
- return 0;
- if (rom->vrom_signature != VMI_SIGNATURE)
- return 0;
-+ if (rom->rom_length * 512 > sizeof(*rom)) {
-+ printk(KERN_WARNING "PAX: VMI: ROM size too big: %x\n", rom->rom_length * 512);
-+ return 0;
-+ }
- if (rom->api_version_maj != VMI_API_REV_MAJOR ||
- rom->api_version_min+1 < VMI_API_REV_MINOR+1) {
- printk(KERN_WARNING "VMI: Found mismatched rom version %d.%d\n",
-@@ -562,7 +584,7 @@ static inline int __init probe_vmi_rom(void)
- struct vrom_header *romstart;
- romstart = (struct vrom_header *)isa_bus_to_virt(base);
- if (check_vmi_rom(romstart)) {
-- vmi_rom = romstart;
-+ vmi_rom = *romstart;
- return 1;
- }
- }
-@@ -604,9 +626,9 @@ do { \
- reloc = call_vrom_long_func(vmi_rom, get_reloc, \
- VMI_CALL_##vmicall); \
- if (rel->type == VMI_RELOCATION_CALL_REL) \
-- opname = (void *)rel->eip; \
-+ *(void **)&opname = (void *)rel->eip; \
- else if (rel->type == VMI_RELOCATION_NOP) \
-- opname = (void *)vmi_nop; \
-+ *(void **)&opname = (void *)vmi_nop; \
- else if (rel->type != VMI_RELOCATION_NONE) \
- printk(KERN_WARNING "VMI: Unknown relocation " \
- "type %d for " #vmicall"\n",\
-@@ -626,7 +648,7 @@ do { \
- VMI_CALL_##vmicall); \
- BUG_ON(rel->type == VMI_RELOCATION_JUMP_REL); \
- if (rel->type == VMI_RELOCATION_CALL_REL) { \
-- opname = wrapper; \
-+ *(void **)&opname = wrapper; \
- vmi_ops.cache = (void *)rel->eip; \
- } \
- } while (0)
-@@ -650,7 +672,7 @@ static inline int __init activate_vmi(void)
- pv_info.kernel_rpl = kernel_cs & SEGMENT_RPL_MASK;
- pv_info.name = "vmi [deprecated]";
-
-- pv_init_ops.patch = vmi_patch;
-+ *(void **)&pv_init_ops.patch = vmi_patch;
-
- /*
- * Many of these operations are ABI compatible with VMI.
-@@ -706,7 +728,7 @@ static inline int __init activate_vmi(void)
- para_fill(pv_cpu_ops.store_gdt, GetGDT);
- para_fill(pv_cpu_ops.store_idt, GetIDT);
- para_fill(pv_cpu_ops.store_tr, GetTR);
-- pv_cpu_ops.load_tls = vmi_load_tls;
-+ *(void **)&pv_cpu_ops.load_tls = vmi_load_tls;
- para_wrap(pv_cpu_ops.write_ldt_entry, vmi_write_ldt_entry,
- write_ldt_entry, WriteLDTEntry);
- para_wrap(pv_cpu_ops.write_gdt_entry, vmi_write_gdt_entry,
-@@ -790,8 +812,8 @@ static inline int __init activate_vmi(void)
- * the backend. They are performance critical anyway, so requiring
- * a patch is not a big problem.
- */
-- pv_cpu_ops.irq_enable_sysexit = (void *)0xfeedbab0;
-- pv_cpu_ops.iret = (void *)0xbadbab0;
-+ *(void **)&pv_cpu_ops.irq_enable_sysexit = (void *)0xfeedbab0;
-+ *(void **)&pv_cpu_ops.iret = (void *)0xbadbab0;
-
- #ifdef CONFIG_SMP
- para_wrap(pv_apic_ops.startup_ipi_hook, vmi_startup_ipi_hook, set_initial_ap_state, SetInitialAPState);
-@@ -817,15 +839,15 @@ static inline int __init activate_vmi(void)
- vmi_timer_ops.set_alarm = vmi_get_function(VMI_CALL_SetAlarm);
- vmi_timer_ops.cancel_alarm =
- vmi_get_function(VMI_CALL_CancelAlarm);
-- x86_init.timers.timer_init = vmi_time_init;
-+ *(void **)&x86_init.timers.timer_init = vmi_time_init;
- #ifdef CONFIG_X86_LOCAL_APIC
-- x86_init.timers.setup_percpu_clockev = vmi_time_bsp_init;
-- x86_cpuinit.setup_percpu_clockev = vmi_time_ap_init;
-+ *(void **)&x86_init.timers.setup_percpu_clockev = vmi_time_bsp_init;
-+ *(void **)&x86_cpuinit.setup_percpu_clockev = vmi_time_ap_init;
- #endif
-- pv_time_ops.sched_clock = vmi_sched_clock;
-- x86_platform.calibrate_tsc = vmi_tsc_khz;
-- x86_platform.get_wallclock = vmi_get_wallclock;
-- x86_platform.set_wallclock = vmi_set_wallclock;
-+ *(void **)&pv_time_ops.sched_clock = vmi_sched_clock;
-+ *(void **)&x86_platform.calibrate_tsc = vmi_tsc_khz;
-+ *(void **)&x86_platform.get_wallclock = vmi_get_wallclock;
-+ *(void **)&x86_platform.set_wallclock = vmi_set_wallclock;
-
- /* We have true wallclock functions; disable CMOS clock sync */
- no_sync_cmos_clock = 1;
-@@ -836,6 +858,11 @@ static inline int __init activate_vmi(void)
-
- para_fill(pv_irq_ops.safe_halt, Halt);
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+ pv_mmu_ops.pax_open_kernel = vmi_pax_open_kernel;
-+ pv_mmu_ops.pax_close_kernel = vmi_pax_close_kernel;
-+#endif
-+
- /*
- * Alternative instruction rewriting doesn't happen soon enough
- * to convert VMI_IRET to a call instead of a jump; so we have
-@@ -853,16 +880,16 @@ static inline int __init activate_vmi(void)
-
- void __init vmi_init(void)
- {
-- if (!vmi_rom)
-+ if (!vmi_rom.rom_signature)
- probe_vmi_rom();
- else
-- check_vmi_rom(vmi_rom);
-+ check_vmi_rom(&vmi_rom);
-
- /* In case probing for or validating the ROM failed, basil */
-- if (!vmi_rom)
-+ if (!vmi_rom.rom_signature)
- return;
-
-- reserve_top_address(-vmi_rom->virtual_top);
-+ reserve_top_address(-vmi_rom.virtual_top);
-
- #ifdef CONFIG_X86_IO_APIC
- /* This is virtual hardware; timer routing is wired correctly */
-@@ -874,7 +901,7 @@ void __init vmi_activate(void)
- {
- unsigned long flags;
-
-- if (!vmi_rom)
-+ if (!vmi_rom.rom_signature)
- return;
-
- local_irq_save(flags);
-diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
-index 3c68fe2..7a8c35b 100644
---- a/arch/x86/kernel/vmlinux.lds.S
-+++ b/arch/x86/kernel/vmlinux.lds.S
-@@ -26,6 +26,13 @@
- #include <asm/page_types.h>
- #include <asm/cache.h>
- #include <asm/boot.h>
-+#include <asm/segment.h>
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+#define __KERNEL_TEXT_OFFSET (LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR)
-+#else
-+#define __KERNEL_TEXT_OFFSET 0
-+#endif
-
- #undef i386 /* in case the preprocessor is a 32bit one */
-
-@@ -34,40 +41,53 @@ OUTPUT_FORMAT(CONFIG_OUTPUT_FORMAT, CONFIG_OUTPUT_FORMAT, CONFIG_OUTPUT_FORMAT)
- #ifdef CONFIG_X86_32
- OUTPUT_ARCH(i386)
- ENTRY(phys_startup_32)
--jiffies = jiffies_64;
- #else
- OUTPUT_ARCH(i386:x86-64)
- ENTRY(phys_startup_64)
--jiffies_64 = jiffies;
- #endif
-
- PHDRS {
- text PT_LOAD FLAGS(5); /* R_E */
-- data PT_LOAD FLAGS(7); /* RWE */
-+#ifdef CONFIG_X86_32
-+ module PT_LOAD FLAGS(5); /* R_E */
-+#endif
-+#ifdef CONFIG_XEN
-+ rodata PT_LOAD FLAGS(5); /* R_E */
-+#else
-+ rodata PT_LOAD FLAGS(4); /* R__ */
-+#endif
-+ data PT_LOAD FLAGS(6); /* RW_ */
- #ifdef CONFIG_X86_64
- user PT_LOAD FLAGS(5); /* R_E */
-+#endif
-+ init.begin PT_LOAD FLAGS(6); /* RW_ */
- #ifdef CONFIG_SMP
- percpu PT_LOAD FLAGS(6); /* RW_ */
- #endif
-+ text.init PT_LOAD FLAGS(5); /* R_E */
-+ text.exit PT_LOAD FLAGS(5); /* R_E */
- init PT_LOAD FLAGS(7); /* RWE */
--#endif
- note PT_NOTE FLAGS(0); /* ___ */
- }
-
- SECTIONS
- {
- #ifdef CONFIG_X86_32
-- . = LOAD_OFFSET + LOAD_PHYSICAL_ADDR;
-- phys_startup_32 = startup_32 - LOAD_OFFSET;
-+ . = LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR;
- #else
-- . = __START_KERNEL;
-- phys_startup_64 = startup_64 - LOAD_OFFSET;
-+ . = __START_KERNEL;
- #endif
-
- /* Text and read-only data */
-- .text : AT(ADDR(.text) - LOAD_OFFSET) {
-- _text = .;
-+ .text (. - __KERNEL_TEXT_OFFSET): AT(ADDR(.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
- /* bootstrapping code */
-+#ifdef CONFIG_X86_32
-+ phys_startup_32 = startup_32 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
-+#else
-+ phys_startup_64 = startup_64 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
-+#endif
-+ __LOAD_PHYSICAL_ADDR = . - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
-+ _text = .;
- HEAD_TEXT
- #ifdef CONFIG_X86_32
- . = ALIGN(PAGE_SIZE);
-@@ -82,28 +102,72 @@ SECTIONS
- IRQENTRY_TEXT
- *(.fixup)
- *(.gnu.warning)
-- /* End of text section */
-- _etext = .;
- } :text = 0x9090
-
-- NOTES :text :note
-+ . += __KERNEL_TEXT_OFFSET;
-
-- EXCEPTION_TABLE(16) :text = 0x9090
-+#ifdef CONFIG_X86_32
-+ . = ALIGN(PAGE_SIZE);
-+ .vmi.rom : AT(ADDR(.vmi.rom) - LOAD_OFFSET) {
-+ *(.vmi.rom)
-+ } :module
-+
-+ . = ALIGN(PAGE_SIZE);
-+ .module.text : AT(ADDR(.module.text) - LOAD_OFFSET) {
-+
-+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_MODULES)
-+ MODULES_EXEC_VADDR = .;
-+ BYTE(0)
-+ . += (CONFIG_PAX_KERNEXEC_MODULE_TEXT * 1024 * 1024);
-+ . = ALIGN(HPAGE_SIZE) - 1;
-+ MODULES_EXEC_END = .;
-+#endif
-+
-+ } :module
-+#endif
-+
-+ .text.end : AT(ADDR(.text.end) - LOAD_OFFSET) {
-+ /* End of text section */
-+ BYTE(0)
-+ _etext = . - __KERNEL_TEXT_OFFSET;
-+ }
-+
-+#ifdef CONFIG_X86_32
-+ . = ALIGN(PAGE_SIZE);
-+ .rodata.page_aligned : AT(ADDR(.rodata.page_aligned) - LOAD_OFFSET) {
-+ *(.idt)
-+ . = ALIGN(PAGE_SIZE);
-+ *(.empty_zero_page)
-+ *(.swapper_pg_fixmap)
-+ *(.swapper_pg_pmd)
-+ *(.swapper_pg_dir)
-+ *(.trampoline_pg_dir)
-+ } :rodata
-+#endif
-+
-+ . = ALIGN(PAGE_SIZE);
-+ NOTES :rodata :note
-+
-+ EXCEPTION_TABLE(16) :rodata
-
- RO_DATA(PAGE_SIZE)
-
- /* Data */
- .data : AT(ADDR(.data) - LOAD_OFFSET) {
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ . = ALIGN(HPAGE_SIZE);
-+#else
-+ . = ALIGN(PAGE_SIZE);
-+#endif
-+
- /* Start of data section */
- _sdata = .;
-
- /* init_task */
- INIT_TASK_DATA(THREAD_SIZE)
-
--#ifdef CONFIG_X86_32
-- /* 32 bit has nosave before _edata */
- NOSAVE_DATA
--#endif
-
- PAGE_ALIGNED_DATA(PAGE_SIZE)
-
-@@ -112,6 +176,8 @@ SECTIONS
- DATA_DATA
- CONSTRUCTORS
-
-+ jiffies = jiffies_64;
-+
- /* rarely changed data like cpu maps */
- READ_MOSTLY_DATA(CONFIG_X86_INTERNODE_CACHE_BYTES)
-
-@@ -166,12 +232,6 @@ SECTIONS
- }
- vgetcpu_mode = VVIRT(.vgetcpu_mode);
-
-- . = ALIGN(CONFIG_X86_L1_CACHE_BYTES);
-- .jiffies : AT(VLOAD(.jiffies)) {
-- *(.jiffies)
-- }
-- jiffies = VVIRT(.jiffies);
--
- .vsyscall_3 ADDR(.vsyscall_0) + 3072: AT(VLOAD(.vsyscall_3)) {
- *(.vsyscall_3)
- }
-@@ -187,12 +247,19 @@ SECTIONS
- #endif /* CONFIG_X86_64 */
-
- /* Init code and data - will be freed after init */
-- . = ALIGN(PAGE_SIZE);
- .init.begin : AT(ADDR(.init.begin) - LOAD_OFFSET) {
-+ BYTE(0)
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ . = ALIGN(HPAGE_SIZE);
-+#else
-+ . = ALIGN(PAGE_SIZE);
-+#endif
-+
- __init_begin = .; /* paired with __init_end */
-- }
-+ } :init.begin
-
--#if defined(CONFIG_X86_64) && defined(CONFIG_SMP)
-+#ifdef CONFIG_SMP
- /*
- * percpu offsets are zero-based on SMP. PERCPU_VADDR() changes the
- * output PHDR, so the next output section - .init.text - should
-@@ -201,12 +268,27 @@ SECTIONS
- PERCPU_VADDR(0, :percpu)
- #endif
-
-- INIT_TEXT_SECTION(PAGE_SIZE)
--#ifdef CONFIG_X86_64
-- :init
--#endif
-+ . = ALIGN(PAGE_SIZE);
-+ init_begin = .;
-+ .init.text (. - __KERNEL_TEXT_OFFSET): AT(init_begin - LOAD_OFFSET) {
-+ VMLINUX_SYMBOL(_sinittext) = .;
-+ INIT_TEXT
-+ VMLINUX_SYMBOL(_einittext) = .;
-+ . = ALIGN(PAGE_SIZE);
-+ } :text.init
-
-- INIT_DATA_SECTION(16)
-+ /*
-+ * .exit.text is discard at runtime, not link time, to deal with
-+ * references from .altinstructions and .eh_frame
-+ */
-+ .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
-+ EXIT_TEXT
-+ . = ALIGN(16);
-+ } :text.exit
-+ . = init_begin + SIZEOF(.init.text) + SIZEOF(.exit.text);
-+
-+ . = ALIGN(PAGE_SIZE);
-+ INIT_DATA_SECTION(16) :init
-
- .x86_cpu_dev.init : AT(ADDR(.x86_cpu_dev.init) - LOAD_OFFSET) {
- __x86_cpu_dev_start = .;
-@@ -232,19 +314,11 @@ SECTIONS
- *(.altinstr_replacement)
- }
-
-- /*
-- * .exit.text is discard at runtime, not link time, to deal with
-- * references from .altinstructions and .eh_frame
-- */
-- .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
-- EXIT_TEXT
-- }
--
- .exit.data : AT(ADDR(.exit.data) - LOAD_OFFSET) {
- EXIT_DATA
- }
-
--#if !defined(CONFIG_X86_64) || !defined(CONFIG_SMP)
-+#ifndef CONFIG_SMP
- PERCPU(PAGE_SIZE)
- #endif
-
-@@ -267,12 +341,6 @@ SECTIONS
- . = ALIGN(PAGE_SIZE);
- }
-
--#ifdef CONFIG_X86_64
-- .data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) {
-- NOSAVE_DATA
-- }
--#endif
--
- /* BSS */
- . = ALIGN(PAGE_SIZE);
- .bss : AT(ADDR(.bss) - LOAD_OFFSET) {
-@@ -288,6 +356,7 @@ SECTIONS
- __brk_base = .;
- . += 64 * 1024; /* 64k alignment slop space */
- *(.brk_reservation) /* areas brk users have reserved */
-+ . = ALIGN(HPAGE_SIZE);
- __brk_limit = .;
- }
-
-@@ -316,13 +385,12 @@ SECTIONS
- * for the boot processor.
- */
- #define INIT_PER_CPU(x) init_per_cpu__##x = per_cpu__##x + __per_cpu_load
--INIT_PER_CPU(gdt_page);
- INIT_PER_CPU(irq_stack_union);
-
- /*
- * Build-time check on the image size:
- */
--. = ASSERT((_end - _text <= KERNEL_IMAGE_SIZE),
-+. = ASSERT((_end - _text - __KERNEL_TEXT_OFFSET <= KERNEL_IMAGE_SIZE),
- "kernel image bigger than KERNEL_IMAGE_SIZE");
-
- #ifdef CONFIG_SMP
-diff --git a/arch/x86/kernel/vsmp_64.c b/arch/x86/kernel/vsmp_64.c
-index a1d804b..1ab845e 100644
---- a/arch/x86/kernel/vsmp_64.c
-+++ b/arch/x86/kernel/vsmp_64.c
-@@ -98,7 +98,7 @@ static void __init set_vsmp_pv_ops(void)
- pv_irq_ops.irq_enable = PV_CALLEE_SAVE(vsmp_irq_enable);
- pv_irq_ops.save_fl = PV_CALLEE_SAVE(vsmp_save_fl);
- pv_irq_ops.restore_fl = PV_CALLEE_SAVE(vsmp_restore_fl);
-- pv_init_ops.patch = vsmp_patch;
-+ *(void **)&pv_init_ops.patch = vsmp_patch;
-
- ctl &= ~(1 << 4);
- writel(ctl, address + 4);
-diff --git a/arch/x86/kernel/vsyscall_64.c b/arch/x86/kernel/vsyscall_64.c
-index 62f39d7..3bc46a1 100644
---- a/arch/x86/kernel/vsyscall_64.c
-+++ b/arch/x86/kernel/vsyscall_64.c
-@@ -80,6 +80,7 @@ void update_vsyscall(struct timespec *wall_time, struct clocksource *clock,
-
- write_seqlock_irqsave(&vsyscall_gtod_data.lock, flags);
- /* copy vsyscall data */
-+ strlcpy(vsyscall_gtod_data.clock.name, clock->name, sizeof vsyscall_gtod_data.clock.name);
- vsyscall_gtod_data.clock.vread = clock->vread;
- vsyscall_gtod_data.clock.cycle_last = clock->cycle_last;
- vsyscall_gtod_data.clock.mask = clock->mask;
-@@ -203,7 +204,7 @@ vgetcpu(unsigned *cpu, unsigned *node, struct getcpu_cache *tcache)
- We do this here because otherwise user space would do it on
- its own in a likely inferior way (no access to jiffies).
- If you don't like it pass NULL. */
-- if (tcache && tcache->blob[0] == (j = __jiffies)) {
-+ if (tcache && tcache->blob[0] == (j = jiffies)) {
- p = tcache->blob[1];
- } else if (__vgetcpu_mode == VGETCPU_RDTSCP) {
- /* Load per CPU data from RDTSCP */
-diff --git a/arch/x86/kernel/x8664_ksyms_64.c b/arch/x86/kernel/x8664_ksyms_64.c
-index 3909e3b..5433a97 100644
---- a/arch/x86/kernel/x8664_ksyms_64.c
-+++ b/arch/x86/kernel/x8664_ksyms_64.c
-@@ -30,8 +30,6 @@ EXPORT_SYMBOL(__put_user_8);
-
- EXPORT_SYMBOL(copy_user_generic);
- EXPORT_SYMBOL(__copy_user_nocache);
--EXPORT_SYMBOL(copy_from_user);
--EXPORT_SYMBOL(copy_to_user);
- EXPORT_SYMBOL(__copy_from_user_inatomic);
-
- EXPORT_SYMBOL(copy_page);
-diff --git a/arch/x86/kernel/xsave.c b/arch/x86/kernel/xsave.c
-index c5ee17e..e73621d2 100644
---- a/arch/x86/kernel/xsave.c
-+++ b/arch/x86/kernel/xsave.c
-@@ -54,7 +54,7 @@ int check_for_xstate(struct i387_fxsave_struct __user *buf,
- fx_sw_user->xstate_size > fx_sw_user->extended_size)
- return -1;
-
-- err = __get_user(magic2, (__u32 *) (((void *)fpstate) +
-+ err = __get_user(magic2, (__u32 __user *) (((void __user *)fpstate) +
- fx_sw_user->extended_size -
- FP_XSTATE_MAGIC2_SIZE));
- /*
-@@ -196,7 +196,7 @@ fx_only:
- * the other extended state.
- */
- xrstor_state(init_xstate_buf, pcntxt_mask & ~XSTATE_FPSSE);
-- return fxrstor_checking((__force struct i387_fxsave_struct *)buf);
-+ return fxrstor_checking((struct i387_fxsave_struct __user *)buf);
- }
-
- /*
-@@ -228,8 +228,7 @@ int restore_i387_xstate(void __user *buf)
- if (task_thread_info(tsk)->status & TS_XSAVE)
- err = restore_user_xstate(buf);
- else
-- err = fxrstor_checking((__force struct i387_fxsave_struct *)
-- buf);
-+ err = fxrstor_checking((struct i387_fxsave_struct __user *)buf);
- if (unlikely(err)) {
- /*
- * Encountered an error while doing the restore from the
-diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
-index aa2d905..d7384e3 100644
---- a/arch/x86/kvm/emulate.c
-+++ b/arch/x86/kvm/emulate.c
-@@ -81,8 +81,8 @@
- #define Src2CL (1<<29)
- #define Src2ImmByte (2<<29)
- #define Src2One (3<<29)
--#define Src2Imm16 (4<<29)
--#define Src2Mask (7<<29)
-+#define Src2Imm16 (4U<<29)
-+#define Src2Mask (7U<<29)
-
- enum {
- Group1_80, Group1_81, Group1_82, Group1_83,
-@@ -411,6 +411,7 @@ static u32 group2_table[] = {
-
- #define ____emulate_2op(_op, _src, _dst, _eflags, _x, _y, _suffix) \
- do { \
-+ unsigned long _tmp; \
- __asm__ __volatile__ ( \
- _PRE_EFLAGS("0", "4", "2") \
- _op _suffix " %"_x"3,%1; " \
-@@ -424,8 +425,6 @@ static u32 group2_table[] = {
- /* Raw emulation: instruction has two explicit operands. */
- #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
- do { \
-- unsigned long _tmp; \
-- \
- switch ((_dst).bytes) { \
- case 2: \
- ____emulate_2op(_op,_src,_dst,_eflags,_wx,_wy,"w"); \
-@@ -441,7 +440,6 @@ static u32 group2_table[] = {
-
- #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
- do { \
-- unsigned long _tmp; \
- switch ((_dst).bytes) { \
- case 1: \
- ____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b"); \
-diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
-index 8dfeaaa..4daa395 100644
---- a/arch/x86/kvm/lapic.c
-+++ b/arch/x86/kvm/lapic.c
-@@ -52,7 +52,7 @@
- #define APIC_BUS_CYCLE_NS 1
-
- /* #define apic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg) */
--#define apic_debug(fmt, arg...)
-+#define apic_debug(fmt, arg...) do {} while (0)
-
- #define APIC_LVT_NUM 6
- /* 14 is the version for Xeon and Pentium 8.4.8*/
-diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
-index 3bc2707..dd157e2 100644
---- a/arch/x86/kvm/paging_tmpl.h
-+++ b/arch/x86/kvm/paging_tmpl.h
-@@ -416,6 +416,8 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr,
- int level = PT_PAGE_TABLE_LEVEL;
- unsigned long mmu_seq;
-
-+ pax_track_stack();
-+
- pgprintk("%s: addr %lx err %x\n", __func__, addr, error_code);
- kvm_mmu_audit(vcpu, "pre page fault");
-
-@@ -461,6 +463,7 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr,
- kvm_mmu_free_some_pages(vcpu);
- sptep = FNAME(fetch)(vcpu, addr, &walker, user_fault, write_fault,
- level, &write_pt, pfn);
-+ (void)sptep;
- pgprintk("%s: shadow pte %p %llx ptwrite %d\n", __func__,
- sptep, *sptep, write_pt);
-
-diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
-index 7c6e63e..c5d92c1 100644
---- a/arch/x86/kvm/svm.c
-+++ b/arch/x86/kvm/svm.c
-@@ -2486,7 +2486,11 @@ static void reload_tss(struct kvm_vcpu *vcpu)
- int cpu = raw_smp_processor_id();
-
- struct svm_cpu_data *svm_data = per_cpu(svm_data, cpu);
-+
-+ pax_open_kernel();
- svm_data->tss_desc->type = 9; /* available 32/64-bit TSS */
-+ pax_close_kernel();
-+
- load_TR_desc();
- }
-
-@@ -2947,7 +2951,7 @@ static bool svm_gb_page_enable(void)
- return true;
- }
-
--static struct kvm_x86_ops svm_x86_ops = {
-+static const struct kvm_x86_ops svm_x86_ops = {
- .cpu_has_kvm_support = has_svm,
- .disabled_by_bios = is_disabled,
- .hardware_setup = svm_hardware_setup,
-diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
-index e6d925f..6bde4d6 100644
---- a/arch/x86/kvm/vmx.c
-+++ b/arch/x86/kvm/vmx.c
-@@ -570,7 +570,11 @@ static void reload_tss(void)
-
- kvm_get_gdt(&gdt);
- descs = (void *)gdt.base;
-+
-+ pax_open_kernel();
- descs[GDT_ENTRY_TSS].type = 9; /* available TSS */
-+ pax_close_kernel();
-+
- load_TR_desc();
- }
-
-@@ -746,6 +750,10 @@ static void vmx_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
- kvm_get_gdt(&dt);
- vmcs_writel(HOST_GDTR_BASE, dt.base); /* 22.2.4 */
-
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ vmcs_writel(HOST_CR3, read_cr3()); /* 22.2.3 FIXME: shadow tables */
-+#endif
-+
- rdmsrl(MSR_IA32_SYSENTER_ESP, sysenter_esp);
- vmcs_writel(HOST_IA32_SYSENTER_ESP, sysenter_esp); /* 22.2.3 */
-
-@@ -1410,8 +1418,11 @@ static __init int hardware_setup(void)
- if (!cpu_has_vmx_flexpriority())
- flexpriority_enabled = 0;
-
-- if (!cpu_has_vmx_tpr_shadow())
-- kvm_x86_ops->update_cr8_intercept = NULL;
-+ if (!cpu_has_vmx_tpr_shadow()) {
-+ pax_open_kernel();
-+ *(void **)&kvm_x86_ops->update_cr8_intercept = NULL;
-+ pax_close_kernel();
-+ }
-
- if (enable_ept && !cpu_has_vmx_ept_2m_page())
- kvm_disable_largepages();
-@@ -2338,7 +2349,10 @@ static int vmx_vcpu_setup(struct vcpu_vmx *vmx)
-
- vmcs_writel(HOST_CR0, read_cr0()); /* 22.2.3 */
- vmcs_writel(HOST_CR4, read_cr4()); /* 22.2.3, 22.2.5 */
-+
-+#ifndef CONFIG_PAX_PER_CPU_PGD
- vmcs_writel(HOST_CR3, read_cr3()); /* 22.2.3 FIXME: shadow tables */
-+#endif
-
- vmcs_write16(HOST_CS_SELECTOR, __KERNEL_CS); /* 22.2.4 */
- vmcs_write16(HOST_DS_SELECTOR, __KERNEL_DS); /* 22.2.4 */
-@@ -2362,7 +2376,7 @@ static int vmx_vcpu_setup(struct vcpu_vmx *vmx)
- vmcs_writel(HOST_IDTR_BASE, dt.base); /* 22.2.4 */
-
- asm("mov $.Lkvm_vmx_return, %0" : "=r"(kvm_vmx_return));
-- vmcs_writel(HOST_RIP, kvm_vmx_return); /* 22.2.5 */
-+ vmcs_writel(HOST_RIP, ktla_ktva(kvm_vmx_return)); /* 22.2.5 */
- vmcs_write32(VM_EXIT_MSR_STORE_COUNT, 0);
- vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, 0);
- vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, 0);
-@@ -3718,6 +3732,12 @@ static void vmx_vcpu_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
- "jmp .Lkvm_vmx_return \n\t"
- ".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t"
- ".Lkvm_vmx_return: "
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ "ljmp %[cs],$.Lkvm_vmx_return2\n\t"
-+ ".Lkvm_vmx_return2: "
-+#endif
-+
- /* Save guest registers, load host registers, keep flags */
- "xchg %0, (%%"R"sp) \n\t"
- "mov %%"R"ax, %c[rax](%0) \n\t"
-@@ -3764,8 +3784,13 @@ static void vmx_vcpu_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
- [r15]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R15])),
- #endif
- [cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2))
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ ,[cs]"i"(__KERNEL_CS)
-+#endif
-+
- : "cc", "memory"
-- , R"bx", R"di", R"si"
-+ , R"ax", R"bx", R"di", R"si"
- #ifdef CONFIG_X86_64
- , "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15"
- #endif
-@@ -3782,7 +3807,16 @@ static void vmx_vcpu_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
- if (vmx->rmode.irq.pending)
- fixup_rmode_irq(vmx);
-
-- asm("mov %0, %%ds; mov %0, %%es" : : "r"(__USER_DS));
-+ asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r"(__KERNEL_DS));
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ loadsegment(fs, __KERNEL_PERCPU);
-+#endif
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ __set_fs(current_thread_info()->addr_limit);
-+#endif
-+
- vmx->launched = 1;
-
- vmx_complete_interrupts(vmx);
-@@ -3957,7 +3991,7 @@ static bool vmx_gb_page_enable(void)
- return false;
- }
-
--static struct kvm_x86_ops vmx_x86_ops = {
-+static const struct kvm_x86_ops vmx_x86_ops = {
- .cpu_has_kvm_support = cpu_has_kvm_support,
- .disabled_by_bios = vmx_disabled_by_bios,
- .hardware_setup = hardware_setup,
-diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index 271fddf..ea708b4 100644
---- a/arch/x86/kvm/x86.c
-+++ b/arch/x86/kvm/x86.c
-@@ -82,7 +82,7 @@ static void update_cr8_intercept(struct kvm_vcpu *vcpu);
- static int kvm_dev_ioctl_get_supported_cpuid(struct kvm_cpuid2 *cpuid,
- struct kvm_cpuid_entry2 __user *entries);
-
--struct kvm_x86_ops *kvm_x86_ops;
-+const struct kvm_x86_ops *kvm_x86_ops;
- EXPORT_SYMBOL_GPL(kvm_x86_ops);
-
- int ignore_msrs = 0;
-@@ -1430,15 +1430,20 @@ static int kvm_vcpu_ioctl_set_cpuid2(struct kvm_vcpu *vcpu,
- struct kvm_cpuid2 *cpuid,
- struct kvm_cpuid_entry2 __user *entries)
- {
-- int r;
-+ int r, i;
-
- r = -E2BIG;
- if (cpuid->nent > KVM_MAX_CPUID_ENTRIES)
- goto out;
- r = -EFAULT;
-- if (copy_from_user(&vcpu->arch.cpuid_entries, entries,
-- cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
-+ if (!access_ok(VERIFY_READ, entries, cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
- goto out;
-+ for (i = 0; i < cpuid->nent; ++i) {
-+ struct kvm_cpuid_entry2 cpuid_entry;
-+ if (__copy_from_user(&cpuid_entry, entries + i, sizeof(cpuid_entry)))
-+ goto out;
-+ vcpu->arch.cpuid_entries[i] = cpuid_entry;
-+ }
- vcpu->arch.cpuid_nent = cpuid->nent;
- kvm_apic_set_version(vcpu);
- return 0;
-@@ -1451,16 +1456,20 @@ static int kvm_vcpu_ioctl_get_cpuid2(struct kvm_vcpu *vcpu,
- struct kvm_cpuid2 *cpuid,
- struct kvm_cpuid_entry2 __user *entries)
- {
-- int r;
-+ int r, i;
-
- vcpu_load(vcpu);
- r = -E2BIG;
- if (cpuid->nent < vcpu->arch.cpuid_nent)
- goto out;
- r = -EFAULT;
-- if (copy_to_user(entries, &vcpu->arch.cpuid_entries,
-- vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
-+ if (!access_ok(VERIFY_WRITE, entries, vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
- goto out;
-+ for (i = 0; i < vcpu->arch.cpuid_nent; ++i) {
-+ struct kvm_cpuid_entry2 cpuid_entry = vcpu->arch.cpuid_entries[i];
-+ if (__copy_to_user(entries + i, &cpuid_entry, sizeof(cpuid_entry)))
-+ goto out;
-+ }
- return 0;
-
- out:
-@@ -1678,7 +1687,7 @@ static int kvm_vcpu_ioctl_set_lapic(struct kvm_vcpu *vcpu,
- static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
- struct kvm_interrupt *irq)
- {
-- if (irq->irq < 0 || irq->irq >= 256)
-+ if (irq->irq >= 256)
- return -EINVAL;
- if (irqchip_in_kernel(vcpu->kvm))
- return -ENXIO;
-@@ -3300,10 +3309,10 @@ static struct notifier_block kvmclock_cpufreq_notifier_block = {
- .notifier_call = kvmclock_cpufreq_notifier
- };
-
--int kvm_arch_init(void *opaque)
-+int kvm_arch_init(const void *opaque)
- {
- int r, cpu;
-- struct kvm_x86_ops *ops = (struct kvm_x86_ops *)opaque;
-+ const struct kvm_x86_ops *ops = (const struct kvm_x86_ops *)opaque;
-
- if (kvm_x86_ops) {
- printk(KERN_ERR "kvm: already loaded the other module\n");
-diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
-index 7e59dc1..6673211 100644
---- a/arch/x86/lguest/boot.c
-+++ b/arch/x86/lguest/boot.c
-@@ -1088,12 +1088,12 @@ static u32 lguest_apic_safe_wait_icr_idle(void)
-
- static void set_lguest_basic_apic_ops(void)
- {
-- apic->read = lguest_apic_read;
-- apic->write = lguest_apic_write;
-- apic->icr_read = lguest_apic_icr_read;
-- apic->icr_write = lguest_apic_icr_write;
-- apic->wait_icr_idle = lguest_apic_wait_icr_idle;
-- apic->safe_wait_icr_idle = lguest_apic_safe_wait_icr_idle;
-+ *(void **)&apic->read = lguest_apic_read;
-+ *(void **)&apic->write = lguest_apic_write;
-+ *(void **)&apic->icr_read = lguest_apic_icr_read;
-+ *(void **)&apic->icr_write = lguest_apic_icr_write;
-+ *(void **)&apic->wait_icr_idle = lguest_apic_wait_icr_idle;
-+ *(void **)&apic->safe_wait_icr_idle = lguest_apic_safe_wait_icr_idle;
- };
- #endif
-
-@@ -1172,9 +1172,10 @@ static __init int early_put_chars(u32 vtermno, const char *buf, int count)
- * Rebooting also tells the Host we're finished, but the RESTART flag tells the
- * Launcher to reboot us.
- */
--static void lguest_restart(char *reason)
-+static __noreturn void lguest_restart(char *reason)
- {
- kvm_hypercall2(LHCALL_SHUTDOWN, __pa(reason), LGUEST_SHUTDOWN_RESTART);
-+ BUG();
- }
-
- /*G:050
-@@ -1264,28 +1265,28 @@ __init void lguest_init(void)
- pv_irq_ops.safe_halt = lguest_safe_halt;
-
- /* Setup operations */
-- pv_init_ops.patch = lguest_patch;
-+ *(void **)&pv_init_ops.patch = lguest_patch;
-
- /* Intercepts of various CPU instructions */
-- pv_cpu_ops.load_gdt = lguest_load_gdt;
-- pv_cpu_ops.cpuid = lguest_cpuid;
-- pv_cpu_ops.load_idt = lguest_load_idt;
-- pv_cpu_ops.iret = lguest_iret;
-- pv_cpu_ops.load_sp0 = lguest_load_sp0;
-- pv_cpu_ops.load_tr_desc = lguest_load_tr_desc;
-- pv_cpu_ops.set_ldt = lguest_set_ldt;
-- pv_cpu_ops.load_tls = lguest_load_tls;
-- pv_cpu_ops.set_debugreg = lguest_set_debugreg;
-- pv_cpu_ops.clts = lguest_clts;
-- pv_cpu_ops.read_cr0 = lguest_read_cr0;
-- pv_cpu_ops.write_cr0 = lguest_write_cr0;
-- pv_cpu_ops.read_cr4 = lguest_read_cr4;
-- pv_cpu_ops.write_cr4 = lguest_write_cr4;
-- pv_cpu_ops.write_gdt_entry = lguest_write_gdt_entry;
-- pv_cpu_ops.write_idt_entry = lguest_write_idt_entry;
-- pv_cpu_ops.wbinvd = lguest_wbinvd;
-- pv_cpu_ops.start_context_switch = paravirt_start_context_switch;
-- pv_cpu_ops.end_context_switch = lguest_end_context_switch;
-+ *(void **)&pv_cpu_ops.load_gdt = lguest_load_gdt;
-+ *(void **)&pv_cpu_ops.cpuid = lguest_cpuid;
-+ *(void **)&pv_cpu_ops.load_idt = lguest_load_idt;
-+ *(void **)&pv_cpu_ops.iret = lguest_iret;
-+ *(void **)&pv_cpu_ops.load_sp0 = lguest_load_sp0;
-+ *(void **)&pv_cpu_ops.load_tr_desc = lguest_load_tr_desc;
-+ *(void **)&pv_cpu_ops.set_ldt = lguest_set_ldt;
-+ *(void **)&pv_cpu_ops.load_tls = lguest_load_tls;
-+ *(void **)&pv_cpu_ops.set_debugreg = lguest_set_debugreg;
-+ *(void **)&pv_cpu_ops.clts = lguest_clts;
-+ *(void **)&pv_cpu_ops.read_cr0 = lguest_read_cr0;
-+ *(void **)&pv_cpu_ops.write_cr0 = lguest_write_cr0;
-+ *(void **)&pv_cpu_ops.read_cr4 = lguest_read_cr4;
-+ *(void **)&pv_cpu_ops.write_cr4 = lguest_write_cr4;
-+ *(void **)&pv_cpu_ops.write_gdt_entry = lguest_write_gdt_entry;
-+ *(void **)&pv_cpu_ops.write_idt_entry = lguest_write_idt_entry;
-+ *(void **)&pv_cpu_ops.wbinvd = lguest_wbinvd;
-+ *(void **)&pv_cpu_ops.start_context_switch = paravirt_start_context_switch;
-+ *(void **)&pv_cpu_ops.end_context_switch = lguest_end_context_switch;
-
- /* Pagetable management */
- pv_mmu_ops.write_cr3 = lguest_write_cr3;
-@@ -1313,11 +1314,11 @@ __init void lguest_init(void)
- set_lguest_basic_apic_ops();
- #endif
-
-- x86_init.resources.memory_setup = lguest_memory_setup;
-- x86_init.irqs.intr_init = lguest_init_IRQ;
-- x86_init.timers.timer_init = lguest_time_init;
-- x86_platform.calibrate_tsc = lguest_tsc_khz;
-- x86_platform.get_wallclock = lguest_get_wallclock;
-+ *(void **)&x86_init.resources.memory_setup = lguest_memory_setup;
-+ *(void **)&x86_init.irqs.intr_init = lguest_init_IRQ;
-+ *(void **)&x86_init.timers.timer_init = lguest_time_init;
-+ *(void **)&x86_platform.calibrate_tsc = lguest_tsc_khz;
-+ *(void **)&x86_platform.get_wallclock = lguest_get_wallclock;
-
- /*
- * Now is a good time to look at the implementations of these functions
-@@ -1410,7 +1411,7 @@ __init void lguest_init(void)
- * routine.
- */
- pm_power_off = lguest_power_off;
-- machine_ops.restart = lguest_restart;
-+ *(void **)&machine_ops.restart = lguest_restart;
-
- /*
- * Now we're set up, call i386_start_kernel() in head32.c and we proceed
-diff --git a/arch/x86/lib/atomic64_32.c b/arch/x86/lib/atomic64_32.c
-index 824fa0b..c619e96 100644
---- a/arch/x86/lib/atomic64_32.c
-+++ b/arch/x86/lib/atomic64_32.c
-@@ -25,6 +25,12 @@ u64 atomic64_cmpxchg(atomic64_t *ptr, u64 old_val, u64 new_val)
- }
- EXPORT_SYMBOL(atomic64_cmpxchg);
-
-+u64 atomic64_cmpxchg_unchecked(atomic64_unchecked_t *ptr, u64 old_val, u64 new_val)
-+{
-+ return cmpxchg8b(&ptr->counter, old_val, new_val);
-+}
-+EXPORT_SYMBOL(atomic64_cmpxchg_unchecked);
-+
- /**
- * atomic64_xchg - xchg atomic64 variable
- * @ptr: pointer to type atomic64_t
-@@ -56,6 +62,36 @@ u64 atomic64_xchg(atomic64_t *ptr, u64 new_val)
- EXPORT_SYMBOL(atomic64_xchg);
-
- /**
-+ * atomic64_xchg_unchecked - xchg atomic64 variable
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ * @new_val: value to assign
-+ *
-+ * Atomically xchgs the value of @ptr to @new_val and returns
-+ * the old value.
-+ */
-+u64 atomic64_xchg_unchecked(atomic64_unchecked_t *ptr, u64 new_val)
-+{
-+ /*
-+ * Try first with a (possibly incorrect) assumption about
-+ * what we have there. We'll do two loops most likely,
-+ * but we'll get an ownership MESI transaction straight away
-+ * instead of a read transaction followed by a
-+ * flush-for-ownership transaction:
-+ */
-+ u64 old_val, real_val = 0;
-+
-+ do {
-+ old_val = real_val;
-+
-+ real_val = atomic64_cmpxchg_unchecked(ptr, old_val, new_val);
-+
-+ } while (real_val != old_val);
-+
-+ return old_val;
-+}
-+EXPORT_SYMBOL(atomic64_xchg_unchecked);
-+
-+/**
- * atomic64_set - set atomic64 variable
- * @ptr: pointer to type atomic64_t
- * @new_val: value to assign
-@@ -69,7 +105,19 @@ void atomic64_set(atomic64_t *ptr, u64 new_val)
- EXPORT_SYMBOL(atomic64_set);
-
- /**
--EXPORT_SYMBOL(atomic64_read);
-+ * atomic64_unchecked_set - set atomic64 variable
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ * @new_val: value to assign
-+ *
-+ * Atomically sets the value of @ptr to @new_val.
-+ */
-+void atomic64_set_unchecked(atomic64_unchecked_t *ptr, u64 new_val)
-+{
-+ atomic64_xchg_unchecked(ptr, new_val);
-+}
-+EXPORT_SYMBOL(atomic64_set_unchecked);
-+
-+/**
- * atomic64_add_return - add and return
- * @delta: integer value to add
- * @ptr: pointer to type atomic64_t
-@@ -99,24 +147,72 @@ noinline u64 atomic64_add_return(u64 delta, atomic64_t *ptr)
- }
- EXPORT_SYMBOL(atomic64_add_return);
-
-+/**
-+ * atomic64_add_return_unchecked - add and return
-+ * @delta: integer value to add
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically adds @delta to @ptr and returns @delta + *@ptr
-+ */
-+noinline u64 atomic64_add_return_unchecked(u64 delta, atomic64_unchecked_t *ptr)
-+{
-+ /*
-+ * Try first with a (possibly incorrect) assumption about
-+ * what we have there. We'll do two loops most likely,
-+ * but we'll get an ownership MESI transaction straight away
-+ * instead of a read transaction followed by a
-+ * flush-for-ownership transaction:
-+ */
-+ u64 old_val, new_val, real_val = 0;
-+
-+ do {
-+ old_val = real_val;
-+ new_val = old_val + delta;
-+
-+ real_val = atomic64_cmpxchg_unchecked(ptr, old_val, new_val);
-+
-+ } while (real_val != old_val);
-+
-+ return new_val;
-+}
-+EXPORT_SYMBOL(atomic64_add_return_unchecked);
-+
- u64 atomic64_sub_return(u64 delta, atomic64_t *ptr)
- {
- return atomic64_add_return(-delta, ptr);
- }
- EXPORT_SYMBOL(atomic64_sub_return);
-
-+u64 atomic64_sub_return_unchecked(u64 delta, atomic64_unchecked_t *ptr)
-+{
-+ return atomic64_add_return_unchecked(-delta, ptr);
-+}
-+EXPORT_SYMBOL(atomic64_sub_return_unchecked);
-+
- u64 atomic64_inc_return(atomic64_t *ptr)
- {
- return atomic64_add_return(1, ptr);
- }
- EXPORT_SYMBOL(atomic64_inc_return);
-
-+u64 atomic64_inc_return_unchecked(atomic64_unchecked_t *ptr)
-+{
-+ return atomic64_add_return_unchecked(1, ptr);
-+}
-+EXPORT_SYMBOL(atomic64_inc_return_unchecked);
-+
- u64 atomic64_dec_return(atomic64_t *ptr)
- {
- return atomic64_sub_return(1, ptr);
- }
- EXPORT_SYMBOL(atomic64_dec_return);
-
-+u64 atomic64_dec_return_unchecked(atomic64_unchecked_t *ptr)
-+{
-+ return atomic64_sub_return_unchecked(1, ptr);
-+}
-+EXPORT_SYMBOL(atomic64_dec_return_unchecked);
-+
- /**
- * atomic64_add - add integer to atomic64 variable
- * @delta: integer value to add
-@@ -131,6 +227,19 @@ void atomic64_add(u64 delta, atomic64_t *ptr)
- EXPORT_SYMBOL(atomic64_add);
-
- /**
-+ * atomic64_add_unchecked - add integer to atomic64 variable
-+ * @delta: integer value to add
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically adds @delta to @ptr.
-+ */
-+void atomic64_add_unchecked(u64 delta, atomic64_unchecked_t *ptr)
-+{
-+ atomic64_add_return_unchecked(delta, ptr);
-+}
-+EXPORT_SYMBOL(atomic64_add_unchecked);
-+
-+/**
- * atomic64_sub - subtract the atomic64 variable
- * @delta: integer value to subtract
- * @ptr: pointer to type atomic64_t
-@@ -144,6 +253,19 @@ void atomic64_sub(u64 delta, atomic64_t *ptr)
- EXPORT_SYMBOL(atomic64_sub);
-
- /**
-+ * atomic64_sub_unchecked - subtract the atomic64 variable
-+ * @delta: integer value to subtract
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically subtracts @delta from @ptr.
-+ */
-+void atomic64_sub_unchecked(u64 delta, atomic64_unchecked_t *ptr)
-+{
-+ atomic64_add_unchecked(-delta, ptr);
-+}
-+EXPORT_SYMBOL(atomic64_sub_unchecked);
-+
-+/**
- * atomic64_sub_and_test - subtract value from variable and test result
- * @delta: integer value to subtract
- * @ptr: pointer to type atomic64_t
-@@ -173,6 +295,18 @@ void atomic64_inc(atomic64_t *ptr)
- EXPORT_SYMBOL(atomic64_inc);
-
- /**
-+ * atomic64_inc_unchecked - increment atomic64 variable
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically increments @ptr by 1.
-+ */
-+void atomic64_inc_unchecked(atomic64_unchecked_t *ptr)
-+{
-+ atomic64_add_unchecked(1, ptr);
-+}
-+EXPORT_SYMBOL(atomic64_inc_unchecked);
-+
-+/**
- * atomic64_dec - decrement atomic64 variable
- * @ptr: pointer to type atomic64_t
- *
-@@ -185,6 +319,18 @@ void atomic64_dec(atomic64_t *ptr)
- EXPORT_SYMBOL(atomic64_dec);
-
- /**
-+ * atomic64_dec_unchecked - decrement atomic64 variable
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically decrements @ptr by 1.
-+ */
-+void atomic64_dec_unchecked(atomic64_unchecked_t *ptr)
-+{
-+ atomic64_sub_unchecked(1, ptr);
-+}
-+EXPORT_SYMBOL(atomic64_dec_unchecked);
-+
-+/**
- * atomic64_dec_and_test - decrement and test
- * @ptr: pointer to type atomic64_t
- *
-diff --git a/arch/x86/lib/checksum_32.S b/arch/x86/lib/checksum_32.S
-index adbccd0..98f96c8 100644
---- a/arch/x86/lib/checksum_32.S
-+++ b/arch/x86/lib/checksum_32.S
-@@ -28,7 +28,8 @@
- #include <linux/linkage.h>
- #include <asm/dwarf2.h>
- #include <asm/errno.h>
--
-+#include <asm/segment.h>
-+
- /*
- * computes a partial checksum, e.g. for TCP/UDP fragments
- */
-@@ -304,9 +305,28 @@ unsigned int csum_partial_copy_generic (const char *src, char *dst,
-
- #define ARGBASE 16
- #define FP 12
--
--ENTRY(csum_partial_copy_generic)
-+
-+ENTRY(csum_partial_copy_generic_to_user)
- CFI_STARTPROC
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ pushl %gs
-+ CFI_ADJUST_CFA_OFFSET 4
-+ popl %es
-+ CFI_ADJUST_CFA_OFFSET -4
-+ jmp csum_partial_copy_generic
-+#endif
-+
-+ENTRY(csum_partial_copy_generic_from_user)
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ pushl %gs
-+ CFI_ADJUST_CFA_OFFSET 4
-+ popl %ds
-+ CFI_ADJUST_CFA_OFFSET -4
-+#endif
-+
-+ENTRY(csum_partial_copy_generic)
- subl $4,%esp
- CFI_ADJUST_CFA_OFFSET 4
- pushl %edi
-@@ -331,7 +351,7 @@ ENTRY(csum_partial_copy_generic)
- jmp 4f
- SRC(1: movw (%esi), %bx )
- addl $2, %esi
--DST( movw %bx, (%edi) )
-+DST( movw %bx, %es:(%edi) )
- addl $2, %edi
- addw %bx, %ax
- adcl $0, %eax
-@@ -343,30 +363,30 @@ DST( movw %bx, (%edi) )
- SRC(1: movl (%esi), %ebx )
- SRC( movl 4(%esi), %edx )
- adcl %ebx, %eax
--DST( movl %ebx, (%edi) )
-+DST( movl %ebx, %es:(%edi) )
- adcl %edx, %eax
--DST( movl %edx, 4(%edi) )
-+DST( movl %edx, %es:4(%edi) )
-
- SRC( movl 8(%esi), %ebx )
- SRC( movl 12(%esi), %edx )
- adcl %ebx, %eax
--DST( movl %ebx, 8(%edi) )
-+DST( movl %ebx, %es:8(%edi) )
- adcl %edx, %eax
--DST( movl %edx, 12(%edi) )
-+DST( movl %edx, %es:12(%edi) )
-
- SRC( movl 16(%esi), %ebx )
- SRC( movl 20(%esi), %edx )
- adcl %ebx, %eax
--DST( movl %ebx, 16(%edi) )
-+DST( movl %ebx, %es:16(%edi) )
- adcl %edx, %eax
--DST( movl %edx, 20(%edi) )
-+DST( movl %edx, %es:20(%edi) )
-
- SRC( movl 24(%esi), %ebx )
- SRC( movl 28(%esi), %edx )
- adcl %ebx, %eax
--DST( movl %ebx, 24(%edi) )
-+DST( movl %ebx, %es:24(%edi) )
- adcl %edx, %eax
--DST( movl %edx, 28(%edi) )
-+DST( movl %edx, %es:28(%edi) )
-
- lea 32(%esi), %esi
- lea 32(%edi), %edi
-@@ -380,7 +400,7 @@ DST( movl %edx, 28(%edi) )
- shrl $2, %edx # This clears CF
- SRC(3: movl (%esi), %ebx )
- adcl %ebx, %eax
--DST( movl %ebx, (%edi) )
-+DST( movl %ebx, %es:(%edi) )
- lea 4(%esi), %esi
- lea 4(%edi), %edi
- dec %edx
-@@ -392,12 +412,12 @@ DST( movl %ebx, (%edi) )
- jb 5f
- SRC( movw (%esi), %cx )
- leal 2(%esi), %esi
--DST( movw %cx, (%edi) )
-+DST( movw %cx, %es:(%edi) )
- leal 2(%edi), %edi
- je 6f
- shll $16,%ecx
- SRC(5: movb (%esi), %cl )
--DST( movb %cl, (%edi) )
-+DST( movb %cl, %es:(%edi) )
- 6: addl %ecx, %eax
- adcl $0, %eax
- 7:
-@@ -408,7 +428,7 @@ DST( movb %cl, (%edi) )
-
- 6001:
- movl ARGBASE+20(%esp), %ebx # src_err_ptr
-- movl $-EFAULT, (%ebx)
-+ movl $-EFAULT, %ss:(%ebx)
-
- # zero the complete destination - computing the rest
- # is too much work
-@@ -421,11 +441,19 @@ DST( movb %cl, (%edi) )
-
- 6002:
- movl ARGBASE+24(%esp), %ebx # dst_err_ptr
-- movl $-EFAULT,(%ebx)
-+ movl $-EFAULT,%ss:(%ebx)
- jmp 5000b
-
- .previous
-
-+ pushl %ss
-+ CFI_ADJUST_CFA_OFFSET 4
-+ popl %ds
-+ CFI_ADJUST_CFA_OFFSET -4
-+ pushl %ss
-+ CFI_ADJUST_CFA_OFFSET 4
-+ popl %es
-+ CFI_ADJUST_CFA_OFFSET -4
- popl %ebx
- CFI_ADJUST_CFA_OFFSET -4
- CFI_RESTORE ebx
-@@ -439,26 +467,47 @@ DST( movb %cl, (%edi) )
- CFI_ADJUST_CFA_OFFSET -4
- ret
- CFI_ENDPROC
--ENDPROC(csum_partial_copy_generic)
-+ENDPROC(csum_partial_copy_generic_to_user)
-
- #else
-
- /* Version for PentiumII/PPro */
-
- #define ROUND1(x) \
-+ nop; nop; nop; \
- SRC(movl x(%esi), %ebx ) ; \
- addl %ebx, %eax ; \
-- DST(movl %ebx, x(%edi) ) ;
-+ DST(movl %ebx, %es:x(%edi)) ;
-
- #define ROUND(x) \
-+ nop; nop; nop; \
- SRC(movl x(%esi), %ebx ) ; \
- adcl %ebx, %eax ; \
-- DST(movl %ebx, x(%edi) ) ;
-+ DST(movl %ebx, %es:x(%edi)) ;
-
- #define ARGBASE 12
--
--ENTRY(csum_partial_copy_generic)
-+
-+ENTRY(csum_partial_copy_generic_to_user)
- CFI_STARTPROC
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ pushl %gs
-+ CFI_ADJUST_CFA_OFFSET 4
-+ popl %es
-+ CFI_ADJUST_CFA_OFFSET -4
-+ jmp csum_partial_copy_generic
-+#endif
-+
-+ENTRY(csum_partial_copy_generic_from_user)
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ pushl %gs
-+ CFI_ADJUST_CFA_OFFSET 4
-+ popl %ds
-+ CFI_ADJUST_CFA_OFFSET -4
-+#endif
-+
-+ENTRY(csum_partial_copy_generic)
- pushl %ebx
- CFI_ADJUST_CFA_OFFSET 4
- CFI_REL_OFFSET ebx, 0
-@@ -482,7 +531,7 @@ ENTRY(csum_partial_copy_generic)
- subl %ebx, %edi
- lea -1(%esi),%edx
- andl $-32,%edx
-- lea 3f(%ebx,%ebx), %ebx
-+ lea 3f(%ebx,%ebx,2), %ebx
- testl %esi, %esi
- jmp *%ebx
- 1: addl $64,%esi
-@@ -503,19 +552,19 @@ ENTRY(csum_partial_copy_generic)
- jb 5f
- SRC( movw (%esi), %dx )
- leal 2(%esi), %esi
--DST( movw %dx, (%edi) )
-+DST( movw %dx, %es:(%edi) )
- leal 2(%edi), %edi
- je 6f
- shll $16,%edx
- 5:
- SRC( movb (%esi), %dl )
--DST( movb %dl, (%edi) )
-+DST( movb %dl, %es:(%edi) )
- 6: addl %edx, %eax
- adcl $0, %eax
- 7:
- .section .fixup, "ax"
- 6001: movl ARGBASE+20(%esp), %ebx # src_err_ptr
-- movl $-EFAULT, (%ebx)
-+ movl $-EFAULT, %ss:(%ebx)
- # zero the complete destination (computing the rest is too much work)
- movl ARGBASE+8(%esp),%edi # dst
- movl ARGBASE+12(%esp),%ecx # len
-@@ -523,10 +572,21 @@ DST( movb %dl, (%edi) )
- rep; stosb
- jmp 7b
- 6002: movl ARGBASE+24(%esp), %ebx # dst_err_ptr
-- movl $-EFAULT, (%ebx)
-+ movl $-EFAULT, %ss:(%ebx)
- jmp 7b
- .previous
-
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ pushl %ss
-+ CFI_ADJUST_CFA_OFFSET 4
-+ popl %ds
-+ CFI_ADJUST_CFA_OFFSET -4
-+ pushl %ss
-+ CFI_ADJUST_CFA_OFFSET 4
-+ popl %es
-+ CFI_ADJUST_CFA_OFFSET -4
-+#endif
-+
- popl %esi
- CFI_ADJUST_CFA_OFFSET -4
- CFI_RESTORE esi
-@@ -538,7 +598,7 @@ DST( movb %dl, (%edi) )
- CFI_RESTORE ebx
- ret
- CFI_ENDPROC
--ENDPROC(csum_partial_copy_generic)
-+ENDPROC(csum_partial_copy_generic_to_user)
-
- #undef ROUND
- #undef ROUND1
-diff --git a/arch/x86/lib/clear_page_64.S b/arch/x86/lib/clear_page_64.S
-index ebeafcc..1e3a402 100644
---- a/arch/x86/lib/clear_page_64.S
-+++ b/arch/x86/lib/clear_page_64.S
-@@ -1,5 +1,6 @@
- #include <linux/linkage.h>
- #include <asm/dwarf2.h>
-+#include <asm/alternative-asm.h>
-
- /*
- * Zero a page.
-@@ -10,6 +11,7 @@ ENTRY(clear_page_c)
- movl $4096/8,%ecx
- xorl %eax,%eax
- rep stosq
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
- ENDPROC(clear_page_c)
-@@ -33,6 +35,7 @@ ENTRY(clear_page)
- leaq 64(%rdi),%rdi
- jnz .Lloop
- nop
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
- .Lclear_page_end:
-@@ -43,7 +46,7 @@ ENDPROC(clear_page)
-
- #include <asm/cpufeature.h>
-
-- .section .altinstr_replacement,"ax"
-+ .section .altinstr_replacement,"a"
- 1: .byte 0xeb /* jmp <disp8> */
- .byte (clear_page_c - clear_page) - (2f - 1b) /* offset */
- 2:
-diff --git a/arch/x86/lib/copy_page_64.S b/arch/x86/lib/copy_page_64.S
-index 727a5d4..333818a 100644
---- a/arch/x86/lib/copy_page_64.S
-+++ b/arch/x86/lib/copy_page_64.S
-@@ -2,12 +2,14 @@
-
- #include <linux/linkage.h>
- #include <asm/dwarf2.h>
-+#include <asm/alternative-asm.h>
-
- ALIGN
- copy_page_c:
- CFI_STARTPROC
- movl $4096/8,%ecx
- rep movsq
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
- ENDPROC(copy_page_c)
-@@ -38,7 +40,7 @@ ENTRY(copy_page)
- movq 16 (%rsi), %rdx
- movq 24 (%rsi), %r8
- movq 32 (%rsi), %r9
-- movq 40 (%rsi), %r10
-+ movq 40 (%rsi), %r13
- movq 48 (%rsi), %r11
- movq 56 (%rsi), %r12
-
-@@ -49,7 +51,7 @@ ENTRY(copy_page)
- movq %rdx, 16 (%rdi)
- movq %r8, 24 (%rdi)
- movq %r9, 32 (%rdi)
-- movq %r10, 40 (%rdi)
-+ movq %r13, 40 (%rdi)
- movq %r11, 48 (%rdi)
- movq %r12, 56 (%rdi)
-
-@@ -68,7 +70,7 @@ ENTRY(copy_page)
- movq 16 (%rsi), %rdx
- movq 24 (%rsi), %r8
- movq 32 (%rsi), %r9
-- movq 40 (%rsi), %r10
-+ movq 40 (%rsi), %r13
- movq 48 (%rsi), %r11
- movq 56 (%rsi), %r12
-
-@@ -77,7 +79,7 @@ ENTRY(copy_page)
- movq %rdx, 16 (%rdi)
- movq %r8, 24 (%rdi)
- movq %r9, 32 (%rdi)
-- movq %r10, 40 (%rdi)
-+ movq %r13, 40 (%rdi)
- movq %r11, 48 (%rdi)
- movq %r12, 56 (%rdi)
-
-@@ -94,6 +96,7 @@ ENTRY(copy_page)
- CFI_RESTORE r13
- addq $3*8,%rsp
- CFI_ADJUST_CFA_OFFSET -3*8
-+ pax_force_retaddr
- ret
- .Lcopy_page_end:
- CFI_ENDPROC
-@@ -104,7 +107,7 @@ ENDPROC(copy_page)
-
- #include <asm/cpufeature.h>
-
-- .section .altinstr_replacement,"ax"
-+ .section .altinstr_replacement,"a"
- 1: .byte 0xeb /* jmp <disp8> */
- .byte (copy_page_c - copy_page) - (2f - 1b) /* offset */
- 2:
-diff --git a/arch/x86/lib/copy_user_64.S b/arch/x86/lib/copy_user_64.S
-index af8debd..40c75f3 100644
---- a/arch/x86/lib/copy_user_64.S
-+++ b/arch/x86/lib/copy_user_64.S
-@@ -15,13 +15,15 @@
- #include <asm/asm-offsets.h>
- #include <asm/thread_info.h>
- #include <asm/cpufeature.h>
-+#include <asm/pgtable.h>
-+#include <asm/alternative-asm.h>
-
- .macro ALTERNATIVE_JUMP feature,orig,alt
- 0:
- .byte 0xe9 /* 32bit jump */
- .long \orig-1f /* by default jump to orig */
- 1:
-- .section .altinstr_replacement,"ax"
-+ .section .altinstr_replacement,"a"
- 2: .byte 0xe9 /* near jump with 32bit immediate */
- .long \alt-1b /* offset */ /* or alternatively to alt */
- .previous
-@@ -64,55 +66,26 @@
- #endif
- .endm
-
--/* Standard copy_to_user with segment limit checking */
--ENTRY(copy_to_user)
-- CFI_STARTPROC
-- GET_THREAD_INFO(%rax)
-- movq %rdi,%rcx
-- addq %rdx,%rcx
-- jc bad_to_user
-- cmpq TI_addr_limit(%rax),%rcx
-- ja bad_to_user
-- ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
-- CFI_ENDPROC
--ENDPROC(copy_to_user)
--
--/* Standard copy_from_user with segment limit checking */
--ENTRY(copy_from_user)
-- CFI_STARTPROC
-- GET_THREAD_INFO(%rax)
-- movq %rsi,%rcx
-- addq %rdx,%rcx
-- jc bad_from_user
-- cmpq TI_addr_limit(%rax),%rcx
-- ja bad_from_user
-- ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
-- CFI_ENDPROC
--ENDPROC(copy_from_user)
--
- ENTRY(copy_user_generic)
- CFI_STARTPROC
- ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
- CFI_ENDPROC
- ENDPROC(copy_user_generic)
-
--ENTRY(__copy_from_user_inatomic)
-- CFI_STARTPROC
-- ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
-- CFI_ENDPROC
--ENDPROC(__copy_from_user_inatomic)
--
- .section .fixup,"ax"
- /* must zero dest */
- ENTRY(bad_from_user)
- bad_from_user:
- CFI_STARTPROC
-+ testl %edx,%edx
-+ js bad_to_user
- movl %edx,%ecx
- xorl %eax,%eax
- rep
- stosb
- bad_to_user:
- movl %edx,%eax
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
- ENDPROC(bad_from_user)
-@@ -142,19 +115,19 @@ ENTRY(copy_user_generic_unrolled)
- jz 17f
- 1: movq (%rsi),%r8
- 2: movq 1*8(%rsi),%r9
--3: movq 2*8(%rsi),%r10
-+3: movq 2*8(%rsi),%rax
- 4: movq 3*8(%rsi),%r11
- 5: movq %r8,(%rdi)
- 6: movq %r9,1*8(%rdi)
--7: movq %r10,2*8(%rdi)
-+7: movq %rax,2*8(%rdi)
- 8: movq %r11,3*8(%rdi)
- 9: movq 4*8(%rsi),%r8
- 10: movq 5*8(%rsi),%r9
--11: movq 6*8(%rsi),%r10
-+11: movq 6*8(%rsi),%rax
- 12: movq 7*8(%rsi),%r11
- 13: movq %r8,4*8(%rdi)
- 14: movq %r9,5*8(%rdi)
--15: movq %r10,6*8(%rdi)
-+15: movq %rax,6*8(%rdi)
- 16: movq %r11,7*8(%rdi)
- leaq 64(%rsi),%rsi
- leaq 64(%rdi),%rdi
-@@ -180,6 +153,7 @@ ENTRY(copy_user_generic_unrolled)
- decl %ecx
- jnz 21b
- 23: xor %eax,%eax
-+ pax_force_retaddr
- ret
-
- .section .fixup,"ax"
-@@ -252,6 +226,7 @@ ENTRY(copy_user_generic_string)
- 3: rep
- movsb
- 4: xorl %eax,%eax
-+ pax_force_retaddr
- ret
-
- .section .fixup,"ax"
-diff --git a/arch/x86/lib/copy_user_nocache_64.S b/arch/x86/lib/copy_user_nocache_64.S
-index cb0c112..e3a6895 100644
---- a/arch/x86/lib/copy_user_nocache_64.S
-+++ b/arch/x86/lib/copy_user_nocache_64.S
-@@ -8,12 +8,14 @@
-
- #include <linux/linkage.h>
- #include <asm/dwarf2.h>
-+#include <asm/alternative-asm.h>
-
- #define FIX_ALIGNMENT 1
-
- #include <asm/current.h>
- #include <asm/asm-offsets.h>
- #include <asm/thread_info.h>
-+#include <asm/pgtable.h>
-
- .macro ALIGN_DESTINATION
- #ifdef FIX_ALIGNMENT
-@@ -50,6 +52,15 @@
- */
- ENTRY(__copy_user_nocache)
- CFI_STARTPROC
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ mov $PAX_USER_SHADOW_BASE,%rcx
-+ cmp %rcx,%rsi
-+ jae 1f
-+ add %rcx,%rsi
-+1:
-+#endif
-+
- cmpl $8,%edx
- jb 20f /* less then 8 bytes, go to byte copy loop */
- ALIGN_DESTINATION
-@@ -59,19 +70,19 @@ ENTRY(__copy_user_nocache)
- jz 17f
- 1: movq (%rsi),%r8
- 2: movq 1*8(%rsi),%r9
--3: movq 2*8(%rsi),%r10
-+3: movq 2*8(%rsi),%rax
- 4: movq 3*8(%rsi),%r11
- 5: movnti %r8,(%rdi)
- 6: movnti %r9,1*8(%rdi)
--7: movnti %r10,2*8(%rdi)
-+7: movnti %rax,2*8(%rdi)
- 8: movnti %r11,3*8(%rdi)
- 9: movq 4*8(%rsi),%r8
- 10: movq 5*8(%rsi),%r9
--11: movq 6*8(%rsi),%r10
-+11: movq 6*8(%rsi),%rax
- 12: movq 7*8(%rsi),%r11
- 13: movnti %r8,4*8(%rdi)
- 14: movnti %r9,5*8(%rdi)
--15: movnti %r10,6*8(%rdi)
-+15: movnti %rax,6*8(%rdi)
- 16: movnti %r11,7*8(%rdi)
- leaq 64(%rsi),%rsi
- leaq 64(%rdi),%rdi
-@@ -98,6 +109,7 @@ ENTRY(__copy_user_nocache)
- jnz 21b
- 23: xorl %eax,%eax
- sfence
-+ pax_force_retaddr
- ret
-
- .section .fixup,"ax"
-diff --git a/arch/x86/lib/csum-copy_64.S b/arch/x86/lib/csum-copy_64.S
-index f0dba36..48cb4d6 100644
---- a/arch/x86/lib/csum-copy_64.S
-+++ b/arch/x86/lib/csum-copy_64.S
-@@ -8,6 +8,7 @@
- #include <linux/linkage.h>
- #include <asm/dwarf2.h>
- #include <asm/errno.h>
-+#include <asm/alternative-asm.h>
-
- /*
- * Checksum copy with exception handling.
-@@ -228,6 +229,7 @@ ENTRY(csum_partial_copy_generic)
- CFI_RESTORE rbp
- addq $7*8,%rsp
- CFI_ADJUST_CFA_OFFSET -7*8
-+ pax_force_retaddr 0, 1
- ret
- CFI_RESTORE_STATE
-
-diff --git a/arch/x86/lib/csum-wrappers_64.c b/arch/x86/lib/csum-wrappers_64.c
-index 459b58a..d67737f 100644
---- a/arch/x86/lib/csum-wrappers_64.c
-+++ b/arch/x86/lib/csum-wrappers_64.c
-@@ -52,7 +52,7 @@ csum_partial_copy_from_user(const void __user *src, void *dst,
- len -= 2;
- }
- }
-- isum = csum_partial_copy_generic((__force const void *)src,
-+ isum = csum_partial_copy_generic((const void __force_kernel *)____m(src),
- dst, len, isum, errp, NULL);
- if (unlikely(*errp))
- goto out_err;
-@@ -105,7 +105,7 @@ csum_partial_copy_to_user(const void *src, void __user *dst,
- }
-
- *errp = 0;
-- return csum_partial_copy_generic(src, (void __force *)dst,
-+ return csum_partial_copy_generic(src, (void __force_kernel *)____m(dst),
- len, isum, NULL, errp);
- }
- EXPORT_SYMBOL(csum_partial_copy_to_user);
-diff --git a/arch/x86/lib/getuser.S b/arch/x86/lib/getuser.S
-index 51f1504..ddac4c1 100644
---- a/arch/x86/lib/getuser.S
-+++ b/arch/x86/lib/getuser.S
-@@ -33,15 +33,38 @@
- #include <asm/asm-offsets.h>
- #include <asm/thread_info.h>
- #include <asm/asm.h>
-+#include <asm/segment.h>
-+#include <asm/pgtable.h>
-+#include <asm/alternative-asm.h>
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+#define __copyuser_seg gs;
-+#else
-+#define __copyuser_seg
-+#endif
-
- .text
- ENTRY(__get_user_1)
- CFI_STARTPROC
-+
-+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
- GET_THREAD_INFO(%_ASM_DX)
- cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
- jae bad_get_user
--1: movzb (%_ASM_AX),%edx
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
-+ cmp %_ASM_DX,%_ASM_AX
-+ jae 1234f
-+ add %_ASM_DX,%_ASM_AX
-+1234:
-+#endif
-+
-+#endif
-+
-+1: __copyuser_seg movzb (%_ASM_AX),%edx
- xor %eax,%eax
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
- ENDPROC(__get_user_1)
-@@ -49,12 +72,26 @@ ENDPROC(__get_user_1)
- ENTRY(__get_user_2)
- CFI_STARTPROC
- add $1,%_ASM_AX
-+
-+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
- jc bad_get_user
- GET_THREAD_INFO(%_ASM_DX)
- cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
- jae bad_get_user
--2: movzwl -1(%_ASM_AX),%edx
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
-+ cmp %_ASM_DX,%_ASM_AX
-+ jae 1234f
-+ add %_ASM_DX,%_ASM_AX
-+1234:
-+#endif
-+
-+#endif
-+
-+2: __copyuser_seg movzwl -1(%_ASM_AX),%edx
- xor %eax,%eax
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
- ENDPROC(__get_user_2)
-@@ -62,12 +99,26 @@ ENDPROC(__get_user_2)
- ENTRY(__get_user_4)
- CFI_STARTPROC
- add $3,%_ASM_AX
-+
-+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
- jc bad_get_user
- GET_THREAD_INFO(%_ASM_DX)
- cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
- jae bad_get_user
--3: mov -3(%_ASM_AX),%edx
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
-+ cmp %_ASM_DX,%_ASM_AX
-+ jae 1234f
-+ add %_ASM_DX,%_ASM_AX
-+1234:
-+#endif
-+
-+#endif
-+
-+3: __copyuser_seg mov -3(%_ASM_AX),%edx
- xor %eax,%eax
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
- ENDPROC(__get_user_4)
-@@ -80,8 +131,18 @@ ENTRY(__get_user_8)
- GET_THREAD_INFO(%_ASM_DX)
- cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
- jae bad_get_user
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
-+ cmp %_ASM_DX,%_ASM_AX
-+ jae 1234f
-+ add %_ASM_DX,%_ASM_AX
-+1234:
-+#endif
-+
- 4: movq -7(%_ASM_AX),%_ASM_DX
- xor %eax,%eax
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
- ENDPROC(__get_user_8)
-@@ -91,6 +152,7 @@ bad_get_user:
- CFI_STARTPROC
- xor %edx,%edx
- mov $(-EFAULT),%_ASM_AX
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
- END(bad_get_user)
-diff --git a/arch/x86/lib/iomap_copy_64.S b/arch/x86/lib/iomap_copy_64.S
-index 05a95e7..326f2fa 100644
---- a/arch/x86/lib/iomap_copy_64.S
-+++ b/arch/x86/lib/iomap_copy_64.S
-@@ -17,6 +17,7 @@
-
- #include <linux/linkage.h>
- #include <asm/dwarf2.h>
-+#include <asm/alternative-asm.h>
-
- /*
- * override generic version in lib/iomap_copy.c
-@@ -25,6 +26,7 @@ ENTRY(__iowrite32_copy)
- CFI_STARTPROC
- movl %edx,%ecx
- rep movsd
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
- ENDPROC(__iowrite32_copy)
-diff --git a/arch/x86/lib/memcpy_64.S b/arch/x86/lib/memcpy_64.S
-index ad5441e..610e351 100644
---- a/arch/x86/lib/memcpy_64.S
-+++ b/arch/x86/lib/memcpy_64.S
-@@ -4,6 +4,7 @@
-
- #include <asm/cpufeature.h>
- #include <asm/dwarf2.h>
-+#include <asm/alternative-asm.h>
-
- /*
- * memcpy - Copy a memory block.
-@@ -34,6 +35,7 @@ memcpy_c:
- rep movsq
- movl %edx, %ecx
- rep movsb
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
- ENDPROC(memcpy_c)
-@@ -118,6 +120,7 @@ ENTRY(memcpy)
- jnz .Lloop_1
-
- .Lend:
-+ pax_force_retaddr 0, 1
- ret
- CFI_ENDPROC
- ENDPROC(memcpy)
-@@ -128,7 +131,7 @@ ENDPROC(__memcpy)
- * It is also a lot simpler. Use this when possible:
- */
-
-- .section .altinstr_replacement, "ax"
-+ .section .altinstr_replacement, "a"
- 1: .byte 0xeb /* jmp <disp8> */
- .byte (memcpy_c - memcpy) - (2f - 1b) /* offset */
- 2:
-diff --git a/arch/x86/lib/memset_64.S b/arch/x86/lib/memset_64.S
-index 2c59481..7e9ba4e 100644
---- a/arch/x86/lib/memset_64.S
-+++ b/arch/x86/lib/memset_64.S
-@@ -2,6 +2,7 @@
-
- #include <linux/linkage.h>
- #include <asm/dwarf2.h>
-+#include <asm/alternative-asm.h>
-
- /*
- * ISO C memset - set a memory block to a byte value.
-@@ -28,6 +29,7 @@ memset_c:
- movl %r8d,%ecx
- rep stosb
- movq %r9,%rax
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
- ENDPROC(memset_c)
-@@ -35,13 +37,13 @@ ENDPROC(memset_c)
- ENTRY(memset)
- ENTRY(__memset)
- CFI_STARTPROC
-- movq %rdi,%r10
- movq %rdx,%r11
-
- /* expand byte value */
- movzbl %sil,%ecx
- movabs $0x0101010101010101,%rax
- mul %rcx /* with rax, clobbers rdx */
-+ movq %rdi,%rdx
-
- /* align dst */
- movl %edi,%r9d
-@@ -95,7 +97,8 @@ ENTRY(__memset)
- jnz .Lloop_1
-
- .Lende:
-- movq %r10,%rax
-+ movq %rdx,%rax
-+ pax_force_retaddr
- ret
-
- CFI_RESTORE_STATE
-@@ -118,7 +121,7 @@ ENDPROC(__memset)
-
- #include <asm/cpufeature.h>
-
-- .section .altinstr_replacement,"ax"
-+ .section .altinstr_replacement,"a"
- 1: .byte 0xeb /* jmp <disp8> */
- .byte (memset_c - memset) - (2f - 1b) /* offset */
- 2:
-diff --git a/arch/x86/lib/mmx_32.c b/arch/x86/lib/mmx_32.c
-index c9f2d9b..e7fd2c0 100644
---- a/arch/x86/lib/mmx_32.c
-+++ b/arch/x86/lib/mmx_32.c
-@@ -29,6 +29,7 @@ void *_mmx_memcpy(void *to, const void *from, size_t len)
- {
- void *p;
- int i;
-+ unsigned long cr0;
-
- if (unlikely(in_interrupt()))
- return __memcpy(to, from, len);
-@@ -39,44 +40,72 @@ void *_mmx_memcpy(void *to, const void *from, size_t len)
- kernel_fpu_begin();
-
- __asm__ __volatile__ (
-- "1: prefetch (%0)\n" /* This set is 28 bytes */
-- " prefetch 64(%0)\n"
-- " prefetch 128(%0)\n"
-- " prefetch 192(%0)\n"
-- " prefetch 256(%0)\n"
-+ "1: prefetch (%1)\n" /* This set is 28 bytes */
-+ " prefetch 64(%1)\n"
-+ " prefetch 128(%1)\n"
-+ " prefetch 192(%1)\n"
-+ " prefetch 256(%1)\n"
- "2: \n"
- ".section .fixup, \"ax\"\n"
-- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
-+ "3: \n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %%cr0, %0\n"
-+ " movl %0, %%eax\n"
-+ " andl $0xFFFEFFFF, %%eax\n"
-+ " movl %%eax, %%cr0\n"
-+#endif
-+
-+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %0, %%cr0\n"
-+#endif
-+
- " jmp 2b\n"
- ".previous\n"
- _ASM_EXTABLE(1b, 3b)
-- : : "r" (from));
-+ : "=&r" (cr0) : "r" (from) : "ax");
-
- for ( ; i > 5; i--) {
- __asm__ __volatile__ (
-- "1: prefetch 320(%0)\n"
-- "2: movq (%0), %%mm0\n"
-- " movq 8(%0), %%mm1\n"
-- " movq 16(%0), %%mm2\n"
-- " movq 24(%0), %%mm3\n"
-- " movq %%mm0, (%1)\n"
-- " movq %%mm1, 8(%1)\n"
-- " movq %%mm2, 16(%1)\n"
-- " movq %%mm3, 24(%1)\n"
-- " movq 32(%0), %%mm0\n"
-- " movq 40(%0), %%mm1\n"
-- " movq 48(%0), %%mm2\n"
-- " movq 56(%0), %%mm3\n"
-- " movq %%mm0, 32(%1)\n"
-- " movq %%mm1, 40(%1)\n"
-- " movq %%mm2, 48(%1)\n"
-- " movq %%mm3, 56(%1)\n"
-+ "1: prefetch 320(%1)\n"
-+ "2: movq (%1), %%mm0\n"
-+ " movq 8(%1), %%mm1\n"
-+ " movq 16(%1), %%mm2\n"
-+ " movq 24(%1), %%mm3\n"
-+ " movq %%mm0, (%2)\n"
-+ " movq %%mm1, 8(%2)\n"
-+ " movq %%mm2, 16(%2)\n"
-+ " movq %%mm3, 24(%2)\n"
-+ " movq 32(%1), %%mm0\n"
-+ " movq 40(%1), %%mm1\n"
-+ " movq 48(%1), %%mm2\n"
-+ " movq 56(%1), %%mm3\n"
-+ " movq %%mm0, 32(%2)\n"
-+ " movq %%mm1, 40(%2)\n"
-+ " movq %%mm2, 48(%2)\n"
-+ " movq %%mm3, 56(%2)\n"
- ".section .fixup, \"ax\"\n"
-- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
-+ "3:\n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %%cr0, %0\n"
-+ " movl %0, %%eax\n"
-+ " andl $0xFFFEFFFF, %%eax\n"
-+ " movl %%eax, %%cr0\n"
-+#endif
-+
-+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %0, %%cr0\n"
-+#endif
-+
- " jmp 2b\n"
- ".previous\n"
- _ASM_EXTABLE(1b, 3b)
-- : : "r" (from), "r" (to) : "memory");
-+ : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
-
- from += 64;
- to += 64;
-@@ -158,6 +187,7 @@ static void fast_clear_page(void *page)
- static void fast_copy_page(void *to, void *from)
- {
- int i;
-+ unsigned long cr0;
-
- kernel_fpu_begin();
-
-@@ -166,42 +196,70 @@ static void fast_copy_page(void *to, void *from)
- * but that is for later. -AV
- */
- __asm__ __volatile__(
-- "1: prefetch (%0)\n"
-- " prefetch 64(%0)\n"
-- " prefetch 128(%0)\n"
-- " prefetch 192(%0)\n"
-- " prefetch 256(%0)\n"
-+ "1: prefetch (%1)\n"
-+ " prefetch 64(%1)\n"
-+ " prefetch 128(%1)\n"
-+ " prefetch 192(%1)\n"
-+ " prefetch 256(%1)\n"
- "2: \n"
- ".section .fixup, \"ax\"\n"
-- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
-+ "3: \n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %%cr0, %0\n"
-+ " movl %0, %%eax\n"
-+ " andl $0xFFFEFFFF, %%eax\n"
-+ " movl %%eax, %%cr0\n"
-+#endif
-+
-+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %0, %%cr0\n"
-+#endif
-+
- " jmp 2b\n"
- ".previous\n"
-- _ASM_EXTABLE(1b, 3b) : : "r" (from));
-+ _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
-
- for (i = 0; i < (4096-320)/64; i++) {
- __asm__ __volatile__ (
-- "1: prefetch 320(%0)\n"
-- "2: movq (%0), %%mm0\n"
-- " movntq %%mm0, (%1)\n"
-- " movq 8(%0), %%mm1\n"
-- " movntq %%mm1, 8(%1)\n"
-- " movq 16(%0), %%mm2\n"
-- " movntq %%mm2, 16(%1)\n"
-- " movq 24(%0), %%mm3\n"
-- " movntq %%mm3, 24(%1)\n"
-- " movq 32(%0), %%mm4\n"
-- " movntq %%mm4, 32(%1)\n"
-- " movq 40(%0), %%mm5\n"
-- " movntq %%mm5, 40(%1)\n"
-- " movq 48(%0), %%mm6\n"
-- " movntq %%mm6, 48(%1)\n"
-- " movq 56(%0), %%mm7\n"
-- " movntq %%mm7, 56(%1)\n"
-+ "1: prefetch 320(%1)\n"
-+ "2: movq (%1), %%mm0\n"
-+ " movntq %%mm0, (%2)\n"
-+ " movq 8(%1), %%mm1\n"
-+ " movntq %%mm1, 8(%2)\n"
-+ " movq 16(%1), %%mm2\n"
-+ " movntq %%mm2, 16(%2)\n"
-+ " movq 24(%1), %%mm3\n"
-+ " movntq %%mm3, 24(%2)\n"
-+ " movq 32(%1), %%mm4\n"
-+ " movntq %%mm4, 32(%2)\n"
-+ " movq 40(%1), %%mm5\n"
-+ " movntq %%mm5, 40(%2)\n"
-+ " movq 48(%1), %%mm6\n"
-+ " movntq %%mm6, 48(%2)\n"
-+ " movq 56(%1), %%mm7\n"
-+ " movntq %%mm7, 56(%2)\n"
- ".section .fixup, \"ax\"\n"
-- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
-+ "3:\n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %%cr0, %0\n"
-+ " movl %0, %%eax\n"
-+ " andl $0xFFFEFFFF, %%eax\n"
-+ " movl %%eax, %%cr0\n"
-+#endif
-+
-+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %0, %%cr0\n"
-+#endif
-+
- " jmp 2b\n"
- ".previous\n"
-- _ASM_EXTABLE(1b, 3b) : : "r" (from), "r" (to) : "memory");
-+ _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
-
- from += 64;
- to += 64;
-@@ -280,47 +338,76 @@ static void fast_clear_page(void *page)
- static void fast_copy_page(void *to, void *from)
- {
- int i;
-+ unsigned long cr0;
-
- kernel_fpu_begin();
-
- __asm__ __volatile__ (
-- "1: prefetch (%0)\n"
-- " prefetch 64(%0)\n"
-- " prefetch 128(%0)\n"
-- " prefetch 192(%0)\n"
-- " prefetch 256(%0)\n"
-+ "1: prefetch (%1)\n"
-+ " prefetch 64(%1)\n"
-+ " prefetch 128(%1)\n"
-+ " prefetch 192(%1)\n"
-+ " prefetch 256(%1)\n"
- "2: \n"
- ".section .fixup, \"ax\"\n"
-- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
-+ "3: \n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %%cr0, %0\n"
-+ " movl %0, %%eax\n"
-+ " andl $0xFFFEFFFF, %%eax\n"
-+ " movl %%eax, %%cr0\n"
-+#endif
-+
-+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %0, %%cr0\n"
-+#endif
-+
- " jmp 2b\n"
- ".previous\n"
-- _ASM_EXTABLE(1b, 3b) : : "r" (from));
-+ _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
-
- for (i = 0; i < 4096/64; i++) {
- __asm__ __volatile__ (
-- "1: prefetch 320(%0)\n"
-- "2: movq (%0), %%mm0\n"
-- " movq 8(%0), %%mm1\n"
-- " movq 16(%0), %%mm2\n"
-- " movq 24(%0), %%mm3\n"
-- " movq %%mm0, (%1)\n"
-- " movq %%mm1, 8(%1)\n"
-- " movq %%mm2, 16(%1)\n"
-- " movq %%mm3, 24(%1)\n"
-- " movq 32(%0), %%mm0\n"
-- " movq 40(%0), %%mm1\n"
-- " movq 48(%0), %%mm2\n"
-- " movq 56(%0), %%mm3\n"
-- " movq %%mm0, 32(%1)\n"
-- " movq %%mm1, 40(%1)\n"
-- " movq %%mm2, 48(%1)\n"
-- " movq %%mm3, 56(%1)\n"
-+ "1: prefetch 320(%1)\n"
-+ "2: movq (%1), %%mm0\n"
-+ " movq 8(%1), %%mm1\n"
-+ " movq 16(%1), %%mm2\n"
-+ " movq 24(%1), %%mm3\n"
-+ " movq %%mm0, (%2)\n"
-+ " movq %%mm1, 8(%2)\n"
-+ " movq %%mm2, 16(%2)\n"
-+ " movq %%mm3, 24(%2)\n"
-+ " movq 32(%1), %%mm0\n"
-+ " movq 40(%1), %%mm1\n"
-+ " movq 48(%1), %%mm2\n"
-+ " movq 56(%1), %%mm3\n"
-+ " movq %%mm0, 32(%2)\n"
-+ " movq %%mm1, 40(%2)\n"
-+ " movq %%mm2, 48(%2)\n"
-+ " movq %%mm3, 56(%2)\n"
- ".section .fixup, \"ax\"\n"
-- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
-+ "3:\n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %%cr0, %0\n"
-+ " movl %0, %%eax\n"
-+ " andl $0xFFFEFFFF, %%eax\n"
-+ " movl %%eax, %%cr0\n"
-+#endif
-+
-+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %0, %%cr0\n"
-+#endif
-+
- " jmp 2b\n"
- ".previous\n"
- _ASM_EXTABLE(1b, 3b)
-- : : "r" (from), "r" (to) : "memory");
-+ : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
-
- from += 64;
- to += 64;
-diff --git a/arch/x86/lib/msr-reg.S b/arch/x86/lib/msr-reg.S
-index 69fa106..adda88b 100644
---- a/arch/x86/lib/msr-reg.S
-+++ b/arch/x86/lib/msr-reg.S
-@@ -3,6 +3,7 @@
- #include <asm/dwarf2.h>
- #include <asm/asm.h>
- #include <asm/msr.h>
-+#include <asm/alternative-asm.h>
-
- #ifdef CONFIG_X86_64
- /*
-@@ -16,7 +17,7 @@ ENTRY(native_\op\()_safe_regs)
- CFI_STARTPROC
- pushq_cfi %rbx
- pushq_cfi %rbp
-- movq %rdi, %r10 /* Save pointer */
-+ movq %rdi, %r9 /* Save pointer */
- xorl %r11d, %r11d /* Return value */
- movl (%rdi), %eax
- movl 4(%rdi), %ecx
-@@ -27,16 +28,17 @@ ENTRY(native_\op\()_safe_regs)
- movl 28(%rdi), %edi
- CFI_REMEMBER_STATE
- 1: \op
--2: movl %eax, (%r10)
-+2: movl %eax, (%r9)
- movl %r11d, %eax /* Return value */
-- movl %ecx, 4(%r10)
-- movl %edx, 8(%r10)
-- movl %ebx, 12(%r10)
-- movl %ebp, 20(%r10)
-- movl %esi, 24(%r10)
-- movl %edi, 28(%r10)
-+ movl %ecx, 4(%r9)
-+ movl %edx, 8(%r9)
-+ movl %ebx, 12(%r9)
-+ movl %ebp, 20(%r9)
-+ movl %esi, 24(%r9)
-+ movl %edi, 28(%r9)
- popq_cfi %rbp
- popq_cfi %rbx
-+ pax_force_retaddr
- ret
- 3:
- CFI_RESTORE_STATE
-diff --git a/arch/x86/lib/putuser.S b/arch/x86/lib/putuser.S
-index 36b0d15..d381858 100644
---- a/arch/x86/lib/putuser.S
-+++ b/arch/x86/lib/putuser.S
-@@ -15,7 +15,9 @@
- #include <asm/thread_info.h>
- #include <asm/errno.h>
- #include <asm/asm.h>
--
-+#include <asm/segment.h>
-+#include <asm/pgtable.h>
-+#include <asm/alternative-asm.h>
-
- /*
- * __put_user_X
-@@ -29,52 +31,119 @@
- * as they get called from within inline assembly.
- */
-
--#define ENTER CFI_STARTPROC ; \
-- GET_THREAD_INFO(%_ASM_BX)
--#define EXIT ret ; \
-+#define ENTER CFI_STARTPROC
-+#define EXIT pax_force_retaddr; ret ; \
- CFI_ENDPROC
-
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+#define _DEST %_ASM_CX,%_ASM_BX
-+#else
-+#define _DEST %_ASM_CX
-+#endif
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+#define __copyuser_seg gs;
-+#else
-+#define __copyuser_seg
-+#endif
-+
- .text
- ENTRY(__put_user_1)
- ENTER
-+
-+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
-+ GET_THREAD_INFO(%_ASM_BX)
- cmp TI_addr_limit(%_ASM_BX),%_ASM_CX
- jae bad_put_user
--1: movb %al,(%_ASM_CX)
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
-+ cmp %_ASM_BX,%_ASM_CX
-+ jb 1234f
-+ xor %ebx,%ebx
-+1234:
-+#endif
-+
-+#endif
-+
-+1: __copyuser_seg movb %al,(_DEST)
- xor %eax,%eax
- EXIT
- ENDPROC(__put_user_1)
-
- ENTRY(__put_user_2)
- ENTER
-+
-+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
-+ GET_THREAD_INFO(%_ASM_BX)
- mov TI_addr_limit(%_ASM_BX),%_ASM_BX
- sub $1,%_ASM_BX
- cmp %_ASM_BX,%_ASM_CX
- jae bad_put_user
--2: movw %ax,(%_ASM_CX)
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
-+ cmp %_ASM_BX,%_ASM_CX
-+ jb 1234f
-+ xor %ebx,%ebx
-+1234:
-+#endif
-+
-+#endif
-+
-+2: __copyuser_seg movw %ax,(_DEST)
- xor %eax,%eax
- EXIT
- ENDPROC(__put_user_2)
-
- ENTRY(__put_user_4)
- ENTER
-+
-+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
-+ GET_THREAD_INFO(%_ASM_BX)
- mov TI_addr_limit(%_ASM_BX),%_ASM_BX
- sub $3,%_ASM_BX
- cmp %_ASM_BX,%_ASM_CX
- jae bad_put_user
--3: movl %eax,(%_ASM_CX)
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
-+ cmp %_ASM_BX,%_ASM_CX
-+ jb 1234f
-+ xor %ebx,%ebx
-+1234:
-+#endif
-+
-+#endif
-+
-+3: __copyuser_seg movl %eax,(_DEST)
- xor %eax,%eax
- EXIT
- ENDPROC(__put_user_4)
-
- ENTRY(__put_user_8)
- ENTER
-+
-+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
-+ GET_THREAD_INFO(%_ASM_BX)
- mov TI_addr_limit(%_ASM_BX),%_ASM_BX
- sub $7,%_ASM_BX
- cmp %_ASM_BX,%_ASM_CX
- jae bad_put_user
--4: mov %_ASM_AX,(%_ASM_CX)
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
-+ cmp %_ASM_BX,%_ASM_CX
-+ jb 1234f
-+ xor %ebx,%ebx
-+1234:
-+#endif
-+
-+#endif
-+
-+4: __copyuser_seg mov %_ASM_AX,(_DEST)
- #ifdef CONFIG_X86_32
--5: movl %edx,4(%_ASM_CX)
-+5: __copyuser_seg movl %edx,4(_DEST)
- #endif
- xor %eax,%eax
- EXIT
-diff --git a/arch/x86/lib/rwlock_64.S b/arch/x86/lib/rwlock_64.S
-index 05ea55f..6345b9a 100644
---- a/arch/x86/lib/rwlock_64.S
-+++ b/arch/x86/lib/rwlock_64.S
-@@ -2,6 +2,7 @@
-
- #include <linux/linkage.h>
- #include <asm/rwlock.h>
-+#include <asm/asm.h>
- #include <asm/alternative-asm.h>
- #include <asm/dwarf2.h>
-
-@@ -10,13 +11,34 @@ ENTRY(__write_lock_failed)
- CFI_STARTPROC
- LOCK_PREFIX
- addl $RW_LOCK_BIAS,(%rdi)
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ jno 1234f
-+ LOCK_PREFIX
-+ subl $RW_LOCK_BIAS,(%rdi)
-+ int $4
-+1234:
-+ _ASM_EXTABLE(1234b, 1234b)
-+#endif
-+
- 1: rep
- nop
- cmpl $RW_LOCK_BIAS,(%rdi)
- jne 1b
- LOCK_PREFIX
- subl $RW_LOCK_BIAS,(%rdi)
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ jno 1234f
-+ LOCK_PREFIX
-+ addl $RW_LOCK_BIAS,(%rdi)
-+ int $4
-+1234:
-+ _ASM_EXTABLE(1234b, 1234b)
-+#endif
-+
- jnz __write_lock_failed
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
- END(__write_lock_failed)
-@@ -26,13 +48,34 @@ ENTRY(__read_lock_failed)
- CFI_STARTPROC
- LOCK_PREFIX
- incl (%rdi)
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ jno 1234f
-+ LOCK_PREFIX
-+ decl (%rdi)
-+ int $4
-+1234:
-+ _ASM_EXTABLE(1234b, 1234b)
-+#endif
-+
- 1: rep
- nop
- cmpl $1,(%rdi)
- js 1b
- LOCK_PREFIX
- decl (%rdi)
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ jno 1234f
-+ LOCK_PREFIX
-+ incl (%rdi)
-+ int $4
-+1234:
-+ _ASM_EXTABLE(1234b, 1234b)
-+#endif
-+
- js __read_lock_failed
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
- END(__read_lock_failed)
-diff --git a/arch/x86/lib/rwsem_64.S b/arch/x86/lib/rwsem_64.S
-index 15acecf..f768b10 100644
---- a/arch/x86/lib/rwsem_64.S
-+++ b/arch/x86/lib/rwsem_64.S
-@@ -48,6 +48,7 @@ ENTRY(call_rwsem_down_read_failed)
- call rwsem_down_read_failed
- popq %rdx
- restore_common_regs
-+ pax_force_retaddr
- ret
- ENDPROC(call_rwsem_down_read_failed)
-
-@@ -56,6 +57,7 @@ ENTRY(call_rwsem_down_write_failed)
- movq %rax,%rdi
- call rwsem_down_write_failed
- restore_common_regs
-+ pax_force_retaddr
- ret
- ENDPROC(call_rwsem_down_write_failed)
-
-@@ -66,7 +68,8 @@ ENTRY(call_rwsem_wake)
- movq %rax,%rdi
- call rwsem_wake
- restore_common_regs
--1: ret
-+1: pax_force_retaddr
-+ ret
- ENDPROC(call_rwsem_wake)
-
- /* Fix up special calling conventions */
-@@ -77,5 +80,6 @@ ENTRY(call_rwsem_downgrade_wake)
- call rwsem_downgrade_wake
- popq %rdx
- restore_common_regs
-+ pax_force_retaddr
- ret
- ENDPROC(call_rwsem_downgrade_wake)
-diff --git a/arch/x86/lib/thunk_64.S b/arch/x86/lib/thunk_64.S
-index bf9a7d5..fb06ab5 100644
---- a/arch/x86/lib/thunk_64.S
-+++ b/arch/x86/lib/thunk_64.S
-@@ -10,7 +10,8 @@
- #include <asm/dwarf2.h>
- #include <asm/calling.h>
- #include <asm/rwlock.h>
--
-+ #include <asm/alternative-asm.h>
-+
- /* rdi: arg1 ... normal C conventions. rax is saved/restored. */
- .macro thunk name,func
- .globl \name
-@@ -70,6 +71,7 @@
- SAVE_ARGS
- restore:
- RESTORE_ARGS
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
-
-@@ -77,5 +79,6 @@ restore:
- SAVE_ARGS
- restore_norax:
- RESTORE_ARGS 1
-+ pax_force_retaddr
- ret
- CFI_ENDPROC
-diff --git a/arch/x86/lib/usercopy_32.c b/arch/x86/lib/usercopy_32.c
-index 1f118d4..7d522b8 100644
---- a/arch/x86/lib/usercopy_32.c
-+++ b/arch/x86/lib/usercopy_32.c
-@@ -43,7 +43,7 @@ do { \
- __asm__ __volatile__( \
- " testl %1,%1\n" \
- " jz 2f\n" \
-- "0: lodsb\n" \
-+ "0: "__copyuser_seg"lodsb\n" \
- " stosb\n" \
- " testb %%al,%%al\n" \
- " jz 1f\n" \
-@@ -128,10 +128,12 @@ do { \
- int __d0; \
- might_fault(); \
- __asm__ __volatile__( \
-+ __COPYUSER_SET_ES \
- "0: rep; stosl\n" \
- " movl %2,%0\n" \
- "1: rep; stosb\n" \
- "2:\n" \
-+ __COPYUSER_RESTORE_ES \
- ".section .fixup,\"ax\"\n" \
- "3: lea 0(%2,%0,4),%0\n" \
- " jmp 2b\n" \
-@@ -200,6 +202,7 @@ long strnlen_user(const char __user *s, long n)
- might_fault();
-
- __asm__ __volatile__(
-+ __COPYUSER_SET_ES
- " testl %0, %0\n"
- " jz 3f\n"
- " andl %0,%%ecx\n"
-@@ -208,6 +211,7 @@ long strnlen_user(const char __user *s, long n)
- " subl %%ecx,%0\n"
- " addl %0,%%eax\n"
- "1:\n"
-+ __COPYUSER_RESTORE_ES
- ".section .fixup,\"ax\"\n"
- "2: xorl %%eax,%%eax\n"
- " jmp 1b\n"
-@@ -227,7 +231,7 @@ EXPORT_SYMBOL(strnlen_user);
-
- #ifdef CONFIG_X86_INTEL_USERCOPY
- static unsigned long
--__copy_user_intel(void __user *to, const void *from, unsigned long size)
-+__generic_copy_to_user_intel(void __user *to, const void *from, unsigned long size)
- {
- int d0, d1;
- __asm__ __volatile__(
-@@ -239,36 +243,36 @@ __copy_user_intel(void __user *to, const void *from, unsigned long size)
- " .align 2,0x90\n"
- "3: movl 0(%4), %%eax\n"
- "4: movl 4(%4), %%edx\n"
-- "5: movl %%eax, 0(%3)\n"
-- "6: movl %%edx, 4(%3)\n"
-+ "5: "__copyuser_seg" movl %%eax, 0(%3)\n"
-+ "6: "__copyuser_seg" movl %%edx, 4(%3)\n"
- "7: movl 8(%4), %%eax\n"
- "8: movl 12(%4),%%edx\n"
-- "9: movl %%eax, 8(%3)\n"
-- "10: movl %%edx, 12(%3)\n"
-+ "9: "__copyuser_seg" movl %%eax, 8(%3)\n"
-+ "10: "__copyuser_seg" movl %%edx, 12(%3)\n"
- "11: movl 16(%4), %%eax\n"
- "12: movl 20(%4), %%edx\n"
-- "13: movl %%eax, 16(%3)\n"
-- "14: movl %%edx, 20(%3)\n"
-+ "13: "__copyuser_seg" movl %%eax, 16(%3)\n"
-+ "14: "__copyuser_seg" movl %%edx, 20(%3)\n"
- "15: movl 24(%4), %%eax\n"
- "16: movl 28(%4), %%edx\n"
-- "17: movl %%eax, 24(%3)\n"
-- "18: movl %%edx, 28(%3)\n"
-+ "17: "__copyuser_seg" movl %%eax, 24(%3)\n"
-+ "18: "__copyuser_seg" movl %%edx, 28(%3)\n"
- "19: movl 32(%4), %%eax\n"
- "20: movl 36(%4), %%edx\n"
-- "21: movl %%eax, 32(%3)\n"
-- "22: movl %%edx, 36(%3)\n"
-+ "21: "__copyuser_seg" movl %%eax, 32(%3)\n"
-+ "22: "__copyuser_seg" movl %%edx, 36(%3)\n"
- "23: movl 40(%4), %%eax\n"
- "24: movl 44(%4), %%edx\n"
-- "25: movl %%eax, 40(%3)\n"
-- "26: movl %%edx, 44(%3)\n"
-+ "25: "__copyuser_seg" movl %%eax, 40(%3)\n"
-+ "26: "__copyuser_seg" movl %%edx, 44(%3)\n"
- "27: movl 48(%4), %%eax\n"
- "28: movl 52(%4), %%edx\n"
-- "29: movl %%eax, 48(%3)\n"
-- "30: movl %%edx, 52(%3)\n"
-+ "29: "__copyuser_seg" movl %%eax, 48(%3)\n"
-+ "30: "__copyuser_seg" movl %%edx, 52(%3)\n"
- "31: movl 56(%4), %%eax\n"
- "32: movl 60(%4), %%edx\n"
-- "33: movl %%eax, 56(%3)\n"
-- "34: movl %%edx, 60(%3)\n"
-+ "33: "__copyuser_seg" movl %%eax, 56(%3)\n"
-+ "34: "__copyuser_seg" movl %%edx, 60(%3)\n"
- " addl $-64, %0\n"
- " addl $64, %4\n"
- " addl $64, %3\n"
-@@ -278,10 +282,12 @@ __copy_user_intel(void __user *to, const void *from, unsigned long size)
- " shrl $2, %0\n"
- " andl $3, %%eax\n"
- " cld\n"
-+ __COPYUSER_SET_ES
- "99: rep; movsl\n"
- "36: movl %%eax, %0\n"
- "37: rep; movsb\n"
- "100:\n"
-+ __COPYUSER_RESTORE_ES
- ".section .fixup,\"ax\"\n"
- "101: lea 0(%%eax,%0,4),%0\n"
- " jmp 100b\n"
-@@ -334,46 +340,153 @@ __copy_user_intel(void __user *to, const void *from, unsigned long size)
- }
-
- static unsigned long
-+__generic_copy_from_user_intel(void *to, const void __user *from, unsigned long size)
-+{
-+ int d0, d1;
-+ __asm__ __volatile__(
-+ " .align 2,0x90\n"
-+ "1: "__copyuser_seg" movl 32(%4), %%eax\n"
-+ " cmpl $67, %0\n"
-+ " jbe 3f\n"
-+ "2: "__copyuser_seg" movl 64(%4), %%eax\n"
-+ " .align 2,0x90\n"
-+ "3: "__copyuser_seg" movl 0(%4), %%eax\n"
-+ "4: "__copyuser_seg" movl 4(%4), %%edx\n"
-+ "5: movl %%eax, 0(%3)\n"
-+ "6: movl %%edx, 4(%3)\n"
-+ "7: "__copyuser_seg" movl 8(%4), %%eax\n"
-+ "8: "__copyuser_seg" movl 12(%4),%%edx\n"
-+ "9: movl %%eax, 8(%3)\n"
-+ "10: movl %%edx, 12(%3)\n"
-+ "11: "__copyuser_seg" movl 16(%4), %%eax\n"
-+ "12: "__copyuser_seg" movl 20(%4), %%edx\n"
-+ "13: movl %%eax, 16(%3)\n"
-+ "14: movl %%edx, 20(%3)\n"
-+ "15: "__copyuser_seg" movl 24(%4), %%eax\n"
-+ "16: "__copyuser_seg" movl 28(%4), %%edx\n"
-+ "17: movl %%eax, 24(%3)\n"
-+ "18: movl %%edx, 28(%3)\n"
-+ "19: "__copyuser_seg" movl 32(%4), %%eax\n"
-+ "20: "__copyuser_seg" movl 36(%4), %%edx\n"
-+ "21: movl %%eax, 32(%3)\n"
-+ "22: movl %%edx, 36(%3)\n"
-+ "23: "__copyuser_seg" movl 40(%4), %%eax\n"
-+ "24: "__copyuser_seg" movl 44(%4), %%edx\n"
-+ "25: movl %%eax, 40(%3)\n"
-+ "26: movl %%edx, 44(%3)\n"
-+ "27: "__copyuser_seg" movl 48(%4), %%eax\n"
-+ "28: "__copyuser_seg" movl 52(%4), %%edx\n"
-+ "29: movl %%eax, 48(%3)\n"
-+ "30: movl %%edx, 52(%3)\n"
-+ "31: "__copyuser_seg" movl 56(%4), %%eax\n"
-+ "32: "__copyuser_seg" movl 60(%4), %%edx\n"
-+ "33: movl %%eax, 56(%3)\n"
-+ "34: movl %%edx, 60(%3)\n"
-+ " addl $-64, %0\n"
-+ " addl $64, %4\n"
-+ " addl $64, %3\n"
-+ " cmpl $63, %0\n"
-+ " ja 1b\n"
-+ "35: movl %0, %%eax\n"
-+ " shrl $2, %0\n"
-+ " andl $3, %%eax\n"
-+ " cld\n"
-+ "99: rep; "__copyuser_seg" movsl\n"
-+ "36: movl %%eax, %0\n"
-+ "37: rep; "__copyuser_seg" movsb\n"
-+ "100:\n"
-+ ".section .fixup,\"ax\"\n"
-+ "101: lea 0(%%eax,%0,4),%0\n"
-+ " jmp 100b\n"
-+ ".previous\n"
-+ ".section __ex_table,\"a\"\n"
-+ " .align 4\n"
-+ " .long 1b,100b\n"
-+ " .long 2b,100b\n"
-+ " .long 3b,100b\n"
-+ " .long 4b,100b\n"
-+ " .long 5b,100b\n"
-+ " .long 6b,100b\n"
-+ " .long 7b,100b\n"
-+ " .long 8b,100b\n"
-+ " .long 9b,100b\n"
-+ " .long 10b,100b\n"
-+ " .long 11b,100b\n"
-+ " .long 12b,100b\n"
-+ " .long 13b,100b\n"
-+ " .long 14b,100b\n"
-+ " .long 15b,100b\n"
-+ " .long 16b,100b\n"
-+ " .long 17b,100b\n"
-+ " .long 18b,100b\n"
-+ " .long 19b,100b\n"
-+ " .long 20b,100b\n"
-+ " .long 21b,100b\n"
-+ " .long 22b,100b\n"
-+ " .long 23b,100b\n"
-+ " .long 24b,100b\n"
-+ " .long 25b,100b\n"
-+ " .long 26b,100b\n"
-+ " .long 27b,100b\n"
-+ " .long 28b,100b\n"
-+ " .long 29b,100b\n"
-+ " .long 30b,100b\n"
-+ " .long 31b,100b\n"
-+ " .long 32b,100b\n"
-+ " .long 33b,100b\n"
-+ " .long 34b,100b\n"
-+ " .long 35b,100b\n"
-+ " .long 36b,100b\n"
-+ " .long 37b,100b\n"
-+ " .long 99b,101b\n"
-+ ".previous"
-+ : "=&c"(size), "=&D" (d0), "=&S" (d1)
-+ : "1"(to), "2"(from), "0"(size)
-+ : "eax", "edx", "memory");
-+ return size;
-+}
-+
-+static unsigned long __size_overflow(3)
- __copy_user_zeroing_intel(void *to, const void __user *from, unsigned long size)
- {
- int d0, d1;
- __asm__ __volatile__(
- " .align 2,0x90\n"
-- "0: movl 32(%4), %%eax\n"
-+ "0: "__copyuser_seg" movl 32(%4), %%eax\n"
- " cmpl $67, %0\n"
- " jbe 2f\n"
-- "1: movl 64(%4), %%eax\n"
-+ "1: "__copyuser_seg" movl 64(%4), %%eax\n"
- " .align 2,0x90\n"
-- "2: movl 0(%4), %%eax\n"
-- "21: movl 4(%4), %%edx\n"
-+ "2: "__copyuser_seg" movl 0(%4), %%eax\n"
-+ "21: "__copyuser_seg" movl 4(%4), %%edx\n"
- " movl %%eax, 0(%3)\n"
- " movl %%edx, 4(%3)\n"
-- "3: movl 8(%4), %%eax\n"
-- "31: movl 12(%4),%%edx\n"
-+ "3: "__copyuser_seg" movl 8(%4), %%eax\n"
-+ "31: "__copyuser_seg" movl 12(%4),%%edx\n"
- " movl %%eax, 8(%3)\n"
- " movl %%edx, 12(%3)\n"
-- "4: movl 16(%4), %%eax\n"
-- "41: movl 20(%4), %%edx\n"
-+ "4: "__copyuser_seg" movl 16(%4), %%eax\n"
-+ "41: "__copyuser_seg" movl 20(%4), %%edx\n"
- " movl %%eax, 16(%3)\n"
- " movl %%edx, 20(%3)\n"
-- "10: movl 24(%4), %%eax\n"
-- "51: movl 28(%4), %%edx\n"
-+ "10: "__copyuser_seg" movl 24(%4), %%eax\n"
-+ "51: "__copyuser_seg" movl 28(%4), %%edx\n"
- " movl %%eax, 24(%3)\n"
- " movl %%edx, 28(%3)\n"
-- "11: movl 32(%4), %%eax\n"
-- "61: movl 36(%4), %%edx\n"
-+ "11: "__copyuser_seg" movl 32(%4), %%eax\n"
-+ "61: "__copyuser_seg" movl 36(%4), %%edx\n"
- " movl %%eax, 32(%3)\n"
- " movl %%edx, 36(%3)\n"
-- "12: movl 40(%4), %%eax\n"
-- "71: movl 44(%4), %%edx\n"
-+ "12: "__copyuser_seg" movl 40(%4), %%eax\n"
-+ "71: "__copyuser_seg" movl 44(%4), %%edx\n"
- " movl %%eax, 40(%3)\n"
- " movl %%edx, 44(%3)\n"
-- "13: movl 48(%4), %%eax\n"
-- "81: movl 52(%4), %%edx\n"
-+ "13: "__copyuser_seg" movl 48(%4), %%eax\n"
-+ "81: "__copyuser_seg" movl 52(%4), %%edx\n"
- " movl %%eax, 48(%3)\n"
- " movl %%edx, 52(%3)\n"
-- "14: movl 56(%4), %%eax\n"
-- "91: movl 60(%4), %%edx\n"
-+ "14: "__copyuser_seg" movl 56(%4), %%eax\n"
-+ "91: "__copyuser_seg" movl 60(%4), %%edx\n"
- " movl %%eax, 56(%3)\n"
- " movl %%edx, 60(%3)\n"
- " addl $-64, %0\n"
-@@ -385,9 +498,9 @@ __copy_user_zeroing_intel(void *to, const void __user *from, unsigned long size)
- " shrl $2, %0\n"
- " andl $3, %%eax\n"
- " cld\n"
-- "6: rep; movsl\n"
-+ "6: rep; "__copyuser_seg" movsl\n"
- " movl %%eax,%0\n"
-- "7: rep; movsb\n"
-+ "7: rep; "__copyuser_seg" movsb\n"
- "8:\n"
- ".section .fixup,\"ax\"\n"
- "9: lea 0(%%eax,%0,4),%0\n"
-@@ -433,48 +546,48 @@ __copy_user_zeroing_intel(void *to, const void __user *from, unsigned long size)
- * hyoshiok@miraclelinux.com
- */
-
--static unsigned long __copy_user_zeroing_intel_nocache(void *to,
-+static unsigned long __size_overflow(3) __copy_user_zeroing_intel_nocache(void *to,
- const void __user *from, unsigned long size)
- {
- int d0, d1;
-
- __asm__ __volatile__(
- " .align 2,0x90\n"
-- "0: movl 32(%4), %%eax\n"
-+ "0: "__copyuser_seg" movl 32(%4), %%eax\n"
- " cmpl $67, %0\n"
- " jbe 2f\n"
-- "1: movl 64(%4), %%eax\n"
-+ "1: "__copyuser_seg" movl 64(%4), %%eax\n"
- " .align 2,0x90\n"
-- "2: movl 0(%4), %%eax\n"
-- "21: movl 4(%4), %%edx\n"
-+ "2: "__copyuser_seg" movl 0(%4), %%eax\n"
-+ "21: "__copyuser_seg" movl 4(%4), %%edx\n"
- " movnti %%eax, 0(%3)\n"
- " movnti %%edx, 4(%3)\n"
-- "3: movl 8(%4), %%eax\n"
-- "31: movl 12(%4),%%edx\n"
-+ "3: "__copyuser_seg" movl 8(%4), %%eax\n"
-+ "31: "__copyuser_seg" movl 12(%4),%%edx\n"
- " movnti %%eax, 8(%3)\n"
- " movnti %%edx, 12(%3)\n"
-- "4: movl 16(%4), %%eax\n"
-- "41: movl 20(%4), %%edx\n"
-+ "4: "__copyuser_seg" movl 16(%4), %%eax\n"
-+ "41: "__copyuser_seg" movl 20(%4), %%edx\n"
- " movnti %%eax, 16(%3)\n"
- " movnti %%edx, 20(%3)\n"
-- "10: movl 24(%4), %%eax\n"
-- "51: movl 28(%4), %%edx\n"
-+ "10: "__copyuser_seg" movl 24(%4), %%eax\n"
-+ "51: "__copyuser_seg" movl 28(%4), %%edx\n"
- " movnti %%eax, 24(%3)\n"
- " movnti %%edx, 28(%3)\n"
-- "11: movl 32(%4), %%eax\n"
-- "61: movl 36(%4), %%edx\n"
-+ "11: "__copyuser_seg" movl 32(%4), %%eax\n"
-+ "61: "__copyuser_seg" movl 36(%4), %%edx\n"
- " movnti %%eax, 32(%3)\n"
- " movnti %%edx, 36(%3)\n"
-- "12: movl 40(%4), %%eax\n"
-- "71: movl 44(%4), %%edx\n"
-+ "12: "__copyuser_seg" movl 40(%4), %%eax\n"
-+ "71: "__copyuser_seg" movl 44(%4), %%edx\n"
- " movnti %%eax, 40(%3)\n"
- " movnti %%edx, 44(%3)\n"
-- "13: movl 48(%4), %%eax\n"
-- "81: movl 52(%4), %%edx\n"
-+ "13: "__copyuser_seg" movl 48(%4), %%eax\n"
-+ "81: "__copyuser_seg" movl 52(%4), %%edx\n"
- " movnti %%eax, 48(%3)\n"
- " movnti %%edx, 52(%3)\n"
-- "14: movl 56(%4), %%eax\n"
-- "91: movl 60(%4), %%edx\n"
-+ "14: "__copyuser_seg" movl 56(%4), %%eax\n"
-+ "91: "__copyuser_seg" movl 60(%4), %%edx\n"
- " movnti %%eax, 56(%3)\n"
- " movnti %%edx, 60(%3)\n"
- " addl $-64, %0\n"
-@@ -487,9 +600,9 @@ static unsigned long __copy_user_zeroing_intel_nocache(void *to,
- " shrl $2, %0\n"
- " andl $3, %%eax\n"
- " cld\n"
-- "6: rep; movsl\n"
-+ "6: rep; "__copyuser_seg" movsl\n"
- " movl %%eax,%0\n"
-- "7: rep; movsb\n"
-+ "7: rep; "__copyuser_seg" movsb\n"
- "8:\n"
- ".section .fixup,\"ax\"\n"
- "9: lea 0(%%eax,%0,4),%0\n"
-@@ -530,48 +643,48 @@ static unsigned long __copy_user_zeroing_intel_nocache(void *to,
- return size;
- }
-
--static unsigned long __copy_user_intel_nocache(void *to,
-+static unsigned long __size_overflow(3) __copy_user_intel_nocache(void *to,
- const void __user *from, unsigned long size)
- {
- int d0, d1;
-
- __asm__ __volatile__(
- " .align 2,0x90\n"
-- "0: movl 32(%4), %%eax\n"
-+ "0: "__copyuser_seg" movl 32(%4), %%eax\n"
- " cmpl $67, %0\n"
- " jbe 2f\n"
-- "1: movl 64(%4), %%eax\n"
-+ "1: "__copyuser_seg" movl 64(%4), %%eax\n"
- " .align 2,0x90\n"
-- "2: movl 0(%4), %%eax\n"
-- "21: movl 4(%4), %%edx\n"
-+ "2: "__copyuser_seg" movl 0(%4), %%eax\n"
-+ "21: "__copyuser_seg" movl 4(%4), %%edx\n"
- " movnti %%eax, 0(%3)\n"
- " movnti %%edx, 4(%3)\n"
-- "3: movl 8(%4), %%eax\n"
-- "31: movl 12(%4),%%edx\n"
-+ "3: "__copyuser_seg" movl 8(%4), %%eax\n"
-+ "31: "__copyuser_seg" movl 12(%4),%%edx\n"
- " movnti %%eax, 8(%3)\n"
- " movnti %%edx, 12(%3)\n"
-- "4: movl 16(%4), %%eax\n"
-- "41: movl 20(%4), %%edx\n"
-+ "4: "__copyuser_seg" movl 16(%4), %%eax\n"
-+ "41: "__copyuser_seg" movl 20(%4), %%edx\n"
- " movnti %%eax, 16(%3)\n"
- " movnti %%edx, 20(%3)\n"
-- "10: movl 24(%4), %%eax\n"
-- "51: movl 28(%4), %%edx\n"
-+ "10: "__copyuser_seg" movl 24(%4), %%eax\n"
-+ "51: "__copyuser_seg" movl 28(%4), %%edx\n"
- " movnti %%eax, 24(%3)\n"
- " movnti %%edx, 28(%3)\n"
-- "11: movl 32(%4), %%eax\n"
-- "61: movl 36(%4), %%edx\n"
-+ "11: "__copyuser_seg" movl 32(%4), %%eax\n"
-+ "61: "__copyuser_seg" movl 36(%4), %%edx\n"
- " movnti %%eax, 32(%3)\n"
- " movnti %%edx, 36(%3)\n"
-- "12: movl 40(%4), %%eax\n"
-- "71: movl 44(%4), %%edx\n"
-+ "12: "__copyuser_seg" movl 40(%4), %%eax\n"
-+ "71: "__copyuser_seg" movl 44(%4), %%edx\n"
- " movnti %%eax, 40(%3)\n"
- " movnti %%edx, 44(%3)\n"
-- "13: movl 48(%4), %%eax\n"
-- "81: movl 52(%4), %%edx\n"
-+ "13: "__copyuser_seg" movl 48(%4), %%eax\n"
-+ "81: "__copyuser_seg" movl 52(%4), %%edx\n"
- " movnti %%eax, 48(%3)\n"
- " movnti %%edx, 52(%3)\n"
-- "14: movl 56(%4), %%eax\n"
-- "91: movl 60(%4), %%edx\n"
-+ "14: "__copyuser_seg" movl 56(%4), %%eax\n"
-+ "91: "__copyuser_seg" movl 60(%4), %%edx\n"
- " movnti %%eax, 56(%3)\n"
- " movnti %%edx, 60(%3)\n"
- " addl $-64, %0\n"
-@@ -584,9 +697,9 @@ static unsigned long __copy_user_intel_nocache(void *to,
- " shrl $2, %0\n"
- " andl $3, %%eax\n"
- " cld\n"
-- "6: rep; movsl\n"
-+ "6: rep; "__copyuser_seg" movsl\n"
- " movl %%eax,%0\n"
-- "7: rep; movsb\n"
-+ "7: rep; "__copyuser_seg" movsb\n"
- "8:\n"
- ".section .fixup,\"ax\"\n"
- "9: lea 0(%%eax,%0,4),%0\n"
-@@ -629,32 +742,36 @@ static unsigned long __copy_user_intel_nocache(void *to,
- */
- unsigned long __copy_user_zeroing_intel(void *to, const void __user *from,
- unsigned long size);
--unsigned long __copy_user_intel(void __user *to, const void *from,
-+unsigned long __generic_copy_to_user_intel(void __user *to, const void *from,
-+ unsigned long size);
-+unsigned long __generic_copy_from_user_intel(void *to, const void __user *from,
- unsigned long size);
- unsigned long __copy_user_zeroing_intel_nocache(void *to,
- const void __user *from, unsigned long size);
- #endif /* CONFIG_X86_INTEL_USERCOPY */
-
- /* Generic arbitrary sized copy. */
--#define __copy_user(to, from, size) \
-+#define __copy_user(to, from, size, prefix, set, restore) \
- do { \
- int __d0, __d1, __d2; \
- __asm__ __volatile__( \
-+ set \
- " cmp $7,%0\n" \
- " jbe 1f\n" \
- " movl %1,%0\n" \
- " negl %0\n" \
- " andl $7,%0\n" \
- " subl %0,%3\n" \
-- "4: rep; movsb\n" \
-+ "4: rep; "prefix"movsb\n" \
- " movl %3,%0\n" \
- " shrl $2,%0\n" \
- " andl $3,%3\n" \
- " .align 2,0x90\n" \
-- "0: rep; movsl\n" \
-+ "0: rep; "prefix"movsl\n" \
- " movl %3,%0\n" \
-- "1: rep; movsb\n" \
-+ "1: rep; "prefix"movsb\n" \
- "2:\n" \
-+ restore \
- ".section .fixup,\"ax\"\n" \
- "5: addl %3,%0\n" \
- " jmp 2b\n" \
-@@ -682,14 +799,14 @@ do { \
- " negl %0\n" \
- " andl $7,%0\n" \
- " subl %0,%3\n" \
-- "4: rep; movsb\n" \
-+ "4: rep; "__copyuser_seg"movsb\n" \
- " movl %3,%0\n" \
- " shrl $2,%0\n" \
- " andl $3,%3\n" \
- " .align 2,0x90\n" \
-- "0: rep; movsl\n" \
-+ "0: rep; "__copyuser_seg"movsl\n" \
- " movl %3,%0\n" \
-- "1: rep; movsb\n" \
-+ "1: rep; "__copyuser_seg"movsb\n" \
- "2:\n" \
- ".section .fixup,\"ax\"\n" \
- "5: addl %3,%0\n" \
-@@ -775,9 +892,9 @@ survive:
- }
- #endif
- if (movsl_is_ok(to, from, n))
-- __copy_user(to, from, n);
-+ __copy_user(to, from, n, "", __COPYUSER_SET_ES, __COPYUSER_RESTORE_ES);
- else
-- n = __copy_user_intel(to, from, n);
-+ n = __generic_copy_to_user_intel(to, from, n);
- return n;
- }
- EXPORT_SYMBOL(__copy_to_user_ll);
-@@ -797,10 +914,9 @@ unsigned long __copy_from_user_ll_nozero(void *to, const void __user *from,
- unsigned long n)
- {
- if (movsl_is_ok(to, from, n))
-- __copy_user(to, from, n);
-+ __copy_user(to, from, n, __copyuser_seg, "", "");
- else
-- n = __copy_user_intel((void __user *)to,
-- (const void *)from, n);
-+ n = __generic_copy_from_user_intel(to, from, n);
- return n;
- }
- EXPORT_SYMBOL(__copy_from_user_ll_nozero);
-@@ -827,59 +943,50 @@ unsigned long __copy_from_user_ll_nocache_nozero(void *to, const void __user *fr
- if (n > 64 && cpu_has_xmm2)
- n = __copy_user_intel_nocache(to, from, n);
- else
-- __copy_user(to, from, n);
-+ __copy_user(to, from, n, __copyuser_seg, "", "");
- #else
-- __copy_user(to, from, n);
-+ __copy_user(to, from, n, __copyuser_seg, "", "");
- #endif
- return n;
- }
- EXPORT_SYMBOL(__copy_from_user_ll_nocache_nozero);
-
--/**
-- * copy_to_user: - Copy a block of data into user space.
-- * @to: Destination address, in user space.
-- * @from: Source address, in kernel space.
-- * @n: Number of bytes to copy.
-- *
-- * Context: User context only. This function may sleep.
-- *
-- * Copy data from kernel space to user space.
-- *
-- * Returns number of bytes that could not be copied.
-- * On success, this will be zero.
-- */
--unsigned long
--copy_to_user(void __user *to, const void *from, unsigned long n)
-+void copy_from_user_overflow(void)
- {
-- if (access_ok(VERIFY_WRITE, to, n))
-- n = __copy_to_user(to, from, n);
-- return n;
-+ WARN(1, "Buffer overflow detected!\n");
- }
--EXPORT_SYMBOL(copy_to_user);
-+EXPORT_SYMBOL(copy_from_user_overflow);
-
--/**
-- * copy_from_user: - Copy a block of data from user space.
-- * @to: Destination address, in kernel space.
-- * @from: Source address, in user space.
-- * @n: Number of bytes to copy.
-- *
-- * Context: User context only. This function may sleep.
-- *
-- * Copy data from user space to kernel space.
-- *
-- * Returns number of bytes that could not be copied.
-- * On success, this will be zero.
-- *
-- * If some data could not be copied, this function will pad the copied
-- * data to the requested size using zero bytes.
-- */
--unsigned long
--copy_from_user(void *to, const void __user *from, unsigned long n)
-+void copy_to_user_overflow(void)
- {
-- if (access_ok(VERIFY_READ, from, n))
-- n = __copy_from_user(to, from, n);
-- else
-- memset(to, 0, n);
-- return n;
-+ WARN(1, "Buffer overflow detected!\n");
- }
--EXPORT_SYMBOL(copy_from_user);
-+EXPORT_SYMBOL(copy_to_user_overflow);
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+void __set_fs(mm_segment_t x)
-+{
-+ switch (x.seg) {
-+ case 0:
-+ loadsegment(gs, 0);
-+ break;
-+ case TASK_SIZE_MAX:
-+ loadsegment(gs, __USER_DS);
-+ break;
-+ case -1UL:
-+ loadsegment(gs, __KERNEL_DS);
-+ break;
-+ default:
-+ BUG();
-+ }
-+ return;
-+}
-+EXPORT_SYMBOL(__set_fs);
-+
-+void set_fs(mm_segment_t x)
-+{
-+ current_thread_info()->addr_limit = x;
-+ __set_fs(x);
-+}
-+EXPORT_SYMBOL(set_fs);
-+#endif
-diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
-index b7c2849..17c878da 100644
---- a/arch/x86/lib/usercopy_64.c
-+++ b/arch/x86/lib/usercopy_64.c
-@@ -42,6 +42,12 @@ long
- __strncpy_from_user(char *dst, const char __user *src, long count)
- {
- long res;
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
-+ src += PAX_USER_SHADOW_BASE;
-+#endif
-+
- __do_strncpy_from_user(dst, src, count, res);
- return res;
- }
-@@ -87,7 +93,7 @@ unsigned long __clear_user(void __user *addr, unsigned long size)
- _ASM_EXTABLE(0b,3b)
- _ASM_EXTABLE(1b,2b)
- : [size8] "=&c"(size), [dst] "=&D" (__d0)
-- : [size1] "r"(size & 7), "[size8]" (size / 8), "[dst]"(addr),
-+ : [size1] "r"(size & 7), "[size8]" (size / 8), "[dst]"(____m(addr)),
- [zero] "r" (0UL), [eight] "r" (8UL));
- return size;
- }
-@@ -149,12 +155,11 @@ long strlen_user(const char __user *s)
- }
- EXPORT_SYMBOL(strlen_user);
-
--unsigned long copy_in_user(void __user *to, const void __user *from, unsigned len)
-+unsigned long copy_in_user(void __user *to, const void __user *from, unsigned long len)
- {
-- if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
-- return copy_user_generic((__force void *)to, (__force void *)from, len);
-- }
-- return len;
-+ if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len))
-+ return copy_user_generic((void __force_kernel *)____m(to), (void __force_kernel *)____m(from), len);
-+ return len;
- }
- EXPORT_SYMBOL(copy_in_user);
-
-@@ -164,7 +169,7 @@ EXPORT_SYMBOL(copy_in_user);
- * it is not necessary to optimize tail handling.
- */
- unsigned long
--copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest)
-+copy_user_handle_tail(char __user *to, char __user *from, unsigned long len, unsigned zerorest)
- {
- char c;
- unsigned zero_len;
-@@ -181,3 +186,15 @@ copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest)
- break;
- return len;
- }
-+
-+void copy_from_user_overflow(void)
-+{
-+ WARN(1, "Buffer overflow detected!\n");
-+}
-+EXPORT_SYMBOL(copy_from_user_overflow);
-+
-+void copy_to_user_overflow(void)
-+{
-+ WARN(1, "Buffer overflow detected!\n");
-+}
-+EXPORT_SYMBOL(copy_to_user_overflow);
-diff --git a/arch/x86/mm/extable.c b/arch/x86/mm/extable.c
-index 61b41ca..5fef66a 100644
---- a/arch/x86/mm/extable.c
-+++ b/arch/x86/mm/extable.c
-@@ -1,14 +1,71 @@
- #include <linux/module.h>
- #include <linux/spinlock.h>
-+#include <linux/sort.h>
- #include <asm/uaccess.h>
-+#include <asm/pgtable.h>
-
-+/*
-+ * The exception table needs to be sorted so that the binary
-+ * search that we use to find entries in it works properly.
-+ * This is used both for the kernel exception table and for
-+ * the exception tables of modules that get loaded.
-+ */
-+static int cmp_ex(const void *a, const void *b)
-+{
-+ const struct exception_table_entry *x = a, *y = b;
-+
-+ /* avoid overflow */
-+ if (x->insn > y->insn)
-+ return 1;
-+ if (x->insn < y->insn)
-+ return -1;
-+ return 0;
-+}
-+
-+static void swap_ex(void *a, void *b, int size)
-+{
-+ struct exception_table_entry t, *x = a, *y = b;
-+
-+ t = *x;
-+
-+ pax_open_kernel();
-+ *x = *y;
-+ *y = t;
-+ pax_close_kernel();
-+}
-+
-+void sort_extable(struct exception_table_entry *start,
-+ struct exception_table_entry *finish)
-+{
-+ sort(start, finish - start, sizeof(struct exception_table_entry),
-+ cmp_ex, swap_ex);
-+}
-+
-+#ifdef CONFIG_MODULES
-+/*
-+ * If the exception table is sorted, any referring to the module init
-+ * will be at the beginning or the end.
-+ */
-+void trim_init_extable(struct module *m)
-+{
-+ /*trim the beginning*/
-+ while (m->num_exentries && within_module_init(m->extable[0].insn, m)) {
-+ m->extable++;
-+ m->num_exentries--;
-+ }
-+ /*trim the end*/
-+ while (m->num_exentries &&
-+ within_module_init(m->extable[m->num_exentries-1].insn, m))
-+ m->num_exentries--;
-+}
-+#endif /* CONFIG_MODULES */
-
- int fixup_exception(struct pt_regs *regs)
- {
- const struct exception_table_entry *fixup;
-
- #ifdef CONFIG_PNPBIOS
-- if (unlikely(SEGMENT_IS_PNP_CODE(regs->cs))) {
-+ if (unlikely(!v8086_mode(regs) && SEGMENT_IS_PNP_CODE(regs->cs))) {
- extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp;
- extern u32 pnp_bios_is_utter_crap;
- pnp_bios_is_utter_crap = 1;
-diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
-index 249ad57..8d4b579 100644
---- a/arch/x86/mm/fault.c
-+++ b/arch/x86/mm/fault.c
-@@ -11,10 +11,19 @@
- #include <linux/kprobes.h> /* __kprobes, ... */
- #include <linux/mmiotrace.h> /* kmmio_handler, ... */
- #include <linux/perf_event.h> /* perf_sw_event */
-+#include <linux/unistd.h>
-+#include <linux/compiler.h>
-
- #include <asm/traps.h> /* dotraplinkage, ... */
- #include <asm/pgalloc.h> /* pgd_*(), ... */
- #include <asm/kmemcheck.h> /* kmemcheck_*(), ... */
-+#include <asm/vsyscall.h>
-+#include <asm/tlbflush.h>
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+#include <asm/stacktrace.h>
-+#include "../kernel/dumpstack.h"
-+#endif
-
- /*
- * Page fault error code bits:
-@@ -51,7 +60,7 @@ static inline int notify_page_fault(struct pt_regs *regs)
- int ret = 0;
-
- /* kprobe_running() needs smp_processor_id() */
-- if (kprobes_built_in() && !user_mode_vm(regs)) {
-+ if (kprobes_built_in() && !user_mode(regs)) {
- preempt_disable();
- if (kprobe_running() && kprobe_fault_handler(regs, 14))
- ret = 1;
-@@ -112,7 +121,10 @@ check_prefetch_opcode(struct pt_regs *regs, unsigned char *instr,
- return !instr_lo || (instr_lo>>1) == 1;
- case 0x00:
- /* Prefetch instruction is 0x0F0D or 0x0F18 */
-- if (probe_kernel_address(instr, opcode))
-+ if (user_mode(regs)) {
-+ if (__copy_from_user_inatomic(&opcode, (unsigned char __force_user *)(instr), 1))
-+ return 0;
-+ } else if (probe_kernel_address(instr, opcode))
- return 0;
-
- *prefetch = (instr_lo == 0xF) &&
-@@ -146,7 +158,10 @@ is_prefetch(struct pt_regs *regs, unsigned long error_code, unsigned long addr)
- while (instr < max_instr) {
- unsigned char opcode;
-
-- if (probe_kernel_address(instr, opcode))
-+ if (user_mode(regs)) {
-+ if (__copy_from_user_inatomic(&opcode, (unsigned char __force_user *)(instr), 1))
-+ break;
-+ } else if (probe_kernel_address(instr, opcode))
- break;
-
- instr++;
-@@ -172,6 +187,34 @@ force_sig_info_fault(int si_signo, int si_code, unsigned long address,
- force_sig_info(si_signo, &info, tsk);
- }
-
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+static bool pax_is_fetch_fault(struct pt_regs *regs, unsigned long error_code, unsigned long address);
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+static int pax_handle_fetch_fault(struct pt_regs *regs);
-+#endif
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+static inline pmd_t * pax_get_pmd(struct mm_struct *mm, unsigned long address)
-+{
-+ pgd_t *pgd;
-+ pud_t *pud;
-+ pmd_t *pmd;
-+
-+ pgd = pgd_offset(mm, address);
-+ if (!pgd_present(*pgd))
-+ return NULL;
-+ pud = pud_offset(pgd, address);
-+ if (!pud_present(*pud))
-+ return NULL;
-+ pmd = pmd_offset(pud, address);
-+ if (!pmd_present(*pmd))
-+ return NULL;
-+ return pmd;
-+}
-+#endif
-+
- DEFINE_SPINLOCK(pgd_lock);
- LIST_HEAD(pgd_list);
-
-@@ -223,11 +266,23 @@ void vmalloc_sync_all(void)
- address >= TASK_SIZE && address < FIXADDR_TOP;
- address += PMD_SIZE) {
-
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ unsigned long cpu;
-+#else
- struct page *page;
-+#endif
-
- spin_lock(&pgd_lock);
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ for (cpu = 0; cpu < nr_cpu_ids; ++cpu) {
-+ pgd_t *pgd = get_cpu_pgd(cpu);
-+#else
- list_for_each_entry(page, &pgd_list, lru) {
-- if (!vmalloc_sync_one(page_address(page), address))
-+ pgd_t *pgd = page_address(page);
-+#endif
-+
-+ if (!vmalloc_sync_one(pgd, address))
- break;
- }
- spin_unlock(&pgd_lock);
-@@ -257,6 +312,11 @@ static noinline int vmalloc_fault(unsigned long address)
- * an interrupt in the middle of a task switch..
- */
- pgd_paddr = read_cr3();
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (pgd_paddr & PHYSICAL_PAGE_MASK));
-+#endif
-+
- pmd_k = vmalloc_sync_one(__va(pgd_paddr), address);
- if (!pmd_k)
- return -1;
-@@ -330,15 +390,27 @@ void vmalloc_sync_all(void)
- address += PGDIR_SIZE) {
-
- const pgd_t *pgd_ref = pgd_offset_k(address);
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ unsigned long cpu;
-+#else
- struct page *page;
-+#endif
-
- if (pgd_none(*pgd_ref))
- continue;
-
- spin_lock(&pgd_lock);
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ for (cpu = 0; cpu < nr_cpu_ids; ++cpu) {
-+ pgd_t *pgd = pgd_offset_cpu(cpu, address);
-+#else
- list_for_each_entry(page, &pgd_list, lru) {
- pgd_t *pgd;
- pgd = (pgd_t *)page_address(page) + pgd_index(address);
-+#endif
-+
- if (pgd_none(*pgd))
- set_pgd(pgd, *pgd_ref);
- else
-@@ -371,7 +443,14 @@ static noinline int vmalloc_fault(unsigned long address)
- * happen within a race in page table update. In the later
- * case just flush:
- */
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (read_cr3() & PHYSICAL_PAGE_MASK));
-+ pgd = pgd_offset_cpu(smp_processor_id(), address);
-+#else
- pgd = pgd_offset(current->active_mm, address);
-+#endif
-+
- pgd_ref = pgd_offset_k(address);
- if (pgd_none(*pgd_ref))
- return -1;
-@@ -533,7 +612,7 @@ static int is_errata93(struct pt_regs *regs, unsigned long address)
- static int is_errata100(struct pt_regs *regs, unsigned long address)
- {
- #ifdef CONFIG_X86_64
-- if ((regs->cs == __USER32_CS || (regs->cs & (1<<2))) && (address >> 32))
-+ if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)) && (address >> 32))
- return 1;
- #endif
- return 0;
-@@ -560,7 +639,7 @@ static int is_f00f_bug(struct pt_regs *regs, unsigned long address)
- }
-
- static const char nx_warning[] = KERN_CRIT
--"kernel tried to execute NX-protected page - exploit attempt? (uid: %d)\n";
-+"kernel tried to execute NX-protected page - exploit attempt? (uid: %d, task: %s, pid: %d)\n";
-
- static void
- show_fault_oops(struct pt_regs *regs, unsigned long error_code,
-@@ -569,15 +648,26 @@ show_fault_oops(struct pt_regs *regs, unsigned long error_code,
- if (!oops_may_print())
- return;
-
-- if (error_code & PF_INSTR) {
-+ if (nx_enabled && (error_code & PF_INSTR)) {
- unsigned int level;
-
- pte_t *pte = lookup_address(address, &level);
-
- if (pte && pte_present(*pte) && !pte_exec(*pte))
-- printk(nx_warning, current_uid());
-+ printk(nx_warning, current_uid(), current->comm, task_pid_nr(current));
- }
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+ if (init_mm.start_code <= address && address < init_mm.end_code) {
-+ if (current->signal->curr_ip)
-+ printk(KERN_ERR "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
-+ ¤t->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
-+ else
-+ printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
-+ current->comm, task_pid_nr(current), current_uid(), current_euid());
-+ }
-+#endif
-+
- printk(KERN_ALERT "BUG: unable to handle kernel ");
- if (address < PAGE_SIZE)
- printk(KERN_CONT "NULL pointer dereference");
-@@ -703,6 +793,23 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
- {
- struct task_struct *tsk = current;
-
-+#ifdef CONFIG_X86_64
-+ struct mm_struct *mm = tsk->mm;
-+
-+ if (mm && (error_code & PF_INSTR) && mm->context.vdso) {
-+ if (regs->ip == (unsigned long)vgettimeofday) {
-+ regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_gettimeofday);
-+ return;
-+ } else if (regs->ip == (unsigned long)vtime) {
-+ regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_time);
-+ return;
-+ } else if (regs->ip == (unsigned long)vgetcpu) {
-+ regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, getcpu);
-+ return;
-+ }
-+ }
-+#endif
-+
- /* User mode accesses just cause a SIGSEGV */
- if (error_code & PF_USER) {
- /*
-@@ -720,12 +827,30 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
- if (is_errata100(regs, address))
- return;
-
-- if (unlikely(show_unhandled_signals))
-- show_signal_msg(regs, error_code, address, tsk);
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+ if (pax_is_fetch_fault(regs, error_code, address)) {
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+ switch (pax_handle_fetch_fault(regs)) {
-+ case 2:
-+ return;
-+ }
-+#endif
-+
-+ pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
-+ do_group_exit(SIGKILL);
-+ }
-+#endif
-
- /* Kernel addresses are always protection faults: */
-+ if (address >= TASK_SIZE)
-+ error_code |= PF_PROT;
-+
-+ if (show_unhandled_signals)
-+ show_signal_msg(regs, error_code, address, tsk);
-+
- tsk->thread.cr2 = address;
-- tsk->thread.error_code = error_code | (address >= TASK_SIZE);
-+ tsk->thread.error_code = error_code;
- tsk->thread.trap_no = 14;
-
- force_sig_info_fault(SIGSEGV, si_code, address, tsk);
-@@ -816,7 +941,7 @@ do_sigbus(struct pt_regs *regs, unsigned long error_code, unsigned long address,
- if (fault & VM_FAULT_HWPOISON) {
- printk(KERN_ERR
- "MCE: Killing %s:%d due to hardware memory corruption fault at %lx\n",
-- tsk->comm, tsk->pid, address);
-+ tsk->comm, task_pid_nr(tsk), address);
- code = BUS_MCEERR_AR;
- }
- #endif
-@@ -855,6 +980,99 @@ static int spurious_fault_check(unsigned long error_code, pte_t *pte)
- return 1;
- }
-
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
-+static int pax_handle_pageexec_fault(struct pt_regs *regs, struct mm_struct *mm, unsigned long address, unsigned long error_code)
-+{
-+ pte_t *pte;
-+ pmd_t *pmd;
-+ spinlock_t *ptl;
-+ unsigned char pte_mask;
-+
-+ if (nx_enabled || (error_code & (PF_PROT|PF_USER)) != (PF_PROT|PF_USER) || v8086_mode(regs) ||
-+ !(mm->pax_flags & MF_PAX_PAGEEXEC))
-+ return 0;
-+
-+ /* PaX: it's our fault, let's handle it if we can */
-+
-+ /* PaX: take a look at read faults before acquiring any locks */
-+ if (unlikely(!(error_code & PF_WRITE) && (regs->ip == address))) {
-+ /* instruction fetch attempt from a protected page in user mode */
-+ up_read(&mm->mmap_sem);
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+ switch (pax_handle_fetch_fault(regs)) {
-+ case 2:
-+ return 1;
-+ }
-+#endif
-+
-+ pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
-+ do_group_exit(SIGKILL);
-+ }
-+
-+ pmd = pax_get_pmd(mm, address);
-+ if (unlikely(!pmd))
-+ return 0;
-+
-+ pte = pte_offset_map_lock(mm, pmd, address, &ptl);
-+ if (unlikely(!(pte_val(*pte) & _PAGE_PRESENT) || pte_user(*pte))) {
-+ pte_unmap_unlock(pte, ptl);
-+ return 0;
-+ }
-+
-+ if (unlikely((error_code & PF_WRITE) && !pte_write(*pte))) {
-+ /* write attempt to a protected page in user mode */
-+ pte_unmap_unlock(pte, ptl);
-+ return 0;
-+ }
-+
-+#ifdef CONFIG_SMP
-+ if (likely(address > get_limit(regs->cs) && cpu_isset(smp_processor_id(), mm->context.cpu_user_cs_mask)))
-+#else
-+ if (likely(address > get_limit(regs->cs)))
-+#endif
-+ {
-+ set_pte(pte, pte_mkread(*pte));
-+ __flush_tlb_one(address);
-+ pte_unmap_unlock(pte, ptl);
-+ up_read(&mm->mmap_sem);
-+ return 1;
-+ }
-+
-+ pte_mask = _PAGE_ACCESSED | _PAGE_USER | ((error_code & PF_WRITE) << (_PAGE_BIT_DIRTY-1));
-+
-+ /*
-+ * PaX: fill DTLB with user rights and retry
-+ */
-+ __asm__ __volatile__ (
-+ "orb %2,(%1)\n"
-+#if defined(CONFIG_M586) || defined(CONFIG_M586TSC)
-+/*
-+ * PaX: let this uncommented 'invlpg' remind us on the behaviour of Intel's
-+ * (and AMD's) TLBs. namely, they do not cache PTEs that would raise *any*
-+ * page fault when examined during a TLB load attempt. this is true not only
-+ * for PTEs holding a non-present entry but also present entries that will
-+ * raise a page fault (such as those set up by PaX, or the copy-on-write
-+ * mechanism). in effect it means that we do *not* need to flush the TLBs
-+ * for our target pages since their PTEs are simply not in the TLBs at all.
-+
-+ * the best thing in omitting it is that we gain around 15-20% speed in the
-+ * fast path of the page fault handler and can get rid of tracing since we
-+ * can no longer flush unintended entries.
-+ */
-+ "invlpg (%0)\n"
-+#endif
-+ __copyuser_seg"testb $0,(%0)\n"
-+ "xorb %3,(%1)\n"
-+ :
-+ : "r" (address), "r" (pte), "q" (pte_mask), "i" (_PAGE_USER)
-+ : "memory", "cc");
-+ pte_unmap_unlock(pte, ptl);
-+ up_read(&mm->mmap_sem);
-+ return 1;
-+}
-+#endif
-+
- /*
- * Handle a spurious fault caused by a stale TLB entry.
- *
-@@ -921,6 +1139,9 @@ int show_unhandled_signals = 1;
- static inline int
- access_error(unsigned long error_code, int write, struct vm_area_struct *vma)
- {
-+ if (nx_enabled && (error_code & PF_INSTR) && !(vma->vm_flags & VM_EXEC))
-+ return 1;
-+
- if (write) {
- /* write, present and write, not present: */
- if (unlikely(!(vma->vm_flags & VM_WRITE)))
-@@ -954,16 +1175,30 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
- {
- struct vm_area_struct *vma;
- struct task_struct *tsk;
-- unsigned long address;
- struct mm_struct *mm;
- int write;
- int fault;
-
-- tsk = current;
-- mm = tsk->mm;
--
- /* Get the faulting address: */
-- address = read_cr2();
-+ unsigned long address = read_cr2();
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ if (!user_mode(regs) && address < 2 * PAX_USER_SHADOW_BASE) {
-+ if (!search_exception_tables(regs->ip)) {
-+ bad_area_nosemaphore(regs, error_code, address);
-+ return;
-+ }
-+ if (address < PAX_USER_SHADOW_BASE) {
-+ printk(KERN_ERR "PAX: please report this to pageexec@freemail.hu\n");
-+ printk(KERN_ERR "PAX: faulting IP: %pA\n", (void *)regs->ip);
-+ show_trace_log_lvl(NULL, NULL, (void *)regs->sp, regs->bp, KERN_ERR);
-+ } else
-+ address -= PAX_USER_SHADOW_BASE;
-+ }
-+#endif
-+
-+ tsk = current;
-+ mm = tsk->mm;
-
- /*
- * Detect and handle instructions that would cause a page fault for
-@@ -1024,7 +1259,7 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
- * User-mode registers count as a user access even for any
- * potential system fault or CPU buglet:
- */
-- if (user_mode_vm(regs)) {
-+ if (user_mode(regs)) {
- local_irq_enable();
- error_code |= PF_USER;
- } else {
-@@ -1078,6 +1313,11 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
- might_sleep();
- }
-
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
-+ if (pax_handle_pageexec_fault(regs, mm, address, error_code))
-+ return;
-+#endif
-+
- vma = find_vma(mm, address);
- if (unlikely(!vma)) {
- bad_area(regs, error_code, address);
-@@ -1089,18 +1329,24 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
- bad_area(regs, error_code, address);
- return;
- }
-- if (error_code & PF_USER) {
-- /*
-- * Accessing the stack below %sp is always a bug.
-- * The large cushion allows instructions like enter
-- * and pusha to work. ("enter $65535, $31" pushes
-- * 32 pointers and then decrements %sp by 65535.)
-- */
-- if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < regs->sp)) {
-- bad_area(regs, error_code, address);
-- return;
-- }
-+ /*
-+ * Accessing the stack below %sp is always a bug.
-+ * The large cushion allows instructions like enter
-+ * and pusha to work. ("enter $65535, $31" pushes
-+ * 32 pointers and then decrements %sp by 65535.)
-+ */
-+ if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < task_pt_regs(tsk)->sp)) {
-+ bad_area(regs, error_code, address);
-+ return;
- }
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (unlikely((mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end - SEGMEXEC_TASK_SIZE - 1 < address - SEGMEXEC_TASK_SIZE - 1)) {
-+ bad_area(regs, error_code, address);
-+ return;
-+ }
-+#endif
-+
- if (unlikely(expand_stack(vma, address))) {
- bad_area(regs, error_code, address);
- return;
-@@ -1144,3 +1390,292 @@ good_area:
-
- up_read(&mm->mmap_sem);
- }
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+static bool pax_is_fetch_fault(struct pt_regs *regs, unsigned long error_code, unsigned long address)
-+{
-+ struct mm_struct *mm = current->mm;
-+ unsigned long ip = regs->ip;
-+
-+ if (v8086_mode(regs))
-+ ip = ((regs->cs & 0xffff) << 4) + (ip & 0xffff);
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (mm->pax_flags & MF_PAX_PAGEEXEC) {
-+ if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR))
-+ return true;
-+ if (!(error_code & (PF_PROT | PF_WRITE)) && ip == address)
-+ return true;
-+ return false;
-+ }
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC) {
-+ if (!(error_code & (PF_PROT | PF_WRITE)) && (ip + SEGMEXEC_TASK_SIZE == address))
-+ return true;
-+ return false;
-+ }
-+#endif
-+
-+ return false;
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+static int pax_handle_fetch_fault_32(struct pt_regs *regs)
-+{
-+ int err;
-+
-+ do { /* PaX: libffi trampoline emulation */
-+ unsigned char mov, jmp;
-+ unsigned int addr1, addr2;
-+
-+#ifdef CONFIG_X86_64
-+ if ((regs->ip + 9) >> 32)
-+ break;
-+#endif
-+
-+ err = get_user(mov, (unsigned char __user *)regs->ip);
-+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
-+ err |= get_user(jmp, (unsigned char __user *)(regs->ip + 5));
-+ err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
-+
-+ if (err)
-+ break;
-+
-+ if (mov == 0xB8 && jmp == 0xE9) {
-+ regs->ax = addr1;
-+ regs->ip = (unsigned int)(regs->ip + addr2 + 10);
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: gcc trampoline emulation #1 */
-+ unsigned char mov1, mov2;
-+ unsigned short jmp;
-+ unsigned int addr1, addr2;
-+
-+#ifdef CONFIG_X86_64
-+ if ((regs->ip + 11) >> 32)
-+ break;
-+#endif
-+
-+ err = get_user(mov1, (unsigned char __user *)regs->ip);
-+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
-+ err |= get_user(mov2, (unsigned char __user *)(regs->ip + 5));
-+ err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
-+ err |= get_user(jmp, (unsigned short __user *)(regs->ip + 10));
-+
-+ if (err)
-+ break;
-+
-+ if (mov1 == 0xB9 && mov2 == 0xB8 && jmp == 0xE0FF) {
-+ regs->cx = addr1;
-+ regs->ax = addr2;
-+ regs->ip = addr2;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: gcc trampoline emulation #2 */
-+ unsigned char mov, jmp;
-+ unsigned int addr1, addr2;
-+
-+#ifdef CONFIG_X86_64
-+ if ((regs->ip + 9) >> 32)
-+ break;
-+#endif
-+
-+ err = get_user(mov, (unsigned char __user *)regs->ip);
-+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
-+ err |= get_user(jmp, (unsigned char __user *)(regs->ip + 5));
-+ err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
-+
-+ if (err)
-+ break;
-+
-+ if (mov == 0xB9 && jmp == 0xE9) {
-+ regs->cx = addr1;
-+ regs->ip = (unsigned int)(regs->ip + addr2 + 10);
-+ return 2;
-+ }
-+ } while (0);
-+
-+ return 1; /* PaX in action */
-+}
-+
-+#ifdef CONFIG_X86_64
-+static int pax_handle_fetch_fault_64(struct pt_regs *regs)
-+{
-+ int err;
-+
-+ do { /* PaX: libffi trampoline emulation */
-+ unsigned short mov1, mov2, jmp1;
-+ unsigned char stcclc, jmp2;
-+ unsigned long addr1, addr2;
-+
-+ err = get_user(mov1, (unsigned short __user *)regs->ip);
-+ err |= get_user(addr1, (unsigned long __user *)(regs->ip + 2));
-+ err |= get_user(mov2, (unsigned short __user *)(regs->ip + 10));
-+ err |= get_user(addr2, (unsigned long __user *)(regs->ip + 12));
-+ err |= get_user(stcclc, (unsigned char __user *)(regs->ip + 20));
-+ err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 21));
-+ err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 23));
-+
-+ if (err)
-+ break;
-+
-+ if (mov1 == 0xBB49 && mov2 == 0xBA49 && (stcclc == 0xF8 || stcclc == 0xF9) && jmp1 == 0xFF49 && jmp2 == 0xE3) {
-+ regs->r11 = addr1;
-+ regs->r10 = addr2;
-+ if (stcclc == 0xF8)
-+ regs->flags &= ~X86_EFLAGS_CF;
-+ else
-+ regs->flags |= X86_EFLAGS_CF;
-+ regs->ip = addr1;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: gcc trampoline emulation #1 */
-+ unsigned short mov1, mov2, jmp1;
-+ unsigned char jmp2;
-+ unsigned int addr1;
-+ unsigned long addr2;
-+
-+ err = get_user(mov1, (unsigned short __user *)regs->ip);
-+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 2));
-+ err |= get_user(mov2, (unsigned short __user *)(regs->ip + 6));
-+ err |= get_user(addr2, (unsigned long __user *)(regs->ip + 8));
-+ err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 16));
-+ err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 18));
-+
-+ if (err)
-+ break;
-+
-+ if (mov1 == 0xBB41 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
-+ regs->r11 = addr1;
-+ regs->r10 = addr2;
-+ regs->ip = addr1;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: gcc trampoline emulation #2 */
-+ unsigned short mov1, mov2, jmp1;
-+ unsigned char jmp2;
-+ unsigned long addr1, addr2;
-+
-+ err = get_user(mov1, (unsigned short __user *)regs->ip);
-+ err |= get_user(addr1, (unsigned long __user *)(regs->ip + 2));
-+ err |= get_user(mov2, (unsigned short __user *)(regs->ip + 10));
-+ err |= get_user(addr2, (unsigned long __user *)(regs->ip + 12));
-+ err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 20));
-+ err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 22));
-+
-+ if (err)
-+ break;
-+
-+ if (mov1 == 0xBB49 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
-+ regs->r11 = addr1;
-+ regs->r10 = addr2;
-+ regs->ip = addr1;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ return 1; /* PaX in action */
-+}
-+#endif
-+
-+/*
-+ * PaX: decide what to do with offenders (regs->ip = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ * 2 when gcc trampoline was detected
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+ if (v8086_mode(regs))
-+ return 1;
-+
-+ if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
-+ return 1;
-+
-+#ifdef CONFIG_X86_32
-+ return pax_handle_fetch_fault_32(regs);
-+#else
-+ if (regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))
-+ return pax_handle_fetch_fault_32(regs);
-+ else
-+ return pax_handle_fetch_fault_64(regs);
-+#endif
-+}
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
-+{
-+ long i;
-+
-+ printk(KERN_ERR "PAX: bytes at PC: ");
-+ for (i = 0; i < 20; i++) {
-+ unsigned char c;
-+ if (get_user(c, (unsigned char __force_user *)pc+i))
-+ printk(KERN_CONT "?? ");
-+ else
-+ printk(KERN_CONT "%02x ", c);
-+ }
-+ printk("\n");
-+
-+ printk(KERN_ERR "PAX: bytes at SP-%lu: ", (unsigned long)sizeof(long));
-+ for (i = -1; i < 80 / (long)sizeof(long); i++) {
-+ unsigned long c;
-+ if (get_user(c, (unsigned long __force_user *)sp+i)) {
-+#ifdef CONFIG_X86_32
-+ printk(KERN_CONT "???????? ");
-+#else
-+ if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)))
-+ printk(KERN_CONT "???????? ???????? ");
-+ else
-+ printk(KERN_CONT "???????????????? ");
-+#endif
-+ } else {
-+#ifdef CONFIG_X86_64
-+ if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))) {
-+ printk(KERN_CONT "%08x ", (unsigned int)c);
-+ printk(KERN_CONT "%08x ", (unsigned int)(c >> 32));
-+ } else
-+#endif
-+ printk(KERN_CONT "%0*lx ", 2 * (int)sizeof(long), c);
-+ }
-+ }
-+ printk("\n");
-+}
-+#endif
-+
-+/**
-+ * probe_kernel_write(): safely attempt to write to a location
-+ * @dst: address to write to
-+ * @src: pointer to the data that shall be written
-+ * @size: size of the data chunk
-+ *
-+ * Safely write to address @dst from the buffer at @src. If a kernel fault
-+ * happens, handle that and return -EFAULT.
-+ */
-+long notrace probe_kernel_write(void *dst, const void *src, size_t size)
-+{
-+ long ret;
-+ mm_segment_t old_fs = get_fs();
-+
-+ set_fs(KERNEL_DS);
-+ pagefault_disable();
-+ pax_open_kernel();
-+ ret = __copy_to_user_inatomic((void __force_user *)dst, src, size);
-+ pax_close_kernel();
-+ pagefault_enable();
-+ set_fs(old_fs);
-+
-+ return ret ? -EFAULT : 0;
-+}
-diff --git a/arch/x86/mm/gup.c b/arch/x86/mm/gup.c
-index 71da1bc..7a16bf4 100644
---- a/arch/x86/mm/gup.c
-+++ b/arch/x86/mm/gup.c
-@@ -237,7 +237,7 @@ int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
- addr = start;
- len = (unsigned long) nr_pages << PAGE_SHIFT;
- end = start + len;
-- if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
-+ if (unlikely(!__access_ok(write ? VERIFY_WRITE : VERIFY_READ,
- (void __user *)start, len)))
- return 0;
-
-diff --git a/arch/x86/mm/highmem_32.c b/arch/x86/mm/highmem_32.c
-index 63a6ba6..79abd7a 100644
---- a/arch/x86/mm/highmem_32.c
-+++ b/arch/x86/mm/highmem_32.c
-@@ -43,7 +43,10 @@ void *kmap_atomic_prot(struct page *page, enum km_type type, pgprot_t prot)
- idx = type + KM_TYPE_NR*smp_processor_id();
- vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
- BUG_ON(!pte_none(*(kmap_pte-idx)));
-+
-+ pax_open_kernel();
- set_pte(kmap_pte-idx, mk_pte(page, prot));
-+ pax_close_kernel();
-
- return (void *)vaddr;
- }
-diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c
-index f46c3407..c56a9d1 100644
---- a/arch/x86/mm/hugetlbpage.c
-+++ b/arch/x86/mm/hugetlbpage.c
-@@ -267,13 +267,21 @@ static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *file,
- struct hstate *h = hstate_file(file);
- struct mm_struct *mm = current->mm;
- struct vm_area_struct *vma;
-- unsigned long start_addr;
-+ unsigned long start_addr, pax_task_size = TASK_SIZE;
-+ unsigned long offset = gr_rand_threadstack_offset(mm, file, flags);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+ pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+ pax_task_size -= PAGE_SIZE;
-
- if (len > mm->cached_hole_size) {
-- start_addr = mm->free_area_cache;
-+ start_addr = mm->free_area_cache;
- } else {
-- start_addr = TASK_UNMAPPED_BASE;
-- mm->cached_hole_size = 0;
-+ start_addr = mm->mmap_base;
-+ mm->cached_hole_size = 0;
- }
-
- full_search:
-@@ -281,26 +289,27 @@ full_search:
-
- for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
- /* At this point: (!vma || addr < vma->vm_end). */
-- if (TASK_SIZE - len < addr) {
-+ if (pax_task_size - len < addr) {
- /*
- * Start a new search - just in case we missed
- * some holes.
- */
-- if (start_addr != TASK_UNMAPPED_BASE) {
-- start_addr = TASK_UNMAPPED_BASE;
-+ if (start_addr != mm->mmap_base) {
-+ start_addr = mm->mmap_base;
- mm->cached_hole_size = 0;
- goto full_search;
- }
- return -ENOMEM;
- }
-- if (!vma || addr + len <= vma->vm_start) {
-- mm->free_area_cache = addr + len;
-- return addr;
-- }
-+ if (check_heap_stack_gap(vma, addr, len, offset))
-+ break;
- if (addr + mm->cached_hole_size < vma->vm_start)
- mm->cached_hole_size = vma->vm_start - addr;
- addr = ALIGN(vma->vm_end, huge_page_size(h));
- }
-+
-+ mm->free_area_cache = addr + len;
-+ return addr;
- }
-
- static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
-@@ -309,10 +318,10 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
- {
- struct hstate *h = hstate_file(file);
- struct mm_struct *mm = current->mm;
-- struct vm_area_struct *vma, *prev_vma;
-- unsigned long base = mm->mmap_base, addr = addr0;
-+ struct vm_area_struct *vma;
-+ unsigned long base = mm->mmap_base, addr;
- unsigned long largest_hole = mm->cached_hole_size;
-- int first_time = 1;
-+ unsigned long offset = gr_rand_threadstack_offset(mm, file, flags);
-
- /* don't allow allocations above current base */
- if (mm->free_area_cache > base)
-@@ -322,64 +331,68 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
- largest_hole = 0;
- mm->free_area_cache = base;
- }
--try_again:
-+
- /* make sure it can fit in the remaining address space */
- if (mm->free_area_cache < len)
- goto fail;
-
- /* either no address requested or cant fit in requested address hole */
-- addr = (mm->free_area_cache - len) & huge_page_mask(h);
-+ addr = (mm->free_area_cache - len);
- do {
-+ addr &= huge_page_mask(h);
- /*
- * Lookup failure means no vma is above this address,
- * i.e. return with success:
- */
-- if (!(vma = find_vma_prev(mm, addr, &prev_vma)))
-+ vma = find_vma(mm, addr);
-+ if (!vma)
- return addr;
-
- /*
- * new region fits between prev_vma->vm_end and
- * vma->vm_start, use it:
- */
-- if (addr + len <= vma->vm_start &&
-- (!prev_vma || (addr >= prev_vma->vm_end))) {
-+ if (check_heap_stack_gap(vma, addr, len, offset)) {
- /* remember the address as a hint for next time */
-- mm->cached_hole_size = largest_hole;
-- return (mm->free_area_cache = addr);
-- } else {
-- /* pull free_area_cache down to the first hole */
-- if (mm->free_area_cache == vma->vm_end) {
-- mm->free_area_cache = vma->vm_start;
-- mm->cached_hole_size = largest_hole;
-- }
-+ mm->cached_hole_size = largest_hole;
-+ return (mm->free_area_cache = addr);
-+ }
-+ /* pull free_area_cache down to the first hole */
-+ if (mm->free_area_cache == vma->vm_end) {
-+ mm->free_area_cache = vma->vm_start;
-+ mm->cached_hole_size = largest_hole;
- }
-
- /* remember the largest hole we saw so far */
- if (addr + largest_hole < vma->vm_start)
-- largest_hole = vma->vm_start - addr;
-+ largest_hole = vma->vm_start - addr;
-
- /* try just below the current vma->vm_start */
-- addr = (vma->vm_start - len) & huge_page_mask(h);
-- } while (len <= vma->vm_start);
-+ addr = skip_heap_stack_gap(vma, len, offset);
-+ } while (!IS_ERR_VALUE(addr));
-
- fail:
- /*
-- * if hint left us with no space for the requested
-- * mapping then try again:
-- */
-- if (first_time) {
-- mm->free_area_cache = base;
-- largest_hole = 0;
-- first_time = 0;
-- goto try_again;
-- }
-- /*
- * A failed mmap() very likely causes application failure,
- * so fall back to the bottom-up function here. This scenario
- * can happen with large stack limits and large mmap()
- * allocations.
- */
-- mm->free_area_cache = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+ mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
-+ else
-+#endif
-+
-+ mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base += mm->delta_mmap;
-+#endif
-+
-+ mm->free_area_cache = mm->mmap_base;
- mm->cached_hole_size = ~0UL;
- addr = hugetlb_get_unmapped_area_bottomup(file, addr0,
- len, pgoff, flags);
-@@ -387,6 +400,7 @@ fail:
- /*
- * Restore the topdown base:
- */
-+ mm->mmap_base = base;
- mm->free_area_cache = base;
- mm->cached_hole_size = ~0UL;
-
-@@ -400,10 +414,20 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
- struct hstate *h = hstate_file(file);
- struct mm_struct *mm = current->mm;
- struct vm_area_struct *vma;
-+ unsigned long pax_task_size = TASK_SIZE;
-+ unsigned long offset = gr_rand_threadstack_offset(mm, file, flags);
-
- if (len & ~huge_page_mask(h))
- return -EINVAL;
-- if (len > TASK_SIZE)
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+ pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+ pax_task_size -= PAGE_SIZE;
-+
-+ if (len > pax_task_size)
- return -ENOMEM;
-
- if (flags & MAP_FIXED) {
-@@ -415,8 +439,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
- if (addr) {
- addr = ALIGN(addr, huge_page_size(h));
- vma = find_vma(mm, addr);
-- if (TASK_SIZE - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-+ if (pax_task_size - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
- return addr;
- }
- if (mm->get_unmapped_area == arch_get_unmapped_area)
-diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
-index 73ffd55..e88dff5 100644
---- a/arch/x86/mm/init.c
-+++ b/arch/x86/mm/init.c
-@@ -1,6 +1,7 @@
- #include <linux/initrd.h>
- #include <linux/ioport.h>
- #include <linux/swap.h>
-+#include <linux/tboot.h>
-
- #include <asm/cacheflush.h>
- #include <asm/e820.h>
-@@ -13,6 +14,7 @@
- #include <asm/tlbflush.h>
- #include <asm/tlb.h>
- #include <asm/proto.h>
-+#include <asm/bios_ebda.h>
-
- DEFINE_PER_CPU(struct mmu_gather, mmu_gathers);
-
-@@ -69,11 +71,7 @@ static void __init find_early_table_space(unsigned long end, int use_pse,
- * cause a hotspot and fill up ZONE_DMA. The page tables
- * need roughly 0.5KB per GB.
- */
--#ifdef CONFIG_X86_32
-- start = 0x7000;
--#else
-- start = 0x8000;
--#endif
-+ start = 0x100000;
- e820_table_start = find_e820_area(start, max_pfn_mapped<<PAGE_SHIFT,
- tables, PAGE_SIZE);
- if (e820_table_start == -1UL)
-@@ -147,7 +145,7 @@ unsigned long __init_refok init_memory_mapping(unsigned long start,
- #endif
-
- set_nx();
-- if (nx_enabled)
-+ if (nx_enabled && cpu_has_nx)
- printk(KERN_INFO "NX (Execute Disable) protection: active\n");
-
- /* Enable PSE if available */
-@@ -329,10 +327,35 @@ unsigned long __init_refok init_memory_mapping(unsigned long start,
- * Access has to be given to non-kernel-ram areas as well, these contain the PCI
- * mmio resources as well as potential bios/acpi data regions.
- */
-+
-+#ifdef CONFIG_GRKERNSEC_KMEM
-+static unsigned int ebda_start __read_only;
-+static unsigned int ebda_end __read_only;
-+#endif
-+
- int devmem_is_allowed(unsigned long pagenr)
- {
-+#ifdef CONFIG_GRKERNSEC_KMEM
-+ /* allow BDA */
-+ if (!pagenr)
-+ return 1;
-+ /* allow EBDA */
-+ if (pagenr >= ebda_start && pagenr < ebda_end)
-+ return 1;
-+ /* if tboot is in use, allow access to its hardcoded serial log range */
-+ if (tboot_enabled() && ((0x60000 >> PAGE_SHIFT) <= pagenr) && (pagenr < (0x68000 >> PAGE_SHIFT)))
-+ return 1;
-+ /* allow ISA/video mem */
-+ if ((ISA_START_ADDRESS >> PAGE_SHIFT) <= pagenr && pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
-+ return 1;
-+ /* throw out everything else below 1MB */
- if (pagenr <= 256)
-+ return 0;
-+#else
-+ if (pagenr < 256)
- return 1;
-+#endif
-+
- if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
- return 0;
- if (!page_is_ram(pagenr))
-@@ -377,8 +400,117 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end)
- #endif
- }
-
-+#ifdef CONFIG_GRKERNSEC_KMEM
-+static inline void gr_init_ebda(void)
-+{
-+ unsigned int ebda_addr;
-+ unsigned int ebda_size = 0;
-+
-+ ebda_addr = get_bios_ebda();
-+ if (ebda_addr) {
-+ ebda_size = *(unsigned char *)phys_to_virt(ebda_addr);
-+ ebda_size <<= 10;
-+ }
-+ if (ebda_addr && ebda_size) {
-+ ebda_start = ebda_addr >> PAGE_SHIFT;
-+ ebda_end = min((unsigned int)PAGE_ALIGN(ebda_addr + ebda_size), (unsigned int)0xa0000) >> PAGE_SHIFT;
-+ } else {
-+ ebda_start = 0x9f000 >> PAGE_SHIFT;
-+ ebda_end = 0xa0000 >> PAGE_SHIFT;
-+ }
-+}
-+#else
-+static inline void gr_init_ebda(void) { }
-+#endif
-+
- void free_initmem(void)
- {
-+#ifdef CONFIG_PAX_KERNEXEC
-+#ifdef CONFIG_X86_32
-+ /* PaX: limit KERNEL_CS to actual size */
-+ unsigned long addr, limit;
-+ struct desc_struct d;
-+ int cpu;
-+#else
-+ pgd_t *pgd;
-+ pud_t *pud;
-+ pmd_t *pmd;
-+ unsigned long addr, end;
-+#endif
-+#endif
-+
-+ gr_init_ebda();
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+#ifdef CONFIG_X86_32
-+ limit = paravirt_enabled() ? ktva_ktla(0xffffffff) : (unsigned long)&_etext;
-+ limit = (limit - 1UL) >> PAGE_SHIFT;
-+
-+ memset(__LOAD_PHYSICAL_ADDR + PAGE_OFFSET, POISON_FREE_INITMEM, PAGE_SIZE);
-+ for (cpu = 0; cpu < nr_cpu_ids; cpu++) {
-+ pack_descriptor(&d, get_desc_base(&get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_CS]), limit, 0x9B, 0xC);
-+ write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_KERNEL_CS, &d, DESCTYPE_S);
-+ write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_KERNEXEC_KERNEL_CS, &d, DESCTYPE_S);
-+ }
-+
-+ /* PaX: make KERNEL_CS read-only */
-+ addr = PFN_ALIGN(ktla_ktva((unsigned long)&_text));
-+ if (!paravirt_enabled())
-+ set_memory_ro(addr, (PFN_ALIGN(_sdata) - addr) >> PAGE_SHIFT);
-+/*
-+ for (addr = ktla_ktva((unsigned long)&_text); addr < (unsigned long)&_sdata; addr += PMD_SIZE) {
-+ pgd = pgd_offset_k(addr);
-+ pud = pud_offset(pgd, addr);
-+ pmd = pmd_offset(pud, addr);
-+ set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
-+ }
-+*/
-+#ifdef CONFIG_X86_PAE
-+ set_memory_nx(PFN_ALIGN(__init_begin), (PFN_ALIGN(__init_end) - PFN_ALIGN(__init_begin)) >> PAGE_SHIFT);
-+/*
-+ for (addr = (unsigned long)&__init_begin; addr < (unsigned long)&__init_end; addr += PMD_SIZE) {
-+ pgd = pgd_offset_k(addr);
-+ pud = pud_offset(pgd, addr);
-+ pmd = pmd_offset(pud, addr);
-+ set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
-+ }
-+*/
-+#endif
-+
-+#ifdef CONFIG_MODULES
-+ set_memory_4k((unsigned long)MODULES_EXEC_VADDR, (MODULES_EXEC_END - MODULES_EXEC_VADDR) >> PAGE_SHIFT);
-+#endif
-+
-+#else
-+ /* PaX: make kernel code/rodata read-only, rest non-executable */
-+ for (addr = __START_KERNEL_map; addr < __START_KERNEL_map + KERNEL_IMAGE_SIZE; addr += PMD_SIZE) {
-+ pgd = pgd_offset_k(addr);
-+ pud = pud_offset(pgd, addr);
-+ pmd = pmd_offset(pud, addr);
-+ if (!pmd_present(*pmd))
-+ continue;
-+ if ((unsigned long)_text <= addr && addr < (unsigned long)_sdata)
-+ set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
-+ else
-+ set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
-+ }
-+
-+ addr = (unsigned long)__va(__pa(__START_KERNEL_map));
-+ end = addr + KERNEL_IMAGE_SIZE;
-+ for (; addr < end; addr += PMD_SIZE) {
-+ pgd = pgd_offset_k(addr);
-+ pud = pud_offset(pgd, addr);
-+ pmd = pmd_offset(pud, addr);
-+ if (!pmd_present(*pmd))
-+ continue;
-+ if ((unsigned long)__va(__pa(_text)) <= addr && addr < (unsigned long)__va(__pa(_sdata)))
-+ set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
-+ }
-+#endif
-+
-+ flush_tlb_all();
-+#endif
-+
- free_init_pages("unused kernel memory",
- (unsigned long)(&__init_begin),
- (unsigned long)(&__init_end));
-diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c
-index 30938c1..bda3d5d 100644
---- a/arch/x86/mm/init_32.c
-+++ b/arch/x86/mm/init_32.c
-@@ -72,36 +72,6 @@ static __init void *alloc_low_page(void)
- }
-
- /*
-- * Creates a middle page table and puts a pointer to it in the
-- * given global directory entry. This only returns the gd entry
-- * in non-PAE compilation mode, since the middle layer is folded.
-- */
--static pmd_t * __init one_md_table_init(pgd_t *pgd)
--{
-- pud_t *pud;
-- pmd_t *pmd_table;
--
--#ifdef CONFIG_X86_PAE
-- if (!(pgd_val(*pgd) & _PAGE_PRESENT)) {
-- if (after_bootmem)
-- pmd_table = (pmd_t *)alloc_bootmem_pages(PAGE_SIZE);
-- else
-- pmd_table = (pmd_t *)alloc_low_page();
-- paravirt_alloc_pmd(&init_mm, __pa(pmd_table) >> PAGE_SHIFT);
-- set_pgd(pgd, __pgd(__pa(pmd_table) | _PAGE_PRESENT));
-- pud = pud_offset(pgd, 0);
-- BUG_ON(pmd_table != pmd_offset(pud, 0));
--
-- return pmd_table;
-- }
--#endif
-- pud = pud_offset(pgd, 0);
-- pmd_table = pmd_offset(pud, 0);
--
-- return pmd_table;
--}
--
--/*
- * Create a page table and place a pointer to it in a middle page
- * directory entry:
- */
-@@ -121,13 +91,28 @@ static pte_t * __init one_page_table_init(pmd_t *pmd)
- page_table = (pte_t *)alloc_low_page();
-
- paravirt_alloc_pte(&init_mm, __pa(page_table) >> PAGE_SHIFT);
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+ set_pmd(pmd, __pmd(__pa(page_table) | _KERNPG_TABLE));
-+#else
- set_pmd(pmd, __pmd(__pa(page_table) | _PAGE_TABLE));
-+#endif
- BUG_ON(page_table != pte_offset_kernel(pmd, 0));
- }
-
- return pte_offset_kernel(pmd, 0);
- }
-
-+static pmd_t * __init one_md_table_init(pgd_t *pgd)
-+{
-+ pud_t *pud;
-+ pmd_t *pmd_table;
-+
-+ pud = pud_offset(pgd, 0);
-+ pmd_table = pmd_offset(pud, 0);
-+
-+ return pmd_table;
-+}
-+
- pmd_t * __init populate_extra_pmd(unsigned long vaddr)
- {
- int pgd_idx = pgd_index(vaddr);
-@@ -201,6 +186,7 @@ page_table_range_init(unsigned long start, unsigned long end, pgd_t *pgd_base)
- int pgd_idx, pmd_idx;
- unsigned long vaddr;
- pgd_t *pgd;
-+ pud_t *pud;
- pmd_t *pmd;
- pte_t *pte = NULL;
-
-@@ -210,8 +196,13 @@ page_table_range_init(unsigned long start, unsigned long end, pgd_t *pgd_base)
- pgd = pgd_base + pgd_idx;
-
- for ( ; (pgd_idx < PTRS_PER_PGD) && (vaddr != end); pgd++, pgd_idx++) {
-- pmd = one_md_table_init(pgd);
-- pmd = pmd + pmd_index(vaddr);
-+ pud = pud_offset(pgd, vaddr);
-+ pmd = pmd_offset(pud, vaddr);
-+
-+#ifdef CONFIG_X86_PAE
-+ paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
-+#endif
-+
- for (; (pmd_idx < PTRS_PER_PMD) && (vaddr != end);
- pmd++, pmd_idx++) {
- pte = page_table_kmap_check(one_page_table_init(pmd),
-@@ -223,11 +214,20 @@ page_table_range_init(unsigned long start, unsigned long end, pgd_t *pgd_base)
- }
- }
-
--static inline int is_kernel_text(unsigned long addr)
-+static inline int is_kernel_text(unsigned long start, unsigned long end)
- {
-- if (addr >= PAGE_OFFSET && addr <= (unsigned long)__init_end)
-- return 1;
-- return 0;
-+ if ((start > ktla_ktva((unsigned long)_etext) ||
-+ end <= ktla_ktva((unsigned long)_stext)) &&
-+ (start > ktla_ktva((unsigned long)_einittext) ||
-+ end <= ktla_ktva((unsigned long)_sinittext)) &&
-+
-+#ifdef CONFIG_ACPI_SLEEP
-+ (start > (unsigned long)__va(acpi_wakeup_address) + 0x4000 || end <= (unsigned long)__va(acpi_wakeup_address)) &&
-+#endif
-+
-+ (start > (unsigned long)__va(0xfffff) || end <= (unsigned long)__va(0xc0000)))
-+ return 0;
-+ return 1;
- }
-
- /*
-@@ -243,9 +243,10 @@ kernel_physical_mapping_init(unsigned long start,
- int use_pse = page_size_mask == (1<<PG_LEVEL_2M);
- unsigned long start_pfn, end_pfn;
- pgd_t *pgd_base = swapper_pg_dir;
-- int pgd_idx, pmd_idx, pte_ofs;
-+ unsigned int pgd_idx, pmd_idx, pte_ofs;
- unsigned long pfn;
- pgd_t *pgd;
-+ pud_t *pud;
- pmd_t *pmd;
- pte_t *pte;
- unsigned pages_2m, pages_4k;
-@@ -278,8 +279,13 @@ repeat:
- pfn = start_pfn;
- pgd_idx = pgd_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
- pgd = pgd_base + pgd_idx;
-- for (; pgd_idx < PTRS_PER_PGD; pgd++, pgd_idx++) {
-- pmd = one_md_table_init(pgd);
-+ for (; pgd_idx < PTRS_PER_PGD && pfn < max_low_pfn; pgd++, pgd_idx++) {
-+ pud = pud_offset(pgd, 0);
-+ pmd = pmd_offset(pud, 0);
-+
-+#ifdef CONFIG_X86_PAE
-+ paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
-+#endif
-
- if (pfn >= end_pfn)
- continue;
-@@ -291,14 +297,13 @@ repeat:
- #endif
- for (; pmd_idx < PTRS_PER_PMD && pfn < end_pfn;
- pmd++, pmd_idx++) {
-- unsigned int addr = pfn * PAGE_SIZE + PAGE_OFFSET;
-+ unsigned long address = pfn * PAGE_SIZE + PAGE_OFFSET;
-
- /*
- * Map with big pages if possible, otherwise
- * create normal page tables:
- */
- if (use_pse) {
-- unsigned int addr2;
- pgprot_t prot = PAGE_KERNEL_LARGE;
- /*
- * first pass will use the same initial
-@@ -308,11 +313,7 @@ repeat:
- __pgprot(PTE_IDENT_ATTR |
- _PAGE_PSE);
-
-- addr2 = (pfn + PTRS_PER_PTE-1) * PAGE_SIZE +
-- PAGE_OFFSET + PAGE_SIZE-1;
--
-- if (is_kernel_text(addr) ||
-- is_kernel_text(addr2))
-+ if (is_kernel_text(address, address + PMD_SIZE))
- prot = PAGE_KERNEL_LARGE_EXEC;
-
- pages_2m++;
-@@ -329,7 +330,7 @@ repeat:
- pte_ofs = pte_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
- pte += pte_ofs;
- for (; pte_ofs < PTRS_PER_PTE && pfn < end_pfn;
-- pte++, pfn++, pte_ofs++, addr += PAGE_SIZE) {
-+ pte++, pfn++, pte_ofs++, address += PAGE_SIZE) {
- pgprot_t prot = PAGE_KERNEL;
- /*
- * first pass will use the same initial
-@@ -337,7 +338,7 @@ repeat:
- */
- pgprot_t init_prot = __pgprot(PTE_IDENT_ATTR);
-
-- if (is_kernel_text(addr))
-+ if (is_kernel_text(address, address + PAGE_SIZE))
- prot = PAGE_KERNEL_EXEC;
-
- pages_4k++;
-@@ -489,7 +490,7 @@ void __init native_pagetable_setup_start(pgd_t *base)
-
- pud = pud_offset(pgd, va);
- pmd = pmd_offset(pud, va);
-- if (!pmd_present(*pmd))
-+ if (!pmd_present(*pmd) || pmd_huge(*pmd))
- break;
-
- pte = pte_offset_kernel(pmd, va);
-@@ -541,9 +542,7 @@ void __init early_ioremap_page_table_range_init(void)
-
- static void __init pagetable_init(void)
- {
-- pgd_t *pgd_base = swapper_pg_dir;
--
-- permanent_kmaps_init(pgd_base);
-+ permanent_kmaps_init(swapper_pg_dir);
- }
-
- #ifdef CONFIG_ACPI_SLEEP
-@@ -551,12 +550,12 @@ static void __init pagetable_init(void)
- * ACPI suspend needs this for resume, because things like the intel-agp
- * driver might have split up a kernel 4MB mapping.
- */
--char swsusp_pg_dir[PAGE_SIZE]
-+pgd_t swsusp_pg_dir[PTRS_PER_PGD]
- __attribute__ ((aligned(PAGE_SIZE)));
-
- static inline void save_pg_dir(void)
- {
-- memcpy(swsusp_pg_dir, swapper_pg_dir, PAGE_SIZE);
-+ clone_pgd_range(swsusp_pg_dir, swapper_pg_dir, PTRS_PER_PGD);
- }
- #else /* !CONFIG_ACPI_SLEEP */
- static inline void save_pg_dir(void)
-@@ -588,7 +587,7 @@ void zap_low_mappings(bool early)
- flush_tlb_all();
- }
-
--pteval_t __supported_pte_mask __read_mostly = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
-+pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
- EXPORT_SYMBOL_GPL(__supported_pte_mask);
-
- /* user-defined highmem size */
-@@ -777,7 +776,7 @@ void __init setup_bootmem_allocator(void)
- * Initialize the boot-time allocator (with low memory only):
- */
- bootmap_size = bootmem_bootmap_pages(max_low_pfn)<<PAGE_SHIFT;
-- bootmap = find_e820_area(0, max_pfn_mapped<<PAGE_SHIFT, bootmap_size,
-+ bootmap = find_e820_area(0x100000, max_pfn_mapped<<PAGE_SHIFT, bootmap_size,
- PAGE_SIZE);
- if (bootmap == -1L)
- panic("Cannot find bootmem map of size %ld\n", bootmap_size);
-@@ -864,6 +863,12 @@ void __init mem_init(void)
-
- pci_iommu_alloc();
-
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
-+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-+ KERNEL_PGD_PTRS);
-+#endif
-+
- #ifdef CONFIG_FLATMEM
- BUG_ON(!mem_map);
- #endif
-@@ -881,7 +886,7 @@ void __init mem_init(void)
- set_highmem_pages_init();
-
- codesize = (unsigned long) &_etext - (unsigned long) &_text;
-- datasize = (unsigned long) &_edata - (unsigned long) &_etext;
-+ datasize = (unsigned long) &_edata - (unsigned long) &_sdata;
- initsize = (unsigned long) &__init_end - (unsigned long) &__init_begin;
-
- printk(KERN_INFO "Memory: %luk/%luk available (%dk kernel code, "
-@@ -923,10 +928,10 @@ void __init mem_init(void)
- ((unsigned long)&__init_end -
- (unsigned long)&__init_begin) >> 10,
-
-- (unsigned long)&_etext, (unsigned long)&_edata,
-- ((unsigned long)&_edata - (unsigned long)&_etext) >> 10,
-+ (unsigned long)&_sdata, (unsigned long)&_edata,
-+ ((unsigned long)&_edata - (unsigned long)&_sdata) >> 10,
-
-- (unsigned long)&_text, (unsigned long)&_etext,
-+ ktla_ktva((unsigned long)&_text), ktla_ktva((unsigned long)&_etext),
- ((unsigned long)&_etext - (unsigned long)&_text) >> 10);
-
- /*
-@@ -1007,6 +1012,7 @@ void set_kernel_text_rw(void)
- if (!kernel_set_to_readonly)
- return;
-
-+ start = ktla_ktva(start);
- pr_debug("Set kernel text: %lx - %lx for read write\n",
- start, start+size);
-
-@@ -1021,6 +1027,7 @@ void set_kernel_text_ro(void)
- if (!kernel_set_to_readonly)
- return;
-
-+ start = ktla_ktva(start);
- pr_debug("Set kernel text: %lx - %lx for read only\n",
- start, start+size);
-
-@@ -1032,6 +1039,7 @@ void mark_rodata_ro(void)
- unsigned long start = PFN_ALIGN(_text);
- unsigned long size = PFN_ALIGN(_etext) - start;
-
-+ start = ktla_ktva(start);
- set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT);
- printk(KERN_INFO "Write protecting the kernel text: %luk\n",
- size >> 10);
-diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
-index 7d095ad..f833fa2 100644
---- a/arch/x86/mm/init_64.c
-+++ b/arch/x86/mm/init_64.c
-@@ -123,7 +123,7 @@ static pud_t *fill_pud(pgd_t *pgd, unsigned long vaddr)
- {
- if (pgd_none(*pgd)) {
- pud_t *pud = (pud_t *)spp_getpage();
-- pgd_populate(&init_mm, pgd, pud);
-+ pgd_populate_kernel(&init_mm, pgd, pud);
- if (pud != pud_offset(pgd, 0))
- printk(KERN_ERR "PAGETABLE BUG #00! %p <-> %p\n",
- pud, pud_offset(pgd, 0));
-@@ -135,7 +135,7 @@ static pmd_t *fill_pmd(pud_t *pud, unsigned long vaddr)
- {
- if (pud_none(*pud)) {
- pmd_t *pmd = (pmd_t *) spp_getpage();
-- pud_populate(&init_mm, pud, pmd);
-+ pud_populate_kernel(&init_mm, pud, pmd);
- if (pmd != pmd_offset(pud, 0))
- printk(KERN_ERR "PAGETABLE BUG #01! %p <-> %p\n",
- pmd, pmd_offset(pud, 0));
-@@ -164,7 +164,9 @@ void set_pte_vaddr_pud(pud_t *pud_page, unsigned long vaddr, pte_t new_pte)
- pmd = fill_pmd(pud, vaddr);
- pte = fill_pte(pmd, vaddr);
-
-+ pax_open_kernel();
- set_pte(pte, new_pte);
-+ pax_close_kernel();
-
- /*
- * It's enough to flush this one mapping.
-@@ -223,14 +225,12 @@ static void __init __init_extra_mapping(unsigned long phys, unsigned long size,
- pgd = pgd_offset_k((unsigned long)__va(phys));
- if (pgd_none(*pgd)) {
- pud = (pud_t *) spp_getpage();
-- set_pgd(pgd, __pgd(__pa(pud) | _KERNPG_TABLE |
-- _PAGE_USER));
-+ set_pgd(pgd, __pgd(__pa(pud) | _PAGE_TABLE));
- }
- pud = pud_offset(pgd, (unsigned long)__va(phys));
- if (pud_none(*pud)) {
- pmd = (pmd_t *) spp_getpage();
-- set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE |
-- _PAGE_USER));
-+ set_pud(pud, __pud(__pa(pmd) | _PAGE_TABLE));
- }
- pmd = pmd_offset(pud, phys);
- BUG_ON(!pmd_none(*pmd));
-@@ -507,7 +507,7 @@ phys_pud_init(pud_t *pud_page, unsigned long addr, unsigned long end,
- unmap_low_page(pmd);
-
- spin_lock(&init_mm.page_table_lock);
-- pud_populate(&init_mm, pud, __va(pmd_phys));
-+ pud_populate_kernel(&init_mm, pud, __va(pmd_phys));
- spin_unlock(&init_mm.page_table_lock);
- }
- __flush_tlb_all();
-@@ -560,7 +560,7 @@ kernel_physical_mapping_init(unsigned long start,
- unmap_low_page(pud);
-
- spin_lock(&init_mm.page_table_lock);
-- pgd_populate(&init_mm, pgd, __va(pud_phys));
-+ pgd_populate_kernel(&init_mm, pgd, __va(pud_phys));
- spin_unlock(&init_mm.page_table_lock);
- }
- __flush_tlb_all();
-@@ -675,6 +675,12 @@ void __init mem_init(void)
-
- pci_iommu_alloc();
-
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
-+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-+ KERNEL_PGD_PTRS);
-+#endif
-+
- /* clear_bss() already clear the empty_zero_page */
-
- reservedpages = 0;
-@@ -861,8 +867,8 @@ int kern_addr_valid(unsigned long addr)
- static struct vm_area_struct gate_vma = {
- .vm_start = VSYSCALL_START,
- .vm_end = VSYSCALL_START + (VSYSCALL_MAPPED_PAGES * PAGE_SIZE),
-- .vm_page_prot = PAGE_READONLY_EXEC,
-- .vm_flags = VM_READ | VM_EXEC
-+ .vm_page_prot = PAGE_READONLY,
-+ .vm_flags = VM_READ
- };
-
- struct vm_area_struct *get_gate_vma(struct task_struct *tsk)
-@@ -896,7 +902,7 @@ int in_gate_area_no_task(unsigned long addr)
-
- const char *arch_vma_name(struct vm_area_struct *vma)
- {
-- if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
-+ if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
- return "[vdso]";
- if (vma == &gate_vma)
- return "[vsyscall]";
-diff --git a/arch/x86/mm/iomap_32.c b/arch/x86/mm/iomap_32.c
-index 84e236c..69bd3f6 100644
---- a/arch/x86/mm/iomap_32.c
-+++ b/arch/x86/mm/iomap_32.c
-@@ -65,7 +65,11 @@ void *kmap_atomic_prot_pfn(unsigned long pfn, enum km_type type, pgprot_t prot)
- debug_kmap_atomic(type);
- idx = type + KM_TYPE_NR * smp_processor_id();
- vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
-+
-+ pax_open_kernel();
- set_pte(kmap_pte - idx, pfn_pte(pfn, prot));
-+ pax_close_kernel();
-+
- arch_flush_lazy_mmu_mode();
-
- return (void *)vaddr;
-diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
-index 2feb9bd..4d4be88 100644
---- a/arch/x86/mm/ioremap.c
-+++ b/arch/x86/mm/ioremap.c
-@@ -41,8 +41,8 @@ int page_is_ram(unsigned long pagenr)
- * Second special case: Some BIOSen report the PC BIOS
- * area (640->1Mb) as ram even though it is not.
- */
-- if (pagenr >= (BIOS_BEGIN >> PAGE_SHIFT) &&
-- pagenr < (BIOS_END >> PAGE_SHIFT))
-+ if (pagenr >= (ISA_START_ADDRESS >> PAGE_SHIFT) &&
-+ pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
- return 0;
-
- for (i = 0; i < e820.nr_map; i++) {
-@@ -137,13 +137,10 @@ static void __iomem *__ioremap_caller(resource_size_t phys_addr,
- /*
- * Don't allow anybody to remap normal RAM that we're using..
- */
-- for (pfn = phys_addr >> PAGE_SHIFT;
-- (pfn << PAGE_SHIFT) < (last_addr & PAGE_MASK);
-- pfn++) {
--
-+ for (pfn = phys_addr >> PAGE_SHIFT; ((resource_size_t)pfn << PAGE_SHIFT) < (last_addr & PAGE_MASK); pfn++) {
- int is_ram = page_is_ram(pfn);
-
-- if (is_ram && pfn_valid(pfn) && !PageReserved(pfn_to_page(pfn)))
-+ if (is_ram && pfn_valid(pfn) && (pfn >= 0x100 || !PageReserved(pfn_to_page(pfn))))
- return NULL;
- WARN_ON_ONCE(is_ram);
- }
-@@ -319,7 +316,7 @@ EXPORT_SYMBOL(ioremap_prot);
- *
- * Caller must ensure there is only one unmapping for the same pointer.
- */
--void iounmap(volatile void __iomem *addr)
-+void iounmap(const volatile void __iomem *addr)
- {
- struct vm_struct *p, *o;
-
-@@ -378,6 +375,9 @@ void *xlate_dev_mem_ptr(unsigned long phys)
-
- /* If page is RAM, we can use __va. Otherwise ioremap and unmap. */
- if (page_is_ram(start >> PAGE_SHIFT))
-+#ifdef CONFIG_HIGHMEM
-+ if ((start >> PAGE_SHIFT) < max_low_pfn)
-+#endif
- return __va(phys);
-
- addr = (void __force *)ioremap_default(start, PAGE_SIZE);
-@@ -407,7 +407,7 @@ static int __init early_ioremap_debug_setup(char *str)
- early_param("early_ioremap_debug", early_ioremap_debug_setup);
-
- static __initdata int after_paging_init;
--static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __page_aligned_bss;
-+static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __read_only __aligned(PAGE_SIZE);
-
- static inline pmd_t * __init early_ioremap_pmd(unsigned long addr)
- {
-@@ -439,8 +439,7 @@ void __init early_ioremap_init(void)
- slot_virt[i] = __fix_to_virt(FIX_BTMAP_BEGIN - NR_FIX_BTMAPS*i);
-
- pmd = early_ioremap_pmd(fix_to_virt(FIX_BTMAP_BEGIN));
-- memset(bm_pte, 0, sizeof(bm_pte));
-- pmd_populate_kernel(&init_mm, pmd, bm_pte);
-+ pmd_populate_user(&init_mm, pmd, bm_pte);
-
- /*
- * The boot-ioremap range spans multiple pmds, for which
-diff --git a/arch/x86/mm/kmemcheck/kmemcheck.c b/arch/x86/mm/kmemcheck/kmemcheck.c
-index 8cc1833..1abbc5b 100644
---- a/arch/x86/mm/kmemcheck/kmemcheck.c
-+++ b/arch/x86/mm/kmemcheck/kmemcheck.c
-@@ -622,9 +622,9 @@ bool kmemcheck_fault(struct pt_regs *regs, unsigned long address,
- * memory (e.g. tracked pages)? For now, we need this to avoid
- * invoking kmemcheck for PnP BIOS calls.
- */
-- if (regs->flags & X86_VM_MASK)
-+ if (v8086_mode(regs))
- return false;
-- if (regs->cs != __KERNEL_CS)
-+ if (regs->cs != __KERNEL_CS && regs->cs != __KERNEXEC_KERNEL_CS)
- return false;
-
- pte = kmemcheck_pte_lookup(address);
-diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
-index c9e57af..07a321b 100644
---- a/arch/x86/mm/mmap.c
-+++ b/arch/x86/mm/mmap.c
-@@ -49,7 +49,7 @@ static unsigned int stack_maxrandom_size(void)
- * Leave an at least ~128 MB hole with possible stack randomization.
- */
- #define MIN_GAP (128*1024*1024UL + stack_maxrandom_size())
--#define MAX_GAP (TASK_SIZE/6*5)
-+#define MAX_GAP (pax_task_size/6*5)
-
- /*
- * True on X86_32 or when emulating IA32 on X86_64
-@@ -94,27 +94,40 @@ static unsigned long mmap_rnd(void)
- return rnd << PAGE_SHIFT;
- }
-
--static unsigned long mmap_base(void)
-+static unsigned long mmap_base(struct mm_struct *mm)
- {
- unsigned long gap = current->signal->rlim[RLIMIT_STACK].rlim_cur;
-+ unsigned long pax_task_size = TASK_SIZE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+ pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-
- if (gap < MIN_GAP)
- gap = MIN_GAP;
- else if (gap > MAX_GAP)
- gap = MAX_GAP;
-
-- return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
-+ return PAGE_ALIGN(pax_task_size - gap - mmap_rnd());
- }
-
- /*
- * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
- * does, but not when emulating X86_32
- */
--static unsigned long mmap_legacy_base(void)
-+static unsigned long mmap_legacy_base(struct mm_struct *mm)
- {
-- if (mmap_is_ia32())
-+ if (mmap_is_ia32()) {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+ return SEGMEXEC_TASK_UNMAPPED_BASE;
-+ else
-+#endif
-+
- return TASK_UNMAPPED_BASE;
-- else
-+ } else
- return TASK_UNMAPPED_BASE + mmap_rnd();
- }
-
-@@ -125,11 +138,23 @@ static unsigned long mmap_legacy_base(void)
- void arch_pick_mmap_layout(struct mm_struct *mm)
- {
- if (mmap_is_legacy()) {
-- mm->mmap_base = mmap_legacy_base();
-+ mm->mmap_base = mmap_legacy_base(mm);
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- mm->get_unmapped_area = arch_get_unmapped_area;
- mm->unmap_area = arch_unmap_area;
- } else {
-- mm->mmap_base = mmap_base();
-+ mm->mmap_base = mmap_base(mm);
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
-+#endif
-+
- mm->get_unmapped_area = arch_get_unmapped_area_topdown;
- mm->unmap_area = arch_unmap_area_topdown;
- }
-diff --git a/arch/x86/mm/mmio-mod.c b/arch/x86/mm/mmio-mod.c
-index 132772a..3c81fd2 100644
---- a/arch/x86/mm/mmio-mod.c
-+++ b/arch/x86/mm/mmio-mod.c
-@@ -193,7 +193,7 @@ static void pre(struct kmmio_probe *p, struct pt_regs *regs,
- break;
- default:
- {
-- unsigned char *ip = (unsigned char *)instptr;
-+ unsigned char *ip = (unsigned char *)ktla_ktva(instptr);
- my_trace->opcode = MMIO_UNKNOWN_OP;
- my_trace->width = 0;
- my_trace->value = (*ip) << 16 | *(ip + 1) << 8 |
-@@ -233,7 +233,7 @@ static void post(struct kmmio_probe *p, unsigned long condition,
- static void ioremap_trace_core(resource_size_t offset, unsigned long size,
- void __iomem *addr)
- {
-- static atomic_t next_id;
-+ static atomic_unchecked_t next_id;
- struct remap_trace *trace = kmalloc(sizeof(*trace), GFP_KERNEL);
- /* These are page-unaligned. */
- struct mmiotrace_map map = {
-@@ -257,7 +257,7 @@ static void ioremap_trace_core(resource_size_t offset, unsigned long size,
- .private = trace
- },
- .phys = offset,
-- .id = atomic_inc_return(&next_id)
-+ .id = atomic_inc_return_unchecked(&next_id)
- };
- map.map_id = trace->id;
-
-@@ -289,7 +289,7 @@ void mmiotrace_ioremap(resource_size_t offset, unsigned long size,
- ioremap_trace_core(offset, size, addr);
- }
-
--static void iounmap_trace_core(volatile void __iomem *addr)
-+static void iounmap_trace_core(const volatile void __iomem *addr)
- {
- struct mmiotrace_map map = {
- .phys = 0,
-@@ -327,7 +327,7 @@ not_enabled:
- }
- }
-
--void mmiotrace_iounmap(volatile void __iomem *addr)
-+void mmiotrace_iounmap(const volatile void __iomem *addr)
- {
- might_sleep();
- if (is_enabled()) /* recheck and proper locking in *_core() */
-diff --git a/arch/x86/mm/numa_32.c b/arch/x86/mm/numa_32.c
-index d253006..e56dd6a 100644
---- a/arch/x86/mm/numa_32.c
-+++ b/arch/x86/mm/numa_32.c
-@@ -98,7 +98,6 @@ unsigned long node_memmap_size_bytes(int nid, unsigned long start_pfn,
- }
- #endif
-
--extern unsigned long find_max_low_pfn(void);
- extern unsigned long highend_pfn, highstart_pfn;
-
- #define LARGE_PAGE_BYTES (PTRS_PER_PTE * PAGE_SIZE)
-diff --git a/arch/x86/mm/pageattr-test.c b/arch/x86/mm/pageattr-test.c
-index e1d1069..2251ff3 100644
---- a/arch/x86/mm/pageattr-test.c
-+++ b/arch/x86/mm/pageattr-test.c
-@@ -36,7 +36,7 @@ enum {
-
- static int pte_testbit(pte_t pte)
- {
-- return pte_flags(pte) & _PAGE_UNUSED1;
-+ return pte_flags(pte) & _PAGE_CPA_TEST;
- }
-
- struct split_state {
-diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
-index 6d44087..6609b55 100644
---- a/arch/x86/mm/pageattr.c
-+++ b/arch/x86/mm/pageattr.c
-@@ -259,16 +259,17 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
- * PCI BIOS based config access (CONFIG_PCI_GOBIOS) support.
- */
- if (within(pfn, BIOS_BEGIN >> PAGE_SHIFT, BIOS_END >> PAGE_SHIFT))
-- pgprot_val(forbidden) |= _PAGE_NX;
-+ pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
-
- /*
- * The kernel text needs to be executable for obvious reasons
- * Does not cover __inittext since that is gone later on. On
- * 64bit we do not enforce !NX on the low mapping
- */
-- if (within(address, (unsigned long)_text, (unsigned long)_etext))
-- pgprot_val(forbidden) |= _PAGE_NX;
-+ if (within(address, ktla_ktva((unsigned long)_text), ktla_ktva((unsigned long)_etext)))
-+ pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
-
-+#ifdef CONFIG_DEBUG_RODATA
- /*
- * The .rodata section needs to be read-only. Using the pfn
- * catches all aliases.
-@@ -276,6 +277,14 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
- if (within(pfn, __pa((unsigned long)__start_rodata) >> PAGE_SHIFT,
- __pa((unsigned long)__end_rodata) >> PAGE_SHIFT))
- pgprot_val(forbidden) |= _PAGE_RW;
-+#endif
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ if (within(pfn, __pa(ktla_ktva((unsigned long)&_text)), __pa((unsigned long)&_sdata))) {
-+ pgprot_val(forbidden) |= _PAGE_RW;
-+ pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
-+ }
-+#endif
-
- prot = __pgprot(pgprot_val(prot) & ~pgprot_val(forbidden));
-
-@@ -329,23 +338,37 @@ EXPORT_SYMBOL_GPL(lookup_address);
- static void __set_pmd_pte(pte_t *kpte, unsigned long address, pte_t pte)
- {
- /* change init_mm */
-+ pax_open_kernel();
- set_pte_atomic(kpte, pte);
-+
- #ifdef CONFIG_X86_32
- if (!SHARED_KERNEL_PMD) {
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ unsigned long cpu;
-+#else
- struct page *page;
-+#endif
-
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ for (cpu = 0; cpu < nr_cpu_ids; ++cpu) {
-+ pgd_t *pgd = get_cpu_pgd(cpu);
-+#else
- list_for_each_entry(page, &pgd_list, lru) {
-- pgd_t *pgd;
-+ pgd_t *pgd = (pgd_t *)page_address(page);
-+#endif
-+
- pud_t *pud;
- pmd_t *pmd;
-
-- pgd = (pgd_t *)page_address(page) + pgd_index(address);
-+ pgd += pgd_index(address);
- pud = pud_offset(pgd, address);
- pmd = pmd_offset(pud, address);
- set_pte_atomic((pte_t *)pmd, pte);
- }
- }
- #endif
-+ pax_close_kernel();
- }
-
- static int
-diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
-index e78cd0e..de0a817 100644
---- a/arch/x86/mm/pat.c
-+++ b/arch/x86/mm/pat.c
-@@ -258,7 +258,7 @@ chk_conflict(struct memtype *new, struct memtype *entry, unsigned long *type)
-
- conflict:
- printk(KERN_INFO "%s:%d conflicting memory types "
-- "%Lx-%Lx %s<->%s\n", current->comm, current->pid, new->start,
-+ "%Lx-%Lx %s<->%s\n", current->comm, task_pid_nr(current), new->start,
- new->end, cattr_name(new->type), cattr_name(entry->type));
- return -EBUSY;
- }
-@@ -559,7 +559,7 @@ unlock_ret:
-
- if (err) {
- printk(KERN_INFO "%s:%d freeing invalid memtype %Lx-%Lx\n",
-- current->comm, current->pid, start, end);
-+ current->comm, task_pid_nr(current), start, end);
- }
-
- dprintk("free_memtype request 0x%Lx-0x%Lx\n", start, end);
-@@ -689,8 +689,8 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
- while (cursor < to) {
- if (!devmem_is_allowed(pfn)) {
- printk(KERN_INFO
-- "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
-- current->comm, from, to);
-+ "Program %s tried to access /dev/mem between %Lx->%Lx (%Lx).\n",
-+ current->comm, from, to, cursor);
- return 0;
- }
- cursor += PAGE_SIZE;
-@@ -755,7 +755,7 @@ int kernel_map_sync_memtype(u64 base, unsigned long size, unsigned long flags)
- printk(KERN_INFO
- "%s:%d ioremap_change_attr failed %s "
- "for %Lx-%Lx\n",
-- current->comm, current->pid,
-+ current->comm, task_pid_nr(current),
- cattr_name(flags),
- base, (unsigned long long)(base + size));
- return -EINVAL;
-@@ -813,7 +813,7 @@ static int reserve_pfn_range(u64 paddr, unsigned long size, pgprot_t *vma_prot,
- free_memtype(paddr, paddr + size);
- printk(KERN_ERR "%s:%d map pfn expected mapping type %s"
- " for %Lx-%Lx, got %s\n",
-- current->comm, current->pid,
-+ current->comm, task_pid_nr(current),
- cattr_name(want_flags),
- (unsigned long long)paddr,
- (unsigned long long)(paddr + size),
-diff --git a/arch/x86/mm/pf_in.c b/arch/x86/mm/pf_in.c
-index df3d5c8..c2223e1 100644
---- a/arch/x86/mm/pf_in.c
-+++ b/arch/x86/mm/pf_in.c
-@@ -148,7 +148,7 @@ enum reason_type get_ins_type(unsigned long ins_addr)
- int i;
- enum reason_type rv = OTHERS;
-
-- p = (unsigned char *)ins_addr;
-+ p = (unsigned char *)ktla_ktva(ins_addr);
- p += skip_prefix(p, &prf);
- p += get_opcode(p, &opcode);
-
-@@ -168,7 +168,7 @@ static unsigned int get_ins_reg_width(unsigned long ins_addr)
- struct prefix_bits prf;
- int i;
-
-- p = (unsigned char *)ins_addr;
-+ p = (unsigned char *)ktla_ktva(ins_addr);
- p += skip_prefix(p, &prf);
- p += get_opcode(p, &opcode);
-
-@@ -191,7 +191,7 @@ unsigned int get_ins_mem_width(unsigned long ins_addr)
- struct prefix_bits prf;
- int i;
-
-- p = (unsigned char *)ins_addr;
-+ p = (unsigned char *)ktla_ktva(ins_addr);
- p += skip_prefix(p, &prf);
- p += get_opcode(p, &opcode);
-
-@@ -417,7 +417,7 @@ unsigned long get_ins_reg_val(unsigned long ins_addr, struct pt_regs *regs)
- int i;
- unsigned long rv;
-
-- p = (unsigned char *)ins_addr;
-+ p = (unsigned char *)ktla_ktva(ins_addr);
- p += skip_prefix(p, &prf);
- p += get_opcode(p, &opcode);
- for (i = 0; i < ARRAY_SIZE(reg_rop); i++)
-@@ -472,7 +472,7 @@ unsigned long get_ins_imm_val(unsigned long ins_addr)
- int i;
- unsigned long rv;
-
-- p = (unsigned char *)ins_addr;
-+ p = (unsigned char *)ktla_ktva(ins_addr);
- p += skip_prefix(p, &prf);
- p += get_opcode(p, &opcode);
- for (i = 0; i < ARRAY_SIZE(imm_wop); i++)
-diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
-index cb7cfc8..84a438a 100644
---- a/arch/x86/mm/pgtable.c
-+++ b/arch/x86/mm/pgtable.c
-@@ -83,9 +83,64 @@ static inline void pgd_list_del(pgd_t *pgd)
- list_del(&page->lru);
- }
-
--#define UNSHARED_PTRS_PER_PGD \
-- (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+pgdval_t clone_pgd_mask __read_only = ~_PAGE_PRESENT;
-
-+void __shadow_user_pgds(pgd_t *dst, const pgd_t *src)
-+{
-+ unsigned int count = USER_PGD_PTRS;
-+
-+ while (count--)
-+ *dst++ = __pgd((pgd_val(*src++) | (_PAGE_NX & __supported_pte_mask)) & ~_PAGE_USER);
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+void __clone_user_pgds(pgd_t *dst, const pgd_t *src)
-+{
-+ unsigned int count = USER_PGD_PTRS;
-+
-+ while (count--) {
-+ pgd_t pgd;
-+
-+#ifdef CONFIG_X86_64
-+ pgd = __pgd(pgd_val(*src++) | _PAGE_USER);
-+#else
-+ pgd = *src++;
-+#endif
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ pgd = __pgd(pgd_val(pgd) & clone_pgd_mask);
-+#endif
-+
-+ *dst++ = pgd;
-+ }
-+
-+}
-+#endif
-+
-+#ifdef CONFIG_X86_64
-+#define pxd_t pud_t
-+#define pyd_t pgd_t
-+#define paravirt_release_pxd(pfn) paravirt_release_pud(pfn)
-+#define pxd_free(mm, pud) pud_free((mm), (pud))
-+#define pyd_populate(mm, pgd, pud) pgd_populate((mm), (pgd), (pud))
-+#define pyd_offset(mm, address) pgd_offset((mm), (address))
-+#define PYD_SIZE PGDIR_SIZE
-+#else
-+#define pxd_t pmd_t
-+#define pyd_t pud_t
-+#define paravirt_release_pxd(pfn) paravirt_release_pmd(pfn)
-+#define pxd_free(mm, pud) pmd_free((mm), (pud))
-+#define pyd_populate(mm, pgd, pud) pud_populate((mm), (pgd), (pud))
-+#define pyd_offset(mm, address) pud_offset((mm), (address))
-+#define PYD_SIZE PUD_SIZE
-+#endif
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+static inline void pgd_ctor(pgd_t *pgd) {}
-+static inline void pgd_dtor(pgd_t *pgd) {}
-+#else
- static void pgd_ctor(pgd_t *pgd)
- {
- /* If the pgd points to a shared pagetable level (either the
-@@ -117,6 +172,7 @@ static void pgd_dtor(pgd_t *pgd)
- pgd_list_del(pgd);
- spin_unlock(&pgd_lock);
- }
-+#endif
-
- /*
- * List of all pgd's needed for non-PAE so it can invalidate entries
-@@ -129,7 +185,7 @@ static void pgd_dtor(pgd_t *pgd)
- * -- wli
- */
-
--#ifdef CONFIG_X86_PAE
-+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
- /*
- * In PAE mode, we need to do a cr3 reload (=tlb flush) when
- * updating the top-level pagetable entries to guarantee the
-@@ -141,7 +197,7 @@ static void pgd_dtor(pgd_t *pgd)
- * not shared between pagetables (!SHARED_KERNEL_PMDS), we allocate
- * and initialize the kernel pmds here.
- */
--#define PREALLOCATED_PMDS UNSHARED_PTRS_PER_PGD
-+#define PREALLOCATED_PXDS (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
-
- void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
- {
-@@ -159,36 +215,38 @@ void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
- */
- flush_tlb_mm(mm);
- }
-+#elif defined(CONFIG_X86_64) && defined(CONFIG_PAX_PER_CPU_PGD)
-+#define PREALLOCATED_PXDS USER_PGD_PTRS
- #else /* !CONFIG_X86_PAE */
-
- /* No need to prepopulate any pagetable entries in non-PAE modes. */
--#define PREALLOCATED_PMDS 0
-+#define PREALLOCATED_PXDS 0
-
- #endif /* CONFIG_X86_PAE */
-
--static void free_pmds(pmd_t *pmds[])
-+static void free_pxds(pxd_t *pxds[])
- {
- int i;
-
-- for(i = 0; i < PREALLOCATED_PMDS; i++)
-- if (pmds[i])
-- free_page((unsigned long)pmds[i]);
-+ for(i = 0; i < PREALLOCATED_PXDS; i++)
-+ if (pxds[i])
-+ free_page((unsigned long)pxds[i]);
- }
-
--static int preallocate_pmds(pmd_t *pmds[])
-+static int preallocate_pxds(pxd_t *pxds[])
- {
- int i;
- bool failed = false;
-
-- for(i = 0; i < PREALLOCATED_PMDS; i++) {
-- pmd_t *pmd = (pmd_t *)__get_free_page(PGALLOC_GFP);
-- if (pmd == NULL)
-+ for(i = 0; i < PREALLOCATED_PXDS; i++) {
-+ pxd_t *pxd = (pxd_t *)__get_free_page(PGALLOC_GFP);
-+ if (pxd == NULL)
- failed = true;
-- pmds[i] = pmd;
-+ pxds[i] = pxd;
- }
-
- if (failed) {
-- free_pmds(pmds);
-+ free_pxds(pxds);
- return -ENOMEM;
- }
-
-@@ -201,51 +259,55 @@ static int preallocate_pmds(pmd_t *pmds[])
- * preallocate which never got a corresponding vma will need to be
- * freed manually.
- */
--static void pgd_mop_up_pmds(struct mm_struct *mm, pgd_t *pgdp)
-+static void pgd_mop_up_pxds(struct mm_struct *mm, pgd_t *pgdp)
- {
- int i;
-
-- for(i = 0; i < PREALLOCATED_PMDS; i++) {
-+ for(i = 0; i < PREALLOCATED_PXDS; i++) {
- pgd_t pgd = pgdp[i];
-
- if (pgd_val(pgd) != 0) {
-- pmd_t *pmd = (pmd_t *)pgd_page_vaddr(pgd);
-+ pxd_t *pxd = (pxd_t *)pgd_page_vaddr(pgd);
-
-- pgdp[i] = native_make_pgd(0);
-+ set_pgd(pgdp + i, native_make_pgd(0));
-
-- paravirt_release_pmd(pgd_val(pgd) >> PAGE_SHIFT);
-- pmd_free(mm, pmd);
-+ paravirt_release_pxd(pgd_val(pgd) >> PAGE_SHIFT);
-+ pxd_free(mm, pxd);
- }
- }
- }
-
--static void pgd_prepopulate_pmd(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmds[])
-+static void pgd_prepopulate_pxd(struct mm_struct *mm, pgd_t *pgd, pxd_t *pxds[])
- {
-- pud_t *pud;
-+ pyd_t *pyd;
- unsigned long addr;
- int i;
-
-- if (PREALLOCATED_PMDS == 0) /* Work around gcc-3.4.x bug */
-+ if (PREALLOCATED_PXDS == 0) /* Work around gcc-3.4.x bug */
- return;
-
-- pud = pud_offset(pgd, 0);
-+#ifdef CONFIG_X86_64
-+ pyd = pyd_offset(mm, 0L);
-+#else
-+ pyd = pyd_offset(pgd, 0L);
-+#endif
-
-- for (addr = i = 0; i < PREALLOCATED_PMDS;
-- i++, pud++, addr += PUD_SIZE) {
-- pmd_t *pmd = pmds[i];
-+ for (addr = i = 0; i < PREALLOCATED_PXDS;
-+ i++, pyd++, addr += PYD_SIZE) {
-+ pxd_t *pxd = pxds[i];
-
- if (i >= KERNEL_PGD_BOUNDARY)
-- memcpy(pmd, (pmd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
-- sizeof(pmd_t) * PTRS_PER_PMD);
-+ memcpy(pxd, (pxd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
-+ sizeof(pxd_t) * PTRS_PER_PMD);
-
-- pud_populate(mm, pud, pmd);
-+ pyd_populate(mm, pyd, pxd);
- }
- }
-
- pgd_t *pgd_alloc(struct mm_struct *mm)
- {
- pgd_t *pgd;
-- pmd_t *pmds[PREALLOCATED_PMDS];
-+ pxd_t *pxds[PREALLOCATED_PXDS];
-
- pgd = (pgd_t *)__get_free_page(PGALLOC_GFP);
-
-@@ -254,11 +316,11 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
-
- mm->pgd = pgd;
-
-- if (preallocate_pmds(pmds) != 0)
-+ if (preallocate_pxds(pxds) != 0)
- goto out_free_pgd;
-
- if (paravirt_pgd_alloc(mm) != 0)
-- goto out_free_pmds;
-+ goto out_free_pxds;
-
- /*
- * Make sure that pre-populating the pmds is atomic with
-@@ -268,14 +330,14 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
- spin_lock(&pgd_lock);
-
- pgd_ctor(pgd);
-- pgd_prepopulate_pmd(mm, pgd, pmds);
-+ pgd_prepopulate_pxd(mm, pgd, pxds);
-
- spin_unlock(&pgd_lock);
-
- return pgd;
-
--out_free_pmds:
-- free_pmds(pmds);
-+out_free_pxds:
-+ free_pxds(pxds);
- out_free_pgd:
- free_page((unsigned long)pgd);
- out:
-@@ -284,7 +346,7 @@ out:
-
- void pgd_free(struct mm_struct *mm, pgd_t *pgd)
- {
-- pgd_mop_up_pmds(mm, pgd);
-+ pgd_mop_up_pxds(mm, pgd);
- pgd_dtor(pgd);
- paravirt_pgd_free(mm, pgd);
- free_page((unsigned long)pgd);
-diff --git a/arch/x86/mm/pgtable_32.c b/arch/x86/mm/pgtable_32.c
-index 46c8834..fcab43d 100644
---- a/arch/x86/mm/pgtable_32.c
-+++ b/arch/x86/mm/pgtable_32.c
-@@ -49,10 +49,13 @@ void set_pte_vaddr(unsigned long vaddr, pte_t pteval)
- return;
- }
- pte = pte_offset_kernel(pmd, vaddr);
-+
-+ pax_open_kernel();
- if (pte_val(pteval))
- set_pte_at(&init_mm, vaddr, pte, pteval);
- else
- pte_clear(&init_mm, vaddr, pte);
-+ pax_close_kernel();
-
- /*
- * It's enough to flush this one mapping.
-diff --git a/arch/x86/mm/setup_nx.c b/arch/x86/mm/setup_nx.c
-index 513d8ed..978c161 100644
---- a/arch/x86/mm/setup_nx.c
-+++ b/arch/x86/mm/setup_nx.c
-@@ -4,11 +4,10 @@
-
- #include <asm/pgtable.h>
-
-+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
- int nx_enabled;
-
--#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
--static int disable_nx __cpuinitdata;
--
-+#ifndef CONFIG_PAX_PAGEEXEC
- /*
- * noexec = on|off
- *
-@@ -22,32 +21,26 @@ static int __init noexec_setup(char *str)
- if (!str)
- return -EINVAL;
- if (!strncmp(str, "on", 2)) {
-- __supported_pte_mask |= _PAGE_NX;
-- disable_nx = 0;
-+ nx_enabled = 1;
- } else if (!strncmp(str, "off", 3)) {
-- disable_nx = 1;
-- __supported_pte_mask &= ~_PAGE_NX;
-+ nx_enabled = 0;
- }
- return 0;
- }
- early_param("noexec", noexec_setup);
- #endif
-+#endif
-
- #ifdef CONFIG_X86_PAE
- void __init set_nx(void)
- {
-- unsigned int v[4], l, h;
-+ if (!nx_enabled && cpu_has_nx) {
-+ unsigned l, h;
-
-- if (cpu_has_pae && (cpuid_eax(0x80000000) > 0x80000001)) {
-- cpuid(0x80000001, &v[0], &v[1], &v[2], &v[3]);
--
-- if ((v[3] & (1 << 20)) && !disable_nx) {
-- rdmsr(MSR_EFER, l, h);
-- l |= EFER_NX;
-- wrmsr(MSR_EFER, l, h);
-- nx_enabled = 1;
-- __supported_pte_mask |= _PAGE_NX;
-- }
-+ __supported_pte_mask &= ~_PAGE_NX;
-+ rdmsr(MSR_EFER, l, h);
-+ l &= ~EFER_NX;
-+ wrmsr(MSR_EFER, l, h);
- }
- }
- #else
-@@ -62,7 +55,7 @@ void __cpuinit check_efer(void)
- unsigned long efer;
-
- rdmsrl(MSR_EFER, efer);
-- if (!(efer & EFER_NX) || disable_nx)
-+ if (!(efer & EFER_NX) || !nx_enabled)
- __supported_pte_mask &= ~_PAGE_NX;
- }
- #endif
-diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
-index 36fe08e..b123d3a 100644
---- a/arch/x86/mm/tlb.c
-+++ b/arch/x86/mm/tlb.c
-@@ -61,7 +61,11 @@ void leave_mm(int cpu)
- BUG();
- cpumask_clear_cpu(cpu,
- mm_cpumask(percpu_read(cpu_tlbstate.active_mm)));
-+
-+#ifndef CONFIG_PAX_PER_CPU_PGD
- load_cr3(swapper_pg_dir);
-+#endif
-+
- }
- EXPORT_SYMBOL_GPL(leave_mm);
-
-diff --git a/arch/x86/oprofile/backtrace.c b/arch/x86/oprofile/backtrace.c
-index b50a280..ada6ded 100644
---- a/arch/x86/oprofile/backtrace.c
-+++ b/arch/x86/oprofile/backtrace.c
-@@ -115,7 +115,7 @@ x86_backtrace(struct pt_regs * const regs, unsigned int depth)
- {
- struct frame_head *head = (struct frame_head *)frame_pointer(regs);
-
-- if (!user_mode_vm(regs)) {
-+ if (!user_mode(regs)) {
- unsigned long stack = kernel_stack_pointer(regs);
- if (depth)
- dump_trace(NULL, regs, (unsigned long *)stack, 0,
-diff --git a/arch/x86/oprofile/op_model_p4.c b/arch/x86/oprofile/op_model_p4.c
-index e6a160a..36deff6 100644
---- a/arch/x86/oprofile/op_model_p4.c
-+++ b/arch/x86/oprofile/op_model_p4.c
-@@ -50,7 +50,7 @@ static inline void setup_num_counters(void)
- #endif
- }
-
--static int inline addr_increment(void)
-+static inline int addr_increment(void)
- {
- #ifdef CONFIG_SMP
- return smp_num_siblings == 2 ? 2 : 1;
-diff --git a/arch/x86/pci/common.c b/arch/x86/pci/common.c
-index 1331fcf..03901b2 100644
---- a/arch/x86/pci/common.c
-+++ b/arch/x86/pci/common.c
-@@ -31,8 +31,8 @@ int noioapicreroute = 1;
- int pcibios_last_bus = -1;
- unsigned long pirq_table_addr;
- struct pci_bus *pci_root_bus;
--struct pci_raw_ops *raw_pci_ops;
--struct pci_raw_ops *raw_pci_ext_ops;
-+const struct pci_raw_ops *raw_pci_ops;
-+const struct pci_raw_ops *raw_pci_ext_ops;
-
- int raw_pci_read(unsigned int domain, unsigned int bus, unsigned int devfn,
- int reg, int len, u32 *val)
-diff --git a/arch/x86/pci/direct.c b/arch/x86/pci/direct.c
-index 347d882..4baf6b6 100644
---- a/arch/x86/pci/direct.c
-+++ b/arch/x86/pci/direct.c
-@@ -79,7 +79,7 @@ static int pci_conf1_write(unsigned int seg, unsigned int bus,
-
- #undef PCI_CONF1_ADDRESS
-
--struct pci_raw_ops pci_direct_conf1 = {
-+const struct pci_raw_ops pci_direct_conf1 = {
- .read = pci_conf1_read,
- .write = pci_conf1_write,
- };
-@@ -173,7 +173,7 @@ static int pci_conf2_write(unsigned int seg, unsigned int bus,
-
- #undef PCI_CONF2_ADDRESS
-
--struct pci_raw_ops pci_direct_conf2 = {
-+const struct pci_raw_ops pci_direct_conf2 = {
- .read = pci_conf2_read,
- .write = pci_conf2_write,
- };
-@@ -189,7 +189,7 @@ struct pci_raw_ops pci_direct_conf2 = {
- * This should be close to trivial, but it isn't, because there are buggy
- * chipsets (yes, you guessed it, by Intel and Compaq) that have no class ID.
- */
--static int __init pci_sanity_check(struct pci_raw_ops *o)
-+static int __init pci_sanity_check(const struct pci_raw_ops *o)
- {
- u32 x = 0;
- int year, devfn;
-diff --git a/arch/x86/pci/mmconfig_32.c b/arch/x86/pci/mmconfig_32.c
-index f10a7e9..0425342 100644
---- a/arch/x86/pci/mmconfig_32.c
-+++ b/arch/x86/pci/mmconfig_32.c
-@@ -125,7 +125,7 @@ static int pci_mmcfg_write(unsigned int seg, unsigned int bus,
- return 0;
- }
-
--static struct pci_raw_ops pci_mmcfg = {
-+static const struct pci_raw_ops pci_mmcfg = {
- .read = pci_mmcfg_read,
- .write = pci_mmcfg_write,
- };
-diff --git a/arch/x86/pci/mmconfig_64.c b/arch/x86/pci/mmconfig_64.c
-index 94349f8..41600a7 100644
---- a/arch/x86/pci/mmconfig_64.c
-+++ b/arch/x86/pci/mmconfig_64.c
-@@ -104,7 +104,7 @@ static int pci_mmcfg_write(unsigned int seg, unsigned int bus,
- return 0;
- }
-
--static struct pci_raw_ops pci_mmcfg = {
-+static const struct pci_raw_ops pci_mmcfg = {
- .read = pci_mmcfg_read,
- .write = pci_mmcfg_write,
- };
-diff --git a/arch/x86/pci/numaq_32.c b/arch/x86/pci/numaq_32.c
-index 8eb295e..86bd657 100644
---- a/arch/x86/pci/numaq_32.c
-+++ b/arch/x86/pci/numaq_32.c
-@@ -112,7 +112,7 @@ static int pci_conf1_mq_write(unsigned int seg, unsigned int bus,
-
- #undef PCI_CONF1_MQ_ADDRESS
-
--static struct pci_raw_ops pci_direct_conf1_mq = {
-+static const struct pci_raw_ops pci_direct_conf1_mq = {
- .read = pci_conf1_mq_read,
- .write = pci_conf1_mq_write
- };
-diff --git a/arch/x86/pci/olpc.c b/arch/x86/pci/olpc.c
-index b889d82..5a58a0a 100644
---- a/arch/x86/pci/olpc.c
-+++ b/arch/x86/pci/olpc.c
-@@ -297,7 +297,7 @@ static int pci_olpc_write(unsigned int seg, unsigned int bus,
- return 0;
- }
-
--static struct pci_raw_ops pci_olpc_conf = {
-+static const struct pci_raw_ops pci_olpc_conf = {
- .read = pci_olpc_read,
- .write = pci_olpc_write,
- };
-diff --git a/arch/x86/pci/pcbios.c b/arch/x86/pci/pcbios.c
-index 1c975cc..b8e16c2 100644
---- a/arch/x86/pci/pcbios.c
-+++ b/arch/x86/pci/pcbios.c
-@@ -56,50 +56,93 @@ union bios32 {
- static struct {
- unsigned long address;
- unsigned short segment;
--} bios32_indirect = { 0, __KERNEL_CS };
-+} bios32_indirect __read_only = { 0, __PCIBIOS_CS };
-
- /*
- * Returns the entry point for the given service, NULL on error
- */
-
--static unsigned long bios32_service(unsigned long service)
-+static unsigned long __devinit bios32_service(unsigned long service)
- {
- unsigned char return_code; /* %al */
- unsigned long address; /* %ebx */
- unsigned long length; /* %ecx */
- unsigned long entry; /* %edx */
- unsigned long flags;
-+ struct desc_struct d, *gdt;
-
- local_irq_save(flags);
-- __asm__("lcall *(%%edi); cld"
-+
-+ gdt = get_cpu_gdt_table(smp_processor_id());
-+
-+ pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x9B, 0xC);
-+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
-+ pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x93, 0xC);
-+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
-+
-+ __asm__("movw %w7, %%ds; lcall *(%%edi); push %%ss; pop %%ds; cld"
- : "=a" (return_code),
- "=b" (address),
- "=c" (length),
- "=d" (entry)
- : "0" (service),
- "1" (0),
-- "D" (&bios32_indirect));
-+ "D" (&bios32_indirect),
-+ "r"(__PCIBIOS_DS)
-+ : "memory");
-+
-+ pax_open_kernel();
-+ gdt[GDT_ENTRY_PCIBIOS_CS].a = 0;
-+ gdt[GDT_ENTRY_PCIBIOS_CS].b = 0;
-+ gdt[GDT_ENTRY_PCIBIOS_DS].a = 0;
-+ gdt[GDT_ENTRY_PCIBIOS_DS].b = 0;
-+ pax_close_kernel();
-+
- local_irq_restore(flags);
-
- switch (return_code) {
-- case 0:
-- return address + entry;
-- case 0x80: /* Not present */
-- printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
-- return 0;
-- default: /* Shouldn't happen */
-- printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
-- service, return_code);
-+ case 0: {
-+ int cpu;
-+ unsigned char flags;
-+
-+ printk(KERN_INFO "bios32_service: base:%08lx length:%08lx entry:%08lx\n", address, length, entry);
-+ if (address >= 0xFFFF0 || length > 0x100000 - address || length <= entry) {
-+ printk(KERN_WARNING "bios32_service: not valid\n");
- return 0;
-+ }
-+ address = address + PAGE_OFFSET;
-+ length += 16UL; /* some BIOSs underreport this... */
-+ flags = 4;
-+ if (length >= 64*1024*1024) {
-+ length >>= PAGE_SHIFT;
-+ flags |= 8;
-+ }
-+
-+ for (cpu = 0; cpu < nr_cpu_ids; cpu++) {
-+ gdt = get_cpu_gdt_table(cpu);
-+ pack_descriptor(&d, address, length, 0x9b, flags);
-+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
-+ pack_descriptor(&d, address, length, 0x93, flags);
-+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
-+ }
-+ return entry;
-+ }
-+ case 0x80: /* Not present */
-+ printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
-+ return 0;
-+ default: /* Shouldn't happen */
-+ printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
-+ service, return_code);
-+ return 0;
- }
- }
-
- static struct {
- unsigned long address;
- unsigned short segment;
--} pci_indirect = { 0, __KERNEL_CS };
-+} pci_indirect __read_only = { 0, __PCIBIOS_CS };
-
--static int pci_bios_present;
-+static int pci_bios_present __read_only;
-
- static int __devinit check_pcibios(void)
- {
-@@ -108,11 +151,13 @@ static int __devinit check_pcibios(void)
- unsigned long flags, pcibios_entry;
-
- if ((pcibios_entry = bios32_service(PCI_SERVICE))) {
-- pci_indirect.address = pcibios_entry + PAGE_OFFSET;
-+ pci_indirect.address = pcibios_entry;
-
- local_irq_save(flags);
-- __asm__(
-- "lcall *(%%edi); cld\n\t"
-+ __asm__("movw %w6, %%ds\n\t"
-+ "lcall *%%ss:(%%edi); cld\n\t"
-+ "push %%ss\n\t"
-+ "pop %%ds\n\t"
- "jc 1f\n\t"
- "xor %%ah, %%ah\n"
- "1:"
-@@ -121,7 +166,8 @@ static int __devinit check_pcibios(void)
- "=b" (ebx),
- "=c" (ecx)
- : "1" (PCIBIOS_PCI_BIOS_PRESENT),
-- "D" (&pci_indirect)
-+ "D" (&pci_indirect),
-+ "r" (__PCIBIOS_DS)
- : "memory");
- local_irq_restore(flags);
-
-@@ -165,7 +211,10 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
-
- switch (len) {
- case 1:
-- __asm__("lcall *(%%esi); cld\n\t"
-+ __asm__("movw %w6, %%ds\n\t"
-+ "lcall *%%ss:(%%esi); cld\n\t"
-+ "push %%ss\n\t"
-+ "pop %%ds\n\t"
- "jc 1f\n\t"
- "xor %%ah, %%ah\n"
- "1:"
-@@ -174,7 +223,8 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
- : "1" (PCIBIOS_READ_CONFIG_BYTE),
- "b" (bx),
- "D" ((long)reg),
-- "S" (&pci_indirect));
-+ "S" (&pci_indirect),
-+ "r" (__PCIBIOS_DS));
- /*
- * Zero-extend the result beyond 8 bits, do not trust the
- * BIOS having done it:
-@@ -182,7 +232,10 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
- *value &= 0xff;
- break;
- case 2:
-- __asm__("lcall *(%%esi); cld\n\t"
-+ __asm__("movw %w6, %%ds\n\t"
-+ "lcall *%%ss:(%%esi); cld\n\t"
-+ "push %%ss\n\t"
-+ "pop %%ds\n\t"
- "jc 1f\n\t"
- "xor %%ah, %%ah\n"
- "1:"
-@@ -191,7 +244,8 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
- : "1" (PCIBIOS_READ_CONFIG_WORD),
- "b" (bx),
- "D" ((long)reg),
-- "S" (&pci_indirect));
-+ "S" (&pci_indirect),
-+ "r" (__PCIBIOS_DS));
- /*
- * Zero-extend the result beyond 16 bits, do not trust the
- * BIOS having done it:
-@@ -199,7 +253,10 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
- *value &= 0xffff;
- break;
- case 4:
-- __asm__("lcall *(%%esi); cld\n\t"
-+ __asm__("movw %w6, %%ds\n\t"
-+ "lcall *%%ss:(%%esi); cld\n\t"
-+ "push %%ss\n\t"
-+ "pop %%ds\n\t"
- "jc 1f\n\t"
- "xor %%ah, %%ah\n"
- "1:"
-@@ -208,7 +265,8 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
- : "1" (PCIBIOS_READ_CONFIG_DWORD),
- "b" (bx),
- "D" ((long)reg),
-- "S" (&pci_indirect));
-+ "S" (&pci_indirect),
-+ "r" (__PCIBIOS_DS));
- break;
- }
-
-@@ -231,7 +289,10 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
-
- switch (len) {
- case 1:
-- __asm__("lcall *(%%esi); cld\n\t"
-+ __asm__("movw %w6, %%ds\n\t"
-+ "lcall *%%ss:(%%esi); cld\n\t"
-+ "push %%ss\n\t"
-+ "pop %%ds\n\t"
- "jc 1f\n\t"
- "xor %%ah, %%ah\n"
- "1:"
-@@ -240,10 +301,14 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
- "c" (value),
- "b" (bx),
- "D" ((long)reg),
-- "S" (&pci_indirect));
-+ "S" (&pci_indirect),
-+ "r" (__PCIBIOS_DS));
- break;
- case 2:
-- __asm__("lcall *(%%esi); cld\n\t"
-+ __asm__("movw %w6, %%ds\n\t"
-+ "lcall *%%ss:(%%esi); cld\n\t"
-+ "push %%ss\n\t"
-+ "pop %%ds\n\t"
- "jc 1f\n\t"
- "xor %%ah, %%ah\n"
- "1:"
-@@ -252,10 +317,14 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
- "c" (value),
- "b" (bx),
- "D" ((long)reg),
-- "S" (&pci_indirect));
-+ "S" (&pci_indirect),
-+ "r" (__PCIBIOS_DS));
- break;
- case 4:
-- __asm__("lcall *(%%esi); cld\n\t"
-+ __asm__("movw %w6, %%ds\n\t"
-+ "lcall *%%ss:(%%esi); cld\n\t"
-+ "push %%ss\n\t"
-+ "pop %%ds\n\t"
- "jc 1f\n\t"
- "xor %%ah, %%ah\n"
- "1:"
-@@ -264,7 +333,8 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
- "c" (value),
- "b" (bx),
- "D" ((long)reg),
-- "S" (&pci_indirect));
-+ "S" (&pci_indirect),
-+ "r" (__PCIBIOS_DS));
- break;
- }
-
-@@ -278,7 +348,7 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
- * Function table for BIOS32 access
- */
-
--static struct pci_raw_ops pci_bios_access = {
-+static const struct pci_raw_ops pci_bios_access = {
- .read = pci_bios_read,
- .write = pci_bios_write
- };
-@@ -287,7 +357,7 @@ static struct pci_raw_ops pci_bios_access = {
- * Try to find PCI BIOS.
- */
-
--static struct pci_raw_ops * __devinit pci_find_bios(void)
-+static const struct pci_raw_ops * __devinit pci_find_bios(void)
- {
- union bios32 *check;
- unsigned char sum;
-@@ -368,10 +438,13 @@ struct irq_routing_table * pcibios_get_irq_routing_table(void)
-
- DBG("PCI: Fetching IRQ routing table... ");
- __asm__("push %%es\n\t"
-+ "movw %w8, %%ds\n\t"
- "push %%ds\n\t"
- "pop %%es\n\t"
-- "lcall *(%%esi); cld\n\t"
-+ "lcall *%%ss:(%%esi); cld\n\t"
- "pop %%es\n\t"
-+ "push %%ss\n\t"
-+ "pop %%ds\n"
- "jc 1f\n\t"
- "xor %%ah, %%ah\n"
- "1:"
-@@ -382,7 +455,8 @@ struct irq_routing_table * pcibios_get_irq_routing_table(void)
- "1" (0),
- "D" ((long) &opt),
- "S" (&pci_indirect),
-- "m" (opt)
-+ "m" (opt),
-+ "r" (__PCIBIOS_DS)
- : "memory");
- DBG("OK ret=%d, size=%d, map=%x\n", ret, opt.size, map);
- if (ret & 0xff00)
-@@ -406,7 +480,10 @@ int pcibios_set_irq_routing(struct pci_dev *dev, int pin, int irq)
- {
- int ret;
-
-- __asm__("lcall *(%%esi); cld\n\t"
-+ __asm__("movw %w5, %%ds\n\t"
-+ "lcall *%%ss:(%%esi); cld\n\t"
-+ "push %%ss\n\t"
-+ "pop %%ds\n"
- "jc 1f\n\t"
- "xor %%ah, %%ah\n"
- "1:"
-@@ -414,7 +491,8 @@ int pcibios_set_irq_routing(struct pci_dev *dev, int pin, int irq)
- : "0" (PCIBIOS_SET_PCI_HW_INT),
- "b" ((dev->bus->number << 8) | dev->devfn),
- "c" ((irq << 8) | (pin + 10)),
-- "S" (&pci_indirect));
-+ "S" (&pci_indirect),
-+ "r" (__PCIBIOS_DS));
- return !(ret & 0xff00);
- }
- EXPORT_SYMBOL(pcibios_set_irq_routing);
-diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c
-index fa0f651..462a948 100644
---- a/arch/x86/power/cpu.c
-+++ b/arch/x86/power/cpu.c
-@@ -129,7 +129,7 @@ static void do_fpu_end(void)
- static void fix_processor_context(void)
- {
- int cpu = smp_processor_id();
-- struct tss_struct *t = &per_cpu(init_tss, cpu);
-+ struct tss_struct *t = init_tss + cpu;
-
- set_tss_desc(cpu, t); /*
- * This just modifies memory; should not be
-@@ -139,8 +139,6 @@ static void fix_processor_context(void)
- */
-
- #ifdef CONFIG_X86_64
-- get_cpu_gdt_table(cpu)[GDT_ENTRY_TSS].type = 9;
--
- syscall_init(); /* This sets MSR_*STAR and related */
- #endif
- load_TR_desc(); /* This does ltr */
-diff --git a/arch/x86/vdso/Makefile b/arch/x86/vdso/Makefile
-index dd78ef6..f9d928d 100644
---- a/arch/x86/vdso/Makefile
-+++ b/arch/x86/vdso/Makefile
-@@ -122,7 +122,7 @@ quiet_cmd_vdso = VDSO $@
- $(VDSO_LDFLAGS) $(VDSO_LDFLAGS_$(filter %.lds,$(^F))) \
- -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^)
-
--VDSO_LDFLAGS = -fPIC -shared $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
-+VDSO_LDFLAGS = -fPIC -shared -Wl,--no-undefined $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
- GCOV_PROFILE := n
-
- #
-diff --git a/arch/x86/vdso/vclock_gettime.c b/arch/x86/vdso/vclock_gettime.c
-index ee55754..0013b2e 100644
---- a/arch/x86/vdso/vclock_gettime.c
-+++ b/arch/x86/vdso/vclock_gettime.c
-@@ -22,24 +22,48 @@
- #include <asm/hpet.h>
- #include <asm/unistd.h>
- #include <asm/io.h>
-+#include <asm/fixmap.h>
- #include "vextern.h"
-
- #define gtod vdso_vsyscall_gtod_data
-
-+notrace noinline long __vdso_fallback_time(long *t)
-+{
-+ long secs;
-+ asm volatile("syscall"
-+ : "=a" (secs)
-+ : "0" (__NR_time),"D" (t) : "r11", "cx", "memory");
-+ return secs;
-+}
-+
- notrace static long vdso_fallback_gettime(long clock, struct timespec *ts)
- {
- long ret;
- asm("syscall" : "=a" (ret) :
-- "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "memory");
-+ "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "r11", "cx", "memory");
- return ret;
- }
-
-+notrace static inline cycle_t __vdso_vread_hpet(void)
-+{
-+ return readl((const void __iomem *)fix_to_virt(VSYSCALL_HPET) + 0xf0);
-+}
-+
-+notrace static inline cycle_t __vdso_vread_tsc(void)
-+{
-+ cycle_t ret = (cycle_t)vget_cycles();
-+
-+ return ret >= gtod->clock.cycle_last ? ret : gtod->clock.cycle_last;
-+}
-+
- notrace static inline long vgetns(void)
- {
- long v;
-- cycles_t (*vread)(void);
-- vread = gtod->clock.vread;
-- v = (vread() - gtod->clock.cycle_last) & gtod->clock.mask;
-+ if (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3])
-+ v = __vdso_vread_tsc();
-+ else
-+ v = __vdso_vread_hpet();
-+ v = (v - gtod->clock.cycle_last) & gtod->clock.mask;
- return (v * gtod->clock.mult) >> gtod->clock.shift;
- }
-
-@@ -113,7 +137,9 @@ notrace static noinline int do_monotonic_coarse(struct timespec *ts)
-
- notrace int __vdso_clock_gettime(clockid_t clock, struct timespec *ts)
- {
-- if (likely(gtod->sysctl_enabled))
-+ if (likely(gtod->sysctl_enabled &&
-+ ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
-+ (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
- switch (clock) {
- case CLOCK_REALTIME:
- if (likely(gtod->clock.vread))
-@@ -133,10 +159,20 @@ notrace int __vdso_clock_gettime(clockid_t clock, struct timespec *ts)
- int clock_gettime(clockid_t, struct timespec *)
- __attribute__((weak, alias("__vdso_clock_gettime")));
-
-+notrace noinline int __vdso_fallback_gettimeofday(struct timeval *tv, struct timezone *tz)
-+{
-+ long ret;
-+ asm("syscall" : "=a" (ret) :
-+ "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "r11", "cx", "memory");
-+ return ret;
-+}
-+
- notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
- {
-- long ret;
-- if (likely(gtod->sysctl_enabled && gtod->clock.vread)) {
-+ if (likely(gtod->sysctl_enabled &&
-+ ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
-+ (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
-+ {
- if (likely(tv != NULL)) {
- BUILD_BUG_ON(offsetof(struct timeval, tv_usec) !=
- offsetof(struct timespec, tv_nsec) ||
-@@ -151,9 +187,7 @@ notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
- }
- return 0;
- }
-- asm("syscall" : "=a" (ret) :
-- "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "memory");
-- return ret;
-+ return __vdso_fallback_gettimeofday(tv, tz);
- }
- int gettimeofday(struct timeval *, struct timezone *)
- __attribute__((weak, alias("__vdso_gettimeofday")));
-diff --git a/arch/x86/vdso/vdso.lds.S b/arch/x86/vdso/vdso.lds.S
-index 4e5dd3b..00ba15e 100644
---- a/arch/x86/vdso/vdso.lds.S
-+++ b/arch/x86/vdso/vdso.lds.S
-@@ -35,3 +35,9 @@ VDSO64_PRELINK = VDSO_PRELINK;
- #define VEXTERN(x) VDSO64_ ## x = vdso_ ## x;
- #include "vextern.h"
- #undef VEXTERN
-+
-+#define VEXTERN(x) VDSO64_ ## x = __vdso_ ## x;
-+VEXTERN(fallback_gettimeofday)
-+VEXTERN(fallback_time)
-+VEXTERN(getcpu)
-+#undef VEXTERN
-diff --git a/arch/x86/vdso/vdso32-setup.c b/arch/x86/vdso/vdso32-setup.c
-index 58bc00f..d53fb48 100644
---- a/arch/x86/vdso/vdso32-setup.c
-+++ b/arch/x86/vdso/vdso32-setup.c
-@@ -25,6 +25,7 @@
- #include <asm/tlbflush.h>
- #include <asm/vdso.h>
- #include <asm/proto.h>
-+#include <asm/mman.h>
-
- enum {
- VDSO_DISABLED = 0,
-@@ -226,7 +227,7 @@ static inline void map_compat_vdso(int map)
- void enable_sep_cpu(void)
- {
- int cpu = get_cpu();
-- struct tss_struct *tss = &per_cpu(init_tss, cpu);
-+ struct tss_struct *tss = init_tss + cpu;
-
- if (!boot_cpu_has(X86_FEATURE_SEP)) {
- put_cpu();
-@@ -249,7 +250,7 @@ static int __init gate_vma_init(void)
- gate_vma.vm_start = FIXADDR_USER_START;
- gate_vma.vm_end = FIXADDR_USER_END;
- gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
-- gate_vma.vm_page_prot = __P101;
-+ gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
- /*
- * Make sure the vDSO gets into every core dump.
- * Dumping its contents makes post-mortem fully interpretable later
-@@ -331,14 +332,14 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
- if (compat)
- addr = VDSO_HIGH_BASE;
- else {
-- addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
-+ addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, MAP_EXECUTABLE);
- if (IS_ERR_VALUE(addr)) {
- ret = addr;
- goto up_fail;
- }
- }
-
-- current->mm->context.vdso = (void *)addr;
-+ current->mm->context.vdso = addr;
-
- if (compat_uses_vma || !compat) {
- /*
-@@ -361,11 +362,11 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
- }
-
- current_thread_info()->sysenter_return =
-- VDSO32_SYMBOL(addr, SYSENTER_RETURN);
-+ (__force void __user *)VDSO32_SYMBOL(addr, SYSENTER_RETURN);
-
- up_fail:
- if (ret)
-- current->mm->context.vdso = NULL;
-+ current->mm->context.vdso = 0;
-
- up_write(&mm->mmap_sem);
-
-@@ -413,8 +414,14 @@ __initcall(ia32_binfmt_init);
-
- const char *arch_vma_name(struct vm_area_struct *vma)
- {
-- if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
-+ if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
- return "[vdso]";
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (vma->vm_mm && vma->vm_mirror && vma->vm_mirror->vm_start == vma->vm_mm->context.vdso)
-+ return "[vdso]";
-+#endif
-+
- return NULL;
- }
-
-@@ -423,7 +430,7 @@ struct vm_area_struct *get_gate_vma(struct task_struct *tsk)
- struct mm_struct *mm = tsk->mm;
-
- /* Check to see if this task was created in compat vdso mode */
-- if (mm && mm->context.vdso == (void *)VDSO_HIGH_BASE)
-+ if (mm && mm->context.vdso == VDSO_HIGH_BASE)
- return &gate_vma;
- return NULL;
- }
-diff --git a/arch/x86/vdso/vextern.h b/arch/x86/vdso/vextern.h
-index 1683ba2..48d07f3 100644
---- a/arch/x86/vdso/vextern.h
-+++ b/arch/x86/vdso/vextern.h
-@@ -11,6 +11,5 @@
- put into vextern.h and be referenced as a pointer with vdso prefix.
- The main kernel later fills in the values. */
-
--VEXTERN(jiffies)
- VEXTERN(vgetcpu_mode)
- VEXTERN(vsyscall_gtod_data)
-diff --git a/arch/x86/vdso/vma.c b/arch/x86/vdso/vma.c
-index 21e1aeb..2c0b3c4 100644
---- a/arch/x86/vdso/vma.c
-+++ b/arch/x86/vdso/vma.c
-@@ -17,8 +17,6 @@
- #include "vextern.h" /* Just for VMAGIC. */
- #undef VEXTERN
-
--unsigned int __read_mostly vdso_enabled = 1;
--
- extern char vdso_start[], vdso_end[];
- extern unsigned short vdso_sync_cpuid;
-
-@@ -27,10 +25,8 @@ static unsigned vdso_size;
-
- static inline void *var_ref(void *p, char *name)
- {
-- if (*(void **)p != (void *)VMAGIC) {
-- printk("VDSO: variable %s broken\n", name);
-- vdso_enabled = 0;
-- }
-+ if (*(void **)p != (void *)VMAGIC)
-+ panic("VDSO: variable %s broken\n", name);
- return p;
- }
-
-@@ -57,21 +53,18 @@ static int __init init_vdso_vars(void)
- if (!vbase)
- goto oom;
-
-- if (memcmp(vbase, "\177ELF", 4)) {
-- printk("VDSO: I'm broken; not ELF\n");
-- vdso_enabled = 0;
-- }
-+ if (memcmp(vbase, ELFMAG, SELFMAG))
-+ panic("VDSO: I'm broken; not ELF\n");
-
- #define VEXTERN(x) \
- *(typeof(__ ## x) **) var_ref(VDSO64_SYMBOL(vbase, x), #x) = &__ ## x;
- #include "vextern.h"
- #undef VEXTERN
-+ vunmap(vbase);
- return 0;
-
- oom:
-- printk("Cannot allocate vdso\n");
-- vdso_enabled = 0;
-- return -ENOMEM;
-+ panic("Cannot allocate vdso\n");
- }
- __initcall(init_vdso_vars);
-
-@@ -102,13 +95,15 @@ static unsigned long vdso_addr(unsigned long start, unsigned len)
- int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
- {
- struct mm_struct *mm = current->mm;
-- unsigned long addr;
-+ unsigned long addr = 0;
- int ret;
-
-- if (!vdso_enabled)
-- return 0;
--
- down_write(&mm->mmap_sem);
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- addr = vdso_addr(mm->start_stack, vdso_size);
- addr = get_unmapped_area(NULL, addr, vdso_size, 0, 0);
- if (IS_ERR_VALUE(addr)) {
-@@ -116,7 +111,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
- goto up_fail;
- }
-
-- current->mm->context.vdso = (void *)addr;
-+ current->mm->context.vdso = addr;
-
- ret = install_special_mapping(mm, addr, vdso_size,
- VM_READ|VM_EXEC|
-@@ -124,7 +119,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
- VM_ALWAYSDUMP,
- vdso_pages);
- if (ret) {
-- current->mm->context.vdso = NULL;
-+ current->mm->context.vdso = 0;
- goto up_fail;
- }
-
-@@ -132,10 +127,3 @@ up_fail:
- up_write(&mm->mmap_sem);
- return ret;
- }
--
--static __init int vdso_setup(char *s)
--{
-- vdso_enabled = simple_strtoul(s, NULL, 0);
-- return 0;
--}
--__setup("vdso=", vdso_setup);
-diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
-index d52f895..499ef73 100644
---- a/arch/x86/xen/enlighten.c
-+++ b/arch/x86/xen/enlighten.c
-@@ -71,8 +71,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
-
- struct shared_info xen_dummy_shared_info;
-
--void *xen_initial_gdt;
--
- /*
- * Point at some empty memory to start with. We map the real shared_info
- * page as soon as fixmap is up and running.
-@@ -336,8 +334,7 @@ static void xen_load_gdt(const struct desc_ptr *dtr)
- {
- unsigned long va = dtr->address;
- unsigned int size = dtr->size + 1;
-- unsigned pages = (size + PAGE_SIZE - 1) / PAGE_SIZE;
-- unsigned long frames[pages];
-+ unsigned long frames[65536 / PAGE_SIZE];
- int f;
-
- /*
-@@ -385,8 +382,7 @@ static __init void xen_load_gdt_boot(const struct desc_ptr *dtr)
- {
- unsigned long va = dtr->address;
- unsigned int size = dtr->size + 1;
-- unsigned pages = (size + PAGE_SIZE - 1) / PAGE_SIZE;
-- unsigned long frames[pages];
-+ unsigned long frames[65536 / PAGE_SIZE];
- int f;
-
- /*
-@@ -548,7 +544,7 @@ static void xen_write_idt_entry(gate_desc *dt, int entrynum, const gate_desc *g)
-
- preempt_disable();
-
-- start = __get_cpu_var(idt_desc).address;
-+ start = (unsigned long)__get_cpu_var(idt_desc).address;
- end = start + __get_cpu_var(idt_desc).size + 1;
-
- xen_mc_flush();
-@@ -718,12 +714,12 @@ static u32 xen_safe_apic_wait_icr_idle(void)
-
- static void set_xen_basic_apic_ops(void)
- {
-- apic->read = xen_apic_read;
-- apic->write = xen_apic_write;
-- apic->icr_read = xen_apic_icr_read;
-- apic->icr_write = xen_apic_icr_write;
-- apic->wait_icr_idle = xen_apic_wait_icr_idle;
-- apic->safe_wait_icr_idle = xen_safe_apic_wait_icr_idle;
-+ *(void **)&apic->read = xen_apic_read;
-+ *(void **)&apic->write = xen_apic_write;
-+ *(void **)&apic->icr_read = xen_apic_icr_read;
-+ *(void **)&apic->icr_write = xen_apic_icr_write;
-+ *(void **)&apic->wait_icr_idle = xen_apic_wait_icr_idle;
-+ *(void **)&apic->safe_wait_icr_idle = xen_safe_apic_wait_icr_idle;
- }
-
- #endif
-@@ -996,7 +992,7 @@ static const struct pv_apic_ops xen_apic_ops __initdata = {
- #endif
- };
-
--static void xen_reboot(int reason)
-+static __noreturn void xen_reboot(int reason)
- {
- struct sched_shutdown r = { .reason = reason };
-
-@@ -1004,17 +1000,17 @@ static void xen_reboot(int reason)
- BUG();
- }
-
--static void xen_restart(char *msg)
-+static __noreturn void xen_restart(char *msg)
- {
- xen_reboot(SHUTDOWN_reboot);
- }
-
--static void xen_emergency_restart(void)
-+static __noreturn void xen_emergency_restart(void)
- {
- xen_reboot(SHUTDOWN_reboot);
- }
-
--static void xen_machine_halt(void)
-+static __noreturn void xen_machine_halt(void)
- {
- xen_reboot(SHUTDOWN_poweroff);
- }
-@@ -1040,14 +1036,14 @@ static const struct machine_ops __initdata xen_machine_ops = {
- */
- static void __init xen_setup_stackprotector(void)
- {
-- pv_cpu_ops.write_gdt_entry = xen_write_gdt_entry_boot;
-- pv_cpu_ops.load_gdt = xen_load_gdt_boot;
-+ *(void **)&pv_cpu_ops.write_gdt_entry = xen_write_gdt_entry_boot;
-+ *(void **)&pv_cpu_ops.load_gdt = xen_load_gdt_boot;
-
- setup_stack_canary_segment(0);
- switch_to_new_gdt(0);
-
-- pv_cpu_ops.write_gdt_entry = xen_write_gdt_entry;
-- pv_cpu_ops.load_gdt = xen_load_gdt;
-+ *(void **)&pv_cpu_ops.write_gdt_entry = xen_write_gdt_entry;
-+ *(void **)&pv_cpu_ops.load_gdt = xen_load_gdt;
- }
-
- /* First C function to be called on Xen boot */
-@@ -1062,22 +1058,22 @@ asmlinkage void __init xen_start_kernel(void)
-
- /* Install Xen paravirt ops */
- pv_info = xen_info;
-- pv_init_ops = xen_init_ops;
-- pv_time_ops = xen_time_ops;
-- pv_cpu_ops = xen_cpu_ops;
-- pv_apic_ops = xen_apic_ops;
-+ memcpy((void *)&pv_init_ops, &xen_init_ops, sizeof pv_init_ops);
-+ memcpy((void *)&pv_time_ops, &xen_time_ops, sizeof pv_time_ops);
-+ memcpy((void *)&pv_cpu_ops, &xen_cpu_ops, sizeof pv_cpu_ops);
-+ memcpy((void *)&pv_apic_ops, &xen_apic_ops, sizeof pv_apic_ops);
-
-- x86_init.resources.memory_setup = xen_memory_setup;
-- x86_init.oem.arch_setup = xen_arch_setup;
-- x86_init.oem.banner = xen_banner;
-+ *(void **)&x86_init.resources.memory_setup = xen_memory_setup;
-+ *(void **)&x86_init.oem.arch_setup = xen_arch_setup;
-+ *(void **)&x86_init.oem.banner = xen_banner;
-
-- x86_init.timers.timer_init = xen_time_init;
-- x86_init.timers.setup_percpu_clockev = x86_init_noop;
-- x86_cpuinit.setup_percpu_clockev = x86_init_noop;
-+ *(void **)&x86_init.timers.timer_init = xen_time_init;
-+ *(void **)&x86_init.timers.setup_percpu_clockev = x86_init_noop;
-+ *(void **)&x86_cpuinit.setup_percpu_clockev = x86_init_noop;
-
-- x86_platform.calibrate_tsc = xen_tsc_khz;
-- x86_platform.get_wallclock = xen_get_wallclock;
-- x86_platform.set_wallclock = xen_set_wallclock;
-+ *(void **)&x86_platform.calibrate_tsc = xen_tsc_khz;
-+ *(void **)&x86_platform.get_wallclock = xen_get_wallclock;
-+ *(void **)&x86_platform.set_wallclock = xen_set_wallclock;
-
- /*
- * Set up some pagetable state before starting to set any ptes.
-@@ -1098,9 +1094,20 @@ asmlinkage void __init xen_start_kernel(void)
- */
- __userpte_alloc_gfp &= ~__GFP_HIGHMEM;
-
--#ifdef CONFIG_X86_64
- /* Work out if we support NX */
-- check_efer();
-+#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
-+ if ((cpuid_eax(0x80000000) & 0xffff0000) == 0x80000000 &&
-+ (cpuid_edx(0x80000001) & (1U << (X86_FEATURE_NX & 31)))) {
-+ unsigned l, h;
-+
-+#ifdef CONFIG_X86_PAE
-+ nx_enabled = 1;
-+#endif
-+ __supported_pte_mask |= _PAGE_NX;
-+ rdmsr(MSR_EFER, l, h);
-+ l |= EFER_NX;
-+ wrmsr(MSR_EFER, l, h);
-+ }
- #endif
-
- xen_setup_features();
-@@ -1130,14 +1137,7 @@ asmlinkage void __init xen_start_kernel(void)
- pv_mmu_ops.ptep_modify_prot_commit = xen_ptep_modify_prot_commit;
- }
-
-- machine_ops = xen_machine_ops;
--
-- /*
-- * The only reliable way to retain the initial address of the
-- * percpu gdt_page is to remember it here, so we can go and
-- * mark it RW later, when the initial percpu area is freed.
-- */
-- xen_initial_gdt = &per_cpu(gdt_page, 0);
-+ memcpy((void *)&machine_ops, &xen_machine_ops, sizeof machine_ops);
-
- xen_smp_init();
-
-diff --git a/arch/x86/xen/irq.c b/arch/x86/xen/irq.c
-index 9d30105..6774081 100644
---- a/arch/x86/xen/irq.c
-+++ b/arch/x86/xen/irq.c
-@@ -129,5 +129,5 @@ static const struct pv_irq_ops xen_irq_ops __initdata = {
- void __init xen_init_irq_ops()
- {
- pv_irq_ops = xen_irq_ops;
-- x86_init.irqs.intr_init = xen_init_IRQ;
-+ *(void **)&x86_init.irqs.intr_init = xen_init_IRQ;
- }
-diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
-index 8f4452c..3dd48c4 100644
---- a/arch/x86/xen/mmu.c
-+++ b/arch/x86/xen/mmu.c
-@@ -1717,6 +1717,9 @@ __init pgd_t *xen_setup_kernel_pagetable(pgd_t *pgd,
- convert_pfn_mfn(init_level4_pgt);
- convert_pfn_mfn(level3_ident_pgt);
- convert_pfn_mfn(level3_kernel_pgt);
-+ convert_pfn_mfn(level3_vmalloc_start_pgt);
-+ convert_pfn_mfn(level3_vmalloc_end_pgt);
-+ convert_pfn_mfn(level3_vmemmap_pgt);
-
- l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd);
- l2 = m2v(l3[pud_index(__START_KERNEL_map)].pud);
-@@ -1735,7 +1738,11 @@ __init pgd_t *xen_setup_kernel_pagetable(pgd_t *pgd,
- set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
- set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
- set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
-+ set_page_prot(level3_vmalloc_start_pgt, PAGE_KERNEL_RO);
-+ set_page_prot(level3_vmalloc_end_pgt, PAGE_KERNEL_RO);
-+ set_page_prot(level3_vmemmap_pgt, PAGE_KERNEL_RO);
- set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
-+ set_page_prot(level2_vmemmap_pgt, PAGE_KERNEL_RO);
- set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
- set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
-
-@@ -1858,6 +1865,7 @@ static __init void xen_post_allocator_init(void)
- pv_mmu_ops.set_pud = xen_set_pud;
- #if PAGETABLE_LEVELS == 4
- pv_mmu_ops.set_pgd = xen_set_pgd;
-+ pv_mmu_ops.set_pgd_batched = xen_set_pgd;
- #endif
-
- /* This will work as long as patching hasn't happened yet
-@@ -1944,6 +1952,7 @@ static const struct pv_mmu_ops xen_mmu_ops __initdata = {
- .pud_val = PV_CALLEE_SAVE(xen_pud_val),
- .make_pud = PV_CALLEE_SAVE(xen_make_pud),
- .set_pgd = xen_set_pgd_hyper,
-+ .set_pgd_batched = xen_set_pgd_hyper,
-
- .alloc_pud = xen_alloc_pmd_init,
- .release_pud = xen_release_pmd_init,
-@@ -1963,8 +1972,8 @@ static const struct pv_mmu_ops xen_mmu_ops __initdata = {
-
- void __init xen_init_mmu_ops(void)
- {
-- x86_init.paging.pagetable_setup_start = xen_pagetable_setup_start;
-- x86_init.paging.pagetable_setup_done = xen_pagetable_setup_done;
-+ *(void **)&x86_init.paging.pagetable_setup_start = xen_pagetable_setup_start;
-+ *(void **)&x86_init.paging.pagetable_setup_done = xen_pagetable_setup_done;
- pv_mmu_ops = xen_mmu_ops;
- }
-
-diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
-index ad0047f..cfec0c4 100644
---- a/arch/x86/xen/setup.c
-+++ b/arch/x86/xen/setup.c
-@@ -14,6 +14,7 @@
- #include <asm/e820.h>
- #include <asm/setup.h>
- #include <asm/acpi.h>
-+#include <asm/numa.h>
- #include <asm/xen/hypervisor.h>
- #include <asm/xen/hypercall.h>
-
-@@ -191,4 +192,7 @@ void __init xen_arch_setup(void)
- paravirt_disable_iospace();
-
- fiddle_vdso();
-+#ifdef CONFIG_NUMA
-+ numa_off = 1;
-+#endif
- }
-diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
-index a96204a..4d2ebba 100644
---- a/arch/x86/xen/smp.c
-+++ b/arch/x86/xen/smp.c
-@@ -168,11 +168,6 @@ static void __init xen_smp_prepare_boot_cpu(void)
- {
- BUG_ON(smp_processor_id() != 0);
- native_smp_prepare_boot_cpu();
--
-- /* We've switched to the "real" per-cpu gdt, so make sure the
-- old memory can be recycled */
-- make_lowmem_page_readwrite(xen_initial_gdt);
--
- xen_setup_vcpu_info_placement();
- }
-
-@@ -241,12 +236,12 @@ cpu_initialize_context(unsigned int cpu, struct task_struct *idle)
- gdt = get_cpu_gdt_table(cpu);
-
- ctxt->flags = VGCF_IN_KERNEL;
-- ctxt->user_regs.ds = __USER_DS;
-- ctxt->user_regs.es = __USER_DS;
-+ ctxt->user_regs.ds = __KERNEL_DS;
-+ ctxt->user_regs.es = __KERNEL_DS;
- ctxt->user_regs.ss = __KERNEL_DS;
- #ifdef CONFIG_X86_32
- ctxt->user_regs.fs = __KERNEL_PERCPU;
-- ctxt->user_regs.gs = __KERNEL_STACK_CANARY;
-+ savesegment(gs, ctxt->user_regs.gs);
- #else
- ctxt->gs_base_kernel = per_cpu_offset(cpu);
- #endif
-@@ -297,13 +292,12 @@ static int __cpuinit xen_cpu_up(unsigned int cpu)
- int rc;
-
- per_cpu(current_task, cpu) = idle;
-+ per_cpu(current_tinfo, cpu) = &idle->tinfo;
- #ifdef CONFIG_X86_32
- irq_ctx_init(cpu);
- #else
- clear_tsk_thread_flag(idle, TIF_FORK);
-- per_cpu(kernel_stack, cpu) =
-- (unsigned long)task_stack_page(idle) -
-- KERNEL_STACK_OFFSET + THREAD_SIZE;
-+ per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(idle) - 16 + THREAD_SIZE;
- #endif
- xen_setup_runstate_info(cpu);
- xen_setup_timer(cpu);
-@@ -485,7 +479,7 @@ static const struct smp_ops xen_smp_ops __initdata = {
-
- void __init xen_smp_init(void)
- {
-- smp_ops = xen_smp_ops;
-+ memcpy((void *)&smp_ops, &xen_smp_ops, sizeof smp_ops);
- xen_fill_possible_map();
- xen_init_spinlocks();
- }
-diff --git a/arch/x86/xen/spinlock.c b/arch/x86/xen/spinlock.c
-index 36a5141..4ef9c78 100644
---- a/arch/x86/xen/spinlock.c
-+++ b/arch/x86/xen/spinlock.c
-@@ -372,12 +372,12 @@ void xen_uninit_lock_cpu(int cpu)
-
- void __init xen_init_spinlocks(void)
- {
-- pv_lock_ops.spin_is_locked = xen_spin_is_locked;
-- pv_lock_ops.spin_is_contended = xen_spin_is_contended;
-- pv_lock_ops.spin_lock = xen_spin_lock;
-- pv_lock_ops.spin_lock_flags = xen_spin_lock_flags;
-- pv_lock_ops.spin_trylock = xen_spin_trylock;
-- pv_lock_ops.spin_unlock = xen_spin_unlock;
-+ *(void **)&pv_lock_ops.spin_is_locked = xen_spin_is_locked;
-+ *(void **)&pv_lock_ops.spin_is_contended = xen_spin_is_contended;
-+ *(void **)&pv_lock_ops.spin_lock = xen_spin_lock;
-+ *(void **)&pv_lock_ops.spin_lock_flags = xen_spin_lock_flags;
-+ *(void **)&pv_lock_ops.spin_trylock = xen_spin_trylock;
-+ *(void **)&pv_lock_ops.spin_unlock = xen_spin_unlock;
- }
-
- #ifdef CONFIG_XEN_DEBUG_FS
-diff --git a/arch/x86/xen/xen-asm_32.S b/arch/x86/xen/xen-asm_32.S
-index 9a95a9c..4f39e774 100644
---- a/arch/x86/xen/xen-asm_32.S
-+++ b/arch/x86/xen/xen-asm_32.S
-@@ -83,14 +83,14 @@ ENTRY(xen_iret)
- ESP_OFFSET=4 # bytes pushed onto stack
-
- /*
-- * Store vcpu_info pointer for easy access. Do it this way to
-- * avoid having to reload %fs
-+ * Store vcpu_info pointer for easy access.
- */
- #ifdef CONFIG_SMP
-- GET_THREAD_INFO(%eax)
-- movl TI_cpu(%eax), %eax
-- movl __per_cpu_offset(,%eax,4), %eax
-- mov per_cpu__xen_vcpu(%eax), %eax
-+ push %fs
-+ mov $(__KERNEL_PERCPU), %eax
-+ mov %eax, %fs
-+ mov PER_CPU_VAR(xen_vcpu), %eax
-+ pop %fs
- #else
- movl per_cpu__xen_vcpu, %eax
- #endif
-diff --git a/arch/x86/xen/xen-head.S b/arch/x86/xen/xen-head.S
-index 1a5ff24..a187d40 100644
---- a/arch/x86/xen/xen-head.S
-+++ b/arch/x86/xen/xen-head.S
-@@ -19,6 +19,17 @@ ENTRY(startup_xen)
- #ifdef CONFIG_X86_32
- mov %esi,xen_start_info
- mov $init_thread_union+THREAD_SIZE,%esp
-+#ifdef CONFIG_SMP
-+ movl $cpu_gdt_table,%edi
-+ movl $__per_cpu_load,%eax
-+ movw %ax,__KERNEL_PERCPU + 2(%edi)
-+ rorl $16,%eax
-+ movb %al,__KERNEL_PERCPU + 4(%edi)
-+ movb %ah,__KERNEL_PERCPU + 7(%edi)
-+ movl $__per_cpu_end - 1,%eax
-+ subl $__per_cpu_start,%eax
-+ movw %ax,__KERNEL_PERCPU + 0(%edi)
-+#endif
- #else
- mov %rsi,xen_start_info
- mov $init_thread_union+THREAD_SIZE,%rsp
-diff --git a/arch/x86/xen/xen-ops.h b/arch/x86/xen/xen-ops.h
-index f9153a3..51eab3d 100644
---- a/arch/x86/xen/xen-ops.h
-+++ b/arch/x86/xen/xen-ops.h
-@@ -10,8 +10,6 @@
- extern const char xen_hypervisor_callback[];
- extern const char xen_failsafe_callback[];
-
--extern void *xen_initial_gdt;
--
- struct trap_info;
- void xen_copy_trap_info(struct trap_info *traps);
-
-diff --git a/arch/xtensa/variants/dc232b/include/variant/core.h b/arch/xtensa/variants/dc232b/include/variant/core.h
-index 525bd3d..ef888b1 100644
---- a/arch/xtensa/variants/dc232b/include/variant/core.h
-+++ b/arch/xtensa/variants/dc232b/include/variant/core.h
-@@ -119,9 +119,9 @@
- ----------------------------------------------------------------------*/
-
- #define XCHAL_ICACHE_LINESIZE 32 /* I-cache line size in bytes */
--#define XCHAL_DCACHE_LINESIZE 32 /* D-cache line size in bytes */
- #define XCHAL_ICACHE_LINEWIDTH 5 /* log2(I line size in bytes) */
- #define XCHAL_DCACHE_LINEWIDTH 5 /* log2(D line size in bytes) */
-+#define XCHAL_DCACHE_LINESIZE (_AC(1,UL) << XCHAL_DCACHE_LINEWIDTH) /* D-cache line size in bytes */
-
- #define XCHAL_ICACHE_SIZE 16384 /* I-cache size in bytes or 0 */
- #define XCHAL_DCACHE_SIZE 16384 /* D-cache size in bytes or 0 */
-diff --git a/arch/xtensa/variants/fsf/include/variant/core.h b/arch/xtensa/variants/fsf/include/variant/core.h
-index 2f33760..835e50a 100644
---- a/arch/xtensa/variants/fsf/include/variant/core.h
-+++ b/arch/xtensa/variants/fsf/include/variant/core.h
-@@ -11,6 +11,7 @@
- #ifndef _XTENSA_CORE_H
- #define _XTENSA_CORE_H
-
-+#include <linux/const.h>
-
- /****************************************************************************
- Parameters Useful for Any Code, USER or PRIVILEGED
-@@ -112,9 +113,9 @@
- ----------------------------------------------------------------------*/
-
- #define XCHAL_ICACHE_LINESIZE 16 /* I-cache line size in bytes */
--#define XCHAL_DCACHE_LINESIZE 16 /* D-cache line size in bytes */
- #define XCHAL_ICACHE_LINEWIDTH 4 /* log2(I line size in bytes) */
- #define XCHAL_DCACHE_LINEWIDTH 4 /* log2(D line size in bytes) */
-+#define XCHAL_DCACHE_LINESIZE (_AC(1,UL) << XCHAL_DCACHE_LINEWIDTH) /* D-cache line size in bytes */
-
- #define XCHAL_ICACHE_SIZE 8192 /* I-cache size in bytes or 0 */
- #define XCHAL_DCACHE_SIZE 8192 /* D-cache size in bytes or 0 */
-diff --git a/arch/xtensa/variants/s6000/include/variant/core.h b/arch/xtensa/variants/s6000/include/variant/core.h
-index af00795..2bb8105 100644
---- a/arch/xtensa/variants/s6000/include/variant/core.h
-+++ b/arch/xtensa/variants/s6000/include/variant/core.h
-@@ -11,6 +11,7 @@
- #ifndef _XTENSA_CORE_CONFIGURATION_H
- #define _XTENSA_CORE_CONFIGURATION_H
-
-+#include <linux/const.h>
-
- /****************************************************************************
- Parameters Useful for Any Code, USER or PRIVILEGED
-@@ -118,9 +119,9 @@
- ----------------------------------------------------------------------*/
-
- #define XCHAL_ICACHE_LINESIZE 16 /* I-cache line size in bytes */
--#define XCHAL_DCACHE_LINESIZE 16 /* D-cache line size in bytes */
- #define XCHAL_ICACHE_LINEWIDTH 4 /* log2(I line size in bytes) */
- #define XCHAL_DCACHE_LINEWIDTH 4 /* log2(D line size in bytes) */
-+#define XCHAL_DCACHE_LINESIZE (_AC(1,UL) << XCHAL_DCACHE_LINEWIDTH) /* D-cache line size in bytes */
-
- #define XCHAL_ICACHE_SIZE 32768 /* I-cache size in bytes or 0 */
- #define XCHAL_DCACHE_SIZE 32768 /* D-cache size in bytes or 0 */
-diff --git a/block/blk-integrity.c b/block/blk-integrity.c
-index 15c6308..96e83c2 100644
---- a/block/blk-integrity.c
-+++ b/block/blk-integrity.c
-@@ -278,7 +278,7 @@ static struct attribute *integrity_attrs[] = {
- NULL,
- };
-
--static struct sysfs_ops integrity_ops = {
-+static const struct sysfs_ops integrity_ops = {
- .show = &integrity_attr_show,
- .store = &integrity_attr_store,
- };
-diff --git a/block/blk-iopoll.c b/block/blk-iopoll.c
-index ca56420..f2fc409 100644
---- a/block/blk-iopoll.c
-+++ b/block/blk-iopoll.c
-@@ -77,7 +77,7 @@ void blk_iopoll_complete(struct blk_iopoll *iopoll)
- }
- EXPORT_SYMBOL(blk_iopoll_complete);
-
--static void blk_iopoll_softirq(struct softirq_action *h)
-+static void blk_iopoll_softirq(void)
- {
- struct list_head *list = &__get_cpu_var(blk_cpu_iopoll);
- int rearm = 0, budget = blk_iopoll_budget;
-diff --git a/block/blk-map.c b/block/blk-map.c
-index 30a7e51..0aeec6a 100644
---- a/block/blk-map.c
-+++ b/block/blk-map.c
-@@ -54,7 +54,7 @@ static int __blk_rq_map_user(struct request_queue *q, struct request *rq,
- * direct dma. else, set up kernel bounce buffers
- */
- uaddr = (unsigned long) ubuf;
-- if (blk_rq_aligned(q, ubuf, len) && !map_data)
-+ if (blk_rq_aligned(q, (__force void *)ubuf, len) && !map_data)
- bio = bio_map_user(q, NULL, uaddr, len, reading, gfp_mask);
- else
- bio = bio_copy_user(q, map_data, uaddr, len, reading, gfp_mask);
-@@ -201,12 +201,13 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq,
- for (i = 0; i < iov_count; i++) {
- unsigned long uaddr = (unsigned long)iov[i].iov_base;
-
-+ if (!iov[i].iov_len)
-+ return -EINVAL;
-+
- if (uaddr & queue_dma_alignment(q)) {
- unaligned = 1;
- break;
- }
-- if (!iov[i].iov_len)
-- return -EINVAL;
- }
-
- if (unaligned || (q->dma_pad_mask & len) || map_data)
-@@ -299,7 +300,7 @@ int blk_rq_map_kern(struct request_queue *q, struct request *rq, void *kbuf,
- if (!len || !kbuf)
- return -EINVAL;
-
-- do_copy = !blk_rq_aligned(q, kbuf, len) || object_is_on_stack(kbuf);
-+ do_copy = !blk_rq_aligned(q, kbuf, len) || object_starts_on_stack(kbuf);
- if (do_copy)
- bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
- else
-diff --git a/block/blk-softirq.c b/block/blk-softirq.c
-index ee9c216..58d410a 100644
---- a/block/blk-softirq.c
-+++ b/block/blk-softirq.c
-@@ -17,7 +17,7 @@ static DEFINE_PER_CPU(struct list_head, blk_cpu_done);
- * Softirq action handler - move entries to local list and loop over them
- * while passing them to the queue registered handler.
- */
--static void blk_done_softirq(struct softirq_action *h)
-+static void blk_done_softirq(void)
- {
- struct list_head *cpu_list, local_list;
-
-diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
-index bb9c5ea..5330d48 100644
---- a/block/blk-sysfs.c
-+++ b/block/blk-sysfs.c
-@@ -414,7 +414,7 @@ static void blk_release_queue(struct kobject *kobj)
- kmem_cache_free(blk_requestq_cachep, q);
- }
-
--static struct sysfs_ops queue_sysfs_ops = {
-+static const struct sysfs_ops queue_sysfs_ops = {
- .show = queue_attr_show,
- .store = queue_attr_store,
- };
-diff --git a/block/bsg.c b/block/bsg.c
-index e3e3241..759ebf7 100644
---- a/block/bsg.c
-+++ b/block/bsg.c
-@@ -175,16 +175,24 @@ static int blk_fill_sgv4_hdr_rq(struct request_queue *q, struct request *rq,
- struct sg_io_v4 *hdr, struct bsg_device *bd,
- fmode_t has_write_perm)
- {
-+ unsigned char tmpcmd[sizeof(rq->__cmd)];
-+ unsigned char *cmdptr;
-+
- if (hdr->request_len > BLK_MAX_CDB) {
- rq->cmd = kzalloc(hdr->request_len, GFP_KERNEL);
- if (!rq->cmd)
- return -ENOMEM;
-- }
-+ cmdptr = rq->cmd;
-+ } else
-+ cmdptr = tmpcmd;
-
-- if (copy_from_user(rq->cmd, (void *)(unsigned long)hdr->request,
-+ if (copy_from_user(cmdptr, (void __user *)(unsigned long)hdr->request,
- hdr->request_len))
- return -EFAULT;
-
-+ if (cmdptr != rq->cmd)
-+ memcpy(rq->cmd, cmdptr, hdr->request_len);
-+
- if (hdr->subprotocol == BSG_SUB_PROTOCOL_SCSI_CMD) {
- if (blk_verify_command(rq->cmd, has_write_perm))
- return -EPERM;
-@@ -282,7 +290,7 @@ bsg_map_hdr(struct bsg_device *bd, struct sg_io_v4 *hdr, fmode_t has_write_perm,
- rq->next_rq = next_rq;
- next_rq->cmd_type = rq->cmd_type;
-
-- dxferp = (void*)(unsigned long)hdr->din_xferp;
-+ dxferp = (void __user *)(unsigned long)hdr->din_xferp;
- ret = blk_rq_map_user(q, next_rq, NULL, dxferp,
- hdr->din_xfer_len, GFP_KERNEL);
- if (ret)
-@@ -291,10 +299,10 @@ bsg_map_hdr(struct bsg_device *bd, struct sg_io_v4 *hdr, fmode_t has_write_perm,
-
- if (hdr->dout_xfer_len) {
- dxfer_len = hdr->dout_xfer_len;
-- dxferp = (void*)(unsigned long)hdr->dout_xferp;
-+ dxferp = (void __user *)(unsigned long)hdr->dout_xferp;
- } else if (hdr->din_xfer_len) {
- dxfer_len = hdr->din_xfer_len;
-- dxferp = (void*)(unsigned long)hdr->din_xferp;
-+ dxferp = (void __user *)(unsigned long)hdr->din_xferp;
- } else
- dxfer_len = 0;
-
-@@ -436,7 +444,7 @@ static int blk_complete_sgv4_hdr_rq(struct request *rq, struct sg_io_v4 *hdr,
- int len = min_t(unsigned int, hdr->max_response_len,
- rq->sense_len);
-
-- ret = copy_to_user((void*)(unsigned long)hdr->response,
-+ ret = copy_to_user((void __user *)(unsigned long)hdr->response,
- rq->sense, len);
- if (!ret)
- hdr->response_len = len;
-diff --git a/block/compat_ioctl.c b/block/compat_ioctl.c
-index 9bd086c..ca1fc22 100644
---- a/block/compat_ioctl.c
-+++ b/block/compat_ioctl.c
-@@ -354,7 +354,7 @@ static int compat_fd_ioctl(struct block_device *bdev, fmode_t mode,
- err |= __get_user(f->spec1, &uf->spec1);
- err |= __get_user(f->fmt_gap, &uf->fmt_gap);
- err |= __get_user(name, &uf->name);
-- f->name = compat_ptr(name);
-+ f->name = (void __force_kernel *)compat_ptr(name);
- if (err) {
- err = -EFAULT;
- goto out;
-diff --git a/block/elevator.c b/block/elevator.c
-index a847046..75a1746 100644
---- a/block/elevator.c
-+++ b/block/elevator.c
-@@ -889,7 +889,7 @@ elv_attr_store(struct kobject *kobj, struct attribute *attr,
- return error;
- }
-
--static struct sysfs_ops elv_sysfs_ops = {
-+static const struct sysfs_ops elv_sysfs_ops = {
- .show = elv_attr_show,
- .store = elv_attr_store,
- };
-diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
-index 2be0a97..bded3fd 100644
---- a/block/scsi_ioctl.c
-+++ b/block/scsi_ioctl.c
-@@ -221,8 +221,20 @@ EXPORT_SYMBOL(blk_verify_command);
- static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
- struct sg_io_hdr *hdr, fmode_t mode)
- {
-- if (copy_from_user(rq->cmd, hdr->cmdp, hdr->cmd_len))
-+ unsigned char tmpcmd[sizeof(rq->__cmd)];
-+ unsigned char *cmdptr;
-+
-+ if (rq->cmd != rq->__cmd)
-+ cmdptr = rq->cmd;
-+ else
-+ cmdptr = tmpcmd;
-+
-+ if (copy_from_user(cmdptr, hdr->cmdp, hdr->cmd_len))
- return -EFAULT;
-+
-+ if (cmdptr != rq->cmd)
-+ memcpy(rq->cmd, cmdptr, hdr->cmd_len);
-+
- if (blk_verify_command(rq->cmd, mode & FMODE_WRITE))
- return -EPERM;
-
-@@ -431,6 +443,8 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
- int err;
- unsigned int in_len, out_len, bytes, opcode, cmdlen;
- char *buffer = NULL, sense[SCSI_SENSE_BUFFERSIZE];
-+ unsigned char tmpcmd[sizeof(rq->__cmd)];
-+ unsigned char *cmdptr;
-
- if (!sic)
- return -EINVAL;
-@@ -464,9 +478,18 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
- */
- err = -EFAULT;
- rq->cmd_len = cmdlen;
-- if (copy_from_user(rq->cmd, sic->data, cmdlen))
-+
-+ if (rq->cmd != rq->__cmd)
-+ cmdptr = rq->cmd;
-+ else
-+ cmdptr = tmpcmd;
-+
-+ if (copy_from_user(cmdptr, sic->data, cmdlen))
- goto error;
-
-+ if (rq->cmd != cmdptr)
-+ memcpy(rq->cmd, cmdptr, cmdlen);
-+
- if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len))
- goto error;
-
-diff --git a/crypto/cryptd.c b/crypto/cryptd.c
-index 3533582..0efffdb 100644
---- a/crypto/cryptd.c
-+++ b/crypto/cryptd.c
-@@ -50,7 +50,7 @@ struct cryptd_blkcipher_ctx {
-
- struct cryptd_blkcipher_request_ctx {
- crypto_completion_t complete;
--};
-+} __no_const;
-
- struct cryptd_hash_ctx {
- struct crypto_shash *child;
-@@ -116,13 +116,18 @@ static void cryptd_queue_worker(struct work_struct *work)
- struct crypto_async_request *req, *backlog;
-
- cpu_queue = container_of(work, struct cryptd_cpu_queue, work);
-- /* Only handle one request at a time to avoid hogging crypto
-- * workqueue. preempt_disable/enable is used to prevent
-- * being preempted by cryptd_enqueue_request() */
-+ /*
-+ * Only handle one request at a time to avoid hogging crypto workqueue.
-+ * preempt_disable/enable is used to prevent being preempted by
-+ * cryptd_enqueue_request(). local_bh_disable/enable is used to prevent
-+ * cryptd_enqueue_request() being accessed from software interrupts.
-+ */
-+ local_bh_disable();
- preempt_disable();
- backlog = crypto_get_backlog(&cpu_queue->queue);
- req = crypto_dequeue_request(&cpu_queue->queue);
- preempt_enable();
-+ local_bh_enable();
-
- if (!req)
- return;
-diff --git a/crypto/gf128mul.c b/crypto/gf128mul.c
-index a90d260..7a9765e 100644
---- a/crypto/gf128mul.c
-+++ b/crypto/gf128mul.c
-@@ -182,7 +182,7 @@ void gf128mul_lle(be128 *r, const be128 *b)
- for (i = 0; i < 7; ++i)
- gf128mul_x_lle(&p[i + 1], &p[i]);
-
-- memset(r, 0, sizeof(r));
-+ memset(r, 0, sizeof(*r));
- for (i = 0;;) {
- u8 ch = ((u8 *)b)[15 - i];
-
-@@ -220,7 +220,7 @@ void gf128mul_bbe(be128 *r, const be128 *b)
- for (i = 0; i < 7; ++i)
- gf128mul_x_bbe(&p[i + 1], &p[i]);
-
-- memset(r, 0, sizeof(r));
-+ memset(r, 0, sizeof(*r));
- for (i = 0;;) {
- u8 ch = ((u8 *)b)[i];
-
-diff --git a/crypto/serpent.c b/crypto/serpent.c
-index b651a55..023297d 100644
---- a/crypto/serpent.c
-+++ b/crypto/serpent.c
-@@ -21,6 +21,7 @@
- #include <asm/byteorder.h>
- #include <linux/crypto.h>
- #include <linux/types.h>
-+#include <linux/sched.h>
-
- /* Key is padded to the maximum of 256 bits before round key generation.
- * Any key length <= 256 bits (32 bytes) is allowed by the algorithm.
-@@ -224,6 +225,8 @@ static int serpent_setkey(struct crypto_tfm *tfm, const u8 *key,
- u32 r0,r1,r2,r3,r4;
- int i;
-
-+ pax_track_stack();
-+
- /* Copy key, add padding */
-
- for (i = 0; i < keylen; ++i)
-diff --git a/drivers/acpi/acpi_pad.c b/drivers/acpi/acpi_pad.c
-index 0d2cdb8..d8de48d 100644
---- a/drivers/acpi/acpi_pad.c
-+++ b/drivers/acpi/acpi_pad.c
-@@ -30,7 +30,7 @@
- #include <acpi/acpi_bus.h>
- #include <acpi/acpi_drivers.h>
-
--#define ACPI_PROCESSOR_AGGREGATOR_CLASS "processor_aggregator"
-+#define ACPI_PROCESSOR_AGGREGATOR_CLASS "acpi_pad"
- #define ACPI_PROCESSOR_AGGREGATOR_DEVICE_NAME "Processor Aggregator"
- #define ACPI_PROCESSOR_AGGREGATOR_NOTIFY 0x80
- static DEFINE_MUTEX(isolated_cpus_lock);
-diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
-index 3f4602b..2e41d36 100644
---- a/drivers/acpi/battery.c
-+++ b/drivers/acpi/battery.c
-@@ -763,7 +763,7 @@ DECLARE_FILE_FUNCTIONS(alarm);
- }
-
- static struct battery_file {
-- struct file_operations ops;
-+ const struct file_operations ops;
- mode_t mode;
- const char *name;
- } acpi_battery_file[] = {
-diff --git a/drivers/acpi/dock.c b/drivers/acpi/dock.c
-index 7338b6a..82f0257 100644
---- a/drivers/acpi/dock.c
-+++ b/drivers/acpi/dock.c
-@@ -77,7 +77,7 @@ struct dock_dependent_device {
- struct list_head list;
- struct list_head hotplug_list;
- acpi_handle handle;
-- struct acpi_dock_ops *ops;
-+ const struct acpi_dock_ops *ops;
- void *context;
- };
-
-@@ -605,7 +605,7 @@ EXPORT_SYMBOL_GPL(unregister_dock_notifier);
- * the dock driver after _DCK is executed.
- */
- int
--register_hotplug_dock_device(acpi_handle handle, struct acpi_dock_ops *ops,
-+register_hotplug_dock_device(acpi_handle handle, const struct acpi_dock_ops *ops,
- void *context)
- {
- struct dock_dependent_device *dd;
-diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
-index 7c1c59e..2993595 100644
---- a/drivers/acpi/osl.c
-+++ b/drivers/acpi/osl.c
-@@ -523,6 +523,8 @@ acpi_os_read_memory(acpi_physical_address phys_addr, u32 * value, u32 width)
- void __iomem *virt_addr;
-
- virt_addr = ioremap(phys_addr, width);
-+ if (!virt_addr)
-+ return AE_NO_MEMORY;
- if (!value)
- value = &dummy;
-
-@@ -551,6 +553,8 @@ acpi_os_write_memory(acpi_physical_address phys_addr, u32 value, u32 width)
- void __iomem *virt_addr;
-
- virt_addr = ioremap(phys_addr, width);
-+ if (!virt_addr)
-+ return AE_NO_MEMORY;
-
- switch (width) {
- case 8:
-diff --git a/drivers/acpi/power_meter.c b/drivers/acpi/power_meter.c
-index c216062..eec10d2 100644
---- a/drivers/acpi/power_meter.c
-+++ b/drivers/acpi/power_meter.c
-@@ -315,8 +315,6 @@ static ssize_t set_trip(struct device *dev, struct device_attribute *devattr,
- return res;
-
- temp /= 1000;
-- if (temp < 0)
-- return -EINVAL;
-
- mutex_lock(&resource->lock);
- resource->trip[attr->index - 7] = temp;
-diff --git a/drivers/acpi/proc.c b/drivers/acpi/proc.c
-index d0d25e2..961643d 100644
---- a/drivers/acpi/proc.c
-+++ b/drivers/acpi/proc.c
-@@ -391,20 +391,15 @@ acpi_system_write_wakeup_device(struct file *file,
- size_t count, loff_t * ppos)
- {
- struct list_head *node, *next;
-- char strbuf[5];
-- char str[5] = "";
-- unsigned int len = count;
-+ char strbuf[5] = {0};
- struct acpi_device *found_dev = NULL;
-
-- if (len > 4)
-- len = 4;
-- if (len < 0)
-- return -EFAULT;
-+ if (count > 4)
-+ count = 4;
-
-- if (copy_from_user(strbuf, buffer, len))
-+ if (copy_from_user(strbuf, buffer, count))
- return -EFAULT;
-- strbuf[len] = '\0';
-- sscanf(strbuf, "%s", str);
-+ strbuf[count] = '\0';
-
- mutex_lock(&acpi_device_lock);
- list_for_each_safe(node, next, &acpi_wakeup_device_list) {
-@@ -413,7 +408,7 @@ acpi_system_write_wakeup_device(struct file *file,
- if (!dev->wakeup.flags.valid)
- continue;
-
-- if (!strncmp(dev->pnp.bus_id, str, 4)) {
-+ if (!strncmp(dev->pnp.bus_id, strbuf, 4)) {
- dev->wakeup.state.enabled =
- dev->wakeup.state.enabled ? 0 : 1;
- found_dev = dev;
-diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
-index 7102474..de8ad22 100644
---- a/drivers/acpi/processor_core.c
-+++ b/drivers/acpi/processor_core.c
-@@ -790,7 +790,7 @@ static int __cpuinit acpi_processor_add(struct acpi_device *device)
- return 0;
- }
-
-- BUG_ON((pr->id >= nr_cpu_ids) || (pr->id < 0));
-+ BUG_ON(pr->id >= nr_cpu_ids);
-
- /*
- * Buggy BIOS check
-diff --git a/drivers/acpi/sbshc.c b/drivers/acpi/sbshc.c
-index d933980..5761f13 100644
---- a/drivers/acpi/sbshc.c
-+++ b/drivers/acpi/sbshc.c
-@@ -17,7 +17,7 @@
-
- #define PREFIX "ACPI: "
-
--#define ACPI_SMB_HC_CLASS "smbus_host_controller"
-+#define ACPI_SMB_HC_CLASS "smbus_host_ctl"
- #define ACPI_SMB_HC_DEVICE_NAME "ACPI SMBus HC"
-
- struct acpi_smb_hc {
-diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
-index 0458094..6978e7b 100644
---- a/drivers/acpi/sleep.c
-+++ b/drivers/acpi/sleep.c
-@@ -283,7 +283,7 @@ static int acpi_suspend_state_valid(suspend_state_t pm_state)
- }
- }
-
--static struct platform_suspend_ops acpi_suspend_ops = {
-+static const struct platform_suspend_ops acpi_suspend_ops = {
- .valid = acpi_suspend_state_valid,
- .begin = acpi_suspend_begin,
- .prepare_late = acpi_pm_prepare,
-@@ -311,7 +311,7 @@ static int acpi_suspend_begin_old(suspend_state_t pm_state)
- * The following callbacks are used if the pre-ACPI 2.0 suspend ordering has
- * been requested.
- */
--static struct platform_suspend_ops acpi_suspend_ops_old = {
-+static const struct platform_suspend_ops acpi_suspend_ops_old = {
- .valid = acpi_suspend_state_valid,
- .begin = acpi_suspend_begin_old,
- .prepare_late = acpi_pm_disable_gpes,
-@@ -460,7 +460,7 @@ static void acpi_pm_enable_gpes(void)
- acpi_enable_all_runtime_gpes();
- }
-
--static struct platform_hibernation_ops acpi_hibernation_ops = {
-+static const struct platform_hibernation_ops acpi_hibernation_ops = {
- .begin = acpi_hibernation_begin,
- .end = acpi_pm_end,
- .pre_snapshot = acpi_hibernation_pre_snapshot,
-@@ -513,7 +513,7 @@ static int acpi_hibernation_pre_snapshot_old(void)
- * The following callbacks are used if the pre-ACPI 2.0 suspend ordering has
- * been requested.
- */
--static struct platform_hibernation_ops acpi_hibernation_ops_old = {
-+static const struct platform_hibernation_ops acpi_hibernation_ops_old = {
- .begin = acpi_hibernation_begin_old,
- .end = acpi_pm_end,
- .pre_snapshot = acpi_hibernation_pre_snapshot_old,
-diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
-index 05dff63..b662ab7 100644
---- a/drivers/acpi/video.c
-+++ b/drivers/acpi/video.c
-@@ -359,7 +359,7 @@ static int acpi_video_set_brightness(struct backlight_device *bd)
- vd->brightness->levels[request_level]);
- }
-
--static struct backlight_ops acpi_backlight_ops = {
-+static const struct backlight_ops acpi_backlight_ops = {
- .get_brightness = acpi_video_get_brightness,
- .update_status = acpi_video_set_brightness,
- };
-diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
-index 6787aab..23ffb0e 100644
---- a/drivers/ata/ahci.c
-+++ b/drivers/ata/ahci.c
-@@ -387,7 +387,7 @@ static struct scsi_host_template ahci_sht = {
- .sdev_attrs = ahci_sdev_attrs,
- };
-
--static struct ata_port_operations ahci_ops = {
-+static const struct ata_port_operations ahci_ops = {
- .inherits = &sata_pmp_port_ops,
-
- .qc_defer = sata_pmp_qc_defer_cmd_switch,
-@@ -424,17 +424,17 @@ static struct ata_port_operations ahci_ops = {
- .port_stop = ahci_port_stop,
- };
-
--static struct ata_port_operations ahci_vt8251_ops = {
-+static const struct ata_port_operations ahci_vt8251_ops = {
- .inherits = &ahci_ops,
- .hardreset = ahci_vt8251_hardreset,
- };
-
--static struct ata_port_operations ahci_p5wdh_ops = {
-+static const struct ata_port_operations ahci_p5wdh_ops = {
- .inherits = &ahci_ops,
- .hardreset = ahci_p5wdh_hardreset,
- };
-
--static struct ata_port_operations ahci_sb600_ops = {
-+static const struct ata_port_operations ahci_sb600_ops = {
- .inherits = &ahci_ops,
- .softreset = ahci_sb600_softreset,
- .pmp_softreset = ahci_sb600_softreset,
-diff --git a/drivers/ata/ata_generic.c b/drivers/ata/ata_generic.c
-index 99e7196..4968c77 100644
---- a/drivers/ata/ata_generic.c
-+++ b/drivers/ata/ata_generic.c
-@@ -104,7 +104,7 @@ static struct scsi_host_template generic_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations generic_port_ops = {
-+static const struct ata_port_operations generic_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = ata_cable_unknown,
- .set_mode = generic_set_mode,
-diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
-index c33591d..000c121 100644
---- a/drivers/ata/ata_piix.c
-+++ b/drivers/ata/ata_piix.c
-@@ -318,7 +318,7 @@ static struct scsi_host_template piix_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations piix_pata_ops = {
-+static const struct ata_port_operations piix_pata_ops = {
- .inherits = &ata_bmdma32_port_ops,
- .cable_detect = ata_cable_40wire,
- .set_piomode = piix_set_piomode,
-@@ -326,22 +326,22 @@ static struct ata_port_operations piix_pata_ops = {
- .prereset = piix_pata_prereset,
- };
-
--static struct ata_port_operations piix_vmw_ops = {
-+static const struct ata_port_operations piix_vmw_ops = {
- .inherits = &piix_pata_ops,
- .bmdma_status = piix_vmw_bmdma_status,
- };
-
--static struct ata_port_operations ich_pata_ops = {
-+static const struct ata_port_operations ich_pata_ops = {
- .inherits = &piix_pata_ops,
- .cable_detect = ich_pata_cable_detect,
- .set_dmamode = ich_set_dmamode,
- };
-
--static struct ata_port_operations piix_sata_ops = {
-+static const struct ata_port_operations piix_sata_ops = {
- .inherits = &ata_bmdma_port_ops,
- };
-
--static struct ata_port_operations piix_sidpr_sata_ops = {
-+static const struct ata_port_operations piix_sidpr_sata_ops = {
- .inherits = &piix_sata_ops,
- .hardreset = sata_std_hardreset,
- .scr_read = piix_sidpr_scr_read,
-diff --git a/drivers/ata/libata-acpi.c b/drivers/ata/libata-acpi.c
-index b0882cd..c295d65 100644
---- a/drivers/ata/libata-acpi.c
-+++ b/drivers/ata/libata-acpi.c
-@@ -223,12 +223,12 @@ static void ata_acpi_dev_uevent(acpi_handle handle, u32 event, void *data)
- ata_acpi_uevent(dev->link->ap, dev, event);
- }
-
--static struct acpi_dock_ops ata_acpi_dev_dock_ops = {
-+static const struct acpi_dock_ops ata_acpi_dev_dock_ops = {
- .handler = ata_acpi_dev_notify_dock,
- .uevent = ata_acpi_dev_uevent,
- };
-
--static struct acpi_dock_ops ata_acpi_ap_dock_ops = {
-+static const struct acpi_dock_ops ata_acpi_ap_dock_ops = {
- .handler = ata_acpi_ap_notify_dock,
- .uevent = ata_acpi_ap_uevent,
- };
-diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
-index d4f7f99..94f603e 100644
---- a/drivers/ata/libata-core.c
-+++ b/drivers/ata/libata-core.c
-@@ -4954,7 +4954,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
- struct ata_port *ap;
- unsigned int tag;
-
-- WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
-+ BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
- ap = qc->ap;
-
- qc->flags = 0;
-@@ -4970,7 +4970,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc)
- struct ata_port *ap;
- struct ata_link *link;
-
-- WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
-+ BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
- WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE));
- ap = qc->ap;
- link = qc->dev->link;
-@@ -5987,7 +5987,7 @@ static void ata_host_stop(struct device *gendev, void *res)
- * LOCKING:
- * None.
- */
--static void ata_finalize_port_ops(struct ata_port_operations *ops)
-+static void ata_finalize_port_ops(const struct ata_port_operations *ops)
- {
- static DEFINE_SPINLOCK(lock);
- const struct ata_port_operations *cur;
-@@ -5999,6 +5999,7 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
- return;
-
- spin_lock(&lock);
-+ pax_open_kernel();
-
- for (cur = ops->inherits; cur; cur = cur->inherits) {
- void **inherit = (void **)cur;
-@@ -6012,8 +6013,9 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
- if (IS_ERR(*pp))
- *pp = NULL;
-
-- ops->inherits = NULL;
-+ *(struct ata_port_operations **)&ops->inherits = NULL;
-
-+ pax_close_kernel();
- spin_unlock(&lock);
- }
-
-@@ -6110,7 +6112,7 @@ int ata_host_start(struct ata_host *host)
- */
- /* KILLME - the only user left is ipr */
- void ata_host_init(struct ata_host *host, struct device *dev,
-- unsigned long flags, struct ata_port_operations *ops)
-+ unsigned long flags, const struct ata_port_operations *ops)
- {
- spin_lock_init(&host->lock);
- host->dev = dev;
-@@ -6773,7 +6775,7 @@ static void ata_dummy_error_handler(struct ata_port *ap)
- /* truly dummy */
- }
-
--struct ata_port_operations ata_dummy_port_ops = {
-+const struct ata_port_operations ata_dummy_port_ops = {
- .qc_prep = ata_noop_qc_prep,
- .qc_issue = ata_dummy_qc_issue,
- .error_handler = ata_dummy_error_handler,
-diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
-index e5bdb9b..45a8e72 100644
---- a/drivers/ata/libata-eh.c
-+++ b/drivers/ata/libata-eh.c
-@@ -2423,6 +2423,8 @@ void ata_eh_report(struct ata_port *ap)
- {
- struct ata_link *link;
-
-+ pax_track_stack();
-+
- ata_for_each_link(link, ap, HOST_FIRST)
- ata_eh_link_report(link);
- }
-@@ -3594,7 +3596,7 @@ void ata_do_eh(struct ata_port *ap, ata_prereset_fn_t prereset,
- */
- void ata_std_error_handler(struct ata_port *ap)
- {
-- struct ata_port_operations *ops = ap->ops;
-+ const struct ata_port_operations *ops = ap->ops;
- ata_reset_fn_t hardreset = ops->hardreset;
-
- /* ignore built-in hardreset if SCR access is not available */
-diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c
-index 51f0ffb..19ce3e3 100644
---- a/drivers/ata/libata-pmp.c
-+++ b/drivers/ata/libata-pmp.c
-@@ -841,7 +841,7 @@ static int sata_pmp_handle_link_fail(struct ata_link *link, int *link_tries)
- */
- static int sata_pmp_eh_recover(struct ata_port *ap)
- {
-- struct ata_port_operations *ops = ap->ops;
-+ const struct ata_port_operations *ops = ap->ops;
- int pmp_tries, link_tries[SATA_PMP_MAX_PORTS];
- struct ata_link *pmp_link = &ap->link;
- struct ata_device *pmp_dev = pmp_link->device;
-diff --git a/drivers/ata/pata_acpi.c b/drivers/ata/pata_acpi.c
-index d8f35fe..288180a 100644
---- a/drivers/ata/pata_acpi.c
-+++ b/drivers/ata/pata_acpi.c
-@@ -215,7 +215,7 @@ static struct scsi_host_template pacpi_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations pacpi_ops = {
-+static const struct ata_port_operations pacpi_ops = {
- .inherits = &ata_bmdma_port_ops,
- .qc_issue = pacpi_qc_issue,
- .cable_detect = pacpi_cable_detect,
-diff --git a/drivers/ata/pata_ali.c b/drivers/ata/pata_ali.c
-index 9434114..1f2f364 100644
---- a/drivers/ata/pata_ali.c
-+++ b/drivers/ata/pata_ali.c
-@@ -365,7 +365,7 @@ static struct scsi_host_template ali_sht = {
- * Port operations for PIO only ALi
- */
-
--static struct ata_port_operations ali_early_port_ops = {
-+static const struct ata_port_operations ali_early_port_ops = {
- .inherits = &ata_sff_port_ops,
- .cable_detect = ata_cable_40wire,
- .set_piomode = ali_set_piomode,
-@@ -382,7 +382,7 @@ static const struct ata_port_operations ali_dma_base_ops = {
- * Port operations for DMA capable ALi without cable
- * detect
- */
--static struct ata_port_operations ali_20_port_ops = {
-+static const struct ata_port_operations ali_20_port_ops = {
- .inherits = &ali_dma_base_ops,
- .cable_detect = ata_cable_40wire,
- .mode_filter = ali_20_filter,
-@@ -393,7 +393,7 @@ static struct ata_port_operations ali_20_port_ops = {
- /*
- * Port operations for DMA capable ALi with cable detect
- */
--static struct ata_port_operations ali_c2_port_ops = {
-+static const struct ata_port_operations ali_c2_port_ops = {
- .inherits = &ali_dma_base_ops,
- .check_atapi_dma = ali_check_atapi_dma,
- .cable_detect = ali_c2_cable_detect,
-@@ -404,7 +404,7 @@ static struct ata_port_operations ali_c2_port_ops = {
- /*
- * Port operations for DMA capable ALi with cable detect
- */
--static struct ata_port_operations ali_c4_port_ops = {
-+static const struct ata_port_operations ali_c4_port_ops = {
- .inherits = &ali_dma_base_ops,
- .check_atapi_dma = ali_check_atapi_dma,
- .cable_detect = ali_c2_cable_detect,
-@@ -414,7 +414,7 @@ static struct ata_port_operations ali_c4_port_ops = {
- /*
- * Port operations for DMA capable ALi with cable detect and LBA48
- */
--static struct ata_port_operations ali_c5_port_ops = {
-+static const struct ata_port_operations ali_c5_port_ops = {
- .inherits = &ali_dma_base_ops,
- .check_atapi_dma = ali_check_atapi_dma,
- .dev_config = ali_warn_atapi_dma,
-diff --git a/drivers/ata/pata_amd.c b/drivers/ata/pata_amd.c
-index 567f3f7..c8ee0da 100644
---- a/drivers/ata/pata_amd.c
-+++ b/drivers/ata/pata_amd.c
-@@ -397,28 +397,28 @@ static const struct ata_port_operations amd_base_port_ops = {
- .prereset = amd_pre_reset,
- };
-
--static struct ata_port_operations amd33_port_ops = {
-+static const struct ata_port_operations amd33_port_ops = {
- .inherits = &amd_base_port_ops,
- .cable_detect = ata_cable_40wire,
- .set_piomode = amd33_set_piomode,
- .set_dmamode = amd33_set_dmamode,
- };
-
--static struct ata_port_operations amd66_port_ops = {
-+static const struct ata_port_operations amd66_port_ops = {
- .inherits = &amd_base_port_ops,
- .cable_detect = ata_cable_unknown,
- .set_piomode = amd66_set_piomode,
- .set_dmamode = amd66_set_dmamode,
- };
-
--static struct ata_port_operations amd100_port_ops = {
-+static const struct ata_port_operations amd100_port_ops = {
- .inherits = &amd_base_port_ops,
- .cable_detect = ata_cable_unknown,
- .set_piomode = amd100_set_piomode,
- .set_dmamode = amd100_set_dmamode,
- };
-
--static struct ata_port_operations amd133_port_ops = {
-+static const struct ata_port_operations amd133_port_ops = {
- .inherits = &amd_base_port_ops,
- .cable_detect = amd_cable_detect,
- .set_piomode = amd133_set_piomode,
-@@ -433,13 +433,13 @@ static const struct ata_port_operations nv_base_port_ops = {
- .host_stop = nv_host_stop,
- };
-
--static struct ata_port_operations nv100_port_ops = {
-+static const struct ata_port_operations nv100_port_ops = {
- .inherits = &nv_base_port_ops,
- .set_piomode = nv100_set_piomode,
- .set_dmamode = nv100_set_dmamode,
- };
-
--static struct ata_port_operations nv133_port_ops = {
-+static const struct ata_port_operations nv133_port_ops = {
- .inherits = &nv_base_port_ops,
- .set_piomode = nv133_set_piomode,
- .set_dmamode = nv133_set_dmamode,
-diff --git a/drivers/ata/pata_artop.c b/drivers/ata/pata_artop.c
-index d332cfd..4b7eaae 100644
---- a/drivers/ata/pata_artop.c
-+++ b/drivers/ata/pata_artop.c
-@@ -311,7 +311,7 @@ static struct scsi_host_template artop_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations artop6210_ops = {
-+static const struct ata_port_operations artop6210_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = ata_cable_40wire,
- .set_piomode = artop6210_set_piomode,
-@@ -320,7 +320,7 @@ static struct ata_port_operations artop6210_ops = {
- .qc_defer = artop6210_qc_defer,
- };
-
--static struct ata_port_operations artop6260_ops = {
-+static const struct ata_port_operations artop6260_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = artop6260_cable_detect,
- .set_piomode = artop6260_set_piomode,
-diff --git a/drivers/ata/pata_at32.c b/drivers/ata/pata_at32.c
-index 5c129f9..7bb7ccb 100644
---- a/drivers/ata/pata_at32.c
-+++ b/drivers/ata/pata_at32.c
-@@ -172,7 +172,7 @@ static struct scsi_host_template at32_sht = {
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations at32_port_ops = {
-+static const struct ata_port_operations at32_port_ops = {
- .inherits = &ata_sff_port_ops,
- .cable_detect = ata_cable_40wire,
- .set_piomode = pata_at32_set_piomode,
-diff --git a/drivers/ata/pata_at91.c b/drivers/ata/pata_at91.c
-index 41c94b1..829006d 100644
---- a/drivers/ata/pata_at91.c
-+++ b/drivers/ata/pata_at91.c
-@@ -195,7 +195,7 @@ static struct scsi_host_template pata_at91_sht = {
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations pata_at91_port_ops = {
-+static const struct ata_port_operations pata_at91_port_ops = {
- .inherits = &ata_sff_port_ops,
-
- .sff_data_xfer = pata_at91_data_xfer_noirq,
-diff --git a/drivers/ata/pata_atiixp.c b/drivers/ata/pata_atiixp.c
-index ae4454d..d391eb4 100644
---- a/drivers/ata/pata_atiixp.c
-+++ b/drivers/ata/pata_atiixp.c
-@@ -205,7 +205,7 @@ static struct scsi_host_template atiixp_sht = {
- .sg_tablesize = LIBATA_DUMB_MAX_PRD,
- };
-
--static struct ata_port_operations atiixp_port_ops = {
-+static const struct ata_port_operations atiixp_port_ops = {
- .inherits = &ata_bmdma_port_ops,
-
- .qc_prep = ata_sff_dumb_qc_prep,
-diff --git a/drivers/ata/pata_atp867x.c b/drivers/ata/pata_atp867x.c
-index 6fe7ded..2a425dc 100644
---- a/drivers/ata/pata_atp867x.c
-+++ b/drivers/ata/pata_atp867x.c
-@@ -274,7 +274,7 @@ static struct scsi_host_template atp867x_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations atp867x_ops = {
-+static const struct ata_port_operations atp867x_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = atp867x_cable_detect,
- .set_piomode = atp867x_set_piomode,
-diff --git a/drivers/ata/pata_bf54x.c b/drivers/ata/pata_bf54x.c
-index c4b47a3..b27a367 100644
---- a/drivers/ata/pata_bf54x.c
-+++ b/drivers/ata/pata_bf54x.c
-@@ -1464,7 +1464,7 @@ static struct scsi_host_template bfin_sht = {
- .dma_boundary = ATA_DMA_BOUNDARY,
- };
-
--static struct ata_port_operations bfin_pata_ops = {
-+static const struct ata_port_operations bfin_pata_ops = {
- .inherits = &ata_sff_port_ops,
-
- .set_piomode = bfin_set_piomode,
-diff --git a/drivers/ata/pata_cmd640.c b/drivers/ata/pata_cmd640.c
-index 5acf9fa..84248be 100644
---- a/drivers/ata/pata_cmd640.c
-+++ b/drivers/ata/pata_cmd640.c
-@@ -168,7 +168,7 @@ static struct scsi_host_template cmd640_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations cmd640_port_ops = {
-+static const struct ata_port_operations cmd640_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- /* In theory xfer_noirq is not needed once we kill the prefetcher */
- .sff_data_xfer = ata_sff_data_xfer_noirq,
-diff --git a/drivers/ata/pata_cmd64x.c b/drivers/ata/pata_cmd64x.c
-index ccd2694..c869c3d 100644
---- a/drivers/ata/pata_cmd64x.c
-+++ b/drivers/ata/pata_cmd64x.c
-@@ -271,18 +271,18 @@ static const struct ata_port_operations cmd64x_base_ops = {
- .set_dmamode = cmd64x_set_dmamode,
- };
-
--static struct ata_port_operations cmd64x_port_ops = {
-+static const struct ata_port_operations cmd64x_port_ops = {
- .inherits = &cmd64x_base_ops,
- .cable_detect = ata_cable_40wire,
- };
-
--static struct ata_port_operations cmd646r1_port_ops = {
-+static const struct ata_port_operations cmd646r1_port_ops = {
- .inherits = &cmd64x_base_ops,
- .bmdma_stop = cmd646r1_bmdma_stop,
- .cable_detect = ata_cable_40wire,
- };
-
--static struct ata_port_operations cmd648_port_ops = {
-+static const struct ata_port_operations cmd648_port_ops = {
- .inherits = &cmd64x_base_ops,
- .bmdma_stop = cmd648_bmdma_stop,
- .cable_detect = cmd648_cable_detect,
-diff --git a/drivers/ata/pata_cs5520.c b/drivers/ata/pata_cs5520.c
-index 0df83cf..d7595b0 100644
---- a/drivers/ata/pata_cs5520.c
-+++ b/drivers/ata/pata_cs5520.c
-@@ -144,7 +144,7 @@ static struct scsi_host_template cs5520_sht = {
- .sg_tablesize = LIBATA_DUMB_MAX_PRD,
- };
-
--static struct ata_port_operations cs5520_port_ops = {
-+static const struct ata_port_operations cs5520_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .qc_prep = ata_sff_dumb_qc_prep,
- .cable_detect = ata_cable_40wire,
-diff --git a/drivers/ata/pata_cs5530.c b/drivers/ata/pata_cs5530.c
-index c974b05..6d26b11 100644
---- a/drivers/ata/pata_cs5530.c
-+++ b/drivers/ata/pata_cs5530.c
-@@ -164,7 +164,7 @@ static struct scsi_host_template cs5530_sht = {
- .sg_tablesize = LIBATA_DUMB_MAX_PRD,
- };
-
--static struct ata_port_operations cs5530_port_ops = {
-+static const struct ata_port_operations cs5530_port_ops = {
- .inherits = &ata_bmdma_port_ops,
-
- .qc_prep = ata_sff_dumb_qc_prep,
-diff --git a/drivers/ata/pata_cs5535.c b/drivers/ata/pata_cs5535.c
-index 403f561..aacd26b 100644
---- a/drivers/ata/pata_cs5535.c
-+++ b/drivers/ata/pata_cs5535.c
-@@ -160,7 +160,7 @@ static struct scsi_host_template cs5535_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations cs5535_port_ops = {
-+static const struct ata_port_operations cs5535_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = cs5535_cable_detect,
- .set_piomode = cs5535_set_piomode,
-diff --git a/drivers/ata/pata_cs5536.c b/drivers/ata/pata_cs5536.c
-index 6da4cb4..de24a25 100644
---- a/drivers/ata/pata_cs5536.c
-+++ b/drivers/ata/pata_cs5536.c
-@@ -223,7 +223,7 @@ static struct scsi_host_template cs5536_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations cs5536_port_ops = {
-+static const struct ata_port_operations cs5536_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = cs5536_cable_detect,
- .set_piomode = cs5536_set_piomode,
-diff --git a/drivers/ata/pata_cypress.c b/drivers/ata/pata_cypress.c
-index 8fb040b..b16a9c9 100644
---- a/drivers/ata/pata_cypress.c
-+++ b/drivers/ata/pata_cypress.c
-@@ -113,7 +113,7 @@ static struct scsi_host_template cy82c693_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations cy82c693_port_ops = {
-+static const struct ata_port_operations cy82c693_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = ata_cable_40wire,
- .set_piomode = cy82c693_set_piomode,
-diff --git a/drivers/ata/pata_efar.c b/drivers/ata/pata_efar.c
-index 2a6412f..555ee11 100644
---- a/drivers/ata/pata_efar.c
-+++ b/drivers/ata/pata_efar.c
-@@ -222,7 +222,7 @@ static struct scsi_host_template efar_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations efar_ops = {
-+static const struct ata_port_operations efar_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = efar_cable_detect,
- .set_piomode = efar_set_piomode,
-diff --git a/drivers/ata/pata_hpt366.c b/drivers/ata/pata_hpt366.c
-index b9d8836..0b92030 100644
---- a/drivers/ata/pata_hpt366.c
-+++ b/drivers/ata/pata_hpt366.c
-@@ -282,7 +282,7 @@ static struct scsi_host_template hpt36x_sht = {
- * Configuration for HPT366/68
- */
-
--static struct ata_port_operations hpt366_port_ops = {
-+static const struct ata_port_operations hpt366_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = hpt36x_cable_detect,
- .mode_filter = hpt366_filter,
-diff --git a/drivers/ata/pata_hpt37x.c b/drivers/ata/pata_hpt37x.c
-index 5af7f19..00c4980 100644
---- a/drivers/ata/pata_hpt37x.c
-+++ b/drivers/ata/pata_hpt37x.c
-@@ -576,7 +576,7 @@ static struct scsi_host_template hpt37x_sht = {
- * Configuration for HPT370
- */
-
--static struct ata_port_operations hpt370_port_ops = {
-+static const struct ata_port_operations hpt370_port_ops = {
- .inherits = &ata_bmdma_port_ops,
-
- .bmdma_stop = hpt370_bmdma_stop,
-@@ -591,7 +591,7 @@ static struct ata_port_operations hpt370_port_ops = {
- * Configuration for HPT370A. Close to 370 but less filters
- */
-
--static struct ata_port_operations hpt370a_port_ops = {
-+static const struct ata_port_operations hpt370a_port_ops = {
- .inherits = &hpt370_port_ops,
- .mode_filter = hpt370a_filter,
- };
-@@ -601,7 +601,7 @@ static struct ata_port_operations hpt370a_port_ops = {
- * and DMA mode setting functionality.
- */
-
--static struct ata_port_operations hpt372_port_ops = {
-+static const struct ata_port_operations hpt372_port_ops = {
- .inherits = &ata_bmdma_port_ops,
-
- .bmdma_stop = hpt37x_bmdma_stop,
-@@ -616,7 +616,7 @@ static struct ata_port_operations hpt372_port_ops = {
- * but we have a different cable detection procedure for function 1.
- */
-
--static struct ata_port_operations hpt374_fn1_port_ops = {
-+static const struct ata_port_operations hpt374_fn1_port_ops = {
- .inherits = &hpt372_port_ops,
- .prereset = hpt374_fn1_pre_reset,
- };
-diff --git a/drivers/ata/pata_hpt3x2n.c b/drivers/ata/pata_hpt3x2n.c
-index 100f227..2e39382 100644
---- a/drivers/ata/pata_hpt3x2n.c
-+++ b/drivers/ata/pata_hpt3x2n.c
-@@ -337,7 +337,7 @@ static struct scsi_host_template hpt3x2n_sht = {
- * Configuration for HPT3x2n.
- */
-
--static struct ata_port_operations hpt3x2n_port_ops = {
-+static const struct ata_port_operations hpt3x2n_port_ops = {
- .inherits = &ata_bmdma_port_ops,
-
- .bmdma_stop = hpt3x2n_bmdma_stop,
-diff --git a/drivers/ata/pata_hpt3x3.c b/drivers/ata/pata_hpt3x3.c
-index 7e31025..6fca8f4 100644
---- a/drivers/ata/pata_hpt3x3.c
-+++ b/drivers/ata/pata_hpt3x3.c
-@@ -141,7 +141,7 @@ static struct scsi_host_template hpt3x3_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations hpt3x3_port_ops = {
-+static const struct ata_port_operations hpt3x3_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = ata_cable_40wire,
- .set_piomode = hpt3x3_set_piomode,
-diff --git a/drivers/ata/pata_icside.c b/drivers/ata/pata_icside.c
-index b663b7f..9a26c2a 100644
---- a/drivers/ata/pata_icside.c
-+++ b/drivers/ata/pata_icside.c
-@@ -319,7 +319,7 @@ static void pata_icside_postreset(struct ata_link *link, unsigned int *classes)
- }
- }
-
--static struct ata_port_operations pata_icside_port_ops = {
-+static const struct ata_port_operations pata_icside_port_ops = {
- .inherits = &ata_sff_port_ops,
- /* no need to build any PRD tables for DMA */
- .qc_prep = ata_noop_qc_prep,
-diff --git a/drivers/ata/pata_isapnp.c b/drivers/ata/pata_isapnp.c
-index 4bceb88..457dfb6 100644
---- a/drivers/ata/pata_isapnp.c
-+++ b/drivers/ata/pata_isapnp.c
-@@ -23,12 +23,12 @@ static struct scsi_host_template isapnp_sht = {
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations isapnp_port_ops = {
-+static const struct ata_port_operations isapnp_port_ops = {
- .inherits = &ata_sff_port_ops,
- .cable_detect = ata_cable_40wire,
- };
-
--static struct ata_port_operations isapnp_noalt_port_ops = {
-+static const struct ata_port_operations isapnp_noalt_port_ops = {
- .inherits = &ata_sff_port_ops,
- .cable_detect = ata_cable_40wire,
- /* No altstatus so we don't want to use the lost interrupt poll */
-diff --git a/drivers/ata/pata_it8213.c b/drivers/ata/pata_it8213.c
-index f156da8..24976e2 100644
---- a/drivers/ata/pata_it8213.c
-+++ b/drivers/ata/pata_it8213.c
-@@ -234,7 +234,7 @@ static struct scsi_host_template it8213_sht = {
- };
-
-
--static struct ata_port_operations it8213_ops = {
-+static const struct ata_port_operations it8213_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = it8213_cable_detect,
- .set_piomode = it8213_set_piomode,
-diff --git a/drivers/ata/pata_it821x.c b/drivers/ata/pata_it821x.c
-index 188bc2f..ca9e785 100644
---- a/drivers/ata/pata_it821x.c
-+++ b/drivers/ata/pata_it821x.c
-@@ -800,7 +800,7 @@ static struct scsi_host_template it821x_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations it821x_smart_port_ops = {
-+static const struct ata_port_operations it821x_smart_port_ops = {
- .inherits = &ata_bmdma_port_ops,
-
- .check_atapi_dma= it821x_check_atapi_dma,
-@@ -814,7 +814,7 @@ static struct ata_port_operations it821x_smart_port_ops = {
- .port_start = it821x_port_start,
- };
-
--static struct ata_port_operations it821x_passthru_port_ops = {
-+static const struct ata_port_operations it821x_passthru_port_ops = {
- .inherits = &ata_bmdma_port_ops,
-
- .check_atapi_dma= it821x_check_atapi_dma,
-@@ -830,7 +830,7 @@ static struct ata_port_operations it821x_passthru_port_ops = {
- .port_start = it821x_port_start,
- };
-
--static struct ata_port_operations it821x_rdc_port_ops = {
-+static const struct ata_port_operations it821x_rdc_port_ops = {
- .inherits = &ata_bmdma_port_ops,
-
- .check_atapi_dma= it821x_check_atapi_dma,
-diff --git a/drivers/ata/pata_ixp4xx_cf.c b/drivers/ata/pata_ixp4xx_cf.c
-index ba54b08..4b952b7 100644
---- a/drivers/ata/pata_ixp4xx_cf.c
-+++ b/drivers/ata/pata_ixp4xx_cf.c
-@@ -89,7 +89,7 @@ static struct scsi_host_template ixp4xx_sht = {
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations ixp4xx_port_ops = {
-+static const struct ata_port_operations ixp4xx_port_ops = {
- .inherits = &ata_sff_port_ops,
- .sff_data_xfer = ixp4xx_mmio_data_xfer,
- .cable_detect = ata_cable_40wire,
-diff --git a/drivers/ata/pata_jmicron.c b/drivers/ata/pata_jmicron.c
-index 3a1474a..434b0ff 100644
---- a/drivers/ata/pata_jmicron.c
-+++ b/drivers/ata/pata_jmicron.c
-@@ -111,7 +111,7 @@ static struct scsi_host_template jmicron_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations jmicron_ops = {
-+static const struct ata_port_operations jmicron_ops = {
- .inherits = &ata_bmdma_port_ops,
- .prereset = jmicron_pre_reset,
- };
-diff --git a/drivers/ata/pata_legacy.c b/drivers/ata/pata_legacy.c
-index 6932e56..220e71d 100644
---- a/drivers/ata/pata_legacy.c
-+++ b/drivers/ata/pata_legacy.c
-@@ -106,7 +106,7 @@ struct legacy_probe {
-
- struct legacy_controller {
- const char *name;
-- struct ata_port_operations *ops;
-+ const struct ata_port_operations *ops;
- unsigned int pio_mask;
- unsigned int flags;
- unsigned int pflags;
-@@ -223,12 +223,12 @@ static const struct ata_port_operations legacy_base_port_ops = {
- * pio_mask as well.
- */
-
--static struct ata_port_operations simple_port_ops = {
-+static const struct ata_port_operations simple_port_ops = {
- .inherits = &legacy_base_port_ops,
- .sff_data_xfer = ata_sff_data_xfer_noirq,
- };
-
--static struct ata_port_operations legacy_port_ops = {
-+static const struct ata_port_operations legacy_port_ops = {
- .inherits = &legacy_base_port_ops,
- .sff_data_xfer = ata_sff_data_xfer_noirq,
- .set_mode = legacy_set_mode,
-@@ -324,7 +324,7 @@ static unsigned int pdc_data_xfer_vlb(struct ata_device *dev,
- return buflen;
- }
-
--static struct ata_port_operations pdc20230_port_ops = {
-+static const struct ata_port_operations pdc20230_port_ops = {
- .inherits = &legacy_base_port_ops,
- .set_piomode = pdc20230_set_piomode,
- .sff_data_xfer = pdc_data_xfer_vlb,
-@@ -357,7 +357,7 @@ static void ht6560a_set_piomode(struct ata_port *ap, struct ata_device *adev)
- ioread8(ap->ioaddr.status_addr);
- }
-
--static struct ata_port_operations ht6560a_port_ops = {
-+static const struct ata_port_operations ht6560a_port_ops = {
- .inherits = &legacy_base_port_ops,
- .set_piomode = ht6560a_set_piomode,
- };
-@@ -400,7 +400,7 @@ static void ht6560b_set_piomode(struct ata_port *ap, struct ata_device *adev)
- ioread8(ap->ioaddr.status_addr);
- }
-
--static struct ata_port_operations ht6560b_port_ops = {
-+static const struct ata_port_operations ht6560b_port_ops = {
- .inherits = &legacy_base_port_ops,
- .set_piomode = ht6560b_set_piomode,
- };
-@@ -499,7 +499,7 @@ static void opti82c611a_set_piomode(struct ata_port *ap,
- }
-
-
--static struct ata_port_operations opti82c611a_port_ops = {
-+static const struct ata_port_operations opti82c611a_port_ops = {
- .inherits = &legacy_base_port_ops,
- .set_piomode = opti82c611a_set_piomode,
- };
-@@ -609,7 +609,7 @@ static unsigned int opti82c46x_qc_issue(struct ata_queued_cmd *qc)
- return ata_sff_qc_issue(qc);
- }
-
--static struct ata_port_operations opti82c46x_port_ops = {
-+static const struct ata_port_operations opti82c46x_port_ops = {
- .inherits = &legacy_base_port_ops,
- .set_piomode = opti82c46x_set_piomode,
- .qc_issue = opti82c46x_qc_issue,
-@@ -771,20 +771,20 @@ static int qdi_port(struct platform_device *dev,
- return 0;
- }
-
--static struct ata_port_operations qdi6500_port_ops = {
-+static const struct ata_port_operations qdi6500_port_ops = {
- .inherits = &legacy_base_port_ops,
- .set_piomode = qdi6500_set_piomode,
- .qc_issue = qdi_qc_issue,
- .sff_data_xfer = vlb32_data_xfer,
- };
-
--static struct ata_port_operations qdi6580_port_ops = {
-+static const struct ata_port_operations qdi6580_port_ops = {
- .inherits = &legacy_base_port_ops,
- .set_piomode = qdi6580_set_piomode,
- .sff_data_xfer = vlb32_data_xfer,
- };
-
--static struct ata_port_operations qdi6580dp_port_ops = {
-+static const struct ata_port_operations qdi6580dp_port_ops = {
- .inherits = &legacy_base_port_ops,
- .set_piomode = qdi6580dp_set_piomode,
- .sff_data_xfer = vlb32_data_xfer,
-@@ -855,7 +855,7 @@ static int winbond_port(struct platform_device *dev,
- return 0;
- }
-
--static struct ata_port_operations winbond_port_ops = {
-+static const struct ata_port_operations winbond_port_ops = {
- .inherits = &legacy_base_port_ops,
- .set_piomode = winbond_set_piomode,
- .sff_data_xfer = vlb32_data_xfer,
-@@ -978,7 +978,7 @@ static __init int legacy_init_one(struct legacy_probe *probe)
- int pio_modes = controller->pio_mask;
- unsigned long io = probe->port;
- u32 mask = (1 << probe->slot);
-- struct ata_port_operations *ops = controller->ops;
-+ const struct ata_port_operations *ops = controller->ops;
- struct legacy_data *ld = &legacy_data[probe->slot];
- struct ata_host *host = NULL;
- struct ata_port *ap;
-diff --git a/drivers/ata/pata_marvell.c b/drivers/ata/pata_marvell.c
-index 2096fb7..4d090fc 100644
---- a/drivers/ata/pata_marvell.c
-+++ b/drivers/ata/pata_marvell.c
-@@ -100,7 +100,7 @@ static struct scsi_host_template marvell_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations marvell_ops = {
-+static const struct ata_port_operations marvell_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = marvell_cable_detect,
- .prereset = marvell_pre_reset,
-diff --git a/drivers/ata/pata_mpc52xx.c b/drivers/ata/pata_mpc52xx.c
-index 99d41be..7d56aa8 100644
---- a/drivers/ata/pata_mpc52xx.c
-+++ b/drivers/ata/pata_mpc52xx.c
-@@ -609,7 +609,7 @@ static struct scsi_host_template mpc52xx_ata_sht = {
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations mpc52xx_ata_port_ops = {
-+static const struct ata_port_operations mpc52xx_ata_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .sff_dev_select = mpc52xx_ata_dev_select,
- .set_piomode = mpc52xx_ata_set_piomode,
-diff --git a/drivers/ata/pata_mpiix.c b/drivers/ata/pata_mpiix.c
-index b21f002..0a27e7f 100644
---- a/drivers/ata/pata_mpiix.c
-+++ b/drivers/ata/pata_mpiix.c
-@@ -140,7 +140,7 @@ static struct scsi_host_template mpiix_sht = {
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations mpiix_port_ops = {
-+static const struct ata_port_operations mpiix_port_ops = {
- .inherits = &ata_sff_port_ops,
- .qc_issue = mpiix_qc_issue,
- .cable_detect = ata_cable_40wire,
-diff --git a/drivers/ata/pata_netcell.c b/drivers/ata/pata_netcell.c
-index f0d52f7..89c3be3 100644
---- a/drivers/ata/pata_netcell.c
-+++ b/drivers/ata/pata_netcell.c
-@@ -34,7 +34,7 @@ static struct scsi_host_template netcell_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations netcell_ops = {
-+static const struct ata_port_operations netcell_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = ata_cable_80wire,
- .read_id = netcell_read_id,
-diff --git a/drivers/ata/pata_ninja32.c b/drivers/ata/pata_ninja32.c
-index dd53a66..a3f4317 100644
---- a/drivers/ata/pata_ninja32.c
-+++ b/drivers/ata/pata_ninja32.c
-@@ -81,7 +81,7 @@ static struct scsi_host_template ninja32_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations ninja32_port_ops = {
-+static const struct ata_port_operations ninja32_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .sff_dev_select = ninja32_dev_select,
- .cable_detect = ata_cable_40wire,
-diff --git a/drivers/ata/pata_ns87410.c b/drivers/ata/pata_ns87410.c
-index ca53fac..9aa93ef 100644
---- a/drivers/ata/pata_ns87410.c
-+++ b/drivers/ata/pata_ns87410.c
-@@ -132,7 +132,7 @@ static struct scsi_host_template ns87410_sht = {
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations ns87410_port_ops = {
-+static const struct ata_port_operations ns87410_port_ops = {
- .inherits = &ata_sff_port_ops,
- .qc_issue = ns87410_qc_issue,
- .cable_detect = ata_cable_40wire,
-diff --git a/drivers/ata/pata_ns87415.c b/drivers/ata/pata_ns87415.c
-index 773b159..55f454e 100644
---- a/drivers/ata/pata_ns87415.c
-+++ b/drivers/ata/pata_ns87415.c
-@@ -299,7 +299,7 @@ static u8 ns87560_bmdma_status(struct ata_port *ap)
- }
- #endif /* 87560 SuperIO Support */
-
--static struct ata_port_operations ns87415_pata_ops = {
-+static const struct ata_port_operations ns87415_pata_ops = {
- .inherits = &ata_bmdma_port_ops,
-
- .check_atapi_dma = ns87415_check_atapi_dma,
-@@ -313,7 +313,7 @@ static struct ata_port_operations ns87415_pata_ops = {
- };
-
- #if defined(CONFIG_SUPERIO)
--static struct ata_port_operations ns87560_pata_ops = {
-+static const struct ata_port_operations ns87560_pata_ops = {
- .inherits = &ns87415_pata_ops,
- .sff_tf_read = ns87560_tf_read,
- .sff_check_status = ns87560_check_status,
-diff --git a/drivers/ata/pata_octeon_cf.c b/drivers/ata/pata_octeon_cf.c
-index d6f6956..639295b 100644
---- a/drivers/ata/pata_octeon_cf.c
-+++ b/drivers/ata/pata_octeon_cf.c
-@@ -801,6 +801,7 @@ static unsigned int octeon_cf_qc_issue(struct ata_queued_cmd *qc)
- return 0;
- }
-
-+/* cannot be const */
- static struct ata_port_operations octeon_cf_ops = {
- .inherits = &ata_sff_port_ops,
- .check_atapi_dma = octeon_cf_check_atapi_dma,
-diff --git a/drivers/ata/pata_oldpiix.c b/drivers/ata/pata_oldpiix.c
-index 84ac503..adee1cd 100644
---- a/drivers/ata/pata_oldpiix.c
-+++ b/drivers/ata/pata_oldpiix.c
-@@ -208,7 +208,7 @@ static struct scsi_host_template oldpiix_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations oldpiix_pata_ops = {
-+static const struct ata_port_operations oldpiix_pata_ops = {
- .inherits = &ata_bmdma_port_ops,
- .qc_issue = oldpiix_qc_issue,
- .cable_detect = ata_cable_40wire,
-diff --git a/drivers/ata/pata_opti.c b/drivers/ata/pata_opti.c
-index 99eddda..3a4c0aa 100644
---- a/drivers/ata/pata_opti.c
-+++ b/drivers/ata/pata_opti.c
-@@ -152,7 +152,7 @@ static struct scsi_host_template opti_sht = {
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations opti_port_ops = {
-+static const struct ata_port_operations opti_port_ops = {
- .inherits = &ata_sff_port_ops,
- .cable_detect = ata_cable_40wire,
- .set_piomode = opti_set_piomode,
-diff --git a/drivers/ata/pata_optidma.c b/drivers/ata/pata_optidma.c
-index 86885a4..8e9968d 100644
---- a/drivers/ata/pata_optidma.c
-+++ b/drivers/ata/pata_optidma.c
-@@ -337,7 +337,7 @@ static struct scsi_host_template optidma_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations optidma_port_ops = {
-+static const struct ata_port_operations optidma_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = ata_cable_40wire,
- .set_piomode = optidma_set_pio_mode,
-@@ -346,7 +346,7 @@ static struct ata_port_operations optidma_port_ops = {
- .prereset = optidma_pre_reset,
- };
-
--static struct ata_port_operations optiplus_port_ops = {
-+static const struct ata_port_operations optiplus_port_ops = {
- .inherits = &optidma_port_ops,
- .set_piomode = optiplus_set_pio_mode,
- .set_dmamode = optiplus_set_dma_mode,
-diff --git a/drivers/ata/pata_palmld.c b/drivers/ata/pata_palmld.c
-index 11fb4cc..1a14022 100644
---- a/drivers/ata/pata_palmld.c
-+++ b/drivers/ata/pata_palmld.c
-@@ -37,7 +37,7 @@ static struct scsi_host_template palmld_sht = {
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations palmld_port_ops = {
-+static const struct ata_port_operations palmld_port_ops = {
- .inherits = &ata_sff_port_ops,
- .sff_data_xfer = ata_sff_data_xfer_noirq,
- .cable_detect = ata_cable_40wire,
-diff --git a/drivers/ata/pata_pcmcia.c b/drivers/ata/pata_pcmcia.c
-index dc99e26..7f4b1e4 100644
---- a/drivers/ata/pata_pcmcia.c
-+++ b/drivers/ata/pata_pcmcia.c
-@@ -162,14 +162,14 @@ static struct scsi_host_template pcmcia_sht = {
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations pcmcia_port_ops = {
-+static const struct ata_port_operations pcmcia_port_ops = {
- .inherits = &ata_sff_port_ops,
- .sff_data_xfer = ata_sff_data_xfer_noirq,
- .cable_detect = ata_cable_40wire,
- .set_mode = pcmcia_set_mode,
- };
-
--static struct ata_port_operations pcmcia_8bit_port_ops = {
-+static const struct ata_port_operations pcmcia_8bit_port_ops = {
- .inherits = &ata_sff_port_ops,
- .sff_data_xfer = ata_data_xfer_8bit,
- .cable_detect = ata_cable_40wire,
-@@ -256,7 +256,7 @@ static int pcmcia_init_one(struct pcmcia_device *pdev)
- unsigned long io_base, ctl_base;
- void __iomem *io_addr, *ctl_addr;
- int n_ports = 1;
-- struct ata_port_operations *ops = &pcmcia_port_ops;
-+ const struct ata_port_operations *ops = &pcmcia_port_ops;
-
- info = kzalloc(sizeof(*info), GFP_KERNEL);
- if (info == NULL)
-diff --git a/drivers/ata/pata_pdc2027x.c b/drivers/ata/pata_pdc2027x.c
-index ca5cad0..3a1f125 100644
---- a/drivers/ata/pata_pdc2027x.c
-+++ b/drivers/ata/pata_pdc2027x.c
-@@ -132,14 +132,14 @@ static struct scsi_host_template pdc2027x_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations pdc2027x_pata100_ops = {
-+static const struct ata_port_operations pdc2027x_pata100_ops = {
- .inherits = &ata_bmdma_port_ops,
- .check_atapi_dma = pdc2027x_check_atapi_dma,
- .cable_detect = pdc2027x_cable_detect,
- .prereset = pdc2027x_prereset,
- };
-
--static struct ata_port_operations pdc2027x_pata133_ops = {
-+static const struct ata_port_operations pdc2027x_pata133_ops = {
- .inherits = &pdc2027x_pata100_ops,
- .mode_filter = pdc2027x_mode_filter,
- .set_piomode = pdc2027x_set_piomode,
-diff --git a/drivers/ata/pata_pdc202xx_old.c b/drivers/ata/pata_pdc202xx_old.c
-index 2911120..4bf62aa 100644
---- a/drivers/ata/pata_pdc202xx_old.c
-+++ b/drivers/ata/pata_pdc202xx_old.c
-@@ -274,7 +274,7 @@ static struct scsi_host_template pdc202xx_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations pdc2024x_port_ops = {
-+static const struct ata_port_operations pdc2024x_port_ops = {
- .inherits = &ata_bmdma_port_ops,
-
- .cable_detect = ata_cable_40wire,
-@@ -284,7 +284,7 @@ static struct ata_port_operations pdc2024x_port_ops = {
- .sff_exec_command = pdc202xx_exec_command,
- };
-
--static struct ata_port_operations pdc2026x_port_ops = {
-+static const struct ata_port_operations pdc2026x_port_ops = {
- .inherits = &pdc2024x_port_ops,
-
- .check_atapi_dma = pdc2026x_check_atapi_dma,
-diff --git a/drivers/ata/pata_platform.c b/drivers/ata/pata_platform.c
-index 3f6ebc6..a18c358 100644
---- a/drivers/ata/pata_platform.c
-+++ b/drivers/ata/pata_platform.c
-@@ -48,7 +48,7 @@ static struct scsi_host_template pata_platform_sht = {
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations pata_platform_port_ops = {
-+static const struct ata_port_operations pata_platform_port_ops = {
- .inherits = &ata_sff_port_ops,
- .sff_data_xfer = ata_sff_data_xfer_noirq,
- .cable_detect = ata_cable_unknown,
-diff --git a/drivers/ata/pata_qdi.c b/drivers/ata/pata_qdi.c
-index 45879dc..165a9f9 100644
---- a/drivers/ata/pata_qdi.c
-+++ b/drivers/ata/pata_qdi.c
-@@ -157,7 +157,7 @@ static struct scsi_host_template qdi_sht = {
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations qdi6500_port_ops = {
-+static const struct ata_port_operations qdi6500_port_ops = {
- .inherits = &ata_sff_port_ops,
- .qc_issue = qdi_qc_issue,
- .sff_data_xfer = qdi_data_xfer,
-@@ -165,7 +165,7 @@ static struct ata_port_operations qdi6500_port_ops = {
- .set_piomode = qdi6500_set_piomode,
- };
-
--static struct ata_port_operations qdi6580_port_ops = {
-+static const struct ata_port_operations qdi6580_port_ops = {
- .inherits = &qdi6500_port_ops,
- .set_piomode = qdi6580_set_piomode,
- };
-diff --git a/drivers/ata/pata_radisys.c b/drivers/ata/pata_radisys.c
-index 4401b33..716c5cc 100644
---- a/drivers/ata/pata_radisys.c
-+++ b/drivers/ata/pata_radisys.c
-@@ -187,7 +187,7 @@ static struct scsi_host_template radisys_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations radisys_pata_ops = {
-+static const struct ata_port_operations radisys_pata_ops = {
- .inherits = &ata_bmdma_port_ops,
- .qc_issue = radisys_qc_issue,
- .cable_detect = ata_cable_unknown,
-diff --git a/drivers/ata/pata_rb532_cf.c b/drivers/ata/pata_rb532_cf.c
-index 45f1e10..fab6bca 100644
---- a/drivers/ata/pata_rb532_cf.c
-+++ b/drivers/ata/pata_rb532_cf.c
-@@ -68,7 +68,7 @@ static irqreturn_t rb532_pata_irq_handler(int irq, void *dev_instance)
- return IRQ_HANDLED;
- }
-
--static struct ata_port_operations rb532_pata_port_ops = {
-+static const struct ata_port_operations rb532_pata_port_ops = {
- .inherits = &ata_sff_port_ops,
- .sff_data_xfer = ata_sff_data_xfer32,
- };
-diff --git a/drivers/ata/pata_rdc.c b/drivers/ata/pata_rdc.c
-index c843a1e..b5853c3 100644
---- a/drivers/ata/pata_rdc.c
-+++ b/drivers/ata/pata_rdc.c
-@@ -272,7 +272,7 @@ static void rdc_set_dmamode(struct ata_port *ap, struct ata_device *adev)
- pci_write_config_byte(dev, 0x48, udma_enable);
- }
-
--static struct ata_port_operations rdc_pata_ops = {
-+static const struct ata_port_operations rdc_pata_ops = {
- .inherits = &ata_bmdma32_port_ops,
- .cable_detect = rdc_pata_cable_detect,
- .set_piomode = rdc_set_piomode,
-diff --git a/drivers/ata/pata_rz1000.c b/drivers/ata/pata_rz1000.c
-index a5e4dfe..080c8c9 100644
---- a/drivers/ata/pata_rz1000.c
-+++ b/drivers/ata/pata_rz1000.c
-@@ -54,7 +54,7 @@ static struct scsi_host_template rz1000_sht = {
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations rz1000_port_ops = {
-+static const struct ata_port_operations rz1000_port_ops = {
- .inherits = &ata_sff_port_ops,
- .cable_detect = ata_cable_40wire,
- .set_mode = rz1000_set_mode,
-diff --git a/drivers/ata/pata_sc1200.c b/drivers/ata/pata_sc1200.c
-index 3bbed83..e309daf 100644
---- a/drivers/ata/pata_sc1200.c
-+++ b/drivers/ata/pata_sc1200.c
-@@ -207,7 +207,7 @@ static struct scsi_host_template sc1200_sht = {
- .sg_tablesize = LIBATA_DUMB_MAX_PRD,
- };
-
--static struct ata_port_operations sc1200_port_ops = {
-+static const struct ata_port_operations sc1200_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .qc_prep = ata_sff_dumb_qc_prep,
- .qc_issue = sc1200_qc_issue,
-diff --git a/drivers/ata/pata_scc.c b/drivers/ata/pata_scc.c
-index 4257d6b..4c1d9d5 100644
---- a/drivers/ata/pata_scc.c
-+++ b/drivers/ata/pata_scc.c
-@@ -965,7 +965,7 @@ static struct scsi_host_template scc_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations scc_pata_ops = {
-+static const struct ata_port_operations scc_pata_ops = {
- .inherits = &ata_bmdma_port_ops,
-
- .set_piomode = scc_set_piomode,
-diff --git a/drivers/ata/pata_sch.c b/drivers/ata/pata_sch.c
-index 99cceb45..e2e0a87 100644
---- a/drivers/ata/pata_sch.c
-+++ b/drivers/ata/pata_sch.c
-@@ -75,7 +75,7 @@ static struct scsi_host_template sch_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations sch_pata_ops = {
-+static const struct ata_port_operations sch_pata_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = ata_cable_unknown,
- .set_piomode = sch_set_piomode,
-diff --git a/drivers/ata/pata_serverworks.c b/drivers/ata/pata_serverworks.c
-index beaed12..39969f1 100644
---- a/drivers/ata/pata_serverworks.c
-+++ b/drivers/ata/pata_serverworks.c
-@@ -299,7 +299,7 @@ static struct scsi_host_template serverworks_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations serverworks_osb4_port_ops = {
-+static const struct ata_port_operations serverworks_osb4_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = serverworks_cable_detect,
- .mode_filter = serverworks_osb4_filter,
-@@ -307,7 +307,7 @@ static struct ata_port_operations serverworks_osb4_port_ops = {
- .set_dmamode = serverworks_set_dmamode,
- };
-
--static struct ata_port_operations serverworks_csb_port_ops = {
-+static const struct ata_port_operations serverworks_csb_port_ops = {
- .inherits = &serverworks_osb4_port_ops,
- .mode_filter = serverworks_csb_filter,
- };
-diff --git a/drivers/ata/pata_sil680.c b/drivers/ata/pata_sil680.c
-index a2ace48..0463b44 100644
---- a/drivers/ata/pata_sil680.c
-+++ b/drivers/ata/pata_sil680.c
-@@ -194,7 +194,7 @@ static struct scsi_host_template sil680_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations sil680_port_ops = {
-+static const struct ata_port_operations sil680_port_ops = {
- .inherits = &ata_bmdma32_port_ops,
- .cable_detect = sil680_cable_detect,
- .set_piomode = sil680_set_piomode,
-diff --git a/drivers/ata/pata_sis.c b/drivers/ata/pata_sis.c
-index 488e77b..b3724d5 100644
---- a/drivers/ata/pata_sis.c
-+++ b/drivers/ata/pata_sis.c
-@@ -503,47 +503,47 @@ static struct scsi_host_template sis_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations sis_133_for_sata_ops = {
-+static const struct ata_port_operations sis_133_for_sata_ops = {
- .inherits = &ata_bmdma_port_ops,
- .set_piomode = sis_133_set_piomode,
- .set_dmamode = sis_133_set_dmamode,
- .cable_detect = sis_133_cable_detect,
- };
-
--static struct ata_port_operations sis_base_ops = {
-+static const struct ata_port_operations sis_base_ops = {
- .inherits = &ata_bmdma_port_ops,
- .prereset = sis_pre_reset,
- };
-
--static struct ata_port_operations sis_133_ops = {
-+static const struct ata_port_operations sis_133_ops = {
- .inherits = &sis_base_ops,
- .set_piomode = sis_133_set_piomode,
- .set_dmamode = sis_133_set_dmamode,
- .cable_detect = sis_133_cable_detect,
- };
-
--static struct ata_port_operations sis_133_early_ops = {
-+static const struct ata_port_operations sis_133_early_ops = {
- .inherits = &sis_base_ops,
- .set_piomode = sis_100_set_piomode,
- .set_dmamode = sis_133_early_set_dmamode,
- .cable_detect = sis_66_cable_detect,
- };
-
--static struct ata_port_operations sis_100_ops = {
-+static const struct ata_port_operations sis_100_ops = {
- .inherits = &sis_base_ops,
- .set_piomode = sis_100_set_piomode,
- .set_dmamode = sis_100_set_dmamode,
- .cable_detect = sis_66_cable_detect,
- };
-
--static struct ata_port_operations sis_66_ops = {
-+static const struct ata_port_operations sis_66_ops = {
- .inherits = &sis_base_ops,
- .set_piomode = sis_old_set_piomode,
- .set_dmamode = sis_66_set_dmamode,
- .cable_detect = sis_66_cable_detect,
- };
-
--static struct ata_port_operations sis_old_ops = {
-+static const struct ata_port_operations sis_old_ops = {
- .inherits = &sis_base_ops,
- .set_piomode = sis_old_set_piomode,
- .set_dmamode = sis_old_set_dmamode,
-diff --git a/drivers/ata/pata_sl82c105.c b/drivers/ata/pata_sl82c105.c
-index 29f733c..43e9ca0 100644
---- a/drivers/ata/pata_sl82c105.c
-+++ b/drivers/ata/pata_sl82c105.c
-@@ -231,7 +231,7 @@ static struct scsi_host_template sl82c105_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations sl82c105_port_ops = {
-+static const struct ata_port_operations sl82c105_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .qc_defer = sl82c105_qc_defer,
- .bmdma_start = sl82c105_bmdma_start,
-diff --git a/drivers/ata/pata_triflex.c b/drivers/ata/pata_triflex.c
-index f1f13ff..df39e99 100644
---- a/drivers/ata/pata_triflex.c
-+++ b/drivers/ata/pata_triflex.c
-@@ -178,7 +178,7 @@ static struct scsi_host_template triflex_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations triflex_port_ops = {
-+static const struct ata_port_operations triflex_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .bmdma_start = triflex_bmdma_start,
- .bmdma_stop = triflex_bmdma_stop,
-diff --git a/drivers/ata/pata_via.c b/drivers/ata/pata_via.c
-index 1d73b8d..98a4b29 100644
---- a/drivers/ata/pata_via.c
-+++ b/drivers/ata/pata_via.c
-@@ -419,7 +419,7 @@ static struct scsi_host_template via_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations via_port_ops = {
-+static const struct ata_port_operations via_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = via_cable_detect,
- .set_piomode = via_set_piomode,
-@@ -429,7 +429,7 @@ static struct ata_port_operations via_port_ops = {
- .port_start = via_port_start,
- };
-
--static struct ata_port_operations via_port_ops_noirq = {
-+static const struct ata_port_operations via_port_ops_noirq = {
- .inherits = &via_port_ops,
- .sff_data_xfer = ata_sff_data_xfer_noirq,
- };
-diff --git a/drivers/ata/pata_winbond.c b/drivers/ata/pata_winbond.c
-index 6d8619b..ad511c4 100644
---- a/drivers/ata/pata_winbond.c
-+++ b/drivers/ata/pata_winbond.c
-@@ -125,7 +125,7 @@ static struct scsi_host_template winbond_sht = {
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations winbond_port_ops = {
-+static const struct ata_port_operations winbond_port_ops = {
- .inherits = &ata_sff_port_ops,
- .sff_data_xfer = winbond_data_xfer,
- .cable_detect = ata_cable_40wire,
-diff --git a/drivers/ata/pdc_adma.c b/drivers/ata/pdc_adma.c
-index 6c65b07..f996ec7 100644
---- a/drivers/ata/pdc_adma.c
-+++ b/drivers/ata/pdc_adma.c
-@@ -145,7 +145,7 @@ static struct scsi_host_template adma_ata_sht = {
- .dma_boundary = ADMA_DMA_BOUNDARY,
- };
-
--static struct ata_port_operations adma_ata_ops = {
-+static const struct ata_port_operations adma_ata_ops = {
- .inherits = &ata_sff_port_ops,
-
- .lost_interrupt = ATA_OP_NULL,
-diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
-index 172b57e..c49bc1e 100644
---- a/drivers/ata/sata_fsl.c
-+++ b/drivers/ata/sata_fsl.c
-@@ -1258,7 +1258,7 @@ static struct scsi_host_template sata_fsl_sht = {
- .dma_boundary = ATA_DMA_BOUNDARY,
- };
-
--static struct ata_port_operations sata_fsl_ops = {
-+static const struct ata_port_operations sata_fsl_ops = {
- .inherits = &sata_pmp_port_ops,
-
- .qc_defer = ata_std_qc_defer,
-diff --git a/drivers/ata/sata_inic162x.c b/drivers/ata/sata_inic162x.c
-index 4406902..60603ef 100644
---- a/drivers/ata/sata_inic162x.c
-+++ b/drivers/ata/sata_inic162x.c
-@@ -721,7 +721,7 @@ static int inic_port_start(struct ata_port *ap)
- return 0;
- }
-
--static struct ata_port_operations inic_port_ops = {
-+static const struct ata_port_operations inic_port_ops = {
- .inherits = &sata_port_ops,
-
- .check_atapi_dma = inic_check_atapi_dma,
-diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
-index cf41126..8107be6 100644
---- a/drivers/ata/sata_mv.c
-+++ b/drivers/ata/sata_mv.c
-@@ -656,7 +656,7 @@ static struct scsi_host_template mv6_sht = {
- .dma_boundary = MV_DMA_BOUNDARY,
- };
-
--static struct ata_port_operations mv5_ops = {
-+static const struct ata_port_operations mv5_ops = {
- .inherits = &ata_sff_port_ops,
-
- .lost_interrupt = ATA_OP_NULL,
-@@ -678,7 +678,7 @@ static struct ata_port_operations mv5_ops = {
- .port_stop = mv_port_stop,
- };
-
--static struct ata_port_operations mv6_ops = {
-+static const struct ata_port_operations mv6_ops = {
- .inherits = &mv5_ops,
- .dev_config = mv6_dev_config,
- .scr_read = mv_scr_read,
-@@ -698,7 +698,7 @@ static struct ata_port_operations mv6_ops = {
- .bmdma_status = mv_bmdma_status,
- };
-
--static struct ata_port_operations mv_iie_ops = {
-+static const struct ata_port_operations mv_iie_ops = {
- .inherits = &mv6_ops,
- .dev_config = ATA_OP_NULL,
- .qc_prep = mv_qc_prep_iie,
-diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
-index ae2297c..d5c9c33 100644
---- a/drivers/ata/sata_nv.c
-+++ b/drivers/ata/sata_nv.c
-@@ -464,7 +464,7 @@ static struct scsi_host_template nv_swncq_sht = {
- * cases. Define nv_hardreset() which only kicks in for post-boot
- * probing and use it for all variants.
- */
--static struct ata_port_operations nv_generic_ops = {
-+static const struct ata_port_operations nv_generic_ops = {
- .inherits = &ata_bmdma_port_ops,
- .lost_interrupt = ATA_OP_NULL,
- .scr_read = nv_scr_read,
-@@ -472,20 +472,20 @@ static struct ata_port_operations nv_generic_ops = {
- .hardreset = nv_hardreset,
- };
-
--static struct ata_port_operations nv_nf2_ops = {
-+static const struct ata_port_operations nv_nf2_ops = {
- .inherits = &nv_generic_ops,
- .freeze = nv_nf2_freeze,
- .thaw = nv_nf2_thaw,
- };
-
--static struct ata_port_operations nv_ck804_ops = {
-+static const struct ata_port_operations nv_ck804_ops = {
- .inherits = &nv_generic_ops,
- .freeze = nv_ck804_freeze,
- .thaw = nv_ck804_thaw,
- .host_stop = nv_ck804_host_stop,
- };
-
--static struct ata_port_operations nv_adma_ops = {
-+static const struct ata_port_operations nv_adma_ops = {
- .inherits = &nv_ck804_ops,
-
- .check_atapi_dma = nv_adma_check_atapi_dma,
-@@ -509,7 +509,7 @@ static struct ata_port_operations nv_adma_ops = {
- .host_stop = nv_adma_host_stop,
- };
-
--static struct ata_port_operations nv_swncq_ops = {
-+static const struct ata_port_operations nv_swncq_ops = {
- .inherits = &nv_generic_ops,
-
- .qc_defer = ata_std_qc_defer,
-diff --git a/drivers/ata/sata_promise.c b/drivers/ata/sata_promise.c
-index 07d8d00..6cc70bb 100644
---- a/drivers/ata/sata_promise.c
-+++ b/drivers/ata/sata_promise.c
-@@ -195,7 +195,7 @@ static const struct ata_port_operations pdc_common_ops = {
- .error_handler = pdc_error_handler,
- };
-
--static struct ata_port_operations pdc_sata_ops = {
-+static const struct ata_port_operations pdc_sata_ops = {
- .inherits = &pdc_common_ops,
- .cable_detect = pdc_sata_cable_detect,
- .freeze = pdc_sata_freeze,
-@@ -208,14 +208,14 @@ static struct ata_port_operations pdc_sata_ops = {
-
- /* First-generation chips need a more restrictive ->check_atapi_dma op,
- and ->freeze/thaw that ignore the hotplug controls. */
--static struct ata_port_operations pdc_old_sata_ops = {
-+static const struct ata_port_operations pdc_old_sata_ops = {
- .inherits = &pdc_sata_ops,
- .freeze = pdc_freeze,
- .thaw = pdc_thaw,
- .check_atapi_dma = pdc_old_sata_check_atapi_dma,
- };
-
--static struct ata_port_operations pdc_pata_ops = {
-+static const struct ata_port_operations pdc_pata_ops = {
- .inherits = &pdc_common_ops,
- .cable_detect = pdc_pata_cable_detect,
- .freeze = pdc_freeze,
-diff --git a/drivers/ata/sata_qstor.c b/drivers/ata/sata_qstor.c
-index 326c0cf..36ecebe 100644
---- a/drivers/ata/sata_qstor.c
-+++ b/drivers/ata/sata_qstor.c
-@@ -132,7 +132,7 @@ static struct scsi_host_template qs_ata_sht = {
- .dma_boundary = QS_DMA_BOUNDARY,
- };
-
--static struct ata_port_operations qs_ata_ops = {
-+static const struct ata_port_operations qs_ata_ops = {
- .inherits = &ata_sff_port_ops,
-
- .check_atapi_dma = qs_check_atapi_dma,
-diff --git a/drivers/ata/sata_sil.c b/drivers/ata/sata_sil.c
-index 3cb69d5..0871d3c 100644
---- a/drivers/ata/sata_sil.c
-+++ b/drivers/ata/sata_sil.c
-@@ -182,7 +182,7 @@ static struct scsi_host_template sil_sht = {
- .sg_tablesize = ATA_MAX_PRD
- };
-
--static struct ata_port_operations sil_ops = {
-+static const struct ata_port_operations sil_ops = {
- .inherits = &ata_bmdma32_port_ops,
- .dev_config = sil_dev_config,
- .set_mode = sil_set_mode,
-diff --git a/drivers/ata/sata_sil24.c b/drivers/ata/sata_sil24.c
-index e6946fc..eddb794 100644
---- a/drivers/ata/sata_sil24.c
-+++ b/drivers/ata/sata_sil24.c
-@@ -388,7 +388,7 @@ static struct scsi_host_template sil24_sht = {
- .dma_boundary = ATA_DMA_BOUNDARY,
- };
-
--static struct ata_port_operations sil24_ops = {
-+static const struct ata_port_operations sil24_ops = {
- .inherits = &sata_pmp_port_ops,
-
- .qc_defer = sil24_qc_defer,
-diff --git a/drivers/ata/sata_sis.c b/drivers/ata/sata_sis.c
-index f8a91bf..9cb06b6 100644
---- a/drivers/ata/sata_sis.c
-+++ b/drivers/ata/sata_sis.c
-@@ -89,7 +89,7 @@ static struct scsi_host_template sis_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations sis_ops = {
-+static const struct ata_port_operations sis_ops = {
- .inherits = &ata_bmdma_port_ops,
- .scr_read = sis_scr_read,
- .scr_write = sis_scr_write,
-diff --git a/drivers/ata/sata_svw.c b/drivers/ata/sata_svw.c
-index 7257f2d..d04c6f5 100644
---- a/drivers/ata/sata_svw.c
-+++ b/drivers/ata/sata_svw.c
-@@ -344,7 +344,7 @@ static struct scsi_host_template k2_sata_sht = {
- };
-
-
--static struct ata_port_operations k2_sata_ops = {
-+static const struct ata_port_operations k2_sata_ops = {
- .inherits = &ata_bmdma_port_ops,
- .sff_tf_load = k2_sata_tf_load,
- .sff_tf_read = k2_sata_tf_read,
-diff --git a/drivers/ata/sata_sx4.c b/drivers/ata/sata_sx4.c
-index bbcf970..cd0df0d 100644
---- a/drivers/ata/sata_sx4.c
-+++ b/drivers/ata/sata_sx4.c
-@@ -248,7 +248,7 @@ static struct scsi_host_template pdc_sata_sht = {
- };
-
- /* TODO: inherit from base port_ops after converting to new EH */
--static struct ata_port_operations pdc_20621_ops = {
-+static const struct ata_port_operations pdc_20621_ops = {
- .inherits = &ata_sff_port_ops,
-
- .check_atapi_dma = pdc_check_atapi_dma,
-diff --git a/drivers/ata/sata_uli.c b/drivers/ata/sata_uli.c
-index e5bff47..089d859 100644
---- a/drivers/ata/sata_uli.c
-+++ b/drivers/ata/sata_uli.c
-@@ -79,7 +79,7 @@ static struct scsi_host_template uli_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations uli_ops = {
-+static const struct ata_port_operations uli_ops = {
- .inherits = &ata_bmdma_port_ops,
- .scr_read = uli_scr_read,
- .scr_write = uli_scr_write,
-diff --git a/drivers/ata/sata_via.c b/drivers/ata/sata_via.c
-index f5dcca7..77b94eb 100644
---- a/drivers/ata/sata_via.c
-+++ b/drivers/ata/sata_via.c
-@@ -115,32 +115,32 @@ static struct scsi_host_template svia_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations svia_base_ops = {
-+static const struct ata_port_operations svia_base_ops = {
- .inherits = &ata_bmdma_port_ops,
- .sff_tf_load = svia_tf_load,
- };
-
--static struct ata_port_operations vt6420_sata_ops = {
-+static const struct ata_port_operations vt6420_sata_ops = {
- .inherits = &svia_base_ops,
- .freeze = svia_noop_freeze,
- .prereset = vt6420_prereset,
- .bmdma_start = vt6420_bmdma_start,
- };
-
--static struct ata_port_operations vt6421_pata_ops = {
-+static const struct ata_port_operations vt6421_pata_ops = {
- .inherits = &svia_base_ops,
- .cable_detect = vt6421_pata_cable_detect,
- .set_piomode = vt6421_set_pio_mode,
- .set_dmamode = vt6421_set_dma_mode,
- };
-
--static struct ata_port_operations vt6421_sata_ops = {
-+static const struct ata_port_operations vt6421_sata_ops = {
- .inherits = &svia_base_ops,
- .scr_read = svia_scr_read,
- .scr_write = svia_scr_write,
- };
-
--static struct ata_port_operations vt8251_ops = {
-+static const struct ata_port_operations vt8251_ops = {
- .inherits = &svia_base_ops,
- .hardreset = sata_std_hardreset,
- .scr_read = vt8251_scr_read,
-diff --git a/drivers/ata/sata_vsc.c b/drivers/ata/sata_vsc.c
-index 8b2a278..51e65d3 100644
---- a/drivers/ata/sata_vsc.c
-+++ b/drivers/ata/sata_vsc.c
-@@ -306,7 +306,7 @@ static struct scsi_host_template vsc_sata_sht = {
- };
-
-
--static struct ata_port_operations vsc_sata_ops = {
-+static const struct ata_port_operations vsc_sata_ops = {
- .inherits = &ata_bmdma_port_ops,
- /* The IRQ handling is not quite standard SFF behaviour so we
- cannot use the default lost interrupt handler */
-diff --git a/drivers/atm/adummy.c b/drivers/atm/adummy.c
-index 5effec6..7e4019a 100644
---- a/drivers/atm/adummy.c
-+++ b/drivers/atm/adummy.c
-@@ -77,7 +77,7 @@ adummy_send(struct atm_vcc *vcc, struct sk_buff *skb)
- vcc->pop(vcc, skb);
- else
- dev_kfree_skb_any(skb);
-- atomic_inc(&vcc->stats->tx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
-
- return 0;
- }
-diff --git a/drivers/atm/ambassador.c b/drivers/atm/ambassador.c
-index 66e1813..26a27c6 100644
---- a/drivers/atm/ambassador.c
-+++ b/drivers/atm/ambassador.c
-@@ -453,7 +453,7 @@ static void tx_complete (amb_dev * dev, tx_out * tx) {
- PRINTD (DBG_FLOW|DBG_TX, "tx_complete %p %p", dev, tx);
-
- // VC layer stats
-- atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
-+ atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
-
- // free the descriptor
- kfree (tx_descr);
-@@ -494,7 +494,7 @@ static void rx_complete (amb_dev * dev, rx_out * rx) {
- dump_skb ("<<<", vc, skb);
-
- // VC layer stats
-- atomic_inc(&atm_vcc->stats->rx);
-+ atomic_inc_unchecked(&atm_vcc->stats->rx);
- __net_timestamp(skb);
- // end of our responsability
- atm_vcc->push (atm_vcc, skb);
-@@ -509,7 +509,7 @@ static void rx_complete (amb_dev * dev, rx_out * rx) {
- } else {
- PRINTK (KERN_INFO, "dropped over-size frame");
- // should we count this?
-- atomic_inc(&atm_vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
- }
-
- } else {
-@@ -1341,7 +1341,7 @@ static int amb_send (struct atm_vcc * atm_vcc, struct sk_buff * skb) {
- }
-
- if (check_area (skb->data, skb->len)) {
-- atomic_inc(&atm_vcc->stats->tx_err);
-+ atomic_inc_unchecked(&atm_vcc->stats->tx_err);
- return -ENOMEM; // ?
- }
-
-diff --git a/drivers/atm/atmtcp.c b/drivers/atm/atmtcp.c
-index 02ad83d..6daffeb 100644
---- a/drivers/atm/atmtcp.c
-+++ b/drivers/atm/atmtcp.c
-@@ -206,7 +206,7 @@ static int atmtcp_v_send(struct atm_vcc *vcc,struct sk_buff *skb)
- if (vcc->pop) vcc->pop(vcc,skb);
- else dev_kfree_skb(skb);
- if (dev_data) return 0;
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- return -ENOLINK;
- }
- size = skb->len+sizeof(struct atmtcp_hdr);
-@@ -214,7 +214,7 @@ static int atmtcp_v_send(struct atm_vcc *vcc,struct sk_buff *skb)
- if (!new_skb) {
- if (vcc->pop) vcc->pop(vcc,skb);
- else dev_kfree_skb(skb);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- return -ENOBUFS;
- }
- hdr = (void *) skb_put(new_skb,sizeof(struct atmtcp_hdr));
-@@ -225,8 +225,8 @@ static int atmtcp_v_send(struct atm_vcc *vcc,struct sk_buff *skb)
- if (vcc->pop) vcc->pop(vcc,skb);
- else dev_kfree_skb(skb);
- out_vcc->push(out_vcc,new_skb);
-- atomic_inc(&vcc->stats->tx);
-- atomic_inc(&out_vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
-+ atomic_inc_unchecked(&out_vcc->stats->rx);
- return 0;
- }
-
-@@ -300,7 +300,7 @@ static int atmtcp_c_send(struct atm_vcc *vcc,struct sk_buff *skb)
- out_vcc = find_vcc(dev, ntohs(hdr->vpi), ntohs(hdr->vci));
- read_unlock(&vcc_sklist_lock);
- if (!out_vcc) {
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- goto done;
- }
- skb_pull(skb,sizeof(struct atmtcp_hdr));
-@@ -312,8 +312,8 @@ static int atmtcp_c_send(struct atm_vcc *vcc,struct sk_buff *skb)
- __net_timestamp(new_skb);
- skb_copy_from_linear_data(skb, skb_put(new_skb, skb->len), skb->len);
- out_vcc->push(out_vcc,new_skb);
-- atomic_inc(&vcc->stats->tx);
-- atomic_inc(&out_vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
-+ atomic_inc_unchecked(&out_vcc->stats->rx);
- done:
- if (vcc->pop) vcc->pop(vcc,skb);
- else dev_kfree_skb(skb);
-diff --git a/drivers/atm/eni.c b/drivers/atm/eni.c
-index 0c30261..3da356e 100644
---- a/drivers/atm/eni.c
-+++ b/drivers/atm/eni.c
-@@ -525,7 +525,7 @@ static int rx_aal0(struct atm_vcc *vcc)
- DPRINTK(DEV_LABEL "(itf %d): trashing empty cell\n",
- vcc->dev->number);
- length = 0;
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- }
- else {
- length = ATM_CELL_SIZE-1; /* no HEC */
-@@ -580,7 +580,7 @@ static int rx_aal5(struct atm_vcc *vcc)
- size);
- }
- eff = length = 0;
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- }
- else {
- size = (descr & MID_RED_COUNT)*(ATM_CELL_PAYLOAD >> 2);
-@@ -597,7 +597,7 @@ static int rx_aal5(struct atm_vcc *vcc)
- "(VCI=%d,length=%ld,size=%ld (descr 0x%lx))\n",
- vcc->dev->number,vcc->vci,length,size << 2,descr);
- length = eff = 0;
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- }
- }
- skb = eff ? atm_alloc_charge(vcc,eff << 2,GFP_ATOMIC) : NULL;
-@@ -770,7 +770,7 @@ rx_dequeued++;
- vcc->push(vcc,skb);
- pushed++;
- }
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
- }
- wake_up(&eni_dev->rx_wait);
- }
-@@ -1227,7 +1227,7 @@ static void dequeue_tx(struct atm_dev *dev)
- PCI_DMA_TODEVICE);
- if (vcc->pop) vcc->pop(vcc,skb);
- else dev_kfree_skb_irq(skb);
-- atomic_inc(&vcc->stats->tx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
- wake_up(&eni_dev->tx_wait);
- dma_complete++;
- }
-@@ -1570,7 +1570,7 @@ tx_complete++;
- /*--------------------------------- entries ---------------------------------*/
-
-
--static const char *media_name[] __devinitdata = {
-+static const char *media_name[] __devinitconst = {
- "MMF", "SMF", "MMF", "03?", /* 0- 3 */
- "UTP", "05?", "06?", "07?", /* 4- 7 */
- "TAXI","09?", "10?", "11?", /* 8-11 */
-diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c
-index cd5049a..a51209f 100644
---- a/drivers/atm/firestream.c
-+++ b/drivers/atm/firestream.c
-@@ -748,7 +748,7 @@ static void process_txdone_queue (struct fs_dev *dev, struct queue *q)
- }
- }
-
-- atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
-+ atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
-
- fs_dprintk (FS_DEBUG_TXMEM, "i");
- fs_dprintk (FS_DEBUG_ALLOC, "Free t-skb: %p\n", skb);
-@@ -815,7 +815,7 @@ static void process_incoming (struct fs_dev *dev, struct queue *q)
- #endif
- skb_put (skb, qe->p1 & 0xffff);
- ATM_SKB(skb)->vcc = atm_vcc;
-- atomic_inc(&atm_vcc->stats->rx);
-+ atomic_inc_unchecked(&atm_vcc->stats->rx);
- __net_timestamp(skb);
- fs_dprintk (FS_DEBUG_ALLOC, "Free rec-skb: %p (pushed)\n", skb);
- atm_vcc->push (atm_vcc, skb);
-@@ -836,12 +836,12 @@ static void process_incoming (struct fs_dev *dev, struct queue *q)
- kfree (pe);
- }
- if (atm_vcc)
-- atomic_inc(&atm_vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
- break;
- case 0x1f: /* Reassembly abort: no buffers. */
- /* Silently increment error counter. */
- if (atm_vcc)
-- atomic_inc(&atm_vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
- break;
- default: /* Hmm. Haven't written the code to handle the others yet... -- REW */
- printk (KERN_WARNING "Don't know what to do with RX status %x: %s.\n",
-diff --git a/drivers/atm/fore200e.c b/drivers/atm/fore200e.c
-index f766cc4..a34002e 100644
---- a/drivers/atm/fore200e.c
-+++ b/drivers/atm/fore200e.c
-@@ -931,9 +931,9 @@ fore200e_tx_irq(struct fore200e* fore200e)
- #endif
- /* check error condition */
- if (*entry->status & STATUS_ERROR)
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- else
-- atomic_inc(&vcc->stats->tx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
- }
- }
-
-@@ -1082,7 +1082,7 @@ fore200e_push_rpd(struct fore200e* fore200e, struct atm_vcc* vcc, struct rpd* rp
- if (skb == NULL) {
- DPRINTK(2, "unable to alloc new skb, rx PDU length = %d\n", pdu_len);
-
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- return -ENOMEM;
- }
-
-@@ -1125,14 +1125,14 @@ fore200e_push_rpd(struct fore200e* fore200e, struct atm_vcc* vcc, struct rpd* rp
-
- dev_kfree_skb_any(skb);
-
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- return -ENOMEM;
- }
-
- ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
-
- vcc->push(vcc, skb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
-
- ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
-
-@@ -1210,7 +1210,7 @@ fore200e_rx_irq(struct fore200e* fore200e)
- DPRINTK(2, "damaged PDU on %d.%d.%d\n",
- fore200e->atm_dev->number,
- entry->rpd->atm_header.vpi, entry->rpd->atm_header.vci);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- }
- }
-
-@@ -1655,7 +1655,7 @@ fore200e_send(struct atm_vcc *vcc, struct sk_buff *skb)
- goto retry_here;
- }
-
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
-
- fore200e->tx_sat++;
- DPRINTK(2, "tx queue of device %s is saturated, PDU dropped - heartbeat is %08x\n",
-diff --git a/drivers/atm/he.c b/drivers/atm/he.c
-index 7066703..2b130de 100644
---- a/drivers/atm/he.c
-+++ b/drivers/atm/he.c
-@@ -1769,7 +1769,7 @@ he_service_rbrq(struct he_dev *he_dev, int group)
-
- if (RBRQ_HBUF_ERR(he_dev->rbrq_head)) {
- hprintk("HBUF_ERR! (cid 0x%x)\n", cid);
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- goto return_host_buffers;
- }
-
-@@ -1802,7 +1802,7 @@ he_service_rbrq(struct he_dev *he_dev, int group)
- RBRQ_LEN_ERR(he_dev->rbrq_head)
- ? "LEN_ERR" : "",
- vcc->vpi, vcc->vci);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- goto return_host_buffers;
- }
-
-@@ -1861,7 +1861,7 @@ he_service_rbrq(struct he_dev *he_dev, int group)
- vcc->push(vcc, skb);
- spin_lock(&he_dev->global_lock);
-
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
-
- return_host_buffers:
- ++pdus_assembled;
-@@ -2206,7 +2206,7 @@ __enqueue_tpd(struct he_dev *he_dev, struct he_tpd *tpd, unsigned cid)
- tpd->vcc->pop(tpd->vcc, tpd->skb);
- else
- dev_kfree_skb_any(tpd->skb);
-- atomic_inc(&tpd->vcc->stats->tx_err);
-+ atomic_inc_unchecked(&tpd->vcc->stats->tx_err);
- }
- pci_pool_free(he_dev->tpd_pool, tpd, TPD_ADDR(tpd->status));
- return;
-@@ -2618,7 +2618,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
- vcc->pop(vcc, skb);
- else
- dev_kfree_skb_any(skb);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- return -EINVAL;
- }
-
-@@ -2629,7 +2629,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
- vcc->pop(vcc, skb);
- else
- dev_kfree_skb_any(skb);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- return -EINVAL;
- }
- #endif
-@@ -2641,7 +2641,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
- vcc->pop(vcc, skb);
- else
- dev_kfree_skb_any(skb);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- spin_unlock_irqrestore(&he_dev->global_lock, flags);
- return -ENOMEM;
- }
-@@ -2683,7 +2683,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
- vcc->pop(vcc, skb);
- else
- dev_kfree_skb_any(skb);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- spin_unlock_irqrestore(&he_dev->global_lock, flags);
- return -ENOMEM;
- }
-@@ -2714,7 +2714,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
- __enqueue_tpd(he_dev, tpd, cid);
- spin_unlock_irqrestore(&he_dev->global_lock, flags);
-
-- atomic_inc(&vcc->stats->tx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
-
- return 0;
- }
-diff --git a/drivers/atm/horizon.c b/drivers/atm/horizon.c
-index 4e49021..01b1512 100644
---- a/drivers/atm/horizon.c
-+++ b/drivers/atm/horizon.c
-@@ -1033,7 +1033,7 @@ static void rx_schedule (hrz_dev * dev, int irq) {
- {
- struct atm_vcc * vcc = ATM_SKB(skb)->vcc;
- // VC layer stats
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
- __net_timestamp(skb);
- // end of our responsability
- vcc->push (vcc, skb);
-@@ -1185,7 +1185,7 @@ static void tx_schedule (hrz_dev * const dev, int irq) {
- dev->tx_iovec = NULL;
-
- // VC layer stats
-- atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
-+ atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
-
- // free the skb
- hrz_kfree_skb (skb);
-diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c
-index e33ae00..9deb4ab 100644
---- a/drivers/atm/idt77252.c
-+++ b/drivers/atm/idt77252.c
-@@ -810,7 +810,7 @@ drain_scq(struct idt77252_dev *card, struct vc_map *vc)
- else
- dev_kfree_skb(skb);
-
-- atomic_inc(&vcc->stats->tx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
- }
-
- atomic_dec(&scq->used);
-@@ -1073,13 +1073,13 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
- if ((sb = dev_alloc_skb(64)) == NULL) {
- printk("%s: Can't allocate buffers for aal0.\n",
- card->name);
-- atomic_add(i, &vcc->stats->rx_drop);
-+ atomic_add_unchecked(i, &vcc->stats->rx_drop);
- break;
- }
- if (!atm_charge(vcc, sb->truesize)) {
- RXPRINTK("%s: atm_charge() dropped aal0 packets.\n",
- card->name);
-- atomic_add(i - 1, &vcc->stats->rx_drop);
-+ atomic_add_unchecked(i - 1, &vcc->stats->rx_drop);
- dev_kfree_skb(sb);
- break;
- }
-@@ -1096,7 +1096,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
- ATM_SKB(sb)->vcc = vcc;
- __net_timestamp(sb);
- vcc->push(vcc, sb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
-
- cell += ATM_CELL_PAYLOAD;
- }
-@@ -1133,13 +1133,13 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
- "(CDC: %08x)\n",
- card->name, len, rpp->len, readl(SAR_REG_CDC));
- recycle_rx_pool_skb(card, rpp);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- return;
- }
- if (stat & SAR_RSQE_CRC) {
- RXPRINTK("%s: AAL5 CRC error.\n", card->name);
- recycle_rx_pool_skb(card, rpp);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- return;
- }
- if (skb_queue_len(&rpp->queue) > 1) {
-@@ -1150,7 +1150,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
- RXPRINTK("%s: Can't alloc RX skb.\n",
- card->name);
- recycle_rx_pool_skb(card, rpp);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- return;
- }
- if (!atm_charge(vcc, skb->truesize)) {
-@@ -1169,7 +1169,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
- __net_timestamp(skb);
-
- vcc->push(vcc, skb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
-
- return;
- }
-@@ -1191,7 +1191,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
- __net_timestamp(skb);
-
- vcc->push(vcc, skb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
-
- if (skb->truesize > SAR_FB_SIZE_3)
- add_rx_skb(card, 3, SAR_FB_SIZE_3, 1);
-@@ -1303,14 +1303,14 @@ idt77252_rx_raw(struct idt77252_dev *card)
- if (vcc->qos.aal != ATM_AAL0) {
- RPRINTK("%s: raw cell for non AAL0 vc %u.%u\n",
- card->name, vpi, vci);
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- goto drop;
- }
-
- if ((sb = dev_alloc_skb(64)) == NULL) {
- printk("%s: Can't allocate buffers for AAL0.\n",
- card->name);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- goto drop;
- }
-
-@@ -1329,7 +1329,7 @@ idt77252_rx_raw(struct idt77252_dev *card)
- ATM_SKB(sb)->vcc = vcc;
- __net_timestamp(sb);
- vcc->push(vcc, sb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
-
- drop:
- skb_pull(queue, 64);
-@@ -1954,13 +1954,13 @@ idt77252_send_skb(struct atm_vcc *vcc, struct sk_buff *skb, int oam)
-
- if (vc == NULL) {
- printk("%s: NULL connection in send().\n", card->name);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- dev_kfree_skb(skb);
- return -EINVAL;
- }
- if (!test_bit(VCF_TX, &vc->flags)) {
- printk("%s: Trying to transmit on a non-tx VC.\n", card->name);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- dev_kfree_skb(skb);
- return -EINVAL;
- }
-@@ -1972,14 +1972,14 @@ idt77252_send_skb(struct atm_vcc *vcc, struct sk_buff *skb, int oam)
- break;
- default:
- printk("%s: Unsupported AAL: %d\n", card->name, vcc->qos.aal);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- dev_kfree_skb(skb);
- return -EINVAL;
- }
-
- if (skb_shinfo(skb)->nr_frags != 0) {
- printk("%s: No scatter-gather yet.\n", card->name);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- dev_kfree_skb(skb);
- return -EINVAL;
- }
-@@ -1987,7 +1987,7 @@ idt77252_send_skb(struct atm_vcc *vcc, struct sk_buff *skb, int oam)
-
- err = queue_skb(card, vc, skb, oam);
- if (err) {
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- dev_kfree_skb(skb);
- return err;
- }
-@@ -2010,7 +2010,7 @@ idt77252_send_oam(struct atm_vcc *vcc, void *cell, int flags)
- skb = dev_alloc_skb(64);
- if (!skb) {
- printk("%s: Out of memory in send_oam().\n", card->name);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- return -ENOMEM;
- }
- atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
-diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c
-index b2c1b37..faa672b 100644
---- a/drivers/atm/iphase.c
-+++ b/drivers/atm/iphase.c
-@@ -1123,7 +1123,7 @@ static int rx_pkt(struct atm_dev *dev)
- status = (u_short) (buf_desc_ptr->desc_mode);
- if (status & (RX_CER | RX_PTE | RX_OFL))
- {
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- IF_ERR(printk("IA: bad packet, dropping it");)
- if (status & RX_CER) {
- IF_ERR(printk(" cause: packet CRC error\n");)
-@@ -1146,7 +1146,7 @@ static int rx_pkt(struct atm_dev *dev)
- len = dma_addr - buf_addr;
- if (len > iadev->rx_buf_sz) {
- printk("Over %d bytes sdu received, dropped!!!\n", iadev->rx_buf_sz);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- goto out_free_desc;
- }
-
-@@ -1296,7 +1296,7 @@ static void rx_dle_intr(struct atm_dev *dev)
- ia_vcc = INPH_IA_VCC(vcc);
- if (ia_vcc == NULL)
- {
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- dev_kfree_skb_any(skb);
- atm_return(vcc, atm_guess_pdu2truesize(len));
- goto INCR_DLE;
-@@ -1308,7 +1308,7 @@ static void rx_dle_intr(struct atm_dev *dev)
- if ((length > iadev->rx_buf_sz) || (length >
- (skb->len - sizeof(struct cpcs_trailer))))
- {
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- IF_ERR(printk("rx_dle_intr: Bad AAL5 trailer %d (skb len %d)",
- length, skb->len);)
- dev_kfree_skb_any(skb);
-@@ -1324,7 +1324,7 @@ static void rx_dle_intr(struct atm_dev *dev)
-
- IF_RX(printk("rx_dle_intr: skb push");)
- vcc->push(vcc,skb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
- iadev->rx_pkt_cnt++;
- }
- INCR_DLE:
-@@ -2806,15 +2806,15 @@ static int ia_ioctl(struct atm_dev *dev, unsigned int cmd, void __user *arg)
- {
- struct k_sonet_stats *stats;
- stats = &PRIV(_ia_dev[board])->sonet_stats;
-- printk("section_bip: %d\n", atomic_read(&stats->section_bip));
-- printk("line_bip : %d\n", atomic_read(&stats->line_bip));
-- printk("path_bip : %d\n", atomic_read(&stats->path_bip));
-- printk("line_febe : %d\n", atomic_read(&stats->line_febe));
-- printk("path_febe : %d\n", atomic_read(&stats->path_febe));
-- printk("corr_hcs : %d\n", atomic_read(&stats->corr_hcs));
-- printk("uncorr_hcs : %d\n", atomic_read(&stats->uncorr_hcs));
-- printk("tx_cells : %d\n", atomic_read(&stats->tx_cells));
-- printk("rx_cells : %d\n", atomic_read(&stats->rx_cells));
-+ printk("section_bip: %d\n", atomic_read_unchecked(&stats->section_bip));
-+ printk("line_bip : %d\n", atomic_read_unchecked(&stats->line_bip));
-+ printk("path_bip : %d\n", atomic_read_unchecked(&stats->path_bip));
-+ printk("line_febe : %d\n", atomic_read_unchecked(&stats->line_febe));
-+ printk("path_febe : %d\n", atomic_read_unchecked(&stats->path_febe));
-+ printk("corr_hcs : %d\n", atomic_read_unchecked(&stats->corr_hcs));
-+ printk("uncorr_hcs : %d\n", atomic_read_unchecked(&stats->uncorr_hcs));
-+ printk("tx_cells : %d\n", atomic_read_unchecked(&stats->tx_cells));
-+ printk("rx_cells : %d\n", atomic_read_unchecked(&stats->rx_cells));
- }
- ia_cmds.status = 0;
- break;
-@@ -2919,7 +2919,7 @@ static int ia_pkt_tx (struct atm_vcc *vcc, struct sk_buff *skb) {
- if ((desc == 0) || (desc > iadev->num_tx_desc))
- {
- IF_ERR(printk(DEV_LABEL "invalid desc for send: %d\n", desc);)
-- atomic_inc(&vcc->stats->tx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
- if (vcc->pop)
- vcc->pop(vcc, skb);
- else
-@@ -3024,14 +3024,14 @@ static int ia_pkt_tx (struct atm_vcc *vcc, struct sk_buff *skb) {
- ATM_DESC(skb) = vcc->vci;
- skb_queue_tail(&iadev->tx_dma_q, skb);
-
-- atomic_inc(&vcc->stats->tx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
- iadev->tx_pkt_cnt++;
- /* Increment transaction counter */
- writel(2, iadev->dma+IPHASE5575_TX_COUNTER);
-
- #if 0
- /* add flow control logic */
-- if (atomic_read(&vcc->stats->tx) % 20 == 0) {
-+ if (atomic_read_unchecked(&vcc->stats->tx) % 20 == 0) {
- if (iavcc->vc_desc_cnt > 10) {
- vcc->tx_quota = vcc->tx_quota * 3 / 4;
- printk("Tx1: vcc->tx_quota = %d \n", (u32)vcc->tx_quota );
-diff --git a/drivers/atm/lanai.c b/drivers/atm/lanai.c
-index cf97c34..8d30655 100644
---- a/drivers/atm/lanai.c
-+++ b/drivers/atm/lanai.c
-@@ -1305,7 +1305,7 @@ static void lanai_send_one_aal5(struct lanai_dev *lanai,
- vcc_tx_add_aal5_trailer(lvcc, skb->len, 0, 0);
- lanai_endtx(lanai, lvcc);
- lanai_free_skb(lvcc->tx.atmvcc, skb);
-- atomic_inc(&lvcc->tx.atmvcc->stats->tx);
-+ atomic_inc_unchecked(&lvcc->tx.atmvcc->stats->tx);
- }
-
- /* Try to fill the buffer - don't call unless there is backlog */
-@@ -1428,7 +1428,7 @@ static void vcc_rx_aal5(struct lanai_vcc *lvcc, int endptr)
- ATM_SKB(skb)->vcc = lvcc->rx.atmvcc;
- __net_timestamp(skb);
- lvcc->rx.atmvcc->push(lvcc->rx.atmvcc, skb);
-- atomic_inc(&lvcc->rx.atmvcc->stats->rx);
-+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx);
- out:
- lvcc->rx.buf.ptr = end;
- cardvcc_write(lvcc, endptr, vcc_rxreadptr);
-@@ -1670,7 +1670,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
- DPRINTK("(itf %d) got RX service entry 0x%X for non-AAL5 "
- "vcc %d\n", lanai->number, (unsigned int) s, vci);
- lanai->stats.service_rxnotaal5++;
-- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
-+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
- return 0;
- }
- if (likely(!(s & (SERVICE_TRASH | SERVICE_STREAM | SERVICE_CRCERR)))) {
-@@ -1682,7 +1682,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
- int bytes;
- read_unlock(&vcc_sklist_lock);
- DPRINTK("got trashed rx pdu on vci %d\n", vci);
-- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
-+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
- lvcc->stats.x.aal5.service_trash++;
- bytes = (SERVICE_GET_END(s) * 16) -
- (((unsigned long) lvcc->rx.buf.ptr) -
-@@ -1694,7 +1694,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
- }
- if (s & SERVICE_STREAM) {
- read_unlock(&vcc_sklist_lock);
-- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
-+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
- lvcc->stats.x.aal5.service_stream++;
- printk(KERN_ERR DEV_LABEL "(itf %d): Got AAL5 stream "
- "PDU on VCI %d!\n", lanai->number, vci);
-@@ -1702,7 +1702,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
- return 0;
- }
- DPRINTK("got rx crc error on vci %d\n", vci);
-- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
-+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
- lvcc->stats.x.aal5.service_rxcrc++;
- lvcc->rx.buf.ptr = &lvcc->rx.buf.start[SERVICE_GET_END(s) * 4];
- cardvcc_write(lvcc, SERVICE_GET_END(s), vcc_rxreadptr);
-diff --git a/drivers/atm/nicstar.c b/drivers/atm/nicstar.c
-index 3da804b..d3b0eed 100644
---- a/drivers/atm/nicstar.c
-+++ b/drivers/atm/nicstar.c
-@@ -1723,7 +1723,7 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
- if ((vc = (vc_map *) vcc->dev_data) == NULL)
- {
- printk("nicstar%d: vcc->dev_data == NULL on ns_send().\n", card->index);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- dev_kfree_skb_any(skb);
- return -EINVAL;
- }
-@@ -1731,7 +1731,7 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
- if (!vc->tx)
- {
- printk("nicstar%d: Trying to transmit on a non-tx VC.\n", card->index);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- dev_kfree_skb_any(skb);
- return -EINVAL;
- }
-@@ -1739,7 +1739,7 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
- if (vcc->qos.aal != ATM_AAL5 && vcc->qos.aal != ATM_AAL0)
- {
- printk("nicstar%d: Only AAL0 and AAL5 are supported.\n", card->index);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- dev_kfree_skb_any(skb);
- return -EINVAL;
- }
-@@ -1747,7 +1747,7 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
- if (skb_shinfo(skb)->nr_frags != 0)
- {
- printk("nicstar%d: No scatter-gather yet.\n", card->index);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- dev_kfree_skb_any(skb);
- return -EINVAL;
- }
-@@ -1792,11 +1792,11 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
-
- if (push_scqe(card, vc, scq, &scqe, skb) != 0)
- {
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- dev_kfree_skb_any(skb);
- return -EIO;
- }
-- atomic_inc(&vcc->stats->tx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
-
- return 0;
- }
-@@ -2111,14 +2111,14 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
- {
- printk("nicstar%d: Can't allocate buffers for aal0.\n",
- card->index);
-- atomic_add(i,&vcc->stats->rx_drop);
-+ atomic_add_unchecked(i,&vcc->stats->rx_drop);
- break;
- }
- if (!atm_charge(vcc, sb->truesize))
- {
- RXPRINTK("nicstar%d: atm_charge() dropped aal0 packets.\n",
- card->index);
-- atomic_add(i-1,&vcc->stats->rx_drop); /* already increased by 1 */
-+ atomic_add_unchecked(i-1,&vcc->stats->rx_drop); /* already increased by 1 */
- dev_kfree_skb_any(sb);
- break;
- }
-@@ -2133,7 +2133,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
- ATM_SKB(sb)->vcc = vcc;
- __net_timestamp(sb);
- vcc->push(vcc, sb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
- cell += ATM_CELL_PAYLOAD;
- }
-
-@@ -2152,7 +2152,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
- if (iovb == NULL)
- {
- printk("nicstar%d: Out of iovec buffers.\n", card->index);
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- recycle_rx_buf(card, skb);
- return;
- }
-@@ -2182,7 +2182,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
- else if (NS_SKB(iovb)->iovcnt >= NS_MAX_IOVECS)
- {
- printk("nicstar%d: received too big AAL5 SDU.\n", card->index);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data, NS_MAX_IOVECS);
- NS_SKB(iovb)->iovcnt = 0;
- iovb->len = 0;
-@@ -2202,7 +2202,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
- printk("nicstar%d: Expected a small buffer, and this is not one.\n",
- card->index);
- which_list(card, skb);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- recycle_rx_buf(card, skb);
- vc->rx_iov = NULL;
- recycle_iov_buf(card, iovb);
-@@ -2216,7 +2216,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
- printk("nicstar%d: Expected a large buffer, and this is not one.\n",
- card->index);
- which_list(card, skb);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
- NS_SKB(iovb)->iovcnt);
- vc->rx_iov = NULL;
-@@ -2240,7 +2240,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
- printk(" - PDU size mismatch.\n");
- else
- printk(".\n");
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
- NS_SKB(iovb)->iovcnt);
- vc->rx_iov = NULL;
-@@ -2256,7 +2256,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
- if (!atm_charge(vcc, skb->truesize))
- {
- push_rxbufs(card, skb);
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- }
- else
- {
-@@ -2268,7 +2268,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
- ATM_SKB(skb)->vcc = vcc;
- __net_timestamp(skb);
- vcc->push(vcc, skb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
- }
- }
- else if (NS_SKB(iovb)->iovcnt == 2) /* One small plus one large buffer */
-@@ -2283,7 +2283,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
- if (!atm_charge(vcc, sb->truesize))
- {
- push_rxbufs(card, sb);
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- }
- else
- {
-@@ -2295,7 +2295,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
- ATM_SKB(sb)->vcc = vcc;
- __net_timestamp(sb);
- vcc->push(vcc, sb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
- }
-
- push_rxbufs(card, skb);
-@@ -2306,7 +2306,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
- if (!atm_charge(vcc, skb->truesize))
- {
- push_rxbufs(card, skb);
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- }
- else
- {
-@@ -2320,7 +2320,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
- ATM_SKB(skb)->vcc = vcc;
- __net_timestamp(skb);
- vcc->push(vcc, skb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
- }
-
- push_rxbufs(card, sb);
-@@ -2342,7 +2342,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
- if (hb == NULL)
- {
- printk("nicstar%d: Out of huge buffers.\n", card->index);
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
- NS_SKB(iovb)->iovcnt);
- vc->rx_iov = NULL;
-@@ -2393,7 +2393,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
- }
- else
- dev_kfree_skb_any(hb);
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- }
- else
- {
-@@ -2427,7 +2427,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
- #endif /* NS_USE_DESTRUCTORS */
- __net_timestamp(hb);
- vcc->push(vcc, hb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
- }
- }
-
-diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
-index 84c93ff..e6ed269 100644
---- a/drivers/atm/solos-pci.c
-+++ b/drivers/atm/solos-pci.c
-@@ -708,7 +708,7 @@ void solos_bh(unsigned long card_arg)
- }
- atm_charge(vcc, skb->truesize);
- vcc->push(vcc, skb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
- break;
-
- case PKT_STATUS:
-@@ -914,6 +914,8 @@ static int print_buffer(struct sk_buff *buf)
- char msg[500];
- char item[10];
-
-+ pax_track_stack();
-+
- len = buf->len;
- for (i = 0; i < len; i++){
- if(i % 8 == 0)
-@@ -1023,7 +1025,7 @@ static uint32_t fpga_tx(struct solos_card *card)
- vcc = SKB_CB(oldskb)->vcc;
-
- if (vcc) {
-- atomic_inc(&vcc->stats->tx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
- solos_pop(vcc, oldskb);
- } else
- dev_kfree_skb_irq(oldskb);
-diff --git a/drivers/atm/suni.c b/drivers/atm/suni.c
-index 6dd3f59..ee377f3 100644
---- a/drivers/atm/suni.c
-+++ b/drivers/atm/suni.c
-@@ -49,8 +49,8 @@ static DEFINE_SPINLOCK(sunis_lock);
-
-
- #define ADD_LIMITED(s,v) \
-- atomic_add((v),&stats->s); \
-- if (atomic_read(&stats->s) < 0) atomic_set(&stats->s,INT_MAX);
-+ atomic_add_unchecked((v),&stats->s); \
-+ if (atomic_read_unchecked(&stats->s) < 0) atomic_set_unchecked(&stats->s,INT_MAX);
-
-
- static void suni_hz(unsigned long from_timer)
-diff --git a/drivers/atm/uPD98402.c b/drivers/atm/uPD98402.c
-index fc8cb07..4a80e53 100644
---- a/drivers/atm/uPD98402.c
-+++ b/drivers/atm/uPD98402.c
-@@ -41,7 +41,7 @@ static int fetch_stats(struct atm_dev *dev,struct sonet_stats __user *arg,int ze
- struct sonet_stats tmp;
- int error = 0;
-
-- atomic_add(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
-+ atomic_add_unchecked(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
- sonet_copy_stats(&PRIV(dev)->sonet_stats,&tmp);
- if (arg) error = copy_to_user(arg,&tmp,sizeof(tmp));
- if (zero && !error) {
-@@ -160,9 +160,9 @@ static int uPD98402_ioctl(struct atm_dev *dev,unsigned int cmd,void __user *arg)
-
-
- #define ADD_LIMITED(s,v) \
-- { atomic_add(GET(v),&PRIV(dev)->sonet_stats.s); \
-- if (atomic_read(&PRIV(dev)->sonet_stats.s) < 0) \
-- atomic_set(&PRIV(dev)->sonet_stats.s,INT_MAX); }
-+ { atomic_add_unchecked(GET(v),&PRIV(dev)->sonet_stats.s); \
-+ if (atomic_read_unchecked(&PRIV(dev)->sonet_stats.s) < 0) \
-+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.s,INT_MAX); }
-
-
- static void stat_event(struct atm_dev *dev)
-@@ -193,7 +193,7 @@ static void uPD98402_int(struct atm_dev *dev)
- if (reason & uPD98402_INT_PFM) stat_event(dev);
- if (reason & uPD98402_INT_PCO) {
- (void) GET(PCOCR); /* clear interrupt cause */
-- atomic_add(GET(HECCT),
-+ atomic_add_unchecked(GET(HECCT),
- &PRIV(dev)->sonet_stats.uncorr_hcs);
- }
- if ((reason & uPD98402_INT_RFO) &&
-@@ -221,9 +221,9 @@ static int uPD98402_start(struct atm_dev *dev)
- PUT(~(uPD98402_INT_PFM | uPD98402_INT_ALM | uPD98402_INT_RFO |
- uPD98402_INT_LOS),PIMR); /* enable them */
- (void) fetch_stats(dev,NULL,1); /* clear kernel counters */
-- atomic_set(&PRIV(dev)->sonet_stats.corr_hcs,-1);
-- atomic_set(&PRIV(dev)->sonet_stats.tx_cells,-1);
-- atomic_set(&PRIV(dev)->sonet_stats.rx_cells,-1);
-+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.corr_hcs,-1);
-+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.tx_cells,-1);
-+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.rx_cells,-1);
- return 0;
- }
-
-diff --git a/drivers/atm/zatm.c b/drivers/atm/zatm.c
-index 2e9635b..32927b4 100644
---- a/drivers/atm/zatm.c
-+++ b/drivers/atm/zatm.c
-@@ -458,7 +458,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy[0],dummy[1]);
- }
- if (!size) {
- dev_kfree_skb_irq(skb);
-- if (vcc) atomic_inc(&vcc->stats->rx_err);
-+ if (vcc) atomic_inc_unchecked(&vcc->stats->rx_err);
- continue;
- }
- if (!atm_charge(vcc,skb->truesize)) {
-@@ -468,7 +468,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy[0],dummy[1]);
- skb->len = size;
- ATM_SKB(skb)->vcc = vcc;
- vcc->push(vcc,skb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
- }
- zout(pos & 0xffff,MTA(mbx));
- #if 0 /* probably a stupid idea */
-@@ -732,7 +732,7 @@ if (*ZATM_PRV_DSC(skb) != (uPD98401_TXPD_V | uPD98401_TXPD_DP |
- skb_queue_head(&zatm_vcc->backlog,skb);
- break;
- }
-- atomic_inc(&vcc->stats->tx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
- wake_up(&zatm_vcc->tx_wait);
- }
-
-diff --git a/drivers/base/bus.c b/drivers/base/bus.c
-index 63c143e..fece183 100644
---- a/drivers/base/bus.c
-+++ b/drivers/base/bus.c
-@@ -70,7 +70,7 @@ static ssize_t drv_attr_store(struct kobject *kobj, struct attribute *attr,
- return ret;
- }
-
--static struct sysfs_ops driver_sysfs_ops = {
-+static const struct sysfs_ops driver_sysfs_ops = {
- .show = drv_attr_show,
- .store = drv_attr_store,
- };
-@@ -115,7 +115,7 @@ static ssize_t bus_attr_store(struct kobject *kobj, struct attribute *attr,
- return ret;
- }
-
--static struct sysfs_ops bus_sysfs_ops = {
-+static const struct sysfs_ops bus_sysfs_ops = {
- .show = bus_attr_show,
- .store = bus_attr_store,
- };
-@@ -154,7 +154,7 @@ static int bus_uevent_filter(struct kset *kset, struct kobject *kobj)
- return 0;
- }
-
--static struct kset_uevent_ops bus_uevent_ops = {
-+static const struct kset_uevent_ops bus_uevent_ops = {
- .filter = bus_uevent_filter,
- };
-
-diff --git a/drivers/base/class.c b/drivers/base/class.c
-index 6e2c3b0..cb61871 100644
---- a/drivers/base/class.c
-+++ b/drivers/base/class.c
-@@ -63,7 +63,7 @@ static void class_release(struct kobject *kobj)
- kfree(cp);
- }
-
--static struct sysfs_ops class_sysfs_ops = {
-+static const struct sysfs_ops class_sysfs_ops = {
- .show = class_attr_show,
- .store = class_attr_store,
- };
-diff --git a/drivers/base/core.c b/drivers/base/core.c
-index f33d768..a9358d0 100644
---- a/drivers/base/core.c
-+++ b/drivers/base/core.c
-@@ -100,7 +100,7 @@ static ssize_t dev_attr_store(struct kobject *kobj, struct attribute *attr,
- return ret;
- }
-
--static struct sysfs_ops dev_sysfs_ops = {
-+static const struct sysfs_ops dev_sysfs_ops = {
- .show = dev_attr_show,
- .store = dev_attr_store,
- };
-@@ -252,7 +252,7 @@ static int dev_uevent(struct kset *kset, struct kobject *kobj,
- return retval;
- }
-
--static struct kset_uevent_ops device_uevent_ops = {
-+static const struct kset_uevent_ops device_uevent_ops = {
- .filter = dev_uevent_filter,
- .name = dev_uevent_name,
- .uevent = dev_uevent,
-diff --git a/drivers/base/memory.c b/drivers/base/memory.c
-index 989429c..2272b00 100644
---- a/drivers/base/memory.c
-+++ b/drivers/base/memory.c
-@@ -44,7 +44,7 @@ static int memory_uevent(struct kset *kset, struct kobject *obj, struct kobj_uev
- return retval;
- }
-
--static struct kset_uevent_ops memory_uevent_ops = {
-+static const struct kset_uevent_ops memory_uevent_ops = {
- .name = memory_uevent_name,
- .uevent = memory_uevent,
- };
-diff --git a/drivers/base/node.c b/drivers/base/node.c
-index 1fe5536..6c2ca13 100644
---- a/drivers/base/node.c
-+++ b/drivers/base/node.c
-@@ -390,11 +390,9 @@ static ssize_t print_nodes_state(enum node_states state, char *buf)
- {
- int n;
-
-- n = nodelist_scnprintf(buf, PAGE_SIZE, node_states[state]);
-- if (n > 0 && PAGE_SIZE > n + 1) {
-- *(buf + n++) = '\n';
-- *(buf + n++) = '\0';
-- }
-+ n = nodelist_scnprintf(buf, PAGE_SIZE-2, node_states[state]);
-+ buf[n++] = '\n';
-+ buf[n] = '\0';
- return n;
- }
-
-diff --git a/drivers/base/sys.c b/drivers/base/sys.c
-index 3f202f7..61c4a6f 100644
---- a/drivers/base/sys.c
-+++ b/drivers/base/sys.c
-@@ -54,7 +54,7 @@ sysdev_store(struct kobject *kobj, struct attribute *attr,
- return -EIO;
- }
-
--static struct sysfs_ops sysfs_ops = {
-+static const struct sysfs_ops sysfs_ops = {
- .show = sysdev_show,
- .store = sysdev_store,
- };
-@@ -104,7 +104,7 @@ static ssize_t sysdev_class_store(struct kobject *kobj, struct attribute *attr,
- return -EIO;
- }
-
--static struct sysfs_ops sysfs_class_ops = {
-+static const struct sysfs_ops sysfs_class_ops = {
- .show = sysdev_class_show,
- .store = sysdev_class_store,
- };
-diff --git a/drivers/block/DAC960.c b/drivers/block/DAC960.c
-index eb4fa19..1954777 100644
---- a/drivers/block/DAC960.c
-+++ b/drivers/block/DAC960.c
-@@ -1973,6 +1973,8 @@ static bool DAC960_V1_ReadDeviceConfiguration(DAC960_Controller_T
- unsigned long flags;
- int Channel, TargetID;
-
-+ pax_track_stack();
-+
- if (!init_dma_loaf(Controller->PCIDevice, &local_dma,
- DAC960_V1_MaxChannels*(sizeof(DAC960_V1_DCDB_T) +
- sizeof(DAC960_SCSI_Inquiry_T) +
-diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
-index 68b90d9..d87f5c9 100644
---- a/drivers/block/cciss.c
-+++ b/drivers/block/cciss.c
-@@ -1,6 +1,6 @@
- /*
- * Disk Array driver for HP Smart Array controllers.
-- * (C) Copyright 2000, 2007 Hewlett-Packard Development Company, L.P.
-+ * (C) Copyright 2000, 2010 Hewlett-Packard Development Company, L.P.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
-@@ -26,7 +26,6 @@
- #include <linux/pci.h>
- #include <linux/kernel.h>
- #include <linux/slab.h>
--#include <linux/smp_lock.h>
- #include <linux/delay.h>
- #include <linux/major.h>
- #include <linux/fs.h>
-@@ -53,20 +52,24 @@
- #include <scsi/scsi_ioctl.h>
- #include <linux/cdrom.h>
- #include <linux/scatterlist.h>
--#include <linux/kthread.h>
-+#include "cciss_cmd.h"
-+#include "cciss.h"
-+#include "cciss_kernel_compat.h"
-+#include <linux/cciss_ioctl.h>
-
- #define CCISS_DRIVER_VERSION(maj,min,submin) ((maj<<16)|(min<<8)|(submin))
--#define DRIVER_NAME "HP CISS Driver (v 3.6.20)"
--#define DRIVER_VERSION CCISS_DRIVER_VERSION(3, 6, 20)
-+#define DRIVER_NAME "HP CISS Driver (v 4.6.28-20 )"
-+#define DRIVER_VERSION CCISS_DRIVER_VERSION(4, 6, 28)
-
- /* Embedded module documentation macros - see modules.h */
- MODULE_AUTHOR("Hewlett-Packard Company");
--MODULE_DESCRIPTION("Driver for HP Smart Array Controllers");
--MODULE_SUPPORTED_DEVICE("HP SA5i SA5i+ SA532 SA5300 SA5312 SA641 SA642 SA6400"
-- " SA6i P600 P800 P400 P400i E200 E200i E500 P700m"
-- " Smart Array G2 Series SAS/SATA Controllers");
--MODULE_VERSION("3.6.20");
-+MODULE_DESCRIPTION("Driver for HP Smart Array Controllers version 4.6.28-20 (d744/s1436)");
-+MODULE_SUPPORTED_DEVICE("HP Smart Array Controllers");
-+MODULE_VERSION("4.6.28-20");
- MODULE_LICENSE("GPL");
-+static int cciss_tape_cmds = 6;
-+module_param(cciss_tape_cmds, int, 0644);
-+MODULE_PARM_DESC(cciss_tape_cmds, "number of commands to allocate for tape devices (default: 6)");
-
- static int cciss_allow_hpsa;
- module_param(cciss_allow_hpsa, int, S_IRUGO|S_IWUSR);
-@@ -74,12 +77,19 @@ MODULE_PARM_DESC(cciss_allow_hpsa,
- "Prevent cciss driver from accessing hardware known to be "
- " supported by the hpsa driver");
-
--#include "cciss_cmd.h"
--#include "cciss.h"
--#include <linux/cciss_ioctl.h>
-+static int cciss_simple_mode;
-+module_param(cciss_simple_mode, int, S_IRUGO|S_IWUSR);
-+MODULE_PARM_DESC(cciss_simple_mode,
-+ "Use 'simple mode' rather than 'performant mode'");
-+
-+#undef PCI_DEVICE_ID_HP_CISSF
-+#ifndef PCI_DEVICE_ID_HP_CISSF
-+#define PCI_DEVICE_ID_HP_CISSF 0x323B
-+#endif
-
- /* define the PCI info for the cards we can control */
- static const struct pci_device_id cciss_pci_device_id[] = {
-+#if SA_CONTROLLERS_LEGACY
- {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISS, 0x0E11, 0x4070},
- {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSB, 0x0E11, 0x4080},
- {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSB, 0x0E11, 0x4082},
-@@ -100,13 +110,25 @@ static const struct pci_device_id cciss_pci_device_id[] = {
- {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSD, 0x103C, 0x3215},
- {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSC, 0x103C, 0x3237},
- {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSC, 0x103C, 0x323D},
-- {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSE, 0x103C, 0x3241},
-+#endif
-+#if SA_CONTROLLERS_GEN6
-+ {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSE, 0x103C, 0x3241},
- {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSE, 0x103C, 0x3243},
- {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSE, 0x103C, 0x3245},
- {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSE, 0x103C, 0x3247},
- {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSE, 0x103C, 0x3249},
- {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSE, 0x103C, 0x324A},
- {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSE, 0x103C, 0x324B},
-+#endif
-+#if SA_CONTROLLERS_GEN8
-+ {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSF, 0x103C, 0x3350},
-+ {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSF, 0x103C, 0x3351},
-+ {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSF, 0x103C, 0x3352},
-+ {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSF, 0x103C, 0x3353},
-+ {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSF, 0x103C, 0x3354},
-+ {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSF, 0x103C, 0x3355},
-+ {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSF, 0x103C, 0x3356},
-+#endif
- {0,}
- };
-
-@@ -117,6 +139,8 @@ MODULE_DEVICE_TABLE(pci, cciss_pci_device_id);
- * access = Address of the struct of function pointers
- */
- static struct board_type products[] = {
-+
-+#if SA_CONTROLLERS_LEGACY
- {0x40700E11, "Smart Array 5300", &SA5_access},
- {0x40800E11, "Smart Array 5i", &SA5B_access},
- {0x40820E11, "Smart Array 532", &SA5B_access},
-@@ -127,6 +151,8 @@ static struct board_type products[] = {
- {0x409D0E11, "Smart Array 6400 EM", &SA5_access},
- {0x40910E11, "Smart Array 6i", &SA5_access},
- {0x3225103C, "Smart Array P600", &SA5_access},
-+ {0x3223103C, "Smart Array P800", &SA5_access},
-+ {0x3234103C, "Smart Array P400", &SA5_access},
- {0x3235103C, "Smart Array P400i", &SA5_access},
- {0x3211103C, "Smart Array E200i", &SA5_access},
- {0x3212103C, "Smart Array E200", &SA5_access},
-@@ -134,11 +160,9 @@ static struct board_type products[] = {
- {0x3214103C, "Smart Array E200i", &SA5_access},
- {0x3215103C, "Smart Array E200i", &SA5_access},
- {0x3237103C, "Smart Array E500", &SA5_access},
--/* controllers below this line are also supported by the hpsa driver. */
--#define HPSA_BOUNDARY 0x3223103C
-- {0x3223103C, "Smart Array P800", &SA5_access},
-- {0x3234103C, "Smart Array P400", &SA5_access},
-- {0x323D103C, "Smart Array P700m", &SA5_access},
-+ {0x323d103c, "Smart Array P700M", &SA5_access},
-+#endif
-+#if SA_CONTROLLERS_GEN6
- {0x3241103C, "Smart Array P212", &SA5_access},
- {0x3243103C, "Smart Array P410", &SA5_access},
- {0x3245103C, "Smart Array P410i", &SA5_access},
-@@ -146,6 +170,16 @@ static struct board_type products[] = {
- {0x3249103C, "Smart Array P812", &SA5_access},
- {0x324A103C, "Smart Array P712m", &SA5_access},
- {0x324B103C, "Smart Array P711m", &SA5_access},
-+#endif
-+#if SA_CONTROLLERS_GEN8
-+ {0x3350103C, "Smart Array P222", &SA5_access},
-+ {0x3351103C, "Smart Array P420", &SA5_access},
-+ {0x3352103C, "Smart Array P421", &SA5_access},
-+ {0x3353103C, "Smart Array P822", &SA5_access},
-+ {0x3354103C, "Smart Array P420i", &SA5_access},
-+ {0x3355103C, "Smart Array P220i", &SA5_access},
-+ {0x3356103C, "Smart Array", &SA5_access},
-+#endif
- };
-
- /* How long to wait (in milliseconds) for board to go into simple mode */
-@@ -162,16 +196,17 @@ static struct board_type products[] = {
-
- static ctlr_info_t *hba[MAX_CTLR];
-
--static struct task_struct *cciss_scan_thread;
--static DEFINE_MUTEX(scan_mutex);
--static LIST_HEAD(scan_q);
--
- static void do_cciss_request(struct request_queue *q);
--static irqreturn_t do_cciss_intr(int irq, void *dev_id);
-+static irqreturn_t do_cciss_intx(int irq, void *dev_id);
-+static irqreturn_t do_cciss_msix_intr(int irq, void *dev_id);
- static int cciss_open(struct block_device *bdev, fmode_t mode);
- static int cciss_release(struct gendisk *disk, fmode_t mode);
- static int cciss_ioctl(struct block_device *bdev, fmode_t mode,
- unsigned int cmd, unsigned long arg);
-+#if defined (CONFIG_COMPAT) || !KFEATURE_HAS_LOCKED_IOCTL
-+static int do_ioctl(struct block_device *bdev, fmode_t mode,
-+ unsigned cmd, unsigned long arg);
-+#endif
- static int cciss_getgeo(struct block_device *bdev, struct hd_geometry *geo);
-
- static int cciss_revalidate(struct gendisk *disk);
-@@ -179,39 +214,52 @@ static int rebuild_lun_table(ctlr_info_t *h, int first_time, int via_ioctl);
- static int deregister_disk(ctlr_info_t *h, int drv_index,
- int clear_all, int via_ioctl);
-
--static void cciss_read_capacity(int ctlr, int logvol, int withirq,
-+static void cciss_read_capacity(ctlr_info_t *h, int logvol,
- sector_t *total_size, unsigned int *block_size);
--static void cciss_read_capacity_16(int ctlr, int logvol, int withirq,
-+static void cciss_read_capacity_16(ctlr_info_t *h, int logvol,
- sector_t *total_size, unsigned int *block_size);
--static void cciss_geometry_inquiry(int ctlr, int logvol,
-- int withirq, sector_t total_size,
-+static void cciss_geometry_inquiry(ctlr_info_t *h, int logvol,
-+ sector_t total_size,
- unsigned int block_size, InquiryData_struct *inq_buff,
- drive_info_struct *drv);
--static void __devinit cciss_interrupt_mode(ctlr_info_t *, struct pci_dev *,
-- __u32);
-+static void __devinit cciss_interrupt_mode(ctlr_info_t *);
-+static int __devinit cciss_enter_simple_mode(struct ctlr_info *h);
- static void start_io(ctlr_info_t *h);
--static int sendcmd(__u8 cmd, int ctlr, void *buff, size_t size,
-- __u8 page_code, unsigned char *scsi3addr, int cmd_type);
--static int sendcmd_withirq(__u8 cmd, int ctlr, void *buff, size_t size,
-+static int sendcmd_withirq(ctlr_info_t *h, __u8 cmd, void *buff, size_t size,
- __u8 page_code, unsigned char scsi3addr[],
- int cmd_type);
- static int sendcmd_withirq_core(ctlr_info_t *h, CommandList_struct *c,
- int attempt_retry);
- static int process_sendcmd_error(ctlr_info_t *h, CommandList_struct *c);
-
--static void fail_all_cmds(unsigned long ctlr);
--static int add_to_scan_list(struct ctlr_info *h);
--static int scan_thread(void *data);
-+static void cciss_get_uid(ctlr_info_t *h, int logvol,
-+ unsigned char *uid, int buflen);
- static int check_for_unit_attention(ctlr_info_t *h, CommandList_struct *c);
- static void cciss_hba_release(struct device *dev);
- static void cciss_device_release(struct device *dev);
- static void cciss_free_gendisk(ctlr_info_t *h, int drv_index);
- static void cciss_free_drive_info(ctlr_info_t *h, int drv_index);
-+static inline void log_unit_to_scsi3addr(ctlr_info_t *h,
-+ unsigned char scsi3addr[], uint32_t log_unit);
-+static int __devinit cciss_find_cfg_addrs(struct pci_dev *pdev,
-+ void __iomem *vaddr, u32 *cfg_base_addr, u64 *cfg_base_addr_index,
-+ u64 *cfg_offset);
-+static int __devinit cciss_pci_find_memory_BAR(struct pci_dev *pdev,
-+ unsigned long *memory_bar);
-+static inline u32 cciss_tag_discard_error_bits(ctlr_info_t *h, u32 tag);
-+static __devinit int write_driver_ver_to_cfgtable(
-+ CfgTable_struct __iomem *cfgtable);
-+
-+
-+/* performant mode helper functions */
-+static void calc_bucket_map(int *bucket, int num_buckets, int nsgs,
-+ int *bucket_map);
-+static void cciss_put_controller_into_performant_mode(ctlr_info_t *h);
-
- #ifdef CONFIG_PROC_FS
--static void cciss_procinit(int i);
-+static void cciss_procinit(ctlr_info_t *h);
- #else
--static void cciss_procinit(int i)
-+static void cciss_procinit(ctlr_info_t *h)
- {
- }
- #endif /* CONFIG_PROC_FS */
-@@ -220,12 +268,14 @@ static void cciss_procinit(int i)
- static int cciss_compat_ioctl(struct block_device *, fmode_t,
- unsigned, unsigned long);
- #endif
-+static void cciss_sysfs_stat_inquiry(ctlr_info_t *h, int logvol,
-+ drive_info_struct *drv);
-
- static const struct block_device_operations cciss_fops = {
- .owner = THIS_MODULE,
- .open = cciss_open,
- .release = cciss_release,
-- .locked_ioctl = cciss_ioctl,
-+ SET_IOCTL_FUNCTION(cciss_ioctl, do_ioctl)
- .getgeo = cciss_getgeo,
- #ifdef CONFIG_COMPAT
- .compat_ioctl = cciss_compat_ioctl,
-@@ -233,12 +283,22 @@ static const struct block_device_operations cciss_fops = {
- .revalidate_disk = cciss_revalidate,
- };
-
-+/* set_performant_mode: Modify the tag for cciss performant
-+ * set bit 0 for pull model, bits 3-1 for block fetch
-+ * register number
-+ */
-+static void set_performant_mode(ctlr_info_t *h, CommandList_struct *c)
-+{
-+ if (likely(h->transMethod & CFGTBL_Trans_Performant))
-+ c->busaddr |= 1 | (h->blockFetchTable[c->Header.SGList] << 1);
-+}
-+
- /*
- * Enqueuing and dequeuing functions for cmdlists.
- */
--static inline void addQ(struct hlist_head *list, CommandList_struct *c)
-+static inline void addQ(struct list_head *list, CommandList_struct *c)
- {
-- hlist_add_head(&c->list, list);
-+ list_add_tail(&c->list, list);
- }
-
- static inline void removeQ(CommandList_struct *c)
-@@ -251,18 +311,105 @@ static inline void removeQ(CommandList_struct *c)
- * them off as 'stale' to prevent the driver from
- * falling over.
- */
-- if (WARN_ON(hlist_unhashed(&c->list))) {
-+ if (WARN_ON(list_empty(&c->list))) {
- c->cmd_type = CMD_MSG_STALE;
- return;
- }
-
-- hlist_del_init(&c->list);
-+ list_del_init(&c->list);
-+}
-+
-+static void enqueue_cmd_and_start_io(ctlr_info_t *h,
-+ CommandList_struct *c)
-+{
-+ unsigned long flags;
-+ set_performant_mode(h, c);
-+ spin_lock_irqsave(&h->lock, flags);
-+ addQ(&h->reqQ, c);
-+ h->Qdepth++;
-+ if (h->Qdepth > h->maxQsinceinit)
-+ h->maxQsinceinit = h->Qdepth;
-+ start_io(h);
-+ spin_unlock_irqrestore(&h->lock, flags);
-+}
-+
-+static void cciss_free_sg_chain_blocks(SGDescriptor_struct **cmd_sg_list,
-+ int nr_cmds)
-+{
-+ int i;
-+
-+ if (!cmd_sg_list)
-+ return;
-+ for (i = 0; i < nr_cmds; i++) {
-+ kfree(cmd_sg_list[i]);
-+ cmd_sg_list[i] = NULL;
-+ }
-+ kfree(cmd_sg_list);
-+}
-+
-+static SGDescriptor_struct **cciss_allocate_sg_chain_blocks(
-+ ctlr_info_t *h, int chainsize, int nr_cmds)
-+{
-+ int j;
-+ SGDescriptor_struct **cmd_sg_list;
-+
-+ if (chainsize <= 0)
-+ return NULL;
-+
-+ cmd_sg_list = kmalloc(sizeof(*cmd_sg_list) * nr_cmds, GFP_KERNEL);
-+ if (!cmd_sg_list)
-+ return NULL;
-+
-+ /* Build up chain blocks for each command */
-+ for (j = 0; j < nr_cmds; j++) {
-+ /* Need a block of chainsized s/g elements. */
-+ cmd_sg_list[j] = kmalloc((chainsize *
-+ sizeof(*cmd_sg_list[j])), GFP_KERNEL);
-+ if (!cmd_sg_list[j]) {
-+ dev_err(&h->pdev->dev, "Cannot get memory "
-+ "for s/g chains.\n");
-+ goto clean;
-+ }
-+ }
-+ return cmd_sg_list;
-+clean:
-+ cciss_free_sg_chain_blocks(cmd_sg_list, nr_cmds);
-+ return NULL;
-+}
-+
-+static void cciss_unmap_sg_chain_block(ctlr_info_t *h, CommandList_struct *c)
-+{
-+ SGDescriptor_struct *chain_sg;
-+ u64bit temp64;
-+
-+ if (c->Header.SGTotal <= h->max_cmd_sgentries)
-+ return;
-+
-+ chain_sg = &c->SG[h->max_cmd_sgentries - 1];
-+ temp64.val32.lower = chain_sg->Addr.lower;
-+ temp64.val32.upper = chain_sg->Addr.upper;
-+ pci_unmap_single(h->pdev, temp64.val, chain_sg->Len, PCI_DMA_TODEVICE);
-+}
-+
-+static void cciss_map_sg_chain_block(ctlr_info_t *h, CommandList_struct *c,
-+ SGDescriptor_struct *chain_block, int len)
-+{
-+ SGDescriptor_struct *chain_sg;
-+ u64bit temp64;
-+
-+ chain_sg = &c->SG[h->max_cmd_sgentries - 1];
-+ chain_sg->Ext = CCISS_SG_CHAIN;
-+ chain_sg->Len = len;
-+ temp64.val = pci_map_single(h->pdev, chain_block, len,
-+ PCI_DMA_TODEVICE);
-+ chain_sg->Addr.lower = temp64.val32.lower;
-+ chain_sg->Addr.upper = temp64.val32.upper;
- }
-
- #include "cciss_scsi.c" /* For SCSI tape support */
-
- static const char *raid_label[] = { "0", "4", "1(1+0)", "5", "5+1", "ADG",
-- "UNKNOWN"
-+ "1(ADM)", "UNKNOWN"
- };
- #define RAID_UNKNOWN (sizeof(raid_label) / sizeof(raid_label[0])-1)
-
-@@ -295,32 +442,31 @@ static void cciss_seq_show_header(struct seq_file *seq)
- h->product_name,
- (unsigned long)h->board_id,
- h->firm_ver[0], h->firm_ver[1], h->firm_ver[2],
-- h->firm_ver[3], (unsigned int)h->intr[SIMPLE_MODE_INT],
-+ h->firm_ver[3], (unsigned int)h->intr[h->intr_mode],
- h->num_luns,
- h->Qdepth, h->commands_outstanding,
- h->maxQsinceinit, h->max_outstanding, h->maxSG);
-
- #ifdef CONFIG_CISS_SCSI_TAPE
-- cciss_seq_tape_report(seq, h->ctlr);
-+ cciss_seq_tape_report(seq, h);
- #endif /* CONFIG_CISS_SCSI_TAPE */
- }
-
- static void *cciss_seq_start(struct seq_file *seq, loff_t *pos)
- {
- ctlr_info_t *h = seq->private;
-- unsigned ctlr = h->ctlr;
- unsigned long flags;
-
- /* prevent displaying bogus info during configuration
- * or deconfiguration of a logical volume
- */
-- spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
-+ spin_lock_irqsave(&h->lock, flags);
- if (h->busy_configuring) {
-- spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
-+ spin_unlock_irqrestore(&h->lock, flags);
- return ERR_PTR(-EBUSY);
- }
- h->busy_configuring = 1;
-- spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
-+ spin_unlock_irqrestore(&h->lock, flags);
-
- if (*pos == 0)
- cciss_seq_show_header(seq);
-@@ -427,12 +573,9 @@ cciss_proc_write(struct file *file, const char __user *buf,
- if (strncmp(ENGAGE_SCSI, buffer, sizeof ENGAGE_SCSI - 1) == 0) {
- struct seq_file *seq = file->private_data;
- ctlr_info_t *h = seq->private;
-- int rc;
-
-- rc = cciss_engage_scsi(h->ctlr);
-- if (rc != 0)
-- err = -rc;
-- else
-+ err = cciss_engage_scsi(h);
-+ if (err == 0)
- err = length;
- } else
- #endif /* CONFIG_CISS_SCSI_TAPE */
-@@ -454,7 +597,7 @@ static const struct file_operations cciss_proc_fops = {
- .write = cciss_proc_write,
- };
-
--static void __devinit cciss_procinit(int i)
-+static void __devinit cciss_procinit(ctlr_info_t *h)
- {
- struct proc_dir_entry *pde;
-
-@@ -462,17 +605,76 @@ static void __devinit cciss_procinit(int i)
- proc_cciss = proc_mkdir("driver/cciss", NULL);
- if (!proc_cciss)
- return;
-- pde = proc_create_data(hba[i]->devname, S_IWUSR | S_IRUSR | S_IRGRP |
-+ pde = proc_create_data(h->devname, S_IWUSR | S_IRUSR | S_IRGRP |
- S_IROTH, proc_cciss,
-- &cciss_proc_fops, hba[i]);
-+ &cciss_proc_fops, h);
- }
- #endif /* CONFIG_PROC_FS */
-
--#define MAX_PRODUCT_NAME_LEN 19
--
- #define to_hba(n) container_of(n, struct ctlr_info, dev)
- #define to_drv(n) container_of(n, drive_info_struct, dev)
-
-+/* List of controllers which cannot be hard reset on kexec with reset_devices */
-+static u32 unresettable_controller[] = {
-+ 0x324a103C, /* Smart Array P712m */
-+ 0x324b103C, /* SmartArray P711m */
-+ 0x3223103C, /* Smart Array P800 */
-+ 0x3234103C, /* Smart Array P400 */
-+ 0x3235103C, /* Smart Array P400i */
-+ 0x3211103C, /* Smart Array E200i */
-+ 0x3212103C, /* Smart Array E200 */
-+ 0x3213103C, /* Smart Array E200i */
-+ 0x3214103C, /* Smart Array E200i */
-+ 0x3215103C, /* Smart Array E200i */
-+ 0x3237103C, /* Smart Array E500 */
-+ 0x323D103C, /* Smart Array P700m */
-+ 0x409C0E11, /* Smart Array 6400 */
-+ 0x409D0E11, /* Smart Array 6400 EM */
-+};
-+
-+/* List of controllers which cannot even be soft reset */
-+static u32 soft_unresettable_controller[] = {
-+ 0x409C0E11, /* Smart Array 6400 */
-+ 0x409D0E11, /* Smart Array 6400 EM */
-+};
-+
-+static int ctlr_is_hard_resettable(u32 board_id)
-+{
-+ int i;
-+
-+ for (i = 0; i < ARRAY_SIZE(unresettable_controller); i++)
-+ if (unresettable_controller[i] == board_id)
-+ return 0;
-+ return 1;
-+}
-+
-+static int ctlr_is_soft_resettable(u32 board_id)
-+{
-+ int i;
-+
-+ for (i = 0; i < ARRAY_SIZE(soft_unresettable_controller); i++)
-+ if (soft_unresettable_controller[i] == board_id)
-+ return 0;
-+ return 1;
-+}
-+
-+static int ctlr_is_resettable(u32 board_id)
-+{
-+ return ctlr_is_hard_resettable(board_id) ||
-+ ctlr_is_soft_resettable(board_id);
-+}
-+
-+static ssize_t host_show_resettable(struct device *dev,
-+ struct device_attribute *attr,
-+ char *buf)
-+{
-+ struct ctlr_info *h = to_hba(dev);
-+
-+ return snprintf(buf, 20, "%d\n", ctlr_is_resettable(h->board_id));
-+}
-+static DEVICE_ATTR(resettable, S_IRUGO, host_show_resettable, NULL);
-+
-+#if 0
- static ssize_t host_store_rescan(struct device *dev,
- struct device_attribute *attr,
- const char *buf, size_t count)
-@@ -486,6 +688,19 @@ static ssize_t host_store_rescan(struct device *dev,
- return count;
- }
- static DEVICE_ATTR(rescan, S_IWUSR, NULL, host_store_rescan);
-+#endif /* mfm need to do something else in sysfs */
-+
-+static ssize_t host_show_transport_mode(struct device *dev,
-+ struct device_attribute *attr,
-+ char *buf)
-+{
-+ struct ctlr_info *h = to_hba(dev);
-+
-+ return snprintf(buf, 20, "%s\n",
-+ h->transMethod & CFGTBL_Trans_Performant ?
-+ "performant" : "simple");
-+}
-+static DEVICE_ATTR(transport_mode, S_IRUGO, host_show_transport_mode, NULL);
-
- static ssize_t dev_show_unique_id(struct device *dev,
- struct device_attribute *attr,
-@@ -497,12 +712,12 @@ static ssize_t dev_show_unique_id(struct device *dev,
- unsigned long flags;
- int ret = 0;
-
-- spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
-+ spin_lock_irqsave(&h->lock, flags);
- if (h->busy_configuring)
- ret = -EBUSY;
- else
-- memcpy(sn, drv->serial_no, sizeof(sn));
-- spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
-+ memcpy(sn, drv->uid, sizeof(sn));
-+ spin_unlock_irqrestore(&h->lock, flags);
-
- if (ret)
- return ret;
-@@ -527,12 +742,12 @@ static ssize_t dev_show_vendor(struct device *dev,
- unsigned long flags;
- int ret = 0;
-
-- spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
-+ spin_lock_irqsave(&h->lock, flags);
- if (h->busy_configuring)
- ret = -EBUSY;
- else
- memcpy(vendor, drv->vendor, VENDOR_LEN + 1);
-- spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
-+ spin_unlock_irqrestore(&h->lock, flags);
-
- if (ret)
- return ret;
-@@ -551,12 +766,12 @@ static ssize_t dev_show_model(struct device *dev,
- unsigned long flags;
- int ret = 0;
-
-- spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
-+ spin_lock_irqsave(&h->lock, flags);
- if (h->busy_configuring)
- ret = -EBUSY;
- else
- memcpy(model, drv->model, MODEL_LEN + 1);
-- spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
-+ spin_unlock_irqrestore(&h->lock, flags);
-
- if (ret)
- return ret;
-@@ -575,12 +790,12 @@ static ssize_t dev_show_rev(struct device *dev,
- unsigned long flags;
- int ret = 0;
-
-- spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
-+ spin_lock_irqsave(&h->lock, flags);
- if (h->busy_configuring)
- ret = -EBUSY;
- else
- memcpy(rev, drv->rev, REV_LEN + 1);
-- spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
-+ spin_unlock_irqrestore(&h->lock, flags);
-
- if (ret)
- return ret;
-@@ -597,17 +812,17 @@ static ssize_t cciss_show_lunid(struct device *dev,
- unsigned long flags;
- unsigned char lunid[8];
-
-- spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
-+ spin_lock_irqsave(&h->lock, flags);
- if (h->busy_configuring) {
-- spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
-+ spin_unlock_irqrestore(&h->lock, flags);
- return -EBUSY;
- }
- if (!drv->heads) {
-- spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
-+ spin_unlock_irqrestore(&h->lock, flags);
- return -ENOTTY;
- }
- memcpy(lunid, drv->LunID, sizeof(lunid));
-- spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
-+ spin_unlock_irqrestore(&h->lock, flags);
- return snprintf(buf, 20, "0x%02x%02x%02x%02x%02x%02x%02x%02x\n",
- lunid[0], lunid[1], lunid[2], lunid[3],
- lunid[4], lunid[5], lunid[6], lunid[7]);
-@@ -622,13 +837,13 @@ static ssize_t cciss_show_raid_level(struct device *dev,
- int raid;
- unsigned long flags;
-
-- spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
-+ spin_lock_irqsave(&h->lock, flags);
- if (h->busy_configuring) {
-- spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
-+ spin_unlock_irqrestore(&h->lock, flags);
- return -EBUSY;
- }
- raid = drv->raid_level;
-- spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
-+ spin_unlock_irqrestore(&h->lock, flags);
- if (raid < 0 || raid > RAID_UNKNOWN)
- raid = RAID_UNKNOWN;
-
-@@ -645,19 +860,23 @@ static ssize_t cciss_show_usage_count(struct device *dev,
- unsigned long flags;
- int count;
-
-- spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
-+ spin_lock_irqsave(&h->lock, flags);
- if (h->busy_configuring) {
-- spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
-+ spin_unlock_irqrestore(&h->lock, flags);
- return -EBUSY;
- }
- count = drv->usage_count;
-- spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
-+ spin_unlock_irqrestore(&h->lock, flags);
- return snprintf(buf, 20, "%d\n", count);
- }
- static DEVICE_ATTR(usage_count, S_IRUGO, cciss_show_usage_count, NULL);
-
- static struct attribute *cciss_host_attrs[] = {
-+#if 0
- &dev_attr_rescan.attr,
-+#endif
-+ &dev_attr_resettable.attr,
-+ &dev_attr_transport_mode.attr,
- NULL
- };
-
-@@ -672,8 +891,8 @@ static const struct attribute_group *cciss_host_attr_groups[] = {
-
- static struct device_type cciss_host_type = {
- .name = "cciss_host",
-- .groups = cciss_host_attr_groups,
- .release = cciss_hba_release,
-+ .groups = cciss_host_attr_groups,
- };
-
- static struct attribute *cciss_dev_attrs[] = {
-@@ -796,62 +1015,72 @@ static void cciss_destroy_ld_sysfs_entry(struct ctlr_info *h, int drv_index,
- /*
- * For operations that cannot sleep, a command block is allocated at init,
- * and managed by cmd_alloc() and cmd_free() using a simple bitmap to track
-- * which ones are free or in use. For operations that can wait for kmalloc
-- * to possible sleep, this routine can be called with get_from_pool set to 0.
-- * cmd_free() MUST be called with a got_from_pool set to 0 if cmd_alloc was.
-+ * which ones are free or in use.
- */
--static CommandList_struct *cmd_alloc(ctlr_info_t *h, int get_from_pool)
-+static CommandList_struct *cmd_alloc(ctlr_info_t *h)
- {
- CommandList_struct *c;
- int i;
- u64bit temp64;
- dma_addr_t cmd_dma_handle, err_dma_handle;
-
-- if (!get_from_pool) {
-- c = (CommandList_struct *) pci_alloc_consistent(h->pdev,
-- sizeof(CommandList_struct), &cmd_dma_handle);
-- if (c == NULL)
-+ do {
-+ i = find_first_zero_bit(h->cmd_pool_bits, h->nr_cmds);
-+ if (i == h->nr_cmds)
- return NULL;
-- memset(c, 0, sizeof(CommandList_struct));
-+ } while (test_and_set_bit(i & (BITS_PER_LONG - 1),
-+ h->cmd_pool_bits + (i / BITS_PER_LONG)) != 0);
-+ c = h->cmd_pool + i;
-+ memset(c, 0, sizeof(CommandList_struct));
-+ cmd_dma_handle = h->cmd_pool_dhandle + i * sizeof(CommandList_struct);
-+ c->err_info = h->errinfo_pool + i;
-+ memset(c->err_info, 0, sizeof(ErrorInfo_struct));
-+ err_dma_handle = h->errinfo_pool_dhandle
-+ + i * sizeof(ErrorInfo_struct);
-+ h->nr_allocs++;
-
-- c->cmdindex = -1;
-+ c->cmdindex = i;
-
-- c->err_info = (ErrorInfo_struct *)
-- pci_alloc_consistent(h->pdev, sizeof(ErrorInfo_struct),
-- &err_dma_handle);
-+ INIT_LIST_HEAD(&c->list);
-+ c->busaddr = (__u32) cmd_dma_handle;
-+ temp64.val = (__u64) err_dma_handle;
-+ c->ErrDesc.Addr.lower = temp64.val32.lower;
-+ c->ErrDesc.Addr.upper = temp64.val32.upper;
-+ c->ErrDesc.Len = sizeof(ErrorInfo_struct);
-
-- if (c->err_info == NULL) {
-- pci_free_consistent(h->pdev,
-- sizeof(CommandList_struct), c, cmd_dma_handle);
-- return NULL;
-- }
-- memset(c->err_info, 0, sizeof(ErrorInfo_struct));
-- } else { /* get it out of the controllers pool */
-+ c->ctlr = h->ctlr;
-+ return c;
-+}
-
-- do {
-- i = find_first_zero_bit(h->cmd_pool_bits, h->nr_cmds);
-- if (i == h->nr_cmds)
-- return NULL;
-- } while (test_and_set_bit
-- (i & (BITS_PER_LONG - 1),
-- h->cmd_pool_bits + (i / BITS_PER_LONG)) != 0);
--#ifdef CCISS_DEBUG
-- printk(KERN_DEBUG "cciss: using command buffer %d\n", i);
--#endif
-- c = h->cmd_pool + i;
-- memset(c, 0, sizeof(CommandList_struct));
-- cmd_dma_handle = h->cmd_pool_dhandle
-- + i * sizeof(CommandList_struct);
-- c->err_info = h->errinfo_pool + i;
-- memset(c->err_info, 0, sizeof(ErrorInfo_struct));
-- err_dma_handle = h->errinfo_pool_dhandle
-- + i * sizeof(ErrorInfo_struct);
-- h->nr_allocs++;
-+/* allocate a command using pci_alloc_consistent, used for ioctls,
-+ * etc., not for the main i/o path.
-+ */
-+static CommandList_struct *cmd_special_alloc(ctlr_info_t *h)
-+{
-+ CommandList_struct *c;
-+ u64bit temp64;
-+ dma_addr_t cmd_dma_handle, err_dma_handle;
-+
-+ c = (CommandList_struct *) pci_alloc_consistent(h->pdev,
-+ sizeof(CommandList_struct), &cmd_dma_handle);
-+ if (c == NULL)
-+ return NULL;
-+ memset(c, 0, sizeof(CommandList_struct));
-
-- c->cmdindex = i;
-+ c->cmdindex = -1;
-+
-+ c->err_info = (ErrorInfo_struct *)
-+ pci_alloc_consistent(h->pdev, sizeof(ErrorInfo_struct),
-+ &err_dma_handle);
-+
-+ if (c->err_info == NULL) {
-+ pci_free_consistent(h->pdev,
-+ sizeof(CommandList_struct), c, cmd_dma_handle);
-+ return NULL;
- }
-+ memset(c->err_info, 0, sizeof(ErrorInfo_struct));
-
-- INIT_HLIST_NODE(&c->list);
-+ INIT_LIST_HEAD(&c->list);
- c->busaddr = (__u32) cmd_dma_handle;
- temp64.val = (__u64) err_dma_handle;
- c->ErrDesc.Addr.lower = temp64.val32.lower;
-@@ -862,27 +1091,26 @@ static CommandList_struct *cmd_alloc(ctlr_info_t *h, int get_from_pool)
- return c;
- }
-
--/*
-- * Frees a command block that was previously allocated with cmd_alloc().
-- */
--static void cmd_free(ctlr_info_t *h, CommandList_struct *c, int got_from_pool)
-+static void cmd_free(ctlr_info_t *h, CommandList_struct *c)
- {
- int i;
-+
-+ i = c - h->cmd_pool;
-+ clear_bit(i & (BITS_PER_LONG - 1),
-+ h->cmd_pool_bits + (i / BITS_PER_LONG));
-+ h->nr_frees++;
-+}
-+
-+static void cmd_special_free(ctlr_info_t *h, CommandList_struct *c)
-+{
- u64bit temp64;
-
-- if (!got_from_pool) {
-- temp64.val32.lower = c->ErrDesc.Addr.lower;
-- temp64.val32.upper = c->ErrDesc.Addr.upper;
-- pci_free_consistent(h->pdev, sizeof(ErrorInfo_struct),
-- c->err_info, (dma_addr_t) temp64.val);
-- pci_free_consistent(h->pdev, sizeof(CommandList_struct),
-- c, (dma_addr_t) c->busaddr);
-- } else {
-- i = c - h->cmd_pool;
-- clear_bit(i & (BITS_PER_LONG - 1),
-- h->cmd_pool_bits + (i / BITS_PER_LONG));
-- h->nr_frees++;
-- }
-+ temp64.val32.lower = c->ErrDesc.Addr.lower;
-+ temp64.val32.upper = c->ErrDesc.Addr.upper;
-+ pci_free_consistent(h->pdev, sizeof(ErrorInfo_struct),
-+ c->err_info, (dma_addr_t) temp64.val);
-+ pci_free_consistent(h->pdev, sizeof(CommandList_struct),
-+ c, (dma_addr_t) cciss_tag_discard_error_bits(h, (u32) c->busaddr));
- }
-
- static inline ctlr_info_t *get_host(struct gendisk *disk)
-@@ -900,13 +1128,10 @@ static inline drive_info_struct *get_drv(struct gendisk *disk)
- */
- static int cciss_open(struct block_device *bdev, fmode_t mode)
- {
-- ctlr_info_t *host = get_host(bdev->bd_disk);
-+ ctlr_info_t *h = get_host(bdev->bd_disk);
- drive_info_struct *drv = get_drv(bdev->bd_disk);
-
--#ifdef CCISS_DEBUG
-- printk(KERN_DEBUG "cciss_open %s\n", bdev->bd_disk->disk_name);
--#endif /* CCISS_DEBUG */
--
-+ dev_dbg(&h->pdev->dev, "cciss_open %s\n", bdev->bd_disk->disk_name);
- if (drv->busy_configuring)
- return -EBUSY;
- /*
-@@ -932,7 +1157,7 @@ static int cciss_open(struct block_device *bdev, fmode_t mode)
- return -EPERM;
- }
- drv->usage_count++;
-- host->usage_count++;
-+ h->usage_count++;
- return 0;
- }
-
-@@ -941,19 +1166,18 @@ static int cciss_open(struct block_device *bdev, fmode_t mode)
- */
- static int cciss_release(struct gendisk *disk, fmode_t mode)
- {
-- ctlr_info_t *host = get_host(disk);
-+ ctlr_info_t *h = get_host(disk);
- drive_info_struct *drv = get_drv(disk);
--
--#ifdef CCISS_DEBUG
-- printk(KERN_DEBUG "cciss_release %s\n", disk->disk_name);
--#endif /* CCISS_DEBUG */
--
-+ dev_dbg(&h->pdev->dev, "cciss_release %s\n", disk->disk_name);
- drv->usage_count--;
-- host->usage_count--;
-+ h->usage_count--;
- return 0;
- }
-
--#ifdef CONFIG_COMPAT
-+/*
-+ * This area could use some work to make it easier to understand.
-+ */
-+#if defined (CONFIG_COMPAT) || !KFEATURE_HAS_LOCKED_IOCTL
-
- static int do_ioctl(struct block_device *bdev, fmode_t mode,
- unsigned cmd, unsigned long arg)
-@@ -965,6 +1189,10 @@ static int do_ioctl(struct block_device *bdev, fmode_t mode,
- return ret;
- }
-
-+#endif
-+
-+#ifdef CONFIG_COMPAT
-+
- static int cciss_ioctl32_passthru(struct block_device *bdev, fmode_t mode,
- unsigned cmd, unsigned long arg);
- static int cciss_ioctl32_big_passthru(struct block_device *bdev, fmode_t mode,
-@@ -1011,6 +1239,7 @@ static int cciss_ioctl32_passthru(struct block_device *bdev, fmode_t mode,
- int err;
- u32 cp;
-
-+ memset(&arg64, 0, sizeof(arg64));
- err = 0;
- err |=
- copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
-@@ -1051,6 +1280,7 @@ static int cciss_ioctl32_big_passthru(struct block_device *bdev, fmode_t mode,
- int err;
- u32 cp;
-
-+ memset(&arg64, 0, sizeof(arg64));
- err = 0;
- err |=
- copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
-@@ -1095,493 +1325,459 @@ static int cciss_getgeo(struct block_device *bdev, struct hd_geometry *geo)
- return 0;
- }
-
--static void check_ioctl_unit_attention(ctlr_info_t *host, CommandList_struct *c)
-+static void check_ioctl_unit_attention(ctlr_info_t *h, CommandList_struct *c)
- {
- if (c->err_info->CommandStatus == CMD_TARGET_STATUS &&
- c->err_info->ScsiStatus != SAM_STAT_CHECK_CONDITION)
-- (void)check_for_unit_attention(host, c);
-+ (void)check_for_unit_attention(h, c);
- }
--/*
-- * ioctl
-- */
-+
-+static int cciss_getpciinfo(ctlr_info_t *h, void __user *argp)
-+{
-+ cciss_pci_info_struct pciinfo;
-+
-+ if (!argp)
-+ return -EINVAL;
-+ pciinfo.domain = pci_domain_nr(h->pdev->bus);
-+ pciinfo.bus = h->pdev->bus->number;
-+ pciinfo.dev_fn = h->pdev->devfn;
-+ pciinfo.board_id = h->board_id;
-+ if (copy_to_user(argp, &pciinfo, sizeof(cciss_pci_info_struct)))
-+ return -EFAULT;
-+ return 0;
-+}
-+
-+static int cciss_getintinfo(ctlr_info_t *h, void __user *argp)
-+{
-+ cciss_coalint_struct intinfo;
-+
-+ if (!argp)
-+ return -EINVAL;
-+ intinfo.delay = readl(&h->cfgtable->HostWrite.CoalIntDelay);
-+ intinfo.count = readl(&h->cfgtable->HostWrite.CoalIntCount);
-+ if (copy_to_user
-+ (argp, &intinfo, sizeof(cciss_coalint_struct)))
-+ return -EFAULT;
-+ return 0;
-+}
-+
-+static int cciss_setintinfo(ctlr_info_t *h, void __user *argp)
-+{
-+ cciss_coalint_struct intinfo;
-+ unsigned long flags;
-+ int i;
-+
-+ if (!argp)
-+ return -EINVAL;
-+ if (!capable(CAP_SYS_ADMIN))
-+ return -EPERM;
-+ if (copy_from_user(&intinfo, argp, sizeof(intinfo)))
-+ return -EFAULT;
-+ if ((intinfo.delay == 0) && (intinfo.count == 0))
-+ return -EINVAL;
-+ spin_lock_irqsave(&h->lock, flags);
-+ /* Update the field, and then ring the doorbell */
-+ writel(intinfo.delay, &(h->cfgtable->HostWrite.CoalIntDelay));
-+ writel(intinfo.count, &(h->cfgtable->HostWrite.CoalIntCount));
-+ writel(CFGTBL_ChangeReq, h->vaddr + SA5_DOORBELL);
-+
-+ for (i = 0; i < MAX_IOCTL_CONFIG_WAIT; i++) {
-+ if (!(readl(h->vaddr + SA5_DOORBELL) & CFGTBL_ChangeReq))
-+ break;
-+ udelay(1000); /* delay and try again */
-+ }
-+ spin_unlock_irqrestore(&h->lock, flags);
-+ if (i >= MAX_IOCTL_CONFIG_WAIT)
-+ return -EAGAIN;
-+ return 0;
-+}
-+
-+static int cciss_getnodename(ctlr_info_t *h, void __user *argp)
-+{
-+ NodeName_type NodeName;
-+ int i;
-+
-+ if (!argp)
-+ return -EINVAL;
-+ for (i = 0; i < 16; i++)
-+ NodeName[i] = readb(&h->cfgtable->ServerName[i]);
-+ if (copy_to_user(argp, NodeName, sizeof(NodeName_type)))
-+ return -EFAULT;
-+ return 0;
-+}
-+
-+static int cciss_setnodename(ctlr_info_t *h, void __user *argp)
-+{
-+ NodeName_type NodeName;
-+ unsigned long flags;
-+ int i;
-+
-+ if (!argp)
-+ return -EINVAL;
-+ if (!capable(CAP_SYS_ADMIN))
-+ return -EPERM;
-+ if (copy_from_user(NodeName, argp, sizeof(NodeName_type)))
-+ return -EFAULT;
-+ spin_lock_irqsave(&h->lock, flags);
-+ /* Update the field, and then ring the doorbell */
-+ for (i = 0; i < 16; i++)
-+ writeb(NodeName[i], &h->cfgtable->ServerName[i]);
-+ writel(CFGTBL_ChangeReq, h->vaddr + SA5_DOORBELL);
-+ for (i = 0; i < MAX_IOCTL_CONFIG_WAIT; i++) {
-+ if (!(readl(h->vaddr + SA5_DOORBELL) & CFGTBL_ChangeReq))
-+ break;
-+ udelay(1000); /* delay and try again */
-+ }
-+ spin_unlock_irqrestore(&h->lock, flags);
-+ if (i >= MAX_IOCTL_CONFIG_WAIT)
-+ return -EAGAIN;
-+ return 0;
-+}
-+
-+static int cciss_getheartbeat(ctlr_info_t *h, void __user *argp)
-+{
-+ Heartbeat_type heartbeat;
-+
-+ if (!argp)
-+ return -EINVAL;
-+ heartbeat = readl(&h->cfgtable->HeartBeat);
-+ if (copy_to_user(argp, &heartbeat, sizeof(Heartbeat_type)))
-+ return -EFAULT;
-+ return 0;
-+}
-+
-+static int cciss_getbustypes(ctlr_info_t *h, void __user *argp)
-+{
-+ BusTypes_type BusTypes;
-+
-+ if (!argp)
-+ return -EINVAL;
-+ BusTypes = readl(&h->cfgtable->BusTypes);
-+ if (copy_to_user(argp, &BusTypes, sizeof(BusTypes_type)))
-+ return -EFAULT;
-+ return 0;
-+}
-+
-+static int cciss_getfirmver(ctlr_info_t *h, void __user *argp)
-+{
-+ FirmwareVer_type firmware;
-+
-+ if (!argp)
-+ return -EINVAL;
-+ memcpy(firmware, h->firm_ver, 4);
-+
-+ if (copy_to_user
-+ (argp, firmware, sizeof(FirmwareVer_type)))
-+ return -EFAULT;
-+ return 0;
-+}
-+
-+static int cciss_getdrivver(ctlr_info_t *h, void __user *argp)
-+{
-+ DriverVer_type DriverVer = DRIVER_VERSION;
-+
-+ if (!argp)
-+ return -EINVAL;
-+ if (copy_to_user(argp, &DriverVer, sizeof(DriverVer_type)))
-+ return -EFAULT;
-+ return 0;
-+}
-+
-+static int cciss_getluninfo(ctlr_info_t *h,
-+ struct gendisk *disk, void __user *argp)
-+{
-+ LogvolInfo_struct luninfo;
-+ drive_info_struct *drv = get_drv(disk);
-+
-+ if (!argp)
-+ return -EINVAL;
-+ memcpy(&luninfo.LunID, drv->LunID, sizeof(luninfo.LunID));
-+ luninfo.num_opens = drv->usage_count;
-+ luninfo.num_parts = 0;
-+ if (copy_to_user(argp, &luninfo, sizeof(LogvolInfo_struct)))
-+ return -EFAULT;
-+ return 0;
-+}
-+
-+static int cciss_passthru(ctlr_info_t *h, void __user *argp)
-+{
-+ IOCTL_Command_struct iocommand;
-+ CommandList_struct *c;
-+ char *buff = NULL;
-+ u64bit temp64;
-+ DECLARE_COMPLETION_ONSTACK(wait);
-+
-+ if (!argp)
-+ return -EINVAL;
-+
-+ if (!capable(CAP_SYS_RAWIO))
-+ return -EPERM;
-+
-+ if (copy_from_user(&iocommand, argp, sizeof(IOCTL_Command_struct)))
-+ return -EFAULT;
-+ if ((iocommand.buf_size < 1) &&
-+ (iocommand.Request.Type.Direction != XFER_NONE))
-+ return -EINVAL;
-+ if (iocommand.buf_size > 0) {
-+ buff = kmalloc(iocommand.buf_size, GFP_KERNEL);
-+ if (buff == NULL)
-+ return -EFAULT;
-+ }
-+ if (iocommand.Request.Type.Direction == XFER_WRITE) {
-+ if (copy_from_user(buff, iocommand.buf, iocommand.buf_size)) {
-+ kfree(buff);
-+ return -EFAULT;
-+ }
-+ } else {
-+ memset(buff, 0, iocommand.buf_size);
-+ }
-+ c = cmd_special_alloc(h);
-+ if (!c) {
-+ kfree(buff);
-+ return -ENOMEM;
-+ }
-+ c->cmd_type = CMD_IOCTL_PEND; /* Fill in the command type */
-+ /* Fill in Command Header */
-+ c->Header.ReplyQueue = 0; /* unused in simple mode */
-+ if (iocommand.buf_size > 0) { /* buffer to fill */
-+ c->Header.SGList = 1;
-+ c->Header.SGTotal = 1;
-+ } else { /* no buffers to fill */
-+ c->Header.SGList = 0;
-+ c->Header.SGTotal = 0;
-+ }
-+ c->Header.LUN = iocommand.LUN_info;
-+ c->Header.Tag.lower = c->busaddr; /* use bus addr for tag */
-+ c->Request = iocommand.Request; /* Fill in Request block */
-+
-+ /* Fill in the scatter gather information */
-+ if (iocommand.buf_size > 0) {
-+ temp64.val = pci_map_single(h->pdev, buff,
-+ iocommand.buf_size,
-+ PCI_DMA_BIDIRECTIONAL);
-+ c->SG[0].Addr.lower = temp64.val32.lower;
-+ c->SG[0].Addr.upper = temp64.val32.upper;
-+ c->SG[0].Len = iocommand.buf_size;
-+ c->SG[0].Ext = 0; /* we are not chaining */
-+ }
-+ c->waiting = &wait;
-+ enqueue_cmd_and_start_io(h, c);
-+ wait_for_completion(&wait);
-+
-+ /* unmap the DMA buffers */
-+ temp64.val32.lower = c->SG[0].Addr.lower;
-+ temp64.val32.upper = c->SG[0].Addr.upper;
-+ pci_unmap_single(h->pdev, (dma_addr_t) temp64.val,
-+ iocommand.buf_size, PCI_DMA_BIDIRECTIONAL);
-+
-+ check_ioctl_unit_attention(h, c);
-+
-+ /* Copy the error information out */
-+ iocommand.error_info = *(c->err_info);
-+ if (copy_to_user(argp, &iocommand, sizeof(IOCTL_Command_struct))) {
-+ kfree(buff);
-+ cmd_special_free(h, c);
-+ return -EFAULT;
-+ }
-+
-+ if (iocommand.Request.Type.Direction == XFER_READ) {
-+ /* Copy the data out of the buffer we created */
-+ if (copy_to_user(iocommand.buf, buff, iocommand.buf_size)) {
-+ kfree(buff);
-+ cmd_special_free(h, c);
-+ return -EFAULT;
-+ }
-+ }
-+ kfree(buff);
-+ cmd_special_free(h, c);
-+ return 0;
-+}
-+
-+static int cciss_bigpassthru(ctlr_info_t *h, void __user *argp)
-+{
-+ BIG_IOCTL_Command_struct *ioc;
-+ CommandList_struct *c;
-+ unsigned char **buff = NULL;
-+ int *buff_size = NULL;
-+ u64bit temp64;
-+ BYTE sg_used = 0;
-+ int status = 0;
-+ int i;
-+ DECLARE_COMPLETION_ONSTACK(wait);
-+ __u32 left;
-+ __u32 sz;
-+ BYTE __user *data_ptr;
-+
-+ if (!argp)
-+ return -EINVAL;
-+ if (!capable(CAP_SYS_RAWIO))
-+ return -EPERM;
-+ ioc = kmalloc(sizeof(*ioc), GFP_KERNEL);
-+ if (!ioc) {
-+ status = -ENOMEM;
-+ goto cleanup1;
-+ }
-+ if (copy_from_user(ioc, argp, sizeof(*ioc))) {
-+ status = -EFAULT;
-+ goto cleanup1;
-+ }
-+ if ((ioc->buf_size < 1) &&
-+ (ioc->Request.Type.Direction != XFER_NONE)) {
-+ status = -EINVAL;
-+ goto cleanup1;
-+ }
-+ /* Check kmalloc limits using all SGs */
-+ if (ioc->malloc_size > MAX_KMALLOC_SIZE) {
-+ status = -EINVAL;
-+ goto cleanup1;
-+ }
-+ if (ioc->buf_size > ioc->malloc_size * MAXSGENTRIES) {
-+ status = -EINVAL;
-+ goto cleanup1;
-+ }
-+ buff = kzalloc(MAXSGENTRIES * sizeof(char *), GFP_KERNEL);
-+ if (!buff) {
-+ status = -ENOMEM;
-+ goto cleanup1;
-+ }
-+ buff_size = kmalloc(MAXSGENTRIES * sizeof(int), GFP_KERNEL);
-+ if (!buff_size) {
-+ status = -ENOMEM;
-+ goto cleanup1;
-+ }
-+ left = ioc->buf_size;
-+ data_ptr = ioc->buf;
-+ while (left) {
-+ sz = (left > ioc->malloc_size) ? ioc-> malloc_size : left;
-+ buff_size[sg_used] = sz;
-+ buff[sg_used] = kmalloc(sz, GFP_KERNEL);
-+ if (buff[sg_used] == NULL) {
-+ status = -ENOMEM;
-+ goto cleanup1;
-+ }
-+ if (ioc->Request.Type.Direction == XFER_WRITE) {
-+ if (copy_from_user(buff[sg_used], data_ptr, sz)) {
-+ status = -EFAULT;
-+ goto cleanup1;
-+ }
-+ } else {
-+ memset(buff[sg_used], 0, sz);
-+ }
-+ left -= sz;
-+ data_ptr += sz;
-+ sg_used++;
-+ }
-+ c = cmd_special_alloc(h);
-+ if (!c) {
-+ status = -ENOMEM;
-+ goto cleanup1;
-+ }
-+ c->cmd_type = CMD_IOCTL_PEND;
-+ c->Header.ReplyQueue = 0;
-+
-+ if (ioc->buf_size > 0) {
-+ c->Header.SGList = sg_used;
-+ c->Header.SGTotal = sg_used;
-+ } else {
-+ c->Header.SGList = 0;
-+ c->Header.SGTotal = 0;
-+ }
-+ c->Header.LUN = ioc->LUN_info;
-+ c->Header.Tag.lower = c->busaddr;
-+
-+ c->Request = ioc->Request;
-+ if (ioc->buf_size > 0) {
-+ int i;
-+ for (i = 0; i < sg_used; i++) {
-+ temp64.val = pci_map_single(h->pdev, buff[i],
-+ buff_size[i], PCI_DMA_BIDIRECTIONAL);
-+ c->SG[i].Addr.lower = temp64.val32.lower;
-+ c->SG[i].Addr.upper = temp64.val32.upper;
-+ c->SG[i].Len = buff_size[i];
-+ c->SG[i].Ext = 0; /* we are not chaining */
-+ }
-+ }
-+ c->waiting = &wait;
-+ enqueue_cmd_and_start_io(h, c);
-+ wait_for_completion(&wait);
-+ /* unlock the buffers from DMA */
-+ for (i = 0; i < sg_used; i++) {
-+ temp64.val32.lower = c->SG[i].Addr.lower;
-+ temp64.val32.upper = c->SG[i].Addr.upper;
-+ pci_unmap_single(h->pdev, (dma_addr_t) temp64.val,
-+ buff_size[i], PCI_DMA_BIDIRECTIONAL);
-+ }
-+ check_ioctl_unit_attention(h, c);
-+ /* Copy the error information out */
-+ ioc->error_info = *(c->err_info);
-+ if (copy_to_user(argp, ioc, sizeof(*ioc))) {
-+ cmd_special_free(h, c);
-+ status = -EFAULT;
-+ goto cleanup1;
-+ }
-+ if (ioc->Request.Type.Direction == XFER_READ) {
-+ /* Copy the data out of the buffer we created */
-+ BYTE __user *ptr = ioc->buf;
-+ for (i = 0; i < sg_used; i++) {
-+ if (copy_to_user(ptr, buff[i], buff_size[i])) {
-+ cmd_special_free(h, c);
-+ status = -EFAULT;
-+ goto cleanup1;
-+ }
-+ ptr += buff_size[i];
-+ }
-+ }
-+ cmd_special_free(h, c);
-+ status = 0;
-+cleanup1:
-+ if (buff) {
-+ for (i = 0; i < sg_used; i++)
-+ kfree(buff[i]);
-+ kfree(buff);
-+ }
-+ kfree(buff_size);
-+ kfree(ioc);
-+ return status;
-+}
-+
- static int cciss_ioctl(struct block_device *bdev, fmode_t mode,
-- unsigned int cmd, unsigned long arg)
-+ unsigned int cmd, unsigned long arg)
- {
- struct gendisk *disk = bdev->bd_disk;
-- ctlr_info_t *host = get_host(disk);
-- drive_info_struct *drv = get_drv(disk);
-- int ctlr = host->ctlr;
-+ ctlr_info_t *h = get_host(disk);
- void __user *argp = (void __user *)arg;
-
--#ifdef CCISS_DEBUG
-- printk(KERN_DEBUG "cciss_ioctl: Called with cmd=%x %lx\n", cmd, arg);
--#endif /* CCISS_DEBUG */
--
-+ dev_dbg(&h->pdev->dev, "cciss_ioctl: Called with cmd=%x %lx\n",
-+ cmd, arg);
- switch (cmd) {
- case CCISS_GETPCIINFO:
-- {
-- cciss_pci_info_struct pciinfo;
--
-- if (!arg)
-- return -EINVAL;
-- pciinfo.domain = pci_domain_nr(host->pdev->bus);
-- pciinfo.bus = host->pdev->bus->number;
-- pciinfo.dev_fn = host->pdev->devfn;
-- pciinfo.board_id = host->board_id;
-- if (copy_to_user
-- (argp, &pciinfo, sizeof(cciss_pci_info_struct)))
-- return -EFAULT;
-- return 0;
-- }
-+ return cciss_getpciinfo(h, argp);
- case CCISS_GETINTINFO:
-- {
-- cciss_coalint_struct intinfo;
-- if (!arg)
-- return -EINVAL;
-- intinfo.delay =
-- readl(&host->cfgtable->HostWrite.CoalIntDelay);
-- intinfo.count =
-- readl(&host->cfgtable->HostWrite.CoalIntCount);
-- if (copy_to_user
-- (argp, &intinfo, sizeof(cciss_coalint_struct)))
-- return -EFAULT;
-- return 0;
-- }
-+ return cciss_getintinfo(h, argp);
- case CCISS_SETINTINFO:
-- {
-- cciss_coalint_struct intinfo;
-- unsigned long flags;
-- int i;
--
-- if (!arg)
-- return -EINVAL;
-- if (!capable(CAP_SYS_ADMIN))
-- return -EPERM;
-- if (copy_from_user
-- (&intinfo, argp, sizeof(cciss_coalint_struct)))
-- return -EFAULT;
-- if ((intinfo.delay == 0) && (intinfo.count == 0))
-- {
--// printk("cciss_ioctl: delay and count cannot be 0\n");
-- return -EINVAL;
-- }
-- spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
-- /* Update the field, and then ring the doorbell */
-- writel(intinfo.delay,
-- &(host->cfgtable->HostWrite.CoalIntDelay));
-- writel(intinfo.count,
-- &(host->cfgtable->HostWrite.CoalIntCount));
-- writel(CFGTBL_ChangeReq, host->vaddr + SA5_DOORBELL);
--
-- for (i = 0; i < MAX_IOCTL_CONFIG_WAIT; i++) {
-- if (!(readl(host->vaddr + SA5_DOORBELL)
-- & CFGTBL_ChangeReq))
-- break;
-- /* delay and try again */
-- udelay(1000);
-- }
-- spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
-- if (i >= MAX_IOCTL_CONFIG_WAIT)
-- return -EAGAIN;
-- return 0;
-- }
-+ return cciss_setintinfo(h, argp);
- case CCISS_GETNODENAME:
-- {
-- NodeName_type NodeName;
-- int i;
--
-- if (!arg)
-- return -EINVAL;
-- for (i = 0; i < 16; i++)
-- NodeName[i] =
-- readb(&host->cfgtable->ServerName[i]);
-- if (copy_to_user(argp, NodeName, sizeof(NodeName_type)))
-- return -EFAULT;
-- return 0;
-- }
-+ return cciss_getnodename(h, argp);
- case CCISS_SETNODENAME:
-- {
-- NodeName_type NodeName;
-- unsigned long flags;
-- int i;
--
-- if (!arg)
-- return -EINVAL;
-- if (!capable(CAP_SYS_ADMIN))
-- return -EPERM;
--
-- if (copy_from_user
-- (NodeName, argp, sizeof(NodeName_type)))
-- return -EFAULT;
--
-- spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
--
-- /* Update the field, and then ring the doorbell */
-- for (i = 0; i < 16; i++)
-- writeb(NodeName[i],
-- &host->cfgtable->ServerName[i]);
--
-- writel(CFGTBL_ChangeReq, host->vaddr + SA5_DOORBELL);
--
-- for (i = 0; i < MAX_IOCTL_CONFIG_WAIT; i++) {
-- if (!(readl(host->vaddr + SA5_DOORBELL)
-- & CFGTBL_ChangeReq))
-- break;
-- /* delay and try again */
-- udelay(1000);
-- }
-- spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
-- if (i >= MAX_IOCTL_CONFIG_WAIT)
-- return -EAGAIN;
-- return 0;
-- }
--
-+ return cciss_setnodename(h, argp);
- case CCISS_GETHEARTBEAT:
-- {
-- Heartbeat_type heartbeat;
--
-- if (!arg)
-- return -EINVAL;
-- heartbeat = readl(&host->cfgtable->HeartBeat);
-- if (copy_to_user
-- (argp, &heartbeat, sizeof(Heartbeat_type)))
-- return -EFAULT;
-- return 0;
-- }
-+ return cciss_getheartbeat(h, argp);
- case CCISS_GETBUSTYPES:
-- {
-- BusTypes_type BusTypes;
--
-- if (!arg)
-- return -EINVAL;
-- BusTypes = readl(&host->cfgtable->BusTypes);
-- if (copy_to_user
-- (argp, &BusTypes, sizeof(BusTypes_type)))
-- return -EFAULT;
-- return 0;
-- }
-+ return cciss_getbustypes(h, argp);
- case CCISS_GETFIRMVER:
-- {
-- FirmwareVer_type firmware;
--
-- if (!arg)
-- return -EINVAL;
-- memcpy(firmware, host->firm_ver, 4);
--
-- if (copy_to_user
-- (argp, firmware, sizeof(FirmwareVer_type)))
-- return -EFAULT;
-- return 0;
-- }
-+ return cciss_getfirmver(h, argp);
- case CCISS_GETDRIVVER:
-- {
-- DriverVer_type DriverVer = DRIVER_VERSION;
--
-- if (!arg)
-- return -EINVAL;
--
-- if (copy_to_user
-- (argp, &DriverVer, sizeof(DriverVer_type)))
-- return -EFAULT;
-- return 0;
-- }
--
-+ return cciss_getdrivver(h, argp);
- case CCISS_DEREGDISK:
- case CCISS_REGNEWD:
- case CCISS_REVALIDVOLS:
-- return rebuild_lun_table(host, 0, 1);
--
-- case CCISS_GETLUNINFO:{
-- LogvolInfo_struct luninfo;
--
-- memcpy(&luninfo.LunID, drv->LunID,
-- sizeof(luninfo.LunID));
-- luninfo.num_opens = drv->usage_count;
-- luninfo.num_parts = 0;
-- if (copy_to_user(argp, &luninfo,
-- sizeof(LogvolInfo_struct)))
-- return -EFAULT;
-- return 0;
-- }
-+ return rebuild_lun_table(h, 0, 1);
-+ case CCISS_GETLUNINFO:
-+ return cciss_getluninfo(h, disk, argp);
- case CCISS_PASSTHRU:
-- {
-- IOCTL_Command_struct iocommand;
-- CommandList_struct *c;
-- char *buff = NULL;
-- u64bit temp64;
-- unsigned long flags;
-- DECLARE_COMPLETION_ONSTACK(wait);
--
-- if (!arg)
-- return -EINVAL;
--
-- if (!capable(CAP_SYS_RAWIO))
-- return -EPERM;
--
-- if (copy_from_user
-- (&iocommand, argp, sizeof(IOCTL_Command_struct)))
-- return -EFAULT;
-- if ((iocommand.buf_size < 1) &&
-- (iocommand.Request.Type.Direction != XFER_NONE)) {
-- return -EINVAL;
-- }
--#if 0 /* 'buf_size' member is 16-bits, and always smaller than kmalloc limit */
-- /* Check kmalloc limits */
-- if (iocommand.buf_size > 128000)
-- return -EINVAL;
--#endif
-- if (iocommand.buf_size > 0) {
-- buff = kmalloc(iocommand.buf_size, GFP_KERNEL);
-- if (buff == NULL)
-- return -EFAULT;
-- }
-- if (iocommand.Request.Type.Direction == XFER_WRITE) {
-- /* Copy the data into the buffer we created */
-- if (copy_from_user
-- (buff, iocommand.buf, iocommand.buf_size)) {
-- kfree(buff);
-- return -EFAULT;
-- }
-- } else {
-- memset(buff, 0, iocommand.buf_size);
-- }
-- if ((c = cmd_alloc(host, 0)) == NULL) {
-- kfree(buff);
-- return -ENOMEM;
-- }
-- // Fill in the command type
-- c->cmd_type = CMD_IOCTL_PEND;
-- // Fill in Command Header
-- c->Header.ReplyQueue = 0; // unused in simple mode
-- if (iocommand.buf_size > 0) // buffer to fill
-- {
-- c->Header.SGList = 1;
-- c->Header.SGTotal = 1;
-- } else // no buffers to fill
-- {
-- c->Header.SGList = 0;
-- c->Header.SGTotal = 0;
-- }
-- c->Header.LUN = iocommand.LUN_info;
-- c->Header.Tag.lower = c->busaddr; // use the kernel address the cmd block for tag
--
-- // Fill in Request block
-- c->Request = iocommand.Request;
--
-- // Fill in the scatter gather information
-- if (iocommand.buf_size > 0) {
-- temp64.val = pci_map_single(host->pdev, buff,
-- iocommand.buf_size,
-- PCI_DMA_BIDIRECTIONAL);
-- c->SG[0].Addr.lower = temp64.val32.lower;
-- c->SG[0].Addr.upper = temp64.val32.upper;
-- c->SG[0].Len = iocommand.buf_size;
-- c->SG[0].Ext = 0; // we are not chaining
-- }
-- c->waiting = &wait;
--
-- /* Put the request on the tail of the request queue */
-- spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
-- addQ(&host->reqQ, c);
-- host->Qdepth++;
-- start_io(host);
-- spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
--
-- wait_for_completion(&wait);
--
-- /* unlock the buffers from DMA */
-- temp64.val32.lower = c->SG[0].Addr.lower;
-- temp64.val32.upper = c->SG[0].Addr.upper;
-- pci_unmap_single(host->pdev, (dma_addr_t) temp64.val,
-- iocommand.buf_size,
-- PCI_DMA_BIDIRECTIONAL);
--
-- check_ioctl_unit_attention(host, c);
--
-- /* Copy the error information out */
-- iocommand.error_info = *(c->err_info);
-- if (copy_to_user
-- (argp, &iocommand, sizeof(IOCTL_Command_struct))) {
-- kfree(buff);
-- cmd_free(host, c, 0);
-- return -EFAULT;
-- }
--
-- if (iocommand.Request.Type.Direction == XFER_READ) {
-- /* Copy the data out of the buffer we created */
-- if (copy_to_user
-- (iocommand.buf, buff, iocommand.buf_size)) {
-- kfree(buff);
-- cmd_free(host, c, 0);
-- return -EFAULT;
-- }
-- }
-- kfree(buff);
-- cmd_free(host, c, 0);
-- return 0;
-- }
-- case CCISS_BIG_PASSTHRU:{
-- BIG_IOCTL_Command_struct *ioc;
-- CommandList_struct *c;
-- unsigned char **buff = NULL;
-- int *buff_size = NULL;
-- u64bit temp64;
-- unsigned long flags;
-- BYTE sg_used = 0;
-- int status = 0;
-- int i;
-- DECLARE_COMPLETION_ONSTACK(wait);
-- __u32 left;
-- __u32 sz;
-- BYTE __user *data_ptr;
--
-- if (!arg)
-- return -EINVAL;
-- if (!capable(CAP_SYS_RAWIO))
-- return -EPERM;
-- ioc = (BIG_IOCTL_Command_struct *)
-- kmalloc(sizeof(*ioc), GFP_KERNEL);
-- if (!ioc) {
-- status = -ENOMEM;
-- goto cleanup1;
-- }
-- if (copy_from_user(ioc, argp, sizeof(*ioc))) {
-- status = -EFAULT;
-- goto cleanup1;
-- }
-- if ((ioc->buf_size < 1) &&
-- (ioc->Request.Type.Direction != XFER_NONE)) {
-- status = -EINVAL;
-- goto cleanup1;
-- }
-- /* Check kmalloc limits using all SGs */
-- if (ioc->malloc_size > MAX_KMALLOC_SIZE) {
-- status = -EINVAL;
-- goto cleanup1;
-- }
-- if (ioc->buf_size > ioc->malloc_size * MAXSGENTRIES) {
-- status = -EINVAL;
-- goto cleanup1;
-- }
-- buff =
-- kzalloc(MAXSGENTRIES * sizeof(char *), GFP_KERNEL);
-- if (!buff) {
-- status = -ENOMEM;
-- goto cleanup1;
-- }
-- buff_size = kmalloc(MAXSGENTRIES * sizeof(int),
-- GFP_KERNEL);
-- if (!buff_size) {
-- status = -ENOMEM;
-- goto cleanup1;
-- }
-- left = ioc->buf_size;
-- data_ptr = ioc->buf;
-- while (left) {
-- sz = (left >
-- ioc->malloc_size) ? ioc->
-- malloc_size : left;
-- buff_size[sg_used] = sz;
-- buff[sg_used] = kmalloc(sz, GFP_KERNEL);
-- if (buff[sg_used] == NULL) {
-- status = -ENOMEM;
-- goto cleanup1;
-- }
-- if (ioc->Request.Type.Direction == XFER_WRITE) {
-- if (copy_from_user
-- (buff[sg_used], data_ptr, sz)) {
-- status = -EFAULT;
-- goto cleanup1;
-- }
-- } else {
-- memset(buff[sg_used], 0, sz);
-- }
-- left -= sz;
-- data_ptr += sz;
-- sg_used++;
-- }
-- if ((c = cmd_alloc(host, 0)) == NULL) {
-- status = -ENOMEM;
-- goto cleanup1;
-- }
-- c->cmd_type = CMD_IOCTL_PEND;
-- c->Header.ReplyQueue = 0;
--
-- if (ioc->buf_size > 0) {
-- c->Header.SGList = sg_used;
-- c->Header.SGTotal = sg_used;
-- } else {
-- c->Header.SGList = 0;
-- c->Header.SGTotal = 0;
-- }
-- c->Header.LUN = ioc->LUN_info;
-- c->Header.Tag.lower = c->busaddr;
--
-- c->Request = ioc->Request;
-- if (ioc->buf_size > 0) {
-- int i;
-- for (i = 0; i < sg_used; i++) {
-- temp64.val =
-- pci_map_single(host->pdev, buff[i],
-- buff_size[i],
-- PCI_DMA_BIDIRECTIONAL);
-- c->SG[i].Addr.lower =
-- temp64.val32.lower;
-- c->SG[i].Addr.upper =
-- temp64.val32.upper;
-- c->SG[i].Len = buff_size[i];
-- c->SG[i].Ext = 0; /* we are not chaining */
-- }
-- }
-- c->waiting = &wait;
-- /* Put the request on the tail of the request queue */
-- spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
-- addQ(&host->reqQ, c);
-- host->Qdepth++;
-- start_io(host);
-- spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
-- wait_for_completion(&wait);
-- /* unlock the buffers from DMA */
-- for (i = 0; i < sg_used; i++) {
-- temp64.val32.lower = c->SG[i].Addr.lower;
-- temp64.val32.upper = c->SG[i].Addr.upper;
-- pci_unmap_single(host->pdev,
-- (dma_addr_t) temp64.val, buff_size[i],
-- PCI_DMA_BIDIRECTIONAL);
-- }
-- check_ioctl_unit_attention(host, c);
-- /* Copy the error information out */
-- ioc->error_info = *(c->err_info);
-- if (copy_to_user(argp, ioc, sizeof(*ioc))) {
-- cmd_free(host, c, 0);
-- status = -EFAULT;
-- goto cleanup1;
-- }
-- if (ioc->Request.Type.Direction == XFER_READ) {
-- /* Copy the data out of the buffer we created */
-- BYTE __user *ptr = ioc->buf;
-- for (i = 0; i < sg_used; i++) {
-- if (copy_to_user
-- (ptr, buff[i], buff_size[i])) {
-- cmd_free(host, c, 0);
-- status = -EFAULT;
-- goto cleanup1;
-- }
-- ptr += buff_size[i];
-- }
-- }
-- cmd_free(host, c, 0);
-- status = 0;
-- cleanup1:
-- if (buff) {
-- for (i = 0; i < sg_used; i++)
-- kfree(buff[i]);
-- kfree(buff);
-- }
-- kfree(buff_size);
-- kfree(ioc);
-- return status;
-- }
-+ return cciss_passthru(h, argp);
-+ case CCISS_BIG_PASSTHRU:
-+ return cciss_bigpassthru(h, argp);
-
- /* scsi_cmd_blk_ioctl handles these, below, though some are not */
- /* very meaningful for cciss. SG_IO is the main one people want. */
-@@ -1658,37 +1854,45 @@ static void cciss_check_queues(ctlr_info_t *h)
-
- static void cciss_softirq_done(struct request *rq)
- {
-- CommandList_struct *cmd = rq->completion_data;
-- ctlr_info_t *h = hba[cmd->ctlr];
-- unsigned long flags;
-+ CommandList_struct *c = rq->completion_data;
-+ ctlr_info_t *h = hba[c->ctlr];
-+ SGDescriptor_struct *curr_sg = c->SG;
- u64bit temp64;
-+ unsigned long flags;
- int i, ddir;
-+ int sg_index = 0;
-
-- if (cmd->Request.Type.Direction == XFER_READ)
-+ if (c->Request.Type.Direction == XFER_READ)
- ddir = PCI_DMA_FROMDEVICE;
- else
- ddir = PCI_DMA_TODEVICE;
-
- /* command did not need to be retried */
- /* unmap the DMA mapping for all the scatter gather elements */
-- for (i = 0; i < cmd->Header.SGList; i++) {
-- temp64.val32.lower = cmd->SG[i].Addr.lower;
-- temp64.val32.upper = cmd->SG[i].Addr.upper;
-- pci_unmap_page(h->pdev, temp64.val, cmd->SG[i].Len, ddir);
-+ for (i = 0; i < c->Header.SGList; i++) {
-+ if (curr_sg[sg_index].Ext == CCISS_SG_CHAIN) {
-+ cciss_unmap_sg_chain_block(h, c);
-+ /* Point to the next block */
-+ curr_sg = h->cmd_sg_list[c->cmdindex];
-+ sg_index = 0;
-+ }
-+ temp64.val32.lower = curr_sg[sg_index].Addr.lower;
-+ temp64.val32.upper = curr_sg[sg_index].Addr.upper;
-+ pci_unmap_page(h->pdev, temp64.val, curr_sg[sg_index].Len,
-+ ddir);
-+ ++sg_index;
- }
-
--#ifdef CCISS_DEBUG
-- printk("Done with %p\n", rq);
--#endif /* CCISS_DEBUG */
-+ dev_dbg(&h->pdev->dev, "Done with %p\n", rq);
-
- /* set the residual count for pc requests */
-- if (blk_pc_request(rq))
-- rq->resid_len = cmd->err_info->ResidualCnt;
-+ if (rq->cmd_type == REQ_TYPE_BLOCK_PC)
-+ rq->resid_len = c->err_info->ResidualCnt;
-
- blk_end_request_all(rq, (rq->errors == 0) ? 0 : -EIO);
-
- spin_lock_irqsave(&h->lock, flags);
-- cmd_free(h, cmd, 1);
-+ cmd_free(h, c);
- cciss_check_queues(h);
- spin_unlock_irqrestore(&h->lock, flags);
- }
-@@ -1704,7 +1908,7 @@ static inline void log_unit_to_scsi3addr(ctlr_info_t *h,
- * via the inquiry page 0. Model, vendor, and rev are set to empty strings if
- * they cannot be read.
- */
--static void cciss_get_device_descr(int ctlr, int logvol, int withirq,
-+static void cciss_get_device_descr(ctlr_info_t *h, int logvol,
- char *vendor, char *model, char *rev)
- {
- int rc;
-@@ -1719,15 +1923,9 @@ static void cciss_get_device_descr(int ctlr, int logvol, int withirq,
- if (!inq_buf)
- return;
-
-- log_unit_to_scsi3addr(hba[ctlr], scsi3addr, logvol);
-- if (withirq)
-- rc = sendcmd_withirq(CISS_INQUIRY, ctlr, inq_buf,
-- sizeof(InquiryData_struct), 0,
-- scsi3addr, TYPE_CMD);
-- else
-- rc = sendcmd(CISS_INQUIRY, ctlr, inq_buf,
-- sizeof(InquiryData_struct), 0,
-- scsi3addr, TYPE_CMD);
-+ log_unit_to_scsi3addr(h, scsi3addr, logvol);
-+ rc = sendcmd_withirq(h, CISS_INQUIRY, inq_buf, sizeof(*inq_buf), 0,
-+ scsi3addr, TYPE_CMD);
- if (rc == IO_OK) {
- memcpy(vendor, &inq_buf->data_byte[8], VENDOR_LEN);
- vendor[VENDOR_LEN] = '\0';
-@@ -1746,8 +1944,8 @@ static void cciss_get_device_descr(int ctlr, int logvol, int withirq,
- * number cannot be had, for whatever reason, 16 bytes of 0xff
- * are returned instead.
- */
--static void cciss_get_serial_no(int ctlr, int logvol, int withirq,
-- unsigned char *serial_no, int buflen)
-+static void cciss_get_uid(ctlr_info_t *h, int logvol,
-+ unsigned char *uid, int buflen)
- {
- #define PAGE_83_INQ_BYTES 64
- int rc;
-@@ -1756,20 +1954,16 @@ static void cciss_get_serial_no(int ctlr, int logvol, int withirq,
-
- if (buflen > 16)
- buflen = 16;
-- memset(serial_no, 0xff, buflen);
-+ memset(uid, 0xff, buflen);
- buf = kzalloc(PAGE_83_INQ_BYTES, GFP_KERNEL);
- if (!buf)
- return;
-- memset(serial_no, 0, buflen);
-- log_unit_to_scsi3addr(hba[ctlr], scsi3addr, logvol);
-- if (withirq)
-- rc = sendcmd_withirq(CISS_INQUIRY, ctlr, buf,
-- PAGE_83_INQ_BYTES, 0x83, scsi3addr, TYPE_CMD);
-- else
-- rc = sendcmd(CISS_INQUIRY, ctlr, buf,
-- PAGE_83_INQ_BYTES, 0x83, scsi3addr, TYPE_CMD);
-+ memset(uid, 0, buflen);
-+ log_unit_to_scsi3addr(h, scsi3addr, logvol);
-+ rc = sendcmd_withirq(h, CISS_INQUIRY, buf,
-+ PAGE_83_INQ_BYTES, 0x83, scsi3addr, TYPE_CMD);
- if (rc == IO_OK)
-- memcpy(serial_no, &buf[8], buflen);
-+ memcpy(uid, &buf[8], buflen);
- kfree(buf);
- return;
- }
-@@ -1796,12 +1990,9 @@ static int cciss_add_disk(ctlr_info_t *h, struct gendisk *disk,
- blk_queue_bounce_limit(disk->queue, h->pdev->dma_mask);
-
- /* This is a hardware imposed limit. */
-- blk_queue_max_hw_segments(disk->queue, MAXSGENTRIES);
-+ blk_queue_max_segments(disk->queue, h->maxsgentries);
-
-- /* This is a limit in the driver and could be eliminated. */
-- blk_queue_max_phys_segments(disk->queue, MAXSGENTRIES);
--
-- blk_queue_max_sectors(disk->queue, h->cciss_max_sectors);
-+ blk_queue_max_hw_sectors(disk->queue, h->cciss_max_sectors);
-
- blk_queue_softirq_done(disk->queue, cciss_softirq_done);
-
-@@ -1835,10 +2026,9 @@ init_queue_failure:
- * is also the controller node. Any changes to disk 0 will show up on
- * the next reboot.
- */
--static void cciss_update_drive_info(int ctlr, int drv_index, int first_time,
-- int via_ioctl)
-+static void cciss_update_drive_info(ctlr_info_t *h, int drv_index,
-+ int first_time, int via_ioctl)
- {
-- ctlr_info_t *h = hba[ctlr];
- struct gendisk *disk;
- InquiryData_struct *inq_buff = NULL;
- unsigned int block_size;
-@@ -1855,18 +2045,16 @@ static void cciss_update_drive_info(int ctlr, int drv_index, int first_time,
-
- /* testing to see if 16-byte CDBs are already being used */
- if (h->cciss_read == CCISS_READ_16) {
-- cciss_read_capacity_16(h->ctlr, drv_index, 1,
-+ cciss_read_capacity_16(h, drv_index,
- &total_size, &block_size);
-
- } else {
-- cciss_read_capacity(ctlr, drv_index, 1,
-- &total_size, &block_size);
--
-+ cciss_read_capacity(h, drv_index, &total_size, &block_size);
- /* if read_capacity returns all F's this volume is >2TB */
- /* in size so we switch to 16-byte CDB's for all */
- /* read/write ops */
- if (total_size == 0xFFFFFFFFULL) {
-- cciss_read_capacity_16(ctlr, drv_index, 1,
-+ cciss_read_capacity_16(h, drv_index,
- &total_size, &block_size);
- h->cciss_read = CCISS_READ_16;
- h->cciss_write = CCISS_WRITE_16;
-@@ -1876,23 +2064,22 @@ static void cciss_update_drive_info(int ctlr, int drv_index, int first_time,
- }
- }
-
-- cciss_geometry_inquiry(ctlr, drv_index, 1, total_size, block_size,
-+ cciss_geometry_inquiry(h, drv_index, total_size, block_size,
- inq_buff, drvinfo);
- drvinfo->block_size = block_size;
- drvinfo->nr_blocks = total_size + 1;
-
-- cciss_get_device_descr(ctlr, drv_index, 1, drvinfo->vendor,
-+ cciss_get_device_descr(h, drv_index, drvinfo->vendor,
- drvinfo->model, drvinfo->rev);
-- cciss_get_serial_no(ctlr, drv_index, 1, drvinfo->serial_no,
-- sizeof(drvinfo->serial_no));
-+ cciss_get_uid(h, drv_index, drvinfo->uid, sizeof(drvinfo->uid));
- /* Save the lunid in case we deregister the disk, below. */
- memcpy(drvinfo->LunID, h->drv[drv_index]->LunID,
- sizeof(drvinfo->LunID));
-
- /* Is it the same disk we already know, and nothing's changed? */
- if (h->drv[drv_index]->raid_level != -1 &&
-- ((memcmp(drvinfo->serial_no,
-- h->drv[drv_index]->serial_no, 16) == 0) &&
-+ ((memcmp(drvinfo->uid,
-+ h->drv[drv_index]->uid, 16) == 0) &&
- drvinfo->block_size == h->drv[drv_index]->block_size &&
- drvinfo->nr_blocks == h->drv[drv_index]->nr_blocks &&
- drvinfo->heads == h->drv[drv_index]->heads &&
-@@ -1908,10 +2095,10 @@ static void cciss_update_drive_info(int ctlr, int drv_index, int first_time,
- * (unless it's the first disk (for the controller node).
- */
- if (h->drv[drv_index]->raid_level != -1 && drv_index != 0) {
-- printk(KERN_WARNING "disk %d has changed.\n", drv_index);
-- spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
-+ dev_warn(&h->pdev->dev, "disk %d has changed.\n", drv_index);
-+ spin_lock_irqsave(&h->lock, flags);
- h->drv[drv_index]->busy_configuring = 1;
-- spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
-+ spin_unlock_irqrestore(&h->lock, flags);
-
- /* deregister_disk sets h->drv[drv_index]->queue = NULL
- * which keeps the interrupt handler from starting
-@@ -1940,7 +2127,7 @@ static void cciss_update_drive_info(int ctlr, int drv_index, int first_time,
- h->drv[drv_index]->sectors = drvinfo->sectors;
- h->drv[drv_index]->cylinders = drvinfo->cylinders;
- h->drv[drv_index]->raid_level = drvinfo->raid_level;
-- memcpy(h->drv[drv_index]->serial_no, drvinfo->serial_no, 16);
-+ memcpy(h->drv[drv_index]->uid, drvinfo->uid, 16);
- memcpy(h->drv[drv_index]->vendor, drvinfo->vendor,
- VENDOR_LEN + 1);
- memcpy(h->drv[drv_index]->model, drvinfo->model, MODEL_LEN + 1);
-@@ -1950,6 +2137,7 @@ static void cciss_update_drive_info(int ctlr, int drv_index, int first_time,
- ++h->num_luns;
- disk = h->gendisk[drv_index];
- set_capacity(disk, h->drv[drv_index]->nr_blocks);
-+ cciss_sysfs_stat_inquiry(h, drv_index, h->drv[drv_index]);
-
- /* If it's not disk 0 (drv_index != 0)
- * or if it was disk 0, but there was previously
-@@ -1961,8 +2149,8 @@ static void cciss_update_drive_info(int ctlr, int drv_index, int first_time,
- if (cciss_add_disk(h, disk, drv_index) != 0) {
- cciss_free_gendisk(h, drv_index);
- cciss_free_drive_info(h, drv_index);
-- printk(KERN_WARNING "cciss:%d could not update "
-- "disk %d\n", h->ctlr, drv_index);
-+ dev_warn(&h->pdev->dev, "could not update disk %d\n",
-+ drv_index);
- --h->num_luns;
- }
- }
-@@ -1972,7 +2160,7 @@ freeret:
- kfree(drvinfo);
- return;
- mem_msg:
-- printk(KERN_ERR "cciss: out of memory\n");
-+ dev_err(&h->pdev->dev, "out of memory\n");
- goto freeret;
- }
-
-@@ -2051,7 +2239,7 @@ static void cciss_free_gendisk(ctlr_info_t *h, int drv_index)
- * drives have yet been configured.
- */
- static int cciss_add_gendisk(ctlr_info_t *h, unsigned char lunid[],
-- int controller_node)
-+ int controller_node)
- {
- int drv_index;
-
-@@ -2064,9 +2252,9 @@ static int cciss_add_gendisk(ctlr_info_t *h, unsigned char lunid[],
- h->gendisk[drv_index] =
- alloc_disk(1 << NWD_SHIFT);
- if (!h->gendisk[drv_index]) {
-- printk(KERN_ERR "cciss%d: could not "
-- "allocate a new disk %d\n",
-- h->ctlr, drv_index);
-+ dev_err(&h->pdev->dev,
-+ "could not allocate a new disk %d\n",
-+ drv_index);
- goto err_free_drive_info;
- }
- }
-@@ -2110,15 +2298,14 @@ static void cciss_add_controller_node(ctlr_info_t *h)
- h->drv[drv_index]->sectors = 0;
- h->drv[drv_index]->cylinders = 0;
- h->drv[drv_index]->raid_level = -1;
-- memset(h->drv[drv_index]->serial_no, 0, 16);
-+ memset(h->drv[drv_index]->uid, 0, 16);
- disk = h->gendisk[drv_index];
- if (cciss_add_disk(h, disk, drv_index) == 0)
- return;
- cciss_free_gendisk(h, drv_index);
- cciss_free_drive_info(h, drv_index);
- error:
-- printk(KERN_WARNING "cciss%d: could not "
-- "add disk 0.\n", h->ctlr);
-+ dev_warn(&h->pdev->dev, "could not add disk 0.\n");
- return;
- }
-
-@@ -2133,7 +2320,6 @@ error:
- static int rebuild_lun_table(ctlr_info_t *h, int first_time,
- int via_ioctl)
- {
-- int ctlr = h->ctlr;
- int num_luns;
- ReportLunData_struct *ld_buff = NULL;
- int return_code;
-@@ -2148,27 +2334,27 @@ static int rebuild_lun_table(ctlr_info_t *h, int first_time,
- return -EPERM;
-
- /* Set busy_configuring flag for this operation */
-- spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
-+ spin_lock_irqsave(&h->lock, flags);
- if (h->busy_configuring) {
-- spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
-+ spin_unlock_irqrestore(&h->lock, flags);
- return -EBUSY;
- }
- h->busy_configuring = 1;
-- spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
-+ spin_unlock_irqrestore(&h->lock, flags);
-
- ld_buff = kzalloc(sizeof(ReportLunData_struct), GFP_KERNEL);
- if (ld_buff == NULL)
- goto mem_msg;
-
-- return_code = sendcmd_withirq(CISS_REPORT_LOG, ctlr, ld_buff,
-+ return_code = sendcmd_withirq(h, CISS_REPORT_LOG, ld_buff,
- sizeof(ReportLunData_struct),
- 0, CTLR_LUNID, TYPE_CMD);
-
- if (return_code == IO_OK)
- listlength = be32_to_cpu(*(__be32 *) ld_buff->LUNListLength);
- else { /* reading number of logical volumes failed */
-- printk(KERN_WARNING "cciss: report logical volume"
-- " command failed\n");
-+ dev_warn(&h->pdev->dev,
-+ "report logical volume command failed\n");
- listlength = 0;
- goto freeret;
- }
-@@ -2176,7 +2362,7 @@ static int rebuild_lun_table(ctlr_info_t *h, int first_time,
- num_luns = listlength / 8; /* 8 bytes per entry */
- if (num_luns > CISS_MAX_LUN) {
- num_luns = CISS_MAX_LUN;
-- printk(KERN_WARNING "cciss: more luns configured"
-+ dev_warn(&h->pdev->dev, "more luns configured"
- " on controller than can be handled by"
- " this driver.\n");
- }
-@@ -2200,16 +2386,16 @@ static int rebuild_lun_table(ctlr_info_t *h, int first_time,
- for (j = 0; j < num_luns; j++) {
- memcpy(lunid, &ld_buff->LUN[j][0], sizeof(lunid));
- if (memcmp(h->drv[i]->LunID, lunid,
-- sizeof(lunid)) == 0) {
-+ sizeof(lunid)) == 0) {
- drv_found = 1;
- break;
- }
- }
- if (!drv_found) {
- /* Deregister it from the OS, it's gone. */
-- spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
-+ spin_lock_irqsave(&h->lock, flags);
- h->drv[i]->busy_configuring = 1;
-- spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
-+ spin_unlock_irqrestore(&h->lock, flags);
- return_code = deregister_disk(h, i, 1, via_ioctl);
- if (h->drv[i] != NULL)
- h->drv[i]->busy_configuring = 0;
-@@ -2248,8 +2434,7 @@ static int rebuild_lun_table(ctlr_info_t *h, int first_time,
- if (drv_index == -1)
- goto freeret;
- }
-- cciss_update_drive_info(ctlr, drv_index, first_time,
-- via_ioctl);
-+ cciss_update_drive_info(h, drv_index, first_time, via_ioctl);
- } /* end for */
-
- freeret:
-@@ -2261,7 +2446,7 @@ freeret:
- */
- return -1;
- mem_msg:
-- printk(KERN_ERR "cciss: out of memory\n");
-+ dev_err(&h->pdev->dev, "out of memory\n");
- h->busy_configuring = 0;
- goto freeret;
- }
-@@ -2275,7 +2460,7 @@ static void cciss_clear_drive_info(drive_info_struct *drive_info)
- drive_info->sectors = 0;
- drive_info->cylinders = 0;
- drive_info->raid_level = -1;
-- memset(drive_info->serial_no, 0, sizeof(drive_info->serial_no));
-+ memset(drive_info->uid, 0, sizeof(drive_info->uid));
- memset(drive_info->model, 0, sizeof(drive_info->model));
- memset(drive_info->rev, 0, sizeof(drive_info->rev));
- memset(drive_info->vendor, 0, sizeof(drive_info->vendor));
-@@ -2381,11 +2566,10 @@ static int deregister_disk(ctlr_info_t *h, int drv_index,
- return 0;
- }
-
--static int fill_cmd(CommandList_struct *c, __u8 cmd, int ctlr, void *buff,
-+static int fill_cmd(ctlr_info_t *h, CommandList_struct *c, __u8 cmd, void *buff,
- size_t size, __u8 page_code, unsigned char *scsi3addr,
- int cmd_type)
- {
-- ctlr_info_t *h = hba[ctlr];
- u64bit buff_dma_handle;
- int status = IO_OK;
-
-@@ -2427,7 +2611,7 @@ static int fill_cmd(CommandList_struct *c, __u8 cmd, int ctlr, void *buff,
- c->Request.Type.Direction = XFER_READ;
- c->Request.Timeout = 0;
- c->Request.CDB[0] = cmd;
-- c->Request.CDB[6] = (size >> 24) & 0xFF; //MSB
-+ c->Request.CDB[6] = (size >> 24) & 0xFF; /* MSB */
- c->Request.CDB[7] = (size >> 16) & 0xFF;
- c->Request.CDB[8] = (size >> 8) & 0xFF;
- c->Request.CDB[9] = size & 0xFF;
-@@ -2461,6 +2645,8 @@ static int fill_cmd(CommandList_struct *c, __u8 cmd, int ctlr, void *buff,
- c->Request.Timeout = 0;
- c->Request.CDB[0] = BMIC_WRITE;
- c->Request.CDB[6] = BMIC_CACHE_FLUSH;
-+ c->Request.CDB[7] = (size >> 8) & 0xFF;
-+ c->Request.CDB[8] = size & 0xFF;
- break;
- case TEST_UNIT_READY:
- c->Request.CDBLen = 6;
-@@ -2469,13 +2655,12 @@ static int fill_cmd(CommandList_struct *c, __u8 cmd, int ctlr, void *buff,
- c->Request.Timeout = 0;
- break;
- default:
-- printk(KERN_WARNING
-- "cciss%d: Unknown Command 0x%c\n", ctlr, cmd);
-+ dev_warn(&h->pdev->dev, "Unknown Command 0x%c\n", cmd);
- return IO_ERROR;
- }
- } else if (cmd_type == TYPE_MSG) {
- switch (cmd) {
-- case 0: /* ABORT message */
-+ case CCISS_ABORT_MSG:
- c->Request.CDBLen = 12;
- c->Request.Type.Attribute = ATTR_SIMPLE;
- c->Request.Type.Direction = XFER_WRITE;
-@@ -2485,16 +2670,16 @@ static int fill_cmd(CommandList_struct *c, __u8 cmd, int ctlr, void *buff,
- /* buff contains the tag of the command to abort */
- memcpy(&c->Request.CDB[4], buff, 8);
- break;
-- case 1: /* RESET message */
-+ case CCISS_RESET_MSG:
- c->Request.CDBLen = 16;
- c->Request.Type.Attribute = ATTR_SIMPLE;
- c->Request.Type.Direction = XFER_NONE;
- c->Request.Timeout = 0;
- memset(&c->Request.CDB[0], 0, sizeof(c->Request.CDB));
- c->Request.CDB[0] = cmd; /* reset */
-- c->Request.CDB[1] = 0x03; /* reset a target */
-+ c->Request.CDB[1] = CCISS_RESET_TYPE_TARGET;
- break;
-- case 3: /* No-Op message */
-+ case CCISS_NOOP_MSG:
- c->Request.CDBLen = 1;
- c->Request.Type.Attribute = ATTR_SIMPLE;
- c->Request.Type.Direction = XFER_WRITE;
-@@ -2502,13 +2687,12 @@ static int fill_cmd(CommandList_struct *c, __u8 cmd, int ctlr, void *buff,
- c->Request.CDB[0] = cmd;
- break;
- default:
-- printk(KERN_WARNING
-- "cciss%d: unknown message type %d\n", ctlr, cmd);
-+ dev_warn(&h->pdev->dev,
-+ "unknown message type %d\n", cmd);
- return IO_ERROR;
- }
- } else {
-- printk(KERN_WARNING
-- "cciss%d: unknown command type %d\n", ctlr, cmd_type);
-+ dev_warn(&h->pdev->dev, "unknown command type %d\n", cmd_type);
- return IO_ERROR;
- }
- /* Fill in the scatter gather information */
-@@ -2524,6 +2708,31 @@ static int fill_cmd(CommandList_struct *c, __u8 cmd, int ctlr, void *buff,
- return status;
- }
-
-+static int __devinit cciss_send_reset(ctlr_info_t *h, unsigned char *scsi3addr,
-+ u8 reset_type)
-+{
-+ CommandList_struct *c;
-+ int return_status;
-+
-+ c = cmd_alloc(h);
-+ if (!c)
-+ return -ENOMEM;
-+ return_status = fill_cmd(h, c, CCISS_RESET_MSG, NULL, 0, 0,
-+ CTLR_LUNID, TYPE_MSG);
-+ c->Request.CDB[1] = reset_type; /* fill_cmd defaults to target reset */
-+ if (return_status != IO_OK) {
-+ cmd_special_free(h, c);
-+ return return_status;
-+ }
-+ c->waiting = NULL;
-+ enqueue_cmd_and_start_io(h, c);
-+ /* Don't wait for completion, the reset won't complete. Don't free
-+ * the command either. This is the last command we will send before
-+ * re-initializing everything, so it doesn't matter and won't leak.
-+ */
-+ return 0;
-+}
-+
- static int check_target_status(ctlr_info_t *h, CommandList_struct *c)
- {
- switch (c->err_info->ScsiStatus) {
-@@ -2534,15 +2743,16 @@ static int check_target_status(ctlr_info_t *h, CommandList_struct *c)
- case 0: return IO_OK; /* no sense */
- case 1: return IO_OK; /* recovered error */
- default:
-- printk(KERN_WARNING "cciss%d: cmd 0x%02x "
-+ if (check_for_unit_attention(h, c))
-+ return IO_NEEDS_RETRY;
-+ dev_warn(&h->pdev->dev, "cmd 0x%02x "
- "check condition, sense key = 0x%02x\n",
-- h->ctlr, c->Request.CDB[0],
-- c->err_info->SenseInfo[2]);
-+ c->Request.CDB[0], c->err_info->SenseInfo[2]);
- }
- break;
- default:
-- printk(KERN_WARNING "cciss%d: cmd 0x%02x"
-- "scsi status = 0x%02x\n", h->ctlr,
-+ dev_warn(&h->pdev->dev, "cmd 0x%02x"
-+ "scsi status = 0x%02x\n",
- c->Request.CDB[0], c->err_info->ScsiStatus);
- break;
- }
-@@ -2565,43 +2775,46 @@ static int process_sendcmd_error(ctlr_info_t *h, CommandList_struct *c)
- /* expected for inquiry and report lun commands */
- break;
- case CMD_INVALID:
-- printk(KERN_WARNING "cciss: cmd 0x%02x is "
-+ dev_warn(&h->pdev->dev, "cmd 0x%02x is "
- "reported invalid\n", c->Request.CDB[0]);
- return_status = IO_ERROR;
- break;
- case CMD_PROTOCOL_ERR:
-- printk(KERN_WARNING "cciss: cmd 0x%02x has "
-- "protocol error \n", c->Request.CDB[0]);
-+ dev_warn(&h->pdev->dev, "cmd 0x%02x has "
-+ "protocol error\n", c->Request.CDB[0]);
- return_status = IO_ERROR;
- break;
- case CMD_HARDWARE_ERR:
-- printk(KERN_WARNING "cciss: cmd 0x%02x had "
-+ dev_warn(&h->pdev->dev, "cmd 0x%02x had "
- " hardware error\n", c->Request.CDB[0]);
- return_status = IO_ERROR;
- break;
- case CMD_CONNECTION_LOST:
-- printk(KERN_WARNING "cciss: cmd 0x%02x had "
-+ dev_warn(&h->pdev->dev, "cmd 0x%02x had "
- "connection lost\n", c->Request.CDB[0]);
- return_status = IO_ERROR;
- break;
- case CMD_ABORTED:
-- printk(KERN_WARNING "cciss: cmd 0x%02x was "
-+ dev_warn(&h->pdev->dev, "cmd 0x%02x was "
- "aborted\n", c->Request.CDB[0]);
- return_status = IO_ERROR;
- break;
- case CMD_ABORT_FAILED:
-- printk(KERN_WARNING "cciss: cmd 0x%02x reports "
-+ dev_warn(&h->pdev->dev, "cmd 0x%02x reports "
- "abort failed\n", c->Request.CDB[0]);
- return_status = IO_ERROR;
- break;
- case CMD_UNSOLICITED_ABORT:
-- printk(KERN_WARNING
-- "cciss%d: unsolicited abort 0x%02x\n", h->ctlr,
-+ dev_warn(&h->pdev->dev, "unsolicited abort 0x%02x\n",
- c->Request.CDB[0]);
- return_status = IO_NEEDS_RETRY;
- break;
-+ case CMD_UNABORTABLE:
-+ dev_warn(&h->pdev->dev, "cmd unabortable\n");
-+ return_status = IO_ERROR;
-+ break;
- default:
-- printk(KERN_WARNING "cciss: cmd 0x%02x returned "
-+ dev_warn(&h->pdev->dev, "cmd 0x%02x returned "
- "unknown status %x\n", c->Request.CDB[0],
- c->err_info->CommandStatus);
- return_status = IO_ERROR;
-@@ -2614,17 +2827,11 @@ static int sendcmd_withirq_core(ctlr_info_t *h, CommandList_struct *c,
- {
- DECLARE_COMPLETION_ONSTACK(wait);
- u64bit buff_dma_handle;
-- unsigned long flags;
- int return_status = IO_OK;
-
- resend_cmd2:
- c->waiting = &wait;
-- /* Put the request on the tail of the queue and send it */
-- spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
-- addQ(&h->reqQ, c);
-- h->Qdepth++;
-- start_io(h);
-- spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
-+ enqueue_cmd_and_start_io(h, c);
-
- wait_for_completion(&wait);
-
-@@ -2635,7 +2842,7 @@ resend_cmd2:
-
- if (return_status == IO_NEEDS_RETRY &&
- c->retry_count < MAX_CMD_RETRIES) {
-- printk(KERN_WARNING "cciss%d: retrying 0x%02x\n", h->ctlr,
-+ dev_warn(&h->pdev->dev, "retrying 0x%02x\n",
- c->Request.CDB[0]);
- c->retry_count++;
- /* erase the old error information */
-@@ -2654,28 +2861,27 @@ command_done:
- return return_status;
- }
-
--static int sendcmd_withirq(__u8 cmd, int ctlr, void *buff, size_t size,
-+static int sendcmd_withirq(ctlr_info_t *h, __u8 cmd, void *buff, size_t size,
- __u8 page_code, unsigned char scsi3addr[],
- int cmd_type)
- {
-- ctlr_info_t *h = hba[ctlr];
- CommandList_struct *c;
- int return_status;
-
-- c = cmd_alloc(h, 0);
-+ c = cmd_special_alloc(h);
- if (!c)
- return -ENOMEM;
-- return_status = fill_cmd(c, cmd, ctlr, buff, size, page_code,
-+ return_status = fill_cmd(h, c, cmd, buff, size, page_code,
- scsi3addr, cmd_type);
- if (return_status == IO_OK)
- return_status = sendcmd_withirq_core(h, c, 1);
-
-- cmd_free(h, c, 0);
-+ cmd_special_free(h, c);
- return return_status;
- }
-
--static void cciss_geometry_inquiry(int ctlr, int logvol,
-- int withirq, sector_t total_size,
-+static void cciss_geometry_inquiry(ctlr_info_t *h, int logvol,
-+ sector_t total_size,
- unsigned int block_size,
- InquiryData_struct *inq_buff,
- drive_info_struct *drv)
-@@ -2685,22 +2891,16 @@ static void cciss_geometry_inquiry(int ctlr, int logvol,
- unsigned char scsi3addr[8];
-
- memset(inq_buff, 0, sizeof(InquiryData_struct));
-- log_unit_to_scsi3addr(hba[ctlr], scsi3addr, logvol);
-- if (withirq)
-- return_code = sendcmd_withirq(CISS_INQUIRY, ctlr,
-- inq_buff, sizeof(*inq_buff),
-- 0xC1, scsi3addr, TYPE_CMD);
-- else
-- return_code = sendcmd(CISS_INQUIRY, ctlr, inq_buff,
-- sizeof(*inq_buff), 0xC1, scsi3addr,
-- TYPE_CMD);
-+ log_unit_to_scsi3addr(h, scsi3addr, logvol);
-+ return_code = sendcmd_withirq(h, CISS_INQUIRY, inq_buff,
-+ sizeof(*inq_buff), 0xC1, scsi3addr, TYPE_CMD);
- if (return_code == IO_OK) {
- if (inq_buff->data_byte[8] == 0xFF) {
-- printk(KERN_WARNING
-- "cciss: reading geometry failed, volume "
-+ dev_warn(&h->pdev->dev,
-+ "reading geometry failed, volume "
- "does not support reading geometry\n");
- drv->heads = 255;
-- drv->sectors = 32; // Sectors per track
-+ drv->sectors = 32; /* Sectors per track */
- drv->cylinders = total_size + 1;
- drv->raid_level = RAID_UNKNOWN;
- } else {
-@@ -2721,12 +2921,12 @@ static void cciss_geometry_inquiry(int ctlr, int logvol,
- drv->cylinders = real_size;
- }
- } else { /* Get geometry failed */
-- printk(KERN_WARNING "cciss: reading geometry failed\n");
-+ dev_warn(&h->pdev->dev, "reading geometry failed\n");
- }
- }
-
- static void
--cciss_read_capacity(int ctlr, int logvol, int withirq, sector_t *total_size,
-+cciss_read_capacity(ctlr_info_t *h, int logvol, sector_t *total_size,
- unsigned int *block_size)
- {
- ReadCapdata_struct *buf;
-@@ -2735,32 +2935,26 @@ cciss_read_capacity(int ctlr, int logvol, int withirq, sector_t *total_size,
-
- buf = kzalloc(sizeof(ReadCapdata_struct), GFP_KERNEL);
- if (!buf) {
-- printk(KERN_WARNING "cciss: out of memory\n");
-+ dev_warn(&h->pdev->dev, "out of memory\n");
- return;
- }
-
-- log_unit_to_scsi3addr(hba[ctlr], scsi3addr, logvol);
-- if (withirq)
-- return_code = sendcmd_withirq(CCISS_READ_CAPACITY,
-- ctlr, buf, sizeof(ReadCapdata_struct),
-- 0, scsi3addr, TYPE_CMD);
-- else
-- return_code = sendcmd(CCISS_READ_CAPACITY,
-- ctlr, buf, sizeof(ReadCapdata_struct),
-- 0, scsi3addr, TYPE_CMD);
-+ log_unit_to_scsi3addr(h, scsi3addr, logvol);
-+ return_code = sendcmd_withirq(h, CCISS_READ_CAPACITY, buf,
-+ sizeof(ReadCapdata_struct), 0, scsi3addr, TYPE_CMD);
- if (return_code == IO_OK) {
- *total_size = be32_to_cpu(*(__be32 *) buf->total_size);
- *block_size = be32_to_cpu(*(__be32 *) buf->block_size);
- } else { /* read capacity command failed */
-- printk(KERN_WARNING "cciss: read capacity failed\n");
-+ dev_warn(&h->pdev->dev, "read capacity failed\n");
- *total_size = 0;
- *block_size = BLOCK_SIZE;
- }
- kfree(buf);
- }
-
--static void
--cciss_read_capacity_16(int ctlr, int logvol, int withirq, sector_t *total_size, unsigned int *block_size)
-+static void cciss_read_capacity_16(ctlr_info_t *h, int logvol,
-+ sector_t *total_size, unsigned int *block_size)
- {
- ReadCapdata_struct_16 *buf;
- int return_code;
-@@ -2768,30 +2962,23 @@ cciss_read_capacity_16(int ctlr, int logvol, int withirq, sector_t *total_size,
-
- buf = kzalloc(sizeof(ReadCapdata_struct_16), GFP_KERNEL);
- if (!buf) {
-- printk(KERN_WARNING "cciss: out of memory\n");
-+ dev_warn(&h->pdev->dev, "out of memory\n");
- return;
- }
-
-- log_unit_to_scsi3addr(hba[ctlr], scsi3addr, logvol);
-- if (withirq) {
-- return_code = sendcmd_withirq(CCISS_READ_CAPACITY_16,
-- ctlr, buf, sizeof(ReadCapdata_struct_16),
-- 0, scsi3addr, TYPE_CMD);
-- }
-- else {
-- return_code = sendcmd(CCISS_READ_CAPACITY_16,
-- ctlr, buf, sizeof(ReadCapdata_struct_16),
-- 0, scsi3addr, TYPE_CMD);
-- }
-+ log_unit_to_scsi3addr(h, scsi3addr, logvol);
-+ return_code = sendcmd_withirq(h, CCISS_READ_CAPACITY_16,
-+ buf, sizeof(ReadCapdata_struct_16),
-+ 0, scsi3addr, TYPE_CMD);
- if (return_code == IO_OK) {
- *total_size = be64_to_cpu(*(__be64 *) buf->total_size);
- *block_size = be32_to_cpu(*(__be32 *) buf->block_size);
- } else { /* read capacity command failed */
-- printk(KERN_WARNING "cciss: read capacity failed\n");
-+ dev_warn(&h->pdev->dev, "read capacity failed\n");
- *total_size = 0;
- *block_size = BLOCK_SIZE;
- }
-- printk(KERN_INFO " blocks= %llu block_size= %d\n",
-+ dev_info(&h->pdev->dev, " blocks= %llu block_size= %d\n",
- (unsigned long long)*total_size+1, *block_size);
- kfree(buf);
- }
-@@ -2806,7 +2993,9 @@ static int cciss_revalidate(struct gendisk *disk)
- sector_t total_size;
- InquiryData_struct *inq_buff = NULL;
-
-- for (logvol = 0; logvol < CISS_MAX_LUN; logvol++) {
-+ for (logvol = 0; logvol <= h->highest_lun; logvol++) {
-+ if (!h->drv[logvol]) /* h->drv[] may contain holes */
-+ continue;
- if (memcmp(h->drv[logvol]->LunID, drv->LunID,
- sizeof(drv->LunID)) == 0) {
- FOUND = 1;
-@@ -2819,17 +3008,17 @@ static int cciss_revalidate(struct gendisk *disk)
-
- inq_buff = kmalloc(sizeof(InquiryData_struct), GFP_KERNEL);
- if (inq_buff == NULL) {
-- printk(KERN_WARNING "cciss: out of memory\n");
-+ dev_warn(&h->pdev->dev, "out of memory\n");
- return 1;
- }
- if (h->cciss_read == CCISS_READ_10) {
-- cciss_read_capacity(h->ctlr, logvol, 1,
-+ cciss_read_capacity(h, logvol,
- &total_size, &block_size);
- } else {
-- cciss_read_capacity_16(h->ctlr, logvol, 1,
-+ cciss_read_capacity_16(h, logvol,
- &total_size, &block_size);
- }
-- cciss_geometry_inquiry(h->ctlr, logvol, 1, total_size, block_size,
-+ cciss_geometry_inquiry(h, logvol, total_size, block_size,
- inq_buff, drv);
-
- blk_queue_logical_block_size(drv->queue, drv->block_size);
-@@ -2840,167 +3029,6 @@ static int cciss_revalidate(struct gendisk *disk)
- }
-
- /*
-- * Wait polling for a command to complete.
-- * The memory mapped FIFO is polled for the completion.
-- * Used only at init time, interrupts from the HBA are disabled.
-- */
--static unsigned long pollcomplete(int ctlr)
--{
-- unsigned long done;
-- int i;
--
-- /* Wait (up to 20 seconds) for a command to complete */
--
-- for (i = 20 * HZ; i > 0; i--) {
-- done = hba[ctlr]->access.command_completed(hba[ctlr]);
-- if (done == FIFO_EMPTY)
-- schedule_timeout_uninterruptible(1);
-- else
-- return done;
-- }
-- /* Invalid address to tell caller we ran out of time */
-- return 1;
--}
--
--/* Send command c to controller h and poll for it to complete.
-- * Turns interrupts off on the board. Used at driver init time
-- * and during SCSI error recovery.
-- */
--static int sendcmd_core(ctlr_info_t *h, CommandList_struct *c)
--{
-- int i;
-- unsigned long complete;
-- int status = IO_ERROR;
-- u64bit buff_dma_handle;
--
--resend_cmd1:
--
-- /* Disable interrupt on the board. */
-- h->access.set_intr_mask(h, CCISS_INTR_OFF);
--
-- /* Make sure there is room in the command FIFO */
-- /* Actually it should be completely empty at this time */
-- /* unless we are in here doing error handling for the scsi */
-- /* tape side of the driver. */
-- for (i = 200000; i > 0; i--) {
-- /* if fifo isn't full go */
-- if (!(h->access.fifo_full(h)))
-- break;
-- udelay(10);
-- printk(KERN_WARNING "cciss cciss%d: SendCmd FIFO full,"
-- " waiting!\n", h->ctlr);
-- }
-- h->access.submit_command(h, c); /* Send the cmd */
-- do {
-- complete = pollcomplete(h->ctlr);
--
--#ifdef CCISS_DEBUG
-- printk(KERN_DEBUG "cciss: command completed\n");
--#endif /* CCISS_DEBUG */
--
-- if (complete == 1) {
-- printk(KERN_WARNING
-- "cciss cciss%d: SendCmd Timeout out, "
-- "No command list address returned!\n", h->ctlr);
-- status = IO_ERROR;
-- break;
-- }
--
-- /* Make sure it's the command we're expecting. */
-- if ((complete & ~CISS_ERROR_BIT) != c->busaddr) {
-- printk(KERN_WARNING "cciss%d: Unexpected command "
-- "completion.\n", h->ctlr);
-- continue;
-- }
--
-- /* It is our command. If no error, we're done. */
-- if (!(complete & CISS_ERROR_BIT)) {
-- status = IO_OK;
-- break;
-- }
--
-- /* There is an error... */
--
-- /* if data overrun or underun on Report command ignore it */
-- if (((c->Request.CDB[0] == CISS_REPORT_LOG) ||
-- (c->Request.CDB[0] == CISS_REPORT_PHYS) ||
-- (c->Request.CDB[0] == CISS_INQUIRY)) &&
-- ((c->err_info->CommandStatus == CMD_DATA_OVERRUN) ||
-- (c->err_info->CommandStatus == CMD_DATA_UNDERRUN))) {
-- complete = c->busaddr;
-- status = IO_OK;
-- break;
-- }
--
-- if (c->err_info->CommandStatus == CMD_UNSOLICITED_ABORT) {
-- printk(KERN_WARNING "cciss%d: unsolicited abort %p\n",
-- h->ctlr, c);
-- if (c->retry_count < MAX_CMD_RETRIES) {
-- printk(KERN_WARNING "cciss%d: retrying %p\n",
-- h->ctlr, c);
-- c->retry_count++;
-- /* erase the old error information */
-- memset(c->err_info, 0, sizeof(c->err_info));
-- goto resend_cmd1;
-- }
-- printk(KERN_WARNING "cciss%d: retried %p too many "
-- "times\n", h->ctlr, c);
-- status = IO_ERROR;
-- break;
-- }
--
-- if (c->err_info->CommandStatus == CMD_UNABORTABLE) {
-- printk(KERN_WARNING "cciss%d: command could not be "
-- "aborted.\n", h->ctlr);
-- status = IO_ERROR;
-- break;
-- }
--
-- if (c->err_info->CommandStatus == CMD_TARGET_STATUS) {
-- status = check_target_status(h, c);
-- break;
-- }
--
-- printk(KERN_WARNING "cciss%d: sendcmd error\n", h->ctlr);
-- printk(KERN_WARNING "cmd = 0x%02x, CommandStatus = 0x%02x\n",
-- c->Request.CDB[0], c->err_info->CommandStatus);
-- status = IO_ERROR;
-- break;
--
-- } while (1);
--
-- /* unlock the data buffer from DMA */
-- buff_dma_handle.val32.lower = c->SG[0].Addr.lower;
-- buff_dma_handle.val32.upper = c->SG[0].Addr.upper;
-- pci_unmap_single(h->pdev, (dma_addr_t) buff_dma_handle.val,
-- c->SG[0].Len, PCI_DMA_BIDIRECTIONAL);
-- return status;
--}
--
--/*
-- * Send a command to the controller, and wait for it to complete.
-- * Used at init time, and during SCSI error recovery.
-- */
--static int sendcmd(__u8 cmd, int ctlr, void *buff, size_t size,
-- __u8 page_code, unsigned char *scsi3addr, int cmd_type)
--{
-- CommandList_struct *c;
-- int status;
--
-- c = cmd_alloc(hba[ctlr], 1);
-- if (!c) {
-- printk(KERN_WARNING "cciss: unable to get memory");
-- return IO_ERROR;
-- }
-- status = fill_cmd(c, cmd, ctlr, buff, size, page_code,
-- scsi3addr, cmd_type);
-- if (status == IO_OK)
-- status = sendcmd_core(hba[ctlr], c);
-- cmd_free(hba[ctlr], c, 1);
-- return status;
--}
--
--/*
- * Map (physical) PCI mem into (virtual) kernel space
- */
- static void __iomem *remap_pci_mem(ulong base, ulong size)
-@@ -3020,11 +3048,11 @@ static void start_io(ctlr_info_t *h)
- {
- CommandList_struct *c;
-
-- while (!hlist_empty(&h->reqQ)) {
-- c = hlist_entry(h->reqQ.first, CommandList_struct, list);
-+ while (!list_empty(&h->reqQ)) {
-+ c = list_entry(h->reqQ.next, CommandList_struct, list);
- /* can't do anything if fifo is full */
-- if ((h->access.fifo_full(h))) {
-- printk(KERN_WARNING "cciss: fifo full\n");
-+ if ((h->access->fifo_full(h))) {
-+ dev_warn(&h->pdev->dev, "fifo full\n");
- break;
- }
-
-@@ -3033,14 +3061,14 @@ static void start_io(ctlr_info_t *h)
- h->Qdepth--;
-
- /* Tell the controller execute command */
-- h->access.submit_command(h, c);
-+ h->access->submit_command(h, c);
-
- /* Put job onto the completed Q */
- addQ(&h->cmpQ, c);
- }
- }
-
--/* Assumes that CCISS_LOCK(h->ctlr) is held. */
-+/* Assumes that h->lock is held. */
- /* Zeros out the error record and then resends the command back */
- /* to the controller */
- static inline void resend_cciss_cmd(ctlr_info_t *h, CommandList_struct *c)
-@@ -3081,7 +3109,7 @@ static inline int evaluate_target_status(ctlr_info_t *h,
- driver_byte = DRIVER_OK;
- msg_byte = cmd->err_info->CommandStatus; /* correct? seems too device specific */
-
-- if (blk_pc_request(cmd->rq))
-+ if (cmd->rq->cmd_type == REQ_TYPE_BLOCK_PC)
- host_byte = DID_PASSTHROUGH;
- else
- host_byte = DID_OK;
-@@ -3090,8 +3118,8 @@ static inline int evaluate_target_status(ctlr_info_t *h,
- host_byte, driver_byte);
-
- if (cmd->err_info->ScsiStatus != SAM_STAT_CHECK_CONDITION) {
-- if (!blk_pc_request(cmd->rq))
-- printk(KERN_WARNING "cciss: cmd %p "
-+ if (cmd->rq->cmd_type != REQ_TYPE_BLOCK_PC)
-+ dev_warn(&h->pdev->dev, "cmd %p "
- "has SCSI Status 0x%x\n",
- cmd, cmd->err_info->ScsiStatus);
- return error_value;
-@@ -3100,17 +3128,18 @@ static inline int evaluate_target_status(ctlr_info_t *h,
- /* check the sense key */
- sense_key = 0xf & cmd->err_info->SenseInfo[2];
- /* no status or recovered error */
-- if (((sense_key == 0x0) || (sense_key == 0x1)) && !blk_pc_request(cmd->rq))
-+ if (((sense_key == 0x0) || (sense_key == 0x1)) &&
-+ (cmd->rq->cmd_type != REQ_TYPE_BLOCK_PC))
- error_value = 0;
-
- if (check_for_unit_attention(h, cmd)) {
-- *retry_cmd = !blk_pc_request(cmd->rq);
-+ *retry_cmd = (cmd->rq->cmd_type != REQ_TYPE_BLOCK_PC);
- return 0;
- }
-
-- if (!blk_pc_request(cmd->rq)) { /* Not SG_IO or similar? */
-+ if (cmd->rq->cmd_type != REQ_TYPE_BLOCK_PC) { /* Not SG_IO? */
- if (error_value != 0)
-- printk(KERN_WARNING "cciss: cmd %p has CHECK CONDITION"
-+ dev_warn(&h->pdev->dev, "cmd %p has CHECK CONDITION"
- " sense key = 0x%x\n", cmd, sense_key);
- return error_value;
- }
-@@ -3150,90 +3179,104 @@ static inline void complete_command(ctlr_info_t *h, CommandList_struct *cmd,
- rq->errors = evaluate_target_status(h, cmd, &retry_cmd);
- break;
- case CMD_DATA_UNDERRUN:
-- if (blk_fs_request(cmd->rq)) {
-- printk(KERN_WARNING "cciss: cmd %p has"
-+ if (cmd->rq->cmd_type == REQ_TYPE_FS) {
-+ dev_warn(&h->pdev->dev, "cmd %p has"
- " completed with data underrun "
- "reported\n", cmd);
- cmd->rq->resid_len = cmd->err_info->ResidualCnt;
- }
- break;
- case CMD_DATA_OVERRUN:
-- if (blk_fs_request(cmd->rq))
-- printk(KERN_WARNING "cciss: cmd %p has"
-+ if (cmd->rq->cmd_type == REQ_TYPE_FS)
-+ dev_warn(&h->pdev->dev, "cciss: cmd %p has"
- " completed with data overrun "
- "reported\n", cmd);
- break;
- case CMD_INVALID:
-- printk(KERN_WARNING "cciss: cmd %p is "
-+ dev_warn(&h->pdev->dev, "cciss: cmd %p is "
- "reported invalid\n", cmd);
- rq->errors = make_status_bytes(SAM_STAT_GOOD,
- cmd->err_info->CommandStatus, DRIVER_OK,
-- blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ERROR);
-+ (cmd->rq->cmd_type == REQ_TYPE_BLOCK_PC) ?
-+ DID_PASSTHROUGH : DID_ERROR);
- break;
- case CMD_PROTOCOL_ERR:
-- printk(KERN_WARNING "cciss: cmd %p has "
-- "protocol error \n", cmd);
-+ dev_warn(&h->pdev->dev, "cciss: cmd %p has "
-+ "protocol error\n", cmd);
- rq->errors = make_status_bytes(SAM_STAT_GOOD,
- cmd->err_info->CommandStatus, DRIVER_OK,
-- blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ERROR);
-+ (cmd->rq->cmd_type == REQ_TYPE_BLOCK_PC) ?
-+ DID_PASSTHROUGH : DID_ERROR);
- break;
- case CMD_HARDWARE_ERR:
-- printk(KERN_WARNING "cciss: cmd %p had "
-+ dev_warn(&h->pdev->dev, "cciss: cmd %p had "
- " hardware error\n", cmd);
- rq->errors = make_status_bytes(SAM_STAT_GOOD,
- cmd->err_info->CommandStatus, DRIVER_OK,
-- blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ERROR);
-+ (cmd->rq->cmd_type == REQ_TYPE_BLOCK_PC) ?
-+ DID_PASSTHROUGH : DID_ERROR);
- break;
- case CMD_CONNECTION_LOST:
-- printk(KERN_WARNING "cciss: cmd %p had "
-+ dev_warn(&h->pdev->dev, "cciss: cmd %p had "
- "connection lost\n", cmd);
- rq->errors = make_status_bytes(SAM_STAT_GOOD,
- cmd->err_info->CommandStatus, DRIVER_OK,
-- blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ERROR);
-+ (cmd->rq->cmd_type == REQ_TYPE_BLOCK_PC) ?
-+ DID_PASSTHROUGH : DID_ERROR);
- break;
- case CMD_ABORTED:
-- printk(KERN_WARNING "cciss: cmd %p was "
-+ dev_warn(&h->pdev->dev, "cciss: cmd %p was "
- "aborted\n", cmd);
- rq->errors = make_status_bytes(SAM_STAT_GOOD,
- cmd->err_info->CommandStatus, DRIVER_OK,
-- blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ABORT);
-+ (cmd->rq->cmd_type == REQ_TYPE_BLOCK_PC) ?
-+ DID_PASSTHROUGH : DID_ABORT);
- break;
- case CMD_ABORT_FAILED:
-- printk(KERN_WARNING "cciss: cmd %p reports "
-+ dev_warn(&h->pdev->dev, "cciss: cmd %p reports "
- "abort failed\n", cmd);
- rq->errors = make_status_bytes(SAM_STAT_GOOD,
- cmd->err_info->CommandStatus, DRIVER_OK,
-- blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ERROR);
-+ (cmd->rq->cmd_type == REQ_TYPE_BLOCK_PC) ?
-+ DID_PASSTHROUGH : DID_ERROR);
- break;
- case CMD_UNSOLICITED_ABORT:
-- printk(KERN_WARNING "cciss%d: unsolicited "
-+ dev_warn(&h->pdev->dev, "cciss%d: unsolicited "
- "abort %p\n", h->ctlr, cmd);
- if (cmd->retry_count < MAX_CMD_RETRIES) {
- retry_cmd = 1;
-- printk(KERN_WARNING
-- "cciss%d: retrying %p\n", h->ctlr, cmd);
-+ dev_warn(&h->pdev->dev, "retrying %p\n", cmd);
- cmd->retry_count++;
- } else
-- printk(KERN_WARNING
-- "cciss%d: %p retried too "
-- "many times\n", h->ctlr, cmd);
-+ dev_warn(&h->pdev->dev,
-+ "%p retried too many times\n", cmd);
- rq->errors = make_status_bytes(SAM_STAT_GOOD,
- cmd->err_info->CommandStatus, DRIVER_OK,
-- blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ABORT);
-+ (cmd->rq->cmd_type == REQ_TYPE_BLOCK_PC) ?
-+ DID_PASSTHROUGH : DID_ABORT);
- break;
- case CMD_TIMEOUT:
-- printk(KERN_WARNING "cciss: cmd %p timedout\n", cmd);
-+ dev_warn(&h->pdev->dev, "cmd %p timedout\n", cmd);
- rq->errors = make_status_bytes(SAM_STAT_GOOD,
- cmd->err_info->CommandStatus, DRIVER_OK,
-- blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ERROR);
-+ (cmd->rq->cmd_type == REQ_TYPE_BLOCK_PC) ?
-+ DID_PASSTHROUGH : DID_ERROR);
-+ break;
-+ case CMD_UNABORTABLE:
-+ dev_warn(&h->pdev->dev, "cmd %p unabortable\n", cmd);
-+ rq->errors = make_status_bytes(SAM_STAT_GOOD,
-+ cmd->err_info->CommandStatus, DRIVER_OK,
-+ (cmd->rq->cmd_type == REQ_TYPE_BLOCK_PC) ?
-+ DID_PASSTHROUGH : DID_ERROR);
- break;
- default:
-- printk(KERN_WARNING "cciss: cmd %p returned "
-+ dev_warn(&h->pdev->dev, "cmd %p returned "
- "unknown status %x\n", cmd,
- cmd->err_info->CommandStatus);
- rq->errors = make_status_bytes(SAM_STAT_GOOD,
- cmd->err_info->CommandStatus, DRIVER_OK,
-- blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ERROR);
-+ (cmd->rq->cmd_type == REQ_TYPE_BLOCK_PC) ?
-+ DID_PASSTHROUGH : DID_ERROR);
- }
-
- after_error_processing:
-@@ -3247,6 +3290,37 @@ after_error_processing:
- blk_complete_request(cmd->rq);
- }
-
-+static inline u32 cciss_tag_contains_index(u32 tag)
-+{
-+#define DIRECT_LOOKUP_BIT 0x10
-+ return tag & DIRECT_LOOKUP_BIT;
-+}
-+
-+static inline u32 cciss_tag_to_index(u32 tag)
-+{
-+#define DIRECT_LOOKUP_SHIFT 5
-+ return tag >> DIRECT_LOOKUP_SHIFT;
-+}
-+
-+static inline u32 cciss_tag_discard_error_bits(ctlr_info_t *h, u32 tag)
-+{
-+#define CCISS_PERF_ERROR_BITS ((1 << DIRECT_LOOKUP_SHIFT) - 1)
-+#define CCISS_SIMPLE_ERROR_BITS 0x03
-+ if (likely(h->transMethod & CFGTBL_Trans_Performant))
-+ return tag & ~CCISS_PERF_ERROR_BITS;
-+ return tag & ~CCISS_SIMPLE_ERROR_BITS;
-+}
-+
-+static inline void cciss_mark_tag_indexed(u32 *tag)
-+{
-+ *tag |= DIRECT_LOOKUP_BIT;
-+}
-+
-+static inline void cciss_set_tag_index(u32 *tag, u32 index)
-+{
-+ *tag |= (index << DIRECT_LOOKUP_SHIFT);
-+}
-+
- /*
- * Get a request and submit it to the controller.
- */
-@@ -3258,14 +3332,17 @@ static void do_cciss_request(struct request_queue *q)
- int seg;
- struct request *creq;
- u64bit temp64;
-- struct scatterlist tmp_sg[MAXSGENTRIES];
-+ struct scatterlist *tmp_sg;
-+ SGDescriptor_struct *curr_sg;
- drive_info_struct *drv;
- int i, dir;
-+ int sg_index = 0;
-+ int chained = 0;
-
- /* We call start_io here in case there is a command waiting on the
- * queue that has not been sent.
- */
-- if (blk_queue_plugged(q))
-+ if (BLK_QUEUE_PLUGGED(q))
- goto startio;
-
- queue:
-@@ -3273,13 +3350,15 @@ static void do_cciss_request(struct request_queue *q)
- if (!creq)
- goto startio;
-
-- BUG_ON(creq->nr_phys_segments > MAXSGENTRIES);
-+ BUG_ON(creq->nr_phys_segments > h->maxsgentries);
-
-- if ((c = cmd_alloc(h, 1)) == NULL)
-+ c = cmd_alloc(h);
-+ if (!c)
- goto full;
-
- blk_start_request(creq);
-
-+ tmp_sg = h->scatter_list[c->cmdindex];
- spin_unlock_irq(q->queue_lock);
-
- c->cmd_type = CMD_RWREQ;
-@@ -3287,28 +3366,25 @@ static void do_cciss_request(struct request_queue *q)
-
- /* fill in the request */
- drv = creq->rq_disk->private_data;
-- c->Header.ReplyQueue = 0; // unused in simple mode
-+ c->Header.ReplyQueue = 0; /* unused in simple mode */
- /* got command from pool, so use the command block index instead */
- /* for direct lookups. */
- /* The first 2 bits are reserved for controller error reporting. */
-- c->Header.Tag.lower = (c->cmdindex << 3);
-- c->Header.Tag.lower |= 0x04; /* flag for direct lookup. */
-+ cciss_set_tag_index(&c->Header.Tag.lower, c->cmdindex);
-+ cciss_mark_tag_indexed(&c->Header.Tag.lower);
- memcpy(&c->Header.LUN, drv->LunID, sizeof(drv->LunID));
-- c->Request.CDBLen = 10; // 12 byte commands not in FW yet;
-- c->Request.Type.Type = TYPE_CMD; // It is a command.
-+ c->Request.CDBLen = 10; /* 12 byte commands not in FW yet; */
-+ c->Request.Type.Type = TYPE_CMD; /* It is a command. */
- c->Request.Type.Attribute = ATTR_SIMPLE;
- c->Request.Type.Direction =
- (rq_data_dir(creq) == READ) ? XFER_READ : XFER_WRITE;
-- c->Request.Timeout = 0; // Don't time out
-+ c->Request.Timeout = 0; /* Don't time out */
- c->Request.CDB[0] =
- (rq_data_dir(creq) == READ) ? h->cciss_read : h->cciss_write;
- start_blk = blk_rq_pos(creq);
--#ifdef CCISS_DEBUG
-- printk(KERN_DEBUG "ciss: sector =%d nr_sectors=%d\n",
-+ dev_dbg(&h->pdev->dev, "sector =%d nr_sectors=%d\n",
- (int)blk_rq_pos(creq), (int)blk_rq_sectors(creq));
--#endif /* CCISS_DEBUG */
--
-- sg_init_table(tmp_sg, MAXSGENTRIES);
-+ sg_init_table(tmp_sg, h->maxsgentries);
- seg = blk_rq_map_sg(q, creq, tmp_sg);
-
- /* get the DMA records for the setup */
-@@ -3317,33 +3393,56 @@ static void do_cciss_request(struct request_queue *q)
- else
- dir = PCI_DMA_TODEVICE;
-
-+ curr_sg = c->SG;
-+ sg_index = 0;
-+ chained = 0;
-+
- for (i = 0; i < seg; i++) {
-- c->SG[i].Len = tmp_sg[i].length;
-+ if (((sg_index+1) == (h->max_cmd_sgentries)) &&
-+ !chained && ((seg - i) > 1)) {
-+ /* Point to next chain block. */
-+ curr_sg = h->cmd_sg_list[c->cmdindex];
-+ sg_index = 0;
-+ chained = 1;
-+ }
-+ curr_sg[sg_index].Len = tmp_sg[i].length;
- temp64.val = (__u64) pci_map_page(h->pdev, sg_page(&tmp_sg[i]),
-- tmp_sg[i].offset,
-- tmp_sg[i].length, dir);
-- c->SG[i].Addr.lower = temp64.val32.lower;
-- c->SG[i].Addr.upper = temp64.val32.upper;
-- c->SG[i].Ext = 0; // we are not chaining
-+ tmp_sg[i].offset,
-+ tmp_sg[i].length, dir);
-+ curr_sg[sg_index].Addr.lower = temp64.val32.lower;
-+ curr_sg[sg_index].Addr.upper = temp64.val32.upper;
-+ curr_sg[sg_index].Ext = 0; /* we are not chaining */
-+
-+ ++sg_index;
- }
-+
-+ if (chained)
-+ cciss_map_sg_chain_block(h, c, h->cmd_sg_list[c->cmdindex],
-+ (seg - (h->max_cmd_sgentries - 1)) *
-+ sizeof(SGDescriptor_struct));
- /* track how many SG entries we are using */
- if (seg > h->maxSG)
- h->maxSG = seg;
-
--#ifdef CCISS_DEBUG
-- printk(KERN_DEBUG "cciss: Submitting %u sectors in %d segments\n",
-- blk_rq_sectors(creq), seg);
--#endif /* CCISS_DEBUG */
-+ dev_dbg(&h->pdev->dev, "Submitting %u sectors in %d segments "
-+ "chained[%d]\n",
-+ blk_rq_sectors(creq), seg, chained);
-
-- c->Header.SGList = c->Header.SGTotal = seg;
-- if (likely(blk_fs_request(creq))) {
-+ c->Header.SGTotal = seg + chained;
-+ if (seg <= h->max_cmd_sgentries)
-+ c->Header.SGList = c->Header.SGTotal;
-+ else
-+ c->Header.SGList = h->max_cmd_sgentries;
-+ set_performant_mode(h, c);
-+
-+ if (likely(creq->cmd_type == REQ_TYPE_FS)) {
- if(h->cciss_read == CCISS_READ_10) {
- c->Request.CDB[1] = 0;
-- c->Request.CDB[2] = (start_blk >> 24) & 0xff; //MSB
-+ c->Request.CDB[2] = (start_blk >> 24) & 0xff; /* MSB */
- c->Request.CDB[3] = (start_blk >> 16) & 0xff;
- c->Request.CDB[4] = (start_blk >> 8) & 0xff;
- c->Request.CDB[5] = start_blk & 0xff;
-- c->Request.CDB[6] = 0; // (sect >> 24) & 0xff; MSB
-+ c->Request.CDB[6] = 0; /* (sect >> 24) & 0xff; MSB */
- c->Request.CDB[7] = (blk_rq_sectors(creq) >> 8) & 0xff;
- c->Request.CDB[8] = blk_rq_sectors(creq) & 0xff;
- c->Request.CDB[9] = c->Request.CDB[11] = c->Request.CDB[12] = 0;
-@@ -3352,7 +3451,7 @@ static void do_cciss_request(struct request_queue *q)
-
- c->Request.CDBLen = 16;
- c->Request.CDB[1]= 0;
-- c->Request.CDB[2]= (upper32 >> 24) & 0xff; //MSB
-+ c->Request.CDB[2]= (upper32 >> 24) & 0xff; /* MSB */
- c->Request.CDB[3]= (upper32 >> 16) & 0xff;
- c->Request.CDB[4]= (upper32 >> 8) & 0xff;
- c->Request.CDB[5]= upper32 & 0xff;
-@@ -3366,11 +3465,12 @@ static void do_cciss_request(struct request_queue *q)
- c->Request.CDB[13]= blk_rq_sectors(creq) & 0xff;
- c->Request.CDB[14] = c->Request.CDB[15] = 0;
- }
-- } else if (blk_pc_request(creq)) {
-+ } else if (creq->cmd_type == REQ_TYPE_BLOCK_PC) {
- c->Request.CDBLen = creq->cmd_len;
- memcpy(c->Request.CDB, creq->cmd, BLK_MAX_CDB);
- } else {
-- printk(KERN_WARNING "cciss%d: bad request type %d\n", h->ctlr, creq->cmd_type);
-+ dev_warn(&h->pdev->dev, "bad request type %d\n",
-+ creq->cmd_type);
- BUG();
- }
-
-@@ -3393,202 +3493,197 @@ startio:
-
- static inline unsigned long get_next_completion(ctlr_info_t *h)
- {
-- return h->access.command_completed(h);
-+ return h->access->command_completed(h);
- }
-
- static inline int interrupt_pending(ctlr_info_t *h)
- {
-- return h->access.intr_pending(h);
-+ return h->access->intr_pending(h);
- }
-
- static inline long interrupt_not_for_us(ctlr_info_t *h)
- {
-- return (((h->access.intr_pending(h) == 0) ||
-- (h->interrupts_enabled == 0)));
-+ return ((h->access->intr_pending(h) == 0) ||
-+ (h->interrupts_enabled == 0));
- }
-
--static irqreturn_t do_cciss_intr(int irq, void *dev_id)
-+static inline int bad_tag(ctlr_info_t *h, u32 tag_index,
-+ u32 raw_tag)
- {
-- ctlr_info_t *h = dev_id;
-- CommandList_struct *c;
-- unsigned long flags;
-- __u32 a, a1, a2;
--
-- if (interrupt_not_for_us(h))
-- return IRQ_NONE;
-- /*
-- * If there are completed commands in the completion queue,
-- * we had better do something about it.
-- */
-- spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
-- while (interrupt_pending(h)) {
-- while ((a = get_next_completion(h)) != FIFO_EMPTY) {
-- a1 = a;
-- if ((a & 0x04)) {
-- a2 = (a >> 3);
-- if (a2 >= h->nr_cmds) {
-- printk(KERN_WARNING
-- "cciss: controller cciss%d failed, stopping.\n",
-- h->ctlr);
-- fail_all_cmds(h->ctlr);
-- return IRQ_HANDLED;
-- }
--
-- c = h->cmd_pool + a2;
-- a = c->busaddr;
--
-- } else {
-- struct hlist_node *tmp;
--
-- a &= ~3;
-- c = NULL;
-- hlist_for_each_entry(c, tmp, &h->cmpQ, list) {
-- if (c->busaddr == a)
-- break;
-- }
-- }
-- /*
-- * If we've found the command, take it off the
-- * completion Q and free it
-- */
-- if (c && c->busaddr == a) {
-- removeQ(c);
-- if (c->cmd_type == CMD_RWREQ) {
-- complete_command(h, c, 0);
-- } else if (c->cmd_type == CMD_IOCTL_PEND) {
-- complete(c->waiting);
-- }
--# ifdef CONFIG_CISS_SCSI_TAPE
-- else if (c->cmd_type == CMD_SCSI)
-- complete_scsi_command(c, 0, a1);
--# endif
-- continue;
-- }
-- }
-+ if (unlikely(tag_index >= h->nr_cmds)) {
-+ dev_warn(&h->pdev->dev, "bad tag 0x%08x ignored.\n", raw_tag);
-+ return 1;
- }
--
-- spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
-- return IRQ_HANDLED;
--}
--
--/**
-- * add_to_scan_list() - add controller to rescan queue
-- * @h: Pointer to the controller.
-- *
-- * Adds the controller to the rescan queue if not already on the queue.
-- *
-- * returns 1 if added to the queue, 0 if skipped (could be on the
-- * queue already, or the controller could be initializing or shutting
-- * down).
-- **/
--static int add_to_scan_list(struct ctlr_info *h)
--{
-- struct ctlr_info *test_h;
-- int found = 0;
-- int ret = 0;
--
-- if (h->busy_initializing)
-- return 0;
--
-- if (!mutex_trylock(&h->busy_shutting_down))
-- return 0;
--
-- mutex_lock(&scan_mutex);
-- list_for_each_entry(test_h, &scan_q, scan_list) {
-- if (test_h == h) {
-- found = 1;
-- break;
-- }
-- }
-- if (!found && !h->busy_scanning) {
-- INIT_COMPLETION(h->scan_wait);
-- list_add_tail(&h->scan_list, &scan_q);
-- ret = 1;
-- }
-- mutex_unlock(&scan_mutex);
-- mutex_unlock(&h->busy_shutting_down);
--
-- return ret;
--}
--
--/**
-- * remove_from_scan_list() - remove controller from rescan queue
-- * @h: Pointer to the controller.
-- *
-- * Removes the controller from the rescan queue if present. Blocks if
-- * the controller is currently conducting a rescan.
-- **/
--static void remove_from_scan_list(struct ctlr_info *h)
--{
-- struct ctlr_info *test_h, *tmp_h;
-- int scanning = 0;
--
-- mutex_lock(&scan_mutex);
-- list_for_each_entry_safe(test_h, tmp_h, &scan_q, scan_list) {
-- if (test_h == h) {
-- list_del(&h->scan_list);
-- complete_all(&h->scan_wait);
-- mutex_unlock(&scan_mutex);
-- return;
-- }
-- }
-- if (&h->busy_scanning)
-- scanning = 0;
-- mutex_unlock(&scan_mutex);
--
-- if (scanning)
-- wait_for_completion(&h->scan_wait);
--}
--
--/**
-- * scan_thread() - kernel thread used to rescan controllers
-- * @data: Ignored.
-- *
-- * A kernel thread used scan for drive topology changes on
-- * controllers. The thread processes only one controller at a time
-- * using a queue. Controllers are added to the queue using
-- * add_to_scan_list() and removed from the queue either after done
-- * processing or using remove_from_scan_list().
-- *
-- * returns 0.
-- **/
--static int scan_thread(void *data)
--{
-- struct ctlr_info *h;
--
-- while (1) {
-- set_current_state(TASK_INTERRUPTIBLE);
-- schedule();
-- if (kthread_should_stop())
-- break;
--
-- while (1) {
-- mutex_lock(&scan_mutex);
-- if (list_empty(&scan_q)) {
-- mutex_unlock(&scan_mutex);
-- break;
-- }
--
-- h = list_entry(scan_q.next,
-- struct ctlr_info,
-- scan_list);
-- list_del(&h->scan_list);
-- h->busy_scanning = 1;
-- mutex_unlock(&scan_mutex);
--
-- if (h) {
-- rebuild_lun_table(h, 0, 0);
-- complete_all(&h->scan_wait);
-- mutex_lock(&scan_mutex);
-- h->busy_scanning = 0;
-- mutex_unlock(&scan_mutex);
-- }
-- }
-- }
--
- return 0;
- }
-
-+static inline void finish_cmd(ctlr_info_t *h, CommandList_struct *c,
-+ u32 raw_tag)
-+{
-+ removeQ(c);
-+ if (likely(c->cmd_type == CMD_RWREQ))
-+ complete_command(h, c, 0);
-+ else if (c->cmd_type == CMD_IOCTL_PEND)
-+ complete(c->waiting);
-+#ifdef CONFIG_CISS_SCSI_TAPE
-+ else if (c->cmd_type == CMD_SCSI)
-+ complete_scsi_command(c, 0, raw_tag);
-+#endif
-+}
-+
-+static inline u32 next_command(ctlr_info_t *h)
-+{
-+ u32 a;
-+
-+ if (unlikely(!(h->transMethod & CFGTBL_Trans_Performant)))
-+ return h->access->command_completed(h);
-+
-+ if ((*(h->reply_pool_head) & 1) == (h->reply_pool_wraparound)) {
-+ a = *(h->reply_pool_head); /* Next cmd in ring buffer */
-+ (h->reply_pool_head)++;
-+ h->commands_outstanding--;
-+ } else {
-+ a = FIFO_EMPTY;
-+ }
-+ /* Check for wraparound */
-+ if (h->reply_pool_head == (h->reply_pool + h->max_commands)) {
-+ h->reply_pool_head = h->reply_pool;
-+ h->reply_pool_wraparound ^= 1;
-+ }
-+ return a;
-+}
-+
-+/* process completion of an indexed ("direct lookup") command */
-+static inline u32 process_indexed_cmd(ctlr_info_t *h, u32 raw_tag)
-+{
-+ u32 tag_index;
-+ CommandList_struct *c;
-+
-+ tag_index = cciss_tag_to_index(raw_tag);
-+ if (bad_tag(h, tag_index, raw_tag))
-+ return next_command(h);
-+ c = h->cmd_pool + tag_index;
-+ finish_cmd(h, c, raw_tag);
-+ return next_command(h);
-+}
-+
-+/* process completion of a non-indexed command */
-+static inline u32 process_nonindexed_cmd(ctlr_info_t *h, u32 raw_tag)
-+{
-+ CommandList_struct *c = NULL;
-+ __u32 busaddr_masked, tag_masked;
-+
-+ tag_masked = cciss_tag_discard_error_bits(h, raw_tag);
-+ list_for_each_entry(c, &h->cmpQ, list) {
-+ busaddr_masked = cciss_tag_discard_error_bits(h, c->busaddr);
-+ if (busaddr_masked == tag_masked) {
-+ finish_cmd(h, c, raw_tag);
-+ return next_command(h);
-+ }
-+ }
-+ bad_tag(h, h->nr_cmds + 1, raw_tag);
-+ return next_command(h);
-+}
-+
-+/* Some controllers, like p400, will give us one interrupt
-+ * after a soft reset, even if we turned interrupts off.
-+ * Only need to check for this in the cciss_xxx_discard_completions
-+ * functions.
-+ */
-+static int ignore_bogus_interrupt(ctlr_info_t *h)
-+{
-+ if (likely(!reset_devices))
-+ return 0;
-+
-+ if (likely(h->interrupts_enabled))
-+ return 0;
-+
-+ dev_info(&h->pdev->dev, "Received interrupt while interrupts disabled "
-+ "(known firmware bug.) Ignoring.\n");
-+
-+ return 1;
-+}
-+
-+static irqreturn_t cciss_intx_discard_completions(int irq, void *dev_id)
-+{
-+ ctlr_info_t *h = dev_id;
-+ unsigned long flags;
-+ u32 raw_tag;
-+
-+ if (ignore_bogus_interrupt(h))
-+ return IRQ_NONE;
-+
-+ if (interrupt_not_for_us(h))
-+ return IRQ_NONE;
-+ spin_lock_irqsave(&h->lock, flags);
-+ while (interrupt_pending(h)) {
-+ raw_tag = get_next_completion(h);
-+ while (raw_tag != FIFO_EMPTY)
-+ raw_tag = next_command(h);
-+ }
-+ spin_unlock_irqrestore(&h->lock, flags);
-+ return IRQ_HANDLED;
-+}
-+
-+static irqreturn_t cciss_msix_discard_completions(int irq, void *dev_id)
-+{
-+ ctlr_info_t *h = dev_id;
-+ unsigned long flags;
-+ u32 raw_tag;
-+
-+ if (ignore_bogus_interrupt(h))
-+ return IRQ_NONE;
-+
-+ spin_lock_irqsave(&h->lock, flags);
-+ raw_tag = get_next_completion(h);
-+ while (raw_tag != FIFO_EMPTY)
-+ raw_tag = next_command(h);
-+ spin_unlock_irqrestore(&h->lock, flags);
-+ return IRQ_HANDLED;
-+}
-+
-+static irqreturn_t do_cciss_intx(int irq, void *dev_id)
-+{
-+ ctlr_info_t *h = dev_id;
-+ unsigned long flags;
-+ u32 raw_tag;
-+
-+ if (interrupt_not_for_us(h))
-+ return IRQ_NONE;
-+ spin_lock_irqsave(&h->lock, flags);
-+ while (interrupt_pending(h)) {
-+ raw_tag = get_next_completion(h);
-+ while (raw_tag != FIFO_EMPTY) {
-+ if (cciss_tag_contains_index(raw_tag))
-+ raw_tag = process_indexed_cmd(h, raw_tag);
-+ else
-+ raw_tag = process_nonindexed_cmd(h, raw_tag);
-+ }
-+ }
-+ spin_unlock_irqrestore(&h->lock, flags);
-+ return IRQ_HANDLED;
-+}
-+/* Add a second interrupt handler for MSI/MSI-X mode. In this mode we never
-+ * check the interrupt pending register because it is not set.
-+ */
-+static irqreturn_t do_cciss_msix_intr(int irq, void *dev_id)
-+{
-+ ctlr_info_t *h = dev_id;
-+ unsigned long flags;
-+ u32 raw_tag;
-+
-+ spin_lock_irqsave(&h->lock, flags);
-+ raw_tag = get_next_completion(h);
-+ while (raw_tag != FIFO_EMPTY) {
-+ if (cciss_tag_contains_index(raw_tag))
-+ raw_tag = process_indexed_cmd(h, raw_tag);
-+ else
-+ raw_tag = process_nonindexed_cmd(h, raw_tag);
-+ }
-+ spin_unlock_irqrestore(&h->lock, flags);
-+ return IRQ_HANDLED;
-+}
-+
- static int check_for_unit_attention(ctlr_info_t *h, CommandList_struct *c)
- {
- if (c->err_info->SenseInfo[2] != UNIT_ATTENTION)
-@@ -3596,36 +3691,48 @@ static int check_for_unit_attention(ctlr_info_t *h, CommandList_struct *c)
-
- switch (c->err_info->SenseInfo[12]) {
- case STATE_CHANGED:
-- printk(KERN_WARNING "cciss%d: a state change "
-- "detected, command retried\n", h->ctlr);
-+ dev_warn(&h->pdev->dev, "a state change "
-+ "detected, command retried\n");
- return 1;
- break;
- case LUN_FAILED:
-- printk(KERN_WARNING "cciss%d: LUN failure "
-- "detected, action required\n", h->ctlr);
-+ dev_warn(&h->pdev->dev, "LUN failure "
-+ "detected, action required\n");
- return 1;
- break;
- case REPORT_LUNS_CHANGED:
-- printk(KERN_WARNING "cciss%d: report LUN data "
-- "changed\n", h->ctlr);
-- add_to_scan_list(h);
-- wake_up_process(cciss_scan_thread);
-+ dev_warn(&h->pdev->dev, "report LUN data changed\n");
-+ /*
-+ * Here, we could call add_to_scan_list and wake up the scan thread,
-+ * except that it's quite likely that we will get more than one
-+ * REPORT_LUNS_CHANGED condition in quick succession, which means
-+ * that those which occur after the first one will likely happen
-+ * *during* the scan_thread's rescan. And the rescan code is not
-+ * robust enough to restart in the middle, undoing what it has already
-+ * done, and it's not clear that it's even possible to do this, since
-+ * part of what it does is notify the block layer, which starts
-+ * doing it's own i/o to read partition tables and so on, and the
-+ * driver doesn't have visibility to know what might need undoing.
-+ * In any event, if possible, it is horribly complicated to get right
-+ * so we just don't do it for now.
-+ *
-+ * Note: this REPORT_LUNS_CHANGED condition only occurs on the MSA2012.
-+ */
- return 1;
- break;
- case POWER_OR_RESET:
-- printk(KERN_WARNING "cciss%d: a power on "
-- "or device reset detected\n", h->ctlr);
-+ dev_warn(&h->pdev->dev,
-+ "a power on or device reset detected\n");
- return 1;
- break;
- case UNIT_ATTENTION_CLEARED:
-- printk(KERN_WARNING "cciss%d: unit attention "
-- "cleared by another initiator\n", h->ctlr);
-+ dev_warn(&h->pdev->dev,
-+ "unit attention cleared by another initiator\n");
- return 1;
- break;
- default:
-- printk(KERN_WARNING "cciss%d: unknown "
-- "unit attention detected\n", h->ctlr);
-- return 1;
-+ dev_warn(&h->pdev->dev, "unknown unit attention detected\n");
-+ return 1;
- }
- }
-
-@@ -3634,39 +3741,41 @@ static int check_for_unit_attention(ctlr_info_t *h, CommandList_struct *c)
- * the io functions.
- * This is for debug only.
- */
--#ifdef CCISS_DEBUG
--static void print_cfg_table(CfgTable_struct *tb)
-+static void print_cfg_table(ctlr_info_t *h)
- {
- int i;
- char temp_name[17];
-+ CfgTable_struct *tb = h->cfgtable;
-
-- printk("Controller Configuration information\n");
-- printk("------------------------------------\n");
-+ dev_dbg(&h->pdev->dev, "Controller Configuration information\n");
-+ dev_dbg(&h->pdev->dev, "------------------------------------\n");
- for (i = 0; i < 4; i++)
- temp_name[i] = readb(&(tb->Signature[i]));
- temp_name[4] = '\0';
-- printk(" Signature = %s\n", temp_name);
-- printk(" Spec Number = %d\n", readl(&(tb->SpecValence)));
-- printk(" Transport methods supported = 0x%x\n",
-+ dev_dbg(&h->pdev->dev, " Signature = %s\n", temp_name);
-+ dev_dbg(&h->pdev->dev, " Spec Number = %d\n",
-+ readl(&(tb->SpecValence)));
-+ dev_dbg(&h->pdev->dev, " Transport methods supported = 0x%x\n",
- readl(&(tb->TransportSupport)));
-- printk(" Transport methods active = 0x%x\n",
-+ dev_dbg(&h->pdev->dev, " Transport methods active = 0x%x\n",
- readl(&(tb->TransportActive)));
-- printk(" Requested transport Method = 0x%x\n",
-+ dev_dbg(&h->pdev->dev, " Requested transport Method = 0x%x\n",
- readl(&(tb->HostWrite.TransportRequest)));
-- printk(" Coalesce Interrupt Delay = 0x%x\n",
-+ dev_dbg(&h->pdev->dev, " Coalesce Interrupt Delay = 0x%x\n",
- readl(&(tb->HostWrite.CoalIntDelay)));
-- printk(" Coalesce Interrupt Count = 0x%x\n",
-+ dev_dbg(&h->pdev->dev, " Coalesce Interrupt Count = 0x%x\n",
- readl(&(tb->HostWrite.CoalIntCount)));
-- printk(" Max outstanding commands = 0x%d\n",
-+ dev_dbg(&h->pdev->dev, " Max outstanding commands = 0x%d\n",
- readl(&(tb->CmdsOutMax)));
-- printk(" Bus Types = 0x%x\n", readl(&(tb->BusTypes)));
-+ dev_dbg(&h->pdev->dev, " Bus Types = 0x%x\n",
-+ readl(&(tb->BusTypes)));
- for (i = 0; i < 16; i++)
- temp_name[i] = readb(&(tb->ServerName[i]));
- temp_name[16] = '\0';
-- printk(" Server Name = %s\n", temp_name);
-- printk(" Heartbeat Counter = 0x%x\n\n\n", readl(&(tb->HeartBeat)));
-+ dev_dbg(&h->pdev->dev, " Server Name = %s\n", temp_name);
-+ dev_dbg(&h->pdev->dev, " Heartbeat Counter = 0x%x\n\n\n",
-+ readl(&(tb->HeartBeat)));
- }
--#endif /* CCISS_DEBUG */
-
- static int find_PCI_BAR_index(struct pci_dev *pdev, unsigned long pci_bar_addr)
- {
-@@ -3690,7 +3799,7 @@ static int find_PCI_BAR_index(struct pci_dev *pdev, unsigned long pci_bar_addr)
- offset += 8;
- break;
- default: /* reserved in PCI 2.2 */
-- printk(KERN_WARNING
-+ dev_warn(&pdev->dev,
- "Base address is invalid\n");
- return -1;
- break;
-@@ -3702,12 +3811,187 @@ static int find_PCI_BAR_index(struct pci_dev *pdev, unsigned long pci_bar_addr)
- return -1;
- }
-
-+/* Fill in bucket_map[], given nsgs (the max number of
-+ * scatter gather elements supported) and bucket[],
-+ * which is an array of 8 integers. The bucket[] array
-+ * contains 8 different DMA transfer sizes (in 16
-+ * byte increments) which the controller uses to fetch
-+ * commands. This function fills in bucket_map[], which
-+ * maps a given number of scatter gather elements to one of
-+ * the 8 DMA transfer sizes. The point of it is to allow the
-+ * controller to only do as much DMA as needed to fetch the
-+ * command, with the DMA transfer size encoded in the lower
-+ * bits of the command address.
-+ */
-+static void calc_bucket_map(int bucket[], int num_buckets,
-+ int nsgs, int *bucket_map)
-+{
-+ int i, j, b, size;
-+
-+ /* even a command with 0 SGs requires 4 blocks */
-+#define MINIMUM_TRANSFER_BLOCKS 4
-+#define NUM_BUCKETS 8
-+ /* Note, bucket_map must have nsgs+1 entries. */
-+ for (i = 0; i <= nsgs; i++) {
-+ /* Compute size of a command with i SG entries */
-+ size = i + MINIMUM_TRANSFER_BLOCKS;
-+ b = num_buckets; /* Assume the biggest bucket */
-+ /* Find the bucket that is just big enough */
-+ for (j = 0; j < 8; j++) {
-+ if (bucket[j] >= size) {
-+ b = j;
-+ break;
-+ }
-+ }
-+ /* for a command with i SG entries, use bucket b. */
-+ bucket_map[i] = b;
-+ }
-+}
-+
-+static void __devinit cciss_wait_for_mode_change_ack(ctlr_info_t *h)
-+{
-+ int i;
-+
-+ /* under certain very rare conditions, this can take awhile.
-+ * (e.g.: hot replace a failed 144GB drive in a RAID 5 set right
-+ * as we enter this code.) */
-+ for (i = 0; i < MAX_CONFIG_WAIT; i++) {
-+ if (!(readl(h->vaddr + SA5_DOORBELL) & CFGTBL_ChangeReq))
-+ break;
-+ msleep(10);
-+ }
-+}
-+
-+static __devinit void cciss_enter_performant_mode(ctlr_info_t *h,
-+ u32 use_short_tags)
-+{
-+ /* This is a bit complicated. There are 8 registers on
-+ * the controller which we write to to tell it 8 different
-+ * sizes of commands which there may be. It's a way of
-+ * reducing the DMA done to fetch each command. Encoded into
-+ * each command's tag are 3 bits which communicate to the controller
-+ * which of the eight sizes that command fits within. The size of
-+ * each command depends on how many scatter gather entries there are.
-+ * Each SG entry requires 16 bytes. The eight registers are programmed
-+ * with the number of 16-byte blocks a command of that size requires.
-+ * The smallest command possible requires 5 such 16 byte blocks.
-+ * the largest command possible requires MAXSGENTRIES + 4 16-byte
-+ * blocks. Note, this only extends to the SG entries contained
-+ * within the command block, and does not extend to chained blocks
-+ * of SG elements. bft[] contains the eight values we write to
-+ * the registers. They are not evenly distributed, but have more
-+ * sizes for small commands, and fewer sizes for larger commands.
-+ */
-+ __u32 trans_offset;
-+ int bft[8] = { 5, 6, 8, 10, 12, 20, 28, MAXSGENTRIES + 4};
-+ /*
-+ * 5 = 1 s/g entry or 4k
-+ * 6 = 2 s/g entry or 8k
-+ * 8 = 4 s/g entry or 16k
-+ * 10 = 6 s/g entry or 24k
-+ */
-+ unsigned long register_value;
-+ BUILD_BUG_ON(28 > MAXSGENTRIES + 4);
-+
-+ h->reply_pool_wraparound = 1; /* spec: init to 1 */
-+
-+ /* Controller spec: zero out this buffer. */
-+ memset(h->reply_pool, 0, h->max_commands * sizeof(__u64));
-+ h->reply_pool_head = h->reply_pool;
-+
-+ trans_offset = readl(&(h->cfgtable->TransMethodOffset));
-+ calc_bucket_map(bft, ARRAY_SIZE(bft), h->maxsgentries,
-+ h->blockFetchTable);
-+ writel(bft[0], &h->transtable->BlockFetch0);
-+ writel(bft[1], &h->transtable->BlockFetch1);
-+ writel(bft[2], &h->transtable->BlockFetch2);
-+ writel(bft[3], &h->transtable->BlockFetch3);
-+ writel(bft[4], &h->transtable->BlockFetch4);
-+ writel(bft[5], &h->transtable->BlockFetch5);
-+ writel(bft[6], &h->transtable->BlockFetch6);
-+ writel(bft[7], &h->transtable->BlockFetch7);
-+
-+ /* size of controller ring buffer */
-+ writel(h->max_commands, &h->transtable->RepQSize);
-+ writel(1, &h->transtable->RepQCount);
-+ writel(0, &h->transtable->RepQCtrAddrLow32);
-+ writel(0, &h->transtable->RepQCtrAddrHigh32);
-+ writel(h->reply_pool_dhandle, &h->transtable->RepQAddr0Low32);
-+ writel(0, &h->transtable->RepQAddr0High32);
-+ writel(CFGTBL_Trans_Performant | use_short_tags,
-+ &(h->cfgtable->HostWrite.TransportRequest));
-+
-+ writel(CFGTBL_ChangeReq, h->vaddr + SA5_DOORBELL);
-+ cciss_wait_for_mode_change_ack(h);
-+ register_value = readl(&(h->cfgtable->TransportActive));
-+ if (!(register_value & CFGTBL_Trans_Performant))
-+ dev_warn(&h->pdev->dev, "cciss: unable to get board into"
-+ " performant mode\n");
-+}
-+
-+static void __devinit cciss_put_controller_into_performant_mode(ctlr_info_t *h)
-+{
-+ __u32 trans_support;
-+
-+ if (cciss_simple_mode)
-+ return;
-+
-+ dev_dbg(&h->pdev->dev, "Trying to put board into Performant mode\n");
-+ /* Attempt to put controller into performant mode if supported */
-+ /* Does board support performant mode? */
-+ trans_support = readl(&(h->cfgtable->TransportSupport));
-+ if (!(trans_support & PERFORMANT_MODE))
-+ return;
-+
-+ dev_dbg(&h->pdev->dev, "Placing controller into performant mode\n");
-+ /* Performant mode demands commands on a 32 byte boundary
-+ * pci_alloc_consistent aligns on page boundarys already.
-+ * Just need to check if divisible by 32
-+ */
-+ if ((sizeof(CommandList_struct) % 32) != 0) {
-+ dev_warn(&h->pdev->dev, "%s %d %s\n",
-+ "cciss info: command size[",
-+ (int)sizeof(CommandList_struct),
-+ "] not divisible by 32, no performant mode..\n");
-+ return;
-+ }
-+
-+ /* Performant mode ring buffer and supporting data structures */
-+ h->reply_pool = (__u64 *)pci_alloc_consistent(
-+ h->pdev, h->max_commands * sizeof(__u64),
-+ &(h->reply_pool_dhandle));
-+
-+ /* Need a block fetch table for performant mode */
-+ h->blockFetchTable = kmalloc(((h->maxsgentries+1) *
-+ sizeof(__u32)), GFP_KERNEL);
-+
-+ if ((h->reply_pool == NULL) || (h->blockFetchTable == NULL))
-+ goto clean_up;
-+
-+ cciss_enter_performant_mode(h,
-+ trans_support & CFGTBL_Trans_use_short_tags);
-+
-+ /* Change the access methods to the performant access methods */
-+ h->access = &SA5_performant_access;
-+ h->transMethod = CFGTBL_Trans_Performant;
-+
-+ return;
-+clean_up:
-+ kfree(h->blockFetchTable);
-+ if (h->reply_pool)
-+ pci_free_consistent(h->pdev,
-+ h->max_commands * sizeof(__u64),
-+ h->reply_pool,
-+ h->reply_pool_dhandle);
-+ return;
-+
-+} /* cciss_put_controller_into_performant_mode */
-+
- /* If MSI/MSI-X is supported by the kernel we will try to enable it on
- * controllers that are capable. If not, we use IO-APIC mode.
- */
-
--static void __devinit cciss_interrupt_mode(ctlr_info_t *c,
-- struct pci_dev *pdev, __u32 board_id)
-+static void __devinit cciss_interrupt_mode(ctlr_info_t *h)
- {
- #ifdef CONFIG_PCI_MSI
- int err;
-@@ -3716,251 +4000,307 @@ static void __devinit cciss_interrupt_mode(ctlr_info_t *c,
- };
-
- /* Some boards advertise MSI but don't really support it */
-- if ((board_id == 0x40700E11) ||
-- (board_id == 0x40800E11) ||
-- (board_id == 0x40820E11) || (board_id == 0x40830E11))
-+ if ((h->board_id == 0x40700E11) || (h->board_id == 0x40800E11) ||
-+ (h->board_id == 0x40820E11) || (h->board_id == 0x40830E11))
- goto default_int_mode;
-
-- if (pci_find_capability(pdev, PCI_CAP_ID_MSIX)) {
-- err = pci_enable_msix(pdev, cciss_msix_entries, 4);
-+ if (pci_find_capability(h->pdev, PCI_CAP_ID_MSIX)) {
-+ err = pci_enable_msix(h->pdev, cciss_msix_entries, 4);
- if (!err) {
-- c->intr[0] = cciss_msix_entries[0].vector;
-- c->intr[1] = cciss_msix_entries[1].vector;
-- c->intr[2] = cciss_msix_entries[2].vector;
-- c->intr[3] = cciss_msix_entries[3].vector;
-- c->msix_vector = 1;
-+ h->intr[0] = cciss_msix_entries[0].vector;
-+ h->intr[1] = cciss_msix_entries[1].vector;
-+ h->intr[2] = cciss_msix_entries[2].vector;
-+ h->intr[3] = cciss_msix_entries[3].vector;
-+ h->msix_vector = 1;
- return;
- }
- if (err > 0) {
-- printk(KERN_WARNING "cciss: only %d MSI-X vectors "
-- "available\n", err);
-+ dev_warn(&h->pdev->dev,
-+ "only %d MSI-X vectors available\n", err);
- goto default_int_mode;
- } else {
-- printk(KERN_WARNING "cciss: MSI-X init failed %d\n",
-- err);
-+ dev_warn(&h->pdev->dev,
-+ "MSI-X init failed %d\n", err);
- goto default_int_mode;
- }
- }
-- if (pci_find_capability(pdev, PCI_CAP_ID_MSI)) {
-- if (!pci_enable_msi(pdev)) {
-- c->msi_vector = 1;
-- } else {
-- printk(KERN_WARNING "cciss: MSI init failed\n");
-- }
-+ if (pci_find_capability(h->pdev, PCI_CAP_ID_MSI)) {
-+ if (!pci_enable_msi(h->pdev))
-+ h->msi_vector = 1;
-+ else
-+ dev_warn(&h->pdev->dev, "MSI init failed\n");
- }
- default_int_mode:
- #endif /* CONFIG_PCI_MSI */
- /* if we get here we're going to use the default interrupt mode */
-- c->intr[SIMPLE_MODE_INT] = pdev->irq;
-+ h->intr[h->intr_mode] = h->pdev->irq;
- return;
- }
-
--static int __devinit cciss_pci_init(ctlr_info_t *c, struct pci_dev *pdev)
-+static int __devinit cciss_lookup_board_id(struct pci_dev *pdev, u32 *board_id)
- {
-- ushort subsystem_vendor_id, subsystem_device_id, command;
-- __u32 board_id, scratchpad = 0;
-- __u64 cfg_offset;
-- __u32 cfg_base_addr;
-- __u64 cfg_base_addr_index;
-- int i, prod_index, err;
-+ int i;
-+ u32 subsystem_vendor_id, subsystem_device_id;
-
- subsystem_vendor_id = pdev->subsystem_vendor;
- subsystem_device_id = pdev->subsystem_device;
-- board_id = (((__u32) (subsystem_device_id << 16) & 0xffff0000) |
-- subsystem_vendor_id);
-+ *board_id = ((subsystem_device_id << 16) & 0xffff0000) |
-+ subsystem_vendor_id;
-
- for (i = 0; i < ARRAY_SIZE(products); i++) {
- /* Stand aside for hpsa driver on request */
-- if (cciss_allow_hpsa && products[i].board_id == HPSA_BOUNDARY)
-+ if (cciss_allow_hpsa)
- return -ENODEV;
-- if (board_id == products[i].board_id)
-- break;
-- }
-- prod_index = i;
-- if (prod_index == ARRAY_SIZE(products)) {
-- dev_warn(&pdev->dev,
-- "unrecognized board ID: 0x%08lx, ignoring.\n",
-- (unsigned long) board_id);
-- return -ENODEV;
-+ if (*board_id == products[i].board_id)
-+ return i;
-+ }
-+ dev_warn(&pdev->dev, "unrecognized board ID: 0x%08x, ignoring.\n",
-+ *board_id);
-+ return -ENODEV;
-+}
-+
-+static inline bool cciss_board_disabled(ctlr_info_t *h)
-+{
-+ u16 command;
-+
-+ (void) pci_read_config_word(h->pdev, PCI_COMMAND, &command);
-+ return ((command & PCI_COMMAND_MEMORY) == 0);
-+}
-+
-+static int __devinit cciss_pci_find_memory_BAR(struct pci_dev *pdev,
-+ unsigned long *memory_bar)
-+{
-+ int i;
-+
-+ for (i = 0; i < DEVICE_COUNT_RESOURCE; i++)
-+ if (pci_resource_flags(pdev, i) & IORESOURCE_MEM) {
-+ /* addressing mode bits already removed */
-+ *memory_bar = pci_resource_start(pdev, i);
-+ dev_dbg(&pdev->dev, "memory BAR = %lx\n",
-+ *memory_bar);
-+ return 0;
-+ }
-+ dev_warn(&pdev->dev, "no memory BAR found\n");
-+ return -ENODEV;
-+}
-+
-+static int __devinit cciss_wait_for_board_state(struct pci_dev *pdev,
-+ void __iomem *vaddr, int wait_for_ready)
-+#define BOARD_READY 1
-+#define BOARD_NOT_READY 0
-+{
-+ int i, iterations;
-+ u32 scratchpad;
-+
-+ if (wait_for_ready)
-+ iterations = CCISS_BOARD_READY_ITERATIONS;
-+ else
-+ iterations = CCISS_BOARD_NOT_READY_ITERATIONS;
-+
-+ for (i = 0; i < iterations; i++) {
-+ scratchpad = readl(vaddr + SA5_SCRATCHPAD_OFFSET);
-+ if (wait_for_ready) {
-+ if (scratchpad == CCISS_FIRMWARE_READY)
-+ return 0;
-+ } else {
-+ if (scratchpad != CCISS_FIRMWARE_READY)
-+ return 0;
-+ }
-+ msleep(CCISS_BOARD_READY_POLL_INTERVAL_MSECS);
- }
-+ dev_warn(&pdev->dev, "board not ready, timed out.\n");
-+ return -ENODEV;
-+}
-
-- /* check to see if controller has been disabled */
-- /* BEFORE trying to enable it */
-- (void)pci_read_config_word(pdev, PCI_COMMAND, &command);
-- if (!(command & 0x02)) {
-- printk(KERN_WARNING
-- "cciss: controller appears to be disabled\n");
-+static int __devinit cciss_find_cfg_addrs(struct pci_dev *pdev,
-+ void __iomem *vaddr, u32 *cfg_base_addr, u64 *cfg_base_addr_index,
-+ u64 *cfg_offset)
-+{
-+ *cfg_base_addr = readl(vaddr + SA5_CTCFG_OFFSET);
-+ *cfg_offset = readl(vaddr + SA5_CTMEM_OFFSET);
-+ *cfg_base_addr &= (u32) 0x0000ffff;
-+ *cfg_base_addr_index = find_PCI_BAR_index(pdev, *cfg_base_addr);
-+ if (*cfg_base_addr_index == -1) {
-+ dev_warn(&pdev->dev, "cannot find cfg_base_addr_index, "
-+ "*cfg_base_addr = 0x%08x\n", *cfg_base_addr);
- return -ENODEV;
- }
-+ return 0;
-+}
-+
-+static int __devinit cciss_find_cfgtables(ctlr_info_t *h)
-+{
-+ u64 cfg_offset;
-+ u32 cfg_base_addr;
-+ u64 cfg_base_addr_index;
-+ u32 trans_offset;
-+ int rc;
-+
-+ rc = cciss_find_cfg_addrs(h->pdev, h->vaddr, &cfg_base_addr,
-+ &cfg_base_addr_index, &cfg_offset);
-+ if (rc)
-+ return rc;
-+ h->cfgtable = remap_pci_mem(pci_resource_start(h->pdev,
-+ cfg_base_addr_index) + cfg_offset, sizeof(*h->cfgtable));
-+ if (!h->cfgtable)
-+ return -ENOMEM;
-+ rc = write_driver_ver_to_cfgtable(h->cfgtable);
-+ if (rc)
-+ return rc;
-+ /* Find performant mode table. */
-+ trans_offset = readl(&h->cfgtable->TransMethodOffset);
-+ h->transtable = remap_pci_mem(pci_resource_start(h->pdev,
-+ cfg_base_addr_index)+cfg_offset+trans_offset,
-+ sizeof(*h->transtable));
-+ if (!h->transtable)
-+ return -ENOMEM;
-+ return 0;
-+}
-+
-+static void __devinit cciss_get_max_perf_mode_cmds(struct ctlr_info *h)
-+{
-+ h->max_commands = readl(&(h->cfgtable->MaxPerformantModeCommands));
-+
-+ /* Limit commands in memory limited kdump scenario. */
-+ if (reset_devices && h->max_commands > 32)
-+ h->max_commands = 32;
-+
-+ if (h->max_commands < 16) {
-+ dev_warn(&h->pdev->dev, "Controller reports "
-+ "max supported commands of %d, an obvious lie. "
-+ "Using 16. Ensure that firmware is up to date.\n",
-+ h->max_commands);
-+ h->max_commands = 16;
-+ }
-+}
-+
-+/* Interrogate the hardware for some limits:
-+ * max commands, max SG elements without chaining, and with chaining,
-+ * SG chain block size, etc.
-+ */
-+static void __devinit cciss_find_board_params(ctlr_info_t *h)
-+{
-+ cciss_get_max_perf_mode_cmds(h);
-+ h->nr_cmds = h->max_commands - 4 - cciss_tape_cmds;
-+ h->maxsgentries = readl(&(h->cfgtable->MaxSGElements));
-+ /*
-+ * Limit in-command s/g elements to 32 save dma'able memory.
-+ * Howvever spec says if 0, use 31
-+ */
-+ h->max_cmd_sgentries = 31;
-+ if (h->maxsgentries > 512) {
-+ h->max_cmd_sgentries = 32;
-+ h->chainsize = h->maxsgentries - h->max_cmd_sgentries + 1;
-+ h->maxsgentries--; /* save one for chain pointer */
-+ } else {
-+ h->maxsgentries = 31; /* default to traditional values */
-+ h->chainsize = 0;
-+ }
-+}
-+
-+static inline bool CISS_signature_present(ctlr_info_t *h)
-+{
-+ if ((readb(&h->cfgtable->Signature[0]) != 'C') ||
-+ (readb(&h->cfgtable->Signature[1]) != 'I') ||
-+ (readb(&h->cfgtable->Signature[2]) != 'S') ||
-+ (readb(&h->cfgtable->Signature[3]) != 'S')) {
-+ dev_warn(&h->pdev->dev, "not a valid CISS config table\n");
-+ return false;
-+ }
-+ return true;
-+}
-+
-+/* Need to enable prefetch in the SCSI core for 6400 in x86 */
-+static inline void cciss_enable_scsi_prefetch(ctlr_info_t *h)
-+{
-+#ifdef CONFIG_X86
-+ u32 prefetch;
-+
-+ prefetch = readl(&(h->cfgtable->SCSI_Prefetch));
-+ prefetch |= 0x100;
-+ writel(prefetch, &(h->cfgtable->SCSI_Prefetch));
-+#endif
-+}
-
-- err = pci_enable_device(pdev);
-+/* Disable DMA prefetch for the P600. Otherwise an ASIC bug may result
-+ * in a prefetch beyond physical memory.
-+ */
-+static inline void cciss_p600_dma_prefetch_quirk(ctlr_info_t *h)
-+{
-+ u32 dma_prefetch;
-+ __u32 dma_refetch;
-+
-+ if (h->board_id != 0x3225103C)
-+ return;
-+ dma_prefetch = readl(h->vaddr + I2O_DMA1_CFG);
-+ dma_prefetch |= 0x8000;
-+ writel(dma_prefetch, h->vaddr + I2O_DMA1_CFG);
-+ pci_read_config_dword(h->pdev, PCI_COMMAND_PARITY, &dma_refetch);
-+ dma_refetch |= 0x1;
-+ pci_write_config_dword(h->pdev, PCI_COMMAND_PARITY, dma_refetch);
-+}
-+
-+static int __devinit cciss_pci_init(ctlr_info_t *h)
-+{
-+ int prod_index, err;
-+
-+ prod_index = cciss_lookup_board_id(h->pdev, &h->board_id);
-+ if (prod_index < 0)
-+ return -ENODEV;
-+ h->product_name = products[prod_index].product_name;
-+ h->access = products[prod_index].access;
-+
-+ if (cciss_board_disabled(h)) {
-+ dev_warn(&h->pdev->dev, "controller appears to be disabled\n");
-+ return -ENODEV;
-+ }
-+ err = pci_enable_device(h->pdev);
- if (err) {
-- printk(KERN_ERR "cciss: Unable to Enable PCI device\n");
-+ dev_warn(&h->pdev->dev, "Unable to Enable PCI device\n");
- return err;
- }
-
-- err = pci_request_regions(pdev, "cciss");
-+ err = pci_request_regions(h->pdev, "cciss");
- if (err) {
-- printk(KERN_ERR "cciss: Cannot obtain PCI resources, "
-- "aborting\n");
-+ dev_warn(&h->pdev->dev,
-+ "Cannot obtain PCI resources, aborting\n");
- return err;
- }
-
--#ifdef CCISS_DEBUG
-- printk("command = %x\n", command);
-- printk("irq = %x\n", pdev->irq);
-- printk("board_id = %x\n", board_id);
--#endif /* CCISS_DEBUG */
-+ dev_dbg(&h->pdev->dev, "irq = %x\n", h->pdev->irq);
-+ dev_dbg(&h->pdev->dev, "board_id = %x\n", h->board_id);
-
- /* If the kernel supports MSI/MSI-X we will try to enable that functionality,
- * else we use the IO-APIC interrupt assigned to us by system ROM.
- */
-- cciss_interrupt_mode(c, pdev, board_id);
--
-- /* find the memory BAR */
-- for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
-- if (pci_resource_flags(pdev, i) & IORESOURCE_MEM)
-- break;
-- }
-- if (i == DEVICE_COUNT_RESOURCE) {
-- printk(KERN_WARNING "cciss: No memory BAR found\n");
-- err = -ENODEV;
-+ cciss_interrupt_mode(h);
-+ err = cciss_pci_find_memory_BAR(h->pdev, &h->paddr);
-+ if (err)
- goto err_out_free_res;
-- }
--
-- c->paddr = pci_resource_start(pdev, i); /* addressing mode bits
-- * already removed
-- */
--
--#ifdef CCISS_DEBUG
-- printk("address 0 = %lx\n", c->paddr);
--#endif /* CCISS_DEBUG */
-- c->vaddr = remap_pci_mem(c->paddr, 0x250);
--
-- /* Wait for the board to become ready. (PCI hotplug needs this.)
-- * We poll for up to 120 secs, once per 100ms. */
-- for (i = 0; i < 1200; i++) {
-- scratchpad = readl(c->vaddr + SA5_SCRATCHPAD_OFFSET);
-- if (scratchpad == CCISS_FIRMWARE_READY)
-- break;
-- set_current_state(TASK_INTERRUPTIBLE);
-- schedule_timeout(msecs_to_jiffies(100)); /* wait 100ms */
-- }
-- if (scratchpad != CCISS_FIRMWARE_READY) {
-- printk(KERN_WARNING "cciss: Board not ready. Timed out.\n");
-- err = -ENODEV;
-+ h->vaddr = remap_pci_mem(h->paddr, 0x250);
-+ if (!h->vaddr) {
-+ err = -ENOMEM;
- goto err_out_free_res;
- }
--
-- /* get the address index number */
-- cfg_base_addr = readl(c->vaddr + SA5_CTCFG_OFFSET);
-- cfg_base_addr &= (__u32) 0x0000ffff;
--#ifdef CCISS_DEBUG
-- printk("cfg base address = %x\n", cfg_base_addr);
--#endif /* CCISS_DEBUG */
-- cfg_base_addr_index = find_PCI_BAR_index(pdev, cfg_base_addr);
--#ifdef CCISS_DEBUG
-- printk("cfg base address index = %llx\n",
-- (unsigned long long)cfg_base_addr_index);
--#endif /* CCISS_DEBUG */
-- if (cfg_base_addr_index == -1) {
-- printk(KERN_WARNING "cciss: Cannot find cfg_base_addr_index\n");
-- err = -ENODEV;
-+ err = cciss_wait_for_board_state(h->pdev, h->vaddr, BOARD_READY);
-+ if (err)
- goto err_out_free_res;
-- }
--
-- cfg_offset = readl(c->vaddr + SA5_CTMEM_OFFSET);
--#ifdef CCISS_DEBUG
-- printk("cfg offset = %llx\n", (unsigned long long)cfg_offset);
--#endif /* CCISS_DEBUG */
-- c->cfgtable = remap_pci_mem(pci_resource_start(pdev,
-- cfg_base_addr_index) +
-- cfg_offset, sizeof(CfgTable_struct));
-- c->board_id = board_id;
--
--#ifdef CCISS_DEBUG
-- print_cfg_table(c->cfgtable);
--#endif /* CCISS_DEBUG */
--
-- /* Some controllers support Zero Memory Raid (ZMR).
-- * When configured in ZMR mode the number of supported
-- * commands drops to 64. So instead of just setting an
-- * arbitrary value we make the driver a little smarter.
-- * We read the config table to tell us how many commands
-- * are supported on the controller then subtract 4 to
-- * leave a little room for ioctl calls.
-- */
-- c->max_commands = readl(&(c->cfgtable->CmdsOutMax));
-- c->product_name = products[prod_index].product_name;
-- c->access = *(products[prod_index].access);
-- c->nr_cmds = c->max_commands - 4;
-- if ((readb(&c->cfgtable->Signature[0]) != 'C') ||
-- (readb(&c->cfgtable->Signature[1]) != 'I') ||
-- (readb(&c->cfgtable->Signature[2]) != 'S') ||
-- (readb(&c->cfgtable->Signature[3]) != 'S')) {
-- printk("Does not appear to be a valid CISS config table\n");
-- err = -ENODEV;
-+ err = cciss_find_cfgtables(h);
-+ if (err)
- goto err_out_free_res;
-- }
--#ifdef CONFIG_X86
-- {
-- /* Need to enable prefetch in the SCSI core for 6400 in x86 */
-- __u32 prefetch;
-- prefetch = readl(&(c->cfgtable->SCSI_Prefetch));
-- prefetch |= 0x100;
-- writel(prefetch, &(c->cfgtable->SCSI_Prefetch));
-- }
--#endif
--
-- /* Disabling DMA prefetch and refetch for the P600.
-- * An ASIC bug may result in accesses to invalid memory addresses.
-- * We've disabled prefetch for some time now. Testing with XEN
-- * kernels revealed a bug in the refetch if dom0 resides on a P600.
-- */
-- if(board_id == 0x3225103C) {
-- __u32 dma_prefetch;
-- __u32 dma_refetch;
-- dma_prefetch = readl(c->vaddr + I2O_DMA1_CFG);
-- dma_prefetch |= 0x8000;
-- writel(dma_prefetch, c->vaddr + I2O_DMA1_CFG);
-- pci_read_config_dword(pdev, PCI_COMMAND_PARITY, &dma_refetch);
-- dma_refetch |= 0x1;
-- pci_write_config_dword(pdev, PCI_COMMAND_PARITY, dma_refetch);
-- }
--
--#ifdef CCISS_DEBUG
-- printk("Trying to put board into Simple mode\n");
--#endif /* CCISS_DEBUG */
-- c->max_commands = readl(&(c->cfgtable->CmdsOutMax));
-- /* Update the field, and then ring the doorbell */
-- writel(CFGTBL_Trans_Simple, &(c->cfgtable->HostWrite.TransportRequest));
-- writel(CFGTBL_ChangeReq, c->vaddr + SA5_DOORBELL);
--
-- /* under certain very rare conditions, this can take awhile.
-- * (e.g.: hot replace a failed 144GB drive in a RAID 5 set right
-- * as we enter this code.) */
-- for (i = 0; i < MAX_CONFIG_WAIT; i++) {
-- if (!(readl(c->vaddr + SA5_DOORBELL) & CFGTBL_ChangeReq))
-- break;
-- /* delay and try again */
-- set_current_state(TASK_INTERRUPTIBLE);
-- schedule_timeout(msecs_to_jiffies(1));
-- }
--
--#ifdef CCISS_DEBUG
-- printk(KERN_DEBUG "I counter got to %d %x\n", i,
-- readl(c->vaddr + SA5_DOORBELL));
--#endif /* CCISS_DEBUG */
--#ifdef CCISS_DEBUG
-- print_cfg_table(c->cfgtable);
--#endif /* CCISS_DEBUG */
-+ print_cfg_table(h);
-+ cciss_find_board_params(h);
-
-- if (!(readl(&(c->cfgtable->TransportActive)) & CFGTBL_Trans_Simple)) {
-- printk(KERN_WARNING "cciss: unable to get board into"
-- " simple mode\n");
-+ if (!CISS_signature_present(h)) {
- err = -ENODEV;
- goto err_out_free_res;
- }
-+ cciss_enable_scsi_prefetch(h);
-+ cciss_p600_dma_prefetch_quirk(h);
-+ err = cciss_enter_simple_mode(h);
-+ if (err)
-+ goto err_out_free_res;
-+ cciss_put_controller_into_performant_mode(h);
- return 0;
-
- err_out_free_res:
-@@ -3968,42 +4308,47 @@ err_out_free_res:
- * Deliberately omit pci_disable_device(): it does something nasty to
- * Smart Array controllers that pci_enable_device does not undo
- */
-- pci_release_regions(pdev);
-+ if (h->transtable)
-+ iounmap(h->transtable);
-+ if (h->cfgtable)
-+ iounmap(h->cfgtable);
-+ if (h->vaddr)
-+ iounmap(h->vaddr);
-+ pci_release_regions(h->pdev);
- return err;
- }
-
- /* Function to find the first free pointer into our hba[] array
- * Returns -1 if no free entries are left.
- */
--static int alloc_cciss_hba(void)
-+static int alloc_cciss_hba(struct pci_dev *pdev)
- {
- int i;
-
- for (i = 0; i < MAX_CTLR; i++) {
- if (!hba[i]) {
-- ctlr_info_t *p;
-+ ctlr_info_t *h;
-
-- p = kzalloc(sizeof(ctlr_info_t), GFP_KERNEL);
-- if (!p)
-+ h = kzalloc(sizeof(ctlr_info_t), GFP_KERNEL);
-+ if (!h)
- goto Enomem;
-- hba[i] = p;
-+ hba[i] = h;
- return i;
- }
- }
-- printk(KERN_WARNING "cciss: This driver supports a maximum"
-+ dev_warn(&pdev->dev, "This driver supports a maximum"
- " of %d controllers.\n", MAX_CTLR);
- return -1;
- Enomem:
-- printk(KERN_ERR "cciss: out of memory.\n");
-+ dev_warn(&pdev->dev, "out of memory.\n");
- return -1;
- }
-
--static void free_hba(int n)
-+static void free_hba(ctlr_info_t *h)
- {
-- ctlr_info_t *h = hba[n];
- int i;
-
-- hba[n] = NULL;
-+ hba[h->ctlr] = NULL;
- for (i = 0; i < h->highest_lun + 1; i++)
- if (h->gendisk[i] != NULL)
- put_disk(h->gendisk[i]);
-@@ -4075,7 +4420,7 @@ static __devinit int cciss_message(struct pci_dev *pdev, unsigned char opcode, u
- tag = readl(vaddr + SA5_REPLY_PORT_OFFSET);
- if ((tag & ~3) == paddr32)
- break;
-- schedule_timeout_uninterruptible(HZ);
-+ msleep(CCISS_POST_RESET_NOOP_TIMEOUT_MSECS);
- }
-
- iounmap(vaddr);
-@@ -4083,7 +4428,8 @@ static __devinit int cciss_message(struct pci_dev *pdev, unsigned char opcode, u
- /* we leak the DMA buffer here ... no choice since the controller could
- still complete the command. */
- if (i == 10) {
-- printk(KERN_ERR "cciss: controller message %02x:%02x timed out\n",
-+ dev_err(&pdev->dev,
-+ "controller message %02x:%02x timed out\n",
- opcode, type);
- return -ETIMEDOUT;
- }
-@@ -4091,122 +4437,439 @@ static __devinit int cciss_message(struct pci_dev *pdev, unsigned char opcode, u
- pci_free_consistent(pdev, cmd_sz, cmd, paddr64);
-
- if (tag & 2) {
-- printk(KERN_ERR "cciss: controller message %02x:%02x failed\n",
-+ dev_err(&pdev->dev, "controller message %02x:%02x failed\n",
- opcode, type);
- return -EIO;
- }
-
-- printk(KERN_INFO "cciss: controller message %02x:%02x succeeded\n",
-+ dev_info(&pdev->dev, "controller message %02x:%02x succeeded\n",
- opcode, type);
- return 0;
- }
-
--#define cciss_soft_reset_controller(p) cciss_message(p, 1, 0)
- #define cciss_noop(p) cciss_message(p, 3, 0)
-
--static __devinit int cciss_reset_msi(struct pci_dev *pdev)
-+static int cciss_controller_hard_reset(struct pci_dev *pdev,
-+ void * __iomem vaddr, u32 use_doorbell)
- {
--/* the #defines are stolen from drivers/pci/msi.h. */
--#define msi_control_reg(base) (base + PCI_MSI_FLAGS)
--#define PCI_MSIX_FLAGS_ENABLE (1 << 15)
--
-+ u16 pmcsr;
- int pos;
-- u16 control = 0;
--
-- pos = pci_find_capability(pdev, PCI_CAP_ID_MSI);
-- if (pos) {
-- pci_read_config_word(pdev, msi_control_reg(pos), &control);
-- if (control & PCI_MSI_FLAGS_ENABLE) {
-- printk(KERN_INFO "cciss: resetting MSI\n");
-- pci_write_config_word(pdev, msi_control_reg(pos), control & ~PCI_MSI_FLAGS_ENABLE);
-- }
-- }
-
-- pos = pci_find_capability(pdev, PCI_CAP_ID_MSIX);
-- if (pos) {
-- pci_read_config_word(pdev, msi_control_reg(pos), &control);
-- if (control & PCI_MSIX_FLAGS_ENABLE) {
-- printk(KERN_INFO "cciss: resetting MSI-X\n");
-- pci_write_config_word(pdev, msi_control_reg(pos), control & ~PCI_MSIX_FLAGS_ENABLE);
-+ if (use_doorbell) {
-+ /* For everything after the P600, the PCI power state method
-+ * of resetting the controller doesn't work, so we have this
-+ * other way using the doorbell register.
-+ */
-+ dev_info(&pdev->dev, "using doorbell to reset controller\n");
-+ writel(use_doorbell, vaddr + SA5_DOORBELL);
-+ } else { /* Try to do it the PCI power state way */
-+
-+ /* Quoting from the Open CISS Specification: "The Power
-+ * Management Control/Status Register (CSR) controls the power
-+ * state of the device. The normal operating state is D0,
-+ * CSR=00h. The software off state is D3, CSR=03h. To reset
-+ * the controller, place the interface device in D3 then to D0,
-+ * this causes a secondary PCI reset which will reset the
-+ * controller." */
-+
-+ pos = pci_find_capability(pdev, PCI_CAP_ID_PM);
-+ if (pos == 0) {
-+ dev_err(&pdev->dev,
-+ "cciss_controller_hard_reset: "
-+ "PCI PM not supported\n");
-+ return -ENODEV;
- }
-+ dev_info(&pdev->dev, "using PCI PM to reset controller\n");
-+ /* enter the D3hot power management state */
-+ pci_read_config_word(pdev, pos + PCI_PM_CTRL, &pmcsr);
-+ pmcsr &= ~PCI_PM_CTRL_STATE_MASK;
-+ pmcsr |= PCI_D3hot;
-+ pci_write_config_word(pdev, pos + PCI_PM_CTRL, pmcsr);
-+
-+ msleep(500);
-+
-+ /* enter the D0 power management state */
-+ pmcsr &= ~PCI_PM_CTRL_STATE_MASK;
-+ pmcsr |= PCI_D0;
-+ pci_write_config_word(pdev, pos + PCI_PM_CTRL, pmcsr);
- }
-+ return 0;
-+}
-+
-+static __devinit void init_driver_version(char *driver_version, int len)
-+{
-+ memset(driver_version, 0, len);
-+ strncpy(driver_version, "cciss " DRIVER_NAME, len - 1);
-+}
-
-+static __devinit int write_driver_ver_to_cfgtable(
-+ CfgTable_struct __iomem *cfgtable)
-+{
-+ char *driver_version;
-+ int i, size = sizeof(cfgtable->driver_version);
-+
-+ driver_version = kmalloc(size, GFP_KERNEL);
-+ if (!driver_version)
-+ return -ENOMEM;
-+
-+ init_driver_version(driver_version, size);
-+ for (i = 0; i < size; i++)
-+ writeb(driver_version[i], &cfgtable->driver_version[i]);
-+ kfree(driver_version);
- return 0;
- }
-
-+static __devinit void read_driver_ver_from_cfgtable(
-+ CfgTable_struct __iomem *cfgtable, unsigned char *driver_ver)
-+{
-+ int i;
-+
-+ for (i = 0; i < sizeof(cfgtable->driver_version); i++)
-+ driver_ver[i] = readb(&cfgtable->driver_version[i]);
-+}
-+
-+static __devinit int controller_reset_failed(
-+ CfgTable_struct __iomem *cfgtable)
-+{
-+
-+ char *driver_ver, *old_driver_ver;
-+ int rc, size = sizeof(cfgtable->driver_version);
-+
-+ old_driver_ver = kmalloc(2 * size, GFP_KERNEL);
-+ if (!old_driver_ver)
-+ return -ENOMEM;
-+ driver_ver = old_driver_ver + size;
-+
-+ /* After a reset, the 32 bytes of "driver version" in the cfgtable
-+ * should have been changed, otherwise we know the reset failed.
-+ */
-+ init_driver_version(old_driver_ver, size);
-+ read_driver_ver_from_cfgtable(cfgtable, driver_ver);
-+ rc = !memcmp(driver_ver, old_driver_ver, size);
-+ kfree(old_driver_ver);
-+ return rc;
-+}
-+
- /* This does a hard reset of the controller using PCI power management
-- * states. */
--static __devinit int cciss_hard_reset_controller(struct pci_dev *pdev)
-+ * states or using the doorbell register. */
-+static __devinit int cciss_kdump_hard_reset_controller(struct pci_dev *pdev)
- {
-- u16 pmcsr, saved_config_space[32];
-- int i, pos;
-+ u64 cfg_offset;
-+ u32 cfg_base_addr;
-+ u64 cfg_base_addr_index;
-+ void __iomem *vaddr;
-+ unsigned long paddr;
-+ u32 misc_fw_support;
-+ int rc;
-+ CfgTable_struct __iomem *cfgtable;
-+ u32 use_doorbell;
-+ u32 board_id;
-+ u16 command_register;
-
-- printk(KERN_INFO "cciss: using PCI PM to reset controller\n");
-+ /* For controllers as old a the p600, this is very nearly
-+ * the same thing as
-+ *
-+ * pci_save_state(pci_dev);
-+ * pci_set_power_state(pci_dev, PCI_D3hot);
-+ * pci_set_power_state(pci_dev, PCI_D0);
-+ * pci_restore_state(pci_dev);
-+ *
-+ * For controllers newer than the P600, the pci power state
-+ * method of resetting doesn't work so we have another way
-+ * using the doorbell register.
-+ */
-
-- /* This is very nearly the same thing as
-+ /* Exclude 640x boards. These are two pci devices in one slot
-+ * which share a battery backed cache module. One controls the
-+ * cache, the other accesses the cache through the one that controls
-+ * it. If we reset the one controlling the cache, the other will
-+ * likely not be happy. Just forbid resetting this conjoined mess.
-+ */
-+ cciss_lookup_board_id(pdev, &board_id);
-+ if (!ctlr_is_resettable(board_id)) {
-+ dev_warn(&pdev->dev, "Cannot reset Smart Array 640x "
-+ "due to shared cache module.");
-+ return -ENODEV;
-+ }
-+
-+ /* if controller is soft- but not hard resettable... */
-+ if (!ctlr_is_hard_resettable(board_id))
-+ return -ENOTSUPP; /* try soft reset later. */
-+
-+ /* Save the PCI command register */
-+ pci_read_config_word(pdev, 4, &command_register);
-+ /* Turn the board off. This is so that later pci_restore_state()
-+ * won't turn the board on before the rest of config space is ready.
-+ */
-+ pci_disable_device(pdev);
-+ pci_save_state(pdev);
-+
-+ /* find the first memory BAR, so we can find the cfg table */
-+ rc = cciss_pci_find_memory_BAR(pdev, &paddr);
-+ if (rc)
-+ return rc;
-+ vaddr = remap_pci_mem(paddr, 0x250);
-+ if (!vaddr)
-+ return -ENOMEM;
-+
-+ /* find cfgtable in order to check if reset via doorbell is supported */
-+ rc = cciss_find_cfg_addrs(pdev, vaddr, &cfg_base_addr,
-+ &cfg_base_addr_index, &cfg_offset);
-+ if (rc)
-+ goto unmap_vaddr;
-+ cfgtable = remap_pci_mem(pci_resource_start(pdev,
-+ cfg_base_addr_index) + cfg_offset, sizeof(*cfgtable));
-+ if (!cfgtable) {
-+ rc = -ENOMEM;
-+ goto unmap_vaddr;
-+ }
-+ rc = write_driver_ver_to_cfgtable(cfgtable);
-+ if (rc)
-+ goto unmap_vaddr;
-+
-+ /* If reset via doorbell register is supported, use that.
-+ * There are two such methods. Favor the newest method.
-+ */
-+ misc_fw_support = readl(&cfgtable->misc_fw_support);
-+ use_doorbell = misc_fw_support & MISC_FW_DOORBELL_RESET2;
-+ if (use_doorbell) {
-+ use_doorbell = DOORBELL_CTLR_RESET2;
-+ } else {
-+ use_doorbell = misc_fw_support & MISC_FW_DOORBELL_RESET;
-+ if (use_doorbell) {
-+ dev_warn(&pdev->dev, "Controller claims that "
-+ "'Bit 2 doorbell reset' is "
-+ "supported, but not 'bit 5 doorbell reset'. "
-+ "Firmware update is recommended.\n");
-+ rc = -ENOTSUPP; /* use the soft reset */
-+ goto unmap_cfgtable;
-+ }
-+ }
-+
-+ rc = cciss_controller_hard_reset(pdev, vaddr, use_doorbell);
-+ if (rc)
-+ goto unmap_cfgtable;
-+
-+ pci_restore_state(pdev);
-+ rc = pci_enable_device(pdev);
-+ if (rc) {
-+ dev_warn(&pdev->dev, "failed to enable device.\n");
-+ goto unmap_cfgtable;
-+ }
-+ pci_write_config_word(pdev, 4, command_register);
-+
-+ /* Some devices (notably the HP Smart Array 5i Controller)
-+ need a little pause here */
-+ msleep(CCISS_POST_RESET_PAUSE_MSECS);
-
-- pci_save_state(pci_dev);
-- pci_set_power_state(pci_dev, PCI_D3hot);
-- pci_set_power_state(pci_dev, PCI_D0);
-- pci_restore_state(pci_dev);
-+ /* Wait for board to become not ready, then ready. */
-+ dev_info(&pdev->dev, "Waiting for board to reset.\n");
-+ rc = cciss_wait_for_board_state(pdev, vaddr, BOARD_NOT_READY);
-+ if (rc) {
-+ dev_warn(&pdev->dev, "Failed waiting for board to hard reset."
-+ " Will try soft reset.\n");
-+ rc = -ENOTSUPP; /* Not expected, but try soft reset later */
-+ goto unmap_cfgtable;
-+ }
-+ rc = cciss_wait_for_board_state(pdev, vaddr, BOARD_READY);
-+ if (rc) {
-+ dev_warn(&pdev->dev,
-+ "failed waiting for board to become ready "
-+ "after hard reset\n");
-+ goto unmap_cfgtable;
-+ }
-+
-+ rc = controller_reset_failed(vaddr);
-+ if (rc < 0)
-+ goto unmap_cfgtable;
-+ if (rc) {
-+ dev_warn(&pdev->dev, "Unable to successfully hard reset "
-+ "controller. Will try soft reset.\n");
-+ rc = -ENOTSUPP; /* Not expected, but try soft reset later */
-+ } else {
-+ dev_info(&pdev->dev, "Board ready after hard reset.\n");
-+ }
-
-- but we can't use these nice canned kernel routines on
-- kexec, because they also check the MSI/MSI-X state in PCI
-- configuration space and do the wrong thing when it is
-- set/cleared. Also, the pci_save/restore_state functions
-- violate the ordering requirements for restoring the
-- configuration space from the CCISS document (see the
-- comment below). So we roll our own .... */
-+unmap_cfgtable:
-+ iounmap(cfgtable);
-+
-+unmap_vaddr:
-+ iounmap(vaddr);
-+ return rc;
-+}
-+
-+static __devinit int cciss_init_reset_devices(struct pci_dev *pdev)
-+{
-+ int rc, i;
-
-- for (i = 0; i < 32; i++)
-- pci_read_config_word(pdev, 2*i, &saved_config_space[i]);
-+ if (!reset_devices)
-+ return 0;
-
-- pos = pci_find_capability(pdev, PCI_CAP_ID_PM);
-- if (pos == 0) {
-- printk(KERN_ERR "cciss_reset_controller: PCI PM not supported\n");
-+ /* Reset the controller with a PCI power-cycle or via doorbell */
-+ rc = cciss_kdump_hard_reset_controller(pdev);
-+
-+ /* -ENOTSUPP here means we cannot reset the controller
-+ * but it's already (and still) up and running in
-+ * "performant mode". Or, it might be 640x, which can't reset
-+ * due to concerns about shared bbwc between 6402/6404 pair.
-+ */
-+ if (rc == -ENOTSUPP)
-+ return rc; /* just try to do the kdump anyhow. */
-+ if (rc)
- return -ENODEV;
-+
-+ /* Now try to get the controller to respond to a no-op */
-+ dev_warn(&pdev->dev, "Waiting for controller to respond to no-op\n");
-+ for (i = 0; i < CCISS_POST_RESET_NOOP_RETRIES; i++) {
-+ if (cciss_noop(pdev) == 0)
-+ break;
-+ else
-+ dev_warn(&pdev->dev, "no-op failed%s\n",
-+ (i < CCISS_POST_RESET_NOOP_RETRIES - 1 ?
-+ "; re-trying" : ""));
-+ msleep(CCISS_POST_RESET_NOOP_INTERVAL_MSECS);
- }
-+ return 0;
-+}
-
-- /* Quoting from the Open CISS Specification: "The Power
-- * Management Control/Status Register (CSR) controls the power
-- * state of the device. The normal operating state is D0,
-- * CSR=00h. The software off state is D3, CSR=03h. To reset
-- * the controller, place the interface device in D3 then to
-- * D0, this causes a secondary PCI reset which will reset the
-- * controller." */
--
-- /* enter the D3hot power management state */
-- pci_read_config_word(pdev, pos + PCI_PM_CTRL, &pmcsr);
-- pmcsr &= ~PCI_PM_CTRL_STATE_MASK;
-- pmcsr |= PCI_D3hot;
-- pci_write_config_word(pdev, pos + PCI_PM_CTRL, pmcsr);
--
-- schedule_timeout_uninterruptible(HZ >> 1);
--
-- /* enter the D0 power management state */
-- pmcsr &= ~PCI_PM_CTRL_STATE_MASK;
-- pmcsr |= PCI_D0;
-- pci_write_config_word(pdev, pos + PCI_PM_CTRL, pmcsr);
--
-- schedule_timeout_uninterruptible(HZ >> 1);
--
-- /* Restore the PCI configuration space. The Open CISS
-- * Specification says, "Restore the PCI Configuration
-- * Registers, offsets 00h through 60h. It is important to
-- * restore the command register, 16-bits at offset 04h,
-- * last. Do not restore the configuration status register,
-- * 16-bits at offset 06h." Note that the offset is 2*i. */
-- for (i = 0; i < 32; i++) {
-- if (i == 2 || i == 3)
-- continue;
-- pci_write_config_word(pdev, 2*i, saved_config_space[i]);
-+static __devinit int cciss_allocate_cmd_pool(ctlr_info_t *h)
-+{
-+ h->cmd_pool_bits = kmalloc(
-+ DIV_ROUND_UP(h->nr_cmds, BITS_PER_LONG) *
-+ sizeof(unsigned long), GFP_KERNEL);
-+ h->cmd_pool = pci_alloc_consistent(h->pdev,
-+ h->nr_cmds * sizeof(CommandList_struct),
-+ &(h->cmd_pool_dhandle));
-+ h->errinfo_pool = pci_alloc_consistent(h->pdev,
-+ h->nr_cmds * sizeof(ErrorInfo_struct),
-+ &(h->errinfo_pool_dhandle));
-+ if ((h->cmd_pool_bits == NULL)
-+ || (h->cmd_pool == NULL)
-+ || (h->errinfo_pool == NULL)) {
-+ dev_err(&h->pdev->dev, "out of memory");
-+ return -ENOMEM;
- }
-- wmb();
-- pci_write_config_word(pdev, 4, saved_config_space[2]);
-+ return 0;
-+}
-
-+static __devinit int cciss_allocate_scatterlists(ctlr_info_t *h)
-+{
-+ int i;
-+
-+ /* zero it, so that on free we need not know how many were alloc'ed */
-+ h->scatter_list = kzalloc(h->max_commands *
-+ sizeof(struct scatterlist *), GFP_KERNEL);
-+ if (!h->scatter_list)
-+ return -ENOMEM;
-+
-+ for (i = 0; i < h->nr_cmds; i++) {
-+ h->scatter_list[i] = kmalloc(sizeof(struct scatterlist) *
-+ h->maxsgentries, GFP_KERNEL);
-+ if (h->scatter_list[i] == NULL) {
-+ dev_err(&h->pdev->dev, "could not allocate "
-+ "s/g lists\n");
-+ return -ENOMEM;
-+ }
-+ }
- return 0;
- }
-
-+static void cciss_free_scatterlists(ctlr_info_t *h)
-+{
-+ int i;
-+
-+ if (h->scatter_list) {
-+ for (i = 0; i < h->nr_cmds; i++)
-+ kfree(h->scatter_list[i]);
-+ kfree(h->scatter_list);
-+ }
-+}
-+
-+static void cciss_free_cmd_pool(ctlr_info_t *h)
-+{
-+ kfree(h->cmd_pool_bits);
-+ if (h->cmd_pool)
-+ pci_free_consistent(h->pdev,
-+ h->nr_cmds * sizeof(CommandList_struct),
-+ h->cmd_pool, h->cmd_pool_dhandle);
-+ if (h->errinfo_pool)
-+ pci_free_consistent(h->pdev,
-+ h->nr_cmds * sizeof(ErrorInfo_struct),
-+ h->errinfo_pool, h->errinfo_pool_dhandle);
-+}
-+
-+static int cciss_request_irq(ctlr_info_t *h,
-+ irqreturn_t (*msixhandler)(int, void *),
-+ irqreturn_t (*intxhandler)(int, void *))
-+{
-+ if (h->msix_vector || h->msi_vector) {
-+ if (!request_irq(h->intr[h->intr_mode], msixhandler,
-+ IRQF_DISABLED, h->devname, h))
-+ return 0;
-+ dev_err(&h->pdev->dev, "Unable to get msi irq %d"
-+ " for %s\n", h->intr[h->intr_mode],
-+ h->devname);
-+ return -1;
-+ }
-+
-+ if (!request_irq(h->intr[h->intr_mode], intxhandler,
-+ IRQF_DISABLED | IRQF_SHARED, h->devname, h))
-+ return 0;
-+ dev_err(&h->pdev->dev, "Unable to get irq %d for %s\n",
-+ h->intr[h->intr_mode], h->devname);
-+ return -1;
-+}
-+
-+static int __devinit cciss_kdump_soft_reset(ctlr_info_t *h)
-+{
-+ if (cciss_send_reset(h, CTLR_LUNID, CCISS_RESET_TYPE_CONTROLLER)) {
-+ dev_warn(&h->pdev->dev, "Resetting array controller failed.\n");
-+ return -EIO;
-+ }
-+
-+ dev_info(&h->pdev->dev, "Waiting for board to soft reset.\n");
-+ if (cciss_wait_for_board_state(h->pdev, h->vaddr, BOARD_NOT_READY)) {
-+ dev_warn(&h->pdev->dev, "Soft reset had no effect.\n");
-+ return -1;
-+ }
-+
-+ dev_info(&h->pdev->dev, "Board reset, awaiting READY status.\n");
-+ if (cciss_wait_for_board_state(h->pdev, h->vaddr, BOARD_READY)) {
-+ dev_warn(&h->pdev->dev, "Board failed to become ready "
-+ "after soft reset.\n");
-+ return -1;
-+ }
-+
-+ return 0;
-+}
-+
-+static void cciss_undo_allocations_after_kdump_soft_reset(ctlr_info_t *h)
-+{
-+ int ctlr = h->ctlr;
-+
-+ free_irq(h->intr[h->intr_mode], h);
-+#ifdef CONFIG_PCI_MSI
-+ if (h->msix_vector)
-+ pci_disable_msix(h->pdev);
-+ else if (h->msi_vector)
-+ pci_disable_msi(h->pdev);
-+#endif /* CONFIG_PCI_MSI */
-+ cciss_free_sg_chain_blocks(h->cmd_sg_list, h->nr_cmds);
-+ cciss_free_scatterlists(h);
-+ cciss_free_cmd_pool(h);
-+ if (h->transtable)
-+ iounmap(h->transtable);
-+ if (h->cfgtable)
-+ iounmap(h->cfgtable);
-+ if (h->vaddr)
-+ iounmap(h->vaddr);
-+ unregister_blkdev(h->major, h->devname);
-+ cciss_destroy_hba_sysfs_entry(h);
-+ pci_release_regions(h->pdev);
-+ kfree(h);
-+ hba[ctlr] = NULL;
-+}
-+
- /*
- * This is it. Find all the controllers and register them. I really hate
- * stealing all these major device numbers.
-@@ -4218,48 +4881,51 @@ static int __devinit cciss_init_one(struct pci_dev *pdev,
- int i;
- int j = 0;
- int rc;
-+ int try_soft_reset = 0;
- int dac, return_code;
- InquiryData_struct *inq_buff;
-+ ctlr_info_t *h;
-+ unsigned long flags;
-
-- if (reset_devices) {
-- /* Reset the controller with a PCI power-cycle */
-- if (cciss_hard_reset_controller(pdev) || cciss_reset_msi(pdev))
-- return -ENODEV;
--
-- /* Now try to get the controller to respond to a no-op. Some
-- devices (notably the HP Smart Array 5i Controller) need
-- up to 30 seconds to respond. */
-- for (i=0; i<30; i++) {
-- if (cciss_noop(pdev) == 0)
-- break;
--
-- schedule_timeout_uninterruptible(HZ);
-- }
-- if (i == 30) {
-- printk(KERN_ERR "cciss: controller seems dead\n");
-- return -EBUSY;
-- }
-+ rc = cciss_init_reset_devices(pdev);
-+ if (rc) {
-+ if (rc != -ENOTSUPP)
-+ return rc;
-+ /* If the reset fails in a particular way (it has no way to do
-+ * a proper hard reset, so returns -ENOTSUPP) we can try to do
-+ * a soft reset once we get the controller configured up to the
-+ * point that it can accept a command.
-+ */
-+ try_soft_reset = 1;
-+ rc = 0;
- }
-
-- i = alloc_cciss_hba();
-+reinit_after_soft_reset:
-+
-+ i = alloc_cciss_hba(pdev);
- if (i < 0)
- return -1;
-
-- hba[i]->busy_initializing = 1;
-- INIT_HLIST_HEAD(&hba[i]->cmpQ);
-- INIT_HLIST_HEAD(&hba[i]->reqQ);
-- mutex_init(&hba[i]->busy_shutting_down);
-+ h = hba[i];
-+ h->pdev = pdev;
-+ h->busy_initializing = 1;
-+ h->intr_mode = cciss_simple_mode ? SIMPLE_MODE_INT : PERF_MODE_INT;
-+ INIT_LIST_HEAD(&h->cmpQ);
-+ INIT_LIST_HEAD(&h->reqQ);
-+ mutex_init(&h->busy_shutting_down);
-
-- if (cciss_pci_init(hba[i], pdev) != 0)
-+ sprintf(h->devname, "cciss%d", i);
-+ h->ctlr = i;
-+
-+ if (cciss_tape_cmds < 2)
-+ cciss_tape_cmds = 2;
-+ if (cciss_tape_cmds > 16)
-+ cciss_tape_cmds = 16;
-+
-+ if (cciss_pci_init(h) != 0)
- goto clean_no_release_regions;
-
-- sprintf(hba[i]->devname, "cciss%d", i);
-- hba[i]->ctlr = i;
-- hba[i]->pdev = pdev;
--
-- init_completion(&hba[i]->scan_wait);
--
-- if (cciss_create_hba_sysfs_entry(hba[i]))
-+ if (cciss_create_hba_sysfs_entry(h))
- goto clean0;
-
- /* configure PCI DMA stuff */
-@@ -4268,7 +4934,7 @@ static int __devinit cciss_init_one(struct pci_dev *pdev,
- else if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(32)))
- dac = 0;
- else {
-- printk(KERN_ERR "cciss: no suitable DMA available\n");
-+ dev_err(&h->pdev->dev, "no suitable DMA available\n");
- goto clean1;
- }
-
-@@ -4278,189 +4944,244 @@ static int __devinit cciss_init_one(struct pci_dev *pdev,
- * 8 controller support.
- */
- if (i < MAX_CTLR_ORIG)
-- hba[i]->major = COMPAQ_CISS_MAJOR + i;
-- rc = register_blkdev(hba[i]->major, hba[i]->devname);
-+ h->major = COMPAQ_CISS_MAJOR + i;
-+ rc = register_blkdev(h->major, h->devname);
- if (rc == -EBUSY || rc == -EINVAL) {
-- printk(KERN_ERR
-- "cciss: Unable to get major number %d for %s "
-- "on hba %d\n", hba[i]->major, hba[i]->devname, i);
-+ dev_err(&h->pdev->dev,
-+ "Unable to get major number %d for %s "
-+ "on hba %d\n", h->major, h->devname, i);
- goto clean1;
- } else {
- if (i >= MAX_CTLR_ORIG)
-- hba[i]->major = rc;
-+ h->major = rc;
- }
-
- /* make sure the board interrupts are off */
-- hba[i]->access.set_intr_mask(hba[i], CCISS_INTR_OFF);
-- if (request_irq(hba[i]->intr[SIMPLE_MODE_INT], do_cciss_intr,
-- IRQF_DISABLED | IRQF_SHARED, hba[i]->devname, hba[i])) {
-- printk(KERN_ERR "cciss: Unable to get irq %d for %s\n",
-- hba[i]->intr[SIMPLE_MODE_INT], hba[i]->devname);
-+ h->access->set_intr_mask(h, CCISS_INTR_OFF);
-+ rc = cciss_request_irq(h, do_cciss_msix_intr, do_cciss_intx);
-+ if (rc)
- goto clean2;
-- }
-
-- printk(KERN_INFO "%s: <0x%x> at PCI %s IRQ %d%s using DAC\n",
-- hba[i]->devname, pdev->device, pci_name(pdev),
-- hba[i]->intr[SIMPLE_MODE_INT], dac ? "" : " not");
-+ dev_info(&h->pdev->dev, "%s: <0x%x> at PCI %s IRQ %d%s using DAC\n",
-+ h->devname, pdev->device, pci_name(pdev),
-+ h->intr[h->intr_mode], dac ? "" : " not");
-
-- hba[i]->cmd_pool_bits =
-- kmalloc(DIV_ROUND_UP(hba[i]->nr_cmds, BITS_PER_LONG)
-- * sizeof(unsigned long), GFP_KERNEL);
-- hba[i]->cmd_pool = (CommandList_struct *)
-- pci_alloc_consistent(hba[i]->pdev,
-- hba[i]->nr_cmds * sizeof(CommandList_struct),
-- &(hba[i]->cmd_pool_dhandle));
-- hba[i]->errinfo_pool = (ErrorInfo_struct *)
-- pci_alloc_consistent(hba[i]->pdev,
-- hba[i]->nr_cmds * sizeof(ErrorInfo_struct),
-- &(hba[i]->errinfo_pool_dhandle));
-- if ((hba[i]->cmd_pool_bits == NULL)
-- || (hba[i]->cmd_pool == NULL)
-- || (hba[i]->errinfo_pool == NULL)) {
-- printk(KERN_ERR "cciss: out of memory");
-+ if (cciss_allocate_cmd_pool(h))
- goto clean4;
-- }
-- spin_lock_init(&hba[i]->lock);
-+
-+ if (cciss_allocate_scatterlists(h))
-+ goto clean4;
-+
-+ h->cmd_sg_list = cciss_allocate_sg_chain_blocks(h,
-+ h->chainsize, h->nr_cmds);
-+ if (!h->cmd_sg_list && h->chainsize > 0)
-+ goto clean4;
-+
-+ spin_lock_init(&h->lock);
-
- /* Initialize the pdev driver private data.
-- have it point to hba[i]. */
-- pci_set_drvdata(pdev, hba[i]);
-+ have it point to h. */
-+ pci_set_drvdata(pdev, h);
- /* command and error info recs zeroed out before
- they are used */
-- memset(hba[i]->cmd_pool_bits, 0,
-- DIV_ROUND_UP(hba[i]->nr_cmds, BITS_PER_LONG)
-+ memset(h->cmd_pool_bits, 0,
-+ DIV_ROUND_UP(h->nr_cmds, BITS_PER_LONG)
- * sizeof(unsigned long));
-
-- hba[i]->num_luns = 0;
-- hba[i]->highest_lun = -1;
-+ h->num_luns = 0;
-+ h->highest_lun = -1;
- for (j = 0; j < CISS_MAX_LUN; j++) {
-- hba[i]->drv[j] = NULL;
-- hba[i]->gendisk[j] = NULL;
-+ h->drv[j] = NULL;
-+ h->gendisk[j] = NULL;
- }
-
-- cciss_scsi_setup(i);
-+ /* At this point, the controller is ready to take commands.
-+ * Now, if reset_devices and the hard reset didn't work, try
-+ * the soft reset and see if that works.
-+ */
-+ if (try_soft_reset) {
-+
-+ /* This is kind of gross. We may or may not get a completion
-+ * from the soft reset command, and if we do, then the value
-+ * from the fifo may or may not be valid. So, we wait 10 secs
-+ * after the reset throwing away any completions we get during
-+ * that time. Unregister the interrupt handler and register
-+ * fake ones to scoop up any residual completions.
-+ */
-+ spin_lock_irqsave(&h->lock, flags);
-+ h->access->set_intr_mask(h, CCISS_INTR_OFF);
-+ spin_unlock_irqrestore(&h->lock, flags);
-+ free_irq(h->intr[h->intr_mode], h);
-+ rc = cciss_request_irq(h, cciss_msix_discard_completions,
-+ cciss_intx_discard_completions);
-+ if (rc) {
-+ dev_warn(&h->pdev->dev, "Failed to request_irq after "
-+ "soft reset.\n");
-+ goto clean4;
-+ }
-+
-+ rc = cciss_kdump_soft_reset(h);
-+ if (rc) {
-+ dev_warn(&h->pdev->dev, "Soft reset failed.\n");
-+ goto clean4;
-+ }
-+
-+ dev_info(&h->pdev->dev, "Board READY.\n");
-+ dev_info(&h->pdev->dev,
-+ "Waiting for stale completions to drain.\n");
-+ h->access->set_intr_mask(h, CCISS_INTR_ON);
-+ msleep(10000);
-+ h->access->set_intr_mask(h, CCISS_INTR_OFF);
-+
-+ rc = controller_reset_failed(h->cfgtable);
-+ if (rc)
-+ dev_info(&h->pdev->dev,
-+ "Soft reset appears to have failed.\n");
-+
-+ /* since the controller's reset, we have to go back and re-init
-+ * everything. Easiest to just forget what we've done and do it
-+ * all over again.
-+ */
-+ cciss_undo_allocations_after_kdump_soft_reset(h);
-+ try_soft_reset = 0;
-+ if (rc)
-+ /* don't go to clean4, we already unallocated */
-+ return -ENODEV;
-+
-+ goto reinit_after_soft_reset;
-+ }
-+
-+ cciss_scsi_setup(h);
-
- /* Turn the interrupts on so we can service requests */
-- hba[i]->access.set_intr_mask(hba[i], CCISS_INTR_ON);
-+ h->access->set_intr_mask(h, CCISS_INTR_ON);
-
- /* Get the firmware version */
- inq_buff = kzalloc(sizeof(InquiryData_struct), GFP_KERNEL);
- if (inq_buff == NULL) {
-- printk(KERN_ERR "cciss: out of memory\n");
-+ dev_err(&h->pdev->dev, "out of memory\n");
- goto clean4;
- }
-
-- return_code = sendcmd_withirq(CISS_INQUIRY, i, inq_buff,
-+ return_code = sendcmd_withirq(h, CISS_INQUIRY, inq_buff,
- sizeof(InquiryData_struct), 0, CTLR_LUNID, TYPE_CMD);
- if (return_code == IO_OK) {
-- hba[i]->firm_ver[0] = inq_buff->data_byte[32];
-- hba[i]->firm_ver[1] = inq_buff->data_byte[33];
-- hba[i]->firm_ver[2] = inq_buff->data_byte[34];
-- hba[i]->firm_ver[3] = inq_buff->data_byte[35];
-+ h->firm_ver[0] = inq_buff->data_byte[32];
-+ h->firm_ver[1] = inq_buff->data_byte[33];
-+ h->firm_ver[2] = inq_buff->data_byte[34];
-+ h->firm_ver[3] = inq_buff->data_byte[35];
- } else { /* send command failed */
-- printk(KERN_WARNING "cciss: unable to determine firmware"
-+ dev_warn(&h->pdev->dev, "unable to determine firmware"
- " version of controller\n");
- }
- kfree(inq_buff);
-
-- cciss_procinit(i);
-+ cciss_procinit(h);
-
-- hba[i]->cciss_max_sectors = 2048;
-+ h->cciss_max_sectors = 8192;
-
-- rebuild_lun_table(hba[i], 1, 0);
-- hba[i]->busy_initializing = 0;
-+ rebuild_lun_table(h, 1, 0);
-+ cciss_engage_scsi(h);
-+ h->busy_initializing = 0;
- return 1;
-
- clean4:
-- kfree(hba[i]->cmd_pool_bits);
-- if (hba[i]->cmd_pool)
-- pci_free_consistent(hba[i]->pdev,
-- hba[i]->nr_cmds * sizeof(CommandList_struct),
-- hba[i]->cmd_pool, hba[i]->cmd_pool_dhandle);
-- if (hba[i]->errinfo_pool)
-- pci_free_consistent(hba[i]->pdev,
-- hba[i]->nr_cmds * sizeof(ErrorInfo_struct),
-- hba[i]->errinfo_pool,
-- hba[i]->errinfo_pool_dhandle);
-- free_irq(hba[i]->intr[SIMPLE_MODE_INT], hba[i]);
-+ cciss_free_cmd_pool(h);
-+ cciss_free_scatterlists(h);
-+ cciss_free_sg_chain_blocks(h->cmd_sg_list, h->nr_cmds);
-+ free_irq(h->intr[h->intr_mode], h);
- clean2:
-- unregister_blkdev(hba[i]->major, hba[i]->devname);
-+ unregister_blkdev(h->major, h->devname);
- clean1:
-- cciss_destroy_hba_sysfs_entry(hba[i]);
-+ cciss_destroy_hba_sysfs_entry(h);
- clean0:
- pci_release_regions(pdev);
- clean_no_release_regions:
-- hba[i]->busy_initializing = 0;
-+ h->busy_initializing = 0;
-
- /*
- * Deliberately omit pci_disable_device(): it does something nasty to
- * Smart Array controllers that pci_enable_device does not undo
- */
- pci_set_drvdata(pdev, NULL);
-- free_hba(i);
-+ free_hba(h);
- return -1;
- }
-
- static void cciss_shutdown(struct pci_dev *pdev)
- {
-- ctlr_info_t *tmp_ptr;
-- int i;
-- char flush_buf[4];
-+ ctlr_info_t *h;
-+ char *flush_buf;
- int return_code;
-
-- tmp_ptr = pci_get_drvdata(pdev);
-- if (tmp_ptr == NULL)
-+ h = pci_get_drvdata(pdev);
-+ flush_buf = kzalloc(4, GFP_KERNEL);
-+ if (!flush_buf) {
-+ dev_warn(&h->pdev->dev, "cache not flushed, out of memory.\n");
- return;
-- i = tmp_ptr->ctlr;
-- if (hba[i] == NULL)
-- return;
--
-- /* Turn board interrupts off and send the flush cache command */
-- /* sendcmd will turn off interrupt, and send the flush...
-- * To write all data in the battery backed cache to disks */
-+ }
-+ /* write all data in the battery backed cache to disk */
- memset(flush_buf, 0, 4);
-- return_code = sendcmd(CCISS_CACHE_FLUSH, i, flush_buf, 4, 0,
-- CTLR_LUNID, TYPE_CMD);
-- if (return_code == IO_OK) {
-- printk(KERN_INFO "Completed flushing cache on controller %d\n", i);
-- } else {
-- printk(KERN_WARNING "Error flushing cache on controller %d\n", i);
-+ return_code = sendcmd_withirq(h, CCISS_CACHE_FLUSH, flush_buf,
-+ 4, 0, CTLR_LUNID, TYPE_CMD);
-+ kfree(flush_buf);
-+ if (return_code != IO_OK)
-+ dev_warn(&h->pdev->dev, "Error flushing cache\n");
-+ h->access->set_intr_mask(h, CCISS_INTR_OFF);
-+ free_irq(h->intr[h->intr_mode], h);
-+}
-+
-+static int __devinit cciss_enter_simple_mode(struct ctlr_info *h)
-+{
-+ u32 trans_support;
-+
-+ trans_support = readl(&(h->cfgtable->TransportSupport));
-+ if (!(trans_support & SIMPLE_MODE))
-+ return -ENOTSUPP;
-+
-+ h->max_commands = readl(&(h->cfgtable->CmdsOutMax));
-+ writel(CFGTBL_Trans_Simple, &(h->cfgtable->HostWrite.TransportRequest));
-+ writel(CFGTBL_ChangeReq, h->vaddr + SA5_DOORBELL);
-+ cciss_wait_for_mode_change_ack(h);
-+ print_cfg_table(h);
-+ if (!(readl(&(h->cfgtable->TransportActive)) & CFGTBL_Trans_Simple)) {
-+ dev_warn(&h->pdev->dev, "unable to get board into simple mode\n");
-+ return -ENODEV;
- }
-- free_irq(hba[i]->intr[2], hba[i]);
-+ h->transMethod = CFGTBL_Trans_Simple;
-+ return 0;
- }
-
-+
- static void __devexit cciss_remove_one(struct pci_dev *pdev)
- {
-- ctlr_info_t *tmp_ptr;
-+ ctlr_info_t *h;
- int i, j;
-
- if (pci_get_drvdata(pdev) == NULL) {
-- printk(KERN_ERR "cciss: Unable to remove device \n");
-+ dev_err(&pdev->dev, "Unable to remove device\n");
- return;
- }
-
-- tmp_ptr = pci_get_drvdata(pdev);
-- i = tmp_ptr->ctlr;
-+ h = pci_get_drvdata(pdev);
-+ i = h->ctlr;
- if (hba[i] == NULL) {
-- printk(KERN_ERR "cciss: device appears to "
-- "already be removed \n");
-+ dev_err(&pdev->dev, "device appears to already be removed \n");
- return;
- }
-
-- mutex_lock(&hba[i]->busy_shutting_down);
--
-- remove_from_scan_list(hba[i]);
-- remove_proc_entry(hba[i]->devname, proc_cciss);
-- unregister_blkdev(hba[i]->major, hba[i]->devname);
-+ mutex_lock(&h->busy_shutting_down);
-+ remove_proc_entry(h->devname, proc_cciss);
-+ unregister_blkdev(h->major, h->devname);
-
- /* remove it from the disk list */
- for (j = 0; j < CISS_MAX_LUN; j++) {
-- struct gendisk *disk = hba[i]->gendisk[j];
-+ struct gendisk *disk = h->gendisk[j];
- if (disk) {
- struct request_queue *q = disk->queue;
-
- if (disk->flags & GENHD_FL_UP) {
-- cciss_destroy_ld_sysfs_entry(hba[i], j, 1);
-+ cciss_destroy_ld_sysfs_entry(h, j, 1);
- del_gendisk(disk);
- }
- if (q)
-@@ -4469,34 +5190,41 @@ static void __devexit cciss_remove_one(struct pci_dev *pdev)
- }
-
- #ifdef CONFIG_CISS_SCSI_TAPE
-- cciss_unregister_scsi(i); /* unhook from SCSI subsystem */
-+ cciss_unregister_scsi(h); /* unhook from SCSI subsystem */
- #endif
-
- cciss_shutdown(pdev);
-
- #ifdef CONFIG_PCI_MSI
-- if (hba[i]->msix_vector)
-- pci_disable_msix(hba[i]->pdev);
-- else if (hba[i]->msi_vector)
-- pci_disable_msi(hba[i]->pdev);
-+ if (h->msix_vector)
-+ pci_disable_msix(h->pdev);
-+ else if (h->msi_vector)
-+ pci_disable_msi(h->pdev);
- #endif /* CONFIG_PCI_MSI */
-
-- iounmap(hba[i]->vaddr);
-+ iounmap(h->transtable);
-+ iounmap(h->cfgtable);
-+ iounmap(h->vaddr);
-
-- pci_free_consistent(hba[i]->pdev, hba[i]->nr_cmds * sizeof(CommandList_struct),
-- hba[i]->cmd_pool, hba[i]->cmd_pool_dhandle);
-- pci_free_consistent(hba[i]->pdev, hba[i]->nr_cmds * sizeof(ErrorInfo_struct),
-- hba[i]->errinfo_pool, hba[i]->errinfo_pool_dhandle);
-- kfree(hba[i]->cmd_pool_bits);
-+ cciss_free_cmd_pool(h);
-+ /* Free up sg elements */
-+ for (j = 0; j < h->nr_cmds; j++)
-+ kfree(h->scatter_list[j]);
-+ kfree(h->scatter_list);
-+ cciss_free_sg_chain_blocks(h->cmd_sg_list, h->nr_cmds);
-+ kfree(h->blockFetchTable);
-+ if (h->reply_pool)
-+ pci_free_consistent(h->pdev, h->max_commands * sizeof(__u64),
-+ h->reply_pool, h->reply_pool_dhandle);
- /*
- * Deliberately omit pci_disable_device(): it does something nasty to
- * Smart Array controllers that pci_enable_device does not undo
- */
- pci_release_regions(pdev);
- pci_set_drvdata(pdev, NULL);
-- cciss_destroy_hba_sysfs_entry(hba[i]);
-- mutex_unlock(&hba[i]->busy_shutting_down);
-- free_hba(i);
-+ cciss_destroy_hba_sysfs_entry(h);
-+ mutex_unlock(&h->busy_shutting_down);
-+ free_hba(h);
- }
-
- static struct pci_driver cciss_pci_driver = {
-@@ -4520,33 +5248,21 @@ static int __init cciss_init(void)
- * boundary. Given that we use pci_alloc_consistent() to allocate an
- * array of them, the size must be a multiple of 8 bytes.
- */
-- BUILD_BUG_ON(sizeof(CommandList_struct) % 8);
--
-+ BUILD_BUG_ON(sizeof(CommandList_struct) % COMMANDLIST_ALIGNMENT);
- printk(KERN_INFO DRIVER_NAME "\n");
-
- err = bus_register(&cciss_bus_type);
- if (err)
- return err;
-
-- /* Start the scan thread */
-- cciss_scan_thread = kthread_run(scan_thread, NULL, "cciss_scan");
-- if (IS_ERR(cciss_scan_thread)) {
-- err = PTR_ERR(cciss_scan_thread);
-- goto err_bus_unregister;
-- }
--
- /* Register for our PCI devices */
- err = pci_register_driver(&cciss_pci_driver);
- if (err)
-- goto err_thread_stop;
--
-+ goto err_bus_unregister;
- return err;
-
--err_thread_stop:
-- kthread_stop(cciss_scan_thread);
- err_bus_unregister:
- bus_unregister(&cciss_bus_type);
--
- return err;
- }
-
-@@ -4558,55 +5274,55 @@ static void __exit cciss_cleanup(void)
- /* double check that all controller entrys have been removed */
- for (i = 0; i < MAX_CTLR; i++) {
- if (hba[i] != NULL) {
-- printk(KERN_WARNING "cciss: had to remove"
-- " controller %d\n", i);
-+ dev_warn(&hba[i]->pdev->dev,
-+ "had to remove controller\n");
- cciss_remove_one(hba[i]->pdev);
- }
- }
-- kthread_stop(cciss_scan_thread);
-- remove_proc_entry("driver/cciss", NULL);
-+ if (proc_cciss)
-+ remove_proc_entry("driver/cciss", NULL);
- bus_unregister(&cciss_bus_type);
- }
-
--static void fail_all_cmds(unsigned long ctlr)
-+static void cciss_sysfs_stat_inquiry(ctlr_info_t *h, int logvol,
-+ drive_info_struct *drv)
- {
-- /* If we get here, the board is apparently dead. */
-- ctlr_info_t *h = hba[ctlr];
-- CommandList_struct *c;
-- unsigned long flags;
-+ int return_code;
-+ InquiryData_struct *inq_buff;
-+ unsigned char scsi3addr[8];
-
-- printk(KERN_WARNING "cciss%d: controller not responding.\n", h->ctlr);
-- h->alive = 0; /* the controller apparently died... */
-+ /* If there are no heads then this is the controller disk and
-+ * not a valid logical drive so don't query it.
-+ */
-+ if (!drv->heads)
-+ return;
-
-- spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
--
-- pci_disable_device(h->pdev); /* Make sure it is really dead. */
--
-- /* move everything off the request queue onto the completed queue */
-- while (!hlist_empty(&h->reqQ)) {
-- c = hlist_entry(h->reqQ.first, CommandList_struct, list);
-- removeQ(c);
-- h->Qdepth--;
-- addQ(&h->cmpQ, c);
-+ inq_buff = kzalloc(sizeof(InquiryData_struct), GFP_KERNEL);
-+ if (!inq_buff) {
-+ dev_err(&h->pdev->dev, "out of memory\n");
-+ goto err;
- }
--
-- /* Now, fail everything on the completed queue with a HW error */
-- while (!hlist_empty(&h->cmpQ)) {
-- c = hlist_entry(h->cmpQ.first, CommandList_struct, list);
-- removeQ(c);
-- if (c->cmd_type != CMD_MSG_STALE)
-- c->err_info->CommandStatus = CMD_HARDWARE_ERR;
-- if (c->cmd_type == CMD_RWREQ) {
-- complete_command(h, c, 0);
-- } else if (c->cmd_type == CMD_IOCTL_PEND)
-- complete(c->waiting);
--#ifdef CONFIG_CISS_SCSI_TAPE
-- else if (c->cmd_type == CMD_SCSI)
-- complete_scsi_command(c, 0, 0);
--#endif
-+ log_unit_to_scsi3addr(h, scsi3addr, logvol);
-+ return_code = sendcmd_withirq(h, CISS_INQUIRY, inq_buff, sizeof(*inq_buff), 0,
-+ scsi3addr, TYPE_CMD);
-+ if (return_code == IO_OK) {
-+ memcpy(drv->vendor, &inq_buff->data_byte[8], 8);
-+ drv->vendor[8]='\0';
-+ memcpy(drv->model, &inq_buff->data_byte[16], 16);
-+ drv->model[16] = '\0';
-+ memcpy(drv->rev, &inq_buff->data_byte[32], 4);
-+ drv->rev[4] = '\0';
-+ } else { /* Get geometry failed */
-+ dev_warn(&h->pdev->dev, "inquiry for VPD page 0 failed\n");
- }
-- spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
-- return;
-+ kfree(inq_buff);
-+ cciss_get_uid(h, logvol, drv->uid, sizeof(drv->uid));
-+
-+err:
-+ drv->vendor[8] = '\0';
-+ drv->model[16] = '\0';
-+ drv->rev[4] = '\0';
-+
- }
-
- module_init(cciss_init);
-diff --git a/drivers/block/cciss.h b/drivers/block/cciss.h
-index 04d6bf8..ad6d020 100644
---- a/drivers/block/cciss.h
-+++ b/drivers/block/cciss.h
-@@ -25,12 +25,13 @@ struct access_method {
- void (*submit_command)(ctlr_info_t *h, CommandList_struct *c);
- void (*set_intr_mask)(ctlr_info_t *h, unsigned long val);
- unsigned long (*fifo_full)(ctlr_info_t *h);
-- unsigned long (*intr_pending)(ctlr_info_t *h);
-+ bool (*intr_pending)(ctlr_info_t *h);
- unsigned long (*command_completed)(ctlr_info_t *h);
- };
- typedef struct _drive_info_struct
- {
-- unsigned char LunID[8];
-+ unsigned char LunID[8];
-+#define CCISS_HBA_LUNID "\0\0\0\0\0\0\0\0"
- int usage_count;
- struct request_queue *queue;
- sector_t nr_blocks;
-@@ -40,27 +41,31 @@ typedef struct _drive_info_struct
- int cylinders;
- int raid_level; /* set to -1 to indicate that
- * the drive is not in use/configured
-- */
-- int busy_configuring; /* This is set when a drive is being removed
-- * to prevent it from being opened or it's
-- * queue from being started.
-- */
-- struct device dev;
-- __u8 serial_no[16]; /* from inquiry page 0x83,
-- * not necc. null terminated.
-- */
-+ */
-+ int busy_configuring; /*This is set when the drive is being removed
-+ *to prevent it from being opened or it's queue
-+ *from being started.
-+ */
-+ struct device dev;
-+ __u8 uid[16]; /* from inquiry page 0x83, */
-+ /* not necc. null terminated. */
- char vendor[VENDOR_LEN + 1]; /* SCSI vendor string */
- char model[MODEL_LEN + 1]; /* SCSI model string */
- char rev[REV_LEN + 1]; /* SCSI revision string */
- char device_initialized; /* indicates whether dev is initialized */
- } drive_info_struct;
-
--struct ctlr_info
-+struct Cmd_sg_list {
-+ dma_addr_t sg_chain_dma;
-+ int chain_block_size;
-+};
-+
-+struct ctlr_info
- {
- int ctlr;
- char devname[8];
- char *product_name;
-- char firm_ver[4]; // Firmware version
-+ char firm_ver[4]; /* Firmware version */
- struct pci_dev *pdev;
- __u32 board_id;
- void __iomem *vaddr;
-@@ -71,68 +76,91 @@ struct ctlr_info
- int major;
- int max_commands;
- int commands_outstanding;
-- int max_outstanding; /* Debug */
-+ int max_outstanding; /* Debug */
- int num_luns;
- int highest_lun;
- int usage_count; /* number of opens all all minor devices */
--# define DOORBELL_INT 0
--# define PERF_MODE_INT 1
-+ /* Need space for temp sg list
-+ * number of scatter/gathers supported
-+ * number of scatter/gathers in chained block
-+ */
-+ struct scatterlist **scatter_list;
-+ int maxsgentries;
-+ int chainsize;
-+ int max_cmd_sgentries;
-+ SGDescriptor_struct **cmd_sg_list;
-+
-+# define PERF_MODE_INT 0
-+# define DOORBELL_INT 1
- # define SIMPLE_MODE_INT 2
- # define MEMQ_MODE_INT 3
- unsigned int intr[4];
- unsigned int msix_vector;
- unsigned int msi_vector;
-+ int intr_mode;
- int cciss_max_sectors;
- BYTE cciss_read;
- BYTE cciss_write;
- BYTE cciss_read_capacity;
-
-- // information about each logical volume
-+ /* information about each logical volume */
- drive_info_struct *drv[CISS_MAX_LUN];
-
-- struct access_method access;
-+ struct access_method *access;
-
-- /* queue and queue Info */
-- struct hlist_head reqQ;
-- struct hlist_head cmpQ;
-+ /* queue and queue Info */
-+ struct list_head reqQ;
-+ struct list_head cmpQ;
- unsigned int Qdepth;
- unsigned int maxQsinceinit;
- unsigned int maxSG;
- spinlock_t lock;
-
-- //* pointers to command and error info pool */
-+ /* pointers to command and error info pool */
- CommandList_struct *cmd_pool;
-- dma_addr_t cmd_pool_dhandle;
-+ dma_addr_t cmd_pool_dhandle;
- ErrorInfo_struct *errinfo_pool;
-- dma_addr_t errinfo_pool_dhandle;
-+ dma_addr_t errinfo_pool_dhandle;
- unsigned long *cmd_pool_bits;
- int nr_allocs;
-- int nr_frees;
-+ int nr_frees;
- int busy_configuring;
- int busy_initializing;
-- int busy_scanning;
-- struct mutex busy_shutting_down;
-+ struct mutex busy_shutting_down;
-
- /* This element holds the zero based queue number of the last
- * queue to be started. It is used for fairness.
- */
- int next_to_run;
-
-- // Disk structures we need to pass back
-+ /* Disk structures we need to pass back */
- struct gendisk *gendisk[CISS_MAX_LUN];
- #ifdef CONFIG_CISS_SCSI_TAPE
-- void *scsi_ctlr; /* ptr to structure containing scsi related stuff */
-- /* list of block side commands the scsi error handling sucked up */
-- /* and saved for later processing */
-+ struct cciss_scsi_adapter_data_t *scsi_ctlr;
- #endif
- unsigned char alive;
-- struct list_head scan_list;
-- struct completion scan_wait;
- struct device dev;
-+ /*
-+ * Performant mode tables.
-+ */
-+ u32 trans_support;
-+ u32 trans_offset;
-+ struct TransTable_struct *transtable;
-+ unsigned long transMethod;
-+
-+ /*
-+ * Performant mode completion buffer
-+ */
-+ u64 *reply_pool;
-+ dma_addr_t reply_pool_dhandle;
-+ u64 *reply_pool_head;
-+ size_t reply_pool_size;
-+ unsigned char reply_pool_wraparound;
-+ u32 *blockFetchTable;
- };
-
--/* Defining the diffent access_menthods */
--/*
-+/* Defining the diffent access_methods
-+ *
- * Memory mapped FIFO interface (SMART 53xx cards)
- */
- #define SA5_DOORBELL 0x20
-@@ -151,42 +179,77 @@ struct ctlr_info
- #define SA5B_INTR_PENDING 0x04
- #define FIFO_EMPTY 0xffffffff
- #define CCISS_FIRMWARE_READY 0xffff0000 /* value in scratchpad register */
-+/* Perf. mode flags */
-+#define SA5_PERF_INTR_PENDING 0x04
-+#define SA5_PERF_INTR_OFF 0x05
-+#define SA5_OUTDB_STATUS_PERF_BIT 0x01
-+#define SA5_OUTDB_CLEAR_PERF_BIT 0x01
-+#define SA5_OUTDB_CLEAR 0xA0
-+#define SA5_OUTDB_CLEAR_PERF_BIT 0x01
-+#define SA5_OUTDB_STATUS 0x9C
-+
-
- #define CISS_ERROR_BIT 0x02
-
--#define CCISS_INTR_ON 1
-+#define CCISS_INTR_ON 1
- #define CCISS_INTR_OFF 0
--/*
-- Send the command to the hardware
-+
-+
-+/* CCISS_BOARD_READY_WAIT_SECS is how long to wait for a board
-+ * to become ready, in seconds, before giving up on it.
-+ * CCISS_BOARD_READY_POLL_INTERVAL_MSECS * is how long to wait
-+ * between polling the board to see if it is ready, in
-+ * milliseconds. CCISS_BOARD_READY_ITERATIONS is derived
-+ * the above.
-+ */
-+#define CCISS_BOARD_READY_WAIT_SECS (120)
-+#define CCISS_BOARD_NOT_READY_WAIT_SECS (100)
-+#define CCISS_BOARD_READY_POLL_INTERVAL_MSECS (100)
-+#define CCISS_BOARD_READY_ITERATIONS \
-+ ((CCISS_BOARD_READY_WAIT_SECS * 1000) / \
-+ CCISS_BOARD_READY_POLL_INTERVAL_MSECS)
-+#define CCISS_BOARD_NOT_READY_ITERATIONS \
-+ ((CCISS_BOARD_NOT_READY_WAIT_SECS * 1000) / \
-+ CCISS_BOARD_READY_POLL_INTERVAL_MSECS)
-+#define CCISS_POST_RESET_PAUSE_MSECS (3000)
-+#define CCISS_POST_RESET_NOOP_INTERVAL_MSECS (1000)
-+#define CCISS_POST_RESET_NOOP_RETRIES (12)
-+#define CCISS_POST_RESET_NOOP_TIMEOUT_MSECS (10000)
-+
-+/*
-+ Send the command to the hardware
- */
--static void SA5_submit_command( ctlr_info_t *h, CommandList_struct *c)
-+static void SA5_submit_command( ctlr_info_t *h, CommandList_struct *c)
- {
- #ifdef CCISS_DEBUG
-- printk("Sending %x - down to controller\n", c->busaddr );
--#endif /* CCISS_DEBUG */
-- writel(c->busaddr, h->vaddr + SA5_REQUEST_PORT_OFFSET);
-- readl(h->vaddr + SA5_SCRATCHPAD_OFFSET);
-- h->commands_outstanding++;
-- if ( h->commands_outstanding > h->max_outstanding)
-+ printk(KERN_WARNING "cciss%d: Sending %08x - down to controller\n",
-+ h->ctlr, c->busaddr);
-+#endif /* CCISS_DEBUG */
-+ writel(c->busaddr, h->vaddr + SA5_REQUEST_PORT_OFFSET);
-+ (void) readl(h->vaddr + SA5_SCRATCHPAD_OFFSET);
-+ h->commands_outstanding++;
-+ if ( h->commands_outstanding > h->max_outstanding)
- h->max_outstanding = h->commands_outstanding;
- }
-
--/*
-- * This card is the opposite of the other cards.
-- * 0 turns interrupts on...
-- * 0x08 turns them off...
-+/*
-+ * This card is the opposite of the other cards.
-+ * 0 turns interrupts on...
-+ * 0x08 turns them off...
- */
- static void SA5_intr_mask(ctlr_info_t *h, unsigned long val)
- {
-- if (val)
-+ if (val)
- { /* Turn interrupts on */
- h->interrupts_enabled = 1;
- writel(0, h->vaddr + SA5_REPLY_INTR_MASK_OFFSET);
-+ (void) readl(h->vaddr + SA5_REPLY_INTR_MASK_OFFSET);
- } else /* Turn them off */
- {
- h->interrupts_enabled = 0;
-- writel( SA5_INTR_OFF,
-+ writel( SA5_INTR_OFF,
- h->vaddr + SA5_REPLY_INTR_MASK_OFFSET);
-+ (void) readl(h->vaddr + SA5_REPLY_INTR_MASK_OFFSET);
- }
- }
- /*
-@@ -200,60 +263,112 @@ static void SA5B_intr_mask(ctlr_info_t *h, unsigned long val)
- { /* Turn interrupts on */
- h->interrupts_enabled = 1;
- writel(0, h->vaddr + SA5_REPLY_INTR_MASK_OFFSET);
-+ (void) readl(h->vaddr + SA5_REPLY_INTR_MASK_OFFSET);
- } else /* Turn them off */
- {
- h->interrupts_enabled = 0;
- writel( SA5B_INTR_OFF,
- h->vaddr + SA5_REPLY_INTR_MASK_OFFSET);
-+ (void) readl(h->vaddr + SA5_REPLY_INTR_MASK_OFFSET);
- }
- }
-+
-+/* Performant mode intr_mask */
-+static void SA5_performant_intr_mask(ctlr_info_t *h, unsigned long val)
-+{
-+ if (val) { /* turn on interrupts */
-+ h->interrupts_enabled = 1;
-+ writel(0, h->vaddr + SA5_REPLY_INTR_MASK_OFFSET);
-+ (void) readl(h->vaddr + SA5_REPLY_INTR_MASK_OFFSET);
-+ } else {
-+ h->interrupts_enabled = 0;
-+ writel(SA5_PERF_INTR_OFF,
-+ h->vaddr + SA5_REPLY_INTR_MASK_OFFSET);
-+ (void) readl(h->vaddr + SA5_REPLY_INTR_MASK_OFFSET);
-+ }
-+}
-+
- /*
-- * Returns true if fifo is full.
-- *
-- */
-+ * Returns true if fifo is full.
-+ *
-+ */
- static unsigned long SA5_fifo_full(ctlr_info_t *h)
- {
- if( h->commands_outstanding >= h->max_commands)
- return(1);
-- else
-+ else
- return(0);
-
- }
--/*
-- * returns value read from hardware.
-- * returns FIFO_EMPTY if there is nothing to read
-- */
-+/*
-+ * returns value read from hardware.
-+ * returns FIFO_EMPTY if there is nothing to read
-+ */
- static unsigned long SA5_completed(ctlr_info_t *h)
- {
-- unsigned long register_value
-+ unsigned long register_value
- = readl(h->vaddr + SA5_REPLY_PORT_OFFSET);
- if(register_value != FIFO_EMPTY)
- {
- h->commands_outstanding--;
- #ifdef CCISS_DEBUG
- printk("cciss: Read %lx back from board\n", register_value);
--#endif /* CCISS_DEBUG */
-- }
-+#endif /* CCISS_DEBUG */
-+ }
- #ifdef CCISS_DEBUG
- else
- {
- printk("cciss: FIFO Empty read\n");
- }
--#endif
-- return ( register_value);
-+#endif
-+ return ( register_value);
-
- }
-+
-+/* Performant mode command completed */
-+static unsigned long SA5_performant_completed(ctlr_info_t *h)
-+{
-+ unsigned long register_value = FIFO_EMPTY;
-+
-+ /* flush the controller write of the reply queue by reading
-+ * outbound doorbell status register.
-+ */
-+ register_value = readl(h->vaddr + SA5_OUTDB_STATUS);
-+ /* msi auto clears the interrupt pending bit. */
-+ if (!(h->msi_vector || h->msix_vector)) {
-+ writel(SA5_OUTDB_CLEAR_PERF_BIT, h->vaddr + SA5_OUTDB_CLEAR);
-+ /* Do a read in order to flush the write to the controller
-+ * (as per spec.)
-+ */
-+ register_value = readl(h->vaddr + SA5_OUTDB_STATUS);
-+ }
-+
-+ if ((*(h->reply_pool_head) & 1) == (h->reply_pool_wraparound)) {
-+ register_value = *(h->reply_pool_head);
-+ (h->reply_pool_head)++;
-+ h->commands_outstanding--;
-+ } else {
-+ register_value = FIFO_EMPTY;
-+ }
-+ /* Check for wraparound */
-+ if (h->reply_pool_head == (h->reply_pool + h->max_commands)) {
-+ h->reply_pool_head = h->reply_pool;
-+ h->reply_pool_wraparound ^= 1;
-+ }
-+
-+ return register_value;
-+}
- /*
-- * Returns true if an interrupt is pending..
-+ * Returns true if an interrupt is pending..
- */
--static unsigned long SA5_intr_pending(ctlr_info_t *h)
-+static bool SA5_intr_pending(ctlr_info_t *h)
- {
-- unsigned long register_value =
-+ unsigned long register_value =
- readl(h->vaddr + SA5_INTR_STATUS);
- #ifdef CCISS_DEBUG
- printk("cciss: intr_pending %lx\n", register_value);
- #endif /* CCISS_DEBUG */
-- if( register_value & SA5_INTR_PENDING)
-+ if( register_value & SA5_INTR_PENDING)
- return 1;
- return 0 ;
- }
-@@ -261,7 +376,7 @@ static unsigned long SA5_intr_pending(ctlr_info_t *h)
- /*
- * Returns true if an interrupt is pending..
- */
--static unsigned long SA5B_intr_pending(ctlr_info_t *h)
-+static bool SA5B_intr_pending(ctlr_info_t *h)
- {
- unsigned long register_value =
- readl(h->vaddr + SA5_INTR_STATUS);
-@@ -273,6 +388,20 @@ static unsigned long SA5B_intr_pending(ctlr_info_t *h)
- return 0 ;
- }
-
-+static bool SA5_performant_intr_pending(ctlr_info_t *h)
-+{
-+ unsigned long register_value = readl(h->vaddr + SA5_INTR_STATUS);
-+
-+ if (!register_value)
-+ return false;
-+
-+ if (h->msi_vector || h->msix_vector)
-+ return true;
-+
-+ /* Read outbound doorbell to flush */
-+ register_value = readl(h->vaddr + SA5_OUTDB_STATUS);
-+ return register_value & SA5_OUTDB_STATUS_PERF_BIT;
-+}
-
- static struct access_method SA5_access = {
- SA5_submit_command,
-@@ -290,6 +419,14 @@ static struct access_method SA5B_access = {
- SA5_completed,
- };
-
-+static struct access_method SA5_performant_access = {
-+ SA5_submit_command,
-+ SA5_performant_intr_mask,
-+ SA5_fifo_full,
-+ SA5_performant_intr_pending,
-+ SA5_performant_completed,
-+};
-+
- struct board_type {
- __u32 board_id;
- char *product_name;
-@@ -297,7 +434,4 @@ struct board_type {
- int nr_cmds; /* Max cmds this kind of ctlr can handle. */
- };
-
--#define CCISS_LOCK(i) (&hba[i]->lock)
--
- #endif /* CCISS_H */
--
-diff --git a/drivers/block/cciss_cmd.h b/drivers/block/cciss_cmd.h
-index dbaed1e..0e6584d 100644
---- a/drivers/block/cciss_cmd.h
-+++ b/drivers/block/cciss_cmd.h
-@@ -1,30 +1,16 @@
- #ifndef CCISS_CMD_H
- #define CCISS_CMD_H
--//###########################################################################
--//DEFINES
--//###########################################################################
-+
-+#include <linux/cciss_defs.h>
-+
-+/* DEFINES */
- #define CISS_VERSION "1.00"
-
--//general boundary defintions
--#define SENSEINFOBYTES 32//note that this value may vary between host implementations
--#define MAXSGENTRIES 31
-+/* general boundary definitions */
-+#define MAXSGENTRIES 32
-+#define CCISS_SG_CHAIN 0x80000000
- #define MAXREPLYQS 256
-
--//Command Status value
--#define CMD_SUCCESS 0x0000
--#define CMD_TARGET_STATUS 0x0001
--#define CMD_DATA_UNDERRUN 0x0002
--#define CMD_DATA_OVERRUN 0x0003
--#define CMD_INVALID 0x0004
--#define CMD_PROTOCOL_ERR 0x0005
--#define CMD_HARDWARE_ERR 0x0006
--#define CMD_CONNECTION_LOST 0x0007
--#define CMD_ABORTED 0x0008
--#define CMD_ABORT_FAILED 0x0009
--#define CMD_UNSOLICITED_ABORT 0x000A
--#define CMD_TIMEOUT 0x000B
--#define CMD_UNABORTABLE 0x000C
--
- /* Unit Attentions ASC's as defined for the MSA2012sa */
- #define POWER_OR_RESET 0x29
- #define STATE_CHANGED 0x2a
-@@ -48,30 +34,13 @@
- #define ASYM_ACCESS_CHANGED 0x06
- #define LUN_CAPACITY_CHANGED 0x09
-
--//transfer direction
--#define XFER_NONE 0x00
--#define XFER_WRITE 0x01
--#define XFER_READ 0x02
--#define XFER_RSVD 0x03
--
--//task attribute
--#define ATTR_UNTAGGED 0x00
--#define ATTR_SIMPLE 0x04
--#define ATTR_HEADOFQUEUE 0x05
--#define ATTR_ORDERED 0x06
--#define ATTR_ACA 0x07
--
--//cdb type
--#define TYPE_CMD 0x00
--#define TYPE_MSG 0x01
--
--//config space register offsets
-+/* config space register offsets */
- #define CFG_VENDORID 0x00
- #define CFG_DEVICEID 0x02
- #define CFG_I2OBAR 0x10
- #define CFG_MEM1BAR 0x14
-
--//i2o space register offsets
-+/* i2o space register offsets */
- #define I2O_IBDB_SET 0x20
- #define I2O_IBDB_CLEAR 0x70
- #define I2O_INT_STATUS 0x30
-@@ -80,11 +49,15 @@
- #define I2O_OBPOST_Q 0x44
- #define I2O_DMA1_CFG 0x214
-
--//Configuration Table
-+/* Configuration Table */
- #define CFGTBL_ChangeReq 0x00000001l
- #define CFGTBL_AccCmds 0x00000001l
-+#define DOORBELL_CTLR_RESET 0x00000004l
-+#define DOORBELL_CTLR_RESET2 0x00000020l
-
- #define CFGTBL_Trans_Simple 0x00000002l
-+#define CFGTBL_Trans_Performant 0x00000004l
-+#define CFGTBL_Trans_use_short_tags 0x20000000l
-
- #define CFGTBL_BusType_Ultra2 0x00000001l
- #define CFGTBL_BusType_Ultra3 0x00000002l
-@@ -102,24 +75,17 @@ typedef union _u64bit
- __u64 val;
- } u64bit;
-
--// Type defs used in the following structs
--#define BYTE __u8
--#define WORD __u16
--#define HWORD __u16
--#define DWORD __u32
--#define QWORD vals32
-+/* Type defs used in the following structs */
-+#define QWORD vals32
-
--//###########################################################################
--//STRUCTURES
--//###########################################################################
--#define CISS_MAX_LUN 1024
-+/* STRUCTURES */
- #define CISS_MAX_PHYS_LUN 1024
--// SCSI-3 Cmmands
-+/* SCSI-3 Cmmands */
-
- #pragma pack(1)
-
- #define CISS_INQUIRY 0x12
--//Date returned
-+/* Date returned */
- typedef struct _InquiryData_struct
- {
- BYTE data_byte[36];
-@@ -127,7 +93,7 @@ typedef struct _InquiryData_struct
-
- #define CISS_REPORT_LOG 0xc2 /* Report Logical LUNs */
- #define CISS_REPORT_PHYS 0xc3 /* Report Physical LUNs */
--// Data returned
-+/* Data returned */
- typedef struct _ReportLUNdata_struct
- {
- BYTE LUNListLength[4];
-@@ -135,11 +101,11 @@ typedef struct _ReportLUNdata_struct
- BYTE LUN[CISS_MAX_LUN][8];
- } ReportLunData_struct;
-
--#define CCISS_READ_CAPACITY 0x25 /* Read Capacity */
-+#define CCISS_READ_CAPACITY 0x25 /* Read Capacity */
- typedef struct _ReadCapdata_struct
- {
-- BYTE total_size[4]; // Total size in blocks
-- BYTE block_size[4]; // Size of blocks in bytes
-+ BYTE total_size[4]; /* Total size in blocks */
-+ BYTE block_size[4]; /* Size of blocks in bytes */
- } ReadCapdata_struct;
-
- #define CCISS_READ_CAPACITY_16 0x9e /* Read Capacity 16 */
-@@ -171,52 +137,21 @@ typedef struct _ReadCapdata_struct_16
- #define CDB_LEN10 10
- #define CDB_LEN16 16
-
--// BMIC commands
-+/* BMIC commands */
- #define BMIC_READ 0x26
- #define BMIC_WRITE 0x27
- #define BMIC_CACHE_FLUSH 0xc2
--#define CCISS_CACHE_FLUSH 0x01 //C2 was already being used by CCISS
-+#define CCISS_CACHE_FLUSH 0x01 /* C2 was already being used by CCISS */
-
--//Command List Structure
--typedef union _SCSI3Addr_struct {
-- struct {
-- BYTE Dev;
-- BYTE Bus:6;
-- BYTE Mode:2; // b00
-- } PeripDev;
-- struct {
-- BYTE DevLSB;
-- BYTE DevMSB:6;
-- BYTE Mode:2; // b01
-- } LogDev;
-- struct {
-- BYTE Dev:5;
-- BYTE Bus:3;
-- BYTE Targ:6;
-- BYTE Mode:2; // b10
-- } LogUnit;
--} SCSI3Addr_struct;
--
--typedef struct _PhysDevAddr_struct {
-- DWORD TargetId:24;
-- DWORD Bus:6;
-- DWORD Mode:2;
-- SCSI3Addr_struct Target[2]; //2 level target device addr
--} PhysDevAddr_struct;
--
--typedef struct _LogDevAddr_struct {
-- DWORD VolId:30;
-- DWORD Mode:2;
-- BYTE reserved[4];
--} LogDevAddr_struct;
--
--typedef union _LUNAddr_struct {
-- BYTE LunAddrBytes[8];
-- SCSI3Addr_struct SCSI3Lun[4];
-- PhysDevAddr_struct PhysDev;
-- LogDevAddr_struct LogDev;
--} LUNAddr_struct;
-+#define CCISS_ABORT_MSG 0x00
-+#define CCISS_RESET_MSG 0x01
-+#define CCISS_RESET_TYPE_CONTROLLER 0x00
-+#define CCISS_RESET_TYPE_BUS 0x01
-+#define CCISS_RESET_TYPE_TARGET 0x03
-+#define CCISS_RESET_TYPE_LUN 0x04
-+#define CCISS_NOOP_MSG 0x03
-
-+/* Command List Structure */
- #define CTLR_LUNID "\0\0\0\0\0\0\0\0"
-
- typedef struct _CommandListHeader_struct {
-@@ -226,16 +161,6 @@ typedef struct _CommandListHeader_struct {
- QWORD Tag;
- LUNAddr_struct LUN;
- } CommandListHeader_struct;
--typedef struct _RequestBlock_struct {
-- BYTE CDBLen;
-- struct {
-- BYTE Type:3;
-- BYTE Attribute:3;
-- BYTE Direction:2;
-- } Type;
-- HWORD Timeout;
-- BYTE CDB[16];
--} RequestBlock_struct;
- typedef struct _ErrDescriptor_struct {
- QWORD Addr;
- DWORD Len;
-@@ -246,28 +171,6 @@ typedef struct _SGDescriptor_struct {
- DWORD Ext;
- } SGDescriptor_struct;
-
--typedef union _MoreErrInfo_struct{
-- struct {
-- BYTE Reserved[3];
-- BYTE Type;
-- DWORD ErrorInfo;
-- }Common_Info;
-- struct{
-- BYTE Reserved[2];
-- BYTE offense_size;//size of offending entry
-- BYTE offense_num; //byte # of offense 0-base
-- DWORD offense_value;
-- }Invalid_Cmd;
--}MoreErrInfo_struct;
--typedef struct _ErrorInfo_struct {
-- BYTE ScsiStatus;
-- BYTE SenseLen;
-- HWORD CommandStatus;
-- DWORD ResidualCnt;
-- MoreErrInfo_struct MoreErrInfo;
-- BYTE SenseInfo[SENSEINFOBYTES];
--} ErrorInfo_struct;
--
- /* Command types */
- #define CMD_RWREQ 0x00
- #define CMD_IOCTL_PEND 0x01
-@@ -276,30 +179,41 @@ typedef struct _ErrorInfo_struct {
- #define CMD_MSG_TIMEOUT 0x05
- #define CMD_MSG_STALE 0xff
-
--/* This structure needs to be divisible by 8 for new
-- * indexing method.
-+/* This structure needs to be divisible by COMMANDLIST_ALIGNMENT
-+ * because low bits of the address are used to to indicate that
-+ * whether the tag contains an index or an address. PAD_32 and
-+ * PAD_64 can be adjusted independently as needed for 32-bit
-+ * and 64-bits systems.
- */
--#define PADSIZE (sizeof(long) - 4)
-+#define COMMANDLIST_ALIGNMENT (32)
-+#define IS_64_BIT ((sizeof(long) - 4)/4)
-+#define IS_32_BIT (!IS_64_BIT)
-+#define PAD_32 (0)
-+#define PAD_64 (4)
-+#define PADSIZE (IS_32_BIT * PAD_32 + IS_64_BIT * PAD_64)
-+#define DIRECT_LOOKUP_BIT 0x10
-+#define DIRECT_LOOKUP_SHIFT 5
-+
- typedef struct _CommandList_struct {
- CommandListHeader_struct Header;
- RequestBlock_struct Request;
- ErrDescriptor_struct ErrDesc;
- SGDescriptor_struct SG[MAXSGENTRIES];
-- /* information associated with the command */
-+ /* information associated with the command */
- __u32 busaddr; /* physical address of this record */
-- ErrorInfo_struct * err_info; /* pointer to the allocated mem */
-+ ErrorInfo_struct * err_info; /* pointer to the allocated mem */
- int ctlr;
-- int cmd_type;
-+ int cmd_type;
- long cmdindex;
-- struct hlist_node list;
-+ struct list_head list;
- struct request * rq;
- struct completion *waiting;
- int retry_count;
- void * scsi_cmd;
-- char pad[PADSIZE];
-+ char pad[PADSIZE];
- } CommandList_struct;
-
--//Configuration Table Structure
-+/* Configuration Table Structure */
- typedef struct _HostWrite_struct {
- DWORD TransportRequest;
- DWORD Reserved;
-@@ -310,15 +224,46 @@ typedef struct _HostWrite_struct {
- typedef struct _CfgTable_struct {
- BYTE Signature[4];
- DWORD SpecValence;
-+#define SIMPLE_MODE 0x02
-+#define PERFORMANT_MODE 0x04
-+#define MEMQ_MODE 0x08
- DWORD TransportSupport;
- DWORD TransportActive;
- HostWrite_struct HostWrite;
- DWORD CmdsOutMax;
- DWORD BusTypes;
-- DWORD Reserved;
-+ DWORD TransMethodOffset;
- BYTE ServerName[16];
- DWORD HeartBeat;
- DWORD SCSI_Prefetch;
-+ DWORD MaxSGElements;
-+ DWORD MaxLogicalUnits;
-+ DWORD MaxPhysicalDrives;
-+ DWORD MaxPhysicalDrivesPerLogicalUnit;
-+ DWORD MaxPerformantModeCommands;
-+ u8 reserved[0x78 - 0x58];
-+ u32 misc_fw_support; /* offset 0x78 */
-+#define MISC_FW_DOORBELL_RESET (0x02)
-+#define MISC_FW_DOORBELL_RESET2 (0x10)
-+ u8 driver_version[32];
- } CfgTable_struct;
--#pragma pack()
--#endif // CCISS_CMD_H
-+
-+struct TransTable_struct {
-+ u32 BlockFetch0;
-+ u32 BlockFetch1;
-+ u32 BlockFetch2;
-+ u32 BlockFetch3;
-+ u32 BlockFetch4;
-+ u32 BlockFetch5;
-+ u32 BlockFetch6;
-+ u32 BlockFetch7;
-+ u32 RepQSize;
-+ u32 RepQCount;
-+ u32 RepQCtrAddrLow32;
-+ u32 RepQCtrAddrHigh32;
-+ u32 RepQAddr0Low32;
-+ u32 RepQAddr0High32;
-+};
-+
-+#pragma pack()
-+#endif /* CCISS_CMD_H */
-diff --git a/drivers/block/cciss_kernel_compat.h b/drivers/block/cciss_kernel_compat.h
-new file mode 100644
-index 0000000..671f3b8
---- /dev/null
-+++ b/drivers/block/cciss_kernel_compat.h
-@@ -0,0 +1,128 @@
-+/*
-+ * Disk Array driver for HP Smart Array controllers.
-+ * (C) Copyright 2000, 2010, 2012 Hewlett-Packard Development Company, L.P.
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License as published by
-+ * the Free Software Foundation; version 2 of the License.
-+ *
-+ * This program is distributed in the hope that it will be useful,
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-+ * General Public License for more details.
-+ *
-+ * You should have received a copy of the GNU General Public License
-+ * along with this program; if not, write to the Free Software
-+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
-+ * 02111-1307, USA.
-+ *
-+ * Questions/Comments/Bugfixes to iss_storagedev@hp.com
-+ *
-+ */
-+
-+/* Kernel compat file for the cciss_4_6_xx branch */
-+
-+/* #define SLES11sp2plus */
-+/* #define SLES11sp1 */
-+/* #define SLES11sp2plus */
-+/* #define RHEL6 */
-+/* Default is kernel.org */
-+
-+#ifdef SLES11sp1
-+# define KFEATURE_HAS_LOCKED_IOCTL 1
-+# define KFEATURE_HAS_BLK_QUEUE_MAX_SEGMENTS 0
-+# define KFEATURE_HAS_SMP_LOCK_H 1
-+# define KFEATURE_HAS_BLK_QUEUE_PLUGGED 1
-+# define KFEATURE_HAS_LOCK_KERNEL 1
-+# define SA_CONTROLLERS_GEN8 0
-+# define SA_CONTROLLERS_GEN6 1
-+# define SA_CONTROLLERS_LEGACY 1
-+# define KFEATURE_HAS_2011_03_QUEUECOMMAND 0
-+#else
-+#ifdef SLES11sp2plus
-+# define KFEATURE_HAS_LOCKED_IOCTL 0
-+# define KFEATURE_HAS_BLK_QUEUE_MAX_SEGMENTS 1
-+# define KFEATURE_HAS_SMP_LOCK_H 0
-+# define KFEATURE_HAS_BLK_QUEUE_PLUGGED 0
-+# define KFEATURE_HAS_LOCK_KERNEL 0
-+# define SA_CONTROLLERS_GEN8 0
-+# define SA_CONTROLLERS_GEN6 1
-+# define SA_CONTROLLERS_LEGACY 1
-+# define KFEATURE_HAS_2011_03_QUEUECOMMAND 1
-+#else
-+#ifdef RHEL6
-+# define KFEATURE_HAS_LOCKED_IOCTL 0
-+# define KFEATURE_HAS_BLK_QUEUE_MAX_SEGMENTS 1
-+# define KFEATURE_HAS_SMP_LOCK_H 1
-+# define KFEATURE_HAS_BLK_QUEUE_PLUGGED 1
-+# define KFEATURE_HAS_LOCK_KERNEL 1
-+# define SA_CONTROLLERS_GEN8 0
-+# define SA_CONTROLLERS_GEN6 0
-+# define SA_CONTROLLERS_LEGACY 1
-+# define KFEATURE_HAS_2011_03_QUEUECOMMAND 0
-+#else /* kernel.org */
-+# define KFEATURE_HAS_LOCKED_IOCTL 0
-+# define KFEATURE_HAS_BLK_QUEUE_MAX_SEGMENTS 0
-+# define KFEATURE_HAS_SMP_LOCK_H 1
-+# define KFEATURE_HAS_BLK_QUEUE_PLUGGED 1
-+# define KFEATURE_HAS_LOCK_KERNEL 1
-+# define SA_CONTROLLERS_GEN8 1
-+# define SA_CONTROLLERS_GEN6 1
-+# define SA_CONTROLLERS_LEGACY 1
-+# define KFEATURE_HAS_2011_03_QUEUECOMMAND 0
-+#endif
-+#endif
-+#endif
-+
-+/* Some kernels have a .locked_ioctl while some have a .ioctl in the fops */
-+#if KFEATURE_HAS_LOCKED_IOCTL
-+# define SET_IOCTL_FUNCTION(locked_function, unlocked_function) .locked_ioctl = locked_function,
-+#else
-+# define SET_IOCTL_FUNCTION(locked_function, unlocked_function) .ioctl = unlocked_function,
-+#endif /* KFEATURE_HAS_LOCKED_IOCTL */
-+
-+#if KFEATURE_HAS_BLK_QUEUE_MAX_SEGMENTS
-+#else
-+/*
-+ * Some kernels don't have blk_queue_max_segments(), instead it has the older
-+ * blk_queue_max_hw_segments() and blk_queue_max_phys_segments()
-+ */
-+static inline void blk_queue_max_segments(struct request_queue *queue,
-+ int nsegments)
-+{
-+ blk_queue_max_hw_segments(queue, nsegments);
-+ blk_queue_max_phys_segments(queue, nsegments);
-+}
-+#endif /* KFEATURE_HAS_BLK_QUEUE_MAX_SEGMENTS */
-+
-+#if KFEATURE_HAS_SMP_LOCK_H
-+#include <linux/smp_lock.h>
-+#endif
-+
-+#if KFEATURE_HAS_BLK_QUEUE_PLUGGED
-+# define BLK_QUEUE_PLUGGED(x) blk_queue_plugged(x)
-+#else
-+ /* No such thing as blk_queue_plugged, so always return
-+ * false, compiler will optimize away
-+ */
-+# define BLK_QUEUE_PLUGGED(x) (0)
-+#endif
-+
-+#if KFEATURE_HAS_LOCK_KERNEL
-+#else
-+# define lock_kernel() do { } while (0)
-+# define unlock_kernel() do { } while (0)
-+#endif
-+
-+#if KFEATURE_HAS_2011_03_QUEUECOMMAND
-+# define DECLARE_QUEUECOMMAND(func) \
-+ static int func##_lck(struct scsi_cmnd *cmd, \
-+ void (*done)(struct scsi_cmnd *))
-+# define DECLARE_QUEUECOMMAND_WRAPPER(func) static DEF_SCSI_QCMD(func)
-+#else
-+# define DECLARE_QUEUECOMMAND(func) \
-+ static int func(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *))
-+# define DECLARE_QUEUECOMMAND_WRAPPER(func)
-+#endif
-+
-+
-diff --git a/drivers/block/cciss_scsi.c b/drivers/block/cciss_scsi.c
-index ad8e592..2921035 100644
---- a/drivers/block/cciss_scsi.c
-+++ b/drivers/block/cciss_scsi.c
-@@ -1,6 +1,6 @@
- /*
- * Disk Array driver for HP Smart Array controllers, SCSI Tape module.
-- * (C) Copyright 2001, 2007 Hewlett-Packard Development Company, L.P.
-+ * (C) Copyright 2001, 2010 Hewlett-Packard Development Company, L.P.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
-@@ -17,15 +17,15 @@
- * 02111-1307, USA.
- *
- * Questions/Comments/Bugfixes to iss_storagedev@hp.com
-- *
-+ *
- * Author: Stephen M. Cameron
- */
- #ifdef CONFIG_CISS_SCSI_TAPE
-
--/* Here we have code to present the driver as a scsi driver
-- as it is simultaneously presented as a block driver. The
-+/* Here we have code to present the driver as a scsi driver
-+ as it is simultaneously presented as a block driver. The
- reason for doing this is to allow access to SCSI tape drives
-- through the array controller. Note in particular, neither
-+ through the array controller. Note in particular, neither
- physical nor logical disks are presented through the scsi layer. */
-
- #include <linux/timer.h>
-@@ -37,20 +37,22 @@
-
- #include <scsi/scsi_cmnd.h>
- #include <scsi/scsi_device.h>
--#include <scsi/scsi_host.h>
-+#include <scsi/scsi_host.h>
-
- #include "cciss_scsi.h"
-
- #define CCISS_ABORT_MSG 0x00
- #define CCISS_RESET_MSG 0x01
-
--static int fill_cmd(CommandList_struct *c, __u8 cmd, int ctlr, void *buff,
-+static int fill_cmd(ctlr_info_t *h, CommandList_struct *c, __u8 cmd, void *buff,
- size_t size,
- __u8 page_code, unsigned char *scsi3addr,
- int cmd_type);
-
--static CommandList_struct *cmd_alloc(ctlr_info_t *h, int get_from_pool);
--static void cmd_free(ctlr_info_t *h, CommandList_struct *c, int got_from_pool);
-+static CommandList_struct *cmd_alloc(ctlr_info_t *h);
-+static CommandList_struct *cmd_special_alloc(ctlr_info_t *h);
-+static void cmd_free(ctlr_info_t *h, CommandList_struct *c);
-+static void cmd_special_free(ctlr_info_t *h, CommandList_struct *c);
-
- static int cciss_scsi_proc_info(
- struct Scsi_Host *sh,
-@@ -60,8 +62,8 @@ static int cciss_scsi_proc_info(
- int length, /* length of data in buffer */
- int func); /* 0 == read, 1 == write */
-
--static int cciss_scsi_queue_command (struct scsi_cmnd *cmd,
-- void (* done)(struct scsi_cmnd *));
-+DECLARE_QUEUECOMMAND(cciss_scsi_queue_command);
-+DECLARE_QUEUECOMMAND_WRAPPER(cciss_scsi_queue_command);
- static int cciss_eh_device_reset_handler(struct scsi_cmnd *);
- static int cciss_eh_abort_handler(struct scsi_cmnd *);
-
-@@ -82,9 +84,7 @@ static struct scsi_host_template cciss_driver_template = {
- .proc_name = "cciss",
- .proc_info = cciss_scsi_proc_info,
- .queuecommand = cciss_scsi_queue_command,
-- .can_queue = SCSI_CCISS_CAN_QUEUE,
- .this_id = 7,
-- .sg_tablesize = MAXSGENTRIES,
- .cmd_per_lun = 1,
- .use_clustering = DISABLE_CLUSTERING,
- /* Can't have eh_bus_reset_handler or eh_host_reset_handler for cciss */
-@@ -93,47 +93,45 @@ static struct scsi_host_template cciss_driver_template = {
- };
-
- #pragma pack(1)
-+
-+#define SCSI_PAD_32 8
-+#define SCSI_PAD_64 8
-+
- struct cciss_scsi_cmd_stack_elem_t {
- CommandList_struct cmd;
- ErrorInfo_struct Err;
- __u32 busaddr;
-- __u32 pad;
-+ int cmdindex;
-+ unsigned char pad[IS_32_BIT * SCSI_PAD_32 + IS_64_BIT * SCSI_PAD_64];
- };
-
--#pragma pack()
--
--#define CMD_STACK_SIZE (SCSI_CCISS_CAN_QUEUE * \
-- CCISS_MAX_SCSI_DEVS_PER_HBA + 2)
-- // plus two for init time usage
--
--#pragma pack(1)
- struct cciss_scsi_cmd_stack_t {
- struct cciss_scsi_cmd_stack_elem_t *pool;
-- struct cciss_scsi_cmd_stack_elem_t *elem[CMD_STACK_SIZE];
-+ struct cciss_scsi_cmd_stack_elem_t **elem;
- dma_addr_t cmd_pool_handle;
- int top;
-+ int nelems;
- };
- #pragma pack()
-
- struct cciss_scsi_adapter_data_t {
- struct Scsi_Host *scsi_host;
- struct cciss_scsi_cmd_stack_t cmd_stack;
-+ SGDescriptor_struct **cmd_sg_list;
- int registered;
-- spinlock_t lock; // to protect ccissscsi[ctlr];
-+ spinlock_t lock; // to protect ccissscsi[ctlr];
- };
-
--#define CPQ_TAPE_LOCK(ctlr, flags) spin_lock_irqsave( \
-- &(((struct cciss_scsi_adapter_data_t *) \
-- hba[ctlr]->scsi_ctlr)->lock), flags);
--#define CPQ_TAPE_UNLOCK(ctlr, flags) spin_unlock_irqrestore( \
-- &(((struct cciss_scsi_adapter_data_t *) \
-- hba[ctlr]->scsi_ctlr)->lock), flags);
-+#define CPQ_TAPE_LOCK(h, flags) spin_lock_irqsave( \
-+ &h->scsi_ctlr->lock, flags);
-+#define CPQ_TAPE_UNLOCK(h, flags) spin_unlock_irqrestore( \
-+ &h->scsi_ctlr->lock, flags);
-
- static CommandList_struct *
- scsi_cmd_alloc(ctlr_info_t *h)
- {
- /* assume only one process in here at a time, locking done by caller. */
-- /* use CCISS_LOCK(ctlr) */
-+ /* use h->lock */
- /* might be better to rewrite how we allocate scsi commands in a way that */
- /* needs no locking at all. */
-
-@@ -143,22 +141,23 @@ scsi_cmd_alloc(ctlr_info_t *h)
- struct cciss_scsi_cmd_stack_t *stk;
- u64bit temp64;
-
-- sa = (struct cciss_scsi_adapter_data_t *) h->scsi_ctlr;
-- stk = &sa->cmd_stack;
-+ sa = h->scsi_ctlr;
-+ stk = &sa->cmd_stack;
-
-- if (stk->top < 0)
-+ if (stk->top < 0)
- return NULL;
- c = stk->elem[stk->top];
- /* memset(c, 0, sizeof(*c)); */
- memset(&c->cmd, 0, sizeof(c->cmd));
- memset(&c->Err, 0, sizeof(c->Err));
- /* set physical addr of cmd and addr of scsi parameters */
-- c->cmd.busaddr = c->busaddr;
-- /* (__u32) (stk->cmd_pool_handle +
-+ c->cmd.busaddr = c->busaddr;
-+ c->cmd.cmdindex = c->cmdindex;
-+ /* (__u32) (stk->cmd_pool_handle +
- (sizeof(struct cciss_scsi_cmd_stack_elem_t)*stk->top)); */
-
- temp64.val = (__u64) (c->busaddr + sizeof(CommandList_struct));
-- /* (__u64) (stk->cmd_pool_handle +
-+ /* (__u64) (stk->cmd_pool_handle +
- (sizeof(struct cciss_scsi_cmd_stack_elem_t)*stk->top) +
- sizeof(CommandList_struct)); */
- stk->top--;
-@@ -172,75 +171,92 @@ scsi_cmd_alloc(ctlr_info_t *h)
- return (CommandList_struct *) c;
- }
-
--static void
--scsi_cmd_free(ctlr_info_t *h, CommandList_struct *cmd)
-+static void
-+scsi_cmd_free(ctlr_info_t *h, CommandList_struct *c)
- {
- /* assume only one process in here at a time, locking done by caller. */
-- /* use CCISS_LOCK(ctlr) */
-+ /* use h->lock */
- /* drop the free memory chunk on top of the stack. */
-
- struct cciss_scsi_adapter_data_t *sa;
- struct cciss_scsi_cmd_stack_t *stk;
-
-- sa = (struct cciss_scsi_adapter_data_t *) h->scsi_ctlr;
-- stk = &sa->cmd_stack;
-- if (stk->top >= CMD_STACK_SIZE) {
-- printk("cciss: scsi_cmd_free called too many times.\n");
-- BUG();
-- }
-+ sa = h->scsi_ctlr;
-+ stk = &sa->cmd_stack;
- stk->top++;
-- stk->elem[stk->top] = (struct cciss_scsi_cmd_stack_elem_t *) cmd;
-+ if (stk->top >= stk->nelems) {
-+ dev_err(&h->pdev->dev,
-+ "scsi_cmd_free called too many times.\n");
-+ BUG();
-+ }
-+ stk->elem[stk->top] = (struct cciss_scsi_cmd_stack_elem_t *) c;
- }
-
- static int
--scsi_cmd_stack_setup(int ctlr, struct cciss_scsi_adapter_data_t *sa)
-+scsi_cmd_stack_setup(ctlr_info_t *h, struct cciss_scsi_adapter_data_t *sa)
- {
- int i;
- struct cciss_scsi_cmd_stack_t *stk;
- size_t size;
-
-- stk = &sa->cmd_stack;
-- size = sizeof(struct cciss_scsi_cmd_stack_elem_t) * CMD_STACK_SIZE;
-+ stk = &sa->cmd_stack;
-+ stk->nelems = cciss_tape_cmds + 2;
-+ sa->cmd_sg_list = cciss_allocate_sg_chain_blocks(h,
-+ h->chainsize, stk->nelems);
-+ if (!sa->cmd_sg_list && h->chainsize > 0)
-+ return -ENOMEM;
-
-+ size = sizeof(struct cciss_scsi_cmd_stack_elem_t) * stk->nelems;
-+
-+ /* Check alignment, see cciss_cmd.h near CommandList_struct def. */
-+ BUILD_BUG_ON((sizeof(*stk->pool) % COMMANDLIST_ALIGNMENT) != 0);
- // pci_alloc_consistent guarantees 32-bit DMA address will
- // be used
--
- stk->pool = (struct cciss_scsi_cmd_stack_elem_t *)
-- pci_alloc_consistent(hba[ctlr]->pdev, size, &stk->cmd_pool_handle);
-+ pci_alloc_consistent(h->pdev, size, &stk->cmd_pool_handle);
-
- if (stk->pool == NULL) {
-- printk("stk->pool is null\n");
-+ cciss_free_sg_chain_blocks(sa->cmd_sg_list, stk->nelems);
-+ sa->cmd_sg_list = NULL;
-+ return -ENOMEM;
-+ }
-+ stk->elem = kmalloc(sizeof(stk->elem[0]) * stk->nelems, GFP_KERNEL);
-+ if (!stk->elem) {
-+ pci_free_consistent(h->pdev, size, stk->pool,
-+ stk->cmd_pool_handle);
- return -1;
- }
--
-- for (i=0; i<CMD_STACK_SIZE; i++) {
-+ for (i = 0; i < stk->nelems; i++) {
- stk->elem[i] = &stk->pool[i];
-- stk->elem[i]->busaddr = (__u32) (stk->cmd_pool_handle +
-+ stk->elem[i]->busaddr = (__u32) (stk->cmd_pool_handle +
- (sizeof(struct cciss_scsi_cmd_stack_elem_t) * i));
-+ stk->elem[i]->cmdindex = i;
- }
-- stk->top = CMD_STACK_SIZE-1;
-+ stk->top = stk->nelems - 1;
- return 0;
- }
-
- static void
--scsi_cmd_stack_free(int ctlr)
-+scsi_cmd_stack_free(ctlr_info_t *h)
- {
- struct cciss_scsi_adapter_data_t *sa;
- struct cciss_scsi_cmd_stack_t *stk;
- size_t size;
-
-- sa = (struct cciss_scsi_adapter_data_t *) hba[ctlr]->scsi_ctlr;
-- stk = &sa->cmd_stack;
-- if (stk->top != CMD_STACK_SIZE-1) {
-- printk( "cciss: %d scsi commands are still outstanding.\n",
-- CMD_STACK_SIZE - stk->top);
-- // BUG();
-- printk("WE HAVE A BUG HERE!!! stk=0x%p\n", stk);
-+ sa = h->scsi_ctlr;
-+ stk = &sa->cmd_stack;
-+ if (stk->top != stk->nelems - 1) {
-+ dev_warn(&h->pdev->dev,
-+ "bug: %d scsi commands are still outstanding.\n",
-+ stk->nelems - stk->top);
- }
-- size = sizeof(struct cciss_scsi_cmd_stack_elem_t) * CMD_STACK_SIZE;
-+ size = sizeof(struct cciss_scsi_cmd_stack_elem_t) * stk->nelems;
-
-- pci_free_consistent(hba[ctlr]->pdev, size, stk->pool, stk->cmd_pool_handle);
-+ pci_free_consistent(h->pdev, size, stk->pool, stk->cmd_pool_handle);
- stk->pool = NULL;
-+ cciss_free_sg_chain_blocks(sa->cmd_sg_list, stk->nelems);
-+ kfree(stk->elem);
-+ stk->elem = NULL;
- }
-
- #if 0
-@@ -287,7 +303,7 @@ print_cmd(CommandList_struct *cp)
- printk("queue:%d\n", cp->Header.ReplyQueue);
- printk("sglist:%d\n", cp->Header.SGList);
- printk("sgtot:%d\n", cp->Header.SGTotal);
-- printk("Tag:0x%08x/0x%08x\n", cp->Header.Tag.upper,
-+ printk("Tag:0x%08x/0x%08x\n", cp->Header.Tag.upper,
- cp->Header.Tag.lower);
- printk("LUN:0x%02x%02x%02x%02x%02x%02x%02x%02x\n",
- cp->Header.LUN.LunAddrBytes[0],
-@@ -313,8 +329,8 @@ print_cmd(CommandList_struct *cp)
- cp->Request.CDB[10], cp->Request.CDB[11],
- cp->Request.CDB[12], cp->Request.CDB[13],
- cp->Request.CDB[14], cp->Request.CDB[15]),
-- printk("edesc.Addr: 0x%08x/0%08x, Len = %d\n",
-- cp->ErrDesc.Addr.upper, cp->ErrDesc.Addr.lower,
-+ printk("edesc.Addr: 0x%08x/0%08x, Len = %d\n",
-+ cp->ErrDesc.Addr.upper, cp->ErrDesc.Addr.lower,
- cp->ErrDesc.Len);
- printk("sgs..........Errorinfo:\n");
- printk("scsistatus:%d\n", cp->err_info->ScsiStatus);
-@@ -329,21 +345,21 @@ print_cmd(CommandList_struct *cp)
-
- #endif
-
--static int
--find_bus_target_lun(int ctlr, int *bus, int *target, int *lun)
-+static int
-+find_bus_target_lun(ctlr_info_t *h, int *bus, int *target, int *lun)
- {
- /* finds an unused bus, target, lun for a new device */
-- /* assumes hba[ctlr]->scsi_ctlr->lock is held */
-+ /* assumes h->scsi_ctlr->lock is held */
- int i, found=0;
- unsigned char target_taken[CCISS_MAX_SCSI_DEVS_PER_HBA];
-
- memset(&target_taken[0], 0, CCISS_MAX_SCSI_DEVS_PER_HBA);
-
- target_taken[SELF_SCSI_ID] = 1;
-- for (i=0;i<ccissscsi[ctlr].ndevices;i++)
-- target_taken[ccissscsi[ctlr].dev[i].target] = 1;
-+ for (i = 0; i < ccissscsi[h->ctlr].ndevices; i++)
-+ target_taken[ccissscsi[h->ctlr].dev[i].target] = 1;
-
-- for (i=0;i<CCISS_MAX_SCSI_DEVS_PER_HBA;i++) {
-+ for (i = 0; i < CCISS_MAX_SCSI_DEVS_PER_HBA; i++) {
- if (!target_taken[i]) {
- *bus = 0; *target=i; *lun = 0; found=1;
- break;
-@@ -356,20 +372,20 @@ struct scsi2map {
- int bus, target, lun;
- };
-
--static int
--cciss_scsi_add_entry(int ctlr, int hostno,
-+static int
-+cciss_scsi_add_entry(ctlr_info_t *h, int hostno,
- struct cciss_scsi_dev_t *device,
- struct scsi2map *added, int *nadded)
- {
-- /* assumes hba[ctlr]->scsi_ctlr->lock is held */
-- int n = ccissscsi[ctlr].ndevices;
-+ /* assumes h->scsi_ctlr->lock is held */
-+ int n = ccissscsi[h->ctlr].ndevices;
- struct cciss_scsi_dev_t *sd;
- int i, bus, target, lun;
- unsigned char addr1[8], addr2[8];
-
- if (n >= CCISS_MAX_SCSI_DEVS_PER_HBA) {
-- printk("cciss%d: Too many devices, "
-- "some will be inaccessible.\n", ctlr);
-+ dev_warn(&h->pdev->dev, "Too many devices, "
-+ "some will be inaccessible.\n");
- return -1;
- }
-
-@@ -385,7 +401,7 @@ cciss_scsi_add_entry(int ctlr, int hostno,
- memcpy(addr1, device->scsi3addr, 8);
- addr1[4] = 0;
- for (i = 0; i < n; i++) {
-- sd = &ccissscsi[ctlr].dev[i];
-+ sd = &ccissscsi[h->ctlr].dev[i];
- memcpy(addr2, sd->scsi3addr, 8);
- addr2[4] = 0;
- /* differ only in byte 4? */
-@@ -398,9 +414,9 @@ cciss_scsi_add_entry(int ctlr, int hostno,
- }
- }
-
-- sd = &ccissscsi[ctlr].dev[n];
-+ sd = &ccissscsi[h->ctlr].dev[n];
- if (lun == 0) {
-- if (find_bus_target_lun(ctlr,
-+ if (find_bus_target_lun(h,
- &sd->bus, &sd->target, &sd->lun) != 0)
- return -1;
- } else {
-@@ -419,37 +435,37 @@ cciss_scsi_add_entry(int ctlr, int hostno,
- memcpy(sd->device_id, device->device_id, sizeof(sd->device_id));
- sd->devtype = device->devtype;
-
-- ccissscsi[ctlr].ndevices++;
-+ ccissscsi[h->ctlr].ndevices++;
-
-- /* initially, (before registering with scsi layer) we don't
-- know our hostno and we don't want to print anything first
-+ /* initially, (before registering with scsi layer) we don't
-+ know our hostno and we don't want to print anything first
- time anyway (the scsi layer's inquiries will show that info) */
- if (hostno != -1)
-- printk("cciss%d: %s device c%db%dt%dl%d added.\n",
-- ctlr, scsi_device_type(sd->devtype), hostno,
-+ dev_info(&h->pdev->dev, "%s device c%db%dt%dl%d added.\n",
-+ scsi_device_type(sd->devtype), hostno,
- sd->bus, sd->target, sd->lun);
- return 0;
- }
-
- static void
--cciss_scsi_remove_entry(int ctlr, int hostno, int entry,
-+cciss_scsi_remove_entry(ctlr_info_t *h, int hostno, int entry,
- struct scsi2map *removed, int *nremoved)
- {
-- /* assumes hba[ctlr]->scsi_ctlr->lock is held */
-+ /* assumes h->ctlr]->scsi_ctlr->lock is held */
- int i;
- struct cciss_scsi_dev_t sd;
-
- if (entry < 0 || entry >= CCISS_MAX_SCSI_DEVS_PER_HBA) return;
-- sd = ccissscsi[ctlr].dev[entry];
-+ sd = ccissscsi[h->ctlr].dev[entry];
- removed[*nremoved].bus = sd.bus;
- removed[*nremoved].target = sd.target;
- removed[*nremoved].lun = sd.lun;
- (*nremoved)++;
-- for (i=entry;i<ccissscsi[ctlr].ndevices-1;i++)
-- ccissscsi[ctlr].dev[i] = ccissscsi[ctlr].dev[i+1];
-- ccissscsi[ctlr].ndevices--;
-- printk("cciss%d: %s device c%db%dt%dl%d removed.\n",
-- ctlr, scsi_device_type(sd.devtype), hostno,
-+ for (i = entry; i < ccissscsi[h->ctlr].ndevices-1; i++)
-+ ccissscsi[h->ctlr].dev[i] = ccissscsi[h->ctlr].dev[i+1];
-+ ccissscsi[h->ctlr].ndevices--;
-+ dev_info(&h->pdev->dev, "%s device c%db%dt%dl%d removed.\n",
-+ scsi_device_type(sd.devtype), hostno,
- sd.bus, sd.target, sd.lun);
- }
-
-@@ -464,24 +480,24 @@ cciss_scsi_remove_entry(int ctlr, int hostno, int entry,
- (a)[1] == (b)[1] && \
- (a)[0] == (b)[0])
-
--static void fixup_botched_add(int ctlr, char *scsi3addr)
-+static void fixup_botched_add(ctlr_info_t *h, char *scsi3addr)
- {
- /* called when scsi_add_device fails in order to re-adjust */
- /* ccissscsi[] to match the mid layer's view. */
- unsigned long flags;
- int i, j;
-- CPQ_TAPE_LOCK(ctlr, flags);
-- for (i = 0; i < ccissscsi[ctlr].ndevices; i++) {
-+ CPQ_TAPE_LOCK(h, flags);
-+ for (i = 0; i < ccissscsi[h->ctlr].ndevices; i++) {
- if (memcmp(scsi3addr,
-- ccissscsi[ctlr].dev[i].scsi3addr, 8) == 0) {
-- for (j = i; j < ccissscsi[ctlr].ndevices-1; j++)
-- ccissscsi[ctlr].dev[j] =
-- ccissscsi[ctlr].dev[j+1];
-- ccissscsi[ctlr].ndevices--;
-+ ccissscsi[h->ctlr].dev[i].scsi3addr, 8) == 0) {
-+ for (j = i; j < ccissscsi[h->ctlr].ndevices-1; j++)
-+ ccissscsi[h->ctlr].dev[j] =
-+ ccissscsi[h->ctlr].dev[j+1];
-+ ccissscsi[h->ctlr].ndevices--;
- break;
- }
- }
-- CPQ_TAPE_UNLOCK(ctlr, flags);
-+ CPQ_TAPE_UNLOCK(h, flags);
- }
-
- static int device_is_the_same(struct cciss_scsi_dev_t *dev1,
-@@ -501,13 +517,13 @@ static int device_is_the_same(struct cciss_scsi_dev_t *dev1,
- }
-
- static int
--adjust_cciss_scsi_table(int ctlr, int hostno,
-+adjust_cciss_scsi_table(ctlr_info_t *h, int hostno,
- struct cciss_scsi_dev_t sd[], int nsds)
- {
- /* sd contains scsi3 addresses and devtypes, but
- bus target and lun are not filled in. This funciton
- takes what's in sd to be the current and adjusts
-- ccissscsi[] to be in line with what's in sd. */
-+ ccissscsi[] to be in line with what's in sd. */
-
- int i,j, found, changes=0;
- struct cciss_scsi_dev_t *csd;
-@@ -522,25 +538,24 @@ adjust_cciss_scsi_table(int ctlr, int hostno,
- GFP_KERNEL);
-
- if (!added || !removed) {
-- printk(KERN_WARNING "cciss%d: Out of memory in "
-- "adjust_cciss_scsi_table\n", ctlr);
-+ dev_warn(&h->pdev->dev,
-+ "Out of memory in adjust_cciss_scsi_table\n");
- goto free_and_out;
- }
-
-- CPQ_TAPE_LOCK(ctlr, flags);
-+ CPQ_TAPE_LOCK(h, flags);
-
- if (hostno != -1) /* if it's not the first time... */
-- sh = ((struct cciss_scsi_adapter_data_t *)
-- hba[ctlr]->scsi_ctlr)->scsi_host;
-+ sh = h->scsi_ctlr->scsi_host;
-
-- /* find any devices in ccissscsi[] that are not in
-+ /* find any devices in ccissscsi[] that are not in
- sd[] and remove them from ccissscsi[] */
-
- i = 0;
- nremoved = 0;
- nadded = 0;
-- while(i<ccissscsi[ctlr].ndevices) {
-- csd = &ccissscsi[ctlr].dev[i];
-+ while (i < ccissscsi[h->ctlr].ndevices) {
-+ csd = &ccissscsi[h->ctlr].dev[i];
- found=0;
- for (j=0;j<nsds;j++) {
- if (SCSI3ADDR_EQ(sd[j].scsi3addr,
-@@ -553,22 +568,20 @@ adjust_cciss_scsi_table(int ctlr, int hostno,
- }
- }
-
-- if (found == 0) { /* device no longer present. */
-+ if (found == 0) { /* device no longer present. */
- changes++;
-- /* printk("cciss%d: %s device c%db%dt%dl%d removed.\n",
-- ctlr, scsi_device_type(csd->devtype), hostno,
-- csd->bus, csd->target, csd->lun); */
-- cciss_scsi_remove_entry(ctlr, hostno, i,
-+ cciss_scsi_remove_entry(h, hostno, i,
- removed, &nremoved);
- /* remove ^^^, hence i not incremented */
- } else if (found == 1) { /* device is different in some way */
- changes++;
-- printk("cciss%d: device c%db%dt%dl%d has changed.\n",
-- ctlr, hostno, csd->bus, csd->target, csd->lun);
-- cciss_scsi_remove_entry(ctlr, hostno, i,
-+ dev_info(&h->pdev->dev,
-+ "device c%db%dt%dl%d has changed.\n",
-+ hostno, csd->bus, csd->target, csd->lun);
-+ cciss_scsi_remove_entry(h, hostno, i,
- removed, &nremoved);
- /* remove ^^^, hence i not incremented */
-- if (cciss_scsi_add_entry(ctlr, hostno, &sd[j],
-+ if (cciss_scsi_add_entry(h, hostno, &sd[j],
- added, &nadded) != 0)
- /* we just removed one, so add can't fail. */
- BUG();
-@@ -590,8 +603,8 @@ adjust_cciss_scsi_table(int ctlr, int hostno,
-
- for (i=0;i<nsds;i++) {
- found=0;
-- for (j=0;j<ccissscsi[ctlr].ndevices;j++) {
-- csd = &ccissscsi[ctlr].dev[j];
-+ for (j = 0; j < ccissscsi[h->ctlr].ndevices; j++) {
-+ csd = &ccissscsi[h->ctlr].dev[j];
- if (SCSI3ADDR_EQ(sd[i].scsi3addr,
- csd->scsi3addr)) {
- if (device_is_the_same(&sd[i], csd))
-@@ -603,18 +616,18 @@ adjust_cciss_scsi_table(int ctlr, int hostno,
- }
- if (!found) {
- changes++;
-- if (cciss_scsi_add_entry(ctlr, hostno, &sd[i],
-+ if (cciss_scsi_add_entry(h, hostno, &sd[i],
- added, &nadded) != 0)
- break;
- } else if (found == 1) {
- /* should never happen... */
- changes++;
-- printk(KERN_WARNING "cciss%d: device "
-- "unexpectedly changed\n", ctlr);
-+ dev_warn(&h->pdev->dev,
-+ "device unexpectedly changed\n");
- /* but if it does happen, we just ignore that device */
- }
- }
-- CPQ_TAPE_UNLOCK(ctlr, flags);
-+ CPQ_TAPE_UNLOCK(h, flags);
-
- /* Don't notify scsi mid layer of any changes the first time through */
- /* (or if there are no changes) scsi_scan_host will do it later the */
-@@ -634,9 +647,9 @@ adjust_cciss_scsi_table(int ctlr, int hostno,
- /* We don't expect to get here. */
- /* future cmds to this device will get selection */
- /* timeout as if the device was gone. */
-- printk(KERN_WARNING "cciss%d: didn't find "
-+ dev_warn(&h->pdev->dev, "didn't find "
- "c%db%dt%dl%d\n for removal.",
-- ctlr, hostno, removed[i].bus,
-+ hostno, removed[i].bus,
- removed[i].target, removed[i].lun);
- }
- }
-@@ -648,13 +661,12 @@ adjust_cciss_scsi_table(int ctlr, int hostno,
- added[i].target, added[i].lun);
- if (rc == 0)
- continue;
-- printk(KERN_WARNING "cciss%d: scsi_add_device "
-+ dev_warn(&h->pdev->dev, "scsi_add_device "
- "c%db%dt%dl%d failed, device not added.\n",
-- ctlr, hostno,
-- added[i].bus, added[i].target, added[i].lun);
-+ hostno, added[i].bus, added[i].target, added[i].lun);
- /* now we have to remove it from ccissscsi, */
- /* since it didn't get added to scsi mid layer */
-- fixup_botched_add(ctlr, added[i].scsi3addr);
-+ fixup_botched_add(h, added[i].scsi3addr);
- }
-
- free_and_out:
-@@ -664,33 +676,33 @@ free_and_out:
- }
-
- static int
--lookup_scsi3addr(int ctlr, int bus, int target, int lun, char *scsi3addr)
-+lookup_scsi3addr(ctlr_info_t *h, int bus, int target, int lun, char *scsi3addr)
- {
- int i;
- struct cciss_scsi_dev_t *sd;
- unsigned long flags;
-
-- CPQ_TAPE_LOCK(ctlr, flags);
-- for (i=0;i<ccissscsi[ctlr].ndevices;i++) {
-- sd = &ccissscsi[ctlr].dev[i];
-+ CPQ_TAPE_LOCK(h, flags);
-+ for (i = 0; i < ccissscsi[h->ctlr].ndevices; i++) {
-+ sd = &ccissscsi[h->ctlr].dev[i];
- if (sd->bus == bus &&
- sd->target == target &&
- sd->lun == lun) {
- memcpy(scsi3addr, &sd->scsi3addr[0], 8);
-- CPQ_TAPE_UNLOCK(ctlr, flags);
-+ CPQ_TAPE_UNLOCK(h, flags);
- return 0;
- }
- }
-- CPQ_TAPE_UNLOCK(ctlr, flags);
-+ CPQ_TAPE_UNLOCK(h, flags);
- return -1;
- }
-
--static void
--cciss_scsi_setup(int cntl_num)
-+static void
-+cciss_scsi_setup(ctlr_info_t *h)
- {
- struct cciss_scsi_adapter_data_t * shba;
-
-- ccissscsi[cntl_num].ndevices = 0;
-+ ccissscsi[h->ctlr].ndevices = 0;
- shba = (struct cciss_scsi_adapter_data_t *)
- kmalloc(sizeof(*shba), GFP_KERNEL);
- if (shba == NULL)
-@@ -698,33 +710,35 @@ cciss_scsi_setup(int cntl_num)
- shba->scsi_host = NULL;
- spin_lock_init(&shba->lock);
- shba->registered = 0;
-- if (scsi_cmd_stack_setup(cntl_num, shba) != 0) {
-+ if (scsi_cmd_stack_setup(h, shba) != 0) {
- kfree(shba);
- shba = NULL;
- }
-- hba[cntl_num]->scsi_ctlr = (void *) shba;
-+ h->scsi_ctlr = shba;
- return;
- }
-
--static void
--complete_scsi_command( CommandList_struct *cp, int timeout, __u32 tag)
-+static void complete_scsi_command(CommandList_struct *c, int timeout,
-+ __u32 tag)
- {
- struct scsi_cmnd *cmd;
-- ctlr_info_t *ctlr;
-+ ctlr_info_t *h;
- ErrorInfo_struct *ei;
-
-- ei = cp->err_info;
-+ ei = c->err_info;
-
- /* First, see if it was a message rather than a command */
-- if (cp->Request.Type.Type == TYPE_MSG) {
-- cp->cmd_type = CMD_MSG_DONE;
-+ if (c->Request.Type.Type == TYPE_MSG) {
-+ c->cmd_type = CMD_MSG_DONE;
- return;
- }
-
-- cmd = (struct scsi_cmnd *) cp->scsi_cmd;
-- ctlr = hba[cp->ctlr];
-+ cmd = (struct scsi_cmnd *) c->scsi_cmd;
-+ h = hba[c->ctlr];
-
- scsi_dma_unmap(cmd);
-+ if (c->Header.SGTotal > h->max_cmd_sgentries)
-+ cciss_unmap_sg_chain_block(h, c);
-
- cmd->result = (DID_OK << 16); /* host byte */
- cmd->result |= (COMMAND_COMPLETE << 8); /* msg byte */
-@@ -735,19 +749,27 @@ complete_scsi_command( CommandList_struct *cp, int timeout, __u32 tag)
-
- /* copy the sense data whether we need to or not. */
-
-- memcpy(cmd->sense_buffer, ei->SenseInfo,
-+ memcpy(cmd->sense_buffer, ei->SenseInfo,
- ei->SenseLen > SCSI_SENSE_BUFFERSIZE ?
-- SCSI_SENSE_BUFFERSIZE :
-+ SCSI_SENSE_BUFFERSIZE :
- ei->SenseLen);
- scsi_set_resid(cmd, ei->ResidualCnt);
-
-- if(ei->CommandStatus != 0)
-- { /* an error has occurred */
-+ if(ei->CommandStatus != 0)
-+ { /* an error has occurred */
- switch(ei->CommandStatus)
- {
- case CMD_TARGET_STATUS:
- /* Pass it up to the upper layers... */
-- if (!ei->ScsiStatus) {
-+ if( ei->ScsiStatus)
-+ {
-+#if 0
-+ printk(KERN_WARNING "cciss: cmd %p "
-+ "has SCSI Status = %x\n",
-+ c, ei->ScsiStatus);
-+#endif
-+ }
-+ else { /* scsi status is zero??? How??? */
-
- /* Ordinarily, this case should never happen, but there is a bug
- in some released firmware revisions that allows it to happen
-@@ -763,15 +785,15 @@ complete_scsi_command( CommandList_struct *cp, int timeout, __u32 tag)
- case CMD_DATA_UNDERRUN: /* let mid layer handle it. */
- break;
- case CMD_DATA_OVERRUN:
-- printk(KERN_WARNING "cciss: cp %p has"
-+ dev_warn(&h->pdev->dev, "%p has"
- " completed with data overrun "
-- "reported\n", cp);
-+ "reported\n", c);
- break;
- case CMD_INVALID: {
-- /* print_bytes(cp, sizeof(*cp), 1, 0);
-- print_cmd(cp); */
-+ /* print_bytes(c, sizeof(*c), 1, 0);
-+ print_cmd(c); */
- /* We get CMD_INVALID if you address a non-existent tape drive instead
-- of a selection timeout (no response). You will see this if you yank
-+ of a selection timeout (no response). You will see this if you yank
- out a tape drive, then try to access it. This is kind of a shame
- because it means that any other CMD_INVALID (e.g. driver bug) will
- get interpreted as a missing target. */
-@@ -779,54 +801,55 @@ complete_scsi_command( CommandList_struct *cp, int timeout, __u32 tag)
- }
- break;
- case CMD_PROTOCOL_ERR:
-- printk(KERN_WARNING "cciss: cp %p has "
-- "protocol error \n", cp);
-+ dev_warn(&h->pdev->dev,
-+ "%p has protocol error\n", c);
- break;
- case CMD_HARDWARE_ERR:
- cmd->result = DID_ERROR << 16;
-- printk(KERN_WARNING "cciss: cp %p had "
-- " hardware error\n", cp);
-+ dev_warn(&h->pdev->dev,
-+ "%p had hardware error\n", c);
- break;
- case CMD_CONNECTION_LOST:
- cmd->result = DID_ERROR << 16;
-- printk(KERN_WARNING "cciss: cp %p had "
-- "connection lost\n", cp);
-+ dev_warn(&h->pdev->dev,
-+ "%p had connection lost\n", c);
- break;
- case CMD_ABORTED:
- cmd->result = DID_ABORT << 16;
-- printk(KERN_WARNING "cciss: cp %p was "
-- "aborted\n", cp);
-+ dev_warn(&h->pdev->dev, "%p was aborted\n", c);
- break;
- case CMD_ABORT_FAILED:
- cmd->result = DID_ERROR << 16;
-- printk(KERN_WARNING "cciss: cp %p reports "
-- "abort failed\n", cp);
-+ dev_warn(&h->pdev->dev,
-+ "%p reports abort failed\n", c);
- break;
- case CMD_UNSOLICITED_ABORT:
- cmd->result = DID_ABORT << 16;
-- printk(KERN_WARNING "cciss: cp %p aborted "
-- "do to an unsolicited abort\n", cp);
-+ dev_warn(&h->pdev->dev, "%p aborted do to an "
-+ "unsolicited abort\n", c);
- break;
- case CMD_TIMEOUT:
- cmd->result = DID_TIME_OUT << 16;
-- printk(KERN_WARNING "cciss: cp %p timedout\n",
-- cp);
-+ dev_warn(&h->pdev->dev, "%p timedout\n", c);
-+ break;
-+ case CMD_UNABORTABLE:
-+ cmd->result = DID_ERROR << 16;
-+ dev_warn(&h->pdev->dev, "c %p command "
-+ "unabortable\n", c);
- break;
- default:
- cmd->result = DID_ERROR << 16;
-- printk(KERN_WARNING "cciss: cp %p returned "
-- "unknown status %x\n", cp,
-- ei->CommandStatus);
-+ dev_warn(&h->pdev->dev,
-+ "%p returned unknown status %x\n", c,
-+ ei->CommandStatus);
- }
- }
-- // printk("c:%p:c%db%dt%dl%d ", cmd, ctlr->ctlr, cmd->channel,
-- // cmd->target, cmd->lun);
- cmd->scsi_done(cmd);
-- scsi_cmd_free(ctlr, cp);
-+ scsi_cmd_free(h, c);
- }
-
- static int
--cciss_scsi_detect(int ctlr)
-+cciss_scsi_detect(ctlr_info_t *h)
- {
- struct Scsi_Host *sh;
- int error;
-@@ -834,16 +857,20 @@ cciss_scsi_detect(int ctlr)
- sh = scsi_host_alloc(&cciss_driver_template, sizeof(struct ctlr_info *));
- if (sh == NULL)
- goto fail;
-- sh->io_port = 0; // good enough? FIXME,
-+ sh->io_port = 0; // good enough? FIXME,
- sh->n_io_port = 0; // I don't think we use these two...
-- sh->this_id = SELF_SCSI_ID;
-+ sh->this_id = SELF_SCSI_ID;
-+ sh->sg_tablesize = h->maxsgentries;
-+ sh->can_queue = cciss_tape_cmds;
-+ sh->max_cmd_len = MAX_COMMAND_SIZE;
-+ sh->max_sectors = h->cciss_max_sectors;
-
-- ((struct cciss_scsi_adapter_data_t *)
-- hba[ctlr]->scsi_ctlr)->scsi_host = (void *) sh;
-- sh->hostdata[0] = (unsigned long) hba[ctlr];
-- sh->irq = hba[ctlr]->intr[SIMPLE_MODE_INT];
-+ ((struct cciss_scsi_adapter_data_t *)
-+ h->scsi_ctlr)->scsi_host = sh;
-+ sh->hostdata[0] = (unsigned long) h;
-+ sh->irq = h->intr[SIMPLE_MODE_INT];
- sh->unique_id = sh->irq;
-- error = scsi_add_host(sh, &hba[ctlr]->pdev->dev);
-+ error = scsi_add_host(sh, &h->pdev->dev);
- if (error)
- goto fail_host_put;
- scsi_scan_host(sh);
-@@ -857,20 +884,20 @@ cciss_scsi_detect(int ctlr)
-
- static void
- cciss_unmap_one(struct pci_dev *pdev,
-- CommandList_struct *cp,
-+ CommandList_struct *c,
- size_t buflen,
- int data_direction)
- {
- u64bit addr64;
-
-- addr64.val32.lower = cp->SG[0].Addr.lower;
-- addr64.val32.upper = cp->SG[0].Addr.upper;
-+ addr64.val32.lower = c->SG[0].Addr.lower;
-+ addr64.val32.upper = c->SG[0].Addr.upper;
- pci_unmap_single(pdev, (dma_addr_t) addr64.val, buflen, data_direction);
- }
-
- static void
- cciss_map_one(struct pci_dev *pdev,
-- CommandList_struct *cp,
-+ CommandList_struct *c,
- unsigned char *buf,
- size_t buflen,
- int data_direction)
-@@ -878,164 +905,153 @@ cciss_map_one(struct pci_dev *pdev,
- __u64 addr64;
-
- addr64 = (__u64) pci_map_single(pdev, buf, buflen, data_direction);
-- cp->SG[0].Addr.lower =
-+ c->SG[0].Addr.lower =
- (__u32) (addr64 & (__u64) 0x00000000FFFFFFFF);
-- cp->SG[0].Addr.upper =
-+ c->SG[0].Addr.upper =
- (__u32) ((addr64 >> 32) & (__u64) 0x00000000FFFFFFFF);
-- cp->SG[0].Len = buflen;
-- cp->Header.SGList = (__u8) 1; /* no. SGs contig in this cmd */
-- cp->Header.SGTotal = (__u16) 1; /* total sgs in this cmd list */
-+ c->SG[0].Len = buflen;
-+ c->Header.SGList = (__u8) 1; /* no. SGs contig in this cmd */
-+ c->Header.SGTotal = (__u16) 1; /* total sgs in this cmd list */
- }
-
- static int
--cciss_scsi_do_simple_cmd(ctlr_info_t *c,
-- CommandList_struct *cp,
-- unsigned char *scsi3addr,
-+cciss_scsi_do_simple_cmd(ctlr_info_t *h,
-+ CommandList_struct *c,
-+ unsigned char *scsi3addr,
- unsigned char *cdb,
- unsigned char cdblen,
- unsigned char *buf, int bufsize,
- int direction)
- {
-- unsigned long flags;
- DECLARE_COMPLETION_ONSTACK(wait);
-
-- cp->cmd_type = CMD_IOCTL_PEND; // treat this like an ioctl
-- cp->scsi_cmd = NULL;
-- cp->Header.ReplyQueue = 0; // unused in simple mode
-- memcpy(&cp->Header.LUN, scsi3addr, sizeof(cp->Header.LUN));
-- cp->Header.Tag.lower = cp->busaddr; // Use k. address of cmd as tag
-+ c->cmd_type = CMD_IOCTL_PEND; /* treat this like an ioctl */
-+ c->scsi_cmd = NULL;
-+ c->Header.ReplyQueue = 0; /* unused in simple mode */
-+ memcpy(&c->Header.LUN, scsi3addr, sizeof(c->Header.LUN));
-+ c->Header.Tag.lower = c->busaddr; /* Use k. address of cmd as tag */
- // Fill in the request block...
-
-- /* printk("Using scsi3addr 0x%02x%0x2%0x2%0x2%0x2%0x2%0x2%0x2\n",
-+ /* printk("Using scsi3addr 0x%02x%0x2%0x2%0x2%0x2%0x2%0x2%0x2\n",
- scsi3addr[0], scsi3addr[1], scsi3addr[2], scsi3addr[3],
- scsi3addr[4], scsi3addr[5], scsi3addr[6], scsi3addr[7]); */
-
-- memset(cp->Request.CDB, 0, sizeof(cp->Request.CDB));
-- memcpy(cp->Request.CDB, cdb, cdblen);
-- cp->Request.Timeout = 0;
-- cp->Request.CDBLen = cdblen;
-- cp->Request.Type.Type = TYPE_CMD;
-- cp->Request.Type.Attribute = ATTR_SIMPLE;
-- cp->Request.Type.Direction = direction;
-+ memset(c->Request.CDB, 0, sizeof(c->Request.CDB));
-+ memcpy(c->Request.CDB, cdb, cdblen);
-+ c->Request.Timeout = 0;
-+ c->Request.CDBLen = cdblen;
-+ c->Request.Type.Type = TYPE_CMD;
-+ c->Request.Type.Attribute = ATTR_SIMPLE;
-+ c->Request.Type.Direction = direction;
-
- /* Fill in the SG list and do dma mapping */
-- cciss_map_one(c->pdev, cp, (unsigned char *) buf,
-- bufsize, DMA_FROM_DEVICE);
--
-- cp->waiting = &wait;
--
-- /* Put the request on the tail of the request queue */
-- spin_lock_irqsave(CCISS_LOCK(c->ctlr), flags);
-- addQ(&c->reqQ, cp);
-- c->Qdepth++;
-- start_io(c);
-- spin_unlock_irqrestore(CCISS_LOCK(c->ctlr), flags);
-+ cciss_map_one(h->pdev, c, (unsigned char *) buf,
-+ bufsize, DMA_FROM_DEVICE);
-
-+ c->waiting = &wait;
-+ enqueue_cmd_and_start_io(h, c);
- wait_for_completion(&wait);
-
- /* undo the dma mapping */
-- cciss_unmap_one(c->pdev, cp, bufsize, DMA_FROM_DEVICE);
-+ cciss_unmap_one(h->pdev, c, bufsize, DMA_FROM_DEVICE);
- return(0);
- }
-
--static void
--cciss_scsi_interpret_error(CommandList_struct *cp)
-+static void
-+cciss_scsi_interpret_error(ctlr_info_t *h, CommandList_struct *c)
- {
- ErrorInfo_struct *ei;
-
-- ei = cp->err_info;
-+ ei = c->err_info;
- switch(ei->CommandStatus)
- {
- case CMD_TARGET_STATUS:
-- printk(KERN_WARNING "cciss: cmd %p has "
-- "completed with errors\n", cp);
-- printk(KERN_WARNING "cciss: cmd %p "
-- "has SCSI Status = %x\n",
-- cp,
-- ei->ScsiStatus);
-+ dev_warn(&h->pdev->dev,
-+ "cmd %p has completed with errors\n", c);
-+ dev_warn(&h->pdev->dev,
-+ "cmd %p has SCSI Status = %x\n",
-+ c, ei->ScsiStatus);
- if (ei->ScsiStatus == 0)
-- printk(KERN_WARNING
-- "cciss:SCSI status is abnormally zero. "
-+ dev_warn(&h->pdev->dev,
-+ "SCSI status is abnormally zero. "
- "(probably indicates selection timeout "
- "reported incorrectly due to a known "
- "firmware bug, circa July, 2001.)\n");
- break;
- case CMD_DATA_UNDERRUN: /* let mid layer handle it. */
-- printk("UNDERRUN\n");
-+ dev_info(&h->pdev->dev, "UNDERRUN\n");
- break;
- case CMD_DATA_OVERRUN:
-- printk(KERN_WARNING "cciss: cp %p has"
-+ dev_warn(&h->pdev->dev, "%p has"
- " completed with data overrun "
-- "reported\n", cp);
-+ "reported\n", c);
- break;
- case CMD_INVALID: {
- /* controller unfortunately reports SCSI passthru's */
- /* to non-existent targets as invalid commands. */
-- printk(KERN_WARNING "cciss: cp %p is "
-- "reported invalid (probably means "
-- "target device no longer present)\n",
-- cp);
-- /* print_bytes((unsigned char *) cp, sizeof(*cp), 1, 0);
-- print_cmd(cp); */
-+ dev_warn(&h->pdev->dev,
-+ "%p is reported invalid (probably means "
-+ "target device no longer present)\n", c);
-+ /* print_bytes((unsigned char *) c, sizeof(*c), 1, 0);
-+ print_cmd(c); */
- }
- break;
- case CMD_PROTOCOL_ERR:
-- printk(KERN_WARNING "cciss: cp %p has "
-- "protocol error \n", cp);
-+ dev_warn(&h->pdev->dev, "%p has protocol error\n", c);
- break;
- case CMD_HARDWARE_ERR:
- /* cmd->result = DID_ERROR << 16; */
-- printk(KERN_WARNING "cciss: cp %p had "
-- " hardware error\n", cp);
-+ dev_warn(&h->pdev->dev, "%p had hardware error\n", c);
- break;
- case CMD_CONNECTION_LOST:
-- printk(KERN_WARNING "cciss: cp %p had "
-- "connection lost\n", cp);
-+ dev_warn(&h->pdev->dev, "%p had connection lost\n", c);
- break;
- case CMD_ABORTED:
-- printk(KERN_WARNING "cciss: cp %p was "
-- "aborted\n", cp);
-+ dev_warn(&h->pdev->dev, "%p was aborted\n", c);
- break;
- case CMD_ABORT_FAILED:
-- printk(KERN_WARNING "cciss: cp %p reports "
-- "abort failed\n", cp);
-+ dev_warn(&h->pdev->dev,
-+ "%p reports abort failed\n", c);
- break;
- case CMD_UNSOLICITED_ABORT:
-- printk(KERN_WARNING "cciss: cp %p aborted "
-- "do to an unsolicited abort\n", cp);
-+ dev_warn(&h->pdev->dev,
-+ "%p aborted due to an unsolicited abort\n", c);
- break;
- case CMD_TIMEOUT:
-- printk(KERN_WARNING "cciss: cp %p timedout\n",
-- cp);
-+ dev_warn(&h->pdev->dev, "%p timedout\n", c);
-+ break;
-+ case CMD_UNABORTABLE:
-+ dev_warn(&h->pdev->dev,
-+ "%p unabortable\n", c);
- break;
- default:
-- printk(KERN_WARNING "cciss: cp %p returned "
-- "unknown status %x\n", cp,
-- ei->CommandStatus);
-+ dev_warn(&h->pdev->dev,
-+ "%p returned unknown status %x\n",
-+ c, ei->CommandStatus);
- }
- }
-
- static int
--cciss_scsi_do_inquiry(ctlr_info_t *c, unsigned char *scsi3addr,
-+cciss_scsi_do_inquiry(ctlr_info_t *h, unsigned char *scsi3addr,
- unsigned char page, unsigned char *buf,
- unsigned char bufsize)
- {
- int rc;
-- CommandList_struct *cp;
-+ CommandList_struct *c;
- char cdb[6];
- ErrorInfo_struct *ei;
- unsigned long flags;
-
-- spin_lock_irqsave(CCISS_LOCK(c->ctlr), flags);
-- cp = scsi_cmd_alloc(c);
-- spin_unlock_irqrestore(CCISS_LOCK(c->ctlr), flags);
-+ spin_lock_irqsave(&h->lock, flags);
-+ c = scsi_cmd_alloc(h);
-+ spin_unlock_irqrestore(&h->lock, flags);
-
-- if (cp == NULL) { /* trouble... */
-- printk("cmd_alloc returned NULL!\n");
-+ if (c == NULL) { /* trouble... */
-+ dev_warn(&h->pdev->dev, "scsi_cmd_alloc returned NULL!\n");
- return -1;
- }
-
-- ei = cp->err_info;
-+ ei = c->err_info;
-
- cdb[0] = CISS_INQUIRY;
- cdb[1] = (page != 0);
-@@ -1043,24 +1059,24 @@ cciss_scsi_do_inquiry(ctlr_info_t *c, unsigned char *scsi3addr,
- cdb[3] = 0;
- cdb[4] = bufsize;
- cdb[5] = 0;
-- rc = cciss_scsi_do_simple_cmd(c, cp, scsi3addr, cdb,
-+ rc = cciss_scsi_do_simple_cmd(h, c, scsi3addr, cdb,
- 6, buf, bufsize, XFER_READ);
-
- if (rc != 0) return rc; /* something went wrong */
-
-- if (ei->CommandStatus != 0 &&
-+ if (ei->CommandStatus != 0 &&
- ei->CommandStatus != CMD_DATA_UNDERRUN) {
-- cciss_scsi_interpret_error(cp);
-+ cciss_scsi_interpret_error(h, c);
- rc = -1;
- }
-- spin_lock_irqsave(CCISS_LOCK(c->ctlr), flags);
-- scsi_cmd_free(c, cp);
-- spin_unlock_irqrestore(CCISS_LOCK(c->ctlr), flags);
-+ spin_lock_irqsave(&h->lock, flags);
-+ scsi_cmd_free(h, c);
-+ spin_unlock_irqrestore(&h->lock, flags);
- return rc;
- }
-
- /* Get the device id from inquiry page 0x83 */
--static int cciss_scsi_get_device_id(ctlr_info_t *c, unsigned char *scsi3addr,
-+static int cciss_scsi_get_device_id(ctlr_info_t *h, unsigned char *scsi3addr,
- unsigned char *device_id, int buflen)
- {
- int rc;
-@@ -1071,7 +1087,7 @@ static int cciss_scsi_get_device_id(ctlr_info_t *c, unsigned char *scsi3addr,
- buf = kzalloc(64, GFP_KERNEL);
- if (!buf)
- return -1;
-- rc = cciss_scsi_do_inquiry(c, scsi3addr, 0x83, buf, 64);
-+ rc = cciss_scsi_do_inquiry(h, scsi3addr, 0x83, buf, 64);
- if (rc == 0)
- memcpy(device_id, &buf[8], buflen);
- kfree(buf);
-@@ -1079,21 +1095,21 @@ static int cciss_scsi_get_device_id(ctlr_info_t *c, unsigned char *scsi3addr,
- }
-
- static int
--cciss_scsi_do_report_phys_luns(ctlr_info_t *c,
-+cciss_scsi_do_report_phys_luns(ctlr_info_t *h,
- ReportLunData_struct *buf, int bufsize)
- {
- int rc;
-- CommandList_struct *cp;
-+ CommandList_struct *c;
- unsigned char cdb[12];
-- unsigned char scsi3addr[8];
-+ unsigned char scsi3addr[8];
- ErrorInfo_struct *ei;
- unsigned long flags;
-
-- spin_lock_irqsave(CCISS_LOCK(c->ctlr), flags);
-- cp = scsi_cmd_alloc(c);
-- spin_unlock_irqrestore(CCISS_LOCK(c->ctlr), flags);
-- if (cp == NULL) { /* trouble... */
-- printk("cmd_alloc returned NULL!\n");
-+ spin_lock_irqsave(&h->lock, flags);
-+ c = scsi_cmd_alloc(h);
-+ spin_unlock_irqrestore(&h->lock, flags);
-+ if (c == NULL) { /* trouble... */
-+ dev_warn(&h->pdev->dev, "scsi_cmd_alloc returned NULL!\n");
- return -1;
- }
-
-@@ -1111,52 +1127,52 @@ cciss_scsi_do_report_phys_luns(ctlr_info_t *c,
- cdb[10] = 0;
- cdb[11] = 0;
-
-- rc = cciss_scsi_do_simple_cmd(c, cp, scsi3addr,
-- cdb, 12,
-- (unsigned char *) buf,
-+ rc = cciss_scsi_do_simple_cmd(h, c, scsi3addr,
-+ cdb, 12,
-+ (unsigned char *) buf,
- bufsize, XFER_READ);
-
- if (rc != 0) return rc; /* something went wrong */
-
-- ei = cp->err_info;
-- if (ei->CommandStatus != 0 &&
-+ ei = c->err_info;
-+ if (ei->CommandStatus != 0 &&
- ei->CommandStatus != CMD_DATA_UNDERRUN) {
-- cciss_scsi_interpret_error(cp);
-+ cciss_scsi_interpret_error(h, c);
- rc = -1;
- }
-- spin_lock_irqsave(CCISS_LOCK(c->ctlr), flags);
-- scsi_cmd_free(c, cp);
-- spin_unlock_irqrestore(CCISS_LOCK(c->ctlr), flags);
-+ spin_lock_irqsave(&h->lock, flags);
-+ scsi_cmd_free(h, c);
-+ spin_unlock_irqrestore(&h->lock, flags);
- return rc;
- }
-
- static void
--cciss_update_non_disk_devices(int cntl_num, int hostno)
-+cciss_update_non_disk_devices(ctlr_info_t *h, int hostno)
- {
- /* the idea here is we could get notified from /proc
-- that some devices have changed, so we do a report
-- physical luns cmd, and adjust our list of devices
-+ that some devices have changed, so we do a report
-+ physical luns cmd, and adjust our list of devices
- accordingly. (We can't rely on the scsi-mid layer just
-- doing inquiries, because the "busses" that the scsi
-+ doing inquiries, because the "busses" that the scsi
- mid-layer probes are totally fabricated by this driver,
- so new devices wouldn't show up.
-
-- the scsi3addr's of devices won't change so long as the
-- adapter is not reset. That means we can rescan and
-- tell which devices we already know about, vs. new
-+ the scsi3addr's of devices won't change so long as the
-+ adapter is not reset. That means we can rescan and
-+ tell which devices we already know about, vs. new
- devices, vs. disappearing devices.
-
- Also, if you yank out a tape drive, then put in a disk
-- in it's place, (say, a configured volume from another
-- array controller for instance) _don't_ poke this driver
-- (so it thinks it's still a tape, but _do_ poke the scsi
-- mid layer, so it does an inquiry... the scsi mid layer
-+ in it's place, (say, a configured volume from another
-+ array controller for instance) _don't_ poke this driver
-+ (so it thinks it's still a tape, but _do_ poke the scsi
-+ mid layer, so it does an inquiry... the scsi mid layer
- will see the physical disk. This would be bad. Need to
-- think about how to prevent that. One idea would be to
-+ think about how to prevent that. One idea would be to
- snoop all scsi responses and if an inquiry repsonse comes
- back that reports a disk, chuck it an return selection
- timeout instead and adjust our table... Not sure i like
-- that though.
-+ that though.
-
- */
- #define OBDR_TAPE_INQ_SIZE 49
-@@ -1164,7 +1180,6 @@ cciss_update_non_disk_devices(int cntl_num, int hostno)
- ReportLunData_struct *ld_buff;
- unsigned char *inq_buff;
- unsigned char scsi3addr[8];
-- ctlr_info_t *c;
- __u32 num_luns=0;
- unsigned char *ch;
- struct cciss_scsi_dev_t *currentsd, *this_device;
-@@ -1172,29 +1187,28 @@ cciss_update_non_disk_devices(int cntl_num, int hostno)
- int reportlunsize = sizeof(*ld_buff) + CISS_MAX_PHYS_LUN * 8;
- int i;
-
-- c = (ctlr_info_t *) hba[cntl_num];
- ld_buff = kzalloc(reportlunsize, GFP_KERNEL);
- inq_buff = kmalloc(OBDR_TAPE_INQ_SIZE, GFP_KERNEL);
- currentsd = kzalloc(sizeof(*currentsd) *
- (CCISS_MAX_SCSI_DEVS_PER_HBA+1), GFP_KERNEL);
- if (ld_buff == NULL || inq_buff == NULL || currentsd == NULL) {
-- printk(KERN_ERR "cciss: out of memory\n");
-+ dev_err(&h->pdev->dev, "out of memory\n");
- goto out;
- }
- this_device = ¤tsd[CCISS_MAX_SCSI_DEVS_PER_HBA];
-- if (cciss_scsi_do_report_phys_luns(c, ld_buff, reportlunsize) == 0) {
-+ if (cciss_scsi_do_report_phys_luns(h, ld_buff, reportlunsize) == 0) {
- ch = &ld_buff->LUNListLength[0];
- num_luns = ((ch[0]<<24) | (ch[1]<<16) | (ch[2]<<8) | ch[3]) / 8;
- if (num_luns > CISS_MAX_PHYS_LUN) {
-- printk(KERN_WARNING
-- "cciss: Maximum physical LUNs (%d) exceeded. "
-- "%d LUNs ignored.\n", CISS_MAX_PHYS_LUN,
-+ dev_warn(&h->pdev->dev,
-+ "Maximum physical LUNs (%d) exceeded. "
-+ "%d LUNs ignored.\n", CISS_MAX_PHYS_LUN,
- num_luns - CISS_MAX_PHYS_LUN);
- num_luns = CISS_MAX_PHYS_LUN;
- }
- }
- else {
-- printk(KERN_ERR "cciss: Report physical LUNs failed.\n");
-+ dev_err(&h->pdev->dev, "Report physical LUNs failed.\n");
- goto out;
- }
-
-@@ -1206,7 +1220,7 @@ cciss_update_non_disk_devices(int cntl_num, int hostno)
- memset(inq_buff, 0, OBDR_TAPE_INQ_SIZE);
- memcpy(&scsi3addr[0], &ld_buff->LUN[i][0], 8);
-
-- if (cciss_scsi_do_inquiry(hba[cntl_num], scsi3addr, 0, inq_buff,
-+ if (cciss_scsi_do_inquiry(h, scsi3addr, 0, inq_buff,
- (unsigned char) OBDR_TAPE_INQ_SIZE) != 0)
- /* Inquiry failed (msg printed already) */
- continue; /* so we will skip this device. */
-@@ -1224,7 +1238,7 @@ cciss_update_non_disk_devices(int cntl_num, int hostno)
- sizeof(this_device->revision));
- memset(this_device->device_id, 0,
- sizeof(this_device->device_id));
-- cciss_scsi_get_device_id(hba[cntl_num], scsi3addr,
-+ cciss_scsi_get_device_id(h, scsi3addr,
- this_device->device_id, sizeof(this_device->device_id));
-
- switch (this_device->devtype)
-@@ -1250,20 +1264,20 @@ cciss_update_non_disk_devices(int cntl_num, int hostno)
- case 0x01: /* sequential access, (tape) */
- case 0x08: /* medium changer */
- if (ncurrent >= CCISS_MAX_SCSI_DEVS_PER_HBA) {
-- printk(KERN_INFO "cciss%d: %s ignored, "
-- "too many devices.\n", cntl_num,
-+ dev_info(&h->pdev->dev, "%s ignored, "
-+ "too many devices.\n",
- scsi_device_type(this_device->devtype));
- break;
- }
- currentsd[ncurrent] = *this_device;
- ncurrent++;
- break;
-- default:
-+ default:
- break;
- }
- }
-
-- adjust_cciss_scsi_table(cntl_num, hostno, currentsd, ncurrent);
-+ adjust_cciss_scsi_table(h, hostno, currentsd, ncurrent);
- out:
- kfree(inq_buff);
- kfree(ld_buff);
-@@ -1282,12 +1296,12 @@ is_keyword(char *ptr, int len, char *verb) // Thanks to ncr53c8xx.c
- }
-
- static int
--cciss_scsi_user_command(int ctlr, int hostno, char *buffer, int length)
-+cciss_scsi_user_command(ctlr_info_t *h, int hostno, char *buffer, int length)
- {
- int arg_len;
-
- if ((arg_len = is_keyword(buffer, length, "rescan")) != 0)
-- cciss_update_non_disk_devices(ctlr, hostno);
-+ cciss_update_non_disk_devices(h, hostno);
- else
- return -EINVAL;
- return length;
-@@ -1304,20 +1318,16 @@ cciss_scsi_proc_info(struct Scsi_Host *sh,
- {
-
- int buflen, datalen;
-- ctlr_info_t *ci;
-+ ctlr_info_t *h;
- int i;
-- int cntl_num;
-
--
-- ci = (ctlr_info_t *) sh->hostdata[0];
-- if (ci == NULL) /* This really shouldn't ever happen. */
-+ h = (ctlr_info_t *) sh->hostdata[0];
-+ if (h == NULL) /* This really shouldn't ever happen. */
- return -EINVAL;
-
-- cntl_num = ci->ctlr; /* Get our index into the hba[] array */
--
- if (func == 0) { /* User is reading from /proc/scsi/ciss*?/?* */
- buflen = sprintf(buffer, "cciss%d: SCSI host: %d\n",
-- cntl_num, sh->host_no);
-+ h->ctlr, sh->host_no);
-
- /* this information is needed by apps to know which cciss
- device corresponds to which scsi host number without
-@@ -1327,8 +1337,9 @@ cciss_scsi_proc_info(struct Scsi_Host *sh,
- this info is for an app to be able to use to know how to
- get them back in sync. */
-
-- for (i=0;i<ccissscsi[cntl_num].ndevices;i++) {
-- struct cciss_scsi_dev_t *sd = &ccissscsi[cntl_num].dev[i];
-+ for (i = 0; i < ccissscsi[h->ctlr].ndevices; i++) {
-+ struct cciss_scsi_dev_t *sd =
-+ &ccissscsi[h->ctlr].dev[i];
- buflen += sprintf(&buffer[buflen], "c%db%dt%dl%d %02d "
- "0x%02x%02x%02x%02x%02x%02x%02x%02x\n",
- sh->host_no, sd->bus, sd->target, sd->lun,
-@@ -1346,61 +1357,78 @@ cciss_scsi_proc_info(struct Scsi_Host *sh,
- *start = buffer + offset;
- return(datalen);
- } else /* User is writing to /proc/scsi/cciss*?/?* ... */
-- return cciss_scsi_user_command(cntl_num, sh->host_no,
-+ return cciss_scsi_user_command(h, sh->host_no,
- buffer, length);
--}
-+}
-
--/* cciss_scatter_gather takes a struct scsi_cmnd, (cmd), and does the pci
-- dma mapping and fills in the scatter gather entries of the
-- cciss command, cp. */
-+/* cciss_scatter_gather takes a struct scsi_cmnd, (cmd), and does the pci
-+ dma mapping and fills in the scatter gather entries of the
-+ cciss command, c. */
-
--static void
--cciss_scatter_gather(struct pci_dev *pdev,
-- CommandList_struct *cp,
-- struct scsi_cmnd *cmd)
-+static void cciss_scatter_gather(ctlr_info_t *h, CommandList_struct *c,
-+ struct scsi_cmnd *cmd)
- {
- unsigned int len;
- struct scatterlist *sg;
- __u64 addr64;
-- int use_sg, i;
-+ int request_nsgs, i, chained, sg_index;
-+ struct cciss_scsi_adapter_data_t *sa = h->scsi_ctlr;
-+ SGDescriptor_struct *curr_sg;
-
-- BUG_ON(scsi_sg_count(cmd) > MAXSGENTRIES);
-+ BUG_ON(scsi_sg_count(cmd) > h->maxsgentries);
-
-- use_sg = scsi_dma_map(cmd);
-- if (use_sg) { /* not too many addrs? */
-- scsi_for_each_sg(cmd, sg, use_sg, i) {
-+ chained = 0;
-+ sg_index = 0;
-+ curr_sg = c->SG;
-+ request_nsgs = scsi_dma_map(cmd);
-+ if (request_nsgs) {
-+ scsi_for_each_sg(cmd, sg, request_nsgs, i) {
-+ if (sg_index + 1 == h->max_cmd_sgentries &&
-+ !chained && request_nsgs - i > 1) {
-+ chained = 1;
-+ sg_index = 0;
-+ curr_sg = sa->cmd_sg_list[c->cmdindex];
-+ }
- addr64 = (__u64) sg_dma_address(sg);
- len = sg_dma_len(sg);
-- cp->SG[i].Addr.lower =
-- (__u32) (addr64 & (__u64) 0x00000000FFFFFFFF);
-- cp->SG[i].Addr.upper =
-- (__u32) ((addr64 >> 32) & (__u64) 0x00000000FFFFFFFF);
-- cp->SG[i].Len = len;
-- cp->SG[i].Ext = 0; // we are not chaining
-+ curr_sg[sg_index].Addr.lower =
-+ (__u32) (addr64 & 0x0FFFFFFFFULL);
-+ curr_sg[sg_index].Addr.upper =
-+ (__u32) ((addr64 >> 32) & 0x0FFFFFFFFULL);
-+ curr_sg[sg_index].Len = len;
-+ curr_sg[sg_index].Ext = 0;
-+ ++sg_index;
- }
-+ if (chained)
-+ cciss_map_sg_chain_block(h, c,
-+ sa->cmd_sg_list[c->cmdindex],
-+ (request_nsgs - (h->max_cmd_sgentries - 1)) *
-+ sizeof(SGDescriptor_struct));
- }
--
-- cp->Header.SGList = (__u8) use_sg; /* no. SGs contig in this cmd */
-- cp->Header.SGTotal = (__u16) use_sg; /* total sgs in this cmd list */
-+ /* track how many SG entries we are using */
-+ if (request_nsgs > h->maxSG)
-+ h->maxSG = request_nsgs;
-+ c->Header.SGTotal = (__u16) request_nsgs + chained;
-+ if (request_nsgs > h->max_cmd_sgentries)
-+ c->Header.SGList = h->max_cmd_sgentries;
-+ else
-+ c->Header.SGList = c->Header.SGTotal;
- return;
- }
-
--
--static int
--cciss_scsi_queue_command (struct scsi_cmnd *cmd, void (* done)(struct scsi_cmnd *))
-+DECLARE_QUEUECOMMAND(cciss_scsi_queue_command)
- {
-- ctlr_info_t **c;
-- int ctlr, rc;
-+ ctlr_info_t *h;
-+ int rc;
- unsigned char scsi3addr[8];
-- CommandList_struct *cp;
-+ CommandList_struct *c;
- unsigned long flags;
-
- // Get the ptr to our adapter structure (hba[i]) out of cmd->host.
- // We violate cmd->host privacy here. (Is there another way?)
-- c = (ctlr_info_t **) &cmd->device->host->hostdata[0];
-- ctlr = (*c)->ctlr;
-+ h = (ctlr_info_t *) cmd->device->host->hostdata[0];
-
-- rc = lookup_scsi3addr(ctlr, cmd->device->channel, cmd->device->id,
-+ rc = lookup_scsi3addr(h, cmd->device->channel, cmd->device->id,
- cmd->device->lun, scsi3addr);
- if (rc != 0) {
- /* the scsi nexus does not match any that we presented... */
-@@ -1412,19 +1440,14 @@ cciss_scsi_queue_command (struct scsi_cmnd *cmd, void (* done)(struct scsi_cmnd
- return 0;
- }
-
-- /* printk("cciss_queue_command, p=%p, cmd=0x%02x, c%db%dt%dl%d\n",
-- cmd, cmd->cmnd[0], ctlr, cmd->channel, cmd->target, cmd->lun);*/
-- // printk("q:%p:c%db%dt%dl%d ", cmd, ctlr, cmd->channel,
-- // cmd->target, cmd->lun);
--
- /* Ok, we have a reasonable scsi nexus, so send the cmd down, and
- see what the device thinks of it. */
-
-- spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
-- cp = scsi_cmd_alloc(*c);
-- spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
-- if (cp == NULL) { /* trouble... */
-- printk("scsi_cmd_alloc returned NULL!\n");
-+ spin_lock_irqsave(&h->lock, flags);
-+ c = scsi_cmd_alloc(h);
-+ spin_unlock_irqrestore(&h->lock, flags);
-+ if (c == NULL) { /* trouble... */
-+ dev_warn(&h->pdev->dev, "scsi_cmd_alloc returned NULL!\n");
- /* FIXME: next 3 lines are -> BAD! <- */
- cmd->result = DID_NO_CONNECT << 16;
- done(cmd);
-@@ -1433,69 +1456,65 @@ cciss_scsi_queue_command (struct scsi_cmnd *cmd, void (* done)(struct scsi_cmnd
-
- // Fill in the command list header
-
-- cmd->scsi_done = done; // save this for use by completion code
-+ cmd->scsi_done = done; // save this for use by completion code
-
-- // save cp in case we have to abort it
-- cmd->host_scribble = (unsigned char *) cp;
-+ /* save c in case we have to abort it */
-+ cmd->host_scribble = (unsigned char *) c;
-
-- cp->cmd_type = CMD_SCSI;
-- cp->scsi_cmd = cmd;
-- cp->Header.ReplyQueue = 0; // unused in simple mode
-- memcpy(&cp->Header.LUN.LunAddrBytes[0], &scsi3addr[0], 8);
-- cp->Header.Tag.lower = cp->busaddr; // Use k. address of cmd as tag
-+ c->cmd_type = CMD_SCSI;
-+ c->scsi_cmd = cmd;
-+ c->Header.ReplyQueue = 0; /* unused in simple mode */
-+ memcpy(&c->Header.LUN.LunAddrBytes[0], &scsi3addr[0], 8);
-+ c->Header.Tag.lower = c->busaddr; /* Use k. address of cmd as tag */
-
- // Fill in the request block...
-
-- cp->Request.Timeout = 0;
-- memset(cp->Request.CDB, 0, sizeof(cp->Request.CDB));
-- BUG_ON(cmd->cmd_len > sizeof(cp->Request.CDB));
-- cp->Request.CDBLen = cmd->cmd_len;
-- memcpy(cp->Request.CDB, cmd->cmnd, cmd->cmd_len);
-- cp->Request.Type.Type = TYPE_CMD;
-- cp->Request.Type.Attribute = ATTR_SIMPLE;
-+ c->Request.Timeout = 0;
-+ memset(c->Request.CDB, 0, sizeof(c->Request.CDB));
-+ BUG_ON(cmd->cmd_len > sizeof(c->Request.CDB));
-+ c->Request.CDBLen = cmd->cmd_len;
-+ memcpy(c->Request.CDB, cmd->cmnd, cmd->cmd_len);
-+ c->Request.Type.Type = TYPE_CMD;
-+ c->Request.Type.Attribute = ATTR_SIMPLE;
- switch(cmd->sc_data_direction)
- {
-- case DMA_TO_DEVICE: cp->Request.Type.Direction = XFER_WRITE; break;
-- case DMA_FROM_DEVICE: cp->Request.Type.Direction = XFER_READ; break;
-- case DMA_NONE: cp->Request.Type.Direction = XFER_NONE; break;
-+ case DMA_TO_DEVICE:
-+ c->Request.Type.Direction = XFER_WRITE;
-+ break;
-+ case DMA_FROM_DEVICE:
-+ c->Request.Type.Direction = XFER_READ;
-+ break;
-+ case DMA_NONE:
-+ c->Request.Type.Direction = XFER_NONE;
-+ break;
- case DMA_BIDIRECTIONAL:
- // This can happen if a buggy application does a scsi passthru
- // and sets both inlen and outlen to non-zero. ( see
- // ../scsi/scsi_ioctl.c:scsi_ioctl_send_command() )
-
-- cp->Request.Type.Direction = XFER_RSVD;
-+ c->Request.Type.Direction = XFER_RSVD;
- // This is technically wrong, and cciss controllers should
-- // reject it with CMD_INVALID, which is the most correct
-- // response, but non-fibre backends appear to let it
-+ // reject it with CMD_INVALID, which is the most correct
-+ // response, but non-fibre backends appear to let it
- // slide by, and give the same results as if this field
- // were set correctly. Either way is acceptable for
- // our purposes here.
-
- break;
-
-- default:
-- printk("cciss: unknown data direction: %d\n",
-+ default:
-+ dev_warn(&h->pdev->dev, "unknown data direction: %d\n",
- cmd->sc_data_direction);
- BUG();
- break;
- }
--
-- cciss_scatter_gather((*c)->pdev, cp, cmd); // Fill the SG list
--
-- /* Put the request on the tail of the request queue */
--
-- spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
-- addQ(&(*c)->reqQ, cp);
-- (*c)->Qdepth++;
-- start_io(*c);
-- spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
--
-+ cciss_scatter_gather(h, c, cmd);
-+ enqueue_cmd_and_start_io(h, c);
- /* the cmd'll come back via intr handler in complete_scsi_command() */
- return 0;
- }
-
--static void
--cciss_unregister_scsi(int ctlr)
-+static void cciss_unregister_scsi(ctlr_info_t *h)
- {
- struct cciss_scsi_adapter_data_t *sa;
- struct cciss_scsi_cmd_stack_t *stk;
-@@ -1503,59 +1522,58 @@ cciss_unregister_scsi(int ctlr)
-
- /* we are being forcibly unloaded, and may not refuse. */
-
-- spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
-- sa = (struct cciss_scsi_adapter_data_t *) hba[ctlr]->scsi_ctlr;
-- stk = &sa->cmd_stack;
-+ spin_lock_irqsave(&h->lock, flags);
-+ sa = h->scsi_ctlr;
-+ stk = &sa->cmd_stack;
-
-- /* if we weren't ever actually registered, don't unregister */
-+ /* if we weren't ever actually registered, don't unregister */
- if (sa->registered) {
-- spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
-+ spin_unlock_irqrestore(&h->lock, flags);
- scsi_remove_host(sa->scsi_host);
- scsi_host_put(sa->scsi_host);
-- spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
-+ spin_lock_irqsave(&h->lock, flags);
- }
-
-- /* set scsi_host to NULL so our detect routine will
-+ /* set scsi_host to NULL so our detect routine will
- find us on register */
- sa->scsi_host = NULL;
-- spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
-- scsi_cmd_stack_free(ctlr);
-+ spin_unlock_irqrestore(&h->lock, flags);
-+ scsi_cmd_stack_free(h);
- kfree(sa);
- }
-
--static int
--cciss_engage_scsi(int ctlr)
-+static int cciss_engage_scsi(ctlr_info_t *h)
- {
- struct cciss_scsi_adapter_data_t *sa;
- struct cciss_scsi_cmd_stack_t *stk;
- unsigned long flags;
-
-- spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
-- sa = (struct cciss_scsi_adapter_data_t *) hba[ctlr]->scsi_ctlr;
-- stk = &sa->cmd_stack;
-+ spin_lock_irqsave(&h->lock, flags);
-+ sa = h->scsi_ctlr;
-+ stk = &sa->cmd_stack;
-
- if (sa->registered) {
-- printk("cciss%d: SCSI subsystem already engaged.\n", ctlr);
-- spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
-- return ENXIO;
-+ dev_info(&h->pdev->dev, "SCSI subsystem already engaged.\n");
-+ spin_unlock_irqrestore(&h->lock, flags);
-+ return -ENXIO;
- }
- sa->registered = 1;
-- spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
-- cciss_update_non_disk_devices(ctlr, -1);
-- cciss_scsi_detect(ctlr);
-+ spin_unlock_irqrestore(&h->lock, flags);
-+ cciss_update_non_disk_devices(h, -1);
-+ cciss_scsi_detect(h);
- return 0;
- }
-
- static void
--cciss_seq_tape_report(struct seq_file *seq, int ctlr)
-+cciss_seq_tape_report(struct seq_file *seq, ctlr_info_t *h)
- {
- unsigned long flags;
-
-- CPQ_TAPE_LOCK(ctlr, flags);
-+ CPQ_TAPE_LOCK(h, flags);
- seq_printf(seq,
- "Sequential access devices: %d\n\n",
-- ccissscsi[ctlr].ndevices);
-- CPQ_TAPE_UNLOCK(ctlr, flags);
-+ ccissscsi[h->ctlr].ndevices);
-+ CPQ_TAPE_UNLOCK(h, flags);
- }
-
- static int wait_for_device_to_become_ready(ctlr_info_t *h,
-@@ -1566,10 +1584,10 @@ static int wait_for_device_to_become_ready(ctlr_info_t *h,
- int waittime = HZ;
- CommandList_struct *c;
-
-- c = cmd_alloc(h, 1);
-+ c = cmd_alloc(h);
- if (!c) {
-- printk(KERN_WARNING "cciss%d: out of memory in "
-- "wait_for_device_to_become_ready.\n", h->ctlr);
-+ dev_warn(&h->pdev->dev, "out of memory in "
-+ "wait_for_device_to_become_ready.\n");
- return IO_ERROR;
- }
-
-@@ -1587,7 +1605,7 @@ static int wait_for_device_to_become_ready(ctlr_info_t *h,
- waittime = waittime * 2;
-
- /* Send the Test Unit Ready */
-- rc = fill_cmd(c, TEST_UNIT_READY, h->ctlr, NULL, 0, 0,
-+ rc = fill_cmd(h, c, TEST_UNIT_READY, NULL, 0, 0,
- lunaddr, TYPE_CMD);
- if (rc == 0)
- rc = sendcmd_withirq_core(h, c, 0);
-@@ -1613,28 +1631,28 @@ static int wait_for_device_to_become_ready(ctlr_info_t *h,
- }
- }
- retry_tur:
-- printk(KERN_WARNING "cciss%d: Waiting %d secs "
-+ dev_warn(&h->pdev->dev, "Waiting %d secs "
- "for device to become ready.\n",
-- h->ctlr, waittime / HZ);
-+ waittime / HZ);
- rc = 1; /* device not ready. */
- }
-
- if (rc)
-- printk("cciss%d: giving up on device.\n", h->ctlr);
-+ dev_warn(&h->pdev->dev, "giving up on device.\n");
- else
-- printk(KERN_WARNING "cciss%d: device is ready.\n", h->ctlr);
-+ dev_warn(&h->pdev->dev, "device is ready.\n");
-
-- cmd_free(h, c, 1);
-+ cmd_free(h, c);
- return rc;
- }
-
--/* Need at least one of these error handlers to keep ../scsi/hosts.c from
-- * complaining. Doing a host- or bus-reset can't do anything good here.
-+/* Need at least one of these error handlers to keep ../scsi/hosts.c from
-+ * complaining. Doing a host- or bus-reset can't do anything good here.
- * Despite what it might say in scsi_error.c, there may well be commands
- * on the controller, as the cciss driver registers twice, once as a block
- * device for the logical drives, and once as a scsi device, for any tape
- * drives. So we know there are no commands out on the tape drives, but we
-- * don't know there are no commands on the controller, and it is likely
-+ * don't know there are no commands on the controller, and it is likely
- * that there probably are, as the cciss block device is most commonly used
- * as a boot device (embedded controller on HP/Compaq systems.)
- */
-@@ -1644,26 +1662,24 @@ static int cciss_eh_device_reset_handler(struct scsi_cmnd *scsicmd)
- int rc;
- CommandList_struct *cmd_in_trouble;
- unsigned char lunaddr[8];
-- ctlr_info_t **c;
-- int ctlr;
-+ ctlr_info_t *h;
-
- /* find the controller to which the command to be aborted was sent */
-- c = (ctlr_info_t **) &scsicmd->device->host->hostdata[0];
-- if (c == NULL) /* paranoia */
-+ h = (ctlr_info_t *) scsicmd->device->host->hostdata[0];
-+ if (h == NULL) /* paranoia */
- return FAILED;
-- ctlr = (*c)->ctlr;
-- printk(KERN_WARNING "cciss%d: resetting tape drive or medium changer.\n", ctlr);
-+ dev_warn(&h->pdev->dev, "resetting tape drive or medium changer.\n");
- /* find the command that's giving us trouble */
- cmd_in_trouble = (CommandList_struct *) scsicmd->host_scribble;
- if (cmd_in_trouble == NULL) /* paranoia */
- return FAILED;
- memcpy(lunaddr, &cmd_in_trouble->Header.LUN.LunAddrBytes[0], 8);
- /* send a reset to the SCSI LUN which the command was sent to */
-- rc = sendcmd_withirq(CCISS_RESET_MSG, ctlr, NULL, 0, 0, lunaddr,
-+ rc = sendcmd_withirq(h, CCISS_RESET_MSG, NULL, 0, 0, lunaddr,
- TYPE_MSG);
-- if (rc == 0 && wait_for_device_to_become_ready(*c, lunaddr) == 0)
-+ if (rc == 0 && wait_for_device_to_become_ready(h, lunaddr) == 0)
- return SUCCESS;
-- printk(KERN_WARNING "cciss%d: resetting device failed.\n", ctlr);
-+ dev_warn(&h->pdev->dev, "resetting device failed.\n");
- return FAILED;
- }
-
-@@ -1672,22 +1688,20 @@ static int cciss_eh_abort_handler(struct scsi_cmnd *scsicmd)
- int rc;
- CommandList_struct *cmd_to_abort;
- unsigned char lunaddr[8];
-- ctlr_info_t **c;
-- int ctlr;
-+ ctlr_info_t *h;
-
- /* find the controller to which the command to be aborted was sent */
-- c = (ctlr_info_t **) &scsicmd->device->host->hostdata[0];
-- if (c == NULL) /* paranoia */
-+ h = (ctlr_info_t *) scsicmd->device->host->hostdata[0];
-+ if (h == NULL) /* paranoia */
- return FAILED;
-- ctlr = (*c)->ctlr;
-- printk(KERN_WARNING "cciss%d: aborting tardy SCSI cmd\n", ctlr);
-+ dev_warn(&h->pdev->dev, "aborting tardy SCSI cmd\n");
-
- /* find the command to be aborted */
- cmd_to_abort = (CommandList_struct *) scsicmd->host_scribble;
- if (cmd_to_abort == NULL) /* paranoia */
- return FAILED;
- memcpy(lunaddr, &cmd_to_abort->Header.LUN.LunAddrBytes[0], 8);
-- rc = sendcmd_withirq(CCISS_ABORT_MSG, ctlr, &cmd_to_abort->Header.Tag,
-+ rc = sendcmd_withirq(h, CCISS_ABORT_MSG, &cmd_to_abort->Header.Tag,
- 0, 0, lunaddr, TYPE_MSG);
- if (rc == 0)
- return SUCCESS;
-@@ -1700,5 +1714,7 @@ static int cciss_eh_abort_handler(struct scsi_cmnd *scsicmd)
- /* If no tape support, then these become defined out of existence */
-
- #define cciss_scsi_setup(cntl_num)
-+#define cciss_engage_scsi(h)
-+static void print_cmd(CommandList_struct *cp) {}
-
- #endif /* CONFIG_CISS_SCSI_TAPE */
-diff --git a/drivers/block/cciss_scsi.h b/drivers/block/cciss_scsi.h
-index 7b75024..a4c62e8 100644
---- a/drivers/block/cciss_scsi.h
-+++ b/drivers/block/cciss_scsi.h
-@@ -1,6 +1,6 @@
- /*
- * Disk Array driver for HP Smart Array controllers, SCSI Tape module.
-- * (C) Copyright 2001, 2007 Hewlett-Packard Development Company, L.P.
-+ * (C) Copyright 2001, 2010 Hewlett-Packard Development Company, L.P.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
-@@ -25,30 +25,25 @@
-
- #include <scsi/scsicam.h> /* possibly irrelevant, since we don't show disks */
-
-- // the scsi id of the adapter...
-+ /* the scsi id of the adapter... */
- #define SELF_SCSI_ID 15
-- // 15 is somewhat arbitrary, since the scsi-2 bus
-- // that's presented by the driver to the OS is
-- // fabricated. The "real" scsi-3 bus the
-- // hardware presents is fabricated too.
-- // The actual, honest-to-goodness physical
-- // bus that the devices are attached to is not
-- // addressible natively, and may in fact turn
-- // out to be not scsi at all.
--
--#define SCSI_CCISS_CAN_QUEUE 2
--
--/*
--
--Note, cmd_per_lun could give us some trouble, so I'm setting it very low.
--Likewise, SCSI_CCISS_CAN_QUEUE is set very conservatively.
--
--If the upper scsi layer tries to track how many commands we have
-+ /* 15 is somewhat arbitrary, since the scsi-2 bus
-+ that's presented by the driver to the OS is
-+ fabricated. The "real" scsi-3 bus the
-+ hardware presents is fabricated too.
-+ The actual, honest-to-goodness physical
-+ bus that the devices are attached to is not
-+ addressible natively, and may in fact turn
-+ out to be not scsi at all. */
-+
-+/*
-+
-+If the upper scsi layer tries to track how many commands we have
- outstanding, it will be operating under the misapprehension that it is
- the only one sending us requests. We also have the block interface,
- which is where most requests must surely come from, so the upper layer's
- notion of how many requests we have outstanding will be wrong most or
--all of the time.
-+all of the time.
-
- Note, the normal SCSI mid-layer error handling doesn't work well
- for this driver because 1) it takes the io_request_lock before
-@@ -78,6 +73,5 @@ struct cciss_scsi_hba_t {
- #define CCISS_MAX_SCSI_DEVS_PER_HBA 16
- struct cciss_scsi_dev_t dev[CCISS_MAX_SCSI_DEVS_PER_HBA];
- };
--
- #endif /* _CCISS_SCSI_H_ */
- #endif /* CONFIG_CISS_SCSI_TAPE */
-diff --git a/drivers/block/cpqarray.c b/drivers/block/cpqarray.c
-index 6422651..bb1bdef 100644
---- a/drivers/block/cpqarray.c
-+++ b/drivers/block/cpqarray.c
-@@ -402,7 +402,7 @@ static int __init cpqarray_register_ctlr( int i, struct pci_dev *pdev)
- if (register_blkdev(COMPAQ_SMART2_MAJOR+i, hba[i]->devname)) {
- goto Enomem4;
- }
-- hba[i]->access.set_intr_mask(hba[i], 0);
-+ hba[i]->access->set_intr_mask(hba[i], 0);
- if (request_irq(hba[i]->intr, do_ida_intr,
- IRQF_DISABLED|IRQF_SHARED, hba[i]->devname, hba[i]))
- {
-@@ -460,7 +460,7 @@ static int __init cpqarray_register_ctlr( int i, struct pci_dev *pdev)
- add_timer(&hba[i]->timer);
-
- /* Enable IRQ now that spinlock and rate limit timer are set up */
-- hba[i]->access.set_intr_mask(hba[i], FIFO_NOT_EMPTY);
-+ hba[i]->access->set_intr_mask(hba[i], FIFO_NOT_EMPTY);
-
- for(j=0; j<NWD; j++) {
- struct gendisk *disk = ida_gendisk[i][j];
-@@ -695,7 +695,7 @@ DBGINFO(
- for(i=0; i<NR_PRODUCTS; i++) {
- if (board_id == products[i].board_id) {
- c->product_name = products[i].product_name;
-- c->access = *(products[i].access);
-+ c->access = products[i].access;
- break;
- }
- }
-@@ -793,7 +793,7 @@ static int __init cpqarray_eisa_detect(void)
- hba[ctlr]->intr = intr;
- sprintf(hba[ctlr]->devname, "ida%d", nr_ctlr);
- hba[ctlr]->product_name = products[j].product_name;
-- hba[ctlr]->access = *(products[j].access);
-+ hba[ctlr]->access = products[j].access;
- hba[ctlr]->ctlr = ctlr;
- hba[ctlr]->board_id = board_id;
- hba[ctlr]->pci_dev = NULL; /* not PCI */
-@@ -896,6 +896,8 @@ static void do_ida_request(struct request_queue *q)
- struct scatterlist tmp_sg[SG_MAX];
- int i, dir, seg;
-
-+ pax_track_stack();
-+
- if (blk_queue_plugged(q))
- goto startio;
-
-@@ -968,7 +970,7 @@ static void start_io(ctlr_info_t *h)
-
- while((c = h->reqQ) != NULL) {
- /* Can't do anything if we're busy */
-- if (h->access.fifo_full(h) == 0)
-+ if (h->access->fifo_full(h) == 0)
- return;
-
- /* Get the first entry from the request Q */
-@@ -976,7 +978,7 @@ static void start_io(ctlr_info_t *h)
- h->Qdepth--;
-
- /* Tell the controller to do our bidding */
-- h->access.submit_command(h, c);
-+ h->access->submit_command(h, c);
-
- /* Get onto the completion Q */
- addQ(&h->cmpQ, c);
-@@ -1038,7 +1040,7 @@ static irqreturn_t do_ida_intr(int irq, void *dev_id)
- unsigned long flags;
- __u32 a,a1;
-
-- istat = h->access.intr_pending(h);
-+ istat = h->access->intr_pending(h);
- /* Is this interrupt for us? */
- if (istat == 0)
- return IRQ_NONE;
-@@ -1049,7 +1051,7 @@ static irqreturn_t do_ida_intr(int irq, void *dev_id)
- */
- spin_lock_irqsave(IDA_LOCK(h->ctlr), flags);
- if (istat & FIFO_NOT_EMPTY) {
-- while((a = h->access.command_completed(h))) {
-+ while((a = h->access->command_completed(h))) {
- a1 = a; a &= ~3;
- if ((c = h->cmpQ) == NULL)
- {
-@@ -1434,11 +1436,11 @@ static int sendcmd(
- /*
- * Disable interrupt
- */
-- info_p->access.set_intr_mask(info_p, 0);
-+ info_p->access->set_intr_mask(info_p, 0);
- /* Make sure there is room in the command FIFO */
- /* Actually it should be completely empty at this time. */
- for (i = 200000; i > 0; i--) {
-- temp = info_p->access.fifo_full(info_p);
-+ temp = info_p->access->fifo_full(info_p);
- if (temp != 0) {
- break;
- }
-@@ -1451,7 +1453,7 @@ DBG(
- /*
- * Send the cmd
- */
-- info_p->access.submit_command(info_p, c);
-+ info_p->access->submit_command(info_p, c);
- complete = pollcomplete(ctlr);
-
- pci_unmap_single(info_p->pci_dev, (dma_addr_t) c->req.sg[0].addr,
-@@ -1534,9 +1536,9 @@ static int revalidate_allvol(ctlr_info_t *host)
- * we check the new geometry. Then turn interrupts back on when
- * we're done.
- */
-- host->access.set_intr_mask(host, 0);
-+ host->access->set_intr_mask(host, 0);
- getgeometry(ctlr);
-- host->access.set_intr_mask(host, FIFO_NOT_EMPTY);
-+ host->access->set_intr_mask(host, FIFO_NOT_EMPTY);
-
- for(i=0; i<NWD; i++) {
- struct gendisk *disk = ida_gendisk[ctlr][i];
-@@ -1576,7 +1578,7 @@ static int pollcomplete(int ctlr)
- /* Wait (up to 2 seconds) for a command to complete */
-
- for (i = 200000; i > 0; i--) {
-- done = hba[ctlr]->access.command_completed(hba[ctlr]);
-+ done = hba[ctlr]->access->command_completed(hba[ctlr]);
- if (done == 0) {
- udelay(10); /* a short fixed delay */
- } else
-diff --git a/drivers/block/cpqarray.h b/drivers/block/cpqarray.h
-index be73e9d..7fbf140 100644
---- a/drivers/block/cpqarray.h
-+++ b/drivers/block/cpqarray.h
-@@ -99,7 +99,7 @@ struct ctlr_info {
- drv_info_t drv[NWD];
- struct proc_dir_entry *proc;
-
-- struct access_method access;
-+ struct access_method *access;
-
- cmdlist_t *reqQ;
- cmdlist_t *cmpQ;
-diff --git a/drivers/block/loop.c b/drivers/block/loop.c
-index 8ec2d70..2804b30 100644
---- a/drivers/block/loop.c
-+++ b/drivers/block/loop.c
-@@ -282,7 +282,7 @@ static int __do_lo_send_write(struct file *file,
- mm_segment_t old_fs = get_fs();
-
- set_fs(get_ds());
-- bw = file->f_op->write(file, buf, len, &pos);
-+ bw = file->f_op->write(file, (const char __force_user *)buf, len, &pos);
- set_fs(old_fs);
- if (likely(bw == len))
- return 0;
-diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
-index 26ada47..083c480 100644
---- a/drivers/block/nbd.c
-+++ b/drivers/block/nbd.c
-@@ -155,6 +155,8 @@ static int sock_xmit(struct nbd_device *lo, int send, void *buf, int size,
- struct kvec iov;
- sigset_t blocked, oldset;
-
-+ pax_track_stack();
-+
- if (unlikely(!sock)) {
- printk(KERN_ERR "%s: Attempted %s on closed socket in sock_xmit\n",
- lo->disk->disk_name, (send ? "send" : "recv"));
-@@ -569,6 +571,8 @@ static void do_nbd_request(struct request_queue *q)
- static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *lo,
- unsigned int cmd, unsigned long arg)
- {
-+ pax_track_stack();
-+
- switch (cmd) {
- case NBD_DISCONNECT: {
- struct request sreq;
-diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
-index a5d585d..d087be3 100644
---- a/drivers/block/pktcdvd.c
-+++ b/drivers/block/pktcdvd.c
-@@ -284,7 +284,7 @@ static ssize_t kobj_pkt_store(struct kobject *kobj,
- return len;
- }
-
--static struct sysfs_ops kobj_pkt_ops = {
-+static const struct sysfs_ops kobj_pkt_ops = {
- .show = kobj_pkt_show,
- .store = kobj_pkt_store
- };
-diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
-index a4592ec..432659a 100644
---- a/drivers/cdrom/cdrom.c
-+++ b/drivers/cdrom/cdrom.c
-@@ -410,7 +410,6 @@ int register_cdrom(struct cdrom_device_info *cdi)
- ENSURE(reset, CDC_RESET);
- ENSURE(generic_packet, CDC_GENERIC_PACKET);
- cdi->mc_flags = 0;
-- cdo->n_minors = 0;
- cdi->options = CDO_USE_FFLAGS;
-
- if (autoclose==1 && CDROM_CAN(CDC_CLOSE_TRAY))
-@@ -430,8 +429,11 @@ int register_cdrom(struct cdrom_device_info *cdi)
- else
- cdi->cdda_method = CDDA_OLD;
-
-- if (!cdo->generic_packet)
-- cdo->generic_packet = cdrom_dummy_generic_packet;
-+ if (!cdo->generic_packet) {
-+ pax_open_kernel();
-+ *(void **)&cdo->generic_packet = cdrom_dummy_generic_packet;
-+ pax_close_kernel();
-+ }
-
- cdinfo(CD_REG_UNREG, "drive \"/dev/%s\" registered\n", cdi->name);
- mutex_lock(&cdrom_mutex);
-@@ -452,7 +454,6 @@ void unregister_cdrom(struct cdrom_device_info *cdi)
- if (cdi->exit)
- cdi->exit(cdi);
-
-- cdi->ops->n_minors--;
- cdinfo(CD_REG_UNREG, "drive \"/dev/%s\" unregistered\n", cdi->name);
- }
-
-diff --git a/drivers/cdrom/gdrom.c b/drivers/cdrom/gdrom.c
-index a762283..57cb232 100644
---- a/drivers/cdrom/gdrom.c
-+++ b/drivers/cdrom/gdrom.c
-@@ -487,7 +487,6 @@ static struct cdrom_device_ops gdrom_ops = {
- .audio_ioctl = gdrom_audio_ioctl,
- .capability = CDC_MULTI_SESSION | CDC_MEDIA_CHANGED |
- CDC_RESET | CDC_DRIVE_STATUS | CDC_CD_R,
-- .n_minors = 1,
- };
-
- static int gdrom_bdops_open(struct block_device *bdev, fmode_t mode)
-diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
-index 6aad99e..89cd142 100644
---- a/drivers/char/Kconfig
-+++ b/drivers/char/Kconfig
-@@ -90,7 +90,8 @@ config VT_HW_CONSOLE_BINDING
-
- config DEVKMEM
- bool "/dev/kmem virtual device support"
-- default y
-+ default n
-+ depends on !GRKERNSEC_KMEM
- help
- Say Y here if you want to support the /dev/kmem device. The
- /dev/kmem device is rarely used, but can be used for certain
-@@ -1114,6 +1115,7 @@ config DEVPORT
- bool
- depends on !M68K
- depends on ISA || PCI
-+ depends on !GRKERNSEC_KMEM
- default y
-
- source "drivers/s390/char/Kconfig"
-diff --git a/drivers/char/agp/frontend.c b/drivers/char/agp/frontend.c
-index a96f319..a778a5b 100644
---- a/drivers/char/agp/frontend.c
-+++ b/drivers/char/agp/frontend.c
-@@ -824,7 +824,7 @@ static int agpioc_reserve_wrap(struct agp_file_private *priv, void __user *arg)
- if (copy_from_user(&reserve, arg, sizeof(struct agp_region)))
- return -EFAULT;
-
-- if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment))
-+ if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment_priv))
- return -EFAULT;
-
- client = agp_find_client_by_pid(reserve.pid);
-diff --git a/drivers/char/briq_panel.c b/drivers/char/briq_panel.c
-index d8cff90..9628e70 100644
---- a/drivers/char/briq_panel.c
-+++ b/drivers/char/briq_panel.c
-@@ -10,6 +10,7 @@
- #include <linux/types.h>
- #include <linux/errno.h>
- #include <linux/tty.h>
-+#include <linux/mutex.h>
- #include <linux/timer.h>
- #include <linux/kernel.h>
- #include <linux/wait.h>
-@@ -36,6 +37,7 @@ static int vfd_is_open;
- static unsigned char vfd[40];
- static int vfd_cursor;
- static unsigned char ledpb, led;
-+static DEFINE_MUTEX(vfd_mutex);
-
- static void update_vfd(void)
- {
-@@ -142,12 +144,15 @@ static ssize_t briq_panel_write(struct file *file, const char __user *buf, size_
- if (!vfd_is_open)
- return -EBUSY;
-
-+ mutex_lock(&vfd_mutex);
- for (;;) {
- char c;
- if (!indx)
- break;
-- if (get_user(c, buf))
-+ if (get_user(c, buf)) {
-+ mutex_unlock(&vfd_mutex);
- return -EFAULT;
-+ }
- if (esc) {
- set_led(c);
- esc = 0;
-@@ -177,6 +182,7 @@ static ssize_t briq_panel_write(struct file *file, const char __user *buf, size_
- buf++;
- }
- update_vfd();
-+ mutex_unlock(&vfd_mutex);
-
- return len;
- }
-diff --git a/drivers/char/genrtc.c b/drivers/char/genrtc.c
-index 31e7c91..161afc0 100644
---- a/drivers/char/genrtc.c
-+++ b/drivers/char/genrtc.c
-@@ -272,6 +272,7 @@ static int gen_rtc_ioctl(struct inode *inode, struct file *file,
- switch (cmd) {
-
- case RTC_PLL_GET:
-+ memset(&pll, 0, sizeof(pll));
- if (get_rtc_pll(&pll))
- return -EINVAL;
- else
-diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
-index 006466d..a2bb21c 100644
---- a/drivers/char/hpet.c
-+++ b/drivers/char/hpet.c
-@@ -430,7 +430,7 @@ static int hpet_release(struct inode *inode, struct file *file)
- return 0;
- }
-
--static int hpet_ioctl_common(struct hpet_dev *, int, unsigned long, int);
-+static int hpet_ioctl_common(struct hpet_dev *, unsigned int, unsigned long, int);
-
- static int
- hpet_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
-@@ -565,7 +565,7 @@ static inline unsigned long hpet_time_div(struct hpets *hpets,
- }
-
- static int
--hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg, int kernel)
-+hpet_ioctl_common(struct hpet_dev *devp, unsigned int cmd, unsigned long arg, int kernel)
- {
- struct hpet_timer __iomem *timer;
- struct hpet __iomem *hpet;
-@@ -608,11 +608,11 @@ hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg, int kernel)
- {
- struct hpet_info info;
-
-+ memset(&info, 0, sizeof(info));
-+
- if (devp->hd_ireqfreq)
- info.hi_ireqfreq =
- hpet_time_div(hpetp, devp->hd_ireqfreq);
-- else
-- info.hi_ireqfreq = 0;
- info.hi_flags =
- readq(&timer->hpet_config) & Tn_PER_INT_CAP_MASK;
- info.hi_hpet = hpetp->hp_which;
-diff --git a/drivers/char/hvc_beat.c b/drivers/char/hvc_beat.c
-index 0afc8b8..6913fc3 100644
---- a/drivers/char/hvc_beat.c
-+++ b/drivers/char/hvc_beat.c
-@@ -84,7 +84,7 @@ static int hvc_beat_put_chars(uint32_t vtermno, const char *buf, int cnt)
- return cnt;
- }
-
--static struct hv_ops hvc_beat_get_put_ops = {
-+static const struct hv_ops hvc_beat_get_put_ops = {
- .get_chars = hvc_beat_get_chars,
- .put_chars = hvc_beat_put_chars,
- };
-diff --git a/drivers/char/hvc_console.c b/drivers/char/hvc_console.c
-index 98097f2..407dddc 100644
---- a/drivers/char/hvc_console.c
-+++ b/drivers/char/hvc_console.c
-@@ -125,7 +125,7 @@ static struct hvc_struct *hvc_get_by_index(int index)
- * console interfaces but can still be used as a tty device. This has to be
- * static because kmalloc will not work during early console init.
- */
--static struct hv_ops *cons_ops[MAX_NR_HVC_CONSOLES];
-+static const struct hv_ops *cons_ops[MAX_NR_HVC_CONSOLES];
- static uint32_t vtermnos[MAX_NR_HVC_CONSOLES] =
- {[0 ... MAX_NR_HVC_CONSOLES - 1] = -1};
-
-@@ -249,7 +249,7 @@ static void destroy_hvc_struct(struct kref *kref)
- * vty adapters do NOT get an hvc_instantiate() callback since they
- * appear after early console init.
- */
--int hvc_instantiate(uint32_t vtermno, int index, struct hv_ops *ops)
-+int hvc_instantiate(uint32_t vtermno, int index, const struct hv_ops *ops)
- {
- struct hvc_struct *hp;
-
-@@ -758,7 +758,7 @@ static const struct tty_operations hvc_ops = {
- };
-
- struct hvc_struct __devinit *hvc_alloc(uint32_t vtermno, int data,
-- struct hv_ops *ops, int outbuf_size)
-+ const struct hv_ops *ops, int outbuf_size)
- {
- struct hvc_struct *hp;
- int i;
-diff --git a/drivers/char/hvc_console.h b/drivers/char/hvc_console.h
-index 10950ca..ed176c3 100644
---- a/drivers/char/hvc_console.h
-+++ b/drivers/char/hvc_console.h
-@@ -55,7 +55,7 @@ struct hvc_struct {
- int outbuf_size;
- int n_outbuf;
- uint32_t vtermno;
-- struct hv_ops *ops;
-+ const struct hv_ops *ops;
- int irq_requested;
- int data;
- struct winsize ws;
-@@ -76,11 +76,11 @@ struct hv_ops {
- };
-
- /* Register a vterm and a slot index for use as a console (console_init) */
--extern int hvc_instantiate(uint32_t vtermno, int index, struct hv_ops *ops);
-+extern int hvc_instantiate(uint32_t vtermno, int index, const struct hv_ops *ops);
-
- /* register a vterm for hvc tty operation (module_init or hotplug add) */
- extern struct hvc_struct * __devinit hvc_alloc(uint32_t vtermno, int data,
-- struct hv_ops *ops, int outbuf_size);
-+ const struct hv_ops *ops, int outbuf_size);
- /* remove a vterm from hvc tty operation (module_exit or hotplug remove) */
- extern int hvc_remove(struct hvc_struct *hp);
-
-diff --git a/drivers/char/hvc_iseries.c b/drivers/char/hvc_iseries.c
-index 936d05b..fd02426 100644
---- a/drivers/char/hvc_iseries.c
-+++ b/drivers/char/hvc_iseries.c
-@@ -197,7 +197,7 @@ done:
- return sent;
- }
-
--static struct hv_ops hvc_get_put_ops = {
-+static const struct hv_ops hvc_get_put_ops = {
- .get_chars = get_chars,
- .put_chars = put_chars,
- .notifier_add = notifier_add_irq,
-diff --git a/drivers/char/hvc_iucv.c b/drivers/char/hvc_iucv.c
-index b0e168f..69cda2a 100644
---- a/drivers/char/hvc_iucv.c
-+++ b/drivers/char/hvc_iucv.c
-@@ -924,7 +924,7 @@ static int hvc_iucv_pm_restore_thaw(struct device *dev)
-
-
- /* HVC operations */
--static struct hv_ops hvc_iucv_ops = {
-+static const struct hv_ops hvc_iucv_ops = {
- .get_chars = hvc_iucv_get_chars,
- .put_chars = hvc_iucv_put_chars,
- .notifier_add = hvc_iucv_notifier_add,
-diff --git a/drivers/char/hvc_rtas.c b/drivers/char/hvc_rtas.c
-index 88590d0..61c4a61 100644
---- a/drivers/char/hvc_rtas.c
-+++ b/drivers/char/hvc_rtas.c
-@@ -71,7 +71,7 @@ static int hvc_rtas_read_console(uint32_t vtermno, char *buf, int count)
- return i;
- }
-
--static struct hv_ops hvc_rtas_get_put_ops = {
-+static const struct hv_ops hvc_rtas_get_put_ops = {
- .get_chars = hvc_rtas_read_console,
- .put_chars = hvc_rtas_write_console,
- };
-diff --git a/drivers/char/hvc_udbg.c b/drivers/char/hvc_udbg.c
-index bd63ba8..b0957e6 100644
---- a/drivers/char/hvc_udbg.c
-+++ b/drivers/char/hvc_udbg.c
-@@ -58,7 +58,7 @@ static int hvc_udbg_get(uint32_t vtermno, char *buf, int count)
- return i;
- }
-
--static struct hv_ops hvc_udbg_ops = {
-+static const struct hv_ops hvc_udbg_ops = {
- .get_chars = hvc_udbg_get,
- .put_chars = hvc_udbg_put,
- };
-diff --git a/drivers/char/hvc_vio.c b/drivers/char/hvc_vio.c
-index 10be343..27370e9 100644
---- a/drivers/char/hvc_vio.c
-+++ b/drivers/char/hvc_vio.c
-@@ -77,7 +77,7 @@ static int filtered_get_chars(uint32_t vtermno, char *buf, int count)
- return got;
- }
-
--static struct hv_ops hvc_get_put_ops = {
-+static const struct hv_ops hvc_get_put_ops = {
- .get_chars = filtered_get_chars,
- .put_chars = hvc_put_chars,
- .notifier_add = notifier_add_irq,
-diff --git a/drivers/char/hvc_xen.c b/drivers/char/hvc_xen.c
-index a6ee32b..94f8c26 100644
---- a/drivers/char/hvc_xen.c
-+++ b/drivers/char/hvc_xen.c
-@@ -120,7 +120,7 @@ static int read_console(uint32_t vtermno, char *buf, int len)
- return recv;
- }
-
--static struct hv_ops hvc_ops = {
-+static const struct hv_ops hvc_ops = {
- .get_chars = read_console,
- .put_chars = write_console,
- .notifier_add = notifier_add_irq,
-diff --git a/drivers/char/hvcs.c b/drivers/char/hvcs.c
-index 266b858..f3ee0bb 100644
---- a/drivers/char/hvcs.c
-+++ b/drivers/char/hvcs.c
-@@ -82,6 +82,7 @@
- #include <asm/hvcserver.h>
- #include <asm/uaccess.h>
- #include <asm/vio.h>
-+#include <asm/local.h>
-
- /*
- * 1.3.0 -> 1.3.1 In hvcs_open memset(..,0x00,..) instead of memset(..,0x3F,00).
-@@ -269,7 +270,7 @@ struct hvcs_struct {
- unsigned int index;
-
- struct tty_struct *tty;
-- int open_count;
-+ local_t open_count;
-
- /*
- * Used to tell the driver kernel_thread what operations need to take
-@@ -419,7 +420,7 @@ static ssize_t hvcs_vterm_state_store(struct device *dev, struct device_attribut
-
- spin_lock_irqsave(&hvcsd->lock, flags);
-
-- if (hvcsd->open_count > 0) {
-+ if (local_read(&hvcsd->open_count) > 0) {
- spin_unlock_irqrestore(&hvcsd->lock, flags);
- printk(KERN_INFO "HVCS: vterm state unchanged. "
- "The hvcs device node is still in use.\n");
-@@ -1135,7 +1136,7 @@ static int hvcs_open(struct tty_struct *tty, struct file *filp)
- if ((retval = hvcs_partner_connect(hvcsd)))
- goto error_release;
-
-- hvcsd->open_count = 1;
-+ local_set(&hvcsd->open_count, 1);
- hvcsd->tty = tty;
- tty->driver_data = hvcsd;
-
-@@ -1169,7 +1170,7 @@ fast_open:
-
- spin_lock_irqsave(&hvcsd->lock, flags);
- kref_get(&hvcsd->kref);
-- hvcsd->open_count++;
-+ local_inc(&hvcsd->open_count);
- hvcsd->todo_mask |= HVCS_SCHED_READ;
- spin_unlock_irqrestore(&hvcsd->lock, flags);
-
-@@ -1213,7 +1214,7 @@ static void hvcs_close(struct tty_struct *tty, struct file *filp)
- hvcsd = tty->driver_data;
-
- spin_lock_irqsave(&hvcsd->lock, flags);
-- if (--hvcsd->open_count == 0) {
-+ if (local_dec_and_test(&hvcsd->open_count)) {
-
- vio_disable_interrupts(hvcsd->vdev);
-
-@@ -1239,10 +1240,10 @@ static void hvcs_close(struct tty_struct *tty, struct file *filp)
- free_irq(irq, hvcsd);
- kref_put(&hvcsd->kref, destroy_hvcs_struct);
- return;
-- } else if (hvcsd->open_count < 0) {
-+ } else if (local_read(&hvcsd->open_count) < 0) {
- printk(KERN_ERR "HVCS: vty-server@%X open_count: %d"
- " is missmanaged.\n",
-- hvcsd->vdev->unit_address, hvcsd->open_count);
-+ hvcsd->vdev->unit_address, local_read(&hvcsd->open_count));
- }
-
- spin_unlock_irqrestore(&hvcsd->lock, flags);
-@@ -1258,7 +1259,7 @@ static void hvcs_hangup(struct tty_struct * tty)
-
- spin_lock_irqsave(&hvcsd->lock, flags);
- /* Preserve this so that we know how many kref refs to put */
-- temp_open_count = hvcsd->open_count;
-+ temp_open_count = local_read(&hvcsd->open_count);
-
- /*
- * Don't kref put inside the spinlock because the destruction
-@@ -1273,7 +1274,7 @@ static void hvcs_hangup(struct tty_struct * tty)
- hvcsd->tty->driver_data = NULL;
- hvcsd->tty = NULL;
-
-- hvcsd->open_count = 0;
-+ local_set(&hvcsd->open_count, 0);
-
- /* This will drop any buffered data on the floor which is OK in a hangup
- * scenario. */
-@@ -1344,7 +1345,7 @@ static int hvcs_write(struct tty_struct *tty,
- * the middle of a write operation? This is a crummy place to do this
- * but we want to keep it all in the spinlock.
- */
-- if (hvcsd->open_count <= 0) {
-+ if (local_read(&hvcsd->open_count) <= 0) {
- spin_unlock_irqrestore(&hvcsd->lock, flags);
- return -ENODEV;
- }
-@@ -1418,7 +1419,7 @@ static int hvcs_write_room(struct tty_struct *tty)
- {
- struct hvcs_struct *hvcsd = tty->driver_data;
-
-- if (!hvcsd || hvcsd->open_count <= 0)
-+ if (!hvcsd || local_read(&hvcsd->open_count) <= 0)
- return 0;
-
- return HVCS_BUFF_LEN - hvcsd->chars_in_buffer;
-diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
-index ec5e3f8..02455ba 100644
---- a/drivers/char/ipmi/ipmi_msghandler.c
-+++ b/drivers/char/ipmi/ipmi_msghandler.c
-@@ -414,7 +414,7 @@ struct ipmi_smi {
- struct proc_dir_entry *proc_dir;
- char proc_dir_name[10];
-
-- atomic_t stats[IPMI_NUM_STATS];
-+ atomic_unchecked_t stats[IPMI_NUM_STATS];
-
- /*
- * run_to_completion duplicate of smb_info, smi_info
-@@ -447,9 +447,9 @@ static DEFINE_MUTEX(smi_watchers_mutex);
-
-
- #define ipmi_inc_stat(intf, stat) \
-- atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
-+ atomic_inc_unchecked(&(intf)->stats[IPMI_STAT_ ## stat])
- #define ipmi_get_stat(intf, stat) \
-- ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
-+ ((unsigned int) atomic_read_unchecked(&(intf)->stats[IPMI_STAT_ ## stat]))
-
- static int is_lan_addr(struct ipmi_addr *addr)
- {
-@@ -2808,7 +2808,7 @@ int ipmi_register_smi(struct ipmi_smi_handlers *handlers,
- INIT_LIST_HEAD(&intf->cmd_rcvrs);
- init_waitqueue_head(&intf->waitq);
- for (i = 0; i < IPMI_NUM_STATS; i++)
-- atomic_set(&intf->stats[i], 0);
-+ atomic_set_unchecked(&intf->stats[i], 0);
-
- intf->proc_dir = NULL;
-
-@@ -4160,6 +4160,8 @@ static void send_panic_events(char *str)
- struct ipmi_smi_msg smi_msg;
- struct ipmi_recv_msg recv_msg;
-
-+ pax_track_stack();
-+
- si = (struct ipmi_system_interface_addr *) &addr;
- si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
- si->channel = IPMI_BMC_CHANNEL;
-diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
-index abae8c9..8021979 100644
---- a/drivers/char/ipmi/ipmi_si_intf.c
-+++ b/drivers/char/ipmi/ipmi_si_intf.c
-@@ -277,7 +277,7 @@ struct smi_info {
- unsigned char slave_addr;
-
- /* Counters and things for the proc filesystem. */
-- atomic_t stats[SI_NUM_STATS];
-+ atomic_unchecked_t stats[SI_NUM_STATS];
-
- struct task_struct *thread;
-
-@@ -285,9 +285,9 @@ struct smi_info {
- };
-
- #define smi_inc_stat(smi, stat) \
-- atomic_inc(&(smi)->stats[SI_STAT_ ## stat])
-+ atomic_inc_unchecked(&(smi)->stats[SI_STAT_ ## stat])
- #define smi_get_stat(smi, stat) \
-- ((unsigned int) atomic_read(&(smi)->stats[SI_STAT_ ## stat]))
-+ ((unsigned int) atomic_read_unchecked(&(smi)->stats[SI_STAT_ ## stat]))
-
- #define SI_MAX_PARMS 4
-
-@@ -2931,7 +2931,7 @@ static int try_smi_init(struct smi_info *new_smi)
- atomic_set(&new_smi->req_events, 0);
- new_smi->run_to_completion = 0;
- for (i = 0; i < SI_NUM_STATS; i++)
-- atomic_set(&new_smi->stats[i], 0);
-+ atomic_set_unchecked(&new_smi->stats[i], 0);
-
- new_smi->interrupt_disabled = 0;
- atomic_set(&new_smi->stop_operation, 0);
-diff --git a/drivers/char/istallion.c b/drivers/char/istallion.c
-index 402838f..55e2200 100644
---- a/drivers/char/istallion.c
-+++ b/drivers/char/istallion.c
-@@ -187,7 +187,6 @@ static struct ktermios stli_deftermios = {
- * re-used for each stats call.
- */
- static comstats_t stli_comstats;
--static combrd_t stli_brdstats;
- static struct asystats stli_cdkstats;
-
- /*****************************************************************************/
-@@ -4058,6 +4057,7 @@ static int stli_getbrdstats(combrd_t __user *bp)
- {
- struct stlibrd *brdp;
- unsigned int i;
-+ combrd_t stli_brdstats;
-
- if (copy_from_user(&stli_brdstats, bp, sizeof(combrd_t)))
- return -EFAULT;
-@@ -4269,6 +4269,8 @@ static int stli_getportstruct(struct stliport __user *arg)
- struct stliport stli_dummyport;
- struct stliport *portp;
-
-+ pax_track_stack();
-+
- if (copy_from_user(&stli_dummyport, arg, sizeof(struct stliport)))
- return -EFAULT;
- portp = stli_getport(stli_dummyport.brdnr, stli_dummyport.panelnr,
-@@ -4291,6 +4293,8 @@ static int stli_getbrdstruct(struct stlibrd __user *arg)
- struct stlibrd stli_dummybrd;
- struct stlibrd *brdp;
-
-+ pax_track_stack();
-+
- if (copy_from_user(&stli_dummybrd, arg, sizeof(struct stlibrd)))
- return -EFAULT;
- if (stli_dummybrd.brdnr >= STL_MAXBRDS)
-diff --git a/drivers/char/keyboard.c b/drivers/char/keyboard.c
-index 950837c..e55a288 100644
---- a/drivers/char/keyboard.c
-+++ b/drivers/char/keyboard.c
-@@ -635,6 +635,16 @@ static void k_spec(struct vc_data *vc, unsigned char value, char up_flag)
- kbd->kbdmode == VC_MEDIUMRAW) &&
- value != KVAL(K_SAK))
- return; /* SAK is allowed even in raw mode */
-+
-+#if defined(CONFIG_GRKERNSEC_PROC) || defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
-+ {
-+ void *func = fn_handler[value];
-+ if (func == fn_show_state || func == fn_show_ptregs ||
-+ func == fn_show_mem)
-+ return;
-+ }
-+#endif
-+
- fn_handler[value](vc);
- }
-
-@@ -1386,7 +1396,7 @@ static const struct input_device_id kbd_ids[] = {
- .evbit = { BIT_MASK(EV_SND) },
- },
-
-- { }, /* Terminating entry */
-+ { 0 }, /* Terminating entry */
- };
-
- MODULE_DEVICE_TABLE(input, kbd_ids);
-diff --git a/drivers/char/mbcs.c b/drivers/char/mbcs.c
-index 87c67b4..230527a 100644
---- a/drivers/char/mbcs.c
-+++ b/drivers/char/mbcs.c
-@@ -799,7 +799,7 @@ static int mbcs_remove(struct cx_dev *dev)
- return 0;
- }
-
--static const struct cx_device_id __devinitdata mbcs_id_table[] = {
-+static const struct cx_device_id __devinitconst mbcs_id_table[] = {
- {
- .part_num = MBCS_PART_NUM,
- .mfg_num = MBCS_MFG_NUM,
-diff --git a/drivers/char/mem.c b/drivers/char/mem.c
-index 1270f64..3b87405 100644
---- a/drivers/char/mem.c
-+++ b/drivers/char/mem.c
-@@ -18,6 +18,7 @@
- #include <linux/raw.h>
- #include <linux/tty.h>
- #include <linux/capability.h>
-+#include <linux/security.h>
- #include <linux/ptrace.h>
- #include <linux/device.h>
- #include <linux/highmem.h>
-@@ -35,6 +36,10 @@
- # include <linux/efi.h>
- #endif
-
-+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
-+extern struct file_operations grsec_fops;
-+#endif
-+
- static inline unsigned long size_inside_page(unsigned long start,
- unsigned long size)
- {
-@@ -102,9 +107,13 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
-
- while (cursor < to) {
- if (!devmem_is_allowed(pfn)) {
-+#ifdef CONFIG_GRKERNSEC_KMEM
-+ gr_handle_mem_readwrite(from, to);
-+#else
- printk(KERN_INFO
- "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
- current->comm, from, to);
-+#endif
- return 0;
- }
- cursor += PAGE_SIZE;
-@@ -112,6 +121,11 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
- }
- return 1;
- }
-+#elif defined(CONFIG_GRKERNSEC_KMEM)
-+static inline int range_is_allowed(unsigned long pfn, unsigned long size)
-+{
-+ return 0;
-+}
- #else
- static inline int range_is_allowed(unsigned long pfn, unsigned long size)
- {
-@@ -155,6 +169,8 @@ static ssize_t read_mem(struct file * file, char __user * buf,
- #endif
-
- while (count > 0) {
-+ char *temp;
-+
- /*
- * Handle first page in case it's not aligned
- */
-@@ -177,11 +193,31 @@ static ssize_t read_mem(struct file * file, char __user * buf,
- if (!ptr)
- return -EFAULT;
-
-- if (copy_to_user(buf, ptr, sz)) {
-+#ifdef CONFIG_PAX_USERCOPY
-+ temp = kmalloc(sz, GFP_KERNEL|GFP_USERCOPY);
-+ if (!temp) {
-+ unxlate_dev_mem_ptr(p, ptr);
-+ return -ENOMEM;
-+ }
-+ memcpy(temp, ptr, sz);
-+#else
-+ temp = ptr;
-+#endif
-+
-+ if (copy_to_user(buf, temp, sz)) {
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+ kfree(temp);
-+#endif
-+
- unxlate_dev_mem_ptr(p, ptr);
- return -EFAULT;
- }
-
-+#ifdef CONFIG_PAX_USERCOPY
-+ kfree(temp);
-+#endif
-+
- unxlate_dev_mem_ptr(p, ptr);
-
- buf += sz;
-@@ -419,9 +455,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
- size_t count, loff_t *ppos)
- {
- unsigned long p = *ppos;
-- ssize_t low_count, read, sz;
-+ ssize_t low_count, read, sz, err = 0;
- char * kbuf; /* k-addr because vread() takes vmlist_lock rwlock */
-- int err = 0;
-
- read = 0;
- if (p < (unsigned long) high_memory) {
-@@ -444,6 +479,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
- }
- #endif
- while (low_count > 0) {
-+ char *temp;
-+
- sz = size_inside_page(p, low_count);
-
- /*
-@@ -453,7 +490,22 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
- */
- kbuf = xlate_dev_kmem_ptr((char *)p);
-
-- if (copy_to_user(buf, kbuf, sz))
-+#ifdef CONFIG_PAX_USERCOPY
-+ temp = kmalloc(sz, GFP_KERNEL|GFP_USERCOPY);
-+ if (!temp)
-+ return -ENOMEM;
-+ memcpy(temp, kbuf, sz);
-+#else
-+ temp = kbuf;
-+#endif
-+
-+ err = copy_to_user(buf, temp, sz);
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+ kfree(temp);
-+#endif
-+
-+ if (err)
- return -EFAULT;
- buf += sz;
- p += sz;
-@@ -889,6 +941,9 @@ static const struct memdev {
- #ifdef CONFIG_CRASH_DUMP
- [12] = { "oldmem", 0, &oldmem_fops, NULL },
- #endif
-+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
-+ [13] = { "grsec",S_IRUSR | S_IWUGO, &grsec_fops, NULL },
-+#endif
- };
-
- static int memory_open(struct inode *inode, struct file *filp)
-diff --git a/drivers/char/mmtimer.c b/drivers/char/mmtimer.c
-index 918711a..4ffaf5e 100644
---- a/drivers/char/mmtimer.c
-+++ b/drivers/char/mmtimer.c
-@@ -756,7 +756,7 @@ static int sgi_timer_set(struct k_itimer *timr, int flags,
- return err;
- }
-
--static struct k_clock sgi_clock = {
-+static k_clock_no_const sgi_clock = {
- .res = 0,
- .clock_set = sgi_clock_set,
- .clock_get = sgi_clock_get,
-diff --git a/drivers/char/pcmcia/ipwireless/tty.c b/drivers/char/pcmcia/ipwireless/tty.c
-index 674b3ab..a8d1970 100644
---- a/drivers/char/pcmcia/ipwireless/tty.c
-+++ b/drivers/char/pcmcia/ipwireless/tty.c
-@@ -29,6 +29,7 @@
- #include <linux/tty_driver.h>
- #include <linux/tty_flip.h>
- #include <linux/uaccess.h>
-+#include <asm/local.h>
-
- #include "tty.h"
- #include "network.h"
-@@ -51,7 +52,7 @@ struct ipw_tty {
- int tty_type;
- struct ipw_network *network;
- struct tty_struct *linux_tty;
-- int open_count;
-+ local_t open_count;
- unsigned int control_lines;
- struct mutex ipw_tty_mutex;
- int tx_bytes_queued;
-@@ -127,10 +128,10 @@ static int ipw_open(struct tty_struct *linux_tty, struct file *filp)
- mutex_unlock(&tty->ipw_tty_mutex);
- return -ENODEV;
- }
-- if (tty->open_count == 0)
-+ if (local_read(&tty->open_count) == 0)
- tty->tx_bytes_queued = 0;
-
-- tty->open_count++;
-+ local_inc(&tty->open_count);
-
- tty->linux_tty = linux_tty;
- linux_tty->driver_data = tty;
-@@ -146,9 +147,7 @@ static int ipw_open(struct tty_struct *linux_tty, struct file *filp)
-
- static void do_ipw_close(struct ipw_tty *tty)
- {
-- tty->open_count--;
--
-- if (tty->open_count == 0) {
-+ if (local_dec_return(&tty->open_count) == 0) {
- struct tty_struct *linux_tty = tty->linux_tty;
-
- if (linux_tty != NULL) {
-@@ -169,7 +168,7 @@ static void ipw_hangup(struct tty_struct *linux_tty)
- return;
-
- mutex_lock(&tty->ipw_tty_mutex);
-- if (tty->open_count == 0) {
-+ if (local_read(&tty->open_count) == 0) {
- mutex_unlock(&tty->ipw_tty_mutex);
- return;
- }
-@@ -198,7 +197,7 @@ void ipwireless_tty_received(struct ipw_tty *tty, unsigned char *data,
- return;
- }
-
-- if (!tty->open_count) {
-+ if (!local_read(&tty->open_count)) {
- mutex_unlock(&tty->ipw_tty_mutex);
- return;
- }
-@@ -240,7 +239,7 @@ static int ipw_write(struct tty_struct *linux_tty,
- return -ENODEV;
-
- mutex_lock(&tty->ipw_tty_mutex);
-- if (!tty->open_count) {
-+ if (!local_read(&tty->open_count)) {
- mutex_unlock(&tty->ipw_tty_mutex);
- return -EINVAL;
- }
-@@ -280,7 +279,7 @@ static int ipw_write_room(struct tty_struct *linux_tty)
- if (!tty)
- return -ENODEV;
-
-- if (!tty->open_count)
-+ if (!local_read(&tty->open_count))
- return -EINVAL;
-
- room = IPWIRELESS_TX_QUEUE_SIZE - tty->tx_bytes_queued;
-@@ -322,7 +321,7 @@ static int ipw_chars_in_buffer(struct tty_struct *linux_tty)
- if (!tty)
- return 0;
-
-- if (!tty->open_count)
-+ if (!local_read(&tty->open_count))
- return 0;
-
- return tty->tx_bytes_queued;
-@@ -403,7 +402,7 @@ static int ipw_tiocmget(struct tty_struct *linux_tty, struct file *file)
- if (!tty)
- return -ENODEV;
-
-- if (!tty->open_count)
-+ if (!local_read(&tty->open_count))
- return -EINVAL;
-
- return get_control_lines(tty);
-@@ -419,7 +418,7 @@ ipw_tiocmset(struct tty_struct *linux_tty, struct file *file,
- if (!tty)
- return -ENODEV;
-
-- if (!tty->open_count)
-+ if (!local_read(&tty->open_count))
- return -EINVAL;
-
- return set_control_lines(tty, set, clear);
-@@ -433,7 +432,7 @@ static int ipw_ioctl(struct tty_struct *linux_tty, struct file *file,
- if (!tty)
- return -ENODEV;
-
-- if (!tty->open_count)
-+ if (!local_read(&tty->open_count))
- return -EINVAL;
-
- /* FIXME: Exactly how is the tty object locked here .. */
-@@ -591,7 +590,7 @@ void ipwireless_tty_free(struct ipw_tty *tty)
- against a parallel ioctl etc */
- mutex_lock(&ttyj->ipw_tty_mutex);
- }
-- while (ttyj->open_count)
-+ while (local_read(&ttyj->open_count))
- do_ipw_close(ttyj);
- ipwireless_disassociate_network_ttys(network,
- ttyj->channel_idx);
-diff --git a/drivers/char/pty.c b/drivers/char/pty.c
-index 62f282e..e45c45c 100644
---- a/drivers/char/pty.c
-+++ b/drivers/char/pty.c
-@@ -736,8 +736,10 @@ static void __init unix98_pty_init(void)
- register_sysctl_table(pty_root_table);
-
- /* Now create the /dev/ptmx special device */
-+ pax_open_kernel();
- tty_default_fops(&ptmx_fops);
-- ptmx_fops.open = ptmx_open;
-+ *(void **)&ptmx_fops.open = ptmx_open;
-+ pax_close_kernel();
-
- cdev_init(&ptmx_cdev, &ptmx_fops);
- if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
-diff --git a/drivers/char/random.c b/drivers/char/random.c
-index 446b20a..710568a 100644
---- a/drivers/char/random.c
-+++ b/drivers/char/random.c
-@@ -269,8 +269,13 @@
- /*
- * Configuration information
- */
-+#ifdef CONFIG_GRKERNSEC_RANDNET
-+#define INPUT_POOL_WORDS 512
-+#define OUTPUT_POOL_WORDS 128
-+#else
- #define INPUT_POOL_WORDS 128
- #define OUTPUT_POOL_WORDS 32
-+#endif
- #define SEC_XFER_SIZE 512
- #define EXTRACT_SIZE 10
-
-@@ -310,10 +315,17 @@ static struct poolinfo {
- int poolwords;
- int tap1, tap2, tap3, tap4, tap5;
- } poolinfo_table[] = {
-+#ifdef CONFIG_GRKERNSEC_RANDNET
-+ /* x^512 + x^411 + x^308 + x^208 +x^104 + x + 1 -- 225 */
-+ { 512, 411, 308, 208, 104, 1 },
-+ /* x^128 + x^103 + x^76 + x^51 + x^25 + x + 1 -- 105 */
-+ { 128, 103, 76, 51, 25, 1 },
-+#else
- /* x^128 + x^103 + x^76 + x^51 +x^25 + x + 1 -- 105 */
- { 128, 103, 76, 51, 25, 1 },
- /* x^32 + x^26 + x^20 + x^14 + x^7 + x + 1 -- 15 */
- { 32, 26, 20, 14, 7, 1 },
-+#endif
- #if 0
- /* x^2048 + x^1638 + x^1231 + x^819 + x^411 + x + 1 -- 115 */
- { 2048, 1638, 1231, 819, 411, 1 },
-@@ -434,6 +446,7 @@ struct entropy_store {
- int entropy_count;
- int entropy_total;
- unsigned int initialized:1;
-+ bool last_data_init;
- __u8 last_data[EXTRACT_SIZE];
- };
-
-@@ -524,8 +537,8 @@ static void __mix_pool_bytes(struct entropy_store *r, const void *in,
- input_rotate += i ? 7 : 14;
- }
-
-- ACCESS_ONCE(r->input_rotate) = input_rotate;
-- ACCESS_ONCE(r->add_ptr) = i;
-+ ACCESS_ONCE_RW(r->input_rotate) = input_rotate;
-+ ACCESS_ONCE_RW(r->add_ptr) = i;
- smp_wmb();
-
- if (out)
-@@ -942,6 +955,10 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
- ssize_t ret = 0, i;
- __u8 tmp[EXTRACT_SIZE];
-
-+ /* if last_data isn't primed, we need EXTRACT_SIZE extra bytes */
-+ if (fips_enabled && !r->last_data_init)
-+ nbytes += EXTRACT_SIZE;
-+
- xfer_secondary_pool(r, nbytes);
- nbytes = account(r, nbytes, min, reserved);
-
-@@ -951,6 +968,17 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
- if (fips_enabled) {
- unsigned long flags;
-
-+
-+ /* prime last_data value if need be, per fips 140-2 */
-+ if (!r->last_data_init) {
-+ spin_lock_irqsave(&r->lock, flags);
-+ memcpy(r->last_data, tmp, EXTRACT_SIZE);
-+ r->last_data_init = true;
-+ nbytes -= EXTRACT_SIZE;
-+ spin_unlock_irqrestore(&r->lock, flags);
-+ extract_buf(r, tmp);
-+ }
-+
- spin_lock_irqsave(&r->lock, flags);
- if (!memcmp(tmp, r->last_data, EXTRACT_SIZE))
- panic("Hardware RNG duplicated output!\n");
-@@ -1015,7 +1043,21 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf,
- */
- void get_random_bytes(void *buf, int nbytes)
- {
-- extract_entropy(&nonblocking_pool, buf, nbytes, 0, 0);
-+ char *p = buf;
-+
-+ while (nbytes) {
-+ unsigned long v;
-+ int chunk = min(nbytes, (int)sizeof(unsigned long));
-+
-+ if (!arch_get_random_long(&v))
-+ break;
-+
-+ memcpy(buf, &v, chunk);
-+ p += chunk;
-+ nbytes -= chunk;
-+ }
-+
-+ extract_entropy(&nonblocking_pool, p, nbytes, 0, 0);
- }
- EXPORT_SYMBOL(get_random_bytes);
-
-@@ -1068,6 +1110,7 @@ static void init_std_data(struct entropy_store *r)
-
- r->entropy_count = 0;
- r->entropy_total = 0;
-+ r->last_data_init = false;
- mix_pool_bytes(r, &now, sizeof(now), NULL);
- for (i = r->poolinfo->POOLBYTES; i > 0; i -= sizeof(rv)) {
- if (!arch_get_random_long(&rv))
-@@ -1322,7 +1365,7 @@ EXPORT_SYMBOL(generate_random_uuid);
- #include <linux/sysctl.h>
-
- static int min_read_thresh = 8, min_write_thresh;
--static int max_read_thresh = INPUT_POOL_WORDS * 32;
-+static int max_read_thresh = OUTPUT_POOL_WORDS * 32;
- static int max_write_thresh = INPUT_POOL_WORDS * 32;
- static char sysctl_bootid[16];
-
-@@ -1397,6 +1440,7 @@ static int uuid_strategy(ctl_table *table,
- }
-
- static int sysctl_poolsize = INPUT_POOL_WORDS * 32;
-+extern ctl_table random_table[];
- ctl_table random_table[] = {
- {
- .ctl_name = RANDOM_POOLSIZE,
-@@ -1472,7 +1516,7 @@ late_initcall(random_int_secret_init);
- * value is not cryptographically secure but for several uses the cost of
- * depleting entropy is too high
- */
--DEFINE_PER_CPU(__u32 [MD5_DIGEST_WORDS], get_random_int_hash);
-+static DEFINE_PER_CPU(__u32 [MD5_DIGEST_WORDS], get_random_int_hash);
- unsigned int get_random_int(void)
- {
- __u32 *hash;
-diff --git a/drivers/char/rocket.c b/drivers/char/rocket.c
-index 0e29a23..0efc2c2 100644
---- a/drivers/char/rocket.c
-+++ b/drivers/char/rocket.c
-@@ -1266,6 +1266,8 @@ static int get_ports(struct r_port *info, struct rocket_ports __user *retports)
- struct rocket_ports tmp;
- int board;
-
-+ pax_track_stack();
-+
- if (!retports)
- return -EFAULT;
- memset(&tmp, 0, sizeof (tmp));
-diff --git a/drivers/char/sonypi.c b/drivers/char/sonypi.c
-index 8c262aa..4d3b058 100644
---- a/drivers/char/sonypi.c
-+++ b/drivers/char/sonypi.c
-@@ -55,6 +55,7 @@
- #include <asm/uaccess.h>
- #include <asm/io.h>
- #include <asm/system.h>
-+#include <asm/local.h>
-
- #include <linux/sonypi.h>
-
-@@ -491,7 +492,7 @@ static struct sonypi_device {
- spinlock_t fifo_lock;
- wait_queue_head_t fifo_proc_list;
- struct fasync_struct *fifo_async;
-- int open_count;
-+ local_t open_count;
- int model;
- struct input_dev *input_jog_dev;
- struct input_dev *input_key_dev;
-@@ -895,7 +896,7 @@ static int sonypi_misc_fasync(int fd, struct file *filp, int on)
- static int sonypi_misc_release(struct inode *inode, struct file *file)
- {
- mutex_lock(&sonypi_device.lock);
-- sonypi_device.open_count--;
-+ local_dec(&sonypi_device.open_count);
- mutex_unlock(&sonypi_device.lock);
- return 0;
- }
-@@ -905,9 +906,9 @@ static int sonypi_misc_open(struct inode *inode, struct file *file)
- lock_kernel();
- mutex_lock(&sonypi_device.lock);
- /* Flush input queue on first open */
-- if (!sonypi_device.open_count)
-+ if (!local_read(&sonypi_device.open_count))
- kfifo_reset(sonypi_device.fifo);
-- sonypi_device.open_count++;
-+ local_inc(&sonypi_device.open_count);
- mutex_unlock(&sonypi_device.lock);
- unlock_kernel();
- return 0;
-diff --git a/drivers/char/stallion.c b/drivers/char/stallion.c
-index db6dcfa..13834cb 100644
---- a/drivers/char/stallion.c
-+++ b/drivers/char/stallion.c
-@@ -2448,6 +2448,8 @@ static int stl_getportstruct(struct stlport __user *arg)
- struct stlport stl_dummyport;
- struct stlport *portp;
-
-+ pax_track_stack();
-+
- if (copy_from_user(&stl_dummyport, arg, sizeof(struct stlport)))
- return -EFAULT;
- portp = stl_getport(stl_dummyport.brdnr, stl_dummyport.panelnr,
-diff --git a/drivers/char/sysrq.c b/drivers/char/sysrq.c
-index 44203ff..09a3678 100644
---- a/drivers/char/sysrq.c
-+++ b/drivers/char/sysrq.c
-@@ -591,7 +591,7 @@ EXPORT_SYMBOL(unregister_sysrq_key);
- static ssize_t write_sysrq_trigger(struct file *file, const char __user *buf,
- size_t count, loff_t *ppos)
- {
-- if (count) {
-+ if (count && capable(CAP_SYS_ADMIN)) {
- char c;
-
- if (get_user(c, buf))
-diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
-index a0789f6..cea3902 100644
---- a/drivers/char/tpm/tpm.c
-+++ b/drivers/char/tpm/tpm.c
-@@ -405,7 +405,7 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
- chip->vendor.req_complete_val)
- goto out_recv;
-
-- if ((status == chip->vendor.req_canceled)) {
-+ if (status == chip->vendor.req_canceled) {
- dev_err(chip->dev, "Operation Canceled\n");
- rc = -ECANCELED;
- goto out;
-@@ -824,6 +824,8 @@ ssize_t tpm_show_pubek(struct device *dev, struct device_attribute *attr,
-
- struct tpm_chip *chip = dev_get_drvdata(dev);
-
-+ pax_track_stack();
-+
- tpm_cmd.header.in = tpm_readpubek_header;
- err = transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE,
- "attempting to read the PUBEK");
-diff --git a/drivers/char/tpm/tpm_bios.c b/drivers/char/tpm/tpm_bios.c
-index bf2170f..ce8cab9 100644
---- a/drivers/char/tpm/tpm_bios.c
-+++ b/drivers/char/tpm/tpm_bios.c
-@@ -172,7 +172,7 @@ static void *tpm_bios_measurements_start(struct seq_file *m, loff_t *pos)
- event = addr;
-
- if ((event->event_type == 0 && event->event_size == 0) ||
-- ((addr + sizeof(struct tcpa_event) + event->event_size) >= limit))
-+ (event->event_size >= limit - addr - sizeof(struct tcpa_event)))
- return NULL;
-
- return addr;
-@@ -197,7 +197,7 @@ static void *tpm_bios_measurements_next(struct seq_file *m, void *v,
- return NULL;
-
- if ((event->event_type == 0 && event->event_size == 0) ||
-- ((v + sizeof(struct tcpa_event) + event->event_size) >= limit))
-+ (event->event_size >= limit - v - sizeof(struct tcpa_event)))
- return NULL;
-
- (*pos)++;
-@@ -290,7 +290,8 @@ static int tpm_binary_bios_measurements_show(struct seq_file *m, void *v)
- int i;
-
- for (i = 0; i < sizeof(struct tcpa_event) + event->event_size; i++)
-- seq_putc(m, data[i]);
-+ if (!seq_putc(m, data[i]))
-+ return -EFAULT;
-
- return 0;
- }
-@@ -409,8 +410,13 @@ static int read_log(struct tpm_bios_log *log)
- log->bios_event_log_end = log->bios_event_log + len;
-
- virt = acpi_os_map_memory(start, len);
-+ if (!virt) {
-+ kfree(log->bios_event_log);
-+ log->bios_event_log = NULL;
-+ return -EFAULT;
-+ }
-
-- memcpy(log->bios_event_log, virt, len);
-+ memcpy(log->bios_event_log, (const char __force_kernel *)virt, len);
-
- acpi_os_unmap_memory(virt, len);
- return 0;
-diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
-index 123cedf..6664cb4 100644
---- a/drivers/char/tty_io.c
-+++ b/drivers/char/tty_io.c
-@@ -146,7 +146,7 @@ static int tty_open(struct inode *, struct file *);
- static int tty_release(struct inode *, struct file *);
- long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
- #ifdef CONFIG_COMPAT
--static long tty_compat_ioctl(struct file *file, unsigned int cmd,
-+long tty_compat_ioctl(struct file *file, unsigned int cmd,
- unsigned long arg);
- #else
- #define tty_compat_ioctl NULL
-@@ -1774,6 +1774,7 @@ got_driver:
-
- if (IS_ERR(tty)) {
- mutex_unlock(&tty_mutex);
-+ tty_driver_kref_put(driver);
- return PTR_ERR(tty);
- }
- }
-@@ -2603,8 +2604,10 @@ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
- return retval;
- }
-
-+EXPORT_SYMBOL(tty_ioctl);
-+
- #ifdef CONFIG_COMPAT
--static long tty_compat_ioctl(struct file *file, unsigned int cmd,
-+long tty_compat_ioctl(struct file *file, unsigned int cmd,
- unsigned long arg)
- {
- struct inode *inode = file->f_dentry->d_inode;
-@@ -2628,6 +2631,8 @@ static long tty_compat_ioctl(struct file *file, unsigned int cmd,
-
- return retval;
- }
-+
-+EXPORT_SYMBOL(tty_compat_ioctl);
- #endif
-
- /*
-@@ -3073,7 +3078,7 @@ EXPORT_SYMBOL_GPL(get_current_tty);
-
- void tty_default_fops(struct file_operations *fops)
- {
-- *fops = tty_fops;
-+ memcpy((void *)fops, &tty_fops, sizeof(tty_fops));
- }
-
- /*
-diff --git a/drivers/char/tty_ldisc.c b/drivers/char/tty_ldisc.c
-index d814a3d..b55b9c9 100644
---- a/drivers/char/tty_ldisc.c
-+++ b/drivers/char/tty_ldisc.c
-@@ -74,7 +74,7 @@ static void put_ldisc(struct tty_ldisc *ld)
- if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) {
- struct tty_ldisc_ops *ldo = ld->ops;
-
-- ldo->refcount--;
-+ atomic_dec(&ldo->refcount);
- module_put(ldo->owner);
- spin_unlock_irqrestore(&tty_ldisc_lock, flags);
-
-@@ -109,7 +109,7 @@ int tty_register_ldisc(int disc, struct tty_ldisc_ops *new_ldisc)
- spin_lock_irqsave(&tty_ldisc_lock, flags);
- tty_ldiscs[disc] = new_ldisc;
- new_ldisc->num = disc;
-- new_ldisc->refcount = 0;
-+ atomic_set(&new_ldisc->refcount, 0);
- spin_unlock_irqrestore(&tty_ldisc_lock, flags);
-
- return ret;
-@@ -137,7 +137,7 @@ int tty_unregister_ldisc(int disc)
- return -EINVAL;
-
- spin_lock_irqsave(&tty_ldisc_lock, flags);
-- if (tty_ldiscs[disc]->refcount)
-+ if (atomic_read(&tty_ldiscs[disc]->refcount))
- ret = -EBUSY;
- else
- tty_ldiscs[disc] = NULL;
-@@ -158,7 +158,7 @@ static struct tty_ldisc_ops *get_ldops(int disc)
- if (ldops) {
- ret = ERR_PTR(-EAGAIN);
- if (try_module_get(ldops->owner)) {
-- ldops->refcount++;
-+ atomic_inc(&ldops->refcount);
- ret = ldops;
- }
- }
-@@ -171,7 +171,7 @@ static void put_ldops(struct tty_ldisc_ops *ldops)
- unsigned long flags;
-
- spin_lock_irqsave(&tty_ldisc_lock, flags);
-- ldops->refcount--;
-+ atomic_dec(&ldops->refcount);
- module_put(ldops->owner);
- spin_unlock_irqrestore(&tty_ldisc_lock, flags);
- }
-diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
-index a035ae3..c27fe2c 100644
---- a/drivers/char/virtio_console.c
-+++ b/drivers/char/virtio_console.c
-@@ -133,7 +133,9 @@ static int get_chars(u32 vtermno, char *buf, int count)
- * virtqueue, so we let the drivers do some boutique early-output thing. */
- int __init virtio_cons_early_init(int (*put_chars)(u32, const char *, int))
- {
-- virtio_cons.put_chars = put_chars;
-+ pax_open_kernel();
-+ *(void **)&virtio_cons.put_chars = put_chars;
-+ pax_close_kernel();
- return hvc_instantiate(0, 0, &virtio_cons);
- }
-
-@@ -213,11 +215,13 @@ static int __devinit virtcons_probe(struct virtio_device *dev)
- out_vq = vqs[1];
-
- /* Start using the new console output. */
-- virtio_cons.get_chars = get_chars;
-- virtio_cons.put_chars = put_chars;
-- virtio_cons.notifier_add = notifier_add_vio;
-- virtio_cons.notifier_del = notifier_del_vio;
-- virtio_cons.notifier_hangup = notifier_del_vio;
-+ pax_open_kernel();
-+ *(void **)&virtio_cons.get_chars = get_chars;
-+ *(void **)&virtio_cons.put_chars = put_chars;
-+ *(void **)&virtio_cons.notifier_add = notifier_add_vio;
-+ *(void **)&virtio_cons.notifier_del = notifier_del_vio;
-+ *(void **)&virtio_cons.notifier_hangup = notifier_del_vio;
-+ pax_close_kernel();
-
- /* The first argument of hvc_alloc() is the virtual console number, so
- * we use zero. The second argument is the parameter for the
-diff --git a/drivers/char/vt.c b/drivers/char/vt.c
-index 0c80c68..53d59c1 100644
---- a/drivers/char/vt.c
-+++ b/drivers/char/vt.c
-@@ -243,7 +243,7 @@ EXPORT_SYMBOL_GPL(unregister_vt_notifier);
-
- static void notify_write(struct vc_data *vc, unsigned int unicode)
- {
-- struct vt_notifier_param param = { .vc = vc, unicode = unicode };
-+ struct vt_notifier_param param = { .vc = vc, .c = unicode };
- atomic_notifier_call_chain(&vt_notifier_list, VT_WRITE, ¶m);
- }
-
-diff --git a/drivers/char/vt_ioctl.c b/drivers/char/vt_ioctl.c
-index 6351a26..999af95 100644
---- a/drivers/char/vt_ioctl.c
-+++ b/drivers/char/vt_ioctl.c
-@@ -210,9 +210,6 @@ do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm, struct kbd_str
- if (copy_from_user(&tmp, user_kbe, sizeof(struct kbentry)))
- return -EFAULT;
-
-- if (!capable(CAP_SYS_TTY_CONFIG))
-- perm = 0;
--
- switch (cmd) {
- case KDGKBENT:
- key_map = key_maps[s];
-@@ -224,8 +221,12 @@ do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm, struct kbd_str
- val = (i ? K_HOLE : K_NOSUCHMAP);
- return put_user(val, &user_kbe->kb_value);
- case KDSKBENT:
-+ if (!capable(CAP_SYS_TTY_CONFIG))
-+ perm = 0;
-+
- if (!perm)
- return -EPERM;
-+
- if (!i && v == K_NOSUCHMAP) {
- /* deallocate map */
- key_map = key_maps[s];
-@@ -325,9 +326,6 @@ do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
- int i, j, k;
- int ret;
-
-- if (!capable(CAP_SYS_TTY_CONFIG))
-- perm = 0;
--
- kbs = kmalloc(sizeof(*kbs), GFP_KERNEL);
- if (!kbs) {
- ret = -ENOMEM;
-@@ -361,6 +359,9 @@ do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
- kfree(kbs);
- return ((p && *p) ? -EOVERFLOW : 0);
- case KDSKBSENT:
-+ if (!capable(CAP_SYS_TTY_CONFIG))
-+ perm = 0;
-+
- if (!perm) {
- ret = -EPERM;
- goto reterr;
-diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
-index c7ae026..1769c1d 100644
---- a/drivers/cpufreq/cpufreq.c
-+++ b/drivers/cpufreq/cpufreq.c
-@@ -750,7 +750,7 @@ static void cpufreq_sysfs_release(struct kobject *kobj)
- complete(&policy->kobj_unregister);
- }
-
--static struct sysfs_ops sysfs_ops = {
-+static const struct sysfs_ops sysfs_ops = {
- .show = show,
- .store = store,
- };
-diff --git a/drivers/cpuidle/sysfs.c b/drivers/cpuidle/sysfs.c
-index 97b0038..2056670 100644
---- a/drivers/cpuidle/sysfs.c
-+++ b/drivers/cpuidle/sysfs.c
-@@ -191,7 +191,7 @@ static ssize_t cpuidle_store(struct kobject * kobj, struct attribute * attr,
- return ret;
- }
-
--static struct sysfs_ops cpuidle_sysfs_ops = {
-+static const struct sysfs_ops cpuidle_sysfs_ops = {
- .show = cpuidle_show,
- .store = cpuidle_store,
- };
-@@ -277,7 +277,7 @@ static ssize_t cpuidle_state_show(struct kobject * kobj,
- return ret;
- }
-
--static struct sysfs_ops cpuidle_state_sysfs_ops = {
-+static const struct sysfs_ops cpuidle_state_sysfs_ops = {
- .show = cpuidle_state_show,
- };
-
-@@ -294,7 +294,7 @@ static struct kobj_type ktype_state_cpuidle = {
- .release = cpuidle_state_sysfs_release,
- };
-
--static void inline cpuidle_free_state_kobj(struct cpuidle_device *device, int i)
-+static inline void cpuidle_free_state_kobj(struct cpuidle_device *device, int i)
- {
- kobject_put(&device->kobjs[i]->kobj);
- wait_for_completion(&device->kobjs[i]->kobj_unregister);
-diff --git a/drivers/crypto/hifn_795x.c b/drivers/crypto/hifn_795x.c
-index 5f753fc..0377ae9 100644
---- a/drivers/crypto/hifn_795x.c
-+++ b/drivers/crypto/hifn_795x.c
-@@ -1655,6 +1655,8 @@ static int hifn_test(struct hifn_device *dev, int encdec, u8 snum)
- 0xCA, 0x34, 0x2B, 0x2E};
- struct scatterlist sg;
-
-+ pax_track_stack();
-+
- memset(src, 0, sizeof(src));
- memset(ctx.key, 0, sizeof(ctx.key));
-
-diff --git a/drivers/crypto/padlock-aes.c b/drivers/crypto/padlock-aes.c
-index 71e6482..de8d96c 100644
---- a/drivers/crypto/padlock-aes.c
-+++ b/drivers/crypto/padlock-aes.c
-@@ -108,6 +108,8 @@ static int aes_set_key(struct crypto_tfm *tfm, const u8 *in_key,
- struct crypto_aes_ctx gen_aes;
- int cpu;
-
-+ pax_track_stack();
-+
- if (key_len % 8) {
- *flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
- return -EINVAL;
-diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c
-index dcc4ab7..cc834bb 100644
---- a/drivers/dma/ioat/dma.c
-+++ b/drivers/dma/ioat/dma.c
-@@ -1146,7 +1146,7 @@ ioat_attr_show(struct kobject *kobj, struct attribute *attr, char *page)
- return entry->show(&chan->common, page);
- }
-
--struct sysfs_ops ioat_sysfs_ops = {
-+const struct sysfs_ops ioat_sysfs_ops = {
- .show = ioat_attr_show,
- };
-
-diff --git a/drivers/dma/ioat/dma.h b/drivers/dma/ioat/dma.h
-index bbc3e78..f2db62c 100644
---- a/drivers/dma/ioat/dma.h
-+++ b/drivers/dma/ioat/dma.h
-@@ -347,7 +347,7 @@ bool ioat_cleanup_preamble(struct ioat_chan_common *chan,
- unsigned long *phys_complete);
- void ioat_kobject_add(struct ioatdma_device *device, struct kobj_type *type);
- void ioat_kobject_del(struct ioatdma_device *device);
--extern struct sysfs_ops ioat_sysfs_ops;
-+extern const struct sysfs_ops ioat_sysfs_ops;
- extern struct ioat_sysfs_entry ioat_version_attr;
- extern struct ioat_sysfs_entry ioat_cap_attr;
- #endif /* IOATDMA_H */
-diff --git a/drivers/dma/ioat/dma_v3.c b/drivers/dma/ioat/dma_v3.c
-index 9908c9e..3ceb0e5 100644
---- a/drivers/dma/ioat/dma_v3.c
-+++ b/drivers/dma/ioat/dma_v3.c
-@@ -71,10 +71,10 @@
- /* provide a lookup table for setting the source address in the base or
- * extended descriptor of an xor or pq descriptor
- */
--static const u8 xor_idx_to_desc __read_mostly = 0xd0;
--static const u8 xor_idx_to_field[] __read_mostly = { 1, 4, 5, 6, 7, 0, 1, 2 };
--static const u8 pq_idx_to_desc __read_mostly = 0xf8;
--static const u8 pq_idx_to_field[] __read_mostly = { 1, 4, 5, 0, 1, 2, 4, 5 };
-+static const u8 xor_idx_to_desc = 0xd0;
-+static const u8 xor_idx_to_field[] = { 1, 4, 5, 6, 7, 0, 1, 2 };
-+static const u8 pq_idx_to_desc = 0xf8;
-+static const u8 pq_idx_to_field[] = { 1, 4, 5, 0, 1, 2, 4, 5 };
-
- static dma_addr_t xor_get_src(struct ioat_raw_descriptor *descs[2], int idx)
- {
-diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
-index 85c464a..378a72b 100644
---- a/drivers/edac/amd64_edac.c
-+++ b/drivers/edac/amd64_edac.c
-@@ -106,8 +106,11 @@ static int amd64_search_set_scrub_rate(struct pci_dev *ctl, u32 new_bw,
- * memory controller and apply to register. Search for the first
- * bandwidth entry that is greater or equal than the setting requested
- * and program that. If at last entry, turn off DRAM scrubbing.
-+ *
-+ * If no suitable bandwidth is found, turn off DRAM scrubbing entirely
-+ * by falling back to the last element in scrubrates[].
- */
-- for (i = 0; i < ARRAY_SIZE(scrubrates); i++) {
-+ for (i = 0; i < ARRAY_SIZE(scrubrates) - 1; i++) {
- /*
- * skip scrub rates which aren't recommended
- * (see F10 BKDG, F3x58)
-@@ -117,12 +120,6 @@ static int amd64_search_set_scrub_rate(struct pci_dev *ctl, u32 new_bw,
-
- if (scrubrates[i].bandwidth <= new_bw)
- break;
--
-- /*
-- * if no suitable bandwidth found, turn off DRAM scrubbing
-- * entirely by falling back to the last element in the
-- * scrubrates array.
-- */
- }
-
- scrubval = scrubrates[i].scrubval;
-@@ -3099,7 +3096,7 @@ static void __devexit amd64_remove_one_instance(struct pci_dev *pdev)
- * PCI core identifies what devices are on a system during boot, and then
- * inquiry this table to see if this driver is for a given device found.
- */
--static const struct pci_device_id amd64_pci_table[] __devinitdata = {
-+static const struct pci_device_id amd64_pci_table[] __devinitconst = {
- {
- .vendor = PCI_VENDOR_ID_AMD,
- .device = PCI_DEVICE_ID_AMD_K8_NB_MEMCTL,
-diff --git a/drivers/edac/amd76x_edac.c b/drivers/edac/amd76x_edac.c
-index 2b95f1a..4f52793 100644
---- a/drivers/edac/amd76x_edac.c
-+++ b/drivers/edac/amd76x_edac.c
-@@ -322,7 +322,7 @@ static void __devexit amd76x_remove_one(struct pci_dev *pdev)
- edac_mc_free(mci);
- }
-
--static const struct pci_device_id amd76x_pci_tbl[] __devinitdata = {
-+static const struct pci_device_id amd76x_pci_tbl[] __devinitconst = {
- {
- PCI_VEND_DEV(AMD, FE_GATE_700C), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
- AMD762},
-diff --git a/drivers/edac/e752x_edac.c b/drivers/edac/e752x_edac.c
-index d205d49..74c9672 100644
---- a/drivers/edac/e752x_edac.c
-+++ b/drivers/edac/e752x_edac.c
-@@ -1282,7 +1282,7 @@ static void __devexit e752x_remove_one(struct pci_dev *pdev)
- edac_mc_free(mci);
- }
-
--static const struct pci_device_id e752x_pci_tbl[] __devinitdata = {
-+static const struct pci_device_id e752x_pci_tbl[] __devinitconst = {
- {
- PCI_VEND_DEV(INTEL, 7520_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
- E7520},
-diff --git a/drivers/edac/e7xxx_edac.c b/drivers/edac/e7xxx_edac.c
-index c7d11cc..c59c1ca 100644
---- a/drivers/edac/e7xxx_edac.c
-+++ b/drivers/edac/e7xxx_edac.c
-@@ -526,7 +526,7 @@ static void __devexit e7xxx_remove_one(struct pci_dev *pdev)
- edac_mc_free(mci);
- }
-
--static const struct pci_device_id e7xxx_pci_tbl[] __devinitdata = {
-+static const struct pci_device_id e7xxx_pci_tbl[] __devinitconst = {
- {
- PCI_VEND_DEV(INTEL, 7205_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
- E7205},
-diff --git a/drivers/edac/edac_device_sysfs.c b/drivers/edac/edac_device_sysfs.c
-index 5376457..5fdedbc 100644
---- a/drivers/edac/edac_device_sysfs.c
-+++ b/drivers/edac/edac_device_sysfs.c
-@@ -137,7 +137,7 @@ static ssize_t edac_dev_ctl_info_store(struct kobject *kobj,
- }
-
- /* edac_dev file operations for an 'ctl_info' */
--static struct sysfs_ops device_ctl_info_ops = {
-+static const struct sysfs_ops device_ctl_info_ops = {
- .show = edac_dev_ctl_info_show,
- .store = edac_dev_ctl_info_store
- };
-@@ -373,7 +373,7 @@ static ssize_t edac_dev_instance_store(struct kobject *kobj,
- }
-
- /* edac_dev file operations for an 'instance' */
--static struct sysfs_ops device_instance_ops = {
-+static const struct sysfs_ops device_instance_ops = {
- .show = edac_dev_instance_show,
- .store = edac_dev_instance_store
- };
-@@ -476,7 +476,7 @@ static ssize_t edac_dev_block_store(struct kobject *kobj,
- }
-
- /* edac_dev file operations for a 'block' */
--static struct sysfs_ops device_block_ops = {
-+static const struct sysfs_ops device_block_ops = {
- .show = edac_dev_block_show,
- .store = edac_dev_block_store
- };
-diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
-index e1d4ce0..88840e9 100644
---- a/drivers/edac/edac_mc_sysfs.c
-+++ b/drivers/edac/edac_mc_sysfs.c
-@@ -245,7 +245,7 @@ static ssize_t csrowdev_store(struct kobject *kobj, struct attribute *attr,
- return -EIO;
- }
-
--static struct sysfs_ops csrowfs_ops = {
-+static const struct sysfs_ops csrowfs_ops = {
- .show = csrowdev_show,
- .store = csrowdev_store
- };
-@@ -575,7 +575,7 @@ static ssize_t mcidev_store(struct kobject *kobj, struct attribute *attr,
- }
-
- /* Intermediate show/store table */
--static struct sysfs_ops mci_ops = {
-+static const struct sysfs_ops mci_ops = {
- .show = mcidev_show,
- .store = mcidev_store
- };
-diff --git a/drivers/edac/edac_pci_sysfs.c b/drivers/edac/edac_pci_sysfs.c
-index 422728c..d8d9c88 100644
---- a/drivers/edac/edac_pci_sysfs.c
-+++ b/drivers/edac/edac_pci_sysfs.c
-@@ -25,8 +25,8 @@ static int edac_pci_log_pe = 1; /* log PCI parity errors */
- static int edac_pci_log_npe = 1; /* log PCI non-parity error errors */
- static int edac_pci_poll_msec = 1000; /* one second workq period */
-
--static atomic_t pci_parity_count = ATOMIC_INIT(0);
--static atomic_t pci_nonparity_count = ATOMIC_INIT(0);
-+static atomic_unchecked_t pci_parity_count = ATOMIC_INIT(0);
-+static atomic_unchecked_t pci_nonparity_count = ATOMIC_INIT(0);
-
- static struct kobject *edac_pci_top_main_kobj;
- static atomic_t edac_pci_sysfs_refcount = ATOMIC_INIT(0);
-@@ -121,7 +121,7 @@ static ssize_t edac_pci_instance_store(struct kobject *kobj,
- }
-
- /* fs_ops table */
--static struct sysfs_ops pci_instance_ops = {
-+static const struct sysfs_ops pci_instance_ops = {
- .show = edac_pci_instance_show,
- .store = edac_pci_instance_store
- };
-@@ -261,7 +261,7 @@ static ssize_t edac_pci_dev_store(struct kobject *kobj,
- return -EIO;
- }
-
--static struct sysfs_ops edac_pci_sysfs_ops = {
-+static const struct sysfs_ops edac_pci_sysfs_ops = {
- .show = edac_pci_dev_show,
- .store = edac_pci_dev_store
- };
-@@ -579,7 +579,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
- edac_printk(KERN_CRIT, EDAC_PCI,
- "Signaled System Error on %s\n",
- pci_name(dev));
-- atomic_inc(&pci_nonparity_count);
-+ atomic_inc_unchecked(&pci_nonparity_count);
- }
-
- if (status & (PCI_STATUS_PARITY)) {
-@@ -587,7 +587,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
- "Master Data Parity Error on %s\n",
- pci_name(dev));
-
-- atomic_inc(&pci_parity_count);
-+ atomic_inc_unchecked(&pci_parity_count);
- }
-
- if (status & (PCI_STATUS_DETECTED_PARITY)) {
-@@ -595,7 +595,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
- "Detected Parity Error on %s\n",
- pci_name(dev));
-
-- atomic_inc(&pci_parity_count);
-+ atomic_inc_unchecked(&pci_parity_count);
- }
- }
-
-@@ -616,7 +616,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
- edac_printk(KERN_CRIT, EDAC_PCI, "Bridge "
- "Signaled System Error on %s\n",
- pci_name(dev));
-- atomic_inc(&pci_nonparity_count);
-+ atomic_inc_unchecked(&pci_nonparity_count);
- }
-
- if (status & (PCI_STATUS_PARITY)) {
-@@ -624,7 +624,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
- "Master Data Parity Error on "
- "%s\n", pci_name(dev));
-
-- atomic_inc(&pci_parity_count);
-+ atomic_inc_unchecked(&pci_parity_count);
- }
-
- if (status & (PCI_STATUS_DETECTED_PARITY)) {
-@@ -632,7 +632,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
- "Detected Parity Error on %s\n",
- pci_name(dev));
-
-- atomic_inc(&pci_parity_count);
-+ atomic_inc_unchecked(&pci_parity_count);
- }
- }
- }
-@@ -674,7 +674,7 @@ void edac_pci_do_parity_check(void)
- if (!check_pci_errors)
- return;
-
-- before_count = atomic_read(&pci_parity_count);
-+ before_count = atomic_read_unchecked(&pci_parity_count);
-
- /* scan all PCI devices looking for a Parity Error on devices and
- * bridges.
-@@ -686,7 +686,7 @@ void edac_pci_do_parity_check(void)
- /* Only if operator has selected panic on PCI Error */
- if (edac_pci_get_panic_on_pe()) {
- /* If the count is different 'after' from 'before' */
-- if (before_count != atomic_read(&pci_parity_count))
-+ if (before_count != atomic_read_unchecked(&pci_parity_count))
- panic("EDAC: PCI Parity Error");
- }
- }
-diff --git a/drivers/edac/i3000_edac.c b/drivers/edac/i3000_edac.c
-index 6c9a0f2..9c1cf7e 100644
---- a/drivers/edac/i3000_edac.c
-+++ b/drivers/edac/i3000_edac.c
-@@ -471,7 +471,7 @@ static void __devexit i3000_remove_one(struct pci_dev *pdev)
- edac_mc_free(mci);
- }
-
--static const struct pci_device_id i3000_pci_tbl[] __devinitdata = {
-+static const struct pci_device_id i3000_pci_tbl[] __devinitconst = {
- {
- PCI_VEND_DEV(INTEL, 3000_HB), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
- I3000},
-diff --git a/drivers/edac/i3200_edac.c b/drivers/edac/i3200_edac.c
-index fde4db9..fe108f9 100644
---- a/drivers/edac/i3200_edac.c
-+++ b/drivers/edac/i3200_edac.c
-@@ -444,7 +444,7 @@ static void __devexit i3200_remove_one(struct pci_dev *pdev)
- edac_mc_free(mci);
- }
-
--static const struct pci_device_id i3200_pci_tbl[] __devinitdata = {
-+static const struct pci_device_id i3200_pci_tbl[] __devinitconst = {
- {
- PCI_VEND_DEV(INTEL, 3200_HB), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
- I3200},
-diff --git a/drivers/edac/i5000_edac.c b/drivers/edac/i5000_edac.c
-index adc10a2..57d4ccf 100644
---- a/drivers/edac/i5000_edac.c
-+++ b/drivers/edac/i5000_edac.c
-@@ -1516,7 +1516,7 @@ static void __devexit i5000_remove_one(struct pci_dev *pdev)
- *
- * The "E500P" device is the first device supported.
- */
--static const struct pci_device_id i5000_pci_tbl[] __devinitdata = {
-+static const struct pci_device_id i5000_pci_tbl[] __devinitconst = {
- {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_I5000_DEV16),
- .driver_data = I5000P},
-
-diff --git a/drivers/edac/i5100_edac.c b/drivers/edac/i5100_edac.c
-index 22db05a..b2b5503 100644
---- a/drivers/edac/i5100_edac.c
-+++ b/drivers/edac/i5100_edac.c
-@@ -944,7 +944,7 @@ static void __devexit i5100_remove_one(struct pci_dev *pdev)
- edac_mc_free(mci);
- }
-
--static const struct pci_device_id i5100_pci_tbl[] __devinitdata = {
-+static const struct pci_device_id i5100_pci_tbl[] __devinitconst = {
- /* Device 16, Function 0, Channel 0 Memory Map, Error Flag/Mask, ... */
- { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_5100_16) },
- { 0, }
-diff --git a/drivers/edac/i5400_edac.c b/drivers/edac/i5400_edac.c
-index f99d106..f050710 100644
---- a/drivers/edac/i5400_edac.c
-+++ b/drivers/edac/i5400_edac.c
-@@ -1383,7 +1383,7 @@ static void __devexit i5400_remove_one(struct pci_dev *pdev)
- *
- * The "E500P" device is the first device supported.
- */
--static const struct pci_device_id i5400_pci_tbl[] __devinitdata = {
-+static const struct pci_device_id i5400_pci_tbl[] __devinitconst = {
- {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_5400_ERR)},
- {0,} /* 0 terminated list. */
- };
-diff --git a/drivers/edac/i82443bxgx_edac.c b/drivers/edac/i82443bxgx_edac.c
-index 577760a..9ce16ce 100644
---- a/drivers/edac/i82443bxgx_edac.c
-+++ b/drivers/edac/i82443bxgx_edac.c
-@@ -381,7 +381,7 @@ static void __devexit i82443bxgx_edacmc_remove_one(struct pci_dev *pdev)
-
- EXPORT_SYMBOL_GPL(i82443bxgx_edacmc_remove_one);
-
--static const struct pci_device_id i82443bxgx_pci_tbl[] __devinitdata = {
-+static const struct pci_device_id i82443bxgx_pci_tbl[] __devinitconst = {
- {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443BX_0)},
- {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443BX_2)},
- {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443GX_0)},
-diff --git a/drivers/edac/i82860_edac.c b/drivers/edac/i82860_edac.c
-index c0088ba..64a7b98 100644
---- a/drivers/edac/i82860_edac.c
-+++ b/drivers/edac/i82860_edac.c
-@@ -271,7 +271,7 @@ static void __devexit i82860_remove_one(struct pci_dev *pdev)
- edac_mc_free(mci);
- }
-
--static const struct pci_device_id i82860_pci_tbl[] __devinitdata = {
-+static const struct pci_device_id i82860_pci_tbl[] __devinitconst = {
- {
- PCI_VEND_DEV(INTEL, 82860_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
- I82860},
-diff --git a/drivers/edac/i82875p_edac.c b/drivers/edac/i82875p_edac.c
-index b2d83b9..a34357b 100644
---- a/drivers/edac/i82875p_edac.c
-+++ b/drivers/edac/i82875p_edac.c
-@@ -512,7 +512,7 @@ static void __devexit i82875p_remove_one(struct pci_dev *pdev)
- edac_mc_free(mci);
- }
-
--static const struct pci_device_id i82875p_pci_tbl[] __devinitdata = {
-+static const struct pci_device_id i82875p_pci_tbl[] __devinitconst = {
- {
- PCI_VEND_DEV(INTEL, 82875_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
- I82875P},
-diff --git a/drivers/edac/i82975x_edac.c b/drivers/edac/i82975x_edac.c
-index 2eed3ea..87bbbd1 100644
---- a/drivers/edac/i82975x_edac.c
-+++ b/drivers/edac/i82975x_edac.c
-@@ -586,7 +586,7 @@ static void __devexit i82975x_remove_one(struct pci_dev *pdev)
- edac_mc_free(mci);
- }
-
--static const struct pci_device_id i82975x_pci_tbl[] __devinitdata = {
-+static const struct pci_device_id i82975x_pci_tbl[] __devinitconst = {
- {
- PCI_VEND_DEV(INTEL, 82975_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
- I82975X
-diff --git a/drivers/edac/r82600_edac.c b/drivers/edac/r82600_edac.c
-index 9900675..78ac2b6 100644
---- a/drivers/edac/r82600_edac.c
-+++ b/drivers/edac/r82600_edac.c
-@@ -374,7 +374,7 @@ static void __devexit r82600_remove_one(struct pci_dev *pdev)
- edac_mc_free(mci);
- }
-
--static const struct pci_device_id r82600_pci_tbl[] __devinitdata = {
-+static const struct pci_device_id r82600_pci_tbl[] __devinitconst = {
- {
- PCI_DEVICE(PCI_VENDOR_ID_RADISYS, R82600_BRIDGE_ID)
- },
-diff --git a/drivers/edac/x38_edac.c b/drivers/edac/x38_edac.c
-index d4ec605..4cfec4e 100644
---- a/drivers/edac/x38_edac.c
-+++ b/drivers/edac/x38_edac.c
-@@ -441,7 +441,7 @@ static void __devexit x38_remove_one(struct pci_dev *pdev)
- edac_mc_free(mci);
- }
-
--static const struct pci_device_id x38_pci_tbl[] __devinitdata = {
-+static const struct pci_device_id x38_pci_tbl[] __devinitconst = {
- {
- PCI_VEND_DEV(INTEL, X38_HB), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
- X38},
-diff --git a/drivers/firewire/core-card.c b/drivers/firewire/core-card.c
-index 3fc2ceb..daf098f 100644
---- a/drivers/firewire/core-card.c
-+++ b/drivers/firewire/core-card.c
-@@ -558,7 +558,7 @@ void fw_card_release(struct kref *kref)
-
- void fw_core_remove_card(struct fw_card *card)
- {
-- struct fw_card_driver dummy_driver = dummy_driver_template;
-+ fw_card_driver_no_const dummy_driver = dummy_driver_template;
-
- card->driver->update_phy_reg(card, 4,
- PHY_LINK_ACTIVE | PHY_CONTENDER, 0);
-diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
-index 4560d8f..36db24a 100644
---- a/drivers/firewire/core-cdev.c
-+++ b/drivers/firewire/core-cdev.c
-@@ -1141,8 +1141,7 @@ static int init_iso_resource(struct client *client,
- int ret;
-
- if ((request->channels == 0 && request->bandwidth == 0) ||
-- request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL ||
-- request->bandwidth < 0)
-+ request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL)
- return -EINVAL;
-
- r = kmalloc(sizeof(*r), GFP_KERNEL);
-diff --git a/drivers/firewire/core-transaction.c b/drivers/firewire/core-transaction.c
-index da628c7..cf54a2c 100644
---- a/drivers/firewire/core-transaction.c
-+++ b/drivers/firewire/core-transaction.c
-@@ -36,6 +36,7 @@
- #include <linux/string.h>
- #include <linux/timer.h>
- #include <linux/types.h>
-+#include <linux/sched.h>
-
- #include <asm/byteorder.h>
-
-@@ -344,6 +345,8 @@ int fw_run_transaction(struct fw_card *card, int tcode, int destination_id,
- struct transaction_callback_data d;
- struct fw_transaction t;
-
-+ pax_track_stack();
-+
- init_completion(&d.done);
- d.payload = payload;
- fw_send_request(card, &t, tcode, destination_id, generation, speed,
-diff --git a/drivers/firewire/core.h b/drivers/firewire/core.h
-index 7ff6e75..a2965d9 100644
---- a/drivers/firewire/core.h
-+++ b/drivers/firewire/core.h
-@@ -86,6 +86,7 @@ struct fw_card_driver {
-
- int (*stop_iso)(struct fw_iso_context *ctx);
- };
-+typedef struct fw_card_driver __no_const fw_card_driver_no_const;
-
- void fw_card_initialize(struct fw_card *card,
- const struct fw_card_driver *driver, struct device *device);
-diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
-index 10a4246..8365cd1 100644
---- a/drivers/firmware/dmi_scan.c
-+++ b/drivers/firmware/dmi_scan.c
-@@ -394,11 +394,6 @@ void __init dmi_scan_machine(void)
- }
- }
- else {
-- /*
-- * no iounmap() for that ioremap(); it would be a no-op, but
-- * it's so early in setup that sucker gets confused into doing
-- * what it shouldn't if we actually call it.
-- */
- p = dmi_ioremap(0xF0000, 0x10000);
- if (p == NULL)
- goto error;
-@@ -670,7 +665,7 @@ int dmi_walk(void (*decode)(const struct dmi_header *, void *),
- if (buf == NULL)
- return -1;
-
-- dmi_table(buf, dmi_len, dmi_num, decode, private_data);
-+ dmi_table((char __force_kernel *)buf, dmi_len, dmi_num, decode, private_data);
-
- iounmap(buf);
- return 0;
-diff --git a/drivers/firmware/edd.c b/drivers/firmware/edd.c
-index 9e4f59d..110e24e 100644
---- a/drivers/firmware/edd.c
-+++ b/drivers/firmware/edd.c
-@@ -122,7 +122,7 @@ edd_attr_show(struct kobject * kobj, struct attribute *attr, char *buf)
- return ret;
- }
-
--static struct sysfs_ops edd_attr_ops = {
-+static const struct sysfs_ops edd_attr_ops = {
- .show = edd_attr_show,
- };
-
-diff --git a/drivers/firmware/efivars.c b/drivers/firmware/efivars.c
-index f4f709d..082f06e 100644
---- a/drivers/firmware/efivars.c
-+++ b/drivers/firmware/efivars.c
-@@ -362,7 +362,7 @@ static ssize_t efivar_attr_store(struct kobject *kobj, struct attribute *attr,
- return ret;
- }
-
--static struct sysfs_ops efivar_attr_ops = {
-+static const struct sysfs_ops efivar_attr_ops = {
- .show = efivar_attr_show,
- .store = efivar_attr_store,
- };
-diff --git a/drivers/firmware/iscsi_ibft.c b/drivers/firmware/iscsi_ibft.c
-index 051d1eb..0a5d4e7 100644
---- a/drivers/firmware/iscsi_ibft.c
-+++ b/drivers/firmware/iscsi_ibft.c
-@@ -525,7 +525,7 @@ static ssize_t ibft_show_attribute(struct kobject *kobj,
- return ret;
- }
-
--static struct sysfs_ops ibft_attr_ops = {
-+static const struct sysfs_ops ibft_attr_ops = {
- .show = ibft_show_attribute,
- };
-
-diff --git a/drivers/firmware/memmap.c b/drivers/firmware/memmap.c
-index 56f9234..8c58c7b 100644
---- a/drivers/firmware/memmap.c
-+++ b/drivers/firmware/memmap.c
-@@ -74,7 +74,7 @@ static struct attribute *def_attrs[] = {
- NULL
- };
-
--static struct sysfs_ops memmap_attr_ops = {
-+static const struct sysfs_ops memmap_attr_ops = {
- .show = memmap_attr_show,
- };
-
-diff --git a/drivers/gpio/vr41xx_giu.c b/drivers/gpio/vr41xx_giu.c
-index b16c9a8..2af7d3f 100644
---- a/drivers/gpio/vr41xx_giu.c
-+++ b/drivers/gpio/vr41xx_giu.c
-@@ -204,7 +204,7 @@ static int giu_get_irq(unsigned int irq)
- printk(KERN_ERR "spurious GIU interrupt: %04x(%04x),%04x(%04x)\n",
- maskl, pendl, maskh, pendh);
-
-- atomic_inc(&irq_err_count);
-+ atomic_inc_unchecked(&irq_err_count);
-
- return -EINVAL;
- }
-diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
-index bea6efc..3dc0f42 100644
---- a/drivers/gpu/drm/drm_crtc.c
-+++ b/drivers/gpu/drm/drm_crtc.c
-@@ -1323,7 +1323,7 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
- */
- if ((out_resp->count_modes >= mode_count) && mode_count) {
- copied = 0;
-- mode_ptr = (struct drm_mode_modeinfo *)(unsigned long)out_resp->modes_ptr;
-+ mode_ptr = (struct drm_mode_modeinfo __user *)(unsigned long)out_resp->modes_ptr;
- list_for_each_entry(mode, &connector->modes, head) {
- drm_crtc_convert_to_umode(&u_mode, mode);
- if (copy_to_user(mode_ptr + copied,
-@@ -1338,8 +1338,8 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
-
- if ((out_resp->count_props >= props_count) && props_count) {
- copied = 0;
-- prop_ptr = (uint32_t *)(unsigned long)(out_resp->props_ptr);
-- prop_values = (uint64_t *)(unsigned long)(out_resp->prop_values_ptr);
-+ prop_ptr = (uint32_t __user *)(unsigned long)(out_resp->props_ptr);
-+ prop_values = (uint64_t __user *)(unsigned long)(out_resp->prop_values_ptr);
- for (i = 0; i < DRM_CONNECTOR_MAX_PROPERTY; i++) {
- if (connector->property_ids[i] != 0) {
- if (put_user(connector->property_ids[i],
-@@ -1361,7 +1361,7 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
-
- if ((out_resp->count_encoders >= encoders_count) && encoders_count) {
- copied = 0;
-- encoder_ptr = (uint32_t *)(unsigned long)(out_resp->encoders_ptr);
-+ encoder_ptr = (uint32_t __user *)(unsigned long)(out_resp->encoders_ptr);
- for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
- if (connector->encoder_ids[i] != 0) {
- if (put_user(connector->encoder_ids[i],
-@@ -1513,7 +1513,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
- }
-
- for (i = 0; i < crtc_req->count_connectors; i++) {
-- set_connectors_ptr = (uint32_t *)(unsigned long)crtc_req->set_connectors_ptr;
-+ set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr;
- if (get_user(out_id, &set_connectors_ptr[i])) {
- ret = -EFAULT;
- goto out;
-@@ -2118,7 +2118,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
- out_resp->flags = property->flags;
-
- if ((out_resp->count_values >= value_count) && value_count) {
-- values_ptr = (uint64_t *)(unsigned long)out_resp->values_ptr;
-+ values_ptr = (uint64_t __user *)(unsigned long)out_resp->values_ptr;
- for (i = 0; i < value_count; i++) {
- if (copy_to_user(values_ptr + i, &property->values[i], sizeof(uint64_t))) {
- ret = -EFAULT;
-@@ -2131,7 +2131,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
- if (property->flags & DRM_MODE_PROP_ENUM) {
- if ((out_resp->count_enum_blobs >= enum_count) && enum_count) {
- copied = 0;
-- enum_ptr = (struct drm_mode_property_enum *)(unsigned long)out_resp->enum_blob_ptr;
-+ enum_ptr = (struct drm_mode_property_enum __user *)(unsigned long)out_resp->enum_blob_ptr;
- list_for_each_entry(prop_enum, &property->enum_blob_list, head) {
-
- if (copy_to_user(&enum_ptr[copied].value, &prop_enum->value, sizeof(uint64_t))) {
-@@ -2154,7 +2154,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
- if ((out_resp->count_enum_blobs >= blob_count) && blob_count) {
- copied = 0;
- blob_id_ptr = (uint32_t *)(unsigned long)out_resp->enum_blob_ptr;
-- blob_length_ptr = (uint32_t *)(unsigned long)out_resp->values_ptr;
-+ blob_length_ptr = (uint32_t __user *)(unsigned long)out_resp->values_ptr;
-
- list_for_each_entry(prop_blob, &property->enum_blob_list, head) {
- if (put_user(prop_blob->base.id, blob_id_ptr + copied)) {
-@@ -2226,7 +2226,7 @@ int drm_mode_getblob_ioctl(struct drm_device *dev,
- blob = obj_to_blob(obj);
-
- if (out_resp->length == blob->length) {
-- blob_ptr = (void *)(unsigned long)out_resp->data;
-+ blob_ptr = (void __user *)(unsigned long)out_resp->data;
- if (copy_to_user(blob_ptr, blob->data, blob->length)){
- ret = -EFAULT;
- goto done;
-diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
-index 1b8745d..92fdbf6 100644
---- a/drivers/gpu/drm/drm_crtc_helper.c
-+++ b/drivers/gpu/drm/drm_crtc_helper.c
-@@ -573,7 +573,7 @@ static bool drm_encoder_crtc_ok(struct drm_encoder *encoder,
- struct drm_crtc *tmp;
- int crtc_mask = 1;
-
-- WARN(!crtc, "checking null crtc?");
-+ BUG_ON(!crtc);
-
- dev = crtc->dev;
-
-@@ -642,6 +642,8 @@ bool drm_crtc_helper_set_mode(struct drm_crtc *crtc,
-
- adjusted_mode = drm_mode_duplicate(dev, mode);
-
-+ pax_track_stack();
-+
- crtc->enabled = drm_helper_crtc_in_use(crtc);
-
- if (!crtc->enabled)
-diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
-index 0e27d98..dec8768 100644
---- a/drivers/gpu/drm/drm_drv.c
-+++ b/drivers/gpu/drm/drm_drv.c
-@@ -417,7 +417,7 @@ int drm_ioctl(struct inode *inode, struct file *filp,
- char *kdata = NULL;
-
- atomic_inc(&dev->ioctl_count);
-- atomic_inc(&dev->counts[_DRM_STAT_IOCTLS]);
-+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_IOCTLS]);
- ++file_priv->ioctl_count;
-
- DRM_DEBUG("pid=%d, cmd=0x%02x, nr=0x%02x, dev 0x%lx, auth=%d\n",
-diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c
-index 519161e..98c840c 100644
---- a/drivers/gpu/drm/drm_fops.c
-+++ b/drivers/gpu/drm/drm_fops.c
-@@ -66,7 +66,7 @@ static int drm_setup(struct drm_device * dev)
- }
-
- for (i = 0; i < ARRAY_SIZE(dev->counts); i++)
-- atomic_set(&dev->counts[i], 0);
-+ atomic_set_unchecked(&dev->counts[i], 0);
-
- dev->sigdata.lock = NULL;
-
-@@ -130,9 +130,9 @@ int drm_open(struct inode *inode, struct file *filp)
-
- retcode = drm_open_helper(inode, filp, dev);
- if (!retcode) {
-- atomic_inc(&dev->counts[_DRM_STAT_OPENS]);
-+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_OPENS]);
- spin_lock(&dev->count_lock);
-- if (!dev->open_count++) {
-+ if (local_inc_return(&dev->open_count) == 1) {
- spin_unlock(&dev->count_lock);
- retcode = drm_setup(dev);
- goto out;
-@@ -435,7 +435,7 @@ int drm_release(struct inode *inode, struct file *filp)
-
- lock_kernel();
-
-- DRM_DEBUG("open_count = %d\n", dev->open_count);
-+ DRM_DEBUG("open_count = %d\n", local_read(&dev->open_count));
-
- if (dev->driver->preclose)
- dev->driver->preclose(dev, file_priv);
-@@ -447,7 +447,7 @@ int drm_release(struct inode *inode, struct file *filp)
- DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %d\n",
- task_pid_nr(current),
- (long)old_encode_dev(file_priv->minor->device),
-- dev->open_count);
-+ local_read(&dev->open_count));
-
- /* Release any auth tokens that might point to this file_priv,
- (do that under the drm_global_mutex) */
-@@ -529,9 +529,9 @@ int drm_release(struct inode *inode, struct file *filp)
- * End inline drm_release
- */
-
-- atomic_inc(&dev->counts[_DRM_STAT_CLOSES]);
-+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_CLOSES]);
- spin_lock(&dev->count_lock);
-- if (!--dev->open_count) {
-+ if (local_dec_and_test(&dev->open_count)) {
- if (atomic_read(&dev->ioctl_count)) {
- DRM_ERROR("Device busy: %d\n",
- atomic_read(&dev->ioctl_count));
-diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
-index 8bf3770..79422805 100644
---- a/drivers/gpu/drm/drm_gem.c
-+++ b/drivers/gpu/drm/drm_gem.c
-@@ -83,11 +83,11 @@ drm_gem_init(struct drm_device *dev)
- spin_lock_init(&dev->object_name_lock);
- idr_init(&dev->object_name_idr);
- atomic_set(&dev->object_count, 0);
-- atomic_set(&dev->object_memory, 0);
-+ atomic_set_unchecked(&dev->object_memory, 0);
- atomic_set(&dev->pin_count, 0);
-- atomic_set(&dev->pin_memory, 0);
-+ atomic_set_unchecked(&dev->pin_memory, 0);
- atomic_set(&dev->gtt_count, 0);
-- atomic_set(&dev->gtt_memory, 0);
-+ atomic_set_unchecked(&dev->gtt_memory, 0);
-
- mm = kzalloc(sizeof(struct drm_gem_mm), GFP_KERNEL);
- if (!mm) {
-@@ -150,7 +150,7 @@ drm_gem_object_alloc(struct drm_device *dev, size_t size)
- goto fput;
- }
- atomic_inc(&dev->object_count);
-- atomic_add(obj->size, &dev->object_memory);
-+ atomic_add_unchecked(obj->size, &dev->object_memory);
- return obj;
- fput:
- fput(obj->filp);
-@@ -429,7 +429,7 @@ drm_gem_object_free(struct kref *kref)
-
- fput(obj->filp);
- atomic_dec(&dev->object_count);
-- atomic_sub(obj->size, &dev->object_memory);
-+ atomic_sub_unchecked(obj->size, &dev->object_memory);
- kfree(obj);
- }
- EXPORT_SYMBOL(drm_gem_object_free);
-diff --git a/drivers/gpu/drm/drm_info.c b/drivers/gpu/drm/drm_info.c
-index f0f6c6b..34af322 100644
---- a/drivers/gpu/drm/drm_info.c
-+++ b/drivers/gpu/drm/drm_info.c
-@@ -75,10 +75,14 @@ int drm_vm_info(struct seq_file *m, void *data)
- struct drm_local_map *map;
- struct drm_map_list *r_list;
-
-- /* Hardcoded from _DRM_FRAME_BUFFER,
-- _DRM_REGISTERS, _DRM_SHM, _DRM_AGP, and
-- _DRM_SCATTER_GATHER and _DRM_CONSISTENT */
-- const char *types[] = { "FB", "REG", "SHM", "AGP", "SG", "PCI" };
-+ static const char * const types[] = {
-+ [_DRM_FRAME_BUFFER] = "FB",
-+ [_DRM_REGISTERS] = "REG",
-+ [_DRM_SHM] = "SHM",
-+ [_DRM_AGP] = "AGP",
-+ [_DRM_SCATTER_GATHER] = "SG",
-+ [_DRM_CONSISTENT] = "PCI",
-+ [_DRM_GEM] = "GEM" };
- const char *type;
- int i;
-
-@@ -89,7 +93,7 @@ int drm_vm_info(struct seq_file *m, void *data)
- map = r_list->map;
- if (!map)
- continue;
-- if (map->type < 0 || map->type > 5)
-+ if (map->type >= ARRAY_SIZE(types))
- type = "??";
- else
- type = types[map->type];
-@@ -265,10 +269,10 @@ int drm_gem_object_info(struct seq_file *m, void* data)
- struct drm_device *dev = node->minor->dev;
-
- seq_printf(m, "%d objects\n", atomic_read(&dev->object_count));
-- seq_printf(m, "%d object bytes\n", atomic_read(&dev->object_memory));
-+ seq_printf(m, "%d object bytes\n", atomic_read_unchecked(&dev->object_memory));
- seq_printf(m, "%d pinned\n", atomic_read(&dev->pin_count));
-- seq_printf(m, "%d pin bytes\n", atomic_read(&dev->pin_memory));
-- seq_printf(m, "%d gtt bytes\n", atomic_read(&dev->gtt_memory));
-+ seq_printf(m, "%d pin bytes\n", atomic_read_unchecked(&dev->pin_memory));
-+ seq_printf(m, "%d gtt bytes\n", atomic_read_unchecked(&dev->gtt_memory));
- seq_printf(m, "%d gtt total\n", dev->gtt_total);
- return 0;
- }
-@@ -288,7 +292,11 @@ int drm_vma_info(struct seq_file *m, void *data)
- mutex_lock(&dev->struct_mutex);
- seq_printf(m, "vma use count: %d, high_memory = %p, 0x%08llx\n",
- atomic_read(&dev->vma_count),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL, 0);
-+#else
- high_memory, (u64)virt_to_phys(high_memory));
-+#endif
-
- list_for_each_entry(pt, &dev->vmalist, head) {
- vma = pt->vma;
-@@ -296,14 +304,23 @@ int drm_vma_info(struct seq_file *m, void *data)
- continue;
- seq_printf(m,
- "\n%5d 0x%08lx-0x%08lx %c%c%c%c%c%c 0x%08lx000",
-- pt->pid, vma->vm_start, vma->vm_end,
-+ pt->pid,
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ 0, 0,
-+#else
-+ vma->vm_start, vma->vm_end,
-+#endif
- vma->vm_flags & VM_READ ? 'r' : '-',
- vma->vm_flags & VM_WRITE ? 'w' : '-',
- vma->vm_flags & VM_EXEC ? 'x' : '-',
- vma->vm_flags & VM_MAYSHARE ? 's' : 'p',
- vma->vm_flags & VM_LOCKED ? 'l' : '-',
- vma->vm_flags & VM_IO ? 'i' : '-',
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ 0);
-+#else
- vma->vm_pgoff);
-+#endif
-
- #if defined(__i386__)
- pgprot = pgprot_val(vma->vm_page_prot);
-diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
-index 282d9fd..71e5f11 100644
---- a/drivers/gpu/drm/drm_ioc32.c
-+++ b/drivers/gpu/drm/drm_ioc32.c
-@@ -463,7 +463,7 @@ static int compat_drm_infobufs(struct file *file, unsigned int cmd,
- request = compat_alloc_user_space(nbytes);
- if (!access_ok(VERIFY_WRITE, request, nbytes))
- return -EFAULT;
-- list = (struct drm_buf_desc *) (request + 1);
-+ list = (struct drm_buf_desc __user *) (request + 1);
-
- if (__put_user(count, &request->count)
- || __put_user(list, &request->list))
-@@ -525,7 +525,7 @@ static int compat_drm_mapbufs(struct file *file, unsigned int cmd,
- request = compat_alloc_user_space(nbytes);
- if (!access_ok(VERIFY_WRITE, request, nbytes))
- return -EFAULT;
-- list = (struct drm_buf_pub *) (request + 1);
-+ list = (struct drm_buf_pub __user *) (request + 1);
-
- if (__put_user(count, &request->count)
- || __put_user(list, &request->list))
-diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c
-index 9b9ff46..4ea724c 100644
---- a/drivers/gpu/drm/drm_ioctl.c
-+++ b/drivers/gpu/drm/drm_ioctl.c
-@@ -283,7 +283,7 @@ int drm_getstats(struct drm_device *dev, void *data,
- stats->data[i].value =
- (file_priv->master->lock.hw_lock ? file_priv->master->lock.hw_lock->lock : 0);
- else
-- stats->data[i].value = atomic_read(&dev->counts[i]);
-+ stats->data[i].value = atomic_read_unchecked(&dev->counts[i]);
- stats->data[i].type = dev->types[i];
- }
-
-diff --git a/drivers/gpu/drm/drm_lock.c b/drivers/gpu/drm/drm_lock.c
-index e2f70a5..c703e86 100644
---- a/drivers/gpu/drm/drm_lock.c
-+++ b/drivers/gpu/drm/drm_lock.c
-@@ -87,7 +87,7 @@ int drm_lock(struct drm_device *dev, void *data, struct drm_file *file_priv)
- if (drm_lock_take(&master->lock, lock->context)) {
- master->lock.file_priv = file_priv;
- master->lock.lock_time = jiffies;
-- atomic_inc(&dev->counts[_DRM_STAT_LOCKS]);
-+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_LOCKS]);
- break; /* Got lock */
- }
-
-@@ -165,7 +165,7 @@ int drm_unlock(struct drm_device *dev, void *data, struct drm_file *file_priv)
- return -EINVAL;
- }
-
-- atomic_inc(&dev->counts[_DRM_STAT_UNLOCKS]);
-+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_UNLOCKS]);
-
- /* kernel_context_switch isn't used by any of the x86 drm
- * modules but is required by the Sparc driver.
-diff --git a/drivers/gpu/drm/i810/i810_dma.c b/drivers/gpu/drm/i810/i810_dma.c
-index 7d1d88cd..b9131b2 100644
---- a/drivers/gpu/drm/i810/i810_dma.c
-+++ b/drivers/gpu/drm/i810/i810_dma.c
-@@ -952,8 +952,8 @@ static int i810_dma_vertex(struct drm_device *dev, void *data,
- dma->buflist[vertex->idx],
- vertex->discard, vertex->used);
-
-- atomic_add(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
-- atomic_inc(&dev->counts[_DRM_STAT_DMA]);
-+ atomic_add_unchecked(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
-+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
- sarea_priv->last_enqueue = dev_priv->counter - 1;
- sarea_priv->last_dispatch = (int)hw_status[5];
-
-@@ -1115,8 +1115,8 @@ static int i810_dma_mc(struct drm_device *dev, void *data,
- i810_dma_dispatch_mc(dev, dma->buflist[mc->idx], mc->used,
- mc->last_render);
-
-- atomic_add(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
-- atomic_inc(&dev->counts[_DRM_STAT_DMA]);
-+ atomic_add_unchecked(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
-+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
- sarea_priv->last_enqueue = dev_priv->counter - 1;
- sarea_priv->last_dispatch = (int)hw_status[5];
-
-diff --git a/drivers/gpu/drm/i810/i810_drv.h b/drivers/gpu/drm/i810/i810_drv.h
-index 21e2691..7321edd 100644
---- a/drivers/gpu/drm/i810/i810_drv.h
-+++ b/drivers/gpu/drm/i810/i810_drv.h
-@@ -108,8 +108,8 @@ typedef struct drm_i810_private {
- int page_flipping;
-
- wait_queue_head_t irq_queue;
-- atomic_t irq_received;
-- atomic_t irq_emitted;
-+ atomic_unchecked_t irq_received;
-+ atomic_unchecked_t irq_emitted;
-
- int front_offset;
- } drm_i810_private_t;
-diff --git a/drivers/gpu/drm/i830/i830_drv.h b/drivers/gpu/drm/i830/i830_drv.h
-index da82afe..48a45de 100644
---- a/drivers/gpu/drm/i830/i830_drv.h
-+++ b/drivers/gpu/drm/i830/i830_drv.h
-@@ -115,8 +115,8 @@ typedef struct drm_i830_private {
- int page_flipping;
-
- wait_queue_head_t irq_queue;
-- atomic_t irq_received;
-- atomic_t irq_emitted;
-+ atomic_unchecked_t irq_received;
-+ atomic_unchecked_t irq_emitted;
-
- int use_mi_batchbuffer_start;
-
-diff --git a/drivers/gpu/drm/i830/i830_irq.c b/drivers/gpu/drm/i830/i830_irq.c
-index 91ec2bb..6f21fab 100644
---- a/drivers/gpu/drm/i830/i830_irq.c
-+++ b/drivers/gpu/drm/i830/i830_irq.c
-@@ -47,7 +47,7 @@ irqreturn_t i830_driver_irq_handler(DRM_IRQ_ARGS)
-
- I830_WRITE16(I830REG_INT_IDENTITY_R, temp);
-
-- atomic_inc(&dev_priv->irq_received);
-+ atomic_inc_unchecked(&dev_priv->irq_received);
- wake_up_interruptible(&dev_priv->irq_queue);
-
- return IRQ_HANDLED;
-@@ -60,14 +60,14 @@ static int i830_emit_irq(struct drm_device * dev)
-
- DRM_DEBUG("%s\n", __func__);
-
-- atomic_inc(&dev_priv->irq_emitted);
-+ atomic_inc_unchecked(&dev_priv->irq_emitted);
-
- BEGIN_LP_RING(2);
- OUT_RING(0);
- OUT_RING(GFX_OP_USER_INTERRUPT);
- ADVANCE_LP_RING();
-
-- return atomic_read(&dev_priv->irq_emitted);
-+ return atomic_read_unchecked(&dev_priv->irq_emitted);
- }
-
- static int i830_wait_irq(struct drm_device * dev, int irq_nr)
-@@ -79,7 +79,7 @@ static int i830_wait_irq(struct drm_device * dev, int irq_nr)
-
- DRM_DEBUG("%s\n", __func__);
-
-- if (atomic_read(&dev_priv->irq_received) >= irq_nr)
-+ if (atomic_read_unchecked(&dev_priv->irq_received) >= irq_nr)
- return 0;
-
- dev_priv->sarea_priv->perf_boxes |= I830_BOX_WAIT;
-@@ -88,7 +88,7 @@ static int i830_wait_irq(struct drm_device * dev, int irq_nr)
-
- for (;;) {
- __set_current_state(TASK_INTERRUPTIBLE);
-- if (atomic_read(&dev_priv->irq_received) >= irq_nr)
-+ if (atomic_read_unchecked(&dev_priv->irq_received) >= irq_nr)
- break;
- if ((signed)(end - jiffies) <= 0) {
- DRM_ERROR("timeout iir %x imr %x ier %x hwstam %x\n",
-@@ -163,8 +163,8 @@ void i830_driver_irq_preinstall(struct drm_device * dev)
- I830_WRITE16(I830REG_HWSTAM, 0xffff);
- I830_WRITE16(I830REG_INT_MASK_R, 0x0);
- I830_WRITE16(I830REG_INT_ENABLE_R, 0x0);
-- atomic_set(&dev_priv->irq_received, 0);
-- atomic_set(&dev_priv->irq_emitted, 0);
-+ atomic_set_unchecked(&dev_priv->irq_received, 0);
-+ atomic_set_unchecked(&dev_priv->irq_emitted, 0);
- init_waitqueue_head(&dev_priv->irq_queue);
- }
-
-diff --git a/drivers/gpu/drm/i915/dvo.h b/drivers/gpu/drm/i915/dvo.h
-index 288fc50..c6092055 100644
---- a/drivers/gpu/drm/i915/dvo.h
-+++ b/drivers/gpu/drm/i915/dvo.h
-@@ -135,23 +135,23 @@ struct intel_dvo_dev_ops {
- *
- * \return singly-linked list of modes or NULL if no modes found.
- */
-- struct drm_display_mode *(*get_modes)(struct intel_dvo_device *dvo);
-+ struct drm_display_mode *(* const get_modes)(struct intel_dvo_device *dvo);
-
- /**
- * Clean up driver-specific bits of the output
- */
-- void (*destroy) (struct intel_dvo_device *dvo);
-+ void (* const destroy) (struct intel_dvo_device *dvo);
-
- /**
- * Debugging hook to dump device registers to log file
- */
-- void (*dump_regs)(struct intel_dvo_device *dvo);
-+ void (* const dump_regs)(struct intel_dvo_device *dvo);
- };
-
--extern struct intel_dvo_dev_ops sil164_ops;
--extern struct intel_dvo_dev_ops ch7xxx_ops;
--extern struct intel_dvo_dev_ops ivch_ops;
--extern struct intel_dvo_dev_ops tfp410_ops;
--extern struct intel_dvo_dev_ops ch7017_ops;
-+extern const struct intel_dvo_dev_ops sil164_ops;
-+extern const struct intel_dvo_dev_ops ch7xxx_ops;
-+extern const struct intel_dvo_dev_ops ivch_ops;
-+extern const struct intel_dvo_dev_ops tfp410_ops;
-+extern const struct intel_dvo_dev_ops ch7017_ops;
-
- #endif /* _INTEL_DVO_H */
-diff --git a/drivers/gpu/drm/i915/dvo_ch7017.c b/drivers/gpu/drm/i915/dvo_ch7017.c
-index 621815b..499d82e 100644
---- a/drivers/gpu/drm/i915/dvo_ch7017.c
-+++ b/drivers/gpu/drm/i915/dvo_ch7017.c
-@@ -443,7 +443,7 @@ static void ch7017_destroy(struct intel_dvo_device *dvo)
- }
- }
-
--struct intel_dvo_dev_ops ch7017_ops = {
-+const struct intel_dvo_dev_ops ch7017_ops = {
- .init = ch7017_init,
- .detect = ch7017_detect,
- .mode_valid = ch7017_mode_valid,
-diff --git a/drivers/gpu/drm/i915/dvo_ch7xxx.c b/drivers/gpu/drm/i915/dvo_ch7xxx.c
-index a9b8962..ac769ba 100644
---- a/drivers/gpu/drm/i915/dvo_ch7xxx.c
-+++ b/drivers/gpu/drm/i915/dvo_ch7xxx.c
-@@ -356,7 +356,7 @@ static void ch7xxx_destroy(struct intel_dvo_device *dvo)
- }
- }
-
--struct intel_dvo_dev_ops ch7xxx_ops = {
-+const struct intel_dvo_dev_ops ch7xxx_ops = {
- .init = ch7xxx_init,
- .detect = ch7xxx_detect,
- .mode_valid = ch7xxx_mode_valid,
-diff --git a/drivers/gpu/drm/i915/dvo_ivch.c b/drivers/gpu/drm/i915/dvo_ivch.c
-index aa176f9..ed2930c 100644
---- a/drivers/gpu/drm/i915/dvo_ivch.c
-+++ b/drivers/gpu/drm/i915/dvo_ivch.c
-@@ -430,7 +430,7 @@ static void ivch_destroy(struct intel_dvo_device *dvo)
- }
- }
-
--struct intel_dvo_dev_ops ivch_ops= {
-+const struct intel_dvo_dev_ops ivch_ops= {
- .init = ivch_init,
- .dpms = ivch_dpms,
- .save = ivch_save,
-diff --git a/drivers/gpu/drm/i915/dvo_sil164.c b/drivers/gpu/drm/i915/dvo_sil164.c
-index e1c1f73..7dbebcf 100644
---- a/drivers/gpu/drm/i915/dvo_sil164.c
-+++ b/drivers/gpu/drm/i915/dvo_sil164.c
-@@ -290,7 +290,7 @@ static void sil164_destroy(struct intel_dvo_device *dvo)
- }
- }
-
--struct intel_dvo_dev_ops sil164_ops = {
-+const struct intel_dvo_dev_ops sil164_ops = {
- .init = sil164_init,
- .detect = sil164_detect,
- .mode_valid = sil164_mode_valid,
-diff --git a/drivers/gpu/drm/i915/dvo_tfp410.c b/drivers/gpu/drm/i915/dvo_tfp410.c
-index 16dce84..7e1b6f8 100644
---- a/drivers/gpu/drm/i915/dvo_tfp410.c
-+++ b/drivers/gpu/drm/i915/dvo_tfp410.c
-@@ -323,7 +323,7 @@ static void tfp410_destroy(struct intel_dvo_device *dvo)
- }
- }
-
--struct intel_dvo_dev_ops tfp410_ops = {
-+const struct intel_dvo_dev_ops tfp410_ops = {
- .init = tfp410_init,
- .detect = tfp410_detect,
- .mode_valid = tfp410_mode_valid,
-diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
-index 7e859d6..7d1cf2b 100644
---- a/drivers/gpu/drm/i915/i915_debugfs.c
-+++ b/drivers/gpu/drm/i915/i915_debugfs.c
-@@ -192,7 +192,7 @@ static int i915_interrupt_info(struct seq_file *m, void *data)
- I915_READ(GTIMR));
- }
- seq_printf(m, "Interrupts received: %d\n",
-- atomic_read(&dev_priv->irq_received));
-+ atomic_read_unchecked(&dev_priv->irq_received));
- if (dev_priv->hw_status_page != NULL) {
- seq_printf(m, "Current sequence: %d\n",
- i915_get_gem_seqno(dev));
-diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
-index 5449239..7e4f68d 100644
---- a/drivers/gpu/drm/i915/i915_drv.c
-+++ b/drivers/gpu/drm/i915/i915_drv.c
-@@ -285,7 +285,7 @@ i915_pci_resume(struct pci_dev *pdev)
- return i915_resume(dev);
- }
-
--static struct vm_operations_struct i915_gem_vm_ops = {
-+static const struct vm_operations_struct i915_gem_vm_ops = {
- .fault = i915_gem_fault,
- .open = drm_gem_vm_open,
- .close = drm_gem_vm_close,
-diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
-index 97163f7..65574ff 100644
---- a/drivers/gpu/drm/i915/i915_drv.h
-+++ b/drivers/gpu/drm/i915/i915_drv.h
-@@ -197,7 +197,7 @@ typedef struct drm_i915_private {
- int page_flipping;
-
- wait_queue_head_t irq_queue;
-- atomic_t irq_received;
-+ atomic_unchecked_t irq_received;
- /** Protects user_irq_refcount and irq_mask_reg */
- spinlock_t user_irq_lock;
- /** Refcount for i915_user_irq_get() versus i915_user_irq_put(). */
-diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
-index 27a3074..eb3f959 100644
---- a/drivers/gpu/drm/i915/i915_gem.c
-+++ b/drivers/gpu/drm/i915/i915_gem.c
-@@ -102,7 +102,7 @@ i915_gem_get_aperture_ioctl(struct drm_device *dev, void *data,
-
- args->aper_size = dev->gtt_total;
- args->aper_available_size = (args->aper_size -
-- atomic_read(&dev->pin_memory));
-+ atomic_read_unchecked(&dev->pin_memory));
-
- return 0;
- }
-@@ -2058,7 +2058,7 @@ i915_gem_object_unbind(struct drm_gem_object *obj)
-
- if (obj_priv->gtt_space) {
- atomic_dec(&dev->gtt_count);
-- atomic_sub(obj->size, &dev->gtt_memory);
-+ atomic_sub_unchecked(obj->size, &dev->gtt_memory);
-
- drm_mm_put_block(obj_priv->gtt_space);
- obj_priv->gtt_space = NULL;
-@@ -2701,7 +2701,7 @@ i915_gem_object_bind_to_gtt(struct drm_gem_object *obj, unsigned alignment)
- goto search_free;
- }
- atomic_inc(&dev->gtt_count);
-- atomic_add(obj->size, &dev->gtt_memory);
-+ atomic_add_unchecked(obj->size, &dev->gtt_memory);
-
- /* Assert that the object is not currently in any GPU domain. As it
- * wasn't in the GTT, there shouldn't be any way it could have been in
-@@ -3755,9 +3755,9 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
- "%d/%d gtt bytes\n",
- atomic_read(&dev->object_count),
- atomic_read(&dev->pin_count),
-- atomic_read(&dev->object_memory),
-- atomic_read(&dev->pin_memory),
-- atomic_read(&dev->gtt_memory),
-+ atomic_read_unchecked(&dev->object_memory),
-+ atomic_read_unchecked(&dev->pin_memory),
-+ atomic_read_unchecked(&dev->gtt_memory),
- dev->gtt_total);
- }
- goto err;
-@@ -3989,7 +3989,7 @@ i915_gem_object_pin(struct drm_gem_object *obj, uint32_t alignment)
- */
- if (obj_priv->pin_count == 1) {
- atomic_inc(&dev->pin_count);
-- atomic_add(obj->size, &dev->pin_memory);
-+ atomic_add_unchecked(obj->size, &dev->pin_memory);
- if (!obj_priv->active &&
- (obj->write_domain & I915_GEM_GPU_DOMAINS) == 0 &&
- !list_empty(&obj_priv->list))
-@@ -4022,7 +4022,7 @@ i915_gem_object_unpin(struct drm_gem_object *obj)
- list_move_tail(&obj_priv->list,
- &dev_priv->mm.inactive_list);
- atomic_dec(&dev->pin_count);
-- atomic_sub(obj->size, &dev->pin_memory);
-+ atomic_sub_unchecked(obj->size, &dev->pin_memory);
- }
- i915_verify_inactive(dev, __FILE__, __LINE__);
- }
-diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
-index 63f28ad..f5469da 100644
---- a/drivers/gpu/drm/i915/i915_irq.c
-+++ b/drivers/gpu/drm/i915/i915_irq.c
-@@ -528,7 +528,7 @@ irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
- int irq_received;
- int ret = IRQ_NONE;
-
-- atomic_inc(&dev_priv->irq_received);
-+ atomic_inc_unchecked(&dev_priv->irq_received);
-
- if (IS_IGDNG(dev))
- return igdng_irq_handler(dev);
-@@ -1021,7 +1021,7 @@ void i915_driver_irq_preinstall(struct drm_device * dev)
- {
- drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
-
-- atomic_set(&dev_priv->irq_received, 0);
-+ atomic_set_unchecked(&dev_priv->irq_received, 0);
-
- INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
- INIT_WORK(&dev_priv->error_work, i915_error_work_func);
-diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
-index 5d9c6a7..d1b0e29 100644
---- a/drivers/gpu/drm/i915/intel_sdvo.c
-+++ b/drivers/gpu/drm/i915/intel_sdvo.c
-@@ -2795,7 +2795,9 @@ bool intel_sdvo_init(struct drm_device *dev, int output_device)
- sdvo_priv->slave_addr = intel_sdvo_get_slave_addr(dev, output_device);
-
- /* Save the bit-banging i2c functionality for use by the DDC wrapper */
-- intel_sdvo_i2c_bit_algo.functionality = intel_output->i2c_bus->algo->functionality;
-+ pax_open_kernel();
-+ *(void **)&intel_sdvo_i2c_bit_algo.functionality = intel_output->i2c_bus->algo->functionality;
-+ pax_close_kernel();
-
- /* Read the regs to test if we can talk to the device */
- for (i = 0; i < 0x40; i++) {
-diff --git a/drivers/gpu/drm/mga/mga_drv.h b/drivers/gpu/drm/mga/mga_drv.h
-index be6c6b9..8615d9c 100644
---- a/drivers/gpu/drm/mga/mga_drv.h
-+++ b/drivers/gpu/drm/mga/mga_drv.h
-@@ -120,9 +120,9 @@ typedef struct drm_mga_private {
- u32 clear_cmd;
- u32 maccess;
-
-- atomic_t vbl_received; /**< Number of vblanks received. */
-+ atomic_unchecked_t vbl_received; /**< Number of vblanks received. */
- wait_queue_head_t fence_queue;
-- atomic_t last_fence_retired;
-+ atomic_unchecked_t last_fence_retired;
- u32 next_fence_to_post;
-
- unsigned int fb_cpp;
-diff --git a/drivers/gpu/drm/mga/mga_irq.c b/drivers/gpu/drm/mga/mga_irq.c
-index daa6041..a28a5da 100644
---- a/drivers/gpu/drm/mga/mga_irq.c
-+++ b/drivers/gpu/drm/mga/mga_irq.c
-@@ -44,7 +44,7 @@ u32 mga_get_vblank_counter(struct drm_device *dev, int crtc)
- if (crtc != 0)
- return 0;
-
-- return atomic_read(&dev_priv->vbl_received);
-+ return atomic_read_unchecked(&dev_priv->vbl_received);
- }
-
-
-@@ -60,7 +60,7 @@ irqreturn_t mga_driver_irq_handler(DRM_IRQ_ARGS)
- /* VBLANK interrupt */
- if (status & MGA_VLINEPEN) {
- MGA_WRITE(MGA_ICLEAR, MGA_VLINEICLR);
-- atomic_inc(&dev_priv->vbl_received);
-+ atomic_inc_unchecked(&dev_priv->vbl_received);
- drm_handle_vblank(dev, 0);
- handled = 1;
- }
-@@ -80,7 +80,7 @@ irqreturn_t mga_driver_irq_handler(DRM_IRQ_ARGS)
- MGA_WRITE(MGA_PRIMEND, prim_end);
- }
-
-- atomic_inc(&dev_priv->last_fence_retired);
-+ atomic_inc_unchecked(&dev_priv->last_fence_retired);
- DRM_WAKEUP(&dev_priv->fence_queue);
- handled = 1;
- }
-@@ -131,7 +131,7 @@ int mga_driver_fence_wait(struct drm_device * dev, unsigned int *sequence)
- * using fences.
- */
- DRM_WAIT_ON(ret, dev_priv->fence_queue, 3 * DRM_HZ,
-- (((cur_fence = atomic_read(&dev_priv->last_fence_retired))
-+ (((cur_fence = atomic_read_unchecked(&dev_priv->last_fence_retired))
- - *sequence) <= (1 << 23)));
-
- *sequence = cur_fence;
-diff --git a/drivers/gpu/drm/r128/r128_cce.c b/drivers/gpu/drm/r128/r128_cce.c
-index 4c39a40..b22a9ea 100644
---- a/drivers/gpu/drm/r128/r128_cce.c
-+++ b/drivers/gpu/drm/r128/r128_cce.c
-@@ -377,7 +377,7 @@ static int r128_do_init_cce(struct drm_device * dev, drm_r128_init_t * init)
-
- /* GH: Simple idle check.
- */
-- atomic_set(&dev_priv->idle_count, 0);
-+ atomic_set_unchecked(&dev_priv->idle_count, 0);
-
- /* We don't support anything other than bus-mastering ring mode,
- * but the ring can be in either AGP or PCI space for the ring
-diff --git a/drivers/gpu/drm/r128/r128_drv.h b/drivers/gpu/drm/r128/r128_drv.h
-index 3c60829..4faf484 100644
---- a/drivers/gpu/drm/r128/r128_drv.h
-+++ b/drivers/gpu/drm/r128/r128_drv.h
-@@ -90,14 +90,14 @@ typedef struct drm_r128_private {
- int is_pci;
- unsigned long cce_buffers_offset;
-
-- atomic_t idle_count;
-+ atomic_unchecked_t idle_count;
-
- int page_flipping;
- int current_page;
- u32 crtc_offset;
- u32 crtc_offset_cntl;
-
-- atomic_t vbl_received;
-+ atomic_unchecked_t vbl_received;
-
- u32 color_fmt;
- unsigned int front_offset;
-diff --git a/drivers/gpu/drm/r128/r128_irq.c b/drivers/gpu/drm/r128/r128_irq.c
-index 69810fb..97bf17a 100644
---- a/drivers/gpu/drm/r128/r128_irq.c
-+++ b/drivers/gpu/drm/r128/r128_irq.c
-@@ -42,7 +42,7 @@ u32 r128_get_vblank_counter(struct drm_device *dev, int crtc)
- if (crtc != 0)
- return 0;
-
-- return atomic_read(&dev_priv->vbl_received);
-+ return atomic_read_unchecked(&dev_priv->vbl_received);
- }
-
- irqreturn_t r128_driver_irq_handler(DRM_IRQ_ARGS)
-@@ -56,7 +56,7 @@ irqreturn_t r128_driver_irq_handler(DRM_IRQ_ARGS)
- /* VBLANK interrupt */
- if (status & R128_CRTC_VBLANK_INT) {
- R128_WRITE(R128_GEN_INT_STATUS, R128_CRTC_VBLANK_INT_AK);
-- atomic_inc(&dev_priv->vbl_received);
-+ atomic_inc_unchecked(&dev_priv->vbl_received);
- drm_handle_vblank(dev, 0);
- return IRQ_HANDLED;
- }
-diff --git a/drivers/gpu/drm/r128/r128_state.c b/drivers/gpu/drm/r128/r128_state.c
-index af2665c..51922d2 100644
---- a/drivers/gpu/drm/r128/r128_state.c
-+++ b/drivers/gpu/drm/r128/r128_state.c
-@@ -323,10 +323,10 @@ static void r128_clear_box(drm_r128_private_t * dev_priv,
-
- static void r128_cce_performance_boxes(drm_r128_private_t * dev_priv)
- {
-- if (atomic_read(&dev_priv->idle_count) == 0) {
-+ if (atomic_read_unchecked(&dev_priv->idle_count) == 0) {
- r128_clear_box(dev_priv, 64, 4, 8, 8, 0, 255, 0);
- } else {
-- atomic_set(&dev_priv->idle_count, 0);
-+ atomic_set_unchecked(&dev_priv->idle_count, 0);
- }
- }
-
-diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
-index dd72b91..8644b3c 100644
---- a/drivers/gpu/drm/radeon/atom.c
-+++ b/drivers/gpu/drm/radeon/atom.c
-@@ -1115,6 +1115,8 @@ struct atom_context *atom_parse(struct card_info *card, void *bios)
- char name[512];
- int i;
-
-+ pax_track_stack();
-+
- ctx->card = card;
- ctx->bios = bios;
-
-diff --git a/drivers/gpu/drm/radeon/mkregtable.c b/drivers/gpu/drm/radeon/mkregtable.c
-index 0d79577..efaa7a5 100644
---- a/drivers/gpu/drm/radeon/mkregtable.c
-+++ b/drivers/gpu/drm/radeon/mkregtable.c
-@@ -637,14 +637,14 @@ static int parser_auth(struct table *t, const char *filename)
- regex_t mask_rex;
- regmatch_t match[4];
- char buf[1024];
-- size_t end;
-+ long end;
- int len;
- int done = 0;
- int r;
- unsigned o;
- struct offset *offset;
- char last_reg_s[10];
-- int last_reg;
-+ unsigned long last_reg;
-
- if (regcomp
- (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
-diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
-index a2ae151..0017d7b 100644
---- a/drivers/gpu/drm/radeon/r100.c
-+++ b/drivers/gpu/drm/radeon/r100.c
-@@ -89,8 +89,10 @@ int r100_pci_gart_init(struct radeon_device *rdev)
- if (r)
- return r;
- rdev->gart.table_size = rdev->gart.num_gpu_pages * 4;
-- rdev->asic->gart_tlb_flush = &r100_pci_gart_tlb_flush;
-- rdev->asic->gart_set_page = &r100_pci_gart_set_page;
-+ pax_open_kernel();
-+ *(void **)&rdev->asic->gart_tlb_flush = &r100_pci_gart_tlb_flush;
-+ *(void **)&rdev->asic->gart_set_page = &r100_pci_gart_set_page;
-+ pax_close_kernel();
- return radeon_gart_table_ram_alloc(rdev);
- }
-
-diff --git a/drivers/gpu/drm/radeon/r300.c b/drivers/gpu/drm/radeon/r300.c
-index d8c4f72..20936ed 100644
---- a/drivers/gpu/drm/radeon/r300.c
-+++ b/drivers/gpu/drm/radeon/r300.c
-@@ -91,8 +91,10 @@ int rv370_pcie_gart_init(struct radeon_device *rdev)
- if (r)
- DRM_ERROR("Failed to register debugfs file for PCIE gart !\n");
- rdev->gart.table_size = rdev->gart.num_gpu_pages * 4;
-- rdev->asic->gart_tlb_flush = &rv370_pcie_gart_tlb_flush;
-- rdev->asic->gart_set_page = &rv370_pcie_gart_set_page;
-+ pax_open_kernel();
-+ *(void **)&rdev->asic->gart_tlb_flush = &rv370_pcie_gart_tlb_flush;
-+ *(void **)&rdev->asic->gart_set_page = &rv370_pcie_gart_set_page;
-+ pax_close_kernel();
- return radeon_gart_table_vram_alloc(rdev);
- }
-
-diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
-index 6735213..c6ca8e6 100644
---- a/drivers/gpu/drm/radeon/radeon.h
-+++ b/drivers/gpu/drm/radeon/radeon.h
-@@ -149,7 +149,7 @@ int radeon_pm_init(struct radeon_device *rdev);
- */
- struct radeon_fence_driver {
- uint32_t scratch_reg;
-- atomic_t seq;
-+ atomic_unchecked_t seq;
- uint32_t last_seq;
- unsigned long count_timeout;
- wait_queue_head_t queue;
-diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
-index 4e928b9..d8b6008 100644
---- a/drivers/gpu/drm/radeon/radeon_atombios.c
-+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
-@@ -275,6 +275,8 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev)
- bool linkb;
- struct radeon_i2c_bus_rec ddc_bus;
-
-+ pax_track_stack();
-+
- atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset);
-
- if (data_offset == 0)
-@@ -520,13 +522,13 @@ static uint16_t atombios_get_connector_object_id(struct drm_device *dev,
- }
- }
-
--struct bios_connector {
-+static struct bios_connector {
- bool valid;
- uint16_t line_mux;
- uint16_t devices;
- int connector_type;
- struct radeon_i2c_bus_rec ddc_bus;
--};
-+} bios_connectors[ATOM_MAX_SUPPORTED_DEVICE];
-
- bool radeon_get_atom_connector_info_from_supported_devices_table(struct
- drm_device
-@@ -542,7 +544,6 @@ bool radeon_get_atom_connector_info_from_supported_devices_table(struct
- uint8_t dac;
- union atom_supported_devices *supported_devices;
- int i, j;
-- struct bios_connector bios_connectors[ATOM_MAX_SUPPORTED_DEVICE];
-
- atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset);
-
-diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
-index 3db54e9..ccfa400 100644
---- a/drivers/gpu/drm/radeon/radeon_device.c
-+++ b/drivers/gpu/drm/radeon/radeon_device.c
-@@ -322,8 +322,10 @@ int radeon_asic_init(struct radeon_device *rdev)
- case CHIP_RV380:
- rdev->asic = &r300_asic;
- if (rdev->flags & RADEON_IS_PCIE) {
-- rdev->asic->gart_tlb_flush = &rv370_pcie_gart_tlb_flush;
-- rdev->asic->gart_set_page = &rv370_pcie_gart_set_page;
-+ pax_open_kernel();
-+ *(void **)&rdev->asic->gart_tlb_flush = &rv370_pcie_gart_tlb_flush;
-+ *(void **)&rdev->asic->gart_set_page = &rv370_pcie_gart_set_page;
-+ pax_close_kernel();
- }
- break;
- case CHIP_R420:
-@@ -506,13 +508,17 @@ void radeon_agp_disable(struct radeon_device *rdev)
- rdev->family == CHIP_R423) {
- DRM_INFO("Forcing AGP to PCIE mode\n");
- rdev->flags |= RADEON_IS_PCIE;
-- rdev->asic->gart_tlb_flush = &rv370_pcie_gart_tlb_flush;
-- rdev->asic->gart_set_page = &rv370_pcie_gart_set_page;
-+ pax_open_kernel();
-+ *(void **)&rdev->asic->gart_tlb_flush = &rv370_pcie_gart_tlb_flush;
-+ *(void **)&rdev->asic->gart_set_page = &rv370_pcie_gart_set_page;
-+ pax_close_kernel();
- } else {
- DRM_INFO("Forcing AGP to PCI mode\n");
- rdev->flags |= RADEON_IS_PCI;
-- rdev->asic->gart_tlb_flush = &r100_pci_gart_tlb_flush;
-- rdev->asic->gart_set_page = &r100_pci_gart_set_page;
-+ pax_open_kernel();
-+ *(void **)&rdev->asic->gart_tlb_flush = &r100_pci_gart_tlb_flush;
-+ *(void **)&rdev->asic->gart_set_page = &r100_pci_gart_set_page;
-+ pax_close_kernel();
- }
- }
-
-diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
-index 083a181..ccccae0 100644
---- a/drivers/gpu/drm/radeon/radeon_display.c
-+++ b/drivers/gpu/drm/radeon/radeon_display.c
-@@ -482,7 +482,7 @@ void radeon_compute_pll(struct radeon_pll *pll,
-
- if (flags & RADEON_PLL_PREFER_CLOSEST_LOWER) {
- error = freq - current_freq;
-- error = error < 0 ? 0xffffffff : error;
-+ error = (int32_t)error < 0 ? 0xffffffff : error;
- } else
- error = abs(current_freq - freq);
- vco_diff = abs(vco - best_vco);
-diff --git a/drivers/gpu/drm/radeon/radeon_drv.h b/drivers/gpu/drm/radeon/radeon_drv.h
-index 76e4070..193fa7f 100644
---- a/drivers/gpu/drm/radeon/radeon_drv.h
-+++ b/drivers/gpu/drm/radeon/radeon_drv.h
-@@ -253,7 +253,7 @@ typedef struct drm_radeon_private {
-
- /* SW interrupt */
- wait_queue_head_t swi_queue;
-- atomic_t swi_emitted;
-+ atomic_unchecked_t swi_emitted;
- int vblank_crtc;
- uint32_t irq_enable_reg;
- uint32_t r500_disp_irq_reg;
-diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
-index 3beb26d..6ce9c4a 100644
---- a/drivers/gpu/drm/radeon/radeon_fence.c
-+++ b/drivers/gpu/drm/radeon/radeon_fence.c
-@@ -47,7 +47,7 @@ int radeon_fence_emit(struct radeon_device *rdev, struct radeon_fence *fence)
- write_unlock_irqrestore(&rdev->fence_drv.lock, irq_flags);
- return 0;
- }
-- fence->seq = atomic_add_return(1, &rdev->fence_drv.seq);
-+ fence->seq = atomic_add_return_unchecked(1, &rdev->fence_drv.seq);
- if (!rdev->cp.ready) {
- /* FIXME: cp is not running assume everythings is done right
- * away
-@@ -364,7 +364,7 @@ int radeon_fence_driver_init(struct radeon_device *rdev)
- return r;
- }
- WREG32(rdev->fence_drv.scratch_reg, 0);
-- atomic_set(&rdev->fence_drv.seq, 0);
-+ atomic_set_unchecked(&rdev->fence_drv.seq, 0);
- INIT_LIST_HEAD(&rdev->fence_drv.created);
- INIT_LIST_HEAD(&rdev->fence_drv.emited);
- INIT_LIST_HEAD(&rdev->fence_drv.signaled);
-diff --git a/drivers/gpu/drm/radeon/radeon_ioc32.c b/drivers/gpu/drm/radeon/radeon_ioc32.c
-index a1bf11d..4a123c0 100644
---- a/drivers/gpu/drm/radeon/radeon_ioc32.c
-+++ b/drivers/gpu/drm/radeon/radeon_ioc32.c
-@@ -368,7 +368,7 @@ static int compat_radeon_cp_setparam(struct file *file, unsigned int cmd,
- request = compat_alloc_user_space(sizeof(*request));
- if (!access_ok(VERIFY_WRITE, request, sizeof(*request))
- || __put_user(req32.param, &request->param)
-- || __put_user((void __user *)(unsigned long)req32.value,
-+ || __put_user((unsigned long)req32.value,
- &request->value))
- return -EFAULT;
-
-diff --git a/drivers/gpu/drm/radeon/radeon_irq.c b/drivers/gpu/drm/radeon/radeon_irq.c
-index b79ecc4..8dab92d 100644
---- a/drivers/gpu/drm/radeon/radeon_irq.c
-+++ b/drivers/gpu/drm/radeon/radeon_irq.c
-@@ -225,8 +225,8 @@ static int radeon_emit_irq(struct drm_device * dev)
- unsigned int ret;
- RING_LOCALS;
-
-- atomic_inc(&dev_priv->swi_emitted);
-- ret = atomic_read(&dev_priv->swi_emitted);
-+ atomic_inc_unchecked(&dev_priv->swi_emitted);
-+ ret = atomic_read_unchecked(&dev_priv->swi_emitted);
-
- BEGIN_RING(4);
- OUT_RING_REG(RADEON_LAST_SWI_REG, ret);
-@@ -352,7 +352,7 @@ int radeon_driver_irq_postinstall(struct drm_device *dev)
- drm_radeon_private_t *dev_priv =
- (drm_radeon_private_t *) dev->dev_private;
-
-- atomic_set(&dev_priv->swi_emitted, 0);
-+ atomic_set_unchecked(&dev_priv->swi_emitted, 0);
- DRM_INIT_WAITQUEUE(&dev_priv->swi_queue);
-
- dev->max_vblank_count = 0x001fffff;
-diff --git a/drivers/gpu/drm/radeon/radeon_state.c b/drivers/gpu/drm/radeon/radeon_state.c
-index 4747910..48ca4b3 100644
---- a/drivers/gpu/drm/radeon/radeon_state.c
-+++ b/drivers/gpu/drm/radeon/radeon_state.c
-@@ -3021,7 +3021,7 @@ static int radeon_cp_getparam(struct drm_device *dev, void *data, struct drm_fil
- {
- drm_radeon_private_t *dev_priv = dev->dev_private;
- drm_radeon_getparam_t *param = data;
-- int value;
-+ int value = 0;
-
- DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
-
-diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
-index 1381e06..0e53b17 100644
---- a/drivers/gpu/drm/radeon/radeon_ttm.c
-+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
-@@ -535,27 +535,10 @@ void radeon_ttm_fini(struct radeon_device *rdev)
- DRM_INFO("radeon: ttm finalized\n");
- }
-
--static struct vm_operations_struct radeon_ttm_vm_ops;
--static const struct vm_operations_struct *ttm_vm_ops = NULL;
--
--static int radeon_ttm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
--{
-- struct ttm_buffer_object *bo;
-- int r;
--
-- bo = (struct ttm_buffer_object *)vma->vm_private_data;
-- if (bo == NULL) {
-- return VM_FAULT_NOPAGE;
-- }
-- r = ttm_vm_ops->fault(vma, vmf);
-- return r;
--}
--
- int radeon_mmap(struct file *filp, struct vm_area_struct *vma)
- {
- struct drm_file *file_priv;
- struct radeon_device *rdev;
-- int r;
-
- if (unlikely(vma->vm_pgoff < DRM_FILE_PAGE_OFFSET)) {
- return drm_mmap(filp, vma);
-@@ -563,20 +546,9 @@ int radeon_mmap(struct file *filp, struct vm_area_struct *vma)
-
- file_priv = (struct drm_file *)filp->private_data;
- rdev = file_priv->minor->dev->dev_private;
-- if (rdev == NULL) {
-+ if (!rdev)
- return -EINVAL;
-- }
-- r = ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
-- if (unlikely(r != 0)) {
-- return r;
-- }
-- if (unlikely(ttm_vm_ops == NULL)) {
-- ttm_vm_ops = vma->vm_ops;
-- radeon_ttm_vm_ops = *ttm_vm_ops;
-- radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
-- }
-- vma->vm_ops = &radeon_ttm_vm_ops;
-- return 0;
-+ return ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
- }
-
-
-diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
-index b12ff76..0bd0c6e 100644
---- a/drivers/gpu/drm/radeon/rs690.c
-+++ b/drivers/gpu/drm/radeon/rs690.c
-@@ -302,9 +302,11 @@ void rs690_crtc_bandwidth_compute(struct radeon_device *rdev,
- if (rdev->pm.max_bandwidth.full > rdev->pm.sideport_bandwidth.full &&
- rdev->pm.sideport_bandwidth.full)
- rdev->pm.max_bandwidth = rdev->pm.sideport_bandwidth;
-- read_delay_latency.full = rfixed_const(370 * 800 * 1000);
-+ read_delay_latency.full = rfixed_const(800 * 1000);
- read_delay_latency.full = rfixed_div(read_delay_latency,
- rdev->pm.igp_sideport_mclk);
-+ a.full = rfixed_const(370);
-+ read_delay_latency.full = rfixed_mul(read_delay_latency, a);
- } else {
- if (rdev->pm.max_bandwidth.full > rdev->pm.k8_bandwidth.full &&
- rdev->pm.k8_bandwidth.full)
-diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
-index 0ed436e..e6e7ce3 100644
---- a/drivers/gpu/drm/ttm/ttm_bo.c
-+++ b/drivers/gpu/drm/ttm/ttm_bo.c
-@@ -67,7 +67,7 @@ static struct attribute *ttm_bo_global_attrs[] = {
- NULL
- };
-
--static struct sysfs_ops ttm_bo_global_ops = {
-+static const struct sysfs_ops ttm_bo_global_ops = {
- .show = &ttm_bo_global_show
- };
-
-diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
-index 1c040d0..f9e4af8 100644
---- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
-+++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
-@@ -73,7 +73,7 @@ static int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
- {
- struct ttm_buffer_object *bo = (struct ttm_buffer_object *)
- vma->vm_private_data;
-- struct ttm_bo_device *bdev = bo->bdev;
-+ struct ttm_bo_device *bdev;
- unsigned long bus_base;
- unsigned long bus_offset;
- unsigned long bus_size;
-@@ -88,6 +88,10 @@ static int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
- unsigned long address = (unsigned long)vmf->virtual_address;
- int retval = VM_FAULT_NOPAGE;
-
-+ if (!bo)
-+ return VM_FAULT_NOPAGE;
-+ bdev = bo->bdev;
-+
- /*
- * Work around locking order reversal in fault / nopfn
- * between mmap_sem and bo_reserve: Perform a trylock operation
-diff --git a/drivers/gpu/drm/ttm/ttm_global.c b/drivers/gpu/drm/ttm/ttm_global.c
-index b170071..28ae90e 100644
---- a/drivers/gpu/drm/ttm/ttm_global.c
-+++ b/drivers/gpu/drm/ttm/ttm_global.c
-@@ -36,7 +36,7 @@
- struct ttm_global_item {
- struct mutex mutex;
- void *object;
-- int refcount;
-+ atomic_t refcount;
- };
-
- static struct ttm_global_item glob[TTM_GLOBAL_NUM];
-@@ -49,7 +49,7 @@ void ttm_global_init(void)
- struct ttm_global_item *item = &glob[i];
- mutex_init(&item->mutex);
- item->object = NULL;
-- item->refcount = 0;
-+ atomic_set(&item->refcount, 0);
- }
- }
-
-@@ -59,7 +59,7 @@ void ttm_global_release(void)
- for (i = 0; i < TTM_GLOBAL_NUM; ++i) {
- struct ttm_global_item *item = &glob[i];
- BUG_ON(item->object != NULL);
-- BUG_ON(item->refcount != 0);
-+ BUG_ON(atomic_read(&item->refcount) != 0);
- }
- }
-
-@@ -70,7 +70,7 @@ int ttm_global_item_ref(struct ttm_global_reference *ref)
- void *object;
-
- mutex_lock(&item->mutex);
-- if (item->refcount == 0) {
-+ if (atomic_read(&item->refcount) == 0) {
- item->object = kzalloc(ref->size, GFP_KERNEL);
- if (unlikely(item->object == NULL)) {
- ret = -ENOMEM;
-@@ -83,7 +83,7 @@ int ttm_global_item_ref(struct ttm_global_reference *ref)
- goto out_err;
-
- }
-- ++item->refcount;
-+ atomic_inc(&item->refcount);
- ref->object = item->object;
- object = item->object;
- mutex_unlock(&item->mutex);
-@@ -100,9 +100,9 @@ void ttm_global_item_unref(struct ttm_global_reference *ref)
- struct ttm_global_item *item = &glob[ref->global_type];
-
- mutex_lock(&item->mutex);
-- BUG_ON(item->refcount == 0);
-+ BUG_ON(atomic_read(&item->refcount) == 0);
- BUG_ON(ref->object != item->object);
-- if (--item->refcount == 0) {
-+ if (atomic_dec_and_test(&item->refcount)) {
- ref->release(ref);
- item->object = NULL;
- }
-diff --git a/drivers/gpu/drm/ttm/ttm_memory.c b/drivers/gpu/drm/ttm/ttm_memory.c
-index 072c281..d8ef483 100644
---- a/drivers/gpu/drm/ttm/ttm_memory.c
-+++ b/drivers/gpu/drm/ttm/ttm_memory.c
-@@ -152,7 +152,7 @@ static struct attribute *ttm_mem_zone_attrs[] = {
- NULL
- };
-
--static struct sysfs_ops ttm_mem_zone_ops = {
-+static const struct sysfs_ops ttm_mem_zone_ops = {
- .show = &ttm_mem_zone_show,
- .store = &ttm_mem_zone_store
- };
-diff --git a/drivers/gpu/drm/via/via_drv.h b/drivers/gpu/drm/via/via_drv.h
-index cafcb84..b8e66cc 100644
---- a/drivers/gpu/drm/via/via_drv.h
-+++ b/drivers/gpu/drm/via/via_drv.h
-@@ -51,7 +51,7 @@ typedef struct drm_via_ring_buffer {
- typedef uint32_t maskarray_t[5];
-
- typedef struct drm_via_irq {
-- atomic_t irq_received;
-+ atomic_unchecked_t irq_received;
- uint32_t pending_mask;
- uint32_t enable_mask;
- wait_queue_head_t irq_queue;
-@@ -75,7 +75,7 @@ typedef struct drm_via_private {
- struct timeval last_vblank;
- int last_vblank_valid;
- unsigned usec_per_vblank;
-- atomic_t vbl_received;
-+ atomic_unchecked_t vbl_received;
- drm_via_state_t hc_state;
- char pci_buf[VIA_PCI_BUF_SIZE];
- const uint32_t *fire_offsets[VIA_FIRE_BUF_SIZE];
-diff --git a/drivers/gpu/drm/via/via_irq.c b/drivers/gpu/drm/via/via_irq.c
-index 5935b88..127a8a6 100644
---- a/drivers/gpu/drm/via/via_irq.c
-+++ b/drivers/gpu/drm/via/via_irq.c
-@@ -102,7 +102,7 @@ u32 via_get_vblank_counter(struct drm_device *dev, int crtc)
- if (crtc != 0)
- return 0;
-
-- return atomic_read(&dev_priv->vbl_received);
-+ return atomic_read_unchecked(&dev_priv->vbl_received);
- }
-
- irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
-@@ -117,8 +117,8 @@ irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
-
- status = VIA_READ(VIA_REG_INTERRUPT);
- if (status & VIA_IRQ_VBLANK_PENDING) {
-- atomic_inc(&dev_priv->vbl_received);
-- if (!(atomic_read(&dev_priv->vbl_received) & 0x0F)) {
-+ atomic_inc_unchecked(&dev_priv->vbl_received);
-+ if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0x0F)) {
- do_gettimeofday(&cur_vblank);
- if (dev_priv->last_vblank_valid) {
- dev_priv->usec_per_vblank =
-@@ -128,7 +128,7 @@ irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
- dev_priv->last_vblank = cur_vblank;
- dev_priv->last_vblank_valid = 1;
- }
-- if (!(atomic_read(&dev_priv->vbl_received) & 0xFF)) {
-+ if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0xFF)) {
- DRM_DEBUG("US per vblank is: %u\n",
- dev_priv->usec_per_vblank);
- }
-@@ -138,7 +138,7 @@ irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
-
- for (i = 0; i < dev_priv->num_irqs; ++i) {
- if (status & cur_irq->pending_mask) {
-- atomic_inc(&cur_irq->irq_received);
-+ atomic_inc_unchecked(&cur_irq->irq_received);
- DRM_WAKEUP(&cur_irq->irq_queue);
- handled = 1;
- if (dev_priv->irq_map[drm_via_irq_dma0_td] == i) {
-@@ -244,11 +244,11 @@ via_driver_irq_wait(struct drm_device * dev, unsigned int irq, int force_sequenc
- DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
- ((VIA_READ(masks[irq][2]) & masks[irq][3]) ==
- masks[irq][4]));
-- cur_irq_sequence = atomic_read(&cur_irq->irq_received);
-+ cur_irq_sequence = atomic_read_unchecked(&cur_irq->irq_received);
- } else {
- DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
- (((cur_irq_sequence =
-- atomic_read(&cur_irq->irq_received)) -
-+ atomic_read_unchecked(&cur_irq->irq_received)) -
- *sequence) <= (1 << 23)));
- }
- *sequence = cur_irq_sequence;
-@@ -286,7 +286,7 @@ void via_driver_irq_preinstall(struct drm_device * dev)
- }
-
- for (i = 0; i < dev_priv->num_irqs; ++i) {
-- atomic_set(&cur_irq->irq_received, 0);
-+ atomic_set_unchecked(&cur_irq->irq_received, 0);
- cur_irq->enable_mask = dev_priv->irq_masks[i][0];
- cur_irq->pending_mask = dev_priv->irq_masks[i][1];
- DRM_INIT_WAITQUEUE(&cur_irq->irq_queue);
-@@ -368,7 +368,7 @@ int via_wait_irq(struct drm_device *dev, void *data, struct drm_file *file_priv)
- switch (irqwait->request.type & ~VIA_IRQ_FLAGS_MASK) {
- case VIA_IRQ_RELATIVE:
- irqwait->request.sequence +=
-- atomic_read(&cur_irq->irq_received);
-+ atomic_read_unchecked(&cur_irq->irq_received);
- irqwait->request.type &= ~_DRM_VBLANK_RELATIVE;
- case VIA_IRQ_ABSOLUTE:
- break;
-diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c
-index aa8688d..6a0140c 100644
---- a/drivers/gpu/vga/vgaarb.c
-+++ b/drivers/gpu/vga/vgaarb.c
-@@ -894,14 +894,20 @@ static ssize_t vga_arb_write(struct file *file, const char __user * buf,
- uc = &priv->cards[i];
- }
-
-- if (!uc)
-- return -EINVAL;
-+ if (!uc) {
-+ ret_val = -EINVAL;
-+ goto done;
-+ }
-
-- if (io_state & VGA_RSRC_LEGACY_IO && uc->io_cnt == 0)
-- return -EINVAL;
-+ if (io_state & VGA_RSRC_LEGACY_IO && uc->io_cnt == 0) {
-+ ret_val = -EINVAL;
-+ goto done;
-+ }
-
-- if (io_state & VGA_RSRC_LEGACY_MEM && uc->mem_cnt == 0)
-- return -EINVAL;
-+ if (io_state & VGA_RSRC_LEGACY_MEM && uc->mem_cnt == 0) {
-+ ret_val = -EINVAL;
-+ goto done;
-+ }
-
- vga_put(pdev, io_state);
-
-diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
-index 11f8069..4783396 100644
---- a/drivers/hid/hid-core.c
-+++ b/drivers/hid/hid-core.c
-@@ -1752,7 +1752,7 @@ static bool hid_ignore(struct hid_device *hdev)
-
- int hid_add_device(struct hid_device *hdev)
- {
-- static atomic_t id = ATOMIC_INIT(0);
-+ static atomic_unchecked_t id = ATOMIC_INIT(0);
- int ret;
-
- if (WARN_ON(hdev->status & HID_STAT_ADDED))
-@@ -1766,7 +1766,7 @@ int hid_add_device(struct hid_device *hdev)
- /* XXX hack, any other cleaner solution after the driver core
- * is converted to allow more than 20 bytes as the device name? */
- dev_set_name(&hdev->dev, "%04X:%04X:%04X.%04X", hdev->bus,
-- hdev->vendor, hdev->product, atomic_inc_return(&id));
-+ hdev->vendor, hdev->product, atomic_inc_return_unchecked(&id));
-
- ret = device_add(&hdev->dev);
- if (!ret)
-diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
-index 8b6ee24..70f657d 100644
---- a/drivers/hid/usbhid/hiddev.c
-+++ b/drivers/hid/usbhid/hiddev.c
-@@ -617,7 +617,7 @@ static long hiddev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
- return put_user(HID_VERSION, (int __user *)arg);
-
- case HIDIOCAPPLICATION:
-- if (arg < 0 || arg >= hid->maxapplication)
-+ if (arg >= hid->maxapplication)
- return -EINVAL;
-
- for (i = 0; i < hid->maxcollection; i++)
-diff --git a/drivers/hwmon/lis3lv02d.c b/drivers/hwmon/lis3lv02d.c
-index 5d5ed69..f40533e 100644
---- a/drivers/hwmon/lis3lv02d.c
-+++ b/drivers/hwmon/lis3lv02d.c
-@@ -146,7 +146,7 @@ static irqreturn_t lis302dl_interrupt(int irq, void *dummy)
- * the lid is closed. This leads to interrupts as soon as a little move
- * is done.
- */
-- atomic_inc(&lis3_dev.count);
-+ atomic_inc_unchecked(&lis3_dev.count);
-
- wake_up_interruptible(&lis3_dev.misc_wait);
- kill_fasync(&lis3_dev.async_queue, SIGIO, POLL_IN);
-@@ -160,7 +160,7 @@ static int lis3lv02d_misc_open(struct inode *inode, struct file *file)
- if (test_and_set_bit(0, &lis3_dev.misc_opened))
- return -EBUSY; /* already open */
-
-- atomic_set(&lis3_dev.count, 0);
-+ atomic_set_unchecked(&lis3_dev.count, 0);
-
- /*
- * The sensor can generate interrupts for free-fall and direction
-@@ -206,7 +206,7 @@ static ssize_t lis3lv02d_misc_read(struct file *file, char __user *buf,
- add_wait_queue(&lis3_dev.misc_wait, &wait);
- while (true) {
- set_current_state(TASK_INTERRUPTIBLE);
-- data = atomic_xchg(&lis3_dev.count, 0);
-+ data = atomic_xchg_unchecked(&lis3_dev.count, 0);
- if (data)
- break;
-
-@@ -244,7 +244,7 @@ out:
- static unsigned int lis3lv02d_misc_poll(struct file *file, poll_table *wait)
- {
- poll_wait(file, &lis3_dev.misc_wait, wait);
-- if (atomic_read(&lis3_dev.count))
-+ if (atomic_read_unchecked(&lis3_dev.count))
- return POLLIN | POLLRDNORM;
- return 0;
- }
-diff --git a/drivers/hwmon/lis3lv02d.h b/drivers/hwmon/lis3lv02d.h
-index 7cdd76f..fe0efdf 100644
---- a/drivers/hwmon/lis3lv02d.h
-+++ b/drivers/hwmon/lis3lv02d.h
-@@ -201,7 +201,7 @@ struct lis3lv02d {
-
- struct input_polled_dev *idev; /* input device */
- struct platform_device *pdev; /* platform device */
-- atomic_t count; /* interrupt count after last read */
-+ atomic_unchecked_t count; /* interrupt count after last read */
- int xcalib; /* calibrated null value for x */
- int ycalib; /* calibrated null value for y */
- int zcalib; /* calibrated null value for z */
-diff --git a/drivers/hwmon/sht15.c b/drivers/hwmon/sht15.c
-index 740785e..5a5c6c6 100644
---- a/drivers/hwmon/sht15.c
-+++ b/drivers/hwmon/sht15.c
-@@ -112,7 +112,7 @@ struct sht15_data {
- int supply_uV;
- int supply_uV_valid;
- struct work_struct update_supply_work;
-- atomic_t interrupt_handled;
-+ atomic_unchecked_t interrupt_handled;
- };
-
- /**
-@@ -245,13 +245,13 @@ static inline int sht15_update_single_val(struct sht15_data *data,
- return ret;
-
- gpio_direction_input(data->pdata->gpio_data);
-- atomic_set(&data->interrupt_handled, 0);
-+ atomic_set_unchecked(&data->interrupt_handled, 0);
-
- enable_irq(gpio_to_irq(data->pdata->gpio_data));
- if (gpio_get_value(data->pdata->gpio_data) == 0) {
- disable_irq_nosync(gpio_to_irq(data->pdata->gpio_data));
- /* Only relevant if the interrupt hasn't occured. */
-- if (!atomic_read(&data->interrupt_handled))
-+ if (!atomic_read_unchecked(&data->interrupt_handled))
- schedule_work(&data->read_work);
- }
- ret = wait_event_timeout(data->wait_queue,
-@@ -398,7 +398,7 @@ static irqreturn_t sht15_interrupt_fired(int irq, void *d)
- struct sht15_data *data = d;
- /* First disable the interrupt */
- disable_irq_nosync(irq);
-- atomic_inc(&data->interrupt_handled);
-+ atomic_inc_unchecked(&data->interrupt_handled);
- /* Then schedule a reading work struct */
- if (data->flag != SHT15_READING_NOTHING)
- schedule_work(&data->read_work);
-@@ -449,11 +449,11 @@ static void sht15_bh_read_data(struct work_struct *work_s)
- here as could have gone low in meantime so verify
- it hasn't!
- */
-- atomic_set(&data->interrupt_handled, 0);
-+ atomic_set_unchecked(&data->interrupt_handled, 0);
- enable_irq(gpio_to_irq(data->pdata->gpio_data));
- /* If still not occured or another handler has been scheduled */
- if (gpio_get_value(data->pdata->gpio_data)
-- || atomic_read(&data->interrupt_handled))
-+ || atomic_read_unchecked(&data->interrupt_handled))
- return;
- }
- /* Read the data back from the device */
-diff --git a/drivers/hwmon/w83791d.c b/drivers/hwmon/w83791d.c
-index 97851c5..cb40626 100644
---- a/drivers/hwmon/w83791d.c
-+++ b/drivers/hwmon/w83791d.c
-@@ -330,8 +330,8 @@ static int w83791d_detect(struct i2c_client *client, int kind,
- struct i2c_board_info *info);
- static int w83791d_remove(struct i2c_client *client);
-
--static int w83791d_read(struct i2c_client *client, u8 register);
--static int w83791d_write(struct i2c_client *client, u8 register, u8 value);
-+static int w83791d_read(struct i2c_client *client, u8 reg);
-+static int w83791d_write(struct i2c_client *client, u8 reg, u8 value);
- static struct w83791d_data *w83791d_update_device(struct device *dev);
-
- #ifdef DEBUG
-diff --git a/drivers/i2c/busses/i2c-amd756-s4882.c b/drivers/i2c/busses/i2c-amd756-s4882.c
-index 378fcb5..5e91fa8 100644
---- a/drivers/i2c/busses/i2c-amd756-s4882.c
-+++ b/drivers/i2c/busses/i2c-amd756-s4882.c
-@@ -43,7 +43,7 @@
- extern struct i2c_adapter amd756_smbus;
-
- static struct i2c_adapter *s4882_adapter;
--static struct i2c_algorithm *s4882_algo;
-+static i2c_algorithm_no_const *s4882_algo;
-
- /* Wrapper access functions for multiplexed SMBus */
- static DEFINE_MUTEX(amd756_lock);
-diff --git a/drivers/i2c/busses/i2c-nforce2-s4985.c b/drivers/i2c/busses/i2c-nforce2-s4985.c
-index 29015eb..af2d8e9 100644
---- a/drivers/i2c/busses/i2c-nforce2-s4985.c
-+++ b/drivers/i2c/busses/i2c-nforce2-s4985.c
-@@ -41,7 +41,7 @@
- extern struct i2c_adapter *nforce2_smbus;
-
- static struct i2c_adapter *s4985_adapter;
--static struct i2c_algorithm *s4985_algo;
-+static i2c_algorithm_no_const *s4985_algo;
-
- /* Wrapper access functions for multiplexed SMBus */
- static DEFINE_MUTEX(nforce2_lock);
-diff --git a/drivers/ide/aec62xx.c b/drivers/ide/aec62xx.c
-index 878f8ec..12376fc 100644
---- a/drivers/ide/aec62xx.c
-+++ b/drivers/ide/aec62xx.c
-@@ -180,7 +180,7 @@ static const struct ide_port_ops atp86x_port_ops = {
- .cable_detect = atp86x_cable_detect,
- };
-
--static const struct ide_port_info aec62xx_chipsets[] __devinitdata = {
-+static const struct ide_port_info aec62xx_chipsets[] __devinitconst = {
- { /* 0: AEC6210 */
- .name = DRV_NAME,
- .init_chipset = init_chipset_aec62xx,
-diff --git a/drivers/ide/alim15x3.c b/drivers/ide/alim15x3.c
-index e59b6de..4b4fc65 100644
---- a/drivers/ide/alim15x3.c
-+++ b/drivers/ide/alim15x3.c
-@@ -509,7 +509,7 @@ static const struct ide_dma_ops ali_dma_ops = {
- .dma_sff_read_status = ide_dma_sff_read_status,
- };
-
--static const struct ide_port_info ali15x3_chipset __devinitdata = {
-+static const struct ide_port_info ali15x3_chipset __devinitconst = {
- .name = DRV_NAME,
- .init_chipset = init_chipset_ali15x3,
- .init_hwif = init_hwif_ali15x3,
-diff --git a/drivers/ide/amd74xx.c b/drivers/ide/amd74xx.c
-index 628cd2e..087a414 100644
---- a/drivers/ide/amd74xx.c
-+++ b/drivers/ide/amd74xx.c
-@@ -221,7 +221,7 @@ static const struct ide_port_ops amd_port_ops = {
- .udma_mask = udma, \
- }
-
--static const struct ide_port_info amd74xx_chipsets[] __devinitdata = {
-+static const struct ide_port_info amd74xx_chipsets[] __devinitconst = {
- /* 0: AMD7401 */ DECLARE_AMD_DEV(0x00, ATA_UDMA2),
- /* 1: AMD7409 */ DECLARE_AMD_DEV(ATA_SWDMA2, ATA_UDMA4),
- /* 2: AMD7411/7441 */ DECLARE_AMD_DEV(ATA_SWDMA2, ATA_UDMA5),
-diff --git a/drivers/ide/atiixp.c b/drivers/ide/atiixp.c
-index 837322b..837fd71 100644
---- a/drivers/ide/atiixp.c
-+++ b/drivers/ide/atiixp.c
-@@ -137,7 +137,7 @@ static const struct ide_port_ops atiixp_port_ops = {
- .cable_detect = atiixp_cable_detect,
- };
-
--static const struct ide_port_info atiixp_pci_info[] __devinitdata = {
-+static const struct ide_port_info atiixp_pci_info[] __devinitconst = {
- { /* 0: IXP200/300/400/700 */
- .name = DRV_NAME,
- .enablebits = {{0x48,0x01,0x00}, {0x48,0x08,0x00}},
-diff --git a/drivers/ide/cmd64x.c b/drivers/ide/cmd64x.c
-index ca0c46f..d55318a 100644
---- a/drivers/ide/cmd64x.c
-+++ b/drivers/ide/cmd64x.c
-@@ -372,7 +372,7 @@ static const struct ide_dma_ops cmd646_rev1_dma_ops = {
- .dma_sff_read_status = ide_dma_sff_read_status,
- };
-
--static const struct ide_port_info cmd64x_chipsets[] __devinitdata = {
-+static const struct ide_port_info cmd64x_chipsets[] __devinitconst = {
- { /* 0: CMD643 */
- .name = DRV_NAME,
- .init_chipset = init_chipset_cmd64x,
-diff --git a/drivers/ide/cs5520.c b/drivers/ide/cs5520.c
-index 09f98ed..cebc5bc 100644
---- a/drivers/ide/cs5520.c
-+++ b/drivers/ide/cs5520.c
-@@ -93,7 +93,7 @@ static const struct ide_port_ops cs5520_port_ops = {
- .set_dma_mode = cs5520_set_dma_mode,
- };
-
--static const struct ide_port_info cyrix_chipset __devinitdata = {
-+static const struct ide_port_info cyrix_chipset __devinitconst = {
- .name = DRV_NAME,
- .enablebits = { { 0x60, 0x01, 0x01 }, { 0x60, 0x02, 0x02 } },
- .port_ops = &cs5520_port_ops,
-diff --git a/drivers/ide/cs5530.c b/drivers/ide/cs5530.c
-index 40bf05e..7d58ca0 100644
---- a/drivers/ide/cs5530.c
-+++ b/drivers/ide/cs5530.c
-@@ -244,7 +244,7 @@ static const struct ide_port_ops cs5530_port_ops = {
- .udma_filter = cs5530_udma_filter,
- };
-
--static const struct ide_port_info cs5530_chipset __devinitdata = {
-+static const struct ide_port_info cs5530_chipset __devinitconst = {
- .name = DRV_NAME,
- .init_chipset = init_chipset_cs5530,
- .init_hwif = init_hwif_cs5530,
-diff --git a/drivers/ide/cs5535.c b/drivers/ide/cs5535.c
-index 983d957..53e6172 100644
---- a/drivers/ide/cs5535.c
-+++ b/drivers/ide/cs5535.c
-@@ -170,7 +170,7 @@ static const struct ide_port_ops cs5535_port_ops = {
- .cable_detect = cs5535_cable_detect,
- };
-
--static const struct ide_port_info cs5535_chipset __devinitdata = {
-+static const struct ide_port_info cs5535_chipset __devinitconst = {
- .name = DRV_NAME,
- .port_ops = &cs5535_port_ops,
- .host_flags = IDE_HFLAG_SINGLE | IDE_HFLAG_POST_SET_MODE,
-diff --git a/drivers/ide/cy82c693.c b/drivers/ide/cy82c693.c
-index 74fc540..8e933d8 100644
---- a/drivers/ide/cy82c693.c
-+++ b/drivers/ide/cy82c693.c
-@@ -288,7 +288,7 @@ static const struct ide_port_ops cy82c693_port_ops = {
- .set_dma_mode = cy82c693_set_dma_mode,
- };
-
--static const struct ide_port_info cy82c693_chipset __devinitdata = {
-+static const struct ide_port_info cy82c693_chipset __devinitconst = {
- .name = DRV_NAME,
- .init_iops = init_iops_cy82c693,
- .port_ops = &cy82c693_port_ops,
-diff --git a/drivers/ide/hpt366.c b/drivers/ide/hpt366.c
-index 7ce68ef..e78197d 100644
---- a/drivers/ide/hpt366.c
-+++ b/drivers/ide/hpt366.c
-@@ -507,7 +507,7 @@ static struct hpt_timings hpt37x_timings = {
- }
- };
-
--static const struct hpt_info hpt36x __devinitdata = {
-+static const struct hpt_info hpt36x __devinitconst = {
- .chip_name = "HPT36x",
- .chip_type = HPT36x,
- .udma_mask = HPT366_ALLOW_ATA66_3 ? (HPT366_ALLOW_ATA66_4 ? ATA_UDMA4 : ATA_UDMA3) : ATA_UDMA2,
-@@ -515,7 +515,7 @@ static const struct hpt_info hpt36x __devinitdata = {
- .timings = &hpt36x_timings
- };
-
--static const struct hpt_info hpt370 __devinitdata = {
-+static const struct hpt_info hpt370 __devinitconst = {
- .chip_name = "HPT370",
- .chip_type = HPT370,
- .udma_mask = HPT370_ALLOW_ATA100_5 ? ATA_UDMA5 : ATA_UDMA4,
-@@ -523,7 +523,7 @@ static const struct hpt_info hpt370 __devinitdata = {
- .timings = &hpt37x_timings
- };
-
--static const struct hpt_info hpt370a __devinitdata = {
-+static const struct hpt_info hpt370a __devinitconst = {
- .chip_name = "HPT370A",
- .chip_type = HPT370A,
- .udma_mask = HPT370_ALLOW_ATA100_5 ? ATA_UDMA5 : ATA_UDMA4,
-@@ -531,7 +531,7 @@ static const struct hpt_info hpt370a __devinitdata = {
- .timings = &hpt37x_timings
- };
-
--static const struct hpt_info hpt374 __devinitdata = {
-+static const struct hpt_info hpt374 __devinitconst = {
- .chip_name = "HPT374",
- .chip_type = HPT374,
- .udma_mask = ATA_UDMA5,
-@@ -539,7 +539,7 @@ static const struct hpt_info hpt374 __devinitdata = {
- .timings = &hpt37x_timings
- };
-
--static const struct hpt_info hpt372 __devinitdata = {
-+static const struct hpt_info hpt372 __devinitconst = {
- .chip_name = "HPT372",
- .chip_type = HPT372,
- .udma_mask = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
-@@ -547,7 +547,7 @@ static const struct hpt_info hpt372 __devinitdata = {
- .timings = &hpt37x_timings
- };
-
--static const struct hpt_info hpt372a __devinitdata = {
-+static const struct hpt_info hpt372a __devinitconst = {
- .chip_name = "HPT372A",
- .chip_type = HPT372A,
- .udma_mask = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
-@@ -555,7 +555,7 @@ static const struct hpt_info hpt372a __devinitdata = {
- .timings = &hpt37x_timings
- };
-
--static const struct hpt_info hpt302 __devinitdata = {
-+static const struct hpt_info hpt302 __devinitconst = {
- .chip_name = "HPT302",
- .chip_type = HPT302,
- .udma_mask = HPT302_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
-@@ -563,7 +563,7 @@ static const struct hpt_info hpt302 __devinitdata = {
- .timings = &hpt37x_timings
- };
-
--static const struct hpt_info hpt371 __devinitdata = {
-+static const struct hpt_info hpt371 __devinitconst = {
- .chip_name = "HPT371",
- .chip_type = HPT371,
- .udma_mask = HPT371_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
-@@ -571,7 +571,7 @@ static const struct hpt_info hpt371 __devinitdata = {
- .timings = &hpt37x_timings
- };
-
--static const struct hpt_info hpt372n __devinitdata = {
-+static const struct hpt_info hpt372n __devinitconst = {
- .chip_name = "HPT372N",
- .chip_type = HPT372N,
- .udma_mask = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
-@@ -579,7 +579,7 @@ static const struct hpt_info hpt372n __devinitdata = {
- .timings = &hpt37x_timings
- };
-
--static const struct hpt_info hpt302n __devinitdata = {
-+static const struct hpt_info hpt302n __devinitconst = {
- .chip_name = "HPT302N",
- .chip_type = HPT302N,
- .udma_mask = HPT302_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
-@@ -587,7 +587,7 @@ static const struct hpt_info hpt302n __devinitdata = {
- .timings = &hpt37x_timings
- };
-
--static const struct hpt_info hpt371n __devinitdata = {
-+static const struct hpt_info hpt371n __devinitconst = {
- .chip_name = "HPT371N",
- .chip_type = HPT371N,
- .udma_mask = HPT371_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
-@@ -1422,7 +1422,7 @@ static const struct ide_dma_ops hpt36x_dma_ops = {
- .dma_sff_read_status = ide_dma_sff_read_status,
- };
-
--static const struct ide_port_info hpt366_chipsets[] __devinitdata = {
-+static const struct ide_port_info hpt366_chipsets[] __devinitconst = {
- { /* 0: HPT36x */
- .name = DRV_NAME,
- .init_chipset = init_chipset_hpt366,
-diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
-index 2de76cc..74186a1 100644
---- a/drivers/ide/ide-cd.c
-+++ b/drivers/ide/ide-cd.c
-@@ -774,7 +774,7 @@ static void cdrom_do_block_pc(ide_drive_t *drive, struct request *rq)
- alignment = queue_dma_alignment(q) | q->dma_pad_mask;
- if ((unsigned long)buf & alignment
- || blk_rq_bytes(rq) & q->dma_pad_mask
-- || object_is_on_stack(buf))
-+ || object_starts_on_stack(buf))
- drive->dma = 0;
- }
- }
-diff --git a/drivers/ide/ide-floppy.c b/drivers/ide/ide-floppy.c
-index fefbdfc..62ff465 100644
---- a/drivers/ide/ide-floppy.c
-+++ b/drivers/ide/ide-floppy.c
-@@ -373,6 +373,8 @@ static int ide_floppy_get_capacity(ide_drive_t *drive)
- u8 pc_buf[256], header_len, desc_cnt;
- int i, rc = 1, blocks, length;
-
-+ pax_track_stack();
-+
- ide_debug_log(IDE_DBG_FUNC, "enter");
-
- drive->bios_cyl = 0;
-diff --git a/drivers/ide/ide-pci-generic.c b/drivers/ide/ide-pci-generic.c
-index 39d4e01..11538ce 100644
---- a/drivers/ide/ide-pci-generic.c
-+++ b/drivers/ide/ide-pci-generic.c
-@@ -53,7 +53,7 @@ static const struct ide_port_ops netcell_port_ops = {
- .udma_mask = ATA_UDMA6, \
- }
-
--static const struct ide_port_info generic_chipsets[] __devinitdata = {
-+static const struct ide_port_info generic_chipsets[] __devinitconst = {
- /* 0: Unknown */
- DECLARE_GENERIC_PCI_DEV(0),
-
-diff --git a/drivers/ide/it8172.c b/drivers/ide/it8172.c
-index 0d266a5..aaca790 100644
---- a/drivers/ide/it8172.c
-+++ b/drivers/ide/it8172.c
-@@ -115,7 +115,7 @@ static const struct ide_port_ops it8172_port_ops = {
- .set_dma_mode = it8172_set_dma_mode,
- };
-
--static const struct ide_port_info it8172_port_info __devinitdata = {
-+static const struct ide_port_info it8172_port_info __devinitconst = {
- .name = DRV_NAME,
- .port_ops = &it8172_port_ops,
- .enablebits = { {0x41, 0x80, 0x80}, {0x00, 0x00, 0x00} },
-diff --git a/drivers/ide/it8213.c b/drivers/ide/it8213.c
-index 4797616..4be488a 100644
---- a/drivers/ide/it8213.c
-+++ b/drivers/ide/it8213.c
-@@ -156,7 +156,7 @@ static const struct ide_port_ops it8213_port_ops = {
- .cable_detect = it8213_cable_detect,
- };
-
--static const struct ide_port_info it8213_chipset __devinitdata = {
-+static const struct ide_port_info it8213_chipset __devinitconst = {
- .name = DRV_NAME,
- .enablebits = { {0x41, 0x80, 0x80} },
- .port_ops = &it8213_port_ops,
-diff --git a/drivers/ide/it821x.c b/drivers/ide/it821x.c
-index 51aa745..146ee60 100644
---- a/drivers/ide/it821x.c
-+++ b/drivers/ide/it821x.c
-@@ -627,7 +627,7 @@ static const struct ide_port_ops it821x_port_ops = {
- .cable_detect = it821x_cable_detect,
- };
-
--static const struct ide_port_info it821x_chipset __devinitdata = {
-+static const struct ide_port_info it821x_chipset __devinitconst = {
- .name = DRV_NAME,
- .init_chipset = init_chipset_it821x,
- .init_hwif = init_hwif_it821x,
-diff --git a/drivers/ide/jmicron.c b/drivers/ide/jmicron.c
-index bf2be643..9270098 100644
---- a/drivers/ide/jmicron.c
-+++ b/drivers/ide/jmicron.c
-@@ -102,7 +102,7 @@ static const struct ide_port_ops jmicron_port_ops = {
- .cable_detect = jmicron_cable_detect,
- };
-
--static const struct ide_port_info jmicron_chipset __devinitdata = {
-+static const struct ide_port_info jmicron_chipset __devinitconst = {
- .name = DRV_NAME,
- .enablebits = { { 0x40, 0x01, 0x01 }, { 0x40, 0x10, 0x10 } },
- .port_ops = &jmicron_port_ops,
-diff --git a/drivers/ide/ns87415.c b/drivers/ide/ns87415.c
-index 95327a2..73f78d8 100644
---- a/drivers/ide/ns87415.c
-+++ b/drivers/ide/ns87415.c
-@@ -293,7 +293,7 @@ static const struct ide_dma_ops ns87415_dma_ops = {
- .dma_sff_read_status = superio_dma_sff_read_status,
- };
-
--static const struct ide_port_info ns87415_chipset __devinitdata = {
-+static const struct ide_port_info ns87415_chipset __devinitconst = {
- .name = DRV_NAME,
- .init_hwif = init_hwif_ns87415,
- .tp_ops = &ns87415_tp_ops,
-diff --git a/drivers/ide/opti621.c b/drivers/ide/opti621.c
-index f1d70d6..e1de05b 100644
---- a/drivers/ide/opti621.c
-+++ b/drivers/ide/opti621.c
-@@ -202,7 +202,7 @@ static const struct ide_port_ops opti621_port_ops = {
- .set_pio_mode = opti621_set_pio_mode,
- };
-
--static const struct ide_port_info opti621_chipset __devinitdata = {
-+static const struct ide_port_info opti621_chipset __devinitconst = {
- .name = DRV_NAME,
- .enablebits = { {0x45, 0x80, 0x00}, {0x40, 0x08, 0x00} },
- .port_ops = &opti621_port_ops,
-diff --git a/drivers/ide/pdc202xx_new.c b/drivers/ide/pdc202xx_new.c
-index 65ba823..7311f4d 100644
---- a/drivers/ide/pdc202xx_new.c
-+++ b/drivers/ide/pdc202xx_new.c
-@@ -465,7 +465,7 @@ static const struct ide_port_ops pdcnew_port_ops = {
- .udma_mask = udma, \
- }
-
--static const struct ide_port_info pdcnew_chipsets[] __devinitdata = {
-+static const struct ide_port_info pdcnew_chipsets[] __devinitconst = {
- /* 0: PDC202{68,70} */ DECLARE_PDCNEW_DEV(ATA_UDMA5),
- /* 1: PDC202{69,71,75,76,77} */ DECLARE_PDCNEW_DEV(ATA_UDMA6),
- };
-diff --git a/drivers/ide/pdc202xx_old.c b/drivers/ide/pdc202xx_old.c
-index cb812f3..af816ef 100644
---- a/drivers/ide/pdc202xx_old.c
-+++ b/drivers/ide/pdc202xx_old.c
-@@ -285,7 +285,7 @@ static const struct ide_dma_ops pdc2026x_dma_ops = {
- .max_sectors = sectors, \
- }
-
--static const struct ide_port_info pdc202xx_chipsets[] __devinitdata = {
-+static const struct ide_port_info pdc202xx_chipsets[] __devinitconst = {
- { /* 0: PDC20246 */
- .name = DRV_NAME,
- .init_chipset = init_chipset_pdc202xx,
-diff --git a/drivers/ide/piix.c b/drivers/ide/piix.c
-index bf14f39..15c4b98 100644
---- a/drivers/ide/piix.c
-+++ b/drivers/ide/piix.c
-@@ -344,7 +344,7 @@ static const struct ide_port_ops ich_port_ops = {
- .udma_mask = udma, \
- }
-
--static const struct ide_port_info piix_pci_info[] __devinitdata = {
-+static const struct ide_port_info piix_pci_info[] __devinitconst = {
- /* 0: MPIIX */
- { /*
- * MPIIX actually has only a single IDE channel mapped to
-diff --git a/drivers/ide/rz1000.c b/drivers/ide/rz1000.c
-index a6414a8..c04173e 100644
---- a/drivers/ide/rz1000.c
-+++ b/drivers/ide/rz1000.c
-@@ -38,7 +38,7 @@ static int __devinit rz1000_disable_readahead(struct pci_dev *dev)
- }
- }
-
--static const struct ide_port_info rz1000_chipset __devinitdata = {
-+static const struct ide_port_info rz1000_chipset __devinitconst = {
- .name = DRV_NAME,
- .host_flags = IDE_HFLAG_NO_DMA,
- };
-diff --git a/drivers/ide/sc1200.c b/drivers/ide/sc1200.c
-index d467478..9203942 100644
---- a/drivers/ide/sc1200.c
-+++ b/drivers/ide/sc1200.c
-@@ -290,7 +290,7 @@ static const struct ide_dma_ops sc1200_dma_ops = {
- .dma_sff_read_status = ide_dma_sff_read_status,
- };
-
--static const struct ide_port_info sc1200_chipset __devinitdata = {
-+static const struct ide_port_info sc1200_chipset __devinitconst = {
- .name = DRV_NAME,
- .port_ops = &sc1200_port_ops,
- .dma_ops = &sc1200_dma_ops,
-diff --git a/drivers/ide/scc_pata.c b/drivers/ide/scc_pata.c
-index 1104bb3..59c5194 100644
---- a/drivers/ide/scc_pata.c
-+++ b/drivers/ide/scc_pata.c
-@@ -811,7 +811,7 @@ static const struct ide_dma_ops scc_dma_ops = {
- .dma_sff_read_status = scc_dma_sff_read_status,
- };
-
--static const struct ide_port_info scc_chipset __devinitdata = {
-+static const struct ide_port_info scc_chipset __devinitconst = {
- .name = "sccIDE",
- .init_iops = init_iops_scc,
- .init_dma = scc_init_dma,
-diff --git a/drivers/ide/serverworks.c b/drivers/ide/serverworks.c
-index b6554ef..6cc2cc3 100644
---- a/drivers/ide/serverworks.c
-+++ b/drivers/ide/serverworks.c
-@@ -353,7 +353,7 @@ static const struct ide_port_ops svwks_port_ops = {
- .cable_detect = svwks_cable_detect,
- };
-
--static const struct ide_port_info serverworks_chipsets[] __devinitdata = {
-+static const struct ide_port_info serverworks_chipsets[] __devinitconst = {
- { /* 0: OSB4 */
- .name = DRV_NAME,
- .init_chipset = init_chipset_svwks,
-diff --git a/drivers/ide/setup-pci.c b/drivers/ide/setup-pci.c
-index ab3db61..afed580 100644
---- a/drivers/ide/setup-pci.c
-+++ b/drivers/ide/setup-pci.c
-@@ -542,6 +542,8 @@ int ide_pci_init_two(struct pci_dev *dev1, struct pci_dev *dev2,
- int ret, i, n_ports = dev2 ? 4 : 2;
- struct ide_hw hw[4], *hws[] = { NULL, NULL, NULL, NULL };
-
-+ pax_track_stack();
-+
- for (i = 0; i < n_ports / 2; i++) {
- ret = ide_setup_pci_controller(pdev[i], d, !i);
- if (ret < 0)
-diff --git a/drivers/ide/siimage.c b/drivers/ide/siimage.c
-index d95df52..0b03a39 100644
---- a/drivers/ide/siimage.c
-+++ b/drivers/ide/siimage.c
-@@ -719,7 +719,7 @@ static const struct ide_dma_ops sil_dma_ops = {
- .udma_mask = ATA_UDMA6, \
- }
-
--static const struct ide_port_info siimage_chipsets[] __devinitdata = {
-+static const struct ide_port_info siimage_chipsets[] __devinitconst = {
- /* 0: SiI680 */ DECLARE_SII_DEV(&sil_pata_port_ops),
- /* 1: SiI3112 */ DECLARE_SII_DEV(&sil_sata_port_ops)
- };
-diff --git a/drivers/ide/sis5513.c b/drivers/ide/sis5513.c
-index 3b88eba..ca8699d 100644
---- a/drivers/ide/sis5513.c
-+++ b/drivers/ide/sis5513.c
-@@ -561,7 +561,7 @@ static const struct ide_port_ops sis_ata133_port_ops = {
- .cable_detect = sis_cable_detect,
- };
-
--static const struct ide_port_info sis5513_chipset __devinitdata = {
-+static const struct ide_port_info sis5513_chipset __devinitconst = {
- .name = DRV_NAME,
- .init_chipset = init_chipset_sis5513,
- .enablebits = { {0x4a, 0x02, 0x02}, {0x4a, 0x04, 0x04} },
-diff --git a/drivers/ide/sl82c105.c b/drivers/ide/sl82c105.c
-index d698da4..fca42a4 100644
---- a/drivers/ide/sl82c105.c
-+++ b/drivers/ide/sl82c105.c
-@@ -319,7 +319,7 @@ static const struct ide_dma_ops sl82c105_dma_ops = {
- .dma_sff_read_status = ide_dma_sff_read_status,
- };
-
--static const struct ide_port_info sl82c105_chipset __devinitdata = {
-+static const struct ide_port_info sl82c105_chipset __devinitconst = {
- .name = DRV_NAME,
- .init_chipset = init_chipset_sl82c105,
- .enablebits = {{0x40,0x01,0x01}, {0x40,0x10,0x10}},
-diff --git a/drivers/ide/slc90e66.c b/drivers/ide/slc90e66.c
-index 1ccfb40..83d5779 100644
---- a/drivers/ide/slc90e66.c
-+++ b/drivers/ide/slc90e66.c
-@@ -131,7 +131,7 @@ static const struct ide_port_ops slc90e66_port_ops = {
- .cable_detect = slc90e66_cable_detect,
- };
-
--static const struct ide_port_info slc90e66_chipset __devinitdata = {
-+static const struct ide_port_info slc90e66_chipset __devinitconst = {
- .name = DRV_NAME,
- .enablebits = { {0x41, 0x80, 0x80}, {0x43, 0x80, 0x80} },
- .port_ops = &slc90e66_port_ops,
-diff --git a/drivers/ide/tc86c001.c b/drivers/ide/tc86c001.c
-index 05a93d6..5f9e325 100644
---- a/drivers/ide/tc86c001.c
-+++ b/drivers/ide/tc86c001.c
-@@ -190,7 +190,7 @@ static const struct ide_dma_ops tc86c001_dma_ops = {
- .dma_sff_read_status = ide_dma_sff_read_status,
- };
-
--static const struct ide_port_info tc86c001_chipset __devinitdata = {
-+static const struct ide_port_info tc86c001_chipset __devinitconst = {
- .name = DRV_NAME,
- .init_hwif = init_hwif_tc86c001,
- .port_ops = &tc86c001_port_ops,
-diff --git a/drivers/ide/triflex.c b/drivers/ide/triflex.c
-index 8773c3b..7907d6c 100644
---- a/drivers/ide/triflex.c
-+++ b/drivers/ide/triflex.c
-@@ -92,7 +92,7 @@ static const struct ide_port_ops triflex_port_ops = {
- .set_dma_mode = triflex_set_mode,
- };
-
--static const struct ide_port_info triflex_device __devinitdata = {
-+static const struct ide_port_info triflex_device __devinitconst = {
- .name = DRV_NAME,
- .enablebits = {{0x80, 0x01, 0x01}, {0x80, 0x02, 0x02}},
- .port_ops = &triflex_port_ops,
-diff --git a/drivers/ide/trm290.c b/drivers/ide/trm290.c
-index 4b42ca0..e494a98 100644
---- a/drivers/ide/trm290.c
-+++ b/drivers/ide/trm290.c
-@@ -324,7 +324,7 @@ static struct ide_dma_ops trm290_dma_ops = {
- .dma_check = trm290_dma_check,
- };
-
--static const struct ide_port_info trm290_chipset __devinitdata = {
-+static const struct ide_port_info trm290_chipset __devinitconst = {
- .name = DRV_NAME,
- .init_hwif = init_hwif_trm290,
- .tp_ops = &trm290_tp_ops,
-diff --git a/drivers/ide/via82cxxx.c b/drivers/ide/via82cxxx.c
-index 028de26..520d5d5 100644
---- a/drivers/ide/via82cxxx.c
-+++ b/drivers/ide/via82cxxx.c
-@@ -374,7 +374,7 @@ static const struct ide_port_ops via_port_ops = {
- .cable_detect = via82cxxx_cable_detect,
- };
-
--static const struct ide_port_info via82cxxx_chipset __devinitdata = {
-+static const struct ide_port_info via82cxxx_chipset __devinitconst = {
- .name = DRV_NAME,
- .init_chipset = init_chipset_via82cxxx,
- .enablebits = { { 0x40, 0x02, 0x02 }, { 0x40, 0x01, 0x01 } },
-diff --git a/drivers/ieee1394/dv1394.c b/drivers/ieee1394/dv1394.c
-index 2cd00b5..14de699 100644
---- a/drivers/ieee1394/dv1394.c
-+++ b/drivers/ieee1394/dv1394.c
-@@ -739,7 +739,7 @@ static void frame_prepare(struct video_card *video, unsigned int this_frame)
- based upon DIF section and sequence
- */
-
--static void inline
-+static inline void
- frame_put_packet (struct frame *f, struct packet *p)
- {
- int section_type = p->data[0] >> 5; /* section type is in bits 5 - 7 */
-diff --git a/drivers/ieee1394/hosts.c b/drivers/ieee1394/hosts.c
-index e947d8f..6a966b9 100644
---- a/drivers/ieee1394/hosts.c
-+++ b/drivers/ieee1394/hosts.c
-@@ -78,6 +78,7 @@ static int dummy_isoctl(struct hpsb_iso *iso, enum isoctl_cmd command,
- }
-
- static struct hpsb_host_driver dummy_driver = {
-+ .name = "dummy",
- .transmit_packet = dummy_transmit_packet,
- .devctl = dummy_devctl,
- .isoctl = dummy_isoctl
-diff --git a/drivers/ieee1394/init_ohci1394_dma.c b/drivers/ieee1394/init_ohci1394_dma.c
-index ddaab6e..8d37435 100644
---- a/drivers/ieee1394/init_ohci1394_dma.c
-+++ b/drivers/ieee1394/init_ohci1394_dma.c
-@@ -257,7 +257,7 @@ void __init init_ohci1394_dma_on_all_controllers(void)
- for (func = 0; func < 8; func++) {
- u32 class = read_pci_config(num,slot,func,
- PCI_CLASS_REVISION);
-- if ((class == 0xffffffff))
-+ if (class == 0xffffffff)
- continue; /* No device at this func */
-
- if (class>>8 != PCI_CLASS_SERIAL_FIREWIRE_OHCI)
-diff --git a/drivers/ieee1394/ohci1394.c b/drivers/ieee1394/ohci1394.c
-index 65c1429..5d8c11f 100644
---- a/drivers/ieee1394/ohci1394.c
-+++ b/drivers/ieee1394/ohci1394.c
-@@ -147,9 +147,9 @@ printk(level "%s: " fmt "\n" , OHCI1394_DRIVER_NAME , ## args)
- printk(level "%s: fw-host%d: " fmt "\n" , OHCI1394_DRIVER_NAME, ohci->host->id , ## args)
-
- /* Module Parameters */
--static int phys_dma = 1;
-+static int phys_dma;
- module_param(phys_dma, int, 0444);
--MODULE_PARM_DESC(phys_dma, "Enable physical DMA (default = 1).");
-+MODULE_PARM_DESC(phys_dma, "Enable physical DMA (default = 0).");
-
- static void dma_trm_tasklet(unsigned long data);
- static void dma_trm_reset(struct dma_trm_ctx *d);
-diff --git a/drivers/ieee1394/sbp2.c b/drivers/ieee1394/sbp2.c
-index f199896..78c9fc8 100644
---- a/drivers/ieee1394/sbp2.c
-+++ b/drivers/ieee1394/sbp2.c
-@@ -2111,7 +2111,7 @@ MODULE_DESCRIPTION("IEEE-1394 SBP-2 protocol driver");
- MODULE_SUPPORTED_DEVICE(SBP2_DEVICE_NAME);
- MODULE_LICENSE("GPL");
-
--static int sbp2_module_init(void)
-+static int __init sbp2_module_init(void)
- {
- int ret;
-
-diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
-index a5dea6b..0cefe8f 100644
---- a/drivers/infiniband/core/cm.c
-+++ b/drivers/infiniband/core/cm.c
-@@ -112,7 +112,7 @@ static char const counter_group_names[CM_COUNTER_GROUPS]
-
- struct cm_counter_group {
- struct kobject obj;
-- atomic_long_t counter[CM_ATTR_COUNT];
-+ atomic_long_unchecked_t counter[CM_ATTR_COUNT];
- };
-
- struct cm_counter_attribute {
-@@ -1386,7 +1386,7 @@ static void cm_dup_req_handler(struct cm_work *work,
- struct ib_mad_send_buf *msg = NULL;
- int ret;
-
-- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- counter[CM_REQ_COUNTER]);
-
- /* Quick state check to discard duplicate REQs. */
-@@ -1764,7 +1764,7 @@ static void cm_dup_rep_handler(struct cm_work *work)
- if (!cm_id_priv)
- return;
-
-- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- counter[CM_REP_COUNTER]);
- ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
- if (ret)
-@@ -1931,7 +1931,7 @@ static int cm_rtu_handler(struct cm_work *work)
- if (cm_id_priv->id.state != IB_CM_REP_SENT &&
- cm_id_priv->id.state != IB_CM_MRA_REP_RCVD) {
- spin_unlock_irq(&cm_id_priv->lock);
-- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- counter[CM_RTU_COUNTER]);
- goto out;
- }
-@@ -2110,7 +2110,7 @@ static int cm_dreq_handler(struct cm_work *work)
- cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id,
- dreq_msg->local_comm_id);
- if (!cm_id_priv) {
-- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- counter[CM_DREQ_COUNTER]);
- cm_issue_drep(work->port, work->mad_recv_wc);
- return -EINVAL;
-@@ -2131,7 +2131,7 @@ static int cm_dreq_handler(struct cm_work *work)
- case IB_CM_MRA_REP_RCVD:
- break;
- case IB_CM_TIMEWAIT:
-- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- counter[CM_DREQ_COUNTER]);
- if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
- goto unlock;
-@@ -2145,7 +2145,7 @@ static int cm_dreq_handler(struct cm_work *work)
- cm_free_msg(msg);
- goto deref;
- case IB_CM_DREQ_RCVD:
-- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- counter[CM_DREQ_COUNTER]);
- goto unlock;
- default:
-@@ -2501,7 +2501,7 @@ static int cm_mra_handler(struct cm_work *work)
- ib_modify_mad(cm_id_priv->av.port->mad_agent,
- cm_id_priv->msg, timeout)) {
- if (cm_id_priv->id.lap_state == IB_CM_MRA_LAP_RCVD)
-- atomic_long_inc(&work->port->
-+ atomic_long_inc_unchecked(&work->port->
- counter_group[CM_RECV_DUPLICATES].
- counter[CM_MRA_COUNTER]);
- goto out;
-@@ -2510,7 +2510,7 @@ static int cm_mra_handler(struct cm_work *work)
- break;
- case IB_CM_MRA_REQ_RCVD:
- case IB_CM_MRA_REP_RCVD:
-- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- counter[CM_MRA_COUNTER]);
- /* fall through */
- default:
-@@ -2672,7 +2672,7 @@ static int cm_lap_handler(struct cm_work *work)
- case IB_CM_LAP_IDLE:
- break;
- case IB_CM_MRA_LAP_SENT:
-- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- counter[CM_LAP_COUNTER]);
- if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
- goto unlock;
-@@ -2688,7 +2688,7 @@ static int cm_lap_handler(struct cm_work *work)
- cm_free_msg(msg);
- goto deref;
- case IB_CM_LAP_RCVD:
-- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- counter[CM_LAP_COUNTER]);
- goto unlock;
- default:
-@@ -2972,7 +2972,7 @@ static int cm_sidr_req_handler(struct cm_work *work)
- cur_cm_id_priv = cm_insert_remote_sidr(cm_id_priv);
- if (cur_cm_id_priv) {
- spin_unlock_irq(&cm.lock);
-- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- counter[CM_SIDR_REQ_COUNTER]);
- goto out; /* Duplicate message. */
- }
-@@ -3184,10 +3184,10 @@ static void cm_send_handler(struct ib_mad_agent *mad_agent,
- if (!msg->context[0] && (attr_index != CM_REJ_COUNTER))
- msg->retries = 1;
-
-- atomic_long_add(1 + msg->retries,
-+ atomic_long_add_unchecked(1 + msg->retries,
- &port->counter_group[CM_XMIT].counter[attr_index]);
- if (msg->retries)
-- atomic_long_add(msg->retries,
-+ atomic_long_add_unchecked(msg->retries,
- &port->counter_group[CM_XMIT_RETRIES].
- counter[attr_index]);
-
-@@ -3397,7 +3397,7 @@ static void cm_recv_handler(struct ib_mad_agent *mad_agent,
- }
-
- attr_id = be16_to_cpu(mad_recv_wc->recv_buf.mad->mad_hdr.attr_id);
-- atomic_long_inc(&port->counter_group[CM_RECV].
-+ atomic_long_inc_unchecked(&port->counter_group[CM_RECV].
- counter[attr_id - CM_ATTR_ID_OFFSET]);
-
- work = kmalloc(sizeof *work + sizeof(struct ib_sa_path_rec) * paths,
-@@ -3595,10 +3595,10 @@ static ssize_t cm_show_counter(struct kobject *obj, struct attribute *attr,
- cm_attr = container_of(attr, struct cm_counter_attribute, attr);
-
- return sprintf(buf, "%ld\n",
-- atomic_long_read(&group->counter[cm_attr->index]));
-+ atomic_long_read_unchecked(&group->counter[cm_attr->index]));
- }
-
--static struct sysfs_ops cm_counter_ops = {
-+static const struct sysfs_ops cm_counter_ops = {
- .show = cm_show_counter
- };
-
-diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
-index 8fd3a6f..61d8075 100644
---- a/drivers/infiniband/core/cma.c
-+++ b/drivers/infiniband/core/cma.c
-@@ -2267,6 +2267,9 @@ static int cma_resolve_ib_udp(struct rdma_id_private *id_priv,
-
- req.private_data_len = sizeof(struct cma_hdr) +
- conn_param->private_data_len;
-+ if (req.private_data_len < conn_param->private_data_len)
-+ return -EINVAL;
-+
- req.private_data = kzalloc(req.private_data_len, GFP_ATOMIC);
- if (!req.private_data)
- return -ENOMEM;
-@@ -2314,6 +2317,9 @@ static int cma_connect_ib(struct rdma_id_private *id_priv,
- memset(&req, 0, sizeof req);
- offset = cma_user_data_offset(id_priv->id.ps);
- req.private_data_len = offset + conn_param->private_data_len;
-+ if (req.private_data_len < conn_param->private_data_len)
-+ return -EINVAL;
-+
- private_data = kzalloc(req.private_data_len, GFP_ATOMIC);
- if (!private_data)
- return -ENOMEM;
-diff --git a/drivers/infiniband/core/fmr_pool.c b/drivers/infiniband/core/fmr_pool.c
-index 4507043..14ad522 100644
---- a/drivers/infiniband/core/fmr_pool.c
-+++ b/drivers/infiniband/core/fmr_pool.c
-@@ -97,8 +97,8 @@ struct ib_fmr_pool {
-
- struct task_struct *thread;
-
-- atomic_t req_ser;
-- atomic_t flush_ser;
-+ atomic_unchecked_t req_ser;
-+ atomic_unchecked_t flush_ser;
-
- wait_queue_head_t force_wait;
- };
-@@ -179,10 +179,10 @@ static int ib_fmr_cleanup_thread(void *pool_ptr)
- struct ib_fmr_pool *pool = pool_ptr;
-
- do {
-- if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) < 0) {
-+ if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) < 0) {
- ib_fmr_batch_release(pool);
-
-- atomic_inc(&pool->flush_ser);
-+ atomic_inc_unchecked(&pool->flush_ser);
- wake_up_interruptible(&pool->force_wait);
-
- if (pool->flush_function)
-@@ -190,7 +190,7 @@ static int ib_fmr_cleanup_thread(void *pool_ptr)
- }
-
- set_current_state(TASK_INTERRUPTIBLE);
-- if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) >= 0 &&
-+ if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) >= 0 &&
- !kthread_should_stop())
- schedule();
- __set_current_state(TASK_RUNNING);
-@@ -282,8 +282,8 @@ struct ib_fmr_pool *ib_create_fmr_pool(struct ib_pd *pd,
- pool->dirty_watermark = params->dirty_watermark;
- pool->dirty_len = 0;
- spin_lock_init(&pool->pool_lock);
-- atomic_set(&pool->req_ser, 0);
-- atomic_set(&pool->flush_ser, 0);
-+ atomic_set_unchecked(&pool->req_ser, 0);
-+ atomic_set_unchecked(&pool->flush_ser, 0);
- init_waitqueue_head(&pool->force_wait);
-
- pool->thread = kthread_run(ib_fmr_cleanup_thread,
-@@ -411,11 +411,11 @@ int ib_flush_fmr_pool(struct ib_fmr_pool *pool)
- }
- spin_unlock_irq(&pool->pool_lock);
-
-- serial = atomic_inc_return(&pool->req_ser);
-+ serial = atomic_inc_return_unchecked(&pool->req_ser);
- wake_up_process(pool->thread);
-
- if (wait_event_interruptible(pool->force_wait,
-- atomic_read(&pool->flush_ser) - serial >= 0))
-+ atomic_read_unchecked(&pool->flush_ser) - serial >= 0))
- return -EINTR;
-
- return 0;
-@@ -525,7 +525,7 @@ int ib_fmr_pool_unmap(struct ib_pool_fmr *fmr)
- } else {
- list_add_tail(&fmr->list, &pool->dirty_list);
- if (++pool->dirty_len >= pool->dirty_watermark) {
-- atomic_inc(&pool->req_ser);
-+ atomic_inc_unchecked(&pool->req_ser);
- wake_up_process(pool->thread);
- }
- }
-diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
-index 158a214..1558bb7 100644
---- a/drivers/infiniband/core/sysfs.c
-+++ b/drivers/infiniband/core/sysfs.c
-@@ -79,7 +79,7 @@ static ssize_t port_attr_show(struct kobject *kobj,
- return port_attr->show(p, port_attr, buf);
- }
-
--static struct sysfs_ops port_sysfs_ops = {
-+static const struct sysfs_ops port_sysfs_ops = {
- .show = port_attr_show
- };
-
-diff --git a/drivers/infiniband/core/uverbs_marshall.c b/drivers/infiniband/core/uverbs_marshall.c
-index 5440da0..1194ecb 100644
---- a/drivers/infiniband/core/uverbs_marshall.c
-+++ b/drivers/infiniband/core/uverbs_marshall.c
-@@ -40,18 +40,21 @@ void ib_copy_ah_attr_to_user(struct ib_uverbs_ah_attr *dst,
- dst->grh.sgid_index = src->grh.sgid_index;
- dst->grh.hop_limit = src->grh.hop_limit;
- dst->grh.traffic_class = src->grh.traffic_class;
-+ memset(&dst->grh.reserved, 0, sizeof(dst->grh.reserved));
- dst->dlid = src->dlid;
- dst->sl = src->sl;
- dst->src_path_bits = src->src_path_bits;
- dst->static_rate = src->static_rate;
- dst->is_global = src->ah_flags & IB_AH_GRH ? 1 : 0;
- dst->port_num = src->port_num;
-+ dst->reserved = 0;
- }
- EXPORT_SYMBOL(ib_copy_ah_attr_to_user);
-
- void ib_copy_qp_attr_to_user(struct ib_uverbs_qp_attr *dst,
- struct ib_qp_attr *src)
- {
-+ dst->qp_state = src->qp_state;
- dst->cur_qp_state = src->cur_qp_state;
- dst->path_mtu = src->path_mtu;
- dst->path_mig_state = src->path_mig_state;
-@@ -83,6 +86,7 @@ void ib_copy_qp_attr_to_user(struct ib_uverbs_qp_attr *dst,
- dst->rnr_retry = src->rnr_retry;
- dst->alt_port_num = src->alt_port_num;
- dst->alt_timeout = src->alt_timeout;
-+ memset(dst->reserved, 0, sizeof(dst->reserved));
- }
- EXPORT_SYMBOL(ib_copy_qp_attr_to_user);
-
-diff --git a/drivers/infiniband/hw/ipath/ipath_fs.c b/drivers/infiniband/hw/ipath/ipath_fs.c
-index 100da85..62e6b88 100644
---- a/drivers/infiniband/hw/ipath/ipath_fs.c
-+++ b/drivers/infiniband/hw/ipath/ipath_fs.c
-@@ -110,6 +110,8 @@ static ssize_t atomic_counters_read(struct file *file, char __user *buf,
- struct infinipath_counters counters;
- struct ipath_devdata *dd;
-
-+ pax_track_stack();
-+
- dd = file->f_path.dentry->d_inode->i_private;
- dd->ipath_f_read_counters(dd, &counters);
-
-diff --git a/drivers/infiniband/hw/nes/nes.c b/drivers/infiniband/hw/nes/nes.c
-index cbde0cf..afaf55c 100644
---- a/drivers/infiniband/hw/nes/nes.c
-+++ b/drivers/infiniband/hw/nes/nes.c
-@@ -102,7 +102,7 @@ MODULE_PARM_DESC(limit_maxrdreqsz, "Limit max read request size to 256 Bytes");
- LIST_HEAD(nes_adapter_list);
- static LIST_HEAD(nes_dev_list);
-
--atomic_t qps_destroyed;
-+atomic_unchecked_t qps_destroyed;
-
- static unsigned int ee_flsh_adapter;
- static unsigned int sysfs_nonidx_addr;
-@@ -259,7 +259,7 @@ static void nes_cqp_rem_ref_callback(struct nes_device *nesdev, struct nes_cqp_r
- struct nes_adapter *nesadapter = nesdev->nesadapter;
- u32 qp_id;
-
-- atomic_inc(&qps_destroyed);
-+ atomic_inc_unchecked(&qps_destroyed);
-
- /* Free the control structures */
-
-diff --git a/drivers/infiniband/hw/nes/nes.h b/drivers/infiniband/hw/nes/nes.h
-index bcc6abc..9c76b2f 100644
---- a/drivers/infiniband/hw/nes/nes.h
-+++ b/drivers/infiniband/hw/nes/nes.h
-@@ -174,17 +174,17 @@ extern unsigned int nes_debug_level;
- extern unsigned int wqm_quanta;
- extern struct list_head nes_adapter_list;
-
--extern atomic_t cm_connects;
--extern atomic_t cm_accepts;
--extern atomic_t cm_disconnects;
--extern atomic_t cm_closes;
--extern atomic_t cm_connecteds;
--extern atomic_t cm_connect_reqs;
--extern atomic_t cm_rejects;
--extern atomic_t mod_qp_timouts;
--extern atomic_t qps_created;
--extern atomic_t qps_destroyed;
--extern atomic_t sw_qps_destroyed;
-+extern atomic_unchecked_t cm_connects;
-+extern atomic_unchecked_t cm_accepts;
-+extern atomic_unchecked_t cm_disconnects;
-+extern atomic_unchecked_t cm_closes;
-+extern atomic_unchecked_t cm_connecteds;
-+extern atomic_unchecked_t cm_connect_reqs;
-+extern atomic_unchecked_t cm_rejects;
-+extern atomic_unchecked_t mod_qp_timouts;
-+extern atomic_unchecked_t qps_created;
-+extern atomic_unchecked_t qps_destroyed;
-+extern atomic_unchecked_t sw_qps_destroyed;
- extern u32 mh_detected;
- extern u32 mh_pauses_sent;
- extern u32 cm_packets_sent;
-@@ -196,11 +196,11 @@ extern u32 cm_packets_retrans;
- extern u32 cm_listens_created;
- extern u32 cm_listens_destroyed;
- extern u32 cm_backlog_drops;
--extern atomic_t cm_loopbacks;
--extern atomic_t cm_nodes_created;
--extern atomic_t cm_nodes_destroyed;
--extern atomic_t cm_accel_dropped_pkts;
--extern atomic_t cm_resets_recvd;
-+extern atomic_unchecked_t cm_loopbacks;
-+extern atomic_unchecked_t cm_nodes_created;
-+extern atomic_unchecked_t cm_nodes_destroyed;
-+extern atomic_unchecked_t cm_accel_dropped_pkts;
-+extern atomic_unchecked_t cm_resets_recvd;
-
- extern u32 int_mod_timer_init;
- extern u32 int_mod_cq_depth_256;
-diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c
-index 73473db..5ed06e8 100644
---- a/drivers/infiniband/hw/nes/nes_cm.c
-+++ b/drivers/infiniband/hw/nes/nes_cm.c
-@@ -69,11 +69,11 @@ u32 cm_packets_received;
- u32 cm_listens_created;
- u32 cm_listens_destroyed;
- u32 cm_backlog_drops;
--atomic_t cm_loopbacks;
--atomic_t cm_nodes_created;
--atomic_t cm_nodes_destroyed;
--atomic_t cm_accel_dropped_pkts;
--atomic_t cm_resets_recvd;
-+atomic_unchecked_t cm_loopbacks;
-+atomic_unchecked_t cm_nodes_created;
-+atomic_unchecked_t cm_nodes_destroyed;
-+atomic_unchecked_t cm_accel_dropped_pkts;
-+atomic_unchecked_t cm_resets_recvd;
-
- static inline int mini_cm_accelerated(struct nes_cm_core *,
- struct nes_cm_node *);
-@@ -149,13 +149,13 @@ static struct nes_cm_ops nes_cm_api = {
-
- static struct nes_cm_core *g_cm_core;
-
--atomic_t cm_connects;
--atomic_t cm_accepts;
--atomic_t cm_disconnects;
--atomic_t cm_closes;
--atomic_t cm_connecteds;
--atomic_t cm_connect_reqs;
--atomic_t cm_rejects;
-+atomic_unchecked_t cm_connects;
-+atomic_unchecked_t cm_accepts;
-+atomic_unchecked_t cm_disconnects;
-+atomic_unchecked_t cm_closes;
-+atomic_unchecked_t cm_connecteds;
-+atomic_unchecked_t cm_connect_reqs;
-+atomic_unchecked_t cm_rejects;
-
-
- /**
-@@ -1195,7 +1195,7 @@ static struct nes_cm_node *make_cm_node(struct nes_cm_core *cm_core,
- cm_node->rem_mac);
-
- add_hte_node(cm_core, cm_node);
-- atomic_inc(&cm_nodes_created);
-+ atomic_inc_unchecked(&cm_nodes_created);
-
- return cm_node;
- }
-@@ -1253,7 +1253,7 @@ static int rem_ref_cm_node(struct nes_cm_core *cm_core,
- }
-
- atomic_dec(&cm_core->node_cnt);
-- atomic_inc(&cm_nodes_destroyed);
-+ atomic_inc_unchecked(&cm_nodes_destroyed);
- nesqp = cm_node->nesqp;
- if (nesqp) {
- nesqp->cm_node = NULL;
-@@ -1320,7 +1320,7 @@ static int process_options(struct nes_cm_node *cm_node, u8 *optionsloc,
-
- static void drop_packet(struct sk_buff *skb)
- {
-- atomic_inc(&cm_accel_dropped_pkts);
-+ atomic_inc_unchecked(&cm_accel_dropped_pkts);
- dev_kfree_skb_any(skb);
- }
-
-@@ -1377,7 +1377,7 @@ static void handle_rst_pkt(struct nes_cm_node *cm_node, struct sk_buff *skb,
-
- int reset = 0; /* whether to send reset in case of err.. */
- int passive_state;
-- atomic_inc(&cm_resets_recvd);
-+ atomic_inc_unchecked(&cm_resets_recvd);
- nes_debug(NES_DBG_CM, "Received Reset, cm_node = %p, state = %u."
- " refcnt=%d\n", cm_node, cm_node->state,
- atomic_read(&cm_node->ref_count));
-@@ -2000,7 +2000,7 @@ static struct nes_cm_node *mini_cm_connect(struct nes_cm_core *cm_core,
- rem_ref_cm_node(cm_node->cm_core, cm_node);
- return NULL;
- }
-- atomic_inc(&cm_loopbacks);
-+ atomic_inc_unchecked(&cm_loopbacks);
- loopbackremotenode->loopbackpartner = cm_node;
- loopbackremotenode->tcp_cntxt.rcv_wscale =
- NES_CM_DEFAULT_RCV_WND_SCALE;
-@@ -2262,7 +2262,7 @@ static int mini_cm_recv_pkt(struct nes_cm_core *cm_core,
- add_ref_cm_node(cm_node);
- } else if (cm_node->state == NES_CM_STATE_TSA) {
- rem_ref_cm_node(cm_core, cm_node);
-- atomic_inc(&cm_accel_dropped_pkts);
-+ atomic_inc_unchecked(&cm_accel_dropped_pkts);
- dev_kfree_skb_any(skb);
- break;
- }
-@@ -2568,7 +2568,7 @@ static int nes_cm_disconn_true(struct nes_qp *nesqp)
-
- if ((cm_id) && (cm_id->event_handler)) {
- if (issue_disconn) {
-- atomic_inc(&cm_disconnects);
-+ atomic_inc_unchecked(&cm_disconnects);
- cm_event.event = IW_CM_EVENT_DISCONNECT;
- cm_event.status = disconn_status;
- cm_event.local_addr = cm_id->local_addr;
-@@ -2590,7 +2590,7 @@ static int nes_cm_disconn_true(struct nes_qp *nesqp)
- }
-
- if (issue_close) {
-- atomic_inc(&cm_closes);
-+ atomic_inc_unchecked(&cm_closes);
- nes_disconnect(nesqp, 1);
-
- cm_id->provider_data = nesqp;
-@@ -2710,7 +2710,7 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
-
- nes_debug(NES_DBG_CM, "QP%u, cm_node=%p, jiffies = %lu listener = %p\n",
- nesqp->hwqp.qp_id, cm_node, jiffies, cm_node->listener);
-- atomic_inc(&cm_accepts);
-+ atomic_inc_unchecked(&cm_accepts);
-
- nes_debug(NES_DBG_CM, "netdev refcnt = %u.\n",
- atomic_read(&nesvnic->netdev->refcnt));
-@@ -2919,7 +2919,7 @@ int nes_reject(struct iw_cm_id *cm_id, const void *pdata, u8 pdata_len)
-
- struct nes_cm_core *cm_core;
-
-- atomic_inc(&cm_rejects);
-+ atomic_inc_unchecked(&cm_rejects);
- cm_node = (struct nes_cm_node *) cm_id->provider_data;
- loopback = cm_node->loopbackpartner;
- cm_core = cm_node->cm_core;
-@@ -2982,7 +2982,7 @@ int nes_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
- ntohl(cm_id->local_addr.sin_addr.s_addr),
- ntohs(cm_id->local_addr.sin_port));
-
-- atomic_inc(&cm_connects);
-+ atomic_inc_unchecked(&cm_connects);
- nesqp->active_conn = 1;
-
- /* cache the cm_id in the qp */
-@@ -3195,7 +3195,7 @@ static void cm_event_connected(struct nes_cm_event *event)
- if (nesqp->destroyed) {
- return;
- }
-- atomic_inc(&cm_connecteds);
-+ atomic_inc_unchecked(&cm_connecteds);
- nes_debug(NES_DBG_CM, "QP%u attempting to connect to 0x%08X:0x%04X on"
- " local port 0x%04X. jiffies = %lu.\n",
- nesqp->hwqp.qp_id,
-@@ -3403,7 +3403,7 @@ static void cm_event_reset(struct nes_cm_event *event)
-
- ret = cm_id->event_handler(cm_id, &cm_event);
- cm_id->add_ref(cm_id);
-- atomic_inc(&cm_closes);
-+ atomic_inc_unchecked(&cm_closes);
- cm_event.event = IW_CM_EVENT_CLOSE;
- cm_event.status = IW_CM_EVENT_STATUS_OK;
- cm_event.provider_data = cm_id->provider_data;
-@@ -3439,7 +3439,7 @@ static void cm_event_mpa_req(struct nes_cm_event *event)
- return;
- cm_id = cm_node->cm_id;
-
-- atomic_inc(&cm_connect_reqs);
-+ atomic_inc_unchecked(&cm_connect_reqs);
- nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
- cm_node, cm_id, jiffies);
-
-@@ -3477,7 +3477,7 @@ static void cm_event_mpa_reject(struct nes_cm_event *event)
- return;
- cm_id = cm_node->cm_id;
-
-- atomic_inc(&cm_connect_reqs);
-+ atomic_inc_unchecked(&cm_connect_reqs);
- nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
- cm_node, cm_id, jiffies);
-
-diff --git a/drivers/infiniband/hw/nes/nes_nic.c b/drivers/infiniband/hw/nes/nes_nic.c
-index e593af3..870694a 100644
---- a/drivers/infiniband/hw/nes/nes_nic.c
-+++ b/drivers/infiniband/hw/nes/nes_nic.c
-@@ -1210,17 +1210,17 @@ static void nes_netdev_get_ethtool_stats(struct net_device *netdev,
- target_stat_values[++index] = mh_detected;
- target_stat_values[++index] = mh_pauses_sent;
- target_stat_values[++index] = nesvnic->endnode_ipv4_tcp_retransmits;
-- target_stat_values[++index] = atomic_read(&cm_connects);
-- target_stat_values[++index] = atomic_read(&cm_accepts);
-- target_stat_values[++index] = atomic_read(&cm_disconnects);
-- target_stat_values[++index] = atomic_read(&cm_connecteds);
-- target_stat_values[++index] = atomic_read(&cm_connect_reqs);
-- target_stat_values[++index] = atomic_read(&cm_rejects);
-- target_stat_values[++index] = atomic_read(&mod_qp_timouts);
-- target_stat_values[++index] = atomic_read(&qps_created);
-- target_stat_values[++index] = atomic_read(&sw_qps_destroyed);
-- target_stat_values[++index] = atomic_read(&qps_destroyed);
-- target_stat_values[++index] = atomic_read(&cm_closes);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_connects);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_accepts);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_disconnects);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_connecteds);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_connect_reqs);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_rejects);
-+ target_stat_values[++index] = atomic_read_unchecked(&mod_qp_timouts);
-+ target_stat_values[++index] = atomic_read_unchecked(&qps_created);
-+ target_stat_values[++index] = atomic_read_unchecked(&sw_qps_destroyed);
-+ target_stat_values[++index] = atomic_read_unchecked(&qps_destroyed);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_closes);
- target_stat_values[++index] = cm_packets_sent;
- target_stat_values[++index] = cm_packets_bounced;
- target_stat_values[++index] = cm_packets_created;
-@@ -1230,11 +1230,11 @@ static void nes_netdev_get_ethtool_stats(struct net_device *netdev,
- target_stat_values[++index] = cm_listens_created;
- target_stat_values[++index] = cm_listens_destroyed;
- target_stat_values[++index] = cm_backlog_drops;
-- target_stat_values[++index] = atomic_read(&cm_loopbacks);
-- target_stat_values[++index] = atomic_read(&cm_nodes_created);
-- target_stat_values[++index] = atomic_read(&cm_nodes_destroyed);
-- target_stat_values[++index] = atomic_read(&cm_accel_dropped_pkts);
-- target_stat_values[++index] = atomic_read(&cm_resets_recvd);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_loopbacks);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_created);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_destroyed);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_accel_dropped_pkts);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_resets_recvd);
- target_stat_values[++index] = int_mod_timer_init;
- target_stat_values[++index] = int_mod_cq_depth_1;
- target_stat_values[++index] = int_mod_cq_depth_4;
-diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
-index a680c42..f914deb 100644
---- a/drivers/infiniband/hw/nes/nes_verbs.c
-+++ b/drivers/infiniband/hw/nes/nes_verbs.c
-@@ -45,9 +45,9 @@
-
- #include <rdma/ib_umem.h>
-
--atomic_t mod_qp_timouts;
--atomic_t qps_created;
--atomic_t sw_qps_destroyed;
-+atomic_unchecked_t mod_qp_timouts;
-+atomic_unchecked_t qps_created;
-+atomic_unchecked_t sw_qps_destroyed;
-
- static void nes_unregister_ofa_device(struct nes_ib_device *nesibdev);
-
-@@ -1240,7 +1240,7 @@ static struct ib_qp *nes_create_qp(struct ib_pd *ibpd,
- if (init_attr->create_flags)
- return ERR_PTR(-EINVAL);
-
-- atomic_inc(&qps_created);
-+ atomic_inc_unchecked(&qps_created);
- switch (init_attr->qp_type) {
- case IB_QPT_RC:
- if (nes_drv_opt & NES_DRV_OPT_NO_INLINE_DATA) {
-@@ -1568,7 +1568,7 @@ static int nes_destroy_qp(struct ib_qp *ibqp)
- struct iw_cm_event cm_event;
- int ret;
-
-- atomic_inc(&sw_qps_destroyed);
-+ atomic_inc_unchecked(&sw_qps_destroyed);
- nesqp->destroyed = 1;
-
- /* Blow away the connection if it exists. */
-diff --git a/drivers/input/gameport/gameport.c b/drivers/input/gameport/gameport.c
-index ac11be0..3883c04 100644
---- a/drivers/input/gameport/gameport.c
-+++ b/drivers/input/gameport/gameport.c
-@@ -515,13 +515,13 @@ EXPORT_SYMBOL(gameport_set_phys);
- */
- static void gameport_init_port(struct gameport *gameport)
- {
-- static atomic_t gameport_no = ATOMIC_INIT(0);
-+ static atomic_unchecked_t gameport_no = ATOMIC_INIT(0);
-
- __module_get(THIS_MODULE);
-
- mutex_init(&gameport->drv_mutex);
- device_initialize(&gameport->dev);
-- dev_set_name(&gameport->dev, "gameport%lu", (unsigned long)atomic_inc_return(&gameport_no) - 1);
-+ dev_set_name(&gameport->dev, "gameport%lu", (unsigned long)atomic_inc_return_unchecked(&gameport_no) - 1);
- gameport->dev.bus = &gameport_bus;
- gameport->dev.release = gameport_release_port;
- if (gameport->parent)
-diff --git a/drivers/input/input.c b/drivers/input/input.c
-index c82ae82..8cfb9cb 100644
---- a/drivers/input/input.c
-+++ b/drivers/input/input.c
-@@ -1558,7 +1558,7 @@ EXPORT_SYMBOL(input_set_capability);
- */
- int input_register_device(struct input_dev *dev)
- {
-- static atomic_t input_no = ATOMIC_INIT(0);
-+ static atomic_unchecked_t input_no = ATOMIC_INIT(0);
- struct input_handler *handler;
- const char *path;
- int error;
-@@ -1585,7 +1585,7 @@ int input_register_device(struct input_dev *dev)
- dev->setkeycode = input_default_setkeycode;
-
- dev_set_name(&dev->dev, "input%ld",
-- (unsigned long) atomic_inc_return(&input_no) - 1);
-+ (unsigned long) atomic_inc_return_unchecked(&input_no) - 1);
-
- error = device_add(&dev->dev);
- if (error)
-diff --git a/drivers/input/joystick/sidewinder.c b/drivers/input/joystick/sidewinder.c
-index ca13a6b..b032b0c 100644
---- a/drivers/input/joystick/sidewinder.c
-+++ b/drivers/input/joystick/sidewinder.c
-@@ -30,6 +30,7 @@
- #include <linux/kernel.h>
- #include <linux/module.h>
- #include <linux/slab.h>
-+#include <linux/sched.h>
- #include <linux/init.h>
- #include <linux/input.h>
- #include <linux/gameport.h>
-@@ -428,6 +429,8 @@ static int sw_read(struct sw *sw)
- unsigned char buf[SW_LENGTH];
- int i;
-
-+ pax_track_stack();
-+
- i = sw_read_packet(sw->gameport, buf, sw->length, 0);
-
- if (sw->type == SW_ID_3DP && sw->length == 66 && i != 66) { /* Broken packet, try to fix */
-diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
-index 79e3edc..01412b9 100644
---- a/drivers/input/joystick/xpad.c
-+++ b/drivers/input/joystick/xpad.c
-@@ -621,7 +621,7 @@ static void xpad_led_set(struct led_classdev *led_cdev,
-
- static int xpad_led_probe(struct usb_xpad *xpad)
- {
-- static atomic_t led_seq = ATOMIC_INIT(0);
-+ static atomic_unchecked_t led_seq = ATOMIC_INIT(0);
- long led_no;
- struct xpad_led *led;
- struct led_classdev *led_cdev;
-@@ -634,7 +634,7 @@ static int xpad_led_probe(struct usb_xpad *xpad)
- if (!led)
- return -ENOMEM;
-
-- led_no = (long)atomic_inc_return(&led_seq) - 1;
-+ led_no = (long)atomic_inc_return_unchecked(&led_seq) - 1;
-
- snprintf(led->name, sizeof(led->name), "xpad%ld", led_no);
- led->xpad = xpad;
-diff --git a/drivers/input/serio/serio.c b/drivers/input/serio/serio.c
-index 0236f0d..c7327f1 100644
---- a/drivers/input/serio/serio.c
-+++ b/drivers/input/serio/serio.c
-@@ -527,7 +527,7 @@ static void serio_release_port(struct device *dev)
- */
- static void serio_init_port(struct serio *serio)
- {
-- static atomic_t serio_no = ATOMIC_INIT(0);
-+ static atomic_unchecked_t serio_no = ATOMIC_INIT(0);
-
- __module_get(THIS_MODULE);
-
-@@ -536,7 +536,7 @@ static void serio_init_port(struct serio *serio)
- mutex_init(&serio->drv_mutex);
- device_initialize(&serio->dev);
- dev_set_name(&serio->dev, "serio%ld",
-- (long)atomic_inc_return(&serio_no) - 1);
-+ (long)atomic_inc_return_unchecked(&serio_no) - 1);
- serio->dev.bus = &serio_bus;
- serio->dev.release = serio_release_port;
- if (serio->parent) {
-diff --git a/drivers/isdn/gigaset/common.c b/drivers/isdn/gigaset/common.c
-index 33dcd8d..2783d25 100644
---- a/drivers/isdn/gigaset/common.c
-+++ b/drivers/isdn/gigaset/common.c
-@@ -712,7 +712,7 @@ struct cardstate *gigaset_initcs(struct gigaset_driver *drv, int channels,
- cs->commands_pending = 0;
- cs->cur_at_seq = 0;
- cs->gotfwver = -1;
-- cs->open_count = 0;
-+ local_set(&cs->open_count, 0);
- cs->dev = NULL;
- cs->tty = NULL;
- cs->tty_dev = NULL;
-diff --git a/drivers/isdn/gigaset/gigaset.h b/drivers/isdn/gigaset/gigaset.h
-index a2f6125..6a70677 100644
---- a/drivers/isdn/gigaset/gigaset.h
-+++ b/drivers/isdn/gigaset/gigaset.h
-@@ -34,6 +34,7 @@
- #include <linux/tty_driver.h>
- #include <linux/list.h>
- #include <asm/atomic.h>
-+#include <asm/local.h>
-
- #define GIG_VERSION {0,5,0,0}
- #define GIG_COMPAT {0,4,0,0}
-@@ -446,7 +447,7 @@ struct cardstate {
- spinlock_t cmdlock;
- unsigned curlen, cmdbytes;
-
-- unsigned open_count;
-+ local_t open_count;
- struct tty_struct *tty;
- struct tasklet_struct if_wake_tasklet;
- unsigned control_state;
-diff --git a/drivers/isdn/gigaset/interface.c b/drivers/isdn/gigaset/interface.c
-index b3065b8..c7e8cc9 100644
---- a/drivers/isdn/gigaset/interface.c
-+++ b/drivers/isdn/gigaset/interface.c
-@@ -165,9 +165,7 @@ static int if_open(struct tty_struct *tty, struct file *filp)
- return -ERESTARTSYS; // FIXME -EINTR?
- tty->driver_data = cs;
-
-- ++cs->open_count;
--
-- if (cs->open_count == 1) {
-+ if (local_inc_return(&cs->open_count) == 1) {
- spin_lock_irqsave(&cs->lock, flags);
- cs->tty = tty;
- spin_unlock_irqrestore(&cs->lock, flags);
-@@ -195,10 +193,10 @@ static void if_close(struct tty_struct *tty, struct file *filp)
-
- if (!cs->connected)
- gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
-- else if (!cs->open_count)
-+ else if (!local_read(&cs->open_count))
- dev_warn(cs->dev, "%s: device not opened\n", __func__);
- else {
-- if (!--cs->open_count) {
-+ if (!local_dec_return(&cs->open_count)) {
- spin_lock_irqsave(&cs->lock, flags);
- cs->tty = NULL;
- spin_unlock_irqrestore(&cs->lock, flags);
-@@ -233,7 +231,7 @@ static int if_ioctl(struct tty_struct *tty, struct file *file,
- if (!cs->connected) {
- gig_dbg(DEBUG_IF, "not connected");
- retval = -ENODEV;
-- } else if (!cs->open_count)
-+ } else if (!local_read(&cs->open_count))
- dev_warn(cs->dev, "%s: device not opened\n", __func__);
- else {
- retval = 0;
-@@ -361,7 +359,7 @@ static int if_write(struct tty_struct *tty, const unsigned char *buf, int count)
- if (!cs->connected) {
- gig_dbg(DEBUG_IF, "not connected");
- retval = -ENODEV;
-- } else if (!cs->open_count)
-+ } else if (!local_read(&cs->open_count))
- dev_warn(cs->dev, "%s: device not opened\n", __func__);
- else if (cs->mstate != MS_LOCKED) {
- dev_warn(cs->dev, "can't write to unlocked device\n");
-@@ -395,7 +393,7 @@ static int if_write_room(struct tty_struct *tty)
- if (!cs->connected) {
- gig_dbg(DEBUG_IF, "not connected");
- retval = -ENODEV;
-- } else if (!cs->open_count)
-+ } else if (!local_read(&cs->open_count))
- dev_warn(cs->dev, "%s: device not opened\n", __func__);
- else if (cs->mstate != MS_LOCKED) {
- dev_warn(cs->dev, "can't write to unlocked device\n");
-@@ -425,7 +423,7 @@ static int if_chars_in_buffer(struct tty_struct *tty)
-
- if (!cs->connected)
- gig_dbg(DEBUG_IF, "not connected");
-- else if (!cs->open_count)
-+ else if (!local_read(&cs->open_count))
- dev_warn(cs->dev, "%s: device not opened\n", __func__);
- else if (cs->mstate != MS_LOCKED)
- dev_warn(cs->dev, "can't write to unlocked device\n");
-@@ -453,7 +451,7 @@ static void if_throttle(struct tty_struct *tty)
-
- if (!cs->connected)
- gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
-- else if (!cs->open_count)
-+ else if (!local_read(&cs->open_count))
- dev_warn(cs->dev, "%s: device not opened\n", __func__);
- else {
- //FIXME
-@@ -478,7 +476,7 @@ static void if_unthrottle(struct tty_struct *tty)
-
- if (!cs->connected)
- gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
-- else if (!cs->open_count)
-+ else if (!local_read(&cs->open_count))
- dev_warn(cs->dev, "%s: device not opened\n", __func__);
- else {
- //FIXME
-@@ -510,7 +508,7 @@ static void if_set_termios(struct tty_struct *tty, struct ktermios *old)
- goto out;
- }
-
-- if (!cs->open_count) {
-+ if (!local_read(&cs->open_count)) {
- dev_warn(cs->dev, "%s: device not opened\n", __func__);
- goto out;
- }
-diff --git a/drivers/isdn/hardware/avm/b1.c b/drivers/isdn/hardware/avm/b1.c
-index a7c0083..62a7cb6 100644
---- a/drivers/isdn/hardware/avm/b1.c
-+++ b/drivers/isdn/hardware/avm/b1.c
-@@ -173,7 +173,7 @@ int b1_load_t4file(avmcard *card, capiloaddatapart * t4file)
- }
- if (left) {
- if (t4file->user) {
-- if (copy_from_user(buf, dp, left))
-+ if (left > sizeof buf || copy_from_user(buf, dp, left))
- return -EFAULT;
- } else {
- memcpy(buf, dp, left);
-@@ -221,7 +221,7 @@ int b1_load_config(avmcard *card, capiloaddatapart * config)
- }
- if (left) {
- if (config->user) {
-- if (copy_from_user(buf, dp, left))
-+ if (left > sizeof buf || copy_from_user(buf, dp, left))
- return -EFAULT;
- } else {
- memcpy(buf, dp, left);
-diff --git a/drivers/isdn/hardware/eicon/capidtmf.c b/drivers/isdn/hardware/eicon/capidtmf.c
-index f130724..c373c68 100644
---- a/drivers/isdn/hardware/eicon/capidtmf.c
-+++ b/drivers/isdn/hardware/eicon/capidtmf.c
-@@ -498,6 +498,7 @@ void capidtmf_recv_block (t_capidtmf_state *p_state, byte *buffer, word leng
- byte goertzel_result_buffer[CAPIDTMF_RECV_TOTAL_FREQUENCY_COUNT];
- short windowed_sample_buffer[CAPIDTMF_RECV_WINDOWED_SAMPLES];
-
-+ pax_track_stack();
-
- if (p_state->recv.state & CAPIDTMF_RECV_STATE_DTMF_ACTIVE)
- {
-diff --git a/drivers/isdn/hardware/eicon/capifunc.c b/drivers/isdn/hardware/eicon/capifunc.c
-index 4d425c6..a9be6c4 100644
---- a/drivers/isdn/hardware/eicon/capifunc.c
-+++ b/drivers/isdn/hardware/eicon/capifunc.c
-@@ -1055,6 +1055,8 @@ static int divacapi_connect_didd(void)
- IDI_SYNC_REQ req;
- DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
-
-+ pax_track_stack();
-+
- DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
-
- for (x = 0; x < MAX_DESCRIPTORS; x++) {
-diff --git a/drivers/isdn/hardware/eicon/diddfunc.c b/drivers/isdn/hardware/eicon/diddfunc.c
-index 3029234..ef0d9e2 100644
---- a/drivers/isdn/hardware/eicon/diddfunc.c
-+++ b/drivers/isdn/hardware/eicon/diddfunc.c
-@@ -54,6 +54,8 @@ static int DIVA_INIT_FUNCTION connect_didd(void)
- IDI_SYNC_REQ req;
- DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
-
-+ pax_track_stack();
-+
- DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
-
- for (x = 0; x < MAX_DESCRIPTORS; x++) {
-diff --git a/drivers/isdn/hardware/eicon/divasfunc.c b/drivers/isdn/hardware/eicon/divasfunc.c
-index d36a4c0..11e7d1a 100644
---- a/drivers/isdn/hardware/eicon/divasfunc.c
-+++ b/drivers/isdn/hardware/eicon/divasfunc.c
-@@ -161,6 +161,8 @@ static int DIVA_INIT_FUNCTION connect_didd(void)
- IDI_SYNC_REQ req;
- DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
-
-+ pax_track_stack();
-+
- DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
-
- for (x = 0; x < MAX_DESCRIPTORS; x++) {
-diff --git a/drivers/isdn/hardware/eicon/idifunc.c b/drivers/isdn/hardware/eicon/idifunc.c
-index db87d51..7d09acf 100644
---- a/drivers/isdn/hardware/eicon/idifunc.c
-+++ b/drivers/isdn/hardware/eicon/idifunc.c
-@@ -188,6 +188,8 @@ static int DIVA_INIT_FUNCTION connect_didd(void)
- IDI_SYNC_REQ req;
- DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
-
-+ pax_track_stack();
-+
- DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
-
- for (x = 0; x < MAX_DESCRIPTORS; x++) {
-diff --git a/drivers/isdn/hardware/eicon/message.c b/drivers/isdn/hardware/eicon/message.c
-index ae89fb8..0fab299 100644
---- a/drivers/isdn/hardware/eicon/message.c
-+++ b/drivers/isdn/hardware/eicon/message.c
-@@ -4889,6 +4889,8 @@ static void sig_ind(PLCI *plci)
- dword d;
- word w;
-
-+ pax_track_stack();
-+
- a = plci->adapter;
- Id = ((word)plci->Id<<8)|a->Id;
- PUT_WORD(&SS_Ind[4],0x0000);
-@@ -7484,6 +7486,8 @@ static word add_b1(PLCI *plci, API_PARSE *bp, word b_channel_info,
- word j, n, w;
- dword d;
-
-+ pax_track_stack();
-+
-
- for(i=0;i<8;i++) bp_parms[i].length = 0;
- for(i=0;i<2;i++) global_config[i].length = 0;
-@@ -7958,6 +7962,8 @@ static word add_b23(PLCI *plci, API_PARSE *bp)
- const byte llc3[] = {4,3,2,2,6,6,0};
- const byte header[] = {0,2,3,3,0,0,0};
-
-+ pax_track_stack();
-+
- for(i=0;i<8;i++) bp_parms[i].length = 0;
- for(i=0;i<6;i++) b2_config_parms[i].length = 0;
- for(i=0;i<5;i++) b3_config_parms[i].length = 0;
-@@ -14761,6 +14767,8 @@ static void group_optimization(DIVA_CAPI_ADAPTER * a, PLCI * plci)
- word appl_number_group_type[MAX_APPL];
- PLCI *auxplci;
-
-+ pax_track_stack();
-+
- set_group_ind_mask (plci); /* all APPLs within this inc. call are allowed to dial in */
-
- if(!a->group_optimization_enabled)
-diff --git a/drivers/isdn/hardware/eicon/mntfunc.c b/drivers/isdn/hardware/eicon/mntfunc.c
-index a564b75..f3cf8b5 100644
---- a/drivers/isdn/hardware/eicon/mntfunc.c
-+++ b/drivers/isdn/hardware/eicon/mntfunc.c
-@@ -79,6 +79,8 @@ static int DIVA_INIT_FUNCTION connect_didd(void)
- IDI_SYNC_REQ req;
- DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
-
-+ pax_track_stack();
-+
- DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
-
- for (x = 0; x < MAX_DESCRIPTORS; x++) {
-diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
-index adb1e8c..21b590b 100644
---- a/drivers/isdn/i4l/isdn_common.c
-+++ b/drivers/isdn/i4l/isdn_common.c
-@@ -1290,6 +1290,8 @@ isdn_ioctl(struct inode *inode, struct file *file, uint cmd, ulong arg)
- } iocpar;
- void __user *argp = (void __user *)arg;
-
-+ pax_track_stack();
-+
- #define name iocpar.name
- #define bname iocpar.bname
- #define iocts iocpar.iocts
-diff --git a/drivers/isdn/i4l/isdn_net.c b/drivers/isdn/i4l/isdn_net.c
-index 90b56ed..5ed3305 100644
---- a/drivers/isdn/i4l/isdn_net.c
-+++ b/drivers/isdn/i4l/isdn_net.c
-@@ -1902,7 +1902,7 @@ static int isdn_net_header(struct sk_buff *skb, struct net_device *dev,
- {
- isdn_net_local *lp = netdev_priv(dev);
- unsigned char *p;
-- ushort len = 0;
-+ int len = 0;
-
- switch (lp->p_encap) {
- case ISDN_NET_ENCAP_ETHER:
-diff --git a/drivers/isdn/icn/icn.c b/drivers/isdn/icn/icn.c
-index bf7997a..cf091db 100644
---- a/drivers/isdn/icn/icn.c
-+++ b/drivers/isdn/icn/icn.c
-@@ -1044,7 +1044,7 @@ icn_writecmd(const u_char * buf, int len, int user, icn_card * card)
- if (count > len)
- count = len;
- if (user) {
-- if (copy_from_user(msg, buf, count))
-+ if (count > sizeof msg || copy_from_user(msg, buf, count))
- return -EFAULT;
- } else
- memcpy(msg, buf, count);
-diff --git a/drivers/isdn/mISDN/socket.c b/drivers/isdn/mISDN/socket.c
-index feb0fa4..f76f830 100644
---- a/drivers/isdn/mISDN/socket.c
-+++ b/drivers/isdn/mISDN/socket.c
-@@ -391,6 +391,7 @@ data_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
- if (dev) {
- struct mISDN_devinfo di;
-
-+ memset(&di, 0, sizeof(di));
- di.id = dev->id;
- di.Dprotocols = dev->Dprotocols;
- di.Bprotocols = dev->Bprotocols | get_all_Bprotocols();
-@@ -671,6 +672,7 @@ base_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
- if (dev) {
- struct mISDN_devinfo di;
-
-+ memset(&di, 0, sizeof(di));
- di.id = dev->id;
- di.Dprotocols = dev->Dprotocols;
- di.Bprotocols = dev->Bprotocols | get_all_Bprotocols();
-diff --git a/drivers/isdn/sc/interrupt.c b/drivers/isdn/sc/interrupt.c
-index 485be8b..f0225bc 100644
---- a/drivers/isdn/sc/interrupt.c
-+++ b/drivers/isdn/sc/interrupt.c
-@@ -112,11 +112,19 @@ irqreturn_t interrupt_handler(int dummy, void *card_inst)
- }
- else if(callid>=0x0000 && callid<=0x7FFF)
- {
-+ int len;
-+
- pr_debug("%s: Got Incoming Call\n",
- sc_adapter[card]->devicename);
-- strcpy(setup.phone,&(rcvmsg.msg_data.byte_array[4]));
-- strcpy(setup.eazmsn,
-- sc_adapter[card]->channel[rcvmsg.phy_link_no-1].dn);
-+ len = strlcpy(setup.phone, &(rcvmsg.msg_data.byte_array[4]),
-+ sizeof(setup.phone));
-+ if (len >= sizeof(setup.phone))
-+ continue;
-+ len = strlcpy(setup.eazmsn,
-+ sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn,
-+ sizeof(setup.eazmsn));
-+ if (len >= sizeof(setup.eazmsn))
-+ continue;
- setup.si1 = 7;
- setup.si2 = 0;
- setup.plan = 0;
-@@ -176,7 +184,9 @@ irqreturn_t interrupt_handler(int dummy, void *card_inst)
- * Handle a GetMyNumber Rsp
- */
- if (IS_CE_MESSAGE(rcvmsg,Call,0,GetMyNumber)){
-- strcpy(sc_adapter[card]->channel[rcvmsg.phy_link_no-1].dn,rcvmsg.msg_data.byte_array);
-+ strlcpy(sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn,
-+ rcvmsg.msg_data.byte_array,
-+ sizeof(rcvmsg.msg_data.byte_array));
- continue;
- }
-
-diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c
-index 8744d24..d1f9a9a 100644
---- a/drivers/lguest/core.c
-+++ b/drivers/lguest/core.c
-@@ -91,9 +91,17 @@ static __init int map_switcher(void)
- * it's worked so far. The end address needs +1 because __get_vm_area
- * allocates an extra guard page, so we need space for that.
- */
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
-+ VM_ALLOC | VM_KERNEXEC, SWITCHER_ADDR, SWITCHER_ADDR
-+ + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
-+#else
- switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
- VM_ALLOC, SWITCHER_ADDR, SWITCHER_ADDR
- + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
-+#endif
-+
- if (!switcher_vma) {
- err = -ENOMEM;
- printk("lguest: could not map switcher pages high\n");
-@@ -118,7 +126,7 @@ static __init int map_switcher(void)
- * Now the Switcher is mapped at the right address, we can't fail!
- * Copy in the compiled-in Switcher code (from <arch>_switcher.S).
- */
-- memcpy(switcher_vma->addr, start_switcher_text,
-+ memcpy(switcher_vma->addr, ktla_ktva(start_switcher_text),
- end_switcher_text - start_switcher_text);
-
- printk(KERN_INFO "lguest: mapped switcher at %p\n",
-diff --git a/drivers/lguest/x86/core.c b/drivers/lguest/x86/core.c
-index 6ae3888..8b38145 100644
---- a/drivers/lguest/x86/core.c
-+++ b/drivers/lguest/x86/core.c
-@@ -59,7 +59,7 @@ static struct {
- /* Offset from where switcher.S was compiled to where we've copied it */
- static unsigned long switcher_offset(void)
- {
-- return SWITCHER_ADDR - (unsigned long)start_switcher_text;
-+ return SWITCHER_ADDR - (unsigned long)ktla_ktva(start_switcher_text);
- }
-
- /* This cpu's struct lguest_pages. */
-@@ -100,7 +100,13 @@ static void copy_in_guest_info(struct lg_cpu *cpu, struct lguest_pages *pages)
- * These copies are pretty cheap, so we do them unconditionally: */
- /* Save the current Host top-level page directory.
- */
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ pages->state.host_cr3 = read_cr3();
-+#else
- pages->state.host_cr3 = __pa(current->mm->pgd);
-+#endif
-+
- /*
- * Set up the Guest's page tables to see this CPU's pages (and no
- * other CPU's pages).
-@@ -535,7 +541,7 @@ void __init lguest_arch_host_init(void)
- * compiled-in switcher code and the high-mapped copy we just made.
- */
- for (i = 0; i < IDT_ENTRIES; i++)
-- default_idt_entries[i] += switcher_offset();
-+ default_idt_entries[i] = ktla_ktva(default_idt_entries[i]) + switcher_offset();
-
- /*
- * Set up the Switcher's per-cpu areas.
-@@ -618,7 +624,7 @@ void __init lguest_arch_host_init(void)
- * it will be undisturbed when we switch. To change %cs and jump we
- * need this structure to feed to Intel's "lcall" instruction.
- */
-- lguest_entry.offset = (long)switch_to_guest + switcher_offset();
-+ lguest_entry.offset = (long)ktla_ktva(switch_to_guest) + switcher_offset();
- lguest_entry.segment = LGUEST_CS;
-
- /*
-diff --git a/drivers/lguest/x86/switcher_32.S b/drivers/lguest/x86/switcher_32.S
-index 40634b0..4f5855e 100644
---- a/drivers/lguest/x86/switcher_32.S
-+++ b/drivers/lguest/x86/switcher_32.S
-@@ -87,6 +87,7 @@
- #include <asm/page.h>
- #include <asm/segment.h>
- #include <asm/lguest.h>
-+#include <asm/processor-flags.h>
-
- // We mark the start of the code to copy
- // It's placed in .text tho it's never run here
-@@ -149,6 +150,13 @@ ENTRY(switch_to_guest)
- // Changes type when we load it: damn Intel!
- // For after we switch over our page tables
- // That entry will be read-only: we'd crash.
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ mov %cr0, %edx
-+ xor $X86_CR0_WP, %edx
-+ mov %edx, %cr0
-+#endif
-+
- movl $(GDT_ENTRY_TSS*8), %edx
- ltr %dx
-
-@@ -157,9 +165,15 @@ ENTRY(switch_to_guest)
- // Let's clear it again for our return.
- // The GDT descriptor of the Host
- // Points to the table after two "size" bytes
-- movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %edx
-+ movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %eax
- // Clear "used" from type field (byte 5, bit 2)
-- andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%edx)
-+ andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%eax)
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ mov %cr0, %eax
-+ xor $X86_CR0_WP, %eax
-+ mov %eax, %cr0
-+#endif
-
- // Once our page table's switched, the Guest is live!
- // The Host fades as we run this final step.
-@@ -295,13 +309,12 @@ deliver_to_host:
- // I consulted gcc, and it gave
- // These instructions, which I gladly credit:
- leal (%edx,%ebx,8), %eax
-- movzwl (%eax),%edx
-- movl 4(%eax), %eax
-- xorw %ax, %ax
-- orl %eax, %edx
-+ movl 4(%eax), %edx
-+ movw (%eax), %dx
- // Now the address of the handler's in %edx
- // We call it now: its "iret" drops us home.
-- jmp *%edx
-+ ljmp $__KERNEL_CS, $1f
-+1: jmp *%edx
-
- // Every interrupt can come to us here
- // But we must truly tell each apart.
-diff --git a/drivers/macintosh/macio_asic.c b/drivers/macintosh/macio_asic.c
-index 588a5b0..b71db89 100644
---- a/drivers/macintosh/macio_asic.c
-+++ b/drivers/macintosh/macio_asic.c
-@@ -701,7 +701,7 @@ static void __devexit macio_pci_remove(struct pci_dev* pdev)
- * MacIO is matched against any Apple ID, it's probe() function
- * will then decide wether it applies or not
- */
--static const struct pci_device_id __devinitdata pci_ids [] = { {
-+static const struct pci_device_id __devinitconst pci_ids [] = { {
- .vendor = PCI_VENDOR_ID_APPLE,
- .device = PCI_ANY_ID,
- .subvendor = PCI_ANY_ID,
-diff --git a/drivers/macintosh/via-pmu-backlight.c b/drivers/macintosh/via-pmu-backlight.c
-index a348bb0..ecd9b3f 100644
---- a/drivers/macintosh/via-pmu-backlight.c
-+++ b/drivers/macintosh/via-pmu-backlight.c
-@@ -15,7 +15,7 @@
-
- #define MAX_PMU_LEVEL 0xFF
-
--static struct backlight_ops pmu_backlight_data;
-+static const struct backlight_ops pmu_backlight_data;
- static DEFINE_SPINLOCK(pmu_backlight_lock);
- static int sleeping, uses_pmu_bl;
- static u8 bl_curve[FB_BACKLIGHT_LEVELS];
-@@ -115,7 +115,7 @@ static int pmu_backlight_get_brightness(struct backlight_device *bd)
- return bd->props.brightness;
- }
-
--static struct backlight_ops pmu_backlight_data = {
-+static const struct backlight_ops pmu_backlight_data = {
- .get_brightness = pmu_backlight_get_brightness,
- .update_status = pmu_backlight_update_status,
-
-diff --git a/drivers/macintosh/via-pmu.c b/drivers/macintosh/via-pmu.c
-index 6f308a4..b5f7ff7 100644
---- a/drivers/macintosh/via-pmu.c
-+++ b/drivers/macintosh/via-pmu.c
-@@ -2232,7 +2232,7 @@ static int pmu_sleep_valid(suspend_state_t state)
- && (pmac_call_feature(PMAC_FTR_SLEEP_STATE, NULL, 0, -1) >= 0);
- }
-
--static struct platform_suspend_ops pmu_pm_ops = {
-+static const struct platform_suspend_ops pmu_pm_ops = {
- .enter = powerbook_sleep,
- .valid = pmu_sleep_valid,
- };
-diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
-index 818b617..4656e38 100644
---- a/drivers/md/dm-ioctl.c
-+++ b/drivers/md/dm-ioctl.c
-@@ -1437,7 +1437,7 @@ static int validate_params(uint cmd, struct dm_ioctl *param)
- cmd == DM_LIST_VERSIONS_CMD)
- return 0;
-
-- if ((cmd == DM_DEV_CREATE_CMD)) {
-+ if (cmd == DM_DEV_CREATE_CMD) {
- if (!*param->name) {
- DMWARN("name not supplied when creating device");
- return -EINVAL;
-diff --git a/drivers/md/dm-log-userspace-transfer.c b/drivers/md/dm-log-userspace-transfer.c
-index f1c8cae..59f0822 100644
---- a/drivers/md/dm-log-userspace-transfer.c
-+++ b/drivers/md/dm-log-userspace-transfer.c
-@@ -133,7 +133,7 @@ static void cn_ulog_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
- {
- struct dm_ulog_request *tfr = (struct dm_ulog_request *)(msg + 1);
-
-- if (!cap_raised(nsp->eff_cap, CAP_SYS_ADMIN))
-+ if (!capable(CAP_SYS_ADMIN))
- return;
-
- spin_lock(&receiving_list_lock);
-diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
-index 6021d0a..a878643 100644
---- a/drivers/md/dm-raid1.c
-+++ b/drivers/md/dm-raid1.c
-@@ -41,7 +41,7 @@ enum dm_raid1_error {
-
- struct mirror {
- struct mirror_set *ms;
-- atomic_t error_count;
-+ atomic_unchecked_t error_count;
- unsigned long error_type;
- struct dm_dev *dev;
- sector_t offset;
-@@ -203,7 +203,7 @@ static void fail_mirror(struct mirror *m, enum dm_raid1_error error_type)
- * simple way to tell if a device has encountered
- * errors.
- */
-- atomic_inc(&m->error_count);
-+ atomic_inc_unchecked(&m->error_count);
-
- if (test_and_set_bit(error_type, &m->error_type))
- return;
-@@ -225,7 +225,7 @@ static void fail_mirror(struct mirror *m, enum dm_raid1_error error_type)
- }
-
- for (new = ms->mirror; new < ms->mirror + ms->nr_mirrors; new++)
-- if (!atomic_read(&new->error_count)) {
-+ if (!atomic_read_unchecked(&new->error_count)) {
- set_default_mirror(new);
- break;
- }
-@@ -363,7 +363,7 @@ static struct mirror *choose_mirror(struct mirror_set *ms, sector_t sector)
- struct mirror *m = get_default_mirror(ms);
-
- do {
-- if (likely(!atomic_read(&m->error_count)))
-+ if (likely(!atomic_read_unchecked(&m->error_count)))
- return m;
-
- if (m-- == ms->mirror)
-@@ -377,7 +377,7 @@ static int default_ok(struct mirror *m)
- {
- struct mirror *default_mirror = get_default_mirror(m->ms);
-
-- return !atomic_read(&default_mirror->error_count);
-+ return !atomic_read_unchecked(&default_mirror->error_count);
- }
-
- static int mirror_available(struct mirror_set *ms, struct bio *bio)
-@@ -484,7 +484,7 @@ static void do_reads(struct mirror_set *ms, struct bio_list *reads)
- */
- if (likely(region_in_sync(ms, region, 1)))
- m = choose_mirror(ms, bio->bi_sector);
-- else if (m && atomic_read(&m->error_count))
-+ else if (m && atomic_read_unchecked(&m->error_count))
- m = NULL;
-
- if (likely(m))
-@@ -855,7 +855,7 @@ static int get_mirror(struct mirror_set *ms, struct dm_target *ti,
- }
-
- ms->mirror[mirror].ms = ms;
-- atomic_set(&(ms->mirror[mirror].error_count), 0);
-+ atomic_set_unchecked(&(ms->mirror[mirror].error_count), 0);
- ms->mirror[mirror].error_type = 0;
- ms->mirror[mirror].offset = offset;
-
-@@ -1241,7 +1241,7 @@ static void mirror_resume(struct dm_target *ti)
- */
- static char device_status_char(struct mirror *m)
- {
-- if (!atomic_read(&(m->error_count)))
-+ if (!atomic_read_unchecked(&(m->error_count)))
- return 'A';
-
- return (test_bit(DM_RAID1_WRITE_ERROR, &(m->error_type))) ? 'D' :
-diff --git a/drivers/md/dm-stripe.c b/drivers/md/dm-stripe.c
-index bd58703..9f26571 100644
---- a/drivers/md/dm-stripe.c
-+++ b/drivers/md/dm-stripe.c
-@@ -20,7 +20,7 @@ struct stripe {
- struct dm_dev *dev;
- sector_t physical_start;
-
-- atomic_t error_count;
-+ atomic_unchecked_t error_count;
- };
-
- struct stripe_c {
-@@ -188,7 +188,7 @@ static int stripe_ctr(struct dm_target *ti, unsigned int argc, char **argv)
- kfree(sc);
- return r;
- }
-- atomic_set(&(sc->stripe[i].error_count), 0);
-+ atomic_set_unchecked(&(sc->stripe[i].error_count), 0);
- }
-
- ti->private = sc;
-@@ -257,7 +257,7 @@ static int stripe_status(struct dm_target *ti,
- DMEMIT("%d ", sc->stripes);
- for (i = 0; i < sc->stripes; i++) {
- DMEMIT("%s ", sc->stripe[i].dev->name);
-- buffer[i] = atomic_read(&(sc->stripe[i].error_count)) ?
-+ buffer[i] = atomic_read_unchecked(&(sc->stripe[i].error_count)) ?
- 'D' : 'A';
- }
- buffer[i] = '\0';
-@@ -304,8 +304,8 @@ static int stripe_end_io(struct dm_target *ti, struct bio *bio,
- */
- for (i = 0; i < sc->stripes; i++)
- if (!strcmp(sc->stripe[i].dev->name, major_minor)) {
-- atomic_inc(&(sc->stripe[i].error_count));
-- if (atomic_read(&(sc->stripe[i].error_count)) <
-+ atomic_inc_unchecked(&(sc->stripe[i].error_count));
-+ if (atomic_read_unchecked(&(sc->stripe[i].error_count)) <
- DM_IO_ERROR_THRESHOLD)
- queue_work(kstriped, &sc->kstriped_ws);
- }
-diff --git a/drivers/md/dm-sysfs.c b/drivers/md/dm-sysfs.c
-index 4b04590..13a77b2 100644
---- a/drivers/md/dm-sysfs.c
-+++ b/drivers/md/dm-sysfs.c
-@@ -75,7 +75,7 @@ static struct attribute *dm_attrs[] = {
- NULL,
- };
-
--static struct sysfs_ops dm_sysfs_ops = {
-+static const struct sysfs_ops dm_sysfs_ops = {
- .show = dm_attr_show,
- };
-
-diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
-index 03345bb..332250d 100644
---- a/drivers/md/dm-table.c
-+++ b/drivers/md/dm-table.c
-@@ -376,7 +376,7 @@ static int device_area_is_invalid(struct dm_target *ti, struct dm_dev *dev,
- if (!dev_size)
- return 0;
-
-- if ((start >= dev_size) || (start + len > dev_size)) {
-+ if ((start >= dev_size) || (len > dev_size - start)) {
- DMWARN("%s: %s too small for target: "
- "start=%llu, len=%llu, dev_size=%llu",
- dm_device_name(ti->table->md), bdevname(bdev, b),
-diff --git a/drivers/md/dm.c b/drivers/md/dm.c
-index c988ac2..c418141 100644
---- a/drivers/md/dm.c
-+++ b/drivers/md/dm.c
-@@ -165,9 +165,9 @@ struct mapped_device {
- /*
- * Event handling.
- */
-- atomic_t event_nr;
-+ atomic_unchecked_t event_nr;
- wait_queue_head_t eventq;
-- atomic_t uevent_seq;
-+ atomic_unchecked_t uevent_seq;
- struct list_head uevent_list;
- spinlock_t uevent_lock; /* Protect access to uevent_list */
-
-@@ -1776,8 +1776,8 @@ static struct mapped_device *alloc_dev(int minor)
- rwlock_init(&md->map_lock);
- atomic_set(&md->holders, 1);
- atomic_set(&md->open_count, 0);
-- atomic_set(&md->event_nr, 0);
-- atomic_set(&md->uevent_seq, 0);
-+ atomic_set_unchecked(&md->event_nr, 0);
-+ atomic_set_unchecked(&md->uevent_seq, 0);
- INIT_LIST_HEAD(&md->uevent_list);
- spin_lock_init(&md->uevent_lock);
-
-@@ -1927,7 +1927,7 @@ static void event_callback(void *context)
-
- dm_send_uevents(&uevents, &disk_to_dev(md->disk)->kobj);
-
-- atomic_inc(&md->event_nr);
-+ atomic_inc_unchecked(&md->event_nr);
- wake_up(&md->eventq);
- }
-
-@@ -2562,18 +2562,18 @@ void dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
-
- uint32_t dm_next_uevent_seq(struct mapped_device *md)
- {
-- return atomic_add_return(1, &md->uevent_seq);
-+ return atomic_add_return_unchecked(1, &md->uevent_seq);
- }
-
- uint32_t dm_get_event_nr(struct mapped_device *md)
- {
-- return atomic_read(&md->event_nr);
-+ return atomic_read_unchecked(&md->event_nr);
- }
-
- int dm_wait_event(struct mapped_device *md, int event_nr)
- {
- return wait_event_interruptible(md->eventq,
-- (event_nr != atomic_read(&md->event_nr)));
-+ (event_nr != atomic_read_unchecked(&md->event_nr)));
- }
-
- void dm_uevent_add(struct mapped_device *md, struct list_head *elist)
-diff --git a/drivers/md/md.c b/drivers/md/md.c
-index 4ce6e2f..7a9530a 100644
---- a/drivers/md/md.c
-+++ b/drivers/md/md.c
-@@ -153,10 +153,10 @@ static int start_readonly;
- * start build, activate spare
- */
- static DECLARE_WAIT_QUEUE_HEAD(md_event_waiters);
--static atomic_t md_event_count;
-+static atomic_unchecked_t md_event_count;
- void md_new_event(mddev_t *mddev)
- {
-- atomic_inc(&md_event_count);
-+ atomic_inc_unchecked(&md_event_count);
- wake_up(&md_event_waiters);
- }
- EXPORT_SYMBOL_GPL(md_new_event);
-@@ -166,7 +166,7 @@ EXPORT_SYMBOL_GPL(md_new_event);
- */
- static void md_new_event_inintr(mddev_t *mddev)
- {
-- atomic_inc(&md_event_count);
-+ atomic_inc_unchecked(&md_event_count);
- wake_up(&md_event_waiters);
- }
-
-@@ -1226,7 +1226,7 @@ static int super_1_load(mdk_rdev_t *rdev, mdk_rdev_t *refdev, int minor_version)
-
- rdev->preferred_minor = 0xffff;
- rdev->data_offset = le64_to_cpu(sb->data_offset);
-- atomic_set(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
-+ atomic_set_unchecked(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
-
- rdev->sb_size = le32_to_cpu(sb->max_dev) * 2 + 256;
- bmask = queue_logical_block_size(rdev->bdev->bd_disk->queue)-1;
-@@ -1400,7 +1400,7 @@ static void super_1_sync(mddev_t *mddev, mdk_rdev_t *rdev)
- else
- sb->resync_offset = cpu_to_le64(0);
-
-- sb->cnt_corrected_read = cpu_to_le32(atomic_read(&rdev->corrected_errors));
-+ sb->cnt_corrected_read = cpu_to_le32(atomic_read_unchecked(&rdev->corrected_errors));
-
- sb->raid_disks = cpu_to_le32(mddev->raid_disks);
- sb->size = cpu_to_le64(mddev->dev_sectors);
-@@ -2222,7 +2222,7 @@ __ATTR(state, S_IRUGO|S_IWUSR, state_show, state_store);
- static ssize_t
- errors_show(mdk_rdev_t *rdev, char *page)
- {
-- return sprintf(page, "%d\n", atomic_read(&rdev->corrected_errors));
-+ return sprintf(page, "%d\n", atomic_read_unchecked(&rdev->corrected_errors));
- }
-
- static ssize_t
-@@ -2231,7 +2231,7 @@ errors_store(mdk_rdev_t *rdev, const char *buf, size_t len)
- char *e;
- unsigned long n = simple_strtoul(buf, &e, 10);
- if (*buf && (*e == 0 || *e == '\n')) {
-- atomic_set(&rdev->corrected_errors, n);
-+ atomic_set_unchecked(&rdev->corrected_errors, n);
- return len;
- }
- return -EINVAL;
-@@ -2525,7 +2525,7 @@ static void rdev_free(struct kobject *ko)
- mdk_rdev_t *rdev = container_of(ko, mdk_rdev_t, kobj);
- kfree(rdev);
- }
--static struct sysfs_ops rdev_sysfs_ops = {
-+static const struct sysfs_ops rdev_sysfs_ops = {
- .show = rdev_attr_show,
- .store = rdev_attr_store,
- };
-@@ -2574,8 +2574,8 @@ static mdk_rdev_t *md_import_device(dev_t newdev, int super_format, int super_mi
- rdev->data_offset = 0;
- rdev->sb_events = 0;
- atomic_set(&rdev->nr_pending, 0);
-- atomic_set(&rdev->read_errors, 0);
-- atomic_set(&rdev->corrected_errors, 0);
-+ atomic_set_unchecked(&rdev->read_errors, 0);
-+ atomic_set_unchecked(&rdev->corrected_errors, 0);
-
- size = rdev->bdev->bd_inode->i_size >> BLOCK_SIZE_BITS;
- if (!size) {
-@@ -3895,7 +3895,7 @@ static void md_free(struct kobject *ko)
- kfree(mddev);
- }
-
--static struct sysfs_ops md_sysfs_ops = {
-+static const struct sysfs_ops md_sysfs_ops = {
- .show = md_attr_show,
- .store = md_attr_store,
- };
-@@ -4482,7 +4482,8 @@ out:
- err = 0;
- blk_integrity_unregister(disk);
- md_new_event(mddev);
-- sysfs_notify_dirent(mddev->sysfs_state);
-+ if (mddev->sysfs_state)
-+ sysfs_notify_dirent(mddev->sysfs_state);
- return err;
- }
-
-@@ -5962,7 +5963,7 @@ static int md_seq_show(struct seq_file *seq, void *v)
-
- spin_unlock(&pers_lock);
- seq_printf(seq, "\n");
-- mi->event = atomic_read(&md_event_count);
-+ mi->event = atomic_read_unchecked(&md_event_count);
- return 0;
- }
- if (v == (void*)2) {
-@@ -6051,7 +6052,7 @@ static int md_seq_show(struct seq_file *seq, void *v)
- chunk_kb ? "KB" : "B");
- if (bitmap->file) {
- seq_printf(seq, ", file: ");
-- seq_path(seq, &bitmap->file->f_path, " \t\n");
-+ seq_path(seq, &bitmap->file->f_path, " \t\n\\");
- }
-
- seq_printf(seq, "\n");
-@@ -6085,7 +6086,7 @@ static int md_seq_open(struct inode *inode, struct file *file)
- else {
- struct seq_file *p = file->private_data;
- p->private = mi;
-- mi->event = atomic_read(&md_event_count);
-+ mi->event = atomic_read_unchecked(&md_event_count);
- }
- return error;
- }
-@@ -6101,7 +6102,7 @@ static unsigned int mdstat_poll(struct file *filp, poll_table *wait)
- /* always allow read */
- mask = POLLIN | POLLRDNORM;
-
-- if (mi->event != atomic_read(&md_event_count))
-+ if (mi->event != atomic_read_unchecked(&md_event_count))
- mask |= POLLERR | POLLPRI;
- return mask;
- }
-@@ -6145,7 +6146,7 @@ static int is_mddev_idle(mddev_t *mddev, int init)
- struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
- curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
- (int)part_stat_read(&disk->part0, sectors[1]) -
-- atomic_read(&disk->sync_io);
-+ atomic_read_unchecked(&disk->sync_io);
- /* sync IO will cause sync_io to increase before the disk_stats
- * as sync_io is counted when a request starts, and
- * disk_stats is counted when it completes.
-diff --git a/drivers/md/md.h b/drivers/md/md.h
-index 87430fe..0024a4c 100644
---- a/drivers/md/md.h
-+++ b/drivers/md/md.h
-@@ -94,10 +94,10 @@ struct mdk_rdev_s
- * only maintained for arrays that
- * support hot removal
- */
-- atomic_t read_errors; /* number of consecutive read errors that
-+ atomic_unchecked_t read_errors; /* number of consecutive read errors that
- * we have tried to ignore.
- */
-- atomic_t corrected_errors; /* number of corrected read errors,
-+ atomic_unchecked_t corrected_errors; /* number of corrected read errors,
- * for reporting to userspace and storing
- * in superblock.
- */
-@@ -304,7 +304,7 @@ static inline void rdev_dec_pending(mdk_rdev_t *rdev, mddev_t *mddev)
-
- static inline void md_sync_acct(struct block_device *bdev, unsigned long nr_sectors)
- {
-- atomic_add(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
-+ atomic_add_unchecked(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
- }
-
- struct mdk_personality
-diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
-index 968cb14..f0ad2e4 100644
---- a/drivers/md/raid1.c
-+++ b/drivers/md/raid1.c
-@@ -1415,7 +1415,7 @@ static void sync_request_write(mddev_t *mddev, r1bio_t *r1_bio)
- if (r1_bio->bios[d]->bi_end_io != end_sync_read)
- continue;
- rdev = conf->mirrors[d].rdev;
-- atomic_add(s, &rdev->corrected_errors);
-+ atomic_add_unchecked(s, &rdev->corrected_errors);
- if (sync_page_io(rdev->bdev,
- sect + rdev->data_offset,
- s<<9,
-@@ -1564,7 +1564,7 @@ static void fix_read_error(conf_t *conf, int read_disk,
- /* Well, this device is dead */
- md_error(mddev, rdev);
- else {
-- atomic_add(s, &rdev->corrected_errors);
-+ atomic_add_unchecked(s, &rdev->corrected_errors);
- printk(KERN_INFO
- "raid1:%s: read error corrected "
- "(%d sectors at %llu on %s)\n",
-diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
-index 1b4e232..cf0f534b 100644
---- a/drivers/md/raid10.c
-+++ b/drivers/md/raid10.c
-@@ -1255,7 +1255,7 @@ static void end_sync_read(struct bio *bio, int error)
- if (test_bit(BIO_UPTODATE, &bio->bi_flags))
- set_bit(R10BIO_Uptodate, &r10_bio->state);
- else {
-- atomic_add(r10_bio->sectors,
-+ atomic_add_unchecked(r10_bio->sectors,
- &conf->mirrors[d].rdev->corrected_errors);
- if (!test_bit(MD_RECOVERY_SYNC, &conf->mddev->recovery))
- md_error(r10_bio->mddev,
-@@ -1520,7 +1520,7 @@ static void fix_read_error(conf_t *conf, mddev_t *mddev, r10bio_t *r10_bio)
- test_bit(In_sync, &rdev->flags)) {
- atomic_inc(&rdev->nr_pending);
- rcu_read_unlock();
-- atomic_add(s, &rdev->corrected_errors);
-+ atomic_add_unchecked(s, &rdev->corrected_errors);
- if (sync_page_io(rdev->bdev,
- r10_bio->devs[sl].addr +
- sect + rdev->data_offset,
-diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
-index 883215d..675bf47 100644
---- a/drivers/md/raid5.c
-+++ b/drivers/md/raid5.c
-@@ -482,7 +482,7 @@ static void ops_run_io(struct stripe_head *sh, struct stripe_head_state *s)
- bi->bi_next = NULL;
- if ((rw & WRITE) &&
- test_bit(R5_ReWrite, &sh->dev[i].flags))
-- atomic_add(STRIPE_SECTORS,
-+ atomic_add_unchecked(STRIPE_SECTORS,
- &rdev->corrected_errors);
- generic_make_request(bi);
- } else {
-@@ -1517,15 +1517,15 @@ static void raid5_end_read_request(struct bio * bi, int error)
- clear_bit(R5_ReadError, &sh->dev[i].flags);
- clear_bit(R5_ReWrite, &sh->dev[i].flags);
- }
-- if (atomic_read(&conf->disks[i].rdev->read_errors))
-- atomic_set(&conf->disks[i].rdev->read_errors, 0);
-+ if (atomic_read_unchecked(&conf->disks[i].rdev->read_errors))
-+ atomic_set_unchecked(&conf->disks[i].rdev->read_errors, 0);
- } else {
- const char *bdn = bdevname(conf->disks[i].rdev->bdev, b);
- int retry = 0;
- rdev = conf->disks[i].rdev;
-
- clear_bit(R5_UPTODATE, &sh->dev[i].flags);
-- atomic_inc(&rdev->read_errors);
-+ atomic_inc_unchecked(&rdev->read_errors);
- if (conf->mddev->degraded >= conf->max_degraded)
- printk_rl(KERN_WARNING
- "raid5:%s: read error not correctable "
-@@ -1543,7 +1543,7 @@ static void raid5_end_read_request(struct bio * bi, int error)
- (unsigned long long)(sh->sector
- + rdev->data_offset),
- bdn);
-- else if (atomic_read(&rdev->read_errors)
-+ else if (atomic_read_unchecked(&rdev->read_errors)
- > conf->max_nr_stripes)
- printk(KERN_WARNING
- "raid5:%s: Too many read errors, failing device %s.\n",
-@@ -1870,6 +1870,7 @@ static sector_t compute_blocknr(struct stripe_head *sh, int i, int previous)
- sector_t r_sector;
- struct stripe_head sh2;
-
-+ pax_track_stack();
-
- chunk_offset = sector_div(new_sector, sectors_per_chunk);
- stripe = new_sector;
-diff --git a/drivers/media/common/saa7146_hlp.c b/drivers/media/common/saa7146_hlp.c
-index 05bde9c..2f31d40 100644
---- a/drivers/media/common/saa7146_hlp.c
-+++ b/drivers/media/common/saa7146_hlp.c
-@@ -353,6 +353,8 @@ static void calculate_clipping_registers_rect(struct saa7146_dev *dev, struct sa
-
- int x[32], y[32], w[32], h[32];
-
-+ pax_track_stack();
-+
- /* clear out memory */
- memset(&line_list[0], 0x00, sizeof(u32)*32);
- memset(&pixel_list[0], 0x00, sizeof(u32)*32);
-diff --git a/drivers/media/dvb/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
-index cb22da5..82b686e 100644
---- a/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
-+++ b/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
-@@ -590,6 +590,8 @@ static int dvb_ca_en50221_read_data(struct dvb_ca_private *ca, int slot, u8 * eb
- u8 buf[HOST_LINK_BUF_SIZE];
- int i;
-
-+ pax_track_stack();
-+
- dprintk("%s\n", __func__);
-
- /* check if we have space for a link buf in the rx_buffer */
-@@ -1285,6 +1287,8 @@ static ssize_t dvb_ca_en50221_io_write(struct file *file,
- unsigned long timeout;
- int written;
-
-+ pax_track_stack();
-+
- dprintk("%s\n", __func__);
-
- /* Incoming packet has a 2 byte header. hdr[0] = slot_id, hdr[1] = connection_id */
-diff --git a/drivers/media/dvb/dvb-core/dvbdev.c b/drivers/media/dvb/dvb-core/dvbdev.c
-index 94159b9..376bd8e 100644
---- a/drivers/media/dvb/dvb-core/dvbdev.c
-+++ b/drivers/media/dvb/dvb-core/dvbdev.c
-@@ -191,7 +191,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev,
- const struct dvb_device *template, void *priv, int type)
- {
- struct dvb_device *dvbdev;
-- struct file_operations *dvbdevfops;
-+ file_operations_no_const *dvbdevfops;
- struct device *clsdev;
- int minor;
- int id;
-diff --git a/drivers/media/dvb/dvb-usb/cxusb.c b/drivers/media/dvb/dvb-usb/cxusb.c
-index 2a53dd0..db8c07a 100644
---- a/drivers/media/dvb/dvb-usb/cxusb.c
-+++ b/drivers/media/dvb/dvb-usb/cxusb.c
-@@ -1040,7 +1040,7 @@ static struct dib0070_config dib7070p_dib0070_config = {
- struct dib0700_adapter_state {
- int (*set_param_save) (struct dvb_frontend *,
- struct dvb_frontend_parameters *);
--};
-+} __no_const;
-
- static int dib7070_set_param_override(struct dvb_frontend *fe,
- struct dvb_frontend_parameters *fep)
-diff --git a/drivers/media/dvb/dvb-usb/dib0700_core.c b/drivers/media/dvb/dvb-usb/dib0700_core.c
-index db7f7f7..f55e96f 100644
---- a/drivers/media/dvb/dvb-usb/dib0700_core.c
-+++ b/drivers/media/dvb/dvb-usb/dib0700_core.c
-@@ -332,6 +332,8 @@ int dib0700_download_firmware(struct usb_device *udev, const struct firmware *fw
-
- u8 buf[260];
-
-+ pax_track_stack();
-+
- while ((ret = dvb_usb_get_hexline(fw, &hx, &pos)) > 0) {
- deb_fwdata("writing to address 0x%08x (buffer: 0x%02x %02x)\n",hx.addr, hx.len, hx.chk);
-
-diff --git a/drivers/media/dvb/dvb-usb/dib0700_devices.c b/drivers/media/dvb/dvb-usb/dib0700_devices.c
-index 524acf5..5ffc403 100644
---- a/drivers/media/dvb/dvb-usb/dib0700_devices.c
-+++ b/drivers/media/dvb/dvb-usb/dib0700_devices.c
-@@ -28,7 +28,7 @@ MODULE_PARM_DESC(force_lna_activation, "force the activation of Low-Noise-Amplif
-
- struct dib0700_adapter_state {
- int (*set_param_save) (struct dvb_frontend *, struct dvb_frontend_parameters *);
--};
-+} __no_const;
-
- /* Hauppauge Nova-T 500 (aka Bristol)
- * has a LNA on GPIO0 which is enabled by setting 1 */
-diff --git a/drivers/media/dvb/frontends/dib3000.h b/drivers/media/dvb/frontends/dib3000.h
-index ba91735..4261d84 100644
---- a/drivers/media/dvb/frontends/dib3000.h
-+++ b/drivers/media/dvb/frontends/dib3000.h
-@@ -39,7 +39,7 @@ struct dib_fe_xfer_ops
- int (*fifo_ctrl)(struct dvb_frontend *fe, int onoff);
- int (*pid_ctrl)(struct dvb_frontend *fe, int index, int pid, int onoff);
- int (*tuner_pass_ctrl)(struct dvb_frontend *fe, int onoff, u8 pll_ctrl);
--};
-+} __no_const;
-
- #if defined(CONFIG_DVB_DIB3000MB) || (defined(CONFIG_DVB_DIB3000MB_MODULE) && defined(MODULE))
- extern struct dvb_frontend* dib3000mb_attach(const struct dib3000_config* config,
-diff --git a/drivers/media/dvb/frontends/or51211.c b/drivers/media/dvb/frontends/or51211.c
-index c709ce6..b3fe620 100644
---- a/drivers/media/dvb/frontends/or51211.c
-+++ b/drivers/media/dvb/frontends/or51211.c
-@@ -113,6 +113,8 @@ static int or51211_load_firmware (struct dvb_frontend* fe,
- u8 tudata[585];
- int i;
-
-+ pax_track_stack();
-+
- dprintk("Firmware is %zd bytes\n",fw->size);
-
- /* Get eprom data */
-diff --git a/drivers/media/radio/radio-cadet.c b/drivers/media/radio/radio-cadet.c
-index 482d0f3..ee1e202 100644
---- a/drivers/media/radio/radio-cadet.c
-+++ b/drivers/media/radio/radio-cadet.c
-@@ -347,7 +347,7 @@ static ssize_t cadet_read(struct file *file, char __user *data, size_t count, lo
- while (i < count && dev->rdsin != dev->rdsout)
- readbuf[i++] = dev->rdsbuf[dev->rdsout++];
-
-- if (copy_to_user(data, readbuf, i))
-+ if (i > sizeof readbuf || copy_to_user(data, readbuf, i))
- return -EFAULT;
- return i;
- }
-diff --git a/drivers/media/video/cx18/cx18-driver.c b/drivers/media/video/cx18/cx18-driver.c
-index 6dd51e2..0359b92 100644
---- a/drivers/media/video/cx18/cx18-driver.c
-+++ b/drivers/media/video/cx18/cx18-driver.c
-@@ -56,7 +56,7 @@ static struct pci_device_id cx18_pci_tbl[] __devinitdata = {
-
- MODULE_DEVICE_TABLE(pci, cx18_pci_tbl);
-
--static atomic_t cx18_instance = ATOMIC_INIT(0);
-+static atomic_unchecked_t cx18_instance = ATOMIC_INIT(0);
-
- /* Parameter declarations */
- static int cardtype[CX18_MAX_CARDS];
-@@ -288,6 +288,8 @@ void cx18_read_eeprom(struct cx18 *cx, struct tveeprom *tv)
- struct i2c_client c;
- u8 eedata[256];
-
-+ pax_track_stack();
-+
- memset(&c, 0, sizeof(c));
- strlcpy(c.name, "cx18 tveeprom tmp", sizeof(c.name));
- c.adapter = &cx->i2c_adap[0];
-@@ -800,7 +802,7 @@ static int __devinit cx18_probe(struct pci_dev *pci_dev,
- struct cx18 *cx;
-
- /* FIXME - module parameter arrays constrain max instances */
-- i = atomic_inc_return(&cx18_instance) - 1;
-+ i = atomic_inc_return_unchecked(&cx18_instance) - 1;
- if (i >= CX18_MAX_CARDS) {
- printk(KERN_ERR "cx18: cannot manage card %d, driver has a "
- "limit of 0 - %d\n", i, CX18_MAX_CARDS - 1);
-diff --git a/drivers/media/video/ivtv/ivtv-driver.c b/drivers/media/video/ivtv/ivtv-driver.c
-index 463ec34..2f4625a 100644
---- a/drivers/media/video/ivtv/ivtv-driver.c
-+++ b/drivers/media/video/ivtv/ivtv-driver.c
-@@ -79,7 +79,7 @@ static struct pci_device_id ivtv_pci_tbl[] __devinitdata = {
- MODULE_DEVICE_TABLE(pci,ivtv_pci_tbl);
-
- /* ivtv instance counter */
--static atomic_t ivtv_instance = ATOMIC_INIT(0);
-+static atomic_unchecked_t ivtv_instance = ATOMIC_INIT(0);
-
- /* Parameter declarations */
- static int cardtype[IVTV_MAX_CARDS];
-diff --git a/drivers/media/video/omap24xxcam.c b/drivers/media/video/omap24xxcam.c
-index 5fc4ac0..652a54a 100644
---- a/drivers/media/video/omap24xxcam.c
-+++ b/drivers/media/video/omap24xxcam.c
-@@ -401,7 +401,7 @@ static void omap24xxcam_vbq_complete(struct omap24xxcam_sgdma *sgdma,
- spin_unlock_irqrestore(&cam->core_enable_disable_lock, flags);
-
- do_gettimeofday(&vb->ts);
-- vb->field_count = atomic_add_return(2, &fh->field_count);
-+ vb->field_count = atomic_add_return_unchecked(2, &fh->field_count);
- if (csr & csr_error) {
- vb->state = VIDEOBUF_ERROR;
- if (!atomic_read(&fh->cam->in_reset)) {
-diff --git a/drivers/media/video/omap24xxcam.h b/drivers/media/video/omap24xxcam.h
-index 2ce67f5..cf26a5b 100644
---- a/drivers/media/video/omap24xxcam.h
-+++ b/drivers/media/video/omap24xxcam.h
-@@ -533,7 +533,7 @@ struct omap24xxcam_fh {
- spinlock_t vbq_lock; /* spinlock for the videobuf queue */
- struct videobuf_queue vbq;
- struct v4l2_pix_format pix; /* serialise pix by vbq->lock */
-- atomic_t field_count; /* field counter for videobuf_buffer */
-+ atomic_unchecked_t field_count; /* field counter for videobuf_buffer */
- /* accessing cam here doesn't need serialisation: it's constant */
- struct omap24xxcam_device *cam;
- };
-diff --git a/drivers/media/video/pvrusb2/pvrusb2-eeprom.c b/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
-index 299afa4..eb47459 100644
---- a/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
-+++ b/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
-@@ -119,6 +119,8 @@ int pvr2_eeprom_analyze(struct pvr2_hdw *hdw)
- u8 *eeprom;
- struct tveeprom tvdata;
-
-+ pax_track_stack();
-+
- memset(&tvdata,0,sizeof(tvdata));
-
- eeprom = pvr2_eeprom_fetch(hdw);
-diff --git a/drivers/media/video/saa7134/saa6752hs.c b/drivers/media/video/saa7134/saa6752hs.c
-index 1eabff6..8e2313a 100644
---- a/drivers/media/video/saa7134/saa6752hs.c
-+++ b/drivers/media/video/saa7134/saa6752hs.c
-@@ -683,6 +683,8 @@ static int saa6752hs_init(struct v4l2_subdev *sd, u32 leading_null_bytes)
- unsigned char localPAT[256];
- unsigned char localPMT[256];
-
-+ pax_track_stack();
-+
- /* Set video format - must be done first as it resets other settings */
- set_reg8(client, 0x41, h->video_format);
-
-diff --git a/drivers/media/video/saa7164/saa7164-cmd.c b/drivers/media/video/saa7164/saa7164-cmd.c
-index 9c1d3ac..b1b49e9 100644
---- a/drivers/media/video/saa7164/saa7164-cmd.c
-+++ b/drivers/media/video/saa7164/saa7164-cmd.c
-@@ -87,6 +87,8 @@ int saa7164_irq_dequeue(struct saa7164_dev *dev)
- wait_queue_head_t *q = 0;
- dprintk(DBGLVL_CMD, "%s()\n", __func__);
-
-+ pax_track_stack();
-+
- /* While any outstand message on the bus exists... */
- do {
-
-@@ -126,6 +128,8 @@ int saa7164_cmd_dequeue(struct saa7164_dev *dev)
- u8 tmp[512];
- dprintk(DBGLVL_CMD, "%s()\n", __func__);
-
-+ pax_track_stack();
-+
- while (loop) {
-
- tmComResInfo_t tRsp = { 0, 0, 0, 0, 0, 0 };
-diff --git a/drivers/media/video/usbvideo/ibmcam.c b/drivers/media/video/usbvideo/ibmcam.c
-index b085496..cde0270 100644
---- a/drivers/media/video/usbvideo/ibmcam.c
-+++ b/drivers/media/video/usbvideo/ibmcam.c
-@@ -3947,15 +3947,15 @@ static struct usb_device_id id_table[] = {
- static int __init ibmcam_init(void)
- {
- struct usbvideo_cb cbTbl;
-- memset(&cbTbl, 0, sizeof(cbTbl));
-- cbTbl.probe = ibmcam_probe;
-- cbTbl.setupOnOpen = ibmcam_setup_on_open;
-- cbTbl.videoStart = ibmcam_video_start;
-- cbTbl.videoStop = ibmcam_video_stop;
-- cbTbl.processData = ibmcam_ProcessIsocData;
-- cbTbl.postProcess = usbvideo_DeinterlaceFrame;
-- cbTbl.adjustPicture = ibmcam_adjust_picture;
-- cbTbl.getFPS = ibmcam_calculate_fps;
-+ memset((void *)&cbTbl, 0, sizeof(cbTbl));
-+ *(void **)&cbTbl.probe = ibmcam_probe;
-+ *(void **)&cbTbl.setupOnOpen = ibmcam_setup_on_open;
-+ *(void **)&cbTbl.videoStart = ibmcam_video_start;
-+ *(void **)&cbTbl.videoStop = ibmcam_video_stop;
-+ *(void **)&cbTbl.processData = ibmcam_ProcessIsocData;
-+ *(void **)&cbTbl.postProcess = usbvideo_DeinterlaceFrame;
-+ *(void **)&cbTbl.adjustPicture = ibmcam_adjust_picture;
-+ *(void **)&cbTbl.getFPS = ibmcam_calculate_fps;
- return usbvideo_register(
- &cams,
- MAX_IBMCAM,
-diff --git a/drivers/media/video/usbvideo/konicawc.c b/drivers/media/video/usbvideo/konicawc.c
-index 31d57f2..600b735 100644
---- a/drivers/media/video/usbvideo/konicawc.c
-+++ b/drivers/media/video/usbvideo/konicawc.c
-@@ -225,7 +225,7 @@ static void konicawc_register_input(struct konicawc *cam, struct usb_device *dev
- int error;
-
- usb_make_path(dev, cam->input_physname, sizeof(cam->input_physname));
-- strncat(cam->input_physname, "/input0", sizeof(cam->input_physname));
-+ strlcat(cam->input_physname, "/input0", sizeof(cam->input_physname));
-
- cam->input = input_dev = input_allocate_device();
- if (!input_dev) {
-@@ -935,16 +935,16 @@ static int __init konicawc_init(void)
- struct usbvideo_cb cbTbl;
- printk(KERN_INFO KBUILD_MODNAME ": " DRIVER_VERSION ":"
- DRIVER_DESC "\n");
-- memset(&cbTbl, 0, sizeof(cbTbl));
-- cbTbl.probe = konicawc_probe;
-- cbTbl.setupOnOpen = konicawc_setup_on_open;
-- cbTbl.processData = konicawc_process_isoc;
-- cbTbl.getFPS = konicawc_calculate_fps;
-- cbTbl.setVideoMode = konicawc_set_video_mode;
-- cbTbl.startDataPump = konicawc_start_data;
-- cbTbl.stopDataPump = konicawc_stop_data;
-- cbTbl.adjustPicture = konicawc_adjust_picture;
-- cbTbl.userFree = konicawc_free_uvd;
-+ memset((void * )&cbTbl, 0, sizeof(cbTbl));
-+ *(void **)&cbTbl.probe = konicawc_probe;
-+ *(void **)&cbTbl.setupOnOpen = konicawc_setup_on_open;
-+ *(void **)&cbTbl.processData = konicawc_process_isoc;
-+ *(void **)&cbTbl.getFPS = konicawc_calculate_fps;
-+ *(void **)&cbTbl.setVideoMode = konicawc_set_video_mode;
-+ *(void **)&cbTbl.startDataPump = konicawc_start_data;
-+ *(void **)&cbTbl.stopDataPump = konicawc_stop_data;
-+ *(void **)&cbTbl.adjustPicture = konicawc_adjust_picture;
-+ *(void **)&cbTbl.userFree = konicawc_free_uvd;
- return usbvideo_register(
- &cams,
- MAX_CAMERAS,
-diff --git a/drivers/media/video/usbvideo/quickcam_messenger.c b/drivers/media/video/usbvideo/quickcam_messenger.c
-index 803d3e4..c4d1b96 100644
---- a/drivers/media/video/usbvideo/quickcam_messenger.c
-+++ b/drivers/media/video/usbvideo/quickcam_messenger.c
-@@ -89,7 +89,7 @@ static void qcm_register_input(struct qcm *cam, struct usb_device *dev)
- int error;
-
- usb_make_path(dev, cam->input_physname, sizeof(cam->input_physname));
-- strncat(cam->input_physname, "/input0", sizeof(cam->input_physname));
-+ strlcat(cam->input_physname, "/input0", sizeof(cam->input_physname));
-
- cam->input = input_dev = input_allocate_device();
- if (!input_dev) {
-diff --git a/drivers/media/video/usbvideo/ultracam.c b/drivers/media/video/usbvideo/ultracam.c
-index fbd1b63..292f9f0 100644
---- a/drivers/media/video/usbvideo/ultracam.c
-+++ b/drivers/media/video/usbvideo/ultracam.c
-@@ -655,14 +655,14 @@ static int __init ultracam_init(void)
- {
- struct usbvideo_cb cbTbl;
- memset(&cbTbl, 0, sizeof(cbTbl));
-- cbTbl.probe = ultracam_probe;
-- cbTbl.setupOnOpen = ultracam_setup_on_open;
-- cbTbl.videoStart = ultracam_video_start;
-- cbTbl.videoStop = ultracam_video_stop;
-- cbTbl.processData = ultracam_ProcessIsocData;
-- cbTbl.postProcess = usbvideo_DeinterlaceFrame;
-- cbTbl.adjustPicture = ultracam_adjust_picture;
-- cbTbl.getFPS = ultracam_calculate_fps;
-+ *(void **)&cbTbl.probe = ultracam_probe;
-+ *(void **)&cbTbl.setupOnOpen = ultracam_setup_on_open;
-+ *(void **)&cbTbl.videoStart = ultracam_video_start;
-+ *(void **)&cbTbl.videoStop = ultracam_video_stop;
-+ *(void **)&cbTbl.processData = ultracam_ProcessIsocData;
-+ *(void **)&cbTbl.postProcess = usbvideo_DeinterlaceFrame;
-+ *(void **)&cbTbl.adjustPicture = ultracam_adjust_picture;
-+ *(void **)&cbTbl.getFPS = ultracam_calculate_fps;
- return usbvideo_register(
- &cams,
- MAX_CAMERAS,
-diff --git a/drivers/media/video/usbvideo/usbvideo.c b/drivers/media/video/usbvideo/usbvideo.c
-index dea8b32..34f6878 100644
---- a/drivers/media/video/usbvideo/usbvideo.c
-+++ b/drivers/media/video/usbvideo/usbvideo.c
-@@ -697,15 +697,15 @@ int usbvideo_register(
- __func__, cams, base_size, num_cams);
-
- /* Copy callbacks, apply defaults for those that are not set */
-- memmove(&cams->cb, cbTbl, sizeof(cams->cb));
-+ memmove((void *)&cams->cb, cbTbl, sizeof(cams->cb));
- if (cams->cb.getFrame == NULL)
-- cams->cb.getFrame = usbvideo_GetFrame;
-+ *(void **)&cams->cb.getFrame = usbvideo_GetFrame;
- if (cams->cb.disconnect == NULL)
-- cams->cb.disconnect = usbvideo_Disconnect;
-+ *(void **)&cams->cb.disconnect = usbvideo_Disconnect;
- if (cams->cb.startDataPump == NULL)
-- cams->cb.startDataPump = usbvideo_StartDataPump;
-+ *(void **)&cams->cb.startDataPump = usbvideo_StartDataPump;
- if (cams->cb.stopDataPump == NULL)
-- cams->cb.stopDataPump = usbvideo_StopDataPump;
-+ *(void **)&cams->cb.stopDataPump = usbvideo_StopDataPump;
-
- cams->num_cameras = num_cams;
- cams->cam = (struct uvd *) &cams[1];
-diff --git a/drivers/media/video/usbvideo/usbvideo.h b/drivers/media/video/usbvideo/usbvideo.h
-index c66985b..7fa143a 100644
---- a/drivers/media/video/usbvideo/usbvideo.h
-+++ b/drivers/media/video/usbvideo/usbvideo.h
-@@ -268,7 +268,7 @@ struct usbvideo_cb {
- int (*startDataPump)(struct uvd *uvd);
- void (*stopDataPump)(struct uvd *uvd);
- int (*setVideoMode)(struct uvd *uvd, struct video_window *vw);
--};
-+} __no_const;
-
- struct usbvideo {
- int num_cameras; /* As allocated */
-diff --git a/drivers/media/video/usbvision/usbvision-core.c b/drivers/media/video/usbvision/usbvision-core.c
-index e0f91e4..37554ea 100644
---- a/drivers/media/video/usbvision/usbvision-core.c
-+++ b/drivers/media/video/usbvision/usbvision-core.c
-@@ -820,6 +820,8 @@ static enum ParseState usbvision_parse_compress(struct usb_usbvision *usbvision,
- unsigned char rv, gv, bv;
- static unsigned char *Y, *U, *V;
-
-+ pax_track_stack();
-+
- frame = usbvision->curFrame;
- imageSize = frame->frmwidth * frame->frmheight;
- if ( (frame->v4l2_format.format == V4L2_PIX_FMT_YUV422P) ||
-diff --git a/drivers/media/video/v4l2-device.c b/drivers/media/video/v4l2-device.c
-index 0d06e7c..3d17d24 100644
---- a/drivers/media/video/v4l2-device.c
-+++ b/drivers/media/video/v4l2-device.c
-@@ -50,9 +50,9 @@ int v4l2_device_register(struct device *dev, struct v4l2_device *v4l2_dev)
- EXPORT_SYMBOL_GPL(v4l2_device_register);
-
- int v4l2_device_set_name(struct v4l2_device *v4l2_dev, const char *basename,
-- atomic_t *instance)
-+ atomic_unchecked_t *instance)
- {
-- int num = atomic_inc_return(instance) - 1;
-+ int num = atomic_inc_return_unchecked(instance) - 1;
- int len = strlen(basename);
-
- if (basename[len - 1] >= '0' && basename[len - 1] <= '9')
-diff --git a/drivers/media/video/videobuf-dma-sg.c b/drivers/media/video/videobuf-dma-sg.c
-index 032ebae..6a3532c 100644
---- a/drivers/media/video/videobuf-dma-sg.c
-+++ b/drivers/media/video/videobuf-dma-sg.c
-@@ -693,6 +693,8 @@ void *videobuf_sg_alloc(size_t size)
- {
- struct videobuf_queue q;
-
-+ pax_track_stack();
-+
- /* Required to make generic handler to call __videobuf_alloc */
- q.int_ops = &sg_ops;
-
-diff --git a/drivers/message/fusion/mptbase.c b/drivers/message/fusion/mptbase.c
-index b6992b7..9fa7547 100644
---- a/drivers/message/fusion/mptbase.c
-+++ b/drivers/message/fusion/mptbase.c
-@@ -6709,8 +6709,14 @@ procmpt_iocinfo_read(char *buf, char **start, off_t offset, int request, int *eo
- len += sprintf(buf+len, " MaxChainDepth = 0x%02x frames\n", ioc->facts.MaxChainDepth);
- len += sprintf(buf+len, " MinBlockSize = 0x%02x bytes\n", 4*ioc->facts.BlockSize);
-
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ len += sprintf(buf+len, " RequestFrames @ 0x%p (Dma @ 0x%p)\n",
-+ NULL, NULL);
-+#else
- len += sprintf(buf+len, " RequestFrames @ 0x%p (Dma @ 0x%p)\n",
- (void *)ioc->req_frames, (void *)(ulong)ioc->req_frames_dma);
-+#endif
-+
- /*
- * Rounding UP to nearest 4-kB boundary here...
- */
-diff --git a/drivers/message/fusion/mptsas.c b/drivers/message/fusion/mptsas.c
-index 83873e3..e360e9a 100644
---- a/drivers/message/fusion/mptsas.c
-+++ b/drivers/message/fusion/mptsas.c
-@@ -436,6 +436,23 @@ mptsas_is_end_device(struct mptsas_devinfo * attached)
- return 0;
- }
-
-+static inline void
-+mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
-+{
-+ if (phy_info->port_details) {
-+ phy_info->port_details->rphy = rphy;
-+ dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
-+ ioc->name, rphy));
-+ }
-+
-+ if (rphy) {
-+ dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
-+ &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
-+ dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
-+ ioc->name, rphy, rphy->dev.release));
-+ }
-+}
-+
- /* no mutex */
- static void
- mptsas_port_delete(MPT_ADAPTER *ioc, struct mptsas_portinfo_details * port_details)
-@@ -474,23 +491,6 @@ mptsas_get_rphy(struct mptsas_phyinfo *phy_info)
- return NULL;
- }
-
--static inline void
--mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
--{
-- if (phy_info->port_details) {
-- phy_info->port_details->rphy = rphy;
-- dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
-- ioc->name, rphy));
-- }
--
-- if (rphy) {
-- dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
-- &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
-- dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
-- ioc->name, rphy, rphy->dev.release));
-- }
--}
--
- static inline struct sas_port *
- mptsas_get_port(struct mptsas_phyinfo *phy_info)
- {
-diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c
-index bd096ca..332cf76 100644
---- a/drivers/message/fusion/mptscsih.c
-+++ b/drivers/message/fusion/mptscsih.c
-@@ -1248,15 +1248,16 @@ mptscsih_info(struct Scsi_Host *SChost)
-
- h = shost_priv(SChost);
-
-- if (h) {
-- if (h->info_kbuf == NULL)
-- if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
-- return h->info_kbuf;
-- h->info_kbuf[0] = '\0';
-+ if (!h)
-+ return NULL;
-
-- mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
-- h->info_kbuf[size-1] = '\0';
-- }
-+ if (h->info_kbuf == NULL)
-+ if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
-+ return h->info_kbuf;
-+ h->info_kbuf[0] = '\0';
-+
-+ mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
-+ h->info_kbuf[size-1] = '\0';
-
- return h->info_kbuf;
- }
-diff --git a/drivers/message/i2o/i2o_config.c b/drivers/message/i2o/i2o_config.c
-index efba702..59b2c0f 100644
---- a/drivers/message/i2o/i2o_config.c
-+++ b/drivers/message/i2o/i2o_config.c
-@@ -787,6 +787,8 @@ static int i2o_cfg_passthru(unsigned long arg)
- struct i2o_message *msg;
- unsigned int iop;
-
-+ pax_track_stack();
-+
- if (get_user(iop, &cmd->iop) || get_user(user_msg, &cmd->msg))
- return -EFAULT;
-
-diff --git a/drivers/message/i2o/i2o_proc.c b/drivers/message/i2o/i2o_proc.c
-index 7045c45..c07b170 100644
---- a/drivers/message/i2o/i2o_proc.c
-+++ b/drivers/message/i2o/i2o_proc.c
-@@ -259,13 +259,6 @@ static char *scsi_devices[] = {
- "Array Controller Device"
- };
-
--static char *chtostr(u8 * chars, int n)
--{
-- char tmp[256];
-- tmp[0] = 0;
-- return strncat(tmp, (char *)chars, n);
--}
--
- static int i2o_report_query_status(struct seq_file *seq, int block_status,
- char *group)
- {
-@@ -842,8 +835,7 @@ static int i2o_seq_show_ddm_table(struct seq_file *seq, void *v)
-
- seq_printf(seq, "%-#7x", ddm_table.i2o_vendor_id);
- seq_printf(seq, "%-#8x", ddm_table.module_id);
-- seq_printf(seq, "%-29s",
-- chtostr(ddm_table.module_name_version, 28));
-+ seq_printf(seq, "%-.28s", ddm_table.module_name_version);
- seq_printf(seq, "%9d ", ddm_table.data_size);
- seq_printf(seq, "%8d", ddm_table.code_size);
-
-@@ -944,8 +936,8 @@ static int i2o_seq_show_drivers_stored(struct seq_file *seq, void *v)
-
- seq_printf(seq, "%-#7x", dst->i2o_vendor_id);
- seq_printf(seq, "%-#8x", dst->module_id);
-- seq_printf(seq, "%-29s", chtostr(dst->module_name_version, 28));
-- seq_printf(seq, "%-9s", chtostr(dst->date, 8));
-+ seq_printf(seq, "%-.28s", dst->module_name_version);
-+ seq_printf(seq, "%-.8s", dst->date);
- seq_printf(seq, "%8d ", dst->module_size);
- seq_printf(seq, "%8d ", dst->mpb_size);
- seq_printf(seq, "0x%04x", dst->module_flags);
-@@ -1276,14 +1268,10 @@ static int i2o_seq_show_dev_identity(struct seq_file *seq, void *v)
- seq_printf(seq, "Device Class : %s\n", i2o_get_class_name(work16[0]));
- seq_printf(seq, "Owner TID : %0#5x\n", work16[2]);
- seq_printf(seq, "Parent TID : %0#5x\n", work16[3]);
-- seq_printf(seq, "Vendor info : %s\n",
-- chtostr((u8 *) (work32 + 2), 16));
-- seq_printf(seq, "Product info : %s\n",
-- chtostr((u8 *) (work32 + 6), 16));
-- seq_printf(seq, "Description : %s\n",
-- chtostr((u8 *) (work32 + 10), 16));
-- seq_printf(seq, "Product rev. : %s\n",
-- chtostr((u8 *) (work32 + 14), 8));
-+ seq_printf(seq, "Vendor info : %.16s\n", (u8 *) (work32 + 2));
-+ seq_printf(seq, "Product info : %.16s\n", (u8 *) (work32 + 6));
-+ seq_printf(seq, "Description : %.16s\n", (u8 *) (work32 + 10));
-+ seq_printf(seq, "Product rev. : %.8s\n", (u8 *) (work32 + 14));
-
- seq_printf(seq, "Serial number : ");
- print_serial_number(seq, (u8 *) (work32 + 16),
-@@ -1328,10 +1316,8 @@ static int i2o_seq_show_ddm_identity(struct seq_file *seq, void *v)
- }
-
- seq_printf(seq, "Registering DDM TID : 0x%03x\n", result.ddm_tid);
-- seq_printf(seq, "Module name : %s\n",
-- chtostr(result.module_name, 24));
-- seq_printf(seq, "Module revision : %s\n",
-- chtostr(result.module_rev, 8));
-+ seq_printf(seq, "Module name : %.24s\n", result.module_name);
-+ seq_printf(seq, "Module revision : %.8s\n", result.module_rev);
-
- seq_printf(seq, "Serial number : ");
- print_serial_number(seq, result.serial_number, sizeof(result) - 36);
-@@ -1362,14 +1348,10 @@ static int i2o_seq_show_uinfo(struct seq_file *seq, void *v)
- return 0;
- }
-
-- seq_printf(seq, "Device name : %s\n",
-- chtostr(result.device_name, 64));
-- seq_printf(seq, "Service name : %s\n",
-- chtostr(result.service_name, 64));
-- seq_printf(seq, "Physical name : %s\n",
-- chtostr(result.physical_location, 64));
-- seq_printf(seq, "Instance number : %s\n",
-- chtostr(result.instance_number, 4));
-+ seq_printf(seq, "Device name : %.64s\n", result.device_name);
-+ seq_printf(seq, "Service name : %.64s\n", result.service_name);
-+ seq_printf(seq, "Physical name : %.64s\n", result.physical_location);
-+ seq_printf(seq, "Instance number : %.4s\n", result.instance_number);
-
- return 0;
- }
-diff --git a/drivers/message/i2o/iop.c b/drivers/message/i2o/iop.c
-index 27cf4af..b1205b8 100644
---- a/drivers/message/i2o/iop.c
-+++ b/drivers/message/i2o/iop.c
-@@ -110,10 +110,10 @@ u32 i2o_cntxt_list_add(struct i2o_controller * c, void *ptr)
-
- spin_lock_irqsave(&c->context_list_lock, flags);
-
-- if (unlikely(atomic_inc_and_test(&c->context_list_counter)))
-- atomic_inc(&c->context_list_counter);
-+ if (unlikely(atomic_inc_and_test_unchecked(&c->context_list_counter)))
-+ atomic_inc_unchecked(&c->context_list_counter);
-
-- entry->context = atomic_read(&c->context_list_counter);
-+ entry->context = atomic_read_unchecked(&c->context_list_counter);
-
- list_add(&entry->list, &c->context_list);
-
-@@ -1076,7 +1076,7 @@ struct i2o_controller *i2o_iop_alloc(void)
-
- #if BITS_PER_LONG == 64
- spin_lock_init(&c->context_list_lock);
-- atomic_set(&c->context_list_counter, 0);
-+ atomic_set_unchecked(&c->context_list_counter, 0);
- INIT_LIST_HEAD(&c->context_list);
- #endif
-
-diff --git a/drivers/mfd/ab3100-core.c b/drivers/mfd/ab3100-core.c
-index 78e3e85..66c9a0d 100644
---- a/drivers/mfd/ab3100-core.c
-+++ b/drivers/mfd/ab3100-core.c
-@@ -777,7 +777,7 @@ struct ab_family_id {
- char *name;
- };
-
--static const struct ab_family_id ids[] __initdata = {
-+static const struct ab_family_id ids[] __initconst = {
- /* AB3100 */
- {
- .id = 0xc0,
-diff --git a/drivers/mfd/wm8350-i2c.c b/drivers/mfd/wm8350-i2c.c
-index 8d8c932..8104515 100644
---- a/drivers/mfd/wm8350-i2c.c
-+++ b/drivers/mfd/wm8350-i2c.c
-@@ -43,6 +43,8 @@ static int wm8350_i2c_write_device(struct wm8350 *wm8350, char reg,
- u8 msg[(WM8350_MAX_REGISTER << 1) + 1];
- int ret;
-
-+ pax_track_stack();
-+
- if (bytes > ((WM8350_MAX_REGISTER << 1) + 1))
- return -EINVAL;
-
-diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c
-index e4ff50b..80b88b4 100644
---- a/drivers/misc/kgdbts.c
-+++ b/drivers/misc/kgdbts.c
-@@ -118,7 +118,7 @@
- } while (0)
- #define MAX_CONFIG_LEN 40
-
--static struct kgdb_io kgdbts_io_ops;
-+static const struct kgdb_io kgdbts_io_ops;
- static char get_buf[BUFMAX];
- static int get_buf_cnt;
- static char put_buf[BUFMAX];
-@@ -740,7 +740,7 @@ static void run_plant_and_detach_test(int is_early)
- char before[BREAK_INSTR_SIZE];
- char after[BREAK_INSTR_SIZE];
-
-- probe_kernel_read(before, (char *)kgdbts_break_test,
-+ probe_kernel_read(before, ktla_ktva((char *)kgdbts_break_test),
- BREAK_INSTR_SIZE);
- init_simple_test();
- ts.tst = plant_and_detach_test;
-@@ -748,7 +748,7 @@ static void run_plant_and_detach_test(int is_early)
- /* Activate test with initial breakpoint */
- if (!is_early)
- kgdb_breakpoint();
-- probe_kernel_read(after, (char *)kgdbts_break_test,
-+ probe_kernel_read(after, ktla_ktva((char *)kgdbts_break_test),
- BREAK_INSTR_SIZE);
- if (memcmp(before, after, BREAK_INSTR_SIZE)) {
- printk(KERN_CRIT "kgdbts: ERROR kgdb corrupted memory\n");
-@@ -1102,7 +1102,7 @@ static void kgdbts_post_exp_handler(void)
- module_put(THIS_MODULE);
- }
-
--static struct kgdb_io kgdbts_io_ops = {
-+static const struct kgdb_io kgdbts_io_ops = {
- .name = "kgdbts",
- .read_char = kgdbts_get_char,
- .write_char = kgdbts_put_char,
-diff --git a/drivers/misc/sgi-gru/gruhandles.c b/drivers/misc/sgi-gru/gruhandles.c
-index 37e7cfc..67cfb76 100644
---- a/drivers/misc/sgi-gru/gruhandles.c
-+++ b/drivers/misc/sgi-gru/gruhandles.c
-@@ -39,8 +39,8 @@ struct mcs_op_statistic mcs_op_statistics[mcsop_last];
-
- static void update_mcs_stats(enum mcs_op op, unsigned long clks)
- {
-- atomic_long_inc(&mcs_op_statistics[op].count);
-- atomic_long_add(clks, &mcs_op_statistics[op].total);
-+ atomic_long_inc_unchecked(&mcs_op_statistics[op].count);
-+ atomic_long_add_unchecked(clks, &mcs_op_statistics[op].total);
- if (mcs_op_statistics[op].max < clks)
- mcs_op_statistics[op].max = clks;
- }
-diff --git a/drivers/misc/sgi-gru/gruprocfs.c b/drivers/misc/sgi-gru/gruprocfs.c
-index 3f2375c..467c6e6 100644
---- a/drivers/misc/sgi-gru/gruprocfs.c
-+++ b/drivers/misc/sgi-gru/gruprocfs.c
-@@ -32,9 +32,9 @@
-
- #define printstat(s, f) printstat_val(s, &gru_stats.f, #f)
-
--static void printstat_val(struct seq_file *s, atomic_long_t *v, char *id)
-+static void printstat_val(struct seq_file *s, atomic_long_unchecked_t *v, char *id)
- {
-- unsigned long val = atomic_long_read(v);
-+ unsigned long val = atomic_long_read_unchecked(v);
-
- if (val)
- seq_printf(s, "%16lu %s\n", val, id);
-@@ -136,8 +136,8 @@ static int mcs_statistics_show(struct seq_file *s, void *p)
- "cch_interrupt_sync", "cch_deallocate", "tgh_invalidate"};
-
- for (op = 0; op < mcsop_last; op++) {
-- count = atomic_long_read(&mcs_op_statistics[op].count);
-- total = atomic_long_read(&mcs_op_statistics[op].total);
-+ count = atomic_long_read_unchecked(&mcs_op_statistics[op].count);
-+ total = atomic_long_read_unchecked(&mcs_op_statistics[op].total);
- max = mcs_op_statistics[op].max;
- seq_printf(s, "%-20s%12ld%12ld%12ld\n", id[op], count,
- count ? total / count : 0, max);
-diff --git a/drivers/misc/sgi-gru/grutables.h b/drivers/misc/sgi-gru/grutables.h
-index 46990bc..4a251b5 100644
---- a/drivers/misc/sgi-gru/grutables.h
-+++ b/drivers/misc/sgi-gru/grutables.h
-@@ -167,84 +167,84 @@ extern unsigned int gru_max_gids;
- * GRU statistics.
- */
- struct gru_stats_s {
-- atomic_long_t vdata_alloc;
-- atomic_long_t vdata_free;
-- atomic_long_t gts_alloc;
-- atomic_long_t gts_free;
-- atomic_long_t vdata_double_alloc;
-- atomic_long_t gts_double_allocate;
-- atomic_long_t assign_context;
-- atomic_long_t assign_context_failed;
-- atomic_long_t free_context;
-- atomic_long_t load_user_context;
-- atomic_long_t load_kernel_context;
-- atomic_long_t lock_kernel_context;
-- atomic_long_t unlock_kernel_context;
-- atomic_long_t steal_user_context;
-- atomic_long_t steal_kernel_context;
-- atomic_long_t steal_context_failed;
-- atomic_long_t nopfn;
-- atomic_long_t break_cow;
-- atomic_long_t asid_new;
-- atomic_long_t asid_next;
-- atomic_long_t asid_wrap;
-- atomic_long_t asid_reuse;
-- atomic_long_t intr;
-- atomic_long_t intr_mm_lock_failed;
-- atomic_long_t call_os;
-- atomic_long_t call_os_offnode_reference;
-- atomic_long_t call_os_check_for_bug;
-- atomic_long_t call_os_wait_queue;
-- atomic_long_t user_flush_tlb;
-- atomic_long_t user_unload_context;
-- atomic_long_t user_exception;
-- atomic_long_t set_context_option;
-- atomic_long_t migrate_check;
-- atomic_long_t migrated_retarget;
-- atomic_long_t migrated_unload;
-- atomic_long_t migrated_unload_delay;
-- atomic_long_t migrated_nopfn_retarget;
-- atomic_long_t migrated_nopfn_unload;
-- atomic_long_t tlb_dropin;
-- atomic_long_t tlb_dropin_fail_no_asid;
-- atomic_long_t tlb_dropin_fail_upm;
-- atomic_long_t tlb_dropin_fail_invalid;
-- atomic_long_t tlb_dropin_fail_range_active;
-- atomic_long_t tlb_dropin_fail_idle;
-- atomic_long_t tlb_dropin_fail_fmm;
-- atomic_long_t tlb_dropin_fail_no_exception;
-- atomic_long_t tlb_dropin_fail_no_exception_war;
-- atomic_long_t tfh_stale_on_fault;
-- atomic_long_t mmu_invalidate_range;
-- atomic_long_t mmu_invalidate_page;
-- atomic_long_t mmu_clear_flush_young;
-- atomic_long_t flush_tlb;
-- atomic_long_t flush_tlb_gru;
-- atomic_long_t flush_tlb_gru_tgh;
-- atomic_long_t flush_tlb_gru_zero_asid;
-+ atomic_long_unchecked_t vdata_alloc;
-+ atomic_long_unchecked_t vdata_free;
-+ atomic_long_unchecked_t gts_alloc;
-+ atomic_long_unchecked_t gts_free;
-+ atomic_long_unchecked_t vdata_double_alloc;
-+ atomic_long_unchecked_t gts_double_allocate;
-+ atomic_long_unchecked_t assign_context;
-+ atomic_long_unchecked_t assign_context_failed;
-+ atomic_long_unchecked_t free_context;
-+ atomic_long_unchecked_t load_user_context;
-+ atomic_long_unchecked_t load_kernel_context;
-+ atomic_long_unchecked_t lock_kernel_context;
-+ atomic_long_unchecked_t unlock_kernel_context;
-+ atomic_long_unchecked_t steal_user_context;
-+ atomic_long_unchecked_t steal_kernel_context;
-+ atomic_long_unchecked_t steal_context_failed;
-+ atomic_long_unchecked_t nopfn;
-+ atomic_long_unchecked_t break_cow;
-+ atomic_long_unchecked_t asid_new;
-+ atomic_long_unchecked_t asid_next;
-+ atomic_long_unchecked_t asid_wrap;
-+ atomic_long_unchecked_t asid_reuse;
-+ atomic_long_unchecked_t intr;
-+ atomic_long_unchecked_t intr_mm_lock_failed;
-+ atomic_long_unchecked_t call_os;
-+ atomic_long_unchecked_t call_os_offnode_reference;
-+ atomic_long_unchecked_t call_os_check_for_bug;
-+ atomic_long_unchecked_t call_os_wait_queue;
-+ atomic_long_unchecked_t user_flush_tlb;
-+ atomic_long_unchecked_t user_unload_context;
-+ atomic_long_unchecked_t user_exception;
-+ atomic_long_unchecked_t set_context_option;
-+ atomic_long_unchecked_t migrate_check;
-+ atomic_long_unchecked_t migrated_retarget;
-+ atomic_long_unchecked_t migrated_unload;
-+ atomic_long_unchecked_t migrated_unload_delay;
-+ atomic_long_unchecked_t migrated_nopfn_retarget;
-+ atomic_long_unchecked_t migrated_nopfn_unload;
-+ atomic_long_unchecked_t tlb_dropin;
-+ atomic_long_unchecked_t tlb_dropin_fail_no_asid;
-+ atomic_long_unchecked_t tlb_dropin_fail_upm;
-+ atomic_long_unchecked_t tlb_dropin_fail_invalid;
-+ atomic_long_unchecked_t tlb_dropin_fail_range_active;
-+ atomic_long_unchecked_t tlb_dropin_fail_idle;
-+ atomic_long_unchecked_t tlb_dropin_fail_fmm;
-+ atomic_long_unchecked_t tlb_dropin_fail_no_exception;
-+ atomic_long_unchecked_t tlb_dropin_fail_no_exception_war;
-+ atomic_long_unchecked_t tfh_stale_on_fault;
-+ atomic_long_unchecked_t mmu_invalidate_range;
-+ atomic_long_unchecked_t mmu_invalidate_page;
-+ atomic_long_unchecked_t mmu_clear_flush_young;
-+ atomic_long_unchecked_t flush_tlb;
-+ atomic_long_unchecked_t flush_tlb_gru;
-+ atomic_long_unchecked_t flush_tlb_gru_tgh;
-+ atomic_long_unchecked_t flush_tlb_gru_zero_asid;
-
-- atomic_long_t copy_gpa;
-+ atomic_long_unchecked_t copy_gpa;
-
-- atomic_long_t mesq_receive;
-- atomic_long_t mesq_receive_none;
-- atomic_long_t mesq_send;
-- atomic_long_t mesq_send_failed;
-- atomic_long_t mesq_noop;
-- atomic_long_t mesq_send_unexpected_error;
-- atomic_long_t mesq_send_lb_overflow;
-- atomic_long_t mesq_send_qlimit_reached;
-- atomic_long_t mesq_send_amo_nacked;
-- atomic_long_t mesq_send_put_nacked;
-- atomic_long_t mesq_qf_not_full;
-- atomic_long_t mesq_qf_locked;
-- atomic_long_t mesq_qf_noop_not_full;
-- atomic_long_t mesq_qf_switch_head_failed;
-- atomic_long_t mesq_qf_unexpected_error;
-- atomic_long_t mesq_noop_unexpected_error;
-- atomic_long_t mesq_noop_lb_overflow;
-- atomic_long_t mesq_noop_qlimit_reached;
-- atomic_long_t mesq_noop_amo_nacked;
-- atomic_long_t mesq_noop_put_nacked;
-+ atomic_long_unchecked_t mesq_receive;
-+ atomic_long_unchecked_t mesq_receive_none;
-+ atomic_long_unchecked_t mesq_send;
-+ atomic_long_unchecked_t mesq_send_failed;
-+ atomic_long_unchecked_t mesq_noop;
-+ atomic_long_unchecked_t mesq_send_unexpected_error;
-+ atomic_long_unchecked_t mesq_send_lb_overflow;
-+ atomic_long_unchecked_t mesq_send_qlimit_reached;
-+ atomic_long_unchecked_t mesq_send_amo_nacked;
-+ atomic_long_unchecked_t mesq_send_put_nacked;
-+ atomic_long_unchecked_t mesq_qf_not_full;
-+ atomic_long_unchecked_t mesq_qf_locked;
-+ atomic_long_unchecked_t mesq_qf_noop_not_full;
-+ atomic_long_unchecked_t mesq_qf_switch_head_failed;
-+ atomic_long_unchecked_t mesq_qf_unexpected_error;
-+ atomic_long_unchecked_t mesq_noop_unexpected_error;
-+ atomic_long_unchecked_t mesq_noop_lb_overflow;
-+ atomic_long_unchecked_t mesq_noop_qlimit_reached;
-+ atomic_long_unchecked_t mesq_noop_amo_nacked;
-+ atomic_long_unchecked_t mesq_noop_put_nacked;
-
- };
-
-@@ -252,8 +252,8 @@ enum mcs_op {cchop_allocate, cchop_start, cchop_interrupt, cchop_interrupt_sync,
- cchop_deallocate, tghop_invalidate, mcsop_last};
-
- struct mcs_op_statistic {
-- atomic_long_t count;
-- atomic_long_t total;
-+ atomic_long_unchecked_t count;
-+ atomic_long_unchecked_t total;
- unsigned long max;
- };
-
-@@ -276,7 +276,7 @@ extern struct mcs_op_statistic mcs_op_statistics[mcsop_last];
-
- #define STAT(id) do { \
- if (gru_options & OPT_STATS) \
-- atomic_long_inc(&gru_stats.id); \
-+ atomic_long_inc_unchecked(&gru_stats.id); \
- } while (0)
-
- #ifdef CONFIG_SGI_GRU_DEBUG
-diff --git a/drivers/misc/sgi-xp/xp.h b/drivers/misc/sgi-xp/xp.h
-index 2275126..12a9dbfb 100644
---- a/drivers/misc/sgi-xp/xp.h
-+++ b/drivers/misc/sgi-xp/xp.h
-@@ -289,7 +289,7 @@ struct xpc_interface {
- xpc_notify_func, void *);
- void (*received) (short, int, void *);
- enum xp_retval (*partid_to_nasids) (short, void *);
--};
-+} __no_const;
-
- extern struct xpc_interface xpc_interface;
-
-diff --git a/drivers/misc/sgi-xp/xpc.h b/drivers/misc/sgi-xp/xpc.h
-index b94d5f7..7f494c5 100644
---- a/drivers/misc/sgi-xp/xpc.h
-+++ b/drivers/misc/sgi-xp/xpc.h
-@@ -835,6 +835,7 @@ struct xpc_arch_operations {
- void (*received_payload) (struct xpc_channel *, void *);
- void (*notify_senders_of_disconnect) (struct xpc_channel *);
- };
-+typedef struct xpc_arch_operations __no_const xpc_arch_operations_no_const;
-
- /* struct xpc_partition act_state values (for XPC HB) */
-
-@@ -876,7 +877,7 @@ extern struct xpc_registration xpc_registrations[];
- /* found in xpc_main.c */
- extern struct device *xpc_part;
- extern struct device *xpc_chan;
--extern struct xpc_arch_operations xpc_arch_ops;
-+extern xpc_arch_operations_no_const xpc_arch_ops;
- extern int xpc_disengage_timelimit;
- extern int xpc_disengage_timedout;
- extern int xpc_activate_IRQ_rcvd;
-diff --git a/drivers/misc/sgi-xp/xpc_main.c b/drivers/misc/sgi-xp/xpc_main.c
-index fd3688a..7e211a4 100644
---- a/drivers/misc/sgi-xp/xpc_main.c
-+++ b/drivers/misc/sgi-xp/xpc_main.c
-@@ -169,7 +169,7 @@ static struct notifier_block xpc_die_notifier = {
- .notifier_call = xpc_system_die,
- };
-
--struct xpc_arch_operations xpc_arch_ops;
-+xpc_arch_operations_no_const xpc_arch_ops;
-
- /*
- * Timer function to enforce the timelimit on the partition disengage.
-diff --git a/drivers/misc/sgi-xp/xpc_sn2.c b/drivers/misc/sgi-xp/xpc_sn2.c
-index 8b70e03..700bda6 100644
---- a/drivers/misc/sgi-xp/xpc_sn2.c
-+++ b/drivers/misc/sgi-xp/xpc_sn2.c
-@@ -2350,7 +2350,7 @@ xpc_received_payload_sn2(struct xpc_channel *ch, void *payload)
- xpc_acknowledge_msgs_sn2(ch, get, msg->flags);
- }
-
--static struct xpc_arch_operations xpc_arch_ops_sn2 = {
-+static const struct xpc_arch_operations xpc_arch_ops_sn2 = {
- .setup_partitions = xpc_setup_partitions_sn2,
- .teardown_partitions = xpc_teardown_partitions_sn2,
- .process_activate_IRQ_rcvd = xpc_process_activate_IRQ_rcvd_sn2,
-@@ -2413,7 +2413,9 @@ xpc_init_sn2(void)
- int ret;
- size_t buf_size;
-
-- xpc_arch_ops = xpc_arch_ops_sn2;
-+ pax_open_kernel();
-+ memcpy((void *)&xpc_arch_ops, &xpc_arch_ops_sn2, sizeof(xpc_arch_ops_sn2));
-+ pax_close_kernel();
-
- if (offsetof(struct xpc_msg_sn2, payload) > XPC_MSG_HDR_MAX_SIZE) {
- dev_err(xpc_part, "header portion of struct xpc_msg_sn2 is "
-diff --git a/drivers/misc/sgi-xp/xpc_uv.c b/drivers/misc/sgi-xp/xpc_uv.c
-index 8e08d71..7cb8c9b 100644
---- a/drivers/misc/sgi-xp/xpc_uv.c
-+++ b/drivers/misc/sgi-xp/xpc_uv.c
-@@ -1669,7 +1669,7 @@ xpc_received_payload_uv(struct xpc_channel *ch, void *payload)
- XPC_DEACTIVATE_PARTITION(&xpc_partitions[ch->partid], ret);
- }
-
--static struct xpc_arch_operations xpc_arch_ops_uv = {
-+static const struct xpc_arch_operations xpc_arch_ops_uv = {
- .setup_partitions = xpc_setup_partitions_uv,
- .teardown_partitions = xpc_teardown_partitions_uv,
- .process_activate_IRQ_rcvd = xpc_process_activate_IRQ_rcvd_uv,
-@@ -1729,7 +1729,9 @@ static struct xpc_arch_operations xpc_arch_ops_uv = {
- int
- xpc_init_uv(void)
- {
-- xpc_arch_ops = xpc_arch_ops_uv;
-+ pax_open_kernel();
-+ memcpy((void *)&xpc_arch_ops, &xpc_arch_ops_uv, sizeof(xpc_arch_ops_uv));
-+ pax_close_kernel();
-
- if (sizeof(struct xpc_notify_mq_msghdr_uv) > XPC_MSG_HDR_MAX_SIZE) {
- dev_err(xpc_part, "xpc_notify_mq_msghdr_uv is larger than %d\n",
-diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c
-index 6fd20b42..650efe3 100644
---- a/drivers/mmc/host/sdhci-pci.c
-+++ b/drivers/mmc/host/sdhci-pci.c
-@@ -297,7 +297,7 @@ static const struct sdhci_pci_fixes sdhci_via = {
- .probe = via_probe,
- };
-
--static const struct pci_device_id pci_ids[] __devinitdata = {
-+static const struct pci_device_id pci_ids[] __devinitconst = {
- {
- .vendor = PCI_VENDOR_ID_RICOH,
- .device = PCI_DEVICE_ID_RICOH_R5C822,
-diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
-index e7563a9..5f90ce5 100644
---- a/drivers/mtd/chips/cfi_cmdset_0001.c
-+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
-@@ -743,6 +743,8 @@ static int chip_ready (struct map_info *map, struct flchip *chip, unsigned long
- struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
- unsigned long timeo = jiffies + HZ;
-
-+ pax_track_stack();
-+
- /* Prevent setting state FL_SYNCING for chip in suspended state. */
- if (mode == FL_SYNCING && chip->oldstate != FL_READY)
- goto sleep;
-@@ -1642,6 +1644,8 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
- unsigned long initial_adr;
- int initial_len = len;
-
-+ pax_track_stack();
-+
- wbufsize = cfi_interleave(cfi) << cfi->cfiq->MaxBufWriteSize;
- adr += chip->start;
- initial_adr = adr;
-@@ -1860,6 +1864,8 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
- int retries = 3;
- int ret;
-
-+ pax_track_stack();
-+
- adr += chip->start;
-
- retry:
-diff --git a/drivers/mtd/chips/cfi_cmdset_0020.c b/drivers/mtd/chips/cfi_cmdset_0020.c
-index 0667a67..3ab97ed 100644
---- a/drivers/mtd/chips/cfi_cmdset_0020.c
-+++ b/drivers/mtd/chips/cfi_cmdset_0020.c
-@@ -255,6 +255,8 @@ static inline int do_read_onechip(struct map_info *map, struct flchip *chip, lof
- unsigned long cmd_addr;
- struct cfi_private *cfi = map->fldrv_priv;
-
-+ pax_track_stack();
-+
- adr += chip->start;
-
- /* Ensure cmd read/writes are aligned. */
-@@ -428,6 +430,8 @@ static inline int do_write_buffer(struct map_info *map, struct flchip *chip,
- DECLARE_WAITQUEUE(wait, current);
- int wbufsize, z;
-
-+ pax_track_stack();
-+
- /* M58LW064A requires bus alignment for buffer wriets -- saw */
- if (adr & (map_bankwidth(map)-1))
- return -EINVAL;
-@@ -742,6 +746,8 @@ static inline int do_erase_oneblock(struct map_info *map, struct flchip *chip, u
- DECLARE_WAITQUEUE(wait, current);
- int ret = 0;
-
-+ pax_track_stack();
-+
- adr += chip->start;
-
- /* Let's determine this according to the interleave only once */
-@@ -1047,6 +1053,8 @@ static inline int do_lock_oneblock(struct map_info *map, struct flchip *chip, un
- unsigned long timeo = jiffies + HZ;
- DECLARE_WAITQUEUE(wait, current);
-
-+ pax_track_stack();
-+
- adr += chip->start;
-
- /* Let's determine this according to the interleave only once */
-@@ -1196,6 +1204,8 @@ static inline int do_unlock_oneblock(struct map_info *map, struct flchip *chip,
- unsigned long timeo = jiffies + HZ;
- DECLARE_WAITQUEUE(wait, current);
-
-+ pax_track_stack();
-+
- adr += chip->start;
-
- /* Let's determine this according to the interleave only once */
-diff --git a/drivers/mtd/devices/doc2000.c b/drivers/mtd/devices/doc2000.c
-index 5bf5f46..c5de373 100644
---- a/drivers/mtd/devices/doc2000.c
-+++ b/drivers/mtd/devices/doc2000.c
-@@ -776,7 +776,7 @@ static int doc_write(struct mtd_info *mtd, loff_t to, size_t len,
-
- /* The ECC will not be calculated correctly if less than 512 is written */
- /* DBB-
-- if (len != 0x200 && eccbuf)
-+ if (len != 0x200)
- printk(KERN_WARNING
- "ECC needs a full sector write (adr: %lx size %lx)\n",
- (long) to, (long) len);
-diff --git a/drivers/mtd/devices/doc2001.c b/drivers/mtd/devices/doc2001.c
-index 0990f78..bb4e8a4 100644
---- a/drivers/mtd/devices/doc2001.c
-+++ b/drivers/mtd/devices/doc2001.c
-@@ -393,7 +393,7 @@ static int doc_read (struct mtd_info *mtd, loff_t from, size_t len,
- struct Nand *mychip = &this->chips[from >> (this->chipshift)];
-
- /* Don't allow read past end of device */
-- if (from >= this->totlen)
-+ if (from >= this->totlen || !len)
- return -EINVAL;
-
- /* Don't allow a single read to cross a 512-byte block boundary */
-diff --git a/drivers/mtd/ftl.c b/drivers/mtd/ftl.c
-index e56d6b4..f07e6cf 100644
---- a/drivers/mtd/ftl.c
-+++ b/drivers/mtd/ftl.c
-@@ -474,6 +474,8 @@ static int copy_erase_unit(partition_t *part, uint16_t srcunit,
- loff_t offset;
- uint16_t srcunitswap = cpu_to_le16(srcunit);
-
-+ pax_track_stack();
-+
- eun = &part->EUNInfo[srcunit];
- xfer = &part->XferInfo[xferunit];
- DEBUG(2, "ftl_cs: copying block 0x%x to 0x%x\n",
-diff --git a/drivers/mtd/inftlcore.c b/drivers/mtd/inftlcore.c
-index 8aca552..146446e 100755
---- a/drivers/mtd/inftlcore.c
-+++ b/drivers/mtd/inftlcore.c
-@@ -260,6 +260,8 @@ static u16 INFTL_foldchain(struct INFTLrecord *inftl, unsigned thisVUC, unsigned
- struct inftl_oob oob;
- size_t retlen;
-
-+ pax_track_stack();
-+
- DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_foldchain(inftl=%p,thisVUC=%d,"
- "pending=%d)\n", inftl, thisVUC, pendingblock);
-
-diff --git a/drivers/mtd/inftlmount.c b/drivers/mtd/inftlmount.c
-index 32e82ae..ed50953 100644
---- a/drivers/mtd/inftlmount.c
-+++ b/drivers/mtd/inftlmount.c
-@@ -54,6 +54,8 @@ static int find_boot_record(struct INFTLrecord *inftl)
- struct INFTLPartition *ip;
- size_t retlen;
-
-+ pax_track_stack();
-+
- DEBUG(MTD_DEBUG_LEVEL3, "INFTL: find_boot_record(inftl=%p)\n", inftl);
-
- /*
-diff --git a/drivers/mtd/lpddr/qinfo_probe.c b/drivers/mtd/lpddr/qinfo_probe.c
-index 79bf40f..fe5f8fd 100644
---- a/drivers/mtd/lpddr/qinfo_probe.c
-+++ b/drivers/mtd/lpddr/qinfo_probe.c
-@@ -106,6 +106,8 @@ static int lpddr_pfow_present(struct map_info *map, struct lpddr_private *lpddr)
- {
- map_word pfow_val[4];
-
-+ pax_track_stack();
-+
- /* Check identification string */
- pfow_val[0] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_P);
- pfow_val[1] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_F);
-diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
-index 726a1b8..f46b460 100644
---- a/drivers/mtd/mtdchar.c
-+++ b/drivers/mtd/mtdchar.c
-@@ -461,6 +461,8 @@ static int mtd_ioctl(struct inode *inode, struct file *file,
- u_long size;
- struct mtd_info_user info;
-
-+ pax_track_stack();
-+
- DEBUG(MTD_DEBUG_LEVEL0, "MTD_ioctl\n");
-
- size = (cmd & IOCSIZE_MASK) >> IOCSIZE_SHIFT;
-diff --git a/drivers/mtd/nftlcore.c b/drivers/mtd/nftlcore.c
-index 1002e18..26d82d5 100644
---- a/drivers/mtd/nftlcore.c
-+++ b/drivers/mtd/nftlcore.c
-@@ -254,6 +254,8 @@ static u16 NFTL_foldchain (struct NFTLrecord *nftl, unsigned thisVUC, unsigned p
- int inplace = 1;
- size_t retlen;
-
-+ pax_track_stack();
-+
- memset(BlockMap, 0xff, sizeof(BlockMap));
- memset(BlockFreeFound, 0, sizeof(BlockFreeFound));
-
-diff --git a/drivers/mtd/nftlmount.c b/drivers/mtd/nftlmount.c
-index 8b22b18..6fada85 100644
---- a/drivers/mtd/nftlmount.c
-+++ b/drivers/mtd/nftlmount.c
-@@ -23,6 +23,7 @@
- #include <asm/errno.h>
- #include <linux/delay.h>
- #include <linux/slab.h>
-+#include <linux/sched.h>
- #include <linux/mtd/mtd.h>
- #include <linux/mtd/nand.h>
- #include <linux/mtd/nftl.h>
-@@ -44,6 +45,8 @@ static int find_boot_record(struct NFTLrecord *nftl)
- struct mtd_info *mtd = nftl->mbd.mtd;
- unsigned int i;
-
-+ pax_track_stack();
-+
- /* Assume logical EraseSize == physical erasesize for starting the scan.
- We'll sort it out later if we find a MediaHeader which says otherwise */
- /* Actually, we won't. The new DiskOnChip driver has already scanned
-diff --git a/drivers/net/atlx/atl2.c b/drivers/net/atlx/atl2.c
-index ab68886..ca405e8 100644
---- a/drivers/net/atlx/atl2.c
-+++ b/drivers/net/atlx/atl2.c
-@@ -2845,7 +2845,7 @@ static void atl2_force_ps(struct atl2_hw *hw)
- */
-
- #define ATL2_PARAM(X, desc) \
-- static const int __devinitdata X[ATL2_MAX_NIC + 1] = ATL2_PARAM_INIT; \
-+ static const int __devinitconst X[ATL2_MAX_NIC + 1] = ATL2_PARAM_INIT; \
- MODULE_PARM(X, "1-" __MODULE_STRING(ATL2_MAX_NIC) "i"); \
- MODULE_PARM_DESC(X, desc);
- #else
-diff --git a/drivers/net/benet/Makefile b/drivers/net/benet/Makefile
-index a60cd80..0ed11ef 100644
---- a/drivers/net/benet/Makefile
-+++ b/drivers/net/benet/Makefile
-@@ -1,7 +1,9 @@
- #
--# Makefile to build the network driver for ServerEngine's BladeEngine.
-+# Makefile to build the be2net network driver
- #
-
-+EXTRA_CFLAGS += -DCONFIG_PALAU
-+
- obj-$(CONFIG_BE2NET) += be2net.o
-
--be2net-y := be_main.o be_cmds.o be_ethtool.o
-+be2net-y := be_main.o be_cmds.o be_ethtool.o be_compat.o be_misc.o
-diff --git a/drivers/net/benet/be.h b/drivers/net/benet/be.h
-index 5c74ff0..7382603 100644
---- a/drivers/net/benet/be.h
-+++ b/drivers/net/benet/be.h
-@@ -1,18 +1,18 @@
- /*
-- * Copyright (C) 2005 - 2009 ServerEngines
-+ * Copyright (C) 2005 - 2011 Emulex
- * All rights reserved.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License version 2
-- * as published by the Free Software Foundation. The full GNU General
-+ * as published by the Free Software Foundation. The full GNU General
- * Public License is included in this distribution in the file called COPYING.
- *
- * Contact Information:
-- * linux-drivers@serverengines.com
-+ * linux-drivers@emulex.com
- *
-- * ServerEngines
-- * 209 N. Fair Oaks Ave
-- * Sunnyvale, CA 94085
-+ * Emulex
-+ * 3333 Susan Street
-+ * Costa Mesa, CA 92626
- */
-
- #ifndef BE_H
-@@ -29,32 +29,53 @@
- #include <linux/workqueue.h>
- #include <linux/interrupt.h>
- #include <linux/firmware.h>
-+#include <linux/jhash.h>
-+#ifndef CONFIG_PALAU
-+#include <linux/inet_lro.h>
-+#endif
-
-+#ifdef CONFIG_PALAU
-+#include "be_compat.h"
-+#endif
- #include "be_hw.h"
-
--#define DRV_VER "2.101.205"
-+#ifdef CONFIG_PALAU
-+#include "version.h"
-+#define DRV_VER STR_BE_MAJOR "." STR_BE_MINOR "."\
-+ STR_BE_BUILD "." STR_BE_BRANCH
-+#else
-+#define DRV_VER "2.0.348"
-+#endif
- #define DRV_NAME "be2net"
--#define BE_NAME "ServerEngines BladeEngine2 10Gbps NIC"
--#define BE3_NAME "ServerEngines BladeEngine3 10Gbps NIC"
--#define OC_NAME "Emulex OneConnect 10Gbps NIC"
--#define OC_NAME1 "Emulex OneConnect 10Gbps NIC (be3)"
--#define DRV_DESC BE_NAME "Driver"
-+#define BE_NAME "Emulex BladeEngine2"
-+#define BE3_NAME "Emulex BladeEngine3"
-+#define OC_NAME "Emulex OneConnect"
-+#define OC_NAME_BE OC_NAME "(be3)"
-+#define OC_NAME_LANCER OC_NAME "(Lancer)"
-+#define DRV_DESC "Emulex OneConnect 10Gbps NIC Driver"
-
--#define BE_VENDOR_ID 0x19a2
-+#define BE_VENDOR_ID 0x19a2
-+#define EMULEX_VENDOR_ID 0x10df
- #define BE_DEVICE_ID1 0x211
- #define BE_DEVICE_ID2 0x221
--#define OC_DEVICE_ID1 0x700
--#define OC_DEVICE_ID2 0x701
--#define OC_DEVICE_ID3 0x710
-+#define OC_DEVICE_ID1 0x700 /* Device Id for BE2 cards */
-+#define OC_DEVICE_ID2 0x710 /* Device Id for BE3 cards */
-+#define OC_DEVICE_ID3 0xe220 /* Device id for Lancer cards */
-+
-+#define OC_SUBSYS_DEVICE_ID1 0xE602
-+#define OC_SUBSYS_DEVICE_ID2 0xE642
-+#define OC_SUBSYS_DEVICE_ID3 0xE612
-+#define OC_SUBSYS_DEVICE_ID4 0xE652
-
- static inline char *nic_name(struct pci_dev *pdev)
- {
- switch (pdev->device) {
- case OC_DEVICE_ID1:
-- case OC_DEVICE_ID2:
- return OC_NAME;
-+ case OC_DEVICE_ID2:
-+ return OC_NAME_BE;
- case OC_DEVICE_ID3:
-- return OC_NAME1;
-+ return OC_NAME_LANCER;
- case BE_DEVICE_ID2:
- return BE3_NAME;
- default:
-@@ -63,7 +84,7 @@ static inline char *nic_name(struct pci_dev *pdev)
- }
-
- /* Number of bytes of an RX frame that are copied to skb->data */
--#define BE_HDR_LEN 64
-+#define BE_HDR_LEN ((u16) 64)
- #define BE_MAX_JUMBO_FRAME_SIZE 9018
- #define BE_MIN_MTU 256
-
-@@ -79,10 +100,24 @@ static inline char *nic_name(struct pci_dev *pdev)
- #define MCC_Q_LEN 128 /* total size not to exceed 8 pages */
- #define MCC_CQ_LEN 256
-
-+#define MAX_RSS_QS 4 /* BE limit is 4 queues/port */
-+
-+#define MAX_RX_QS (MAX_RSS_QS + 1)
-+
-+#ifdef MQ_TX
-+#define MAX_TX_QS 8
-+#else
-+#define MAX_TX_QS 1
-+#endif
-+
-+#define BE_MAX_MSIX_VECTORS (MAX_RX_QS + 1)/* RSS qs + 1 def Rx + Tx */
- #define BE_NAPI_WEIGHT 64
--#define MAX_RX_POST BE_NAPI_WEIGHT /* Frags posted at a time */
-+#define MAX_RX_POST BE_NAPI_WEIGHT /* Frags posted at a time */
- #define RX_FRAGS_REFILL_WM (RX_Q_LEN - MAX_RX_POST)
-
-+#define BE_MAX_LRO_DESCRIPTORS 16
-+#define BE_MAX_FRAGS_PER_FRAME (min((u32) 16, (u32) MAX_SKB_FRAGS))
-+
- #define FW_VER_LEN 32
-
- struct be_dma_mem {
-@@ -127,6 +162,11 @@ static inline void *queue_tail_node(struct be_queue_info *q)
- return q->dma_mem.va + q->tail * q->entry_size;
- }
-
-+static inline void *queue_index_node(struct be_queue_info *q, u16 index)
-+{
-+ return q->dma_mem.va + index * q->entry_size;
-+}
-+
- static inline void queue_head_inc(struct be_queue_info *q)
- {
- index_inc(&q->head, q->len);
-@@ -137,6 +177,7 @@ static inline void queue_tail_inc(struct be_queue_info *q)
- index_inc(&q->tail, q->len);
- }
-
-+
- struct be_eq_obj {
- struct be_queue_info q;
- char desc[32];
-@@ -146,6 +187,7 @@ struct be_eq_obj {
- u16 min_eqd; /* in usecs */
- u16 max_eqd; /* in usecs */
- u16 cur_eqd; /* in usecs */
-+ u8 eq_idx;
-
- struct napi_struct napi;
- };
-@@ -153,49 +195,20 @@ struct be_eq_obj {
- struct be_mcc_obj {
- struct be_queue_info q;
- struct be_queue_info cq;
-+ bool rearm_cq;
- };
-
--struct be_drvr_stats {
-+struct be_tx_stats {
- u32 be_tx_reqs; /* number of TX requests initiated */
- u32 be_tx_stops; /* number of times TX Q was stopped */
-- u32 be_fwd_reqs; /* number of send reqs through forwarding i/f */
- u32 be_tx_wrbs; /* number of tx WRBs used */
-- u32 be_tx_events; /* number of tx completion events */
- u32 be_tx_compl; /* number of tx completion entries processed */
- ulong be_tx_jiffies;
- u64 be_tx_bytes;
- u64 be_tx_bytes_prev;
- u64 be_tx_pkts;
- u32 be_tx_rate;
--
-- u32 cache_barrier[16];
--
-- u32 be_ethrx_post_fail;/* number of ethrx buffer alloc failures */
-- u32 be_polls; /* number of times NAPI called poll function */
-- u32 be_rx_events; /* number of ucast rx completion events */
-- u32 be_rx_compl; /* number of rx completion entries processed */
-- ulong be_rx_jiffies;
-- u64 be_rx_bytes;
-- u64 be_rx_bytes_prev;
-- u64 be_rx_pkts;
-- u32 be_rx_rate;
-- /* number of non ether type II frames dropped where
-- * frame len > length field of Mac Hdr */
-- u32 be_802_3_dropped_frames;
-- /* number of non ether type II frames malformed where
-- * in frame len < length field of Mac Hdr */
-- u32 be_802_3_malformed_frames;
-- u32 be_rxcp_err; /* Num rx completion entries w/ err set. */
-- ulong rx_fps_jiffies; /* jiffies at last FPS calc */
-- u32 be_rx_frags;
-- u32 be_prev_rx_frags;
-- u32 be_rx_fps; /* Rx frags per second */
--};
--
--struct be_stats_obj {
-- struct be_drvr_stats drvr_stats;
-- struct net_device_stats net_stats;
-- struct be_dma_mem cmd;
-+ u32 be_ipv6_ext_hdr_tx_drop;
- };
-
- struct be_tx_obj {
-@@ -203,23 +216,124 @@ struct be_tx_obj {
- struct be_queue_info cq;
- /* Remember the skbs that were transmitted */
- struct sk_buff *sent_skb_list[TX_Q_LEN];
-+ struct be_tx_stats stats;
- };
-
- /* Struct to remember the pages posted for rx frags */
- struct be_rx_page_info {
- struct page *page;
-- dma_addr_t bus;
-+ DEFINE_DMA_UNMAP_ADDR(bus);
- u16 page_offset;
- bool last_page_user;
- };
-
-+struct be_rx_stats {
-+ u32 rx_post_fail;/* number of ethrx buffer alloc failures */
-+ u32 rx_polls; /* number of times NAPI called poll function */
-+ u32 rx_events; /* number of ucast rx completion events */
-+ u32 rx_compl; /* number of rx completion entries processed */
-+ ulong rx_jiffies;
-+ u64 rx_bytes;
-+ u64 rx_bytes_prev;
-+ u64 rx_pkts;
-+ u32 rx_rate;
-+ u32 rx_mcast_pkts;
-+ u32 rxcp_err; /* Num rx completion entries w/ err set. */
-+ ulong rx_fps_jiffies; /* jiffies at last FPS calc */
-+ u32 rx_frags;
-+ u32 prev_rx_frags;
-+ u32 rx_fps; /* Rx frags per second */
-+ u32 rx_drops_no_frags;
-+};
-+
-+struct be_rx_compl_info {
-+ u32 rss_hash;
-+ u16 vlan_tag;
-+ u16 pkt_size;
-+ u16 rxq_idx;
-+ u16 port;
-+ u8 vlanf;
-+ u8 num_rcvd;
-+ u8 err;
-+ u8 ipf;
-+ u8 tcpf;
-+ u8 udpf;
-+ u8 ip_csum;
-+ u8 l4_csum;
-+ u8 ipv6;
-+ u8 vtm;
-+ u8 pkt_type;
-+};
-+
- struct be_rx_obj {
-+ struct be_adapter *adapter;
- struct be_queue_info q;
- struct be_queue_info cq;
-- struct be_rx_page_info page_info_tbl[RX_Q_LEN];
-+ struct be_rx_compl_info rxcp;
-+ struct be_rx_page_info *page_info_tbl;
-+ struct net_lro_mgr lro_mgr;
-+ struct net_lro_desc lro_desc[BE_MAX_LRO_DESCRIPTORS];
-+ struct be_eq_obj rx_eq;
-+ struct be_rx_stats stats;
-+ u8 rss_id;
-+ bool rx_post_starved; /* Zero rx frags have been posted to BE */
-+ u16 prev_frag_idx;
-+ u32 cache_line_barrier[16];
- };
-
--#define BE_NUM_MSIX_VECTORS 2 /* 1 each for Tx and Rx */
-+struct be_drv_stats {
-+ u32 be_on_die_temperature;
-+ u32 be_tx_events;
-+ u32 eth_red_drops;
-+ u32 rx_drops_no_pbuf;
-+ u32 rx_drops_no_txpb;
-+ u32 rx_drops_no_erx_descr;
-+ u32 rx_drops_no_tpre_descr;
-+ u32 rx_drops_too_many_frags;
-+ u32 rx_drops_invalid_ring;
-+ u32 forwarded_packets;
-+ u32 rx_drops_mtu;
-+ u32 rx_crc_errors;
-+ u32 rx_alignment_symbol_errors;
-+ u32 rx_pause_frames;
-+ u32 rx_priority_pause_frames;
-+ u32 rx_control_frames;
-+ u32 rx_in_range_errors;
-+ u32 rx_out_range_errors;
-+ u32 rx_frame_too_long;
-+ u32 rx_address_match_errors;
-+ u32 rx_dropped_too_small;
-+ u32 rx_dropped_too_short;
-+ u32 rx_dropped_header_too_small;
-+ u32 rx_dropped_tcp_length;
-+ u32 rx_dropped_runt;
-+ u32 rx_ip_checksum_errs;
-+ u32 rx_tcp_checksum_errs;
-+ u32 rx_udp_checksum_errs;
-+ u32 rx_switched_unicast_packets;
-+ u32 rx_switched_multicast_packets;
-+ u32 rx_switched_broadcast_packets;
-+ u32 tx_pauseframes;
-+ u32 tx_priority_pauseframes;
-+ u32 tx_controlframes;
-+ u32 rxpp_fifo_overflow_drop;
-+ u32 rx_input_fifo_overflow_drop;
-+ u32 pmem_fifo_overflow_drop;
-+ u32 jabber_events;
-+};
-+
-+struct be_vf_cfg {
-+ unsigned char vf_mac_addr[ETH_ALEN];
-+ u32 vf_if_handle;
-+ u32 vf_pmac_id;
-+ u16 vf_def_vid;
-+ u16 vf_vlan_tag;
-+ u32 vf_tx_rate;
-+};
-+
-+#define BE_INVALID_PMAC_ID 0xffffffff
-+#define BE_FLAGS_DCBX (1 << 16)
-+
- struct be_adapter {
- struct pci_dev *pdev;
- struct net_device *netdev;
-@@ -228,7 +342,7 @@ struct be_adapter {
- u8 __iomem *db; /* Door Bell */
- u8 __iomem *pcicfg; /* PCI config space */
-
-- spinlock_t mbox_lock; /* For serializing mbox cmds to BE card */
-+ struct mutex mbox_lock; /* For serializing mbox cmds to BE card */
- struct be_dma_mem mbox_mem;
- /* Mbox mem is adjusted to align to 16 bytes. The allocated addr
- * is stored for freeing purpose */
-@@ -238,66 +352,121 @@ struct be_adapter {
- spinlock_t mcc_lock; /* For serializing mcc cmds to BE card */
- spinlock_t mcc_cq_lock;
-
-- struct msix_entry msix_entries[BE_NUM_MSIX_VECTORS];
-- bool msix_enabled;
-+ struct msix_entry msix_entries[BE_MAX_MSIX_VECTORS];
-+ u32 num_msix_vec;
- bool isr_registered;
-
- /* TX Rings */
- struct be_eq_obj tx_eq;
-- struct be_tx_obj tx_obj;
-+ struct be_tx_obj tx_obj[MAX_TX_QS];
-+ u8 num_tx_qs;
-+ u8 prio_tc_map[MAX_TX_QS]; /* prio_tc_map[prio] => tc-id */
-+ u8 tc_txq_map[MAX_TX_QS]; /* tc_txq_map[tc-id] => txq index */
-
- u32 cache_line_break[8];
-
- /* Rx rings */
-- struct be_eq_obj rx_eq;
-- struct be_rx_obj rx_obj;
-+ struct be_rx_obj rx_obj[MAX_RX_QS]; /* one default non-rss Q */
-+ u32 num_rx_qs;
-+
-+ struct be_dma_mem stats_cmd;
-+ struct net_device_stats net_stats;
-+ struct be_drv_stats drv_stats;
- u32 big_page_size; /* Compounded page size shared by rx wrbs */
-- bool rx_post_starved; /* Zero rx frags have been posted to BE */
-
- struct vlan_group *vlan_grp;
-- u16 num_vlans;
-+ u16 vlans_added;
-+ u16 max_vlans; /* Number of vlans supported */
- u8 vlan_tag[VLAN_GROUP_ARRAY_LEN];
-+ u8 vlan_prio_bmap; /* Available priority BitMap */
-+ u16 recommended_prio; /* Recommended Priority */
-+ struct be_dma_mem rx_filter;
-
-- struct be_stats_obj stats;
- /* Work queue used to perform periodic tasks like getting statistics */
- struct delayed_work work;
-+ u16 work_counter;
-
-- /* Ethtool knobs and info */
-- bool rx_csum; /* BE card must perform rx-checksumming */
-+ u32 flags;
-+ bool rx_csum; /* BE card must perform rx-checksumming */
-+ u32 max_rx_coal;
- char fw_ver[FW_VER_LEN];
- u32 if_handle; /* Used to configure filtering */
- u32 pmac_id; /* MAC addr handle used by BE card */
-+ u32 beacon_state; /* for set_phys_id */
-
-- bool link_up;
-+ bool eeh_err;
-+ int link_status;
- u32 port_num;
-+ u32 hba_port_num;
- bool promiscuous;
-- u32 cap;
-+ bool wol;
-+ u32 function_mode;
-+ u32 function_caps;
- u32 rx_fc; /* Rx flow control */
- u32 tx_fc; /* Tx flow control */
-+ bool ue_detected;
-+ bool stats_cmd_sent;
-+ bool gro_supported;
-+ int link_speed;
-+ u8 port_type;
-+ u8 transceiver;
-+ u8 autoneg;
- u8 generation; /* BladeEngine ASIC generation */
-+ u32 flash_status;
-+ struct completion flash_compl;
-+
-+ u8 eq_next_idx;
-+ bool be3_native;
-+ u16 num_vfs;
-+ struct be_vf_cfg *vf_cfg;
-+ u8 is_virtfn;
-+ u16 pvid;
-+ u32 sli_family;
-+ u8 port_name[4];
-+ char model_number[32];
- };
-
- /* BladeEngine Generation numbers */
- #define BE_GEN2 2
- #define BE_GEN3 3
-
--extern const struct ethtool_ops be_ethtool_ops;
-+#define ON 1
-+#define OFF 0
-+#define lancer_chip(adapter) (adapter->pdev->device == OC_DEVICE_ID3)
-+#define lancer_A0_chip(adapter) \
-+ (adapter->sli_family == LANCER_A0_SLI_FAMILY)
-
--#define drvr_stats(adapter) (&adapter->stats.drvr_stats)
-+extern struct ethtool_ops be_ethtool_ops;
-
--static inline unsigned int be_pci_func(struct be_adapter *adapter)
--{
-- return PCI_FUNC(adapter->pdev->devfn);
--}
-+#define msix_enabled(adapter) (adapter->num_msix_vec > 0)
-+#define tx_stats(txo) (&txo->stats)
-+#define rx_stats(rxo) (&rxo->stats)
-
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 29)
-+#define BE_SET_NETDEV_OPS(netdev, ops) be_netdev_ops_init(netdev, ops)
-+#else
- #define BE_SET_NETDEV_OPS(netdev, ops) (netdev->netdev_ops = ops)
-+#endif
-+
-+#define for_all_rx_queues(adapter, rxo, i) \
-+ for (i = 0, rxo = &adapter->rx_obj[i]; i < adapter->num_rx_qs; \
-+ i++, rxo++)
-+
-+/* Just skip the first default non-rss queue */
-+#define for_all_rss_queues(adapter, rxo, i) \
-+ for (i = 0, rxo = &adapter->rx_obj[i+1]; i < (adapter->num_rx_qs - 1);\
-+ i++, rxo++)
-+
-+#define for_all_tx_queues(adapter, txo, i) \
-+ for (i = 0, txo = &adapter->tx_obj[i]; i < adapter->num_tx_qs; \
-+ i++, txo++)
-
- #define PAGE_SHIFT_4K 12
- #define PAGE_SIZE_4K (1 << PAGE_SHIFT_4K)
-
- /* Returns number of pages spanned by the data starting at the given addr */
--#define PAGES_4K_SPANNED(_address, size) \
-- ((u32)((((size_t)(_address) & (PAGE_SIZE_4K - 1)) + \
-+#define PAGES_4K_SPANNED(_address, size) \
-+ ((u32)((((size_t)(_address) & (PAGE_SIZE_4K - 1)) + \
- (size) + (PAGE_SIZE_4K - 1)) >> PAGE_SHIFT_4K))
-
- /* Byte offset into the page corresponding to given address */
-@@ -305,7 +474,7 @@ static inline unsigned int be_pci_func(struct be_adapter *adapter)
- ((size_t)(addr) & (PAGE_SIZE_4K-1))
-
- /* Returns bit offset within a DWORD of a bitfield */
--#define AMAP_BIT_OFFSET(_struct, field) \
-+#define AMAP_BIT_OFFSET(_struct, field) \
- (((size_t)&(((_struct *)0)->field))%32)
-
- /* Returns the bit mask of the field that is NOT shifted into location. */
-@@ -356,6 +525,11 @@ static inline void swap_dws(void *wrb, int len)
- #endif /* __BIG_ENDIAN */
- }
-
-+static inline bool vlan_configured(struct be_adapter *adapter)
-+{
-+ return adapter->vlan_grp && adapter->vlans_added;
-+}
-+
- static inline u8 is_tcp_pkt(struct sk_buff *skb)
- {
- u8 val = 0;
-@@ -380,9 +554,65 @@ static inline u8 is_udp_pkt(struct sk_buff *skb)
- return val;
- }
-
-+static inline u8 is_ipv6_ext_hdr(struct sk_buff *skb)
-+{
-+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
-+ if (ip_hdr(skb)->version == 6)
-+ return ipv6_ext_hdr(ipv6_hdr(skb)->nexthdr);
-+ else
-+#endif
-+ return 0;
-+}
-+
-+static inline void be_check_sriov_fn_type(struct be_adapter *adapter)
-+{
-+ u32 sli_intf;
-+
-+ pci_read_config_dword(adapter->pdev, SLI_INTF_REG_OFFSET, &sli_intf);
-+ adapter->is_virtfn = (sli_intf & SLI_INTF_FT_MASK) ? 1 : 0;
-+}
-+
-+static inline void be_vf_eth_addr_generate(struct be_adapter *adapter, u8 *mac)
-+{
-+ u32 addr;
-+
-+ addr = jhash(adapter->netdev->dev_addr, ETH_ALEN, 0);
-+
-+ mac[5] = (u8)(addr & 0xFF);
-+ mac[4] = (u8)((addr >> 8) & 0xFF);
-+ mac[3] = (u8)((addr >> 16) & 0xFF);
-+ /* Use the OUI programmed in hardware */
-+ memcpy(mac, adapter->netdev->dev_addr, 3);
-+}
-+
-+static inline u16 be_get_tx_vlan_tag(struct be_adapter *adapter,
-+ struct sk_buff *skb)
-+{
-+ u8 vlan_prio = 0;
-+ u16 vlan_tag = 0;
-+
-+ vlan_tag = vlan_tx_tag_get(skb);
-+ vlan_prio = (vlan_tag & VLAN_PRIO_MASK) >> VLAN_PRIO_SHIFT;
-+ /* If vlan priority provided by OS is NOT in available bmap */
-+ if (!(adapter->vlan_prio_bmap & (1 << vlan_prio)))
-+ vlan_tag = (vlan_tag & ~VLAN_PRIO_MASK) |
-+ adapter->recommended_prio;
-+
-+ return vlan_tag;
-+}
-+
-+#define be_physfn(adapter) (!adapter->is_virtfn)
-+
- extern void be_cq_notify(struct be_adapter *adapter, u16 qid, bool arm,
- u16 num_popped);
--extern void be_link_status_update(struct be_adapter *adapter, bool link_up);
-+extern void be_link_status_update(struct be_adapter *adapter, int link_status);
- extern void netdev_stats_update(struct be_adapter *adapter);
-+extern void be_parse_stats(struct be_adapter *adapter);
- extern int be_load_fw(struct be_adapter *adapter, u8 *func);
-+
-+#ifdef CONFIG_PALAU
-+extern void be_sysfs_create_group(struct be_adapter *adapter);
-+extern void be_sysfs_remove_group(struct be_adapter *adapter);
-+#endif
-+
- #endif /* BE_H */
-diff --git a/drivers/net/benet/be_cmds.c b/drivers/net/benet/be_cmds.c
-index 28a0eda..b4ca89c 100644
---- a/drivers/net/benet/be_cmds.c
-+++ b/drivers/net/benet/be_cmds.c
-@@ -1,30 +1,45 @@
- /*
-- * Copyright (C) 2005 - 2009 ServerEngines
-+ * Copyright (C) 2005 - 2011 Emulex
- * All rights reserved.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License version 2
-- * as published by the Free Software Foundation. The full GNU General
-+ * as published by the Free Software Foundation. The full GNU General
- * Public License is included in this distribution in the file called COPYING.
- *
- * Contact Information:
-- * linux-drivers@serverengines.com
-+ * linux-drivers@emulex.com
- *
-- * ServerEngines
-- * 209 N. Fair Oaks Ave
-- * Sunnyvale, CA 94085
-+ * Emulex
-+ * 3333 Susan Street
-+ * Costa Mesa, CA 92626
- */
-
- #include "be.h"
- #include "be_cmds.h"
-
-+/* Must be a power of 2 or else MODULO will BUG_ON */
-+static int be_get_temp_freq = 64;
-+
-+static inline void *embedded_payload(struct be_mcc_wrb *wrb)
-+{
-+ return wrb->payload.embedded_payload;
-+}
-+
- static void be_mcc_notify(struct be_adapter *adapter)
- {
- struct be_queue_info *mccq = &adapter->mcc_obj.q;
- u32 val = 0;
-
-+ if (adapter->eeh_err) {
-+ dev_info(&adapter->pdev->dev, "Error in Card Detected! Cannot issue commands\n");
-+ return;
-+ }
-+
- val |= mccq->id & DB_MCCQ_RING_ID_MASK;
- val |= 1 << DB_MCCQ_NUM_POSTED_SHIFT;
-+
-+ wmb();
- iowrite32(val, adapter->db + DB_MCCQ_OFFSET);
- }
-
-@@ -59,21 +74,67 @@ static int be_mcc_compl_process(struct be_adapter *adapter,
-
- compl_status = (compl->status >> CQE_STATUS_COMPL_SHIFT) &
- CQE_STATUS_COMPL_MASK;
-+
-+ if ((compl->tag0 == OPCODE_COMMON_WRITE_FLASHROM) &&
-+ (compl->tag1 == CMD_SUBSYSTEM_COMMON)) {
-+ adapter->flash_status = compl_status;
-+ complete(&adapter->flash_compl);
-+ }
-+
- if (compl_status == MCC_STATUS_SUCCESS) {
-- if (compl->tag0 == OPCODE_ETH_GET_STATISTICS) {
-- struct be_cmd_resp_get_stats *resp =
-- adapter->stats.cmd.va;
-- be_dws_le_to_cpu(&resp->hw_stats,
-- sizeof(resp->hw_stats));
-+ if ((compl->tag0 == OPCODE_ETH_GET_STATISTICS) &&
-+ (compl->tag1 == CMD_SUBSYSTEM_ETH)) {
-+ if (adapter->generation == BE_GEN3) {
-+ struct be_cmd_resp_get_stats_v1 *resp =
-+ adapter->stats_cmd.va;
-+
-+ be_dws_le_to_cpu(&resp->hw_stats,
-+ sizeof(resp->hw_stats));
-+ } else {
-+ struct be_cmd_resp_get_stats_v0 *resp =
-+ adapter->stats_cmd.va;
-+
-+ be_dws_le_to_cpu(&resp->hw_stats,
-+ sizeof(resp->hw_stats));
-+ }
-+ be_parse_stats(adapter);
- netdev_stats_update(adapter);
-+ adapter->stats_cmd_sent = false;
-+ }
-+ if (compl->tag0 ==
-+ OPCODE_COMMON_GET_CNTL_ADDITIONAL_ATTRIBUTES) {
-+ struct be_mcc_wrb *mcc_wrb =
-+ queue_index_node(&adapter->mcc_obj.q,
-+ compl->tag1);
-+ struct be_cmd_resp_get_cntl_addnl_attribs *resp =
-+ embedded_payload(mcc_wrb);
-+ adapter->drv_stats.be_on_die_temperature =
-+ resp->on_die_temperature;
-+ }
-+ } else {
-+ if (compl->tag0 == OPCODE_COMMON_GET_CNTL_ADDITIONAL_ATTRIBUTES)
-+ be_get_temp_freq = 0;
-+
-+ if (compl->tag1 == MCC_WRB_PASS_THRU)
-+ goto done;
-+
-+ if (compl_status == MCC_STATUS_NOT_SUPPORTED ||
-+ compl_status == MCC_STATUS_ILLEGAL_REQUEST)
-+ goto done;
-+
-+ if (compl_status == MCC_STATUS_UNAUTHORIZED_REQUEST) {
-+ dev_warn(&adapter->pdev->dev, "This domain(VM) is not "
-+ "permitted to execute this cmd (opcode %d)\n",
-+ compl->tag0);
-+ } else {
-+ extd_status = (compl->status >> CQE_STATUS_EXTD_SHIFT) &
-+ CQE_STATUS_EXTD_MASK;
-+ dev_err(&adapter->pdev->dev, "Cmd (opcode %d) failed:"
-+ "status %d, extd-status %d\n",
-+ compl->tag0, compl_status, extd_status);
- }
-- } else if (compl_status != MCC_STATUS_NOT_SUPPORTED) {
-- extd_status = (compl->status >> CQE_STATUS_EXTD_SHIFT) &
-- CQE_STATUS_EXTD_MASK;
-- dev_warn(&adapter->pdev->dev,
-- "Error in cmd completion: status(compl/extd)=%d/%d\n",
-- compl_status, extd_status);
- }
-+done:
- return compl_status;
- }
-
-@@ -82,7 +143,70 @@ static void be_async_link_state_process(struct be_adapter *adapter,
- struct be_async_event_link_state *evt)
- {
- be_link_status_update(adapter,
-- evt->port_link_status == ASYNC_EVENT_LINK_UP);
-+ ((evt->port_link_status & ~ASYNC_EVENT_LOGICAL) ==
-+ ASYNC_EVENT_LINK_UP ? LINK_UP : LINK_DOWN));
-+}
-+
-+/* Grp5 CoS Priority evt */
-+static void be_async_grp5_cos_priority_process(struct be_adapter *adapter,
-+ struct be_async_event_grp5_cos_priority *evt)
-+{
-+ if (evt->valid) {
-+ adapter->vlan_prio_bmap = evt->available_priority_bmap;
-+ adapter->recommended_prio &= ~VLAN_PRIO_MASK;
-+ adapter->recommended_prio =
-+ evt->reco_default_priority << VLAN_PRIO_SHIFT;
-+ }
-+}
-+
-+/* Grp5 QOS Speed evt */
-+static void be_async_grp5_qos_speed_process(struct be_adapter *adapter,
-+ struct be_async_event_grp5_qos_link_speed *evt)
-+{
-+ if (evt->physical_port == adapter->hba_port_num) {
-+ /* qos_link_speed is in units of 10 Mbps */
-+ adapter->link_speed = evt->qos_link_speed * 10;
-+ }
-+}
-+
-+/*Grp5 PVID evt*/
-+static void be_async_grp5_pvid_state_process(struct be_adapter *adapter,
-+ struct be_async_event_grp5_pvid_state *evt)
-+{
-+ if (evt->enabled)
-+ adapter->pvid = le16_to_cpu(evt->tag) & VLAN_VID_MASK ;
-+ else
-+ adapter->pvid = 0;
-+}
-+
-+static void be_async_grp5_evt_process(struct be_adapter *adapter,
-+ u32 trailer, struct be_mcc_compl *evt)
-+{
-+ u8 event_type = 0;
-+
-+ event_type = (trailer >> ASYNC_TRAILER_EVENT_TYPE_SHIFT) &
-+ ASYNC_TRAILER_EVENT_TYPE_MASK;
-+
-+ switch (event_type) {
-+ case ASYNC_EVENT_COS_PRIORITY:
-+ be_async_grp5_cos_priority_process(adapter,
-+ (struct be_async_event_grp5_cos_priority *)evt);
-+ break;
-+ case ASYNC_EVENT_QOS_SPEED:
-+ be_async_grp5_qos_speed_process(adapter,
-+ (struct be_async_event_grp5_qos_link_speed *)evt);
-+ break;
-+ case ASYNC_EVENT_PVID_STATE:
-+ be_async_grp5_pvid_state_process(adapter,
-+ (struct be_async_event_grp5_pvid_state *)evt);
-+ break;
-+ case GRP5_TYPE_PRIO_TC_MAP:
-+ memcpy(adapter->prio_tc_map, evt, MAX_TX_QS);
-+ break;
-+ default:
-+ printk(KERN_WARNING "Unknown grp5 event!\n");
-+ break;
-+ }
- }
-
- static inline bool is_link_state_evt(u32 trailer)
-@@ -92,6 +216,13 @@ static inline bool is_link_state_evt(u32 trailer)
- ASYNC_EVENT_CODE_LINK_STATE);
- }
-
-+static inline bool is_grp5_evt(u32 trailer)
-+{
-+ return (((trailer >> ASYNC_TRAILER_EVENT_CODE_SHIFT) &
-+ ASYNC_TRAILER_EVENT_CODE_MASK) ==
-+ ASYNC_EVENT_CODE_GRP_5);
-+}
-+
- static struct be_mcc_compl *be_mcc_compl_get(struct be_adapter *adapter)
- {
- struct be_queue_info *mcc_cq = &adapter->mcc_obj.cq;
-@@ -104,46 +235,67 @@ static struct be_mcc_compl *be_mcc_compl_get(struct be_adapter *adapter)
- return NULL;
- }
-
--int be_process_mcc(struct be_adapter *adapter)
-+void be_async_mcc_enable(struct be_adapter *adapter)
-+{
-+ spin_lock_bh(&adapter->mcc_cq_lock);
-+
-+ be_cq_notify(adapter, adapter->mcc_obj.cq.id, true, 0);
-+ adapter->mcc_obj.rearm_cq = true;
-+
-+ spin_unlock_bh(&adapter->mcc_cq_lock);
-+}
-+
-+void be_async_mcc_disable(struct be_adapter *adapter)
-+{
-+ adapter->mcc_obj.rearm_cq = false;
-+}
-+
-+int be_process_mcc(struct be_adapter *adapter, int *status)
- {
- struct be_mcc_compl *compl;
-- int num = 0, status = 0;
-+ int num = 0;
-+ struct be_mcc_obj *mcc_obj = &adapter->mcc_obj;
-
- spin_lock_bh(&adapter->mcc_cq_lock);
- while ((compl = be_mcc_compl_get(adapter))) {
- if (compl->flags & CQE_FLAGS_ASYNC_MASK) {
- /* Interpret flags as an async trailer */
-- BUG_ON(!is_link_state_evt(compl->flags));
--
-- /* Interpret compl as a async link evt */
-- be_async_link_state_process(adapter,
-+ if (is_link_state_evt(compl->flags))
-+ be_async_link_state_process(adapter,
- (struct be_async_event_link_state *) compl);
-+ else if (is_grp5_evt(compl->flags))
-+ be_async_grp5_evt_process(adapter,
-+ compl->flags, compl);
-+
- } else if (compl->flags & CQE_FLAGS_COMPLETED_MASK) {
-- status = be_mcc_compl_process(adapter, compl);
-- atomic_dec(&adapter->mcc_obj.q.used);
-+ *status = be_mcc_compl_process(adapter, compl);
-+ atomic_dec(&mcc_obj->q.used);
- }
- be_mcc_compl_use(compl);
- num++;
- }
-
-- if (num)
-- be_cq_notify(adapter, adapter->mcc_obj.cq.id, true, num);
--
- spin_unlock_bh(&adapter->mcc_cq_lock);
-- return status;
-+ return num;
- }
-
- /* Wait till no more pending mcc requests are present */
- static int be_mcc_wait_compl(struct be_adapter *adapter)
- {
- #define mcc_timeout 120000 /* 12s timeout */
-- int i, status;
-+ int i, num, status = 0;
-+ struct be_mcc_obj *mcc_obj = &adapter->mcc_obj;
-+
-+ if (adapter->eeh_err)
-+ return -EIO;
-+
- for (i = 0; i < mcc_timeout; i++) {
-- status = be_process_mcc(adapter);
-- if (status)
-- return status;
-+ num = be_process_mcc(adapter, &status);
-+ if (num)
-+ be_cq_notify(adapter, mcc_obj->cq.id,
-+ mcc_obj->rearm_cq, num);
-
-- if (atomic_read(&adapter->mcc_obj.q.used) == 0)
-+ if (atomic_read(&mcc_obj->q.used) == 0)
- break;
- udelay(100);
- }
-@@ -151,7 +303,7 @@ static int be_mcc_wait_compl(struct be_adapter *adapter)
- dev_err(&adapter->pdev->dev, "mccq poll timed out\n");
- return -1;
- }
-- return 0;
-+ return status;
- }
-
- /* Notify MCC requests and wait for completion */
-@@ -163,23 +315,34 @@ static int be_mcc_notify_wait(struct be_adapter *adapter)
-
- static int be_mbox_db_ready_wait(struct be_adapter *adapter, void __iomem *db)
- {
-- int cnt = 0, wait = 5;
-+ int msecs = 0;
- u32 ready;
-
-+ if (adapter->eeh_err) {
-+ dev_err(&adapter->pdev->dev, "Error detected in card.Cannot issue commands\n");
-+ return -EIO;
-+ }
- do {
-- ready = ioread32(db) & MPU_MAILBOX_DB_RDY_MASK;
-+ ready = ioread32(db);
-+ if (ready == 0xffffffff) {
-+ dev_err(&adapter->pdev->dev,
-+ "pci slot disconnected\n");
-+ return -1;
-+ }
-+
-+ ready &= MPU_MAILBOX_DB_RDY_MASK;
- if (ready)
- break;
-
-- if (cnt > 4000000) {
-+ if (msecs > 4000) {
- dev_err(&adapter->pdev->dev, "mbox poll timed out\n");
-+ be_detect_dump_ue(adapter);
- return -1;
- }
-
-- if (cnt > 50)
-- wait = 200;
-- cnt += wait;
-- udelay(wait);
-+ set_current_state(TASK_UNINTERRUPTIBLE);
-+ schedule_timeout(msecs_to_jiffies(1));
-+ msecs++;
- } while (true);
-
- return 0;
-@@ -198,6 +361,11 @@ static int be_mbox_notify_wait(struct be_adapter *adapter)
- struct be_mcc_mailbox *mbox = mbox_mem->va;
- struct be_mcc_compl *compl = &mbox->compl;
-
-+ /* wait for ready to be set */
-+ status = be_mbox_db_ready_wait(adapter, db);
-+ if (status != 0)
-+ return status;
-+
- val |= MPU_MAILBOX_DB_HI_MASK;
- /* at bits 2 - 31 place mbox dma addr msb bits 34 - 63 */
- val |= (upper_32_bits(mbox_mem->dma) >> 2) << 2;
-@@ -232,7 +400,12 @@ static int be_mbox_notify_wait(struct be_adapter *adapter)
-
- static int be_POST_stage_get(struct be_adapter *adapter, u16 *stage)
- {
-- u32 sem = ioread32(adapter->csr + MPU_EP_SEMAPHORE_OFFSET);
-+ u32 sem;
-+
-+ if (lancer_chip(adapter))
-+ sem = ioread32(adapter->db + MPU_EP_SEMAPHORE_IF_TYPE2_OFFSET);
-+ else
-+ sem = ioread32(adapter->csr + MPU_EP_SEMAPHORE_OFFSET);
-
- *stage = sem & EP_SEMAPHORE_POST_STAGE_MASK;
- if ((sem >> EP_SEMAPHORE_POST_ERR_SHIFT) & EP_SEMAPHORE_POST_ERR_MASK)
-@@ -245,30 +418,29 @@ int be_cmd_POST(struct be_adapter *adapter)
- {
- u16 stage;
- int status, timeout = 0;
-+ struct device *dev = &adapter->pdev->dev;
-
- do {
- status = be_POST_stage_get(adapter, &stage);
- if (status) {
-- dev_err(&adapter->pdev->dev, "POST error; stage=0x%x\n",
-- stage);
-+ dev_err(dev, "POST error; stage=0x%x\n", stage);
- return -1;
- } else if (stage != POST_STAGE_ARMFW_RDY) {
- set_current_state(TASK_INTERRUPTIBLE);
-- schedule_timeout(2 * HZ);
-+ if (schedule_timeout(2 * HZ)) {
-+ dev_err(dev, "POST cmd aborted\n");
-+ return -EINTR;
-+ }
- timeout += 2;
- } else {
- return 0;
- }
-- } while (timeout < 20);
-+ } while (timeout < 40);
-
-- dev_err(&adapter->pdev->dev, "POST timeout; stage=0x%x\n", stage);
-+ dev_err(dev, "POST timeout; stage=0x%x\n", stage);
- return -1;
- }
-
--static inline void *embedded_payload(struct be_mcc_wrb *wrb)
--{
-- return wrb->payload.embedded_payload;
--}
-
- static inline struct be_sge *nonembedded_sgl(struct be_mcc_wrb *wrb)
- {
-@@ -277,7 +449,7 @@ static inline struct be_sge *nonembedded_sgl(struct be_mcc_wrb *wrb)
-
- /* Don't touch the hdr after it's prepared */
- static void be_wrb_hdr_prepare(struct be_mcc_wrb *wrb, int payload_len,
-- bool embedded, u8 sge_cnt)
-+ bool embedded, u8 sge_cnt, u32 opcode)
- {
- if (embedded)
- wrb->embedded |= MCC_WRB_EMBEDDED_MASK;
-@@ -285,7 +457,8 @@ static void be_wrb_hdr_prepare(struct be_mcc_wrb *wrb, int payload_len,
- wrb->embedded |= (sge_cnt & MCC_WRB_SGE_CNT_MASK) <<
- MCC_WRB_SGE_CNT_SHIFT;
- wrb->payload_length = payload_len;
-- be_dws_cpu_to_le(wrb, 20);
-+ wrb->tag0 = opcode;
-+ be_dws_cpu_to_le(wrb, 8);
- }
-
- /* Don't touch the hdr after it's prepared */
-@@ -295,6 +468,7 @@ static void be_cmd_hdr_prepare(struct be_cmd_req_hdr *req_hdr,
- req_hdr->opcode = opcode;
- req_hdr->subsystem = subsystem;
- req_hdr->request_length = cpu_to_le32(cmd_len - sizeof(*req_hdr));
-+ req_hdr->version = 0;
- }
-
- static void be_cmd_page_addrs_prepare(struct phys_addr *pages, u32 max_pages,
-@@ -349,7 +523,11 @@ static struct be_mcc_wrb *wrb_from_mccq(struct be_adapter *adapter)
- struct be_queue_info *mccq = &adapter->mcc_obj.q;
- struct be_mcc_wrb *wrb;
-
-- BUG_ON(atomic_read(&mccq->used) >= mccq->len);
-+ if (atomic_read(&mccq->used) >= mccq->len) {
-+ dev_err(&adapter->pdev->dev, "Out of MCCQ wrbs\n");
-+ return NULL;
-+ }
-+
- wrb = queue_head_node(mccq);
- queue_head_inc(mccq);
- atomic_inc(&mccq->used);
-@@ -357,6 +535,59 @@ static struct be_mcc_wrb *wrb_from_mccq(struct be_adapter *adapter)
- return wrb;
- }
-
-+/* Tell fw we're about to start firing cmds by writing a
-+ * special pattern across the wrb hdr; uses mbox
-+ */
-+int be_cmd_fw_init(struct be_adapter *adapter)
-+{
-+ u8 *wrb;
-+ int status;
-+
-+ if (mutex_lock_interruptible(&adapter->mbox_lock))
-+ return -1;
-+
-+ wrb = (u8 *)wrb_from_mbox(adapter);
-+ *wrb++ = 0xFF;
-+ *wrb++ = 0x12;
-+ *wrb++ = 0x34;
-+ *wrb++ = 0xFF;
-+ *wrb++ = 0xFF;
-+ *wrb++ = 0x56;
-+ *wrb++ = 0x78;
-+ *wrb = 0xFF;
-+
-+ status = be_mbox_notify_wait(adapter);
-+
-+ mutex_unlock(&adapter->mbox_lock);
-+ return status;
-+}
-+
-+/* Tell fw we're done with firing cmds by writing a
-+ * special pattern across the wrb hdr; uses mbox
-+ */
-+int be_cmd_fw_clean(struct be_adapter *adapter)
-+{
-+ u8 *wrb;
-+ int status;
-+
-+ if (mutex_lock_interruptible(&adapter->mbox_lock))
-+ return -1;
-+
-+ wrb = (u8 *)wrb_from_mbox(adapter);
-+ *wrb++ = 0xFF;
-+ *wrb++ = 0xAA;
-+ *wrb++ = 0xBB;
-+ *wrb++ = 0xFF;
-+ *wrb++ = 0xFF;
-+ *wrb++ = 0xCC;
-+ *wrb++ = 0xDD;
-+ *wrb = 0xFF;
-+
-+ status = be_mbox_notify_wait(adapter);
-+
-+ mutex_unlock(&adapter->mbox_lock);
-+ return status;
-+}
- int be_cmd_eq_create(struct be_adapter *adapter,
- struct be_queue_info *eq, int eq_delay)
- {
-@@ -365,20 +596,19 @@ int be_cmd_eq_create(struct be_adapter *adapter,
- struct be_dma_mem *q_mem = &eq->dma_mem;
- int status;
-
-- spin_lock(&adapter->mbox_lock);
-+ if (mutex_lock_interruptible(&adapter->mbox_lock))
-+ return -1;
-
- wrb = wrb_from_mbox(adapter);
- req = embedded_payload(wrb);
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0, OPCODE_COMMON_EQ_CREATE);
-
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
- OPCODE_COMMON_EQ_CREATE, sizeof(*req));
-
- req->num_pages = cpu_to_le16(PAGES_4K_SPANNED(q_mem->va, q_mem->size));
-
-- AMAP_SET_BITS(struct amap_eq_context, func, req->context,
-- be_pci_func(adapter));
- AMAP_SET_BITS(struct amap_eq_context, valid, req->context, 1);
- /* 4byte eqe*/
- AMAP_SET_BITS(struct amap_eq_context, size, req->context, 0);
-@@ -397,7 +627,7 @@ int be_cmd_eq_create(struct be_adapter *adapter,
- eq->created = true;
- }
-
-- spin_unlock(&adapter->mbox_lock);
-+ mutex_unlock(&adapter->mbox_lock);
- return status;
- }
-
-@@ -409,12 +639,14 @@ int be_cmd_mac_addr_query(struct be_adapter *adapter, u8 *mac_addr,
- struct be_cmd_req_mac_query *req;
- int status;
-
-- spin_lock(&adapter->mbox_lock);
-+ if (mutex_lock_interruptible(&adapter->mbox_lock))
-+ return -1;
-
- wrb = wrb_from_mbox(adapter);
- req = embedded_payload(wrb);
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_NTWK_MAC_QUERY);
-
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
- OPCODE_COMMON_NTWK_MAC_QUERY, sizeof(*req));
-@@ -433,13 +665,13 @@ int be_cmd_mac_addr_query(struct be_adapter *adapter, u8 *mac_addr,
- memcpy(mac_addr, resp->mac.addr, ETH_ALEN);
- }
-
-- spin_unlock(&adapter->mbox_lock);
-+ mutex_unlock(&adapter->mbox_lock);
- return status;
- }
-
- /* Uses synchronous MCCQ */
- int be_cmd_pmac_add(struct be_adapter *adapter, u8 *mac_addr,
-- u32 if_id, u32 *pmac_id)
-+ u32 if_id, u32 *pmac_id, u32 domain)
- {
- struct be_mcc_wrb *wrb;
- struct be_cmd_req_pmac_add *req;
-@@ -448,13 +680,19 @@ int be_cmd_pmac_add(struct be_adapter *adapter, u8 *mac_addr,
- spin_lock_bh(&adapter->mcc_lock);
-
- wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
- req = embedded_payload(wrb);
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_NTWK_PMAC_ADD);
-
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
- OPCODE_COMMON_NTWK_PMAC_ADD, sizeof(*req));
-
-+ req->hdr.domain = domain;
- req->if_id = cpu_to_le32(if_id);
- memcpy(req->mac_address, mac_addr, ETH_ALEN);
-
-@@ -464,12 +702,13 @@ int be_cmd_pmac_add(struct be_adapter *adapter, u8 *mac_addr,
- *pmac_id = le32_to_cpu(resp->pmac_id);
- }
-
-+err:
- spin_unlock_bh(&adapter->mcc_lock);
- return status;
- }
-
- /* Uses synchronous MCCQ */
--int be_cmd_pmac_del(struct be_adapter *adapter, u32 if_id, u32 pmac_id)
-+int be_cmd_pmac_del(struct be_adapter *adapter, u32 if_id, u32 pmac_id, u32 dom)
- {
- struct be_mcc_wrb *wrb;
- struct be_cmd_req_pmac_del *req;
-@@ -478,20 +717,26 @@ int be_cmd_pmac_del(struct be_adapter *adapter, u32 if_id, u32 pmac_id)
- spin_lock_bh(&adapter->mcc_lock);
-
- wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
- req = embedded_payload(wrb);
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_NTWK_PMAC_DEL);
-
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
- OPCODE_COMMON_NTWK_PMAC_DEL, sizeof(*req));
-
-+ req->hdr.domain = dom;
- req->if_id = cpu_to_le32(if_id);
- req->pmac_id = cpu_to_le32(pmac_id);
-
- status = be_mcc_notify_wait(adapter);
-
-+err:
- spin_unlock_bh(&adapter->mcc_lock);
--
- return status;
- }
-
-@@ -506,29 +751,51 @@ int be_cmd_cq_create(struct be_adapter *adapter,
- void *ctxt;
- int status;
-
-- spin_lock(&adapter->mbox_lock);
-+ if (mutex_lock_interruptible(&adapter->mbox_lock))
-+ return -1;
-
- wrb = wrb_from_mbox(adapter);
- req = embedded_payload(wrb);
- ctxt = &req->context;
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_CQ_CREATE);
-
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
- OPCODE_COMMON_CQ_CREATE, sizeof(*req));
-
- req->num_pages = cpu_to_le16(PAGES_4K_SPANNED(q_mem->va, q_mem->size));
-
-- AMAP_SET_BITS(struct amap_cq_context, coalescwm, ctxt, coalesce_wm);
-- AMAP_SET_BITS(struct amap_cq_context, nodelay, ctxt, no_delay);
-- AMAP_SET_BITS(struct amap_cq_context, count, ctxt,
-- __ilog2_u32(cq->len/256));
-- AMAP_SET_BITS(struct amap_cq_context, valid, ctxt, 1);
-- AMAP_SET_BITS(struct amap_cq_context, solevent, ctxt, sol_evts);
-- AMAP_SET_BITS(struct amap_cq_context, eventable, ctxt, 1);
-- AMAP_SET_BITS(struct amap_cq_context, eqid, ctxt, eq->id);
-- AMAP_SET_BITS(struct amap_cq_context, armed, ctxt, 1);
-- AMAP_SET_BITS(struct amap_cq_context, func, ctxt, be_pci_func(adapter));
-+ if (lancer_chip(adapter)) {
-+ req->hdr.version = 2;
-+ req->page_size = 1; /* 1 for 4K */
-+ AMAP_SET_BITS(struct amap_cq_context_lancer, coalescwm, ctxt,
-+ coalesce_wm);
-+ AMAP_SET_BITS(struct amap_cq_context_lancer, nodelay, ctxt,
-+ no_delay);
-+ AMAP_SET_BITS(struct amap_cq_context_lancer, count, ctxt,
-+ __ilog2_u32(cq->len/256));
-+ AMAP_SET_BITS(struct amap_cq_context_lancer, valid, ctxt, 1);
-+ AMAP_SET_BITS(struct amap_cq_context_lancer, eventable,
-+ ctxt, 1);
-+ AMAP_SET_BITS(struct amap_cq_context_lancer, eqid,
-+ ctxt, eq->id);
-+ AMAP_SET_BITS(struct amap_cq_context_lancer, armed, ctxt, 1);
-+ } else {
-+ AMAP_SET_BITS(struct amap_cq_context_be, coalescwm, ctxt,
-+ coalesce_wm);
-+ AMAP_SET_BITS(struct amap_cq_context_be, nodelay,
-+ ctxt, no_delay);
-+ AMAP_SET_BITS(struct amap_cq_context_be, count, ctxt,
-+ __ilog2_u32(cq->len/256));
-+ AMAP_SET_BITS(struct amap_cq_context_be, valid, ctxt, 1);
-+ AMAP_SET_BITS(struct amap_cq_context_be, solevent,
-+ ctxt, sol_evts);
-+ AMAP_SET_BITS(struct amap_cq_context_be, eventable, ctxt, 1);
-+ AMAP_SET_BITS(struct amap_cq_context_be, eqid, ctxt, eq->id);
-+ AMAP_SET_BITS(struct amap_cq_context_be, armed, ctxt, 1);
-+ }
-+
- be_dws_cpu_to_le(ctxt, sizeof(req->context));
-
- be_cmd_page_addrs_prepare(req->pages, ARRAY_SIZE(req->pages), q_mem);
-@@ -540,8 +807,7 @@ int be_cmd_cq_create(struct be_adapter *adapter,
- cq->created = true;
- }
-
-- spin_unlock(&adapter->mbox_lock);
--
-+ mutex_unlock(&adapter->mbox_lock);
- return status;
- }
-
-@@ -553,7 +819,68 @@ static u32 be_encoded_q_len(int q_len)
- return len_encoded;
- }
-
--int be_cmd_mccq_create(struct be_adapter *adapter,
-+int be_cmd_mccq_ext_create(struct be_adapter *adapter,
-+ struct be_queue_info *mccq,
-+ struct be_queue_info *cq)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_mcc_ext_create *req;
-+ struct be_dma_mem *q_mem = &mccq->dma_mem;
-+ void *ctxt;
-+ int status;
-+
-+ if (mutex_lock_interruptible(&adapter->mbox_lock))
-+ return -1;
-+
-+ wrb = wrb_from_mbox(adapter);
-+ req = embedded_payload(wrb);
-+ ctxt = &req->context;
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_MCC_CREATE_EXT);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_MCC_CREATE_EXT, sizeof(*req));
-+
-+ req->num_pages = cpu_to_le16(PAGES_4K_SPANNED(q_mem->va, q_mem->size));
-+ if (lancer_chip(adapter)) {
-+ req->hdr.version = 1;
-+ req->cq_id = cpu_to_le16(cq->id);
-+
-+ AMAP_SET_BITS(struct amap_mcc_context_lancer, ring_size, ctxt,
-+ be_encoded_q_len(mccq->len));
-+ AMAP_SET_BITS(struct amap_mcc_context_lancer, valid, ctxt, 1);
-+ AMAP_SET_BITS(struct amap_mcc_context_lancer, async_cq_id,
-+ ctxt, cq->id);
-+ AMAP_SET_BITS(struct amap_mcc_context_lancer, async_cq_valid,
-+ ctxt, 1);
-+
-+ } else {
-+ AMAP_SET_BITS(struct amap_mcc_context_be, valid, ctxt, 1);
-+ AMAP_SET_BITS(struct amap_mcc_context_be, ring_size, ctxt,
-+ be_encoded_q_len(mccq->len));
-+ AMAP_SET_BITS(struct amap_mcc_context_be, cq_id, ctxt, cq->id);
-+ }
-+
-+ /* Subscribe to Link State and Group 5 Events(bits 1 and 5 set) */
-+ req->async_event_bitmap[0] |= cpu_to_le32(0x00000022);
-+
-+ be_dws_cpu_to_le(ctxt, sizeof(req->context));
-+
-+ be_cmd_page_addrs_prepare(req->pages, ARRAY_SIZE(req->pages), q_mem);
-+
-+ status = be_mbox_notify_wait(adapter);
-+ if (!status) {
-+ struct be_cmd_resp_mcc_create *resp = embedded_payload(wrb);
-+ mccq->id = le16_to_cpu(resp->id);
-+ mccq->created = true;
-+ }
-+
-+ mutex_unlock(&adapter->mbox_lock);
-+ return status;
-+}
-+
-+int be_cmd_mccq_org_create(struct be_adapter *adapter,
- struct be_queue_info *mccq,
- struct be_queue_info *cq)
- {
-@@ -563,24 +890,25 @@ int be_cmd_mccq_create(struct be_adapter *adapter,
- void *ctxt;
- int status;
-
-- spin_lock(&adapter->mbox_lock);
-+ if (mutex_lock_interruptible(&adapter->mbox_lock))
-+ return -1;
-
- wrb = wrb_from_mbox(adapter);
- req = embedded_payload(wrb);
- ctxt = &req->context;
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_MCC_CREATE);
-
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
- OPCODE_COMMON_MCC_CREATE, sizeof(*req));
-
-- req->num_pages = PAGES_4K_SPANNED(q_mem->va, q_mem->size);
-+ req->num_pages = cpu_to_le16(PAGES_4K_SPANNED(q_mem->va, q_mem->size));
-
-- AMAP_SET_BITS(struct amap_mcc_context, fid, ctxt, be_pci_func(adapter));
-- AMAP_SET_BITS(struct amap_mcc_context, valid, ctxt, 1);
-- AMAP_SET_BITS(struct amap_mcc_context, ring_size, ctxt,
-- be_encoded_q_len(mccq->len));
-- AMAP_SET_BITS(struct amap_mcc_context, cq_id, ctxt, cq->id);
-+ AMAP_SET_BITS(struct amap_mcc_context_be, valid, ctxt, 1);
-+ AMAP_SET_BITS(struct amap_mcc_context_be, ring_size, ctxt,
-+ be_encoded_q_len(mccq->len));
-+ AMAP_SET_BITS(struct amap_mcc_context_be, cq_id, ctxt, cq->id);
-
- be_dws_cpu_to_le(ctxt, sizeof(req->context));
-
-@@ -592,75 +920,93 @@ int be_cmd_mccq_create(struct be_adapter *adapter,
- mccq->id = le16_to_cpu(resp->id);
- mccq->created = true;
- }
-- spin_unlock(&adapter->mbox_lock);
-
-+ mutex_unlock(&adapter->mbox_lock);
- return status;
- }
-
--int be_cmd_txq_create(struct be_adapter *adapter,
-- struct be_queue_info *txq,
-+int be_cmd_mccq_create(struct be_adapter *adapter,
-+ struct be_queue_info *mccq,
- struct be_queue_info *cq)
- {
-+ int status;
-+
-+ status = be_cmd_mccq_ext_create(adapter, mccq, cq);
-+ if (status && !lancer_chip(adapter)) {
-+ dev_warn(&adapter->pdev->dev, "Upgrade to F/W ver 2.102.235.0 "
-+ "or newer to avoid conflicting priorities between NIC "
-+ "and FCoE traffic");
-+ status = be_cmd_mccq_org_create(adapter, mccq, cq);
-+ }
-+ return status;
-+}
-+
-+int be_cmd_txq_create(struct be_adapter *adapter, struct be_queue_info *txq,
-+ struct be_queue_info *cq, u8 *tc_id)
-+{
- struct be_mcc_wrb *wrb;
- struct be_cmd_req_eth_tx_create *req;
- struct be_dma_mem *q_mem = &txq->dma_mem;
-- void *ctxt;
- int status;
-
-- spin_lock(&adapter->mbox_lock);
-+ if (mutex_lock_interruptible(&adapter->mbox_lock))
-+ return -1;
-
- wrb = wrb_from_mbox(adapter);
- req = embedded_payload(wrb);
-- ctxt = &req->context;
--
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0, OPCODE_ETH_TX_CREATE);
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_ETH, OPCODE_ETH_TX_CREATE,
- sizeof(*req));
-
-- req->num_pages = PAGES_4K_SPANNED(q_mem->va, q_mem->size);
-+ if (adapter->flags & BE_FLAGS_DCBX || lancer_chip(adapter)) {
-+ req->hdr.version = 1;
-+ req->if_id = cpu_to_le16(adapter->if_handle);
-+ }
-+ if (adapter->flags & BE_FLAGS_DCBX)
-+ req->type = cpu_to_le16(ETX_QUEUE_TYPE_PRIORITY);
-+ else
-+ req->type = cpu_to_le16(ETX_QUEUE_TYPE_STANDARD);
- req->ulp_num = BE_ULP1_NUM;
-- req->type = BE_ETH_TX_RING_TYPE_STANDARD;
--
-- AMAP_SET_BITS(struct amap_tx_context, tx_ring_size, ctxt,
-- be_encoded_q_len(txq->len));
-- AMAP_SET_BITS(struct amap_tx_context, pci_func_id, ctxt,
-- be_pci_func(adapter));
-- AMAP_SET_BITS(struct amap_tx_context, ctx_valid, ctxt, 1);
-- AMAP_SET_BITS(struct amap_tx_context, cq_id_send, ctxt, cq->id);
--
-- be_dws_cpu_to_le(ctxt, sizeof(req->context));
--
-+ req->cq_id = cpu_to_le16(cq->id);
-+ req->queue_size = be_encoded_q_len(txq->len);
-+ req->num_pages = PAGES_4K_SPANNED(q_mem->va, q_mem->size);
- be_cmd_page_addrs_prepare(req->pages, ARRAY_SIZE(req->pages), q_mem);
-
- status = be_mbox_notify_wait(adapter);
- if (!status) {
- struct be_cmd_resp_eth_tx_create *resp = embedded_payload(wrb);
- txq->id = le16_to_cpu(resp->cid);
-+ if (adapter->flags & BE_FLAGS_DCBX)
-+ *tc_id = resp->tc_id;
- txq->created = true;
- }
-
-- spin_unlock(&adapter->mbox_lock);
--
-+ mutex_unlock(&adapter->mbox_lock);
- return status;
- }
-
--/* Uses mbox */
-+/* Uses MCC */
- int be_cmd_rxq_create(struct be_adapter *adapter,
- struct be_queue_info *rxq, u16 cq_id, u16 frag_size,
-- u16 max_frame_size, u32 if_id, u32 rss)
-+ u16 max_frame_size, u32 if_id, u32 rss, u8 *rss_id)
- {
- struct be_mcc_wrb *wrb;
- struct be_cmd_req_eth_rx_create *req;
- struct be_dma_mem *q_mem = &rxq->dma_mem;
- int status;
-
-- spin_lock(&adapter->mbox_lock);
-+ spin_lock_bh(&adapter->mcc_lock);
-
-- wrb = wrb_from_mbox(adapter);
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
- req = embedded_payload(wrb);
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_ETH_RX_CREATE);
-
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_ETH, OPCODE_ETH_RX_CREATE,
- sizeof(*req));
-@@ -673,15 +1019,16 @@ int be_cmd_rxq_create(struct be_adapter *adapter,
- req->max_frame_size = cpu_to_le16(max_frame_size);
- req->rss_queue = cpu_to_le32(rss);
-
-- status = be_mbox_notify_wait(adapter);
-+ status = be_mcc_notify_wait(adapter);
- if (!status) {
- struct be_cmd_resp_eth_rx_create *resp = embedded_payload(wrb);
- rxq->id = le16_to_cpu(resp->id);
- rxq->created = true;
-+ *rss_id = resp->rss_id;
- }
-
-- spin_unlock(&adapter->mbox_lock);
--
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
- return status;
- }
-
-@@ -696,13 +1043,12 @@ int be_cmd_q_destroy(struct be_adapter *adapter, struct be_queue_info *q,
- u8 subsys = 0, opcode = 0;
- int status;
-
-- spin_lock(&adapter->mbox_lock);
-+ if (mutex_lock_interruptible(&adapter->mbox_lock))
-+ return -1;
-
- wrb = wrb_from_mbox(adapter);
- req = embedded_payload(wrb);
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
--
- switch (queue_type) {
- case QTYPE_EQ:
- subsys = CMD_SUBSYSTEM_COMMON;
-@@ -727,13 +1073,47 @@ int be_cmd_q_destroy(struct be_adapter *adapter, struct be_queue_info *q,
- default:
- BUG();
- }
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0, opcode);
-+
- be_cmd_hdr_prepare(&req->hdr, subsys, opcode, sizeof(*req));
- req->id = cpu_to_le16(q->id);
-
- status = be_mbox_notify_wait(adapter);
-+ if (!status)
-+ q->created = false;
-
-- spin_unlock(&adapter->mbox_lock);
-+ mutex_unlock(&adapter->mbox_lock);
-+ return status;
-+}
-
-+/* Uses MCC */
-+int be_cmd_rxq_destroy(struct be_adapter *adapter, struct be_queue_info *q)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_q_destroy *req;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+ req = embedded_payload(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0, OPCODE_ETH_RX_DESTROY);
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_ETH, OPCODE_ETH_RX_DESTROY,
-+ sizeof(*req));
-+ req->id = cpu_to_le16(q->id);
-+
-+ status = be_mcc_notify_wait(adapter);
-+ if (!status)
-+ q->created = false;
-+
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
- return status;
- }
-
-@@ -741,22 +1121,26 @@ int be_cmd_q_destroy(struct be_adapter *adapter, struct be_queue_info *q,
- * Uses mbox
- */
- int be_cmd_if_create(struct be_adapter *adapter, u32 cap_flags, u32 en_flags,
-- u8 *mac, bool pmac_invalid, u32 *if_handle, u32 *pmac_id)
-+ u8 *mac, bool pmac_invalid, u32 *if_handle, u32 *pmac_id,
-+ u32 domain)
- {
- struct be_mcc_wrb *wrb;
- struct be_cmd_req_if_create *req;
- int status;
-
-- spin_lock(&adapter->mbox_lock);
-+ if (mutex_lock_interruptible(&adapter->mbox_lock))
-+ return -1;
-
- wrb = wrb_from_mbox(adapter);
- req = embedded_payload(wrb);
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_NTWK_INTERFACE_CREATE);
-
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
- OPCODE_COMMON_NTWK_INTERFACE_CREATE, sizeof(*req));
-
-+ req->hdr.domain = domain;
- req->capability_flags = cpu_to_le32(cap_flags);
- req->enable_flags = cpu_to_le32(en_flags);
- req->pmac_invalid = pmac_invalid;
-@@ -771,33 +1155,35 @@ int be_cmd_if_create(struct be_adapter *adapter, u32 cap_flags, u32 en_flags,
- *pmac_id = le32_to_cpu(resp->pmac_id);
- }
-
-- spin_unlock(&adapter->mbox_lock);
-+ mutex_unlock(&adapter->mbox_lock);
- return status;
- }
-
- /* Uses mbox */
--int be_cmd_if_destroy(struct be_adapter *adapter, u32 interface_id)
-+int be_cmd_if_destroy(struct be_adapter *adapter, u32 interface_id, u32 domain)
- {
- struct be_mcc_wrb *wrb;
- struct be_cmd_req_if_destroy *req;
- int status;
-
-- spin_lock(&adapter->mbox_lock);
-+ if (mutex_lock_interruptible(&adapter->mbox_lock))
-+ return -1;
-
- wrb = wrb_from_mbox(adapter);
- req = embedded_payload(wrb);
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_NTWK_INTERFACE_DESTROY);
-
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
- OPCODE_COMMON_NTWK_INTERFACE_DESTROY, sizeof(*req));
-
-+ req->hdr.domain = domain;
- req->interface_id = cpu_to_le32(interface_id);
-
- status = be_mbox_notify_wait(adapter);
-
-- spin_unlock(&adapter->mbox_lock);
--
-+ mutex_unlock(&adapter->mbox_lock);
- return status;
- }
-
-@@ -808,33 +1194,48 @@ int be_cmd_if_destroy(struct be_adapter *adapter, u32 interface_id)
- int be_cmd_get_stats(struct be_adapter *adapter, struct be_dma_mem *nonemb_cmd)
- {
- struct be_mcc_wrb *wrb;
-- struct be_cmd_req_get_stats *req;
-+ struct be_cmd_req_hdr *hdr;
- struct be_sge *sge;
-+ int status = 0;
-+
-+ if (MODULO(adapter->work_counter, be_get_temp_freq) == 0)
-+ be_cmd_get_die_temperature(adapter);
-
- spin_lock_bh(&adapter->mcc_lock);
-
- wrb = wrb_from_mccq(adapter);
-- req = nonemb_cmd->va;
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+ hdr = nonemb_cmd->va;
- sge = nonembedded_sgl(wrb);
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), false, 1);
-- wrb->tag0 = OPCODE_ETH_GET_STATISTICS;
-+ be_wrb_hdr_prepare(wrb, nonemb_cmd->size, false, 1,
-+ OPCODE_ETH_GET_STATISTICS);
-
-- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_ETH,
-- OPCODE_ETH_GET_STATISTICS, sizeof(*req));
-+ be_cmd_hdr_prepare(hdr, CMD_SUBSYSTEM_ETH,
-+ OPCODE_ETH_GET_STATISTICS, nonemb_cmd->size);
-+
-+ if (adapter->generation == BE_GEN3)
-+ hdr->version = 1;
-+
-+ wrb->tag1 = CMD_SUBSYSTEM_ETH;
- sge->pa_hi = cpu_to_le32(upper_32_bits(nonemb_cmd->dma));
- sge->pa_lo = cpu_to_le32(nonemb_cmd->dma & 0xFFFFFFFF);
- sge->len = cpu_to_le32(nonemb_cmd->size);
-
- be_mcc_notify(adapter);
-+ adapter->stats_cmd_sent = true;
-
-+err:
- spin_unlock_bh(&adapter->mcc_lock);
-- return 0;
-+ return status;
- }
-
- /* Uses synchronous mcc */
- int be_cmd_link_status_query(struct be_adapter *adapter,
-- bool *link_up)
-+ int *link_status, u8 *mac_speed, u16 *link_speed, u32 dom)
- {
- struct be_mcc_wrb *wrb;
- struct be_cmd_req_link_status *req;
-@@ -843,50 +1244,216 @@ int be_cmd_link_status_query(struct be_adapter *adapter,
- spin_lock_bh(&adapter->mcc_lock);
-
- wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
- req = embedded_payload(wrb);
-
-- *link_up = false;
-+ *link_status = LINK_DOWN;
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_NTWK_LINK_STATUS_QUERY);
-
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
- OPCODE_COMMON_NTWK_LINK_STATUS_QUERY, sizeof(*req));
-
-+ req->hdr.domain = dom;
-+
- status = be_mcc_notify_wait(adapter);
- if (!status) {
- struct be_cmd_resp_link_status *resp = embedded_payload(wrb);
-- if (resp->mac_speed != PHY_LINK_SPEED_ZERO)
-- *link_up = true;
-+ if (resp->mac_speed != PHY_LINK_SPEED_ZERO) {
-+ *link_status = LINK_UP;
-+ *link_speed = le16_to_cpu(resp->link_speed);
-+ *mac_speed = resp->mac_speed;
-+ }
- }
-
-+err:
- spin_unlock_bh(&adapter->mcc_lock);
- return status;
- }
-
--/* Uses Mbox */
--int be_cmd_get_fw_ver(struct be_adapter *adapter, char *fw_ver)
-+/* Uses synchronous mcc */
-+int be_cmd_get_die_temperature(struct be_adapter *adapter)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_get_cntl_addnl_attribs *req;
-+ u16 mccq_index;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ mccq_index = adapter->mcc_obj.q.head;
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+ req = embedded_payload(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_GET_CNTL_ADDITIONAL_ATTRIBUTES);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_GET_CNTL_ADDITIONAL_ATTRIBUTES, sizeof(*req));
-+
-+ wrb->tag1 = mccq_index;
-+
-+ be_mcc_notify(adapter);
-+
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+
-+/* Uses synchronous mcc */
-+int be_cmd_get_reg_len(struct be_adapter *adapter, u32 *log_size)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_get_fat *req;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+ req = embedded_payload(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_MANAGE_FAT);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_MANAGE_FAT, sizeof(*req));
-+ req->fat_operation = cpu_to_le32(QUERY_FAT);
-+ status = be_mcc_notify_wait(adapter);
-+ if (!status) {
-+ struct be_cmd_resp_get_fat *resp = embedded_payload(wrb);
-+ if (log_size && resp->log_size)
-+ *log_size = le32_to_cpu(resp->log_size) -
-+ sizeof(u32);
-+ }
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+void be_cmd_get_regs(struct be_adapter *adapter, u32 buf_len, void *buf)
-+{
-+ struct be_dma_mem get_fat_cmd;
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_get_fat *req;
-+ struct be_sge *sge;
-+ u32 offset = 0, total_size, buf_size,
-+ log_offset = sizeof(u32), payload_len;
-+ int status;
-+
-+ if (buf_len == 0)
-+ return;
-+
-+ total_size = buf_len;
-+
-+ get_fat_cmd.size = sizeof(struct be_cmd_req_get_fat) + 60*1024;
-+ get_fat_cmd.va = pci_alloc_consistent(adapter->pdev,
-+ get_fat_cmd.size,
-+ &get_fat_cmd.dma);
-+ if (!get_fat_cmd.va) {
-+ status = -ENOMEM;
-+ dev_err(&adapter->pdev->dev,
-+ "Memory allocation failure while retrieving FAT data\n");
-+ return;
-+ }
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ while (total_size) {
-+ buf_size = min(total_size, (u32)60*1024);
-+ total_size -= buf_size;
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+ req = get_fat_cmd.va;
-+ sge = nonembedded_sgl(wrb);
-+
-+ payload_len = sizeof(struct be_cmd_req_get_fat) + buf_size;
-+ be_wrb_hdr_prepare(wrb, payload_len, false, 1,
-+ OPCODE_COMMON_MANAGE_FAT);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_MANAGE_FAT, payload_len);
-+
-+ sge->pa_hi = cpu_to_le32(upper_32_bits(get_fat_cmd.dma));
-+ sge->pa_lo = cpu_to_le32(get_fat_cmd.dma & 0xFFFFFFFF);
-+ sge->len = cpu_to_le32(get_fat_cmd.size);
-+
-+ req->fat_operation = cpu_to_le32(RETRIEVE_FAT);
-+ req->read_log_offset = cpu_to_le32(log_offset);
-+ req->read_log_length = cpu_to_le32(buf_size);
-+ req->data_buffer_size = cpu_to_le32(buf_size);
-+
-+ status = be_mcc_notify_wait(adapter);
-+ if (!status) {
-+ struct be_cmd_resp_get_fat *resp = get_fat_cmd.va;
-+ memcpy(buf + offset,
-+ resp->data_buffer,
-+ le32_to_cpu(resp->read_log_length));
-+ } else {
-+ dev_err(&adapter->pdev->dev, "FAT Table Retrieve error\n");
-+ goto err;
-+ }
-+ offset += buf_size;
-+ log_offset += buf_size;
-+ }
-+err:
-+ pci_free_consistent(adapter->pdev, get_fat_cmd.size,
-+ get_fat_cmd.va,
-+ get_fat_cmd.dma);
-+ spin_unlock_bh(&adapter->mcc_lock);
-+}
-+
-+/* Uses synchronous mcc */
-+int be_cmd_get_fw_ver(struct be_adapter *adapter, char *fw_ver,
-+ char *fw_on_flash)
- {
- struct be_mcc_wrb *wrb;
- struct be_cmd_req_get_fw_version *req;
- int status;
-
-- spin_lock(&adapter->mbox_lock);
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-
-- wrb = wrb_from_mbox(adapter);
- req = embedded_payload(wrb);
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_GET_FW_VERSION);
-
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
- OPCODE_COMMON_GET_FW_VERSION, sizeof(*req));
-
-- status = be_mbox_notify_wait(adapter);
-+ status = be_mcc_notify_wait(adapter);
- if (!status) {
- struct be_cmd_resp_get_fw_version *resp = embedded_payload(wrb);
-- strncpy(fw_ver, resp->firmware_version_string, FW_VER_LEN);
-+ strncpy(fw_ver, resp->firmware_version_string, FW_VER_LEN-1);
-+ if (fw_on_flash)
-+ strncpy(fw_on_flash, resp->fw_on_flash_version_string,
-+ FW_VER_LEN-1);
- }
--
-- spin_unlock(&adapter->mbox_lock);
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
- return status;
- }
-
-@@ -897,13 +1464,19 @@ int be_cmd_modify_eqd(struct be_adapter *adapter, u32 eq_id, u32 eqd)
- {
- struct be_mcc_wrb *wrb;
- struct be_cmd_req_modify_eq_delay *req;
-+ int status = 0;
-
- spin_lock_bh(&adapter->mcc_lock);
-
- wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
- req = embedded_payload(wrb);
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_MODIFY_EQ_DELAY);
-
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
- OPCODE_COMMON_MODIFY_EQ_DELAY, sizeof(*req));
-@@ -915,8 +1488,9 @@ int be_cmd_modify_eqd(struct be_adapter *adapter, u32 eq_id, u32 eqd)
-
- be_mcc_notify(adapter);
-
-+err:
- spin_unlock_bh(&adapter->mcc_lock);
-- return 0;
-+ return status;
- }
-
- /* Uses sycnhronous mcc */
-@@ -930,9 +1504,14 @@ int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array,
- spin_lock_bh(&adapter->mcc_lock);
-
- wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
- req = embedded_payload(wrb);
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_NTWK_VLAN_CONFIG);
-
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
- OPCODE_COMMON_NTWK_VLAN_CONFIG, sizeof(*req));
-@@ -948,79 +1527,63 @@ int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array,
-
- status = be_mcc_notify_wait(adapter);
-
-+err:
- spin_unlock_bh(&adapter->mcc_lock);
- return status;
- }
-
--/* Uses MCC for this command as it may be called in BH context
-- * Uses synchronous mcc
-- */
--int be_cmd_promiscuous_config(struct be_adapter *adapter, u8 port_num, bool en)
-+int be_cmd_rx_filter(struct be_adapter *adapter, u32 flags, u32 value)
- {
- struct be_mcc_wrb *wrb;
-- struct be_cmd_req_promiscuous_config *req;
-+ struct be_dma_mem *mem = &adapter->rx_filter;
-+ struct be_cmd_req_rx_filter *req = mem->va;
-+ struct be_sge *sge;
- int status;
-
- spin_lock_bh(&adapter->mcc_lock);
-
- wrb = wrb_from_mccq(adapter);
-- req = embedded_payload(wrb);
--
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
--
-- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_ETH,
-- OPCODE_ETH_PROMISCUOUS, sizeof(*req));
--
-- if (port_num)
-- req->port1_promiscuous = en;
-- else
-- req->port0_promiscuous = en;
--
-- status = be_mcc_notify_wait(adapter);
--
-- spin_unlock_bh(&adapter->mcc_lock);
-- return status;
--}
--
--/*
-- * Uses MCC for this command as it may be called in BH context
-- * (mc == NULL) => multicast promiscous
-- */
--int be_cmd_multicast_set(struct be_adapter *adapter, u32 if_id,
-- struct dev_mc_list *mc_list, u32 mc_count)
--{
--#define BE_MAX_MC 32 /* set mcast promisc if > 32 */
-- struct be_mcc_wrb *wrb;
-- struct be_cmd_req_mcast_mac_config *req;
--
-- spin_lock_bh(&adapter->mcc_lock);
--
-- wrb = wrb_from_mccq(adapter);
-- req = embedded_payload(wrb);
--
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
--
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+ sge = nonembedded_sgl(wrb);
-+ sge->pa_hi = cpu_to_le32(upper_32_bits(mem->dma));
-+ sge->pa_lo = cpu_to_le32(mem->dma & 0xFFFFFFFF);
-+ sge->len = cpu_to_le32(mem->size);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), false, 1,
-+ OPCODE_COMMON_NTWK_RX_FILTER);
-+
-+ memset(req, 0, sizeof(*req));
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-- OPCODE_COMMON_NTWK_MULTICAST_SET, sizeof(*req));
-+ OPCODE_COMMON_NTWK_RX_FILTER, sizeof(*req));
-
-- req->interface_id = if_id;
-- if (mc_list && mc_count <= BE_MAX_MC) {
-- int i;
-- struct dev_mc_list *mc;
--
-- req->num_mac = cpu_to_le16(mc_count);
--
-- for (mc = mc_list, i = 0; mc; mc = mc->next, i++)
-- memcpy(req->mac[i].byte, mc->dmi_addr, ETH_ALEN);
-+ req->if_id = cpu_to_le32(adapter->if_handle);
-+ if (flags & IFF_PROMISC) {
-+ req->if_flags_mask = cpu_to_le32(BE_IF_FLAGS_PROMISCUOUS |
-+ BE_IF_FLAGS_VLAN_PROMISCUOUS);
-+ if (value == ON)
-+ req->if_flags = cpu_to_le32(BE_IF_FLAGS_PROMISCUOUS |
-+ BE_IF_FLAGS_VLAN_PROMISCUOUS);
-+ } else if (flags & IFF_ALLMULTI) {
-+ req->if_flags_mask = req->if_flags =
-+ cpu_to_le32(BE_IF_FLAGS_MCAST_PROMISCUOUS);
- } else {
-- req->promiscuous = 1;
-- }
-+ struct netdev_hw_addr *ha;
-+ int i = 0;
-
-- be_mcc_notify_wait(adapter);
-+ req->if_flags_mask = req->if_flags =
-+ cpu_to_le32(BE_IF_FLAGS_MULTICAST);
-+ req->mcast_num = cpu_to_le16(netdev_mc_count(adapter->netdev));
-+ netdev_for_each_mc_addr(ha, adapter->netdev)
-+ memcpy(req->mcast_mac[i++].byte, ha->DMI_ADDR,
-+ ETH_ALEN);
-+ }
-+ status = be_mcc_notify_wait(adapter);
-
-+err:
- spin_unlock_bh(&adapter->mcc_lock);
--
-- return 0;
-+ return status;
- }
-
- /* Uses synchrounous mcc */
-@@ -1033,9 +1596,14 @@ int be_cmd_set_flow_control(struct be_adapter *adapter, u32 tx_fc, u32 rx_fc)
- spin_lock_bh(&adapter->mcc_lock);
-
- wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
- req = embedded_payload(wrb);
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_SET_FLOW_CONTROL);
-
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
- OPCODE_COMMON_SET_FLOW_CONTROL, sizeof(*req));
-@@ -1045,6 +1613,7 @@ int be_cmd_set_flow_control(struct be_adapter *adapter, u32 tx_fc, u32 rx_fc)
-
- status = be_mcc_notify_wait(adapter);
-
-+err:
- spin_unlock_bh(&adapter->mcc_lock);
- return status;
- }
-@@ -1059,9 +1628,14 @@ int be_cmd_get_flow_control(struct be_adapter *adapter, u32 *tx_fc, u32 *rx_fc)
- spin_lock_bh(&adapter->mcc_lock);
-
- wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
- req = embedded_payload(wrb);
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_GET_FLOW_CONTROL);
-
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
- OPCODE_COMMON_GET_FLOW_CONTROL, sizeof(*req));
-@@ -1074,23 +1648,27 @@ int be_cmd_get_flow_control(struct be_adapter *adapter, u32 *tx_fc, u32 *rx_fc)
- *rx_fc = le16_to_cpu(resp->rx_flow_control);
- }
-
-+err:
- spin_unlock_bh(&adapter->mcc_lock);
- return status;
- }
-
- /* Uses mbox */
--int be_cmd_query_fw_cfg(struct be_adapter *adapter, u32 *port_num, u32 *cap)
-+int be_cmd_query_fw_cfg(struct be_adapter *adapter, u32 *port_num,
-+ u32 *mode, u32 *function_caps)
- {
- struct be_mcc_wrb *wrb;
- struct be_cmd_req_query_fw_cfg *req;
- int status;
-
-- spin_lock(&adapter->mbox_lock);
-+ if (mutex_lock_interruptible(&adapter->mbox_lock))
-+ return -1;
-
- wrb = wrb_from_mbox(adapter);
- req = embedded_payload(wrb);
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_QUERY_FIRMWARE_CONFIG);
-
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
- OPCODE_COMMON_QUERY_FIRMWARE_CONFIG, sizeof(*req));
-@@ -1099,10 +1677,11 @@ int be_cmd_query_fw_cfg(struct be_adapter *adapter, u32 *port_num, u32 *cap)
- if (!status) {
- struct be_cmd_resp_query_fw_cfg *resp = embedded_payload(wrb);
- *port_num = le32_to_cpu(resp->phys_port);
-- *cap = le32_to_cpu(resp->function_cap);
-+ *mode = le32_to_cpu(resp->function_mode);
-+ *function_caps = le32_to_cpu(resp->function_caps);
- }
-
-- spin_unlock(&adapter->mbox_lock);
-+ mutex_unlock(&adapter->mbox_lock);
- return status;
- }
-
-@@ -1113,19 +1692,161 @@ int be_cmd_reset_function(struct be_adapter *adapter)
- struct be_cmd_req_hdr *req;
- int status;
-
-- spin_lock(&adapter->mbox_lock);
-+ if (mutex_lock_interruptible(&adapter->mbox_lock))
-+ return -1;
-
- wrb = wrb_from_mbox(adapter);
- req = embedded_payload(wrb);
-
-- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_FUNCTION_RESET);
-
- be_cmd_hdr_prepare(req, CMD_SUBSYSTEM_COMMON,
- OPCODE_COMMON_FUNCTION_RESET, sizeof(*req));
-
- status = be_mbox_notify_wait(adapter);
-
-- spin_unlock(&adapter->mbox_lock);
-+ mutex_unlock(&adapter->mbox_lock);
-+ return status;
-+}
-+
-+int be_cmd_rss_config(struct be_adapter *adapter, u8 *rsstable, u16 table_size)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_rss_config *req;
-+ u32 myhash[10] = {0x0123, 0x4567, 0x89AB, 0xCDEF, 0x01EF,
-+ 0x0123, 0x4567, 0x89AB, 0xCDEF, 0x01EF};
-+ int status;
-+
-+ if (mutex_lock_interruptible(&adapter->mbox_lock))
-+ return -1;
-+
-+ wrb = wrb_from_mbox(adapter);
-+ req = embedded_payload(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_ETH_RSS_CONFIG);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_ETH,
-+ OPCODE_ETH_RSS_CONFIG, sizeof(*req));
-+
-+ req->if_id = cpu_to_le32(adapter->if_handle);
-+ req->enable_rss = cpu_to_le16(RSS_ENABLE_TCP_IPV4 | RSS_ENABLE_IPV4);
-+ req->cpu_table_size_log2 = cpu_to_le16(fls(table_size) - 1);
-+ memcpy(req->cpu_table, rsstable, table_size);
-+ memcpy(req->hash, myhash, sizeof(myhash));
-+ be_dws_cpu_to_le(req->hash, sizeof(req->hash));
-+
-+ status = be_mbox_notify_wait(adapter);
-+
-+ mutex_unlock(&adapter->mbox_lock);
-+ return status;
-+}
-+
-+/* Uses sync mcc */
-+int be_cmd_set_beacon_state(struct be_adapter *adapter, u8 port_num,
-+ u8 bcn, u8 sts, u8 state)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_enable_disable_beacon *req;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+ req = embedded_payload(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_ENABLE_DISABLE_BEACON);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_ENABLE_DISABLE_BEACON, sizeof(*req));
-+
-+ req->port_num = port_num;
-+ req->beacon_state = state;
-+ req->beacon_duration = bcn;
-+ req->status_duration = sts;
-+
-+ status = be_mcc_notify_wait(adapter);
-+
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+/* Uses sync mcc */
-+int be_cmd_get_beacon_state(struct be_adapter *adapter, u8 port_num, u32 *state)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_get_beacon_state *req;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+ req = embedded_payload(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_GET_BEACON_STATE);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_GET_BEACON_STATE, sizeof(*req));
-+
-+ req->port_num = port_num;
-+
-+ status = be_mcc_notify_wait(adapter);
-+ if (!status) {
-+ struct be_cmd_resp_get_beacon_state *resp =
-+ embedded_payload(wrb);
-+ *state = resp->beacon_state;
-+ }
-+
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+/* Uses sync mcc */
-+int be_cmd_read_port_type(struct be_adapter *adapter, u32 port,
-+ u8 *connector)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_port_type *req;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+ req = embedded_payload(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(struct be_cmd_resp_port_type), true, 0,
-+ OPCODE_COMMON_READ_TRANSRECV_DATA);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_READ_TRANSRECV_DATA, sizeof(*req));
-+
-+ req->port = cpu_to_le32(port);
-+ req->page_num = cpu_to_le32(TR_PAGE_A0);
-+ status = be_mcc_notify_wait(adapter);
-+ if (!status) {
-+ struct be_cmd_resp_port_type *resp = embedded_payload(wrb);
-+ *connector = resp->data.connector;
-+ }
-+
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
- return status;
- }
-
-@@ -1133,16 +1854,24 @@ int be_cmd_write_flashrom(struct be_adapter *adapter, struct be_dma_mem *cmd,
- u32 flash_type, u32 flash_opcode, u32 buf_size)
- {
- struct be_mcc_wrb *wrb;
-- struct be_cmd_write_flashrom *req = cmd->va;
-+ struct be_cmd_write_flashrom *req;
- struct be_sge *sge;
- int status;
-
- spin_lock_bh(&adapter->mcc_lock);
-+ adapter->flash_status = 0;
-
- wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err_unlock;
-+ }
-+ req = cmd->va;
- sge = nonembedded_sgl(wrb);
-
-- be_wrb_hdr_prepare(wrb, cmd->size, false, 1);
-+ be_wrb_hdr_prepare(wrb, cmd->size, false, 1,
-+ OPCODE_COMMON_WRITE_FLASHROM);
-+ wrb->tag1 = CMD_SUBSYSTEM_COMMON;
-
- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
- OPCODE_COMMON_WRITE_FLASHROM, cmd->size);
-@@ -1154,8 +1883,852 @@ int be_cmd_write_flashrom(struct be_adapter *adapter, struct be_dma_mem *cmd,
- req->params.op_code = cpu_to_le32(flash_opcode);
- req->params.data_buf_size = cpu_to_le32(buf_size);
-
-+ be_mcc_notify(adapter);
-+ spin_unlock_bh(&adapter->mcc_lock);
-+
-+ if (!wait_for_completion_timeout(&adapter->flash_compl,
-+ msecs_to_jiffies(40000)))
-+ status = -1;
-+ else
-+ status = adapter->flash_status;
-+
-+ return status;
-+
-+err_unlock:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+int be_cmd_get_flash_crc(struct be_adapter *adapter, u8 *flashed_crc,
-+ int offset)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_write_flashrom *req;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+ req = embedded_payload(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req)+4, true, 0,
-+ OPCODE_COMMON_READ_FLASHROM);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_READ_FLASHROM, sizeof(*req)+4);
-+
-+ req->params.op_type = cpu_to_le32(IMG_TYPE_REDBOOT);
-+ req->params.op_code = cpu_to_le32(FLASHROM_OPER_REPORT);
-+ req->params.offset = cpu_to_le32(offset);
-+ req->params.data_buf_size = cpu_to_le32(0x4);
-+
-+ status = be_mcc_notify_wait(adapter);
-+ if (!status)
-+ memcpy(flashed_crc, req->params.data_buf, 4);
-+
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+int be_cmd_enable_magic_wol(struct be_adapter *adapter, u8 *mac,
-+ struct be_dma_mem *nonemb_cmd)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_acpi_wol_magic_config *req;
-+ struct be_sge *sge;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+ req = nonemb_cmd->va;
-+ sge = nonembedded_sgl(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), false, 1,
-+ OPCODE_ETH_ACPI_WOL_MAGIC_CONFIG);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_ETH,
-+ OPCODE_ETH_ACPI_WOL_MAGIC_CONFIG, sizeof(*req));
-+ memcpy(req->magic_mac, mac, ETH_ALEN);
-+
-+ sge->pa_hi = cpu_to_le32(upper_32_bits(nonemb_cmd->dma));
-+ sge->pa_lo = cpu_to_le32(nonemb_cmd->dma & 0xFFFFFFFF);
-+ sge->len = cpu_to_le32(nonemb_cmd->size);
-+
-+ status = be_mcc_notify_wait(adapter);
-+
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+int be_cmd_set_loopback(struct be_adapter *adapter, u8 port_num,
-+ u8 loopback_type, u8 enable)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_set_lmode *req;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+
-+ req = embedded_payload(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_LOWLEVEL_SET_LOOPBACK_MODE);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_LOWLEVEL,
-+ OPCODE_LOWLEVEL_SET_LOOPBACK_MODE,
-+ sizeof(*req));
-+
-+ req->src_port = port_num;
-+ req->dest_port = port_num;
-+ req->loopback_type = loopback_type;
-+ req->loopback_state = enable;
-+
-+ status = be_mcc_notify_wait(adapter);
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+int be_cmd_loopback_test(struct be_adapter *adapter, u32 port_num,
-+ u32 loopback_type, u32 pkt_size, u32 num_pkts, u64 pattern)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_loopback_test *req;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+
-+ req = embedded_payload(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_LOWLEVEL_LOOPBACK_TEST);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_LOWLEVEL,
-+ OPCODE_LOWLEVEL_LOOPBACK_TEST, sizeof(*req));
-+ req->hdr.timeout = cpu_to_le32(4);
-+
-+ req->pattern = cpu_to_le64(pattern);
-+ req->src_port = cpu_to_le32(port_num);
-+ req->dest_port = cpu_to_le32(port_num);
-+ req->pkt_size = cpu_to_le32(pkt_size);
-+ req->num_pkts = cpu_to_le32(num_pkts);
-+ req->loopback_type = cpu_to_le32(loopback_type);
-+
-+ status = be_mcc_notify_wait(adapter);
-+ if (!status) {
-+ struct be_cmd_resp_loopback_test *resp = embedded_payload(wrb);
-+ status = le32_to_cpu(resp->status);
-+ }
-+
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+int be_cmd_ddr_dma_test(struct be_adapter *adapter, u64 pattern,
-+ u32 byte_cnt, struct be_dma_mem *cmd)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_ddrdma_test *req;
-+ struct be_sge *sge;
-+ int status;
-+ int i, j = 0;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+ req = cmd->va;
-+ sge = nonembedded_sgl(wrb);
-+ be_wrb_hdr_prepare(wrb, cmd->size, false, 1,
-+ OPCODE_LOWLEVEL_HOST_DDR_DMA);
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_LOWLEVEL,
-+ OPCODE_LOWLEVEL_HOST_DDR_DMA, cmd->size);
-+
-+ sge->pa_hi = cpu_to_le32(upper_32_bits(cmd->dma));
-+ sge->pa_lo = cpu_to_le32(cmd->dma & 0xFFFFFFFF);
-+ sge->len = cpu_to_le32(cmd->size);
-+
-+ req->pattern = cpu_to_le64(pattern);
-+ req->byte_count = cpu_to_le32(byte_cnt);
-+ for (i = 0; i < byte_cnt; i++) {
-+ req->snd_buff[i] = (u8)(pattern >> (j*8));
-+ j++;
-+ if (j > 7)
-+ j = 0;
-+ }
-+
-+ status = be_mcc_notify_wait(adapter);
-+
-+ if (!status) {
-+ struct be_cmd_resp_ddrdma_test *resp;
-+ resp = cmd->va;
-+ if ((memcmp(resp->rcv_buff, req->snd_buff, byte_cnt) != 0) ||
-+ resp->snd_err) {
-+ status = -1;
-+ }
-+ }
-+
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+int be_cmd_get_seeprom_data(struct be_adapter *adapter,
-+ struct be_dma_mem *nonemb_cmd)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_seeprom_read *req;
-+ struct be_sge *sge;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ req = nonemb_cmd->va;
-+ sge = nonembedded_sgl(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), false, 1,
-+ OPCODE_COMMON_SEEPROM_READ);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_SEEPROM_READ, sizeof(*req));
-+
-+ sge->pa_hi = cpu_to_le32(upper_32_bits(nonemb_cmd->dma));
-+ sge->pa_lo = cpu_to_le32(nonemb_cmd->dma & 0xFFFFFFFF);
-+ sge->len = cpu_to_le32(nonemb_cmd->size);
-+
-+ status = be_mcc_notify_wait(adapter);
-+
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+int be_cmd_get_phy_info(struct be_adapter *adapter,
-+ struct be_phy_info *phy_info)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_get_phy_info *req;
-+ struct be_sge *sge;
-+ struct be_dma_mem cmd;
-+ struct be_phy_info *resp_phy_info;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+ cmd.size = sizeof(struct be_cmd_req_get_phy_info);
-+ cmd.va = pci_alloc_consistent(adapter->pdev, cmd.size,
-+ &cmd.dma);
-+ if (!cmd.va) {
-+ dev_err(&adapter->pdev->dev, "Memory alloc failure\n");
-+ status = -ENOMEM;
-+ goto err;
-+ }
-+
-+ req = cmd.va;
-+ sge = nonembedded_sgl(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), false, 1,
-+ OPCODE_COMMON_GET_PHY_DETAILS);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_GET_PHY_DETAILS,
-+ sizeof(*req));
-+
-+ sge->pa_hi = cpu_to_le32(upper_32_bits(cmd.dma));
-+ sge->pa_lo = cpu_to_le32(cmd.dma & 0xFFFFFFFF);
-+ sge->len = cpu_to_le32(cmd.size);
-+
-+ status = be_mcc_notify_wait(adapter);
-+ if (!status) {
-+ resp_phy_info = cmd.va + sizeof(struct be_cmd_req_hdr);
-+ phy_info->phy_type = le16_to_cpu(resp_phy_info->phy_type);
-+ phy_info->interface_type =
-+ le16_to_cpu(resp_phy_info->interface_type);
-+ phy_info->auto_speeds_supported =
-+ le16_to_cpu(resp_phy_info->auto_speeds_supported);
-+ phy_info->fixed_speeds_supported =
-+ le16_to_cpu(resp_phy_info->fixed_speeds_supported);
-+ phy_info->misc_params =
-+ le32_to_cpu(resp_phy_info->misc_params);
-+ }
-+ pci_free_consistent(adapter->pdev, cmd.size,
-+ cmd.va, cmd.dma);
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+int be_cmd_set_qos(struct be_adapter *adapter, u32 bps, u32 domain)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_set_qos *req;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+
-+ req = embedded_payload(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_SET_QOS);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_SET_QOS, sizeof(*req));
-+
-+ req->hdr.domain = domain;
-+ req->valid_bits = cpu_to_le32(BE_QOS_BITS_NIC);
-+ req->max_bps_nic = cpu_to_le32(bps);
-+
-+ status = be_mcc_notify_wait(adapter);
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+int be_cmd_get_cntl_attributes(struct be_adapter *adapter)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_cntl_attribs *req;
-+ struct be_cmd_resp_cntl_attribs *resp;
-+ struct be_sge *sge;
-+ int status;
-+ int payload_len = max(sizeof(*req), sizeof(*resp));
-+ struct mgmt_controller_attrib *attribs;
-+ struct be_dma_mem attribs_cmd;
-+
-+ memset(&attribs_cmd, 0, sizeof(struct be_dma_mem));
-+ attribs_cmd.size = sizeof(struct be_cmd_resp_cntl_attribs);
-+ attribs_cmd.va = pci_alloc_consistent(adapter->pdev, attribs_cmd.size,
-+ &attribs_cmd.dma);
-+ if (!attribs_cmd.va) {
-+ dev_err(&adapter->pdev->dev,
-+ "Memory allocation failure\n");
-+ return -ENOMEM;
-+ }
-+
-+ if (mutex_lock_interruptible(&adapter->mbox_lock))
-+ return -1;
-+
-+ wrb = wrb_from_mbox(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+ req = attribs_cmd.va;
-+ sge = nonembedded_sgl(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, payload_len, false, 1,
-+ OPCODE_COMMON_GET_CNTL_ATTRIBUTES);
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_GET_CNTL_ATTRIBUTES, payload_len);
-+ sge->pa_hi = cpu_to_le32(upper_32_bits(attribs_cmd.dma));
-+ sge->pa_lo = cpu_to_le32(attribs_cmd.dma & 0xFFFFFFFF);
-+ sge->len = cpu_to_le32(attribs_cmd.size);
-+
-+ status = be_mbox_notify_wait(adapter);
-+ if (!status) {
-+ attribs = (struct mgmt_controller_attrib *)(attribs_cmd.va +
-+ sizeof(struct be_cmd_resp_hdr));
-+ adapter->hba_port_num = attribs->hba_attribs.phy_port;
-+ strncpy(adapter->model_number,
-+ attribs->hba_attribs.controller_model_number, 31);
-+ }
-+
-+err:
-+ mutex_unlock(&adapter->mbox_lock);
-+ pci_free_consistent(adapter->pdev, attribs_cmd.size, attribs_cmd.va,
-+ attribs_cmd.dma);
-+ return status;
-+}
-+
-+/* Uses mbox */
-+int be_cmd_req_native_mode(struct be_adapter *adapter)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_set_func_cap *req;
-+ int status;
-+
-+ if (mutex_lock_interruptible(&adapter->mbox_lock))
-+ return -1;
-+
-+ wrb = wrb_from_mbox(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+
-+ req = embedded_payload(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_SET_DRIVER_FUNCTION_CAP);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_SET_DRIVER_FUNCTION_CAP, sizeof(*req));
-+
-+ req->valid_cap_flags = cpu_to_le32(CAPABILITY_SW_TIMESTAMPS |
-+ CAPABILITY_BE3_NATIVE_ERX_API);
-+ req->cap_flags = cpu_to_le32(CAPABILITY_BE3_NATIVE_ERX_API);
-+
-+ status = be_mbox_notify_wait(adapter);
-+ if (!status) {
-+ struct be_cmd_resp_set_func_cap *resp = embedded_payload(wrb);
-+ adapter->be3_native = le32_to_cpu(resp->cap_flags) &
-+ CAPABILITY_BE3_NATIVE_ERX_API;
-+ }
-+err:
-+ mutex_unlock(&adapter->mbox_lock);
-+ return status;
-+}
-+
-+static void encode_port_names(struct be_adapter *adapter)
-+{
-+ switch (adapter->port_name[adapter->hba_port_num]) {
-+ case '0':
-+ adapter->port_name[adapter->hba_port_num] = 0;
-+ break;
-+ case '1':
-+ adapter->port_name[adapter->hba_port_num] = 1;
-+ break;
-+ case '2':
-+ adapter->port_name[adapter->hba_port_num] = 2;
-+ break;
-+ case '3':
-+ adapter->port_name[adapter->hba_port_num] = 3;
-+ break;
-+ case '4':
-+ adapter->port_name[adapter->hba_port_num] = 4;
-+ break;
-+ case 'A':
-+ adapter->port_name[adapter->hba_port_num] = 5;
-+ break;
-+ case 'B':
-+ adapter->port_name[adapter->hba_port_num] = 6;
-+ break;
-+ case 'C':
-+ adapter->port_name[adapter->hba_port_num] = 7;
-+ break;
-+ case 'D':
-+ adapter->port_name[adapter->hba_port_num] = 8;
-+ break;
-+ }
-+}
-+
-+int be_cmd_query_port_names_v0(struct be_adapter *adapter, u8 *port_name)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_get_port_name *req;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+
-+ req = embedded_payload(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_GET_PORT_NAME);
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_GET_PORT_NAME, sizeof(*req));
-+
-+ status = be_mcc_notify_wait(adapter);
-+ if (!status) {
-+ struct be_cmd_resp_get_port_name *resp = embedded_payload(wrb);
-+ port_name[0] = resp->port0_name;
-+ port_name[1] = resp->port1_name;
-+ }
-+
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+
-+ if(!status)
-+ encode_port_names(adapter);
-+ return status;
-+}
-+
-+int be_cmd_query_port_names_v1(struct be_adapter *adapter, u8 *port_name)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_get_port_name *req;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+ req = embedded_payload(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_GET_PORT_NAME);
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_GET_PORT_NAME, sizeof(*req));
-+ req->hdr.version = 1;
-+
- status = be_mcc_notify_wait(adapter);
-+ if (!status) {
-+ struct be_cmd_resp_get_port_name_v1 *resp = embedded_payload(wrb);
-+ port_name[0] = resp->port0_name;
-+ port_name[1] = resp->port1_name;
-+ port_name[2] = resp->port2_name;
-+ port_name[3] = resp->port3_name;
-+ }
-+
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+
-+ if (!status)
-+ encode_port_names(adapter);
-+ return status;
-+}
-+
-+int be_cmd_req_pg_pfc(struct be_adapter *adapter, int *fw_num_txqs)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_pg *req;
-+ int status, num = 0;
-+ bool query = true;
-+
-+ *fw_num_txqs = MAX_TX_QS;
-+
-+ if (mutex_lock_interruptible(&adapter->mbox_lock))
-+ return -1;
-+
-+enable_pfc:
-+ wrb = wrb_from_mbox(adapter);
-+ req = embedded_payload(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_ETH_PG_FEATURE_QUERY_REQUEST);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_ETH,
-+ OPCODE_ETH_PG_FEATURE_QUERY_REQUEST, sizeof(*req));
-+
-+ if (query)
-+ req->query |= cpu_to_le32(REQ_PG_QUERY);
-+ req->pfc_pg |= cpu_to_le32(REQ_PG_FEAT);
-+
-+ status = be_mbox_notify_wait(adapter);
-+ if (!status) {
-+ struct be_cmd_resp_pg *resp = embedded_payload(wrb);
-+ if (query) {
-+ if (le32_to_cpu(resp->pfc_pg) & REQ_PG_FEAT) {
-+ num = le32_to_cpu(resp->num_tx_rings);
-+ query = false;
-+ goto enable_pfc;
-+ }
-+ } else {
-+ adapter->flags |= BE_FLAGS_DCBX;
-+ *fw_num_txqs = num;
-+ }
-+ }
-+
-+ mutex_unlock(&adapter->mbox_lock);
-+ return status;
-+}
-+
-+/* Set privilege(s) for a function */
-+int be_cmd_set_fn_privileges(struct be_adapter *adapter, u32 mask, u32 *prev,
-+ u32 domain)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_set_fn_privileges *req;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+
-+ req = embedded_payload(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_SET_FN_PRIVILEGES);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_SET_FN_PRIVILEGES, sizeof(*req));
-+
-+ req->hdr.domain = domain;
-+ req->privilege_mask = cpu_to_le32(mask);
-+
-+ status = be_mcc_notify_wait(adapter);
-+
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+/* Get privilege(s) for a function */
-+int be_cmd_get_fn_privileges(struct be_adapter *adapter, u32 *privilege,
-+ u32 domain)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_get_fn_privileges *req;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+
-+ req = embedded_payload(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_GET_FN_PRIVILEGES);
-
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_GET_FN_PRIVILEGES, sizeof(*req));
-+
-+ req->hdr.domain = domain;
-+
-+ status = be_mcc_notify_wait(adapter);
-+ if (!status) {
-+ struct be_cmd_resp_get_fn_privileges *resp =
-+ embedded_payload(wrb);
-+ *privilege = le32_to_cpu(resp->privilege_mask);
-+ } else
-+ *privilege = 0;
-+
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+/* Set Hyper switch config */
-+int be_cmd_set_hsw_config(struct be_adapter *adapter, u16 pvid,
-+ u32 domain, u16 intf_id)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_set_hsw_config *req;
-+ void *ctxt;
-+ int status;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+
-+ req = embedded_payload(wrb);
-+ ctxt = &req->context;
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_SET_HSW_CONFIG);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_SET_HSW_CONFIG, sizeof(*req));
-+
-+ req->hdr.domain = domain;
-+ AMAP_SET_BITS(struct amap_set_hsw_context, interface_id, ctxt, intf_id);
-+ if (pvid) {
-+ AMAP_SET_BITS(struct amap_set_hsw_context, pvid_valid, ctxt, 1);
-+ AMAP_SET_BITS(struct amap_set_hsw_context, pvid, ctxt, pvid);
-+ }
-+
-+ be_dws_cpu_to_le(req->context, sizeof(req->context));
-+ status = be_mcc_notify_wait(adapter);
-+
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+/* Get Hyper switch config */
-+int be_cmd_get_hsw_config(struct be_adapter *adapter, u16 *pvid,
-+ u32 domain, u16 intf_id)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_get_hsw_config *req;
-+ void *ctxt;
-+ int status;
-+ u16 vid;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+
-+ req = embedded_payload(wrb);
-+ ctxt = &req->context;
-+
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_GET_HSW_CONFIG);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_GET_HSW_CONFIG, sizeof(*req));
-+
-+ req->hdr.domain = domain;
-+ AMAP_SET_BITS(struct amap_get_hsw_req_context, interface_id, ctxt,
-+ intf_id);
-+ AMAP_SET_BITS(struct amap_get_hsw_req_context, pvid_valid, ctxt, 1);
-+ be_dws_cpu_to_le(req->context, sizeof(req->context));
-+
-+ status = be_mcc_notify_wait(adapter);
-+ if (!status) {
-+ struct be_cmd_resp_get_hsw_config *resp =
-+ embedded_payload(wrb);
-+ be_dws_le_to_cpu(&resp->context,
-+ sizeof(resp->context));
-+ vid = AMAP_GET_BITS(struct amap_get_hsw_resp_context,
-+ pvid, &resp->context);
-+ *pvid = le16_to_cpu(vid);
-+ }
-+
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+int be_cmd_get_port_speed(struct be_adapter *adapter,
-+ u8 port_num, u16 *dac_cable_len, u16 *port_speed)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_get_port_speed *req;
-+ int status = 0;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+
-+ req = embedded_payload(wrb);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_NTWK_GET_LINK_SPEED);
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_NTWK_GET_LINK_SPEED,
-+ sizeof(*req));
-+ req->port_num = port_num;
-+ status = be_mcc_notify_wait(adapter);
-+ if (!status) {
-+ struct be_cmd_resp_get_port_speed *resp =
-+ embedded_payload(wrb);
-+ *dac_cable_len = resp->dac_cable_length;
-+ *port_speed = resp->mac_speed;
-+ }
-+
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+int be_cmd_set_port_speed_v1(struct be_adapter *adapter,
-+ u8 port_num, u16 mac_speed,
-+ u16 dac_cable_len)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_cmd_req_set_port_speed_v1 *req;
-+ int status = 0;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+ req = embedded_payload(wrb);
-+ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
-+ OPCODE_COMMON_NTWK_SET_LINK_SPEED);
-+
-+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
-+ OPCODE_COMMON_NTWK_SET_LINK_SPEED,
-+ sizeof(*req));
-+ req->hdr.version=1;
-+
-+ req->port_num = port_num;
-+ req->virt_port = port_num;
-+ req->mac_speed = mac_speed;
-+ req->dac_cable_length = dac_cable_len;
-+ status = be_mcc_notify_wait(adapter);
-+err:
-+ spin_unlock_bh(&adapter->mcc_lock);
-+ return status;
-+}
-+
-+
-+/* Uses sync mcc */
-+#ifdef CONFIG_PALAU
-+int be_cmd_pass_ext_ioctl(struct be_adapter *adapter, dma_addr_t dma,
-+ int req_size, void *va)
-+{
-+ struct be_mcc_wrb *wrb;
-+ struct be_sge *sge;
-+ int status;
-+ struct be_cmd_req_hdr *hdr = (struct be_cmd_req_hdr *) va;
-+
-+ spin_lock_bh(&adapter->mcc_lock);
-+
-+ wrb = wrb_from_mccq(adapter);
-+ if (!wrb) {
-+ status = -EBUSY;
-+ goto err;
-+ }
-+ sge = nonembedded_sgl(wrb);
-+
-+ be_wrb_hdr_prepare(wrb, req_size, false, 1, hdr->opcode);
-+ wrb->tag1 = MCC_WRB_PASS_THRU;
-+ sge->pa_hi = cpu_to_le32(upper_32_bits(dma));
-+ sge->pa_lo = cpu_to_le32(dma & 0xFFFFFFFF);
-+ sge->len = cpu_to_le32(req_size);
-+
-+ status = be_mcc_notify_wait(adapter);
-+err:
- spin_unlock_bh(&adapter->mcc_lock);
- return status;
- }
-+#endif
-diff --git a/drivers/net/benet/be_cmds.h b/drivers/net/benet/be_cmds.h
-index ad33d55..35aa5c7 100644
---- a/drivers/net/benet/be_cmds.h
-+++ b/drivers/net/benet/be_cmds.h
-@@ -1,20 +1,23 @@
- /*
-- * Copyright (C) 2005 - 2009 ServerEngines
-+ * Copyright (C) 2005 - 2011 Emulex
- * All rights reserved.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License version 2
-- * as published by the Free Software Foundation. The full GNU General
-+ * as published by the Free Software Foundation. The full GNU General
- * Public License is included in this distribution in the file called COPYING.
- *
- * Contact Information:
-- * linux-drivers@serverengines.com
-+ * linux-drivers@emulex.com
- *
-- * ServerEngines
-- * 209 N. Fair Oaks Ave
-- * Sunnyvale, CA 94085
-+ * Emulex
-+ * 3333 Susan Street
-+ * Costa Mesa, CA 92626
- */
-
-+#ifndef BE_CMDS_H
-+#define BE_CMDS_H
-+
- /*
- * The driver sends configuration and managements command requests to the
- * firmware in the BE. These requests are communicated to the processor
-@@ -29,9 +32,10 @@ struct be_sge {
- u32 len;
- };
-
--#define MCC_WRB_EMBEDDED_MASK 1 /* bit 0 of dword 0*/
-+#define MCC_WRB_EMBEDDED_MASK 1 /* bit 0 of dword 0*/
- #define MCC_WRB_SGE_CNT_SHIFT 3 /* bits 3 - 7 of dword 0 */
- #define MCC_WRB_SGE_CNT_MASK 0x1F /* bits 3 - 7 of dword 0 */
-+#define MCC_WRB_PASS_THRU 0xFF /* this wrb is used for pass thru cmd */
- struct be_mcc_wrb {
- u32 embedded; /* dword 0 */
- u32 payload_length; /* dword 1 */
-@@ -44,24 +48,19 @@ struct be_mcc_wrb {
- } payload;
- };
-
--#define CQE_FLAGS_VALID_MASK (1 << 31)
--#define CQE_FLAGS_ASYNC_MASK (1 << 30)
--#define CQE_FLAGS_COMPLETED_MASK (1 << 28)
--#define CQE_FLAGS_CONSUMED_MASK (1 << 27)
-+#define CQE_FLAGS_VALID_MASK (1 << 31)
-+#define CQE_FLAGS_ASYNC_MASK (1 << 30)
-+#define CQE_FLAGS_COMPLETED_MASK (1 << 28)
-+#define CQE_FLAGS_CONSUMED_MASK (1 << 27)
-
- /* Completion Status */
- enum {
-- MCC_STATUS_SUCCESS = 0x0,
--/* The client does not have sufficient privileges to execute the command */
-- MCC_STATUS_INSUFFICIENT_PRIVILEGES = 0x1,
--/* A parameter in the command was invalid. */
-- MCC_STATUS_INVALID_PARAMETER = 0x2,
--/* There are insufficient chip resources to execute the command */
-- MCC_STATUS_INSUFFICIENT_RESOURCES = 0x3,
--/* The command is completing because the queue was getting flushed */
-- MCC_STATUS_QUEUE_FLUSHING = 0x4,
--/* The command is completing with a DMA error */
-- MCC_STATUS_DMA_FAILED = 0x5,
-+ MCC_STATUS_SUCCESS = 0,
-+ MCC_STATUS_FAILED = 1,
-+ MCC_STATUS_ILLEGAL_REQUEST = 2,
-+ MCC_STATUS_ILLEGAL_FIELD = 3,
-+ MCC_STATUS_INSUFFICIENT_BUFFER = 4,
-+ MCC_STATUS_UNAUTHORIZED_REQUEST = 5,
- MCC_STATUS_NOT_SUPPORTED = 66
- };
-
-@@ -81,15 +80,24 @@ struct be_mcc_compl {
- * mcc_compl is interpreted as follows:
- */
- #define ASYNC_TRAILER_EVENT_CODE_SHIFT 8 /* bits 8 - 15 */
-+#define ASYNC_TRAILER_EVENT_TYPE_SHIFT 16 /* bits 16 - 23 */
- #define ASYNC_TRAILER_EVENT_CODE_MASK 0xFF
-+#define ASYNC_TRAILER_EVENT_TYPE_MASK 0xFF
- #define ASYNC_EVENT_CODE_LINK_STATE 0x1
-+#define ASYNC_EVENT_CODE_GRP_5 0x5
-+#define ASYNC_EVENT_QOS_SPEED 0x1
-+#define ASYNC_EVENT_COS_PRIORITY 0x2
-+#define ASYNC_EVENT_PVID_STATE 0x3
-+#define GRP5_TYPE_PRIO_TC_MAP 4
-+
- struct be_async_event_trailer {
- u32 code;
- };
-
- enum {
-- ASYNC_EVENT_LINK_DOWN = 0x0,
-- ASYNC_EVENT_LINK_UP = 0x1
-+ ASYNC_EVENT_LINK_DOWN = 0x0,
-+ ASYNC_EVENT_LINK_UP = 0x1,
-+ ASYNC_EVENT_LOGICAL = 0x2
- };
-
- /* When the event code of an async trailer is link-state, the mcc_compl
-@@ -101,7 +109,51 @@ struct be_async_event_link_state {
- u8 port_duplex;
- u8 port_speed;
- u8 port_fault;
-- u8 rsvd0[7];
-+ u8 rsvd0;
-+ u16 qos_link_speed;
-+ u32 event_tag;
-+ struct be_async_event_trailer trailer;
-+} __packed;
-+
-+/* When the event code of an async trailer is GRP-5 and event_type is QOS_SPEED
-+ * the mcc_compl must be interpreted as follows
-+ */
-+struct be_async_event_grp5_qos_link_speed {
-+ u8 physical_port;
-+ u8 rsvd[5];
-+ u16 qos_link_speed;
-+ u32 event_tag;
-+ struct be_async_event_trailer trailer;
-+} __packed;
-+
-+/* When the event code of an async trailer is GRP5 and event type is
-+ * CoS-Priority, the mcc_compl must be interpreted as follows
-+ */
-+struct be_async_event_grp5_cos_priority {
-+ u8 physical_port;
-+ u8 available_priority_bmap;
-+ u8 reco_default_priority;
-+ u8 valid;
-+ u8 rsvd0;
-+ u8 event_tag;
-+ struct be_async_event_trailer trailer;
-+} __packed;
-+
-+/* When the event code of an async trailer is GRP5 and event type is
-+ * PVID state, the mcc_compl must be interpreted as follows
-+ */
-+struct be_async_event_grp5_pvid_state {
-+ u8 enabled;
-+ u8 rsvd0;
-+ u16 tag;
-+ u32 event_tag;
-+ u32 rsvd1;
-+ struct be_async_event_trailer trailer;
-+} __packed;
-+
-+/* GRP5 prio-tc-map event */
-+struct be_async_event_grp5_prio_tc_map {
-+ u8 prio_tc_map[8]; /* map[prio] -> tc_id */
- struct be_async_event_trailer trailer;
- } __packed;
-
-@@ -111,41 +163,68 @@ struct be_mcc_mailbox {
- };
-
- #define CMD_SUBSYSTEM_COMMON 0x1
--#define CMD_SUBSYSTEM_ETH 0x3
-+#define CMD_SUBSYSTEM_ETH 0x3
-+#define CMD_SUBSYSTEM_LOWLEVEL 0xb
-
- #define OPCODE_COMMON_NTWK_MAC_QUERY 1
- #define OPCODE_COMMON_NTWK_MAC_SET 2
- #define OPCODE_COMMON_NTWK_MULTICAST_SET 3
--#define OPCODE_COMMON_NTWK_VLAN_CONFIG 4
-+#define OPCODE_COMMON_NTWK_VLAN_CONFIG 4
- #define OPCODE_COMMON_NTWK_LINK_STATUS_QUERY 5
-+#define OPCODE_COMMON_READ_FLASHROM 6
- #define OPCODE_COMMON_WRITE_FLASHROM 7
- #define OPCODE_COMMON_CQ_CREATE 12
- #define OPCODE_COMMON_EQ_CREATE 13
--#define OPCODE_COMMON_MCC_CREATE 21
--#define OPCODE_COMMON_NTWK_RX_FILTER 34
-+#define OPCODE_COMMON_MCC_CREATE 21
-+#define OPCODE_COMMON_SET_QOS 28
-+#define OPCODE_COMMON_MCC_CREATE_EXT 90
-+#define OPCODE_COMMON_SEEPROM_READ 30
-+#define OPCODE_COMMON_GET_CNTL_ATTRIBUTES 32
-+#define OPCODE_COMMON_NTWK_RX_FILTER 34
- #define OPCODE_COMMON_GET_FW_VERSION 35
- #define OPCODE_COMMON_SET_FLOW_CONTROL 36
- #define OPCODE_COMMON_GET_FLOW_CONTROL 37
- #define OPCODE_COMMON_SET_FRAME_SIZE 39
- #define OPCODE_COMMON_MODIFY_EQ_DELAY 41
- #define OPCODE_COMMON_FIRMWARE_CONFIG 42
--#define OPCODE_COMMON_NTWK_INTERFACE_CREATE 50
--#define OPCODE_COMMON_NTWK_INTERFACE_DESTROY 51
--#define OPCODE_COMMON_MCC_DESTROY 53
--#define OPCODE_COMMON_CQ_DESTROY 54
--#define OPCODE_COMMON_EQ_DESTROY 55
-+#define OPCODE_COMMON_NTWK_INTERFACE_CREATE 50
-+#define OPCODE_COMMON_NTWK_INTERFACE_DESTROY 51
-+#define OPCODE_COMMON_MCC_DESTROY 53
-+#define OPCODE_COMMON_CQ_DESTROY 54
-+#define OPCODE_COMMON_EQ_DESTROY 55
-+#define OPCODE_COMMON_NTWK_SET_LINK_SPEED 57
- #define OPCODE_COMMON_QUERY_FIRMWARE_CONFIG 58
- #define OPCODE_COMMON_NTWK_PMAC_ADD 59
- #define OPCODE_COMMON_NTWK_PMAC_DEL 60
- #define OPCODE_COMMON_FUNCTION_RESET 61
-+#define OPCODE_COMMON_MANAGE_FAT 68
-+#define OPCODE_COMMON_ENABLE_DISABLE_BEACON 69
-+#define OPCODE_COMMON_GET_BEACON_STATE 70
-+#define OPCODE_COMMON_READ_TRANSRECV_DATA 73
-+#define OPCODE_COMMON_GET_PORT_NAME 77
-+#define OPCODE_COMMON_SET_FN_PRIVILEGES 100
-+#define OPCODE_COMMON_GET_PHY_DETAILS 102
-+#define OPCODE_COMMON_SET_DRIVER_FUNCTION_CAP 103
-+#define OPCODE_COMMON_GET_CNTL_ADDITIONAL_ATTRIBUTES 121
-+#define OPCODE_COMMON_NTWK_GET_LINK_SPEED 134
-+#define OPCODE_COMMON_GET_HSW_CONFIG 152
-+#define OPCODE_COMMON_SET_HSW_CONFIG 153
-+#define OPCODE_COMMON_GET_FN_PRIVILEGES 170
-
-+#define OPCODE_ETH_RSS_CONFIG 1
- #define OPCODE_ETH_ACPI_CONFIG 2
- #define OPCODE_ETH_PROMISCUOUS 3
- #define OPCODE_ETH_GET_STATISTICS 4
- #define OPCODE_ETH_TX_CREATE 7
--#define OPCODE_ETH_RX_CREATE 8
--#define OPCODE_ETH_TX_DESTROY 9
--#define OPCODE_ETH_RX_DESTROY 10
-+#define OPCODE_ETH_RX_CREATE 8
-+#define OPCODE_ETH_TX_DESTROY 9
-+#define OPCODE_ETH_RX_DESTROY 10
-+#define OPCODE_ETH_ACPI_WOL_MAGIC_CONFIG 12
-+#define OPCODE_ETH_PG_FEATURE_QUERY_REQUEST 23
-+
-+#define OPCODE_LOWLEVEL_HOST_DDR_DMA 17
-+#define OPCODE_LOWLEVEL_LOOPBACK_TEST 18
-+#define OPCODE_LOWLEVEL_SET_LOOPBACK_MODE 19
-
- struct be_cmd_req_hdr {
- u8 opcode; /* dword 0 */
-@@ -159,7 +238,7 @@ struct be_cmd_req_hdr {
- };
-
- #define RESP_HDR_INFO_OPCODE_SHIFT 0 /* bits 0 - 7 */
--#define RESP_HDR_INFO_SUBSYS_SHIFT 8 /* bits 8 - 15 */
-+#define RESP_HDR_INFO_SUBSYS_SHIFT 8 /* bits 8 - 15 */
- struct be_cmd_resp_hdr {
- u32 info; /* dword 0 */
- u32 status; /* dword 1 */
-@@ -265,7 +344,7 @@ struct be_cmd_req_pmac_del {
- /******************** Create CQ ***************************/
- /* Pseudo amap definition in which each bit of the actual structure is defined
- * as a byte: used to calculate offset/shift/mask of each field */
--struct amap_cq_context {
-+struct amap_cq_context_be {
- u8 cidx[11]; /* dword 0*/
- u8 rsvd0; /* dword 0*/
- u8 coalescwm[2]; /* dword 0*/
-@@ -288,11 +367,28 @@ struct amap_cq_context {
- u8 rsvd5[32]; /* dword 3*/
- } __packed;
-
-+struct amap_cq_context_lancer {
-+ u8 rsvd0[12]; /* dword 0*/
-+ u8 coalescwm[2]; /* dword 0*/
-+ u8 nodelay; /* dword 0*/
-+ u8 rsvd1[12]; /* dword 0*/
-+ u8 count[2]; /* dword 0*/
-+ u8 valid; /* dword 0*/
-+ u8 rsvd2; /* dword 0*/
-+ u8 eventable; /* dword 0*/
-+ u8 eqid[16]; /* dword 1*/
-+ u8 rsvd3[15]; /* dword 1*/
-+ u8 armed; /* dword 1*/
-+ u8 rsvd4[32]; /* dword 2*/
-+ u8 rsvd5[32]; /* dword 3*/
-+} __packed;
-+
- struct be_cmd_req_cq_create {
- struct be_cmd_req_hdr hdr;
- u16 num_pages;
-- u16 rsvd0;
-- u8 context[sizeof(struct amap_cq_context) / 8];
-+ u8 page_size;
-+ u8 rsvd0;
-+ u8 context[sizeof(struct amap_cq_context_be) / 8];
- struct phys_addr pages[8];
- } __packed;
-
-@@ -302,10 +398,28 @@ struct be_cmd_resp_cq_create {
- u16 rsvd0;
- } __packed;
-
-+struct be_cmd_req_get_fat {
-+ struct be_cmd_req_hdr hdr;
-+ u32 fat_operation;
-+ u32 read_log_offset;
-+ u32 read_log_length;
-+ u32 data_buffer_size;
-+ u32 data_buffer[1];
-+} __packed;
-+
-+struct be_cmd_resp_get_fat {
-+ struct be_cmd_resp_hdr hdr;
-+ u32 log_size;
-+ u32 read_log_length;
-+ u32 rsvd[2];
-+ u32 data_buffer[1];
-+} __packed;
-+
-+
- /******************** Create MCCQ ***************************/
- /* Pseudo amap definition in which each bit of the actual structure is defined
- * as a byte: used to calculate offset/shift/mask of each field */
--struct amap_mcc_context {
-+struct amap_mcc_context_be {
- u8 con_index[14];
- u8 rsvd0[2];
- u8 ring_size[4];
-@@ -320,11 +434,31 @@ struct amap_mcc_context {
- u8 rsvd2[32];
- } __packed;
-
-+struct amap_mcc_context_lancer {
-+ u8 async_cq_id[16];
-+ u8 ring_size[4];
-+ u8 rsvd0[12];
-+ u8 rsvd1[31];
-+ u8 valid;
-+ u8 async_cq_valid[1];
-+ u8 rsvd2[31];
-+ u8 rsvd3[32];
-+} __packed;
-+
- struct be_cmd_req_mcc_create {
- struct be_cmd_req_hdr hdr;
- u16 num_pages;
-- u16 rsvd0;
-- u8 context[sizeof(struct amap_mcc_context) / 8];
-+ u16 cq_id;
-+ u8 context[sizeof(struct amap_mcc_context_be) / 8];
-+ struct phys_addr pages[8];
-+} __packed;
-+
-+struct be_cmd_req_mcc_ext_create {
-+ struct be_cmd_req_hdr hdr;
-+ u16 num_pages;
-+ u16 cq_id;
-+ u32 async_event_bitmap[1];
-+ u8 context[sizeof(struct amap_mcc_context_be) / 8];
- struct phys_addr pages[8];
- } __packed;
-
-@@ -335,49 +469,32 @@ struct be_cmd_resp_mcc_create {
- } __packed;
-
- /******************** Create TxQ ***************************/
--#define BE_ETH_TX_RING_TYPE_STANDARD 2
-+#define ETX_QUEUE_TYPE_STANDARD 0x2
-+#define ETX_QUEUE_TYPE_PRIORITY 0x10
- #define BE_ULP1_NUM 1
-
--/* Pseudo amap definition in which each bit of the actual structure is defined
-- * as a byte: used to calculate offset/shift/mask of each field */
--struct amap_tx_context {
-- u8 rsvd0[16]; /* dword 0 */
-- u8 tx_ring_size[4]; /* dword 0 */
-- u8 rsvd1[26]; /* dword 0 */
-- u8 pci_func_id[8]; /* dword 1 */
-- u8 rsvd2[9]; /* dword 1 */
-- u8 ctx_valid; /* dword 1 */
-- u8 cq_id_send[16]; /* dword 2 */
-- u8 rsvd3[16]; /* dword 2 */
-- u8 rsvd4[32]; /* dword 3 */
-- u8 rsvd5[32]; /* dword 4 */
-- u8 rsvd6[32]; /* dword 5 */
-- u8 rsvd7[32]; /* dword 6 */
-- u8 rsvd8[32]; /* dword 7 */
-- u8 rsvd9[32]; /* dword 8 */
-- u8 rsvd10[32]; /* dword 9 */
-- u8 rsvd11[32]; /* dword 10 */
-- u8 rsvd12[32]; /* dword 11 */
-- u8 rsvd13[32]; /* dword 12 */
-- u8 rsvd14[32]; /* dword 13 */
-- u8 rsvd15[32]; /* dword 14 */
-- u8 rsvd16[32]; /* dword 15 */
--} __packed;
--
- struct be_cmd_req_eth_tx_create {
- struct be_cmd_req_hdr hdr;
- u8 num_pages;
- u8 ulp_num;
-- u8 type;
-- u8 bound_port;
-- u8 context[sizeof(struct amap_tx_context) / 8];
-+ u16 type;
-+ u16 if_id;
-+ u8 queue_size;
-+ u8 rsvd1;
-+ u32 rsvd2;
-+ u16 cq_id;
-+ u16 rsvd3;
-+ u32 rsvd4[13];
- struct phys_addr pages[8];
- } __packed;
-
- struct be_cmd_resp_eth_tx_create {
- struct be_cmd_resp_hdr hdr;
- u16 cid;
-- u16 rsvd0;
-+ u16 rid;
-+ u32 db_offset;
-+ u8 tc_id;
-+ u8 rsvd0[3];
- } __packed;
-
- /******************** Create RxQ ***************************/
-@@ -396,7 +513,7 @@ struct be_cmd_req_eth_rx_create {
- struct be_cmd_resp_eth_rx_create {
- struct be_cmd_resp_hdr hdr;
- u16 id;
-- u8 cpu_id;
-+ u8 rss_id;
- u8 rsvd0;
- } __packed;
-
-@@ -429,14 +546,15 @@ enum be_if_flags {
- BE_IF_FLAGS_VLAN = 0x100,
- BE_IF_FLAGS_MCAST_PROMISCUOUS = 0x200,
- BE_IF_FLAGS_PASS_L2_ERRORS = 0x400,
-- BE_IF_FLAGS_PASS_L3L4_ERRORS = 0x800
-+ BE_IF_FLAGS_PASS_L3L4_ERRORS = 0x800,
-+ BE_IF_FLAGS_MULTICAST = 0x1000
- };
-
- /* An RX interface is an object with one or more MAC addresses and
- * filtering capabilities. */
- struct be_cmd_req_if_create {
- struct be_cmd_req_hdr hdr;
-- u32 version; /* ignore currntly */
-+ u32 version; /* ignore currently */
- u32 capability_flags;
- u32 enable_flags;
- u8 mac_addr[ETH_ALEN];
-@@ -458,7 +576,7 @@ struct be_cmd_req_if_destroy {
- };
-
- /*************** HW Stats Get **********************************/
--struct be_port_rxf_stats {
-+struct be_port_rxf_stats_v0 {
- u32 rx_bytes_lsd; /* dword 0*/
- u32 rx_bytes_msd; /* dword 1*/
- u32 rx_total_frames; /* dword 2*/
-@@ -527,8 +645,8 @@ struct be_port_rxf_stats {
- u32 rx_input_fifo_overflow; /* dword 65*/
- };
-
--struct be_rxf_stats {
-- struct be_port_rxf_stats port[2];
-+struct be_rxf_stats_v0 {
-+ struct be_port_rxf_stats_v0 port[2];
- u32 rx_drops_no_pbuf; /* dword 132*/
- u32 rx_drops_no_txpb; /* dword 133*/
- u32 rx_drops_no_erx_descr; /* dword 134*/
-@@ -545,31 +663,51 @@ struct be_rxf_stats {
- u32 rx_drops_invalid_ring; /* dword 145*/
- u32 forwarded_packets; /* dword 146*/
- u32 rx_drops_mtu; /* dword 147*/
-- u32 rsvd0[15];
-+ u32 rsvd0[7];
-+ u32 port0_jabber_events;
-+ u32 port1_jabber_events;
-+ u32 rsvd1[6];
- };
-
--struct be_erx_stats {
-+struct be_erx_stats_v0 {
- u32 rx_drops_no_fragments[44]; /* dwordS 0 to 43*/
-- u32 debug_wdma_sent_hold; /* dword 44*/
-- u32 debug_wdma_pbfree_sent_hold; /* dword 45*/
-- u32 debug_wdma_zerobyte_pbfree_sent_hold; /* dword 46*/
-- u32 debug_pmem_pbuf_dealloc; /* dword 47*/
-+ u32 rsvd[4];
- };
-
--struct be_hw_stats {
-- struct be_rxf_stats rxf;
-+struct be_pmem_stats {
-+ u32 eth_red_drops;
-+ u32 rsvd[5];
-+};
-+
-+struct be_hw_stats_v0 {
-+ struct be_rxf_stats_v0 rxf;
- u32 rsvd[48];
-- struct be_erx_stats erx;
-+ struct be_erx_stats_v0 erx;
-+ struct be_pmem_stats pmem;
- };
-
--struct be_cmd_req_get_stats {
-+struct be_cmd_req_get_stats_v0 {
- struct be_cmd_req_hdr hdr;
-- u8 rsvd[sizeof(struct be_hw_stats)];
-+ u8 rsvd[sizeof(struct be_hw_stats_v0)];
- };
-
--struct be_cmd_resp_get_stats {
-+struct be_cmd_resp_get_stats_v0 {
- struct be_cmd_resp_hdr hdr;
-- struct be_hw_stats hw_stats;
-+ struct be_hw_stats_v0 hw_stats;
-+};
-+
-+struct be_cmd_req_get_cntl_addnl_attribs {
-+ struct be_cmd_req_hdr hdr;
-+ u8 rsvd[8];
-+};
-+
-+struct be_cmd_resp_get_cntl_addnl_attribs {
-+ struct be_cmd_resp_hdr hdr;
-+ u16 ipl_file_number;
-+ u8 ipl_file_version;
-+ u8 rsvd0;
-+ u8 on_die_temperature; /* in degrees centigrade*/
-+ u8 rsvd1[3];
- };
-
- struct be_cmd_req_vlan_config {
-@@ -581,30 +719,22 @@ struct be_cmd_req_vlan_config {
- u16 normal_vlan[64];
- } __packed;
-
--struct be_cmd_req_promiscuous_config {
-- struct be_cmd_req_hdr hdr;
-- u8 port0_promiscuous;
-- u8 port1_promiscuous;
-- u16 rsvd0;
--} __packed;
--
-+/******************** RX FILTER ******************************/
-+#define BE_MAX_MC 64 /* set mcast promisc if > 64 */
- struct macaddr {
- u8 byte[ETH_ALEN];
- };
-
--struct be_cmd_req_mcast_mac_config {
-+struct be_cmd_req_rx_filter {
- struct be_cmd_req_hdr hdr;
-- u16 num_mac;
-- u8 promiscuous;
-- u8 interface_id;
-- struct macaddr mac[32];
--} __packed;
--
--static inline struct be_hw_stats *
--hw_stats_from_cmd(struct be_cmd_resp_get_stats *cmd)
--{
-- return &cmd->hw_stats;
--}
-+ u32 global_flags_mask;
-+ u32 global_flags;
-+ u32 if_flags_mask;
-+ u32 if_flags;
-+ u32 if_id;
-+ u32 mcast_num;
-+ struct macaddr mcast_mac[BE_MAX_MC];
-+};
-
- /******************** Link Status Query *******************/
- struct be_cmd_req_link_status {
-@@ -619,13 +749,18 @@ enum {
- };
-
- enum {
-- PHY_LINK_SPEED_ZERO = 0x0, /* => No link */
-+ PHY_LINK_SPEED_ZERO = 0x0, /* => No link */
- PHY_LINK_SPEED_10MBPS = 0x1,
- PHY_LINK_SPEED_100MBPS = 0x2,
- PHY_LINK_SPEED_1GBPS = 0x3,
- PHY_LINK_SPEED_10GBPS = 0x4
- };
-
-+enum {
-+ LINK_DOWN = 0x0,
-+ LINK_UP = 0X1
-+};
-+
- struct be_cmd_resp_link_status {
- struct be_cmd_resp_hdr hdr;
- u8 physical_port;
-@@ -634,9 +769,47 @@ struct be_cmd_resp_link_status {
- u8 mac_fault;
- u8 mgmt_mac_duplex;
- u8 mgmt_mac_speed;
-- u16 rsvd0;
-+ u16 link_speed;
-+ u32 logical_link_status;
- } __packed;
-
-+/******************** Port Identification ***************************/
-+/* Identifies the type of port attached to NIC */
-+struct be_cmd_req_port_type {
-+ struct be_cmd_req_hdr hdr;
-+ u32 page_num;
-+ u32 port;
-+};
-+
-+enum {
-+ TR_PAGE_A0 = 0xa0,
-+ TR_PAGE_A2 = 0xa2
-+};
-+
-+struct be_cmd_resp_port_type {
-+ struct be_cmd_resp_hdr hdr;
-+ u32 page_num;
-+ u32 port;
-+ struct data {
-+ u8 identifier;
-+ u8 identifier_ext;
-+ u8 connector;
-+ u8 transceiver[8];
-+ u8 rsvd0[3];
-+ u8 length_km;
-+ u8 length_hm;
-+ u8 length_om1;
-+ u8 length_om2;
-+ u8 length_cu;
-+ u8 length_cu_m;
-+ u8 vendor_name[16];
-+ u8 rsvd;
-+ u8 vendor_oui[3];
-+ u8 vendor_pn[16];
-+ u8 vendor_rev[4];
-+ } data;
-+};
-+
- /******************** Get FW Version *******************/
- struct be_cmd_req_get_fw_version {
- struct be_cmd_req_hdr hdr;
-@@ -686,9 +859,13 @@ struct be_cmd_resp_modify_eq_delay {
- } __packed;
-
- /******************** Get FW Config *******************/
-+#define FLEX10_MODE 0x400
-+#define VNIC_MODE 0x20000
-+#define UMC_ENABLED 0x1000000
-+
- struct be_cmd_req_query_fw_cfg {
- struct be_cmd_req_hdr hdr;
-- u32 rsvd[30];
-+ u32 rsvd[31];
- };
-
- struct be_cmd_resp_query_fw_cfg {
-@@ -696,10 +873,61 @@ struct be_cmd_resp_query_fw_cfg {
- u32 be_config_number;
- u32 asic_revision;
- u32 phys_port;
-- u32 function_cap;
-+ u32 function_mode;
- u32 rsvd[26];
-+ u32 function_caps;
- };
-
-+/******************** RSS Config *******************/
-+/* RSS types */
-+#define RSS_ENABLE_NONE 0x0
-+#define RSS_ENABLE_IPV4 0x1
-+#define RSS_ENABLE_TCP_IPV4 0x2
-+#define RSS_ENABLE_IPV6 0x4
-+#define RSS_ENABLE_TCP_IPV6 0x8
-+
-+struct be_cmd_req_rss_config {
-+ struct be_cmd_req_hdr hdr;
-+ u32 if_id;
-+ u16 enable_rss;
-+ u16 cpu_table_size_log2;
-+ u32 hash[10];
-+ u8 cpu_table[128];
-+ u8 flush;
-+ u8 rsvd0[3];
-+};
-+
-+/******************** Port Beacon ***************************/
-+
-+#define BEACON_STATE_ENABLED 0x1
-+#define BEACON_STATE_DISABLED 0x0
-+
-+struct be_cmd_req_enable_disable_beacon {
-+ struct be_cmd_req_hdr hdr;
-+ u8 port_num;
-+ u8 beacon_state;
-+ u8 beacon_duration;
-+ u8 status_duration;
-+} __packed;
-+
-+struct be_cmd_resp_enable_disable_beacon {
-+ struct be_cmd_resp_hdr resp_hdr;
-+ u32 rsvd0;
-+} __packed;
-+
-+struct be_cmd_req_get_beacon_state {
-+ struct be_cmd_req_hdr hdr;
-+ u8 port_num;
-+ u8 rsvd0;
-+ u16 rsvd1;
-+} __packed;
-+
-+struct be_cmd_resp_get_beacon_state {
-+ struct be_cmd_resp_hdr resp_hdr;
-+ u8 beacon_state;
-+ u8 rsvd0[3];
-+} __packed;
-+
- /****************** Firmware Flash ******************/
- struct flashrom_params {
- u32 op_code;
-@@ -714,17 +942,468 @@ struct be_cmd_write_flashrom {
- struct flashrom_params params;
- };
-
-+/************************ WOL *******************************/
-+struct be_cmd_req_acpi_wol_magic_config {
-+ struct be_cmd_req_hdr hdr;
-+ u32 rsvd0[145];
-+ u8 magic_mac[6];
-+ u8 rsvd2[2];
-+} __packed;
-+
-+/********************** LoopBack test *********************/
-+struct be_cmd_req_loopback_test {
-+ struct be_cmd_req_hdr hdr;
-+ u32 loopback_type;
-+ u32 num_pkts;
-+ u64 pattern;
-+ u32 src_port;
-+ u32 dest_port;
-+ u32 pkt_size;
-+};
-+
-+struct be_cmd_resp_loopback_test {
-+ struct be_cmd_resp_hdr resp_hdr;
-+ u32 status;
-+ u32 num_txfer;
-+ u32 num_rx;
-+ u32 miscomp_off;
-+ u32 ticks_compl;
-+};
-+
-+struct be_cmd_req_set_lmode {
-+ struct be_cmd_req_hdr hdr;
-+ u8 src_port;
-+ u8 dest_port;
-+ u8 loopback_type;
-+ u8 loopback_state;
-+};
-+
-+struct be_cmd_resp_set_lmode {
-+ struct be_cmd_resp_hdr resp_hdr;
-+ u8 rsvd0[4];
-+};
-+
-+/********************** DDR DMA test *********************/
-+struct be_cmd_req_ddrdma_test {
-+ struct be_cmd_req_hdr hdr;
-+ u64 pattern;
-+ u32 byte_count;
-+ u32 rsvd0;
-+ u8 snd_buff[4096];
-+ u8 rsvd1[4096];
-+};
-+
-+struct be_cmd_resp_ddrdma_test {
-+ struct be_cmd_resp_hdr hdr;
-+ u64 pattern;
-+ u32 byte_cnt;
-+ u32 snd_err;
-+ u8 rsvd0[4096];
-+ u8 rcv_buff[4096];
-+};
-+
-+/*********************** SEEPROM Read ***********************/
-+
-+#define BE_READ_SEEPROM_LEN 1024
-+struct be_cmd_req_seeprom_read {
-+ struct be_cmd_req_hdr hdr;
-+ u8 rsvd0[BE_READ_SEEPROM_LEN];
-+};
-+
-+struct be_cmd_resp_seeprom_read {
-+ struct be_cmd_req_hdr hdr;
-+ u8 seeprom_data[BE_READ_SEEPROM_LEN];
-+};
-+
-+enum {
-+ PHY_TYPE_CX4_10GB = 0,
-+ PHY_TYPE_XFP_10GB,
-+ PHY_TYPE_SFP_1GB,
-+ PHY_TYPE_SFP_PLUS_10GB,
-+ PHY_TYPE_KR_10GB,
-+ PHY_TYPE_KX4_10GB,
-+ PHY_TYPE_BASET_10GB,
-+ PHY_TYPE_BASET_1GB,
-+ PHY_TYPE_BASEX_1GB,
-+ PHY_TYPE_SGMII,
-+ PHY_TYPE_DISABLED = 255
-+};
-+
-+#define BE_AN_EN 0x2
-+#define BE_PAUSE_SYM_EN 0x80
-+
-+struct be_cmd_req_get_phy_info {
-+ struct be_cmd_req_hdr hdr;
-+ u8 rsvd0[24];
-+};
-+
-+struct be_phy_info {
-+ u16 phy_type;
-+ u16 interface_type;
-+ u32 misc_params;
-+ u16 ext_phy_details;
-+ u16 rsvd;
-+ u16 auto_speeds_supported;
-+ u16 fixed_speeds_supported;
-+ u32 future_use[2];
-+};
-+
-+struct be_cmd_resp_get_phy_info {
-+ struct be_cmd_req_hdr hdr;
-+ struct be_phy_info phy_info;
-+};
-+
-+/*********************** Set QOS ***********************/
-+
-+#define BE_QOS_BITS_NIC 1
-+
-+struct be_cmd_req_set_qos {
-+ struct be_cmd_req_hdr hdr;
-+ u32 valid_bits;
-+ u32 max_bps_nic;
-+ u32 rsvd[7];
-+};
-+
-+struct be_cmd_resp_set_qos {
-+ struct be_cmd_resp_hdr hdr;
-+ u32 rsvd;
-+};
-+
-+/*********************** Controller Attributes ***********************/
-+struct be_cmd_req_cntl_attribs {
-+ struct be_cmd_req_hdr hdr;
-+};
-+
-+struct be_cmd_resp_cntl_attribs {
-+ struct be_cmd_resp_hdr hdr;
-+ struct mgmt_controller_attrib attribs;
-+};
-+
-+/******************* get port names ***************/
-+struct be_cmd_req_get_port_name {
-+ struct be_cmd_req_hdr hdr;
-+ u32 rsvd0;
-+};
-+
-+struct be_cmd_resp_get_port_name {
-+ struct be_cmd_req_hdr hdr;
-+ u8 port0_name;
-+ u8 port1_name;
-+ u8 rsvd0[2];
-+};
-+
-+struct be_cmd_resp_get_port_name_v1 {
-+ struct be_cmd_req_hdr hdr;
-+ u32 pt : 2;
-+ u32 rsvd0 : 30;
-+ u8 port0_name;
-+ u8 port1_name;
-+ u8 port2_name;
-+ u8 port3_name;
-+};
-+
-+/*********************** Set driver function ***********************/
-+#define CAPABILITY_SW_TIMESTAMPS 2
-+#define CAPABILITY_BE3_NATIVE_ERX_API 4
-+
-+struct be_cmd_req_set_func_cap {
-+ struct be_cmd_req_hdr hdr;
-+ u32 valid_cap_flags;
-+ u32 cap_flags;
-+ u8 rsvd[212];
-+};
-+
-+struct be_cmd_resp_set_func_cap {
-+ struct be_cmd_resp_hdr hdr;
-+ u32 valid_cap_flags;
-+ u32 cap_flags;
-+ u8 rsvd[212];
-+};
-+
-+/*********************** PG Query Request ****************************/
-+#define REQ_PG_QUERY 0x1
-+#define REQ_PG_FEAT 0x1
-+struct be_cmd_req_pg {
-+ struct be_cmd_req_hdr hdr;
-+ u32 query;
-+ u32 pfc_pg;
-+};
-+
-+struct be_cmd_resp_pg {
-+ struct be_cmd_resp_hdr hdr;
-+ u32 pfc_pg;
-+ u32 num_tx_rings;
-+};
-+
-+/*********************** Function Privileges ***********************/
-+enum {
-+ BE_PRIV_DEFAULT = 0x1,
-+ BE_PRIV_LNKQUERY = 0x2,
-+ BE_PRIV_LNKSTATS = 0x4,
-+ BE_PRIV_LNKMGMT = 0x8,
-+ BE_PRIV_LNKDIAG = 0x10,
-+ BE_PRIV_UTILQUERY = 0x20,
-+ BE_PRIV_FILTMGMT = 0x40,
-+ BE_PRIV_IFACEMGMT = 0x80,
-+ BE_PRIV_VHADM = 0x100,
-+ BE_PRIV_DEVCFG = 0x200,
-+ BE_PRIV_DEVSEC = 0x400
-+};
-+
-+struct be_cmd_req_get_fn_privileges {
-+ struct be_cmd_req_hdr hdr;
-+ u32 rsvd;
-+};
-+
-+struct be_cmd_resp_get_fn_privileges {
-+ struct be_cmd_resp_hdr hdr;
-+ u32 privilege_mask;
-+};
-+
-+struct be_cmd_req_set_fn_privileges {
-+ struct be_cmd_req_hdr hdr;
-+ u32 privilege_mask;
-+};
-+
-+struct be_cmd_resp_set_fn_privileges {
-+ struct be_cmd_resp_hdr hdr;
-+ u32 prev_privilege_mask;
-+};
-+
-+/*********************** HSW Config ***********************/
-+struct amap_set_hsw_context {
-+ u8 interface_id[16];
-+ u8 rsvd0[14];
-+ u8 pvid_valid;
-+ u8 rsvd1;
-+ u8 rsvd2[16];
-+ u8 pvid[16];
-+ u8 rsvd3[32];
-+ u8 rsvd4[32];
-+ u8 rsvd5[32];
-+} __packed;
-+
-+struct be_cmd_req_set_hsw_config {
-+ struct be_cmd_req_hdr hdr;
-+ u8 context[sizeof(struct amap_set_hsw_context) / 8];
-+} __packed;
-+
-+struct be_cmd_resp_set_hsw_config {
-+ struct be_cmd_resp_hdr hdr;
-+ u32 rsvd;
-+};
-+
-+struct amap_get_hsw_req_context {
-+ u8 interface_id[16];
-+ u8 rsvd0[14];
-+ u8 pvid_valid;
-+ u8 pport;
-+} __packed;
-+
-+struct amap_get_hsw_resp_context {
-+ u8 rsvd1[16];
-+ u8 pvid[16];
-+ u8 rsvd2[32];
-+ u8 rsvd3[32];
-+ u8 rsvd4[32];
-+} __packed;
-+
-+struct be_cmd_req_get_hsw_config {
-+ struct be_cmd_req_hdr hdr;
-+ u8 context[sizeof(struct amap_get_hsw_req_context) / 8];
-+} __packed;
-+
-+struct be_cmd_resp_get_hsw_config {
-+ struct be_cmd_resp_hdr hdr;
-+ u8 context[sizeof(struct amap_get_hsw_resp_context) / 8];
-+ u32 rsvd;
-+};
-+
-+/*************** Set speed ********************/
-+struct be_cmd_req_set_port_speed_v1 {
-+ struct be_cmd_req_hdr hdr;
-+ u8 port_num;
-+ u8 virt_port;
-+ u16 mac_speed;
-+ u16 dac_cable_length;
-+ u16 rsvd0;
-+};
-+
-+struct be_cmd_resp_set_port_speed_v1 {
-+ struct be_cmd_resp_hdr hdr;
-+ u32 rsvd0;
-+};
-+
-+/************** get port speed *******************/
-+struct be_cmd_req_get_port_speed {
-+ struct be_cmd_req_hdr hdr;
-+ u8 port_num;
-+};
-+
-+struct be_cmd_resp_get_port_speed {
-+ struct be_cmd_req_hdr hdr;
-+ u16 mac_speed;
-+ u16 dac_cable_length;
-+};
-+
-+/*************** HW Stats Get v1 **********************************/
-+#define BE_TXP_SW_SZ 48
-+struct be_port_rxf_stats_v1 {
-+ u32 rsvd0[12];
-+ u32 rx_crc_errors;
-+ u32 rx_alignment_symbol_errors;
-+ u32 rx_pause_frames;
-+ u32 rx_priority_pause_frames;
-+ u32 rx_control_frames;
-+ u32 rx_in_range_errors;
-+ u32 rx_out_range_errors;
-+ u32 rx_frame_too_long;
-+ u32 rx_address_match_errors;
-+ u32 rx_dropped_too_small;
-+ u32 rx_dropped_too_short;
-+ u32 rx_dropped_header_too_small;
-+ u32 rx_dropped_tcp_length;
-+ u32 rx_dropped_runt;
-+ u32 rsvd1[10];
-+ u32 rx_ip_checksum_errs;
-+ u32 rx_tcp_checksum_errs;
-+ u32 rx_udp_checksum_errs;
-+ u32 rsvd2[7];
-+ u32 rx_switched_unicast_packets;
-+ u32 rx_switched_multicast_packets;
-+ u32 rx_switched_broadcast_packets;
-+ u32 rsvd3[3];
-+ u32 tx_pauseframes;
-+ u32 tx_priority_pauseframes;
-+ u32 tx_controlframes;
-+ u32 rsvd4[10];
-+ u32 rxpp_fifo_overflow_drop;
-+ u32 rx_input_fifo_overflow_drop;
-+ u32 pmem_fifo_overflow_drop;
-+ u32 jabber_events;
-+ u32 rsvd5[3];
-+};
-+
-+
-+struct be_rxf_stats_v1 {
-+ struct be_port_rxf_stats_v1 port[4];
-+ u32 rsvd0[2];
-+ u32 rx_drops_no_pbuf;
-+ u32 rx_drops_no_txpb;
-+ u32 rx_drops_no_erx_descr;
-+ u32 rx_drops_no_tpre_descr;
-+ u32 rsvd1[6];
-+ u32 rx_drops_too_many_frags;
-+ u32 rx_drops_invalid_ring;
-+ u32 forwarded_packets;
-+ u32 rx_drops_mtu;
-+ u32 rsvd2[14];
-+};
-+
-+struct be_erx_stats_v1 {
-+ u32 rx_drops_no_fragments[68]; /* dwordS 0 to 67*/
-+ u32 rsvd[4];
-+};
-+
-+struct be_hw_stats_v1 {
-+ struct be_rxf_stats_v1 rxf;
-+ u32 rsvd0[BE_TXP_SW_SZ];
-+ struct be_erx_stats_v1 erx;
-+ struct be_pmem_stats pmem;
-+ u32 rsvd1[3];
-+};
-+
-+struct be_cmd_req_get_stats_v1 {
-+ struct be_cmd_req_hdr hdr;
-+ u8 rsvd[sizeof(struct be_hw_stats_v1)];
-+};
-+
-+struct be_cmd_resp_get_stats_v1 {
-+ struct be_cmd_resp_hdr hdr;
-+ struct be_hw_stats_v1 hw_stats;
-+};
-+
-+static inline void *
-+hw_stats_from_cmd(struct be_adapter *adapter)
-+{
-+ if (adapter->generation == BE_GEN3) {
-+ struct be_cmd_resp_get_stats_v1 *cmd = adapter->stats_cmd.va;
-+
-+ return &cmd->hw_stats;
-+ } else {
-+ struct be_cmd_resp_get_stats_v0 *cmd = adapter->stats_cmd.va;
-+
-+ return &cmd->hw_stats;
-+ }
-+}
-+
-+static inline void *be_port_rxf_stats_from_cmd(struct be_adapter *adapter)
-+{
-+ if (adapter->generation == BE_GEN3) {
-+ struct be_hw_stats_v1 *hw_stats = hw_stats_from_cmd(adapter);
-+ struct be_rxf_stats_v1 *rxf_stats = &hw_stats->rxf;
-+
-+ return &rxf_stats->port[adapter->port_num];
-+ } else {
-+ struct be_hw_stats_v0 *hw_stats = hw_stats_from_cmd(adapter);
-+ struct be_rxf_stats_v0 *rxf_stats = &hw_stats->rxf;
-+
-+ return &rxf_stats->port[adapter->port_num];
-+ }
-+}
-+
-+static inline void *be_rxf_stats_from_cmd(struct be_adapter *adapter)
-+{
-+ if (adapter->generation == BE_GEN3) {
-+ struct be_hw_stats_v1 *hw_stats = hw_stats_from_cmd(adapter);
-+
-+ return &hw_stats->rxf;
-+ } else {
-+ struct be_hw_stats_v0 *hw_stats = hw_stats_from_cmd(adapter);
-+
-+ return &hw_stats->rxf;
-+ }
-+}
-+
-+static inline void *be_erx_stats_from_cmd(struct be_adapter *adapter)
-+{
-+ if (adapter->generation == BE_GEN3) {
-+ struct be_hw_stats_v1 *hw_stats = hw_stats_from_cmd(adapter);
-+
-+ return &hw_stats->erx;
-+ } else {
-+ struct be_hw_stats_v0 *hw_stats = hw_stats_from_cmd(adapter);
-+
-+ return &hw_stats->erx;
-+ }
-+}
-+
-+static inline void *be_pmem_stats_from_cmd(struct be_adapter *adapter)
-+{
-+ if (adapter->generation == BE_GEN3) {
-+ struct be_hw_stats_v1 *hw_stats = hw_stats_from_cmd(adapter);
-+
-+ return &hw_stats->pmem;
-+ } else {
-+ struct be_hw_stats_v0 *hw_stats = hw_stats_from_cmd(adapter);
-+
-+ return &hw_stats->pmem;
-+ }
-+}
-+
- extern int be_pci_fnum_get(struct be_adapter *adapter);
- extern int be_cmd_POST(struct be_adapter *adapter);
- extern int be_cmd_mac_addr_query(struct be_adapter *adapter, u8 *mac_addr,
- u8 type, bool permanent, u32 if_handle);
- extern int be_cmd_pmac_add(struct be_adapter *adapter, u8 *mac_addr,
-- u32 if_id, u32 *pmac_id);
--extern int be_cmd_pmac_del(struct be_adapter *adapter, u32 if_id, u32 pmac_id);
-+ u32 if_id, u32 *pmac_id, u32 domain);
-+extern int be_cmd_pmac_del(struct be_adapter *adapter, u32 if_id, u32 pmac_id,
-+ u32 domain);
- extern int be_cmd_if_create(struct be_adapter *adapter, u32 cap_flags,
- u32 en_flags, u8 *mac, bool pmac_invalid,
-- u32 *if_handle, u32 *pmac_id);
--extern int be_cmd_if_destroy(struct be_adapter *adapter, u32 if_handle);
-+ u32 *if_handle, u32 *pmac_id, u32 domain);
-+extern int be_cmd_if_destroy(struct be_adapter *adapter, u32 if_handle,
-+ u32 domain);
- extern int be_cmd_eq_create(struct be_adapter *adapter,
- struct be_queue_info *eq, int eq_delay);
- extern int be_cmd_cq_create(struct be_adapter *adapter,
-@@ -736,36 +1415,92 @@ extern int be_cmd_mccq_create(struct be_adapter *adapter,
- struct be_queue_info *cq);
- extern int be_cmd_txq_create(struct be_adapter *adapter,
- struct be_queue_info *txq,
-- struct be_queue_info *cq);
-+ struct be_queue_info *cq, u8 *tc_id);
- extern int be_cmd_rxq_create(struct be_adapter *adapter,
- struct be_queue_info *rxq, u16 cq_id,
- u16 frag_size, u16 max_frame_size, u32 if_id,
-- u32 rss);
-+ u32 rss, u8 *rss_id);
- extern int be_cmd_q_destroy(struct be_adapter *adapter, struct be_queue_info *q,
- int type);
-+extern int be_cmd_rxq_destroy(struct be_adapter *adapter,
-+ struct be_queue_info *q);
- extern int be_cmd_link_status_query(struct be_adapter *adapter,
-- bool *link_up);
-+ int *link_status, u8 *mac_speed, u16 *link_speed, u32 dom);
- extern int be_cmd_reset(struct be_adapter *adapter);
- extern int be_cmd_get_stats(struct be_adapter *adapter,
- struct be_dma_mem *nonemb_cmd);
--extern int be_cmd_get_fw_ver(struct be_adapter *adapter, char *fw_ver);
-+extern int be_cmd_get_fw_ver(struct be_adapter *adapter, char *fw_ver,
-+ char *fw_on_flash);
-
- extern int be_cmd_modify_eqd(struct be_adapter *adapter, u32 eq_id, u32 eqd);
- extern int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id,
- u16 *vtag_array, u32 num, bool untagged,
- bool promiscuous);
--extern int be_cmd_promiscuous_config(struct be_adapter *adapter,
-- u8 port_num, bool en);
--extern int be_cmd_multicast_set(struct be_adapter *adapter, u32 if_id,
-- struct dev_mc_list *mc_list, u32 mc_count);
-+extern int be_cmd_rx_filter(struct be_adapter *adapter, u32 flags, u32 status);
- extern int be_cmd_set_flow_control(struct be_adapter *adapter,
- u32 tx_fc, u32 rx_fc);
- extern int be_cmd_get_flow_control(struct be_adapter *adapter,
- u32 *tx_fc, u32 *rx_fc);
--extern int be_cmd_query_fw_cfg(struct be_adapter *adapter,
-- u32 *port_num, u32 *cap);
-+extern int be_cmd_query_fw_cfg(struct be_adapter *adapter, u32 *port_num,
-+ u32 *function_mode, u32 *functions_caps);
- extern int be_cmd_reset_function(struct be_adapter *adapter);
--extern int be_process_mcc(struct be_adapter *adapter);
-+extern int be_cmd_rss_config(struct be_adapter *adapter, u8 *rsstable,
-+ u16 table_size);
-+extern int be_process_mcc(struct be_adapter *adapter, int *status);
-+extern int be_cmd_set_beacon_state(struct be_adapter *adapter,
-+ u8 port_num, u8 beacon, u8 status, u8 state);
-+extern int be_cmd_get_beacon_state(struct be_adapter *adapter,
-+ u8 port_num, u32 *state);
-+extern int be_cmd_read_port_type(struct be_adapter *adapter, u32 port,
-+ u8 *connector);
- extern int be_cmd_write_flashrom(struct be_adapter *adapter,
- struct be_dma_mem *cmd, u32 flash_oper,
- u32 flash_opcode, u32 buf_size);
-+int be_cmd_get_flash_crc(struct be_adapter *adapter, u8 *flashed_crc,
-+ int offset);
-+extern int be_cmd_enable_magic_wol(struct be_adapter *adapter, u8 *mac,
-+ struct be_dma_mem *nonemb_cmd);
-+extern int be_cmd_fw_init(struct be_adapter *adapter);
-+extern int be_cmd_fw_clean(struct be_adapter *adapter);
-+extern void be_async_mcc_enable(struct be_adapter *adapter);
-+extern void be_async_mcc_disable(struct be_adapter *adapter);
-+extern int be_cmd_loopback_test(struct be_adapter *adapter, u32 port_num,
-+ u32 loopback_type, u32 pkt_size,
-+ u32 num_pkts, u64 pattern);
-+extern int be_cmd_ddr_dma_test(struct be_adapter *adapter, u64 pattern,
-+ u32 byte_cnt, struct be_dma_mem *cmd);
-+extern int be_cmd_get_seeprom_data(struct be_adapter *adapter,
-+ struct be_dma_mem *nonemb_cmd);
-+extern int be_cmd_set_loopback(struct be_adapter *adapter, u8 port_num,
-+ u8 loopback_type, u8 enable);
-+extern int be_cmd_get_phy_info(struct be_adapter *adapter,
-+ struct be_phy_info *phy_info);
-+extern int be_cmd_set_qos(struct be_adapter *adapter, u32 bps, u32 domain);
-+extern void be_detect_dump_ue(struct be_adapter *adapter);
-+extern int be_cmd_get_die_temperature(struct be_adapter *adapter);
-+extern int be_cmd_get_cntl_attributes(struct be_adapter *adapter);
-+extern int be_cmd_get_reg_len(struct be_adapter *adapter, u32 *log_size);
-+extern void be_cmd_get_regs(struct be_adapter *adapter, u32 buf_len, void *buf);
-+extern int be_cmd_req_native_mode(struct be_adapter *adapter);
-+extern int be_cmd_query_port_names_v0(struct be_adapter *adapter, u8 *port_name);
-+extern int be_cmd_query_port_names_v1(struct be_adapter *adapter, u8 *port_name);
-+extern int be_cmd_req_pg_pfc(struct be_adapter *adapter, int *fw_num_txqs);
-+
-+extern int be_cmd_get_fn_privileges(struct be_adapter *adapter,
-+ u32 *privilege, u32 domain);
-+extern int be_cmd_set_fn_privileges(struct be_adapter *adapter,
-+ u32 mask, u32 *prev, u32 domain);
-+extern int be_cmd_set_hsw_config(struct be_adapter *adapter, u16 pvid,
-+ u32 domain, u16 intf_id);
-+extern int be_cmd_get_hsw_config(struct be_adapter *adapter, u16 *pvid,
-+ u32 domain, u16 intf_id);
-+extern int be_cmd_set_port_speed_v1(struct be_adapter *adapter, u8 port_num,
-+ u16 mac_speed, u16 dac_cable_len);
-+extern int be_cmd_get_port_speed(struct be_adapter *adapter, u8 port_num,
-+ u16 *dac_cable_len, u16 *port_speed);
-+#ifdef CONFIG_PALAU
-+int be_cmd_pass_ext_ioctl(struct be_adapter *adapter, dma_addr_t dma,
-+ int req_size, void *va);
-+#endif
-+
-+#endif /* !BE_CMDS_H */
-diff --git a/drivers/net/benet/be_compat.c b/drivers/net/benet/be_compat.c
-new file mode 100644
-index 0000000..bdd1dba
---- /dev/null
-+++ b/drivers/net/benet/be_compat.c
-@@ -0,0 +1,630 @@
-+/*
-+ * Copyright (C) 2005 - 2011 Emulex
-+ * All rights reserved.
-+ *
-+ * This program is free software; you can redistribute it and/or
-+ * modify it under the terms of the GNU General Public License version 2
-+ * as published by the Free Software Foundation. The full GNU General
-+ * Public License is included in this distribution in the file called COPYING.
-+ *
-+ * Contact Information:
-+ * linux-drivers@emulex.com
-+ *
-+ * Emulex
-+ * 3333 Susan Street
-+ * Costa Mesa, CA 92626
-+ */
-+
-+#include "be.h"
-+
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 28)
-+void be_netdev_ops_init(struct net_device *netdev, struct net_device_ops *ops)
-+{
-+ netdev->open = ops->ndo_open;
-+ netdev->stop = ops->ndo_stop;
-+ netdev->hard_start_xmit = ops->ndo_start_xmit;
-+ netdev->set_mac_address = ops->ndo_set_mac_address;
-+ netdev->get_stats = ops->ndo_get_stats;
-+ netdev->set_multicast_list = ops->ndo_set_rx_mode;
-+ netdev->change_mtu = ops->ndo_change_mtu;
-+ netdev->vlan_rx_register = ops->ndo_vlan_rx_register;
-+ netdev->vlan_rx_add_vid = ops->ndo_vlan_rx_add_vid;
-+ netdev->vlan_rx_kill_vid = ops->ndo_vlan_rx_kill_vid;
-+ netdev->do_ioctl = ops->ndo_do_ioctl;
-+#ifdef CONFIG_NET_POLL_CONTROLLER
-+ netdev->poll_controller = ops->ndo_poll_controller;
-+#endif
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
-+ netdev->select_queue = ops->ndo_select_queue;
-+#endif
-+}
-+#endif
-+
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 28)
-+int eth_validate_addr(struct net_device *netdev)
-+{
-+ return 0;
-+}
-+#endif
-+
-+/* New NAPI backport */
-+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 24)
-+
-+int be_poll_compat(struct net_device *netdev, int *budget)
-+{
-+ struct napi_struct *napi = netdev->priv;
-+ u32 work_done, can_do;
-+
-+ can_do = min(*budget, netdev->quota);
-+ work_done = napi->poll(napi, can_do);
-+
-+ *budget -= work_done;
-+ netdev->quota -= work_done;
-+ if (napi->rx)
-+ return (work_done >= can_do);
-+ return 0;
-+}
-+
-+
-+#endif /* New NAPI backport */
-+
-+int be_netif_napi_add(struct net_device *netdev,
-+ struct napi_struct *napi,
-+ int (*poll) (struct napi_struct *, int), int weight)
-+{
-+#ifdef HAVE_SIMULATED_MULTI_NAPI
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+ struct net_device *nd;
-+
-+ nd = alloc_netdev(0, "", ether_setup);
-+ if (!nd)
-+ return -ENOMEM;
-+ nd->priv = napi;
-+ nd->weight = BE_NAPI_WEIGHT;
-+ nd->poll = be_poll_compat;
-+ set_bit(__LINK_STATE_START, &nd->state);
-+
-+ if (napi == &adapter->rx_obj[0].rx_eq.napi)
-+ napi->rx = true;
-+ napi->poll = poll;
-+ napi->dev = nd;
-+#ifdef RHEL_NEW_NAPI
-+ napi->napi.dev = netdev;
-+#endif
-+ return 0;
-+#else
-+ netif_napi_add(netdev, napi, poll, weight);
-+ return 0;
-+#endif
-+}
-+void be_netif_napi_del(struct net_device *netdev)
-+{
-+#ifdef HAVE_SIMULATED_MULTI_NAPI
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+ struct napi_struct *napi;
-+ struct be_rx_obj *rxo;
-+ int i;
-+
-+ for_all_rx_queues(adapter, rxo, i) {
-+ napi = &rxo->rx_eq.napi;
-+ if (napi->dev) {
-+ free_netdev(napi->dev);
-+ napi->dev = NULL;
-+ }
-+ }
-+
-+ napi = &adapter->tx_eq.napi;
-+ if (napi->dev) {
-+ free_netdev(napi->dev);
-+ napi->dev = NULL;
-+ }
-+#endif
-+}
-+/* INET_LRO backport */
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 27)
-+
-+#define TCP_HDR_LEN(tcph) (tcph->doff << 2)
-+#define IP_HDR_LEN(iph) (iph->ihl << 2)
-+#define TCP_PAYLOAD_LENGTH(iph, tcph) (ntohs(iph->tot_len) - IP_HDR_LEN(iph) \
-+ - TCP_HDR_LEN(tcph))
-+
-+#define IPH_LEN_WO_OPTIONS 5
-+#define TCPH_LEN_WO_OPTIONS 5
-+#define TCPH_LEN_W_TIMESTAMP 8
-+
-+#define LRO_MAX_PG_HLEN 64
-+#define LRO_INC_STATS(lro_mgr, attr) { lro_mgr->stats.attr++; }
-+/*
-+ * Basic tcp checks whether packet is suitable for LRO
-+ */
-+static int lro_tcp_ip_check(struct iphdr *iph, struct tcphdr *tcph,
-+ int len, struct net_lro_desc *lro_desc)
-+{
-+ /* check ip header: don't aggregate padded frames */
-+ if (ntohs(iph->tot_len) != len)
-+ return -1;
-+
-+ if (iph->ihl != IPH_LEN_WO_OPTIONS)
-+ return -1;
-+
-+ if (tcph->cwr || tcph->ece || tcph->urg || !tcph->ack
-+ || tcph->rst || tcph->syn || tcph->fin)
-+ return -1;
-+
-+ if (INET_ECN_is_ce(ipv4_get_dsfield(iph)))
-+ return -1;
-+
-+ if (tcph->doff != TCPH_LEN_WO_OPTIONS
-+ && tcph->doff != TCPH_LEN_W_TIMESTAMP)
-+ return -1;
-+
-+ /* check tcp options (only timestamp allowed) */
-+ if (tcph->doff == TCPH_LEN_W_TIMESTAMP) {
-+ u32 *topt = (u32 *)(tcph + 1);
-+
-+ if (*topt != htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16)
-+ | (TCPOPT_TIMESTAMP << 8)
-+ | TCPOLEN_TIMESTAMP))
-+ return -1;
-+
-+ /* timestamp should be in right order */
-+ topt++;
-+ if (lro_desc && after(ntohl(lro_desc->tcp_rcv_tsval),
-+ ntohl(*topt)))
-+ return -1;
-+
-+ /* timestamp reply should not be zero */
-+ topt++;
-+ if (*topt == 0)
-+ return -1;
-+ }
-+
-+ return 0;
-+}
-+
-+static void lro_update_tcp_ip_header(struct net_lro_desc *lro_desc)
-+{
-+ struct iphdr *iph = lro_desc->iph;
-+ struct tcphdr *tcph = lro_desc->tcph;
-+ u32 *p;
-+ __wsum tcp_hdr_csum;
-+
-+ tcph->ack_seq = lro_desc->tcp_ack;
-+ tcph->window = lro_desc->tcp_window;
-+
-+ if (lro_desc->tcp_saw_tstamp) {
-+ p = (u32 *)(tcph + 1);
-+ *(p+2) = lro_desc->tcp_rcv_tsecr;
-+ }
-+
-+ iph->tot_len = htons(lro_desc->ip_tot_len);
-+
-+ iph->check = 0;
-+ iph->check = ip_fast_csum((u8 *)lro_desc->iph, iph->ihl);
-+
-+ tcph->check = 0;
-+ tcp_hdr_csum = csum_partial((u8 *)tcph, TCP_HDR_LEN(tcph), 0);
-+ lro_desc->data_csum = csum_add(lro_desc->data_csum, tcp_hdr_csum);
-+ tcph->check = csum_tcpudp_magic(iph->saddr, iph->daddr,
-+ lro_desc->ip_tot_len -
-+ IP_HDR_LEN(iph), IPPROTO_TCP,
-+ lro_desc->data_csum);
-+}
-+
-+static __wsum lro_tcp_data_csum(struct iphdr *iph, struct tcphdr *tcph, int len)
-+{
-+ __wsum tcp_csum;
-+ __wsum tcp_hdr_csum;
-+ __wsum tcp_ps_hdr_csum;
-+
-+ tcp_csum = ~csum_unfold(tcph->check);
-+ tcp_hdr_csum = csum_partial((u8 *)tcph, TCP_HDR_LEN(tcph), tcp_csum);
-+
-+ tcp_ps_hdr_csum = csum_tcpudp_nofold(iph->saddr, iph->daddr,
-+ len + TCP_HDR_LEN(tcph),
-+ IPPROTO_TCP, 0);
-+
-+ return csum_sub(csum_sub(tcp_csum, tcp_hdr_csum),
-+ tcp_ps_hdr_csum);
-+}
-+
-+static void lro_init_desc(struct net_lro_desc *lro_desc, struct sk_buff *skb,
-+ struct iphdr *iph, struct tcphdr *tcph,
-+ u16 vlan_tag, struct vlan_group *vgrp)
-+{
-+ int nr_frags;
-+ u32 *ptr;
-+ u32 tcp_data_len = TCP_PAYLOAD_LENGTH(iph, tcph);
-+
-+ nr_frags = skb_shinfo(skb)->nr_frags;
-+ lro_desc->parent = skb;
-+ lro_desc->next_frag = &(skb_shinfo(skb)->frags[nr_frags]);
-+ lro_desc->iph = iph;
-+ lro_desc->tcph = tcph;
-+ lro_desc->tcp_next_seq = ntohl(tcph->seq) + tcp_data_len;
-+ lro_desc->tcp_ack = ntohl(tcph->ack_seq);
-+ lro_desc->tcp_window = tcph->window;
-+
-+ lro_desc->pkt_aggr_cnt = 1;
-+ lro_desc->ip_tot_len = ntohs(iph->tot_len);
-+
-+ if (tcph->doff == 8) {
-+ ptr = (u32 *)(tcph+1);
-+ lro_desc->tcp_saw_tstamp = 1;
-+ lro_desc->tcp_rcv_tsval = *(ptr+1);
-+ lro_desc->tcp_rcv_tsecr = *(ptr+2);
-+ }
-+
-+ lro_desc->mss = tcp_data_len;
-+ lro_desc->vgrp = vgrp;
-+ lro_desc->vlan_tag = vlan_tag;
-+ lro_desc->active = 1;
-+
-+ if (tcp_data_len)
-+ lro_desc->data_csum = lro_tcp_data_csum(iph, tcph,
-+ tcp_data_len);
-+
-+ if (!tcp_data_len)
-+ lro_desc->ack_cnt++;
-+}
-+
-+static inline void lro_clear_desc(struct net_lro_desc *lro_desc)
-+{
-+ memset(lro_desc, 0, sizeof(struct net_lro_desc));
-+}
-+
-+static void lro_add_common(struct net_lro_desc *lro_desc, struct iphdr *iph,
-+ struct tcphdr *tcph, int tcp_data_len)
-+{
-+ struct sk_buff *parent = lro_desc->parent;
-+ u32 *topt;
-+
-+ lro_desc->pkt_aggr_cnt++;
-+ lro_desc->ip_tot_len += tcp_data_len;
-+ lro_desc->tcp_next_seq += tcp_data_len;
-+ lro_desc->tcp_window = tcph->window;
-+ lro_desc->tcp_ack = tcph->ack_seq;
-+
-+ /* don't update tcp_rcv_tsval, would not work with PAWS */
-+ if (lro_desc->tcp_saw_tstamp) {
-+ topt = (u32 *) (tcph + 1);
-+ lro_desc->tcp_rcv_tsecr = *(topt + 2);
-+ }
-+
-+ if (tcp_data_len)
-+ lro_desc->data_csum = csum_block_add(lro_desc->data_csum,
-+ lro_tcp_data_csum(iph, tcph,
-+ tcp_data_len),
-+ parent->len);
-+
-+ parent->len += tcp_data_len;
-+ parent->data_len += tcp_data_len;
-+ if (tcp_data_len > lro_desc->mss)
-+ lro_desc->mss = tcp_data_len;
-+}
-+
-+static void lro_add_frags(struct net_lro_desc *lro_desc,
-+ int len, int hlen, int truesize,
-+ struct skb_frag_struct *skb_frags,
-+ struct iphdr *iph, struct tcphdr *tcph)
-+{
-+ struct sk_buff *skb = lro_desc->parent;
-+ int tcp_data_len = TCP_PAYLOAD_LENGTH(iph, tcph);
-+
-+ lro_add_common(lro_desc, iph, tcph, tcp_data_len);
-+
-+ skb->truesize += truesize;
-+
-+ if (!tcp_data_len) {
-+ put_page(skb_frags[0].page);
-+ lro_desc->ack_cnt++;
-+ return;
-+ }
-+
-+ skb_frags[0].page_offset += hlen;
-+ skb_frags[0].size -= hlen;
-+
-+ while (tcp_data_len > 0) {
-+ *(lro_desc->next_frag) = *skb_frags;
-+ tcp_data_len -= skb_frags->size;
-+ lro_desc->next_frag++;
-+ skb_frags++;
-+ skb_shinfo(skb)->nr_frags++;
-+ }
-+}
-+
-+static int lro_check_tcp_conn(struct net_lro_desc *lro_desc,
-+ struct iphdr *iph,
-+ struct tcphdr *tcph)
-+{
-+ if ((lro_desc->iph->saddr != iph->saddr)
-+ || (lro_desc->iph->daddr != iph->daddr)
-+ || (lro_desc->tcph->source != tcph->source)
-+ || (lro_desc->tcph->dest != tcph->dest))
-+ return -1;
-+ return 0;
-+}
-+
-+static struct net_lro_desc *lro_get_desc(struct net_lro_mgr *lro_mgr,
-+ struct net_lro_desc *lro_arr,
-+ struct iphdr *iph,
-+ struct tcphdr *tcph)
-+{
-+ struct net_lro_desc *lro_desc = NULL;
-+ struct net_lro_desc *tmp;
-+ int max_desc = lro_mgr->max_desc;
-+ int i;
-+
-+ for (i = 0; i < max_desc; i++) {
-+ tmp = &lro_arr[i];
-+ if (tmp->active)
-+ if (!lro_check_tcp_conn(tmp, iph, tcph)) {
-+ lro_desc = tmp;
-+ goto out;
-+ }
-+ }
-+
-+ for (i = 0; i < max_desc; i++) {
-+ if (!lro_arr[i].active) {
-+ lro_desc = &lro_arr[i];
-+ goto out;
-+ }
-+ }
-+
-+ LRO_INC_STATS(lro_mgr, no_desc);
-+out:
-+ return lro_desc;
-+}
-+
-+static void lro_flush(struct net_lro_mgr *lro_mgr,
-+ struct net_lro_desc *lro_desc)
-+{
-+ struct be_adapter *adapter = netdev_priv(lro_mgr->dev);
-+
-+ if (lro_desc->pkt_aggr_cnt > 1)
-+ lro_update_tcp_ip_header(lro_desc);
-+
-+ skb_shinfo(lro_desc->parent)->gso_size = lro_desc->mss;
-+
-+ if (lro_desc->vgrp) {
-+ if (test_bit(LRO_F_NAPI, &lro_mgr->features))
-+ vlan_hwaccel_receive_skb(lro_desc->parent,
-+ lro_desc->vgrp,
-+ lro_desc->vlan_tag);
-+ else
-+ vlan_hwaccel_rx(lro_desc->parent,
-+ lro_desc->vgrp,
-+ lro_desc->vlan_tag);
-+
-+ } else {
-+ if (test_bit(LRO_F_NAPI, &lro_mgr->features))
-+ netif_receive_skb(lro_desc->parent);
-+ else
-+ netif_rx(lro_desc->parent);
-+ }
-+
-+ LRO_INC_STATS(lro_mgr, flushed);
-+ lro_clear_desc(lro_desc);
-+}
-+
-+static struct sk_buff *lro_gen_skb(struct net_lro_mgr *lro_mgr,
-+ struct skb_frag_struct *frags,
-+ int len, int true_size,
-+ void *mac_hdr,
-+ int hlen, __wsum sum,
-+ u32 ip_summed)
-+{
-+ struct sk_buff *skb;
-+ struct skb_frag_struct *skb_frags;
-+ int data_len = len;
-+ int hdr_len = min(len, hlen);
-+
-+ skb = netdev_alloc_skb(lro_mgr->dev, hlen);
-+ if (!skb)
-+ return NULL;
-+
-+ skb->len = len;
-+ skb->data_len = len - hdr_len;
-+ skb->truesize += true_size;
-+ skb->tail += hdr_len;
-+
-+ memcpy(skb->data, mac_hdr, hdr_len);
-+
-+ if (skb->data_len) {
-+ skb_frags = skb_shinfo(skb)->frags;
-+ while (data_len > 0) {
-+ *skb_frags = *frags;
-+ data_len -= frags->size;
-+ skb_frags++;
-+ frags++;
-+ skb_shinfo(skb)->nr_frags++;
-+ }
-+ skb_shinfo(skb)->frags[0].page_offset += hdr_len;
-+ skb_shinfo(skb)->frags[0].size -= hdr_len;
-+ } else {
-+ put_page(frags[0].page);
-+ }
-+
-+
-+ skb->ip_summed = ip_summed;
-+ skb->csum = sum;
-+ skb->protocol = eth_type_trans(skb, lro_mgr->dev);
-+ return skb;
-+}
-+
-+static struct sk_buff *__lro_proc_segment(struct net_lro_mgr *lro_mgr,
-+ struct skb_frag_struct *frags,
-+ int len, int true_size,
-+ struct vlan_group *vgrp,
-+ u16 vlan_tag, void *priv, __wsum sum)
-+{
-+ struct net_lro_desc *lro_desc;
-+ struct iphdr *iph;
-+ struct tcphdr *tcph;
-+ struct sk_buff *skb;
-+ u64 flags;
-+ void *mac_hdr;
-+ int mac_hdr_len;
-+ int hdr_len = LRO_MAX_PG_HLEN;
-+ int vlan_hdr_len = 0;
-+ u8 pad_bytes;
-+
-+ if (!lro_mgr->get_frag_header
-+ || lro_mgr->get_frag_header(frags, (void *)&mac_hdr, (void *)&iph,
-+ (void *)&tcph, &flags, priv)) {
-+ mac_hdr = page_address(frags->page) + frags->page_offset;
-+ goto out1;
-+ }
-+
-+ if (!(flags & LRO_IPV4) || !(flags & LRO_TCP))
-+ goto out1;
-+
-+ hdr_len = (int)((void *)(tcph) + TCP_HDR_LEN(tcph) - mac_hdr);
-+ mac_hdr_len = (int)((void *)(iph) - mac_hdr);
-+
-+ lro_desc = lro_get_desc(lro_mgr, lro_mgr->lro_arr, iph, tcph);
-+ if (!lro_desc)
-+ goto out1;
-+
-+ pad_bytes = len - (ntohs(iph->tot_len) + mac_hdr_len);
-+ if (!TCP_PAYLOAD_LENGTH(iph, tcph) && pad_bytes) {
-+ len -= pad_bytes; /* trim the packet */
-+ frags[0].size -= pad_bytes;
-+ true_size -= pad_bytes;
-+ }
-+
-+ if (!lro_desc->active) { /* start new lro session */
-+ if (lro_tcp_ip_check(iph, tcph, len - mac_hdr_len, NULL))
-+ goto out1;
-+
-+ skb = lro_gen_skb(lro_mgr, frags, len, true_size, mac_hdr,
-+ hdr_len, 0, lro_mgr->ip_summed_aggr);
-+ if (!skb)
-+ goto out;
-+
-+ if ((skb->protocol == htons(ETH_P_8021Q))
-+ && !test_bit(LRO_F_EXTRACT_VLAN_ID, &lro_mgr->features))
-+ vlan_hdr_len = VLAN_HLEN;
-+
-+ iph = (void *)(skb->data + vlan_hdr_len);
-+ tcph = (void *)((u8 *)skb->data + vlan_hdr_len
-+ + IP_HDR_LEN(iph));
-+
-+ lro_init_desc(lro_desc, skb, iph, tcph, vlan_tag, vgrp);
-+ LRO_INC_STATS(lro_mgr, aggregated);
-+ return 0;
-+ }
-+
-+ if (lro_desc->tcp_next_seq != ntohl(tcph->seq))
-+ goto out2;
-+
-+ if (lro_tcp_ip_check(iph, tcph, len - mac_hdr_len, lro_desc))
-+ goto out2;
-+
-+ lro_add_frags(lro_desc, len, hdr_len, true_size, frags, iph, tcph);
-+ LRO_INC_STATS(lro_mgr, aggregated);
-+
-+ if ((skb_shinfo(lro_desc->parent)->nr_frags >= lro_mgr->max_aggr) ||
-+ lro_desc->parent->len > (0xFFFF - lro_mgr->dev->mtu))
-+ lro_flush(lro_mgr, lro_desc);
-+
-+ return NULL;
-+
-+out2: /* send aggregated packets to the stack */
-+ lro_flush(lro_mgr, lro_desc);
-+
-+out1: /* Original packet has to be posted to the stack */
-+ skb = lro_gen_skb(lro_mgr, frags, len, true_size, mac_hdr,
-+ hdr_len, sum, lro_mgr->ip_summed);
-+out:
-+ return skb;
-+}
-+
-+void lro_receive_frags_compat(struct net_lro_mgr *lro_mgr,
-+ struct skb_frag_struct *frags,
-+ int len, int true_size, void *priv, __wsum sum)
-+{
-+ struct sk_buff *skb;
-+
-+ skb = __lro_proc_segment(lro_mgr, frags, len, true_size, NULL, 0,
-+ priv, sum);
-+ if (!skb)
-+ return;
-+
-+ if (test_bit(LRO_F_NAPI, &lro_mgr->features))
-+ netif_receive_skb(skb);
-+ else
-+ netif_rx(skb);
-+}
-+
-+void lro_vlan_hwaccel_receive_frags_compat(struct net_lro_mgr *lro_mgr,
-+ struct skb_frag_struct *frags,
-+ int len, int true_size,
-+ struct vlan_group *vgrp,
-+ u16 vlan_tag, void *priv, __wsum sum)
-+{
-+ struct sk_buff *skb;
-+
-+ skb = __lro_proc_segment(lro_mgr, frags, len, true_size, vgrp,
-+ vlan_tag, priv, sum);
-+ if (!skb)
-+ return;
-+
-+ if (test_bit(LRO_F_NAPI, &lro_mgr->features))
-+ vlan_hwaccel_receive_skb(skb, vgrp, vlan_tag);
-+ else
-+ vlan_hwaccel_rx(skb, vgrp, vlan_tag);
-+}
-+
-+void lro_flush_all_compat(struct net_lro_mgr *lro_mgr)
-+{
-+ int i;
-+ struct net_lro_desc *lro_desc = lro_mgr->lro_arr;
-+
-+ for (i = 0; i < lro_mgr->max_desc; i++) {
-+ if (lro_desc[i].active)
-+ lro_flush(lro_mgr, &lro_desc[i]);
-+ }
-+}
-+#endif /* INET_LRO backport */
-+
-+#ifndef TX_MQ
-+struct net_device *alloc_etherdev_mq_compat(int sizeof_priv,
-+ unsigned int queue_count)
-+{
-+ return alloc_etherdev(sizeof_priv);
-+}
-+
-+void netif_wake_subqueue_compat(struct net_device *dev, u16 queue_index)
-+{
-+ netif_wake_queue(dev);
-+}
-+
-+void netif_stop_subqueue_compat(struct net_device *dev, u16 queue_index)
-+{
-+ netif_stop_queue(dev);
-+}
-+
-+int __netif_subqueue_stopped_compat(const struct net_device *dev,
-+ u16 queue_index)
-+{
-+ return netif_queue_stopped(dev);
-+}
-+
-+u16 skb_get_queue_mapping_compat(const struct sk_buff *skb)
-+{
-+ return 0;
-+}
-+
-+void netif_set_real_num_tx_queues_compat(struct net_device *dev,
-+ unsigned int txq)
-+{
-+ return;
-+}
-+
-+u16 skb_tx_hash_compat(const struct net_device *dev,
-+ const struct sk_buff *skb)
-+{
-+ return 0;
-+}
-+#endif
-diff --git a/drivers/net/benet/be_compat.h b/drivers/net/benet/be_compat.h
-new file mode 100644
-index 0000000..8ceecc8
---- /dev/null
-+++ b/drivers/net/benet/be_compat.h
-@@ -0,0 +1,621 @@
-+/*
-+ * Copyright (C) 2005 - 2011 Emulex
-+ * All rights reserved.
-+ *
-+ * This program is free software; you can redistribute it and/or
-+ * modify it under the terms of the GNU General Public License version 2
-+ * as published by the Free Software Foundation. The full GNU General
-+ * Public License is included in this distribution in the file called COPYING.
-+ *
-+ * Contact Information:
-+ * linux-drivers@emulex.com
-+ *
-+ * Emulex
-+ * 3333 Susan Street
-+ * Costa Mesa, CA 92626
-+ */
-+
-+#ifndef BE_COMPAT_H
-+#define BE_COMPAT_H
-+
-+/****************** RHEL5 and SLES10 backport ***************************/
-+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 18)
-+
-+#ifndef upper_32_bits
-+#define upper_32_bits(n) ((u32)(((n) >> 16) >> 16))
-+#endif
-+
-+#ifndef CHECKSUM_PARTIAL
-+#define CHECKSUM_PARTIAL CHECKSUM_HW
-+#define CHECKSUM_COMPLETE CHECKSUM_HW
-+#endif
-+
-+#if !defined(ip_hdr)
-+#define ip_hdr(skb) (skb->nh.iph)
-+#define ipv6_hdr(skb) (skb->nh.ipv6h)
-+#endif
-+
-+#if !defined(__packed)
-+#define __packed __attribute__ ((packed))
-+#endif
-+
-+#if !defined(RHEL_MINOR)
-+/* Only for RH5U1 (Maui) and SLES10 NIC driver */
-+enum {
-+ false = 0,
-+ true = 1
-+};
-+#if LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 18)
-+/* Only for RH5U1 (Maui) NIC driver */
-+static inline __attribute__((const))
-+int __ilog2_u32(u32 n)
-+{
-+ return fls(n) - 1;
-+}
-+#endif
-+#endif
-+
-+#define ETH_FCS_LEN 4
-+#define bool u8
-+#ifndef PTR_ALIGN
-+#define PTR_ALIGN(p, a) ((typeof(p)) \
-+ ALIGN((unsigned long)(p), (a)))
-+#endif
-+#define list_first_entry(ptr, type, member) \
-+ list_entry((ptr)->next, type, member)
-+
-+#if (defined(RHEL_MINOR) && RHEL_MINOR < 6) || \
-+ LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 16)
-+#define DEFINE_PCI_DEVICE_TABLE(_table) struct pci_device_id _table[] \
-+ __devinitdata
-+#endif
-+
-+/* Backport of request_irq */
-+typedef irqreturn_t(*backport_irq_handler_t) (int, void *);
-+static inline int
-+backport_request_irq(unsigned int irq, irqreturn_t(*handler) (int, void *),
-+ unsigned long flags, const char *dev_name, void *dev_id)
-+{
-+ return request_irq(irq,
-+ (irqreturn_t(*) (int, void *, struct pt_regs *))handler,
-+ flags, dev_name, dev_id);
-+}
-+#define request_irq backport_request_irq
-+
-+#endif /*** RHEL5 and SLES10 backport ***/
-+
-+#if !defined(__packed)
-+#define __packed __attribute__ ((packed))
-+#endif
-+
-+/****************** SLES10 only backport ***************************/
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 18)
-+
-+#include <linux/tifm.h>
-+
-+#define FIELD_SIZEOF(t, f) (sizeof(((t *)0)->f))
-+#define IRQF_SHARED SA_SHIRQ
-+#define CHECKSUM_PARTIAL CHECKSUM_HW
-+#define CHECKSUM_COMPLETE CHECKSUM_HW
-+#define DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d))
-+#define NETIF_F_IPV6_CSUM NETIF_F_IP_CSUM
-+#define NETIF_F_TSO6 NETIF_F_TSO
-+
-+
-+static inline struct sk_buff *netdev_alloc_skb(struct net_device *dev,
-+ unsigned int length)
-+{
-+ /* 16 == NET_PAD_SKB */
-+ struct sk_buff *skb;
-+ skb = alloc_skb(length + 16, GFP_ATOMIC);
-+ if (likely(skb != NULL)) {
-+ skb_reserve(skb, 16);
-+ skb->dev = dev;
-+ }
-+ return skb;
-+}
-+
-+#define PCI_SAVE_STATE(x)
-+
-+#else /* SLES10 only backport */
-+
-+#define PCI_SAVE_STATE(x) pci_save_state(x)
-+
-+#endif /* SLES10 only backport */
-+
-+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 31)
-+#define netdev_tx_t int
-+#endif
-+
-+#ifndef VLAN_PRIO_MASK
-+#define VLAN_PRIO_MASK 0xe000 /* Priority Code Point */
-+#define VLAN_PRIO_SHIFT 13
-+#endif
-+
-+/*
-+ * Backport of netdev ops struct
-+ */
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 28)
-+struct net_device_ops {
-+ int (*ndo_init)(struct net_device *dev);
-+ void (*ndo_uninit)(struct net_device *dev);
-+ int (*ndo_open)(struct net_device *dev);
-+ int (*ndo_stop)(struct net_device *dev);
-+ int (*ndo_start_xmit) (struct sk_buff *skb, struct net_device *dev);
-+ u16 (*ndo_select_queue)(struct net_device *dev,
-+ struct sk_buff *skb);
-+ void (*ndo_change_rx_flags)(struct net_device *dev, int flags);
-+ void (*ndo_set_rx_mode)(struct net_device *dev);
-+ void (*ndo_set_multicast_list)(struct net_device *dev);
-+ int (*ndo_set_mac_address)(struct net_device *dev, void *addr);
-+ int (*ndo_validate_addr)(struct net_device *dev);
-+ int (*ndo_do_ioctl)(struct net_device *dev,
-+ struct ifreq *ifr, int cmd);
-+ int (*ndo_set_config)(struct net_device *dev, struct ifmap *map);
-+ int (*ndo_change_mtu)(struct net_device *dev, int new_mtu);
-+ int (*ndo_neigh_setup)(struct net_device *dev,
-+ struct neigh_parms *);
-+ void (*ndo_tx_timeout) (struct net_device *dev);
-+
-+ struct net_device_stats* (*ndo_get_stats)(struct net_device *dev);
-+
-+ void (*ndo_vlan_rx_register)(struct net_device *dev,
-+ struct vlan_group *grp);
-+ void (*ndo_vlan_rx_add_vid)(struct net_device *dev,
-+ unsigned short vid);
-+ void (*ndo_vlan_rx_kill_vid)(struct net_device *dev,
-+ unsigned short vid);
-+#ifdef CONFIG_NET_POLL_CONTROLLER
-+#define HAVE_NETDEV_POLL
-+ void (*ndo_poll_controller)(struct net_device *dev);
-+#endif
-+};
-+extern void be_netdev_ops_init(struct net_device *netdev,
-+ struct net_device_ops *ops);
-+extern int eth_validate_addr(struct net_device *);
-+
-+#endif /* Netdev ops backport */
-+
-+#if LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 29)
-+#undef NETIF_F_GRO
-+#endif
-+
-+#ifdef NO_GRO
-+#if ((defined(RHEL_MAJOR) && (RHEL_MAJOR == 5)))
-+#undef NETIF_F_GRO
-+#endif
-+#endif
-+
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 32)
-+#define HAVE_ETHTOOL_FLASH
-+#endif
-+
-+/*
-+ * Backport of NAPI
-+ */
-+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 24)
-+
-+#if defined(RHEL_MINOR) && (RHEL_MINOR > 3)
-+#define RHEL_NEW_NAPI
-+#endif
-+
-+/* We need a new struct that has some meta data beyond rhel 5.4's napi_struct
-+ * to fix rhel5.4's half-baked new napi implementation.
-+ * We don't want to use rhel 5.4's broken napi_complete; so
-+ * define a new be_napi_complete that executes the logic only for Rx
-+ */
-+
-+#ifdef RHEL_NEW_NAPI
-+#define napi_complete be_napi_complete
-+typedef struct napi_struct rhel_napi_struct;
-+#endif
-+#define napi_struct be_napi_struct
-+#define napi_gro_frags(napi) napi_gro_frags((rhel_napi_struct *) napi)
-+#define vlan_gro_frags(napi, vlan_grp, vid)\
-+ vlan_gro_frags((rhel_napi_struct *) napi, vlan_grp, vid)
-+#define napi_get_frags(napi) napi_get_frags((rhel_napi_struct *) napi)
-+
-+struct napi_struct {
-+#ifdef RHEL_NEW_NAPI
-+ rhel_napi_struct napi; /* must be the first member */
-+#endif
-+ struct net_device *dev;
-+ int (*poll) (struct napi_struct *napi, int budget);
-+ bool rx;
-+};
-+
-+static inline void napi_complete(struct napi_struct *napi)
-+{
-+#ifdef NETIF_F_GRO
-+ napi_gro_flush((rhel_napi_struct *)napi);
-+#endif
-+ netif_rx_complete(napi->dev);
-+}
-+
-+static inline void napi_schedule(struct napi_struct *napi)
-+{
-+ netif_rx_schedule(napi->dev);
-+}
-+
-+static inline void napi_enable(struct napi_struct *napi)
-+{
-+ netif_poll_enable(napi->dev);
-+}
-+
-+static inline void napi_disable(struct napi_struct *napi)
-+{
-+ netif_poll_disable(napi->dev);
-+}
-+
-+#if (defined(RHEL_MINOR) && RHEL_MINOR < 6) || \
-+ LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 16)
-+static inline void vlan_group_set_device(struct vlan_group *vg,
-+ u16 vlan_id,
-+ struct net_device *dev)
-+{
-+ struct net_device **array;
-+ if (!vg)
-+ return;
-+ array = vg->vlan_devices;
-+ array[vlan_id] = dev;
-+}
-+#endif
-+
-+#endif /* New NAPI backport */
-+
-+extern int be_netif_napi_add(struct net_device *netdev,
-+ struct napi_struct *napi,
-+ int (*poll) (struct napi_struct *, int), int weight);
-+extern void be_netif_napi_del(struct net_device *netdev);
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 27)
-+#define HAVE_SIMULATED_MULTI_NAPI
-+#endif
-+
-+/************** Backport of Delayed work queues interface ****************/
-+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 19)
-+#if (defined(RHEL_MINOR) && RHEL_MINOR < 6) || \
-+ LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 16)
-+struct delayed_work {
-+ struct work_struct work;
-+};
-+#endif
-+
-+#define INIT_DELAYED_WORK(_work, _func) \
-+ INIT_WORK(&(_work)->work, _func, &(_work)->work)
-+
-+static inline int backport_cancel_delayed_work_sync(struct delayed_work *work)
-+{
-+ cancel_rearming_delayed_work(&work->work);
-+ return 0;
-+}
-+#define cancel_delayed_work_sync backport_cancel_delayed_work_sync
-+
-+static inline int backport_schedule_delayed_work(struct delayed_work *work,
-+ unsigned long delay)
-+{
-+ if (unlikely(!delay))
-+ return schedule_work(&work->work);
-+ else
-+ return schedule_delayed_work(&work->work, delay);
-+}
-+#define schedule_delayed_work backport_schedule_delayed_work
-+#endif /* backport delayed workqueue */
-+
-+
-+/************** Backport of INET_LRO **********************************/
-+#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 18)
-+
-+#include <linux/inet_lro.h>
-+
-+#else
-+
-+#if LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 18)
-+
-+#if defined(RHEL_MINOR) && RHEL_MINOR < 6
-+typedef __u16 __bitwise __sum16;
-+typedef __u32 __bitwise __wsum;
-+#endif
-+
-+#if ((defined(RHEL_MAJOR) && (RHEL_MAJOR == 5) && (RHEL_MINOR <= 3)) || \
-+ (!defined(RHEL_MINOR)))
-+static inline __wsum csum_unfold(__sum16 n)
-+{
-+ return (__force __wsum)n;
-+}
-+#endif
-+
-+#endif
-+
-+#define lro_flush_all lro_flush_all_compat
-+#define lro_vlan_hwaccel_receive_frags lro_vlan_hwaccel_receive_frags_compat
-+#define lro_receive_frags lro_receive_frags_compat
-+
-+struct net_lro_stats {
-+ unsigned long aggregated;
-+ unsigned long flushed;
-+ unsigned long no_desc;
-+};
-+
-+struct net_lro_desc {
-+ struct sk_buff *parent;
-+ struct sk_buff *last_skb;
-+ struct skb_frag_struct *next_frag;
-+ struct iphdr *iph;
-+ struct tcphdr *tcph;
-+ struct vlan_group *vgrp;
-+ __wsum data_csum;
-+ u32 tcp_rcv_tsecr;
-+ u32 tcp_rcv_tsval;
-+ u32 tcp_ack;
-+ u32 tcp_next_seq;
-+ u32 skb_tot_frags_len;
-+ u32 ack_cnt;
-+ u16 ip_tot_len;
-+ u16 tcp_saw_tstamp; /* timestamps enabled */
-+ u16 tcp_window;
-+ u16 vlan_tag;
-+ int pkt_aggr_cnt; /* counts aggregated packets */
-+ int vlan_packet;
-+ int mss;
-+ int active;
-+};
-+
-+struct net_lro_mgr {
-+ struct net_device *dev;
-+ struct net_lro_stats stats;
-+
-+ /* LRO features */
-+ unsigned long features;
-+#define LRO_F_NAPI 1 /* Pass packets to stack via NAPI */
-+#define LRO_F_EXTRACT_VLAN_ID 2 /* Set flag if VLAN IDs are extracted
-+ from received packets and eth protocol
-+ is still ETH_P_8021Q */
-+
-+ u32 ip_summed; /* Set in non generated SKBs in page mode */
-+ u32 ip_summed_aggr; /* Set in aggregated SKBs: CHECKSUM_UNNECESSARY
-+ * or CHECKSUM_NONE */
-+
-+ int max_desc; /* Max number of LRO descriptors */
-+ int max_aggr; /* Max number of LRO packets to be aggregated */
-+
-+ struct net_lro_desc *lro_arr; /* Array of LRO descriptors */
-+
-+ /* Optimized driver functions
-+ * get_skb_header: returns tcp and ip header for packet in SKB
-+ */
-+ int (*get_skb_header)(struct sk_buff *skb, void **ip_hdr,
-+ void **tcpudp_hdr, u64 *hdr_flags, void *priv);
-+
-+ /* hdr_flags: */
-+#define LRO_IPV4 1 /* ip_hdr is IPv4 header */
-+#define LRO_TCP 2 /* tcpudp_hdr is TCP header */
-+
-+ /*
-+ * get_frag_header: returns mac, tcp and ip header for packet in SKB
-+ *
-+ * @hdr_flags: Indicate what kind of LRO has to be done
-+ * (IPv4/IPv6/TCP/UDP)
-+ */
-+ int (*get_frag_header)(struct skb_frag_struct *frag, void **mac_hdr,
-+ void **ip_hdr, void **tcpudp_hdr, u64 *hdr_flags,
-+ void *priv);
-+};
-+
-+extern void lro_receive_skb(struct net_lro_mgr *lro_mgr, struct sk_buff *skb,
-+ void *priv);
-+
-+extern void lro_vlan_hwaccel_receive_skb(struct net_lro_mgr *lro_mgr,
-+ struct sk_buff *skb, struct vlan_group *vgrp,
-+ u16 vlan_tag, void *priv);
-+
-+/* This functions aggregate fragments and generate SKBs do pass
-+ * the packets to the stack.
-+ *
-+ * @lro_mgr: LRO manager to use
-+ * @frags: Fragment to be processed. Must contain entire header in first
-+ * element.
-+ * @len: Length of received data
-+ * @true_size: Actual size of memory the fragment is consuming
-+ * @priv: Private data that may be used by driver functions
-+ * (for example get_tcp_ip_hdr)
-+ */
-+extern void lro_receive_frags_compat(struct net_lro_mgr *lro_mgr,
-+ struct skb_frag_struct *frags, int len, int true_size,
-+ void *priv, __wsum sum);
-+
-+extern void lro_vlan_hwaccel_receive_frags_compat(struct net_lro_mgr *lro_mgr,
-+ struct skb_frag_struct *frags, int len, int true_size,
-+ struct vlan_group *vgrp, u16 vlan_tag, void *priv,
-+ __wsum sum);
-+
-+/* Forward all aggregated SKBs held by lro_mgr to network stack */
-+extern void lro_flush_all_compat(struct net_lro_mgr *lro_mgr);
-+
-+extern void lro_flush_pkt(struct net_lro_mgr *lro_mgr, struct iphdr *iph,
-+ struct tcphdr *tcph);
-+#endif /* backport of inet_lro */
-+
-+#ifndef ETHTOOL_FLASH_MAX_FILENAME
-+#define ETHTOOL_FLASH_MAX_FILENAME 128
-+#endif
-+
-+#if defined(CONFIG_XEN) && !defined(NETIF_F_GRO)
-+#define BE_INIT_FRAGS_PER_FRAME (u32) 1
-+#else
-+#define BE_INIT_FRAGS_PER_FRAME (min((u32) 16, (u32) MAX_SKB_FRAGS))
-+#endif
-+
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 32)
-+#ifdef CONFIG_PCI_IOV
-+#if (!(defined(RHEL_MAJOR) && (RHEL_MAJOR == 5) && (RHEL_MINOR == 6)))
-+#undef CONFIG_PCI_IOV
-+#endif
-+#endif
-+#endif
-+
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 20)
-+#define dev_to_node(dev) -1
-+#endif
-+
-+
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 32)
-+#if (!(defined(RHEL_MAJOR) && (RHEL_MAJOR == 5) && (RHEL_MINOR > 6)))
-+static inline struct sk_buff *netdev_alloc_skb_ip_align(struct net_device *dev,
-+ unsigned int length)
-+{
-+ struct sk_buff *skb = netdev_alloc_skb(dev, length + NET_IP_ALIGN);
-+
-+ if (NET_IP_ALIGN && skb)
-+ skb_reserve(skb, NET_IP_ALIGN);
-+ return skb;
-+}
-+#endif
-+#endif
-+
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 26)
-+#ifndef netif_set_gso_max_size
-+#define netif_set_gso_max_size(netdev, size) do {} while (0)
-+#endif
-+#endif
-+
-+#if (LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 18))
-+#if defined(RHEL_MINOR) && (RHEL_MINOR <= 4)
-+static inline int skb_is_gso_v6(const struct sk_buff *skb)
-+{
-+ return skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6;
-+}
-+#endif
-+#endif
-+
-+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 18))
-+static inline int skb_is_gso_v6(const struct sk_buff *skb)
-+{
-+ return (ip_hdr(skb)->version == 6);
-+}
-+#endif
-+
-+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 18))
-+#define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
-+#endif
-+
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 32)
-+#if ((defined(RHEL_MAJOR) && (RHEL_MAJOR == 6)))
-+#define HAVE_SRIOV_CONFIG
-+#endif
-+#endif
-+
-+#ifndef NETIF_F_VLAN_SG
-+#define NETIF_F_VLAN_SG NETIF_F_SG
-+#endif
-+
-+#ifndef NETIF_F_VLAN_CSUM
-+#define NETIF_F_VLAN_CSUM NETIF_F_HW_CSUM
-+#endif
-+
-+#ifndef NETIF_F_VLAN_TSO
-+#define NETIF_F_VLAN_TSO NETIF_F_TSO
-+#endif
-+
-+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 27))
-+#define vlan_features features
-+#endif
-+
-+#ifndef DEFINE_DMA_UNMAP_ADDR
-+#define DEFINE_DMA_UNMAP_ADDR(bus) dma_addr_t bus
-+#endif
-+
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 0, 0)
-+
-+#ifndef netdev_mc_count
-+#define netdev_mc_count(nd) (nd->mc_count)
-+#endif
-+
-+#ifndef netdev_hw_addr
-+#define netdev_hw_addr dev_mc_list
-+#endif
-+
-+#ifndef netdev_for_each_mc_addr
-+#define netdev_for_each_mc_addr(ha, nd) \
-+ for (ha = (nd)->mc_list; ha; ha = ha->next)
-+#endif
-+
-+#define DMI_ADDR dmi_addr
-+#else
-+#define DMI_ADDR addr
-+#endif
-+
-+#ifndef VLAN_GROUP_ARRAY_LEN
-+#define VLAN_GROUP_ARRAY_LEN VLAN_N_VID
-+#endif
-+/**************************** Multi TXQ Support ******************************/
-+
-+/* Supported only in RHEL6 and SL11.1 (barring one execption) */
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 32)
-+#define MQ_TX
-+#endif
-+
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 27)
-+#define alloc_etherdev_mq(sz, cnt) alloc_etherdev(sz)
-+#define skb_get_queue_mapping(skb) 0
-+#define skb_tx_hash(dev, skb) 0
-+#define netif_set_real_num_tx_queues(dev, txq) do {} while(0)
-+#define netif_wake_subqueue(dev, idx) netif_wake_queue(dev)
-+#define netif_stop_subqueue(dev, idx) netif_stop_queue(dev)
-+#define __netif_subqueue_stopped(dev, idx) netif_queue_stopped(dev)
-+#endif /* < 2.6.27 */
-+
-+#if ((LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && \
-+ (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 32)))
-+#define skb_tx_hash(dev, skb) 0
-+#define netif_set_real_num_tx_queues(dev, txq) do {} while(0)
-+#endif
-+
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 32)
-+#define netif_set_real_num_tx_queues be_set_real_num_tx_queues
-+static inline void be_set_real_num_tx_queues(struct net_device *dev,
-+ unsigned int txq)
-+{
-+ dev->real_num_tx_queues = txq;
-+}
-+#endif
-+
-+#include <linux/if_vlan.h>
-+static inline void be_reset_skb_tx_vlan(struct sk_buff *skb)
-+{
-+#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 18)
-+ skb->vlan_tci = 0;
-+#else
-+ struct vlan_skb_tx_cookie *cookie;
-+
-+ cookie = VLAN_TX_SKB_CB(skb);
-+ cookie->magic = 0;
-+#endif
-+}
-+
-+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 18))
-+static inline void skb_set_network_header(struct sk_buff *skb, const int offset)
-+{
-+ skb->nh.raw = skb->data + offset;
-+}
-+#endif
-+
-+static inline struct sk_buff *be_vlan_put_tag(struct sk_buff *skb,
-+ unsigned short vlan_tag)
-+{
-+ struct sk_buff *new_skb = __vlan_put_tag(skb, vlan_tag);
-+ /* On kernel versions < 2.6.27 the __vlan_put_tag() function
-+ * distorts the network layer hdr pointer in the skb which
-+ * affects the detection of UDP/TCP packets down the line in
-+ * wrb_fill_hdr().This work-around sets it right.
-+ */
-+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 27))
-+ skb_set_network_header(new_skb, VLAN_ETH_HLEN);
-+#endif
-+ return new_skb;
-+}
-+
-+#ifndef ACCESS_ONCE
-+#define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x))
-+#endif
-+
-+#endif /* BE_COMPAT_H */
-diff --git a/drivers/net/benet/be_ethtool.c b/drivers/net/benet/be_ethtool.c
-index f0fd95b..37bad99 100644
---- a/drivers/net/benet/be_ethtool.c
-+++ b/drivers/net/benet/be_ethtool.c
-@@ -1,18 +1,18 @@
- /*
-- * Copyright (C) 2005 - 2009 ServerEngines
-+ * Copyright (C) 2005 - 2011 Emulex
- * All rights reserved.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License version 2
-- * as published by the Free Software Foundation. The full GNU General
-+ * as published by the Free Software Foundation. The full GNU General
- * Public License is included in this distribution in the file called COPYING.
- *
- * Contact Information:
-- * linux-drivers@serverengines.com
-+ * linux-drivers@emulex.com
- *
-- * ServerEngines
-- * 209 N. Fair Oaks Ave
-- * Sunnyvale, CA 94085
-+ * Emulex
-+ * 3333 Susan Street
-+ * Costa Mesa, CA 92626
- */
-
- #include "be.h"
-@@ -26,21 +26,19 @@ struct be_ethtool_stat {
- int offset;
- };
-
--enum {NETSTAT, PORTSTAT, MISCSTAT, DRVSTAT, ERXSTAT};
-+enum {NETSTAT, DRVSTAT_TX, DRVSTAT_RX, DRVSTAT};
- #define FIELDINFO(_struct, field) FIELD_SIZEOF(_struct, field), \
- offsetof(_struct, field)
--#define NETSTAT_INFO(field) #field, NETSTAT,\
-+#define NETSTAT_INFO(field) #field, NETSTAT,\
- FIELDINFO(struct net_device_stats,\
- field)
--#define DRVSTAT_INFO(field) #field, DRVSTAT,\
-- FIELDINFO(struct be_drvr_stats, field)
--#define MISCSTAT_INFO(field) #field, MISCSTAT,\
-- FIELDINFO(struct be_rxf_stats, field)
--#define PORTSTAT_INFO(field) #field, PORTSTAT,\
-- FIELDINFO(struct be_port_rxf_stats, \
-+#define DRVSTAT_TX_INFO(field) #field, DRVSTAT_TX,\
-+ FIELDINFO(struct be_tx_stats, field)
-+#define DRVSTAT_RX_INFO(field) #field, DRVSTAT_RX,\
-+ FIELDINFO(struct be_rx_stats, field)
-+#define DRVSTAT_INFO(field) #field, DRVSTAT,\
-+ FIELDINFO(struct be_drv_stats, \
- field)
--#define ERXSTAT_INFO(field) #field, ERXSTAT,\
-- FIELDINFO(struct be_erx_stats, field)
-
- static const struct be_ethtool_stat et_stats[] = {
- {NETSTAT_INFO(rx_packets)},
-@@ -51,70 +49,131 @@ static const struct be_ethtool_stat et_stats[] = {
- {NETSTAT_INFO(tx_errors)},
- {NETSTAT_INFO(rx_dropped)},
- {NETSTAT_INFO(tx_dropped)},
-- {DRVSTAT_INFO(be_tx_reqs)},
-- {DRVSTAT_INFO(be_tx_stops)},
-- {DRVSTAT_INFO(be_fwd_reqs)},
-- {DRVSTAT_INFO(be_tx_wrbs)},
-- {DRVSTAT_INFO(be_polls)},
- {DRVSTAT_INFO(be_tx_events)},
-- {DRVSTAT_INFO(be_rx_events)},
-- {DRVSTAT_INFO(be_tx_compl)},
-- {DRVSTAT_INFO(be_rx_compl)},
-- {DRVSTAT_INFO(be_ethrx_post_fail)},
-- {DRVSTAT_INFO(be_802_3_dropped_frames)},
-- {DRVSTAT_INFO(be_802_3_malformed_frames)},
-- {DRVSTAT_INFO(be_tx_rate)},
-- {DRVSTAT_INFO(be_rx_rate)},
-- {PORTSTAT_INFO(rx_unicast_frames)},
-- {PORTSTAT_INFO(rx_multicast_frames)},
-- {PORTSTAT_INFO(rx_broadcast_frames)},
-- {PORTSTAT_INFO(rx_crc_errors)},
-- {PORTSTAT_INFO(rx_alignment_symbol_errors)},
-- {PORTSTAT_INFO(rx_pause_frames)},
-- {PORTSTAT_INFO(rx_control_frames)},
-- {PORTSTAT_INFO(rx_in_range_errors)},
-- {PORTSTAT_INFO(rx_out_range_errors)},
-- {PORTSTAT_INFO(rx_frame_too_long)},
-- {PORTSTAT_INFO(rx_address_match_errors)},
-- {PORTSTAT_INFO(rx_vlan_mismatch)},
-- {PORTSTAT_INFO(rx_dropped_too_small)},
-- {PORTSTAT_INFO(rx_dropped_too_short)},
-- {PORTSTAT_INFO(rx_dropped_header_too_small)},
-- {PORTSTAT_INFO(rx_dropped_tcp_length)},
-- {PORTSTAT_INFO(rx_dropped_runt)},
-- {PORTSTAT_INFO(rx_fifo_overflow)},
-- {PORTSTAT_INFO(rx_input_fifo_overflow)},
-- {PORTSTAT_INFO(rx_ip_checksum_errs)},
-- {PORTSTAT_INFO(rx_tcp_checksum_errs)},
-- {PORTSTAT_INFO(rx_udp_checksum_errs)},
-- {PORTSTAT_INFO(rx_non_rss_packets)},
-- {PORTSTAT_INFO(rx_ipv4_packets)},
-- {PORTSTAT_INFO(rx_ipv6_packets)},
-- {PORTSTAT_INFO(tx_unicastframes)},
-- {PORTSTAT_INFO(tx_multicastframes)},
-- {PORTSTAT_INFO(tx_broadcastframes)},
-- {PORTSTAT_INFO(tx_pauseframes)},
-- {PORTSTAT_INFO(tx_controlframes)},
-- {MISCSTAT_INFO(rx_drops_no_pbuf)},
-- {MISCSTAT_INFO(rx_drops_no_txpb)},
-- {MISCSTAT_INFO(rx_drops_no_erx_descr)},
-- {MISCSTAT_INFO(rx_drops_no_tpre_descr)},
-- {MISCSTAT_INFO(rx_drops_too_many_frags)},
-- {MISCSTAT_INFO(rx_drops_invalid_ring)},
-- {MISCSTAT_INFO(forwarded_packets)},
-- {MISCSTAT_INFO(rx_drops_mtu)},
-- {ERXSTAT_INFO(rx_drops_no_fragments)},
-+ {DRVSTAT_INFO(rx_crc_errors)},
-+ {DRVSTAT_INFO(rx_alignment_symbol_errors)},
-+ {DRVSTAT_INFO(rx_pause_frames)},
-+ {DRVSTAT_INFO(rx_control_frames)},
-+ {DRVSTAT_INFO(rx_in_range_errors)},
-+ {DRVSTAT_INFO(rx_out_range_errors)},
-+ {DRVSTAT_INFO(rx_frame_too_long)},
-+ {DRVSTAT_INFO(rx_address_match_errors)},
-+ {DRVSTAT_INFO(rx_dropped_too_small)},
-+ {DRVSTAT_INFO(rx_dropped_too_short)},
-+ {DRVSTAT_INFO(rx_dropped_header_too_small)},
-+ {DRVSTAT_INFO(rx_dropped_tcp_length)},
-+ {DRVSTAT_INFO(rx_dropped_runt)},
-+ {DRVSTAT_INFO(rxpp_fifo_overflow_drop)},
-+ {DRVSTAT_INFO(rx_input_fifo_overflow_drop)},
-+ {DRVSTAT_INFO(rx_ip_checksum_errs)},
-+ {DRVSTAT_INFO(rx_tcp_checksum_errs)},
-+ {DRVSTAT_INFO(rx_udp_checksum_errs)},
-+ {DRVSTAT_INFO(rx_switched_unicast_packets)},
-+ {DRVSTAT_INFO(rx_switched_multicast_packets)},
-+ {DRVSTAT_INFO(rx_switched_broadcast_packets)},
-+ {DRVSTAT_INFO(tx_pauseframes)},
-+ {DRVSTAT_INFO(tx_controlframes)},
-+ {DRVSTAT_INFO(rx_priority_pause_frames)},
-+ {DRVSTAT_INFO(pmem_fifo_overflow_drop)},
-+ {DRVSTAT_INFO(jabber_events)},
-+ {DRVSTAT_INFO(rx_drops_no_pbuf)},
-+ {DRVSTAT_INFO(rx_drops_no_txpb)},
-+ {DRVSTAT_INFO(rx_drops_no_erx_descr)},
-+ {DRVSTAT_INFO(rx_drops_no_tpre_descr)},
-+ {DRVSTAT_INFO(rx_drops_too_many_frags)},
-+ {DRVSTAT_INFO(rx_drops_invalid_ring)},
-+ {DRVSTAT_INFO(forwarded_packets)},
-+ {DRVSTAT_INFO(rx_drops_mtu)},
-+ {DRVSTAT_INFO(eth_red_drops)},
-+ {DRVSTAT_INFO(be_on_die_temperature)}
- };
- #define ETHTOOL_STATS_NUM ARRAY_SIZE(et_stats)
-
-+/* Stats related to multi RX queues */
-+static const struct be_ethtool_stat et_rx_stats[] = {
-+ {DRVSTAT_RX_INFO(rx_bytes)},
-+ {DRVSTAT_RX_INFO(rx_pkts)},
-+ {DRVSTAT_RX_INFO(rx_rate)},
-+ {DRVSTAT_RX_INFO(rx_polls)},
-+ {DRVSTAT_RX_INFO(rx_events)},
-+ {DRVSTAT_RX_INFO(rx_compl)},
-+ {DRVSTAT_RX_INFO(rx_mcast_pkts)},
-+ {DRVSTAT_RX_INFO(rx_post_fail)},
-+ {DRVSTAT_RX_INFO(rx_drops_no_frags)}
-+};
-+#define ETHTOOL_RXSTATS_NUM (ARRAY_SIZE(et_rx_stats))
-+
-+/* Stats related to multi TX queues */
-+static const struct be_ethtool_stat et_tx_stats[] = {
-+ {DRVSTAT_TX_INFO(be_tx_rate)},
-+ {DRVSTAT_TX_INFO(be_tx_reqs)},
-+ {DRVSTAT_TX_INFO(be_tx_wrbs)},
-+ {DRVSTAT_TX_INFO(be_tx_stops)},
-+ {DRVSTAT_TX_INFO(be_tx_compl)},
-+ {DRVSTAT_TX_INFO(be_ipv6_ext_hdr_tx_drop)}
-+};
-+#define ETHTOOL_TXSTATS_NUM (ARRAY_SIZE(et_tx_stats))
-+
-+static const char et_self_tests[][ETH_GSTRING_LEN] = {
-+ "MAC Loopback test",
-+ "PHY Loopback test",
-+ "External Loopback test",
-+ "DDR DMA test",
-+ "Link test"
-+};
-+
-+#define ETHTOOL_TESTS_NUM ARRAY_SIZE(et_self_tests)
-+#define BE_MAC_LOOPBACK 0x0
-+#define BE_PHY_LOOPBACK 0x1
-+#define BE_ONE_PORT_EXT_LOOPBACK 0x2
-+#define BE_NO_LOOPBACK 0xff
-+
-+/* MAC speed valid values */
-+#define SPEED_DEFAULT 0x0
-+#define SPEED_FORCED_10GB 0x1
-+#define SPEED_FORCED_1GB 0x2
-+#define SPEED_AUTONEG_10GB 0x3
-+#define SPEED_AUTONEG_1GB 0x4
-+#define SPEED_AUTONEG_100MB 0x5
-+#define SPEED_AUTONEG_10GB_1GB 0x6
-+#define SPEED_AUTONEG_10GB_1GB_100MB 0x7
-+#define SPEED_AUTONEG_1GB_100MB 0x8
-+#define SPEED_AUTONEG_10MB 0x9
-+#define SPEED_AUTONEG_1GB_100MB_10MB 0xa
-+#define SPEED_AUTONEG_100MB_10MB 0xb
-+#define SPEED_FORCED_100MB 0xc
-+#define SPEED_FORCED_10MB 0xd
-+
-+
-+
- static void
- be_get_drvinfo(struct net_device *netdev, struct ethtool_drvinfo *drvinfo)
- {
- struct be_adapter *adapter = netdev_priv(netdev);
-+ int len;
-+ char fw_on_flash[FW_VER_LEN];
-+
-+ memset(fw_on_flash, 0 , sizeof(fw_on_flash));
-+
-+ be_cmd_get_fw_ver(adapter, adapter->fw_ver,
-+ fw_on_flash);
-
- strcpy(drvinfo->driver, DRV_NAME);
- strcpy(drvinfo->version, DRV_VER);
-+
- strncpy(drvinfo->fw_version, adapter->fw_ver, FW_VER_LEN);
-+ if (memcmp(adapter->fw_ver, fw_on_flash,
-+ FW_VER_LEN) != 0) {
-+ len = strlen(drvinfo->fw_version);
-+ strncpy(drvinfo->fw_version+len, " [",
-+ FW_VER_LEN-len-1);
-+ len = strlen(drvinfo->fw_version);
-+ strncpy(drvinfo->fw_version+len, fw_on_flash,
-+ FW_VER_LEN-len-1);
-+ len = strlen(drvinfo->fw_version);
-+ strncpy(drvinfo->fw_version+len, "]", FW_VER_LEN-len-1);
-+ }
-+
- strcpy(drvinfo->bus_info, pci_name(adapter->pdev));
- drvinfo->testinfo_len = 0;
- drvinfo->regdump_len = 0;
-@@ -122,12 +181,37 @@ be_get_drvinfo(struct net_device *netdev, struct ethtool_drvinfo *drvinfo)
- }
-
- static int
-+be_get_reg_len(struct net_device *netdev)
-+{
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+ u32 log_size = 0;
-+
-+ if (be_physfn(adapter))
-+ be_cmd_get_reg_len(adapter, &log_size);
-+
-+ return log_size;
-+}
-+
-+static void
-+be_get_regs(struct net_device *netdev, struct ethtool_regs *regs, void *buf)
-+{
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+
-+ if (be_physfn(adapter)) {
-+ memset(buf, 0, regs->len);
-+ be_cmd_get_regs(adapter, regs->len, buf);
-+ }
-+}
-+
-+static int
- be_get_coalesce(struct net_device *netdev, struct ethtool_coalesce *coalesce)
- {
- struct be_adapter *adapter = netdev_priv(netdev);
-- struct be_eq_obj *rx_eq = &adapter->rx_eq;
-+ struct be_eq_obj *rx_eq = &adapter->rx_obj[0].rx_eq;
- struct be_eq_obj *tx_eq = &adapter->tx_eq;
-
-+ coalesce->rx_max_coalesced_frames = adapter->max_rx_coal;
-+
- coalesce->rx_coalesce_usecs = rx_eq->cur_eqd;
- coalesce->rx_coalesce_usecs_high = rx_eq->max_eqd;
- coalesce->rx_coalesce_usecs_low = rx_eq->min_eqd;
-@@ -149,25 +233,52 @@ static int
- be_set_coalesce(struct net_device *netdev, struct ethtool_coalesce *coalesce)
- {
- struct be_adapter *adapter = netdev_priv(netdev);
-- struct be_eq_obj *rx_eq = &adapter->rx_eq;
-+ struct be_rx_obj *rxo;
-+ struct be_eq_obj *rx_eq;
- struct be_eq_obj *tx_eq = &adapter->tx_eq;
- u32 tx_max, tx_min, tx_cur;
- u32 rx_max, rx_min, rx_cur;
-- int status = 0;
-+ int status = 0, i;
-
- if (coalesce->use_adaptive_tx_coalesce == 1)
- return -EINVAL;
-+ adapter->max_rx_coal = coalesce->rx_max_coalesced_frames;
-+ if (adapter->max_rx_coal > BE_MAX_FRAGS_PER_FRAME)
-+ adapter->max_rx_coal = BE_MAX_FRAGS_PER_FRAME;
-
-- /* if AIC is being turned on now, start with an EQD of 0 */
-- if (rx_eq->enable_aic == 0 &&
-- coalesce->use_adaptive_rx_coalesce == 1) {
-- rx_eq->cur_eqd = 0;
-+ for_all_rx_queues(adapter, rxo, i) {
-+ rx_eq = &rxo->rx_eq;
-+
-+ if (!rx_eq->enable_aic && coalesce->use_adaptive_rx_coalesce)
-+ rx_eq->cur_eqd = 0;
-+ rx_eq->enable_aic = coalesce->use_adaptive_rx_coalesce;
-+
-+ rx_max = coalesce->rx_coalesce_usecs_high;
-+ rx_min = coalesce->rx_coalesce_usecs_low;
-+ rx_cur = coalesce->rx_coalesce_usecs;
-+
-+ if (rx_eq->enable_aic) {
-+ if (rx_max > BE_MAX_EQD)
-+ rx_max = BE_MAX_EQD;
-+ if (rx_min > rx_max)
-+ rx_min = rx_max;
-+ rx_eq->max_eqd = rx_max;
-+ rx_eq->min_eqd = rx_min;
-+ if (rx_eq->cur_eqd > rx_max)
-+ rx_eq->cur_eqd = rx_max;
-+ if (rx_eq->cur_eqd < rx_min)
-+ rx_eq->cur_eqd = rx_min;
-+ } else {
-+ if (rx_cur > BE_MAX_EQD)
-+ rx_cur = BE_MAX_EQD;
-+ if (rx_eq->cur_eqd != rx_cur) {
-+ status = be_cmd_modify_eqd(adapter, rx_eq->q.id,
-+ rx_cur);
-+ if (!status)
-+ rx_eq->cur_eqd = rx_cur;
-+ }
-+ }
- }
-- rx_eq->enable_aic = coalesce->use_adaptive_rx_coalesce;
--
-- rx_max = coalesce->rx_coalesce_usecs_high;
-- rx_min = coalesce->rx_coalesce_usecs_low;
-- rx_cur = coalesce->rx_coalesce_usecs;
-
- tx_max = coalesce->tx_coalesce_usecs_high;
- tx_min = coalesce->tx_coalesce_usecs_low;
-@@ -181,27 +292,6 @@ be_set_coalesce(struct net_device *netdev, struct ethtool_coalesce *coalesce)
- tx_eq->cur_eqd = tx_cur;
- }
-
-- if (rx_eq->enable_aic) {
-- if (rx_max > BE_MAX_EQD)
-- rx_max = BE_MAX_EQD;
-- if (rx_min > rx_max)
-- rx_min = rx_max;
-- rx_eq->max_eqd = rx_max;
-- rx_eq->min_eqd = rx_min;
-- if (rx_eq->cur_eqd > rx_max)
-- rx_eq->cur_eqd = rx_max;
-- if (rx_eq->cur_eqd < rx_min)
-- rx_eq->cur_eqd = rx_min;
-- } else {
-- if (rx_cur > BE_MAX_EQD)
-- rx_cur = BE_MAX_EQD;
-- if (rx_eq->cur_eqd != rx_cur) {
-- status = be_cmd_modify_eqd(adapter, rx_eq->q.id,
-- rx_cur);
-- if (!status)
-- rx_eq->cur_eqd = rx_cur;
-- }
-- }
- return 0;
- }
-
-@@ -229,81 +319,294 @@ be_get_ethtool_stats(struct net_device *netdev,
- struct ethtool_stats *stats, uint64_t *data)
- {
- struct be_adapter *adapter = netdev_priv(netdev);
-- struct be_drvr_stats *drvr_stats = &adapter->stats.drvr_stats;
-- struct be_hw_stats *hw_stats = hw_stats_from_cmd(adapter->stats.cmd.va);
-- struct be_rxf_stats *rxf_stats = &hw_stats->rxf;
-- struct be_port_rxf_stats *port_stats =
-- &rxf_stats->port[adapter->port_num];
-- struct net_device_stats *net_stats = &adapter->stats.net_stats;
-- struct be_erx_stats *erx_stats = &hw_stats->erx;
-+ struct be_rx_obj *rxo;
-+ struct be_tx_obj *txo;
- void *p = NULL;
-- int i;
-+ int i, j, base;
-
- for (i = 0; i < ETHTOOL_STATS_NUM; i++) {
- switch (et_stats[i].type) {
- case NETSTAT:
-- p = net_stats;
-+ p = &adapter->net_stats;
- break;
- case DRVSTAT:
-- p = drvr_stats;
-- break;
-- case PORTSTAT:
-- p = port_stats;
-- break;
-- case MISCSTAT:
-- p = rxf_stats;
-- break;
-- case ERXSTAT: /* Currently only one ERX stat is provided */
-- p = (u32 *)erx_stats + adapter->rx_obj.q.id;
-+ p = &adapter->drv_stats;
- break;
- }
-
- p = (u8 *)p + et_stats[i].offset;
- data[i] = (et_stats[i].size == sizeof(u64)) ?
-- *(u64 *)p: *(u32 *)p;
-+ *(u64 *)p:(*(u32 *)p);
- }
-
-- return;
-+ base = ETHTOOL_STATS_NUM;
-+ for_all_rx_queues(adapter, rxo, j) {
-+ for (i = 0; i < ETHTOOL_RXSTATS_NUM; i++) {
-+ p = (u8 *)&rxo->stats + et_rx_stats[i].offset;
-+ data[base + j * ETHTOOL_RXSTATS_NUM + i] =
-+ (et_rx_stats[i].size == sizeof(u64)) ?
-+ *(u64 *)p: *(u32 *)p;
-+ }
-+ }
-+
-+ base = ETHTOOL_STATS_NUM + adapter->num_rx_qs * ETHTOOL_RXSTATS_NUM;
-+ for_all_tx_queues(adapter, txo, j) {
-+ for (i = 0; i < ETHTOOL_TXSTATS_NUM; i++) {
-+ p = (u8 *)&txo->stats + et_tx_stats[i].offset;
-+ data[base + j * ETHTOOL_TXSTATS_NUM + i] =
-+ (et_tx_stats[i].size == sizeof(u64)) ?
-+ *(u64 *)p: *(u32 *)p;
-+ }
-+ }
- }
-
- static void
- be_get_stat_strings(struct net_device *netdev, uint32_t stringset,
- uint8_t *data)
- {
-- int i;
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+ int i, j;
-+
- switch (stringset) {
- case ETH_SS_STATS:
- for (i = 0; i < ETHTOOL_STATS_NUM; i++) {
- memcpy(data, et_stats[i].desc, ETH_GSTRING_LEN);
- data += ETH_GSTRING_LEN;
- }
-+ for (i = 0; i < adapter->num_rx_qs; i++) {
-+ for (j = 0; j < ETHTOOL_RXSTATS_NUM; j++) {
-+ sprintf(data, "rxq%d: %s", i,
-+ et_rx_stats[j].desc);
-+ data += ETH_GSTRING_LEN;
-+ }
-+ }
-+ for (i = 0; i < adapter->num_tx_qs; i++) {
-+ for (j = 0; j < ETHTOOL_TXSTATS_NUM; j++) {
-+ sprintf(data, "txq%d: %s", i,
-+ et_tx_stats[j].desc);
-+ data += ETH_GSTRING_LEN;
-+ }
-+ }
-+ break;
-+ case ETH_SS_TEST:
-+ for (i = 0; i < ETHTOOL_TESTS_NUM; i++) {
-+ memcpy(data, et_self_tests[i], ETH_GSTRING_LEN);
-+ data += ETH_GSTRING_LEN;
-+ }
- break;
- }
- }
-
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 0, 0)
- static int be_get_stats_count(struct net_device *netdev)
- {
-- return ETHTOOL_STATS_NUM;
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+
-+ return ETHTOOL_STATS_NUM + adapter->num_rx_qs * ETHTOOL_RXSTATS_NUM
-+ + adapter->num_tx_qs * ETHTOOL_TXSTATS_NUM;
- }
-+static int
-+be_self_test_count(struct net_device *dev)
-+{
-+ return ETHTOOL_TESTS_NUM;
-+}
-+#else
-+
-+static int be_get_sset_count(struct net_device *netdev, int stringset)
-+{
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+
-+ switch (stringset) {
-+ case ETH_SS_TEST:
-+ return ETHTOOL_TESTS_NUM;
-+ case ETH_SS_STATS:
-+ return ETHTOOL_STATS_NUM +
-+ adapter->num_rx_qs * ETHTOOL_RXSTATS_NUM +
-+ adapter->num_tx_qs * ETHTOOL_TXSTATS_NUM;
-+ default:
-+ return -EINVAL;
-+ }
-+}
-+#endif
-
- static int be_get_settings(struct net_device *netdev, struct ethtool_cmd *ecmd)
- {
-- ecmd->speed = SPEED_10000;
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+ struct be_phy_info phy_info;
-+ u8 mac_speed = 0;
-+ u16 link_speed = 0;
-+ int link_status = LINK_DOWN;
-+ int status;
-+
-+ if ((adapter->link_speed < 0) || (!(netdev->flags & IFF_UP))) {
-+ status = be_cmd_link_status_query(adapter, &link_status,
-+ &mac_speed, &link_speed, 0);
-+
-+ be_link_status_update(adapter, link_status);
-+ /* link_speed is in units of 10 Mbps */
-+ if (link_speed) {
-+ ecmd->speed = link_speed*10;
-+ } else {
-+ switch (mac_speed) {
-+ case PHY_LINK_SPEED_10MBPS:
-+ ecmd->speed = SPEED_10;
-+ break;
-+ case PHY_LINK_SPEED_100MBPS:
-+ ecmd->speed = SPEED_100;
-+ break;
-+ case PHY_LINK_SPEED_1GBPS:
-+ ecmd->speed = SPEED_1000;
-+ break;
-+ case PHY_LINK_SPEED_10GBPS:
-+ ecmd->speed = SPEED_10000;
-+ break;
-+ case PHY_LINK_SPEED_ZERO:
-+ ecmd->speed = 0;
-+ break;
-+ }
-+ }
-+
-+ status = be_cmd_get_phy_info(adapter, &phy_info);
-+ if (!status) {
-+ switch (phy_info.interface_type) {
-+ case PHY_TYPE_XFP_10GB:
-+ case PHY_TYPE_SFP_1GB:
-+ case PHY_TYPE_SFP_PLUS_10GB:
-+ ecmd->port = PORT_FIBRE;
-+ break;
-+ default:
-+ ecmd->port = PORT_TP;
-+ break;
-+ }
-+
-+ switch (phy_info.interface_type) {
-+ case PHY_TYPE_KR_10GB:
-+ case PHY_TYPE_KX4_10GB:
-+ ecmd->transceiver = XCVR_INTERNAL;
-+ break;
-+ default:
-+ ecmd->transceiver = XCVR_EXTERNAL;
-+ break;
-+ }
-+
-+ if (phy_info.auto_speeds_supported) {
-+ ecmd->supported |= SUPPORTED_Autoneg;
-+ ecmd->autoneg = AUTONEG_ENABLE;
-+ ecmd->advertising |= ADVERTISED_Autoneg;
-+ }
-+
-+ if (phy_info.misc_params & BE_PAUSE_SYM_EN) {
-+ ecmd->supported |= SUPPORTED_Pause;
-+ ecmd->advertising |= ADVERTISED_Pause;
-+ }
-+
-+ }
-+
-+ /* Save for future use */
-+ adapter->link_speed = ecmd->speed;
-+ adapter->port_type = ecmd->port;
-+ adapter->transceiver = ecmd->transceiver;
-+ adapter->autoneg = ecmd->autoneg;
-+ } else {
-+ ecmd->speed = adapter->link_speed;
-+ ecmd->port = adapter->port_type;
-+ ecmd->transceiver = adapter->transceiver;
-+ ecmd->autoneg = adapter->autoneg;
-+ }
-+
- ecmd->duplex = DUPLEX_FULL;
-- ecmd->autoneg = AUTONEG_DISABLE;
-+ ecmd->phy_address = (adapter->hba_port_num << 4) |
-+ (adapter->port_name[adapter->hba_port_num]);
-+ switch (ecmd->port) {
-+ case PORT_FIBRE:
-+ ecmd->supported = (SUPPORTED_10000baseT_Full | SUPPORTED_FIBRE);
-+ break;
-+ case PORT_TP:
-+ ecmd->supported = (SUPPORTED_10000baseT_Full | SUPPORTED_TP);
-+ break;
-+ }
-+
-+ if (ecmd->autoneg) {
-+ ecmd->supported |= SUPPORTED_1000baseT_Full;
-+ ecmd->advertising |= (ADVERTISED_10000baseT_Full |
-+ ADVERTISED_1000baseT_Full);
-+ }
-+
- return 0;
- }
-
-+static int be_set_settings(struct net_device *netdev,
-+ struct ethtool_cmd *ecmd)
-+{
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+ struct be_phy_info phy_info;
-+ u16 mac_speed=0;
-+ u16 dac_cable_len=0;
-+ u16 port_speed = 0;
-+ int status;
-+
-+ status = be_cmd_get_phy_info(adapter, &phy_info);
-+ if (status) {
-+ dev_warn(&adapter->pdev->dev, "port speed set failed.\n");
-+ return status;
-+ }
-+
-+ if (ecmd->autoneg == AUTONEG_ENABLE) {
-+ switch(phy_info.interface_type) {
-+ case PHY_TYPE_SFP_1GB:
-+ case PHY_TYPE_BASET_1GB:
-+ case PHY_TYPE_BASEX_1GB:
-+ case PHY_TYPE_SGMII:
-+ mac_speed = SPEED_AUTONEG_1GB_100MB_10MB;
-+ break;
-+ case PHY_TYPE_SFP_PLUS_10GB:
-+ dev_warn(&adapter->pdev->dev,
-+ "Autoneg not supported on this module. \n");
-+ return -EINVAL;
-+ case PHY_TYPE_KR_10GB:
-+ case PHY_TYPE_KX4_10GB:
-+ mac_speed = SPEED_AUTONEG_10GB_1GB;
-+ break;
-+ case PHY_TYPE_BASET_10GB:
-+ mac_speed = SPEED_AUTONEG_10GB_1GB_100MB;
-+ break;
-+ }
-+ } else if(ecmd->autoneg == AUTONEG_DISABLE) {
-+ if(ecmd->speed == SPEED_10) {
-+ mac_speed = SPEED_FORCED_10MB;
-+ } else if(ecmd->speed == SPEED_100) {
-+ mac_speed = SPEED_FORCED_100MB;
-+ } else if(ecmd->speed == SPEED_1000) {
-+ mac_speed = SPEED_FORCED_1GB;
-+ } else if(ecmd->speed == SPEED_10000) {
-+ mac_speed = SPEED_FORCED_10GB;
-+ }
-+ }
-+
-+ status = be_cmd_get_port_speed(adapter, adapter->hba_port_num,
-+ &dac_cable_len, &port_speed);
-+
-+ if (!status && port_speed != mac_speed)
-+ status = be_cmd_set_port_speed_v1(adapter,
-+ adapter->hba_port_num, mac_speed,
-+ dac_cable_len);
-+ if (status)
-+ dev_warn(&adapter->pdev->dev, "port speed set failed.\n");
-+
-+ return status;
-+
-+}
-+
- static void
- be_get_ringparam(struct net_device *netdev, struct ethtool_ringparam *ring)
- {
- struct be_adapter *adapter = netdev_priv(netdev);
-
-- ring->rx_max_pending = adapter->rx_obj.q.len;
-- ring->tx_max_pending = adapter->tx_obj.q.len;
-+ ring->rx_max_pending = adapter->rx_obj[0].q.len;
-+ ring->tx_max_pending = adapter->tx_obj[0].q.len;
-
-- ring->rx_pending = atomic_read(&adapter->rx_obj.q.used);
-- ring->tx_pending = atomic_read(&adapter->tx_obj.q.used);
-+ ring->rx_pending = atomic_read(&adapter->rx_obj[0].q.used);
-+ ring->tx_pending = atomic_read(&adapter->tx_obj[0].q.used);
- }
-
- static void
-@@ -312,7 +615,7 @@ be_get_pauseparam(struct net_device *netdev, struct ethtool_pauseparam *ecmd)
- struct be_adapter *adapter = netdev_priv(netdev);
-
- be_cmd_get_flow_control(adapter, &ecmd->tx_pause, &ecmd->rx_pause);
-- ecmd->autoneg = 0;
-+ ecmd->autoneg = adapter->autoneg;
- }
-
- static int
-@@ -334,6 +637,203 @@ be_set_pauseparam(struct net_device *netdev, struct ethtool_pauseparam *ecmd)
- return status;
- }
-
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 0, 0)
-+static int
-+be_phys_id(struct net_device *netdev, u32 data)
-+{
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+ int status;
-+ u32 cur;
-+
-+ be_cmd_get_beacon_state(adapter, adapter->hba_port_num, &cur);
-+
-+ if (cur == BEACON_STATE_ENABLED)
-+ return 0;
-+
-+ if (data < 2)
-+ data = 2;
-+
-+ status = be_cmd_set_beacon_state(adapter, adapter->hba_port_num, 0, 0,
-+ BEACON_STATE_ENABLED);
-+ set_current_state(TASK_INTERRUPTIBLE);
-+ schedule_timeout(data*HZ);
-+
-+ status = be_cmd_set_beacon_state(adapter, adapter->hba_port_num, 0, 0,
-+ BEACON_STATE_DISABLED);
-+
-+ return status;
-+}
-+#else
-+static int
-+be_set_phys_id(struct net_device *netdev,
-+ enum ethtool_phys_id_state state)
-+{
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+
-+ switch (state) {
-+ case ETHTOOL_ID_ACTIVE:
-+ be_cmd_get_beacon_state(adapter, adapter->hba_port_num,
-+ &adapter->beacon_state);
-+ return 1; /* cycle on/off once per second */
-+
-+ case ETHTOOL_ID_ON:
-+ be_cmd_set_beacon_state(adapter, adapter->hba_port_num, 0, 0,
-+ BEACON_STATE_ENABLED);
-+ break;
-+
-+ case ETHTOOL_ID_OFF:
-+ be_cmd_set_beacon_state(adapter, adapter->hba_port_num, 0, 0,
-+ BEACON_STATE_DISABLED);
-+ break;
-+
-+ case ETHTOOL_ID_INACTIVE:
-+ be_cmd_set_beacon_state(adapter, adapter->hba_port_num, 0, 0,
-+ adapter->beacon_state);
-+ }
-+
-+ return 0;
-+}
-+#endif
-+
-+static bool
-+be_is_wol_supported(struct be_adapter *adapter)
-+{
-+ struct pci_dev *pdev = adapter->pdev;
-+
-+ if (!be_physfn(adapter))
-+ return false;
-+
-+ switch (pdev->subsystem_device) {
-+ case OC_SUBSYS_DEVICE_ID1:
-+ case OC_SUBSYS_DEVICE_ID2:
-+ case OC_SUBSYS_DEVICE_ID3:
-+ case OC_SUBSYS_DEVICE_ID4:
-+ return false;
-+ default:
-+ return true;
-+ }
-+}
-+
-+static void
-+be_get_wol(struct net_device *netdev, struct ethtool_wolinfo *wol)
-+{
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+
-+ if (be_is_wol_supported(adapter))
-+ wol->supported = WAKE_MAGIC;
-+ if (adapter->wol)
-+ wol->wolopts = WAKE_MAGIC;
-+ else
-+ wol->wolopts = 0;
-+ memset(&wol->sopass, 0, sizeof(wol->sopass));
-+}
-+
-+static int
-+be_set_wol(struct net_device *netdev, struct ethtool_wolinfo *wol)
-+{
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+
-+ if (wol->wolopts & ~WAKE_MAGIC)
-+ return -EOPNOTSUPP;
-+
-+ if (!be_is_wol_supported(adapter)) {
-+ dev_warn(&adapter->pdev->dev,
-+ "WOL not supported for this subsystemid: %x\n",
-+ adapter->pdev->subsystem_device);
-+ return -EOPNOTSUPP;
-+ }
-+
-+ if (wol->wolopts & WAKE_MAGIC)
-+ adapter->wol = true;
-+ else
-+ adapter->wol = false;
-+
-+ return 0;
-+}
-+
-+static int
-+be_test_ddr_dma(struct be_adapter *adapter)
-+{
-+ int ret, i;
-+ struct be_dma_mem ddrdma_cmd;
-+ u64 pattern[2] = {0x5a5a5a5a5a5a5a5aULL, 0xa5a5a5a5a5a5a5a5ULL};
-+
-+ ddrdma_cmd.size = sizeof(struct be_cmd_req_ddrdma_test);
-+ ddrdma_cmd.va = pci_alloc_consistent(adapter->pdev, ddrdma_cmd.size,
-+ &ddrdma_cmd.dma);
-+ if (!ddrdma_cmd.va) {
-+ dev_err(&adapter->pdev->dev, "Memory allocation failure\n");
-+ return -ENOMEM;
-+ }
-+
-+ for (i = 0; i < 2; i++) {
-+ ret = be_cmd_ddr_dma_test(adapter, pattern[i],
-+ 4096, &ddrdma_cmd);
-+ if (ret != 0)
-+ goto err;
-+ }
-+
-+err:
-+ pci_free_consistent(adapter->pdev, ddrdma_cmd.size,
-+ ddrdma_cmd.va, ddrdma_cmd.dma);
-+ return ret;
-+}
-+
-+static u64 be_loopback_test(struct be_adapter *adapter, u8 loopback_type,
-+ u64 *status)
-+{
-+ be_cmd_set_loopback(adapter, adapter->hba_port_num,
-+ loopback_type, 1);
-+ *status = be_cmd_loopback_test(adapter, adapter->hba_port_num,
-+ loopback_type, 1500,
-+ 2, 0xabc);
-+ be_cmd_set_loopback(adapter, adapter->hba_port_num,
-+ BE_NO_LOOPBACK, 1);
-+ return *status;
-+}
-+
-+static void
-+be_self_test(struct net_device *netdev, struct ethtool_test *test, u64 *data)
-+{
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+ int link_status;
-+ u8 mac_speed = 0;
-+ u16 qos_link_speed = 0;
-+
-+ memset(data, 0, sizeof(u64) * ETHTOOL_TESTS_NUM);
-+
-+ if (test->flags & ETH_TEST_FL_OFFLINE) {
-+ if (be_loopback_test(adapter, BE_MAC_LOOPBACK,
-+ &data[0]) != 0) {
-+ test->flags |= ETH_TEST_FL_FAILED;
-+ }
-+ if (be_loopback_test(adapter, BE_PHY_LOOPBACK,
-+ &data[1]) != 0) {
-+ test->flags |= ETH_TEST_FL_FAILED;
-+ }
-+ if (be_loopback_test(adapter, BE_ONE_PORT_EXT_LOOPBACK,
-+ &data[2]) != 0) {
-+ test->flags |= ETH_TEST_FL_FAILED;
-+ }
-+ }
-+
-+ if (be_test_ddr_dma(adapter) != 0) {
-+ data[3] = 1;
-+ test->flags |= ETH_TEST_FL_FAILED;
-+ }
-+
-+ if (be_cmd_link_status_query(adapter, &link_status, &mac_speed,
-+ &qos_link_speed, 0) != 0) {
-+ test->flags |= ETH_TEST_FL_FAILED;
-+ data[4] = -1;
-+ } else if (!mac_speed) {
-+ test->flags |= ETH_TEST_FL_FAILED;
-+ data[4] = 1;
-+ }
-+
-+}
-+
-+#ifdef HAVE_ETHTOOL_FLASH
- static int
- be_do_flash(struct net_device *netdev, struct ethtool_flash *efl)
- {
-@@ -347,11 +847,73 @@ be_do_flash(struct net_device *netdev, struct ethtool_flash *efl)
-
- return be_load_fw(adapter, file_name);
- }
-+#endif
-
--const struct ethtool_ops be_ethtool_ops = {
-+static int
-+be_get_eeprom_len(struct net_device *netdev)
-+{
-+ return BE_READ_SEEPROM_LEN;
-+}
-+
-+static int
-+be_read_eeprom(struct net_device *netdev, struct ethtool_eeprom *eeprom,
-+ uint8_t *data)
-+{
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+ struct be_dma_mem eeprom_cmd;
-+ struct be_cmd_resp_seeprom_read *resp;
-+ int status;
-+
-+ if (!eeprom->len)
-+ return -EINVAL;
-+
-+ eeprom->magic = BE_VENDOR_ID | (adapter->pdev->device<<16);
-+
-+ memset(&eeprom_cmd, 0, sizeof(struct be_dma_mem));
-+ eeprom_cmd.size = sizeof(struct be_cmd_req_seeprom_read);
-+ eeprom_cmd.va = pci_alloc_consistent(adapter->pdev, eeprom_cmd.size,
-+ &eeprom_cmd.dma);
-+
-+ if (!eeprom_cmd.va) {
-+ dev_err(&adapter->pdev->dev,
-+ "Memory allocation failure. Could not read eeprom\n");
-+ return -ENOMEM;
-+ }
-+
-+ status = be_cmd_get_seeprom_data(adapter, &eeprom_cmd);
-+
-+ if (!status) {
-+ resp = (struct be_cmd_resp_seeprom_read *) eeprom_cmd.va;
-+ memcpy(data, resp->seeprom_data + eeprom->offset, eeprom->len);
-+ }
-+ pci_free_consistent(adapter->pdev, eeprom_cmd.size, eeprom_cmd.va,
-+ eeprom_cmd.dma);
-+
-+ return status;
-+}
-+
-+static int be_set_tso(struct net_device *netdev, uint32_t data)
-+{
-+ if (data) {
-+ netdev->features |= NETIF_F_TSO;
-+ netdev->features |= NETIF_F_TSO6;
-+ } else {
-+ netdev->features &= ~NETIF_F_TSO;
-+ netdev->features &= ~NETIF_F_TSO6;
-+ }
-+ return 0;
-+}
-+
-+
-+struct ethtool_ops be_ethtool_ops = {
- .get_settings = be_get_settings,
-+ .set_settings = be_set_settings,
- .get_drvinfo = be_get_drvinfo,
-+ .get_wol = be_get_wol,
-+ .set_wol = be_set_wol,
- .get_link = ethtool_op_get_link,
-+ .get_eeprom_len = be_get_eeprom_len,
-+ .get_eeprom = be_read_eeprom,
- .get_coalesce = be_get_coalesce,
- .set_coalesce = be_set_coalesce,
- .get_ringparam = be_get_ringparam,
-@@ -364,9 +926,21 @@ const struct ethtool_ops be_ethtool_ops = {
- .get_sg = ethtool_op_get_sg,
- .set_sg = ethtool_op_set_sg,
- .get_tso = ethtool_op_get_tso,
-- .set_tso = ethtool_op_set_tso,
-+ .set_tso = be_set_tso,
- .get_strings = be_get_stat_strings,
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 0, 0)
-+ .phys_id = be_phys_id,
- .get_stats_count = be_get_stats_count,
-+ .self_test_count = be_self_test_count,
-+#else
-+ .set_phys_id = be_set_phys_id,
-+ .get_sset_count = be_get_sset_count,
-+#endif
- .get_ethtool_stats = be_get_ethtool_stats,
-+ .get_regs_len = be_get_reg_len,
-+ .get_regs = be_get_regs,
-+#ifdef HAVE_ETHTOOL_FLASH
- .flash_device = be_do_flash,
-+#endif
-+ .self_test = be_self_test
- };
-diff --git a/drivers/net/benet/be_hw.h b/drivers/net/benet/be_hw.h
-index a3394b4..f871d8c 100644
---- a/drivers/net/benet/be_hw.h
-+++ b/drivers/net/benet/be_hw.h
-@@ -1,18 +1,18 @@
- /*
-- * Copyright (C) 2005 - 2009 ServerEngines
-+ * Copyright (C) 2005 - 2011 Emulex
- * All rights reserved.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License version 2
-- * as published by the Free Software Foundation. The full GNU General
-+ * as published by the Free Software Foundation. The full GNU General
- * Public License is included in this distribution in the file called COPYING.
- *
- * Contact Information:
-- * linux-drivers@serverengines.com
-+ * linux-drivers@emulex.com
- *
-- * ServerEngines
-- * 209 N. Fair Oaks Ave
-- * Sunnyvale, CA 94085
-+ * Emulex
-+ * 3333 Susan Street
-+ * Costa Mesa, CA 92626
- */
-
- /********* Mailbox door bell *************/
-@@ -26,24 +26,34 @@
- * queue entry.
- */
- #define MPU_MAILBOX_DB_OFFSET 0x160
--#define MPU_MAILBOX_DB_RDY_MASK 0x1 /* bit 0 */
-+#define MPU_MAILBOX_DB_RDY_MASK 0x1 /* bit 0 */
- #define MPU_MAILBOX_DB_HI_MASK 0x2 /* bit 1 */
-
--#define MPU_EP_CONTROL 0
-+#define MPU_EP_CONTROL 0
-
- /********** MPU semphore ******************/
--#define MPU_EP_SEMAPHORE_OFFSET 0xac
-+#define MPU_EP_SEMAPHORE_OFFSET 0xac
-+#define MPU_EP_SEMAPHORE_IF_TYPE2_OFFSET 0x400
- #define EP_SEMAPHORE_POST_STAGE_MASK 0x0000FFFF
- #define EP_SEMAPHORE_POST_ERR_MASK 0x1
- #define EP_SEMAPHORE_POST_ERR_SHIFT 31
- /* MPU semphore POST stage values */
--#define POST_STAGE_AWAITING_HOST_RDY 0x1 /* FW awaiting goahead from host */
--#define POST_STAGE_HOST_RDY 0x2 /* Host has given go-ahed to FW */
-+#define POST_STAGE_AWAITING_HOST_RDY 0x1 /* FW awaiting goahead from host */
-+#define POST_STAGE_HOST_RDY 0x2 /* Host has given go-ahed to FW */
- #define POST_STAGE_BE_RESET 0x3 /* Host wants to reset chip */
- #define POST_STAGE_ARMFW_RDY 0xc000 /* FW is done with POST */
-
-+/* Lancer SLIPORT_CONTROL SLIPORT_STATUS registers */
-+#define SLIPORT_STATUS_OFFSET 0x404
-+#define SLIPORT_CONTROL_OFFSET 0x408
-+
-+#define SLIPORT_STATUS_ERR_MASK 0x80000000
-+#define SLIPORT_STATUS_RN_MASK 0x01000000
-+#define SLIPORT_STATUS_RDY_MASK 0x00800000
-+#define SLI_PORT_CONTROL_IP_MASK 0x08000000
-+
- /********* Memory BAR register ************/
--#define PCICFG_MEMBAR_CTRL_INT_CTRL_OFFSET 0xfc
-+#define PCICFG_MEMBAR_CTRL_INT_CTRL_OFFSET 0xfc
- /* Host Interrupt Enable, if set interrupts are enabled although "PCI Interrupt
- * Disable" may still globally block interrupts in addition to individual
- * interrupt masks; a mechanism for the device driver to block all interrupts
-@@ -52,13 +62,70 @@
- */
- #define MEMBAR_CTRL_INT_CTRL_HOSTINTR_MASK (1 << 29) /* bit 29 */
-
-+/********* Link Status CSR ****************/
-+#define PCICFG_PCIE_LINK_STATUS_OFFSET 0xd0
-+#define PCIE_LINK_STATUS_SPEED_MASK 0xFF /* bits 16 - 19 */
-+#define PCIE_LINK_STATUS_SPEED_SHIFT 16
-+#define PCIE_LINK_STATUS_NEG_WIDTH_MASK 0x3F /* bits 20 - 25 */
-+#define PCIE_LINK_STATUS_NEG_WIDTH_SHIFT 20
-+
-+/********* Link Capability CSR ************/
-+#define PCICFG_PCIE_LINK_CAP_OFFSET 0xcc
-+#define PCIE_LINK_CAP_MAX_SPEED_MASK 0xFF /* bits 0 - 3 */
-+#define PCIE_LINK_CAP_MAX_SPEED_SHIFT 0
-+#define PCIE_LINK_CAP_MAX_WIDTH_MASK 0x3F /* bits 4 - 9 */
-+#define PCIE_LINK_CAP_MAX_WIDTH_SHIFT 4
-+
-+/********* PCI Function Capability ************/
-+#define BE_FUNCTION_CAPS_UNCLASSIFIED_STATS 0x1
-+#define BE_FUNCTION_CAPS_RSS 0x2
-+#define BE_FUNCTION_CAPS_PROMISCUOUS 0x4
-+#define BE_FUNCTION_CAPS_LEGACY_MODE 0x8
-+
-+/********* Power managment (WOL) **********/
-+#define PCICFG_PM_CONTROL_OFFSET 0x44
-+#define PCICFG_PM_CONTROL_MASK 0x108 /* bits 3 & 8 */
-+
-+/********* Online Control Registers *******/
-+#define PCICFG_ONLINE0 0xB0
-+#define PCICFG_ONLINE1 0xB4
-+
-+/********* UE Status and Mask Registers ***/
-+#define PCICFG_UE_STATUS_LOW 0xA0
-+#define PCICFG_UE_STATUS_HIGH 0xA4
-+#define PCICFG_UE_STATUS_LOW_MASK 0xA8
-+#define PCICFG_UE_STATUS_HI_MASK 0xAC
-+
-+/******** SLI_INTF ***********************/
-+#define SLI_INTF_REG_OFFSET 0x58
-+#define SLI_INTF_VALID_MASK 0xE0000000
-+#define SLI_INTF_VALID 0xC0000000
-+#define SLI_INTF_HINT2_MASK 0x1F000000
-+#define SLI_INTF_HINT2_SHIFT 24
-+#define SLI_INTF_HINT1_MASK 0x00FF0000
-+#define SLI_INTF_HINT1_SHIFT 16
-+#define SLI_INTF_FAMILY_MASK 0x00000F00
-+#define SLI_INTF_FAMILY_SHIFT 8
-+#define SLI_INTF_IF_TYPE_MASK 0x0000F000
-+#define SLI_INTF_IF_TYPE_SHIFT 12
-+#define SLI_INTF_REV_MASK 0x000000F0
-+#define SLI_INTF_REV_SHIFT 4
-+#define SLI_INTF_FT_MASK 0x00000001
-+
-+/* SLI family */
-+#define BE_SLI_FAMILY 0x0
-+#define LANCER_A0_SLI_FAMILY 0xA
-+
- /********* ISR0 Register offset **********/
--#define CEV_ISR0_OFFSET 0xC18
-+#define CEV_ISR0_OFFSET 0xC18
- #define CEV_ISR_SIZE 4
-
- /********* Event Q door bell *************/
- #define DB_EQ_OFFSET DB_CQ_OFFSET
- #define DB_EQ_RING_ID_MASK 0x1FF /* bits 0 - 8 */
-+#define DB_EQ_RING_ID_EXT_MASK 0x3e00 /* bits 9-13 */
-+#define DB_EQ_RING_ID_EXT_MASK_SHIFT (2) /* qid bits 9-13 placing at 11-15 */
-+
- /* Clear the interrupt for this eq */
- #define DB_EQ_CLR_SHIFT (9) /* bit 9 */
- /* Must be 1 */
-@@ -69,12 +136,16 @@
- #define DB_EQ_REARM_SHIFT (29) /* bit 29 */
-
- /********* Compl Q door bell *************/
--#define DB_CQ_OFFSET 0x120
-+#define DB_CQ_OFFSET 0x120
- #define DB_CQ_RING_ID_MASK 0x3FF /* bits 0 - 9 */
-+#define DB_CQ_RING_ID_EXT_MASK 0x7C00 /* bits 10-14 */
-+#define DB_CQ_RING_ID_EXT_MASK_SHIFT (1) /* qid bits 10-14
-+ placing at 11-15 */
-+
- /* Number of event entries processed */
--#define DB_CQ_NUM_POPPED_SHIFT (16) /* bits 16 - 28 */
-+#define DB_CQ_NUM_POPPED_SHIFT (16) /* bits 16 - 28 */
- /* Rearm bit */
--#define DB_CQ_REARM_SHIFT (29) /* bit 29 */
-+#define DB_CQ_REARM_SHIFT (29) /* bit 29 */
-
- /********** TX ULP door bell *************/
- #define DB_TXULP1_OFFSET 0x60
-@@ -84,25 +155,103 @@
- #define DB_TXULP_NUM_POSTED_MASK 0x3FFF /* bits 16 - 29 */
-
- /********** RQ(erx) door bell ************/
--#define DB_RQ_OFFSET 0x100
-+#define DB_RQ_OFFSET 0x100
- #define DB_RQ_RING_ID_MASK 0x3FF /* bits 0 - 9 */
- /* Number of rx frags posted */
- #define DB_RQ_NUM_POSTED_SHIFT (24) /* bits 24 - 31 */
-
- /********** MCC door bell ************/
--#define DB_MCCQ_OFFSET 0x140
-+#define DB_MCCQ_OFFSET 0x140
- #define DB_MCCQ_RING_ID_MASK 0x7FF /* bits 0 - 10 */
- /* Number of entries posted */
- #define DB_MCCQ_NUM_POSTED_SHIFT (16) /* bits 16 - 29 */
-
-+/********** SRIOV VF PCICFG OFFSET ********/
-+#define SRIOV_VF_PCICFG_OFFSET (4096)
-+
-+/********** FAT TABLE ********/
-+#define RETRIEVE_FAT 0
-+#define QUERY_FAT 1
-+
-+/* Flashrom related descriptors */
-+#define IMAGE_TYPE_FIRMWARE 160
-+#define IMAGE_TYPE_BOOTCODE 224
-+#define IMAGE_TYPE_OPTIONROM 32
-+
-+#define NUM_FLASHDIR_ENTRIES 32
-+
-+#define IMG_TYPE_ISCSI_ACTIVE 0
-+#define IMG_TYPE_REDBOOT 1
-+#define IMG_TYPE_BIOS 2
-+#define IMG_TYPE_PXE_BIOS 3
-+#define IMG_TYPE_FCOE_BIOS 8
-+#define IMG_TYPE_ISCSI_BACKUP 9
-+#define IMG_TYPE_FCOE_FW_ACTIVE 10
-+#define IMG_TYPE_FCOE_FW_BACKUP 11
-+#define IMG_TYPE_NCSI_FW 13
-+#define IMG_TYPE_PHY_FW 99
-+#define TN_8022 13
-+
-+#define ILLEGAL_IOCTL_REQ 2
-+#define FLASHROM_OPER_PHY_FLASH 9
-+#define FLASHROM_OPER_PHY_SAVE 10
-+#define FLASHROM_OPER_FLASH 1
-+#define FLASHROM_OPER_SAVE 2
-+#define FLASHROM_OPER_REPORT 4
-+
-+#define FLASH_IMAGE_MAX_SIZE_g2 (1310720) /* Max firmware image size */
-+#define FLASH_BIOS_IMAGE_MAX_SIZE_g2 (262144) /* Max OPTION ROM image sz */
-+#define FLASH_REDBOOT_IMAGE_MAX_SIZE_g2 (262144) /* Max Redboot image sz */
-+#define FLASH_IMAGE_MAX_SIZE_g3 (2097152) /* Max firmware image size */
-+#define FLASH_BIOS_IMAGE_MAX_SIZE_g3 (524288) /* Max OPTION ROM image sz */
-+#define FLASH_REDBOOT_IMAGE_MAX_SIZE_g3 (1048576) /* Max Redboot image sz */
-+#define FLASH_NCSI_IMAGE_MAX_SIZE_g3 (262144)
-+#define FLASH_PHY_FW_IMAGE_MAX_SIZE_g3 (262144)
-+
-+#define FLASH_NCSI_MAGIC (0x16032009)
-+#define FLASH_NCSI_DISABLED (0)
-+#define FLASH_NCSI_ENABLED (1)
-+
-+#define FLASH_NCSI_BITFILE_HDR_OFFSET (0x600000)
-+
-+/* Offsets for components on Flash. */
-+#define FLASH_iSCSI_PRIMARY_IMAGE_START_g2 (1048576)
-+#define FLASH_iSCSI_BACKUP_IMAGE_START_g2 (2359296)
-+#define FLASH_FCoE_PRIMARY_IMAGE_START_g2 (3670016)
-+#define FLASH_FCoE_BACKUP_IMAGE_START_g2 (4980736)
-+#define FLASH_iSCSI_BIOS_START_g2 (7340032)
-+#define FLASH_PXE_BIOS_START_g2 (7864320)
-+#define FLASH_FCoE_BIOS_START_g2 (524288)
-+#define FLASH_REDBOOT_START_g2 (0)
-+
-+#define FLASH_NCSI_START_g3 (15990784)
-+#define FLASH_iSCSI_PRIMARY_IMAGE_START_g3 (2097152)
-+#define FLASH_iSCSI_BACKUP_IMAGE_START_g3 (4194304)
-+#define FLASH_FCoE_PRIMARY_IMAGE_START_g3 (6291456)
-+#define FLASH_FCoE_BACKUP_IMAGE_START_g3 (8388608)
-+#define FLASH_iSCSI_BIOS_START_g3 (12582912)
-+#define FLASH_PXE_BIOS_START_g3 (13107200)
-+#define FLASH_FCoE_BIOS_START_g3 (13631488)
-+#define FLASH_REDBOOT_START_g3 (262144)
-+#define FLASH_PHY_FW_START_g3 (1310720)
-+
-+/************* Rx Packet Type Encoding **************/
-+#define BE_UNICAST_PACKET 0
-+#define BE_MULTICAST_PACKET 1
-+#define BE_BROADCAST_PACKET 2
-+#define BE_RSVD_PACKET 3
-+
- /*
- * BE descriptors: host memory data structures whose formats
- * are hardwired in BE silicon.
- */
- /* Event Queue Descriptor */
--#define EQ_ENTRY_VALID_MASK 0x1 /* bit 0 */
--#define EQ_ENTRY_RES_ID_MASK 0xFFFF /* bits 16 - 31 */
--#define EQ_ENTRY_RES_ID_SHIFT 16
-+#define EQ_ENTRY_VALID_MASK 0x1 /* bit 0 */
-+#define EQ_ENTRY_RES_ID_MASK 0xFFFF /* bits 16 - 31 */
-+#define EQ_ENTRY_RES_ID_SHIFT 16
-+
-+#define BE_MAC_PROMISCUOUS 62 /* Promiscuous mode */
-+
- struct be_eq_entry {
- u32 evt;
- };
-@@ -126,7 +275,7 @@ struct amap_eth_hdr_wrb {
- u8 event;
- u8 crc;
- u8 forward;
-- u8 ipsec;
-+ u8 lso6;
- u8 mgmt;
- u8 ipcs;
- u8 udpcs;
-@@ -151,7 +300,7 @@ struct be_eth_hdr_wrb {
- * offset/shift/mask of each field */
- struct amap_eth_tx_compl {
- u8 wrb_index[16]; /* dword 0 */
-- u8 ct[2]; /* dword 0 */
-+ u8 ct[2]; /* dword 0 */
- u8 port[2]; /* dword 0 */
- u8 rsvd0[8]; /* dword 0 */
- u8 status[4]; /* dword 0 */
-@@ -179,10 +328,10 @@ struct be_eth_rx_d {
-
- /* RX Compl Queue Descriptor */
-
--/* Pseudo amap definition for eth_rx_compl in which each bit of the
-- * actual structure is defined as a byte: used to calculate
-+/* Pseudo amap definition for BE2 and BE3 legacy mode eth_rx_compl in which
-+ * each bit of the actual structure is defined as a byte: used to calculate
- * offset/shift/mask of each field */
--struct amap_eth_rx_compl {
-+struct amap_eth_rx_compl_v0 {
- u8 vlan_tag[16]; /* dword 0 */
- u8 pktsize[14]; /* dword 0 */
- u8 port; /* dword 0 */
-@@ -213,39 +362,91 @@ struct amap_eth_rx_compl {
- u8 rsshash[32]; /* dword 3 */
- } __packed;
-
-+/* Pseudo amap definition for BE3 native mode eth_rx_compl in which
-+ * each bit of the actual structure is defined as a byte: used to calculate
-+ * offset/shift/mask of each field */
-+struct amap_eth_rx_compl_v1 {
-+ u8 vlan_tag[16]; /* dword 0 */
-+ u8 pktsize[14]; /* dword 0 */
-+ u8 vtp; /* dword 0 */
-+ u8 ip_opt; /* dword 0 */
-+ u8 err; /* dword 1 */
-+ u8 rsshp; /* dword 1 */
-+ u8 ipf; /* dword 1 */
-+ u8 tcpf; /* dword 1 */
-+ u8 udpf; /* dword 1 */
-+ u8 ipcksm; /* dword 1 */
-+ u8 l4_cksm; /* dword 1 */
-+ u8 ip_version; /* dword 1 */
-+ u8 macdst[7]; /* dword 1 */
-+ u8 rsvd0; /* dword 1 */
-+ u8 fragndx[10]; /* dword 1 */
-+ u8 ct[2]; /* dword 1 */
-+ u8 sw; /* dword 1 */
-+ u8 numfrags[3]; /* dword 1 */
-+ u8 rss_flush; /* dword 2 */
-+ u8 cast_enc[2]; /* dword 2 */
-+ u8 vtm; /* dword 2 */
-+ u8 rss_bank; /* dword 2 */
-+ u8 port[2]; /* dword 2 */
-+ u8 vntagp; /* dword 2 */
-+ u8 header_len[8]; /* dword 2 */
-+ u8 header_split[2]; /* dword 2 */
-+ u8 rsvd1[13]; /* dword 2 */
-+ u8 valid; /* dword 2 */
-+ u8 rsshash[32]; /* dword 3 */
-+} __packed;
-+
- struct be_eth_rx_compl {
- u32 dw[4];
- };
-
--/* Flashrom related descriptors */
--#define IMAGE_TYPE_FIRMWARE 160
--#define IMAGE_TYPE_BOOTCODE 224
--#define IMAGE_TYPE_OPTIONROM 32
-+struct mgmt_hba_attribs {
-+ u8 flashrom_version_string[32];
-+ u8 manufacturer_name[32];
-+ u32 supported_modes;
-+ u32 rsvd0[3];
-+ u8 ncsi_ver_string[12];
-+ u32 default_extended_timeout;
-+ u8 controller_model_number[32];
-+ u8 controller_description[64];
-+ u8 controller_serial_number[32];
-+ u8 ip_version_string[32];
-+ u8 firmware_version_string[32];
-+ u8 bios_version_string[32];
-+ u8 redboot_version_string[32];
-+ u8 driver_version_string[32];
-+ u8 fw_on_flash_version_string[32];
-+ u32 functionalities_supported;
-+ u16 max_cdblength;
-+ u8 asic_revision;
-+ u8 generational_guid[16];
-+ u8 hba_port_count;
-+ u16 default_link_down_timeout;
-+ u8 iscsi_ver_min_max;
-+ u8 multifunction_device;
-+ u8 cache_valid;
-+ u8 hba_status;
-+ u8 max_domains_supported;
-+ u8 phy_port;
-+ u32 firmware_post_status;
-+ u32 hba_mtu[8];
-+ u32 rsvd1[4];
-+};
-
--#define NUM_FLASHDIR_ENTRIES 32
--
--#define FLASHROM_TYPE_ISCSI_ACTIVE 0
--#define FLASHROM_TYPE_BIOS 2
--#define FLASHROM_TYPE_PXE_BIOS 3
--#define FLASHROM_TYPE_FCOE_BIOS 8
--#define FLASHROM_TYPE_ISCSI_BACKUP 9
--#define FLASHROM_TYPE_FCOE_FW_ACTIVE 10
--#define FLASHROM_TYPE_FCOE_FW_BACKUP 11
--
--#define FLASHROM_OPER_FLASH 1
--#define FLASHROM_OPER_SAVE 2
--
--#define FLASH_IMAGE_MAX_SIZE (1310720) /* Max firmware image size */
--#define FLASH_BIOS_IMAGE_MAX_SIZE (262144) /* Max OPTION ROM image sz */
--
--/* Offsets for components on Flash. */
--#define FLASH_iSCSI_PRIMARY_IMAGE_START (1048576)
--#define FLASH_iSCSI_BACKUP_IMAGE_START (2359296)
--#define FLASH_FCoE_PRIMARY_IMAGE_START (3670016)
--#define FLASH_FCoE_BACKUP_IMAGE_START (4980736)
--#define FLASH_iSCSI_BIOS_START (7340032)
--#define FLASH_PXE_BIOS_START (7864320)
--#define FLASH_FCoE_BIOS_START (524288)
-+struct mgmt_controller_attrib {
-+ struct mgmt_hba_attribs hba_attribs;
-+ u16 pci_vendor_id;
-+ u16 pci_device_id;
-+ u16 pci_sub_vendor_id;
-+ u16 pci_sub_system_id;
-+ u8 pci_bus_number;
-+ u8 pci_device_number;
-+ u8 pci_function_number;
-+ u8 interface_type;
-+ u64 unique_identifier;
-+ u32 rsvd0[5];
-+};
-
- struct controller_id {
- u32 vendor;
-@@ -254,7 +455,20 @@ struct controller_id {
- u32 subdevice;
- };
-
--struct flash_file_hdr {
-+struct flash_comp {
-+ unsigned long offset;
-+ int optype;
-+ int size;
-+};
-+
-+struct image_hdr {
-+ u32 imageid;
-+ u32 imageoffset;
-+ u32 imagelength;
-+ u32 image_checksum;
-+ u8 image_version[32];
-+};
-+struct flash_file_hdr_g2 {
- u8 sign[32];
- u32 cksum;
- u32 antidote;
-@@ -266,6 +480,17 @@ struct flash_file_hdr {
- u8 build[24];
- };
-
-+struct flash_file_hdr_g3 {
-+ u8 sign[52];
-+ u8 ufi_version[4];
-+ u32 file_len;
-+ u32 cksum;
-+ u32 antidote;
-+ u32 num_imgs;
-+ u8 build[24];
-+ u8 rsvd[32];
-+};
-+
- struct flash_section_hdr {
- u32 format_rev;
- u32 cksum;
-@@ -299,3 +524,19 @@ struct flash_section_info {
- struct flash_section_hdr fsec_hdr;
- struct flash_section_entry fsec_entry[32];
- };
-+
-+struct flash_ncsi_image_hdr {
-+ u32 magic;
-+ u8 hdr_len;
-+ u8 type;
-+ u16 hdr_ver;
-+ u8 rsvd0[2];
-+ u16 load_offset;
-+ u32 len;
-+ u32 flash_offset;
-+ u8 ver[16];
-+ u8 name[24];
-+ u32 img_cksum;
-+ u8 rsvd1[4];
-+ u32 hdr_cksum;
-+};
-diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
-index 000e377..709dc47 100644
---- a/drivers/net/benet/be_main.c
-+++ b/drivers/net/benet/be_main.c
-@@ -1,18 +1,18 @@
- /*
-- * Copyright (C) 2005 - 2009 ServerEngines
-+ * Copyright (C) 2005 - 2011 Emulex
- * All rights reserved.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License version 2
-- * as published by the Free Software Foundation. The full GNU General
-+ * as published by the Free Software Foundation. The full GNU General
- * Public License is included in this distribution in the file called COPYING.
- *
- * Contact Information:
-- * linux-drivers@serverengines.com
-+ * linux-drivers@emulex.com
- *
-- * ServerEngines
-- * 209 N. Fair Oaks Ave
-- * Sunnyvale, CA 94085
-+ * Emulex
-+ * 3333 Susan Street
-+ * Costa Mesa, CA 92626
- */
-
- #include "be.h"
-@@ -22,23 +22,119 @@
- MODULE_VERSION(DRV_VER);
- MODULE_DEVICE_TABLE(pci, be_dev_ids);
- MODULE_DESCRIPTION(DRV_DESC " " DRV_VER);
--MODULE_AUTHOR("ServerEngines Corporation");
-+MODULE_AUTHOR("Emulex Corporation");
- MODULE_LICENSE("GPL");
-+MODULE_INFO(supported, "external");
-
--static unsigned int rx_frag_size = 2048;
--module_param(rx_frag_size, uint, S_IRUGO);
--MODULE_PARM_DESC(rx_frag_size, "Size of a fragment that holds rcvd data.");
-+static ushort rx_frag_size = 2048;
-+static unsigned int num_vfs;
-+static unsigned int msix = 1;
-+module_param(rx_frag_size, ushort, S_IRUGO);
-+module_param(num_vfs, uint, S_IRUGO);
-+module_param(msix, uint, S_IRUGO);
-+MODULE_PARM_DESC(rx_frag_size, "Size of receive fragment buffer"
-+ " - 2048 (default), 4096 or 8192");
-+MODULE_PARM_DESC(num_vfs, "Number of PCI VFs to initialize");
-+MODULE_PARM_DESC(msix, "Enable and disable the MSI"
-+ "x (By default MSIx is enabled)");
-+static unsigned int gro = 1;
-+module_param(gro, uint, S_IRUGO);
-+MODULE_PARM_DESC(gro, "Enable or Disable GRO. Enabled by default");
-+
-+static unsigned int multi_rxq = true;
-+module_param(multi_rxq, uint, S_IRUGO);
-+MODULE_PARM_DESC(multi_rxq, "Multi Rx Queue support. Enabled by default");
-
- static DEFINE_PCI_DEVICE_TABLE(be_dev_ids) = {
- { PCI_DEVICE(BE_VENDOR_ID, BE_DEVICE_ID1) },
- { PCI_DEVICE(BE_VENDOR_ID, BE_DEVICE_ID2) },
- { PCI_DEVICE(BE_VENDOR_ID, OC_DEVICE_ID1) },
- { PCI_DEVICE(BE_VENDOR_ID, OC_DEVICE_ID2) },
-- { PCI_DEVICE(BE_VENDOR_ID, OC_DEVICE_ID3) },
-+ /*
-+ * Lancer is not part of Palau 4.0
-+ * { PCI_DEVICE(EMULEX_VENDOR_ID, OC_DEVICE_ID3)},
-+ */
- { 0 }
- };
- MODULE_DEVICE_TABLE(pci, be_dev_ids);
-
-+/* UE Status Low CSR */
-+static char *ue_status_low_desc[] = {
-+ "CEV",
-+ "CTX",
-+ "DBUF",
-+ "ERX",
-+ "Host",
-+ "MPU",
-+ "NDMA",
-+ "PTC ",
-+ "RDMA ",
-+ "RXF ",
-+ "RXIPS ",
-+ "RXULP0 ",
-+ "RXULP1 ",
-+ "RXULP2 ",
-+ "TIM ",
-+ "TPOST ",
-+ "TPRE ",
-+ "TXIPS ",
-+ "TXULP0 ",
-+ "TXULP1 ",
-+ "UC ",
-+ "WDMA ",
-+ "TXULP2 ",
-+ "HOST1 ",
-+ "P0_OB_LINK ",
-+ "P1_OB_LINK ",
-+ "HOST_GPIO ",
-+ "MBOX ",
-+ "AXGMAC0",
-+ "AXGMAC1",
-+ "JTAG",
-+ "MPU_INTPEND"
-+};
-+
-+/* UE Status High CSR */
-+static char *ue_status_hi_desc[] = {
-+ "LPCMEMHOST",
-+ "MGMT_MAC",
-+ "PCS0ONLINE",
-+ "MPU_IRAM",
-+ "PCS1ONLINE",
-+ "PCTL0",
-+ "PCTL1",
-+ "PMEM",
-+ "RR",
-+ "TXPB",
-+ "RXPP",
-+ "XAUI",
-+ "TXP",
-+ "ARM",
-+ "IPC",
-+ "HOST2",
-+ "HOST3",
-+ "HOST4",
-+ "HOST5",
-+ "HOST6",
-+ "HOST7",
-+ "HOST8",
-+ "HOST9",
-+ "NETC",
-+ "Unknown",
-+ "Unknown",
-+ "Unknown",
-+ "Unknown",
-+ "Unknown",
-+ "Unknown",
-+ "Unknown",
-+ "Unknown"
-+};
-+
-+static inline bool be_multi_rxq(struct be_adapter *adapter)
-+{
-+ return (adapter->num_rx_qs > 1);
-+}
-+
- static void be_queue_free(struct be_adapter *adapter, struct be_queue_info *q)
- {
- struct be_dma_mem *mem = &q->dma_mem;
-@@ -69,6 +165,9 @@ static void be_intr_set(struct be_adapter *adapter, bool enable)
- u32 reg = ioread32(addr);
- u32 enabled = reg & MEMBAR_CTRL_INT_CTRL_HOSTINTR_MASK;
-
-+ if (adapter->eeh_err)
-+ return;
-+
- if (!enabled && enable)
- reg |= MEMBAR_CTRL_INT_CTRL_HOSTINTR_MASK;
- else if (enabled && !enable)
-@@ -84,6 +183,8 @@ static void be_rxq_notify(struct be_adapter *adapter, u16 qid, u16 posted)
- u32 val = 0;
- val |= qid & DB_RQ_RING_ID_MASK;
- val |= posted << DB_RQ_NUM_POSTED_SHIFT;
-+
-+ wmb();
- iowrite32(val, adapter->db + DB_RQ_OFFSET);
- }
-
-@@ -92,6 +193,8 @@ static void be_txq_notify(struct be_adapter *adapter, u16 qid, u16 posted)
- u32 val = 0;
- val |= qid & DB_TXULP_RING_ID_MASK;
- val |= (posted & DB_TXULP_NUM_POSTED_MASK) << DB_TXULP_NUM_POSTED_SHIFT;
-+
-+ wmb();
- iowrite32(val, adapter->db + DB_TXULP1_OFFSET);
- }
-
-@@ -100,6 +203,12 @@ static void be_eq_notify(struct be_adapter *adapter, u16 qid,
- {
- u32 val = 0;
- val |= qid & DB_EQ_RING_ID_MASK;
-+ val |= ((qid & DB_EQ_RING_ID_EXT_MASK) <<
-+ DB_EQ_RING_ID_EXT_MASK_SHIFT);
-+
-+ if (adapter->eeh_err)
-+ return;
-+
- if (arm)
- val |= 1 << DB_EQ_REARM_SHIFT;
- if (clear_int)
-@@ -113,6 +222,12 @@ void be_cq_notify(struct be_adapter *adapter, u16 qid, bool arm, u16 num_popped)
- {
- u32 val = 0;
- val |= qid & DB_CQ_RING_ID_MASK;
-+ val |= ((qid & DB_CQ_RING_ID_EXT_MASK) <<
-+ DB_CQ_RING_ID_EXT_MASK_SHIFT);
-+
-+ if (adapter->eeh_err)
-+ return;
-+
- if (arm)
- val |= 1 << DB_CQ_REARM_SHIFT;
- val |= num_popped << DB_CQ_NUM_POPPED_SHIFT;
-@@ -124,96 +239,250 @@ static int be_mac_addr_set(struct net_device *netdev, void *p)
- struct be_adapter *adapter = netdev_priv(netdev);
- struct sockaddr *addr = p;
- int status = 0;
-+ u8 current_mac[ETH_ALEN];
-+ u32 pmac_id = adapter->pmac_id;
-
-- status = be_cmd_pmac_del(adapter, adapter->if_handle, adapter->pmac_id);
-+ if (!is_valid_ether_addr(addr->sa_data))
-+ return -EADDRNOTAVAIL;
-+
-+ status = be_cmd_mac_addr_query(adapter, current_mac,
-+ MAC_ADDRESS_TYPE_NETWORK, false,
-+ adapter->if_handle);
- if (status)
-- return status;
-+ goto err;
-+
-+ if (!memcmp(addr->sa_data, current_mac, ETH_ALEN))
-+ goto done;
-
- status = be_cmd_pmac_add(adapter, (u8 *)addr->sa_data,
-- adapter->if_handle, &adapter->pmac_id);
-- if (!status)
-+ adapter->if_handle, &adapter->pmac_id, 0);
-+
-+ if (!status) {
-+ status = be_cmd_pmac_del(adapter, adapter->if_handle,
-+ pmac_id, 0);
- memcpy(netdev->dev_addr, addr->sa_data, netdev->addr_len);
-+ goto done;
-+ }
-
-- return status;
-+err:
-+ if (status == MCC_STATUS_UNAUTHORIZED_REQUEST)
-+ return -EPERM;
-+ else
-+ dev_err(&adapter->pdev->dev, "MAC %pM set Failed\n",
-+ addr->sa_data);
-+done:
-+ return status;
-+}
-+
-+static void populate_be2_stats(struct be_adapter *adapter)
-+{
-+
-+ struct be_drv_stats *drvs = &adapter->drv_stats;
-+ struct be_pmem_stats *pmem_sts = be_pmem_stats_from_cmd(adapter);
-+ struct be_port_rxf_stats_v0 *port_stats =
-+ be_port_rxf_stats_from_cmd(adapter);
-+ struct be_rxf_stats_v0 *rxf_stats =
-+ be_rxf_stats_from_cmd(adapter);
-+
-+ drvs->rx_pause_frames = port_stats->rx_pause_frames;
-+ drvs->rx_crc_errors = port_stats->rx_crc_errors;
-+ drvs->rx_control_frames = port_stats->rx_control_frames;
-+ drvs->rx_in_range_errors = port_stats->rx_in_range_errors;
-+ drvs->rx_frame_too_long = port_stats->rx_frame_too_long;
-+ drvs->rx_dropped_runt = port_stats->rx_dropped_runt;
-+ drvs->rx_ip_checksum_errs = port_stats->rx_ip_checksum_errs;
-+ drvs->rx_tcp_checksum_errs = port_stats->rx_tcp_checksum_errs;
-+ drvs->rx_udp_checksum_errs = port_stats->rx_udp_checksum_errs;
-+ drvs->rxpp_fifo_overflow_drop = port_stats->rx_fifo_overflow;
-+ drvs->rx_dropped_tcp_length = port_stats->rx_dropped_tcp_length;
-+ drvs->rx_dropped_too_small = port_stats->rx_dropped_too_small;
-+ drvs->rx_dropped_too_short = port_stats->rx_dropped_too_short;
-+ drvs->rx_out_range_errors = port_stats->rx_out_range_errors;
-+ drvs->rx_input_fifo_overflow_drop =
-+ port_stats->rx_input_fifo_overflow;
-+ drvs->rx_dropped_header_too_small =
-+ port_stats->rx_dropped_header_too_small;
-+ drvs->rx_address_match_errors =
-+ port_stats->rx_address_match_errors;
-+ drvs->rx_alignment_symbol_errors =
-+ port_stats->rx_alignment_symbol_errors;
-+
-+ drvs->tx_pauseframes = port_stats->tx_pauseframes;
-+ drvs->tx_controlframes = port_stats->tx_controlframes;
-+
-+ if (adapter->port_num)
-+ drvs->jabber_events =
-+ rxf_stats->port1_jabber_events;
-+ else
-+ drvs->jabber_events =
-+ rxf_stats->port0_jabber_events;
-+ drvs->rx_drops_no_pbuf = rxf_stats->rx_drops_no_pbuf;
-+ drvs->rx_drops_no_txpb = rxf_stats->rx_drops_no_txpb;
-+ drvs->rx_drops_no_erx_descr = rxf_stats->rx_drops_no_erx_descr;
-+ drvs->rx_drops_invalid_ring = rxf_stats->rx_drops_invalid_ring;
-+ drvs->forwarded_packets = rxf_stats->forwarded_packets;
-+ drvs->rx_drops_mtu = rxf_stats->rx_drops_mtu;
-+ drvs->rx_drops_no_tpre_descr =
-+ rxf_stats->rx_drops_no_tpre_descr;
-+ drvs->rx_drops_too_many_frags =
-+ rxf_stats->rx_drops_too_many_frags;
-+ adapter->drv_stats.eth_red_drops = pmem_sts->eth_red_drops;
-+}
-+
-+static void populate_be3_stats(struct be_adapter *adapter)
-+{
-+ struct be_drv_stats *drvs = &adapter->drv_stats;
-+ struct be_pmem_stats *pmem_sts = be_pmem_stats_from_cmd(adapter);
-+
-+ struct be_rxf_stats_v1 *rxf_stats =
-+ be_rxf_stats_from_cmd(adapter);
-+ struct be_port_rxf_stats_v1 *port_stats =
-+ be_port_rxf_stats_from_cmd(adapter);
-+
-+ drvs->pmem_fifo_overflow_drop = port_stats->pmem_fifo_overflow_drop;
-+ drvs->rx_priority_pause_frames = port_stats->rx_priority_pause_frames;
-+ drvs->rx_pause_frames = port_stats->rx_pause_frames;
-+ drvs->rx_crc_errors = port_stats->rx_crc_errors;
-+ drvs->rx_control_frames = port_stats->rx_control_frames;
-+ drvs->rx_in_range_errors = port_stats->rx_in_range_errors;
-+ drvs->rx_frame_too_long = port_stats->rx_frame_too_long;
-+ drvs->rx_dropped_runt = port_stats->rx_dropped_runt;
-+ drvs->rx_ip_checksum_errs = port_stats->rx_ip_checksum_errs;
-+ drvs->rx_tcp_checksum_errs = port_stats->rx_tcp_checksum_errs;
-+ drvs->rx_udp_checksum_errs = port_stats->rx_udp_checksum_errs;
-+ drvs->rx_dropped_tcp_length = port_stats->rx_dropped_tcp_length;
-+ drvs->rx_dropped_too_small = port_stats->rx_dropped_too_small;
-+ drvs->rx_dropped_too_short = port_stats->rx_dropped_too_short;
-+ drvs->rx_out_range_errors = port_stats->rx_out_range_errors;
-+ drvs->rx_dropped_header_too_small =
-+ port_stats->rx_dropped_header_too_small;
-+ drvs->rx_input_fifo_overflow_drop =
-+ port_stats->rx_input_fifo_overflow_drop;
-+ drvs->rx_address_match_errors =
-+ port_stats->rx_address_match_errors;
-+ drvs->rx_alignment_symbol_errors =
-+ port_stats->rx_alignment_symbol_errors;
-+ drvs->rxpp_fifo_overflow_drop =
-+ port_stats->rxpp_fifo_overflow_drop;
-+ drvs->tx_pauseframes = port_stats->tx_pauseframes;
-+ drvs->tx_controlframes = port_stats->tx_controlframes;
-+ drvs->jabber_events = port_stats->jabber_events;
-+ drvs->rx_drops_no_pbuf = rxf_stats->rx_drops_no_pbuf;
-+ drvs->rx_drops_no_txpb = rxf_stats->rx_drops_no_txpb;
-+ drvs->rx_drops_no_erx_descr = rxf_stats->rx_drops_no_erx_descr;
-+ drvs->rx_drops_invalid_ring = rxf_stats->rx_drops_invalid_ring;
-+ drvs->forwarded_packets = rxf_stats->forwarded_packets;
-+ drvs->rx_drops_mtu = rxf_stats->rx_drops_mtu;
-+ drvs->rx_drops_no_tpre_descr =
-+ rxf_stats->rx_drops_no_tpre_descr;
-+ drvs->rx_drops_too_many_frags =
-+ rxf_stats->rx_drops_too_many_frags;
-+ adapter->drv_stats.eth_red_drops = pmem_sts->eth_red_drops;
-+}
-+
-+
-+static void accumulate_16bit_val(u32 *acc, u16 val)
-+{
-+#define lo(x) (x & 0xFFFF)
-+#define hi(x) (x & 0xFFFF0000)
-+ bool wrapped = val < lo(*acc);
-+ u32 newacc = hi(*acc) + val;
-+
-+ if (wrapped)
-+ newacc += 65536;
-+ ACCESS_ONCE_RW(*acc) = newacc;
-+}
-+
-+void be_parse_stats(struct be_adapter *adapter)
-+{
-+ struct be_erx_stats_v1 *erx = be_erx_stats_from_cmd(adapter);
-+ struct be_rx_obj *rxo;
-+ int i;
-+
-+ if (adapter->generation == BE_GEN3) {
-+ populate_be3_stats(adapter);
-+ } else {
-+ populate_be2_stats(adapter);
-+ }
-+
-+ /* as erx_v1 is longer than v0, ok to use v1 defn for v0 access */
-+ for_all_rx_queues(adapter, rxo, i) {
-+ /* below erx HW counter can actually wrap around after
-+ * 65535. Driver accumulates a 32-bit value
-+ */
-+ accumulate_16bit_val(&rx_stats(rxo)->rx_drops_no_frags,
-+ (u16)erx->rx_drops_no_fragments[rxo->q.id]);
-+ }
- }
-
- void netdev_stats_update(struct be_adapter *adapter)
- {
-- struct be_hw_stats *hw_stats = hw_stats_from_cmd(adapter->stats.cmd.va);
-- struct be_rxf_stats *rxf_stats = &hw_stats->rxf;
-- struct be_port_rxf_stats *port_stats =
-- &rxf_stats->port[adapter->port_num];
-- struct net_device_stats *dev_stats = &adapter->stats.net_stats;
-- struct be_erx_stats *erx_stats = &hw_stats->erx;
-+ struct be_drv_stats *drvs = &adapter->drv_stats;
-+ struct net_device_stats *dev_stats = &adapter->net_stats;
-+ struct be_rx_obj *rxo;
-+ struct be_tx_obj *txo;
-+ unsigned long pkts = 0, bytes = 0, mcast = 0, drops = 0;
-+ int i;
-
-- dev_stats->rx_packets = drvr_stats(adapter)->be_rx_pkts;
-- dev_stats->tx_packets = drvr_stats(adapter)->be_tx_pkts;
-- dev_stats->rx_bytes = drvr_stats(adapter)->be_rx_bytes;
-- dev_stats->tx_bytes = drvr_stats(adapter)->be_tx_bytes;
-+ for_all_rx_queues(adapter, rxo, i) {
-+ pkts += rx_stats(rxo)->rx_pkts;
-+ bytes += rx_stats(rxo)->rx_bytes;
-+ mcast += rx_stats(rxo)->rx_mcast_pkts;
-+ drops += rx_stats(rxo)->rx_drops_no_frags;
-+ }
-+ dev_stats->rx_packets = pkts;
-+ dev_stats->rx_bytes = bytes;
-+ dev_stats->multicast = mcast;
-+ dev_stats->rx_dropped = drops;
-+
-+ pkts = bytes = 0;
-+ for_all_tx_queues(adapter, txo, i) {
-+ pkts += tx_stats(txo)->be_tx_pkts;
-+ bytes += tx_stats(txo)->be_tx_bytes;
-+ }
-+ dev_stats->tx_packets = pkts;
-+ dev_stats->tx_bytes = bytes;
-
- /* bad pkts received */
-- dev_stats->rx_errors = port_stats->rx_crc_errors +
-- port_stats->rx_alignment_symbol_errors +
-- port_stats->rx_in_range_errors +
-- port_stats->rx_out_range_errors +
-- port_stats->rx_frame_too_long +
-- port_stats->rx_dropped_too_small +
-- port_stats->rx_dropped_too_short +
-- port_stats->rx_dropped_header_too_small +
-- port_stats->rx_dropped_tcp_length +
-- port_stats->rx_dropped_runt +
-- port_stats->rx_tcp_checksum_errs +
-- port_stats->rx_ip_checksum_errs +
-- port_stats->rx_udp_checksum_errs;
--
-- /* no space in linux buffers: best possible approximation */
-- dev_stats->rx_dropped = erx_stats->rx_drops_no_fragments[0];
-+ dev_stats->rx_errors = drvs->rx_crc_errors +
-+ drvs->rx_alignment_symbol_errors +
-+ drvs->rx_in_range_errors +
-+ drvs->rx_out_range_errors +
-+ drvs->rx_frame_too_long +
-+ drvs->rx_dropped_too_small +
-+ drvs->rx_dropped_too_short +
-+ drvs->rx_dropped_header_too_small +
-+ drvs->rx_dropped_tcp_length +
-+ drvs->rx_dropped_runt +
-+ drvs->rx_tcp_checksum_errs +
-+ drvs->rx_ip_checksum_errs +
-+ drvs->rx_udp_checksum_errs;
-
- /* detailed rx errors */
-- dev_stats->rx_length_errors = port_stats->rx_in_range_errors +
-- port_stats->rx_out_range_errors +
-- port_stats->rx_frame_too_long;
-+ dev_stats->rx_length_errors = drvs->rx_in_range_errors +
-+ drvs->rx_out_range_errors +
-+ drvs->rx_frame_too_long;
-
-- /* receive ring buffer overflow */
-- dev_stats->rx_over_errors = 0;
--
-- dev_stats->rx_crc_errors = port_stats->rx_crc_errors;
-+ dev_stats->rx_crc_errors = drvs->rx_crc_errors;
-
- /* frame alignment errors */
-- dev_stats->rx_frame_errors = port_stats->rx_alignment_symbol_errors;
-+ dev_stats->rx_frame_errors = drvs->rx_alignment_symbol_errors;
-
- /* receiver fifo overrun */
- /* drops_no_pbuf is no per i/f, it's per BE card */
-- dev_stats->rx_fifo_errors = port_stats->rx_fifo_overflow +
-- port_stats->rx_input_fifo_overflow +
-- rxf_stats->rx_drops_no_pbuf;
-- /* receiver missed packetd */
-- dev_stats->rx_missed_errors = 0;
--
-- /* packet transmit problems */
-- dev_stats->tx_errors = 0;
--
-- /* no space available in linux */
-- dev_stats->tx_dropped = 0;
--
-- dev_stats->multicast = port_stats->rx_multicast_frames;
-- dev_stats->collisions = 0;
--
-- /* detailed tx_errors */
-- dev_stats->tx_aborted_errors = 0;
-- dev_stats->tx_carrier_errors = 0;
-- dev_stats->tx_fifo_errors = 0;
-- dev_stats->tx_heartbeat_errors = 0;
-- dev_stats->tx_window_errors = 0;
-+ dev_stats->rx_fifo_errors = drvs->rxpp_fifo_overflow_drop +
-+ drvs->rx_input_fifo_overflow_drop +
-+ drvs->rx_drops_no_pbuf;
- }
-
--void be_link_status_update(struct be_adapter *adapter, bool link_up)
-+void be_link_status_update(struct be_adapter *adapter, int link_status)
- {
- struct net_device *netdev = adapter->netdev;
-
- /* If link came up or went down */
-- if (adapter->link_up != link_up) {
-- if (link_up) {
-+ if (adapter->link_status != link_status) {
-+ adapter->link_speed = -1;
-+ if (link_status == LINK_UP) {
- netif_start_queue(netdev);
- netif_carrier_on(netdev);
- printk(KERN_INFO "%s: Link up\n", netdev->name);
-@@ -222,15 +491,15 @@ void be_link_status_update(struct be_adapter *adapter, bool link_up)
- netif_carrier_off(netdev);
- printk(KERN_INFO "%s: Link down\n", netdev->name);
- }
-- adapter->link_up = link_up;
-+ adapter->link_status = link_status;
- }
- }
-
- /* Update the EQ delay n BE based on the RX frags consumed / sec */
--static void be_rx_eqd_update(struct be_adapter *adapter)
-+static void be_rx_eqd_update(struct be_adapter *adapter, struct be_rx_obj *rxo)
- {
-- struct be_eq_obj *rx_eq = &adapter->rx_eq;
-- struct be_drvr_stats *stats = &adapter->stats.drvr_stats;
-+ struct be_eq_obj *rx_eq = &rxo->rx_eq;
-+ struct be_rx_stats *stats = &rxo->stats;
- ulong now = jiffies;
- u32 eqd;
-
-@@ -247,19 +516,17 @@ static void be_rx_eqd_update(struct be_adapter *adapter)
- if ((now - stats->rx_fps_jiffies) < HZ)
- return;
-
-- stats->be_rx_fps = (stats->be_rx_frags - stats->be_prev_rx_frags) /
-+ stats->rx_fps = (stats->rx_frags - stats->prev_rx_frags) /
- ((now - stats->rx_fps_jiffies) / HZ);
-
- stats->rx_fps_jiffies = now;
-- stats->be_prev_rx_frags = stats->be_rx_frags;
-- eqd = stats->be_rx_fps / 110000;
-+ stats->prev_rx_frags = stats->rx_frags;
-+ eqd = stats->rx_fps / 110000;
- eqd = eqd << 3;
- if (eqd > rx_eq->max_eqd)
- eqd = rx_eq->max_eqd;
- if (eqd < rx_eq->min_eqd)
- eqd = rx_eq->min_eqd;
-- if (eqd < 10)
-- eqd = 0;
- if (eqd != rx_eq->cur_eqd)
- be_cmd_modify_eqd(adapter, rx_eq->q.id, eqd);
-
-@@ -270,7 +537,7 @@ static struct net_device_stats *be_get_stats(struct net_device *dev)
- {
- struct be_adapter *adapter = netdev_priv(dev);
-
-- return &adapter->stats.net_stats;
-+ return &adapter->net_stats;
- }
-
- static u32 be_calc_rate(u64 bytes, unsigned long ticks)
-@@ -284,9 +551,9 @@ static u32 be_calc_rate(u64 bytes, unsigned long ticks)
- return rate;
- }
-
--static void be_tx_rate_update(struct be_adapter *adapter)
-+static void be_tx_rate_update(struct be_tx_obj *txo)
- {
-- struct be_drvr_stats *stats = drvr_stats(adapter);
-+ struct be_tx_stats *stats = tx_stats(txo);
- ulong now = jiffies;
-
- /* Wrapped around? */
-@@ -305,10 +572,11 @@ static void be_tx_rate_update(struct be_adapter *adapter)
- }
- }
-
--static void be_tx_stats_update(struct be_adapter *adapter,
-+static void be_tx_stats_update(struct be_tx_obj *txo,
- u32 wrb_cnt, u32 copied, u32 gso_segs, bool stopped)
- {
-- struct be_drvr_stats *stats = drvr_stats(adapter);
-+ struct be_tx_stats *stats = tx_stats(txo);
-+
- stats->be_tx_reqs++;
- stats->be_tx_wrbs += wrb_cnt;
- stats->be_tx_bytes += copied;
-@@ -318,7 +586,8 @@ static void be_tx_stats_update(struct be_adapter *adapter,
- }
-
- /* Determine number of WRB entries needed to xmit data in an skb */
--static u32 wrb_cnt_for_skb(struct sk_buff *skb, bool *dummy)
-+static u32 wrb_cnt_for_skb(struct be_adapter *adapter, struct sk_buff *skb,
-+ bool *dummy)
- {
- int cnt = (skb->len > skb->data_len);
-
-@@ -326,12 +595,13 @@ static u32 wrb_cnt_for_skb(struct sk_buff *skb, bool *dummy)
-
- /* to account for hdr wrb */
- cnt++;
-- if (cnt & 1) {
-+ if (lancer_chip(adapter) || !(cnt & 1)) {
-+ *dummy = false;
-+ } else {
- /* add a dummy to make it an even num */
- cnt++;
- *dummy = true;
-- } else
-- *dummy = false;
-+ }
- BUG_ON(cnt > BE_MAX_TX_FRAG_COUNT);
- return cnt;
- }
-@@ -343,17 +613,31 @@ static inline void wrb_fill(struct be_eth_wrb *wrb, u64 addr, int len)
- wrb->frag_len = len & ETH_WRB_FRAG_LEN_MASK;
- }
-
--static void wrb_fill_hdr(struct be_eth_hdr_wrb *hdr, struct sk_buff *skb,
-- bool vlan, u32 wrb_cnt, u32 len)
-+static void wrb_fill_hdr(struct be_adapter *adapter, struct be_eth_hdr_wrb *hdr,
-+ struct sk_buff *skb, u32 wrb_cnt, u32 len)
- {
-+ u16 vlan_tag = 0;
-+
- memset(hdr, 0, sizeof(*hdr));
-
- AMAP_SET_BITS(struct amap_eth_hdr_wrb, crc, hdr, 1);
-
-- if (skb_shinfo(skb)->gso_segs > 1 && skb_shinfo(skb)->gso_size) {
-+ if (skb_is_gso(skb)) {
- AMAP_SET_BITS(struct amap_eth_hdr_wrb, lso, hdr, 1);
- AMAP_SET_BITS(struct amap_eth_hdr_wrb, lso_mss,
- hdr, skb_shinfo(skb)->gso_size);
-+ if (skb_is_gso_v6(skb) && !lancer_chip(adapter))
-+ AMAP_SET_BITS(struct amap_eth_hdr_wrb, lso6, hdr, 1);
-+
-+ if (lancer_A0_chip(adapter)) {
-+ AMAP_SET_BITS(struct amap_eth_hdr_wrb, ipcs, hdr, 1);
-+ if (is_tcp_pkt(skb))
-+ AMAP_SET_BITS(struct amap_eth_hdr_wrb,
-+ tcpcs, hdr, 1);
-+ else if (is_udp_pkt(skb))
-+ AMAP_SET_BITS(struct amap_eth_hdr_wrb,
-+ udpcs, hdr, 1);
-+ }
- } else if (skb->ip_summed == CHECKSUM_PARTIAL) {
- if (is_tcp_pkt(skb))
- AMAP_SET_BITS(struct amap_eth_hdr_wrb, tcpcs, hdr, 1);
-@@ -361,10 +645,10 @@ static void wrb_fill_hdr(struct be_eth_hdr_wrb *hdr, struct sk_buff *skb,
- AMAP_SET_BITS(struct amap_eth_hdr_wrb, udpcs, hdr, 1);
- }
-
-- if (vlan && vlan_tx_tag_present(skb)) {
-+ if (adapter->vlan_grp && vlan_tx_tag_present(skb)) {
- AMAP_SET_BITS(struct amap_eth_hdr_wrb, vlan, hdr, 1);
-- AMAP_SET_BITS(struct amap_eth_hdr_wrb, vlan_tag,
-- hdr, vlan_tx_tag_get(skb));
-+ vlan_tag = be_get_tx_vlan_tag(adapter, skb);
-+ AMAP_SET_BITS(struct amap_eth_hdr_wrb, vlan_tag, hdr, vlan_tag);
- }
-
- AMAP_SET_BITS(struct amap_eth_hdr_wrb, event, hdr, 1);
-@@ -374,14 +658,13 @@ static void wrb_fill_hdr(struct be_eth_hdr_wrb *hdr, struct sk_buff *skb,
- }
-
-
--static int make_tx_wrbs(struct be_adapter *adapter,
-+static int make_tx_wrbs(struct be_adapter *adapter, struct be_queue_info *txq,
- struct sk_buff *skb, u32 wrb_cnt, bool dummy_wrb)
- {
-- u64 busaddr;
-- u32 i, copied = 0;
-+ dma_addr_t busaddr;
-+ int i, copied = 0;
- struct pci_dev *pdev = adapter->pdev;
- struct sk_buff *first_skb = skb;
-- struct be_queue_info *txq = &adapter->tx_obj.q;
- struct be_eth_wrb *wrb;
- struct be_eth_hdr_wrb *hdr;
-
-@@ -389,15 +672,11 @@ static int make_tx_wrbs(struct be_adapter *adapter,
- atomic_add(wrb_cnt, &txq->used);
- queue_head_inc(txq);
-
-- if (skb_dma_map(&pdev->dev, skb, DMA_TO_DEVICE)) {
-- dev_err(&pdev->dev, "TX DMA mapping failed\n");
-- return 0;
-- }
--
- if (skb->len > skb->data_len) {
-- int len = skb->len - skb->data_len;
-+ int len = skb_headlen(skb);
-+ busaddr = pci_map_single(pdev, skb->data, len,
-+ PCI_DMA_TODEVICE);
- wrb = queue_head_node(txq);
-- busaddr = skb_shinfo(skb)->dma_head;
- wrb_fill(wrb, busaddr, len);
- be_dws_cpu_to_le(wrb, sizeof(*wrb));
- queue_head_inc(txq);
-@@ -407,8 +686,9 @@ static int make_tx_wrbs(struct be_adapter *adapter,
- for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
- struct skb_frag_struct *frag =
- &skb_shinfo(skb)->frags[i];
--
-- busaddr = skb_shinfo(skb)->dma_maps[i];
-+ busaddr = pci_map_page(pdev, frag->page,
-+ frag->page_offset,
-+ frag->size, PCI_DMA_TODEVICE);
- wrb = queue_head_node(txq);
- wrb_fill(wrb, busaddr, frag->size);
- be_dws_cpu_to_le(wrb, sizeof(*wrb));
-@@ -423,8 +703,7 @@ static int make_tx_wrbs(struct be_adapter *adapter,
- queue_head_inc(txq);
- }
-
-- wrb_fill_hdr(hdr, first_skb, adapter->vlan_grp ? true : false,
-- wrb_cnt, copied);
-+ wrb_fill_hdr(adapter, hdr, first_skb, wrb_cnt, copied);
- be_dws_cpu_to_le(hdr, sizeof(*hdr));
-
- return copied;
-@@ -434,19 +713,72 @@ static netdev_tx_t be_xmit(struct sk_buff *skb,
- struct net_device *netdev)
- {
- struct be_adapter *adapter = netdev_priv(netdev);
-- struct be_tx_obj *tx_obj = &adapter->tx_obj;
-- struct be_queue_info *txq = &tx_obj->q;
-+ struct be_tx_obj *txo = &adapter->tx_obj[skb_get_queue_mapping(skb)];
-+ struct be_queue_info *txq = &txo->q;
- u32 wrb_cnt = 0, copied = 0;
- u32 start = txq->head;
- bool dummy_wrb, stopped = false;
-
-- wrb_cnt = wrb_cnt_for_skb(skb, &dummy_wrb);
-+ if (unlikely((skb_shinfo(skb)->gso_segs > 1) &&
-+ skb_shinfo(skb)->gso_size && is_ipv6_ext_hdr(skb))) {
-+ tx_stats(txo)->be_ipv6_ext_hdr_tx_drop++;
-+ goto tx_drop;
-+ }
-
-- copied = make_tx_wrbs(adapter, skb, wrb_cnt, dummy_wrb);
-+ /* If the skb is a large pkt forwarded to this interface
-+ * after being LRO'd on another interface, drop the pkt.
-+ * HW cannot handle such pkts. LRO must be disabled when
-+ * using the server as a router.
-+ */
-+ if (!skb_is_gso(skb)) {
-+ int eth_hdr_len = ntohs(skb->protocol) == ETH_P_8021Q ?
-+ VLAN_ETH_HLEN : ETH_HLEN;
-+
-+ if ((skb->len - eth_hdr_len) > adapter->netdev->mtu)
-+ goto tx_drop;
-+ }
-+
-+ /* The ASIC is calculating checksum for Vlan tagged pkts
-+ * though CSO is disabled.
-+ * To work around this, insert the Vlan tag in the driver
-+ * and donot set the vlan bit, cso bit in the Tx WRB.
-+ */
-+ if (unlikely(vlan_tx_tag_present(skb) &&
-+ ((skb->ip_summed != CHECKSUM_PARTIAL) || (skb->len <= 60)))) {
-+ /* Bug 28694: Don't embed the host VLAN tag in SKB
-+ * when UMC mode enabled on that interface
-+ */
-+ if (!(adapter->function_mode & UMC_ENABLED)) {
-+ skb = skb_share_check(skb, GFP_ATOMIC);
-+ if (unlikely(!skb))
-+ goto tx_drop;
-+
-+ skb = be_vlan_put_tag(skb,
-+ be_get_tx_vlan_tag(adapter, skb));
-+ if (unlikely(!skb))
-+ goto tx_drop;
-+
-+ be_reset_skb_tx_vlan(skb);
-+ }
-+ }
-+
-+ /* Bug 12422: the stack can send us skbs with length more than 65535
-+ * BE cannot handle such requests. Hack the extra data out and drop it.
-+ */
-+ if (skb->len > 65535) {
-+ int err = __pskb_trim(skb, 65535);
-+ BUG_ON(err);
-+ }
-+
-+ wrb_cnt = wrb_cnt_for_skb(adapter, skb, &dummy_wrb);
-+
-+ copied = make_tx_wrbs(adapter, txq, skb, wrb_cnt, dummy_wrb);
- if (copied) {
-+ int gso_segs = skb_shinfo(skb)->gso_segs;
-+
- /* record the sent skb in the sent_skb table */
-- BUG_ON(tx_obj->sent_skb_list[start]);
-- tx_obj->sent_skb_list[start] = skb;
-+ BUG_ON(txo->sent_skb_list[start]);
-+ txo->sent_skb_list[start] = skb;
-
- /* Ensure txq has space for the next skb; Else stop the queue
- * *BEFORE* ringing the tx doorbell, so that we serialze the
-@@ -454,16 +786,20 @@ static netdev_tx_t be_xmit(struct sk_buff *skb,
- */
- if ((BE_MAX_TX_FRAG_COUNT + atomic_read(&txq->used)) >=
- txq->len) {
-- netif_stop_queue(netdev);
-+ netif_stop_subqueue(netdev, skb_get_queue_mapping(skb));
- stopped = true;
- }
-
- be_txq_notify(adapter, txq->id, wrb_cnt);
-
-- be_tx_stats_update(adapter, wrb_cnt, copied,
-- skb_shinfo(skb)->gso_segs, stopped);
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 32)
-+ netdev->trans_start = jiffies;
-+#endif
-+
-+ be_tx_stats_update(txo, wrb_cnt, copied, gso_segs, stopped);
- } else {
- txq->head = start;
-+tx_drop:
- dev_kfree_skb_any(skb);
- }
- return NETDEV_TX_OK;
-@@ -473,10 +809,12 @@ static int be_change_mtu(struct net_device *netdev, int new_mtu)
- {
- struct be_adapter *adapter = netdev_priv(netdev);
- if (new_mtu < BE_MIN_MTU ||
-- new_mtu > BE_MAX_JUMBO_FRAME_SIZE) {
-+ new_mtu > (BE_MAX_JUMBO_FRAME_SIZE -
-+ (ETH_HLEN + ETH_FCS_LEN))) {
- dev_info(&adapter->pdev->dev,
- "MTU must be between %d and %d bytes\n",
-- BE_MIN_MTU, BE_MAX_JUMBO_FRAME_SIZE);
-+ BE_MIN_MTU,
-+ (BE_MAX_JUMBO_FRAME_SIZE - (ETH_HLEN + ETH_FCS_LEN)));
- return -EINVAL;
- }
- dev_info(&adapter->pdev->dev, "MTU changed from %d to %d bytes\n",
-@@ -486,17 +824,19 @@ static int be_change_mtu(struct net_device *netdev, int new_mtu)
- }
-
- /*
-- * if there are BE_NUM_VLANS_SUPPORTED or lesser number of VLANS configured,
-- * program them in BE. If more than BE_NUM_VLANS_SUPPORTED are configured,
-- * set the BE in promiscuous VLAN mode.
-+ * A max of 64 (BE_NUM_VLANS_SUPPORTED) vlans can be configured in BE.
-+ * If the user configures more, place BE in vlan promiscuous mode.
- */
--static int be_vid_config(struct be_adapter *adapter)
-+static int be_vid_config(struct be_adapter *adapter, bool vf, u32 vf_num)
- {
- u16 vtag[BE_NUM_VLANS_SUPPORTED];
- u16 ntags = 0, i;
-- int status;
-+ int status = 0;
-
-- if (adapter->num_vlans <= BE_NUM_VLANS_SUPPORTED) {
-+ /* No need to change the VLAN state if the I/F is in promiscous */
-+ if (adapter->promiscuous)
-+ return 0;
-+ if (adapter->vlans_added <= adapter->max_vlans) {
- /* Construct VLAN Table to give to HW */
- for (i = 0; i < VLAN_GROUP_ARRAY_LEN; i++) {
- if (adapter->vlan_tag[i]) {
-@@ -504,47 +844,46 @@ static int be_vid_config(struct be_adapter *adapter)
- ntags++;
- }
- }
-- status = be_cmd_vlan_config(adapter, adapter->if_handle,
-- vtag, ntags, 1, 0);
-+ /* Send command only if there is something to be programmed */
-+ if (ntags)
-+ status = be_cmd_vlan_config(adapter, adapter->if_handle,
-+ vtag, ntags, 1, 0);
- } else {
- status = be_cmd_vlan_config(adapter, adapter->if_handle,
-- NULL, 0, 1, 1);
-+ NULL, 0, 1, 1);
- }
-+
- return status;
- }
-
- static void be_vlan_register(struct net_device *netdev, struct vlan_group *grp)
- {
- struct be_adapter *adapter = netdev_priv(netdev);
-- struct be_eq_obj *rx_eq = &adapter->rx_eq;
-- struct be_eq_obj *tx_eq = &adapter->tx_eq;
-
-- be_eq_notify(adapter, rx_eq->q.id, false, false, 0);
-- be_eq_notify(adapter, tx_eq->q.id, false, false, 0);
- adapter->vlan_grp = grp;
-- be_eq_notify(adapter, rx_eq->q.id, true, false, 0);
-- be_eq_notify(adapter, tx_eq->q.id, true, false, 0);
- }
-
- static void be_vlan_add_vid(struct net_device *netdev, u16 vid)
- {
- struct be_adapter *adapter = netdev_priv(netdev);
-
-- adapter->num_vlans++;
-+ adapter->vlans_added++;
-+
- adapter->vlan_tag[vid] = 1;
--
-- be_vid_config(adapter);
-+ if (adapter->vlans_added <= (adapter->max_vlans + 1))
-+ be_vid_config(adapter, false, 0);
- }
-
- static void be_vlan_rem_vid(struct net_device *netdev, u16 vid)
- {
- struct be_adapter *adapter = netdev_priv(netdev);
-
-- adapter->num_vlans--;
-- adapter->vlan_tag[vid] = 0;
--
-+ adapter->vlans_added--;
- vlan_group_set_device(adapter->vlan_grp, vid, NULL);
-- be_vid_config(adapter);
-+
-+ adapter->vlan_tag[vid] = 0;
-+ if (adapter->vlans_added <= adapter->max_vlans)
-+ be_vid_config(adapter, false, 0);
- }
-
- static void be_set_multicast_list(struct net_device *netdev)
-@@ -552,7 +891,7 @@ static void be_set_multicast_list(struct net_device *netdev)
- struct be_adapter *adapter = netdev_priv(netdev);
-
- if (netdev->flags & IFF_PROMISC) {
-- be_cmd_promiscuous_config(adapter, adapter->port_num, 1);
-+ be_cmd_rx_filter(adapter, IFF_PROMISC, ON);
- adapter->promiscuous = true;
- goto done;
- }
-@@ -560,81 +899,244 @@ static void be_set_multicast_list(struct net_device *netdev)
- /* BE was previously in promiscous mode; disable it */
- if (adapter->promiscuous) {
- adapter->promiscuous = false;
-- be_cmd_promiscuous_config(adapter, adapter->port_num, 0);
-+ be_cmd_rx_filter(adapter, IFF_PROMISC, OFF);
-+
-+ if (adapter->vlans_added)
-+ be_vid_config(adapter, false, 0);
- }
-
-- if (netdev->flags & IFF_ALLMULTI) {
-- be_cmd_multicast_set(adapter, adapter->if_handle, NULL, 0);
-+ /* Enable multicast promisc if num configured exceeds what we support */
-+ if (netdev->flags & IFF_ALLMULTI ||
-+ netdev_mc_count(netdev) > BE_MAX_MC) {
-+ be_cmd_rx_filter(adapter, IFF_ALLMULTI, ON);
- goto done;
- }
-
-- be_cmd_multicast_set(adapter, adapter->if_handle, netdev->mc_list,
-- netdev->mc_count);
-+ be_cmd_rx_filter(adapter, IFF_MULTICAST, ON);
- done:
- return;
- }
-
--static void be_rx_rate_update(struct be_adapter *adapter)
-+#ifdef HAVE_SRIOV_CONFIG
-+static int be_set_vf_mac(struct net_device *netdev, int vf, u8 *mac)
- {
-- struct be_drvr_stats *stats = drvr_stats(adapter);
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+ int status;
-+
-+ if (adapter->num_vfs == 0)
-+ return -EPERM;
-+
-+ if (!is_valid_ether_addr(mac) || (vf >= adapter->num_vfs))
-+ return -EINVAL;
-+
-+ if (adapter->vf_cfg[vf].vf_pmac_id != BE_INVALID_PMAC_ID)
-+ status = be_cmd_pmac_del(adapter,
-+ adapter->vf_cfg[vf].vf_if_handle,
-+ adapter->vf_cfg[vf].vf_pmac_id, vf + 1);
-+
-+ status = be_cmd_pmac_add(adapter, mac,
-+ adapter->vf_cfg[vf].vf_if_handle,
-+ &adapter->vf_cfg[vf].vf_pmac_id, vf + 1);
-+
-+ if (status)
-+ dev_err(&adapter->pdev->dev, "MAC %pM set on VF %d Failed\n",
-+ mac, vf);
-+ else
-+ memcpy(adapter->vf_cfg[vf].vf_mac_addr, mac, ETH_ALEN);
-+
-+ return status;
-+}
-+
-+static int be_get_vf_config(struct net_device *netdev, int vf,
-+ struct ifla_vf_info *vi)
-+{
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+
-+ if (adapter->num_vfs == 0)
-+ return -EPERM;
-+
-+ if (vf >= adapter->num_vfs)
-+ return -EINVAL;
-+
-+ vi->vf = vf;
-+ vi->tx_rate = adapter->vf_cfg[vf].vf_tx_rate;
-+ vi->vlan = adapter->vf_cfg[vf].vf_vlan_tag & VLAN_VID_MASK;
-+ vi->qos = adapter->vf_cfg[vf].vf_vlan_tag >> VLAN_PRIO_SHIFT;
-+ memcpy(&vi->mac, adapter->vf_cfg[vf].vf_mac_addr, ETH_ALEN);
-+
-+ return 0;
-+}
-+
-+/*
-+ * Entry point to configure vlan behavior for a VF.
-+ * 1. By default a VF is vlan Challenged.
-+ * 2. It may or may not have Transparent Tagging enabled.
-+ * 3. Vlan privilege for a VF can be toggled using special VID 4095.
-+ * 4. When removing the Vlan privilege for a VF there is no need set default vid
-+ * 5. Transparent Tagging configured for a VF resets its Vlan privilege
-+ * 6. To disable the current Transparet Tagging for a VF:
-+ * 6a. run the last iproute command with vlan set to 0.
-+ * 6b. programing the default vid will disable Transparent Tagging in ARM/ASIC
-+ */
-+static int be_set_vf_vlan(struct net_device *netdev,
-+ int vf, u16 vlan, u8 qos)
-+{
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+ int status = 0;
-+ u32 en = 0;
-+
-+ if (adapter->num_vfs == 0)
-+ return -EPERM;
-+
-+ if ((vf >= adapter->num_vfs) || (vlan > 4095) || (qos > 7))
-+ return -EINVAL;
-+
-+ status = be_cmd_get_fn_privileges(adapter, &en, vf + 1);
-+ if (status)
-+ goto sts;
-+
-+ if (vlan == 4095) {
-+ if (en & BE_PRIV_FILTMGMT) {
-+ /* Knock off filtering privileges */
-+ en &= ~BE_PRIV_FILTMGMT;
-+ } else {
-+ en |= BE_PRIV_FILTMGMT;
-+ /* Transparent Tagging is currently enabled, Reset it */
-+ if (adapter->vf_cfg[vf].vf_vlan_tag) {
-+ adapter->vf_cfg[vf].vf_vlan_tag = 0;
-+ vlan = adapter->vf_cfg[vf].vf_def_vid;
-+ be_cmd_set_hsw_config(adapter, vlan, vf + 1,
-+ adapter->vf_cfg[vf].vf_if_handle);
-+ }
-+ }
-+
-+ adapter->vf_cfg[vf].vf_vlan_tag = 0;
-+ status = be_cmd_set_fn_privileges(adapter, en, NULL, vf + 1);
-+
-+ goto sts;
-+ }
-+
-+ if (vlan || qos) {
-+ if (en & BE_PRIV_FILTMGMT) {
-+ /* Check privilege and reset it to default */
-+ en &= ~BE_PRIV_FILTMGMT;
-+ be_cmd_set_fn_privileges(adapter, en, NULL, vf + 1);
-+ }
-+
-+ vlan |= qos << VLAN_PRIO_SHIFT;
-+ if (adapter->vf_cfg[vf].vf_vlan_tag != vlan) {
-+ /* If this is new value, program it. Else skip. */
-+ adapter->vf_cfg[vf].vf_vlan_tag = vlan;
-+
-+ status = be_cmd_set_hsw_config(adapter, vlan,
-+ vf + 1, adapter->vf_cfg[vf].vf_if_handle);
-+ }
-+
-+ } else {
-+ /* Reset Transparent Vlan Tagging. */
-+ adapter->vf_cfg[vf].vf_vlan_tag = 0;
-+ vlan = adapter->vf_cfg[vf].vf_def_vid;
-+ status = be_cmd_set_hsw_config(adapter, vlan, vf + 1,
-+ adapter->vf_cfg[vf].vf_if_handle);
-+ }
-+
-+sts:
-+ if (status)
-+ dev_info(&adapter->pdev->dev,
-+ "VLAN %d config on VF %d failed\n", vlan, vf);
-+ return status;
-+}
-+
-+static int be_set_vf_tx_rate(struct net_device *netdev,
-+ int vf, int rate)
-+{
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+ int status = 0;
-+
-+ if (adapter->num_vfs == 0)
-+ return -EPERM;
-+
-+ if ((vf >= adapter->num_vfs) || (rate < 0))
-+ return -EINVAL;
-+
-+ if (rate > 10000)
-+ rate = 10000;
-+
-+ adapter->vf_cfg[vf].vf_tx_rate = rate;
-+ status = be_cmd_set_qos(adapter, rate / 10, vf + 1);
-+
-+ if (status)
-+ dev_info(&adapter->pdev->dev,
-+ "tx rate %d on VF %d failed\n", rate, vf);
-+ return status;
-+}
-+#endif /* HAVE_SRIOV_CONFIG */
-+
-+static void be_rx_rate_update(struct be_rx_obj *rxo)
-+{
-+ struct be_rx_stats *stats = &rxo->stats;
- ulong now = jiffies;
-
- /* Wrapped around */
-- if (time_before(now, stats->be_rx_jiffies)) {
-- stats->be_rx_jiffies = now;
-+ if (time_before(now, stats->rx_jiffies)) {
-+ stats->rx_jiffies = now;
- return;
- }
-
- /* Update the rate once in two seconds */
-- if ((now - stats->be_rx_jiffies) < 2 * HZ)
-+ if ((now - stats->rx_jiffies) < 2 * HZ)
- return;
-
-- stats->be_rx_rate = be_calc_rate(stats->be_rx_bytes
-- - stats->be_rx_bytes_prev,
-- now - stats->be_rx_jiffies);
-- stats->be_rx_jiffies = now;
-- stats->be_rx_bytes_prev = stats->be_rx_bytes;
-+ stats->rx_rate = be_calc_rate(stats->rx_bytes - stats->rx_bytes_prev,
-+ now - stats->rx_jiffies);
-+ stats->rx_jiffies = now;
-+ stats->rx_bytes_prev = stats->rx_bytes;
- }
-
--static void be_rx_stats_update(struct be_adapter *adapter,
-- u32 pktsize, u16 numfrags)
-+static void be_rx_stats_update(struct be_rx_obj *rxo,
-+ struct be_rx_compl_info *rxcp)
- {
-- struct be_drvr_stats *stats = drvr_stats(adapter);
-+ struct be_rx_stats *stats = &rxo->stats;
-
-- stats->be_rx_compl++;
-- stats->be_rx_frags += numfrags;
-- stats->be_rx_bytes += pktsize;
-- stats->be_rx_pkts++;
-+ stats->rx_compl++;
-+ stats->rx_frags += rxcp->num_rcvd;
-+ stats->rx_bytes += rxcp->pkt_size;
-+ stats->rx_pkts++;
-+ if (rxcp->pkt_type == BE_MULTICAST_PACKET)
-+ stats->rx_mcast_pkts++;
-+ if (rxcp->err)
-+ stats->rxcp_err++;
- }
-
--static inline bool do_pkt_csum(struct be_eth_rx_compl *rxcp, bool cso)
-+static inline bool csum_passed(struct be_rx_compl_info *rxcp)
- {
-- u8 l4_cksm, ip_version, ipcksm, tcpf = 0, udpf = 0, ipv6_chk;
--
-- l4_cksm = AMAP_GET_BITS(struct amap_eth_rx_compl, l4_cksm, rxcp);
-- ipcksm = AMAP_GET_BITS(struct amap_eth_rx_compl, ipcksm, rxcp);
-- ip_version = AMAP_GET_BITS(struct amap_eth_rx_compl, ip_version, rxcp);
-- if (ip_version) {
-- tcpf = AMAP_GET_BITS(struct amap_eth_rx_compl, tcpf, rxcp);
-- udpf = AMAP_GET_BITS(struct amap_eth_rx_compl, udpf, rxcp);
-- }
-- ipv6_chk = (ip_version && (tcpf || udpf));
--
-- return ((l4_cksm && ipv6_chk && ipcksm) && cso) ? false : true;
-+ /* L4 checksum is not reliable for non TCP/UDP packets.
-+ * Also ignore ipcksm for ipv6 pkts */
-+ return (rxcp->tcpf || rxcp->udpf) && rxcp->l4_csum &&
-+ (rxcp->ip_csum || rxcp->ipv6);
- }
-
- static struct be_rx_page_info *
--get_rx_page_info(struct be_adapter *adapter, u16 frag_idx)
-+get_rx_page_info(struct be_adapter *adapter, struct be_rx_obj *rxo,
-+ u16 frag_idx)
- {
- struct be_rx_page_info *rx_page_info;
-- struct be_queue_info *rxq = &adapter->rx_obj.q;
-+ struct be_queue_info *rxq = &rxo->q;
-
-- rx_page_info = &adapter->rx_obj.page_info_tbl[frag_idx];
-- BUG_ON(!rx_page_info->page);
-+ rx_page_info = &rxo->page_info_tbl[frag_idx];
-+ if (!rx_page_info->page) {
-+ printk(KERN_EMERG "curr_idx=%d prev_dix=%d rxq->head=%d\n",
-+ frag_idx, rxo->prev_frag_idx, rxq->head);
-+ BUG_ON(!rx_page_info->page);
-+ }
-
-- if (rx_page_info->last_page_user)
-+ if (rx_page_info->last_page_user) {
- pci_unmap_page(adapter->pdev, pci_unmap_addr(rx_page_info, bus),
- adapter->big_page_size, PCI_DMA_FROMDEVICE);
-+ rx_page_info->last_page_user = false;
-+ }
-+
-+ rxo->prev_frag_idx = frag_idx;
-
- atomic_dec(&rxq->used);
- return rx_page_info;
-@@ -642,20 +1144,26 @@ get_rx_page_info(struct be_adapter *adapter, u16 frag_idx)
-
- /* Throwaway the data in the Rx completion */
- static void be_rx_compl_discard(struct be_adapter *adapter,
-- struct be_eth_rx_compl *rxcp)
-+ struct be_rx_obj *rxo,
-+ struct be_rx_compl_info *rxcp)
- {
-- struct be_queue_info *rxq = &adapter->rx_obj.q;
-+ struct be_queue_info *rxq = &rxo->q;
- struct be_rx_page_info *page_info;
-- u16 rxq_idx, i, num_rcvd;
-+ u16 i;
-+ bool oob_error;
-+ u16 num_rcvd = rxcp->num_rcvd;
-
-- rxq_idx = AMAP_GET_BITS(struct amap_eth_rx_compl, fragndx, rxcp);
-- num_rcvd = AMAP_GET_BITS(struct amap_eth_rx_compl, numfrags, rxcp);
-+ oob_error = lancer_A0_chip(adapter) && rxcp->err;
-+
-+ /* In case of OOB error num_rcvd will be 1 more than actual */
-+ if (oob_error && num_rcvd)
-+ num_rcvd -= 1;
-
- for (i = 0; i < num_rcvd; i++) {
-- page_info = get_rx_page_info(adapter, rxq_idx);
-+ page_info = get_rx_page_info(adapter, rxo, rxcp->rxq_idx);
- put_page(page_info->page);
- memset(page_info, 0, sizeof(*page_info));
-- index_inc(&rxq_idx, rxq->len);
-+ index_inc(&rxcp->rxq_idx, rxq->len);
- }
- }
-
-@@ -663,29 +1171,24 @@ static void be_rx_compl_discard(struct be_adapter *adapter,
- * skb_fill_rx_data forms a complete skb for an ether frame
- * indicated by rxcp.
- */
--static void skb_fill_rx_data(struct be_adapter *adapter,
-- struct sk_buff *skb, struct be_eth_rx_compl *rxcp)
-+static void skb_fill_rx_data(struct be_adapter *adapter, struct be_rx_obj *rxo,
-+ struct sk_buff *skb, struct be_rx_compl_info *rxcp)
- {
-- struct be_queue_info *rxq = &adapter->rx_obj.q;
-+ struct be_queue_info *rxq = &rxo->q;
- struct be_rx_page_info *page_info;
-- u16 rxq_idx, i, num_rcvd, j;
-- u32 pktsize, hdr_len, curr_frag_len, size;
-+ u16 i, j;
-+ u16 hdr_len, curr_frag_len, remaining;
- u8 *start;
-
-- rxq_idx = AMAP_GET_BITS(struct amap_eth_rx_compl, fragndx, rxcp);
-- pktsize = AMAP_GET_BITS(struct amap_eth_rx_compl, pktsize, rxcp);
-- num_rcvd = AMAP_GET_BITS(struct amap_eth_rx_compl, numfrags, rxcp);
--
-- page_info = get_rx_page_info(adapter, rxq_idx);
--
-+ page_info = get_rx_page_info(adapter, rxo, rxcp->rxq_idx);
- start = page_address(page_info->page) + page_info->page_offset;
- prefetch(start);
-
- /* Copy data in the first descriptor of this completion */
-- curr_frag_len = min(pktsize, rx_frag_size);
-+ curr_frag_len = min(rxcp->pkt_size, rx_frag_size);
-
- /* Copy the header portion into skb_data */
-- hdr_len = min((u32)BE_HDR_LEN, curr_frag_len);
-+ hdr_len = min(BE_HDR_LEN, curr_frag_len);
- memcpy(skb->data, start, hdr_len);
- skb->len = curr_frag_len;
- if (curr_frag_len <= BE_HDR_LEN) { /* tiny packet */
-@@ -702,21 +1205,19 @@ static void skb_fill_rx_data(struct be_adapter *adapter,
- skb->data_len = curr_frag_len - hdr_len;
- skb->tail += hdr_len;
- }
-- memset(page_info, 0, sizeof(*page_info));
-+ page_info->page = NULL;
-
-- if (pktsize <= rx_frag_size) {
-- BUG_ON(num_rcvd != 1);
-- goto done;
-+ if (rxcp->pkt_size <= rx_frag_size) {
-+ BUG_ON(rxcp->num_rcvd != 1);
-+ return;
- }
-
- /* More frags present for this completion */
-- size = pktsize;
-- for (i = 1, j = 0; i < num_rcvd; i++) {
-- size -= curr_frag_len;
-- index_inc(&rxq_idx, rxq->len);
-- page_info = get_rx_page_info(adapter, rxq_idx);
--
-- curr_frag_len = min(size, rx_frag_size);
-+ index_inc(&rxcp->rxq_idx, rxq->len);
-+ remaining = rxcp->pkt_size - curr_frag_len;
-+ for (i = 1, j = 0; i < rxcp->num_rcvd; i++) {
-+ page_info = get_rx_page_info(adapter, rxo, rxcp->rxq_idx);
-+ curr_frag_len = min(remaining, rx_frag_size);
-
- /* Coalesce all frags from the same physical page in one slot */
- if (page_info->page_offset == 0) {
-@@ -735,99 +1236,122 @@ static void skb_fill_rx_data(struct be_adapter *adapter,
- skb->len += curr_frag_len;
- skb->data_len += curr_frag_len;
-
-- memset(page_info, 0, sizeof(*page_info));
-+ remaining -= curr_frag_len;
-+ index_inc(&rxcp->rxq_idx, rxq->len);
-+ page_info->page = NULL;
- }
- BUG_ON(j > MAX_SKB_FRAGS);
--
--done:
-- be_rx_stats_update(adapter, pktsize, num_rcvd);
-- return;
- }
-
--/* Process the RX completion indicated by rxcp when GRO is disabled */
-+/* Process the RX completion indicated by rxcp when LRO is disabled */
- static void be_rx_compl_process(struct be_adapter *adapter,
-- struct be_eth_rx_compl *rxcp)
-+ struct be_rx_obj *rxo,
-+ struct be_rx_compl_info *rxcp)
- {
- struct sk_buff *skb;
-- u32 vlanf, vid;
-- u8 vtm;
-
-- vlanf = AMAP_GET_BITS(struct amap_eth_rx_compl, vtp, rxcp);
-- vtm = AMAP_GET_BITS(struct amap_eth_rx_compl, vtm, rxcp);
--
-- /* vlanf could be wrongly set in some cards.
-- * ignore if vtm is not set */
-- if ((adapter->cap == 0x400) && !vtm)
-- vlanf = 0;
--
-- skb = netdev_alloc_skb(adapter->netdev, BE_HDR_LEN + NET_IP_ALIGN);
-- if (!skb) {
-+ skb = netdev_alloc_skb_ip_align(adapter->netdev, BE_HDR_LEN);
-+ if (unlikely(!skb)) {
- if (net_ratelimit())
- dev_warn(&adapter->pdev->dev, "skb alloc failed\n");
-- be_rx_compl_discard(adapter, rxcp);
-+ be_rx_compl_discard(adapter, rxo, rxcp);
- return;
- }
-
-- skb_reserve(skb, NET_IP_ALIGN);
-+ skb_fill_rx_data(adapter, rxo, skb, rxcp);
-
-- skb_fill_rx_data(adapter, skb, rxcp);
--
-- if (do_pkt_csum(rxcp, adapter->rx_csum))
-- skb->ip_summed = CHECKSUM_NONE;
-- else
-+ if (likely(adapter->rx_csum && csum_passed(rxcp)))
- skb->ip_summed = CHECKSUM_UNNECESSARY;
-+ else
-+ skb->ip_summed = CHECKSUM_NONE;
-
- skb->truesize = skb->len + sizeof(struct sk_buff);
-+ if (unlikely(rxcp->vlanf) &&
-+ unlikely(!vlan_configured(adapter))) {
-+ __vlan_put_tag(skb, rxcp->vlan_tag);
-+ }
- skb->protocol = eth_type_trans(skb, adapter->netdev);
- skb->dev = adapter->netdev;
-
-- if (vlanf) {
-- if (!adapter->vlan_grp || adapter->num_vlans == 0) {
-- kfree_skb(skb);
-- return;
-- }
-- vid = AMAP_GET_BITS(struct amap_eth_rx_compl, vlan_tag, rxcp);
-- vid = be16_to_cpu(vid);
-- vlan_hwaccel_receive_skb(skb, adapter->vlan_grp, vid);
-- } else {
-+ if (unlikely(rxcp->vlanf) &&
-+ vlan_configured(adapter))
-+ vlan_hwaccel_receive_skb(skb, adapter->vlan_grp,
-+ rxcp->vlan_tag);
-+ else
- netif_receive_skb(skb);
-+
-+ return;
-+}
-+
-+/* Process the RX completion indicated by rxcp when LRO is enabled */
-+static void be_rx_compl_process_lro(struct be_adapter *adapter,
-+ struct be_rx_obj *rxo,
-+ struct be_rx_compl_info *rxcp)
-+{
-+ struct be_rx_page_info *page_info;
-+ struct skb_frag_struct rx_frags[BE_MAX_FRAGS_PER_FRAME];
-+ struct be_queue_info *rxq = &rxo->q;
-+ u16 remaining, curr_frag_len;
-+ u16 i, j;
-+
-+ remaining = rxcp->pkt_size;
-+ for (i = 0, j = -1; i < rxcp->num_rcvd; i++) {
-+ page_info = get_rx_page_info(adapter, rxo, rxcp->rxq_idx);
-+
-+ curr_frag_len = min(remaining, rx_frag_size);
-+
-+ /* Coalesce all frags from the same physical page in one slot */
-+ if (i == 0 || page_info->page_offset == 0) {
-+ /* First frag or Fresh page */
-+ j++;
-+ rx_frags[j].page = page_info->page;
-+ rx_frags[j].page_offset = page_info->page_offset;
-+ rx_frags[j].size = 0;
-+ } else {
-+ put_page(page_info->page);
-+ }
-+ rx_frags[j].size += curr_frag_len;
-+
-+ remaining -= curr_frag_len;
-+ index_inc(&rxcp->rxq_idx, rxq->len);
-+ memset(page_info, 0, sizeof(*page_info));
-+ }
-+ BUG_ON(j > MAX_SKB_FRAGS);
-+
-+ if (likely(!rxcp->vlanf)) {
-+ lro_receive_frags(&rxo->lro_mgr, rx_frags, rxcp->pkt_size,
-+ rxcp->pkt_size, NULL, 0);
-+ } else {
-+ lro_vlan_hwaccel_receive_frags(&rxo->lro_mgr, rx_frags,
-+ rxcp->pkt_size, rxcp->pkt_size, adapter->vlan_grp,
-+ rxcp->vlan_tag, NULL, 0);
- }
-
- return;
- }
-
- /* Process the RX completion indicated by rxcp when GRO is enabled */
--static void be_rx_compl_process_gro(struct be_adapter *adapter,
-- struct be_eth_rx_compl *rxcp)
-+void be_rx_compl_process_gro(struct be_adapter *adapter,
-+ struct be_rx_obj *rxo,
-+ struct be_rx_compl_info *rxcp)
- {
-+#ifdef NETIF_F_GRO
- struct be_rx_page_info *page_info;
- struct sk_buff *skb = NULL;
-- struct be_queue_info *rxq = &adapter->rx_obj.q;
-- struct be_eq_obj *eq_obj = &adapter->rx_eq;
-- u32 num_rcvd, pkt_size, remaining, vlanf, curr_frag_len;
-- u16 i, rxq_idx = 0, vid, j;
-- u8 vtm;
--
-- num_rcvd = AMAP_GET_BITS(struct amap_eth_rx_compl, numfrags, rxcp);
-- pkt_size = AMAP_GET_BITS(struct amap_eth_rx_compl, pktsize, rxcp);
-- vlanf = AMAP_GET_BITS(struct amap_eth_rx_compl, vtp, rxcp);
-- rxq_idx = AMAP_GET_BITS(struct amap_eth_rx_compl, fragndx, rxcp);
-- vtm = AMAP_GET_BITS(struct amap_eth_rx_compl, vtm, rxcp);
--
-- /* vlanf could be wrongly set in some cards.
-- * ignore if vtm is not set */
-- if ((adapter->cap == 0x400) && !vtm)
-- vlanf = 0;
-+ struct be_queue_info *rxq = &rxo->q;
-+ struct be_eq_obj *eq_obj = &rxo->rx_eq;
-+ u16 remaining, curr_frag_len;
-+ u16 i, j;
-
- skb = napi_get_frags(&eq_obj->napi);
- if (!skb) {
-- be_rx_compl_discard(adapter, rxcp);
-+ be_rx_compl_discard(adapter, rxo, rxcp);
- return;
- }
-
-- remaining = pkt_size;
-- for (i = 0, j = -1; i < num_rcvd; i++) {
-- page_info = get_rx_page_info(adapter, rxq_idx);
-+ remaining = rxcp->pkt_size;
-+ for (i = 0, j = -1; i < rxcp->num_rcvd; i++) {
-+ page_info = get_rx_page_info(adapter, rxo, rxcp->rxq_idx);
-
- curr_frag_len = min(remaining, rx_frag_size);
-
-@@ -845,55 +1369,129 @@ static void be_rx_compl_process_gro(struct be_adapter *adapter,
- skb_shinfo(skb)->frags[j].size += curr_frag_len;
-
- remaining -= curr_frag_len;
-- index_inc(&rxq_idx, rxq->len);
-+ index_inc(&rxcp->rxq_idx, rxq->len);
- memset(page_info, 0, sizeof(*page_info));
- }
- BUG_ON(j > MAX_SKB_FRAGS);
-
- skb_shinfo(skb)->nr_frags = j + 1;
-- skb->len = pkt_size;
-- skb->data_len = pkt_size;
-- skb->truesize += pkt_size;
-+ skb->len = rxcp->pkt_size;
-+ skb->data_len = rxcp->pkt_size;
-+ skb->truesize += rxcp->pkt_size;
- skb->ip_summed = CHECKSUM_UNNECESSARY;
-
-- if (likely(!vlanf)) {
-+ if (likely(!rxcp->vlanf))
- napi_gro_frags(&eq_obj->napi);
-- } else {
-- vid = AMAP_GET_BITS(struct amap_eth_rx_compl, vlan_tag, rxcp);
-- vid = be16_to_cpu(vid);
-+ else
-+ vlan_gro_frags(&eq_obj->napi,
-+ adapter->vlan_grp, rxcp->vlan_tag);
-+#endif
-
-- if (!adapter->vlan_grp || adapter->num_vlans == 0)
-- return;
--
-- vlan_gro_frags(&eq_obj->napi, adapter->vlan_grp, vid);
-- }
--
-- be_rx_stats_update(adapter, pkt_size, num_rcvd);
- return;
- }
-
--static struct be_eth_rx_compl *be_rx_compl_get(struct be_adapter *adapter)
-+static void be_parse_rx_compl_v1(struct be_adapter *adapter,
-+ struct be_eth_rx_compl *compl,
-+ struct be_rx_compl_info *rxcp)
- {
-- struct be_eth_rx_compl *rxcp = queue_tail_node(&adapter->rx_obj.cq);
-+ rxcp->pkt_size =
-+ AMAP_GET_BITS(struct amap_eth_rx_compl_v1, pktsize, compl);
-+ rxcp->vlanf = AMAP_GET_BITS(struct amap_eth_rx_compl_v1, vtp, compl);
-+ rxcp->err = AMAP_GET_BITS(struct amap_eth_rx_compl_v1, err, compl);
-+ rxcp->tcpf = AMAP_GET_BITS(struct amap_eth_rx_compl_v1, tcpf, compl);
-+ rxcp->udpf = AMAP_GET_BITS(struct amap_eth_rx_compl_v1, udpf, compl);
-+ rxcp->ip_csum =
-+ AMAP_GET_BITS(struct amap_eth_rx_compl_v1, ipcksm, compl);
-+ rxcp->l4_csum =
-+ AMAP_GET_BITS(struct amap_eth_rx_compl_v1, l4_cksm, compl);
-+ rxcp->ipv6 =
-+ AMAP_GET_BITS(struct amap_eth_rx_compl_v1, ip_version, compl);
-+ rxcp->rxq_idx =
-+ AMAP_GET_BITS(struct amap_eth_rx_compl_v1, fragndx, compl);
-+ rxcp->num_rcvd =
-+ AMAP_GET_BITS(struct amap_eth_rx_compl_v1, numfrags, compl);
-+ rxcp->pkt_type =
-+ AMAP_GET_BITS(struct amap_eth_rx_compl_v1, cast_enc, compl);
-+ if (rxcp->vlanf) {
-+ rxcp->vtm = AMAP_GET_BITS(struct amap_eth_rx_compl_v1, vtm,
-+ compl);
-+ rxcp->vlan_tag = AMAP_GET_BITS(struct amap_eth_rx_compl_v1,
-+ vlan_tag, compl);
-+ }
-+ rxcp->port = AMAP_GET_BITS(struct amap_eth_rx_compl_v1, port, compl);
-+}
-
-- if (rxcp->dw[offsetof(struct amap_eth_rx_compl, valid) / 32] == 0)
-+static void be_parse_rx_compl_v0(struct be_adapter *adapter,
-+ struct be_eth_rx_compl *compl,
-+ struct be_rx_compl_info *rxcp)
-+{
-+ rxcp->pkt_size =
-+ AMAP_GET_BITS(struct amap_eth_rx_compl_v0, pktsize, compl);
-+ rxcp->vlanf = AMAP_GET_BITS(struct amap_eth_rx_compl_v0, vtp, compl);
-+ rxcp->err = AMAP_GET_BITS(struct amap_eth_rx_compl_v0, err, compl);
-+ rxcp->tcpf = AMAP_GET_BITS(struct amap_eth_rx_compl_v0, tcpf, compl);
-+ rxcp->udpf = AMAP_GET_BITS(struct amap_eth_rx_compl_v0, udpf, compl);
-+ rxcp->ip_csum =
-+ AMAP_GET_BITS(struct amap_eth_rx_compl_v0, ipcksm, compl);
-+ rxcp->l4_csum =
-+ AMAP_GET_BITS(struct amap_eth_rx_compl_v0, l4_cksm, compl);
-+ rxcp->ipv6 =
-+ AMAP_GET_BITS(struct amap_eth_rx_compl_v0, ip_version, compl);
-+ rxcp->rxq_idx =
-+ AMAP_GET_BITS(struct amap_eth_rx_compl_v0, fragndx, compl);
-+ rxcp->num_rcvd =
-+ AMAP_GET_BITS(struct amap_eth_rx_compl_v0, numfrags, compl);
-+ rxcp->pkt_type =
-+ AMAP_GET_BITS(struct amap_eth_rx_compl_v0, cast_enc, compl);
-+ if (rxcp->vlanf) {
-+ rxcp->vtm = AMAP_GET_BITS(struct amap_eth_rx_compl_v0, vtm,
-+ compl);
-+ rxcp->vlan_tag = AMAP_GET_BITS(struct amap_eth_rx_compl_v0,
-+ vlan_tag, compl);
-+ }
-+ rxcp->port = AMAP_GET_BITS(struct amap_eth_rx_compl_v0, port, compl);
-+}
-+
-+static struct be_rx_compl_info *be_rx_compl_get(struct be_rx_obj *rxo)
-+{
-+ struct be_eth_rx_compl *compl = queue_tail_node(&rxo->cq);
-+ struct be_rx_compl_info *rxcp = &rxo->rxcp;
-+ struct be_adapter *adapter = rxo->adapter;
-+
-+ /* For checking the valid bit it is Ok to use either definition as the
-+ * valid bit is at the same position in both v0 and v1 Rx compl */
-+ if (compl->dw[offsetof(struct amap_eth_rx_compl_v1, valid) / 32] == 0)
- return NULL;
-
-- be_dws_le_to_cpu(rxcp, sizeof(*rxcp));
-+ rmb();
-+ be_dws_le_to_cpu(compl, sizeof(*compl));
-
-- queue_tail_inc(&adapter->rx_obj.cq);
-+ if (adapter->be3_native)
-+ be_parse_rx_compl_v1(adapter, compl, rxcp);
-+ else
-+ be_parse_rx_compl_v0(adapter, compl, rxcp);
-+
-+ if (rxcp->vlanf) {
-+ /* vlanf could be wrongly set in some cards.
-+ * ignore if vtm is not set */
-+ if ((adapter->function_mode & FLEX10_MODE) && !rxcp->vtm)
-+ rxcp->vlanf = 0;
-+
-+ if (!lancer_chip(adapter))
-+ rxcp->vlan_tag = swab16(rxcp->vlan_tag);
-+
-+ if ((adapter->pvid == (rxcp->vlan_tag & VLAN_VID_MASK)) &&
-+ !adapter->vlan_tag[rxcp->vlan_tag])
-+ rxcp->vlanf = 0;
-+ }
-+
-+ /* As the compl has been parsed, reset it; we wont touch it again */
-+ compl->dw[offsetof(struct amap_eth_rx_compl_v1, valid) / 32] = 0;
-+
-+ queue_tail_inc(&rxo->cq);
- return rxcp;
- }
-
--/* To reset the valid bit, we need to reset the whole word as
-- * when walking the queue the valid entries are little-endian
-- * and invalid entries are host endian
-- */
--static inline void be_rx_compl_reset(struct be_eth_rx_compl *rxcp)
--{
-- rxcp->dw[offsetof(struct amap_eth_rx_compl, valid) / 32] = 0;
--}
--
- static inline struct page *be_alloc_pages(u32 size)
- {
- gfp_t alloc_flags = GFP_ATOMIC;
-@@ -907,11 +1505,12 @@ static inline struct page *be_alloc_pages(u32 size)
- * Allocate a page, split it to fragments of size rx_frag_size and post as
- * receive buffers to BE
- */
--static void be_post_rx_frags(struct be_adapter *adapter)
-+static void be_post_rx_frags(struct be_rx_obj *rxo)
- {
-- struct be_rx_page_info *page_info_tbl = adapter->rx_obj.page_info_tbl;
-- struct be_rx_page_info *page_info = NULL;
-- struct be_queue_info *rxq = &adapter->rx_obj.q;
-+ struct be_adapter *adapter = rxo->adapter;
-+ struct be_rx_page_info *page_info_tbl = rxo->page_info_tbl;
-+ struct be_rx_page_info *page_info = NULL, *prev_page_info = NULL;
-+ struct be_queue_info *rxq = &rxo->q;
- struct page *pagep = NULL;
- struct be_eth_rx_d *rxd;
- u64 page_dmaaddr = 0, frag_dmaaddr;
-@@ -922,7 +1521,7 @@ static void be_post_rx_frags(struct be_adapter *adapter)
- if (!pagep) {
- pagep = be_alloc_pages(adapter->big_page_size);
- if (unlikely(!pagep)) {
-- drvr_stats(adapter)->be_ethrx_post_fail++;
-+ rxo->stats.rx_post_fail++;
- break;
- }
- page_dmaaddr = pci_map_page(adapter->pdev, pagep, 0,
-@@ -941,7 +1540,6 @@ static void be_post_rx_frags(struct be_adapter *adapter)
- rxd = queue_head_node(rxq);
- rxd->fragpa_lo = cpu_to_le32(frag_dmaaddr & 0xFFFFFFFF);
- rxd->fragpa_hi = cpu_to_le32(upper_32_bits(frag_dmaaddr));
-- queue_head_inc(rxq);
-
- /* Any space left in the current big page for another frag? */
- if ((page_offset + rx_frag_size + rx_frag_size) >
-@@ -949,17 +1547,24 @@ static void be_post_rx_frags(struct be_adapter *adapter)
- pagep = NULL;
- page_info->last_page_user = true;
- }
-+
-+ prev_page_info = page_info;
-+ queue_head_inc(rxq);
- page_info = &page_info_tbl[rxq->head];
- }
- if (pagep)
-- page_info->last_page_user = true;
-+ prev_page_info->last_page_user = true;
-
-+ /* Ensure that posting buffers is the last thing done by this
-+ * routine to avoid racing between rx bottom-half and
-+ * be_worker (process) contexts.
-+ */
- if (posted) {
- atomic_add(posted, &rxq->used);
- be_rxq_notify(adapter, rxq->id, posted);
- } else if (atomic_read(&rxq->used) == 0) {
- /* Let be_worker replenish when memory is available */
-- adapter->rx_post_starved = true;
-+ rxo->rx_post_starved = true;
- }
-
- return;
-@@ -972,6 +1577,7 @@ static struct be_eth_tx_compl *be_tx_compl_get(struct be_queue_info *tx_cq)
- if (txcp->dw[offsetof(struct amap_eth_tx_compl, valid) / 32] == 0)
- return NULL;
-
-+ rmb();
- be_dws_le_to_cpu(txcp, sizeof(*txcp));
-
- txcp->dw[offsetof(struct amap_eth_tx_compl, valid) / 32] = 0;
-@@ -980,11 +1586,14 @@ static struct be_eth_tx_compl *be_tx_compl_get(struct be_queue_info *tx_cq)
- return txcp;
- }
-
--static void be_tx_compl_process(struct be_adapter *adapter, u16 last_index)
-+static u16 be_tx_compl_process(struct be_adapter *adapter,
-+ struct be_tx_obj *txo, u16 last_index)
- {
-- struct be_queue_info *txq = &adapter->tx_obj.q;
-- struct sk_buff **sent_skbs = adapter->tx_obj.sent_skb_list;
-+ struct be_queue_info *txq = &txo->q;
-+ struct be_eth_wrb *wrb;
-+ struct sk_buff **sent_skbs = txo->sent_skb_list;
- struct sk_buff *sent_skb;
-+ u64 busaddr;
- u16 cur_index, num_wrbs = 0;
-
- cur_index = txq->tail;
-@@ -992,15 +1601,31 @@ static void be_tx_compl_process(struct be_adapter *adapter, u16 last_index)
- BUG_ON(!sent_skb);
- sent_skbs[cur_index] = NULL;
-
-- do {
-+ wrb = queue_tail_node(txq);
-+ be_dws_le_to_cpu(wrb, sizeof(*wrb));
-+ busaddr = ((u64)wrb->frag_pa_hi << 32) | (u64)wrb->frag_pa_lo;
-+ if (busaddr != 0) {
-+ pci_unmap_single(adapter->pdev, busaddr,
-+ wrb->frag_len, PCI_DMA_TODEVICE);
-+ }
-+ num_wrbs++;
-+ queue_tail_inc(txq);
-+
-+ while (cur_index != last_index) {
- cur_index = txq->tail;
-+ wrb = queue_tail_node(txq);
-+ be_dws_le_to_cpu(wrb, sizeof(*wrb));
-+ busaddr = ((u64)wrb->frag_pa_hi << 32) | (u64)wrb->frag_pa_lo;
-+ if (busaddr != 0) {
-+ pci_unmap_page(adapter->pdev, busaddr,
-+ wrb->frag_len, PCI_DMA_TODEVICE);
-+ }
- num_wrbs++;
- queue_tail_inc(txq);
-- } while (cur_index != last_index);
-+ }
-
-- atomic_sub(num_wrbs, &txq->used);
-- skb_dma_unmap(&adapter->pdev->dev, sent_skb, DMA_TO_DEVICE);
- kfree_skb(sent_skb);
-+ return num_wrbs;
- }
-
- static inline struct be_eq_entry *event_get(struct be_eq_obj *eq_obj)
-@@ -1010,13 +1635,15 @@ static inline struct be_eq_entry *event_get(struct be_eq_obj *eq_obj)
- if (!eqe->evt)
- return NULL;
-
-+ rmb();
- eqe->evt = le32_to_cpu(eqe->evt);
- queue_tail_inc(&eq_obj->q);
- return eqe;
- }
-
- static int event_handle(struct be_adapter *adapter,
-- struct be_eq_obj *eq_obj)
-+ struct be_eq_obj *eq_obj,
-+ bool rearm)
- {
- struct be_eq_entry *eqe;
- u16 num = 0;
-@@ -1029,7 +1656,10 @@ static int event_handle(struct be_adapter *adapter,
- /* Deal with any spurious interrupts that come
- * without events
- */
-- be_eq_notify(adapter, eq_obj->q.id, true, true, num);
-+ if (!num)
-+ rearm = true;
-+
-+ be_eq_notify(adapter, eq_obj->q.id, rearm, true, num);
- if (num)
- napi_schedule(&eq_obj->napi);
-
-@@ -1053,49 +1683,55 @@ static void be_eq_clean(struct be_adapter *adapter,
- be_eq_notify(adapter, eq_obj->q.id, false, true, num);
- }
-
--static void be_rx_q_clean(struct be_adapter *adapter)
-+static void be_rx_q_clean(struct be_adapter *adapter, struct be_rx_obj *rxo)
- {
- struct be_rx_page_info *page_info;
-- struct be_queue_info *rxq = &adapter->rx_obj.q;
-- struct be_queue_info *rx_cq = &adapter->rx_obj.cq;
-- struct be_eth_rx_compl *rxcp;
-+ struct be_queue_info *rxq = &rxo->q;
-+ struct be_queue_info *rx_cq = &rxo->cq;
-+ struct be_rx_compl_info *rxcp;
- u16 tail;
-
- /* First cleanup pending rx completions */
-- while ((rxcp = be_rx_compl_get(adapter)) != NULL) {
-- be_rx_compl_discard(adapter, rxcp);
-- be_rx_compl_reset(rxcp);
-+ while ((rxcp = be_rx_compl_get(rxo)) != NULL) {
-+ be_rx_compl_discard(adapter, rxo, rxcp);
- be_cq_notify(adapter, rx_cq->id, true, 1);
- }
-
- /* Then free posted rx buffer that were not used */
- tail = (rxq->head + rxq->len - atomic_read(&rxq->used)) % rxq->len;
- for (; atomic_read(&rxq->used) > 0; index_inc(&tail, rxq->len)) {
-- page_info = get_rx_page_info(adapter, tail);
-+ page_info = get_rx_page_info(adapter, rxo, tail);
- put_page(page_info->page);
- memset(page_info, 0, sizeof(*page_info));
- }
- BUG_ON(atomic_read(&rxq->used));
-+ rxq->tail = rxq->head = 0;
- }
-
--static void be_tx_compl_clean(struct be_adapter *adapter)
-+static void be_tx_compl_clean(struct be_adapter *adapter,
-+ struct be_tx_obj *txo)
- {
-- struct be_queue_info *tx_cq = &adapter->tx_obj.cq;
-- struct be_queue_info *txq = &adapter->tx_obj.q;
-+ struct be_queue_info *tx_cq = &txo->cq;
-+ struct be_queue_info *txq = &txo->q;
- struct be_eth_tx_compl *txcp;
-- u16 end_idx, cmpl = 0, timeo = 0;
-+ u16 end_idx, cmpl = 0, timeo = 0, num_wrbs = 0;
-+ struct sk_buff **sent_skbs = txo->sent_skb_list;
-+ struct sk_buff *sent_skb;
-+ bool dummy_wrb;
-
- /* Wait for a max of 200ms for all the tx-completions to arrive. */
- do {
- while ((txcp = be_tx_compl_get(tx_cq))) {
- end_idx = AMAP_GET_BITS(struct amap_eth_tx_compl,
- wrb_index, txcp);
-- be_tx_compl_process(adapter, end_idx);
-+ num_wrbs += be_tx_compl_process(adapter, txo, end_idx);
- cmpl++;
- }
- if (cmpl) {
- be_cq_notify(adapter, tx_cq->id, false, cmpl);
-+ atomic_sub(num_wrbs, &txq->used);
- cmpl = 0;
-+ num_wrbs = 0;
- }
-
- if (atomic_read(&txq->used) == 0 || ++timeo > 200)
-@@ -1107,6 +1743,17 @@ static void be_tx_compl_clean(struct be_adapter *adapter)
- if (atomic_read(&txq->used))
- dev_err(&adapter->pdev->dev, "%d pending tx-completions\n",
- atomic_read(&txq->used));
-+
-+ /* free posted tx for which compls will never arrive */
-+ while (atomic_read(&txq->used)) {
-+ sent_skb = sent_skbs[txq->tail];
-+ end_idx = txq->tail;
-+ index_adv(&end_idx,
-+ wrb_cnt_for_skb(adapter, sent_skb, &dummy_wrb) - 1,
-+ txq->len);
-+ num_wrbs = be_tx_compl_process(adapter, txo, end_idx);
-+ atomic_sub(num_wrbs, &txq->used);
-+ }
- }
-
- static void be_mcc_queues_destroy(struct be_adapter *adapter)
-@@ -1145,8 +1792,9 @@ static int be_mcc_queues_create(struct be_adapter *adapter)
- goto mcc_cq_destroy;
-
- /* Ask BE to create MCC queue */
-- if (be_cmd_mccq_create(adapter, q, cq))
-+ if (be_cmd_mccq_create(adapter, q, cq)) {
- goto mcc_q_free;
-+ }
-
- return 0;
-
-@@ -1163,16 +1811,20 @@ err:
- static void be_tx_queues_destroy(struct be_adapter *adapter)
- {
- struct be_queue_info *q;
-+ struct be_tx_obj *txo;
-+ u8 i;
-
-- q = &adapter->tx_obj.q;
-- if (q->created)
-- be_cmd_q_destroy(adapter, q, QTYPE_TXQ);
-- be_queue_free(adapter, q);
-+ for_all_tx_queues(adapter, txo, i) {
-+ q = &txo->q;
-+ if (q->created)
-+ be_cmd_q_destroy(adapter, q, QTYPE_TXQ);
-+ be_queue_free(adapter, q);
-
-- q = &adapter->tx_obj.cq;
-- if (q->created)
-- be_cmd_q_destroy(adapter, q, QTYPE_CQ);
-- be_queue_free(adapter, q);
-+ q = &txo->cq;
-+ if (q->created)
-+ be_cmd_q_destroy(adapter, q, QTYPE_CQ);
-+ be_queue_free(adapter, q);
-+ }
-
- /* Clear any residual events */
- be_eq_clean(adapter, &adapter->tx_eq);
-@@ -1183,168 +1835,210 @@ static void be_tx_queues_destroy(struct be_adapter *adapter)
- be_queue_free(adapter, q);
- }
-
-+/* One TX event queue is shared by all TX compl qs */
- static int be_tx_queues_create(struct be_adapter *adapter)
- {
- struct be_queue_info *eq, *q, *cq;
-+ struct be_tx_obj *txo;
-+ u8 i, tc_id;
-
- adapter->tx_eq.max_eqd = 0;
- adapter->tx_eq.min_eqd = 0;
- adapter->tx_eq.cur_eqd = 96;
- adapter->tx_eq.enable_aic = false;
-- /* Alloc Tx Event queue */
-+
- eq = &adapter->tx_eq.q;
-- if (be_queue_alloc(adapter, eq, EVNT_Q_LEN, sizeof(struct be_eq_entry)))
-+ if (be_queue_alloc(adapter, eq, EVNT_Q_LEN,
-+ sizeof(struct be_eq_entry)))
- return -1;
-
-- /* Ask BE to create Tx Event queue */
- if (be_cmd_eq_create(adapter, eq, adapter->tx_eq.cur_eqd))
-- goto tx_eq_free;
-- /* Alloc TX eth compl queue */
-- cq = &adapter->tx_obj.cq;
-- if (be_queue_alloc(adapter, cq, TX_CQ_LEN,
-+ goto err;
-+ adapter->tx_eq.eq_idx = adapter->eq_next_idx++;
-+
-+ for_all_tx_queues(adapter, txo, i) {
-+ cq = &txo->cq;
-+ if (be_queue_alloc(adapter, cq, TX_CQ_LEN,
- sizeof(struct be_eth_tx_compl)))
-- goto tx_eq_destroy;
-+ goto err;
-
-- /* Ask BE to create Tx eth compl queue */
-- if (be_cmd_cq_create(adapter, cq, eq, false, false, 3))
-- goto tx_cq_free;
-+ if (be_cmd_cq_create(adapter, cq, eq, false, false, 3))
-+ goto err;
-
-- /* Alloc TX eth queue */
-- q = &adapter->tx_obj.q;
-- if (be_queue_alloc(adapter, q, TX_Q_LEN, sizeof(struct be_eth_wrb)))
-- goto tx_cq_destroy;
-+ q = &txo->q;
-+ if (be_queue_alloc(adapter, q, TX_Q_LEN,
-+ sizeof(struct be_eth_wrb)))
-+ goto err;
-
-- /* Ask BE to create Tx eth queue */
-- if (be_cmd_txq_create(adapter, q, cq))
-- goto tx_q_free;
-+ if (be_cmd_txq_create(adapter, q, cq, &tc_id))
-+ goto err;
-+
-+ if (adapter->flags & BE_FLAGS_DCBX)
-+ adapter->tc_txq_map[tc_id] = i;
-+ }
- return 0;
-
--tx_q_free:
-- be_queue_free(adapter, q);
--tx_cq_destroy:
-- be_cmd_q_destroy(adapter, cq, QTYPE_CQ);
--tx_cq_free:
-- be_queue_free(adapter, cq);
--tx_eq_destroy:
-- be_cmd_q_destroy(adapter, eq, QTYPE_EQ);
--tx_eq_free:
-- be_queue_free(adapter, eq);
-+err:
-+ be_tx_queues_destroy(adapter);
- return -1;
- }
-
- static void be_rx_queues_destroy(struct be_adapter *adapter)
- {
- struct be_queue_info *q;
-+ struct be_rx_obj *rxo;
-+ int i;
-
-- q = &adapter->rx_obj.q;
-- if (q->created) {
-- be_cmd_q_destroy(adapter, q, QTYPE_RXQ);
-- be_rx_q_clean(adapter);
-- }
-- be_queue_free(adapter, q);
-+ for_all_rx_queues(adapter, rxo, i) {
-+ be_queue_free(adapter, &rxo->q);
-+
-+ q = &rxo->cq;
-+ if (q->created)
-+ be_cmd_q_destroy(adapter, q, QTYPE_CQ);
-+ be_queue_free(adapter, q);
-
-- q = &adapter->rx_obj.cq;
-- if (q->created)
-- be_cmd_q_destroy(adapter, q, QTYPE_CQ);
-- be_queue_free(adapter, q);
-+ q = &rxo->rx_eq.q;
-+ if (q->created)
-+ be_cmd_q_destroy(adapter, q, QTYPE_EQ);
-+ be_queue_free(adapter, q);
-
-- /* Clear any residual events */
-- be_eq_clean(adapter, &adapter->rx_eq);
-+ kfree(rxo->page_info_tbl);
-+ }
-+}
-
-- q = &adapter->rx_eq.q;
-- if (q->created)
-- be_cmd_q_destroy(adapter, q, QTYPE_EQ);
-- be_queue_free(adapter, q);
-+/* Is BE in a multi-channel mode */
-+static inline bool be_is_mc(struct be_adapter *adapter) {
-+ return (adapter->function_mode & FLEX10_MODE ||
-+ adapter->function_mode & VNIC_MODE ||
-+ adapter->function_mode & UMC_ENABLED);
-+}
-+
-+static u32 be_num_rxqs_want(struct be_adapter *adapter)
-+{
-+ if (multi_rxq && (adapter->function_caps & BE_FUNCTION_CAPS_RSS) &&
-+ adapter->num_vfs == 0 && be_physfn(adapter) &&
-+ !be_is_mc(adapter)) {
-+ return 1 + MAX_RSS_QS; /* one default non-RSS queue */
-+ } else {
-+ dev_warn(&adapter->pdev->dev,
-+ "No support for multiple RX queues\n");
-+ return 1;
-+ }
- }
-
- static int be_rx_queues_create(struct be_adapter *adapter)
- {
- struct be_queue_info *eq, *q, *cq;
-- int rc;
-+ struct be_rx_obj *rxo;
-+ int rc, i;
-
-+ adapter->num_rx_qs = min(be_num_rxqs_want(adapter),
-+ msix_enabled(adapter) ?
-+ adapter->num_msix_vec - 1 : 1);
-+ if (adapter->num_rx_qs != MAX_RX_QS)
-+ dev_warn(&adapter->pdev->dev,
-+ "Could create only %d receive queues",
-+ adapter->num_rx_qs);
-+
-+ adapter->max_rx_coal = gro ? BE_INIT_FRAGS_PER_FRAME : 1;
- adapter->big_page_size = (1 << get_order(rx_frag_size)) * PAGE_SIZE;
-- adapter->rx_eq.max_eqd = BE_MAX_EQD;
-- adapter->rx_eq.min_eqd = 0;
-- adapter->rx_eq.cur_eqd = 0;
-- adapter->rx_eq.enable_aic = true;
-+ for_all_rx_queues(adapter, rxo, i) {
-+ rxo->adapter = adapter;
-+ rxo->rx_eq.max_eqd = BE_MAX_EQD;
-+ rxo->rx_eq.enable_aic = true;
-
-- /* Alloc Rx Event queue */
-- eq = &adapter->rx_eq.q;
-- rc = be_queue_alloc(adapter, eq, EVNT_Q_LEN,
-- sizeof(struct be_eq_entry));
-- if (rc)
-- return rc;
-+ /* EQ */
-+ eq = &rxo->rx_eq.q;
-+ rc = be_queue_alloc(adapter, eq, EVNT_Q_LEN,
-+ sizeof(struct be_eq_entry));
-+ if (rc)
-+ goto err;
-
-- /* Ask BE to create Rx Event queue */
-- rc = be_cmd_eq_create(adapter, eq, adapter->rx_eq.cur_eqd);
-- if (rc)
-- goto rx_eq_free;
-+ rc = be_cmd_eq_create(adapter, eq, rxo->rx_eq.cur_eqd);
-+ if (rc)
-+ goto err;
-
-- /* Alloc RX eth compl queue */
-- cq = &adapter->rx_obj.cq;
-- rc = be_queue_alloc(adapter, cq, RX_CQ_LEN,
-- sizeof(struct be_eth_rx_compl));
-- if (rc)
-- goto rx_eq_destroy;
-+ rxo->rx_eq.eq_idx = adapter->eq_next_idx++;
-
-- /* Ask BE to create Rx eth compl queue */
-- rc = be_cmd_cq_create(adapter, cq, eq, false, false, 3);
-- if (rc)
-- goto rx_cq_free;
-+ /* CQ */
-+ cq = &rxo->cq;
-+ rc = be_queue_alloc(adapter, cq, RX_CQ_LEN,
-+ sizeof(struct be_eth_rx_compl));
-+ if (rc)
-+ goto err;
-
-- /* Alloc RX eth queue */
-- q = &adapter->rx_obj.q;
-- rc = be_queue_alloc(adapter, q, RX_Q_LEN, sizeof(struct be_eth_rx_d));
-- if (rc)
-- goto rx_cq_destroy;
-+ rc = be_cmd_cq_create(adapter, cq, eq, false, false, 3);
-+ if (rc)
-+ goto err;
-
-- /* Ask BE to create Rx eth queue */
-- rc = be_cmd_rxq_create(adapter, q, cq->id, rx_frag_size,
-- BE_MAX_JUMBO_FRAME_SIZE, adapter->if_handle, false);
-- if (rc)
-- goto rx_q_free;
-+ /* Rx Q - will be created in be_open() */
-+ q = &rxo->q;
-+ rc = be_queue_alloc(adapter, q, RX_Q_LEN,
-+ sizeof(struct be_eth_rx_d));
-+ if (rc)
-+ goto err;
-+
-+ rxo->page_info_tbl = kzalloc(sizeof(struct be_rx_page_info) *
-+ RX_Q_LEN, GFP_KERNEL);
-+ if (!rxo->page_info_tbl)
-+ goto err;
-+ }
-
- return 0;
--rx_q_free:
-- be_queue_free(adapter, q);
--rx_cq_destroy:
-- be_cmd_q_destroy(adapter, cq, QTYPE_CQ);
--rx_cq_free:
-- be_queue_free(adapter, cq);
--rx_eq_destroy:
-- be_cmd_q_destroy(adapter, eq, QTYPE_EQ);
--rx_eq_free:
-- be_queue_free(adapter, eq);
-- return rc;
-+err:
-+ be_rx_queues_destroy(adapter);
-+ return -1;
- }
-
--/* There are 8 evt ids per func. Retruns the evt id's bit number */
--static inline int be_evt_bit_get(struct be_adapter *adapter, u32 eq_id)
-+static bool event_peek(struct be_eq_obj *eq_obj)
- {
-- return eq_id - 8 * be_pci_func(adapter);
-+ struct be_eq_entry *eqe = queue_tail_node(&eq_obj->q);
-+ if (!eqe->evt)
-+ return false;
-+ else
-+ return true;
- }
-
- static irqreturn_t be_intx(int irq, void *dev)
- {
- struct be_adapter *adapter = dev;
-- int isr;
-+ struct be_rx_obj *rxo;
-+ int isr, i, tx = 0 , rx = 0;
-
-- isr = ioread32(adapter->csr + CEV_ISR0_OFFSET +
-- be_pci_func(adapter) * CEV_ISR_SIZE);
-- if (!isr)
-- return IRQ_NONE;
-+ if (lancer_chip(adapter)) {
-+ if (event_peek(&adapter->tx_eq))
-+ tx = event_handle(adapter, &adapter->tx_eq, false);
-+ for_all_rx_queues(adapter, rxo, i) {
-+ if (event_peek(&rxo->rx_eq))
-+ rx |= event_handle(adapter, &rxo->rx_eq, true);
-+ }
-
-- event_handle(adapter, &adapter->tx_eq);
-- event_handle(adapter, &adapter->rx_eq);
-+ if (!(tx || rx))
-+ return IRQ_NONE;
-+ } else {
-+ isr = ioread32(adapter->csr + CEV_ISR0_OFFSET +
-+ (adapter->tx_eq.q.id / 8) * CEV_ISR_SIZE);
-+ if (!isr)
-+ return IRQ_NONE;
-+
-+ if ((1 << adapter->tx_eq.eq_idx & isr))
-+ event_handle(adapter, &adapter->tx_eq, false);
-+
-+ for_all_rx_queues(adapter, rxo, i) {
-+ if ((1 << rxo->rx_eq.eq_idx & isr))
-+ event_handle(adapter, &rxo->rx_eq, true);
-+ }
-+ }
-
- return IRQ_HANDLED;
- }
-
- static irqreturn_t be_msix_rx(int irq, void *dev)
- {
-- struct be_adapter *adapter = dev;
-+ struct be_rx_obj *rxo = dev;
-+ struct be_adapter *adapter = rxo->adapter;
-
-- event_handle(adapter, &adapter->rx_eq);
-+ event_handle(adapter, &rxo->rx_eq, true);
-
- return IRQ_HANDLED;
- }
-@@ -1353,48 +2047,72 @@ static irqreturn_t be_msix_tx_mcc(int irq, void *dev)
- {
- struct be_adapter *adapter = dev;
-
-- event_handle(adapter, &adapter->tx_eq);
-+ event_handle(adapter, &adapter->tx_eq, false);
-
- return IRQ_HANDLED;
- }
-
- static inline bool do_gro(struct be_adapter *adapter,
-- struct be_eth_rx_compl *rxcp)
-+ struct be_rx_compl_info *rxcp)
- {
-- int err = AMAP_GET_BITS(struct amap_eth_rx_compl, err, rxcp);
-- int tcp_frame = AMAP_GET_BITS(struct amap_eth_rx_compl, tcpf, rxcp);
--
-- if (err)
-- drvr_stats(adapter)->be_rxcp_err++;
--
-- return (tcp_frame && !err) ? true : false;
-+ return (!rxcp->tcpf || rxcp->err || adapter->max_rx_coal <= 1 ||
-+ (rxcp->vlanf && !vlan_configured(adapter))) ?
-+ false : true;
- }
-
- int be_poll_rx(struct napi_struct *napi, int budget)
- {
- struct be_eq_obj *rx_eq = container_of(napi, struct be_eq_obj, napi);
-- struct be_adapter *adapter =
-- container_of(rx_eq, struct be_adapter, rx_eq);
-- struct be_queue_info *rx_cq = &adapter->rx_obj.cq;
-- struct be_eth_rx_compl *rxcp;
-+ struct be_rx_obj *rxo = container_of(rx_eq, struct be_rx_obj, rx_eq);
-+ struct be_adapter *adapter = rxo->adapter;
-+ struct be_queue_info *rx_cq = &rxo->cq;
-+ struct be_rx_compl_info *rxcp;
- u32 work_done;
-+ bool flush_lro = false;
-
-+ rxo->stats.rx_polls++;
- for (work_done = 0; work_done < budget; work_done++) {
-- rxcp = be_rx_compl_get(adapter);
-+ rxcp = be_rx_compl_get(rxo);
- if (!rxcp)
- break;
-
-- if (do_gro(adapter, rxcp))
-- be_rx_compl_process_gro(adapter, rxcp);
-- else
-- be_rx_compl_process(adapter, rxcp);
-+ /* Is it a flush compl that has no data */
-+ if (unlikely(rxcp->num_rcvd == 0))
-+ continue;
-
-- be_rx_compl_reset(rxcp);
-+ if (unlikely(rxcp->port != adapter->port_num)) {
-+ be_rx_compl_discard(adapter, rxo, rxcp);
-+ be_rx_stats_update(rxo, rxcp);
-+ continue;
-+ }
-+
-+ if (likely((lancer_A0_chip(adapter) && !rxcp->err) ||
-+ !lancer_A0_chip(adapter))) {
-+ if (do_gro(adapter, rxcp)) {
-+ if (adapter->gro_supported) {
-+ be_rx_compl_process_gro(adapter, rxo,
-+ rxcp);
-+ } else {
-+ be_rx_compl_process_lro(adapter, rxo,
-+ rxcp);
-+ flush_lro = true;
-+ }
-+ } else {
-+ be_rx_compl_process(adapter, rxo, rxcp);
-+ }
-+ } else if (lancer_A0_chip(adapter) && rxcp->err) {
-+ be_rx_compl_discard(adapter, rxo, rxcp);
-+ }
-+
-+ be_rx_stats_update(rxo, rxcp);
- }
-
-+ if (flush_lro)
-+ lro_flush_all(&rxo->lro_mgr);
-+
- /* Refill the queue */
-- if (atomic_read(&adapter->rx_obj.q.used) < RX_FRAGS_REFILL_WM)
-- be_post_rx_frags(adapter);
-+ if (work_done && atomic_read(&rxo->q.used) < RX_FRAGS_REFILL_WM)
-+ be_post_rx_frags(rxo);
-
- /* All consumed */
- if (work_done < budget) {
-@@ -1404,40 +2122,13 @@ int be_poll_rx(struct napi_struct *napi, int budget)
- /* More to be consumed; continue with interrupts disabled */
- be_cq_notify(adapter, rx_cq->id, false, work_done);
- }
-+
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 32)
-+ adapter->netdev->last_rx = jiffies;
-+#endif
- return work_done;
- }
-
--void be_process_tx(struct be_adapter *adapter)
--{
-- struct be_queue_info *txq = &adapter->tx_obj.q;
-- struct be_queue_info *tx_cq = &adapter->tx_obj.cq;
-- struct be_eth_tx_compl *txcp;
-- u32 num_cmpl = 0;
-- u16 end_idx;
--
-- while ((txcp = be_tx_compl_get(tx_cq))) {
-- end_idx = AMAP_GET_BITS(struct amap_eth_tx_compl,
-- wrb_index, txcp);
-- be_tx_compl_process(adapter, end_idx);
-- num_cmpl++;
-- }
--
-- if (num_cmpl) {
-- be_cq_notify(adapter, tx_cq->id, true, num_cmpl);
--
-- /* As Tx wrbs have been freed up, wake up netdev queue if
-- * it was stopped due to lack of tx wrbs.
-- */
-- if (netif_queue_stopped(adapter->netdev) &&
-- atomic_read(&txq->used) < txq->len / 2) {
-- netif_wake_queue(adapter->netdev);
-- }
--
-- drvr_stats(adapter)->be_tx_events++;
-- drvr_stats(adapter)->be_tx_compl += num_cmpl;
-- }
--}
--
- /* As TX and MCC share the same EQ check for both TX and MCC completions.
- * For TX/MCC we don't honour budget; consume everything
- */
-@@ -1446,96 +2137,264 @@ static int be_poll_tx_mcc(struct napi_struct *napi, int budget)
- struct be_eq_obj *tx_eq = container_of(napi, struct be_eq_obj, napi);
- struct be_adapter *adapter =
- container_of(tx_eq, struct be_adapter, tx_eq);
-+ struct be_tx_obj *txo;
-+ struct be_eth_tx_compl *txcp;
-+ int tx_compl, mcc_compl, status = 0;
-+ u8 i;
-+ u16 num_wrbs;
-+
-+ for_all_tx_queues(adapter, txo, i) {
-+ tx_compl = 0;
-+ num_wrbs = 0;
-+ while ((txcp = be_tx_compl_get(&txo->cq))) {
-+ num_wrbs += be_tx_compl_process(adapter, txo,
-+ AMAP_GET_BITS(struct amap_eth_tx_compl,
-+ wrb_index, txcp));
-+ tx_compl++;
-+ }
-+ if (tx_compl) {
-+ be_cq_notify(adapter, txo->cq.id, true, tx_compl);
-+
-+ atomic_sub(num_wrbs, &txo->q.used);
-+
-+ /* As Tx wrbs have been freed up, wake up netdev queue
-+ * if it was stopped due to lack of tx wrbs. */
-+ if (__netif_subqueue_stopped(adapter->netdev, i) &&
-+ atomic_read(&txo->q.used) < txo->q.len / 2) {
-+ netif_wake_subqueue(adapter->netdev, i);
-+ }
-+
-+ adapter->drv_stats.be_tx_events++;
-+ txo->stats.be_tx_compl += tx_compl;
-+ }
-+ }
-+
-+ mcc_compl = be_process_mcc(adapter, &status);
-+
-+ if (mcc_compl) {
-+ struct be_mcc_obj *mcc_obj = &adapter->mcc_obj;
-+ be_cq_notify(adapter, mcc_obj->cq.id, true, mcc_compl);
-+ }
-
- napi_complete(napi);
-
-- be_process_tx(adapter);
--
-- be_process_mcc(adapter);
--
-+ be_eq_notify(adapter, tx_eq->q.id, true, false, 0);
- return 1;
- }
-
-+void be_detect_dump_ue(struct be_adapter *adapter)
-+{
-+ u32 ue_status_lo, ue_status_hi, ue_status_lo_mask, ue_status_hi_mask;
-+ u32 i;
-+
-+ pci_read_config_dword(adapter->pdev,
-+ PCICFG_UE_STATUS_LOW, &ue_status_lo);
-+ pci_read_config_dword(adapter->pdev,
-+ PCICFG_UE_STATUS_HIGH, &ue_status_hi);
-+ pci_read_config_dword(adapter->pdev,
-+ PCICFG_UE_STATUS_LOW_MASK, &ue_status_lo_mask);
-+ pci_read_config_dword(adapter->pdev,
-+ PCICFG_UE_STATUS_HI_MASK, &ue_status_hi_mask);
-+
-+ ue_status_lo = (ue_status_lo & (~ue_status_lo_mask));
-+ ue_status_hi = (ue_status_hi & (~ue_status_hi_mask));
-+
-+ if (ue_status_lo || ue_status_hi) {
-+ adapter->ue_detected = true;
-+ adapter->eeh_err = true;
-+ dev_err(&adapter->pdev->dev, "UE Detected!!\n");
-+ }
-+
-+ if (ue_status_lo) {
-+ for (i = 0; ue_status_lo; ue_status_lo >>= 1, i++) {
-+ if (ue_status_lo & 1)
-+ dev_err(&adapter->pdev->dev,
-+ "UE: %s bit set\n", ue_status_low_desc[i]);
-+ }
-+ }
-+ if (ue_status_hi) {
-+ for (i = 0; ue_status_hi; ue_status_hi >>= 1, i++) {
-+ if (ue_status_hi & 1)
-+ dev_err(&adapter->pdev->dev,
-+ "UE: %s bit set\n", ue_status_hi_desc[i]);
-+ }
-+ }
-+
-+}
-+
- static void be_worker(struct work_struct *work)
- {
- struct be_adapter *adapter =
- container_of(work, struct be_adapter, work.work);
-+ struct be_rx_obj *rxo;
-+ struct be_tx_obj *txo;
-+ int i;
-
-- be_cmd_get_stats(adapter, &adapter->stats.cmd);
-+ if (!adapter->ue_detected && !lancer_chip(adapter))
-+ be_detect_dump_ue(adapter);
-
-- /* Set EQ delay */
-- be_rx_eqd_update(adapter);
-+ /* when interrupts are not yet enabled, just reap any pending
-+ * mcc completions */
-+ if (!netif_running(adapter->netdev)) {
-+ int mcc_compl, status = 0;
-
-- be_tx_rate_update(adapter);
-- be_rx_rate_update(adapter);
-+ mcc_compl = be_process_mcc(adapter, &status);
-
-- if (adapter->rx_post_starved) {
-- adapter->rx_post_starved = false;
-- be_post_rx_frags(adapter);
-+ if (mcc_compl) {
-+ struct be_mcc_obj *mcc_obj = &adapter->mcc_obj;
-+ be_cq_notify(adapter, mcc_obj->cq.id, false, mcc_compl);
-+ }
-+
-+ goto reschedule;
-+ }
-+
-+ if (!adapter->stats_cmd_sent)
-+ be_cmd_get_stats(adapter, &adapter->stats_cmd);
-+
-+ for_all_tx_queues(adapter, txo, i)
-+ be_tx_rate_update(txo);
-+
-+ for_all_rx_queues(adapter, rxo, i) {
-+ be_rx_rate_update(rxo);
-+ be_rx_eqd_update(adapter, rxo);
-+
-+ if (rxo->rx_post_starved) {
-+ rxo->rx_post_starved = false;
-+ be_post_rx_frags(rxo);
-+ }
- }
-
-+reschedule:
-+ adapter->work_counter++;
- schedule_delayed_work(&adapter->work, msecs_to_jiffies(1000));
- }
-
-+static void be_msix_disable(struct be_adapter *adapter)
-+{
-+ if (msix_enabled(adapter)) {
-+ pci_disable_msix(adapter->pdev);
-+ adapter->num_msix_vec = 0;
-+ }
-+}
-+
- static void be_msix_enable(struct be_adapter *adapter)
- {
-- int i, status;
-+#define BE_MIN_MSIX_VECTORS (1 + 1) /* Rx + Tx */
-+ int i, status, num_vec;
-
-- for (i = 0; i < BE_NUM_MSIX_VECTORS; i++)
-+ num_vec = be_num_rxqs_want(adapter) + 1;
-+
-+ for (i = 0; i < num_vec; i++)
- adapter->msix_entries[i].entry = i;
-
-- status = pci_enable_msix(adapter->pdev, adapter->msix_entries,
-- BE_NUM_MSIX_VECTORS);
-- if (status == 0)
-- adapter->msix_enabled = true;
-+ status = pci_enable_msix(adapter->pdev, adapter->msix_entries, num_vec);
-+ if (status == 0) {
-+ goto done;
-+ } else if (status >= BE_MIN_MSIX_VECTORS) {
-+ num_vec = status;
-+ if (pci_enable_msix(adapter->pdev, adapter->msix_entries,
-+ num_vec) == 0)
-+ goto done;
-+ }
- return;
-+done:
-+ adapter->num_msix_vec = num_vec;
-+ return;
-+}
-+
-+static void be_sriov_enable(struct be_adapter *adapter)
-+{
-+ be_check_sriov_fn_type(adapter);
-+#ifdef CONFIG_PCI_IOV
-+ if (be_physfn(adapter) && num_vfs) {
-+ int status, pos;
-+ u16 nvfs;
-+
-+ pos = pci_find_ext_capability(adapter->pdev,
-+ PCI_EXT_CAP_ID_SRIOV);
-+ pci_read_config_word(adapter->pdev,
-+ pos + PCI_SRIOV_TOTAL_VF, &nvfs);
-+ adapter->num_vfs = num_vfs;
-+ if (num_vfs > nvfs) {
-+ dev_info(&adapter->pdev->dev,
-+ "Device supports %d VFs and not %d\n",
-+ nvfs, num_vfs);
-+ adapter->num_vfs = nvfs;
-+ }
-+
-+ status = pci_enable_sriov(adapter->pdev, adapter->num_vfs);
-+ if (status)
-+ adapter->num_vfs = 0;
-+ }
-+#endif
-+}
-+
-+static void be_sriov_disable(struct be_adapter *adapter)
-+{
-+#ifdef CONFIG_PCI_IOV
-+ if (adapter->num_vfs > 0) {
-+ pci_disable_sriov(adapter->pdev);
-+ adapter->num_vfs = 0;
-+ }
-+#endif
- }
-
--static inline int be_msix_vec_get(struct be_adapter *adapter, u32 eq_id)
-+static inline int be_msix_vec_get(struct be_adapter *adapter,
-+ struct be_eq_obj *eq_obj)
- {
-- return adapter->msix_entries[
-- be_evt_bit_get(adapter, eq_id)].vector;
-+ return adapter->msix_entries[eq_obj->eq_idx].vector;
- }
-
- static int be_request_irq(struct be_adapter *adapter,
- struct be_eq_obj *eq_obj,
-- void *handler, char *desc)
-+ void *handler, char *desc, void *context)
- {
- struct net_device *netdev = adapter->netdev;
- int vec;
-
- sprintf(eq_obj->desc, "%s-%s", netdev->name, desc);
-- vec = be_msix_vec_get(adapter, eq_obj->q.id);
-- return request_irq(vec, handler, 0, eq_obj->desc, adapter);
-+ vec = be_msix_vec_get(adapter, eq_obj);
-+ return request_irq(vec, handler, 0, eq_obj->desc, context);
- }
-
--static void be_free_irq(struct be_adapter *adapter, struct be_eq_obj *eq_obj)
-+static void be_free_irq(struct be_adapter *adapter, struct be_eq_obj *eq_obj,
-+ void *context)
- {
-- int vec = be_msix_vec_get(adapter, eq_obj->q.id);
-- free_irq(vec, adapter);
-+ int vec = be_msix_vec_get(adapter, eq_obj);
-+ free_irq(vec, context);
- }
-
- static int be_msix_register(struct be_adapter *adapter)
- {
-- int status;
-+ struct be_rx_obj *rxo;
-+ int status, i;
-+ char qname[10];
-
-- status = be_request_irq(adapter, &adapter->tx_eq, be_msix_tx_mcc, "tx");
-+ status = be_request_irq(adapter, &adapter->tx_eq, be_msix_tx_mcc, "tx",
-+ adapter);
- if (status)
- goto err;
-
-- status = be_request_irq(adapter, &adapter->rx_eq, be_msix_rx, "rx");
-- if (status)
-- goto free_tx_irq;
-+ for_all_rx_queues(adapter, rxo, i) {
-+ sprintf(qname, "rxq%d", i);
-+ status = be_request_irq(adapter, &rxo->rx_eq, be_msix_rx,
-+ qname, rxo);
-+ if (status)
-+ goto err_msix;
-+ }
-
- return 0;
-
--free_tx_irq:
-- be_free_irq(adapter, &adapter->tx_eq);
-+err_msix:
-+ be_free_irq(adapter, &adapter->tx_eq, adapter);
-+
-+ for (i--, rxo = &adapter->rx_obj[i]; i >= 0; i--, rxo--)
-+ be_free_irq(adapter, &rxo->rx_eq, rxo);
-+
- err:
- dev_warn(&adapter->pdev->dev,
- "MSIX Request IRQ failed - err %d\n", status);
-- pci_disable_msix(adapter->pdev);
-- adapter->msix_enabled = false;
-+ be_msix_disable(adapter);
- return status;
- }
-
-@@ -1544,10 +2403,13 @@ static int be_irq_register(struct be_adapter *adapter)
- struct net_device *netdev = adapter->netdev;
- int status;
-
-- if (adapter->msix_enabled) {
-+ if (msix_enabled(adapter)) {
- status = be_msix_register(adapter);
- if (status == 0)
- goto done;
-+ /* INTx is not supported for VF */
-+ if (!be_physfn(adapter))
-+ return status;
- }
-
- /* INTx */
-@@ -1567,87 +2429,363 @@ done:
- static void be_irq_unregister(struct be_adapter *adapter)
- {
- struct net_device *netdev = adapter->netdev;
-+ struct be_rx_obj *rxo;
-+ int i;
-
- if (!adapter->isr_registered)
- return;
-
- /* INTx */
-- if (!adapter->msix_enabled) {
-+ if (!msix_enabled(adapter)) {
- free_irq(netdev->irq, adapter);
- goto done;
- }
-
- /* MSIx */
-- be_free_irq(adapter, &adapter->tx_eq);
-- be_free_irq(adapter, &adapter->rx_eq);
-+ be_free_irq(adapter, &adapter->tx_eq, adapter);
-+
-+ for_all_rx_queues(adapter, rxo, i)
-+ be_free_irq(adapter, &rxo->rx_eq, rxo);
-+
- done:
- adapter->isr_registered = false;
-- return;
- }
-
--static int be_open(struct net_device *netdev)
-+static u16 be_select_queue(struct net_device *netdev,
-+ struct sk_buff *skb)
- {
- struct be_adapter *adapter = netdev_priv(netdev);
-- struct be_eq_obj *rx_eq = &adapter->rx_eq;
-+ u8 prio;
-+
-+ if (adapter->num_tx_qs == 1)
-+ return 0;
-+
-+ prio = (vlan_tx_tag_get(skb) & VLAN_PRIO_MASK) >> VLAN_PRIO_SHIFT;
-+ return adapter->tc_txq_map[adapter->prio_tc_map[prio]];
-+}
-+
-+static void be_rx_queues_clear(struct be_adapter *adapter)
-+{
-+ struct be_queue_info *q;
-+ struct be_rx_obj *rxo;
-+ int i;
-+
-+ for_all_rx_queues(adapter, rxo, i) {
-+ q = &rxo->q;
-+ if (q->created) {
-+ be_cmd_rxq_destroy(adapter, q);
-+ /* After the rxq is invalidated, wait for a grace time
-+ * of 1ms for all dma to end and the flush compl to
-+ * arrive
-+ */
-+ mdelay(1);
-+ be_rx_q_clean(adapter, rxo);
-+ }
-+
-+ /* Clear any residual events */
-+ q = &rxo->rx_eq.q;
-+ if (q->created)
-+ be_eq_clean(adapter, &rxo->rx_eq);
-+ }
-+}
-+
-+static int be_close(struct net_device *netdev)
-+{
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+ struct be_rx_obj *rxo;
-+ struct be_tx_obj *txo;
- struct be_eq_obj *tx_eq = &adapter->tx_eq;
-- bool link_up;
-- int status;
-+ int vec, i;
-+
-+ be_async_mcc_disable(adapter);
-+
-+ netif_stop_queue(netdev);
-+ netif_carrier_off(netdev);
-+ adapter->link_status = LINK_DOWN;
-+
-+ if (!lancer_chip(adapter))
-+ be_intr_set(adapter, false);
-+
-+ for_all_rx_queues(adapter, rxo, i)
-+ napi_disable(&rxo->rx_eq.napi);
-+
-+ napi_disable(&tx_eq->napi);
-+
-+ if (lancer_chip(adapter)) {
-+ be_cq_notify(adapter, adapter->mcc_obj.cq.id, false, 0);
-+ for_all_rx_queues(adapter, rxo, i)
-+ be_cq_notify(adapter, rxo->cq.id, false, 0);
-+ for_all_tx_queues(adapter, txo, i)
-+ be_cq_notify(adapter, txo->cq.id, false, 0);
-+ }
-+
-+ if (msix_enabled(adapter)) {
-+ vec = be_msix_vec_get(adapter, tx_eq);
-+ synchronize_irq(vec);
-+
-+ for_all_rx_queues(adapter, rxo, i) {
-+ vec = be_msix_vec_get(adapter, &rxo->rx_eq);
-+ synchronize_irq(vec);
-+ }
-+ } else {
-+ synchronize_irq(netdev->irq);
-+ }
-+ be_irq_unregister(adapter);
-+
-+ /* Wait for all pending tx completions to arrive so that
-+ * all tx skbs are freed.
-+ */
-+ for_all_tx_queues(adapter, txo, i)
-+ be_tx_compl_clean(adapter, txo);
-+
-+ be_rx_queues_clear(adapter);
-+ return 0;
-+}
-+
-+static int be_rx_queues_setup(struct be_adapter *adapter)
-+{
-+ struct be_rx_obj *rxo;
-+ int rc, i;
-+ u8 rsstable[MAX_RSS_QS];
-+
-+ for_all_rx_queues(adapter, rxo, i) {
-+ rc = be_cmd_rxq_create(adapter, &rxo->q, rxo->cq.id,
-+ rx_frag_size, BE_MAX_JUMBO_FRAME_SIZE,
-+ adapter->if_handle,
-+ (i > 0) ? 1 : 0/* rss enable */, &rxo->rss_id);
-+ if (rc)
-+ return rc;
-+ }
-+
-+ if (be_multi_rxq(adapter)) {
-+ for_all_rss_queues(adapter, rxo, i)
-+ rsstable[i] = rxo->rss_id;
-+
-+ rc = be_cmd_rss_config(adapter, rsstable,
-+ adapter->num_rx_qs - 1);
-+ if (rc)
-+ return rc;
-+ }
-
- /* First time posting */
-- be_post_rx_frags(adapter);
-+ for_all_rx_queues(adapter, rxo, i) {
-+ be_post_rx_frags(rxo);
-+ napi_enable(&rxo->rx_eq.napi);
-+ }
-+ return 0;
-+}
-+
-+static int be_open(struct net_device *netdev)
-+{
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+ struct be_eq_obj *tx_eq = &adapter->tx_eq;
-+ struct be_rx_obj *rxo;
-+ int link_status;
-+ int status, i;
-+ u8 mac_speed;
-+ u16 link_speed;
-+
-+ status = be_rx_queues_setup(adapter);
-+ if (status)
-+ goto err;
-
-- napi_enable(&rx_eq->napi);
- napi_enable(&tx_eq->napi);
-
- be_irq_register(adapter);
-
-- be_intr_set(adapter, true);
-+ if (!lancer_chip(adapter))
-+ be_intr_set(adapter, true);
-
- /* The evt queues are created in unarmed state; arm them */
-- be_eq_notify(adapter, rx_eq->q.id, true, false, 0);
-+ for_all_rx_queues(adapter, rxo, i) {
-+ be_eq_notify(adapter, rxo->rx_eq.q.id, true, false, 0);
-+ be_cq_notify(adapter, rxo->cq.id, true, 0);
-+ }
- be_eq_notify(adapter, tx_eq->q.id, true, false, 0);
-
-- /* Rx compl queue may be in unarmed state; rearm it */
-- be_cq_notify(adapter, adapter->rx_obj.cq.id, true, 0);
-+ /* Now that interrupts are on we can process async mcc */
-+ be_async_mcc_enable(adapter);
-
-- status = be_cmd_link_status_query(adapter, &link_up);
-+ status = be_cmd_link_status_query(adapter, &link_status, &mac_speed,
-+ &link_speed, 0);
- if (status)
-- goto ret_sts;
-- be_link_status_update(adapter, link_up);
-+ goto err;
-+ be_link_status_update(adapter, link_status);
-
-- status = be_vid_config(adapter);
-+ status = be_vid_config(adapter, false, 0);
- if (status)
-- goto ret_sts;
-+ goto err;
-
-- status = be_cmd_set_flow_control(adapter,
-- adapter->tx_fc, adapter->rx_fc);
-- if (status)
-- goto ret_sts;
-+ if (be_physfn(adapter)) {
-+ status = be_cmd_set_flow_control(adapter,
-+ adapter->tx_fc, adapter->rx_fc);
-+ if (status)
-+ goto err;
-+ }
-+
-+ return 0;
-+err:
-+ be_close(adapter->netdev);
-+ return -EIO;
-+}
-+
-+static int be_setup_wol(struct be_adapter *adapter, bool enable)
-+{
-+ struct be_dma_mem cmd;
-+ int status = 0;
-+ u8 mac[ETH_ALEN];
-+
-+ memset(mac, 0, ETH_ALEN);
-+
-+ cmd.size = sizeof(struct be_cmd_req_acpi_wol_magic_config);
-+ cmd.va = pci_alloc_consistent(adapter->pdev, cmd.size, &cmd.dma);
-+ if (cmd.va == NULL)
-+ return -1;
-+ memset(cmd.va, 0, cmd.size);
-+
-+ if (enable) {
-+ status = pci_write_config_dword(adapter->pdev,
-+ PCICFG_PM_CONTROL_OFFSET, PCICFG_PM_CONTROL_MASK);
-+ if (status) {
-+ dev_err(&adapter->pdev->dev,
-+ "Could not enable Wake-on-lan\n");
-+ pci_free_consistent(adapter->pdev, cmd.size, cmd.va,
-+ cmd.dma);
-+ return status;
-+ }
-+ status = be_cmd_enable_magic_wol(adapter,
-+ adapter->netdev->dev_addr, &cmd);
-+ pci_enable_wake(adapter->pdev, PCI_D3hot, 1);
-+ pci_enable_wake(adapter->pdev, PCI_D3cold, 1);
-+ } else {
-+ status = be_cmd_enable_magic_wol(adapter, mac, &cmd);
-+ pci_enable_wake(adapter->pdev, PCI_D3hot, 0);
-+ pci_enable_wake(adapter->pdev, PCI_D3cold, 0);
-+ }
-+
-+ pci_free_consistent(adapter->pdev, cmd.size, cmd.va, cmd.dma);
-+ return status;
-+}
-+
-+/*
-+ * Generate a seed MAC address from the PF MAC Address using jhash.
-+ * MAC Address for VFs are assigned incrementally starting from the seed.
-+ * These addresses are programmed in the ASIC by the PF and the VF driver
-+ * queries for the MAC address during its probe.
-+ */
-+static inline int be_vf_eth_addr_config(struct be_adapter *adapter)
-+{
-+ u32 vf = 0;
-+ int status = 0;
-+ u8 mac[ETH_ALEN];
-+
-+ be_vf_eth_addr_generate(adapter, mac);
-+
-+ for (vf = 0; vf < adapter->num_vfs; vf++) {
-+ status = be_cmd_pmac_add(adapter, mac,
-+ adapter->vf_cfg[vf].vf_if_handle,
-+ &adapter->vf_cfg[vf].vf_pmac_id,
-+ vf + 1);
-+ if (status)
-+ dev_err(&adapter->pdev->dev,
-+ "Mac address add failed for VF %d\n", vf);
-+ else
-+ memcpy(adapter->vf_cfg[vf].vf_mac_addr, mac, ETH_ALEN);
-
-- schedule_delayed_work(&adapter->work, msecs_to_jiffies(100));
--ret_sts:
-+ mac[5] += 1;
-+ }
- return status;
- }
-
-+static inline void be_vf_eth_addr_rem(struct be_adapter *adapter)
-+{
-+ u32 vf;
-+
-+ for (vf = 0; vf < adapter->num_vfs; vf++) {
-+ if (adapter->vf_cfg[vf].vf_pmac_id != BE_INVALID_PMAC_ID)
-+ be_cmd_pmac_del(adapter,
-+ adapter->vf_cfg[vf].vf_if_handle,
-+ adapter->vf_cfg[vf].vf_pmac_id, vf + 1);
-+ }
-+}
-+
-+static int be_num_txqs_want(struct be_adapter *adapter)
-+{
-+ if (adapter->num_vfs > 0 || be_is_mc(adapter) ||
-+ lancer_chip(adapter) || !be_physfn(adapter) ||
-+ adapter->generation == BE_GEN2)
-+ return 1;
-+ else
-+ return MAX_TX_QS;
-+}
-+
- static int be_setup(struct be_adapter *adapter)
- {
- struct net_device *netdev = adapter->netdev;
-- u32 cap_flags, en_flags;
-- int status;
--
-- cap_flags = BE_IF_FLAGS_UNTAGGED | BE_IF_FLAGS_BROADCAST |
-- BE_IF_FLAGS_MCAST_PROMISCUOUS |
-- BE_IF_FLAGS_PROMISCUOUS |
-- BE_IF_FLAGS_PASS_L3L4_ERRORS;
-- en_flags = BE_IF_FLAGS_UNTAGGED | BE_IF_FLAGS_BROADCAST |
-- BE_IF_FLAGS_PASS_L3L4_ERRORS;
-+ int status, fw_num_txqs, num_txqs;
-+ u32 cap_flags, en_flags, vf = 0;
-+ u8 mac[ETH_ALEN];
-+
-+ num_txqs = be_num_txqs_want(adapter);
-+ if (num_txqs > 1) {
-+ be_cmd_req_pg_pfc(adapter, &fw_num_txqs);
-+ num_txqs = min(num_txqs, fw_num_txqs);
-+ }
-+ adapter->num_tx_qs = num_txqs;
-+ if (adapter->num_tx_qs != MAX_TX_QS)
-+ netif_set_real_num_tx_queues(adapter->netdev,
-+ adapter->num_tx_qs);
-+
-+ be_cmd_req_native_mode(adapter);
-+
-+ cap_flags = en_flags = BE_IF_FLAGS_UNTAGGED |
-+ BE_IF_FLAGS_BROADCAST |
-+ BE_IF_FLAGS_MULTICAST;
-+
-+ if (be_physfn(adapter)) {
-+ if (adapter->function_caps & BE_FUNCTION_CAPS_RSS) {
-+ cap_flags |= BE_IF_FLAGS_RSS;
-+ en_flags |= BE_IF_FLAGS_RSS;
-+ }
-+ cap_flags |= BE_IF_FLAGS_MCAST_PROMISCUOUS |
-+ BE_IF_FLAGS_PROMISCUOUS;
-+ if (!lancer_A0_chip(adapter)) {
-+ cap_flags |= BE_IF_FLAGS_PASS_L3L4_ERRORS;
-+ en_flags |= BE_IF_FLAGS_PASS_L3L4_ERRORS;
-+ }
-+ }
-
- status = be_cmd_if_create(adapter, cap_flags, en_flags,
- netdev->dev_addr, false/* pmac_invalid */,
-- &adapter->if_handle, &adapter->pmac_id);
-+ &adapter->if_handle, &adapter->pmac_id, 0);
- if (status != 0)
- goto do_none;
-
-+ if (be_physfn(adapter)) {
-+ while (vf < adapter->num_vfs) {
-+ cap_flags = en_flags = BE_IF_FLAGS_UNTAGGED |
-+ BE_IF_FLAGS_BROADCAST;
-+ status = be_cmd_if_create(adapter, cap_flags,
-+ en_flags, mac, true,
-+ &adapter->vf_cfg[vf].vf_if_handle,
-+ NULL, vf+1);
-+ if (status) {
-+ dev_err(&adapter->pdev->dev,
-+ "Interface Create failed for VF %d\n", vf);
-+ goto if_destroy;
-+ }
-+ adapter->vf_cfg[vf].vf_pmac_id = BE_INVALID_PMAC_ID;
-+ vf++;
-+ }
-+ } else {
-+ status = be_cmd_mac_addr_query(adapter, mac,
-+ MAC_ADDRESS_TYPE_NETWORK, false, adapter->if_handle);
-+ if (!status) {
-+ memcpy(adapter->netdev->dev_addr, mac, ETH_ALEN);
-+ memcpy(adapter->netdev->perm_addr, mac, ETH_ALEN);
-+ }
-+ }
-+
- status = be_tx_queues_create(adapter);
- if (status != 0)
- goto if_destroy;
-@@ -1656,10 +2794,15 @@ static int be_setup(struct be_adapter *adapter)
- if (status != 0)
- goto tx_qs_destroy;
-
-+ /* Allow all priorities by default. A GRP5 evt may modify this */
-+ adapter->vlan_prio_bmap = 0xff;
-+
- status = be_mcc_queues_create(adapter);
- if (status != 0)
- goto rx_qs_destroy;
-
-+ adapter->link_speed = -1;
-+
- return 0;
-
- rx_qs_destroy:
-@@ -1667,158 +2810,392 @@ rx_qs_destroy:
- tx_qs_destroy:
- be_tx_queues_destroy(adapter);
- if_destroy:
-- be_cmd_if_destroy(adapter, adapter->if_handle);
-+ if (be_physfn(adapter)) {
-+ for (vf = 0; vf < adapter->num_vfs; vf++)
-+ if (adapter->vf_cfg[vf].vf_if_handle)
-+ be_cmd_if_destroy(adapter,
-+ adapter->vf_cfg[vf].vf_if_handle,
-+ vf + 1);
-+ }
-+ be_cmd_if_destroy(adapter, adapter->if_handle, 0);
- do_none:
- return status;
- }
-
- static int be_clear(struct be_adapter *adapter)
- {
-+ int vf;
-+
-+ if (be_physfn(adapter) && adapter->num_vfs)
-+ be_vf_eth_addr_rem(adapter);
-+
- be_mcc_queues_destroy(adapter);
- be_rx_queues_destroy(adapter);
- be_tx_queues_destroy(adapter);
-+ adapter->eq_next_idx = 0;
-
-- be_cmd_if_destroy(adapter, adapter->if_handle);
-+ if (be_physfn(adapter)) {
-+ for (vf = 0; vf < adapter->num_vfs; vf++)
-+ if (adapter->vf_cfg[vf].vf_if_handle)
-+ be_cmd_if_destroy(adapter,
-+ adapter->vf_cfg[vf].vf_if_handle, vf + 1);
-+ }
-+ be_cmd_if_destroy(adapter, adapter->if_handle, 0);
-
-+ /* tell fw we're done with firing cmds */
-+ be_cmd_fw_clean(adapter);
- return 0;
- }
-
--static int be_close(struct net_device *netdev)
-+static void be_cpy_drv_ver(struct be_adapter *adapter, void *va)
-+{
-+ struct mgmt_controller_attrib *attrib =
-+ (struct mgmt_controller_attrib *) ((u8*) va +
-+ sizeof(struct be_cmd_resp_hdr));
-+
-+ memcpy(attrib->hba_attribs.driver_version_string,
-+ DRV_VER, sizeof(DRV_VER));
-+ attrib->pci_bus_number = adapter->pdev->bus->number;
-+ attrib->pci_device_number = PCI_SLOT(adapter->pdev->devfn);
-+ return;
-+}
-+
-+#define IOCTL_COOKIE "SERVERENGINES CORP"
-+static int be_do_ioctl(struct net_device *netdev,
-+ struct ifreq *ifr, int cmd)
- {
- struct be_adapter *adapter = netdev_priv(netdev);
-- struct be_eq_obj *rx_eq = &adapter->rx_eq;
-- struct be_eq_obj *tx_eq = &adapter->tx_eq;
-- int vec;
-+ struct be_cmd_req_hdr req;
-+ struct be_cmd_resp_hdr *resp;
-+ void *data = ifr->ifr_data;
-+ void *ioctl_ptr;
-+ void *va;
-+ dma_addr_t dma;
-+ u32 req_size;
-+ int status, ret = 0;
-+ u8 cookie[32];
-+
-+ switch (cmd) {
-+ case SIOCDEVPRIVATE:
-+ if (copy_from_user(cookie, data, strlen(IOCTL_COOKIE)))
-+ return -EFAULT;
-+
-+ if (memcmp(cookie, IOCTL_COOKIE, strlen(IOCTL_COOKIE)))
-+ return -EINVAL;
-
-- cancel_delayed_work_sync(&adapter->work);
-+ ioctl_ptr = (u8 *)data + strlen(IOCTL_COOKIE);
-+ if (copy_from_user(&req, ioctl_ptr,
-+ sizeof(struct be_cmd_req_hdr)))
-+ return -EFAULT;
-
-- netif_stop_queue(netdev);
-- netif_carrier_off(netdev);
-- adapter->link_up = false;
-+ req_size = le32_to_cpu(req.request_length);
-+ if (req_size > 65536)
-+ return -EINVAL;
-
-- be_intr_set(adapter, false);
-+ req_size += sizeof(struct be_cmd_req_hdr);
-+ va = pci_alloc_consistent(adapter->pdev, req_size, &dma);
-+ if (!va)
-+ return -ENOMEM;
-+ if (copy_from_user(va, ioctl_ptr, req_size)) {
-+ ret = -EFAULT;
-+ break;
-+ }
-
-- if (adapter->msix_enabled) {
-- vec = be_msix_vec_get(adapter, tx_eq->q.id);
-- synchronize_irq(vec);
-- vec = be_msix_vec_get(adapter, rx_eq->q.id);
-- synchronize_irq(vec);
-- } else {
-- synchronize_irq(netdev->irq);
-+ status = be_cmd_pass_ext_ioctl(adapter, dma, req_size, va);
-+ if (status == -1) {
-+ ret = -EIO;
-+ break;
-+ }
-+
-+ resp = (struct be_cmd_resp_hdr *) va;
-+ if (!status) {
-+ if (req.opcode == OPCODE_COMMON_GET_CNTL_ATTRIBUTES)
-+ be_cpy_drv_ver(adapter, va);
-+ }
-+
-+ if (copy_to_user(ioctl_ptr, va, req_size)) {
-+ ret = -EFAULT;
-+ break;
-+ }
-+ break;
-+ default:
-+ return -EOPNOTSUPP;
- }
-- be_irq_unregister(adapter);
-
-- napi_disable(&rx_eq->napi);
-- napi_disable(&tx_eq->napi);
-+ if (va)
-+ pci_free_consistent(adapter->pdev, req_size, va, dma);
-+
-+ return ret;
-+}
-+
-+#ifdef CONFIG_NET_POLL_CONTROLLER
-+static void be_netpoll(struct net_device *netdev)
-+{
-+ struct be_adapter *adapter = netdev_priv(netdev);
-+ struct be_rx_obj *rxo;
-+ int i;
-
-- /* Wait for all pending tx completions to arrive so that
-- * all tx skbs are freed.
-- */
-- be_tx_compl_clean(adapter);
-+ event_handle(adapter, &adapter->tx_eq, false);
-+ for_all_rx_queues(adapter, rxo, i)
-+ event_handle(adapter, &rxo->rx_eq, true);
-+
-+ return;
-+}
-+#endif
-+
-+static int be_get_frag_header(struct skb_frag_struct *frag, void **mac_hdr,
-+ void **ip_hdr, void **tcpudp_hdr,
-+ u64 *hdr_flags, void *priv)
-+{
-+ struct ethhdr *eh;
-+ struct vlan_ethhdr *veh;
-+ struct iphdr *iph;
-+ u8 *va = page_address(frag->page) + frag->page_offset;
-+ unsigned long ll_hlen;
-+
-+ prefetch(va);
-+ eh = (struct ethhdr *)va;
-+ *mac_hdr = eh;
-+ ll_hlen = ETH_HLEN;
-+ if (eh->h_proto != htons(ETH_P_IP)) {
-+ if (eh->h_proto == htons(ETH_P_8021Q)) {
-+ veh = (struct vlan_ethhdr *)va;
-+ if (veh->h_vlan_encapsulated_proto != htons(ETH_P_IP))
-+ return -1;
-+
-+ ll_hlen += VLAN_HLEN;
-+ } else {
-+ return -1;
-+ }
-+ }
-+ *hdr_flags = LRO_IPV4;
-+ iph = (struct iphdr *)(va + ll_hlen);
-+ *ip_hdr = iph;
-+ if (iph->protocol != IPPROTO_TCP)
-+ return -1;
-+ *hdr_flags |= LRO_TCP;
-+ *tcpudp_hdr = (u8 *) (*ip_hdr) + (iph->ihl << 2);
-
- return 0;
- }
-
--#define FW_FILE_HDR_SIGN "ServerEngines Corp. "
-+static void be_lro_init(struct be_adapter *adapter, struct net_device *netdev)
-+{
-+ struct net_lro_mgr *lro_mgr;
-+ struct be_rx_obj *rxo;
-+ int i;
-+
-+ for_all_rx_queues(adapter, rxo, i) {
-+ lro_mgr = &rxo->lro_mgr;
-+ lro_mgr->dev = netdev;
-+ lro_mgr->features = LRO_F_NAPI;
-+ lro_mgr->ip_summed = CHECKSUM_UNNECESSARY;
-+ lro_mgr->ip_summed_aggr = CHECKSUM_UNNECESSARY;
-+ lro_mgr->max_desc = BE_MAX_LRO_DESCRIPTORS;
-+ lro_mgr->lro_arr = rxo->lro_desc;
-+ lro_mgr->get_frag_header = be_get_frag_header;
-+ lro_mgr->max_aggr = BE_MAX_FRAGS_PER_FRAME;
-+ }
-+
-+#ifdef NETIF_F_GRO
-+ netdev->features |= NETIF_F_GRO;
-+ adapter->gro_supported = true;
-+#endif
-+}
-+
-+#define FW_FILE_HDR_SIGN "ServerEngines Corp. "
- char flash_cookie[2][16] = {"*** SE FLAS",
- "H DIRECTORY *** "};
--static int be_flash_image(struct be_adapter *adapter,
-+
-+static bool be_flash_redboot(struct be_adapter *adapter,
-+ const u8 *p, u32 img_start, int image_size,
-+ int hdr_size)
-+{
-+ u32 crc_offset;
-+ u8 flashed_crc[4];
-+ int status;
-+
-+ crc_offset = hdr_size + img_start + image_size - 4;
-+
-+ p += crc_offset;
-+
-+ status = be_cmd_get_flash_crc(adapter, flashed_crc,
-+ (image_size - 4));
-+ if (status) {
-+ dev_err(&adapter->pdev->dev,
-+ "could not get crc from flash, not flashing redboot\n");
-+ return false;
-+ }
-+
-+ /*update redboot only if crc does not match*/
-+ if (!memcmp(flashed_crc, p, 4))
-+ return false;
-+ else
-+ return true;
-+}
-+
-+static bool phy_flashing_required(struct be_adapter *adapter)
-+{
-+ int status = 0;
-+ struct be_phy_info phy_info;
-+
-+ status = be_cmd_get_phy_info(adapter, &phy_info);
-+ if (status)
-+ return false;
-+ if ((phy_info.phy_type == TN_8022) &&
-+ (phy_info.interface_type == PHY_TYPE_BASET_10GB)) {
-+ return true;
-+ }
-+ return false;
-+}
-+
-+static int be_flash_data(struct be_adapter *adapter,
- const struct firmware *fw,
-- struct be_dma_mem *flash_cmd, u32 flash_type)
-+ struct be_dma_mem *flash_cmd, int num_of_images)
-+
- {
-- int status;
-- u32 flash_op, image_offset = 0, total_bytes, image_size = 0;
-+ int status = 0, i, filehdr_size = 0;
-+ u32 total_bytes = 0, flash_op;
- int num_bytes;
- const u8 *p = fw->data;
- struct be_cmd_write_flashrom *req = flash_cmd->va;
-+ struct flash_comp *pflashcomp;
-+ int num_comp;
-
-- switch (flash_type) {
-- case FLASHROM_TYPE_ISCSI_ACTIVE:
-- image_offset = FLASH_iSCSI_PRIMARY_IMAGE_START;
-- image_size = FLASH_IMAGE_MAX_SIZE;
-- break;
-- case FLASHROM_TYPE_ISCSI_BACKUP:
-- image_offset = FLASH_iSCSI_BACKUP_IMAGE_START;
-- image_size = FLASH_IMAGE_MAX_SIZE;
-- break;
-- case FLASHROM_TYPE_FCOE_FW_ACTIVE:
-- image_offset = FLASH_FCoE_PRIMARY_IMAGE_START;
-- image_size = FLASH_IMAGE_MAX_SIZE;
-- break;
-- case FLASHROM_TYPE_FCOE_FW_BACKUP:
-- image_offset = FLASH_FCoE_BACKUP_IMAGE_START;
-- image_size = FLASH_IMAGE_MAX_SIZE;
-- break;
-- case FLASHROM_TYPE_BIOS:
-- image_offset = FLASH_iSCSI_BIOS_START;
-- image_size = FLASH_BIOS_IMAGE_MAX_SIZE;
-- break;
-- case FLASHROM_TYPE_FCOE_BIOS:
-- image_offset = FLASH_FCoE_BIOS_START;
-- image_size = FLASH_BIOS_IMAGE_MAX_SIZE;
-- break;
-- case FLASHROM_TYPE_PXE_BIOS:
-- image_offset = FLASH_PXE_BIOS_START;
-- image_size = FLASH_BIOS_IMAGE_MAX_SIZE;
-- break;
-- default:
-- return 0;
-+ struct flash_comp gen3_flash_types[10] = {
-+ { FLASH_iSCSI_PRIMARY_IMAGE_START_g3, IMG_TYPE_ISCSI_ACTIVE,
-+ FLASH_IMAGE_MAX_SIZE_g3},
-+ { FLASH_REDBOOT_START_g3, IMG_TYPE_REDBOOT,
-+ FLASH_REDBOOT_IMAGE_MAX_SIZE_g3},
-+ { FLASH_iSCSI_BIOS_START_g3, IMG_TYPE_BIOS,
-+ FLASH_BIOS_IMAGE_MAX_SIZE_g3},
-+ { FLASH_PXE_BIOS_START_g3, IMG_TYPE_PXE_BIOS,
-+ FLASH_BIOS_IMAGE_MAX_SIZE_g3},
-+ { FLASH_FCoE_BIOS_START_g3, IMG_TYPE_FCOE_BIOS,
-+ FLASH_BIOS_IMAGE_MAX_SIZE_g3},
-+ { FLASH_iSCSI_BACKUP_IMAGE_START_g3, IMG_TYPE_ISCSI_BACKUP,
-+ FLASH_IMAGE_MAX_SIZE_g3},
-+ { FLASH_FCoE_PRIMARY_IMAGE_START_g3, IMG_TYPE_FCOE_FW_ACTIVE,
-+ FLASH_IMAGE_MAX_SIZE_g3},
-+ { FLASH_FCoE_BACKUP_IMAGE_START_g3, IMG_TYPE_FCOE_FW_BACKUP,
-+ FLASH_IMAGE_MAX_SIZE_g3},
-+ { FLASH_NCSI_START_g3, IMG_TYPE_NCSI_FW,
-+ FLASH_NCSI_IMAGE_MAX_SIZE_g3},
-+ { FLASH_PHY_FW_START_g3, IMG_TYPE_PHY_FW,
-+ FLASH_PHY_FW_IMAGE_MAX_SIZE_g3}
-+ };
-+ struct flash_comp gen2_flash_types[8] = {
-+ { FLASH_iSCSI_PRIMARY_IMAGE_START_g2, IMG_TYPE_ISCSI_ACTIVE,
-+ FLASH_IMAGE_MAX_SIZE_g2},
-+ { FLASH_REDBOOT_START_g2, IMG_TYPE_REDBOOT,
-+ FLASH_REDBOOT_IMAGE_MAX_SIZE_g2},
-+ { FLASH_iSCSI_BIOS_START_g2, IMG_TYPE_BIOS,
-+ FLASH_BIOS_IMAGE_MAX_SIZE_g2},
-+ { FLASH_PXE_BIOS_START_g2, IMG_TYPE_PXE_BIOS,
-+ FLASH_BIOS_IMAGE_MAX_SIZE_g2},
-+ { FLASH_FCoE_BIOS_START_g2, IMG_TYPE_FCOE_BIOS,
-+ FLASH_BIOS_IMAGE_MAX_SIZE_g2},
-+ { FLASH_iSCSI_BACKUP_IMAGE_START_g2, IMG_TYPE_ISCSI_BACKUP,
-+ FLASH_IMAGE_MAX_SIZE_g2},
-+ { FLASH_FCoE_PRIMARY_IMAGE_START_g2, IMG_TYPE_FCOE_FW_ACTIVE,
-+ FLASH_IMAGE_MAX_SIZE_g2},
-+ { FLASH_FCoE_BACKUP_IMAGE_START_g2, IMG_TYPE_FCOE_FW_BACKUP,
-+ FLASH_IMAGE_MAX_SIZE_g2}
-+ };
-+ if (adapter->generation == BE_GEN3) {
-+ pflashcomp = gen3_flash_types;
-+ filehdr_size = sizeof(struct flash_file_hdr_g3);
-+ num_comp = ARRAY_SIZE(gen3_flash_types);
-+ } else {
-+ pflashcomp = gen2_flash_types;
-+ filehdr_size = sizeof(struct flash_file_hdr_g2);
-+ num_comp = ARRAY_SIZE(gen2_flash_types);
- }
-+ for (i = 0; i < num_comp; i++) {
-+ if ((pflashcomp[i].optype == IMG_TYPE_NCSI_FW) &&
-+ memcmp(adapter->fw_ver, "3.102.148.0", 11) < 0)
-+ continue;
-+ if (pflashcomp[i].optype == IMG_TYPE_PHY_FW) {
-+ if (!phy_flashing_required(adapter))
-+ continue;
-+ }
-+ if ((pflashcomp[i].optype == IMG_TYPE_REDBOOT) &&
-+ (!be_flash_redboot(adapter, fw->data,
-+ pflashcomp[i].offset, pflashcomp[i].size, filehdr_size +
-+ (num_of_images * sizeof(struct image_hdr)))))
-+ continue;
-
-- p += sizeof(struct flash_file_hdr) + image_offset;
-- if (p + image_size > fw->data + fw->size)
-- return -1;
--
-- total_bytes = image_size;
--
-- while (total_bytes) {
-- if (total_bytes > 32*1024)
-- num_bytes = 32*1024;
-- else
-- num_bytes = total_bytes;
-- total_bytes -= num_bytes;
--
-- if (!total_bytes)
-- flash_op = FLASHROM_OPER_FLASH;
-- else
-- flash_op = FLASHROM_OPER_SAVE;
-- memcpy(req->params.data_buf, p, num_bytes);
-- p += num_bytes;
-- status = be_cmd_write_flashrom(adapter, flash_cmd,
-- flash_type, flash_op, num_bytes);
-- if (status) {
-- dev_err(&adapter->pdev->dev,
-- "cmd to write to flash rom failed. type/op %d/%d\n",
-- flash_type, flash_op);
-+ p = fw->data;
-+ p += filehdr_size + pflashcomp[i].offset
-+ + (num_of_images * sizeof(struct image_hdr));
-+ if (p + pflashcomp[i].size > fw->data + fw->size)
- return -1;
-+ total_bytes = pflashcomp[i].size;
-+ while (total_bytes) {
-+ if (total_bytes > 32*1024)
-+ num_bytes = 32*1024;
-+ else
-+ num_bytes = total_bytes;
-+ total_bytes -= num_bytes;
-+ if (!total_bytes) {
-+ if (pflashcomp[i].optype == IMG_TYPE_PHY_FW)
-+ flash_op = FLASHROM_OPER_PHY_FLASH;
-+ else
-+ flash_op = FLASHROM_OPER_FLASH;
-+ } else {
-+ if (pflashcomp[i].optype == IMG_TYPE_PHY_FW)
-+ flash_op = FLASHROM_OPER_PHY_SAVE;
-+ else
-+ flash_op = FLASHROM_OPER_SAVE;
-+ }
-+ memcpy(req->params.data_buf, p, num_bytes);
-+ p += num_bytes;
-+ status = be_cmd_write_flashrom(adapter, flash_cmd,
-+ pflashcomp[i].optype, flash_op, num_bytes);
-+ if (status) {
-+ if ((status == ILLEGAL_IOCTL_REQ) &&
-+ (pflashcomp[i].optype ==
-+ IMG_TYPE_PHY_FW))
-+ break;
-+ dev_err(&adapter->pdev->dev,
-+ "cmd to write to flash rom failed.\n");
-+ return -1;
-+ }
-+ yield();
- }
-- yield();
- }
--
- return 0;
- }
-
-+static int get_ufigen_type(struct flash_file_hdr_g2 *fhdr)
-+{
-+ if (fhdr == NULL)
-+ return 0;
-+ if (fhdr->build[0] == '3')
-+ return BE_GEN3;
-+ else if (fhdr->build[0] == '2')
-+ return BE_GEN2;
-+ else
-+ return 0;
-+}
-+
- int be_load_fw(struct be_adapter *adapter, u8 *func)
- {
- char fw_file[ETHTOOL_FLASH_MAX_FILENAME];
- const struct firmware *fw;
-- struct flash_file_hdr *fhdr;
-- struct flash_section_info *fsec = NULL;
-+ struct flash_file_hdr_g2 *fhdr;
-+ struct flash_file_hdr_g3 *fhdr3;
-+ struct image_hdr *img_hdr_ptr = NULL;
- struct be_dma_mem flash_cmd;
-- int status;
-+ int status, i = 0, num_imgs = 0;
- const u8 *p;
-- bool entry_found = false;
-- int flash_type;
-- char fw_ver[FW_VER_LEN];
-- char fw_cfg;
-
-- status = be_cmd_get_fw_ver(adapter, fw_ver);
-- if (status)
-- return status;
-+ if (!netif_running(adapter->netdev)) {
-+ dev_err(&adapter->pdev->dev,
-+ "Firmware load not allowed (interface is down)\n");
-+ return -1;
-+ }
-
-- fw_cfg = *(fw_ver + 2);
-- if (fw_cfg == '0')
-- fw_cfg = '1';
- strcpy(fw_file, func);
-
- status = request_firmware(&fw, fw_file, &adapter->pdev->dev);
-@@ -1826,34 +3203,9 @@ int be_load_fw(struct be_adapter *adapter, u8 *func)
- goto fw_exit;
-
- p = fw->data;
-- fhdr = (struct flash_file_hdr *) p;
-- if (memcmp(fhdr->sign, FW_FILE_HDR_SIGN, strlen(FW_FILE_HDR_SIGN))) {
-- dev_err(&adapter->pdev->dev,
-- "Firmware(%s) load error (signature did not match)\n",
-- fw_file);
-- status = -1;
-- goto fw_exit;
-- }
--
-+ fhdr = (struct flash_file_hdr_g2 *) p;
- dev_info(&adapter->pdev->dev, "Flashing firmware file %s\n", fw_file);
-
-- p += sizeof(struct flash_file_hdr);
-- while (p < (fw->data + fw->size)) {
-- fsec = (struct flash_section_info *)p;
-- if (!memcmp(flash_cookie, fsec->cookie, sizeof(flash_cookie))) {
-- entry_found = true;
-- break;
-- }
-- p += 32;
-- }
--
-- if (!entry_found) {
-- status = -1;
-- dev_err(&adapter->pdev->dev,
-- "Flash cookie not found in firmware image\n");
-- goto fw_exit;
-- }
--
- flash_cmd.size = sizeof(struct be_cmd_write_flashrom) + 32*1024;
- flash_cmd.va = pci_alloc_consistent(adapter->pdev, flash_cmd.size,
- &flash_cmd.dma);
-@@ -1864,12 +3216,25 @@ int be_load_fw(struct be_adapter *adapter, u8 *func)
- goto fw_exit;
- }
-
-- for (flash_type = FLASHROM_TYPE_ISCSI_ACTIVE;
-- flash_type <= FLASHROM_TYPE_FCOE_FW_BACKUP; flash_type++) {
-- status = be_flash_image(adapter, fw, &flash_cmd,
-- flash_type);
-- if (status)
-- break;
-+ if ((adapter->generation == BE_GEN3) &&
-+ (get_ufigen_type(fhdr) == BE_GEN3)) {
-+ fhdr3 = (struct flash_file_hdr_g3 *) fw->data;
-+ num_imgs = le32_to_cpu(fhdr3->num_imgs);
-+ for (i = 0; i < num_imgs; i++) {
-+ img_hdr_ptr = (struct image_hdr *) (fw->data +
-+ (sizeof(struct flash_file_hdr_g3) +
-+ i * sizeof(struct image_hdr)));
-+ if (le32_to_cpu(img_hdr_ptr->imageid) == 1)
-+ status = be_flash_data(adapter, fw, &flash_cmd,
-+ num_imgs);
-+ }
-+ } else if ((adapter->generation == BE_GEN2) &&
-+ (get_ufigen_type(fhdr) == BE_GEN2)) {
-+ status = be_flash_data(adapter, fw, &flash_cmd, 0);
-+ } else {
-+ dev_err(&adapter->pdev->dev,
-+ "UFI and Interface are not compatible for flashing\n");
-+ status = -1;
- }
-
- pci_free_consistent(adapter->pdev, flash_cmd.size, flash_cmd.va,
-@@ -1879,14 +3244,14 @@ int be_load_fw(struct be_adapter *adapter, u8 *func)
- goto fw_exit;
- }
-
-- dev_info(&adapter->pdev->dev, "Firmware flashed succesfully\n");
-+ dev_info(&adapter->pdev->dev, "Firmware flashed successfully\n");
-
- fw_exit:
- release_firmware(fw);
- return status;
- }
-
--static struct net_device_ops be_netdev_ops = {
-+static net_device_ops_no_const be_netdev_ops = {
- .ndo_open = be_open,
- .ndo_stop = be_close,
- .ndo_start_xmit = be_xmit,
-@@ -1898,15 +3263,32 @@ static struct net_device_ops be_netdev_ops = {
- .ndo_vlan_rx_register = be_vlan_register,
- .ndo_vlan_rx_add_vid = be_vlan_add_vid,
- .ndo_vlan_rx_kill_vid = be_vlan_rem_vid,
-+#ifdef HAVE_SRIOV_CONFIG
-+ .ndo_set_vf_mac = be_set_vf_mac,
-+ .ndo_set_vf_vlan = be_set_vf_vlan,
-+ .ndo_set_vf_tx_rate = be_set_vf_tx_rate,
-+ .ndo_get_vf_config = be_get_vf_config,
-+#endif
-+ .ndo_do_ioctl = be_do_ioctl,
-+#ifdef CONFIG_NET_POLL_CONTROLLER
-+ .ndo_poll_controller = be_netpoll,
-+#endif
- };
-
--static void be_netdev_init(struct net_device *netdev)
-+static int be_netdev_init(struct net_device *netdev)
- {
- struct be_adapter *adapter = netdev_priv(netdev);
-+ struct be_rx_obj *rxo;
-+ int i, status = 0;
-
- netdev->features |= NETIF_F_SG | NETIF_F_HW_VLAN_RX | NETIF_F_TSO |
-- NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_FILTER | NETIF_F_HW_CSUM |
-- NETIF_F_GRO;
-+ NETIF_F_HW_VLAN_TX | NETIF_F_HW_CSUM | NETIF_F_TSO6;
-+
-+ netdev->vlan_features |= NETIF_F_SG | NETIF_F_TSO | NETIF_F_TSO6 |
-+ NETIF_F_HW_CSUM;
-+
-+ netdev->features |= NETIF_F_VLAN_SG | NETIF_F_VLAN_TSO |
-+ NETIF_F_VLAN_CSUM;
-
- netdev->flags |= IFF_MULTICAST;
-
-@@ -1918,17 +3300,30 @@ static void be_netdev_init(struct net_device *netdev)
-
- netif_set_gso_max_size(netdev, 65535);
-
-+ if (adapter->flags & BE_FLAGS_DCBX)
-+ be_netdev_ops.ndo_select_queue = be_select_queue;
- BE_SET_NETDEV_OPS(netdev, &be_netdev_ops);
--
-+
- SET_ETHTOOL_OPS(netdev, &be_ethtool_ops);
-
-- netif_napi_add(netdev, &adapter->rx_eq.napi, be_poll_rx,
-- BE_NAPI_WEIGHT);
-- netif_napi_add(netdev, &adapter->tx_eq.napi, be_poll_tx_mcc,
-+ be_lro_init(adapter, netdev);
-+
-+ for_all_rx_queues(adapter, rxo, i) {
-+ status = be_netif_napi_add(netdev, &rxo->rx_eq.napi, be_poll_rx,
-+ BE_NAPI_WEIGHT);
-+ if (status) {
-+ dev_err(&adapter->pdev->dev, "dummy netdev alloc fail"
-+ "for rxo:%d\n", i);
-+ return status;
-+ }
-+ }
-+ status = be_netif_napi_add(netdev, &adapter->tx_eq.napi, be_poll_tx_mcc,
- BE_NAPI_WEIGHT);
-+ if (status)
-+ dev_err(&adapter->pdev->dev, "dummy netdev alloc fail"
-+ "for tx\n");
-
-- netif_carrier_off(netdev);
-- netif_stop_queue(netdev);
-+ return status;
- }
-
- static void be_unmap_pci_bars(struct be_adapter *adapter)
-@@ -1937,37 +3332,62 @@ static void be_unmap_pci_bars(struct be_adapter *adapter)
- iounmap(adapter->csr);
- if (adapter->db)
- iounmap(adapter->db);
-- if (adapter->pcicfg)
-+ if (adapter->pcicfg && be_physfn(adapter))
- iounmap(adapter->pcicfg);
- }
-
- static int be_map_pci_bars(struct be_adapter *adapter)
- {
-+ struct pci_dev *pdev = adapter->pdev;
- u8 __iomem *addr;
-- int pcicfg_reg;
-+ int pcicfg_reg, db_reg;
-
-- addr = ioremap_nocache(pci_resource_start(adapter->pdev, 2),
-- pci_resource_len(adapter->pdev, 2));
-- if (addr == NULL)
-- return -ENOMEM;
-- adapter->csr = addr;
-+ if (lancer_chip(adapter)) {
-+ addr = ioremap_nocache(pci_resource_start(pdev, 0),
-+ pci_resource_len(adapter->pdev, 0));
-+ if (addr == NULL)
-+ return -ENOMEM;
-+ adapter->db = addr;
-+ return 0;
-+ }
-
-- addr = ioremap_nocache(pci_resource_start(adapter->pdev, 4),
-- 128 * 1024);
-- if (addr == NULL)
-- goto pci_map_err;
-- adapter->db = addr;
-+ if (be_physfn(adapter)) {
-+ addr = ioremap_nocache(pci_resource_start(pdev, 2),
-+ pci_resource_len(pdev, 2));
-+ if (addr == NULL)
-+ return -ENOMEM;
-+ adapter->csr = addr;
-+ adapter->netdev->mem_start = pci_resource_start(pdev, 2);
-+ adapter->netdev->mem_end = pci_resource_start(pdev, 2) +
-+ pci_resource_len(pdev, 2);
-+ }
-
-- if (adapter->generation == BE_GEN2)
-+ if (adapter->generation == BE_GEN2) {
- pcicfg_reg = 1;
-- else
-+ db_reg = 4;
-+ } else {
- pcicfg_reg = 0;
-+ if (be_physfn(adapter))
-+ db_reg = 4;
-+ else
-+ db_reg = 0;
-+ }
-
-- addr = ioremap_nocache(pci_resource_start(adapter->pdev, pcicfg_reg),
-- pci_resource_len(adapter->pdev, pcicfg_reg));
-+ addr = ioremap_nocache(pci_resource_start(pdev, db_reg),
-+ pci_resource_len(pdev, db_reg));
- if (addr == NULL)
- goto pci_map_err;
-- adapter->pcicfg = addr;
-+ adapter->db = addr;
-+
-+ if (be_physfn(adapter)) {
-+ addr = ioremap_nocache(
-+ pci_resource_start(pdev, pcicfg_reg),
-+ pci_resource_len(pdev, pcicfg_reg));
-+ if (addr == NULL)
-+ goto pci_map_err;
-+ adapter->pcicfg = addr;
-+ } else
-+ adapter->pcicfg = adapter->db + SRIOV_VF_PCICFG_OFFSET;
-
- return 0;
- pci_map_err:
-@@ -1985,40 +3405,69 @@ static void be_ctrl_cleanup(struct be_adapter *adapter)
- if (mem->va)
- pci_free_consistent(adapter->pdev, mem->size,
- mem->va, mem->dma);
-+
-+ mem = &adapter->rx_filter;
-+ if (mem->va)
-+ pci_free_consistent(adapter->pdev, mem->size,
-+ mem->va, mem->dma);
- }
-
- static int be_ctrl_init(struct be_adapter *adapter)
- {
- struct be_dma_mem *mbox_mem_alloc = &adapter->mbox_mem_alloced;
- struct be_dma_mem *mbox_mem_align = &adapter->mbox_mem;
-+ struct be_dma_mem *rx_filter = &adapter->rx_filter;
- int status;
-
- status = be_map_pci_bars(adapter);
- if (status)
-- return status;
-+ goto done;
-
- mbox_mem_alloc->size = sizeof(struct be_mcc_mailbox) + 16;
- mbox_mem_alloc->va = pci_alloc_consistent(adapter->pdev,
- mbox_mem_alloc->size, &mbox_mem_alloc->dma);
- if (!mbox_mem_alloc->va) {
-- be_unmap_pci_bars(adapter);
-- return -1;
-+ status = -ENOMEM;
-+ goto unmap_pci_bars;
- }
-+
- mbox_mem_align->size = sizeof(struct be_mcc_mailbox);
- mbox_mem_align->va = PTR_ALIGN(mbox_mem_alloc->va, 16);
- mbox_mem_align->dma = PTR_ALIGN(mbox_mem_alloc->dma, 16);
- memset(mbox_mem_align->va, 0, sizeof(struct be_mcc_mailbox));
-- spin_lock_init(&adapter->mbox_lock);
-+
-+ rx_filter->size = sizeof(struct be_cmd_req_rx_filter);
-+ rx_filter->va = pci_alloc_consistent(adapter->pdev, rx_filter->size,
-+ &rx_filter->dma);
-+ if (rx_filter->va == NULL) {
-+ status = -ENOMEM;
-+ goto free_mbox;
-+ }
-+ memset(rx_filter->va, 0, rx_filter->size);
-+
-+ mutex_init(&adapter->mbox_lock);
- spin_lock_init(&adapter->mcc_lock);
- spin_lock_init(&adapter->mcc_cq_lock);
-
-+ init_completion(&adapter->flash_compl);
-+
-+ PCI_SAVE_STATE(adapter->pdev);
- return 0;
-+
-+free_mbox:
-+ pci_free_consistent(adapter->pdev, mbox_mem_alloc->size,
-+ mbox_mem_alloc->va, mbox_mem_alloc->dma);
-+
-+unmap_pci_bars:
-+ be_unmap_pci_bars(adapter);
-+
-+done:
-+ return status;
- }
-
- static void be_stats_cleanup(struct be_adapter *adapter)
- {
-- struct be_stats_obj *stats = &adapter->stats;
-- struct be_dma_mem *cmd = &stats->cmd;
-+ struct be_dma_mem *cmd = &adapter->stats_cmd;
-
- if (cmd->va)
- pci_free_consistent(adapter->pdev, cmd->size,
-@@ -2027,10 +3476,12 @@ static void be_stats_cleanup(struct be_adapter *adapter)
-
- static int be_stats_init(struct be_adapter *adapter)
- {
-- struct be_stats_obj *stats = &adapter->stats;
-- struct be_dma_mem *cmd = &stats->cmd;
-+ struct be_dma_mem *cmd = &adapter->stats_cmd;
-
-- cmd->size = sizeof(struct be_cmd_req_get_stats);
-+ if (adapter->generation == BE_GEN2)
-+ cmd->size = sizeof(struct be_cmd_req_get_stats_v0);
-+ else
-+ cmd->size = sizeof(struct be_cmd_req_get_stats_v1);
- cmd->va = pci_alloc_consistent(adapter->pdev, cmd->size, &cmd->dma);
- if (cmd->va == NULL)
- return -1;
-@@ -2041,9 +3492,17 @@ static int be_stats_init(struct be_adapter *adapter)
- static void __devexit be_remove(struct pci_dev *pdev)
- {
- struct be_adapter *adapter = pci_get_drvdata(pdev);
-+
- if (!adapter)
- return;
-
-+ cancel_delayed_work_sync(&adapter->work);
-+
-+#ifdef CONFIG_PALAU
-+ be_sysfs_remove_group(adapter);
-+#endif
-+
-+ /* be_close() gets called if the device is open by unregister */
- unregister_netdev(adapter->netdev);
-
- be_clear(adapter);
-@@ -2052,36 +3511,203 @@ static void __devexit be_remove(struct pci_dev *pdev)
-
- be_ctrl_cleanup(adapter);
-
-- if (adapter->msix_enabled) {
-- pci_disable_msix(adapter->pdev);
-- adapter->msix_enabled = false;
-- }
-+ kfree(adapter->vf_cfg);
-+ be_sriov_disable(adapter);
-+
-+ be_msix_disable(adapter);
-
- pci_set_drvdata(pdev, NULL);
- pci_release_regions(pdev);
- pci_disable_device(pdev);
--
-+ be_netif_napi_del(adapter->netdev);
- free_netdev(adapter->netdev);
- }
-
--static int be_hw_up(struct be_adapter *adapter)
-+static void be_pcie_slot_check(struct be_adapter *adapter)
-+{
-+ u32 curr, max, width, max_wd, speed, max_sp;
-+
-+ pci_read_config_dword(adapter->pdev, PCICFG_PCIE_LINK_STATUS_OFFSET,
-+ &curr);
-+ width = (curr >> PCIE_LINK_STATUS_NEG_WIDTH_SHIFT) &
-+ PCIE_LINK_STATUS_NEG_WIDTH_MASK;
-+ speed = (curr >> PCIE_LINK_STATUS_SPEED_SHIFT) &
-+ PCIE_LINK_STATUS_SPEED_MASK;
-+
-+ pci_read_config_dword(adapter->pdev, PCICFG_PCIE_LINK_CAP_OFFSET,
-+ &max);
-+ max_wd = (max >> PCIE_LINK_CAP_MAX_WIDTH_SHIFT) &
-+ PCIE_LINK_CAP_MAX_WIDTH_MASK;
-+ max_sp = (max >> PCIE_LINK_CAP_MAX_SPEED_SHIFT) &
-+ PCIE_LINK_CAP_MAX_SPEED_MASK;
-+
-+ if (width < max_wd || speed < max_sp)
-+ dev_warn(&adapter->pdev->dev,
-+ "Found network device in a Gen%s x%d PCIe slot. It "
-+ "should be in a Gen2 x%d slot for best performance\n",
-+ speed < max_sp ? "1" : "2", width, max_wd);
-+}
-+
-+static int be_get_ioctl_version(char *fw_version) {
-+ char *str[4];
-+ int i;
-+ int val[4];
-+ char *endptr;
-+
-+ if(!fw_version)
-+ return 0;
-+ for(i=0; i<3; i++) {
-+ str[i] = strsep(&fw_version, ".");
-+ val[i] = simple_strtol(str[i], &endptr, 10);
-+ }
-+
-+ if (val[0]>4 || (val[0]>3 && val[2]>143))
-+ return 1;
-+ return 0;
-+}
-+
-+static int be_get_port_names(struct be_adapter *adapter)
- {
- int status;
-+ int ver;
-
-- status = be_cmd_POST(adapter);
-+ status = be_cmd_get_fw_ver(adapter,
-+ adapter->fw_ver, NULL);
- if (status)
- return status;
-+ ver = be_get_ioctl_version(adapter->fw_ver);
-+ if (ver && (adapter->generation == BE_GEN3))
-+ status = be_cmd_query_port_names_v1(adapter,
-+ adapter->port_name);
-+ else
-+ status = be_cmd_query_port_names_v0(adapter,
-+ adapter->port_name);
-+ return status;
-+}
-
-- status = be_cmd_reset_function(adapter);
-+static int be_get_config(struct be_adapter *adapter)
-+{
-+ int status;
-+ u8 mac[ETH_ALEN];
-+
-+ status = be_cmd_query_fw_cfg(adapter, &adapter->port_num,
-+ &adapter->function_mode,
-+ &adapter->function_caps);
- if (status)
- return status;
-
-- status = be_cmd_get_fw_ver(adapter, adapter->fw_ver);
-+ status = be_cmd_get_cntl_attributes(adapter);
- if (status)
- return status;
-
-- status = be_cmd_query_fw_cfg(adapter,
-- &adapter->port_num, &adapter->cap);
-+ memset(mac, 0, ETH_ALEN);
-+ be_pcie_slot_check(adapter);
-+
-+ if (be_physfn(adapter)) {
-+ status = be_cmd_mac_addr_query(adapter, mac,
-+ MAC_ADDRESS_TYPE_NETWORK, true /*permanent */, 0);
-+
-+ if (status)
-+ return status;
-+
-+ if (!is_valid_ether_addr(mac))
-+ return -EADDRNOTAVAIL;
-+
-+ memcpy(adapter->netdev->dev_addr, mac, ETH_ALEN);
-+ memcpy(adapter->netdev->perm_addr, mac, ETH_ALEN);
-+ }
-+
-+ if (adapter->function_mode & FLEX10_MODE)
-+ adapter->max_vlans = BE_NUM_VLANS_SUPPORTED/8;
-+ else
-+ adapter->max_vlans = BE_NUM_VLANS_SUPPORTED;
-+
-+ return 0;
-+}
-+
-+static int be_dev_family_check(struct be_adapter *adapter)
-+{
-+ struct pci_dev *pdev = adapter->pdev;
-+ u32 sli_intf = 0, if_type;
-+
-+ switch (pdev->device) {
-+ case BE_DEVICE_ID1:
-+ case OC_DEVICE_ID1:
-+ adapter->generation = BE_GEN2;
-+ break;
-+ case BE_DEVICE_ID2:
-+ case OC_DEVICE_ID2:
-+ adapter->generation = BE_GEN3;
-+ break;
-+ case OC_DEVICE_ID3:
-+ pci_read_config_dword(pdev, SLI_INTF_REG_OFFSET, &sli_intf);
-+ if_type = (sli_intf & SLI_INTF_IF_TYPE_MASK) >>
-+ SLI_INTF_IF_TYPE_SHIFT;
-+
-+ if (((sli_intf & SLI_INTF_VALID_MASK) != SLI_INTF_VALID) ||
-+ if_type != 0x02) {
-+ dev_err(&pdev->dev, "SLI_INTF reg val is not valid\n");
-+ return -EINVAL;
-+ }
-+ if (num_vfs > 0) {
-+ dev_err(&pdev->dev, "VFs not supported\n");
-+ return -EINVAL;
-+ }
-+ adapter->sli_family = ((sli_intf & SLI_INTF_FAMILY_MASK) >>
-+ SLI_INTF_FAMILY_SHIFT);
-+ adapter->generation = BE_GEN3;
-+ break;
-+ default:
-+ adapter->generation = 0;
-+ }
-+ return 0;
-+}
-+
-+static int lancer_wait_ready(struct be_adapter *adapter)
-+{
-+#define SLIPORT_READY_TIMEOUT 500
-+ u32 sliport_status;
-+ int status = 0, i;
-+
-+ for (i = 0; i < SLIPORT_READY_TIMEOUT; i++) {
-+ sliport_status = ioread32(adapter->db + SLIPORT_STATUS_OFFSET);
-+ if (sliport_status & SLIPORT_STATUS_RDY_MASK)
-+ break;
-+
-+ msleep(20);
-+ }
-+
-+ if (i == SLIPORT_READY_TIMEOUT)
-+ status = -1;
-+
-+ return status;
-+}
-+
-+static int lancer_test_and_set_rdy_state(struct be_adapter *adapter)
-+{
-+ int status;
-+ u32 sliport_status, err, reset_needed;
-+ status = lancer_wait_ready(adapter);
-+ if (!status) {
-+ sliport_status = ioread32(adapter->db + SLIPORT_STATUS_OFFSET);
-+ err = sliport_status & SLIPORT_STATUS_ERR_MASK;
-+ reset_needed = sliport_status & SLIPORT_STATUS_RN_MASK;
-+ if (err && reset_needed) {
-+ iowrite32(SLI_PORT_CONTROL_IP_MASK,
-+ adapter->db + SLIPORT_CONTROL_OFFSET);
-+
-+ /* check adapter has corrected the error */
-+ status = lancer_wait_ready(adapter);
-+ sliport_status = ioread32(adapter->db +
-+ SLIPORT_STATUS_OFFSET);
-+ sliport_status &= (SLIPORT_STATUS_ERR_MASK |
-+ SLIPORT_STATUS_RN_MASK);
-+ if (status || sliport_status)
-+ status = -1;
-+ } else if (err || reset_needed) {
-+ status = -1;
-+ }
-+ }
- return status;
- }
-
-@@ -2091,7 +3717,7 @@ static int __devinit be_probe(struct pci_dev *pdev,
- int status = 0;
- struct be_adapter *adapter;
- struct net_device *netdev;
-- u8 mac[ETH_ALEN];
-+ u32 en;
-
- status = pci_enable_device(pdev);
- if (status)
-@@ -2102,31 +3728,22 @@ static int __devinit be_probe(struct pci_dev *pdev,
- goto disable_dev;
- pci_set_master(pdev);
-
-- netdev = alloc_etherdev(sizeof(struct be_adapter));
-+ netdev = alloc_etherdev_mq(sizeof(struct be_adapter), MAX_TX_QS);
- if (netdev == NULL) {
- status = -ENOMEM;
- goto rel_reg;
- }
- adapter = netdev_priv(netdev);
-
-- switch (pdev->device) {
-- case BE_DEVICE_ID1:
-- case OC_DEVICE_ID1:
-- adapter->generation = BE_GEN2;
-- break;
-- case BE_DEVICE_ID2:
-- case OC_DEVICE_ID2:
-- adapter->generation = BE_GEN3;
-- break;
-- default:
-- adapter->generation = 0;
-- }
--
- adapter->pdev = pdev;
-+
-+ status = be_dev_family_check(adapter);
-+ if (status)
-+ goto free_netdev;
-+
- pci_set_drvdata(pdev, adapter);
- adapter->netdev = netdev;
--
-- be_msix_enable(adapter);
-+ SET_NETDEV_DEV(netdev, &pdev->dev);
-
- status = pci_set_dma_mask(pdev, DMA_BIT_MASK(64));
- if (!status) {
-@@ -2139,46 +3756,150 @@ static int __devinit be_probe(struct pci_dev *pdev,
- }
- }
-
-+ be_sriov_enable(adapter);
-+ if (adapter->num_vfs > 0) {
-+ adapter->vf_cfg = kcalloc(adapter->num_vfs,
-+ sizeof(struct be_vf_cfg), GFP_KERNEL);
-+
-+ if (!adapter->vf_cfg)
-+ goto free_netdev;
-+ }
-+
- status = be_ctrl_init(adapter);
- if (status)
-- goto free_netdev;
-+ goto free_vf_cfg;
-+
-+ if (lancer_chip(adapter)) {
-+ status = lancer_test_and_set_rdy_state(adapter);
-+ if (status) {
-+ dev_err(&pdev->dev, "Adapter in non recoverable error\n");
-+ goto ctrl_clean;
-+ }
-+ }
-+
-+ /* sync up with fw's ready state */
-+ if (be_physfn(adapter)) {
-+ status = be_cmd_POST(adapter);
-+ if (status)
-+ goto ctrl_clean;
-+ }
-+
-+ /* tell fw we're ready to fire cmds */
-+ status = be_cmd_fw_init(adapter);
-+ if (status)
-+ goto ctrl_clean;
-+
-+ status = be_cmd_reset_function(adapter);
-+ if (status)
-+ goto ctrl_clean;
-
- status = be_stats_init(adapter);
- if (status)
- goto ctrl_clean;
-
-- status = be_hw_up(adapter);
-+ status = be_get_config(adapter);
- if (status)
- goto stats_clean;
-
-- status = be_cmd_mac_addr_query(adapter, mac, MAC_ADDRESS_TYPE_NETWORK,
-- true /* permanent */, 0);
-- if (status)
-- goto stats_clean;
-- memcpy(netdev->dev_addr, mac, ETH_ALEN);
-+ /* This bit is zero in normal boot case, but in crash kernel case this
-+ is not cleared. clear this bit here, until we are ready with the irqs
-+ i.e in be_open call.*/
-+ if (!lancer_chip(adapter))
-+ be_intr_set(adapter, false);
-+
-+ if (msix)
-+ be_msix_enable(adapter);
-
- INIT_DELAYED_WORK(&adapter->work, be_worker);
-- be_netdev_init(netdev);
-- SET_NETDEV_DEV(netdev, &adapter->pdev->dev);
-
- status = be_setup(adapter);
- if (status)
-- goto stats_clean;
-+ goto msix_disable;
-+
-+ /* Initilize the link status to -1 */
-+ adapter->link_status = -1;
-+
-+ status = be_netdev_init(netdev);
-+ if (status)
-+ goto unsetup;
-+
- status = register_netdev(netdev);
- if (status != 0)
- goto unsetup;
-
-- dev_info(&pdev->dev, "%s port %d\n", nic_name(pdev), adapter->port_num);
-+ be_cmd_get_fw_ver(adapter, adapter->fw_ver, NULL);
-+
-+ if (be_physfn(adapter) && adapter->num_vfs) {
-+ u8 mac_speed;
-+ int link_status;
-+ u16 def_vlan, vf, lnk_speed;
-+
-+ status = be_vf_eth_addr_config(adapter);
-+ if (status)
-+ goto unreg_netdev;
-+
-+ for (vf = 0; vf < adapter->num_vfs; vf++) {
-+ status = be_cmd_get_hsw_config(adapter, &def_vlan,
-+ vf + 1, adapter->vf_cfg[vf].vf_if_handle);
-+ if (!status)
-+ adapter->vf_cfg[vf].vf_def_vid = def_vlan;
-+ else
-+ goto unreg_netdev;
-+
-+ status = be_cmd_link_status_query(adapter, &link_status,
-+ &mac_speed, &lnk_speed, vf + 1);
-+ if (!status)
-+ adapter->vf_cfg[vf].vf_tx_rate = lnk_speed * 10;
-+ else
-+ goto unreg_netdev;
-+ }
-+ }
-+ if (be_physfn(adapter)) {
-+ /* Temp fix ofr bug# 23034. Till ARM
-+ * f/w fixes privilege lvl */
-+ be_get_port_names(adapter);
-+ }
-+
-+ /* Enable Vlan capability based on privileges.
-+ * PF will have Vlan capability anyway. */
-+ be_cmd_get_fn_privileges(adapter, &en, 0);
-+
-+ if ((en & (BE_PRIV_FILTMGMT | BE_PRIV_VHADM | BE_PRIV_DEVCFG)) ||
-+ be_physfn(adapter))
-+ netdev->features |= NETIF_F_HW_VLAN_FILTER;
-+ else
-+ netdev->features |= NETIF_F_VLAN_CHALLENGED;
-+
-+ dev_info(&pdev->dev, "%s: numa node %d\n", netdev->name,
-+ dev_to_node(&pdev->dev));
-+ dev_info(&pdev->dev, "%s %s \"%s\" port %d\n", nic_name(pdev),
-+ (adapter->port_num > 1 ? "1Gbps NIC" : "10Gbps NIC"),
-+ adapter->model_number, adapter->hba_port_num);
-+
-+
-+#ifdef CONFIG_PALAU
-+ be_sysfs_create_group(adapter);
-+#endif
-+ schedule_delayed_work(&adapter->work, msecs_to_jiffies(100));
- return 0;
-
-+unreg_netdev:
-+ unregister_netdev(netdev);
- unsetup:
- be_clear(adapter);
-+msix_disable:
-+ be_msix_disable(adapter);
- stats_clean:
- be_stats_cleanup(adapter);
- ctrl_clean:
- be_ctrl_cleanup(adapter);
-+free_vf_cfg:
-+ kfree(adapter->vf_cfg);
- free_netdev:
-- free_netdev(adapter->netdev);
-+ be_sriov_disable(adapter);
-+ be_netif_napi_del(netdev);
-+ free_netdev(netdev);
-+ pci_set_drvdata(pdev, NULL);
- rel_reg:
- pci_release_regions(pdev);
- disable_dev:
-@@ -2193,6 +3914,10 @@ static int be_suspend(struct pci_dev *pdev, pm_message_t state)
- struct be_adapter *adapter = pci_get_drvdata(pdev);
- struct net_device *netdev = adapter->netdev;
-
-+ cancel_delayed_work_sync(&adapter->work);
-+ if (adapter->wol)
-+ be_setup_wol(adapter, true);
-+
- netif_device_detach(netdev);
- if (netif_running(netdev)) {
- rtnl_lock();
-@@ -2202,6 +3927,7 @@ static int be_suspend(struct pci_dev *pdev, pm_message_t state)
- be_cmd_get_flow_control(adapter, &adapter->tx_fc, &adapter->rx_fc);
- be_clear(adapter);
-
-+ be_msix_disable(adapter);
- pci_save_state(pdev);
- pci_disable_device(pdev);
- pci_set_power_state(pdev, pci_choose_state(pdev, state));
-@@ -2223,6 +3949,12 @@ static int be_resume(struct pci_dev *pdev)
- pci_set_power_state(pdev, 0);
- pci_restore_state(pdev);
-
-+ be_msix_enable(adapter);
-+ /* tell fw we're ready to fire cmds */
-+ status = be_cmd_fw_init(adapter);
-+ if (status)
-+ return status;
-+
- be_setup(adapter);
- if (netif_running(netdev)) {
- rtnl_lock();
-@@ -2230,28 +3962,152 @@ static int be_resume(struct pci_dev *pdev)
- rtnl_unlock();
- }
- netif_device_attach(netdev);
-+
-+ if (adapter->wol)
-+ be_setup_wol(adapter, false);
-+
-+ schedule_delayed_work(&adapter->work, msecs_to_jiffies(100));
- return 0;
- }
-
-+/*
-+ * An FLR will stop BE from DMAing any data.
-+ */
-+static void be_shutdown(struct pci_dev *pdev)
-+{
-+ struct be_adapter *adapter = pci_get_drvdata(pdev);
-+
-+ if (!adapter)
-+ return;
-+
-+ cancel_delayed_work_sync(&adapter->work);
-+
-+ netif_device_detach(adapter->netdev);
-+
-+ if (adapter->wol)
-+ be_setup_wol(adapter, true);
-+
-+ be_cmd_reset_function(adapter);
-+
-+ pci_disable_device(pdev);
-+}
-+
-+static pci_ers_result_t be_eeh_err_detected(struct pci_dev *pdev,
-+ pci_channel_state_t state)
-+{
-+ struct be_adapter *adapter = pci_get_drvdata(pdev);
-+ struct net_device *netdev = adapter->netdev;
-+
-+ dev_err(&adapter->pdev->dev, "EEH error detected\n");
-+
-+ adapter->eeh_err = true;
-+
-+ netif_device_detach(netdev);
-+
-+ if (netif_running(netdev)) {
-+ rtnl_lock();
-+ be_close(netdev);
-+ rtnl_unlock();
-+ }
-+ be_clear(adapter);
-+
-+ if (state == pci_channel_io_perm_failure)
-+ return PCI_ERS_RESULT_DISCONNECT;
-+
-+ pci_disable_device(pdev);
-+
-+ return PCI_ERS_RESULT_NEED_RESET;
-+}
-+
-+static pci_ers_result_t be_eeh_reset(struct pci_dev *pdev)
-+{
-+ struct be_adapter *adapter = pci_get_drvdata(pdev);
-+ int status;
-+
-+ dev_info(&adapter->pdev->dev, "EEH reset\n");
-+ adapter->eeh_err = false;
-+
-+ status = pci_enable_device(pdev);
-+ if (status)
-+ return PCI_ERS_RESULT_DISCONNECT;
-+
-+ pci_set_master(pdev);
-+ pci_set_power_state(pdev, 0);
-+ pci_restore_state(pdev);
-+
-+ /* Check if card is ok and fw is ready */
-+ status = be_cmd_POST(adapter);
-+ if (status)
-+ return PCI_ERS_RESULT_DISCONNECT;
-+
-+ return PCI_ERS_RESULT_RECOVERED;
-+}
-+
-+static void be_eeh_resume(struct pci_dev *pdev)
-+{
-+ int status = 0;
-+ struct be_adapter *adapter = pci_get_drvdata(pdev);
-+ struct net_device *netdev = adapter->netdev;
-+
-+ dev_info(&adapter->pdev->dev, "EEH resume\n");
-+
-+ pci_save_state(pdev);
-+
-+ /* tell fw we're ready to fire cmds */
-+ status = be_cmd_fw_init(adapter);
-+ if (status)
-+ goto err;
-+
-+ status = be_setup(adapter);
-+ if (status)
-+ goto err;
-+
-+ if (netif_running(netdev)) {
-+ status = be_open(netdev);
-+ if (status)
-+ goto err;
-+ }
-+ netif_device_attach(netdev);
-+ return;
-+err:
-+ dev_err(&adapter->pdev->dev, "EEH resume failed\n");
-+ return;
-+}
-+
-+static struct pci_error_handlers be_eeh_handlers = {
-+ .error_detected = be_eeh_err_detected,
-+ .slot_reset = be_eeh_reset,
-+ .resume = be_eeh_resume,
-+};
-+
- static struct pci_driver be_driver = {
- .name = DRV_NAME,
- .id_table = be_dev_ids,
- .probe = be_probe,
- .remove = be_remove,
- .suspend = be_suspend,
-- .resume = be_resume
-+ .resume = be_resume,
-+ .shutdown = be_shutdown,
-+ .err_handler = &be_eeh_handlers
- };
-
- static int __init be_init_module(void)
- {
-- if (rx_frag_size != 8192 && rx_frag_size != 4096
-- && rx_frag_size != 2048) {
-+ if (rx_frag_size != 8192 && rx_frag_size != 4096 &&
-+ rx_frag_size != 2048) {
- printk(KERN_WARNING DRV_NAME
- " : Module param rx_frag_size must be 2048/4096/8192."
- " Using 2048\n");
- rx_frag_size = 2048;
- }
-
-+ if (!msix && num_vfs > 0) {
-+ printk(KERN_WARNING DRV_NAME
-+ " : MSIx required for num_vfs > 0. Ignoring msix=0\n");
-+ msix = 1;
-+ }
-+
-+
- return pci_register_driver(&be_driver);
- }
- module_init(be_init_module);
-diff --git a/drivers/net/benet/be_misc.c b/drivers/net/benet/be_misc.c
-new file mode 100644
-index 0000000..4ab499f
---- /dev/null
-+++ b/drivers/net/benet/be_misc.c
-@@ -0,0 +1,106 @@
-+/*
-+ * Copyright (C) 2005 - 2011 Emulex
-+ * All rights reserved.
-+ *
-+ * This program is free software; you can redistribute it and/or
-+ * modify it under the terms of the GNU General Public License version 2
-+ * as published by the Free Software Foundation. The full GNU General
-+ * Public License is included in this distribution in the file called COPYING.
-+ *
-+ * Contact Information:
-+ * linux-drivers@emulex.com
-+ *
-+ * Emulex
-+ * 3333 Susan Street
-+ * Costa Mesa, CA 92626
-+ */
-+#include "be.h"
-+
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 24)
-+static ssize_t
-+flash_fw_store(struct class_device *cd, const char *buf, size_t len)
-+{
-+ struct be_adapter *adapter =
-+ netdev_priv(container_of(cd, struct net_device, class_dev));
-+ char file_name[ETHTOOL_FLASH_MAX_FILENAME];
-+ int status;
-+
-+ if (!capable(CAP_NET_ADMIN))
-+ return -EPERM;
-+
-+ file_name[ETHTOOL_FLASH_MAX_FILENAME - 1] = 0;
-+ strncpy(file_name, buf, (ETHTOOL_FLASH_MAX_FILENAME - 1));
-+
-+ /* Removing new-line char given by sysfs */
-+ file_name[strlen(file_name) - 1] = '\0';
-+
-+ status = be_load_fw(adapter, file_name);
-+ if (!status)
-+ return len;
-+ else
-+ return status;
-+}
-+
-+static CLASS_DEVICE_ATTR(flash_fw, S_IWUSR, NULL, flash_fw_store);
-+
-+static struct attribute *benet_attrs[] = {
-+ &class_device_attr_flash_fw.attr,
-+ NULL,
-+};
-+#else
-+
-+static ssize_t
-+flash_fw_store(struct device *dev, struct device_attribute *attr,
-+ const char *buf, size_t len)
-+{
-+ struct be_adapter *adapter =
-+ netdev_priv(container_of(dev, struct net_device, dev));
-+ char file_name[ETHTOOL_FLASH_MAX_FILENAME];
-+ int status;
-+
-+ if (!capable(CAP_NET_ADMIN))
-+ return -EPERM;
-+
-+ file_name[ETHTOOL_FLASH_MAX_FILENAME - 1] = 0;
-+ strncpy(file_name, buf, (ETHTOOL_FLASH_MAX_FILENAME - 1));
-+
-+ /* Removing new-line char given by sysfs */
-+ file_name[strlen(file_name) - 1] = '\0';
-+
-+ status = be_load_fw(adapter, file_name);
-+ if (!status)
-+ return len;
-+ else
-+ return status;
-+}
-+
-+static DEVICE_ATTR(flash_fw, S_IWUSR, NULL, flash_fw_store);
-+
-+static struct attribute *benet_attrs[] = {
-+ &dev_attr_flash_fw.attr,
-+ NULL,
-+};
-+#endif
-+
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 24)
-+#define CLASS_DEV class_dev
-+#else
-+#define CLASS_DEV dev
-+#endif
-+
-+static struct attribute_group benet_attr_group = {.attrs = benet_attrs };
-+
-+void be_sysfs_create_group(struct be_adapter *adapter)
-+{
-+ int status;
-+
-+ status = sysfs_create_group(&adapter->netdev->CLASS_DEV.kobj,
-+ &benet_attr_group);
-+ if (status)
-+ dev_err(&adapter->pdev->dev, "Could not create sysfs group\n");
-+}
-+
-+void be_sysfs_remove_group(struct be_adapter *adapter)
-+{
-+ sysfs_remove_group(&adapter->netdev->CLASS_DEV.kobj, &benet_attr_group);
-+}
-diff --git a/drivers/net/benet/be_proc.c b/drivers/net/benet/be_proc.c
-new file mode 100644
-index 0000000..0bfdb3b
---- /dev/null
-+++ b/drivers/net/benet/be_proc.c
-@@ -0,0 +1,513 @@
-+/*
-+ * Copyright (C) 2005 - 2011 ServerEngines
-+ * All rights reserved.
-+ *
-+ * This program is free software; you can redistribute it and/or
-+ * modify it under the terms of the GNU General Public License version 2
-+ * as published by the Free Software Foundation. The full GNU General
-+ * Public License is included in this distribution in the file called COPYING.
-+ *
-+ * Contact Information:
-+ * linux-drivers@serverengines.com
-+ *
-+ * ServerEngines
-+ * 209 N. Fair Oaks Ave
-+ * Sunnyvale, CA 94085
-+ */
-+#include <linux/proc_fs.h>
-+#include "be.h"
-+
-+char *be_adpt_name[] = {
-+ "driver/be2net0",
-+ "driver/be2net1",
-+ "driver/be2net2",
-+ "driver/be2net3",
-+ "driver/be2net4",
-+ "driver/be2net5",
-+ "driver/be2net6",
-+ "driver/be2net7"
-+};
-+
-+#define MAX_BE_DEVICES 8
-+struct proc_dir_entry *be_proc_dir[MAX_BE_DEVICES];
-+
-+/*File to read Eth Ring Information */
-+#define BE_ETH_RING_FILE "eth_ring"
-+#define BE_DRVR_STAT_FILE "drvr_stat"
-+
-+/*
-+ * this file enables user to read a 32 bit CSR register.
-+ * to read 32 bit value of a register at offset 0x1234,
-+ * first write the offset 0x1234 (echo "0x1234") in
-+ * the file and then read the value from this file.
-+ * the written offset is latched until another value is written
-+ */
-+#define BE_CSR_R_FILE "csrr"
-+/*
-+ * this file enables user to write to a 32 bit CSR register.
-+ * to write a value 0xdeadbeef to a register at offset 0x1234,
-+ * write 0x1234 0xdeadbeef (echo "0x1234 0xdeadbeeb") to
-+ * the file.
-+ */
-+#define BE_CSR_W_FILE "csrw"
-+
-+#define BE_PROC_MODE 0600
-+
-+static char read_eth_ring_buf[4096];
-+static int read_eth_ring_count;
-+
-+/*
-+ * Get Various Eth Ring Properties
-+ */
-+static int proc_eth_read_ring(char *page, char **start,
-+ off_t off, int count, int *eof, void *data)
-+{
-+ int i, n;
-+ char *p = read_eth_ring_buf;
-+ struct be_adapter *adapter = (struct be_adapter *) data;
-+
-+ if (off == 0) {
-+ /* Reset read_eth_ring_count */
-+ read_eth_ring_count = 0;
-+
-+ n = sprintf(p, " PhyAddr VirtAddr Size TotalEntries ProducerIndex ConsumerIndex NumUsed\n");
-+ p += n;
-+ read_eth_ring_count += n;
-+
-+ n = sprintf(p, " ------- -------- ---- ------------ ------------- ------------- -------\n");
-+ p += n;
-+ read_eth_ring_count += n;
-+
-+ n = sprintf(p, "%s", "EthSendRing");
-+ p += n;
-+ read_eth_ring_count += n;
-+
-+ n = sprintf(p, " %7lx %8p %4u %12u %13u %13u %7u \n",
-+ (long) adapter->tx_obj.q.dma_mem.dma,
-+ (void *)adapter->tx_obj.q.dma_mem.va,
-+ (u32) (adapter->tx_obj.q.len *
-+ sizeof(struct be_eth_wrb)),
-+ adapter->tx_obj.q.len, adapter->tx_obj.q.head,
-+ adapter->tx_obj.q.tail,
-+ atomic_read(&adapter->tx_obj.q.used));
-+
-+ p += n;
-+ read_eth_ring_count += n;
-+
-+ /* Get Eth Send Compl Queue Details */
-+ n = sprintf(p, "%s", "EthSendCmplRing");
-+ p += n;
-+ read_eth_ring_count += n;
-+
-+ n = sprintf(p, " %7lx %8p %4u %12u %13s %13u %7s\n",
-+ (long)adapter->tx_obj.cq.dma_mem.dma,
-+ (void *)adapter->tx_obj.cq.dma_mem.va,
-+ (u32) (adapter->tx_obj.cq.len *
-+ sizeof(struct be_eth_tx_compl)),
-+ adapter->tx_obj.cq.len, "NA",
-+ adapter->tx_obj.cq.tail, "NA");
-+
-+ p += n;
-+ read_eth_ring_count += n;
-+ /* Get Eth Rx Queue Details */
-+ n = sprintf(p, "%s", "EthRxRing");
-+ p += n;
-+ read_eth_ring_count += n;
-+
-+ n = sprintf(p, " %7lx %8p %4u %12u %13u %13s %7u \n",
-+ (long)adapter->rx_obj.q.dma_mem.dma,
-+ (void *)adapter->rx_obj.q.dma_mem.va,
-+ (u32) (adapter->rx_obj.q.len *
-+ sizeof(struct be_eth_rx_d)),
-+ adapter->rx_obj.q.len, adapter->rx_obj.q.head,"NA",
-+ atomic_read(&adapter->rx_obj.q.used));
-+ p += n;
-+ read_eth_ring_count += n;
-+
-+ /* Get Eth Unicast Rx Compl Queue Details */
-+ n = sprintf(p, "%s", "EthRxCmplRing");
-+ p += n;
-+ read_eth_ring_count += n;
-+
-+ n = sprintf(p, " %7lx %8p %4u %12u %13s %13u %7s\n",
-+ (long)adapter->rx_obj.cq.dma_mem.dma,
-+ (void *)adapter->rx_obj.cq.dma_mem.va,
-+ (u32) (adapter->rx_obj.cq.len *
-+ sizeof(struct be_eth_rx_compl)),
-+ adapter->rx_obj.cq.len, "NA",
-+ adapter->rx_obj.cq.tail, "NA");
-+ p += n;
-+ read_eth_ring_count += n;
-+
-+ /* Get Eth Event Queue Details */
-+ n = sprintf(p, "%s", "EthTxEventRing");
-+ p += n;
-+ read_eth_ring_count += n;
-+
-+ n = sprintf(p,
-+ " %7lx %8p %4u %12u %13s %13u %7s\n",
-+ (long) adapter->tx_eq.q.dma_mem.dma,
-+ (void *)adapter->tx_eq.q.dma_mem.va,
-+ (u32) (adapter->tx_eq.q.len *
-+ sizeof(struct be_eq_entry)),
-+ adapter->tx_eq.q.len, "NA",
-+ adapter->tx_eq.q.tail, "NA");
-+
-+ p += n;
-+ read_eth_ring_count += n;
-+
-+ /* Get Eth Event Queue Details */
-+ n = sprintf(p, "%s", "EthRxEventRing");
-+ p += n;
-+ read_eth_ring_count += n;
-+
-+ n = sprintf(p,
-+ " %7lx %8p %4u %12u %13s %13u %7s\n",
-+ (long) adapter->rx_eq.q.dma_mem.dma,
-+ (void *)adapter->rx_eq.q.dma_mem.va,
-+ (u32) (adapter->rx_eq.q.len *
-+ sizeof(struct be_eq_entry)),
-+ adapter->rx_eq.q.len, "NA",
-+ adapter->rx_eq.q.tail, "NA");
-+
-+ p += n;
-+ read_eth_ring_count += n;
-+ }
-+
-+ *start = page;
-+ /* copy whatever we can */
-+ if (count < (read_eth_ring_count - off)) {
-+ i = count;
-+ *eof = 0; /* More bytes left */
-+ } else {
-+ i = read_eth_ring_count - off;
-+ *eof = 1; /* Nothing left. indicate EOF */
-+ }
-+
-+ memcpy(page, read_eth_ring_buf + off, i);
-+ return (i);
-+}
-+
-+static int proc_eth_write_ring(struct file *file,
-+ const char *buffer, unsigned long count,
-+ void *data)
-+{
-+ return (count); /* we do not support write */
-+}
-+
-+/*
-+ * read the driver stats.
-+ */
-+static int proc_read_drvr_stat(char *page, char **start,
-+ off_t off, int count, int *eof, void *data)
-+{
-+ int n, lro_cp;
-+ char *p = page;
-+ struct be_adapter *adapter = (struct be_adapter *) data;
-+ struct net_device *netdev = adapter->netdev;
-+
-+ if (off == 0) {
-+ n = sprintf(p, "interface = %s\n", netdev->name);
-+ p += n;
-+ n = sprintf(p, "tx_reqs = %d\n",
-+ drvr_stats(adapter)->be_tx_reqs);
-+ p += n;
-+ n = sprintf(p, "tx_stops = %d\n",
-+ drvr_stats(adapter)->be_tx_stops);
-+ p += n;
-+ n = sprintf(p, "fwd_reqs = %d\n",
-+ drvr_stats(adapter)->be_fwd_reqs);
-+ p += n;
-+ n = sprintf(p, "tx_wrbs = %d\n",
-+ drvr_stats(adapter)->be_tx_wrbs);
-+ p += n;
-+ n = sprintf(p, "rx_poll = %d\n", drvr_stats(adapter)->be_rx_polls);
-+ p += n;
-+ n = sprintf(p, "tx_events = %d\n",
-+ drvr_stats(adapter)->be_tx_events);
-+ p += n;
-+ n = sprintf(p, "rx_events = %d\n",
-+ drvr_stats(adapter)->be_rx_events);
-+ p += n;
-+ n = sprintf(p, "tx_compl = %d\n",
-+ drvr_stats(adapter)->be_tx_compl);
-+ p += n;
-+ n = sprintf(p, "rx_compl = %d\n",
-+ drvr_stats(adapter)->be_rx_compl);
-+ p += n;
-+ n = sprintf(p, "ethrx_post_fail = %d\n",
-+ drvr_stats(adapter)->be_ethrx_post_fail);
-+ p += n;
-+ n = sprintf(p, "802.3_dropped_frames = %d\n",
-+ drvr_stats(adapter)->be_802_3_dropped_frames);
-+ p += n;
-+ n = sprintf(p, "802.3_malformed_frames = %d\n",
-+ drvr_stats(adapter)->be_802_3_malformed_frames);
-+ p += n;
-+ n = sprintf(p, "eth_tx_rate = %d\n",
-+ drvr_stats(adapter)->be_tx_rate);
-+ p += n;
-+ n = sprintf(p, "eth_rx_rate = %d\n",
-+ drvr_stats(adapter)->be_rx_rate);
-+ p += n;
-+
-+ lro_cp = (drvr_stats(adapter)->be_lro_hgram_data[0] +
-+ drvr_stats(adapter)->be_lro_hgram_data[1] +
-+ drvr_stats(adapter)->be_lro_hgram_data[2] +
-+ drvr_stats(adapter)->be_lro_hgram_data[3] +
-+ drvr_stats(adapter)->be_lro_hgram_data[4] +
-+ drvr_stats(adapter)->be_lro_hgram_data[5] +
-+ drvr_stats(adapter)->be_lro_hgram_data[6] +
-+ drvr_stats(adapter)->be_lro_hgram_data[7])/100;
-+ lro_cp = (lro_cp == 0) ? 1 : lro_cp; /* avoid divide by 0 */
-+ n = sprintf(p,
-+ "LRO data count %% histogram (1, 2-3, 4-5,..,>=16) = "
-+ "%d, %d, %d, %d - %d, %d, %d, %d\n",
-+ drvr_stats(adapter)->be_lro_hgram_data[0]/lro_cp,
-+ drvr_stats(adapter)->be_lro_hgram_data[1]/lro_cp,
-+ drvr_stats(adapter)->be_lro_hgram_data[2]/lro_cp,
-+ drvr_stats(adapter)->be_lro_hgram_data[3]/lro_cp,
-+ drvr_stats(adapter)->be_lro_hgram_data[4]/lro_cp,
-+ drvr_stats(adapter)->be_lro_hgram_data[5]/lro_cp,
-+ drvr_stats(adapter)->be_lro_hgram_data[6]/lro_cp,
-+ drvr_stats(adapter)->be_lro_hgram_data[7]/lro_cp);
-+ p += n;
-+
-+ lro_cp = (drvr_stats(adapter)->be_lro_hgram_ack[0] +
-+ drvr_stats(adapter)->be_lro_hgram_ack[1] +
-+ drvr_stats(adapter)->be_lro_hgram_ack[2] +
-+ drvr_stats(adapter)->be_lro_hgram_ack[3] +
-+ drvr_stats(adapter)->be_lro_hgram_ack[4] +
-+ drvr_stats(adapter)->be_lro_hgram_ack[5] +
-+ drvr_stats(adapter)->be_lro_hgram_ack[6] +
-+ drvr_stats(adapter)->be_lro_hgram_ack[7])/100;
-+ lro_cp = (lro_cp == 0) ? 1 : lro_cp; /* avoid divide by 0 */
-+ n = sprintf(p,
-+ "LRO ack count %% histogram (1, 2-3, 4-5,..,>=16) = "
-+ "%d, %d, %d, %d - %d, %d, %d, %d\n",
-+ drvr_stats(adapter)->be_lro_hgram_ack[0]/lro_cp,
-+ drvr_stats(adapter)->be_lro_hgram_ack[1]/lro_cp,
-+ drvr_stats(adapter)->be_lro_hgram_ack[2]/lro_cp,
-+ drvr_stats(adapter)->be_lro_hgram_ack[3]/lro_cp,
-+ drvr_stats(adapter)->be_lro_hgram_ack[4]/lro_cp,
-+ drvr_stats(adapter)->be_lro_hgram_ack[5]/lro_cp,
-+ drvr_stats(adapter)->be_lro_hgram_ack[6]/lro_cp,
-+ drvr_stats(adapter)->be_lro_hgram_ack[7]/lro_cp);
-+ p += n;
-+ n = sprintf(p, "rx_eq_delay = %d \n", adapter->rx_eq.cur_eqd);
-+ p += n;
-+ n = sprintf(p, "rx frags per sec=%d \n",
-+ drvr_stats(adapter)->be_rx_fps);
-+ p += n;
-+
-+ }
-+ *eof = 1;
-+ return (p - page);
-+}
-+
-+static int proc_write_drvr_stat(struct file *file,
-+ const char *buffer, unsigned long count,
-+ void *data)
-+{
-+ struct be_adapter *adapter = (struct be_adapter *) data;
-+
-+ memset(&(adapter->stats.drvr_stats), 0,
-+ sizeof(adapter->stats.drvr_stats));
-+ return (count); /* we do not support write */
-+}
-+
-+#if 0
-+/* the following are some of the functions that are needed here
-+ * until all initializations are done by MPU.
-+ */
-+
-+u32
-+CsrReadDr(void* BaseAddress, u32 Offset)
-+{
-+ u32 *rp;
-+
-+ rp = (u32 *) (((u8 *) BaseAddress) + Offset);
-+ return (*rp);
-+}
-+
-+/*!
-+
-+@brief
-+ This routine writes to a register located within the CSR
-+ space for a given function object.
-+
-+@param
-+ FuncObj - Pointer to the function object to read from.
-+
-+@param
-+ Offset - The Offset (in bytes) to write to within the function's CSR space.
-+
-+@param
-+ Value - The value to write to the register.
-+
-+@return
-+
-+@note
-+ IRQL: any
-+
-+*/
-+void
-+CsrWriteDr(void* BaseAddress, u32 Offset, u32 Value)
-+{
-+ u32 *Register;
-+
-+ Register = (u32 *) (((u8 *) BaseAddress) + Offset);
-+
-+ //TRACE(DL_INFO, "CsrWrite[ %X ] <= %X", Register, Value);
-+ *Register = Value;
-+}
-+u32 be_proc_csrr_offset = -1; /* to latch the offset of next CSR Read req. */
-+
-+/*
-+ * read the csr_r file. return the 32 bit register value from
-+ * CSR space at offset latched in the global location
-+ * be_proc_csrr_offset
-+ */
-+static int proc_read_csr_r(char *page, char **start,
-+ off_t off, int count, int *eof, void *data)
-+{
-+ struct be_adapter * adapter = (struct be_adapter *)data;
-+ u32 val;
-+ int n = 0;
-+ if (be_proc_csrr_offset == -1)
-+ return -EINVAL;
-+
-+ if (off == 0) {
-+ /* read the CSR at offset be_proc_csrr_offset and return */
-+ val = CsrReadDr(adapter->csr_va, be_proc_csrr_offset);
-+ n = sprintf(page, "0x%x\n", val);
-+ }
-+ *eof = 1;
-+ return n;
-+}
-+
-+/*
-+ * save the written value in be_proc_csrr_offset for next
-+ * read from the file
-+ */
-+static int proc_write_csr_r(struct file *file,
-+ const char *buffer, unsigned long count, void *data)
-+{
-+ char buf[64];
-+ u32 n;
-+
-+ if (count > sizeof(buf) + 1)
-+ return -EINVAL;
-+ if (copy_from_user(buf, buffer, count))
-+ return -EFAULT;
-+ buf[count] = '\0';
-+
-+ n = simple_strtoul(buf, NULL, 16);
-+ if (n < 0x50000)
-+ be_proc_csrr_offset = n;
-+ return (count);
-+}
-+
-+/*
-+ * return the latched offset for reading the csr_r file.
-+ */
-+static int proc_read_csr_w(char *page, char **start,
-+ off_t off, int count, int *eof, void *data)
-+{
-+
-+ *eof = 1;
-+ return sprintf(page, "0x%x\n", be_proc_csrr_offset);
-+}
-+
-+/*
-+ * the incoming string is of the form "<offset> <value>"
-+ * where the offset is the offset of the register to be written
-+ * and value is the value to be written.
-+ */
-+static int proc_write_csr_w(struct file *file,
-+ const char *buffer, unsigned long count,
-+ void *data)
-+{
-+ char buf[64];
-+ char *p;
-+ u32 n, val;
-+ struct be_adapter * adapter = (struct be_adapter *)data;
-+
-+ if (count > sizeof(buf) + 1)
-+ return -EINVAL;
-+ if (copy_from_user(buf, buffer, count))
-+ return -EFAULT;
-+ buf[count] = '\0';
-+
-+ n = simple_strtoul(buf, &p, 16);
-+ if (n > 0x50000)
-+ return -EINVAL;
-+
-+ /* now get the actual value to be written */
-+ while (*p == ' ' || *p == '\t')
-+ p++;
-+ val = simple_strtoul(p, NULL, 16);
-+ CsrWriteDr(adapter->csr_va, n, val);
-+ return (count);
-+}
-+#endif
-+
-+void be_init_procfs(struct be_adapter *adapter, int adapt_num)
-+{
-+ static struct proc_dir_entry *pde;
-+
-+ if (adapt_num > MAX_BE_DEVICES - 1)
-+ return;
-+
-+ /* create directory */
-+ be_proc_dir[adapt_num] =
-+ proc_mkdir(be_adpt_name[adapt_num], NULL);
-+ if (be_proc_dir[adapt_num]) {
-+ (be_proc_dir[adapt_num])->owner = THIS_MODULE;
-+ }
-+
-+ pde = create_proc_entry(BE_ETH_RING_FILE, BE_PROC_MODE,
-+ be_proc_dir[adapt_num]);
-+ if (pde) {
-+ pde->read_proc = proc_eth_read_ring;
-+ pde->write_proc = proc_eth_write_ring;
-+ pde->data = adapter;
-+ pde->owner = THIS_MODULE;
-+ }
-+
-+ pde = create_proc_entry(BE_DRVR_STAT_FILE, BE_PROC_MODE,
-+ be_proc_dir[adapt_num]);
-+ if (pde) {
-+ pde->read_proc = proc_read_drvr_stat;
-+ pde->write_proc = proc_write_drvr_stat;
-+ pde->data = adapter;
-+ pde->owner = THIS_MODULE;
-+ }
-+
-+#if 0
-+ if ((pde = create_proc_entry(BE_CSR_R_FILE, BE_PROC_MODE, be_proc_dir[adapt_num]))) {
-+ pde->read_proc = proc_read_csr_r;
-+ pde->write_proc = proc_write_csr_r;
-+ pde->data = adapter;
-+ pde->owner = THIS_MODULE;
-+ }
-+
-+ if ((pde = create_proc_entry(BE_CSR_W_FILE, BE_PROC_MODE, be_proc_dir[adapt_num]))) {
-+ pde->read_proc = proc_read_csr_w;
-+ pde->write_proc = proc_write_csr_w;
-+ pde->data = adapter;
-+ pde->owner = THIS_MODULE;
-+ }
-+#endif
-+}
-+
-+void be_cleanup_procfs(struct be_adapter *adapter, int adapt_num)
-+{
-+ if (adapt_num > MAX_BE_DEVICES - 1)
-+ return;
-+ remove_proc_entry(BE_ETH_RING_FILE, be_proc_dir[adapt_num]);
-+ remove_proc_entry(BE_DRVR_STAT_FILE, be_proc_dir[adapt_num]);
-+ remove_proc_entry(BE_CSR_R_FILE, be_proc_dir[adapt_num]);
-+ remove_proc_entry(BE_CSR_W_FILE, be_proc_dir[adapt_num]);
-+ remove_proc_entry(be_adpt_name[adapt_num], NULL);
-+}
-diff --git a/drivers/net/benet/version.h b/drivers/net/benet/version.h
-new file mode 100644
-index 0000000..c7ed692
---- /dev/null
-+++ b/drivers/net/benet/version.h
-@@ -0,0 +1,51 @@
-+#define STR_BE_BRANCH "0"
-+#define STR_BE_BUILD "479"
-+#define STR_BE_DOT "0"
-+#define STR_BE_MINOR "0"
-+#define STR_BE_MAJOR "4"
-+
-+#define BE_BRANCH 0
-+#define BE_BUILD 479
-+#define BE_DOT 0
-+#define BE_MINOR 0
-+#define BE_MAJOR 4
-+
-+#define MGMT_BRANCH 0
-+#define MGMT_BUILDNUM 479
-+#define MGMT_MINOR 0
-+#define MGMT_MAJOR 4
-+
-+#define BE_REDBOOT_VERSION "2.0.5.0"
-+
-+//start-auto
-+#define BUILD_MONTH "12"
-+#define BUILD_MONTH_NAME "December"
-+#define BUILD_DAY "6"
-+#define BUILD_YEAR "2011"
-+#define BUILD_24HOUR "21"
-+#define BUILD_12HOUR "9"
-+#define BUILD_AM_PM "PM"
-+#define BUILD_MIN "48"
-+#define BUILD_SEC "05"
-+#define BUILD_MONTH_NUMBER 12
-+#define BUILD_DAY_NUMBER 6
-+#define BUILD_YEAR_NUMBER 2011
-+#define BUILD_24HOUR_NUMBER 21
-+#define BUILD_12HOUR_NUMBER 9
-+#define BUILD_MIN_NUMBER 48
-+#define BUILD_SEC_NUMBER 5
-+#undef MAJOR_BUILD
-+#undef MINOR_BUILD
-+#undef DOT_BUILD
-+#define NUMBERED_BUILD
-+#undef BRANCH_BUILD
-+//end-auto
-+
-+#define ELX_FCOE_XROM_BIOS_VER "7.03a1"
-+#define ELX_FCoE_X86_VER "4.02a1"
-+#define ELX_FCoE_EFI_VER "5.01a1"
-+#define ELX_FCoE_FCODE_VER "4.01a0"
-+#define ELX_PXE_BIOS_VER "3.00a5"
-+#define ELX_UEFI_NIC_VER "2.10A10"
-+#define ELX_UEFI_FCODE_VER "1.10A0"
-+#define ELX_ISCSI_BIOS_VER "1.00A8"
-diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
-index 4874b2b..67f8526 100644
---- a/drivers/net/bnx2.c
-+++ b/drivers/net/bnx2.c
-@@ -5809,6 +5809,8 @@ bnx2_test_nvram(struct bnx2 *bp)
- int rc = 0;
- u32 magic, csum;
-
-+ pax_track_stack();
-+
- if ((rc = bnx2_nvram_read(bp, 0, data, 4)) != 0)
- goto test_nvram_done;
-
-diff --git a/drivers/net/cxgb3/l2t.h b/drivers/net/cxgb3/l2t.h
-index fd3eb07..8a6978d 100644
---- a/drivers/net/cxgb3/l2t.h
-+++ b/drivers/net/cxgb3/l2t.h
-@@ -86,7 +86,7 @@ typedef void (*arp_failure_handler_func)(struct t3cdev * dev,
- */
- struct l2t_skb_cb {
- arp_failure_handler_func arp_failure_handler;
--};
-+} __no_const;
-
- #define L2T_SKB_CB(skb) ((struct l2t_skb_cb *)(skb)->cb)
-
-diff --git a/drivers/net/cxgb3/t3_hw.c b/drivers/net/cxgb3/t3_hw.c
-index 032cfe0..411af379 100644
---- a/drivers/net/cxgb3/t3_hw.c
-+++ b/drivers/net/cxgb3/t3_hw.c
-@@ -699,6 +699,8 @@ static int get_vpd_params(struct adapter *adapter, struct vpd_params *p)
- int i, addr, ret;
- struct t3_vpd vpd;
-
-+ pax_track_stack();
-+
- /*
- * Card information is normally at VPD_BASE but some early cards had
- * it at 0.
-diff --git a/drivers/net/dl2k.h b/drivers/net/dl2k.h
-index cde8ecd..db944d3 100644
---- a/drivers/net/dl2k.h
-+++ b/drivers/net/dl2k.h
-@@ -438,4 +438,7 @@ MODULE_DEVICE_TABLE (pci, rio_pci_tbl);
- #define DEFAULT_RXT 750
- #define DEFAULT_TXC 1
- #define MAX_TXC 8
-+
-+#include <linux/mii.h>
-+
- #endif /* __DL2K_H__ */
-diff --git a/drivers/net/e1000e/82571.c b/drivers/net/e1000e/82571.c
-index d1e0563..77f3794 100644
---- a/drivers/net/e1000e/82571.c
-+++ b/drivers/net/e1000e/82571.c
-@@ -212,7 +212,6 @@ static s32 e1000_init_mac_params_82571(struct e1000_adapter *adapter)
- {
- struct e1000_hw *hw = &adapter->hw;
- struct e1000_mac_info *mac = &hw->mac;
-- struct e1000_mac_operations *func = &mac->ops;
- u32 swsm = 0;
- u32 swsm2 = 0;
- bool force_clear_smbi = false;
-@@ -245,22 +244,22 @@ static s32 e1000_init_mac_params_82571(struct e1000_adapter *adapter)
- /* check for link */
- switch (hw->phy.media_type) {
- case e1000_media_type_copper:
-- func->setup_physical_interface = e1000_setup_copper_link_82571;
-- func->check_for_link = e1000e_check_for_copper_link;
-- func->get_link_up_info = e1000e_get_speed_and_duplex_copper;
-+ mac->ops.setup_physical_interface = e1000_setup_copper_link_82571;
-+ mac->ops.check_for_link = e1000e_check_for_copper_link;
-+ mac->ops.get_link_up_info = e1000e_get_speed_and_duplex_copper;
- break;
- case e1000_media_type_fiber:
-- func->setup_physical_interface =
-+ mac->ops.setup_physical_interface =
- e1000_setup_fiber_serdes_link_82571;
-- func->check_for_link = e1000e_check_for_fiber_link;
-- func->get_link_up_info =
-+ mac->ops.check_for_link = e1000e_check_for_fiber_link;
-+ mac->ops.get_link_up_info =
- e1000e_get_speed_and_duplex_fiber_serdes;
- break;
- case e1000_media_type_internal_serdes:
-- func->setup_physical_interface =
-+ mac->ops.setup_physical_interface =
- e1000_setup_fiber_serdes_link_82571;
-- func->check_for_link = e1000_check_for_serdes_link_82571;
-- func->get_link_up_info =
-+ mac->ops.check_for_link = e1000_check_for_serdes_link_82571;
-+ mac->ops.get_link_up_info =
- e1000e_get_speed_and_duplex_fiber_serdes;
- break;
- default:
-@@ -271,12 +270,12 @@ static s32 e1000_init_mac_params_82571(struct e1000_adapter *adapter)
- switch (hw->mac.type) {
- case e1000_82574:
- case e1000_82583:
-- func->check_mng_mode = e1000_check_mng_mode_82574;
-- func->led_on = e1000_led_on_82574;
-+ mac->ops.check_mng_mode = e1000_check_mng_mode_82574;
-+ mac->ops.led_on = e1000_led_on_82574;
- break;
- default:
-- func->check_mng_mode = e1000e_check_mng_mode_generic;
-- func->led_on = e1000e_led_on_generic;
-+ mac->ops.check_mng_mode = e1000e_check_mng_mode_generic;
-+ mac->ops.led_on = e1000e_led_on_generic;
- break;
- }
-
-@@ -1656,7 +1655,7 @@ static void e1000_clear_hw_cntrs_82571(struct e1000_hw *hw)
- temp = er32(ICRXDMTC);
- }
-
--static struct e1000_mac_operations e82571_mac_ops = {
-+static const struct e1000_mac_operations e82571_mac_ops = {
- /* .check_mng_mode: mac type dependent */
- /* .check_for_link: media type dependent */
- .id_led_init = e1000e_id_led_init,
-@@ -1674,7 +1673,7 @@ static struct e1000_mac_operations e82571_mac_ops = {
- .setup_led = e1000e_setup_led_generic,
- };
-
--static struct e1000_phy_operations e82_phy_ops_igp = {
-+static const struct e1000_phy_operations e82_phy_ops_igp = {
- .acquire_phy = e1000_get_hw_semaphore_82571,
- .check_reset_block = e1000e_check_reset_block_generic,
- .commit_phy = NULL,
-@@ -1691,7 +1690,7 @@ static struct e1000_phy_operations e82_phy_ops_igp = {
- .cfg_on_link_up = NULL,
- };
-
--static struct e1000_phy_operations e82_phy_ops_m88 = {
-+static const struct e1000_phy_operations e82_phy_ops_m88 = {
- .acquire_phy = e1000_get_hw_semaphore_82571,
- .check_reset_block = e1000e_check_reset_block_generic,
- .commit_phy = e1000e_phy_sw_reset,
-@@ -1708,7 +1707,7 @@ static struct e1000_phy_operations e82_phy_ops_m88 = {
- .cfg_on_link_up = NULL,
- };
-
--static struct e1000_phy_operations e82_phy_ops_bm = {
-+static const struct e1000_phy_operations e82_phy_ops_bm = {
- .acquire_phy = e1000_get_hw_semaphore_82571,
- .check_reset_block = e1000e_check_reset_block_generic,
- .commit_phy = e1000e_phy_sw_reset,
-@@ -1725,7 +1724,7 @@ static struct e1000_phy_operations e82_phy_ops_bm = {
- .cfg_on_link_up = NULL,
- };
-
--static struct e1000_nvm_operations e82571_nvm_ops = {
-+static const struct e1000_nvm_operations e82571_nvm_ops = {
- .acquire_nvm = e1000_acquire_nvm_82571,
- .read_nvm = e1000e_read_nvm_eerd,
- .release_nvm = e1000_release_nvm_82571,
-diff --git a/drivers/net/e1000e/e1000.h b/drivers/net/e1000e/e1000.h
-index 47db9bd..fa58ccd 100644
---- a/drivers/net/e1000e/e1000.h
-+++ b/drivers/net/e1000e/e1000.h
-@@ -375,9 +375,9 @@ struct e1000_info {
- u32 pba;
- u32 max_hw_frame_size;
- s32 (*get_variants)(struct e1000_adapter *);
-- struct e1000_mac_operations *mac_ops;
-- struct e1000_phy_operations *phy_ops;
-- struct e1000_nvm_operations *nvm_ops;
-+ const struct e1000_mac_operations *mac_ops;
-+ const struct e1000_phy_operations *phy_ops;
-+ const struct e1000_nvm_operations *nvm_ops;
- };
-
- /* hardware capability, feature, and workaround flags */
-diff --git a/drivers/net/e1000e/es2lan.c b/drivers/net/e1000e/es2lan.c
-index ae5d736..afc88d6 100644
---- a/drivers/net/e1000e/es2lan.c
-+++ b/drivers/net/e1000e/es2lan.c
-@@ -207,7 +207,6 @@ static s32 e1000_init_mac_params_80003es2lan(struct e1000_adapter *adapter)
- {
- struct e1000_hw *hw = &adapter->hw;
- struct e1000_mac_info *mac = &hw->mac;
-- struct e1000_mac_operations *func = &mac->ops;
-
- /* Set media type */
- switch (adapter->pdev->device) {
-@@ -229,16 +228,16 @@ static s32 e1000_init_mac_params_80003es2lan(struct e1000_adapter *adapter)
- /* check for link */
- switch (hw->phy.media_type) {
- case e1000_media_type_copper:
-- func->setup_physical_interface = e1000_setup_copper_link_80003es2lan;
-- func->check_for_link = e1000e_check_for_copper_link;
-+ mac->ops.setup_physical_interface = e1000_setup_copper_link_80003es2lan;
-+ mac->ops.check_for_link = e1000e_check_for_copper_link;
- break;
- case e1000_media_type_fiber:
-- func->setup_physical_interface = e1000e_setup_fiber_serdes_link;
-- func->check_for_link = e1000e_check_for_fiber_link;
-+ mac->ops.setup_physical_interface = e1000e_setup_fiber_serdes_link;
-+ mac->ops.check_for_link = e1000e_check_for_fiber_link;
- break;
- case e1000_media_type_internal_serdes:
-- func->setup_physical_interface = e1000e_setup_fiber_serdes_link;
-- func->check_for_link = e1000e_check_for_serdes_link;
-+ mac->ops.setup_physical_interface = e1000e_setup_fiber_serdes_link;
-+ mac->ops.check_for_link = e1000e_check_for_serdes_link;
- break;
- default:
- return -E1000_ERR_CONFIG;
-@@ -1365,7 +1364,7 @@ static void e1000_clear_hw_cntrs_80003es2lan(struct e1000_hw *hw)
- temp = er32(ICRXDMTC);
- }
-
--static struct e1000_mac_operations es2_mac_ops = {
-+static const struct e1000_mac_operations es2_mac_ops = {
- .id_led_init = e1000e_id_led_init,
- .check_mng_mode = e1000e_check_mng_mode_generic,
- /* check_for_link dependent on media type */
-@@ -1383,7 +1382,7 @@ static struct e1000_mac_operations es2_mac_ops = {
- .setup_led = e1000e_setup_led_generic,
- };
-
--static struct e1000_phy_operations es2_phy_ops = {
-+static const struct e1000_phy_operations es2_phy_ops = {
- .acquire_phy = e1000_acquire_phy_80003es2lan,
- .check_reset_block = e1000e_check_reset_block_generic,
- .commit_phy = e1000e_phy_sw_reset,
-@@ -1400,7 +1399,7 @@ static struct e1000_phy_operations es2_phy_ops = {
- .cfg_on_link_up = e1000_cfg_on_link_up_80003es2lan,
- };
-
--static struct e1000_nvm_operations es2_nvm_ops = {
-+static const struct e1000_nvm_operations es2_nvm_ops = {
- .acquire_nvm = e1000_acquire_nvm_80003es2lan,
- .read_nvm = e1000e_read_nvm_eerd,
- .release_nvm = e1000_release_nvm_80003es2lan,
-diff --git a/drivers/net/e1000e/ich8lan.c b/drivers/net/e1000e/ich8lan.c
-index de39f9a..e28d3e0 100644
---- a/drivers/net/e1000e/ich8lan.c
-+++ b/drivers/net/e1000e/ich8lan.c
-@@ -3463,7 +3463,7 @@ static void e1000_clear_hw_cntrs_ich8lan(struct e1000_hw *hw)
- }
- }
-
--static struct e1000_mac_operations ich8_mac_ops = {
-+static const struct e1000_mac_operations ich8_mac_ops = {
- .id_led_init = e1000e_id_led_init,
- .check_mng_mode = e1000_check_mng_mode_ich8lan,
- .check_for_link = e1000_check_for_copper_link_ich8lan,
-@@ -3481,7 +3481,7 @@ static struct e1000_mac_operations ich8_mac_ops = {
- /* id_led_init dependent on mac type */
- };
-
--static struct e1000_phy_operations ich8_phy_ops = {
-+static const struct e1000_phy_operations ich8_phy_ops = {
- .acquire_phy = e1000_acquire_swflag_ich8lan,
- .check_reset_block = e1000_check_reset_block_ich8lan,
- .commit_phy = NULL,
-@@ -3497,7 +3497,7 @@ static struct e1000_phy_operations ich8_phy_ops = {
- .write_phy_reg = e1000e_write_phy_reg_igp,
- };
-
--static struct e1000_nvm_operations ich8_nvm_ops = {
-+static const struct e1000_nvm_operations ich8_nvm_ops = {
- .acquire_nvm = e1000_acquire_nvm_ich8lan,
- .read_nvm = e1000_read_nvm_ich8lan,
- .release_nvm = e1000_release_nvm_ich8lan,
-diff --git a/drivers/net/fealnx.c b/drivers/net/fealnx.c
-index 18d5fbb..542d96d 100644
---- a/drivers/net/fealnx.c
-+++ b/drivers/net/fealnx.c
-@@ -151,7 +151,7 @@ struct chip_info {
- int flags;
- };
-
--static const struct chip_info skel_netdrv_tbl[] __devinitdata = {
-+static const struct chip_info skel_netdrv_tbl[] __devinitconst = {
- { "100/10M Ethernet PCI Adapter", HAS_MII_XCVR },
- { "100/10M Ethernet PCI Adapter", HAS_CHIP_XCVR },
- { "1000/100/10M Ethernet PCI Adapter", HAS_MII_XCVR },
-diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
-index 0e5b54b..b503f82 100644
---- a/drivers/net/hamradio/6pack.c
-+++ b/drivers/net/hamradio/6pack.c
-@@ -461,6 +461,8 @@ static void sixpack_receive_buf(struct tty_struct *tty,
- unsigned char buf[512];
- int count1;
-
-+ pax_track_stack();
-+
- if (!count)
- return;
-
-diff --git a/drivers/net/ibmveth.c b/drivers/net/ibmveth.c
-index 5862282..7cce8cb 100644
---- a/drivers/net/ibmveth.c
-+++ b/drivers/net/ibmveth.c
-@@ -1577,7 +1577,7 @@ static struct attribute * veth_pool_attrs[] = {
- NULL,
- };
-
--static struct sysfs_ops veth_pool_ops = {
-+static const struct sysfs_ops veth_pool_ops = {
- .show = veth_pool_show,
- .store = veth_pool_store,
- };
-diff --git a/drivers/net/igb/e1000_82575.c b/drivers/net/igb/e1000_82575.c
-index d617f2d..57b5309 100644
---- a/drivers/net/igb/e1000_82575.c
-+++ b/drivers/net/igb/e1000_82575.c
-@@ -1411,7 +1411,7 @@ void igb_vmdq_set_replication_pf(struct e1000_hw *hw, bool enable)
- wr32(E1000_VT_CTL, vt_ctl);
- }
-
--static struct e1000_mac_operations e1000_mac_ops_82575 = {
-+static const struct e1000_mac_operations e1000_mac_ops_82575 = {
- .reset_hw = igb_reset_hw_82575,
- .init_hw = igb_init_hw_82575,
- .check_for_link = igb_check_for_link_82575,
-@@ -1420,13 +1420,13 @@ static struct e1000_mac_operations e1000_mac_ops_82575 = {
- .get_speed_and_duplex = igb_get_speed_and_duplex_copper,
- };
-
--static struct e1000_phy_operations e1000_phy_ops_82575 = {
-+static const struct e1000_phy_operations e1000_phy_ops_82575 = {
- .acquire = igb_acquire_phy_82575,
- .get_cfg_done = igb_get_cfg_done_82575,
- .release = igb_release_phy_82575,
- };
-
--static struct e1000_nvm_operations e1000_nvm_ops_82575 = {
-+static const struct e1000_nvm_operations e1000_nvm_ops_82575 = {
- .acquire = igb_acquire_nvm_82575,
- .read = igb_read_nvm_eerd,
- .release = igb_release_nvm_82575,
-diff --git a/drivers/net/iseries_veth.c b/drivers/net/iseries_veth.c
-index aa7286b..a61394f 100644
---- a/drivers/net/iseries_veth.c
-+++ b/drivers/net/iseries_veth.c
-@@ -384,7 +384,7 @@ static struct attribute *veth_cnx_default_attrs[] = {
- NULL
- };
-
--static struct sysfs_ops veth_cnx_sysfs_ops = {
-+static const struct sysfs_ops veth_cnx_sysfs_ops = {
- .show = veth_cnx_attribute_show
- };
-
-@@ -441,7 +441,7 @@ static struct attribute *veth_port_default_attrs[] = {
- NULL
- };
-
--static struct sysfs_ops veth_port_sysfs_ops = {
-+static const struct sysfs_ops veth_port_sysfs_ops = {
- .show = veth_port_attribute_show
- };
-
-diff --git a/drivers/net/ixgb/ixgb_main.c b/drivers/net/ixgb/ixgb_main.c
-index 8aa44dc..fa1e797 100644
---- a/drivers/net/ixgb/ixgb_main.c
-+++ b/drivers/net/ixgb/ixgb_main.c
-@@ -1052,6 +1052,8 @@ ixgb_set_multi(struct net_device *netdev)
- u32 rctl;
- int i;
-
-+ pax_track_stack();
-+
- /* Check for Promiscuous and All Multicast modes */
-
- rctl = IXGB_READ_REG(hw, RCTL);
-diff --git a/drivers/net/ixgb/ixgb_param.c b/drivers/net/ixgb/ixgb_param.c
-index af35e1d..8781785 100644
---- a/drivers/net/ixgb/ixgb_param.c
-+++ b/drivers/net/ixgb/ixgb_param.c
-@@ -260,6 +260,9 @@ void __devinit
- ixgb_check_options(struct ixgb_adapter *adapter)
- {
- int bd = adapter->bd_number;
-+
-+ pax_track_stack();
-+
- if (bd >= IXGB_MAX_NIC) {
- printk(KERN_NOTICE
- "Warning: no configuration for board #%i\n", bd);
-diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
-index 2490aa3..185d647 100644
---- a/drivers/net/macvlan.c
-+++ b/drivers/net/macvlan.c
-@@ -568,7 +568,7 @@ static void macvlan_dellink(struct net_device *dev)
- macvlan_port_destroy(port->dev);
- }
-
--static struct rtnl_link_ops macvlan_link_ops __read_mostly = {
-+static struct rtnl_link_ops macvlan_link_ops = {
- .kind = "macvlan",
- .priv_size = sizeof(struct macvlan_dev),
- .get_tx_queues = macvlan_get_tx_queues,
-diff --git a/drivers/net/mlx4/main.c b/drivers/net/mlx4/main.c
-index 291a505..2543756 100644
---- a/drivers/net/mlx4/main.c
-+++ b/drivers/net/mlx4/main.c
-@@ -38,6 +38,7 @@
- #include <linux/errno.h>
- #include <linux/pci.h>
- #include <linux/dma-mapping.h>
-+#include <linux/sched.h>
-
- #include <linux/mlx4/device.h>
- #include <linux/mlx4/doorbell.h>
-@@ -730,6 +731,8 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
- u64 icm_size;
- int err;
-
-+ pax_track_stack();
-+
- err = mlx4_QUERY_FW(dev);
- if (err) {
- if (err == -EACCES)
-diff --git a/drivers/net/niu.c b/drivers/net/niu.c
-index 2dce134..fa5ce75 100644
---- a/drivers/net/niu.c
-+++ b/drivers/net/niu.c
-@@ -9128,6 +9128,8 @@ static void __devinit niu_try_msix(struct niu *np, u8 *ldg_num_map)
- int i, num_irqs, err;
- u8 first_ldg;
-
-+ pax_track_stack();
-+
- first_ldg = (NIU_NUM_LDG / parent->num_ports) * np->port;
- for (i = 0; i < (NIU_NUM_LDG / parent->num_ports); i++)
- ldg_num_map[i] = first_ldg + i;
-diff --git a/drivers/net/pasemi_mac.c b/drivers/net/pasemi_mac.c
-index c254a7f..7aa030e 100644
---- a/drivers/net/pasemi_mac.c
-+++ b/drivers/net/pasemi_mac.c
-@@ -1099,9 +1099,9 @@ static int pasemi_mac_phy_init(struct net_device *dev)
- phydev = of_phy_connect(dev, phy_dn, &pasemi_adjust_link, 0,
- PHY_INTERFACE_MODE_SGMII);
-
-- if (IS_ERR(phydev)) {
-+ if (!phydev) {
- printk(KERN_ERR "%s: Could not attach to phy\n", dev->name);
-- return PTR_ERR(phydev);
-+ return -ENODEV;
- }
-
- mac->phydev = phydev;
-diff --git a/drivers/net/pcnet32.c b/drivers/net/pcnet32.c
-index c1b3f09..97cd8c4 100644
---- a/drivers/net/pcnet32.c
-+++ b/drivers/net/pcnet32.c
-@@ -79,7 +79,7 @@ static int cards_found;
- /*
- * VLB I/O addresses
- */
--static unsigned int pcnet32_portlist[] __initdata =
-+static unsigned int pcnet32_portlist[] __devinitdata =
- { 0x300, 0x320, 0x340, 0x360, 0 };
-
- static int pcnet32_debug = 0;
-@@ -267,7 +267,7 @@ struct pcnet32_private {
- struct sk_buff **rx_skbuff;
- dma_addr_t *tx_dma_addr;
- dma_addr_t *rx_dma_addr;
-- struct pcnet32_access a;
-+ struct pcnet32_access *a;
- spinlock_t lock; /* Guard lock */
- unsigned int cur_rx, cur_tx; /* The next free ring entry */
- unsigned int rx_ring_size; /* current rx ring size */
-@@ -457,9 +457,9 @@ static void pcnet32_netif_start(struct net_device *dev)
- u16 val;
-
- netif_wake_queue(dev);
-- val = lp->a.read_csr(ioaddr, CSR3);
-+ val = lp->a->read_csr(ioaddr, CSR3);
- val &= 0x00ff;
-- lp->a.write_csr(ioaddr, CSR3, val);
-+ lp->a->write_csr(ioaddr, CSR3, val);
- napi_enable(&lp->napi);
- }
-
-@@ -744,7 +744,7 @@ static u32 pcnet32_get_link(struct net_device *dev)
- r = mii_link_ok(&lp->mii_if);
- } else if (lp->chip_version >= PCNET32_79C970A) {
- ulong ioaddr = dev->base_addr; /* card base I/O address */
-- r = (lp->a.read_bcr(ioaddr, 4) != 0xc0);
-+ r = (lp->a->read_bcr(ioaddr, 4) != 0xc0);
- } else { /* can not detect link on really old chips */
- r = 1;
- }
-@@ -806,7 +806,7 @@ static int pcnet32_set_ringparam(struct net_device *dev,
- pcnet32_netif_stop(dev);
-
- spin_lock_irqsave(&lp->lock, flags);
-- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
-
- size = min(ering->tx_pending, (unsigned int)TX_MAX_RING_SIZE);
-
-@@ -886,7 +886,7 @@ static void pcnet32_ethtool_test(struct net_device *dev,
- static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
- {
- struct pcnet32_private *lp = netdev_priv(dev);
-- struct pcnet32_access *a = &lp->a; /* access to registers */
-+ struct pcnet32_access *a = lp->a; /* access to registers */
- ulong ioaddr = dev->base_addr; /* card base I/O address */
- struct sk_buff *skb; /* sk buff */
- int x, i; /* counters */
-@@ -906,21 +906,21 @@ static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
- pcnet32_netif_stop(dev);
-
- spin_lock_irqsave(&lp->lock, flags);
-- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
-
- numbuffs = min(numbuffs, (int)min(lp->rx_ring_size, lp->tx_ring_size));
-
- /* Reset the PCNET32 */
-- lp->a.reset(ioaddr);
-- lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
-+ lp->a->reset(ioaddr);
-+ lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
-
- /* switch pcnet32 to 32bit mode */
-- lp->a.write_bcr(ioaddr, 20, 2);
-+ lp->a->write_bcr(ioaddr, 20, 2);
-
- /* purge & init rings but don't actually restart */
- pcnet32_restart(dev, 0x0000);
-
-- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
-
- /* Initialize Transmit buffers. */
- size = data_len + 15;
-@@ -966,10 +966,10 @@ static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
-
- /* set int loopback in CSR15 */
- x = a->read_csr(ioaddr, CSR15) & 0xfffc;
-- lp->a.write_csr(ioaddr, CSR15, x | 0x0044);
-+ lp->a->write_csr(ioaddr, CSR15, x | 0x0044);
-
- teststatus = cpu_to_le16(0x8000);
-- lp->a.write_csr(ioaddr, CSR0, CSR0_START); /* Set STRT bit */
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_START); /* Set STRT bit */
-
- /* Check status of descriptors */
- for (x = 0; x < numbuffs; x++) {
-@@ -990,7 +990,7 @@ static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
- }
- }
-
-- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
- wmb();
- if (netif_msg_hw(lp) && netif_msg_pktdata(lp)) {
- printk(KERN_DEBUG "%s: RX loopback packets:\n", dev->name);
-@@ -1039,7 +1039,7 @@ static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
- pcnet32_restart(dev, CSR0_NORMAL);
- } else {
- pcnet32_purge_rx_ring(dev);
-- lp->a.write_bcr(ioaddr, 20, 4); /* return to 16bit mode */
-+ lp->a->write_bcr(ioaddr, 20, 4); /* return to 16bit mode */
- }
- spin_unlock_irqrestore(&lp->lock, flags);
-
-@@ -1049,7 +1049,7 @@ static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
- static void pcnet32_led_blink_callback(struct net_device *dev)
- {
- struct pcnet32_private *lp = netdev_priv(dev);
-- struct pcnet32_access *a = &lp->a;
-+ struct pcnet32_access *a = lp->a;
- ulong ioaddr = dev->base_addr;
- unsigned long flags;
- int i;
-@@ -1066,7 +1066,7 @@ static void pcnet32_led_blink_callback(struct net_device *dev)
- static int pcnet32_phys_id(struct net_device *dev, u32 data)
- {
- struct pcnet32_private *lp = netdev_priv(dev);
-- struct pcnet32_access *a = &lp->a;
-+ struct pcnet32_access *a = lp->a;
- ulong ioaddr = dev->base_addr;
- unsigned long flags;
- int i, regs[4];
-@@ -1112,7 +1112,7 @@ static int pcnet32_suspend(struct net_device *dev, unsigned long *flags,
- {
- int csr5;
- struct pcnet32_private *lp = netdev_priv(dev);
-- struct pcnet32_access *a = &lp->a;
-+ struct pcnet32_access *a = lp->a;
- ulong ioaddr = dev->base_addr;
- int ticks;
-
-@@ -1388,8 +1388,8 @@ static int pcnet32_poll(struct napi_struct *napi, int budget)
- spin_lock_irqsave(&lp->lock, flags);
- if (pcnet32_tx(dev)) {
- /* reset the chip to clear the error condition, then restart */
-- lp->a.reset(ioaddr);
-- lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
-+ lp->a->reset(ioaddr);
-+ lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
- pcnet32_restart(dev, CSR0_START);
- netif_wake_queue(dev);
- }
-@@ -1401,12 +1401,12 @@ static int pcnet32_poll(struct napi_struct *napi, int budget)
- __napi_complete(napi);
-
- /* clear interrupt masks */
-- val = lp->a.read_csr(ioaddr, CSR3);
-+ val = lp->a->read_csr(ioaddr, CSR3);
- val &= 0x00ff;
-- lp->a.write_csr(ioaddr, CSR3, val);
-+ lp->a->write_csr(ioaddr, CSR3, val);
-
- /* Set interrupt enable. */
-- lp->a.write_csr(ioaddr, CSR0, CSR0_INTEN);
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_INTEN);
-
- spin_unlock_irqrestore(&lp->lock, flags);
- }
-@@ -1429,7 +1429,7 @@ static void pcnet32_get_regs(struct net_device *dev, struct ethtool_regs *regs,
- int i, csr0;
- u16 *buff = ptr;
- struct pcnet32_private *lp = netdev_priv(dev);
-- struct pcnet32_access *a = &lp->a;
-+ struct pcnet32_access *a = lp->a;
- ulong ioaddr = dev->base_addr;
- unsigned long flags;
-
-@@ -1466,9 +1466,9 @@ static void pcnet32_get_regs(struct net_device *dev, struct ethtool_regs *regs,
- for (j = 0; j < PCNET32_MAX_PHYS; j++) {
- if (lp->phymask & (1 << j)) {
- for (i = 0; i < PCNET32_REGS_PER_PHY; i++) {
-- lp->a.write_bcr(ioaddr, 33,
-+ lp->a->write_bcr(ioaddr, 33,
- (j << 5) | i);
-- *buff++ = lp->a.read_bcr(ioaddr, 34);
-+ *buff++ = lp->a->read_bcr(ioaddr, 34);
- }
- }
- }
-@@ -1858,7 +1858,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
- ((cards_found >= MAX_UNITS) || full_duplex[cards_found]))
- lp->options |= PCNET32_PORT_FD;
-
-- lp->a = *a;
-+ lp->a = a;
-
- /* prior to register_netdev, dev->name is not yet correct */
- if (pcnet32_alloc_ring(dev, pci_name(lp->pci_dev))) {
-@@ -1917,7 +1917,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
- if (lp->mii) {
- /* lp->phycount and lp->phymask are set to 0 by memset above */
-
-- lp->mii_if.phy_id = ((lp->a.read_bcr(ioaddr, 33)) >> 5) & 0x1f;
-+ lp->mii_if.phy_id = ((lp->a->read_bcr(ioaddr, 33)) >> 5) & 0x1f;
- /* scan for PHYs */
- for (i = 0; i < PCNET32_MAX_PHYS; i++) {
- unsigned short id1, id2;
-@@ -1938,7 +1938,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
- "Found PHY %04x:%04x at address %d.\n",
- id1, id2, i);
- }
-- lp->a.write_bcr(ioaddr, 33, (lp->mii_if.phy_id) << 5);
-+ lp->a->write_bcr(ioaddr, 33, (lp->mii_if.phy_id) << 5);
- if (lp->phycount > 1) {
- lp->options |= PCNET32_PORT_MII;
- }
-@@ -2109,10 +2109,10 @@ static int pcnet32_open(struct net_device *dev)
- }
-
- /* Reset the PCNET32 */
-- lp->a.reset(ioaddr);
-+ lp->a->reset(ioaddr);
-
- /* switch pcnet32 to 32bit mode */
-- lp->a.write_bcr(ioaddr, 20, 2);
-+ lp->a->write_bcr(ioaddr, 20, 2);
-
- if (netif_msg_ifup(lp))
- printk(KERN_DEBUG
-@@ -2122,14 +2122,14 @@ static int pcnet32_open(struct net_device *dev)
- (u32) (lp->init_dma_addr));
-
- /* set/reset autoselect bit */
-- val = lp->a.read_bcr(ioaddr, 2) & ~2;
-+ val = lp->a->read_bcr(ioaddr, 2) & ~2;
- if (lp->options & PCNET32_PORT_ASEL)
- val |= 2;
-- lp->a.write_bcr(ioaddr, 2, val);
-+ lp->a->write_bcr(ioaddr, 2, val);
-
- /* handle full duplex setting */
- if (lp->mii_if.full_duplex) {
-- val = lp->a.read_bcr(ioaddr, 9) & ~3;
-+ val = lp->a->read_bcr(ioaddr, 9) & ~3;
- if (lp->options & PCNET32_PORT_FD) {
- val |= 1;
- if (lp->options == (PCNET32_PORT_FD | PCNET32_PORT_AUI))
-@@ -2139,14 +2139,14 @@ static int pcnet32_open(struct net_device *dev)
- if (lp->chip_version == 0x2627)
- val |= 3;
- }
-- lp->a.write_bcr(ioaddr, 9, val);
-+ lp->a->write_bcr(ioaddr, 9, val);
- }
-
- /* set/reset GPSI bit in test register */
-- val = lp->a.read_csr(ioaddr, 124) & ~0x10;
-+ val = lp->a->read_csr(ioaddr, 124) & ~0x10;
- if ((lp->options & PCNET32_PORT_PORTSEL) == PCNET32_PORT_GPSI)
- val |= 0x10;
-- lp->a.write_csr(ioaddr, 124, val);
-+ lp->a->write_csr(ioaddr, 124, val);
-
- /* Allied Telesyn AT 2700/2701 FX are 100Mbit only and do not negotiate */
- if (pdev && pdev->subsystem_vendor == PCI_VENDOR_ID_AT &&
-@@ -2167,24 +2167,24 @@ static int pcnet32_open(struct net_device *dev)
- * duplex, and/or enable auto negotiation, and clear DANAS
- */
- if (lp->mii && !(lp->options & PCNET32_PORT_ASEL)) {
-- lp->a.write_bcr(ioaddr, 32,
-- lp->a.read_bcr(ioaddr, 32) | 0x0080);
-+ lp->a->write_bcr(ioaddr, 32,
-+ lp->a->read_bcr(ioaddr, 32) | 0x0080);
- /* disable Auto Negotiation, set 10Mpbs, HD */
-- val = lp->a.read_bcr(ioaddr, 32) & ~0xb8;
-+ val = lp->a->read_bcr(ioaddr, 32) & ~0xb8;
- if (lp->options & PCNET32_PORT_FD)
- val |= 0x10;
- if (lp->options & PCNET32_PORT_100)
- val |= 0x08;
-- lp->a.write_bcr(ioaddr, 32, val);
-+ lp->a->write_bcr(ioaddr, 32, val);
- } else {
- if (lp->options & PCNET32_PORT_ASEL) {
-- lp->a.write_bcr(ioaddr, 32,
-- lp->a.read_bcr(ioaddr,
-+ lp->a->write_bcr(ioaddr, 32,
-+ lp->a->read_bcr(ioaddr,
- 32) | 0x0080);
- /* enable auto negotiate, setup, disable fd */
-- val = lp->a.read_bcr(ioaddr, 32) & ~0x98;
-+ val = lp->a->read_bcr(ioaddr, 32) & ~0x98;
- val |= 0x20;
-- lp->a.write_bcr(ioaddr, 32, val);
-+ lp->a->write_bcr(ioaddr, 32, val);
- }
- }
- } else {
-@@ -2197,10 +2197,10 @@ static int pcnet32_open(struct net_device *dev)
- * There is really no good other way to handle multiple PHYs
- * other than turning off all automatics
- */
-- val = lp->a.read_bcr(ioaddr, 2);
-- lp->a.write_bcr(ioaddr, 2, val & ~2);
-- val = lp->a.read_bcr(ioaddr, 32);
-- lp->a.write_bcr(ioaddr, 32, val & ~(1 << 7)); /* stop MII manager */
-+ val = lp->a->read_bcr(ioaddr, 2);
-+ lp->a->write_bcr(ioaddr, 2, val & ~2);
-+ val = lp->a->read_bcr(ioaddr, 32);
-+ lp->a->write_bcr(ioaddr, 32, val & ~(1 << 7)); /* stop MII manager */
-
- if (!(lp->options & PCNET32_PORT_ASEL)) {
- /* setup ecmd */
-@@ -2210,7 +2210,7 @@ static int pcnet32_open(struct net_device *dev)
- ecmd.speed =
- lp->
- options & PCNET32_PORT_100 ? SPEED_100 : SPEED_10;
-- bcr9 = lp->a.read_bcr(ioaddr, 9);
-+ bcr9 = lp->a->read_bcr(ioaddr, 9);
-
- if (lp->options & PCNET32_PORT_FD) {
- ecmd.duplex = DUPLEX_FULL;
-@@ -2219,7 +2219,7 @@ static int pcnet32_open(struct net_device *dev)
- ecmd.duplex = DUPLEX_HALF;
- bcr9 |= ~(1 << 0);
- }
-- lp->a.write_bcr(ioaddr, 9, bcr9);
-+ lp->a->write_bcr(ioaddr, 9, bcr9);
- }
-
- for (i = 0; i < PCNET32_MAX_PHYS; i++) {
-@@ -2252,9 +2252,9 @@ static int pcnet32_open(struct net_device *dev)
-
- #ifdef DO_DXSUFLO
- if (lp->dxsuflo) { /* Disable transmit stop on underflow */
-- val = lp->a.read_csr(ioaddr, CSR3);
-+ val = lp->a->read_csr(ioaddr, CSR3);
- val |= 0x40;
-- lp->a.write_csr(ioaddr, CSR3, val);
-+ lp->a->write_csr(ioaddr, CSR3, val);
- }
- #endif
-
-@@ -2270,11 +2270,11 @@ static int pcnet32_open(struct net_device *dev)
- napi_enable(&lp->napi);
-
- /* Re-initialize the PCNET32, and start it when done. */
-- lp->a.write_csr(ioaddr, 1, (lp->init_dma_addr & 0xffff));
-- lp->a.write_csr(ioaddr, 2, (lp->init_dma_addr >> 16));
-+ lp->a->write_csr(ioaddr, 1, (lp->init_dma_addr & 0xffff));
-+ lp->a->write_csr(ioaddr, 2, (lp->init_dma_addr >> 16));
-
-- lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
-- lp->a.write_csr(ioaddr, CSR0, CSR0_INIT);
-+ lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_INIT);
-
- netif_start_queue(dev);
-
-@@ -2286,20 +2286,20 @@ static int pcnet32_open(struct net_device *dev)
-
- i = 0;
- while (i++ < 100)
-- if (lp->a.read_csr(ioaddr, CSR0) & CSR0_IDON)
-+ if (lp->a->read_csr(ioaddr, CSR0) & CSR0_IDON)
- break;
- /*
- * We used to clear the InitDone bit, 0x0100, here but Mark Stockton
- * reports that doing so triggers a bug in the '974.
- */
-- lp->a.write_csr(ioaddr, CSR0, CSR0_NORMAL);
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_NORMAL);
-
- if (netif_msg_ifup(lp))
- printk(KERN_DEBUG
- "%s: pcnet32 open after %d ticks, init block %#x csr0 %4.4x.\n",
- dev->name, i,
- (u32) (lp->init_dma_addr),
-- lp->a.read_csr(ioaddr, CSR0));
-+ lp->a->read_csr(ioaddr, CSR0));
-
- spin_unlock_irqrestore(&lp->lock, flags);
-
-@@ -2313,7 +2313,7 @@ static int pcnet32_open(struct net_device *dev)
- * Switch back to 16bit mode to avoid problems with dumb
- * DOS packet driver after a warm reboot
- */
-- lp->a.write_bcr(ioaddr, 20, 4);
-+ lp->a->write_bcr(ioaddr, 20, 4);
-
- err_free_irq:
- spin_unlock_irqrestore(&lp->lock, flags);
-@@ -2420,7 +2420,7 @@ static void pcnet32_restart(struct net_device *dev, unsigned int csr0_bits)
-
- /* wait for stop */
- for (i = 0; i < 100; i++)
-- if (lp->a.read_csr(ioaddr, CSR0) & CSR0_STOP)
-+ if (lp->a->read_csr(ioaddr, CSR0) & CSR0_STOP)
- break;
-
- if (i >= 100 && netif_msg_drv(lp))
-@@ -2433,13 +2433,13 @@ static void pcnet32_restart(struct net_device *dev, unsigned int csr0_bits)
- return;
-
- /* ReInit Ring */
-- lp->a.write_csr(ioaddr, CSR0, CSR0_INIT);
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_INIT);
- i = 0;
- while (i++ < 1000)
-- if (lp->a.read_csr(ioaddr, CSR0) & CSR0_IDON)
-+ if (lp->a->read_csr(ioaddr, CSR0) & CSR0_IDON)
- break;
-
-- lp->a.write_csr(ioaddr, CSR0, csr0_bits);
-+ lp->a->write_csr(ioaddr, CSR0, csr0_bits);
- }
-
- static void pcnet32_tx_timeout(struct net_device *dev)
-@@ -2452,8 +2452,8 @@ static void pcnet32_tx_timeout(struct net_device *dev)
- if (pcnet32_debug & NETIF_MSG_DRV)
- printk(KERN_ERR
- "%s: transmit timed out, status %4.4x, resetting.\n",
-- dev->name, lp->a.read_csr(ioaddr, CSR0));
-- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
-+ dev->name, lp->a->read_csr(ioaddr, CSR0));
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
- dev->stats.tx_errors++;
- if (netif_msg_tx_err(lp)) {
- int i;
-@@ -2497,7 +2497,7 @@ static netdev_tx_t pcnet32_start_xmit(struct sk_buff *skb,
- if (netif_msg_tx_queued(lp)) {
- printk(KERN_DEBUG
- "%s: pcnet32_start_xmit() called, csr0 %4.4x.\n",
-- dev->name, lp->a.read_csr(ioaddr, CSR0));
-+ dev->name, lp->a->read_csr(ioaddr, CSR0));
- }
-
- /* Default status -- will not enable Successful-TxDone
-@@ -2528,7 +2528,7 @@ static netdev_tx_t pcnet32_start_xmit(struct sk_buff *skb,
- dev->stats.tx_bytes += skb->len;
-
- /* Trigger an immediate send poll. */
-- lp->a.write_csr(ioaddr, CSR0, CSR0_INTEN | CSR0_TXPOLL);
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_INTEN | CSR0_TXPOLL);
-
- dev->trans_start = jiffies;
-
-@@ -2555,18 +2555,18 @@ pcnet32_interrupt(int irq, void *dev_id)
-
- spin_lock(&lp->lock);
-
-- csr0 = lp->a.read_csr(ioaddr, CSR0);
-+ csr0 = lp->a->read_csr(ioaddr, CSR0);
- while ((csr0 & 0x8f00) && --boguscnt >= 0) {
- if (csr0 == 0xffff) {
- break; /* PCMCIA remove happened */
- }
- /* Acknowledge all of the current interrupt sources ASAP. */
-- lp->a.write_csr(ioaddr, CSR0, csr0 & ~0x004f);
-+ lp->a->write_csr(ioaddr, CSR0, csr0 & ~0x004f);
-
- if (netif_msg_intr(lp))
- printk(KERN_DEBUG
- "%s: interrupt csr0=%#2.2x new csr=%#2.2x.\n",
-- dev->name, csr0, lp->a.read_csr(ioaddr, CSR0));
-+ dev->name, csr0, lp->a->read_csr(ioaddr, CSR0));
-
- /* Log misc errors. */
- if (csr0 & 0x4000)
-@@ -2595,19 +2595,19 @@ pcnet32_interrupt(int irq, void *dev_id)
- if (napi_schedule_prep(&lp->napi)) {
- u16 val;
- /* set interrupt masks */
-- val = lp->a.read_csr(ioaddr, CSR3);
-+ val = lp->a->read_csr(ioaddr, CSR3);
- val |= 0x5f00;
-- lp->a.write_csr(ioaddr, CSR3, val);
-+ lp->a->write_csr(ioaddr, CSR3, val);
-
- __napi_schedule(&lp->napi);
- break;
- }
-- csr0 = lp->a.read_csr(ioaddr, CSR0);
-+ csr0 = lp->a->read_csr(ioaddr, CSR0);
- }
-
- if (netif_msg_intr(lp))
- printk(KERN_DEBUG "%s: exiting interrupt, csr0=%#4.4x.\n",
-- dev->name, lp->a.read_csr(ioaddr, CSR0));
-+ dev->name, lp->a->read_csr(ioaddr, CSR0));
-
- spin_unlock(&lp->lock);
-
-@@ -2627,21 +2627,21 @@ static int pcnet32_close(struct net_device *dev)
-
- spin_lock_irqsave(&lp->lock, flags);
-
-- dev->stats.rx_missed_errors = lp->a.read_csr(ioaddr, 112);
-+ dev->stats.rx_missed_errors = lp->a->read_csr(ioaddr, 112);
-
- if (netif_msg_ifdown(lp))
- printk(KERN_DEBUG
- "%s: Shutting down ethercard, status was %2.2x.\n",
-- dev->name, lp->a.read_csr(ioaddr, CSR0));
-+ dev->name, lp->a->read_csr(ioaddr, CSR0));
-
- /* We stop the PCNET32 here -- it occasionally polls memory if we don't. */
-- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
-
- /*
- * Switch back to 16bit mode to avoid problems with dumb
- * DOS packet driver after a warm reboot
- */
-- lp->a.write_bcr(ioaddr, 20, 4);
-+ lp->a->write_bcr(ioaddr, 20, 4);
-
- spin_unlock_irqrestore(&lp->lock, flags);
-
-@@ -2664,7 +2664,7 @@ static struct net_device_stats *pcnet32_get_stats(struct net_device *dev)
- unsigned long flags;
-
- spin_lock_irqsave(&lp->lock, flags);
-- dev->stats.rx_missed_errors = lp->a.read_csr(ioaddr, 112);
-+ dev->stats.rx_missed_errors = lp->a->read_csr(ioaddr, 112);
- spin_unlock_irqrestore(&lp->lock, flags);
-
- return &dev->stats;
-@@ -2686,10 +2686,10 @@ static void pcnet32_load_multicast(struct net_device *dev)
- if (dev->flags & IFF_ALLMULTI) {
- ib->filter[0] = cpu_to_le32(~0U);
- ib->filter[1] = cpu_to_le32(~0U);
-- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER, 0xffff);
-- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+1, 0xffff);
-- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+2, 0xffff);
-- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+3, 0xffff);
-+ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER, 0xffff);
-+ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+1, 0xffff);
-+ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+2, 0xffff);
-+ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+3, 0xffff);
- return;
- }
- /* clear the multicast filter */
-@@ -2710,7 +2710,7 @@ static void pcnet32_load_multicast(struct net_device *dev)
- mcast_table[crc >> 4] |= cpu_to_le16(1 << (crc & 0xf));
- }
- for (i = 0; i < 4; i++)
-- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER + i,
-+ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER + i,
- le16_to_cpu(mcast_table[i]));
- return;
- }
-@@ -2726,7 +2726,7 @@ static void pcnet32_set_multicast_list(struct net_device *dev)
-
- spin_lock_irqsave(&lp->lock, flags);
- suspended = pcnet32_suspend(dev, &flags, 0);
-- csr15 = lp->a.read_csr(ioaddr, CSR15);
-+ csr15 = lp->a->read_csr(ioaddr, CSR15);
- if (dev->flags & IFF_PROMISC) {
- /* Log any net taps. */
- if (netif_msg_hw(lp))
-@@ -2735,21 +2735,21 @@ static void pcnet32_set_multicast_list(struct net_device *dev)
- lp->init_block->mode =
- cpu_to_le16(0x8000 | (lp->options & PCNET32_PORT_PORTSEL) <<
- 7);
-- lp->a.write_csr(ioaddr, CSR15, csr15 | 0x8000);
-+ lp->a->write_csr(ioaddr, CSR15, csr15 | 0x8000);
- } else {
- lp->init_block->mode =
- cpu_to_le16((lp->options & PCNET32_PORT_PORTSEL) << 7);
-- lp->a.write_csr(ioaddr, CSR15, csr15 & 0x7fff);
-+ lp->a->write_csr(ioaddr, CSR15, csr15 & 0x7fff);
- pcnet32_load_multicast(dev);
- }
-
- if (suspended) {
- int csr5;
- /* clear SUSPEND (SPND) - CSR5 bit 0 */
-- csr5 = lp->a.read_csr(ioaddr, CSR5);
-- lp->a.write_csr(ioaddr, CSR5, csr5 & (~CSR5_SUSPEND));
-+ csr5 = lp->a->read_csr(ioaddr, CSR5);
-+ lp->a->write_csr(ioaddr, CSR5, csr5 & (~CSR5_SUSPEND));
- } else {
-- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
- pcnet32_restart(dev, CSR0_NORMAL);
- netif_wake_queue(dev);
- }
-@@ -2767,8 +2767,8 @@ static int mdio_read(struct net_device *dev, int phy_id, int reg_num)
- if (!lp->mii)
- return 0;
-
-- lp->a.write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
-- val_out = lp->a.read_bcr(ioaddr, 34);
-+ lp->a->write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
-+ val_out = lp->a->read_bcr(ioaddr, 34);
-
- return val_out;
- }
-@@ -2782,8 +2782,8 @@ static void mdio_write(struct net_device *dev, int phy_id, int reg_num, int val)
- if (!lp->mii)
- return;
-
-- lp->a.write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
-- lp->a.write_bcr(ioaddr, 34, val);
-+ lp->a->write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
-+ lp->a->write_bcr(ioaddr, 34, val);
- }
-
- static int pcnet32_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
-@@ -2862,7 +2862,7 @@ static void pcnet32_check_media(struct net_device *dev, int verbose)
- curr_link = mii_link_ok(&lp->mii_if);
- } else {
- ulong ioaddr = dev->base_addr; /* card base I/O address */
-- curr_link = (lp->a.read_bcr(ioaddr, 4) != 0xc0);
-+ curr_link = (lp->a->read_bcr(ioaddr, 4) != 0xc0);
- }
- if (!curr_link) {
- if (prev_link || verbose) {
-@@ -2887,13 +2887,13 @@ static void pcnet32_check_media(struct net_device *dev, int verbose)
- (ecmd.duplex ==
- DUPLEX_FULL) ? "full" : "half");
- }
-- bcr9 = lp->a.read_bcr(dev->base_addr, 9);
-+ bcr9 = lp->a->read_bcr(dev->base_addr, 9);
- if ((bcr9 & (1 << 0)) != lp->mii_if.full_duplex) {
- if (lp->mii_if.full_duplex)
- bcr9 |= (1 << 0);
- else
- bcr9 &= ~(1 << 0);
-- lp->a.write_bcr(dev->base_addr, 9, bcr9);
-+ lp->a->write_bcr(dev->base_addr, 9, bcr9);
- }
- } else {
- if (netif_msg_link(lp))
-diff --git a/drivers/net/phy/mdio-bitbang.c b/drivers/net/phy/mdio-bitbang.c
-index 2576055..4b8b7d3 100644
---- a/drivers/net/phy/mdio-bitbang.c
-+++ b/drivers/net/phy/mdio-bitbang.c
-@@ -184,6 +184,7 @@ void free_mdio_bitbang(struct mii_bus *bus)
- struct mdiobb_ctrl *ctrl = bus->priv;
-
- module_put(ctrl->ops->owner);
-+ mdiobus_unregister(bus);
- mdiobus_free(bus);
- }
- EXPORT_SYMBOL(free_mdio_bitbang);
-diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c
-index 9235901..d31e726 100644
---- a/drivers/net/pppol2tp.c
-+++ b/drivers/net/pppol2tp.c
-@@ -1174,7 +1174,7 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
-
- /* Get routing info from the tunnel socket */
- skb_dst_drop(skb);
-- skb_dst_set(skb, dst_clone(__sk_dst_get(sk_tun)));
-+ skb_dst_set(skb, dst_clone(__sk_dst_check(sk_tun, 0)));
- pppol2tp_skb_set_owner_w(skb, sk_tun);
-
- /* Calculate UDP checksum if configured to do so */
-diff --git a/drivers/net/sis190.c b/drivers/net/sis190.c
-index 7cc9898..6eb50d3 100644
---- a/drivers/net/sis190.c
-+++ b/drivers/net/sis190.c
-@@ -1598,7 +1598,7 @@ static int __devinit sis190_get_mac_addr_from_eeprom(struct pci_dev *pdev,
- static int __devinit sis190_get_mac_addr_from_apc(struct pci_dev *pdev,
- struct net_device *dev)
- {
-- static const u16 __devinitdata ids[] = { 0x0965, 0x0966, 0x0968 };
-+ static const u16 __devinitconst ids[] = { 0x0965, 0x0966, 0x0968 };
- struct sis190_private *tp = netdev_priv(dev);
- struct pci_dev *isa_bridge;
- u8 reg, tmp8;
-diff --git a/drivers/net/sundance.c b/drivers/net/sundance.c
-index e13685a..60c948c 100644
---- a/drivers/net/sundance.c
-+++ b/drivers/net/sundance.c
-@@ -225,7 +225,7 @@ enum {
- struct pci_id_info {
- const char *name;
- };
--static const struct pci_id_info pci_id_tbl[] __devinitdata = {
-+static const struct pci_id_info pci_id_tbl[] __devinitconst = {
- {"D-Link DFE-550TX FAST Ethernet Adapter"},
- {"D-Link DFE-550FX 100Mbps Fiber-optics Adapter"},
- {"D-Link DFE-580TX 4 port Server Adapter"},
-diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
-index 529f55a..cccaa18 100644
---- a/drivers/net/tg3.h
-+++ b/drivers/net/tg3.h
-@@ -95,6 +95,7 @@
- #define CHIPREV_ID_5750_A0 0x4000
- #define CHIPREV_ID_5750_A1 0x4001
- #define CHIPREV_ID_5750_A3 0x4003
-+#define CHIPREV_ID_5750_C1 0x4201
- #define CHIPREV_ID_5750_C2 0x4202
- #define CHIPREV_ID_5752_A0_HW 0x5000
- #define CHIPREV_ID_5752_A0 0x6000
-diff --git a/drivers/net/tokenring/abyss.c b/drivers/net/tokenring/abyss.c
-index b9db1b5..720f9ce 100644
---- a/drivers/net/tokenring/abyss.c
-+++ b/drivers/net/tokenring/abyss.c
-@@ -451,10 +451,12 @@ static struct pci_driver abyss_driver = {
-
- static int __init abyss_init (void)
- {
-- abyss_netdev_ops = tms380tr_netdev_ops;
-+ pax_open_kernel();
-+ memcpy((void *)&abyss_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
-
-- abyss_netdev_ops.ndo_open = abyss_open;
-- abyss_netdev_ops.ndo_stop = abyss_close;
-+ *(void **)&abyss_netdev_ops.ndo_open = abyss_open;
-+ *(void **)&abyss_netdev_ops.ndo_stop = abyss_close;
-+ pax_close_kernel();
-
- return pci_register_driver(&abyss_driver);
- }
-diff --git a/drivers/net/tokenring/madgemc.c b/drivers/net/tokenring/madgemc.c
-index 456f8bf..373e56d 100644
---- a/drivers/net/tokenring/madgemc.c
-+++ b/drivers/net/tokenring/madgemc.c
-@@ -755,9 +755,11 @@ static struct mca_driver madgemc_driver = {
-
- static int __init madgemc_init (void)
- {
-- madgemc_netdev_ops = tms380tr_netdev_ops;
-- madgemc_netdev_ops.ndo_open = madgemc_open;
-- madgemc_netdev_ops.ndo_stop = madgemc_close;
-+ pax_open_kernel();
-+ memcpy((void *)&madgemc_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
-+ *(void **)&madgemc_netdev_ops.ndo_open = madgemc_open;
-+ *(void **)&madgemc_netdev_ops.ndo_stop = madgemc_close;
-+ pax_close_kernel();
-
- return mca_register_driver (&madgemc_driver);
- }
-diff --git a/drivers/net/tokenring/proteon.c b/drivers/net/tokenring/proteon.c
-index 16e8783..925bd49 100644
---- a/drivers/net/tokenring/proteon.c
-+++ b/drivers/net/tokenring/proteon.c
-@@ -353,9 +353,11 @@ static int __init proteon_init(void)
- struct platform_device *pdev;
- int i, num = 0, err = 0;
-
-- proteon_netdev_ops = tms380tr_netdev_ops;
-- proteon_netdev_ops.ndo_open = proteon_open;
-- proteon_netdev_ops.ndo_stop = tms380tr_close;
-+ pax_open_kernel();
-+ memcpy((void *)&proteon_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
-+ *(void **)&proteon_netdev_ops.ndo_open = proteon_open;
-+ *(void **)&proteon_netdev_ops.ndo_stop = tms380tr_close;
-+ pax_close_kernel();
-
- err = platform_driver_register(&proteon_driver);
- if (err)
-diff --git a/drivers/net/tokenring/skisa.c b/drivers/net/tokenring/skisa.c
-index 46db5c5..37c1536 100644
---- a/drivers/net/tokenring/skisa.c
-+++ b/drivers/net/tokenring/skisa.c
-@@ -363,9 +363,11 @@ static int __init sk_isa_init(void)
- struct platform_device *pdev;
- int i, num = 0, err = 0;
-
-- sk_isa_netdev_ops = tms380tr_netdev_ops;
-- sk_isa_netdev_ops.ndo_open = sk_isa_open;
-- sk_isa_netdev_ops.ndo_stop = tms380tr_close;
-+ pax_open_kernel();
-+ memcpy((void *)&sk_isa_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
-+ *(void **)&sk_isa_netdev_ops.ndo_open = sk_isa_open;
-+ *(void **)&sk_isa_netdev_ops.ndo_stop = tms380tr_close;
-+ pax_close_kernel();
-
- err = platform_driver_register(&sk_isa_driver);
- if (err)
-diff --git a/drivers/net/tulip/de2104x.c b/drivers/net/tulip/de2104x.c
-index 74e5ba4..5cf6bc9 100644
---- a/drivers/net/tulip/de2104x.c
-+++ b/drivers/net/tulip/de2104x.c
-@@ -1785,6 +1785,8 @@ static void __devinit de21041_get_srom_info (struct de_private *de)
- struct de_srom_info_leaf *il;
- void *bufp;
-
-+ pax_track_stack();
-+
- /* download entire eeprom */
- for (i = 0; i < DE_EEPROM_WORDS; i++)
- ((__le16 *)ee_data)[i] =
-diff --git a/drivers/net/tulip/de4x5.c b/drivers/net/tulip/de4x5.c
-index a8349b7..90f9dfe 100644
---- a/drivers/net/tulip/de4x5.c
-+++ b/drivers/net/tulip/de4x5.c
-@@ -5472,7 +5472,7 @@ de4x5_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
- for (i=0; i<ETH_ALEN; i++) {
- tmp.addr[i] = dev->dev_addr[i];
- }
-- if (copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
-+ if (ioc->len > sizeof tmp.addr || copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
- break;
-
- case DE4X5_SET_HWADDR: /* Set the hardware address */
-@@ -5512,7 +5512,7 @@ de4x5_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
- spin_lock_irqsave(&lp->lock, flags);
- memcpy(&statbuf, &lp->pktStats, ioc->len);
- spin_unlock_irqrestore(&lp->lock, flags);
-- if (copy_to_user(ioc->data, &statbuf, ioc->len))
-+ if (ioc->len > sizeof statbuf || copy_to_user(ioc->data, &statbuf, ioc->len))
- return -EFAULT;
- break;
- }
-diff --git a/drivers/net/tulip/eeprom.c b/drivers/net/tulip/eeprom.c
-index 391acd3..56d11cd 100644
---- a/drivers/net/tulip/eeprom.c
-+++ b/drivers/net/tulip/eeprom.c
-@@ -80,7 +80,7 @@ static struct eeprom_fixup eeprom_fixups[] __devinitdata = {
- {NULL}};
-
-
--static const char *block_name[] __devinitdata = {
-+static const char *block_name[] __devinitconst = {
- "21140 non-MII",
- "21140 MII PHY",
- "21142 Serial PHY",
-diff --git a/drivers/net/tulip/winbond-840.c b/drivers/net/tulip/winbond-840.c
-index b38d3b7..b1cff23 100644
---- a/drivers/net/tulip/winbond-840.c
-+++ b/drivers/net/tulip/winbond-840.c
-@@ -235,7 +235,7 @@ struct pci_id_info {
- int drv_flags; /* Driver use, intended as capability flags. */
- };
-
--static const struct pci_id_info pci_id_tbl[] __devinitdata = {
-+static const struct pci_id_info pci_id_tbl[] __devinitconst = {
- { /* Sometime a Level-One switch card. */
- "Winbond W89c840", CanHaveMII | HasBrokenTx | FDXOnNoMII},
- { "Winbond W89c840", CanHaveMII | HasBrokenTx},
-diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
-index f450bc9..2b747c8 100644
---- a/drivers/net/usb/hso.c
-+++ b/drivers/net/usb/hso.c
-@@ -71,7 +71,7 @@
- #include <asm/byteorder.h>
- #include <linux/serial_core.h>
- #include <linux/serial.h>
--
-+#include <asm/local.h>
-
- #define DRIVER_VERSION "1.2"
- #define MOD_AUTHOR "Option Wireless"
-@@ -258,7 +258,7 @@ struct hso_serial {
-
- /* from usb_serial_port */
- struct tty_struct *tty;
-- int open_count;
-+ local_t open_count;
- spinlock_t serial_lock;
-
- int (*write_data) (struct hso_serial *serial);
-@@ -1180,7 +1180,7 @@ static void put_rxbuf_data_and_resubmit_ctrl_urb(struct hso_serial *serial)
- struct urb *urb;
-
- urb = serial->rx_urb[0];
-- if (serial->open_count > 0) {
-+ if (local_read(&serial->open_count) > 0) {
- count = put_rxbuf_data(urb, serial);
- if (count == -1)
- return;
-@@ -1216,7 +1216,7 @@ static void hso_std_serial_read_bulk_callback(struct urb *urb)
- DUMP1(urb->transfer_buffer, urb->actual_length);
-
- /* Anyone listening? */
-- if (serial->open_count == 0)
-+ if (local_read(&serial->open_count) == 0)
- return;
-
- if (status == 0) {
-@@ -1311,8 +1311,7 @@ static int hso_serial_open(struct tty_struct *tty, struct file *filp)
- spin_unlock_irq(&serial->serial_lock);
-
- /* check for port already opened, if not set the termios */
-- serial->open_count++;
-- if (serial->open_count == 1) {
-+ if (local_inc_return(&serial->open_count) == 1) {
- tty->low_latency = 1;
- serial->rx_state = RX_IDLE;
- /* Force default termio settings */
-@@ -1325,7 +1324,7 @@ static int hso_serial_open(struct tty_struct *tty, struct file *filp)
- result = hso_start_serial_device(serial->parent, GFP_KERNEL);
- if (result) {
- hso_stop_serial_device(serial->parent);
-- serial->open_count--;
-+ local_dec(&serial->open_count);
- kref_put(&serial->parent->ref, hso_serial_ref_free);
- }
- } else {
-@@ -1362,10 +1361,10 @@ static void hso_serial_close(struct tty_struct *tty, struct file *filp)
-
- /* reset the rts and dtr */
- /* do the actual close */
-- serial->open_count--;
-+ local_dec(&serial->open_count);
-
-- if (serial->open_count <= 0) {
-- serial->open_count = 0;
-+ if (local_read(&serial->open_count) <= 0) {
-+ local_set(&serial->open_count, 0);
- spin_lock_irq(&serial->serial_lock);
- if (serial->tty == tty) {
- serial->tty->driver_data = NULL;
-@@ -1447,7 +1446,7 @@ static void hso_serial_set_termios(struct tty_struct *tty, struct ktermios *old)
-
- /* the actual setup */
- spin_lock_irqsave(&serial->serial_lock, flags);
-- if (serial->open_count)
-+ if (local_read(&serial->open_count))
- _hso_serial_set_termios(tty, old);
- else
- tty->termios = old;
-@@ -3097,7 +3096,7 @@ static int hso_resume(struct usb_interface *iface)
- /* Start all serial ports */
- for (i = 0; i < HSO_SERIAL_TTY_MINORS; i++) {
- if (serial_table[i] && (serial_table[i]->interface == iface)) {
-- if (dev2ser(serial_table[i])->open_count) {
-+ if (local_read(&dev2ser(serial_table[i])->open_count)) {
- result =
- hso_start_serial_device(serial_table[i], GFP_NOIO);
- hso_kick_transmit(dev2ser(serial_table[i]));
-diff --git a/drivers/net/vxge/vxge-config.c b/drivers/net/vxge/vxge-config.c
-index 9e94c4b..316ee65 100644
---- a/drivers/net/vxge/vxge-config.c
-+++ b/drivers/net/vxge/vxge-config.c
-@@ -1467,7 +1467,9 @@ __vxge_hw_ring_create(struct __vxge_hw_vpath_handle *vp,
- struct vxge_hw_ring_config *config;
- struct __vxge_hw_device *hldev;
- u32 vp_id;
-- struct vxge_hw_mempool_cbs ring_mp_callback;
-+ static struct vxge_hw_mempool_cbs ring_mp_callback = {
-+ .item_func_alloc = __vxge_hw_ring_mempool_item_alloc,
-+ };
-
- if ((vp == NULL) || (attr == NULL)) {
- status = VXGE_HW_FAIL;
-@@ -1521,7 +1523,6 @@ __vxge_hw_ring_create(struct __vxge_hw_vpath_handle *vp,
-
- /* calculate actual RxD block private size */
- ring->rxdblock_priv_size = ring->rxd_priv_size * ring->rxds_per_block;
-- ring_mp_callback.item_func_alloc = __vxge_hw_ring_mempool_item_alloc;
- ring->mempool = __vxge_hw_mempool_create(hldev,
- VXGE_HW_BLOCK_SIZE,
- VXGE_HW_BLOCK_SIZE,
-@@ -2509,7 +2510,10 @@ __vxge_hw_fifo_create(struct __vxge_hw_vpath_handle *vp,
- struct __vxge_hw_fifo *fifo;
- struct vxge_hw_fifo_config *config;
- u32 txdl_size, txdl_per_memblock;
-- struct vxge_hw_mempool_cbs fifo_mp_callback;
-+ static struct vxge_hw_mempool_cbs fifo_mp_callback = {
-+ .item_func_alloc = __vxge_hw_fifo_mempool_item_alloc,
-+ };
-+
- struct __vxge_hw_virtualpath *vpath;
-
- if ((vp == NULL) || (attr == NULL)) {
-@@ -2590,8 +2594,6 @@ __vxge_hw_fifo_create(struct __vxge_hw_vpath_handle *vp,
- goto exit;
- }
-
-- fifo_mp_callback.item_func_alloc = __vxge_hw_fifo_mempool_item_alloc;
--
- fifo->mempool =
- __vxge_hw_mempool_create(vpath->hldev,
- fifo->config->memblock_size,
-diff --git a/drivers/net/vxge/vxge-main.c b/drivers/net/vxge/vxge-main.c
-index 068d7a9..35293de 100644
---- a/drivers/net/vxge/vxge-main.c
-+++ b/drivers/net/vxge/vxge-main.c
-@@ -93,6 +93,8 @@ static inline void VXGE_COMPLETE_VPATH_TX(struct vxge_fifo *fifo)
- struct sk_buff *completed[NR_SKB_COMPLETED];
- int more;
-
-+ pax_track_stack();
-+
- do {
- more = 0;
- skb_ptr = completed;
-@@ -1779,6 +1781,8 @@ static enum vxge_hw_status vxge_rth_configure(struct vxgedev *vdev)
- u8 mtable[256] = {0}; /* CPU to vpath mapping */
- int index;
-
-+ pax_track_stack();
-+
- /*
- * Filling
- * - itable with bucket numbers
-diff --git a/drivers/net/wan/cycx_x25.c b/drivers/net/wan/cycx_x25.c
-index cd8cb95..4153b79 100644
---- a/drivers/net/wan/cycx_x25.c
-+++ b/drivers/net/wan/cycx_x25.c
-@@ -1017,6 +1017,8 @@ static void hex_dump(char *msg, unsigned char *p, int len)
- unsigned char hex[1024],
- * phex = hex;
-
-+ pax_track_stack();
-+
- if (len >= (sizeof(hex) / 2))
- len = (sizeof(hex) / 2) - 1;
-
-diff --git a/drivers/net/wan/hdlc_x25.c b/drivers/net/wan/hdlc_x25.c
-index aa9248f..a4e3c3b 100644
---- a/drivers/net/wan/hdlc_x25.c
-+++ b/drivers/net/wan/hdlc_x25.c
-@@ -136,16 +136,16 @@ static netdev_tx_t x25_xmit(struct sk_buff *skb, struct net_device *dev)
-
- static int x25_open(struct net_device *dev)
- {
-- struct lapb_register_struct cb;
-+ static struct lapb_register_struct cb = {
-+ .connect_confirmation = x25_connected,
-+ .connect_indication = x25_connected,
-+ .disconnect_confirmation = x25_disconnected,
-+ .disconnect_indication = x25_disconnected,
-+ .data_indication = x25_data_indication,
-+ .data_transmit = x25_data_transmit
-+ };
- int result;
-
-- cb.connect_confirmation = x25_connected;
-- cb.connect_indication = x25_connected;
-- cb.disconnect_confirmation = x25_disconnected;
-- cb.disconnect_indication = x25_disconnected;
-- cb.data_indication = x25_data_indication;
-- cb.data_transmit = x25_data_transmit;
--
- result = lapb_register(dev, &cb);
- if (result != LAPB_OK)
- return result;
-diff --git a/drivers/net/wimax/i2400m/usb-fw.c b/drivers/net/wimax/i2400m/usb-fw.c
-index 5ad287c..783b020 100644
---- a/drivers/net/wimax/i2400m/usb-fw.c
-+++ b/drivers/net/wimax/i2400m/usb-fw.c
-@@ -263,6 +263,8 @@ ssize_t i2400mu_bus_bm_wait_for_ack(struct i2400m *i2400m,
- int do_autopm = 1;
- DECLARE_COMPLETION_ONSTACK(notif_completion);
-
-+ pax_track_stack();
-+
- d_fnstart(8, dev, "(i2400m %p ack %p size %zu)\n",
- i2400m, ack, ack_size);
- BUG_ON(_ack == i2400m->bm_ack_buf);
-diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
-index 6c26840..62c97c3 100644
---- a/drivers/net/wireless/airo.c
-+++ b/drivers/net/wireless/airo.c
-@@ -3003,6 +3003,8 @@ static void airo_process_scan_results (struct airo_info *ai) {
- BSSListElement * loop_net;
- BSSListElement * tmp_net;
-
-+ pax_track_stack();
-+
- /* Blow away current list of scan results */
- list_for_each_entry_safe (loop_net, tmp_net, &ai->network_list, list) {
- list_move_tail (&loop_net->list, &ai->network_free_list);
-@@ -3783,6 +3785,8 @@ static u16 setup_card(struct airo_info *ai, u8 *mac, int lock)
- WepKeyRid wkr;
- int rc;
-
-+ pax_track_stack();
-+
- memset( &mySsid, 0, sizeof( mySsid ) );
- kfree (ai->flash);
- ai->flash = NULL;
-@@ -4758,6 +4762,8 @@ static int proc_stats_rid_open( struct inode *inode,
- __le32 *vals = stats.vals;
- int len;
-
-+ pax_track_stack();
-+
- if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
- return -ENOMEM;
- data = (struct proc_data *)file->private_data;
-@@ -5487,6 +5493,8 @@ static int proc_BSSList_open( struct inode *inode, struct file *file ) {
- /* If doLoseSync is not 1, we won't do a Lose Sync */
- int doLoseSync = -1;
-
-+ pax_track_stack();
-+
- if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
- return -ENOMEM;
- data = (struct proc_data *)file->private_data;
-@@ -7193,6 +7201,8 @@ static int airo_get_aplist(struct net_device *dev,
- int i;
- int loseSync = capable(CAP_NET_ADMIN) ? 1: -1;
-
-+ pax_track_stack();
-+
- qual = kmalloc(IW_MAX_AP * sizeof(*qual), GFP_KERNEL);
- if (!qual)
- return -ENOMEM;
-@@ -7753,6 +7763,8 @@ static void airo_read_wireless_stats(struct airo_info *local)
- CapabilityRid cap_rid;
- __le32 *vals = stats_rid.vals;
-
-+ pax_track_stack();
-+
- /* Get stats out of the card */
- clear_bit(JOB_WSTATS, &local->jobs);
- if (local->power.event) {
-diff --git a/drivers/net/wireless/ath/ath5k/debug.c b/drivers/net/wireless/ath/ath5k/debug.c
-index 747508c..82e965d 100644
---- a/drivers/net/wireless/ath/ath5k/debug.c
-+++ b/drivers/net/wireless/ath/ath5k/debug.c
-@@ -205,6 +205,8 @@ static ssize_t read_file_beacon(struct file *file, char __user *user_buf,
- unsigned int v;
- u64 tsf;
-
-+ pax_track_stack();
-+
- v = ath5k_hw_reg_read(sc->ah, AR5K_BEACON);
- len += snprintf(buf+len, sizeof(buf)-len,
- "%-24s0x%08x\tintval: %d\tTIM: 0x%x\n",
-@@ -318,6 +320,8 @@ static ssize_t read_file_debug(struct file *file, char __user *user_buf,
- unsigned int len = 0;
- unsigned int i;
-
-+ pax_track_stack();
-+
- len += snprintf(buf+len, sizeof(buf)-len,
- "DEBUG LEVEL: 0x%08x\n\n", sc->debug.level);
-
-diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
-index 2be4c22..593b1eb 100644
---- a/drivers/net/wireless/ath/ath9k/debug.c
-+++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -220,6 +220,8 @@ static ssize_t read_file_interrupt(struct file *file, char __user *user_buf,
- char buf[512];
- unsigned int len = 0;
-
-+ pax_track_stack();
-+
- len += snprintf(buf + len, sizeof(buf) - len,
- "%8s: %10u\n", "RX", sc->debug.stats.istats.rxok);
- len += snprintf(buf + len, sizeof(buf) - len,
-@@ -360,6 +362,8 @@ static ssize_t read_file_wiphy(struct file *file, char __user *user_buf,
- int i;
- u8 addr[ETH_ALEN];
-
-+ pax_track_stack();
-+
- len += snprintf(buf + len, sizeof(buf) - len,
- "primary: %s (%s chan=%d ht=%d)\n",
- wiphy_name(sc->pri_wiphy->hw->wiphy),
-diff --git a/drivers/net/wireless/b43/debugfs.c b/drivers/net/wireless/b43/debugfs.c
-index 80b19a4..dab3a45 100644
---- a/drivers/net/wireless/b43/debugfs.c
-+++ b/drivers/net/wireless/b43/debugfs.c
-@@ -43,7 +43,7 @@ static struct dentry *rootdir;
- struct b43_debugfs_fops {
- ssize_t (*read)(struct b43_wldev *dev, char *buf, size_t bufsize);
- int (*write)(struct b43_wldev *dev, const char *buf, size_t count);
-- struct file_operations fops;
-+ const struct file_operations fops;
- /* Offset of struct b43_dfs_file in struct b43_dfsentry */
- size_t file_struct_offset;
- };
-diff --git a/drivers/net/wireless/b43legacy/debugfs.c b/drivers/net/wireless/b43legacy/debugfs.c
-index 1f85ac5..c99b4b4 100644
---- a/drivers/net/wireless/b43legacy/debugfs.c
-+++ b/drivers/net/wireless/b43legacy/debugfs.c
-@@ -44,7 +44,7 @@ static struct dentry *rootdir;
- struct b43legacy_debugfs_fops {
- ssize_t (*read)(struct b43legacy_wldev *dev, char *buf, size_t bufsize);
- int (*write)(struct b43legacy_wldev *dev, const char *buf, size_t count);
-- struct file_operations fops;
-+ const struct file_operations fops;
- /* Offset of struct b43legacy_dfs_file in struct b43legacy_dfsentry */
- size_t file_struct_offset;
- /* Take wl->irq_lock before calling read/write? */
-diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
-index 43102bf..3b569c3 100644
---- a/drivers/net/wireless/ipw2x00/ipw2100.c
-+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
-@@ -2014,6 +2014,8 @@ static int ipw2100_set_essid(struct ipw2100_priv *priv, char *essid,
- int err;
- DECLARE_SSID_BUF(ssid);
-
-+ pax_track_stack();
-+
- IPW_DEBUG_HC("SSID: '%s'\n", print_ssid(ssid, essid, ssid_len));
-
- if (ssid_len)
-@@ -5380,6 +5382,8 @@ static int ipw2100_set_key(struct ipw2100_priv *priv,
- struct ipw2100_wep_key *wep_key = (void *)cmd.host_command_parameters;
- int err;
-
-+ pax_track_stack();
-+
- IPW_DEBUG_HC("WEP_KEY_INFO: index = %d, len = %d/%d\n",
- idx, keylen, len);
-
-diff --git a/drivers/net/wireless/ipw2x00/libipw_rx.c b/drivers/net/wireless/ipw2x00/libipw_rx.c
-index 282b1f7..169f0cf 100644
---- a/drivers/net/wireless/ipw2x00/libipw_rx.c
-+++ b/drivers/net/wireless/ipw2x00/libipw_rx.c
-@@ -1566,6 +1566,8 @@ static void libipw_process_probe_response(struct libipw_device
- unsigned long flags;
- DECLARE_SSID_BUF(ssid);
-
-+ pax_track_stack();
-+
- LIBIPW_DEBUG_SCAN("'%s' (%pM"
- "): %c%c%c%c %c%c%c%c-%c%c%c%c %c%c%c%c\n",
- print_ssid(ssid, info_element->data, info_element->len),
-diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
-index 950267a..80d5fd2 100644
---- a/drivers/net/wireless/iwlwifi/iwl-1000.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
-@@ -137,7 +137,7 @@ static struct iwl_lib_ops iwl1000_lib = {
- },
- };
-
--static struct iwl_ops iwl1000_ops = {
-+static const struct iwl_ops iwl1000_ops = {
- .ucode = &iwl5000_ucode,
- .lib = &iwl1000_lib,
- .hcmd = &iwl5000_hcmd,
-diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
-index 56bfcc3..b348020 100644
---- a/drivers/net/wireless/iwlwifi/iwl-3945.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
-@@ -2874,7 +2874,7 @@ static struct iwl_hcmd_utils_ops iwl3945_hcmd_utils = {
- .build_addsta_hcmd = iwl3945_build_addsta_hcmd,
- };
-
--static struct iwl_ops iwl3945_ops = {
-+static const struct iwl_ops iwl3945_ops = {
- .ucode = &iwl3945_ucode,
- .lib = &iwl3945_lib,
- .hcmd = &iwl3945_hcmd,
-diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
-index 585b8d4..e142963 100644
---- a/drivers/net/wireless/iwlwifi/iwl-4965.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
-@@ -2345,7 +2345,7 @@ static struct iwl_lib_ops iwl4965_lib = {
- },
- };
-
--static struct iwl_ops iwl4965_ops = {
-+static const struct iwl_ops iwl4965_ops = {
- .ucode = &iwl4965_ucode,
- .lib = &iwl4965_lib,
- .hcmd = &iwl4965_hcmd,
-diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
-index 1f423f2..e37c192 100644
---- a/drivers/net/wireless/iwlwifi/iwl-5000.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
-@@ -1633,14 +1633,14 @@ static struct iwl_lib_ops iwl5150_lib = {
- },
- };
-
--struct iwl_ops iwl5000_ops = {
-+const struct iwl_ops iwl5000_ops = {
- .ucode = &iwl5000_ucode,
- .lib = &iwl5000_lib,
- .hcmd = &iwl5000_hcmd,
- .utils = &iwl5000_hcmd_utils,
- };
-
--static struct iwl_ops iwl5150_ops = {
-+static const struct iwl_ops iwl5150_ops = {
- .ucode = &iwl5000_ucode,
- .lib = &iwl5150_lib,
- .hcmd = &iwl5000_hcmd,
-diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
-index 1473452..f07d5e1 100644
---- a/drivers/net/wireless/iwlwifi/iwl-6000.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
-@@ -146,7 +146,7 @@ static struct iwl_hcmd_utils_ops iwl6000_hcmd_utils = {
- .calc_rssi = iwl5000_calc_rssi,
- };
-
--static struct iwl_ops iwl6000_ops = {
-+static const struct iwl_ops iwl6000_ops = {
- .ucode = &iwl5000_ucode,
- .lib = &iwl6000_lib,
- .hcmd = &iwl5000_hcmd,
-diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
-index 1a3dfa2..b3e0a61 100644
---- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
-@@ -857,6 +857,8 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
- u8 active_index = 0;
- s32 tpt = 0;
-
-+ pax_track_stack();
-+
- IWL_DEBUG_RATE_LIMIT(priv, "get frame ack response, update rate scale window\n");
-
- if (!ieee80211_is_data(hdr->frame_control) ||
-@@ -2722,6 +2724,8 @@ static void rs_fill_link_cmd(struct iwl_priv *priv,
- u8 valid_tx_ant = 0;
- struct iwl_link_quality_cmd *lq_cmd = &lq_sta->lq;
-
-+ pax_track_stack();
-+
- /* Override starting rate (index 0) if needed for debug purposes */
- rs_dbgfs_set_mcs(lq_sta, &new_rate, index);
-
-diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
-index 0e56d78..6a3c107 100644
---- a/drivers/net/wireless/iwlwifi/iwl-agn.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
-@@ -2911,7 +2911,9 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
- if (iwl_debug_level & IWL_DL_INFO)
- dev_printk(KERN_DEBUG, &(pdev->dev),
- "Disabling hw_scan\n");
-- iwl_hw_ops.hw_scan = NULL;
-+ pax_open_kernel();
-+ *(void **)&iwl_hw_ops.hw_scan = NULL;
-+ pax_close_kernel();
- }
-
- hw = iwl_alloc_all(cfg, &iwl_hw_ops);
-diff --git a/drivers/net/wireless/iwlwifi/iwl-debug.h b/drivers/net/wireless/iwlwifi/iwl-debug.h
-index cbc6290..eb323d7 100644
---- a/drivers/net/wireless/iwlwifi/iwl-debug.h
-+++ b/drivers/net/wireless/iwlwifi/iwl-debug.h
-@@ -118,8 +118,8 @@ void iwl_dbgfs_unregister(struct iwl_priv *priv);
- #endif
-
- #else
--#define IWL_DEBUG(__priv, level, fmt, args...)
--#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...)
-+#define IWL_DEBUG(__priv, level, fmt, args...) do {} while (0)
-+#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...) do {} while (0)
- static inline void iwl_print_hex_dump(struct iwl_priv *priv, int level,
- void *p, u32 len)
- {}
-diff --git a/drivers/net/wireless/iwlwifi/iwl-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
-index a198bcf..aaa4128 100644
---- a/drivers/net/wireless/iwlwifi/iwl-debugfs.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
-@@ -166,7 +166,7 @@ static ssize_t iwl_dbgfs_tx_statistics_write(struct file *file,
- struct iwl_priv *priv = file->private_data;
- u32 clear_flag;
- char buf[8];
-- int buf_size;
-+ size_t buf_size;
-
- memset(buf, 0, sizeof(buf));
- buf_size = min(count, sizeof(buf) - 1);
-@@ -285,7 +285,7 @@ static ssize_t iwl_dbgfs_sram_write(struct file *file,
- {
- struct iwl_priv *priv = file->private_data;
- char buf[64];
-- int buf_size;
-+ size_t buf_size;
- u32 offset, len;
-
- memset(buf, 0, sizeof(buf));
-@@ -524,6 +524,8 @@ static ssize_t iwl_dbgfs_status_read(struct file *file,
- int pos = 0;
- const size_t bufsz = sizeof(buf);
-
-+ pax_track_stack();
-+
- pos += scnprintf(buf + pos, bufsz - pos, "STATUS_HCMD_ACTIVE:\t %d\n",
- test_bit(STATUS_HCMD_ACTIVE, &priv->status));
- pos += scnprintf(buf + pos, bufsz - pos, "STATUS_HCMD_SYNC_ACTIVE: %d\n",
-@@ -658,6 +660,8 @@ static ssize_t iwl_dbgfs_qos_read(struct file *file, char __user *user_buf,
- const size_t bufsz = sizeof(buf);
- ssize_t ret;
-
-+ pax_track_stack();
-+
- for (i = 0; i < AC_NUM; i++) {
- pos += scnprintf(buf + pos, bufsz - pos,
- "\tcw_min\tcw_max\taifsn\ttxop\n");
-@@ -739,7 +743,7 @@ static ssize_t iwl_dbgfs_disable_ht40_write(struct file *file,
- {
- struct iwl_priv *priv = file->private_data;
- char buf[8];
-- int buf_size;
-+ size_t buf_size;
- int ht40;
-
- memset(buf, 0, sizeof(buf));
-@@ -782,7 +786,7 @@ static ssize_t iwl_dbgfs_sleep_level_override_write(struct file *file,
- {
- struct iwl_priv *priv = file->private_data;
- char buf[8];
-- int buf_size;
-+ size_t buf_size;
- int value;
-
- memset(buf, 0, sizeof(buf));
-@@ -950,7 +954,7 @@ static ssize_t iwl_dbgfs_traffic_log_write(struct file *file,
- {
- struct iwl_priv *priv = file->private_data;
- char buf[8];
-- int buf_size;
-+ size_t buf_size;
- int traffic_log;
-
- memset(buf, 0, sizeof(buf));
-diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
-index 3539ea4..b174bfa 100644
---- a/drivers/net/wireless/iwlwifi/iwl-dev.h
-+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
-@@ -68,7 +68,7 @@ struct iwl_tx_queue;
-
- /* shared structures from iwl-5000.c */
- extern struct iwl_mod_params iwl50_mod_params;
--extern struct iwl_ops iwl5000_ops;
-+extern const struct iwl_ops iwl5000_ops;
- extern struct iwl_ucode_ops iwl5000_ucode;
- extern struct iwl_lib_ops iwl5000_lib;
- extern struct iwl_hcmd_ops iwl5000_hcmd;
-diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
-index 619590d..69235ee 100644
---- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
-+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
-@@ -3927,7 +3927,9 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
- */
- if (iwl3945_mod_params.disable_hw_scan) {
- IWL_DEBUG_INFO(priv, "Disabling hw_scan\n");
-- iwl3945_hw_ops.hw_scan = NULL;
-+ pax_open_kernel();
-+ *(void **)&iwl3945_hw_ops.hw_scan = NULL;
-+ pax_close_kernel();
- }
-
-
-diff --git a/drivers/net/wireless/iwmc3200wifi/debugfs.c b/drivers/net/wireless/iwmc3200wifi/debugfs.c
-index 1465379..fe4d78b 100644
---- a/drivers/net/wireless/iwmc3200wifi/debugfs.c
-+++ b/drivers/net/wireless/iwmc3200wifi/debugfs.c
-@@ -299,6 +299,8 @@ static ssize_t iwm_debugfs_fw_err_read(struct file *filp,
- int buf_len = 512;
- size_t len = 0;
-
-+ pax_track_stack();
-+
- if (*ppos != 0)
- return 0;
- if (count < sizeof(buf))
-diff --git a/drivers/net/wireless/libertas/debugfs.c b/drivers/net/wireless/libertas/debugfs.c
-index 893a55c..7f66a50 100644
---- a/drivers/net/wireless/libertas/debugfs.c
-+++ b/drivers/net/wireless/libertas/debugfs.c
-@@ -708,7 +708,7 @@ out_unlock:
- struct lbs_debugfs_files {
- const char *name;
- int perm;
-- struct file_operations fops;
-+ const struct file_operations fops;
- };
-
- static const struct lbs_debugfs_files debugfs_files[] = {
-diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
-index 2ecbedb..42704f0 100644
---- a/drivers/net/wireless/rndis_wlan.c
-+++ b/drivers/net/wireless/rndis_wlan.c
-@@ -1176,7 +1176,7 @@ static int set_rts_threshold(struct usbnet *usbdev, u32 rts_threshold)
-
- devdbg(usbdev, "set_rts_threshold %i", rts_threshold);
-
-- if (rts_threshold < 0 || rts_threshold > 2347)
-+ if (rts_threshold > 2347)
- rts_threshold = 2347;
-
- tmp = cpu_to_le32(rts_threshold);
-diff --git a/drivers/oprofile/buffer_sync.c b/drivers/oprofile/buffer_sync.c
-index 334ccd6..47f8944 100644
---- a/drivers/oprofile/buffer_sync.c
-+++ b/drivers/oprofile/buffer_sync.c
-@@ -342,7 +342,7 @@ static void add_data(struct op_entry *entry, struct mm_struct *mm)
- if (cookie == NO_COOKIE)
- offset = pc;
- if (cookie == INVALID_COOKIE) {
-- atomic_inc(&oprofile_stats.sample_lost_no_mapping);
-+ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
- offset = pc;
- }
- if (cookie != last_cookie) {
-@@ -386,14 +386,14 @@ add_sample(struct mm_struct *mm, struct op_sample *s, int in_kernel)
- /* add userspace sample */
-
- if (!mm) {
-- atomic_inc(&oprofile_stats.sample_lost_no_mm);
-+ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mm);
- return 0;
- }
-
- cookie = lookup_dcookie(mm, s->eip, &offset);
-
- if (cookie == INVALID_COOKIE) {
-- atomic_inc(&oprofile_stats.sample_lost_no_mapping);
-+ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
- return 0;
- }
-
-@@ -562,7 +562,7 @@ void sync_buffer(int cpu)
- /* ignore backtraces if failed to add a sample */
- if (state == sb_bt_start) {
- state = sb_bt_ignore;
-- atomic_inc(&oprofile_stats.bt_lost_no_mapping);
-+ atomic_inc_unchecked(&oprofile_stats.bt_lost_no_mapping);
- }
- }
- release_mm(mm);
-diff --git a/drivers/oprofile/event_buffer.c b/drivers/oprofile/event_buffer.c
-index 5df60a6..72f5c1c 100644
---- a/drivers/oprofile/event_buffer.c
-+++ b/drivers/oprofile/event_buffer.c
-@@ -53,7 +53,7 @@ void add_event_entry(unsigned long value)
- }
-
- if (buffer_pos == buffer_size) {
-- atomic_inc(&oprofile_stats.event_lost_overflow);
-+ atomic_inc_unchecked(&oprofile_stats.event_lost_overflow);
- return;
- }
-
-diff --git a/drivers/oprofile/oprof.c b/drivers/oprofile/oprof.c
-index dc8a042..fe5f315 100644
---- a/drivers/oprofile/oprof.c
-+++ b/drivers/oprofile/oprof.c
-@@ -110,7 +110,7 @@ static void switch_worker(struct work_struct *work)
- if (oprofile_ops.switch_events())
- return;
-
-- atomic_inc(&oprofile_stats.multiplex_counter);
-+ atomic_inc_unchecked(&oprofile_stats.multiplex_counter);
- start_switch_worker();
- }
-
-diff --git a/drivers/oprofile/oprofile_stats.c b/drivers/oprofile/oprofile_stats.c
-index 61689e8..387f7f8 100644
---- a/drivers/oprofile/oprofile_stats.c
-+++ b/drivers/oprofile/oprofile_stats.c
-@@ -30,11 +30,11 @@ void oprofile_reset_stats(void)
- cpu_buf->sample_invalid_eip = 0;
- }
-
-- atomic_set(&oprofile_stats.sample_lost_no_mm, 0);
-- atomic_set(&oprofile_stats.sample_lost_no_mapping, 0);
-- atomic_set(&oprofile_stats.event_lost_overflow, 0);
-- atomic_set(&oprofile_stats.bt_lost_no_mapping, 0);
-- atomic_set(&oprofile_stats.multiplex_counter, 0);
-+ atomic_set_unchecked(&oprofile_stats.sample_lost_no_mm, 0);
-+ atomic_set_unchecked(&oprofile_stats.sample_lost_no_mapping, 0);
-+ atomic_set_unchecked(&oprofile_stats.event_lost_overflow, 0);
-+ atomic_set_unchecked(&oprofile_stats.bt_lost_no_mapping, 0);
-+ atomic_set_unchecked(&oprofile_stats.multiplex_counter, 0);
- }
-
-
-diff --git a/drivers/oprofile/oprofile_stats.h b/drivers/oprofile/oprofile_stats.h
-index 0b54e46..a37c527 100644
---- a/drivers/oprofile/oprofile_stats.h
-+++ b/drivers/oprofile/oprofile_stats.h
-@@ -13,11 +13,11 @@
- #include <asm/atomic.h>
-
- struct oprofile_stat_struct {
-- atomic_t sample_lost_no_mm;
-- atomic_t sample_lost_no_mapping;
-- atomic_t bt_lost_no_mapping;
-- atomic_t event_lost_overflow;
-- atomic_t multiplex_counter;
-+ atomic_unchecked_t sample_lost_no_mm;
-+ atomic_unchecked_t sample_lost_no_mapping;
-+ atomic_unchecked_t bt_lost_no_mapping;
-+ atomic_unchecked_t event_lost_overflow;
-+ atomic_unchecked_t multiplex_counter;
- };
-
- extern struct oprofile_stat_struct oprofile_stats;
-diff --git a/drivers/oprofile/oprofilefs.c b/drivers/oprofile/oprofilefs.c
-index 2766a6d..80c77e2 100644
---- a/drivers/oprofile/oprofilefs.c
-+++ b/drivers/oprofile/oprofilefs.c
-@@ -187,7 +187,7 @@ static const struct file_operations atomic_ro_fops = {
-
-
- int oprofilefs_create_ro_atomic(struct super_block *sb, struct dentry *root,
-- char const *name, atomic_t *val)
-+ char const *name, atomic_unchecked_t *val)
- {
- struct dentry *d = __oprofilefs_create_file(sb, root, name,
- &atomic_ro_fops, 0444);
-diff --git a/drivers/parisc/pdc_stable.c b/drivers/parisc/pdc_stable.c
-index 13a64bc..ad62835 100644
---- a/drivers/parisc/pdc_stable.c
-+++ b/drivers/parisc/pdc_stable.c
-@@ -481,7 +481,7 @@ pdcspath_attr_store(struct kobject *kobj, struct attribute *attr,
- return ret;
- }
-
--static struct sysfs_ops pdcspath_attr_ops = {
-+static const struct sysfs_ops pdcspath_attr_ops = {
- .show = pdcspath_attr_show,
- .store = pdcspath_attr_store,
- };
-diff --git a/drivers/parport/procfs.c b/drivers/parport/procfs.c
-index 8eefe56..40751a7 100644
---- a/drivers/parport/procfs.c
-+++ b/drivers/parport/procfs.c
-@@ -64,7 +64,7 @@ static int do_active_device(ctl_table *table, int write,
-
- *ppos += len;
-
-- return copy_to_user(result, buffer, len) ? -EFAULT : 0;
-+ return (len > sizeof buffer || copy_to_user(result, buffer, len)) ? -EFAULT : 0;
- }
-
- #ifdef CONFIG_PARPORT_1284
-@@ -106,7 +106,7 @@ static int do_autoprobe(ctl_table *table, int write,
-
- *ppos += len;
-
-- return copy_to_user (result, buffer, len) ? -EFAULT : 0;
-+ return (len > sizeof buffer || copy_to_user (result, buffer, len)) ? -EFAULT : 0;
- }
- #endif /* IEEE1284.3 support. */
-
-diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
-index 73e7d8e..c80f3d2 100644
---- a/drivers/pci/hotplug/acpiphp_glue.c
-+++ b/drivers/pci/hotplug/acpiphp_glue.c
-@@ -111,7 +111,7 @@ static int post_dock_fixups(struct notifier_block *nb, unsigned long val,
- }
-
-
--static struct acpi_dock_ops acpiphp_dock_ops = {
-+static const struct acpi_dock_ops acpiphp_dock_ops = {
- .handler = handle_hotplug_event_func,
- };
-
-diff --git a/drivers/pci/hotplug/cpcihp_generic.c b/drivers/pci/hotplug/cpcihp_generic.c
-index 148fb46..6ff9455 100644
---- a/drivers/pci/hotplug/cpcihp_generic.c
-+++ b/drivers/pci/hotplug/cpcihp_generic.c
-@@ -73,7 +73,6 @@ static u16 port;
- static unsigned int enum_bit;
- static u8 enum_mask;
-
--static struct cpci_hp_controller_ops generic_hpc_ops;
- static struct cpci_hp_controller generic_hpc;
-
- static int __init validate_parameters(void)
-@@ -139,6 +138,10 @@ static int query_enum(void)
- return ((value & enum_mask) == enum_mask);
- }
-
-+static struct cpci_hp_controller_ops generic_hpc_ops = {
-+ .query_enum = query_enum,
-+};
-+
- static int __init cpcihp_generic_init(void)
- {
- int status;
-@@ -168,7 +171,6 @@ static int __init cpcihp_generic_init(void)
- pci_dev_put(dev);
-
- memset(&generic_hpc, 0, sizeof (struct cpci_hp_controller));
-- generic_hpc_ops.query_enum = query_enum;
- generic_hpc.ops = &generic_hpc_ops;
-
- status = cpci_hp_register_controller(&generic_hpc);
-diff --git a/drivers/pci/hotplug/cpcihp_zt5550.c b/drivers/pci/hotplug/cpcihp_zt5550.c
-index 41f6a8d..da73050 100644
---- a/drivers/pci/hotplug/cpcihp_zt5550.c
-+++ b/drivers/pci/hotplug/cpcihp_zt5550.c
-@@ -59,7 +59,6 @@
- /* local variables */
- static int debug;
- static int poll;
--static struct cpci_hp_controller_ops zt5550_hpc_ops;
- static struct cpci_hp_controller zt5550_hpc;
-
- /* Primary cPCI bus bridge device */
-@@ -205,6 +204,10 @@ static int zt5550_hc_disable_irq(void)
- return 0;
- }
-
-+static struct cpci_hp_controller_ops zt5550_hpc_ops = {
-+ .query_enum = zt5550_hc_query_enum,
-+};
-+
- static int zt5550_hc_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
- {
- int status;
-@@ -216,16 +219,17 @@ static int zt5550_hc_init_one (struct pci_dev *pdev, const struct pci_device_id
- dbg("returned from zt5550_hc_config");
-
- memset(&zt5550_hpc, 0, sizeof (struct cpci_hp_controller));
-- zt5550_hpc_ops.query_enum = zt5550_hc_query_enum;
- zt5550_hpc.ops = &zt5550_hpc_ops;
- if(!poll) {
- zt5550_hpc.irq = hc_dev->irq;
- zt5550_hpc.irq_flags = IRQF_SHARED;
- zt5550_hpc.dev_id = hc_dev;
-
-- zt5550_hpc_ops.enable_irq = zt5550_hc_enable_irq;
-- zt5550_hpc_ops.disable_irq = zt5550_hc_disable_irq;
-- zt5550_hpc_ops.check_irq = zt5550_hc_check_irq;
-+ pax_open_kernel();
-+ *(void **)&zt5550_hpc_ops.enable_irq = zt5550_hc_enable_irq;
-+ *(void **)&zt5550_hpc_ops.disable_irq = zt5550_hc_disable_irq;
-+ *(void **)&zt5550_hpc_ops.check_irq = zt5550_hc_check_irq;
-+ pax_open_kernel();
- } else {
- info("using ENUM# polling mode");
- }
-diff --git a/drivers/pci/hotplug/cpqphp_nvram.c b/drivers/pci/hotplug/cpqphp_nvram.c
-index 76ba8a1..20ca857 100644
---- a/drivers/pci/hotplug/cpqphp_nvram.c
-+++ b/drivers/pci/hotplug/cpqphp_nvram.c
-@@ -428,9 +428,13 @@ static u32 store_HRT (void __iomem *rom_start)
-
- void compaq_nvram_init (void __iomem *rom_start)
- {
-+
-+#ifndef CONFIG_PAX_KERNEXEC
- if (rom_start) {
- compaq_int15_entry_point = (rom_start + ROM_INT15_PHY_ADDR - ROM_PHY_ADDR);
- }
-+#endif
-+
- dbg("int15 entry = %p\n", compaq_int15_entry_point);
-
- /* initialize our int15 lock */
-diff --git a/drivers/pci/hotplug/fakephp.c b/drivers/pci/hotplug/fakephp.c
-index 6151389..0a894ef 100644
---- a/drivers/pci/hotplug/fakephp.c
-+++ b/drivers/pci/hotplug/fakephp.c
-@@ -73,7 +73,7 @@ static void legacy_release(struct kobject *kobj)
- }
-
- static struct kobj_type legacy_ktype = {
-- .sysfs_ops = &(struct sysfs_ops){
-+ .sysfs_ops = &(const struct sysfs_ops){
- .store = legacy_store, .show = legacy_show
- },
- .release = &legacy_release,
-diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
-index 5b680df..fe05b7e 100644
---- a/drivers/pci/intel-iommu.c
-+++ b/drivers/pci/intel-iommu.c
-@@ -2643,7 +2643,7 @@ error:
- return 0;
- }
-
--static dma_addr_t intel_map_page(struct device *dev, struct page *page,
-+dma_addr_t intel_map_page(struct device *dev, struct page *page,
- unsigned long offset, size_t size,
- enum dma_data_direction dir,
- struct dma_attrs *attrs)
-@@ -2719,7 +2719,7 @@ static void add_unmap(struct dmar_domain *dom, struct iova *iova)
- spin_unlock_irqrestore(&async_umap_flush_lock, flags);
- }
-
--static void intel_unmap_page(struct device *dev, dma_addr_t dev_addr,
-+void intel_unmap_page(struct device *dev, dma_addr_t dev_addr,
- size_t size, enum dma_data_direction dir,
- struct dma_attrs *attrs)
- {
-@@ -2768,7 +2768,7 @@ static void intel_unmap_page(struct device *dev, dma_addr_t dev_addr,
- }
- }
-
--static void *intel_alloc_coherent(struct device *hwdev, size_t size,
-+void *intel_alloc_coherent(struct device *hwdev, size_t size,
- dma_addr_t *dma_handle, gfp_t flags)
- {
- void *vaddr;
-@@ -2800,7 +2800,7 @@ static void *intel_alloc_coherent(struct device *hwdev, size_t size,
- return NULL;
- }
-
--static void intel_free_coherent(struct device *hwdev, size_t size, void *vaddr,
-+void intel_free_coherent(struct device *hwdev, size_t size, void *vaddr,
- dma_addr_t dma_handle)
- {
- int order;
-@@ -2812,7 +2812,7 @@ static void intel_free_coherent(struct device *hwdev, size_t size, void *vaddr,
- free_pages((unsigned long)vaddr, order);
- }
-
--static void intel_unmap_sg(struct device *hwdev, struct scatterlist *sglist,
-+void intel_unmap_sg(struct device *hwdev, struct scatterlist *sglist,
- int nelems, enum dma_data_direction dir,
- struct dma_attrs *attrs)
- {
-@@ -2872,7 +2872,7 @@ static int intel_nontranslate_map_sg(struct device *hddev,
- return nelems;
- }
-
--static int intel_map_sg(struct device *hwdev, struct scatterlist *sglist, int nelems,
-+int intel_map_sg(struct device *hwdev, struct scatterlist *sglist, int nelems,
- enum dma_data_direction dir, struct dma_attrs *attrs)
- {
- int i;
-@@ -2941,12 +2941,12 @@ static int intel_map_sg(struct device *hwdev, struct scatterlist *sglist, int ne
- return nelems;
- }
-
--static int intel_mapping_error(struct device *dev, dma_addr_t dma_addr)
-+int intel_mapping_error(struct device *dev, dma_addr_t dma_addr)
- {
- return !dma_addr;
- }
-
--struct dma_map_ops intel_dma_ops = {
-+const struct dma_map_ops intel_dma_ops = {
- .alloc_coherent = intel_alloc_coherent,
- .free_coherent = intel_free_coherent,
- .map_sg = intel_map_sg,
-diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
-index 5b7056c..607bc94 100644
---- a/drivers/pci/pcie/aspm.c
-+++ b/drivers/pci/pcie/aspm.c
-@@ -27,9 +27,9 @@
- #define MODULE_PARAM_PREFIX "pcie_aspm."
-
- /* Note: those are not register definitions */
--#define ASPM_STATE_L0S_UP (1) /* Upstream direction L0s state */
--#define ASPM_STATE_L0S_DW (2) /* Downstream direction L0s state */
--#define ASPM_STATE_L1 (4) /* L1 state */
-+#define ASPM_STATE_L0S_UP (1U) /* Upstream direction L0s state */
-+#define ASPM_STATE_L0S_DW (2U) /* Downstream direction L0s state */
-+#define ASPM_STATE_L1 (4U) /* L1 state */
- #define ASPM_STATE_L0S (ASPM_STATE_L0S_UP | ASPM_STATE_L0S_DW)
- #define ASPM_STATE_ALL (ASPM_STATE_L0S | ASPM_STATE_L1)
-
-diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
-index 8105e32..ca10419 100644
---- a/drivers/pci/probe.c
-+++ b/drivers/pci/probe.c
-@@ -62,14 +62,14 @@ static ssize_t pci_bus_show_cpuaffinity(struct device *dev,
- return ret;
- }
-
--static ssize_t inline pci_bus_show_cpumaskaffinity(struct device *dev,
-+static inline ssize_t pci_bus_show_cpumaskaffinity(struct device *dev,
- struct device_attribute *attr,
- char *buf)
- {
- return pci_bus_show_cpuaffinity(dev, 0, attr, buf);
- }
-
--static ssize_t inline pci_bus_show_cpulistaffinity(struct device *dev,
-+static inline ssize_t pci_bus_show_cpulistaffinity(struct device *dev,
- struct device_attribute *attr,
- char *buf)
- {
-diff --git a/drivers/pci/proc.c b/drivers/pci/proc.c
-index a03ad8c..024b0da 100644
---- a/drivers/pci/proc.c
-+++ b/drivers/pci/proc.c
-@@ -480,7 +480,16 @@ static const struct file_operations proc_bus_pci_dev_operations = {
- static int __init pci_proc_init(void)
- {
- struct pci_dev *dev = NULL;
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+ proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR, NULL);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
-+#endif
-+#else
- proc_bus_pci_dir = proc_mkdir("bus/pci", NULL);
-+#endif
- proc_create("devices", 0, proc_bus_pci_dir,
- &proc_bus_pci_dev_operations);
- proc_initialized = 1;
-diff --git a/drivers/pci/slot.c b/drivers/pci/slot.c
-index 8c02b6c..5584d8e 100644
---- a/drivers/pci/slot.c
-+++ b/drivers/pci/slot.c
-@@ -29,7 +29,7 @@ static ssize_t pci_slot_attr_store(struct kobject *kobj,
- return attribute->store ? attribute->store(slot, buf, len) : -EIO;
- }
-
--static struct sysfs_ops pci_slot_sysfs_ops = {
-+static const struct sysfs_ops pci_slot_sysfs_ops = {
- .show = pci_slot_attr_show,
- .store = pci_slot_attr_store,
- };
-diff --git a/drivers/pcmcia/pcmcia_ioctl.c b/drivers/pcmcia/pcmcia_ioctl.c
-index 30cf71d2..50938f1 100644
---- a/drivers/pcmcia/pcmcia_ioctl.c
-+++ b/drivers/pcmcia/pcmcia_ioctl.c
-@@ -819,7 +819,7 @@ static int ds_ioctl(struct inode * inode, struct file * file,
- return -EFAULT;
- }
- }
-- buf = kmalloc(sizeof(ds_ioctl_arg_t), GFP_KERNEL);
-+ buf = kzalloc(sizeof(ds_ioctl_arg_t), GFP_KERNEL);
- if (!buf)
- return -ENOMEM;
-
-diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
-index 52183c4..b224c69 100644
---- a/drivers/platform/x86/acer-wmi.c
-+++ b/drivers/platform/x86/acer-wmi.c
-@@ -918,7 +918,7 @@ static int update_bl_status(struct backlight_device *bd)
- return 0;
- }
-
--static struct backlight_ops acer_bl_ops = {
-+static const struct backlight_ops acer_bl_ops = {
- .get_brightness = read_brightness,
- .update_status = update_bl_status,
- };
-diff --git a/drivers/platform/x86/asus-laptop.c b/drivers/platform/x86/asus-laptop.c
-index 767cb61..a87380b 100644
---- a/drivers/platform/x86/asus-laptop.c
-+++ b/drivers/platform/x86/asus-laptop.c
-@@ -250,7 +250,7 @@ static struct backlight_device *asus_backlight_device;
- */
- static int read_brightness(struct backlight_device *bd);
- static int update_bl_status(struct backlight_device *bd);
--static struct backlight_ops asusbl_ops = {
-+static const struct backlight_ops asusbl_ops = {
- .get_brightness = read_brightness,
- .update_status = update_bl_status,
- };
-diff --git a/drivers/platform/x86/asus_acpi.c b/drivers/platform/x86/asus_acpi.c
-index d66c07a..a4abaac 100644
---- a/drivers/platform/x86/asus_acpi.c
-+++ b/drivers/platform/x86/asus_acpi.c
-@@ -1396,7 +1396,7 @@ static int asus_hotk_remove(struct acpi_device *device, int type)
- return 0;
- }
-
--static struct backlight_ops asus_backlight_data = {
-+static const struct backlight_ops asus_backlight_data = {
- .get_brightness = read_brightness,
- .update_status = set_brightness_status,
- };
-diff --git a/drivers/platform/x86/compal-laptop.c b/drivers/platform/x86/compal-laptop.c
-index 11003bb..550ff1b 100644
---- a/drivers/platform/x86/compal-laptop.c
-+++ b/drivers/platform/x86/compal-laptop.c
-@@ -163,7 +163,7 @@ static int bl_update_status(struct backlight_device *b)
- return set_lcd_level(b->props.brightness);
- }
-
--static struct backlight_ops compalbl_ops = {
-+static const struct backlight_ops compalbl_ops = {
- .get_brightness = bl_get_brightness,
- .update_status = bl_update_status,
- };
-diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
-index 07a74da..9dc99fa 100644
---- a/drivers/platform/x86/dell-laptop.c
-+++ b/drivers/platform/x86/dell-laptop.c
-@@ -318,7 +318,7 @@ static int dell_get_intensity(struct backlight_device *bd)
- return buffer.output[1];
- }
-
--static struct backlight_ops dell_ops = {
-+static const struct backlight_ops dell_ops = {
- .get_brightness = dell_get_intensity,
- .update_status = dell_send_intensity,
- };
-diff --git a/drivers/platform/x86/eeepc-laptop.c b/drivers/platform/x86/eeepc-laptop.c
-index c533b1c..5c81f22 100644
---- a/drivers/platform/x86/eeepc-laptop.c
-+++ b/drivers/platform/x86/eeepc-laptop.c
-@@ -245,7 +245,7 @@ static struct device *eeepc_hwmon_device;
- */
- static int read_brightness(struct backlight_device *bd);
- static int update_bl_status(struct backlight_device *bd);
--static struct backlight_ops eeepcbl_ops = {
-+static const struct backlight_ops eeepcbl_ops = {
- .get_brightness = read_brightness,
- .update_status = update_bl_status,
- };
-diff --git a/drivers/platform/x86/fujitsu-laptop.c b/drivers/platform/x86/fujitsu-laptop.c
-index bcd4ba8..a249b35 100644
---- a/drivers/platform/x86/fujitsu-laptop.c
-+++ b/drivers/platform/x86/fujitsu-laptop.c
-@@ -436,7 +436,7 @@ static int bl_update_status(struct backlight_device *b)
- return ret;
- }
-
--static struct backlight_ops fujitsubl_ops = {
-+static const struct backlight_ops fujitsubl_ops = {
- .get_brightness = bl_get_brightness,
- .update_status = bl_update_status,
- };
-diff --git a/drivers/platform/x86/msi-laptop.c b/drivers/platform/x86/msi-laptop.c
-index 759763d..1093ba2 100644
---- a/drivers/platform/x86/msi-laptop.c
-+++ b/drivers/platform/x86/msi-laptop.c
-@@ -161,7 +161,7 @@ static int bl_update_status(struct backlight_device *b)
- return set_lcd_level(b->props.brightness);
- }
-
--static struct backlight_ops msibl_ops = {
-+static const struct backlight_ops msibl_ops = {
- .get_brightness = bl_get_brightness,
- .update_status = bl_update_status,
- };
-diff --git a/drivers/platform/x86/panasonic-laptop.c b/drivers/platform/x86/panasonic-laptop.c
-index fe7cf01..9012d8d 100644
---- a/drivers/platform/x86/panasonic-laptop.c
-+++ b/drivers/platform/x86/panasonic-laptop.c
-@@ -352,7 +352,7 @@ static int bl_set_status(struct backlight_device *bd)
- return acpi_pcc_write_sset(pcc, SINF_DC_CUR_BRIGHT, bright);
- }
-
--static struct backlight_ops pcc_backlight_ops = {
-+static const struct backlight_ops pcc_backlight_ops = {
- .get_brightness = bl_get,
- .update_status = bl_set_status,
- };
-diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
-index a2a742c..b37e25e 100644
---- a/drivers/platform/x86/sony-laptop.c
-+++ b/drivers/platform/x86/sony-laptop.c
-@@ -850,7 +850,7 @@ static int sony_backlight_get_brightness(struct backlight_device *bd)
- }
-
- static struct backlight_device *sony_backlight_device;
--static struct backlight_ops sony_backlight_ops = {
-+static const struct backlight_ops sony_backlight_ops = {
- .update_status = sony_backlight_update_status,
- .get_brightness = sony_backlight_get_brightness,
- };
-diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
-index 68271ae..5e8fb10 100644
---- a/drivers/platform/x86/thinkpad_acpi.c
-+++ b/drivers/platform/x86/thinkpad_acpi.c
-@@ -2139,7 +2139,7 @@ static int hotkey_mask_get(void)
- return 0;
- }
-
--void static hotkey_mask_warn_incomplete_mask(void)
-+static void hotkey_mask_warn_incomplete_mask(void)
- {
- /* log only what the user can fix... */
- const u32 wantedmask = hotkey_driver_mask &
-@@ -6125,7 +6125,7 @@ static void tpacpi_brightness_notify_change(void)
- BACKLIGHT_UPDATE_HOTKEY);
- }
-
--static struct backlight_ops ibm_backlight_data = {
-+static const struct backlight_ops ibm_backlight_data = {
- .get_brightness = brightness_get,
- .update_status = brightness_update_status,
- };
-diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c
-index 51c0a8b..0786629 100644
---- a/drivers/platform/x86/toshiba_acpi.c
-+++ b/drivers/platform/x86/toshiba_acpi.c
-@@ -671,7 +671,7 @@ static acpi_status remove_device(void)
- return AE_OK;
- }
-
--static struct backlight_ops toshiba_backlight_data = {
-+static const struct backlight_ops toshiba_backlight_data = {
- .get_brightness = get_lcd,
- .update_status = set_lcd_status,
- };
-diff --git a/drivers/pnp/pnpbios/bioscalls.c b/drivers/pnp/pnpbios/bioscalls.c
-index fc83783c..cf370d7 100644
---- a/drivers/pnp/pnpbios/bioscalls.c
-+++ b/drivers/pnp/pnpbios/bioscalls.c
-@@ -60,7 +60,7 @@ do { \
- set_desc_limit(&gdt[(selname) >> 3], (size) - 1); \
- } while(0)
-
--static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
-+static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
- (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
-
- /*
-@@ -97,7 +97,10 @@ static inline u16 call_pnp_bios(u16 func, u16 arg1, u16 arg2, u16 arg3,
-
- cpu = get_cpu();
- save_desc_40 = get_cpu_gdt_table(cpu)[0x40 / 8];
-+
-+ pax_open_kernel();
- get_cpu_gdt_table(cpu)[0x40 / 8] = bad_bios_desc;
-+ pax_close_kernel();
-
- /* On some boxes IRQ's during PnP BIOS calls are deadly. */
- spin_lock_irqsave(&pnp_bios_lock, flags);
-@@ -135,7 +138,10 @@ static inline u16 call_pnp_bios(u16 func, u16 arg1, u16 arg2, u16 arg3,
- :"memory");
- spin_unlock_irqrestore(&pnp_bios_lock, flags);
-
-+ pax_open_kernel();
- get_cpu_gdt_table(cpu)[0x40 / 8] = save_desc_40;
-+ pax_close_kernel();
-+
- put_cpu();
-
- /* If we get here and this is set then the PnP BIOS faulted on us. */
-@@ -469,7 +475,7 @@ int pnp_bios_read_escd(char *data, u32 nvram_base)
- return status;
- }
-
--void pnpbios_calls_init(union pnp_bios_install_struct *header)
-+void __init pnpbios_calls_init(union pnp_bios_install_struct *header)
- {
- int i;
-
-@@ -477,6 +483,8 @@ void pnpbios_calls_init(union pnp_bios_install_struct *header)
- pnp_bios_callpoint.offset = header->fields.pm16offset;
- pnp_bios_callpoint.segment = PNP_CS16;
-
-+ pax_open_kernel();
-+
- for_each_possible_cpu(i) {
- struct desc_struct *gdt = get_cpu_gdt_table(i);
- if (!gdt)
-@@ -488,4 +496,6 @@ void pnpbios_calls_init(union pnp_bios_install_struct *header)
- set_desc_base(&gdt[GDT_ENTRY_PNPBIOS_DS],
- (unsigned long)__va(header->fields.pm16dseg));
- }
-+
-+ pax_close_kernel();
- }
-diff --git a/drivers/pnp/resource.c b/drivers/pnp/resource.c
-index ba97654..66b99d4 100644
---- a/drivers/pnp/resource.c
-+++ b/drivers/pnp/resource.c
-@@ -355,7 +355,7 @@ int pnp_check_irq(struct pnp_dev *dev, struct resource *res)
- return 1;
-
- /* check if the resource is valid */
-- if (*irq < 0 || *irq > 15)
-+ if (*irq > 15)
- return 0;
-
- /* check if the resource is reserved */
-@@ -419,7 +419,7 @@ int pnp_check_dma(struct pnp_dev *dev, struct resource *res)
- return 1;
-
- /* check if the resource is valid */
-- if (*dma < 0 || *dma == 4 || *dma > 7)
-+ if (*dma == 4 || *dma > 7)
- return 0;
-
- /* check if the resource is reserved */
-diff --git a/drivers/power/bq27x00_battery.c b/drivers/power/bq27x00_battery.c
-index 62bb981..428f9a2 100644
---- a/drivers/power/bq27x00_battery.c
-+++ b/drivers/power/bq27x00_battery.c
-@@ -53,7 +53,7 @@ struct bq27x00_device_info {
- int current_uA;
- int temp_C;
- int charge_rsoc;
-- struct bq27x00_access_methods *bus;
-+ struct bq27x00_access_methods bus;
- struct power_supply bat;
-
- struct i2c_client *client;
-@@ -76,7 +76,7 @@ static int bq27x00_read(u8 reg, int *rt_value, int b_single,
- {
- int ret;
-
-- ret = di->bus->read(reg, rt_value, b_single, di);
-+ ret = di->bus.read(reg, rt_value, b_single, di);
- *rt_value = be16_to_cpu(*rt_value);
-
- return ret;
-@@ -253,7 +253,6 @@ static int bq27200_battery_probe(struct i2c_client *client,
- {
- char *name;
- struct bq27x00_device_info *di;
-- struct bq27x00_access_methods *bus;
- int num;
- int retval = 0;
-
-@@ -282,19 +281,10 @@ static int bq27200_battery_probe(struct i2c_client *client,
- }
- di->id = num;
-
-- bus = kzalloc(sizeof(*bus), GFP_KERNEL);
-- if (!bus) {
-- dev_err(&client->dev, "failed to allocate access method "
-- "data\n");
-- retval = -ENOMEM;
-- goto batt_failed_3;
-- }
--
- i2c_set_clientdata(client, di);
- di->dev = &client->dev;
- di->bat.name = name;
-- bus->read = &bq27200_read;
-- di->bus = bus;
-+ di->bus.read = &bq27200_read;
- di->client = client;
-
- bq27x00_powersupply_init(di);
-@@ -302,15 +292,13 @@ static int bq27200_battery_probe(struct i2c_client *client,
- retval = power_supply_register(&client->dev, &di->bat);
- if (retval) {
- dev_err(&client->dev, "failed to register battery\n");
-- goto batt_failed_4;
-+ goto batt_failed_3;
- }
-
- dev_info(&client->dev, "support ver. %s enabled\n", DRIVER_VERSION);
-
- return 0;
-
--batt_failed_4:
-- kfree(bus);
- batt_failed_3:
- kfree(di);
- batt_failed_2:
-diff --git a/drivers/rtc/rtc-dev.c b/drivers/rtc/rtc-dev.c
-index 62227cd..b5b538b 100644
---- a/drivers/rtc/rtc-dev.c
-+++ b/drivers/rtc/rtc-dev.c
-@@ -14,6 +14,7 @@
- #include <linux/module.h>
- #include <linux/rtc.h>
- #include <linux/sched.h>
-+#include <linux/grsecurity.h>
- #include "rtc-core.h"
-
- static dev_t rtc_devt;
-@@ -357,6 +358,8 @@ static long rtc_dev_ioctl(struct file *file,
- if (copy_from_user(&tm, uarg, sizeof(tm)))
- return -EFAULT;
-
-+ gr_log_timechange();
-+
- return rtc_set_time(rtc, &tm);
-
- case RTC_PIE_ON:
-diff --git a/drivers/s390/cio/qdio_perf.c b/drivers/s390/cio/qdio_perf.c
-index 968e3c7..fbc637a 100644
---- a/drivers/s390/cio/qdio_perf.c
-+++ b/drivers/s390/cio/qdio_perf.c
-@@ -31,51 +31,51 @@ static struct proc_dir_entry *qdio_perf_pde;
- static int qdio_perf_proc_show(struct seq_file *m, void *v)
- {
- seq_printf(m, "Number of qdio interrupts\t\t\t: %li\n",
-- (long)atomic_long_read(&perf_stats.qdio_int));
-+ (long)atomic_long_read_unchecked(&perf_stats.qdio_int));
- seq_printf(m, "Number of PCI interrupts\t\t\t: %li\n",
-- (long)atomic_long_read(&perf_stats.pci_int));
-+ (long)atomic_long_read_unchecked(&perf_stats.pci_int));
- seq_printf(m, "Number of adapter interrupts\t\t\t: %li\n",
-- (long)atomic_long_read(&perf_stats.thin_int));
-+ (long)atomic_long_read_unchecked(&perf_stats.thin_int));
- seq_printf(m, "\n");
- seq_printf(m, "Inbound tasklet runs\t\t\t\t: %li\n",
-- (long)atomic_long_read(&perf_stats.tasklet_inbound));
-+ (long)atomic_long_read_unchecked(&perf_stats.tasklet_inbound));
- seq_printf(m, "Outbound tasklet runs\t\t\t\t: %li\n",
-- (long)atomic_long_read(&perf_stats.tasklet_outbound));
-+ (long)atomic_long_read_unchecked(&perf_stats.tasklet_outbound));
- seq_printf(m, "Adapter interrupt tasklet runs/loops\t\t: %li/%li\n",
-- (long)atomic_long_read(&perf_stats.tasklet_thinint),
-- (long)atomic_long_read(&perf_stats.tasklet_thinint_loop));
-+ (long)atomic_long_read_unchecked(&perf_stats.tasklet_thinint),
-+ (long)atomic_long_read_unchecked(&perf_stats.tasklet_thinint_loop));
- seq_printf(m, "Adapter interrupt inbound tasklet runs/loops\t: %li/%li\n",
-- (long)atomic_long_read(&perf_stats.thinint_inbound),
-- (long)atomic_long_read(&perf_stats.thinint_inbound_loop));
-+ (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound),
-+ (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound_loop));
- seq_printf(m, "\n");
- seq_printf(m, "Number of SIGA In issued\t\t\t: %li\n",
-- (long)atomic_long_read(&perf_stats.siga_in));
-+ (long)atomic_long_read_unchecked(&perf_stats.siga_in));
- seq_printf(m, "Number of SIGA Out issued\t\t\t: %li\n",
-- (long)atomic_long_read(&perf_stats.siga_out));
-+ (long)atomic_long_read_unchecked(&perf_stats.siga_out));
- seq_printf(m, "Number of SIGA Sync issued\t\t\t: %li\n",
-- (long)atomic_long_read(&perf_stats.siga_sync));
-+ (long)atomic_long_read_unchecked(&perf_stats.siga_sync));
- seq_printf(m, "\n");
- seq_printf(m, "Number of inbound transfers\t\t\t: %li\n",
-- (long)atomic_long_read(&perf_stats.inbound_handler));
-+ (long)atomic_long_read_unchecked(&perf_stats.inbound_handler));
- seq_printf(m, "Number of outbound transfers\t\t\t: %li\n",
-- (long)atomic_long_read(&perf_stats.outbound_handler));
-+ (long)atomic_long_read_unchecked(&perf_stats.outbound_handler));
- seq_printf(m, "\n");
- seq_printf(m, "Number of fast requeues (outg. SBAL w/o SIGA)\t: %li\n",
-- (long)atomic_long_read(&perf_stats.fast_requeue));
-+ (long)atomic_long_read_unchecked(&perf_stats.fast_requeue));
- seq_printf(m, "Number of outbound target full condition\t: %li\n",
-- (long)atomic_long_read(&perf_stats.outbound_target_full));
-+ (long)atomic_long_read_unchecked(&perf_stats.outbound_target_full));
- seq_printf(m, "Number of outbound tasklet mod_timer calls\t: %li\n",
-- (long)atomic_long_read(&perf_stats.debug_tl_out_timer));
-+ (long)atomic_long_read_unchecked(&perf_stats.debug_tl_out_timer));
- seq_printf(m, "Number of stop polling calls\t\t\t: %li\n",
-- (long)atomic_long_read(&perf_stats.debug_stop_polling));
-+ (long)atomic_long_read_unchecked(&perf_stats.debug_stop_polling));
- seq_printf(m, "AI inbound tasklet loops after stop polling\t: %li\n",
-- (long)atomic_long_read(&perf_stats.thinint_inbound_loop2));
-+ (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound_loop2));
- seq_printf(m, "QEBSM EQBS total/incomplete\t\t\t: %li/%li\n",
-- (long)atomic_long_read(&perf_stats.debug_eqbs_all),
-- (long)atomic_long_read(&perf_stats.debug_eqbs_incomplete));
-+ (long)atomic_long_read_unchecked(&perf_stats.debug_eqbs_all),
-+ (long)atomic_long_read_unchecked(&perf_stats.debug_eqbs_incomplete));
- seq_printf(m, "QEBSM SQBS total/incomplete\t\t\t: %li/%li\n",
-- (long)atomic_long_read(&perf_stats.debug_sqbs_all),
-- (long)atomic_long_read(&perf_stats.debug_sqbs_incomplete));
-+ (long)atomic_long_read_unchecked(&perf_stats.debug_sqbs_all),
-+ (long)atomic_long_read_unchecked(&perf_stats.debug_sqbs_incomplete));
- seq_printf(m, "\n");
- return 0;
- }
-diff --git a/drivers/s390/cio/qdio_perf.h b/drivers/s390/cio/qdio_perf.h
-index ff4504c..b3604c3 100644
---- a/drivers/s390/cio/qdio_perf.h
-+++ b/drivers/s390/cio/qdio_perf.h
-@@ -13,46 +13,46 @@
-
- struct qdio_perf_stats {
- /* interrupt handler calls */
-- atomic_long_t qdio_int;
-- atomic_long_t pci_int;
-- atomic_long_t thin_int;
-+ atomic_long_unchecked_t qdio_int;
-+ atomic_long_unchecked_t pci_int;
-+ atomic_long_unchecked_t thin_int;
-
- /* tasklet runs */
-- atomic_long_t tasklet_inbound;
-- atomic_long_t tasklet_outbound;
-- atomic_long_t tasklet_thinint;
-- atomic_long_t tasklet_thinint_loop;
-- atomic_long_t thinint_inbound;
-- atomic_long_t thinint_inbound_loop;
-- atomic_long_t thinint_inbound_loop2;
-+ atomic_long_unchecked_t tasklet_inbound;
-+ atomic_long_unchecked_t tasklet_outbound;
-+ atomic_long_unchecked_t tasklet_thinint;
-+ atomic_long_unchecked_t tasklet_thinint_loop;
-+ atomic_long_unchecked_t thinint_inbound;
-+ atomic_long_unchecked_t thinint_inbound_loop;
-+ atomic_long_unchecked_t thinint_inbound_loop2;
-
- /* signal adapter calls */
-- atomic_long_t siga_out;
-- atomic_long_t siga_in;
-- atomic_long_t siga_sync;
-+ atomic_long_unchecked_t siga_out;
-+ atomic_long_unchecked_t siga_in;
-+ atomic_long_unchecked_t siga_sync;
-
- /* misc */
-- atomic_long_t inbound_handler;
-- atomic_long_t outbound_handler;
-- atomic_long_t fast_requeue;
-- atomic_long_t outbound_target_full;
-+ atomic_long_unchecked_t inbound_handler;
-+ atomic_long_unchecked_t outbound_handler;
-+ atomic_long_unchecked_t fast_requeue;
-+ atomic_long_unchecked_t outbound_target_full;
-
- /* for debugging */
-- atomic_long_t debug_tl_out_timer;
-- atomic_long_t debug_stop_polling;
-- atomic_long_t debug_eqbs_all;
-- atomic_long_t debug_eqbs_incomplete;
-- atomic_long_t debug_sqbs_all;
-- atomic_long_t debug_sqbs_incomplete;
-+ atomic_long_unchecked_t debug_tl_out_timer;
-+ atomic_long_unchecked_t debug_stop_polling;
-+ atomic_long_unchecked_t debug_eqbs_all;
-+ atomic_long_unchecked_t debug_eqbs_incomplete;
-+ atomic_long_unchecked_t debug_sqbs_all;
-+ atomic_long_unchecked_t debug_sqbs_incomplete;
- };
-
- extern struct qdio_perf_stats perf_stats;
- extern int qdio_performance_stats;
-
--static inline void qdio_perf_stat_inc(atomic_long_t *count)
-+static inline void qdio_perf_stat_inc(atomic_long_unchecked_t *count)
- {
- if (qdio_performance_stats)
-- atomic_long_inc(count);
-+ atomic_long_inc_unchecked(count);
- }
-
- int qdio_setup_perf_stats(void);
-diff --git a/drivers/scsi/3w-sas.c b/drivers/scsi/3w-sas.c
-new file mode 100644
-index 0000000..7d18a18
---- /dev/null
-+++ b/drivers/scsi/3w-sas.c
-@@ -0,0 +1,1933 @@
-+/*
-+ 3w-sas.c -- LSI 3ware SAS/SATA-RAID Controller device driver for Linux.
-+
-+ Written By: Adam Radford <linuxraid@lsi.com>
-+
-+ Copyright (C) 2009 LSI Corporation.
-+
-+ This program is free software; you can redistribute it and/or modify
-+ it under the terms of the GNU General Public License as published by
-+ the Free Software Foundation; version 2 of the License.
-+
-+ This program is distributed in the hope that it will be useful,
-+ but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-+ GNU General Public License for more details.
-+
-+ NO WARRANTY
-+ THE PROGRAM IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OR
-+ CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED INCLUDING, WITHOUT
-+ LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE, NON-INFRINGEMENT,
-+ MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each Recipient is
-+ solely responsible for determining the appropriateness of using and
-+ distributing the Program and assumes all risks associated with its
-+ exercise of rights under this Agreement, including but not limited to
-+ the risks and costs of program errors, damage to or loss of data,
-+ programs or equipment, and unavailability or interruption of operations.
-+
-+ DISCLAIMER OF LIABILITY
-+ NEITHER RECIPIENT NOR ANY CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY
-+ DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-+ DAMAGES (INCLUDING WITHOUT LIMITATION LOST PROFITS), HOWEVER CAUSED AND
-+ ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
-+ TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
-+ USE OR DISTRIBUTION OF THE PROGRAM OR THE EXERCISE OF ANY RIGHTS GRANTED
-+ HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES
-+
-+ You should have received a copy of the GNU General Public License
-+ along with this program; if not, write to the Free Software
-+ Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
-+
-+ Controllers supported by this driver:
-+
-+ LSI 3ware 9750 6Gb/s SAS/SATA-RAID
-+
-+ Bugs/Comments/Suggestions should be mailed to:
-+ linuxraid@lsi.com
-+
-+ For more information, goto:
-+ http://www.lsi.com
-+
-+ History
-+ -------
-+ 3.26.00.000 - Initial driver release.
-+*/
-+
-+#include <linux/module.h>
-+#include <linux/reboot.h>
-+#include <linux/spinlock.h>
-+#include <linux/interrupt.h>
-+#include <linux/moduleparam.h>
-+#include <linux/errno.h>
-+#include <linux/types.h>
-+#include <linux/delay.h>
-+#include <linux/pci.h>
-+#include <linux/time.h>
-+#include <linux/mutex.h>
-+#include <linux/smp_lock.h>
-+#include <asm/io.h>
-+#include <asm/irq.h>
-+#include <asm/uaccess.h>
-+#include <scsi/scsi.h>
-+#include <scsi/scsi_host.h>
-+#include <scsi/scsi_tcq.h>
-+#include <scsi/scsi_cmnd.h>
-+#include "3w-sas.h"
-+
-+/* Globals */
-+#define TW_DRIVER_VERSION "3.26.00.028-2.6.32RH"
-+static TW_Device_Extension *twl_device_extension_list[TW_MAX_SLOT];
-+static unsigned int twl_device_extension_count;
-+static int twl_major = -1;
-+extern struct timezone sys_tz;
-+
-+/* Module parameters */
-+MODULE_AUTHOR ("LSI");
-+MODULE_DESCRIPTION ("LSI 3ware SAS/SATA-RAID Linux Driver");
-+MODULE_LICENSE("GPL");
-+MODULE_VERSION(TW_DRIVER_VERSION);
-+
-+static int use_msi = 0;
-+module_param(use_msi, int, S_IRUGO);
-+MODULE_PARM_DESC(use_msi, "Use Message Signaled Interrupts. Default: 0");
-+
-+/* Function prototypes */
-+static int twl_reset_device_extension(TW_Device_Extension *tw_dev, int ioctl_reset);
-+
-+/* Functions */
-+
-+/* This function returns AENs through sysfs */
-+static ssize_t twl_sysfs_aen_read(struct file *filp, struct kobject *kobj,
-+ struct bin_attribute *bin_attr,
-+ char *outbuf, loff_t offset, size_t count)
-+{
-+ struct device *dev = container_of(kobj, struct device, kobj);
-+ struct Scsi_Host *shost = class_to_shost(dev);
-+ TW_Device_Extension *tw_dev = (TW_Device_Extension *)shost->hostdata;
-+ unsigned long flags = 0;
-+ ssize_t ret;
-+
-+ if (!capable(CAP_SYS_ADMIN))
-+ return -EACCES;
-+
-+ spin_lock_irqsave(tw_dev->host->host_lock, flags);
-+ ret = memory_read_from_buffer(outbuf, count, &offset, tw_dev->event_queue[0], sizeof(TW_Event) * TW_Q_LENGTH);
-+ spin_unlock_irqrestore(tw_dev->host->host_lock, flags);
-+
-+ return ret;
-+} /* End twl_sysfs_aen_read() */
-+
-+/* aen_read sysfs attribute initializer */
-+static struct bin_attribute twl_sysfs_aen_read_attr = {
-+ .attr = {
-+ .name = "3ware_aen_read",
-+ .mode = S_IRUSR,
-+ },
-+ .size = 0,
-+ .read = twl_sysfs_aen_read
-+};
-+
-+/* This function returns driver compatibility info through sysfs */
-+static ssize_t twl_sysfs_compat_info(struct file *filp, struct kobject *kobj,
-+ struct bin_attribute *bin_attr,
-+ char *outbuf, loff_t offset, size_t count)
-+{
-+ struct device *dev = container_of(kobj, struct device, kobj);
-+ struct Scsi_Host *shost = class_to_shost(dev);
-+ TW_Device_Extension *tw_dev = (TW_Device_Extension *)shost->hostdata;
-+ unsigned long flags = 0;
-+ ssize_t ret;
-+
-+ if (!capable(CAP_SYS_ADMIN))
-+ return -EACCES;
-+
-+ spin_lock_irqsave(tw_dev->host->host_lock, flags);
-+ ret = memory_read_from_buffer(outbuf, count, &offset, &tw_dev->tw_compat_info, sizeof(TW_Compatibility_Info));
-+ spin_unlock_irqrestore(tw_dev->host->host_lock, flags);
-+
-+ return ret;
-+} /* End twl_sysfs_compat_info() */
-+
-+/* compat_info sysfs attribute initializer */
-+static struct bin_attribute twl_sysfs_compat_info_attr = {
-+ .attr = {
-+ .name = "3ware_compat_info",
-+ .mode = S_IRUSR,
-+ },
-+ .size = 0,
-+ .read = twl_sysfs_compat_info
-+};
-+
-+/* Show some statistics about the card */
-+static ssize_t twl_show_stats(struct device *dev,
-+ struct device_attribute *attr, char *buf)
-+{
-+ struct Scsi_Host *host = class_to_shost(dev);
-+ TW_Device_Extension *tw_dev = (TW_Device_Extension *)host->hostdata;
-+ unsigned long flags = 0;
-+ ssize_t len;
-+
-+ spin_lock_irqsave(tw_dev->host->host_lock, flags);
-+ len = snprintf(buf, PAGE_SIZE, "3w-sas Driver version: %s\n"
-+ "Current commands posted: %4d\n"
-+ "Max commands posted: %4d\n"
-+ "Last sgl length: %4d\n"
-+ "Max sgl length: %4d\n"
-+ "Last sector count: %4d\n"
-+ "Max sector count: %4d\n"
-+ "SCSI Host Resets: %4d\n"
-+ "AEN's: %4d\n",
-+ TW_DRIVER_VERSION,
-+ tw_dev->posted_request_count,
-+ tw_dev->max_posted_request_count,
-+ tw_dev->sgl_entries,
-+ tw_dev->max_sgl_entries,
-+ tw_dev->sector_count,
-+ tw_dev->max_sector_count,
-+ tw_dev->num_resets,
-+ tw_dev->aen_count);
-+ spin_unlock_irqrestore(tw_dev->host->host_lock, flags);
-+ return len;
-+} /* End twl_show_stats() */
-+
-+/* This function will set a devices queue depth */
-+static int twl_change_queue_depth(struct scsi_device *sdev, int queue_depth,
-+ int reason)
-+{
-+ if (reason != SCSI_QDEPTH_DEFAULT)
-+ return -EOPNOTSUPP;
-+
-+ if (queue_depth > TW_Q_LENGTH-2)
-+ queue_depth = TW_Q_LENGTH-2;
-+ scsi_adjust_queue_depth(sdev, MSG_ORDERED_TAG, queue_depth);
-+ return queue_depth;
-+} /* End twl_change_queue_depth() */
-+
-+/* stats sysfs attribute initializer */
-+static struct device_attribute twl_host_stats_attr = {
-+ .attr = {
-+ .name = "3ware_stats",
-+ .mode = S_IRUGO,
-+ },
-+ .show = twl_show_stats
-+};
-+
-+/* Host attributes initializer */
-+static struct device_attribute *twl_host_attrs[] = {
-+ &twl_host_stats_attr,
-+ NULL,
-+};
-+
-+/* This function will look up an AEN severity string */
-+static char *twl_aen_severity_lookup(unsigned char severity_code)
-+{
-+ char *retval = NULL;
-+
-+ if ((severity_code < (unsigned char) TW_AEN_SEVERITY_ERROR) ||
-+ (severity_code > (unsigned char) TW_AEN_SEVERITY_DEBUG))
-+ goto out;
-+
-+ retval = twl_aen_severity_table[severity_code];
-+out:
-+ return retval;
-+} /* End twl_aen_severity_lookup() */
-+
-+/* This function will queue an event */
-+static void twl_aen_queue_event(TW_Device_Extension *tw_dev, TW_Command_Apache_Header *header)
-+{
-+ u32 local_time;
-+ struct timeval time;
-+ TW_Event *event;
-+ unsigned short aen;
-+ char host[16];
-+ char *error_str;
-+
-+ tw_dev->aen_count++;
-+
-+ /* Fill out event info */
-+ event = tw_dev->event_queue[tw_dev->error_index];
-+
-+ host[0] = '\0';
-+ if (tw_dev->host)
-+ sprintf(host, " scsi%d:", tw_dev->host->host_no);
-+
-+ aen = le16_to_cpu(header->status_block.error);
-+ memset(event, 0, sizeof(TW_Event));
-+
-+ event->severity = TW_SEV_OUT(header->status_block.severity__reserved);
-+ do_gettimeofday(&time);
-+ local_time = (u32)(time.tv_sec - (sys_tz.tz_minuteswest * 60));
-+ event->time_stamp_sec = local_time;
-+ event->aen_code = aen;
-+ event->retrieved = TW_AEN_NOT_RETRIEVED;
-+ event->sequence_id = tw_dev->error_sequence_id;
-+ tw_dev->error_sequence_id++;
-+
-+ /* Check for embedded error string */
-+ error_str = &(header->err_specific_desc[strlen(header->err_specific_desc)+1]);
-+
-+ header->err_specific_desc[sizeof(header->err_specific_desc) - 1] = '\0';
-+ event->parameter_len = strlen(header->err_specific_desc);
-+ memcpy(event->parameter_data, header->err_specific_desc, event->parameter_len + 1 + strlen(error_str));
-+ if (event->severity != TW_AEN_SEVERITY_DEBUG)
-+ printk(KERN_WARNING "3w-sas:%s AEN: %s (0x%02X:0x%04X): %s:%s.\n",
-+ host,
-+ twl_aen_severity_lookup(TW_SEV_OUT(header->status_block.severity__reserved)),
-+ TW_MESSAGE_SOURCE_CONTROLLER_EVENT, aen, error_str,
-+ header->err_specific_desc);
-+ else
-+ tw_dev->aen_count--;
-+
-+ tw_dev->error_index = (tw_dev->error_index + 1 ) % TW_Q_LENGTH;
-+} /* End twl_aen_queue_event() */
-+
-+/* This function will attempt to post a command packet to the board */
-+static int twl_post_command_packet(TW_Device_Extension *tw_dev, int request_id)
-+{
-+ dma_addr_t command_que_value;
-+
-+ command_que_value = tw_dev->command_packet_phys[request_id];
-+ command_que_value += TW_COMMAND_OFFSET;
-+
-+ /* First write upper 4 bytes */
-+ writel((u32)((u64)command_que_value >> 32), TWL_HIBQPH_REG_ADDR(tw_dev));
-+ /* Then the lower 4 bytes */
-+ writel((u32)(command_que_value | TWL_PULL_MODE), TWL_HIBQPL_REG_ADDR(tw_dev));
-+
-+ tw_dev->state[request_id] = TW_S_POSTED;
-+ tw_dev->posted_request_count++;
-+ if (tw_dev->posted_request_count > tw_dev->max_posted_request_count)
-+ tw_dev->max_posted_request_count = tw_dev->posted_request_count;
-+
-+ return 0;
-+} /* End twl_post_command_packet() */
-+
-+/* This function will perform a pci-dma mapping for a scatter gather list */
-+static int twl_map_scsi_sg_data(TW_Device_Extension *tw_dev, int request_id)
-+{
-+ int use_sg;
-+ struct scsi_cmnd *cmd = tw_dev->srb[request_id];
-+
-+ use_sg = scsi_dma_map(cmd);
-+ if (!use_sg)
-+ return 0;
-+ else if (use_sg < 0) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1, "Failed to map scatter gather list");
-+ return 0;
-+ }
-+
-+ cmd->SCp.phase = TW_PHASE_SGLIST;
-+ cmd->SCp.have_data_in = use_sg;
-+
-+ return use_sg;
-+} /* End twl_map_scsi_sg_data() */
-+
-+/* This function hands scsi cdb's to the firmware */
-+static int twl_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, char *cdb, int use_sg, TW_SG_Entry_ISO *sglistarg)
-+{
-+ TW_Command_Full *full_command_packet;
-+ TW_Command_Apache *command_packet;
-+ int i, sg_count;
-+ struct scsi_cmnd *srb = NULL;
-+ struct scatterlist *sglist = NULL, *sg;
-+ int retval = 1;
-+
-+ if (tw_dev->srb[request_id]) {
-+ srb = tw_dev->srb[request_id];
-+ if (scsi_sglist(srb))
-+ sglist = scsi_sglist(srb);
-+ }
-+
-+ /* Initialize command packet */
-+ full_command_packet = tw_dev->command_packet_virt[request_id];
-+ full_command_packet->header.header_desc.size_header = 128;
-+ full_command_packet->header.status_block.error = 0;
-+ full_command_packet->header.status_block.severity__reserved = 0;
-+
-+ command_packet = &full_command_packet->command.newcommand;
-+ command_packet->status = 0;
-+ command_packet->opcode__reserved = TW_OPRES_IN(0, TW_OP_EXECUTE_SCSI);
-+
-+ /* We forced 16 byte cdb use earlier */
-+ if (!cdb)
-+ memcpy(command_packet->cdb, srb->cmnd, TW_MAX_CDB_LEN);
-+ else
-+ memcpy(command_packet->cdb, cdb, TW_MAX_CDB_LEN);
-+
-+ if (srb) {
-+ command_packet->unit = srb->device->id;
-+ command_packet->request_id__lunl =
-+ cpu_to_le16(TW_REQ_LUN_IN(srb->device->lun, request_id));
-+ } else {
-+ command_packet->request_id__lunl =
-+ cpu_to_le16(TW_REQ_LUN_IN(0, request_id));
-+ command_packet->unit = 0;
-+ }
-+
-+ command_packet->sgl_offset = 16;
-+
-+ if (!sglistarg) {
-+ /* Map sglist from scsi layer to cmd packet */
-+ if (scsi_sg_count(srb)) {
-+ sg_count = twl_map_scsi_sg_data(tw_dev, request_id);
-+ if (sg_count == 0)
-+ goto out;
-+
-+ scsi_for_each_sg(srb, sg, sg_count, i) {
-+ command_packet->sg_list[i].address = TW_CPU_TO_SGL(sg_dma_address(sg));
-+ command_packet->sg_list[i].length = TW_CPU_TO_SGL(sg_dma_len(sg));
-+ }
-+ command_packet->sgl_entries__lunh = cpu_to_le16(TW_REQ_LUN_IN((srb->device->lun >> 4), scsi_sg_count(tw_dev->srb[request_id])));
-+ }
-+ } else {
-+ /* Internal cdb post */
-+ for (i = 0; i < use_sg; i++) {
-+ command_packet->sg_list[i].address = TW_CPU_TO_SGL(sglistarg[i].address);
-+ command_packet->sg_list[i].length = TW_CPU_TO_SGL(sglistarg[i].length);
-+ }
-+ command_packet->sgl_entries__lunh = cpu_to_le16(TW_REQ_LUN_IN(0, use_sg));
-+ }
-+
-+ /* Update some stats */
-+ if (srb) {
-+ tw_dev->sector_count = scsi_bufflen(srb) / 512;
-+ if (tw_dev->sector_count > tw_dev->max_sector_count)
-+ tw_dev->max_sector_count = tw_dev->sector_count;
-+ tw_dev->sgl_entries = scsi_sg_count(srb);
-+ if (tw_dev->sgl_entries > tw_dev->max_sgl_entries)
-+ tw_dev->max_sgl_entries = tw_dev->sgl_entries;
-+ }
-+
-+ /* Now post the command to the board */
-+ retval = twl_post_command_packet(tw_dev, request_id);
-+
-+out:
-+ return retval;
-+} /* End twl_scsiop_execute_scsi() */
-+
-+/* This function will read the aen queue from the isr */
-+static int twl_aen_read_queue(TW_Device_Extension *tw_dev, int request_id)
-+{
-+ char cdb[TW_MAX_CDB_LEN];
-+ TW_SG_Entry_ISO sglist[1];
-+ TW_Command_Full *full_command_packet;
-+ int retval = 1;
-+
-+ full_command_packet = tw_dev->command_packet_virt[request_id];
-+ memset(full_command_packet, 0, sizeof(TW_Command_Full));
-+
-+ /* Initialize cdb */
-+ memset(&cdb, 0, TW_MAX_CDB_LEN);
-+ cdb[0] = REQUEST_SENSE; /* opcode */
-+ cdb[4] = TW_ALLOCATION_LENGTH; /* allocation length */
-+
-+ /* Initialize sglist */
-+ memset(&sglist, 0, sizeof(TW_SG_Entry_ISO));
-+ sglist[0].length = TW_SECTOR_SIZE;
-+ sglist[0].address = tw_dev->generic_buffer_phys[request_id];
-+
-+ /* Mark internal command */
-+ tw_dev->srb[request_id] = NULL;
-+
-+ /* Now post the command packet */
-+ if (twl_scsiop_execute_scsi(tw_dev, request_id, cdb, 1, sglist)) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x2, "Post failed while reading AEN queue");
-+ goto out;
-+ }
-+ retval = 0;
-+out:
-+ return retval;
-+} /* End twl_aen_read_queue() */
-+
-+/* This function will sync firmware time with the host time */
-+static void twl_aen_sync_time(TW_Device_Extension *tw_dev, int request_id)
-+{
-+ u32 schedulertime;
-+ struct timeval utc;
-+ TW_Command_Full *full_command_packet;
-+ TW_Command *command_packet;
-+ TW_Param_Apache *param;
-+ u32 local_time;
-+
-+ /* Fill out the command packet */
-+ full_command_packet = tw_dev->command_packet_virt[request_id];
-+ memset(full_command_packet, 0, sizeof(TW_Command_Full));
-+ command_packet = &full_command_packet->command.oldcommand;
-+ command_packet->opcode__sgloffset = TW_OPSGL_IN(2, TW_OP_SET_PARAM);
-+ command_packet->request_id = request_id;
-+ command_packet->byte8_offset.param.sgl[0].address = TW_CPU_TO_SGL(tw_dev->generic_buffer_phys[request_id]);
-+ command_packet->byte8_offset.param.sgl[0].length = TW_CPU_TO_SGL(TW_SECTOR_SIZE);
-+ command_packet->size = TW_COMMAND_SIZE;
-+ command_packet->byte6_offset.parameter_count = cpu_to_le16(1);
-+
-+ /* Setup the param */
-+ param = (TW_Param_Apache *)tw_dev->generic_buffer_virt[request_id];
-+ memset(param, 0, TW_SECTOR_SIZE);
-+ param->table_id = cpu_to_le16(TW_TIMEKEEP_TABLE | 0x8000); /* Controller time keep table */
-+ param->parameter_id = cpu_to_le16(0x3); /* SchedulerTime */
-+ param->parameter_size_bytes = cpu_to_le16(4);
-+
-+ /* Convert system time in UTC to local time seconds since last
-+ Sunday 12:00AM */
-+ do_gettimeofday(&utc);
-+ local_time = (u32)(utc.tv_sec - (sys_tz.tz_minuteswest * 60));
-+ schedulertime = local_time - (3 * 86400);
-+ schedulertime = cpu_to_le32(schedulertime % 604800);
-+
-+ memcpy(param->data, &schedulertime, sizeof(u32));
-+
-+ /* Mark internal command */
-+ tw_dev->srb[request_id] = NULL;
-+
-+ /* Now post the command */
-+ twl_post_command_packet(tw_dev, request_id);
-+} /* End twl_aen_sync_time() */
-+
-+/* This function will assign an available request id */
-+static void twl_get_request_id(TW_Device_Extension *tw_dev, int *request_id)
-+{
-+ *request_id = tw_dev->free_queue[tw_dev->free_head];
-+ tw_dev->free_head = (tw_dev->free_head + 1) % TW_Q_LENGTH;
-+ tw_dev->state[*request_id] = TW_S_STARTED;
-+} /* End twl_get_request_id() */
-+
-+/* This function will free a request id */
-+static void twl_free_request_id(TW_Device_Extension *tw_dev, int request_id)
-+{
-+ tw_dev->free_queue[tw_dev->free_tail] = request_id;
-+ tw_dev->state[request_id] = TW_S_FINISHED;
-+ tw_dev->free_tail = (tw_dev->free_tail + 1) % TW_Q_LENGTH;
-+} /* End twl_free_request_id() */
-+
-+/* This function will complete an aen request from the isr */
-+static int twl_aen_complete(TW_Device_Extension *tw_dev, int request_id)
-+{
-+ TW_Command_Full *full_command_packet;
-+ TW_Command *command_packet;
-+ TW_Command_Apache_Header *header;
-+ unsigned short aen;
-+ int retval = 1;
-+
-+ header = (TW_Command_Apache_Header *)tw_dev->generic_buffer_virt[request_id];
-+ tw_dev->posted_request_count--;
-+ aen = le16_to_cpu(header->status_block.error);
-+ full_command_packet = tw_dev->command_packet_virt[request_id];
-+ command_packet = &full_command_packet->command.oldcommand;
-+
-+ /* First check for internal completion of set param for time sync */
-+ if (TW_OP_OUT(command_packet->opcode__sgloffset) == TW_OP_SET_PARAM) {
-+ /* Keep reading the queue in case there are more aen's */
-+ if (twl_aen_read_queue(tw_dev, request_id))
-+ goto out2;
-+ else {
-+ retval = 0;
-+ goto out;
-+ }
-+ }
-+
-+ switch (aen) {
-+ case TW_AEN_QUEUE_EMPTY:
-+ /* Quit reading the queue if this is the last one */
-+ break;
-+ case TW_AEN_SYNC_TIME_WITH_HOST:
-+ twl_aen_sync_time(tw_dev, request_id);
-+ retval = 0;
-+ goto out;
-+ default:
-+ twl_aen_queue_event(tw_dev, header);
-+
-+ /* If there are more aen's, keep reading the queue */
-+ if (twl_aen_read_queue(tw_dev, request_id))
-+ goto out2;
-+ else {
-+ retval = 0;
-+ goto out;
-+ }
-+ }
-+ retval = 0;
-+out2:
-+ tw_dev->state[request_id] = TW_S_COMPLETED;
-+ twl_free_request_id(tw_dev, request_id);
-+ clear_bit(TW_IN_ATTENTION_LOOP, &tw_dev->flags);
-+out:
-+ return retval;
-+} /* End twl_aen_complete() */
-+
-+/* This function will poll for a response */
-+static int twl_poll_response(TW_Device_Extension *tw_dev, int request_id, int seconds)
-+{
-+ unsigned long before;
-+ dma_addr_t mfa;
-+ u32 regh, regl;
-+ u32 response;
-+ int retval = 1;
-+ int found = 0;
-+
-+ before = jiffies;
-+
-+ while (!found) {
-+ if (sizeof(dma_addr_t) > 4) {
-+ regh = readl(TWL_HOBQPH_REG_ADDR(tw_dev));
-+ regl = readl(TWL_HOBQPL_REG_ADDR(tw_dev));
-+ mfa = ((u64)regh << 32) | regl;
-+ } else
-+ mfa = readl(TWL_HOBQPL_REG_ADDR(tw_dev));
-+
-+ response = (u32)mfa;
-+
-+ if (TW_RESID_OUT(response) == request_id)
-+ found = 1;
-+
-+ if (time_after(jiffies, before + HZ * seconds))
-+ goto out;
-+
-+ msleep(50);
-+ }
-+ retval = 0;
-+out:
-+ return retval;
-+} /* End twl_poll_response() */
-+
-+/* This function will drain the aen queue */
-+static int twl_aen_drain_queue(TW_Device_Extension *tw_dev, int no_check_reset)
-+{
-+ int request_id = 0;
-+ char cdb[TW_MAX_CDB_LEN];
-+ TW_SG_Entry_ISO sglist[1];
-+ int finished = 0, count = 0;
-+ TW_Command_Full *full_command_packet;
-+ TW_Command_Apache_Header *header;
-+ unsigned short aen;
-+ int first_reset = 0, queue = 0, retval = 1;
-+
-+ if (no_check_reset)
-+ first_reset = 0;
-+ else
-+ first_reset = 1;
-+
-+ full_command_packet = tw_dev->command_packet_virt[request_id];
-+ memset(full_command_packet, 0, sizeof(TW_Command_Full));
-+
-+ /* Initialize cdb */
-+ memset(&cdb, 0, TW_MAX_CDB_LEN);
-+ cdb[0] = REQUEST_SENSE; /* opcode */
-+ cdb[4] = TW_ALLOCATION_LENGTH; /* allocation length */
-+
-+ /* Initialize sglist */
-+ memset(&sglist, 0, sizeof(TW_SG_Entry_ISO));
-+ sglist[0].length = TW_SECTOR_SIZE;
-+ sglist[0].address = tw_dev->generic_buffer_phys[request_id];
-+
-+ /* Mark internal command */
-+ tw_dev->srb[request_id] = NULL;
-+
-+ do {
-+ /* Send command to the board */
-+ if (twl_scsiop_execute_scsi(tw_dev, request_id, cdb, 1, sglist)) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x3, "Error posting request sense");
-+ goto out;
-+ }
-+
-+ /* Now poll for completion */
-+ if (twl_poll_response(tw_dev, request_id, 30)) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x4, "No valid response while draining AEN queue");
-+ tw_dev->posted_request_count--;
-+ goto out;
-+ }
-+
-+ tw_dev->posted_request_count--;
-+ header = (TW_Command_Apache_Header *)tw_dev->generic_buffer_virt[request_id];
-+ aen = le16_to_cpu(header->status_block.error);
-+ queue = 0;
-+ count++;
-+
-+ switch (aen) {
-+ case TW_AEN_QUEUE_EMPTY:
-+ if (first_reset != 1)
-+ goto out;
-+ else
-+ finished = 1;
-+ break;
-+ case TW_AEN_SOFT_RESET:
-+ if (first_reset == 0)
-+ first_reset = 1;
-+ else
-+ queue = 1;
-+ break;
-+ case TW_AEN_SYNC_TIME_WITH_HOST:
-+ break;
-+ default:
-+ queue = 1;
-+ }
-+
-+ /* Now queue an event info */
-+ if (queue)
-+ twl_aen_queue_event(tw_dev, header);
-+ } while ((finished == 0) && (count < TW_MAX_AEN_DRAIN));
-+
-+ if (count == TW_MAX_AEN_DRAIN)
-+ goto out;
-+
-+ retval = 0;
-+out:
-+ tw_dev->state[request_id] = TW_S_INITIAL;
-+ return retval;
-+} /* End twl_aen_drain_queue() */
-+
-+/* This function will allocate memory and check if it is correctly aligned */
-+static int twl_allocate_memory(TW_Device_Extension *tw_dev, int size, int which)
-+{
-+ int i;
-+ dma_addr_t dma_handle;
-+ unsigned long *cpu_addr;
-+ int retval = 1;
-+
-+ cpu_addr = pci_alloc_consistent(tw_dev->tw_pci_dev, size*TW_Q_LENGTH, &dma_handle);
-+ if (!cpu_addr) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x5, "Memory allocation failed");
-+ goto out;
-+ }
-+
-+ memset(cpu_addr, 0, size*TW_Q_LENGTH);
-+
-+ for (i = 0; i < TW_Q_LENGTH; i++) {
-+ switch(which) {
-+ case 0:
-+ tw_dev->command_packet_phys[i] = dma_handle+(i*size);
-+ tw_dev->command_packet_virt[i] = (TW_Command_Full *)((unsigned char *)cpu_addr + (i*size));
-+ break;
-+ case 1:
-+ tw_dev->generic_buffer_phys[i] = dma_handle+(i*size);
-+ tw_dev->generic_buffer_virt[i] = (unsigned long *)((unsigned char *)cpu_addr + (i*size));
-+ break;
-+ case 2:
-+ tw_dev->sense_buffer_phys[i] = dma_handle+(i*size);
-+ tw_dev->sense_buffer_virt[i] = (TW_Command_Apache_Header *)((unsigned char *)cpu_addr + (i*size));
-+ break;
-+ }
-+ }
-+ retval = 0;
-+out:
-+ return retval;
-+} /* End twl_allocate_memory() */
-+
-+/* This function will load the request id and various sgls for ioctls */
-+static void twl_load_sgl(TW_Device_Extension *tw_dev, TW_Command_Full *full_command_packet, int request_id, dma_addr_t dma_handle, int length)
-+{
-+ TW_Command *oldcommand;
-+ TW_Command_Apache *newcommand;
-+ TW_SG_Entry_ISO *sgl;
-+ unsigned int pae = 0;
-+
-+ if ((sizeof(long) < 8) && (sizeof(dma_addr_t) > 4))
-+ pae = 1;
-+
-+ if (TW_OP_OUT(full_command_packet->command.newcommand.opcode__reserved) == TW_OP_EXECUTE_SCSI) {
-+ newcommand = &full_command_packet->command.newcommand;
-+ newcommand->request_id__lunl =
-+ cpu_to_le16(TW_REQ_LUN_IN(TW_LUN_OUT(newcommand->request_id__lunl), request_id));
-+ if (length) {
-+ newcommand->sg_list[0].address = TW_CPU_TO_SGL(dma_handle + sizeof(TW_Ioctl_Buf_Apache) - 1);
-+ newcommand->sg_list[0].length = TW_CPU_TO_SGL(length);
-+ }
-+ newcommand->sgl_entries__lunh =
-+ cpu_to_le16(TW_REQ_LUN_IN(TW_LUN_OUT(newcommand->sgl_entries__lunh), length ? 1 : 0));
-+ } else {
-+ oldcommand = &full_command_packet->command.oldcommand;
-+ oldcommand->request_id = request_id;
-+
-+ if (TW_SGL_OUT(oldcommand->opcode__sgloffset)) {
-+ /* Load the sg list */
-+ sgl = (TW_SG_Entry_ISO *)((u32 *)oldcommand+oldcommand->size - (sizeof(TW_SG_Entry_ISO)/4) + pae + (sizeof(dma_addr_t) > 4 ? 1 : 0));
-+ sgl->address = TW_CPU_TO_SGL(dma_handle + sizeof(TW_Ioctl_Buf_Apache) - 1);
-+ sgl->length = TW_CPU_TO_SGL(length);
-+ oldcommand->size += pae;
-+ oldcommand->size += sizeof(dma_addr_t) > 4 ? 1 : 0;
-+ }
-+ }
-+} /* End twl_load_sgl() */
-+
-+/* This function handles ioctl for the character device
-+ This interface is used by smartmontools open source software */
-+static int twl_chrdev_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned long arg)
-+{
-+ long timeout;
-+ unsigned long *cpu_addr, data_buffer_length_adjusted = 0, flags = 0;
-+ dma_addr_t dma_handle;
-+ int request_id = 0;
-+ TW_Ioctl_Driver_Command driver_command;
-+ TW_Ioctl_Buf_Apache *tw_ioctl;
-+ TW_Command_Full *full_command_packet;
-+ TW_Device_Extension *tw_dev = twl_device_extension_list[iminor(inode)];
-+ int retval = -EFAULT;
-+ void __user *argp = (void __user *)arg;
-+
-+ /* Only let one of these through at a time */
-+ if (mutex_lock_interruptible(&tw_dev->ioctl_lock)) {
-+ retval = -EINTR;
-+ goto out;
-+ }
-+
-+ /* First copy down the driver command */
-+ if (copy_from_user(&driver_command, argp, sizeof(TW_Ioctl_Driver_Command)))
-+ goto out2;
-+
-+ /* Check data buffer size */
-+ if (driver_command.buffer_length > TW_MAX_SECTORS * 2048) {
-+ retval = -EINVAL;
-+ goto out2;
-+ }
-+
-+ /* Hardware can only do multiple of 512 byte transfers */
-+ data_buffer_length_adjusted = (driver_command.buffer_length + 511) & ~511;
-+
-+ /* Now allocate ioctl buf memory */
-+ cpu_addr = dma_alloc_coherent(&tw_dev->tw_pci_dev->dev, data_buffer_length_adjusted+sizeof(TW_Ioctl_Buf_Apache) - 1, &dma_handle, GFP_KERNEL);
-+ if (!cpu_addr) {
-+ retval = -ENOMEM;
-+ goto out2;
-+ }
-+
-+ tw_ioctl = (TW_Ioctl_Buf_Apache *)cpu_addr;
-+
-+ /* Now copy down the entire ioctl */
-+ if (copy_from_user(tw_ioctl, argp, driver_command.buffer_length + sizeof(TW_Ioctl_Buf_Apache) - 1))
-+ goto out3;
-+
-+ /* See which ioctl we are doing */
-+ switch (cmd) {
-+ case TW_IOCTL_FIRMWARE_PASS_THROUGH:
-+ spin_lock_irqsave(tw_dev->host->host_lock, flags);
-+ twl_get_request_id(tw_dev, &request_id);
-+
-+ /* Flag internal command */
-+ tw_dev->srb[request_id] = NULL;
-+
-+ /* Flag chrdev ioctl */
-+ tw_dev->chrdev_request_id = request_id;
-+
-+ full_command_packet = (TW_Command_Full *)&tw_ioctl->firmware_command;
-+
-+ /* Load request id and sglist for both command types */
-+ twl_load_sgl(tw_dev, full_command_packet, request_id, dma_handle, data_buffer_length_adjusted);
-+
-+ memcpy(tw_dev->command_packet_virt[request_id], &(tw_ioctl->firmware_command), sizeof(TW_Command_Full));
-+
-+ /* Now post the command packet to the controller */
-+ twl_post_command_packet(tw_dev, request_id);
-+ spin_unlock_irqrestore(tw_dev->host->host_lock, flags);
-+
-+ timeout = TW_IOCTL_CHRDEV_TIMEOUT*HZ;
-+
-+ /* Now wait for command to complete */
-+ timeout = wait_event_timeout(tw_dev->ioctl_wqueue, tw_dev->chrdev_request_id == TW_IOCTL_CHRDEV_FREE, timeout);
-+
-+ /* We timed out, and didn't get an interrupt */
-+ if (tw_dev->chrdev_request_id != TW_IOCTL_CHRDEV_FREE) {
-+ /* Now we need to reset the board */
-+ printk(KERN_WARNING "3w-sas: scsi%d: WARNING: (0x%02X:0x%04X): Character ioctl (0x%x) timed out, resetting card.\n",
-+ tw_dev->host->host_no, TW_DRIVER, 0x6,
-+ cmd);
-+ retval = -EIO;
-+ twl_reset_device_extension(tw_dev, 1);
-+ goto out3;
-+ }
-+
-+ /* Now copy in the command packet response */
-+ memcpy(&(tw_ioctl->firmware_command), tw_dev->command_packet_virt[request_id], sizeof(TW_Command_Full));
-+
-+ /* Now complete the io */
-+ spin_lock_irqsave(tw_dev->host->host_lock, flags);
-+ tw_dev->posted_request_count--;
-+ tw_dev->state[request_id] = TW_S_COMPLETED;
-+ twl_free_request_id(tw_dev, request_id);
-+ spin_unlock_irqrestore(tw_dev->host->host_lock, flags);
-+ break;
-+ default:
-+ retval = -ENOTTY;
-+ goto out3;
-+ }
-+
-+ /* Now copy the entire response to userspace */
-+ if (copy_to_user(argp, tw_ioctl, sizeof(TW_Ioctl_Buf_Apache) + driver_command.buffer_length - 1) == 0)
-+ retval = 0;
-+out3:
-+ /* Now free ioctl buf memory */
-+ dma_free_coherent(&tw_dev->tw_pci_dev->dev, data_buffer_length_adjusted+sizeof(TW_Ioctl_Buf_Apache) - 1, cpu_addr, dma_handle);
-+out2:
-+ mutex_unlock(&tw_dev->ioctl_lock);
-+out:
-+ return retval;
-+} /* End twl_chrdev_ioctl() */
-+
-+/* This function handles open for the character device */
-+static int twl_chrdev_open(struct inode *inode, struct file *file)
-+{
-+ unsigned int minor_number;
-+ int retval = -ENODEV;
-+
-+ if (!capable(CAP_SYS_ADMIN)) {
-+ retval = -EACCES;
-+ goto out;
-+ }
-+
-+ cycle_kernel_lock();
-+ minor_number = iminor(inode);
-+ if (minor_number >= twl_device_extension_count)
-+ goto out;
-+ retval = 0;
-+out:
-+ return retval;
-+} /* End twl_chrdev_open() */
-+
-+/* File operations struct for character device */
-+static const struct file_operations twl_fops = {
-+ .owner = THIS_MODULE,
-+ .ioctl = twl_chrdev_ioctl,
-+ .open = twl_chrdev_open,
-+ .release = NULL
-+};
-+
-+/* This function passes sense data from firmware to scsi layer */
-+static int twl_fill_sense(TW_Device_Extension *tw_dev, int i, int request_id, int copy_sense, int print_host)
-+{
-+ TW_Command_Apache_Header *header;
-+ TW_Command_Full *full_command_packet;
-+ unsigned short error;
-+ char *error_str;
-+ int retval = 1;
-+
-+ header = tw_dev->sense_buffer_virt[i];
-+ full_command_packet = tw_dev->command_packet_virt[request_id];
-+
-+ /* Get embedded firmware error string */
-+ error_str = &(header->err_specific_desc[strlen(header->err_specific_desc) + 1]);
-+
-+ /* Don't print error for Logical unit not supported during rollcall */
-+ error = le16_to_cpu(header->status_block.error);
-+ if ((error != TW_ERROR_LOGICAL_UNIT_NOT_SUPPORTED) && (error != TW_ERROR_UNIT_OFFLINE) && (error != TW_ERROR_INVALID_FIELD_IN_CDB)) {
-+ if (print_host)
-+ printk(KERN_WARNING "3w-sas: scsi%d: ERROR: (0x%02X:0x%04X): %s:%s.\n",
-+ tw_dev->host->host_no,
-+ TW_MESSAGE_SOURCE_CONTROLLER_ERROR,
-+ header->status_block.error,
-+ error_str,
-+ header->err_specific_desc);
-+ else
-+ printk(KERN_WARNING "3w-sas: ERROR: (0x%02X:0x%04X): %s:%s.\n",
-+ TW_MESSAGE_SOURCE_CONTROLLER_ERROR,
-+ header->status_block.error,
-+ error_str,
-+ header->err_specific_desc);
-+ }
-+
-+ if (copy_sense) {
-+ memcpy(tw_dev->srb[request_id]->sense_buffer, header->sense_data, TW_SENSE_DATA_LENGTH);
-+ tw_dev->srb[request_id]->result = (full_command_packet->command.newcommand.status << 1);
-+ goto out;
-+ }
-+out:
-+ return retval;
-+} /* End twl_fill_sense() */
-+
-+/* This function will free up device extension resources */
-+static void twl_free_device_extension(TW_Device_Extension *tw_dev)
-+{
-+ if (tw_dev->command_packet_virt[0])
-+ pci_free_consistent(tw_dev->tw_pci_dev,
-+ sizeof(TW_Command_Full)*TW_Q_LENGTH,
-+ tw_dev->command_packet_virt[0],
-+ tw_dev->command_packet_phys[0]);
-+
-+ if (tw_dev->generic_buffer_virt[0])
-+ pci_free_consistent(tw_dev->tw_pci_dev,
-+ TW_SECTOR_SIZE*TW_Q_LENGTH,
-+ tw_dev->generic_buffer_virt[0],
-+ tw_dev->generic_buffer_phys[0]);
-+
-+ if (tw_dev->sense_buffer_virt[0])
-+ pci_free_consistent(tw_dev->tw_pci_dev,
-+ sizeof(TW_Command_Apache_Header)*
-+ TW_Q_LENGTH,
-+ tw_dev->sense_buffer_virt[0],
-+ tw_dev->sense_buffer_phys[0]);
-+
-+ kfree(tw_dev->event_queue[0]);
-+} /* End twl_free_device_extension() */
-+
-+/* This function will get parameter table entries from the firmware */
-+static void *twl_get_param(TW_Device_Extension *tw_dev, int request_id, int table_id, int parameter_id, int parameter_size_bytes)
-+{
-+ TW_Command_Full *full_command_packet;
-+ TW_Command *command_packet;
-+ TW_Param_Apache *param;
-+ void *retval = NULL;
-+
-+ /* Setup the command packet */
-+ full_command_packet = tw_dev->command_packet_virt[request_id];
-+ memset(full_command_packet, 0, sizeof(TW_Command_Full));
-+ command_packet = &full_command_packet->command.oldcommand;
-+
-+ command_packet->opcode__sgloffset = TW_OPSGL_IN(2, TW_OP_GET_PARAM);
-+ command_packet->size = TW_COMMAND_SIZE;
-+ command_packet->request_id = request_id;
-+ command_packet->byte6_offset.block_count = cpu_to_le16(1);
-+
-+ /* Now setup the param */
-+ param = (TW_Param_Apache *)tw_dev->generic_buffer_virt[request_id];
-+ memset(param, 0, TW_SECTOR_SIZE);
-+ param->table_id = cpu_to_le16(table_id | 0x8000);
-+ param->parameter_id = cpu_to_le16(parameter_id);
-+ param->parameter_size_bytes = cpu_to_le16(parameter_size_bytes);
-+
-+ command_packet->byte8_offset.param.sgl[0].address = TW_CPU_TO_SGL(tw_dev->generic_buffer_phys[request_id]);
-+ command_packet->byte8_offset.param.sgl[0].length = TW_CPU_TO_SGL(TW_SECTOR_SIZE);
-+
-+ /* Post the command packet to the board */
-+ twl_post_command_packet(tw_dev, request_id);
-+
-+ /* Poll for completion */
-+ if (twl_poll_response(tw_dev, request_id, 30))
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x7, "No valid response during get param")
-+ else
-+ retval = (void *)&(param->data[0]);
-+
-+ tw_dev->posted_request_count--;
-+ tw_dev->state[request_id] = TW_S_INITIAL;
-+
-+ return retval;
-+} /* End twl_get_param() */
-+
-+/* This function will send an initconnection command to controller */
-+static int twl_initconnection(TW_Device_Extension *tw_dev, int message_credits,
-+ u32 set_features, unsigned short current_fw_srl,
-+ unsigned short current_fw_arch_id,
-+ unsigned short current_fw_branch,
-+ unsigned short current_fw_build,
-+ unsigned short *fw_on_ctlr_srl,
-+ unsigned short *fw_on_ctlr_arch_id,
-+ unsigned short *fw_on_ctlr_branch,
-+ unsigned short *fw_on_ctlr_build,
-+ u32 *init_connect_result)
-+{
-+ TW_Command_Full *full_command_packet;
-+ TW_Initconnect *tw_initconnect;
-+ int request_id = 0, retval = 1;
-+
-+ /* Initialize InitConnection command packet */
-+ full_command_packet = tw_dev->command_packet_virt[request_id];
-+ memset(full_command_packet, 0, sizeof(TW_Command_Full));
-+ full_command_packet->header.header_desc.size_header = 128;
-+
-+ tw_initconnect = (TW_Initconnect *)&full_command_packet->command.oldcommand;
-+ tw_initconnect->opcode__reserved = TW_OPRES_IN(0, TW_OP_INIT_CONNECTION);
-+ tw_initconnect->request_id = request_id;
-+ tw_initconnect->message_credits = cpu_to_le16(message_credits);
-+ tw_initconnect->features = set_features;
-+
-+ /* Turn on 64-bit sgl support if we need to */
-+ tw_initconnect->features |= sizeof(dma_addr_t) > 4 ? 1 : 0;
-+
-+ tw_initconnect->features = cpu_to_le32(tw_initconnect->features);
-+
-+ if (set_features & TW_EXTENDED_INIT_CONNECT) {
-+ tw_initconnect->size = TW_INIT_COMMAND_PACKET_SIZE_EXTENDED;
-+ tw_initconnect->fw_srl = cpu_to_le16(current_fw_srl);
-+ tw_initconnect->fw_arch_id = cpu_to_le16(current_fw_arch_id);
-+ tw_initconnect->fw_branch = cpu_to_le16(current_fw_branch);
-+ tw_initconnect->fw_build = cpu_to_le16(current_fw_build);
-+ } else
-+ tw_initconnect->size = TW_INIT_COMMAND_PACKET_SIZE;
-+
-+ /* Send command packet to the board */
-+ twl_post_command_packet(tw_dev, request_id);
-+
-+ /* Poll for completion */
-+ if (twl_poll_response(tw_dev, request_id, 30)) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x8, "No valid response during init connection");
-+ } else {
-+ if (set_features & TW_EXTENDED_INIT_CONNECT) {
-+ *fw_on_ctlr_srl = le16_to_cpu(tw_initconnect->fw_srl);
-+ *fw_on_ctlr_arch_id = le16_to_cpu(tw_initconnect->fw_arch_id);
-+ *fw_on_ctlr_branch = le16_to_cpu(tw_initconnect->fw_branch);
-+ *fw_on_ctlr_build = le16_to_cpu(tw_initconnect->fw_build);
-+ *init_connect_result = le32_to_cpu(tw_initconnect->result);
-+ }
-+ retval = 0;
-+ }
-+
-+ tw_dev->posted_request_count--;
-+ tw_dev->state[request_id] = TW_S_INITIAL;
-+
-+ return retval;
-+} /* End twl_initconnection() */
-+
-+/* This function will initialize the fields of a device extension */
-+static int twl_initialize_device_extension(TW_Device_Extension *tw_dev)
-+{
-+ int i, retval = 1;
-+
-+ /* Initialize command packet buffers */
-+ if (twl_allocate_memory(tw_dev, sizeof(TW_Command_Full), 0)) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x9, "Command packet memory allocation failed");
-+ goto out;
-+ }
-+
-+ /* Initialize generic buffer */
-+ if (twl_allocate_memory(tw_dev, TW_SECTOR_SIZE, 1)) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0xa, "Generic memory allocation failed");
-+ goto out;
-+ }
-+
-+ /* Allocate sense buffers */
-+ if (twl_allocate_memory(tw_dev, sizeof(TW_Command_Apache_Header), 2)) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0xb, "Sense buffer allocation failed");
-+ goto out;
-+ }
-+
-+ /* Allocate event info space */
-+ tw_dev->event_queue[0] = kcalloc(TW_Q_LENGTH, sizeof(TW_Event), GFP_KERNEL);
-+ if (!tw_dev->event_queue[0]) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0xc, "Event info memory allocation failed");
-+ goto out;
-+ }
-+
-+ for (i = 0; i < TW_Q_LENGTH; i++) {
-+ tw_dev->event_queue[i] = (TW_Event *)((unsigned char *)tw_dev->event_queue[0] + (i * sizeof(TW_Event)));
-+ tw_dev->free_queue[i] = i;
-+ tw_dev->state[i] = TW_S_INITIAL;
-+ }
-+
-+ tw_dev->free_head = TW_Q_START;
-+ tw_dev->free_tail = TW_Q_START;
-+ tw_dev->error_sequence_id = 1;
-+ tw_dev->chrdev_request_id = TW_IOCTL_CHRDEV_FREE;
-+
-+ mutex_init(&tw_dev->ioctl_lock);
-+ init_waitqueue_head(&tw_dev->ioctl_wqueue);
-+
-+ retval = 0;
-+out:
-+ return retval;
-+} /* End twl_initialize_device_extension() */
-+
-+/* This function will perform a pci-dma unmap */
-+static void twl_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id)
-+{
-+ struct scsi_cmnd *cmd = tw_dev->srb[request_id];
-+
-+ if (cmd->SCp.phase == TW_PHASE_SGLIST)
-+ scsi_dma_unmap(cmd);
-+} /* End twl_unmap_scsi_data() */
-+
-+/* This function will handle attention interrupts */
-+static int twl_handle_attention_interrupt(TW_Device_Extension *tw_dev)
-+{
-+ int retval = 1;
-+ u32 request_id, doorbell;
-+
-+ /* Read doorbell status */
-+ doorbell = readl(TWL_HOBDB_REG_ADDR(tw_dev));
-+
-+ /* Check for controller errors */
-+ if (doorbell & TWL_DOORBELL_CONTROLLER_ERROR) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0xd, "Microcontroller Error: clearing");
-+ goto out;
-+ }
-+
-+ /* Check if we need to perform an AEN drain */
-+ if (doorbell & TWL_DOORBELL_ATTENTION_INTERRUPT) {
-+ if (!(test_and_set_bit(TW_IN_ATTENTION_LOOP, &tw_dev->flags))) {
-+ twl_get_request_id(tw_dev, &request_id);
-+ if (twl_aen_read_queue(tw_dev, request_id)) {
-+ tw_dev->state[request_id] = TW_S_COMPLETED;
-+ twl_free_request_id(tw_dev, request_id);
-+ clear_bit(TW_IN_ATTENTION_LOOP, &tw_dev->flags);
-+ }
-+ }
-+ }
-+
-+ retval = 0;
-+out:
-+ /* Clear doorbell interrupt */
-+ TWL_CLEAR_DB_INTERRUPT(tw_dev);
-+
-+ /* Make sure the clear was flushed by reading it back */
-+ readl(TWL_HOBDBC_REG_ADDR(tw_dev));
-+
-+ return retval;
-+} /* End twl_handle_attention_interrupt() */
-+
-+/* Interrupt service routine */
-+static irqreturn_t twl_interrupt(int irq, void *dev_instance)
-+{
-+ TW_Device_Extension *tw_dev = (TW_Device_Extension *)dev_instance;
-+ int i, handled = 0, error = 0;
-+ dma_addr_t mfa = 0;
-+ u32 reg, regl, regh, response, request_id = 0;
-+ struct scsi_cmnd *cmd;
-+ TW_Command_Full *full_command_packet;
-+
-+ spin_lock(tw_dev->host->host_lock);
-+
-+ /* Read host interrupt status */
-+ reg = readl(TWL_HISTAT_REG_ADDR(tw_dev));
-+
-+ /* Check if this is our interrupt, otherwise bail */
-+ if (!(reg & TWL_HISTATUS_VALID_INTERRUPT))
-+ goto twl_interrupt_bail;
-+
-+ handled = 1;
-+
-+ /* If we are resetting, bail */
-+ if (test_bit(TW_IN_RESET, &tw_dev->flags))
-+ goto twl_interrupt_bail;
-+
-+ /* Attention interrupt */
-+ if (reg & TWL_HISTATUS_ATTENTION_INTERRUPT) {
-+ if (twl_handle_attention_interrupt(tw_dev)) {
-+ TWL_MASK_INTERRUPTS(tw_dev);
-+ goto twl_interrupt_bail;
-+ }
-+ }
-+
-+ /* Response interrupt */
-+ while (reg & TWL_HISTATUS_RESPONSE_INTERRUPT) {
-+ if (sizeof(dma_addr_t) > 4) {
-+ regh = readl(TWL_HOBQPH_REG_ADDR(tw_dev));
-+ regl = readl(TWL_HOBQPL_REG_ADDR(tw_dev));
-+ mfa = ((u64)regh << 32) | regl;
-+ } else
-+ mfa = readl(TWL_HOBQPL_REG_ADDR(tw_dev));
-+
-+ error = 0;
-+ response = (u32)mfa;
-+
-+ /* Check for command packet error */
-+ if (!TW_NOTMFA_OUT(response)) {
-+ for (i=0;i<TW_Q_LENGTH;i++) {
-+ if (tw_dev->sense_buffer_phys[i] == mfa) {
-+ request_id = le16_to_cpu(tw_dev->sense_buffer_virt[i]->header_desc.request_id);
-+ if (tw_dev->srb[request_id] != NULL)
-+ error = twl_fill_sense(tw_dev, i, request_id, 1, 1);
-+ else {
-+ /* Skip ioctl error prints */
-+ if (request_id != tw_dev->chrdev_request_id)
-+ error = twl_fill_sense(tw_dev, i, request_id, 0, 1);
-+ else
-+ memcpy(tw_dev->command_packet_virt[request_id], tw_dev->sense_buffer_virt[i], sizeof(TW_Command_Apache_Header));
-+ }
-+
-+ /* Now re-post the sense buffer */
-+ writel((u32)((u64)tw_dev->sense_buffer_phys[i] >> 32), TWL_HOBQPH_REG_ADDR(tw_dev));
-+ writel((u32)tw_dev->sense_buffer_phys[i], TWL_HOBQPL_REG_ADDR(tw_dev));
-+ break;
-+ }
-+ }
-+ } else
-+ request_id = TW_RESID_OUT(response);
-+
-+ full_command_packet = tw_dev->command_packet_virt[request_id];
-+
-+ /* Check for correct state */
-+ if (tw_dev->state[request_id] != TW_S_POSTED) {
-+ if (tw_dev->srb[request_id] != NULL) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0xe, "Received a request id that wasn't posted");
-+ TWL_MASK_INTERRUPTS(tw_dev);
-+ goto twl_interrupt_bail;
-+ }
-+ }
-+
-+ /* Check for internal command completion */
-+ if (tw_dev->srb[request_id] == NULL) {
-+ if (request_id != tw_dev->chrdev_request_id) {
-+ if (twl_aen_complete(tw_dev, request_id))
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0xf, "Error completing AEN during attention interrupt");
-+ } else {
-+ tw_dev->chrdev_request_id = TW_IOCTL_CHRDEV_FREE;
-+ wake_up(&tw_dev->ioctl_wqueue);
-+ }
-+ } else {
-+ cmd = tw_dev->srb[request_id];
-+
-+ if (!error)
-+ cmd->result = (DID_OK << 16);
-+
-+ /* Report residual bytes for single sgl */
-+ if ((scsi_sg_count(cmd) <= 1) && (full_command_packet->command.newcommand.status == 0)) {
-+ if (full_command_packet->command.newcommand.sg_list[0].length < scsi_bufflen(tw_dev->srb[request_id]))
-+ scsi_set_resid(cmd, scsi_bufflen(cmd) - full_command_packet->command.newcommand.sg_list[0].length);
-+ }
-+
-+ /* Now complete the io */
-+ tw_dev->state[request_id] = TW_S_COMPLETED;
-+ twl_free_request_id(tw_dev, request_id);
-+ tw_dev->posted_request_count--;
-+ tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
-+ twl_unmap_scsi_data(tw_dev, request_id);
-+ }
-+
-+ /* Check for another response interrupt */
-+ reg = readl(TWL_HISTAT_REG_ADDR(tw_dev));
-+ }
-+
-+twl_interrupt_bail:
-+ spin_unlock(tw_dev->host->host_lock);
-+ return IRQ_RETVAL(handled);
-+} /* End twl_interrupt() */
-+
-+/* This function will poll for a register change */
-+static int twl_poll_register(TW_Device_Extension *tw_dev, void *reg, u32 value, u32 result, int seconds)
-+{
-+ unsigned long before;
-+ int retval = 1;
-+ u32 reg_value;
-+
-+ reg_value = readl(reg);
-+ before = jiffies;
-+
-+ while ((reg_value & value) != result) {
-+ reg_value = readl(reg);
-+ if (time_after(jiffies, before + HZ * seconds))
-+ goto out;
-+ msleep(50);
-+ }
-+ retval = 0;
-+out:
-+ return retval;
-+} /* End twl_poll_register() */
-+
-+/* This function will reset a controller */
-+static int twl_reset_sequence(TW_Device_Extension *tw_dev, int soft_reset)
-+{
-+ int retval = 1;
-+ int i = 0;
-+ u32 status = 0;
-+ unsigned short fw_on_ctlr_srl = 0, fw_on_ctlr_arch_id = 0;
-+ unsigned short fw_on_ctlr_branch = 0, fw_on_ctlr_build = 0;
-+ u32 init_connect_result = 0;
-+ int tries = 0;
-+ int do_soft_reset = soft_reset;
-+
-+ while (tries < TW_MAX_RESET_TRIES) {
-+ /* Do a soft reset if one is needed */
-+ if (do_soft_reset) {
-+ TWL_SOFT_RESET(tw_dev);
-+
-+ /* Make sure controller is in a good state */
-+ if (twl_poll_register(tw_dev, TWL_SCRPD3_REG_ADDR(tw_dev), TWL_CONTROLLER_READY, 0x0, 30)) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x10, "Controller never went non-ready during reset sequence");
-+ tries++;
-+ continue;
-+ }
-+ if (twl_poll_register(tw_dev, TWL_SCRPD3_REG_ADDR(tw_dev), TWL_CONTROLLER_READY, TWL_CONTROLLER_READY, 60)) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x11, "Controller not ready during reset sequence");
-+ tries++;
-+ continue;
-+ }
-+ }
-+
-+ /* Initconnect */
-+ if (twl_initconnection(tw_dev, TW_INIT_MESSAGE_CREDITS,
-+ TW_EXTENDED_INIT_CONNECT, TW_CURRENT_DRIVER_SRL,
-+ TW_9750_ARCH_ID, TW_CURRENT_DRIVER_BRANCH,
-+ TW_CURRENT_DRIVER_BUILD, &fw_on_ctlr_srl,
-+ &fw_on_ctlr_arch_id, &fw_on_ctlr_branch,
-+ &fw_on_ctlr_build, &init_connect_result)) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x12, "Initconnection failed while checking SRL");
-+ do_soft_reset = 1;
-+ tries++;
-+ continue;
-+ }
-+
-+ /* Load sense buffers */
-+ while (i < TW_Q_LENGTH) {
-+ writel((u32)((u64)tw_dev->sense_buffer_phys[i] >> 32), TWL_HOBQPH_REG_ADDR(tw_dev));
-+ writel((u32)tw_dev->sense_buffer_phys[i], TWL_HOBQPL_REG_ADDR(tw_dev));
-+
-+ /* Check status for over-run after each write */
-+ status = readl(TWL_STATUS_REG_ADDR(tw_dev));
-+ if (!(status & TWL_STATUS_OVERRUN_SUBMIT))
-+ i++;
-+ }
-+
-+ /* Now check status */
-+ status = readl(TWL_STATUS_REG_ADDR(tw_dev));
-+ if (status) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x13, "Bad controller status after loading sense buffers");
-+ do_soft_reset = 1;
-+ tries++;
-+ continue;
-+ }
-+
-+ /* Drain the AEN queue */
-+ if (twl_aen_drain_queue(tw_dev, soft_reset)) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x14, "AEN drain failed during reset sequence");
-+ do_soft_reset = 1;
-+ tries++;
-+ continue;
-+ }
-+
-+ /* Load rest of compatibility struct */
-+ strncpy(tw_dev->tw_compat_info.driver_version, TW_DRIVER_VERSION, strlen(TW_DRIVER_VERSION));
-+ tw_dev->tw_compat_info.driver_srl_high = TW_CURRENT_DRIVER_SRL;
-+ tw_dev->tw_compat_info.driver_branch_high = TW_CURRENT_DRIVER_BRANCH;
-+ tw_dev->tw_compat_info.driver_build_high = TW_CURRENT_DRIVER_BUILD;
-+ tw_dev->tw_compat_info.driver_srl_low = TW_BASE_FW_SRL;
-+ tw_dev->tw_compat_info.driver_branch_low = TW_BASE_FW_BRANCH;
-+ tw_dev->tw_compat_info.driver_build_low = TW_BASE_FW_BUILD;
-+ tw_dev->tw_compat_info.fw_on_ctlr_srl = fw_on_ctlr_srl;
-+ tw_dev->tw_compat_info.fw_on_ctlr_branch = fw_on_ctlr_branch;
-+ tw_dev->tw_compat_info.fw_on_ctlr_build = fw_on_ctlr_build;
-+
-+ /* If we got here, controller is in a good state */
-+ retval = 0;
-+ goto out;
-+ }
-+out:
-+ return retval;
-+} /* End twl_reset_sequence() */
-+
-+/* This function will reset a device extension */
-+static int twl_reset_device_extension(TW_Device_Extension *tw_dev, int ioctl_reset)
-+{
-+ int i = 0, retval = 1;
-+ unsigned long flags = 0;
-+
-+ /* Block SCSI requests while we are resetting */
-+ if (ioctl_reset)
-+ scsi_block_requests(tw_dev->host);
-+
-+ set_bit(TW_IN_RESET, &tw_dev->flags);
-+ TWL_MASK_INTERRUPTS(tw_dev);
-+ TWL_CLEAR_DB_INTERRUPT(tw_dev);
-+
-+ spin_lock_irqsave(tw_dev->host->host_lock, flags);
-+
-+ /* Abort all requests that are in progress */
-+ for (i = 0; i < TW_Q_LENGTH; i++) {
-+ if ((tw_dev->state[i] != TW_S_FINISHED) &&
-+ (tw_dev->state[i] != TW_S_INITIAL) &&
-+ (tw_dev->state[i] != TW_S_COMPLETED)) {
-+ if (tw_dev->srb[i]) {
-+ tw_dev->srb[i]->result = (DID_RESET << 16);
-+ tw_dev->srb[i]->scsi_done(tw_dev->srb[i]);
-+ twl_unmap_scsi_data(tw_dev, i);
-+ }
-+ }
-+ }
-+
-+ /* Reset queues and counts */
-+ for (i = 0; i < TW_Q_LENGTH; i++) {
-+ tw_dev->free_queue[i] = i;
-+ tw_dev->state[i] = TW_S_INITIAL;
-+ }
-+ tw_dev->free_head = TW_Q_START;
-+ tw_dev->free_tail = TW_Q_START;
-+ tw_dev->posted_request_count = 0;
-+
-+ spin_unlock_irqrestore(tw_dev->host->host_lock, flags);
-+
-+ if (twl_reset_sequence(tw_dev, 1))
-+ goto out;
-+
-+ TWL_UNMASK_INTERRUPTS(tw_dev);
-+
-+ clear_bit(TW_IN_RESET, &tw_dev->flags);
-+ tw_dev->chrdev_request_id = TW_IOCTL_CHRDEV_FREE;
-+
-+ retval = 0;
-+out:
-+ if (ioctl_reset)
-+ scsi_unblock_requests(tw_dev->host);
-+ return retval;
-+} /* End twl_reset_device_extension() */
-+
-+/* This funciton returns unit geometry in cylinders/heads/sectors */
-+static int twl_scsi_biosparam(struct scsi_device *sdev, struct block_device *bdev, sector_t capacity, int geom[])
-+{
-+ int heads, sectors, cylinders;
-+ TW_Device_Extension *tw_dev;
-+
-+ tw_dev = (TW_Device_Extension *)sdev->host->hostdata;
-+
-+ if (capacity >= 0x200000) {
-+ heads = 255;
-+ sectors = 63;
-+ cylinders = sector_div(capacity, heads * sectors);
-+ } else {
-+ heads = 64;
-+ sectors = 32;
-+ cylinders = sector_div(capacity, heads * sectors);
-+ }
-+
-+ geom[0] = heads;
-+ geom[1] = sectors;
-+ geom[2] = cylinders;
-+
-+ return 0;
-+} /* End twl_scsi_biosparam() */
-+
-+/* This is the new scsi eh reset function */
-+static int twl_scsi_eh_reset(struct scsi_cmnd *SCpnt)
-+{
-+ TW_Device_Extension *tw_dev = NULL;
-+ int retval = FAILED;
-+
-+ tw_dev = (TW_Device_Extension *)SCpnt->device->host->hostdata;
-+
-+ tw_dev->num_resets++;
-+
-+ sdev_printk(KERN_WARNING, SCpnt->device,
-+ "WARNING: (0x%02X:0x%04X): Command (0x%x) timed out, resetting card.\n",
-+ TW_DRIVER, 0x2c, SCpnt->cmnd[0]);
-+
-+ /* Make sure we are not issuing an ioctl or resetting from ioctl */
-+ mutex_lock(&tw_dev->ioctl_lock);
-+
-+ /* Now reset the card and some of the device extension data */
-+ if (twl_reset_device_extension(tw_dev, 0)) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x15, "Controller reset failed during scsi host reset");
-+ goto out;
-+ }
-+
-+ retval = SUCCESS;
-+out:
-+ mutex_unlock(&tw_dev->ioctl_lock);
-+ return retval;
-+} /* End twl_scsi_eh_reset() */
-+
-+/* This is the main scsi queue function to handle scsi opcodes */
-+static int twl_scsi_queue(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_cmnd *))
-+{
-+ int request_id, retval;
-+ TW_Device_Extension *tw_dev = (TW_Device_Extension *)SCpnt->device->host->hostdata;
-+
-+ /* If we are resetting due to timed out ioctl, report as busy */
-+ if (test_bit(TW_IN_RESET, &tw_dev->flags)) {
-+ retval = SCSI_MLQUEUE_HOST_BUSY;
-+ goto out;
-+ }
-+
-+ /* Save done function into scsi_cmnd struct */
-+ SCpnt->scsi_done = done;
-+
-+ /* Get a free request id */
-+ twl_get_request_id(tw_dev, &request_id);
-+
-+ /* Save the scsi command for use by the ISR */
-+ tw_dev->srb[request_id] = SCpnt;
-+
-+ /* Initialize phase to zero */
-+ SCpnt->SCp.phase = TW_PHASE_INITIAL;
-+
-+ retval = twl_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL);
-+ if (retval) {
-+ tw_dev->state[request_id] = TW_S_COMPLETED;
-+ twl_free_request_id(tw_dev, request_id);
-+ SCpnt->result = (DID_ERROR << 16);
-+ done(SCpnt);
-+ retval = 0;
-+ }
-+out:
-+ return retval;
-+} /* End twl_scsi_queue() */
-+
-+/* This function tells the controller to shut down */
-+static void __twl_shutdown(TW_Device_Extension *tw_dev)
-+{
-+ /* Disable interrupts */
-+ TWL_MASK_INTERRUPTS(tw_dev);
-+
-+ /* Free up the IRQ */
-+ free_irq(tw_dev->tw_pci_dev->irq, tw_dev);
-+
-+ printk(KERN_WARNING "3w-sas: Shutting down host %d.\n", tw_dev->host->host_no);
-+
-+ /* Tell the card we are shutting down */
-+ if (twl_initconnection(tw_dev, 1, 0, 0, 0, 0, 0, NULL, NULL, NULL, NULL, NULL)) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x16, "Connection shutdown failed");
-+ } else {
-+ printk(KERN_WARNING "3w-sas: Shutdown complete.\n");
-+ }
-+
-+ /* Clear doorbell interrupt just before exit */
-+ TWL_CLEAR_DB_INTERRUPT(tw_dev);
-+} /* End __twl_shutdown() */
-+
-+/* Wrapper for __twl_shutdown */
-+static void twl_shutdown(struct pci_dev *pdev)
-+{
-+ struct Scsi_Host *host = pci_get_drvdata(pdev);
-+ TW_Device_Extension *tw_dev;
-+
-+ if (!host)
-+ return;
-+
-+ tw_dev = (TW_Device_Extension *)host->hostdata;
-+
-+ if (tw_dev->online)
-+ __twl_shutdown(tw_dev);
-+} /* End twl_shutdown() */
-+
-+/* This function configures unit settings when a unit is coming on-line */
-+static int twl_slave_configure(struct scsi_device *sdev)
-+{
-+ /* Force 60 second timeout */
-+ blk_queue_rq_timeout(sdev->request_queue, 60 * HZ);
-+
-+ return 0;
-+} /* End twl_slave_configure() */
-+
-+/* scsi_host_template initializer */
-+static struct scsi_host_template driver_template = {
-+ .module = THIS_MODULE,
-+ .name = "3w-sas",
-+ .queuecommand = twl_scsi_queue,
-+ .eh_host_reset_handler = twl_scsi_eh_reset,
-+ .bios_param = twl_scsi_biosparam,
-+ .change_queue_depth = twl_change_queue_depth,
-+ .can_queue = TW_Q_LENGTH-2,
-+ .slave_configure = twl_slave_configure,
-+ .this_id = -1,
-+ .sg_tablesize = TW_LIBERATOR_MAX_SGL_LENGTH,
-+ .max_sectors = TW_MAX_SECTORS,
-+ .cmd_per_lun = TW_MAX_CMDS_PER_LUN,
-+ .use_clustering = ENABLE_CLUSTERING,
-+ .shost_attrs = twl_host_attrs,
-+ .emulated = 1
-+};
-+
-+/* This function will probe and initialize a card */
-+static int __devinit twl_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id)
-+{
-+ struct Scsi_Host *host = NULL;
-+ TW_Device_Extension *tw_dev;
-+ resource_size_t mem_addr, mem_len;
-+ int retval = -ENODEV;
-+ int *ptr_phycount, phycount=0;
-+
-+ retval = pci_enable_device(pdev);
-+ if (retval) {
-+ TW_PRINTK(host, TW_DRIVER, 0x17, "Failed to enable pci device");
-+ goto out_disable_device;
-+ }
-+
-+ pci_set_master(pdev);
-+ pci_try_set_mwi(pdev);
-+
-+ if (pci_set_dma_mask(pdev, DMA_BIT_MASK(64))
-+ || pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64)))
-+ if (pci_set_dma_mask(pdev, DMA_BIT_MASK(32))
-+ || pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32))) {
-+ TW_PRINTK(host, TW_DRIVER, 0x18, "Failed to set dma mask");
-+ retval = -ENODEV;
-+ goto out_disable_device;
-+ }
-+
-+ host = scsi_host_alloc(&driver_template, sizeof(TW_Device_Extension));
-+ if (!host) {
-+ TW_PRINTK(host, TW_DRIVER, 0x19, "Failed to allocate memory for device extension");
-+ retval = -ENOMEM;
-+ goto out_disable_device;
-+ }
-+ tw_dev = (TW_Device_Extension *)host->hostdata;
-+
-+ /* Save values to device extension */
-+ tw_dev->host = host;
-+ tw_dev->tw_pci_dev = pdev;
-+
-+ if (twl_initialize_device_extension(tw_dev)) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1a, "Failed to initialize device extension");
-+ goto out_free_device_extension;
-+ }
-+
-+ /* Request IO regions */
-+ retval = pci_request_regions(pdev, "3w-sas");
-+ if (retval) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1b, "Failed to get mem region");
-+ goto out_free_device_extension;
-+ }
-+
-+ /* Use region 1 */
-+ mem_addr = pci_resource_start(pdev, 1);
-+ mem_len = pci_resource_len(pdev, 1);
-+
-+ /* Save base address */
-+ tw_dev->base_addr = ioremap(mem_addr, mem_len);
-+
-+ if (!tw_dev->base_addr) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1c, "Failed to ioremap");
-+ goto out_release_mem_region;
-+ }
-+
-+ /* Disable interrupts on the card */
-+ TWL_MASK_INTERRUPTS(tw_dev);
-+
-+ /* Initialize the card */
-+ if (twl_reset_sequence(tw_dev, 0)) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1d, "Controller reset failed during probe");
-+ goto out_iounmap;
-+ }
-+
-+ /* Set host specific parameters */
-+ host->max_id = TW_MAX_UNITS;
-+ host->max_cmd_len = TW_MAX_CDB_LEN;
-+ host->max_lun = TW_MAX_LUNS;
-+ host->max_channel = 0;
-+
-+ /* Register the card with the kernel SCSI layer */
-+ retval = scsi_add_host(host, &pdev->dev);
-+ if (retval) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1e, "scsi add host failed");
-+ goto out_iounmap;
-+ }
-+
-+ pci_set_drvdata(pdev, host);
-+
-+ printk(KERN_WARNING "3w-sas: scsi%d: Found an LSI 3ware %s Controller at 0x%llx, IRQ: %d.\n",
-+ host->host_no,
-+ (char *)twl_get_param(tw_dev, 1, TW_VERSION_TABLE,
-+ TW_PARAM_MODEL, TW_PARAM_MODEL_LENGTH),
-+ (u64)mem_addr, pdev->irq);
-+
-+ ptr_phycount = twl_get_param(tw_dev, 2, TW_PARAM_PHY_SUMMARY_TABLE,
-+ TW_PARAM_PHYCOUNT, TW_PARAM_PHYCOUNT_LENGTH);
-+ if (ptr_phycount)
-+ phycount = le32_to_cpu(*(int *)ptr_phycount);
-+
-+ printk(KERN_WARNING "3w-sas: scsi%d: Firmware %s, BIOS %s, Phys: %d.\n",
-+ host->host_no,
-+ (char *)twl_get_param(tw_dev, 1, TW_VERSION_TABLE,
-+ TW_PARAM_FWVER, TW_PARAM_FWVER_LENGTH),
-+ (char *)twl_get_param(tw_dev, 2, TW_VERSION_TABLE,
-+ TW_PARAM_BIOSVER, TW_PARAM_BIOSVER_LENGTH),
-+ phycount);
-+
-+ /* Try to enable MSI */
-+ if (use_msi && !pci_enable_msi(pdev))
-+ set_bit(TW_USING_MSI, &tw_dev->flags);
-+
-+ /* Now setup the interrupt handler */
-+ retval = request_irq(pdev->irq, twl_interrupt, IRQF_SHARED, "3w-sas", tw_dev);
-+ if (retval) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1f, "Error requesting IRQ");
-+ goto out_remove_host;
-+ }
-+
-+ twl_device_extension_list[twl_device_extension_count] = tw_dev;
-+ twl_device_extension_count++;
-+
-+ /* Re-enable interrupts on the card */
-+ TWL_UNMASK_INTERRUPTS(tw_dev);
-+
-+ /* Finally, scan the host */
-+ scsi_scan_host(host);
-+
-+ /* Add sysfs binary files */
-+ if (sysfs_create_bin_file(&host->shost_dev.kobj, &twl_sysfs_aen_read_attr))
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x20, "Failed to create sysfs binary file: 3ware_aen_read");
-+ if (sysfs_create_bin_file(&host->shost_dev.kobj, &twl_sysfs_compat_info_attr))
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x21, "Failed to create sysfs binary file: 3ware_compat_info");
-+
-+ if (twl_major == -1) {
-+ if ((twl_major = register_chrdev (0, "twl", &twl_fops)) < 0)
-+ TW_PRINTK(host, TW_DRIVER, 0x22, "Failed to register character device");
-+ }
-+ tw_dev->online = 1;
-+ return 0;
-+
-+out_remove_host:
-+ if (test_bit(TW_USING_MSI, &tw_dev->flags))
-+ pci_disable_msi(pdev);
-+ scsi_remove_host(host);
-+out_iounmap:
-+ iounmap(tw_dev->base_addr);
-+out_release_mem_region:
-+ pci_release_regions(pdev);
-+out_free_device_extension:
-+ twl_free_device_extension(tw_dev);
-+ scsi_host_put(host);
-+out_disable_device:
-+ pci_disable_device(pdev);
-+
-+ return retval;
-+} /* End twl_probe() */
-+
-+/* This function is called to remove a device */
-+static void twl_remove(struct pci_dev *pdev)
-+{
-+ struct Scsi_Host *host = pci_get_drvdata(pdev);
-+ TW_Device_Extension *tw_dev;
-+
-+ if (!host)
-+ return;
-+
-+ tw_dev = (TW_Device_Extension *)host->hostdata;
-+
-+ if (!tw_dev->online)
-+ return;
-+
-+ /* Remove sysfs binary files */
-+ sysfs_remove_bin_file(&host->shost_dev.kobj, &twl_sysfs_aen_read_attr);
-+ sysfs_remove_bin_file(&host->shost_dev.kobj, &twl_sysfs_compat_info_attr);
-+
-+ scsi_remove_host(tw_dev->host);
-+
-+ /* Unregister character device */
-+ if (twl_major >= 0) {
-+ unregister_chrdev(twl_major, "twl");
-+ twl_major = -1;
-+ }
-+
-+ /* Shutdown the card */
-+ __twl_shutdown(tw_dev);
-+
-+ /* Disable MSI if enabled */
-+ if (test_bit(TW_USING_MSI, &tw_dev->flags))
-+ pci_disable_msi(pdev);
-+
-+ /* Free IO remapping */
-+ iounmap(tw_dev->base_addr);
-+
-+ /* Free up the mem region */
-+ pci_release_regions(pdev);
-+
-+ /* Free up device extension resources */
-+ twl_free_device_extension(tw_dev);
-+
-+ scsi_host_put(tw_dev->host);
-+ pci_disable_device(pdev);
-+ twl_device_extension_count--;
-+} /* End twl_remove() */
-+
-+#ifdef CONFIG_PM
-+/* This function is called on PCI suspend */
-+static int twl_suspend(struct pci_dev *pdev, pm_message_t state)
-+{
-+ struct Scsi_Host *host = pci_get_drvdata(pdev);
-+ TW_Device_Extension *tw_dev = (TW_Device_Extension *)host->hostdata;
-+
-+ printk(KERN_WARNING "3w-sas: Suspending host %d.\n", tw_dev->host->host_no);
-+ /* Disable interrupts */
-+ TWL_MASK_INTERRUPTS(tw_dev);
-+
-+ free_irq(tw_dev->tw_pci_dev->irq, tw_dev);
-+
-+ /* Tell the card we are shutting down */
-+ if (twl_initconnection(tw_dev, 1, 0, 0, 0, 0, 0, NULL, NULL, NULL, NULL, NULL)) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x23, "Connection shutdown failed during suspend");
-+ } else {
-+ printk(KERN_WARNING "3w-sas: Suspend complete.\n");
-+ }
-+
-+ /* Clear doorbell interrupt */
-+ TWL_CLEAR_DB_INTERRUPT(tw_dev);
-+
-+ pci_save_state(pdev);
-+ pci_disable_device(pdev);
-+ pci_set_power_state(pdev, pci_choose_state(pdev, state));
-+
-+ return 0;
-+} /* End twl_suspend() */
-+
-+/* This function is called on PCI resume */
-+static int twl_resume(struct pci_dev *pdev)
-+{
-+ int retval = 0;
-+ struct Scsi_Host *host = pci_get_drvdata(pdev);
-+ TW_Device_Extension *tw_dev = (TW_Device_Extension *)host->hostdata;
-+
-+ printk(KERN_WARNING "3w-sas: Resuming host %d.\n", tw_dev->host->host_no);
-+ pci_set_power_state(pdev, PCI_D0);
-+ pci_enable_wake(pdev, PCI_D0, 0);
-+ pci_restore_state(pdev);
-+
-+ retval = pci_enable_device(pdev);
-+ if (retval) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x24, "Enable device failed during resume");
-+ return retval;
-+ }
-+
-+ pci_set_master(pdev);
-+ pci_try_set_mwi(pdev);
-+
-+ if (pci_set_dma_mask(pdev, DMA_BIT_MASK(64))
-+ || pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64)))
-+ if (pci_set_dma_mask(pdev, DMA_BIT_MASK(32))
-+ || pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32))) {
-+ TW_PRINTK(host, TW_DRIVER, 0x25, "Failed to set dma mask during resume");
-+ retval = -ENODEV;
-+ goto out_disable_device;
-+ }
-+
-+ /* Initialize the card */
-+ if (twl_reset_sequence(tw_dev, 0)) {
-+ retval = -ENODEV;
-+ goto out_disable_device;
-+ }
-+
-+ /* Now setup the interrupt handler */
-+ retval = request_irq(pdev->irq, twl_interrupt, IRQF_SHARED, "3w-sas", tw_dev);
-+ if (retval) {
-+ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x26, "Error requesting IRQ during resume");
-+ retval = -ENODEV;
-+ goto out_disable_device;
-+ }
-+
-+ /* Now enable MSI if enabled */
-+ if (test_bit(TW_USING_MSI, &tw_dev->flags))
-+ pci_enable_msi(pdev);
-+
-+ /* Re-enable interrupts on the card */
-+ TWL_UNMASK_INTERRUPTS(tw_dev);
-+
-+ printk(KERN_WARNING "3w-sas: Resume complete.\n");
-+ return 0;
-+
-+out_disable_device:
-+ scsi_remove_host(host);
-+ pci_disable_device(pdev);
-+
-+ return retval;
-+} /* End twl_resume() */
-+#endif
-+
-+/* PCI Devices supported by this driver */
-+static struct pci_device_id twl_pci_tbl[] __devinitdata = {
-+ { PCI_VENDOR_ID_3WARE, PCI_DEVICE_ID_3WARE_9750,
-+ PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
-+ { }
-+};
-+MODULE_DEVICE_TABLE(pci, twl_pci_tbl);
-+
-+/* pci_driver initializer */
-+static struct pci_driver twl_driver = {
-+ .name = "3w-sas",
-+ .id_table = twl_pci_tbl,
-+ .probe = twl_probe,
-+ .remove = twl_remove,
-+#ifdef CONFIG_PM
-+ .suspend = twl_suspend,
-+ .resume = twl_resume,
-+#endif
-+ .shutdown = twl_shutdown
-+};
-+
-+/* This function is called on driver initialization */
-+static int __init twl_init(void)
-+{
-+ printk(KERN_WARNING "LSI 3ware SAS/SATA-RAID Controller device driver for Linux v%s.\n", TW_DRIVER_VERSION);
-+
-+ return pci_register_driver(&twl_driver);
-+} /* End twl_init() */
-+
-+/* This function is called on driver exit */
-+static void __exit twl_exit(void)
-+{
-+ pci_unregister_driver(&twl_driver);
-+} /* End twl_exit() */
-+
-+module_init(twl_init);
-+module_exit(twl_exit);
-+
-diff --git a/drivers/scsi/3w-sas.h b/drivers/scsi/3w-sas.h
-new file mode 100644
-index 0000000..e620505
---- /dev/null
-+++ b/drivers/scsi/3w-sas.h
-@@ -0,0 +1,396 @@
-+/*
-+ 3w-sas.h -- LSI 3ware SAS/SATA-RAID Controller device driver for Linux.
-+
-+ Written By: Adam Radford <linuxraid@lsi.com>
-+
-+ Copyright (C) 2009 LSI Corporation.
-+
-+ This program is free software; you can redistribute it and/or modify
-+ it under the terms of the GNU General Public License as published by
-+ the Free Software Foundation; version 2 of the License.
-+
-+ This program is distributed in the hope that it will be useful,
-+ but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-+ GNU General Public License for more details.
-+
-+ NO WARRANTY
-+ THE PROGRAM IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OR
-+ CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED INCLUDING, WITHOUT
-+ LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE, NON-INFRINGEMENT,
-+ MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each Recipient is
-+ solely responsible for determining the appropriateness of using and
-+ distributing the Program and assumes all risks associated with its
-+ exercise of rights under this Agreement, including but not limited to
-+ the risks and costs of program errors, damage to or loss of data,
-+ programs or equipment, and unavailability or interruption of operations.
-+
-+ DISCLAIMER OF LIABILITY
-+ NEITHER RECIPIENT NOR ANY CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY
-+ DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-+ DAMAGES (INCLUDING WITHOUT LIMITATION LOST PROFITS), HOWEVER CAUSED AND
-+ ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
-+ TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
-+ USE OR DISTRIBUTION OF THE PROGRAM OR THE EXERCISE OF ANY RIGHTS GRANTED
-+ HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES
-+
-+ You should have received a copy of the GNU General Public License
-+ along with this program; if not, write to the Free Software
-+ Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
-+
-+ Bugs/Comments/Suggestions should be mailed to:
-+ linuxraid@lsi.com
-+
-+ For more information, goto:
-+ http://www.lsi.com
-+*/
-+
-+#ifndef _3W_SAS_H
-+#define _3W_SAS_H
-+
-+/* AEN severity table */
-+static char *twl_aen_severity_table[] =
-+{
-+ "None", "ERROR", "WARNING", "INFO", "DEBUG", (char*) 0
-+};
-+
-+/* Liberator register offsets */
-+#define TWL_STATUS 0x0 /* Status */
-+#define TWL_HIBDB 0x20 /* Inbound doorbell */
-+#define TWL_HISTAT 0x30 /* Host interrupt status */
-+#define TWL_HIMASK 0x34 /* Host interrupt mask */
-+#define TWL_HOBDB 0x9C /* Outbound doorbell */
-+#define TWL_HOBDBC 0xA0 /* Outbound doorbell clear */
-+#define TWL_SCRPD3 0xBC /* Scratchpad */
-+#define TWL_HIBQPL 0xC0 /* Host inbound Q low */
-+#define TWL_HIBQPH 0xC4 /* Host inbound Q high */
-+#define TWL_HOBQPL 0xC8 /* Host outbound Q low */
-+#define TWL_HOBQPH 0xCC /* Host outbound Q high */
-+#define TWL_HISTATUS_VALID_INTERRUPT 0xC
-+#define TWL_HISTATUS_ATTENTION_INTERRUPT 0x4
-+#define TWL_HISTATUS_RESPONSE_INTERRUPT 0x8
-+#define TWL_STATUS_OVERRUN_SUBMIT 0x2000
-+#define TWL_ISSUE_SOFT_RESET 0x100
-+#define TWL_CONTROLLER_READY 0x2000
-+#define TWL_DOORBELL_CONTROLLER_ERROR 0x200000
-+#define TWL_DOORBELL_ATTENTION_INTERRUPT 0x40000
-+#define TWL_PULL_MODE 0x1
-+
-+/* Command packet opcodes used by the driver */
-+#define TW_OP_INIT_CONNECTION 0x1
-+#define TW_OP_GET_PARAM 0x12
-+#define TW_OP_SET_PARAM 0x13
-+#define TW_OP_EXECUTE_SCSI 0x10
-+
-+/* Asynchronous Event Notification (AEN) codes used by the driver */
-+#define TW_AEN_QUEUE_EMPTY 0x0000
-+#define TW_AEN_SOFT_RESET 0x0001
-+#define TW_AEN_SYNC_TIME_WITH_HOST 0x031
-+#define TW_AEN_SEVERITY_ERROR 0x1
-+#define TW_AEN_SEVERITY_DEBUG 0x4
-+#define TW_AEN_NOT_RETRIEVED 0x1
-+
-+/* Command state defines */
-+#define TW_S_INITIAL 0x1 /* Initial state */
-+#define TW_S_STARTED 0x2 /* Id in use */
-+#define TW_S_POSTED 0x4 /* Posted to the controller */
-+#define TW_S_COMPLETED 0x8 /* Completed by isr */
-+#define TW_S_FINISHED 0x10 /* I/O completely done */
-+
-+/* Compatibility defines */
-+#define TW_9750_ARCH_ID 10
-+#define TW_CURRENT_DRIVER_SRL 40
-+#define TW_CURRENT_DRIVER_BUILD 0
-+#define TW_CURRENT_DRIVER_BRANCH 0
-+
-+/* Phase defines */
-+#define TW_PHASE_INITIAL 0
-+#define TW_PHASE_SGLIST 2
-+
-+/* Misc defines */
-+#define TW_SECTOR_SIZE 512
-+#define TW_MAX_UNITS 32
-+#define TW_INIT_MESSAGE_CREDITS 0x100
-+#define TW_INIT_COMMAND_PACKET_SIZE 0x3
-+#define TW_INIT_COMMAND_PACKET_SIZE_EXTENDED 0x6
-+#define TW_EXTENDED_INIT_CONNECT 0x2
-+#define TW_BASE_FW_SRL 24
-+#define TW_BASE_FW_BRANCH 0
-+#define TW_BASE_FW_BUILD 1
-+#define TW_Q_LENGTH 256
-+#define TW_Q_START 0
-+#define TW_MAX_SLOT 32
-+#define TW_MAX_RESET_TRIES 2
-+#define TW_MAX_CMDS_PER_LUN 254
-+#define TW_MAX_AEN_DRAIN 255
-+#define TW_IN_RESET 2
-+#define TW_USING_MSI 3
-+#define TW_IN_ATTENTION_LOOP 4
-+#define TW_MAX_SECTORS 256
-+#define TW_MAX_CDB_LEN 16
-+#define TW_IOCTL_CHRDEV_TIMEOUT 60 /* 60 seconds */
-+#define TW_IOCTL_CHRDEV_FREE -1
-+#define TW_COMMAND_OFFSET 128 /* 128 bytes */
-+#define TW_VERSION_TABLE 0x0402
-+#define TW_TIMEKEEP_TABLE 0x040A
-+#define TW_INFORMATION_TABLE 0x0403
-+#define TW_PARAM_FWVER 3
-+#define TW_PARAM_FWVER_LENGTH 16
-+#define TW_PARAM_BIOSVER 4
-+#define TW_PARAM_BIOSVER_LENGTH 16
-+#define TW_PARAM_MODEL 8
-+#define TW_PARAM_MODEL_LENGTH 16
-+#define TW_PARAM_PHY_SUMMARY_TABLE 1
-+#define TW_PARAM_PHYCOUNT 2
-+#define TW_PARAM_PHYCOUNT_LENGTH 1
-+#define TW_IOCTL_FIRMWARE_PASS_THROUGH 0x108 // Used by smartmontools
-+#define TW_ALLOCATION_LENGTH 128
-+#define TW_SENSE_DATA_LENGTH 18
-+#define TW_ERROR_LOGICAL_UNIT_NOT_SUPPORTED 0x10a
-+#define TW_ERROR_INVALID_FIELD_IN_CDB 0x10d
-+#define TW_ERROR_UNIT_OFFLINE 0x128
-+#define TW_MESSAGE_SOURCE_CONTROLLER_ERROR 3
-+#define TW_MESSAGE_SOURCE_CONTROLLER_EVENT 4
-+#define TW_DRIVER 6
-+#ifndef PCI_DEVICE_ID_3WARE_9750
-+#define PCI_DEVICE_ID_3WARE_9750 0x1010
-+#endif
-+
-+/* Bitmask macros to eliminate bitfields */
-+
-+/* opcode: 5, reserved: 3 */
-+#define TW_OPRES_IN(x,y) ((x << 5) | (y & 0x1f))
-+#define TW_OP_OUT(x) (x & 0x1f)
-+
-+/* opcode: 5, sgloffset: 3 */
-+#define TW_OPSGL_IN(x,y) ((x << 5) | (y & 0x1f))
-+#define TW_SGL_OUT(x) ((x >> 5) & 0x7)
-+
-+/* severity: 3, reserved: 5 */
-+#define TW_SEV_OUT(x) (x & 0x7)
-+
-+/* not_mfa: 1, reserved: 7, status: 8, request_id: 16 */
-+#define TW_RESID_OUT(x) ((x >> 16) & 0xffff)
-+#define TW_NOTMFA_OUT(x) (x & 0x1)
-+
-+/* request_id: 12, lun: 4 */
-+#define TW_REQ_LUN_IN(lun, request_id) (((lun << 12) & 0xf000) | (request_id & 0xfff))
-+#define TW_LUN_OUT(lun) ((lun >> 12) & 0xf)
-+
-+/* Register access macros */
-+#define TWL_STATUS_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_STATUS)
-+#define TWL_HOBQPL_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HOBQPL)
-+#define TWL_HOBQPH_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HOBQPH)
-+#define TWL_HOBDB_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HOBDB)
-+#define TWL_HOBDBC_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HOBDBC)
-+#define TWL_HIMASK_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HIMASK)
-+#define TWL_HISTAT_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HISTAT)
-+#define TWL_HIBQPH_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HIBQPH)
-+#define TWL_HIBQPL_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HIBQPL)
-+#define TWL_HIBDB_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HIBDB)
-+#define TWL_SCRPD3_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_SCRPD3)
-+#define TWL_MASK_INTERRUPTS(x) (writel(~0, TWL_HIMASK_REG_ADDR(tw_dev)))
-+#define TWL_UNMASK_INTERRUPTS(x) (writel(~TWL_HISTATUS_VALID_INTERRUPT, TWL_HIMASK_REG_ADDR(tw_dev)))
-+#define TWL_CLEAR_DB_INTERRUPT(x) (writel(~0, TWL_HOBDBC_REG_ADDR(tw_dev)))
-+#define TWL_SOFT_RESET(x) (writel(TWL_ISSUE_SOFT_RESET, TWL_HIBDB_REG_ADDR(tw_dev)))
-+
-+/* Macros */
-+#define TW_PRINTK(h,a,b,c) { \
-+if (h) \
-+printk(KERN_WARNING "3w-sas: scsi%d: ERROR: (0x%02X:0x%04X): %s.\n",h->host_no,a,b,c); \
-+else \
-+printk(KERN_WARNING "3w-sas: ERROR: (0x%02X:0x%04X): %s.\n",a,b,c); \
-+}
-+#define TW_MAX_LUNS 16
-+#define TW_COMMAND_SIZE (sizeof(dma_addr_t) > 4 ? 6 : 4)
-+#define TW_LIBERATOR_MAX_SGL_LENGTH (sizeof(dma_addr_t) > 4 ? 46 : 92)
-+#define TW_LIBERATOR_MAX_SGL_LENGTH_OLD (sizeof(dma_addr_t) > 4 ? 47 : 94)
-+#define TW_PADDING_LENGTH_LIBERATOR 136
-+#define TW_PADDING_LENGTH_LIBERATOR_OLD 132
-+#define TW_CPU_TO_SGL(x) (sizeof(dma_addr_t) > 4 ? cpu_to_le64(x) : cpu_to_le32(x))
-+
-+#pragma pack(1)
-+
-+/* SGL entry */
-+typedef struct TAG_TW_SG_Entry_ISO {
-+ dma_addr_t address;
-+ dma_addr_t length;
-+} TW_SG_Entry_ISO;
-+
-+/* Old Command Packet with ISO SGL */
-+typedef struct TW_Command {
-+ unsigned char opcode__sgloffset;
-+ unsigned char size;
-+ unsigned char request_id;
-+ unsigned char unit__hostid;
-+ /* Second DWORD */
-+ unsigned char status;
-+ unsigned char flags;
-+ union {
-+ unsigned short block_count;
-+ unsigned short parameter_count;
-+ } byte6_offset;
-+ union {
-+ struct {
-+ u32 lba;
-+ TW_SG_Entry_ISO sgl[TW_LIBERATOR_MAX_SGL_LENGTH_OLD];
-+ unsigned char padding[TW_PADDING_LENGTH_LIBERATOR_OLD];
-+ } io;
-+ struct {
-+ TW_SG_Entry_ISO sgl[TW_LIBERATOR_MAX_SGL_LENGTH_OLD];
-+ u32 padding;
-+ unsigned char padding2[TW_PADDING_LENGTH_LIBERATOR_OLD];
-+ } param;
-+ } byte8_offset;
-+} TW_Command;
-+
-+/* New Command Packet with ISO SGL */
-+typedef struct TAG_TW_Command_Apache {
-+ unsigned char opcode__reserved;
-+ unsigned char unit;
-+ unsigned short request_id__lunl;
-+ unsigned char status;
-+ unsigned char sgl_offset;
-+ unsigned short sgl_entries__lunh;
-+ unsigned char cdb[16];
-+ TW_SG_Entry_ISO sg_list[TW_LIBERATOR_MAX_SGL_LENGTH];
-+ unsigned char padding[TW_PADDING_LENGTH_LIBERATOR];
-+} TW_Command_Apache;
-+
-+/* New command packet header */
-+typedef struct TAG_TW_Command_Apache_Header {
-+ unsigned char sense_data[TW_SENSE_DATA_LENGTH];
-+ struct {
-+ char reserved[4];
-+ unsigned short error;
-+ unsigned char padding;
-+ unsigned char severity__reserved;
-+ } status_block;
-+ unsigned char err_specific_desc[98];
-+ struct {
-+ unsigned char size_header;
-+ unsigned short request_id;
-+ unsigned char size_sense;
-+ } header_desc;
-+} TW_Command_Apache_Header;
-+
-+/* This struct is a union of the 2 command packets */
-+typedef struct TAG_TW_Command_Full {
-+ TW_Command_Apache_Header header;
-+ union {
-+ TW_Command oldcommand;
-+ TW_Command_Apache newcommand;
-+ } command;
-+} TW_Command_Full;
-+
-+/* Initconnection structure */
-+typedef struct TAG_TW_Initconnect {
-+ unsigned char opcode__reserved;
-+ unsigned char size;
-+ unsigned char request_id;
-+ unsigned char res2;
-+ unsigned char status;
-+ unsigned char flags;
-+ unsigned short message_credits;
-+ u32 features;
-+ unsigned short fw_srl;
-+ unsigned short fw_arch_id;
-+ unsigned short fw_branch;
-+ unsigned short fw_build;
-+ u32 result;
-+} TW_Initconnect;
-+
-+/* Event info structure */
-+typedef struct TAG_TW_Event
-+{
-+ unsigned int sequence_id;
-+ unsigned int time_stamp_sec;
-+ unsigned short aen_code;
-+ unsigned char severity;
-+ unsigned char retrieved;
-+ unsigned char repeat_count;
-+ unsigned char parameter_len;
-+ unsigned char parameter_data[98];
-+} TW_Event;
-+
-+typedef struct TAG_TW_Ioctl_Driver_Command {
-+ unsigned int control_code;
-+ unsigned int status;
-+ unsigned int unique_id;
-+ unsigned int sequence_id;
-+ unsigned int os_specific;
-+ unsigned int buffer_length;
-+} TW_Ioctl_Driver_Command;
-+
-+typedef struct TAG_TW_Ioctl_Apache {
-+ TW_Ioctl_Driver_Command driver_command;
-+ char padding[488];
-+ TW_Command_Full firmware_command;
-+ char data_buffer[1];
-+} TW_Ioctl_Buf_Apache;
-+
-+/* GetParam descriptor */
-+typedef struct {
-+ unsigned short table_id;
-+ unsigned short parameter_id;
-+ unsigned short parameter_size_bytes;
-+ unsigned short actual_parameter_size_bytes;
-+ unsigned char data[1];
-+} TW_Param_Apache;
-+
-+/* Compatibility information structure */
-+typedef struct TAG_TW_Compatibility_Info
-+{
-+ char driver_version[32];
-+ unsigned short working_srl;
-+ unsigned short working_branch;
-+ unsigned short working_build;
-+ unsigned short driver_srl_high;
-+ unsigned short driver_branch_high;
-+ unsigned short driver_build_high;
-+ unsigned short driver_srl_low;
-+ unsigned short driver_branch_low;
-+ unsigned short driver_build_low;
-+ unsigned short fw_on_ctlr_srl;
-+ unsigned short fw_on_ctlr_branch;
-+ unsigned short fw_on_ctlr_build;
-+} TW_Compatibility_Info;
-+
-+#pragma pack()
-+
-+typedef struct TAG_TW_Device_Extension {
-+ void __iomem *base_addr;
-+ unsigned long *generic_buffer_virt[TW_Q_LENGTH];
-+ dma_addr_t generic_buffer_phys[TW_Q_LENGTH];
-+ TW_Command_Full *command_packet_virt[TW_Q_LENGTH];
-+ dma_addr_t command_packet_phys[TW_Q_LENGTH];
-+ TW_Command_Apache_Header *sense_buffer_virt[TW_Q_LENGTH];
-+ dma_addr_t sense_buffer_phys[TW_Q_LENGTH];
-+ struct pci_dev *tw_pci_dev;
-+ struct scsi_cmnd *srb[TW_Q_LENGTH];
-+ unsigned char free_queue[TW_Q_LENGTH];
-+ unsigned char free_head;
-+ unsigned char free_tail;
-+ int state[TW_Q_LENGTH];
-+ unsigned int posted_request_count;
-+ unsigned int max_posted_request_count;
-+ unsigned int max_sgl_entries;
-+ unsigned int sgl_entries;
-+ unsigned int num_resets;
-+ unsigned int sector_count;
-+ unsigned int max_sector_count;
-+ unsigned int aen_count;
-+ struct Scsi_Host *host;
-+ long flags;
-+ TW_Event *event_queue[TW_Q_LENGTH];
-+ unsigned char error_index;
-+ unsigned int error_sequence_id;
-+ int chrdev_request_id;
-+ wait_queue_head_t ioctl_wqueue;
-+ struct mutex ioctl_lock;
-+ TW_Compatibility_Info tw_compat_info;
-+ char online;
-+} TW_Device_Extension;
-+
-+#endif /* _3W_SAS_H */
-+
-diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c
-index 1ddcf40..a85f062 100644
---- a/drivers/scsi/BusLogic.c
-+++ b/drivers/scsi/BusLogic.c
-@@ -961,6 +961,8 @@ static int __init BusLogic_InitializeFlashPointProbeInfo(struct BusLogic_HostAda
- static void __init BusLogic_InitializeProbeInfoList(struct BusLogic_HostAdapter
- *PrototypeHostAdapter)
- {
-+ pax_track_stack();
-+
- /*
- If a PCI BIOS is present, interrogate it for MultiMaster and FlashPoint
- Host Adapters; otherwise, default to the standard ISA MultiMaster probe.
-diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
-index e11cca4..4295679 100644
---- a/drivers/scsi/Kconfig
-+++ b/drivers/scsi/Kconfig
-@@ -399,6 +399,17 @@ config SCSI_3W_9XXX
- Please read the comments at the top of
- <file:drivers/scsi/3w-9xxx.c>.
-
-+config SCSI_3W_SAS
-+ tristate "3ware 97xx SAS/SATA-RAID support"
-+ depends on PCI && SCSI
-+ help
-+ This driver supports the LSI 3ware 9750 6Gb/s SAS/SATA-RAID cards.
-+
-+ <http://www.lsi.com>
-+
-+ Please read the comments at the top of
-+ <file:drivers/scsi/3w-sas.c>.
-+
- config SCSI_7000FASST
- tristate "7000FASST SCSI support"
- depends on ISA && SCSI && ISA_DMA_API
-@@ -621,6 +632,14 @@ config SCSI_FLASHPOINT
- substantial, so users of MultiMaster Host Adapters may not
- wish to include it.
-
-+config VMWARE_PVSCSI
-+ tristate "VMware PVSCSI driver support"
-+ depends on PCI && SCSI && X86
-+ help
-+ This driver supports VMware's para virtualized SCSI HBA.
-+ To compile this driver as a module, choose M here: the
-+ module will be called vmw_pvscsi.
-+
- config LIBFC
- tristate "LibFC module"
- select SCSI_FC_ATTRS
-diff --git a/drivers/scsi/Makefile b/drivers/scsi/Makefile
-index 3ad61db..c938975 100644
---- a/drivers/scsi/Makefile
-+++ b/drivers/scsi/Makefile
-@@ -113,6 +113,7 @@ obj-$(CONFIG_SCSI_MESH) += mesh.o
- obj-$(CONFIG_SCSI_MAC53C94) += mac53c94.o
- obj-$(CONFIG_BLK_DEV_3W_XXXX_RAID) += 3w-xxxx.o
- obj-$(CONFIG_SCSI_3W_9XXX) += 3w-9xxx.o
-+obj-$(CONFIG_SCSI_3W_SAS) += 3w-sas.o
- obj-$(CONFIG_SCSI_PPA) += ppa.o
- obj-$(CONFIG_SCSI_IMM) += imm.o
- obj-$(CONFIG_JAZZ_ESP) += esp_scsi.o jazz_esp.o
-@@ -133,6 +134,7 @@ obj-$(CONFIG_SCSI_CXGB3_ISCSI) += libiscsi.o libiscsi_tcp.o cxgb3i/
- obj-$(CONFIG_SCSI_BNX2_ISCSI) += libiscsi.o bnx2i/
- obj-$(CONFIG_BE2ISCSI) += libiscsi.o be2iscsi/
- obj-$(CONFIG_SCSI_PMCRAID) += pmcraid.o
-+obj-$(CONFIG_VMWARE_PVSCSI) += vmw_pvscsi.o
-
- obj-$(CONFIG_ARM) += arm/
-
-diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c
-index a5b8e7b..a6a0e43 100644
---- a/drivers/scsi/aacraid/commctrl.c
-+++ b/drivers/scsi/aacraid/commctrl.c
-@@ -481,6 +481,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
- u32 actual_fibsize64, actual_fibsize = 0;
- int i;
-
-+ pax_track_stack();
-
- if (dev->in_reset) {
- dprintk((KERN_DEBUG"aacraid: send raw srb -EBUSY\n"));
-diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
-index 9b97c3e..f099725 100644
---- a/drivers/scsi/aacraid/linit.c
-+++ b/drivers/scsi/aacraid/linit.c
-@@ -91,7 +91,7 @@ static DECLARE_PCI_DEVICE_TABLE(aac_pci_tbl) = {
- #elif defined(__devinitconst)
- static const struct pci_device_id aac_pci_tbl[] __devinitconst = {
- #else
--static const struct pci_device_id aac_pci_tbl[] __devinitdata = {
-+static const struct pci_device_id aac_pci_tbl[] __devinitconst = {
- #endif
- { 0x1028, 0x0001, 0x1028, 0x0001, 0, 0, 0 }, /* PERC 2/Si (Iguana/PERC2Si) */
- { 0x1028, 0x0002, 0x1028, 0x0002, 0, 0, 1 }, /* PERC 3/Di (Opal/PERC3Di) */
-diff --git a/drivers/scsi/aic94xx/aic94xx_init.c b/drivers/scsi/aic94xx/aic94xx_init.c
-index 996f722..9127845 100644
---- a/drivers/scsi/aic94xx/aic94xx_init.c
-+++ b/drivers/scsi/aic94xx/aic94xx_init.c
-@@ -485,7 +485,7 @@ static ssize_t asd_show_update_bios(struct device *dev,
- flash_error_table[i].reason);
- }
-
--static DEVICE_ATTR(update_bios, S_IRUGO|S_IWUGO,
-+static DEVICE_ATTR(update_bios, S_IRUGO|S_IWUSR,
- asd_show_update_bios, asd_store_update_bios);
-
- static int asd_create_dev_attrs(struct asd_ha_struct *asd_ha)
-@@ -1011,7 +1011,7 @@ static struct sas_domain_function_template aic94xx_transport_functions = {
- .lldd_control_phy = asd_control_phy,
- };
-
--static const struct pci_device_id aic94xx_pci_table[] __devinitdata = {
-+static const struct pci_device_id aic94xx_pci_table[] __devinitconst = {
- {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, 0x410),0, 0, 1},
- {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, 0x412),0, 0, 1},
- {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, 0x416),0, 0, 1},
-diff --git a/drivers/scsi/bfa/bfa_ioc.h b/drivers/scsi/bfa/bfa_ioc.h
-index 58efd4b..cb48dc7 100644
---- a/drivers/scsi/bfa/bfa_ioc.h
-+++ b/drivers/scsi/bfa/bfa_ioc.h
-@@ -127,7 +127,7 @@ struct bfa_ioc_cbfn_s {
- bfa_ioc_disable_cbfn_t disable_cbfn;
- bfa_ioc_hbfail_cbfn_t hbfail_cbfn;
- bfa_ioc_reset_cbfn_t reset_cbfn;
--};
-+} __no_const;
-
- /**
- * Heartbeat failure notification queue element.
-diff --git a/drivers/scsi/bfa/bfa_iocfc.h b/drivers/scsi/bfa/bfa_iocfc.h
-index 7ad177e..5503586 100644
---- a/drivers/scsi/bfa/bfa_iocfc.h
-+++ b/drivers/scsi/bfa/bfa_iocfc.h
-@@ -61,7 +61,7 @@ struct bfa_hwif_s {
- void (*hw_isr_mode_set)(struct bfa_s *bfa, bfa_boolean_t msix);
- void (*hw_msix_getvecs)(struct bfa_s *bfa, u32 *vecmap,
- u32 *nvecs, u32 *maxvec);
--};
-+} __no_const;
- typedef void (*bfa_cb_iocfc_t) (void *cbarg, enum bfa_status status);
-
- struct bfa_iocfc_s {
-diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c
-index 4967643..cbec06b 100644
---- a/drivers/scsi/dpt_i2o.c
-+++ b/drivers/scsi/dpt_i2o.c
-@@ -1804,6 +1804,8 @@ static int adpt_i2o_passthru(adpt_hba* pHba, u32 __user *arg)
- dma_addr_t addr;
- ulong flags = 0;
-
-+ pax_track_stack();
-+
- memset(&msg, 0, MAX_MESSAGE_SIZE*4);
- // get user msg size in u32s
- if(get_user(size, &user_msg[0])){
-@@ -2297,6 +2299,8 @@ static s32 adpt_scsi_to_i2o(adpt_hba* pHba, struct scsi_cmnd* cmd, struct adpt_d
- s32 rcode;
- dma_addr_t addr;
-
-+ pax_track_stack();
-+
- memset(msg, 0 , sizeof(msg));
- len = scsi_bufflen(cmd);
- direction = 0x00000000;
-diff --git a/drivers/scsi/eata.c b/drivers/scsi/eata.c
-index c7076ce..e20c67c 100644
---- a/drivers/scsi/eata.c
-+++ b/drivers/scsi/eata.c
-@@ -1087,6 +1087,8 @@ static int port_detect(unsigned long port_base, unsigned int j,
- struct hostdata *ha;
- char name[16];
-
-+ pax_track_stack();
-+
- sprintf(name, "%s%d", driver_name, j);
-
- if (!request_region(port_base, REGION_SIZE, driver_name)) {
-diff --git a/drivers/scsi/fcoe/libfcoe.c b/drivers/scsi/fcoe/libfcoe.c
-index 11ae5c9..891daec 100644
---- a/drivers/scsi/fcoe/libfcoe.c
-+++ b/drivers/scsi/fcoe/libfcoe.c
-@@ -809,6 +809,8 @@ static void fcoe_ctlr_recv_els(struct fcoe_ctlr *fip, struct sk_buff *skb)
- size_t rlen;
- size_t dlen;
-
-+ pax_track_stack();
-+
- fiph = (struct fip_header *)skb->data;
- sub = fiph->fip_subcode;
- if (sub != FIP_SC_REQ && sub != FIP_SC_REP)
-diff --git a/drivers/scsi/fnic/fnic_main.c b/drivers/scsi/fnic/fnic_main.c
-index 71c7bbe..e93088a 100644
---- a/drivers/scsi/fnic/fnic_main.c
-+++ b/drivers/scsi/fnic/fnic_main.c
-@@ -669,7 +669,7 @@ static int __devinit fnic_probe(struct pci_dev *pdev,
- /* Start local port initiatialization */
-
- lp->link_up = 0;
-- lp->tt = fnic_transport_template;
-+ memcpy((void *)&lp->tt, &fnic_transport_template, sizeof(fnic_transport_template));
-
- lp->max_retry_count = fnic->config.flogi_retries;
- lp->max_rport_retry_count = fnic->config.plogi_retries;
-diff --git a/drivers/scsi/gdth.c b/drivers/scsi/gdth.c
-index bb96d74..9ec3ce4 100644
---- a/drivers/scsi/gdth.c
-+++ b/drivers/scsi/gdth.c
-@@ -4102,6 +4102,8 @@ static int ioc_lockdrv(void __user *arg)
- ulong flags;
- gdth_ha_str *ha;
-
-+ pax_track_stack();
-+
- if (copy_from_user(&ldrv, arg, sizeof(gdth_ioctl_lockdrv)))
- return -EFAULT;
- ha = gdth_find_ha(ldrv.ionode);
-@@ -4134,6 +4136,8 @@ static int ioc_resetdrv(void __user *arg, char *cmnd)
- gdth_ha_str *ha;
- int rval;
-
-+ pax_track_stack();
-+
- if (copy_from_user(&res, arg, sizeof(gdth_ioctl_reset)) ||
- res.number >= MAX_HDRIVES)
- return -EFAULT;
-@@ -4169,6 +4173,8 @@ static int ioc_general(void __user *arg, char *cmnd)
- gdth_ha_str *ha;
- int rval;
-
-+ pax_track_stack();
-+
- if (copy_from_user(&gen, arg, sizeof(gdth_ioctl_general)))
- return -EFAULT;
- ha = gdth_find_ha(gen.ionode);
-@@ -4625,6 +4631,9 @@ static void gdth_flush(gdth_ha_str *ha)
- int i;
- gdth_cmd_str gdtcmd;
- char cmnd[MAX_COMMAND_SIZE];
-+
-+ pax_track_stack();
-+
- memset(cmnd, 0xff, MAX_COMMAND_SIZE);
-
- TRACE2(("gdth_flush() hanum %d\n", ha->hanum));
-diff --git a/drivers/scsi/gdth_proc.c b/drivers/scsi/gdth_proc.c
-index 1258da3..20d8ae6 100644
---- a/drivers/scsi/gdth_proc.c
-+++ b/drivers/scsi/gdth_proc.c
-@@ -46,6 +46,9 @@ static int gdth_set_asc_info(struct Scsi_Host *host, char *buffer,
- ulong64 paddr;
-
- char cmnd[MAX_COMMAND_SIZE];
-+
-+ pax_track_stack();
-+
- memset(cmnd, 0xff, 12);
- memset(&gdtcmd, 0, sizeof(gdth_cmd_str));
-
-@@ -174,6 +177,8 @@ static int gdth_get_info(char *buffer,char **start,off_t offset,int length,
- gdth_hget_str *phg;
- char cmnd[MAX_COMMAND_SIZE];
-
-+ pax_track_stack();
-+
- gdtcmd = kmalloc(sizeof(*gdtcmd), GFP_KERNEL);
- estr = kmalloc(sizeof(*estr), GFP_KERNEL);
- if (!gdtcmd || !estr)
-diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
-index d03a926..f324286 100644
---- a/drivers/scsi/hosts.c
-+++ b/drivers/scsi/hosts.c
-@@ -40,7 +40,7 @@
- #include "scsi_logging.h"
-
-
--static atomic_t scsi_host_next_hn; /* host_no for next new host */
-+static atomic_unchecked_t scsi_host_next_hn; /* host_no for next new host */
-
-
- static void scsi_host_cls_release(struct device *dev)
-@@ -347,7 +347,7 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize)
- * subtract one because we increment first then return, but we need to
- * know what the next host number was before increment
- */
-- shost->host_no = atomic_inc_return(&scsi_host_next_hn) - 1;
-+ shost->host_no = atomic_inc_return_unchecked(&scsi_host_next_hn) - 1;
- shost->dma_channel = 0xff;
-
- /* These three are default values which can be overridden */
-diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
-index a601159..55e19d2 100644
---- a/drivers/scsi/ipr.c
-+++ b/drivers/scsi/ipr.c
-@@ -5286,7 +5286,7 @@ static bool ipr_qc_fill_rtf(struct ata_queued_cmd *qc)
- return true;
- }
-
--static struct ata_port_operations ipr_sata_ops = {
-+static const struct ata_port_operations ipr_sata_ops = {
- .phy_reset = ipr_ata_phy_reset,
- .hardreset = ipr_sata_reset,
- .post_internal_cmd = ipr_ata_post_internal,
-diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c
-index c1c1574..a9c9348 100644
---- a/drivers/scsi/libfc/fc_exch.c
-+++ b/drivers/scsi/libfc/fc_exch.c
-@@ -86,12 +86,12 @@ struct fc_exch_mgr {
- * all together if not used XXX
- */
- struct {
-- atomic_t no_free_exch;
-- atomic_t no_free_exch_xid;
-- atomic_t xid_not_found;
-- atomic_t xid_busy;
-- atomic_t seq_not_found;
-- atomic_t non_bls_resp;
-+ atomic_unchecked_t no_free_exch;
-+ atomic_unchecked_t no_free_exch_xid;
-+ atomic_unchecked_t xid_not_found;
-+ atomic_unchecked_t xid_busy;
-+ atomic_unchecked_t seq_not_found;
-+ atomic_unchecked_t non_bls_resp;
- } stats;
- };
- #define fc_seq_exch(sp) container_of(sp, struct fc_exch, seq)
-@@ -510,7 +510,7 @@ static struct fc_exch *fc_exch_em_alloc(struct fc_lport *lport,
- /* allocate memory for exchange */
- ep = mempool_alloc(mp->ep_pool, GFP_ATOMIC);
- if (!ep) {
-- atomic_inc(&mp->stats.no_free_exch);
-+ atomic_inc_unchecked(&mp->stats.no_free_exch);
- goto out;
- }
- memset(ep, 0, sizeof(*ep));
-@@ -557,7 +557,7 @@ out:
- return ep;
- err:
- spin_unlock_bh(&pool->lock);
-- atomic_inc(&mp->stats.no_free_exch_xid);
-+ atomic_inc_unchecked(&mp->stats.no_free_exch_xid);
- mempool_free(ep, mp->ep_pool);
- return NULL;
- }
-@@ -690,7 +690,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
- xid = ntohs(fh->fh_ox_id); /* we originated exch */
- ep = fc_exch_find(mp, xid);
- if (!ep) {
-- atomic_inc(&mp->stats.xid_not_found);
-+ atomic_inc_unchecked(&mp->stats.xid_not_found);
- reject = FC_RJT_OX_ID;
- goto out;
- }
-@@ -720,7 +720,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
- ep = fc_exch_find(mp, xid);
- if ((f_ctl & FC_FC_FIRST_SEQ) && fc_sof_is_init(fr_sof(fp))) {
- if (ep) {
-- atomic_inc(&mp->stats.xid_busy);
-+ atomic_inc_unchecked(&mp->stats.xid_busy);
- reject = FC_RJT_RX_ID;
- goto rel;
- }
-@@ -731,7 +731,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
- }
- xid = ep->xid; /* get our XID */
- } else if (!ep) {
-- atomic_inc(&mp->stats.xid_not_found);
-+ atomic_inc_unchecked(&mp->stats.xid_not_found);
- reject = FC_RJT_RX_ID; /* XID not found */
- goto out;
- }
-@@ -752,7 +752,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
- } else {
- sp = &ep->seq;
- if (sp->id != fh->fh_seq_id) {
-- atomic_inc(&mp->stats.seq_not_found);
-+ atomic_inc_unchecked(&mp->stats.seq_not_found);
- reject = FC_RJT_SEQ_ID; /* sequence/exch should exist */
- goto rel;
- }
-@@ -1163,22 +1163,22 @@ static void fc_exch_recv_seq_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
-
- ep = fc_exch_find(mp, ntohs(fh->fh_ox_id));
- if (!ep) {
-- atomic_inc(&mp->stats.xid_not_found);
-+ atomic_inc_unchecked(&mp->stats.xid_not_found);
- goto out;
- }
- if (ep->esb_stat & ESB_ST_COMPLETE) {
-- atomic_inc(&mp->stats.xid_not_found);
-+ atomic_inc_unchecked(&mp->stats.xid_not_found);
- goto out;
- }
- if (ep->rxid == FC_XID_UNKNOWN)
- ep->rxid = ntohs(fh->fh_rx_id);
- if (ep->sid != 0 && ep->sid != ntoh24(fh->fh_d_id)) {
-- atomic_inc(&mp->stats.xid_not_found);
-+ atomic_inc_unchecked(&mp->stats.xid_not_found);
- goto rel;
- }
- if (ep->did != ntoh24(fh->fh_s_id) &&
- ep->did != FC_FID_FLOGI) {
-- atomic_inc(&mp->stats.xid_not_found);
-+ atomic_inc_unchecked(&mp->stats.xid_not_found);
- goto rel;
- }
- sof = fr_sof(fp);
-@@ -1189,7 +1189,7 @@ static void fc_exch_recv_seq_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
- } else {
- sp = &ep->seq;
- if (sp->id != fh->fh_seq_id) {
-- atomic_inc(&mp->stats.seq_not_found);
-+ atomic_inc_unchecked(&mp->stats.seq_not_found);
- goto rel;
- }
- }
-@@ -1249,9 +1249,9 @@ static void fc_exch_recv_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
- sp = fc_seq_lookup_orig(mp, fp); /* doesn't hold sequence */
-
- if (!sp)
-- atomic_inc(&mp->stats.xid_not_found);
-+ atomic_inc_unchecked(&mp->stats.xid_not_found);
- else
-- atomic_inc(&mp->stats.non_bls_resp);
-+ atomic_inc_unchecked(&mp->stats.non_bls_resp);
-
- fc_frame_free(fp);
- }
-diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
-index 0ee989f..a582241 100644
---- a/drivers/scsi/libsas/sas_ata.c
-+++ b/drivers/scsi/libsas/sas_ata.c
-@@ -343,7 +343,7 @@ static int sas_ata_scr_read(struct ata_link *link, unsigned int sc_reg_in,
- }
- }
-
--static struct ata_port_operations sas_sata_ops = {
-+static const struct ata_port_operations sas_sata_ops = {
- .phy_reset = sas_ata_phy_reset,
- .post_internal_cmd = sas_ata_post_internal,
- .qc_defer = ata_std_qc_defer,
-diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
-index aa10f79..5cc79e4 100644
---- a/drivers/scsi/lpfc/lpfc.h
-+++ b/drivers/scsi/lpfc/lpfc.h
-@@ -400,7 +400,7 @@ struct lpfc_vport {
- struct dentry *debug_nodelist;
- struct dentry *vport_debugfs_root;
- struct lpfc_debugfs_trc *disc_trc;
-- atomic_t disc_trc_cnt;
-+ atomic_unchecked_t disc_trc_cnt;
- #endif
- uint8_t stat_data_enabled;
- uint8_t stat_data_blocked;
-@@ -725,8 +725,8 @@ struct lpfc_hba {
- struct timer_list fabric_block_timer;
- unsigned long bit_flags;
- #define FABRIC_COMANDS_BLOCKED 0
-- atomic_t num_rsrc_err;
-- atomic_t num_cmd_success;
-+ atomic_unchecked_t num_rsrc_err;
-+ atomic_unchecked_t num_cmd_success;
- unsigned long last_rsrc_error_time;
- unsigned long last_ramp_down_time;
- unsigned long last_ramp_up_time;
-@@ -740,7 +740,7 @@ struct lpfc_hba {
- struct dentry *debug_dumpDif; /* BlockGuard BPL*/
- struct dentry *debug_slow_ring_trc;
- struct lpfc_debugfs_trc *slow_ring_trc;
-- atomic_t slow_ring_trc_cnt;
-+ atomic_unchecked_t slow_ring_trc_cnt;
- #endif
-
- /* Used for deferred freeing of ELS data buffers */
-diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
-index 8d0f0de..7c77a62 100644
---- a/drivers/scsi/lpfc/lpfc_debugfs.c
-+++ b/drivers/scsi/lpfc/lpfc_debugfs.c
-@@ -124,7 +124,7 @@ struct lpfc_debug {
- int len;
- };
-
--static atomic_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
-+static atomic_unchecked_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
- static unsigned long lpfc_debugfs_start_time = 0L;
-
- /**
-@@ -158,7 +158,7 @@ lpfc_debugfs_disc_trc_data(struct lpfc_vport *vport, char *buf, int size)
- lpfc_debugfs_enable = 0;
-
- len = 0;
-- index = (atomic_read(&vport->disc_trc_cnt) + 1) &
-+ index = (atomic_read_unchecked(&vport->disc_trc_cnt) + 1) &
- (lpfc_debugfs_max_disc_trc - 1);
- for (i = index; i < lpfc_debugfs_max_disc_trc; i++) {
- dtp = vport->disc_trc + i;
-@@ -219,7 +219,7 @@ lpfc_debugfs_slow_ring_trc_data(struct lpfc_hba *phba, char *buf, int size)
- lpfc_debugfs_enable = 0;
-
- len = 0;
-- index = (atomic_read(&phba->slow_ring_trc_cnt) + 1) &
-+ index = (atomic_read_unchecked(&phba->slow_ring_trc_cnt) + 1) &
- (lpfc_debugfs_max_slow_ring_trc - 1);
- for (i = index; i < lpfc_debugfs_max_slow_ring_trc; i++) {
- dtp = phba->slow_ring_trc + i;
-@@ -397,6 +397,8 @@ lpfc_debugfs_dumpHBASlim_data(struct lpfc_hba *phba, char *buf, int size)
- uint32_t *ptr;
- char buffer[1024];
-
-+ pax_track_stack();
-+
- off = 0;
- spin_lock_irq(&phba->hbalock);
-
-@@ -634,14 +636,14 @@ lpfc_debugfs_disc_trc(struct lpfc_vport *vport, int mask, char *fmt,
- !vport || !vport->disc_trc)
- return;
-
-- index = atomic_inc_return(&vport->disc_trc_cnt) &
-+ index = atomic_inc_return_unchecked(&vport->disc_trc_cnt) &
- (lpfc_debugfs_max_disc_trc - 1);
- dtp = vport->disc_trc + index;
- dtp->fmt = fmt;
- dtp->data1 = data1;
- dtp->data2 = data2;
- dtp->data3 = data3;
-- dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
-+ dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
- dtp->jif = jiffies;
- #endif
- return;
-@@ -672,14 +674,14 @@ lpfc_debugfs_slow_ring_trc(struct lpfc_hba *phba, char *fmt,
- !phba || !phba->slow_ring_trc)
- return;
-
-- index = atomic_inc_return(&phba->slow_ring_trc_cnt) &
-+ index = atomic_inc_return_unchecked(&phba->slow_ring_trc_cnt) &
- (lpfc_debugfs_max_slow_ring_trc - 1);
- dtp = phba->slow_ring_trc + index;
- dtp->fmt = fmt;
- dtp->data1 = data1;
- dtp->data2 = data2;
- dtp->data3 = data3;
-- dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
-+ dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
- dtp->jif = jiffies;
- #endif
- return;
-@@ -1364,7 +1366,7 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport)
- "slow_ring buffer\n");
- goto debug_failed;
- }
-- atomic_set(&phba->slow_ring_trc_cnt, 0);
-+ atomic_set_unchecked(&phba->slow_ring_trc_cnt, 0);
- memset(phba->slow_ring_trc, 0,
- (sizeof(struct lpfc_debugfs_trc) *
- lpfc_debugfs_max_slow_ring_trc));
-@@ -1410,7 +1412,7 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport)
- "buffer\n");
- goto debug_failed;
- }
-- atomic_set(&vport->disc_trc_cnt, 0);
-+ atomic_set_unchecked(&vport->disc_trc_cnt, 0);
-
- snprintf(name, sizeof(name), "discovery_trace");
- vport->debug_disc_trc =
-diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
-index 549bc7d..8189dbb 100644
---- a/drivers/scsi/lpfc/lpfc_init.c
-+++ b/drivers/scsi/lpfc/lpfc_init.c
-@@ -8021,8 +8021,10 @@ lpfc_init(void)
- printk(LPFC_COPYRIGHT "\n");
-
- if (lpfc_enable_npiv) {
-- lpfc_transport_functions.vport_create = lpfc_vport_create;
-- lpfc_transport_functions.vport_delete = lpfc_vport_delete;
-+ pax_open_kernel();
-+ *(void **)&lpfc_transport_functions.vport_create = lpfc_vport_create;
-+ *(void **)&lpfc_transport_functions.vport_delete = lpfc_vport_delete;
-+ pax_close_kernel();
- }
- lpfc_transport_template =
- fc_attach_transport(&lpfc_transport_functions);
-diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
-index c88f59f..ff2a42f 100644
---- a/drivers/scsi/lpfc/lpfc_scsi.c
-+++ b/drivers/scsi/lpfc/lpfc_scsi.c
-@@ -259,7 +259,7 @@ lpfc_rampdown_queue_depth(struct lpfc_hba *phba)
- uint32_t evt_posted;
-
- spin_lock_irqsave(&phba->hbalock, flags);
-- atomic_inc(&phba->num_rsrc_err);
-+ atomic_inc_unchecked(&phba->num_rsrc_err);
- phba->last_rsrc_error_time = jiffies;
-
- if ((phba->last_ramp_down_time + QUEUE_RAMP_DOWN_INTERVAL) > jiffies) {
-@@ -300,7 +300,7 @@ lpfc_rampup_queue_depth(struct lpfc_vport *vport,
- unsigned long flags;
- struct lpfc_hba *phba = vport->phba;
- uint32_t evt_posted;
-- atomic_inc(&phba->num_cmd_success);
-+ atomic_inc_unchecked(&phba->num_cmd_success);
-
- if (vport->cfg_lun_queue_depth <= queue_depth)
- return;
-@@ -343,8 +343,8 @@ lpfc_ramp_down_queue_handler(struct lpfc_hba *phba)
- int i;
- struct lpfc_rport_data *rdata;
-
-- num_rsrc_err = atomic_read(&phba->num_rsrc_err);
-- num_cmd_success = atomic_read(&phba->num_cmd_success);
-+ num_rsrc_err = atomic_read_unchecked(&phba->num_rsrc_err);
-+ num_cmd_success = atomic_read_unchecked(&phba->num_cmd_success);
-
- vports = lpfc_create_vport_work_array(phba);
- if (vports != NULL)
-@@ -378,8 +378,8 @@ lpfc_ramp_down_queue_handler(struct lpfc_hba *phba)
- }
- }
- lpfc_destroy_vport_work_array(phba, vports);
-- atomic_set(&phba->num_rsrc_err, 0);
-- atomic_set(&phba->num_cmd_success, 0);
-+ atomic_set_unchecked(&phba->num_rsrc_err, 0);
-+ atomic_set_unchecked(&phba->num_cmd_success, 0);
- }
-
- /**
-@@ -427,8 +427,8 @@ lpfc_ramp_up_queue_handler(struct lpfc_hba *phba)
- }
- }
- lpfc_destroy_vport_work_array(phba, vports);
-- atomic_set(&phba->num_rsrc_err, 0);
-- atomic_set(&phba->num_cmd_success, 0);
-+ atomic_set_unchecked(&phba->num_rsrc_err, 0);
-+ atomic_set_unchecked(&phba->num_cmd_success, 0);
- }
-
- /**
-diff --git a/drivers/scsi/megaraid/megaraid_mbox.c b/drivers/scsi/megaraid/megaraid_mbox.c
-index 234f0b7..3020aea 100644
---- a/drivers/scsi/megaraid/megaraid_mbox.c
-+++ b/drivers/scsi/megaraid/megaraid_mbox.c
-@@ -3503,6 +3503,8 @@ megaraid_cmm_register(adapter_t *adapter)
- int rval;
- int i;
-
-+ pax_track_stack();
-+
- // Allocate memory for the base list of scb for management module.
- adapter->uscb_list = kcalloc(MBOX_MAX_USER_CMDS, sizeof(scb_t), GFP_KERNEL);
-
-diff --git a/drivers/scsi/osd/osd_initiator.c b/drivers/scsi/osd/osd_initiator.c
-index 7a117c1..ee01e9e 100644
---- a/drivers/scsi/osd/osd_initiator.c
-+++ b/drivers/scsi/osd/osd_initiator.c
-@@ -94,6 +94,8 @@ static int _osd_print_system_info(struct osd_dev *od, void *caps)
- int nelem = ARRAY_SIZE(get_attrs), a = 0;
- int ret;
-
-+ pax_track_stack();
-+
- or = osd_start_request(od, GFP_KERNEL);
- if (!or)
- return -ENOMEM;
-diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
-index 9ab8c86..9425ad3 100644
---- a/drivers/scsi/pmcraid.c
-+++ b/drivers/scsi/pmcraid.c
-@@ -189,8 +189,8 @@ static int pmcraid_slave_alloc(struct scsi_device *scsi_dev)
- res->scsi_dev = scsi_dev;
- scsi_dev->hostdata = res;
- res->change_detected = 0;
-- atomic_set(&res->read_failures, 0);
-- atomic_set(&res->write_failures, 0);
-+ atomic_set_unchecked(&res->read_failures, 0);
-+ atomic_set_unchecked(&res->write_failures, 0);
- rc = 0;
- }
- spin_unlock_irqrestore(&pinstance->resource_lock, lock_flags);
-@@ -2396,9 +2396,9 @@ static int pmcraid_error_handler(struct pmcraid_cmd *cmd)
-
- /* If this was a SCSI read/write command keep count of errors */
- if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_READ_CMD)
-- atomic_inc(&res->read_failures);
-+ atomic_inc_unchecked(&res->read_failures);
- else if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_WRITE_CMD)
-- atomic_inc(&res->write_failures);
-+ atomic_inc_unchecked(&res->write_failures);
-
- if (!RES_IS_GSCSI(res->cfg_entry) &&
- masked_ioasc != PMCRAID_IOASC_HW_DEVICE_BUS_STATUS_ERROR) {
-@@ -4116,7 +4116,7 @@ static void pmcraid_worker_function(struct work_struct *workp)
-
- pinstance = container_of(workp, struct pmcraid_instance, worker_q);
- /* add resources only after host is added into system */
-- if (!atomic_read(&pinstance->expose_resources))
-+ if (!atomic_read_unchecked(&pinstance->expose_resources))
- return;
-
- spin_lock_irqsave(&pinstance->resource_lock, lock_flags);
-@@ -4850,7 +4850,7 @@ static int __devinit pmcraid_init_instance(
- init_waitqueue_head(&pinstance->reset_wait_q);
-
- atomic_set(&pinstance->outstanding_cmds, 0);
-- atomic_set(&pinstance->expose_resources, 0);
-+ atomic_set_unchecked(&pinstance->expose_resources, 0);
-
- INIT_LIST_HEAD(&pinstance->free_res_q);
- INIT_LIST_HEAD(&pinstance->used_res_q);
-@@ -5502,7 +5502,7 @@ static int __devinit pmcraid_probe(
- /* Schedule worker thread to handle CCN and take care of adding and
- * removing devices to OS
- */
-- atomic_set(&pinstance->expose_resources, 1);
-+ atomic_set_unchecked(&pinstance->expose_resources, 1);
- schedule_work(&pinstance->worker_q);
- return rc;
-
-diff --git a/drivers/scsi/pmcraid.h b/drivers/scsi/pmcraid.h
-index 3441b3f..6cbe8f7 100644
---- a/drivers/scsi/pmcraid.h
-+++ b/drivers/scsi/pmcraid.h
-@@ -690,7 +690,7 @@ struct pmcraid_instance {
- atomic_t outstanding_cmds;
-
- /* should add/delete resources to mid-layer now ?*/
-- atomic_t expose_resources;
-+ atomic_unchecked_t expose_resources;
-
- /* Tasklet to handle deferred processing */
- struct tasklet_struct isr_tasklet[PMCRAID_NUM_MSIX_VECTORS];
-@@ -727,8 +727,8 @@ struct pmcraid_resource_entry {
- struct list_head queue; /* link to "to be exposed" resources */
- struct pmcraid_config_table_entry cfg_entry;
- struct scsi_device *scsi_dev; /* Link scsi_device structure */
-- atomic_t read_failures; /* count of failed READ commands */
-- atomic_t write_failures; /* count of failed WRITE commands */
-+ atomic_unchecked_t read_failures; /* count of failed READ commands */
-+ atomic_unchecked_t write_failures; /* count of failed WRITE commands */
-
- /* To indicate add/delete/modify during CCN */
- u8 change_detected;
-diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
-index 06bbe0d..4b5dc65 100644
---- a/drivers/scsi/qla2xxx/qla_os.c
-+++ b/drivers/scsi/qla2xxx/qla_os.c
-@@ -1274,8 +1274,10 @@ qla2x00_config_dma_addressing(struct qla_hw_data *ha)
- !pci_set_consistent_dma_mask(ha->pdev, DMA_BIT_MASK(64))) {
- /* Ok, a 64bit DMA mask is applicable. */
- ha->flags.enable_64bit_addressing = 1;
-- ha->isp_ops->calc_req_entries = qla2x00_calc_iocbs_64;
-- ha->isp_ops->build_iocbs = qla2x00_build_scsi_iocbs_64;
-+ pax_open_kernel();
-+ *(void **)&ha->isp_ops->calc_req_entries = qla2x00_calc_iocbs_64;
-+ *(void **)&ha->isp_ops->build_iocbs = qla2x00_build_scsi_iocbs_64;
-+ pax_close_kernel();
- return;
- }
- }
-diff --git a/drivers/scsi/qla4xxx/ql4_def.h b/drivers/scsi/qla4xxx/ql4_def.h
-index 81b5f29..2ae1fad 100644
---- a/drivers/scsi/qla4xxx/ql4_def.h
-+++ b/drivers/scsi/qla4xxx/ql4_def.h
-@@ -240,7 +240,7 @@ struct ddb_entry {
- atomic_t retry_relogin_timer; /* Min Time between relogins
- * (4000 only) */
- atomic_t relogin_timer; /* Max Time to wait for relogin to complete */
-- atomic_t relogin_retry_count; /* Num of times relogin has been
-+ atomic_unchecked_t relogin_retry_count; /* Num of times relogin has been
- * retried */
-
- uint16_t port;
-diff --git a/drivers/scsi/qla4xxx/ql4_init.c b/drivers/scsi/qla4xxx/ql4_init.c
-index af8c323..515dd51 100644
---- a/drivers/scsi/qla4xxx/ql4_init.c
-+++ b/drivers/scsi/qla4xxx/ql4_init.c
-@@ -482,7 +482,7 @@ static struct ddb_entry * qla4xxx_alloc_ddb(struct scsi_qla_host *ha,
- atomic_set(&ddb_entry->port_down_timer, ha->port_down_retry_count);
- atomic_set(&ddb_entry->retry_relogin_timer, INVALID_ENTRY);
- atomic_set(&ddb_entry->relogin_timer, 0);
-- atomic_set(&ddb_entry->relogin_retry_count, 0);
-+ atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
- atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
- list_add_tail(&ddb_entry->list, &ha->ddb_list);
- ha->fw_ddb_index_map[fw_ddb_index] = ddb_entry;
-@@ -1308,7 +1308,7 @@ int qla4xxx_process_ddb_changed(struct scsi_qla_host *ha,
- atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
- atomic_set(&ddb_entry->port_down_timer,
- ha->port_down_retry_count);
-- atomic_set(&ddb_entry->relogin_retry_count, 0);
-+ atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
- atomic_set(&ddb_entry->relogin_timer, 0);
- clear_bit(DF_RELOGIN, &ddb_entry->flags);
- clear_bit(DF_NO_RELOGIN, &ddb_entry->flags);
-diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
-index 83c8b5e..a82b348 100644
---- a/drivers/scsi/qla4xxx/ql4_os.c
-+++ b/drivers/scsi/qla4xxx/ql4_os.c
-@@ -641,13 +641,13 @@ static void qla4xxx_timer(struct scsi_qla_host *ha)
- ddb_entry->fw_ddb_device_state ==
- DDB_DS_SESSION_FAILED) {
- /* Reset retry relogin timer */
-- atomic_inc(&ddb_entry->relogin_retry_count);
-+ atomic_inc_unchecked(&ddb_entry->relogin_retry_count);
- DEBUG2(printk("scsi%ld: index[%d] relogin"
- " timed out-retrying"
- " relogin (%d)\n",
- ha->host_no,
- ddb_entry->fw_ddb_index,
-- atomic_read(&ddb_entry->
-+ atomic_read_unchecked(&ddb_entry->
- relogin_retry_count))
- );
- start_dpc++;
-diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
-index dd098ca..686ce01 100644
---- a/drivers/scsi/scsi.c
-+++ b/drivers/scsi/scsi.c
-@@ -652,7 +652,7 @@ int scsi_dispatch_cmd(struct scsi_cmnd *cmd)
- unsigned long timeout;
- int rtn = 0;
-
-- atomic_inc(&cmd->device->iorequest_cnt);
-+ atomic_inc_unchecked(&cmd->device->iorequest_cnt);
-
- /* check if the device is still usable */
- if (unlikely(cmd->device->sdev_state == SDEV_DEL)) {
-diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
-index bc3e363..e1a8e50 100644
---- a/drivers/scsi/scsi_debug.c
-+++ b/drivers/scsi/scsi_debug.c
-@@ -1395,6 +1395,8 @@ static int resp_mode_select(struct scsi_cmnd * scp, int mselect6,
- unsigned char arr[SDEBUG_MAX_MSELECT_SZ];
- unsigned char *cmd = (unsigned char *)scp->cmnd;
-
-+ pax_track_stack();
-+
- if ((errsts = check_readiness(scp, 1, devip)))
- return errsts;
- memset(arr, 0, sizeof(arr));
-@@ -1492,6 +1494,8 @@ static int resp_log_sense(struct scsi_cmnd * scp,
- unsigned char arr[SDEBUG_MAX_LSENSE_SZ];
- unsigned char *cmd = (unsigned char *)scp->cmnd;
-
-+ pax_track_stack();
-+
- if ((errsts = check_readiness(scp, 1, devip)))
- return errsts;
- memset(arr, 0, sizeof(arr));
-diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
-index e28f9b0..030e4b5 100644
---- a/drivers/scsi/scsi_lib.c
-+++ b/drivers/scsi/scsi_lib.c
-@@ -1400,7 +1400,7 @@ static void scsi_kill_request(struct request *req, struct request_queue *q)
- shost = sdev->host;
- scsi_init_cmd_errh(cmd);
- cmd->result = DID_NO_CONNECT << 16;
-- atomic_inc(&cmd->device->iorequest_cnt);
-+ atomic_inc_unchecked(&cmd->device->iorequest_cnt);
-
- /*
- * SCSI request completion path will do scsi_device_unbusy(),
-@@ -1431,9 +1431,9 @@ static void scsi_softirq_done(struct request *rq)
- */
- cmd->serial_number = 0;
-
-- atomic_inc(&cmd->device->iodone_cnt);
-+ atomic_inc_unchecked(&cmd->device->iodone_cnt);
- if (cmd->result)
-- atomic_inc(&cmd->device->ioerr_cnt);
-+ atomic_inc_unchecked(&cmd->device->ioerr_cnt);
-
- disposition = scsi_decide_disposition(cmd);
- if (disposition != SUCCESS &&
-diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
-index 91a93e0..eae0fe3 100644
---- a/drivers/scsi/scsi_sysfs.c
-+++ b/drivers/scsi/scsi_sysfs.c
-@@ -662,7 +662,7 @@ show_iostat_##field(struct device *dev, struct device_attribute *attr, \
- char *buf) \
- { \
- struct scsi_device *sdev = to_scsi_device(dev); \
-- unsigned long long count = atomic_read(&sdev->field); \
-+ unsigned long long count = atomic_read_unchecked(&sdev->field); \
- return snprintf(buf, 20, "0x%llx\n", count); \
- } \
- static DEVICE_ATTR(field, S_IRUGO, show_iostat_##field, NULL)
-diff --git a/drivers/scsi/scsi_tgt_lib.c b/drivers/scsi/scsi_tgt_lib.c
-index 1030327..f91fd30 100644
---- a/drivers/scsi/scsi_tgt_lib.c
-+++ b/drivers/scsi/scsi_tgt_lib.c
-@@ -362,7 +362,7 @@ static int scsi_map_user_pages(struct scsi_tgt_cmd *tcmd, struct scsi_cmnd *cmd,
- int err;
-
- dprintk("%lx %u\n", uaddr, len);
-- err = blk_rq_map_user(q, rq, NULL, (void *)uaddr, len, GFP_KERNEL);
-+ err = blk_rq_map_user(q, rq, NULL, (void __user *)uaddr, len, GFP_KERNEL);
- if (err) {
- /*
- * TODO: need to fixup sg_tablesize, max_segment_size,
-diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
-index db02e31..1b42ea9 100644
---- a/drivers/scsi/scsi_transport_fc.c
-+++ b/drivers/scsi/scsi_transport_fc.c
-@@ -480,7 +480,7 @@ MODULE_PARM_DESC(dev_loss_tmo,
- * Netlink Infrastructure
- */
-
--static atomic_t fc_event_seq;
-+static atomic_unchecked_t fc_event_seq;
-
- /**
- * fc_get_event_number - Obtain the next sequential FC event number
-@@ -493,7 +493,7 @@ static atomic_t fc_event_seq;
- u32
- fc_get_event_number(void)
- {
-- return atomic_add_return(1, &fc_event_seq);
-+ return atomic_add_return_unchecked(1, &fc_event_seq);
- }
- EXPORT_SYMBOL(fc_get_event_number);
-
-@@ -641,7 +641,7 @@ static __init int fc_transport_init(void)
- {
- int error;
-
-- atomic_set(&fc_event_seq, 0);
-+ atomic_set_unchecked(&fc_event_seq, 0);
-
- error = transport_class_register(&fc_host_class);
- if (error)
-diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
-index de2f8c4..63c5278 100644
---- a/drivers/scsi/scsi_transport_iscsi.c
-+++ b/drivers/scsi/scsi_transport_iscsi.c
-@@ -81,7 +81,7 @@ struct iscsi_internal {
- struct device_attribute *session_attrs[ISCSI_SESSION_ATTRS + 1];
- };
-
--static atomic_t iscsi_session_nr; /* sysfs session id for next new session */
-+static atomic_unchecked_t iscsi_session_nr; /* sysfs session id for next new session */
- static struct workqueue_struct *iscsi_eh_timer_workq;
-
- /*
-@@ -728,7 +728,7 @@ int iscsi_add_session(struct iscsi_cls_session *session, unsigned int target_id)
- int err;
-
- ihost = shost->shost_data;
-- session->sid = atomic_add_return(1, &iscsi_session_nr);
-+ session->sid = atomic_add_return_unchecked(1, &iscsi_session_nr);
-
- if (id == ISCSI_MAX_TARGET) {
- for (id = 0; id < ISCSI_MAX_TARGET; id++) {
-@@ -2060,7 +2060,7 @@ static __init int iscsi_transport_init(void)
- printk(KERN_INFO "Loading iSCSI transport class v%s.\n",
- ISCSI_TRANSPORT_VERSION);
-
-- atomic_set(&iscsi_session_nr, 0);
-+ atomic_set_unchecked(&iscsi_session_nr, 0);
-
- err = class_register(&iscsi_transport_class);
- if (err)
-diff --git a/drivers/scsi/scsi_transport_srp.c b/drivers/scsi/scsi_transport_srp.c
-index 21a045e..ec89e03 100644
---- a/drivers/scsi/scsi_transport_srp.c
-+++ b/drivers/scsi/scsi_transport_srp.c
-@@ -33,7 +33,7 @@
- #include "scsi_transport_srp_internal.h"
-
- struct srp_host_attrs {
-- atomic_t next_port_id;
-+ atomic_unchecked_t next_port_id;
- };
- #define to_srp_host_attrs(host) ((struct srp_host_attrs *)(host)->shost_data)
-
-@@ -62,7 +62,7 @@ static int srp_host_setup(struct transport_container *tc, struct device *dev,
- struct Scsi_Host *shost = dev_to_shost(dev);
- struct srp_host_attrs *srp_host = to_srp_host_attrs(shost);
-
-- atomic_set(&srp_host->next_port_id, 0);
-+ atomic_set_unchecked(&srp_host->next_port_id, 0);
- return 0;
- }
-
-@@ -211,7 +211,7 @@ struct srp_rport *srp_rport_add(struct Scsi_Host *shost,
- memcpy(rport->port_id, ids->port_id, sizeof(rport->port_id));
- rport->roles = ids->roles;
-
-- id = atomic_inc_return(&to_srp_host_attrs(shost)->next_port_id);
-+ id = atomic_inc_return_unchecked(&to_srp_host_attrs(shost)->next_port_id);
- dev_set_name(&rport->dev, "port-%d:%d", shost->host_no, id);
-
- transport_setup_device(&rport->dev);
-diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
-index 040f751..98a5ed2 100644
---- a/drivers/scsi/sg.c
-+++ b/drivers/scsi/sg.c
-@@ -1064,7 +1064,7 @@ sg_ioctl(struct inode *inode, struct file *filp,
- sdp->disk->disk_name,
- MKDEV(SCSI_GENERIC_MAJOR, sdp->index),
- NULL,
-- (char *)arg);
-+ (char __user *)arg);
- case BLKTRACESTART:
- return blk_trace_startstop(sdp->device->request_queue, 1);
- case BLKTRACESTOP:
-@@ -2292,7 +2292,7 @@ struct sg_proc_leaf {
- const struct file_operations * fops;
- };
-
--static struct sg_proc_leaf sg_proc_leaf_arr[] = {
-+static const struct sg_proc_leaf sg_proc_leaf_arr[] = {
- {"allow_dio", &adio_fops},
- {"debug", &debug_fops},
- {"def_reserved_size", &dressz_fops},
-@@ -2307,7 +2307,7 @@ sg_proc_init(void)
- {
- int k, mask;
- int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
-- struct sg_proc_leaf * leaf;
-+ const struct sg_proc_leaf * leaf;
-
- sg_proc_sgp = proc_mkdir(sg_proc_sg_dirname, NULL);
- if (!sg_proc_sgp)
-diff --git a/drivers/scsi/sym53c8xx_2/sym_glue.c b/drivers/scsi/sym53c8xx_2/sym_glue.c
-index c19ca5e..3eb5959 100644
---- a/drivers/scsi/sym53c8xx_2/sym_glue.c
-+++ b/drivers/scsi/sym53c8xx_2/sym_glue.c
-@@ -1758,6 +1758,8 @@ static int __devinit sym2_probe(struct pci_dev *pdev,
- int do_iounmap = 0;
- int do_disable_device = 1;
-
-+ pax_track_stack();
-+
- memset(&sym_dev, 0, sizeof(sym_dev));
- memset(&nvram, 0, sizeof(nvram));
- sym_dev.pdev = pdev;
-diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c
-new file mode 100644
-index 0000000..eabb432
---- /dev/null
-+++ b/drivers/scsi/vmw_pvscsi.c
-@@ -0,0 +1,1401 @@
-+/*
-+ * Linux driver for VMware's para-virtualized SCSI HBA.
-+ *
-+ * Copyright (C) 2008-2009, VMware, Inc. All Rights Reserved.
-+ *
-+ * This program is free software; you can redistribute it and/or modify it
-+ * under the terms of the GNU General Public License as published by the
-+ * Free Software Foundation; version 2 of the License and no later version.
-+ *
-+ * This program is distributed in the hope that it will be useful, but
-+ * WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
-+ * NON INFRINGEMENT. See the GNU General Public License for more
-+ * details.
-+ *
-+ * You should have received a copy of the GNU General Public License
-+ * along with this program; if not, write to the Free Software
-+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
-+ *
-+ * Maintained by: Alok N Kataria <akataria@vmware.com>
-+ *
-+ */
-+
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/moduleparam.h>
-+#include <linux/types.h>
-+#include <linux/interrupt.h>
-+#include <linux/workqueue.h>
-+#include <linux/pci.h>
-+
-+#include <scsi/scsi.h>
-+#include <scsi/scsi_host.h>
-+#include <scsi/scsi_cmnd.h>
-+#include <scsi/scsi_device.h>
-+
-+#include "vmw_pvscsi.h"
-+
-+#define PVSCSI_LINUX_DRIVER_DESC "VMware PVSCSI driver"
-+
-+MODULE_DESCRIPTION(PVSCSI_LINUX_DRIVER_DESC);
-+MODULE_AUTHOR("VMware, Inc.");
-+MODULE_LICENSE("GPL");
-+MODULE_VERSION(PVSCSI_DRIVER_VERSION_STRING);
-+
-+#define PVSCSI_DEFAULT_NUM_PAGES_PER_RING 8
-+#define PVSCSI_DEFAULT_NUM_PAGES_MSG_RING 1
-+#define PVSCSI_DEFAULT_QUEUE_DEPTH 64
-+#define SGL_SIZE PAGE_SIZE
-+
-+#define pvscsi_dev(adapter) (&(adapter->dev->dev))
-+
-+struct pvscsi_sg_list {
-+ struct PVSCSISGElement sge[PVSCSI_MAX_NUM_SG_ENTRIES_PER_SEGMENT];
-+};
-+
-+struct pvscsi_ctx {
-+ /*
-+ * The index of the context in cmd_map serves as the context ID for a
-+ * 1-to-1 mapping completions back to requests.
-+ */
-+ struct scsi_cmnd *cmd;
-+ struct pvscsi_sg_list *sgl;
-+ struct list_head list;
-+ dma_addr_t dataPA;
-+ dma_addr_t sensePA;
-+ dma_addr_t sglPA;
-+};
-+
-+struct pvscsi_adapter {
-+ char *mmioBase;
-+ unsigned int irq;
-+ u8 rev;
-+ bool use_msi;
-+ bool use_msix;
-+ bool use_msg;
-+
-+ spinlock_t hw_lock;
-+
-+ struct workqueue_struct *workqueue;
-+ struct work_struct work;
-+
-+ struct PVSCSIRingReqDesc *req_ring;
-+ unsigned req_pages;
-+ unsigned req_depth;
-+ dma_addr_t reqRingPA;
-+
-+ struct PVSCSIRingCmpDesc *cmp_ring;
-+ unsigned cmp_pages;
-+ dma_addr_t cmpRingPA;
-+
-+ struct PVSCSIRingMsgDesc *msg_ring;
-+ unsigned msg_pages;
-+ dma_addr_t msgRingPA;
-+
-+ struct PVSCSIRingsState *rings_state;
-+ dma_addr_t ringStatePA;
-+
-+ struct pci_dev *dev;
-+ struct Scsi_Host *host;
-+
-+ struct list_head cmd_pool;
-+ struct pvscsi_ctx *cmd_map;
-+};
-+
-+
-+/* Command line parameters */
-+static int pvscsi_ring_pages = PVSCSI_DEFAULT_NUM_PAGES_PER_RING;
-+static int pvscsi_msg_ring_pages = PVSCSI_DEFAULT_NUM_PAGES_MSG_RING;
-+static int pvscsi_cmd_per_lun = PVSCSI_DEFAULT_QUEUE_DEPTH;
-+static bool pvscsi_disable_msi;
-+static bool pvscsi_disable_msix;
-+static bool pvscsi_use_msg = true;
-+
-+#define PVSCSI_RW (S_IRUSR | S_IWUSR)
-+
-+module_param_named(ring_pages, pvscsi_ring_pages, int, PVSCSI_RW);
-+MODULE_PARM_DESC(ring_pages, "Number of pages per req/cmp ring - (default="
-+ __stringify(PVSCSI_DEFAULT_NUM_PAGES_PER_RING) ")");
-+
-+module_param_named(msg_ring_pages, pvscsi_msg_ring_pages, int, PVSCSI_RW);
-+MODULE_PARM_DESC(msg_ring_pages, "Number of pages for the msg ring - (default="
-+ __stringify(PVSCSI_DEFAULT_NUM_PAGES_MSG_RING) ")");
-+
-+module_param_named(cmd_per_lun, pvscsi_cmd_per_lun, int, PVSCSI_RW);
-+MODULE_PARM_DESC(cmd_per_lun, "Maximum commands per lun - (default="
-+ __stringify(PVSCSI_MAX_REQ_QUEUE_DEPTH) ")");
-+
-+module_param_named(disable_msi, pvscsi_disable_msi, bool, PVSCSI_RW);
-+MODULE_PARM_DESC(disable_msi, "Disable MSI use in driver - (default=0)");
-+
-+module_param_named(disable_msix, pvscsi_disable_msix, bool, PVSCSI_RW);
-+MODULE_PARM_DESC(disable_msix, "Disable MSI-X use in driver - (default=0)");
-+
-+module_param_named(use_msg, pvscsi_use_msg, bool, PVSCSI_RW);
-+MODULE_PARM_DESC(use_msg, "Use msg ring when available - (default=1)");
-+
-+static const struct pci_device_id pvscsi_pci_tbl[] = {
-+ { PCI_VDEVICE(VMWARE, PCI_DEVICE_ID_VMWARE_PVSCSI) },
-+ { 0 }
-+};
-+
-+MODULE_DEVICE_TABLE(pci, pvscsi_pci_tbl);
-+
-+static struct pvscsi_ctx *
-+pvscsi_find_context(const struct pvscsi_adapter *adapter, struct scsi_cmnd *cmd)
-+{
-+ struct pvscsi_ctx *ctx, *end;
-+
-+ end = &adapter->cmd_map[adapter->req_depth];
-+ for (ctx = adapter->cmd_map; ctx < end; ctx++)
-+ if (ctx->cmd == cmd)
-+ return ctx;
-+
-+ return NULL;
-+}
-+
-+static struct pvscsi_ctx *
-+pvscsi_acquire_context(struct pvscsi_adapter *adapter, struct scsi_cmnd *cmd)
-+{
-+ struct pvscsi_ctx *ctx;
-+
-+ if (list_empty(&adapter->cmd_pool))
-+ return NULL;
-+
-+ ctx = list_first_entry(&adapter->cmd_pool, struct pvscsi_ctx, list);
-+ ctx->cmd = cmd;
-+ list_del(&ctx->list);
-+
-+ return ctx;
-+}
-+
-+static void pvscsi_release_context(struct pvscsi_adapter *adapter,
-+ struct pvscsi_ctx *ctx)
-+{
-+ ctx->cmd = NULL;
-+ list_add(&ctx->list, &adapter->cmd_pool);
-+}
-+
-+/*
-+ * Map a pvscsi_ctx struct to a context ID field value; we map to a simple
-+ * non-zero integer. ctx always points to an entry in cmd_map array, hence
-+ * the return value is always >=1.
-+ */
-+static u64 pvscsi_map_context(const struct pvscsi_adapter *adapter,
-+ const struct pvscsi_ctx *ctx)
-+{
-+ return ctx - adapter->cmd_map + 1;
-+}
-+
-+static struct pvscsi_ctx *
-+pvscsi_get_context(const struct pvscsi_adapter *adapter, u64 context)
-+{
-+ return &adapter->cmd_map[context - 1];
-+}
-+
-+static void pvscsi_reg_write(const struct pvscsi_adapter *adapter,
-+ u32 offset, u32 val)
-+{
-+ writel(val, adapter->mmioBase + offset);
-+}
-+
-+static u32 pvscsi_reg_read(const struct pvscsi_adapter *adapter, u32 offset)
-+{
-+ return readl(adapter->mmioBase + offset);
-+}
-+
-+static u32 pvscsi_read_intr_status(const struct pvscsi_adapter *adapter)
-+{
-+ return pvscsi_reg_read(adapter, PVSCSI_REG_OFFSET_INTR_STATUS);
-+}
-+
-+static void pvscsi_write_intr_status(const struct pvscsi_adapter *adapter,
-+ u32 val)
-+{
-+ pvscsi_reg_write(adapter, PVSCSI_REG_OFFSET_INTR_STATUS, val);
-+}
-+
-+static void pvscsi_unmask_intr(const struct pvscsi_adapter *adapter)
-+{
-+ u32 intr_bits;
-+
-+ intr_bits = PVSCSI_INTR_CMPL_MASK;
-+ if (adapter->use_msg)
-+ intr_bits |= PVSCSI_INTR_MSG_MASK;
-+
-+ pvscsi_reg_write(adapter, PVSCSI_REG_OFFSET_INTR_MASK, intr_bits);
-+}
-+
-+static void pvscsi_mask_intr(const struct pvscsi_adapter *adapter)
-+{
-+ pvscsi_reg_write(adapter, PVSCSI_REG_OFFSET_INTR_MASK, 0);
-+}
-+
-+static void pvscsi_write_cmd_desc(const struct pvscsi_adapter *adapter,
-+ u32 cmd, const void *desc, size_t len)
-+{
-+ const u32 *ptr = desc;
-+ size_t i;
-+
-+ len /= sizeof(*ptr);
-+ pvscsi_reg_write(adapter, PVSCSI_REG_OFFSET_COMMAND, cmd);
-+ for (i = 0; i < len; i++)
-+ pvscsi_reg_write(adapter,
-+ PVSCSI_REG_OFFSET_COMMAND_DATA, ptr[i]);
-+}
-+
-+static void pvscsi_abort_cmd(const struct pvscsi_adapter *adapter,
-+ const struct pvscsi_ctx *ctx)
-+{
-+ struct PVSCSICmdDescAbortCmd cmd = { 0 };
-+
-+ cmd.target = ctx->cmd->device->id;
-+ cmd.context = pvscsi_map_context(adapter, ctx);
-+
-+ pvscsi_write_cmd_desc(adapter, PVSCSI_CMD_ABORT_CMD, &cmd, sizeof(cmd));
-+}
-+
-+static void pvscsi_kick_rw_io(const struct pvscsi_adapter *adapter)
-+{
-+ pvscsi_reg_write(adapter, PVSCSI_REG_OFFSET_KICK_RW_IO, 0);
-+}
-+
-+static void pvscsi_process_request_ring(const struct pvscsi_adapter *adapter)
-+{
-+ pvscsi_reg_write(adapter, PVSCSI_REG_OFFSET_KICK_NON_RW_IO, 0);
-+}
-+
-+static int scsi_is_rw(unsigned char op)
-+{
-+ return op == READ_6 || op == WRITE_6 ||
-+ op == READ_10 || op == WRITE_10 ||
-+ op == READ_12 || op == WRITE_12 ||
-+ op == READ_16 || op == WRITE_16;
-+}
-+
-+static void pvscsi_kick_io(const struct pvscsi_adapter *adapter,
-+ unsigned char op)
-+{
-+ if (scsi_is_rw(op))
-+ pvscsi_kick_rw_io(adapter);
-+ else
-+ pvscsi_process_request_ring(adapter);
-+}
-+
-+static void ll_adapter_reset(const struct pvscsi_adapter *adapter)
-+{
-+ dev_dbg(pvscsi_dev(adapter), "Adapter Reset on %p\n", adapter);
-+
-+ pvscsi_write_cmd_desc(adapter, PVSCSI_CMD_ADAPTER_RESET, NULL, 0);
-+}
-+
-+static void ll_bus_reset(const struct pvscsi_adapter *adapter)
-+{
-+ dev_dbg(pvscsi_dev(adapter), "Reseting bus on %p\n", adapter);
-+
-+ pvscsi_write_cmd_desc(adapter, PVSCSI_CMD_RESET_BUS, NULL, 0);
-+}
-+
-+static void ll_device_reset(const struct pvscsi_adapter *adapter, u32 target)
-+{
-+ struct PVSCSICmdDescResetDevice cmd = { 0 };
-+
-+ dev_dbg(pvscsi_dev(adapter), "Reseting device: target=%u\n", target);
-+
-+ cmd.target = target;
-+
-+ pvscsi_write_cmd_desc(adapter, PVSCSI_CMD_RESET_DEVICE,
-+ &cmd, sizeof(cmd));
-+}
-+
-+static void pvscsi_create_sg(struct pvscsi_ctx *ctx,
-+ struct scatterlist *sg, unsigned count)
-+{
-+ unsigned i;
-+ struct PVSCSISGElement *sge;
-+
-+ BUG_ON(count > PVSCSI_MAX_NUM_SG_ENTRIES_PER_SEGMENT);
-+
-+ sge = &ctx->sgl->sge[0];
-+ for (i = 0; i < count; i++, sg++) {
-+ sge[i].addr = sg_dma_address(sg);
-+ sge[i].length = sg_dma_len(sg);
-+ sge[i].flags = 0;
-+ }
-+}
-+
-+/*
-+ * Map all data buffers for a command into PCI space and
-+ * setup the scatter/gather list if needed.
-+ */
-+static void pvscsi_map_buffers(struct pvscsi_adapter *adapter,
-+ struct pvscsi_ctx *ctx, struct scsi_cmnd *cmd,
-+ struct PVSCSIRingReqDesc *e)
-+{
-+ unsigned count;
-+ unsigned bufflen = scsi_bufflen(cmd);
-+ struct scatterlist *sg;
-+
-+ e->dataLen = bufflen;
-+ e->dataAddr = 0;
-+ if (bufflen == 0)
-+ return;
-+
-+ sg = scsi_sglist(cmd);
-+ count = scsi_sg_count(cmd);
-+ if (count != 0) {
-+ int segs = scsi_dma_map(cmd);
-+ if (segs > 1) {
-+ pvscsi_create_sg(ctx, sg, segs);
-+
-+ e->flags |= PVSCSI_FLAG_CMD_WITH_SG_LIST;
-+ ctx->sglPA = pci_map_single(adapter->dev, ctx->sgl,
-+ SGL_SIZE, PCI_DMA_TODEVICE);
-+ e->dataAddr = ctx->sglPA;
-+ } else
-+ e->dataAddr = sg_dma_address(sg);
-+ } else {
-+ /*
-+ * In case there is no S/G list, scsi_sglist points
-+ * directly to the buffer.
-+ */
-+ ctx->dataPA = pci_map_single(adapter->dev, sg, bufflen,
-+ cmd->sc_data_direction);
-+ e->dataAddr = ctx->dataPA;
-+ }
-+}
-+
-+static void pvscsi_unmap_buffers(const struct pvscsi_adapter *adapter,
-+ struct pvscsi_ctx *ctx)
-+{
-+ struct scsi_cmnd *cmd;
-+ unsigned bufflen;
-+
-+ cmd = ctx->cmd;
-+ bufflen = scsi_bufflen(cmd);
-+
-+ if (bufflen != 0) {
-+ unsigned count = scsi_sg_count(cmd);
-+
-+ if (count != 0) {
-+ scsi_dma_unmap(cmd);
-+ if (ctx->sglPA) {
-+ pci_unmap_single(adapter->dev, ctx->sglPA,
-+ SGL_SIZE, PCI_DMA_TODEVICE);
-+ ctx->sglPA = 0;
-+ }
-+ } else
-+ pci_unmap_single(adapter->dev, ctx->dataPA, bufflen,
-+ cmd->sc_data_direction);
-+ }
-+ if (cmd->sense_buffer)
-+ pci_unmap_single(adapter->dev, ctx->sensePA,
-+ SCSI_SENSE_BUFFERSIZE, PCI_DMA_FROMDEVICE);
-+}
-+
-+static int __devinit pvscsi_allocate_rings(struct pvscsi_adapter *adapter)
-+{
-+ adapter->rings_state = pci_alloc_consistent(adapter->dev, PAGE_SIZE,
-+ &adapter->ringStatePA);
-+ if (!adapter->rings_state)
-+ return -ENOMEM;
-+
-+ adapter->req_pages = min(PVSCSI_MAX_NUM_PAGES_REQ_RING,
-+ pvscsi_ring_pages);
-+ adapter->req_depth = adapter->req_pages
-+ * PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE;
-+ adapter->req_ring = pci_alloc_consistent(adapter->dev,
-+ adapter->req_pages * PAGE_SIZE,
-+ &adapter->reqRingPA);
-+ if (!adapter->req_ring)
-+ return -ENOMEM;
-+
-+ adapter->cmp_pages = min(PVSCSI_MAX_NUM_PAGES_CMP_RING,
-+ pvscsi_ring_pages);
-+ adapter->cmp_ring = pci_alloc_consistent(adapter->dev,
-+ adapter->cmp_pages * PAGE_SIZE,
-+ &adapter->cmpRingPA);
-+ if (!adapter->cmp_ring)
-+ return -ENOMEM;
-+
-+ BUG_ON(!IS_ALIGNED(adapter->ringStatePA, PAGE_SIZE));
-+ BUG_ON(!IS_ALIGNED(adapter->reqRingPA, PAGE_SIZE));
-+ BUG_ON(!IS_ALIGNED(adapter->cmpRingPA, PAGE_SIZE));
-+
-+ if (!adapter->use_msg)
-+ return 0;
-+
-+ adapter->msg_pages = min(PVSCSI_MAX_NUM_PAGES_MSG_RING,
-+ pvscsi_msg_ring_pages);
-+ adapter->msg_ring = pci_alloc_consistent(adapter->dev,
-+ adapter->msg_pages * PAGE_SIZE,
-+ &adapter->msgRingPA);
-+ if (!adapter->msg_ring)
-+ return -ENOMEM;
-+ BUG_ON(!IS_ALIGNED(adapter->msgRingPA, PAGE_SIZE));
-+
-+ return 0;
-+}
-+
-+static void pvscsi_setup_all_rings(const struct pvscsi_adapter *adapter)
-+{
-+ struct PVSCSICmdDescSetupRings cmd = { 0 };
-+ dma_addr_t base;
-+ unsigned i;
-+
-+ cmd.ringsStatePPN = adapter->ringStatePA >> PAGE_SHIFT;
-+ cmd.reqRingNumPages = adapter->req_pages;
-+ cmd.cmpRingNumPages = adapter->cmp_pages;
-+
-+ base = adapter->reqRingPA;
-+ for (i = 0; i < adapter->req_pages; i++) {
-+ cmd.reqRingPPNs[i] = base >> PAGE_SHIFT;
-+ base += PAGE_SIZE;
-+ }
-+
-+ base = adapter->cmpRingPA;
-+ for (i = 0; i < adapter->cmp_pages; i++) {
-+ cmd.cmpRingPPNs[i] = base >> PAGE_SHIFT;
-+ base += PAGE_SIZE;
-+ }
-+
-+ memset(adapter->rings_state, 0, PAGE_SIZE);
-+ memset(adapter->req_ring, 0, adapter->req_pages * PAGE_SIZE);
-+ memset(adapter->cmp_ring, 0, adapter->cmp_pages * PAGE_SIZE);
-+
-+ pvscsi_write_cmd_desc(adapter, PVSCSI_CMD_SETUP_RINGS,
-+ &cmd, sizeof(cmd));
-+
-+ if (adapter->use_msg) {
-+ struct PVSCSICmdDescSetupMsgRing cmd_msg = { 0 };
-+
-+ cmd_msg.numPages = adapter->msg_pages;
-+
-+ base = adapter->msgRingPA;
-+ for (i = 0; i < adapter->msg_pages; i++) {
-+ cmd_msg.ringPPNs[i] = base >> PAGE_SHIFT;
-+ base += PAGE_SIZE;
-+ }
-+ memset(adapter->msg_ring, 0, adapter->msg_pages * PAGE_SIZE);
-+
-+ pvscsi_write_cmd_desc(adapter, PVSCSI_CMD_SETUP_MSG_RING,
-+ &cmd_msg, sizeof(cmd_msg));
-+ }
-+}
-+
-+/*
-+ * Pull a completion descriptor off and pass the completion back
-+ * to the SCSI mid layer.
-+ */
-+static void pvscsi_complete_request(struct pvscsi_adapter *adapter,
-+ const struct PVSCSIRingCmpDesc *e)
-+{
-+ struct pvscsi_ctx *ctx;
-+ struct scsi_cmnd *cmd;
-+ u32 btstat = e->hostStatus;
-+ u32 sdstat = e->scsiStatus;
-+
-+ ctx = pvscsi_get_context(adapter, e->context);
-+ cmd = ctx->cmd;
-+ pvscsi_unmap_buffers(adapter, ctx);
-+ pvscsi_release_context(adapter, ctx);
-+ cmd->result = 0;
-+
-+ if (sdstat != SAM_STAT_GOOD &&
-+ (btstat == BTSTAT_SUCCESS ||
-+ btstat == BTSTAT_LINKED_COMMAND_COMPLETED ||
-+ btstat == BTSTAT_LINKED_COMMAND_COMPLETED_WITH_FLAG)) {
-+ cmd->result = (DID_OK << 16) | sdstat;
-+ if (sdstat == SAM_STAT_CHECK_CONDITION && cmd->sense_buffer)
-+ cmd->result |= (DRIVER_SENSE << 24);
-+ } else
-+ switch (btstat) {
-+ case BTSTAT_SUCCESS:
-+ case BTSTAT_LINKED_COMMAND_COMPLETED:
-+ case BTSTAT_LINKED_COMMAND_COMPLETED_WITH_FLAG:
-+ /* If everything went fine, let's move on.. */
-+ cmd->result = (DID_OK << 16);
-+ break;
-+
-+ case BTSTAT_DATARUN:
-+ case BTSTAT_DATA_UNDERRUN:
-+ /* Report residual data in underruns */
-+ scsi_set_resid(cmd, scsi_bufflen(cmd) - e->dataLen);
-+ cmd->result = (DID_ERROR << 16);
-+ break;
-+
-+ case BTSTAT_SELTIMEO:
-+ /* Our emulation returns this for non-connected devs */
-+ cmd->result = (DID_BAD_TARGET << 16);
-+ break;
-+
-+ case BTSTAT_LUNMISMATCH:
-+ case BTSTAT_TAGREJECT:
-+ case BTSTAT_BADMSG:
-+ cmd->result = (DRIVER_INVALID << 24);
-+ /* fall through */
-+
-+ case BTSTAT_HAHARDWARE:
-+ case BTSTAT_INVPHASE:
-+ case BTSTAT_HATIMEOUT:
-+ case BTSTAT_NORESPONSE:
-+ case BTSTAT_DISCONNECT:
-+ case BTSTAT_HASOFTWARE:
-+ case BTSTAT_BUSFREE:
-+ case BTSTAT_SENSFAILED:
-+ cmd->result |= (DID_ERROR << 16);
-+ break;
-+
-+ case BTSTAT_SENTRST:
-+ case BTSTAT_RECVRST:
-+ case BTSTAT_BUSRESET:
-+ cmd->result = (DID_RESET << 16);
-+ break;
-+
-+ case BTSTAT_ABORTQUEUE:
-+ cmd->result = (DID_ABORT << 16);
-+ break;
-+
-+ case BTSTAT_SCSIPARITY:
-+ cmd->result = (DID_PARITY << 16);
-+ break;
-+
-+ default:
-+ cmd->result = (DID_ERROR << 16);
-+ scmd_printk(KERN_DEBUG, cmd,
-+ "Unknown completion status: 0x%x\n",
-+ btstat);
-+ }
-+
-+ dev_dbg(&cmd->device->sdev_gendev,
-+ "cmd=%p %x ctx=%p result=0x%x status=0x%x,%x\n",
-+ cmd, cmd->cmnd[0], ctx, cmd->result, btstat, sdstat);
-+
-+ cmd->scsi_done(cmd);
-+}
-+
-+/*
-+ * barrier usage : Since the PVSCSI device is emulated, there could be cases
-+ * where we may want to serialize some accesses between the driver and the
-+ * emulation layer. We use compiler barriers instead of the more expensive
-+ * memory barriers because PVSCSI is only supported on X86 which has strong
-+ * memory access ordering.
-+ */
-+static void pvscsi_process_completion_ring(struct pvscsi_adapter *adapter)
-+{
-+ struct PVSCSIRingsState *s = adapter->rings_state;
-+ struct PVSCSIRingCmpDesc *ring = adapter->cmp_ring;
-+ u32 cmp_entries = s->cmpNumEntriesLog2;
-+
-+ while (s->cmpConsIdx != s->cmpProdIdx) {
-+ struct PVSCSIRingCmpDesc *e = ring + (s->cmpConsIdx &
-+ MASK(cmp_entries));
-+ /*
-+ * This barrier() ensures that *e is not dereferenced while
-+ * the device emulation still writes data into the slot.
-+ * Since the device emulation advances s->cmpProdIdx only after
-+ * updating the slot we want to check it first.
-+ */
-+ barrier();
-+ pvscsi_complete_request(adapter, e);
-+ /*
-+ * This barrier() ensures that compiler doesn't reorder write
-+ * to s->cmpConsIdx before the read of (*e) inside
-+ * pvscsi_complete_request. Otherwise, device emulation may
-+ * overwrite *e before we had a chance to read it.
-+ */
-+ barrier();
-+ s->cmpConsIdx++;
-+ }
-+}
-+
-+/*
-+ * Translate a Linux SCSI request into a request ring entry.
-+ */
-+static int pvscsi_queue_ring(struct pvscsi_adapter *adapter,
-+ struct pvscsi_ctx *ctx, struct scsi_cmnd *cmd)
-+{
-+ struct PVSCSIRingsState *s;
-+ struct PVSCSIRingReqDesc *e;
-+ struct scsi_device *sdev;
-+ u32 req_entries;
-+
-+ s = adapter->rings_state;
-+ sdev = cmd->device;
-+ req_entries = s->reqNumEntriesLog2;
-+
-+ /*
-+ * If this condition holds, we might have room on the request ring, but
-+ * we might not have room on the completion ring for the response.
-+ * However, we have already ruled out this possibility - we would not
-+ * have successfully allocated a context if it were true, since we only
-+ * have one context per request entry. Check for it anyway, since it
-+ * would be a serious bug.
-+ */
-+ if (s->reqProdIdx - s->cmpConsIdx >= 1 << req_entries) {
-+ scmd_printk(KERN_ERR, cmd, "vmw_pvscsi: "
-+ "ring full: reqProdIdx=%d cmpConsIdx=%d\n",
-+ s->reqProdIdx, s->cmpConsIdx);
-+ return -1;
-+ }
-+
-+ e = adapter->req_ring + (s->reqProdIdx & MASK(req_entries));
-+
-+ e->bus = sdev->channel;
-+ e->target = sdev->id;
-+ memset(e->lun, 0, sizeof(e->lun));
-+ e->lun[1] = sdev->lun;
-+
-+ if (cmd->sense_buffer) {
-+ ctx->sensePA = pci_map_single(adapter->dev, cmd->sense_buffer,
-+ SCSI_SENSE_BUFFERSIZE,
-+ PCI_DMA_FROMDEVICE);
-+ e->senseAddr = ctx->sensePA;
-+ e->senseLen = SCSI_SENSE_BUFFERSIZE;
-+ } else {
-+ e->senseLen = 0;
-+ e->senseAddr = 0;
-+ }
-+ e->cdbLen = cmd->cmd_len;
-+ e->vcpuHint = smp_processor_id();
-+ memcpy(e->cdb, cmd->cmnd, e->cdbLen);
-+
-+ e->tag = SIMPLE_QUEUE_TAG;
-+ if (sdev->tagged_supported &&
-+ (cmd->tag == HEAD_OF_QUEUE_TAG ||
-+ cmd->tag == ORDERED_QUEUE_TAG))
-+ e->tag = cmd->tag;
-+
-+ if (cmd->sc_data_direction == DMA_FROM_DEVICE)
-+ e->flags = PVSCSI_FLAG_CMD_DIR_TOHOST;
-+ else if (cmd->sc_data_direction == DMA_TO_DEVICE)
-+ e->flags = PVSCSI_FLAG_CMD_DIR_TODEVICE;
-+ else if (cmd->sc_data_direction == DMA_NONE)
-+ e->flags = PVSCSI_FLAG_CMD_DIR_NONE;
-+ else
-+ e->flags = 0;
-+
-+ pvscsi_map_buffers(adapter, ctx, cmd, e);
-+
-+ e->context = pvscsi_map_context(adapter, ctx);
-+
-+ barrier();
-+
-+ s->reqProdIdx++;
-+
-+ return 0;
-+}
-+
-+static int pvscsi_queue(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *))
-+{
-+ struct Scsi_Host *host = cmd->device->host;
-+ struct pvscsi_adapter *adapter = shost_priv(host);
-+ struct pvscsi_ctx *ctx;
-+ unsigned long flags;
-+
-+ spin_lock_irqsave(&adapter->hw_lock, flags);
-+
-+ ctx = pvscsi_acquire_context(adapter, cmd);
-+ if (!ctx || pvscsi_queue_ring(adapter, ctx, cmd) != 0) {
-+ if (ctx)
-+ pvscsi_release_context(adapter, ctx);
-+ spin_unlock_irqrestore(&adapter->hw_lock, flags);
-+ return SCSI_MLQUEUE_HOST_BUSY;
-+ }
-+
-+ cmd->scsi_done = done;
-+
-+ dev_dbg(&cmd->device->sdev_gendev,
-+ "queued cmd %p, ctx %p, op=%x\n", cmd, ctx, cmd->cmnd[0]);
-+
-+ spin_unlock_irqrestore(&adapter->hw_lock, flags);
-+
-+ pvscsi_kick_io(adapter, cmd->cmnd[0]);
-+
-+ return 0;
-+}
-+
-+static int pvscsi_abort(struct scsi_cmnd *cmd)
-+{
-+ struct pvscsi_adapter *adapter = shost_priv(cmd->device->host);
-+ struct pvscsi_ctx *ctx;
-+ unsigned long flags;
-+
-+ scmd_printk(KERN_DEBUG, cmd, "task abort on host %u, %p\n",
-+ adapter->host->host_no, cmd);
-+
-+ spin_lock_irqsave(&adapter->hw_lock, flags);
-+
-+ /*
-+ * Poll the completion ring first - we might be trying to abort
-+ * a command that is waiting to be dispatched in the completion ring.
-+ */
-+ pvscsi_process_completion_ring(adapter);
-+
-+ /*
-+ * If there is no context for the command, it either already succeeded
-+ * or else was never properly issued. Not our problem.
-+ */
-+ ctx = pvscsi_find_context(adapter, cmd);
-+ if (!ctx) {
-+ scmd_printk(KERN_DEBUG, cmd, "Failed to abort cmd %p\n", cmd);
-+ goto out;
-+ }
-+
-+ pvscsi_abort_cmd(adapter, ctx);
-+
-+ pvscsi_process_completion_ring(adapter);
-+
-+out:
-+ spin_unlock_irqrestore(&adapter->hw_lock, flags);
-+ return SUCCESS;
-+}
-+
-+/*
-+ * Abort all outstanding requests. This is only safe to use if the completion
-+ * ring will never be walked again or the device has been reset, because it
-+ * destroys the 1-1 mapping between context field passed to emulation and our
-+ * request structure.
-+ */
-+static void pvscsi_reset_all(struct pvscsi_adapter *adapter)
-+{
-+ unsigned i;
-+
-+ for (i = 0; i < adapter->req_depth; i++) {
-+ struct pvscsi_ctx *ctx = &adapter->cmd_map[i];
-+ struct scsi_cmnd *cmd = ctx->cmd;
-+ if (cmd) {
-+ scmd_printk(KERN_ERR, cmd,
-+ "Forced reset on cmd %p\n", cmd);
-+ pvscsi_unmap_buffers(adapter, ctx);
-+ pvscsi_release_context(adapter, ctx);
-+ cmd->result = (DID_RESET << 16);
-+ cmd->scsi_done(cmd);
-+ }
-+ }
-+}
-+
-+static int pvscsi_host_reset(struct scsi_cmnd *cmd)
-+{
-+ struct Scsi_Host *host = cmd->device->host;
-+ struct pvscsi_adapter *adapter = shost_priv(host);
-+ unsigned long flags;
-+ bool use_msg;
-+
-+ scmd_printk(KERN_INFO, cmd, "SCSI Host reset\n");
-+
-+ spin_lock_irqsave(&adapter->hw_lock, flags);
-+
-+ use_msg = adapter->use_msg;
-+
-+ if (use_msg) {
-+ adapter->use_msg = 0;
-+ spin_unlock_irqrestore(&adapter->hw_lock, flags);
-+
-+ /*
-+ * Now that we know that the ISR won't add more work on the
-+ * workqueue we can safely flush any outstanding work.
-+ */
-+ flush_workqueue(adapter->workqueue);
-+ spin_lock_irqsave(&adapter->hw_lock, flags);
-+ }
-+
-+ /*
-+ * We're going to tear down the entire ring structure and set it back
-+ * up, so stalling new requests until all completions are flushed and
-+ * the rings are back in place.
-+ */
-+
-+ pvscsi_process_request_ring(adapter);
-+
-+ ll_adapter_reset(adapter);
-+
-+ /*
-+ * Now process any completions. Note we do this AFTER adapter reset,
-+ * which is strange, but stops races where completions get posted
-+ * between processing the ring and issuing the reset. The backend will
-+ * not touch the ring memory after reset, so the immediately pre-reset
-+ * completion ring state is still valid.
-+ */
-+ pvscsi_process_completion_ring(adapter);
-+
-+ pvscsi_reset_all(adapter);
-+ adapter->use_msg = use_msg;
-+ pvscsi_setup_all_rings(adapter);
-+ pvscsi_unmask_intr(adapter);
-+
-+ spin_unlock_irqrestore(&adapter->hw_lock, flags);
-+
-+ return SUCCESS;
-+}
-+
-+static int pvscsi_bus_reset(struct scsi_cmnd *cmd)
-+{
-+ struct Scsi_Host *host = cmd->device->host;
-+ struct pvscsi_adapter *adapter = shost_priv(host);
-+ unsigned long flags;
-+
-+ scmd_printk(KERN_INFO, cmd, "SCSI Bus reset\n");
-+
-+ /*
-+ * We don't want to queue new requests for this bus after
-+ * flushing all pending requests to emulation, since new
-+ * requests could then sneak in during this bus reset phase,
-+ * so take the lock now.
-+ */
-+ spin_lock_irqsave(&adapter->hw_lock, flags);
-+
-+ pvscsi_process_request_ring(adapter);
-+ ll_bus_reset(adapter);
-+ pvscsi_process_completion_ring(adapter);
-+
-+ spin_unlock_irqrestore(&adapter->hw_lock, flags);
-+
-+ return SUCCESS;
-+}
-+
-+static int pvscsi_device_reset(struct scsi_cmnd *cmd)
-+{
-+ struct Scsi_Host *host = cmd->device->host;
-+ struct pvscsi_adapter *adapter = shost_priv(host);
-+ unsigned long flags;
-+
-+ scmd_printk(KERN_INFO, cmd, "SCSI device reset on scsi%u:%u\n",
-+ host->host_no, cmd->device->id);
-+
-+ /*
-+ * We don't want to queue new requests for this device after flushing
-+ * all pending requests to emulation, since new requests could then
-+ * sneak in during this device reset phase, so take the lock now.
-+ */
-+ spin_lock_irqsave(&adapter->hw_lock, flags);
-+
-+ pvscsi_process_request_ring(adapter);
-+ ll_device_reset(adapter, cmd->device->id);
-+ pvscsi_process_completion_ring(adapter);
-+
-+ spin_unlock_irqrestore(&adapter->hw_lock, flags);
-+
-+ return SUCCESS;
-+}
-+
-+static struct scsi_host_template pvscsi_template;
-+
-+static const char *pvscsi_info(struct Scsi_Host *host)
-+{
-+ struct pvscsi_adapter *adapter = shost_priv(host);
-+ static char buf[256];
-+
-+ sprintf(buf, "VMware PVSCSI storage adapter rev %d, req/cmp/msg rings: "
-+ "%u/%u/%u pages, cmd_per_lun=%u", adapter->rev,
-+ adapter->req_pages, adapter->cmp_pages, adapter->msg_pages,
-+ pvscsi_template.cmd_per_lun);
-+
-+ return buf;
-+}
-+
-+static struct scsi_host_template pvscsi_template = {
-+ .module = THIS_MODULE,
-+ .name = "VMware PVSCSI Host Adapter",
-+ .proc_name = "vmw_pvscsi",
-+ .info = pvscsi_info,
-+ .queuecommand = pvscsi_queue,
-+ .this_id = -1,
-+ .sg_tablesize = PVSCSI_MAX_NUM_SG_ENTRIES_PER_SEGMENT,
-+ .dma_boundary = UINT_MAX,
-+ .max_sectors = 0xffff,
-+ .use_clustering = ENABLE_CLUSTERING,
-+ .eh_abort_handler = pvscsi_abort,
-+ .eh_device_reset_handler = pvscsi_device_reset,
-+ .eh_bus_reset_handler = pvscsi_bus_reset,
-+ .eh_host_reset_handler = pvscsi_host_reset,
-+};
-+
-+static void pvscsi_process_msg(const struct pvscsi_adapter *adapter,
-+ const struct PVSCSIRingMsgDesc *e)
-+{
-+ struct PVSCSIRingsState *s = adapter->rings_state;
-+ struct Scsi_Host *host = adapter->host;
-+ struct scsi_device *sdev;
-+
-+ printk(KERN_INFO "vmw_pvscsi: msg type: 0x%x - MSG RING: %u/%u (%u) \n",
-+ e->type, s->msgProdIdx, s->msgConsIdx, s->msgNumEntriesLog2);
-+
-+ BUILD_BUG_ON(PVSCSI_MSG_LAST != 2);
-+
-+ if (e->type == PVSCSI_MSG_DEV_ADDED) {
-+ struct PVSCSIMsgDescDevStatusChanged *desc;
-+ desc = (struct PVSCSIMsgDescDevStatusChanged *)e;
-+
-+ printk(KERN_INFO
-+ "vmw_pvscsi: msg: device added at scsi%u:%u:%u\n",
-+ desc->bus, desc->target, desc->lun[1]);
-+
-+ if (!scsi_host_get(host))
-+ return;
-+
-+ sdev = scsi_device_lookup(host, desc->bus, desc->target,
-+ desc->lun[1]);
-+ if (sdev) {
-+ printk(KERN_INFO "vmw_pvscsi: device already exists\n");
-+ scsi_device_put(sdev);
-+ } else
-+ scsi_add_device(adapter->host, desc->bus,
-+ desc->target, desc->lun[1]);
-+
-+ scsi_host_put(host);
-+ } else if (e->type == PVSCSI_MSG_DEV_REMOVED) {
-+ struct PVSCSIMsgDescDevStatusChanged *desc;
-+ desc = (struct PVSCSIMsgDescDevStatusChanged *)e;
-+
-+ printk(KERN_INFO
-+ "vmw_pvscsi: msg: device removed at scsi%u:%u:%u\n",
-+ desc->bus, desc->target, desc->lun[1]);
-+
-+ if (!scsi_host_get(host))
-+ return;
-+
-+ sdev = scsi_device_lookup(host, desc->bus, desc->target,
-+ desc->lun[1]);
-+ if (sdev) {
-+ scsi_remove_device(sdev);
-+ scsi_device_put(sdev);
-+ } else
-+ printk(KERN_INFO
-+ "vmw_pvscsi: failed to lookup scsi%u:%u:%u\n",
-+ desc->bus, desc->target, desc->lun[1]);
-+
-+ scsi_host_put(host);
-+ }
-+}
-+
-+static int pvscsi_msg_pending(const struct pvscsi_adapter *adapter)
-+{
-+ struct PVSCSIRingsState *s = adapter->rings_state;
-+
-+ return s->msgProdIdx != s->msgConsIdx;
-+}
-+
-+static void pvscsi_process_msg_ring(const struct pvscsi_adapter *adapter)
-+{
-+ struct PVSCSIRingsState *s = adapter->rings_state;
-+ struct PVSCSIRingMsgDesc *ring = adapter->msg_ring;
-+ u32 msg_entries = s->msgNumEntriesLog2;
-+
-+ while (pvscsi_msg_pending(adapter)) {
-+ struct PVSCSIRingMsgDesc *e = ring + (s->msgConsIdx &
-+ MASK(msg_entries));
-+
-+ barrier();
-+ pvscsi_process_msg(adapter, e);
-+ barrier();
-+ s->msgConsIdx++;
-+ }
-+}
-+
-+static void pvscsi_msg_workqueue_handler(struct work_struct *data)
-+{
-+ struct pvscsi_adapter *adapter;
-+
-+ adapter = container_of(data, struct pvscsi_adapter, work);
-+
-+ pvscsi_process_msg_ring(adapter);
-+}
-+
-+static int pvscsi_setup_msg_workqueue(struct pvscsi_adapter *adapter)
-+{
-+ char name[32];
-+
-+ if (!pvscsi_use_msg)
-+ return 0;
-+
-+ pvscsi_reg_write(adapter, PVSCSI_REG_OFFSET_COMMAND,
-+ PVSCSI_CMD_SETUP_MSG_RING);
-+
-+ if (pvscsi_reg_read(adapter, PVSCSI_REG_OFFSET_COMMAND_STATUS) == -1)
-+ return 0;
-+
-+ snprintf(name, sizeof(name),
-+ "vmw_pvscsi_wq_%u", adapter->host->host_no);
-+
-+ adapter->workqueue = create_singlethread_workqueue(name);
-+ if (!adapter->workqueue) {
-+ printk(KERN_ERR "vmw_pvscsi: failed to create work queue\n");
-+ return 0;
-+ }
-+ INIT_WORK(&adapter->work, pvscsi_msg_workqueue_handler);
-+
-+ return 1;
-+}
-+
-+static irqreturn_t pvscsi_isr(int irq, void *devp)
-+{
-+ struct pvscsi_adapter *adapter = devp;
-+ int handled;
-+
-+ if (adapter->use_msi || adapter->use_msix)
-+ handled = true;
-+ else {
-+ u32 val = pvscsi_read_intr_status(adapter);
-+ handled = (val & PVSCSI_INTR_ALL_SUPPORTED) != 0;
-+ if (handled)
-+ pvscsi_write_intr_status(devp, val);
-+ }
-+
-+ if (handled) {
-+ unsigned long flags;
-+
-+ spin_lock_irqsave(&adapter->hw_lock, flags);
-+
-+ pvscsi_process_completion_ring(adapter);
-+ if (adapter->use_msg && pvscsi_msg_pending(adapter))
-+ queue_work(adapter->workqueue, &adapter->work);
-+
-+ spin_unlock_irqrestore(&adapter->hw_lock, flags);
-+ }
-+
-+ return IRQ_RETVAL(handled);
-+}
-+
-+static void pvscsi_free_sgls(const struct pvscsi_adapter *adapter)
-+{
-+ struct pvscsi_ctx *ctx = adapter->cmd_map;
-+ unsigned i;
-+
-+ for (i = 0; i < adapter->req_depth; ++i, ++ctx)
-+ kfree(ctx->sgl);
-+}
-+
-+static int pvscsi_setup_msix(const struct pvscsi_adapter *adapter, int *irq)
-+{
-+ struct msix_entry entry = { 0, PVSCSI_VECTOR_COMPLETION };
-+ int ret;
-+
-+ ret = pci_enable_msix(adapter->dev, &entry, 1);
-+ if (ret)
-+ return ret;
-+
-+ *irq = entry.vector;
-+
-+ return 0;
-+}
-+
-+static void pvscsi_shutdown_intr(struct pvscsi_adapter *adapter)
-+{
-+ if (adapter->irq) {
-+ free_irq(adapter->irq, adapter);
-+ adapter->irq = 0;
-+ }
-+ if (adapter->use_msi) {
-+ pci_disable_msi(adapter->dev);
-+ adapter->use_msi = 0;
-+ } else if (adapter->use_msix) {
-+ pci_disable_msix(adapter->dev);
-+ adapter->use_msix = 0;
-+ }
-+}
-+
-+static void pvscsi_release_resources(struct pvscsi_adapter *adapter)
-+{
-+ pvscsi_shutdown_intr(adapter);
-+
-+ if (adapter->workqueue)
-+ destroy_workqueue(adapter->workqueue);
-+
-+ if (adapter->mmioBase)
-+ pci_iounmap(adapter->dev, adapter->mmioBase);
-+
-+ pci_release_regions(adapter->dev);
-+
-+ if (adapter->cmd_map) {
-+ pvscsi_free_sgls(adapter);
-+ kfree(adapter->cmd_map);
-+ }
-+
-+ if (adapter->rings_state)
-+ pci_free_consistent(adapter->dev, PAGE_SIZE,
-+ adapter->rings_state, adapter->ringStatePA);
-+
-+ if (adapter->req_ring)
-+ pci_free_consistent(adapter->dev,
-+ adapter->req_pages * PAGE_SIZE,
-+ adapter->req_ring, adapter->reqRingPA);
-+
-+ if (adapter->cmp_ring)
-+ pci_free_consistent(adapter->dev,
-+ adapter->cmp_pages * PAGE_SIZE,
-+ adapter->cmp_ring, adapter->cmpRingPA);
-+
-+ if (adapter->msg_ring)
-+ pci_free_consistent(adapter->dev,
-+ adapter->msg_pages * PAGE_SIZE,
-+ adapter->msg_ring, adapter->msgRingPA);
-+}
-+
-+/*
-+ * Allocate scatter gather lists.
-+ *
-+ * These are statically allocated. Trying to be clever was not worth it.
-+ *
-+ * Dynamic allocation can fail, and we can't go deeep into the memory
-+ * allocator, since we're a SCSI driver, and trying too hard to allocate
-+ * memory might generate disk I/O. We also don't want to fail disk I/O
-+ * in that case because we can't get an allocation - the I/O could be
-+ * trying to swap out data to free memory. Since that is pathological,
-+ * just use a statically allocated scatter list.
-+ *
-+ */
-+static int __devinit pvscsi_allocate_sg(struct pvscsi_adapter *adapter)
-+{
-+ struct pvscsi_ctx *ctx;
-+ int i;
-+
-+ ctx = adapter->cmd_map;
-+ BUILD_BUG_ON(sizeof(struct pvscsi_sg_list) > SGL_SIZE);
-+
-+ for (i = 0; i < adapter->req_depth; ++i, ++ctx) {
-+ ctx->sgl = kmalloc(SGL_SIZE, GFP_KERNEL);
-+ ctx->sglPA = 0;
-+ BUG_ON(!IS_ALIGNED(((unsigned long)ctx->sgl), PAGE_SIZE));
-+ if (!ctx->sgl) {
-+ for (; i >= 0; --i, --ctx) {
-+ kfree(ctx->sgl);
-+ ctx->sgl = NULL;
-+ }
-+ return -ENOMEM;
-+ }
-+ }
-+
-+ return 0;
-+}
-+
-+static int __devinit pvscsi_probe(struct pci_dev *pdev,
-+ const struct pci_device_id *id)
-+{
-+ struct pvscsi_adapter *adapter;
-+ struct Scsi_Host *host;
-+ unsigned int i;
-+ int error;
-+
-+ error = -ENODEV;
-+
-+ if (pci_enable_device(pdev))
-+ return error;
-+
-+ if (pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) == 0 &&
-+ pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64)) == 0) {
-+ printk(KERN_INFO "vmw_pvscsi: using 64bit dma\n");
-+ } else if (pci_set_dma_mask(pdev, DMA_BIT_MASK(32)) == 0 &&
-+ pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32)) == 0) {
-+ printk(KERN_INFO "vmw_pvscsi: using 32bit dma\n");
-+ } else {
-+ printk(KERN_ERR "vmw_pvscsi: failed to set DMA mask\n");
-+ goto out_disable_device;
-+ }
-+
-+ pvscsi_template.can_queue =
-+ min(PVSCSI_MAX_NUM_PAGES_REQ_RING, pvscsi_ring_pages) *
-+ PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE;
-+ pvscsi_template.cmd_per_lun =
-+ min(pvscsi_template.can_queue, pvscsi_cmd_per_lun);
-+ host = scsi_host_alloc(&pvscsi_template, sizeof(struct pvscsi_adapter));
-+ if (!host) {
-+ printk(KERN_ERR "vmw_pvscsi: failed to allocate host\n");
-+ goto out_disable_device;
-+ }
-+
-+ adapter = shost_priv(host);
-+ memset(adapter, 0, sizeof(*adapter));
-+ adapter->dev = pdev;
-+ adapter->host = host;
-+
-+ spin_lock_init(&adapter->hw_lock);
-+
-+ host->max_channel = 0;
-+ host->max_id = 16;
-+ host->max_lun = 1;
-+ host->max_cmd_len = 16;
-+
-+ adapter->rev = pdev->revision;
-+
-+ if (pci_request_regions(pdev, "vmw_pvscsi")) {
-+ printk(KERN_ERR "vmw_pvscsi: pci memory selection failed\n");
-+ goto out_free_host;
-+ }
-+
-+ for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
-+ if ((pci_resource_flags(pdev, i) & PCI_BASE_ADDRESS_SPACE_IO))
-+ continue;
-+
-+ if (pci_resource_len(pdev, i) < PVSCSI_MEM_SPACE_SIZE)
-+ continue;
-+
-+ break;
-+ }
-+
-+ if (i == DEVICE_COUNT_RESOURCE) {
-+ printk(KERN_ERR
-+ "vmw_pvscsi: adapter has no suitable MMIO region\n");
-+ goto out_release_resources;
-+ }
-+
-+ adapter->mmioBase = pci_iomap(pdev, i, PVSCSI_MEM_SPACE_SIZE);
-+
-+ if (!adapter->mmioBase) {
-+ printk(KERN_ERR
-+ "vmw_pvscsi: can't iomap for BAR %d memsize %lu\n",
-+ i, PVSCSI_MEM_SPACE_SIZE);
-+ goto out_release_resources;
-+ }
-+
-+ pci_set_master(pdev);
-+ pci_set_drvdata(pdev, host);
-+
-+ ll_adapter_reset(adapter);
-+
-+ adapter->use_msg = pvscsi_setup_msg_workqueue(adapter);
-+
-+ error = pvscsi_allocate_rings(adapter);
-+ if (error) {
-+ printk(KERN_ERR "vmw_pvscsi: unable to allocate ring memory\n");
-+ goto out_release_resources;
-+ }
-+
-+ /*
-+ * From this point on we should reset the adapter if anything goes
-+ * wrong.
-+ */
-+ pvscsi_setup_all_rings(adapter);
-+
-+ adapter->cmd_map = kcalloc(adapter->req_depth,
-+ sizeof(struct pvscsi_ctx), GFP_KERNEL);
-+ if (!adapter->cmd_map) {
-+ printk(KERN_ERR "vmw_pvscsi: failed to allocate memory.\n");
-+ error = -ENOMEM;
-+ goto out_reset_adapter;
-+ }
-+
-+ INIT_LIST_HEAD(&adapter->cmd_pool);
-+ for (i = 0; i < adapter->req_depth; i++) {
-+ struct pvscsi_ctx *ctx = adapter->cmd_map + i;
-+ list_add(&ctx->list, &adapter->cmd_pool);
-+ }
-+
-+ error = pvscsi_allocate_sg(adapter);
-+ if (error) {
-+ printk(KERN_ERR "vmw_pvscsi: unable to allocate s/g table\n");
-+ goto out_reset_adapter;
-+ }
-+
-+ if (!pvscsi_disable_msix &&
-+ pvscsi_setup_msix(adapter, &adapter->irq) == 0) {
-+ printk(KERN_INFO "vmw_pvscsi: using MSI-X\n");
-+ adapter->use_msix = 1;
-+ } else if (!pvscsi_disable_msi && pci_enable_msi(pdev) == 0) {
-+ printk(KERN_INFO "vmw_pvscsi: using MSI\n");
-+ adapter->use_msi = 1;
-+ adapter->irq = pdev->irq;
-+ } else {
-+ printk(KERN_INFO "vmw_pvscsi: using INTx\n");
-+ adapter->irq = pdev->irq;
-+ }
-+
-+ error = request_irq(adapter->irq, pvscsi_isr, IRQF_SHARED,
-+ "vmw_pvscsi", adapter);
-+ if (error) {
-+ printk(KERN_ERR
-+ "vmw_pvscsi: unable to request IRQ: %d\n", error);
-+ adapter->irq = 0;
-+ goto out_reset_adapter;
-+ }
-+
-+ error = scsi_add_host(host, &pdev->dev);
-+ if (error) {
-+ printk(KERN_ERR
-+ "vmw_pvscsi: scsi_add_host failed: %d\n", error);
-+ goto out_reset_adapter;
-+ }
-+
-+ dev_info(&pdev->dev, "VMware PVSCSI rev %d host #%u\n",
-+ adapter->rev, host->host_no);
-+
-+ pvscsi_unmask_intr(adapter);
-+
-+ scsi_scan_host(host);
-+
-+ return 0;
-+
-+out_reset_adapter:
-+ ll_adapter_reset(adapter);
-+out_release_resources:
-+ pvscsi_release_resources(adapter);
-+out_free_host:
-+ scsi_host_put(host);
-+out_disable_device:
-+ pci_set_drvdata(pdev, NULL);
-+ pci_disable_device(pdev);
-+
-+ return error;
-+}
-+
-+static void __pvscsi_shutdown(struct pvscsi_adapter *adapter)
-+{
-+ pvscsi_mask_intr(adapter);
-+
-+ if (adapter->workqueue)
-+ flush_workqueue(adapter->workqueue);
-+
-+ pvscsi_shutdown_intr(adapter);
-+
-+ pvscsi_process_request_ring(adapter);
-+ pvscsi_process_completion_ring(adapter);
-+ ll_adapter_reset(adapter);
-+}
-+
-+static void pvscsi_shutdown(struct pci_dev *dev)
-+{
-+ struct Scsi_Host *host = pci_get_drvdata(dev);
-+ struct pvscsi_adapter *adapter = shost_priv(host);
-+
-+ __pvscsi_shutdown(adapter);
-+}
-+
-+static void pvscsi_remove(struct pci_dev *pdev)
-+{
-+ struct Scsi_Host *host = pci_get_drvdata(pdev);
-+ struct pvscsi_adapter *adapter = shost_priv(host);
-+
-+ scsi_remove_host(host);
-+
-+ __pvscsi_shutdown(adapter);
-+ pvscsi_release_resources(adapter);
-+
-+ scsi_host_put(host);
-+
-+ pci_set_drvdata(pdev, NULL);
-+ pci_disable_device(pdev);
-+}
-+
-+static struct pci_driver pvscsi_pci_driver = {
-+ .name = "vmw_pvscsi",
-+ .id_table = pvscsi_pci_tbl,
-+ .probe = pvscsi_probe,
-+ .remove = __devexit_p(pvscsi_remove),
-+ .shutdown = pvscsi_shutdown,
-+};
-+
-+static int __init pvscsi_init(void)
-+{
-+ pr_info("%s - version %s\n",
-+ PVSCSI_LINUX_DRIVER_DESC, PVSCSI_DRIVER_VERSION_STRING);
-+ return pci_register_driver(&pvscsi_pci_driver);
-+}
-+
-+static void __exit pvscsi_exit(void)
-+{
-+ pci_unregister_driver(&pvscsi_pci_driver);
-+}
-+
-+module_init(pvscsi_init);
-+module_exit(pvscsi_exit);
-diff --git a/drivers/scsi/vmw_pvscsi.h b/drivers/scsi/vmw_pvscsi.h
-new file mode 100644
-index 0000000..62e36e7
---- /dev/null
-+++ b/drivers/scsi/vmw_pvscsi.h
-@@ -0,0 +1,397 @@
-+/*
-+ * VMware PVSCSI header file
-+ *
-+ * Copyright (C) 2008-2009, VMware, Inc. All Rights Reserved.
-+ *
-+ * This program is free software; you can redistribute it and/or modify it
-+ * under the terms of the GNU General Public License as published by the
-+ * Free Software Foundation; version 2 of the License and no later version.
-+ *
-+ * This program is distributed in the hope that it will be useful, but
-+ * WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
-+ * NON INFRINGEMENT. See the GNU General Public License for more
-+ * details.
-+ *
-+ * You should have received a copy of the GNU General Public License
-+ * along with this program; if not, write to the Free Software
-+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
-+ *
-+ * Maintained by: Alok N Kataria <akataria@vmware.com>
-+ *
-+ */
-+
-+#ifndef _VMW_PVSCSI_H_
-+#define _VMW_PVSCSI_H_
-+
-+#include <linux/types.h>
-+
-+#define PVSCSI_DRIVER_VERSION_STRING "1.0.1.0-k"
-+
-+#define PVSCSI_MAX_NUM_SG_ENTRIES_PER_SEGMENT 128
-+
-+#define MASK(n) ((1 << (n)) - 1) /* make an n-bit mask */
-+
-+#define PCI_VENDOR_ID_VMWARE 0x15AD
-+#define PCI_DEVICE_ID_VMWARE_PVSCSI 0x07C0
-+
-+/*
-+ * host adapter status/error codes
-+ */
-+enum HostBusAdapterStatus {
-+ BTSTAT_SUCCESS = 0x00, /* CCB complete normally with no errors */
-+ BTSTAT_LINKED_COMMAND_COMPLETED = 0x0a,
-+ BTSTAT_LINKED_COMMAND_COMPLETED_WITH_FLAG = 0x0b,
-+ BTSTAT_DATA_UNDERRUN = 0x0c,
-+ BTSTAT_SELTIMEO = 0x11, /* SCSI selection timeout */
-+ BTSTAT_DATARUN = 0x12, /* data overrun/underrun */
-+ BTSTAT_BUSFREE = 0x13, /* unexpected bus free */
-+ BTSTAT_INVPHASE = 0x14, /* invalid bus phase or sequence requested by target */
-+ BTSTAT_LUNMISMATCH = 0x17, /* linked CCB has different LUN from first CCB */
-+ BTSTAT_SENSFAILED = 0x1b, /* auto request sense failed */
-+ BTSTAT_TAGREJECT = 0x1c, /* SCSI II tagged queueing message rejected by target */
-+ BTSTAT_BADMSG = 0x1d, /* unsupported message received by the host adapter */
-+ BTSTAT_HAHARDWARE = 0x20, /* host adapter hardware failed */
-+ BTSTAT_NORESPONSE = 0x21, /* target did not respond to SCSI ATN, sent a SCSI RST */
-+ BTSTAT_SENTRST = 0x22, /* host adapter asserted a SCSI RST */
-+ BTSTAT_RECVRST = 0x23, /* other SCSI devices asserted a SCSI RST */
-+ BTSTAT_DISCONNECT = 0x24, /* target device reconnected improperly (w/o tag) */
-+ BTSTAT_BUSRESET = 0x25, /* host adapter issued BUS device reset */
-+ BTSTAT_ABORTQUEUE = 0x26, /* abort queue generated */
-+ BTSTAT_HASOFTWARE = 0x27, /* host adapter software error */
-+ BTSTAT_HATIMEOUT = 0x30, /* host adapter hardware timeout error */
-+ BTSTAT_SCSIPARITY = 0x34, /* SCSI parity error detected */
-+};
-+
-+/*
-+ * Register offsets.
-+ *
-+ * These registers are accessible both via i/o space and mm i/o.
-+ */
-+
-+enum PVSCSIRegOffset {
-+ PVSCSI_REG_OFFSET_COMMAND = 0x0,
-+ PVSCSI_REG_OFFSET_COMMAND_DATA = 0x4,
-+ PVSCSI_REG_OFFSET_COMMAND_STATUS = 0x8,
-+ PVSCSI_REG_OFFSET_LAST_STS_0 = 0x100,
-+ PVSCSI_REG_OFFSET_LAST_STS_1 = 0x104,
-+ PVSCSI_REG_OFFSET_LAST_STS_2 = 0x108,
-+ PVSCSI_REG_OFFSET_LAST_STS_3 = 0x10c,
-+ PVSCSI_REG_OFFSET_INTR_STATUS = 0x100c,
-+ PVSCSI_REG_OFFSET_INTR_MASK = 0x2010,
-+ PVSCSI_REG_OFFSET_KICK_NON_RW_IO = 0x3014,
-+ PVSCSI_REG_OFFSET_DEBUG = 0x3018,
-+ PVSCSI_REG_OFFSET_KICK_RW_IO = 0x4018,
-+};
-+
-+/*
-+ * Virtual h/w commands.
-+ */
-+
-+enum PVSCSICommands {
-+ PVSCSI_CMD_FIRST = 0, /* has to be first */
-+
-+ PVSCSI_CMD_ADAPTER_RESET = 1,
-+ PVSCSI_CMD_ISSUE_SCSI = 2,
-+ PVSCSI_CMD_SETUP_RINGS = 3,
-+ PVSCSI_CMD_RESET_BUS = 4,
-+ PVSCSI_CMD_RESET_DEVICE = 5,
-+ PVSCSI_CMD_ABORT_CMD = 6,
-+ PVSCSI_CMD_CONFIG = 7,
-+ PVSCSI_CMD_SETUP_MSG_RING = 8,
-+ PVSCSI_CMD_DEVICE_UNPLUG = 9,
-+
-+ PVSCSI_CMD_LAST = 10 /* has to be last */
-+};
-+
-+/*
-+ * Command descriptor for PVSCSI_CMD_RESET_DEVICE --
-+ */
-+
-+struct PVSCSICmdDescResetDevice {
-+ u32 target;
-+ u8 lun[8];
-+} __packed;
-+
-+/*
-+ * Command descriptor for PVSCSI_CMD_ABORT_CMD --
-+ *
-+ * - currently does not support specifying the LUN.
-+ * - _pad should be 0.
-+ */
-+
-+struct PVSCSICmdDescAbortCmd {
-+ u64 context;
-+ u32 target;
-+ u32 _pad;
-+} __packed;
-+
-+/*
-+ * Command descriptor for PVSCSI_CMD_SETUP_RINGS --
-+ *
-+ * Notes:
-+ * - reqRingNumPages and cmpRingNumPages need to be power of two.
-+ * - reqRingNumPages and cmpRingNumPages need to be different from 0,
-+ * - reqRingNumPages and cmpRingNumPages need to be inferior to
-+ * PVSCSI_SETUP_RINGS_MAX_NUM_PAGES.
-+ */
-+
-+#define PVSCSI_SETUP_RINGS_MAX_NUM_PAGES 32
-+struct PVSCSICmdDescSetupRings {
-+ u32 reqRingNumPages;
-+ u32 cmpRingNumPages;
-+ u64 ringsStatePPN;
-+ u64 reqRingPPNs[PVSCSI_SETUP_RINGS_MAX_NUM_PAGES];
-+ u64 cmpRingPPNs[PVSCSI_SETUP_RINGS_MAX_NUM_PAGES];
-+} __packed;
-+
-+/*
-+ * Command descriptor for PVSCSI_CMD_SETUP_MSG_RING --
-+ *
-+ * Notes:
-+ * - this command was not supported in the initial revision of the h/w
-+ * interface. Before using it, you need to check that it is supported by
-+ * writing PVSCSI_CMD_SETUP_MSG_RING to the 'command' register, then
-+ * immediately after read the 'command status' register:
-+ * * a value of -1 means that the cmd is NOT supported,
-+ * * a value != -1 means that the cmd IS supported.
-+ * If it's supported the 'command status' register should return:
-+ * sizeof(PVSCSICmdDescSetupMsgRing) / sizeof(u32).
-+ * - this command should be issued _after_ the usual SETUP_RINGS so that the
-+ * RingsState page is already setup. If not, the command is a nop.
-+ * - numPages needs to be a power of two,
-+ * - numPages needs to be different from 0,
-+ * - _pad should be zero.
-+ */
-+
-+#define PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES 16
-+
-+struct PVSCSICmdDescSetupMsgRing {
-+ u32 numPages;
-+ u32 _pad;
-+ u64 ringPPNs[PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES];
-+} __packed;
-+
-+enum PVSCSIMsgType {
-+ PVSCSI_MSG_DEV_ADDED = 0,
-+ PVSCSI_MSG_DEV_REMOVED = 1,
-+ PVSCSI_MSG_LAST = 2,
-+};
-+
-+/*
-+ * Msg descriptor.
-+ *
-+ * sizeof(struct PVSCSIRingMsgDesc) == 128.
-+ *
-+ * - type is of type enum PVSCSIMsgType.
-+ * - the content of args depend on the type of event being delivered.
-+ */
-+
-+struct PVSCSIRingMsgDesc {
-+ u32 type;
-+ u32 args[31];
-+} __packed;
-+
-+struct PVSCSIMsgDescDevStatusChanged {
-+ u32 type; /* PVSCSI_MSG_DEV _ADDED / _REMOVED */
-+ u32 bus;
-+ u32 target;
-+ u8 lun[8];
-+ u32 pad[27];
-+} __packed;
-+
-+/*
-+ * Rings state.
-+ *
-+ * - the fields:
-+ * . msgProdIdx,
-+ * . msgConsIdx,
-+ * . msgNumEntriesLog2,
-+ * .. are only used once the SETUP_MSG_RING cmd has been issued.
-+ * - '_pad' helps to ensure that the msg related fields are on their own
-+ * cache-line.
-+ */
-+
-+struct PVSCSIRingsState {
-+ u32 reqProdIdx;
-+ u32 reqConsIdx;
-+ u32 reqNumEntriesLog2;
-+
-+ u32 cmpProdIdx;
-+ u32 cmpConsIdx;
-+ u32 cmpNumEntriesLog2;
-+
-+ u8 _pad[104];
-+
-+ u32 msgProdIdx;
-+ u32 msgConsIdx;
-+ u32 msgNumEntriesLog2;
-+} __packed;
-+
-+/*
-+ * Request descriptor.
-+ *
-+ * sizeof(RingReqDesc) = 128
-+ *
-+ * - context: is a unique identifier of a command. It could normally be any
-+ * 64bit value, however we currently store it in the serialNumber variable
-+ * of struct SCSI_Command, so we have the following restrictions due to the
-+ * way this field is handled in the vmkernel storage stack:
-+ * * this value can't be 0,
-+ * * the upper 32bit need to be 0 since serialNumber is as a u32.
-+ * Currently tracked as PR 292060.
-+ * - dataLen: contains the total number of bytes that need to be transferred.
-+ * - dataAddr:
-+ * * if PVSCSI_FLAG_CMD_WITH_SG_LIST is set: dataAddr is the PA of the first
-+ * s/g table segment, each s/g segment is entirely contained on a single
-+ * page of physical memory,
-+ * * if PVSCSI_FLAG_CMD_WITH_SG_LIST is NOT set, then dataAddr is the PA of
-+ * the buffer used for the DMA transfer,
-+ * - flags:
-+ * * PVSCSI_FLAG_CMD_WITH_SG_LIST: see dataAddr above,
-+ * * PVSCSI_FLAG_CMD_DIR_NONE: no DMA involved,
-+ * * PVSCSI_FLAG_CMD_DIR_TOHOST: transfer from device to main memory,
-+ * * PVSCSI_FLAG_CMD_DIR_TODEVICE: transfer from main memory to device,
-+ * * PVSCSI_FLAG_CMD_OUT_OF_BAND_CDB: reserved to handle CDBs larger than
-+ * 16bytes. To be specified.
-+ * - vcpuHint: vcpuId of the processor that will be most likely waiting for the
-+ * completion of the i/o. For guest OSes that use lowest priority message
-+ * delivery mode (such as windows), we use this "hint" to deliver the
-+ * completion action to the proper vcpu. For now, we can use the vcpuId of
-+ * the processor that initiated the i/o as a likely candidate for the vcpu
-+ * that will be waiting for the completion..
-+ * - bus should be 0: we currently only support bus 0 for now.
-+ * - unused should be zero'd.
-+ */
-+
-+#define PVSCSI_FLAG_CMD_WITH_SG_LIST (1 << 0)
-+#define PVSCSI_FLAG_CMD_OUT_OF_BAND_CDB (1 << 1)
-+#define PVSCSI_FLAG_CMD_DIR_NONE (1 << 2)
-+#define PVSCSI_FLAG_CMD_DIR_TOHOST (1 << 3)
-+#define PVSCSI_FLAG_CMD_DIR_TODEVICE (1 << 4)
-+
-+struct PVSCSIRingReqDesc {
-+ u64 context;
-+ u64 dataAddr;
-+ u64 dataLen;
-+ u64 senseAddr;
-+ u32 senseLen;
-+ u32 flags;
-+ u8 cdb[16];
-+ u8 cdbLen;
-+ u8 lun[8];
-+ u8 tag;
-+ u8 bus;
-+ u8 target;
-+ u8 vcpuHint;
-+ u8 unused[59];
-+} __packed;
-+
-+/*
-+ * Scatter-gather list management.
-+ *
-+ * As described above, when PVSCSI_FLAG_CMD_WITH_SG_LIST is set in the
-+ * RingReqDesc.flags, then RingReqDesc.dataAddr is the PA of the first s/g
-+ * table segment.
-+ *
-+ * - each segment of the s/g table contain a succession of struct
-+ * PVSCSISGElement.
-+ * - each segment is entirely contained on a single physical page of memory.
-+ * - a "chain" s/g element has the flag PVSCSI_SGE_FLAG_CHAIN_ELEMENT set in
-+ * PVSCSISGElement.flags and in this case:
-+ * * addr is the PA of the next s/g segment,
-+ * * length is undefined, assumed to be 0.
-+ */
-+
-+struct PVSCSISGElement {
-+ u64 addr;
-+ u32 length;
-+ u32 flags;
-+} __packed;
-+
-+/*
-+ * Completion descriptor.
-+ *
-+ * sizeof(RingCmpDesc) = 32
-+ *
-+ * - context: identifier of the command. The same thing that was specified
-+ * under "context" as part of struct RingReqDesc at initiation time,
-+ * - dataLen: number of bytes transferred for the actual i/o operation,
-+ * - senseLen: number of bytes written into the sense buffer,
-+ * - hostStatus: adapter status,
-+ * - scsiStatus: device status,
-+ * - _pad should be zero.
-+ */
-+
-+struct PVSCSIRingCmpDesc {
-+ u64 context;
-+ u64 dataLen;
-+ u32 senseLen;
-+ u16 hostStatus;
-+ u16 scsiStatus;
-+ u32 _pad[2];
-+} __packed;
-+
-+/*
-+ * Interrupt status / IRQ bits.
-+ */
-+
-+#define PVSCSI_INTR_CMPL_0 (1 << 0)
-+#define PVSCSI_INTR_CMPL_1 (1 << 1)
-+#define PVSCSI_INTR_CMPL_MASK MASK(2)
-+
-+#define PVSCSI_INTR_MSG_0 (1 << 2)
-+#define PVSCSI_INTR_MSG_1 (1 << 3)
-+#define PVSCSI_INTR_MSG_MASK (MASK(2) << 2)
-+
-+#define PVSCSI_INTR_ALL_SUPPORTED MASK(4)
-+
-+/*
-+ * Number of MSI-X vectors supported.
-+ */
-+#define PVSCSI_MAX_INTRS 24
-+
-+/*
-+ * Enumeration of supported MSI-X vectors
-+ */
-+#define PVSCSI_VECTOR_COMPLETION 0
-+
-+/*
-+ * Misc constants for the rings.
-+ */
-+
-+#define PVSCSI_MAX_NUM_PAGES_REQ_RING PVSCSI_SETUP_RINGS_MAX_NUM_PAGES
-+#define PVSCSI_MAX_NUM_PAGES_CMP_RING PVSCSI_SETUP_RINGS_MAX_NUM_PAGES
-+#define PVSCSI_MAX_NUM_PAGES_MSG_RING PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES
-+
-+#define PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE \
-+ (PAGE_SIZE / sizeof(struct PVSCSIRingReqDesc))
-+
-+#define PVSCSI_MAX_REQ_QUEUE_DEPTH \
-+ (PVSCSI_MAX_NUM_PAGES_REQ_RING * PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE)
-+
-+#define PVSCSI_MEM_SPACE_COMMAND_NUM_PAGES 1
-+#define PVSCSI_MEM_SPACE_INTR_STATUS_NUM_PAGES 1
-+#define PVSCSI_MEM_SPACE_MISC_NUM_PAGES 2
-+#define PVSCSI_MEM_SPACE_KICK_IO_NUM_PAGES 2
-+#define PVSCSI_MEM_SPACE_MSIX_NUM_PAGES 2
-+
-+enum PVSCSIMemSpace {
-+ PVSCSI_MEM_SPACE_COMMAND_PAGE = 0,
-+ PVSCSI_MEM_SPACE_INTR_STATUS_PAGE = 1,
-+ PVSCSI_MEM_SPACE_MISC_PAGE = 2,
-+ PVSCSI_MEM_SPACE_KICK_IO_PAGE = 4,
-+ PVSCSI_MEM_SPACE_MSIX_TABLE_PAGE = 6,
-+ PVSCSI_MEM_SPACE_MSIX_PBA_PAGE = 7,
-+};
-+
-+#define PVSCSI_MEM_SPACE_NUM_PAGES \
-+ (PVSCSI_MEM_SPACE_COMMAND_NUM_PAGES + \
-+ PVSCSI_MEM_SPACE_INTR_STATUS_NUM_PAGES + \
-+ PVSCSI_MEM_SPACE_MISC_NUM_PAGES + \
-+ PVSCSI_MEM_SPACE_KICK_IO_NUM_PAGES + \
-+ PVSCSI_MEM_SPACE_MSIX_NUM_PAGES)
-+
-+#define PVSCSI_MEM_SPACE_SIZE (PVSCSI_MEM_SPACE_NUM_PAGES * PAGE_SIZE)
-+
-+#endif /* _VMW_PVSCSI_H_ */
-diff --git a/drivers/serial/kgdboc.c b/drivers/serial/kgdboc.c
-index eadc1ab..2d81457 100644
---- a/drivers/serial/kgdboc.c
-+++ b/drivers/serial/kgdboc.c
-@@ -18,7 +18,7 @@
-
- #define MAX_CONFIG_LEN 40
-
--static struct kgdb_io kgdboc_io_ops;
-+static const struct kgdb_io kgdboc_io_ops;
-
- /* -1 = init not run yet, 0 = unconfigured, 1 = configured. */
- static int configured = -1;
-@@ -154,7 +154,7 @@ static void kgdboc_post_exp_handler(void)
- module_put(THIS_MODULE);
- }
-
--static struct kgdb_io kgdboc_io_ops = {
-+static const struct kgdb_io kgdboc_io_ops = {
- .name = "kgdboc",
- .read_char = kgdboc_get_char,
- .write_char = kgdboc_put_char,
-diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
-index b76f246..7f41af7 100644
---- a/drivers/spi/spi.c
-+++ b/drivers/spi/spi.c
-@@ -774,7 +774,7 @@ int spi_sync(struct spi_device *spi, struct spi_message *message)
- EXPORT_SYMBOL_GPL(spi_sync);
-
- /* portable code must never pass more than 32 bytes */
--#define SPI_BUFSIZ max(32,SMP_CACHE_BYTES)
-+#define SPI_BUFSIZ max(32U,SMP_CACHE_BYTES)
-
- static u8 *buf;
-
-diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c
-index b9b37ff..19dfa23 100644
---- a/drivers/staging/android/binder.c
-+++ b/drivers/staging/android/binder.c
-@@ -2761,7 +2761,7 @@ static void binder_vma_close(struct vm_area_struct *vma)
- binder_defer_work(proc, BINDER_DEFERRED_PUT_FILES);
- }
-
--static struct vm_operations_struct binder_vm_ops = {
-+static const struct vm_operations_struct binder_vm_ops = {
- .open = binder_vma_open,
- .close = binder_vma_close,
- };
-diff --git a/drivers/staging/b3dfg/b3dfg.c b/drivers/staging/b3dfg/b3dfg.c
-index cda26bb4..39fed3f 100644
---- a/drivers/staging/b3dfg/b3dfg.c
-+++ b/drivers/staging/b3dfg/b3dfg.c
-@@ -455,7 +455,7 @@ static int b3dfg_vma_fault(struct vm_area_struct *vma,
- return VM_FAULT_NOPAGE;
- }
-
--static struct vm_operations_struct b3dfg_vm_ops = {
-+static const struct vm_operations_struct b3dfg_vm_ops = {
- .fault = b3dfg_vma_fault,
- };
-
-@@ -848,7 +848,7 @@ static int b3dfg_mmap(struct file *filp, struct vm_area_struct *vma)
- return r;
- }
-
--static struct file_operations b3dfg_fops = {
-+static const struct file_operations b3dfg_fops = {
- .owner = THIS_MODULE,
- .open = b3dfg_open,
- .release = b3dfg_release,
-diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
-index 908f25a..c9a579b 100644
---- a/drivers/staging/comedi/comedi_fops.c
-+++ b/drivers/staging/comedi/comedi_fops.c
-@@ -1389,7 +1389,7 @@ void comedi_unmap(struct vm_area_struct *area)
- mutex_unlock(&dev->mutex);
- }
-
--static struct vm_operations_struct comedi_vm_ops = {
-+static const struct vm_operations_struct comedi_vm_ops = {
- .close = comedi_unmap,
- };
-
-diff --git a/drivers/staging/dream/qdsp5/adsp_driver.c b/drivers/staging/dream/qdsp5/adsp_driver.c
-index e55a0db..577b776 100644
---- a/drivers/staging/dream/qdsp5/adsp_driver.c
-+++ b/drivers/staging/dream/qdsp5/adsp_driver.c
-@@ -576,7 +576,7 @@ static struct adsp_device *inode_to_device(struct inode *inode)
- static dev_t adsp_devno;
- static struct class *adsp_class;
-
--static struct file_operations adsp_fops = {
-+static const struct file_operations adsp_fops = {
- .owner = THIS_MODULE,
- .open = adsp_open,
- .unlocked_ioctl = adsp_ioctl,
-diff --git a/drivers/staging/dream/qdsp5/audio_aac.c b/drivers/staging/dream/qdsp5/audio_aac.c
-index ad2390f..4116ee8 100644
---- a/drivers/staging/dream/qdsp5/audio_aac.c
-+++ b/drivers/staging/dream/qdsp5/audio_aac.c
-@@ -1022,7 +1022,7 @@ done:
- return rc;
- }
-
--static struct file_operations audio_aac_fops = {
-+static const struct file_operations audio_aac_fops = {
- .owner = THIS_MODULE,
- .open = audio_open,
- .release = audio_release,
-diff --git a/drivers/staging/dream/qdsp5/audio_amrnb.c b/drivers/staging/dream/qdsp5/audio_amrnb.c
-index cd818a5..870b37b 100644
---- a/drivers/staging/dream/qdsp5/audio_amrnb.c
-+++ b/drivers/staging/dream/qdsp5/audio_amrnb.c
-@@ -833,7 +833,7 @@ done:
- return rc;
- }
-
--static struct file_operations audio_amrnb_fops = {
-+static const struct file_operations audio_amrnb_fops = {
- .owner = THIS_MODULE,
- .open = audamrnb_open,
- .release = audamrnb_release,
-diff --git a/drivers/staging/dream/qdsp5/audio_evrc.c b/drivers/staging/dream/qdsp5/audio_evrc.c
-index 4b43e18..cedafda 100644
---- a/drivers/staging/dream/qdsp5/audio_evrc.c
-+++ b/drivers/staging/dream/qdsp5/audio_evrc.c
-@@ -805,7 +805,7 @@ dma_fail:
- return rc;
- }
-
--static struct file_operations audio_evrc_fops = {
-+static const struct file_operations audio_evrc_fops = {
- .owner = THIS_MODULE,
- .open = audevrc_open,
- .release = audevrc_release,
-diff --git a/drivers/staging/dream/qdsp5/audio_in.c b/drivers/staging/dream/qdsp5/audio_in.c
-index 3d950a2..9431118 100644
---- a/drivers/staging/dream/qdsp5/audio_in.c
-+++ b/drivers/staging/dream/qdsp5/audio_in.c
-@@ -913,7 +913,7 @@ static int audpre_open(struct inode *inode, struct file *file)
- return 0;
- }
-
--static struct file_operations audio_fops = {
-+static const struct file_operations audio_fops = {
- .owner = THIS_MODULE,
- .open = audio_in_open,
- .release = audio_in_release,
-@@ -922,7 +922,7 @@ static struct file_operations audio_fops = {
- .unlocked_ioctl = audio_in_ioctl,
- };
-
--static struct file_operations audpre_fops = {
-+static const struct file_operations audpre_fops = {
- .owner = THIS_MODULE,
- .open = audpre_open,
- .unlocked_ioctl = audpre_ioctl,
-diff --git a/drivers/staging/dream/qdsp5/audio_mp3.c b/drivers/staging/dream/qdsp5/audio_mp3.c
-index b95574f..286c2f4 100644
---- a/drivers/staging/dream/qdsp5/audio_mp3.c
-+++ b/drivers/staging/dream/qdsp5/audio_mp3.c
-@@ -941,7 +941,7 @@ done:
- return rc;
- }
-
--static struct file_operations audio_mp3_fops = {
-+static const struct file_operations audio_mp3_fops = {
- .owner = THIS_MODULE,
- .open = audio_open,
- .release = audio_release,
-diff --git a/drivers/staging/dream/qdsp5/audio_out.c b/drivers/staging/dream/qdsp5/audio_out.c
-index d1adcf6..f8f9833 100644
---- a/drivers/staging/dream/qdsp5/audio_out.c
-+++ b/drivers/staging/dream/qdsp5/audio_out.c
-@@ -810,7 +810,7 @@ static int audpp_open(struct inode *inode, struct file *file)
- return 0;
- }
-
--static struct file_operations audio_fops = {
-+static const struct file_operations audio_fops = {
- .owner = THIS_MODULE,
- .open = audio_open,
- .release = audio_release,
-@@ -819,7 +819,7 @@ static struct file_operations audio_fops = {
- .unlocked_ioctl = audio_ioctl,
- };
-
--static struct file_operations audpp_fops = {
-+static const struct file_operations audpp_fops = {
- .owner = THIS_MODULE,
- .open = audpp_open,
- .unlocked_ioctl = audpp_ioctl,
-diff --git a/drivers/staging/dream/qdsp5/audio_qcelp.c b/drivers/staging/dream/qdsp5/audio_qcelp.c
-index f0f50e3..f6b9dbc 100644
---- a/drivers/staging/dream/qdsp5/audio_qcelp.c
-+++ b/drivers/staging/dream/qdsp5/audio_qcelp.c
-@@ -816,7 +816,7 @@ err:
- return rc;
- }
-
--static struct file_operations audio_qcelp_fops = {
-+static const struct file_operations audio_qcelp_fops = {
- .owner = THIS_MODULE,
- .open = audqcelp_open,
- .release = audqcelp_release,
-diff --git a/drivers/staging/dream/qdsp5/snd.c b/drivers/staging/dream/qdsp5/snd.c
-index 037d7ff..5469ec3 100644
---- a/drivers/staging/dream/qdsp5/snd.c
-+++ b/drivers/staging/dream/qdsp5/snd.c
-@@ -242,7 +242,7 @@ err:
- return rc;
- }
-
--static struct file_operations snd_fops = {
-+static const struct file_operations snd_fops = {
- .owner = THIS_MODULE,
- .open = snd_open,
- .release = snd_release,
-diff --git a/drivers/staging/dream/smd/smd_qmi.c b/drivers/staging/dream/smd/smd_qmi.c
-index d4e7d88..0ea632a 100644
---- a/drivers/staging/dream/smd/smd_qmi.c
-+++ b/drivers/staging/dream/smd/smd_qmi.c
-@@ -793,7 +793,7 @@ static int qmi_release(struct inode *ip, struct file *fp)
- return 0;
- }
-
--static struct file_operations qmi_fops = {
-+static const struct file_operations qmi_fops = {
- .owner = THIS_MODULE,
- .read = qmi_read,
- .write = qmi_write,
-diff --git a/drivers/staging/dream/smd/smd_rpcrouter_device.c b/drivers/staging/dream/smd/smd_rpcrouter_device.c
-index cd3910b..ff053d3 100644
---- a/drivers/staging/dream/smd/smd_rpcrouter_device.c
-+++ b/drivers/staging/dream/smd/smd_rpcrouter_device.c
-@@ -214,7 +214,7 @@ static long rpcrouter_ioctl(struct file *filp, unsigned int cmd,
- return rc;
- }
-
--static struct file_operations rpcrouter_server_fops = {
-+static const struct file_operations rpcrouter_server_fops = {
- .owner = THIS_MODULE,
- .open = rpcrouter_open,
- .release = rpcrouter_release,
-@@ -224,7 +224,7 @@ static struct file_operations rpcrouter_server_fops = {
- .unlocked_ioctl = rpcrouter_ioctl,
- };
-
--static struct file_operations rpcrouter_router_fops = {
-+static const struct file_operations rpcrouter_router_fops = {
- .owner = THIS_MODULE,
- .open = rpcrouter_open,
- .release = rpcrouter_release,
-diff --git a/drivers/staging/dst/dcore.c b/drivers/staging/dst/dcore.c
-index c24e4e0..629999b 100644
---- a/drivers/staging/dst/dcore.c
-+++ b/drivers/staging/dst/dcore.c
-@@ -149,7 +149,7 @@ static int dst_bdev_release(struct gendisk *disk, fmode_t mode)
- return 0;
- }
-
--static struct block_device_operations dst_blk_ops = {
-+static const struct block_device_operations dst_blk_ops = {
- .open = dst_bdev_open,
- .release = dst_bdev_release,
- .owner = THIS_MODULE,
-@@ -588,7 +588,7 @@ static struct dst_node *dst_alloc_node(struct dst_ctl *ctl,
- n->size = ctl->size;
-
- atomic_set(&n->refcnt, 1);
-- atomic_long_set(&n->gen, 0);
-+ atomic_long_set_unchecked(&n->gen, 0);
- snprintf(n->name, sizeof(n->name), "%s", ctl->name);
-
- err = dst_node_sysfs_init(n);
-@@ -855,7 +855,7 @@ static void cn_dst_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
- struct dst_node *n = NULL, *tmp;
- unsigned int hash;
-
-- if (!cap_raised(nsp->eff_cap, CAP_SYS_ADMIN)) {
-+ if (!capable(CAP_SYS_ADMIN)) {
- err = -EPERM;
- goto out;
- }
-diff --git a/drivers/staging/dst/trans.c b/drivers/staging/dst/trans.c
-index 557d372..8d84422 100644
---- a/drivers/staging/dst/trans.c
-+++ b/drivers/staging/dst/trans.c
-@@ -169,7 +169,7 @@ int dst_process_bio(struct dst_node *n, struct bio *bio)
- t->error = 0;
- t->retries = 0;
- atomic_set(&t->refcnt, 1);
-- t->gen = atomic_long_inc_return(&n->gen);
-+ t->gen = atomic_long_inc_return_unchecked(&n->gen);
-
- t->enc = bio_data_dir(bio);
- dst_bio_to_cmd(bio, &t->cmd, DST_IO, t->gen);
-diff --git a/drivers/staging/et131x/et1310_tx.c b/drivers/staging/et131x/et1310_tx.c
-index 94f7752..d051514 100644
---- a/drivers/staging/et131x/et1310_tx.c
-+++ b/drivers/staging/et131x/et1310_tx.c
-@@ -710,11 +710,11 @@ inline void et131x_free_send_packet(struct et131x_adapter *etdev,
- struct net_device_stats *stats = &etdev->net_stats;
-
- if (pMpTcb->Flags & fMP_DEST_BROAD)
-- atomic_inc(&etdev->Stats.brdcstxmt);
-+ atomic_inc_unchecked(&etdev->Stats.brdcstxmt);
- else if (pMpTcb->Flags & fMP_DEST_MULTI)
-- atomic_inc(&etdev->Stats.multixmt);
-+ atomic_inc_unchecked(&etdev->Stats.multixmt);
- else
-- atomic_inc(&etdev->Stats.unixmt);
-+ atomic_inc_unchecked(&etdev->Stats.unixmt);
-
- if (pMpTcb->Packet) {
- stats->tx_bytes += pMpTcb->Packet->len;
-diff --git a/drivers/staging/et131x/et131x_adapter.h b/drivers/staging/et131x/et131x_adapter.h
-index 1dfe06f..f469b4d 100644
---- a/drivers/staging/et131x/et131x_adapter.h
-+++ b/drivers/staging/et131x/et131x_adapter.h
-@@ -145,11 +145,11 @@ typedef struct _ce_stats_t {
- * operations
- */
- u32 unircv; /* # multicast packets received */
-- atomic_t unixmt; /* # multicast packets for Tx */
-+ atomic_unchecked_t unixmt; /* # multicast packets for Tx */
- u32 multircv; /* # multicast packets received */
-- atomic_t multixmt; /* # multicast packets for Tx */
-+ atomic_unchecked_t multixmt; /* # multicast packets for Tx */
- u32 brdcstrcv; /* # broadcast packets received */
-- atomic_t brdcstxmt; /* # broadcast packets for Tx */
-+ atomic_unchecked_t brdcstxmt; /* # broadcast packets for Tx */
- u32 norcvbuf; /* # Rx packets discarded */
- u32 noxmtbuf; /* # Tx packets discarded */
-
-diff --git a/drivers/staging/go7007/go7007-v4l2.c b/drivers/staging/go7007/go7007-v4l2.c
-index 4bd353a..e28f455 100644
---- a/drivers/staging/go7007/go7007-v4l2.c
-+++ b/drivers/staging/go7007/go7007-v4l2.c
-@@ -1700,7 +1700,7 @@ static int go7007_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
- return 0;
- }
-
--static struct vm_operations_struct go7007_vm_ops = {
-+static const struct vm_operations_struct go7007_vm_ops = {
- .open = go7007_vm_open,
- .close = go7007_vm_close,
- .fault = go7007_vm_fault,
-diff --git a/drivers/staging/hv/Channel.c b/drivers/staging/hv/Channel.c
-index 366dc95..b974d87 100644
---- a/drivers/staging/hv/Channel.c
-+++ b/drivers/staging/hv/Channel.c
-@@ -464,8 +464,8 @@ int VmbusChannelEstablishGpadl(struct vmbus_channel *Channel, void *Kbuffer,
-
- DPRINT_ENTER(VMBUS);
-
-- nextGpadlHandle = atomic_read(&gVmbusConnection.NextGpadlHandle);
-- atomic_inc(&gVmbusConnection.NextGpadlHandle);
-+ nextGpadlHandle = atomic_read_unchecked(&gVmbusConnection.NextGpadlHandle);
-+ atomic_inc_unchecked(&gVmbusConnection.NextGpadlHandle);
-
- VmbusChannelCreateGpadlHeader(Kbuffer, Size, &msgInfo, &msgCount);
- ASSERT(msgInfo != NULL);
-diff --git a/drivers/staging/hv/Hv.c b/drivers/staging/hv/Hv.c
-index b12237f..01ae28a 100644
---- a/drivers/staging/hv/Hv.c
-+++ b/drivers/staging/hv/Hv.c
-@@ -161,7 +161,7 @@ static u64 HvDoHypercall(u64 Control, void *Input, void *Output)
- u64 outputAddress = (Output) ? virt_to_phys(Output) : 0;
- u32 outputAddressHi = outputAddress >> 32;
- u32 outputAddressLo = outputAddress & 0xFFFFFFFF;
-- volatile void *hypercallPage = gHvContext.HypercallPage;
-+ volatile void *hypercallPage = ktva_ktla(gHvContext.HypercallPage);
-
- DPRINT_DBG(VMBUS, "Hypercall <control %llx input %p output %p>",
- Control, Input, Output);
-diff --git a/drivers/staging/hv/VmbusApi.h b/drivers/staging/hv/VmbusApi.h
-index d089bb1..2ebc158 100644
---- a/drivers/staging/hv/VmbusApi.h
-+++ b/drivers/staging/hv/VmbusApi.h
-@@ -109,7 +109,7 @@ struct vmbus_channel_interface {
- u32 *GpadlHandle);
- int (*TeardownGpadl)(struct hv_device *device, u32 GpadlHandle);
- void (*GetInfo)(struct hv_device *dev, struct hv_device_info *devinfo);
--};
-+} __no_const;
-
- /* Base driver object */
- struct hv_driver {
-diff --git a/drivers/staging/hv/VmbusPrivate.h b/drivers/staging/hv/VmbusPrivate.h
-index 5a37cce..6ecc88c 100644
---- a/drivers/staging/hv/VmbusPrivate.h
-+++ b/drivers/staging/hv/VmbusPrivate.h
-@@ -59,7 +59,7 @@ enum VMBUS_CONNECT_STATE {
- struct VMBUS_CONNECTION {
- enum VMBUS_CONNECT_STATE ConnectState;
-
-- atomic_t NextGpadlHandle;
-+ atomic_unchecked_t NextGpadlHandle;
-
- /*
- * Represents channel interrupts. Each bit position represents a
-diff --git a/drivers/staging/hv/blkvsc_drv.c b/drivers/staging/hv/blkvsc_drv.c
-index 871a202..ca50ddf 100644
---- a/drivers/staging/hv/blkvsc_drv.c
-+++ b/drivers/staging/hv/blkvsc_drv.c
-@@ -153,7 +153,7 @@ static int blkvsc_ringbuffer_size = BLKVSC_RING_BUFFER_SIZE;
- /* The one and only one */
- static struct blkvsc_driver_context g_blkvsc_drv;
-
--static struct block_device_operations block_ops = {
-+static const struct block_device_operations block_ops = {
- .owner = THIS_MODULE,
- .open = blkvsc_open,
- .release = blkvsc_release,
-diff --git a/drivers/staging/hv/vmbus_drv.c b/drivers/staging/hv/vmbus_drv.c
-index 6acc49a..fbc8d46 100644
---- a/drivers/staging/hv/vmbus_drv.c
-+++ b/drivers/staging/hv/vmbus_drv.c
-@@ -532,7 +532,7 @@ static int vmbus_child_device_register(struct hv_device *root_device_obj,
- to_device_context(root_device_obj);
- struct device_context *child_device_ctx =
- to_device_context(child_device_obj);
-- static atomic_t device_num = ATOMIC_INIT(0);
-+ static atomic_unchecked_t device_num = ATOMIC_INIT(0);
-
- DPRINT_ENTER(VMBUS_DRV);
-
-@@ -541,7 +541,7 @@ static int vmbus_child_device_register(struct hv_device *root_device_obj,
-
- /* Set the device name. Otherwise, device_register() will fail. */
- dev_set_name(&child_device_ctx->device, "vmbus_0_%d",
-- atomic_inc_return(&device_num));
-+ atomic_inc_return_unchecked(&device_num));
-
- /* The new device belongs to this bus */
- child_device_ctx->device.bus = &g_vmbus_drv.bus; /* device->dev.bus; */
-diff --git a/drivers/staging/iio/ring_generic.h b/drivers/staging/iio/ring_generic.h
-index d926189..17b19fd 100644
---- a/drivers/staging/iio/ring_generic.h
-+++ b/drivers/staging/iio/ring_generic.h
-@@ -87,7 +87,7 @@ struct iio_ring_access_funcs {
-
- int (*is_enabled)(struct iio_ring_buffer *ring);
- int (*enable)(struct iio_ring_buffer *ring);
--};
-+} __no_const;
-
- /**
- * struct iio_ring_buffer - general ring buffer structure
-diff --git a/drivers/staging/octeon/ethernet-rx.c b/drivers/staging/octeon/ethernet-rx.c
-index 1b237b7..88c624e 100644
---- a/drivers/staging/octeon/ethernet-rx.c
-+++ b/drivers/staging/octeon/ethernet-rx.c
-@@ -406,11 +406,11 @@ void cvm_oct_tasklet_rx(unsigned long unused)
- /* Increment RX stats for virtual ports */
- if (work->ipprt >= CVMX_PIP_NUM_INPUT_PORTS) {
- #ifdef CONFIG_64BIT
-- atomic64_add(1, (atomic64_t *)&priv->stats.rx_packets);
-- atomic64_add(skb->len, (atomic64_t *)&priv->stats.rx_bytes);
-+ atomic64_add_unchecked(1, (atomic64_unchecked_t *)&priv->stats.rx_packets);
-+ atomic64_add_unchecked(skb->len, (atomic64_unchecked_t *)&priv->stats.rx_bytes);
- #else
-- atomic_add(1, (atomic_t *)&priv->stats.rx_packets);
-- atomic_add(skb->len, (atomic_t *)&priv->stats.rx_bytes);
-+ atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_packets);
-+ atomic_add_unchecked(skb->len, (atomic_unchecked_t *)&priv->stats.rx_bytes);
- #endif
- }
- netif_receive_skb(skb);
-@@ -424,9 +424,9 @@ void cvm_oct_tasklet_rx(unsigned long unused)
- dev->name);
- */
- #ifdef CONFIG_64BIT
-- atomic64_add(1, (atomic64_t *)&priv->stats.rx_dropped);
-+ atomic64_add_unchecked(1, (atomic64_t *)&priv->stats.rx_dropped);
- #else
-- atomic_add(1, (atomic_t *)&priv->stats.rx_dropped);
-+ atomic_add_unchecked(1, (atomic_t *)&priv->stats.rx_dropped);
- #endif
- dev_kfree_skb_irq(skb);
- }
-diff --git a/drivers/staging/octeon/ethernet.c b/drivers/staging/octeon/ethernet.c
-index 492c502..d9909f1 100644
---- a/drivers/staging/octeon/ethernet.c
-+++ b/drivers/staging/octeon/ethernet.c
-@@ -294,11 +294,11 @@ static struct net_device_stats *cvm_oct_common_get_stats(struct net_device *dev)
- * since the RX tasklet also increments it.
- */
- #ifdef CONFIG_64BIT
-- atomic64_add(rx_status.dropped_packets,
-- (atomic64_t *)&priv->stats.rx_dropped);
-+ atomic64_add_unchecked(rx_status.dropped_packets,
-+ (atomic64_unchecked_t *)&priv->stats.rx_dropped);
- #else
-- atomic_add(rx_status.dropped_packets,
-- (atomic_t *)&priv->stats.rx_dropped);
-+ atomic_add_unchecked(rx_status.dropped_packets,
-+ (atomic_unchecked_t *)&priv->stats.rx_dropped);
- #endif
- }
-
-diff --git a/drivers/staging/otus/80211core/pub_zfi.h b/drivers/staging/otus/80211core/pub_zfi.h
-index a35bd5d..28fff45 100644
---- a/drivers/staging/otus/80211core/pub_zfi.h
-+++ b/drivers/staging/otus/80211core/pub_zfi.h
-@@ -531,7 +531,7 @@ struct zsCbFuncTbl
- u8_t (*zfcbClassifyTxPacket)(zdev_t* dev, zbuf_t* buf);
-
- void (*zfcbHwWatchDogNotify)(zdev_t* dev);
--};
-+} __no_const;
-
- extern void zfZeroMemory(u8_t* va, u16_t length);
- #define ZM_INIT_CB_FUNC_TABLE(p) zfZeroMemory((u8_t *)p, sizeof(struct zsCbFuncTbl));
-diff --git a/drivers/staging/panel/panel.c b/drivers/staging/panel/panel.c
-index c39a25f..696f5aa 100644
---- a/drivers/staging/panel/panel.c
-+++ b/drivers/staging/panel/panel.c
-@@ -1305,7 +1305,7 @@ static int lcd_release(struct inode *inode, struct file *file)
- return 0;
- }
-
--static struct file_operations lcd_fops = {
-+static const struct file_operations lcd_fops = {
- .write = lcd_write,
- .open = lcd_open,
- .release = lcd_release,
-@@ -1565,7 +1565,7 @@ static int keypad_release(struct inode *inode, struct file *file)
- return 0;
- }
-
--static struct file_operations keypad_fops = {
-+static const struct file_operations keypad_fops = {
- .read = keypad_read, /* read */
- .open = keypad_open, /* open */
- .release = keypad_release, /* close */
-diff --git a/drivers/staging/phison/phison.c b/drivers/staging/phison/phison.c
-index 270ebcb..37e46af 100644
---- a/drivers/staging/phison/phison.c
-+++ b/drivers/staging/phison/phison.c
-@@ -43,7 +43,7 @@ static struct scsi_host_template phison_sht = {
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations phison_ops = {
-+static const struct ata_port_operations phison_ops = {
- .inherits = &ata_bmdma_port_ops,
- .prereset = phison_pre_reset,
- };
-diff --git a/drivers/staging/poch/poch.c b/drivers/staging/poch/poch.c
-index 2eb8e3d..57616a7 100644
---- a/drivers/staging/poch/poch.c
-+++ b/drivers/staging/poch/poch.c
-@@ -1057,7 +1057,7 @@ static int poch_ioctl(struct inode *inode, struct file *filp,
- return 0;
- }
-
--static struct file_operations poch_fops = {
-+static const struct file_operations poch_fops = {
- .owner = THIS_MODULE,
- .open = poch_open,
- .release = poch_release,
-diff --git a/drivers/staging/pohmelfs/config.c b/drivers/staging/pohmelfs/config.c
-index 5d04bf5..d4baff2 100644
---- a/drivers/staging/pohmelfs/config.c
-+++ b/drivers/staging/pohmelfs/config.c
-@@ -531,7 +531,7 @@ static void pohmelfs_cn_callback(struct cn_msg *msg, struct netlink_skb_parms *n
- {
- int err;
-
-- if (!cap_raised(nsp->eff_cap, CAP_SYS_ADMIN))
-+ if (!capable(CAP_SYS_ADMIN))
- return;
-
- switch (msg->flags) {
-diff --git a/drivers/staging/pohmelfs/inode.c b/drivers/staging/pohmelfs/inode.c
-index c94de31..19402bc 100644
---- a/drivers/staging/pohmelfs/inode.c
-+++ b/drivers/staging/pohmelfs/inode.c
-@@ -1850,7 +1850,7 @@ static int pohmelfs_fill_super(struct super_block *sb, void *data, int silent)
- mutex_init(&psb->mcache_lock);
- psb->mcache_root = RB_ROOT;
- psb->mcache_timeout = msecs_to_jiffies(5000);
-- atomic_long_set(&psb->mcache_gen, 0);
-+ atomic_long_set_unchecked(&psb->mcache_gen, 0);
-
- psb->trans_max_pages = 100;
-
-@@ -1865,7 +1865,7 @@ static int pohmelfs_fill_super(struct super_block *sb, void *data, int silent)
- INIT_LIST_HEAD(&psb->crypto_ready_list);
- INIT_LIST_HEAD(&psb->crypto_active_list);
-
-- atomic_set(&psb->trans_gen, 1);
-+ atomic_set_unchecked(&psb->trans_gen, 1);
- atomic_long_set(&psb->total_inodes, 0);
-
- mutex_init(&psb->state_lock);
-diff --git a/drivers/staging/pohmelfs/mcache.c b/drivers/staging/pohmelfs/mcache.c
-index e22665c..a2a9390 100644
---- a/drivers/staging/pohmelfs/mcache.c
-+++ b/drivers/staging/pohmelfs/mcache.c
-@@ -121,7 +121,7 @@ struct pohmelfs_mcache *pohmelfs_mcache_alloc(struct pohmelfs_sb *psb, u64 start
- m->data = data;
- m->start = start;
- m->size = size;
-- m->gen = atomic_long_inc_return(&psb->mcache_gen);
-+ m->gen = atomic_long_inc_return_unchecked(&psb->mcache_gen);
-
- mutex_lock(&psb->mcache_lock);
- err = pohmelfs_mcache_insert(psb, m);
-diff --git a/drivers/staging/pohmelfs/netfs.h b/drivers/staging/pohmelfs/netfs.h
-index 623a07d..4035c19 100644
---- a/drivers/staging/pohmelfs/netfs.h
-+++ b/drivers/staging/pohmelfs/netfs.h
-@@ -570,14 +570,14 @@ struct pohmelfs_config;
- struct pohmelfs_sb {
- struct rb_root mcache_root;
- struct mutex mcache_lock;
-- atomic_long_t mcache_gen;
-+ atomic_long_unchecked_t mcache_gen;
- unsigned long mcache_timeout;
-
- unsigned int idx;
-
- unsigned int trans_retries;
-
-- atomic_t trans_gen;
-+ atomic_unchecked_t trans_gen;
-
- unsigned int crypto_attached_size;
- unsigned int crypto_align_size;
-diff --git a/drivers/staging/pohmelfs/trans.c b/drivers/staging/pohmelfs/trans.c
-index 36a2535..0591bf4 100644
---- a/drivers/staging/pohmelfs/trans.c
-+++ b/drivers/staging/pohmelfs/trans.c
-@@ -492,7 +492,7 @@ int netfs_trans_finish(struct netfs_trans *t, struct pohmelfs_sb *psb)
- int err;
- struct netfs_cmd *cmd = t->iovec.iov_base;
-
-- t->gen = atomic_inc_return(&psb->trans_gen);
-+ t->gen = atomic_inc_return_unchecked(&psb->trans_gen);
-
- cmd->size = t->iovec.iov_len - sizeof(struct netfs_cmd) +
- t->attached_size + t->attached_pages * sizeof(struct netfs_cmd);
-diff --git a/drivers/staging/sep/sep_driver.c b/drivers/staging/sep/sep_driver.c
-index f890a16..509ece8 100644
---- a/drivers/staging/sep/sep_driver.c
-+++ b/drivers/staging/sep/sep_driver.c
-@@ -2603,7 +2603,7 @@ static struct pci_driver sep_pci_driver = {
- static dev_t sep_devno;
-
- /* the files operations structure of the driver */
--static struct file_operations sep_file_operations = {
-+static const struct file_operations sep_file_operations = {
- .owner = THIS_MODULE,
- .ioctl = sep_ioctl,
- .poll = sep_poll,
-diff --git a/drivers/staging/usbip/vhci.h b/drivers/staging/usbip/vhci.h
-index 57f7946..d9df23d 100644
---- a/drivers/staging/usbip/vhci.h
-+++ b/drivers/staging/usbip/vhci.h
-@@ -92,7 +92,7 @@ struct vhci_hcd {
- unsigned resuming:1;
- unsigned long re_timeout;
-
-- atomic_t seqnum;
-+ atomic_unchecked_t seqnum;
-
- /*
- * NOTE:
-diff --git a/drivers/staging/usbip/vhci_hcd.c b/drivers/staging/usbip/vhci_hcd.c
-index 20cd7db..c2693ff 100644
---- a/drivers/staging/usbip/vhci_hcd.c
-+++ b/drivers/staging/usbip/vhci_hcd.c
-@@ -534,7 +534,7 @@ static void vhci_tx_urb(struct urb *urb)
- return;
- }
-
-- priv->seqnum = atomic_inc_return(&the_controller->seqnum);
-+ priv->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
- if (priv->seqnum == 0xffff)
- usbip_uinfo("seqnum max\n");
-
-@@ -793,7 +793,7 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
- return -ENOMEM;
- }
-
-- unlink->seqnum = atomic_inc_return(&the_controller->seqnum);
-+ unlink->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
- if (unlink->seqnum == 0xffff)
- usbip_uinfo("seqnum max\n");
-
-@@ -988,7 +988,7 @@ static int vhci_start(struct usb_hcd *hcd)
- vdev->rhport = rhport;
- }
-
-- atomic_set(&vhci->seqnum, 0);
-+ atomic_set_unchecked(&vhci->seqnum, 0);
- spin_lock_init(&vhci->lock);
-
-
-diff --git a/drivers/staging/usbip/vhci_rx.c b/drivers/staging/usbip/vhci_rx.c
-index 7fd76fe..673695a 100644
---- a/drivers/staging/usbip/vhci_rx.c
-+++ b/drivers/staging/usbip/vhci_rx.c
-@@ -79,7 +79,7 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev,
- usbip_uerr("cannot find a urb of seqnum %u\n",
- pdu->base.seqnum);
- usbip_uinfo("max seqnum %d\n",
-- atomic_read(&the_controller->seqnum));
-+ atomic_read_unchecked(&the_controller->seqnum));
- usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
- return;
- }
-diff --git a/drivers/staging/vme/devices/vme_user.c b/drivers/staging/vme/devices/vme_user.c
-index 7891288..8e31300 100644
---- a/drivers/staging/vme/devices/vme_user.c
-+++ b/drivers/staging/vme/devices/vme_user.c
-@@ -136,7 +136,7 @@ static int vme_user_ioctl(struct inode *, struct file *, unsigned int,
- static int __init vme_user_probe(struct device *, int, int);
- static int __exit vme_user_remove(struct device *, int, int);
-
--static struct file_operations vme_user_fops = {
-+static const struct file_operations vme_user_fops = {
- .open = vme_user_open,
- .release = vme_user_release,
- .read = vme_user_read,
-diff --git a/drivers/staging/vt6655/hostap.c b/drivers/staging/vt6655/hostap.c
-index 58abf44..00c1fc8 100644
---- a/drivers/staging/vt6655/hostap.c
-+++ b/drivers/staging/vt6655/hostap.c
-@@ -84,7 +84,7 @@ static int hostap_enable_hostapd(PSDevice pDevice, int rtnl_locked)
- PSDevice apdev_priv;
- struct net_device *dev = pDevice->dev;
- int ret;
-- const struct net_device_ops apdev_netdev_ops = {
-+ net_device_ops_no_const apdev_netdev_ops = {
- .ndo_start_xmit = pDevice->tx_80211,
- };
-
-diff --git a/drivers/staging/vt6656/hostap.c b/drivers/staging/vt6656/hostap.c
-index 0c8267a..db1f363 100644
---- a/drivers/staging/vt6656/hostap.c
-+++ b/drivers/staging/vt6656/hostap.c
-@@ -86,7 +86,7 @@ static int hostap_enable_hostapd(PSDevice pDevice, int rtnl_locked)
- PSDevice apdev_priv;
- struct net_device *dev = pDevice->dev;
- int ret;
-- const struct net_device_ops apdev_netdev_ops = {
-+ net_device_ops_no_const apdev_netdev_ops = {
- .ndo_start_xmit = pDevice->tx_80211,
- };
-
-diff --git a/drivers/telephony/ixj.c b/drivers/telephony/ixj.c
-index 40de151..924f268 100644
---- a/drivers/telephony/ixj.c
-+++ b/drivers/telephony/ixj.c
-@@ -4976,6 +4976,8 @@ static int ixj_daa_cid_read(IXJ *j)
- bool mContinue;
- char *pIn, *pOut;
-
-+ pax_track_stack();
-+
- if (!SCI_Prepare(j))
- return 0;
-
-diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
-index e941367..b631f5a 100644
---- a/drivers/uio/uio.c
-+++ b/drivers/uio/uio.c
-@@ -23,6 +23,7 @@
- #include <linux/string.h>
- #include <linux/kobject.h>
- #include <linux/uio_driver.h>
-+#include <asm/local.h>
-
- #define UIO_MAX_DEVICES 255
-
-@@ -30,10 +31,10 @@ struct uio_device {
- struct module *owner;
- struct device *dev;
- int minor;
-- atomic_t event;
-+ atomic_unchecked_t event;
- struct fasync_struct *async_queue;
- wait_queue_head_t wait;
-- int vma_count;
-+ local_t vma_count;
- struct uio_info *info;
- struct kobject *map_dir;
- struct kobject *portio_dir;
-@@ -129,7 +130,7 @@ static ssize_t map_type_show(struct kobject *kobj, struct attribute *attr,
- return entry->show(mem, buf);
- }
-
--static struct sysfs_ops map_sysfs_ops = {
-+static const struct sysfs_ops map_sysfs_ops = {
- .show = map_type_show,
- };
-
-@@ -217,7 +218,7 @@ static ssize_t portio_type_show(struct kobject *kobj, struct attribute *attr,
- return entry->show(port, buf);
- }
-
--static struct sysfs_ops portio_sysfs_ops = {
-+static const struct sysfs_ops portio_sysfs_ops = {
- .show = portio_type_show,
- };
-
-@@ -255,7 +256,7 @@ static ssize_t show_event(struct device *dev,
- struct uio_device *idev = dev_get_drvdata(dev);
- if (idev)
- return sprintf(buf, "%u\n",
-- (unsigned int)atomic_read(&idev->event));
-+ (unsigned int)atomic_read_unchecked(&idev->event));
- else
- return -ENODEV;
- }
-@@ -424,7 +425,7 @@ void uio_event_notify(struct uio_info *info)
- {
- struct uio_device *idev = info->uio_dev;
-
-- atomic_inc(&idev->event);
-+ atomic_inc_unchecked(&idev->event);
- wake_up_interruptible(&idev->wait);
- kill_fasync(&idev->async_queue, SIGIO, POLL_IN);
- }
-@@ -477,7 +478,7 @@ static int uio_open(struct inode *inode, struct file *filep)
- }
-
- listener->dev = idev;
-- listener->event_count = atomic_read(&idev->event);
-+ listener->event_count = atomic_read_unchecked(&idev->event);
- filep->private_data = listener;
-
- if (idev->info->open) {
-@@ -528,7 +529,7 @@ static unsigned int uio_poll(struct file *filep, poll_table *wait)
- return -EIO;
-
- poll_wait(filep, &idev->wait, wait);
-- if (listener->event_count != atomic_read(&idev->event))
-+ if (listener->event_count != atomic_read_unchecked(&idev->event))
- return POLLIN | POLLRDNORM;
- return 0;
- }
-@@ -553,7 +554,7 @@ static ssize_t uio_read(struct file *filep, char __user *buf,
- do {
- set_current_state(TASK_INTERRUPTIBLE);
-
-- event_count = atomic_read(&idev->event);
-+ event_count = atomic_read_unchecked(&idev->event);
- if (event_count != listener->event_count) {
- if (copy_to_user(buf, &event_count, count))
- retval = -EFAULT;
-@@ -624,13 +625,13 @@ static int uio_find_mem_index(struct vm_area_struct *vma)
- static void uio_vma_open(struct vm_area_struct *vma)
- {
- struct uio_device *idev = vma->vm_private_data;
-- idev->vma_count++;
-+ local_inc(&idev->vma_count);
- }
-
- static void uio_vma_close(struct vm_area_struct *vma)
- {
- struct uio_device *idev = vma->vm_private_data;
-- idev->vma_count--;
-+ local_dec(&idev->vma_count);
- }
-
- static int uio_vma_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
-@@ -840,7 +841,7 @@ int __uio_register_device(struct module *owner,
- idev->owner = owner;
- idev->info = info;
- init_waitqueue_head(&idev->wait);
-- atomic_set(&idev->event, 0);
-+ atomic_set_unchecked(&idev->event, 0);
-
- ret = uio_get_minor(idev);
- if (ret)
-diff --git a/drivers/usb/atm/usbatm.c b/drivers/usb/atm/usbatm.c
-index fbea856..06efea6 100644
---- a/drivers/usb/atm/usbatm.c
-+++ b/drivers/usb/atm/usbatm.c
-@@ -333,7 +333,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
- if (printk_ratelimit())
- atm_warn(instance, "%s: OAM not supported (vpi %d, vci %d)!\n",
- __func__, vpi, vci);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- return;
- }
-
-@@ -361,7 +361,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
- if (length > ATM_MAX_AAL5_PDU) {
- atm_rldbg(instance, "%s: bogus length %u (vcc: 0x%p)!\n",
- __func__, length, vcc);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- goto out;
- }
-
-@@ -370,14 +370,14 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
- if (sarb->len < pdu_length) {
- atm_rldbg(instance, "%s: bogus pdu_length %u (sarb->len: %u, vcc: 0x%p)!\n",
- __func__, pdu_length, sarb->len, vcc);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- goto out;
- }
-
- if (crc32_be(~0, skb_tail_pointer(sarb) - pdu_length, pdu_length) != 0xc704dd7b) {
- atm_rldbg(instance, "%s: packet failed crc check (vcc: 0x%p)!\n",
- __func__, vcc);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- goto out;
- }
-
-@@ -387,7 +387,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
- if (printk_ratelimit())
- atm_err(instance, "%s: no memory for skb (length: %u)!\n",
- __func__, length);
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- goto out;
- }
-
-@@ -412,7 +412,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
-
- vcc->push(vcc, skb);
-
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
- out:
- skb_trim(sarb, 0);
- }
-@@ -616,7 +616,7 @@ static void usbatm_tx_process(unsigned long data)
- struct atm_vcc *vcc = UDSL_SKB(skb)->atm.vcc;
-
- usbatm_pop(vcc, skb);
-- atomic_inc(&vcc->stats->tx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
-
- skb = skb_dequeue(&instance->sndqueue);
- }
-@@ -775,11 +775,11 @@ static int usbatm_atm_proc_read(struct atm_dev *atm_dev, loff_t * pos, char *pag
- if (!left--)
- return sprintf(page,
- "AAL5: tx %d ( %d err ), rx %d ( %d err, %d drop )\n",
-- atomic_read(&atm_dev->stats.aal5.tx),
-- atomic_read(&atm_dev->stats.aal5.tx_err),
-- atomic_read(&atm_dev->stats.aal5.rx),
-- atomic_read(&atm_dev->stats.aal5.rx_err),
-- atomic_read(&atm_dev->stats.aal5.rx_drop));
-+ atomic_read_unchecked(&atm_dev->stats.aal5.tx),
-+ atomic_read_unchecked(&atm_dev->stats.aal5.tx_err),
-+ atomic_read_unchecked(&atm_dev->stats.aal5.rx),
-+ atomic_read_unchecked(&atm_dev->stats.aal5.rx_err),
-+ atomic_read_unchecked(&atm_dev->stats.aal5.rx_drop));
-
- if (!left--) {
- if (instance->disconnected)
-diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
-index 24e6205..b94523b 100644
---- a/drivers/usb/core/hcd.c
-+++ b/drivers/usb/core/hcd.c
-@@ -1373,7 +1373,7 @@ int usb_hcd_submit_urb (struct urb *urb, gfp_t mem_flags)
- */
- usb_get_urb(urb);
- atomic_inc(&urb->use_count);
-- atomic_inc(&urb->dev->urbnum);
-+ atomic_inc_unchecked(&urb->dev->urbnum);
- usbmon_urb_submit(&hcd->self, urb);
-
- /* NOTE requirements on root-hub callers (usbfs and the hub
-@@ -1401,7 +1401,7 @@ int usb_hcd_submit_urb (struct urb *urb, gfp_t mem_flags)
- urb->hcpriv = NULL;
- INIT_LIST_HEAD(&urb->urb_list);
- atomic_dec(&urb->use_count);
-- atomic_dec(&urb->dev->urbnum);
-+ atomic_dec_unchecked(&urb->dev->urbnum);
- if (atomic_read(&urb->reject))
- wake_up(&usb_kill_urb_queue);
- usb_put_urb(urb);
-@@ -2216,7 +2216,7 @@ EXPORT_SYMBOL_GPL(usb_hcd_platform_shutdown);
-
- #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
-
--struct usb_mon_operations *mon_ops;
-+const struct usb_mon_operations *mon_ops;
-
- /*
- * The registration is unlocked.
-@@ -2226,7 +2226,7 @@ struct usb_mon_operations *mon_ops;
- * symbols from usbcore, usbcore gets referenced and cannot be unloaded first.
- */
-
--int usb_mon_register (struct usb_mon_operations *ops)
-+int usb_mon_register (const struct usb_mon_operations *ops)
- {
-
- if (mon_ops)
-diff --git a/drivers/usb/core/hcd.h b/drivers/usb/core/hcd.h
-index bcbe104..9cfd1c6 100644
---- a/drivers/usb/core/hcd.h
-+++ b/drivers/usb/core/hcd.h
-@@ -486,13 +486,13 @@ static inline void usbfs_cleanup(void) { }
- #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
-
- struct usb_mon_operations {
-- void (*urb_submit)(struct usb_bus *bus, struct urb *urb);
-- void (*urb_submit_error)(struct usb_bus *bus, struct urb *urb, int err);
-- void (*urb_complete)(struct usb_bus *bus, struct urb *urb, int status);
-+ void (* const urb_submit)(struct usb_bus *bus, struct urb *urb);
-+ void (* const urb_submit_error)(struct usb_bus *bus, struct urb *urb, int err);
-+ void (* const urb_complete)(struct usb_bus *bus, struct urb *urb, int status);
- /* void (*urb_unlink)(struct usb_bus *bus, struct urb *urb); */
- };
-
--extern struct usb_mon_operations *mon_ops;
-+extern const struct usb_mon_operations *mon_ops;
-
- static inline void usbmon_urb_submit(struct usb_bus *bus, struct urb *urb)
- {
-@@ -514,7 +514,7 @@ static inline void usbmon_urb_complete(struct usb_bus *bus, struct urb *urb,
- (*mon_ops->urb_complete)(bus, urb, status);
- }
-
--int usb_mon_register(struct usb_mon_operations *ops);
-+int usb_mon_register(const struct usb_mon_operations *ops);
- void usb_mon_deregister(void);
-
- #else
-diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c
-index fcdcad4..cf1aadd 100644
---- a/drivers/usb/core/sysfs.c
-+++ b/drivers/usb/core/sysfs.c
-@@ -186,7 +186,7 @@ show_urbnum(struct device *dev, struct device_attribute *attr, char *buf)
- struct usb_device *udev;
-
- udev = to_usb_device(dev);
-- return sprintf(buf, "%d\n", atomic_read(&udev->urbnum));
-+ return sprintf(buf, "%d\n", atomic_read_unchecked(&udev->urbnum));
- }
- static DEVICE_ATTR(urbnum, S_IRUGO, show_urbnum, NULL);
-
-diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
-index ab2d3e7..9c5dffe 100644
---- a/drivers/usb/core/usb.c
-+++ b/drivers/usb/core/usb.c
-@@ -377,7 +377,7 @@ struct usb_device *usb_alloc_dev(struct usb_device *parent,
- dev->dev.dma_mask = bus->controller->dma_mask;
- set_dev_node(&dev->dev, dev_to_node(bus->controller));
- dev->state = USB_STATE_ATTACHED;
-- atomic_set(&dev->urbnum, 0);
-+ atomic_set_unchecked(&dev->urbnum, 0);
-
- INIT_LIST_HEAD(&dev->ep0.urb_list);
- dev->ep0.desc.bLength = USB_DT_ENDPOINT_SIZE;
-diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c
-index 62ff5e7..530b74e 100644
---- a/drivers/usb/misc/appledisplay.c
-+++ b/drivers/usb/misc/appledisplay.c
-@@ -178,7 +178,7 @@ static int appledisplay_bl_get_brightness(struct backlight_device *bd)
- return pdata->msgdata[1];
- }
-
--static struct backlight_ops appledisplay_bl_data = {
-+static const struct backlight_ops appledisplay_bl_data = {
- .get_brightness = appledisplay_bl_get_brightness,
- .update_status = appledisplay_bl_update_status,
- };
-diff --git a/drivers/usb/mon/mon_main.c b/drivers/usb/mon/mon_main.c
-index e0c2db3..bd8cb66 100644
---- a/drivers/usb/mon/mon_main.c
-+++ b/drivers/usb/mon/mon_main.c
-@@ -238,7 +238,7 @@ static struct notifier_block mon_nb = {
- /*
- * Ops
- */
--static struct usb_mon_operations mon_ops_0 = {
-+static const struct usb_mon_operations mon_ops_0 = {
- .urb_submit = mon_submit,
- .urb_submit_error = mon_submit_error,
- .urb_complete = mon_complete,
-diff --git a/drivers/usb/wusbcore/wa-hc.h b/drivers/usb/wusbcore/wa-hc.h
-index d6bea3e..60b250e 100644
---- a/drivers/usb/wusbcore/wa-hc.h
-+++ b/drivers/usb/wusbcore/wa-hc.h
-@@ -192,7 +192,7 @@ struct wahc {
- struct list_head xfer_delayed_list;
- spinlock_t xfer_list_lock;
- struct work_struct xfer_work;
-- atomic_t xfer_id_count;
-+ atomic_unchecked_t xfer_id_count;
- };
-
-
-@@ -246,7 +246,7 @@ static inline void wa_init(struct wahc *wa)
- INIT_LIST_HEAD(&wa->xfer_delayed_list);
- spin_lock_init(&wa->xfer_list_lock);
- INIT_WORK(&wa->xfer_work, wa_urb_enqueue_run);
-- atomic_set(&wa->xfer_id_count, 1);
-+ atomic_set_unchecked(&wa->xfer_id_count, 1);
- }
-
- /**
-diff --git a/drivers/usb/wusbcore/wa-xfer.c b/drivers/usb/wusbcore/wa-xfer.c
-index 613a5fc..3174865 100644
---- a/drivers/usb/wusbcore/wa-xfer.c
-+++ b/drivers/usb/wusbcore/wa-xfer.c
-@@ -293,7 +293,7 @@ out:
- */
- static void wa_xfer_id_init(struct wa_xfer *xfer)
- {
-- xfer->id = atomic_add_return(1, &xfer->wa->xfer_id_count);
-+ xfer->id = atomic_add_return_unchecked(1, &xfer->wa->xfer_id_count);
- }
-
- /*
-diff --git a/drivers/uwb/wlp/messages.c b/drivers/uwb/wlp/messages.c
-index aa42fce..f8a828c 100644
---- a/drivers/uwb/wlp/messages.c
-+++ b/drivers/uwb/wlp/messages.c
-@@ -903,7 +903,7 @@ int wlp_parse_f0(struct wlp *wlp, struct sk_buff *skb)
- size_t len = skb->len;
- size_t used;
- ssize_t result;
-- struct wlp_nonce enonce, rnonce;
-+ struct wlp_nonce enonce = {{0}}, rnonce = {{0}};
- enum wlp_assc_error assc_err;
- char enonce_buf[WLP_WSS_NONCE_STRSIZE];
- char rnonce_buf[WLP_WSS_NONCE_STRSIZE];
-diff --git a/drivers/uwb/wlp/sysfs.c b/drivers/uwb/wlp/sysfs.c
-index 0370399..6627c94 100644
---- a/drivers/uwb/wlp/sysfs.c
-+++ b/drivers/uwb/wlp/sysfs.c
-@@ -615,8 +615,7 @@ ssize_t wlp_wss_attr_store(struct kobject *kobj, struct attribute *attr,
- return ret;
- }
-
--static
--struct sysfs_ops wss_sysfs_ops = {
-+static const struct sysfs_ops wss_sysfs_ops = {
- .show = wlp_wss_attr_show,
- .store = wlp_wss_attr_store,
- };
-diff --git a/drivers/video/atmel_lcdfb.c b/drivers/video/atmel_lcdfb.c
-index 8c5e432..5ee90ea 100644
---- a/drivers/video/atmel_lcdfb.c
-+++ b/drivers/video/atmel_lcdfb.c
-@@ -110,7 +110,7 @@ static int atmel_bl_get_brightness(struct backlight_device *bl)
- return lcdc_readl(sinfo, ATMEL_LCDC_CONTRAST_VAL);
- }
-
--static struct backlight_ops atmel_lcdc_bl_ops = {
-+static const struct backlight_ops atmel_lcdc_bl_ops = {
- .update_status = atmel_bl_update_status,
- .get_brightness = atmel_bl_get_brightness,
- };
-diff --git a/drivers/video/aty/aty128fb.c b/drivers/video/aty/aty128fb.c
-index e4e4d43..66bcbcc 100644
---- a/drivers/video/aty/aty128fb.c
-+++ b/drivers/video/aty/aty128fb.c
-@@ -149,7 +149,7 @@ enum {
- };
-
- /* Must match above enum */
--static const char *r128_family[] __devinitdata = {
-+static const char *r128_family[] __devinitconst = {
- "AGP",
- "PCI",
- "PRO AGP",
-@@ -1787,7 +1787,7 @@ static int aty128_bl_get_brightness(struct backlight_device *bd)
- return bd->props.brightness;
- }
-
--static struct backlight_ops aty128_bl_data = {
-+static const struct backlight_ops aty128_bl_data = {
- .get_brightness = aty128_bl_get_brightness,
- .update_status = aty128_bl_update_status,
- };
-diff --git a/drivers/video/aty/atyfb_base.c b/drivers/video/aty/atyfb_base.c
-index 913b4a4..4de325a9 100644
---- a/drivers/video/aty/atyfb_base.c
-+++ b/drivers/video/aty/atyfb_base.c
-@@ -2225,7 +2225,7 @@ static int aty_bl_get_brightness(struct backlight_device *bd)
- return bd->props.brightness;
- }
-
--static struct backlight_ops aty_bl_data = {
-+static const struct backlight_ops aty_bl_data = {
- .get_brightness = aty_bl_get_brightness,
- .update_status = aty_bl_update_status,
- };
-@@ -2970,9 +2970,8 @@ static int __devinit atyfb_setup_sparc(struct pci_dev *pdev,
- {
- struct atyfb_par *par = info->par;
- struct device_node *dp;
-- char prop[128];
-- int node, len, i, j, ret;
- u32 mem, chip_id;
-+ int i, j, ret;
-
- /*
- * Map memory-mapped registers.
-@@ -3088,23 +3087,8 @@ static int __devinit atyfb_setup_sparc(struct pci_dev *pdev,
- aty_st_le32(MEM_CNTL, mem, par);
- }
-
-- /*
-- * If this is the console device, we will set default video
-- * settings to what the PROM left us with.
-- */
-- node = prom_getchild(prom_root_node);
-- node = prom_searchsiblings(node, "aliases");
-- if (node) {
-- len = prom_getproperty(node, "screen", prop, sizeof(prop));
-- if (len > 0) {
-- prop[len] = '\0';
-- node = prom_finddevice(prop);
-- } else
-- node = 0;
-- }
--
- dp = pci_device_to_OF_node(pdev);
-- if (node == dp->node) {
-+ if (dp == of_console_device) {
- struct fb_var_screeninfo *var = &default_var;
- unsigned int N, P, Q, M, T, R;
- u32 v_total, h_total;
-@@ -3112,9 +3096,9 @@ static int __devinit atyfb_setup_sparc(struct pci_dev *pdev,
- u8 pll_regs[16];
- u8 clock_cntl;
-
-- crtc.vxres = prom_getintdefault(node, "width", 1024);
-- crtc.vyres = prom_getintdefault(node, "height", 768);
-- var->bits_per_pixel = prom_getintdefault(node, "depth", 8);
-+ crtc.vxres = of_getintprop_default(dp, "width", 1024);
-+ crtc.vyres = of_getintprop_default(dp, "height", 768);
-+ var->bits_per_pixel = of_getintprop_default(dp, "depth", 8);
- var->xoffset = var->yoffset = 0;
- crtc.h_tot_disp = aty_ld_le32(CRTC_H_TOTAL_DISP, par);
- crtc.h_sync_strt_wid = aty_ld_le32(CRTC_H_SYNC_STRT_WID, par);
-diff --git a/drivers/video/aty/radeon_backlight.c b/drivers/video/aty/radeon_backlight.c
-index 1a056ad..221bd6a 100644
---- a/drivers/video/aty/radeon_backlight.c
-+++ b/drivers/video/aty/radeon_backlight.c
-@@ -127,7 +127,7 @@ static int radeon_bl_get_brightness(struct backlight_device *bd)
- return bd->props.brightness;
- }
-
--static struct backlight_ops radeon_bl_data = {
-+static const struct backlight_ops radeon_bl_data = {
- .get_brightness = radeon_bl_get_brightness,
- .update_status = radeon_bl_update_status,
- };
-diff --git a/drivers/video/backlight/adp5520_bl.c b/drivers/video/backlight/adp5520_bl.c
-index ad05da5..3cb2cb9 100644
---- a/drivers/video/backlight/adp5520_bl.c
-+++ b/drivers/video/backlight/adp5520_bl.c
-@@ -84,7 +84,7 @@ static int adp5520_bl_get_brightness(struct backlight_device *bl)
- return error ? data->current_brightness : reg_val;
- }
-
--static struct backlight_ops adp5520_bl_ops = {
-+static const struct backlight_ops adp5520_bl_ops = {
- .update_status = adp5520_bl_update_status,
- .get_brightness = adp5520_bl_get_brightness,
- };
-diff --git a/drivers/video/backlight/adx_bl.c b/drivers/video/backlight/adx_bl.c
-index 2c3bdfc..d769b0b 100644
---- a/drivers/video/backlight/adx_bl.c
-+++ b/drivers/video/backlight/adx_bl.c
-@@ -61,7 +61,7 @@ static int adx_backlight_check_fb(struct fb_info *fb)
- return 1;
- }
-
--static struct backlight_ops adx_backlight_ops = {
-+static const struct backlight_ops adx_backlight_ops = {
- .options = 0,
- .update_status = adx_backlight_update_status,
- .get_brightness = adx_backlight_get_brightness,
-diff --git a/drivers/video/backlight/atmel-pwm-bl.c b/drivers/video/backlight/atmel-pwm-bl.c
-index 505c082..6b6b3cc 100644
---- a/drivers/video/backlight/atmel-pwm-bl.c
-+++ b/drivers/video/backlight/atmel-pwm-bl.c
-@@ -113,7 +113,7 @@ static int atmel_pwm_bl_init_pwm(struct atmel_pwm_bl *pwmbl)
- return pwm_channel_enable(&pwmbl->pwmc);
- }
-
--static struct backlight_ops atmel_pwm_bl_ops = {
-+static const struct backlight_ops atmel_pwm_bl_ops = {
- .get_brightness = atmel_pwm_bl_get_intensity,
- .update_status = atmel_pwm_bl_set_intensity,
- };
-diff --git a/drivers/video/backlight/backlight.c b/drivers/video/backlight/backlight.c
-index 5e20e6e..89025e6 100644
---- a/drivers/video/backlight/backlight.c
-+++ b/drivers/video/backlight/backlight.c
-@@ -269,7 +269,7 @@ EXPORT_SYMBOL(backlight_force_update);
- * ERR_PTR() or a pointer to the newly allocated device.
- */
- struct backlight_device *backlight_device_register(const char *name,
-- struct device *parent, void *devdata, struct backlight_ops *ops)
-+ struct device *parent, void *devdata, const struct backlight_ops *ops)
- {
- struct backlight_device *new_bd;
- int rc;
-diff --git a/drivers/video/backlight/corgi_lcd.c b/drivers/video/backlight/corgi_lcd.c
-index 9677494..b4bcf80 100644
---- a/drivers/video/backlight/corgi_lcd.c
-+++ b/drivers/video/backlight/corgi_lcd.c
-@@ -451,7 +451,7 @@ void corgi_lcd_limit_intensity(int limit)
- }
- EXPORT_SYMBOL(corgi_lcd_limit_intensity);
-
--static struct backlight_ops corgi_bl_ops = {
-+static const struct backlight_ops corgi_bl_ops = {
- .get_brightness = corgi_bl_get_intensity,
- .update_status = corgi_bl_update_status,
- };
-diff --git a/drivers/video/backlight/cr_bllcd.c b/drivers/video/backlight/cr_bllcd.c
-index b9fe62b..2914bf1 100644
---- a/drivers/video/backlight/cr_bllcd.c
-+++ b/drivers/video/backlight/cr_bllcd.c
-@@ -108,7 +108,7 @@ static int cr_backlight_get_intensity(struct backlight_device *bd)
- return intensity;
- }
-
--static struct backlight_ops cr_backlight_ops = {
-+static const struct backlight_ops cr_backlight_ops = {
- .get_brightness = cr_backlight_get_intensity,
- .update_status = cr_backlight_set_intensity,
- };
-diff --git a/drivers/video/backlight/da903x_bl.c b/drivers/video/backlight/da903x_bl.c
-index 701a108..feacfd5 100644
---- a/drivers/video/backlight/da903x_bl.c
-+++ b/drivers/video/backlight/da903x_bl.c
-@@ -94,7 +94,7 @@ static int da903x_backlight_get_brightness(struct backlight_device *bl)
- return data->current_brightness;
- }
-
--static struct backlight_ops da903x_backlight_ops = {
-+static const struct backlight_ops da903x_backlight_ops = {
- .update_status = da903x_backlight_update_status,
- .get_brightness = da903x_backlight_get_brightness,
- };
-diff --git a/drivers/video/backlight/generic_bl.c b/drivers/video/backlight/generic_bl.c
-index 6d27f62..e6d348e 100644
---- a/drivers/video/backlight/generic_bl.c
-+++ b/drivers/video/backlight/generic_bl.c
-@@ -70,7 +70,7 @@ void corgibl_limit_intensity(int limit)
- }
- EXPORT_SYMBOL(corgibl_limit_intensity);
-
--static struct backlight_ops genericbl_ops = {
-+static const struct backlight_ops genericbl_ops = {
- .options = BL_CORE_SUSPENDRESUME,
- .get_brightness = genericbl_get_intensity,
- .update_status = genericbl_send_intensity,
-diff --git a/drivers/video/backlight/hp680_bl.c b/drivers/video/backlight/hp680_bl.c
-index 7fb4eef..f7cc528 100644
---- a/drivers/video/backlight/hp680_bl.c
-+++ b/drivers/video/backlight/hp680_bl.c
-@@ -98,7 +98,7 @@ static int hp680bl_get_intensity(struct backlight_device *bd)
- return current_intensity;
- }
-
--static struct backlight_ops hp680bl_ops = {
-+static const struct backlight_ops hp680bl_ops = {
- .get_brightness = hp680bl_get_intensity,
- .update_status = hp680bl_set_intensity,
- };
-diff --git a/drivers/video/backlight/jornada720_bl.c b/drivers/video/backlight/jornada720_bl.c
-index 7aed256..db9071f 100644
---- a/drivers/video/backlight/jornada720_bl.c
-+++ b/drivers/video/backlight/jornada720_bl.c
-@@ -93,7 +93,7 @@ out:
- return ret;
- }
-
--static struct backlight_ops jornada_bl_ops = {
-+static const struct backlight_ops jornada_bl_ops = {
- .get_brightness = jornada_bl_get_brightness,
- .update_status = jornada_bl_update_status,
- .options = BL_CORE_SUSPENDRESUME,
-diff --git a/drivers/video/backlight/kb3886_bl.c b/drivers/video/backlight/kb3886_bl.c
-index a38fda1..939e7b8 100644
---- a/drivers/video/backlight/kb3886_bl.c
-+++ b/drivers/video/backlight/kb3886_bl.c
-@@ -134,7 +134,7 @@ static int kb3886bl_get_intensity(struct backlight_device *bd)
- return kb3886bl_intensity;
- }
-
--static struct backlight_ops kb3886bl_ops = {
-+static const struct backlight_ops kb3886bl_ops = {
- .get_brightness = kb3886bl_get_intensity,
- .update_status = kb3886bl_send_intensity,
- };
-diff --git a/drivers/video/backlight/locomolcd.c b/drivers/video/backlight/locomolcd.c
-index 6b488b8..00a9591 100644
---- a/drivers/video/backlight/locomolcd.c
-+++ b/drivers/video/backlight/locomolcd.c
-@@ -141,7 +141,7 @@ static int locomolcd_get_intensity(struct backlight_device *bd)
- return current_intensity;
- }
-
--static struct backlight_ops locomobl_data = {
-+static const struct backlight_ops locomobl_data = {
- .get_brightness = locomolcd_get_intensity,
- .update_status = locomolcd_set_intensity,
- };
-diff --git a/drivers/video/backlight/mbp_nvidia_bl.c b/drivers/video/backlight/mbp_nvidia_bl.c
-index 99bdfa8..3dac448 100644
---- a/drivers/video/backlight/mbp_nvidia_bl.c
-+++ b/drivers/video/backlight/mbp_nvidia_bl.c
-@@ -33,7 +33,7 @@ struct dmi_match_data {
- unsigned long iostart;
- unsigned long iolen;
- /* Backlight operations structure. */
-- struct backlight_ops backlight_ops;
-+ const struct backlight_ops backlight_ops;
- };
-
- /* Module parameters. */
-diff --git a/drivers/video/backlight/omap1_bl.c b/drivers/video/backlight/omap1_bl.c
-index cbad67e8..3cf900e 100644
---- a/drivers/video/backlight/omap1_bl.c
-+++ b/drivers/video/backlight/omap1_bl.c
-@@ -125,7 +125,7 @@ static int omapbl_get_intensity(struct backlight_device *dev)
- return bl->current_intensity;
- }
-
--static struct backlight_ops omapbl_ops = {
-+static const struct backlight_ops omapbl_ops = {
- .get_brightness = omapbl_get_intensity,
- .update_status = omapbl_update_status,
- };
-diff --git a/drivers/video/backlight/progear_bl.c b/drivers/video/backlight/progear_bl.c
-index 9edaf24f..075786e 100644
---- a/drivers/video/backlight/progear_bl.c
-+++ b/drivers/video/backlight/progear_bl.c
-@@ -54,7 +54,7 @@ static int progearbl_get_intensity(struct backlight_device *bd)
- return intensity - HW_LEVEL_MIN;
- }
-
--static struct backlight_ops progearbl_ops = {
-+static const struct backlight_ops progearbl_ops = {
- .get_brightness = progearbl_get_intensity,
- .update_status = progearbl_set_intensity,
- };
-diff --git a/drivers/video/backlight/pwm_bl.c b/drivers/video/backlight/pwm_bl.c
-index 8871662..df9e0b3 100644
---- a/drivers/video/backlight/pwm_bl.c
-+++ b/drivers/video/backlight/pwm_bl.c
-@@ -56,7 +56,7 @@ static int pwm_backlight_get_brightness(struct backlight_device *bl)
- return bl->props.brightness;
- }
-
--static struct backlight_ops pwm_backlight_ops = {
-+static const struct backlight_ops pwm_backlight_ops = {
- .update_status = pwm_backlight_update_status,
- .get_brightness = pwm_backlight_get_brightness,
- };
-diff --git a/drivers/video/backlight/tosa_bl.c b/drivers/video/backlight/tosa_bl.c
-index 43edbad..e14ce4d 100644
---- a/drivers/video/backlight/tosa_bl.c
-+++ b/drivers/video/backlight/tosa_bl.c
-@@ -72,7 +72,7 @@ static int tosa_bl_get_brightness(struct backlight_device *dev)
- return props->brightness;
- }
-
--static struct backlight_ops bl_ops = {
-+static const struct backlight_ops bl_ops = {
- .get_brightness = tosa_bl_get_brightness,
- .update_status = tosa_bl_update_status,
- };
-diff --git a/drivers/video/backlight/wm831x_bl.c b/drivers/video/backlight/wm831x_bl.c
-index 467bdb7..e32add3 100644
---- a/drivers/video/backlight/wm831x_bl.c
-+++ b/drivers/video/backlight/wm831x_bl.c
-@@ -112,7 +112,7 @@ static int wm831x_backlight_get_brightness(struct backlight_device *bl)
- return data->current_brightness;
- }
-
--static struct backlight_ops wm831x_backlight_ops = {
-+static const struct backlight_ops wm831x_backlight_ops = {
- .options = BL_CORE_SUSPENDRESUME,
- .update_status = wm831x_backlight_update_status,
- .get_brightness = wm831x_backlight_get_brightness,
-diff --git a/drivers/video/bf54x-lq043fb.c b/drivers/video/bf54x-lq043fb.c
-index e49ae5e..db4e6f7 100644
---- a/drivers/video/bf54x-lq043fb.c
-+++ b/drivers/video/bf54x-lq043fb.c
-@@ -463,7 +463,7 @@ static int bl_get_brightness(struct backlight_device *bd)
- return 0;
- }
-
--static struct backlight_ops bfin_lq043fb_bl_ops = {
-+static const struct backlight_ops bfin_lq043fb_bl_ops = {
- .get_brightness = bl_get_brightness,
- };
-
-diff --git a/drivers/video/bfin-t350mcqb-fb.c b/drivers/video/bfin-t350mcqb-fb.c
-index 2c72a7c..d523e52 100644
---- a/drivers/video/bfin-t350mcqb-fb.c
-+++ b/drivers/video/bfin-t350mcqb-fb.c
-@@ -381,7 +381,7 @@ static int bl_get_brightness(struct backlight_device *bd)
- return 0;
- }
-
--static struct backlight_ops bfin_lq043fb_bl_ops = {
-+static const struct backlight_ops bfin_lq043fb_bl_ops = {
- .get_brightness = bl_get_brightness,
- };
-
-diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
-index 3681c6a..a0169fb 100644
---- a/drivers/video/console/fbcon.c
-+++ b/drivers/video/console/fbcon.c
-@@ -444,7 +444,7 @@ static int __init fb_console_setup(char *this_opt)
-
- while ((options = strsep(&this_opt, ",")) != NULL) {
- if (!strncmp(options, "font:", 5))
-- strcpy(fontname, options + 5);
-+ strlcpy(fontname, options + 5, sizeof(fontname));
-
- if (!strncmp(options, "scrollback:", 11)) {
- options += 11;
-diff --git a/drivers/video/fbcmap.c b/drivers/video/fbcmap.c
-index f53b9f1..958bf4e 100644
---- a/drivers/video/fbcmap.c
-+++ b/drivers/video/fbcmap.c
-@@ -266,8 +266,7 @@ int fb_set_user_cmap(struct fb_cmap_user *cmap, struct fb_info *info)
- rc = -ENODEV;
- goto out;
- }
-- if (cmap->start < 0 || (!info->fbops->fb_setcolreg &&
-- !info->fbops->fb_setcmap)) {
-+ if (!info->fbops->fb_setcolreg && !info->fbops->fb_setcmap) {
- rc = -EINVAL;
- goto out1;
- }
-diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
-index 99bbd28..ad3829e 100644
---- a/drivers/video/fbmem.c
-+++ b/drivers/video/fbmem.c
-@@ -403,7 +403,7 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image,
- image->dx += image->width + 8;
- }
- } else if (rotate == FB_ROTATE_UD) {
-- for (x = 0; x < num && image->dx >= 0; x++) {
-+ for (x = 0; x < num && (__s32)image->dx >= 0; x++) {
- info->fbops->fb_imageblit(info, image);
- image->dx -= image->width + 8;
- }
-@@ -415,7 +415,7 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image,
- image->dy += image->height + 8;
- }
- } else if (rotate == FB_ROTATE_CCW) {
-- for (x = 0; x < num && image->dy >= 0; x++) {
-+ for (x = 0; x < num && (__s32)image->dy >= 0; x++) {
- info->fbops->fb_imageblit(info, image);
- image->dy -= image->height + 8;
- }
-@@ -915,6 +915,8 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var)
- int flags = info->flags;
- int ret = 0;
-
-+ pax_track_stack();
-+
- if (var->activate & FB_ACTIVATE_INV_MODE) {
- struct fb_videomode mode1, mode2;
-
-@@ -1040,6 +1042,8 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
- void __user *argp = (void __user *)arg;
- long ret = 0;
-
-+ pax_track_stack();
-+
- switch (cmd) {
- case FBIOGET_VSCREENINFO:
- if (!lock_fb_info(info))
-@@ -1119,7 +1123,7 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
- return -EFAULT;
- if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
- return -EINVAL;
-- if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX)
-+ if (con2fb.framebuffer >= FB_MAX)
- return -EINVAL;
- if (!registered_fb[con2fb.framebuffer])
- request_module("fb%d", con2fb.framebuffer);
-diff --git a/drivers/video/geode/gx1fb_core.c b/drivers/video/geode/gx1fb_core.c
-index f20eff8..3e4f622 100644
---- a/drivers/video/geode/gx1fb_core.c
-+++ b/drivers/video/geode/gx1fb_core.c
-@@ -30,7 +30,7 @@ static int crt_option = 1;
- static char panel_option[32] = "";
-
- /* Modes relevant to the GX1 (taken from modedb.c) */
--static const struct fb_videomode __initdata gx1_modedb[] = {
-+static const struct fb_videomode __initconst gx1_modedb[] = {
- /* 640x480-60 VESA */
- { NULL, 60, 640, 480, 39682, 48, 16, 33, 10, 96, 2,
- 0, FB_VMODE_NONINTERLACED, FB_MODE_IS_VESA },
-diff --git a/drivers/video/gxt4500.c b/drivers/video/gxt4500.c
-index 896e53d..4d87d0b 100644
---- a/drivers/video/gxt4500.c
-+++ b/drivers/video/gxt4500.c
-@@ -156,7 +156,7 @@ struct gxt4500_par {
- static char *mode_option;
-
- /* default mode: 1280x1024 @ 60 Hz, 8 bpp */
--static const struct fb_videomode defaultmode __devinitdata = {
-+static const struct fb_videomode defaultmode __devinitconst = {
- .refresh = 60,
- .xres = 1280,
- .yres = 1024,
-@@ -581,7 +581,7 @@ static int gxt4500_blank(int blank, struct fb_info *info)
- return 0;
- }
-
--static const struct fb_fix_screeninfo gxt4500_fix __devinitdata = {
-+static const struct fb_fix_screeninfo gxt4500_fix __devinitconst = {
- .id = "IBM GXT4500P",
- .type = FB_TYPE_PACKED_PIXELS,
- .visual = FB_VISUAL_PSEUDOCOLOR,
-diff --git a/drivers/video/i810/i810_accel.c b/drivers/video/i810/i810_accel.c
-index f5bedee..28c6028 100644
---- a/drivers/video/i810/i810_accel.c
-+++ b/drivers/video/i810/i810_accel.c
-@@ -73,6 +73,7 @@ static inline int wait_for_space(struct fb_info *info, u32 space)
- }
- }
- printk("ringbuffer lockup!!!\n");
-+ printk("head:%u tail:%u iring.size:%u space:%u\n", head, tail, par->iring.size, space);
- i810_report_error(mmio);
- par->dev_flags |= LOCKUP;
- info->pixmap.scan_align = 1;
-diff --git a/drivers/video/i810/i810_main.c b/drivers/video/i810/i810_main.c
-index 5743ea2..457f82c 100644
---- a/drivers/video/i810/i810_main.c
-+++ b/drivers/video/i810/i810_main.c
-@@ -97,7 +97,7 @@ static int i810fb_blank (int blank_mode, struct fb_info *info);
- static void i810fb_release_resource (struct fb_info *info, struct i810fb_par *par);
-
- /* PCI */
--static const char *i810_pci_list[] __devinitdata = {
-+static const char *i810_pci_list[] __devinitconst = {
- "Intel(R) 810 Framebuffer Device" ,
- "Intel(R) 810-DC100 Framebuffer Device" ,
- "Intel(R) 810E Framebuffer Device" ,
-diff --git a/drivers/video/logo/logo_linux_clut224.ppm b/drivers/video/logo/logo_linux_clut224.ppm
-index 3c14e43..eafa544 100644
---- a/drivers/video/logo/logo_linux_clut224.ppm
-+++ b/drivers/video/logo/logo_linux_clut224.ppm
-@@ -1,1604 +1,1123 @@
- P3
--# Standard 224-color Linux logo
- 80 80
- 255
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 6 6 6 6 6 6 10 10 10 10 10 10
-- 10 10 10 6 6 6 6 6 6 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 6 6 6 10 10 10 14 14 14
-- 22 22 22 26 26 26 30 30 30 34 34 34
-- 30 30 30 30 30 30 26 26 26 18 18 18
-- 14 14 14 10 10 10 6 6 6 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 1 0 0 1 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 6 6 6 14 14 14 26 26 26 42 42 42
-- 54 54 54 66 66 66 78 78 78 78 78 78
-- 78 78 78 74 74 74 66 66 66 54 54 54
-- 42 42 42 26 26 26 18 18 18 10 10 10
-- 6 6 6 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 1 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 10 10 10
-- 22 22 22 42 42 42 66 66 66 86 86 86
-- 66 66 66 38 38 38 38 38 38 22 22 22
-- 26 26 26 34 34 34 54 54 54 66 66 66
-- 86 86 86 70 70 70 46 46 46 26 26 26
-- 14 14 14 6 6 6 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 1 0 0 1 0 0 1 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 10 10 10 26 26 26
-- 50 50 50 82 82 82 58 58 58 6 6 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 6 6 6 54 54 54 86 86 86 66 66 66
-- 38 38 38 18 18 18 6 6 6 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 6 6 6 22 22 22 50 50 50
-- 78 78 78 34 34 34 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 6 6 6 70 70 70
-- 78 78 78 46 46 46 22 22 22 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 1 0 0 1 0 0 1 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 6 6 6 18 18 18 42 42 42 82 82 82
-- 26 26 26 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 14 14 14
-- 46 46 46 34 34 34 6 6 6 2 2 6
-- 42 42 42 78 78 78 42 42 42 18 18 18
-- 6 6 6 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 1 0 0 0 0 0 1 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 10 10 10 30 30 30 66 66 66 58 58 58
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 26 26 26
-- 86 86 86 101 101 101 46 46 46 10 10 10
-- 2 2 6 58 58 58 70 70 70 34 34 34
-- 10 10 10 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 1 0 0 1 0 0 1 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 14 14 14 42 42 42 86 86 86 10 10 10
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 30 30 30
-- 94 94 94 94 94 94 58 58 58 26 26 26
-- 2 2 6 6 6 6 78 78 78 54 54 54
-- 22 22 22 6 6 6 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 6 6 6
-- 22 22 22 62 62 62 62 62 62 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 26 26 26
-- 54 54 54 38 38 38 18 18 18 10 10 10
-- 2 2 6 2 2 6 34 34 34 82 82 82
-- 38 38 38 14 14 14 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 1 0 0 1 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 6 6 6
-- 30 30 30 78 78 78 30 30 30 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 10 10 10
-- 10 10 10 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 78 78 78
-- 50 50 50 18 18 18 6 6 6 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 1 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 10 10 10
-- 38 38 38 86 86 86 14 14 14 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 54 54 54
-- 66 66 66 26 26 26 6 6 6 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 1 0 0 1 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 14 14 14
-- 42 42 42 82 82 82 2 2 6 2 2 6
-- 2 2 6 6 6 6 10 10 10 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 6 6 6
-- 14 14 14 10 10 10 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 18 18 18
-- 82 82 82 34 34 34 10 10 10 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 1 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 14 14 14
-- 46 46 46 86 86 86 2 2 6 2 2 6
-- 6 6 6 6 6 6 22 22 22 34 34 34
-- 6 6 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 18 18 18 34 34 34
-- 10 10 10 50 50 50 22 22 22 2 2 6
-- 2 2 6 2 2 6 2 2 6 10 10 10
-- 86 86 86 42 42 42 14 14 14 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 1 0 0 1 0 0 1 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 14 14 14
-- 46 46 46 86 86 86 2 2 6 2 2 6
-- 38 38 38 116 116 116 94 94 94 22 22 22
-- 22 22 22 2 2 6 2 2 6 2 2 6
-- 14 14 14 86 86 86 138 138 138 162 162 162
--154 154 154 38 38 38 26 26 26 6 6 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 86 86 86 46 46 46 14 14 14 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 14 14 14
-- 46 46 46 86 86 86 2 2 6 14 14 14
--134 134 134 198 198 198 195 195 195 116 116 116
-- 10 10 10 2 2 6 2 2 6 6 6 6
--101 98 89 187 187 187 210 210 210 218 218 218
--214 214 214 134 134 134 14 14 14 6 6 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 86 86 86 50 50 50 18 18 18 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 1 0 0 0
-- 0 0 1 0 0 1 0 0 1 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 14 14 14
-- 46 46 46 86 86 86 2 2 6 54 54 54
--218 218 218 195 195 195 226 226 226 246 246 246
-- 58 58 58 2 2 6 2 2 6 30 30 30
--210 210 210 253 253 253 174 174 174 123 123 123
--221 221 221 234 234 234 74 74 74 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 70 70 70 58 58 58 22 22 22 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 14 14 14
-- 46 46 46 82 82 82 2 2 6 106 106 106
--170 170 170 26 26 26 86 86 86 226 226 226
--123 123 123 10 10 10 14 14 14 46 46 46
--231 231 231 190 190 190 6 6 6 70 70 70
-- 90 90 90 238 238 238 158 158 158 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 70 70 70 58 58 58 22 22 22 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 1 0 0 0
-- 0 0 1 0 0 1 0 0 1 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 14 14 14
-- 42 42 42 86 86 86 6 6 6 116 116 116
--106 106 106 6 6 6 70 70 70 149 149 149
--128 128 128 18 18 18 38 38 38 54 54 54
--221 221 221 106 106 106 2 2 6 14 14 14
-- 46 46 46 190 190 190 198 198 198 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 74 74 74 62 62 62 22 22 22 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 1 0 0 0
-- 0 0 1 0 0 0 0 0 1 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 14 14 14
-- 42 42 42 94 94 94 14 14 14 101 101 101
--128 128 128 2 2 6 18 18 18 116 116 116
--118 98 46 121 92 8 121 92 8 98 78 10
--162 162 162 106 106 106 2 2 6 2 2 6
-- 2 2 6 195 195 195 195 195 195 6 6 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 74 74 74 62 62 62 22 22 22 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 1 0 0 1
-- 0 0 1 0 0 0 0 0 1 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 10 10 10
-- 38 38 38 90 90 90 14 14 14 58 58 58
--210 210 210 26 26 26 54 38 6 154 114 10
--226 170 11 236 186 11 225 175 15 184 144 12
--215 174 15 175 146 61 37 26 9 2 2 6
-- 70 70 70 246 246 246 138 138 138 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 70 70 70 66 66 66 26 26 26 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 10 10 10
-- 38 38 38 86 86 86 14 14 14 10 10 10
--195 195 195 188 164 115 192 133 9 225 175 15
--239 182 13 234 190 10 232 195 16 232 200 30
--245 207 45 241 208 19 232 195 16 184 144 12
--218 194 134 211 206 186 42 42 42 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 50 50 50 74 74 74 30 30 30 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 10 10 10
-- 34 34 34 86 86 86 14 14 14 2 2 6
--121 87 25 192 133 9 219 162 10 239 182 13
--236 186 11 232 195 16 241 208 19 244 214 54
--246 218 60 246 218 38 246 215 20 241 208 19
--241 208 19 226 184 13 121 87 25 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 50 50 50 82 82 82 34 34 34 10 10 10
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 10 10 10
-- 34 34 34 82 82 82 30 30 30 61 42 6
--180 123 7 206 145 10 230 174 11 239 182 13
--234 190 10 238 202 15 241 208 19 246 218 74
--246 218 38 246 215 20 246 215 20 246 215 20
--226 184 13 215 174 15 184 144 12 6 6 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 26 26 26 94 94 94 42 42 42 14 14 14
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 10 10 10
-- 30 30 30 78 78 78 50 50 50 104 69 6
--192 133 9 216 158 10 236 178 12 236 186 11
--232 195 16 241 208 19 244 214 54 245 215 43
--246 215 20 246 215 20 241 208 19 198 155 10
--200 144 11 216 158 10 156 118 10 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 6 6 6 90 90 90 54 54 54 18 18 18
-- 6 6 6 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 10 10 10
-- 30 30 30 78 78 78 46 46 46 22 22 22
--137 92 6 210 162 10 239 182 13 238 190 10
--238 202 15 241 208 19 246 215 20 246 215 20
--241 208 19 203 166 17 185 133 11 210 150 10
--216 158 10 210 150 10 102 78 10 2 2 6
-- 6 6 6 54 54 54 14 14 14 2 2 6
-- 2 2 6 62 62 62 74 74 74 30 30 30
-- 10 10 10 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 10 10 10
-- 34 34 34 78 78 78 50 50 50 6 6 6
-- 94 70 30 139 102 15 190 146 13 226 184 13
--232 200 30 232 195 16 215 174 15 190 146 13
--168 122 10 192 133 9 210 150 10 213 154 11
--202 150 34 182 157 106 101 98 89 2 2 6
-- 2 2 6 78 78 78 116 116 116 58 58 58
-- 2 2 6 22 22 22 90 90 90 46 46 46
-- 18 18 18 6 6 6 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 10 10 10
-- 38 38 38 86 86 86 50 50 50 6 6 6
--128 128 128 174 154 114 156 107 11 168 122 10
--198 155 10 184 144 12 197 138 11 200 144 11
--206 145 10 206 145 10 197 138 11 188 164 115
--195 195 195 198 198 198 174 174 174 14 14 14
-- 2 2 6 22 22 22 116 116 116 116 116 116
-- 22 22 22 2 2 6 74 74 74 70 70 70
-- 30 30 30 10 10 10 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 6 6 6 18 18 18
-- 50 50 50 101 101 101 26 26 26 10 10 10
--138 138 138 190 190 190 174 154 114 156 107 11
--197 138 11 200 144 11 197 138 11 192 133 9
--180 123 7 190 142 34 190 178 144 187 187 187
--202 202 202 221 221 221 214 214 214 66 66 66
-- 2 2 6 2 2 6 50 50 50 62 62 62
-- 6 6 6 2 2 6 10 10 10 90 90 90
-- 50 50 50 18 18 18 6 6 6 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 10 10 10 34 34 34
-- 74 74 74 74 74 74 2 2 6 6 6 6
--144 144 144 198 198 198 190 190 190 178 166 146
--154 121 60 156 107 11 156 107 11 168 124 44
--174 154 114 187 187 187 190 190 190 210 210 210
--246 246 246 253 253 253 253 253 253 182 182 182
-- 6 6 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 62 62 62
-- 74 74 74 34 34 34 14 14 14 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 10 10 10 22 22 22 54 54 54
-- 94 94 94 18 18 18 2 2 6 46 46 46
--234 234 234 221 221 221 190 190 190 190 190 190
--190 190 190 187 187 187 187 187 187 190 190 190
--190 190 190 195 195 195 214 214 214 242 242 242
--253 253 253 253 253 253 253 253 253 253 253 253
-- 82 82 82 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 14 14 14
-- 86 86 86 54 54 54 22 22 22 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 6 6 6 18 18 18 46 46 46 90 90 90
-- 46 46 46 18 18 18 6 6 6 182 182 182
--253 253 253 246 246 246 206 206 206 190 190 190
--190 190 190 190 190 190 190 190 190 190 190 190
--206 206 206 231 231 231 250 250 250 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--202 202 202 14 14 14 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 42 42 42 86 86 86 42 42 42 18 18 18
-- 6 6 6 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 6 6 6
-- 14 14 14 38 38 38 74 74 74 66 66 66
-- 2 2 6 6 6 6 90 90 90 250 250 250
--253 253 253 253 253 253 238 238 238 198 198 198
--190 190 190 190 190 190 195 195 195 221 221 221
--246 246 246 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 82 82 82 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 78 78 78 70 70 70 34 34 34
-- 14 14 14 6 6 6 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 14 14 14
-- 34 34 34 66 66 66 78 78 78 6 6 6
-- 2 2 6 18 18 18 218 218 218 253 253 253
--253 253 253 253 253 253 253 253 253 246 246 246
--226 226 226 231 231 231 246 246 246 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 178 178 178 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 18 18 18 90 90 90 62 62 62
-- 30 30 30 10 10 10 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 10 10 10 26 26 26
-- 58 58 58 90 90 90 18 18 18 2 2 6
-- 2 2 6 110 110 110 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--250 250 250 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 231 231 231 18 18 18 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 18 18 18 94 94 94
-- 54 54 54 26 26 26 10 10 10 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 6 6 6 22 22 22 50 50 50
-- 90 90 90 26 26 26 2 2 6 2 2 6
-- 14 14 14 195 195 195 250 250 250 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--250 250 250 242 242 242 54 54 54 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 38 38 38
-- 86 86 86 50 50 50 22 22 22 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 6 6 6 14 14 14 38 38 38 82 82 82
-- 34 34 34 2 2 6 2 2 6 2 2 6
-- 42 42 42 195 195 195 246 246 246 253 253 253
--253 253 253 253 253 253 253 253 253 250 250 250
--242 242 242 242 242 242 250 250 250 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 250 250 250 246 246 246 238 238 238
--226 226 226 231 231 231 101 101 101 6 6 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 38 38 38 82 82 82 42 42 42 14 14 14
-- 6 6 6 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 10 10 10 26 26 26 62 62 62 66 66 66
-- 2 2 6 2 2 6 2 2 6 6 6 6
-- 70 70 70 170 170 170 206 206 206 234 234 234
--246 246 246 250 250 250 250 250 250 238 238 238
--226 226 226 231 231 231 238 238 238 250 250 250
--250 250 250 250 250 250 246 246 246 231 231 231
--214 214 214 206 206 206 202 202 202 202 202 202
--198 198 198 202 202 202 182 182 182 18 18 18
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 62 62 62 66 66 66 30 30 30
-- 10 10 10 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 14 14 14 42 42 42 82 82 82 18 18 18
-- 2 2 6 2 2 6 2 2 6 10 10 10
-- 94 94 94 182 182 182 218 218 218 242 242 242
--250 250 250 253 253 253 253 253 253 250 250 250
--234 234 234 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 246 246 246
--238 238 238 226 226 226 210 210 210 202 202 202
--195 195 195 195 195 195 210 210 210 158 158 158
-- 6 6 6 14 14 14 50 50 50 14 14 14
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 6 6 6 86 86 86 46 46 46
-- 18 18 18 6 6 6 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 6 6 6
-- 22 22 22 54 54 54 70 70 70 2 2 6
-- 2 2 6 10 10 10 2 2 6 22 22 22
--166 166 166 231 231 231 250 250 250 253 253 253
--253 253 253 253 253 253 253 253 253 250 250 250
--242 242 242 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 246 246 246
--231 231 231 206 206 206 198 198 198 226 226 226
-- 94 94 94 2 2 6 6 6 6 38 38 38
-- 30 30 30 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 62 62 62 66 66 66
-- 26 26 26 10 10 10 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 10 10 10
-- 30 30 30 74 74 74 50 50 50 2 2 6
-- 26 26 26 26 26 26 2 2 6 106 106 106
--238 238 238 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 246 246 246 218 218 218 202 202 202
--210 210 210 14 14 14 2 2 6 2 2 6
-- 30 30 30 22 22 22 2 2 6 2 2 6
-- 2 2 6 2 2 6 18 18 18 86 86 86
-- 42 42 42 14 14 14 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 14 14 14
-- 42 42 42 90 90 90 22 22 22 2 2 6
-- 42 42 42 2 2 6 18 18 18 218 218 218
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 250 250 250 221 221 221
--218 218 218 101 101 101 2 2 6 14 14 14
-- 18 18 18 38 38 38 10 10 10 2 2 6
-- 2 2 6 2 2 6 2 2 6 78 78 78
-- 58 58 58 22 22 22 6 6 6 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 6 6 6 18 18 18
-- 54 54 54 82 82 82 2 2 6 26 26 26
-- 22 22 22 2 2 6 123 123 123 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 250 250 250
--238 238 238 198 198 198 6 6 6 38 38 38
-- 58 58 58 26 26 26 38 38 38 2 2 6
-- 2 2 6 2 2 6 2 2 6 46 46 46
-- 78 78 78 30 30 30 10 10 10 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 10 10 10 30 30 30
-- 74 74 74 58 58 58 2 2 6 42 42 42
-- 2 2 6 22 22 22 231 231 231 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 250 250 250
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 246 246 246 46 46 46 38 38 38
-- 42 42 42 14 14 14 38 38 38 14 14 14
-- 2 2 6 2 2 6 2 2 6 6 6 6
-- 86 86 86 46 46 46 14 14 14 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 6 6 6 14 14 14 42 42 42
-- 90 90 90 18 18 18 18 18 18 26 26 26
-- 2 2 6 116 116 116 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 250 250 250 238 238 238
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 94 94 94 6 6 6
-- 2 2 6 2 2 6 10 10 10 34 34 34
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 74 74 74 58 58 58 22 22 22 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 10 10 10 26 26 26 66 66 66
-- 82 82 82 2 2 6 38 38 38 6 6 6
-- 14 14 14 210 210 210 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 246 246 246 242 242 242
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 144 144 144 2 2 6
-- 2 2 6 2 2 6 2 2 6 46 46 46
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 42 42 42 74 74 74 30 30 30 10 10 10
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 6 6 6 14 14 14 42 42 42 90 90 90
-- 26 26 26 6 6 6 42 42 42 2 2 6
-- 74 74 74 250 250 250 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 242 242 242 242 242 242
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 182 182 182 2 2 6
-- 2 2 6 2 2 6 2 2 6 46 46 46
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 10 10 10 86 86 86 38 38 38 10 10 10
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 10 10 10 26 26 26 66 66 66 82 82 82
-- 2 2 6 22 22 22 18 18 18 2 2 6
--149 149 149 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 234 234 234 242 242 242
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 206 206 206 2 2 6
-- 2 2 6 2 2 6 2 2 6 38 38 38
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 6 6 6 86 86 86 46 46 46 14 14 14
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 6 6 6
-- 18 18 18 46 46 46 86 86 86 18 18 18
-- 2 2 6 34 34 34 10 10 10 6 6 6
--210 210 210 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 234 234 234 242 242 242
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 221 221 221 6 6 6
-- 2 2 6 2 2 6 6 6 6 30 30 30
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 82 82 82 54 54 54 18 18 18
-- 6 6 6 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 10 10 10
-- 26 26 26 66 66 66 62 62 62 2 2 6
-- 2 2 6 38 38 38 10 10 10 26 26 26
--238 238 238 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 231 231 231 238 238 238
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 231 231 231 6 6 6
-- 2 2 6 2 2 6 10 10 10 30 30 30
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 66 66 66 58 58 58 22 22 22
-- 6 6 6 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 10 10 10
-- 38 38 38 78 78 78 6 6 6 2 2 6
-- 2 2 6 46 46 46 14 14 14 42 42 42
--246 246 246 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 231 231 231 242 242 242
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 234 234 234 10 10 10
-- 2 2 6 2 2 6 22 22 22 14 14 14
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 66 66 66 62 62 62 22 22 22
-- 6 6 6 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 6 6 6 18 18 18
-- 50 50 50 74 74 74 2 2 6 2 2 6
-- 14 14 14 70 70 70 34 34 34 62 62 62
--250 250 250 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 231 231 231 246 246 246
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 234 234 234 14 14 14
-- 2 2 6 2 2 6 30 30 30 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 66 66 66 62 62 62 22 22 22
-- 6 6 6 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 6 6 6 18 18 18
-- 54 54 54 62 62 62 2 2 6 2 2 6
-- 2 2 6 30 30 30 46 46 46 70 70 70
--250 250 250 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 231 231 231 246 246 246
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 226 226 226 10 10 10
-- 2 2 6 6 6 6 30 30 30 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 66 66 66 58 58 58 22 22 22
-- 6 6 6 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 6 6 6 22 22 22
-- 58 58 58 62 62 62 2 2 6 2 2 6
-- 2 2 6 2 2 6 30 30 30 78 78 78
--250 250 250 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 231 231 231 246 246 246
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 206 206 206 2 2 6
-- 22 22 22 34 34 34 18 14 6 22 22 22
-- 26 26 26 18 18 18 6 6 6 2 2 6
-- 2 2 6 82 82 82 54 54 54 18 18 18
-- 6 6 6 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 6 6 6 26 26 26
-- 62 62 62 106 106 106 74 54 14 185 133 11
--210 162 10 121 92 8 6 6 6 62 62 62
--238 238 238 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 231 231 231 246 246 246
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 158 158 158 18 18 18
-- 14 14 14 2 2 6 2 2 6 2 2 6
-- 6 6 6 18 18 18 66 66 66 38 38 38
-- 6 6 6 94 94 94 50 50 50 18 18 18
-- 6 6 6 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 6 6 6
-- 10 10 10 10 10 10 18 18 18 38 38 38
-- 78 78 78 142 134 106 216 158 10 242 186 14
--246 190 14 246 190 14 156 118 10 10 10 10
-- 90 90 90 238 238 238 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 231 231 231 250 250 250
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 246 230 190
--238 204 91 238 204 91 181 142 44 37 26 9
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 38 38 38 46 46 46
-- 26 26 26 106 106 106 54 54 54 18 18 18
-- 6 6 6 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 6 6 6 14 14 14 22 22 22
-- 30 30 30 38 38 38 50 50 50 70 70 70
--106 106 106 190 142 34 226 170 11 242 186 14
--246 190 14 246 190 14 246 190 14 154 114 10
-- 6 6 6 74 74 74 226 226 226 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 231 231 231 250 250 250
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 228 184 62
--241 196 14 241 208 19 232 195 16 38 30 10
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 6 6 6 30 30 30 26 26 26
--203 166 17 154 142 90 66 66 66 26 26 26
-- 6 6 6 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 6 6 6 18 18 18 38 38 38 58 58 58
-- 78 78 78 86 86 86 101 101 101 123 123 123
--175 146 61 210 150 10 234 174 13 246 186 14
--246 190 14 246 190 14 246 190 14 238 190 10
--102 78 10 2 2 6 46 46 46 198 198 198
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 234 234 234 242 242 242
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 224 178 62
--242 186 14 241 196 14 210 166 10 22 18 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 6 6 6 121 92 8
--238 202 15 232 195 16 82 82 82 34 34 34
-- 10 10 10 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 14 14 14 38 38 38 70 70 70 154 122 46
--190 142 34 200 144 11 197 138 11 197 138 11
--213 154 11 226 170 11 242 186 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--225 175 15 46 32 6 2 2 6 22 22 22
--158 158 158 250 250 250 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 250 250 250 242 242 242 224 178 62
--239 182 13 236 186 11 213 154 11 46 32 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 61 42 6 225 175 15
--238 190 10 236 186 11 112 100 78 42 42 42
-- 14 14 14 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 6 6 6
-- 22 22 22 54 54 54 154 122 46 213 154 11
--226 170 11 230 174 11 226 170 11 226 170 11
--236 178 12 242 186 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--241 196 14 184 144 12 10 10 10 2 2 6
-- 6 6 6 116 116 116 242 242 242 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 231 231 231 198 198 198 214 170 54
--236 178 12 236 178 12 210 150 10 137 92 6
-- 18 14 6 2 2 6 2 2 6 2 2 6
-- 6 6 6 70 47 6 200 144 11 236 178 12
--239 182 13 239 182 13 124 112 88 58 58 58
-- 22 22 22 6 6 6 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 10 10 10
-- 30 30 30 70 70 70 180 133 36 226 170 11
--239 182 13 242 186 14 242 186 14 246 186 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 232 195 16 98 70 6 2 2 6
-- 2 2 6 2 2 6 66 66 66 221 221 221
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 206 206 206 198 198 198 214 166 58
--230 174 11 230 174 11 216 158 10 192 133 9
--163 110 8 116 81 8 102 78 10 116 81 8
--167 114 7 197 138 11 226 170 11 239 182 13
--242 186 14 242 186 14 162 146 94 78 78 78
-- 34 34 34 14 14 14 6 6 6 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 6 6 6
-- 30 30 30 78 78 78 190 142 34 226 170 11
--239 182 13 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 241 196 14 203 166 17 22 18 6
-- 2 2 6 2 2 6 2 2 6 38 38 38
--218 218 218 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--250 250 250 206 206 206 198 198 198 202 162 69
--226 170 11 236 178 12 224 166 10 210 150 10
--200 144 11 197 138 11 192 133 9 197 138 11
--210 150 10 226 170 11 242 186 14 246 190 14
--246 190 14 246 186 14 225 175 15 124 112 88
-- 62 62 62 30 30 30 14 14 14 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 10 10 10
-- 30 30 30 78 78 78 174 135 50 224 166 10
--239 182 13 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 241 196 14 139 102 15
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 78 78 78 250 250 250 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--250 250 250 214 214 214 198 198 198 190 150 46
--219 162 10 236 178 12 234 174 13 224 166 10
--216 158 10 213 154 11 213 154 11 216 158 10
--226 170 11 239 182 13 246 190 14 246 190 14
--246 190 14 246 190 14 242 186 14 206 162 42
--101 101 101 58 58 58 30 30 30 14 14 14
-- 6 6 6 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 10 10 10
-- 30 30 30 74 74 74 174 135 50 216 158 10
--236 178 12 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 241 196 14 226 184 13
-- 61 42 6 2 2 6 2 2 6 2 2 6
-- 22 22 22 238 238 238 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 226 226 226 187 187 187 180 133 36
--216 158 10 236 178 12 239 182 13 236 178 12
--230 174 11 226 170 11 226 170 11 230 174 11
--236 178 12 242 186 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 186 14 239 182 13
--206 162 42 106 106 106 66 66 66 34 34 34
-- 14 14 14 6 6 6 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 6 6 6
-- 26 26 26 70 70 70 163 133 67 213 154 11
--236 178 12 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 241 196 14
--190 146 13 18 14 6 2 2 6 2 2 6
-- 46 46 46 246 246 246 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 221 221 221 86 86 86 156 107 11
--216 158 10 236 178 12 242 186 14 246 186 14
--242 186 14 239 182 13 239 182 13 242 186 14
--242 186 14 246 186 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--242 186 14 225 175 15 142 122 72 66 66 66
-- 30 30 30 10 10 10 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 6 6 6
-- 26 26 26 70 70 70 163 133 67 210 150 10
--236 178 12 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--232 195 16 121 92 8 34 34 34 106 106 106
--221 221 221 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--242 242 242 82 82 82 18 14 6 163 110 8
--216 158 10 236 178 12 242 186 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 242 186 14 163 133 67
-- 46 46 46 18 18 18 6 6 6 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 10 10 10
-- 30 30 30 78 78 78 163 133 67 210 150 10
--236 178 12 246 186 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--241 196 14 215 174 15 190 178 144 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 218 218 218
-- 58 58 58 2 2 6 22 18 6 167 114 7
--216 158 10 236 178 12 246 186 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 186 14 242 186 14 190 150 46
-- 54 54 54 22 22 22 6 6 6 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 14 14 14
-- 38 38 38 86 86 86 180 133 36 213 154 11
--236 178 12 246 186 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 232 195 16 190 146 13 214 214 214
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 250 250 250 170 170 170 26 26 26
-- 2 2 6 2 2 6 37 26 9 163 110 8
--219 162 10 239 182 13 246 186 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 186 14 236 178 12 224 166 10 142 122 72
-- 46 46 46 18 18 18 6 6 6 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 6 6 6 18 18 18
-- 50 50 50 109 106 95 192 133 9 224 166 10
--242 186 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--242 186 14 226 184 13 210 162 10 142 110 46
--226 226 226 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--253 253 253 253 253 253 253 253 253 253 253 253
--198 198 198 66 66 66 2 2 6 2 2 6
-- 2 2 6 2 2 6 50 34 6 156 107 11
--219 162 10 239 182 13 246 186 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 242 186 14
--234 174 13 213 154 11 154 122 46 66 66 66
-- 30 30 30 10 10 10 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 6 6 6 22 22 22
-- 58 58 58 154 121 60 206 145 10 234 174 13
--242 186 14 246 186 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 186 14 236 178 12 210 162 10 163 110 8
-- 61 42 6 138 138 138 218 218 218 250 250 250
--253 253 253 253 253 253 253 253 253 250 250 250
--242 242 242 210 210 210 144 144 144 66 66 66
-- 6 6 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 61 42 6 163 110 8
--216 158 10 236 178 12 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 239 182 13 230 174 11 216 158 10
--190 142 34 124 112 88 70 70 70 38 38 38
-- 18 18 18 6 6 6 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 6 6 6 22 22 22
-- 62 62 62 168 124 44 206 145 10 224 166 10
--236 178 12 239 182 13 242 186 14 242 186 14
--246 186 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 236 178 12 216 158 10 175 118 6
-- 80 54 7 2 2 6 6 6 6 30 30 30
-- 54 54 54 62 62 62 50 50 50 38 38 38
-- 14 14 14 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 6 6 6 80 54 7 167 114 7
--213 154 11 236 178 12 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 190 14 242 186 14 239 182 13 239 182 13
--230 174 11 210 150 10 174 135 50 124 112 88
-- 82 82 82 54 54 54 34 34 34 18 18 18
-- 6 6 6 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 6 6 6 18 18 18
-- 50 50 50 158 118 36 192 133 9 200 144 11
--216 158 10 219 162 10 224 166 10 226 170 11
--230 174 11 236 178 12 239 182 13 239 182 13
--242 186 14 246 186 14 246 190 14 246 190 14
--246 190 14 246 190 14 246 190 14 246 190 14
--246 186 14 230 174 11 210 150 10 163 110 8
--104 69 6 10 10 10 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 6 6 6 91 60 6 167 114 7
--206 145 10 230 174 11 242 186 14 246 190 14
--246 190 14 246 190 14 246 186 14 242 186 14
--239 182 13 230 174 11 224 166 10 213 154 11
--180 133 36 124 112 88 86 86 86 58 58 58
-- 38 38 38 22 22 22 10 10 10 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 14 14 14
-- 34 34 34 70 70 70 138 110 50 158 118 36
--167 114 7 180 123 7 192 133 9 197 138 11
--200 144 11 206 145 10 213 154 11 219 162 10
--224 166 10 230 174 11 239 182 13 242 186 14
--246 186 14 246 186 14 246 186 14 246 186 14
--239 182 13 216 158 10 185 133 11 152 99 6
--104 69 6 18 14 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 2 2 6 2 2 6 2 2 6
-- 2 2 6 6 6 6 80 54 7 152 99 6
--192 133 9 219 162 10 236 178 12 239 182 13
--246 186 14 242 186 14 239 182 13 236 178 12
--224 166 10 206 145 10 192 133 9 154 121 60
-- 94 94 94 62 62 62 42 42 42 22 22 22
-- 14 14 14 6 6 6 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 6 6 6
-- 18 18 18 34 34 34 58 58 58 78 78 78
--101 98 89 124 112 88 142 110 46 156 107 11
--163 110 8 167 114 7 175 118 6 180 123 7
--185 133 11 197 138 11 210 150 10 219 162 10
--226 170 11 236 178 12 236 178 12 234 174 13
--219 162 10 197 138 11 163 110 8 130 83 6
-- 91 60 6 10 10 10 2 2 6 2 2 6
-- 18 18 18 38 38 38 38 38 38 38 38 38
-- 38 38 38 38 38 38 38 38 38 38 38 38
-- 38 38 38 38 38 38 26 26 26 2 2 6
-- 2 2 6 6 6 6 70 47 6 137 92 6
--175 118 6 200 144 11 219 162 10 230 174 11
--234 174 13 230 174 11 219 162 10 210 150 10
--192 133 9 163 110 8 124 112 88 82 82 82
-- 50 50 50 30 30 30 14 14 14 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 6 6 6 14 14 14 22 22 22 34 34 34
-- 42 42 42 58 58 58 74 74 74 86 86 86
--101 98 89 122 102 70 130 98 46 121 87 25
--137 92 6 152 99 6 163 110 8 180 123 7
--185 133 11 197 138 11 206 145 10 200 144 11
--180 123 7 156 107 11 130 83 6 104 69 6
-- 50 34 6 54 54 54 110 110 110 101 98 89
-- 86 86 86 82 82 82 78 78 78 78 78 78
-- 78 78 78 78 78 78 78 78 78 78 78 78
-- 78 78 78 82 82 82 86 86 86 94 94 94
--106 106 106 101 101 101 86 66 34 124 80 6
--156 107 11 180 123 7 192 133 9 200 144 11
--206 145 10 200 144 11 192 133 9 175 118 6
--139 102 15 109 106 95 70 70 70 42 42 42
-- 22 22 22 10 10 10 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 6 6 6 10 10 10
-- 14 14 14 22 22 22 30 30 30 38 38 38
-- 50 50 50 62 62 62 74 74 74 90 90 90
--101 98 89 112 100 78 121 87 25 124 80 6
--137 92 6 152 99 6 152 99 6 152 99 6
--138 86 6 124 80 6 98 70 6 86 66 30
--101 98 89 82 82 82 58 58 58 46 46 46
-- 38 38 38 34 34 34 34 34 34 34 34 34
-- 34 34 34 34 34 34 34 34 34 34 34 34
-- 34 34 34 34 34 34 38 38 38 42 42 42
-- 54 54 54 82 82 82 94 86 76 91 60 6
--134 86 6 156 107 11 167 114 7 175 118 6
--175 118 6 167 114 7 152 99 6 121 87 25
--101 98 89 62 62 62 34 34 34 18 18 18
-- 6 6 6 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 6 6 6 6 6 6 10 10 10
-- 18 18 18 22 22 22 30 30 30 42 42 42
-- 50 50 50 66 66 66 86 86 86 101 98 89
--106 86 58 98 70 6 104 69 6 104 69 6
--104 69 6 91 60 6 82 62 34 90 90 90
-- 62 62 62 38 38 38 22 22 22 14 14 14
-- 10 10 10 10 10 10 10 10 10 10 10 10
-- 10 10 10 10 10 10 6 6 6 10 10 10
-- 10 10 10 10 10 10 10 10 10 14 14 14
-- 22 22 22 42 42 42 70 70 70 89 81 66
-- 80 54 7 104 69 6 124 80 6 137 92 6
--134 86 6 116 81 8 100 82 52 86 86 86
-- 58 58 58 30 30 30 14 14 14 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 6 6 6 10 10 10 14 14 14
-- 18 18 18 26 26 26 38 38 38 54 54 54
-- 70 70 70 86 86 86 94 86 76 89 81 66
-- 89 81 66 86 86 86 74 74 74 50 50 50
-- 30 30 30 14 14 14 6 6 6 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 6 6 6 18 18 18 34 34 34 58 58 58
-- 82 82 82 89 81 66 89 81 66 89 81 66
-- 94 86 66 94 86 76 74 74 74 50 50 50
-- 26 26 26 14 14 14 6 6 6 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 6 6 6 6 6 6 14 14 14 18 18 18
-- 30 30 30 38 38 38 46 46 46 54 54 54
-- 50 50 50 42 42 42 30 30 30 18 18 18
-- 10 10 10 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 6 6 6 14 14 14 26 26 26
-- 38 38 38 50 50 50 58 58 58 58 58 58
-- 54 54 54 42 42 42 30 30 30 18 18 18
-- 10 10 10 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 6 6 6
-- 6 6 6 10 10 10 14 14 14 18 18 18
-- 18 18 18 14 14 14 10 10 10 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 6 6 6
-- 14 14 14 18 18 18 22 22 22 22 22 22
-- 18 18 18 14 14 14 10 10 10 6 6 6
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-- 0 0 0 0 0 0 0 0 0 0 0 0
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 3 3 3 0 0 0 0 0 0
-+0 0 0 0 0 0 0 0 0 0 0 0 3 3 3 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 1 1 1 0 0 0
-+0 0 0 3 3 3 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 2 1 0 2 1 0 3 2 2
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 2 2 2 0 0 0 3 4 3 26 28 28
-+37 38 37 37 38 37 14 17 19 2 2 2 0 0 0 2 2 2
-+5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 3 3 3 0 0 0 1 1 1 6 6 6
-+2 2 2 0 0 0 3 3 3 4 4 4 4 4 4 4 4 4
-+4 4 5 3 3 3 1 0 0 0 0 0 1 0 0 0 0 0
-+1 1 1 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+2 2 2 0 0 0 0 0 0 14 17 19 60 74 84 137 136 137
-+153 152 153 137 136 137 125 124 125 60 73 81 6 6 6 3 1 0
-+0 0 0 3 3 3 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 0 0 0 4 4 4 41 54 63 125 124 125
-+60 73 81 6 6 6 4 0 0 3 3 3 4 4 4 4 4 4
-+4 4 4 0 0 0 6 9 11 41 54 63 41 65 82 22 30 35
-+2 2 2 2 1 0 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 5 5 5 5 5 5 2 2 2 0 0 0
-+4 0 0 6 6 6 41 54 63 137 136 137 174 174 174 167 166 167
-+165 164 165 165 164 165 163 162 163 163 162 163 125 124 125 41 54 63
-+1 1 1 0 0 0 0 0 0 3 3 3 5 5 5 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 5 5 5
-+3 3 3 2 0 0 4 0 0 60 73 81 156 155 156 167 166 167
-+163 162 163 85 115 134 5 7 8 0 0 0 4 4 4 5 5 5
-+0 0 0 2 5 5 55 98 126 90 154 193 90 154 193 72 125 159
-+37 51 59 2 0 0 1 1 1 4 5 5 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 5 5 5 4 4 4 1 1 1 0 0 0 3 3 3
-+37 38 37 125 124 125 163 162 163 174 174 174 158 157 158 158 157 158
-+156 155 156 156 155 156 158 157 158 165 164 165 174 174 174 166 165 166
-+125 124 125 16 19 21 1 0 0 0 0 0 0 0 0 4 4 4
-+5 5 5 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 1 1 1
-+0 0 0 0 0 0 37 38 37 153 152 153 174 174 174 158 157 158
-+174 174 174 163 162 163 37 38 37 4 3 3 4 0 0 1 1 1
-+0 0 0 22 40 52 101 161 196 101 161 196 90 154 193 101 161 196
-+64 123 161 14 17 19 0 0 0 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
-+5 5 5 2 2 2 0 0 0 4 0 0 24 26 27 85 115 134
-+156 155 156 174 174 174 167 166 167 156 155 156 154 153 154 157 156 157
-+156 155 156 156 155 156 155 154 155 153 152 153 158 157 158 167 166 167
-+174 174 174 156 155 156 60 74 84 16 19 21 0 0 0 0 0 0
-+1 1 1 5 5 5 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 5 5 5 6 6 6 3 3 3 0 0 0 4 0 0
-+13 16 17 60 73 81 137 136 137 165 164 165 156 155 156 153 152 153
-+174 174 174 177 184 187 60 73 81 3 1 0 0 0 0 1 1 2
-+22 30 35 64 123 161 136 185 209 90 154 193 90 154 193 90 154 193
-+90 154 193 21 29 34 0 0 0 3 2 2 4 4 5 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 3 3 3
-+0 0 0 0 0 0 10 13 16 60 74 84 157 156 157 174 174 174
-+174 174 174 158 157 158 153 152 153 154 153 154 156 155 156 155 154 155
-+156 155 156 155 154 155 154 153 154 157 156 157 154 153 154 153 152 153
-+163 162 163 174 174 174 177 184 187 137 136 137 60 73 81 13 16 17
-+4 0 0 0 0 0 3 3 3 5 5 5 4 4 4 4 4 4
-+5 5 5 4 4 4 1 1 1 0 0 0 3 3 3 41 54 63
-+131 129 131 174 174 174 174 174 174 174 174 174 167 166 167 174 174 174
-+190 197 201 137 136 137 24 26 27 4 0 0 16 21 25 50 82 103
-+90 154 193 136 185 209 90 154 193 101 161 196 101 161 196 101 161 196
-+31 91 132 3 6 7 0 0 0 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 2 2 2 0 0 0 4 0 0
-+4 0 0 43 57 68 137 136 137 177 184 187 174 174 174 163 162 163
-+155 154 155 155 154 155 156 155 156 155 154 155 158 157 158 165 164 165
-+167 166 167 166 165 166 163 162 163 157 156 157 155 154 155 155 154 155
-+153 152 153 156 155 156 167 166 167 174 174 174 174 174 174 131 129 131
-+41 54 63 5 5 5 0 0 0 0 0 0 3 3 3 4 4 4
-+1 1 1 0 0 0 1 0 0 26 28 28 125 124 125 174 174 174
-+177 184 187 174 174 174 174 174 174 156 155 156 131 129 131 137 136 137
-+125 124 125 24 26 27 4 0 0 41 65 82 90 154 193 136 185 209
-+136 185 209 101 161 196 53 118 160 37 112 160 90 154 193 34 86 122
-+7 12 15 0 0 0 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 3 3 3 0 0 0 0 0 0 5 5 5 37 38 37
-+125 124 125 167 166 167 174 174 174 167 166 167 158 157 158 155 154 155
-+156 155 156 156 155 156 156 155 156 163 162 163 167 166 167 155 154 155
-+137 136 137 153 152 153 156 155 156 165 164 165 163 162 163 156 155 156
-+156 155 156 156 155 156 155 154 155 158 157 158 166 165 166 174 174 174
-+167 166 167 125 124 125 37 38 37 1 0 0 0 0 0 0 0 0
-+0 0 0 24 26 27 60 74 84 158 157 158 174 174 174 174 174 174
-+166 165 166 158 157 158 125 124 125 41 54 63 13 16 17 6 6 6
-+6 6 6 37 38 37 80 127 157 136 185 209 101 161 196 101 161 196
-+90 154 193 28 67 93 6 10 14 13 20 25 13 20 25 6 10 14
-+1 1 2 4 3 3 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+1 1 1 1 0 0 4 3 3 37 38 37 60 74 84 153 152 153
-+167 166 167 167 166 167 158 157 158 154 153 154 155 154 155 156 155 156
-+157 156 157 158 157 158 167 166 167 167 166 167 131 129 131 43 57 68
-+26 28 28 37 38 37 60 73 81 131 129 131 165 164 165 166 165 166
-+158 157 158 155 154 155 156 155 156 156 155 156 156 155 156 158 157 158
-+165 164 165 174 174 174 163 162 163 60 74 84 16 19 21 13 16 17
-+60 73 81 131 129 131 174 174 174 174 174 174 167 166 167 165 164 165
-+137 136 137 60 73 81 24 26 27 4 0 0 4 0 0 16 19 21
-+52 104 138 101 161 196 136 185 209 136 185 209 90 154 193 27 99 146
-+13 20 25 4 5 7 2 5 5 4 5 7 1 1 2 0 0 0
-+4 4 4 4 4 4 3 3 3 2 2 2 2 2 2 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 3 3 3 0 0 0
-+0 0 0 13 16 17 60 73 81 137 136 137 174 174 174 166 165 166
-+158 157 158 156 155 156 157 156 157 156 155 156 155 154 155 158 157 158
-+167 166 167 174 174 174 153 152 153 60 73 81 16 19 21 4 0 0
-+4 0 0 4 0 0 6 6 6 26 28 28 60 74 84 158 157 158
-+174 174 174 166 165 166 157 156 157 155 154 155 156 155 156 156 155 156
-+155 154 155 158 157 158 167 166 167 167 166 167 131 129 131 125 124 125
-+137 136 137 167 166 167 167 166 167 174 174 174 158 157 158 125 124 125
-+16 19 21 4 0 0 4 0 0 10 13 16 49 76 92 107 159 188
-+136 185 209 136 185 209 90 154 193 26 108 161 22 40 52 6 10 14
-+2 3 3 1 1 2 1 1 2 4 4 5 4 4 5 4 4 5
-+4 4 5 2 2 1 0 0 0 0 0 0 0 0 0 2 2 2
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 5 5 5 3 3 3 0 0 0 1 0 0 4 0 0
-+37 51 59 131 129 131 167 166 167 167 166 167 163 162 163 157 156 157
-+157 156 157 155 154 155 153 152 153 157 156 157 167 166 167 174 174 174
-+153 152 153 125 124 125 37 38 37 4 0 0 4 0 0 4 0 0
-+4 3 3 4 3 3 4 0 0 6 6 6 4 0 0 37 38 37
-+125 124 125 174 174 174 174 174 174 165 164 165 156 155 156 154 153 154
-+156 155 156 156 155 156 155 154 155 163 162 163 158 157 158 163 162 163
-+174 174 174 174 174 174 174 174 174 125 124 125 37 38 37 0 0 0
-+4 0 0 6 9 11 41 54 63 90 154 193 136 185 209 146 190 211
-+136 185 209 37 112 160 22 40 52 6 10 14 3 6 7 1 1 2
-+1 1 2 3 3 3 1 1 2 3 3 3 4 4 4 4 4 4
-+2 2 2 2 0 0 16 19 21 37 38 37 24 26 27 0 0 0
-+0 0 0 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 5 5 5
-+4 4 4 0 0 0 0 0 0 0 0 0 26 28 28 120 125 127
-+158 157 158 174 174 174 165 164 165 157 156 157 155 154 155 156 155 156
-+153 152 153 153 152 153 167 166 167 174 174 174 174 174 174 125 124 125
-+37 38 37 4 0 0 0 0 0 4 0 0 4 3 3 4 4 4
-+4 4 4 4 4 4 5 5 5 4 0 0 4 0 0 4 0 0
-+4 3 3 43 57 68 137 136 137 174 174 174 174 174 174 165 164 165
-+154 153 154 153 152 153 153 152 153 153 152 153 163 162 163 174 174 174
-+174 174 174 153 152 153 60 73 81 6 6 6 4 0 0 4 3 3
-+32 43 50 80 127 157 136 185 209 146 190 211 146 190 211 90 154 193
-+28 67 93 28 67 93 40 71 93 3 6 7 1 1 2 2 5 5
-+50 82 103 79 117 143 26 37 45 0 0 0 3 3 3 1 1 1
-+0 0 0 41 54 63 137 136 137 174 174 174 153 152 153 60 73 81
-+2 0 0 0 0 0
-+4 4 4 4 4 4 4 4 4 4 4 4 6 6 6 2 2 2
-+0 0 0 2 0 0 24 26 27 60 74 84 153 152 153 174 174 174
-+174 174 174 157 156 157 154 153 154 156 155 156 154 153 154 153 152 153
-+165 164 165 174 174 174 177 184 187 137 136 137 43 57 68 6 6 6
-+4 0 0 2 0 0 3 3 3 5 5 5 5 5 5 4 4 4
-+4 4 4 4 4 4 4 4 4 5 5 5 6 6 6 4 3 3
-+4 0 0 4 0 0 24 26 27 60 73 81 153 152 153 174 174 174
-+174 174 174 158 157 158 158 157 158 174 174 174 174 174 174 158 157 158
-+60 74 84 24 26 27 4 0 0 4 0 0 17 23 27 59 113 148
-+136 185 209 191 222 234 146 190 211 136 185 209 31 91 132 7 11 13
-+22 40 52 101 161 196 90 154 193 6 9 11 3 4 4 43 95 132
-+136 185 209 172 205 220 55 98 126 0 0 0 0 0 0 2 0 0
-+26 28 28 153 152 153 177 184 187 167 166 167 177 184 187 165 164 165
-+37 38 37 0 0 0
-+4 4 4 4 4 4 5 5 5 5 5 5 1 1 1 0 0 0
-+13 16 17 60 73 81 137 136 137 174 174 174 174 174 174 165 164 165
-+153 152 153 153 152 153 155 154 155 154 153 154 158 157 158 174 174 174
-+177 184 187 163 162 163 60 73 81 16 19 21 4 0 0 4 0 0
-+4 3 3 4 4 4 5 5 5 5 5 5 4 4 4 5 5 5
-+5 5 5 5 5 5 5 5 5 4 4 4 4 4 4 5 5 5
-+6 6 6 4 0 0 4 0 0 4 0 0 24 26 27 60 74 84
-+166 165 166 174 174 174 177 184 187 165 164 165 125 124 125 24 26 27
-+4 0 0 4 0 0 5 5 5 50 82 103 136 185 209 172 205 220
-+146 190 211 136 185 209 26 108 161 22 40 52 7 12 15 44 81 103
-+71 116 144 28 67 93 37 51 59 41 65 82 100 139 164 101 161 196
-+90 154 193 90 154 193 28 67 93 0 0 0 0 0 0 26 28 28
-+125 124 125 167 166 167 163 162 163 153 152 153 163 162 163 174 174 174
-+85 115 134 4 0 0
-+4 4 4 5 5 5 4 4 4 1 0 0 4 0 0 34 47 55
-+125 124 125 174 174 174 174 174 174 167 166 167 157 156 157 153 152 153
-+155 154 155 155 154 155 158 157 158 166 165 166 167 166 167 154 153 154
-+125 124 125 26 28 28 4 0 0 4 0 0 4 0 0 5 5 5
-+5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 1 1 1
-+0 0 0 0 0 0 1 1 1 4 4 4 4 4 4 4 4 4
-+5 5 5 5 5 5 4 3 3 4 0 0 4 0 0 6 6 6
-+37 38 37 131 129 131 137 136 137 37 38 37 0 0 0 4 0 0
-+4 5 5 43 61 72 90 154 193 172 205 220 146 190 211 136 185 209
-+90 154 193 28 67 93 13 20 25 43 61 72 71 116 144 44 81 103
-+2 5 5 7 11 13 59 113 148 101 161 196 90 154 193 28 67 93
-+13 20 25 6 10 14 0 0 0 13 16 17 60 73 81 137 136 137
-+166 165 166 158 157 158 156 155 156 154 153 154 167 166 167 174 174 174
-+60 73 81 4 0 0
-+4 4 4 4 4 4 0 0 0 3 3 3 60 74 84 174 174 174
-+174 174 174 167 166 167 163 162 163 155 154 155 157 156 157 155 154 155
-+156 155 156 163 162 163 167 166 167 158 157 158 125 124 125 37 38 37
-+4 3 3 4 0 0 4 0 0 6 6 6 6 6 6 5 5 5
-+4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 2 3 3
-+10 13 16 7 11 13 1 0 0 0 0 0 2 2 1 4 4 4
-+4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 4 0 0
-+4 0 0 7 11 13 13 16 17 4 0 0 3 3 3 34 47 55
-+80 127 157 146 190 211 172 205 220 136 185 209 136 185 209 136 185 209
-+28 67 93 22 40 52 55 98 126 55 98 126 21 29 34 7 11 13
-+50 82 103 101 161 196 101 161 196 35 83 115 13 20 25 2 2 1
-+1 1 2 1 1 2 37 51 59 131 129 131 174 174 174 174 174 174
-+167 166 167 163 162 163 163 162 163 167 166 167 174 174 174 125 124 125
-+16 19 21 4 0 0
-+4 4 4 4 0 0 4 0 0 60 74 84 174 174 174 174 174 174
-+158 157 158 155 154 155 155 154 155 156 155 156 155 154 155 158 157 158
-+167 166 167 165 164 165 131 129 131 60 73 81 13 16 17 4 0 0
-+4 0 0 4 3 3 6 6 6 4 3 3 5 5 5 4 4 4
-+4 4 4 3 2 2 0 0 0 0 0 0 7 11 13 45 69 86
-+80 127 157 71 116 144 43 61 72 7 11 13 0 0 0 1 1 1
-+4 3 3 4 4 4 4 4 4 4 4 4 6 6 6 5 5 5
-+3 2 2 4 0 0 1 0 0 21 29 34 59 113 148 136 185 209
-+146 190 211 136 185 209 136 185 209 136 185 209 136 185 209 136 185 209
-+68 124 159 44 81 103 22 40 52 13 16 17 43 61 72 90 154 193
-+136 185 209 59 113 148 21 29 34 3 4 3 1 1 1 0 0 0
-+24 26 27 125 124 125 163 162 163 174 174 174 166 165 166 165 164 165
-+163 162 163 125 124 125 125 124 125 125 124 125 125 124 125 26 28 28
-+4 0 0 4 3 3
-+3 3 3 0 0 0 24 26 27 153 152 153 177 184 187 158 157 158
-+156 155 156 156 155 156 155 154 155 155 154 155 165 164 165 174 174 174
-+155 154 155 60 74 84 26 28 28 4 0 0 4 0 0 3 1 0
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 3 3
-+2 0 0 0 0 0 0 0 0 32 43 50 72 125 159 101 161 196
-+136 185 209 101 161 196 101 161 196 79 117 143 32 43 50 0 0 0
-+0 0 0 2 2 2 4 4 4 4 4 4 3 3 3 1 0 0
-+0 0 0 4 5 5 49 76 92 101 161 196 146 190 211 146 190 211
-+136 185 209 136 185 209 136 185 209 136 185 209 136 185 209 90 154 193
-+28 67 93 13 16 17 37 51 59 80 127 157 136 185 209 90 154 193
-+22 40 52 6 9 11 3 4 3 2 2 1 16 19 21 60 73 81
-+137 136 137 163 162 163 158 157 158 166 165 166 167 166 167 153 152 153
-+60 74 84 37 38 37 6 6 6 13 16 17 4 0 0 1 0 0
-+3 2 2 4 4 4
-+3 2 2 4 0 0 37 38 37 137 136 137 167 166 167 158 157 158
-+157 156 157 154 153 154 157 156 157 167 166 167 174 174 174 125 124 125
-+37 38 37 4 0 0 4 0 0 4 0 0 4 3 3 4 4 4
-+4 4 4 4 4 4 5 5 5 5 5 5 1 1 1 0 0 0
-+0 0 0 16 21 25 55 98 126 90 154 193 136 185 209 101 161 196
-+101 161 196 101 161 196 136 185 209 136 185 209 101 161 196 55 98 126
-+14 17 19 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
-+22 40 52 90 154 193 146 190 211 146 190 211 136 185 209 136 185 209
-+136 185 209 136 185 209 136 185 209 101 161 196 35 83 115 7 11 13
-+17 23 27 59 113 148 136 185 209 101 161 196 34 86 122 7 12 15
-+2 5 5 3 4 3 6 6 6 60 73 81 131 129 131 163 162 163
-+166 165 166 174 174 174 174 174 174 163 162 163 125 124 125 41 54 63
-+13 16 17 4 0 0 4 0 0 4 0 0 1 0 0 2 2 2
-+4 4 4 4 4 4
-+1 1 1 2 1 0 43 57 68 137 136 137 153 152 153 153 152 153
-+163 162 163 156 155 156 165 164 165 167 166 167 60 74 84 6 6 6
-+4 0 0 4 0 0 5 5 5 4 4 4 4 4 4 4 4 4
-+4 5 5 6 6 6 4 3 3 0 0 0 0 0 0 11 15 18
-+40 71 93 100 139 164 101 161 196 101 161 196 101 161 196 101 161 196
-+101 161 196 101 161 196 101 161 196 101 161 196 136 185 209 136 185 209
-+101 161 196 45 69 86 6 6 6 0 0 0 17 23 27 55 98 126
-+136 185 209 146 190 211 136 185 209 136 185 209 136 185 209 136 185 209
-+136 185 209 136 185 209 90 154 193 22 40 52 7 11 13 50 82 103
-+136 185 209 136 185 209 53 118 160 22 40 52 7 11 13 2 5 5
-+3 4 3 37 38 37 125 124 125 157 156 157 166 165 166 167 166 167
-+174 174 174 174 174 174 137 136 137 60 73 81 4 0 0 4 0 0
-+4 0 0 4 0 0 5 5 5 3 3 3 3 3 3 4 4 4
-+4 4 4 4 4 4
-+4 0 0 4 0 0 41 54 63 137 136 137 125 124 125 131 129 131
-+155 154 155 167 166 167 174 174 174 60 74 84 6 6 6 4 0 0
-+4 3 3 6 6 6 4 4 4 4 4 4 4 4 4 5 5 5
-+4 4 4 1 1 1 0 0 0 3 6 7 41 65 82 72 125 159
-+101 161 196 101 161 196 101 161 196 90 154 193 90 154 193 101 161 196
-+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 136 185 209
-+136 185 209 136 185 209 80 127 157 55 98 126 101 161 196 146 190 211
-+136 185 209 136 185 209 136 185 209 101 161 196 136 185 209 101 161 196
-+136 185 209 101 161 196 35 83 115 22 30 35 101 161 196 172 205 220
-+90 154 193 28 67 93 7 11 13 2 5 5 3 4 3 13 16 17
-+85 115 134 167 166 167 174 174 174 174 174 174 174 174 174 174 174 174
-+167 166 167 60 74 84 13 16 17 4 0 0 4 0 0 4 3 3
-+6 6 6 5 5 5 4 4 4 5 5 5 4 4 4 5 5 5
-+5 5 5 5 5 5
-+1 1 1 4 0 0 41 54 63 137 136 137 137 136 137 125 124 125
-+131 129 131 167 166 167 157 156 157 37 38 37 6 6 6 4 0 0
-+6 6 6 5 5 5 4 4 4 4 4 4 4 5 5 2 2 1
-+0 0 0 0 0 0 26 37 45 58 111 146 101 161 196 101 161 196
-+101 161 196 90 154 193 90 154 193 90 154 193 101 161 196 101 161 196
-+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
-+101 161 196 136 185 209 136 185 209 136 185 209 146 190 211 136 185 209
-+136 185 209 101 161 196 136 185 209 136 185 209 101 161 196 136 185 209
-+101 161 196 136 185 209 136 185 209 136 185 209 136 185 209 16 89 141
-+7 11 13 2 5 5 2 5 5 13 16 17 60 73 81 154 154 154
-+174 174 174 174 174 174 174 174 174 174 174 174 163 162 163 125 124 125
-+24 26 27 4 0 0 4 0 0 4 0 0 5 5 5 5 5 5
-+4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 5 5 5
-+5 5 5 4 4 4
-+4 0 0 6 6 6 37 38 37 137 136 137 137 136 137 131 129 131
-+131 129 131 153 152 153 131 129 131 26 28 28 4 0 0 4 3 3
-+6 6 6 4 4 4 4 4 4 4 4 4 0 0 0 0 0 0
-+13 20 25 51 88 114 90 154 193 101 161 196 101 161 196 90 154 193
-+90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
-+101 161 196 101 161 196 101 161 196 101 161 196 136 185 209 101 161 196
-+101 161 196 136 185 209 101 161 196 136 185 209 136 185 209 101 161 196
-+136 185 209 101 161 196 136 185 209 101 161 196 101 161 196 101 161 196
-+136 185 209 136 185 209 136 185 209 37 112 160 21 29 34 5 7 8
-+2 5 5 13 16 17 43 57 68 131 129 131 174 174 174 174 174 174
-+174 174 174 167 166 167 157 156 157 125 124 125 37 38 37 4 0 0
-+4 0 0 4 0 0 5 5 5 5 5 5 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+1 1 1 4 0 0 41 54 63 153 152 153 137 136 137 137 136 137
-+137 136 137 153 152 153 125 124 125 24 26 27 4 0 0 3 2 2
-+4 4 4 4 4 4 4 3 3 4 0 0 3 6 7 43 61 72
-+64 123 161 101 161 196 90 154 193 90 154 193 90 154 193 90 154 193
-+90 154 193 90 154 193 90 154 193 90 154 193 101 161 196 90 154 193
-+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
-+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
-+136 185 209 101 161 196 101 161 196 136 185 209 136 185 209 101 161 196
-+101 161 196 90 154 193 28 67 93 13 16 17 7 11 13 3 6 7
-+37 51 59 125 124 125 163 162 163 174 174 174 167 166 167 166 165 166
-+167 166 167 131 129 131 60 73 81 4 0 0 4 0 0 4 0 0
-+3 3 3 5 5 5 6 6 6 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 0 0 4 0 0 41 54 63 137 136 137 153 152 153 137 136 137
-+153 152 153 157 156 157 125 124 125 24 26 27 0 0 0 2 2 2
-+4 4 4 4 4 4 2 0 0 0 0 0 28 67 93 90 154 193
-+90 154 193 90 154 193 90 154 193 90 154 193 64 123 161 90 154 193
-+90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
-+90 154 193 101 161 196 101 161 196 101 161 196 90 154 193 136 185 209
-+101 161 196 101 161 196 136 185 209 101 161 196 136 185 209 101 161 196
-+101 161 196 101 161 196 136 185 209 101 161 196 101 161 196 90 154 193
-+35 83 115 13 16 17 3 6 7 2 5 5 13 16 17 60 74 84
-+154 154 154 166 165 166 165 164 165 158 157 158 163 162 163 157 156 157
-+60 74 84 13 16 17 4 0 0 4 0 0 3 2 2 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+1 1 1 4 0 0 41 54 63 157 156 157 155 154 155 137 136 137
-+153 152 153 158 157 158 137 136 137 26 28 28 2 0 0 2 2 2
-+4 4 4 4 4 4 1 0 0 6 10 14 34 86 122 90 154 193
-+64 123 161 90 154 193 64 123 161 90 154 193 90 154 193 90 154 193
-+64 123 161 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
-+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
-+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
-+136 185 209 101 161 196 136 185 209 90 154 193 26 108 161 22 40 52
-+13 16 17 5 7 8 2 5 5 2 5 5 37 38 37 165 164 165
-+174 174 174 163 162 163 154 154 154 165 164 165 167 166 167 60 73 81
-+6 6 6 4 0 0 4 0 0 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 0 0 6 6 6 41 54 63 156 155 156 158 157 158 153 152 153
-+156 155 156 165 164 165 137 136 137 26 28 28 0 0 0 2 2 2
-+4 4 5 4 4 4 2 0 0 7 12 15 31 96 139 64 123 161
-+90 154 193 64 123 161 90 154 193 90 154 193 64 123 161 90 154 193
-+90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
-+90 154 193 90 154 193 90 154 193 101 161 196 101 161 196 101 161 196
-+101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 136 185 209
-+101 161 196 136 185 209 26 108 161 22 40 52 7 11 13 5 7 8
-+2 5 5 2 5 5 2 5 5 2 2 1 37 38 37 158 157 158
-+174 174 174 154 154 154 156 155 156 167 166 167 165 164 165 37 38 37
-+4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+3 1 0 4 0 0 60 73 81 157 156 157 163 162 163 153 152 153
-+158 157 158 167 166 167 137 136 137 26 28 28 2 0 0 2 2 2
-+4 5 5 4 4 4 4 0 0 7 12 15 24 86 132 26 108 161
-+37 112 160 64 123 161 90 154 193 64 123 161 90 154 193 90 154 193
-+90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
-+90 154 193 101 161 196 90 154 193 101 161 196 101 161 196 101 161 196
-+101 161 196 101 161 196 101 161 196 136 185 209 101 161 196 136 185 209
-+90 154 193 35 83 115 13 16 17 13 16 17 7 11 13 3 6 7
-+5 7 8 6 6 6 3 4 3 2 2 1 30 32 34 154 154 154
-+167 166 167 154 154 154 154 154 154 174 174 174 165 164 165 37 38 37
-+6 6 6 4 0 0 6 6 6 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 0 0 4 0 0 41 54 63 163 162 163 166 165 166 154 154 154
-+163 162 163 174 174 174 137 136 137 26 28 28 0 0 0 2 2 2
-+4 5 5 4 4 5 1 1 2 6 10 14 28 67 93 18 97 151
-+18 97 151 18 97 151 26 108 161 37 112 160 37 112 160 90 154 193
-+64 123 161 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
-+90 154 193 101 161 196 101 161 196 90 154 193 101 161 196 101 161 196
-+101 161 196 101 161 196 101 161 196 136 185 209 90 154 193 16 89 141
-+13 20 25 7 11 13 5 7 8 5 7 8 2 5 5 4 5 5
-+3 4 3 4 5 5 3 4 3 0 0 0 37 38 37 158 157 158
-+174 174 174 158 157 158 158 157 158 167 166 167 174 174 174 41 54 63
-+4 0 0 3 2 2 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+1 1 1 4 0 0 60 73 81 165 164 165 174 174 174 158 157 158
-+167 166 167 174 174 174 153 152 153 26 28 28 2 0 0 2 2 2
-+4 5 5 4 4 4 4 0 0 7 12 15 10 87 144 10 87 144
-+18 97 151 18 97 151 18 97 151 26 108 161 26 108 161 26 108 161
-+26 108 161 37 112 160 53 118 160 90 154 193 90 154 193 90 154 193
-+90 154 193 90 154 193 101 161 196 101 161 196 101 161 196 101 161 196
-+101 161 196 136 185 209 90 154 193 26 108 161 22 40 52 13 16 17
-+7 11 13 3 6 7 5 7 8 5 7 8 2 5 5 4 5 5
-+4 5 5 6 6 6 3 4 3 0 0 0 30 32 34 158 157 158
-+174 174 174 156 155 156 155 154 155 165 164 165 154 153 154 37 38 37
-+4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 0 0 4 0 0 60 73 81 167 166 167 174 174 174 163 162 163
-+174 174 174 174 174 174 153 152 153 26 28 28 0 0 0 3 3 3
-+5 5 5 4 4 4 1 1 2 7 12 15 28 67 93 18 97 151
-+18 97 151 18 97 151 18 97 151 18 97 151 18 97 151 26 108 161
-+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
-+90 154 193 26 108 161 90 154 193 90 154 193 90 154 193 101 161 196
-+101 161 196 26 108 161 22 40 52 13 16 17 7 11 13 2 5 5
-+2 5 5 6 6 6 2 5 5 4 5 5 4 5 5 4 5 5
-+3 4 3 5 5 5 3 4 3 2 0 0 30 32 34 137 136 137
-+153 152 153 137 136 137 131 129 131 137 136 137 131 129 131 37 38 37
-+4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+1 1 1 4 0 0 60 73 81 167 166 167 174 174 174 166 165 166
-+174 174 174 177 184 187 153 152 153 30 32 34 1 0 0 3 3 3
-+5 5 5 4 3 3 4 0 0 7 12 15 10 87 144 10 87 144
-+18 97 151 18 97 151 18 97 151 26 108 161 26 108 161 26 108 161
-+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
-+26 108 161 26 108 161 26 108 161 90 154 193 90 154 193 26 108 161
-+35 83 115 13 16 17 7 11 13 5 7 8 3 6 7 5 7 8
-+2 5 5 6 6 6 4 5 5 4 5 5 3 4 3 4 5 5
-+3 4 3 6 6 6 3 4 3 0 0 0 26 28 28 125 124 125
-+131 129 131 125 124 125 125 124 125 131 129 131 131 129 131 37 38 37
-+4 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+3 1 0 4 0 0 60 73 81 174 174 174 177 184 187 167 166 167
-+174 174 174 177 184 187 153 152 153 30 32 34 0 0 0 3 3 3
-+5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 18 97 151
-+18 97 151 18 97 151 18 97 151 18 97 151 18 97 151 26 108 161
-+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
-+26 108 161 90 154 193 26 108 161 26 108 161 24 86 132 13 20 25
-+7 11 13 13 20 25 22 40 52 5 7 8 3 4 3 3 4 3
-+4 5 5 3 4 3 4 5 5 3 4 3 4 5 5 3 4 3
-+4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 125 124 125
-+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
-+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+1 1 1 4 0 0 60 73 81 174 174 174 177 184 187 174 174 174
-+174 174 174 190 197 201 157 156 157 30 32 34 1 0 0 3 3 3
-+5 5 5 4 3 3 4 0 0 7 12 15 10 87 144 10 87 144
-+18 97 151 19 95 150 19 95 150 18 97 151 18 97 151 26 108 161
-+18 97 151 26 108 161 26 108 161 26 108 161 26 108 161 90 154 193
-+26 108 161 26 108 161 26 108 161 22 40 52 2 5 5 3 4 3
-+28 67 93 37 112 160 34 86 122 2 5 5 3 4 3 3 4 3
-+3 4 3 3 4 3 3 4 3 2 2 1 3 4 3 4 4 4
-+4 5 5 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
-+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
-+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 0 0 4 0 0 60 73 81 174 174 174 177 184 187 174 174 174
-+174 174 174 190 197 201 158 157 158 30 32 34 0 0 0 2 2 2
-+5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 18 97 151
-+10 87 144 19 95 150 19 95 150 18 97 151 18 97 151 18 97 151
-+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
-+18 97 151 22 40 52 2 5 5 2 2 1 22 40 52 26 108 161
-+90 154 193 37 112 160 22 40 52 3 4 3 13 20 25 22 30 35
-+3 6 7 1 1 1 2 2 2 6 9 11 5 5 5 4 3 3
-+4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
-+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
-+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+1 1 1 4 0 0 60 73 81 177 184 187 193 200 203 174 174 174
-+177 184 187 193 200 203 163 162 163 30 32 34 4 0 0 2 2 2
-+5 5 5 4 3 3 4 0 0 6 10 14 24 86 132 10 87 144
-+10 87 144 10 87 144 19 95 150 19 95 150 19 95 150 18 97 151
-+26 108 161 26 108 161 26 108 161 90 154 193 26 108 161 28 67 93
-+6 10 14 2 5 5 13 20 25 24 86 132 37 112 160 90 154 193
-+10 87 144 7 12 15 2 5 5 28 67 93 37 112 160 28 67 93
-+2 2 1 7 12 15 35 83 115 28 67 93 3 6 7 1 0 0
-+4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
-+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
-+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 0 0 4 0 0 60 73 81 174 174 174 190 197 201 174 174 174
-+177 184 187 193 200 203 163 162 163 30 32 34 0 0 0 2 2 2
-+5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
-+10 87 144 16 89 141 19 95 150 10 87 144 26 108 161 26 108 161
-+26 108 161 26 108 161 26 108 161 28 67 93 6 10 14 1 1 2
-+7 12 15 28 67 93 26 108 161 16 89 141 24 86 132 21 29 34
-+3 4 3 21 29 34 37 112 160 37 112 160 27 99 146 21 29 34
-+21 29 34 26 108 161 90 154 193 35 83 115 1 1 2 2 0 0
-+4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 125 124 125
-+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
-+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+3 1 0 4 0 0 60 73 81 193 200 203 193 200 203 174 174 174
-+190 197 201 193 200 203 165 164 165 37 38 37 4 0 0 2 2 2
-+5 5 5 4 3 3 4 0 0 6 10 14 24 86 132 10 87 144
-+10 87 144 10 87 144 16 89 141 18 97 151 18 97 151 10 87 144
-+24 86 132 24 86 132 13 20 25 4 5 7 4 5 7 22 40 52
-+18 97 151 37 112 160 26 108 161 7 12 15 1 1 1 0 0 0
-+28 67 93 37 112 160 26 108 161 28 67 93 22 40 52 28 67 93
-+26 108 161 90 154 193 26 108 161 10 87 144 0 0 0 2 0 0
-+4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
-+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
-+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 0 0 6 6 6 60 73 81 174 174 174 193 200 203 174 174 174
-+190 197 201 193 200 203 165 164 165 30 32 34 0 0 0 2 2 2
-+5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
-+10 87 144 10 87 144 10 87 144 18 97 151 28 67 93 6 10 14
-+0 0 0 1 1 2 4 5 7 13 20 25 16 89 141 26 108 161
-+26 108 161 26 108 161 24 86 132 6 9 11 2 3 3 22 40 52
-+37 112 160 16 89 141 22 40 52 28 67 93 26 108 161 26 108 161
-+90 154 193 26 108 161 26 108 161 28 67 93 1 1 1 4 0 0
-+4 4 4 5 5 5 3 3 3 4 0 0 26 28 28 124 126 130
-+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
-+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 0 0 4 0 0 60 73 81 193 200 203 193 200 203 174 174 174
-+193 200 203 193 200 203 167 166 167 37 38 37 4 0 0 2 2 2
-+5 5 5 4 4 4 4 0 0 6 10 14 28 67 93 10 87 144
-+10 87 144 10 87 144 18 97 151 10 87 144 13 20 25 4 5 7
-+1 1 2 1 1 1 22 40 52 26 108 161 26 108 161 26 108 161
-+26 108 161 26 108 161 26 108 161 24 86 132 22 40 52 22 40 52
-+22 40 52 22 40 52 10 87 144 26 108 161 26 108 161 26 108 161
-+26 108 161 26 108 161 90 154 193 10 87 144 0 0 0 4 0 0
-+4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
-+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
-+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
-+190 197 201 205 212 215 167 166 167 30 32 34 0 0 0 2 2 2
-+5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
-+10 87 144 10 87 144 10 87 144 10 87 144 22 40 52 1 1 2
-+2 0 0 1 1 2 24 86 132 26 108 161 26 108 161 26 108 161
-+26 108 161 19 95 150 16 89 141 10 87 144 22 40 52 22 40 52
-+10 87 144 26 108 161 37 112 160 26 108 161 26 108 161 26 108 161
-+26 108 161 26 108 161 26 108 161 28 67 93 2 0 0 3 1 0
-+4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
-+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
-+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 0 0 4 0 0 60 73 81 220 221 221 190 197 201 174 174 174
-+193 200 203 193 200 203 174 174 174 37 38 37 4 0 0 2 2 2
-+5 5 5 4 4 4 3 2 2 1 1 2 13 20 25 10 87 144
-+10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 13 20 25
-+13 20 25 22 40 52 10 87 144 18 97 151 18 97 151 26 108 161
-+10 87 144 13 20 25 6 10 14 21 29 34 24 86 132 18 97 151
-+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
-+26 108 161 90 154 193 18 97 151 13 20 25 0 0 0 4 3 3
-+4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
-+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
-+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
-+190 197 201 220 221 221 167 166 167 30 32 34 1 0 0 2 2 2
-+5 5 5 4 4 4 4 4 5 2 5 5 4 5 7 13 20 25
-+28 67 93 10 87 144 10 87 144 10 87 144 10 87 144 10 87 144
-+10 87 144 10 87 144 18 97 151 10 87 144 18 97 151 18 97 151
-+28 67 93 2 3 3 0 0 0 28 67 93 26 108 161 26 108 161
-+26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
-+26 108 161 10 87 144 13 20 25 1 1 2 3 2 2 4 4 4
-+4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
-+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
-+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 0 0 4 0 0 60 73 81 220 221 221 190 197 201 174 174 174
-+193 200 203 193 200 203 174 174 174 26 28 28 4 0 0 4 3 3
-+5 5 5 4 4 4 4 4 4 4 4 5 1 1 2 2 5 5
-+4 5 7 22 40 52 10 87 144 10 87 144 18 97 151 10 87 144
-+10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 18 97 151
-+10 87 144 28 67 93 22 40 52 10 87 144 26 108 161 18 97 151
-+18 97 151 18 97 151 26 108 161 26 108 161 26 108 161 26 108 161
-+22 40 52 1 1 2 0 0 0 2 3 3 4 4 4 4 4 4
-+4 4 4 5 5 5 4 4 4 0 0 0 26 28 28 131 129 131
-+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
-+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
-+190 197 201 220 221 221 190 197 201 41 54 63 4 0 0 2 2 2
-+6 6 6 4 4 4 4 4 4 4 4 5 4 4 5 3 3 3
-+1 1 2 1 1 2 6 10 14 22 40 52 10 87 144 18 97 151
-+18 97 151 10 87 144 10 87 144 10 87 144 18 97 151 10 87 144
-+10 87 144 18 97 151 26 108 161 18 97 151 18 97 151 10 87 144
-+26 108 161 26 108 161 26 108 161 10 87 144 28 67 93 6 10 14
-+1 1 2 1 1 2 4 3 3 4 4 5 4 4 4 4 4 4
-+5 5 5 5 5 5 1 1 1 4 0 0 37 51 59 137 136 137
-+137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
-+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 0 0 4 0 0 60 73 81 220 221 221 193 200 203 174 174 174
-+193 200 203 193 200 203 220 221 221 137 136 137 13 16 17 4 0 0
-+2 2 2 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5
-+4 4 5 4 3 3 1 1 2 4 5 7 13 20 25 28 67 93
-+10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 10 87 144
-+10 87 144 18 97 151 18 97 151 10 87 144 18 97 151 26 108 161
-+26 108 161 18 97 151 28 67 93 6 10 14 0 0 0 0 0 0
-+2 3 3 4 5 5 4 4 5 4 4 4 4 4 4 5 5 5
-+3 3 3 1 1 1 0 0 0 16 19 21 125 124 125 137 136 137
-+131 129 131 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
-+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
-+193 200 203 190 197 201 220 221 221 220 221 221 153 152 153 30 32 34
-+0 0 0 0 0 0 2 2 2 4 4 4 4 4 4 4 4 4
-+4 4 4 4 5 5 4 5 7 1 1 2 1 1 2 4 5 7
-+13 20 25 28 67 93 10 87 144 18 97 151 10 87 144 10 87 144
-+10 87 144 10 87 144 10 87 144 18 97 151 26 108 161 18 97 151
-+28 67 93 7 12 15 0 0 0 0 0 0 2 2 1 4 4 4
-+4 5 5 4 5 5 4 4 4 4 4 4 3 3 3 0 0 0
-+0 0 0 0 0 0 37 38 37 125 124 125 158 157 158 131 129 131
-+125 124 125 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
-+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 3 3 4 0 0 41 54 63 193 200 203 220 221 221 174 174 174
-+193 200 203 193 200 203 193 200 203 220 221 221 244 246 246 193 200 203
-+120 125 127 5 5 5 1 0 0 0 0 0 1 1 1 4 4 4
-+4 4 4 4 4 4 4 5 5 4 5 5 4 4 5 1 1 2
-+4 5 7 4 5 7 22 40 52 10 87 144 10 87 144 10 87 144
-+10 87 144 10 87 144 18 97 151 10 87 144 10 87 144 13 20 25
-+4 5 7 2 3 3 1 1 2 4 4 4 4 5 5 4 4 4
-+4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 1 1 2
-+24 26 27 60 74 84 153 152 153 163 162 163 137 136 137 125 124 125
-+125 124 125 125 124 125 125 124 125 137 136 137 125 124 125 26 28 28
-+0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 0 0 6 6 6 26 28 28 156 155 156 220 221 221 220 221 221
-+174 174 174 193 200 203 193 200 203 193 200 203 205 212 215 220 221 221
-+220 221 221 167 166 167 60 73 81 7 11 13 0 0 0 0 0 0
-+3 3 3 4 4 4 4 4 4 4 4 4 4 4 5 4 4 5
-+4 4 5 1 1 2 1 1 2 4 5 7 22 40 52 10 87 144
-+10 87 144 10 87 144 10 87 144 22 40 52 4 5 7 1 1 2
-+1 1 2 4 4 5 4 4 4 4 4 4 4 4 4 4 4 4
-+5 5 5 2 2 2 0 0 0 4 0 0 16 19 21 60 73 81
-+137 136 137 167 166 167 158 157 158 137 136 137 131 129 131 131 129 131
-+125 124 125 125 124 125 131 129 131 155 154 155 60 74 84 5 7 8
-+0 0 0 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+5 5 5 4 0 0 4 0 0 60 73 81 193 200 203 220 221 221
-+193 200 203 193 200 203 193 200 203 193 200 203 205 212 215 220 221 221
-+220 221 221 220 221 221 220 221 221 137 136 137 43 57 68 6 6 6
-+4 0 0 1 1 1 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 5 4 4 5 3 2 2 1 1 2 2 5 5 13 20 25
-+22 40 52 22 40 52 13 20 25 2 3 3 1 1 2 3 3 3
-+4 5 7 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+1 1 1 0 0 0 2 3 3 41 54 63 131 129 131 166 165 166
-+166 165 166 155 154 155 153 152 153 137 136 137 137 136 137 125 124 125
-+125 124 125 137 136 137 137 136 137 125 124 125 37 38 37 4 3 3
-+4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 3 3 6 6 6 6 6 6 13 16 17 60 73 81 167 166 167
-+220 221 221 220 221 221 220 221 221 193 200 203 193 200 203 193 200 203
-+205 212 215 220 221 221 220 221 221 244 246 246 205 212 215 125 124 125
-+24 26 27 0 0 0 0 0 0 2 2 2 5 5 5 5 5 5
-+4 4 4 4 4 4 4 4 4 4 4 5 1 1 2 4 5 7
-+4 5 7 4 5 7 1 1 2 3 2 2 4 4 5 4 4 4
-+4 4 4 4 4 4 5 5 5 4 4 4 0 0 0 0 0 0
-+2 0 0 26 28 28 125 124 125 174 174 174 174 174 174 166 165 166
-+156 155 156 153 152 153 137 136 137 137 136 137 131 129 131 137 136 137
-+137 136 137 137 136 137 60 74 84 30 32 34 4 0 0 4 0 0
-+5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+5 5 5 6 6 6 4 0 0 4 0 0 6 6 6 26 28 28
-+125 124 125 174 174 174 220 221 221 220 221 221 220 221 221 193 200 203
-+205 212 215 220 221 221 205 212 215 220 221 221 220 221 221 244 246 246
-+193 200 203 60 74 84 13 16 17 4 0 0 0 0 0 3 3 3
-+5 5 5 5 5 5 4 4 4 4 4 4 4 4 5 3 3 3
-+1 1 2 3 3 3 4 4 5 4 4 5 4 4 4 4 4 4
-+5 5 5 5 5 5 2 2 2 0 0 0 0 0 0 13 16 17
-+60 74 84 174 174 174 193 200 203 174 174 174 167 166 167 163 162 163
-+153 152 153 153 152 153 137 136 137 137 136 137 153 152 153 137 136 137
-+125 124 125 41 54 63 24 26 27 4 0 0 4 0 0 5 5 5
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 3 3 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
-+6 6 6 37 38 37 131 129 131 220 221 221 220 221 221 220 221 221
-+193 200 203 193 200 203 220 221 221 205 212 215 220 221 221 244 246 246
-+244 246 246 244 246 246 174 174 174 41 54 63 0 0 0 0 0 0
-+0 0 0 4 4 4 5 5 5 5 5 5 4 4 4 4 4 5
-+4 4 5 4 4 5 4 4 4 4 4 4 6 6 6 6 6 6
-+3 3 3 0 0 0 2 0 0 13 16 17 60 73 81 156 155 156
-+220 221 221 193 200 203 174 174 174 165 164 165 163 162 163 154 153 154
-+153 152 153 153 152 153 158 157 158 163 162 163 137 136 137 60 73 81
-+13 16 17 4 0 0 4 0 0 4 3 3 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+5 5 5 4 3 3 4 3 3 6 6 6 6 6 6 6 6 6
-+6 6 6 6 6 6 6 6 6 37 38 37 167 166 167 244 246 246
-+244 246 246 220 221 221 205 212 215 205 212 215 220 221 221 193 200 203
-+220 221 221 244 246 246 244 246 246 244 246 246 137 136 137 37 38 37
-+3 2 2 0 0 0 1 1 1 5 5 5 5 5 5 4 4 4
-+4 4 4 4 4 4 4 4 4 5 5 5 4 4 4 1 1 1
-+0 0 0 5 5 5 43 57 68 153 152 153 193 200 203 220 221 221
-+177 184 187 174 174 174 167 166 167 166 165 166 158 157 158 157 156 157
-+158 157 158 166 165 166 156 155 156 85 115 134 13 16 17 4 0 0
-+4 0 0 4 0 0 5 5 5 5 5 5 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+5 5 5 4 3 3 6 6 6 6 6 6 4 0 0 6 6 6
-+6 6 6 6 6 6 6 6 6 6 6 6 13 16 17 60 73 81
-+177 184 187 220 221 221 220 221 221 220 221 221 205 212 215 220 221 221
-+220 221 221 205 212 215 220 221 221 244 246 246 244 246 246 205 212 215
-+125 124 125 30 32 34 0 0 0 0 0 0 2 2 2 5 5 5
-+4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 1 0 0
-+37 38 37 131 129 131 205 212 215 220 221 221 193 200 203 174 174 174
-+174 174 174 174 174 174 167 166 167 165 164 165 166 165 166 167 166 167
-+158 157 158 125 124 125 37 38 37 4 0 0 4 0 0 4 0 0
-+4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 5 5 5 4 3 3 4 3 3 6 6 6 6 6 6
-+4 0 0 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
-+26 28 28 125 124 125 205 212 215 220 221 221 220 221 221 220 221 221
-+205 212 215 220 221 221 205 212 215 220 221 221 220 221 221 244 246 246
-+244 246 246 190 197 201 60 74 84 16 19 21 4 0 0 0 0 0
-+0 0 0 0 0 0 0 0 0 0 0 0 16 19 21 120 125 127
-+177 184 187 220 221 221 205 212 215 177 184 187 174 174 174 177 184 187
-+174 174 174 174 174 174 167 166 167 174 174 174 166 165 166 137 136 137
-+60 73 81 13 16 17 4 0 0 4 0 0 4 3 3 6 6 6
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+5 5 5 4 3 3 5 5 5 4 3 3 6 6 6 4 0 0
-+6 6 6 6 6 6 4 0 0 6 6 6 4 0 0 6 6 6
-+6 6 6 6 6 6 37 38 37 137 136 137 193 200 203 220 221 221
-+220 221 221 205 212 215 220 221 221 205 212 215 205 212 215 220 221 221
-+220 221 221 220 221 221 244 246 246 166 165 166 43 57 68 2 2 2
-+0 0 0 4 0 0 16 19 21 60 73 81 157 156 157 202 210 214
-+220 221 221 193 200 203 177 184 187 177 184 187 177 184 187 174 174 174
-+174 174 174 174 174 174 174 174 174 157 156 157 60 74 84 24 26 27
-+4 0 0 4 0 0 4 0 0 6 6 6 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 5 5 5 4 3 3 5 5 5 6 6 6
-+6 6 6 4 0 0 6 6 6 6 6 6 6 6 6 4 0 0
-+4 0 0 4 0 0 6 6 6 24 26 27 60 73 81 167 166 167
-+220 221 221 220 221 221 220 221 221 205 212 215 205 212 215 205 212 215
-+205 212 215 220 221 221 220 221 221 220 221 221 205 212 215 137 136 137
-+60 74 84 125 124 125 137 136 137 190 197 201 220 221 221 193 200 203
-+177 184 187 177 184 187 177 184 187 174 174 174 174 174 174 177 184 187
-+190 197 201 174 174 174 125 124 125 37 38 37 6 6 6 4 0 0
-+4 0 0 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 5 5 5 5 5 5 4 3 3 6 6 6
-+4 0 0 6 6 6 6 6 6 6 6 6 4 0 0 6 6 6
-+6 6 6 6 6 6 4 0 0 4 0 0 6 6 6 6 6 6
-+125 124 125 193 200 203 244 246 246 220 221 221 205 212 215 205 212 215
-+205 212 215 193 200 203 205 212 215 205 212 215 220 221 221 220 221 221
-+193 200 203 193 200 203 205 212 215 193 200 203 193 200 203 177 184 187
-+190 197 201 190 197 201 174 174 174 190 197 201 193 200 203 190 197 201
-+153 152 153 60 73 81 4 0 0 4 0 0 4 0 0 3 2 2
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 4 3 3
-+6 6 6 4 3 3 4 3 3 4 3 3 6 6 6 6 6 6
-+4 0 0 6 6 6 6 6 6 6 6 6 4 0 0 4 0 0
-+4 0 0 26 28 28 131 129 131 220 221 221 244 246 246 220 221 221
-+205 212 215 193 200 203 205 212 215 193 200 203 193 200 203 205 212 215
-+220 221 221 193 200 203 193 200 203 193 200 203 190 197 201 174 174 174
-+174 174 174 190 197 201 193 200 203 193 200 203 167 166 167 125 124 125
-+6 6 6 4 0 0 4 0 0 4 3 3 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
-+5 5 5 4 3 3 5 5 5 6 6 6 4 3 3 5 5 5
-+6 6 6 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
-+4 0 0 4 0 0 6 6 6 41 54 63 158 157 158 220 221 221
-+220 221 221 220 221 221 193 200 203 193 200 203 193 200 203 190 197 201
-+190 197 201 190 197 201 190 197 201 190 197 201 174 174 174 193 200 203
-+193 200 203 220 221 221 174 174 174 125 124 125 37 38 37 4 0 0
-+4 0 0 4 3 3 6 6 6 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 5 5 5 4 3 3 4 3 3 4 3 3 5 5 5
-+4 3 3 6 6 6 5 5 5 4 3 3 6 6 6 6 6 6
-+6 6 6 6 6 6 4 0 0 4 0 0 13 16 17 60 73 81
-+174 174 174 220 221 221 220 221 221 205 212 215 190 197 201 174 174 174
-+193 200 203 174 174 174 190 197 201 174 174 174 193 200 203 220 221 221
-+193 200 203 131 129 131 37 38 37 6 6 6 4 0 0 4 0 0
-+6 6 6 6 6 6 4 3 3 5 5 5 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 5 5 5
-+5 5 5 4 3 3 4 3 3 5 5 5 4 3 3 4 3 3
-+5 5 5 6 6 6 6 6 6 4 0 0 6 6 6 6 6 6
-+6 6 6 125 124 125 174 174 174 220 221 221 220 221 221 193 200 203
-+193 200 203 193 200 203 193 200 203 193 200 203 220 221 221 158 157 158
-+60 73 81 6 6 6 4 0 0 4 0 0 5 5 5 6 6 6
-+5 5 5 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 5 5 5 5 5 5 4 3 3 5 5 5 4 3 3
-+5 5 5 5 5 5 6 6 6 6 6 6 4 0 0 4 0 0
-+4 0 0 4 0 0 26 28 28 125 124 125 174 174 174 193 200 203
-+193 200 203 174 174 174 193 200 203 167 166 167 125 124 125 6 6 6
-+6 6 6 6 6 6 4 0 0 6 6 6 6 6 6 5 5 5
-+4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
-+4 3 3 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
-+6 6 6 4 0 0 4 0 0 6 6 6 37 38 37 125 124 125
-+153 152 153 131 129 131 125 124 125 37 38 37 6 6 6 6 6 6
-+6 6 6 4 0 0 6 6 6 6 6 6 4 3 3 5 5 5
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 5 5 5 5 5 5 4 3 3 5 5 5 4 3 3
-+6 6 6 6 6 6 4 0 0 4 0 0 6 6 6 6 6 6
-+24 26 27 24 26 27 6 6 6 6 6 6 6 6 6 4 0 0
-+6 6 6 6 6 6 4 0 0 6 6 6 5 5 5 4 3 3
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 5 5 5 4 3 3 5 5 5 6 6 6
-+4 0 0 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
-+6 6 6 6 6 6 6 6 6 4 0 0 6 6 6 6 6 6
-+4 0 0 6 6 6 6 6 6 4 3 3 5 5 5 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 5 5 5
-+5 5 5 5 5 5 4 0 0 6 6 6 4 0 0 6 6 6
-+6 6 6 6 6 6 6 6 6 4 0 0 6 6 6 4 0 0
-+6 6 6 4 3 3 5 5 5 4 3 3 5 5 5 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
-+4 3 3 6 6 6 4 3 3 6 6 6 6 6 6 6 6 6
-+4 0 0 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
-+6 6 6 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 5 5 5 4 3 3 5 5 5 4 0 0 6 6 6
-+6 6 6 4 0 0 6 6 6 6 6 6 4 0 0 6 6 6
-+4 3 3 5 5 5 5 5 5 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 5 5 5 4 3 3 5 5 5 6 6 6 4 3 3
-+4 3 3 6 6 6 6 6 6 4 3 3 6 6 6 4 3 3
-+5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 6 6 6
-+5 5 5 4 3 3 4 3 3 4 3 3 5 5 5 5 5 5
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 4 3 3
-+5 5 5 4 3 3 5 5 5 5 5 5 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
-+4 4 4 4 4 4
-diff --git a/drivers/video/nvidia/nv_backlight.c b/drivers/video/nvidia/nv_backlight.c
-index 443e3c8..c443d6a 100644
---- a/drivers/video/nvidia/nv_backlight.c
-+++ b/drivers/video/nvidia/nv_backlight.c
-@@ -87,7 +87,7 @@ static int nvidia_bl_get_brightness(struct backlight_device *bd)
- return bd->props.brightness;
- }
-
--static struct backlight_ops nvidia_bl_ops = {
-+static const struct backlight_ops nvidia_bl_ops = {
- .get_brightness = nvidia_bl_get_brightness,
- .update_status = nvidia_bl_update_status,
- };
-diff --git a/drivers/video/riva/fbdev.c b/drivers/video/riva/fbdev.c
-index d94c57f..912984c 100644
---- a/drivers/video/riva/fbdev.c
-+++ b/drivers/video/riva/fbdev.c
-@@ -331,7 +331,7 @@ static int riva_bl_get_brightness(struct backlight_device *bd)
- return bd->props.brightness;
- }
-
--static struct backlight_ops riva_bl_ops = {
-+static const struct backlight_ops riva_bl_ops = {
- .get_brightness = riva_bl_get_brightness,
- .update_status = riva_bl_update_status,
- };
-diff --git a/drivers/video/uvesafb.c b/drivers/video/uvesafb.c
-index 6623a2e..d748f10 100644
---- a/drivers/video/uvesafb.c
-+++ b/drivers/video/uvesafb.c
-@@ -18,6 +18,7 @@
- #include <linux/fb.h>
- #include <linux/io.h>
- #include <linux/mutex.h>
-+#include <linux/moduleloader.h>
- #include <video/edid.h>
- #include <video/uvesafb.h>
- #ifdef CONFIG_X86
-@@ -72,7 +73,7 @@ static void uvesafb_cn_callback(struct cn_msg *msg, struct netlink_skb_parms *ns
- struct uvesafb_task *utask;
- struct uvesafb_ktask *task;
-
-- if (!cap_raised(nsp->eff_cap, CAP_SYS_ADMIN))
-+ if (!capable(CAP_SYS_ADMIN))
- return;
-
- if (msg->seq >= UVESAFB_TASKS_MAX)
-@@ -120,7 +121,7 @@ static int uvesafb_helper_start(void)
- NULL,
- };
-
-- return call_usermodehelper(v86d_path, argv, envp, 1);
-+ return call_usermodehelper(v86d_path, argv, envp, UMH_WAIT_PROC);
- }
-
- /*
-@@ -568,10 +569,32 @@ static int __devinit uvesafb_vbe_getpmi(struct uvesafb_ktask *task,
- if ((task->t.regs.eax & 0xffff) != 0x4f || task->t.regs.es < 0xc000) {
- par->pmi_setpal = par->ypan = 0;
- } else {
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+#ifdef CONFIG_MODULES
-+ par->pmi_code = module_alloc_exec((u16)task->t.regs.ecx);
-+#endif
-+ if (!par->pmi_code) {
-+ par->pmi_setpal = par->ypan = 0;
-+ return 0;
-+ }
-+#endif
-+
- par->pmi_base = (u16 *)phys_to_virt(((u32)task->t.regs.es << 4)
- + task->t.regs.edi);
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+ pax_open_kernel();
-+ memcpy(par->pmi_code, par->pmi_base, (u16)task->t.regs.ecx);
-+ pax_close_kernel();
-+
-+ par->pmi_start = ktva_ktla(par->pmi_code + par->pmi_base[1]);
-+ par->pmi_pal = ktva_ktla(par->pmi_code + par->pmi_base[2]);
-+#else
- par->pmi_start = (u8 *)par->pmi_base + par->pmi_base[1];
- par->pmi_pal = (u8 *)par->pmi_base + par->pmi_base[2];
-+#endif
-+
- printk(KERN_INFO "uvesafb: protected mode interface info at "
- "%04x:%04x\n",
- (u16)task->t.regs.es, (u16)task->t.regs.edi);
-@@ -1806,6 +1829,11 @@ out:
- if (par->vbe_modes)
- kfree(par->vbe_modes);
-
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+ if (par->pmi_code)
-+ module_free_exec(NULL, par->pmi_code);
-+#endif
-+
- framebuffer_release(info);
- return err;
- }
-@@ -1832,6 +1860,12 @@ static int uvesafb_remove(struct platform_device *dev)
- kfree(par->vbe_state_orig);
- if (par->vbe_state_saved)
- kfree(par->vbe_state_saved);
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+ if (par->pmi_code)
-+ module_free_exec(NULL, par->pmi_code);
-+#endif
-+
- }
-
- framebuffer_release(info);
-diff --git a/drivers/video/vesafb.c b/drivers/video/vesafb.c
-index bd37ee1..cb827e8 100644
---- a/drivers/video/vesafb.c
-+++ b/drivers/video/vesafb.c
-@@ -9,6 +9,7 @@
- */
-
- #include <linux/module.h>
-+#include <linux/moduleloader.h>
- #include <linux/kernel.h>
- #include <linux/errno.h>
- #include <linux/string.h>
-@@ -53,8 +54,8 @@ static int vram_remap __initdata; /* Set amount of memory to be used */
- static int vram_total __initdata; /* Set total amount of memory */
- static int pmi_setpal __read_mostly = 1; /* pmi for palette changes ??? */
- static int ypan __read_mostly; /* 0..nothing, 1..ypan, 2..ywrap */
--static void (*pmi_start)(void) __read_mostly;
--static void (*pmi_pal) (void) __read_mostly;
-+static void (*pmi_start)(void) __read_only;
-+static void (*pmi_pal) (void) __read_only;
- static int depth __read_mostly;
- static int vga_compat __read_mostly;
- /* --------------------------------------------------------------------- */
-@@ -233,6 +234,7 @@ static int __init vesafb_probe(struct platform_device *dev)
- unsigned int size_vmode;
- unsigned int size_remap;
- unsigned int size_total;
-+ void *pmi_code = NULL;
-
- if (screen_info.orig_video_isVGA != VIDEO_TYPE_VLFB)
- return -ENODEV;
-@@ -275,10 +277,6 @@ static int __init vesafb_probe(struct platform_device *dev)
- size_remap = size_total;
- vesafb_fix.smem_len = size_remap;
-
--#ifndef __i386__
-- screen_info.vesapm_seg = 0;
--#endif
--
- if (!request_mem_region(vesafb_fix.smem_start, size_total, "vesafb")) {
- printk(KERN_WARNING
- "vesafb: cannot reserve video memory at 0x%lx\n",
-@@ -315,9 +313,21 @@ static int __init vesafb_probe(struct platform_device *dev)
- printk(KERN_INFO "vesafb: mode is %dx%dx%d, linelength=%d, pages=%d\n",
- vesafb_defined.xres, vesafb_defined.yres, vesafb_defined.bits_per_pixel, vesafb_fix.line_length, screen_info.pages);
-
-+#ifdef __i386__
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+ pmi_code = module_alloc_exec(screen_info.vesapm_size);
-+ if (!pmi_code)
-+#elif !defined(CONFIG_PAX_KERNEXEC)
-+ if (0)
-+#endif
-+
-+#endif
-+ screen_info.vesapm_seg = 0;
-+
- if (screen_info.vesapm_seg) {
-- printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x\n",
-- screen_info.vesapm_seg,screen_info.vesapm_off);
-+ printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x %04x bytes\n",
-+ screen_info.vesapm_seg,screen_info.vesapm_off,screen_info.vesapm_size);
- }
-
- if (screen_info.vesapm_seg < 0xc000)
-@@ -325,9 +335,25 @@ static int __init vesafb_probe(struct platform_device *dev)
-
- if (ypan || pmi_setpal) {
- unsigned short *pmi_base;
-+
- pmi_base = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
-- pmi_start = (void*)((char*)pmi_base + pmi_base[1]);
-- pmi_pal = (void*)((char*)pmi_base + pmi_base[2]);
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+ pax_open_kernel();
-+ memcpy(pmi_code, pmi_base, screen_info.vesapm_size);
-+#else
-+ pmi_code = pmi_base;
-+#endif
-+
-+ pmi_start = (void*)((char*)pmi_code + pmi_base[1]);
-+ pmi_pal = (void*)((char*)pmi_code + pmi_base[2]);
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+ pmi_start = ktva_ktla(pmi_start);
-+ pmi_pal = ktva_ktla(pmi_pal);
-+ pax_close_kernel();
-+#endif
-+
- printk(KERN_INFO "vesafb: pmi: set display start = %p, set palette = %p\n",pmi_start,pmi_pal);
- if (pmi_base[3]) {
- printk(KERN_INFO "vesafb: pmi: ports = ");
-@@ -469,6 +495,11 @@ static int __init vesafb_probe(struct platform_device *dev)
- info->node, info->fix.id);
- return 0;
- err:
-+
-+#if defined(__i386__) && defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+ module_free_exec(NULL, pmi_code);
-+#endif
-+
- if (info->screen_base)
- iounmap(info->screen_base);
- framebuffer_release(info);
-diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
-index 1f6bb28..bd773f4 100644
---- a/drivers/watchdog/hpwdt.c
-+++ b/drivers/watchdog/hpwdt.c
-@@ -725,8 +725,11 @@ static int __devinit hpwdt_init_one(struct pci_dev *dev,
- * die notify list to handle a critical NMI. The default is to
- * be last so other users of the NMI signal can function.
- */
-- if (priority)
-- die_notifier.priority = 0x7FFFFFFF;
-+ if (priority) {
-+ pax_open_kernel();
-+ *(void **)&die_notifier.priority = 0x7FFFFFFF;
-+ pax_close_kernel();
-+ }
-
- retval = register_die_notifier(&die_notifier);
- if (retval != 0) {
-diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
-index 4204336..d2f0824 100644
---- a/drivers/xen/balloon.c
-+++ b/drivers/xen/balloon.c
-@@ -395,7 +395,9 @@ static int balloon_init_watcher(struct notifier_block *notifier,
- return NOTIFY_DONE;
- }
-
--static struct notifier_block xenstore_notifier;
-+static struct notifier_block xenstore_notifier = {
-+ .notifier_call = balloon_init_watcher,
-+};
-
- static int __init balloon_init(void)
- {
-@@ -427,7 +429,6 @@ static int __init balloon_init(void)
- }
-
- target_watch.callback = watch_target;
-- xenstore_notifier.notifier_call = balloon_init_watcher;
-
- register_xenstore_notifier(&xenstore_notifier);
-
-diff --git a/drivers/xen/sys-hypervisor.c b/drivers/xen/sys-hypervisor.c
-index 88a60e0..6783cc2 100644
---- a/drivers/xen/sys-hypervisor.c
-+++ b/drivers/xen/sys-hypervisor.c
-@@ -425,7 +425,7 @@ static ssize_t hyp_sysfs_store(struct kobject *kobj,
- return 0;
- }
-
--static struct sysfs_ops hyp_sysfs_ops = {
-+static const struct sysfs_ops hyp_sysfs_ops = {
- .show = hyp_sysfs_show,
- .store = hyp_sysfs_store,
- };
-diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
-index 18f74ec..3227009 100644
---- a/fs/9p/vfs_inode.c
-+++ b/fs/9p/vfs_inode.c
-@@ -1079,7 +1079,7 @@ static void *v9fs_vfs_follow_link(struct dentry *dentry, struct nameidata *nd)
- static void
- v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
- {
-- char *s = nd_get_link(nd);
-+ const char *s = nd_get_link(nd);
-
- P9_DPRINTK(P9_DEBUG_VFS, " %s %s\n", dentry->d_name.name,
- IS_ERR(s) ? "<error>" : s);
-diff --git a/fs/Kconfig.binfmt b/fs/Kconfig.binfmt
-index bb4cc5b..df5eaa0 100644
---- a/fs/Kconfig.binfmt
-+++ b/fs/Kconfig.binfmt
-@@ -86,7 +86,7 @@ config HAVE_AOUT
-
- config BINFMT_AOUT
- tristate "Kernel support for a.out and ECOFF binaries"
-- depends on HAVE_AOUT
-+ depends on HAVE_AOUT && BROKEN
- ---help---
- A.out (Assembler.OUTput) is a set of formats for libraries and
- executables used in the earliest versions of UNIX. Linux used
-diff --git a/fs/aio.c b/fs/aio.c
-index 22a19ad..d484e5b 100644
---- a/fs/aio.c
-+++ b/fs/aio.c
-@@ -115,7 +115,7 @@ static int aio_setup_ring(struct kioctx *ctx)
- size += sizeof(struct io_event) * nr_events;
- nr_pages = (size + PAGE_SIZE-1) >> PAGE_SHIFT;
-
-- if (nr_pages < 0)
-+ if (nr_pages <= 0)
- return -EINVAL;
-
- nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
-@@ -1089,6 +1089,8 @@ static int read_events(struct kioctx *ctx,
- struct aio_timeout to;
- int retry = 0;
-
-+ pax_track_stack();
-+
- /* needed to zero any padding within an entry (there shouldn't be
- * any, but C is fun!
- */
-@@ -1382,13 +1384,18 @@ static ssize_t aio_fsync(struct kiocb *iocb)
- static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb)
- {
- ssize_t ret;
-+ struct iovec iovstack;
-
- ret = rw_copy_check_uvector(type, (struct iovec __user *)kiocb->ki_buf,
- kiocb->ki_nbytes, 1,
-- &kiocb->ki_inline_vec, &kiocb->ki_iovec);
-+ &iovstack, &kiocb->ki_iovec);
- if (ret < 0)
- goto out;
-
-+ if (kiocb->ki_iovec == &iovstack) {
-+ kiocb->ki_inline_vec = iovstack;
-+ kiocb->ki_iovec = &kiocb->ki_inline_vec;
-+ }
- kiocb->ki_nr_segs = kiocb->ki_nbytes;
- kiocb->ki_cur_seg = 0;
- /* ki_nbytes/left now reflect bytes instead of segs */
-diff --git a/fs/attr.c b/fs/attr.c
-index 96d394b..33cf5b4 100644
---- a/fs/attr.c
-+++ b/fs/attr.c
-@@ -83,6 +83,7 @@ int inode_newsize_ok(const struct inode *inode, loff_t offset)
- unsigned long limit;
-
- limit = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
-+ gr_learn_resource(current, RLIMIT_FSIZE, (unsigned long)offset, 1);
- if (limit != RLIM_INFINITY && offset > limit)
- goto out_sig;
- if (offset > inode->i_sb->s_maxbytes)
-diff --git a/fs/autofs4/symlink.c b/fs/autofs4/symlink.c
-index b4ea829..e63ef18 100644
---- a/fs/autofs4/symlink.c
-+++ b/fs/autofs4/symlink.c
-@@ -15,7 +15,7 @@
- static void *autofs4_follow_link(struct dentry *dentry, struct nameidata *nd)
- {
- struct autofs_info *ino = autofs4_dentry_ino(dentry);
-- nd_set_link(nd, (char *)ino->u.symlink);
-+ nd_set_link(nd, ino->u.symlink);
- return NULL;
- }
-
-diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
-index 136a0d6..3330341 100644
---- a/fs/autofs4/waitq.c
-+++ b/fs/autofs4/waitq.c
-@@ -60,7 +60,7 @@ static int autofs4_write(struct file *file, const void *addr, int bytes)
- {
- unsigned long sigpipe, flags;
- mm_segment_t fs;
-- const char *data = (const char *)addr;
-+ const char __user *data = (const char __force_user *)addr;
- ssize_t wr = 0;
-
- /** WARNING: this is not safe for writing more than PIPE_BUF bytes! **/
-@@ -326,6 +326,10 @@ static int validate_request(struct autofs_wait_queue **wait,
- return 1;
- }
-
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+static atomic_unchecked_t autofs_dummy_name_id = ATOMIC_INIT(0);
-+#endif
-+
- int autofs4_wait(struct autofs_sb_info *sbi, struct dentry *dentry,
- enum autofs_notify notify)
- {
-@@ -359,7 +363,12 @@ int autofs4_wait(struct autofs_sb_info *sbi, struct dentry *dentry,
-
- /* If this is a direct mount request create a dummy name */
- if (IS_ROOT(dentry) && autofs_type_trigger(sbi->type))
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ /* this name does get written to userland via autofs4_write() */
-+ qstr.len = sprintf(name, "%08x", atomic_inc_return_unchecked(&autofs_dummy_name_id));
-+#else
- qstr.len = sprintf(name, "%p", dentry);
-+#endif
- else {
- qstr.len = autofs4_getpath(sbi, dentry, &name);
- if (!qstr.len) {
-diff --git a/fs/befs/linuxvfs.c b/fs/befs/linuxvfs.c
-index 9158c07..3f06659 100644
---- a/fs/befs/linuxvfs.c
-+++ b/fs/befs/linuxvfs.c
-@@ -498,7 +498,7 @@ static void befs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
- {
- befs_inode_info *befs_ino = BEFS_I(dentry->d_inode);
- if (befs_ino->i_flags & BEFS_LONG_SYMLINK) {
-- char *link = nd_get_link(nd);
-+ const char *link = nd_get_link(nd);
- if (!IS_ERR(link))
- kfree(link);
- }
-diff --git a/fs/binfmt_aout.c b/fs/binfmt_aout.c
-index 0133b5a..3710d09 100644
---- a/fs/binfmt_aout.c
-+++ b/fs/binfmt_aout.c
-@@ -16,6 +16,7 @@
- #include <linux/string.h>
- #include <linux/fs.h>
- #include <linux/file.h>
-+#include <linux/security.h>
- #include <linux/stat.h>
- #include <linux/fcntl.h>
- #include <linux/ptrace.h>
-@@ -102,6 +103,8 @@ static int aout_core_dump(long signr, struct pt_regs *regs, struct file *file, u
- #endif
- # define START_STACK(u) (u.start_stack)
-
-+ memset(&dump, 0, sizeof(dump));
-+
- fs = get_fs();
- set_fs(KERNEL_DS);
- has_dumped = 1;
-@@ -113,10 +116,12 @@ static int aout_core_dump(long signr, struct pt_regs *regs, struct file *file, u
-
- /* If the size of the dump file exceeds the rlimit, then see what would happen
- if we wrote the stack, but not the data area. */
-+ gr_learn_resource(current, RLIMIT_CORE, (dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE, 1);
- if ((dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE > limit)
- dump.u_dsize = 0;
-
- /* Make sure we have enough room to write the stack and data areas. */
-+ gr_learn_resource(current, RLIMIT_CORE, (dump.u_ssize + 1) * PAGE_SIZE, 1);
- if ((dump.u_ssize + 1) * PAGE_SIZE > limit)
- dump.u_ssize = 0;
-
-@@ -146,9 +151,7 @@ static int aout_core_dump(long signr, struct pt_regs *regs, struct file *file, u
- dump_size = dump.u_ssize << PAGE_SHIFT;
- DUMP_WRITE(dump_start,dump_size);
- }
--/* Finally dump the task struct. Not be used by gdb, but could be useful */
-- set_fs(KERNEL_DS);
-- DUMP_WRITE(current,sizeof(*current));
-+/* Finally, let's not dump the task struct. Not be used by gdb, but could be useful to an attacker */
- end_coredump:
- set_fs(fs);
- return has_dumped;
-@@ -249,6 +252,8 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
- rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
- if (rlim >= RLIM_INFINITY)
- rlim = ~0;
-+
-+ gr_learn_resource(current, RLIMIT_DATA, ex.a_data + ex.a_bss, 1);
- if (ex.a_data + ex.a_bss > rlim)
- return -ENOMEM;
-
-@@ -274,9 +279,37 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
- current->mm->free_area_cache = current->mm->mmap_base;
- current->mm->cached_hole_size = 0;
-
-+ retval = setup_arg_pages(bprm, STACK_TOP, EXSTACK_DEFAULT);
-+ if (retval < 0) {
-+ /* Someone check-me: is this error path enough? */
-+ send_sig(SIGKILL, current, 0);
-+ return retval;
-+ }
-+
- install_exec_creds(bprm);
- current->flags &= ~PF_FORKNOEXEC;
-
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+ current->mm->pax_flags = 0UL;
-+#endif
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (!(N_FLAGS(ex) & F_PAX_PAGEEXEC)) {
-+ current->mm->pax_flags |= MF_PAX_PAGEEXEC;
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+ if (N_FLAGS(ex) & F_PAX_EMUTRAMP)
-+ current->mm->pax_flags |= MF_PAX_EMUTRAMP;
-+#endif
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (!(N_FLAGS(ex) & F_PAX_MPROTECT))
-+ current->mm->pax_flags |= MF_PAX_MPROTECT;
-+#endif
-+
-+ }
-+#endif
-+
- if (N_MAGIC(ex) == OMAGIC) {
- unsigned long text_addr, map_size;
- loff_t pos;
-@@ -349,7 +382,7 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
-
- down_write(¤t->mm->mmap_sem);
- error = do_mmap(bprm->file, N_DATADDR(ex), ex.a_data,
-- PROT_READ | PROT_WRITE | PROT_EXEC,
-+ PROT_READ | PROT_WRITE,
- MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE,
- fd_offset + ex.a_text);
- up_write(¤t->mm->mmap_sem);
-@@ -367,13 +400,6 @@ beyond_if:
- return retval;
- }
-
-- retval = setup_arg_pages(bprm, STACK_TOP, EXSTACK_DEFAULT);
-- if (retval < 0) {
-- /* Someone check-me: is this error path enough? */
-- send_sig(SIGKILL, current, 0);
-- return retval;
-- }
--
- current->mm->start_stack =
- (unsigned long) create_aout_tables((char __user *) bprm->p, bprm);
- #ifdef __alpha__
-diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
-index a64fde6..621e25d 100644
---- a/fs/binfmt_elf.c
-+++ b/fs/binfmt_elf.c
-@@ -31,6 +31,7 @@
- #include <linux/random.h>
- #include <linux/elf.h>
- #include <linux/utsname.h>
-+#include <linux/xattr.h>
- #include <asm/uaccess.h>
- #include <asm/param.h>
- #include <asm/page.h>
-@@ -50,6 +51,10 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file, un
- #define elf_core_dump NULL
- #endif
-
-+#ifdef CONFIG_PAX_MPROTECT
-+static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags);
-+#endif
-+
- #if ELF_EXEC_PAGESIZE > PAGE_SIZE
- #define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE
- #else
-@@ -69,6 +74,11 @@ static struct linux_binfmt elf_format = {
- .load_binary = load_elf_binary,
- .load_shlib = load_elf_library,
- .core_dump = elf_core_dump,
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ .handle_mprotect= elf_handle_mprotect,
-+#endif
-+
- .min_coredump = ELF_EXEC_PAGESIZE,
- .hasvdso = 1
- };
-@@ -77,6 +87,8 @@ static struct linux_binfmt elf_format = {
-
- static int set_brk(unsigned long start, unsigned long end)
- {
-+ unsigned long e = end;
-+
- start = ELF_PAGEALIGN(start);
- end = ELF_PAGEALIGN(end);
- if (end > start) {
-@@ -87,7 +99,7 @@ static int set_brk(unsigned long start, unsigned long end)
- if (BAD_ADDR(addr))
- return addr;
- }
-- current->mm->start_brk = current->mm->brk = end;
-+ current->mm->start_brk = current->mm->brk = e;
- return 0;
- }
-
-@@ -148,12 +160,15 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
- elf_addr_t __user *u_rand_bytes;
- const char *k_platform = ELF_PLATFORM;
- const char *k_base_platform = ELF_BASE_PLATFORM;
-- unsigned char k_rand_bytes[16];
-+ u32 k_rand_bytes[4];
- int items;
- elf_addr_t *elf_info;
- int ei_index = 0;
- const struct cred *cred = current_cred();
- struct vm_area_struct *vma;
-+ unsigned long saved_auxv[AT_VECTOR_SIZE];
-+
-+ pax_track_stack();
-
- /*
- * In some cases (e.g. Hyper-Threading), we want to avoid L1
-@@ -195,8 +210,12 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
- * Generate 16 random bytes for userspace PRNG seeding.
- */
- get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
-- u_rand_bytes = (elf_addr_t __user *)
-- STACK_ALLOC(p, sizeof(k_rand_bytes));
-+ srandom32(k_rand_bytes[0] ^ random32());
-+ srandom32(k_rand_bytes[1] ^ random32());
-+ srandom32(k_rand_bytes[2] ^ random32());
-+ srandom32(k_rand_bytes[3] ^ random32());
-+ p = STACK_ROUND(p, sizeof(k_rand_bytes));
-+ u_rand_bytes = (elf_addr_t __user *) p;
- if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
- return -EFAULT;
-
-@@ -308,9 +327,11 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
- return -EFAULT;
- current->mm->env_end = p;
-
-+ memcpy(saved_auxv, elf_info, ei_index * sizeof(elf_addr_t));
-+
- /* Put the elf_info on the stack in the right place. */
- sp = (elf_addr_t __user *)envp + 1;
-- if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
-+ if (copy_to_user(sp, saved_auxv, ei_index * sizeof(elf_addr_t)))
- return -EFAULT;
- return 0;
- }
-@@ -380,15 +401,14 @@ static unsigned long total_mapping_size(struct elf_phdr *cmds, int nr)
- an ELF header */
-
- static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
-- struct file *interpreter, unsigned long *interp_map_addr,
-- unsigned long no_base)
-+ struct file *interpreter, unsigned long no_base)
- {
- struct elf_phdr *elf_phdata;
- struct elf_phdr *eppnt;
-- unsigned long load_addr = 0;
-+ unsigned long load_addr = 0, pax_task_size = TASK_SIZE;
- int load_addr_set = 0;
- unsigned long last_bss = 0, elf_bss = 0;
-- unsigned long error = ~0UL;
-+ unsigned long error = -EINVAL;
- unsigned long total_size;
- int retval, i, size;
-
-@@ -434,6 +454,11 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
- goto out_close;
- }
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
-+ pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
- eppnt = elf_phdata;
- for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
- if (eppnt->p_type == PT_LOAD) {
-@@ -457,8 +482,6 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
- map_addr = elf_map(interpreter, load_addr + vaddr,
- eppnt, elf_prot, elf_type, total_size);
- total_size = 0;
-- if (!*interp_map_addr)
-- *interp_map_addr = map_addr;
- error = map_addr;
- if (BAD_ADDR(map_addr))
- goto out_close;
-@@ -477,8 +500,8 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
- k = load_addr + eppnt->p_vaddr;
- if (BAD_ADDR(k) ||
- eppnt->p_filesz > eppnt->p_memsz ||
-- eppnt->p_memsz > TASK_SIZE ||
-- TASK_SIZE - eppnt->p_memsz < k) {
-+ eppnt->p_memsz > pax_task_size ||
-+ pax_task_size - eppnt->p_memsz < k) {
- error = -ENOMEM;
- goto out_close;
- }
-@@ -532,6 +555,315 @@ out:
- return error;
- }
-
-+#ifdef CONFIG_PAX_PT_PAX_FLAGS
-+#ifdef CONFIG_PAX_SOFTMODE
-+static unsigned long pax_parse_pt_pax_softmode(const struct elf_phdr * const elf_phdata)
-+{
-+ unsigned long pax_flags = 0UL;
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (elf_phdata->p_flags & PF_PAGEEXEC)
-+ pax_flags |= MF_PAX_PAGEEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (elf_phdata->p_flags & PF_SEGMEXEC)
-+ pax_flags |= MF_PAX_SEGMEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+ if ((elf_phdata->p_flags & PF_EMUTRAMP) && (pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)))
-+ pax_flags |= MF_PAX_EMUTRAMP;
-+#endif
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (elf_phdata->p_flags & PF_MPROTECT)
-+ pax_flags |= MF_PAX_MPROTECT;
-+#endif
-+
-+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
-+ if (randomize_va_space && (elf_phdata->p_flags & PF_RANDMMAP))
-+ pax_flags |= MF_PAX_RANDMMAP;
-+#endif
-+
-+ return pax_flags;
-+}
-+#endif
-+
-+static unsigned long pax_parse_pt_pax_hardmode(const struct elf_phdr * const elf_phdata)
-+{
-+ unsigned long pax_flags = 0UL;
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (!(elf_phdata->p_flags & PF_NOPAGEEXEC))
-+ pax_flags |= MF_PAX_PAGEEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (!(elf_phdata->p_flags & PF_NOSEGMEXEC))
-+ pax_flags |= MF_PAX_SEGMEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+ if (!(elf_phdata->p_flags & PF_NOEMUTRAMP))
-+ pax_flags |= MF_PAX_EMUTRAMP;
-+#endif
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (!(elf_phdata->p_flags & PF_NOMPROTECT))
-+ pax_flags |= MF_PAX_MPROTECT;
-+#endif
-+
-+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
-+ if (randomize_va_space && !(elf_phdata->p_flags & PF_NORANDMMAP))
-+ pax_flags |= MF_PAX_RANDMMAP;
-+#endif
-+
-+ return pax_flags;
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_XATTR_PAX_FLAGS
-+#ifdef CONFIG_PAX_SOFTMODE
-+static unsigned long pax_parse_xattr_pax_softmode(unsigned long pax_flags_softmode)
-+{
-+ unsigned long pax_flags = 0UL;
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (pax_flags_softmode & MF_PAX_PAGEEXEC)
-+ pax_flags |= MF_PAX_PAGEEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (pax_flags_softmode & MF_PAX_SEGMEXEC)
-+ pax_flags |= MF_PAX_SEGMEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+ if (pax_flags_softmode & MF_PAX_EMUTRAMP)
-+ pax_flags |= MF_PAX_EMUTRAMP;
-+#endif
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (pax_flags_softmode & MF_PAX_MPROTECT)
-+ pax_flags |= MF_PAX_MPROTECT;
-+#endif
-+
-+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
-+ if (randomize_va_space && (pax_flags_softmode & MF_PAX_RANDMMAP))
-+ pax_flags |= MF_PAX_RANDMMAP;
-+#endif
-+
-+ return pax_flags;
-+}
-+#endif
-+
-+static unsigned long pax_parse_xattr_pax_hardmode(unsigned long pax_flags_hardmode)
-+{
-+ unsigned long pax_flags = 0UL;
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (!(pax_flags_hardmode & MF_PAX_PAGEEXEC))
-+ pax_flags |= MF_PAX_PAGEEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (!(pax_flags_hardmode & MF_PAX_SEGMEXEC))
-+ pax_flags |= MF_PAX_SEGMEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+ if (!(pax_flags_hardmode & MF_PAX_EMUTRAMP))
-+ pax_flags |= MF_PAX_EMUTRAMP;
-+#endif
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (!(pax_flags_hardmode & MF_PAX_MPROTECT))
-+ pax_flags |= MF_PAX_MPROTECT;
-+#endif
-+
-+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
-+ if (randomize_va_space && !(pax_flags_hardmode & MF_PAX_RANDMMAP))
-+ pax_flags |= MF_PAX_RANDMMAP;
-+#endif
-+
-+ return pax_flags;
-+}
-+#endif
-+
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+static unsigned long pax_parse_ei_pax(const struct elfhdr * const elf_ex)
-+{
-+ unsigned long pax_flags = 0UL;
-+
-+#ifdef CONFIG_PAX_EI_PAX
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_PAGEEXEC))
-+ pax_flags |= MF_PAX_PAGEEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_SEGMEXEC))
-+ pax_flags |= MF_PAX_SEGMEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && (elf_ex->e_ident[EI_PAX] & EF_PAX_EMUTRAMP))
-+ pax_flags |= MF_PAX_EMUTRAMP;
-+#endif
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && !(elf_ex->e_ident[EI_PAX] & EF_PAX_MPROTECT))
-+ pax_flags |= MF_PAX_MPROTECT;
-+#endif
-+
-+#ifdef CONFIG_PAX_ASLR
-+ if (randomize_va_space && !(elf_ex->e_ident[EI_PAX] & EF_PAX_RANDMMAP))
-+ pax_flags |= MF_PAX_RANDMMAP;
-+#endif
-+
-+#else
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ pax_flags |= MF_PAX_PAGEEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ pax_flags |= MF_PAX_SEGMEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ pax_flags |= MF_PAX_MPROTECT;
-+#endif
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (randomize_va_space)
-+ pax_flags |= MF_PAX_RANDMMAP;
-+#endif
-+
-+#endif
-+
-+ return pax_flags;
-+}
-+
-+static unsigned long pax_parse_pt_pax(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata)
-+{
-+
-+#ifdef CONFIG_PAX_PT_PAX_FLAGS
-+ unsigned long i;
-+
-+ for (i = 0UL; i < elf_ex->e_phnum; i++)
-+ if (elf_phdata[i].p_type == PT_PAX_FLAGS) {
-+ if (((elf_phdata[i].p_flags & PF_PAGEEXEC) && (elf_phdata[i].p_flags & PF_NOPAGEEXEC)) ||
-+ ((elf_phdata[i].p_flags & PF_SEGMEXEC) && (elf_phdata[i].p_flags & PF_NOSEGMEXEC)) ||
-+ ((elf_phdata[i].p_flags & PF_EMUTRAMP) && (elf_phdata[i].p_flags & PF_NOEMUTRAMP)) ||
-+ ((elf_phdata[i].p_flags & PF_MPROTECT) && (elf_phdata[i].p_flags & PF_NOMPROTECT)) ||
-+ ((elf_phdata[i].p_flags & PF_RANDMMAP) && (elf_phdata[i].p_flags & PF_NORANDMMAP)))
-+ return ~0UL;
-+
-+#ifdef CONFIG_PAX_SOFTMODE
-+ if (pax_softmode)
-+ return pax_parse_pt_pax_softmode(&elf_phdata[i]);
-+ else
-+#endif
-+
-+ return pax_parse_pt_pax_hardmode(&elf_phdata[i]);
-+ break;
-+ }
-+#endif
-+
-+ return ~0UL;
-+}
-+
-+static unsigned long pax_parse_xattr_pax(struct file * const file)
-+{
-+
-+#ifdef CONFIG_PAX_XATTR_PAX_FLAGS
-+ ssize_t xattr_size, i;
-+ unsigned char xattr_value[5];
-+ unsigned long pax_flags_hardmode = 0UL, pax_flags_softmode = 0UL;
-+
-+ xattr_size = vfs_getxattr(file->f_path.dentry, XATTR_NAME_PAX_FLAGS, xattr_value, sizeof xattr_value);
-+ if (xattr_size <= 0 || xattr_size > 5)
-+ return ~0UL;
-+
-+ for (i = 0; i < xattr_size; i++)
-+ switch (xattr_value[i]) {
-+ default:
-+ return ~0UL;
-+
-+#define parse_flag(option1, option2, flag) \
-+ case option1: \
-+ if (pax_flags_hardmode & MF_PAX_##flag) \
-+ return ~0UL; \
-+ pax_flags_hardmode |= MF_PAX_##flag; \
-+ break; \
-+ case option2: \
-+ if (pax_flags_softmode & MF_PAX_##flag) \
-+ return ~0UL; \
-+ pax_flags_softmode |= MF_PAX_##flag; \
-+ break;
-+
-+ parse_flag('p', 'P', PAGEEXEC);
-+ parse_flag('e', 'E', EMUTRAMP);
-+ parse_flag('m', 'M', MPROTECT);
-+ parse_flag('r', 'R', RANDMMAP);
-+ parse_flag('s', 'S', SEGMEXEC);
-+
-+#undef parse_flag
-+ }
-+
-+ if (pax_flags_hardmode & pax_flags_softmode)
-+ return ~0UL;
-+
-+#ifdef CONFIG_PAX_SOFTMODE
-+ if (pax_softmode)
-+ return pax_parse_xattr_pax_softmode(pax_flags_softmode);
-+ else
-+#endif
-+
-+ return pax_parse_xattr_pax_hardmode(pax_flags_hardmode);
-+#else
-+ return ~0UL;
-+#endif
-+
-+}
-+
-+static long pax_parse_pax_flags(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata, struct file * const file)
-+{
-+ unsigned long pax_flags, pt_pax_flags, xattr_pax_flags;
-+
-+ pax_flags = pax_parse_ei_pax(elf_ex);
-+ pt_pax_flags = pax_parse_pt_pax(elf_ex, elf_phdata);
-+ xattr_pax_flags = pax_parse_xattr_pax(file);
-+
-+ if (pt_pax_flags == ~0UL)
-+ pt_pax_flags = xattr_pax_flags;
-+ else if (xattr_pax_flags == ~0UL)
-+ xattr_pax_flags = pt_pax_flags;
-+ if (pt_pax_flags != xattr_pax_flags)
-+ return -EINVAL;
-+ if (pt_pax_flags != ~0UL)
-+ pax_flags = pt_pax_flags;
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
-+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+ if ((__supported_pte_mask & _PAGE_NX))
-+ pax_flags &= ~MF_PAX_SEGMEXEC;
-+ else
-+ pax_flags &= ~MF_PAX_PAGEEXEC;
-+ }
-+#endif
-+
-+ if (0 > pax_check_flags(&pax_flags))
-+ return -EINVAL;
-+
-+ current->mm->pax_flags = pax_flags;
-+ return 0;
-+}
-+#endif
-+
- /*
- * These are the functions used to load ELF style executables and shared
- * libraries. There is no binary dependent code anywhere else.
-@@ -548,6 +880,11 @@ static unsigned long randomize_stack_top(unsigned long stack_top)
- {
- unsigned int random_variable = 0;
-
-+#ifdef CONFIG_PAX_RANDUSTACK
-+ if (current->mm->pax_flags & MF_PAX_RANDMMAP)
-+ return stack_top - current->mm->delta_stack;
-+#endif
-+
- if ((current->flags & PF_RANDOMIZE) &&
- !(current->personality & ADDR_NO_RANDOMIZE)) {
- random_variable = get_random_int() & STACK_RND_MASK;
-@@ -566,7 +903,7 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
- unsigned long load_addr = 0, load_bias = 0;
- int load_addr_set = 0;
- char * elf_interpreter = NULL;
-- unsigned long error;
-+ unsigned long error = 0;
- struct elf_phdr *elf_ppnt, *elf_phdata;
- unsigned long elf_bss, elf_brk;
- int retval, i;
-@@ -576,11 +913,11 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
- unsigned long start_code, end_code, start_data, end_data;
- unsigned long reloc_func_desc = 0;
- int executable_stack = EXSTACK_DEFAULT;
-- unsigned long def_flags = 0;
- struct {
- struct elfhdr elf_ex;
- struct elfhdr interp_elf_ex;
- } *loc;
-+ unsigned long pax_task_size = TASK_SIZE;
-
- loc = kmalloc(sizeof(*loc), GFP_KERNEL);
- if (!loc) {
-@@ -718,11 +1055,80 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
-
- /* OK, This is the point of no return */
- current->flags &= ~PF_FORKNOEXEC;
-- current->mm->def_flags = def_flags;
-+
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+ current->mm->pax_flags = 0UL;
-+#endif
-+
-+#ifdef CONFIG_PAX_DLRESOLVE
-+ current->mm->call_dl_resolve = 0UL;
-+#endif
-+
-+#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
-+ current->mm->call_syscall = 0UL;
-+#endif
-+
-+#ifdef CONFIG_PAX_ASLR
-+ current->mm->delta_mmap = 0UL;
-+ current->mm->delta_stack = 0UL;
-+#endif
-+
-+ current->mm->def_flags = 0;
-+
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+ if (0 > pax_parse_pax_flags(&loc->elf_ex, elf_phdata, bprm->file)) {
-+ send_sig(SIGKILL, current, 0);
-+ goto out_free_dentry;
-+ }
-+#endif
-+
-+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
-+ pax_set_initial_flags(bprm);
-+#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
-+ if (pax_set_initial_flags_func)
-+ (pax_set_initial_flags_func)(bprm);
-+#endif
-+
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+ if ((current->mm->pax_flags & MF_PAX_PAGEEXEC) && !nx_enabled) {
-+ current->mm->context.user_cs_limit = PAGE_SIZE;
-+ current->mm->def_flags |= VM_PAGEEXEC;
-+ }
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
-+ current->mm->context.user_cs_base = SEGMEXEC_TASK_SIZE;
-+ current->mm->context.user_cs_limit = TASK_SIZE-SEGMEXEC_TASK_SIZE;
-+ pax_task_size = SEGMEXEC_TASK_SIZE;
-+ }
-+#endif
-+
-+#if defined(CONFIG_ARCH_TRACK_EXEC_LIMIT) || defined(CONFIG_PAX_SEGMEXEC)
-+ if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+ set_user_cs(current->mm->context.user_cs_base, current->mm->context.user_cs_limit, get_cpu());
-+ put_cpu();
-+ }
-+#endif
-
- /* Do this immediately, since STACK_TOP as used in setup_arg_pages
- may depend on the personality. */
- SET_PERSONALITY(loc->elf_ex);
-+
-+#ifdef CONFIG_PAX_ASLR
-+ if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
-+ current->mm->delta_mmap = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN)-1)) << PAGE_SHIFT;
-+ current->mm->delta_stack = (pax_get_random_long() & ((1UL << PAX_DELTA_STACK_LEN)-1)) << PAGE_SHIFT;
-+ }
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+ if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+ executable_stack = EXSTACK_DISABLE_X;
-+ current->personality &= ~READ_IMPLIES_EXEC;
-+ } else
-+#endif
-+
- if (elf_read_implies_exec(loc->elf_ex, executable_stack))
- current->personality |= READ_IMPLIES_EXEC;
-
-@@ -800,10 +1206,27 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
- * might try to exec. This is because the brk will
- * follow the loader, and is not movable. */
- #ifdef CONFIG_X86
-- load_bias = 0;
-+ if (current->flags & PF_RANDOMIZE)
-+ load_bias = 0;
-+ else
-+ load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
- #else
- load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
- #endif
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ /* PaX: randomize base address at the default exe base if requested */
-+ if ((current->mm->pax_flags & MF_PAX_RANDMMAP) && elf_interpreter) {
-+#ifdef CONFIG_SPARC64
-+ load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << (PAGE_SHIFT+1);
-+#else
-+ load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << PAGE_SHIFT;
-+#endif
-+ load_bias = ELF_PAGESTART(PAX_ELF_ET_DYN_BASE - vaddr + load_bias);
-+ elf_flags |= MAP_FIXED;
-+ }
-+#endif
-+
- }
-
- error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
-@@ -836,9 +1259,9 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
- * allowed task size. Note that p_filesz must always be
- * <= p_memsz so it is only necessary to check p_memsz.
- */
-- if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
-- elf_ppnt->p_memsz > TASK_SIZE ||
-- TASK_SIZE - elf_ppnt->p_memsz < k) {
-+ if (k >= pax_task_size || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
-+ elf_ppnt->p_memsz > pax_task_size ||
-+ pax_task_size - elf_ppnt->p_memsz < k) {
- /* set_brk can never work. Avoid overflows. */
- send_sig(SIGKILL, current, 0);
- retval = -EINVAL;
-@@ -877,17 +1300,43 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
- goto out_free_dentry;
- }
- if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
-- send_sig(SIGSEGV, current, 0);
-- retval = -EFAULT; /* Nobody gets to see this, but.. */
-- goto out_free_dentry;
-+ /*
-+ * This bss-zeroing can fail if the ELF
-+ * file specifies odd protections. So
-+ * we don't check the return value
-+ */
- }
-
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
-+ unsigned long start, size;
-+
-+ start = ELF_PAGEALIGN(elf_brk);
-+ size = PAGE_SIZE + ((pax_get_random_long() & ((1UL << 22) - 1UL)) << 4);
-+ down_write(¤t->mm->mmap_sem);
-+ retval = -ENOMEM;
-+ if (!find_vma_intersection(current->mm, start, start + size + PAGE_SIZE)) {
-+ unsigned long prot = PROT_NONE;
-+
-+ current->mm->brk_gap = PAGE_ALIGN(size) >> PAGE_SHIFT;
-+// if (current->personality & ADDR_NO_RANDOMIZE)
-+// prot = PROT_READ;
-+ start = do_mmap(NULL, start, size, prot, MAP_ANONYMOUS | MAP_FIXED | MAP_PRIVATE, 0);
-+ retval = IS_ERR_VALUE(start) ? start : 0;
-+ }
-+ up_write(¤t->mm->mmap_sem);
-+ if (retval == 0)
-+ retval = set_brk(start + size, start + size + PAGE_SIZE);
-+ if (retval < 0) {
-+ send_sig(SIGKILL, current, 0);
-+ goto out_free_dentry;
-+ }
-+ }
-+#endif
-+
- if (elf_interpreter) {
-- unsigned long uninitialized_var(interp_map_addr);
--
- elf_entry = load_elf_interp(&loc->interp_elf_ex,
- interpreter,
-- &interp_map_addr,
- load_bias);
- if (!IS_ERR((void *)elf_entry)) {
- /*
-@@ -1112,8 +1561,10 @@ static int dump_seek(struct file *file, loff_t off)
- unsigned long n = off;
- if (n > PAGE_SIZE)
- n = PAGE_SIZE;
-- if (!dump_write(file, buf, n))
-+ if (!dump_write(file, buf, n)) {
-+ free_page((unsigned long)buf);
- return 0;
-+ }
- off -= n;
- }
- free_page((unsigned long)buf);
-@@ -1125,7 +1576,7 @@ static int dump_seek(struct file *file, loff_t off)
- * Decide what to dump of a segment, part, all or none.
- */
- static unsigned long vma_dump_size(struct vm_area_struct *vma,
-- unsigned long mm_flags)
-+ unsigned long mm_flags, long signr)
- {
- #define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type))
-
-@@ -1159,7 +1610,7 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
- if (vma->vm_file == NULL)
- return 0;
-
-- if (FILTER(MAPPED_PRIVATE))
-+ if (signr == SIGKILL || FILTER(MAPPED_PRIVATE))
- goto whole;
-
- /*
-@@ -1255,8 +1706,11 @@ static int writenote(struct memelfnote *men, struct file *file,
- #undef DUMP_WRITE
-
- #define DUMP_WRITE(addr, nr) \
-+ do { \
-+ gr_learn_resource(current, RLIMIT_CORE, size + (nr), 1); \
- if ((size += (nr)) > limit || !dump_write(file, (addr), (nr))) \
-- goto end_coredump;
-+ goto end_coredump; \
-+ } while (0);
-
- static void fill_elf_header(struct elfhdr *elf, int segs,
- u16 machine, u32 flags, u8 osabi)
-@@ -1385,9 +1839,9 @@ static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
- {
- elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
- int i = 0;
-- do
-+ do {
- i += 2;
-- while (auxv[i - 2] != AT_NULL);
-+ } while (auxv[i - 2] != AT_NULL);
- fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
- }
-
-@@ -1973,7 +2427,7 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file, un
- phdr.p_offset = offset;
- phdr.p_vaddr = vma->vm_start;
- phdr.p_paddr = 0;
-- phdr.p_filesz = vma_dump_size(vma, mm_flags);
-+ phdr.p_filesz = vma_dump_size(vma, mm_flags, signr);
- phdr.p_memsz = vma->vm_end - vma->vm_start;
- offset += phdr.p_filesz;
- phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
-@@ -2006,7 +2460,7 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file, un
- unsigned long addr;
- unsigned long end;
-
-- end = vma->vm_start + vma_dump_size(vma, mm_flags);
-+ end = vma->vm_start + vma_dump_size(vma, mm_flags, signr);
-
- for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
- struct page *page;
-@@ -2015,6 +2469,7 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file, un
- page = get_dump_page(addr);
- if (page) {
- void *kaddr = kmap(page);
-+ gr_learn_resource(current, RLIMIT_CORE, size + PAGE_SIZE, 1);
- stop = ((size += PAGE_SIZE) > limit) ||
- !dump_write(file, kaddr, PAGE_SIZE);
- kunmap(page);
-@@ -2042,6 +2497,97 @@ out:
-
- #endif /* USE_ELF_CORE_DUMP */
-
-+#ifdef CONFIG_PAX_MPROTECT
-+/* PaX: non-PIC ELF libraries need relocations on their executable segments
-+ * therefore we'll grant them VM_MAYWRITE once during their life. Similarly
-+ * we'll remove VM_MAYWRITE for good on RELRO segments.
-+ *
-+ * The checks favour ld-linux.so behaviour which operates on a per ELF segment
-+ * basis because we want to allow the common case and not the special ones.
-+ */
-+static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags)
-+{
-+ struct elfhdr elf_h;
-+ struct elf_phdr elf_p;
-+ unsigned long i;
-+ unsigned long oldflags;
-+ bool is_textrel_rw, is_textrel_rx, is_relro;
-+
-+ if (!(vma->vm_mm->pax_flags & MF_PAX_MPROTECT))
-+ return;
-+
-+ oldflags = vma->vm_flags & (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ);
-+ newflags &= VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ;
-+
-+#ifdef CONFIG_PAX_ELFRELOCS
-+ /* possible TEXTREL */
-+ is_textrel_rw = vma->vm_file && !vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYREAD | VM_EXEC | VM_READ) && newflags == (VM_WRITE | VM_READ);
-+ is_textrel_rx = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_WRITE | VM_READ) && newflags == (VM_EXEC | VM_READ);
-+#else
-+ is_textrel_rw = false;
-+ is_textrel_rx = false;
-+#endif
-+
-+ /* possible RELRO */
-+ is_relro = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ) && newflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ);
-+
-+ if (!is_textrel_rw && !is_textrel_rx && !is_relro)
-+ return;
-+
-+ if (sizeof(elf_h) != kernel_read(vma->vm_file, 0UL, (char *)&elf_h, sizeof(elf_h)) ||
-+ memcmp(elf_h.e_ident, ELFMAG, SELFMAG) ||
-+
-+#ifdef CONFIG_PAX_ETEXECRELOCS
-+ ((is_textrel_rw || is_textrel_rx) && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
-+#else
-+ ((is_textrel_rw || is_textrel_rx) && elf_h.e_type != ET_DYN) ||
-+#endif
-+
-+ (is_relro && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
-+ !elf_check_arch(&elf_h) ||
-+ elf_h.e_phentsize != sizeof(struct elf_phdr) ||
-+ elf_h.e_phnum > 65536UL / sizeof(struct elf_phdr))
-+ return;
-+
-+ for (i = 0UL; i < elf_h.e_phnum; i++) {
-+ if (sizeof(elf_p) != kernel_read(vma->vm_file, elf_h.e_phoff + i*sizeof(elf_p), (char *)&elf_p, sizeof(elf_p)))
-+ return;
-+ switch (elf_p.p_type) {
-+ case PT_DYNAMIC:
-+ if (!is_textrel_rw && !is_textrel_rx)
-+ continue;
-+ i = 0UL;
-+ while ((i+1) * sizeof(elf_dyn) <= elf_p.p_filesz) {
-+ elf_dyn dyn;
-+
-+ if (sizeof(dyn) != kernel_read(vma->vm_file, elf_p.p_offset + i*sizeof(dyn), (char *)&dyn, sizeof(dyn)))
-+ return;
-+ if (dyn.d_tag == DT_NULL)
-+ return;
-+ if (dyn.d_tag == DT_TEXTREL || (dyn.d_tag == DT_FLAGS && (dyn.d_un.d_val & DF_TEXTREL))) {
-+ gr_log_textrel(vma);
-+ if (is_textrel_rw)
-+ vma->vm_flags |= VM_MAYWRITE;
-+ else
-+ /* PaX: disallow write access after relocs are done, hopefully noone else needs it... */
-+ vma->vm_flags &= ~VM_MAYWRITE;
-+ return;
-+ }
-+ i++;
-+ }
-+ return;
-+
-+ case PT_GNU_RELRO:
-+ if (!is_relro)
-+ continue;
-+ if ((elf_p.p_offset >> PAGE_SHIFT) == vma->vm_pgoff && ELF_PAGEALIGN(elf_p.p_memsz) == vma->vm_end - vma->vm_start)
-+ vma->vm_flags &= ~VM_MAYWRITE;
-+ return;
-+ }
-+ }
-+}
-+#endif
-+
- static int __init init_elf_binfmt(void)
- {
- return register_binfmt(&elf_format);
-diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c
-index ca88c46..f155a60 100644
---- a/fs/binfmt_flat.c
-+++ b/fs/binfmt_flat.c
-@@ -564,7 +564,9 @@ static int load_flat_file(struct linux_binprm * bprm,
- realdatastart = (unsigned long) -ENOMEM;
- printk("Unable to allocate RAM for process data, errno %d\n",
- (int)-realdatastart);
-+ down_write(¤t->mm->mmap_sem);
- do_munmap(current->mm, textpos, text_len);
-+ up_write(¤t->mm->mmap_sem);
- ret = realdatastart;
- goto err;
- }
-@@ -588,8 +590,10 @@ static int load_flat_file(struct linux_binprm * bprm,
- }
- if (IS_ERR_VALUE(result)) {
- printk("Unable to read data+bss, errno %d\n", (int)-result);
-+ down_write(¤t->mm->mmap_sem);
- do_munmap(current->mm, textpos, text_len);
- do_munmap(current->mm, realdatastart, data_len + extra);
-+ up_write(¤t->mm->mmap_sem);
- ret = result;
- goto err;
- }
-@@ -658,8 +662,10 @@ static int load_flat_file(struct linux_binprm * bprm,
- }
- if (IS_ERR_VALUE(result)) {
- printk("Unable to read code+data+bss, errno %d\n",(int)-result);
-+ down_write(¤t->mm->mmap_sem);
- do_munmap(current->mm, textpos, text_len + data_len + extra +
- MAX_SHARED_LIBS * sizeof(unsigned long));
-+ up_write(¤t->mm->mmap_sem);
- ret = result;
- goto err;
- }
-diff --git a/fs/bio.c b/fs/bio.c
-index e696713..5a85bf9 100644
---- a/fs/bio.c
-+++ b/fs/bio.c
-@@ -78,7 +78,7 @@ static struct kmem_cache *bio_find_or_create_slab(unsigned int extra_size)
-
- i = 0;
- while (i < bio_slab_nr) {
-- struct bio_slab *bslab = &bio_slabs[i];
-+ bslab = &bio_slabs[i];
-
- if (!bslab->slab && entry == -1)
- entry = i;
-@@ -841,7 +841,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
- /*
- * Overflow, abort
- */
-- if (end < start)
-+ if (end < start || end - start > INT_MAX - nr_pages)
- return ERR_PTR(-EINVAL);
-
- nr_pages += end - start;
-@@ -974,7 +974,7 @@ static struct bio *__bio_map_user_iov(struct request_queue *q,
- /*
- * Overflow, abort
- */
-- if (end < start)
-+ if (end < start || end - start > INT_MAX - nr_pages)
- return ERR_PTR(-EINVAL);
-
- nr_pages += end - start;
-@@ -1236,7 +1236,7 @@ static void bio_copy_kern_endio(struct bio *bio, int err)
- const int read = bio_data_dir(bio) == READ;
- struct bio_map_data *bmd = bio->bi_private;
- int i;
-- char *p = bmd->sgvecs[0].iov_base;
-+ char *p = (char __force_kernel *)bmd->sgvecs[0].iov_base;
-
- __bio_for_each_segment(bvec, bio, i, 0) {
- char *addr = page_address(bvec->bv_page);
-diff --git a/fs/block_dev.c b/fs/block_dev.c
-index e65efa2..d5ce33a 100644
---- a/fs/block_dev.c
-+++ b/fs/block_dev.c
-@@ -48,7 +48,7 @@ inline struct block_device *I_BDEV(struct inode *inode)
-
- EXPORT_SYMBOL(I_BDEV);
-
--static sector_t max_block(struct block_device *bdev)
-+sector_t blkdev_max_block(struct block_device *bdev)
- {
- sector_t retval = ~((sector_t)0);
- loff_t sz = i_size_read(bdev->bd_inode);
-@@ -119,7 +119,7 @@ static int
- blkdev_get_block(struct inode *inode, sector_t iblock,
- struct buffer_head *bh, int create)
- {
-- if (iblock >= max_block(I_BDEV(inode))) {
-+ if (iblock >= blkdev_max_block(I_BDEV(inode))) {
- if (create)
- return -EIO;
-
-@@ -141,7 +141,7 @@ static int
- blkdev_get_blocks(struct inode *inode, sector_t iblock,
- struct buffer_head *bh, int create)
- {
-- sector_t end_block = max_block(I_BDEV(inode));
-+ sector_t end_block = blkdev_max_block(I_BDEV(inode));
- unsigned long max_blocks = bh->b_size >> inode->i_blkbits;
-
- if ((iblock + max_blocks) > end_block) {
-@@ -664,7 +664,7 @@ int bd_claim(struct block_device *bdev, void *holder)
- else if (bdev->bd_contains == bdev)
- res = 0; /* is a whole device which isn't held */
-
-- else if (bdev->bd_contains->bd_holder == bd_claim)
-+ else if (bdev->bd_contains->bd_holder == (void *)bd_claim)
- res = 0; /* is a partition of a device that is being partitioned */
- else if (bdev->bd_contains->bd_holder != NULL)
- res = -EBUSY; /* is a partition of a held device */
-diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
-index c4bc570..42acd8d 100644
---- a/fs/btrfs/ctree.c
-+++ b/fs/btrfs/ctree.c
-@@ -461,9 +461,12 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
- free_extent_buffer(buf);
- add_root_to_dirty_list(root);
- } else {
-- if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID)
-- parent_start = parent->start;
-- else
-+ if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) {
-+ if (parent)
-+ parent_start = parent->start;
-+ else
-+ parent_start = 0;
-+ } else
- parent_start = 0;
-
- WARN_ON(trans->transid != btrfs_header_generation(parent));
-@@ -3645,7 +3648,6 @@ setup_items_for_insert(struct btrfs_trans_handle *trans,
-
- ret = 0;
- if (slot == 0) {
-- struct btrfs_disk_key disk_key;
- btrfs_cpu_key_to_disk(&disk_key, cpu_key);
- ret = fixup_low_keys(trans, root, path, &disk_key, 1);
- }
-diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
-index f447188..59c17c5 100644
---- a/fs/btrfs/disk-io.c
-+++ b/fs/btrfs/disk-io.c
-@@ -39,7 +39,7 @@
- #include "tree-log.h"
- #include "free-space-cache.h"
-
--static struct extent_io_ops btree_extent_io_ops;
-+static const struct extent_io_ops btree_extent_io_ops;
- static void end_workqueue_fn(struct btrfs_work *work);
- static void free_fs_root(struct btrfs_root *root);
-
-@@ -2607,7 +2607,7 @@ out:
- return 0;
- }
-
--static struct extent_io_ops btree_extent_io_ops = {
-+static const struct extent_io_ops btree_extent_io_ops = {
- .write_cache_pages_lock_hook = btree_lock_page_hook,
- .readpage_end_io_hook = btree_readpage_end_io_hook,
- .submit_bio_hook = btree_submit_bio_hook,
-diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
-index 559f724..a026171 100644
---- a/fs/btrfs/extent-tree.c
-+++ b/fs/btrfs/extent-tree.c
-@@ -7141,6 +7141,10 @@ static noinline int relocate_one_extent(struct btrfs_root *extent_root,
- u64 group_start = group->key.objectid;
- new_extents = kmalloc(sizeof(*new_extents),
- GFP_NOFS);
-+ if (!new_extents) {
-+ ret = -ENOMEM;
-+ goto out;
-+ }
- nr_extents = 1;
- ret = get_new_locations(reloc_inode,
- extent_key,
-diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
-index 36de250..7ec75c7 100644
---- a/fs/btrfs/extent_io.h
-+++ b/fs/btrfs/extent_io.h
-@@ -49,36 +49,36 @@ typedef int (extent_submit_bio_hook_t)(struct inode *inode, int rw,
- struct bio *bio, int mirror_num,
- unsigned long bio_flags);
- struct extent_io_ops {
-- int (*fill_delalloc)(struct inode *inode, struct page *locked_page,
-+ int (* const fill_delalloc)(struct inode *inode, struct page *locked_page,
- u64 start, u64 end, int *page_started,
- unsigned long *nr_written);
-- int (*writepage_start_hook)(struct page *page, u64 start, u64 end);
-- int (*writepage_io_hook)(struct page *page, u64 start, u64 end);
-+ int (* const writepage_start_hook)(struct page *page, u64 start, u64 end);
-+ int (* const writepage_io_hook)(struct page *page, u64 start, u64 end);
- extent_submit_bio_hook_t *submit_bio_hook;
-- int (*merge_bio_hook)(struct page *page, unsigned long offset,
-+ int (* const merge_bio_hook)(struct page *page, unsigned long offset,
- size_t size, struct bio *bio,
- unsigned long bio_flags);
-- int (*readpage_io_hook)(struct page *page, u64 start, u64 end);
-- int (*readpage_io_failed_hook)(struct bio *bio, struct page *page,
-+ int (* const readpage_io_hook)(struct page *page, u64 start, u64 end);
-+ int (* const readpage_io_failed_hook)(struct bio *bio, struct page *page,
- u64 start, u64 end,
- struct extent_state *state);
-- int (*writepage_io_failed_hook)(struct bio *bio, struct page *page,
-+ int (* const writepage_io_failed_hook)(struct bio *bio, struct page *page,
- u64 start, u64 end,
- struct extent_state *state);
-- int (*readpage_end_io_hook)(struct page *page, u64 start, u64 end,
-+ int (* const readpage_end_io_hook)(struct page *page, u64 start, u64 end,
- struct extent_state *state);
-- int (*writepage_end_io_hook)(struct page *page, u64 start, u64 end,
-+ int (* const writepage_end_io_hook)(struct page *page, u64 start, u64 end,
- struct extent_state *state, int uptodate);
-- int (*set_bit_hook)(struct inode *inode, u64 start, u64 end,
-+ int (* const set_bit_hook)(struct inode *inode, u64 start, u64 end,
- unsigned long old, unsigned long bits);
-- int (*clear_bit_hook)(struct inode *inode, struct extent_state *state,
-+ int (* const clear_bit_hook)(struct inode *inode, struct extent_state *state,
- unsigned long bits);
-- int (*merge_extent_hook)(struct inode *inode,
-+ int (* const merge_extent_hook)(struct inode *inode,
- struct extent_state *new,
- struct extent_state *other);
-- int (*split_extent_hook)(struct inode *inode,
-+ int (* const split_extent_hook)(struct inode *inode,
- struct extent_state *orig, u64 split);
-- int (*write_cache_pages_lock_hook)(struct page *page);
-+ int (* const write_cache_pages_lock_hook)(struct page *page);
- };
-
- struct extent_io_tree {
-@@ -88,7 +88,7 @@ struct extent_io_tree {
- u64 dirty_bytes;
- spinlock_t lock;
- spinlock_t buffer_lock;
-- struct extent_io_ops *ops;
-+ const struct extent_io_ops *ops;
- };
-
- struct extent_state {
-diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
-index cb2849f..3718fb4 100644
---- a/fs/btrfs/free-space-cache.c
-+++ b/fs/btrfs/free-space-cache.c
-@@ -1074,8 +1074,6 @@ u64 btrfs_alloc_from_cluster(struct btrfs_block_group_cache *block_group,
-
- while(1) {
- if (entry->bytes < bytes || entry->offset < min_start) {
-- struct rb_node *node;
--
- node = rb_next(&entry->offset_index);
- if (!node)
- break;
-@@ -1226,7 +1224,7 @@ again:
- */
- while (entry->bitmap || found_bitmap ||
- (!entry->bitmap && entry->bytes < min_bytes)) {
-- struct rb_node *node = rb_next(&entry->offset_index);
-+ node = rb_next(&entry->offset_index);
-
- if (entry->bitmap && entry->bytes > bytes + empty_size) {
- ret = btrfs_bitmap_cluster(block_group, entry, cluster,
-diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
-index e03a836..323837e 100644
---- a/fs/btrfs/inode.c
-+++ b/fs/btrfs/inode.c
-@@ -63,7 +63,7 @@ static const struct inode_operations btrfs_file_inode_operations;
- static const struct address_space_operations btrfs_aops;
- static const struct address_space_operations btrfs_symlink_aops;
- static const struct file_operations btrfs_dir_file_operations;
--static struct extent_io_ops btrfs_extent_io_ops;
-+static const struct extent_io_ops btrfs_extent_io_ops;
-
- static struct kmem_cache *btrfs_inode_cachep;
- struct kmem_cache *btrfs_trans_handle_cachep;
-@@ -925,6 +925,7 @@ static int cow_file_range_async(struct inode *inode, struct page *locked_page,
- 1, 0, NULL, GFP_NOFS);
- while (start < end) {
- async_cow = kmalloc(sizeof(*async_cow), GFP_NOFS);
-+ BUG_ON(!async_cow);
- async_cow->inode = inode;
- async_cow->root = root;
- async_cow->locked_page = locked_page;
-@@ -4591,6 +4592,8 @@ static noinline int uncompress_inline(struct btrfs_path *path,
- inline_size = btrfs_file_extent_inline_item_len(leaf,
- btrfs_item_nr(leaf, path->slots[0]));
- tmp = kmalloc(inline_size, GFP_NOFS);
-+ if (!tmp)
-+ return -ENOMEM;
- ptr = btrfs_file_extent_inline_start(item);
-
- read_extent_buffer(leaf, tmp, ptr, inline_size);
-@@ -5410,7 +5413,7 @@ fail:
- return -ENOMEM;
- }
-
--static int btrfs_getattr(struct vfsmount *mnt,
-+int btrfs_getattr(struct vfsmount *mnt,
- struct dentry *dentry, struct kstat *stat)
- {
- struct inode *inode = dentry->d_inode;
-@@ -5422,6 +5425,14 @@ static int btrfs_getattr(struct vfsmount *mnt,
- return 0;
- }
-
-+EXPORT_SYMBOL(btrfs_getattr);
-+
-+dev_t get_btrfs_dev_from_inode(struct inode *inode)
-+{
-+ return BTRFS_I(inode)->root->anon_super.s_dev;
-+}
-+EXPORT_SYMBOL(get_btrfs_dev_from_inode);
-+
- static int btrfs_rename(struct inode *old_dir, struct dentry *old_dentry,
- struct inode *new_dir, struct dentry *new_dentry)
- {
-@@ -5972,7 +5983,7 @@ static const struct file_operations btrfs_dir_file_operations = {
- .fsync = btrfs_sync_file,
- };
-
--static struct extent_io_ops btrfs_extent_io_ops = {
-+static const struct extent_io_ops btrfs_extent_io_ops = {
- .fill_delalloc = run_delalloc_range,
- .submit_bio_hook = btrfs_submit_bio_hook,
- .merge_bio_hook = btrfs_merge_bio_hook,
-diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
-index ab7ab53..94e0781 100644
---- a/fs/btrfs/relocation.c
-+++ b/fs/btrfs/relocation.c
-@@ -884,7 +884,7 @@ static int __update_reloc_root(struct btrfs_root *root, int del)
- }
- spin_unlock(&rc->reloc_root_tree.lock);
-
-- BUG_ON((struct btrfs_root *)node->data != root);
-+ BUG_ON(!node || (struct btrfs_root *)node->data != root);
-
- if (!del) {
- spin_lock(&rc->reloc_root_tree.lock);
-diff --git a/fs/btrfs/sysfs.c b/fs/btrfs/sysfs.c
-index a240b6f..4ce16ef7 100644
---- a/fs/btrfs/sysfs.c
-+++ b/fs/btrfs/sysfs.c
-@@ -164,12 +164,12 @@ static void btrfs_root_release(struct kobject *kobj)
- complete(&root->kobj_unregister);
- }
-
--static struct sysfs_ops btrfs_super_attr_ops = {
-+static const struct sysfs_ops btrfs_super_attr_ops = {
- .show = btrfs_super_attr_show,
- .store = btrfs_super_attr_store,
- };
-
--static struct sysfs_ops btrfs_root_attr_ops = {
-+static const struct sysfs_ops btrfs_root_attr_ops = {
- .show = btrfs_root_attr_show,
- .store = btrfs_root_attr_store,
- };
-diff --git a/fs/buffer.c b/fs/buffer.c
-index 6fa5302..183550e 100644
---- a/fs/buffer.c
-+++ b/fs/buffer.c
-@@ -25,6 +25,7 @@
- #include <linux/percpu.h>
- #include <linux/slab.h>
- #include <linux/capability.h>
-+#include <linux/security.h>
- #include <linux/blkdev.h>
- #include <linux/file.h>
- #include <linux/quotaops.h>
-@@ -970,13 +971,14 @@ link_dev_buffers(struct page *page, struct buffer_head *head)
- /*
- * Initialise the state of a blockdev page's buffers.
- */
--static void
-+static sector_t
- init_page_buffers(struct page *page, struct block_device *bdev,
- sector_t block, int size)
- {
- struct buffer_head *head = page_buffers(page);
- struct buffer_head *bh = head;
- int uptodate = PageUptodate(page);
-+ sector_t end_block = blkdev_max_block(I_BDEV(bdev->bd_inode));
-
- do {
- if (!buffer_mapped(bh)) {
-@@ -985,38 +987,47 @@ init_page_buffers(struct page *page, struct block_device *bdev,
- bh->b_blocknr = block;
- if (uptodate)
- set_buffer_uptodate(bh);
-- set_buffer_mapped(bh);
-+ if (block < end_block)
-+ set_buffer_mapped(bh);
- }
- block++;
- bh = bh->b_this_page;
- } while (bh != head);
-+
-+ /*
-+ * Caller needs to validate requested block against end of device.
-+ */
-+ return end_block;
- }
-
- /*
- * Create the page-cache page that contains the requested block.
- *
-- * This is user purely for blockdev mappings.
-+ * This is used purely for blockdev mappings.
- */
--static struct page *
-+static int
- grow_dev_page(struct block_device *bdev, sector_t block,
-- pgoff_t index, int size)
-+ pgoff_t index, int size, int sizebits)
- {
- struct inode *inode = bdev->bd_inode;
- struct page *page;
- struct buffer_head *bh;
-+ sector_t end_block;
-+ int ret = 0; /* Will call free_more_memory() */
-
- page = find_or_create_page(inode->i_mapping, index,
- (mapping_gfp_mask(inode->i_mapping) & ~__GFP_FS)|__GFP_MOVABLE);
- if (!page)
-- return NULL;
-+ return ret;
-
- BUG_ON(!PageLocked(page));
-
- if (page_has_buffers(page)) {
- bh = page_buffers(page);
- if (bh->b_size == size) {
-- init_page_buffers(page, bdev, block, size);
-- return page;
-+ end_block = init_page_buffers(page, bdev,
-+ index << sizebits, size);
-+ goto done;
- }
- if (!try_to_free_buffers(page))
- goto failed;
-@@ -1036,15 +1047,15 @@ grow_dev_page(struct block_device *bdev, sector_t block,
- */
- spin_lock(&inode->i_mapping->private_lock);
- link_dev_buffers(page, bh);
-- init_page_buffers(page, bdev, block, size);
-+ end_block = init_page_buffers(page, bdev, index << sizebits, size);
- spin_unlock(&inode->i_mapping->private_lock);
-- return page;
-+done:
-+ ret = (block < end_block) ? 1 : -ENXIO;
-
- failed:
-- BUG();
- unlock_page(page);
- page_cache_release(page);
-- return NULL;
-+ return ret;
- }
-
- /*
-@@ -1054,7 +1065,6 @@ failed:
- static int
- grow_buffers(struct block_device *bdev, sector_t block, int size)
- {
-- struct page *page;
- pgoff_t index;
- int sizebits;
-
-@@ -1078,14 +1088,9 @@ grow_buffers(struct block_device *bdev, sector_t block, int size)
- bdevname(bdev, b));
- return -EIO;
- }
-- block = index << sizebits;
-+
- /* Create a page with the proper size buffers.. */
-- page = grow_dev_page(bdev, block, index, size);
-- if (!page)
-- return 0;
-- unlock_page(page);
-- page_cache_release(page);
-- return 1;
-+ return grow_dev_page(bdev, block, index, size, sizebits);
- }
-
- static struct buffer_head *
-@@ -1104,7 +1109,7 @@ __getblk_slow(struct block_device *bdev, sector_t block, int size)
- }
-
- for (;;) {
-- struct buffer_head * bh;
-+ struct buffer_head *bh;
- int ret;
-
- bh = __find_get_block(bdev, block, size);
-@@ -1374,10 +1379,6 @@ EXPORT_SYMBOL(__find_get_block);
- * which corresponds to the passed block_device, block and size. The
- * returned buffer has its reference count incremented.
- *
-- * __getblk() cannot fail - it just keeps trying. If you pass it an
-- * illegal block number, __getblk() will happily return a buffer_head
-- * which represents the non-existent block. Very weird.
-- *
- * __getblk() will lock up the machine if grow_dev_page's try_to_free_buffers()
- * attempt is failing. FIXME, perhaps?
- */
-diff --git a/fs/cachefiles/bind.c b/fs/cachefiles/bind.c
-index 3797e00..ce776f6 100644
---- a/fs/cachefiles/bind.c
-+++ b/fs/cachefiles/bind.c
-@@ -39,13 +39,11 @@ int cachefiles_daemon_bind(struct cachefiles_cache *cache, char *args)
- args);
-
- /* start by checking things over */
-- ASSERT(cache->fstop_percent >= 0 &&
-- cache->fstop_percent < cache->fcull_percent &&
-+ ASSERT(cache->fstop_percent < cache->fcull_percent &&
- cache->fcull_percent < cache->frun_percent &&
- cache->frun_percent < 100);
-
-- ASSERT(cache->bstop_percent >= 0 &&
-- cache->bstop_percent < cache->bcull_percent &&
-+ ASSERT(cache->bstop_percent < cache->bcull_percent &&
- cache->bcull_percent < cache->brun_percent &&
- cache->brun_percent < 100);
-
-diff --git a/fs/cachefiles/daemon.c b/fs/cachefiles/daemon.c
-index 4618516..bb30d01 100644
---- a/fs/cachefiles/daemon.c
-+++ b/fs/cachefiles/daemon.c
-@@ -220,7 +220,7 @@ static ssize_t cachefiles_daemon_write(struct file *file,
- if (test_bit(CACHEFILES_DEAD, &cache->flags))
- return -EIO;
-
-- if (datalen < 0 || datalen > PAGE_SIZE - 1)
-+ if (datalen > PAGE_SIZE - 1)
- return -EOPNOTSUPP;
-
- /* drag the command string into the kernel so we can parse it */
-@@ -385,7 +385,7 @@ static int cachefiles_daemon_fstop(struct cachefiles_cache *cache, char *args)
- if (args[0] != '%' || args[1] != '\0')
- return -EINVAL;
-
-- if (fstop < 0 || fstop >= cache->fcull_percent)
-+ if (fstop >= cache->fcull_percent)
- return cachefiles_daemon_range_error(cache, args);
-
- cache->fstop_percent = fstop;
-@@ -457,7 +457,7 @@ static int cachefiles_daemon_bstop(struct cachefiles_cache *cache, char *args)
- if (args[0] != '%' || args[1] != '\0')
- return -EINVAL;
-
-- if (bstop < 0 || bstop >= cache->bcull_percent)
-+ if (bstop >= cache->bcull_percent)
- return cachefiles_daemon_range_error(cache, args);
-
- cache->bstop_percent = bstop;
-diff --git a/fs/cachefiles/internal.h b/fs/cachefiles/internal.h
-index f7c255f..fcd61de 100644
---- a/fs/cachefiles/internal.h
-+++ b/fs/cachefiles/internal.h
-@@ -56,7 +56,7 @@ struct cachefiles_cache {
- wait_queue_head_t daemon_pollwq; /* poll waitqueue for daemon */
- struct rb_root active_nodes; /* active nodes (can't be culled) */
- rwlock_t active_lock; /* lock for active_nodes */
-- atomic_t gravecounter; /* graveyard uniquifier */
-+ atomic_unchecked_t gravecounter; /* graveyard uniquifier */
- unsigned frun_percent; /* when to stop culling (% files) */
- unsigned fcull_percent; /* when to start culling (% files) */
- unsigned fstop_percent; /* when to stop allocating (% files) */
-@@ -168,19 +168,19 @@ extern int cachefiles_check_in_use(struct cachefiles_cache *cache,
- * proc.c
- */
- #ifdef CONFIG_CACHEFILES_HISTOGRAM
--extern atomic_t cachefiles_lookup_histogram[HZ];
--extern atomic_t cachefiles_mkdir_histogram[HZ];
--extern atomic_t cachefiles_create_histogram[HZ];
-+extern atomic_unchecked_t cachefiles_lookup_histogram[HZ];
-+extern atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
-+extern atomic_unchecked_t cachefiles_create_histogram[HZ];
-
- extern int __init cachefiles_proc_init(void);
- extern void cachefiles_proc_cleanup(void);
- static inline
--void cachefiles_hist(atomic_t histogram[], unsigned long start_jif)
-+void cachefiles_hist(atomic_unchecked_t histogram[], unsigned long start_jif)
- {
- unsigned long jif = jiffies - start_jif;
- if (jif >= HZ)
- jif = HZ - 1;
-- atomic_inc(&histogram[jif]);
-+ atomic_inc_unchecked(&histogram[jif]);
- }
-
- #else
-diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c
-index 14ac480..a62766c 100644
---- a/fs/cachefiles/namei.c
-+++ b/fs/cachefiles/namei.c
-@@ -250,7 +250,7 @@ try_again:
- /* first step is to make up a grave dentry in the graveyard */
- sprintf(nbuffer, "%08x%08x",
- (uint32_t) get_seconds(),
-- (uint32_t) atomic_inc_return(&cache->gravecounter));
-+ (uint32_t) atomic_inc_return_unchecked(&cache->gravecounter));
-
- /* do the multiway lock magic */
- trap = lock_rename(cache->graveyard, dir);
-diff --git a/fs/cachefiles/proc.c b/fs/cachefiles/proc.c
-index eccd339..4c1d995 100644
---- a/fs/cachefiles/proc.c
-+++ b/fs/cachefiles/proc.c
-@@ -14,9 +14,9 @@
- #include <linux/seq_file.h>
- #include "internal.h"
-
--atomic_t cachefiles_lookup_histogram[HZ];
--atomic_t cachefiles_mkdir_histogram[HZ];
--atomic_t cachefiles_create_histogram[HZ];
-+atomic_unchecked_t cachefiles_lookup_histogram[HZ];
-+atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
-+atomic_unchecked_t cachefiles_create_histogram[HZ];
-
- /*
- * display the latency histogram
-@@ -35,9 +35,9 @@ static int cachefiles_histogram_show(struct seq_file *m, void *v)
- return 0;
- default:
- index = (unsigned long) v - 3;
-- x = atomic_read(&cachefiles_lookup_histogram[index]);
-- y = atomic_read(&cachefiles_mkdir_histogram[index]);
-- z = atomic_read(&cachefiles_create_histogram[index]);
-+ x = atomic_read_unchecked(&cachefiles_lookup_histogram[index]);
-+ y = atomic_read_unchecked(&cachefiles_mkdir_histogram[index]);
-+ z = atomic_read_unchecked(&cachefiles_create_histogram[index]);
- if (x == 0 && y == 0 && z == 0)
- return 0;
-
-diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c
-index a6c8c6f..5cf8517 100644
---- a/fs/cachefiles/rdwr.c
-+++ b/fs/cachefiles/rdwr.c
-@@ -946,7 +946,7 @@ int cachefiles_write_page(struct fscache_storage *op, struct page *page)
- old_fs = get_fs();
- set_fs(KERNEL_DS);
- ret = file->f_op->write(
-- file, (const void __user *) data, len, &pos);
-+ file, (const void __force_user *) data, len, &pos);
- set_fs(old_fs);
- kunmap(page);
- if (ret != len)
-diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
-index 42cec2a..2aba466 100644
---- a/fs/cifs/cifs_debug.c
-+++ b/fs/cifs/cifs_debug.c
-@@ -256,25 +256,25 @@ static ssize_t cifs_stats_proc_write(struct file *file,
- tcon = list_entry(tmp3,
- struct cifsTconInfo,
- tcon_list);
-- atomic_set(&tcon->num_smbs_sent, 0);
-- atomic_set(&tcon->num_writes, 0);
-- atomic_set(&tcon->num_reads, 0);
-- atomic_set(&tcon->num_oplock_brks, 0);
-- atomic_set(&tcon->num_opens, 0);
-- atomic_set(&tcon->num_posixopens, 0);
-- atomic_set(&tcon->num_posixmkdirs, 0);
-- atomic_set(&tcon->num_closes, 0);
-- atomic_set(&tcon->num_deletes, 0);
-- atomic_set(&tcon->num_mkdirs, 0);
-- atomic_set(&tcon->num_rmdirs, 0);
-- atomic_set(&tcon->num_renames, 0);
-- atomic_set(&tcon->num_t2renames, 0);
-- atomic_set(&tcon->num_ffirst, 0);
-- atomic_set(&tcon->num_fnext, 0);
-- atomic_set(&tcon->num_fclose, 0);
-- atomic_set(&tcon->num_hardlinks, 0);
-- atomic_set(&tcon->num_symlinks, 0);
-- atomic_set(&tcon->num_locks, 0);
-+ atomic_set_unchecked(&tcon->num_smbs_sent, 0);
-+ atomic_set_unchecked(&tcon->num_writes, 0);
-+ atomic_set_unchecked(&tcon->num_reads, 0);
-+ atomic_set_unchecked(&tcon->num_oplock_brks, 0);
-+ atomic_set_unchecked(&tcon->num_opens, 0);
-+ atomic_set_unchecked(&tcon->num_posixopens, 0);
-+ atomic_set_unchecked(&tcon->num_posixmkdirs, 0);
-+ atomic_set_unchecked(&tcon->num_closes, 0);
-+ atomic_set_unchecked(&tcon->num_deletes, 0);
-+ atomic_set_unchecked(&tcon->num_mkdirs, 0);
-+ atomic_set_unchecked(&tcon->num_rmdirs, 0);
-+ atomic_set_unchecked(&tcon->num_renames, 0);
-+ atomic_set_unchecked(&tcon->num_t2renames, 0);
-+ atomic_set_unchecked(&tcon->num_ffirst, 0);
-+ atomic_set_unchecked(&tcon->num_fnext, 0);
-+ atomic_set_unchecked(&tcon->num_fclose, 0);
-+ atomic_set_unchecked(&tcon->num_hardlinks, 0);
-+ atomic_set_unchecked(&tcon->num_symlinks, 0);
-+ atomic_set_unchecked(&tcon->num_locks, 0);
- }
- }
- }
-@@ -334,41 +334,41 @@ static int cifs_stats_proc_show(struct seq_file *m, void *v)
- if (tcon->need_reconnect)
- seq_puts(m, "\tDISCONNECTED ");
- seq_printf(m, "\nSMBs: %d Oplock Breaks: %d",
-- atomic_read(&tcon->num_smbs_sent),
-- atomic_read(&tcon->num_oplock_brks));
-+ atomic_read_unchecked(&tcon->num_smbs_sent),
-+ atomic_read_unchecked(&tcon->num_oplock_brks));
- seq_printf(m, "\nReads: %d Bytes: %lld",
-- atomic_read(&tcon->num_reads),
-+ atomic_read_unchecked(&tcon->num_reads),
- (long long)(tcon->bytes_read));
- seq_printf(m, "\nWrites: %d Bytes: %lld",
-- atomic_read(&tcon->num_writes),
-+ atomic_read_unchecked(&tcon->num_writes),
- (long long)(tcon->bytes_written));
- seq_printf(m, "\nFlushes: %d",
-- atomic_read(&tcon->num_flushes));
-+ atomic_read_unchecked(&tcon->num_flushes));
- seq_printf(m, "\nLocks: %d HardLinks: %d "
- "Symlinks: %d",
-- atomic_read(&tcon->num_locks),
-- atomic_read(&tcon->num_hardlinks),
-- atomic_read(&tcon->num_symlinks));
-+ atomic_read_unchecked(&tcon->num_locks),
-+ atomic_read_unchecked(&tcon->num_hardlinks),
-+ atomic_read_unchecked(&tcon->num_symlinks));
- seq_printf(m, "\nOpens: %d Closes: %d "
- "Deletes: %d",
-- atomic_read(&tcon->num_opens),
-- atomic_read(&tcon->num_closes),
-- atomic_read(&tcon->num_deletes));
-+ atomic_read_unchecked(&tcon->num_opens),
-+ atomic_read_unchecked(&tcon->num_closes),
-+ atomic_read_unchecked(&tcon->num_deletes));
- seq_printf(m, "\nPosix Opens: %d "
- "Posix Mkdirs: %d",
-- atomic_read(&tcon->num_posixopens),
-- atomic_read(&tcon->num_posixmkdirs));
-+ atomic_read_unchecked(&tcon->num_posixopens),
-+ atomic_read_unchecked(&tcon->num_posixmkdirs));
- seq_printf(m, "\nMkdirs: %d Rmdirs: %d",
-- atomic_read(&tcon->num_mkdirs),
-- atomic_read(&tcon->num_rmdirs));
-+ atomic_read_unchecked(&tcon->num_mkdirs),
-+ atomic_read_unchecked(&tcon->num_rmdirs));
- seq_printf(m, "\nRenames: %d T2 Renames %d",
-- atomic_read(&tcon->num_renames),
-- atomic_read(&tcon->num_t2renames));
-+ atomic_read_unchecked(&tcon->num_renames),
-+ atomic_read_unchecked(&tcon->num_t2renames));
- seq_printf(m, "\nFindFirst: %d FNext %d "
- "FClose %d",
-- atomic_read(&tcon->num_ffirst),
-- atomic_read(&tcon->num_fnext),
-- atomic_read(&tcon->num_fclose));
-+ atomic_read_unchecked(&tcon->num_ffirst),
-+ atomic_read_unchecked(&tcon->num_fnext),
-+ atomic_read_unchecked(&tcon->num_fclose));
- }
- }
- }
-diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
-index 1445407..68cb0dc 100644
---- a/fs/cifs/cifsfs.c
-+++ b/fs/cifs/cifsfs.c
-@@ -869,7 +869,7 @@ cifs_init_request_bufs(void)
- cifs_req_cachep = kmem_cache_create("cifs_request",
- CIFSMaxBufSize +
- MAX_CIFS_HDR_SIZE, 0,
-- SLAB_HWCACHE_ALIGN, NULL);
-+ SLAB_HWCACHE_ALIGN | SLAB_USERCOPY, NULL);
- if (cifs_req_cachep == NULL)
- return -ENOMEM;
-
-@@ -896,7 +896,7 @@ cifs_init_request_bufs(void)
- efficient to alloc 1 per page off the slab compared to 17K (5page)
- alloc of large cifs buffers even when page debugging is on */
- cifs_sm_req_cachep = kmem_cache_create("cifs_small_rq",
-- MAX_CIFS_SMALL_BUFFER_SIZE, 0, SLAB_HWCACHE_ALIGN,
-+ MAX_CIFS_SMALL_BUFFER_SIZE, 0, SLAB_HWCACHE_ALIGN | SLAB_USERCOPY,
- NULL);
- if (cifs_sm_req_cachep == NULL) {
- mempool_destroy(cifs_req_poolp);
-@@ -991,8 +991,8 @@ init_cifs(void)
- atomic_set(&bufAllocCount, 0);
- atomic_set(&smBufAllocCount, 0);
- #ifdef CONFIG_CIFS_STATS2
-- atomic_set(&totBufAllocCount, 0);
-- atomic_set(&totSmBufAllocCount, 0);
-+ atomic_set_unchecked(&totBufAllocCount, 0);
-+ atomic_set_unchecked(&totSmBufAllocCount, 0);
- #endif /* CONFIG_CIFS_STATS2 */
-
- atomic_set(&midCount, 0);
-diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
-index e29581e..1c22bab 100644
---- a/fs/cifs/cifsglob.h
-+++ b/fs/cifs/cifsglob.h
-@@ -252,28 +252,28 @@ struct cifsTconInfo {
- __u16 Flags; /* optional support bits */
- enum statusEnum tidStatus;
- #ifdef CONFIG_CIFS_STATS
-- atomic_t num_smbs_sent;
-- atomic_t num_writes;
-- atomic_t num_reads;
-- atomic_t num_flushes;
-- atomic_t num_oplock_brks;
-- atomic_t num_opens;
-- atomic_t num_closes;
-- atomic_t num_deletes;
-- atomic_t num_mkdirs;
-- atomic_t num_posixopens;
-- atomic_t num_posixmkdirs;
-- atomic_t num_rmdirs;
-- atomic_t num_renames;
-- atomic_t num_t2renames;
-- atomic_t num_ffirst;
-- atomic_t num_fnext;
-- atomic_t num_fclose;
-- atomic_t num_hardlinks;
-- atomic_t num_symlinks;
-- atomic_t num_locks;
-- atomic_t num_acl_get;
-- atomic_t num_acl_set;
-+ atomic_unchecked_t num_smbs_sent;
-+ atomic_unchecked_t num_writes;
-+ atomic_unchecked_t num_reads;
-+ atomic_unchecked_t num_flushes;
-+ atomic_unchecked_t num_oplock_brks;
-+ atomic_unchecked_t num_opens;
-+ atomic_unchecked_t num_closes;
-+ atomic_unchecked_t num_deletes;
-+ atomic_unchecked_t num_mkdirs;
-+ atomic_unchecked_t num_posixopens;
-+ atomic_unchecked_t num_posixmkdirs;
-+ atomic_unchecked_t num_rmdirs;
-+ atomic_unchecked_t num_renames;
-+ atomic_unchecked_t num_t2renames;
-+ atomic_unchecked_t num_ffirst;
-+ atomic_unchecked_t num_fnext;
-+ atomic_unchecked_t num_fclose;
-+ atomic_unchecked_t num_hardlinks;
-+ atomic_unchecked_t num_symlinks;
-+ atomic_unchecked_t num_locks;
-+ atomic_unchecked_t num_acl_get;
-+ atomic_unchecked_t num_acl_set;
- #ifdef CONFIG_CIFS_STATS2
- unsigned long long time_writes;
- unsigned long long time_reads;
-@@ -414,7 +414,7 @@ static inline char CIFS_DIR_SEP(const struct cifs_sb_info *cifs_sb)
- }
-
- #ifdef CONFIG_CIFS_STATS
--#define cifs_stats_inc atomic_inc
-+#define cifs_stats_inc atomic_inc_unchecked
-
- static inline void cifs_stats_bytes_written(struct cifsTconInfo *tcon,
- unsigned int bytes)
-@@ -701,8 +701,8 @@ GLOBAL_EXTERN atomic_t tconInfoReconnectCount;
- /* Various Debug counters */
- GLOBAL_EXTERN atomic_t bufAllocCount; /* current number allocated */
- #ifdef CONFIG_CIFS_STATS2
--GLOBAL_EXTERN atomic_t totBufAllocCount; /* total allocated over all time */
--GLOBAL_EXTERN atomic_t totSmBufAllocCount;
-+GLOBAL_EXTERN atomic_unchecked_t totBufAllocCount; /* total allocated over all time */
-+GLOBAL_EXTERN atomic_unchecked_t totSmBufAllocCount;
- #endif
- GLOBAL_EXTERN atomic_t smBufAllocCount;
- GLOBAL_EXTERN atomic_t midCount;
-diff --git a/fs/cifs/link.c b/fs/cifs/link.c
-index fc1e048..28b3441 100644
---- a/fs/cifs/link.c
-+++ b/fs/cifs/link.c
-@@ -215,7 +215,7 @@ cifs_symlink(struct inode *inode, struct dentry *direntry, const char *symname)
-
- void cifs_put_link(struct dentry *direntry, struct nameidata *nd, void *cookie)
- {
-- char *p = nd_get_link(nd);
-+ const char *p = nd_get_link(nd);
- if (!IS_ERR(p))
- kfree(p);
- }
-diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
-index 95b82e8..12a538d 100644
---- a/fs/cifs/misc.c
-+++ b/fs/cifs/misc.c
-@@ -155,7 +155,7 @@ cifs_buf_get(void)
- memset(ret_buf, 0, sizeof(struct smb_hdr) + 3);
- atomic_inc(&bufAllocCount);
- #ifdef CONFIG_CIFS_STATS2
-- atomic_inc(&totBufAllocCount);
-+ atomic_inc_unchecked(&totBufAllocCount);
- #endif /* CONFIG_CIFS_STATS2 */
- }
-
-@@ -190,7 +190,7 @@ cifs_small_buf_get(void)
- /* memset(ret_buf, 0, sizeof(struct smb_hdr) + 27);*/
- atomic_inc(&smBufAllocCount);
- #ifdef CONFIG_CIFS_STATS2
-- atomic_inc(&totSmBufAllocCount);
-+ atomic_inc_unchecked(&totSmBufAllocCount);
- #endif /* CONFIG_CIFS_STATS2 */
-
- }
-diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
-index f5618f8..fd7b4d0 100644
---- a/fs/cifs/readdir.c
-+++ b/fs/cifs/readdir.c
-@@ -79,11 +79,17 @@ cifs_readdir_lookup(struct dentry *parent, struct qstr *name,
-
- dentry = d_lookup(parent, name);
- if (dentry) {
-- /* FIXME: check for inode number changes? */
-- if (dentry->d_inode != NULL)
-+ int err;
-+ inode = dentry->d_inode;
-+ /* update inode in place if i_ino didn't change */
-+ if (inode && CIFS_I(inode)->uniqueid == fattr->cf_uniqueid) {
-+ cifs_fattr_to_inode(inode, fattr);
- return dentry;
-- d_drop(dentry);
-+ }
-+ err = d_invalidate(dentry);
- dput(dentry);
-+ if (err)
-+ return NULL;
- }
-
- dentry = d_alloc(parent, name);
-diff --git a/fs/coda/cache.c b/fs/coda/cache.c
-index a5bf577..6d19845 100644
---- a/fs/coda/cache.c
-+++ b/fs/coda/cache.c
-@@ -24,14 +24,14 @@
- #include <linux/coda_fs_i.h>
- #include <linux/coda_cache.h>
-
--static atomic_t permission_epoch = ATOMIC_INIT(0);
-+static atomic_unchecked_t permission_epoch = ATOMIC_INIT(0);
-
- /* replace or extend an acl cache hit */
- void coda_cache_enter(struct inode *inode, int mask)
- {
- struct coda_inode_info *cii = ITOC(inode);
-
-- cii->c_cached_epoch = atomic_read(&permission_epoch);
-+ cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch);
- if (cii->c_uid != current_fsuid()) {
- cii->c_uid = current_fsuid();
- cii->c_cached_perm = mask;
-@@ -43,13 +43,13 @@ void coda_cache_enter(struct inode *inode, int mask)
- void coda_cache_clear_inode(struct inode *inode)
- {
- struct coda_inode_info *cii = ITOC(inode);
-- cii->c_cached_epoch = atomic_read(&permission_epoch) - 1;
-+ cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch) - 1;
- }
-
- /* remove all acl caches */
- void coda_cache_clear_all(struct super_block *sb)
- {
-- atomic_inc(&permission_epoch);
-+ atomic_inc_unchecked(&permission_epoch);
- }
-
-
-@@ -61,7 +61,7 @@ int coda_cache_check(struct inode *inode, int mask)
-
- hit = (mask & cii->c_cached_perm) == mask &&
- cii->c_uid == current_fsuid() &&
-- cii->c_cached_epoch == atomic_read(&permission_epoch);
-+ cii->c_cached_epoch == atomic_read_unchecked(&permission_epoch);
-
- return hit;
- }
-diff --git a/fs/compat.c b/fs/compat.c
-index 46b93d1..84978fe 100644
---- a/fs/compat.c
-+++ b/fs/compat.c
-@@ -133,8 +133,8 @@ asmlinkage long compat_sys_utimes(char __user *filename, struct compat_timeval _
- static int cp_compat_stat(struct kstat *stat, struct compat_stat __user *ubuf)
- {
- compat_ino_t ino = stat->ino;
-- typeof(ubuf->st_uid) uid = 0;
-- typeof(ubuf->st_gid) gid = 0;
-+ typeof(((struct compat_stat *)0)->st_uid) uid = 0;
-+ typeof(((struct compat_stat *)0)->st_gid) gid = 0;
- int err;
-
- SET_UID(uid, stat->uid);
-@@ -533,7 +533,7 @@ compat_sys_io_setup(unsigned nr_reqs, u32 __user *ctx32p)
-
- set_fs(KERNEL_DS);
- /* The __user pointer cast is valid because of the set_fs() */
-- ret = sys_io_setup(nr_reqs, (aio_context_t __user *) &ctx64);
-+ ret = sys_io_setup(nr_reqs, (aio_context_t __force_user *) &ctx64);
- set_fs(oldfs);
- /* truncating is ok because it's a user address */
- if (!ret)
-@@ -830,6 +830,7 @@ struct compat_old_linux_dirent {
-
- struct compat_readdir_callback {
- struct compat_old_linux_dirent __user *dirent;
-+ struct file * file;
- int result;
- };
-
-@@ -847,6 +848,10 @@ static int compat_fillonedir(void *__buf, const char *name, int namlen,
- buf->result = -EOVERFLOW;
- return -EOVERFLOW;
- }
-+
-+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
-+ return 0;
-+
- buf->result++;
- dirent = buf->dirent;
- if (!access_ok(VERIFY_WRITE, dirent,
-@@ -879,6 +884,7 @@ asmlinkage long compat_sys_old_readdir(unsigned int fd,
-
- buf.result = 0;
- buf.dirent = dirent;
-+ buf.file = file;
-
- error = vfs_readdir(file, compat_fillonedir, &buf);
- if (buf.result)
-@@ -899,6 +905,7 @@ struct compat_linux_dirent {
- struct compat_getdents_callback {
- struct compat_linux_dirent __user *current_dir;
- struct compat_linux_dirent __user *previous;
-+ struct file * file;
- int count;
- int error;
- };
-@@ -919,6 +926,10 @@ static int compat_filldir(void *__buf, const char *name, int namlen,
- buf->error = -EOVERFLOW;
- return -EOVERFLOW;
- }
-+
-+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
-+ return 0;
-+
- dirent = buf->previous;
- if (dirent) {
- if (__put_user(offset, &dirent->d_off))
-@@ -966,6 +977,7 @@ asmlinkage long compat_sys_getdents(unsigned int fd,
- buf.previous = NULL;
- buf.count = count;
- buf.error = 0;
-+ buf.file = file;
-
- error = vfs_readdir(file, compat_filldir, &buf);
- if (error >= 0)
-@@ -987,6 +999,7 @@ out:
- struct compat_getdents_callback64 {
- struct linux_dirent64 __user *current_dir;
- struct linux_dirent64 __user *previous;
-+ struct file * file;
- int count;
- int error;
- };
-@@ -1003,6 +1016,10 @@ static int compat_filldir64(void * __buf, const char * name, int namlen, loff_t
- buf->error = -EINVAL; /* only used if we fail.. */
- if (reclen > buf->count)
- return -EINVAL;
-+
-+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
-+ return 0;
-+
- dirent = buf->previous;
-
- if (dirent) {
-@@ -1054,13 +1071,14 @@ asmlinkage long compat_sys_getdents64(unsigned int fd,
- buf.previous = NULL;
- buf.count = count;
- buf.error = 0;
-+ buf.file = file;
-
- error = vfs_readdir(file, compat_filldir64, &buf);
- if (error >= 0)
- error = buf.error;
- lastdirent = buf.previous;
- if (lastdirent) {
-- typeof(lastdirent->d_off) d_off = file->f_pos;
-+ typeof(((struct linux_dirent64 *)0)->d_off) d_off = file->f_pos;
- if (__put_user_unaligned(d_off, &lastdirent->d_off))
- error = -EFAULT;
- else
-@@ -1098,7 +1116,7 @@ static ssize_t compat_do_readv_writev(int type, struct file *file,
- * verify all the pointers
- */
- ret = -EINVAL;
-- if ((nr_segs > UIO_MAXIOV) || (nr_segs <= 0))
-+ if (nr_segs > UIO_MAXIOV)
- goto out;
- if (!file->f_op)
- goto out;
-@@ -1469,11 +1487,35 @@ int compat_do_execve(char * filename,
- compat_uptr_t __user *envp,
- struct pt_regs * regs)
- {
-+#ifdef CONFIG_GRKERNSEC
-+ struct file *old_exec_file;
-+ struct acl_subject_label *old_acl;
-+ struct rlimit old_rlim[RLIM_NLIMITS];
-+#endif
- struct linux_binprm *bprm;
- struct file *file;
- struct files_struct *displaced;
- bool clear_in_exec;
- int retval;
-+ const struct cred *cred = current_cred();
-+
-+ /*
-+ * We move the actual failure in case of RLIMIT_NPROC excess from
-+ * set*uid() to execve() because too many poorly written programs
-+ * don't check setuid() return code. Here we additionally recheck
-+ * whether NPROC limit is still exceeded.
-+ */
-+ gr_learn_resource(current, RLIMIT_NPROC, atomic_read(¤t->cred->user->processes), 1);
-+
-+ if ((current->flags & PF_NPROC_EXCEEDED) &&
-+ atomic_read(&cred->user->processes) > current->signal->rlim[RLIMIT_NPROC].rlim_cur) {
-+ retval = -EAGAIN;
-+ goto out_ret;
-+ }
-+
-+ /* We're below the limit (still or again), so we don't want to make
-+ * further execve() calls fail. */
-+ current->flags &= ~PF_NPROC_EXCEEDED;
-
- retval = unshare_files(&displaced);
- if (retval)
-@@ -1499,12 +1541,26 @@ int compat_do_execve(char * filename,
- if (IS_ERR(file))
- goto out_unmark;
-
-+ if (gr_ptrace_readexec(file, bprm->unsafe)) {
-+ retval = -EPERM;
-+ goto out_file;
-+ }
-+
- sched_exec();
-
- bprm->file = file;
- bprm->filename = filename;
- bprm->interp = filename;
-
-+ if (gr_process_user_ban()) {
-+ retval = -EPERM;
-+ goto out_file;
-+ }
-+
-+ retval = -EACCES;
-+ if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt))
-+ goto out_file;
-+
- retval = bprm_mm_init(bprm);
- if (retval)
- goto out_file;
-@@ -1521,24 +1577,63 @@ int compat_do_execve(char * filename,
- if (retval < 0)
- goto out;
-
-+#ifdef CONFIG_GRKERNSEC
-+ old_acl = current->acl;
-+ memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
-+ old_exec_file = current->exec_file;
-+ get_file(file);
-+ current->exec_file = file;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ /* limit suid stack to 8MB
-+ we saved the old limits above and will restore them if this exec fails
-+ */
-+ if ((bprm->cred->euid != current_euid()) || (bprm->cred->egid != current_egid()))
-+ current->signal->rlim[RLIMIT_STACK].rlim_cur = 8 * 1024 * 1024;
-+#endif
-+
-+ if (!gr_tpe_allow(file)) {
-+ retval = -EACCES;
-+ goto out_fail;
-+ }
-+
-+ if (gr_check_crash_exec(file)) {
-+ retval = -EACCES;
-+ goto out_fail;
-+ }
-+
-+ retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
-+ bprm->unsafe);
-+ if (retval < 0)
-+ goto out_fail;
-+
- retval = copy_strings_kernel(1, &bprm->filename, bprm);
- if (retval < 0)
-- goto out;
-+ goto out_fail;
-
- bprm->exec = bprm->p;
- retval = compat_copy_strings(bprm->envc, envp, bprm);
- if (retval < 0)
-- goto out;
-+ goto out_fail;
-
- retval = compat_copy_strings(bprm->argc, argv, bprm);
- if (retval < 0)
-- goto out;
-+ goto out_fail;
-+
-+ gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
-+
-+ gr_handle_exec_args_compat(bprm, argv);
-
- retval = search_binary_handler(bprm, regs);
- if (retval < 0)
-- goto out;
-+ goto out_fail;
-+#ifdef CONFIG_GRKERNSEC
-+ if (old_exec_file)
-+ fput(old_exec_file);
-+#endif
-
- /* execve succeeded */
-+ increment_exec_counter();
- current->fs->in_exec = 0;
- current->in_execve = 0;
- acct_update_integrals(current);
-@@ -1547,6 +1642,14 @@ int compat_do_execve(char * filename,
- put_files_struct(displaced);
- return retval;
-
-+out_fail:
-+#ifdef CONFIG_GRKERNSEC
-+ current->acl = old_acl;
-+ memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
-+ fput(current->exec_file);
-+ current->exec_file = old_exec_file;
-+#endif
-+
- out:
- if (bprm->mm) {
- acct_arg_size(bprm, 0);
-@@ -1717,6 +1820,8 @@ int compat_core_sys_select(int n, compat_ulong_t __user *inp,
- struct fdtable *fdt;
- long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
-
-+ pax_track_stack();
-+
- if (n < 0)
- goto out_nofds;
-
-@@ -2157,7 +2262,7 @@ asmlinkage long compat_sys_nfsservctl(int cmd,
- oldfs = get_fs();
- set_fs(KERNEL_DS);
- /* The __user pointer casts are valid because of the set_fs() */
-- err = sys_nfsservctl(cmd, (void __user *) karg, (void __user *) kres);
-+ err = sys_nfsservctl(cmd, (void __force_user *) karg, (void __force_user *) kres);
- set_fs(oldfs);
-
- if (err)
-diff --git a/fs/compat_binfmt_elf.c b/fs/compat_binfmt_elf.c
-index 0adced2..bbb1b0d 100644
---- a/fs/compat_binfmt_elf.c
-+++ b/fs/compat_binfmt_elf.c
-@@ -29,10 +29,12 @@
- #undef elfhdr
- #undef elf_phdr
- #undef elf_note
-+#undef elf_dyn
- #undef elf_addr_t
- #define elfhdr elf32_hdr
- #define elf_phdr elf32_phdr
- #define elf_note elf32_note
-+#define elf_dyn Elf32_Dyn
- #define elf_addr_t Elf32_Addr
-
- /*
-diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
-index d84e705..d8c364c 100644
---- a/fs/compat_ioctl.c
-+++ b/fs/compat_ioctl.c
-@@ -234,6 +234,8 @@ static int do_video_set_spu_palette(unsigned int fd, unsigned int cmd, unsigned
- up = (struct compat_video_spu_palette __user *) arg;
- err = get_user(palp, &up->palette);
- err |= get_user(length, &up->length);
-+ if (err)
-+ return -EFAULT;
-
- up_native = compat_alloc_user_space(sizeof(struct video_spu_palette));
- err = put_user(compat_ptr(palp), &up_native->palette);
-@@ -1513,7 +1515,7 @@ static int serial_struct_ioctl(unsigned fd, unsigned cmd, unsigned long arg)
- return -EFAULT;
- if (__get_user(udata, &ss32->iomem_base))
- return -EFAULT;
-- ss.iomem_base = compat_ptr(udata);
-+ ss.iomem_base = (unsigned char __force_kernel *)compat_ptr(udata);
- if (__get_user(ss.iomem_reg_shift, &ss32->iomem_reg_shift) ||
- __get_user(ss.port_high, &ss32->port_high))
- return -EFAULT;
-@@ -1809,7 +1811,7 @@ static int compat_ioctl_preallocate(struct file *file, unsigned long arg)
- copy_in_user(&p->l_len, &p32->l_len, sizeof(s64)) ||
- copy_in_user(&p->l_sysid, &p32->l_sysid, sizeof(s32)) ||
- copy_in_user(&p->l_pid, &p32->l_pid, sizeof(u32)) ||
-- copy_in_user(&p->l_pad, &p32->l_pad, 4*sizeof(u32)))
-+ copy_in_user(p->l_pad, &p32->l_pad, 4*sizeof(u32)))
- return -EFAULT;
-
- return ioctl_preallocate(file, p);
-diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
-index 8e48b52..f01ed91 100644
---- a/fs/configfs/dir.c
-+++ b/fs/configfs/dir.c
-@@ -1572,7 +1572,8 @@ static int configfs_readdir(struct file * filp, void * dirent, filldir_t filldir
- }
- for (p=q->next; p!= &parent_sd->s_children; p=p->next) {
- struct configfs_dirent *next;
-- const char * name;
-+ const unsigned char * name;
-+ char d_name[sizeof(next->s_dentry->d_iname)];
- int len;
-
- next = list_entry(p, struct configfs_dirent,
-@@ -1581,7 +1582,12 @@ static int configfs_readdir(struct file * filp, void * dirent, filldir_t filldir
- continue;
-
- name = configfs_get_name(next);
-- len = strlen(name);
-+ if (next->s_dentry && name == next->s_dentry->d_iname) {
-+ len = next->s_dentry->d_name.len;
-+ memcpy(d_name, name, len);
-+ name = d_name;
-+ } else
-+ len = strlen(name);
- if (next->s_dentry)
- ino = next->s_dentry->d_inode->i_ino;
- else
-diff --git a/fs/dcache.c b/fs/dcache.c
-index 44c0aea..a663f95 100644
---- a/fs/dcache.c
-+++ b/fs/dcache.c
-@@ -45,8 +45,6 @@ EXPORT_SYMBOL(dcache_lock);
-
- static struct kmem_cache *dentry_cache __read_mostly;
-
--#define DNAME_INLINE_LEN (sizeof(struct dentry)-offsetof(struct dentry,d_iname))
--
- /*
- * This is the single most critical data structure when it comes
- * to the dcache: the hashtable for lookups. Somebody should try
-@@ -1108,11 +1106,11 @@ struct dentry * d_alloc_root(struct inode * root_inode)
- return res;
- }
-
--static inline struct hlist_head *d_hash(struct dentry *parent,
-- unsigned long hash)
-+static inline struct hlist_head *d_hash(const struct dentry *parent,
-+ unsigned int hash)
- {
-- hash += ((unsigned long) parent ^ GOLDEN_RATIO_PRIME) / L1_CACHE_BYTES;
-- hash = hash ^ ((hash ^ GOLDEN_RATIO_PRIME) >> D_HASHBITS);
-+ hash += (unsigned long) parent / L1_CACHE_BYTES;
-+ hash = hash + (hash >> D_HASHBITS);
- return dentry_hashtable + (hash & D_HASHMASK);
- }
-
-@@ -2319,7 +2317,7 @@ void __init vfs_caches_init(unsigned long mempages)
- mempages -= reserve;
-
- names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
-- SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
-+ SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_USERCOPY, NULL);
-
- dcache_init();
- inode_init();
-diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
-index 39c6ee8..dcee0f1 100644
---- a/fs/debugfs/inode.c
-+++ b/fs/debugfs/inode.c
-@@ -269,7 +269,11 @@ EXPORT_SYMBOL_GPL(debugfs_create_file);
- struct dentry *debugfs_create_dir(const char *name, struct dentry *parent)
- {
- return debugfs_create_file(name,
-+#ifdef CONFIG_GRKERNSEC_SYSFS_RESTRICT
-+ S_IFDIR | S_IRWXU,
-+#else
- S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO,
-+#endif
- parent, NULL, NULL);
- }
- EXPORT_SYMBOL_GPL(debugfs_create_dir);
-diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c
-index c010ecf..a8d8c59 100644
---- a/fs/dlm/lockspace.c
-+++ b/fs/dlm/lockspace.c
-@@ -148,7 +148,7 @@ static void lockspace_kobj_release(struct kobject *k)
- kfree(ls);
- }
-
--static struct sysfs_ops dlm_attr_ops = {
-+static const struct sysfs_ops dlm_attr_ops = {
- .show = dlm_attr_show,
- .store = dlm_attr_store,
- };
-diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
-index 7e164bb..62fa913 100644
---- a/fs/ecryptfs/crypto.c
-+++ b/fs/ecryptfs/crypto.c
-@@ -418,17 +418,6 @@ static int ecryptfs_encrypt_extent(struct page *enc_extent_page,
- rc);
- goto out;
- }
-- if (unlikely(ecryptfs_verbosity > 0)) {
-- ecryptfs_printk(KERN_DEBUG, "Encrypting extent "
-- "with iv:\n");
-- ecryptfs_dump_hex(extent_iv, crypt_stat->iv_bytes);
-- ecryptfs_printk(KERN_DEBUG, "First 8 bytes before "
-- "encryption:\n");
-- ecryptfs_dump_hex((char *)
-- (page_address(page)
-- + (extent_offset * crypt_stat->extent_size)),
-- 8);
-- }
- rc = ecryptfs_encrypt_page_offset(crypt_stat, enc_extent_page, 0,
- page, (extent_offset
- * crypt_stat->extent_size),
-@@ -441,14 +430,6 @@ static int ecryptfs_encrypt_extent(struct page *enc_extent_page,
- goto out;
- }
- rc = 0;
-- if (unlikely(ecryptfs_verbosity > 0)) {
-- ecryptfs_printk(KERN_DEBUG, "Encrypt extent [0x%.16x]; "
-- "rc = [%d]\n", (extent_base + extent_offset),
-- rc);
-- ecryptfs_printk(KERN_DEBUG, "First 8 bytes after "
-- "encryption:\n");
-- ecryptfs_dump_hex((char *)(page_address(enc_extent_page)), 8);
-- }
- out:
- return rc;
- }
-@@ -545,17 +526,6 @@ static int ecryptfs_decrypt_extent(struct page *page,
- rc);
- goto out;
- }
-- if (unlikely(ecryptfs_verbosity > 0)) {
-- ecryptfs_printk(KERN_DEBUG, "Decrypting extent "
-- "with iv:\n");
-- ecryptfs_dump_hex(extent_iv, crypt_stat->iv_bytes);
-- ecryptfs_printk(KERN_DEBUG, "First 8 bytes before "
-- "decryption:\n");
-- ecryptfs_dump_hex((char *)
-- (page_address(enc_extent_page)
-- + (extent_offset * crypt_stat->extent_size)),
-- 8);
-- }
- rc = ecryptfs_decrypt_page_offset(crypt_stat, page,
- (extent_offset
- * crypt_stat->extent_size),
-@@ -569,16 +539,6 @@ static int ecryptfs_decrypt_extent(struct page *page,
- goto out;
- }
- rc = 0;
-- if (unlikely(ecryptfs_verbosity > 0)) {
-- ecryptfs_printk(KERN_DEBUG, "Decrypt extent [0x%.16x]; "
-- "rc = [%d]\n", (extent_base + extent_offset),
-- rc);
-- ecryptfs_printk(KERN_DEBUG, "First 8 bytes after "
-- "decryption:\n");
-- ecryptfs_dump_hex((char *)(page_address(page)
-- + (extent_offset
-- * crypt_stat->extent_size)), 8);
-- }
- out:
- return rc;
- }
-diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
-index 502b09f..49129f4 100644
---- a/fs/ecryptfs/file.c
-+++ b/fs/ecryptfs/file.c
-@@ -348,7 +348,6 @@ const struct file_operations ecryptfs_main_fops = {
- #ifdef CONFIG_COMPAT
- .compat_ioctl = ecryptfs_compat_ioctl,
- #endif
-- .mmap = generic_file_mmap,
- .open = ecryptfs_open,
- .flush = ecryptfs_flush,
- .release = ecryptfs_release,
-diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
-index 3c1dbc0..250e1b4 100644
---- a/fs/ecryptfs/inode.c
-+++ b/fs/ecryptfs/inode.c
-@@ -647,7 +647,7 @@ static int ecryptfs_readlink_lower(struct dentry *dentry, char **buf,
- old_fs = get_fs();
- set_fs(get_ds());
- rc = lower_dentry->d_inode->i_op->readlink(lower_dentry,
-- (char __user *)lower_buf,
-+ (char __force_user *)lower_buf,
- lower_bufsiz);
- set_fs(old_fs);
- if (rc < 0)
-@@ -693,7 +693,7 @@ static void *ecryptfs_follow_link(struct dentry *dentry, struct nameidata *nd)
- }
- old_fs = get_fs();
- set_fs(get_ds());
-- rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
-+ rc = dentry->d_inode->i_op->readlink(dentry, (__force char __user *)buf, len);
- set_fs(old_fs);
- if (rc < 0)
- goto out_free;
-diff --git a/fs/eventpoll.c b/fs/eventpoll.c
-index ff57421..f65f88a 100644
---- a/fs/eventpoll.c
-+++ b/fs/eventpoll.c
-@@ -1488,8 +1488,8 @@ SYSCALL_DEFINE1(epoll_create1, int, flags)
- error = PTR_ERR(file);
- goto out_free_fd;
- }
-- fd_install(fd, file);
- ep->file = file;
-+ fd_install(fd, file);
- return fd;
-
- out_free_fd:
-diff --git a/fs/exec.c b/fs/exec.c
-index 86fafc6..c1f24b5 100644
---- a/fs/exec.c
-+++ b/fs/exec.c
-@@ -56,12 +56,34 @@
- #include <linux/fsnotify.h>
- #include <linux/fs_struct.h>
- #include <linux/pipe_fs_i.h>
-+#include <linux/random.h>
-+#include <linux/seq_file.h>
-+#include <linux/mman.h>
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#include <linux/kallsyms.h>
-+#include <linux/kdebug.h>
-+#endif
-+
-+#include <trace/events/fs.h>
-
- #include <asm/uaccess.h>
- #include <asm/mmu_context.h>
- #include <asm/tlb.h>
- #include "internal.h"
-
-+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
-+void __weak pax_set_initial_flags(struct linux_binprm *bprm)
-+{
-+ printk_once(KERN_WARNING "PAX: PAX_HAVE_ACL_FLAGS was enabled without providing the pax_set_initial_flags callback, this is probably not what you wanted.\n");
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_HOOK_ACL_FLAGS
-+void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
-+EXPORT_SYMBOL(pax_set_initial_flags_func);
-+#endif
-+
- int core_uses_pid;
- char core_pattern[CORENAME_MAX_SIZE] = "core";
- unsigned int core_pipe_limit;
-@@ -178,18 +200,10 @@ struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
- int write)
- {
- struct page *page;
-- int ret;
-
--#ifdef CONFIG_STACK_GROWSUP
-- if (write) {
-- ret = expand_stack_downwards(bprm->vma, pos);
-- if (ret < 0)
-- return NULL;
-- }
--#endif
-- ret = get_user_pages(current, bprm->mm, pos,
-- 1, write, 1, &page, NULL);
-- if (ret <= 0)
-+ if (0 > expand_stack_downwards(bprm->vma, pos))
-+ return NULL;
-+ if (0 >= get_user_pages(current, bprm->mm, pos, 1, write, 1, &page, NULL))
- return NULL;
-
- if (write) {
-@@ -205,6 +219,17 @@ struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
- if (size <= ARG_MAX)
- return page;
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ // only allow 512KB for argv+env on suid/sgid binaries
-+ // to prevent easy ASLR exhaustion
-+ if (((bprm->cred->euid != current_euid()) ||
-+ (bprm->cred->egid != current_egid())) &&
-+ (size > (512 * 1024))) {
-+ put_page(page);
-+ return NULL;
-+ }
-+#endif
-+
- /*
- * Limit to 1/4-th the stack size for the argv+env strings.
- * This ensures that:
-@@ -263,6 +288,11 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
- vma->vm_end = STACK_TOP_MAX;
- vma->vm_start = vma->vm_end - PAGE_SIZE;
- vma->vm_flags = VM_STACK_FLAGS;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ vma->vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
-+#endif
-+
- vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
-
- err = security_file_mmap(NULL, 0, 0, 0, vma->vm_start, 1);
-@@ -276,6 +306,12 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
- mm->stack_vm = mm->total_vm = 1;
- up_write(&mm->mmap_sem);
- bprm->p = vma->vm_end - sizeof(void *);
-+
-+#ifdef CONFIG_PAX_RANDUSTACK
-+ if (randomize_va_space)
-+ bprm->p ^= random32() & ~PAGE_MASK;
-+#endif
-+
- return 0;
- err:
- up_write(&mm->mmap_sem);
-@@ -400,8 +436,9 @@ static int count(char __user * __user * argv, int max)
- if (!p)
- break;
- argv++;
-- if (i++ >= max)
-+ if (i >= max)
- return -E2BIG;
-+ ++i;
-
- if (fatal_signal_pending(current))
- return -ERESTARTNOHAND;
-@@ -510,7 +547,7 @@ int copy_strings_kernel(int argc,char ** argv, struct linux_binprm *bprm)
- int r;
- mm_segment_t oldfs = get_fs();
- set_fs(KERNEL_DS);
-- r = copy_strings(argc, (char __user * __user *)argv, bprm);
-+ r = copy_strings(argc, (__force char __user * __user *)argv, bprm);
- set_fs(oldfs);
- return r;
- }
-@@ -540,7 +577,8 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
- unsigned long new_end = old_end - shift;
- struct mmu_gather *tlb;
-
-- BUG_ON(new_start > new_end);
-+ if (new_start >= new_end || new_start < mmap_min_addr)
-+ return -ENOMEM;
-
- /*
- * ensure there are no vmas between where we want to go
-@@ -549,6 +587,10 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
- if (vma != find_vma(mm, new_start))
- return -EFAULT;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ BUG_ON(pax_find_mirror_vma(vma));
-+#endif
-+
- /*
- * cover the whole range: [new_start, old_end)
- */
-@@ -630,10 +672,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
- stack_top = arch_align_stack(stack_top);
- stack_top = PAGE_ALIGN(stack_top);
-
-- if (unlikely(stack_top < mmap_min_addr) ||
-- unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr))
-- return -ENOMEM;
--
- stack_shift = vma->vm_end - stack_top;
-
- bprm->p -= stack_shift;
-@@ -645,6 +683,14 @@ int setup_arg_pages(struct linux_binprm *bprm,
- bprm->exec -= stack_shift;
-
- down_write(&mm->mmap_sem);
-+
-+ /* Move stack pages down in memory. */
-+ if (stack_shift) {
-+ ret = shift_arg_pages(vma, stack_shift);
-+ if (ret)
-+ goto out_unlock;
-+ }
-+
- vm_flags = VM_STACK_FLAGS;
-
- /*
-@@ -658,19 +704,24 @@ int setup_arg_pages(struct linux_binprm *bprm,
- vm_flags &= ~VM_EXEC;
- vm_flags |= mm->def_flags;
-
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+ if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+ vm_flags &= ~VM_EXEC;
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (mm->pax_flags & MF_PAX_MPROTECT)
-+ vm_flags &= ~VM_MAYEXEC;
-+#endif
-+
-+ }
-+#endif
-+
- ret = mprotect_fixup(vma, &prev, vma->vm_start, vma->vm_end,
- vm_flags);
- if (ret)
- goto out_unlock;
- BUG_ON(prev != vma);
-
-- /* Move stack pages down in memory. */
-- if (stack_shift) {
-- ret = shift_arg_pages(vma, stack_shift);
-- if (ret)
-- goto out_unlock;
-- }
--
- stack_expand = EXTRA_STACK_VM_PAGES * PAGE_SIZE;
- stack_size = vma->vm_end - vma->vm_start;
- /*
-@@ -690,6 +741,27 @@ int setup_arg_pages(struct linux_binprm *bprm,
- stack_base = vma->vm_start - stack_expand;
- #endif
- ret = expand_stack(vma, stack_base);
-+
-+#if !defined(CONFIG_STACK_GROWSUP) && defined(CONFIG_PAX_ASLR)
-+ if (!ret && (mm->pax_flags & MF_PAX_RANDMMAP) && STACK_TOP <= 0xFFFFFFFFU && STACK_TOP > vma->vm_end) {
-+ unsigned long size, flags, vm_flags;
-+
-+ size = STACK_TOP - vma->vm_end;
-+ flags = MAP_FIXED | MAP_PRIVATE;
-+ vm_flags = VM_DONTEXPAND | VM_RESERVED;
-+
-+ ret = vma->vm_end != mmap_region(NULL, vma->vm_end, size, flags, vm_flags, 0);
-+
-+#ifdef CONFIG_X86
-+ if (!ret) {
-+ size = mmap_min_addr + ((mm->delta_mmap ^ mm->delta_stack) & (0xFFUL << PAGE_SHIFT));
-+ ret = 0 != mmap_region(NULL, 0, size, flags, vm_flags, 0);
-+ }
-+#endif
-+
-+ }
-+#endif
-+
- if (ret)
- ret = -EFAULT;
-
-@@ -721,6 +793,8 @@ struct file *open_exec(const char *name)
-
- fsnotify_open(file->f_path.dentry);
-
-+ trace_open_exec(name);
-+
- err = deny_write_access(file);
- if (err)
- goto exit;
-@@ -744,7 +818,7 @@ int kernel_read(struct file *file, loff_t offset,
- old_fs = get_fs();
- set_fs(get_ds());
- /* The cast to a user pointer is valid due to the set_fs() */
-- result = vfs_read(file, (void __user *)addr, count, &pos);
-+ result = vfs_read(file, (void __force_user *)addr, count, &pos);
- set_fs(old_fs);
- return result;
- }
-@@ -985,6 +1059,21 @@ void set_task_comm(struct task_struct *tsk, char *buf)
- perf_event_comm(tsk);
- }
-
-+static void filename_to_taskname(char *tcomm, const char *fn, unsigned int len)
-+{
-+ int i, ch;
-+
-+ /* Copies the binary name from after last slash */
-+ for (i = 0; (ch = *(fn++)) != '\0';) {
-+ if (ch == '/')
-+ i = 0; /* overwrite what we wrote */
-+ else
-+ if (i < len - 1)
-+ tcomm[i++] = ch;
-+ }
-+ tcomm[i] = '\0';
-+}
-+
- int flush_old_exec(struct linux_binprm * bprm)
- {
- int retval;
-@@ -999,6 +1088,7 @@ int flush_old_exec(struct linux_binprm * bprm)
-
- set_mm_exe_file(bprm->mm, bprm->file);
-
-+ filename_to_taskname(bprm->tcomm, bprm->filename, sizeof(bprm->tcomm));
- /*
- * Release all of the old mmap stuff
- */
-@@ -1023,10 +1113,6 @@ EXPORT_SYMBOL(flush_old_exec);
-
- void setup_new_exec(struct linux_binprm * bprm)
- {
-- int i, ch;
-- char * name;
-- char tcomm[sizeof(current->comm)];
--
- arch_pick_mmap_layout(current->mm);
-
- /* This is the point of no return */
-@@ -1037,18 +1123,7 @@ void setup_new_exec(struct linux_binprm * bprm)
- else
- set_dumpable(current->mm, suid_dumpable);
-
-- name = bprm->filename;
--
-- /* Copies the binary name from after last slash */
-- for (i=0; (ch = *(name++)) != '\0';) {
-- if (ch == '/')
-- i = 0; /* overwrite what we wrote */
-- else
-- if (i < (sizeof(tcomm) - 1))
-- tcomm[i++] = ch;
-- }
-- tcomm[i] = '\0';
-- set_task_comm(current, tcomm);
-+ set_task_comm(current, bprm->tcomm);
-
- /* Set the new mm task size. We have to do that late because it may
- * depend on TIF_32BIT which is only updated in flush_thread() on
-@@ -1090,14 +1165,14 @@ EXPORT_SYMBOL(setup_new_exec);
- */
- int prepare_bprm_creds(struct linux_binprm *bprm)
- {
-- if (mutex_lock_interruptible(¤t->cred_guard_mutex))
-+ if (mutex_lock_interruptible(¤t->signal->cred_guard_mutex))
- return -ERESTARTNOINTR;
-
- bprm->cred = prepare_exec_creds();
- if (likely(bprm->cred))
- return 0;
-
-- mutex_unlock(¤t->cred_guard_mutex);
-+ mutex_unlock(¤t->signal->cred_guard_mutex);
- return -ENOMEM;
- }
-
-@@ -1105,7 +1180,7 @@ void free_bprm(struct linux_binprm *bprm)
- {
- free_arg_pages(bprm);
- if (bprm->cred) {
-- mutex_unlock(¤t->cred_guard_mutex);
-+ mutex_unlock(¤t->signal->cred_guard_mutex);
- abort_creds(bprm->cred);
- }
- kfree(bprm);
-@@ -1126,13 +1201,13 @@ void install_exec_creds(struct linux_binprm *bprm)
- * credentials; any time after this it may be unlocked.
- */
- security_bprm_committed_creds(bprm);
-- mutex_unlock(¤t->cred_guard_mutex);
-+ mutex_unlock(¤t->signal->cred_guard_mutex);
- }
- EXPORT_SYMBOL(install_exec_creds);
-
- /*
- * determine how safe it is to execute the proposed program
-- * - the caller must hold current->cred_guard_mutex to protect against
-+ * - the caller must hold ->cred_guard_mutex to protect against
- * PTRACE_ATTACH
- */
- int check_unsafe_exec(struct linux_binprm *bprm)
-@@ -1152,7 +1227,7 @@ int check_unsafe_exec(struct linux_binprm *bprm)
- }
- rcu_read_unlock();
-
-- if (p->fs->users > n_fs) {
-+ if (atomic_read(&p->fs->users) > n_fs) {
- bprm->unsafe |= LSM_UNSAFE_SHARE;
- } else {
- res = -EAGAIN;
-@@ -1339,6 +1414,21 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
-
- EXPORT_SYMBOL(search_binary_handler);
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+DEFINE_PER_CPU(u64, exec_counter);
-+static int __init init_exec_counters(void)
-+{
-+ unsigned int cpu;
-+
-+ for_each_possible_cpu(cpu) {
-+ per_cpu(exec_counter, cpu) = (u64)cpu;
-+ }
-+
-+ return 0;
-+}
-+early_initcall(init_exec_counters);
-+#endif
-+
- /*
- * sys_execve() executes a new program.
- */
-@@ -1347,11 +1437,35 @@ int do_execve(char * filename,
- char __user *__user *envp,
- struct pt_regs * regs)
- {
-+#ifdef CONFIG_GRKERNSEC
-+ struct file *old_exec_file;
-+ struct acl_subject_label *old_acl;
-+ struct rlimit old_rlim[RLIM_NLIMITS];
-+#endif
- struct linux_binprm *bprm;
- struct file *file;
- struct files_struct *displaced;
- bool clear_in_exec;
- int retval;
-+ const struct cred *cred = current_cred();
-+
-+ /*
-+ * We move the actual failure in case of RLIMIT_NPROC excess from
-+ * set*uid() to execve() because too many poorly written programs
-+ * don't check setuid() return code. Here we additionally recheck
-+ * whether NPROC limit is still exceeded.
-+ */
-+ gr_learn_resource(current, RLIMIT_NPROC, atomic_read(¤t->cred->user->processes), 1);
-+
-+ if ((current->flags & PF_NPROC_EXCEEDED) &&
-+ atomic_read(&cred->user->processes) > current->signal->rlim[RLIMIT_NPROC].rlim_cur) {
-+ retval = -EAGAIN;
-+ goto out_ret;
-+ }
-+
-+ /* We're below the limit (still or again), so we don't want to make
-+ * further execve() calls fail. */
-+ current->flags &= ~PF_NPROC_EXCEEDED;
-
- retval = unshare_files(&displaced);
- if (retval)
-@@ -1377,12 +1491,27 @@ int do_execve(char * filename,
- if (IS_ERR(file))
- goto out_unmark;
-
-+ if (gr_ptrace_readexec(file, bprm->unsafe)) {
-+ retval = -EPERM;
-+ goto out_file;
-+ }
-+
- sched_exec();
-
- bprm->file = file;
- bprm->filename = filename;
- bprm->interp = filename;
-
-+ if (gr_process_user_ban()) {
-+ retval = -EPERM;
-+ goto out_file;
-+ }
-+
-+ if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt)) {
-+ retval = -EACCES;
-+ goto out_file;
-+ }
-+
- retval = bprm_mm_init(bprm);
- if (retval)
- goto out_file;
-@@ -1399,25 +1528,66 @@ int do_execve(char * filename,
- if (retval < 0)
- goto out;
-
-+#ifdef CONFIG_GRKERNSEC
-+ old_acl = current->acl;
-+ memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
-+ old_exec_file = current->exec_file;
-+ get_file(file);
-+ current->exec_file = file;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ /* limit suid stack to 8MB
-+ we saved the old limits above and will restore them if this exec fails
-+ */
-+ if (((bprm->cred->euid != current_euid()) || (bprm->cred->egid != current_egid())) &&
-+ (old_rlim[RLIMIT_STACK].rlim_cur > (8 * 1024 * 1024)))
-+ current->signal->rlim[RLIMIT_STACK].rlim_cur = 8 * 1024 * 1024;
-+#endif
-+
-+ if (!gr_tpe_allow(file)) {
-+ retval = -EACCES;
-+ goto out_fail;
-+ }
-+
-+ if (gr_check_crash_exec(file)) {
-+ retval = -EACCES;
-+ goto out_fail;
-+ }
-+
-+ retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
-+ bprm->unsafe);
-+ if (retval < 0)
-+ goto out_fail;
-+
- retval = copy_strings_kernel(1, &bprm->filename, bprm);
- if (retval < 0)
-- goto out;
-+ goto out_fail;
-
- bprm->exec = bprm->p;
- retval = copy_strings(bprm->envc, envp, bprm);
- if (retval < 0)
-- goto out;
-+ goto out_fail;
-
- retval = copy_strings(bprm->argc, argv, bprm);
- if (retval < 0)
-- goto out;
-+ goto out_fail;
-+
-+ gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
-+
-+ gr_handle_exec_args(bprm, (const char __user *const __user *)argv);
-
- current->flags &= ~PF_KTHREAD;
- retval = search_binary_handler(bprm,regs);
- if (retval < 0)
-- goto out;
-+ goto out_fail;
-+#ifdef CONFIG_GRKERNSEC
-+ if (old_exec_file)
-+ fput(old_exec_file);
-+#endif
-
- /* execve succeeded */
-+
-+ increment_exec_counter();
- current->fs->in_exec = 0;
- current->in_execve = 0;
- acct_update_integrals(current);
-@@ -1426,6 +1596,14 @@ int do_execve(char * filename,
- put_files_struct(displaced);
- return retval;
-
-+out_fail:
-+#ifdef CONFIG_GRKERNSEC
-+ current->acl = old_acl;
-+ memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
-+ fput(current->exec_file);
-+ current->exec_file = old_exec_file;
-+#endif
-+
- out:
- if (bprm->mm) {
- acct_arg_size(bprm, 0);
-@@ -1591,6 +1769,251 @@ out:
- return ispipe;
- }
-
-+int pax_check_flags(unsigned long *flags)
-+{
-+ int retval = 0;
-+
-+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_SEGMEXEC)
-+ if (*flags & MF_PAX_SEGMEXEC)
-+ {
-+ *flags &= ~MF_PAX_SEGMEXEC;
-+ retval = -EINVAL;
-+ }
-+#endif
-+
-+ if ((*flags & MF_PAX_PAGEEXEC)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ && (*flags & MF_PAX_SEGMEXEC)
-+#endif
-+
-+ )
-+ {
-+ *flags &= ~MF_PAX_PAGEEXEC;
-+ retval = -EINVAL;
-+ }
-+
-+ if ((*flags & MF_PAX_MPROTECT)
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
-+#endif
-+
-+ )
-+ {
-+ *flags &= ~MF_PAX_MPROTECT;
-+ retval = -EINVAL;
-+ }
-+
-+ if ((*flags & MF_PAX_EMUTRAMP)
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+ && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
-+#endif
-+
-+ )
-+ {
-+ *flags &= ~MF_PAX_EMUTRAMP;
-+ retval = -EINVAL;
-+ }
-+
-+ return retval;
-+}
-+
-+EXPORT_SYMBOL(pax_check_flags);
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+void pax_report_fault(struct pt_regs *regs, void *pc, void *sp)
-+{
-+ struct task_struct *tsk = current;
-+ struct mm_struct *mm = current->mm;
-+ char *buffer_exec = (char *)__get_free_page(GFP_KERNEL);
-+ char *buffer_fault = (char *)__get_free_page(GFP_KERNEL);
-+ char *path_exec = NULL;
-+ char *path_fault = NULL;
-+ unsigned long start = 0UL, end = 0UL, offset = 0UL;
-+
-+ if (buffer_exec && buffer_fault) {
-+ struct vm_area_struct *vma, *vma_exec = NULL, *vma_fault = NULL;
-+
-+ down_read(&mm->mmap_sem);
-+ vma = mm->mmap;
-+ while (vma && (!vma_exec || !vma_fault)) {
-+ if ((vma->vm_flags & VM_EXECUTABLE) && vma->vm_file)
-+ vma_exec = vma;
-+ if (vma->vm_start <= (unsigned long)pc && (unsigned long)pc < vma->vm_end)
-+ vma_fault = vma;
-+ vma = vma->vm_next;
-+ }
-+ if (vma_exec) {
-+ path_exec = d_path(&vma_exec->vm_file->f_path, buffer_exec, PAGE_SIZE);
-+ if (IS_ERR(path_exec))
-+ path_exec = "<path too long>";
-+ else {
-+ path_exec = mangle_path(buffer_exec, path_exec, "\t\n\\");
-+ if (path_exec) {
-+ *path_exec = 0;
-+ path_exec = buffer_exec;
-+ } else
-+ path_exec = "<path too long>";
-+ }
-+ }
-+ if (vma_fault) {
-+ start = vma_fault->vm_start;
-+ end = vma_fault->vm_end;
-+ offset = vma_fault->vm_pgoff << PAGE_SHIFT;
-+ if (vma_fault->vm_file) {
-+ path_fault = d_path(&vma_fault->vm_file->f_path, buffer_fault, PAGE_SIZE);
-+ if (IS_ERR(path_fault))
-+ path_fault = "<path too long>";
-+ else {
-+ path_fault = mangle_path(buffer_fault, path_fault, "\t\n\\");
-+ if (path_fault) {
-+ *path_fault = 0;
-+ path_fault = buffer_fault;
-+ } else
-+ path_fault = "<path too long>";
-+ }
-+ } else
-+ path_fault = "<anonymous mapping>";
-+ }
-+ up_read(&mm->mmap_sem);
-+ }
-+ if (tsk->signal->curr_ip)
-+ printk(KERN_ERR "PAX: From %pI4: execution attempt in: %s, %08lx-%08lx %08lx\n", &tsk->signal->curr_ip, path_fault, start, end, offset);
-+ else
-+ printk(KERN_ERR "PAX: execution attempt in: %s, %08lx-%08lx %08lx\n", path_fault, start, end, offset);
-+ printk(KERN_ERR "PAX: terminating task: %s(%s):%d, uid/euid: %u/%u, "
-+ "PC: %p, SP: %p\n", path_exec, tsk->comm, task_pid_nr(tsk),
-+ task_uid(tsk), task_euid(tsk), pc, sp);
-+ free_page((unsigned long)buffer_exec);
-+ free_page((unsigned long)buffer_fault);
-+ pax_report_insns(regs, pc, sp);
-+ do_coredump(SIGKILL, SIGKILL, regs);
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+void pax_report_refcount_overflow(struct pt_regs *regs)
-+{
-+ if (current->signal->curr_ip)
-+ printk(KERN_ERR "PAX: From %pI4: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
-+ ¤t->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
-+ else
-+ printk(KERN_ERR "PAX: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
-+ current->comm, task_pid_nr(current), current_uid(), current_euid());
-+ print_symbol(KERN_ERR "PAX: refcount overflow occured at: %s\n", instruction_pointer(regs));
-+ show_regs(regs);
-+ force_sig_specific(SIGKILL, current);
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+/* 0: not at all, 1: fully, 2: fully inside frame, -1: partially (implies an error) */
-+static noinline int check_stack_object(const void *obj, unsigned long len)
-+{
-+ const void * const stack = task_stack_page(current);
-+ const void * const stackend = stack + THREAD_SIZE;
-+
-+#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
-+ const void *frame = NULL;
-+ const void *oldframe;
-+#endif
-+
-+ if (obj + len < obj)
-+ return -1;
-+
-+ if (obj + len <= stack || stackend <= obj)
-+ return 0;
-+
-+ if (obj < stack || stackend < obj + len)
-+ return -1;
-+
-+#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
-+ oldframe = __builtin_frame_address(1);
-+ if (oldframe)
-+ frame = __builtin_frame_address(2);
-+ /*
-+ low ----------------------------------------------> high
-+ [saved bp][saved ip][args][local vars][saved bp][saved ip]
-+ ^----------------^
-+ allow copies only within here
-+ */
-+ while (stack <= frame && frame < stackend) {
-+ /* if obj + len extends past the last frame, this
-+ check won't pass and the next frame will be 0,
-+ causing us to bail out and correctly report
-+ the copy as invalid
-+ */
-+ if (obj + len <= frame)
-+ return obj >= oldframe + 2 * sizeof(void *) ? 2 : -1;
-+ oldframe = frame;
-+ frame = *(const void * const *)frame;
-+ }
-+ return -1;
-+#else
-+ return 1;
-+#endif
-+}
-+
-+static __noreturn void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type)
-+{
-+ if (current->signal->curr_ip)
-+ printk(KERN_ERR "PAX: From %pI4: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
-+ ¤t->signal->curr_ip, to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
-+ else
-+ printk(KERN_ERR "PAX: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
-+ to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
-+
-+ dump_stack();
-+ gr_handle_kernel_exploit();
-+ do_group_exit(SIGKILL);
-+}
-+#endif
-+
-+void check_object_size(const void *ptr, unsigned long n, bool to)
-+{
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+ const char *type;
-+
-+ if (!n)
-+ return;
-+
-+ type = check_heap_object(ptr, n);
-+ if (!type) {
-+ if (check_stack_object(ptr, n) != -1)
-+ return;
-+ type = "<process stack>";
-+ }
-+
-+ pax_report_usercopy(ptr, n, to, type);
-+#endif
-+
-+}
-+EXPORT_SYMBOL(check_object_size);
-+
-+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
-+void pax_track_stack(void)
-+{
-+ unsigned long sp = (unsigned long)&sp;
-+ if (sp < current_thread_info()->lowest_stack &&
-+ sp > (unsigned long)task_stack_page(current))
-+ current_thread_info()->lowest_stack = sp;
-+}
-+EXPORT_SYMBOL(pax_track_stack);
-+#endif
-+
-+#ifdef CONFIG_PAX_SIZE_OVERFLOW
-+void report_size_overflow(const char *file, unsigned int line, const char *func, const char *ssa_name)
-+{
-+ printk(KERN_ERR "PAX: size overflow detected in function %s %s:%u %s", func, file, line, ssa_name);
-+ dump_stack();
-+ do_group_exit(SIGKILL);
-+}
-+EXPORT_SYMBOL(report_size_overflow);
-+#endif
-+
- static int zap_process(struct task_struct *start)
- {
- struct task_struct *t;
-@@ -1793,17 +2216,17 @@ static void wait_for_dump_helpers(struct file *file)
- pipe = file->f_path.dentry->d_inode->i_pipe;
-
- pipe_lock(pipe);
-- pipe->readers++;
-- pipe->writers--;
-+ atomic_inc(&pipe->readers);
-+ atomic_dec(&pipe->writers);
-
-- while ((pipe->readers > 1) && (!signal_pending(current))) {
-+ while ((atomic_read(&pipe->readers) > 1) && (!signal_pending(current))) {
- wake_up_interruptible_sync(&pipe->wait);
- kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
- pipe_wait(pipe);
- }
-
-- pipe->readers--;
-- pipe->writers++;
-+ atomic_dec(&pipe->readers);
-+ atomic_inc(&pipe->writers);
- pipe_unlock(pipe);
-
- }
-@@ -1826,10 +2249,13 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
- char **helper_argv = NULL;
- int helper_argc = 0;
- int dump_count = 0;
-- static atomic_t core_dump_count = ATOMIC_INIT(0);
-+ static atomic_unchecked_t core_dump_count = ATOMIC_INIT(0);
-
- audit_core_dumps(signr);
-
-+ if (signr == SIGSEGV || signr == SIGBUS || signr == SIGKILL || signr == SIGILL)
-+ gr_handle_brute_attach(mm->flags);
-+
- binfmt = mm->binfmt;
- if (!binfmt || !binfmt->core_dump)
- goto fail;
-@@ -1874,6 +2300,8 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
- */
- clear_thread_flag(TIF_SIGPENDING);
-
-+ gr_learn_resource(current, RLIMIT_CORE, binfmt->min_coredump, 1);
-+
- /*
- * lock_kernel() because format_corename() is controlled by sysctl, which
- * uses lock_kernel()
-@@ -1908,7 +2336,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
- goto fail_unlock;
- }
-
-- dump_count = atomic_inc_return(&core_dump_count);
-+ dump_count = atomic_inc_return_unchecked(&core_dump_count);
- if (core_pipe_limit && (core_pipe_limit < dump_count)) {
- printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
- task_tgid_vnr(current), current->comm);
-@@ -1972,7 +2400,7 @@ close_fail:
- filp_close(file, NULL);
- fail_dropcount:
- if (dump_count)
-- atomic_dec(&core_dump_count);
-+ atomic_dec_unchecked(&core_dump_count);
- fail_unlock:
- if (helper_argv)
- argv_free(helper_argv);
-diff --git a/fs/ext2/balloc.c b/fs/ext2/balloc.c
-index 7f8d2e5..a1abdbb 100644
---- a/fs/ext2/balloc.c
-+++ b/fs/ext2/balloc.c
-@@ -1192,7 +1192,7 @@ static int ext2_has_free_blocks(struct ext2_sb_info *sbi)
-
- free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
- root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
-- if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
-+ if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
- sbi->s_resuid != current_fsuid() &&
- (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
- return 0;
-diff --git a/fs/ext3/balloc.c b/fs/ext3/balloc.c
-index 27967f9..9f2a5fb 100644
---- a/fs/ext3/balloc.c
-+++ b/fs/ext3/balloc.c
-@@ -1421,7 +1421,7 @@ static int ext3_has_free_blocks(struct ext3_sb_info *sbi)
-
- free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
- root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
-- if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
-+ if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
- sbi->s_resuid != current_fsuid() &&
- (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
- return 0;
-diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
-index e85b63c..80398e6 100644
---- a/fs/ext4/balloc.c
-+++ b/fs/ext4/balloc.c
-@@ -570,7 +570,7 @@ int ext4_has_free_blocks(struct ext4_sb_info *sbi, s64 nblocks)
- /* Hm, nope. Are (enough) root reserved blocks available? */
- if (sbi->s_resuid == current_fsuid() ||
- ((sbi->s_resgid != 0) && in_group_p(sbi->s_resgid)) ||
-- capable(CAP_SYS_RESOURCE)) {
-+ capable_nolog(CAP_SYS_RESOURCE)) {
- if (free_blocks >= (nblocks + dirty_blocks))
- return 1;
- }
-diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
-index 67c46ed..1f237e5 100644
---- a/fs/ext4/ext4.h
-+++ b/fs/ext4/ext4.h
-@@ -1077,19 +1077,19 @@ struct ext4_sb_info {
-
- /* stats for buddy allocator */
- spinlock_t s_mb_pa_lock;
-- atomic_t s_bal_reqs; /* number of reqs with len > 1 */
-- atomic_t s_bal_success; /* we found long enough chunks */
-- atomic_t s_bal_allocated; /* in blocks */
-- atomic_t s_bal_ex_scanned; /* total extents scanned */
-- atomic_t s_bal_goals; /* goal hits */
-- atomic_t s_bal_breaks; /* too long searches */
-- atomic_t s_bal_2orders; /* 2^order hits */
-+ atomic_unchecked_t s_bal_reqs; /* number of reqs with len > 1 */
-+ atomic_unchecked_t s_bal_success; /* we found long enough chunks */
-+ atomic_unchecked_t s_bal_allocated; /* in blocks */
-+ atomic_unchecked_t s_bal_ex_scanned; /* total extents scanned */
-+ atomic_unchecked_t s_bal_goals; /* goal hits */
-+ atomic_unchecked_t s_bal_breaks; /* too long searches */
-+ atomic_unchecked_t s_bal_2orders; /* 2^order hits */
- spinlock_t s_bal_lock;
- unsigned long s_mb_buddies_generated;
- unsigned long long s_mb_generation_time;
-- atomic_t s_mb_lost_chunks;
-- atomic_t s_mb_preallocated;
-- atomic_t s_mb_discarded;
-+ atomic_unchecked_t s_mb_lost_chunks;
-+ atomic_unchecked_t s_mb_preallocated;
-+ atomic_unchecked_t s_mb_discarded;
- atomic_t s_lock_busy;
-
- /* locality groups */
-diff --git a/fs/ext4/file.c b/fs/ext4/file.c
-index 2a60541..7439d61 100644
---- a/fs/ext4/file.c
-+++ b/fs/ext4/file.c
-@@ -122,8 +122,8 @@ static int ext4_file_open(struct inode * inode, struct file * filp)
- cp = d_path(&path, buf, sizeof(buf));
- path_put(&path);
- if (!IS_ERR(cp)) {
-- memcpy(sbi->s_es->s_last_mounted, cp,
-- sizeof(sbi->s_es->s_last_mounted));
-+ strlcpy(sbi->s_es->s_last_mounted, cp,
-+ sizeof(sbi->s_es->s_last_mounted));
- sb->s_dirt = 1;
- }
- }
-diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
-index efe6363..f9e1b6e 100644
---- a/fs/ext4/inode.c
-+++ b/fs/ext4/inode.c
-@@ -2179,6 +2179,7 @@ static void ext4_da_block_invalidatepages(struct mpage_da_data *mpd,
- index = logical >> (PAGE_CACHE_SHIFT - inode->i_blkbits);
- end = (logical + blk_cnt - 1) >>
- (PAGE_CACHE_SHIFT - inode->i_blkbits);
-+ pagevec_init(&pvec, 0);
- while (index <= end) {
- nr_pages = pagevec_lookup(&pvec, mapping, index, PAGEVEC_SIZE);
- if (nr_pages == 0)
-diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
-index 42bac1b..0aab9d8 100644
---- a/fs/ext4/mballoc.c
-+++ b/fs/ext4/mballoc.c
-@@ -1755,7 +1755,7 @@ void ext4_mb_simple_scan_group(struct ext4_allocation_context *ac,
- BUG_ON(ac->ac_b_ex.fe_len != ac->ac_g_ex.fe_len);
-
- if (EXT4_SB(sb)->s_mb_stats)
-- atomic_inc(&EXT4_SB(sb)->s_bal_2orders);
-+ atomic_inc_unchecked(&EXT4_SB(sb)->s_bal_2orders);
-
- break;
- }
-@@ -2131,7 +2131,7 @@ repeat:
- ac->ac_status = AC_STATUS_CONTINUE;
- ac->ac_flags |= EXT4_MB_HINT_FIRST;
- cr = 3;
-- atomic_inc(&sbi->s_mb_lost_chunks);
-+ atomic_inc_unchecked(&sbi->s_mb_lost_chunks);
- goto repeat;
- }
- }
-@@ -2174,6 +2174,8 @@ static int ext4_mb_seq_groups_show(struct seq_file *seq, void *v)
- ext4_grpblk_t counters[16];
- } sg;
-
-+ pax_track_stack();
-+
- group--;
- if (group == 0)
- seq_printf(seq, "#%-5s: %-5s %-5s %-5s "
-@@ -2534,25 +2536,25 @@ int ext4_mb_release(struct super_block *sb)
- if (sbi->s_mb_stats) {
- printk(KERN_INFO
- "EXT4-fs: mballoc: %u blocks %u reqs (%u success)\n",
-- atomic_read(&sbi->s_bal_allocated),
-- atomic_read(&sbi->s_bal_reqs),
-- atomic_read(&sbi->s_bal_success));
-+ atomic_read_unchecked(&sbi->s_bal_allocated),
-+ atomic_read_unchecked(&sbi->s_bal_reqs),
-+ atomic_read_unchecked(&sbi->s_bal_success));
- printk(KERN_INFO
- "EXT4-fs: mballoc: %u extents scanned, %u goal hits, "
- "%u 2^N hits, %u breaks, %u lost\n",
-- atomic_read(&sbi->s_bal_ex_scanned),
-- atomic_read(&sbi->s_bal_goals),
-- atomic_read(&sbi->s_bal_2orders),
-- atomic_read(&sbi->s_bal_breaks),
-- atomic_read(&sbi->s_mb_lost_chunks));
-+ atomic_read_unchecked(&sbi->s_bal_ex_scanned),
-+ atomic_read_unchecked(&sbi->s_bal_goals),
-+ atomic_read_unchecked(&sbi->s_bal_2orders),
-+ atomic_read_unchecked(&sbi->s_bal_breaks),
-+ atomic_read_unchecked(&sbi->s_mb_lost_chunks));
- printk(KERN_INFO
- "EXT4-fs: mballoc: %lu generated and it took %Lu\n",
- sbi->s_mb_buddies_generated++,
- sbi->s_mb_generation_time);
- printk(KERN_INFO
- "EXT4-fs: mballoc: %u preallocated, %u discarded\n",
-- atomic_read(&sbi->s_mb_preallocated),
-- atomic_read(&sbi->s_mb_discarded));
-+ atomic_read_unchecked(&sbi->s_mb_preallocated),
-+ atomic_read_unchecked(&sbi->s_mb_discarded));
- }
-
- free_percpu(sbi->s_locality_groups);
-@@ -3034,16 +3036,16 @@ static void ext4_mb_collect_stats(struct ext4_allocation_context *ac)
- struct ext4_sb_info *sbi = EXT4_SB(ac->ac_sb);
-
- if (sbi->s_mb_stats && ac->ac_g_ex.fe_len > 1) {
-- atomic_inc(&sbi->s_bal_reqs);
-- atomic_add(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
-+ atomic_inc_unchecked(&sbi->s_bal_reqs);
-+ atomic_add_unchecked(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
- if (ac->ac_o_ex.fe_len >= ac->ac_g_ex.fe_len)
-- atomic_inc(&sbi->s_bal_success);
-- atomic_add(ac->ac_found, &sbi->s_bal_ex_scanned);
-+ atomic_inc_unchecked(&sbi->s_bal_success);
-+ atomic_add_unchecked(ac->ac_found, &sbi->s_bal_ex_scanned);
- if (ac->ac_g_ex.fe_start == ac->ac_b_ex.fe_start &&
- ac->ac_g_ex.fe_group == ac->ac_b_ex.fe_group)
-- atomic_inc(&sbi->s_bal_goals);
-+ atomic_inc_unchecked(&sbi->s_bal_goals);
- if (ac->ac_found > sbi->s_mb_max_to_scan)
-- atomic_inc(&sbi->s_bal_breaks);
-+ atomic_inc_unchecked(&sbi->s_bal_breaks);
- }
-
- if (ac->ac_op == EXT4_MB_HISTORY_ALLOC)
-@@ -3443,7 +3445,7 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac)
- trace_ext4_mb_new_inode_pa(ac, pa);
-
- ext4_mb_use_inode_pa(ac, pa);
-- atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
-+ atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
-
- ei = EXT4_I(ac->ac_inode);
- grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
-@@ -3503,7 +3505,7 @@ ext4_mb_new_group_pa(struct ext4_allocation_context *ac)
- trace_ext4_mb_new_group_pa(ac, pa);
-
- ext4_mb_use_group_pa(ac, pa);
-- atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
-+ atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
-
- grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
- lg = ac->ac_lg;
-@@ -3607,7 +3609,7 @@ ext4_mb_release_inode_pa(struct ext4_buddy *e4b, struct buffer_head *bitmap_bh,
- * from the bitmap and continue.
- */
- }
-- atomic_add(free, &sbi->s_mb_discarded);
-+ atomic_add_unchecked(free, &sbi->s_mb_discarded);
-
- return err;
- }
-@@ -3626,7 +3628,7 @@ ext4_mb_release_group_pa(struct ext4_buddy *e4b,
- ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit);
- BUG_ON(group != e4b->bd_group && pa->pa_len != 0);
- mb_free_blocks(pa->pa_inode, e4b, bit, pa->pa_len);
-- atomic_add(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
-+ atomic_add_unchecked(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
-
- if (ac) {
- ac->ac_sb = sb;
-diff --git a/fs/ext4/super.c b/fs/ext4/super.c
-index f1e7077..edd86b2 100644
---- a/fs/ext4/super.c
-+++ b/fs/ext4/super.c
-@@ -2286,7 +2286,7 @@ static void ext4_sb_release(struct kobject *kobj)
- }
-
-
--static struct sysfs_ops ext4_attr_ops = {
-+static const struct sysfs_ops ext4_attr_ops = {
- .show = ext4_attr_show,
- .store = ext4_attr_store,
- };
-diff --git a/fs/fcntl.c b/fs/fcntl.c
-index 97e01dc..e9aab2d 100644
---- a/fs/fcntl.c
-+++ b/fs/fcntl.c
-@@ -223,6 +223,11 @@ int __f_setown(struct file *filp, struct pid *pid, enum pid_type type,
- if (err)
- return err;
-
-+ if (gr_handle_chroot_fowner(pid, type))
-+ return -ENOENT;
-+ if (gr_check_protected_task_fowner(pid, type))
-+ return -EACCES;
-+
- f_modown(filp, pid, type, force);
- return 0;
- }
-@@ -265,7 +270,7 @@ pid_t f_getown(struct file *filp)
-
- static int f_setown_ex(struct file *filp, unsigned long arg)
- {
-- struct f_owner_ex * __user owner_p = (void * __user)arg;
-+ struct f_owner_ex __user *owner_p = (void __user *)arg;
- struct f_owner_ex owner;
- struct pid *pid;
- int type;
-@@ -305,7 +310,7 @@ static int f_setown_ex(struct file *filp, unsigned long arg)
-
- static int f_getown_ex(struct file *filp, unsigned long arg)
- {
-- struct f_owner_ex * __user owner_p = (void * __user)arg;
-+ struct f_owner_ex __user *owner_p = (void __user *)arg;
- struct f_owner_ex owner;
- int ret = 0;
-
-@@ -344,6 +349,7 @@ static long do_fcntl(int fd, unsigned int cmd, unsigned long arg,
- switch (cmd) {
- case F_DUPFD:
- case F_DUPFD_CLOEXEC:
-+ gr_learn_resource(current, RLIMIT_NOFILE, arg, 0);
- if (arg >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
- break;
- err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
-diff --git a/fs/fifo.c b/fs/fifo.c
-index f8f97b8..401db37 100644
---- a/fs/fifo.c
-+++ b/fs/fifo.c
-@@ -15,7 +15,7 @@
- #include <linux/sched.h>
- #include <linux/pipe_fs_i.h>
-
--static void wait_for_partner(struct inode* inode, unsigned int *cnt)
-+static int wait_for_partner(struct inode* inode, unsigned int *cnt)
- {
- int cur = *cnt;
-
-@@ -24,6 +24,7 @@ static void wait_for_partner(struct inode* inode, unsigned int *cnt)
- if (signal_pending(current))
- break;
- }
-+ return cur == *cnt ? -ERESTARTSYS : 0;
- }
-
- static void wake_up_partner(struct inode* inode)
-@@ -59,18 +60,16 @@ static int fifo_open(struct inode *inode, struct file *filp)
- */
- filp->f_op = &read_pipefifo_fops;
- pipe->r_counter++;
-- if (pipe->readers++ == 0)
-+ if (atomic_inc_return(&pipe->readers) == 1)
- wake_up_partner(inode);
-
-- if (!pipe->writers) {
-+ if (!atomic_read(&pipe->writers)) {
- if ((filp->f_flags & O_NONBLOCK)) {
- /* suppress POLLHUP until we have
- * seen a writer */
- filp->f_version = pipe->w_counter;
-- } else
-- {
-- wait_for_partner(inode, &pipe->w_counter);
-- if(signal_pending(current))
-+ } else {
-+ if (wait_for_partner(inode, &pipe->w_counter))
- goto err_rd;
- }
- }
-@@ -83,17 +82,16 @@ static int fifo_open(struct inode *inode, struct file *filp)
- * errno=ENXIO when there is no process reading the FIFO.
- */
- ret = -ENXIO;
-- if ((filp->f_flags & O_NONBLOCK) && !pipe->readers)
-+ if ((filp->f_flags & O_NONBLOCK) && !atomic_read(&pipe->readers))
- goto err;
-
- filp->f_op = &write_pipefifo_fops;
- pipe->w_counter++;
-- if (!pipe->writers++)
-+ if (atomic_inc_return(&pipe->writers) == 1)
- wake_up_partner(inode);
-
-- if (!pipe->readers) {
-- wait_for_partner(inode, &pipe->r_counter);
-- if (signal_pending(current))
-+ if (!atomic_read(&pipe->readers)) {
-+ if (wait_for_partner(inode, &pipe->r_counter))
- goto err_wr;
- }
- break;
-@@ -107,11 +105,11 @@ static int fifo_open(struct inode *inode, struct file *filp)
- */
- filp->f_op = &rdwr_pipefifo_fops;
-
-- pipe->readers++;
-- pipe->writers++;
-+ atomic_inc(&pipe->readers);
-+ atomic_inc(&pipe->writers);
- pipe->r_counter++;
- pipe->w_counter++;
-- if (pipe->readers == 1 || pipe->writers == 1)
-+ if (atomic_read(&pipe->readers) == 1 || atomic_read(&pipe->writers) == 1)
- wake_up_partner(inode);
- break;
-
-@@ -125,19 +123,19 @@ static int fifo_open(struct inode *inode, struct file *filp)
- return 0;
-
- err_rd:
-- if (!--pipe->readers)
-+ if (atomic_dec_and_test(&pipe->readers))
- wake_up_interruptible(&pipe->wait);
- ret = -ERESTARTSYS;
- goto err;
-
- err_wr:
-- if (!--pipe->writers)
-+ if (atomic_dec_and_test(&pipe->writers))
- wake_up_interruptible(&pipe->wait);
- ret = -ERESTARTSYS;
- goto err;
-
- err:
-- if (!pipe->readers && !pipe->writers)
-+ if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers))
- free_pipe_info(inode);
-
- err_nocleanup:
-diff --git a/fs/file.c b/fs/file.c
-index 87e1290..a930cc4 100644
---- a/fs/file.c
-+++ b/fs/file.c
-@@ -14,6 +14,7 @@
- #include <linux/slab.h>
- #include <linux/vmalloc.h>
- #include <linux/file.h>
-+#include <linux/security.h>
- #include <linux/fdtable.h>
- #include <linux/bitops.h>
- #include <linux/interrupt.h>
-@@ -257,6 +258,8 @@ int expand_files(struct files_struct *files, int nr)
- * N.B. For clone tasks sharing a files structure, this test
- * will limit the total number of files that can be opened.
- */
-+
-+ gr_learn_resource(current, RLIMIT_NOFILE, nr, 0);
- if (nr >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
- return -EMFILE;
-
-diff --git a/fs/filesystems.c b/fs/filesystems.c
-index a24c58e..53f91ee 100644
---- a/fs/filesystems.c
-+++ b/fs/filesystems.c
-@@ -272,7 +272,12 @@ struct file_system_type *get_fs_type(const char *name)
- int len = dot ? dot - name : strlen(name);
-
- fs = __get_fs_type(name, len);
-+
-+#ifdef CONFIG_GRKERNSEC_MODHARDEN
-+ if (!fs && (___request_module(true, "grsec_modharden_fs", "%.*s", len, name) == 0))
-+#else
- if (!fs && (request_module("%.*s", len, name) == 0))
-+#endif
- fs = __get_fs_type(name, len);
-
- if (dot && fs && !(fs->fs_flags & FS_HAS_SUBTYPE)) {
-diff --git a/fs/fs_struct.c b/fs/fs_struct.c
-index eee0590..0a5b2ee 100644
---- a/fs/fs_struct.c
-+++ b/fs/fs_struct.c
-@@ -4,6 +4,7 @@
- #include <linux/path.h>
- #include <linux/slab.h>
- #include <linux/fs_struct.h>
-+#include <linux/grsecurity.h>
-
- /*
- * Replace the fs->{rootmnt,root} with {mnt,dentry}. Put the old values.
-@@ -17,6 +18,7 @@ void set_fs_root(struct fs_struct *fs, struct path *path)
- old_root = fs->root;
- fs->root = *path;
- path_get(path);
-+ gr_set_chroot_entries(current, path);
- write_unlock(&fs->lock);
- if (old_root.dentry)
- path_put(&old_root);
-@@ -56,6 +58,13 @@ void chroot_fs_refs(struct path *old_root, struct path *new_root)
- && fs->root.mnt == old_root->mnt) {
- path_get(new_root);
- fs->root = *new_root;
-+ /* This function is only called
-+ from pivot_root(). Leave our
-+ gr_chroot_dentry and is_chrooted flags
-+ as-is, so that a pivoted root isn't treated
-+ as a chroot
-+ */
-+ //gr_set_chroot_entries(p, new_root);
- count++;
- }
- if (fs->pwd.dentry == old_root->dentry
-@@ -89,7 +98,8 @@ void exit_fs(struct task_struct *tsk)
- task_lock(tsk);
- write_lock(&fs->lock);
- tsk->fs = NULL;
-- kill = !--fs->users;
-+ gr_clear_chroot_entries(tsk);
-+ kill = !atomic_dec_return(&fs->users);
- write_unlock(&fs->lock);
- task_unlock(tsk);
- if (kill)
-@@ -102,7 +112,7 @@ struct fs_struct *copy_fs_struct(struct fs_struct *old)
- struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL);
- /* We don't need to lock fs - think why ;-) */
- if (fs) {
-- fs->users = 1;
-+ atomic_set(&fs->users, 1);
- fs->in_exec = 0;
- rwlock_init(&fs->lock);
- fs->umask = old->umask;
-@@ -127,8 +137,9 @@ int unshare_fs_struct(void)
-
- task_lock(current);
- write_lock(&fs->lock);
-- kill = !--fs->users;
-+ kill = !atomic_dec_return(&fs->users);
- current->fs = new_fs;
-+ gr_set_chroot_entries(current, &new_fs->root);
- write_unlock(&fs->lock);
- task_unlock(current);
-
-@@ -141,13 +152,13 @@ EXPORT_SYMBOL_GPL(unshare_fs_struct);
-
- int current_umask(void)
- {
-- return current->fs->umask;
-+ return current->fs->umask | gr_acl_umask();
- }
- EXPORT_SYMBOL(current_umask);
-
- /* to be mentioned only in INIT_TASK */
- struct fs_struct init_fs = {
-- .users = 1,
-+ .users = ATOMIC_INIT(1),
- .lock = __RW_LOCK_UNLOCKED(init_fs.lock),
- .umask = 0022,
- };
-@@ -162,12 +173,13 @@ void daemonize_fs_struct(void)
- task_lock(current);
-
- write_lock(&init_fs.lock);
-- init_fs.users++;
-+ atomic_inc(&init_fs.users);
- write_unlock(&init_fs.lock);
-
- write_lock(&fs->lock);
- current->fs = &init_fs;
-- kill = !--fs->users;
-+ gr_set_chroot_entries(current, ¤t->fs->root);
-+ kill = !atomic_dec_return(&fs->users);
- write_unlock(&fs->lock);
-
- task_unlock(current);
-diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c
-index 9905350..02eaec4 100644
---- a/fs/fscache/cookie.c
-+++ b/fs/fscache/cookie.c
-@@ -68,11 +68,11 @@ struct fscache_cookie *__fscache_acquire_cookie(
- parent ? (char *) parent->def->name : "<no-parent>",
- def->name, netfs_data);
-
-- fscache_stat(&fscache_n_acquires);
-+ fscache_stat_unchecked(&fscache_n_acquires);
-
- /* if there's no parent cookie, then we don't create one here either */
- if (!parent) {
-- fscache_stat(&fscache_n_acquires_null);
-+ fscache_stat_unchecked(&fscache_n_acquires_null);
- _leave(" [no parent]");
- return NULL;
- }
-@@ -87,7 +87,7 @@ struct fscache_cookie *__fscache_acquire_cookie(
- /* allocate and initialise a cookie */
- cookie = kmem_cache_alloc(fscache_cookie_jar, GFP_KERNEL);
- if (!cookie) {
-- fscache_stat(&fscache_n_acquires_oom);
-+ fscache_stat_unchecked(&fscache_n_acquires_oom);
- _leave(" [ENOMEM]");
- return NULL;
- }
-@@ -109,13 +109,13 @@ struct fscache_cookie *__fscache_acquire_cookie(
-
- switch (cookie->def->type) {
- case FSCACHE_COOKIE_TYPE_INDEX:
-- fscache_stat(&fscache_n_cookie_index);
-+ fscache_stat_unchecked(&fscache_n_cookie_index);
- break;
- case FSCACHE_COOKIE_TYPE_DATAFILE:
-- fscache_stat(&fscache_n_cookie_data);
-+ fscache_stat_unchecked(&fscache_n_cookie_data);
- break;
- default:
-- fscache_stat(&fscache_n_cookie_special);
-+ fscache_stat_unchecked(&fscache_n_cookie_special);
- break;
- }
-
-@@ -126,13 +126,13 @@ struct fscache_cookie *__fscache_acquire_cookie(
- if (fscache_acquire_non_index_cookie(cookie) < 0) {
- atomic_dec(&parent->n_children);
- __fscache_cookie_put(cookie);
-- fscache_stat(&fscache_n_acquires_nobufs);
-+ fscache_stat_unchecked(&fscache_n_acquires_nobufs);
- _leave(" = NULL");
- return NULL;
- }
- }
-
-- fscache_stat(&fscache_n_acquires_ok);
-+ fscache_stat_unchecked(&fscache_n_acquires_ok);
- _leave(" = %p", cookie);
- return cookie;
- }
-@@ -168,7 +168,7 @@ static int fscache_acquire_non_index_cookie(struct fscache_cookie *cookie)
- cache = fscache_select_cache_for_object(cookie->parent);
- if (!cache) {
- up_read(&fscache_addremove_sem);
-- fscache_stat(&fscache_n_acquires_no_cache);
-+ fscache_stat_unchecked(&fscache_n_acquires_no_cache);
- _leave(" = -ENOMEDIUM [no cache]");
- return -ENOMEDIUM;
- }
-@@ -256,12 +256,12 @@ static int fscache_alloc_object(struct fscache_cache *cache,
- object = cache->ops->alloc_object(cache, cookie);
- fscache_stat_d(&fscache_n_cop_alloc_object);
- if (IS_ERR(object)) {
-- fscache_stat(&fscache_n_object_no_alloc);
-+ fscache_stat_unchecked(&fscache_n_object_no_alloc);
- ret = PTR_ERR(object);
- goto error;
- }
-
-- fscache_stat(&fscache_n_object_alloc);
-+ fscache_stat_unchecked(&fscache_n_object_alloc);
-
- object->debug_id = atomic_inc_return(&fscache_object_debug_id);
-
-@@ -377,10 +377,10 @@ void __fscache_update_cookie(struct fscache_cookie *cookie)
- struct fscache_object *object;
- struct hlist_node *_p;
-
-- fscache_stat(&fscache_n_updates);
-+ fscache_stat_unchecked(&fscache_n_updates);
-
- if (!cookie) {
-- fscache_stat(&fscache_n_updates_null);
-+ fscache_stat_unchecked(&fscache_n_updates_null);
- _leave(" [no cookie]");
- return;
- }
-@@ -414,12 +414,12 @@ void __fscache_relinquish_cookie(struct fscache_cookie *cookie, int retire)
- struct fscache_object *object;
- unsigned long event;
-
-- fscache_stat(&fscache_n_relinquishes);
-+ fscache_stat_unchecked(&fscache_n_relinquishes);
- if (retire)
-- fscache_stat(&fscache_n_relinquishes_retire);
-+ fscache_stat_unchecked(&fscache_n_relinquishes_retire);
-
- if (!cookie) {
-- fscache_stat(&fscache_n_relinquishes_null);
-+ fscache_stat_unchecked(&fscache_n_relinquishes_null);
- _leave(" [no cookie]");
- return;
- }
-@@ -435,7 +435,7 @@ void __fscache_relinquish_cookie(struct fscache_cookie *cookie, int retire)
-
- /* wait for the cookie to finish being instantiated (or to fail) */
- if (test_bit(FSCACHE_COOKIE_CREATING, &cookie->flags)) {
-- fscache_stat(&fscache_n_relinquishes_waitcrt);
-+ fscache_stat_unchecked(&fscache_n_relinquishes_waitcrt);
- wait_on_bit(&cookie->flags, FSCACHE_COOKIE_CREATING,
- fscache_wait_bit, TASK_UNINTERRUPTIBLE);
- }
-diff --git a/fs/fscache/internal.h b/fs/fscache/internal.h
-index edd7434..0725e66 100644
---- a/fs/fscache/internal.h
-+++ b/fs/fscache/internal.h
-@@ -136,94 +136,94 @@ extern void fscache_proc_cleanup(void);
- extern atomic_t fscache_n_ops_processed[FSCACHE_MAX_THREADS];
- extern atomic_t fscache_n_objs_processed[FSCACHE_MAX_THREADS];
-
--extern atomic_t fscache_n_op_pend;
--extern atomic_t fscache_n_op_run;
--extern atomic_t fscache_n_op_enqueue;
--extern atomic_t fscache_n_op_deferred_release;
--extern atomic_t fscache_n_op_release;
--extern atomic_t fscache_n_op_gc;
--extern atomic_t fscache_n_op_cancelled;
--extern atomic_t fscache_n_op_rejected;
-+extern atomic_unchecked_t fscache_n_op_pend;
-+extern atomic_unchecked_t fscache_n_op_run;
-+extern atomic_unchecked_t fscache_n_op_enqueue;
-+extern atomic_unchecked_t fscache_n_op_deferred_release;
-+extern atomic_unchecked_t fscache_n_op_release;
-+extern atomic_unchecked_t fscache_n_op_gc;
-+extern atomic_unchecked_t fscache_n_op_cancelled;
-+extern atomic_unchecked_t fscache_n_op_rejected;
-
--extern atomic_t fscache_n_attr_changed;
--extern atomic_t fscache_n_attr_changed_ok;
--extern atomic_t fscache_n_attr_changed_nobufs;
--extern atomic_t fscache_n_attr_changed_nomem;
--extern atomic_t fscache_n_attr_changed_calls;
-+extern atomic_unchecked_t fscache_n_attr_changed;
-+extern atomic_unchecked_t fscache_n_attr_changed_ok;
-+extern atomic_unchecked_t fscache_n_attr_changed_nobufs;
-+extern atomic_unchecked_t fscache_n_attr_changed_nomem;
-+extern atomic_unchecked_t fscache_n_attr_changed_calls;
-
--extern atomic_t fscache_n_allocs;
--extern atomic_t fscache_n_allocs_ok;
--extern atomic_t fscache_n_allocs_wait;
--extern atomic_t fscache_n_allocs_nobufs;
--extern atomic_t fscache_n_allocs_intr;
--extern atomic_t fscache_n_allocs_object_dead;
--extern atomic_t fscache_n_alloc_ops;
--extern atomic_t fscache_n_alloc_op_waits;
-+extern atomic_unchecked_t fscache_n_allocs;
-+extern atomic_unchecked_t fscache_n_allocs_ok;
-+extern atomic_unchecked_t fscache_n_allocs_wait;
-+extern atomic_unchecked_t fscache_n_allocs_nobufs;
-+extern atomic_unchecked_t fscache_n_allocs_intr;
-+extern atomic_unchecked_t fscache_n_allocs_object_dead;
-+extern atomic_unchecked_t fscache_n_alloc_ops;
-+extern atomic_unchecked_t fscache_n_alloc_op_waits;
-
--extern atomic_t fscache_n_retrievals;
--extern atomic_t fscache_n_retrievals_ok;
--extern atomic_t fscache_n_retrievals_wait;
--extern atomic_t fscache_n_retrievals_nodata;
--extern atomic_t fscache_n_retrievals_nobufs;
--extern atomic_t fscache_n_retrievals_intr;
--extern atomic_t fscache_n_retrievals_nomem;
--extern atomic_t fscache_n_retrievals_object_dead;
--extern atomic_t fscache_n_retrieval_ops;
--extern atomic_t fscache_n_retrieval_op_waits;
-+extern atomic_unchecked_t fscache_n_retrievals;
-+extern atomic_unchecked_t fscache_n_retrievals_ok;
-+extern atomic_unchecked_t fscache_n_retrievals_wait;
-+extern atomic_unchecked_t fscache_n_retrievals_nodata;
-+extern atomic_unchecked_t fscache_n_retrievals_nobufs;
-+extern atomic_unchecked_t fscache_n_retrievals_intr;
-+extern atomic_unchecked_t fscache_n_retrievals_nomem;
-+extern atomic_unchecked_t fscache_n_retrievals_object_dead;
-+extern atomic_unchecked_t fscache_n_retrieval_ops;
-+extern atomic_unchecked_t fscache_n_retrieval_op_waits;
-
--extern atomic_t fscache_n_stores;
--extern atomic_t fscache_n_stores_ok;
--extern atomic_t fscache_n_stores_again;
--extern atomic_t fscache_n_stores_nobufs;
--extern atomic_t fscache_n_stores_oom;
--extern atomic_t fscache_n_store_ops;
--extern atomic_t fscache_n_store_calls;
--extern atomic_t fscache_n_store_pages;
--extern atomic_t fscache_n_store_radix_deletes;
--extern atomic_t fscache_n_store_pages_over_limit;
-+extern atomic_unchecked_t fscache_n_stores;
-+extern atomic_unchecked_t fscache_n_stores_ok;
-+extern atomic_unchecked_t fscache_n_stores_again;
-+extern atomic_unchecked_t fscache_n_stores_nobufs;
-+extern atomic_unchecked_t fscache_n_stores_oom;
-+extern atomic_unchecked_t fscache_n_store_ops;
-+extern atomic_unchecked_t fscache_n_store_calls;
-+extern atomic_unchecked_t fscache_n_store_pages;
-+extern atomic_unchecked_t fscache_n_store_radix_deletes;
-+extern atomic_unchecked_t fscache_n_store_pages_over_limit;
-
--extern atomic_t fscache_n_store_vmscan_not_storing;
--extern atomic_t fscache_n_store_vmscan_gone;
--extern atomic_t fscache_n_store_vmscan_busy;
--extern atomic_t fscache_n_store_vmscan_cancelled;
-+extern atomic_unchecked_t fscache_n_store_vmscan_not_storing;
-+extern atomic_unchecked_t fscache_n_store_vmscan_gone;
-+extern atomic_unchecked_t fscache_n_store_vmscan_busy;
-+extern atomic_unchecked_t fscache_n_store_vmscan_cancelled;
-
--extern atomic_t fscache_n_marks;
--extern atomic_t fscache_n_uncaches;
-+extern atomic_unchecked_t fscache_n_marks;
-+extern atomic_unchecked_t fscache_n_uncaches;
-
--extern atomic_t fscache_n_acquires;
--extern atomic_t fscache_n_acquires_null;
--extern atomic_t fscache_n_acquires_no_cache;
--extern atomic_t fscache_n_acquires_ok;
--extern atomic_t fscache_n_acquires_nobufs;
--extern atomic_t fscache_n_acquires_oom;
-+extern atomic_unchecked_t fscache_n_acquires;
-+extern atomic_unchecked_t fscache_n_acquires_null;
-+extern atomic_unchecked_t fscache_n_acquires_no_cache;
-+extern atomic_unchecked_t fscache_n_acquires_ok;
-+extern atomic_unchecked_t fscache_n_acquires_nobufs;
-+extern atomic_unchecked_t fscache_n_acquires_oom;
-
--extern atomic_t fscache_n_updates;
--extern atomic_t fscache_n_updates_null;
--extern atomic_t fscache_n_updates_run;
-+extern atomic_unchecked_t fscache_n_updates;
-+extern atomic_unchecked_t fscache_n_updates_null;
-+extern atomic_unchecked_t fscache_n_updates_run;
-
--extern atomic_t fscache_n_relinquishes;
--extern atomic_t fscache_n_relinquishes_null;
--extern atomic_t fscache_n_relinquishes_waitcrt;
--extern atomic_t fscache_n_relinquishes_retire;
-+extern atomic_unchecked_t fscache_n_relinquishes;
-+extern atomic_unchecked_t fscache_n_relinquishes_null;
-+extern atomic_unchecked_t fscache_n_relinquishes_waitcrt;
-+extern atomic_unchecked_t fscache_n_relinquishes_retire;
-
--extern atomic_t fscache_n_cookie_index;
--extern atomic_t fscache_n_cookie_data;
--extern atomic_t fscache_n_cookie_special;
-+extern atomic_unchecked_t fscache_n_cookie_index;
-+extern atomic_unchecked_t fscache_n_cookie_data;
-+extern atomic_unchecked_t fscache_n_cookie_special;
-
--extern atomic_t fscache_n_object_alloc;
--extern atomic_t fscache_n_object_no_alloc;
--extern atomic_t fscache_n_object_lookups;
--extern atomic_t fscache_n_object_lookups_negative;
--extern atomic_t fscache_n_object_lookups_positive;
--extern atomic_t fscache_n_object_lookups_timed_out;
--extern atomic_t fscache_n_object_created;
--extern atomic_t fscache_n_object_avail;
--extern atomic_t fscache_n_object_dead;
-+extern atomic_unchecked_t fscache_n_object_alloc;
-+extern atomic_unchecked_t fscache_n_object_no_alloc;
-+extern atomic_unchecked_t fscache_n_object_lookups;
-+extern atomic_unchecked_t fscache_n_object_lookups_negative;
-+extern atomic_unchecked_t fscache_n_object_lookups_positive;
-+extern atomic_unchecked_t fscache_n_object_lookups_timed_out;
-+extern atomic_unchecked_t fscache_n_object_created;
-+extern atomic_unchecked_t fscache_n_object_avail;
-+extern atomic_unchecked_t fscache_n_object_dead;
-
--extern atomic_t fscache_n_checkaux_none;
--extern atomic_t fscache_n_checkaux_okay;
--extern atomic_t fscache_n_checkaux_update;
--extern atomic_t fscache_n_checkaux_obsolete;
-+extern atomic_unchecked_t fscache_n_checkaux_none;
-+extern atomic_unchecked_t fscache_n_checkaux_okay;
-+extern atomic_unchecked_t fscache_n_checkaux_update;
-+extern atomic_unchecked_t fscache_n_checkaux_obsolete;
-
- extern atomic_t fscache_n_cop_alloc_object;
- extern atomic_t fscache_n_cop_lookup_object;
-@@ -247,6 +247,11 @@ static inline void fscache_stat(atomic_t *stat)
- atomic_inc(stat);
- }
-
-+static inline void fscache_stat_unchecked(atomic_unchecked_t *stat)
-+{
-+ atomic_inc_unchecked(stat);
-+}
-+
- static inline void fscache_stat_d(atomic_t *stat)
- {
- atomic_dec(stat);
-@@ -259,6 +264,7 @@ extern const struct file_operations fscache_stats_fops;
-
- #define __fscache_stat(stat) (NULL)
- #define fscache_stat(stat) do {} while (0)
-+#define fscache_stat_unchecked(stat) do {} while (0)
- #define fscache_stat_d(stat) do {} while (0)
- #endif
-
-diff --git a/fs/fscache/object.c b/fs/fscache/object.c
-index e513ac5..e888d34 100644
---- a/fs/fscache/object.c
-+++ b/fs/fscache/object.c
-@@ -144,7 +144,7 @@ static void fscache_object_state_machine(struct fscache_object *object)
- /* update the object metadata on disk */
- case FSCACHE_OBJECT_UPDATING:
- clear_bit(FSCACHE_OBJECT_EV_UPDATE, &object->events);
-- fscache_stat(&fscache_n_updates_run);
-+ fscache_stat_unchecked(&fscache_n_updates_run);
- fscache_stat(&fscache_n_cop_update_object);
- object->cache->ops->update_object(object);
- fscache_stat_d(&fscache_n_cop_update_object);
-@@ -233,7 +233,7 @@ static void fscache_object_state_machine(struct fscache_object *object)
- spin_lock(&object->lock);
- object->state = FSCACHE_OBJECT_DEAD;
- spin_unlock(&object->lock);
-- fscache_stat(&fscache_n_object_dead);
-+ fscache_stat_unchecked(&fscache_n_object_dead);
- goto terminal_transit;
-
- /* handle the parent cache of this object being withdrawn from
-@@ -248,7 +248,7 @@ static void fscache_object_state_machine(struct fscache_object *object)
- spin_lock(&object->lock);
- object->state = FSCACHE_OBJECT_DEAD;
- spin_unlock(&object->lock);
-- fscache_stat(&fscache_n_object_dead);
-+ fscache_stat_unchecked(&fscache_n_object_dead);
- goto terminal_transit;
-
- /* complain about the object being woken up once it is
-@@ -492,7 +492,7 @@ static void fscache_lookup_object(struct fscache_object *object)
- parent->cookie->def->name, cookie->def->name,
- object->cache->tag->name);
-
-- fscache_stat(&fscache_n_object_lookups);
-+ fscache_stat_unchecked(&fscache_n_object_lookups);
- fscache_stat(&fscache_n_cop_lookup_object);
- ret = object->cache->ops->lookup_object(object);
- fscache_stat_d(&fscache_n_cop_lookup_object);
-@@ -503,7 +503,7 @@ static void fscache_lookup_object(struct fscache_object *object)
- if (ret == -ETIMEDOUT) {
- /* probably stuck behind another object, so move this one to
- * the back of the queue */
-- fscache_stat(&fscache_n_object_lookups_timed_out);
-+ fscache_stat_unchecked(&fscache_n_object_lookups_timed_out);
- set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
- }
-
-@@ -526,7 +526,7 @@ void fscache_object_lookup_negative(struct fscache_object *object)
-
- spin_lock(&object->lock);
- if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
-- fscache_stat(&fscache_n_object_lookups_negative);
-+ fscache_stat_unchecked(&fscache_n_object_lookups_negative);
-
- /* transit here to allow write requests to begin stacking up
- * and read requests to begin returning ENODATA */
-@@ -572,7 +572,7 @@ void fscache_obtained_object(struct fscache_object *object)
- * result, in which case there may be data available */
- spin_lock(&object->lock);
- if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
-- fscache_stat(&fscache_n_object_lookups_positive);
-+ fscache_stat_unchecked(&fscache_n_object_lookups_positive);
-
- clear_bit(FSCACHE_COOKIE_NO_DATA_YET, &cookie->flags);
-
-@@ -586,7 +586,7 @@ void fscache_obtained_object(struct fscache_object *object)
- set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
- } else {
- ASSERTCMP(object->state, ==, FSCACHE_OBJECT_CREATING);
-- fscache_stat(&fscache_n_object_created);
-+ fscache_stat_unchecked(&fscache_n_object_created);
-
- object->state = FSCACHE_OBJECT_AVAILABLE;
- spin_unlock(&object->lock);
-@@ -633,7 +633,7 @@ static void fscache_object_available(struct fscache_object *object)
- fscache_enqueue_dependents(object);
-
- fscache_hist(fscache_obj_instantiate_histogram, object->lookup_jif);
-- fscache_stat(&fscache_n_object_avail);
-+ fscache_stat_unchecked(&fscache_n_object_avail);
-
- _leave("");
- }
-@@ -861,7 +861,7 @@ enum fscache_checkaux fscache_check_aux(struct fscache_object *object,
- enum fscache_checkaux result;
-
- if (!object->cookie->def->check_aux) {
-- fscache_stat(&fscache_n_checkaux_none);
-+ fscache_stat_unchecked(&fscache_n_checkaux_none);
- return FSCACHE_CHECKAUX_OKAY;
- }
-
-@@ -870,17 +870,17 @@ enum fscache_checkaux fscache_check_aux(struct fscache_object *object,
- switch (result) {
- /* entry okay as is */
- case FSCACHE_CHECKAUX_OKAY:
-- fscache_stat(&fscache_n_checkaux_okay);
-+ fscache_stat_unchecked(&fscache_n_checkaux_okay);
- break;
-
- /* entry requires update */
- case FSCACHE_CHECKAUX_NEEDS_UPDATE:
-- fscache_stat(&fscache_n_checkaux_update);
-+ fscache_stat_unchecked(&fscache_n_checkaux_update);
- break;
-
- /* entry requires deletion */
- case FSCACHE_CHECKAUX_OBSOLETE:
-- fscache_stat(&fscache_n_checkaux_obsolete);
-+ fscache_stat_unchecked(&fscache_n_checkaux_obsolete);
- break;
-
- default:
-diff --git a/fs/fscache/operation.c b/fs/fscache/operation.c
-index 313e79a..775240f 100644
---- a/fs/fscache/operation.c
-+++ b/fs/fscache/operation.c
-@@ -16,7 +16,7 @@
- #include <linux/seq_file.h>
- #include "internal.h"
-
--atomic_t fscache_op_debug_id;
-+atomic_unchecked_t fscache_op_debug_id;
- EXPORT_SYMBOL(fscache_op_debug_id);
-
- /**
-@@ -39,7 +39,7 @@ void fscache_enqueue_operation(struct fscache_operation *op)
- ASSERTCMP(op->object->state, >=, FSCACHE_OBJECT_AVAILABLE);
- ASSERTCMP(atomic_read(&op->usage), >, 0);
-
-- fscache_stat(&fscache_n_op_enqueue);
-+ fscache_stat_unchecked(&fscache_n_op_enqueue);
- switch (op->flags & FSCACHE_OP_TYPE) {
- case FSCACHE_OP_FAST:
- _debug("queue fast");
-@@ -76,7 +76,7 @@ static void fscache_run_op(struct fscache_object *object,
- wake_up_bit(&op->flags, FSCACHE_OP_WAITING);
- if (op->processor)
- fscache_enqueue_operation(op);
-- fscache_stat(&fscache_n_op_run);
-+ fscache_stat_unchecked(&fscache_n_op_run);
- }
-
- /*
-@@ -107,11 +107,11 @@ int fscache_submit_exclusive_op(struct fscache_object *object,
- if (object->n_ops > 0) {
- atomic_inc(&op->usage);
- list_add_tail(&op->pend_link, &object->pending_ops);
-- fscache_stat(&fscache_n_op_pend);
-+ fscache_stat_unchecked(&fscache_n_op_pend);
- } else if (!list_empty(&object->pending_ops)) {
- atomic_inc(&op->usage);
- list_add_tail(&op->pend_link, &object->pending_ops);
-- fscache_stat(&fscache_n_op_pend);
-+ fscache_stat_unchecked(&fscache_n_op_pend);
- fscache_start_operations(object);
- } else {
- ASSERTCMP(object->n_in_progress, ==, 0);
-@@ -127,7 +127,7 @@ int fscache_submit_exclusive_op(struct fscache_object *object,
- object->n_exclusive++; /* reads and writes must wait */
- atomic_inc(&op->usage);
- list_add_tail(&op->pend_link, &object->pending_ops);
-- fscache_stat(&fscache_n_op_pend);
-+ fscache_stat_unchecked(&fscache_n_op_pend);
- ret = 0;
- } else {
- /* not allowed to submit ops in any other state */
-@@ -214,11 +214,11 @@ int fscache_submit_op(struct fscache_object *object,
- if (object->n_exclusive > 0) {
- atomic_inc(&op->usage);
- list_add_tail(&op->pend_link, &object->pending_ops);
-- fscache_stat(&fscache_n_op_pend);
-+ fscache_stat_unchecked(&fscache_n_op_pend);
- } else if (!list_empty(&object->pending_ops)) {
- atomic_inc(&op->usage);
- list_add_tail(&op->pend_link, &object->pending_ops);
-- fscache_stat(&fscache_n_op_pend);
-+ fscache_stat_unchecked(&fscache_n_op_pend);
- fscache_start_operations(object);
- } else {
- ASSERTCMP(object->n_exclusive, ==, 0);
-@@ -230,12 +230,12 @@ int fscache_submit_op(struct fscache_object *object,
- object->n_ops++;
- atomic_inc(&op->usage);
- list_add_tail(&op->pend_link, &object->pending_ops);
-- fscache_stat(&fscache_n_op_pend);
-+ fscache_stat_unchecked(&fscache_n_op_pend);
- ret = 0;
- } else if (object->state == FSCACHE_OBJECT_DYING ||
- object->state == FSCACHE_OBJECT_LC_DYING ||
- object->state == FSCACHE_OBJECT_WITHDRAWING) {
-- fscache_stat(&fscache_n_op_rejected);
-+ fscache_stat_unchecked(&fscache_n_op_rejected);
- ret = -ENOBUFS;
- } else if (!test_bit(FSCACHE_IOERROR, &object->cache->flags)) {
- fscache_report_unexpected_submission(object, op, ostate);
-@@ -305,7 +305,7 @@ int fscache_cancel_op(struct fscache_operation *op)
-
- ret = -EBUSY;
- if (!list_empty(&op->pend_link)) {
-- fscache_stat(&fscache_n_op_cancelled);
-+ fscache_stat_unchecked(&fscache_n_op_cancelled);
- list_del_init(&op->pend_link);
- object->n_ops--;
- if (test_bit(FSCACHE_OP_EXCLUSIVE, &op->flags))
-@@ -344,7 +344,7 @@ void fscache_put_operation(struct fscache_operation *op)
- if (test_and_set_bit(FSCACHE_OP_DEAD, &op->flags))
- BUG();
-
-- fscache_stat(&fscache_n_op_release);
-+ fscache_stat_unchecked(&fscache_n_op_release);
-
- if (op->release) {
- op->release(op);
-@@ -361,7 +361,7 @@ void fscache_put_operation(struct fscache_operation *op)
- * lock, and defer it otherwise */
- if (!spin_trylock(&object->lock)) {
- _debug("defer put");
-- fscache_stat(&fscache_n_op_deferred_release);
-+ fscache_stat_unchecked(&fscache_n_op_deferred_release);
-
- cache = object->cache;
- spin_lock(&cache->op_gc_list_lock);
-@@ -423,7 +423,7 @@ void fscache_operation_gc(struct work_struct *work)
-
- _debug("GC DEFERRED REL OBJ%x OP%x",
- object->debug_id, op->debug_id);
-- fscache_stat(&fscache_n_op_gc);
-+ fscache_stat_unchecked(&fscache_n_op_gc);
-
- ASSERTCMP(atomic_read(&op->usage), ==, 0);
-
-diff --git a/fs/fscache/page.c b/fs/fscache/page.c
-index c598ea4..6aac13e 100644
---- a/fs/fscache/page.c
-+++ b/fs/fscache/page.c
-@@ -59,7 +59,7 @@ bool __fscache_maybe_release_page(struct fscache_cookie *cookie,
- val = radix_tree_lookup(&cookie->stores, page->index);
- if (!val) {
- rcu_read_unlock();
-- fscache_stat(&fscache_n_store_vmscan_not_storing);
-+ fscache_stat_unchecked(&fscache_n_store_vmscan_not_storing);
- __fscache_uncache_page(cookie, page);
- return true;
- }
-@@ -89,11 +89,11 @@ bool __fscache_maybe_release_page(struct fscache_cookie *cookie,
- spin_unlock(&cookie->stores_lock);
-
- if (xpage) {
-- fscache_stat(&fscache_n_store_vmscan_cancelled);
-- fscache_stat(&fscache_n_store_radix_deletes);
-+ fscache_stat_unchecked(&fscache_n_store_vmscan_cancelled);
-+ fscache_stat_unchecked(&fscache_n_store_radix_deletes);
- ASSERTCMP(xpage, ==, page);
- } else {
-- fscache_stat(&fscache_n_store_vmscan_gone);
-+ fscache_stat_unchecked(&fscache_n_store_vmscan_gone);
- }
-
- wake_up_bit(&cookie->flags, 0);
-@@ -106,7 +106,7 @@ page_busy:
- /* we might want to wait here, but that could deadlock the allocator as
- * the slow-work threads writing to the cache may all end up sleeping
- * on memory allocation */
-- fscache_stat(&fscache_n_store_vmscan_busy);
-+ fscache_stat_unchecked(&fscache_n_store_vmscan_busy);
- return false;
- }
- EXPORT_SYMBOL(__fscache_maybe_release_page);
-@@ -130,7 +130,7 @@ static void fscache_end_page_write(struct fscache_object *object,
- FSCACHE_COOKIE_STORING_TAG);
- if (!radix_tree_tag_get(&cookie->stores, page->index,
- FSCACHE_COOKIE_PENDING_TAG)) {
-- fscache_stat(&fscache_n_store_radix_deletes);
-+ fscache_stat_unchecked(&fscache_n_store_radix_deletes);
- xpage = radix_tree_delete(&cookie->stores, page->index);
- }
- spin_unlock(&cookie->stores_lock);
-@@ -151,7 +151,7 @@ static void fscache_attr_changed_op(struct fscache_operation *op)
-
- _enter("{OBJ%x OP%x}", object->debug_id, op->debug_id);
-
-- fscache_stat(&fscache_n_attr_changed_calls);
-+ fscache_stat_unchecked(&fscache_n_attr_changed_calls);
-
- if (fscache_object_is_active(object)) {
- fscache_set_op_state(op, "CallFS");
-@@ -178,11 +178,11 @@ int __fscache_attr_changed(struct fscache_cookie *cookie)
-
- ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
-
-- fscache_stat(&fscache_n_attr_changed);
-+ fscache_stat_unchecked(&fscache_n_attr_changed);
-
- op = kzalloc(sizeof(*op), GFP_KERNEL);
- if (!op) {
-- fscache_stat(&fscache_n_attr_changed_nomem);
-+ fscache_stat_unchecked(&fscache_n_attr_changed_nomem);
- _leave(" = -ENOMEM");
- return -ENOMEM;
- }
-@@ -202,7 +202,7 @@ int __fscache_attr_changed(struct fscache_cookie *cookie)
- if (fscache_submit_exclusive_op(object, op) < 0)
- goto nobufs;
- spin_unlock(&cookie->lock);
-- fscache_stat(&fscache_n_attr_changed_ok);
-+ fscache_stat_unchecked(&fscache_n_attr_changed_ok);
- fscache_put_operation(op);
- _leave(" = 0");
- return 0;
-@@ -210,7 +210,7 @@ int __fscache_attr_changed(struct fscache_cookie *cookie)
- nobufs:
- spin_unlock(&cookie->lock);
- kfree(op);
-- fscache_stat(&fscache_n_attr_changed_nobufs);
-+ fscache_stat_unchecked(&fscache_n_attr_changed_nobufs);
- _leave(" = %d", -ENOBUFS);
- return -ENOBUFS;
- }
-@@ -264,7 +264,7 @@ static struct fscache_retrieval *fscache_alloc_retrieval(
- /* allocate a retrieval operation and attempt to submit it */
- op = kzalloc(sizeof(*op), GFP_NOIO);
- if (!op) {
-- fscache_stat(&fscache_n_retrievals_nomem);
-+ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
- return NULL;
- }
-
-@@ -294,13 +294,13 @@ static int fscache_wait_for_deferred_lookup(struct fscache_cookie *cookie)
- return 0;
- }
-
-- fscache_stat(&fscache_n_retrievals_wait);
-+ fscache_stat_unchecked(&fscache_n_retrievals_wait);
-
- jif = jiffies;
- if (wait_on_bit(&cookie->flags, FSCACHE_COOKIE_LOOKING_UP,
- fscache_wait_bit_interruptible,
- TASK_INTERRUPTIBLE) != 0) {
-- fscache_stat(&fscache_n_retrievals_intr);
-+ fscache_stat_unchecked(&fscache_n_retrievals_intr);
- _leave(" = -ERESTARTSYS");
- return -ERESTARTSYS;
- }
-@@ -318,8 +318,8 @@ static int fscache_wait_for_deferred_lookup(struct fscache_cookie *cookie)
- */
- static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
- struct fscache_retrieval *op,
-- atomic_t *stat_op_waits,
-- atomic_t *stat_object_dead)
-+ atomic_unchecked_t *stat_op_waits,
-+ atomic_unchecked_t *stat_object_dead)
- {
- int ret;
-
-@@ -327,7 +327,7 @@ static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
- goto check_if_dead;
-
- _debug(">>> WT");
-- fscache_stat(stat_op_waits);
-+ fscache_stat_unchecked(stat_op_waits);
- if (wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
- fscache_wait_bit_interruptible,
- TASK_INTERRUPTIBLE) < 0) {
-@@ -344,7 +344,7 @@ static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
-
- check_if_dead:
- if (unlikely(fscache_object_is_dead(object))) {
-- fscache_stat(stat_object_dead);
-+ fscache_stat_unchecked(stat_object_dead);
- return -ENOBUFS;
- }
- return 0;
-@@ -371,7 +371,7 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
-
- _enter("%p,%p,,,", cookie, page);
-
-- fscache_stat(&fscache_n_retrievals);
-+ fscache_stat_unchecked(&fscache_n_retrievals);
-
- if (hlist_empty(&cookie->backing_objects))
- goto nobufs;
-@@ -405,7 +405,7 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
- goto nobufs_unlock;
- spin_unlock(&cookie->lock);
-
-- fscache_stat(&fscache_n_retrieval_ops);
-+ fscache_stat_unchecked(&fscache_n_retrieval_ops);
-
- /* pin the netfs read context in case we need to do the actual netfs
- * read because we've encountered a cache read failure */
-@@ -435,15 +435,15 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
-
- error:
- if (ret == -ENOMEM)
-- fscache_stat(&fscache_n_retrievals_nomem);
-+ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
- else if (ret == -ERESTARTSYS)
-- fscache_stat(&fscache_n_retrievals_intr);
-+ fscache_stat_unchecked(&fscache_n_retrievals_intr);
- else if (ret == -ENODATA)
-- fscache_stat(&fscache_n_retrievals_nodata);
-+ fscache_stat_unchecked(&fscache_n_retrievals_nodata);
- else if (ret < 0)
-- fscache_stat(&fscache_n_retrievals_nobufs);
-+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
- else
-- fscache_stat(&fscache_n_retrievals_ok);
-+ fscache_stat_unchecked(&fscache_n_retrievals_ok);
-
- fscache_put_retrieval(op);
- _leave(" = %d", ret);
-@@ -453,7 +453,7 @@ nobufs_unlock:
- spin_unlock(&cookie->lock);
- kfree(op);
- nobufs:
-- fscache_stat(&fscache_n_retrievals_nobufs);
-+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
- _leave(" = -ENOBUFS");
- return -ENOBUFS;
- }
-@@ -491,7 +491,7 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
-
- _enter("%p,,%d,,,", cookie, *nr_pages);
-
-- fscache_stat(&fscache_n_retrievals);
-+ fscache_stat_unchecked(&fscache_n_retrievals);
-
- if (hlist_empty(&cookie->backing_objects))
- goto nobufs;
-@@ -522,7 +522,7 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
- goto nobufs_unlock;
- spin_unlock(&cookie->lock);
-
-- fscache_stat(&fscache_n_retrieval_ops);
-+ fscache_stat_unchecked(&fscache_n_retrieval_ops);
-
- /* pin the netfs read context in case we need to do the actual netfs
- * read because we've encountered a cache read failure */
-@@ -552,15 +552,15 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
-
- error:
- if (ret == -ENOMEM)
-- fscache_stat(&fscache_n_retrievals_nomem);
-+ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
- else if (ret == -ERESTARTSYS)
-- fscache_stat(&fscache_n_retrievals_intr);
-+ fscache_stat_unchecked(&fscache_n_retrievals_intr);
- else if (ret == -ENODATA)
-- fscache_stat(&fscache_n_retrievals_nodata);
-+ fscache_stat_unchecked(&fscache_n_retrievals_nodata);
- else if (ret < 0)
-- fscache_stat(&fscache_n_retrievals_nobufs);
-+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
- else
-- fscache_stat(&fscache_n_retrievals_ok);
-+ fscache_stat_unchecked(&fscache_n_retrievals_ok);
-
- fscache_put_retrieval(op);
- _leave(" = %d", ret);
-@@ -570,7 +570,7 @@ nobufs_unlock:
- spin_unlock(&cookie->lock);
- kfree(op);
- nobufs:
-- fscache_stat(&fscache_n_retrievals_nobufs);
-+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
- _leave(" = -ENOBUFS");
- return -ENOBUFS;
- }
-@@ -594,7 +594,7 @@ int __fscache_alloc_page(struct fscache_cookie *cookie,
-
- _enter("%p,%p,,,", cookie, page);
-
-- fscache_stat(&fscache_n_allocs);
-+ fscache_stat_unchecked(&fscache_n_allocs);
-
- if (hlist_empty(&cookie->backing_objects))
- goto nobufs;
-@@ -621,7 +621,7 @@ int __fscache_alloc_page(struct fscache_cookie *cookie,
- goto nobufs_unlock;
- spin_unlock(&cookie->lock);
-
-- fscache_stat(&fscache_n_alloc_ops);
-+ fscache_stat_unchecked(&fscache_n_alloc_ops);
-
- ret = fscache_wait_for_retrieval_activation(
- object, op,
-@@ -637,11 +637,11 @@ int __fscache_alloc_page(struct fscache_cookie *cookie,
-
- error:
- if (ret == -ERESTARTSYS)
-- fscache_stat(&fscache_n_allocs_intr);
-+ fscache_stat_unchecked(&fscache_n_allocs_intr);
- else if (ret < 0)
-- fscache_stat(&fscache_n_allocs_nobufs);
-+ fscache_stat_unchecked(&fscache_n_allocs_nobufs);
- else
-- fscache_stat(&fscache_n_allocs_ok);
-+ fscache_stat_unchecked(&fscache_n_allocs_ok);
-
- fscache_put_retrieval(op);
- _leave(" = %d", ret);
-@@ -651,7 +651,7 @@ nobufs_unlock:
- spin_unlock(&cookie->lock);
- kfree(op);
- nobufs:
-- fscache_stat(&fscache_n_allocs_nobufs);
-+ fscache_stat_unchecked(&fscache_n_allocs_nobufs);
- _leave(" = -ENOBUFS");
- return -ENOBUFS;
- }
-@@ -694,7 +694,7 @@ static void fscache_write_op(struct fscache_operation *_op)
-
- spin_lock(&cookie->stores_lock);
-
-- fscache_stat(&fscache_n_store_calls);
-+ fscache_stat_unchecked(&fscache_n_store_calls);
-
- /* find a page to store */
- page = NULL;
-@@ -705,7 +705,7 @@ static void fscache_write_op(struct fscache_operation *_op)
- page = results[0];
- _debug("gang %d [%lx]", n, page->index);
- if (page->index > op->store_limit) {
-- fscache_stat(&fscache_n_store_pages_over_limit);
-+ fscache_stat_unchecked(&fscache_n_store_pages_over_limit);
- goto superseded;
- }
-
-@@ -721,7 +721,7 @@ static void fscache_write_op(struct fscache_operation *_op)
-
- if (page) {
- fscache_set_op_state(&op->op, "Store");
-- fscache_stat(&fscache_n_store_pages);
-+ fscache_stat_unchecked(&fscache_n_store_pages);
- fscache_stat(&fscache_n_cop_write_page);
- ret = object->cache->ops->write_page(op, page);
- fscache_stat_d(&fscache_n_cop_write_page);
-@@ -792,7 +792,7 @@ int __fscache_write_page(struct fscache_cookie *cookie,
- ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
- ASSERT(PageFsCache(page));
-
-- fscache_stat(&fscache_n_stores);
-+ fscache_stat_unchecked(&fscache_n_stores);
-
- op = kzalloc(sizeof(*op), GFP_NOIO);
- if (!op)
-@@ -844,7 +844,7 @@ int __fscache_write_page(struct fscache_cookie *cookie,
- spin_unlock(&cookie->stores_lock);
- spin_unlock(&object->lock);
-
-- op->op.debug_id = atomic_inc_return(&fscache_op_debug_id);
-+ op->op.debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
- op->store_limit = object->store_limit;
-
- if (fscache_submit_op(object, &op->op) < 0)
-@@ -852,8 +852,8 @@ int __fscache_write_page(struct fscache_cookie *cookie,
-
- spin_unlock(&cookie->lock);
- radix_tree_preload_end();
-- fscache_stat(&fscache_n_store_ops);
-- fscache_stat(&fscache_n_stores_ok);
-+ fscache_stat_unchecked(&fscache_n_store_ops);
-+ fscache_stat_unchecked(&fscache_n_stores_ok);
-
- /* the slow work queue now carries its own ref on the object */
- fscache_put_operation(&op->op);
-@@ -861,14 +861,14 @@ int __fscache_write_page(struct fscache_cookie *cookie,
- return 0;
-
- already_queued:
-- fscache_stat(&fscache_n_stores_again);
-+ fscache_stat_unchecked(&fscache_n_stores_again);
- already_pending:
- spin_unlock(&cookie->stores_lock);
- spin_unlock(&object->lock);
- spin_unlock(&cookie->lock);
- radix_tree_preload_end();
- kfree(op);
-- fscache_stat(&fscache_n_stores_ok);
-+ fscache_stat_unchecked(&fscache_n_stores_ok);
- _leave(" = 0");
- return 0;
-
-@@ -886,14 +886,14 @@ nobufs:
- spin_unlock(&cookie->lock);
- radix_tree_preload_end();
- kfree(op);
-- fscache_stat(&fscache_n_stores_nobufs);
-+ fscache_stat_unchecked(&fscache_n_stores_nobufs);
- _leave(" = -ENOBUFS");
- return -ENOBUFS;
-
- nomem_free:
- kfree(op);
- nomem:
-- fscache_stat(&fscache_n_stores_oom);
-+ fscache_stat_unchecked(&fscache_n_stores_oom);
- _leave(" = -ENOMEM");
- return -ENOMEM;
- }
-@@ -911,7 +911,7 @@ void __fscache_uncache_page(struct fscache_cookie *cookie, struct page *page)
- ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
- ASSERTCMP(page, !=, NULL);
-
-- fscache_stat(&fscache_n_uncaches);
-+ fscache_stat_unchecked(&fscache_n_uncaches);
-
- /* cache withdrawal may beat us to it */
- if (!PageFsCache(page))
-@@ -964,7 +964,7 @@ void fscache_mark_pages_cached(struct fscache_retrieval *op,
- unsigned long loop;
-
- #ifdef CONFIG_FSCACHE_STATS
-- atomic_add(pagevec->nr, &fscache_n_marks);
-+ atomic_add_unchecked(pagevec->nr, &fscache_n_marks);
- #endif
-
- for (loop = 0; loop < pagevec->nr; loop++) {
-diff --git a/fs/fscache/stats.c b/fs/fscache/stats.c
-index 46435f3a..8cddf18 100644
---- a/fs/fscache/stats.c
-+++ b/fs/fscache/stats.c
-@@ -18,95 +18,95 @@
- /*
- * operation counters
- */
--atomic_t fscache_n_op_pend;
--atomic_t fscache_n_op_run;
--atomic_t fscache_n_op_enqueue;
--atomic_t fscache_n_op_requeue;
--atomic_t fscache_n_op_deferred_release;
--atomic_t fscache_n_op_release;
--atomic_t fscache_n_op_gc;
--atomic_t fscache_n_op_cancelled;
--atomic_t fscache_n_op_rejected;
-+atomic_unchecked_t fscache_n_op_pend;
-+atomic_unchecked_t fscache_n_op_run;
-+atomic_unchecked_t fscache_n_op_enqueue;
-+atomic_unchecked_t fscache_n_op_requeue;
-+atomic_unchecked_t fscache_n_op_deferred_release;
-+atomic_unchecked_t fscache_n_op_release;
-+atomic_unchecked_t fscache_n_op_gc;
-+atomic_unchecked_t fscache_n_op_cancelled;
-+atomic_unchecked_t fscache_n_op_rejected;
-
--atomic_t fscache_n_attr_changed;
--atomic_t fscache_n_attr_changed_ok;
--atomic_t fscache_n_attr_changed_nobufs;
--atomic_t fscache_n_attr_changed_nomem;
--atomic_t fscache_n_attr_changed_calls;
-+atomic_unchecked_t fscache_n_attr_changed;
-+atomic_unchecked_t fscache_n_attr_changed_ok;
-+atomic_unchecked_t fscache_n_attr_changed_nobufs;
-+atomic_unchecked_t fscache_n_attr_changed_nomem;
-+atomic_unchecked_t fscache_n_attr_changed_calls;
-
--atomic_t fscache_n_allocs;
--atomic_t fscache_n_allocs_ok;
--atomic_t fscache_n_allocs_wait;
--atomic_t fscache_n_allocs_nobufs;
--atomic_t fscache_n_allocs_intr;
--atomic_t fscache_n_allocs_object_dead;
--atomic_t fscache_n_alloc_ops;
--atomic_t fscache_n_alloc_op_waits;
-+atomic_unchecked_t fscache_n_allocs;
-+atomic_unchecked_t fscache_n_allocs_ok;
-+atomic_unchecked_t fscache_n_allocs_wait;
-+atomic_unchecked_t fscache_n_allocs_nobufs;
-+atomic_unchecked_t fscache_n_allocs_intr;
-+atomic_unchecked_t fscache_n_allocs_object_dead;
-+atomic_unchecked_t fscache_n_alloc_ops;
-+atomic_unchecked_t fscache_n_alloc_op_waits;
-
--atomic_t fscache_n_retrievals;
--atomic_t fscache_n_retrievals_ok;
--atomic_t fscache_n_retrievals_wait;
--atomic_t fscache_n_retrievals_nodata;
--atomic_t fscache_n_retrievals_nobufs;
--atomic_t fscache_n_retrievals_intr;
--atomic_t fscache_n_retrievals_nomem;
--atomic_t fscache_n_retrievals_object_dead;
--atomic_t fscache_n_retrieval_ops;
--atomic_t fscache_n_retrieval_op_waits;
-+atomic_unchecked_t fscache_n_retrievals;
-+atomic_unchecked_t fscache_n_retrievals_ok;
-+atomic_unchecked_t fscache_n_retrievals_wait;
-+atomic_unchecked_t fscache_n_retrievals_nodata;
-+atomic_unchecked_t fscache_n_retrievals_nobufs;
-+atomic_unchecked_t fscache_n_retrievals_intr;
-+atomic_unchecked_t fscache_n_retrievals_nomem;
-+atomic_unchecked_t fscache_n_retrievals_object_dead;
-+atomic_unchecked_t fscache_n_retrieval_ops;
-+atomic_unchecked_t fscache_n_retrieval_op_waits;
-
--atomic_t fscache_n_stores;
--atomic_t fscache_n_stores_ok;
--atomic_t fscache_n_stores_again;
--atomic_t fscache_n_stores_nobufs;
--atomic_t fscache_n_stores_oom;
--atomic_t fscache_n_store_ops;
--atomic_t fscache_n_store_calls;
--atomic_t fscache_n_store_pages;
--atomic_t fscache_n_store_radix_deletes;
--atomic_t fscache_n_store_pages_over_limit;
-+atomic_unchecked_t fscache_n_stores;
-+atomic_unchecked_t fscache_n_stores_ok;
-+atomic_unchecked_t fscache_n_stores_again;
-+atomic_unchecked_t fscache_n_stores_nobufs;
-+atomic_unchecked_t fscache_n_stores_oom;
-+atomic_unchecked_t fscache_n_store_ops;
-+atomic_unchecked_t fscache_n_store_calls;
-+atomic_unchecked_t fscache_n_store_pages;
-+atomic_unchecked_t fscache_n_store_radix_deletes;
-+atomic_unchecked_t fscache_n_store_pages_over_limit;
-
--atomic_t fscache_n_store_vmscan_not_storing;
--atomic_t fscache_n_store_vmscan_gone;
--atomic_t fscache_n_store_vmscan_busy;
--atomic_t fscache_n_store_vmscan_cancelled;
-+atomic_unchecked_t fscache_n_store_vmscan_not_storing;
-+atomic_unchecked_t fscache_n_store_vmscan_gone;
-+atomic_unchecked_t fscache_n_store_vmscan_busy;
-+atomic_unchecked_t fscache_n_store_vmscan_cancelled;
-
--atomic_t fscache_n_marks;
--atomic_t fscache_n_uncaches;
-+atomic_unchecked_t fscache_n_marks;
-+atomic_unchecked_t fscache_n_uncaches;
-
--atomic_t fscache_n_acquires;
--atomic_t fscache_n_acquires_null;
--atomic_t fscache_n_acquires_no_cache;
--atomic_t fscache_n_acquires_ok;
--atomic_t fscache_n_acquires_nobufs;
--atomic_t fscache_n_acquires_oom;
-+atomic_unchecked_t fscache_n_acquires;
-+atomic_unchecked_t fscache_n_acquires_null;
-+atomic_unchecked_t fscache_n_acquires_no_cache;
-+atomic_unchecked_t fscache_n_acquires_ok;
-+atomic_unchecked_t fscache_n_acquires_nobufs;
-+atomic_unchecked_t fscache_n_acquires_oom;
-
--atomic_t fscache_n_updates;
--atomic_t fscache_n_updates_null;
--atomic_t fscache_n_updates_run;
-+atomic_unchecked_t fscache_n_updates;
-+atomic_unchecked_t fscache_n_updates_null;
-+atomic_unchecked_t fscache_n_updates_run;
-
--atomic_t fscache_n_relinquishes;
--atomic_t fscache_n_relinquishes_null;
--atomic_t fscache_n_relinquishes_waitcrt;
--atomic_t fscache_n_relinquishes_retire;
-+atomic_unchecked_t fscache_n_relinquishes;
-+atomic_unchecked_t fscache_n_relinquishes_null;
-+atomic_unchecked_t fscache_n_relinquishes_waitcrt;
-+atomic_unchecked_t fscache_n_relinquishes_retire;
-
--atomic_t fscache_n_cookie_index;
--atomic_t fscache_n_cookie_data;
--atomic_t fscache_n_cookie_special;
-+atomic_unchecked_t fscache_n_cookie_index;
-+atomic_unchecked_t fscache_n_cookie_data;
-+atomic_unchecked_t fscache_n_cookie_special;
-
--atomic_t fscache_n_object_alloc;
--atomic_t fscache_n_object_no_alloc;
--atomic_t fscache_n_object_lookups;
--atomic_t fscache_n_object_lookups_negative;
--atomic_t fscache_n_object_lookups_positive;
--atomic_t fscache_n_object_lookups_timed_out;
--atomic_t fscache_n_object_created;
--atomic_t fscache_n_object_avail;
--atomic_t fscache_n_object_dead;
-+atomic_unchecked_t fscache_n_object_alloc;
-+atomic_unchecked_t fscache_n_object_no_alloc;
-+atomic_unchecked_t fscache_n_object_lookups;
-+atomic_unchecked_t fscache_n_object_lookups_negative;
-+atomic_unchecked_t fscache_n_object_lookups_positive;
-+atomic_unchecked_t fscache_n_object_lookups_timed_out;
-+atomic_unchecked_t fscache_n_object_created;
-+atomic_unchecked_t fscache_n_object_avail;
-+atomic_unchecked_t fscache_n_object_dead;
-
--atomic_t fscache_n_checkaux_none;
--atomic_t fscache_n_checkaux_okay;
--atomic_t fscache_n_checkaux_update;
--atomic_t fscache_n_checkaux_obsolete;
-+atomic_unchecked_t fscache_n_checkaux_none;
-+atomic_unchecked_t fscache_n_checkaux_okay;
-+atomic_unchecked_t fscache_n_checkaux_update;
-+atomic_unchecked_t fscache_n_checkaux_obsolete;
-
- atomic_t fscache_n_cop_alloc_object;
- atomic_t fscache_n_cop_lookup_object;
-@@ -133,113 +133,113 @@ static int fscache_stats_show(struct seq_file *m, void *v)
- seq_puts(m, "FS-Cache statistics\n");
-
- seq_printf(m, "Cookies: idx=%u dat=%u spc=%u\n",
-- atomic_read(&fscache_n_cookie_index),
-- atomic_read(&fscache_n_cookie_data),
-- atomic_read(&fscache_n_cookie_special));
-+ atomic_read_unchecked(&fscache_n_cookie_index),
-+ atomic_read_unchecked(&fscache_n_cookie_data),
-+ atomic_read_unchecked(&fscache_n_cookie_special));
-
- seq_printf(m, "Objects: alc=%u nal=%u avl=%u ded=%u\n",
-- atomic_read(&fscache_n_object_alloc),
-- atomic_read(&fscache_n_object_no_alloc),
-- atomic_read(&fscache_n_object_avail),
-- atomic_read(&fscache_n_object_dead));
-+ atomic_read_unchecked(&fscache_n_object_alloc),
-+ atomic_read_unchecked(&fscache_n_object_no_alloc),
-+ atomic_read_unchecked(&fscache_n_object_avail),
-+ atomic_read_unchecked(&fscache_n_object_dead));
- seq_printf(m, "ChkAux : non=%u ok=%u upd=%u obs=%u\n",
-- atomic_read(&fscache_n_checkaux_none),
-- atomic_read(&fscache_n_checkaux_okay),
-- atomic_read(&fscache_n_checkaux_update),
-- atomic_read(&fscache_n_checkaux_obsolete));
-+ atomic_read_unchecked(&fscache_n_checkaux_none),
-+ atomic_read_unchecked(&fscache_n_checkaux_okay),
-+ atomic_read_unchecked(&fscache_n_checkaux_update),
-+ atomic_read_unchecked(&fscache_n_checkaux_obsolete));
-
- seq_printf(m, "Pages : mrk=%u unc=%u\n",
-- atomic_read(&fscache_n_marks),
-- atomic_read(&fscache_n_uncaches));
-+ atomic_read_unchecked(&fscache_n_marks),
-+ atomic_read_unchecked(&fscache_n_uncaches));
-
- seq_printf(m, "Acquire: n=%u nul=%u noc=%u ok=%u nbf=%u"
- " oom=%u\n",
-- atomic_read(&fscache_n_acquires),
-- atomic_read(&fscache_n_acquires_null),
-- atomic_read(&fscache_n_acquires_no_cache),
-- atomic_read(&fscache_n_acquires_ok),
-- atomic_read(&fscache_n_acquires_nobufs),
-- atomic_read(&fscache_n_acquires_oom));
-+ atomic_read_unchecked(&fscache_n_acquires),
-+ atomic_read_unchecked(&fscache_n_acquires_null),
-+ atomic_read_unchecked(&fscache_n_acquires_no_cache),
-+ atomic_read_unchecked(&fscache_n_acquires_ok),
-+ atomic_read_unchecked(&fscache_n_acquires_nobufs),
-+ atomic_read_unchecked(&fscache_n_acquires_oom));
-
- seq_printf(m, "Lookups: n=%u neg=%u pos=%u crt=%u tmo=%u\n",
-- atomic_read(&fscache_n_object_lookups),
-- atomic_read(&fscache_n_object_lookups_negative),
-- atomic_read(&fscache_n_object_lookups_positive),
-- atomic_read(&fscache_n_object_lookups_timed_out),
-- atomic_read(&fscache_n_object_created));
-+ atomic_read_unchecked(&fscache_n_object_lookups),
-+ atomic_read_unchecked(&fscache_n_object_lookups_negative),
-+ atomic_read_unchecked(&fscache_n_object_lookups_positive),
-+ atomic_read_unchecked(&fscache_n_object_lookups_timed_out),
-+ atomic_read_unchecked(&fscache_n_object_created));
-
- seq_printf(m, "Updates: n=%u nul=%u run=%u\n",
-- atomic_read(&fscache_n_updates),
-- atomic_read(&fscache_n_updates_null),
-- atomic_read(&fscache_n_updates_run));
-+ atomic_read_unchecked(&fscache_n_updates),
-+ atomic_read_unchecked(&fscache_n_updates_null),
-+ atomic_read_unchecked(&fscache_n_updates_run));
-
- seq_printf(m, "Relinqs: n=%u nul=%u wcr=%u rtr=%u\n",
-- atomic_read(&fscache_n_relinquishes),
-- atomic_read(&fscache_n_relinquishes_null),
-- atomic_read(&fscache_n_relinquishes_waitcrt),
-- atomic_read(&fscache_n_relinquishes_retire));
-+ atomic_read_unchecked(&fscache_n_relinquishes),
-+ atomic_read_unchecked(&fscache_n_relinquishes_null),
-+ atomic_read_unchecked(&fscache_n_relinquishes_waitcrt),
-+ atomic_read_unchecked(&fscache_n_relinquishes_retire));
-
- seq_printf(m, "AttrChg: n=%u ok=%u nbf=%u oom=%u run=%u\n",
-- atomic_read(&fscache_n_attr_changed),
-- atomic_read(&fscache_n_attr_changed_ok),
-- atomic_read(&fscache_n_attr_changed_nobufs),
-- atomic_read(&fscache_n_attr_changed_nomem),
-- atomic_read(&fscache_n_attr_changed_calls));
-+ atomic_read_unchecked(&fscache_n_attr_changed),
-+ atomic_read_unchecked(&fscache_n_attr_changed_ok),
-+ atomic_read_unchecked(&fscache_n_attr_changed_nobufs),
-+ atomic_read_unchecked(&fscache_n_attr_changed_nomem),
-+ atomic_read_unchecked(&fscache_n_attr_changed_calls));
-
- seq_printf(m, "Allocs : n=%u ok=%u wt=%u nbf=%u int=%u\n",
-- atomic_read(&fscache_n_allocs),
-- atomic_read(&fscache_n_allocs_ok),
-- atomic_read(&fscache_n_allocs_wait),
-- atomic_read(&fscache_n_allocs_nobufs),
-- atomic_read(&fscache_n_allocs_intr));
-+ atomic_read_unchecked(&fscache_n_allocs),
-+ atomic_read_unchecked(&fscache_n_allocs_ok),
-+ atomic_read_unchecked(&fscache_n_allocs_wait),
-+ atomic_read_unchecked(&fscache_n_allocs_nobufs),
-+ atomic_read_unchecked(&fscache_n_allocs_intr));
- seq_printf(m, "Allocs : ops=%u owt=%u abt=%u\n",
-- atomic_read(&fscache_n_alloc_ops),
-- atomic_read(&fscache_n_alloc_op_waits),
-- atomic_read(&fscache_n_allocs_object_dead));
-+ atomic_read_unchecked(&fscache_n_alloc_ops),
-+ atomic_read_unchecked(&fscache_n_alloc_op_waits),
-+ atomic_read_unchecked(&fscache_n_allocs_object_dead));
-
- seq_printf(m, "Retrvls: n=%u ok=%u wt=%u nod=%u nbf=%u"
- " int=%u oom=%u\n",
-- atomic_read(&fscache_n_retrievals),
-- atomic_read(&fscache_n_retrievals_ok),
-- atomic_read(&fscache_n_retrievals_wait),
-- atomic_read(&fscache_n_retrievals_nodata),
-- atomic_read(&fscache_n_retrievals_nobufs),
-- atomic_read(&fscache_n_retrievals_intr),
-- atomic_read(&fscache_n_retrievals_nomem));
-+ atomic_read_unchecked(&fscache_n_retrievals),
-+ atomic_read_unchecked(&fscache_n_retrievals_ok),
-+ atomic_read_unchecked(&fscache_n_retrievals_wait),
-+ atomic_read_unchecked(&fscache_n_retrievals_nodata),
-+ atomic_read_unchecked(&fscache_n_retrievals_nobufs),
-+ atomic_read_unchecked(&fscache_n_retrievals_intr),
-+ atomic_read_unchecked(&fscache_n_retrievals_nomem));
- seq_printf(m, "Retrvls: ops=%u owt=%u abt=%u\n",
-- atomic_read(&fscache_n_retrieval_ops),
-- atomic_read(&fscache_n_retrieval_op_waits),
-- atomic_read(&fscache_n_retrievals_object_dead));
-+ atomic_read_unchecked(&fscache_n_retrieval_ops),
-+ atomic_read_unchecked(&fscache_n_retrieval_op_waits),
-+ atomic_read_unchecked(&fscache_n_retrievals_object_dead));
-
- seq_printf(m, "Stores : n=%u ok=%u agn=%u nbf=%u oom=%u\n",
-- atomic_read(&fscache_n_stores),
-- atomic_read(&fscache_n_stores_ok),
-- atomic_read(&fscache_n_stores_again),
-- atomic_read(&fscache_n_stores_nobufs),
-- atomic_read(&fscache_n_stores_oom));
-+ atomic_read_unchecked(&fscache_n_stores),
-+ atomic_read_unchecked(&fscache_n_stores_ok),
-+ atomic_read_unchecked(&fscache_n_stores_again),
-+ atomic_read_unchecked(&fscache_n_stores_nobufs),
-+ atomic_read_unchecked(&fscache_n_stores_oom));
- seq_printf(m, "Stores : ops=%u run=%u pgs=%u rxd=%u olm=%u\n",
-- atomic_read(&fscache_n_store_ops),
-- atomic_read(&fscache_n_store_calls),
-- atomic_read(&fscache_n_store_pages),
-- atomic_read(&fscache_n_store_radix_deletes),
-- atomic_read(&fscache_n_store_pages_over_limit));
-+ atomic_read_unchecked(&fscache_n_store_ops),
-+ atomic_read_unchecked(&fscache_n_store_calls),
-+ atomic_read_unchecked(&fscache_n_store_pages),
-+ atomic_read_unchecked(&fscache_n_store_radix_deletes),
-+ atomic_read_unchecked(&fscache_n_store_pages_over_limit));
-
- seq_printf(m, "VmScan : nos=%u gon=%u bsy=%u can=%u\n",
-- atomic_read(&fscache_n_store_vmscan_not_storing),
-- atomic_read(&fscache_n_store_vmscan_gone),
-- atomic_read(&fscache_n_store_vmscan_busy),
-- atomic_read(&fscache_n_store_vmscan_cancelled));
-+ atomic_read_unchecked(&fscache_n_store_vmscan_not_storing),
-+ atomic_read_unchecked(&fscache_n_store_vmscan_gone),
-+ atomic_read_unchecked(&fscache_n_store_vmscan_busy),
-+ atomic_read_unchecked(&fscache_n_store_vmscan_cancelled));
-
- seq_printf(m, "Ops : pend=%u run=%u enq=%u can=%u rej=%u\n",
-- atomic_read(&fscache_n_op_pend),
-- atomic_read(&fscache_n_op_run),
-- atomic_read(&fscache_n_op_enqueue),
-- atomic_read(&fscache_n_op_cancelled),
-- atomic_read(&fscache_n_op_rejected));
-+ atomic_read_unchecked(&fscache_n_op_pend),
-+ atomic_read_unchecked(&fscache_n_op_run),
-+ atomic_read_unchecked(&fscache_n_op_enqueue),
-+ atomic_read_unchecked(&fscache_n_op_cancelled),
-+ atomic_read_unchecked(&fscache_n_op_rejected));
- seq_printf(m, "Ops : dfr=%u rel=%u gc=%u\n",
-- atomic_read(&fscache_n_op_deferred_release),
-- atomic_read(&fscache_n_op_release),
-- atomic_read(&fscache_n_op_gc));
-+ atomic_read_unchecked(&fscache_n_op_deferred_release),
-+ atomic_read_unchecked(&fscache_n_op_release),
-+ atomic_read_unchecked(&fscache_n_op_gc));
-
- seq_printf(m, "CacheOp: alo=%d luo=%d luc=%d gro=%d\n",
- atomic_read(&fscache_n_cop_alloc_object),
-diff --git a/fs/fuse/cuse.c b/fs/fuse/cuse.c
-index de792dc..448b532 100644
---- a/fs/fuse/cuse.c
-+++ b/fs/fuse/cuse.c
-@@ -576,10 +576,12 @@ static int __init cuse_init(void)
- INIT_LIST_HEAD(&cuse_conntbl[i]);
-
- /* inherit and extend fuse_dev_operations */
-- cuse_channel_fops = fuse_dev_operations;
-- cuse_channel_fops.owner = THIS_MODULE;
-- cuse_channel_fops.open = cuse_channel_open;
-- cuse_channel_fops.release = cuse_channel_release;
-+ pax_open_kernel();
-+ memcpy((void *)&cuse_channel_fops, &fuse_dev_operations, sizeof(fuse_dev_operations));
-+ *(void **)&cuse_channel_fops.owner = THIS_MODULE;
-+ *(void **)&cuse_channel_fops.open = cuse_channel_open;
-+ *(void **)&cuse_channel_fops.release = cuse_channel_release;
-+ pax_close_kernel();
-
- cuse_class = class_create(THIS_MODULE, "cuse");
- if (IS_ERR(cuse_class))
-diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
-index 1facb395..7f48557 100644
---- a/fs/fuse/dev.c
-+++ b/fs/fuse/dev.c
-@@ -885,7 +885,7 @@ static int fuse_notify_inval_entry(struct fuse_conn *fc, unsigned int size,
- {
- struct fuse_notify_inval_entry_out outarg;
- int err = -EINVAL;
-- char buf[FUSE_NAME_MAX+1];
-+ char *buf = NULL;
- struct qstr name;
-
- if (size < sizeof(outarg))
-@@ -899,6 +899,11 @@ static int fuse_notify_inval_entry(struct fuse_conn *fc, unsigned int size,
- if (outarg.namelen > FUSE_NAME_MAX)
- goto err;
-
-+ err = -ENOMEM;
-+ buf = kmalloc(FUSE_NAME_MAX+1, GFP_KERNEL);
-+ if (!buf)
-+ goto err;
-+
- err = -EINVAL;
- if (size != sizeof(outarg) + outarg.namelen + 1)
- goto err;
-@@ -914,17 +919,15 @@ static int fuse_notify_inval_entry(struct fuse_conn *fc, unsigned int size,
-
- down_read(&fc->killsb);
- err = -ENOENT;
-- if (!fc->sb)
-- goto err_unlock;
--
-- err = fuse_reverse_inval_entry(fc->sb, outarg.parent, &name);
--
--err_unlock:
-+ if (fc->sb)
-+ err = fuse_reverse_inval_entry(fc->sb, outarg.parent, &name);
- up_read(&fc->killsb);
-+ kfree(buf);
- return err;
-
- err:
- fuse_copy_finish(cs);
-+ kfree(buf);
- return err;
- }
-
-diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
-index b359543..d212be4 100644
---- a/fs/fuse/dir.c
-+++ b/fs/fuse/dir.c
-@@ -1128,7 +1128,7 @@ static char *read_link(struct dentry *dentry)
- return link;
- }
-
--static void free_link(char *link)
-+static void free_link(const char *link)
- {
- if (!IS_ERR(link))
- free_page((unsigned long) link);
-diff --git a/fs/gfs2/ops_inode.c b/fs/gfs2/ops_inode.c
-index 247436c..e650ccb 100644
---- a/fs/gfs2/ops_inode.c
-+++ b/fs/gfs2/ops_inode.c
-@@ -752,6 +752,8 @@ static int gfs2_rename(struct inode *odir, struct dentry *odentry,
- unsigned int x;
- int error;
-
-+ pax_track_stack();
-+
- if (ndentry->d_inode) {
- nip = GFS2_I(ndentry->d_inode);
- if (ip == nip)
-diff --git a/fs/gfs2/sys.c b/fs/gfs2/sys.c
-index 4463297..4fed53b 100644
---- a/fs/gfs2/sys.c
-+++ b/fs/gfs2/sys.c
-@@ -49,7 +49,7 @@ static ssize_t gfs2_attr_store(struct kobject *kobj, struct attribute *attr,
- return a->store ? a->store(sdp, buf, len) : len;
- }
-
--static struct sysfs_ops gfs2_attr_ops = {
-+static const struct sysfs_ops gfs2_attr_ops = {
- .show = gfs2_attr_show,
- .store = gfs2_attr_store,
- };
-@@ -584,7 +584,7 @@ static int gfs2_uevent(struct kset *kset, struct kobject *kobj,
- return 0;
- }
-
--static struct kset_uevent_ops gfs2_uevent_ops = {
-+static const struct kset_uevent_ops gfs2_uevent_ops = {
- .uevent = gfs2_uevent,
- };
-
-diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c
-index a0786c6..46904bd 100644
---- a/fs/hfsplus/catalog.c
-+++ b/fs/hfsplus/catalog.c
-@@ -157,6 +157,8 @@ int hfsplus_find_cat(struct super_block *sb, u32 cnid,
- int err;
- u16 type;
-
-+ pax_track_stack();
-+
- hfsplus_cat_build_key(sb, fd->search_key, cnid, NULL);
- err = hfs_brec_read(fd, &tmp, sizeof(hfsplus_cat_entry));
- if (err)
-@@ -186,6 +188,8 @@ int hfsplus_create_cat(u32 cnid, struct inode *dir, struct qstr *str, struct ino
- int entry_size;
- int err;
-
-+ pax_track_stack();
-+
- dprint(DBG_CAT_MOD, "create_cat: %s,%u(%d)\n", str->name, cnid, inode->i_nlink);
- sb = dir->i_sb;
- hfs_find_init(HFSPLUS_SB(sb).cat_tree, &fd);
-@@ -318,6 +322,8 @@ int hfsplus_rename_cat(u32 cnid,
- int entry_size, type;
- int err = 0;
-
-+ pax_track_stack();
-+
- dprint(DBG_CAT_MOD, "rename_cat: %u - %lu,%s - %lu,%s\n", cnid, src_dir->i_ino, src_name->name,
- dst_dir->i_ino, dst_name->name);
- sb = src_dir->i_sb;
-diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c
-index f4300ff7..6ec38b2 100644
---- a/fs/hfsplus/dir.c
-+++ b/fs/hfsplus/dir.c
-@@ -121,6 +121,8 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir)
- struct hfsplus_readdir_data *rd;
- u16 type;
-
-+ pax_track_stack();
-+
- if (filp->f_pos >= inode->i_size)
- return 0;
-
-diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c
-index 1bcf597..905a251 100644
---- a/fs/hfsplus/inode.c
-+++ b/fs/hfsplus/inode.c
-@@ -399,6 +399,8 @@ int hfsplus_cat_read_inode(struct inode *inode, struct hfs_find_data *fd)
- int res = 0;
- u16 type;
-
-+ pax_track_stack();
-+
- type = hfs_bnode_read_u16(fd->bnode, fd->entryoffset);
-
- HFSPLUS_I(inode).dev = 0;
-@@ -461,6 +463,8 @@ int hfsplus_cat_write_inode(struct inode *inode)
- struct hfs_find_data fd;
- hfsplus_cat_entry entry;
-
-+ pax_track_stack();
-+
- if (HFSPLUS_IS_RSRC(inode))
- main_inode = HFSPLUS_I(inode).rsrc_inode;
-
-diff --git a/fs/hfsplus/ioctl.c b/fs/hfsplus/ioctl.c
-index f457d2c..7ef4ad5 100644
---- a/fs/hfsplus/ioctl.c
-+++ b/fs/hfsplus/ioctl.c
-@@ -101,6 +101,8 @@ int hfsplus_setxattr(struct dentry *dentry, const char *name,
- struct hfsplus_cat_file *file;
- int res;
-
-+ pax_track_stack();
-+
- if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
- return -EOPNOTSUPP;
-
-@@ -143,6 +145,8 @@ ssize_t hfsplus_getxattr(struct dentry *dentry, const char *name,
- struct hfsplus_cat_file *file;
- ssize_t res = 0;
-
-+ pax_track_stack();
-+
- if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
- return -EOPNOTSUPP;
-
-diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
-index 43022f3..7298079 100644
---- a/fs/hfsplus/super.c
-+++ b/fs/hfsplus/super.c
-@@ -312,6 +312,8 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
- struct nls_table *nls = NULL;
- int err = -EINVAL;
-
-+ pax_track_stack();
-+
- sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
- if (!sbi)
- return -ENOMEM;
-diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
-index 2179de8..80c3284 100644
---- a/fs/hugetlbfs/inode.c
-+++ b/fs/hugetlbfs/inode.c
-@@ -897,7 +897,7 @@ static struct file_system_type hugetlbfs_fs_type = {
- .kill_sb = kill_litter_super,
- };
-
--static struct vfsmount *hugetlbfs_vfsmount;
-+struct vfsmount *hugetlbfs_vfsmount;
-
- static int can_do_hugetlb_shm(void)
- {
-diff --git a/fs/ioctl.c b/fs/ioctl.c
-index 6c75110..19d2c3c 100644
---- a/fs/ioctl.c
-+++ b/fs/ioctl.c
-@@ -97,7 +97,7 @@ int fiemap_fill_next_extent(struct fiemap_extent_info *fieinfo, u64 logical,
- u64 phys, u64 len, u32 flags)
- {
- struct fiemap_extent extent;
-- struct fiemap_extent *dest = fieinfo->fi_extents_start;
-+ struct fiemap_extent __user *dest = fieinfo->fi_extents_start;
-
- /* only count the extents */
- if (fieinfo->fi_extents_max == 0) {
-@@ -207,7 +207,7 @@ static int ioctl_fiemap(struct file *filp, unsigned long arg)
-
- fieinfo.fi_flags = fiemap.fm_flags;
- fieinfo.fi_extents_max = fiemap.fm_extent_count;
-- fieinfo.fi_extents_start = (struct fiemap_extent *)(arg + sizeof(fiemap));
-+ fieinfo.fi_extents_start = (struct fiemap_extent __user *)(arg + sizeof(fiemap));
-
- if (fiemap.fm_extent_count != 0 &&
- !access_ok(VERIFY_WRITE, fieinfo.fi_extents_start,
-@@ -220,7 +220,7 @@ static int ioctl_fiemap(struct file *filp, unsigned long arg)
- error = inode->i_op->fiemap(inode, &fieinfo, fiemap.fm_start, len);
- fiemap.fm_flags = fieinfo.fi_flags;
- fiemap.fm_mapped_extents = fieinfo.fi_extents_mapped;
-- if (copy_to_user((char *)arg, &fiemap, sizeof(fiemap)))
-+ if (copy_to_user((__force char __user *)arg, &fiemap, sizeof(fiemap)))
- error = -EFAULT;
-
- return error;
-diff --git a/fs/isofs/export.c b/fs/isofs/export.c
-index e81a305..caec670 100644
---- a/fs/isofs/export.c
-+++ b/fs/isofs/export.c
-@@ -131,6 +131,7 @@ isofs_export_encode_fh(struct dentry *dentry,
- len = 3;
- fh32[0] = ei->i_iget5_block;
- fh16[2] = (__u16)ei->i_iget5_offset; /* fh16 [sic] */
-+ fh16[3] = 0; /* avoid leaking uninitialized data */
- fh32[2] = inode->i_generation;
- if (connectable && !S_ISDIR(inode->i_mode)) {
- struct inode *parent;
-diff --git a/fs/jbd/checkpoint.c b/fs/jbd/checkpoint.c
-index b0435dd..81ee0be 100644
---- a/fs/jbd/checkpoint.c
-+++ b/fs/jbd/checkpoint.c
-@@ -348,6 +348,8 @@ int log_do_checkpoint(journal_t *journal)
- tid_t this_tid;
- int result;
-
-+ pax_track_stack();
-+
- jbd_debug(1, "Start checkpoint\n");
-
- /*
-diff --git a/fs/jffs2/compr_rtime.c b/fs/jffs2/compr_rtime.c
-index 546d153..736896c 100644
---- a/fs/jffs2/compr_rtime.c
-+++ b/fs/jffs2/compr_rtime.c
-@@ -37,6 +37,8 @@ static int jffs2_rtime_compress(unsigned char *data_in,
- int outpos = 0;
- int pos=0;
-
-+ pax_track_stack();
-+
- memset(positions,0,sizeof(positions));
-
- while (pos < (*sourcelen) && outpos <= (*dstlen)-2) {
-@@ -79,6 +81,8 @@ static int jffs2_rtime_decompress(unsigned char *data_in,
- int outpos = 0;
- int pos=0;
-
-+ pax_track_stack();
-+
- memset(positions,0,sizeof(positions));
-
- while (outpos<destlen) {
-diff --git a/fs/jffs2/compr_rubin.c b/fs/jffs2/compr_rubin.c
-index 170d289..3254b98 100644
---- a/fs/jffs2/compr_rubin.c
-+++ b/fs/jffs2/compr_rubin.c
-@@ -314,6 +314,8 @@ static int jffs2_dynrubin_compress(unsigned char *data_in,
- int ret;
- uint32_t mysrclen, mydstlen;
-
-+ pax_track_stack();
-+
- mysrclen = *sourcelen;
- mydstlen = *dstlen - 8;
-
-diff --git a/fs/jffs2/erase.c b/fs/jffs2/erase.c
-index b47679b..00d65d36 100644
---- a/fs/jffs2/erase.c
-+++ b/fs/jffs2/erase.c
-@@ -434,7 +434,8 @@ static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseb
- struct jffs2_unknown_node marker = {
- .magic = cpu_to_je16(JFFS2_MAGIC_BITMASK),
- .nodetype = cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
-- .totlen = cpu_to_je32(c->cleanmarker_size)
-+ .totlen = cpu_to_je32(c->cleanmarker_size),
-+ .hdr_crc = cpu_to_je32(0)
- };
-
- jffs2_prealloc_raw_node_refs(c, jeb, 1);
-diff --git a/fs/jffs2/wbuf.c b/fs/jffs2/wbuf.c
-index 5ef7bac..4fd1e3c 100644
---- a/fs/jffs2/wbuf.c
-+++ b/fs/jffs2/wbuf.c
-@@ -1012,7 +1012,8 @@ static const struct jffs2_unknown_node oob_cleanmarker =
- {
- .magic = constant_cpu_to_je16(JFFS2_MAGIC_BITMASK),
- .nodetype = constant_cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
-- .totlen = constant_cpu_to_je32(8)
-+ .totlen = constant_cpu_to_je32(8),
-+ .hdr_crc = constant_cpu_to_je32(0)
- };
-
- /*
-diff --git a/fs/jffs2/xattr.c b/fs/jffs2/xattr.c
-index 082e844..52012a1 100644
---- a/fs/jffs2/xattr.c
-+++ b/fs/jffs2/xattr.c
-@@ -773,6 +773,8 @@ void jffs2_build_xattr_subsystem(struct jffs2_sb_info *c)
-
- BUG_ON(!(c->flags & JFFS2_SB_FLAG_BUILDING));
-
-+ pax_track_stack();
-+
- /* Phase.1 : Merge same xref */
- for (i=0; i < XREF_TMPHASH_SIZE; i++)
- xref_tmphash[i] = NULL;
-diff --git a/fs/jfs/super.c b/fs/jfs/super.c
-index 2234c73..f6e6e6b 100644
---- a/fs/jfs/super.c
-+++ b/fs/jfs/super.c
-@@ -793,7 +793,7 @@ static int __init init_jfs_fs(void)
-
- jfs_inode_cachep =
- kmem_cache_create("jfs_ip", sizeof(struct jfs_inode_info), 0,
-- SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD,
-+ SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|SLAB_USERCOPY,
- init_once);
- if (jfs_inode_cachep == NULL)
- return -ENOMEM;
-diff --git a/fs/libfs.c b/fs/libfs.c
-index ba36e93..3153fce 100644
---- a/fs/libfs.c
-+++ b/fs/libfs.c
-@@ -157,12 +157,20 @@ int dcache_readdir(struct file * filp, void * dirent, filldir_t filldir)
-
- for (p=q->next; p != &dentry->d_subdirs; p=p->next) {
- struct dentry *next;
-+ char d_name[sizeof(next->d_iname)];
-+ const unsigned char *name;
-+
- next = list_entry(p, struct dentry, d_u.d_child);
- if (d_unhashed(next) || !next->d_inode)
- continue;
-
- spin_unlock(&dcache_lock);
-- if (filldir(dirent, next->d_name.name,
-+ name = next->d_name.name;
-+ if (name == next->d_iname) {
-+ memcpy(d_name, name, next->d_name.len);
-+ name = d_name;
-+ }
-+ if (filldir(dirent, name,
- next->d_name.len, filp->f_pos,
- next->d_inode->i_ino,
- dt_type(next->d_inode)) < 0)
-diff --git a/fs/lockd/clntproc.c b/fs/lockd/clntproc.c
-index c325a83..d15b07b 100644
---- a/fs/lockd/clntproc.c
-+++ b/fs/lockd/clntproc.c
-@@ -36,11 +36,11 @@ static const struct rpc_call_ops nlmclnt_cancel_ops;
- /*
- * Cookie counter for NLM requests
- */
--static atomic_t nlm_cookie = ATOMIC_INIT(0x1234);
-+static atomic_unchecked_t nlm_cookie = ATOMIC_INIT(0x1234);
-
- void nlmclnt_next_cookie(struct nlm_cookie *c)
- {
-- u32 cookie = atomic_inc_return(&nlm_cookie);
-+ u32 cookie = atomic_inc_return_unchecked(&nlm_cookie);
-
- memcpy(c->data, &cookie, 4);
- c->len=4;
-@@ -621,6 +621,8 @@ nlmclnt_reclaim(struct nlm_host *host, struct file_lock *fl)
- struct nlm_rqst reqst, *req;
- int status;
-
-+ pax_track_stack();
-+
- req = &reqst;
- memset(req, 0, sizeof(*req));
- locks_init_lock(&req->a_args.lock.fl);
-diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c
-index 1a54ae1..6a16c27 100644
---- a/fs/lockd/svc.c
-+++ b/fs/lockd/svc.c
-@@ -43,7 +43,7 @@
-
- static struct svc_program nlmsvc_program;
-
--struct nlmsvc_binding * nlmsvc_ops;
-+const struct nlmsvc_binding * nlmsvc_ops;
- EXPORT_SYMBOL_GPL(nlmsvc_ops);
-
- static DEFINE_MUTEX(nlmsvc_mutex);
-diff --git a/fs/locks.c b/fs/locks.c
-index fde92d1..6256b88 100644
---- a/fs/locks.c
-+++ b/fs/locks.c
-@@ -145,10 +145,28 @@ static LIST_HEAD(blocked_list);
-
- static struct kmem_cache *filelock_cache __read_mostly;
-
-+static void locks_init_lock_always(struct file_lock *fl)
-+{
-+ fl->fl_next = NULL;
-+ fl->fl_fasync = NULL;
-+ fl->fl_owner = NULL;
-+ fl->fl_pid = 0;
-+ fl->fl_nspid = NULL;
-+ fl->fl_file = NULL;
-+ fl->fl_flags = 0;
-+ fl->fl_type = 0;
-+ fl->fl_start = fl->fl_end = 0;
-+}
-+
- /* Allocate an empty lock structure. */
- static struct file_lock *locks_alloc_lock(void)
- {
-- return kmem_cache_alloc(filelock_cache, GFP_KERNEL);
-+ struct file_lock *fl = kmem_cache_alloc(filelock_cache, GFP_KERNEL);
-+
-+ if (fl)
-+ locks_init_lock_always(fl);
-+
-+ return fl;
- }
-
- void locks_release_private(struct file_lock *fl)
-@@ -183,17 +201,9 @@ void locks_init_lock(struct file_lock *fl)
- INIT_LIST_HEAD(&fl->fl_link);
- INIT_LIST_HEAD(&fl->fl_block);
- init_waitqueue_head(&fl->fl_wait);
-- fl->fl_next = NULL;
-- fl->fl_fasync = NULL;
-- fl->fl_owner = NULL;
-- fl->fl_pid = 0;
-- fl->fl_nspid = NULL;
-- fl->fl_file = NULL;
-- fl->fl_flags = 0;
-- fl->fl_type = 0;
-- fl->fl_start = fl->fl_end = 0;
- fl->fl_ops = NULL;
- fl->fl_lmops = NULL;
-+ locks_init_lock_always(fl);
- }
-
- EXPORT_SYMBOL(locks_init_lock);
-@@ -2007,16 +2017,16 @@ void locks_remove_flock(struct file *filp)
- return;
-
- if (filp->f_op && filp->f_op->flock) {
-- struct file_lock fl = {
-+ struct file_lock flock = {
- .fl_pid = current->tgid,
- .fl_file = filp,
- .fl_flags = FL_FLOCK,
- .fl_type = F_UNLCK,
- .fl_end = OFFSET_MAX,
- };
-- filp->f_op->flock(filp, F_SETLKW, &fl);
-- if (fl.fl_ops && fl.fl_ops->fl_release_private)
-- fl.fl_ops->fl_release_private(&fl);
-+ filp->f_op->flock(filp, F_SETLKW, &flock);
-+ if (flock.fl_ops && flock.fl_ops->fl_release_private)
-+ flock.fl_ops->fl_release_private(&flock);
- }
-
- lock_kernel();
-diff --git a/fs/mbcache.c b/fs/mbcache.c
-index ec88ff3..b843a82 100644
---- a/fs/mbcache.c
-+++ b/fs/mbcache.c
-@@ -266,9 +266,9 @@ mb_cache_create(const char *name, struct mb_cache_op *cache_op,
- if (!cache)
- goto fail;
- cache->c_name = name;
-- cache->c_op.free = NULL;
-+ *(void **)&cache->c_op.free = NULL;
- if (cache_op)
-- cache->c_op.free = cache_op->free;
-+ *(void **)&cache->c_op.free = cache_op->free;
- atomic_set(&cache->c_entry_count, 0);
- cache->c_bucket_bits = bucket_bits;
- #ifdef MB_CACHE_INDEXES_COUNT
-diff --git a/fs/namei.c b/fs/namei.c
-index b0afbd4..2b96439 100644
---- a/fs/namei.c
-+++ b/fs/namei.c
-@@ -224,6 +224,14 @@ int generic_permission(struct inode *inode, int mask,
- return ret;
-
- /*
-+ * Searching includes executable on directories, else just read.
-+ */
-+ mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
-+ if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE)))
-+ if (capable(CAP_DAC_READ_SEARCH))
-+ return 0;
-+
-+ /*
- * Read/write DACs are always overridable.
- * Executable DACs are overridable if at least one exec bit is set.
- */
-@@ -231,14 +239,6 @@ int generic_permission(struct inode *inode, int mask,
- if (capable(CAP_DAC_OVERRIDE))
- return 0;
-
-- /*
-- * Searching includes executable on directories, else just read.
-- */
-- mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
-- if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE)))
-- if (capable(CAP_DAC_READ_SEARCH))
-- return 0;
--
- return -EACCES;
- }
-
-@@ -458,7 +458,8 @@ static int exec_permission_lite(struct inode *inode)
- if (!ret)
- goto ok;
-
-- if (capable(CAP_DAC_OVERRIDE) || capable(CAP_DAC_READ_SEARCH))
-+ if (capable_nolog(CAP_DAC_OVERRIDE) || capable(CAP_DAC_READ_SEARCH) ||
-+ capable(CAP_DAC_OVERRIDE))
- goto ok;
-
- return ret;
-@@ -638,13 +639,17 @@ static __always_inline int __do_follow_link(struct path *path, struct nameidata
- cookie = dentry->d_inode->i_op->follow_link(dentry, nd);
- error = PTR_ERR(cookie);
- if (!IS_ERR(cookie)) {
-- char *s = nd_get_link(nd);
-+ const char *s = nd_get_link(nd);
- error = 0;
- if (s)
- error = __vfs_follow_link(nd, s);
- if (dentry->d_inode->i_op->put_link)
- dentry->d_inode->i_op->put_link(dentry, nd, cookie);
- }
-+
-+ if (!error && (nd->flags & LOOKUP_SYMLINKOWN) && gr_handle_symlink_owner(path, nd->path.dentry->d_inode))
-+ error = -EACCES;
-+
- path_put(path);
-
- return error;
-@@ -669,9 +674,17 @@ static inline int do_follow_link(struct path *path, struct nameidata *nd)
- err = security_inode_follow_link(path->dentry, nd);
- if (err)
- goto loop;
-+
-+ if (gr_handle_follow_link(path->dentry->d_parent->d_inode,
-+ path->dentry->d_inode, path->dentry, nd->path.mnt)) {
-+ err = -EACCES;
-+ goto loop;
-+ }
-+
- current->link_count++;
- current->total_link_count++;
- nd->depth++;
-+ nd->flags |= LOOKUP_SYMLINKOWN;
- err = __do_follow_link(path, nd);
- current->link_count--;
- nd->depth--;
-@@ -1016,11 +1029,19 @@ return_reval:
- break;
- }
- return_base:
-+ if (!(nd->flags & (LOOKUP_CONTINUE | LOOKUP_PARENT)) &&
-+ !gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
-+ path_put(&nd->path);
-+ return -ENOENT;
-+ }
- return 0;
- out_dput:
- path_put_conditional(&next, nd);
- break;
- }
-+ if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt))
-+ err = -ENOENT;
-+
- path_put(&nd->path);
- return_err:
- return err;
-@@ -1091,13 +1112,20 @@ static int do_path_lookup(int dfd, const char *name,
- int retval = path_init(dfd, name, flags, nd);
- if (!retval)
- retval = path_walk(name, nd);
-- if (unlikely(!retval && !audit_dummy_context() && nd->path.dentry &&
-- nd->path.dentry->d_inode))
-- audit_inode(name, nd->path.dentry);
-+
-+ if (likely(!retval)) {
-+ if (nd->path.dentry && nd->path.dentry->d_inode) {
-+ if (*name != '/' && !gr_chroot_fchdir(nd->path.dentry, nd->path.mnt))
-+ retval = -ENOENT;
-+ if (!audit_dummy_context())
-+ audit_inode(name, nd->path.dentry);
-+ }
-+ }
- if (nd->root.mnt) {
- path_put(&nd->root);
- nd->root.mnt = NULL;
- }
-+
- return retval;
- }
-
-@@ -1251,6 +1279,11 @@ static int __lookup_one_len(const char *name, struct qstr *this,
- if (!len)
- return -EACCES;
-
-+ if (unlikely(name[0] == '.')) {
-+ if (len < 2 || (len == 2 && name[1] == '.'))
-+ return -EACCES;
-+ }
-+
- hash = init_name_hash();
- while (len--) {
- c = *(const unsigned char *)name++;
-@@ -1576,6 +1609,20 @@ int may_open(struct path *path, int acc_mode, int flag)
- if (error)
- goto err_out;
-
-+
-+ if (gr_handle_rofs_blockwrite(dentry, path->mnt, acc_mode)) {
-+ error = -EPERM;
-+ goto err_out;
-+ }
-+ if (gr_handle_rawio(inode)) {
-+ error = -EPERM;
-+ goto err_out;
-+ }
-+ if (!gr_acl_handle_open(dentry, path->mnt, acc_mode)) {
-+ error = -EACCES;
-+ goto err_out;
-+ }
-+
- if (flag & O_TRUNC) {
- error = get_write_access(inode);
- if (error)
-@@ -1620,6 +1667,17 @@ static int __open_namei_create(struct nameidata *nd, struct path *path,
- {
- int error;
- struct dentry *dir = nd->path.dentry;
-+ int acc_mode = ACC_MODE(flag);
-+
-+ if (flag & O_TRUNC)
-+ acc_mode |= MAY_WRITE;
-+ if (flag & O_APPEND)
-+ acc_mode |= MAY_APPEND;
-+
-+ if (!gr_acl_handle_creat(path->dentry, dir, nd->path.mnt, flag, acc_mode, mode)) {
-+ error = -EACCES;
-+ goto out_unlock;
-+ }
-
- if (!IS_POSIXACL(dir->d_inode))
- mode &= ~current_umask();
-@@ -1627,6 +1685,8 @@ static int __open_namei_create(struct nameidata *nd, struct path *path,
- if (error)
- goto out_unlock;
- error = vfs_create(dir->d_inode, path->dentry, mode, nd);
-+ if (!error)
-+ gr_handle_create(path->dentry, nd->path.mnt);
- out_unlock:
- mutex_unlock(&dir->d_inode->i_mutex);
- dput(nd->path.dentry);
-@@ -1684,6 +1744,7 @@ struct file *do_filp_open(int dfd, const char *pathname,
- struct nameidata nd;
- int error;
- struct path path;
-+ struct path link_path;
- struct dentry *dir;
- int count = 0;
- int will_write;
-@@ -1709,6 +1770,22 @@ struct file *do_filp_open(int dfd, const char *pathname,
- &nd, flag);
- if (error)
- return ERR_PTR(error);
-+
-+ if (gr_handle_rofs_blockwrite(nd.path.dentry, nd.path.mnt, acc_mode)) {
-+ error = -EPERM;
-+ goto exit;
-+ }
-+
-+ if (gr_handle_rawio(nd.path.dentry->d_inode)) {
-+ error = -EPERM;
-+ goto exit;
-+ }
-+
-+ if (!gr_acl_handle_open(nd.path.dentry, nd.path.mnt, acc_mode)) {
-+ error = -EACCES;
-+ goto exit;
-+ }
-+
- goto ok;
- }
-
-@@ -1795,6 +1872,19 @@ do_last:
- /*
- * It already exists.
- */
-+
-+ if (!gr_acl_handle_hidden_file(path.dentry, path.mnt)) {
-+ error = -ENOENT;
-+ goto exit_mutex_unlock;
-+ }
-+
-+ /* only check if O_CREAT is specified, all other checks need
-+ to go into may_open */
-+ if (gr_handle_fifo(path.dentry, path.mnt, dir, flag, acc_mode)) {
-+ error = -EACCES;
-+ goto exit_mutex_unlock;
-+ }
-+
- mutex_unlock(&dir->d_inode->i_mutex);
- audit_inode(pathname, path.dentry);
-
-@@ -1887,6 +1977,14 @@ do_link:
- error = security_inode_follow_link(path.dentry, &nd);
- if (error)
- goto exit_dput;
-+
-+ if (gr_handle_follow_link(path.dentry->d_parent->d_inode, path.dentry->d_inode,
-+ path.dentry, nd.path.mnt)) {
-+ error = -EACCES;
-+ goto exit_dput;
-+ }
-+
-+ nd.flags &= ~LOOKUP_SYMLINKOWN;
- error = __do_follow_link(&path, &nd);
- if (error) {
- /* Does someone understand code flow here? Or it is only
-@@ -1915,9 +2013,24 @@ do_link:
- }
- dir = nd.path.dentry;
- mutex_lock(&dir->d_inode->i_mutex);
-+ link_path.dentry = path.dentry;
-+ link_path.mnt = path.mnt;
- path.dentry = lookup_hash(&nd);
- path.mnt = nd.path.mnt;
- __putname(nd.last.name);
-+
-+ /* if the last path component resolved by the symlink exists, then check ownership against that
-+ if it doesn't, we're trying to create it, check ownership against its directory
-+ */
-+ if (!IS_ERR(path.dentry) && !IS_ERR(nd.intent.open.file)) {
-+ if (path.dentry->d_inode && gr_handle_symlink_owner(&link_path, path.dentry->d_inode)) {
-+ error = -EACCES;
-+ goto exit_mutex_unlock;
-+ } else if (!path.dentry->d_inode && gr_handle_symlink_owner(&link_path, dir->d_inode)) {
-+ error = -EACCES;
-+ goto exit_mutex_unlock;
-+ }
-+ }
- goto do_last;
- }
-
-@@ -1984,6 +2097,10 @@ struct dentry *lookup_create(struct nameidata *nd, int is_dir)
- }
- return dentry;
- eexist:
-+ if (!gr_acl_handle_hidden_file(dentry, nd->path.mnt)) {
-+ dput(dentry);
-+ return ERR_PTR(-ENOENT);
-+ }
- dput(dentry);
- dentry = ERR_PTR(-EEXIST);
- fail:
-@@ -2061,6 +2178,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, int, mode,
- error = may_mknod(mode);
- if (error)
- goto out_dput;
-+
-+ if (gr_handle_chroot_mknod(dentry, nd.path.mnt, mode)) {
-+ error = -EPERM;
-+ goto out_dput;
-+ }
-+
-+ if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
-+ error = -EACCES;
-+ goto out_dput;
-+ }
-+
- error = mnt_want_write(nd.path.mnt);
- if (error)
- goto out_dput;
-@@ -2081,6 +2209,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, int, mode,
- }
- out_drop_write:
- mnt_drop_write(nd.path.mnt);
-+
-+ if (!error)
-+ gr_handle_create(dentry, nd.path.mnt);
- out_dput:
- dput(dentry);
- out_unlock:
-@@ -2134,6 +2265,11 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, int, mode)
- if (IS_ERR(dentry))
- goto out_unlock;
-
-+ if (!gr_acl_handle_mkdir(dentry, nd.path.dentry, nd.path.mnt)) {
-+ error = -EACCES;
-+ goto out_dput;
-+ }
-+
- if (!IS_POSIXACL(nd.path.dentry->d_inode))
- mode &= ~current_umask();
- error = mnt_want_write(nd.path.mnt);
-@@ -2145,6 +2281,10 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, int, mode)
- error = vfs_mkdir(nd.path.dentry->d_inode, dentry, mode);
- out_drop_write:
- mnt_drop_write(nd.path.mnt);
-+
-+ if (!error)
-+ gr_handle_create(dentry, nd.path.mnt);
-+
- out_dput:
- dput(dentry);
- out_unlock:
-@@ -2226,6 +2366,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
- char * name;
- struct dentry *dentry;
- struct nameidata nd;
-+ ino_t saved_ino = 0;
-+ dev_t saved_dev = 0;
-
- error = user_path_parent(dfd, pathname, &nd, &name);
- if (error)
-@@ -2250,6 +2392,17 @@ static long do_rmdir(int dfd, const char __user *pathname)
- error = PTR_ERR(dentry);
- if (IS_ERR(dentry))
- goto exit2;
-+
-+ if (dentry->d_inode != NULL) {
-+ saved_ino = dentry->d_inode->i_ino;
-+ saved_dev = gr_get_dev_from_dentry(dentry);
-+
-+ if (!gr_acl_handle_rmdir(dentry, nd.path.mnt)) {
-+ error = -EACCES;
-+ goto exit3;
-+ }
-+ }
-+
- error = mnt_want_write(nd.path.mnt);
- if (error)
- goto exit3;
-@@ -2257,6 +2410,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
- if (error)
- goto exit4;
- error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
-+ if (!error && (saved_dev || saved_ino))
-+ gr_handle_delete(saved_ino, saved_dev);
- exit4:
- mnt_drop_write(nd.path.mnt);
- exit3:
-@@ -2318,6 +2473,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
- struct dentry *dentry;
- struct nameidata nd;
- struct inode *inode = NULL;
-+ ino_t saved_ino = 0;
-+ dev_t saved_dev = 0;
-
- error = user_path_parent(dfd, pathname, &nd, &name);
- if (error)
-@@ -2337,8 +2494,19 @@ static long do_unlinkat(int dfd, const char __user *pathname)
- if (nd.last.name[nd.last.len])
- goto slashes;
- inode = dentry->d_inode;
-- if (inode)
-+ if (inode) {
-+ if (inode->i_nlink <= 1) {
-+ saved_ino = inode->i_ino;
-+ saved_dev = gr_get_dev_from_dentry(dentry);
-+ }
-+
- atomic_inc(&inode->i_count);
-+
-+ if (!gr_acl_handle_unlink(dentry, nd.path.mnt)) {
-+ error = -EACCES;
-+ goto exit2;
-+ }
-+ }
- error = mnt_want_write(nd.path.mnt);
- if (error)
- goto exit2;
-@@ -2346,6 +2514,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
- if (error)
- goto exit3;
- error = vfs_unlink(nd.path.dentry->d_inode, dentry);
-+ if (!error && (saved_ino || saved_dev))
-+ gr_handle_delete(saved_ino, saved_dev);
- exit3:
- mnt_drop_write(nd.path.mnt);
- exit2:
-@@ -2424,6 +2594,11 @@ SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
- if (IS_ERR(dentry))
- goto out_unlock;
-
-+ if (!gr_acl_handle_symlink(dentry, nd.path.dentry, nd.path.mnt, from)) {
-+ error = -EACCES;
-+ goto out_dput;
-+ }
-+
- error = mnt_want_write(nd.path.mnt);
- if (error)
- goto out_dput;
-@@ -2431,6 +2606,8 @@ SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
- if (error)
- goto out_drop_write;
- error = vfs_symlink(nd.path.dentry->d_inode, dentry, from);
-+ if (!error)
-+ gr_handle_create(dentry, nd.path.mnt);
- out_drop_write:
- mnt_drop_write(nd.path.mnt);
- out_dput:
-@@ -2524,6 +2701,20 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
- error = PTR_ERR(new_dentry);
- if (IS_ERR(new_dentry))
- goto out_unlock;
-+
-+ if (gr_handle_hardlink(old_path.dentry, old_path.mnt,
-+ old_path.dentry->d_inode,
-+ old_path.dentry->d_inode->i_mode, to)) {
-+ error = -EACCES;
-+ goto out_dput;
-+ }
-+
-+ if (!gr_acl_handle_link(new_dentry, nd.path.dentry, nd.path.mnt,
-+ old_path.dentry, old_path.mnt, to)) {
-+ error = -EACCES;
-+ goto out_dput;
-+ }
-+
- error = mnt_want_write(nd.path.mnt);
- if (error)
- goto out_dput;
-@@ -2531,6 +2722,8 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
- if (error)
- goto out_drop_write;
- error = vfs_link(old_path.dentry, nd.path.dentry->d_inode, new_dentry);
-+ if (!error)
-+ gr_handle_create(new_dentry, nd.path.mnt);
- out_drop_write:
- mnt_drop_write(nd.path.mnt);
- out_dput:
-@@ -2708,6 +2901,8 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
- char *to;
- int error;
-
-+ pax_track_stack();
-+
- error = user_path_parent(olddfd, oldname, &oldnd, &from);
- if (error)
- goto exit;
-@@ -2764,6 +2959,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
- if (new_dentry == trap)
- goto exit5;
-
-+ error = gr_acl_handle_rename(new_dentry, new_dir, newnd.path.mnt,
-+ old_dentry, old_dir->d_inode, oldnd.path.mnt,
-+ to);
-+ if (error)
-+ goto exit5;
-+
- error = mnt_want_write(oldnd.path.mnt);
- if (error)
- goto exit5;
-@@ -2773,6 +2974,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
- goto exit6;
- error = vfs_rename(old_dir->d_inode, old_dentry,
- new_dir->d_inode, new_dentry);
-+ if (!error)
-+ gr_handle_rename(old_dir->d_inode, new_dir->d_inode, old_dentry,
-+ new_dentry, oldnd.path.mnt, new_dentry->d_inode ? 1 : 0);
- exit6:
- mnt_drop_write(oldnd.path.mnt);
- exit5:
-@@ -2798,6 +3002,8 @@ SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newna
-
- int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
- {
-+ char tmpbuf[64];
-+ const char *newlink;
- int len;
-
- len = PTR_ERR(link);
-@@ -2807,7 +3013,14 @@ int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const c
- len = strlen(link);
- if (len > (unsigned) buflen)
- len = buflen;
-- if (copy_to_user(buffer, link, len))
-+
-+ if (len < sizeof(tmpbuf)) {
-+ memcpy(tmpbuf, link, len);
-+ newlink = tmpbuf;
-+ } else
-+ newlink = link;
-+
-+ if (copy_to_user(buffer, newlink, len))
- len = -EFAULT;
- out:
- return len;
-diff --git a/fs/namespace.c b/fs/namespace.c
-index 2beb0fb..11a95a5 100644
---- a/fs/namespace.c
-+++ b/fs/namespace.c
-@@ -1083,6 +1083,9 @@ static int do_umount(struct vfsmount *mnt, int flags)
- if (!(sb->s_flags & MS_RDONLY))
- retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
- up_write(&sb->s_umount);
-+
-+ gr_log_remount(mnt->mnt_devname, retval);
-+
- return retval;
- }
-
-@@ -1104,6 +1107,9 @@ static int do_umount(struct vfsmount *mnt, int flags)
- security_sb_umount_busy(mnt);
- up_write(&namespace_sem);
- release_mounts(&umount_list);
-+
-+ gr_log_unmount(mnt->mnt_devname, retval);
-+
- return retval;
- }
-
-@@ -1962,6 +1968,16 @@ long do_mount(char *dev_name, char *dir_name, char *type_page,
- if (retval)
- goto dput_out;
-
-+ if (gr_handle_rofs_mount(path.dentry, path.mnt, mnt_flags)) {
-+ retval = -EPERM;
-+ goto dput_out;
-+ }
-+
-+ if (gr_handle_chroot_mount(path.dentry, path.mnt, dev_name)) {
-+ retval = -EPERM;
-+ goto dput_out;
-+ }
-+
- if (flags & MS_REMOUNT)
- retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
- data_page);
-@@ -1976,6 +1992,9 @@ long do_mount(char *dev_name, char *dir_name, char *type_page,
- dev_name, data_page);
- dput_out:
- path_put(&path);
-+
-+ gr_log_mount(dev_name, dir_name, retval);
-+
- return retval;
- }
-
-@@ -2182,6 +2201,12 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
- goto out1;
- }
-
-+ if (gr_handle_chroot_pivot()) {
-+ error = -EPERM;
-+ path_put(&old);
-+ goto out1;
-+ }
-+
- read_lock(¤t->fs->lock);
- root = current->fs->root;
- path_get(¤t->fs->root);
-diff --git a/fs/ncpfs/dir.c b/fs/ncpfs/dir.c
-index b8b5b30..2bd9ccb 100644
---- a/fs/ncpfs/dir.c
-+++ b/fs/ncpfs/dir.c
-@@ -275,6 +275,8 @@ __ncp_lookup_validate(struct dentry *dentry)
- int res, val = 0, len;
- __u8 __name[NCP_MAXPATHLEN + 1];
-
-+ pax_track_stack();
-+
- parent = dget_parent(dentry);
- dir = parent->d_inode;
-
-@@ -799,6 +801,8 @@ static struct dentry *ncp_lookup(struct inode *dir, struct dentry *dentry, struc
- int error, res, len;
- __u8 __name[NCP_MAXPATHLEN + 1];
-
-+ pax_track_stack();
-+
- lock_kernel();
- error = -EIO;
- if (!ncp_conn_valid(server))
-@@ -883,10 +887,12 @@ int ncp_create_new(struct inode *dir, struct dentry *dentry, int mode,
- int error, result, len;
- int opmode;
- __u8 __name[NCP_MAXPATHLEN + 1];
--
-+
- PPRINTK("ncp_create_new: creating %s/%s, mode=%x\n",
- dentry->d_parent->d_name.name, dentry->d_name.name, mode);
-
-+ pax_track_stack();
-+
- error = -EIO;
- lock_kernel();
- if (!ncp_conn_valid(server))
-@@ -952,6 +958,8 @@ static int ncp_mkdir(struct inode *dir, struct dentry *dentry, int mode)
- int error, len;
- __u8 __name[NCP_MAXPATHLEN + 1];
-
-+ pax_track_stack();
-+
- DPRINTK("ncp_mkdir: making %s/%s\n",
- dentry->d_parent->d_name.name, dentry->d_name.name);
-
-@@ -960,6 +968,8 @@ static int ncp_mkdir(struct inode *dir, struct dentry *dentry, int mode)
- if (!ncp_conn_valid(server))
- goto out;
-
-+ pax_track_stack();
-+
- ncp_age_dentry(server, dentry);
- len = sizeof(__name);
- error = ncp_io2vol(server, __name, &len, dentry->d_name.name,
-@@ -1114,6 +1124,8 @@ static int ncp_rename(struct inode *old_dir, struct dentry *old_dentry,
- int old_len, new_len;
- __u8 __old_name[NCP_MAXPATHLEN + 1], __new_name[NCP_MAXPATHLEN + 1];
-
-+ pax_track_stack();
-+
- DPRINTK("ncp_rename: %s/%s to %s/%s\n",
- old_dentry->d_parent->d_name.name, old_dentry->d_name.name,
- new_dentry->d_parent->d_name.name, new_dentry->d_name.name);
-diff --git a/fs/ncpfs/inode.c b/fs/ncpfs/inode.c
-index cf98da1..da890a9 100644
---- a/fs/ncpfs/inode.c
-+++ b/fs/ncpfs/inode.c
-@@ -445,6 +445,8 @@ static int ncp_fill_super(struct super_block *sb, void *raw_data, int silent)
- #endif
- struct ncp_entry_info finfo;
-
-+ pax_track_stack();
-+
- data.wdog_pid = NULL;
- server = kzalloc(sizeof(struct ncp_server), GFP_KERNEL);
- if (!server)
-diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
-index bfaef7b..e9d03ca 100644
---- a/fs/nfs/inode.c
-+++ b/fs/nfs/inode.c
-@@ -156,7 +156,7 @@ static void nfs_zap_caches_locked(struct inode *inode)
- nfsi->attrtimeo = NFS_MINATTRTIMEO(inode);
- nfsi->attrtimeo_timestamp = jiffies;
-
-- memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_COOKIEVERF(inode)));
-+ memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_I(inode)->cookieverf));
- if (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))
- nfsi->cache_validity |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL|NFS_INO_REVAL_PAGECACHE;
- else
-@@ -973,16 +973,16 @@ static int nfs_size_need_update(const struct inode *inode, const struct nfs_fatt
- return nfs_size_to_loff_t(fattr->size) > i_size_read(inode);
- }
-
--static atomic_long_t nfs_attr_generation_counter;
-+static atomic_long_unchecked_t nfs_attr_generation_counter;
-
- static unsigned long nfs_read_attr_generation_counter(void)
- {
-- return atomic_long_read(&nfs_attr_generation_counter);
-+ return atomic_long_read_unchecked(&nfs_attr_generation_counter);
- }
-
- unsigned long nfs_inc_attr_generation_counter(void)
- {
-- return atomic_long_inc_return(&nfs_attr_generation_counter);
-+ return atomic_long_inc_return_unchecked(&nfs_attr_generation_counter);
- }
-
- void nfs_fattr_init(struct nfs_fattr *fattr)
-diff --git a/fs/nfsd/lockd.c b/fs/nfsd/lockd.c
-index cc2f505..f6a236f 100644
---- a/fs/nfsd/lockd.c
-+++ b/fs/nfsd/lockd.c
-@@ -66,7 +66,7 @@ nlm_fclose(struct file *filp)
- fput(filp);
- }
-
--static struct nlmsvc_binding nfsd_nlm_ops = {
-+static const struct nlmsvc_binding nfsd_nlm_ops = {
- .fopen = nlm_fopen, /* open file for locking */
- .fclose = nlm_fclose, /* close file */
- };
-diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
-index cfc3391..dcc083a 100644
---- a/fs/nfsd/nfs4state.c
-+++ b/fs/nfsd/nfs4state.c
-@@ -3459,6 +3459,8 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
- unsigned int cmd;
- int err;
-
-+ pax_track_stack();
-+
- dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n",
- (long long) lock->lk_offset,
- (long long) lock->lk_length);
-diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
-index 6d27757..d046ba1 100644
---- a/fs/nfsd/nfs4xdr.c
-+++ b/fs/nfsd/nfs4xdr.c
-@@ -1751,6 +1751,8 @@ nfsd4_encode_fattr(struct svc_fh *fhp, struct svc_export *exp,
- struct nfsd4_compoundres *resp = rqstp->rq_resp;
- u32 minorversion = resp->cstate.minorversion;
-
-+ pax_track_stack();
-+
- BUG_ON(bmval1 & NFSD_WRITEONLY_ATTRS_WORD1);
- BUG_ON(bmval0 & ~nfsd_suppattrs0(minorversion));
- BUG_ON(bmval1 & ~nfsd_suppattrs1(minorversion));
-diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
-index 2e09588..596421d 100644
---- a/fs/nfsd/vfs.c
-+++ b/fs/nfsd/vfs.c
-@@ -937,7 +937,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
- } else {
- oldfs = get_fs();
- set_fs(KERNEL_DS);
-- host_err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset);
-+ host_err = vfs_readv(file, (struct iovec __force_user *)vec, vlen, &offset);
- set_fs(oldfs);
- }
-
-@@ -1060,7 +1060,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
-
- /* Write the data. */
- oldfs = get_fs(); set_fs(KERNEL_DS);
-- host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
-+ host_err = vfs_writev(file, (struct iovec __force_user *)vec, vlen, &offset);
- set_fs(oldfs);
- if (host_err < 0)
- goto out_nfserr;
-@@ -1542,7 +1542,7 @@ nfsd_readlink(struct svc_rqst *rqstp, struct svc_fh *fhp, char *buf, int *lenp)
- */
-
- oldfs = get_fs(); set_fs(KERNEL_DS);
-- host_err = inode->i_op->readlink(dentry, buf, *lenp);
-+ host_err = inode->i_op->readlink(dentry, (char __force_user *)buf, *lenp);
- set_fs(oldfs);
-
- if (host_err < 0)
-diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
-index f6af760..d0adf34 100644
---- a/fs/nilfs2/ioctl.c
-+++ b/fs/nilfs2/ioctl.c
-@@ -480,7 +480,7 @@ static int nilfs_ioctl_clean_segments(struct inode *inode, struct file *filp,
- unsigned int cmd, void __user *argp)
- {
- struct nilfs_argv argv[5];
-- const static size_t argsz[5] = {
-+ static const size_t argsz[5] = {
- sizeof(struct nilfs_vdesc),
- sizeof(struct nilfs_period),
- sizeof(__u64),
-@@ -522,6 +522,9 @@ static int nilfs_ioctl_clean_segments(struct inode *inode, struct file *filp,
- if (argv[n].v_nmembs > nsegs * nilfs->ns_blocks_per_segment)
- goto out_free;
-
-+ if (argv[n].v_nmembs >= UINT_MAX / argv[n].v_size)
-+ goto out_free;
-+
- len = argv[n].v_size * argv[n].v_nmembs;
- base = (void __user *)(unsigned long)argv[n].v_base;
- if (len == 0) {
-diff --git a/fs/notify/dnotify/dnotify.c b/fs/notify/dnotify/dnotify.c
-index 7e54e52..9337248 100644
---- a/fs/notify/dnotify/dnotify.c
-+++ b/fs/notify/dnotify/dnotify.c
-@@ -173,7 +173,7 @@ static void dnotify_free_mark(struct fsnotify_mark_entry *entry)
- kmem_cache_free(dnotify_mark_entry_cache, dnentry);
- }
-
--static struct fsnotify_ops dnotify_fsnotify_ops = {
-+static const struct fsnotify_ops dnotify_fsnotify_ops = {
- .handle_event = dnotify_handle_event,
- .should_send_event = dnotify_should_send_event,
- .free_group_priv = NULL,
-diff --git a/fs/notify/notification.c b/fs/notify/notification.c
-index b8bf53b..c518688 100644
---- a/fs/notify/notification.c
-+++ b/fs/notify/notification.c
-@@ -57,7 +57,7 @@ static struct kmem_cache *fsnotify_event_holder_cachep;
- * get set to 0 so it will never get 'freed'
- */
- static struct fsnotify_event q_overflow_event;
--static atomic_t fsnotify_sync_cookie = ATOMIC_INIT(0);
-+static atomic_unchecked_t fsnotify_sync_cookie = ATOMIC_INIT(0);
-
- /**
- * fsnotify_get_cookie - return a unique cookie for use in synchronizing events.
-@@ -65,7 +65,7 @@ static atomic_t fsnotify_sync_cookie = ATOMIC_INIT(0);
- */
- u32 fsnotify_get_cookie(void)
- {
-- return atomic_inc_return(&fsnotify_sync_cookie);
-+ return atomic_inc_return_unchecked(&fsnotify_sync_cookie);
- }
- EXPORT_SYMBOL_GPL(fsnotify_get_cookie);
-
-diff --git a/fs/ntfs/dir.c b/fs/ntfs/dir.c
-index 5a9e344..0f8cd28 100644
---- a/fs/ntfs/dir.c
-+++ b/fs/ntfs/dir.c
-@@ -1328,7 +1328,7 @@ find_next_index_buffer:
- ia = (INDEX_ALLOCATION*)(kaddr + (ia_pos & ~PAGE_CACHE_MASK &
- ~(s64)(ndir->itype.index.block_size - 1)));
- /* Bounds checks. */
-- if (unlikely((u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
-+ if (unlikely(!kaddr || (u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
- ntfs_error(sb, "Out of bounds check failed. Corrupt directory "
- "inode 0x%lx or driver bug.", vdir->i_ino);
- goto err_out;
-diff --git a/fs/ntfs/file.c b/fs/ntfs/file.c
-index 663c0e3..b6868e9 100644
---- a/fs/ntfs/file.c
-+++ b/fs/ntfs/file.c
-@@ -2243,6 +2243,6 @@ const struct inode_operations ntfs_file_inode_ops = {
- #endif /* NTFS_RW */
- };
-
--const struct file_operations ntfs_empty_file_ops = {};
-+const struct file_operations ntfs_empty_file_ops __read_only;
-
--const struct inode_operations ntfs_empty_inode_ops = {};
-+const struct inode_operations ntfs_empty_inode_ops __read_only;
-diff --git a/fs/ocfs2/cluster/masklog.c b/fs/ocfs2/cluster/masklog.c
-index 1cd2934..880b5d2 100644
---- a/fs/ocfs2/cluster/masklog.c
-+++ b/fs/ocfs2/cluster/masklog.c
-@@ -135,7 +135,7 @@ static ssize_t mlog_store(struct kobject *obj, struct attribute *attr,
- return mlog_mask_store(mlog_attr->mask, buf, count);
- }
-
--static struct sysfs_ops mlog_attr_ops = {
-+static const struct sysfs_ops mlog_attr_ops = {
- .show = mlog_show,
- .store = mlog_store,
- };
-diff --git a/fs/ocfs2/localalloc.c b/fs/ocfs2/localalloc.c
-index ac10f83..2cd2607 100644
---- a/fs/ocfs2/localalloc.c
-+++ b/fs/ocfs2/localalloc.c
-@@ -1188,7 +1188,7 @@ static int ocfs2_local_alloc_slide_window(struct ocfs2_super *osb,
- goto bail;
- }
-
-- atomic_inc(&osb->alloc_stats.moves);
-+ atomic_inc_unchecked(&osb->alloc_stats.moves);
-
- status = 0;
- bail:
-diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
-index f010b22..9f9ed34 100644
---- a/fs/ocfs2/namei.c
-+++ b/fs/ocfs2/namei.c
-@@ -1043,6 +1043,8 @@ static int ocfs2_rename(struct inode *old_dir,
- struct ocfs2_dir_lookup_result orphan_insert = { NULL, };
- struct ocfs2_dir_lookup_result target_insert = { NULL, };
-
-+ pax_track_stack();
-+
- /* At some point it might be nice to break this function up a
- * bit. */
-
-diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
-index d963d86..914cfbd 100644
---- a/fs/ocfs2/ocfs2.h
-+++ b/fs/ocfs2/ocfs2.h
-@@ -217,11 +217,11 @@ enum ocfs2_vol_state
-
- struct ocfs2_alloc_stats
- {
-- atomic_t moves;
-- atomic_t local_data;
-- atomic_t bitmap_data;
-- atomic_t bg_allocs;
-- atomic_t bg_extends;
-+ atomic_unchecked_t moves;
-+ atomic_unchecked_t local_data;
-+ atomic_unchecked_t bitmap_data;
-+ atomic_unchecked_t bg_allocs;
-+ atomic_unchecked_t bg_extends;
- };
-
- enum ocfs2_local_alloc_state
-diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
-index 79b5dac..d322952 100644
---- a/fs/ocfs2/suballoc.c
-+++ b/fs/ocfs2/suballoc.c
-@@ -623,7 +623,7 @@ static int ocfs2_reserve_suballoc_bits(struct ocfs2_super *osb,
- mlog_errno(status);
- goto bail;
- }
-- atomic_inc(&osb->alloc_stats.bg_extends);
-+ atomic_inc_unchecked(&osb->alloc_stats.bg_extends);
-
- /* You should never ask for this much metadata */
- BUG_ON(bits_wanted >
-@@ -1654,7 +1654,7 @@ int ocfs2_claim_metadata(struct ocfs2_super *osb,
- mlog_errno(status);
- goto bail;
- }
-- atomic_inc(&osb->alloc_stats.bg_allocs);
-+ atomic_inc_unchecked(&osb->alloc_stats.bg_allocs);
-
- *blkno_start = bg_blkno + (u64) *suballoc_bit_start;
- ac->ac_bits_given += (*num_bits);
-@@ -1728,7 +1728,7 @@ int ocfs2_claim_new_inode(struct ocfs2_super *osb,
- mlog_errno(status);
- goto bail;
- }
-- atomic_inc(&osb->alloc_stats.bg_allocs);
-+ atomic_inc_unchecked(&osb->alloc_stats.bg_allocs);
-
- BUG_ON(num_bits != 1);
-
-@@ -1830,7 +1830,7 @@ int __ocfs2_claim_clusters(struct ocfs2_super *osb,
- cluster_start,
- num_clusters);
- if (!status)
-- atomic_inc(&osb->alloc_stats.local_data);
-+ atomic_inc_unchecked(&osb->alloc_stats.local_data);
- } else {
- if (min_clusters > (osb->bitmap_cpg - 1)) {
- /* The only paths asking for contiguousness
-@@ -1858,7 +1858,7 @@ int __ocfs2_claim_clusters(struct ocfs2_super *osb,
- ocfs2_desc_bitmap_to_cluster_off(ac->ac_inode,
- bg_blkno,
- bg_bit_off);
-- atomic_inc(&osb->alloc_stats.bitmap_data);
-+ atomic_inc_unchecked(&osb->alloc_stats.bitmap_data);
- }
- }
- if (status < 0) {
-diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
-index 9f55be4..a3f8048 100644
---- a/fs/ocfs2/super.c
-+++ b/fs/ocfs2/super.c
-@@ -284,11 +284,11 @@ static int ocfs2_osb_dump(struct ocfs2_super *osb, char *buf, int len)
- "%10s => GlobalAllocs: %d LocalAllocs: %d "
- "SubAllocs: %d LAWinMoves: %d SAExtends: %d\n",
- "Stats",
-- atomic_read(&osb->alloc_stats.bitmap_data),
-- atomic_read(&osb->alloc_stats.local_data),
-- atomic_read(&osb->alloc_stats.bg_allocs),
-- atomic_read(&osb->alloc_stats.moves),
-- atomic_read(&osb->alloc_stats.bg_extends));
-+ atomic_read_unchecked(&osb->alloc_stats.bitmap_data),
-+ atomic_read_unchecked(&osb->alloc_stats.local_data),
-+ atomic_read_unchecked(&osb->alloc_stats.bg_allocs),
-+ atomic_read_unchecked(&osb->alloc_stats.moves),
-+ atomic_read_unchecked(&osb->alloc_stats.bg_extends));
-
- out += snprintf(buf + out, len - out,
- "%10s => State: %u Descriptor: %llu Size: %u bits "
-@@ -2002,11 +2002,11 @@ static int ocfs2_initialize_super(struct super_block *sb,
- spin_lock_init(&osb->osb_xattr_lock);
- ocfs2_init_inode_steal_slot(osb);
-
-- atomic_set(&osb->alloc_stats.moves, 0);
-- atomic_set(&osb->alloc_stats.local_data, 0);
-- atomic_set(&osb->alloc_stats.bitmap_data, 0);
-- atomic_set(&osb->alloc_stats.bg_allocs, 0);
-- atomic_set(&osb->alloc_stats.bg_extends, 0);
-+ atomic_set_unchecked(&osb->alloc_stats.moves, 0);
-+ atomic_set_unchecked(&osb->alloc_stats.local_data, 0);
-+ atomic_set_unchecked(&osb->alloc_stats.bitmap_data, 0);
-+ atomic_set_unchecked(&osb->alloc_stats.bg_allocs, 0);
-+ atomic_set_unchecked(&osb->alloc_stats.bg_extends, 0);
-
- /* Copy the blockcheck stats from the superblock probe */
- osb->osb_ecc_stats = *stats;
-diff --git a/fs/open.c b/fs/open.c
-index 4f01e06..b8a21b3 100644
---- a/fs/open.c
-+++ b/fs/open.c
-@@ -31,6 +31,9 @@
- #include <linux/falloc.h>
- #include <linux/fs_struct.h>
-
-+#define CREATE_TRACE_POINTS
-+#include <trace/events/fs.h>
-+
- int vfs_statfs(struct dentry *dentry, struct kstatfs *buf)
- {
- int retval = -ENODEV;
-@@ -275,6 +278,10 @@ static long do_sys_truncate(const char __user *pathname, loff_t length)
- error = locks_verify_truncate(inode, NULL, length);
- if (!error)
- error = security_path_truncate(&path, length, 0);
-+
-+ if (!error && !gr_acl_handle_truncate(path.dentry, path.mnt))
-+ error = -EACCES;
-+
- if (!error) {
- vfs_dq_init(inode);
- error = do_truncate(path.dentry, length, 0, NULL);
-@@ -511,6 +518,9 @@ SYSCALL_DEFINE3(faccessat, int, dfd, const char __user *, filename, int, mode)
- if (__mnt_is_readonly(path.mnt))
- res = -EROFS;
-
-+ if (!res && !gr_acl_handle_access(path.dentry, path.mnt, mode))
-+ res = -EACCES;
-+
- out_path_release:
- path_put(&path);
- out:
-@@ -537,6 +547,8 @@ SYSCALL_DEFINE1(chdir, const char __user *, filename)
- if (error)
- goto dput_and_out;
-
-+ gr_log_chdir(path.dentry, path.mnt);
-+
- set_fs_pwd(current->fs, &path);
-
- dput_and_out:
-@@ -563,6 +575,13 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd)
- goto out_putf;
-
- error = inode_permission(inode, MAY_EXEC | MAY_ACCESS);
-+
-+ if (!error && !gr_chroot_fchdir(file->f_path.dentry, file->f_path.mnt))
-+ error = -EPERM;
-+
-+ if (!error)
-+ gr_log_chdir(file->f_path.dentry, file->f_path.mnt);
-+
- if (!error)
- set_fs_pwd(current->fs, &file->f_path);
- out_putf:
-@@ -588,7 +607,13 @@ SYSCALL_DEFINE1(chroot, const char __user *, filename)
- if (!capable(CAP_SYS_CHROOT))
- goto dput_and_out;
-
-+ if (gr_handle_chroot_chroot(path.dentry, path.mnt))
-+ goto dput_and_out;
-+
- set_fs_root(current->fs, &path);
-+
-+ gr_handle_chroot_chdir(&path);
-+
- error = 0;
- dput_and_out:
- path_put(&path);
-@@ -596,66 +621,57 @@ out:
- return error;
- }
-
-+static int chmod_common(struct path *path, umode_t mode)
-+{
-+ struct inode *inode = path->dentry->d_inode;
-+ struct iattr newattrs;
-+ int error;
-+
-+ error = mnt_want_write(path->mnt);
-+ if (error)
-+ return error;
-+ mutex_lock(&inode->i_mutex);
-+ if (!gr_acl_handle_chmod(path->dentry, path->mnt, &mode)) {
-+ error = -EACCES;
-+ goto out_unlock;
-+ }
-+ if (gr_handle_chroot_chmod(path->dentry, path->mnt, mode)) {
-+ error = -EPERM;
-+ goto out_unlock;
-+ }
-+ newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
-+ newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
-+ error = notify_change(path->dentry, &newattrs);
-+out_unlock:
-+ mutex_unlock(&inode->i_mutex);
-+ mnt_drop_write(path->mnt);
-+ return error;
-+}
-+
- SYSCALL_DEFINE2(fchmod, unsigned int, fd, mode_t, mode)
- {
-- struct inode * inode;
-- struct dentry * dentry;
- struct file * file;
- int err = -EBADF;
-- struct iattr newattrs;
-
- file = fget(fd);
-- if (!file)
-- goto out;
--
-- dentry = file->f_path.dentry;
-- inode = dentry->d_inode;
--
-- audit_inode(NULL, dentry);
--
-- err = mnt_want_write_file(file);
-- if (err)
-- goto out_putf;
-- mutex_lock(&inode->i_mutex);
-- if (mode == (mode_t) -1)
-- mode = inode->i_mode;
-- newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
-- newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
-- err = notify_change(dentry, &newattrs);
-- mutex_unlock(&inode->i_mutex);
-- mnt_drop_write(file->f_path.mnt);
--out_putf:
-- fput(file);
--out:
-+ if (file) {
-+ audit_inode(NULL, file->f_path.dentry);
-+ err = chmod_common(&file->f_path, mode);
-+ fput(file);
-+ }
- return err;
- }
-
- SYSCALL_DEFINE3(fchmodat, int, dfd, const char __user *, filename, mode_t, mode)
- {
- struct path path;
-- struct inode *inode;
- int error;
-- struct iattr newattrs;
-
- error = user_path_at(dfd, filename, LOOKUP_FOLLOW, &path);
-- if (error)
-- goto out;
-- inode = path.dentry->d_inode;
--
-- error = mnt_want_write(path.mnt);
-- if (error)
-- goto dput_and_out;
-- mutex_lock(&inode->i_mutex);
-- if (mode == (mode_t) -1)
-- mode = inode->i_mode;
-- newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
-- newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
-- error = notify_change(path.dentry, &newattrs);
-- mutex_unlock(&inode->i_mutex);
-- mnt_drop_write(path.mnt);
--dput_and_out:
-- path_put(&path);
--out:
-+ if (!error) {
-+ error = chmod_common(&path, mode);
-+ path_put(&path);
-+ }
- return error;
- }
-
-@@ -664,12 +680,15 @@ SYSCALL_DEFINE2(chmod, const char __user *, filename, mode_t, mode)
- return sys_fchmodat(AT_FDCWD, filename, mode);
- }
-
--static int chown_common(struct dentry * dentry, uid_t user, gid_t group)
-+static int chown_common(struct dentry * dentry, uid_t user, gid_t group, struct vfsmount *mnt)
- {
- struct inode *inode = dentry->d_inode;
- int error;
- struct iattr newattrs;
-
-+ if (!gr_acl_handle_chown(dentry, mnt))
-+ return -EACCES;
-+
- newattrs.ia_valid = ATTR_CTIME;
- if (user != (uid_t) -1) {
- newattrs.ia_valid |= ATTR_UID;
-@@ -700,7 +719,7 @@ SYSCALL_DEFINE3(chown, const char __user *, filename, uid_t, user, gid_t, group)
- error = mnt_want_write(path.mnt);
- if (error)
- goto out_release;
-- error = chown_common(path.dentry, user, group);
-+ error = chown_common(path.dentry, user, group, path.mnt);
- mnt_drop_write(path.mnt);
- out_release:
- path_put(&path);
-@@ -725,7 +744,7 @@ SYSCALL_DEFINE5(fchownat, int, dfd, const char __user *, filename, uid_t, user,
- error = mnt_want_write(path.mnt);
- if (error)
- goto out_release;
-- error = chown_common(path.dentry, user, group);
-+ error = chown_common(path.dentry, user, group, path.mnt);
- mnt_drop_write(path.mnt);
- out_release:
- path_put(&path);
-@@ -744,7 +763,7 @@ SYSCALL_DEFINE3(lchown, const char __user *, filename, uid_t, user, gid_t, group
- error = mnt_want_write(path.mnt);
- if (error)
- goto out_release;
-- error = chown_common(path.dentry, user, group);
-+ error = chown_common(path.dentry, user, group, path.mnt);
- mnt_drop_write(path.mnt);
- out_release:
- path_put(&path);
-@@ -767,7 +786,7 @@ SYSCALL_DEFINE3(fchown, unsigned int, fd, uid_t, user, gid_t, group)
- goto out_fput;
- dentry = file->f_path.dentry;
- audit_inode(NULL, dentry);
-- error = chown_common(dentry, user, group);
-+ error = chown_common(dentry, user, group, file->f_path.mnt);
- mnt_drop_write(file->f_path.mnt);
- out_fput:
- fput(file);
-@@ -1036,13 +1055,14 @@ long do_sys_open(int dfd, const char __user *filename, int flags, int mode)
- if (!IS_ERR(tmp)) {
- fd = get_unused_fd_flags(flags);
- if (fd >= 0) {
-- struct file *f = do_filp_open(dfd, tmp, flags, mode, 0);
-+ struct file *f = do_filp_open(dfd, tmp, flags, mode, 0);
- if (IS_ERR(f)) {
- put_unused_fd(fd);
- fd = PTR_ERR(f);
- } else {
- fsnotify_open(f->f_path.dentry);
- fd_install(fd, f);
-+ trace_do_sys_open(tmp, flags, mode);
- }
- }
- putname(tmp);
-diff --git a/fs/partitions/efi.c b/fs/partitions/efi.c
-index 6ab70f4..f4103d1 100644
---- a/fs/partitions/efi.c
-+++ b/fs/partitions/efi.c
-@@ -231,14 +231,14 @@ alloc_read_gpt_entries(struct block_device *bdev, gpt_header *gpt)
- if (!bdev || !gpt)
- return NULL;
-
-+ if (!le32_to_cpu(gpt->num_partition_entries))
-+ return NULL;
-+ pte = kcalloc(le32_to_cpu(gpt->num_partition_entries), le32_to_cpu(gpt->sizeof_partition_entry), GFP_KERNEL);
-+ if (!pte)
-+ return NULL;
-+
- count = le32_to_cpu(gpt->num_partition_entries) *
- le32_to_cpu(gpt->sizeof_partition_entry);
-- if (!count)
-- return NULL;
-- pte = kzalloc(count, GFP_KERNEL);
-- if (!pte)
-- return NULL;
--
- if (read_lba(bdev, le64_to_cpu(gpt->partition_entry_lba),
- (u8 *) pte,
- count) < count) {
-diff --git a/fs/partitions/ldm.c b/fs/partitions/ldm.c
-index dd6efdb..3babc6c 100644
---- a/fs/partitions/ldm.c
-+++ b/fs/partitions/ldm.c
-@@ -1311,6 +1311,7 @@ static bool ldm_frag_add (const u8 *data, int size, struct list_head *frags)
- ldm_error ("A VBLK claims to have %d parts.", num);
- return false;
- }
-+
- if (rec >= num) {
- ldm_error("REC value (%d) exceeds NUM value (%d)", rec, num);
- return false;
-@@ -1322,7 +1323,7 @@ static bool ldm_frag_add (const u8 *data, int size, struct list_head *frags)
- goto found;
- }
-
-- f = kmalloc (sizeof (*f) + size*num, GFP_KERNEL);
-+ f = kmalloc (size*num + sizeof (*f), GFP_KERNEL);
- if (!f) {
- ldm_crit ("Out of memory.");
- return false;
-diff --git a/fs/partitions/mac.c b/fs/partitions/mac.c
-index 5765198..7f8e9e0 100644
---- a/fs/partitions/mac.c
-+++ b/fs/partitions/mac.c
-@@ -59,11 +59,11 @@ int mac_partition(struct parsed_partitions *state, struct block_device *bdev)
- return 0; /* not a MacOS disk */
- }
- blocks_in_map = be32_to_cpu(part->map_count);
-- if (blocks_in_map < 0 || blocks_in_map >= DISK_MAX_PARTS) {
-- put_dev_sector(sect);
-- return 0;
-- }
- printk(" [mac]");
-+ if (blocks_in_map < 0 || blocks_in_map >= DISK_MAX_PARTS) {
-+ put_dev_sector(sect);
-+ return 0;
-+ }
- for (slot = 1; slot <= blocks_in_map; ++slot) {
- int pos = slot * secsize;
- put_dev_sector(sect);
-diff --git a/fs/pipe.c b/fs/pipe.c
-index d0cc080..8a6f211 100644
---- a/fs/pipe.c
-+++ b/fs/pipe.c
-@@ -401,9 +401,9 @@ redo:
- }
- if (bufs) /* More to do? */
- continue;
-- if (!pipe->writers)
-+ if (!atomic_read(&pipe->writers))
- break;
-- if (!pipe->waiting_writers) {
-+ if (!atomic_read(&pipe->waiting_writers)) {
- /* syscall merging: Usually we must not sleep
- * if O_NONBLOCK is set, or if we got some data.
- * But if a writer sleeps in kernel space, then
-@@ -462,7 +462,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
- mutex_lock(&inode->i_mutex);
- pipe = inode->i_pipe;
-
-- if (!pipe->readers) {
-+ if (!atomic_read(&pipe->readers)) {
- send_sig(SIGPIPE, current, 0);
- ret = -EPIPE;
- goto out;
-@@ -511,7 +511,7 @@ redo1:
- for (;;) {
- int bufs;
-
-- if (!pipe->readers) {
-+ if (!atomic_read(&pipe->readers)) {
- send_sig(SIGPIPE, current, 0);
- if (!ret)
- ret = -EPIPE;
-@@ -597,9 +597,9 @@ redo2:
- kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
- do_wakeup = 0;
- }
-- pipe->waiting_writers++;
-+ atomic_inc(&pipe->waiting_writers);
- pipe_wait(pipe);
-- pipe->waiting_writers--;
-+ atomic_dec(&pipe->waiting_writers);
- }
- out:
- mutex_unlock(&inode->i_mutex);
-@@ -666,7 +666,7 @@ pipe_poll(struct file *filp, poll_table *wait)
- mask = 0;
- if (filp->f_mode & FMODE_READ) {
- mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0;
-- if (!pipe->writers && filp->f_version != pipe->w_counter)
-+ if (!atomic_read(&pipe->writers) && filp->f_version != pipe->w_counter)
- mask |= POLLHUP;
- }
-
-@@ -676,7 +676,7 @@ pipe_poll(struct file *filp, poll_table *wait)
- * Most Unices do not set POLLERR for FIFOs but on Linux they
- * behave exactly like pipes for poll().
- */
-- if (!pipe->readers)
-+ if (!atomic_read(&pipe->readers))
- mask |= POLLERR;
- }
-
-@@ -690,10 +690,10 @@ pipe_release(struct inode *inode, int decr, int decw)
-
- mutex_lock(&inode->i_mutex);
- pipe = inode->i_pipe;
-- pipe->readers -= decr;
-- pipe->writers -= decw;
-+ atomic_sub(decr, &pipe->readers);
-+ atomic_sub(decw, &pipe->writers);
-
-- if (!pipe->readers && !pipe->writers) {
-+ if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers)) {
- free_pipe_info(inode);
- } else {
- wake_up_interruptible_sync(&pipe->wait);
-@@ -783,7 +783,7 @@ pipe_read_open(struct inode *inode, struct file *filp)
-
- if (inode->i_pipe) {
- ret = 0;
-- inode->i_pipe->readers++;
-+ atomic_inc(&inode->i_pipe->readers);
- }
-
- mutex_unlock(&inode->i_mutex);
-@@ -800,7 +800,7 @@ pipe_write_open(struct inode *inode, struct file *filp)
-
- if (inode->i_pipe) {
- ret = 0;
-- inode->i_pipe->writers++;
-+ atomic_inc(&inode->i_pipe->writers);
- }
-
- mutex_unlock(&inode->i_mutex);
-@@ -818,9 +818,9 @@ pipe_rdwr_open(struct inode *inode, struct file *filp)
- if (inode->i_pipe) {
- ret = 0;
- if (filp->f_mode & FMODE_READ)
-- inode->i_pipe->readers++;
-+ atomic_inc(&inode->i_pipe->readers);
- if (filp->f_mode & FMODE_WRITE)
-- inode->i_pipe->writers++;
-+ atomic_inc(&inode->i_pipe->writers);
- }
-
- mutex_unlock(&inode->i_mutex);
-@@ -905,7 +905,7 @@ void free_pipe_info(struct inode *inode)
- inode->i_pipe = NULL;
- }
-
--static struct vfsmount *pipe_mnt __read_mostly;
-+struct vfsmount *pipe_mnt __read_mostly;
- static int pipefs_delete_dentry(struct dentry *dentry)
- {
- /*
-@@ -945,7 +945,8 @@ static struct inode * get_pipe_inode(void)
- goto fail_iput;
- inode->i_pipe = pipe;
-
-- pipe->readers = pipe->writers = 1;
-+ atomic_set(&pipe->readers, 1);
-+ atomic_set(&pipe->writers, 1);
- inode->i_fop = &rdwr_pipefifo_fops;
-
- /*
-diff --git a/fs/proc/Kconfig b/fs/proc/Kconfig
-index 50f8f06..c5755df 100644
---- a/fs/proc/Kconfig
-+++ b/fs/proc/Kconfig
-@@ -30,12 +30,12 @@ config PROC_FS
-
- config PROC_KCORE
- bool "/proc/kcore support" if !ARM
-- depends on PROC_FS && MMU
-+ depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
-
- config PROC_VMCORE
- bool "/proc/vmcore support (EXPERIMENTAL)"
-- depends on PROC_FS && CRASH_DUMP
-- default y
-+ depends on PROC_FS && CRASH_DUMP && !GRKERNSEC
-+ default n
- help
- Exports the dump image of crashed kernel in ELF format.
-
-@@ -59,8 +59,8 @@ config PROC_SYSCTL
- limited in memory.
-
- config PROC_PAGE_MONITOR
-- default y
-- depends on PROC_FS && MMU
-+ default n
-+ depends on PROC_FS && MMU && !GRKERNSEC
- bool "Enable /proc page monitoring" if EMBEDDED
- help
- Various /proc files exist to monitor process memory utilization:
-diff --git a/fs/proc/array.c b/fs/proc/array.c
-index c5ef152..28c94f7 100644
---- a/fs/proc/array.c
-+++ b/fs/proc/array.c
-@@ -60,6 +60,7 @@
- #include <linux/tty.h>
- #include <linux/string.h>
- #include <linux/mman.h>
-+#include <linux/grsecurity.h>
- #include <linux/proc_fs.h>
- #include <linux/ioport.h>
- #include <linux/uaccess.h>
-@@ -321,6 +322,21 @@ static inline void task_context_switch_counts(struct seq_file *m,
- p->nivcsw);
- }
-
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+static inline void task_pax(struct seq_file *m, struct task_struct *p)
-+{
-+ if (p->mm)
-+ seq_printf(m, "PaX:\t%c%c%c%c%c\n",
-+ p->mm->pax_flags & MF_PAX_PAGEEXEC ? 'P' : 'p',
-+ p->mm->pax_flags & MF_PAX_EMUTRAMP ? 'E' : 'e',
-+ p->mm->pax_flags & MF_PAX_MPROTECT ? 'M' : 'm',
-+ p->mm->pax_flags & MF_PAX_RANDMMAP ? 'R' : 'r',
-+ p->mm->pax_flags & MF_PAX_SEGMEXEC ? 'S' : 's');
-+ else
-+ seq_printf(m, "PaX:\t-----\n");
-+}
-+#endif
-+
- int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
- struct pid *pid, struct task_struct *task)
- {
-@@ -337,9 +353,24 @@ int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
- task_cap(m, task);
- cpuset_task_status_allowed(m, task);
- task_context_switch_counts(m, task);
-+
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+ task_pax(m, task);
-+#endif
-+
-+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
-+ task_grsec_rbac(m, task);
-+#endif
-+
- return 0;
- }
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
-+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
-+ _mm->pax_flags & MF_PAX_SEGMEXEC))
-+#endif
-+
- static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
- struct pid *pid, struct task_struct *task, int whole)
- {
-@@ -358,9 +389,18 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
- cputime_t cutime, cstime, utime, stime;
- cputime_t cgtime, gtime;
- unsigned long rsslim = 0;
-- char tcomm[sizeof(task->comm)];
-+ char tcomm[sizeof(task->comm)] = { 0 };
- unsigned long flags;
-
-+ pax_track_stack();
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ if (current->exec_id != m->exec_id) {
-+ gr_log_badprocpid("stat");
-+ return 0;
-+ }
-+#endif
-+
- state = *get_task_state(task);
- vsize = eip = esp = 0;
- permitted = ptrace_may_access(task, PTRACE_MODE_READ);
-@@ -433,6 +473,19 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
- gtime = task_gtime(task);
- }
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ if (PAX_RAND_FLAGS(mm)) {
-+ eip = 0;
-+ esp = 0;
-+ wchan = 0;
-+ }
-+#endif
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ wchan = 0;
-+ eip =0;
-+ esp =0;
-+#endif
-+
- /* scale priority and nice values from timeslices to -20..20 */
- /* to make it look like a "normal" Unix priority/nice value */
- priority = task_prio(task);
-@@ -473,9 +526,15 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
- vsize,
- mm ? get_mm_rss(mm) : 0,
- rsslim,
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->start_code : 1) : 0),
-+ PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->end_code : 1) : 0),
-+ PAX_RAND_FLAGS(mm) ? 0 : ((permitted && mm) ? mm->start_stack : 0),
-+#else
- mm ? (permitted ? mm->start_code : 1) : 0,
- mm ? (permitted ? mm->end_code : 1) : 0,
- (permitted && mm) ? mm->start_stack : 0,
-+#endif
- esp,
- eip,
- /* The signal information here is obsolete.
-@@ -517,8 +576,16 @@ int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
- struct pid *pid, struct task_struct *task)
- {
- int size = 0, resident = 0, shared = 0, text = 0, lib = 0, data = 0;
-- struct mm_struct *mm = get_task_mm(task);
-+ struct mm_struct *mm;
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ if (current->exec_id != m->exec_id) {
-+ gr_log_badprocpid("statm");
-+ return 0;
-+ }
-+#endif
-+
-+ mm = get_task_mm(task);
- if (mm) {
- size = task_statm(mm, &shared, &text, &data, &resident);
- mmput(mm);
-@@ -528,3 +595,18 @@ int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
-
- return 0;
- }
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
-+int proc_pid_ipaddr(struct task_struct *task, char *buffer)
-+{
-+ u32 curr_ip = 0;
-+ unsigned long flags;
-+
-+ if (lock_task_sighand(task, &flags)) {
-+ curr_ip = task->signal->curr_ip;
-+ unlock_task_sighand(task, &flags);
-+ }
-+
-+ return sprintf(buffer, "%pI4\n", &curr_ip);
-+}
-+#endif
-diff --git a/fs/proc/base.c b/fs/proc/base.c
-index 67f7dc0..a6663de 100644
---- a/fs/proc/base.c
-+++ b/fs/proc/base.c
-@@ -102,6 +102,22 @@ struct pid_entry {
- union proc_op op;
- };
-
-+struct getdents_callback {
-+ struct linux_dirent __user * current_dir;
-+ struct linux_dirent __user * previous;
-+ struct file * file;
-+ int count;
-+ int error;
-+};
-+
-+static int gr_fake_filldir(void * __buf, const char *name, int namlen,
-+ loff_t offset, u64 ino, unsigned int d_type)
-+{
-+ struct getdents_callback * buf = (struct getdents_callback *) __buf;
-+ buf->error = -EINVAL;
-+ return 0;
-+}
-+
- #define NOD(NAME, MODE, IOP, FOP, OP) { \
- .name = (NAME), \
- .len = sizeof(NAME) - 1, \
-@@ -213,6 +229,9 @@ static int check_mem_permission(struct task_struct *task)
- if (task == current)
- return 0;
-
-+ if (gr_handle_proc_ptrace(task) || gr_acl_handle_procpidmem(task))
-+ return -EPERM;
-+
- /*
- * If current is actively ptrace'ing, and would also be
- * permitted to freshly attach with ptrace now, permit it.
-@@ -236,7 +255,7 @@ struct mm_struct *mm_for_maps(struct task_struct *task)
- {
- struct mm_struct *mm;
-
-- if (mutex_lock_killable(&task->cred_guard_mutex))
-+ if (mutex_lock_killable(&task->signal->cred_guard_mutex))
- return NULL;
-
- mm = get_task_mm(task);
-@@ -245,7 +264,7 @@ struct mm_struct *mm_for_maps(struct task_struct *task)
- mmput(mm);
- mm = NULL;
- }
-- mutex_unlock(&task->cred_guard_mutex);
-+ mutex_unlock(&task->signal->cred_guard_mutex);
-
- return mm;
- }
-@@ -260,6 +279,9 @@ static int proc_pid_cmdline(struct task_struct *task, char * buffer)
- if (!mm->arg_end)
- goto out_mm; /* Shh! No looking before we're done */
-
-+ if (gr_acl_handle_procpidmem(task))
-+ goto out_mm;
-+
- len = mm->arg_end - mm->arg_start;
-
- if (len > PAGE_SIZE)
-@@ -287,12 +309,28 @@ out:
- return res;
- }
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
-+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
-+ _mm->pax_flags & MF_PAX_SEGMEXEC))
-+#endif
-+
- static int proc_pid_auxv(struct task_struct *task, char *buffer)
- {
- int res = 0;
- struct mm_struct *mm = get_task_mm(task);
- if (mm) {
- unsigned int nwords = 0;
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ /* allow if we're currently ptracing this task */
-+ if (PAX_RAND_FLAGS(mm) &&
-+ (!(task->ptrace & PT_PTRACED) || (task->parent != current))) {
-+ mmput(mm);
-+ return 0;
-+ }
-+#endif
-+
- do {
- nwords += 2;
- } while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
-@@ -306,7 +344,7 @@ static int proc_pid_auxv(struct task_struct *task, char *buffer)
- }
-
-
--#ifdef CONFIG_KALLSYMS
-+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
- /*
- * Provides a wchan file via kallsyms in a proper one-value-per-file format.
- * Returns the resolved symbol. If that fails, simply return the address.
-@@ -330,11 +368,11 @@ static int proc_pid_wchan(struct task_struct *task, char *buffer)
-
- static int lock_trace(struct task_struct *task)
- {
-- int err = mutex_lock_killable(&task->cred_guard_mutex);
-+ int err = mutex_lock_killable(&task->signal->cred_guard_mutex);
- if (err)
- return err;
- if (!ptrace_may_access(task, PTRACE_MODE_ATTACH)) {
-- mutex_unlock(&task->cred_guard_mutex);
-+ mutex_unlock(&task->signal->cred_guard_mutex);
- return -EPERM;
- }
- return 0;
-@@ -342,10 +380,10 @@ static int lock_trace(struct task_struct *task)
-
- static void unlock_trace(struct task_struct *task)
- {
-- mutex_unlock(&task->cred_guard_mutex);
-+ mutex_unlock(&task->signal->cred_guard_mutex);
- }
-
--#ifdef CONFIG_STACKTRACE
-+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
-
- #define MAX_STACK_TRACE_DEPTH 64
-
-@@ -545,7 +583,7 @@ static int proc_pid_limits(struct task_struct *task, char *buffer)
- return count;
- }
-
--#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
-+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
- static int proc_pid_syscall(struct task_struct *task, char *buffer)
- {
- long nr;
-@@ -574,7 +612,7 @@ static int proc_pid_syscall(struct task_struct *task, char *buffer)
- /************************************************************************/
-
- /* permission checks */
--static int proc_fd_access_allowed(struct inode *inode)
-+static int proc_fd_access_allowed(struct inode *inode, unsigned int log)
- {
- struct task_struct *task;
- int allowed = 0;
-@@ -584,7 +622,10 @@ static int proc_fd_access_allowed(struct inode *inode)
- */
- task = get_proc_task(inode);
- if (task) {
-- allowed = ptrace_may_access(task, PTRACE_MODE_READ);
-+ if (log)
-+ allowed = ptrace_may_access_log(task, PTRACE_MODE_READ);
-+ else
-+ allowed = ptrace_may_access(task, PTRACE_MODE_READ);
- put_task_struct(task);
- }
- return allowed;
-@@ -806,9 +847,16 @@ static const struct file_operations proc_single_file_operations = {
- static int mem_open(struct inode* inode, struct file* file)
- {
- file->private_data = (void*)((long)current->self_exec_id);
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ file->f_version = current->exec_id;
-+#endif
-+
- return 0;
- }
-
-+static int task_dumpable(struct task_struct *task);
-+
- static ssize_t mem_read(struct file * file, char __user * buf,
- size_t count, loff_t *ppos)
- {
-@@ -818,6 +866,13 @@ static ssize_t mem_read(struct file * file, char __user * buf,
- int ret = -ESRCH;
- struct mm_struct *mm;
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ if (file->f_version != current->exec_id) {
-+ gr_log_badprocpid("mem");
-+ return 0;
-+ }
-+#endif
-+
- if (!task)
- goto out_no_task;
-
-@@ -960,9 +1015,18 @@ static ssize_t environ_read(struct file *file, char __user *buf,
- int ret = -ESRCH;
- struct mm_struct *mm;
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ if (file->f_version != current->exec_id) {
-+ gr_log_badprocpid("environ");
-+ return ret;
-+ }
-+#endif
- if (!task)
- goto out_no_task;
-
-+ if (gr_acl_handle_procpidmem(task))
-+ goto out;
-+
- if (!ptrace_may_access(task, PTRACE_MODE_READ))
- goto out;
-
-@@ -978,15 +1042,16 @@ static ssize_t environ_read(struct file *file, char __user *buf,
- goto out_free;
-
- while (count > 0) {
-- int this_len, retval, max_len;
-+ size_t this_len, max_len;
-+ int retval;
-+
-+ if (src >= (mm->env_end - mm->env_start))
-+ break;
-
- this_len = mm->env_end - (mm->env_start + src);
-
-- if (this_len <= 0)
-- break;
--
-- max_len = (count > PAGE_SIZE) ? PAGE_SIZE : count;
-- this_len = (this_len > max_len) ? max_len : this_len;
-+ max_len = min_t(size_t, PAGE_SIZE, count);
-+ this_len = min(max_len, this_len);
-
- retval = access_process_vm(task, (mm->env_start + src),
- page, this_len, 0);
-@@ -1019,6 +1084,7 @@ out_no_task:
-
- static const struct file_operations proc_environ_operations = {
- .read = environ_read,
-+ .open = mem_open,
- };
-
- static ssize_t oom_adjust_read(struct file *file, char __user *buf,
-@@ -1377,7 +1443,7 @@ static void *proc_pid_follow_link(struct dentry *dentry, struct nameidata *nd)
- path_put(&nd->path);
-
- /* Are we allowed to snoop on the tasks file descriptors? */
-- if (!proc_fd_access_allowed(inode))
-+ if (!proc_fd_access_allowed(inode,0))
- goto out;
-
- error = PROC_I(inode)->op.proc_get_link(inode, &nd->path);
-@@ -1417,8 +1483,18 @@ static int proc_pid_readlink(struct dentry * dentry, char __user * buffer, int b
- struct path path;
-
- /* Are we allowed to snoop on the tasks file descriptors? */
-- if (!proc_fd_access_allowed(inode))
-- goto out;
-+ /* logging this is needed for learning on chromium to work properly,
-+ but we don't want to flood the logs from 'ps' which does a readlink
-+ on /proc/fd/2 of tasks in the listing, nor do we want 'ps' to learn
-+ CAP_SYS_PTRACE as it's not necessary for its basic functionality
-+ */
-+ if (dentry->d_name.name[0] == '2' && dentry->d_name.name[1] == '\0') {
-+ if (!proc_fd_access_allowed(inode,0))
-+ goto out;
-+ } else {
-+ if (!proc_fd_access_allowed(inode,1))
-+ goto out;
-+ }
-
- error = PROC_I(inode)->op.proc_get_link(inode, &path);
- if (error)
-@@ -1483,7 +1559,11 @@ static struct inode *proc_pid_make_inode(struct super_block * sb, struct task_st
- rcu_read_lock();
- cred = __task_cred(task);
- inode->i_uid = cred->euid;
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+ inode->i_gid = grsec_proc_gid;
-+#else
- inode->i_gid = cred->egid;
-+#endif
- rcu_read_unlock();
- }
- security_task_to_inode(task, inode);
-@@ -1501,6 +1581,9 @@ static int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat
- struct inode *inode = dentry->d_inode;
- struct task_struct *task;
- const struct cred *cred;
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ const struct cred *tmpcred = current_cred();
-+#endif
-
- generic_fillattr(inode, stat);
-
-@@ -1508,13 +1591,41 @@ static int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat
- stat->uid = 0;
- stat->gid = 0;
- task = pid_task(proc_pid(inode), PIDTYPE_PID);
-+
-+ if (task && (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))) {
-+ rcu_read_unlock();
-+ return -ENOENT;
-+ }
-+
- if (task) {
-+ cred = __task_cred(task);
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ if (!tmpcred->uid || (tmpcred->uid == cred->uid)
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+ || in_group_p(grsec_proc_gid)
-+#endif
-+ ) {
-+#endif
- if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
-+#endif
- task_dumpable(task)) {
-- cred = __task_cred(task);
- stat->uid = cred->euid;
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+ stat->gid = grsec_proc_gid;
-+#else
- stat->gid = cred->egid;
-+#endif
- }
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ } else {
-+ rcu_read_unlock();
-+ return -ENOENT;
-+ }
-+#endif
- }
- rcu_read_unlock();
- return 0;
-@@ -1545,11 +1656,20 @@ static int pid_revalidate(struct dentry *dentry, struct nameidata *nd)
-
- if (task) {
- if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
-+#endif
- task_dumpable(task)) {
- rcu_read_lock();
- cred = __task_cred(task);
- inode->i_uid = cred->euid;
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+ inode->i_gid = grsec_proc_gid;
-+#else
- inode->i_gid = cred->egid;
-+#endif
- rcu_read_unlock();
- } else {
- inode->i_uid = 0;
-@@ -1670,7 +1790,8 @@ static int proc_fd_info(struct inode *inode, struct path *path, char *info)
- int fd = proc_fd(inode);
-
- if (task) {
-- files = get_files_struct(task);
-+ if (!gr_acl_handle_procpidmem(task))
-+ files = get_files_struct(task);
- put_task_struct(task);
- }
- if (files) {
-@@ -1922,12 +2043,22 @@ static const struct file_operations proc_fd_operations = {
- static int proc_fd_permission(struct inode *inode, int mask)
- {
- int rv;
-+ struct task_struct *task;
-
- rv = generic_permission(inode, mask, NULL);
-- if (rv == 0)
-- return 0;
-+
- if (task_pid(current) == proc_pid(inode))
- rv = 0;
-+
-+ task = get_proc_task(inode);
-+ if (task == NULL)
-+ return rv;
-+
-+ if (gr_acl_handle_procpidmem(task))
-+ rv = -EACCES;
-+
-+ put_task_struct(task);
-+
- return rv;
- }
-
-@@ -2036,6 +2167,9 @@ static struct dentry *proc_pident_lookup(struct inode *dir,
- if (!task)
- goto out_no_task;
-
-+ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
-+ goto out;
-+
- /*
- * Yes, it does not scale. And it should not. Don't add
- * new entries into /proc/<tgid>/ without very good reasons.
-@@ -2080,6 +2214,9 @@ static int proc_pident_readdir(struct file *filp,
- if (!task)
- goto out_no_task;
-
-+ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
-+ goto out;
-+
- ret = 0;
- i = filp->f_pos;
- switch (i) {
-@@ -2171,14 +2308,14 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf,
- goto out_free;
-
- /* Guard against adverse ptrace interaction */
-- length = mutex_lock_interruptible(&task->cred_guard_mutex);
-+ length = mutex_lock_interruptible(&task->signal->cred_guard_mutex);
- if (length < 0)
- goto out_free;
-
- length = security_setprocattr(task,
- (char*)file->f_path.dentry->d_name.name,
- (void*)page, count);
-- mutex_unlock(&task->cred_guard_mutex);
-+ mutex_unlock(&task->signal->cred_guard_mutex);
- out_free:
- free_page((unsigned long) page);
- out:
-@@ -2347,7 +2484,7 @@ static void *proc_self_follow_link(struct dentry *dentry, struct nameidata *nd)
- static void proc_self_put_link(struct dentry *dentry, struct nameidata *nd,
- void *cookie)
- {
-- char *s = nd_get_link(nd);
-+ const char *s = nd_get_link(nd);
- if (!IS_ERR(s))
- __putname(s);
- }
-@@ -2480,6 +2617,11 @@ static int do_io_accounting(struct task_struct *task, char *buffer, int whole)
- {
- struct task_io_accounting acct = task->ioac;
- unsigned long flags;
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ u64 saved_exec_id;
-+
-+ saved_exec_id = task->exec_id;
-+#endif
-
- if (!ptrace_may_access(task, PTRACE_MODE_READ))
- return -EACCES;
-@@ -2493,6 +2635,13 @@ static int do_io_accounting(struct task_struct *task, char *buffer, int whole)
-
- unlock_task_sighand(task, &flags);
- }
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ /* clear the info if an exec occured during its processing*/
-+ if (saved_exec_id != task->exec_id)
-+ memset(&acct, 0, sizeof(acct));
-+#endif
-+
- return sprintf(buffer,
- "rchar: %llu\n"
- "wchar: %llu\n"
-@@ -2524,12 +2673,8 @@ static int proc_tgid_io_accounting(struct task_struct *task, char *buffer)
- static int proc_pid_personality(struct seq_file *m, struct pid_namespace *ns,
- struct pid *pid, struct task_struct *task)
- {
-- int err = lock_trace(task);
-- if (!err) {
-- seq_printf(m, "%08x\n", task->personality);
-- unlock_trace(task);
-- }
-- return err;
-+ seq_printf(m, "%08x\n", task->personality);
-+ return 0;
- }
-
- /*
-@@ -2553,7 +2698,7 @@ static const struct pid_entry tgid_base_stuff[] = {
- #ifdef CONFIG_SCHED_DEBUG
- REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations),
- #endif
--#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
-+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
- INF("syscall", S_IRUGO, proc_pid_syscall),
- #endif
- INF("cmdline", S_IRUGO, proc_pid_cmdline),
-@@ -2578,10 +2723,10 @@ static const struct pid_entry tgid_base_stuff[] = {
- #ifdef CONFIG_SECURITY
- DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
- #endif
--#ifdef CONFIG_KALLSYMS
-+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
- INF("wchan", S_IRUGO, proc_pid_wchan),
- #endif
--#ifdef CONFIG_STACKTRACE
-+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
- ONE("stack", S_IRUGO, proc_pid_stack),
- #endif
- #ifdef CONFIG_SCHEDSTATS
-@@ -2611,6 +2756,9 @@ static const struct pid_entry tgid_base_stuff[] = {
- #ifdef CONFIG_TASK_IO_ACCOUNTING
- INF("io", S_IRUSR, proc_tgid_io_accounting),
- #endif
-+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
-+ INF("ipaddr", S_IRUSR, proc_pid_ipaddr),
-+#endif
- };
-
- static int proc_tgid_base_readdir(struct file * filp,
-@@ -2735,7 +2883,14 @@ static struct dentry *proc_pid_instantiate(struct inode *dir,
- if (!inode)
- goto out;
-
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+ inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ inode->i_gid = grsec_proc_gid;
-+ inode->i_mode = S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP;
-+#else
- inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
-+#endif
- inode->i_op = &proc_tgid_base_inode_operations;
- inode->i_fop = &proc_tgid_base_operations;
- inode->i_flags|=S_IMMUTABLE;
-@@ -2777,7 +2932,11 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, struct
- if (!task)
- goto out;
-
-+ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
-+ goto out_put_task;
-+
- result = proc_pid_instantiate(dir, dentry, task, NULL);
-+out_put_task:
- put_task_struct(task);
- out:
- return result;
-@@ -2842,6 +3001,11 @@ int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
- {
- unsigned int nr;
- struct task_struct *reaper;
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ const struct cred *tmpcred = current_cred();
-+ const struct cred *itercred;
-+#endif
-+ filldir_t __filldir = filldir;
- struct tgid_iter iter;
- struct pid_namespace *ns;
-
-@@ -2865,8 +3029,27 @@ int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
- for (iter = next_tgid(ns, iter);
- iter.task;
- iter.tgid += 1, iter = next_tgid(ns, iter)) {
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ rcu_read_lock();
-+ itercred = __task_cred(iter.task);
-+#endif
-+ if (gr_pid_is_chrooted(iter.task) || gr_check_hidden_task(iter.task)
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ || (tmpcred->uid && (itercred->uid != tmpcred->uid)
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+ && !in_group_p(grsec_proc_gid)
-+#endif
-+ )
-+#endif
-+ )
-+ __filldir = &gr_fake_filldir;
-+ else
-+ __filldir = filldir;
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ rcu_read_unlock();
-+#endif
- filp->f_pos = iter.tgid + TGID_OFFSET;
-- if (proc_pid_fill_cache(filp, dirent, filldir, iter) < 0) {
-+ if (proc_pid_fill_cache(filp, dirent, __filldir, iter) < 0) {
- put_task_struct(iter.task);
- goto out;
- }
-@@ -2892,7 +3075,7 @@ static const struct pid_entry tid_base_stuff[] = {
- #ifdef CONFIG_SCHED_DEBUG
- REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations),
- #endif
--#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
-+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
- INF("syscall", S_IRUGO, proc_pid_syscall),
- #endif
- INF("cmdline", S_IRUGO, proc_pid_cmdline),
-@@ -2916,10 +3099,10 @@ static const struct pid_entry tid_base_stuff[] = {
- #ifdef CONFIG_SECURITY
- DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
- #endif
--#ifdef CONFIG_KALLSYMS
-+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
- INF("wchan", S_IRUGO, proc_pid_wchan),
- #endif
--#ifdef CONFIG_STACKTRACE
-+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
- ONE("stack", S_IRUGO, proc_pid_stack),
- #endif
- #ifdef CONFIG_SCHEDSTATS
-diff --git a/fs/proc/cmdline.c b/fs/proc/cmdline.c
-index 82676e3..5f8518a 100644
---- a/fs/proc/cmdline.c
-+++ b/fs/proc/cmdline.c
-@@ -23,7 +23,11 @@ static const struct file_operations cmdline_proc_fops = {
-
- static int __init proc_cmdline_init(void)
- {
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+ proc_create_grsec("cmdline", 0, NULL, &cmdline_proc_fops);
-+#else
- proc_create("cmdline", 0, NULL, &cmdline_proc_fops);
-+#endif
- return 0;
- }
- module_init(proc_cmdline_init);
-diff --git a/fs/proc/devices.c b/fs/proc/devices.c
-index 59ee7da..469b4b6 100644
---- a/fs/proc/devices.c
-+++ b/fs/proc/devices.c
-@@ -64,7 +64,11 @@ static const struct file_operations proc_devinfo_operations = {
-
- static int __init proc_devices_init(void)
- {
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+ proc_create_grsec("devices", 0, NULL, &proc_devinfo_operations);
-+#else
- proc_create("devices", 0, NULL, &proc_devinfo_operations);
-+#endif
- return 0;
- }
- module_init(proc_devices_init);
-diff --git a/fs/proc/inode.c b/fs/proc/inode.c
-index d78ade3..6820c1b 100644
---- a/fs/proc/inode.c
-+++ b/fs/proc/inode.c
-@@ -18,12 +18,19 @@
- #include <linux/module.h>
- #include <linux/smp_lock.h>
- #include <linux/sysctl.h>
-+#include <linux/grsecurity.h>
-
- #include <asm/system.h>
- #include <asm/uaccess.h>
-
- #include "internal.h"
-
-+#ifdef CONFIG_PROC_SYSCTL
-+extern const struct inode_operations proc_sys_inode_operations;
-+extern const struct inode_operations proc_sys_dir_operations;
-+#endif
-+
-+
- struct proc_dir_entry *de_get(struct proc_dir_entry *de)
- {
- atomic_inc(&de->count);
-@@ -62,6 +69,13 @@ static void proc_delete_inode(struct inode *inode)
- de_put(de);
- if (PROC_I(inode)->sysctl)
- sysctl_head_put(PROC_I(inode)->sysctl);
-+
-+#ifdef CONFIG_PROC_SYSCTL
-+ if (inode->i_op == &proc_sys_inode_operations ||
-+ inode->i_op == &proc_sys_dir_operations)
-+ gr_handle_delete(inode->i_ino, inode->i_sb->s_dev);
-+#endif
-+
- clear_inode(inode);
- }
-
-@@ -457,7 +471,11 @@ struct inode *proc_get_inode(struct super_block *sb, unsigned int ino,
- if (de->mode) {
- inode->i_mode = de->mode;
- inode->i_uid = de->uid;
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+ inode->i_gid = grsec_proc_gid;
-+#else
- inode->i_gid = de->gid;
-+#endif
- }
- if (de->size)
- inode->i_size = de->size;
-diff --git a/fs/proc/internal.h b/fs/proc/internal.h
-index 753ca37..26bcf3b 100644
---- a/fs/proc/internal.h
-+++ b/fs/proc/internal.h
-@@ -51,6 +51,9 @@ extern int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
- struct pid *pid, struct task_struct *task);
- extern int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
- struct pid *pid, struct task_struct *task);
-+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
-+extern int proc_pid_ipaddr(struct task_struct *task, char *buffer);
-+#endif
- extern loff_t mem_lseek(struct file *file, loff_t offset, int orig);
-
- extern const struct file_operations proc_maps_operations;
-diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
-index b442dac..aab29cb 100644
---- a/fs/proc/kcore.c
-+++ b/fs/proc/kcore.c
-@@ -320,6 +320,8 @@ static void elf_kcore_store_hdr(char *bufp, int nphdr, int dataoff)
- off_t offset = 0;
- struct kcore_list *m;
-
-+ pax_track_stack();
-+
- /* setup ELF header */
- elf = (struct elfhdr *) bufp;
- bufp += sizeof(struct elfhdr);
-@@ -477,9 +479,10 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
- * the addresses in the elf_phdr on our list.
- */
- start = kc_offset_to_vaddr(*fpos - elf_buflen);
-- if ((tsz = (PAGE_SIZE - (start & ~PAGE_MASK))) > buflen)
-+ tsz = PAGE_SIZE - (start & ~PAGE_MASK);
-+ if (tsz > buflen)
- tsz = buflen;
--
-+
- while (buflen) {
- struct kcore_list *m;
-
-@@ -508,20 +511,23 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
- kfree(elf_buf);
- } else {
- if (kern_addr_valid(start)) {
-- unsigned long n;
-+ char *elf_buf;
-+ mm_segment_t oldfs;
-
-- n = copy_to_user(buffer, (char *)start, tsz);
-- /*
-- * We cannot distingush between fault on source
-- * and fault on destination. When this happens
-- * we clear too and hope it will trigger the
-- * EFAULT again.
-- */
-- if (n) {
-- if (clear_user(buffer + tsz - n,
-- n))
-+ elf_buf = kmalloc(tsz, GFP_KERNEL);
-+ if (!elf_buf)
-+ return -ENOMEM;
-+ oldfs = get_fs();
-+ set_fs(KERNEL_DS);
-+ if (!__copy_from_user(elf_buf, (const void __user *)start, tsz)) {
-+ set_fs(oldfs);
-+ if (copy_to_user(buffer, elf_buf, tsz)) {
-+ kfree(elf_buf);
- return -EFAULT;
-+ }
- }
-+ set_fs(oldfs);
-+ kfree(elf_buf);
- } else {
- if (clear_user(buffer, tsz))
- return -EFAULT;
-@@ -541,6 +547,9 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
-
- static int open_kcore(struct inode *inode, struct file *filp)
- {
-+#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
-+ return -EPERM;
-+#endif
- if (!capable(CAP_SYS_RAWIO))
- return -EPERM;
- if (kcore_need_update)
-diff --git a/fs/proc/kmsg.c b/fs/proc/kmsg.c
-index 7ca7834..cfe90a4 100644
---- a/fs/proc/kmsg.c
-+++ b/fs/proc/kmsg.c
-@@ -12,37 +12,37 @@
- #include <linux/poll.h>
- #include <linux/proc_fs.h>
- #include <linux/fs.h>
-+#include <linux/syslog.h>
-
- #include <asm/uaccess.h>
- #include <asm/io.h>
-
- extern wait_queue_head_t log_wait;
-
--extern int do_syslog(int type, char __user *bug, int count);
--
- static int kmsg_open(struct inode * inode, struct file * file)
- {
-- return do_syslog(1,NULL,0);
-+ return do_syslog(SYSLOG_ACTION_OPEN, NULL, 0, SYSLOG_FROM_FILE);
- }
-
- static int kmsg_release(struct inode * inode, struct file * file)
- {
-- (void) do_syslog(0,NULL,0);
-+ (void) do_syslog(SYSLOG_ACTION_CLOSE, NULL, 0, SYSLOG_FROM_FILE);
- return 0;
- }
-
- static ssize_t kmsg_read(struct file *file, char __user *buf,
- size_t count, loff_t *ppos)
- {
-- if ((file->f_flags & O_NONBLOCK) && !do_syslog(9, NULL, 0))
-+ if ((file->f_flags & O_NONBLOCK) &&
-+ !do_syslog(SYSLOG_ACTION_SIZE_UNREAD, NULL, 0, SYSLOG_FROM_FILE))
- return -EAGAIN;
-- return do_syslog(2, buf, count);
-+ return do_syslog(SYSLOG_ACTION_READ, buf, count, SYSLOG_FROM_FILE);
- }
-
- static unsigned int kmsg_poll(struct file *file, poll_table *wait)
- {
- poll_wait(file, &log_wait, wait);
-- if (do_syslog(9, NULL, 0))
-+ if (do_syslog(SYSLOG_ACTION_SIZE_UNREAD, NULL, 0, SYSLOG_FROM_FILE))
- return POLLIN | POLLRDNORM;
- return 0;
- }
-diff --git a/fs/proc/meminfo.c b/fs/proc/meminfo.c
-index a65239c..ad1182a 100644
---- a/fs/proc/meminfo.c
-+++ b/fs/proc/meminfo.c
-@@ -29,6 +29,8 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
- unsigned long pages[NR_LRU_LISTS];
- int lru;
-
-+ pax_track_stack();
-+
- /*
- * display in kilobytes.
- */
-@@ -149,7 +151,7 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
- vmi.used >> 10,
- vmi.largest_chunk >> 10
- #ifdef CONFIG_MEMORY_FAILURE
-- ,atomic_long_read(&mce_bad_pages) << (PAGE_SHIFT - 10)
-+ ,atomic_long_read_unchecked(&mce_bad_pages) << (PAGE_SHIFT - 10)
- #endif
- );
-
-diff --git a/fs/proc/nommu.c b/fs/proc/nommu.c
-index 9fe7d7e..cdb62c9 100644
---- a/fs/proc/nommu.c
-+++ b/fs/proc/nommu.c
-@@ -67,7 +67,7 @@ static int nommu_region_show(struct seq_file *m, struct vm_region *region)
- if (len < 1)
- len = 1;
- seq_printf(m, "%*c", len, ' ');
-- seq_path(m, &file->f_path, "");
-+ seq_path(m, &file->f_path, "\n\\");
- }
-
- seq_putc(m, '\n');
-diff --git a/fs/proc/proc_net.c b/fs/proc/proc_net.c
-index 04d1270..9dbd384 100644
---- a/fs/proc/proc_net.c
-+++ b/fs/proc/proc_net.c
-@@ -22,6 +22,7 @@
- #include <linux/nsproxy.h>
- #include <net/net_namespace.h>
- #include <linux/seq_file.h>
-+#include <linux/grsecurity.h>
-
- #include "internal.h"
-
-@@ -104,6 +105,17 @@ static struct net *get_proc_task_net(struct inode *dir)
- struct task_struct *task;
- struct nsproxy *ns;
- struct net *net = NULL;
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ const struct cred *cred = current_cred();
-+#endif
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+ if (cred->fsuid)
-+ return net;
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ if (cred->fsuid && !in_group_p(grsec_proc_gid))
-+ return net;
-+#endif
-
- rcu_read_lock();
- task = pid_task(proc_pid(dir), PIDTYPE_PID);
-diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
-index f667e8a..55f4d96 100644
---- a/fs/proc/proc_sysctl.c
-+++ b/fs/proc/proc_sysctl.c
-@@ -7,11 +7,13 @@
- #include <linux/security.h>
- #include "internal.h"
-
-+extern __u32 gr_handle_sysctl(const struct ctl_table *table, const int op);
-+
- static const struct dentry_operations proc_sys_dentry_operations;
- static const struct file_operations proc_sys_file_operations;
--static const struct inode_operations proc_sys_inode_operations;
-+const struct inode_operations proc_sys_inode_operations;
- static const struct file_operations proc_sys_dir_file_operations;
--static const struct inode_operations proc_sys_dir_operations;
-+const struct inode_operations proc_sys_dir_operations;
-
- static struct inode *proc_sys_make_inode(struct super_block *sb,
- struct ctl_table_header *head, struct ctl_table *table)
-@@ -109,6 +111,9 @@ static struct dentry *proc_sys_lookup(struct inode *dir, struct dentry *dentry,
- if (!p)
- goto out;
-
-+ if (gr_handle_sysctl(p, MAY_EXEC))
-+ goto out;
-+
- err = ERR_PTR(-ENOMEM);
- inode = proc_sys_make_inode(dir->i_sb, h ? h : head, p);
- if (h)
-@@ -119,6 +124,9 @@ static struct dentry *proc_sys_lookup(struct inode *dir, struct dentry *dentry,
-
- err = NULL;
- dentry->d_op = &proc_sys_dentry_operations;
-+
-+ gr_handle_proc_create(dentry, inode);
-+
- d_add(dentry, inode);
-
- out:
-@@ -200,6 +208,9 @@ static int proc_sys_fill_cache(struct file *filp, void *dirent,
- return -ENOMEM;
- } else {
- child->d_op = &proc_sys_dentry_operations;
-+
-+ gr_handle_proc_create(child, inode);
-+
- d_add(child, inode);
- }
- } else {
-@@ -228,6 +239,9 @@ static int scan(struct ctl_table_header *head, ctl_table *table,
- if (*pos < file->f_pos)
- continue;
-
-+ if (gr_handle_sysctl(table, 0))
-+ continue;
-+
- res = proc_sys_fill_cache(file, dirent, filldir, head, table);
- if (res)
- return res;
-@@ -344,6 +358,9 @@ static int proc_sys_getattr(struct vfsmount *mnt, struct dentry *dentry, struct
- if (IS_ERR(head))
- return PTR_ERR(head);
-
-+ if (table && gr_handle_sysctl(table, MAY_EXEC))
-+ return -ENOENT;
-+
- generic_fillattr(inode, stat);
- if (table)
- stat->mode = (stat->mode & S_IFMT) | table->mode;
-@@ -358,17 +375,18 @@ static const struct file_operations proc_sys_file_operations = {
- };
-
- static const struct file_operations proc_sys_dir_file_operations = {
-+ .read = generic_read_dir,
- .readdir = proc_sys_readdir,
- .llseek = generic_file_llseek,
- };
-
--static const struct inode_operations proc_sys_inode_operations = {
-+const struct inode_operations proc_sys_inode_operations = {
- .permission = proc_sys_permission,
- .setattr = proc_sys_setattr,
- .getattr = proc_sys_getattr,
- };
-
--static const struct inode_operations proc_sys_dir_operations = {
-+const struct inode_operations proc_sys_dir_operations = {
- .lookup = proc_sys_lookup,
- .permission = proc_sys_permission,
- .setattr = proc_sys_setattr,
-diff --git a/fs/proc/root.c b/fs/proc/root.c
-index b080b79..d957e63 100644
---- a/fs/proc/root.c
-+++ b/fs/proc/root.c
-@@ -134,7 +134,15 @@ void __init proc_root_init(void)
- #ifdef CONFIG_PROC_DEVICETREE
- proc_device_tree_init();
- #endif
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+ proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
-+#endif
-+#else
- proc_mkdir("bus", NULL);
-+#endif
- proc_sys_init();
- }
-
-diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
-index 3b7b82a..0655a0f 100644
---- a/fs/proc/task_mmu.c
-+++ b/fs/proc/task_mmu.c
-@@ -8,12 +8,19 @@
- #include <linux/mempolicy.h>
- #include <linux/swap.h>
- #include <linux/swapops.h>
-+#include <linux/grsecurity.h>
-
- #include <asm/elf.h>
- #include <asm/uaccess.h>
- #include <asm/tlbflush.h>
- #include "internal.h"
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
-+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
-+ _mm->pax_flags & MF_PAX_SEGMEXEC))
-+#endif
-+
- void task_mem(struct seq_file *m, struct mm_struct *mm)
- {
- unsigned long data, text, lib;
-@@ -46,15 +53,27 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
- "VmStk:\t%8lu kB\n"
- "VmExe:\t%8lu kB\n"
- "VmLib:\t%8lu kB\n"
-- "VmPTE:\t%8lu kB\n",
-- hiwater_vm << (PAGE_SHIFT-10),
-+ "VmPTE:\t%8lu kB\n"
-+
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+ "CsBase:\t%8lx\nCsLim:\t%8lx\n"
-+#endif
-+
-+ ,hiwater_vm << (PAGE_SHIFT-10),
- (total_vm - mm->reserved_vm) << (PAGE_SHIFT-10),
- mm->locked_vm << (PAGE_SHIFT-10),
- hiwater_rss << (PAGE_SHIFT-10),
- total_rss << (PAGE_SHIFT-10),
- data << (PAGE_SHIFT-10),
- mm->stack_vm << (PAGE_SHIFT-10), text, lib,
-- (PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10);
-+ (PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10
-+
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+ , PAX_RAND_FLAGS(mm) ? 0 : mm->context.user_cs_base
-+ , PAX_RAND_FLAGS(mm) ? 0 : mm->context.user_cs_limit
-+#endif
-+
-+ );
- }
-
- unsigned long task_vsize(struct mm_struct *mm)
-@@ -175,7 +194,8 @@ static void m_stop(struct seq_file *m, void *v)
- struct proc_maps_private *priv = m->private;
- struct vm_area_struct *vma = v;
-
-- vma_stop(priv, vma);
-+ if (!IS_ERR(vma))
-+ vma_stop(priv, vma);
- if (priv->task)
- put_task_struct(priv->task);
- }
-@@ -206,7 +226,6 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
- int flags = vma->vm_flags;
- unsigned long ino = 0;
- unsigned long long pgoff = 0;
-- unsigned long start;
- dev_t dev = 0;
- int len;
-
-@@ -217,20 +236,23 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
- pgoff = ((loff_t)vma->vm_pgoff) << PAGE_SHIFT;
- }
-
-- /* We don't show the stack guard page in /proc/maps */
-- start = vma->vm_start;
-- if (vma->vm_flags & VM_GROWSDOWN)
-- if (!vma_stack_continue(vma->vm_prev, vma->vm_start))
-- start += PAGE_SIZE;
--
- seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
-- start,
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_start,
-+ PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_end,
-+#else
-+ vma->vm_start,
- vma->vm_end,
-+#endif
- flags & VM_READ ? 'r' : '-',
- flags & VM_WRITE ? 'w' : '-',
- flags & VM_EXEC ? 'x' : '-',
- flags & VM_MAYSHARE ? 's' : 'p',
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ PAX_RAND_FLAGS(mm) ? 0UL : pgoff,
-+#else
- pgoff,
-+#endif
- MAJOR(dev), MINOR(dev), ino, &len);
-
- /*
-@@ -239,7 +261,7 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
- */
- if (file) {
- pad_len_spaces(m, len);
-- seq_path(m, &file->f_path, "\n");
-+ seq_path(m, &file->f_path, "\n\\");
- } else {
- const char *name = arch_vma_name(vma);
- if (!name) {
-@@ -247,8 +269,9 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
- if (vma->vm_start <= mm->brk &&
- vma->vm_end >= mm->start_brk) {
- name = "[heap]";
-- } else if (vma->vm_start <= mm->start_stack &&
-- vma->vm_end >= mm->start_stack) {
-+ } else if ((vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP)) ||
-+ (vma->vm_start <= mm->start_stack &&
-+ vma->vm_end >= mm->start_stack)) {
- name = "[stack]";
- }
- } else {
-@@ -269,6 +292,13 @@ static int show_map(struct seq_file *m, void *v)
- struct proc_maps_private *priv = m->private;
- struct task_struct *task = priv->task;
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ if (current->exec_id != m->exec_id) {
-+ gr_log_badprocpid("maps");
-+ return 0;
-+ }
-+#endif
-+
- show_map_vma(m, vma);
-
- if (m->count < m->size) /* vma is copied successfully */
-@@ -390,10 +420,23 @@ static int show_smap(struct seq_file *m, void *v)
- .private = &mss,
- };
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ if (current->exec_id != m->exec_id) {
-+ gr_log_badprocpid("smaps");
-+ return 0;
-+ }
-+#endif
- memset(&mss, 0, sizeof mss);
-- mss.vma = vma;
-- if (vma->vm_mm && !is_vm_hugetlb_page(vma))
-- walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ if (!PAX_RAND_FLAGS(vma->vm_mm)) {
-+#endif
-+ mss.vma = vma;
-+ if (vma->vm_mm && !is_vm_hugetlb_page(vma))
-+ walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ }
-+#endif
-
- show_map_vma(m, vma);
-
-@@ -409,7 +452,11 @@ static int show_smap(struct seq_file *m, void *v)
- "Swap: %8lu kB\n"
- "KernelPageSize: %8lu kB\n"
- "MMUPageSize: %8lu kB\n",
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ PAX_RAND_FLAGS(vma->vm_mm) ? 0UL : (vma->vm_end - vma->vm_start) >> 10,
-+#else
- (vma->vm_end - vma->vm_start) >> 10,
-+#endif
- mss.resident >> 10,
- (unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
- mss.shared_clean >> 10,
-diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c
-index 8f5c05d..c99c76d 100644
---- a/fs/proc/task_nommu.c
-+++ b/fs/proc/task_nommu.c
-@@ -50,7 +50,7 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
- else
- bytes += kobjsize(mm);
-
-- if (current->fs && current->fs->users > 1)
-+ if (current->fs && atomic_read(¤t->fs->users) > 1)
- sbytes += kobjsize(current->fs);
- else
- bytes += kobjsize(current->fs);
-@@ -154,7 +154,7 @@ static int nommu_vma_show(struct seq_file *m, struct vm_area_struct *vma)
- if (len < 1)
- len = 1;
- seq_printf(m, "%*c", len, ' ');
-- seq_path(m, &file->f_path, "");
-+ seq_path(m, &file->f_path, "\n\\");
- }
-
- seq_putc(m, '\n');
-diff --git a/fs/read_write.c b/fs/read_write.c
-index b7f4a1f..d40066d 100644
---- a/fs/read_write.c
-+++ b/fs/read_write.c
-@@ -860,6 +860,8 @@ static ssize_t do_sendfile(int out_fd, int in_fd, loff_t *ppos,
- if (retval > 0) {
- add_rchar(current, retval);
- add_wchar(current, retval);
-+ fsnotify_access(in_file->f_path.dentry);
-+ fsnotify_modify(out_file->f_path.dentry);
- }
-
- inc_syscr(current);
-diff --git a/fs/readdir.c b/fs/readdir.c
-index 7723401..30059a6 100644
---- a/fs/readdir.c
-+++ b/fs/readdir.c
-@@ -16,6 +16,7 @@
- #include <linux/security.h>
- #include <linux/syscalls.h>
- #include <linux/unistd.h>
-+#include <linux/namei.h>
-
- #include <asm/uaccess.h>
-
-@@ -67,6 +68,7 @@ struct old_linux_dirent {
-
- struct readdir_callback {
- struct old_linux_dirent __user * dirent;
-+ struct file * file;
- int result;
- };
-
-@@ -84,6 +86,10 @@ static int fillonedir(void * __buf, const char * name, int namlen, loff_t offset
- buf->result = -EOVERFLOW;
- return -EOVERFLOW;
- }
-+
-+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
-+ return 0;
-+
- buf->result++;
- dirent = buf->dirent;
- if (!access_ok(VERIFY_WRITE, dirent,
-@@ -116,6 +122,7 @@ SYSCALL_DEFINE3(old_readdir, unsigned int, fd,
-
- buf.result = 0;
- buf.dirent = dirent;
-+ buf.file = file;
-
- error = vfs_readdir(file, fillonedir, &buf);
- if (buf.result)
-@@ -142,6 +149,7 @@ struct linux_dirent {
- struct getdents_callback {
- struct linux_dirent __user * current_dir;
- struct linux_dirent __user * previous;
-+ struct file * file;
- int count;
- int error;
- };
-@@ -162,6 +170,10 @@ static int filldir(void * __buf, const char * name, int namlen, loff_t offset,
- buf->error = -EOVERFLOW;
- return -EOVERFLOW;
- }
-+
-+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
-+ return 0;
-+
- dirent = buf->previous;
- if (dirent) {
- if (__put_user(offset, &dirent->d_off))
-@@ -209,6 +221,7 @@ SYSCALL_DEFINE3(getdents, unsigned int, fd,
- buf.previous = NULL;
- buf.count = count;
- buf.error = 0;
-+ buf.file = file;
-
- error = vfs_readdir(file, filldir, &buf);
- if (error >= 0)
-@@ -228,6 +241,7 @@ out:
- struct getdents_callback64 {
- struct linux_dirent64 __user * current_dir;
- struct linux_dirent64 __user * previous;
-+ struct file *file;
- int count;
- int error;
- };
-@@ -242,6 +256,10 @@ static int filldir64(void * __buf, const char * name, int namlen, loff_t offset,
- buf->error = -EINVAL; /* only used if we fail.. */
- if (reclen > buf->count)
- return -EINVAL;
-+
-+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
-+ return 0;
-+
- dirent = buf->previous;
- if (dirent) {
- if (__put_user(offset, &dirent->d_off))
-@@ -289,6 +307,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int, fd,
-
- buf.current_dir = dirent;
- buf.previous = NULL;
-+ buf.file = file;
- buf.count = count;
- buf.error = 0;
-
-@@ -297,7 +316,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int, fd,
- error = buf.error;
- lastdirent = buf.previous;
- if (lastdirent) {
-- typeof(lastdirent->d_off) d_off = file->f_pos;
-+ typeof(((struct linux_dirent64 *)0)->d_off) d_off = file->f_pos;
- if (__put_user(d_off, &lastdirent->d_off))
- error = -EFAULT;
- else
-diff --git a/fs/reiserfs/dir.c b/fs/reiserfs/dir.c
-index d42c30c..4fd8718 100644
---- a/fs/reiserfs/dir.c
-+++ b/fs/reiserfs/dir.c
-@@ -66,6 +66,8 @@ int reiserfs_readdir_dentry(struct dentry *dentry, void *dirent,
- struct reiserfs_dir_entry de;
- int ret = 0;
-
-+ pax_track_stack();
-+
- reiserfs_write_lock(inode->i_sb);
-
- reiserfs_check_lock_depth(inode->i_sb, "readdir");
-diff --git a/fs/reiserfs/do_balan.c b/fs/reiserfs/do_balan.c
-index 128d3f7c..8840d44 100644
---- a/fs/reiserfs/do_balan.c
-+++ b/fs/reiserfs/do_balan.c
-@@ -2058,7 +2058,7 @@ void do_balance(struct tree_balance *tb, /* tree_balance structure */
- return;
- }
-
-- atomic_inc(&(fs_generation(tb->tb_sb)));
-+ atomic_inc_unchecked(&(fs_generation(tb->tb_sb)));
- do_balance_starts(tb);
-
- /* balance leaf returns 0 except if combining L R and S into
-diff --git a/fs/reiserfs/item_ops.c b/fs/reiserfs/item_ops.c
-index 72cb1cc..d0e3181 100644
---- a/fs/reiserfs/item_ops.c
-+++ b/fs/reiserfs/item_ops.c
-@@ -102,7 +102,7 @@ static void sd_print_vi(struct virtual_item *vi)
- vi->vi_index, vi->vi_type, vi->vi_ih);
- }
-
--static struct item_operations stat_data_ops = {
-+static const struct item_operations stat_data_ops = {
- .bytes_number = sd_bytes_number,
- .decrement_key = sd_decrement_key,
- .is_left_mergeable = sd_is_left_mergeable,
-@@ -196,7 +196,7 @@ static void direct_print_vi(struct virtual_item *vi)
- vi->vi_index, vi->vi_type, vi->vi_ih);
- }
-
--static struct item_operations direct_ops = {
-+static const struct item_operations direct_ops = {
- .bytes_number = direct_bytes_number,
- .decrement_key = direct_decrement_key,
- .is_left_mergeable = direct_is_left_mergeable,
-@@ -341,7 +341,7 @@ static void indirect_print_vi(struct virtual_item *vi)
- vi->vi_index, vi->vi_type, vi->vi_ih);
- }
-
--static struct item_operations indirect_ops = {
-+static const struct item_operations indirect_ops = {
- .bytes_number = indirect_bytes_number,
- .decrement_key = indirect_decrement_key,
- .is_left_mergeable = indirect_is_left_mergeable,
-@@ -628,7 +628,7 @@ static void direntry_print_vi(struct virtual_item *vi)
- printk("\n");
- }
-
--static struct item_operations direntry_ops = {
-+static const struct item_operations direntry_ops = {
- .bytes_number = direntry_bytes_number,
- .decrement_key = direntry_decrement_key,
- .is_left_mergeable = direntry_is_left_mergeable,
-@@ -724,7 +724,7 @@ static void errcatch_print_vi(struct virtual_item *vi)
- "Invalid item type observed, run fsck ASAP");
- }
-
--static struct item_operations errcatch_ops = {
-+static const struct item_operations errcatch_ops = {
- errcatch_bytes_number,
- errcatch_decrement_key,
- errcatch_is_left_mergeable,
-@@ -746,7 +746,7 @@ static struct item_operations errcatch_ops = {
- #error Item types must use disk-format assigned values.
- #endif
-
--struct item_operations *item_ops[TYPE_ANY + 1] = {
-+const struct item_operations * const item_ops[TYPE_ANY + 1] = {
- &stat_data_ops,
- &indirect_ops,
- &direct_ops,
-diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
-index b5fe0aa..e0e25c4 100644
---- a/fs/reiserfs/journal.c
-+++ b/fs/reiserfs/journal.c
-@@ -2329,6 +2329,8 @@ static struct buffer_head *reiserfs_breada(struct block_device *dev,
- struct buffer_head *bh;
- int i, j;
-
-+ pax_track_stack();
-+
- bh = __getblk(dev, block, bufsize);
- if (buffer_uptodate(bh))
- return (bh);
-diff --git a/fs/reiserfs/namei.c b/fs/reiserfs/namei.c
-index 2715791..b8996db 100644
---- a/fs/reiserfs/namei.c
-+++ b/fs/reiserfs/namei.c
-@@ -1214,6 +1214,8 @@ static int reiserfs_rename(struct inode *old_dir, struct dentry *old_dentry,
- unsigned long savelink = 1;
- struct timespec ctime;
-
-+ pax_track_stack();
-+
- /* three balancings: (1) old name removal, (2) new name insertion
- and (3) maybe "save" link insertion
- stat data updates: (1) old directory,
-diff --git a/fs/reiserfs/procfs.c b/fs/reiserfs/procfs.c
-index 9229e55..3d2e3b7 100644
---- a/fs/reiserfs/procfs.c
-+++ b/fs/reiserfs/procfs.c
-@@ -123,7 +123,7 @@ static int show_super(struct seq_file *m, struct super_block *sb)
- "SMALL_TAILS " : "NO_TAILS ",
- replay_only(sb) ? "REPLAY_ONLY " : "",
- convert_reiserfs(sb) ? "CONV " : "",
-- atomic_read(&r->s_generation_counter),
-+ atomic_read_unchecked(&r->s_generation_counter),
- SF(s_disk_reads), SF(s_disk_writes), SF(s_fix_nodes),
- SF(s_do_balance), SF(s_unneeded_left_neighbor),
- SF(s_good_search_by_key_reada), SF(s_bmaps),
-@@ -309,6 +309,8 @@ static int show_journal(struct seq_file *m, struct super_block *sb)
- struct journal_params *jp = &rs->s_v1.s_journal;
- char b[BDEVNAME_SIZE];
-
-+ pax_track_stack();
-+
- seq_printf(m, /* on-disk fields */
- "jp_journal_1st_block: \t%i\n"
- "jp_journal_dev: \t%s[%x]\n"
-diff --git a/fs/reiserfs/stree.c b/fs/reiserfs/stree.c
-index d036ee5..4c7dca1 100644
---- a/fs/reiserfs/stree.c
-+++ b/fs/reiserfs/stree.c
-@@ -1159,6 +1159,8 @@ int reiserfs_delete_item(struct reiserfs_transaction_handle *th,
- int iter = 0;
- #endif
-
-+ pax_track_stack();
-+
- BUG_ON(!th->t_trans_id);
-
- init_tb_struct(th, &s_del_balance, sb, path,
-@@ -1296,6 +1298,8 @@ void reiserfs_delete_solid_item(struct reiserfs_transaction_handle *th,
- int retval;
- int quota_cut_bytes = 0;
-
-+ pax_track_stack();
-+
- BUG_ON(!th->t_trans_id);
-
- le_key2cpu_key(&cpu_key, key);
-@@ -1525,6 +1529,8 @@ int reiserfs_cut_from_item(struct reiserfs_transaction_handle *th,
- int quota_cut_bytes;
- loff_t tail_pos = 0;
-
-+ pax_track_stack();
-+
- BUG_ON(!th->t_trans_id);
-
- init_tb_struct(th, &s_cut_balance, inode->i_sb, path,
-@@ -1920,6 +1926,8 @@ int reiserfs_paste_into_item(struct reiserfs_transaction_handle *th, struct tree
- int retval;
- int fs_gen;
-
-+ pax_track_stack();
-+
- BUG_ON(!th->t_trans_id);
-
- fs_gen = get_generation(inode->i_sb);
-@@ -2007,6 +2015,8 @@ int reiserfs_insert_item(struct reiserfs_transaction_handle *th,
- int fs_gen = 0;
- int quota_bytes = 0;
-
-+ pax_track_stack();
-+
- BUG_ON(!th->t_trans_id);
-
- if (inode) { /* Do we count quotas for item? */
-diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
-index 7cb1285..c726cd0 100644
---- a/fs/reiserfs/super.c
-+++ b/fs/reiserfs/super.c
-@@ -916,6 +916,8 @@ static int reiserfs_parse_options(struct super_block *s, char *options, /* strin
- {.option_name = NULL}
- };
-
-+ pax_track_stack();
-+
- *blocks = 0;
- if (!options || !*options)
- /* use default configuration: create tails, journaling on, no
-diff --git a/fs/select.c b/fs/select.c
-index fd38ce2..f5381b8 100644
---- a/fs/select.c
-+++ b/fs/select.c
-@@ -20,6 +20,7 @@
- #include <linux/module.h>
- #include <linux/slab.h>
- #include <linux/poll.h>
-+#include <linux/security.h>
- #include <linux/personality.h> /* for STICKY_TIMEOUTS */
- #include <linux/file.h>
- #include <linux/fdtable.h>
-@@ -401,6 +402,8 @@ int do_select(int n, fd_set_bits *fds, struct timespec *end_time)
- int retval, i, timed_out = 0;
- unsigned long slack = 0;
-
-+ pax_track_stack();
-+
- rcu_read_lock();
- retval = max_select_fd(n, fds);
- rcu_read_unlock();
-@@ -529,6 +532,8 @@ int core_sys_select(int n, fd_set __user *inp, fd_set __user *outp,
- /* Allocate small arguments on the stack to save memory and be faster */
- long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
-
-+ pax_track_stack();
-+
- ret = -EINVAL;
- if (n < 0)
- goto out_nofds;
-@@ -821,6 +826,9 @@ int do_sys_poll(struct pollfd __user *ufds, unsigned int nfds,
- struct poll_list *walk = head;
- unsigned long todo = nfds;
-
-+ pax_track_stack();
-+
-+ gr_learn_resource(current, RLIMIT_NOFILE, nfds, 1);
- if (nfds > current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
- return -EINVAL;
-
-diff --git a/fs/seq_file.c b/fs/seq_file.c
-index eae7d9d..69ac0fd 100644
---- a/fs/seq_file.c
-+++ b/fs/seq_file.c
-@@ -9,6 +9,7 @@
- #include <linux/module.h>
- #include <linux/seq_file.h>
- #include <linux/slab.h>
-+#include <linux/sched.h>
-
- #include <asm/uaccess.h>
- #include <asm/page.h>
-@@ -40,6 +41,9 @@ int seq_open(struct file *file, const struct seq_operations *op)
- memset(p, 0, sizeof(*p));
- mutex_init(&p->lock);
- p->op = op;
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ p->exec_id = current->exec_id;
-+#endif
-
- /*
- * Wrappers around seq_open(e.g. swaps_open) need to be
-@@ -76,7 +80,11 @@ static int traverse(struct seq_file *m, loff_t offset)
- return 0;
- }
- if (!m->buf) {
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL | GFP_USERCOPY);
-+#else
- m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
-+#endif
- if (!m->buf)
- return -ENOMEM;
- }
-@@ -116,7 +124,11 @@ static int traverse(struct seq_file *m, loff_t offset)
- Eoverflow:
- m->op->stop(m, p);
- kfree(m->buf);
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ m->buf = kmalloc(m->size <<= 1, GFP_KERNEL | GFP_USERCOPY);
-+#else
- m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
-+#endif
- return !m->buf ? -ENOMEM : -EAGAIN;
- }
-
-@@ -169,7 +181,11 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
- m->version = file->f_version;
- /* grab buffer if we didn't have one */
- if (!m->buf) {
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL | GFP_USERCOPY);
-+#else
- m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
-+#endif
- if (!m->buf)
- goto Enomem;
- }
-@@ -210,7 +226,11 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
- goto Fill;
- m->op->stop(m, p);
- kfree(m->buf);
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ m->buf = kmalloc(m->size <<= 1, GFP_KERNEL | GFP_USERCOPY);
-+#else
- m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
-+#endif
- if (!m->buf)
- goto Enomem;
- m->count = 0;
-@@ -551,7 +571,7 @@ static void single_stop(struct seq_file *p, void *v)
- int single_open(struct file *file, int (*show)(struct seq_file *, void *),
- void *data)
- {
-- struct seq_operations *op = kmalloc(sizeof(*op), GFP_KERNEL);
-+ seq_operations_no_const *op = kzalloc(sizeof(*op), GFP_KERNEL);
- int res = -ENOMEM;
-
- if (op) {
-diff --git a/fs/smbfs/proc.c b/fs/smbfs/proc.c
-index 71c29b6..54694dd 100644
---- a/fs/smbfs/proc.c
-+++ b/fs/smbfs/proc.c
-@@ -266,9 +266,9 @@ int smb_setcodepage(struct smb_sb_info *server, struct smb_nls_codepage *cp)
-
- out:
- if (server->local_nls != NULL && server->remote_nls != NULL)
-- server->ops->convert = convert_cp;
-+ *(void **)&server->ops->convert = convert_cp;
- else
-- server->ops->convert = convert_memcpy;
-+ *(void **)&server->ops->convert = convert_memcpy;
-
- smb_unlock_server(server);
- return n;
-@@ -933,9 +933,9 @@ smb_newconn(struct smb_sb_info *server, struct smb_conn_opt *opt)
-
- /* FIXME: the win9x code wants to modify these ... (seek/trunc bug) */
- if (server->mnt->flags & SMB_MOUNT_OLDATTR) {
-- server->ops->getattr = smb_proc_getattr_core;
-+ *(void **)&server->ops->getattr = smb_proc_getattr_core;
- } else if (server->mnt->flags & SMB_MOUNT_DIRATTR) {
-- server->ops->getattr = smb_proc_getattr_ff;
-+ *(void **)&server->ops->getattr = smb_proc_getattr_ff;
- }
-
- /* Decode server capabilities */
-@@ -3439,7 +3439,7 @@ out:
- static void
- install_ops(struct smb_ops *dst, struct smb_ops *src)
- {
-- memcpy(dst, src, sizeof(void *) * SMB_OPS_NUM_STATIC);
-+ memcpy((void *)dst, src, sizeof(void *) * SMB_OPS_NUM_STATIC);
- }
-
- /* < LANMAN2 */
-diff --git a/fs/smbfs/symlink.c b/fs/smbfs/symlink.c
-index 00b2909..2ace383 100644
---- a/fs/smbfs/symlink.c
-+++ b/fs/smbfs/symlink.c
-@@ -55,7 +55,7 @@ static void *smb_follow_link(struct dentry *dentry, struct nameidata *nd)
-
- static void smb_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
- {
-- char *s = nd_get_link(nd);
-+ const char *s = nd_get_link(nd);
- if (!IS_ERR(s))
- __putname(s);
- }
-diff --git a/fs/splice.c b/fs/splice.c
-index bb92b7c5..5aa72b0 100644
---- a/fs/splice.c
-+++ b/fs/splice.c
-@@ -185,7 +185,7 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
- pipe_lock(pipe);
-
- for (;;) {
-- if (!pipe->readers) {
-+ if (!atomic_read(&pipe->readers)) {
- send_sig(SIGPIPE, current, 0);
- if (!ret)
- ret = -EPIPE;
-@@ -239,9 +239,9 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
- do_wakeup = 0;
- }
-
-- pipe->waiting_writers++;
-+ atomic_inc(&pipe->waiting_writers);
- pipe_wait(pipe);
-- pipe->waiting_writers--;
-+ atomic_dec(&pipe->waiting_writers);
- }
-
- pipe_unlock(pipe);
-@@ -285,6 +285,8 @@ __generic_file_splice_read(struct file *in, loff_t *ppos,
- .spd_release = spd_release_page,
- };
-
-+ pax_track_stack();
-+
- index = *ppos >> PAGE_CACHE_SHIFT;
- loff = *ppos & ~PAGE_CACHE_MASK;
- req_pages = (len + loff + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
-@@ -521,7 +523,7 @@ static ssize_t kernel_readv(struct file *file, const struct iovec *vec,
- old_fs = get_fs();
- set_fs(get_ds());
- /* The cast to a user pointer is valid due to the set_fs() */
-- res = vfs_readv(file, (const struct iovec __user *)vec, vlen, &pos);
-+ res = vfs_readv(file, (const struct iovec __force_user *)vec, vlen, &pos);
- set_fs(old_fs);
-
- return res;
-@@ -536,7 +538,7 @@ static ssize_t kernel_write(struct file *file, const char *buf, size_t count,
- old_fs = get_fs();
- set_fs(get_ds());
- /* The cast to a user pointer is valid due to the set_fs() */
-- res = vfs_write(file, (const char __user *)buf, count, &pos);
-+ res = vfs_write(file, (const char __force_user *)buf, count, &pos);
- set_fs(old_fs);
-
- return res;
-@@ -565,6 +567,8 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
- .spd_release = spd_release_page,
- };
-
-+ pax_track_stack();
-+
- index = *ppos >> PAGE_CACHE_SHIFT;
- offset = *ppos & ~PAGE_CACHE_MASK;
- nr_pages = (len + offset + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
-@@ -578,7 +582,7 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
- goto err;
-
- this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset);
-- vec[i].iov_base = (void __user *) page_address(page);
-+ vec[i].iov_base = (__force void __user *) page_address(page);
- vec[i].iov_len = this_len;
- pages[i] = page;
- spd.nr_pages++;
-@@ -800,10 +804,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
- int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
- {
- while (!pipe->nrbufs) {
-- if (!pipe->writers)
-+ if (!atomic_read(&pipe->writers))
- return 0;
-
-- if (!pipe->waiting_writers && sd->num_spliced)
-+ if (!atomic_read(&pipe->waiting_writers) && sd->num_spliced)
- return 0;
-
- if (sd->flags & SPLICE_F_NONBLOCK)
-@@ -1140,7 +1144,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
- * out of the pipe right after the splice_to_pipe(). So set
- * PIPE_READERS appropriately.
- */
-- pipe->readers = 1;
-+ atomic_set(&pipe->readers, 1);
-
- current->splice_pipe = pipe;
- }
-@@ -1593,6 +1597,8 @@ static long vmsplice_to_pipe(struct file *file, const struct iovec __user *iov,
- .spd_release = spd_release_page,
- };
-
-+ pax_track_stack();
-+
- pipe = pipe_info(file->f_path.dentry->d_inode);
- if (!pipe)
- return -EBADF;
-@@ -1701,9 +1707,9 @@ static int ipipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
- ret = -ERESTARTSYS;
- break;
- }
-- if (!pipe->writers)
-+ if (!atomic_read(&pipe->writers))
- break;
-- if (!pipe->waiting_writers) {
-+ if (!atomic_read(&pipe->waiting_writers)) {
- if (flags & SPLICE_F_NONBLOCK) {
- ret = -EAGAIN;
- break;
-@@ -1735,7 +1741,7 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
- pipe_lock(pipe);
-
- while (pipe->nrbufs >= PIPE_BUFFERS) {
-- if (!pipe->readers) {
-+ if (!atomic_read(&pipe->readers)) {
- send_sig(SIGPIPE, current, 0);
- ret = -EPIPE;
- break;
-@@ -1748,9 +1754,9 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
- ret = -ERESTARTSYS;
- break;
- }
-- pipe->waiting_writers++;
-+ atomic_inc(&pipe->waiting_writers);
- pipe_wait(pipe);
-- pipe->waiting_writers--;
-+ atomic_dec(&pipe->waiting_writers);
- }
-
- pipe_unlock(pipe);
-@@ -1786,14 +1792,14 @@ retry:
- pipe_double_lock(ipipe, opipe);
-
- do {
-- if (!opipe->readers) {
-+ if (!atomic_read(&opipe->readers)) {
- send_sig(SIGPIPE, current, 0);
- if (!ret)
- ret = -EPIPE;
- break;
- }
-
-- if (!ipipe->nrbufs && !ipipe->writers)
-+ if (!ipipe->nrbufs && !atomic_read(&ipipe->writers))
- break;
-
- /*
-@@ -1893,7 +1899,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
- pipe_double_lock(ipipe, opipe);
-
- do {
-- if (!opipe->readers) {
-+ if (!atomic_read(&opipe->readers)) {
- send_sig(SIGPIPE, current, 0);
- if (!ret)
- ret = -EPIPE;
-@@ -1938,7 +1944,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
- * return EAGAIN if we have the potential of some data in the
- * future, otherwise just return 0
- */
-- if (!ret && ipipe->waiting_writers && (flags & SPLICE_F_NONBLOCK))
-+ if (!ret && atomic_read(&ipipe->waiting_writers) && (flags & SPLICE_F_NONBLOCK))
- ret = -EAGAIN;
-
- pipe_unlock(ipipe);
-diff --git a/fs/stat.c b/fs/stat.c
-index c4ecd52..a8fca7d 100644
---- a/fs/stat.c
-+++ b/fs/stat.c
-@@ -27,8 +27,14 @@ void generic_fillattr(struct inode *inode, struct kstat *stat)
- stat->uid = inode->i_uid;
- stat->gid = inode->i_gid;
- stat->rdev = inode->i_rdev;
-- stat->atime = inode->i_atime;
-- stat->mtime = inode->i_mtime;
-+ stat->size = i_size_read(inode);
-+ if (is_sidechannel_device(inode) && !capable_nolog(CAP_MKNOD)) {
-+ stat->atime = inode->i_ctime;
-+ stat->mtime = inode->i_ctime;
-+ } else {
-+ stat->atime = inode->i_atime;
-+ stat->mtime = inode->i_mtime;
-+ }
- stat->ctime = inode->i_ctime;
- stat->size = i_size_read(inode);
- stat->blocks = inode->i_blocks;
-@@ -46,8 +52,14 @@ int vfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
- if (retval)
- return retval;
-
-- if (inode->i_op->getattr)
-- return inode->i_op->getattr(mnt, dentry, stat);
-+ if (inode->i_op->getattr) {
-+ retval = inode->i_op->getattr(mnt, dentry, stat);
-+ if (!retval && is_sidechannel_device(inode) && !capable_nolog(CAP_MKNOD)) {
-+ stat->atime = stat->ctime;
-+ stat->mtime = stat->ctime;
-+ }
-+ return retval;
-+ }
-
- generic_fillattr(inode, stat);
- return 0;
-diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
-index e020183..18d64b4 100644
---- a/fs/sysfs/dir.c
-+++ b/fs/sysfs/dir.c
-@@ -678,6 +678,18 @@ static int create_dir(struct kobject *kobj, struct sysfs_dirent *parent_sd,
- struct sysfs_dirent *sd;
- int rc;
-
-+#ifdef CONFIG_GRKERNSEC_SYSFS_RESTRICT
-+ const char *parent_name = parent_sd->s_name;
-+
-+ mode = S_IFDIR | S_IRWXU;
-+
-+ if ((!strcmp(parent_name, "") && (!strcmp(name, "devices") || !strcmp(name, "fs"))) ||
-+ (!strcmp(parent_name, "devices") && !strcmp(name, "system")) ||
-+ (!strcmp(parent_name, "fs") && (!strcmp(name, "selinux") || !strcmp(name, "fuse"))) ||
-+ (!strcmp(parent_name, "system") && !strcmp(name, "cpu")))
-+ mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO;
-+#endif
-+
- /* allocate */
- sd = sysfs_new_dirent(name, mode, SYSFS_DIR);
- if (!sd)
-diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
-index 7118a38..70af853 100644
---- a/fs/sysfs/file.c
-+++ b/fs/sysfs/file.c
-@@ -44,7 +44,7 @@ static DEFINE_SPINLOCK(sysfs_open_dirent_lock);
-
- struct sysfs_open_dirent {
- atomic_t refcnt;
-- atomic_t event;
-+ atomic_unchecked_t event;
- wait_queue_head_t poll;
- struct list_head buffers; /* goes through sysfs_buffer.list */
- };
-@@ -53,7 +53,7 @@ struct sysfs_buffer {
- size_t count;
- loff_t pos;
- char * page;
-- struct sysfs_ops * ops;
-+ const struct sysfs_ops * ops;
- struct mutex mutex;
- int needs_read_fill;
- int event;
-@@ -75,7 +75,7 @@ static int fill_read_buffer(struct dentry * dentry, struct sysfs_buffer * buffer
- {
- struct sysfs_dirent *attr_sd = dentry->d_fsdata;
- struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
-- struct sysfs_ops * ops = buffer->ops;
-+ const struct sysfs_ops * ops = buffer->ops;
- int ret = 0;
- ssize_t count;
-
-@@ -88,7 +88,7 @@ static int fill_read_buffer(struct dentry * dentry, struct sysfs_buffer * buffer
- if (!sysfs_get_active_two(attr_sd))
- return -ENODEV;
-
-- buffer->event = atomic_read(&attr_sd->s_attr.open->event);
-+ buffer->event = atomic_read_unchecked(&attr_sd->s_attr.open->event);
- count = ops->show(kobj, attr_sd->s_attr.attr, buffer->page);
-
- sysfs_put_active_two(attr_sd);
-@@ -199,7 +199,7 @@ flush_write_buffer(struct dentry * dentry, struct sysfs_buffer * buffer, size_t
- {
- struct sysfs_dirent *attr_sd = dentry->d_fsdata;
- struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
-- struct sysfs_ops * ops = buffer->ops;
-+ const struct sysfs_ops * ops = buffer->ops;
- int rc;
-
- /* need attr_sd for attr and ops, its parent for kobj */
-@@ -294,7 +294,7 @@ static int sysfs_get_open_dirent(struct sysfs_dirent *sd,
- return -ENOMEM;
-
- atomic_set(&new_od->refcnt, 0);
-- atomic_set(&new_od->event, 1);
-+ atomic_set_unchecked(&new_od->event, 1);
- init_waitqueue_head(&new_od->poll);
- INIT_LIST_HEAD(&new_od->buffers);
- goto retry;
-@@ -335,7 +335,7 @@ static int sysfs_open_file(struct inode *inode, struct file *file)
- struct sysfs_dirent *attr_sd = file->f_path.dentry->d_fsdata;
- struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
- struct sysfs_buffer *buffer;
-- struct sysfs_ops *ops;
-+ const struct sysfs_ops *ops;
- int error = -EACCES;
- char *p;
-
-@@ -444,7 +444,7 @@ static unsigned int sysfs_poll(struct file *filp, poll_table *wait)
-
- sysfs_put_active_two(attr_sd);
-
-- if (buffer->event != atomic_read(&od->event))
-+ if (buffer->event != atomic_read_unchecked(&od->event))
- goto trigger;
-
- return DEFAULT_POLLMASK;
-@@ -463,7 +463,7 @@ void sysfs_notify_dirent(struct sysfs_dirent *sd)
-
- od = sd->s_attr.open;
- if (od) {
-- atomic_inc(&od->event);
-+ atomic_inc_unchecked(&od->event);
- wake_up_interruptible(&od->poll);
- }
-
-diff --git a/fs/sysfs/symlink.c b/fs/sysfs/symlink.c
-index c5081ad..342ea86 100644
---- a/fs/sysfs/symlink.c
-+++ b/fs/sysfs/symlink.c
-@@ -204,7 +204,7 @@ static void *sysfs_follow_link(struct dentry *dentry, struct nameidata *nd)
-
- static void sysfs_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
- {
-- char *page = nd_get_link(nd);
-+ const char *page = nd_get_link(nd);
- if (!IS_ERR(page))
- free_page((unsigned long)page);
- }
-diff --git a/fs/udf/balloc.c b/fs/udf/balloc.c
-index 1e06853..b06d325 100644
---- a/fs/udf/balloc.c
-+++ b/fs/udf/balloc.c
-@@ -172,9 +172,7 @@ static void udf_bitmap_free_blocks(struct super_block *sb,
-
- mutex_lock(&sbi->s_alloc_mutex);
- partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
-- if (bloc->logicalBlockNum < 0 ||
-- (bloc->logicalBlockNum + count) >
-- partmap->s_partition_len) {
-+ if ((bloc->logicalBlockNum + count) > partmap->s_partition_len) {
- udf_debug("%d < %d || %d + %d > %d\n",
- bloc->logicalBlockNum, 0, bloc->logicalBlockNum,
- count, partmap->s_partition_len);
-@@ -436,9 +434,7 @@ static void udf_table_free_blocks(struct super_block *sb,
-
- mutex_lock(&sbi->s_alloc_mutex);
- partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
-- if (bloc->logicalBlockNum < 0 ||
-- (bloc->logicalBlockNum + count) >
-- partmap->s_partition_len) {
-+ if ((bloc->logicalBlockNum + count) > partmap->s_partition_len) {
- udf_debug("%d < %d || %d + %d > %d\n",
- bloc.logicalBlockNum, 0, bloc.logicalBlockNum, count,
- partmap->s_partition_len);
-diff --git a/fs/udf/inode.c b/fs/udf/inode.c
-index 6d24c2c..fff470f 100644
---- a/fs/udf/inode.c
-+++ b/fs/udf/inode.c
-@@ -484,6 +484,8 @@ static struct buffer_head *inode_getblk(struct inode *inode, sector_t block,
- int goal = 0, pgoal = iinfo->i_location.logicalBlockNum;
- int lastblock = 0;
-
-+ pax_track_stack();
-+
- prev_epos.offset = udf_file_entry_alloc_offset(inode);
- prev_epos.block = iinfo->i_location;
- prev_epos.bh = NULL;
-diff --git a/fs/udf/misc.c b/fs/udf/misc.c
-index 9215700..bf1f68e 100644
---- a/fs/udf/misc.c
-+++ b/fs/udf/misc.c
-@@ -286,7 +286,7 @@ void udf_new_tag(char *data, uint16_t ident, uint16_t version, uint16_t snum,
-
- u8 udf_tag_checksum(const struct tag *t)
- {
-- u8 *data = (u8 *)t;
-+ const u8 *data = (const u8 *)t;
- u8 checksum = 0;
- int i;
- for (i = 0; i < sizeof(struct tag); ++i)
-diff --git a/fs/udf/namei.c b/fs/udf/namei.c
-index 21dad8c..b754151 100644
---- a/fs/udf/namei.c
-+++ b/fs/udf/namei.c
-@@ -1331,6 +1331,7 @@ static int udf_encode_fh(struct dentry *de, __u32 *fh, int *lenp,
- *lenp = 3;
- fid->udf.block = location.logicalBlockNum;
- fid->udf.partref = location.partitionReferenceNum;
-+ fid->udf.parent_partref = 0;
- fid->udf.generation = inode->i_generation;
-
- if (connectable && !S_ISDIR(inode->i_mode)) {
-diff --git a/fs/udf/super.c b/fs/udf/super.c
-index 0045ebc..d069fda 100644
---- a/fs/udf/super.c
-+++ b/fs/udf/super.c
-@@ -1306,6 +1306,13 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block,
- return 1;
- BUG_ON(ident != TAG_IDENT_LVD);
- lvd = (struct logicalVolDesc *)bh->b_data;
-+ table_len = le32_to_cpu(lvd->mapTableLength);
-+ if (sizeof(*lvd) + table_len > sb->s_blocksize) {
-+ udf_error(sb, __func__, "error loading logical volume descriptor: "
-+ "Partition table too long (%u > %lu)\n", table_len,
-+ sb->s_blocksize - sizeof(*lvd));
-+ goto out_bh;
-+ }
-
- table_len = le32_to_cpu(lvd->mapTableLength);
- if (table_len > sb->s_blocksize - sizeof(*lvd)) {
-diff --git a/fs/utimes.c b/fs/utimes.c
-index e4c75db..b4df0e0 100644
---- a/fs/utimes.c
-+++ b/fs/utimes.c
-@@ -1,6 +1,7 @@
- #include <linux/compiler.h>
- #include <linux/file.h>
- #include <linux/fs.h>
-+#include <linux/security.h>
- #include <linux/linkage.h>
- #include <linux/mount.h>
- #include <linux/namei.h>
-@@ -101,6 +102,12 @@ static int utimes_common(struct path *path, struct timespec *times)
- goto mnt_drop_write_and_out;
- }
- }
-+
-+ if (!gr_acl_handle_utime(path->dentry, path->mnt)) {
-+ error = -EACCES;
-+ goto mnt_drop_write_and_out;
-+ }
-+
- mutex_lock(&inode->i_mutex);
- error = notify_change(path->dentry, &newattrs);
- mutex_unlock(&inode->i_mutex);
-diff --git a/fs/xattr.c b/fs/xattr.c
-index 6d4f6d3..cda3958 100644
---- a/fs/xattr.c
-+++ b/fs/xattr.c
-@@ -247,7 +247,7 @@ EXPORT_SYMBOL_GPL(vfs_removexattr);
- * Extended attribute SET operations
- */
- static long
--setxattr(struct dentry *d, const char __user *name, const void __user *value,
-+setxattr(struct path *path, const char __user *name, const void __user *value,
- size_t size, int flags)
- {
- int error;
-@@ -271,7 +271,13 @@ setxattr(struct dentry *d, const char __user *name, const void __user *value,
- return PTR_ERR(kvalue);
- }
-
-- error = vfs_setxattr(d, kname, kvalue, size, flags);
-+ if (!gr_acl_handle_setxattr(path->dentry, path->mnt)) {
-+ error = -EACCES;
-+ goto out;
-+ }
-+
-+ error = vfs_setxattr(path->dentry, kname, kvalue, size, flags);
-+out:
- kfree(kvalue);
- return error;
- }
-@@ -288,7 +294,7 @@ SYSCALL_DEFINE5(setxattr, const char __user *, pathname,
- return error;
- error = mnt_want_write(path.mnt);
- if (!error) {
-- error = setxattr(path.dentry, name, value, size, flags);
-+ error = setxattr(&path, name, value, size, flags);
- mnt_drop_write(path.mnt);
- }
- path_put(&path);
-@@ -307,7 +313,7 @@ SYSCALL_DEFINE5(lsetxattr, const char __user *, pathname,
- return error;
- error = mnt_want_write(path.mnt);
- if (!error) {
-- error = setxattr(path.dentry, name, value, size, flags);
-+ error = setxattr(&path, name, value, size, flags);
- mnt_drop_write(path.mnt);
- }
- path_put(&path);
-@@ -318,17 +324,15 @@ SYSCALL_DEFINE5(fsetxattr, int, fd, const char __user *, name,
- const void __user *,value, size_t, size, int, flags)
- {
- struct file *f;
-- struct dentry *dentry;
- int error = -EBADF;
-
- f = fget(fd);
- if (!f)
- return error;
-- dentry = f->f_path.dentry;
-- audit_inode(NULL, dentry);
-+ audit_inode(NULL, f->f_path.dentry);
- error = mnt_want_write_file(f);
- if (!error) {
-- error = setxattr(dentry, name, value, size, flags);
-+ error = setxattr(&f->f_path, name, value, size, flags);
- mnt_drop_write(f->f_path.mnt);
- }
- fput(f);
-diff --git a/fs/xattr_acl.c b/fs/xattr_acl.c
-index c6ad7c7..f2847a7 100644
---- a/fs/xattr_acl.c
-+++ b/fs/xattr_acl.c
-@@ -17,8 +17,8 @@
- struct posix_acl *
- posix_acl_from_xattr(const void *value, size_t size)
- {
-- posix_acl_xattr_header *header = (posix_acl_xattr_header *)value;
-- posix_acl_xattr_entry *entry = (posix_acl_xattr_entry *)(header+1), *end;
-+ const posix_acl_xattr_header *header = (const posix_acl_xattr_header *)value;
-+ const posix_acl_xattr_entry *entry = (const posix_acl_xattr_entry *)(header+1), *end;
- int count;
- struct posix_acl *acl;
- struct posix_acl_entry *acl_e;
-diff --git a/fs/xfs/linux-2.6/xfs_ioctl.c b/fs/xfs/linux-2.6/xfs_ioctl.c
-index 942362f..88f96f5 100644
---- a/fs/xfs/linux-2.6/xfs_ioctl.c
-+++ b/fs/xfs/linux-2.6/xfs_ioctl.c
-@@ -134,7 +134,7 @@ xfs_find_handle(
- }
-
- error = -EFAULT;
-- if (copy_to_user(hreq->ohandle, &handle, hsize) ||
-+ if (hsize > sizeof handle || copy_to_user(hreq->ohandle, &handle, hsize) ||
- copy_to_user(hreq->ohandlen, &hsize, sizeof(__s32)))
- goto out_put;
-
-@@ -423,7 +423,7 @@ xfs_attrlist_by_handle(
- if (IS_ERR(dentry))
- return PTR_ERR(dentry);
-
-- kbuf = kmalloc(al_hreq.buflen, GFP_KERNEL);
-+ kbuf = kzalloc(al_hreq.buflen, GFP_KERNEL);
- if (!kbuf)
- goto out_dput;
-
-@@ -697,7 +697,7 @@ xfs_ioc_fsgeometry_v1(
- xfs_mount_t *mp,
- void __user *arg)
- {
-- xfs_fsop_geom_t fsgeo;
-+ xfs_fsop_geom_t fsgeo;
- int error;
-
- error = xfs_fs_geometry(mp, &fsgeo, 3);
-diff --git a/fs/xfs/linux-2.6/xfs_ioctl32.c b/fs/xfs/linux-2.6/xfs_ioctl32.c
-index bad485a..479bd32 100644
---- a/fs/xfs/linux-2.6/xfs_ioctl32.c
-+++ b/fs/xfs/linux-2.6/xfs_ioctl32.c
-@@ -75,6 +75,7 @@ xfs_compat_ioc_fsgeometry_v1(
- xfs_fsop_geom_t fsgeo;
- int error;
-
-+ memset(&fsgeo, 0, sizeof(fsgeo));
- error = xfs_fs_geometry(mp, &fsgeo, 3);
- if (error)
- return -error;
-diff --git a/fs/xfs/linux-2.6/xfs_iops.c b/fs/xfs/linux-2.6/xfs_iops.c
-index 1f3b4b8..6102f6d 100644
---- a/fs/xfs/linux-2.6/xfs_iops.c
-+++ b/fs/xfs/linux-2.6/xfs_iops.c
-@@ -468,7 +468,7 @@ xfs_vn_put_link(
- struct nameidata *nd,
- void *p)
- {
-- char *s = nd_get_link(nd);
-+ const char *s = nd_get_link(nd);
-
- if (!IS_ERR(s))
- kfree(s);
-diff --git a/fs/xfs/xfs_bmap.c b/fs/xfs/xfs_bmap.c
-index 8971fb0..5fc1eb2 100644
---- a/fs/xfs/xfs_bmap.c
-+++ b/fs/xfs/xfs_bmap.c
-@@ -360,7 +360,7 @@ xfs_bmap_validate_ret(
- int nmap,
- int ret_nmap);
- #else
--#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap)
-+#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap) do {} while (0)
- #endif /* DEBUG */
-
- #if defined(XFS_RW_TRACE)
-diff --git a/fs/xfs/xfs_dir2_sf.c b/fs/xfs/xfs_dir2_sf.c
-index e89734e..5e84d8d 100644
---- a/fs/xfs/xfs_dir2_sf.c
-+++ b/fs/xfs/xfs_dir2_sf.c
-@@ -779,7 +779,15 @@ xfs_dir2_sf_getdents(
- }
-
- ino = xfs_dir2_sf_get_inumber(sfp, xfs_dir2_sf_inumberp(sfep));
-- if (filldir(dirent, sfep->name, sfep->namelen,
-+ if (dp->i_df.if_u1.if_data == dp->i_df.if_u2.if_inline_data) {
-+ char name[sfep->namelen];
-+ memcpy(name, sfep->name, sfep->namelen);
-+ if (filldir(dirent, name, sfep->namelen,
-+ off & 0x7fffffff, ino, DT_UNKNOWN)) {
-+ *offset = off & 0x7fffffff;
-+ return 0;
-+ }
-+ } else if (filldir(dirent, sfep->name, sfep->namelen,
- off & 0x7fffffff, ino, DT_UNKNOWN)) {
- *offset = off & 0x7fffffff;
- return 0;
-diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig
-new file mode 100644
-index 0000000..23e4fc1
---- /dev/null
-+++ b/grsecurity/Kconfig
-@@ -0,0 +1,1003 @@
-+#
-+# grecurity configuration
-+#
-+menu "Memory Protections"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_KMEM
-+ bool "Deny reading/writing to /dev/kmem, /dev/mem, and /dev/port"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ select STRICT_DEVMEM if (X86 || ARM || TILE || S390)
-+ help
-+ If you say Y here, /dev/kmem and /dev/mem won't be allowed to
-+ be written to or read from to modify or leak the contents of the running
-+ kernel. /dev/port will also not be allowed to be opened and support
-+ for /dev/cpu/*/msr will be removed. If you have module
-+ support disabled, enabling this will close up five ways that are
-+ currently used to insert malicious code into the running kernel.
-+
-+ Even with all these features enabled, we still highly recommend that
-+ you use the RBAC system, as it is still possible for an attacker to
-+ modify the running kernel through privileged I/O granted by ioperm/iopl.
-+
-+ If you are not using XFree86, you may be able to stop this additional
-+ case by enabling the 'Disable privileged I/O' option. Though nothing
-+ legitimately writes to /dev/kmem, XFree86 does need to write to /dev/mem,
-+ but only to video memory, which is the only writing we allow in this
-+ case. If /dev/kmem or /dev/mem are mmaped without PROT_WRITE, they will
-+ not be allowed to mprotect it with PROT_WRITE later.
-+ Enabling this feature will prevent the "cpupower" and "powertop" tools
-+ from working.
-+
-+ It is highly recommended that you say Y here if you meet all the
-+ conditions above.
-+
-+config GRKERNSEC_VM86
-+ bool "Restrict VM86 mode"
-+ default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_SERVER)
-+ depends on X86_32
-+
-+ help
-+ If you say Y here, only processes with CAP_SYS_RAWIO will be able to
-+ make use of a special execution mode on 32bit x86 processors called
-+ Virtual 8086 (VM86) mode. XFree86 may need vm86 mode for certain
-+ video cards and will still work with this option enabled. The purpose
-+ of the option is to prevent exploitation of emulation errors in
-+ virtualization of vm86 mode like the one discovered in VMWare in 2009.
-+ Nearly all users should be able to enable this option.
-+
-+config GRKERNSEC_IO
-+ bool "Disable privileged I/O"
-+ default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_SERVER)
-+ depends on X86
-+ select RTC_CLASS
-+ select RTC_INTF_DEV
-+ select RTC_DRV_CMOS
-+
-+ help
-+ If you say Y here, all ioperm and iopl calls will return an error.
-+ Ioperm and iopl can be used to modify the running kernel.
-+ Unfortunately, some programs need this access to operate properly,
-+ the most notable of which are XFree86 and hwclock. hwclock can be
-+ remedied by having RTC support in the kernel, so real-time
-+ clock support is enabled if this option is enabled, to ensure
-+ that hwclock operates correctly. XFree86 still will not
-+ operate correctly with this option enabled, so DO NOT CHOOSE Y
-+ IF YOU USE XFree86. If you use XFree86 and you still want to
-+ protect your kernel against modification, use the RBAC system.
-+
-+config GRKERNSEC_RAND_THREADSTACK
-+ bool "Insert random gaps between thread stacks"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on PAX_RANDMMAP && !PPC
-+ help
-+ If you say Y here, a random-sized gap will be enforced between allocated
-+ thread stacks. Glibc's NPTL and other threading libraries that
-+ pass MAP_STACK to the kernel for thread stack allocation are supported.
-+ The implementation currently provides 8 bits of entropy for the gap.
-+
-+ Many distributions do not compile threaded remote services with the
-+ -fstack-check argument to GCC, causing the variable-sized stack-based
-+ allocator, alloca(), to not probe the stack on allocation. This
-+ permits an unbounded alloca() to skip over any guard page and potentially
-+ modify another thread's stack reliably. An enforced random gap
-+ reduces the reliability of such an attack and increases the chance
-+ that such a read/write to another thread's stack instead lands in
-+ an unmapped area, causing a crash and triggering grsecurity's
-+ anti-bruteforcing logic.
-+
-+config GRKERNSEC_PROC_MEMMAP
-+ bool "Harden ASLR against information leaks and entropy reduction"
-+ default y if (GRKERNSEC_CONFIG_AUTO || PAX_NOEXEC || PAX_ASLR)
-+ depends on PAX_NOEXEC || PAX_ASLR
-+ help
-+ If you say Y here, the /proc/<pid>/maps and /proc/<pid>/stat files will
-+ give no information about the addresses of its mappings if
-+ PaX features that rely on random addresses are enabled on the task.
-+ In addition to sanitizing this information and disabling other
-+ dangerous sources of information, this option causes reads of sensitive
-+ /proc/<pid> entries where the file descriptor was opened in a different
-+ task than the one performing the read. Such attempts are logged.
-+ This option also limits argv/env strings for suid/sgid binaries
-+ to 512KB to prevent a complete exhaustion of the stack entropy provided
-+ by ASLR. Finally, it places an 8MB stack resource limit on suid/sgid
-+ binaries to prevent alternative mmap layouts from being abused.
-+
-+ If you use PaX it is essential that you say Y here as it closes up
-+ several holes that make full ASLR useless locally.
-+
-+config GRKERNSEC_BRUTE
-+ bool "Deter exploit bruteforcing"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ If you say Y here, attempts to bruteforce exploits against forking
-+ daemons such as apache or sshd, as well as against suid/sgid binaries
-+ will be deterred. When a child of a forking daemon is killed by PaX
-+ or crashes due to an illegal instruction or other suspicious signal,
-+ the parent process will be delayed 30 seconds upon every subsequent
-+ fork until the administrator is able to assess the situation and
-+ restart the daemon.
-+ In the suid/sgid case, the attempt is logged, the user has all their
-+ processes terminated, and they are prevented from executing any further
-+ processes for 15 minutes.
-+ It is recommended that you also enable signal logging in the auditing
-+ section so that logs are generated when a process triggers a suspicious
-+ signal.
-+ If the sysctl option is enabled, a sysctl option with name
-+ "deter_bruteforce" is created.
-+
-+config GRKERNSEC_MODHARDEN
-+ bool "Harden module auto-loading"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on MODULES
-+ help
-+ If you say Y here, module auto-loading in response to use of some
-+ feature implemented by an unloaded module will be restricted to
-+ root users. Enabling this option helps defend against attacks
-+ by unprivileged users who abuse the auto-loading behavior to
-+ cause a vulnerable module to load that is then exploited.
-+
-+ If this option prevents a legitimate use of auto-loading for a
-+ non-root user, the administrator can execute modprobe manually
-+ with the exact name of the module mentioned in the alert log.
-+ Alternatively, the administrator can add the module to the list
-+ of modules loaded at boot by modifying init scripts.
-+
-+ Modification of init scripts will most likely be needed on
-+ Ubuntu servers with encrypted home directory support enabled,
-+ as the first non-root user logging in will cause the ecb(aes),
-+ ecb(aes)-all, cbc(aes), and cbc(aes)-all modules to be loaded.
-+
-+config GRKERNSEC_HIDESYM
-+ bool "Hide kernel symbols"
-+ select PAX_USERCOPY_SLABS
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ If you say Y here, getting information on loaded modules, and
-+ displaying all kernel symbols through a syscall will be restricted
-+ to users with CAP_SYS_MODULE. For software compatibility reasons,
-+ /proc/kallsyms will be restricted to the root user. The RBAC
-+ system can hide that entry even from root.
-+
-+ This option also prevents leaking of kernel addresses through
-+ several /proc entries.
-+
-+ Note that this option is only effective provided the following
-+ conditions are met:
-+ 1) The kernel using grsecurity is not precompiled by some distribution
-+ 2) You have also enabled GRKERNSEC_DMESG
-+ 3) You are using the RBAC system and hiding other files such as your
-+ kernel image and System.map. Alternatively, enabling this option
-+ causes the permissions on /boot, /lib/modules, and the kernel
-+ source directory to change at compile time to prevent
-+ reading by non-root users.
-+ If the above conditions are met, this option will aid in providing a
-+ useful protection against local kernel exploitation of overflows
-+ and arbitrary read/write vulnerabilities.
-+
-+config GRKERNSEC_KERN_LOCKOUT
-+ bool "Active kernel exploit response"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on X86 || ARM || PPC || SPARC
-+ help
-+ If you say Y here, when a PaX alert is triggered due to suspicious
-+ activity in the kernel (from KERNEXEC/UDEREF/USERCOPY)
-+ or an OOPS occurs due to bad memory accesses, instead of just
-+ terminating the offending process (and potentially allowing
-+ a subsequent exploit from the same user), we will take one of two
-+ actions:
-+ If the user was root, we will panic the system
-+ If the user was non-root, we will log the attempt, terminate
-+ all processes owned by the user, then prevent them from creating
-+ any new processes until the system is restarted
-+ This deters repeated kernel exploitation/bruteforcing attempts
-+ and is useful for later forensics.
-+
-+endmenu
-+menu "Role Based Access Control Options"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_RBAC_DEBUG
-+ bool
-+
-+config GRKERNSEC_NO_RBAC
-+ bool "Disable RBAC system"
-+ help
-+ If you say Y here, the /dev/grsec device will be removed from the kernel,
-+ preventing the RBAC system from being enabled. You should only say Y
-+ here if you have no intention of using the RBAC system, so as to prevent
-+ an attacker with root access from misusing the RBAC system to hide files
-+ and processes when loadable module support and /dev/[k]mem have been
-+ locked down.
-+
-+config GRKERNSEC_ACL_HIDEKERN
-+ bool "Hide kernel processes"
-+ help
-+ If you say Y here, all kernel threads will be hidden to all
-+ processes but those whose subject has the "view hidden processes"
-+ flag.
-+
-+config GRKERNSEC_ACL_MAXTRIES
-+ int "Maximum tries before password lockout"
-+ default 3
-+ help
-+ This option enforces the maximum number of times a user can attempt
-+ to authorize themselves with the grsecurity RBAC system before being
-+ denied the ability to attempt authorization again for a specified time.
-+ The lower the number, the harder it will be to brute-force a password.
-+
-+config GRKERNSEC_ACL_TIMEOUT
-+ int "Time to wait after max password tries, in seconds"
-+ default 30
-+ help
-+ This option specifies the time the user must wait after attempting to
-+ authorize to the RBAC system with the maximum number of invalid
-+ passwords. The higher the number, the harder it will be to brute-force
-+ a password.
-+
-+endmenu
-+menu "Filesystem Protections"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_PROC
-+ bool "Proc restrictions"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ If you say Y here, the permissions of the /proc filesystem
-+ will be altered to enhance system security and privacy. You MUST
-+ choose either a user only restriction or a user and group restriction.
-+ Depending upon the option you choose, you can either restrict users to
-+ see only the processes they themselves run, or choose a group that can
-+ view all processes and files normally restricted to root if you choose
-+ the "restrict to user only" option. NOTE: If you're running identd or
-+ ntpd as a non-root user, you will have to run it as the group you
-+ specify here.
-+
-+config GRKERNSEC_PROC_USER
-+ bool "Restrict /proc to user only"
-+ depends on GRKERNSEC_PROC
-+ help
-+ If you say Y here, non-root users will only be able to view their own
-+ processes, and restricts them from viewing network-related information,
-+ and viewing kernel symbol and module information.
-+
-+config GRKERNSEC_PROC_USERGROUP
-+ bool "Allow special group"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
-+ help
-+ If you say Y here, you will be able to select a group that will be
-+ able to view all processes and network-related information. If you've
-+ enabled GRKERNSEC_HIDESYM, kernel and symbol information may still
-+ remain hidden. This option is useful if you want to run identd as
-+ a non-root user. The group you select may also be chosen at boot time
-+ via "grsec_proc_gid=" on the kernel commandline.
-+
-+config GRKERNSEC_PROC_GID
-+ int "GID for special group"
-+ depends on GRKERNSEC_PROC_USERGROUP
-+ default 1001
-+
-+config GRKERNSEC_PROC_ADD
-+ bool "Additional restrictions"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
-+ help
-+ If you say Y here, additional restrictions will be placed on
-+ /proc that keep normal users from viewing device information and
-+ slabinfo information that could be useful for exploits.
-+
-+config GRKERNSEC_LINK
-+ bool "Linking restrictions"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ If you say Y here, /tmp race exploits will be prevented, since users
-+ will no longer be able to follow symlinks owned by other users in
-+ world-writable +t directories (e.g. /tmp), unless the owner of the
-+ symlink is the owner of the directory. users will also not be
-+ able to hardlink to files they do not own. If the sysctl option is
-+ enabled, a sysctl option with name "linking_restrictions" is created.
-+
-+config GRKERNSEC_SYMLINKOWN
-+ bool "Kernel-enforced SymlinksIfOwnerMatch"
-+ default y if GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_SERVER
-+ help
-+ Apache's SymlinksIfOwnerMatch option has an inherent race condition
-+ that prevents it from being used as a security feature. As Apache
-+ verifies the symlink by performing a stat() against the target of
-+ the symlink before it is followed, an attacker can setup a symlink
-+ to point to a same-owned file, then replace the symlink with one
-+ that targets another user's file just after Apache "validates" the
-+ symlink -- a classic TOCTOU race. If you say Y here, a complete,
-+ race-free replacement for Apache's "SymlinksIfOwnerMatch" option
-+ will be in place for the group you specify. If the sysctl option
-+ is enabled, a sysctl option with name "enforce_symlinksifowner" is
-+ created.
-+
-+config GRKERNSEC_SYMLINKOWN_GID
-+ int "GID for users with kernel-enforced SymlinksIfOwnerMatch"
-+ depends on GRKERNSEC_SYMLINKOWN
-+ default 1006
-+ help
-+ Setting this GID determines what group kernel-enforced
-+ SymlinksIfOwnerMatch will be enabled for. If the sysctl option
-+ is enabled, a sysctl option with name "symlinkown_gid" is created.
-+
-+config GRKERNSEC_FIFO
-+ bool "FIFO restrictions"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ If you say Y here, users will not be able to write to FIFOs they don't
-+ own in world-writable +t directories (e.g. /tmp), unless the owner of
-+ the FIFO is the same owner of the directory it's held in. If the sysctl
-+ option is enabled, a sysctl option with name "fifo_restrictions" is
-+ created.
-+
-+config GRKERNSEC_SYSFS_RESTRICT
-+ bool "Sysfs/debugfs restriction"
-+ default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_SERVER)
-+ depends on SYSFS
-+ help
-+ If you say Y here, sysfs (the pseudo-filesystem mounted at /sys) and
-+ any filesystem normally mounted under it (e.g. debugfs) will be
-+ mostly accessible only by root. These filesystems generally provide access
-+ to hardware and debug information that isn't appropriate for unprivileged
-+ users of the system. Sysfs and debugfs have also become a large source
-+ of new vulnerabilities, ranging from infoleaks to local compromise.
-+ There has been very little oversight with an eye toward security involved
-+ in adding new exporters of information to these filesystems, so their
-+ use is discouraged.
-+ For reasons of compatibility, a few directories have been whitelisted
-+ for access by non-root users:
-+ /sys/fs/selinux
-+ /sys/fs/fuse
-+ /sys/devices/system/cpu
-+
-+config GRKERNSEC_ROFS
-+ bool "Runtime read-only mount protection"
-+ help
-+ If you say Y here, a sysctl option with name "romount_protect" will
-+ be created. By setting this option to 1 at runtime, filesystems
-+ will be protected in the following ways:
-+ * No new writable mounts will be allowed
-+ * Existing read-only mounts won't be able to be remounted read/write
-+ * Write operations will be denied on all block devices
-+ This option acts independently of grsec_lock: once it is set to 1,
-+ it cannot be turned off. Therefore, please be mindful of the resulting
-+ behavior if this option is enabled in an init script on a read-only
-+ filesystem. This feature is mainly intended for secure embedded systems.
-+
-+config GRKERNSEC_DEVICE_SIDECHANNEL
-+ bool "Eliminate stat/notify-based device sidechannels"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ If you say Y here, timing analyses on block or character
-+ devices like /dev/ptmx using stat or inotify/dnotify/fanotify
-+ will be thwarted for unprivileged users. If a process without
-+ CAP_MKNOD stats such a device, the last access and last modify times
-+ will match the device's create time. No access or modify events
-+ will be triggered through inotify/dnotify/fanotify for such devices.
-+ This feature will prevent attacks that may at a minimum
-+ allow an attacker to determine the administrator's password length.
-+
-+config GRKERNSEC_CHROOT
-+ bool "Chroot jail restrictions"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ If you say Y here, you will be able to choose several options that will
-+ make breaking out of a chrooted jail much more difficult. If you
-+ encounter no software incompatibilities with the following options, it
-+ is recommended that you enable each one.
-+
-+config GRKERNSEC_CHROOT_MOUNT
-+ bool "Deny mounts"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, processes inside a chroot will not be able to
-+ mount or remount filesystems. If the sysctl option is enabled, a
-+ sysctl option with name "chroot_deny_mount" is created.
-+
-+config GRKERNSEC_CHROOT_DOUBLE
-+ bool "Deny double-chroots"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, processes inside a chroot will not be able to chroot
-+ again outside the chroot. This is a widely used method of breaking
-+ out of a chroot jail and should not be allowed. If the sysctl
-+ option is enabled, a sysctl option with name
-+ "chroot_deny_chroot" is created.
-+
-+config GRKERNSEC_CHROOT_PIVOT
-+ bool "Deny pivot_root in chroot"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, processes inside a chroot will not be able to use
-+ a function called pivot_root() that was introduced in Linux 2.3.41. It
-+ works similar to chroot in that it changes the root filesystem. This
-+ function could be misused in a chrooted process to attempt to break out
-+ of the chroot, and therefore should not be allowed. If the sysctl
-+ option is enabled, a sysctl option with name "chroot_deny_pivot" is
-+ created.
-+
-+config GRKERNSEC_CHROOT_CHDIR
-+ bool "Enforce chdir(\"/\") on all chroots"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, the current working directory of all newly-chrooted
-+ applications will be set to the the root directory of the chroot.
-+ The man page on chroot(2) states:
-+ Note that this call does not change the current working
-+ directory, so that `.' can be outside the tree rooted at
-+ `/'. In particular, the super-user can escape from a
-+ `chroot jail' by doing `mkdir foo; chroot foo; cd ..'.
-+
-+ It is recommended that you say Y here, since it's not known to break
-+ any software. If the sysctl option is enabled, a sysctl option with
-+ name "chroot_enforce_chdir" is created.
-+
-+config GRKERNSEC_CHROOT_CHMOD
-+ bool "Deny (f)chmod +s"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, processes inside a chroot will not be able to chmod
-+ or fchmod files to make them have suid or sgid bits. This protects
-+ against another published method of breaking a chroot. If the sysctl
-+ option is enabled, a sysctl option with name "chroot_deny_chmod" is
-+ created.
-+
-+config GRKERNSEC_CHROOT_FCHDIR
-+ bool "Deny fchdir out of chroot"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, a well-known method of breaking chroots by fchdir'ing
-+ to a file descriptor of the chrooting process that points to a directory
-+ outside the filesystem will be stopped. If the sysctl option
-+ is enabled, a sysctl option with name "chroot_deny_fchdir" is created.
-+
-+config GRKERNSEC_CHROOT_MKNOD
-+ bool "Deny mknod"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, processes inside a chroot will not be allowed to
-+ mknod. The problem with using mknod inside a chroot is that it
-+ would allow an attacker to create a device entry that is the same
-+ as one on the physical root of your system, which could range from
-+ anything from the console device to a device for your harddrive (which
-+ they could then use to wipe the drive or steal data). It is recommended
-+ that you say Y here, unless you run into software incompatibilities.
-+ If the sysctl option is enabled, a sysctl option with name
-+ "chroot_deny_mknod" is created.
-+
-+config GRKERNSEC_CHROOT_SHMAT
-+ bool "Deny shmat() out of chroot"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, processes inside a chroot will not be able to attach
-+ to shared memory segments that were created outside of the chroot jail.
-+ It is recommended that you say Y here. If the sysctl option is enabled,
-+ a sysctl option with name "chroot_deny_shmat" is created.
-+
-+config GRKERNSEC_CHROOT_UNIX
-+ bool "Deny access to abstract AF_UNIX sockets out of chroot"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, processes inside a chroot will not be able to
-+ connect to abstract (meaning not belonging to a filesystem) Unix
-+ domain sockets that were bound outside of a chroot. It is recommended
-+ that you say Y here. If the sysctl option is enabled, a sysctl option
-+ with name "chroot_deny_unix" is created.
-+
-+config GRKERNSEC_CHROOT_FINDTASK
-+ bool "Protect outside processes"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, processes inside a chroot will not be able to
-+ kill, send signals with fcntl, ptrace, capget, getpgid, setpgid,
-+ getsid, or view any process outside of the chroot. If the sysctl
-+ option is enabled, a sysctl option with name "chroot_findtask" is
-+ created.
-+
-+config GRKERNSEC_CHROOT_NICE
-+ bool "Restrict priority changes"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, processes inside a chroot will not be able to raise
-+ the priority of processes in the chroot, or alter the priority of
-+ processes outside the chroot. This provides more security than simply
-+ removing CAP_SYS_NICE from the process' capability set. If the
-+ sysctl option is enabled, a sysctl option with name "chroot_restrict_nice"
-+ is created.
-+
-+config GRKERNSEC_CHROOT_SYSCTL
-+ bool "Deny sysctl writes"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, an attacker in a chroot will not be able to
-+ write to sysctl entries, either by sysctl(2) or through a /proc
-+ interface. It is strongly recommended that you say Y here. If the
-+ sysctl option is enabled, a sysctl option with name
-+ "chroot_deny_sysctl" is created.
-+
-+config GRKERNSEC_CHROOT_CAPS
-+ bool "Capability restrictions"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, the capabilities on all processes within a
-+ chroot jail will be lowered to stop module insertion, raw i/o,
-+ system and net admin tasks, rebooting the system, modifying immutable
-+ files, modifying IPC owned by another, and changing the system time.
-+ This is left an option because it can break some apps. Disable this
-+ if your chrooted apps are having problems performing those kinds of
-+ tasks. If the sysctl option is enabled, a sysctl option with
-+ name "chroot_caps" is created.
-+
-+endmenu
-+menu "Kernel Auditing"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_AUDIT_GROUP
-+ bool "Single group for auditing"
-+ help
-+ If you say Y here, the exec and chdir logging features will only operate
-+ on a group you specify. This option is recommended if you only want to
-+ watch certain users instead of having a large amount of logs from the
-+ entire system. If the sysctl option is enabled, a sysctl option with
-+ name "audit_group" is created.
-+
-+config GRKERNSEC_AUDIT_GID
-+ int "GID for auditing"
-+ depends on GRKERNSEC_AUDIT_GROUP
-+ default 1007
-+
-+config GRKERNSEC_EXECLOG
-+ bool "Exec logging"
-+ help
-+ If you say Y here, all execve() calls will be logged (since the
-+ other exec*() calls are frontends to execve(), all execution
-+ will be logged). Useful for shell-servers that like to keep track
-+ of their users. If the sysctl option is enabled, a sysctl option with
-+ name "exec_logging" is created.
-+ WARNING: This option when enabled will produce a LOT of logs, especially
-+ on an active system.
-+
-+config GRKERNSEC_RESLOG
-+ bool "Resource logging"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ If you say Y here, all attempts to overstep resource limits will
-+ be logged with the resource name, the requested size, and the current
-+ limit. It is highly recommended that you say Y here. If the sysctl
-+ option is enabled, a sysctl option with name "resource_logging" is
-+ created. If the RBAC system is enabled, the sysctl value is ignored.
-+
-+config GRKERNSEC_CHROOT_EXECLOG
-+ bool "Log execs within chroot"
-+ help
-+ If you say Y here, all executions inside a chroot jail will be logged
-+ to syslog. This can cause a large amount of logs if certain
-+ applications (eg. djb's daemontools) are installed on the system, and
-+ is therefore left as an option. If the sysctl option is enabled, a
-+ sysctl option with name "chroot_execlog" is created.
-+
-+config GRKERNSEC_AUDIT_PTRACE
-+ bool "Ptrace logging"
-+ help
-+ If you say Y here, all attempts to attach to a process via ptrace
-+ will be logged. If the sysctl option is enabled, a sysctl option
-+ with name "audit_ptrace" is created.
-+
-+config GRKERNSEC_AUDIT_CHDIR
-+ bool "Chdir logging"
-+ help
-+ If you say Y here, all chdir() calls will be logged. If the sysctl
-+ option is enabled, a sysctl option with name "audit_chdir" is created.
-+
-+config GRKERNSEC_AUDIT_MOUNT
-+ bool "(Un)Mount logging"
-+ help
-+ If you say Y here, all mounts and unmounts will be logged. If the
-+ sysctl option is enabled, a sysctl option with name "audit_mount" is
-+ created.
-+
-+config GRKERNSEC_SIGNAL
-+ bool "Signal logging"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ If you say Y here, certain important signals will be logged, such as
-+ SIGSEGV, which will as a result inform you of when a error in a program
-+ occurred, which in some cases could mean a possible exploit attempt.
-+ If the sysctl option is enabled, a sysctl option with name
-+ "signal_logging" is created.
-+
-+config GRKERNSEC_FORKFAIL
-+ bool "Fork failure logging"
-+ help
-+ If you say Y here, all failed fork() attempts will be logged.
-+ This could suggest a fork bomb, or someone attempting to overstep
-+ their process limit. If the sysctl option is enabled, a sysctl option
-+ with name "forkfail_logging" is created.
-+
-+config GRKERNSEC_TIME
-+ bool "Time change logging"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ If you say Y here, any changes of the system clock will be logged.
-+ If the sysctl option is enabled, a sysctl option with name
-+ "timechange_logging" is created.
-+
-+config GRKERNSEC_PROC_IPADDR
-+ bool "/proc/<pid>/ipaddr support"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ If you say Y here, a new entry will be added to each /proc/<pid>
-+ directory that contains the IP address of the person using the task.
-+ The IP is carried across local TCP and AF_UNIX stream sockets.
-+ This information can be useful for IDS/IPSes to perform remote response
-+ to a local attack. The entry is readable by only the owner of the
-+ process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
-+ the RBAC system), and thus does not create privacy concerns.
-+
-+config GRKERNSEC_RWXMAP_LOG
-+ bool 'Denied RWX mmap/mprotect logging'
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on PAX_MPROTECT && !PAX_EMUPLT && !PAX_EMUSIGRT
-+ help
-+ If you say Y here, calls to mmap() and mprotect() with explicit
-+ usage of PROT_WRITE and PROT_EXEC together will be logged when
-+ denied by the PAX_MPROTECT feature. If the sysctl option is
-+ enabled, a sysctl option with name "rwxmap_logging" is created.
-+
-+config GRKERNSEC_AUDIT_TEXTREL
-+ bool 'ELF text relocations logging (READ HELP)'
-+ depends on PAX_MPROTECT
-+ help
-+ If you say Y here, text relocations will be logged with the filename
-+ of the offending library or binary. The purpose of the feature is
-+ to help Linux distribution developers get rid of libraries and
-+ binaries that need text relocations which hinder the future progress
-+ of PaX. Only Linux distribution developers should say Y here, and
-+ never on a production machine, as this option creates an information
-+ leak that could aid an attacker in defeating the randomization of
-+ a single memory region. If the sysctl option is enabled, a sysctl
-+ option with name "audit_textrel" is created.
-+
-+endmenu
-+
-+menu "Executable Protections"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_DMESG
-+ bool "Dmesg(8) restriction"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ If you say Y here, non-root users will not be able to use dmesg(8)
-+ to view the contents of the kernel's circular log buffer.
-+ The kernel's log buffer often contains kernel addresses and other
-+ identifying information useful to an attacker in fingerprinting a
-+ system for a targeted exploit.
-+ If the sysctl option is enabled, a sysctl option with name "dmesg" is
-+ created.
-+
-+config GRKERNSEC_HARDEN_PTRACE
-+ bool "Deter ptrace-based process snooping"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ If you say Y here, TTY sniffers and other malicious monitoring
-+ programs implemented through ptrace will be defeated. If you
-+ have been using the RBAC system, this option has already been
-+ enabled for several years for all users, with the ability to make
-+ fine-grained exceptions.
-+
-+ This option only affects the ability of non-root users to ptrace
-+ processes that are not a descendent of the ptracing process.
-+ This means that strace ./binary and gdb ./binary will still work,
-+ but attaching to arbitrary processes will not. If the sysctl
-+ option is enabled, a sysctl option with name "harden_ptrace" is
-+ created.
-+
-+config GRKERNSEC_PTRACE_READEXEC
-+ bool "Require read access to ptrace sensitive binaries"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ If you say Y here, unprivileged users will not be able to ptrace unreadable
-+ binaries. This option is useful in environments that
-+ remove the read bits (e.g. file mode 4711) from suid binaries to
-+ prevent infoleaking of their contents. This option adds
-+ consistency to the use of that file mode, as the binary could normally
-+ be read out when run without privileges while ptracing.
-+
-+ If the sysctl option is enabled, a sysctl option with name "ptrace_readexec"
-+ is created.
-+
-+config GRKERNSEC_SETXID
-+ bool "Enforce consistent multithreaded privileges"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on (X86 || SPARC64 || PPC || ARM || MIPS)
-+ help
-+ If you say Y here, a change from a root uid to a non-root uid
-+ in a multithreaded application will cause the resulting uids,
-+ gids, supplementary groups, and capabilities in that thread
-+ to be propagated to the other threads of the process. In most
-+ cases this is unnecessary, as glibc will emulate this behavior
-+ on behalf of the application. Other libcs do not act in the
-+ same way, allowing the other threads of the process to continue
-+ running with root privileges. If the sysctl option is enabled,
-+ a sysctl option with name "consistent_setxid" is created.
-+
-+config GRKERNSEC_TPE
-+ bool "Trusted Path Execution (TPE)"
-+ default y if GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_SERVER
-+ help
-+ If you say Y here, you will be able to choose a gid to add to the
-+ supplementary groups of users you want to mark as "untrusted."
-+ These users will not be able to execute any files that are not in
-+ root-owned directories writable only by root. If the sysctl option
-+ is enabled, a sysctl option with name "tpe" is created.
-+
-+config GRKERNSEC_TPE_ALL
-+ bool "Partially restrict all non-root users"
-+ depends on GRKERNSEC_TPE
-+ help
-+ If you say Y here, all non-root users will be covered under
-+ a weaker TPE restriction. This is separate from, and in addition to,
-+ the main TPE options that you have selected elsewhere. Thus, if a
-+ "trusted" GID is chosen, this restriction applies to even that GID.
-+ Under this restriction, all non-root users will only be allowed to
-+ execute files in directories they own that are not group or
-+ world-writable, or in directories owned by root and writable only by
-+ root. If the sysctl option is enabled, a sysctl option with name
-+ "tpe_restrict_all" is created.
-+
-+config GRKERNSEC_TPE_INVERT
-+ bool "Invert GID option"
-+ depends on GRKERNSEC_TPE
-+ help
-+ If you say Y here, the group you specify in the TPE configuration will
-+ decide what group TPE restrictions will be *disabled* for. This
-+ option is useful if you want TPE restrictions to be applied to most
-+ users on the system. If the sysctl option is enabled, a sysctl option
-+ with name "tpe_invert" is created. Unlike other sysctl options, this
-+ entry will default to on for backward-compatibility.
-+
-+config GRKERNSEC_TPE_GID
-+ int
-+ default GRKERNSEC_TPE_UNTRUSTED_GID if (GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT)
-+ default GRKERNSEC_TPE_TRUSTED_GID if (GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT)
-+
-+config GRKERNSEC_TPE_UNTRUSTED_GID
-+ int "GID for TPE-untrusted users"
-+ depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
-+ default 1005
-+ help
-+ Setting this GID determines what group TPE restrictions will be
-+ *enabled* for. If the sysctl option is enabled, a sysctl option
-+ with name "tpe_gid" is created.
-+
-+config GRKERNSEC_TPE_TRUSTED_GID
-+ int "GID for TPE-trusted users"
-+ depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
-+ default 1005
-+ help
-+ Setting this GID determines what group TPE restrictions will be
-+ *disabled* for. If the sysctl option is enabled, a sysctl option
-+ with name "tpe_gid" is created.
-+
-+endmenu
-+menu "Network Protections"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_RANDNET
-+ bool "Larger entropy pools"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ If you say Y here, the entropy pools used for many features of Linux
-+ and grsecurity will be doubled in size. Since several grsecurity
-+ features use additional randomness, it is recommended that you say Y
-+ here. Saying Y here has a similar effect as modifying
-+ /proc/sys/kernel/random/poolsize.
-+
-+config GRKERNSEC_BLACKHOLE
-+ bool "TCP/UDP blackhole and LAST_ACK DoS prevention"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on NET
-+ help
-+ If you say Y here, neither TCP resets nor ICMP
-+ destination-unreachable packets will be sent in response to packets
-+ sent to ports for which no associated listening process exists.
-+ This feature supports both IPV4 and IPV6 and exempts the
-+ loopback interface from blackholing. Enabling this feature
-+ makes a host more resilient to DoS attacks and reduces network
-+ visibility against scanners.
-+
-+ The blackhole feature as-implemented is equivalent to the FreeBSD
-+ blackhole feature, as it prevents RST responses to all packets, not
-+ just SYNs. Under most application behavior this causes no
-+ problems, but applications (like haproxy) may not close certain
-+ connections in a way that cleanly terminates them on the remote
-+ end, leaving the remote host in LAST_ACK state. Because of this
-+ side-effect and to prevent intentional LAST_ACK DoSes, this
-+ feature also adds automatic mitigation against such attacks.
-+ The mitigation drastically reduces the amount of time a socket
-+ can spend in LAST_ACK state. If you're using haproxy and not
-+ all servers it connects to have this option enabled, consider
-+ disabling this feature on the haproxy host.
-+
-+ If the sysctl option is enabled, two sysctl options with names
-+ "ip_blackhole" and "lastack_retries" will be created.
-+ While "ip_blackhole" takes the standard zero/non-zero on/off
-+ toggle, "lastack_retries" uses the same kinds of values as
-+ "tcp_retries1" and "tcp_retries2". The default value of 4
-+ prevents a socket from lasting more than 45 seconds in LAST_ACK
-+ state.
-+
-+config GRKERNSEC_NO_SIMULT_CONNECT
-+ bool "Disable TCP Simultaneous Connect"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on NET
-+ help
-+ If you say Y here, a feature by Willy Tarreau will be enabled that
-+ removes a weakness in Linux's strict implementation of TCP that
-+ allows two clients to connect to each other without either entering
-+ a listening state. The weakness allows an attacker to easily prevent
-+ a client from connecting to a known server provided the source port
-+ for the connection is guessed correctly.
-+
-+ As the weakness could be used to prevent an antivirus or IPS from
-+ fetching updates, or prevent an SSL gateway from fetching a CRL,
-+ it should be eliminated by enabling this option. Though Linux is
-+ one of few operating systems supporting simultaneous connect, it
-+ has no legitimate use in practice and is rarely supported by firewalls.
-+
-+config GRKERNSEC_SOCKET
-+ bool "Socket restrictions"
-+ depends on NET
-+ help
-+ If you say Y here, you will be able to choose from several options.
-+ If you assign a GID on your system and add it to the supplementary
-+ groups of users you want to restrict socket access to, this patch
-+ will perform up to three things, based on the option(s) you choose.
-+
-+config GRKERNSEC_SOCKET_ALL
-+ bool "Deny any sockets to group"
-+ depends on GRKERNSEC_SOCKET
-+ help
-+ If you say Y here, you will be able to choose a GID of whose users will
-+ be unable to connect to other hosts from your machine or run server
-+ applications from your machine. If the sysctl option is enabled, a
-+ sysctl option with name "socket_all" is created.
-+
-+config GRKERNSEC_SOCKET_ALL_GID
-+ int "GID to deny all sockets for"
-+ depends on GRKERNSEC_SOCKET_ALL
-+ default 1004
-+ help
-+ Here you can choose the GID to disable socket access for. Remember to
-+ add the users you want socket access disabled for to the GID
-+ specified here. If the sysctl option is enabled, a sysctl option
-+ with name "socket_all_gid" is created.
-+
-+config GRKERNSEC_SOCKET_CLIENT
-+ bool "Deny client sockets to group"
-+ depends on GRKERNSEC_SOCKET
-+ help
-+ If you say Y here, you will be able to choose a GID of whose users will
-+ be unable to connect to other hosts from your machine, but will be
-+ able to run servers. If this option is enabled, all users in the group
-+ you specify will have to use passive mode when initiating ftp transfers
-+ from the shell on your machine. If the sysctl option is enabled, a
-+ sysctl option with name "socket_client" is created.
-+
-+config GRKERNSEC_SOCKET_CLIENT_GID
-+ int "GID to deny client sockets for"
-+ depends on GRKERNSEC_SOCKET_CLIENT
-+ default 1003
-+ help
-+ Here you can choose the GID to disable client socket access for.
-+ Remember to add the users you want client socket access disabled for to
-+ the GID specified here. If the sysctl option is enabled, a sysctl
-+ option with name "socket_client_gid" is created.
-+
-+config GRKERNSEC_SOCKET_SERVER
-+ bool "Deny server sockets to group"
-+ depends on GRKERNSEC_SOCKET
-+ help
-+ If you say Y here, you will be able to choose a GID of whose users will
-+ be unable to run server applications from your machine. If the sysctl
-+ option is enabled, a sysctl option with name "socket_server" is created.
-+
-+config GRKERNSEC_SOCKET_SERVER_GID
-+ int "GID to deny server sockets for"
-+ depends on GRKERNSEC_SOCKET_SERVER
-+ default 1002
-+ help
-+ Here you can choose the GID to disable server socket access for.
-+ Remember to add the users you want server socket access disabled for to
-+ the GID specified here. If the sysctl option is enabled, a sysctl
-+ option with name "socket_server_gid" is created.
-+
-+endmenu
-+menu "Sysctl Support"
-+depends on GRKERNSEC && SYSCTL
-+
-+config GRKERNSEC_SYSCTL
-+ bool "Sysctl support"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ If you say Y here, you will be able to change the options that
-+ grsecurity runs with at bootup, without having to recompile your
-+ kernel. You can echo values to files in /proc/sys/kernel/grsecurity
-+ to enable (1) or disable (0) various features. All the sysctl entries
-+ are mutable until the "grsec_lock" entry is set to a non-zero value.
-+ All features enabled in the kernel configuration are disabled at boot
-+ if you do not say Y to the "Turn on features by default" option.
-+ All options should be set at startup, and the grsec_lock entry should
-+ be set to a non-zero value after all the options are set.
-+ *THIS IS EXTREMELY IMPORTANT*
-+
-+config GRKERNSEC_SYSCTL_DISTRO
-+ bool "Extra sysctl support for distro makers (READ HELP)"
-+ depends on GRKERNSEC_SYSCTL && GRKERNSEC_IO
-+ help
-+ If you say Y here, additional sysctl options will be created
-+ for features that affect processes running as root. Therefore,
-+ it is critical when using this option that the grsec_lock entry be
-+ enabled after boot. Only distros with prebuilt kernel packages
-+ with this option enabled that can ensure grsec_lock is enabled
-+ after boot should use this option.
-+ *Failure to set grsec_lock after boot makes all grsec features
-+ this option covers useless*
-+
-+ Currently this option creates the following sysctl entries:
-+ "Disable Privileged I/O": "disable_priv_io"
-+
-+config GRKERNSEC_SYSCTL_ON
-+ bool "Turn on features by default"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC_SYSCTL
-+ help
-+ If you say Y here, instead of having all features enabled in the
-+ kernel configuration disabled at boot time, the features will be
-+ enabled at boot time. It is recommended you say Y here unless
-+ there is some reason you would want all sysctl-tunable features to
-+ be disabled by default. As mentioned elsewhere, it is important
-+ to enable the grsec_lock entry once you have finished modifying
-+ the sysctl entries.
-+
-+endmenu
-+menu "Logging Options"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_FLOODTIME
-+ int "Seconds in between log messages (minimum)"
-+ default 10
-+ help
-+ This option allows you to enforce the number of seconds between
-+ grsecurity log messages. The default should be suitable for most
-+ people, however, if you choose to change it, choose a value small enough
-+ to allow informative logs to be produced, but large enough to
-+ prevent flooding.
-+
-+config GRKERNSEC_FLOODBURST
-+ int "Number of messages in a burst (maximum)"
-+ default 6
-+ help
-+ This option allows you to choose the maximum number of messages allowed
-+ within the flood time interval you chose in a separate option. The
-+ default should be suitable for most people, however if you find that
-+ many of your logs are being interpreted as flooding, you may want to
-+ raise this value.
-+
-+endmenu
-diff --git a/grsecurity/Makefile b/grsecurity/Makefile
-new file mode 100644
-index 0000000..1b9afa9
---- /dev/null
-+++ b/grsecurity/Makefile
-@@ -0,0 +1,38 @@
-+# grsecurity's ACL system was originally written in 2001 by Michael Dalton
-+# during 2001-2009 it has been completely redesigned by Brad Spengler
-+# into an RBAC system
-+#
-+# All code in this directory and various hooks inserted throughout the kernel
-+# are copyright Brad Spengler - Open Source Security, Inc., and released
-+# under the GPL v2 or higher
-+
-+KBUILD_CFLAGS += -Werror
-+
-+obj-y = grsec_chdir.o grsec_chroot.o grsec_exec.o grsec_fifo.o grsec_fork.o \
-+ grsec_mount.o grsec_sig.o grsec_sysctl.o \
-+ grsec_time.o grsec_tpe.o grsec_link.o grsec_pax.o grsec_ptrace.o
-+
-+obj-$(CONFIG_GRKERNSEC) += grsec_init.o grsum.o gracl.o gracl_segv.o \
-+ gracl_cap.o gracl_alloc.o gracl_shm.o grsec_mem.o gracl_fs.o \
-+ gracl_learn.o grsec_log.o
-+obj-$(CONFIG_GRKERNSEC_RESLOG) += gracl_res.o
-+
-+ifdef CONFIG_NET
-+obj-y += grsec_sock.o
-+obj-$(CONFIG_GRKERNSEC) += gracl_ip.o
-+endif
-+
-+ifndef CONFIG_GRKERNSEC
-+obj-y += grsec_disabled.o
-+endif
-+
-+ifdef CONFIG_GRKERNSEC_HIDESYM
-+extra-y := grsec_hidesym.o
-+$(obj)/grsec_hidesym.o:
-+ @-chmod -f 500 /boot
-+ @-chmod -f 500 /lib/modules
-+ @-chmod -f 500 /lib64/modules
-+ @-chmod -f 500 /lib32/modules
-+ @-chmod -f 700 .
-+ @echo ' grsec: protected kernel image paths'
-+endif
-diff --git a/grsecurity/gracl.c b/grsecurity/gracl.c
-new file mode 100644
-index 0000000..5aba5a8
---- /dev/null
-+++ b/grsecurity/gracl.c
-@@ -0,0 +1,4197 @@
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/sched.h>
-+#include <linux/mm.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/namei.h>
-+#include <linux/mount.h>
-+#include <linux/tty.h>
-+#include <linux/proc_fs.h>
-+#include <linux/smp_lock.h>
-+#include <linux/slab.h>
-+#include <linux/vmalloc.h>
-+#include <linux/types.h>
-+#include <linux/sysctl.h>
-+#include <linux/netdevice.h>
-+#include <linux/ptrace.h>
-+#include <linux/gracl.h>
-+#include <linux/gralloc.h>
-+#include <linux/security.h>
-+#include <linux/grinternal.h>
-+#include <linux/pid_namespace.h>
-+#include <linux/stop_machine.h>
-+#include <linux/fdtable.h>
-+#include <linux/percpu.h>
-+
-+#include <asm/uaccess.h>
-+#include <asm/errno.h>
-+#include <asm/mman.h>
-+
-+static struct acl_role_db acl_role_set;
-+static struct name_db name_set;
-+static struct inodev_db inodev_set;
-+
-+/* for keeping track of userspace pointers used for subjects, so we
-+ can share references in the kernel as well
-+*/
-+
-+static struct dentry *real_root;
-+static struct vfsmount *real_root_mnt;
-+
-+static struct acl_subj_map_db subj_map_set;
-+
-+static struct acl_role_label *default_role;
-+
-+static struct acl_role_label *role_list;
-+
-+static u16 acl_sp_role_value;
-+
-+extern char *gr_shared_page[4];
-+static DEFINE_MUTEX(gr_dev_mutex);
-+DEFINE_RWLOCK(gr_inode_lock);
-+
-+struct gr_arg *gr_usermode;
-+
-+static unsigned int gr_status __read_only = GR_STATUS_INIT;
-+
-+extern int chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum);
-+extern void gr_clear_learn_entries(void);
-+
-+#ifdef CONFIG_GRKERNSEC_RESLOG
-+extern void gr_log_resource(const struct task_struct *task,
-+ const int res, const unsigned long wanted, const int gt);
-+#endif
-+
-+unsigned char *gr_system_salt;
-+unsigned char *gr_system_sum;
-+
-+static struct sprole_pw **acl_special_roles = NULL;
-+static __u16 num_sprole_pws = 0;
-+
-+static struct acl_role_label *kernel_role = NULL;
-+
-+static unsigned int gr_auth_attempts = 0;
-+static unsigned long gr_auth_expires = 0UL;
-+
-+#ifdef CONFIG_NET
-+extern struct vfsmount *sock_mnt;
-+#endif
-+extern struct vfsmount *pipe_mnt;
-+extern struct vfsmount *shm_mnt;
-+#ifdef CONFIG_HUGETLBFS
-+extern struct vfsmount *hugetlbfs_vfsmount;
-+#endif
-+
-+static struct acl_object_label *fakefs_obj_rw;
-+static struct acl_object_label *fakefs_obj_rwx;
-+
-+extern int gr_init_uidset(void);
-+extern void gr_free_uidset(void);
-+extern void gr_remove_uid(uid_t uid);
-+extern int gr_find_uid(uid_t uid);
-+
-+__inline__ int
-+gr_acl_is_enabled(void)
-+{
-+ return (gr_status & GR_READY);
-+}
-+
-+#ifdef CONFIG_BTRFS_FS
-+extern dev_t get_btrfs_dev_from_inode(struct inode *inode);
-+extern int btrfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat);
-+#endif
-+
-+static inline dev_t __get_dev(const struct dentry *dentry)
-+{
-+#ifdef CONFIG_BTRFS_FS
-+ if (dentry->d_inode->i_op && dentry->d_inode->i_op->getattr == &btrfs_getattr)
-+ return get_btrfs_dev_from_inode(dentry->d_inode);
-+ else
-+#endif
-+ return dentry->d_inode->i_sb->s_dev;
-+}
-+
-+dev_t gr_get_dev_from_dentry(struct dentry *dentry)
-+{
-+ return __get_dev(dentry);
-+}
-+
-+static char gr_task_roletype_to_char(struct task_struct *task)
-+{
-+ switch (task->role->roletype &
-+ (GR_ROLE_DEFAULT | GR_ROLE_USER | GR_ROLE_GROUP |
-+ GR_ROLE_SPECIAL)) {
-+ case GR_ROLE_DEFAULT:
-+ return 'D';
-+ case GR_ROLE_USER:
-+ return 'U';
-+ case GR_ROLE_GROUP:
-+ return 'G';
-+ case GR_ROLE_SPECIAL:
-+ return 'S';
-+ }
-+
-+ return 'X';
-+}
-+
-+char gr_roletype_to_char(void)
-+{
-+ return gr_task_roletype_to_char(current);
-+}
-+
-+__inline__ int
-+gr_acl_tpe_check(void)
-+{
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return 0;
-+ if (current->role->roletype & GR_ROLE_TPE)
-+ return 1;
-+ else
-+ return 0;
-+}
-+
-+int
-+gr_handle_rawio(const struct inode *inode)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
-+ if (inode && S_ISBLK(inode->i_mode) &&
-+ grsec_enable_chroot_caps && proc_is_chrooted(current) &&
-+ !capable(CAP_SYS_RAWIO))
-+ return 1;
-+#endif
-+ return 0;
-+}
-+
-+static int
-+gr_streq(const char *a, const char *b, const unsigned int lena, const unsigned int lenb)
-+{
-+ if (likely(lena != lenb))
-+ return 0;
-+
-+ return !memcmp(a, b, lena);
-+}
-+
-+static int prepend(char **buffer, int *buflen, const char *str, int namelen)
-+{
-+ *buflen -= namelen;
-+ if (*buflen < 0)
-+ return -ENAMETOOLONG;
-+ *buffer -= namelen;
-+ memcpy(*buffer, str, namelen);
-+ return 0;
-+}
-+
-+/* this must be called with vfsmount_lock and dcache_lock held */
-+
-+static char * __our_d_path(struct dentry *dentry, struct vfsmount *vfsmnt,
-+ struct dentry *root, struct vfsmount *rootmnt,
-+ char *buffer, int buflen)
-+{
-+ char * end = buffer+buflen;
-+ char * retval;
-+ int namelen;
-+
-+ *--end = '\0';
-+ buflen--;
-+
-+ if (buflen < 1)
-+ goto Elong;
-+ /* Get '/' right */
-+ retval = end-1;
-+ *retval = '/';
-+
-+ for (;;) {
-+ struct dentry * parent;
-+
-+ if (dentry == root && vfsmnt == rootmnt)
-+ break;
-+ if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
-+ /* Global root? */
-+ if (vfsmnt->mnt_parent == vfsmnt)
-+ goto global_root;
-+ dentry = vfsmnt->mnt_mountpoint;
-+ vfsmnt = vfsmnt->mnt_parent;
-+ continue;
-+ }
-+ parent = dentry->d_parent;
-+ prefetch(parent);
-+ namelen = dentry->d_name.len;
-+ buflen -= namelen + 1;
-+ if (buflen < 0)
-+ goto Elong;
-+ end -= namelen;
-+ memcpy(end, dentry->d_name.name, namelen);
-+ *--end = '/';
-+ retval = end;
-+ dentry = parent;
-+ }
-+
-+out:
-+ return retval;
-+
-+global_root:
-+ namelen = dentry->d_name.len;
-+ buflen -= namelen;
-+ if (buflen < 0)
-+ goto Elong;
-+ retval -= namelen-1; /* hit the slash */
-+ memcpy(retval, dentry->d_name.name, namelen);
-+ goto out;
-+Elong:
-+ retval = ERR_PTR(-ENAMETOOLONG);
-+ goto out;
-+}
-+
-+static char *
-+gen_full_path(struct dentry *dentry, struct vfsmount *vfsmnt,
-+ struct dentry *root, struct vfsmount *rootmnt, char *buf, int buflen)
-+{
-+ char *retval;
-+
-+ retval = __our_d_path(dentry, vfsmnt, root, rootmnt, buf, buflen);
-+ if (unlikely(IS_ERR(retval)))
-+ retval = strcpy(buf, "<path too long>");
-+ else if (unlikely(retval[1] == '/' && retval[2] == '\0'))
-+ retval[1] = '\0';
-+
-+ return retval;
-+}
-+
-+static char *
-+__d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
-+ char *buf, int buflen)
-+{
-+ char *res;
-+
-+ /* we can use real_root, real_root_mnt, because this is only called
-+ by the RBAC system */
-+ res = gen_full_path((struct dentry *)dentry, (struct vfsmount *)vfsmnt, real_root, real_root_mnt, buf, buflen);
-+
-+ return res;
-+}
-+
-+static char *
-+d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
-+ char *buf, int buflen)
-+{
-+ char *res;
-+ struct dentry *root;
-+ struct vfsmount *rootmnt;
-+ struct task_struct *reaper = &init_task;
-+
-+ /* we can't use real_root, real_root_mnt, because they belong only to the RBAC system */
-+ read_lock(&reaper->fs->lock);
-+ root = dget(reaper->fs->root.dentry);
-+ rootmnt = mntget(reaper->fs->root.mnt);
-+ read_unlock(&reaper->fs->lock);
-+
-+ spin_lock(&dcache_lock);
-+ spin_lock(&vfsmount_lock);
-+ res = gen_full_path((struct dentry *)dentry, (struct vfsmount *)vfsmnt, root, rootmnt, buf, buflen);
-+ spin_unlock(&vfsmount_lock);
-+ spin_unlock(&dcache_lock);
-+
-+ dput(root);
-+ mntput(rootmnt);
-+ return res;
-+}
-+
-+static char *
-+gr_to_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ char *ret;
-+ spin_lock(&dcache_lock);
-+ spin_lock(&vfsmount_lock);
-+ ret = __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
-+ PAGE_SIZE);
-+ spin_unlock(&vfsmount_lock);
-+ spin_unlock(&dcache_lock);
-+ return ret;
-+}
-+
-+static char *
-+gr_to_proc_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ char *ret;
-+ char *buf;
-+ int buflen;
-+
-+ spin_lock(&dcache_lock);
-+ spin_lock(&vfsmount_lock);
-+ buf = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
-+ ret = __d_real_path(dentry, mnt, buf, PAGE_SIZE - 6);
-+ buflen = (int)(ret - buf);
-+ if (buflen >= 5)
-+ prepend(&ret, &buflen, "/proc", 5);
-+ else
-+ ret = strcpy(buf, "<path too long>");
-+ spin_unlock(&vfsmount_lock);
-+ spin_unlock(&dcache_lock);
-+ return ret;
-+}
-+
-+char *
-+gr_to_filename_nolock(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
-+ PAGE_SIZE);
-+}
-+
-+char *
-+gr_to_filename(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
-+ PAGE_SIZE);
-+}
-+
-+char *
-+gr_to_filename1(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[1], smp_processor_id()),
-+ PAGE_SIZE);
-+}
-+
-+char *
-+gr_to_filename2(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[2], smp_processor_id()),
-+ PAGE_SIZE);
-+}
-+
-+char *
-+gr_to_filename3(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[3], smp_processor_id()),
-+ PAGE_SIZE);
-+}
-+
-+__inline__ __u32
-+to_gr_audit(const __u32 reqmode)
-+{
-+ /* masks off auditable permission flags, then shifts them to create
-+ auditing flags, and adds the special case of append auditing if
-+ we're requesting write */
-+ return (((reqmode & ~GR_AUDITS) << 10) | ((reqmode & GR_WRITE) ? GR_AUDIT_APPEND : 0));
-+}
-+
-+struct acl_subject_label *
-+lookup_subject_map(const struct acl_subject_label *userp)
-+{
-+ unsigned int index = gr_shash(userp, subj_map_set.s_size);
-+ struct subject_map *match;
-+
-+ match = subj_map_set.s_hash[index];
-+
-+ while (match && match->user != userp)
-+ match = match->next;
-+
-+ if (match != NULL)
-+ return match->kernel;
-+ else
-+ return NULL;
-+}
-+
-+static void
-+insert_subj_map_entry(struct subject_map *subjmap)
-+{
-+ unsigned int index = gr_shash(subjmap->user, subj_map_set.s_size);
-+ struct subject_map **curr;
-+
-+ subjmap->prev = NULL;
-+
-+ curr = &subj_map_set.s_hash[index];
-+ if (*curr != NULL)
-+ (*curr)->prev = subjmap;
-+
-+ subjmap->next = *curr;
-+ *curr = subjmap;
-+
-+ return;
-+}
-+
-+static struct acl_role_label *
-+lookup_acl_role_label(const struct task_struct *task, const uid_t uid,
-+ const gid_t gid)
-+{
-+ unsigned int index = gr_rhash(uid, GR_ROLE_USER, acl_role_set.r_size);
-+ struct acl_role_label *match;
-+ struct role_allowed_ip *ipp;
-+ unsigned int x;
-+ u32 curr_ip = task->signal->curr_ip;
-+
-+ task->signal->saved_ip = curr_ip;
-+
-+ match = acl_role_set.r_hash[index];
-+
-+ while (match) {
-+ if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_USER)) == (GR_ROLE_DOMAIN | GR_ROLE_USER)) {
-+ for (x = 0; x < match->domain_child_num; x++) {
-+ if (match->domain_children[x] == uid)
-+ goto found;
-+ }
-+ } else if (match->uidgid == uid && match->roletype & GR_ROLE_USER)
-+ break;
-+ match = match->next;
-+ }
-+found:
-+ if (match == NULL) {
-+ try_group:
-+ index = gr_rhash(gid, GR_ROLE_GROUP, acl_role_set.r_size);
-+ match = acl_role_set.r_hash[index];
-+
-+ while (match) {
-+ if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) == (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) {
-+ for (x = 0; x < match->domain_child_num; x++) {
-+ if (match->domain_children[x] == gid)
-+ goto found2;
-+ }
-+ } else if (match->uidgid == gid && match->roletype & GR_ROLE_GROUP)
-+ break;
-+ match = match->next;
-+ }
-+found2:
-+ if (match == NULL)
-+ match = default_role;
-+ if (match->allowed_ips == NULL)
-+ return match;
-+ else {
-+ for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
-+ if (likely
-+ ((ntohl(curr_ip) & ipp->netmask) ==
-+ (ntohl(ipp->addr) & ipp->netmask)))
-+ return match;
-+ }
-+ match = default_role;
-+ }
-+ } else if (match->allowed_ips == NULL) {
-+ return match;
-+ } else {
-+ for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
-+ if (likely
-+ ((ntohl(curr_ip) & ipp->netmask) ==
-+ (ntohl(ipp->addr) & ipp->netmask)))
-+ return match;
-+ }
-+ goto try_group;
-+ }
-+
-+ return match;
-+}
-+
-+struct acl_subject_label *
-+lookup_acl_subj_label(const ino_t ino, const dev_t dev,
-+ const struct acl_role_label *role)
-+{
-+ unsigned int index = gr_fhash(ino, dev, role->subj_hash_size);
-+ struct acl_subject_label *match;
-+
-+ match = role->subj_hash[index];
-+
-+ while (match && (match->inode != ino || match->device != dev ||
-+ (match->mode & GR_DELETED))) {
-+ match = match->next;
-+ }
-+
-+ if (match && !(match->mode & GR_DELETED))
-+ return match;
-+ else
-+ return NULL;
-+}
-+
-+struct acl_subject_label *
-+lookup_acl_subj_label_deleted(const ino_t ino, const dev_t dev,
-+ const struct acl_role_label *role)
-+{
-+ unsigned int index = gr_fhash(ino, dev, role->subj_hash_size);
-+ struct acl_subject_label *match;
-+
-+ match = role->subj_hash[index];
-+
-+ while (match && (match->inode != ino || match->device != dev ||
-+ !(match->mode & GR_DELETED))) {
-+ match = match->next;
-+ }
-+
-+ if (match && (match->mode & GR_DELETED))
-+ return match;
-+ else
-+ return NULL;
-+}
-+
-+static struct acl_object_label *
-+lookup_acl_obj_label(const ino_t ino, const dev_t dev,
-+ const struct acl_subject_label *subj)
-+{
-+ unsigned int index = gr_fhash(ino, dev, subj->obj_hash_size);
-+ struct acl_object_label *match;
-+
-+ match = subj->obj_hash[index];
-+
-+ while (match && (match->inode != ino || match->device != dev ||
-+ (match->mode & GR_DELETED))) {
-+ match = match->next;
-+ }
-+
-+ if (match && !(match->mode & GR_DELETED))
-+ return match;
-+ else
-+ return NULL;
-+}
-+
-+static struct acl_object_label *
-+lookup_acl_obj_label_create(const ino_t ino, const dev_t dev,
-+ const struct acl_subject_label *subj)
-+{
-+ unsigned int index = gr_fhash(ino, dev, subj->obj_hash_size);
-+ struct acl_object_label *match;
-+
-+ match = subj->obj_hash[index];
-+
-+ while (match && (match->inode != ino || match->device != dev ||
-+ !(match->mode & GR_DELETED))) {
-+ match = match->next;
-+ }
-+
-+ if (match && (match->mode & GR_DELETED))
-+ return match;
-+
-+ match = subj->obj_hash[index];
-+
-+ while (match && (match->inode != ino || match->device != dev ||
-+ (match->mode & GR_DELETED))) {
-+ match = match->next;
-+ }
-+
-+ if (match && !(match->mode & GR_DELETED))
-+ return match;
-+ else
-+ return NULL;
-+}
-+
-+static struct name_entry *
-+lookup_name_entry(const char *name)
-+{
-+ unsigned int len = strlen(name);
-+ unsigned int key = full_name_hash(name, len);
-+ unsigned int index = key % name_set.n_size;
-+ struct name_entry *match;
-+
-+ match = name_set.n_hash[index];
-+
-+ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len)))
-+ match = match->next;
-+
-+ return match;
-+}
-+
-+static struct name_entry *
-+lookup_name_entry_create(const char *name)
-+{
-+ unsigned int len = strlen(name);
-+ unsigned int key = full_name_hash(name, len);
-+ unsigned int index = key % name_set.n_size;
-+ struct name_entry *match;
-+
-+ match = name_set.n_hash[index];
-+
-+ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
-+ !match->deleted))
-+ match = match->next;
-+
-+ if (match && match->deleted)
-+ return match;
-+
-+ match = name_set.n_hash[index];
-+
-+ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
-+ match->deleted))
-+ match = match->next;
-+
-+ if (match && !match->deleted)
-+ return match;
-+ else
-+ return NULL;
-+}
-+
-+static struct inodev_entry *
-+lookup_inodev_entry(const ino_t ino, const dev_t dev)
-+{
-+ unsigned int index = gr_fhash(ino, dev, inodev_set.i_size);
-+ struct inodev_entry *match;
-+
-+ match = inodev_set.i_hash[index];
-+
-+ while (match && (match->nentry->inode != ino || match->nentry->device != dev))
-+ match = match->next;
-+
-+ return match;
-+}
-+
-+static void
-+insert_inodev_entry(struct inodev_entry *entry)
-+{
-+ unsigned int index = gr_fhash(entry->nentry->inode, entry->nentry->device,
-+ inodev_set.i_size);
-+ struct inodev_entry **curr;
-+
-+ entry->prev = NULL;
-+
-+ curr = &inodev_set.i_hash[index];
-+ if (*curr != NULL)
-+ (*curr)->prev = entry;
-+
-+ entry->next = *curr;
-+ *curr = entry;
-+
-+ return;
-+}
-+
-+static void
-+__insert_acl_role_label(struct acl_role_label *role, uid_t uidgid)
-+{
-+ unsigned int index =
-+ gr_rhash(uidgid, role->roletype & (GR_ROLE_USER | GR_ROLE_GROUP), acl_role_set.r_size);
-+ struct acl_role_label **curr;
-+ struct acl_role_label *tmp, *tmp2;
-+
-+ curr = &acl_role_set.r_hash[index];
-+
-+ /* simple case, slot is empty, just set it to our role */
-+ if (*curr == NULL) {
-+ *curr = role;
-+ } else {
-+ /* example:
-+ 1 -> 2 -> 3 (adding 2 -> 3 to here)
-+ 2 -> 3
-+ */
-+ /* first check to see if we can already be reached via this slot */
-+ tmp = *curr;
-+ while (tmp && tmp != role)
-+ tmp = tmp->next;
-+ if (tmp == role) {
-+ /* we don't need to add ourselves to this slot's chain */
-+ return;
-+ }
-+ /* we need to add ourselves to this chain, two cases */
-+ if (role->next == NULL) {
-+ /* simple case, append the current chain to our role */
-+ role->next = *curr;
-+ *curr = role;
-+ } else {
-+ /* 1 -> 2 -> 3 -> 4
-+ 2 -> 3 -> 4
-+ 3 -> 4 (adding 1 -> 2 -> 3 -> 4 to here)
-+ */
-+ /* trickier case: walk our role's chain until we find
-+ the role for the start of the current slot's chain */
-+ tmp = role;
-+ tmp2 = *curr;
-+ while (tmp->next && tmp->next != tmp2)
-+ tmp = tmp->next;
-+ if (tmp->next == tmp2) {
-+ /* from example above, we found 3, so just
-+ replace this slot's chain with ours */
-+ *curr = role;
-+ } else {
-+ /* we didn't find a subset of our role's chain
-+ in the current slot's chain, so append their
-+ chain to ours, and set us as the first role in
-+ the slot's chain
-+
-+ we could fold this case with the case above,
-+ but making it explicit for clarity
-+ */
-+ tmp->next = tmp2;
-+ *curr = role;
-+ }
-+ }
-+ }
-+
-+ return;
-+}
-+
-+static void
-+insert_acl_role_label(struct acl_role_label *role)
-+{
-+ int i;
-+
-+ if (role_list == NULL) {
-+ role_list = role;
-+ role->prev = NULL;
-+ } else {
-+ role->prev = role_list;
-+ role_list = role;
-+ }
-+
-+ /* used for hash chains */
-+ role->next = NULL;
-+
-+ if (role->roletype & GR_ROLE_DOMAIN) {
-+ for (i = 0; i < role->domain_child_num; i++)
-+ __insert_acl_role_label(role, role->domain_children[i]);
-+ } else
-+ __insert_acl_role_label(role, role->uidgid);
-+}
-+
-+static int
-+insert_name_entry(char *name, const ino_t inode, const dev_t device, __u8 deleted)
-+{
-+ struct name_entry **curr, *nentry;
-+ struct inodev_entry *ientry;
-+ unsigned int len = strlen(name);
-+ unsigned int key = full_name_hash(name, len);
-+ unsigned int index = key % name_set.n_size;
-+
-+ curr = &name_set.n_hash[index];
-+
-+ while (*curr && ((*curr)->key != key || !gr_streq((*curr)->name, name, (*curr)->len, len)))
-+ curr = &((*curr)->next);
-+
-+ if (*curr != NULL)
-+ return 1;
-+
-+ nentry = acl_alloc(sizeof (struct name_entry));
-+ if (nentry == NULL)
-+ return 0;
-+ ientry = acl_alloc(sizeof (struct inodev_entry));
-+ if (ientry == NULL)
-+ return 0;
-+ ientry->nentry = nentry;
-+
-+ nentry->key = key;
-+ nentry->name = name;
-+ nentry->inode = inode;
-+ nentry->device = device;
-+ nentry->len = len;
-+ nentry->deleted = deleted;
-+
-+ nentry->prev = NULL;
-+ curr = &name_set.n_hash[index];
-+ if (*curr != NULL)
-+ (*curr)->prev = nentry;
-+ nentry->next = *curr;
-+ *curr = nentry;
-+
-+ /* insert us into the table searchable by inode/dev */
-+ insert_inodev_entry(ientry);
-+
-+ return 1;
-+}
-+
-+static void
-+insert_acl_obj_label(struct acl_object_label *obj,
-+ struct acl_subject_label *subj)
-+{
-+ unsigned int index =
-+ gr_fhash(obj->inode, obj->device, subj->obj_hash_size);
-+ struct acl_object_label **curr;
-+
-+
-+ obj->prev = NULL;
-+
-+ curr = &subj->obj_hash[index];
-+ if (*curr != NULL)
-+ (*curr)->prev = obj;
-+
-+ obj->next = *curr;
-+ *curr = obj;
-+
-+ return;
-+}
-+
-+static void
-+insert_acl_subj_label(struct acl_subject_label *obj,
-+ struct acl_role_label *role)
-+{
-+ unsigned int index = gr_fhash(obj->inode, obj->device, role->subj_hash_size);
-+ struct acl_subject_label **curr;
-+
-+ obj->prev = NULL;
-+
-+ curr = &role->subj_hash[index];
-+ if (*curr != NULL)
-+ (*curr)->prev = obj;
-+
-+ obj->next = *curr;
-+ *curr = obj;
-+
-+ return;
-+}
-+
-+/* allocating chained hash tables, so optimal size is where lambda ~ 1 */
-+
-+static void *
-+create_table(__u32 * len, int elementsize)
-+{
-+ unsigned int table_sizes[] = {
-+ 7, 13, 31, 61, 127, 251, 509, 1021, 2039, 4093, 8191, 16381,
-+ 32749, 65521, 131071, 262139, 524287, 1048573, 2097143,
-+ 4194301, 8388593, 16777213, 33554393, 67108859
-+ };
-+ void *newtable = NULL;
-+ unsigned int pwr = 0;
-+
-+ while ((pwr < ((sizeof (table_sizes) / sizeof (table_sizes[0])) - 1)) &&
-+ table_sizes[pwr] <= *len)
-+ pwr++;
-+
-+ if (table_sizes[pwr] <= *len || (table_sizes[pwr] > ULONG_MAX / elementsize))
-+ return newtable;
-+
-+ if ((table_sizes[pwr] * elementsize) <= PAGE_SIZE)
-+ newtable =
-+ kmalloc(table_sizes[pwr] * elementsize, GFP_KERNEL);
-+ else
-+ newtable = vmalloc(table_sizes[pwr] * elementsize);
-+
-+ *len = table_sizes[pwr];
-+
-+ return newtable;
-+}
-+
-+static int
-+init_variables(const struct gr_arg *arg)
-+{
-+ struct task_struct *reaper = &init_task;
-+ unsigned int stacksize;
-+
-+ subj_map_set.s_size = arg->role_db.num_subjects;
-+ acl_role_set.r_size = arg->role_db.num_roles + arg->role_db.num_domain_children;
-+ name_set.n_size = arg->role_db.num_objects;
-+ inodev_set.i_size = arg->role_db.num_objects;
-+
-+ if (!subj_map_set.s_size || !acl_role_set.r_size ||
-+ !name_set.n_size || !inodev_set.i_size)
-+ return 1;
-+
-+ if (!gr_init_uidset())
-+ return 1;
-+
-+ /* set up the stack that holds allocation info */
-+
-+ stacksize = arg->role_db.num_pointers + 5;
-+
-+ if (!acl_alloc_stack_init(stacksize))
-+ return 1;
-+
-+ /* grab reference for the real root dentry and vfsmount */
-+ read_lock(&reaper->fs->lock);
-+ real_root = dget(reaper->fs->root.dentry);
-+ real_root_mnt = mntget(reaper->fs->root.mnt);
-+ read_unlock(&reaper->fs->lock);
-+
-+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
-+ printk(KERN_ALERT "Obtained real root device=%d, inode=%lu\n", __get_dev(real_root), real_root->d_inode->i_ino);
-+#endif
-+
-+ fakefs_obj_rw = acl_alloc(sizeof(struct acl_object_label));
-+ if (fakefs_obj_rw == NULL)
-+ return 1;
-+ fakefs_obj_rw->mode = GR_FIND | GR_READ | GR_WRITE;
-+
-+ fakefs_obj_rwx = acl_alloc(sizeof(struct acl_object_label));
-+ if (fakefs_obj_rwx == NULL)
-+ return 1;
-+ fakefs_obj_rwx->mode = GR_FIND | GR_READ | GR_WRITE | GR_EXEC;
-+
-+ subj_map_set.s_hash =
-+ (struct subject_map **) create_table(&subj_map_set.s_size, sizeof(void *));
-+ acl_role_set.r_hash =
-+ (struct acl_role_label **) create_table(&acl_role_set.r_size, sizeof(void *));
-+ name_set.n_hash = (struct name_entry **) create_table(&name_set.n_size, sizeof(void *));
-+ inodev_set.i_hash =
-+ (struct inodev_entry **) create_table(&inodev_set.i_size, sizeof(void *));
-+
-+ if (!subj_map_set.s_hash || !acl_role_set.r_hash ||
-+ !name_set.n_hash || !inodev_set.i_hash)
-+ return 1;
-+
-+ memset(subj_map_set.s_hash, 0,
-+ sizeof(struct subject_map *) * subj_map_set.s_size);
-+ memset(acl_role_set.r_hash, 0,
-+ sizeof (struct acl_role_label *) * acl_role_set.r_size);
-+ memset(name_set.n_hash, 0,
-+ sizeof (struct name_entry *) * name_set.n_size);
-+ memset(inodev_set.i_hash, 0,
-+ sizeof (struct inodev_entry *) * inodev_set.i_size);
-+
-+ return 0;
-+}
-+
-+/* free information not needed after startup
-+ currently contains user->kernel pointer mappings for subjects
-+*/
-+
-+static void
-+free_init_variables(void)
-+{
-+ __u32 i;
-+
-+ if (subj_map_set.s_hash) {
-+ for (i = 0; i < subj_map_set.s_size; i++) {
-+ if (subj_map_set.s_hash[i]) {
-+ kfree(subj_map_set.s_hash[i]);
-+ subj_map_set.s_hash[i] = NULL;
-+ }
-+ }
-+
-+ if ((subj_map_set.s_size * sizeof (struct subject_map *)) <=
-+ PAGE_SIZE)
-+ kfree(subj_map_set.s_hash);
-+ else
-+ vfree(subj_map_set.s_hash);
-+ }
-+
-+ return;
-+}
-+
-+static void
-+free_variables(void)
-+{
-+ struct acl_subject_label *s;
-+ struct acl_role_label *r;
-+ struct task_struct *task, *task2;
-+ unsigned int x;
-+
-+ gr_clear_learn_entries();
-+
-+ read_lock(&tasklist_lock);
-+ do_each_thread(task2, task) {
-+ task->acl_sp_role = 0;
-+ task->acl_role_id = 0;
-+ task->acl = NULL;
-+ task->role = NULL;
-+ } while_each_thread(task2, task);
-+ read_unlock(&tasklist_lock);
-+
-+ /* release the reference to the real root dentry and vfsmount */
-+ if (real_root)
-+ dput(real_root);
-+ real_root = NULL;
-+ if (real_root_mnt)
-+ mntput(real_root_mnt);
-+ real_root_mnt = NULL;
-+
-+ /* free all object hash tables */
-+
-+ FOR_EACH_ROLE_START(r)
-+ if (r->subj_hash == NULL)
-+ goto next_role;
-+ FOR_EACH_SUBJECT_START(r, s, x)
-+ if (s->obj_hash == NULL)
-+ break;
-+ if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
-+ kfree(s->obj_hash);
-+ else
-+ vfree(s->obj_hash);
-+ FOR_EACH_SUBJECT_END(s, x)
-+ FOR_EACH_NESTED_SUBJECT_START(r, s)
-+ if (s->obj_hash == NULL)
-+ break;
-+ if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
-+ kfree(s->obj_hash);
-+ else
-+ vfree(s->obj_hash);
-+ FOR_EACH_NESTED_SUBJECT_END(s)
-+ if ((r->subj_hash_size * sizeof (struct acl_subject_label *)) <= PAGE_SIZE)
-+ kfree(r->subj_hash);
-+ else
-+ vfree(r->subj_hash);
-+ r->subj_hash = NULL;
-+next_role:
-+ FOR_EACH_ROLE_END(r)
-+
-+ acl_free_all();
-+
-+ if (acl_role_set.r_hash) {
-+ if ((acl_role_set.r_size * sizeof (struct acl_role_label *)) <=
-+ PAGE_SIZE)
-+ kfree(acl_role_set.r_hash);
-+ else
-+ vfree(acl_role_set.r_hash);
-+ }
-+ if (name_set.n_hash) {
-+ if ((name_set.n_size * sizeof (struct name_entry *)) <=
-+ PAGE_SIZE)
-+ kfree(name_set.n_hash);
-+ else
-+ vfree(name_set.n_hash);
-+ }
-+
-+ if (inodev_set.i_hash) {
-+ if ((inodev_set.i_size * sizeof (struct inodev_entry *)) <=
-+ PAGE_SIZE)
-+ kfree(inodev_set.i_hash);
-+ else
-+ vfree(inodev_set.i_hash);
-+ }
-+
-+ gr_free_uidset();
-+
-+ memset(&name_set, 0, sizeof (struct name_db));
-+ memset(&inodev_set, 0, sizeof (struct inodev_db));
-+ memset(&acl_role_set, 0, sizeof (struct acl_role_db));
-+ memset(&subj_map_set, 0, sizeof (struct acl_subj_map_db));
-+
-+ default_role = NULL;
-+ kernel_role = NULL;
-+ role_list = NULL;
-+
-+ return;
-+}
-+
-+static __u32
-+count_user_objs(struct acl_object_label *userp)
-+{
-+ struct acl_object_label o_tmp;
-+ __u32 num = 0;
-+
-+ while (userp) {
-+ if (copy_from_user(&o_tmp, userp,
-+ sizeof (struct acl_object_label)))
-+ break;
-+
-+ userp = o_tmp.prev;
-+ num++;
-+ }
-+
-+ return num;
-+}
-+
-+static struct acl_subject_label *
-+do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role, int *already_copied);
-+
-+static int
-+copy_user_glob(struct acl_object_label *obj)
-+{
-+ struct acl_object_label *g_tmp, **guser;
-+ unsigned int len;
-+ char *tmp;
-+
-+ if (obj->globbed == NULL)
-+ return 0;
-+
-+ guser = &obj->globbed;
-+ while (*guser) {
-+ g_tmp = (struct acl_object_label *)
-+ acl_alloc(sizeof (struct acl_object_label));
-+ if (g_tmp == NULL)
-+ return -ENOMEM;
-+
-+ if (copy_from_user(g_tmp, *guser,
-+ sizeof (struct acl_object_label)))
-+ return -EFAULT;
-+
-+ len = strnlen_user(g_tmp->filename, PATH_MAX);
-+
-+ if (!len || len >= PATH_MAX)
-+ return -EINVAL;
-+
-+ if ((tmp = (char *) acl_alloc(len)) == NULL)
-+ return -ENOMEM;
-+
-+ if (copy_from_user(tmp, g_tmp->filename, len))
-+ return -EFAULT;
-+ tmp[len-1] = '\0';
-+ g_tmp->filename = tmp;
-+
-+ *guser = g_tmp;
-+ guser = &(g_tmp->next);
-+ }
-+
-+ return 0;
-+}
-+
-+static int
-+copy_user_objs(struct acl_object_label *userp, struct acl_subject_label *subj,
-+ struct acl_role_label *role)
-+{
-+ struct acl_object_label *o_tmp;
-+ unsigned int len;
-+ int ret;
-+ char *tmp;
-+
-+ while (userp) {
-+ if ((o_tmp = (struct acl_object_label *)
-+ acl_alloc(sizeof (struct acl_object_label))) == NULL)
-+ return -ENOMEM;
-+
-+ if (copy_from_user(o_tmp, userp,
-+ sizeof (struct acl_object_label)))
-+ return -EFAULT;
-+
-+ userp = o_tmp->prev;
-+
-+ len = strnlen_user(o_tmp->filename, PATH_MAX);
-+
-+ if (!len || len >= PATH_MAX)
-+ return -EINVAL;
-+
-+ if ((tmp = (char *) acl_alloc(len)) == NULL)
-+ return -ENOMEM;
-+
-+ if (copy_from_user(tmp, o_tmp->filename, len))
-+ return -EFAULT;
-+ tmp[len-1] = '\0';
-+ o_tmp->filename = tmp;
-+
-+ insert_acl_obj_label(o_tmp, subj);
-+ if (!insert_name_entry(o_tmp->filename, o_tmp->inode,
-+ o_tmp->device, (o_tmp->mode & GR_DELETED) ? 1 : 0))
-+ return -ENOMEM;
-+
-+ ret = copy_user_glob(o_tmp);
-+ if (ret)
-+ return ret;
-+
-+ if (o_tmp->nested) {
-+ int already_copied;
-+
-+ o_tmp->nested = do_copy_user_subj(o_tmp->nested, role, &already_copied);
-+ if (IS_ERR(o_tmp->nested))
-+ return PTR_ERR(o_tmp->nested);
-+
-+ /* insert into nested subject list if we haven't copied this one yet
-+ to prevent duplicate entries */
-+ if (!already_copied) {
-+ o_tmp->nested->next = role->hash->first;
-+ role->hash->first = o_tmp->nested;
-+ }
-+ }
-+ }
-+
-+ return 0;
-+}
-+
-+static __u32
-+count_user_subjs(struct acl_subject_label *userp)
-+{
-+ struct acl_subject_label s_tmp;
-+ __u32 num = 0;
-+
-+ while (userp) {
-+ if (copy_from_user(&s_tmp, userp,
-+ sizeof (struct acl_subject_label)))
-+ break;
-+
-+ userp = s_tmp.prev;
-+ }
-+
-+ return num;
-+}
-+
-+static int
-+copy_user_allowedips(struct acl_role_label *rolep)
-+{
-+ struct role_allowed_ip *ruserip, *rtmp = NULL, *rlast;
-+
-+ ruserip = rolep->allowed_ips;
-+
-+ while (ruserip) {
-+ rlast = rtmp;
-+
-+ if ((rtmp = (struct role_allowed_ip *)
-+ acl_alloc(sizeof (struct role_allowed_ip))) == NULL)
-+ return -ENOMEM;
-+
-+ if (copy_from_user(rtmp, ruserip,
-+ sizeof (struct role_allowed_ip)))
-+ return -EFAULT;
-+
-+ ruserip = rtmp->prev;
-+
-+ if (!rlast) {
-+ rtmp->prev = NULL;
-+ rolep->allowed_ips = rtmp;
-+ } else {
-+ rlast->next = rtmp;
-+ rtmp->prev = rlast;
-+ }
-+
-+ if (!ruserip)
-+ rtmp->next = NULL;
-+ }
-+
-+ return 0;
-+}
-+
-+static int
-+copy_user_transitions(struct acl_role_label *rolep)
-+{
-+ struct role_transition *rusertp, *rtmp = NULL, *rlast;
-+
-+ unsigned int len;
-+ char *tmp;
-+
-+ rusertp = rolep->transitions;
-+
-+ while (rusertp) {
-+ rlast = rtmp;
-+
-+ if ((rtmp = (struct role_transition *)
-+ acl_alloc(sizeof (struct role_transition))) == NULL)
-+ return -ENOMEM;
-+
-+ if (copy_from_user(rtmp, rusertp,
-+ sizeof (struct role_transition)))
-+ return -EFAULT;
-+
-+ rusertp = rtmp->prev;
-+
-+ len = strnlen_user(rtmp->rolename, GR_SPROLE_LEN);
-+
-+ if (!len || len >= GR_SPROLE_LEN)
-+ return -EINVAL;
-+
-+ if ((tmp = (char *) acl_alloc(len)) == NULL)
-+ return -ENOMEM;
-+
-+ if (copy_from_user(tmp, rtmp->rolename, len))
-+ return -EFAULT;
-+ tmp[len-1] = '\0';
-+ rtmp->rolename = tmp;
-+
-+ if (!rlast) {
-+ rtmp->prev = NULL;
-+ rolep->transitions = rtmp;
-+ } else {
-+ rlast->next = rtmp;
-+ rtmp->prev = rlast;
-+ }
-+
-+ if (!rusertp)
-+ rtmp->next = NULL;
-+ }
-+
-+ return 0;
-+}
-+
-+static struct acl_subject_label *
-+do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role, int *already_copied)
-+{
-+ struct acl_subject_label *s_tmp = NULL, *s_tmp2;
-+ unsigned int len;
-+ char *tmp;
-+ __u32 num_objs;
-+ struct acl_ip_label **i_tmp, *i_utmp2;
-+ struct gr_hash_struct ghash;
-+ struct subject_map *subjmap;
-+ unsigned int i_num;
-+ int err;
-+
-+ if (already_copied != NULL)
-+ *already_copied = 0;
-+
-+ s_tmp = lookup_subject_map(userp);
-+
-+ /* we've already copied this subject into the kernel, just return
-+ the reference to it, and don't copy it over again
-+ */
-+ if (s_tmp) {
-+ if (already_copied != NULL)
-+ *already_copied = 1;
-+ return(s_tmp);
-+ }
-+
-+ if ((s_tmp = (struct acl_subject_label *)
-+ acl_alloc(sizeof (struct acl_subject_label))) == NULL)
-+ return ERR_PTR(-ENOMEM);
-+
-+ subjmap = (struct subject_map *)kmalloc(sizeof (struct subject_map), GFP_KERNEL);
-+ if (subjmap == NULL)
-+ return ERR_PTR(-ENOMEM);
-+
-+ subjmap->user = userp;
-+ subjmap->kernel = s_tmp;
-+ insert_subj_map_entry(subjmap);
-+
-+ if (copy_from_user(s_tmp, userp,
-+ sizeof (struct acl_subject_label)))
-+ return ERR_PTR(-EFAULT);
-+
-+ len = strnlen_user(s_tmp->filename, PATH_MAX);
-+
-+ if (!len || len >= PATH_MAX)
-+ return ERR_PTR(-EINVAL);
-+
-+ if ((tmp = (char *) acl_alloc(len)) == NULL)
-+ return ERR_PTR(-ENOMEM);
-+
-+ if (copy_from_user(tmp, s_tmp->filename, len))
-+ return ERR_PTR(-EFAULT);
-+ tmp[len-1] = '\0';
-+ s_tmp->filename = tmp;
-+
-+ if (!strcmp(s_tmp->filename, "/"))
-+ role->root_label = s_tmp;
-+
-+ if (copy_from_user(&ghash, s_tmp->hash, sizeof(struct gr_hash_struct)))
-+ return ERR_PTR(-EFAULT);
-+
-+ /* copy user and group transition tables */
-+
-+ if (s_tmp->user_trans_num) {
-+ uid_t *uidlist;
-+
-+ uidlist = (uid_t *)acl_alloc_num(s_tmp->user_trans_num, sizeof(uid_t));
-+ if (uidlist == NULL)
-+ return ERR_PTR(-ENOMEM);
-+ if (copy_from_user(uidlist, s_tmp->user_transitions, s_tmp->user_trans_num * sizeof(uid_t)))
-+ return ERR_PTR(-EFAULT);
-+
-+ s_tmp->user_transitions = uidlist;
-+ }
-+
-+ if (s_tmp->group_trans_num) {
-+ gid_t *gidlist;
-+
-+ gidlist = (gid_t *)acl_alloc_num(s_tmp->group_trans_num, sizeof(gid_t));
-+ if (gidlist == NULL)
-+ return ERR_PTR(-ENOMEM);
-+ if (copy_from_user(gidlist, s_tmp->group_transitions, s_tmp->group_trans_num * sizeof(gid_t)))
-+ return ERR_PTR(-EFAULT);
-+
-+ s_tmp->group_transitions = gidlist;
-+ }
-+
-+ /* set up object hash table */
-+ num_objs = count_user_objs(ghash.first);
-+
-+ s_tmp->obj_hash_size = num_objs;
-+ s_tmp->obj_hash =
-+ (struct acl_object_label **)
-+ create_table(&(s_tmp->obj_hash_size), sizeof(void *));
-+
-+ if (!s_tmp->obj_hash)
-+ return ERR_PTR(-ENOMEM);
-+
-+ memset(s_tmp->obj_hash, 0,
-+ s_tmp->obj_hash_size *
-+ sizeof (struct acl_object_label *));
-+
-+ /* add in objects */
-+ err = copy_user_objs(ghash.first, s_tmp, role);
-+
-+ if (err)
-+ return ERR_PTR(err);
-+
-+ /* set pointer for parent subject */
-+ if (s_tmp->parent_subject) {
-+ s_tmp2 = do_copy_user_subj(s_tmp->parent_subject, role, NULL);
-+
-+ if (IS_ERR(s_tmp2))
-+ return s_tmp2;
-+
-+ s_tmp->parent_subject = s_tmp2;
-+ }
-+
-+ /* add in ip acls */
-+
-+ if (!s_tmp->ip_num) {
-+ s_tmp->ips = NULL;
-+ goto insert;
-+ }
-+
-+ i_tmp =
-+ (struct acl_ip_label **) acl_alloc_num(s_tmp->ip_num,
-+ sizeof (struct acl_ip_label *));
-+
-+ if (!i_tmp)
-+ return ERR_PTR(-ENOMEM);
-+
-+ for (i_num = 0; i_num < s_tmp->ip_num; i_num++) {
-+ *(i_tmp + i_num) =
-+ (struct acl_ip_label *)
-+ acl_alloc(sizeof (struct acl_ip_label));
-+ if (!*(i_tmp + i_num))
-+ return ERR_PTR(-ENOMEM);
-+
-+ if (copy_from_user
-+ (&i_utmp2, s_tmp->ips + i_num,
-+ sizeof (struct acl_ip_label *)))
-+ return ERR_PTR(-EFAULT);
-+
-+ if (copy_from_user
-+ (*(i_tmp + i_num), i_utmp2,
-+ sizeof (struct acl_ip_label)))
-+ return ERR_PTR(-EFAULT);
-+
-+ if ((*(i_tmp + i_num))->iface == NULL)
-+ continue;
-+
-+ len = strnlen_user((*(i_tmp + i_num))->iface, IFNAMSIZ);
-+ if (!len || len >= IFNAMSIZ)
-+ return ERR_PTR(-EINVAL);
-+ tmp = acl_alloc(len);
-+ if (tmp == NULL)
-+ return ERR_PTR(-ENOMEM);
-+ if (copy_from_user(tmp, (*(i_tmp + i_num))->iface, len))
-+ return ERR_PTR(-EFAULT);
-+ (*(i_tmp + i_num))->iface = tmp;
-+ }
-+
-+ s_tmp->ips = i_tmp;
-+
-+insert:
-+ if (!insert_name_entry(s_tmp->filename, s_tmp->inode,
-+ s_tmp->device, (s_tmp->mode & GR_DELETED) ? 1 : 0))
-+ return ERR_PTR(-ENOMEM);
-+
-+ return s_tmp;
-+}
-+
-+static int
-+copy_user_subjs(struct acl_subject_label *userp, struct acl_role_label *role)
-+{
-+ struct acl_subject_label s_pre;
-+ struct acl_subject_label * ret;
-+ int err;
-+
-+ while (userp) {
-+ if (copy_from_user(&s_pre, userp,
-+ sizeof (struct acl_subject_label)))
-+ return -EFAULT;
-+
-+ ret = do_copy_user_subj(userp, role, NULL);
-+
-+ err = PTR_ERR(ret);
-+ if (IS_ERR(ret))
-+ return err;
-+
-+ insert_acl_subj_label(ret, role);
-+
-+ userp = s_pre.prev;
-+ }
-+
-+ return 0;
-+}
-+
-+static int
-+copy_user_acl(struct gr_arg *arg)
-+{
-+ struct acl_role_label *r_tmp = NULL, **r_utmp, *r_utmp2;
-+ struct acl_subject_label *subj_list;
-+ struct sprole_pw *sptmp;
-+ struct gr_hash_struct *ghash;
-+ uid_t *domainlist;
-+ unsigned int r_num;
-+ unsigned int len;
-+ char *tmp;
-+ int err = 0;
-+ __u16 i;
-+ __u32 num_subjs;
-+
-+ /* we need a default and kernel role */
-+ if (arg->role_db.num_roles < 2)
-+ return -EINVAL;
-+
-+ /* copy special role authentication info from userspace */
-+
-+ num_sprole_pws = arg->num_sprole_pws;
-+ acl_special_roles = (struct sprole_pw **) acl_alloc_num(num_sprole_pws, sizeof(struct sprole_pw *));
-+
-+ if (!acl_special_roles && num_sprole_pws)
-+ return -ENOMEM;
-+
-+ for (i = 0; i < num_sprole_pws; i++) {
-+ sptmp = (struct sprole_pw *) acl_alloc(sizeof(struct sprole_pw));
-+ if (!sptmp)
-+ return -ENOMEM;
-+ if (copy_from_user(sptmp, arg->sprole_pws + i,
-+ sizeof (struct sprole_pw)))
-+ return -EFAULT;
-+
-+ len = strnlen_user(sptmp->rolename, GR_SPROLE_LEN);
-+
-+ if (!len || len >= GR_SPROLE_LEN)
-+ return -EINVAL;
-+
-+ if ((tmp = (char *) acl_alloc(len)) == NULL)
-+ return -ENOMEM;
-+
-+ if (copy_from_user(tmp, sptmp->rolename, len))
-+ return -EFAULT;
-+
-+ tmp[len-1] = '\0';
-+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
-+ printk(KERN_ALERT "Copying special role %s\n", tmp);
-+#endif
-+ sptmp->rolename = tmp;
-+ acl_special_roles[i] = sptmp;
-+ }
-+
-+ r_utmp = (struct acl_role_label **) arg->role_db.r_table;
-+
-+ for (r_num = 0; r_num < arg->role_db.num_roles; r_num++) {
-+ r_tmp = acl_alloc(sizeof (struct acl_role_label));
-+
-+ if (!r_tmp)
-+ return -ENOMEM;
-+
-+ if (copy_from_user(&r_utmp2, r_utmp + r_num,
-+ sizeof (struct acl_role_label *)))
-+ return -EFAULT;
-+
-+ if (copy_from_user(r_tmp, r_utmp2,
-+ sizeof (struct acl_role_label)))
-+ return -EFAULT;
-+
-+ len = strnlen_user(r_tmp->rolename, GR_SPROLE_LEN);
-+
-+ if (!len || len >= PATH_MAX)
-+ return -EINVAL;
-+
-+ if ((tmp = (char *) acl_alloc(len)) == NULL)
-+ return -ENOMEM;
-+
-+ if (copy_from_user(tmp, r_tmp->rolename, len))
-+ return -EFAULT;
-+
-+ tmp[len-1] = '\0';
-+ r_tmp->rolename = tmp;
-+
-+ if (!strcmp(r_tmp->rolename, "default")
-+ && (r_tmp->roletype & GR_ROLE_DEFAULT)) {
-+ default_role = r_tmp;
-+ } else if (!strcmp(r_tmp->rolename, ":::kernel:::")) {
-+ kernel_role = r_tmp;
-+ }
-+
-+ if ((ghash = (struct gr_hash_struct *) acl_alloc(sizeof(struct gr_hash_struct))) == NULL)
-+ return -ENOMEM;
-+
-+ if (copy_from_user(ghash, r_tmp->hash, sizeof(struct gr_hash_struct)))
-+ return -EFAULT;
-+
-+ r_tmp->hash = ghash;
-+
-+ num_subjs = count_user_subjs(r_tmp->hash->first);
-+
-+ r_tmp->subj_hash_size = num_subjs;
-+ r_tmp->subj_hash =
-+ (struct acl_subject_label **)
-+ create_table(&(r_tmp->subj_hash_size), sizeof(void *));
-+
-+ if (!r_tmp->subj_hash)
-+ return -ENOMEM;
-+
-+ err = copy_user_allowedips(r_tmp);
-+ if (err)
-+ return err;
-+
-+ /* copy domain info */
-+ if (r_tmp->domain_children != NULL) {
-+ domainlist = acl_alloc_num(r_tmp->domain_child_num, sizeof(uid_t));
-+ if (domainlist == NULL)
-+ return -ENOMEM;
-+
-+ if (copy_from_user(domainlist, r_tmp->domain_children, r_tmp->domain_child_num * sizeof(uid_t)))
-+ return -EFAULT;
-+
-+ r_tmp->domain_children = domainlist;
-+ }
-+
-+ err = copy_user_transitions(r_tmp);
-+ if (err)
-+ return err;
-+
-+ memset(r_tmp->subj_hash, 0,
-+ r_tmp->subj_hash_size *
-+ sizeof (struct acl_subject_label *));
-+
-+ /* acquire the list of subjects, then NULL out
-+ the list prior to parsing the subjects for this role,
-+ as during this parsing the list is replaced with a list
-+ of *nested* subjects for the role
-+ */
-+ subj_list = r_tmp->hash->first;
-+
-+ /* set nested subject list to null */
-+ r_tmp->hash->first = NULL;
-+
-+ err = copy_user_subjs(subj_list, r_tmp);
-+
-+ if (err)
-+ return err;
-+
-+ insert_acl_role_label(r_tmp);
-+ }
-+
-+ if (default_role == NULL || kernel_role == NULL)
-+ return -EINVAL;
-+
-+ return err;
-+}
-+
-+static int
-+gracl_init(struct gr_arg *args)
-+{
-+ int error = 0;
-+
-+ memcpy(gr_system_salt, args->salt, GR_SALT_LEN);
-+ memcpy(gr_system_sum, args->sum, GR_SHA_LEN);
-+
-+ if (init_variables(args)) {
-+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_INITF_ACL_MSG, GR_VERSION);
-+ error = -ENOMEM;
-+ free_variables();
-+ goto out;
-+ }
-+
-+ error = copy_user_acl(args);
-+ free_init_variables();
-+ if (error) {
-+ free_variables();
-+ goto out;
-+ }
-+
-+ if ((error = gr_set_acls(0))) {
-+ free_variables();
-+ goto out;
-+ }
-+
-+ pax_open_kernel();
-+ gr_status |= GR_READY;
-+ pax_close_kernel();
-+
-+ out:
-+ return error;
-+}
-+
-+/* derived from glibc fnmatch() 0: match, 1: no match*/
-+
-+static int
-+glob_match(const char *p, const char *n)
-+{
-+ char c;
-+
-+ while ((c = *p++) != '\0') {
-+ switch (c) {
-+ case '?':
-+ if (*n == '\0')
-+ return 1;
-+ else if (*n == '/')
-+ return 1;
-+ break;
-+ case '\\':
-+ if (*n != c)
-+ return 1;
-+ break;
-+ case '*':
-+ for (c = *p++; c == '?' || c == '*'; c = *p++) {
-+ if (*n == '/')
-+ return 1;
-+ else if (c == '?') {
-+ if (*n == '\0')
-+ return 1;
-+ else
-+ ++n;
-+ }
-+ }
-+ if (c == '\0') {
-+ return 0;
-+ } else {
-+ const char *endp;
-+
-+ if ((endp = strchr(n, '/')) == NULL)
-+ endp = n + strlen(n);
-+
-+ if (c == '[') {
-+ for (--p; n < endp; ++n)
-+ if (!glob_match(p, n))
-+ return 0;
-+ } else if (c == '/') {
-+ while (*n != '\0' && *n != '/')
-+ ++n;
-+ if (*n == '/' && !glob_match(p, n + 1))
-+ return 0;
-+ } else {
-+ for (--p; n < endp; ++n)
-+ if (*n == c && !glob_match(p, n))
-+ return 0;
-+ }
-+
-+ return 1;
-+ }
-+ case '[':
-+ {
-+ int not;
-+ char cold;
-+
-+ if (*n == '\0' || *n == '/')
-+ return 1;
-+
-+ not = (*p == '!' || *p == '^');
-+ if (not)
-+ ++p;
-+
-+ c = *p++;
-+ for (;;) {
-+ unsigned char fn = (unsigned char)*n;
-+
-+ if (c == '\0')
-+ return 1;
-+ else {
-+ if (c == fn)
-+ goto matched;
-+ cold = c;
-+ c = *p++;
-+
-+ if (c == '-' && *p != ']') {
-+ unsigned char cend = *p++;
-+
-+ if (cend == '\0')
-+ return 1;
-+
-+ if (cold <= fn && fn <= cend)
-+ goto matched;
-+
-+ c = *p++;
-+ }
-+ }
-+
-+ if (c == ']')
-+ break;
-+ }
-+ if (!not)
-+ return 1;
-+ break;
-+ matched:
-+ while (c != ']') {
-+ if (c == '\0')
-+ return 1;
-+
-+ c = *p++;
-+ }
-+ if (not)
-+ return 1;
-+ }
-+ break;
-+ default:
-+ if (c != *n)
-+ return 1;
-+ }
-+
-+ ++n;
-+ }
-+
-+ if (*n == '\0')
-+ return 0;
-+
-+ if (*n == '/')
-+ return 0;
-+
-+ return 1;
-+}
-+
-+static struct acl_object_label *
-+chk_glob_label(struct acl_object_label *globbed,
-+ const struct dentry *dentry, const struct vfsmount *mnt, char **path)
-+{
-+ struct acl_object_label *tmp;
-+
-+ if (*path == NULL)
-+ *path = gr_to_filename_nolock(dentry, mnt);
-+
-+ tmp = globbed;
-+
-+ while (tmp) {
-+ if (!glob_match(tmp->filename, *path))
-+ return tmp;
-+ tmp = tmp->next;
-+ }
-+
-+ return NULL;
-+}
-+
-+static struct acl_object_label *
-+__full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
-+ const ino_t curr_ino, const dev_t curr_dev,
-+ const struct acl_subject_label *subj, char **path, const int checkglob)
-+{
-+ struct acl_subject_label *tmpsubj;
-+ struct acl_object_label *retval;
-+ struct acl_object_label *retval2;
-+
-+ tmpsubj = (struct acl_subject_label *) subj;
-+ read_lock(&gr_inode_lock);
-+ do {
-+ retval = lookup_acl_obj_label(curr_ino, curr_dev, tmpsubj);
-+ if (retval) {
-+ if (checkglob && retval->globbed) {
-+ retval2 = chk_glob_label(retval->globbed, orig_dentry, orig_mnt, path);
-+ if (retval2)
-+ retval = retval2;
-+ }
-+ break;
-+ }
-+ } while ((tmpsubj = tmpsubj->parent_subject));
-+ read_unlock(&gr_inode_lock);
-+
-+ return retval;
-+}
-+
-+static __inline__ struct acl_object_label *
-+full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
-+ const struct dentry *curr_dentry,
-+ const struct acl_subject_label *subj, char **path, const int checkglob)
-+{
-+ int newglob = checkglob;
-+
-+ /* if we aren't checking a subdirectory of the original path yet, don't do glob checking
-+ as we don't want a / * rule to match instead of the / object
-+ don't do this for create lookups that call this function though, since they're looking up
-+ on the parent and thus need globbing checks on all paths
-+ */
-+ if (orig_dentry == curr_dentry && newglob != GR_CREATE_GLOB)
-+ newglob = GR_NO_GLOB;
-+
-+ return __full_lookup(orig_dentry, orig_mnt,
-+ curr_dentry->d_inode->i_ino,
-+ __get_dev(curr_dentry), subj, path, newglob);
-+}
-+
-+static struct acl_object_label *
-+__chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
-+ const struct acl_subject_label *subj, char *path, const int checkglob)
-+{
-+ struct dentry *dentry = (struct dentry *) l_dentry;
-+ struct vfsmount *mnt = (struct vfsmount *) l_mnt;
-+ struct acl_object_label *retval;
-+
-+ spin_lock(&dcache_lock);
-+ spin_lock(&vfsmount_lock);
-+
-+ if (unlikely((mnt == shm_mnt && dentry->d_inode->i_nlink == 0) || mnt == pipe_mnt ||
-+#ifdef CONFIG_NET
-+ mnt == sock_mnt ||
-+#endif
-+#ifdef CONFIG_HUGETLBFS
-+ (mnt == hugetlbfs_vfsmount && dentry->d_inode->i_nlink == 0) ||
-+#endif
-+ /* ignore Eric Biederman */
-+ IS_PRIVATE(l_dentry->d_inode))) {
-+ retval = (subj->mode & GR_SHMEXEC) ? fakefs_obj_rwx : fakefs_obj_rw;
-+ goto out;
-+ }
-+
-+ for (;;) {
-+ if (dentry == real_root && mnt == real_root_mnt)
-+ break;
-+
-+ if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
-+ if (mnt->mnt_parent == mnt)
-+ break;
-+
-+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
-+ if (retval != NULL)
-+ goto out;
-+
-+ dentry = mnt->mnt_mountpoint;
-+ mnt = mnt->mnt_parent;
-+ continue;
-+ }
-+
-+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
-+ if (retval != NULL)
-+ goto out;
-+
-+ dentry = dentry->d_parent;
-+ }
-+
-+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
-+
-+ if (retval == NULL)
-+ retval = full_lookup(l_dentry, l_mnt, real_root, subj, &path, checkglob);
-+out:
-+ spin_unlock(&vfsmount_lock);
-+ spin_unlock(&dcache_lock);
-+
-+ BUG_ON(retval == NULL);
-+
-+ return retval;
-+}
-+
-+static __inline__ struct acl_object_label *
-+chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
-+ const struct acl_subject_label *subj)
-+{
-+ char *path = NULL;
-+ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_REG_GLOB);
-+}
-+
-+static __inline__ struct acl_object_label *
-+chk_obj_label_noglob(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
-+ const struct acl_subject_label *subj)
-+{
-+ char *path = NULL;
-+ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_NO_GLOB);
-+}
-+
-+static __inline__ struct acl_object_label *
-+chk_obj_create_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
-+ const struct acl_subject_label *subj, char *path)
-+{
-+ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_CREATE_GLOB);
-+}
-+
-+static struct acl_subject_label *
-+chk_subj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
-+ const struct acl_role_label *role)
-+{
-+ struct dentry *dentry = (struct dentry *) l_dentry;
-+ struct vfsmount *mnt = (struct vfsmount *) l_mnt;
-+ struct acl_subject_label *retval;
-+
-+ spin_lock(&dcache_lock);
-+ spin_lock(&vfsmount_lock);
-+
-+ for (;;) {
-+ if (dentry == real_root && mnt == real_root_mnt)
-+ break;
-+ if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
-+ if (mnt->mnt_parent == mnt)
-+ break;
-+
-+ read_lock(&gr_inode_lock);
-+ retval =
-+ lookup_acl_subj_label(dentry->d_inode->i_ino,
-+ __get_dev(dentry), role);
-+ read_unlock(&gr_inode_lock);
-+ if (retval != NULL)
-+ goto out;
-+
-+ dentry = mnt->mnt_mountpoint;
-+ mnt = mnt->mnt_parent;
-+ continue;
-+ }
-+
-+ read_lock(&gr_inode_lock);
-+ retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
-+ __get_dev(dentry), role);
-+ read_unlock(&gr_inode_lock);
-+ if (retval != NULL)
-+ goto out;
-+
-+ dentry = dentry->d_parent;
-+ }
-+
-+ read_lock(&gr_inode_lock);
-+ retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
-+ __get_dev(dentry), role);
-+ read_unlock(&gr_inode_lock);
-+
-+ if (unlikely(retval == NULL)) {
-+ read_lock(&gr_inode_lock);
-+ retval = lookup_acl_subj_label(real_root->d_inode->i_ino,
-+ __get_dev(real_root), role);
-+ read_unlock(&gr_inode_lock);
-+ }
-+out:
-+ spin_unlock(&vfsmount_lock);
-+ spin_unlock(&dcache_lock);
-+
-+ BUG_ON(retval == NULL);
-+
-+ return retval;
-+}
-+
-+static void
-+gr_log_learn(const struct dentry *dentry, const struct vfsmount *mnt, const __u32 mode)
-+{
-+ struct task_struct *task = current;
-+ const struct cred *cred = current_cred();
-+
-+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
-+ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
-+ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
-+ 1UL, 1UL, gr_to_filename(dentry, mnt), (unsigned long) mode, &task->signal->saved_ip);
-+
-+ return;
-+}
-+
-+static void
-+gr_log_learn_sysctl(const char *path, const __u32 mode)
-+{
-+ struct task_struct *task = current;
-+ const struct cred *cred = current_cred();
-+
-+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
-+ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
-+ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
-+ 1UL, 1UL, path, (unsigned long) mode, &task->signal->saved_ip);
-+
-+ return;
-+}
-+
-+static void
-+gr_log_learn_id_change(const char type, const unsigned int real,
-+ const unsigned int effective, const unsigned int fs)
-+{
-+ struct task_struct *task = current;
-+ const struct cred *cred = current_cred();
-+
-+ security_learn(GR_ID_LEARN_MSG, task->role->rolename, task->role->roletype,
-+ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
-+ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
-+ type, real, effective, fs, &task->signal->saved_ip);
-+
-+ return;
-+}
-+
-+__u32
-+gr_search_file(const struct dentry * dentry, const __u32 mode,
-+ const struct vfsmount * mnt)
-+{
-+ __u32 retval = mode;
-+ struct acl_subject_label *curracl;
-+ struct acl_object_label *currobj;
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return (mode & ~GR_AUDITS);
-+
-+ curracl = current->acl;
-+
-+ currobj = chk_obj_label(dentry, mnt, curracl);
-+ retval = currobj->mode & mode;
-+
-+ /* if we're opening a specified transfer file for writing
-+ (e.g. /dev/initctl), then transfer our role to init
-+ */
-+ if (unlikely(currobj->mode & GR_INIT_TRANSFER && retval & GR_WRITE &&
-+ current->role->roletype & GR_ROLE_PERSIST)) {
-+ struct task_struct *task = init_pid_ns.child_reaper;
-+
-+ if (task->role != current->role) {
-+ task->acl_sp_role = 0;
-+ task->acl_role_id = current->acl_role_id;
-+ task->role = current->role;
-+ rcu_read_lock();
-+ read_lock(&grsec_exec_file_lock);
-+ gr_apply_subject_to_task(task);
-+ read_unlock(&grsec_exec_file_lock);
-+ rcu_read_unlock();
-+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_INIT_TRANSFER_MSG);
-+ }
-+ }
-+
-+ if (unlikely
-+ ((curracl->mode & (GR_LEARN | GR_INHERITLEARN)) && !(mode & GR_NOPTRACE)
-+ && (retval != (mode & ~(GR_AUDITS | GR_SUPPRESS))))) {
-+ __u32 new_mode = mode;
-+
-+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
-+
-+ retval = new_mode;
-+
-+ if (new_mode & GR_EXEC && curracl->mode & GR_INHERITLEARN)
-+ new_mode |= GR_INHERIT;
-+
-+ if (!(mode & GR_NOLEARN))
-+ gr_log_learn(dentry, mnt, new_mode);
-+ }
-+
-+ return retval;
-+}
-+
-+struct acl_object_label *gr_get_create_object(const struct dentry *new_dentry,
-+ const struct dentry *parent,
-+ const struct vfsmount *mnt)
-+{
-+ struct name_entry *match;
-+ struct acl_object_label *matchpo;
-+ struct acl_subject_label *curracl;
-+ char *path;
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return NULL;
-+
-+ preempt_disable();
-+ path = gr_to_filename_rbac(new_dentry, mnt);
-+ match = lookup_name_entry_create(path);
-+
-+ curracl = current->acl;
-+
-+ if (match) {
-+ read_lock(&gr_inode_lock);
-+ matchpo = lookup_acl_obj_label_create(match->inode, match->device, curracl);
-+ read_unlock(&gr_inode_lock);
-+
-+ if (matchpo) {
-+ preempt_enable();
-+ return matchpo;
-+ }
-+ }
-+
-+ // lookup parent
-+
-+ matchpo = chk_obj_create_label(parent, mnt, curracl, path);
-+
-+ preempt_enable();
-+ return matchpo;
-+}
-+
-+__u32
-+gr_check_create(const struct dentry * new_dentry, const struct dentry * parent,
-+ const struct vfsmount * mnt, const __u32 mode)
-+{
-+ struct acl_object_label *matchpo;
-+ __u32 retval;
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return (mode & ~GR_AUDITS);
-+
-+ matchpo = gr_get_create_object(new_dentry, parent, mnt);
-+
-+ retval = matchpo->mode & mode;
-+
-+ if ((retval != (mode & ~(GR_AUDITS | GR_SUPPRESS)))
-+ && (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))) {
-+ __u32 new_mode = mode;
-+
-+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
-+
-+ gr_log_learn(new_dentry, mnt, new_mode);
-+ return new_mode;
-+ }
-+
-+ return retval;
-+}
-+
-+__u32
-+gr_check_link(const struct dentry * new_dentry,
-+ const struct dentry * parent_dentry,
-+ const struct vfsmount * parent_mnt,
-+ const struct dentry * old_dentry, const struct vfsmount * old_mnt)
-+{
-+ struct acl_object_label *obj;
-+ __u32 oldmode, newmode;
-+ __u32 needmode;
-+ __u32 checkmodes = GR_FIND | GR_APPEND | GR_WRITE | GR_EXEC | GR_SETID | GR_READ |
-+ GR_DELETE | GR_INHERIT;
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return (GR_CREATE | GR_LINK);
-+
-+ obj = chk_obj_label(old_dentry, old_mnt, current->acl);
-+ oldmode = obj->mode;
-+
-+ obj = gr_get_create_object(new_dentry, parent_dentry, parent_mnt);
-+ newmode = obj->mode;
-+
-+ needmode = newmode & checkmodes;
-+
-+ // old name for hardlink must have at least the permissions of the new name
-+ if ((oldmode & needmode) != needmode)
-+ goto bad;
-+
-+ // if old name had restrictions/auditing, make sure the new name does as well
-+ needmode = oldmode & (GR_NOPTRACE | GR_PTRACERD | GR_INHERIT | GR_AUDITS);
-+
-+ // don't allow hardlinking of suid/sgid/fcapped files without permission
-+ if (is_privileged_binary(old_dentry))
-+ needmode |= GR_SETID;
-+
-+ if ((newmode & needmode) != needmode)
-+ goto bad;
-+
-+ // enforce minimum permissions
-+ if ((newmode & (GR_CREATE | GR_LINK)) == (GR_CREATE | GR_LINK))
-+ return newmode;
-+bad:
-+ needmode = oldmode;
-+ if (is_privileged_binary(old_dentry))
-+ needmode |= GR_SETID;
-+
-+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) {
-+ gr_log_learn(old_dentry, old_mnt, needmode | GR_CREATE | GR_LINK);
-+ return (GR_CREATE | GR_LINK);
-+ } else if (newmode & GR_SUPPRESS)
-+ return GR_SUPPRESS;
-+ else
-+ return 0;
-+}
-+
-+int
-+gr_check_hidden_task(const struct task_struct *task)
-+{
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return 0;
-+
-+ if (!(task->acl->mode & GR_PROCFIND) && !(current->acl->mode & GR_VIEW))
-+ return 1;
-+
-+ return 0;
-+}
-+
-+int
-+gr_check_protected_task(const struct task_struct *task)
-+{
-+ if (unlikely(!(gr_status & GR_READY) || !task))
-+ return 0;
-+
-+ if ((task->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
-+ task->acl != current->acl)
-+ return 1;
-+
-+ return 0;
-+}
-+
-+int
-+gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
-+{
-+ struct task_struct *p;
-+ int ret = 0;
-+
-+ if (unlikely(!(gr_status & GR_READY) || !pid))
-+ return ret;
-+
-+ read_lock(&tasklist_lock);
-+ do_each_pid_task(pid, type, p) {
-+ if ((p->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
-+ p->acl != current->acl) {
-+ ret = 1;
-+ goto out;
-+ }
-+ } while_each_pid_task(pid, type, p);
-+out:
-+ read_unlock(&tasklist_lock);
-+
-+ return ret;
-+}
-+
-+void
-+gr_copy_label(struct task_struct *tsk)
-+{
-+ tsk->signal->used_accept = 0;
-+ tsk->acl_sp_role = 0;
-+ tsk->acl_role_id = current->acl_role_id;
-+ tsk->acl = current->acl;
-+ tsk->role = current->role;
-+ tsk->signal->curr_ip = current->signal->curr_ip;
-+ tsk->signal->saved_ip = current->signal->saved_ip;
-+ if (current->exec_file)
-+ get_file(current->exec_file);
-+ tsk->exec_file = current->exec_file;
-+ tsk->is_writable = current->is_writable;
-+ if (unlikely(current->signal->used_accept)) {
-+ current->signal->curr_ip = 0;
-+ current->signal->saved_ip = 0;
-+ }
-+
-+ return;
-+}
-+
-+static void
-+gr_set_proc_res(struct task_struct *task)
-+{
-+ struct acl_subject_label *proc;
-+ unsigned short i;
-+
-+ proc = task->acl;
-+
-+ if (proc->mode & (GR_LEARN | GR_INHERITLEARN))
-+ return;
-+
-+ for (i = 0; i < RLIM_NLIMITS; i++) {
-+ if (!(proc->resmask & (1 << i)))
-+ continue;
-+
-+ task->signal->rlim[i].rlim_cur = proc->res[i].rlim_cur;
-+ task->signal->rlim[i].rlim_max = proc->res[i].rlim_max;
-+ }
-+
-+ return;
-+}
-+
-+extern int __gr_process_user_ban(struct user_struct *user);
-+
-+int
-+gr_check_user_change(int real, int effective, int fs)
-+{
-+ unsigned int i;
-+ __u16 num;
-+ uid_t *uidlist;
-+ int curuid;
-+ int realok = 0;
-+ int effectiveok = 0;
-+ int fsok = 0;
-+
-+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
-+ struct user_struct *user;
-+
-+ if (real == -1)
-+ goto skipit;
-+
-+ user = find_user(real);
-+ if (user == NULL)
-+ goto skipit;
-+
-+ if (__gr_process_user_ban(user)) {
-+ /* for find_user */
-+ free_uid(user);
-+ return 1;
-+ }
-+
-+ /* for find_user */
-+ free_uid(user);
-+
-+skipit:
-+#endif
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return 0;
-+
-+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
-+ gr_log_learn_id_change('u', real, effective, fs);
-+
-+ num = current->acl->user_trans_num;
-+ uidlist = current->acl->user_transitions;
-+
-+ if (uidlist == NULL)
-+ return 0;
-+
-+ if (real == -1)
-+ realok = 1;
-+ if (effective == -1)
-+ effectiveok = 1;
-+ if (fs == -1)
-+ fsok = 1;
-+
-+ if (current->acl->user_trans_type & GR_ID_ALLOW) {
-+ for (i = 0; i < num; i++) {
-+ curuid = (int)uidlist[i];
-+ if (real == curuid)
-+ realok = 1;
-+ if (effective == curuid)
-+ effectiveok = 1;
-+ if (fs == curuid)
-+ fsok = 1;
-+ }
-+ } else if (current->acl->user_trans_type & GR_ID_DENY) {
-+ for (i = 0; i < num; i++) {
-+ curuid = (int)uidlist[i];
-+ if (real == curuid)
-+ break;
-+ if (effective == curuid)
-+ break;
-+ if (fs == curuid)
-+ break;
-+ }
-+ /* not in deny list */
-+ if (i == num) {
-+ realok = 1;
-+ effectiveok = 1;
-+ fsok = 1;
-+ }
-+ }
-+
-+ if (realok && effectiveok && fsok)
-+ return 0;
-+ else {
-+ gr_log_int(GR_DONT_AUDIT, GR_USRCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
-+ return 1;
-+ }
-+}
-+
-+int
-+gr_check_group_change(int real, int effective, int fs)
-+{
-+ unsigned int i;
-+ __u16 num;
-+ gid_t *gidlist;
-+ int curgid;
-+ int realok = 0;
-+ int effectiveok = 0;
-+ int fsok = 0;
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return 0;
-+
-+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
-+ gr_log_learn_id_change('g', real, effective, fs);
-+
-+ num = current->acl->group_trans_num;
-+ gidlist = current->acl->group_transitions;
-+
-+ if (gidlist == NULL)
-+ return 0;
-+
-+ if (real == -1)
-+ realok = 1;
-+ if (effective == -1)
-+ effectiveok = 1;
-+ if (fs == -1)
-+ fsok = 1;
-+
-+ if (current->acl->group_trans_type & GR_ID_ALLOW) {
-+ for (i = 0; i < num; i++) {
-+ curgid = (int)gidlist[i];
-+ if (real == curgid)
-+ realok = 1;
-+ if (effective == curgid)
-+ effectiveok = 1;
-+ if (fs == curgid)
-+ fsok = 1;
-+ }
-+ } else if (current->acl->group_trans_type & GR_ID_DENY) {
-+ for (i = 0; i < num; i++) {
-+ curgid = (int)gidlist[i];
-+ if (real == curgid)
-+ break;
-+ if (effective == curgid)
-+ break;
-+ if (fs == curgid)
-+ break;
-+ }
-+ /* not in deny list */
-+ if (i == num) {
-+ realok = 1;
-+ effectiveok = 1;
-+ fsok = 1;
-+ }
-+ }
-+
-+ if (realok && effectiveok && fsok)
-+ return 0;
-+ else {
-+ gr_log_int(GR_DONT_AUDIT, GR_GRPCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
-+ return 1;
-+ }
-+}
-+
-+extern int gr_acl_is_capable(const int cap);
-+
-+void
-+gr_set_role_label(struct task_struct *task, const uid_t uid, const uid_t gid)
-+{
-+ struct acl_role_label *role = task->role;
-+ struct acl_subject_label *subj = NULL;
-+ struct acl_object_label *obj;
-+ struct file *filp;
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return;
-+
-+ filp = task->exec_file;
-+
-+ /* kernel process, we'll give them the kernel role */
-+ if (unlikely(!filp)) {
-+ task->role = kernel_role;
-+ task->acl = kernel_role->root_label;
-+ return;
-+ } else if (!task->role || !(task->role->roletype & GR_ROLE_SPECIAL))
-+ role = lookup_acl_role_label(task, uid, gid);
-+
-+ /* don't change the role if we're not a privileged process */
-+ if (role && task->role != role &&
-+ (((role->roletype & GR_ROLE_USER) && !gr_acl_is_capable(CAP_SETUID)) ||
-+ ((role->roletype & GR_ROLE_GROUP) && !gr_acl_is_capable(CAP_SETGID))))
-+ return;
-+
-+ /* perform subject lookup in possibly new role
-+ we can use this result below in the case where role == task->role
-+ */
-+ subj = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, role);
-+
-+ /* if we changed uid/gid, but result in the same role
-+ and are using inheritance, don't lose the inherited subject
-+ if current subject is other than what normal lookup
-+ would result in, we arrived via inheritance, don't
-+ lose subject
-+ */
-+ if (role != task->role || (!(task->acl->mode & GR_INHERITLEARN) &&
-+ (subj == task->acl)))
-+ task->acl = subj;
-+
-+ task->role = role;
-+
-+ task->is_writable = 0;
-+
-+ /* ignore additional mmap checks for processes that are writable
-+ by the default ACL */
-+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
-+ if (unlikely(obj->mode & GR_WRITE))
-+ task->is_writable = 1;
-+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
-+ if (unlikely(obj->mode & GR_WRITE))
-+ task->is_writable = 1;
-+
-+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
-+ printk(KERN_ALERT "Set role label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
-+#endif
-+
-+ gr_set_proc_res(task);
-+
-+ return;
-+}
-+
-+int
-+gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
-+ const int unsafe_flags)
-+{
-+ struct task_struct *task = current;
-+ struct acl_subject_label *newacl;
-+ struct acl_object_label *obj;
-+ __u32 retmode;
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return 0;
-+
-+ newacl = chk_subj_label(dentry, mnt, task->role);
-+
-+ /* special handling for if we did an strace -f -p <pid> from an admin role, where pid then
-+ did an exec
-+ */
-+ rcu_read_lock();
-+ read_lock(&tasklist_lock);
-+ if (task->ptrace && task->parent && ((task->parent->role->roletype & GR_ROLE_GOD) ||
-+ (task->parent->acl->mode & GR_POVERRIDE))) {
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+ goto skip_check;
-+ }
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+
-+ if (unsafe_flags && !(task->acl->mode & GR_POVERRIDE) && (task->acl != newacl) &&
-+ !(task->role->roletype & GR_ROLE_GOD) &&
-+ !gr_search_file(dentry, GR_PTRACERD, mnt) &&
-+ !(task->acl->mode & (GR_LEARN | GR_INHERITLEARN))) {
-+ if (unsafe_flags & LSM_UNSAFE_SHARE)
-+ gr_log_fs_generic(GR_DONT_AUDIT, GR_UNSAFESHARE_EXEC_ACL_MSG, dentry, mnt);
-+ else
-+ gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_EXEC_ACL_MSG, dentry, mnt);
-+ return -EACCES;
-+ }
-+
-+skip_check:
-+
-+ obj = chk_obj_label(dentry, mnt, task->acl);
-+ retmode = obj->mode & (GR_INHERIT | GR_AUDIT_INHERIT);
-+
-+ if (!(task->acl->mode & GR_INHERITLEARN) &&
-+ ((newacl->mode & GR_LEARN) || !(retmode & GR_INHERIT))) {
-+ if (obj->nested)
-+ task->acl = obj->nested;
-+ else
-+ task->acl = newacl;
-+ } else if (retmode & GR_INHERIT && retmode & GR_AUDIT_INHERIT)
-+ gr_log_str_fs(GR_DO_AUDIT, GR_INHERIT_ACL_MSG, task->acl->filename, dentry, mnt);
-+
-+ task->is_writable = 0;
-+
-+ /* ignore additional mmap checks for processes that are writable
-+ by the default ACL */
-+ obj = chk_obj_label(dentry, mnt, default_role->root_label);
-+ if (unlikely(obj->mode & GR_WRITE))
-+ task->is_writable = 1;
-+ obj = chk_obj_label(dentry, mnt, task->role->root_label);
-+ if (unlikely(obj->mode & GR_WRITE))
-+ task->is_writable = 1;
-+
-+ gr_set_proc_res(task);
-+
-+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
-+ printk(KERN_ALERT "Set subject label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
-+#endif
-+ return 0;
-+}
-+
-+/* always called with valid inodev ptr */
-+static void
-+do_handle_delete(struct inodev_entry *inodev, const ino_t ino, const dev_t dev)
-+{
-+ struct acl_object_label *matchpo;
-+ struct acl_subject_label *matchps;
-+ struct acl_subject_label *subj;
-+ struct acl_role_label *role;
-+ unsigned int x;
-+
-+ FOR_EACH_ROLE_START(role)
-+ FOR_EACH_SUBJECT_START(role, subj, x)
-+ if ((matchpo = lookup_acl_obj_label(ino, dev, subj)) != NULL)
-+ matchpo->mode |= GR_DELETED;
-+ FOR_EACH_SUBJECT_END(subj,x)
-+ FOR_EACH_NESTED_SUBJECT_START(role, subj)
-+ /* nested subjects aren't in the role's subj_hash table */
-+ if ((matchpo = lookup_acl_obj_label(ino, dev, subj)) != NULL)
-+ matchpo->mode |= GR_DELETED;
-+ FOR_EACH_NESTED_SUBJECT_END(subj)
-+ if ((matchps = lookup_acl_subj_label(ino, dev, role)) != NULL)
-+ matchps->mode |= GR_DELETED;
-+ FOR_EACH_ROLE_END(role)
-+
-+ inodev->nentry->deleted = 1;
-+
-+ return;
-+}
-+
-+void
-+gr_handle_delete(const ino_t ino, const dev_t dev)
-+{
-+ struct inodev_entry *inodev;
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return;
-+
-+ write_lock(&gr_inode_lock);
-+ inodev = lookup_inodev_entry(ino, dev);
-+ if (inodev != NULL)
-+ do_handle_delete(inodev, ino, dev);
-+ write_unlock(&gr_inode_lock);
-+
-+ return;
-+}
-+
-+static void
-+update_acl_obj_label(const ino_t oldinode, const dev_t olddevice,
-+ const ino_t newinode, const dev_t newdevice,
-+ struct acl_subject_label *subj)
-+{
-+ unsigned int index = gr_fhash(oldinode, olddevice, subj->obj_hash_size);
-+ struct acl_object_label *match;
-+
-+ match = subj->obj_hash[index];
-+
-+ while (match && (match->inode != oldinode ||
-+ match->device != olddevice ||
-+ !(match->mode & GR_DELETED)))
-+ match = match->next;
-+
-+ if (match && (match->inode == oldinode)
-+ && (match->device == olddevice)
-+ && (match->mode & GR_DELETED)) {
-+ if (match->prev == NULL) {
-+ subj->obj_hash[index] = match->next;
-+ if (match->next != NULL)
-+ match->next->prev = NULL;
-+ } else {
-+ match->prev->next = match->next;
-+ if (match->next != NULL)
-+ match->next->prev = match->prev;
-+ }
-+ match->prev = NULL;
-+ match->next = NULL;
-+ match->inode = newinode;
-+ match->device = newdevice;
-+ match->mode &= ~GR_DELETED;
-+
-+ insert_acl_obj_label(match, subj);
-+ }
-+
-+ return;
-+}
-+
-+static void
-+update_acl_subj_label(const ino_t oldinode, const dev_t olddevice,
-+ const ino_t newinode, const dev_t newdevice,
-+ struct acl_role_label *role)
-+{
-+ unsigned int index = gr_fhash(oldinode, olddevice, role->subj_hash_size);
-+ struct acl_subject_label *match;
-+
-+ match = role->subj_hash[index];
-+
-+ while (match && (match->inode != oldinode ||
-+ match->device != olddevice ||
-+ !(match->mode & GR_DELETED)))
-+ match = match->next;
-+
-+ if (match && (match->inode == oldinode)
-+ && (match->device == olddevice)
-+ && (match->mode & GR_DELETED)) {
-+ if (match->prev == NULL) {
-+ role->subj_hash[index] = match->next;
-+ if (match->next != NULL)
-+ match->next->prev = NULL;
-+ } else {
-+ match->prev->next = match->next;
-+ if (match->next != NULL)
-+ match->next->prev = match->prev;
-+ }
-+ match->prev = NULL;
-+ match->next = NULL;
-+ match->inode = newinode;
-+ match->device = newdevice;
-+ match->mode &= ~GR_DELETED;
-+
-+ insert_acl_subj_label(match, role);
-+ }
-+
-+ return;
-+}
-+
-+static void
-+update_inodev_entry(const ino_t oldinode, const dev_t olddevice,
-+ const ino_t newinode, const dev_t newdevice)
-+{
-+ unsigned int index = gr_fhash(oldinode, olddevice, inodev_set.i_size);
-+ struct inodev_entry *match;
-+
-+ match = inodev_set.i_hash[index];
-+
-+ while (match && (match->nentry->inode != oldinode ||
-+ match->nentry->device != olddevice || !match->nentry->deleted))
-+ match = match->next;
-+
-+ if (match && (match->nentry->inode == oldinode)
-+ && (match->nentry->device == olddevice) &&
-+ match->nentry->deleted) {
-+ if (match->prev == NULL) {
-+ inodev_set.i_hash[index] = match->next;
-+ if (match->next != NULL)
-+ match->next->prev = NULL;
-+ } else {
-+ match->prev->next = match->next;
-+ if (match->next != NULL)
-+ match->next->prev = match->prev;
-+ }
-+ match->prev = NULL;
-+ match->next = NULL;
-+ match->nentry->inode = newinode;
-+ match->nentry->device = newdevice;
-+ match->nentry->deleted = 0;
-+
-+ insert_inodev_entry(match);
-+ }
-+
-+ return;
-+}
-+
-+static void
-+__do_handle_create(const struct name_entry *matchn, ino_t inode, dev_t dev)
-+{
-+ struct acl_subject_label *subj;
-+ struct acl_role_label *role;
-+ unsigned int x;
-+
-+ FOR_EACH_ROLE_START(role)
-+ update_acl_subj_label(matchn->inode, matchn->device,
-+ inode, dev, role);
-+
-+ FOR_EACH_NESTED_SUBJECT_START(role, subj)
-+ if ((subj->inode == inode) && (subj->device == dev)) {
-+ subj->inode = inode;
-+ subj->device = dev;
-+ }
-+ /* nested subjects aren't in the role's subj_hash table */
-+ update_acl_obj_label(matchn->inode, matchn->device,
-+ inode, dev, subj);
-+ FOR_EACH_NESTED_SUBJECT_END(subj)
-+ FOR_EACH_SUBJECT_START(role, subj, x)
-+ update_acl_obj_label(matchn->inode, matchn->device,
-+ inode, dev, subj);
-+ FOR_EACH_SUBJECT_END(subj,x)
-+ FOR_EACH_ROLE_END(role)
-+
-+ update_inodev_entry(matchn->inode, matchn->device, inode, dev);
-+
-+ return;
-+}
-+
-+static void
-+do_handle_create(const struct name_entry *matchn, const struct dentry *dentry,
-+ const struct vfsmount *mnt)
-+{
-+ ino_t ino = dentry->d_inode->i_ino;
-+ dev_t dev = __get_dev(dentry);
-+
-+ __do_handle_create(matchn, ino, dev);
-+
-+ return;
-+}
-+
-+void
-+gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ struct name_entry *matchn;
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return;
-+
-+ preempt_disable();
-+ matchn = lookup_name_entry(gr_to_filename_rbac(dentry, mnt));
-+
-+ if (unlikely((unsigned long)matchn)) {
-+ write_lock(&gr_inode_lock);
-+ do_handle_create(matchn, dentry, mnt);
-+ write_unlock(&gr_inode_lock);
-+ }
-+ preempt_enable();
-+
-+ return;
-+}
-+
-+void
-+gr_handle_proc_create(const struct dentry *dentry, const struct inode *inode)
-+{
-+ struct name_entry *matchn;
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return;
-+
-+ preempt_disable();
-+ matchn = lookup_name_entry(gr_to_proc_filename_rbac(dentry, init_pid_ns.proc_mnt));
-+
-+ if (unlikely((unsigned long)matchn)) {
-+ write_lock(&gr_inode_lock);
-+ __do_handle_create(matchn, inode->i_ino, inode->i_sb->s_dev);
-+ write_unlock(&gr_inode_lock);
-+ }
-+ preempt_enable();
-+
-+ return;
-+}
-+
-+void
-+gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
-+ struct dentry *old_dentry,
-+ struct dentry *new_dentry,
-+ struct vfsmount *mnt, const __u8 replace)
-+{
-+ struct name_entry *matchn;
-+ struct inodev_entry *inodev;
-+ struct inode *inode = new_dentry->d_inode;
-+ ino_t oldinode = old_dentry->d_inode->i_ino;
-+ dev_t olddev = __get_dev(old_dentry);
-+
-+ /* vfs_rename swaps the name and parent link for old_dentry and
-+ new_dentry
-+ at this point, old_dentry has the new name, parent link, and inode
-+ for the renamed file
-+ if a file is being replaced by a rename, new_dentry has the inode
-+ and name for the replaced file
-+ */
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return;
-+
-+ preempt_disable();
-+ matchn = lookup_name_entry(gr_to_filename_rbac(old_dentry, mnt));
-+
-+ /* we wouldn't have to check d_inode if it weren't for
-+ NFS silly-renaming
-+ */
-+
-+ write_lock(&gr_inode_lock);
-+ if (unlikely(replace && inode)) {
-+ ino_t newinode = inode->i_ino;
-+ dev_t newdev = __get_dev(new_dentry);
-+ inodev = lookup_inodev_entry(newinode, newdev);
-+ if (inodev != NULL && ((inode->i_nlink <= 1) || S_ISDIR(inode->i_mode)))
-+ do_handle_delete(inodev, newinode, newdev);
-+ }
-+
-+ inodev = lookup_inodev_entry(oldinode, olddev);
-+ if (inodev != NULL && ((old_dentry->d_inode->i_nlink <= 1) || S_ISDIR(old_dentry->d_inode->i_mode)))
-+ do_handle_delete(inodev, oldinode, olddev);
-+
-+ if (unlikely((unsigned long)matchn))
-+ do_handle_create(matchn, old_dentry, mnt);
-+
-+ write_unlock(&gr_inode_lock);
-+ preempt_enable();
-+
-+ return;
-+}
-+
-+static int
-+lookup_special_role_auth(__u16 mode, const char *rolename, unsigned char **salt,
-+ unsigned char **sum)
-+{
-+ struct acl_role_label *r;
-+ struct role_allowed_ip *ipp;
-+ struct role_transition *trans;
-+ unsigned int i;
-+ int found = 0;
-+ u32 curr_ip = current->signal->curr_ip;
-+
-+ current->signal->saved_ip = curr_ip;
-+
-+ /* check transition table */
-+
-+ for (trans = current->role->transitions; trans; trans = trans->next) {
-+ if (!strcmp(rolename, trans->rolename)) {
-+ found = 1;
-+ break;
-+ }
-+ }
-+
-+ if (!found)
-+ return 0;
-+
-+ /* handle special roles that do not require authentication
-+ and check ip */
-+
-+ FOR_EACH_ROLE_START(r)
-+ if (!strcmp(rolename, r->rolename) &&
-+ (r->roletype & GR_ROLE_SPECIAL)) {
-+ found = 0;
-+ if (r->allowed_ips != NULL) {
-+ for (ipp = r->allowed_ips; ipp; ipp = ipp->next) {
-+ if ((ntohl(curr_ip) & ipp->netmask) ==
-+ (ntohl(ipp->addr) & ipp->netmask))
-+ found = 1;
-+ }
-+ } else
-+ found = 2;
-+ if (!found)
-+ return 0;
-+
-+ if (((mode == GR_SPROLE) && (r->roletype & GR_ROLE_NOPW)) ||
-+ ((mode == GR_SPROLEPAM) && (r->roletype & GR_ROLE_PAM))) {
-+ *salt = NULL;
-+ *sum = NULL;
-+ return 1;
-+ }
-+ }
-+ FOR_EACH_ROLE_END(r)
-+
-+ for (i = 0; i < num_sprole_pws; i++) {
-+ if (!strcmp(rolename, acl_special_roles[i]->rolename)) {
-+ *salt = acl_special_roles[i]->salt;
-+ *sum = acl_special_roles[i]->sum;
-+ return 1;
-+ }
-+ }
-+
-+ return 0;
-+}
-+
-+static void
-+assign_special_role(char *rolename)
-+{
-+ struct acl_object_label *obj;
-+ struct acl_role_label *r;
-+ struct acl_role_label *assigned = NULL;
-+ struct task_struct *tsk;
-+ struct file *filp;
-+
-+ FOR_EACH_ROLE_START(r)
-+ if (!strcmp(rolename, r->rolename) &&
-+ (r->roletype & GR_ROLE_SPECIAL)) {
-+ assigned = r;
-+ break;
-+ }
-+ FOR_EACH_ROLE_END(r)
-+
-+ if (!assigned)
-+ return;
-+
-+ read_lock(&tasklist_lock);
-+ read_lock(&grsec_exec_file_lock);
-+
-+ tsk = current->real_parent;
-+ if (tsk == NULL)
-+ goto out_unlock;
-+
-+ filp = tsk->exec_file;
-+ if (filp == NULL)
-+ goto out_unlock;
-+
-+ tsk->is_writable = 0;
-+
-+ tsk->acl_sp_role = 1;
-+ tsk->acl_role_id = ++acl_sp_role_value;
-+ tsk->role = assigned;
-+ tsk->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role);
-+
-+ /* ignore additional mmap checks for processes that are writable
-+ by the default ACL */
-+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
-+ if (unlikely(obj->mode & GR_WRITE))
-+ tsk->is_writable = 1;
-+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role->root_label);
-+ if (unlikely(obj->mode & GR_WRITE))
-+ tsk->is_writable = 1;
-+
-+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
-+ printk(KERN_ALERT "Assigning special role:%s subject:%s to process (%s:%d)\n", tsk->role->rolename, tsk->acl->filename, tsk->comm, tsk->pid);
-+#endif
-+
-+out_unlock:
-+ read_unlock(&grsec_exec_file_lock);
-+ read_unlock(&tasklist_lock);
-+ return;
-+}
-+
-+int gr_check_secure_terminal(struct task_struct *task)
-+{
-+ struct task_struct *p, *p2, *p3;
-+ struct files_struct *files;
-+ struct fdtable *fdt;
-+ struct file *our_file = NULL, *file;
-+ int i;
-+
-+ if (task->signal->tty == NULL)
-+ return 1;
-+
-+ files = get_files_struct(task);
-+ if (files != NULL) {
-+ rcu_read_lock();
-+ fdt = files_fdtable(files);
-+ for (i=0; i < fdt->max_fds; i++) {
-+ file = fcheck_files(files, i);
-+ if (file && (our_file == NULL) && (file->private_data == task->signal->tty)) {
-+ get_file(file);
-+ our_file = file;
-+ }
-+ }
-+ rcu_read_unlock();
-+ put_files_struct(files);
-+ }
-+
-+ if (our_file == NULL)
-+ return 1;
-+
-+ read_lock(&tasklist_lock);
-+ do_each_thread(p2, p) {
-+ files = get_files_struct(p);
-+ if (files == NULL ||
-+ (p->signal && p->signal->tty == task->signal->tty)) {
-+ if (files != NULL)
-+ put_files_struct(files);
-+ continue;
-+ }
-+ rcu_read_lock();
-+ fdt = files_fdtable(files);
-+ for (i=0; i < fdt->max_fds; i++) {
-+ file = fcheck_files(files, i);
-+ if (file && S_ISCHR(file->f_path.dentry->d_inode->i_mode) &&
-+ file->f_path.dentry->d_inode->i_rdev == our_file->f_path.dentry->d_inode->i_rdev) {
-+ p3 = task;
-+ while (p3->pid > 0) {
-+ if (p3 == p)
-+ break;
-+ p3 = p3->real_parent;
-+ }
-+ if (p3 == p)
-+ break;
-+ gr_log_ttysniff(GR_DONT_AUDIT_GOOD, GR_TTYSNIFF_ACL_MSG, p);
-+ gr_handle_alertkill(p);
-+ rcu_read_unlock();
-+ put_files_struct(files);
-+ read_unlock(&tasklist_lock);
-+ fput(our_file);
-+ return 0;
-+ }
-+ }
-+ rcu_read_unlock();
-+ put_files_struct(files);
-+ } while_each_thread(p2, p);
-+ read_unlock(&tasklist_lock);
-+
-+ fput(our_file);
-+ return 1;
-+}
-+
-+static int gr_rbac_disable(void *unused)
-+{
-+ pax_open_kernel();
-+ gr_status &= ~GR_READY;
-+ pax_close_kernel();
-+
-+ return 0;
-+}
-+
-+ssize_t
-+write_grsec_handler(struct file *file, const char * buf, size_t count, loff_t *ppos)
-+{
-+ struct gr_arg_wrapper uwrap;
-+ unsigned char *sprole_salt = NULL;
-+ unsigned char *sprole_sum = NULL;
-+ int error = sizeof (struct gr_arg_wrapper);
-+ int error2 = 0;
-+
-+ mutex_lock(&gr_dev_mutex);
-+
-+ if ((gr_status & GR_READY) && !(current->acl->mode & GR_KERNELAUTH)) {
-+ error = -EPERM;
-+ goto out;
-+ }
-+
-+ if (count != sizeof (struct gr_arg_wrapper)) {
-+ gr_log_int_int(GR_DONT_AUDIT_GOOD, GR_DEV_ACL_MSG, (int)count, (int)sizeof(struct gr_arg_wrapper));
-+ error = -EINVAL;
-+ goto out;
-+ }
-+
-+
-+ if (gr_auth_expires && time_after_eq(get_seconds(), gr_auth_expires)) {
-+ gr_auth_expires = 0;
-+ gr_auth_attempts = 0;
-+ }
-+
-+ if (copy_from_user(&uwrap, buf, sizeof (struct gr_arg_wrapper))) {
-+ error = -EFAULT;
-+ goto out;
-+ }
-+
-+ if ((uwrap.version != GRSECURITY_VERSION) || (uwrap.size != sizeof(struct gr_arg))) {
-+ error = -EINVAL;
-+ goto out;
-+ }
-+
-+ if (copy_from_user(gr_usermode, uwrap.arg, sizeof (struct gr_arg))) {
-+ error = -EFAULT;
-+ goto out;
-+ }
-+
-+ if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_SPROLEPAM &&
-+ gr_auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
-+ time_after(gr_auth_expires, get_seconds())) {
-+ error = -EBUSY;
-+ goto out;
-+ }
-+
-+ /* if non-root trying to do anything other than use a special role,
-+ do not attempt authentication, do not count towards authentication
-+ locking
-+ */
-+
-+ if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_STATUS &&
-+ gr_usermode->mode != GR_UNSPROLE && gr_usermode->mode != GR_SPROLEPAM &&
-+ current_uid()) {
-+ error = -EPERM;
-+ goto out;
-+ }
-+
-+ /* ensure pw and special role name are null terminated */
-+
-+ gr_usermode->pw[GR_PW_LEN - 1] = '\0';
-+ gr_usermode->sp_role[GR_SPROLE_LEN - 1] = '\0';
-+
-+ /* Okay.
-+ * We have our enough of the argument structure..(we have yet
-+ * to copy_from_user the tables themselves) . Copy the tables
-+ * only if we need them, i.e. for loading operations. */
-+
-+ switch (gr_usermode->mode) {
-+ case GR_STATUS:
-+ if (gr_status & GR_READY) {
-+ error = 1;
-+ if (!gr_check_secure_terminal(current))
-+ error = 3;
-+ } else
-+ error = 2;
-+ goto out;
-+ case GR_SHUTDOWN:
-+ if ((gr_status & GR_READY)
-+ && !(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
-+ stop_machine(gr_rbac_disable, NULL, NULL);
-+ free_variables();
-+ memset(gr_usermode, 0, sizeof (struct gr_arg));
-+ memset(gr_system_salt, 0, GR_SALT_LEN);
-+ memset(gr_system_sum, 0, GR_SHA_LEN);
-+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG);
-+ } else if (gr_status & GR_READY) {
-+ gr_log_noargs(GR_DONT_AUDIT, GR_SHUTF_ACL_MSG);
-+ error = -EPERM;
-+ } else {
-+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTI_ACL_MSG);
-+ error = -EAGAIN;
-+ }
-+ break;
-+ case GR_ENABLE:
-+ if (!(gr_status & GR_READY) && !(error2 = gracl_init(gr_usermode)))
-+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_ENABLE_ACL_MSG, GR_VERSION);
-+ else {
-+ if (gr_status & GR_READY)
-+ error = -EAGAIN;
-+ else
-+ error = error2;
-+ gr_log_str(GR_DONT_AUDIT, GR_ENABLEF_ACL_MSG, GR_VERSION);
-+ }
-+ break;
-+ case GR_RELOAD:
-+ if (!(gr_status & GR_READY)) {
-+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOADI_ACL_MSG, GR_VERSION);
-+ error = -EAGAIN;
-+ } else if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
-+ stop_machine(gr_rbac_disable, NULL, NULL);
-+ free_variables();
-+ error2 = gracl_init(gr_usermode);
-+ if (!error2)
-+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOAD_ACL_MSG, GR_VERSION);
-+ else {
-+ gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
-+ error = error2;
-+ }
-+ } else {
-+ gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
-+ error = -EPERM;
-+ }
-+ break;
-+ case GR_SEGVMOD:
-+ if (unlikely(!(gr_status & GR_READY))) {
-+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODI_ACL_MSG);
-+ error = -EAGAIN;
-+ break;
-+ }
-+
-+ if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
-+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODS_ACL_MSG);
-+ if (gr_usermode->segv_device && gr_usermode->segv_inode) {
-+ struct acl_subject_label *segvacl;
-+ segvacl =
-+ lookup_acl_subj_label(gr_usermode->segv_inode,
-+ gr_usermode->segv_device,
-+ current->role);
-+ if (segvacl) {
-+ segvacl->crashes = 0;
-+ segvacl->expires = 0;
-+ }
-+ } else if (gr_find_uid(gr_usermode->segv_uid) >= 0) {
-+ gr_remove_uid(gr_usermode->segv_uid);
-+ }
-+ } else {
-+ gr_log_noargs(GR_DONT_AUDIT, GR_SEGVMODF_ACL_MSG);
-+ error = -EPERM;
-+ }
-+ break;
-+ case GR_SPROLE:
-+ case GR_SPROLEPAM:
-+ if (unlikely(!(gr_status & GR_READY))) {
-+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SPROLEI_ACL_MSG);
-+ error = -EAGAIN;
-+ break;
-+ }
-+
-+ if (current->role->expires && time_after_eq(get_seconds(), current->role->expires)) {
-+ current->role->expires = 0;
-+ current->role->auth_attempts = 0;
-+ }
-+
-+ if (current->role->auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
-+ time_after(current->role->expires, get_seconds())) {
-+ error = -EBUSY;
-+ goto out;
-+ }
-+
-+ if (lookup_special_role_auth
-+ (gr_usermode->mode, gr_usermode->sp_role, &sprole_salt, &sprole_sum)
-+ && ((!sprole_salt && !sprole_sum)
-+ || !(chkpw(gr_usermode, sprole_salt, sprole_sum)))) {
-+ char *p = "";
-+ assign_special_role(gr_usermode->sp_role);
-+ read_lock(&tasklist_lock);
-+ if (current->real_parent)
-+ p = current->real_parent->role->rolename;
-+ read_unlock(&tasklist_lock);
-+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLES_ACL_MSG,
-+ p, acl_sp_role_value);
-+ } else {
-+ gr_log_str(GR_DONT_AUDIT, GR_SPROLEF_ACL_MSG, gr_usermode->sp_role);
-+ error = -EPERM;
-+ if(!(current->role->auth_attempts++))
-+ current->role->expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
-+
-+ goto out;
-+ }
-+ break;
-+ case GR_UNSPROLE:
-+ if (unlikely(!(gr_status & GR_READY))) {
-+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_UNSPROLEI_ACL_MSG);
-+ error = -EAGAIN;
-+ break;
-+ }
-+
-+ if (current->role->roletype & GR_ROLE_SPECIAL) {
-+ char *p = "";
-+ int i = 0;
-+
-+ read_lock(&tasklist_lock);
-+ if (current->real_parent) {
-+ p = current->real_parent->role->rolename;
-+ i = current->real_parent->acl_role_id;
-+ }
-+ read_unlock(&tasklist_lock);
-+
-+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_UNSPROLES_ACL_MSG, p, i);
-+ gr_set_acls(1);
-+ } else {
-+ error = -EPERM;
-+ goto out;
-+ }
-+ break;
-+ default:
-+ gr_log_int(GR_DONT_AUDIT, GR_INVMODE_ACL_MSG, gr_usermode->mode);
-+ error = -EINVAL;
-+ break;
-+ }
-+
-+ if (error != -EPERM)
-+ goto out;
-+
-+ if(!(gr_auth_attempts++))
-+ gr_auth_expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
-+
-+ out:
-+ mutex_unlock(&gr_dev_mutex);
-+ return error;
-+}
-+
-+/* must be called with
-+ rcu_read_lock();
-+ read_lock(&tasklist_lock);
-+ read_lock(&grsec_exec_file_lock);
-+*/
-+int gr_apply_subject_to_task(struct task_struct *task)
-+{
-+ struct acl_object_label *obj;
-+ char *tmpname;
-+ struct acl_subject_label *tmpsubj;
-+ struct file *filp;
-+ struct name_entry *nmatch;
-+
-+ filp = task->exec_file;
-+ if (filp == NULL)
-+ return 0;
-+
-+ /* the following is to apply the correct subject
-+ on binaries running when the RBAC system
-+ is enabled, when the binaries have been
-+ replaced or deleted since their execution
-+ -----
-+ when the RBAC system starts, the inode/dev
-+ from exec_file will be one the RBAC system
-+ is unaware of. It only knows the inode/dev
-+ of the present file on disk, or the absence
-+ of it.
-+ */
-+ preempt_disable();
-+ tmpname = gr_to_filename_rbac(filp->f_path.dentry, filp->f_path.mnt);
-+
-+ nmatch = lookup_name_entry(tmpname);
-+ preempt_enable();
-+ tmpsubj = NULL;
-+ if (nmatch) {
-+ if (nmatch->deleted)
-+ tmpsubj = lookup_acl_subj_label_deleted(nmatch->inode, nmatch->device, task->role);
-+ else
-+ tmpsubj = lookup_acl_subj_label(nmatch->inode, nmatch->device, task->role);
-+ if (tmpsubj != NULL)
-+ task->acl = tmpsubj;
-+ }
-+ if (tmpsubj == NULL)
-+ task->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt,
-+ task->role);
-+ if (task->acl) {
-+ task->is_writable = 0;
-+ /* ignore additional mmap checks for processes that are writable
-+ by the default ACL */
-+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
-+ if (unlikely(obj->mode & GR_WRITE))
-+ task->is_writable = 1;
-+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
-+ if (unlikely(obj->mode & GR_WRITE))
-+ task->is_writable = 1;
-+
-+ gr_set_proc_res(task);
-+
-+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
-+ printk(KERN_ALERT "gr_set_acls for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
-+#endif
-+ } else {
-+ return 1;
-+ }
-+
-+ return 0;
-+}
-+
-+int
-+gr_set_acls(const int type)
-+{
-+ struct task_struct *task, *task2;
-+ struct acl_role_label *role = current->role;
-+ __u16 acl_role_id = current->acl_role_id;
-+ const struct cred *cred;
-+ int ret;
-+
-+ rcu_read_lock();
-+ read_lock(&tasklist_lock);
-+ read_lock(&grsec_exec_file_lock);
-+ do_each_thread(task2, task) {
-+ /* check to see if we're called from the exit handler,
-+ if so, only replace ACLs that have inherited the admin
-+ ACL */
-+
-+ if (type && (task->role != role ||
-+ task->acl_role_id != acl_role_id))
-+ continue;
-+
-+ task->acl_role_id = 0;
-+ task->acl_sp_role = 0;
-+
-+ if (task->exec_file) {
-+ cred = __task_cred(task);
-+ task->role = lookup_acl_role_label(task, cred->uid, cred->gid);
-+
-+ ret = gr_apply_subject_to_task(task);
-+ if (ret) {
-+ read_unlock(&grsec_exec_file_lock);
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_DEFACL_MSG, task->comm, task->pid);
-+ return ret;
-+ }
-+ } else {
-+ // it's a kernel process
-+ task->role = kernel_role;
-+ task->acl = kernel_role->root_label;
-+#ifdef CONFIG_GRKERNSEC_ACL_HIDEKERN
-+ task->acl->mode &= ~GR_PROCFIND;
-+#endif
-+ }
-+ } while_each_thread(task2, task);
-+ read_unlock(&grsec_exec_file_lock);
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+
-+ return 0;
-+}
-+
-+void
-+gr_learn_resource(const struct task_struct *task,
-+ const int res, const unsigned long wanted, const int gt)
-+{
-+ struct acl_subject_label *acl;
-+ const struct cred *cred;
-+
-+ if (unlikely((gr_status & GR_READY) &&
-+ task->acl && (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))))
-+ goto skip_reslog;
-+
-+#ifdef CONFIG_GRKERNSEC_RESLOG
-+ gr_log_resource(task, res, wanted, gt);
-+#endif
-+ skip_reslog:
-+
-+ if (unlikely(!(gr_status & GR_READY) || !wanted || res >= GR_NLIMITS))
-+ return;
-+
-+ acl = task->acl;
-+
-+ if (likely(!acl || !(acl->mode & (GR_LEARN | GR_INHERITLEARN)) ||
-+ !(acl->resmask & (1 << (unsigned short) res))))
-+ return;
-+
-+ if (wanted >= acl->res[res].rlim_cur) {
-+ unsigned long res_add;
-+
-+ res_add = wanted;
-+ switch (res) {
-+ case RLIMIT_CPU:
-+ res_add += GR_RLIM_CPU_BUMP;
-+ break;
-+ case RLIMIT_FSIZE:
-+ res_add += GR_RLIM_FSIZE_BUMP;
-+ break;
-+ case RLIMIT_DATA:
-+ res_add += GR_RLIM_DATA_BUMP;
-+ break;
-+ case RLIMIT_STACK:
-+ res_add += GR_RLIM_STACK_BUMP;
-+ break;
-+ case RLIMIT_CORE:
-+ res_add += GR_RLIM_CORE_BUMP;
-+ break;
-+ case RLIMIT_RSS:
-+ res_add += GR_RLIM_RSS_BUMP;
-+ break;
-+ case RLIMIT_NPROC:
-+ res_add += GR_RLIM_NPROC_BUMP;
-+ break;
-+ case RLIMIT_NOFILE:
-+ res_add += GR_RLIM_NOFILE_BUMP;
-+ break;
-+ case RLIMIT_MEMLOCK:
-+ res_add += GR_RLIM_MEMLOCK_BUMP;
-+ break;
-+ case RLIMIT_AS:
-+ res_add += GR_RLIM_AS_BUMP;
-+ break;
-+ case RLIMIT_LOCKS:
-+ res_add += GR_RLIM_LOCKS_BUMP;
-+ break;
-+ case RLIMIT_SIGPENDING:
-+ res_add += GR_RLIM_SIGPENDING_BUMP;
-+ break;
-+ case RLIMIT_MSGQUEUE:
-+ res_add += GR_RLIM_MSGQUEUE_BUMP;
-+ break;
-+ case RLIMIT_NICE:
-+ res_add += GR_RLIM_NICE_BUMP;
-+ break;
-+ case RLIMIT_RTPRIO:
-+ res_add += GR_RLIM_RTPRIO_BUMP;
-+ break;
-+ case RLIMIT_RTTIME:
-+ res_add += GR_RLIM_RTTIME_BUMP;
-+ break;
-+ }
-+
-+ acl->res[res].rlim_cur = res_add;
-+
-+ if (wanted > acl->res[res].rlim_max)
-+ acl->res[res].rlim_max = res_add;
-+
-+ /* only log the subject filename, since resource logging is supported for
-+ single-subject learning only */
-+ rcu_read_lock();
-+ cred = __task_cred(task);
-+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
-+ task->role->roletype, cred->uid, cred->gid, acl->filename,
-+ acl->filename, acl->res[res].rlim_cur, acl->res[res].rlim_max,
-+ "", (unsigned long) res, &task->signal->saved_ip);
-+ rcu_read_unlock();
-+ }
-+
-+ return;
-+}
-+
-+#if defined(CONFIG_PAX_HAVE_ACL_FLAGS) && (defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR))
-+void
-+pax_set_initial_flags(struct linux_binprm *bprm)
-+{
-+ struct task_struct *task = current;
-+ struct acl_subject_label *proc;
-+ unsigned long flags;
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return;
-+
-+ flags = pax_get_flags(task);
-+
-+ proc = task->acl;
-+
-+ if (proc->pax_flags & GR_PAX_DISABLE_PAGEEXEC)
-+ flags &= ~MF_PAX_PAGEEXEC;
-+ if (proc->pax_flags & GR_PAX_DISABLE_SEGMEXEC)
-+ flags &= ~MF_PAX_SEGMEXEC;
-+ if (proc->pax_flags & GR_PAX_DISABLE_RANDMMAP)
-+ flags &= ~MF_PAX_RANDMMAP;
-+ if (proc->pax_flags & GR_PAX_DISABLE_EMUTRAMP)
-+ flags &= ~MF_PAX_EMUTRAMP;
-+ if (proc->pax_flags & GR_PAX_DISABLE_MPROTECT)
-+ flags &= ~MF_PAX_MPROTECT;
-+
-+ if (proc->pax_flags & GR_PAX_ENABLE_PAGEEXEC)
-+ flags |= MF_PAX_PAGEEXEC;
-+ if (proc->pax_flags & GR_PAX_ENABLE_SEGMEXEC)
-+ flags |= MF_PAX_SEGMEXEC;
-+ if (proc->pax_flags & GR_PAX_ENABLE_RANDMMAP)
-+ flags |= MF_PAX_RANDMMAP;
-+ if (proc->pax_flags & GR_PAX_ENABLE_EMUTRAMP)
-+ flags |= MF_PAX_EMUTRAMP;
-+ if (proc->pax_flags & GR_PAX_ENABLE_MPROTECT)
-+ flags |= MF_PAX_MPROTECT;
-+
-+ pax_set_flags(task, flags);
-+
-+ return;
-+}
-+#endif
-+
-+#ifdef CONFIG_SYSCTL
-+/* Eric Biederman likes breaking userland ABI and every inode-based security
-+ system to save 35kb of memory */
-+
-+/* we modify the passed in filename, but adjust it back before returning */
-+static struct acl_object_label *gr_lookup_by_name(char *name, unsigned int len)
-+{
-+ struct name_entry *nmatch;
-+ char *p, *lastp = NULL;
-+ struct acl_object_label *obj = NULL, *tmp;
-+ struct acl_subject_label *tmpsubj;
-+ char c = '\0';
-+
-+ read_lock(&gr_inode_lock);
-+
-+ p = name + len - 1;
-+ do {
-+ nmatch = lookup_name_entry(name);
-+ if (lastp != NULL)
-+ *lastp = c;
-+
-+ if (nmatch == NULL)
-+ goto next_component;
-+ tmpsubj = current->acl;
-+ do {
-+ obj = lookup_acl_obj_label(nmatch->inode, nmatch->device, tmpsubj);
-+ if (obj != NULL) {
-+ tmp = obj->globbed;
-+ while (tmp) {
-+ if (!glob_match(tmp->filename, name)) {
-+ obj = tmp;
-+ goto found_obj;
-+ }
-+ tmp = tmp->next;
-+ }
-+ goto found_obj;
-+ }
-+ } while ((tmpsubj = tmpsubj->parent_subject));
-+next_component:
-+ /* end case */
-+ if (p == name)
-+ break;
-+
-+ while (*p != '/')
-+ p--;
-+ if (p == name)
-+ lastp = p + 1;
-+ else {
-+ lastp = p;
-+ p--;
-+ }
-+ c = *lastp;
-+ *lastp = '\0';
-+ } while (1);
-+found_obj:
-+ read_unlock(&gr_inode_lock);
-+ /* obj returned will always be non-null */
-+ return obj;
-+}
-+
-+/* returns 0 when allowing, non-zero on error
-+ op of 0 is used for readdir, so we don't log the names of hidden files
-+*/
-+__u32
-+gr_handle_sysctl(const struct ctl_table *table, const int op)
-+{
-+ ctl_table *tmp;
-+ const char *proc_sys = "/proc/sys";
-+ char *path;
-+ struct acl_object_label *obj;
-+ unsigned short len = 0, pos = 0, depth = 0, i;
-+ __u32 err = 0;
-+ __u32 mode = 0;
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return 0;
-+
-+ /* for now, ignore operations on non-sysctl entries if it's not a
-+ readdir*/
-+ if (table->child != NULL && op != 0)
-+ return 0;
-+
-+ mode |= GR_FIND;
-+ /* it's only a read if it's an entry, read on dirs is for readdir */
-+ if (op & MAY_READ)
-+ mode |= GR_READ;
-+ if (op & MAY_WRITE)
-+ mode |= GR_WRITE;
-+
-+ preempt_disable();
-+
-+ path = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
-+
-+ /* it's only a read/write if it's an actual entry, not a dir
-+ (which are opened for readdir)
-+ */
-+
-+ /* convert the requested sysctl entry into a pathname */
-+
-+ for (tmp = (ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
-+ len += strlen(tmp->procname);
-+ len++;
-+ depth++;
-+ }
-+
-+ if ((len + depth + strlen(proc_sys) + 1) > PAGE_SIZE) {
-+ /* deny */
-+ goto out;
-+ }
-+
-+ memset(path, 0, PAGE_SIZE);
-+
-+ memcpy(path, proc_sys, strlen(proc_sys));
-+
-+ pos += strlen(proc_sys);
-+
-+ for (; depth > 0; depth--) {
-+ path[pos] = '/';
-+ pos++;
-+ for (i = 1, tmp = (ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
-+ if (depth == i) {
-+ memcpy(path + pos, tmp->procname,
-+ strlen(tmp->procname));
-+ pos += strlen(tmp->procname);
-+ }
-+ i++;
-+ }
-+ }
-+
-+ obj = gr_lookup_by_name(path, pos);
-+ err = obj->mode & (mode | to_gr_audit(mode) | GR_SUPPRESS);
-+
-+ if (unlikely((current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) &&
-+ ((err & mode) != mode))) {
-+ __u32 new_mode = mode;
-+
-+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
-+
-+ err = 0;
-+ gr_log_learn_sysctl(path, new_mode);
-+ } else if (!(err & GR_FIND) && !(err & GR_SUPPRESS) && op != 0) {
-+ gr_log_hidden_sysctl(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, path);
-+ err = -ENOENT;
-+ } else if (!(err & GR_FIND)) {
-+ err = -ENOENT;
-+ } else if (((err & mode) & ~GR_FIND) != (mode & ~GR_FIND) && !(err & GR_SUPPRESS)) {
-+ gr_log_str4(GR_DONT_AUDIT, GR_SYSCTL_ACL_MSG, "denied",
-+ path, (mode & GR_READ) ? " reading" : "",
-+ (mode & GR_WRITE) ? " writing" : "");
-+ err = -EACCES;
-+ } else if ((err & mode) != mode) {
-+ err = -EACCES;
-+ } else if ((((err & mode) & ~GR_FIND) == (mode & ~GR_FIND)) && (err & GR_AUDITS)) {
-+ gr_log_str4(GR_DO_AUDIT, GR_SYSCTL_ACL_MSG, "successful",
-+ path, (mode & GR_READ) ? " reading" : "",
-+ (mode & GR_WRITE) ? " writing" : "");
-+ err = 0;
-+ } else
-+ err = 0;
-+
-+ out:
-+ preempt_enable();
-+
-+ return err;
-+}
-+#endif
-+
-+int
-+gr_handle_proc_ptrace(struct task_struct *task)
-+{
-+ struct file *filp;
-+ struct task_struct *tmp = task;
-+ struct task_struct *curtemp = current;
-+ __u32 retmode;
-+
-+#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return 0;
-+#endif
-+
-+ read_lock(&tasklist_lock);
-+ read_lock(&grsec_exec_file_lock);
-+ filp = task->exec_file;
-+
-+ while (tmp->pid > 0) {
-+ if (tmp == curtemp)
-+ break;
-+ tmp = tmp->real_parent;
-+ }
-+
-+ if (!filp || (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
-+ ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE))))) {
-+ read_unlock(&grsec_exec_file_lock);
-+ read_unlock(&tasklist_lock);
-+ return 1;
-+ }
-+
-+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+ if (!(gr_status & GR_READY)) {
-+ read_unlock(&grsec_exec_file_lock);
-+ read_unlock(&tasklist_lock);
-+ return 0;
-+ }
-+#endif
-+
-+ retmode = gr_search_file(filp->f_path.dentry, GR_NOPTRACE, filp->f_path.mnt);
-+ read_unlock(&grsec_exec_file_lock);
-+ read_unlock(&tasklist_lock);
-+
-+ if (retmode & GR_NOPTRACE)
-+ return 1;
-+
-+ if (!(current->acl->mode & GR_POVERRIDE) && !(current->role->roletype & GR_ROLE_GOD)
-+ && (current->acl != task->acl || (current->acl != current->role->root_label
-+ && current->pid != task->pid)))
-+ return 1;
-+
-+ return 0;
-+}
-+
-+void task_grsec_rbac(struct seq_file *m, struct task_struct *p)
-+{
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return;
-+
-+ if (!(current->role->roletype & GR_ROLE_GOD))
-+ return;
-+
-+ seq_printf(m, "RBAC:\t%.64s:%c:%.950s\n",
-+ p->role->rolename, gr_task_roletype_to_char(p),
-+ p->acl->filename);
-+}
-+
-+int
-+gr_handle_ptrace(struct task_struct *task, const long request)
-+{
-+ struct task_struct *tmp = task;
-+ struct task_struct *curtemp = current;
-+ __u32 retmode;
-+
-+#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return 0;
-+#endif
-+
-+ if (request == PTRACE_ATTACH) {
-+ read_lock(&tasklist_lock);
-+ while (tmp->pid > 0) {
-+ if (tmp == curtemp)
-+ break;
-+ tmp = tmp->real_parent;
-+ }
-+
-+ if (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
-+ ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE)))) {
-+ read_unlock(&tasklist_lock);
-+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
-+ return 1;
-+ }
-+ read_unlock(&tasklist_lock);
-+ }
-+
-+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+ if (!(gr_status & GR_READY))
-+ return 0;
-+#endif
-+
-+ read_lock(&grsec_exec_file_lock);
-+ if (unlikely(!task->exec_file)) {
-+ read_unlock(&grsec_exec_file_lock);
-+ return 0;
-+ }
-+
-+ retmode = gr_search_file(task->exec_file->f_path.dentry, GR_PTRACERD | GR_NOPTRACE, task->exec_file->f_path.mnt);
-+ read_unlock(&grsec_exec_file_lock);
-+
-+ if (retmode & GR_NOPTRACE) {
-+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
-+ return 1;
-+ }
-+
-+ if (retmode & GR_PTRACERD) {
-+ switch (request) {
-+ case PTRACE_POKETEXT:
-+ case PTRACE_POKEDATA:
-+ case PTRACE_POKEUSR:
-+#if !defined(CONFIG_PPC32) && !defined(CONFIG_PPC64) && !defined(CONFIG_PARISC) && !defined(CONFIG_ALPHA) && !defined(CONFIG_IA64)
-+ case PTRACE_SETREGS:
-+ case PTRACE_SETFPREGS:
-+#endif
-+#ifdef CONFIG_X86
-+ case PTRACE_SETFPXREGS:
-+#endif
-+#ifdef CONFIG_ALTIVEC
-+ case PTRACE_SETVRREGS:
-+#endif
-+ return 1;
-+ default:
-+ return 0;
-+ }
-+ } else if (!(current->acl->mode & GR_POVERRIDE) &&
-+ !(current->role->roletype & GR_ROLE_GOD) &&
-+ (current->acl != task->acl)) {
-+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
-+ return 1;
-+ }
-+
-+ return 0;
-+}
-+
-+static int is_writable_mmap(const struct file *filp)
-+{
-+ struct task_struct *task = current;
-+ struct acl_object_label *obj, *obj2;
-+
-+ if (gr_status & GR_READY && !(task->acl->mode & GR_OVERRIDE) &&
-+ !task->is_writable && S_ISREG(filp->f_path.dentry->d_inode->i_mode) && (filp->f_path.mnt != shm_mnt || (filp->f_path.dentry->d_inode->i_nlink > 0))) {
-+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
-+ obj2 = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt,
-+ task->role->root_label);
-+ if (unlikely((obj->mode & GR_WRITE) || (obj2->mode & GR_WRITE))) {
-+ gr_log_fs_generic(GR_DONT_AUDIT, GR_WRITLIB_ACL_MSG, filp->f_path.dentry, filp->f_path.mnt);
-+ return 1;
-+ }
-+ }
-+ return 0;
-+}
-+
-+int
-+gr_acl_handle_mmap(const struct file *file, const unsigned long prot)
-+{
-+ __u32 mode;
-+
-+ if (unlikely(!file || !(prot & PROT_EXEC)))
-+ return 1;
-+
-+ if (is_writable_mmap(file))
-+ return 0;
-+
-+ mode =
-+ gr_search_file(file->f_path.dentry,
-+ GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
-+ file->f_path.mnt);
-+
-+ if (!gr_tpe_allow(file))
-+ return 0;
-+
-+ if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
-+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
-+ return 0;
-+ } else if (unlikely(!(mode & GR_EXEC))) {
-+ return 0;
-+ } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
-+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
-+ return 1;
-+ }
-+
-+ return 1;
-+}
-+
-+int
-+gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
-+{
-+ __u32 mode;
-+
-+ if (unlikely(!file || !(prot & PROT_EXEC)))
-+ return 1;
-+
-+ if (is_writable_mmap(file))
-+ return 0;
-+
-+ mode =
-+ gr_search_file(file->f_path.dentry,
-+ GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
-+ file->f_path.mnt);
-+
-+ if (!gr_tpe_allow(file))
-+ return 0;
-+
-+ if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
-+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
-+ return 0;
-+ } else if (unlikely(!(mode & GR_EXEC))) {
-+ return 0;
-+ } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
-+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
-+ return 1;
-+ }
-+
-+ return 1;
-+}
-+
-+void
-+gr_acl_handle_psacct(struct task_struct *task, const long code)
-+{
-+ unsigned long runtime;
-+ unsigned long cputime;
-+ unsigned int wday, cday;
-+ __u8 whr, chr;
-+ __u8 wmin, cmin;
-+ __u8 wsec, csec;
-+ struct timespec timeval;
-+
-+ if (unlikely(!(gr_status & GR_READY) || !task->acl ||
-+ !(task->acl->mode & GR_PROCACCT)))
-+ return;
-+
-+ do_posix_clock_monotonic_gettime(&timeval);
-+ runtime = timeval.tv_sec - task->start_time.tv_sec;
-+ wday = runtime / (3600 * 24);
-+ runtime -= wday * (3600 * 24);
-+ whr = runtime / 3600;
-+ runtime -= whr * 3600;
-+ wmin = runtime / 60;
-+ runtime -= wmin * 60;
-+ wsec = runtime;
-+
-+ cputime = (task->utime + task->stime) / HZ;
-+ cday = cputime / (3600 * 24);
-+ cputime -= cday * (3600 * 24);
-+ chr = cputime / 3600;
-+ cputime -= chr * 3600;
-+ cmin = cputime / 60;
-+ cputime -= cmin * 60;
-+ csec = cputime;
-+
-+ gr_log_procacct(GR_DO_AUDIT, GR_ACL_PROCACCT_MSG, task, wday, whr, wmin, wsec, cday, chr, cmin, csec, code);
-+
-+ return;
-+}
-+
-+void gr_set_kernel_label(struct task_struct *task)
-+{
-+ if (gr_status & GR_READY) {
-+ task->role = kernel_role;
-+ task->acl = kernel_role->root_label;
-+ }
-+ return;
-+}
-+
-+#ifdef CONFIG_TASKSTATS
-+int gr_is_taskstats_denied(int pid)
-+{
-+ struct task_struct *task;
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ const struct cred *cred;
-+#endif
-+ int ret = 0;
-+
-+ /* restrict taskstats viewing to un-chrooted root users
-+ who have the 'view' subject flag if the RBAC system is enabled
-+ */
-+
-+ rcu_read_lock();
-+ read_lock(&tasklist_lock);
-+ task = find_task_by_vpid(pid);
-+ if (task) {
-+#ifdef CONFIG_GRKERNSEC_CHROOT
-+ if (proc_is_chrooted(task))
-+ ret = -EACCES;
-+#endif
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ cred = __task_cred(task);
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+ if (cred->uid != 0)
-+ ret = -EACCES;
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ if (cred->uid != 0 && !groups_search(cred->group_info, grsec_proc_gid))
-+ ret = -EACCES;
-+#endif
-+#endif
-+ if (gr_status & GR_READY) {
-+ if (!(task->acl->mode & GR_VIEW))
-+ ret = -EACCES;
-+ }
-+ } else
-+ ret = -ENOENT;
-+
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+
-+ return ret;
-+}
-+#endif
-+
-+/* AUXV entries are filled via a descendant of search_binary_handler
-+ after we've already applied the subject for the target
-+*/
-+int gr_acl_enable_at_secure(void)
-+{
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return 0;
-+
-+ if (current->acl->mode & GR_ATSECURE)
-+ return 1;
-+
-+ return 0;
-+}
-+
-+int gr_acl_handle_filldir(const struct file *file, const char *name, const unsigned int namelen, const ino_t ino)
-+{
-+ struct task_struct *task = current;
-+ struct dentry *dentry = file->f_path.dentry;
-+ struct vfsmount *mnt = file->f_path.mnt;
-+ struct acl_object_label *obj, *tmp;
-+ struct acl_subject_label *subj;
-+ unsigned int bufsize;
-+ int is_not_root;
-+ char *path;
-+ dev_t dev = __get_dev(dentry);
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return 1;
-+
-+ if (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))
-+ return 1;
-+
-+ /* ignore Eric Biederman */
-+ if (IS_PRIVATE(dentry->d_inode))
-+ return 1;
-+
-+ subj = task->acl;
-+ read_lock(&gr_inode_lock);
-+ do {
-+ obj = lookup_acl_obj_label(ino, dev, subj);
-+ if (obj != NULL) {
-+ read_unlock(&gr_inode_lock);
-+ return (obj->mode & GR_FIND) ? 1 : 0;
-+ }
-+ } while ((subj = subj->parent_subject));
-+ read_unlock(&gr_inode_lock);
-+
-+ /* this is purely an optimization since we're looking for an object
-+ for the directory we're doing a readdir on
-+ if it's possible for any globbed object to match the entry we're
-+ filling into the directory, then the object we find here will be
-+ an anchor point with attached globbed objects
-+ */
-+ obj = chk_obj_label_noglob(dentry, mnt, task->acl);
-+ if (obj->globbed == NULL)
-+ return (obj->mode & GR_FIND) ? 1 : 0;
-+
-+ is_not_root = ((obj->filename[0] == '/') &&
-+ (obj->filename[1] == '\0')) ? 0 : 1;
-+ bufsize = PAGE_SIZE - namelen - is_not_root;
-+
-+ /* check bufsize > PAGE_SIZE || bufsize == 0 */
-+ if (unlikely((bufsize - 1) > (PAGE_SIZE - 1)))
-+ return 1;
-+
-+ preempt_disable();
-+ path = d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
-+ bufsize);
-+
-+ bufsize = strlen(path);
-+
-+ /* if base is "/", don't append an additional slash */
-+ if (is_not_root)
-+ *(path + bufsize) = '/';
-+ memcpy(path + bufsize + is_not_root, name, namelen);
-+ *(path + bufsize + namelen + is_not_root) = '\0';
-+
-+ tmp = obj->globbed;
-+ while (tmp) {
-+ if (!glob_match(tmp->filename, path)) {
-+ preempt_enable();
-+ return (tmp->mode & GR_FIND) ? 1 : 0;
-+ }
-+ tmp = tmp->next;
-+ }
-+ preempt_enable();
-+ return (obj->mode & GR_FIND) ? 1 : 0;
-+}
-+
-+void gr_put_exec_file(struct task_struct *task)
-+{
-+ struct file *filp;
-+
-+ write_lock(&grsec_exec_file_lock);
-+ filp = task->exec_file;
-+ task->exec_file = NULL;
-+ write_unlock(&grsec_exec_file_lock);
-+
-+ if (filp)
-+ fput(filp);
-+
-+ return;
-+}
-+
-+
-+#ifdef CONFIG_NETFILTER_XT_MATCH_GRADM_MODULE
-+EXPORT_SYMBOL(gr_acl_is_enabled);
-+#endif
-+EXPORT_SYMBOL(gr_learn_resource);
-+EXPORT_SYMBOL(gr_set_kernel_label);
-+#ifdef CONFIG_SECURITY
-+EXPORT_SYMBOL(gr_check_user_change);
-+EXPORT_SYMBOL(gr_check_group_change);
-+#endif
-+
-diff --git a/grsecurity/gracl_alloc.c b/grsecurity/gracl_alloc.c
-new file mode 100644
-index 0000000..34fefda
---- /dev/null
-+++ b/grsecurity/gracl_alloc.c
-@@ -0,0 +1,105 @@
-+#include <linux/kernel.h>
-+#include <linux/mm.h>
-+#include <linux/slab.h>
-+#include <linux/vmalloc.h>
-+#include <linux/gracl.h>
-+#include <linux/grsecurity.h>
-+
-+static unsigned long alloc_stack_next = 1;
-+static unsigned long alloc_stack_size = 1;
-+static void **alloc_stack;
-+
-+static __inline__ int
-+alloc_pop(void)
-+{
-+ if (alloc_stack_next == 1)
-+ return 0;
-+
-+ kfree(alloc_stack[alloc_stack_next - 2]);
-+
-+ alloc_stack_next--;
-+
-+ return 1;
-+}
-+
-+static __inline__ int
-+alloc_push(void *buf)
-+{
-+ if (alloc_stack_next >= alloc_stack_size)
-+ return 1;
-+
-+ alloc_stack[alloc_stack_next - 1] = buf;
-+
-+ alloc_stack_next++;
-+
-+ return 0;
-+}
-+
-+void *
-+acl_alloc(unsigned long len)
-+{
-+ void *ret = NULL;
-+
-+ if (!len || len > PAGE_SIZE)
-+ goto out;
-+
-+ ret = kmalloc(len, GFP_KERNEL);
-+
-+ if (ret) {
-+ if (alloc_push(ret)) {
-+ kfree(ret);
-+ ret = NULL;
-+ }
-+ }
-+
-+out:
-+ return ret;
-+}
-+
-+void *
-+acl_alloc_num(unsigned long num, unsigned long len)
-+{
-+ if (!len || (num > (PAGE_SIZE / len)))
-+ return NULL;
-+
-+ return acl_alloc(num * len);
-+}
-+
-+void
-+acl_free_all(void)
-+{
-+ if (gr_acl_is_enabled() || !alloc_stack)
-+ return;
-+
-+ while (alloc_pop()) ;
-+
-+ if (alloc_stack) {
-+ if ((alloc_stack_size * sizeof (void *)) <= PAGE_SIZE)
-+ kfree(alloc_stack);
-+ else
-+ vfree(alloc_stack);
-+ }
-+
-+ alloc_stack = NULL;
-+ alloc_stack_size = 1;
-+ alloc_stack_next = 1;
-+
-+ return;
-+}
-+
-+int
-+acl_alloc_stack_init(unsigned long size)
-+{
-+ if ((size * sizeof (void *)) <= PAGE_SIZE)
-+ alloc_stack =
-+ (void **) kmalloc(size * sizeof (void *), GFP_KERNEL);
-+ else
-+ alloc_stack = (void **) vmalloc(size * sizeof (void *));
-+
-+ alloc_stack_size = size;
-+
-+ if (!alloc_stack)
-+ return 0;
-+ else
-+ return 1;
-+}
-diff --git a/grsecurity/gracl_cap.c b/grsecurity/gracl_cap.c
-new file mode 100644
-index 0000000..955ddfb
---- /dev/null
-+++ b/grsecurity/gracl_cap.c
-@@ -0,0 +1,101 @@
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/sched.h>
-+#include <linux/gracl.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+extern const char *captab_log[];
-+extern int captab_log_entries;
-+
-+int
-+gr_acl_is_capable(const int cap)
-+{
-+ struct task_struct *task = current;
-+ const struct cred *cred = current_cred();
-+ struct acl_subject_label *curracl;
-+ kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
-+ kernel_cap_t cap_audit = __cap_empty_set;
-+
-+ if (!gr_acl_is_enabled())
-+ return 1;
-+
-+ curracl = task->acl;
-+
-+ cap_drop = curracl->cap_lower;
-+ cap_mask = curracl->cap_mask;
-+ cap_audit = curracl->cap_invert_audit;
-+
-+ while ((curracl = curracl->parent_subject)) {
-+ /* if the cap isn't specified in the current computed mask but is specified in the
-+ current level subject, and is lowered in the current level subject, then add
-+ it to the set of dropped capabilities
-+ otherwise, add the current level subject's mask to the current computed mask
-+ */
-+ if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
-+ cap_raise(cap_mask, cap);
-+ if (cap_raised(curracl->cap_lower, cap))
-+ cap_raise(cap_drop, cap);
-+ if (cap_raised(curracl->cap_invert_audit, cap))
-+ cap_raise(cap_audit, cap);
-+ }
-+ }
-+
-+ if (!cap_raised(cap_drop, cap)) {
-+ if (cap_raised(cap_audit, cap))
-+ gr_log_cap(GR_DO_AUDIT, GR_CAP_ACL_MSG2, task, captab_log[cap]);
-+ return 1;
-+ }
-+
-+ curracl = task->acl;
-+
-+ if ((curracl->mode & (GR_LEARN | GR_INHERITLEARN))
-+ && cap_raised(cred->cap_effective, cap)) {
-+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
-+ task->role->roletype, cred->uid,
-+ cred->gid, task->exec_file ?
-+ gr_to_filename(task->exec_file->f_path.dentry,
-+ task->exec_file->f_path.mnt) : curracl->filename,
-+ curracl->filename, 0UL,
-+ 0UL, "", (unsigned long) cap, &task->signal->saved_ip);
-+ return 1;
-+ }
-+
-+ if ((cap >= 0) && (cap < captab_log_entries) && cap_raised(cred->cap_effective, cap) && !cap_raised(cap_audit, cap))
-+ gr_log_cap(GR_DONT_AUDIT, GR_CAP_ACL_MSG, task, captab_log[cap]);
-+ return 0;
-+}
-+
-+int
-+gr_acl_is_capable_nolog(const int cap)
-+{
-+ struct acl_subject_label *curracl;
-+ kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
-+
-+ if (!gr_acl_is_enabled())
-+ return 1;
-+
-+ curracl = current->acl;
-+
-+ cap_drop = curracl->cap_lower;
-+ cap_mask = curracl->cap_mask;
-+
-+ while ((curracl = curracl->parent_subject)) {
-+ /* if the cap isn't specified in the current computed mask but is specified in the
-+ current level subject, and is lowered in the current level subject, then add
-+ it to the set of dropped capabilities
-+ otherwise, add the current level subject's mask to the current computed mask
-+ */
-+ if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
-+ cap_raise(cap_mask, cap);
-+ if (cap_raised(curracl->cap_lower, cap))
-+ cap_raise(cap_drop, cap);
-+ }
-+ }
-+
-+ if (!cap_raised(cap_drop, cap))
-+ return 1;
-+
-+ return 0;
-+}
-+
-diff --git a/grsecurity/gracl_fs.c b/grsecurity/gracl_fs.c
-new file mode 100644
-index 0000000..5a3ac97
---- /dev/null
-+++ b/grsecurity/gracl_fs.c
-@@ -0,0 +1,431 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/types.h>
-+#include <linux/fs.h>
-+#include <linux/file.h>
-+#include <linux/stat.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+#include <linux/gracl.h>
-+
-+umode_t
-+gr_acl_umask(void)
-+{
-+ if (unlikely(!gr_acl_is_enabled()))
-+ return 0;
-+
-+ return current->role->umask;
-+}
-+
-+__u32
-+gr_acl_handle_hidden_file(const struct dentry * dentry,
-+ const struct vfsmount * mnt)
-+{
-+ __u32 mode;
-+
-+ if (unlikely(!dentry->d_inode))
-+ return GR_FIND;
-+
-+ mode =
-+ gr_search_file(dentry, GR_FIND | GR_AUDIT_FIND | GR_SUPPRESS, mnt);
-+
-+ if (unlikely(mode & GR_FIND && mode & GR_AUDIT_FIND)) {
-+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
-+ return mode;
-+ } else if (unlikely(!(mode & GR_FIND) && !(mode & GR_SUPPRESS))) {
-+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
-+ return 0;
-+ } else if (unlikely(!(mode & GR_FIND)))
-+ return 0;
-+
-+ return GR_FIND;
-+}
-+
-+__u32
-+gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
-+ int acc_mode)
-+{
-+ __u32 reqmode = GR_FIND;
-+ __u32 mode;
-+
-+ if (unlikely(!dentry->d_inode))
-+ return reqmode;
-+
-+ if (acc_mode & MAY_APPEND)
-+ reqmode |= GR_APPEND;
-+ else if (acc_mode & MAY_WRITE)
-+ reqmode |= GR_WRITE;
-+ if ((acc_mode & MAY_READ) && !S_ISDIR(dentry->d_inode->i_mode))
-+ reqmode |= GR_READ;
-+
-+ mode =
-+ gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
-+ mnt);
-+
-+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
-+ gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
-+ reqmode & GR_READ ? " reading" : "",
-+ reqmode & GR_WRITE ? " writing" : reqmode &
-+ GR_APPEND ? " appending" : "");
-+ return reqmode;
-+ } else
-+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
-+ {
-+ gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
-+ reqmode & GR_READ ? " reading" : "",
-+ reqmode & GR_WRITE ? " writing" : reqmode &
-+ GR_APPEND ? " appending" : "");
-+ return 0;
-+ } else if (unlikely((mode & reqmode) != reqmode))
-+ return 0;
-+
-+ return reqmode;
-+}
-+
-+__u32
-+gr_acl_handle_creat(const struct dentry * dentry,
-+ const struct dentry * p_dentry,
-+ const struct vfsmount * p_mnt, int open_flags, int acc_mode,
-+ const int imode)
-+{
-+ __u32 reqmode = GR_WRITE | GR_CREATE;
-+ __u32 mode;
-+
-+ if (acc_mode & MAY_APPEND)
-+ reqmode |= GR_APPEND;
-+ // if a directory was required or the directory already exists, then
-+ // don't count this open as a read
-+ if ((acc_mode & MAY_READ) &&
-+ !((open_flags & O_DIRECTORY) || (dentry->d_inode && S_ISDIR(dentry->d_inode->i_mode))))
-+ reqmode |= GR_READ;
-+ if ((open_flags & O_CREAT) &&
-+ ((imode & S_ISUID) || ((imode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))))
-+ reqmode |= GR_SETID;
-+
-+ mode =
-+ gr_check_create(dentry, p_dentry, p_mnt,
-+ reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
-+
-+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
-+ gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
-+ reqmode & GR_READ ? " reading" : "",
-+ reqmode & GR_WRITE ? " writing" : reqmode &
-+ GR_APPEND ? " appending" : "");
-+ return reqmode;
-+ } else
-+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
-+ {
-+ gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
-+ reqmode & GR_READ ? " reading" : "",
-+ reqmode & GR_WRITE ? " writing" : reqmode &
-+ GR_APPEND ? " appending" : "");
-+ return 0;
-+ } else if (unlikely((mode & reqmode) != reqmode))
-+ return 0;
-+
-+ return reqmode;
-+}
-+
-+__u32
-+gr_acl_handle_access(const struct dentry * dentry, const struct vfsmount * mnt,
-+ const int fmode)
-+{
-+ __u32 mode, reqmode = GR_FIND;
-+
-+ if ((fmode & S_IXOTH) && !S_ISDIR(dentry->d_inode->i_mode))
-+ reqmode |= GR_EXEC;
-+ if (fmode & S_IWOTH)
-+ reqmode |= GR_WRITE;
-+ if (fmode & S_IROTH)
-+ reqmode |= GR_READ;
-+
-+ mode =
-+ gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
-+ mnt);
-+
-+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
-+ gr_log_fs_rbac_mode3(GR_DO_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
-+ reqmode & GR_READ ? " reading" : "",
-+ reqmode & GR_WRITE ? " writing" : "",
-+ reqmode & GR_EXEC ? " executing" : "");
-+ return reqmode;
-+ } else
-+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
-+ {
-+ gr_log_fs_rbac_mode3(GR_DONT_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
-+ reqmode & GR_READ ? " reading" : "",
-+ reqmode & GR_WRITE ? " writing" : "",
-+ reqmode & GR_EXEC ? " executing" : "");
-+ return 0;
-+ } else if (unlikely((mode & reqmode) != reqmode))
-+ return 0;
-+
-+ return reqmode;
-+}
-+
-+static __u32 generic_fs_handler(const struct dentry *dentry, const struct vfsmount *mnt, __u32 reqmode, const char *fmt)
-+{
-+ __u32 mode;
-+
-+ mode = gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS, mnt);
-+
-+ if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
-+ gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, dentry, mnt);
-+ return mode;
-+ } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
-+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, dentry, mnt);
-+ return 0;
-+ } else if (unlikely((mode & (reqmode)) != (reqmode)))
-+ return 0;
-+
-+ return (reqmode);
-+}
-+
-+__u32
-+gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_RMDIR_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_unlink(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_UNLINK_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_truncate(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_TRUNCATE_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_utime(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_ATIME_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_chmod(const struct dentry *dentry, const struct vfsmount *mnt,
-+ umode_t *modeptr)
-+{
-+ umode_t mode;
-+
-+ *modeptr &= ~gr_acl_umask();
-+ mode = *modeptr;
-+
-+ if (unlikely(dentry->d_inode && S_ISSOCK(dentry->d_inode->i_mode)))
-+ return 1;
-+
-+ if (unlikely(dentry->d_inode && !S_ISDIR(dentry->d_inode->i_mode) &&
-+ ((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))))) {
-+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
-+ GR_CHMOD_ACL_MSG);
-+ } else {
-+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHMOD_ACL_MSG);
-+ }
-+}
-+
-+__u32
-+gr_acl_handle_chown(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHOWN_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_setxattr(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_SETXATTR_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_execve(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return generic_fs_handler(dentry, mnt, GR_EXEC, GR_EXEC_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_unix(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return generic_fs_handler(dentry, mnt, GR_READ | GR_WRITE,
-+ GR_UNIXCONNECT_ACL_MSG);
-+}
-+
-+/* hardlinks require at minimum create and link permission,
-+ any additional privilege required is based on the
-+ privilege of the file being linked to
-+*/
-+__u32
-+gr_acl_handle_link(const struct dentry * new_dentry,
-+ const struct dentry * parent_dentry,
-+ const struct vfsmount * parent_mnt,
-+ const struct dentry * old_dentry,
-+ const struct vfsmount * old_mnt, const char *to)
-+{
-+ __u32 mode;
-+ __u32 needmode = GR_CREATE | GR_LINK;
-+ __u32 needaudit = GR_AUDIT_CREATE | GR_AUDIT_LINK;
-+
-+ mode =
-+ gr_check_link(new_dentry, parent_dentry, parent_mnt, old_dentry,
-+ old_mnt);
-+
-+ if (unlikely(((mode & needmode) == needmode) && (mode & needaudit))) {
-+ gr_log_fs_rbac_str(GR_DO_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
-+ return mode;
-+ } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
-+ gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
-+ return 0;
-+ } else if (unlikely((mode & needmode) != needmode))
-+ return 0;
-+
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_symlink(const struct dentry * new_dentry,
-+ const struct dentry * parent_dentry,
-+ const struct vfsmount * parent_mnt, const char *from)
-+{
-+ __u32 needmode = GR_WRITE | GR_CREATE;
-+ __u32 mode;
-+
-+ mode =
-+ gr_check_create(new_dentry, parent_dentry, parent_mnt,
-+ GR_CREATE | GR_AUDIT_CREATE |
-+ GR_WRITE | GR_AUDIT_WRITE | GR_SUPPRESS);
-+
-+ if (unlikely(mode & GR_WRITE && mode & GR_AUDITS)) {
-+ gr_log_fs_str_rbac(GR_DO_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
-+ return mode;
-+ } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
-+ gr_log_fs_str_rbac(GR_DONT_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
-+ return 0;
-+ } else if (unlikely((mode & needmode) != needmode))
-+ return 0;
-+
-+ return (GR_WRITE | GR_CREATE);
-+}
-+
-+static __u32 generic_fs_create_handler(const struct dentry *new_dentry, const struct dentry *parent_dentry, const struct vfsmount *parent_mnt, __u32 reqmode, const char *fmt)
-+{
-+ __u32 mode;
-+
-+ mode = gr_check_create(new_dentry, parent_dentry, parent_mnt, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
-+
-+ if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
-+ gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, new_dentry, parent_mnt);
-+ return mode;
-+ } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
-+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, new_dentry, parent_mnt);
-+ return 0;
-+ } else if (unlikely((mode & (reqmode)) != (reqmode)))
-+ return 0;
-+
-+ return (reqmode);
-+}
-+
-+__u32
-+gr_acl_handle_mknod(const struct dentry * new_dentry,
-+ const struct dentry * parent_dentry,
-+ const struct vfsmount * parent_mnt,
-+ const int mode)
-+{
-+ __u32 reqmode = GR_WRITE | GR_CREATE;
-+ if (unlikely((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))))
-+ reqmode |= GR_SETID;
-+
-+ return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
-+ reqmode, GR_MKNOD_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_mkdir(const struct dentry *new_dentry,
-+ const struct dentry *parent_dentry,
-+ const struct vfsmount *parent_mnt)
-+{
-+ return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
-+ GR_WRITE | GR_CREATE, GR_MKDIR_ACL_MSG);
-+}
-+
-+#define RENAME_CHECK_SUCCESS(old, new) \
-+ (((old & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)) && \
-+ ((new & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)))
-+
-+int
-+gr_acl_handle_rename(struct dentry *new_dentry,
-+ struct dentry *parent_dentry,
-+ const struct vfsmount *parent_mnt,
-+ struct dentry *old_dentry,
-+ struct inode *old_parent_inode,
-+ struct vfsmount *old_mnt, const char *newname)
-+{
-+ __u32 comp1, comp2;
-+ int error = 0;
-+
-+ if (unlikely(!gr_acl_is_enabled()))
-+ return 0;
-+
-+ if (!new_dentry->d_inode) {
-+ comp1 = gr_check_create(new_dentry, parent_dentry, parent_mnt,
-+ GR_READ | GR_WRITE | GR_CREATE | GR_AUDIT_READ |
-+ GR_AUDIT_WRITE | GR_AUDIT_CREATE | GR_SUPPRESS);
-+ comp2 = gr_search_file(old_dentry, GR_READ | GR_WRITE |
-+ GR_DELETE | GR_AUDIT_DELETE |
-+ GR_AUDIT_READ | GR_AUDIT_WRITE |
-+ GR_SUPPRESS, old_mnt);
-+ } else {
-+ comp1 = gr_search_file(new_dentry, GR_READ | GR_WRITE |
-+ GR_CREATE | GR_DELETE |
-+ GR_AUDIT_CREATE | GR_AUDIT_DELETE |
-+ GR_AUDIT_READ | GR_AUDIT_WRITE |
-+ GR_SUPPRESS, parent_mnt);
-+ comp2 =
-+ gr_search_file(old_dentry,
-+ GR_READ | GR_WRITE | GR_AUDIT_READ |
-+ GR_DELETE | GR_AUDIT_DELETE |
-+ GR_AUDIT_WRITE | GR_SUPPRESS, old_mnt);
-+ }
-+
-+ if (RENAME_CHECK_SUCCESS(comp1, comp2) &&
-+ ((comp1 & GR_AUDITS) || (comp2 & GR_AUDITS)))
-+ gr_log_fs_rbac_str(GR_DO_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
-+ else if (!RENAME_CHECK_SUCCESS(comp1, comp2) && !(comp1 & GR_SUPPRESS)
-+ && !(comp2 & GR_SUPPRESS)) {
-+ gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
-+ error = -EACCES;
-+ } else if (unlikely(!RENAME_CHECK_SUCCESS(comp1, comp2)))
-+ error = -EACCES;
-+
-+ return error;
-+}
-+
-+void
-+gr_acl_handle_exit(void)
-+{
-+ u16 id;
-+ char *rolename;
-+
-+ if (unlikely(current->acl_sp_role && gr_acl_is_enabled() &&
-+ !(current->role->roletype & GR_ROLE_PERSIST))) {
-+ id = current->acl_role_id;
-+ rolename = current->role->rolename;
-+ gr_set_acls(1);
-+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLEL_ACL_MSG, rolename, id);
-+ }
-+
-+ gr_put_exec_file(current);
-+ return;
-+}
-+
-+int
-+gr_acl_handle_procpidmem(const struct task_struct *task)
-+{
-+ if (unlikely(!gr_acl_is_enabled()))
-+ return 0;
-+
-+ if (task != current && task->acl->mode & GR_PROTPROCFD)
-+ return -EACCES;
-+
-+ return 0;
-+}
-diff --git a/grsecurity/gracl_ip.c b/grsecurity/gracl_ip.c
-new file mode 100644
-index 0000000..dd925aa
---- /dev/null
-+++ b/grsecurity/gracl_ip.c
-@@ -0,0 +1,385 @@
-+#include <linux/kernel.h>
-+#include <asm/uaccess.h>
-+#include <asm/errno.h>
-+#include <net/sock.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/net.h>
-+#include <linux/in.h>
-+#include <linux/skbuff.h>
-+#include <linux/ip.h>
-+#include <linux/udp.h>
-+#include <linux/smp_lock.h>
-+#include <linux/types.h>
-+#include <linux/sched.h>
-+#include <linux/netdevice.h>
-+#include <linux/inetdevice.h>
-+#include <linux/gracl.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+#define GR_BIND 0x01
-+#define GR_CONNECT 0x02
-+#define GR_INVERT 0x04
-+#define GR_BINDOVERRIDE 0x08
-+#define GR_CONNECTOVERRIDE 0x10
-+#define GR_SOCK_FAMILY 0x20
-+
-+static const char * gr_protocols[IPPROTO_MAX] = {
-+ "ip", "icmp", "igmp", "ggp", "ipencap", "st", "tcp", "cbt",
-+ "egp", "igp", "bbn-rcc", "nvp", "pup", "argus", "emcon", "xnet",
-+ "chaos", "udp", "mux", "dcn", "hmp", "prm", "xns-idp", "trunk-1",
-+ "trunk-2", "leaf-1", "leaf-2", "rdp", "irtp", "iso-tp4", "netblt", "mfe-nsp",
-+ "merit-inp", "sep", "3pc", "idpr", "xtp", "ddp", "idpr-cmtp", "tp++",
-+ "il", "ipv6", "sdrp", "ipv6-route", "ipv6-frag", "idrp", "rsvp", "gre",
-+ "mhrp", "bna", "ipv6-crypt", "ipv6-auth", "i-nlsp", "swipe", "narp", "mobile",
-+ "tlsp", "skip", "ipv6-icmp", "ipv6-nonxt", "ipv6-opts", "unknown:61", "cftp", "unknown:63",
-+ "sat-expak", "kryptolan", "rvd", "ippc", "unknown:68", "sat-mon", "visa", "ipcv",
-+ "cpnx", "cphb", "wsn", "pvp", "br-sat-mon", "sun-nd", "wb-mon", "wb-expak",
-+ "iso-ip", "vmtp", "secure-vmtp", "vines", "ttp", "nfsnet-igp", "dgp", "tcf",
-+ "eigrp", "ospf", "sprite-rpc", "larp", "mtp", "ax.25", "ipip", "micp",
-+ "scc-sp", "etherip", "encap", "unknown:99", "gmtp", "ifmp", "pnni", "pim",
-+ "aris", "scps", "qnx", "a/n", "ipcomp", "snp", "compaq-peer", "ipx-in-ip",
-+ "vrrp", "pgm", "unknown:114", "l2tp", "ddx", "iatp", "stp", "srp",
-+ "uti", "smp", "sm", "ptp", "isis", "fire", "crtp", "crdup",
-+ "sscopmce", "iplt", "sps", "pipe", "sctp", "fc", "unkown:134", "unknown:135",
-+ "unknown:136", "unknown:137", "unknown:138", "unknown:139", "unknown:140", "unknown:141", "unknown:142", "unknown:143",
-+ "unknown:144", "unknown:145", "unknown:146", "unknown:147", "unknown:148", "unknown:149", "unknown:150", "unknown:151",
-+ "unknown:152", "unknown:153", "unknown:154", "unknown:155", "unknown:156", "unknown:157", "unknown:158", "unknown:159",
-+ "unknown:160", "unknown:161", "unknown:162", "unknown:163", "unknown:164", "unknown:165", "unknown:166", "unknown:167",
-+ "unknown:168", "unknown:169", "unknown:170", "unknown:171", "unknown:172", "unknown:173", "unknown:174", "unknown:175",
-+ "unknown:176", "unknown:177", "unknown:178", "unknown:179", "unknown:180", "unknown:181", "unknown:182", "unknown:183",
-+ "unknown:184", "unknown:185", "unknown:186", "unknown:187", "unknown:188", "unknown:189", "unknown:190", "unknown:191",
-+ "unknown:192", "unknown:193", "unknown:194", "unknown:195", "unknown:196", "unknown:197", "unknown:198", "unknown:199",
-+ "unknown:200", "unknown:201", "unknown:202", "unknown:203", "unknown:204", "unknown:205", "unknown:206", "unknown:207",
-+ "unknown:208", "unknown:209", "unknown:210", "unknown:211", "unknown:212", "unknown:213", "unknown:214", "unknown:215",
-+ "unknown:216", "unknown:217", "unknown:218", "unknown:219", "unknown:220", "unknown:221", "unknown:222", "unknown:223",
-+ "unknown:224", "unknown:225", "unknown:226", "unknown:227", "unknown:228", "unknown:229", "unknown:230", "unknown:231",
-+ "unknown:232", "unknown:233", "unknown:234", "unknown:235", "unknown:236", "unknown:237", "unknown:238", "unknown:239",
-+ "unknown:240", "unknown:241", "unknown:242", "unknown:243", "unknown:244", "unknown:245", "unknown:246", "unknown:247",
-+ "unknown:248", "unknown:249", "unknown:250", "unknown:251", "unknown:252", "unknown:253", "unknown:254", "unknown:255",
-+ };
-+
-+static const char * gr_socktypes[SOCK_MAX] = {
-+ "unknown:0", "stream", "dgram", "raw", "rdm", "seqpacket", "unknown:6",
-+ "unknown:7", "unknown:8", "unknown:9", "packet"
-+ };
-+
-+static const char * gr_sockfamilies[AF_MAX+1] = {
-+ "unspec", "unix", "inet", "ax25", "ipx", "appletalk", "netrom", "bridge", "atmpvc", "x25",
-+ "inet6", "rose", "decnet", "netbeui", "security", "key", "netlink", "packet", "ash",
-+ "econet", "atmsvc", "rds", "sna", "irda", "ppox", "wanpipe", "llc", "fam_27", "fam_28",
-+ "tipc", "bluetooth", "iucv", "rxrpc", "isdn", "phonet", "ieee802154"
-+ };
-+
-+const char *
-+gr_proto_to_name(unsigned char proto)
-+{
-+ return gr_protocols[proto];
-+}
-+
-+const char *
-+gr_socktype_to_name(unsigned char type)
-+{
-+ return gr_socktypes[type];
-+}
-+
-+const char *
-+gr_sockfamily_to_name(unsigned char family)
-+{
-+ return gr_sockfamilies[family];
-+}
-+
-+int
-+gr_search_socket(const int domain, const int type, const int protocol)
-+{
-+ struct acl_subject_label *curr;
-+ const struct cred *cred = current_cred();
-+
-+ if (unlikely(!gr_acl_is_enabled()))
-+ goto exit;
-+
-+ if ((domain < 0) || (type < 0) || (protocol < 0) ||
-+ (domain >= AF_MAX) || (type >= SOCK_MAX) || (protocol >= IPPROTO_MAX))
-+ goto exit; // let the kernel handle it
-+
-+ curr = current->acl;
-+
-+ if (curr->sock_families[domain / 32] & (1 << (domain % 32))) {
-+ /* the family is allowed, if this is PF_INET allow it only if
-+ the extra sock type/protocol checks pass */
-+ if (domain == PF_INET)
-+ goto inet_check;
-+ goto exit;
-+ } else {
-+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
-+ __u32 fakeip = 0;
-+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
-+ current->role->roletype, cred->uid,
-+ cred->gid, current->exec_file ?
-+ gr_to_filename(current->exec_file->f_path.dentry,
-+ current->exec_file->f_path.mnt) :
-+ curr->filename, curr->filename,
-+ &fakeip, domain, 0, 0, GR_SOCK_FAMILY,
-+ ¤t->signal->saved_ip);
-+ goto exit;
-+ }
-+ goto exit_fail;
-+ }
-+
-+inet_check:
-+ /* the rest of this checking is for IPv4 only */
-+ if (!curr->ips)
-+ goto exit;
-+
-+ if ((curr->ip_type & (1 << type)) &&
-+ (curr->ip_proto[protocol / 32] & (1 << (protocol % 32))))
-+ goto exit;
-+
-+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
-+ /* we don't place acls on raw sockets , and sometimes
-+ dgram/ip sockets are opened for ioctl and not
-+ bind/connect, so we'll fake a bind learn log */
-+ if (type == SOCK_RAW || type == SOCK_PACKET) {
-+ __u32 fakeip = 0;
-+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
-+ current->role->roletype, cred->uid,
-+ cred->gid, current->exec_file ?
-+ gr_to_filename(current->exec_file->f_path.dentry,
-+ current->exec_file->f_path.mnt) :
-+ curr->filename, curr->filename,
-+ &fakeip, 0, type,
-+ protocol, GR_CONNECT, ¤t->signal->saved_ip);
-+ } else if ((type == SOCK_DGRAM) && (protocol == IPPROTO_IP)) {
-+ __u32 fakeip = 0;
-+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
-+ current->role->roletype, cred->uid,
-+ cred->gid, current->exec_file ?
-+ gr_to_filename(current->exec_file->f_path.dentry,
-+ current->exec_file->f_path.mnt) :
-+ curr->filename, curr->filename,
-+ &fakeip, 0, type,
-+ protocol, GR_BIND, ¤t->signal->saved_ip);
-+ }
-+ /* we'll log when they use connect or bind */
-+ goto exit;
-+ }
-+
-+exit_fail:
-+ if (domain == PF_INET)
-+ gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(domain),
-+ gr_socktype_to_name(type), gr_proto_to_name(protocol));
-+ else
-+ gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(domain),
-+ gr_socktype_to_name(type), protocol);
-+
-+ return 0;
-+exit:
-+ return 1;
-+}
-+
-+int check_ip_policy(struct acl_ip_label *ip, __u32 ip_addr, __u16 ip_port, __u8 protocol, const int mode, const int type, __u32 our_addr, __u32 our_netmask)
-+{
-+ if ((ip->mode & mode) &&
-+ (ip_port >= ip->low) &&
-+ (ip_port <= ip->high) &&
-+ ((ntohl(ip_addr) & our_netmask) ==
-+ (ntohl(our_addr) & our_netmask))
-+ && (ip->proto[protocol / 32] & (1 << (protocol % 32)))
-+ && (ip->type & (1 << type))) {
-+ if (ip->mode & GR_INVERT)
-+ return 2; // specifically denied
-+ else
-+ return 1; // allowed
-+ }
-+
-+ return 0; // not specifically allowed, may continue parsing
-+}
-+
-+static int
-+gr_search_connectbind(const int full_mode, struct sock *sk,
-+ struct sockaddr_in *addr, const int type)
-+{
-+ char iface[IFNAMSIZ] = {0};
-+ struct acl_subject_label *curr;
-+ struct acl_ip_label *ip;
-+ struct inet_sock *isk;
-+ struct net_device *dev;
-+ struct in_device *idev;
-+ unsigned long i;
-+ int ret;
-+ int mode = full_mode & (GR_BIND | GR_CONNECT);
-+ __u32 ip_addr = 0;
-+ __u32 our_addr;
-+ __u32 our_netmask;
-+ char *p;
-+ __u16 ip_port = 0;
-+ const struct cred *cred = current_cred();
-+
-+ if (unlikely(!gr_acl_is_enabled() || sk->sk_family != PF_INET))
-+ return 0;
-+
-+ curr = current->acl;
-+ isk = inet_sk(sk);
-+
-+ /* INADDR_ANY overriding for binds, inaddr_any_override is already in network order */
-+ if ((full_mode & GR_BINDOVERRIDE) && addr->sin_addr.s_addr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0)
-+ addr->sin_addr.s_addr = curr->inaddr_any_override;
-+ if ((full_mode & GR_CONNECT) && isk->saddr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0) {
-+ struct sockaddr_in saddr;
-+ int err;
-+
-+ saddr.sin_family = AF_INET;
-+ saddr.sin_addr.s_addr = curr->inaddr_any_override;
-+ saddr.sin_port = isk->sport;
-+
-+ err = security_socket_bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
-+ if (err)
-+ return err;
-+
-+ err = sk->sk_socket->ops->bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
-+ if (err)
-+ return err;
-+ }
-+
-+ if (!curr->ips)
-+ return 0;
-+
-+ ip_addr = addr->sin_addr.s_addr;
-+ ip_port = ntohs(addr->sin_port);
-+
-+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
-+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
-+ current->role->roletype, cred->uid,
-+ cred->gid, current->exec_file ?
-+ gr_to_filename(current->exec_file->f_path.dentry,
-+ current->exec_file->f_path.mnt) :
-+ curr->filename, curr->filename,
-+ &ip_addr, ip_port, type,
-+ sk->sk_protocol, mode, ¤t->signal->saved_ip);
-+ return 0;
-+ }
-+
-+ for (i = 0; i < curr->ip_num; i++) {
-+ ip = *(curr->ips + i);
-+ if (ip->iface != NULL) {
-+ strncpy(iface, ip->iface, IFNAMSIZ - 1);
-+ p = strchr(iface, ':');
-+ if (p != NULL)
-+ *p = '\0';
-+ dev = dev_get_by_name(sock_net(sk), iface);
-+ if (dev == NULL)
-+ continue;
-+ idev = in_dev_get(dev);
-+ if (idev == NULL) {
-+ dev_put(dev);
-+ continue;
-+ }
-+ rcu_read_lock();
-+ for_ifa(idev) {
-+ if (!strcmp(ip->iface, ifa->ifa_label)) {
-+ our_addr = ifa->ifa_address;
-+ our_netmask = 0xffffffff;
-+ ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
-+ if (ret == 1) {
-+ rcu_read_unlock();
-+ in_dev_put(idev);
-+ dev_put(dev);
-+ return 0;
-+ } else if (ret == 2) {
-+ rcu_read_unlock();
-+ in_dev_put(idev);
-+ dev_put(dev);
-+ goto denied;
-+ }
-+ }
-+ } endfor_ifa(idev);
-+ rcu_read_unlock();
-+ in_dev_put(idev);
-+ dev_put(dev);
-+ } else {
-+ our_addr = ip->addr;
-+ our_netmask = ip->netmask;
-+ ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
-+ if (ret == 1)
-+ return 0;
-+ else if (ret == 2)
-+ goto denied;
-+ }
-+ }
-+
-+denied:
-+ if (mode == GR_BIND)
-+ gr_log_int5_str2(GR_DONT_AUDIT, GR_BIND_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
-+ else if (mode == GR_CONNECT)
-+ gr_log_int5_str2(GR_DONT_AUDIT, GR_CONNECT_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
-+
-+ return -EACCES;
-+}
-+
-+int
-+gr_search_connect(struct socket *sock, struct sockaddr_in *addr)
-+{
-+ /* always allow disconnection of dgram sockets with connect */
-+ if (addr->sin_family == AF_UNSPEC)
-+ return 0;
-+ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sock->sk, addr, sock->type);
-+}
-+
-+int
-+gr_search_bind(struct socket *sock, struct sockaddr_in *addr)
-+{
-+ return gr_search_connectbind(GR_BIND | GR_BINDOVERRIDE, sock->sk, addr, sock->type);
-+}
-+
-+int gr_search_listen(struct socket *sock)
-+{
-+ struct sock *sk = sock->sk;
-+ struct sockaddr_in addr;
-+
-+ addr.sin_addr.s_addr = inet_sk(sk)->saddr;
-+ addr.sin_port = inet_sk(sk)->sport;
-+
-+ return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
-+}
-+
-+int gr_search_accept(struct socket *sock)
-+{
-+ struct sock *sk = sock->sk;
-+ struct sockaddr_in addr;
-+
-+ addr.sin_addr.s_addr = inet_sk(sk)->saddr;
-+ addr.sin_port = inet_sk(sk)->sport;
-+
-+ return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
-+}
-+
-+int
-+gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr)
-+{
-+ if (addr)
-+ return gr_search_connectbind(GR_CONNECT, sk, addr, SOCK_DGRAM);
-+ else {
-+ struct sockaddr_in sin;
-+ const struct inet_sock *inet = inet_sk(sk);
-+
-+ sin.sin_addr.s_addr = inet->daddr;
-+ sin.sin_port = inet->dport;
-+
-+ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
-+ }
-+}
-+
-+int
-+gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb)
-+{
-+ struct sockaddr_in sin;
-+
-+ if (unlikely(skb->len < sizeof (struct udphdr)))
-+ return 0; // skip this packet
-+
-+ sin.sin_addr.s_addr = ip_hdr(skb)->saddr;
-+ sin.sin_port = udp_hdr(skb)->source;
-+
-+ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
-+}
-diff --git a/grsecurity/gracl_learn.c b/grsecurity/gracl_learn.c
-new file mode 100644
-index 0000000..34bdd46
---- /dev/null
-+++ b/grsecurity/gracl_learn.c
-@@ -0,0 +1,208 @@
-+#include <linux/kernel.h>
-+#include <linux/mm.h>
-+#include <linux/sched.h>
-+#include <linux/poll.h>
-+#include <linux/smp_lock.h>
-+#include <linux/string.h>
-+#include <linux/file.h>
-+#include <linux/types.h>
-+#include <linux/vmalloc.h>
-+#include <linux/grinternal.h>
-+
-+extern ssize_t write_grsec_handler(struct file * file, const char __user * buf,
-+ size_t count, loff_t *ppos);
-+extern int gr_acl_is_enabled(void);
-+
-+static DECLARE_WAIT_QUEUE_HEAD(learn_wait);
-+static int gr_learn_attached;
-+
-+/* use a 512k buffer */
-+#define LEARN_BUFFER_SIZE (512 * 1024)
-+
-+static DEFINE_SPINLOCK(gr_learn_lock);
-+static DEFINE_MUTEX(gr_learn_user_mutex);
-+
-+/* we need to maintain two buffers, so that the kernel context of grlearn
-+ uses a semaphore around the userspace copying, and the other kernel contexts
-+ use a spinlock when copying into the buffer, since they cannot sleep
-+*/
-+static char *learn_buffer;
-+static char *learn_buffer_user;
-+static int learn_buffer_len;
-+static int learn_buffer_user_len;
-+
-+static ssize_t
-+read_learn(struct file *file, char __user * buf, size_t count, loff_t * ppos)
-+{
-+ DECLARE_WAITQUEUE(wait, current);
-+ ssize_t retval = 0;
-+
-+ add_wait_queue(&learn_wait, &wait);
-+ set_current_state(TASK_INTERRUPTIBLE);
-+ do {
-+ mutex_lock(&gr_learn_user_mutex);
-+ spin_lock(&gr_learn_lock);
-+ if (learn_buffer_len)
-+ break;
-+ spin_unlock(&gr_learn_lock);
-+ mutex_unlock(&gr_learn_user_mutex);
-+ if (file->f_flags & O_NONBLOCK) {
-+ retval = -EAGAIN;
-+ goto out;
-+ }
-+ if (signal_pending(current)) {
-+ retval = -ERESTARTSYS;
-+ goto out;
-+ }
-+
-+ schedule();
-+ } while (1);
-+
-+ memcpy(learn_buffer_user, learn_buffer, learn_buffer_len);
-+ learn_buffer_user_len = learn_buffer_len;
-+ retval = learn_buffer_len;
-+ learn_buffer_len = 0;
-+
-+ spin_unlock(&gr_learn_lock);
-+
-+ if (copy_to_user(buf, learn_buffer_user, learn_buffer_user_len))
-+ retval = -EFAULT;
-+
-+ mutex_unlock(&gr_learn_user_mutex);
-+out:
-+ set_current_state(TASK_RUNNING);
-+ remove_wait_queue(&learn_wait, &wait);
-+ return retval;
-+}
-+
-+static unsigned int
-+poll_learn(struct file * file, poll_table * wait)
-+{
-+ poll_wait(file, &learn_wait, wait);
-+
-+ if (learn_buffer_len)
-+ return (POLLIN | POLLRDNORM);
-+
-+ return 0;
-+}
-+
-+void
-+gr_clear_learn_entries(void)
-+{
-+ char *tmp;
-+
-+ mutex_lock(&gr_learn_user_mutex);
-+ spin_lock(&gr_learn_lock);
-+ tmp = learn_buffer;
-+ learn_buffer = NULL;
-+ spin_unlock(&gr_learn_lock);
-+ if (tmp)
-+ vfree(tmp);
-+ if (learn_buffer_user != NULL) {
-+ vfree(learn_buffer_user);
-+ learn_buffer_user = NULL;
-+ }
-+ learn_buffer_len = 0;
-+ mutex_unlock(&gr_learn_user_mutex);
-+
-+ return;
-+}
-+
-+void
-+gr_add_learn_entry(const char *fmt, ...)
-+{
-+ va_list args;
-+ unsigned int len;
-+
-+ if (!gr_learn_attached)
-+ return;
-+
-+ spin_lock(&gr_learn_lock);
-+
-+ /* leave a gap at the end so we know when it's "full" but don't have to
-+ compute the exact length of the string we're trying to append
-+ */
-+ if (learn_buffer_len > LEARN_BUFFER_SIZE - 16384) {
-+ spin_unlock(&gr_learn_lock);
-+ wake_up_interruptible(&learn_wait);
-+ return;
-+ }
-+ if (learn_buffer == NULL) {
-+ spin_unlock(&gr_learn_lock);
-+ return;
-+ }
-+
-+ va_start(args, fmt);
-+ len = vsnprintf(learn_buffer + learn_buffer_len, LEARN_BUFFER_SIZE - learn_buffer_len, fmt, args);
-+ va_end(args);
-+
-+ learn_buffer_len += len + 1;
-+
-+ spin_unlock(&gr_learn_lock);
-+ wake_up_interruptible(&learn_wait);
-+
-+ return;
-+}
-+
-+static int
-+open_learn(struct inode *inode, struct file *file)
-+{
-+ if (file->f_mode & FMODE_READ && gr_learn_attached)
-+ return -EBUSY;
-+ if (file->f_mode & FMODE_READ) {
-+ int retval = 0;
-+ mutex_lock(&gr_learn_user_mutex);
-+ if (learn_buffer == NULL)
-+ learn_buffer = vmalloc(LEARN_BUFFER_SIZE);
-+ if (learn_buffer_user == NULL)
-+ learn_buffer_user = vmalloc(LEARN_BUFFER_SIZE);
-+ if (learn_buffer == NULL) {
-+ retval = -ENOMEM;
-+ goto out_error;
-+ }
-+ if (learn_buffer_user == NULL) {
-+ retval = -ENOMEM;
-+ goto out_error;
-+ }
-+ learn_buffer_len = 0;
-+ learn_buffer_user_len = 0;
-+ gr_learn_attached = 1;
-+out_error:
-+ mutex_unlock(&gr_learn_user_mutex);
-+ return retval;
-+ }
-+ return 0;
-+}
-+
-+static int
-+close_learn(struct inode *inode, struct file *file)
-+{
-+ if (file->f_mode & FMODE_READ) {
-+ char *tmp = NULL;
-+ mutex_lock(&gr_learn_user_mutex);
-+ spin_lock(&gr_learn_lock);
-+ tmp = learn_buffer;
-+ learn_buffer = NULL;
-+ spin_unlock(&gr_learn_lock);
-+ if (tmp)
-+ vfree(tmp);
-+ if (learn_buffer_user != NULL) {
-+ vfree(learn_buffer_user);
-+ learn_buffer_user = NULL;
-+ }
-+ learn_buffer_len = 0;
-+ learn_buffer_user_len = 0;
-+ gr_learn_attached = 0;
-+ mutex_unlock(&gr_learn_user_mutex);
-+ }
-+
-+ return 0;
-+}
-+
-+const struct file_operations grsec_fops = {
-+ .read = read_learn,
-+ .write = write_grsec_handler,
-+ .open = open_learn,
-+ .release = close_learn,
-+ .poll = poll_learn,
-+};
-diff --git a/grsecurity/gracl_res.c b/grsecurity/gracl_res.c
-new file mode 100644
-index 0000000..70b2179
---- /dev/null
-+++ b/grsecurity/gracl_res.c
-@@ -0,0 +1,67 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/gracl.h>
-+#include <linux/grinternal.h>
-+
-+static const char *restab_log[] = {
-+ [RLIMIT_CPU] = "RLIMIT_CPU",
-+ [RLIMIT_FSIZE] = "RLIMIT_FSIZE",
-+ [RLIMIT_DATA] = "RLIMIT_DATA",
-+ [RLIMIT_STACK] = "RLIMIT_STACK",
-+ [RLIMIT_CORE] = "RLIMIT_CORE",
-+ [RLIMIT_RSS] = "RLIMIT_RSS",
-+ [RLIMIT_NPROC] = "RLIMIT_NPROC",
-+ [RLIMIT_NOFILE] = "RLIMIT_NOFILE",
-+ [RLIMIT_MEMLOCK] = "RLIMIT_MEMLOCK",
-+ [RLIMIT_AS] = "RLIMIT_AS",
-+ [RLIMIT_LOCKS] = "RLIMIT_LOCKS",
-+ [RLIMIT_SIGPENDING] = "RLIMIT_SIGPENDING",
-+ [RLIMIT_MSGQUEUE] = "RLIMIT_MSGQUEUE",
-+ [RLIMIT_NICE] = "RLIMIT_NICE",
-+ [RLIMIT_RTPRIO] = "RLIMIT_RTPRIO",
-+ [RLIMIT_RTTIME] = "RLIMIT_RTTIME",
-+ [GR_CRASH_RES] = "RLIMIT_CRASH"
-+};
-+
-+void
-+gr_log_resource(const struct task_struct *task,
-+ const int res, const unsigned long wanted, const int gt)
-+{
-+ const struct cred *cred;
-+ unsigned long rlim;
-+
-+ if (!gr_acl_is_enabled() && !grsec_resource_logging)
-+ return;
-+
-+ // not yet supported resource
-+ if (unlikely(!restab_log[res]))
-+ return;
-+
-+ if (res == RLIMIT_CPU || res == RLIMIT_RTTIME)
-+ rlim = task->signal->rlim[res].rlim_max;
-+ else
-+ rlim = task->signal->rlim[res].rlim_cur;
-+ if (likely((rlim == RLIM_INFINITY) || (gt && wanted <= rlim) || (!gt && wanted < rlim)))
-+ return;
-+
-+ rcu_read_lock();
-+ cred = __task_cred(task);
-+
-+ if (res == RLIMIT_NPROC &&
-+ (cap_raised(cred->cap_effective, CAP_SYS_ADMIN) ||
-+ cap_raised(cred->cap_effective, CAP_SYS_RESOURCE)))
-+ goto out_rcu_unlock;
-+ else if (res == RLIMIT_MEMLOCK &&
-+ cap_raised(cred->cap_effective, CAP_IPC_LOCK))
-+ goto out_rcu_unlock;
-+ else if (res == RLIMIT_NICE && cap_raised(cred->cap_effective, CAP_SYS_NICE))
-+ goto out_rcu_unlock;
-+ rcu_read_unlock();
-+
-+ gr_log_res_ulong2_str(GR_DONT_AUDIT, GR_RESOURCE_MSG, task, wanted, restab_log[res], rlim);
-+
-+ return;
-+out_rcu_unlock:
-+ rcu_read_unlock();
-+ return;
-+}
-diff --git a/grsecurity/gracl_segv.c b/grsecurity/gracl_segv.c
-new file mode 100644
-index 0000000..1d1b734
---- /dev/null
-+++ b/grsecurity/gracl_segv.c
-@@ -0,0 +1,284 @@
-+#include <linux/kernel.h>
-+#include <linux/mm.h>
-+#include <asm/uaccess.h>
-+#include <asm/errno.h>
-+#include <asm/mman.h>
-+#include <net/sock.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/net.h>
-+#include <linux/in.h>
-+#include <linux/smp_lock.h>
-+#include <linux/slab.h>
-+#include <linux/types.h>
-+#include <linux/sched.h>
-+#include <linux/timer.h>
-+#include <linux/gracl.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+static struct crash_uid *uid_set;
-+static unsigned short uid_used;
-+static DEFINE_SPINLOCK(gr_uid_lock);
-+extern rwlock_t gr_inode_lock;
-+extern struct acl_subject_label *
-+ lookup_acl_subj_label(const ino_t inode, const dev_t dev,
-+ struct acl_role_label *role);
-+extern int gr_fake_force_sig(int sig, struct task_struct *t);
-+
-+int
-+gr_init_uidset(void)
-+{
-+ uid_set =
-+ kmalloc(GR_UIDTABLE_MAX * sizeof (struct crash_uid), GFP_KERNEL);
-+ uid_used = 0;
-+
-+ return uid_set ? 1 : 0;
-+}
-+
-+void
-+gr_free_uidset(void)
-+{
-+ if (uid_set)
-+ kfree(uid_set);
-+
-+ return;
-+}
-+
-+int
-+gr_find_uid(const uid_t uid)
-+{
-+ struct crash_uid *tmp = uid_set;
-+ uid_t buid;
-+ int low = 0, high = uid_used - 1, mid;
-+
-+ while (high >= low) {
-+ mid = (low + high) >> 1;
-+ buid = tmp[mid].uid;
-+ if (buid == uid)
-+ return mid;
-+ if (buid > uid)
-+ high = mid - 1;
-+ if (buid < uid)
-+ low = mid + 1;
-+ }
-+
-+ return -1;
-+}
-+
-+static __inline__ void
-+gr_insertsort(void)
-+{
-+ unsigned short i, j;
-+ struct crash_uid index;
-+
-+ for (i = 1; i < uid_used; i++) {
-+ index = uid_set[i];
-+ j = i;
-+ while ((j > 0) && uid_set[j - 1].uid > index.uid) {
-+ uid_set[j] = uid_set[j - 1];
-+ j--;
-+ }
-+ uid_set[j] = index;
-+ }
-+
-+ return;
-+}
-+
-+static __inline__ void
-+gr_insert_uid(const uid_t uid, const unsigned long expires)
-+{
-+ int loc;
-+
-+ if (uid_used == GR_UIDTABLE_MAX)
-+ return;
-+
-+ loc = gr_find_uid(uid);
-+
-+ if (loc >= 0) {
-+ uid_set[loc].expires = expires;
-+ return;
-+ }
-+
-+ uid_set[uid_used].uid = uid;
-+ uid_set[uid_used].expires = expires;
-+ uid_used++;
-+
-+ gr_insertsort();
-+
-+ return;
-+}
-+
-+void
-+gr_remove_uid(const unsigned short loc)
-+{
-+ unsigned short i;
-+
-+ for (i = loc + 1; i < uid_used; i++)
-+ uid_set[i - 1] = uid_set[i];
-+
-+ uid_used--;
-+
-+ return;
-+}
-+
-+int
-+gr_check_crash_uid(const uid_t uid)
-+{
-+ int loc;
-+ int ret = 0;
-+
-+ if (unlikely(!gr_acl_is_enabled()))
-+ return 0;
-+
-+ spin_lock(&gr_uid_lock);
-+ loc = gr_find_uid(uid);
-+
-+ if (loc < 0)
-+ goto out_unlock;
-+
-+ if (time_before_eq(uid_set[loc].expires, get_seconds()))
-+ gr_remove_uid(loc);
-+ else
-+ ret = 1;
-+
-+out_unlock:
-+ spin_unlock(&gr_uid_lock);
-+ return ret;
-+}
-+
-+static __inline__ int
-+proc_is_setxid(const struct cred *cred)
-+{
-+ if (cred->uid != cred->euid || cred->uid != cred->suid ||
-+ cred->uid != cred->fsuid)
-+ return 1;
-+ if (cred->gid != cred->egid || cred->gid != cred->sgid ||
-+ cred->gid != cred->fsgid)
-+ return 1;
-+
-+ return 0;
-+}
-+
-+void
-+gr_handle_crash(struct task_struct *task, const int sig)
-+{
-+ struct acl_subject_label *curr;
-+ struct task_struct *tsk, *tsk2;
-+ const struct cred *cred;
-+ const struct cred *cred2;
-+
-+ if (sig != SIGSEGV && sig != SIGKILL && sig != SIGBUS && sig != SIGILL)
-+ return;
-+
-+ if (unlikely(!gr_acl_is_enabled()))
-+ return;
-+
-+ curr = task->acl;
-+
-+ if (!(curr->resmask & (1 << GR_CRASH_RES)))
-+ return;
-+
-+ if (time_before_eq(curr->expires, get_seconds())) {
-+ curr->expires = 0;
-+ curr->crashes = 0;
-+ }
-+
-+ curr->crashes++;
-+
-+ if (!curr->expires)
-+ curr->expires = get_seconds() + curr->res[GR_CRASH_RES].rlim_max;
-+
-+ if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
-+ time_after(curr->expires, get_seconds())) {
-+ rcu_read_lock();
-+ cred = __task_cred(task);
-+ if (cred->uid && proc_is_setxid(cred)) {
-+ gr_log_crash1(GR_DONT_AUDIT, GR_SEGVSTART_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
-+ spin_lock(&gr_uid_lock);
-+ gr_insert_uid(cred->uid, curr->expires);
-+ spin_unlock(&gr_uid_lock);
-+ curr->expires = 0;
-+ curr->crashes = 0;
-+ read_lock(&tasklist_lock);
-+ do_each_thread(tsk2, tsk) {
-+ cred2 = __task_cred(tsk);
-+ if (tsk != task && cred2->uid == cred->uid)
-+ gr_fake_force_sig(SIGKILL, tsk);
-+ } while_each_thread(tsk2, tsk);
-+ read_unlock(&tasklist_lock);
-+ } else {
-+ gr_log_crash2(GR_DONT_AUDIT, GR_SEGVNOSUID_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
-+ read_lock(&tasklist_lock);
-+ read_lock(&grsec_exec_file_lock);
-+ do_each_thread(tsk2, tsk) {
-+ if (likely(tsk != task)) {
-+ // if this thread has the same subject as the one that triggered
-+ // RES_CRASH and it's the same binary, kill it
-+ if (tsk->acl == task->acl && tsk->exec_file == task->exec_file)
-+ gr_fake_force_sig(SIGKILL, tsk);
-+ }
-+ } while_each_thread(tsk2, tsk);
-+ read_unlock(&grsec_exec_file_lock);
-+ read_unlock(&tasklist_lock);
-+ }
-+ rcu_read_unlock();
-+ }
-+
-+ return;
-+}
-+
-+int
-+gr_check_crash_exec(const struct file *filp)
-+{
-+ struct acl_subject_label *curr;
-+
-+ if (unlikely(!gr_acl_is_enabled()))
-+ return 0;
-+
-+ read_lock(&gr_inode_lock);
-+ curr = lookup_acl_subj_label(filp->f_path.dentry->d_inode->i_ino,
-+ filp->f_path.dentry->d_inode->i_sb->s_dev,
-+ current->role);
-+ read_unlock(&gr_inode_lock);
-+
-+ if (!curr || !(curr->resmask & (1 << GR_CRASH_RES)) ||
-+ (!curr->crashes && !curr->expires))
-+ return 0;
-+
-+ if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
-+ time_after(curr->expires, get_seconds()))
-+ return 1;
-+ else if (time_before_eq(curr->expires, get_seconds())) {
-+ curr->crashes = 0;
-+ curr->expires = 0;
-+ }
-+
-+ return 0;
-+}
-+
-+void
-+gr_handle_alertkill(struct task_struct *task)
-+{
-+ struct acl_subject_label *curracl;
-+ __u32 curr_ip;
-+ struct task_struct *p, *p2;
-+
-+ if (unlikely(!gr_acl_is_enabled()))
-+ return;
-+
-+ curracl = task->acl;
-+ curr_ip = task->signal->curr_ip;
-+
-+ if ((curracl->mode & GR_KILLIPPROC) && curr_ip) {
-+ read_lock(&tasklist_lock);
-+ do_each_thread(p2, p) {
-+ if (p->signal->curr_ip == curr_ip)
-+ gr_fake_force_sig(SIGKILL, p);
-+ } while_each_thread(p2, p);
-+ read_unlock(&tasklist_lock);
-+ } else if (curracl->mode & GR_KILLPROC)
-+ gr_fake_force_sig(SIGKILL, task);
-+
-+ return;
-+}
-diff --git a/grsecurity/gracl_shm.c b/grsecurity/gracl_shm.c
-new file mode 100644
-index 0000000..9d83a69
---- /dev/null
-+++ b/grsecurity/gracl_shm.c
-@@ -0,0 +1,40 @@
-+#include <linux/kernel.h>
-+#include <linux/mm.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/ipc.h>
-+#include <linux/gracl.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+int
-+gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
-+ const time_t shm_createtime, const uid_t cuid, const int shmid)
-+{
-+ struct task_struct *task;
-+
-+ if (!gr_acl_is_enabled())
-+ return 1;
-+
-+ rcu_read_lock();
-+ read_lock(&tasklist_lock);
-+
-+ task = find_task_by_vpid(shm_cprid);
-+
-+ if (unlikely(!task))
-+ task = find_task_by_vpid(shm_lapid);
-+
-+ if (unlikely(task && (time_before_eq((unsigned long)task->start_time.tv_sec, (unsigned long)shm_createtime) ||
-+ (task->pid == shm_lapid)) &&
-+ (task->acl->mode & GR_PROTSHM) &&
-+ (task->acl != current->acl))) {
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+ gr_log_int3(GR_DONT_AUDIT, GR_SHMAT_ACL_MSG, cuid, shm_cprid, shmid);
-+ return 0;
-+ }
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+
-+ return 1;
-+}
-diff --git a/grsecurity/grsec_chdir.c b/grsecurity/grsec_chdir.c
-new file mode 100644
-index 0000000..bc0be01
---- /dev/null
-+++ b/grsecurity/grsec_chdir.c
-@@ -0,0 +1,19 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/fs.h>
-+#include <linux/file.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+void
-+gr_log_chdir(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
-+ if ((grsec_enable_chdir && grsec_enable_group &&
-+ in_group_p(grsec_audit_gid)) || (grsec_enable_chdir &&
-+ !grsec_enable_group)) {
-+ gr_log_fs_generic(GR_DO_AUDIT, GR_CHDIR_AUDIT_MSG, dentry, mnt);
-+ }
-+#endif
-+ return;
-+}
-diff --git a/grsecurity/grsec_chroot.c b/grsecurity/grsec_chroot.c
-new file mode 100644
-index 0000000..80a3a4b
---- /dev/null
-+++ b/grsecurity/grsec_chroot.c
-@@ -0,0 +1,375 @@
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/mount.h>
-+#include <linux/types.h>
-+#include <linux/pid_namespace.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+void gr_set_chroot_entries(struct task_struct *task, struct path *path)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+ if (task->pid > 1 && path->dentry != init_task.fs->root.dentry &&
-+ path->dentry != task->nsproxy->mnt_ns->root->mnt_root)
-+ task->gr_is_chrooted = 1;
-+ else
-+ task->gr_is_chrooted = 0;
-+
-+ task->gr_chroot_dentry = path->dentry;
-+#endif
-+ return;
-+}
-+
-+void gr_clear_chroot_entries(struct task_struct *task)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+ task->gr_is_chrooted = 0;
-+ task->gr_chroot_dentry = NULL;
-+#endif
-+ return;
-+}
-+
-+int
-+gr_handle_chroot_unix(const pid_t pid)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
-+ struct task_struct *p;
-+
-+ if (unlikely(!grsec_enable_chroot_unix))
-+ return 1;
-+
-+ if (likely(!proc_is_chrooted(current)))
-+ return 1;
-+
-+ rcu_read_lock();
-+ read_lock(&tasklist_lock);
-+
-+ p = find_task_by_vpid_unrestricted(pid);
-+ if (unlikely(p && !have_same_root(current, p))) {
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+ gr_log_noargs(GR_DONT_AUDIT, GR_UNIX_CHROOT_MSG);
-+ return 0;
-+ }
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+#endif
-+ return 1;
-+}
-+
-+int
-+gr_handle_chroot_nice(void)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
-+ if (grsec_enable_chroot_nice && proc_is_chrooted(current)) {
-+ gr_log_noargs(GR_DONT_AUDIT, GR_NICE_CHROOT_MSG);
-+ return -EPERM;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_handle_chroot_setpriority(struct task_struct *p, const int niceval)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
-+ if (grsec_enable_chroot_nice && (niceval < task_nice(p))
-+ && proc_is_chrooted(current)) {
-+ gr_log_str_int(GR_DONT_AUDIT, GR_PRIORITY_CHROOT_MSG, p->comm, p->pid);
-+ return -EACCES;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_handle_chroot_fowner(struct pid *pid, enum pid_type type)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
-+ struct task_struct *p;
-+ int ret = 0;
-+ if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || !pid)
-+ return ret;
-+
-+ read_lock(&tasklist_lock);
-+ do_each_pid_task(pid, type, p) {
-+ if (!have_same_root(current, p)) {
-+ ret = 1;
-+ goto out;
-+ }
-+ } while_each_pid_task(pid, type, p);
-+out:
-+ read_unlock(&tasklist_lock);
-+ return ret;
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_pid_is_chrooted(struct task_struct *p)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
-+ if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || p == NULL)
-+ return 0;
-+
-+ if ((p->exit_state & (EXIT_ZOMBIE | EXIT_DEAD)) ||
-+ !have_same_root(current, p)) {
-+ return 1;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+EXPORT_SYMBOL(gr_pid_is_chrooted);
-+
-+#if defined(CONFIG_GRKERNSEC_CHROOT_DOUBLE) || defined(CONFIG_GRKERNSEC_CHROOT_FCHDIR)
-+int gr_is_outside_chroot(const struct dentry *u_dentry, const struct vfsmount *u_mnt)
-+{
-+ struct dentry *dentry = (struct dentry *)u_dentry;
-+ struct vfsmount *mnt = (struct vfsmount *)u_mnt;
-+ struct dentry *realroot;
-+ struct vfsmount *realrootmnt;
-+ struct dentry *currentroot;
-+ struct vfsmount *currentmnt;
-+ struct task_struct *reaper = &init_task;
-+ int ret = 1;
-+
-+ read_lock(&reaper->fs->lock);
-+ realrootmnt = mntget(reaper->fs->root.mnt);
-+ realroot = dget(reaper->fs->root.dentry);
-+ read_unlock(&reaper->fs->lock);
-+
-+ read_lock(¤t->fs->lock);
-+ currentmnt = mntget(current->fs->root.mnt);
-+ currentroot = dget(current->fs->root.dentry);
-+ read_unlock(¤t->fs->lock);
-+
-+ spin_lock(&dcache_lock);
-+ for (;;) {
-+ if (unlikely((dentry == realroot && mnt == realrootmnt)
-+ || (dentry == currentroot && mnt == currentmnt)))
-+ break;
-+ if (unlikely(dentry == mnt->mnt_root || IS_ROOT(dentry))) {
-+ if (mnt->mnt_parent == mnt)
-+ break;
-+ dentry = mnt->mnt_mountpoint;
-+ mnt = mnt->mnt_parent;
-+ continue;
-+ }
-+ dentry = dentry->d_parent;
-+ }
-+ spin_unlock(&dcache_lock);
-+
-+ dput(currentroot);
-+ mntput(currentmnt);
-+
-+ /* access is outside of chroot */
-+ if (dentry == realroot && mnt == realrootmnt)
-+ ret = 0;
-+
-+ dput(realroot);
-+ mntput(realrootmnt);
-+ return ret;
-+}
-+#endif
-+
-+int
-+gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
-+ if (!grsec_enable_chroot_fchdir)
-+ return 1;
-+
-+ if (!proc_is_chrooted(current))
-+ return 1;
-+ else if (!gr_is_outside_chroot(u_dentry, u_mnt)) {
-+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_FCHDIR_MSG, u_dentry, u_mnt);
-+ return 0;
-+ }
-+#endif
-+ return 1;
-+}
-+
-+int
-+gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
-+ const time_t shm_createtime)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
-+ struct task_struct *p;
-+ time_t starttime;
-+
-+ if (unlikely(!grsec_enable_chroot_shmat))
-+ return 1;
-+
-+ if (likely(!proc_is_chrooted(current)))
-+ return 1;
-+
-+ rcu_read_lock();
-+ read_lock(&tasklist_lock);
-+
-+ if ((p = find_task_by_vpid_unrestricted(shm_cprid))) {
-+ starttime = p->start_time.tv_sec;
-+ if (time_before_eq((unsigned long)starttime, (unsigned long)shm_createtime)) {
-+ if (have_same_root(current, p)) {
-+ goto allow;
-+ } else {
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+ gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
-+ return 0;
-+ }
-+ }
-+ /* creator exited, pid reuse, fall through to next check */
-+ }
-+ if ((p = find_task_by_vpid_unrestricted(shm_lapid))) {
-+ if (unlikely(!have_same_root(current, p))) {
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+ gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
-+ return 0;
-+ }
-+ }
-+
-+allow:
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+#endif
-+ return 1;
-+}
-+
-+void
-+gr_log_chroot_exec(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
-+ if (grsec_enable_chroot_execlog && proc_is_chrooted(current))
-+ gr_log_fs_generic(GR_DO_AUDIT, GR_EXEC_CHROOT_MSG, dentry, mnt);
-+#endif
-+ return;
-+}
-+
-+int
-+gr_handle_chroot_mknod(const struct dentry *dentry,
-+ const struct vfsmount *mnt, const int mode)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
-+ if (grsec_enable_chroot_mknod && !S_ISFIFO(mode) && !S_ISREG(mode) &&
-+ proc_is_chrooted(current)) {
-+ gr_log_fs_generic(GR_DONT_AUDIT, GR_MKNOD_CHROOT_MSG, dentry, mnt);
-+ return -EPERM;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_handle_chroot_mount(const struct dentry *dentry,
-+ const struct vfsmount *mnt, const char *dev_name)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
-+ if (grsec_enable_chroot_mount && proc_is_chrooted(current)) {
-+ gr_log_str_fs(GR_DONT_AUDIT, GR_MOUNT_CHROOT_MSG, dev_name ? dev_name : "none" , dentry, mnt);
-+ return -EPERM;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_handle_chroot_pivot(void)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
-+ if (grsec_enable_chroot_pivot && proc_is_chrooted(current)) {
-+ gr_log_noargs(GR_DONT_AUDIT, GR_PIVOT_CHROOT_MSG);
-+ return -EPERM;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_handle_chroot_chroot(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
-+ if (grsec_enable_chroot_double && proc_is_chrooted(current) &&
-+ !gr_is_outside_chroot(dentry, mnt)) {
-+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_CHROOT_MSG, dentry, mnt);
-+ return -EPERM;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+extern const char *captab_log[];
-+extern int captab_log_entries;
-+
-+int
-+gr_chroot_is_capable(const int cap)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
-+ if (grsec_enable_chroot_caps && proc_is_chrooted(current)) {
-+ kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
-+ if (cap_raised(chroot_caps, cap)) {
-+ const struct cred *creds = current_cred();
-+ if (cap_raised(creds->cap_effective, cap) && cap < captab_log_entries) {
-+ gr_log_cap(GR_DONT_AUDIT, GR_CAP_CHROOT_MSG, current, captab_log[cap]);
-+ }
-+ return 0;
-+ }
-+ }
-+#endif
-+ return 1;
-+}
-+
-+int
-+gr_chroot_is_capable_nolog(const int cap)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
-+ if (grsec_enable_chroot_caps && proc_is_chrooted(current)) {
-+ kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
-+ if (cap_raised(chroot_caps, cap)) {
-+ return 0;
-+ }
-+ }
-+#endif
-+ return 1;
-+}
-+
-+int
-+gr_handle_chroot_sysctl(const int op)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
-+ if (grsec_enable_chroot_sysctl && proc_is_chrooted(current)
-+ && (op & MAY_WRITE))
-+ return -EACCES;
-+#endif
-+ return 0;
-+}
-+
-+void
-+gr_handle_chroot_chdir(struct path *path)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
-+ if (grsec_enable_chroot_chdir)
-+ set_fs_pwd(current->fs, path);
-+#endif
-+ return;
-+}
-+
-+int
-+gr_handle_chroot_chmod(const struct dentry *dentry,
-+ const struct vfsmount *mnt, const int mode)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
-+ /* allow chmod +s on directories, but not on files */
-+ if (grsec_enable_chroot_chmod && !S_ISDIR(dentry->d_inode->i_mode) &&
-+ ((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))) &&
-+ proc_is_chrooted(current)) {
-+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHMOD_CHROOT_MSG, dentry, mnt);
-+ return -EPERM;
-+ }
-+#endif
-+ return 0;
-+}
-diff --git a/grsecurity/grsec_disabled.c b/grsecurity/grsec_disabled.c
-new file mode 100644
-index 0000000..7a358f8
---- /dev/null
-+++ b/grsecurity/grsec_disabled.c
-@@ -0,0 +1,442 @@
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/kdev_t.h>
-+#include <linux/net.h>
-+#include <linux/in.h>
-+#include <linux/ip.h>
-+#include <linux/skbuff.h>
-+#include <linux/sysctl.h>
-+
-+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
-+void
-+pax_set_initial_flags(struct linux_binprm *bprm)
-+{
-+ return;
-+}
-+#endif
-+
-+#ifdef CONFIG_SYSCTL
-+__u32
-+gr_handle_sysctl(const struct ctl_table * table, const int op)
-+{
-+ return 0;
-+}
-+#endif
-+
-+#ifdef CONFIG_TASKSTATS
-+int gr_is_taskstats_denied(int pid)
-+{
-+ return 0;
-+}
-+#endif
-+
-+int
-+gr_acl_is_enabled(void)
-+{
-+ return 0;
-+}
-+
-+void
-+gr_handle_proc_create(const struct dentry *dentry, const struct inode *inode)
-+{
-+ return;
-+}
-+
-+int
-+gr_handle_rawio(const struct inode *inode)
-+{
-+ return 0;
-+}
-+
-+void
-+gr_acl_handle_psacct(struct task_struct *task, const long code)
-+{
-+ return;
-+}
-+
-+int
-+gr_handle_ptrace(struct task_struct *task, const long request)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_handle_proc_ptrace(struct task_struct *task)
-+{
-+ return 0;
-+}
-+
-+void
-+gr_learn_resource(const struct task_struct *task,
-+ const int res, const unsigned long wanted, const int gt)
-+{
-+ return;
-+}
-+
-+int
-+gr_set_acls(const int type)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_check_hidden_task(const struct task_struct *tsk)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_check_protected_task(const struct task_struct *task)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
-+{
-+ return 0;
-+}
-+
-+void
-+gr_copy_label(struct task_struct *tsk)
-+{
-+ return;
-+}
-+
-+void
-+gr_set_pax_flags(struct task_struct *task)
-+{
-+ return;
-+}
-+
-+int
-+gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
-+ const int unsafe_share)
-+{
-+ return 0;
-+}
-+
-+void
-+gr_handle_delete(const ino_t ino, const dev_t dev)
-+{
-+ return;
-+}
-+
-+void
-+gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return;
-+}
-+
-+void
-+gr_handle_crash(struct task_struct *task, const int sig)
-+{
-+ return;
-+}
-+
-+int
-+gr_check_crash_exec(const struct file *filp)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_check_crash_uid(const uid_t uid)
-+{
-+ return 0;
-+}
-+
-+void
-+gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
-+ struct dentry *old_dentry,
-+ struct dentry *new_dentry,
-+ struct vfsmount *mnt, const __u8 replace)
-+{
-+ return;
-+}
-+
-+int
-+gr_search_socket(const int family, const int type, const int protocol)
-+{
-+ return 1;
-+}
-+
-+int
-+gr_search_connectbind(const int mode, const struct socket *sock,
-+ const struct sockaddr_in *addr)
-+{
-+ return 0;
-+}
-+
-+void
-+gr_handle_alertkill(struct task_struct *task)
-+{
-+ return;
-+}
-+
-+__u32
-+gr_acl_handle_execve(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_hidden_file(const struct dentry * dentry,
-+ const struct vfsmount * mnt)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
-+ int acc_mode)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_unlink(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+ return 1;
-+}
-+
-+int
-+gr_acl_handle_mmap(const struct file *file, const unsigned long prot,
-+ unsigned int *vm_flags)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_truncate(const struct dentry * dentry,
-+ const struct vfsmount * mnt)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_utime(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_access(const struct dentry * dentry,
-+ const struct vfsmount * mnt, const int fmode)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_chmod(const struct dentry * dentry, const struct vfsmount * mnt,
-+ umode_t *mode)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_chown(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_setxattr(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+ return 1;
-+}
-+
-+void
-+grsecurity_init(void)
-+{
-+ return;
-+}
-+
-+umode_t gr_acl_umask(void)
-+{
-+ return 0;
-+}
-+
-+__u32
-+gr_acl_handle_mknod(const struct dentry * new_dentry,
-+ const struct dentry * parent_dentry,
-+ const struct vfsmount * parent_mnt,
-+ const int mode)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_mkdir(const struct dentry * new_dentry,
-+ const struct dentry * parent_dentry,
-+ const struct vfsmount * parent_mnt)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_symlink(const struct dentry * new_dentry,
-+ const struct dentry * parent_dentry,
-+ const struct vfsmount * parent_mnt, const char *from)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_link(const struct dentry * new_dentry,
-+ const struct dentry * parent_dentry,
-+ const struct vfsmount * parent_mnt,
-+ const struct dentry * old_dentry,
-+ const struct vfsmount * old_mnt, const char *to)
-+{
-+ return 1;
-+}
-+
-+int
-+gr_acl_handle_rename(const struct dentry *new_dentry,
-+ const struct dentry *parent_dentry,
-+ const struct vfsmount *parent_mnt,
-+ const struct dentry *old_dentry,
-+ const struct inode *old_parent_inode,
-+ const struct vfsmount *old_mnt, const char *newname)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_acl_handle_filldir(const struct file *file, const char *name,
-+ const int namelen, const ino_t ino)
-+{
-+ return 1;
-+}
-+
-+int
-+gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
-+ const time_t shm_createtime, const uid_t cuid, const int shmid)
-+{
-+ return 1;
-+}
-+
-+int
-+gr_search_bind(const struct socket *sock, const struct sockaddr_in *addr)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_search_accept(const struct socket *sock)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_search_listen(const struct socket *sock)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_search_connect(const struct socket *sock, const struct sockaddr_in *addr)
-+{
-+ return 0;
-+}
-+
-+__u32
-+gr_acl_handle_unix(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_creat(const struct dentry * dentry,
-+ const struct dentry * p_dentry,
-+ const struct vfsmount * p_mnt, int open_flags, int acc_mode,
-+ const int imode)
-+{
-+ return 1;
-+}
-+
-+void
-+gr_acl_handle_exit(void)
-+{
-+ return;
-+}
-+
-+int
-+gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
-+{
-+ return 1;
-+}
-+
-+void
-+gr_set_role_label(const uid_t uid, const gid_t gid)
-+{
-+ return;
-+}
-+
-+int
-+gr_acl_handle_procpidmem(const struct task_struct *task)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr)
-+{
-+ return 0;
-+}
-+
-+void
-+gr_set_kernel_label(struct task_struct *task)
-+{
-+ return;
-+}
-+
-+int
-+gr_check_user_change(int real, int effective, int fs)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_check_group_change(int real, int effective, int fs)
-+{
-+ return 0;
-+}
-+
-+int gr_acl_enable_at_secure(void)
-+{
-+ return 0;
-+}
-+
-+dev_t gr_get_dev_from_dentry(struct dentry *dentry)
-+{
-+ return dentry->d_inode->i_sb->s_dev;
-+}
-+
-+void gr_put_exec_file(struct task_struct *task)
-+{
-+ return;
-+}
-+
-+EXPORT_SYMBOL(gr_learn_resource);
-+EXPORT_SYMBOL(gr_set_kernel_label);
-+#ifdef CONFIG_SECURITY
-+EXPORT_SYMBOL(gr_check_user_change);
-+EXPORT_SYMBOL(gr_check_group_change);
-+#endif
-diff --git a/grsecurity/grsec_exec.c b/grsecurity/grsec_exec.c
-new file mode 100644
-index 0000000..a96e155
---- /dev/null
-+++ b/grsecurity/grsec_exec.c
-@@ -0,0 +1,204 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/binfmts.h>
-+#include <linux/smp_lock.h>
-+#include <linux/fs.h>
-+#include <linux/types.h>
-+#include <linux/grdefs.h>
-+#include <linux/grinternal.h>
-+#include <linux/capability.h>
-+#include <linux/compat.h>
-+#include <linux/module.h>
-+
-+#include <asm/uaccess.h>
-+
-+#ifdef CONFIG_GRKERNSEC_EXECLOG
-+static char gr_exec_arg_buf[132];
-+static DEFINE_MUTEX(gr_exec_arg_mutex);
-+#endif
-+
-+void
-+gr_handle_exec_args(struct linux_binprm *bprm, const char __user *const __user *argv)
-+{
-+#ifdef CONFIG_GRKERNSEC_EXECLOG
-+ char *grarg = gr_exec_arg_buf;
-+ unsigned int i, x, execlen = 0;
-+ char c;
-+
-+ if (!((grsec_enable_execlog && grsec_enable_group &&
-+ in_group_p(grsec_audit_gid))
-+ || (grsec_enable_execlog && !grsec_enable_group)))
-+ return;
-+
-+ mutex_lock(&gr_exec_arg_mutex);
-+ memset(grarg, 0, sizeof(gr_exec_arg_buf));
-+
-+ if (unlikely(argv == NULL))
-+ goto log;
-+
-+ for (i = 0; i < bprm->argc && execlen < 128; i++) {
-+ const char __user *p;
-+ unsigned int len;
-+
-+ if (copy_from_user(&p, argv + i, sizeof(p)))
-+ goto log;
-+ if (!p)
-+ goto log;
-+ len = strnlen_user(p, 128 - execlen);
-+ if (len > 128 - execlen)
-+ len = 128 - execlen;
-+ else if (len > 0)
-+ len--;
-+ if (copy_from_user(grarg + execlen, p, len))
-+ goto log;
-+
-+ /* rewrite unprintable characters */
-+ for (x = 0; x < len; x++) {
-+ c = *(grarg + execlen + x);
-+ if (c < 32 || c > 126)
-+ *(grarg + execlen + x) = ' ';
-+ }
-+
-+ execlen += len;
-+ *(grarg + execlen) = ' ';
-+ *(grarg + execlen + 1) = '\0';
-+ execlen++;
-+ }
-+
-+ log:
-+ gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
-+ bprm->file->f_path.mnt, grarg);
-+ mutex_unlock(&gr_exec_arg_mutex);
-+#endif
-+ return;
-+}
-+
-+#ifdef CONFIG_COMPAT
-+void
-+gr_handle_exec_args_compat(struct linux_binprm *bprm, compat_uptr_t __user *argv)
-+{
-+#ifdef CONFIG_GRKERNSEC_EXECLOG
-+ char *grarg = gr_exec_arg_buf;
-+ unsigned int i, x, execlen = 0;
-+ char c;
-+
-+ if (!((grsec_enable_execlog && grsec_enable_group &&
-+ in_group_p(grsec_audit_gid))
-+ || (grsec_enable_execlog && !grsec_enable_group)))
-+ return;
-+
-+ mutex_lock(&gr_exec_arg_mutex);
-+ memset(grarg, 0, sizeof(gr_exec_arg_buf));
-+
-+ if (unlikely(argv == NULL))
-+ goto log;
-+
-+ for (i = 0; i < bprm->argc && execlen < 128; i++) {
-+ compat_uptr_t p;
-+ unsigned int len;
-+
-+ if (get_user(p, argv + i))
-+ goto log;
-+ len = strnlen_user(compat_ptr(p), 128 - execlen);
-+ if (len > 128 - execlen)
-+ len = 128 - execlen;
-+ else if (len > 0)
-+ len--;
-+ else
-+ goto log;
-+ if (copy_from_user(grarg + execlen, compat_ptr(p), len))
-+ goto log;
-+
-+ /* rewrite unprintable characters */
-+ for (x = 0; x < len; x++) {
-+ c = *(grarg + execlen + x);
-+ if (c < 32 || c > 126)
-+ *(grarg + execlen + x) = ' ';
-+ }
-+
-+ execlen += len;
-+ *(grarg + execlen) = ' ';
-+ *(grarg + execlen + 1) = '\0';
-+ execlen++;
-+ }
-+
-+ log:
-+ gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
-+ bprm->file->f_path.mnt, grarg);
-+ mutex_unlock(&gr_exec_arg_mutex);
-+#endif
-+ return;
-+}
-+#endif
-+
-+#ifdef CONFIG_GRKERNSEC
-+extern int gr_acl_is_capable(const int cap);
-+extern int gr_acl_is_capable_nolog(const int cap);
-+extern int gr_chroot_is_capable(const int cap);
-+extern int gr_chroot_is_capable_nolog(const int cap);
-+#endif
-+
-+const char *captab_log[] = {
-+ "CAP_CHOWN",
-+ "CAP_DAC_OVERRIDE",
-+ "CAP_DAC_READ_SEARCH",
-+ "CAP_FOWNER",
-+ "CAP_FSETID",
-+ "CAP_KILL",
-+ "CAP_SETGID",
-+ "CAP_SETUID",
-+ "CAP_SETPCAP",
-+ "CAP_LINUX_IMMUTABLE",
-+ "CAP_NET_BIND_SERVICE",
-+ "CAP_NET_BROADCAST",
-+ "CAP_NET_ADMIN",
-+ "CAP_NET_RAW",
-+ "CAP_IPC_LOCK",
-+ "CAP_IPC_OWNER",
-+ "CAP_SYS_MODULE",
-+ "CAP_SYS_RAWIO",
-+ "CAP_SYS_CHROOT",
-+ "CAP_SYS_PTRACE",
-+ "CAP_SYS_PACCT",
-+ "CAP_SYS_ADMIN",
-+ "CAP_SYS_BOOT",
-+ "CAP_SYS_NICE",
-+ "CAP_SYS_RESOURCE",
-+ "CAP_SYS_TIME",
-+ "CAP_SYS_TTY_CONFIG",
-+ "CAP_MKNOD",
-+ "CAP_LEASE",
-+ "CAP_AUDIT_WRITE",
-+ "CAP_AUDIT_CONTROL",
-+ "CAP_SETFCAP",
-+ "CAP_MAC_OVERRIDE",
-+ "CAP_MAC_ADMIN"
-+};
-+
-+int captab_log_entries = sizeof(captab_log)/sizeof(captab_log[0]);
-+
-+int gr_is_capable(const int cap)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+ if (gr_acl_is_capable(cap) && gr_chroot_is_capable(cap))
-+ return 1;
-+ return 0;
-+#else
-+ return 1;
-+#endif
-+}
-+
-+int gr_is_capable_nolog(const int cap)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+ if (gr_acl_is_capable_nolog(cap) && gr_chroot_is_capable_nolog(cap))
-+ return 1;
-+ return 0;
-+#else
-+ return 1;
-+#endif
-+}
-+
-+EXPORT_SYMBOL(gr_is_capable);
-+EXPORT_SYMBOL(gr_is_capable_nolog);
-diff --git a/grsecurity/grsec_fifo.c b/grsecurity/grsec_fifo.c
-new file mode 100644
-index 0000000..d3ee748
---- /dev/null
-+++ b/grsecurity/grsec_fifo.c
-@@ -0,0 +1,24 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/fs.h>
-+#include <linux/file.h>
-+#include <linux/grinternal.h>
-+
-+int
-+gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
-+ const struct dentry *dir, const int flag, const int acc_mode)
-+{
-+#ifdef CONFIG_GRKERNSEC_FIFO
-+ const struct cred *cred = current_cred();
-+
-+ if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
-+ !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
-+ (dentry->d_inode->i_uid != dir->d_inode->i_uid) &&
-+ (cred->fsuid != dentry->d_inode->i_uid)) {
-+ if (!inode_permission(dentry->d_inode, acc_mode))
-+ gr_log_fs_int2(GR_DONT_AUDIT, GR_FIFO_MSG, dentry, mnt, dentry->d_inode->i_uid, dentry->d_inode->i_gid);
-+ return -EACCES;
-+ }
-+#endif
-+ return 0;
-+}
-diff --git a/grsecurity/grsec_fork.c b/grsecurity/grsec_fork.c
-new file mode 100644
-index 0000000..8ca18bf
---- /dev/null
-+++ b/grsecurity/grsec_fork.c
-@@ -0,0 +1,23 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+#include <linux/errno.h>
-+
-+void
-+gr_log_forkfail(const int retval)
-+{
-+#ifdef CONFIG_GRKERNSEC_FORKFAIL
-+ if (grsec_enable_forkfail && (retval == -EAGAIN || retval == -ENOMEM)) {
-+ switch (retval) {
-+ case -EAGAIN:
-+ gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "EAGAIN");
-+ break;
-+ case -ENOMEM:
-+ gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "ENOMEM");
-+ break;
-+ }
-+ }
-+#endif
-+ return;
-+}
-diff --git a/grsecurity/grsec_init.c b/grsecurity/grsec_init.c
-new file mode 100644
-index 0000000..13e8574
---- /dev/null
-+++ b/grsecurity/grsec_init.c
-@@ -0,0 +1,284 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/mm.h>
-+#include <linux/smp_lock.h>
-+#include <linux/gracl.h>
-+#include <linux/slab.h>
-+#include <linux/vmalloc.h>
-+#include <linux/percpu.h>
-+#include <linux/module.h>
-+
-+int grsec_enable_ptrace_readexec;
-+int grsec_enable_setxid;
-+int grsec_enable_symlinkown;
-+int grsec_symlinkown_gid;
-+int grsec_enable_brute;
-+int grsec_enable_link;
-+int grsec_enable_dmesg;
-+int grsec_enable_harden_ptrace;
-+int grsec_enable_fifo;
-+int grsec_enable_execlog;
-+int grsec_enable_signal;
-+int grsec_enable_forkfail;
-+int grsec_enable_audit_ptrace;
-+int grsec_enable_time;
-+int grsec_enable_audit_textrel;
-+int grsec_enable_group;
-+int grsec_audit_gid;
-+int grsec_enable_chdir;
-+int grsec_enable_mount;
-+int grsec_enable_rofs;
-+int grsec_enable_chroot_findtask;
-+int grsec_enable_chroot_mount;
-+int grsec_enable_chroot_shmat;
-+int grsec_enable_chroot_fchdir;
-+int grsec_enable_chroot_double;
-+int grsec_enable_chroot_pivot;
-+int grsec_enable_chroot_chdir;
-+int grsec_enable_chroot_chmod;
-+int grsec_enable_chroot_mknod;
-+int grsec_enable_chroot_nice;
-+int grsec_enable_chroot_execlog;
-+int grsec_enable_chroot_caps;
-+int grsec_enable_chroot_sysctl;
-+int grsec_enable_chroot_unix;
-+int grsec_enable_tpe;
-+int grsec_tpe_gid;
-+int grsec_enable_blackhole;
-+#ifdef CONFIG_IPV6_MODULE
-+EXPORT_SYMBOL(grsec_enable_blackhole);
-+#endif
-+int grsec_lastack_retries;
-+int grsec_enable_tpe_all;
-+int grsec_enable_tpe_invert;
-+int grsec_enable_socket_all;
-+int grsec_socket_all_gid;
-+int grsec_enable_socket_client;
-+int grsec_socket_client_gid;
-+int grsec_enable_socket_server;
-+int grsec_socket_server_gid;
-+int grsec_resource_logging;
-+int grsec_disable_privio;
-+int grsec_enable_log_rwxmaps;
-+int grsec_lock;
-+
-+DEFINE_SPINLOCK(grsec_alert_lock);
-+unsigned long grsec_alert_wtime = 0;
-+unsigned long grsec_alert_fyet = 0;
-+
-+DEFINE_SPINLOCK(grsec_audit_lock);
-+
-+DEFINE_RWLOCK(grsec_exec_file_lock);
-+
-+char *gr_shared_page[4];
-+
-+char *gr_alert_log_fmt;
-+char *gr_audit_log_fmt;
-+char *gr_alert_log_buf;
-+char *gr_audit_log_buf;
-+
-+extern struct gr_arg *gr_usermode;
-+extern unsigned char *gr_system_salt;
-+extern unsigned char *gr_system_sum;
-+
-+void __init
-+grsecurity_init(void)
-+{
-+ int j;
-+ /* create the per-cpu shared pages */
-+
-+#ifdef CONFIG_X86
-+ memset((char *)(0x41a + PAGE_OFFSET), 0, 36);
-+#endif
-+
-+ for (j = 0; j < 4; j++) {
-+ gr_shared_page[j] = (char *)__alloc_percpu(PAGE_SIZE, __alignof__(unsigned long long));
-+ if (gr_shared_page[j] == NULL) {
-+ panic("Unable to allocate grsecurity shared page");
-+ return;
-+ }
-+ }
-+
-+ /* allocate log buffers */
-+ gr_alert_log_fmt = kmalloc(512, GFP_KERNEL);
-+ if (!gr_alert_log_fmt) {
-+ panic("Unable to allocate grsecurity alert log format buffer");
-+ return;
-+ }
-+ gr_audit_log_fmt = kmalloc(512, GFP_KERNEL);
-+ if (!gr_audit_log_fmt) {
-+ panic("Unable to allocate grsecurity audit log format buffer");
-+ return;
-+ }
-+ gr_alert_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
-+ if (!gr_alert_log_buf) {
-+ panic("Unable to allocate grsecurity alert log buffer");
-+ return;
-+ }
-+ gr_audit_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
-+ if (!gr_audit_log_buf) {
-+ panic("Unable to allocate grsecurity audit log buffer");
-+ return;
-+ }
-+
-+ /* allocate memory for authentication structure */
-+ gr_usermode = kmalloc(sizeof(struct gr_arg), GFP_KERNEL);
-+ gr_system_salt = kmalloc(GR_SALT_LEN, GFP_KERNEL);
-+ gr_system_sum = kmalloc(GR_SHA_LEN, GFP_KERNEL);
-+
-+ if (!gr_usermode || !gr_system_salt || !gr_system_sum) {
-+ panic("Unable to allocate grsecurity authentication structure");
-+ return;
-+ }
-+
-+
-+#ifdef CONFIG_GRKERNSEC_IO
-+#if !defined(CONFIG_GRKERNSEC_SYSCTL_DISTRO)
-+ grsec_disable_privio = 1;
-+#elif defined(CONFIG_GRKERNSEC_SYSCTL_ON)
-+ grsec_disable_privio = 1;
-+#else
-+ grsec_disable_privio = 0;
-+#endif
-+#endif
-+
-+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
-+ /* for backward compatibility, tpe_invert always defaults to on if
-+ enabled in the kernel
-+ */
-+ grsec_enable_tpe_invert = 1;
-+#endif
-+
-+#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
-+#ifndef CONFIG_GRKERNSEC_SYSCTL
-+ grsec_lock = 1;
-+#endif
-+
-+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
-+ grsec_enable_audit_textrel = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
-+ grsec_enable_log_rwxmaps = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
-+ grsec_enable_group = 1;
-+ grsec_audit_gid = CONFIG_GRKERNSEC_AUDIT_GID;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
-+ grsec_enable_chdir = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+ grsec_enable_harden_ptrace = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
-+ grsec_enable_mount = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_LINK
-+ grsec_enable_link = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_BRUTE
-+ grsec_enable_brute = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_DMESG
-+ grsec_enable_dmesg = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ grsec_enable_blackhole = 1;
-+ grsec_lastack_retries = 4;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_FIFO
-+ grsec_enable_fifo = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_EXECLOG
-+ grsec_enable_execlog = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+ grsec_enable_setxid = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_PTRACE_READEXEC
-+ grsec_enable_ptrace_readexec = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SIGNAL
-+ grsec_enable_signal = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_FORKFAIL
-+ grsec_enable_forkfail = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_TIME
-+ grsec_enable_time = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_RESLOG
-+ grsec_resource_logging = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
-+ grsec_enable_chroot_findtask = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
-+ grsec_enable_chroot_unix = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
-+ grsec_enable_chroot_mount = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
-+ grsec_enable_chroot_fchdir = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
-+ grsec_enable_chroot_shmat = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
-+ grsec_enable_audit_ptrace = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
-+ grsec_enable_chroot_double = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
-+ grsec_enable_chroot_pivot = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
-+ grsec_enable_chroot_chdir = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
-+ grsec_enable_chroot_chmod = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
-+ grsec_enable_chroot_mknod = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
-+ grsec_enable_chroot_nice = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
-+ grsec_enable_chroot_execlog = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
-+ grsec_enable_chroot_caps = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
-+ grsec_enable_chroot_sysctl = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SYMLINKOWN
-+ grsec_enable_symlinkown = 1;
-+ grsec_symlinkown_gid = CONFIG_GRKERNSEC_SYMLINKOWN_GID;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_TPE
-+ grsec_enable_tpe = 1;
-+ grsec_tpe_gid = CONFIG_GRKERNSEC_TPE_GID;
-+#ifdef CONFIG_GRKERNSEC_TPE_ALL
-+ grsec_enable_tpe_all = 1;
-+#endif
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
-+ grsec_enable_socket_all = 1;
-+ grsec_socket_all_gid = CONFIG_GRKERNSEC_SOCKET_ALL_GID;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
-+ grsec_enable_socket_client = 1;
-+ grsec_socket_client_gid = CONFIG_GRKERNSEC_SOCKET_CLIENT_GID;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
-+ grsec_enable_socket_server = 1;
-+ grsec_socket_server_gid = CONFIG_GRKERNSEC_SOCKET_SERVER_GID;
-+#endif
-+#endif
-+
-+ return;
-+}
-diff --git a/grsecurity/grsec_link.c b/grsecurity/grsec_link.c
-new file mode 100644
-index 0000000..8598e7f
---- /dev/null
-+++ b/grsecurity/grsec_link.c
-@@ -0,0 +1,58 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/fs.h>
-+#include <linux/file.h>
-+#include <linux/grinternal.h>
-+
-+int gr_handle_symlink_owner(const struct path *link, const struct inode *target)
-+{
-+#ifdef CONFIG_GRKERNSEC_SYMLINKOWN
-+ const struct inode *link_inode = link->dentry->d_inode;
-+
-+ if (grsec_enable_symlinkown && in_group_p(grsec_symlinkown_gid) &&
-+ /* ignore root-owned links, e.g. /proc/self */
-+ link_inode->i_uid && target &&
-+ link_inode->i_uid != target->i_uid) {
-+ gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINKOWNER_MSG, link->dentry, link->mnt, link_inode->i_uid, target->i_uid);
-+ return 1;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_handle_follow_link(const struct inode *parent,
-+ const struct inode *inode,
-+ const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+#ifdef CONFIG_GRKERNSEC_LINK
-+ const struct cred *cred = current_cred();
-+
-+ if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
-+ (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) &&
-+ (parent->i_mode & S_IWOTH) && (cred->fsuid != inode->i_uid)) {
-+ gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid);
-+ return -EACCES;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_handle_hardlink(const struct dentry *dentry,
-+ const struct vfsmount *mnt,
-+ struct inode *inode, const int mode, const char *to)
-+{
-+#ifdef CONFIG_GRKERNSEC_LINK
-+ const struct cred *cred = current_cred();
-+
-+ if (grsec_enable_link && cred->fsuid != inode->i_uid &&
-+ (!S_ISREG(mode) || is_privileged_binary(dentry) ||
-+ (inode_permission(inode, MAY_READ | MAY_WRITE))) &&
-+ !capable(CAP_FOWNER) && cred->uid) {
-+ gr_log_fs_int2_str(GR_DONT_AUDIT, GR_HARDLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid, to);
-+ return -EPERM;
-+ }
-+#endif
-+ return 0;
-+}
-diff --git a/grsecurity/grsec_log.c b/grsecurity/grsec_log.c
-new file mode 100644
-index 0000000..a45d2e9
---- /dev/null
-+++ b/grsecurity/grsec_log.c
-@@ -0,0 +1,322 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/tty.h>
-+#include <linux/fs.h>
-+#include <linux/grinternal.h>
-+
-+#ifdef CONFIG_TREE_PREEMPT_RCU
-+#define DISABLE_PREEMPT() preempt_disable()
-+#define ENABLE_PREEMPT() preempt_enable()
-+#else
-+#define DISABLE_PREEMPT()
-+#define ENABLE_PREEMPT()
-+#endif
-+
-+#define BEGIN_LOCKS(x) \
-+ DISABLE_PREEMPT(); \
-+ rcu_read_lock(); \
-+ read_lock(&tasklist_lock); \
-+ read_lock(&grsec_exec_file_lock); \
-+ if (x != GR_DO_AUDIT) \
-+ spin_lock(&grsec_alert_lock); \
-+ else \
-+ spin_lock(&grsec_audit_lock)
-+
-+#define END_LOCKS(x) \
-+ if (x != GR_DO_AUDIT) \
-+ spin_unlock(&grsec_alert_lock); \
-+ else \
-+ spin_unlock(&grsec_audit_lock); \
-+ read_unlock(&grsec_exec_file_lock); \
-+ read_unlock(&tasklist_lock); \
-+ rcu_read_unlock(); \
-+ ENABLE_PREEMPT(); \
-+ if (x == GR_DONT_AUDIT) \
-+ gr_handle_alertkill(current)
-+
-+enum {
-+ FLOODING,
-+ NO_FLOODING
-+};
-+
-+extern char *gr_alert_log_fmt;
-+extern char *gr_audit_log_fmt;
-+extern char *gr_alert_log_buf;
-+extern char *gr_audit_log_buf;
-+
-+static int gr_log_start(int audit)
-+{
-+ char *loglevel = (audit == GR_DO_AUDIT) ? KERN_INFO : KERN_ALERT;
-+ char *fmt = (audit == GR_DO_AUDIT) ? gr_audit_log_fmt : gr_alert_log_fmt;
-+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
-+#if (CONFIG_GRKERNSEC_FLOODTIME > 0 && CONFIG_GRKERNSEC_FLOODBURST > 0)
-+ unsigned long curr_secs = get_seconds();
-+
-+ if (audit == GR_DO_AUDIT)
-+ goto set_fmt;
-+
-+ if (!grsec_alert_wtime || time_after(curr_secs, grsec_alert_wtime + CONFIG_GRKERNSEC_FLOODTIME)) {
-+ grsec_alert_wtime = curr_secs;
-+ grsec_alert_fyet = 0;
-+ } else if (time_before_eq(curr_secs, grsec_alert_wtime + CONFIG_GRKERNSEC_FLOODTIME)
-+ && (grsec_alert_fyet < CONFIG_GRKERNSEC_FLOODBURST)) {
-+ grsec_alert_fyet++;
-+ } else if (grsec_alert_fyet == CONFIG_GRKERNSEC_FLOODBURST) {
-+ grsec_alert_wtime = curr_secs;
-+ grsec_alert_fyet++;
-+ printk(KERN_ALERT "grsec: more alerts, logging disabled for %d seconds\n", CONFIG_GRKERNSEC_FLOODTIME);
-+ return FLOODING;
-+ }
-+ else return FLOODING;
-+
-+set_fmt:
-+#endif
-+ memset(buf, 0, PAGE_SIZE);
-+ if (current->signal->curr_ip && gr_acl_is_enabled()) {
-+ sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: (%.64s:%c:%.950s) ");
-+ snprintf(buf, PAGE_SIZE - 1, fmt, ¤t->signal->curr_ip, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
-+ } else if (current->signal->curr_ip) {
-+ sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: ");
-+ snprintf(buf, PAGE_SIZE - 1, fmt, ¤t->signal->curr_ip);
-+ } else if (gr_acl_is_enabled()) {
-+ sprintf(fmt, "%s%s", loglevel, "grsec: (%.64s:%c:%.950s) ");
-+ snprintf(buf, PAGE_SIZE - 1, fmt, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
-+ } else {
-+ sprintf(fmt, "%s%s", loglevel, "grsec: ");
-+ strcpy(buf, fmt);
-+ }
-+
-+ return NO_FLOODING;
-+}
-+
-+static void gr_log_middle(int audit, const char *msg, va_list ap)
-+ __attribute__ ((format (printf, 2, 0)));
-+
-+static void gr_log_middle(int audit, const char *msg, va_list ap)
-+{
-+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
-+ unsigned int len = strlen(buf);
-+
-+ vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
-+
-+ return;
-+}
-+
-+static void gr_log_middle_varargs(int audit, const char *msg, ...)
-+ __attribute__ ((format (printf, 2, 3)));
-+
-+static void gr_log_middle_varargs(int audit, const char *msg, ...)
-+{
-+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
-+ unsigned int len = strlen(buf);
-+ va_list ap;
-+
-+ va_start(ap, msg);
-+ vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
-+ va_end(ap);
-+
-+ return;
-+}
-+
-+static void gr_log_end(int audit, int append_default)
-+{
-+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
-+
-+ if (append_default) {
-+ unsigned int len = strlen(buf);
-+ snprintf(buf + len, PAGE_SIZE - len - 1, DEFAULTSECMSG, DEFAULTSECARGS(current, current_cred(), __task_cred(current->real_parent)));
-+ }
-+
-+ printk("%s\n", buf);
-+
-+ return;
-+}
-+
-+void gr_log_varargs(int audit, const char *msg, int argtypes, ...)
-+{
-+ int logtype;
-+ char *result = (audit == GR_DO_AUDIT) ? "successful" : "denied";
-+ char *str1 = NULL, *str2 = NULL, *str3 = NULL;
-+ void *voidptr = NULL;
-+ int num1 = 0, num2 = 0;
-+ unsigned long ulong1 = 0, ulong2 = 0;
-+ struct dentry *dentry = NULL;
-+ struct vfsmount *mnt = NULL;
-+ struct file *file = NULL;
-+ struct task_struct *task = NULL;
-+ const struct cred *cred, *pcred;
-+ va_list ap;
-+
-+ BEGIN_LOCKS(audit);
-+ logtype = gr_log_start(audit);
-+ if (logtype == FLOODING) {
-+ END_LOCKS(audit);
-+ return;
-+ }
-+ va_start(ap, argtypes);
-+ switch (argtypes) {
-+ case GR_TTYSNIFF:
-+ task = va_arg(ap, struct task_struct *);
-+ gr_log_middle_varargs(audit, msg, &task->signal->curr_ip, gr_task_fullpath0(task), task->comm, task->pid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid);
-+ break;
-+ case GR_SYSCTL_HIDDEN:
-+ str1 = va_arg(ap, char *);
-+ gr_log_middle_varargs(audit, msg, result, str1);
-+ break;
-+ case GR_RBAC:
-+ dentry = va_arg(ap, struct dentry *);
-+ mnt = va_arg(ap, struct vfsmount *);
-+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt));
-+ break;
-+ case GR_RBAC_STR:
-+ dentry = va_arg(ap, struct dentry *);
-+ mnt = va_arg(ap, struct vfsmount *);
-+ str1 = va_arg(ap, char *);
-+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1);
-+ break;
-+ case GR_STR_RBAC:
-+ str1 = va_arg(ap, char *);
-+ dentry = va_arg(ap, struct dentry *);
-+ mnt = va_arg(ap, struct vfsmount *);
-+ gr_log_middle_varargs(audit, msg, result, str1, gr_to_filename(dentry, mnt));
-+ break;
-+ case GR_RBAC_MODE2:
-+ dentry = va_arg(ap, struct dentry *);
-+ mnt = va_arg(ap, struct vfsmount *);
-+ str1 = va_arg(ap, char *);
-+ str2 = va_arg(ap, char *);
-+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2);
-+ break;
-+ case GR_RBAC_MODE3:
-+ dentry = va_arg(ap, struct dentry *);
-+ mnt = va_arg(ap, struct vfsmount *);
-+ str1 = va_arg(ap, char *);
-+ str2 = va_arg(ap, char *);
-+ str3 = va_arg(ap, char *);
-+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2, str3);
-+ break;
-+ case GR_FILENAME:
-+ dentry = va_arg(ap, struct dentry *);
-+ mnt = va_arg(ap, struct vfsmount *);
-+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt));
-+ break;
-+ case GR_STR_FILENAME:
-+ str1 = va_arg(ap, char *);
-+ dentry = va_arg(ap, struct dentry *);
-+ mnt = va_arg(ap, struct vfsmount *);
-+ gr_log_middle_varargs(audit, msg, str1, gr_to_filename(dentry, mnt));
-+ break;
-+ case GR_FILENAME_STR:
-+ dentry = va_arg(ap, struct dentry *);
-+ mnt = va_arg(ap, struct vfsmount *);
-+ str1 = va_arg(ap, char *);
-+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), str1);
-+ break;
-+ case GR_FILENAME_TWO_INT:
-+ dentry = va_arg(ap, struct dentry *);
-+ mnt = va_arg(ap, struct vfsmount *);
-+ num1 = va_arg(ap, int);
-+ num2 = va_arg(ap, int);
-+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2);
-+ break;
-+ case GR_FILENAME_TWO_INT_STR:
-+ dentry = va_arg(ap, struct dentry *);
-+ mnt = va_arg(ap, struct vfsmount *);
-+ num1 = va_arg(ap, int);
-+ num2 = va_arg(ap, int);
-+ str1 = va_arg(ap, char *);
-+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2, str1);
-+ break;
-+ case GR_TEXTREL:
-+ file = va_arg(ap, struct file *);
-+ ulong1 = va_arg(ap, unsigned long);
-+ ulong2 = va_arg(ap, unsigned long);
-+ gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>", ulong1, ulong2);
-+ break;
-+ case GR_PTRACE:
-+ task = va_arg(ap, struct task_struct *);
-+ gr_log_middle_varargs(audit, msg, task->exec_file ? gr_to_filename(task->exec_file->f_path.dentry, task->exec_file->f_path.mnt) : "(none)", task->comm, task->pid);
-+ break;
-+ case GR_RESOURCE:
-+ task = va_arg(ap, struct task_struct *);
-+ cred = __task_cred(task);
-+ pcred = __task_cred(task->real_parent);
-+ ulong1 = va_arg(ap, unsigned long);
-+ str1 = va_arg(ap, char *);
-+ ulong2 = va_arg(ap, unsigned long);
-+ gr_log_middle_varargs(audit, msg, ulong1, str1, ulong2, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
-+ break;
-+ case GR_CAP:
-+ task = va_arg(ap, struct task_struct *);
-+ cred = __task_cred(task);
-+ pcred = __task_cred(task->real_parent);
-+ str1 = va_arg(ap, char *);
-+ gr_log_middle_varargs(audit, msg, str1, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
-+ break;
-+ case GR_SIG:
-+ str1 = va_arg(ap, char *);
-+ voidptr = va_arg(ap, void *);
-+ gr_log_middle_varargs(audit, msg, str1, voidptr);
-+ break;
-+ case GR_SIG2:
-+ task = va_arg(ap, struct task_struct *);
-+ cred = __task_cred(task);
-+ pcred = __task_cred(task->real_parent);
-+ num1 = va_arg(ap, int);
-+ gr_log_middle_varargs(audit, msg, num1, gr_task_fullpath0(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
-+ break;
-+ case GR_CRASH1:
-+ task = va_arg(ap, struct task_struct *);
-+ cred = __task_cred(task);
-+ pcred = __task_cred(task->real_parent);
-+ ulong1 = va_arg(ap, unsigned long);
-+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, cred->uid, ulong1);
-+ break;
-+ case GR_CRASH2:
-+ task = va_arg(ap, struct task_struct *);
-+ cred = __task_cred(task);
-+ pcred = __task_cred(task->real_parent);
-+ ulong1 = va_arg(ap, unsigned long);
-+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, ulong1);
-+ break;
-+ case GR_RWXMAP:
-+ file = va_arg(ap, struct file *);
-+ gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>");
-+ break;
-+ case GR_PSACCT:
-+ {
-+ unsigned int wday, cday;
-+ __u8 whr, chr;
-+ __u8 wmin, cmin;
-+ __u8 wsec, csec;
-+ char cur_tty[64] = { 0 };
-+ char parent_tty[64] = { 0 };
-+
-+ task = va_arg(ap, struct task_struct *);
-+ wday = va_arg(ap, unsigned int);
-+ cday = va_arg(ap, unsigned int);
-+ whr = va_arg(ap, int);
-+ chr = va_arg(ap, int);
-+ wmin = va_arg(ap, int);
-+ cmin = va_arg(ap, int);
-+ wsec = va_arg(ap, int);
-+ csec = va_arg(ap, int);
-+ ulong1 = va_arg(ap, unsigned long);
-+ cred = __task_cred(task);
-+ pcred = __task_cred(task->real_parent);
-+
-+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, &task->signal->curr_ip, tty_name(task->signal->tty, cur_tty), cred->uid, cred->euid, cred->gid, cred->egid, wday, whr, wmin, wsec, cday, chr, cmin, csec, (task->flags & PF_SIGNALED) ? "killed by signal" : "exited", ulong1, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, &task->real_parent->signal->curr_ip, tty_name(task->real_parent->signal->tty, parent_tty), pcred->uid, pcred->euid, pcred->gid, pcred->egid);
-+ }
-+ break;
-+ default:
-+ gr_log_middle(audit, msg, ap);
-+ }
-+ va_end(ap);
-+ // these don't need DEFAULTSECARGS printed on the end
-+ if (argtypes == GR_CRASH1 || argtypes == GR_CRASH2)
-+ gr_log_end(audit, 0);
-+ else
-+ gr_log_end(audit, 1);
-+ END_LOCKS(audit);
-+}
-diff --git a/grsecurity/grsec_mem.c b/grsecurity/grsec_mem.c
-new file mode 100644
-index 0000000..f536303
---- /dev/null
-+++ b/grsecurity/grsec_mem.c
-@@ -0,0 +1,40 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/mm.h>
-+#include <linux/mman.h>
-+#include <linux/grinternal.h>
-+
-+void
-+gr_handle_ioperm(void)
-+{
-+ gr_log_noargs(GR_DONT_AUDIT, GR_IOPERM_MSG);
-+ return;
-+}
-+
-+void
-+gr_handle_iopl(void)
-+{
-+ gr_log_noargs(GR_DONT_AUDIT, GR_IOPL_MSG);
-+ return;
-+}
-+
-+void
-+gr_handle_mem_readwrite(u64 from, u64 to)
-+{
-+ gr_log_two_u64(GR_DONT_AUDIT, GR_MEM_READWRITE_MSG, from, to);
-+ return;
-+}
-+
-+void
-+gr_handle_vm86(void)
-+{
-+ gr_log_noargs(GR_DONT_AUDIT, GR_VM86_MSG);
-+ return;
-+}
-+
-+void
-+gr_log_badprocpid(const char *entry)
-+{
-+ gr_log_str(GR_DONT_AUDIT, GR_BADPROCPID_MSG, entry);
-+ return;
-+}
-diff --git a/grsecurity/grsec_mount.c b/grsecurity/grsec_mount.c
-new file mode 100644
-index 0000000..2131422
---- /dev/null
-+++ b/grsecurity/grsec_mount.c
-@@ -0,0 +1,62 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/mount.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+void
-+gr_log_remount(const char *devname, const int retval)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
-+ if (grsec_enable_mount && (retval >= 0))
-+ gr_log_str(GR_DO_AUDIT, GR_REMOUNT_AUDIT_MSG, devname ? devname : "none");
-+#endif
-+ return;
-+}
-+
-+void
-+gr_log_unmount(const char *devname, const int retval)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
-+ if (grsec_enable_mount && (retval >= 0))
-+ gr_log_str(GR_DO_AUDIT, GR_UNMOUNT_AUDIT_MSG, devname ? devname : "none");
-+#endif
-+ return;
-+}
-+
-+void
-+gr_log_mount(const char *from, const char *to, const int retval)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
-+ if (grsec_enable_mount && (retval >= 0))
-+ gr_log_str_str(GR_DO_AUDIT, GR_MOUNT_AUDIT_MSG, from ? from : "none", to);
-+#endif
-+ return;
-+}
-+
-+int
-+gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags)
-+{
-+#ifdef CONFIG_GRKERNSEC_ROFS
-+ if (grsec_enable_rofs && !(mnt_flags & MNT_READONLY)) {
-+ gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_MOUNT_MSG, dentry, mnt);
-+ return -EPERM;
-+ } else
-+ return 0;
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode)
-+{
-+#ifdef CONFIG_GRKERNSEC_ROFS
-+ if (grsec_enable_rofs && (acc_mode & MAY_WRITE) &&
-+ dentry->d_inode && S_ISBLK(dentry->d_inode->i_mode)) {
-+ gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_BLOCKWRITE_MSG, dentry, mnt);
-+ return -EPERM;
-+ } else
-+ return 0;
-+#endif
-+ return 0;
-+}
-diff --git a/grsecurity/grsec_pax.c b/grsecurity/grsec_pax.c
-new file mode 100644
-index 0000000..a3b12a0
---- /dev/null
-+++ b/grsecurity/grsec_pax.c
-@@ -0,0 +1,36 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/mm.h>
-+#include <linux/file.h>
-+#include <linux/grinternal.h>
-+#include <linux/grsecurity.h>
-+
-+void
-+gr_log_textrel(struct vm_area_struct * vma)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
-+ if (grsec_enable_audit_textrel)
-+ gr_log_textrel_ulong_ulong(GR_DO_AUDIT, GR_TEXTREL_AUDIT_MSG, vma->vm_file, vma->vm_start, vma->vm_pgoff);
-+#endif
-+ return;
-+}
-+
-+void
-+gr_log_rwxmmap(struct file *file)
-+{
-+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
-+ if (grsec_enable_log_rwxmaps)
-+ gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMMAP_MSG, file);
-+#endif
-+ return;
-+}
-+
-+void
-+gr_log_rwxmprotect(struct file *file)
-+{
-+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
-+ if (grsec_enable_log_rwxmaps)
-+ gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMPROTECT_MSG, file);
-+#endif
-+ return;
-+}
-diff --git a/grsecurity/grsec_ptrace.c b/grsecurity/grsec_ptrace.c
-new file mode 100644
-index 0000000..78f8733
---- /dev/null
-+++ b/grsecurity/grsec_ptrace.c
-@@ -0,0 +1,30 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/grinternal.h>
-+#include <linux/security.h>
-+
-+void
-+gr_audit_ptrace(struct task_struct *task)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
-+ if (grsec_enable_audit_ptrace)
-+ gr_log_ptrace(GR_DO_AUDIT, GR_PTRACE_AUDIT_MSG, task);
-+#endif
-+ return;
-+}
-+
-+int
-+gr_ptrace_readexec(struct file *file, int unsafe_flags)
-+{
-+#ifdef CONFIG_GRKERNSEC_PTRACE_READEXEC
-+ const struct dentry *dentry = file->f_path.dentry;
-+ const struct vfsmount *mnt = file->f_path.mnt;
-+
-+ if (grsec_enable_ptrace_readexec && (unsafe_flags & LSM_UNSAFE_PTRACE) &&
-+ (inode_permission(dentry->d_inode, MAY_READ) || !gr_acl_handle_open(dentry, mnt, MAY_READ))) {
-+ gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_READEXEC_MSG, dentry, mnt);
-+ return -EACCES;
-+ }
-+#endif
-+ return 0;
-+}
-diff --git a/grsecurity/grsec_sig.c b/grsecurity/grsec_sig.c
-new file mode 100644
-index 0000000..d450a74
---- /dev/null
-+++ b/grsecurity/grsec_sig.c
-@@ -0,0 +1,219 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/delay.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+#include <linux/hardirq.h>
-+
-+char *signames[] = {
-+ [SIGSEGV] = "Segmentation fault",
-+ [SIGILL] = "Illegal instruction",
-+ [SIGABRT] = "Abort",
-+ [SIGBUS] = "Invalid alignment/Bus error"
-+};
-+
-+void
-+gr_log_signal(const int sig, const void *addr, const struct task_struct *t)
-+{
-+#ifdef CONFIG_GRKERNSEC_SIGNAL
-+ if (grsec_enable_signal && ((sig == SIGSEGV) || (sig == SIGILL) ||
-+ (sig == SIGABRT) || (sig == SIGBUS))) {
-+ if (t->pid == current->pid) {
-+ gr_log_sig_addr(GR_DONT_AUDIT_GOOD, GR_UNISIGLOG_MSG, signames[sig], addr);
-+ } else {
-+ gr_log_sig_task(GR_DONT_AUDIT_GOOD, GR_DUALSIGLOG_MSG, t, sig);
-+ }
-+ }
-+#endif
-+ return;
-+}
-+
-+int
-+gr_handle_signal(const struct task_struct *p, const int sig)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+ /* ignore the 0 signal for protected task checks */
-+ if (current->pid > 1 && sig && gr_check_protected_task(p)) {
-+ gr_log_sig_task(GR_DONT_AUDIT, GR_SIG_ACL_MSG, p, sig);
-+ return -EPERM;
-+ } else if (gr_pid_is_chrooted((struct task_struct *)p)) {
-+ return -EPERM;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+#ifdef CONFIG_GRKERNSEC
-+extern int specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t);
-+
-+int gr_fake_force_sig(int sig, struct task_struct *t)
-+{
-+ unsigned long int flags;
-+ int ret, blocked, ignored;
-+ struct k_sigaction *action;
-+
-+ spin_lock_irqsave(&t->sighand->siglock, flags);
-+ action = &t->sighand->action[sig-1];
-+ ignored = action->sa.sa_handler == SIG_IGN;
-+ blocked = sigismember(&t->blocked, sig);
-+ if (blocked || ignored) {
-+ action->sa.sa_handler = SIG_DFL;
-+ if (blocked) {
-+ sigdelset(&t->blocked, sig);
-+ recalc_sigpending_and_wake(t);
-+ }
-+ }
-+ if (action->sa.sa_handler == SIG_DFL)
-+ t->signal->flags &= ~SIGNAL_UNKILLABLE;
-+ ret = specific_send_sig_info(sig, SEND_SIG_PRIV, t);
-+
-+ spin_unlock_irqrestore(&t->sighand->siglock, flags);
-+
-+ return ret;
-+}
-+#endif
-+
-+#ifdef CONFIG_GRKERNSEC_BRUTE
-+#define GR_USER_BAN_TIME (15 * 60)
-+#define GR_DAEMON_BRUTE_TIME (30 * 60)
-+
-+static int __get_dumpable(unsigned long mm_flags)
-+{
-+ int ret;
-+
-+ ret = mm_flags & MMF_DUMPABLE_MASK;
-+ return (ret >= 2) ? 2 : ret;
-+}
-+#endif
-+
-+void gr_handle_brute_attach(unsigned long mm_flags)
-+{
-+#ifdef CONFIG_GRKERNSEC_BRUTE
-+ struct task_struct *p = current;
-+ uid_t uid = 0;
-+ int daemon = 0;
-+
-+ if (!grsec_enable_brute)
-+ return;
-+
-+ rcu_read_lock();
-+ read_lock(&tasklist_lock);
-+ read_lock(&grsec_exec_file_lock);
-+ if (p->real_parent && p->real_parent->exec_file == p->exec_file) {
-+ p->real_parent->brute_expires = get_seconds() + GR_DAEMON_BRUTE_TIME;
-+ p->real_parent->brute = 1;
-+ daemon = 1;
-+ } else {
-+ const struct cred *cred = __task_cred(p), *cred2;
-+ struct task_struct *tsk, *tsk2;
-+
-+ if (!__get_dumpable(mm_flags) && cred->uid) {
-+ struct user_struct *user;
-+
-+ uid = cred->uid;
-+
-+ /* this is put upon execution past expiration */
-+ user = find_user(uid);
-+ if (user == NULL)
-+ goto unlock;
-+ user->banned = 1;
-+ user->ban_expires = get_seconds() + GR_USER_BAN_TIME;
-+ if (user->ban_expires == ~0UL)
-+ user->ban_expires--;
-+
-+ do_each_thread(tsk2, tsk) {
-+ cred2 = __task_cred(tsk);
-+ if (tsk != p && cred2->uid == uid)
-+ gr_fake_force_sig(SIGKILL, tsk);
-+ } while_each_thread(tsk2, tsk);
-+ }
-+ }
-+unlock:
-+ read_unlock(&grsec_exec_file_lock);
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+
-+ if (uid)
-+ printk(KERN_ALERT "grsec: bruteforce prevention initiated against uid %u, banning for %d minutes\n", uid, GR_USER_BAN_TIME / 60);
-+ else if (daemon)
-+ gr_log_noargs(GR_DONT_AUDIT, GR_BRUTE_DAEMON_MSG);
-+#endif
-+ return;
-+}
-+
-+void gr_handle_brute_check(void)
-+{
-+#ifdef CONFIG_GRKERNSEC_BRUTE
-+ struct task_struct *p = current;
-+
-+ if (unlikely(p->brute)) {
-+ if (!grsec_enable_brute)
-+ p->brute = 0;
-+ else if (time_before(get_seconds(), p->brute_expires))
-+ msleep(30 * 1000);
-+ }
-+#endif
-+ return;
-+}
-+
-+void gr_handle_kernel_exploit(void)
-+{
-+#ifdef CONFIG_GRKERNSEC_KERN_LOCKOUT
-+ const struct cred *cred;
-+ struct task_struct *tsk, *tsk2;
-+ struct user_struct *user;
-+ uid_t uid;
-+
-+ if (in_irq() || in_serving_softirq() || in_nmi())
-+ panic("grsec: halting the system due to suspicious kernel crash caused in interrupt context");
-+
-+ uid = current_uid();
-+
-+ if (uid == 0)
-+ panic("grsec: halting the system due to suspicious kernel crash caused by root");
-+ else {
-+ /* kill all the processes of this user, hold a reference
-+ to their creds struct, and prevent them from creating
-+ another process until system reset
-+ */
-+ printk(KERN_ALERT "grsec: banning user with uid %u until system restart for suspicious kernel crash\n", uid);
-+ /* we intentionally leak this ref */
-+ user = get_uid(current->cred->user);
-+ if (user) {
-+ user->banned = 1;
-+ user->ban_expires = ~0UL;
-+ }
-+
-+ read_lock(&tasklist_lock);
-+ do_each_thread(tsk2, tsk) {
-+ cred = __task_cred(tsk);
-+ if (cred->uid == uid)
-+ gr_fake_force_sig(SIGKILL, tsk);
-+ } while_each_thread(tsk2, tsk);
-+ read_unlock(&tasklist_lock);
-+ }
-+#endif
-+}
-+
-+int __gr_process_user_ban(struct user_struct *user)
-+{
-+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
-+ if (unlikely(user->banned)) {
-+ if (user->ban_expires != ~0UL && time_after_eq(get_seconds(), user->ban_expires)) {
-+ user->banned = 0;
-+ user->ban_expires = 0;
-+ free_uid(user);
-+ } else
-+ return -EPERM;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+int gr_process_user_ban(void)
-+{
-+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
-+ return __gr_process_user_ban(current->cred->user);
-+#endif
-+ return 0;
-+}
-diff --git a/grsecurity/grsec_sock.c b/grsecurity/grsec_sock.c
-new file mode 100644
-index 0000000..7512ea9
---- /dev/null
-+++ b/grsecurity/grsec_sock.c
-@@ -0,0 +1,275 @@
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/net.h>
-+#include <linux/in.h>
-+#include <linux/ip.h>
-+#include <net/sock.h>
-+#include <net/inet_sock.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+#include <linux/gracl.h>
-+
-+kernel_cap_t gr_cap_rtnetlink(struct sock *sock);
-+EXPORT_SYMBOL(gr_cap_rtnetlink);
-+
-+extern int gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb);
-+extern int gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr);
-+
-+EXPORT_SYMBOL(gr_search_udp_recvmsg);
-+EXPORT_SYMBOL(gr_search_udp_sendmsg);
-+
-+#ifdef CONFIG_UNIX_MODULE
-+EXPORT_SYMBOL(gr_acl_handle_unix);
-+EXPORT_SYMBOL(gr_acl_handle_mknod);
-+EXPORT_SYMBOL(gr_handle_chroot_unix);
-+EXPORT_SYMBOL(gr_handle_create);
-+#endif
-+
-+#ifdef CONFIG_GRKERNSEC
-+#define gr_conn_table_size 32749
-+struct conn_table_entry {
-+ struct conn_table_entry *next;
-+ struct signal_struct *sig;
-+};
-+
-+struct conn_table_entry *gr_conn_table[gr_conn_table_size];
-+DEFINE_SPINLOCK(gr_conn_table_lock);
-+
-+extern const char * gr_socktype_to_name(unsigned char type);
-+extern const char * gr_proto_to_name(unsigned char proto);
-+extern const char * gr_sockfamily_to_name(unsigned char family);
-+
-+static __inline__ int
-+conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
-+{
-+ return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
-+}
-+
-+static __inline__ int
-+conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr,
-+ __u16 sport, __u16 dport)
-+{
-+ if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
-+ sig->gr_sport == sport && sig->gr_dport == dport))
-+ return 1;
-+ else
-+ return 0;
-+}
-+
-+static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
-+{
-+ struct conn_table_entry **match;
-+ unsigned int index;
-+
-+ index = conn_hash(sig->gr_saddr, sig->gr_daddr,
-+ sig->gr_sport, sig->gr_dport,
-+ gr_conn_table_size);
-+
-+ newent->sig = sig;
-+
-+ match = &gr_conn_table[index];
-+ newent->next = *match;
-+ *match = newent;
-+
-+ return;
-+}
-+
-+static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
-+{
-+ struct conn_table_entry *match, *last = NULL;
-+ unsigned int index;
-+
-+ index = conn_hash(sig->gr_saddr, sig->gr_daddr,
-+ sig->gr_sport, sig->gr_dport,
-+ gr_conn_table_size);
-+
-+ match = gr_conn_table[index];
-+ while (match && !conn_match(match->sig,
-+ sig->gr_saddr, sig->gr_daddr, sig->gr_sport,
-+ sig->gr_dport)) {
-+ last = match;
-+ match = match->next;
-+ }
-+
-+ if (match) {
-+ if (last)
-+ last->next = match->next;
-+ else
-+ gr_conn_table[index] = NULL;
-+ kfree(match);
-+ }
-+
-+ return;
-+}
-+
-+static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
-+ __u16 sport, __u16 dport)
-+{
-+ struct conn_table_entry *match;
-+ unsigned int index;
-+
-+ index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
-+
-+ match = gr_conn_table[index];
-+ while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
-+ match = match->next;
-+
-+ if (match)
-+ return match->sig;
-+ else
-+ return NULL;
-+}
-+
-+#endif
-+
-+void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+ struct signal_struct *sig = task->signal;
-+ struct conn_table_entry *newent;
-+
-+ newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
-+ if (newent == NULL)
-+ return;
-+ /* no bh lock needed since we are called with bh disabled */
-+ spin_lock(&gr_conn_table_lock);
-+ gr_del_task_from_ip_table_nolock(sig);
-+ sig->gr_saddr = inet->rcv_saddr;
-+ sig->gr_daddr = inet->daddr;
-+ sig->gr_sport = inet->sport;
-+ sig->gr_dport = inet->dport;
-+ gr_add_to_task_ip_table_nolock(sig, newent);
-+ spin_unlock(&gr_conn_table_lock);
-+#endif
-+ return;
-+}
-+
-+void gr_del_task_from_ip_table(struct task_struct *task)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+ spin_lock_bh(&gr_conn_table_lock);
-+ gr_del_task_from_ip_table_nolock(task->signal);
-+ spin_unlock_bh(&gr_conn_table_lock);
-+#endif
-+ return;
-+}
-+
-+void
-+gr_attach_curr_ip(const struct sock *sk)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+ struct signal_struct *p, *set;
-+ const struct inet_sock *inet = inet_sk(sk);
-+
-+ if (unlikely(sk->sk_protocol != IPPROTO_TCP))
-+ return;
-+
-+ set = current->signal;
-+
-+ spin_lock_bh(&gr_conn_table_lock);
-+ p = gr_lookup_task_ip_table(inet->daddr, inet->rcv_saddr,
-+ inet->dport, inet->sport);
-+ if (unlikely(p != NULL)) {
-+ set->curr_ip = p->curr_ip;
-+ set->used_accept = 1;
-+ gr_del_task_from_ip_table_nolock(p);
-+ spin_unlock_bh(&gr_conn_table_lock);
-+ return;
-+ }
-+ spin_unlock_bh(&gr_conn_table_lock);
-+
-+ set->curr_ip = inet->daddr;
-+ set->used_accept = 1;
-+#endif
-+ return;
-+}
-+
-+int
-+gr_handle_sock_all(const int family, const int type, const int protocol)
-+{
-+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
-+ if (grsec_enable_socket_all && in_group_p(grsec_socket_all_gid) &&
-+ (family != AF_UNIX)) {
-+ if (family == AF_INET)
-+ gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), gr_proto_to_name(protocol));
-+ else
-+ gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), protocol);
-+ return -EACCES;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_handle_sock_server(const struct sockaddr *sck)
-+{
-+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
-+ if (grsec_enable_socket_server &&
-+ in_group_p(grsec_socket_server_gid) &&
-+ sck && (sck->sa_family != AF_UNIX) &&
-+ (sck->sa_family != AF_LOCAL)) {
-+ gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
-+ return -EACCES;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_handle_sock_server_other(const struct sock *sck)
-+{
-+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
-+ if (grsec_enable_socket_server &&
-+ in_group_p(grsec_socket_server_gid) &&
-+ sck && (sck->sk_family != AF_UNIX) &&
-+ (sck->sk_family != AF_LOCAL)) {
-+ gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
-+ return -EACCES;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_handle_sock_client(const struct sockaddr *sck)
-+{
-+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
-+ if (grsec_enable_socket_client && in_group_p(grsec_socket_client_gid) &&
-+ sck && (sck->sa_family != AF_UNIX) &&
-+ (sck->sa_family != AF_LOCAL)) {
-+ gr_log_noargs(GR_DONT_AUDIT, GR_CONNECT_MSG);
-+ return -EACCES;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+kernel_cap_t
-+gr_cap_rtnetlink(struct sock *sock)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+ if (!gr_acl_is_enabled())
-+ return current_cap();
-+ else if (sock->sk_protocol == NETLINK_ISCSI &&
-+ cap_raised(current_cap(), CAP_SYS_ADMIN) &&
-+ gr_is_capable(CAP_SYS_ADMIN))
-+ return current_cap();
-+ else if (sock->sk_protocol == NETLINK_AUDIT &&
-+ cap_raised(current_cap(), CAP_AUDIT_WRITE) &&
-+ gr_is_capable(CAP_AUDIT_WRITE) &&
-+ cap_raised(current_cap(), CAP_AUDIT_CONTROL) &&
-+ gr_is_capable(CAP_AUDIT_CONTROL))
-+ return current_cap();
-+ else if (cap_raised(current_cap(), CAP_NET_ADMIN) &&
-+ ((sock->sk_protocol == NETLINK_ROUTE) ?
-+ gr_is_capable_nolog(CAP_NET_ADMIN) :
-+ gr_is_capable(CAP_NET_ADMIN)))
-+ return current_cap();
-+ else
-+ return __cap_empty_set;
-+#else
-+ return current_cap();
-+#endif
-+}
-diff --git a/grsecurity/grsec_sysctl.c b/grsecurity/grsec_sysctl.c
-new file mode 100644
-index 0000000..f33decd
---- /dev/null
-+++ b/grsecurity/grsec_sysctl.c
-@@ -0,0 +1,517 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/sysctl.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+int
-+gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
-+{
-+#ifdef CONFIG_GRKERNSEC_SYSCTL
-+ if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & MAY_WRITE)) {
-+ gr_log_str(GR_DONT_AUDIT, GR_SYSCTL_MSG, name);
-+ return -EACCES;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+#ifdef CONFIG_GRKERNSEC_ROFS
-+static int __maybe_unused one = 1;
-+#endif
-+
-+#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
-+ctl_table grsecurity_table[] = {
-+#ifdef CONFIG_GRKERNSEC_SYSCTL
-+#ifdef CONFIG_GRKERNSEC_SYSCTL_DISTRO
-+#ifdef CONFIG_GRKERNSEC_IO
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "disable_priv_io",
-+ .data = &grsec_disable_privio,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#endif
-+#ifdef CONFIG_GRKERNSEC_LINK
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "linking_restrictions",
-+ .data = &grsec_enable_link,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SYMLINKOWN
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "enforce_symlinksifowner",
-+ .data = &grsec_enable_symlinkown,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "symlinkown_gid",
-+ .data = &grsec_symlinkown_gid,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_BRUTE
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "deter_bruteforce",
-+ .data = &grsec_enable_brute,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_FIFO
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "fifo_restrictions",
-+ .data = &grsec_enable_fifo,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_PTRACE_READEXEC
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "ptrace_readexec",
-+ .data = &grsec_enable_ptrace_readexec,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "consistent_setxid",
-+ .data = &grsec_enable_setxid,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "ip_blackhole",
-+ .data = &grsec_enable_blackhole,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "lastack_retries",
-+ .data = &grsec_lastack_retries,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_EXECLOG
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "exec_logging",
-+ .data = &grsec_enable_execlog,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "rwxmap_logging",
-+ .data = &grsec_enable_log_rwxmaps,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SIGNAL
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "signal_logging",
-+ .data = &grsec_enable_signal,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_FORKFAIL
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "forkfail_logging",
-+ .data = &grsec_enable_forkfail,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_TIME
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "timechange_logging",
-+ .data = &grsec_enable_time,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_deny_shmat",
-+ .data = &grsec_enable_chroot_shmat,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_deny_unix",
-+ .data = &grsec_enable_chroot_unix,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_deny_mount",
-+ .data = &grsec_enable_chroot_mount,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_deny_fchdir",
-+ .data = &grsec_enable_chroot_fchdir,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_deny_chroot",
-+ .data = &grsec_enable_chroot_double,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_deny_pivot",
-+ .data = &grsec_enable_chroot_pivot,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_enforce_chdir",
-+ .data = &grsec_enable_chroot_chdir,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_deny_chmod",
-+ .data = &grsec_enable_chroot_chmod,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_deny_mknod",
-+ .data = &grsec_enable_chroot_mknod,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_restrict_nice",
-+ .data = &grsec_enable_chroot_nice,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_execlog",
-+ .data = &grsec_enable_chroot_execlog,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_caps",
-+ .data = &grsec_enable_chroot_caps,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_deny_sysctl",
-+ .data = &grsec_enable_chroot_sysctl,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_TPE
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "tpe",
-+ .data = &grsec_enable_tpe,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "tpe_gid",
-+ .data = &grsec_tpe_gid,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "tpe_invert",
-+ .data = &grsec_enable_tpe_invert,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_TPE_ALL
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "tpe_restrict_all",
-+ .data = &grsec_enable_tpe_all,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "socket_all",
-+ .data = &grsec_enable_socket_all,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "socket_all_gid",
-+ .data = &grsec_socket_all_gid,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "socket_client",
-+ .data = &grsec_enable_socket_client,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "socket_client_gid",
-+ .data = &grsec_socket_client_gid,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "socket_server",
-+ .data = &grsec_enable_socket_server,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "socket_server_gid",
-+ .data = &grsec_socket_server_gid,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "audit_group",
-+ .data = &grsec_enable_group,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "audit_gid",
-+ .data = &grsec_audit_gid,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "audit_chdir",
-+ .data = &grsec_enable_chdir,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "audit_mount",
-+ .data = &grsec_enable_mount,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "audit_textrel",
-+ .data = &grsec_enable_audit_textrel,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_DMESG
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "dmesg",
-+ .data = &grsec_enable_dmesg,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_findtask",
-+ .data = &grsec_enable_chroot_findtask,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_RESLOG
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "resource_logging",
-+ .data = &grsec_resource_logging,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "audit_ptrace",
-+ .data = &grsec_enable_audit_ptrace,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "harden_ptrace",
-+ .data = &grsec_enable_harden_ptrace,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "grsec_lock",
-+ .data = &grsec_lock,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_ROFS
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "romount_protect",
-+ .data = &grsec_enable_rofs,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec_minmax,
-+ .extra1 = &one,
-+ .extra2 = &one,
-+ },
-+#endif
-+ { .ctl_name = 0 }
-+};
-+#endif
-diff --git a/grsecurity/grsec_time.c b/grsecurity/grsec_time.c
-new file mode 100644
-index 0000000..0dc13c3
---- /dev/null
-+++ b/grsecurity/grsec_time.c
-@@ -0,0 +1,16 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/grinternal.h>
-+#include <linux/module.h>
-+
-+void
-+gr_log_timechange(void)
-+{
-+#ifdef CONFIG_GRKERNSEC_TIME
-+ if (grsec_enable_time)
-+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_TIME_MSG);
-+#endif
-+ return;
-+}
-+
-+EXPORT_SYMBOL(gr_log_timechange);
-diff --git a/grsecurity/grsec_tpe.c b/grsecurity/grsec_tpe.c
-new file mode 100644
-index 0000000..07e0dc0
---- /dev/null
-+++ b/grsecurity/grsec_tpe.c
-@@ -0,0 +1,73 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/grinternal.h>
-+
-+extern int gr_acl_tpe_check(void);
-+
-+int
-+gr_tpe_allow(const struct file *file)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+ struct inode *inode = file->f_path.dentry->d_parent->d_inode;
-+ const struct cred *cred = current_cred();
-+ char *msg = NULL;
-+ char *msg2 = NULL;
-+
-+ // never restrict root
-+ if (!cred->uid)
-+ return 1;
-+
-+ if (grsec_enable_tpe) {
-+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
-+ if (grsec_enable_tpe_invert && !in_group_p(grsec_tpe_gid))
-+ msg = "not being in trusted group";
-+ else if (!grsec_enable_tpe_invert && in_group_p(grsec_tpe_gid))
-+ msg = "being in untrusted group";
-+#else
-+ if (in_group_p(grsec_tpe_gid))
-+ msg = "being in untrusted group";
-+#endif
-+ }
-+ if (!msg && gr_acl_tpe_check())
-+ msg = "being in untrusted role";
-+
-+ // not in any affected group/role
-+ if (!msg)
-+ goto next_check;
-+
-+ if (inode->i_uid)
-+ msg2 = "file in non-root-owned directory";
-+ else if (inode->i_mode & S_IWOTH)
-+ msg2 = "file in world-writable directory";
-+ else if (inode->i_mode & S_IWGRP)
-+ msg2 = "file in group-writable directory";
-+
-+ if (msg && msg2) {
-+ char fullmsg[70] = {0};
-+ snprintf(fullmsg, sizeof(fullmsg)-1, "%s and %s", msg, msg2);
-+ gr_log_str_fs(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, fullmsg, file->f_path.dentry, file->f_path.mnt);
-+ return 0;
-+ }
-+ msg = NULL;
-+next_check:
-+#ifdef CONFIG_GRKERNSEC_TPE_ALL
-+ if (!grsec_enable_tpe || !grsec_enable_tpe_all)
-+ return 1;
-+
-+ if (inode->i_uid && (inode->i_uid != cred->uid))
-+ msg = "directory not owned by user";
-+ else if (inode->i_mode & S_IWOTH)
-+ msg = "file in world-writable directory";
-+ else if (inode->i_mode & S_IWGRP)
-+ msg = "file in group-writable directory";
-+
-+ if (msg) {
-+ gr_log_str_fs(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, msg, file->f_path.dentry, file->f_path.mnt);
-+ return 0;
-+ }
-+#endif
-+#endif
-+ return 1;
-+}
-diff --git a/grsecurity/grsum.c b/grsecurity/grsum.c
-new file mode 100644
-index 0000000..9f7b1ac
---- /dev/null
-+++ b/grsecurity/grsum.c
-@@ -0,0 +1,61 @@
-+#include <linux/err.h>
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/mm.h>
-+#include <linux/scatterlist.h>
-+#include <linux/crypto.h>
-+#include <linux/gracl.h>
-+
-+
-+#if !defined(CONFIG_CRYPTO) || defined(CONFIG_CRYPTO_MODULE) || !defined(CONFIG_CRYPTO_SHA256) || defined(CONFIG_CRYPTO_SHA256_MODULE)
-+#error "crypto and sha256 must be built into the kernel"
-+#endif
-+
-+int
-+chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum)
-+{
-+ char *p;
-+ struct crypto_hash *tfm;
-+ struct hash_desc desc;
-+ struct scatterlist sg;
-+ unsigned char temp_sum[GR_SHA_LEN];
-+ volatile int retval = 0;
-+ volatile int dummy = 0;
-+ unsigned int i;
-+
-+ sg_init_table(&sg, 1);
-+
-+ tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
-+ if (IS_ERR(tfm)) {
-+ /* should never happen, since sha256 should be built in */
-+ return 1;
-+ }
-+
-+ desc.tfm = tfm;
-+ desc.flags = 0;
-+
-+ crypto_hash_init(&desc);
-+
-+ p = salt;
-+ sg_set_buf(&sg, p, GR_SALT_LEN);
-+ crypto_hash_update(&desc, &sg, sg.length);
-+
-+ p = entry->pw;
-+ sg_set_buf(&sg, p, strlen(p));
-+
-+ crypto_hash_update(&desc, &sg, sg.length);
-+
-+ crypto_hash_final(&desc, temp_sum);
-+
-+ memset(entry->pw, 0, GR_PW_LEN);
-+
-+ for (i = 0; i < GR_SHA_LEN; i++)
-+ if (sum[i] != temp_sum[i])
-+ retval = 1;
-+ else
-+ dummy = 1; // waste a cycle
-+
-+ crypto_free_hash(tfm);
-+
-+ return retval;
-+}
-diff --git a/include/acpi/acpi_drivers.h b/include/acpi/acpi_drivers.h
-index f4906f6..71feb73 100644
---- a/include/acpi/acpi_drivers.h
-+++ b/include/acpi/acpi_drivers.h
-@@ -119,8 +119,8 @@ int acpi_processor_set_thermal_limit(acpi_handle handle, int type);
- Dock Station
- -------------------------------------------------------------------------- */
- struct acpi_dock_ops {
-- acpi_notify_handler handler;
-- acpi_notify_handler uevent;
-+ const acpi_notify_handler handler;
-+ const acpi_notify_handler uevent;
- };
-
- #if defined(CONFIG_ACPI_DOCK) || defined(CONFIG_ACPI_DOCK_MODULE)
-@@ -128,7 +128,7 @@ extern int is_dock_device(acpi_handle handle);
- extern int register_dock_notifier(struct notifier_block *nb);
- extern void unregister_dock_notifier(struct notifier_block *nb);
- extern int register_hotplug_dock_device(acpi_handle handle,
-- struct acpi_dock_ops *ops,
-+ const struct acpi_dock_ops *ops,
- void *context);
- extern void unregister_hotplug_dock_device(acpi_handle handle);
- #else
-@@ -144,7 +144,7 @@ static inline void unregister_dock_notifier(struct notifier_block *nb)
- {
- }
- static inline int register_hotplug_dock_device(acpi_handle handle,
-- struct acpi_dock_ops *ops,
-+ const struct acpi_dock_ops *ops,
- void *context)
- {
- return -ENODEV;
-diff --git a/include/asm-generic/4level-fixup.h b/include/asm-generic/4level-fixup.h
-index 77ff547..181834f 100644
---- a/include/asm-generic/4level-fixup.h
-+++ b/include/asm-generic/4level-fixup.h
-@@ -13,8 +13,10 @@
- #define pmd_alloc(mm, pud, address) \
- ((unlikely(pgd_none(*(pud))) && __pmd_alloc(mm, pud, address))? \
- NULL: pmd_offset(pud, address))
-+#define pmd_alloc_kernel(mm, pud, address) pmd_alloc((mm), (pud), (address))
-
- #define pud_alloc(mm, pgd, address) (pgd)
-+#define pud_alloc_kernel(mm, pgd, address) pud_alloc((mm), (pgd), (address))
- #define pud_offset(pgd, start) (pgd)
- #define pud_none(pud) 0
- #define pud_bad(pud) 0
-diff --git a/include/asm-generic/atomic-long.h b/include/asm-generic/atomic-long.h
-index b7babf0..755fb22 100644
---- a/include/asm-generic/atomic-long.h
-+++ b/include/asm-generic/atomic-long.h
-@@ -22,6 +22,12 @@
-
- typedef atomic64_t atomic_long_t;
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+typedef atomic64_unchecked_t atomic_long_unchecked_t;
-+#else
-+typedef atomic64_t atomic_long_unchecked_t;
-+#endif
-+
- #define ATOMIC_LONG_INIT(i) ATOMIC64_INIT(i)
-
- static inline long atomic_long_read(atomic_long_t *l)
-@@ -31,6 +37,15 @@ static inline long atomic_long_read(atomic_long_t *l)
- return (long)atomic64_read(v);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
-+{
-+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
-+
-+ return (long)atomic64_read_unchecked(v);
-+}
-+#endif
-+
- static inline void atomic_long_set(atomic_long_t *l, long i)
- {
- atomic64_t *v = (atomic64_t *)l;
-@@ -38,6 +53,15 @@ static inline void atomic_long_set(atomic_long_t *l, long i)
- atomic64_set(v, i);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
-+{
-+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
-+
-+ atomic64_set_unchecked(v, i);
-+}
-+#endif
-+
- static inline void atomic_long_inc(atomic_long_t *l)
- {
- atomic64_t *v = (atomic64_t *)l;
-@@ -45,6 +69,15 @@ static inline void atomic_long_inc(atomic_long_t *l)
- atomic64_inc(v);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
-+{
-+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
-+
-+ atomic64_inc_unchecked(v);
-+}
-+#endif
-+
- static inline void atomic_long_dec(atomic_long_t *l)
- {
- atomic64_t *v = (atomic64_t *)l;
-@@ -52,6 +85,15 @@ static inline void atomic_long_dec(atomic_long_t *l)
- atomic64_dec(v);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
-+{
-+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
-+
-+ atomic64_dec_unchecked(v);
-+}
-+#endif
-+
- static inline void atomic_long_add(long i, atomic_long_t *l)
- {
- atomic64_t *v = (atomic64_t *)l;
-@@ -59,6 +101,15 @@ static inline void atomic_long_add(long i, atomic_long_t *l)
- atomic64_add(i, v);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
-+{
-+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
-+
-+ atomic64_add_unchecked(i, v);
-+}
-+#endif
-+
- static inline void atomic_long_sub(long i, atomic_long_t *l)
- {
- atomic64_t *v = (atomic64_t *)l;
-@@ -101,6 +152,15 @@ static inline long atomic_long_add_return(long i, atomic_long_t *l)
- return (long)atomic64_add_return(i, v);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline long atomic_long_add_return_unchecked(long i, atomic_long_unchecked_t *l)
-+{
-+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
-+
-+ return (long)atomic64_add_return_unchecked(i, v);
-+}
-+#endif
-+
- static inline long atomic_long_sub_return(long i, atomic_long_t *l)
- {
- atomic64_t *v = (atomic64_t *)l;
-@@ -115,6 +175,15 @@ static inline long atomic_long_inc_return(atomic_long_t *l)
- return (long)atomic64_inc_return(v);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
-+{
-+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
-+
-+ return (long)atomic64_inc_return_unchecked(v);
-+}
-+#endif
-+
- static inline long atomic_long_dec_return(atomic_long_t *l)
- {
- atomic64_t *v = (atomic64_t *)l;
-@@ -140,6 +209,12 @@ static inline long atomic_long_add_unless(atomic_long_t *l, long a, long u)
-
- typedef atomic_t atomic_long_t;
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+typedef atomic_unchecked_t atomic_long_unchecked_t;
-+#else
-+typedef atomic_t atomic_long_unchecked_t;
-+#endif
-+
- #define ATOMIC_LONG_INIT(i) ATOMIC_INIT(i)
- static inline long atomic_long_read(atomic_long_t *l)
- {
-@@ -148,6 +223,15 @@ static inline long atomic_long_read(atomic_long_t *l)
- return (long)atomic_read(v);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
-+{
-+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
-+
-+ return (long)atomic_read_unchecked(v);
-+}
-+#endif
-+
- static inline void atomic_long_set(atomic_long_t *l, long i)
- {
- atomic_t *v = (atomic_t *)l;
-@@ -155,6 +239,15 @@ static inline void atomic_long_set(atomic_long_t *l, long i)
- atomic_set(v, i);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
-+{
-+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
-+
-+ atomic_set_unchecked(v, i);
-+}
-+#endif
-+
- static inline void atomic_long_inc(atomic_long_t *l)
- {
- atomic_t *v = (atomic_t *)l;
-@@ -162,6 +255,15 @@ static inline void atomic_long_inc(atomic_long_t *l)
- atomic_inc(v);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
-+{
-+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
-+
-+ atomic_inc_unchecked(v);
-+}
-+#endif
-+
- static inline void atomic_long_dec(atomic_long_t *l)
- {
- atomic_t *v = (atomic_t *)l;
-@@ -169,6 +271,15 @@ static inline void atomic_long_dec(atomic_long_t *l)
- atomic_dec(v);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
-+{
-+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
-+
-+ atomic_dec_unchecked(v);
-+}
-+#endif
-+
- static inline void atomic_long_add(long i, atomic_long_t *l)
- {
- atomic_t *v = (atomic_t *)l;
-@@ -176,6 +287,15 @@ static inline void atomic_long_add(long i, atomic_long_t *l)
- atomic_add(i, v);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
-+{
-+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
-+
-+ atomic_add_unchecked(i, v);
-+}
-+#endif
-+
- static inline void atomic_long_sub(long i, atomic_long_t *l)
- {
- atomic_t *v = (atomic_t *)l;
-@@ -218,6 +338,16 @@ static inline long atomic_long_add_return(long i, atomic_long_t *l)
- return (long)atomic_add_return(i, v);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline long atomic_long_add_return_unchecked(long i, atomic_long_unchecked_t *l)
-+{
-+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
-+
-+ return (long)atomic_add_return_unchecked(i, v);
-+}
-+
-+#endif
-+
- static inline long atomic_long_sub_return(long i, atomic_long_t *l)
- {
- atomic_t *v = (atomic_t *)l;
-@@ -232,6 +362,15 @@ static inline long atomic_long_inc_return(atomic_long_t *l)
- return (long)atomic_inc_return(v);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
-+{
-+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
-+
-+ return (long)atomic_inc_return_unchecked(v);
-+}
-+#endif
-+
- static inline long atomic_long_dec_return(atomic_long_t *l)
- {
- atomic_t *v = (atomic_t *)l;
-@@ -255,4 +394,55 @@ static inline long atomic_long_add_unless(atomic_long_t *l, long a, long u)
-
- #endif /* BITS_PER_LONG == 64 */
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void pax_refcount_needs_these_functions(void)
-+{
-+ atomic_read_unchecked((atomic_unchecked_t *)NULL);
-+ atomic_set_unchecked((atomic_unchecked_t *)NULL, 0);
-+ atomic_add_unchecked(0, (atomic_unchecked_t *)NULL);
-+ atomic_sub_unchecked(0, (atomic_unchecked_t *)NULL);
-+ atomic_inc_unchecked((atomic_unchecked_t *)NULL);
-+ (void)atomic_inc_and_test_unchecked((atomic_unchecked_t *)NULL);
-+ atomic_inc_return_unchecked((atomic_unchecked_t *)NULL);
-+ atomic_add_return_unchecked(0, (atomic_unchecked_t *)NULL);
-+ atomic_dec_unchecked((atomic_unchecked_t *)NULL);
-+ atomic_cmpxchg_unchecked((atomic_unchecked_t *)NULL, 0, 0);
-+ (void)atomic_xchg_unchecked((atomic_unchecked_t *)NULL, 0);
-+#ifdef CONFIG_X86
-+ atomic_clear_mask_unchecked(0, NULL);
-+ atomic_set_mask_unchecked(0, NULL);
-+#endif
-+
-+ atomic_long_read_unchecked((atomic_long_unchecked_t *)NULL);
-+ atomic_long_set_unchecked((atomic_long_unchecked_t *)NULL, 0);
-+ atomic_long_add_unchecked(0, (atomic_long_unchecked_t *)NULL);
-+ atomic_long_inc_unchecked((atomic_long_unchecked_t *)NULL);
-+ atomic_long_add_return_unchecked(0, (atomic_long_unchecked_t *)NULL);
-+ atomic_long_inc_return_unchecked((atomic_long_unchecked_t *)NULL);
-+ atomic_long_dec_unchecked((atomic_long_unchecked_t *)NULL);
-+}
-+#else
-+#define atomic_read_unchecked(v) atomic_read(v)
-+#define atomic_set_unchecked(v, i) atomic_set((v), (i))
-+#define atomic_add_unchecked(i, v) atomic_add((i), (v))
-+#define atomic_sub_unchecked(i, v) atomic_sub((i), (v))
-+#define atomic_inc_unchecked(v) atomic_inc(v)
-+#define atomic_inc_and_test_unchecked(v) atomic_inc_and_test(v)
-+#define atomic_inc_return_unchecked(v) atomic_inc_return(v)
-+#define atomic_add_return_unchecked(i, v) atomic_add_return((i), (v))
-+#define atomic_dec_unchecked(v) atomic_dec(v)
-+#define atomic_cmpxchg_unchecked(v, o, n) atomic_cmpxchg((v), (o), (n))
-+#define atomic_xchg_unchecked(v, i) atomic_xchg((v), (i))
-+#define atomic_clear_mask_unchecked(mask, v) atomic_clear_mask((mask), (v))
-+#define atomic_set_mask_unchecked(mask, v) atomic_set_mask((mask), (v))
-+
-+#define atomic_long_read_unchecked(v) atomic_long_read(v)
-+#define atomic_long_set_unchecked(v, i) atomic_long_set((v), (i))
-+#define atomic_long_add_unchecked(i, v) atomic_long_add((i), (v))
-+#define atomic_long_inc_unchecked(v) atomic_long_inc(v)
-+#define atomic_long_add_return_unchecked(i, v) atomic_long_add_return((i), (v))
-+#define atomic_long_inc_return_unchecked(v) atomic_long_inc_return(v)
-+#define atomic_long_dec_unchecked(v) atomic_long_dec(v)
-+#endif
-+
- #endif /* _ASM_GENERIC_ATOMIC_LONG_H */
-diff --git a/include/asm-generic/atomic.h b/include/asm-generic/atomic.h
-index c99c64d..f173e40 100644
---- a/include/asm-generic/atomic.h
-+++ b/include/asm-generic/atomic.h
-@@ -134,7 +134,7 @@ static inline void atomic_dec(atomic_t *v)
-
- #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
-
--static inline void atomic_clear_mask(unsigned long mask, unsigned long *addr)
-+static inline void atomic_clear_mask(unsigned int mask, atomic_t *v)
- {
- unsigned long flags;
-
-diff --git a/include/asm-generic/atomic64.h b/include/asm-generic/atomic64.h
-index b18ce4f..2ee2843 100644
---- a/include/asm-generic/atomic64.h
-+++ b/include/asm-generic/atomic64.h
-@@ -16,6 +16,8 @@ typedef struct {
- long long counter;
- } atomic64_t;
-
-+typedef atomic64_t atomic64_unchecked_t;
-+
- #define ATOMIC64_INIT(i) { (i) }
-
- extern long long atomic64_read(const atomic64_t *v);
-@@ -39,4 +41,14 @@ extern int atomic64_add_unless(atomic64_t *v, long long a, long long u);
- #define atomic64_dec_and_test(v) (atomic64_dec_return((v)) == 0)
- #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1LL, 0LL)
-
-+#define atomic64_read_unchecked(v) atomic64_read(v)
-+#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
-+#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
-+#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
-+#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
-+#define atomic64_inc_unchecked(v) atomic64_inc(v)
-+#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
-+#define atomic64_dec_unchecked(v) atomic64_dec(v)
-+#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
-+
- #endif /* _ASM_GENERIC_ATOMIC64_H */
-diff --git a/include/asm-generic/bug.h b/include/asm-generic/bug.h
-index d48ddf0..656a0ac 100644
---- a/include/asm-generic/bug.h
-+++ b/include/asm-generic/bug.h
-@@ -105,11 +105,11 @@ extern void warn_slowpath_null(const char *file, const int line);
-
- #else /* !CONFIG_BUG */
- #ifndef HAVE_ARCH_BUG
--#define BUG() do {} while(0)
-+#define BUG() do { for (;;) ; } while(0)
- #endif
-
- #ifndef HAVE_ARCH_BUG_ON
--#define BUG_ON(condition) do { if (condition) ; } while(0)
-+#define BUG_ON(condition) do { if (condition) for (;;) ; } while(0)
- #endif
-
- #ifndef HAVE_ARCH_WARN_ON
-diff --git a/include/asm-generic/cache.h b/include/asm-generic/cache.h
-index 1bfcfe5..e04c5c9 100644
---- a/include/asm-generic/cache.h
-+++ b/include/asm-generic/cache.h
-@@ -6,7 +6,7 @@
- * cache lines need to provide their own cache.h.
- */
-
--#define L1_CACHE_SHIFT 5
--#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_SHIFT 5UL
-+#define L1_CACHE_BYTES (1UL << L1_CACHE_SHIFT)
-
- #endif /* __ASM_GENERIC_CACHE_H */
-diff --git a/include/asm-generic/dma-mapping-common.h b/include/asm-generic/dma-mapping-common.h
-index 6920695..41038bc 100644
---- a/include/asm-generic/dma-mapping-common.h
-+++ b/include/asm-generic/dma-mapping-common.h
-@@ -11,7 +11,7 @@ static inline dma_addr_t dma_map_single_attrs(struct device *dev, void *ptr,
- enum dma_data_direction dir,
- struct dma_attrs *attrs)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
- dma_addr_t addr;
-
- kmemcheck_mark_initialized(ptr, size);
-@@ -30,7 +30,7 @@ static inline void dma_unmap_single_attrs(struct device *dev, dma_addr_t addr,
- enum dma_data_direction dir,
- struct dma_attrs *attrs)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- BUG_ON(!valid_dma_direction(dir));
- if (ops->unmap_page)
-@@ -42,7 +42,7 @@ static inline int dma_map_sg_attrs(struct device *dev, struct scatterlist *sg,
- int nents, enum dma_data_direction dir,
- struct dma_attrs *attrs)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
- int i, ents;
- struct scatterlist *s;
-
-@@ -59,7 +59,7 @@ static inline void dma_unmap_sg_attrs(struct device *dev, struct scatterlist *sg
- int nents, enum dma_data_direction dir,
- struct dma_attrs *attrs)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- BUG_ON(!valid_dma_direction(dir));
- debug_dma_unmap_sg(dev, sg, nents, dir);
-@@ -71,7 +71,7 @@ static inline dma_addr_t dma_map_page(struct device *dev, struct page *page,
- size_t offset, size_t size,
- enum dma_data_direction dir)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
- dma_addr_t addr;
-
- kmemcheck_mark_initialized(page_address(page) + offset, size);
-@@ -85,7 +85,7 @@ static inline dma_addr_t dma_map_page(struct device *dev, struct page *page,
- static inline void dma_unmap_page(struct device *dev, dma_addr_t addr,
- size_t size, enum dma_data_direction dir)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- BUG_ON(!valid_dma_direction(dir));
- if (ops->unmap_page)
-@@ -97,7 +97,7 @@ static inline void dma_sync_single_for_cpu(struct device *dev, dma_addr_t addr,
- size_t size,
- enum dma_data_direction dir)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- BUG_ON(!valid_dma_direction(dir));
- if (ops->sync_single_for_cpu)
-@@ -109,7 +109,7 @@ static inline void dma_sync_single_for_device(struct device *dev,
- dma_addr_t addr, size_t size,
- enum dma_data_direction dir)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- BUG_ON(!valid_dma_direction(dir));
- if (ops->sync_single_for_device)
-@@ -123,7 +123,7 @@ static inline void dma_sync_single_range_for_cpu(struct device *dev,
- size_t size,
- enum dma_data_direction dir)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- BUG_ON(!valid_dma_direction(dir));
- if (ops->sync_single_range_for_cpu) {
-@@ -140,7 +140,7 @@ static inline void dma_sync_single_range_for_device(struct device *dev,
- size_t size,
- enum dma_data_direction dir)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- BUG_ON(!valid_dma_direction(dir));
- if (ops->sync_single_range_for_device) {
-@@ -155,7 +155,7 @@ static inline void
- dma_sync_sg_for_cpu(struct device *dev, struct scatterlist *sg,
- int nelems, enum dma_data_direction dir)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- BUG_ON(!valid_dma_direction(dir));
- if (ops->sync_sg_for_cpu)
-@@ -167,7 +167,7 @@ static inline void
- dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg,
- int nelems, enum dma_data_direction dir)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- BUG_ON(!valid_dma_direction(dir));
- if (ops->sync_sg_for_device)
-diff --git a/include/asm-generic/emergency-restart.h b/include/asm-generic/emergency-restart.h
-index 0d68a1e..b74a761 100644
---- a/include/asm-generic/emergency-restart.h
-+++ b/include/asm-generic/emergency-restart.h
-@@ -1,7 +1,7 @@
- #ifndef _ASM_GENERIC_EMERGENCY_RESTART_H
- #define _ASM_GENERIC_EMERGENCY_RESTART_H
-
--static inline void machine_emergency_restart(void)
-+static inline __noreturn void machine_emergency_restart(void)
- {
- machine_restart(NULL);
- }
-diff --git a/include/asm-generic/futex.h b/include/asm-generic/futex.h
-index 3c2344f..4590a7d 100644
---- a/include/asm-generic/futex.h
-+++ b/include/asm-generic/futex.h
-@@ -6,7 +6,7 @@
- #include <asm/errno.h>
-
- static inline int
--futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
-+futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
- {
- int op = (encoded_op >> 28) & 7;
- int cmp = (encoded_op >> 24) & 15;
-@@ -48,7 +48,7 @@ futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
- }
-
- static inline int
--futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval, int newval)
-+futex_atomic_cmpxchg_inatomic(u32 __user *uaddr, int oldval, int newval)
- {
- return -ENOSYS;
- }
-diff --git a/include/asm-generic/kmap_types.h b/include/asm-generic/kmap_types.h
-index e5f234a..cdb16b3 100644
---- a/include/asm-generic/kmap_types.h
-+++ b/include/asm-generic/kmap_types.h
-@@ -28,7 +28,8 @@ KMAP_D(15) KM_UML_USERCOPY,
- KMAP_D(16) KM_IRQ_PTE,
- KMAP_D(17) KM_NMI,
- KMAP_D(18) KM_NMI_PTE,
--KMAP_D(19) KM_TYPE_NR
-+KMAP_D(19) KM_CLEARPAGE,
-+KMAP_D(20) KM_TYPE_NR
- };
-
- #undef KMAP_D
-diff --git a/include/asm-generic/local.h b/include/asm-generic/local.h
-index fc21844..c2c4ea2 100644
---- a/include/asm-generic/local.h
-+++ b/include/asm-generic/local.h
-@@ -23,24 +23,37 @@ typedef struct
- atomic_long_t a;
- } local_t;
-
-+typedef struct {
-+ atomic_long_unchecked_t a;
-+} local_unchecked_t;
-+
- #define LOCAL_INIT(i) { ATOMIC_LONG_INIT(i) }
-
- #define local_read(l) atomic_long_read(&(l)->a)
-+#define local_read_unchecked(l) atomic_long_read_unchecked(&(l)->a)
- #define local_set(l,i) atomic_long_set((&(l)->a),(i))
-+#define local_set_unchecked(l,i) atomic_long_set_unchecked((&(l)->a),(i))
- #define local_inc(l) atomic_long_inc(&(l)->a)
-+#define local_inc_unchecked(l) atomic_long_inc_unchecked(&(l)->a)
- #define local_dec(l) atomic_long_dec(&(l)->a)
-+#define local_dec_unchecked(l) atomic_long_dec_unchecked(&(l)->a)
- #define local_add(i,l) atomic_long_add((i),(&(l)->a))
-+#define local_add_unchecked(i,l) atomic_long_add_unchecked((i),(&(l)->a))
- #define local_sub(i,l) atomic_long_sub((i),(&(l)->a))
-+#define local_sub_unchecked(i,l) atomic_long_sub_unchecked((i),(&(l)->a))
-
- #define local_sub_and_test(i, l) atomic_long_sub_and_test((i), (&(l)->a))
- #define local_dec_and_test(l) atomic_long_dec_and_test(&(l)->a)
- #define local_inc_and_test(l) atomic_long_inc_and_test(&(l)->a)
- #define local_add_negative(i, l) atomic_long_add_negative((i), (&(l)->a))
- #define local_add_return(i, l) atomic_long_add_return((i), (&(l)->a))
-+#define local_add_return_unchecked(i, l) atomic_long_add_return_unchecked((i), (&(l)->a))
- #define local_sub_return(i, l) atomic_long_sub_return((i), (&(l)->a))
- #define local_inc_return(l) atomic_long_inc_return(&(l)->a)
-+#define local_dec_return(l) atomic_long_dec_return(&(l)->a)
-
- #define local_cmpxchg(l, o, n) atomic_long_cmpxchg((&(l)->a), (o), (n))
-+#define local_cmpxchg_unchecked(l, o, n) atomic_long_cmpxchg((&(l)->a), (o), (n))
- #define local_xchg(l, n) atomic_long_xchg((&(l)->a), (n))
- #define local_add_unless(l, _a, u) atomic_long_add_unless((&(l)->a), (_a), (u))
- #define local_inc_not_zero(l) atomic_long_inc_not_zero(&(l)->a)
-diff --git a/include/asm-generic/pgtable-nopmd.h b/include/asm-generic/pgtable-nopmd.h
-index 725612b..9cc513a 100644
---- a/include/asm-generic/pgtable-nopmd.h
-+++ b/include/asm-generic/pgtable-nopmd.h
-@@ -1,14 +1,19 @@
- #ifndef _PGTABLE_NOPMD_H
- #define _PGTABLE_NOPMD_H
-
--#ifndef __ASSEMBLY__
--
- #include <asm-generic/pgtable-nopud.h>
-
--struct mm_struct;
--
- #define __PAGETABLE_PMD_FOLDED
-
-+#define PMD_SHIFT PUD_SHIFT
-+#define PTRS_PER_PMD 1
-+#define PMD_SIZE (_AC(1,UL) << PMD_SHIFT)
-+#define PMD_MASK (~(PMD_SIZE-1))
-+
-+#ifndef __ASSEMBLY__
-+
-+struct mm_struct;
-+
- /*
- * Having the pmd type consist of a pud gets the size right, and allows
- * us to conceptually access the pud entry that this pmd is folded into
-@@ -16,11 +21,6 @@ struct mm_struct;
- */
- typedef struct { pud_t pud; } pmd_t;
-
--#define PMD_SHIFT PUD_SHIFT
--#define PTRS_PER_PMD 1
--#define PMD_SIZE (1UL << PMD_SHIFT)
--#define PMD_MASK (~(PMD_SIZE-1))
--
- /*
- * The "pud_xxx()" functions here are trivial for a folded two-level
- * setup: the pmd is never bad, and a pmd always exists (as it's folded
-diff --git a/include/asm-generic/pgtable-nopud.h b/include/asm-generic/pgtable-nopud.h
-index 810431d..0ec4804f 100644
---- a/include/asm-generic/pgtable-nopud.h
-+++ b/include/asm-generic/pgtable-nopud.h
-@@ -1,10 +1,15 @@
- #ifndef _PGTABLE_NOPUD_H
- #define _PGTABLE_NOPUD_H
-
--#ifndef __ASSEMBLY__
--
- #define __PAGETABLE_PUD_FOLDED
-
-+#define PUD_SHIFT PGDIR_SHIFT
-+#define PTRS_PER_PUD 1
-+#define PUD_SIZE (_AC(1,UL) << PUD_SHIFT)
-+#define PUD_MASK (~(PUD_SIZE-1))
-+
-+#ifndef __ASSEMBLY__
-+
- /*
- * Having the pud type consist of a pgd gets the size right, and allows
- * us to conceptually access the pgd entry that this pud is folded into
-@@ -12,11 +17,6 @@
- */
- typedef struct { pgd_t pgd; } pud_t;
-
--#define PUD_SHIFT PGDIR_SHIFT
--#define PTRS_PER_PUD 1
--#define PUD_SIZE (1UL << PUD_SHIFT)
--#define PUD_MASK (~(PUD_SIZE-1))
--
- /*
- * The "pgd_xxx()" functions here are trivial for a folded two-level
- * setup: the pud is never bad, and a pud always exists (as it's folded
-@@ -29,6 +29,7 @@ static inline void pgd_clear(pgd_t *pgd) { }
- #define pud_ERROR(pud) (pgd_ERROR((pud).pgd))
-
- #define pgd_populate(mm, pgd, pud) do { } while (0)
-+#define pgd_populate_kernel(mm, pgd, pud) do { } while (0)
- /*
- * (puds are folded into pgds so this doesn't get actually called,
- * but the define is needed for a generic inline function.)
-diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
-index e2bd73e..fea8ed3 100644
---- a/include/asm-generic/pgtable.h
-+++ b/include/asm-generic/pgtable.h
-@@ -344,6 +344,14 @@ extern void untrack_pfn_vma(struct vm_area_struct *vma, unsigned long pfn,
- unsigned long size);
- #endif
-
-+#ifndef __HAVE_ARCH_PAX_OPEN_KERNEL
-+static inline unsigned long pax_open_kernel(void) { return 0; }
-+#endif
-+
-+#ifndef __HAVE_ARCH_PAX_CLOSE_KERNEL
-+static inline unsigned long pax_close_kernel(void) { return 0; }
-+#endif
-+
- #endif /* !__ASSEMBLY__ */
-
- #endif /* _ASM_GENERIC_PGTABLE_H */
-diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
-index b6e818f..21aa58a 100644
---- a/include/asm-generic/vmlinux.lds.h
-+++ b/include/asm-generic/vmlinux.lds.h
-@@ -199,6 +199,7 @@
- .rodata : AT(ADDR(.rodata) - LOAD_OFFSET) { \
- VMLINUX_SYMBOL(__start_rodata) = .; \
- *(.rodata) *(.rodata.*) \
-+ *(.data.read_only) \
- *(__vermagic) /* Kernel version magic */ \
- *(__markers_strings) /* Markers: strings */ \
- *(__tracepoints_strings)/* Tracepoints: strings */ \
-@@ -656,22 +657,24 @@
- * section in the linker script will go there too. @phdr should have
- * a leading colon.
- *
-- * Note that this macros defines __per_cpu_load as an absolute symbol.
-+ * Note that this macros defines per_cpu_load as an absolute symbol.
- * If there is no need to put the percpu section at a predetermined
- * address, use PERCPU().
- */
- #define PERCPU_VADDR(vaddr, phdr) \
-- VMLINUX_SYMBOL(__per_cpu_load) = .; \
-- .data.percpu vaddr : AT(VMLINUX_SYMBOL(__per_cpu_load) \
-+ per_cpu_load = .; \
-+ .data.percpu vaddr : AT(VMLINUX_SYMBOL(per_cpu_load) \
- - LOAD_OFFSET) { \
-+ VMLINUX_SYMBOL(__per_cpu_load) = . + per_cpu_load; \
- VMLINUX_SYMBOL(__per_cpu_start) = .; \
- *(.data.percpu.first) \
-- *(.data.percpu.page_aligned) \
- *(.data.percpu) \
-+ . = ALIGN(PAGE_SIZE); \
-+ *(.data.percpu.page_aligned) \
- *(.data.percpu.shared_aligned) \
- VMLINUX_SYMBOL(__per_cpu_end) = .; \
- } phdr \
-- . = VMLINUX_SYMBOL(__per_cpu_load) + SIZEOF(.data.percpu);
-+ . = VMLINUX_SYMBOL(per_cpu_load) + SIZEOF(.data.percpu);
-
- /**
- * PERCPU - define output section for percpu area, simple version
-diff --git a/include/crypto/algapi.h b/include/crypto/algapi.h
-index 1ffb53f..b156927 100644
---- a/include/crypto/algapi.h
-+++ b/include/crypto/algapi.h
-@@ -32,7 +32,7 @@ struct crypto_type {
- unsigned int maskclear;
- unsigned int maskset;
- unsigned int tfmsize;
--};
-+} __do_const;
-
- struct crypto_instance {
- struct crypto_alg alg;
-diff --git a/include/drm/drmP.h b/include/drm/drmP.h
-index ebab6a6..351dba1 100644
---- a/include/drm/drmP.h
-+++ b/include/drm/drmP.h
-@@ -71,6 +71,7 @@
- #include <linux/workqueue.h>
- #include <linux/poll.h>
- #include <asm/pgalloc.h>
-+#include <asm/local.h>
- #include "drm.h"
-
- #include <linux/idr.h>
-@@ -814,7 +815,7 @@ struct drm_driver {
- void (*vgaarb_irq)(struct drm_device *dev, bool state);
-
- /* Driver private ops for this object */
-- struct vm_operations_struct *gem_vm_ops;
-+ const struct vm_operations_struct *gem_vm_ops;
-
- int major;
- int minor;
-@@ -917,7 +918,7 @@ struct drm_device {
-
- /** \name Usage Counters */
- /*@{ */
-- int open_count; /**< Outstanding files open */
-+ local_t open_count; /**< Outstanding files open */
- atomic_t ioctl_count; /**< Outstanding IOCTLs pending */
- atomic_t vma_count; /**< Outstanding vma areas open */
- int buf_use; /**< Buffers in use -- cannot alloc */
-@@ -928,7 +929,7 @@ struct drm_device {
- /*@{ */
- unsigned long counters;
- enum drm_stat_type types[15];
-- atomic_t counts[15];
-+ atomic_unchecked_t counts[15];
- /*@} */
-
- struct list_head filelist;
-@@ -1016,7 +1017,7 @@ struct drm_device {
- struct pci_controller *hose;
- #endif
- struct drm_sg_mem *sg; /**< Scatter gather memory */
-- unsigned int num_crtcs; /**< Number of CRTCs on this device */
-+ unsigned int num_crtcs; /**< Number of CRTCs on this device */
- void *dev_private; /**< device private data */
- void *mm_private;
- struct address_space *dev_mapping;
-@@ -1042,11 +1043,11 @@ struct drm_device {
- spinlock_t object_name_lock;
- struct idr object_name_idr;
- atomic_t object_count;
-- atomic_t object_memory;
-+ atomic_unchecked_t object_memory;
- atomic_t pin_count;
-- atomic_t pin_memory;
-+ atomic_unchecked_t pin_memory;
- atomic_t gtt_count;
-- atomic_t gtt_memory;
-+ atomic_unchecked_t gtt_memory;
- uint32_t gtt_total;
- uint32_t invalidate_domains; /* domains pending invalidation */
- uint32_t flush_domains; /* domains pending flush */
-diff --git a/include/drm/drm_crtc_helper.h b/include/drm/drm_crtc_helper.h
-index b29e201..c4825f4 100644
---- a/include/drm/drm_crtc_helper.h
-+++ b/include/drm/drm_crtc_helper.h
-@@ -85,7 +85,7 @@ struct drm_encoder_helper_funcs {
- struct drm_connector *connector);
- /* disable encoder when not in use - more explicit than dpms off */
- void (*disable)(struct drm_encoder *encoder);
--};
-+} __no_const;
-
- struct drm_connector_helper_funcs {
- int (*get_modes)(struct drm_connector *connector);
-diff --git a/include/drm/ttm/ttm_memory.h b/include/drm/ttm/ttm_memory.h
-index b199170..6f9e64c 100644
---- a/include/drm/ttm/ttm_memory.h
-+++ b/include/drm/ttm/ttm_memory.h
-@@ -47,7 +47,7 @@
-
- struct ttm_mem_shrink {
- int (*do_shrink) (struct ttm_mem_shrink *);
--};
-+} __no_const;
-
- /**
- * struct ttm_mem_global - Global memory accounting structure.
-diff --git a/include/linux/Kbuild b/include/linux/Kbuild
-index 1feed71..4d4cbbb 100644
---- a/include/linux/Kbuild
-+++ b/include/linux/Kbuild
-@@ -187,6 +187,7 @@ unifdef-y += blktrace_api.h
- unifdef-y += capability.h
- unifdef-y += capi.h
- unifdef-y += cciss_ioctl.h
-+unifdef-y += cciss_defs.h
- unifdef-y += cdrom.h
- unifdef-y += cm4000_cs.h
- unifdef-y += cn_proc.h
-diff --git a/include/linux/a.out.h b/include/linux/a.out.h
-index e86dfca..40cc55f 100644
---- a/include/linux/a.out.h
-+++ b/include/linux/a.out.h
-@@ -39,6 +39,14 @@ enum machine_type {
- M_MIPS2 = 152 /* MIPS R6000/R4000 binary */
- };
-
-+/* Constants for the N_FLAGS field */
-+#define F_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
-+#define F_PAX_EMUTRAMP 2 /* Emulate trampolines */
-+#define F_PAX_MPROTECT 4 /* Restrict mprotect() */
-+#define F_PAX_RANDMMAP 8 /* Randomize mmap() base */
-+/*#define F_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
-+#define F_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
-+
- #if !defined (N_MAGIC)
- #define N_MAGIC(exec) ((exec).a_info & 0xffff)
- #endif
-diff --git a/include/linux/atmdev.h b/include/linux/atmdev.h
-index 817b237..62c10bc 100644
---- a/include/linux/atmdev.h
-+++ b/include/linux/atmdev.h
-@@ -237,7 +237,7 @@ struct compat_atm_iobuf {
- #endif
-
- struct k_atm_aal_stats {
--#define __HANDLE_ITEM(i) atomic_t i
-+#define __HANDLE_ITEM(i) atomic_unchecked_t i
- __AAL_STAT_ITEMS
- #undef __HANDLE_ITEM
- };
-diff --git a/include/linux/backlight.h b/include/linux/backlight.h
-index 0f5f578..8c4f884 100644
---- a/include/linux/backlight.h
-+++ b/include/linux/backlight.h
-@@ -36,18 +36,18 @@ struct backlight_device;
- struct fb_info;
-
- struct backlight_ops {
-- unsigned int options;
-+ const unsigned int options;
-
- #define BL_CORE_SUSPENDRESUME (1 << 0)
-
- /* Notify the backlight driver some property has changed */
-- int (*update_status)(struct backlight_device *);
-+ int (* const update_status)(struct backlight_device *);
- /* Return the current backlight brightness (accounting for power,
- fb_blank etc.) */
-- int (*get_brightness)(struct backlight_device *);
-+ int (* const get_brightness)(struct backlight_device *);
- /* Check if given framebuffer device is the one bound to this backlight;
- return 0 if not, !=0 if it is. If NULL, backlight always matches the fb. */
-- int (*check_fb)(struct fb_info *);
-+ int (* const check_fb)(struct fb_info *);
- };
-
- /* This structure defines all the properties of a backlight */
-@@ -86,7 +86,7 @@ struct backlight_device {
- registered this device has been unloaded, and if class_get_devdata()
- points to something in the body of that driver, it is also invalid. */
- struct mutex ops_lock;
-- struct backlight_ops *ops;
-+ const struct backlight_ops *ops;
-
- /* The framebuffer notifier block */
- struct notifier_block fb_notif;
-@@ -103,7 +103,7 @@ static inline void backlight_update_status(struct backlight_device *bd)
- }
-
- extern struct backlight_device *backlight_device_register(const char *name,
-- struct device *dev, void *devdata, struct backlight_ops *ops);
-+ struct device *dev, void *devdata, const struct backlight_ops *ops);
- extern void backlight_device_unregister(struct backlight_device *bd);
- extern void backlight_force_update(struct backlight_device *bd,
- enum backlight_update_reason reason);
-diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
-index a3d802e..93a2ef4 100644
---- a/include/linux/binfmts.h
-+++ b/include/linux/binfmts.h
-@@ -18,7 +18,7 @@ struct pt_regs;
- #define BINPRM_BUF_SIZE 128
-
- #ifdef __KERNEL__
--#include <linux/list.h>
-+#include <linux/sched.h>
-
- #define CORENAME_MAX_SIZE 128
-
-@@ -58,6 +58,7 @@ struct linux_binprm{
- unsigned interp_flags;
- unsigned interp_data;
- unsigned long loader, exec;
-+ char tcomm[TASK_COMM_LEN];
- };
-
- extern void acct_arg_size(struct linux_binprm *bprm, unsigned long pages);
-@@ -83,6 +84,7 @@ struct linux_binfmt {
- int (*load_binary)(struct linux_binprm *, struct pt_regs * regs);
- int (*load_shlib)(struct file *);
- int (*core_dump)(long signr, struct pt_regs *regs, struct file *file, unsigned long limit);
-+ void (*handle_mprotect)(struct vm_area_struct *vma, unsigned long newflags);
- unsigned long min_coredump; /* minimal dump size */
- int hasvdso;
- };
-diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
-index 5eb6cb0..a2906d2 100644
---- a/include/linux/blkdev.h
-+++ b/include/linux/blkdev.h
-@@ -1281,7 +1281,7 @@ struct block_device_operations {
- int (*revalidate_disk) (struct gendisk *);
- int (*getgeo)(struct block_device *, struct hd_geometry *);
- struct module *owner;
--};
-+} __do_const;
-
- extern int __blkdev_driver_ioctl(struct block_device *, fmode_t, unsigned int,
- unsigned long);
-diff --git a/include/linux/blktrace_api.h b/include/linux/blktrace_api.h
-index 3b73b99..629d21b 100644
---- a/include/linux/blktrace_api.h
-+++ b/include/linux/blktrace_api.h
-@@ -160,7 +160,7 @@ struct blk_trace {
- struct dentry *dir;
- struct dentry *dropped_file;
- struct dentry *msg_file;
-- atomic_t dropped;
-+ atomic_unchecked_t dropped;
- };
-
- extern int blk_trace_ioctl(struct block_device *, unsigned, char __user *);
-diff --git a/include/linux/byteorder/little_endian.h b/include/linux/byteorder/little_endian.h
-index 83195fb..0b0f77d 100644
---- a/include/linux/byteorder/little_endian.h
-+++ b/include/linux/byteorder/little_endian.h
-@@ -42,51 +42,51 @@
-
- static inline __le64 __cpu_to_le64p(const __u64 *p)
- {
-- return (__force __le64)*p;
-+ return (__force const __le64)*p;
- }
- static inline __u64 __le64_to_cpup(const __le64 *p)
- {
-- return (__force __u64)*p;
-+ return (__force const __u64)*p;
- }
- static inline __le32 __cpu_to_le32p(const __u32 *p)
- {
-- return (__force __le32)*p;
-+ return (__force const __le32)*p;
- }
- static inline __u32 __le32_to_cpup(const __le32 *p)
- {
-- return (__force __u32)*p;
-+ return (__force const __u32)*p;
- }
- static inline __le16 __cpu_to_le16p(const __u16 *p)
- {
-- return (__force __le16)*p;
-+ return (__force const __le16)*p;
- }
- static inline __u16 __le16_to_cpup(const __le16 *p)
- {
-- return (__force __u16)*p;
-+ return (__force const __u16)*p;
- }
- static inline __be64 __cpu_to_be64p(const __u64 *p)
- {
-- return (__force __be64)__swab64p(p);
-+ return (__force const __be64)__swab64p(p);
- }
- static inline __u64 __be64_to_cpup(const __be64 *p)
- {
-- return __swab64p((__u64 *)p);
-+ return __swab64p((const __u64 *)p);
- }
- static inline __be32 __cpu_to_be32p(const __u32 *p)
- {
-- return (__force __be32)__swab32p(p);
-+ return (__force const __be32)__swab32p(p);
- }
- static inline __u32 __be32_to_cpup(const __be32 *p)
- {
-- return __swab32p((__u32 *)p);
-+ return __swab32p((const __u32 *)p);
- }
- static inline __be16 __cpu_to_be16p(const __u16 *p)
- {
-- return (__force __be16)__swab16p(p);
-+ return (__force const __be16)__swab16p(p);
- }
- static inline __u16 __be16_to_cpup(const __be16 *p)
- {
-- return __swab16p((__u16 *)p);
-+ return __swab16p((const __u16 *)p);
- }
- #define __cpu_to_le64s(x) do { (void)(x); } while (0)
- #define __le64_to_cpus(x) do { (void)(x); } while (0)
-diff --git a/include/linux/cache.h b/include/linux/cache.h
-index 97e2488..e7576b9 100644
---- a/include/linux/cache.h
-+++ b/include/linux/cache.h
-@@ -16,6 +16,10 @@
- #define __read_mostly
- #endif
-
-+#ifndef __read_only
-+#define __read_only __read_mostly
-+#endif
-+
- #ifndef ____cacheline_aligned
- #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
- #endif
-diff --git a/include/linux/capability.h b/include/linux/capability.h
-index c8f2a5f7..78ffdf5 100644
---- a/include/linux/capability.h
-+++ b/include/linux/capability.h
-@@ -563,11 +563,15 @@ extern const kernel_cap_t __cap_init_eff_set;
- (security_real_capable_noaudit((t), (cap)) == 0)
-
- extern int capable(int cap);
-+int capable_nolog(int cap);
-
- /* audit system wants to get cap info from files as well */
- struct dentry;
- extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps);
-
-+extern int is_privileged_binary(const struct dentry *dentry);
-+extern int is_root_privileged_binary(const struct dentry *dentry);
-+
- #endif /* __KERNEL__ */
-
- #endif /* !_LINUX_CAPABILITY_H */
-diff --git a/include/linux/cciss_defs.h b/include/linux/cciss_defs.h
-new file mode 100644
-index 0000000..316b670
---- /dev/null
-+++ b/include/linux/cciss_defs.h
-@@ -0,0 +1,130 @@
-+#ifndef CCISS_DEFS_H
-+#define CCISS_DEFS_H
-+
-+#include <linux/types.h>
-+
-+/* general boundary definitions */
-+#define SENSEINFOBYTES 32 /* note that this value may vary
-+ between host implementations */
-+
-+/* Command Status value */
-+#define CMD_SUCCESS 0x0000
-+#define CMD_TARGET_STATUS 0x0001
-+#define CMD_DATA_UNDERRUN 0x0002
-+#define CMD_DATA_OVERRUN 0x0003
-+#define CMD_INVALID 0x0004
-+#define CMD_PROTOCOL_ERR 0x0005
-+#define CMD_HARDWARE_ERR 0x0006
-+#define CMD_CONNECTION_LOST 0x0007
-+#define CMD_ABORTED 0x0008
-+#define CMD_ABORT_FAILED 0x0009
-+#define CMD_UNSOLICITED_ABORT 0x000A
-+#define CMD_TIMEOUT 0x000B
-+#define CMD_UNABORTABLE 0x000C
-+
-+/* transfer direction */
-+#define XFER_NONE 0x00
-+#define XFER_WRITE 0x01
-+#define XFER_READ 0x02
-+#define XFER_RSVD 0x03
-+
-+/* task attribute */
-+#define ATTR_UNTAGGED 0x00
-+#define ATTR_SIMPLE 0x04
-+#define ATTR_HEADOFQUEUE 0x05
-+#define ATTR_ORDERED 0x06
-+#define ATTR_ACA 0x07
-+
-+/* cdb type */
-+#define TYPE_CMD 0x00
-+#define TYPE_MSG 0x01
-+
-+/* Type defs used in the following structs */
-+#define BYTE __u8
-+#define WORD __u16
-+#define HWORD __u16
-+#define DWORD __u32
-+
-+#define CISS_MAX_LUN 1024
-+
-+#define LEVEL2LUN 1 /* index into Target(x) structure, due to byte swapping */
-+#define LEVEL3LUN 0
-+
-+#pragma pack(1)
-+
-+/* Command List Structure */
-+typedef union _SCSI3Addr_struct {
-+ struct {
-+ BYTE Dev;
-+ BYTE Bus:6;
-+ BYTE Mode:2; /* b00 */
-+ } PeripDev;
-+ struct {
-+ BYTE DevLSB;
-+ BYTE DevMSB:6;
-+ BYTE Mode:2; /* b01 */
-+ } LogDev;
-+ struct {
-+ BYTE Dev:5;
-+ BYTE Bus:3;
-+ BYTE Targ:6;
-+ BYTE Mode:2; /* b10 */
-+ } LogUnit;
-+} SCSI3Addr_struct;
-+
-+typedef struct _PhysDevAddr_struct {
-+ DWORD TargetId:24;
-+ DWORD Bus:6;
-+ DWORD Mode:2;
-+ SCSI3Addr_struct Target[2]; /* 2 level target device addr */
-+} PhysDevAddr_struct;
-+
-+typedef struct _LogDevAddr_struct {
-+ DWORD VolId:30;
-+ DWORD Mode:2;
-+ BYTE reserved[4];
-+} LogDevAddr_struct;
-+
-+typedef union _LUNAddr_struct {
-+ BYTE LunAddrBytes[8];
-+ SCSI3Addr_struct SCSI3Lun[4];
-+ PhysDevAddr_struct PhysDev;
-+ LogDevAddr_struct LogDev;
-+} LUNAddr_struct;
-+
-+typedef struct _RequestBlock_struct {
-+ BYTE CDBLen;
-+ struct {
-+ BYTE Type:3;
-+ BYTE Attribute:3;
-+ BYTE Direction:2;
-+ } Type;
-+ HWORD Timeout;
-+ BYTE CDB[16];
-+} RequestBlock_struct;
-+
-+typedef union _MoreErrInfo_struct{
-+ struct {
-+ BYTE Reserved[3];
-+ BYTE Type;
-+ DWORD ErrorInfo;
-+ } Common_Info;
-+ struct{
-+ BYTE Reserved[2];
-+ BYTE offense_size; /* size of offending entry */
-+ BYTE offense_num; /* byte # of offense 0-base */
-+ DWORD offense_value;
-+ } Invalid_Cmd;
-+} MoreErrInfo_struct;
-+typedef struct _ErrorInfo_struct {
-+ BYTE ScsiStatus;
-+ BYTE SenseLen;
-+ HWORD CommandStatus;
-+ DWORD ResidualCnt;
-+ MoreErrInfo_struct MoreErrInfo;
-+ BYTE SenseInfo[SENSEINFOBYTES];
-+} ErrorInfo_struct;
-+
-+#pragma pack()
-+
-+#endif /* CCISS_DEFS_H */
-diff --git a/include/linux/cciss_ioctl.h b/include/linux/cciss_ioctl.h
-index cb57c30..48078c3 100644
---- a/include/linux/cciss_ioctl.h
-+++ b/include/linux/cciss_ioctl.h
-@@ -3,6 +3,7 @@
-
- #include <linux/types.h>
- #include <linux/ioctl.h>
-+#include <linux/cciss_defs.h>
-
- #define CCISS_IOC_MAGIC 'B'
-
-@@ -13,7 +14,7 @@ typedef struct _cciss_pci_info_struct
- unsigned char dev_fn;
- unsigned short domain;
- __u32 board_id;
--} cciss_pci_info_struct;
-+} cciss_pci_info_struct;
-
- typedef struct _cciss_coalint_struct
- {
-@@ -36,137 +37,10 @@ typedef __u32 DriverVer_type;
-
- #define MAX_KMALLOC_SIZE 128000
-
--#ifndef CCISS_CMD_H
--// This defines are duplicated in cciss_cmd.h in the driver directory
--
--//general boundary defintions
--#define SENSEINFOBYTES 32//note that this value may vary between host implementations
--
--//Command Status value
--#define CMD_SUCCESS 0x0000
--#define CMD_TARGET_STATUS 0x0001
--#define CMD_DATA_UNDERRUN 0x0002
--#define CMD_DATA_OVERRUN 0x0003
--#define CMD_INVALID 0x0004
--#define CMD_PROTOCOL_ERR 0x0005
--#define CMD_HARDWARE_ERR 0x0006
--#define CMD_CONNECTION_LOST 0x0007
--#define CMD_ABORTED 0x0008
--#define CMD_ABORT_FAILED 0x0009
--#define CMD_UNSOLICITED_ABORT 0x000A
--#define CMD_TIMEOUT 0x000B
--#define CMD_UNABORTABLE 0x000C
--
--//transfer direction
--#define XFER_NONE 0x00
--#define XFER_WRITE 0x01
--#define XFER_READ 0x02
--#define XFER_RSVD 0x03
--
--//task attribute
--#define ATTR_UNTAGGED 0x00
--#define ATTR_SIMPLE 0x04
--#define ATTR_HEADOFQUEUE 0x05
--#define ATTR_ORDERED 0x06
--#define ATTR_ACA 0x07
--
--//cdb type
--#define TYPE_CMD 0x00
--#define TYPE_MSG 0x01
--
--// Type defs used in the following structs
--#define BYTE __u8
--#define WORD __u16
--#define HWORD __u16
--#define DWORD __u32
--
--#define CISS_MAX_LUN 1024
--
--#define LEVEL2LUN 1 // index into Target(x) structure, due to byte swapping
--#define LEVEL3LUN 0
--
--#pragma pack(1)
--
--//Command List Structure
--typedef union _SCSI3Addr_struct {
-- struct {
-- BYTE Dev;
-- BYTE Bus:6;
-- BYTE Mode:2; // b00
-- } PeripDev;
-- struct {
-- BYTE DevLSB;
-- BYTE DevMSB:6;
-- BYTE Mode:2; // b01
-- } LogDev;
-- struct {
-- BYTE Dev:5;
-- BYTE Bus:3;
-- BYTE Targ:6;
-- BYTE Mode:2; // b10
-- } LogUnit;
--} SCSI3Addr_struct;
--
--typedef struct _PhysDevAddr_struct {
-- DWORD TargetId:24;
-- DWORD Bus:6;
-- DWORD Mode:2;
-- SCSI3Addr_struct Target[2]; //2 level target device addr
--} PhysDevAddr_struct;
--
--typedef struct _LogDevAddr_struct {
-- DWORD VolId:30;
-- DWORD Mode:2;
-- BYTE reserved[4];
--} LogDevAddr_struct;
--
--typedef union _LUNAddr_struct {
-- BYTE LunAddrBytes[8];
-- SCSI3Addr_struct SCSI3Lun[4];
-- PhysDevAddr_struct PhysDev;
-- LogDevAddr_struct LogDev;
--} LUNAddr_struct;
--
--typedef struct _RequestBlock_struct {
-- BYTE CDBLen;
-- struct {
-- BYTE Type:3;
-- BYTE Attribute:3;
-- BYTE Direction:2;
-- } Type;
-- HWORD Timeout;
-- BYTE CDB[16];
--} RequestBlock_struct;
--
--typedef union _MoreErrInfo_struct{
-- struct {
-- BYTE Reserved[3];
-- BYTE Type;
-- DWORD ErrorInfo;
-- }Common_Info;
-- struct{
-- BYTE Reserved[2];
-- BYTE offense_size;//size of offending entry
-- BYTE offense_num; //byte # of offense 0-base
-- DWORD offense_value;
-- }Invalid_Cmd;
--}MoreErrInfo_struct;
--typedef struct _ErrorInfo_struct {
-- BYTE ScsiStatus;
-- BYTE SenseLen;
-- HWORD CommandStatus;
-- DWORD ResidualCnt;
-- MoreErrInfo_struct MoreErrInfo;
-- BYTE SenseInfo[SENSEINFOBYTES];
--} ErrorInfo_struct;
--
--#pragma pack()
--#endif /* CCISS_CMD_H */
--
- typedef struct _IOCTL_Command_struct {
- LUNAddr_struct LUN_info;
- RequestBlock_struct Request;
-- ErrorInfo_struct error_info;
-+ ErrorInfo_struct error_info;
- WORD buf_size; /* size in bytes of the buf */
- BYTE __user *buf;
- } IOCTL_Command_struct;
-@@ -203,7 +77,7 @@ typedef struct _LogvolInfo_struct{
- #define CCISS_PASSTHRU _IOWR(CCISS_IOC_MAGIC, 11, IOCTL_Command_struct)
- #define CCISS_DEREGDISK _IO(CCISS_IOC_MAGIC, 12)
-
--/* no longer used... use REGNEWD instead */
-+/* no longer used... use REGNEWD instead */
- #define CCISS_REGNEWDISK _IOW(CCISS_IOC_MAGIC, 13, int)
-
- #define CCISS_REGNEWD _IO(CCISS_IOC_MAGIC, 14)
-@@ -238,4 +112,4 @@ typedef struct _BIG_IOCTL32_Command_struct {
-
- #endif /* CONFIG_COMPAT */
- #endif /* __KERNEL__ */
--#endif
-+#endif
-diff --git a/include/linux/cdrom.h b/include/linux/cdrom.h
-index 78e9047..ff39f6b 100644
---- a/include/linux/cdrom.h
-+++ b/include/linux/cdrom.h
-@@ -981,7 +981,6 @@ struct cdrom_device_ops {
-
- /* driver specifications */
- const int capability; /* capability flags */
-- int n_minors; /* number of active minor devices */
- /* handle uniform packets for scsi type devices (scsi,atapi) */
- int (*generic_packet) (struct cdrom_device_info *,
- struct packet_command *);
-diff --git a/include/linux/compiler-gcc4.h b/include/linux/compiler-gcc4.h
-index 450fa59..16b904d 100644
---- a/include/linux/compiler-gcc4.h
-+++ b/include/linux/compiler-gcc4.h
-@@ -14,6 +14,15 @@
- #define __compiler_offsetof(a,b) __builtin_offsetof(a,b)
- #define __always_inline inline __attribute__((always_inline))
-
-+#ifdef SIZE_OVERFLOW_PLUGIN
-+#define __size_overflow(...) __attribute__((size_overflow(__VA_ARGS__)))
-+#define __intentional_overflow(...) __attribute__((intentional_overflow(__VA_ARGS__)))
-+#endif
-+
-+#ifdef LATENT_ENTROPY_PLUGIN
-+#define __latent_entropy __attribute__((latent_entropy))
-+#endif
-+
- /*
- * A trick to suppress uninitialized variable warning without generating any
- * code
-@@ -36,4 +45,23 @@
- the kernel context */
- #define __cold __attribute__((__cold__))
-
-+#define __alloc_size(...) __attribute((alloc_size(__VA_ARGS__)))
-+#define __bos(ptr, arg) __builtin_object_size((ptr), (arg))
-+#define __bos0(ptr) __bos((ptr), 0)
-+#define __bos1(ptr) __bos((ptr), 1)
-+#endif
-+
-+#if __GNUC_MINOR__ >= 5
-+#ifdef CONSTIFY_PLUGIN
-+#define __no_const __attribute__((no_const))
-+#define __do_const __attribute__((do_const))
-+#endif
-+#endif
-+
-+#if __GNUC_MINOR__ > 0
-+#define __compiletime_object_size(obj) __builtin_object_size(obj, 0)
-+#endif
-+#if __GNUC_MINOR__ >= 4 && !defined(__CHECKER__)
-+#define __compiletime_warning(message) __attribute__((warning(message)))
-+#define __compiletime_error(message) __attribute__((error(message)))
- #endif
-diff --git a/include/linux/compiler.h b/include/linux/compiler.h
-index 04fb513..225dd4d 100644
---- a/include/linux/compiler.h
-+++ b/include/linux/compiler.h
-@@ -5,11 +5,14 @@
-
- #ifdef __CHECKER__
- # define __user __attribute__((noderef, address_space(1)))
-+# define __force_user __force __user
- # define __kernel /* default address space */
-+# define __force_kernel __force __kernel
- # define __safe __attribute__((safe))
- # define __force __attribute__((force))
- # define __nocast __attribute__((nocast))
- # define __iomem __attribute__((noderef, address_space(2)))
-+# define __force_iomem __force __iomem
- # define __acquires(x) __attribute__((context(x,0,1)))
- # define __releases(x) __attribute__((context(x,1,0)))
- # define __acquire(x) __context__(x,1)
-@@ -17,13 +20,34 @@
- # define __cond_lock(x,c) ((c) ? ({ __acquire(x); 1; }) : 0)
- extern void __chk_user_ptr(const volatile void __user *);
- extern void __chk_io_ptr(const volatile void __iomem *);
-+#elif defined(CHECKER_PLUGIN)
-+//# define __user
-+//# define __force_user
-+//# define __kernel
-+//# define __force_kernel
-+# define __safe
-+# define __force
-+# define __nocast
-+# define __iomem
-+# define __force_iomem
-+# define __chk_user_ptr(x) (void)0
-+# define __chk_io_ptr(x) (void)0
-+# define __builtin_warning(x, y...) (1)
-+# define __acquires(x)
-+# define __releases(x)
-+# define __acquire(x) (void)0
-+# define __release(x) (void)0
-+# define __cond_lock(x,c) (c)
- #else
- # define __user
-+# define __force_user
- # define __kernel
-+# define __force_kernel
- # define __safe
- # define __force
- # define __nocast
- # define __iomem
-+# define __force_iomem
- # define __chk_user_ptr(x) (void)0
- # define __chk_io_ptr(x) (void)0
- # define __builtin_warning(x, y...) (1)
-@@ -247,6 +271,26 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
- # define __attribute_const__ /* unimplemented */
- #endif
-
-+#ifndef __no_const
-+# define __no_const
-+#endif
-+
-+#ifndef __do_const
-+# define __do_const
-+#endif
-+
-+#ifndef __size_overflow
-+# define __size_overflow(...)
-+#endif
-+
-+#ifndef __intentional_overflow
-+# define __intentional_overflow(...)
-+#endif
-+
-+#ifndef __latent_entropy
-+# define __latent_entropy
-+#endif
-+
- /*
- * Tell gcc if a function is cold. The compiler will assume any path
- * directly leading to the call is unlikely.
-@@ -256,6 +300,22 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
- #define __cold
- #endif
-
-+#ifndef __alloc_size
-+#define __alloc_size(...)
-+#endif
-+
-+#ifndef __bos
-+#define __bos(ptr, arg)
-+#endif
-+
-+#ifndef __bos0
-+#define __bos0(ptr)
-+#endif
-+
-+#ifndef __bos1
-+#define __bos1(ptr)
-+#endif
-+
- /* Simple shorthand for a section definition */
- #ifndef __section
- # define __section(S) __attribute__ ((__section__(#S)))
-@@ -266,6 +326,19 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
- # define __same_type(a, b) __builtin_types_compatible_p(typeof(a), typeof(b))
- #endif
-
-+/* Compile time object size, -1 for unknown */
-+#ifndef __compiletime_object_size
-+# define __compiletime_object_size(obj) -1
-+#endif
-+#ifndef __compiletime_warning
-+# define __compiletime_warning(message)
-+#endif
-+#ifndef __compiletime_error
-+# define __compiletime_error(message)
-+#endif
-+#ifndef __linktime_error
-+# define __linktime_error(message)
-+#endif
- /*
- * Prevent the compiler from merging or refetching accesses. The compiler
- * is also forbidden from reordering successive instances of ACCESS_ONCE(),
-@@ -278,6 +351,7 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
- * use is to mediate communication between process-level code and irq/NMI
- * handlers, all running on the same CPU.
- */
--#define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x))
-+#define ACCESS_ONCE(x) (*(volatile const typeof(x) *)&(x))
-+#define ACCESS_ONCE_RW(x) (*(volatile typeof(x) *)&(x))
-
- #endif /* __LINUX_COMPILER_H */
-diff --git a/include/linux/crypto.h b/include/linux/crypto.h
-index fd92988..a3164bd 100644
---- a/include/linux/crypto.h
-+++ b/include/linux/crypto.h
-@@ -394,7 +394,7 @@ struct cipher_tfm {
- const u8 *key, unsigned int keylen);
- void (*cit_encrypt_one)(struct crypto_tfm *tfm, u8 *dst, const u8 *src);
- void (*cit_decrypt_one)(struct crypto_tfm *tfm, u8 *dst, const u8 *src);
--};
-+} __no_const;
-
- struct hash_tfm {
- int (*init)(struct hash_desc *desc);
-@@ -415,13 +415,13 @@ struct compress_tfm {
- int (*cot_decompress)(struct crypto_tfm *tfm,
- const u8 *src, unsigned int slen,
- u8 *dst, unsigned int *dlen);
--};
-+} __no_const;
-
- struct rng_tfm {
- int (*rng_gen_random)(struct crypto_rng *tfm, u8 *rdata,
- unsigned int dlen);
- int (*rng_reset)(struct crypto_rng *tfm, u8 *seed, unsigned int slen);
--};
-+} __no_const;
-
- #define crt_ablkcipher crt_u.ablkcipher
- #define crt_aead crt_u.aead
-diff --git a/include/linux/dcache.h b/include/linux/dcache.h
-index 30b93b2..cd7a8db 100644
---- a/include/linux/dcache.h
-+++ b/include/linux/dcache.h
-@@ -119,6 +119,8 @@ struct dentry {
- unsigned char d_iname[DNAME_INLINE_LEN_MIN]; /* small names */
- };
-
-+#define DNAME_INLINE_LEN (sizeof(struct dentry)-offsetof(struct dentry,d_iname))
-+
- /*
- * dentry->d_lock spinlock nesting subclasses:
- *
-diff --git a/include/linux/decompress/mm.h b/include/linux/decompress/mm.h
-index 3e9bd6a..f4e1aa0 100644
---- a/include/linux/decompress/mm.h
-+++ b/include/linux/decompress/mm.h
-@@ -78,7 +78,7 @@ static void free(void *where)
- * warnings when not needed (indeed large_malloc / large_free are not
- * needed by inflate */
-
--#define malloc(a) kmalloc(a, GFP_KERNEL)
-+#define malloc(a) kmalloc((a), GFP_KERNEL)
- #define free(a) kfree(a)
-
- #define large_malloc(a) vmalloc(a)
-diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
-index 91b7618..92a93d32 100644
---- a/include/linux/dma-mapping.h
-+++ b/include/linux/dma-mapping.h
-@@ -16,51 +16,51 @@ enum dma_data_direction {
- };
-
- struct dma_map_ops {
-- void* (*alloc_coherent)(struct device *dev, size_t size,
-+ void* (* const alloc_coherent)(struct device *dev, size_t size,
- dma_addr_t *dma_handle, gfp_t gfp);
-- void (*free_coherent)(struct device *dev, size_t size,
-+ void (* const free_coherent)(struct device *dev, size_t size,
- void *vaddr, dma_addr_t dma_handle);
-- dma_addr_t (*map_page)(struct device *dev, struct page *page,
-+ dma_addr_t (* const map_page)(struct device *dev, struct page *page,
- unsigned long offset, size_t size,
- enum dma_data_direction dir,
- struct dma_attrs *attrs);
-- void (*unmap_page)(struct device *dev, dma_addr_t dma_handle,
-+ void (* const unmap_page)(struct device *dev, dma_addr_t dma_handle,
- size_t size, enum dma_data_direction dir,
- struct dma_attrs *attrs);
-- int (*map_sg)(struct device *dev, struct scatterlist *sg,
-+ int (* const map_sg)(struct device *dev, struct scatterlist *sg,
- int nents, enum dma_data_direction dir,
- struct dma_attrs *attrs);
-- void (*unmap_sg)(struct device *dev,
-+ void (* const unmap_sg)(struct device *dev,
- struct scatterlist *sg, int nents,
- enum dma_data_direction dir,
- struct dma_attrs *attrs);
-- void (*sync_single_for_cpu)(struct device *dev,
-+ void (* const sync_single_for_cpu)(struct device *dev,
- dma_addr_t dma_handle, size_t size,
- enum dma_data_direction dir);
-- void (*sync_single_for_device)(struct device *dev,
-+ void (* const sync_single_for_device)(struct device *dev,
- dma_addr_t dma_handle, size_t size,
- enum dma_data_direction dir);
-- void (*sync_single_range_for_cpu)(struct device *dev,
-+ void (* const sync_single_range_for_cpu)(struct device *dev,
- dma_addr_t dma_handle,
- unsigned long offset,
- size_t size,
- enum dma_data_direction dir);
-- void (*sync_single_range_for_device)(struct device *dev,
-+ void (* const sync_single_range_for_device)(struct device *dev,
- dma_addr_t dma_handle,
- unsigned long offset,
- size_t size,
- enum dma_data_direction dir);
-- void (*sync_sg_for_cpu)(struct device *dev,
-+ void (* const sync_sg_for_cpu)(struct device *dev,
- struct scatterlist *sg, int nents,
- enum dma_data_direction dir);
-- void (*sync_sg_for_device)(struct device *dev,
-+ void (* const sync_sg_for_device)(struct device *dev,
- struct scatterlist *sg, int nents,
- enum dma_data_direction dir);
-- int (*mapping_error)(struct device *dev, dma_addr_t dma_addr);
-- int (*dma_supported)(struct device *dev, u64 mask);
-+ int (* const mapping_error)(struct device *dev, dma_addr_t dma_addr);
-+ int (* const dma_supported)(struct device *dev, u64 mask);
- int (*set_dma_mask)(struct device *dev, u64 mask);
- int is_phys;
--};
-+} __do_const;
-
- #define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
-
-diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
-index 2b9f2ac..287034f 100644
---- a/include/linux/dmaengine.h
-+++ b/include/linux/dmaengine.h
-@@ -625,9 +625,9 @@ struct dma_pinned_list {
- struct dma_pinned_list *dma_pin_iovec_pages(struct iovec *iov, size_t len);
- void dma_unpin_iovec_pages(struct dma_pinned_list* pinned_list);
-
--dma_cookie_t dma_memcpy_to_iovec(struct dma_chan *chan, struct iovec *iov,
-+dma_cookie_t __intentional_overflow(0) dma_memcpy_to_iovec(struct dma_chan *chan, struct iovec *iov,
- struct dma_pinned_list *pinned_list, unsigned char *kdata, size_t len);
--dma_cookie_t dma_memcpy_pg_to_iovec(struct dma_chan *chan, struct iovec *iov,
-+dma_cookie_t __intentional_overflow(0) dma_memcpy_pg_to_iovec(struct dma_chan *chan, struct iovec *iov,
- struct dma_pinned_list *pinned_list, struct page *page,
- unsigned int offset, size_t len);
-
-diff --git a/include/linux/dst.h b/include/linux/dst.h
-index e26fed8..b976d9f 100644
---- a/include/linux/dst.h
-+++ b/include/linux/dst.h
-@@ -380,7 +380,7 @@ struct dst_node
- struct thread_pool *pool;
-
- /* Transaction IDs live here */
-- atomic_long_t gen;
-+ atomic_long_unchecked_t gen;
-
- /*
- * How frequently and how many times transaction
-diff --git a/include/linux/elf.h b/include/linux/elf.h
-index 90a4ed0..d652617 100644
---- a/include/linux/elf.h
-+++ b/include/linux/elf.h
-@@ -49,6 +49,17 @@ typedef __s64 Elf64_Sxword;
- #define PT_GNU_EH_FRAME 0x6474e550
-
- #define PT_GNU_STACK (PT_LOOS + 0x474e551)
-+#define PT_GNU_RELRO (PT_LOOS + 0x474e552)
-+
-+#define PT_PAX_FLAGS (PT_LOOS + 0x5041580)
-+
-+/* Constants for the e_flags field */
-+#define EF_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
-+#define EF_PAX_EMUTRAMP 2 /* Emulate trampolines */
-+#define EF_PAX_MPROTECT 4 /* Restrict mprotect() */
-+#define EF_PAX_RANDMMAP 8 /* Randomize mmap() base */
-+/*#define EF_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
-+#define EF_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
-
- /* These constants define the different elf file types */
- #define ET_NONE 0
-@@ -84,6 +95,8 @@ typedef __s64 Elf64_Sxword;
- #define DT_DEBUG 21
- #define DT_TEXTREL 22
- #define DT_JMPREL 23
-+#define DT_FLAGS 30
-+ #define DF_TEXTREL 0x00000004
- #define DT_ENCODING 32
- #define OLD_DT_LOOS 0x60000000
- #define DT_LOOS 0x6000000d
-@@ -230,6 +243,19 @@ typedef struct elf64_hdr {
- #define PF_W 0x2
- #define PF_X 0x1
-
-+#define PF_PAGEEXEC (1U << 4) /* Enable PAGEEXEC */
-+#define PF_NOPAGEEXEC (1U << 5) /* Disable PAGEEXEC */
-+#define PF_SEGMEXEC (1U << 6) /* Enable SEGMEXEC */
-+#define PF_NOSEGMEXEC (1U << 7) /* Disable SEGMEXEC */
-+#define PF_MPROTECT (1U << 8) /* Enable MPROTECT */
-+#define PF_NOMPROTECT (1U << 9) /* Disable MPROTECT */
-+/*#define PF_RANDEXEC (1U << 10)*/ /* Enable RANDEXEC */
-+/*#define PF_NORANDEXEC (1U << 11)*/ /* Disable RANDEXEC */
-+#define PF_EMUTRAMP (1U << 12) /* Enable EMUTRAMP */
-+#define PF_NOEMUTRAMP (1U << 13) /* Disable EMUTRAMP */
-+#define PF_RANDMMAP (1U << 14) /* Enable RANDMMAP */
-+#define PF_NORANDMMAP (1U << 15) /* Disable RANDMMAP */
-+
- typedef struct elf32_phdr{
- Elf32_Word p_type;
- Elf32_Off p_offset;
-@@ -322,6 +348,8 @@ typedef struct elf64_shdr {
- #define EI_OSABI 7
- #define EI_PAD 8
-
-+#define EI_PAX 14
-+
- #define ELFMAG0 0x7f /* EI_MAG */
- #define ELFMAG1 'E'
- #define ELFMAG2 'L'
-@@ -386,6 +414,7 @@ extern Elf32_Dyn _DYNAMIC [];
- #define elf_phdr elf32_phdr
- #define elf_note elf32_note
- #define elf_addr_t Elf32_Off
-+#define elf_dyn Elf32_Dyn
-
- #else
-
-@@ -394,6 +423,7 @@ extern Elf64_Dyn _DYNAMIC [];
- #define elf_phdr elf64_phdr
- #define elf_note elf64_note
- #define elf_addr_t Elf64_Off
-+#define elf_dyn Elf64_Dyn
-
- #endif
-
-diff --git a/include/linux/fs.h b/include/linux/fs.h
-index 860cb6d..67c3325 100644
---- a/include/linux/fs.h
-+++ b/include/linux/fs.h
-@@ -568,41 +568,41 @@ typedef int (*read_actor_t)(read_descriptor_t *, struct page *,
- unsigned long, unsigned long);
-
- struct address_space_operations {
-- int (*writepage)(struct page *page, struct writeback_control *wbc);
-- int (*readpage)(struct file *, struct page *);
-- void (*sync_page)(struct page *);
-+ int (* const writepage)(struct page *page, struct writeback_control *wbc);
-+ int (* const readpage)(struct file *, struct page *);
-+ void (* const sync_page)(struct page *);
-
- /* Write back some dirty pages from this mapping. */
-- int (*writepages)(struct address_space *, struct writeback_control *);
-+ int (* const writepages)(struct address_space *, struct writeback_control *);
-
- /* Set a page dirty. Return true if this dirtied it */
-- int (*set_page_dirty)(struct page *page);
-+ int (* const set_page_dirty)(struct page *page);
-
-- int (*readpages)(struct file *filp, struct address_space *mapping,
-+ int (* const readpages)(struct file *filp, struct address_space *mapping,
- struct list_head *pages, unsigned nr_pages);
-
-- int (*write_begin)(struct file *, struct address_space *mapping,
-+ int (* const write_begin)(struct file *, struct address_space *mapping,
- loff_t pos, unsigned len, unsigned flags,
- struct page **pagep, void **fsdata);
-- int (*write_end)(struct file *, struct address_space *mapping,
-+ int (* const write_end)(struct file *, struct address_space *mapping,
- loff_t pos, unsigned len, unsigned copied,
- struct page *page, void *fsdata);
-
- /* Unfortunately this kludge is needed for FIBMAP. Don't use it */
-- sector_t (*bmap)(struct address_space *, sector_t);
-- void (*invalidatepage) (struct page *, unsigned long);
-- int (*releasepage) (struct page *, gfp_t);
-- ssize_t (*direct_IO)(int, struct kiocb *, const struct iovec *iov,
-+ sector_t (* const bmap)(struct address_space *, sector_t);
-+ void (* const invalidatepage) (struct page *, unsigned long);
-+ int (* const releasepage) (struct page *, gfp_t);
-+ ssize_t (* const direct_IO)(int, struct kiocb *, const struct iovec *iov,
- loff_t offset, unsigned long nr_segs);
-- int (*get_xip_mem)(struct address_space *, pgoff_t, int,
-+ int (* const get_xip_mem)(struct address_space *, pgoff_t, int,
- void **, unsigned long *);
- /* migrate the contents of a page to the specified target */
-- int (*migratepage) (struct address_space *,
-+ int (* const migratepage) (struct address_space *,
- struct page *, struct page *);
-- int (*launder_page) (struct page *);
-- int (*is_partially_uptodate) (struct page *, read_descriptor_t *,
-+ int (* const launder_page) (struct page *);
-+ int (* const is_partially_uptodate) (struct page *, read_descriptor_t *,
- unsigned long);
-- int (*error_remove_page)(struct address_space *, struct page *);
-+ int (* const error_remove_page)(struct address_space *, struct page *);
- };
-
- /*
-@@ -1032,19 +1032,19 @@ static inline int file_check_writeable(struct file *filp)
- typedef struct files_struct *fl_owner_t;
-
- struct file_lock_operations {
-- void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
-- void (*fl_release_private)(struct file_lock *);
-+ void (* const fl_copy_lock)(struct file_lock *, struct file_lock *);
-+ void (* const fl_release_private)(struct file_lock *);
- };
-
- struct lock_manager_operations {
-- int (*fl_compare_owner)(struct file_lock *, struct file_lock *);
-- void (*fl_notify)(struct file_lock *); /* unblock callback */
-- int (*fl_grant)(struct file_lock *, struct file_lock *, int);
-- void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
-- void (*fl_release_private)(struct file_lock *);
-- void (*fl_break)(struct file_lock *);
-- int (*fl_mylease)(struct file_lock *, struct file_lock *);
-- int (*fl_change)(struct file_lock **, int);
-+ int (* const fl_compare_owner)(struct file_lock *, struct file_lock *);
-+ void (* const fl_notify)(struct file_lock *); /* unblock callback */
-+ int (* const fl_grant)(struct file_lock *, struct file_lock *, int);
-+ void (* const fl_copy_lock)(struct file_lock *, struct file_lock *);
-+ void (* const fl_release_private)(struct file_lock *);
-+ void (* const fl_break)(struct file_lock *);
-+ int (* const fl_mylease)(struct file_lock *, struct file_lock *);
-+ int (* const fl_change)(struct file_lock **, int);
- };
-
- struct lock_manager {
-@@ -1443,7 +1443,7 @@ struct fiemap_extent_info {
- unsigned int fi_flags; /* Flags as passed from user */
- unsigned int fi_extents_mapped; /* Number of mapped extents */
- unsigned int fi_extents_max; /* Size of fiemap_extent array */
-- struct fiemap_extent *fi_extents_start; /* Start of fiemap_extent
-+ struct fiemap_extent __user *fi_extents_start; /* Start of fiemap_extent
- * array */
- };
- int fiemap_fill_next_extent(struct fiemap_extent_info *info, u64 logical,
-@@ -1513,7 +1513,8 @@ struct file_operations {
- ssize_t (*splice_write)(struct pipe_inode_info *, struct file *, loff_t *, size_t, unsigned int);
- ssize_t (*splice_read)(struct file *, loff_t *, struct pipe_inode_info *, size_t, unsigned int);
- int (*setlease)(struct file *, long, struct file_lock **);
--};
-+} __do_const;
-+typedef struct file_operations __no_const file_operations_no_const;
-
- struct inode_operations {
- int (*create) (struct inode *,struct dentry *,int, struct nameidata *);
-@@ -1560,30 +1561,30 @@ extern ssize_t vfs_writev(struct file *, const struct iovec __user *,
- unsigned long, loff_t *);
-
- struct super_operations {
-- struct inode *(*alloc_inode)(struct super_block *sb);
-- void (*destroy_inode)(struct inode *);
-+ struct inode *(* const alloc_inode)(struct super_block *sb);
-+ void (* const destroy_inode)(struct inode *);
-
-- void (*dirty_inode) (struct inode *);
-- int (*write_inode) (struct inode *, int);
-- void (*drop_inode) (struct inode *);
-- void (*delete_inode) (struct inode *);
-- void (*put_super) (struct super_block *);
-- void (*write_super) (struct super_block *);
-- int (*sync_fs)(struct super_block *sb, int wait);
-- int (*freeze_fs) (struct super_block *);
-- int (*unfreeze_fs) (struct super_block *);
-- int (*statfs) (struct dentry *, struct kstatfs *);
-- int (*remount_fs) (struct super_block *, int *, char *);
-- void (*clear_inode) (struct inode *);
-- void (*umount_begin) (struct super_block *);
-+ void (* const dirty_inode) (struct inode *);
-+ int (* const write_inode) (struct inode *, int);
-+ void (* const drop_inode) (struct inode *);
-+ void (* const delete_inode) (struct inode *);
-+ void (* const put_super) (struct super_block *);
-+ void (* const write_super) (struct super_block *);
-+ int (* const sync_fs)(struct super_block *sb, int wait);
-+ int (* const freeze_fs) (struct super_block *);
-+ int (* const unfreeze_fs) (struct super_block *);
-+ int (* const statfs) (struct dentry *, struct kstatfs *);
-+ int (* const remount_fs) (struct super_block *, int *, char *);
-+ void (* const clear_inode) (struct inode *);
-+ void (* const umount_begin) (struct super_block *);
-
-- int (*show_options)(struct seq_file *, struct vfsmount *);
-- int (*show_stats)(struct seq_file *, struct vfsmount *);
-+ int (* const show_options)(struct seq_file *, struct vfsmount *);
-+ int (* const show_stats)(struct seq_file *, struct vfsmount *);
- #ifdef CONFIG_QUOTA
-- ssize_t (*quota_read)(struct super_block *, int, char *, size_t, loff_t);
-- ssize_t (*quota_write)(struct super_block *, int, const char *, size_t, loff_t);
-+ ssize_t (* const quota_read)(struct super_block *, int, char *, size_t, loff_t);
-+ ssize_t (* const quota_write)(struct super_block *, int, const char *, size_t, loff_t);
- #endif
-- int (*bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
-+ int (* const bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
- };
-
- /*
-@@ -1953,6 +1954,7 @@ extern void unregister_blkdev(unsigned int, const char *);
- extern struct block_device *bdget(dev_t);
- extern struct block_device *bdgrab(struct block_device *bdev);
- extern void bd_set_size(struct block_device *, loff_t size);
-+extern sector_t blkdev_max_block(struct block_device *bdev);
- extern void bd_forget(struct inode *inode);
- extern void bdput(struct block_device *);
- extern struct block_device *open_by_devnum(dev_t, fmode_t);
-@@ -2489,5 +2491,15 @@ int proc_nr_files(struct ctl_table *table, int write,
-
- int __init get_filesystem_list(char *buf);
-
-+static inline bool is_sidechannel_device(const struct inode *inode)
-+{
-+#ifdef CONFIG_GRKERNSEC_DEVICE_SIDECHANNEL
-+ umode_t mode = inode->i_mode;
-+ return ((S_ISCHR(mode) || S_ISBLK(mode)) && (mode & (S_IROTH | S_IWOTH)));
-+#else
-+ return false;
-+#endif
-+}
-+
- #endif /* __KERNEL__ */
- #endif /* _LINUX_FS_H */
-diff --git a/include/linux/fs_struct.h b/include/linux/fs_struct.h
-index 78a05bf..2a7d3e1 100644
---- a/include/linux/fs_struct.h
-+++ b/include/linux/fs_struct.h
-@@ -4,7 +4,7 @@
- #include <linux/path.h>
-
- struct fs_struct {
-- int users;
-+ atomic_t users;
- rwlock_t lock;
- int umask;
- int in_exec;
-diff --git a/include/linux/fscache-cache.h b/include/linux/fscache-cache.h
-index 7be0c6f..2f63a2b 100644
---- a/include/linux/fscache-cache.h
-+++ b/include/linux/fscache-cache.h
-@@ -116,7 +116,7 @@ struct fscache_operation {
- #endif
- };
-
--extern atomic_t fscache_op_debug_id;
-+extern atomic_unchecked_t fscache_op_debug_id;
- extern const struct slow_work_ops fscache_op_slow_work_ops;
-
- extern void fscache_enqueue_operation(struct fscache_operation *);
-@@ -134,7 +134,7 @@ static inline void fscache_operation_init(struct fscache_operation *op,
- fscache_operation_release_t release)
- {
- atomic_set(&op->usage, 1);
-- op->debug_id = atomic_inc_return(&fscache_op_debug_id);
-+ op->debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
- op->release = release;
- INIT_LIST_HEAD(&op->pend_link);
- fscache_set_op_state(op, "Init");
-diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h
-index 936f9aa..d0bd57d 100644
---- a/include/linux/fsnotify.h
-+++ b/include/linux/fsnotify.h
-@@ -188,6 +188,9 @@ static inline void fsnotify_access(struct dentry *dentry)
- struct inode *inode = dentry->d_inode;
- __u32 mask = FS_ACCESS;
-
-+ if (is_sidechannel_device(inode))
-+ return;
-+
- if (S_ISDIR(inode->i_mode))
- mask |= FS_IN_ISDIR;
-
-@@ -205,6 +208,9 @@ static inline void fsnotify_modify(struct dentry *dentry)
- struct inode *inode = dentry->d_inode;
- __u32 mask = FS_MODIFY;
-
-+ if (is_sidechannel_device(inode))
-+ return;
-+
- if (S_ISDIR(inode->i_mode))
- mask |= FS_IN_ISDIR;
-
-diff --git a/include/linux/ftrace_event.h b/include/linux/ftrace_event.h
-index 4ec5e67..42f1eb9 100644
---- a/include/linux/ftrace_event.h
-+++ b/include/linux/ftrace_event.h
-@@ -163,7 +163,7 @@ extern int trace_define_field(struct ftrace_event_call *call,
- int filter_type);
- extern int trace_define_common_fields(struct ftrace_event_call *call);
-
--#define is_signed_type(type) (((type)(-1)) < 0)
-+#define is_signed_type(type) (((type)(-1)) < (type)1)
-
- int trace_set_clr_event(const char *system, const char *event, int set);
-
-diff --git a/include/linux/genhd.h b/include/linux/genhd.h
-index 297df45..b6a74ff 100644
---- a/include/linux/genhd.h
-+++ b/include/linux/genhd.h
-@@ -161,7 +161,7 @@ struct gendisk {
-
- struct timer_rand_state *random;
-
-- atomic_t sync_io; /* RAID */
-+ atomic_unchecked_t sync_io; /* RAID */
- struct work_struct async_notify;
- #ifdef CONFIG_BLK_DEV_INTEGRITY
- struct blk_integrity *integrity;
-diff --git a/include/linux/gfp.h b/include/linux/gfp.h
-index 557bdad..b5e8c98 100644
---- a/include/linux/gfp.h
-+++ b/include/linux/gfp.h
-@@ -53,6 +53,12 @@ struct vm_area_struct;
- #define __GFP_THISNODE ((__force gfp_t)0x40000u)/* No fallback, no policies */
- #define __GFP_RECLAIMABLE ((__force gfp_t)0x80000u) /* Page is reclaimable */
-
-+#ifdef CONFIG_PAX_USERCOPY_SLABS
-+#define __GFP_USERCOPY ((__force gfp_t)0x1000000u)
-+#else
-+#define __GFP_USERCOPY ((__force gfp_t)0)
-+#endif
-+
- #ifdef CONFIG_KMEMCHECK
- #define __GFP_NOTRACK ((__force gfp_t)0x200000u) /* Don't track with kmemcheck */
- #else
-@@ -65,7 +71,7 @@ struct vm_area_struct;
- */
- #define __GFP_NOTRACK_FALSE_POSITIVE (__GFP_NOTRACK)
-
--#define __GFP_BITS_SHIFT 22 /* Room for 22 __GFP_FOO bits */
-+#define __GFP_BITS_SHIFT 26 /* Room for 26 __GFP_FOO bits */
- #define __GFP_BITS_MASK ((__force gfp_t)((1 << __GFP_BITS_SHIFT) - 1))
-
- /* This equals 0, but use constants in case they ever change */
-@@ -115,6 +121,8 @@ struct vm_area_struct;
- /* 4GB DMA on some platforms */
- #define GFP_DMA32 __GFP_DMA32
-
-+#define GFP_USERCOPY __GFP_USERCOPY
-+
- /* Convert GFP flags to their corresponding migrate type */
- static inline int allocflags_to_migratetype(gfp_t gfp_flags)
- {
-diff --git a/include/linux/gracl.h b/include/linux/gracl.h
-new file mode 100644
-index 0000000..5f646cf
---- /dev/null
-+++ b/include/linux/gracl.h
-@@ -0,0 +1,320 @@
-+#ifndef GR_ACL_H
-+#define GR_ACL_H
-+
-+#include <linux/grdefs.h>
-+#include <linux/resource.h>
-+#include <linux/capability.h>
-+#include <linux/dcache.h>
-+#include <asm/resource.h>
-+
-+/* Major status information */
-+
-+#define GR_VERSION "grsecurity 2.9.1"
-+#define GRSECURITY_VERSION 0x2901
-+
-+enum {
-+ GR_SHUTDOWN = 0,
-+ GR_ENABLE = 1,
-+ GR_SPROLE = 2,
-+ GR_RELOAD = 3,
-+ GR_SEGVMOD = 4,
-+ GR_STATUS = 5,
-+ GR_UNSPROLE = 6,
-+ GR_PASSSET = 7,
-+ GR_SPROLEPAM = 8,
-+};
-+
-+/* Password setup definitions
-+ * kernel/grhash.c */
-+enum {
-+ GR_PW_LEN = 128,
-+ GR_SALT_LEN = 16,
-+ GR_SHA_LEN = 32,
-+};
-+
-+enum {
-+ GR_SPROLE_LEN = 64,
-+};
-+
-+enum {
-+ GR_NO_GLOB = 0,
-+ GR_REG_GLOB,
-+ GR_CREATE_GLOB
-+};
-+
-+#define GR_NLIMITS 32
-+
-+/* Begin Data Structures */
-+
-+struct sprole_pw {
-+ unsigned char *rolename;
-+ unsigned char salt[GR_SALT_LEN];
-+ unsigned char sum[GR_SHA_LEN]; /* 256-bit SHA hash of the password */
-+};
-+
-+struct name_entry {
-+ __u32 key;
-+ ino_t inode;
-+ dev_t device;
-+ char *name;
-+ __u16 len;
-+ __u8 deleted;
-+ struct name_entry *prev;
-+ struct name_entry *next;
-+};
-+
-+struct inodev_entry {
-+ struct name_entry *nentry;
-+ struct inodev_entry *prev;
-+ struct inodev_entry *next;
-+};
-+
-+struct acl_role_db {
-+ struct acl_role_label **r_hash;
-+ __u32 r_size;
-+};
-+
-+struct inodev_db {
-+ struct inodev_entry **i_hash;
-+ __u32 i_size;
-+};
-+
-+struct name_db {
-+ struct name_entry **n_hash;
-+ __u32 n_size;
-+};
-+
-+struct crash_uid {
-+ uid_t uid;
-+ unsigned long expires;
-+};
-+
-+struct gr_hash_struct {
-+ void **table;
-+ void **nametable;
-+ void *first;
-+ __u32 table_size;
-+ __u32 used_size;
-+ int type;
-+};
-+
-+/* Userspace Grsecurity ACL data structures */
-+
-+struct acl_subject_label {
-+ char *filename;
-+ ino_t inode;
-+ dev_t device;
-+ __u32 mode;
-+ kernel_cap_t cap_mask;
-+ kernel_cap_t cap_lower;
-+ kernel_cap_t cap_invert_audit;
-+
-+ struct rlimit res[GR_NLIMITS];
-+ __u32 resmask;
-+
-+ __u8 user_trans_type;
-+ __u8 group_trans_type;
-+ uid_t *user_transitions;
-+ gid_t *group_transitions;
-+ __u16 user_trans_num;
-+ __u16 group_trans_num;
-+
-+ __u32 sock_families[2];
-+ __u32 ip_proto[8];
-+ __u32 ip_type;
-+ struct acl_ip_label **ips;
-+ __u32 ip_num;
-+ __u32 inaddr_any_override;
-+
-+ __u32 crashes;
-+ unsigned long expires;
-+
-+ struct acl_subject_label *parent_subject;
-+ struct gr_hash_struct *hash;
-+ struct acl_subject_label *prev;
-+ struct acl_subject_label *next;
-+
-+ struct acl_object_label **obj_hash;
-+ __u32 obj_hash_size;
-+ __u16 pax_flags;
-+};
-+
-+struct role_allowed_ip {
-+ __u32 addr;
-+ __u32 netmask;
-+
-+ struct role_allowed_ip *prev;
-+ struct role_allowed_ip *next;
-+};
-+
-+struct role_transition {
-+ char *rolename;
-+
-+ struct role_transition *prev;
-+ struct role_transition *next;
-+};
-+
-+struct acl_role_label {
-+ char *rolename;
-+ uid_t uidgid;
-+ __u16 roletype;
-+
-+ __u16 auth_attempts;
-+ unsigned long expires;
-+
-+ struct acl_subject_label *root_label;
-+ struct gr_hash_struct *hash;
-+
-+ struct acl_role_label *prev;
-+ struct acl_role_label *next;
-+
-+ struct role_transition *transitions;
-+ struct role_allowed_ip *allowed_ips;
-+ uid_t *domain_children;
-+ __u16 domain_child_num;
-+
-+ // __u16
-+ umode_t umask;
-+
-+ struct acl_subject_label **subj_hash;
-+ __u32 subj_hash_size;
-+};
-+
-+struct user_acl_role_db {
-+ struct acl_role_label **r_table;
-+ __u32 num_pointers; /* Number of allocations to track */
-+ __u32 num_roles; /* Number of roles */
-+ __u32 num_domain_children; /* Number of domain children */
-+ __u32 num_subjects; /* Number of subjects */
-+ __u32 num_objects; /* Number of objects */
-+};
-+
-+struct acl_object_label {
-+ char *filename;
-+ ino_t inode;
-+ dev_t device;
-+ __u32 mode;
-+
-+ struct acl_subject_label *nested;
-+ struct acl_object_label *globbed;
-+
-+ /* next two structures not used */
-+
-+ struct acl_object_label *prev;
-+ struct acl_object_label *next;
-+};
-+
-+struct acl_ip_label {
-+ char *iface;
-+ __u32 addr;
-+ __u32 netmask;
-+ __u16 low, high;
-+ __u8 mode;
-+ __u32 type;
-+ __u32 proto[8];
-+
-+ /* next two structures not used */
-+
-+ struct acl_ip_label *prev;
-+ struct acl_ip_label *next;
-+};
-+
-+struct gr_arg {
-+ struct user_acl_role_db role_db;
-+ unsigned char pw[GR_PW_LEN];
-+ unsigned char salt[GR_SALT_LEN];
-+ unsigned char sum[GR_SHA_LEN];
-+ unsigned char sp_role[GR_SPROLE_LEN];
-+ struct sprole_pw *sprole_pws;
-+ dev_t segv_device;
-+ ino_t segv_inode;
-+ uid_t segv_uid;
-+ __u16 num_sprole_pws;
-+ __u16 mode;
-+};
-+
-+struct gr_arg_wrapper {
-+ struct gr_arg *arg;
-+ __u32 version;
-+ __u32 size;
-+};
-+
-+struct subject_map {
-+ struct acl_subject_label *user;
-+ struct acl_subject_label *kernel;
-+ struct subject_map *prev;
-+ struct subject_map *next;
-+};
-+
-+struct acl_subj_map_db {
-+ struct subject_map **s_hash;
-+ __u32 s_size;
-+};
-+
-+/* End Data Structures Section */
-+
-+/* Hash functions generated by empirical testing by Brad Spengler
-+ Makes good use of the low bits of the inode. Generally 0-1 times
-+ in loop for successful match. 0-3 for unsuccessful match.
-+ Shift/add algorithm with modulus of table size and an XOR*/
-+
-+static __inline__ unsigned int
-+gr_rhash(const uid_t uid, const __u16 type, const unsigned int sz)
-+{
-+ return ((((uid + type) << (16 + type)) ^ uid) % sz);
-+}
-+
-+ static __inline__ unsigned int
-+gr_shash(const struct acl_subject_label *userp, const unsigned int sz)
-+{
-+ return ((const unsigned long)userp % sz);
-+}
-+
-+static __inline__ unsigned int
-+gr_fhash(const ino_t ino, const dev_t dev, const unsigned int sz)
-+{
-+ return (((ino + dev) ^ ((ino << 13) + (ino << 23) + (dev << 9))) % sz);
-+}
-+
-+static __inline__ unsigned int
-+gr_nhash(const char *name, const __u16 len, const unsigned int sz)
-+{
-+ return full_name_hash((const unsigned char *)name, len) % sz;
-+}
-+
-+#define FOR_EACH_ROLE_START(role) \
-+ role = role_list; \
-+ while (role) {
-+
-+#define FOR_EACH_ROLE_END(role) \
-+ role = role->prev; \
-+ }
-+
-+#define FOR_EACH_SUBJECT_START(role,subj,iter) \
-+ subj = NULL; \
-+ iter = 0; \
-+ while (iter < role->subj_hash_size) { \
-+ if (subj == NULL) \
-+ subj = role->subj_hash[iter]; \
-+ if (subj == NULL) { \
-+ iter++; \
-+ continue; \
-+ }
-+
-+#define FOR_EACH_SUBJECT_END(subj,iter) \
-+ subj = subj->next; \
-+ if (subj == NULL) \
-+ iter++; \
-+ }
-+
-+
-+#define FOR_EACH_NESTED_SUBJECT_START(role,subj) \
-+ subj = role->hash->first; \
-+ while (subj != NULL) {
-+
-+#define FOR_EACH_NESTED_SUBJECT_END(subj) \
-+ subj = subj->next; \
-+ }
-+
-+#endif
-+
-diff --git a/include/linux/gralloc.h b/include/linux/gralloc.h
-new file mode 100644
-index 0000000..323ecf2
---- /dev/null
-+++ b/include/linux/gralloc.h
-@@ -0,0 +1,9 @@
-+#ifndef __GRALLOC_H
-+#define __GRALLOC_H
-+
-+void acl_free_all(void);
-+int acl_alloc_stack_init(unsigned long size);
-+void *acl_alloc(unsigned long len);
-+void *acl_alloc_num(unsigned long num, unsigned long len);
-+
-+#endif
-diff --git a/include/linux/grdefs.h b/include/linux/grdefs.h
-new file mode 100644
-index 0000000..0b166f4
---- /dev/null
-+++ b/include/linux/grdefs.h
-@@ -0,0 +1,140 @@
-+#ifndef GRDEFS_H
-+#define GRDEFS_H
-+
-+/* Begin grsecurity status declarations */
-+
-+enum {
-+ GR_READY = 0x01,
-+ GR_STATUS_INIT = 0x00 // disabled state
-+};
-+
-+/* Begin ACL declarations */
-+
-+/* Role flags */
-+
-+enum {
-+ GR_ROLE_USER = 0x0001,
-+ GR_ROLE_GROUP = 0x0002,
-+ GR_ROLE_DEFAULT = 0x0004,
-+ GR_ROLE_SPECIAL = 0x0008,
-+ GR_ROLE_AUTH = 0x0010,
-+ GR_ROLE_NOPW = 0x0020,
-+ GR_ROLE_GOD = 0x0040,
-+ GR_ROLE_LEARN = 0x0080,
-+ GR_ROLE_TPE = 0x0100,
-+ GR_ROLE_DOMAIN = 0x0200,
-+ GR_ROLE_PAM = 0x0400,
-+ GR_ROLE_PERSIST = 0x800
-+};
-+
-+/* ACL Subject and Object mode flags */
-+enum {
-+ GR_DELETED = 0x80000000
-+};
-+
-+/* ACL Object-only mode flags */
-+enum {
-+ GR_READ = 0x00000001,
-+ GR_APPEND = 0x00000002,
-+ GR_WRITE = 0x00000004,
-+ GR_EXEC = 0x00000008,
-+ GR_FIND = 0x00000010,
-+ GR_INHERIT = 0x00000020,
-+ GR_SETID = 0x00000040,
-+ GR_CREATE = 0x00000080,
-+ GR_DELETE = 0x00000100,
-+ GR_LINK = 0x00000200,
-+ GR_AUDIT_READ = 0x00000400,
-+ GR_AUDIT_APPEND = 0x00000800,
-+ GR_AUDIT_WRITE = 0x00001000,
-+ GR_AUDIT_EXEC = 0x00002000,
-+ GR_AUDIT_FIND = 0x00004000,
-+ GR_AUDIT_INHERIT= 0x00008000,
-+ GR_AUDIT_SETID = 0x00010000,
-+ GR_AUDIT_CREATE = 0x00020000,
-+ GR_AUDIT_DELETE = 0x00040000,
-+ GR_AUDIT_LINK = 0x00080000,
-+ GR_PTRACERD = 0x00100000,
-+ GR_NOPTRACE = 0x00200000,
-+ GR_SUPPRESS = 0x00400000,
-+ GR_NOLEARN = 0x00800000,
-+ GR_INIT_TRANSFER= 0x01000000
-+};
-+
-+#define GR_AUDITS (GR_AUDIT_READ | GR_AUDIT_WRITE | GR_AUDIT_APPEND | GR_AUDIT_EXEC | \
-+ GR_AUDIT_FIND | GR_AUDIT_INHERIT | GR_AUDIT_SETID | \
-+ GR_AUDIT_CREATE | GR_AUDIT_DELETE | GR_AUDIT_LINK)
-+
-+/* ACL subject-only mode flags */
-+enum {
-+ GR_KILL = 0x00000001,
-+ GR_VIEW = 0x00000002,
-+ GR_PROTECTED = 0x00000004,
-+ GR_LEARN = 0x00000008,
-+ GR_OVERRIDE = 0x00000010,
-+ /* just a placeholder, this mode is only used in userspace */
-+ GR_DUMMY = 0x00000020,
-+ GR_PROTSHM = 0x00000040,
-+ GR_KILLPROC = 0x00000080,
-+ GR_KILLIPPROC = 0x00000100,
-+ /* just a placeholder, this mode is only used in userspace */
-+ GR_NOTROJAN = 0x00000200,
-+ GR_PROTPROCFD = 0x00000400,
-+ GR_PROCACCT = 0x00000800,
-+ GR_RELAXPTRACE = 0x00001000,
-+ //GR_NESTED = 0x00002000,
-+ GR_INHERITLEARN = 0x00004000,
-+ GR_PROCFIND = 0x00008000,
-+ GR_POVERRIDE = 0x00010000,
-+ GR_KERNELAUTH = 0x00020000,
-+ GR_ATSECURE = 0x00040000,
-+ GR_SHMEXEC = 0x00080000
-+};
-+
-+enum {
-+ GR_PAX_ENABLE_SEGMEXEC = 0x0001,
-+ GR_PAX_ENABLE_PAGEEXEC = 0x0002,
-+ GR_PAX_ENABLE_MPROTECT = 0x0004,
-+ GR_PAX_ENABLE_RANDMMAP = 0x0008,
-+ GR_PAX_ENABLE_EMUTRAMP = 0x0010,
-+ GR_PAX_DISABLE_SEGMEXEC = 0x0100,
-+ GR_PAX_DISABLE_PAGEEXEC = 0x0200,
-+ GR_PAX_DISABLE_MPROTECT = 0x0400,
-+ GR_PAX_DISABLE_RANDMMAP = 0x0800,
-+ GR_PAX_DISABLE_EMUTRAMP = 0x1000,
-+};
-+
-+enum {
-+ GR_ID_USER = 0x01,
-+ GR_ID_GROUP = 0x02,
-+};
-+
-+enum {
-+ GR_ID_ALLOW = 0x01,
-+ GR_ID_DENY = 0x02,
-+};
-+
-+#define GR_CRASH_RES 31
-+#define GR_UIDTABLE_MAX 500
-+
-+/* begin resource learning section */
-+enum {
-+ GR_RLIM_CPU_BUMP = 60,
-+ GR_RLIM_FSIZE_BUMP = 50000,
-+ GR_RLIM_DATA_BUMP = 10000,
-+ GR_RLIM_STACK_BUMP = 1000,
-+ GR_RLIM_CORE_BUMP = 10000,
-+ GR_RLIM_RSS_BUMP = 500000,
-+ GR_RLIM_NPROC_BUMP = 1,
-+ GR_RLIM_NOFILE_BUMP = 5,
-+ GR_RLIM_MEMLOCK_BUMP = 50000,
-+ GR_RLIM_AS_BUMP = 500000,
-+ GR_RLIM_LOCKS_BUMP = 2,
-+ GR_RLIM_SIGPENDING_BUMP = 5,
-+ GR_RLIM_MSGQUEUE_BUMP = 10000,
-+ GR_RLIM_NICE_BUMP = 1,
-+ GR_RLIM_RTPRIO_BUMP = 1,
-+ GR_RLIM_RTTIME_BUMP = 1000000
-+};
-+
-+#endif
-diff --git a/include/linux/grinternal.h b/include/linux/grinternal.h
-new file mode 100644
-index 0000000..3322652
---- /dev/null
-+++ b/include/linux/grinternal.h
-@@ -0,0 +1,221 @@
-+#ifndef __GRINTERNAL_H
-+#define __GRINTERNAL_H
-+
-+#ifdef CONFIG_GRKERNSEC
-+
-+#include <linux/fs.h>
-+#include <linux/mnt_namespace.h>
-+#include <linux/nsproxy.h>
-+#include <linux/gracl.h>
-+#include <linux/grdefs.h>
-+#include <linux/grmsg.h>
-+
-+void gr_add_learn_entry(const char *fmt, ...)
-+ __attribute__ ((format (printf, 1, 2)));
-+__u32 gr_search_file(const struct dentry *dentry, const __u32 mode,
-+ const struct vfsmount *mnt);
-+__u32 gr_check_create(const struct dentry *new_dentry,
-+ const struct dentry *parent,
-+ const struct vfsmount *mnt, const __u32 mode);
-+int gr_check_protected_task(const struct task_struct *task);
-+__u32 to_gr_audit(const __u32 reqmode);
-+int gr_set_acls(const int type);
-+int gr_apply_subject_to_task(struct task_struct *task);
-+int gr_acl_is_enabled(void);
-+char gr_roletype_to_char(void);
-+
-+void gr_handle_alertkill(struct task_struct *task);
-+char *gr_to_filename(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+char *gr_to_filename1(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+char *gr_to_filename2(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+char *gr_to_filename3(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+
-+extern int grsec_enable_ptrace_readexec;
-+extern int grsec_enable_harden_ptrace;
-+extern int grsec_enable_link;
-+extern int grsec_enable_fifo;
-+extern int grsec_enable_shm;
-+extern int grsec_enable_execlog;
-+extern int grsec_enable_signal;
-+extern int grsec_enable_audit_ptrace;
-+extern int grsec_enable_forkfail;
-+extern int grsec_enable_time;
-+extern int grsec_enable_rofs;
-+extern int grsec_enable_chroot_shmat;
-+extern int grsec_enable_chroot_mount;
-+extern int grsec_enable_chroot_double;
-+extern int grsec_enable_chroot_pivot;
-+extern int grsec_enable_chroot_chdir;
-+extern int grsec_enable_chroot_chmod;
-+extern int grsec_enable_chroot_mknod;
-+extern int grsec_enable_chroot_fchdir;
-+extern int grsec_enable_chroot_nice;
-+extern int grsec_enable_chroot_execlog;
-+extern int grsec_enable_chroot_caps;
-+extern int grsec_enable_chroot_sysctl;
-+extern int grsec_enable_chroot_unix;
-+extern int grsec_enable_symlinkown;
-+extern int grsec_symlinkown_gid;
-+extern int grsec_enable_tpe;
-+extern int grsec_tpe_gid;
-+extern int grsec_enable_tpe_all;
-+extern int grsec_enable_tpe_invert;
-+extern int grsec_enable_socket_all;
-+extern int grsec_socket_all_gid;
-+extern int grsec_enable_socket_client;
-+extern int grsec_socket_client_gid;
-+extern int grsec_enable_socket_server;
-+extern int grsec_socket_server_gid;
-+extern int grsec_audit_gid;
-+extern int grsec_enable_group;
-+extern int grsec_enable_audit_textrel;
-+extern int grsec_enable_log_rwxmaps;
-+extern int grsec_enable_mount;
-+extern int grsec_enable_chdir;
-+extern int grsec_resource_logging;
-+extern int grsec_enable_blackhole;
-+extern int grsec_lastack_retries;
-+extern int grsec_enable_brute;
-+extern int grsec_lock;
-+
-+extern spinlock_t grsec_alert_lock;
-+extern unsigned long grsec_alert_wtime;
-+extern unsigned long grsec_alert_fyet;
-+
-+extern spinlock_t grsec_audit_lock;
-+
-+extern rwlock_t grsec_exec_file_lock;
-+
-+#define gr_task_fullpath(tsk) ((tsk)->exec_file ? \
-+ gr_to_filename2((tsk)->exec_file->f_path.dentry, \
-+ (tsk)->exec_file->f_vfsmnt) : "/")
-+
-+#define gr_parent_task_fullpath(tsk) ((tsk)->real_parent->exec_file ? \
-+ gr_to_filename3((tsk)->real_parent->exec_file->f_path.dentry, \
-+ (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
-+
-+#define gr_task_fullpath0(tsk) ((tsk)->exec_file ? \
-+ gr_to_filename((tsk)->exec_file->f_path.dentry, \
-+ (tsk)->exec_file->f_vfsmnt) : "/")
-+
-+#define gr_parent_task_fullpath0(tsk) ((tsk)->real_parent->exec_file ? \
-+ gr_to_filename1((tsk)->real_parent->exec_file->f_path.dentry, \
-+ (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
-+
-+#define proc_is_chrooted(tsk_a) ((tsk_a)->gr_is_chrooted)
-+
-+#define have_same_root(tsk_a,tsk_b) ((tsk_a)->gr_chroot_dentry == (tsk_b)->gr_chroot_dentry)
-+
-+#define DEFAULTSECARGS(task, cred, pcred) gr_task_fullpath(task), (task)->comm, \
-+ (task)->pid, (cred)->uid, \
-+ (cred)->euid, (cred)->gid, (cred)->egid, \
-+ gr_parent_task_fullpath(task), \
-+ (task)->real_parent->comm, (task)->real_parent->pid, \
-+ (pcred)->uid, (pcred)->euid, \
-+ (pcred)->gid, (pcred)->egid
-+
-+#define GR_CHROOT_CAPS {{ \
-+ CAP_TO_MASK(CAP_LINUX_IMMUTABLE) | CAP_TO_MASK(CAP_NET_ADMIN) | \
-+ CAP_TO_MASK(CAP_SYS_MODULE) | CAP_TO_MASK(CAP_SYS_RAWIO) | \
-+ CAP_TO_MASK(CAP_SYS_PACCT) | CAP_TO_MASK(CAP_SYS_ADMIN) | \
-+ CAP_TO_MASK(CAP_SYS_BOOT) | CAP_TO_MASK(CAP_SYS_TIME) | \
-+ CAP_TO_MASK(CAP_NET_RAW) | CAP_TO_MASK(CAP_SYS_TTY_CONFIG) | \
-+ CAP_TO_MASK(CAP_IPC_OWNER) | CAP_TO_MASK(CAP_SETFCAP), \
-+ CAP_TO_MASK(CAP_MAC_ADMIN) }}
-+
-+#define security_learn(normal_msg,args...) \
-+({ \
-+ read_lock(&grsec_exec_file_lock); \
-+ gr_add_learn_entry(normal_msg "\n", ## args); \
-+ read_unlock(&grsec_exec_file_lock); \
-+})
-+
-+enum {
-+ GR_DO_AUDIT,
-+ GR_DONT_AUDIT,
-+ GR_DONT_AUDIT_GOOD
-+};
-+
-+enum {
-+ GR_TTYSNIFF,
-+ GR_RBAC,
-+ GR_RBAC_STR,
-+ GR_STR_RBAC,
-+ GR_RBAC_MODE2,
-+ GR_RBAC_MODE3,
-+ GR_FILENAME,
-+ GR_SYSCTL_HIDDEN,
-+ GR_NOARGS,
-+ GR_ONE_INT,
-+ GR_ONE_INT_TWO_STR,
-+ GR_ONE_STR,
-+ GR_STR_INT,
-+ GR_TWO_STR_INT,
-+ GR_TWO_INT,
-+ GR_TWO_U64,
-+ GR_THREE_INT,
-+ GR_FIVE_INT_TWO_STR,
-+ GR_TWO_STR,
-+ GR_THREE_STR,
-+ GR_FOUR_STR,
-+ GR_STR_FILENAME,
-+ GR_FILENAME_STR,
-+ GR_FILENAME_TWO_INT,
-+ GR_FILENAME_TWO_INT_STR,
-+ GR_TEXTREL,
-+ GR_PTRACE,
-+ GR_RESOURCE,
-+ GR_CAP,
-+ GR_SIG,
-+ GR_SIG2,
-+ GR_CRASH1,
-+ GR_CRASH2,
-+ GR_PSACCT,
-+ GR_RWXMAP
-+};
-+
-+#define gr_log_hidden_sysctl(audit, msg, str) gr_log_varargs(audit, msg, GR_SYSCTL_HIDDEN, str)
-+#define gr_log_ttysniff(audit, msg, task) gr_log_varargs(audit, msg, GR_TTYSNIFF, task)
-+#define gr_log_fs_rbac_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_RBAC, dentry, mnt)
-+#define gr_log_fs_rbac_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_RBAC_STR, dentry, mnt, str)
-+#define gr_log_fs_str_rbac(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_RBAC, str, dentry, mnt)
-+#define gr_log_fs_rbac_mode2(audit, msg, dentry, mnt, str1, str2) gr_log_varargs(audit, msg, GR_RBAC_MODE2, dentry, mnt, str1, str2)
-+#define gr_log_fs_rbac_mode3(audit, msg, dentry, mnt, str1, str2, str3) gr_log_varargs(audit, msg, GR_RBAC_MODE3, dentry, mnt, str1, str2, str3)
-+#define gr_log_fs_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_FILENAME, dentry, mnt)
-+#define gr_log_noargs(audit, msg) gr_log_varargs(audit, msg, GR_NOARGS)
-+#define gr_log_int(audit, msg, num) gr_log_varargs(audit, msg, GR_ONE_INT, num)
-+#define gr_log_int_str2(audit, msg, num, str1, str2) gr_log_varargs(audit, msg, GR_ONE_INT_TWO_STR, num, str1, str2)
-+#define gr_log_str(audit, msg, str) gr_log_varargs(audit, msg, GR_ONE_STR, str)
-+#define gr_log_str_int(audit, msg, str, num) gr_log_varargs(audit, msg, GR_STR_INT, str, num)
-+#define gr_log_int_int(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_INT, num1, num2)
-+#define gr_log_two_u64(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_U64, num1, num2)
-+#define gr_log_int3(audit, msg, num1, num2, num3) gr_log_varargs(audit, msg, GR_THREE_INT, num1, num2, num3)
-+#define gr_log_int5_str2(audit, msg, num1, num2, str1, str2) gr_log_varargs(audit, msg, GR_FIVE_INT_TWO_STR, num1, num2, str1, str2)
-+#define gr_log_str_str(audit, msg, str1, str2) gr_log_varargs(audit, msg, GR_TWO_STR, str1, str2)
-+#define gr_log_str2_int(audit, msg, str1, str2, num) gr_log_varargs(audit, msg, GR_TWO_STR_INT, str1, str2, num)
-+#define gr_log_str3(audit, msg, str1, str2, str3) gr_log_varargs(audit, msg, GR_THREE_STR, str1, str2, str3)
-+#define gr_log_str4(audit, msg, str1, str2, str3, str4) gr_log_varargs(audit, msg, GR_FOUR_STR, str1, str2, str3, str4)
-+#define gr_log_str_fs(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_FILENAME, str, dentry, mnt)
-+#define gr_log_fs_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_FILENAME_STR, dentry, mnt, str)
-+#define gr_log_fs_int2(audit, msg, dentry, mnt, num1, num2) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT, dentry, mnt, num1, num2)
-+#define gr_log_fs_int2_str(audit, msg, dentry, mnt, num1, num2, str) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT_STR, dentry, mnt, num1, num2, str)
-+#define gr_log_textrel_ulong_ulong(audit, msg, file, ulong1, ulong2) gr_log_varargs(audit, msg, GR_TEXTREL, file, ulong1, ulong2)
-+#define gr_log_ptrace(audit, msg, task) gr_log_varargs(audit, msg, GR_PTRACE, task)
-+#define gr_log_res_ulong2_str(audit, msg, task, ulong1, str, ulong2) gr_log_varargs(audit, msg, GR_RESOURCE, task, ulong1, str, ulong2)
-+#define gr_log_cap(audit, msg, task, str) gr_log_varargs(audit, msg, GR_CAP, task, str)
-+#define gr_log_sig_addr(audit, msg, str, addr) gr_log_varargs(audit, msg, GR_SIG, str, addr)
-+#define gr_log_sig_task(audit, msg, task, num) gr_log_varargs(audit, msg, GR_SIG2, task, num)
-+#define gr_log_crash1(audit, msg, task, ulong) gr_log_varargs(audit, msg, GR_CRASH1, task, ulong)
-+#define gr_log_crash2(audit, msg, task, ulong1) gr_log_varargs(audit, msg, GR_CRASH2, task, ulong1)
-+#define gr_log_procacct(audit, msg, task, num1, num2, num3, num4, num5, num6, num7, num8, num9) gr_log_varargs(audit, msg, GR_PSACCT, task, num1, num2, num3, num4, num5, num6, num7, num8, num9)
-+#define gr_log_rwxmap(audit, msg, str) gr_log_varargs(audit, msg, GR_RWXMAP, str)
-+
-+void gr_log_varargs(int audit, const char *msg, int argtypes, ...);
-+
-+#endif
-+
-+#endif
-diff --git a/include/linux/grmsg.h b/include/linux/grmsg.h
-new file mode 100644
-index 0000000..18863d1
---- /dev/null
-+++ b/include/linux/grmsg.h
-@@ -0,0 +1,111 @@
-+#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
-+#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
-+#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
-+#define GR_STOPMOD_MSG "denied modification of module state by "
-+#define GR_ROFS_BLOCKWRITE_MSG "denied write to block device %.950s by "
-+#define GR_ROFS_MOUNT_MSG "denied writable mount of %.950s by "
-+#define GR_IOPERM_MSG "denied use of ioperm() by "
-+#define GR_IOPL_MSG "denied use of iopl() by "
-+#define GR_SHMAT_ACL_MSG "denied attach of shared memory of UID %u, PID %d, ID %u by "
-+#define GR_UNIX_CHROOT_MSG "denied connect() to abstract AF_UNIX socket outside of chroot by "
-+#define GR_SHMAT_CHROOT_MSG "denied attach of shared memory outside of chroot by "
-+#define GR_MEM_READWRITE_MSG "denied access of range %Lx -> %Lx in /dev/mem by "
-+#define GR_SYMLINK_MSG "not following symlink %.950s owned by %d.%d by "
-+#define GR_LEARN_AUDIT_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%lu\t%lu\t%.4095s\t%lu\t%pI4"
-+#define GR_ID_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%c\t%d\t%d\t%d\t%pI4"
-+#define GR_HIDDEN_ACL_MSG "%s access to hidden file %.950s by "
-+#define GR_OPEN_ACL_MSG "%s open of %.950s for%s%s by "
-+#define GR_CREATE_ACL_MSG "%s create of %.950s for%s%s by "
-+#define GR_FIFO_MSG "denied writing FIFO %.950s of %d.%d by "
-+#define GR_MKNOD_CHROOT_MSG "denied mknod of %.950s from chroot by "
-+#define GR_MKNOD_ACL_MSG "%s mknod of %.950s by "
-+#define GR_UNIXCONNECT_ACL_MSG "%s connect() to the unix domain socket %.950s by "
-+#define GR_TTYSNIFF_ACL_MSG "terminal being sniffed by IP:%pI4 %.480s[%.16s:%d], parent %.480s[%.16s:%d] against "
-+#define GR_MKDIR_ACL_MSG "%s mkdir of %.950s by "
-+#define GR_RMDIR_ACL_MSG "%s rmdir of %.950s by "
-+#define GR_UNLINK_ACL_MSG "%s unlink of %.950s by "
-+#define GR_SYMLINK_ACL_MSG "%s symlink from %.480s to %.480s by "
-+#define GR_HARDLINK_MSG "denied hardlink of %.930s (owned by %d.%d) to %.30s for "
-+#define GR_LINK_ACL_MSG "%s link of %.480s to %.480s by "
-+#define GR_INHERIT_ACL_MSG "successful inherit of %.480s's ACL for %.480s by "
-+#define GR_RENAME_ACL_MSG "%s rename of %.480s to %.480s by "
-+#define GR_UNSAFESHARE_EXEC_ACL_MSG "denied exec with cloned fs of %.950s by "
-+#define GR_PTRACE_EXEC_ACL_MSG "denied ptrace of %.950s by "
-+#define GR_EXEC_ACL_MSG "%s execution of %.950s by "
-+#define GR_EXEC_TPE_MSG "denied untrusted exec (due to %.70s) of %.950s by "
-+#define GR_SEGVSTART_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning uid %u from login for %lu seconds"
-+#define GR_SEGVNOSUID_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning execution for %lu seconds"
-+#define GR_MOUNT_CHROOT_MSG "denied mount of %.256s as %.930s from chroot by "
-+#define GR_PIVOT_CHROOT_MSG "denied pivot_root from chroot by "
-+#define GR_TRUNCATE_ACL_MSG "%s truncate of %.950s by "
-+#define GR_ATIME_ACL_MSG "%s access time change of %.950s by "
-+#define GR_ACCESS_ACL_MSG "%s access of %.950s for%s%s%s by "
-+#define GR_CHROOT_CHROOT_MSG "denied double chroot to %.950s by "
-+#define GR_CHMOD_CHROOT_MSG "denied chmod +s of %.950s by "
-+#define GR_CHMOD_ACL_MSG "%s chmod of %.950s by "
-+#define GR_CHROOT_FCHDIR_MSG "denied fchdir outside of chroot to %.950s by "
-+#define GR_CHOWN_ACL_MSG "%s chown of %.950s by "
-+#define GR_SETXATTR_ACL_MSG "%s setting extended attributes of %.950s by "
-+#define GR_WRITLIB_ACL_MSG "denied load of writable library %.950s by "
-+#define GR_INITF_ACL_MSG "init_variables() failed %s by "
-+#define GR_DISABLED_ACL_MSG "Error loading %s, trying to run kernel with acls disabled. To disable acls at startup use <kernel image name> gracl=off from your boot loader"
-+#define GR_DEV_ACL_MSG "/dev/grsec: %d bytes sent %d required, being fed garbaged by "
-+#define GR_SHUTS_ACL_MSG "shutdown auth success for "
-+#define GR_SHUTF_ACL_MSG "shutdown auth failure for "
-+#define GR_SHUTI_ACL_MSG "ignoring shutdown for disabled RBAC system for "
-+#define GR_SEGVMODS_ACL_MSG "segvmod auth success for "
-+#define GR_SEGVMODF_ACL_MSG "segvmod auth failure for "
-+#define GR_SEGVMODI_ACL_MSG "ignoring segvmod for disabled RBAC system for "
-+#define GR_ENABLE_ACL_MSG "%s RBAC system loaded by "
-+#define GR_ENABLEF_ACL_MSG "unable to load %s for "
-+#define GR_RELOADI_ACL_MSG "ignoring reload request for disabled RBAC system"
-+#define GR_RELOAD_ACL_MSG "%s RBAC system reloaded by "
-+#define GR_RELOADF_ACL_MSG "failed reload of %s for "
-+#define GR_SPROLEI_ACL_MSG "ignoring change to special role for disabled RBAC system for "
-+#define GR_SPROLES_ACL_MSG "successful change to special role %s (id %d) by "
-+#define GR_SPROLEL_ACL_MSG "special role %s (id %d) exited by "
-+#define GR_SPROLEF_ACL_MSG "special role %s failure for "
-+#define GR_UNSPROLEI_ACL_MSG "ignoring unauth of special role for disabled RBAC system for "
-+#define GR_UNSPROLES_ACL_MSG "successful unauth of special role %s (id %d) by "
-+#define GR_INVMODE_ACL_MSG "invalid mode %d by "
-+#define GR_PRIORITY_CHROOT_MSG "denied priority change of process (%.16s:%d) by "
-+#define GR_FAILFORK_MSG "failed fork with errno %s by "
-+#define GR_NICE_CHROOT_MSG "denied priority change by "
-+#define GR_UNISIGLOG_MSG "%.32s occurred at %p in "
-+#define GR_DUALSIGLOG_MSG "signal %d sent to " DEFAULTSECMSG " by "
-+#define GR_SIG_ACL_MSG "denied send of signal %d to protected task " DEFAULTSECMSG " by "
-+#define GR_SYSCTL_MSG "denied modification of grsecurity sysctl value : %.32s by "
-+#define GR_SYSCTL_ACL_MSG "%s sysctl of %.950s for%s%s by "
-+#define GR_TIME_MSG "time set by "
-+#define GR_DEFACL_MSG "fatal: unable to find subject for (%.16s:%d), loaded by "
-+#define GR_MMAP_ACL_MSG "%s executable mmap of %.950s by "
-+#define GR_MPROTECT_ACL_MSG "%s executable mprotect of %.950s by "
-+#define GR_SOCK_MSG "denied socket(%.16s,%.16s,%.16s) by "
-+#define GR_SOCK_NOINET_MSG "denied socket(%.16s,%.16s,%d) by "
-+#define GR_BIND_MSG "denied bind() by "
-+#define GR_CONNECT_MSG "denied connect() by "
-+#define GR_BIND_ACL_MSG "denied bind() to %pI4 port %u sock type %.16s protocol %.16s by "
-+#define GR_CONNECT_ACL_MSG "denied connect() to %pI4 port %u sock type %.16s protocol %.16s by "
-+#define GR_IP_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%pI4\t%u\t%u\t%u\t%u\t%pI4"
-+#define GR_EXEC_CHROOT_MSG "exec of %.980s within chroot by process "
-+#define GR_CAP_ACL_MSG "use of %s denied for "
-+#define GR_CAP_CHROOT_MSG "use of %s in chroot denied for "
-+#define GR_CAP_ACL_MSG2 "use of %s permitted for "
-+#define GR_USRCHANGE_ACL_MSG "change to uid %u denied for "
-+#define GR_GRPCHANGE_ACL_MSG "change to gid %u denied for "
-+#define GR_REMOUNT_AUDIT_MSG "remount of %.256s by "
-+#define GR_UNMOUNT_AUDIT_MSG "unmount of %.256s by "
-+#define GR_MOUNT_AUDIT_MSG "mount of %.256s to %.256s by "
-+#define GR_CHDIR_AUDIT_MSG "chdir to %.980s by "
-+#define GR_EXEC_AUDIT_MSG "exec of %.930s (%.128s) by "
-+#define GR_RESOURCE_MSG "denied resource overstep by requesting %lu for %.16s against limit %lu for "
-+#define GR_RWXMMAP_MSG "denied RWX mmap of %.950s by "
-+#define GR_RWXMPROTECT_MSG "denied RWX mprotect of %.950s by "
-+#define GR_TEXTREL_AUDIT_MSG "text relocation in %s, VMA:0x%08lx 0x%08lx by "
-+#define GR_VM86_MSG "denied use of vm86 by "
-+#define GR_PTRACE_AUDIT_MSG "process %.950s(%.16s:%d) attached to via ptrace by "
-+#define GR_PTRACE_READEXEC_MSG "denied ptrace of unreadable binary %.950s by "
-+#define GR_INIT_TRANSFER_MSG "persistent special role transferred privilege to init by "
-+#define GR_BADPROCPID_MSG "denied read of sensitive /proc/pid/%s entry via fd passed across exec by "
-+#define GR_SYMLINKOWNER_MSG "denied following symlink %.950s since symlink owner %u does not match target owner %u, by "
-+#define GR_BRUTE_DAEMON_MSG "bruteforce prevention initiated for the next 30 minutes or until service restarted, stalling each fork 30 seconds. Please investigate the crash report for "
-diff --git a/include/linux/grsecurity.h b/include/linux/grsecurity.h
-new file mode 100644
-index 0000000..6e2f8bc
---- /dev/null
-+++ b/include/linux/grsecurity.h
-@@ -0,0 +1,226 @@
-+#ifndef GR_SECURITY_H
-+#define GR_SECURITY_H
-+#include <linux/fs.h>
-+#include <linux/fs_struct.h>
-+#include <linux/binfmts.h>
-+#include <linux/gracl.h>
-+#include <linux/compat.h>
-+
-+/* notify of brain-dead configs */
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) && defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+#error "CONFIG_GRKERNSEC_PROC_USER and CONFIG_GRKERNSEC_PROC_USERGROUP cannot both be enabled."
-+#endif
-+#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_PAGEEXEC) && !defined(CONFIG_PAX_SEGMEXEC) && !defined(CONFIG_PAX_KERNEXEC)
-+#error "CONFIG_PAX_NOEXEC enabled, but PAGEEXEC, SEGMEXEC, and KERNEXEC are disabled."
-+#endif
-+#if defined(CONFIG_PAX_ASLR) && !defined(CONFIG_PAX_RANDKSTACK) && !defined(CONFIG_PAX_RANDUSTACK) && !defined(CONFIG_PAX_RANDMMAP)
-+#error "CONFIG_PAX_ASLR enabled, but RANDKSTACK, RANDUSTACK, and RANDMMAP are disabled."
-+#endif
-+#if defined(CONFIG_PAX) && !defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_ASLR)
-+#error "CONFIG_PAX enabled, but no PaX options are enabled."
-+#endif
-+
-+void gr_handle_brute_attach(unsigned long mm_flags);
-+void gr_handle_brute_check(void);
-+void gr_handle_kernel_exploit(void);
-+int gr_process_user_ban(void);
-+
-+char gr_roletype_to_char(void);
-+
-+int gr_acl_enable_at_secure(void);
-+
-+int gr_check_user_change(int real, int effective, int fs);
-+int gr_check_group_change(int real, int effective, int fs);
-+
-+void gr_del_task_from_ip_table(struct task_struct *p);
-+
-+int gr_pid_is_chrooted(struct task_struct *p);
-+int gr_handle_chroot_fowner(struct pid *pid, enum pid_type type);
-+int gr_handle_chroot_nice(void);
-+int gr_handle_chroot_sysctl(const int op);
-+int gr_handle_chroot_setpriority(struct task_struct *p,
-+ const int niceval);
-+int gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt);
-+int gr_handle_chroot_chroot(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+void gr_handle_chroot_chdir(struct path *path);
-+int gr_handle_chroot_chmod(const struct dentry *dentry,
-+ const struct vfsmount *mnt, const int mode);
-+int gr_handle_chroot_mknod(const struct dentry *dentry,
-+ const struct vfsmount *mnt, const int mode);
-+int gr_handle_chroot_mount(const struct dentry *dentry,
-+ const struct vfsmount *mnt,
-+ const char *dev_name);
-+int gr_handle_chroot_pivot(void);
-+int gr_handle_chroot_unix(const pid_t pid);
-+
-+int gr_handle_rawio(const struct inode *inode);
-+
-+void gr_handle_ioperm(void);
-+void gr_handle_iopl(void);
-+
-+umode_t gr_acl_umask(void);
-+
-+int gr_tpe_allow(const struct file *file);
-+
-+void gr_set_chroot_entries(struct task_struct *task, struct path *path);
-+void gr_clear_chroot_entries(struct task_struct *task);
-+
-+void gr_log_forkfail(const int retval);
-+void gr_log_timechange(void);
-+void gr_log_signal(const int sig, const void *addr, const struct task_struct *t);
-+void gr_log_chdir(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+void gr_log_chroot_exec(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+void gr_handle_exec_args(struct linux_binprm *bprm, const char __user *const __user *argv);
-+#ifdef CONFIG_COMPAT
-+void gr_handle_exec_args_compat(struct linux_binprm *bprm, compat_uptr_t __user *argv);
-+#endif
-+void gr_log_remount(const char *devname, const int retval);
-+void gr_log_unmount(const char *devname, const int retval);
-+void gr_log_mount(const char *from, const char *to, const int retval);
-+void gr_log_textrel(struct vm_area_struct *vma);
-+void gr_log_rwxmmap(struct file *file);
-+void gr_log_rwxmprotect(struct file *file);
-+
-+int gr_handle_follow_link(const struct inode *parent,
-+ const struct inode *inode,
-+ const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+int gr_handle_fifo(const struct dentry *dentry,
-+ const struct vfsmount *mnt,
-+ const struct dentry *dir, const int flag,
-+ const int acc_mode);
-+int gr_handle_hardlink(const struct dentry *dentry,
-+ const struct vfsmount *mnt,
-+ struct inode *inode,
-+ const int mode, const char *to);
-+
-+int gr_is_capable(const int cap);
-+int gr_is_capable_nolog(const int cap);
-+void gr_learn_resource(const struct task_struct *task, const int limit,
-+ const unsigned long wanted, const int gt);
-+void gr_copy_label(struct task_struct *tsk);
-+void gr_handle_crash(struct task_struct *task, const int sig);
-+int gr_handle_signal(const struct task_struct *p, const int sig);
-+int gr_check_crash_uid(const uid_t uid);
-+int gr_check_protected_task(const struct task_struct *task);
-+int gr_check_protected_task_fowner(struct pid *pid, enum pid_type type);
-+int gr_acl_handle_mmap(const struct file *file,
-+ const unsigned long prot);
-+int gr_acl_handle_mprotect(const struct file *file,
-+ const unsigned long prot);
-+int gr_check_hidden_task(const struct task_struct *tsk);
-+__u32 gr_acl_handle_truncate(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+__u32 gr_acl_handle_utime(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+__u32 gr_acl_handle_access(const struct dentry *dentry,
-+ const struct vfsmount *mnt, const int fmode);
-+__u32 gr_acl_handle_chmod(const struct dentry *dentry,
-+ const struct vfsmount *mnt, umode_t *mode);
-+__u32 gr_acl_handle_chown(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+__u32 gr_acl_handle_setxattr(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+int gr_handle_ptrace(struct task_struct *task, const long request);
-+int gr_handle_proc_ptrace(struct task_struct *task);
-+__u32 gr_acl_handle_execve(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+int gr_check_crash_exec(const struct file *filp);
-+int gr_acl_is_enabled(void);
-+void gr_set_kernel_label(struct task_struct *task);
-+void gr_set_role_label(struct task_struct *task, const uid_t uid,
-+ const gid_t gid);
-+int gr_set_proc_label(const struct dentry *dentry,
-+ const struct vfsmount *mnt,
-+ const int unsafe_flags);
-+__u32 gr_acl_handle_hidden_file(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+__u32 gr_acl_handle_open(const struct dentry *dentry,
-+ const struct vfsmount *mnt, int acc_mode);
-+__u32 gr_acl_handle_creat(const struct dentry *dentry,
-+ const struct dentry *p_dentry,
-+ const struct vfsmount *p_mnt,
-+ int open_flags, int acc_mode, const int imode);
-+void gr_handle_create(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+void gr_handle_proc_create(const struct dentry *dentry,
-+ const struct inode *inode);
-+__u32 gr_acl_handle_mknod(const struct dentry *new_dentry,
-+ const struct dentry *parent_dentry,
-+ const struct vfsmount *parent_mnt,
-+ const int mode);
-+__u32 gr_acl_handle_mkdir(const struct dentry *new_dentry,
-+ const struct dentry *parent_dentry,
-+ const struct vfsmount *parent_mnt);
-+__u32 gr_acl_handle_rmdir(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+void gr_handle_delete(const ino_t ino, const dev_t dev);
-+__u32 gr_acl_handle_unlink(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+__u32 gr_acl_handle_symlink(const struct dentry *new_dentry,
-+ const struct dentry *parent_dentry,
-+ const struct vfsmount *parent_mnt,
-+ const char *from);
-+__u32 gr_acl_handle_link(const struct dentry *new_dentry,
-+ const struct dentry *parent_dentry,
-+ const struct vfsmount *parent_mnt,
-+ const struct dentry *old_dentry,
-+ const struct vfsmount *old_mnt, const char *to);
-+int gr_handle_symlink_owner(const struct path *link, const struct inode *target);
-+int gr_acl_handle_rename(struct dentry *new_dentry,
-+ struct dentry *parent_dentry,
-+ const struct vfsmount *parent_mnt,
-+ struct dentry *old_dentry,
-+ struct inode *old_parent_inode,
-+ struct vfsmount *old_mnt, const char *newname);
-+void gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
-+ struct dentry *old_dentry,
-+ struct dentry *new_dentry,
-+ struct vfsmount *mnt, const __u8 replace);
-+__u32 gr_check_link(const struct dentry *new_dentry,
-+ const struct dentry *parent_dentry,
-+ const struct vfsmount *parent_mnt,
-+ const struct dentry *old_dentry,
-+ const struct vfsmount *old_mnt);
-+int gr_acl_handle_filldir(const struct file *file, const char *name,
-+ const unsigned int namelen, const ino_t ino);
-+
-+__u32 gr_acl_handle_unix(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+void gr_acl_handle_exit(void);
-+void gr_acl_handle_psacct(struct task_struct *task, const long code);
-+int gr_acl_handle_procpidmem(const struct task_struct *task);
-+int gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags);
-+int gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode);
-+void gr_audit_ptrace(struct task_struct *task);
-+dev_t gr_get_dev_from_dentry(struct dentry *dentry);
-+void gr_put_exec_file(struct task_struct *task);
-+
-+int gr_ptrace_readexec(struct file *file, int unsafe_flags);
-+
-+#ifdef CONFIG_GRKERNSEC
-+void task_grsec_rbac(struct seq_file *m, struct task_struct *p);
-+void gr_handle_vm86(void);
-+void gr_handle_mem_readwrite(u64 from, u64 to);
-+
-+void gr_log_badprocpid(const char *entry);
-+
-+extern int grsec_enable_dmesg;
-+extern int grsec_disable_privio;
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+extern int grsec_proc_gid;
-+#endif
-+
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
-+extern int grsec_enable_chroot_findtask;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+extern int grsec_enable_setxid;
-+#endif
-+#endif
-+
-+#endif
-diff --git a/include/linux/hdpu_features.h b/include/linux/hdpu_features.h
-index 6a87154..a3ce57b 100644
---- a/include/linux/hdpu_features.h
-+++ b/include/linux/hdpu_features.h
-@@ -3,7 +3,7 @@
- struct cpustate_t {
- spinlock_t lock;
- int excl;
-- int open_count;
-+ atomic_t open_count;
- unsigned char cached_val;
- int inited;
- unsigned long *set_addr;
-diff --git a/include/linux/highmem.h b/include/linux/highmem.h
-index 211ff44..00ab6d7 100644
---- a/include/linux/highmem.h
-+++ b/include/linux/highmem.h
-@@ -137,6 +137,18 @@ static inline void clear_highpage(struct page *page)
- kunmap_atomic(kaddr, KM_USER0);
- }
-
-+static inline void sanitize_highpage(struct page *page)
-+{
-+ void *kaddr;
-+ unsigned long flags;
-+
-+ local_irq_save(flags);
-+ kaddr = kmap_atomic(page, KM_CLEARPAGE);
-+ clear_page(kaddr);
-+ kunmap_atomic(kaddr, KM_CLEARPAGE);
-+ local_irq_restore(flags);
-+}
-+
- static inline void zero_user_segments(struct page *page,
- unsigned start1, unsigned end1,
- unsigned start2, unsigned end2)
-diff --git a/include/linux/i2c.h b/include/linux/i2c.h
-index 7b40cda..24eb44e 100644
---- a/include/linux/i2c.h
-+++ b/include/linux/i2c.h
-@@ -325,6 +325,7 @@ struct i2c_algorithm {
- /* To determine what the adapter supports */
- u32 (*functionality) (struct i2c_adapter *);
- };
-+typedef struct i2c_algorithm __no_const i2c_algorithm_no_const;
-
- /*
- * i2c_adapter is the structure used to identify a physical i2c bus along
-diff --git a/include/linux/i2o.h b/include/linux/i2o.h
-index 4c4e57d..f3c5303 100644
---- a/include/linux/i2o.h
-+++ b/include/linux/i2o.h
-@@ -564,7 +564,7 @@ struct i2o_controller {
- struct i2o_device *exec; /* Executive */
- #if BITS_PER_LONG == 64
- spinlock_t context_list_lock; /* lock for context_list */
-- atomic_t context_list_counter; /* needed for unique contexts */
-+ atomic_unchecked_t context_list_counter; /* needed for unique contexts */
- struct list_head context_list; /* list of context id's
- and pointers */
- #endif
-diff --git a/include/linux/if_pppox.h b/include/linux/if_pppox.h
-index 90b5fae..a11a48e 100644
---- a/include/linux/if_pppox.h
-+++ b/include/linux/if_pppox.h
-@@ -175,7 +175,7 @@ struct pppox_proto {
- int (*ioctl)(struct socket *sock, unsigned int cmd,
- unsigned long arg);
- struct module *owner;
--};
-+} __do_const;
-
- extern int register_pppox_proto(int proto_num, struct pppox_proto *pp);
- extern void unregister_pppox_proto(int proto_num);
-diff --git a/include/linux/init.h b/include/linux/init.h
-index ff8bde5..ed08ca7 100644
---- a/include/linux/init.h
-+++ b/include/linux/init.h
-@@ -38,9 +38,36 @@
- * Also note, that this data cannot be "const".
- */
-
-+#ifdef MODULE
-+#define add_init_latent_entropy
-+#define add_devinit_latent_entropy
-+#define add_cpuinit_latent_entropy
-+#define add_meminit_latent_entropy
-+#else
-+#define add_init_latent_entropy __latent_entropy
-+
-+#ifdef CONFIG_HOTPLUG
-+#define add_devinit_latent_entropy
-+#else
-+#define add_devinit_latent_entropy __latent_entropy
-+#endif
-+
-+#ifdef CONFIG_HOTPLUG_CPU
-+#define add_cpuinit_latent_entropy
-+#else
-+#define add_cpuinit_latent_entropy __latent_entropy
-+#endif
-+
-+#ifdef CONFIG_MEMORY_HOTPLUG
-+#define add_meminit_latent_entropy
-+#else
-+#define add_meminit_latent_entropy __latent_entropy
-+#endif
-+#endif
-+
- /* These are for everybody (although not all archs will actually
- discard it in modules) */
--#define __init __section(.init.text) __cold notrace
-+#define __init __section(.init.text) __cold notrace add_init_latent_entropy
- #define __initdata __section(.init.data)
- #define __initconst __section(.init.rodata)
- #define __exitdata __section(.exit.data)
-@@ -75,7 +102,7 @@
- #define __exit __section(.exit.text) __exitused __cold
-
- /* Used for HOTPLUG */
--#define __devinit __section(.devinit.text) __cold
-+#define __devinit __section(.devinit.text) __cold add_devinit_latent_entropy
- #define __devinitdata __section(.devinit.data)
- #define __devinitconst __section(.devinit.rodata)
- #define __devexit __section(.devexit.text) __exitused __cold
-@@ -83,7 +110,7 @@
- #define __devexitconst __section(.devexit.rodata)
-
- /* Used for HOTPLUG_CPU */
--#define __cpuinit __section(.cpuinit.text) __cold
-+#define __cpuinit __section(.cpuinit.text) __cold add_cpuinit_latent_entropy
- #define __cpuinitdata __section(.cpuinit.data)
- #define __cpuinitconst __section(.cpuinit.rodata)
- #define __cpuexit __section(.cpuexit.text) __exitused __cold
-@@ -91,7 +118,7 @@
- #define __cpuexitconst __section(.cpuexit.rodata)
-
- /* Used for MEMORY_HOTPLUG */
--#define __meminit __section(.meminit.text) __cold
-+#define __meminit __section(.meminit.text) __cold add_meminit_latent_entropy
- #define __meminitdata __section(.meminit.data)
- #define __meminitconst __section(.meminit.rodata)
- #define __memexit __section(.memexit.text) __exitused __cold
-diff --git a/include/linux/init_task.h b/include/linux/init_task.h
-index 21a6f5d..7c7d19f 100644
---- a/include/linux/init_task.h
-+++ b/include/linux/init_task.h
-@@ -29,6 +29,8 @@ extern struct fs_struct init_fs;
- .running = 0, \
- .lock = __SPIN_LOCK_UNLOCKED(sig.cputimer.lock), \
- }, \
-+ .cred_guard_mutex = \
-+ __MUTEX_INITIALIZER(sig.cred_guard_mutex), \
- }
-
- extern struct nsproxy init_nsproxy;
-@@ -83,6 +85,12 @@ extern struct group_info init_groups;
- #define INIT_IDS
- #endif
-
-+#ifdef CONFIG_X86
-+#define INIT_TASK_THREAD_INFO .tinfo = INIT_THREAD_INFO,
-+#else
-+#define INIT_TASK_THREAD_INFO
-+#endif
-+
- #ifdef CONFIG_SECURITY_FILE_CAPABILITIES
- /*
- * Because of the reduced scope of CAP_SETPCAP when filesystem
-@@ -152,10 +160,9 @@ extern struct cred init_cred;
- .group_leader = &tsk, \
- .real_cred = &init_cred, \
- .cred = &init_cred, \
-- .cred_guard_mutex = \
-- __MUTEX_INITIALIZER(tsk.cred_guard_mutex), \
- .comm = "swapper", \
- .thread = INIT_THREAD, \
-+ INIT_TASK_THREAD_INFO \
- .fs = &init_fs, \
- .files = &init_files, \
- .signal = &init_signals, \
-diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
-index c739150..be577b5 100644
---- a/include/linux/interrupt.h
-+++ b/include/linux/interrupt.h
-@@ -369,7 +369,7 @@ enum
- /* map softirq index to softirq name. update 'softirq_to_name' in
- * kernel/softirq.c when adding a new softirq.
- */
--extern char *softirq_to_name[NR_SOFTIRQS];
-+extern const char * const softirq_to_name[NR_SOFTIRQS];
-
- /* softirq mask and active fields moved to irq_cpustat_t in
- * asm/hardirq.h to get better cache usage. KAO
-@@ -377,12 +377,12 @@ extern char *softirq_to_name[NR_SOFTIRQS];
-
- struct softirq_action
- {
-- void (*action)(struct softirq_action *);
-+ void (*action)(void);
- };
-
- asmlinkage void do_softirq(void);
- asmlinkage void __do_softirq(void);
--extern void open_softirq(int nr, void (*action)(struct softirq_action *));
-+extern void open_softirq(int nr, void (*action)(void));
- extern void softirq_init(void);
- #define __raise_softirq_irqoff(nr) do { or_softirq_pending(1UL << (nr)); } while (0)
- extern void raise_softirq_irqoff(unsigned int nr);
-diff --git a/include/linux/irq.h b/include/linux/irq.h
-index 2333710..74767a7 100644
---- a/include/linux/irq.h
-+++ b/include/linux/irq.h
-@@ -437,12 +437,12 @@ extern int set_irq_msi(unsigned int irq, struct msi_desc *entry);
- static inline bool alloc_desc_masks(struct irq_desc *desc, int node,
- bool boot)
- {
-+#ifdef CONFIG_CPUMASK_OFFSTACK
- gfp_t gfp = GFP_ATOMIC;
-
- if (boot)
- gfp = GFP_NOWAIT;
-
--#ifdef CONFIG_CPUMASK_OFFSTACK
- if (!alloc_cpumask_var_node(&desc->affinity, gfp, node))
- return false;
-
-diff --git a/include/linux/kallsyms.h b/include/linux/kallsyms.h
-index 7922742..27306a2 100644
---- a/include/linux/kallsyms.h
-+++ b/include/linux/kallsyms.h
-@@ -15,7 +15,8 @@
-
- struct module;
-
--#ifdef CONFIG_KALLSYMS
-+#if !defined(__INCLUDED_BY_HIDESYM) || !defined(CONFIG_KALLSYMS)
-+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
- /* Lookup the address for a symbol. Returns 0 if not found. */
- unsigned long kallsyms_lookup_name(const char *name);
-
-@@ -92,6 +93,15 @@ static inline int lookup_symbol_attrs(unsigned long addr, unsigned long *size, u
- /* Stupid that this does nothing, but I didn't create this mess. */
- #define __print_symbol(fmt, addr)
- #endif /*CONFIG_KALLSYMS*/
-+#else /* when included by kallsyms.c, vsnprintf.c, or
-+ arch/x86/kernel/dumpstack.c, with HIDESYM enabled */
-+extern void __print_symbol(const char *fmt, unsigned long address);
-+extern int sprint_symbol(char *buffer, unsigned long address);
-+const char *kallsyms_lookup(unsigned long addr,
-+ unsigned long *symbolsize,
-+ unsigned long *offset,
-+ char **modname, char *namebuf);
-+#endif
-
- /* This macro allows us to keep printk typechecking */
- static void __check_printsym_format(const char *fmt, ...)
-diff --git a/include/linux/kernel.h b/include/linux/kernel.h
-index 3526cd4..99206e2 100644
---- a/include/linux/kernel.h
-+++ b/include/linux/kernel.h
-@@ -163,6 +163,11 @@ extern int _cond_resched(void);
- (__x < 0) ? -__x : __x; \
- })
-
-+#define abs64(x) ({ \
-+ s64 __x = (x); \
-+ (__x < 0) ? -__x : __x; \
-+ })
-+
- #ifdef CONFIG_PROVE_LOCKING
- void might_fault(void);
- #else
-diff --git a/include/linux/kgdb.h b/include/linux/kgdb.h
-index 6adcc29..13369e8 100644
---- a/include/linux/kgdb.h
-+++ b/include/linux/kgdb.h
-@@ -74,8 +74,8 @@ void kgdb_breakpoint(void);
-
- extern int kgdb_connected;
-
--extern atomic_t kgdb_setting_breakpoint;
--extern atomic_t kgdb_cpu_doing_single_step;
-+extern atomic_unchecked_t kgdb_setting_breakpoint;
-+extern atomic_unchecked_t kgdb_cpu_doing_single_step;
-
- extern struct task_struct *kgdb_usethread;
- extern struct task_struct *kgdb_contthread;
-@@ -235,7 +235,7 @@ struct kgdb_arch {
- int (*remove_hw_breakpoint)(unsigned long, int, enum kgdb_bptype);
- void (*remove_all_hw_break)(void);
- void (*correct_hw_break)(void);
--};
-+} __do_const;
-
- /**
- * struct kgdb_io - Describe the interface for an I/O driver to talk with KGDB.
-@@ -257,14 +257,14 @@ struct kgdb_io {
- int (*init) (void);
- void (*pre_exception) (void);
- void (*post_exception) (void);
--};
-+} __do_const;
-
--extern struct kgdb_arch arch_kgdb_ops;
-+extern const struct kgdb_arch arch_kgdb_ops;
-
- extern unsigned long __weak kgdb_arch_pc(int exception, struct pt_regs *regs);
-
--extern int kgdb_register_io_module(struct kgdb_io *local_kgdb_io_ops);
--extern void kgdb_unregister_io_module(struct kgdb_io *local_kgdb_io_ops);
-+extern int kgdb_register_io_module(const struct kgdb_io *local_kgdb_io_ops);
-+extern void kgdb_unregister_io_module(const struct kgdb_io *local_kgdb_io_ops);
-
- extern int kgdb_hex2long(char **ptr, unsigned long *long_val);
- extern int kgdb_mem2hex(char *mem, char *buf, int count);
-diff --git a/include/linux/kmod.h b/include/linux/kmod.h
-index 0546fe7..2a22bc1 100644
---- a/include/linux/kmod.h
-+++ b/include/linux/kmod.h
-@@ -31,6 +31,8 @@
- * usually useless though. */
- extern int __request_module(bool wait, const char *name, ...) \
- __attribute__((format(printf, 2, 3)));
-+extern int ___request_module(bool wait, char *param_name, const char *name, ...) \
-+ __attribute__((format(printf, 3, 4)));
- #define request_module(mod...) __request_module(true, mod)
- #define request_module_nowait(mod...) __request_module(false, mod)
- #define try_then_request_module(x, mod...) \
-diff --git a/include/linux/kobject.h b/include/linux/kobject.h
-index 58ae8e0..8ce9617 100644
---- a/include/linux/kobject.h
-+++ b/include/linux/kobject.h
-@@ -106,9 +106,9 @@ extern char *kobject_get_path(struct kobject *kobj, gfp_t flag);
-
- struct kobj_type {
- void (*release)(struct kobject *kobj);
-- struct sysfs_ops *sysfs_ops;
-+ const struct sysfs_ops *sysfs_ops;
- struct attribute **default_attrs;
--};
-+} __do_const;
-
- struct kobj_uevent_env {
- char *envp[UEVENT_NUM_ENVP];
-@@ -118,9 +118,9 @@ struct kobj_uevent_env {
- };
-
- struct kset_uevent_ops {
-- int (*filter)(struct kset *kset, struct kobject *kobj);
-- const char *(*name)(struct kset *kset, struct kobject *kobj);
-- int (*uevent)(struct kset *kset, struct kobject *kobj,
-+ int (* const filter)(struct kset *kset, struct kobject *kobj);
-+ const char *(* const name)(struct kset *kset, struct kobject *kobj);
-+ int (* const uevent)(struct kset *kset, struct kobject *kobj,
- struct kobj_uevent_env *env);
- };
-
-@@ -132,7 +132,7 @@ struct kobj_attribute {
- const char *buf, size_t count);
- };
-
--extern struct sysfs_ops kobj_sysfs_ops;
-+extern const struct sysfs_ops kobj_sysfs_ops;
-
- /**
- * struct kset - a set of kobjects of a specific type, belonging to a specific subsystem.
-@@ -155,14 +155,14 @@ struct kset {
- struct list_head list;
- spinlock_t list_lock;
- struct kobject kobj;
-- struct kset_uevent_ops *uevent_ops;
-+ const struct kset_uevent_ops *uevent_ops;
- };
-
- extern void kset_init(struct kset *kset);
- extern int __must_check kset_register(struct kset *kset);
- extern void kset_unregister(struct kset *kset);
- extern struct kset * __must_check kset_create_and_add(const char *name,
-- struct kset_uevent_ops *u,
-+ const struct kset_uevent_ops *u,
- struct kobject *parent_kobj);
-
- static inline struct kset *to_kset(struct kobject *kobj)
-diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
-index 8bfed57..07be660 100644
---- a/include/linux/kvm_host.h
-+++ b/include/linux/kvm_host.h
-@@ -210,7 +210,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vcpu);
- void vcpu_load(struct kvm_vcpu *vcpu);
- void vcpu_put(struct kvm_vcpu *vcpu);
-
--int kvm_init(void *opaque, unsigned int vcpu_size,
-+int kvm_init(const void *opaque, unsigned int vcpu_size,
- struct module *module);
- void kvm_exit(void);
-
-@@ -316,7 +316,7 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(struct kvm_vcpu *vcpu,
- struct kvm_guest_debug *dbg);
- int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run);
-
--int kvm_arch_init(void *opaque);
-+int kvm_arch_init(const void *opaque);
- void kvm_arch_exit(void);
-
- int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
-diff --git a/include/linux/libata.h b/include/linux/libata.h
-index a069916..223edde 100644
---- a/include/linux/libata.h
-+++ b/include/linux/libata.h
-@@ -525,11 +525,11 @@ struct ata_ioports {
-
- struct ata_host {
- spinlock_t lock;
-- struct device *dev;
-+ struct device *dev;
- void __iomem * const *iomap;
- unsigned int n_ports;
- void *private_data;
-- struct ata_port_operations *ops;
-+ const struct ata_port_operations *ops;
- unsigned long flags;
- #ifdef CONFIG_ATA_ACPI
- acpi_handle acpi_handle;
-@@ -710,7 +710,7 @@ struct ata_link {
-
- struct ata_port {
- struct Scsi_Host *scsi_host; /* our co-allocated scsi host */
-- struct ata_port_operations *ops;
-+ const struct ata_port_operations *ops;
- spinlock_t *lock;
- /* Flags owned by the EH context. Only EH should touch these once the
- port is active */
-@@ -884,7 +884,7 @@ struct ata_port_operations {
- * fields must be pointers.
- */
- const struct ata_port_operations *inherits;
--};
-+} __do_const;
-
- struct ata_port_info {
- unsigned long flags;
-@@ -892,7 +892,7 @@ struct ata_port_info {
- unsigned long pio_mask;
- unsigned long mwdma_mask;
- unsigned long udma_mask;
-- struct ata_port_operations *port_ops;
-+ const struct ata_port_operations *port_ops;
- void *private_data;
- };
-
-@@ -916,7 +916,7 @@ extern const unsigned long sata_deb_timing_normal[];
- extern const unsigned long sata_deb_timing_hotplug[];
- extern const unsigned long sata_deb_timing_long[];
-
--extern struct ata_port_operations ata_dummy_port_ops;
-+extern const struct ata_port_operations ata_dummy_port_ops;
- extern const struct ata_port_info ata_dummy_port_info;
-
- static inline const unsigned long *
-@@ -962,7 +962,7 @@ extern int ata_host_activate(struct ata_host *host, int irq,
- struct scsi_host_template *sht);
- extern void ata_host_detach(struct ata_host *host);
- extern void ata_host_init(struct ata_host *, struct device *,
-- unsigned long, struct ata_port_operations *);
-+ unsigned long, const struct ata_port_operations *);
- extern int ata_scsi_detect(struct scsi_host_template *sht);
- extern int ata_scsi_ioctl(struct scsi_device *dev, int cmd, void __user *arg);
- extern int ata_scsi_queuecmd(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *));
-diff --git a/include/linux/list.h b/include/linux/list.h
-index 969f6e9..0327c33 100644
---- a/include/linux/list.h
-+++ b/include/linux/list.h
-@@ -110,6 +110,9 @@ static inline void list_del(struct list_head *entry)
- extern void list_del(struct list_head *entry);
- #endif
-
-+extern void pax_list_add_tail(struct list_head *new, struct list_head *head);
-+extern void pax_list_del(struct list_head *entry);
-+
- /**
- * list_replace - replace old entry by new one
- * @old : the element to be replaced
-diff --git a/include/linux/lockd/bind.h b/include/linux/lockd/bind.h
-index fbc48f8..0886e57 100644
---- a/include/linux/lockd/bind.h
-+++ b/include/linux/lockd/bind.h
-@@ -23,13 +23,13 @@ struct svc_rqst;
- * This is the set of functions for lockd->nfsd communication
- */
- struct nlmsvc_binding {
-- __be32 (*fopen)(struct svc_rqst *,
-+ __be32 (* const fopen)(struct svc_rqst *,
- struct nfs_fh *,
- struct file **);
-- void (*fclose)(struct file *);
-+ void (* const fclose)(struct file *);
- };
-
--extern struct nlmsvc_binding * nlmsvc_ops;
-+extern const struct nlmsvc_binding * nlmsvc_ops;
-
- /*
- * Similar to nfs_client_initdata, but without the NFS-specific
-diff --git a/include/linux/math64.h b/include/linux/math64.h
-index c87f152..23fcdfc 100644
---- a/include/linux/math64.h
-+++ b/include/linux/math64.h
-@@ -35,6 +35,14 @@ static inline u64 div64_u64(u64 dividend, u64 divisor)
- return dividend / divisor;
- }
-
-+/**
-+ * div64_s64 - signed 64bit divide with 64bit divisor
-+ */
-+static inline s64 div64_s64(s64 dividend, s64 divisor)
-+{
-+ return dividend / divisor;
-+}
-+
- #elif BITS_PER_LONG == 32
-
- #ifndef div_u64_rem
-@@ -53,6 +61,10 @@ extern s64 div_s64_rem(s64 dividend, s32 divisor, s32 *remainder);
- extern u64 div64_u64(u64 dividend, u64 divisor);
- #endif
-
-+#ifndef div64_s64
-+extern s64 div64_s64(s64 dividend, s64 divisor);
-+#endif
-+
- #endif /* BITS_PER_LONG */
-
- /**
-diff --git a/include/linux/mca.h b/include/linux/mca.h
-index 3797270..7765ede 100644
---- a/include/linux/mca.h
-+++ b/include/linux/mca.h
-@@ -80,7 +80,7 @@ struct mca_bus_accessor_functions {
- int region);
- void * (*mca_transform_memory)(struct mca_device *,
- void *memory);
--};
-+} __no_const;
-
- struct mca_bus {
- u64 default_dma_mask;
-diff --git a/include/linux/mm.h b/include/linux/mm.h
-index 11e5be6..8ff8c91 100644
---- a/include/linux/mm.h
-+++ b/include/linux/mm.h
-@@ -106,7 +106,14 @@ extern unsigned int kobjsize(const void *objp);
-
- #define VM_CAN_NONLINEAR 0x08000000 /* Has ->fault & does nonlinear pages */
- #define VM_MIXEDMAP 0x10000000 /* Can contain "struct page" and pure PFN pages */
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
-+#define VM_SAO 0x00000000 /* Strong Access Ordering (powerpc) */
-+#define VM_PAGEEXEC 0x20000000 /* vma->vm_page_prot needs special handling */
-+#else
- #define VM_SAO 0x20000000 /* Strong Access Ordering (powerpc) */
-+#endif
-+
- #define VM_PFN_AT_MMAP 0x40000000 /* PFNMAP vma that is fully mapped at mmap time */
- #define VM_MERGEABLE 0x80000000 /* KSM may merge identical pages */
-
-@@ -841,12 +848,6 @@ int set_page_dirty(struct page *page);
- int set_page_dirty_lock(struct page *page);
- int clear_page_dirty_for_io(struct page *page);
-
--/* Is the vma a continuation of the stack vma above it? */
--static inline int vma_stack_continue(struct vm_area_struct *vma, unsigned long addr)
--{
-- return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN);
--}
--
- extern unsigned long move_page_tables(struct vm_area_struct *vma,
- unsigned long old_addr, struct vm_area_struct *new_vma,
- unsigned long new_addr, unsigned long len);
-@@ -890,6 +891,8 @@ struct shrinker {
- extern void register_shrinker(struct shrinker *);
- extern void unregister_shrinker(struct shrinker *);
-
-+pgprot_t vm_get_page_prot(unsigned long vm_flags);
-+
- int vma_wants_writenotify(struct vm_area_struct *vma);
-
- extern pte_t *get_locked_pte(struct mm_struct *mm, unsigned long addr, spinlock_t **ptl);
-@@ -900,8 +903,15 @@ static inline int __pud_alloc(struct mm_struct *mm, pgd_t *pgd,
- {
- return 0;
- }
-+
-+static inline int __pud_alloc_kernel(struct mm_struct *mm, pgd_t *pgd,
-+ unsigned long address)
-+{
-+ return 0;
-+}
- #else
- int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address);
-+int __pud_alloc_kernel(struct mm_struct *mm, pgd_t *pgd, unsigned long address);
- #endif
-
- #ifdef __PAGETABLE_PMD_FOLDED
-@@ -910,8 +920,15 @@ static inline int __pmd_alloc(struct mm_struct *mm, pud_t *pud,
- {
- return 0;
- }
-+
-+static inline int __pmd_alloc_kernel(struct mm_struct *mm, pud_t *pud,
-+ unsigned long address)
-+{
-+ return 0;
-+}
- #else
- int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address);
-+int __pmd_alloc_kernel(struct mm_struct *mm, pud_t *pud, unsigned long address);
- #endif
-
- int __pte_alloc(struct mm_struct *mm, pmd_t *pmd, unsigned long address);
-@@ -928,11 +945,23 @@ static inline pud_t *pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long a
- NULL: pud_offset(pgd, address);
- }
-
-+static inline pud_t *pud_alloc_kernel(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
-+{
-+ return (unlikely(pgd_none(*pgd)) && __pud_alloc_kernel(mm, pgd, address))?
-+ NULL: pud_offset(pgd, address);
-+}
-+
- static inline pmd_t *pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
- {
- return (unlikely(pud_none(*pud)) && __pmd_alloc(mm, pud, address))?
- NULL: pmd_offset(pud, address);
- }
-+
-+static inline pmd_t *pmd_alloc_kernel(struct mm_struct *mm, pud_t *pud, unsigned long address)
-+{
-+ return (unlikely(pud_none(*pud)) && __pmd_alloc_kernel(mm, pud, address))?
-+ NULL: pmd_offset(pud, address);
-+}
- #endif /* CONFIG_MMU && !__ARCH_HAS_4LEVEL_HACK */
-
- #if USE_SPLIT_PTLOCKS
-@@ -1162,6 +1191,7 @@ out:
- }
-
- extern int do_munmap(struct mm_struct *, unsigned long, size_t);
-+extern int __do_munmap(struct mm_struct *, unsigned long, size_t);
-
- extern unsigned long do_brk(unsigned long, unsigned long);
-
-@@ -1218,6 +1248,10 @@ extern struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long add
- extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
- struct vm_area_struct **pprev);
-
-+extern struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma);
-+extern void pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma);
-+extern void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl);
-+
- /* Look up the first VMA which intersects the interval start_addr..end_addr-1,
- NULL if none. Assume start_addr < end_addr. */
- static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr)
-@@ -1234,7 +1268,6 @@ static inline unsigned long vma_pages(struct vm_area_struct *vma)
- return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
- }
-
--pgprot_t vm_get_page_prot(unsigned long vm_flags);
- struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr);
- int remap_pfn_range(struct vm_area_struct *, unsigned long addr,
- unsigned long pfn, unsigned long size, pgprot_t);
-@@ -1332,7 +1365,13 @@ extern void memory_failure(unsigned long pfn, int trapno);
- extern int __memory_failure(unsigned long pfn, int trapno, int ref);
- extern int sysctl_memory_failure_early_kill;
- extern int sysctl_memory_failure_recovery;
--extern atomic_long_t mce_bad_pages;
-+extern atomic_long_unchecked_t mce_bad_pages;
-+
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+extern void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot);
-+#else
-+static inline void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot) {}
-+#endif
-
- #endif /* __KERNEL__ */
- #endif /* _LINUX_MM_H */
-diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
-index 9d12ed5..9d9dab3 100644
---- a/include/linux/mm_types.h
-+++ b/include/linux/mm_types.h
-@@ -186,6 +186,8 @@ struct vm_area_struct {
- #ifdef CONFIG_NUMA
- struct mempolicy *vm_policy; /* NUMA policy for the VMA */
- #endif
-+
-+ struct vm_area_struct *vm_mirror;/* PaX: mirror vma or NULL */
- };
-
- struct core_thread {
-@@ -235,7 +237,7 @@ struct mm_struct {
- unsigned long total_vm, locked_vm, shared_vm, exec_vm;
- unsigned long stack_vm, reserved_vm, def_flags, nr_ptes;
- unsigned long start_code, end_code, start_data, end_data;
-- unsigned long start_brk, brk, start_stack;
-+ unsigned long brk_gap, start_brk, brk, start_stack;
- unsigned long arg_start, arg_end, env_start, env_end;
-
- unsigned long saved_auxv[AT_VECTOR_SIZE]; /* for /proc/PID/auxv */
-@@ -287,6 +289,24 @@ struct mm_struct {
- #ifdef CONFIG_MMU_NOTIFIER
- struct mmu_notifier_mm *mmu_notifier_mm;
- #endif
-+
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+ unsigned long pax_flags;
-+#endif
-+
-+#ifdef CONFIG_PAX_DLRESOLVE
-+ unsigned long call_dl_resolve;
-+#endif
-+
-+#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
-+ unsigned long call_syscall;
-+#endif
-+
-+#ifdef CONFIG_PAX_ASLR
-+ unsigned long delta_mmap; /* randomized offset */
-+ unsigned long delta_stack; /* randomized offset */
-+#endif
-+
- };
-
- /* Future-safe accessor for struct mm_struct's cpu_vm_mask. */
-diff --git a/include/linux/mmiotrace.h b/include/linux/mmiotrace.h
-index 97491f7..2265523 100644
---- a/include/linux/mmiotrace.h
-+++ b/include/linux/mmiotrace.h
-@@ -46,7 +46,7 @@ extern int kmmio_handler(struct pt_regs *regs, unsigned long addr);
- /* Called from ioremap.c */
- extern void mmiotrace_ioremap(resource_size_t offset, unsigned long size,
- void __iomem *addr);
--extern void mmiotrace_iounmap(volatile void __iomem *addr);
-+extern void mmiotrace_iounmap(const volatile void __iomem *addr);
-
- /* For anyone to insert markers. Remember trailing newline. */
- extern int mmiotrace_printk(const char *fmt, ...)
-@@ -67,7 +67,7 @@ static inline void mmiotrace_ioremap(resource_size_t offset,
- {
- }
-
--static inline void mmiotrace_iounmap(volatile void __iomem *addr)
-+static inline void mmiotrace_iounmap(const volatile void __iomem *addr)
- {
- }
-
-diff --git a/include/linux/mmu_notifier.h b/include/linux/mmu_notifier.h
-index 4e02ee2..afb159e 100644
---- a/include/linux/mmu_notifier.h
-+++ b/include/linux/mmu_notifier.h
-@@ -235,12 +235,12 @@ static inline void mmu_notifier_mm_destroy(struct mm_struct *mm)
- */
- #define ptep_clear_flush_notify(__vma, __address, __ptep) \
- ({ \
-- pte_t __pte; \
-+ pte_t ___pte; \
- struct vm_area_struct *___vma = __vma; \
- unsigned long ___address = __address; \
-- __pte = ptep_clear_flush(___vma, ___address, __ptep); \
-+ ___pte = ptep_clear_flush(___vma, ___address, __ptep); \
- mmu_notifier_invalidate_page(___vma->vm_mm, ___address); \
-- __pte; \
-+ ___pte; \
- })
-
- #define ptep_clear_flush_young_notify(__vma, __address, __ptep) \
-diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
-index 6c31a2a..4b0e930 100644
---- a/include/linux/mmzone.h
-+++ b/include/linux/mmzone.h
-@@ -350,7 +350,7 @@ struct zone {
- unsigned long flags; /* zone flags, see below */
-
- /* Zone statistics */
-- atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
-+ atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
-
- /*
- * prev_priority holds the scanning priority for this zone. It is
-diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
-index f58e9d83..3503935 100644
---- a/include/linux/mod_devicetable.h
-+++ b/include/linux/mod_devicetable.h
-@@ -12,7 +12,7 @@
- typedef unsigned long kernel_ulong_t;
- #endif
-
--#define PCI_ANY_ID (~0)
-+#define PCI_ANY_ID ((__u16)~0)
-
- struct pci_device_id {
- __u32 vendor, device; /* Vendor and device ID or PCI_ANY_ID*/
-@@ -131,7 +131,7 @@ struct usb_device_id {
- #define USB_DEVICE_ID_MATCH_INT_SUBCLASS 0x0100
- #define USB_DEVICE_ID_MATCH_INT_PROTOCOL 0x0200
-
--#define HID_ANY_ID (~0)
-+#define HID_ANY_ID (~0U)
-
- struct hid_device_id {
- __u16 bus;
-diff --git a/include/linux/module.h b/include/linux/module.h
-index 482efc8..4ba6781 100644
---- a/include/linux/module.h
-+++ b/include/linux/module.h
-@@ -16,9 +16,11 @@
- #include <linux/kobject.h>
- #include <linux/moduleparam.h>
- #include <linux/tracepoint.h>
-+#include <linux/fs.h>
-
- #include <asm/local.h>
- #include <asm/module.h>
-+#include <asm/pgtable.h>
-
- #include <trace/events/module.h>
-
-@@ -287,16 +289,16 @@ struct module
- int (*init)(void);
-
- /* If this is non-NULL, vfree after init() returns */
-- void *module_init;
-+ void *module_init_rx, *module_init_rw;
-
- /* Here is the actual code + data, vfree'd on unload. */
-- void *module_core;
-+ void *module_core_rx, *module_core_rw;
-
- /* Here are the sizes of the init and core sections */
-- unsigned int init_size, core_size;
-+ unsigned int init_size_rw, core_size_rw;
-
- /* The size of the executable code in each section. */
-- unsigned int init_text_size, core_text_size;
-+ unsigned int init_size_rx, core_size_rx;
-
- /* Arch-specific module values */
- struct mod_arch_specific arch;
-@@ -345,6 +347,10 @@ struct module
- #ifdef CONFIG_EVENT_TRACING
- struct ftrace_event_call *trace_events;
- unsigned int num_trace_events;
-+ struct file_operations trace_id;
-+ struct file_operations trace_enable;
-+ struct file_operations trace_format;
-+ struct file_operations trace_filter;
- #endif
- #ifdef CONFIG_FTRACE_MCOUNT_RECORD
- unsigned long *ftrace_callsites;
-@@ -393,16 +399,46 @@ struct module *__module_address(unsigned long addr);
- bool is_module_address(unsigned long addr);
- bool is_module_text_address(unsigned long addr);
-
-+static inline int within_module_range(unsigned long addr, void *start, unsigned long size)
-+{
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ if (ktla_ktva(addr) >= (unsigned long)start &&
-+ ktla_ktva(addr) < (unsigned long)start + size)
-+ return 1;
-+#endif
-+
-+ return ((void *)addr >= start && (void *)addr < start + size);
-+}
-+
-+static inline int within_module_core_rx(unsigned long addr, struct module *mod)
-+{
-+ return within_module_range(addr, mod->module_core_rx, mod->core_size_rx);
-+}
-+
-+static inline int within_module_core_rw(unsigned long addr, struct module *mod)
-+{
-+ return within_module_range(addr, mod->module_core_rw, mod->core_size_rw);
-+}
-+
-+static inline int within_module_init_rx(unsigned long addr, struct module *mod)
-+{
-+ return within_module_range(addr, mod->module_init_rx, mod->init_size_rx);
-+}
-+
-+static inline int within_module_init_rw(unsigned long addr, struct module *mod)
-+{
-+ return within_module_range(addr, mod->module_init_rw, mod->init_size_rw);
-+}
-+
- static inline int within_module_core(unsigned long addr, struct module *mod)
- {
-- return (unsigned long)mod->module_core <= addr &&
-- addr < (unsigned long)mod->module_core + mod->core_size;
-+ return within_module_core_rx(addr, mod) || within_module_core_rw(addr, mod);
- }
-
- static inline int within_module_init(unsigned long addr, struct module *mod)
- {
-- return (unsigned long)mod->module_init <= addr &&
-- addr < (unsigned long)mod->module_init + mod->init_size;
-+ return within_module_init_rx(addr, mod) || within_module_init_rw(addr, mod);
- }
-
- /* Search for module by name: must hold module_mutex. */
-diff --git a/include/linux/moduleloader.h b/include/linux/moduleloader.h
-index c1f40c2..f26b93c 100644
---- a/include/linux/moduleloader.h
-+++ b/include/linux/moduleloader.h
-@@ -20,9 +20,21 @@ unsigned int arch_mod_section_prepend(struct module *mod, unsigned int section);
- sections. Returns NULL on failure. */
- void *module_alloc(unsigned long size);
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+void *module_alloc_exec(unsigned long size) __size_overflow(1);
-+#else
-+#define module_alloc_exec(x) module_alloc(x)
-+#endif
-+
- /* Free memory returned from module_alloc. */
- void module_free(struct module *mod, void *module_region);
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+void module_free_exec(struct module *mod, void *module_region);
-+#else
-+#define module_free_exec(x, y) module_free((x), (y))
-+#endif
-+
- /* Apply the given relocation to the (simplified) ELF. Return -error
- or 0. */
- int apply_relocate(Elf_Shdr *sechdrs,
-diff --git a/include/linux/moduleparam.h b/include/linux/moduleparam.h
-index 82a9124..8a5f622 100644
---- a/include/linux/moduleparam.h
-+++ b/include/linux/moduleparam.h
-@@ -132,7 +132,7 @@ struct kparam_array
-
- /* Actually copy string: maxlen param is usually sizeof(string). */
- #define module_param_string(name, string, len, perm) \
-- static const struct kparam_string __param_string_##name \
-+ static const struct kparam_string __param_string_##name __used \
- = { len, string }; \
- __module_param_call(MODULE_PARAM_PREFIX, name, \
- param_set_copystring, param_get_string, \
-@@ -211,7 +211,7 @@ extern int param_get_invbool(char *buffer, struct kernel_param *kp);
-
- /* Comma-separated array: *nump is set to number they actually specified. */
- #define module_param_array_named(name, array, type, nump, perm) \
-- static const struct kparam_array __param_arr_##name \
-+ static const struct kparam_array __param_arr_##name __used \
- = { ARRAY_SIZE(array), nump, param_set_##type, param_get_##type,\
- sizeof(array[0]), array }; \
- __module_param_call(MODULE_PARAM_PREFIX, name, \
-diff --git a/include/linux/mutex.h b/include/linux/mutex.h
-index 878cab4..c92cb3e 100644
---- a/include/linux/mutex.h
-+++ b/include/linux/mutex.h
-@@ -51,7 +51,7 @@ struct mutex {
- spinlock_t wait_lock;
- struct list_head wait_list;
- #if defined(CONFIG_DEBUG_MUTEXES) || defined(CONFIG_SMP)
-- struct thread_info *owner;
-+ struct task_struct *owner;
- #endif
- #ifdef CONFIG_DEBUG_MUTEXES
- const char *name;
-diff --git a/include/linux/namei.h b/include/linux/namei.h
-index ec0f607..fa088ac4 100644
---- a/include/linux/namei.h
-+++ b/include/linux/namei.h
-@@ -22,7 +22,7 @@ struct nameidata {
- unsigned int flags;
- int last_type;
- unsigned depth;
-- char *saved_names[MAX_NESTED_LINKS + 1];
-+ const char *saved_names[MAX_NESTED_LINKS + 1];
-
- /* Intent data */
- union {
-@@ -49,6 +49,8 @@ enum {LAST_NORM, LAST_ROOT, LAST_DOT, LAST_DOTDOT, LAST_BIND};
- #define LOOKUP_CONTINUE 4
- #define LOOKUP_PARENT 16
- #define LOOKUP_REVAL 64
-+#define LOOKUP_SYMLINKOWN 128
-+
- /*
- * Intent data
- */
-@@ -84,12 +86,12 @@ extern int follow_up(struct path *);
- extern struct dentry *lock_rename(struct dentry *, struct dentry *);
- extern void unlock_rename(struct dentry *, struct dentry *);
-
--static inline void nd_set_link(struct nameidata *nd, char *path)
-+static inline void nd_set_link(struct nameidata *nd, const char *path)
- {
- nd->saved_names[nd->depth] = path;
- }
-
--static inline char *nd_get_link(struct nameidata *nd)
-+static inline const char *nd_get_link(const struct nameidata *nd)
- {
- return nd->saved_names[nd->depth];
- }
-diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
-index 9d7e8f7..04428c5 100644
---- a/include/linux/netdevice.h
-+++ b/include/linux/netdevice.h
-@@ -637,6 +637,7 @@ struct net_device_ops {
- u16 xid);
- #endif
- };
-+typedef struct net_device_ops __no_const net_device_ops_no_const;
-
- /*
- * The DEVICE structure.
-diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h
-index 9f00da2..8304ebc 100644
---- a/include/linux/netfilter/nfnetlink.h
-+++ b/include/linux/netfilter/nfnetlink.h
-@@ -62,7 +62,7 @@ struct nfnl_callback
- const struct nlattr * const cda[]);
- const struct nla_policy *policy; /* netlink attribute policy */
- const u_int16_t attr_count; /* number of nlattr's */
--};
-+} __do_const;
-
- struct nfnetlink_subsystem
- {
-diff --git a/include/linux/netfilter/xt_gradm.h b/include/linux/netfilter/xt_gradm.h
-new file mode 100644
-index 0000000..33f4af8
---- /dev/null
-+++ b/include/linux/netfilter/xt_gradm.h
-@@ -0,0 +1,9 @@
-+#ifndef _LINUX_NETFILTER_XT_GRADM_H
-+#define _LINUX_NETFILTER_XT_GRADM_H 1
-+
-+struct xt_gradm_mtinfo {
-+ __u16 flags;
-+ __u16 invflags;
-+};
-+
-+#endif
-diff --git a/include/linux/nodemask.h b/include/linux/nodemask.h
-index b359c4a..c08b334 100644
---- a/include/linux/nodemask.h
-+++ b/include/linux/nodemask.h
-@@ -464,11 +464,11 @@ static inline int num_node_state(enum node_states state)
-
- #define any_online_node(mask) \
- ({ \
-- int node; \
-- for_each_node_mask(node, (mask)) \
-- if (node_online(node)) \
-+ int __node; \
-+ for_each_node_mask(__node, (mask)) \
-+ if (node_online(__node)) \
- break; \
-- node; \
-+ __node; \
- })
-
- #define num_online_nodes() num_node_state(N_ONLINE)
-diff --git a/include/linux/notifier.h b/include/linux/notifier.h
-index 5ecdb50..7b98d41 100644
---- a/include/linux/notifier.h
-+++ b/include/linux/notifier.h
-@@ -51,7 +51,8 @@ struct notifier_block {
- int (*notifier_call)(struct notifier_block *, unsigned long, void *);
- struct notifier_block *next;
- int priority;
--};
-+} __do_const;
-+typedef struct notifier_block __no_const notifier_block_no_const;
-
- struct atomic_notifier_head {
- spinlock_t lock;
-diff --git a/include/linux/oprofile.h b/include/linux/oprofile.h
-index 5171639..7cf4235 100644
---- a/include/linux/oprofile.h
-+++ b/include/linux/oprofile.h
-@@ -129,9 +129,9 @@ int oprofilefs_create_ulong(struct super_block * sb, struct dentry * root,
- int oprofilefs_create_ro_ulong(struct super_block * sb, struct dentry * root,
- char const * name, ulong * val);
-
--/** Create a file for read-only access to an atomic_t. */
-+/** Create a file for read-only access to an atomic_unchecked_t. */
- int oprofilefs_create_ro_atomic(struct super_block * sb, struct dentry * root,
-- char const * name, atomic_t * val);
-+ char const * name, atomic_unchecked_t * val);
-
- /** create a directory */
- struct dentry * oprofilefs_mkdir(struct super_block * sb, struct dentry * root,
-diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
-index 6b202b1..f451772 100644
---- a/include/linux/page-flags.h
-+++ b/include/linux/page-flags.h
-@@ -362,7 +362,7 @@ static inline int PageCompound(struct page *page)
- * pages on the LRU and/or pagecache.
- */
- TESTPAGEFLAG(Compound, compound)
--__PAGEFLAG(Head, compound)
-+__SETPAGEFLAG(Head, compound) __CLEARPAGEFLAG(Head, compound)
-
- /*
- * PG_reclaim is used in combination with PG_compound to mark the
-@@ -374,8 +374,14 @@ __PAGEFLAG(Head, compound)
- * PG_compound & PG_reclaim => Tail page
- * PG_compound & ~PG_reclaim => Head page
- */
-+#define PG_head_mask ((1L << PG_compound))
- #define PG_head_tail_mask ((1L << PG_compound) | (1L << PG_reclaim))
-
-+static inline int PageHead(struct page *page)
-+{
-+ return ((page->flags & PG_head_tail_mask) == PG_head_mask);
-+}
-+
- static inline int PageTail(struct page *page)
- {
- return ((page->flags & PG_head_tail_mask) == PG_head_tail_mask);
-diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h
-index 3c62ed4..8924c7c 100644
---- a/include/linux/pagemap.h
-+++ b/include/linux/pagemap.h
-@@ -425,7 +425,9 @@ static inline int fault_in_pages_readable(const char __user *uaddr, int size)
- if (((unsigned long)uaddr & PAGE_MASK) !=
- ((unsigned long)end & PAGE_MASK))
- ret = __get_user(c, end);
-+ (void)c;
- }
-+ (void)c;
- return ret;
- }
-
-diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
-index 81c9689..a567a55 100644
---- a/include/linux/perf_event.h
-+++ b/include/linux/perf_event.h
-@@ -476,7 +476,7 @@ struct hw_perf_event {
- struct hrtimer hrtimer;
- };
- };
-- atomic64_t prev_count;
-+ atomic64_unchecked_t prev_count;
- u64 sample_period;
- u64 last_period;
- atomic64_t period_left;
-@@ -557,7 +557,7 @@ struct perf_event {
- const struct pmu *pmu;
-
- enum perf_event_active_state state;
-- atomic64_t count;
-+ atomic64_unchecked_t count;
-
- /*
- * These are the total time in nanoseconds that the event
-@@ -595,8 +595,8 @@ struct perf_event {
- * These accumulate total time (in nanoseconds) that children
- * events have been enabled and running, respectively.
- */
-- atomic64_t child_total_time_enabled;
-- atomic64_t child_total_time_running;
-+ atomic64_unchecked_t child_total_time_enabled;
-+ atomic64_unchecked_t child_total_time_running;
-
- /*
- * Protect attach/detach and child_list:
-diff --git a/include/linux/personality.h b/include/linux/personality.h
-index 1261208..ddef96fb 100644
---- a/include/linux/personality.h
-+++ b/include/linux/personality.h
-@@ -43,6 +43,7 @@ enum {
- #define PER_CLEAR_ON_SETID (READ_IMPLIES_EXEC | \
- ADDR_NO_RANDOMIZE | \
- ADDR_COMPAT_LAYOUT | \
-+ ADDR_LIMIT_3GB | \
- MMAP_PAGE_ZERO)
-
- /*
-diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
-index b43a9e0..b77d869 100644
---- a/include/linux/pipe_fs_i.h
-+++ b/include/linux/pipe_fs_i.h
-@@ -46,9 +46,9 @@ struct pipe_inode_info {
- wait_queue_head_t wait;
- unsigned int nrbufs, curbuf;
- struct page *tmp_page;
-- unsigned int readers;
-- unsigned int writers;
-- unsigned int waiting_writers;
-+ atomic_t readers;
-+ atomic_t writers;
-+ atomic_t waiting_writers;
- unsigned int r_counter;
- unsigned int w_counter;
- struct fasync_struct *fasync_readers;
-diff --git a/include/linux/poison.h b/include/linux/poison.h
-index 34066ff..e95d744 100644
---- a/include/linux/poison.h
-+++ b/include/linux/poison.h
-@@ -19,8 +19,8 @@
- * under normal circumstances, used to verify that nobody uses
- * non-initialized list entries.
- */
--#define LIST_POISON1 ((void *) 0x00100100 + POISON_POINTER_DELTA)
--#define LIST_POISON2 ((void *) 0x00200200 + POISON_POINTER_DELTA)
-+#define LIST_POISON1 ((void *) (long)0xFFFFFF01)
-+#define LIST_POISON2 ((void *) (long)0xFFFFFF02)
-
- /********** include/linux/timer.h **********/
- /*
-diff --git a/include/linux/posix-timers.h b/include/linux/posix-timers.h
-index 4f71bf4..cd2f68e 100644
---- a/include/linux/posix-timers.h
-+++ b/include/linux/posix-timers.h
-@@ -82,7 +82,8 @@ struct k_clock {
- #define TIMER_RETRY 1
- void (*timer_get) (struct k_itimer * timr,
- struct itimerspec * cur_setting);
--};
-+} __do_const;
-+typedef struct k_clock __no_const k_clock_no_const;
-
- void register_posix_clock(const clockid_t clock_id, struct k_clock *new_clock);
-
-diff --git a/include/linux/prefetch.h b/include/linux/prefetch.h
-index af7c36a..a93005c 100644
---- a/include/linux/prefetch.h
-+++ b/include/linux/prefetch.h
-@@ -11,6 +11,7 @@
- #define _LINUX_PREFETCH_H
-
- #include <linux/types.h>
-+#include <linux/const.h>
- #include <asm/processor.h>
- #include <asm/cache.h>
-
-diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h
-index 379eaed..3471a57 100644
---- a/include/linux/proc_fs.h
-+++ b/include/linux/proc_fs.h
-@@ -155,6 +155,19 @@ static inline struct proc_dir_entry *proc_create(const char *name, mode_t mode,
- return proc_create_data(name, mode, parent, proc_fops, NULL);
- }
-
-+static inline struct proc_dir_entry *proc_create_grsec(const char *name, mode_t mode,
-+ struct proc_dir_entry *parent, const struct file_operations *proc_fops)
-+{
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+ return proc_create_data(name, S_IRUSR, parent, proc_fops, NULL);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ return proc_create_data(name, S_IRUSR | S_IRGRP, parent, proc_fops, NULL);
-+#else
-+ return proc_create_data(name, mode, parent, proc_fops, NULL);
-+#endif
-+}
-+
-+
- static inline struct proc_dir_entry *create_proc_read_entry(const char *name,
- mode_t mode, struct proc_dir_entry *base,
- read_proc_t *read_proc, void * data)
-diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h
-index 7456d7d..6c1cfc9 100644
---- a/include/linux/ptrace.h
-+++ b/include/linux/ptrace.h
-@@ -96,10 +96,10 @@ extern void __ptrace_unlink(struct task_struct *child);
- extern void exit_ptrace(struct task_struct *tracer);
- #define PTRACE_MODE_READ 1
- #define PTRACE_MODE_ATTACH 2
--/* Returns 0 on success, -errno on denial. */
--extern int __ptrace_may_access(struct task_struct *task, unsigned int mode);
- /* Returns true on success, false on denial. */
- extern bool ptrace_may_access(struct task_struct *task, unsigned int mode);
-+/* Returns true on success, false on denial. */
-+extern bool ptrace_may_access_log(struct task_struct *task, unsigned int mode);
-
- static inline int ptrace_reparented(struct task_struct *child)
- {
-diff --git a/include/linux/random.h b/include/linux/random.h
-index 1864957..491144d 100644
---- a/include/linux/random.h
-+++ b/include/linux/random.h
-@@ -76,6 +76,11 @@ static inline int arch_get_random_int(unsigned int *v)
- }
- #endif
-
-+static inline unsigned long pax_get_random_long(void)
-+{
-+ return random32() + (sizeof(long) > 4 ? (unsigned long)random32() << 32 : 0);
-+}
-+
- #endif /* __KERNEL___ */
-
- #endif /* _LINUX_RANDOM_H */
-diff --git a/include/linux/reboot.h b/include/linux/reboot.h
-index 988e55f..17cb4ef 100644
---- a/include/linux/reboot.h
-+++ b/include/linux/reboot.h
-@@ -47,9 +47,9 @@ extern int unregister_reboot_notifier(struct notifier_block *);
- * Architecture-specific implementations of sys_reboot commands.
- */
-
--extern void machine_restart(char *cmd);
--extern void machine_halt(void);
--extern void machine_power_off(void);
-+extern void machine_restart(char *cmd) __noreturn;
-+extern void machine_halt(void) __noreturn;
-+extern void machine_power_off(void) __noreturn;
-
- extern void machine_shutdown(void);
- struct pt_regs;
-@@ -60,9 +60,9 @@ extern void machine_crash_shutdown(struct pt_regs *);
- */
-
- extern void kernel_restart_prepare(char *cmd);
--extern void kernel_restart(char *cmd);
--extern void kernel_halt(void);
--extern void kernel_power_off(void);
-+extern void kernel_restart(char *cmd) __noreturn;
-+extern void kernel_halt(void) __noreturn;
-+extern void kernel_power_off(void) __noreturn;
-
- void ctrl_alt_del(void);
-
-@@ -75,7 +75,7 @@ extern int orderly_poweroff(bool force);
- * Emergency restart, callable from an interrupt handler.
- */
-
--extern void emergency_restart(void);
-+extern void emergency_restart(void) __noreturn;
- #include <asm/emergency-restart.h>
-
- #endif
-diff --git a/include/linux/regset.h b/include/linux/regset.h
-index 686f373..a72ed78 100644
---- a/include/linux/regset.h
-+++ b/include/linux/regset.h
-@@ -160,7 +160,7 @@ struct user_regset {
- unsigned int align;
- unsigned int bias;
- unsigned int core_note_type;
--};
-+} __do_const;
-
- /**
- * struct user_regset_view - available regsets
-diff --git a/include/linux/reiserfs_fs.h b/include/linux/reiserfs_fs.h
-index dd31e7b..5b03c5c 100644
---- a/include/linux/reiserfs_fs.h
-+++ b/include/linux/reiserfs_fs.h
-@@ -1326,7 +1326,7 @@ static inline loff_t max_reiserfs_offset(struct inode *inode)
- #define REISERFS_USER_MEM 1 /* reiserfs user memory mode */
-
- #define fs_generation(s) (REISERFS_SB(s)->s_generation_counter)
--#define get_generation(s) atomic_read (&fs_generation(s))
-+#define get_generation(s) atomic_read_unchecked (&fs_generation(s))
- #define FILESYSTEM_CHANGED_TB(tb) (get_generation((tb)->tb_sb) != (tb)->fs_gen)
- #define __fs_changed(gen,s) (gen != get_generation (s))
- #define fs_changed(gen,s) ({cond_resched(); __fs_changed(gen, s);})
-@@ -1534,24 +1534,24 @@ static inline struct super_block *sb_from_bi(struct buffer_info *bi)
- */
-
- struct item_operations {
-- int (*bytes_number) (struct item_head * ih, int block_size);
-- void (*decrement_key) (struct cpu_key *);
-- int (*is_left_mergeable) (struct reiserfs_key * ih,
-+ int (* const bytes_number) (struct item_head * ih, int block_size);
-+ void (* const decrement_key) (struct cpu_key *);
-+ int (* const is_left_mergeable) (struct reiserfs_key * ih,
- unsigned long bsize);
-- void (*print_item) (struct item_head *, char *item);
-- void (*check_item) (struct item_head *, char *item);
-+ void (* const print_item) (struct item_head *, char *item);
-+ void (* const check_item) (struct item_head *, char *item);
-
-- int (*create_vi) (struct virtual_node * vn, struct virtual_item * vi,
-+ int (* const create_vi) (struct virtual_node * vn, struct virtual_item * vi,
- int is_affected, int insert_size);
-- int (*check_left) (struct virtual_item * vi, int free,
-+ int (* const check_left) (struct virtual_item * vi, int free,
- int start_skip, int end_skip);
-- int (*check_right) (struct virtual_item * vi, int free);
-- int (*part_size) (struct virtual_item * vi, int from, int to);
-- int (*unit_num) (struct virtual_item * vi);
-- void (*print_vi) (struct virtual_item * vi);
-+ int (* const check_right) (struct virtual_item * vi, int free);
-+ int (* const part_size) (struct virtual_item * vi, int from, int to);
-+ int (* const unit_num) (struct virtual_item * vi);
-+ void (* const print_vi) (struct virtual_item * vi);
- };
-
--extern struct item_operations *item_ops[TYPE_ANY + 1];
-+extern const struct item_operations * const item_ops[TYPE_ANY + 1];
-
- #define op_bytes_number(ih,bsize) item_ops[le_ih_k_type (ih)]->bytes_number (ih, bsize)
- #define op_is_left_mergeable(key,bsize) item_ops[le_key_k_type (le_key_version (key), key)]->is_left_mergeable (key, bsize)
-diff --git a/include/linux/reiserfs_fs_sb.h b/include/linux/reiserfs_fs_sb.h
-index dab68bb..0688727 100644
---- a/include/linux/reiserfs_fs_sb.h
-+++ b/include/linux/reiserfs_fs_sb.h
-@@ -377,7 +377,7 @@ struct reiserfs_sb_info {
- /* Comment? -Hans */
- wait_queue_head_t s_wait;
- /* To be obsoleted soon by per buffer seals.. -Hans */
-- atomic_t s_generation_counter; // increased by one every time the
-+ atomic_unchecked_t s_generation_counter; // increased by one every time the
- // tree gets re-balanced
- unsigned long s_properties; /* File system properties. Currently holds
- on-disk FS format */
-diff --git a/include/linux/relay.h b/include/linux/relay.h
-index 14a86bc..17d0700 100644
---- a/include/linux/relay.h
-+++ b/include/linux/relay.h
-@@ -159,7 +159,7 @@ struct rchan_callbacks
- * The callback should return 0 if successful, negative if not.
- */
- int (*remove_buf_file)(struct dentry *dentry);
--};
-+} __no_const;
-
- /*
- * CONFIG_RELAY kernel API, kernel/relay.c
-diff --git a/include/linux/sched.h b/include/linux/sched.h
-index 71849bf..fb7ea50 100644
---- a/include/linux/sched.h
-+++ b/include/linux/sched.h
-@@ -101,6 +101,7 @@ struct bio;
- struct fs_struct;
- struct bts_context;
- struct perf_event_context;
-+struct linux_binprm;
-
- /*
- * List of flags we want to share for kernel threads,
-@@ -350,7 +351,7 @@ extern signed long schedule_timeout_killable(signed long timeout);
- extern signed long schedule_timeout_uninterruptible(signed long timeout);
- asmlinkage void __schedule(void);
- asmlinkage void schedule(void);
--extern int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner);
-+extern int mutex_spin_on_owner(struct mutex *lock, struct task_struct *owner);
-
- struct nsproxy;
- struct user_namespace;
-@@ -371,9 +372,21 @@ struct user_namespace;
- #define DEFAULT_MAX_MAP_COUNT (USHORT_MAX - MAPCOUNT_ELF_CORE_MARGIN)
-
- extern int sysctl_max_map_count;
-+extern unsigned long sysctl_heap_stack_gap;
-
- #include <linux/aio.h>
-
-+#ifdef CONFIG_GRKERNSEC_RAND_THREADSTACK
-+extern unsigned long gr_rand_threadstack_offset(const struct mm_struct *mm, const struct file *filp, unsigned long flags);
-+#else
-+static inline unsigned long gr_rand_threadstack_offset(const struct mm_struct *mm, const struct file *filp, unsigned long flags)
-+{
-+ return 0;
-+}
-+#endif
-+
-+extern bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len, unsigned long offset);
-+extern unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len, unsigned long offset);
- extern unsigned long
- arch_get_unmapped_area(struct file *, unsigned long, unsigned long,
- unsigned long, unsigned long);
-@@ -666,7 +679,20 @@ struct signal_struct {
- struct tty_audit_buf *tty_audit_buf;
- #endif
-
-+#ifdef CONFIG_GRKERNSEC
-+ u32 curr_ip;
-+ u32 saved_ip;
-+ u32 gr_saddr;
-+ u32 gr_daddr;
-+ u16 gr_sport;
-+ u16 gr_dport;
-+ u8 used_accept:1;
-+#endif
-+
- int oom_adj; /* OOM kill score adjustment (bit shift) */
-+ struct mutex cred_guard_mutex; /* guard against foreign influences on
-+ * credential calculations
-+ * (notably. ptrace) */
- };
-
- /* Context switch must be unlocked if interrupts are to be enabled */
-@@ -723,6 +749,11 @@ struct user_struct {
- struct key *session_keyring; /* UID's default session keyring */
- #endif
-
-+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
-+ unsigned int banned;
-+ unsigned long ban_expires;
-+#endif
-+
- /* Hash table maintenance information */
- struct hlist_node uidhash_node;
- uid_t uid;
-@@ -1328,8 +1359,8 @@ struct task_struct {
- struct list_head thread_group;
-
- struct completion *vfork_done; /* for vfork() */
-- int __user *set_child_tid; /* CLONE_CHILD_SETTID */
-- int __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
-+ pid_t __user *set_child_tid; /* CLONE_CHILD_SETTID */
-+ pid_t __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
-
- cputime_t utime, stime, utimescaled, stimescaled;
- cputime_t gtime;
-@@ -1343,16 +1374,6 @@ struct task_struct {
- struct task_cputime cputime_expires;
- struct list_head cpu_timers[3];
-
--/* process credentials */
-- const struct cred *real_cred; /* objective and real subjective task
-- * credentials (COW) */
-- const struct cred *cred; /* effective (overridable) subjective task
-- * credentials (COW) */
-- struct mutex cred_guard_mutex; /* guard against foreign influences on
-- * credential calculations
-- * (notably. ptrace) */
-- struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
--
- char comm[TASK_COMM_LEN]; /* executable name excluding path
- - access with [gs]et_task_comm (which lock
- it with task_lock())
-@@ -1369,6 +1390,10 @@ struct task_struct {
- #endif
- /* CPU-specific state of this task */
- struct thread_struct thread;
-+/* thread_info moved to task_struct */
-+#ifdef CONFIG_X86
-+ struct thread_info tinfo;
-+#endif
- /* filesystem information */
- struct fs_struct *fs;
- /* open file information */
-@@ -1436,6 +1461,12 @@ struct task_struct {
- int hardirq_context;
- int softirq_context;
- #endif
-+
-+/* process credentials */
-+ const struct cred *real_cred; /* objective and real subjective task
-+ * credentials (COW) */
-+ struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
-+
- #ifdef CONFIG_LOCKDEP
- # define MAX_LOCK_DEPTH 48UL
- u64 curr_chain_key;
-@@ -1456,6 +1487,9 @@ struct task_struct {
-
- struct backing_dev_info *backing_dev_info;
-
-+ const struct cred *cred; /* effective (overridable) subjective task
-+ * credentials (COW) */
-+
- struct io_context *io_context;
-
- unsigned long ptrace_message;
-@@ -1519,6 +1553,28 @@ struct task_struct {
- unsigned long default_timer_slack_ns;
-
- struct list_head *scm_work_list;
-+
-+#ifdef CONFIG_GRKERNSEC
-+ /* grsecurity */
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ u64 exec_id;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+ const struct cred *delayed_cred;
-+#endif
-+ struct dentry *gr_chroot_dentry;
-+ struct acl_subject_label *acl;
-+ struct acl_role_label *role;
-+ struct file *exec_file;
-+ unsigned long brute_expires;
-+ u16 acl_role_id;
-+ /* is this the task that authenticated to the special role */
-+ u8 acl_sp_role;
-+ u8 is_writable;
-+ u8 brute;
-+ u8 gr_is_chrooted;
-+#endif
-+
- #ifdef CONFIG_FUNCTION_GRAPH_TRACER
- /* Index of current stored adress in ret_stack */
- int curr_ret_stack;
-@@ -1542,6 +1598,57 @@ struct task_struct {
- #endif /* CONFIG_TRACING */
- };
-
-+#define MF_PAX_PAGEEXEC 0x01000000 /* Paging based non-executable pages */
-+#define MF_PAX_EMUTRAMP 0x02000000 /* Emulate trampolines */
-+#define MF_PAX_MPROTECT 0x04000000 /* Restrict mprotect() */
-+#define MF_PAX_RANDMMAP 0x08000000 /* Randomize mmap() base */
-+/*#define MF_PAX_RANDEXEC 0x10000000*/ /* Randomize ET_EXEC base */
-+#define MF_PAX_SEGMEXEC 0x20000000 /* Segmentation based non-executable pages */
-+
-+#ifdef CONFIG_PAX_SOFTMODE
-+extern int pax_softmode;
-+#endif
-+
-+extern int pax_check_flags(unsigned long *);
-+
-+/* if tsk != current then task_lock must be held on it */
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+static inline unsigned long pax_get_flags(struct task_struct *tsk)
-+{
-+ if (likely(tsk->mm))
-+ return tsk->mm->pax_flags;
-+ else
-+ return 0UL;
-+}
-+
-+/* if tsk != current then task_lock must be held on it */
-+static inline long pax_set_flags(struct task_struct *tsk, unsigned long flags)
-+{
-+ if (likely(tsk->mm)) {
-+ tsk->mm->pax_flags = flags;
-+ return 0;
-+ }
-+ return -EINVAL;
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
-+extern void pax_set_initial_flags(struct linux_binprm *bprm);
-+#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
-+extern void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
-+#endif
-+
-+extern void pax_report_fault(struct pt_regs *regs, void *pc, void *sp);
-+extern void pax_report_insns(struct pt_regs *regs, void *pc, void *sp);
-+extern void pax_report_refcount_overflow(struct pt_regs *regs);
-+extern void check_object_size(const void *ptr, unsigned long n, bool to);
-+
-+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
-+extern void pax_track_stack(void);
-+#else
-+static inline void pax_track_stack(void) {}
-+#endif
-+
- /* Future-safe accessor for struct task_struct's cpus_allowed. */
- #define tsk_cpumask(tsk) (&(tsk)->cpus_allowed)
-
-@@ -1740,7 +1847,7 @@ extern void thread_group_times(struct task_struct *p, cputime_t *ut, cputime_t *
- #define PF_DUMPCORE 0x00000200 /* dumped core */
- #define PF_SIGNALED 0x00000400 /* killed by a signal */
- #define PF_MEMALLOC 0x00000800 /* Allocating memory */
--#define PF_FLUSHER 0x00001000 /* responsible for disk writeback */
-+#define PF_NPROC_EXCEEDED 0x00001000 /* set_user noticed that RLIMIT_NPROC was exceeded */
- #define PF_USED_MATH 0x00002000 /* if unset the fpu must be initialized before use */
- #define PF_FREEZING 0x00004000 /* freeze in progress. do not account to load */
- #define PF_NOFREEZE 0x00008000 /* this thread should not be frozen */
-@@ -1978,7 +2085,9 @@ void yield(void);
- extern struct exec_domain default_exec_domain;
-
- union thread_union {
-+#ifndef CONFIG_X86
- struct thread_info thread_info;
-+#endif
- unsigned long stack[THREAD_SIZE/sizeof(long)];
- };
-
-@@ -2011,6 +2120,7 @@ extern struct pid_namespace init_pid_ns;
- */
-
- extern struct task_struct *find_task_by_vpid(pid_t nr);
-+extern struct task_struct *find_task_by_vpid_unrestricted(pid_t nr);
- extern struct task_struct *find_task_by_pid_ns(pid_t nr,
- struct pid_namespace *ns);
-
-@@ -2155,7 +2265,7 @@ extern void __cleanup_sighand(struct sighand_struct *);
- extern void exit_itimers(struct signal_struct *);
- extern void flush_itimer_signals(void);
-
--extern NORET_TYPE void do_group_exit(int);
-+extern __noreturn void do_group_exit(int);
-
- extern void daemonize(const char *, ...);
- extern int allow_signal(int);
-@@ -2284,9 +2394,9 @@ static inline unsigned long *end_of_stack(struct task_struct *p)
-
- #endif
-
--static inline int object_is_on_stack(void *obj)
-+static inline int object_starts_on_stack(void *obj)
- {
-- void *stack = task_stack_page(current);
-+ const void *stack = task_stack_page(current);
-
- return (obj >= stack) && (obj < (stack + THREAD_SIZE));
- }
-@@ -2616,6 +2726,23 @@ static inline unsigned long rlimit_max(unsigned int limit)
- return task_rlimit_max(current, limit);
- }
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+DECLARE_PER_CPU(u64, exec_counter);
-+static inline void increment_exec_counter(void)
-+{
-+ unsigned int cpu;
-+ u64 *exec_id_ptr;
-+ BUILD_BUG_ON(NR_CPUS > (1 << 16));
-+ cpu = get_cpu();
-+ exec_id_ptr = &per_cpu(exec_counter, cpu);
-+ *exec_id_ptr += 1ULL << 16;
-+ current->exec_id = *exec_id_ptr;
-+ put_cpu();
-+}
-+#else
-+static inline void increment_exec_counter(void) {}
-+#endif
-+
- #endif /* __KERNEL__ */
-
- #endif
-diff --git a/include/linux/screen_info.h b/include/linux/screen_info.h
-index 1ee2c05..81b7ec4 100644
---- a/include/linux/screen_info.h
-+++ b/include/linux/screen_info.h
-@@ -42,7 +42,8 @@ struct screen_info {
- __u16 pages; /* 0x32 */
- __u16 vesa_attributes; /* 0x34 */
- __u32 capabilities; /* 0x36 */
-- __u8 _reserved[6]; /* 0x3a */
-+ __u16 vesapm_size; /* 0x3a */
-+ __u8 _reserved[4]; /* 0x3c */
- } __attribute__((packed));
-
- #define VIDEO_TYPE_MDA 0x10 /* Monochrome Text Display */
-diff --git a/include/linux/security.h b/include/linux/security.h
-index d40d23f..d739b08 100644
---- a/include/linux/security.h
-+++ b/include/linux/security.h
-@@ -34,6 +34,7 @@
- #include <linux/key.h>
- #include <linux/xfrm.h>
- #include <linux/gfp.h>
-+#include <linux/grsecurity.h>
- #include <net/flow.h>
-
- /* Maximum number of letters for an LSM name string */
-@@ -76,7 +77,7 @@ extern int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
- extern int cap_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp);
- extern int cap_task_setioprio(struct task_struct *p, int ioprio);
- extern int cap_task_setnice(struct task_struct *p, int nice);
--extern int cap_syslog(int type);
-+extern int cap_syslog(int type, bool from_file);
- extern int cap_vm_enough_memory(struct mm_struct *mm, long pages);
-
- struct msghdr;
-@@ -1331,6 +1332,7 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
- * logging to the console.
- * See the syslog(2) manual page for an explanation of the @type values.
- * @type contains the type of action.
-+ * @from_file indicates the context of action (if it came from /proc).
- * Return 0 if permission is granted.
- * @settime:
- * Check permission to change the system time.
-@@ -1445,7 +1447,7 @@ struct security_operations {
- int (*sysctl) (struct ctl_table *table, int op);
- int (*quotactl) (int cmds, int type, int id, struct super_block *sb);
- int (*quota_on) (struct dentry *dentry);
-- int (*syslog) (int type);
-+ int (*syslog) (int type, bool from_file);
- int (*settime) (struct timespec *ts, struct timezone *tz);
- int (*vm_enough_memory) (struct mm_struct *mm, long pages);
-
-@@ -1740,7 +1742,7 @@ int security_acct(struct file *file);
- int security_sysctl(struct ctl_table *table, int op);
- int security_quotactl(int cmds, int type, int id, struct super_block *sb);
- int security_quota_on(struct dentry *dentry);
--int security_syslog(int type);
-+int security_syslog(int type, bool from_file);
- int security_settime(struct timespec *ts, struct timezone *tz);
- int security_vm_enough_memory(long pages);
- int security_vm_enough_memory_mm(struct mm_struct *mm, long pages);
-@@ -1986,9 +1988,9 @@ static inline int security_quota_on(struct dentry *dentry)
- return 0;
- }
-
--static inline int security_syslog(int type)
-+static inline int security_syslog(int type, bool from_file)
- {
-- return cap_syslog(type);
-+ return cap_syslog(type, from_file);
- }
-
- static inline int security_settime(struct timespec *ts, struct timezone *tz)
-diff --git a/include/linux/seq_file.h b/include/linux/seq_file.h
-index 8366d8f..cc5f9d6 100644
---- a/include/linux/seq_file.h
-+++ b/include/linux/seq_file.h
-@@ -23,6 +23,9 @@ struct seq_file {
- u64 version;
- struct mutex lock;
- const struct seq_operations *op;
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ u64 exec_id;
-+#endif
- void *private;
- };
-
-@@ -32,6 +35,7 @@ struct seq_operations {
- void * (*next) (struct seq_file *m, void *v, loff_t *pos);
- int (*show) (struct seq_file *m, void *v);
- };
-+typedef struct seq_operations __no_const seq_operations_no_const;
-
- #define SEQ_SKIP 1
-
-diff --git a/include/linux/shm.h b/include/linux/shm.h
-index eca6235..c7417ed 100644
---- a/include/linux/shm.h
-+++ b/include/linux/shm.h
-@@ -95,6 +95,10 @@ struct shmid_kernel /* private to the kernel */
- pid_t shm_cprid;
- pid_t shm_lprid;
- struct user_struct *mlock_user;
-+#ifdef CONFIG_GRKERNSEC
-+ time_t shm_createtime;
-+ pid_t shm_lapid;
-+#endif
- };
-
- /* shm_mode upper byte flags */
-diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
-index 4e647bb..23b3911 100644
---- a/include/linux/skbuff.h
-+++ b/include/linux/skbuff.h
-@@ -14,6 +14,7 @@
- #ifndef _LINUX_SKBUFF_H
- #define _LINUX_SKBUFF_H
-
-+#include <linux/const.h>
- #include <linux/kernel.h>
- #include <linux/kmemcheck.h>
- #include <linux/compiler.h>
-@@ -442,7 +443,7 @@ extern void consume_skb(struct sk_buff *skb);
- extern void __kfree_skb(struct sk_buff *skb);
- extern struct sk_buff *__alloc_skb(unsigned int size,
- gfp_t priority, int fclone, int node);
--static inline struct sk_buff *alloc_skb(unsigned int size,
-+static inline struct sk_buff * __intentional_overflow(0) alloc_skb(unsigned int size,
- gfp_t priority)
- {
- return __alloc_skb(size, priority, 0, -1);
-@@ -544,7 +545,7 @@ static inline union skb_shared_tx *skb_tx(struct sk_buff *skb)
- */
- static inline int skb_queue_empty(const struct sk_buff_head *list)
- {
-- return list->next == (struct sk_buff *)list;
-+ return list->next == (const struct sk_buff *)list;
- }
-
- /**
-@@ -557,7 +558,7 @@ static inline int skb_queue_empty(const struct sk_buff_head *list)
- static inline bool skb_queue_is_last(const struct sk_buff_head *list,
- const struct sk_buff *skb)
- {
-- return (skb->next == (struct sk_buff *) list);
-+ return (skb->next == (const struct sk_buff *) list);
- }
-
- /**
-@@ -570,7 +571,7 @@ static inline bool skb_queue_is_last(const struct sk_buff_head *list,
- static inline bool skb_queue_is_first(const struct sk_buff_head *list,
- const struct sk_buff *skb)
- {
-- return (skb->prev == (struct sk_buff *) list);
-+ return (skb->prev == (const struct sk_buff *) list);
- }
-
- /**
-@@ -1377,7 +1378,7 @@ static inline int skb_network_offset(const struct sk_buff *skb)
- * headroom, you should not reduce this.
- */
- #ifndef NET_SKB_PAD
--#define NET_SKB_PAD 32
-+#define NET_SKB_PAD (_AC(32,UL))
- #endif
-
- extern int ___pskb_trim(struct sk_buff *skb, unsigned int len);
-@@ -1499,6 +1500,22 @@ static inline struct sk_buff *netdev_alloc_skb(struct net_device *dev,
- return __netdev_alloc_skb(dev, length, GFP_ATOMIC);
- }
-
-+static inline struct sk_buff *__netdev_alloc_skb_ip_align(struct net_device *dev,
-+ unsigned int length, gfp_t gfp)
-+{
-+ struct sk_buff *skb = __netdev_alloc_skb(dev, length + NET_IP_ALIGN, gfp);
-+
-+ if (NET_IP_ALIGN && skb)
-+ skb_reserve(skb, NET_IP_ALIGN);
-+ return skb;
-+}
-+
-+static inline struct sk_buff *netdev_alloc_skb_ip_align(struct net_device *dev,
-+ unsigned int length)
-+{
-+ return __netdev_alloc_skb_ip_align(dev, length, GFP_ATOMIC);
-+}
-+
- extern struct page *__netdev_alloc_page(struct net_device *dev, gfp_t gfp_mask);
-
- /**
-@@ -1750,7 +1767,7 @@ extern struct sk_buff *skb_recv_datagram(struct sock *sk, unsigned flags,
- int noblock, int *err);
- extern unsigned int datagram_poll(struct file *file, struct socket *sock,
- struct poll_table_struct *wait);
--extern int skb_copy_datagram_iovec(const struct sk_buff *from,
-+extern int __intentional_overflow(0) skb_copy_datagram_iovec(const struct sk_buff *from,
- int offset, struct iovec *to,
- int size);
- extern int skb_copy_and_csum_datagram_iovec(struct sk_buff *skb,
-diff --git a/include/linux/slab.h b/include/linux/slab.h
-index 2da8372..45c2b89 100644
---- a/include/linux/slab.h
-+++ b/include/linux/slab.h
-@@ -11,12 +11,20 @@
-
- #include <linux/gfp.h>
- #include <linux/types.h>
-+#include <linux/err.h>
-
- /*
- * Flags to pass to kmem_cache_create().
- * The ones marked DEBUG are only valid if CONFIG_SLAB_DEBUG is set.
- */
- #define SLAB_DEBUG_FREE 0x00000100UL /* DEBUG: Perform (expensive) checks on free */
-+
-+#ifdef CONFIG_PAX_USERCOPY_SLABS
-+#define SLAB_USERCOPY 0x00000200UL /* PaX: Allow copying objs to/from userland */
-+#else
-+#define SLAB_USERCOPY 0x00000000UL
-+#endif
-+
- #define SLAB_RED_ZONE 0x00000400UL /* DEBUG: Red zone objs in a cache */
- #define SLAB_POISON 0x00000800UL /* DEBUG: Poison objects */
- #define SLAB_HWCACHE_ALIGN 0x00002000UL /* Align objs on cache lines */
-@@ -82,10 +90,13 @@
- * ZERO_SIZE_PTR can be passed to kfree though in the same way that NULL can.
- * Both make kfree a no-op.
- */
--#define ZERO_SIZE_PTR ((void *)16)
-+#define ZERO_SIZE_PTR \
-+({ \
-+ BUILD_BUG_ON(!(MAX_ERRNO & ~PAGE_MASK));\
-+ (void *)(-MAX_ERRNO-1L); \
-+})
-
--#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) <= \
-- (unsigned long)ZERO_SIZE_PTR)
-+#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) - 1 >= (unsigned long)ZERO_SIZE_PTR - 1)
-
- /*
- * struct kmem_cache related prototypes
-@@ -138,6 +149,8 @@ void * __must_check krealloc(const void *, size_t, gfp_t);
- void kfree(const void *);
- void kzfree(const void *);
- size_t ksize(const void *);
-+const char *check_heap_object(const void *ptr, unsigned long n);
-+bool is_usercopy_object(const void *ptr);
-
- /*
- * Allocator specific definitions. These are mainly used to establish optimized
-@@ -263,7 +276,7 @@ static inline void *kmem_cache_alloc_node(struct kmem_cache *cachep,
- * request comes from.
- */
- #if defined(CONFIG_DEBUG_SLAB) || defined(CONFIG_SLUB)
--extern void *__kmalloc_track_caller(size_t, gfp_t, unsigned long);
-+extern void *__kmalloc_track_caller(size_t, gfp_t, unsigned long) __size_overflow(1);
- #define kmalloc_track_caller(size, flags) \
- __kmalloc_track_caller(size, flags, _RET_IP_)
- #else
-@@ -281,7 +294,7 @@ extern void *__kmalloc_track_caller(size_t, gfp_t, unsigned long);
- * allocation request comes from.
- */
- #if defined(CONFIG_DEBUG_SLAB) || defined(CONFIG_SLUB)
--extern void *__kmalloc_node_track_caller(size_t, gfp_t, int, unsigned long);
-+extern void *__kmalloc_node_track_caller(size_t, gfp_t, int, unsigned long) __size_overflow(1);
- #define kmalloc_node_track_caller(size, flags, node) \
- __kmalloc_node_track_caller(size, flags, node, \
- _RET_IP_)
-diff --git a/include/linux/slab_def.h b/include/linux/slab_def.h
-index 850d057..aa58075 100644
---- a/include/linux/slab_def.h
-+++ b/include/linux/slab_def.h
-@@ -69,10 +69,10 @@ struct kmem_cache {
- unsigned long node_allocs;
- unsigned long node_frees;
- unsigned long node_overflow;
-- atomic_t allochit;
-- atomic_t allocmiss;
-- atomic_t freehit;
-- atomic_t freemiss;
-+ atomic_unchecked_t allochit;
-+ atomic_unchecked_t allocmiss;
-+ atomic_unchecked_t freehit;
-+ atomic_unchecked_t freemiss;
-
- /*
- * If debugging is enabled, then the allocator can add additional
-@@ -104,11 +104,16 @@ struct cache_sizes {
- #ifdef CONFIG_ZONE_DMA
- struct kmem_cache *cs_dmacachep;
- #endif
-+
-+#ifdef CONFIG_PAX_USERCOPY_SLABS
-+ struct kmem_cache *cs_usercopycachep;
-+#endif
-+
- };
- extern struct cache_sizes malloc_sizes[];
-
- void *kmem_cache_alloc(struct kmem_cache *, gfp_t);
--void *__kmalloc(size_t size, gfp_t flags);
-+void *__kmalloc(size_t size, gfp_t flags) __size_overflow(1);
-
- #ifdef CONFIG_KMEMTRACE
- extern void *kmem_cache_alloc_notrace(struct kmem_cache *cachep, gfp_t flags);
-@@ -150,6 +155,13 @@ found:
- cachep = malloc_sizes[i].cs_dmacachep;
- else
- #endif
-+
-+#ifdef CONFIG_PAX_USERCOPY_SLABS
-+ if (flags & GFP_USERCOPY)
-+ cachep = malloc_sizes[i].cs_usercopycachep;
-+ else
-+#endif
-+
- cachep = malloc_sizes[i].cs_cachep;
-
- ret = kmem_cache_alloc_notrace(cachep, flags);
-@@ -163,7 +175,7 @@ found:
- }
-
- #ifdef CONFIG_NUMA
--extern void *__kmalloc_node(size_t size, gfp_t flags, int node);
-+extern void *__kmalloc_node(size_t size, gfp_t flags, int node) __size_overflow(1);
- extern void *kmem_cache_alloc_node(struct kmem_cache *, gfp_t flags, int node);
-
- #ifdef CONFIG_KMEMTRACE
-@@ -205,6 +217,13 @@ found:
- cachep = malloc_sizes[i].cs_dmacachep;
- else
- #endif
-+
-+#ifdef CONFIG_PAX_USERCOPY_SLABS
-+ if (flags & GFP_USERCOPY)
-+ cachep = malloc_sizes[i].cs_usercopycachep;
-+ else
-+#endif
-+
- cachep = malloc_sizes[i].cs_cachep;
-
- ret = kmem_cache_alloc_node_notrace(cachep, flags, node);
-diff --git a/include/linux/slob_def.h b/include/linux/slob_def.h
-index 0ec00b3..22b4715 100644
---- a/include/linux/slob_def.h
-+++ b/include/linux/slob_def.h
-@@ -9,7 +9,7 @@ static __always_inline void *kmem_cache_alloc(struct kmem_cache *cachep,
- return kmem_cache_alloc_node(cachep, flags, -1);
- }
-
--void *__kmalloc_node(size_t size, gfp_t flags, int node);
-+void *__kmalloc_node(size_t size, gfp_t flags, int node) __size_overflow(1);
-
- static __always_inline void *kmalloc_node(size_t size, gfp_t flags, int node)
- {
-@@ -29,7 +29,7 @@ static __always_inline void *kmalloc(size_t size, gfp_t flags)
- return __kmalloc_node(size, flags, -1);
- }
-
--static __always_inline void *__kmalloc(size_t size, gfp_t flags)
-+static __always_inline __size_overflow(1) void *__kmalloc(size_t size, gfp_t flags)
- {
- return kmalloc(size, flags);
- }
-diff --git a/include/linux/slub_def.h b/include/linux/slub_def.h
-index 5ad70a6..108e1dc 100644
---- a/include/linux/slub_def.h
-+++ b/include/linux/slub_def.h
-@@ -86,7 +86,7 @@ struct kmem_cache {
- struct kmem_cache_order_objects max;
- struct kmem_cache_order_objects min;
- gfp_t allocflags; /* gfp flags to use on each alloc */
-- int refcount; /* Refcount for slab cache destroy */
-+ atomic_t refcount; /* Refcount for slab cache destroy */
- void (*ctor)(void *);
- int inuse; /* Offset to metadata */
- int align; /* Alignment */
-@@ -145,7 +145,7 @@ extern struct kmem_cache kmalloc_caches[SLUB_PAGE_SHIFT];
- * Sorry that the following has to be that ugly but some versions of GCC
- * have trouble with constant propagation and loops.
- */
--static __always_inline int kmalloc_index(size_t size)
-+static __always_inline __size_overflow(1) int kmalloc_index(size_t size)
- {
- if (!size)
- return 0;
-@@ -215,7 +215,7 @@ static __always_inline struct kmem_cache *kmalloc_slab(size_t size)
- #endif
-
- void *kmem_cache_alloc(struct kmem_cache *, gfp_t);
--void *__kmalloc(size_t size, gfp_t flags);
-+void *__kmalloc(size_t size, gfp_t flags) __alloc_size(1);
-
- #ifdef CONFIG_KMEMTRACE
- extern void *kmem_cache_alloc_notrace(struct kmem_cache *s, gfp_t gfpflags);
-@@ -227,7 +227,7 @@ kmem_cache_alloc_notrace(struct kmem_cache *s, gfp_t gfpflags)
- }
- #endif
-
--static __always_inline void *kmalloc_large(size_t size, gfp_t flags)
-+static __always_inline __size_overflow(1) void *kmalloc_large(size_t size, gfp_t flags)
- {
- unsigned int order = get_order(size);
- void *ret = (void *) __get_free_pages(flags | __GFP_COMP, order);
-@@ -263,7 +263,7 @@ static __always_inline void *kmalloc(size_t size, gfp_t flags)
- }
-
- #ifdef CONFIG_NUMA
--void *__kmalloc_node(size_t size, gfp_t flags, int node);
-+void *__kmalloc_node(size_t size, gfp_t flags, int node) __size_overflow(1);
- void *kmem_cache_alloc_node(struct kmem_cache *, gfp_t flags, int node);
-
- #ifdef CONFIG_KMEMTRACE
-diff --git a/include/linux/snmp.h b/include/linux/snmp.h
-index 0f953fe4..05d45da 100644
---- a/include/linux/snmp.h
-+++ b/include/linux/snmp.h
-@@ -208,7 +208,6 @@ enum
- LINUX_MIB_TCPDSACKOFOSENT, /* TCPDSACKOfoSent */
- LINUX_MIB_TCPDSACKRECV, /* TCPDSACKRecv */
- LINUX_MIB_TCPDSACKOFORECV, /* TCPDSACKOfoRecv */
-- LINUX_MIB_TCPABORTONSYN, /* TCPAbortOnSyn */
- LINUX_MIB_TCPABORTONDATA, /* TCPAbortOnData */
- LINUX_MIB_TCPABORTONCLOSE, /* TCPAbortOnClose */
- LINUX_MIB_TCPABORTONMEMORY, /* TCPAbortOnMemory */
-@@ -225,6 +224,8 @@ enum
- LINUX_MIB_SACKSHIFTED,
- LINUX_MIB_SACKMERGED,
- LINUX_MIB_SACKSHIFTFALLBACK,
-+ LINUX_MIB_TCPCHALLENGEACK, /* TCPChallengeACK */
-+ LINUX_MIB_TCPSYNCHALLENGE, /* TCPSYNChallenge */
- __LINUX_MIB_MAX
- };
-
-diff --git a/include/linux/sonet.h b/include/linux/sonet.h
-index 67ad11f..0bbd8af 100644
---- a/include/linux/sonet.h
-+++ b/include/linux/sonet.h
-@@ -61,7 +61,7 @@ struct sonet_stats {
- #include <asm/atomic.h>
-
- struct k_sonet_stats {
--#define __HANDLE_ITEM(i) atomic_t i
-+#define __HANDLE_ITEM(i) atomic_unchecked_t i
- __SONET_ITEMS
- #undef __HANDLE_ITEM
- };
-diff --git a/include/linux/stddef.h b/include/linux/stddef.h
-index 6a40c76..1747b67 100644
---- a/include/linux/stddef.h
-+++ b/include/linux/stddef.h
-@@ -3,14 +3,10 @@
-
- #include <linux/compiler.h>
-
-+#ifdef __KERNEL__
-+
- #undef NULL
--#if defined(__cplusplus)
--#define NULL 0
--#else
- #define NULL ((void *)0)
--#endif
--
--#ifdef __KERNEL__
-
- enum {
- false = 0,
-diff --git a/include/linux/sunrpc/cache.h b/include/linux/sunrpc/cache.h
-index 6f52b4d..5500323 100644
---- a/include/linux/sunrpc/cache.h
-+++ b/include/linux/sunrpc/cache.h
-@@ -125,7 +125,7 @@ struct cache_detail {
- */
- struct cache_req {
- struct cache_deferred_req *(*defer)(struct cache_req *req);
--};
-+} __no_const;
- /* this must be embedded in a deferred_request that is being
- * delayed awaiting cache-fill
- */
-diff --git a/include/linux/sunrpc/clnt.h b/include/linux/sunrpc/clnt.h
-index 8ed9642..101ceab 100644
---- a/include/linux/sunrpc/clnt.h
-+++ b/include/linux/sunrpc/clnt.h
-@@ -167,9 +167,9 @@ static inline unsigned short rpc_get_port(const struct sockaddr *sap)
- {
- switch (sap->sa_family) {
- case AF_INET:
-- return ntohs(((struct sockaddr_in *)sap)->sin_port);
-+ return ntohs(((const struct sockaddr_in *)sap)->sin_port);
- case AF_INET6:
-- return ntohs(((struct sockaddr_in6 *)sap)->sin6_port);
-+ return ntohs(((const struct sockaddr_in6 *)sap)->sin6_port);
- }
- return 0;
- }
-@@ -202,7 +202,7 @@ static inline bool __rpc_cmp_addr4(const struct sockaddr *sap1,
- static inline bool __rpc_copy_addr4(struct sockaddr *dst,
- const struct sockaddr *src)
- {
-- const struct sockaddr_in *ssin = (struct sockaddr_in *) src;
-+ const struct sockaddr_in *ssin = (const struct sockaddr_in *) src;
- struct sockaddr_in *dsin = (struct sockaddr_in *) dst;
-
- dsin->sin_family = ssin->sin_family;
-@@ -299,7 +299,7 @@ static inline u32 rpc_get_scope_id(const struct sockaddr *sa)
- if (sa->sa_family != AF_INET6)
- return 0;
-
-- return ((struct sockaddr_in6 *) sa)->sin6_scope_id;
-+ return ((const struct sockaddr_in6 *) sa)->sin6_scope_id;
- }
-
- #endif /* __KERNEL__ */
-diff --git a/include/linux/sunrpc/svc_rdma.h b/include/linux/sunrpc/svc_rdma.h
-index c14fe86..393245e 100644
---- a/include/linux/sunrpc/svc_rdma.h
-+++ b/include/linux/sunrpc/svc_rdma.h
-@@ -53,15 +53,15 @@ extern unsigned int svcrdma_ord;
- extern unsigned int svcrdma_max_requests;
- extern unsigned int svcrdma_max_req_size;
-
--extern atomic_t rdma_stat_recv;
--extern atomic_t rdma_stat_read;
--extern atomic_t rdma_stat_write;
--extern atomic_t rdma_stat_sq_starve;
--extern atomic_t rdma_stat_rq_starve;
--extern atomic_t rdma_stat_rq_poll;
--extern atomic_t rdma_stat_rq_prod;
--extern atomic_t rdma_stat_sq_poll;
--extern atomic_t rdma_stat_sq_prod;
-+extern atomic_unchecked_t rdma_stat_recv;
-+extern atomic_unchecked_t rdma_stat_read;
-+extern atomic_unchecked_t rdma_stat_write;
-+extern atomic_unchecked_t rdma_stat_sq_starve;
-+extern atomic_unchecked_t rdma_stat_rq_starve;
-+extern atomic_unchecked_t rdma_stat_rq_poll;
-+extern atomic_unchecked_t rdma_stat_rq_prod;
-+extern atomic_unchecked_t rdma_stat_sq_poll;
-+extern atomic_unchecked_t rdma_stat_sq_prod;
-
- #define RPCRDMA_VERSION 1
-
-diff --git a/include/linux/suspend.h b/include/linux/suspend.h
-index 5e781d8..1e62818 100644
---- a/include/linux/suspend.h
-+++ b/include/linux/suspend.h
-@@ -104,15 +104,15 @@ typedef int __bitwise suspend_state_t;
- * which require special recovery actions in that situation.
- */
- struct platform_suspend_ops {
-- int (*valid)(suspend_state_t state);
-- int (*begin)(suspend_state_t state);
-- int (*prepare)(void);
-- int (*prepare_late)(void);
-- int (*enter)(suspend_state_t state);
-- void (*wake)(void);
-- void (*finish)(void);
-- void (*end)(void);
-- void (*recover)(void);
-+ int (* const valid)(suspend_state_t state);
-+ int (* const begin)(suspend_state_t state);
-+ int (* const prepare)(void);
-+ int (* const prepare_late)(void);
-+ int (* const enter)(suspend_state_t state);
-+ void (* const wake)(void);
-+ void (* const finish)(void);
-+ void (* const end)(void);
-+ void (* const recover)(void);
- };
-
- #ifdef CONFIG_SUSPEND
-@@ -120,7 +120,7 @@ struct platform_suspend_ops {
- * suspend_set_ops - set platform dependent suspend operations
- * @ops: The new suspend operations to set.
- */
--extern void suspend_set_ops(struct platform_suspend_ops *ops);
-+extern void suspend_set_ops(const struct platform_suspend_ops *ops);
- extern int suspend_valid_only_mem(suspend_state_t state);
-
- /**
-@@ -145,7 +145,7 @@ extern int pm_suspend(suspend_state_t state);
- #else /* !CONFIG_SUSPEND */
- #define suspend_valid_only_mem NULL
-
--static inline void suspend_set_ops(struct platform_suspend_ops *ops) {}
-+static inline void suspend_set_ops(const struct platform_suspend_ops *ops) {}
- static inline int pm_suspend(suspend_state_t state) { return -ENOSYS; }
- #endif /* !CONFIG_SUSPEND */
-
-@@ -215,16 +215,16 @@ extern void mark_free_pages(struct zone *zone);
- * platforms which require special recovery actions in that situation.
- */
- struct platform_hibernation_ops {
-- int (*begin)(void);
-- void (*end)(void);
-- int (*pre_snapshot)(void);
-- void (*finish)(void);
-- int (*prepare)(void);
-- int (*enter)(void);
-- void (*leave)(void);
-- int (*pre_restore)(void);
-- void (*restore_cleanup)(void);
-- void (*recover)(void);
-+ int (* const begin)(void);
-+ void (* const end)(void);
-+ int (* const pre_snapshot)(void);
-+ void (* const finish)(void);
-+ int (* const prepare)(void);
-+ int (* const enter)(void);
-+ void (* const leave)(void);
-+ int (* const pre_restore)(void);
-+ void (* const restore_cleanup)(void);
-+ void (* const recover)(void);
- };
-
- #ifdef CONFIG_HIBERNATION
-@@ -243,7 +243,7 @@ extern void swsusp_set_page_free(struct page *);
- extern void swsusp_unset_page_free(struct page *);
- extern unsigned long get_safe_page(gfp_t gfp_mask);
-
--extern void hibernation_set_ops(struct platform_hibernation_ops *ops);
-+extern void hibernation_set_ops(const struct platform_hibernation_ops *ops);
- extern int hibernate(void);
- extern bool system_entering_hibernation(void);
- #else /* CONFIG_HIBERNATION */
-@@ -251,7 +251,7 @@ static inline int swsusp_page_is_forbidden(struct page *p) { return 0; }
- static inline void swsusp_set_page_free(struct page *p) {}
- static inline void swsusp_unset_page_free(struct page *p) {}
-
--static inline void hibernation_set_ops(struct platform_hibernation_ops *ops) {}
-+static inline void hibernation_set_ops(const struct platform_hibernation_ops *ops) {}
- static inline int hibernate(void) { return -ENOSYS; }
- static inline bool system_entering_hibernation(void) { return false; }
- #endif /* CONFIG_HIBERNATION */
-diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
-index 0eb6942..a805cb6 100644
---- a/include/linux/sysctl.h
-+++ b/include/linux/sysctl.h
-@@ -164,7 +164,11 @@ enum
- KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
- };
-
--
-+#ifdef CONFIG_PAX_SOFTMODE
-+enum {
-+ PAX_SOFTMODE=1 /* PaX: disable/enable soft mode */
-+};
-+#endif
-
- /* CTL_VM names: */
- enum
-@@ -982,6 +986,8 @@ typedef int proc_handler (struct ctl_table *ctl, int write,
-
- extern int proc_dostring(struct ctl_table *, int,
- void __user *, size_t *, loff_t *);
-+extern int proc_dostring_modpriv(struct ctl_table *, int,
-+ void __user *, size_t *, loff_t *);
- extern int proc_dointvec(struct ctl_table *, int,
- void __user *, size_t *, loff_t *);
- extern int proc_dointvec_minmax(struct ctl_table *, int,
-@@ -1003,6 +1009,7 @@ extern int do_sysctl (int __user *name, int nlen,
-
- extern ctl_handler sysctl_data;
- extern ctl_handler sysctl_string;
-+extern ctl_handler sysctl_string_modpriv;
- extern ctl_handler sysctl_intvec;
- extern ctl_handler sysctl_jiffies;
- extern ctl_handler sysctl_ms_jiffies;
-diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h
-index 9d68fed..71f02cc 100644
---- a/include/linux/sysfs.h
-+++ b/include/linux/sysfs.h
-@@ -75,8 +75,8 @@ struct bin_attribute {
- };
-
- struct sysfs_ops {
-- ssize_t (*show)(struct kobject *, struct attribute *,char *);
-- ssize_t (*store)(struct kobject *,struct attribute *,const char *, size_t);
-+ ssize_t (* const show)(struct kobject *, struct attribute *,char *);
-+ ssize_t (* const store)(struct kobject *,struct attribute *,const char *, size_t);
- };
-
- struct sysfs_dirent;
-diff --git a/include/linux/syslog.h b/include/linux/syslog.h
-new file mode 100644
-index 0000000..3891139
---- /dev/null
-+++ b/include/linux/syslog.h
-@@ -0,0 +1,52 @@
-+/* Syslog internals
-+ *
-+ * Copyright 2010 Canonical, Ltd.
-+ * Author: Kees Cook <kees.cook@canonical.com>
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License as published by
-+ * the Free Software Foundation; either version 2, or (at your option)
-+ * any later version.
-+ *
-+ * This program is distributed in the hope that it will be useful,
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-+ * GNU General Public License for more details.
-+ *
-+ * You should have received a copy of the GNU General Public License
-+ * along with this program; see the file COPYING. If not, write to
-+ * the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
-+ */
-+
-+#ifndef _LINUX_SYSLOG_H
-+#define _LINUX_SYSLOG_H
-+
-+/* Close the log. Currently a NOP. */
-+#define SYSLOG_ACTION_CLOSE 0
-+/* Open the log. Currently a NOP. */
-+#define SYSLOG_ACTION_OPEN 1
-+/* Read from the log. */
-+#define SYSLOG_ACTION_READ 2
-+/* Read all messages remaining in the ring buffer. */
-+#define SYSLOG_ACTION_READ_ALL 3
-+/* Read and clear all messages remaining in the ring buffer */
-+#define SYSLOG_ACTION_READ_CLEAR 4
-+/* Clear ring buffer. */
-+#define SYSLOG_ACTION_CLEAR 5
-+/* Disable printk's to console */
-+#define SYSLOG_ACTION_CONSOLE_OFF 6
-+/* Enable printk's to console */
-+#define SYSLOG_ACTION_CONSOLE_ON 7
-+/* Set level of messages printed to console */
-+#define SYSLOG_ACTION_CONSOLE_LEVEL 8
-+/* Return number of unread characters in the log buffer */
-+#define SYSLOG_ACTION_SIZE_UNREAD 9
-+/* Return size of the log buffer */
-+#define SYSLOG_ACTION_SIZE_BUFFER 10
-+
-+#define SYSLOG_FROM_CALL 0
-+#define SYSLOG_FROM_FILE 1
-+
-+int do_syslog(int type, char __user *buf, int count, bool from_file);
-+
-+#endif /* _LINUX_SYSLOG_H */
-diff --git a/include/linux/sysrq.h b/include/linux/sysrq.h
-index 99adcdc..09207eb 100644
---- a/include/linux/sysrq.h
-+++ b/include/linux/sysrq.h
-@@ -35,7 +35,7 @@ struct sysrq_key_op {
- char *help_msg;
- char *action_msg;
- int enable_mask;
--};
-+} __do_const;
-
- #ifdef CONFIG_MAGIC_SYSRQ
-
-diff --git a/include/linux/thread_info.h b/include/linux/thread_info.h
-index a8cc4e1..98d3b85 100644
---- a/include/linux/thread_info.h
-+++ b/include/linux/thread_info.h
-@@ -23,7 +23,7 @@ struct restart_block {
- };
- /* For futex_wait and futex_wait_requeue_pi */
- struct {
-- u32 *uaddr;
-+ u32 __user *uaddr;
- u32 val;
- u32 flags;
- u32 bitset;
-diff --git a/include/linux/tracehook.h b/include/linux/tracehook.h
-index 1eb44a9..77ac9f4 100644
---- a/include/linux/tracehook.h
-+++ b/include/linux/tracehook.h
-@@ -69,12 +69,12 @@ static inline int tracehook_expect_breakpoints(struct task_struct *task)
- /*
- * ptrace report for syscall entry and exit looks identical.
- */
--static inline void ptrace_report_syscall(struct pt_regs *regs)
-+static inline int ptrace_report_syscall(struct pt_regs *regs)
- {
- int ptrace = task_ptrace(current);
-
- if (!(ptrace & PT_PTRACED))
-- return;
-+ return 0;
-
- ptrace_notify(SIGTRAP | ((ptrace & PT_TRACESYSGOOD) ? 0x80 : 0));
-
-@@ -87,6 +87,8 @@ static inline void ptrace_report_syscall(struct pt_regs *regs)
- send_sig(current->exit_code, current, 1);
- current->exit_code = 0;
- }
-+
-+ return fatal_signal_pending(current);
- }
-
- /**
-@@ -111,8 +113,7 @@ static inline void ptrace_report_syscall(struct pt_regs *regs)
- static inline __must_check int tracehook_report_syscall_entry(
- struct pt_regs *regs)
- {
-- ptrace_report_syscall(regs);
-- return 0;
-+ return ptrace_report_syscall(regs);
- }
-
- /**
-@@ -143,7 +144,7 @@ static inline void tracehook_report_syscall_exit(struct pt_regs *regs, int step)
- *
- * Return %LSM_UNSAFE_* bits applied to an exec because of tracing.
- *
-- * @task->cred_guard_mutex is held by the caller through the do_execve().
-+ * @task->signal->cred_guard_mutex is held by the caller through the do_execve().
- */
- static inline int tracehook_unsafe_exec(struct task_struct *task)
- {
-diff --git a/include/linux/tty.h b/include/linux/tty.h
-index e9c57e9..ee6d489 100644
---- a/include/linux/tty.h
-+++ b/include/linux/tty.h
-@@ -493,7 +493,6 @@ extern void tty_ldisc_begin(void);
- /* This last one is just for the tty layer internals and shouldn't be used elsewhere */
- extern void tty_ldisc_enable(struct tty_struct *tty);
-
--
- /* n_tty.c */
- extern struct tty_ldisc_ops tty_ldisc_N_TTY;
-
-diff --git a/include/linux/tty_driver.h b/include/linux/tty_driver.h
-index db2d227..ea28ae8 100644
---- a/include/linux/tty_driver.h
-+++ b/include/linux/tty_driver.h
-@@ -283,7 +283,7 @@ struct tty_operations {
- void (*poll_put_char)(struct tty_driver *driver, int line, char ch);
- #endif
- const struct file_operations *proc_fops;
--};
-+} __do_const;
-
- struct tty_driver {
- int magic; /* magic number for this structure */
-diff --git a/include/linux/tty_ldisc.h b/include/linux/tty_ldisc.h
-index 0c4ee9b..9f7c426 100644
---- a/include/linux/tty_ldisc.h
-+++ b/include/linux/tty_ldisc.h
-@@ -139,7 +139,7 @@ struct tty_ldisc_ops {
-
- struct module *owner;
-
-- int refcount;
-+ atomic_t refcount;
- };
-
- struct tty_ldisc {
-diff --git a/include/linux/types.h b/include/linux/types.h
-index c42724f..d190eee 100644
---- a/include/linux/types.h
-+++ b/include/linux/types.h
-@@ -191,10 +191,26 @@ typedef struct {
- volatile int counter;
- } atomic_t;
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+typedef struct {
-+ volatile int counter;
-+} atomic_unchecked_t;
-+#else
-+typedef atomic_t atomic_unchecked_t;
-+#endif
-+
- #ifdef CONFIG_64BIT
- typedef struct {
- volatile long counter;
- } atomic64_t;
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+typedef struct {
-+ volatile long counter;
-+} atomic64_unchecked_t;
-+#else
-+typedef atomic64_t atomic64_unchecked_t;
-+#endif
- #endif
-
- struct ustat {
-diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h
-index 6b58367..57b150e 100644
---- a/include/linux/uaccess.h
-+++ b/include/linux/uaccess.h
-@@ -76,11 +76,11 @@ static inline unsigned long __copy_from_user_nocache(void *to,
- long ret; \
- mm_segment_t old_fs = get_fs(); \
- \
-- set_fs(KERNEL_DS); \
- pagefault_disable(); \
-- ret = __copy_from_user_inatomic(&(retval), (__force typeof(retval) __user *)(addr), sizeof(retval)); \
-- pagefault_enable(); \
-+ set_fs(KERNEL_DS); \
-+ ret = __copy_from_user_inatomic(&(retval), (typeof(retval) __force_user *)(addr), sizeof(retval)); \
- set_fs(old_fs); \
-+ pagefault_enable(); \
- ret; \
- })
-
-@@ -93,7 +93,7 @@ static inline unsigned long __copy_from_user_nocache(void *to,
- * Safely read from address @src to the buffer at @dst. If a kernel fault
- * happens, handle that and return -EFAULT.
- */
--extern long probe_kernel_read(void *dst, void *src, size_t size);
-+extern long probe_kernel_read(void *dst, const void *src, size_t size);
-
- /*
- * probe_kernel_write(): safely attempt to write to a location
-@@ -104,6 +104,6 @@ extern long probe_kernel_read(void *dst, void *src, size_t size);
- * Safely write to address @dst from the buffer at @src. If a kernel fault
- * happens, handle that and return -EFAULT.
- */
--extern long probe_kernel_write(void *dst, void *src, size_t size);
-+extern long probe_kernel_write(void *dst, const void *src, size_t size) __size_overflow(3);
-
- #endif /* __LINUX_UACCESS_H__ */
-diff --git a/include/linux/unaligned/access_ok.h b/include/linux/unaligned/access_ok.h
-index 99c1b4d..bb94261 100644
---- a/include/linux/unaligned/access_ok.h
-+++ b/include/linux/unaligned/access_ok.h
-@@ -6,32 +6,32 @@
-
- static inline u16 get_unaligned_le16(const void *p)
- {
-- return le16_to_cpup((__le16 *)p);
-+ return le16_to_cpup((const __le16 *)p);
- }
-
- static inline u32 get_unaligned_le32(const void *p)
- {
-- return le32_to_cpup((__le32 *)p);
-+ return le32_to_cpup((const __le32 *)p);
- }
-
- static inline u64 get_unaligned_le64(const void *p)
- {
-- return le64_to_cpup((__le64 *)p);
-+ return le64_to_cpup((const __le64 *)p);
- }
-
- static inline u16 get_unaligned_be16(const void *p)
- {
-- return be16_to_cpup((__be16 *)p);
-+ return be16_to_cpup((const __be16 *)p);
- }
-
- static inline u32 get_unaligned_be32(const void *p)
- {
-- return be32_to_cpup((__be32 *)p);
-+ return be32_to_cpup((const __be32 *)p);
- }
-
- static inline u64 get_unaligned_be64(const void *p)
- {
-- return be64_to_cpup((__be64 *)p);
-+ return be64_to_cpup((const __be64 *)p);
- }
-
- static inline void put_unaligned_le16(u16 val, void *p)
-diff --git a/include/linux/usb.h b/include/linux/usb.h
-index a34fa89..ef176bc 100644
---- a/include/linux/usb.h
-+++ b/include/linux/usb.h
-@@ -500,7 +500,7 @@ struct usb_device {
-
- int pm_usage_cnt;
- u32 quirks;
-- atomic_t urbnum;
-+ atomic_unchecked_t urbnum;
-
- unsigned long active_duration;
-
-diff --git a/include/linux/vermagic.h b/include/linux/vermagic.h
-index 79b9837..b5a56f9 100644
---- a/include/linux/vermagic.h
-+++ b/include/linux/vermagic.h
-@@ -26,9 +26,35 @@
- #define MODULE_ARCH_VERMAGIC ""
- #endif
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+#define MODULE_PAX_REFCOUNT "REFCOUNT "
-+#else
-+#define MODULE_PAX_REFCOUNT ""
-+#endif
-+
-+#ifdef CONSTIFY_PLUGIN
-+#define MODULE_CONSTIFY_PLUGIN "CONSTIFY_PLUGIN "
-+#else
-+#define MODULE_CONSTIFY_PLUGIN ""
-+#endif
-+
-+#ifdef STACKLEAK_PLUGIN
-+#define MODULE_STACKLEAK_PLUGIN "STACKLEAK_PLUGIN "
-+#else
-+#define MODULE_STACKLEAK_PLUGIN ""
-+#endif
-+
-+#ifdef CONFIG_GRKERNSEC
-+#define MODULE_GRSEC "GRSEC "
-+#else
-+#define MODULE_GRSEC ""
-+#endif
-+
- #define VERMAGIC_STRING \
- UTS_RELEASE " " \
- MODULE_VERMAGIC_SMP MODULE_VERMAGIC_PREEMPT \
- MODULE_VERMAGIC_MODULE_UNLOAD MODULE_VERMAGIC_MODVERSIONS \
-- MODULE_ARCH_VERMAGIC
-+ MODULE_ARCH_VERMAGIC \
-+ MODULE_PAX_REFCOUNT MODULE_CONSTIFY_PLUGIN MODULE_STACKLEAK_PLUGIN \
-+ MODULE_GRSEC
-
-diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h
-index 819a634..dcc51e98 100644
---- a/include/linux/vmalloc.h
-+++ b/include/linux/vmalloc.h
-@@ -14,6 +14,11 @@ struct vm_area_struct; /* vma defining user mapping in mm_types.h */
- #define VM_USERMAP 0x00000008 /* suitable for remap_vmalloc_range */
- #define VM_VPAGES 0x00000010 /* buffer for pages was vmalloc'ed */
- #define VM_UNLIST 0x00000020 /* vm_struct is not listed in vmlist */
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
-+#define VM_KERNEXEC 0x00000040 /* allocate from executable kernel memory range */
-+#endif
-+
- /* bits [20..32] reserved for arch specific ioremap internals */
-
- /*
-@@ -106,8 +111,8 @@ extern struct vm_struct *alloc_vm_area(size_t size);
- extern void free_vm_area(struct vm_struct *area);
-
- /* for /dev/kmem */
--extern long vread(char *buf, char *addr, unsigned long count);
--extern long vwrite(char *buf, char *addr, unsigned long count);
-+extern long vread(char *buf, char *addr, unsigned long count) __size_overflow(3);
-+extern long vwrite(char *buf, char *addr, unsigned long count) __size_overflow(3);
-
- /*
- * Internals. Dont't use..
-diff --git a/include/linux/vmstat.h b/include/linux/vmstat.h
-index 13070d6..aa4159a 100644
---- a/include/linux/vmstat.h
-+++ b/include/linux/vmstat.h
-@@ -136,18 +136,18 @@ static inline void vm_events_fold_cpu(int cpu)
- /*
- * Zone based page accounting with per cpu differentials.
- */
--extern atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
-+extern atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
-
- static inline void zone_page_state_add(long x, struct zone *zone,
- enum zone_stat_item item)
- {
-- atomic_long_add(x, &zone->vm_stat[item]);
-- atomic_long_add(x, &vm_stat[item]);
-+ atomic_long_add_unchecked(x, &zone->vm_stat[item]);
-+ atomic_long_add_unchecked(x, &vm_stat[item]);
- }
-
- static inline unsigned long global_page_state(enum zone_stat_item item)
- {
-- long x = atomic_long_read(&vm_stat[item]);
-+ long x = atomic_long_read_unchecked(&vm_stat[item]);
- #ifdef CONFIG_SMP
- if (x < 0)
- x = 0;
-@@ -158,7 +158,7 @@ static inline unsigned long global_page_state(enum zone_stat_item item)
- static inline unsigned long zone_page_state(struct zone *zone,
- enum zone_stat_item item)
- {
-- long x = atomic_long_read(&zone->vm_stat[item]);
-+ long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
- #ifdef CONFIG_SMP
- if (x < 0)
- x = 0;
-@@ -175,7 +175,7 @@ static inline unsigned long zone_page_state(struct zone *zone,
- static inline unsigned long zone_page_state_snapshot(struct zone *zone,
- enum zone_stat_item item)
- {
-- long x = atomic_long_read(&zone->vm_stat[item]);
-+ long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
-
- #ifdef CONFIG_SMP
- int cpu;
-@@ -264,8 +264,8 @@ static inline void __mod_zone_page_state(struct zone *zone,
-
- static inline void __inc_zone_state(struct zone *zone, enum zone_stat_item item)
- {
-- atomic_long_inc(&zone->vm_stat[item]);
-- atomic_long_inc(&vm_stat[item]);
-+ atomic_long_inc_unchecked(&zone->vm_stat[item]);
-+ atomic_long_inc_unchecked(&vm_stat[item]);
- }
-
- static inline void __inc_zone_page_state(struct page *page,
-@@ -276,8 +276,8 @@ static inline void __inc_zone_page_state(struct page *page,
-
- static inline void __dec_zone_state(struct zone *zone, enum zone_stat_item item)
- {
-- atomic_long_dec(&zone->vm_stat[item]);
-- atomic_long_dec(&vm_stat[item]);
-+ atomic_long_dec_unchecked(&zone->vm_stat[item]);
-+ atomic_long_dec_unchecked(&vm_stat[item]);
- }
-
- static inline void __dec_zone_page_state(struct page *page,
-diff --git a/include/linux/xattr.h b/include/linux/xattr.h
-index 5c84af8..1a3b6e2 100644
---- a/include/linux/xattr.h
-+++ b/include/linux/xattr.h
-@@ -33,6 +33,11 @@
- #define XATTR_USER_PREFIX "user."
- #define XATTR_USER_PREFIX_LEN (sizeof (XATTR_USER_PREFIX) - 1)
-
-+/* User namespace */
-+#define XATTR_PAX_PREFIX XATTR_USER_PREFIX "pax."
-+#define XATTR_PAX_FLAGS_SUFFIX "flags"
-+#define XATTR_NAME_PAX_FLAGS XATTR_PAX_PREFIX XATTR_PAX_FLAGS_SUFFIX
-+
- struct inode;
- struct dentry;
-
-diff --git a/include/media/v4l2-dev.h b/include/media/v4l2-dev.h
-index 73c9867..14cc2cd 100644
---- a/include/media/v4l2-dev.h
-+++ b/include/media/v4l2-dev.h
-@@ -34,7 +34,7 @@ struct v4l2_device;
- #define V4L2_FL_UNREGISTERED (0)
-
- struct v4l2_file_operations {
-- struct module *owner;
-+ struct module * const owner;
- ssize_t (*read) (struct file *, char __user *, size_t, loff_t *);
- ssize_t (*write) (struct file *, const char __user *, size_t, loff_t *);
- unsigned int (*poll) (struct file *, struct poll_table_struct *);
-diff --git a/include/media/v4l2-device.h b/include/media/v4l2-device.h
-index 5d5d550..f559ef1 100644
---- a/include/media/v4l2-device.h
-+++ b/include/media/v4l2-device.h
-@@ -71,7 +71,7 @@ int __must_check v4l2_device_register(struct device *dev, struct v4l2_device *v4
- this function returns 0. If the name ends with a digit (e.g. cx18),
- then the name will be set to cx18-0 since cx180 looks really odd. */
- int v4l2_device_set_name(struct v4l2_device *v4l2_dev, const char *basename,
-- atomic_t *instance);
-+ atomic_unchecked_t *instance);
-
- /* Set v4l2_dev->dev to NULL. Call when the USB parent disconnects.
- Since the parent disappears this ensures that v4l2_dev doesn't have an
-diff --git a/include/net/flow.h b/include/net/flow.h
-index 809970b..c3df4f3 100644
---- a/include/net/flow.h
-+++ b/include/net/flow.h
-@@ -92,7 +92,7 @@ typedef int (*flow_resolve_t)(struct net *net, struct flowi *key, u16 family,
- extern void *flow_cache_lookup(struct net *net, struct flowi *key, u16 family,
- u8 dir, flow_resolve_t resolver);
- extern void flow_cache_flush(void);
--extern atomic_t flow_cache_genid;
-+extern atomic_unchecked_t flow_cache_genid;
-
- static inline int flow_cache_uli_match(struct flowi *fl1, struct flowi *fl2)
- {
-diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
-index 696d6e4..9259a0f 100644
---- a/include/net/inet_connection_sock.h
-+++ b/include/net/inet_connection_sock.h
-@@ -62,7 +62,7 @@ struct inet_connection_sock_af_ops {
- void (*addr2sockaddr)(struct sock *sk, struct sockaddr *);
- int (*bind_conflict)(const struct sock *sk,
- const struct inet_bind_bucket *tb);
--};
-+} __do_const;
-
- /** inet_connection_sock - INET connection oriented sock
- *
-diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
-index 15e1f8fe..668837c 100644
---- a/include/net/inetpeer.h
-+++ b/include/net/inetpeer.h
-@@ -24,7 +24,7 @@ struct inet_peer
- __u32 dtime; /* the time of last use of not
- * referenced entries */
- atomic_t refcnt;
-- atomic_t rid; /* Frag reception counter */
-+ atomic_unchecked_t rid; /* Frag reception counter */
- __u32 tcp_ts;
- unsigned long tcp_ts_stamp;
- };
-diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
-index 98978e7..2243a3d 100644
---- a/include/net/ip_vs.h
-+++ b/include/net/ip_vs.h
-@@ -365,7 +365,7 @@ struct ip_vs_conn {
- struct ip_vs_conn *control; /* Master control connection */
- atomic_t n_control; /* Number of controlled ones */
- struct ip_vs_dest *dest; /* real server */
-- atomic_t in_pkts; /* incoming packet counter */
-+ atomic_unchecked_t in_pkts; /* incoming packet counter */
-
- /* packet transmitter for different forwarding methods. If it
- mangles the packet, it must return NF_DROP or better NF_STOLEN,
-@@ -466,7 +466,7 @@ struct ip_vs_dest {
- union nf_inet_addr addr; /* IP address of the server */
- __be16 port; /* port number of the server */
- volatile unsigned flags; /* dest status flags */
-- atomic_t conn_flags; /* flags to copy to conn */
-+ atomic_unchecked_t conn_flags; /* flags to copy to conn */
- atomic_t weight; /* server weight */
-
- atomic_t refcnt; /* reference counter */
-diff --git a/include/net/irda/ircomm_tty.h b/include/net/irda/ircomm_tty.h
-index eea2e61..08c692d 100644
---- a/include/net/irda/ircomm_tty.h
-+++ b/include/net/irda/ircomm_tty.h
-@@ -35,6 +35,7 @@
- #include <linux/termios.h>
- #include <linux/timer.h>
- #include <linux/tty.h> /* struct tty_struct */
-+#include <asm/local.h>
-
- #include <net/irda/irias_object.h>
- #include <net/irda/ircomm_core.h>
-@@ -105,8 +106,8 @@ struct ircomm_tty_cb {
- unsigned short close_delay;
- unsigned short closing_wait; /* time to wait before closing */
-
-- int open_count;
-- int blocked_open; /* # of blocked opens */
-+ local_t open_count;
-+ local_t blocked_open; /* # of blocked opens */
-
- /* Protect concurent access to :
- * o self->open_count
-diff --git a/include/net/iucv/af_iucv.h b/include/net/iucv/af_iucv.h
-index f82a1e8..82d81e8 100644
---- a/include/net/iucv/af_iucv.h
-+++ b/include/net/iucv/af_iucv.h
-@@ -87,7 +87,7 @@ struct iucv_sock {
- struct iucv_sock_list {
- struct hlist_head head;
- rwlock_t lock;
-- atomic_t autobind_name;
-+ atomic_unchecked_t autobind_name;
- };
-
- unsigned int iucv_sock_poll(struct file *file, struct socket *sock,
-diff --git a/include/net/lapb.h b/include/net/lapb.h
-index 96cb5dd..25e8d4f 100644
---- a/include/net/lapb.h
-+++ b/include/net/lapb.h
-@@ -95,7 +95,7 @@ struct lapb_cb {
- struct sk_buff_head write_queue;
- struct sk_buff_head ack_queue;
- unsigned char window;
-- struct lapb_register_struct callbacks;
-+ struct lapb_register_struct *callbacks;
-
- /* FRMR control information */
- struct lapb_frame frmr_data;
-diff --git a/include/net/neighbour.h b/include/net/neighbour.h
-index 3817fda..cdb2343 100644
---- a/include/net/neighbour.h
-+++ b/include/net/neighbour.h
-@@ -131,7 +131,7 @@ struct neigh_ops
- int (*connected_output)(struct sk_buff*);
- int (*hh_output)(struct sk_buff*);
- int (*queue_xmit)(struct sk_buff*);
--};
-+} __do_const;
-
- struct pneigh_entry
- {
-diff --git a/include/net/netdma.h b/include/net/netdma.h
-index 8ba8ce2..99b7fff 100644
---- a/include/net/netdma.h
-+++ b/include/net/netdma.h
-@@ -24,7 +24,7 @@
- #include <linux/dmaengine.h>
- #include <linux/skbuff.h>
-
--int dma_skb_copy_datagram_iovec(struct dma_chan* chan,
-+int __intentional_overflow(3,5) dma_skb_copy_datagram_iovec(struct dma_chan* chan,
- struct sk_buff *skb, int offset, struct iovec *to,
- size_t len, struct dma_pinned_list *pinned_list);
-
-diff --git a/include/net/netfilter/nf_queue.h b/include/net/netfilter/nf_queue.h
-index 252fd10..aa1421f 100644
---- a/include/net/netfilter/nf_queue.h
-+++ b/include/net/netfilter/nf_queue.h
-@@ -22,7 +22,7 @@ struct nf_queue_handler {
- int (*outfn)(struct nf_queue_entry *entry,
- unsigned int queuenum);
- char *name;
--};
-+} __do_const;
-
- extern int nf_register_queue_handler(u_int8_t pf,
- const struct nf_queue_handler *qh);
-diff --git a/include/net/netlink.h b/include/net/netlink.h
-index c344646..4778c71 100644
---- a/include/net/netlink.h
-+++ b/include/net/netlink.h
-@@ -335,7 +335,7 @@ static inline int nlmsg_ok(const struct nlmsghdr *nlh, int remaining)
- {
- return (remaining >= (int) sizeof(struct nlmsghdr) &&
- nlh->nlmsg_len >= sizeof(struct nlmsghdr) &&
-- nlh->nlmsg_len <= remaining);
-+ nlh->nlmsg_len <= (unsigned int)remaining);
- }
-
- /**
-@@ -558,7 +558,7 @@ static inline void *nlmsg_get_pos(struct sk_buff *skb)
- static inline void nlmsg_trim(struct sk_buff *skb, const void *mark)
- {
- if (mark)
-- skb_trim(skb, (unsigned char *) mark - skb->data);
-+ skb_trim(skb, (const unsigned char *) mark - skb->data);
- }
-
- /**
-diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
-index 9a4b8b7..e49e077 100644
---- a/include/net/netns/ipv4.h
-+++ b/include/net/netns/ipv4.h
-@@ -54,7 +54,7 @@ struct netns_ipv4 {
- int current_rt_cache_rebuild_count;
-
- struct timer_list rt_secret_timer;
-- atomic_t rt_genid;
-+ atomic_unchecked_t rt_genid;
-
- #ifdef CONFIG_IP_MROUTE
- struct sock *mroute_sk;
-diff --git a/include/net/protocol.h b/include/net/protocol.h
-index 60249e5..f9c3724 100644
---- a/include/net/protocol.h
-+++ b/include/net/protocol.h
-@@ -44,7 +44,7 @@ struct net_protocol {
- int (*gro_complete)(struct sk_buff *skb);
- unsigned int no_policy:1,
- netns_ok:1;
--};
-+} __do_const;
-
- #if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
- struct inet6_protocol
-@@ -64,7 +64,7 @@ struct inet6_protocol
- int (*gro_complete)(struct sk_buff *skb);
-
- unsigned int flags; /* INET6_PROTO_xxx */
--};
-+} __do_const;
-
- #define INET6_PROTO_NOPOLICY 0x1
- #define INET6_PROTO_FINAL 0x2
-diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
-index 8a6d529..171f401 100644
---- a/include/net/sctp/sctp.h
-+++ b/include/net/sctp/sctp.h
-@@ -305,8 +305,8 @@ extern int sctp_debug_flag;
-
- #else /* SCTP_DEBUG */
-
--#define SCTP_DEBUG_PRINTK(whatever...)
--#define SCTP_DEBUG_PRINTK_IPADDR(whatever...)
-+#define SCTP_DEBUG_PRINTK(whatever...) do {} while (0)
-+#define SCTP_DEBUG_PRINTK_IPADDR(whatever...) do {} while (0)
- #define SCTP_ENABLE_DEBUG
- #define SCTP_DISABLE_DEBUG
- #define SCTP_ASSERT(expr, str, func)
-diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
-index 88daa54..9013116 100644
---- a/include/net/sctp/structs.h
-+++ b/include/net/sctp/structs.h
-@@ -608,7 +608,7 @@ struct sctp_af {
- int sockaddr_len;
- sa_family_t sa_family;
- struct list_head list;
--};
-+} __do_const;
-
- struct sctp_af *sctp_get_af_specific(sa_family_t);
- int sctp_register_af(struct sctp_af *);
-@@ -628,7 +628,7 @@ struct sctp_pf {
- struct sctp_association *asoc);
- void (*addr_v4map) (struct sctp_sock *, union sctp_addr *);
- struct sctp_af *af;
--};
-+} __do_const;
-
-
- /* Structure to track chunk fragments that have been acked, but peer
-diff --git a/include/net/secure_seq.h b/include/net/secure_seq.h
-index d97f689..f3b90ab 100644
---- a/include/net/secure_seq.h
-+++ b/include/net/secure_seq.h
-@@ -7,14 +7,14 @@ extern __u32 secure_ip_id(__be32 daddr);
- extern __u32 secure_ipv6_id(const __be32 daddr[4]);
- extern u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport);
- extern u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
-- __be16 dport);
-+ __be16 dport);
- extern __u32 secure_tcp_sequence_number(__be32 saddr, __be32 daddr,
- __be16 sport, __be16 dport);
- extern __u32 secure_tcpv6_sequence_number(__be32 *saddr, __be32 *daddr,
-- __be16 sport, __be16 dport);
-+ __be16 sport, __be16 dport);
- extern u64 secure_dccp_sequence_number(__be32 saddr, __be32 daddr,
-- __be16 sport, __be16 dport);
-+ __be16 sport, __be16 dport);
- extern u64 secure_dccpv6_sequence_number(__be32 *saddr, __be32 *daddr,
-- __be16 sport, __be16 dport);
-+ __be16 sport, __be16 dport);
-
- #endif /* _NET_SECURE_SEQ */
-diff --git a/include/net/sock.h b/include/net/sock.h
-index 78adf52..32bb160 100644
---- a/include/net/sock.h
-+++ b/include/net/sock.h
-@@ -272,7 +272,7 @@ struct sock {
- rwlock_t sk_callback_lock;
- int sk_err,
- sk_err_soft;
-- atomic_t sk_drops;
-+ atomic_unchecked_t sk_drops;
- unsigned short sk_ack_backlog;
- unsigned short sk_max_ack_backlog;
- __u32 sk_priority;
-@@ -737,7 +737,7 @@ static inline void sk_refcnt_debug_release(const struct sock *sk)
- extern void sock_prot_inuse_add(struct net *net, struct proto *prot, int inc);
- extern int sock_prot_inuse_get(struct net *net, struct proto *proto);
- #else
--static void inline sock_prot_inuse_add(struct net *net, struct proto *prot,
-+static inline void sock_prot_inuse_add(struct net *net, struct proto *prot,
- int inc)
- {
- }
-@@ -1398,7 +1398,7 @@ static inline void sk_stream_moderate_sndbuf(struct sock *sk)
- }
- }
-
--struct sk_buff *sk_stream_alloc_skb(struct sock *sk, int size, gfp_t gfp);
-+struct sk_buff * __intentional_overflow(0) sk_stream_alloc_skb(struct sock *sk, int size, gfp_t gfp);
-
- static inline struct page *sk_stream_alloc_page(struct sock *sk)
- {
-diff --git a/include/net/tcp.h b/include/net/tcp.h
-index 6cfe18b..5f08ff0 100644
---- a/include/net/tcp.h
-+++ b/include/net/tcp.h
-@@ -237,6 +237,7 @@ extern int sysctl_tcp_base_mss;
- extern int sysctl_tcp_workaround_signed_windows;
- extern int sysctl_tcp_slow_start_after_idle;
- extern int sysctl_tcp_max_ssthresh;
-+extern int sysctl_tcp_challenge_ack_limit;
-
- extern atomic_t tcp_memory_allocated;
- extern struct percpu_counter tcp_sockets_allocated;
-@@ -483,7 +484,7 @@ extern void tcp_retransmit_timer(struct sock *sk);
- extern void tcp_xmit_retransmit_queue(struct sock *);
- extern void tcp_simple_retransmit(struct sock *);
- extern int tcp_trim_head(struct sock *, struct sk_buff *, u32);
--extern int tcp_fragment(struct sock *, struct sk_buff *, u32, unsigned int);
-+extern int __intentional_overflow(3) tcp_fragment(struct sock *, struct sk_buff *, u32, unsigned int);
-
- extern void tcp_send_probe0(struct sock *);
- extern void tcp_send_partial(struct sock *);
-@@ -632,8 +633,8 @@ struct tcp_skb_cb {
- struct inet6_skb_parm h6;
- #endif
- } header; /* For incoming frames */
-- __u32 seq; /* Starting sequence number */
-- __u32 end_seq; /* SEQ + FIN + SYN + datalen */
-+ __u32 seq __intentional_overflow(0); /* Starting sequence number */
-+ __u32 end_seq __intentional_overflow(0); /* SEQ + FIN + SYN + datalen */
- __u32 when; /* used to compute rtt's */
- __u8 flags; /* TCP header flags. */
-
-@@ -658,7 +659,7 @@ struct tcp_skb_cb {
- #define TCPCB_EVER_RETRANS 0x80 /* Ever retransmitted frame */
- #define TCPCB_RETRANS (TCPCB_SACKED_RETRANS|TCPCB_EVER_RETRANS)
-
-- __u32 ack_seq; /* Sequence number ACK'd */
-+ __u32 ack_seq __intentional_overflow(0); /* Sequence number ACK'd */
- };
-
- #define TCP_SKB_CB(__skb) ((struct tcp_skb_cb *)&((__skb)->cb[0]))
-diff --git a/include/net/xfrm.h b/include/net/xfrm.h
-index 223e90a..d652d35 100644
---- a/include/net/xfrm.h
-+++ b/include/net/xfrm.h
-@@ -389,7 +389,7 @@ struct xfrm_mode {
- struct module *owner;
- unsigned int encap;
- int flags;
--};
-+} __do_const;
-
- /* Flags for xfrm_mode. */
- enum {
-diff --git a/include/rdma/iw_cm.h b/include/rdma/iw_cm.h
-index cbb822e..e9c1cbe 100644
---- a/include/rdma/iw_cm.h
-+++ b/include/rdma/iw_cm.h
-@@ -129,7 +129,7 @@ struct iw_cm_verbs {
- int backlog);
-
- int (*destroy_listen)(struct iw_cm_id *cm_id);
--};
-+} __no_const;
-
- /**
- * iw_create_cm_id - Create an IW CM identifier.
-diff --git a/include/scsi/libfc.h b/include/scsi/libfc.h
-index 09a124b..caa8ca8 100644
---- a/include/scsi/libfc.h
-+++ b/include/scsi/libfc.h
-@@ -675,6 +675,7 @@ struct libfc_function_template {
- */
- void (*disc_stop_final) (struct fc_lport *);
- };
-+typedef struct libfc_function_template __no_const libfc_function_template_no_const;
-
- /* information used by the discovery layer */
- struct fc_disc {
-@@ -707,7 +708,7 @@ struct fc_lport {
- struct fc_disc disc;
-
- /* Operational Information */
-- struct libfc_function_template tt;
-+ libfc_function_template_no_const tt;
- u8 link_up;
- u8 qfull;
- enum fc_lport_state state;
-diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
-index de8e180..f15e0d7 100644
---- a/include/scsi/scsi_device.h
-+++ b/include/scsi/scsi_device.h
-@@ -156,9 +156,9 @@ struct scsi_device {
- unsigned int max_device_blocked; /* what device_blocked counts down from */
- #define SCSI_DEFAULT_DEVICE_BLOCKED 3
-
-- atomic_t iorequest_cnt;
-- atomic_t iodone_cnt;
-- atomic_t ioerr_cnt;
-+ atomic_unchecked_t iorequest_cnt;
-+ atomic_unchecked_t iodone_cnt;
-+ atomic_unchecked_t ioerr_cnt;
-
- struct device sdev_gendev,
- sdev_dev;
-diff --git a/include/scsi/scsi_host.h b/include/scsi/scsi_host.h
-index 0b4baba..0106e9e 100644
---- a/include/scsi/scsi_host.h
-+++ b/include/scsi/scsi_host.h
-@@ -43,6 +43,12 @@ struct blk_queue_tags;
- #define DISABLE_CLUSTERING 0
- #define ENABLE_CLUSTERING 1
-
-+enum {
-+ SCSI_QDEPTH_DEFAULT, /* default requested change, e.g. from sysfs */
-+ SCSI_QDEPTH_QFULL, /* scsi-ml requested due to queue full */
-+ SCSI_QDEPTH_RAMP_UP, /* scsi-ml requested due to threshhold event */
-+};
-+
- struct scsi_host_template {
- struct module *module;
- const char *name;
-diff --git a/include/scsi/scsi_transport_fc.h b/include/scsi/scsi_transport_fc.h
-index fc50bd6..81ba9cb 100644
---- a/include/scsi/scsi_transport_fc.h
-+++ b/include/scsi/scsi_transport_fc.h
-@@ -708,7 +708,7 @@ struct fc_function_template {
- unsigned long show_host_system_hostname:1;
-
- unsigned long disable_target_scan:1;
--};
-+} __do_const;
-
-
- /**
-diff --git a/include/sound/ac97_codec.h b/include/sound/ac97_codec.h
-index 3dae3f7..8440d6f 100644
---- a/include/sound/ac97_codec.h
-+++ b/include/sound/ac97_codec.h
-@@ -419,15 +419,15 @@
- struct snd_ac97;
-
- struct snd_ac97_build_ops {
-- int (*build_3d) (struct snd_ac97 *ac97);
-- int (*build_specific) (struct snd_ac97 *ac97);
-- int (*build_spdif) (struct snd_ac97 *ac97);
-- int (*build_post_spdif) (struct snd_ac97 *ac97);
-+ int (* const build_3d) (struct snd_ac97 *ac97);
-+ int (* const build_specific) (struct snd_ac97 *ac97);
-+ int (* const build_spdif) (struct snd_ac97 *ac97);
-+ int (* const build_post_spdif) (struct snd_ac97 *ac97);
- #ifdef CONFIG_PM
-- void (*suspend) (struct snd_ac97 *ac97);
-- void (*resume) (struct snd_ac97 *ac97);
-+ void (* const suspend) (struct snd_ac97 *ac97);
-+ void (* const resume) (struct snd_ac97 *ac97);
- #endif
-- void (*update_jacks) (struct snd_ac97 *ac97); /* for jack-sharing */
-+ void (* const update_jacks) (struct snd_ac97 *ac97); /* for jack-sharing */
- };
-
- struct snd_ac97_bus_ops {
-@@ -477,7 +477,7 @@ struct snd_ac97_template {
-
- struct snd_ac97 {
- /* -- lowlevel (hardware) driver specific -- */
-- struct snd_ac97_build_ops * build_ops;
-+ const struct snd_ac97_build_ops * build_ops;
- void *private_data;
- void (*private_free) (struct snd_ac97 *ac97);
- /* --- */
-diff --git a/include/sound/ymfpci.h b/include/sound/ymfpci.h
-index 444cd6b..3327cc5 100644
---- a/include/sound/ymfpci.h
-+++ b/include/sound/ymfpci.h
-@@ -358,7 +358,7 @@ struct snd_ymfpci {
- spinlock_t reg_lock;
- spinlock_t voice_lock;
- wait_queue_head_t interrupt_sleep;
-- atomic_t interrupt_sleep_count;
-+ atomic_unchecked_t interrupt_sleep_count;
- struct snd_info_entry *proc_entry;
- const struct firmware *dsp_microcode;
- const struct firmware *controller_microcode;
-diff --git a/include/trace/events/fs.h b/include/trace/events/fs.h
-new file mode 100644
-index 0000000..2efe49d
---- /dev/null
-+++ b/include/trace/events/fs.h
-@@ -0,0 +1,53 @@
-+#undef TRACE_SYSTEM
-+#define TRACE_SYSTEM fs
-+
-+#if !defined(_TRACE_FS_H) || defined(TRACE_HEADER_MULTI_READ)
-+#define _TRACE_FS_H
-+
-+#include <linux/fs.h>
-+#include <linux/tracepoint.h>
-+
-+TRACE_EVENT(do_sys_open,
-+
-+ TP_PROTO(char *filename, int flags, int mode),
-+
-+ TP_ARGS(filename, flags, mode),
-+
-+ TP_STRUCT__entry(
-+ __string( filename, filename )
-+ __field( int, flags )
-+ __field( int, mode )
-+ ),
-+
-+ TP_fast_assign(
-+ __assign_str(filename, filename);
-+ __entry->flags = flags;
-+ __entry->mode = mode;
-+ ),
-+
-+ TP_printk("\"%s\" %x %o",
-+ __get_str(filename), __entry->flags, __entry->mode)
-+);
-+
-+TRACE_EVENT(open_exec,
-+
-+ TP_PROTO(const char *filename),
-+
-+ TP_ARGS(filename),
-+
-+ TP_STRUCT__entry(
-+ __string( filename, filename )
-+ ),
-+
-+ TP_fast_assign(
-+ __assign_str(filename, filename);
-+ ),
-+
-+ TP_printk("\"%s\"",
-+ __get_str(filename))
-+);
-+
-+#endif /* _TRACE_FS_H */
-+
-+/* This part must be outside protection */
-+#include <trace/define_trace.h>
-diff --git a/include/trace/events/irq.h b/include/trace/events/irq.h
-index b89f9db..f097b38 100644
---- a/include/trace/events/irq.h
-+++ b/include/trace/events/irq.h
-@@ -34,7 +34,7 @@
- */
- TRACE_EVENT(irq_handler_entry,
-
-- TP_PROTO(int irq, struct irqaction *action),
-+ TP_PROTO(int irq, const struct irqaction *action),
-
- TP_ARGS(irq, action),
-
-@@ -64,7 +64,7 @@ TRACE_EVENT(irq_handler_entry,
- */
- TRACE_EVENT(irq_handler_exit,
-
-- TP_PROTO(int irq, struct irqaction *action, int ret),
-+ TP_PROTO(int irq, const struct irqaction *action, int ret),
-
- TP_ARGS(irq, action, ret),
-
-@@ -95,7 +95,7 @@ TRACE_EVENT(irq_handler_exit,
- */
- TRACE_EVENT(softirq_entry,
-
-- TP_PROTO(struct softirq_action *h, struct softirq_action *vec),
-+ TP_PROTO(const struct softirq_action *h, const struct softirq_action *vec),
-
- TP_ARGS(h, vec),
-
-@@ -124,7 +124,7 @@ TRACE_EVENT(softirq_entry,
- */
- TRACE_EVENT(softirq_exit,
-
-- TP_PROTO(struct softirq_action *h, struct softirq_action *vec),
-+ TP_PROTO(const struct softirq_action *h, const struct softirq_action *vec),
-
- TP_ARGS(h, vec),
-
-diff --git a/include/video/uvesafb.h b/include/video/uvesafb.h
-index 0993a22..32ba2fe 100644
---- a/include/video/uvesafb.h
-+++ b/include/video/uvesafb.h
-@@ -177,6 +177,7 @@ struct uvesafb_par {
- u8 ypan; /* 0 - nothing, 1 - ypan, 2 - ywrap */
- u8 pmi_setpal; /* PMI for palette changes */
- u16 *pmi_base; /* protected mode interface location */
-+ u8 *pmi_code; /* protected mode code location */
- void *pmi_start;
- void *pmi_pal;
- u8 *vbe_state_orig; /*
-diff --git a/init/Kconfig b/init/Kconfig
-index d72691b..b21f901 100644
---- a/init/Kconfig
-+++ b/init/Kconfig
-@@ -1004,7 +1004,7 @@ config SLUB_DEBUG
-
- config COMPAT_BRK
- bool "Disable heap randomization"
-- default y
-+ default n
- help
- Randomizing heap placement makes heap exploits harder, but it
- also breaks ancient binaries (including anything libc5 based).
-@@ -1190,7 +1190,7 @@ config INIT_ALL_POSSIBLE
- config STOP_MACHINE
- bool
- default y
-- depends on (SMP && MODULE_UNLOAD) || HOTPLUG_CPU
-+ depends on (SMP && MODULE_UNLOAD) || HOTPLUG_CPU || GRKERNSEC
- help
- Need stop_machine() primitive.
-
-diff --git a/init/do_mounts.c b/init/do_mounts.c
-index bb008d0..4fa3933 100644
---- a/init/do_mounts.c
-+++ b/init/do_mounts.c
-@@ -216,11 +216,11 @@ static void __init get_fs_names(char *page)
-
- static int __init do_mount_root(char *name, char *fs, int flags, void *data)
- {
-- int err = sys_mount(name, "/root", fs, flags, data);
-+ int err = sys_mount((__force char __user *)name, (__force char __user *)"/root", (__force char __user *)fs, flags, (__force void __user *)data);
- if (err)
- return err;
-
-- sys_chdir("/root");
-+ sys_chdir((__force const char __user *)"/root");
- ROOT_DEV = current->fs->pwd.mnt->mnt_sb->s_dev;
- printk("VFS: Mounted root (%s filesystem)%s on device %u:%u.\n",
- current->fs->pwd.mnt->mnt_sb->s_type->name,
-@@ -311,18 +311,18 @@ void __init change_floppy(char *fmt, ...)
- va_start(args, fmt);
- vsprintf(buf, fmt, args);
- va_end(args);
-- fd = sys_open("/dev/root", O_RDWR | O_NDELAY, 0);
-+ fd = sys_open((char __user *)"/dev/root", O_RDWR | O_NDELAY, 0);
- if (fd >= 0) {
- sys_ioctl(fd, FDEJECT, 0);
- sys_close(fd);
- }
- printk(KERN_NOTICE "VFS: Insert %s and press ENTER\n", buf);
-- fd = sys_open("/dev/console", O_RDWR, 0);
-+ fd = sys_open((char __user *)"/dev/console", O_RDWR, 0);
- if (fd >= 0) {
- sys_ioctl(fd, TCGETS, (long)&termios);
- termios.c_lflag &= ~ICANON;
- sys_ioctl(fd, TCSETSF, (long)&termios);
-- sys_read(fd, &c, 1);
-+ sys_read(fd, (char __user *)&c, 1);
- termios.c_lflag |= ICANON;
- sys_ioctl(fd, TCSETSF, (long)&termios);
- sys_close(fd);
-@@ -416,6 +416,6 @@ void __init prepare_namespace(void)
- mount_root();
- out:
- devtmpfs_mount("dev");
-- sys_mount(".", "/", NULL, MS_MOVE, NULL);
-- sys_chroot(".");
-+ sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
-+ sys_chroot((__force char __user *)".");
- }
-diff --git a/init/do_mounts.h b/init/do_mounts.h
-index f5b978a..a34abde 100644
---- a/init/do_mounts.h
-+++ b/init/do_mounts.h
-@@ -15,15 +15,15 @@ extern int root_mountflags;
-
- static inline int create_dev(char *name, dev_t dev)
- {
-- sys_unlink(name);
-- return sys_mknod(name, S_IFBLK|0600, new_encode_dev(dev));
-+ sys_unlink((char __force_user *)name);
-+ return sys_mknod((char __force_user *)name, S_IFBLK|0600, new_encode_dev(dev));
- }
-
- #if BITS_PER_LONG == 32
- static inline u32 bstat(char *name)
- {
- struct stat64 stat;
-- if (sys_stat64(name, &stat) != 0)
-+ if (sys_stat64((char __force_user *)name, (struct stat64 __force_user *)&stat) != 0)
- return 0;
- if (!S_ISBLK(stat.st_mode))
- return 0;
-@@ -35,7 +35,7 @@ static inline u32 bstat(char *name)
- static inline u32 bstat(char *name)
- {
- struct stat stat;
-- if (sys_newstat(name, &stat) != 0)
-+ if (sys_newstat((char __force_user *)name, (struct stat __force_user *)&stat) != 0)
- return 0;
- if (!S_ISBLK(stat.st_mode))
- return 0;
-diff --git a/init/do_mounts_initrd.c b/init/do_mounts_initrd.c
-index 614241b..4da046b 100644
---- a/init/do_mounts_initrd.c
-+++ b/init/do_mounts_initrd.c
-@@ -32,7 +32,7 @@ static int __init do_linuxrc(void * shell)
- sys_close(old_fd);sys_close(root_fd);
- sys_close(0);sys_close(1);sys_close(2);
- sys_setsid();
-- (void) sys_open("/dev/console",O_RDWR,0);
-+ (void) sys_open((__force const char __user *)"/dev/console",O_RDWR,0);
- (void) sys_dup(0);
- (void) sys_dup(0);
- return kernel_execve(shell, argv, envp_init);
-@@ -47,13 +47,13 @@ static void __init handle_initrd(void)
- create_dev("/dev/root.old", Root_RAM0);
- /* mount initrd on rootfs' /root */
- mount_block_root("/dev/root.old", root_mountflags & ~MS_RDONLY);
-- sys_mkdir("/old", 0700);
-- root_fd = sys_open("/", 0, 0);
-- old_fd = sys_open("/old", 0, 0);
-+ sys_mkdir((const char __force_user *)"/old", 0700);
-+ root_fd = sys_open((const char __force_user *)"/", 0, 0);
-+ old_fd = sys_open((const char __force_user *)"/old", 0, 0);
- /* move initrd over / and chdir/chroot in initrd root */
-- sys_chdir("/root");
-- sys_mount(".", "/", NULL, MS_MOVE, NULL);
-- sys_chroot(".");
-+ sys_chdir((const char __force_user *)"/root");
-+ sys_mount((char __force_user *)".", (char __force_user *)"/", NULL, MS_MOVE, NULL);
-+ sys_chroot((const char __force_user *)".");
-
- /*
- * In case that a resume from disk is carried out by linuxrc or one of
-@@ -70,15 +70,15 @@ static void __init handle_initrd(void)
-
- /* move initrd to rootfs' /old */
- sys_fchdir(old_fd);
-- sys_mount("/", ".", NULL, MS_MOVE, NULL);
-+ sys_mount((char __force_user *)"/", (char __force_user *)".", NULL, MS_MOVE, NULL);
- /* switch root and cwd back to / of rootfs */
- sys_fchdir(root_fd);
-- sys_chroot(".");
-+ sys_chroot((const char __force_user *)".");
- sys_close(old_fd);
- sys_close(root_fd);
-
- if (new_decode_dev(real_root_dev) == Root_RAM0) {
-- sys_chdir("/old");
-+ sys_chdir((const char __force_user *)"/old");
- return;
- }
-
-@@ -86,17 +86,17 @@ static void __init handle_initrd(void)
- mount_root();
-
- printk(KERN_NOTICE "Trying to move old root to /initrd ... ");
-- error = sys_mount("/old", "/root/initrd", NULL, MS_MOVE, NULL);
-+ error = sys_mount((char __force_user *)"/old", (char __force_user *)"/root/initrd", NULL, MS_MOVE, NULL);
- if (!error)
- printk("okay\n");
- else {
-- int fd = sys_open("/dev/root.old", O_RDWR, 0);
-+ int fd = sys_open((const char __force_user *)"/dev/root.old", O_RDWR, 0);
- if (error == -ENOENT)
- printk("/initrd does not exist. Ignored.\n");
- else
- printk("failed\n");
- printk(KERN_NOTICE "Unmounting old root\n");
-- sys_umount("/old", MNT_DETACH);
-+ sys_umount((char __force_user *)"/old", MNT_DETACH);
- printk(KERN_NOTICE "Trying to free ramdisk memory ... ");
- if (fd < 0) {
- error = fd;
-@@ -119,11 +119,11 @@ int __init initrd_load(void)
- * mounted in the normal path.
- */
- if (rd_load_image("/initrd.image") && ROOT_DEV != Root_RAM0) {
-- sys_unlink("/initrd.image");
-+ sys_unlink((const char __force_user *)"/initrd.image");
- handle_initrd();
- return 1;
- }
- }
-- sys_unlink("/initrd.image");
-+ sys_unlink((const char __force_user *)"/initrd.image");
- return 0;
- }
-diff --git a/init/do_mounts_md.c b/init/do_mounts_md.c
-index 69aebbf..c0bf6a7 100644
---- a/init/do_mounts_md.c
-+++ b/init/do_mounts_md.c
-@@ -170,7 +170,7 @@ static void __init md_setup_drive(void)
- partitioned ? "_d" : "", minor,
- md_setup_args[ent].device_names);
-
-- fd = sys_open(name, 0, 0);
-+ fd = sys_open((char __force_user *)name, 0, 0);
- if (fd < 0) {
- printk(KERN_ERR "md: open failed - cannot start "
- "array %s\n", name);
-@@ -233,7 +233,7 @@ static void __init md_setup_drive(void)
- * array without it
- */
- sys_close(fd);
-- fd = sys_open(name, 0, 0);
-+ fd = sys_open((char __force_user *)name, 0, 0);
- sys_ioctl(fd, BLKRRPART, 0);
- }
- sys_close(fd);
-@@ -283,7 +283,7 @@ static void __init autodetect_raid(void)
-
- wait_for_device_probe();
-
-- fd = sys_open("/dev/md0", 0, 0);
-+ fd = sys_open((__force char __user *)"/dev/md0", 0, 0);
- if (fd >= 0) {
- sys_ioctl(fd, RAID_AUTORUN, raid_autopart);
- sys_close(fd);
-diff --git a/init/initramfs.c b/init/initramfs.c
-index 1fd59b8..a01b079 100644
---- a/init/initramfs.c
-+++ b/init/initramfs.c
-@@ -74,7 +74,7 @@ static void __init free_hash(void)
- }
- }
-
--static long __init do_utime(char __user *filename, time_t mtime)
-+static long __init do_utime(__force char __user *filename, time_t mtime)
- {
- struct timespec t[2];
-
-@@ -109,7 +109,7 @@ static void __init dir_utime(void)
- struct dir_entry *de, *tmp;
- list_for_each_entry_safe(de, tmp, &dir_list, list) {
- list_del(&de->list);
-- do_utime(de->name, de->mtime);
-+ do_utime((char __force_user *)de->name, de->mtime);
- kfree(de->name);
- kfree(de);
- }
-@@ -271,7 +271,7 @@ static int __init maybe_link(void)
- if (nlink >= 2) {
- char *old = find_link(major, minor, ino, mode, collected);
- if (old)
-- return (sys_link(old, collected) < 0) ? -1 : 1;
-+ return (sys_link((char __force_user *)old, (char __force_user *)collected) < 0) ? -1 : 1;
- }
- return 0;
- }
-@@ -280,11 +280,11 @@ static void __init clean_path(char *path, mode_t mode)
- {
- struct stat st;
-
-- if (!sys_newlstat(path, &st) && (st.st_mode^mode) & S_IFMT) {
-+ if (!sys_newlstat((char __force_user *)path, (struct stat __force_user *)&st) && (st.st_mode^mode) & S_IFMT) {
- if (S_ISDIR(st.st_mode))
-- sys_rmdir(path);
-+ sys_rmdir((char __force_user *)path);
- else
-- sys_unlink(path);
-+ sys_unlink((char __force_user *)path);
- }
- }
-
-@@ -305,7 +305,7 @@ static int __init do_name(void)
- int openflags = O_WRONLY|O_CREAT;
- if (ml != 1)
- openflags |= O_TRUNC;
-- wfd = sys_open(collected, openflags, mode);
-+ wfd = sys_open((char __force_user *)collected, openflags, mode);
-
- if (wfd >= 0) {
- sys_fchown(wfd, uid, gid);
-@@ -317,17 +317,17 @@ static int __init do_name(void)
- }
- }
- } else if (S_ISDIR(mode)) {
-- sys_mkdir(collected, mode);
-- sys_chown(collected, uid, gid);
-- sys_chmod(collected, mode);
-+ sys_mkdir((char __force_user *)collected, mode);
-+ sys_chown((char __force_user *)collected, uid, gid);
-+ sys_chmod((char __force_user *)collected, mode);
- dir_add(collected, mtime);
- } else if (S_ISBLK(mode) || S_ISCHR(mode) ||
- S_ISFIFO(mode) || S_ISSOCK(mode)) {
- if (maybe_link() == 0) {
-- sys_mknod(collected, mode, rdev);
-- sys_chown(collected, uid, gid);
-- sys_chmod(collected, mode);
-- do_utime(collected, mtime);
-+ sys_mknod((char __force_user *)collected, mode, rdev);
-+ sys_chown((char __force_user *)collected, uid, gid);
-+ sys_chmod((char __force_user *)collected, mode);
-+ do_utime((char __force_user *)collected, mtime);
- }
- }
- return 0;
-@@ -336,15 +336,15 @@ static int __init do_name(void)
- static int __init do_copy(void)
- {
- if (count >= body_len) {
-- sys_write(wfd, victim, body_len);
-+ sys_write(wfd, (char __force_user *)victim, body_len);
- sys_close(wfd);
-- do_utime(vcollected, mtime);
-+ do_utime((char __force_user *)vcollected, mtime);
- kfree(vcollected);
- eat(body_len);
- state = SkipIt;
- return 0;
- } else {
-- sys_write(wfd, victim, count);
-+ sys_write(wfd, (char __force_user *)victim, count);
- body_len -= count;
- eat(count);
- return 1;
-@@ -355,9 +355,9 @@ static int __init do_symlink(void)
- {
- collected[N_ALIGN(name_len) + body_len] = '\0';
- clean_path(collected, 0);
-- sys_symlink(collected + N_ALIGN(name_len), collected);
-- sys_lchown(collected, uid, gid);
-- do_utime(collected, mtime);
-+ sys_symlink((char __force_user *)collected + N_ALIGN(name_len), (char __force_user *)collected);
-+ sys_lchown((char __force_user *)collected, uid, gid);
-+ do_utime((char __force_user *)collected, mtime);
- state = SkipIt;
- next_state = Reset;
- return 0;
-diff --git a/init/main.c b/init/main.c
-index 1eb4bd5..24fe9c2 100644
---- a/init/main.c
-+++ b/init/main.c
-@@ -97,6 +97,7 @@ static inline void mark_rodata_ro(void) { }
- #ifdef CONFIG_TC
- extern void tc_init(void);
- #endif
-+extern void grsecurity_init(void);
-
- enum system_states system_state __read_mostly;
- EXPORT_SYMBOL(system_state);
-@@ -183,6 +184,61 @@ static int __init set_reset_devices(char *str)
-
- __setup("reset_devices", set_reset_devices);
-
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+int grsec_proc_gid = CONFIG_GRKERNSEC_PROC_GID;
-+static int __init setup_grsec_proc_gid(char *str)
-+{
-+ grsec_proc_gid = (int)simple_strtol(str, NULL, 0);
-+ return 1;
-+}
-+__setup("grsec_proc_gid=", setup_grsec_proc_gid);
-+#endif
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+extern char pax_enter_kernel_user[];
-+extern char pax_exit_kernel_user[];
-+extern pgdval_t clone_pgd_mask;
-+#endif
-+
-+#if defined(CONFIG_X86) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+static int __init setup_pax_nouderef(char *str)
-+{
-+#ifdef CONFIG_X86_32
-+ unsigned int cpu;
-+ struct desc_struct *gdt;
-+
-+ for (cpu = 0; cpu < nr_cpu_ids; cpu++) {
-+ gdt = get_cpu_gdt_table(cpu);
-+ gdt[GDT_ENTRY_KERNEL_DS].type = 3;
-+ gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
-+ gdt[GDT_ENTRY_DEFAULT_USER_CS].limit = 0xf;
-+ gdt[GDT_ENTRY_DEFAULT_USER_DS].limit = 0xf;
-+ }
-+ loadsegment(ds, __KERNEL_DS);
-+ loadsegment(es, __KERNEL_DS);
-+ loadsegment(ss, __KERNEL_DS);
-+#else
-+ memcpy(pax_enter_kernel_user, (unsigned char []){0xc3}, 1);
-+ memcpy(pax_exit_kernel_user, (unsigned char []){0xc3}, 1);
-+ clone_pgd_mask = ~(pgdval_t)0UL;
-+#endif
-+
-+ return 0;
-+}
-+early_param("pax_nouderef", setup_pax_nouderef);
-+#endif
-+
-+#ifdef CONFIG_PAX_SOFTMODE
-+int pax_softmode;
-+
-+static int __init setup_pax_softmode(char *str)
-+{
-+ get_option(&str, &pax_softmode);
-+ return 1;
-+}
-+__setup("pax_softmode=", setup_pax_softmode);
-+#endif
-+
- static char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
- char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
- static const char *panic_later, *panic_param;
-@@ -705,64 +761,75 @@ int initcall_debug;
- core_param(initcall_debug, initcall_debug, bool, 0644);
-
- static char msgbuf[64];
--static struct boot_trace_call call;
--static struct boot_trace_ret ret;
-+static struct boot_trace_call trace_call;
-+static struct boot_trace_ret trace_ret;
-
- int do_one_initcall(initcall_t fn)
- {
- int count = preempt_count();
- ktime_t calltime, delta, rettime;
-+ const char *msg1 = "", *msg2 = "";
-
- if (initcall_debug) {
-- call.caller = task_pid_nr(current);
-- printk("calling %pF @ %i\n", fn, call.caller);
-+ trace_call.caller = task_pid_nr(current);
-+ printk("calling %pF @ %i\n", fn, trace_call.caller);
- calltime = ktime_get();
-- trace_boot_call(&call, fn);
-+ trace_boot_call(&trace_call, fn);
- enable_boot_trace();
- }
-
-- ret.result = fn();
-+ trace_ret.result = fn();
-
- if (initcall_debug) {
- disable_boot_trace();
- rettime = ktime_get();
- delta = ktime_sub(rettime, calltime);
-- ret.duration = (unsigned long long) ktime_to_ns(delta) >> 10;
-- trace_boot_ret(&ret, fn);
-+ trace_ret.duration = (unsigned long long) ktime_to_ns(delta) >> 10;
-+ trace_boot_ret(&trace_ret, fn);
- printk("initcall %pF returned %d after %Ld usecs\n", fn,
-- ret.result, ret.duration);
-+ trace_ret.result, trace_ret.duration);
- }
-
- msgbuf[0] = 0;
-
-- if (ret.result && ret.result != -ENODEV && initcall_debug)
-- sprintf(msgbuf, "error code %d ", ret.result);
-+ if (trace_ret.result && trace_ret.result != -ENODEV && initcall_debug)
-+ sprintf(msgbuf, "error code %d ", trace_ret.result);
-
- if (preempt_count() != count) {
-- strlcat(msgbuf, "preemption imbalance ", sizeof(msgbuf));
-+ msg1 = " preemption imbalance";
- preempt_count() = count;
- }
- if (irqs_disabled()) {
-- strlcat(msgbuf, "disabled interrupts ", sizeof(msgbuf));
-+ msg2 = " disabled interrupts";
- local_irq_enable();
- }
-- if (msgbuf[0]) {
-- printk("initcall %pF returned with %s\n", fn, msgbuf);
-+ if (msgbuf[0] || *msg1 || *msg2) {
-+ printk("initcall %pF returned with %s%s%s\n", fn, msgbuf, msg1, msg2);
- }
-
-- return ret.result;
-+ return trace_ret.result;
- }
-
-
- extern initcall_t __initcall_start[], __initcall_end[], __early_initcall_end[];
-
-+#ifdef CONFIG_PAX_LATENT_ENTROPY
-+u64 latent_entropy;
-+#endif
-+
- static void __init do_initcalls(void)
- {
- initcall_t *call;
-
-- for (call = __early_initcall_end; call < __initcall_end; call++)
-+ for (call = __early_initcall_end; call < __initcall_end; call++) {
- do_one_initcall(*call);
-
-+#ifdef CONFIG_PAX_LATENT_ENTROPY
-+ add_device_randomness(&latent_entropy, sizeof(latent_entropy));
-+#endif
-+
-+ }
-+
- /* Make sure there is no pending stuff from the initcall sequence */
- flush_scheduled_work();
- }
-@@ -790,8 +857,14 @@ static void __init do_pre_smp_initcalls(void)
- {
- initcall_t *call;
-
-- for (call = __initcall_start; call < __early_initcall_end; call++)
-+ for (call = __initcall_start; call < __early_initcall_end; call++) {
- do_one_initcall(*call);
-+
-+#ifdef CONFIG_PAX_LATENT_ENTROPY
-+ add_device_randomness(&latent_entropy, sizeof(latent_entropy));
-+#endif
-+
-+ }
- }
-
- static void run_init_process(char *init_filename)
-@@ -893,11 +966,13 @@ static int __init kernel_init(void * unused)
- if (!ramdisk_execute_command)
- ramdisk_execute_command = "/init";
-
-- if (sys_access((const char __user *) ramdisk_execute_command, 0) != 0) {
-+ if (sys_access((const char __force_user *) ramdisk_execute_command, 0) != 0) {
- ramdisk_execute_command = NULL;
- prepare_namespace();
- }
-
-+ grsecurity_init();
-+
- /*
- * Ok, we have completed the initial bootup, and
- * we're essentially up and running. Get rid of the
-diff --git a/init/noinitramfs.c b/init/noinitramfs.c
-index f4c1a3a..96c19bd 100644
---- a/init/noinitramfs.c
-+++ b/init/noinitramfs.c
-@@ -29,7 +29,7 @@ static int __init default_rootfs(void)
- {
- int err;
-
-- err = sys_mkdir("/dev", 0755);
-+ err = sys_mkdir((const char __user *)"/dev", 0755);
- if (err < 0)
- goto out;
-
-@@ -39,7 +39,7 @@ static int __init default_rootfs(void)
- if (err < 0)
- goto out;
-
-- err = sys_mkdir("/root", 0700);
-+ err = sys_mkdir((const char __user *)"/root", 0700);
- if (err < 0)
- goto out;
-
-diff --git a/ipc/mqueue.c b/ipc/mqueue.c
-index d01bc14..8df81db 100644
---- a/ipc/mqueue.c
-+++ b/ipc/mqueue.c
-@@ -150,6 +150,7 @@ static struct inode *mqueue_get_inode(struct super_block *sb,
- mq_bytes = (mq_msg_tblsz +
- (info->attr.mq_maxmsg * info->attr.mq_msgsize));
-
-+ gr_learn_resource(current, RLIMIT_MSGQUEUE, u->mq_bytes + mq_bytes, 1);
- spin_lock(&mq_lock);
- if (u->mq_bytes + mq_bytes < u->mq_bytes ||
- u->mq_bytes + mq_bytes >
-diff --git a/ipc/msg.c b/ipc/msg.c
-index 779f762..4af9e36 100644
---- a/ipc/msg.c
-+++ b/ipc/msg.c
-@@ -310,18 +310,19 @@ static inline int msg_security(struct kern_ipc_perm *ipcp, int msgflg)
- return security_msg_queue_associate(msq, msgflg);
- }
-
-+static struct ipc_ops msg_ops = {
-+ .getnew = newque,
-+ .associate = msg_security,
-+ .more_checks = NULL
-+};
-+
- SYSCALL_DEFINE2(msgget, key_t, key, int, msgflg)
- {
- struct ipc_namespace *ns;
-- struct ipc_ops msg_ops;
- struct ipc_params msg_params;
-
- ns = current->nsproxy->ipc_ns;
-
-- msg_ops.getnew = newque;
-- msg_ops.associate = msg_security;
-- msg_ops.more_checks = NULL;
--
- msg_params.key = key;
- msg_params.flg = msgflg;
-
-diff --git a/ipc/sem.c b/ipc/sem.c
-index b781007..f738b04 100644
---- a/ipc/sem.c
-+++ b/ipc/sem.c
-@@ -309,10 +309,15 @@ static inline int sem_more_checks(struct kern_ipc_perm *ipcp,
- return 0;
- }
-
-+static struct ipc_ops sem_ops = {
-+ .getnew = newary,
-+ .associate = sem_security,
-+ .more_checks = sem_more_checks
-+};
-+
- SYSCALL_DEFINE3(semget, key_t, key, int, nsems, int, semflg)
- {
- struct ipc_namespace *ns;
-- struct ipc_ops sem_ops;
- struct ipc_params sem_params;
-
- ns = current->nsproxy->ipc_ns;
-@@ -320,10 +325,6 @@ SYSCALL_DEFINE3(semget, key_t, key, int, nsems, int, semflg)
- if (nsems < 0 || nsems > ns->sc_semmsl)
- return -EINVAL;
-
-- sem_ops.getnew = newary;
-- sem_ops.associate = sem_security;
-- sem_ops.more_checks = sem_more_checks;
--
- sem_params.key = key;
- sem_params.flg = semflg;
- sem_params.u.nsems = nsems;
-@@ -671,6 +672,8 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
- ushort* sem_io = fast_sem_io;
- int nsems;
-
-+ pax_track_stack();
-+
- sma = sem_lock_check(ns, semid);
- if (IS_ERR(sma))
- return PTR_ERR(sma);
-@@ -1071,6 +1074,8 @@ SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops,
- unsigned long jiffies_left = 0;
- struct ipc_namespace *ns;
-
-+ pax_track_stack();
-+
- ns = current->nsproxy->ipc_ns;
-
- if (nsops < 1 || semid < 0)
-diff --git a/ipc/shm.c b/ipc/shm.c
-index d30732c..e4992cd 100644
---- a/ipc/shm.c
-+++ b/ipc/shm.c
-@@ -70,6 +70,14 @@ static void shm_destroy (struct ipc_namespace *ns, struct shmid_kernel *shp);
- static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
- #endif
-
-+#ifdef CONFIG_GRKERNSEC
-+extern int gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
-+ const time_t shm_createtime, const uid_t cuid,
-+ const int shmid);
-+extern int gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
-+ const time_t shm_createtime);
-+#endif
-+
- void shm_init_ns(struct ipc_namespace *ns)
- {
- ns->shm_ctlmax = SHMMAX;
-@@ -396,6 +404,14 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
- shp->shm_lprid = 0;
- shp->shm_atim = shp->shm_dtim = 0;
- shp->shm_ctim = get_seconds();
-+#ifdef CONFIG_GRKERNSEC
-+ {
-+ struct timespec timeval;
-+ do_posix_clock_monotonic_gettime(&timeval);
-+
-+ shp->shm_createtime = timeval.tv_sec;
-+ }
-+#endif
- shp->shm_segsz = size;
- shp->shm_nattch = 0;
- shp->shm_file = file;
-@@ -446,18 +462,19 @@ static inline int shm_more_checks(struct kern_ipc_perm *ipcp,
- return 0;
- }
-
-+static struct ipc_ops shm_ops = {
-+ .getnew = newseg,
-+ .associate = shm_security,
-+ .more_checks = shm_more_checks
-+};
-+
- SYSCALL_DEFINE3(shmget, key_t, key, size_t, size, int, shmflg)
- {
- struct ipc_namespace *ns;
-- struct ipc_ops shm_ops;
- struct ipc_params shm_params;
-
- ns = current->nsproxy->ipc_ns;
-
-- shm_ops.getnew = newseg;
-- shm_ops.associate = shm_security;
-- shm_ops.more_checks = shm_more_checks;
--
- shm_params.key = key;
- shm_params.flg = shmflg;
- shm_params.u.size = size;
-@@ -857,6 +874,12 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr)
- f_mode = FMODE_READ | FMODE_WRITE;
- }
- if (shmflg & SHM_EXEC) {
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (current->mm->pax_flags & MF_PAX_MPROTECT)
-+ goto out;
-+#endif
-+
- prot |= PROT_EXEC;
- acc_mode |= S_IXUGO;
- }
-@@ -880,9 +903,21 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr)
- if (err)
- goto out_unlock;
-
-+#ifdef CONFIG_GRKERNSEC
-+ if (!gr_handle_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime,
-+ shp->shm_perm.cuid, shmid) ||
-+ !gr_chroot_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime)) {
-+ err = -EACCES;
-+ goto out_unlock;
-+ }
-+#endif
-+
- path.dentry = dget(shp->shm_file->f_path.dentry);
- path.mnt = shp->shm_file->f_path.mnt;
- shp->shm_nattch++;
-+#ifdef CONFIG_GRKERNSEC
-+ shp->shm_lapid = current->pid;
-+#endif
- size = i_size_read(path.dentry->d_inode);
- shm_unlock(shp);
-
-diff --git a/kernel/Makefile b/kernel/Makefile
-index d7c13d2..13de8d7 100644
---- a/kernel/Makefile
-+++ b/kernel/Makefile
-@@ -66,7 +66,9 @@ obj-$(CONFIG_USER_NS) += user_namespace.o
- obj-$(CONFIG_PID_NS) += pid_namespace.o
- obj-$(CONFIG_IKCONFIG) += configs.o
- obj-$(CONFIG_RESOURCE_COUNTERS) += res_counter.o
-+ifeq ($(CONFIG_SMP),y)
- obj-$(CONFIG_STOP_MACHINE) += stop_machine.o
-+endif
- obj-$(CONFIG_KPROBES_SANITY_TEST) += test_kprobes.o
- obj-$(CONFIG_AUDIT) += audit.o auditfilter.o audit_watch.o
- obj-$(CONFIG_AUDITSYSCALL) += auditsc.o
-diff --git a/kernel/acct.c b/kernel/acct.c
-index a6605ca..ca91111 100644
---- a/kernel/acct.c
-+++ b/kernel/acct.c
-@@ -579,7 +579,7 @@ static void do_acct_process(struct bsd_acct_struct *acct,
- */
- flim = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
- current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY;
-- file->f_op->write(file, (char *)&ac,
-+ file->f_op->write(file, (char __force_user *)&ac,
- sizeof(acct_t), &file->f_pos);
- current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
- set_fs(fs);
-diff --git a/kernel/audit.c b/kernel/audit.c
-index 5feed23..48415fd 100644
---- a/kernel/audit.c
-+++ b/kernel/audit.c
-@@ -110,7 +110,7 @@ u32 audit_sig_sid = 0;
- 3) suppressed due to audit_rate_limit
- 4) suppressed due to audit_backlog_limit
- */
--static atomic_t audit_lost = ATOMIC_INIT(0);
-+static atomic_unchecked_t audit_lost = ATOMIC_INIT(0);
-
- /* The netlink socket. */
- static struct sock *audit_sock;
-@@ -232,7 +232,7 @@ void audit_log_lost(const char *message)
- unsigned long now;
- int print;
-
-- atomic_inc(&audit_lost);
-+ atomic_inc_unchecked(&audit_lost);
-
- print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit);
-
-@@ -251,7 +251,7 @@ void audit_log_lost(const char *message)
- printk(KERN_WARNING
- "audit: audit_lost=%d audit_rate_limit=%d "
- "audit_backlog_limit=%d\n",
-- atomic_read(&audit_lost),
-+ atomic_read_unchecked(&audit_lost),
- audit_rate_limit,
- audit_backlog_limit);
- audit_panic(message);
-@@ -691,7 +691,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
- status_set.pid = audit_pid;
- status_set.rate_limit = audit_rate_limit;
- status_set.backlog_limit = audit_backlog_limit;
-- status_set.lost = atomic_read(&audit_lost);
-+ status_set.lost = atomic_read_unchecked(&audit_lost);
- status_set.backlog = skb_queue_len(&audit_skb_queue);
- audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_GET, 0, 0,
- &status_set, sizeof(status_set));
-@@ -891,8 +891,10 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
- spin_unlock_irq(&tsk->sighand->siglock);
- }
- read_unlock(&tasklist_lock);
-- audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_TTY_GET, 0, 0,
-- &s, sizeof(s));
-+
-+ if (!err)
-+ audit_send_reply(NETLINK_CB(skb).pid, seq,
-+ AUDIT_TTY_GET, 0, 0, &s, sizeof(s));
- break;
- }
- case AUDIT_TTY_SET: {
-@@ -1262,12 +1264,13 @@ static void audit_log_vformat(struct audit_buffer *ab, const char *fmt,
- avail = audit_expand(ab,
- max_t(unsigned, AUDIT_BUFSIZ, 1+len-avail));
- if (!avail)
-- goto out;
-+ goto out_va_end;
- len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args2);
- }
-- va_end(args2);
- if (len > 0)
- skb_put(skb, len);
-+out_va_end:
-+ va_end(args2);
- out:
- return;
- }
-diff --git a/kernel/auditsc.c b/kernel/auditsc.c
-index 267e484..ac41bc3 100644
---- a/kernel/auditsc.c
-+++ b/kernel/auditsc.c
-@@ -1157,8 +1157,8 @@ static void audit_log_execve_info(struct audit_context *context,
- struct audit_buffer **ab,
- struct audit_aux_data_execve *axi)
- {
-- int i;
-- size_t len, len_sent = 0;
-+ int i, len;
-+ size_t len_sent = 0;
- const char __user *p;
- char *buf;
-
-@@ -2113,7 +2113,7 @@ int auditsc_get_stamp(struct audit_context *ctx,
- }
-
- /* global counter which is incremented every time something logs in */
--static atomic_t session_id = ATOMIC_INIT(0);
-+static atomic_unchecked_t session_id = ATOMIC_INIT(0);
-
- /**
- * audit_set_loginuid - set a task's audit_context loginuid
-@@ -2126,7 +2126,7 @@ static atomic_t session_id = ATOMIC_INIT(0);
- */
- int audit_set_loginuid(struct task_struct *task, uid_t loginuid)
- {
-- unsigned int sessionid = atomic_inc_return(&session_id);
-+ unsigned int sessionid = atomic_inc_return_unchecked(&session_id);
- struct audit_context *context = task->audit_context;
-
- if (context && context->in_syscall) {
-diff --git a/kernel/capability.c b/kernel/capability.c
-index 8a944f5..eed9491 100644
---- a/kernel/capability.c
-+++ b/kernel/capability.c
-@@ -254,7 +254,7 @@ SYSCALL_DEFINE2(capset, cap_user_header_t, header, const cap_user_data_t, data)
- if (pid != 0 && pid != task_pid_vnr(current))
- return -EPERM;
-
-- if (copy_from_user(&kdata, data,
-+ if (tocopy > _KERNEL_CAPABILITY_U32S || copy_from_user(&kdata, data,
- tocopy * sizeof(struct __user_cap_data_struct)))
- return -EFAULT;
-
-@@ -305,10 +305,26 @@ int capable(int cap)
- BUG();
- }
-
-- if (security_capable(cap) == 0) {
-+ if (security_capable(cap) == 0 && gr_is_capable(cap)) {
- current->flags |= PF_SUPERPRIV;
- return 1;
- }
- return 0;
- }
-+
-+int capable_nolog(int cap)
-+{
-+ if (unlikely(!cap_valid(cap))) {
-+ printk(KERN_CRIT "capable() called with invalid cap=%u\n", cap);
-+ BUG();
-+ }
-+
-+ if (security_capable(cap) == 0 && gr_is_capable_nolog(cap)) {
-+ current->flags |= PF_SUPERPRIV;
-+ return 1;
-+ }
-+ return 0;
-+}
-+
- EXPORT_SYMBOL(capable);
-+EXPORT_SYMBOL(capable_nolog);
-diff --git a/kernel/cgroup.c b/kernel/cgroup.c
-index 1fbcc74..ceecd77 100644
---- a/kernel/cgroup.c
-+++ b/kernel/cgroup.c
-@@ -536,6 +536,8 @@ static struct css_set *find_css_set(
- struct hlist_head *hhead;
- struct cg_cgroup_link *link;
-
-+ pax_track_stack();
-+
- /* First see if we already have a cgroup group that matches
- * the desired set */
- read_lock(&css_set_lock);
-@@ -4124,7 +4126,7 @@ static int cgroup_css_links_read(struct cgroup *cont,
- struct css_set *cg = link->cg;
- struct task_struct *task;
- int count = 0;
-- seq_printf(seq, "css_set %p\n", cg);
-+ seq_printf(seq, "css_set %pK\n", cg);
- list_for_each_entry(task, &cg->tasks, cg_list) {
- if (count++ > MAX_TASKS_SHOWN_PER_CSS) {
- seq_puts(seq, " ...\n");
-diff --git a/kernel/compat.c b/kernel/compat.c
-index 8bc5578..186e44a 100644
---- a/kernel/compat.c
-+++ b/kernel/compat.c
-@@ -108,7 +108,7 @@ static long compat_nanosleep_restart(struct restart_block *restart)
- mm_segment_t oldfs;
- long ret;
-
-- restart->nanosleep.rmtp = (struct timespec __user *) &rmt;
-+ restart->nanosleep.rmtp = (struct timespec __force_user *) &rmt;
- oldfs = get_fs();
- set_fs(KERNEL_DS);
- ret = hrtimer_nanosleep_restart(restart);
-@@ -140,7 +140,7 @@ asmlinkage long compat_sys_nanosleep(struct compat_timespec __user *rqtp,
- oldfs = get_fs();
- set_fs(KERNEL_DS);
- ret = hrtimer_nanosleep(&tu,
-- rmtp ? (struct timespec __user *)&rmt : NULL,
-+ rmtp ? (struct timespec __force_user *)&rmt : NULL,
- HRTIMER_MODE_REL, CLOCK_MONOTONIC);
- set_fs(oldfs);
-
-@@ -247,7 +247,7 @@ asmlinkage long compat_sys_sigpending(compat_old_sigset_t __user *set)
- mm_segment_t old_fs = get_fs();
-
- set_fs(KERNEL_DS);
-- ret = sys_sigpending((old_sigset_t __user *) &s);
-+ ret = sys_sigpending((old_sigset_t __force_user *) &s);
- set_fs(old_fs);
- if (ret == 0)
- ret = put_user(s, set);
-@@ -266,8 +266,8 @@ asmlinkage long compat_sys_sigprocmask(int how, compat_old_sigset_t __user *set,
- old_fs = get_fs();
- set_fs(KERNEL_DS);
- ret = sys_sigprocmask(how,
-- set ? (old_sigset_t __user *) &s : NULL,
-- oset ? (old_sigset_t __user *) &s : NULL);
-+ set ? (old_sigset_t __force_user *) &s : NULL,
-+ oset ? (old_sigset_t __force_user *) &s : NULL);
- set_fs(old_fs);
- if (ret == 0)
- if (oset)
-@@ -310,7 +310,7 @@ asmlinkage long compat_sys_old_getrlimit(unsigned int resource,
- mm_segment_t old_fs = get_fs();
-
- set_fs(KERNEL_DS);
-- ret = sys_old_getrlimit(resource, &r);
-+ ret = sys_old_getrlimit(resource, (struct rlimit __force_user *)&r);
- set_fs(old_fs);
-
- if (!ret) {
-@@ -385,7 +385,7 @@ asmlinkage long compat_sys_getrusage(int who, struct compat_rusage __user *ru)
- mm_segment_t old_fs = get_fs();
-
- set_fs(KERNEL_DS);
-- ret = sys_getrusage(who, (struct rusage __user *) &r);
-+ ret = sys_getrusage(who, (struct rusage __force_user *) &r);
- set_fs(old_fs);
-
- if (ret)
-@@ -412,8 +412,8 @@ compat_sys_wait4(compat_pid_t pid, compat_uint_t __user *stat_addr, int options,
- set_fs (KERNEL_DS);
- ret = sys_wait4(pid,
- (stat_addr ?
-- (unsigned int __user *) &status : NULL),
-- options, (struct rusage __user *) &r);
-+ (unsigned int __force_user *) &status : NULL),
-+ options, (struct rusage __force_user *) &r);
- set_fs (old_fs);
-
- if (ret > 0) {
-@@ -438,8 +438,8 @@ asmlinkage long compat_sys_waitid(int which, compat_pid_t pid,
- memset(&info, 0, sizeof(info));
-
- set_fs(KERNEL_DS);
-- ret = sys_waitid(which, pid, (siginfo_t __user *)&info, options,
-- uru ? (struct rusage __user *)&ru : NULL);
-+ ret = sys_waitid(which, pid, (siginfo_t __force_user *)&info, options,
-+ uru ? (struct rusage __force_user *)&ru : NULL);
- set_fs(old_fs);
-
- if ((ret < 0) || (info.si_signo == 0))
-@@ -569,8 +569,8 @@ long compat_sys_timer_settime(timer_t timer_id, int flags,
- oldfs = get_fs();
- set_fs(KERNEL_DS);
- err = sys_timer_settime(timer_id, flags,
-- (struct itimerspec __user *) &newts,
-- (struct itimerspec __user *) &oldts);
-+ (struct itimerspec __force_user *) &newts,
-+ (struct itimerspec __force_user *) &oldts);
- set_fs(oldfs);
- if (!err && old && put_compat_itimerspec(old, &oldts))
- return -EFAULT;
-@@ -587,7 +587,7 @@ long compat_sys_timer_gettime(timer_t timer_id,
- oldfs = get_fs();
- set_fs(KERNEL_DS);
- err = sys_timer_gettime(timer_id,
-- (struct itimerspec __user *) &ts);
-+ (struct itimerspec __force_user *) &ts);
- set_fs(oldfs);
- if (!err && put_compat_itimerspec(setting, &ts))
- return -EFAULT;
-@@ -606,7 +606,7 @@ long compat_sys_clock_settime(clockid_t which_clock,
- oldfs = get_fs();
- set_fs(KERNEL_DS);
- err = sys_clock_settime(which_clock,
-- (struct timespec __user *) &ts);
-+ (struct timespec __force_user *) &ts);
- set_fs(oldfs);
- return err;
- }
-@@ -621,7 +621,7 @@ long compat_sys_clock_gettime(clockid_t which_clock,
- oldfs = get_fs();
- set_fs(KERNEL_DS);
- err = sys_clock_gettime(which_clock,
-- (struct timespec __user *) &ts);
-+ (struct timespec __force_user *) &ts);
- set_fs(oldfs);
- if (!err && put_compat_timespec(&ts, tp))
- return -EFAULT;
-@@ -638,7 +638,7 @@ long compat_sys_clock_getres(clockid_t which_clock,
- oldfs = get_fs();
- set_fs(KERNEL_DS);
- err = sys_clock_getres(which_clock,
-- (struct timespec __user *) &ts);
-+ (struct timespec __force_user *) &ts);
- set_fs(oldfs);
- if (!err && tp && put_compat_timespec(&ts, tp))
- return -EFAULT;
-@@ -650,9 +650,9 @@ static long compat_clock_nanosleep_restart(struct restart_block *restart)
- long err;
- mm_segment_t oldfs;
- struct timespec tu;
-- struct compat_timespec *rmtp = restart->nanosleep.compat_rmtp;
-+ struct compat_timespec __user *rmtp = restart->nanosleep.compat_rmtp;
-
-- restart->nanosleep.rmtp = (struct timespec __user *) &tu;
-+ restart->nanosleep.rmtp = (struct timespec __force_user *) &tu;
- oldfs = get_fs();
- set_fs(KERNEL_DS);
- err = clock_nanosleep_restart(restart);
-@@ -684,8 +684,8 @@ long compat_sys_clock_nanosleep(clockid_t which_clock, int flags,
- oldfs = get_fs();
- set_fs(KERNEL_DS);
- err = sys_clock_nanosleep(which_clock, flags,
-- (struct timespec __user *) &in,
-- (struct timespec __user *) &out);
-+ (struct timespec __force_user *) &in,
-+ (struct timespec __force_user *) &out);
- set_fs(oldfs);
-
- if ((err == -ERESTART_RESTARTBLOCK) && rmtp &&
-diff --git a/kernel/configs.c b/kernel/configs.c
-index abaee68..047facd 100644
---- a/kernel/configs.c
-+++ b/kernel/configs.c
-@@ -73,8 +73,19 @@ static int __init ikconfig_init(void)
- struct proc_dir_entry *entry;
-
- /* create the current config file */
-+#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_HIDESYM)
-+ entry = proc_create("config.gz", S_IFREG | S_IRUSR, NULL,
-+ &ikconfig_file_ops);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ entry = proc_create("config.gz", S_IFREG | S_IRUSR | S_IRGRP, NULL,
-+ &ikconfig_file_ops);
-+#endif
-+#else
- entry = proc_create("config.gz", S_IFREG | S_IRUGO, NULL,
- &ikconfig_file_ops);
-+#endif
-+
- if (!entry)
- return -ENOMEM;
-
-diff --git a/kernel/cpu.c b/kernel/cpu.c
-index 3f2f04f..4e53ded 100644
---- a/kernel/cpu.c
-+++ b/kernel/cpu.c
-@@ -20,7 +20,7 @@
- /* Serializes the updates to cpu_online_mask, cpu_present_mask */
- static DEFINE_MUTEX(cpu_add_remove_lock);
-
--static __cpuinitdata RAW_NOTIFIER_HEAD(cpu_chain);
-+static RAW_NOTIFIER_HEAD(cpu_chain);
-
- /* If set, cpu_up and cpu_down will return -EBUSY and do nothing.
- * Should always be manipulated under cpu_add_remove_lock
-diff --git a/kernel/cred.c b/kernel/cred.c
-index 9c06d10..5b211dc 100644
---- a/kernel/cred.c
-+++ b/kernel/cred.c
-@@ -160,6 +160,8 @@ static void put_cred_rcu(struct rcu_head *rcu)
- */
- void __put_cred(struct cred *cred)
- {
-+ pax_track_stack();
-+
- kdebug("__put_cred(%p{%d,%d})", cred,
- atomic_read(&cred->usage),
- read_cred_subscribers(cred));
-@@ -184,6 +186,8 @@ void exit_creds(struct task_struct *tsk)
- {
- struct cred *cred;
-
-+ pax_track_stack();
-+
- kdebug("exit_creds(%u,%p,%p,{%d,%d})", tsk->pid, tsk->real_cred, tsk->cred,
- atomic_read(&tsk->cred->usage),
- read_cred_subscribers(tsk->cred));
-@@ -206,6 +210,15 @@ void exit_creds(struct task_struct *tsk)
- validate_creds(cred);
- put_cred(cred);
- }
-+
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+ cred = (struct cred *) tsk->delayed_cred;
-+ if (cred) {
-+ tsk->delayed_cred = NULL;
-+ validate_creds(cred);
-+ put_cred(cred);
-+ }
-+#endif
- }
-
- /**
-@@ -222,6 +235,8 @@ const struct cred *get_task_cred(struct task_struct *task)
- {
- const struct cred *cred;
-
-+ pax_track_stack();
-+
- rcu_read_lock();
-
- do {
-@@ -241,6 +256,8 @@ struct cred *cred_alloc_blank(void)
- {
- struct cred *new;
-
-+ pax_track_stack();
-+
- new = kmem_cache_zalloc(cred_jar, GFP_KERNEL);
- if (!new)
- return NULL;
-@@ -289,6 +306,8 @@ struct cred *prepare_creds(void)
- const struct cred *old;
- struct cred *new;
-
-+ pax_track_stack();
-+
- validate_process_creds();
-
- new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
-@@ -328,13 +347,15 @@ EXPORT_SYMBOL(prepare_creds);
-
- /*
- * Prepare credentials for current to perform an execve()
-- * - The caller must hold current->cred_guard_mutex
-+ * - The caller must hold ->cred_guard_mutex
- */
- struct cred *prepare_exec_creds(void)
- {
- struct thread_group_cred *tgcred = NULL;
- struct cred *new;
-
-+ pax_track_stack();
-+
- #ifdef CONFIG_KEYS
- tgcred = kmalloc(sizeof(*tgcred), GFP_KERNEL);
- if (!tgcred)
-@@ -441,7 +462,9 @@ int copy_creds(struct task_struct *p, unsigned long clone_flags)
- struct cred *new;
- int ret;
-
-- mutex_init(&p->cred_guard_mutex);
-+ pax_track_stack();
-+
-+ p->replacement_session_keyring = NULL;
-
- p->replacement_session_keyring = NULL;
-
-@@ -525,11 +548,13 @@ error_put:
- * Always returns 0 thus allowing this function to be tail-called at the end
- * of, say, sys_setgid().
- */
--int commit_creds(struct cred *new)
-+static int __commit_creds(struct cred *new)
- {
- struct task_struct *task = current;
- const struct cred *old = task->real_cred;
-
-+ pax_track_stack();
-+
- kdebug("commit_creds(%p{%d,%d})", new,
- atomic_read(&new->usage),
- read_cred_subscribers(new));
-@@ -546,6 +571,8 @@ int commit_creds(struct cred *new)
-
- get_cred(new); /* we will require a ref for the subj creds too */
-
-+ gr_set_role_label(task, new->uid, new->gid);
-+
- /* dumpability changes */
- if (old->euid != new->euid ||
- old->egid != new->egid ||
-@@ -565,10 +592,8 @@ int commit_creds(struct cred *new)
- key_fsgid_changed(task);
-
- /* do it
-- * - What if a process setreuid()'s and this brings the
-- * new uid over his NPROC rlimit? We can check this now
-- * cheaply with the new uid cache, so if it matters
-- * we should be checking for it. -DaveM
-+ * RLIMIT_NPROC limits on user->processes have already been checked
-+ * in set_user().
- */
- alter_cred_subscribers(new, 2);
- if (new->user != old->user)
-@@ -597,8 +622,105 @@ int commit_creds(struct cred *new)
- put_cred(old);
- return 0;
- }
-+
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+extern int set_user(struct cred *new);
-+
-+void gr_delayed_cred_worker(void)
-+{
-+ const struct cred *new = current->delayed_cred;
-+ struct cred *ncred;
-+
-+ current->delayed_cred = NULL;
-+
-+ if (current_uid() && new != NULL) {
-+ // from doing get_cred on it when queueing this
-+ put_cred(new);
-+ return;
-+ } else if (new == NULL)
-+ return;
-+
-+ ncred = prepare_creds();
-+ if (!ncred)
-+ goto die;
-+ // uids
-+ ncred->uid = new->uid;
-+ ncred->euid = new->euid;
-+ ncred->suid = new->suid;
-+ ncred->fsuid = new->fsuid;
-+ // gids
-+ ncred->gid = new->gid;
-+ ncred->egid = new->egid;
-+ ncred->sgid = new->sgid;
-+ ncred->fsgid = new->fsgid;
-+ // groups
-+ if (set_groups(ncred, new->group_info) < 0) {
-+ abort_creds(ncred);
-+ goto die;
-+ }
-+ // caps
-+ ncred->securebits = new->securebits;
-+ ncred->cap_inheritable = new->cap_inheritable;
-+ ncred->cap_permitted = new->cap_permitted;
-+ ncred->cap_effective = new->cap_effective;
-+ ncred->cap_bset = new->cap_bset;
-+
-+ if (set_user(ncred)) {
-+ abort_creds(ncred);
-+ goto die;
-+ }
-+
-+ // from doing get_cred on it when queueing this
-+ put_cred(new);
-+
-+ __commit_creds(ncred);
-+ return;
-+die:
-+ // from doing get_cred on it when queueing this
-+ put_cred(new);
-+ do_group_exit(SIGKILL);
-+}
-+#endif
-+
-+int commit_creds(struct cred *new)
-+{
-+#ifdef CONFIG_GRKERNSEC_SETXID
-+ int ret;
-+ int schedule_it = 0;
-+ struct task_struct *t;
-+
-+ /* we won't get called with tasklist_lock held for writing
-+ and interrupts disabled as the cred struct in that case is
-+ init_cred
-+ */
-+ if (grsec_enable_setxid && !current_is_single_threaded() &&
-+ !current_uid() && new->uid) {
-+ schedule_it = 1;
-+ }
-+ ret = __commit_creds(new);
-+ if (schedule_it) {
-+ rcu_read_lock();
-+ read_lock(&tasklist_lock);
-+ for (t = next_thread(current); t != current;
-+ t = next_thread(t)) {
-+ if (t->delayed_cred == NULL) {
-+ t->delayed_cred = get_cred(new);
-+ set_tsk_thread_flag(t, TIF_GRSEC_SETXID);
-+ set_tsk_need_resched(t);
-+ }
-+ }
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+ }
-+ return ret;
-+#else
-+ return __commit_creds(new);
-+#endif
-+}
-+
- EXPORT_SYMBOL(commit_creds);
-
-+
- /**
- * abort_creds - Discard a set of credentials and unlock the current task
- * @new: The credentials that were going to be applied
-@@ -608,6 +730,8 @@ EXPORT_SYMBOL(commit_creds);
- */
- void abort_creds(struct cred *new)
- {
-+ pax_track_stack();
-+
- kdebug("abort_creds(%p{%d,%d})", new,
- atomic_read(&new->usage),
- read_cred_subscribers(new));
-@@ -631,6 +755,8 @@ const struct cred *override_creds(const struct cred *new)
- {
- const struct cred *old = current->cred;
-
-+ pax_track_stack();
-+
- kdebug("override_creds(%p{%d,%d})", new,
- atomic_read(&new->usage),
- read_cred_subscribers(new));
-@@ -660,6 +786,8 @@ void revert_creds(const struct cred *old)
- {
- const struct cred *override = current->cred;
-
-+ pax_track_stack();
-+
- kdebug("revert_creds(%p{%d,%d})", old,
- atomic_read(&old->usage),
- read_cred_subscribers(old));
-@@ -706,6 +834,8 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
- const struct cred *old;
- struct cred *new;
-
-+ pax_track_stack();
-+
- new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
- if (!new)
- return NULL;
-@@ -760,6 +890,8 @@ EXPORT_SYMBOL(prepare_kernel_cred);
- */
- int set_security_override(struct cred *new, u32 secid)
- {
-+ pax_track_stack();
-+
- return security_kernel_act_as(new, secid);
- }
- EXPORT_SYMBOL(set_security_override);
-@@ -779,6 +911,8 @@ int set_security_override_from_ctx(struct cred *new, const char *secctx)
- u32 secid;
- int ret;
-
-+ pax_track_stack();
-+
- ret = security_secctx_to_secid(secctx, strlen(secctx), &secid);
- if (ret < 0)
- return ret;
-diff --git a/kernel/exit.c b/kernel/exit.c
-index a2a1659..df8479c 100644
---- a/kernel/exit.c
-+++ b/kernel/exit.c
-@@ -174,6 +174,10 @@ void release_task(struct task_struct * p)
- struct task_struct *leader;
- int zap_leader;
- repeat:
-+#ifdef CONFIG_NET
-+ gr_del_task_from_ip_table(p);
-+#endif
-+
- tracehook_prepare_release_task(p);
- /* don't need to get the RCU readlock here - the process is dead and
- * can't be modifying its own credentials */
-@@ -397,7 +401,7 @@ int allow_signal(int sig)
- * know it'll be handled, so that they don't get converted to
- * SIGKILL or just silently dropped.
- */
-- current->sighand->action[(sig)-1].sa.sa_handler = (void __user *)2;
-+ current->sighand->action[(sig)-1].sa.sa_handler = (__force void __user *)2;
- recalc_sigpending();
- spin_unlock_irq(¤t->sighand->siglock);
- return 0;
-@@ -433,6 +437,9 @@ void daemonize(const char *name, ...)
- vsnprintf(current->comm, sizeof(current->comm), name, args);
- va_end(args);
-
-+ gr_put_exec_file(current);
-+ gr_set_kernel_label(current);
-+
- /*
- * If we were started as result of loading a module, close all of the
- * user space pages. We don't need them, and if we didn't close them
-@@ -897,17 +904,17 @@ NORET_TYPE void do_exit(long code)
- struct task_struct *tsk = current;
- int group_dead;
-
-- profile_task_exit(tsk);
--
-- WARN_ON(atomic_read(&tsk->fs_excl));
--
-+ /*
-+ * Check this first since set_fs() below depends on
-+ * current_thread_info(), which we better not access when we're in
-+ * interrupt context. Other than that, we want to do the set_fs()
-+ * as early as possible.
-+ */
- if (unlikely(in_interrupt()))
- panic("Aiee, killing interrupt handler!");
-- if (unlikely(!tsk->pid))
-- panic("Attempted to kill the idle task!");
-
- /*
-- * If do_exit is called because this processes oopsed, it's possible
-+ * If do_exit is called because this processes Oops'ed, it's possible
- * that get_fs() was left as KERNEL_DS, so reset it to USER_DS before
- * continuing. Amongst other possible reasons, this is to prevent
- * mm_release()->clear_child_tid() from writing to a user-controlled
-@@ -915,6 +922,13 @@ NORET_TYPE void do_exit(long code)
- */
- set_fs(USER_DS);
-
-+ profile_task_exit(tsk);
-+
-+ WARN_ON(atomic_read(&tsk->fs_excl));
-+
-+ if (unlikely(!tsk->pid))
-+ panic("Attempted to kill the idle task!");
-+
- tracehook_report_exit(&code);
-
- validate_creds_for_do_exit(tsk);
-@@ -973,6 +987,9 @@ NORET_TYPE void do_exit(long code)
- tsk->exit_code = code;
- taskstats_exit(tsk, group_dead);
-
-+ gr_acl_handle_psacct(tsk, code);
-+ gr_acl_handle_exit();
-+
- exit_mm(tsk);
-
- if (group_dead)
-@@ -1059,7 +1076,7 @@ SYSCALL_DEFINE1(exit, int, error_code)
- * Take down every thread in the group. This is called by fatal signals
- * as well as by sys_exit_group (below).
- */
--NORET_TYPE void
-+__noreturn void
- do_group_exit(int exit_code)
- {
- struct signal_struct *sig = current->signal;
-@@ -1188,7 +1205,7 @@ static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p)
-
- if (unlikely(wo->wo_flags & WNOWAIT)) {
- int exit_code = p->exit_code;
-- int why, status;
-+ int why;
-
- get_task_struct(p);
- read_unlock(&tasklist_lock);
-diff --git a/kernel/fork.c b/kernel/fork.c
-index c28f804..3a04506 100644
---- a/kernel/fork.c
-+++ b/kernel/fork.c
-@@ -240,21 +240,26 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
- }
-
- err = arch_dup_task_struct(tsk, orig);
-- if (err)
-- goto out;
-+ /*
-+ * We defer looking at err, because we will need this setup
-+ * for the clean up path to work correctly.
-+ */
-
- tsk->stack = ti;
--
-- err = prop_local_init_single(&tsk->dirties);
-- if (err)
-- goto out;
--
- setup_thread_stack(tsk, orig);
-+
-+ if (err)
-+ goto out;
-+
-+ err = prop_local_init_single(&tsk->dirties);
-+ if (err)
-+ goto out;
-+
- stackend = end_of_stack(tsk);
- *stackend = STACK_END_MAGIC; /* for overflow detection */
-
- #ifdef CONFIG_CC_STACKPROTECTOR
-- tsk->stack_canary = get_random_int();
-+ tsk->stack_canary = pax_get_random_long();
- #endif
-
- /* One for us, one for whoever does the "release_task()" (usually parent) */
-@@ -294,8 +299,8 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
- mm->locked_vm = 0;
- mm->mmap = NULL;
- mm->mmap_cache = NULL;
-- mm->free_area_cache = oldmm->mmap_base;
-- mm->cached_hole_size = ~0UL;
-+ mm->free_area_cache = oldmm->free_area_cache;
-+ mm->cached_hole_size = oldmm->cached_hole_size;
- mm->map_count = 0;
- cpumask_clear(mm_cpumask(mm));
- mm->mm_rb = RB_ROOT;
-@@ -319,7 +324,7 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
- }
- charge = 0;
- if (mpnt->vm_flags & VM_ACCOUNT) {
-- unsigned int len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
-+ unsigned long len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
- if (security_vm_enough_memory(len))
- goto fail_nomem;
- charge = len;
-@@ -336,6 +341,7 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
- tmp->vm_flags &= ~VM_LOCKED;
- tmp->vm_mm = mm;
- tmp->vm_next = tmp->vm_prev = NULL;
-+ tmp->vm_mirror = NULL;
- anon_vma_link(tmp);
- file = tmp->vm_file;
- if (file) {
-@@ -385,6 +391,31 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
- if (retval)
- goto out;
- }
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (oldmm->pax_flags & MF_PAX_SEGMEXEC) {
-+ struct vm_area_struct *mpnt_m;
-+
-+ for (mpnt = oldmm->mmap, mpnt_m = mm->mmap; mpnt; mpnt = mpnt->vm_next, mpnt_m = mpnt_m->vm_next) {
-+ BUG_ON(!mpnt_m || mpnt_m->vm_mirror || mpnt->vm_mm != oldmm || mpnt_m->vm_mm != mm);
-+
-+ if (!mpnt->vm_mirror)
-+ continue;
-+
-+ if (mpnt->vm_end <= SEGMEXEC_TASK_SIZE) {
-+ BUG_ON(mpnt->vm_mirror->vm_mirror != mpnt);
-+ mpnt->vm_mirror = mpnt_m;
-+ } else {
-+ BUG_ON(mpnt->vm_mirror->vm_mirror == mpnt || mpnt->vm_mirror->vm_mirror->vm_mm != mm);
-+ mpnt_m->vm_mirror = mpnt->vm_mirror->vm_mirror;
-+ mpnt_m->vm_mirror->vm_mirror = mpnt_m;
-+ mpnt->vm_mirror->vm_mirror = mpnt;
-+ }
-+ }
-+ BUG_ON(mpnt_m);
-+ }
-+#endif
-+
- /* a new mm has just been created */
- arch_dup_mmap(oldmm, mm);
- retval = 0;
-@@ -735,13 +766,20 @@ static int copy_fs(unsigned long clone_flags, struct task_struct *tsk)
- write_unlock(&fs->lock);
- return -EAGAIN;
- }
-- fs->users++;
-+ atomic_inc(&fs->users);
- write_unlock(&fs->lock);
- return 0;
- }
- tsk->fs = copy_fs_struct(fs);
- if (!tsk->fs)
- return -ENOMEM;
-+ /* Carry through gr_chroot_dentry and is_chrooted instead
-+ of recomputing it here. Already copied when the task struct
-+ is duplicated. This allows pivot_root to not be treated as
-+ a chroot
-+ */
-+ //gr_set_chroot_entries(tsk, &tsk->fs->root);
-+
- return 0;
- }
-
-@@ -913,6 +951,8 @@ static int copy_signal(unsigned long clone_flags, struct task_struct *tsk)
-
- sig->oom_adj = current->signal->oom_adj;
-
-+ mutex_init(&sig->cred_guard_mutex);
-+
- return 0;
- }
-
-@@ -1036,12 +1076,16 @@ static struct task_struct *copy_process(unsigned long clone_flags,
- DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
- #endif
- retval = -EAGAIN;
-+
-+ gr_learn_resource(p, RLIMIT_NPROC, atomic_read(&p->real_cred->user->processes), 0);
-+
- if (atomic_read(&p->real_cred->user->processes) >=
- p->signal->rlim[RLIMIT_NPROC].rlim_cur) {
-- if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
-- p->real_cred->user != INIT_USER)
-+ if (p->real_cred->user != INIT_USER &&
-+ !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN))
- goto bad_fork_free;
- }
-+ current->flags &= ~PF_NPROC_EXCEEDED;
-
- retval = copy_creds(p, clone_flags);
- if (retval < 0)
-@@ -1263,6 +1307,11 @@ static struct task_struct *copy_process(unsigned long clone_flags,
- goto bad_fork_free_pid;
- }
-
-+ /* synchronizes with gr_set_acls()
-+ we need to call this past the point of no return for fork()
-+ */
-+ gr_copy_label(p);
-+
- if (clone_flags & CLONE_THREAD) {
- atomic_inc(¤t->signal->count);
- atomic_inc(¤t->signal->live);
-@@ -1337,6 +1386,8 @@ bad_fork_cleanup_count:
- bad_fork_free:
- free_task(p);
- fork_out:
-+ gr_log_forkfail(retval);
-+
- return ERR_PTR(retval);
- }
-
-@@ -1430,6 +1481,8 @@ long do_fork(unsigned long clone_flags,
- if (clone_flags & CLONE_PARENT_SETTID)
- put_user(nr, parent_tidptr);
-
-+ gr_handle_brute_check();
-+
- if (clone_flags & CLONE_VFORK) {
- p->vfork_done = &vfork;
- init_completion(&vfork);
-@@ -1562,7 +1615,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
- return 0;
-
- /* don't need lock here; in the worst case we'll do useless copy */
-- if (fs->users == 1)
-+ if (atomic_read(&fs->users) == 1)
- return 0;
-
- *new_fsp = copy_fs_struct(fs);
-@@ -1685,7 +1738,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
- fs = current->fs;
- write_lock(&fs->lock);
- current->fs = new_fs;
-- if (--fs->users)
-+ gr_set_chroot_entries(current, ¤t->fs->root);
-+ if (atomic_dec_return(&fs->users))
- new_fs = NULL;
- else
- new_fs = fs;
-diff --git a/kernel/futex.c b/kernel/futex.c
-index 9c5ffe1..7c85216 100644
---- a/kernel/futex.c
-+++ b/kernel/futex.c
-@@ -54,6 +54,7 @@
- #include <linux/mount.h>
- #include <linux/pagemap.h>
- #include <linux/syscalls.h>
-+#include <linux/ptrace.h>
- #include <linux/signal.h>
- #include <linux/module.h>
- #include <linux/magic.h>
-@@ -223,6 +224,11 @@ get_futex_key(u32 __user *uaddr, int fshared, union futex_key *key, int rw)
- struct page *page;
- int err, ro = 0;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && address >= SEGMEXEC_TASK_SIZE)
-+ return -EFAULT;
-+#endif
-+
- /*
- * The futex address must be "naturally" aligned.
- */
-@@ -665,8 +671,8 @@ static int futex_lock_pi_atomic(u32 __user *uaddr, struct futex_hash_bucket *hb,
- struct futex_pi_state **ps,
- struct task_struct *task, int set_waiters)
- {
-- int lock_taken, ret, ownerdied = 0;
-- u32 uval, newval, curval;
-+ int lock_taken, ret, force_take = 0;
-+ u32 uval, newval, curval, vpid = task_pid_vnr(task);
-
- retry:
- ret = lock_taken = 0;
-@@ -676,7 +682,7 @@ retry:
- * (by doing a 0 -> TID atomic cmpxchg), while holding all
- * the locks. It will most likely not succeed.
- */
-- newval = task_pid_vnr(task);
-+ newval = vpid;
- if (set_waiters)
- newval |= FUTEX_WAITERS;
-
-@@ -688,7 +694,7 @@ retry:
- /*
- * Detect deadlocks.
- */
-- if ((unlikely((curval & FUTEX_TID_MASK) == task_pid_vnr(task))))
-+ if ((unlikely((curval & FUTEX_TID_MASK) == vpid)))
- return -EDEADLK;
-
- /*
-@@ -706,17 +712,15 @@ retry:
- newval = curval | FUTEX_WAITERS;
-
- /*
-- * There are two cases, where a futex might have no owner (the
-- * owner TID is 0): OWNER_DIED. We take over the futex in this
-- * case. We also do an unconditional take over, when the owner
-- * of the futex died.
-- *
-- * This is safe as we are protected by the hash bucket lock !
-+ * Should we force take the futex? See below.
- */
-- if (unlikely(ownerdied || !(curval & FUTEX_TID_MASK))) {
-- /* Keep the OWNER_DIED bit */
-- newval = (curval & ~FUTEX_TID_MASK) | task_pid_vnr(task);
-- ownerdied = 0;
-+ if (unlikely(force_take)) {
-+ /*
-+ * Keep the OWNER_DIED and the WAITERS bit and set the
-+ * new TID value.
-+ */
-+ newval = (curval & ~FUTEX_TID_MASK) | vpid;
-+ force_take = 0;
- lock_taken = 1;
- }
-
-@@ -728,7 +732,7 @@ retry:
- goto retry;
-
- /*
-- * We took the lock due to owner died take over.
-+ * We took the lock due to forced take over.
- */
- if (unlikely(lock_taken))
- return 1;
-@@ -743,20 +747,25 @@ retry:
- switch (ret) {
- case -ESRCH:
- /*
-- * No owner found for this futex. Check if the
-- * OWNER_DIED bit is set to figure out whether
-- * this is a robust futex or not.
-+ * We failed to find an owner for this
-+ * futex. So we have no pi_state to block
-+ * on. This can happen in two cases:
-+ *
-+ * 1) The owner died
-+ * 2) A stale FUTEX_WAITERS bit
-+ *
-+ * Re-read the futex value.
- */
- if (get_futex_value_locked(&curval, uaddr))
- return -EFAULT;
-
- /*
-- * We simply start over in case of a robust
-- * futex. The code above will take the futex
-- * and return happy.
-+ * If the owner died or we have a stale
-+ * WAITERS bit the owner TID in the user space
-+ * futex is 0.
- */
-- if (curval & FUTEX_OWNER_DIED) {
-- ownerdied = 1;
-+ if (!(curval & FUTEX_TID_MASK)) {
-+ force_take = 1;
- goto retry;
- }
- default:
-@@ -775,6 +784,9 @@ static void wake_futex(struct futex_q *q)
- {
- struct task_struct *p = q->task;
-
-+ if (WARN(q->pi_state || q->rt_waiter, "refusing to wake PI futex\n"))
-+ return;
-+
- /*
- * We set q->lock_ptr = NULL _before_ we wake up the task. If
- * a non futex wake up happens on another CPU then the task
-@@ -1014,6 +1026,10 @@ retry_private:
-
- plist_for_each_entry_safe(this, next, head, list) {
- if (match_futex (&this->key, &key1)) {
-+ if (this->pi_state || this->rt_waiter) {
-+ ret = -EINVAL;
-+ goto out_unlock;
-+ }
- wake_futex(this);
- if (++ret >= nr_wake)
- break;
-@@ -1026,6 +1042,10 @@ retry_private:
- op_ret = 0;
- plist_for_each_entry_safe(this, next, head, list) {
- if (match_futex (&this->key, &key2)) {
-+ if (this->pi_state || this->rt_waiter) {
-+ ret = -EINVAL;
-+ goto out_unlock;
-+ }
- wake_futex(this);
- if (++op_ret >= nr_wake2)
- break;
-@@ -1034,6 +1054,7 @@ retry_private:
- ret += op_ret;
- }
-
-+out_unlock:
- double_unlock_hb(hb1, hb2);
- out_put_keys:
- put_futex_key(fshared, &key2);
-@@ -1328,9 +1349,13 @@ retry_private:
- /*
- * FUTEX_WAIT_REQEUE_PI and FUTEX_CMP_REQUEUE_PI should always
- * be paired with each other and no other futex ops.
-+ *
-+ * We should never be requeueing a futex_q with a pi_state,
-+ * which is awaiting a futex_unlock_pi().
- */
- if ((requeue_pi && !this->rt_waiter) ||
-- (!requeue_pi && this->rt_waiter)) {
-+ (!requeue_pi && this->rt_waiter) ||
-+ this->pi_state) {
- ret = -EINVAL;
- break;
- }
-@@ -1831,6 +1856,8 @@ static int futex_wait(u32 __user *uaddr, int fshared,
- struct futex_q q;
- int ret;
-
-+ pax_track_stack();
-+
- if (!bitset)
- return -EINVAL;
-
-@@ -1883,7 +1910,7 @@ retry:
-
- restart = ¤t_thread_info()->restart_block;
- restart->fn = futex_wait_restart;
-- restart->futex.uaddr = (u32 *)uaddr;
-+ restart->futex.uaddr = uaddr;
- restart->futex.val = val;
- restart->futex.time = abs_time->tv64;
- restart->futex.bitset = bitset;
-@@ -2245,6 +2272,8 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, int fshared,
- struct futex_q q;
- int res, ret;
-
-+ pax_track_stack();
-+
- if (uaddr == uaddr2)
- return -EINVAL;
-
-@@ -2438,6 +2467,10 @@ SYSCALL_DEFINE3(get_robust_list, int, pid,
- if (!p)
- goto err_unlock;
- ret = -EPERM;
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ if (!ptrace_may_access(p, PTRACE_MODE_READ))
-+ goto err_unlock;
-+#endif
- pcred = __task_cred(p);
- if (cred->euid != pcred->euid &&
- cred->euid != pcred->uid &&
-@@ -2504,7 +2537,7 @@ retry:
- */
- static inline int fetch_robust_entry(struct robust_list __user **entry,
- struct robust_list __user * __user *head,
-- int *pi)
-+ unsigned int *pi)
- {
- unsigned long uentry;
-
-@@ -2685,6 +2718,7 @@ static int __init futex_init(void)
- {
- u32 curval;
- int i;
-+ mm_segment_t oldfs;
-
- /*
- * This will fail and we want it. Some arch implementations do
-@@ -2696,7 +2730,10 @@ static int __init futex_init(void)
- * implementation, the non functional ones will return
- * -ENOSYS.
- */
-+ oldfs = get_fs();
-+ set_fs(USER_DS);
- curval = cmpxchg_futex_value_locked(NULL, 0, 0);
-+ set_fs(oldfs);
- if (curval == -EFAULT)
- futex_cmpxchg_enabled = 1;
-
-diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c
-index 2357165..eb25501b 100644
---- a/kernel/futex_compat.c
-+++ b/kernel/futex_compat.c
-@@ -10,6 +10,7 @@
- #include <linux/compat.h>
- #include <linux/nsproxy.h>
- #include <linux/futex.h>
-+#include <linux/ptrace.h>
-
- #include <asm/uaccess.h>
-
-@@ -135,7 +136,8 @@ compat_sys_get_robust_list(int pid, compat_uptr_t __user *head_ptr,
- {
- struct compat_robust_list_head __user *head;
- unsigned long ret;
-- const struct cred *cred = current_cred(), *pcred;
-+ const struct cred *cred = current_cred();
-+ const struct cred *pcred;
-
- if (!futex_cmpxchg_enabled)
- return -ENOSYS;
-@@ -151,6 +153,10 @@ compat_sys_get_robust_list(int pid, compat_uptr_t __user *head_ptr,
- if (!p)
- goto err_unlock;
- ret = -EPERM;
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ if (!ptrace_may_access(p, PTRACE_MODE_READ))
-+ goto err_unlock;
-+#endif
- pcred = __task_cred(p);
- if (cred->euid != pcred->euid &&
- cred->euid != pcred->uid &&
-diff --git a/kernel/gcov/base.c b/kernel/gcov/base.c
-index 9b22d03..6295b62 100644
---- a/kernel/gcov/base.c
-+++ b/kernel/gcov/base.c
-@@ -102,11 +102,6 @@ void gcov_enable_events(void)
- }
-
- #ifdef CONFIG_MODULES
--static inline int within(void *addr, void *start, unsigned long size)
--{
-- return ((addr >= start) && (addr < start + size));
--}
--
- /* Update list and generate events when modules are unloaded. */
- static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
- void *data)
-@@ -121,7 +116,7 @@ static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
- prev = NULL;
- /* Remove entries located in module from linked list. */
- for (info = gcov_info_head; info; info = info->next) {
-- if (within(info, mod->module_core, mod->core_size)) {
-+ if (within_module_core_rw((unsigned long)info, mod)) {
- if (prev)
- prev->next = info->next;
- else
-diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
-index 2818422..b63eb19 100644
---- a/kernel/hrtimer.c
-+++ b/kernel/hrtimer.c
-@@ -1402,7 +1402,7 @@ void hrtimer_peek_ahead_timers(void)
- local_irq_restore(flags);
- }
-
--static void run_hrtimer_softirq(struct softirq_action *h)
-+static void run_hrtimer_softirq(void)
- {
- struct hrtimer_cpu_base *cpu_base = &__get_cpu_var(hrtimer_bases);
-
-diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
-index 8b6b8b6..6bc87df 100644
---- a/kernel/kallsyms.c
-+++ b/kernel/kallsyms.c
-@@ -11,6 +11,9 @@
- * Changed the compression method from stem compression to "table lookup"
- * compression (see scripts/kallsyms.c for a more complete description)
- */
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+#define __INCLUDED_BY_HIDESYM 1
-+#endif
- #include <linux/kallsyms.h>
- #include <linux/module.h>
- #include <linux/init.h>
-@@ -51,12 +54,33 @@ extern const unsigned long kallsyms_markers[] __attribute__((weak));
-
- static inline int is_kernel_inittext(unsigned long addr)
- {
-+ if (system_state != SYSTEM_BOOTING)
-+ return 0;
-+
- if (addr >= (unsigned long)_sinittext
- && addr <= (unsigned long)_einittext)
- return 1;
- return 0;
- }
-
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+#ifdef CONFIG_MODULES
-+static inline int is_module_text(unsigned long addr)
-+{
-+ if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END)
-+ return 1;
-+
-+ addr = ktla_ktva(addr);
-+ return (unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END;
-+}
-+#else
-+static inline int is_module_text(unsigned long addr)
-+{
-+ return 0;
-+}
-+#endif
-+#endif
-+
- static inline int is_kernel_text(unsigned long addr)
- {
- if ((addr >= (unsigned long)_stext && addr <= (unsigned long)_etext) ||
-@@ -67,13 +91,28 @@ static inline int is_kernel_text(unsigned long addr)
-
- static inline int is_kernel(unsigned long addr)
- {
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ if (is_kernel_text(addr) || is_kernel_inittext(addr))
-+ return 1;
-+
-+ if (ktla_ktva((unsigned long)_text) <= addr && addr < (unsigned long)_end)
-+#else
- if (addr >= (unsigned long)_stext && addr <= (unsigned long)_end)
-+#endif
-+
- return 1;
- return in_gate_area_no_task(addr);
- }
-
- static int is_ksym_addr(unsigned long addr)
- {
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ if (is_module_text(addr))
-+ return 0;
-+#endif
-+
- if (all_var)
- return is_kernel(addr);
-
-@@ -413,7 +452,6 @@ static unsigned long get_ksymbol_core(struct kallsym_iter *iter)
-
- static void reset_iter(struct kallsym_iter *iter, loff_t new_pos)
- {
-- iter->name[0] = '\0';
- iter->nameoff = get_symbol_offset(new_pos);
- iter->pos = new_pos;
- }
-@@ -461,6 +499,11 @@ static int s_show(struct seq_file *m, void *p)
- {
- struct kallsym_iter *iter = m->private;
-
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ if (current_uid())
-+ return 0;
-+#endif
-+
- /* Some debugging symbols have no name. Ignore them. */
- if (!iter->name[0])
- return 0;
-@@ -501,7 +544,7 @@ static int kallsyms_open(struct inode *inode, struct file *file)
- struct kallsym_iter *iter;
- int ret;
-
-- iter = kmalloc(sizeof(*iter), GFP_KERNEL);
-+ iter = kzalloc(sizeof(*iter), GFP_KERNEL);
- if (!iter)
- return -ENOMEM;
- reset_iter(iter, 0);
-diff --git a/kernel/kexec.c b/kernel/kexec.c
-index f336e21..9c1c20b 100644
---- a/kernel/kexec.c
-+++ b/kernel/kexec.c
-@@ -1028,7 +1028,8 @@ asmlinkage long compat_sys_kexec_load(unsigned long entry,
- unsigned long flags)
- {
- struct compat_kexec_segment in;
-- struct kexec_segment out, __user *ksegments;
-+ struct kexec_segment out;
-+ struct kexec_segment __user *ksegments;
- unsigned long i, result;
-
- /* Don't allow clients that don't understand the native
-diff --git a/kernel/kgdb.c b/kernel/kgdb.c
-index 53dae4b..9ba3743 100644
---- a/kernel/kgdb.c
-+++ b/kernel/kgdb.c
-@@ -86,7 +86,7 @@ static int kgdb_io_module_registered;
- /* Guard for recursive entry */
- static int exception_level;
-
--static struct kgdb_io *kgdb_io_ops;
-+static const struct kgdb_io *kgdb_io_ops;
- static DEFINE_SPINLOCK(kgdb_registration_lock);
-
- /* kgdb console driver is loaded */
-@@ -123,7 +123,7 @@ atomic_t kgdb_active = ATOMIC_INIT(-1);
- */
- static atomic_t passive_cpu_wait[NR_CPUS];
- static atomic_t cpu_in_kgdb[NR_CPUS];
--atomic_t kgdb_setting_breakpoint;
-+atomic_unchecked_t kgdb_setting_breakpoint;
-
- struct task_struct *kgdb_usethread;
- struct task_struct *kgdb_contthread;
-@@ -140,7 +140,7 @@ static unsigned long gdb_regs[(NUMREGBYTES +
- sizeof(unsigned long)];
-
- /* to keep track of the CPU which is doing the single stepping*/
--atomic_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
-+atomic_unchecked_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
-
- /*
- * If you are debugging a problem where roundup (the collection of
-@@ -815,7 +815,7 @@ static int kgdb_io_ready(int print_wait)
- return 0;
- if (kgdb_connected)
- return 1;
-- if (atomic_read(&kgdb_setting_breakpoint))
-+ if (atomic_read_unchecked(&kgdb_setting_breakpoint))
- return 1;
- if (print_wait)
- printk(KERN_CRIT "KGDB: Waiting for remote debugger\n");
-@@ -1426,8 +1426,8 @@ acquirelock:
- * instance of the exception handler wanted to come into the
- * debugger on a different CPU via a single step
- */
-- if (atomic_read(&kgdb_cpu_doing_single_step) != -1 &&
-- atomic_read(&kgdb_cpu_doing_single_step) != cpu) {
-+ if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1 &&
-+ atomic_read_unchecked(&kgdb_cpu_doing_single_step) != cpu) {
-
- atomic_set(&kgdb_active, -1);
- touch_softlockup_watchdog();
-@@ -1634,7 +1634,7 @@ static void kgdb_initial_breakpoint(void)
- *
- * Register it with the KGDB core.
- */
--int kgdb_register_io_module(struct kgdb_io *new_kgdb_io_ops)
-+int kgdb_register_io_module(const struct kgdb_io *new_kgdb_io_ops)
- {
- int err;
-
-@@ -1679,7 +1679,7 @@ EXPORT_SYMBOL_GPL(kgdb_register_io_module);
- *
- * Unregister it with the KGDB core.
- */
--void kgdb_unregister_io_module(struct kgdb_io *old_kgdb_io_ops)
-+void kgdb_unregister_io_module(const struct kgdb_io *old_kgdb_io_ops)
- {
- BUG_ON(kgdb_connected);
-
-@@ -1712,11 +1712,11 @@ EXPORT_SYMBOL_GPL(kgdb_unregister_io_module);
- */
- void kgdb_breakpoint(void)
- {
-- atomic_set(&kgdb_setting_breakpoint, 1);
-+ atomic_set_unchecked(&kgdb_setting_breakpoint, 1);
- wmb(); /* Sync point before breakpoint */
- arch_kgdb_breakpoint();
- wmb(); /* Sync point after breakpoint */
-- atomic_set(&kgdb_setting_breakpoint, 0);
-+ atomic_set_unchecked(&kgdb_setting_breakpoint, 0);
- }
- EXPORT_SYMBOL_GPL(kgdb_breakpoint);
-
-diff --git a/kernel/kmod.c b/kernel/kmod.c
-index a061472..40884b6 100644
---- a/kernel/kmod.c
-+++ b/kernel/kmod.c
-@@ -68,13 +68,12 @@ char modprobe_path[KMOD_PATH_LEN] = "/sbin/modprobe";
- * If module auto-loading support is disabled then this function
- * becomes a no-operation.
- */
--int __request_module(bool wait, const char *fmt, ...)
-+static int ____request_module(bool wait, char *module_param, const char *fmt, va_list ap)
- {
-- va_list args;
- char module_name[MODULE_NAME_LEN];
- unsigned int max_modprobes;
- int ret;
-- char *argv[] = { modprobe_path, "-q", "--", module_name, NULL };
-+ char *argv[] = { modprobe_path, "-q", "--", module_name, module_param, NULL };
- static char *envp[] = { "HOME=/",
- "TERM=linux",
- "PATH=/sbin:/usr/sbin:/bin:/usr/bin",
-@@ -87,12 +86,24 @@ int __request_module(bool wait, const char *fmt, ...)
- if (ret)
- return ret;
-
-- va_start(args, fmt);
-- ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
-- va_end(args);
-+ ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, ap);
- if (ret >= MODULE_NAME_LEN)
- return -ENAMETOOLONG;
-
-+#ifdef CONFIG_GRKERNSEC_MODHARDEN
-+ if (!current_uid()) {
-+ /* hack to workaround consolekit/udisks stupidity */
-+ read_lock(&tasklist_lock);
-+ if (!strcmp(current->comm, "mount") &&
-+ current->real_parent && !strncmp(current->real_parent->comm, "udisk", 5)) {
-+ read_unlock(&tasklist_lock);
-+ printk(KERN_ALERT "grsec: denied attempt to auto-load fs module %.64s by udisks\n", module_name);
-+ return -EPERM;
-+ }
-+ read_unlock(&tasklist_lock);
-+ }
-+#endif
-+
- /* If modprobe needs a service that is in a module, we get a recursive
- * loop. Limit the number of running kmod threads to max_threads/2 or
- * MAX_KMOD_CONCURRENT, whichever is the smaller. A cleaner method
-@@ -126,6 +137,48 @@ int __request_module(bool wait, const char *fmt, ...)
- atomic_dec(&kmod_concurrent);
- return ret;
- }
-+
-+int ___request_module(bool wait, char *module_param, const char *fmt, ...)
-+{
-+ va_list args;
-+ int ret;
-+
-+ va_start(args, fmt);
-+ ret = ____request_module(wait, module_param, fmt, args);
-+ va_end(args);
-+
-+ return ret;
-+}
-+
-+int __request_module(bool wait, const char *fmt, ...)
-+{
-+ va_list args;
-+ int ret;
-+
-+#ifdef CONFIG_GRKERNSEC_MODHARDEN
-+ if (current_uid()) {
-+ char module_param[MODULE_NAME_LEN];
-+
-+ memset(module_param, 0, sizeof(module_param));
-+
-+ snprintf(module_param, sizeof(module_param) - 1, "grsec_modharden_normal%u_", current_uid());
-+
-+ va_start(args, fmt);
-+ ret = ____request_module(wait, module_param, fmt, args);
-+ va_end(args);
-+
-+ return ret;
-+ }
-+#endif
-+
-+ va_start(args, fmt);
-+ ret = ____request_module(wait, NULL, fmt, args);
-+ va_end(args);
-+
-+ return ret;
-+}
-+
-+
- EXPORT_SYMBOL(__request_module);
- #endif /* CONFIG_MODULES */
-
-@@ -231,7 +284,7 @@ static int wait_for_helper(void *data)
- *
- * Thus the __user pointer cast is valid here.
- */
-- sys_wait4(pid, (int __user *)&ret, 0, NULL);
-+ sys_wait4(pid, (int __force_user *)&ret, 0, NULL);
-
- /*
- * If ret is 0, either ____call_usermodehelper failed and the
-diff --git a/kernel/kprobes.c b/kernel/kprobes.c
-index 176d825..68c261a 100644
---- a/kernel/kprobes.c
-+++ b/kernel/kprobes.c
-@@ -183,7 +183,7 @@ static kprobe_opcode_t __kprobes *__get_insn_slot(void)
- * kernel image and loaded module images reside. This is required
- * so x86_64 can correctly handle the %rip-relative fixups.
- */
-- kip->insns = module_alloc(PAGE_SIZE);
-+ kip->insns = module_alloc_exec(PAGE_SIZE);
- if (!kip->insns) {
- kfree(kip);
- return NULL;
-@@ -220,7 +220,7 @@ static int __kprobes collect_one_slot(struct kprobe_insn_page *kip, int idx)
- */
- if (!list_is_singular(&kprobe_insn_pages)) {
- list_del(&kip->list);
-- module_free(NULL, kip->insns);
-+ module_free_exec(NULL, kip->insns);
- kfree(kip);
- }
- return 1;
-@@ -1189,7 +1189,7 @@ static int __init init_kprobes(void)
- {
- int i, err = 0;
- unsigned long offset = 0, size = 0;
-- char *modname, namebuf[128];
-+ char *modname, namebuf[KSYM_NAME_LEN];
- const char *symbol_name;
- void *addr;
- struct kprobe_blackpoint *kb;
-@@ -1264,14 +1264,14 @@ static void __kprobes report_probe(struct seq_file *pi, struct kprobe *p,
- else
- kprobe_type = "k";
- if (sym)
-- seq_printf(pi, "%p %s %s+0x%x %s %s%s\n",
-+ seq_printf(pi, "%pK %s %s+0x%x %s %s%s\n",
- p->addr, kprobe_type, sym, offset,
- (modname ? modname : " "),
- (kprobe_gone(p) ? "[GONE]" : ""),
- ((kprobe_disabled(p) && !kprobe_gone(p)) ?
- "[DISABLED]" : ""));
- else
-- seq_printf(pi, "%p %s %p %s%s\n",
-+ seq_printf(pi, "%pK %s %pK %s%s\n",
- p->addr, kprobe_type, p->addr,
- (kprobe_gone(p) ? "[GONE]" : ""),
- ((kprobe_disabled(p) && !kprobe_gone(p)) ?
-@@ -1304,7 +1304,7 @@ static int __kprobes show_kprobe_addr(struct seq_file *pi, void *v)
- const char *sym = NULL;
- unsigned int i = *(loff_t *) v;
- unsigned long offset = 0;
-- char *modname, namebuf[128];
-+ char *modname, namebuf[KSYM_NAME_LEN];
-
- head = &kprobe_table[i];
- preempt_disable();
-diff --git a/kernel/ksysfs.c b/kernel/ksysfs.c
-index 9cd2b1c..ab201ef 100644
---- a/kernel/ksysfs.c
-+++ b/kernel/ksysfs.c
-@@ -45,6 +45,8 @@ static ssize_t uevent_helper_store(struct kobject *kobj,
- {
- if (count+1 > UEVENT_HELPER_PATH_LEN)
- return -ENOENT;
-+ if (!capable(CAP_SYS_ADMIN))
-+ return -EPERM;
- memcpy(uevent_helper, buf, count);
- uevent_helper[count] = '\0';
- if (count && uevent_helper[count-1] == '\n')
-diff --git a/kernel/lockdep.c b/kernel/lockdep.c
-index d86fe89..d12fc66 100644
---- a/kernel/lockdep.c
-+++ b/kernel/lockdep.c
-@@ -421,20 +421,20 @@ static struct stack_trace lockdep_init_trace = {
- /*
- * Various lockdep statistics:
- */
--atomic_t chain_lookup_hits;
--atomic_t chain_lookup_misses;
--atomic_t hardirqs_on_events;
--atomic_t hardirqs_off_events;
--atomic_t redundant_hardirqs_on;
--atomic_t redundant_hardirqs_off;
--atomic_t softirqs_on_events;
--atomic_t softirqs_off_events;
--atomic_t redundant_softirqs_on;
--atomic_t redundant_softirqs_off;
--atomic_t nr_unused_locks;
--atomic_t nr_cyclic_checks;
--atomic_t nr_find_usage_forwards_checks;
--atomic_t nr_find_usage_backwards_checks;
-+atomic_unchecked_t chain_lookup_hits;
-+atomic_unchecked_t chain_lookup_misses;
-+atomic_unchecked_t hardirqs_on_events;
-+atomic_unchecked_t hardirqs_off_events;
-+atomic_unchecked_t redundant_hardirqs_on;
-+atomic_unchecked_t redundant_hardirqs_off;
-+atomic_unchecked_t softirqs_on_events;
-+atomic_unchecked_t softirqs_off_events;
-+atomic_unchecked_t redundant_softirqs_on;
-+atomic_unchecked_t redundant_softirqs_off;
-+atomic_unchecked_t nr_unused_locks;
-+atomic_unchecked_t nr_cyclic_checks;
-+atomic_unchecked_t nr_find_usage_forwards_checks;
-+atomic_unchecked_t nr_find_usage_backwards_checks;
- #endif
-
- /*
-@@ -577,6 +577,10 @@ static int static_obj(void *obj)
- int i;
- #endif
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+ start = ktla_ktva(start);
-+#endif
-+
- /*
- * static variable?
- */
-@@ -592,8 +596,7 @@ static int static_obj(void *obj)
- */
- for_each_possible_cpu(i) {
- start = (unsigned long) &__per_cpu_start + per_cpu_offset(i);
-- end = (unsigned long) &__per_cpu_start + PERCPU_ENOUGH_ROOM
-- + per_cpu_offset(i);
-+ end = start + PERCPU_ENOUGH_ROOM;
-
- if ((addr >= start) && (addr < end))
- return 1;
-@@ -710,6 +713,7 @@ register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force)
- if (!static_obj(lock->key)) {
- debug_locks_off();
- printk("INFO: trying to register non-static key.\n");
-+ printk("lock:%pS key:%pS.\n", lock, lock->key);
- printk("the code is fine but needs lockdep annotation.\n");
- printk("turning off the locking correctness validator.\n");
- dump_stack();
-@@ -2751,7 +2755,7 @@ static int __lock_acquire(struct lockdep_map *lock, unsigned int subclass,
- if (!class)
- return 0;
- }
-- debug_atomic_inc((atomic_t *)&class->ops);
-+ debug_atomic_inc((atomic_unchecked_t *)&class->ops);
- if (very_verbose(class)) {
- printk("\nacquire class [%p] %s", class->key, class->name);
- if (class->name_version > 1)
-diff --git a/kernel/lockdep_internals.h b/kernel/lockdep_internals.h
-index a2ee95a..092f0f2 100644
---- a/kernel/lockdep_internals.h
-+++ b/kernel/lockdep_internals.h
-@@ -113,26 +113,26 @@ lockdep_count_backward_deps(struct lock_class *class)
- /*
- * Various lockdep statistics:
- */
--extern atomic_t chain_lookup_hits;
--extern atomic_t chain_lookup_misses;
--extern atomic_t hardirqs_on_events;
--extern atomic_t hardirqs_off_events;
--extern atomic_t redundant_hardirqs_on;
--extern atomic_t redundant_hardirqs_off;
--extern atomic_t softirqs_on_events;
--extern atomic_t softirqs_off_events;
--extern atomic_t redundant_softirqs_on;
--extern atomic_t redundant_softirqs_off;
--extern atomic_t nr_unused_locks;
--extern atomic_t nr_cyclic_checks;
--extern atomic_t nr_cyclic_check_recursions;
--extern atomic_t nr_find_usage_forwards_checks;
--extern atomic_t nr_find_usage_forwards_recursions;
--extern atomic_t nr_find_usage_backwards_checks;
--extern atomic_t nr_find_usage_backwards_recursions;
--# define debug_atomic_inc(ptr) atomic_inc(ptr)
--# define debug_atomic_dec(ptr) atomic_dec(ptr)
--# define debug_atomic_read(ptr) atomic_read(ptr)
-+extern atomic_unchecked_t chain_lookup_hits;
-+extern atomic_unchecked_t chain_lookup_misses;
-+extern atomic_unchecked_t hardirqs_on_events;
-+extern atomic_unchecked_t hardirqs_off_events;
-+extern atomic_unchecked_t redundant_hardirqs_on;
-+extern atomic_unchecked_t redundant_hardirqs_off;
-+extern atomic_unchecked_t softirqs_on_events;
-+extern atomic_unchecked_t softirqs_off_events;
-+extern atomic_unchecked_t redundant_softirqs_on;
-+extern atomic_unchecked_t redundant_softirqs_off;
-+extern atomic_unchecked_t nr_unused_locks;
-+extern atomic_unchecked_t nr_cyclic_checks;
-+extern atomic_unchecked_t nr_cyclic_check_recursions;
-+extern atomic_unchecked_t nr_find_usage_forwards_checks;
-+extern atomic_unchecked_t nr_find_usage_forwards_recursions;
-+extern atomic_unchecked_t nr_find_usage_backwards_checks;
-+extern atomic_unchecked_t nr_find_usage_backwards_recursions;
-+# define debug_atomic_inc(ptr) atomic_inc_unchecked(ptr)
-+# define debug_atomic_dec(ptr) atomic_dec_unchecked(ptr)
-+# define debug_atomic_read(ptr) atomic_read_unchecked(ptr)
- #else
- # define debug_atomic_inc(ptr) do { } while (0)
- # define debug_atomic_dec(ptr) do { } while (0)
-diff --git a/kernel/lockdep_proc.c b/kernel/lockdep_proc.c
-index d4aba4f..0bb4763 100644
---- a/kernel/lockdep_proc.c
-+++ b/kernel/lockdep_proc.c
-@@ -39,7 +39,7 @@ static void l_stop(struct seq_file *m, void *v)
-
- static void print_name(struct seq_file *m, struct lock_class *class)
- {
-- char str[128];
-+ char str[KSYM_NAME_LEN];
- const char *name = class->name;
-
- if (!name) {
-@@ -65,7 +65,7 @@ static int l_show(struct seq_file *m, void *v)
- return 0;
- }
-
-- seq_printf(m, "%p", class->key);
-+ seq_printf(m, "%pK", class->key);
- #ifdef CONFIG_DEBUG_LOCKDEP
- seq_printf(m, " OPS:%8ld", class->ops);
- #endif
-@@ -83,7 +83,7 @@ static int l_show(struct seq_file *m, void *v)
-
- list_for_each_entry(entry, &class->locks_after, entry) {
- if (entry->distance == 1) {
-- seq_printf(m, " -> [%p] ", entry->class->key);
-+ seq_printf(m, " -> [%pK] ", entry->class->key);
- print_name(m, entry->class);
- seq_puts(m, "\n");
- }
-@@ -152,7 +152,7 @@ static int lc_show(struct seq_file *m, void *v)
- if (!class->key)
- continue;
-
-- seq_printf(m, "[%p] ", class->key);
-+ seq_printf(m, "[%pK] ", class->key);
- print_name(m, class);
- seq_puts(m, "\n");
- }
-@@ -504,7 +504,7 @@ static void seq_stats(struct seq_file *m, struct lock_stat_data *data)
- seq_line(m, '-', 40-namelen, namelen);
-
- sprint_symbol(sym, class->contention_point[i]);
-- snprintf(ip, sizeof(ip), "[<%p>]",
-+ snprintf(ip, sizeof(ip), "[<%pK>]",
- (void *)class->contention_point[i]);
- seq_printf(m, "%40s %14lu %29s %s\n", name,
- stats->contention_point[i],
-@@ -521,7 +521,7 @@ static void seq_stats(struct seq_file *m, struct lock_stat_data *data)
- seq_line(m, '-', 40-namelen, namelen);
-
- sprint_symbol(sym, class->contending_point[i]);
-- snprintf(ip, sizeof(ip), "[<%p>]",
-+ snprintf(ip, sizeof(ip), "[<%pK>]",
- (void *)class->contending_point[i]);
- seq_printf(m, "%40s %14lu %29s %s\n", name,
- stats->contending_point[i],
-diff --git a/kernel/module.c b/kernel/module.c
-index 4b270e6..ca3d254 100644
---- a/kernel/module.c
-+++ b/kernel/module.c
-@@ -55,6 +55,7 @@
- #include <linux/async.h>
- #include <linux/percpu.h>
- #include <linux/kmemleak.h>
-+#include <linux/grsecurity.h>
-
- #define CREATE_TRACE_POINTS
- #include <trace/events/module.h>
-@@ -89,7 +90,8 @@ static DECLARE_WAIT_QUEUE_HEAD(module_wq);
- static BLOCKING_NOTIFIER_HEAD(module_notify_list);
-
- /* Bounds of module allocation, for speeding __module_address */
--static unsigned long module_addr_min = -1UL, module_addr_max = 0;
-+static unsigned long module_addr_min_rw = -1UL, module_addr_max_rw = 0;
-+static unsigned long module_addr_min_rx = -1UL, module_addr_max_rx = 0;
-
- int register_module_notifier(struct notifier_block * nb)
- {
-@@ -245,7 +247,7 @@ bool each_symbol(bool (*fn)(const struct symsearch *arr, struct module *owner,
- return true;
-
- list_for_each_entry_rcu(mod, &modules, list) {
-- struct symsearch arr[] = {
-+ struct symsearch modarr[] = {
- { mod->syms, mod->syms + mod->num_syms, mod->crcs,
- NOT_GPL_ONLY, false },
- { mod->gpl_syms, mod->gpl_syms + mod->num_gpl_syms,
-@@ -267,7 +269,7 @@ bool each_symbol(bool (*fn)(const struct symsearch *arr, struct module *owner,
- #endif
- };
-
-- if (each_symbol_in_section(arr, ARRAY_SIZE(arr), mod, fn, data))
-+ if (each_symbol_in_section(modarr, ARRAY_SIZE(modarr), mod, fn, data))
- return true;
- }
- return false;
-@@ -442,7 +444,7 @@ static void *percpu_modalloc(unsigned long size, unsigned long align,
- void *ptr;
- int cpu;
-
-- if (align > PAGE_SIZE) {
-+ if (align-1 >= PAGE_SIZE) {
- printk(KERN_WARNING "%s: per-cpu alignment %li > %li\n",
- name, align, PAGE_SIZE);
- align = PAGE_SIZE;
-@@ -1158,7 +1160,7 @@ static const struct kernel_symbol *resolve_symbol(Elf_Shdr *sechdrs,
- * /sys/module/foo/sections stuff
- * J. Corbet <corbet@lwn.net>
- */
--#if defined(CONFIG_KALLSYMS) && defined(CONFIG_SYSFS)
-+#if defined(CONFIG_KALLSYMS) && defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
-
- static inline bool sect_empty(const Elf_Shdr *sect)
- {
-@@ -1545,7 +1547,8 @@ static void free_module(struct module *mod)
- destroy_params(mod->kp, mod->num_kp);
-
- /* This may be NULL, but that's OK */
-- module_free(mod, mod->module_init);
-+ module_free(mod, mod->module_init_rw);
-+ module_free_exec(mod, mod->module_init_rx);
- kfree(mod->args);
- if (mod->percpu)
- percpu_modfree(mod->percpu);
-@@ -1554,10 +1557,12 @@ static void free_module(struct module *mod)
- percpu_modfree(mod->refptr);
- #endif
- /* Free lock-classes: */
-- lockdep_free_key_range(mod->module_core, mod->core_size);
-+ lockdep_free_key_range(mod->module_core_rx, mod->core_size_rx);
-+ lockdep_free_key_range(mod->module_core_rw, mod->core_size_rw);
-
- /* Finally, free the core (containing the module structure) */
-- module_free(mod, mod->module_core);
-+ module_free_exec(mod, mod->module_core_rx);
-+ module_free(mod, mod->module_core_rw);
-
- #ifdef CONFIG_MPU
- update_protections(current->mm);
-@@ -1628,8 +1633,32 @@ static int simplify_symbols(Elf_Shdr *sechdrs,
- unsigned int i, n = sechdrs[symindex].sh_size / sizeof(Elf_Sym);
- int ret = 0;
- const struct kernel_symbol *ksym;
-+#ifdef CONFIG_GRKERNSEC_MODHARDEN
-+ int is_fs_load = 0;
-+ int register_filesystem_found = 0;
-+ char *p;
-+
-+ p = strstr(mod->args, "grsec_modharden_fs");
-+
-+ if (p) {
-+ char *endptr = p + sizeof("grsec_modharden_fs") - 1;
-+ /* copy \0 as well */
-+ memmove(p, endptr, strlen(mod->args) - (unsigned int)(endptr - mod->args) + 1);
-+ is_fs_load = 1;
-+ }
-+#endif
-+
-
- for (i = 1; i < n; i++) {
-+#ifdef CONFIG_GRKERNSEC_MODHARDEN
-+ const char *name = strtab + sym[i].st_name;
-+
-+ /* it's a real shame this will never get ripped and copied
-+ upstream! ;(
-+ */
-+ if (is_fs_load && !strcmp(name, "register_filesystem"))
-+ register_filesystem_found = 1;
-+#endif
- switch (sym[i].st_shndx) {
- case SHN_COMMON:
- /* We compiled with -fno-common. These are not
-@@ -1651,7 +1680,9 @@ static int simplify_symbols(Elf_Shdr *sechdrs,
- strtab + sym[i].st_name, mod);
- /* Ok if resolved. */
- if (ksym) {
-+ pax_open_kernel();
- sym[i].st_value = ksym->value;
-+ pax_close_kernel();
- break;
- }
-
-@@ -1670,11 +1701,20 @@ static int simplify_symbols(Elf_Shdr *sechdrs,
- secbase = (unsigned long)mod->percpu;
- else
- secbase = sechdrs[sym[i].st_shndx].sh_addr;
-+ pax_open_kernel();
- sym[i].st_value += secbase;
-+ pax_close_kernel();
- break;
- }
- }
-
-+#ifdef CONFIG_GRKERNSEC_MODHARDEN
-+ if (is_fs_load && !register_filesystem_found) {
-+ printk(KERN_ALERT "grsec: Denied attempt to load non-fs module %.64s through mount\n", mod->name);
-+ ret = -EPERM;
-+ }
-+#endif
-+
- return ret;
- }
-
-@@ -1731,11 +1771,12 @@ static void layout_sections(struct module *mod,
- || s->sh_entsize != ~0UL
- || strstarts(secstrings + s->sh_name, ".init"))
- continue;
-- s->sh_entsize = get_offset(mod, &mod->core_size, s, i);
-+ if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
-+ s->sh_entsize = get_offset(mod, &mod->core_size_rw, s, i);
-+ else
-+ s->sh_entsize = get_offset(mod, &mod->core_size_rx, s, i);
- DEBUGP("\t%s\n", secstrings + s->sh_name);
- }
-- if (m == 0)
-- mod->core_text_size = mod->core_size;
- }
-
- DEBUGP("Init section allocation order:\n");
-@@ -1748,12 +1789,13 @@ static void layout_sections(struct module *mod,
- || s->sh_entsize != ~0UL
- || !strstarts(secstrings + s->sh_name, ".init"))
- continue;
-- s->sh_entsize = (get_offset(mod, &mod->init_size, s, i)
-- | INIT_OFFSET_MASK);
-+ if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
-+ s->sh_entsize = get_offset(mod, &mod->init_size_rw, s, i);
-+ else
-+ s->sh_entsize = get_offset(mod, &mod->init_size_rx, s, i);
-+ s->sh_entsize |= INIT_OFFSET_MASK;
- DEBUGP("\t%s\n", secstrings + s->sh_name);
- }
-- if (m == 0)
-- mod->init_text_size = mod->init_size;
- }
- }
-
-@@ -1857,9 +1899,8 @@ static int is_exported(const char *name, unsigned long value,
-
- /* As per nm */
- static char elf_type(const Elf_Sym *sym,
-- Elf_Shdr *sechdrs,
-- const char *secstrings,
-- struct module *mod)
-+ const Elf_Shdr *sechdrs,
-+ const char *secstrings)
- {
- if (ELF_ST_BIND(sym->st_info) == STB_WEAK) {
- if (ELF_ST_TYPE(sym->st_info) == STT_OBJECT)
-@@ -1934,7 +1975,7 @@ static unsigned long layout_symtab(struct module *mod,
-
- /* Put symbol section at end of init part of module. */
- symsect->sh_flags |= SHF_ALLOC;
-- symsect->sh_entsize = get_offset(mod, &mod->init_size, symsect,
-+ symsect->sh_entsize = get_offset(mod, &mod->init_size_rx, symsect,
- symindex) | INIT_OFFSET_MASK;
- DEBUGP("\t%s\n", secstrings + symsect->sh_name);
-
-@@ -1951,19 +1992,19 @@ static unsigned long layout_symtab(struct module *mod,
- }
-
- /* Append room for core symbols at end of core part. */
-- symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1);
-- mod->core_size = symoffs + ndst * sizeof(Elf_Sym);
-+ symoffs = ALIGN(mod->core_size_rx, symsect->sh_addralign ?: 1);
-+ mod->core_size_rx = symoffs + ndst * sizeof(Elf_Sym);
-
- /* Put string table section at end of init part of module. */
- strsect->sh_flags |= SHF_ALLOC;
-- strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect,
-+ strsect->sh_entsize = get_offset(mod, &mod->init_size_rx, strsect,
- strindex) | INIT_OFFSET_MASK;
- DEBUGP("\t%s\n", secstrings + strsect->sh_name);
-
- /* Append room for core symbols' strings at end of core part. */
-- *pstroffs = mod->core_size;
-+ *pstroffs = mod->core_size_rx;
- __set_bit(0, strmap);
-- mod->core_size += bitmap_weight(strmap, strsect->sh_size);
-+ mod->core_size_rx += bitmap_weight(strmap, strsect->sh_size);
-
- return symoffs;
- }
-@@ -1987,12 +2028,14 @@ static void add_kallsyms(struct module *mod,
- mod->num_symtab = sechdrs[symindex].sh_size / sizeof(Elf_Sym);
- mod->strtab = (void *)sechdrs[strindex].sh_addr;
-
-+ pax_open_kernel();
-+
- /* Set types up while we still have access to sections. */
- for (i = 0; i < mod->num_symtab; i++)
- mod->symtab[i].st_info
-- = elf_type(&mod->symtab[i], sechdrs, secstrings, mod);
-+ = elf_type(&mod->symtab[i], sechdrs, secstrings);
-
-- mod->core_symtab = dst = mod->module_core + symoffs;
-+ mod->core_symtab = dst = mod->module_core_rx + symoffs;
- src = mod->symtab;
- *dst = *src;
- for (ndst = i = 1; i < mod->num_symtab; ++i, ++src) {
-@@ -2004,10 +2047,12 @@ static void add_kallsyms(struct module *mod,
- }
- mod->core_num_syms = ndst;
-
-- mod->core_strtab = s = mod->module_core + stroffs;
-+ mod->core_strtab = s = mod->module_core_rx + stroffs;
- for (*s = 0, i = 1; i < sechdrs[strindex].sh_size; ++i)
- if (test_bit(i, strmap))
- *++s = mod->strtab[i];
-+
-+ pax_close_kernel();
- }
- #else
- static inline unsigned long layout_symtab(struct module *mod,
-@@ -2044,16 +2089,30 @@ static void dynamic_debug_setup(struct _ddebug *debug, unsigned int num)
- #endif
- }
-
--static void *module_alloc_update_bounds(unsigned long size)
-+static void *module_alloc_update_bounds_rw(unsigned long size)
- {
- void *ret = module_alloc(size);
-
- if (ret) {
- /* Update module bounds. */
-- if ((unsigned long)ret < module_addr_min)
-- module_addr_min = (unsigned long)ret;
-- if ((unsigned long)ret + size > module_addr_max)
-- module_addr_max = (unsigned long)ret + size;
-+ if ((unsigned long)ret < module_addr_min_rw)
-+ module_addr_min_rw = (unsigned long)ret;
-+ if ((unsigned long)ret + size > module_addr_max_rw)
-+ module_addr_max_rw = (unsigned long)ret + size;
-+ }
-+ return ret;
-+}
-+
-+static void *module_alloc_update_bounds_rx(unsigned long size)
-+{
-+ void *ret = module_alloc_exec(size);
-+
-+ if (ret) {
-+ /* Update module bounds. */
-+ if ((unsigned long)ret < module_addr_min_rx)
-+ module_addr_min_rx = (unsigned long)ret;
-+ if ((unsigned long)ret + size > module_addr_max_rx)
-+ module_addr_max_rx = (unsigned long)ret + size;
- }
- return ret;
- }
-@@ -2065,8 +2124,8 @@ static void kmemleak_load_module(struct module *mod, Elf_Ehdr *hdr,
- unsigned int i;
-
- /* only scan the sections containing data */
-- kmemleak_scan_area(mod->module_core, (unsigned long)mod -
-- (unsigned long)mod->module_core,
-+ kmemleak_scan_area(mod->module_core_rw, (unsigned long)mod -
-+ (unsigned long)mod->module_core_rw,
- sizeof(struct module), GFP_KERNEL);
-
- for (i = 1; i < hdr->e_shnum; i++) {
-@@ -2076,8 +2135,8 @@ static void kmemleak_load_module(struct module *mod, Elf_Ehdr *hdr,
- && strncmp(secstrings + sechdrs[i].sh_name, ".bss", 4) != 0)
- continue;
-
-- kmemleak_scan_area(mod->module_core, sechdrs[i].sh_addr -
-- (unsigned long)mod->module_core,
-+ kmemleak_scan_area(mod->module_core_rw, sechdrs[i].sh_addr -
-+ (unsigned long)mod->module_core_rw,
- sechdrs[i].sh_size, GFP_KERNEL);
- }
- }
-@@ -2097,7 +2156,7 @@ static noinline struct module *load_module(void __user *umod,
- Elf_Ehdr *hdr;
- Elf_Shdr *sechdrs;
- char *secstrings, *args, *modmagic, *strtab = NULL;
-- char *staging;
-+ char *staging, *license;
- unsigned int i;
- unsigned int symindex = 0;
- unsigned int strindex = 0;
-@@ -2195,6 +2254,14 @@ static noinline struct module *load_module(void __user *umod,
- goto free_hdr;
- }
-
-+ license = get_modinfo(sechdrs, infoindex, "license");
-+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR
-+ if (!license || !license_is_gpl_compatible(license)) {
-+ err = -ENOEXEC;
-+ goto free_hdr;
-+ }
-+#endif
-+
- modmagic = get_modinfo(sechdrs, infoindex, "vermagic");
- /* This is allowed: modprobe --force will invalidate it. */
- if (!modmagic) {
-@@ -2263,7 +2330,7 @@ static noinline struct module *load_module(void __user *umod,
- secstrings, &stroffs, strmap);
-
- /* Do the allocs. */
-- ptr = module_alloc_update_bounds(mod->core_size);
-+ ptr = module_alloc_update_bounds_rw(mod->core_size_rw);
- /*
- * The pointer to this block is stored in the module structure
- * which is inside the block. Just mark it as not being a
-@@ -2274,23 +2341,47 @@ static noinline struct module *load_module(void __user *umod,
- err = -ENOMEM;
- goto free_percpu;
- }
-- memset(ptr, 0, mod->core_size);
-- mod->module_core = ptr;
-+ memset(ptr, 0, mod->core_size_rw);
-+ mod->module_core_rw = ptr;
-
-- ptr = module_alloc_update_bounds(mod->init_size);
-+ ptr = module_alloc_update_bounds_rw(mod->init_size_rw);
- /*
- * The pointer to this block is stored in the module structure
- * which is inside the block. This block doesn't need to be
- * scanned as it contains data and code that will be freed
- * after the module is initialized.
- */
-- kmemleak_ignore(ptr);
-- if (!ptr && mod->init_size) {
-+ kmemleak_not_leak(ptr);
-+ if (!ptr && mod->init_size_rw) {
- err = -ENOMEM;
-- goto free_core;
-+ goto free_core_rw;
- }
-- memset(ptr, 0, mod->init_size);
-- mod->module_init = ptr;
-+ memset(ptr, 0, mod->init_size_rw);
-+ mod->module_init_rw = ptr;
-+
-+ ptr = module_alloc_update_bounds_rx(mod->core_size_rx);
-+ kmemleak_not_leak(ptr);
-+ if (!ptr) {
-+ err = -ENOMEM;
-+ goto free_init_rw;
-+ }
-+
-+ pax_open_kernel();
-+ memset(ptr, 0, mod->core_size_rx);
-+ pax_close_kernel();
-+ mod->module_core_rx = ptr;
-+
-+ ptr = module_alloc_update_bounds_rx(mod->init_size_rx);
-+ kmemleak_not_leak(ptr);
-+ if (!ptr && mod->init_size_rx) {
-+ err = -ENOMEM;
-+ goto free_core_rx;
-+ }
-+
-+ pax_open_kernel();
-+ memset(ptr, 0, mod->init_size_rx);
-+ pax_close_kernel();
-+ mod->module_init_rx = ptr;
-
- /* Transfer each section which specifies SHF_ALLOC */
- DEBUGP("final section addresses:\n");
-@@ -2300,17 +2391,45 @@ static noinline struct module *load_module(void __user *umod,
- if (!(sechdrs[i].sh_flags & SHF_ALLOC))
- continue;
-
-- if (sechdrs[i].sh_entsize & INIT_OFFSET_MASK)
-- dest = mod->module_init
-- + (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
-- else
-- dest = mod->module_core + sechdrs[i].sh_entsize;
-+ if (sechdrs[i].sh_entsize & INIT_OFFSET_MASK) {
-+ if ((sechdrs[i].sh_flags & SHF_WRITE) || !(sechdrs[i].sh_flags & SHF_ALLOC))
-+ dest = mod->module_init_rw
-+ + (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
-+ else
-+ dest = mod->module_init_rx
-+ + (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
-+ } else {
-+ if ((sechdrs[i].sh_flags & SHF_WRITE) || !(sechdrs[i].sh_flags & SHF_ALLOC))
-+ dest = mod->module_core_rw + sechdrs[i].sh_entsize;
-+ else
-+ dest = mod->module_core_rx + sechdrs[i].sh_entsize;
-+ }
-
-- if (sechdrs[i].sh_type != SHT_NOBITS)
-- memcpy(dest, (void *)sechdrs[i].sh_addr,
-- sechdrs[i].sh_size);
-+ if (sechdrs[i].sh_type != SHT_NOBITS) {
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+#ifdef CONFIG_X86_64
-+ if ((sechdrs[i].sh_flags & SHF_WRITE) && (sechdrs[i].sh_flags & SHF_EXECINSTR))
-+ set_memory_x((unsigned long)dest, (sechdrs[i].sh_size + PAGE_SIZE) >> PAGE_SHIFT);
-+#endif
-+ if (!(sechdrs[i].sh_flags & SHF_WRITE) && (sechdrs[i].sh_flags & SHF_ALLOC)) {
-+ pax_open_kernel();
-+ memcpy(dest, (void *)sechdrs[i].sh_addr, sechdrs[i].sh_size);
-+ pax_close_kernel();
-+ } else
-+#endif
-+
-+ memcpy(dest, (void *)sechdrs[i].sh_addr, sechdrs[i].sh_size);
-+ }
- /* Update sh_addr to point to copy in image. */
-- sechdrs[i].sh_addr = (unsigned long)dest;
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ if (sechdrs[i].sh_flags & SHF_EXECINSTR)
-+ sechdrs[i].sh_addr = ktva_ktla((unsigned long)dest);
-+ else
-+#endif
-+
-+ sechdrs[i].sh_addr = (unsigned long)dest;
- DEBUGP("\t0x%lx %s\n", sechdrs[i].sh_addr, secstrings + sechdrs[i].sh_name);
- }
- /* Module has been moved. */
-@@ -2322,7 +2441,7 @@ static noinline struct module *load_module(void __user *umod,
- mod->name);
- if (!mod->refptr) {
- err = -ENOMEM;
-- goto free_init;
-+ goto free_init_rx;
- }
- #endif
- /* Now we've moved module, initialize linked lists, etc. */
-@@ -2334,7 +2453,7 @@ static noinline struct module *load_module(void __user *umod,
- goto free_unload;
-
- /* Set up license info based on the info section */
-- set_license(mod, get_modinfo(sechdrs, infoindex, "license"));
-+ set_license(mod, license);
-
- /*
- * ndiswrapper is under GPL by itself, but loads proprietary modules.
-@@ -2351,6 +2470,31 @@ static noinline struct module *load_module(void __user *umod,
- /* Set up MODINFO_ATTR fields */
- setup_modinfo(mod, sechdrs, infoindex);
-
-+ mod->args = args;
-+
-+#ifdef CONFIG_GRKERNSEC_MODHARDEN
-+ {
-+ char *p, *p2;
-+
-+ if (strstr(mod->args, "grsec_modharden_netdev")) {
-+ printk(KERN_ALERT "grsec: denied auto-loading kernel module for a network device with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%.64s instead.", mod->name);
-+ err = -EPERM;
-+ goto cleanup;
-+ } else if ((p = strstr(mod->args, "grsec_modharden_normal"))) {
-+ p += sizeof("grsec_modharden_normal") - 1;
-+ p2 = strstr(p, "_");
-+ if (p2) {
-+ *p2 = '\0';
-+ printk(KERN_ALERT "grsec: denied kernel module auto-load of %.64s by uid %.9s\n", mod->name, p);
-+ *p2 = '_';
-+ }
-+ err = -EPERM;
-+ goto cleanup;
-+ }
-+ }
-+#endif
-+
-+
- /* Fix up syms, so that st_value is a pointer to location. */
- err = simplify_symbols(sechdrs, symindex, strtab, versindex, pcpuindex,
- mod);
-@@ -2431,8 +2575,8 @@ static noinline struct module *load_module(void __user *umod,
-
- /* Now do relocations. */
- for (i = 1; i < hdr->e_shnum; i++) {
-- const char *strtab = (char *)sechdrs[strindex].sh_addr;
- unsigned int info = sechdrs[i].sh_info;
-+ strtab = (char *)sechdrs[strindex].sh_addr;
-
- /* Not a valid relocation section? */
- if (info >= hdr->e_shnum)
-@@ -2493,16 +2637,15 @@ static noinline struct module *load_module(void __user *umod,
- * Do it before processing of module parameters, so the module
- * can provide parameter accessor functions of its own.
- */
-- if (mod->module_init)
-- flush_icache_range((unsigned long)mod->module_init,
-- (unsigned long)mod->module_init
-- + mod->init_size);
-- flush_icache_range((unsigned long)mod->module_core,
-- (unsigned long)mod->module_core + mod->core_size);
-+ if (mod->module_init_rx)
-+ flush_icache_range((unsigned long)mod->module_init_rx,
-+ (unsigned long)mod->module_init_rx
-+ + mod->init_size_rx);
-+ flush_icache_range((unsigned long)mod->module_core_rx,
-+ (unsigned long)mod->module_core_rx + mod->core_size_rx);
-
- set_fs(old_fs);
-
-- mod->args = args;
- if (section_addr(hdr, sechdrs, secstrings, "__obsparm"))
- printk(KERN_WARNING "%s: Ignoring obsolete parameters\n",
- mod->name);
-@@ -2546,12 +2689,16 @@ static noinline struct module *load_module(void __user *umod,
- free_unload:
- module_unload_free(mod);
- #if defined(CONFIG_MODULE_UNLOAD) && defined(CONFIG_SMP)
-+ free_init_rx:
- percpu_modfree(mod->refptr);
-- free_init:
- #endif
-- module_free(mod, mod->module_init);
-- free_core:
-- module_free(mod, mod->module_core);
-+ module_free_exec(mod, mod->module_init_rx);
-+ free_core_rx:
-+ module_free_exec(mod, mod->module_core_rx);
-+ free_init_rw:
-+ module_free(mod, mod->module_init_rw);
-+ free_core_rw:
-+ module_free(mod, mod->module_core_rw);
- /* mod will be freed with core. Don't access it beyond this line! */
- free_percpu:
- if (percpu)
-@@ -2653,10 +2800,12 @@ SYSCALL_DEFINE3(init_module, void __user *, umod,
- mod->symtab = mod->core_symtab;
- mod->strtab = mod->core_strtab;
- #endif
-- module_free(mod, mod->module_init);
-- mod->module_init = NULL;
-- mod->init_size = 0;
-- mod->init_text_size = 0;
-+ module_free(mod, mod->module_init_rw);
-+ module_free_exec(mod, mod->module_init_rx);
-+ mod->module_init_rw = NULL;
-+ mod->module_init_rx = NULL;
-+ mod->init_size_rw = 0;
-+ mod->init_size_rx = 0;
- mutex_unlock(&module_mutex);
-
- return 0;
-@@ -2687,10 +2836,16 @@ static const char *get_ksymbol(struct module *mod,
- unsigned long nextval;
-
- /* At worse, next value is at end of module */
-- if (within_module_init(addr, mod))
-- nextval = (unsigned long)mod->module_init+mod->init_text_size;
-+ if (within_module_init_rx(addr, mod))
-+ nextval = (unsigned long)mod->module_init_rx+mod->init_size_rx;
-+ else if (within_module_init_rw(addr, mod))
-+ nextval = (unsigned long)mod->module_init_rw+mod->init_size_rw;
-+ else if (within_module_core_rx(addr, mod))
-+ nextval = (unsigned long)mod->module_core_rx+mod->core_size_rx;
-+ else if (within_module_core_rw(addr, mod))
-+ nextval = (unsigned long)mod->module_core_rw+mod->core_size_rw;
- else
-- nextval = (unsigned long)mod->module_core+mod->core_text_size;
-+ return NULL;
-
- /* Scan for closest preceeding symbol, and next symbol. (ELF
- starts real symbols at 1). */
-@@ -2936,7 +3091,7 @@ static int m_show(struct seq_file *m, void *p)
- char buf[8];
-
- seq_printf(m, "%s %u",
-- mod->name, mod->init_size + mod->core_size);
-+ mod->name, mod->init_size_rx + mod->init_size_rw + mod->core_size_rx + mod->core_size_rw);
- print_unload_info(m, mod);
-
- /* Informative for users. */
-@@ -2945,7 +3100,7 @@ static int m_show(struct seq_file *m, void *p)
- mod->state == MODULE_STATE_COMING ? "Loading":
- "Live");
- /* Used by oprofile and other similar tools. */
-- seq_printf(m, " 0x%p", mod->module_core);
-+ seq_printf(m, " 0x%pP 0x%pP", mod->module_core_rx, mod->module_core_rw);
-
- /* Taints info */
- if (mod->taints)
-@@ -2981,7 +3136,17 @@ static const struct file_operations proc_modules_operations = {
-
- static int __init proc_modules_init(void)
- {
-+#ifndef CONFIG_GRKERNSEC_HIDESYM
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+ proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ proc_create("modules", S_IRUSR | S_IRGRP, NULL, &proc_modules_operations);
-+#else
- proc_create("modules", 0, NULL, &proc_modules_operations);
-+#endif
-+#else
-+ proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
-+#endif
- return 0;
- }
- module_init(proc_modules_init);
-@@ -3040,12 +3205,12 @@ struct module *__module_address(unsigned long addr)
- {
- struct module *mod;
-
-- if (addr < module_addr_min || addr > module_addr_max)
-+ if ((addr < module_addr_min_rx || addr > module_addr_max_rx) &&
-+ (addr < module_addr_min_rw || addr > module_addr_max_rw))
- return NULL;
-
- list_for_each_entry_rcu(mod, &modules, list)
-- if (within_module_core(addr, mod)
-- || within_module_init(addr, mod))
-+ if (within_module_init(addr, mod) || within_module_core(addr, mod))
- return mod;
- return NULL;
- }
-@@ -3079,11 +3244,20 @@ bool is_module_text_address(unsigned long addr)
- */
- struct module *__module_text_address(unsigned long addr)
- {
-- struct module *mod = __module_address(addr);
-+ struct module *mod;
-+
-+#ifdef CONFIG_X86_32
-+ addr = ktla_ktva(addr);
-+#endif
-+
-+ if (addr < module_addr_min_rx || addr > module_addr_max_rx)
-+ return NULL;
-+
-+ mod = __module_address(addr);
-+
- if (mod) {
- /* Make sure it's within the text section. */
-- if (!within(addr, mod->module_init, mod->init_text_size)
-- && !within(addr, mod->module_core, mod->core_text_size))
-+ if (!within_module_init_rx(addr, mod) && !within_module_core_rx(addr, mod))
- mod = NULL;
- }
- return mod;
-diff --git a/kernel/mutex-debug.c b/kernel/mutex-debug.c
-index ec815a9..fe46e99 100644
---- a/kernel/mutex-debug.c
-+++ b/kernel/mutex-debug.c
-@@ -49,21 +49,21 @@ void debug_mutex_free_waiter(struct mutex_waiter *waiter)
- }
-
- void debug_mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter,
-- struct thread_info *ti)
-+ struct task_struct *task)
- {
- SMP_DEBUG_LOCKS_WARN_ON(!spin_is_locked(&lock->wait_lock));
-
- /* Mark the current thread as blocked on the lock: */
-- ti->task->blocked_on = waiter;
-+ task->blocked_on = waiter;
- }
-
- void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
-- struct thread_info *ti)
-+ struct task_struct *task)
- {
- DEBUG_LOCKS_WARN_ON(list_empty(&waiter->list));
-- DEBUG_LOCKS_WARN_ON(waiter->task != ti->task);
-- DEBUG_LOCKS_WARN_ON(ti->task->blocked_on != waiter);
-- ti->task->blocked_on = NULL;
-+ DEBUG_LOCKS_WARN_ON(waiter->task != task);
-+ DEBUG_LOCKS_WARN_ON(task->blocked_on != waiter);
-+ task->blocked_on = NULL;
-
- list_del_init(&waiter->list);
- waiter->task = NULL;
-@@ -75,7 +75,7 @@ void debug_mutex_unlock(struct mutex *lock)
- return;
-
- DEBUG_LOCKS_WARN_ON(lock->magic != lock);
-- DEBUG_LOCKS_WARN_ON(lock->owner != current_thread_info());
-+ DEBUG_LOCKS_WARN_ON(lock->owner != current);
- DEBUG_LOCKS_WARN_ON(!lock->wait_list.prev && !lock->wait_list.next);
- mutex_clear_owner(lock);
- }
-diff --git a/kernel/mutex-debug.h b/kernel/mutex-debug.h
-index 6b2d735..372d3c4 100644
---- a/kernel/mutex-debug.h
-+++ b/kernel/mutex-debug.h
-@@ -20,16 +20,16 @@ extern void debug_mutex_wake_waiter(struct mutex *lock,
- extern void debug_mutex_free_waiter(struct mutex_waiter *waiter);
- extern void debug_mutex_add_waiter(struct mutex *lock,
- struct mutex_waiter *waiter,
-- struct thread_info *ti);
-+ struct task_struct *task);
- extern void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
-- struct thread_info *ti);
-+ struct task_struct *task);
- extern void debug_mutex_unlock(struct mutex *lock);
- extern void debug_mutex_init(struct mutex *lock, const char *name,
- struct lock_class_key *key);
-
- static inline void mutex_set_owner(struct mutex *lock)
- {
-- lock->owner = current_thread_info();
-+ lock->owner = current;
- }
-
- static inline void mutex_clear_owner(struct mutex *lock)
-diff --git a/kernel/mutex.c b/kernel/mutex.c
-index f85644c..5ee9f77 100644
---- a/kernel/mutex.c
-+++ b/kernel/mutex.c
-@@ -169,7 +169,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
- */
-
- for (;;) {
-- struct thread_info *owner;
-+ struct task_struct *owner;
-
- /*
- * If we own the BKL, then don't spin. The owner of
-@@ -214,7 +214,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
- spin_lock_mutex(&lock->wait_lock, flags);
-
- debug_mutex_lock_common(lock, &waiter);
-- debug_mutex_add_waiter(lock, &waiter, task_thread_info(task));
-+ debug_mutex_add_waiter(lock, &waiter, task);
-
- /* add waiting tasks to the end of the waitqueue (FIFO): */
- list_add_tail(&waiter.list, &lock->wait_list);
-@@ -243,8 +243,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
- * TASK_UNINTERRUPTIBLE case.)
- */
- if (unlikely(signal_pending_state(state, task))) {
-- mutex_remove_waiter(lock, &waiter,
-- task_thread_info(task));
-+ mutex_remove_waiter(lock, &waiter, task);
- mutex_release(&lock->dep_map, 1, ip);
- spin_unlock_mutex(&lock->wait_lock, flags);
-
-@@ -265,7 +264,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
- done:
- lock_acquired(&lock->dep_map, ip);
- /* got the lock - rejoice! */
-- mutex_remove_waiter(lock, &waiter, current_thread_info());
-+ mutex_remove_waiter(lock, &waiter, task);
- mutex_set_owner(lock);
-
- /* set it to 0 if there are no waiters left: */
-diff --git a/kernel/mutex.h b/kernel/mutex.h
-index 67578ca..4115fbf 100644
---- a/kernel/mutex.h
-+++ b/kernel/mutex.h
-@@ -19,7 +19,7 @@
- #ifdef CONFIG_SMP
- static inline void mutex_set_owner(struct mutex *lock)
- {
-- lock->owner = current_thread_info();
-+ lock->owner = current;
- }
-
- static inline void mutex_clear_owner(struct mutex *lock)
-diff --git a/kernel/notifier.c b/kernel/notifier.c
-index 61d5aa5..451d460 100644
---- a/kernel/notifier.c
-+++ b/kernel/notifier.c
-@@ -5,6 +5,7 @@
- #include <linux/rcupdate.h>
- #include <linux/vmalloc.h>
- #include <linux/reboot.h>
-+#include <linux/mm.h>
-
- /*
- * Notifier list for kernel code which wants to be called
-@@ -24,10 +25,12 @@ static int notifier_chain_register(struct notifier_block **nl,
- while ((*nl) != NULL) {
- if (n->priority > (*nl)->priority)
- break;
-- nl = &((*nl)->next);
-+ nl = (struct notifier_block **)&((*nl)->next);
- }
-- n->next = *nl;
-+ pax_open_kernel();
-+ *(const void **)&n->next = *nl;
- rcu_assign_pointer(*nl, n);
-+ pax_close_kernel();
- return 0;
- }
-
-@@ -39,10 +42,12 @@ static int notifier_chain_cond_register(struct notifier_block **nl,
- return 0;
- if (n->priority > (*nl)->priority)
- break;
-- nl = &((*nl)->next);
-+ nl = (struct notifier_block **)&((*nl)->next);
- }
-- n->next = *nl;
-+ pax_open_kernel();
-+ *(const void **)&n->next = *nl;
- rcu_assign_pointer(*nl, n);
-+ pax_close_kernel();
- return 0;
- }
-
-@@ -51,10 +56,12 @@ static int notifier_chain_unregister(struct notifier_block **nl,
- {
- while ((*nl) != NULL) {
- if ((*nl) == n) {
-+ pax_open_kernel();
- rcu_assign_pointer(*nl, n->next);
-+ pax_close_kernel();
- return 0;
- }
-- nl = &((*nl)->next);
-+ nl = (struct notifier_block **)&((*nl)->next);
- }
- return -ENOENT;
- }
-diff --git a/kernel/panic.c b/kernel/panic.c
-index 96b45d0..98fb1c3 100644
---- a/kernel/panic.c
-+++ b/kernel/panic.c
-@@ -59,6 +59,14 @@ NORET_TYPE void panic(const char * fmt, ...)
- long i;
-
- /*
-+ * Disable local interrupts. This will prevent panic_smp_self_stop
-+ * from deadlocking the first cpu that invokes the panic, since
-+ * there is nothing to prevent an interrupt handler (that runs
-+ * after the panic_lock is acquired) from invoking panic again.
-+ */
-+ local_irq_disable();
-+
-+ /*
- * It's possible to come here directly from a panic-assertion and
- * not have preempt disabled. Some functions called from here want
- * preempt to be disabled. No point enabling it later though...
-@@ -71,7 +79,11 @@ NORET_TYPE void panic(const char * fmt, ...)
- va_end(args);
- printk(KERN_EMERG "Kernel panic - not syncing: %s\n",buf);
- #ifdef CONFIG_DEBUG_BUGVERBOSE
-- dump_stack();
-+ /*
-+ * Avoid nested stack-dumping if a panic occurs during oops processing
-+ */
-+ if (!test_taint(TAINT_DIE) && oops_in_progress <= 1)
-+ dump_stack();
- #endif
-
- /*
-@@ -352,7 +364,7 @@ static void warn_slowpath_common(const char *file, int line, void *caller, struc
- const char *board;
-
- printk(KERN_WARNING "------------[ cut here ]------------\n");
-- printk(KERN_WARNING "WARNING: at %s:%d %pS()\n", file, line, caller);
-+ printk(KERN_WARNING "WARNING: at %s:%d %pA()\n", file, line, caller);
- board = dmi_get_system_info(DMI_PRODUCT_NAME);
- if (board)
- printk(KERN_WARNING "Hardware name: %s\n", board);
-@@ -392,7 +404,8 @@ EXPORT_SYMBOL(warn_slowpath_null);
- */
- void __stack_chk_fail(void)
- {
-- panic("stack-protector: Kernel stack is corrupted in: %p\n",
-+ dump_stack();
-+ panic("stack-protector: Kernel stack is corrupted in: %pA\n",
- __builtin_return_address(0));
- }
- EXPORT_SYMBOL(__stack_chk_fail);
-diff --git a/kernel/params.c b/kernel/params.c
-index d656c27..21e452c 100644
---- a/kernel/params.c
-+++ b/kernel/params.c
-@@ -725,7 +725,7 @@ static ssize_t module_attr_store(struct kobject *kobj,
- return ret;
- }
-
--static struct sysfs_ops module_sysfs_ops = {
-+static const struct sysfs_ops module_sysfs_ops = {
- .show = module_attr_show,
- .store = module_attr_store,
- };
-@@ -739,7 +739,7 @@ static int uevent_filter(struct kset *kset, struct kobject *kobj)
- return 0;
- }
-
--static struct kset_uevent_ops module_uevent_ops = {
-+static const struct kset_uevent_ops module_uevent_ops = {
- .filter = uevent_filter,
- };
-
-diff --git a/kernel/perf_event.c b/kernel/perf_event.c
-index 37ebc14..9c121d9 100644
---- a/kernel/perf_event.c
-+++ b/kernel/perf_event.c
-@@ -77,7 +77,7 @@ int sysctl_perf_event_mlock __read_mostly = 516; /* 'free' kb per user */
- */
- int sysctl_perf_event_sample_rate __read_mostly = 100000;
-
--static atomic64_t perf_event_id;
-+static atomic64_unchecked_t perf_event_id;
-
- /*
- * Lock for (sysadmin-configurable) event reservations:
-@@ -1094,9 +1094,9 @@ static void __perf_event_sync_stat(struct perf_event *event,
- * In order to keep per-task stats reliable we need to flip the event
- * values when we flip the contexts.
- */
-- value = atomic64_read(&next_event->count);
-- value = atomic64_xchg(&event->count, value);
-- atomic64_set(&next_event->count, value);
-+ value = atomic64_read_unchecked(&next_event->count);
-+ value = atomic64_xchg_unchecked(&event->count, value);
-+ atomic64_set_unchecked(&next_event->count, value);
-
- swap(event->total_time_enabled, next_event->total_time_enabled);
- swap(event->total_time_running, next_event->total_time_running);
-@@ -1552,7 +1552,7 @@ static u64 perf_event_read(struct perf_event *event)
- update_event_times(event);
- }
-
-- return atomic64_read(&event->count);
-+ return atomic64_read_unchecked(&event->count);
- }
-
- /*
-@@ -1790,11 +1790,11 @@ static int perf_event_read_group(struct perf_event *event,
- values[n++] = 1 + leader->nr_siblings;
- if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
- values[n++] = leader->total_time_enabled +
-- atomic64_read(&leader->child_total_time_enabled);
-+ atomic64_read_unchecked(&leader->child_total_time_enabled);
- }
- if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
- values[n++] = leader->total_time_running +
-- atomic64_read(&leader->child_total_time_running);
-+ atomic64_read_unchecked(&leader->child_total_time_running);
- }
-
- size = n * sizeof(u64);
-@@ -1829,11 +1829,11 @@ static int perf_event_read_one(struct perf_event *event,
- values[n++] = perf_event_read_value(event);
- if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
- values[n++] = event->total_time_enabled +
-- atomic64_read(&event->child_total_time_enabled);
-+ atomic64_read_unchecked(&event->child_total_time_enabled);
- }
- if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
- values[n++] = event->total_time_running +
-- atomic64_read(&event->child_total_time_running);
-+ atomic64_read_unchecked(&event->child_total_time_running);
- }
- if (read_format & PERF_FORMAT_ID)
- values[n++] = primary_event_id(event);
-@@ -1903,7 +1903,7 @@ static unsigned int perf_poll(struct file *file, poll_table *wait)
- static void perf_event_reset(struct perf_event *event)
- {
- (void)perf_event_read(event);
-- atomic64_set(&event->count, 0);
-+ atomic64_set_unchecked(&event->count, 0);
- perf_event_update_userpage(event);
- }
-
-@@ -2079,15 +2079,15 @@ void perf_event_update_userpage(struct perf_event *event)
- ++userpg->lock;
- barrier();
- userpg->index = perf_event_index(event);
-- userpg->offset = atomic64_read(&event->count);
-+ userpg->offset = atomic64_read_unchecked(&event->count);
- if (event->state == PERF_EVENT_STATE_ACTIVE)
-- userpg->offset -= atomic64_read(&event->hw.prev_count);
-+ userpg->offset -= atomic64_read_unchecked(&event->hw.prev_count);
-
- userpg->time_enabled = event->total_time_enabled +
-- atomic64_read(&event->child_total_time_enabled);
-+ atomic64_read_unchecked(&event->child_total_time_enabled);
-
- userpg->time_running = event->total_time_running +
-- atomic64_read(&event->child_total_time_running);
-+ atomic64_read_unchecked(&event->child_total_time_running);
-
- barrier();
- ++userpg->lock;
-@@ -2903,14 +2903,14 @@ static void perf_output_read_one(struct perf_output_handle *handle,
- u64 values[4];
- int n = 0;
-
-- values[n++] = atomic64_read(&event->count);
-+ values[n++] = atomic64_read_unchecked(&event->count);
- if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
- values[n++] = event->total_time_enabled +
-- atomic64_read(&event->child_total_time_enabled);
-+ atomic64_read_unchecked(&event->child_total_time_enabled);
- }
- if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
- values[n++] = event->total_time_running +
-- atomic64_read(&event->child_total_time_running);
-+ atomic64_read_unchecked(&event->child_total_time_running);
- }
- if (read_format & PERF_FORMAT_ID)
- values[n++] = primary_event_id(event);
-@@ -2940,7 +2940,7 @@ static void perf_output_read_group(struct perf_output_handle *handle,
- if (leader != event)
- leader->pmu->read(leader);
-
-- values[n++] = atomic64_read(&leader->count);
-+ values[n++] = atomic64_read_unchecked(&leader->count);
- if (read_format & PERF_FORMAT_ID)
- values[n++] = primary_event_id(leader);
-
-@@ -2952,7 +2952,7 @@ static void perf_output_read_group(struct perf_output_handle *handle,
- if (sub != event)
- sub->pmu->read(sub);
-
-- values[n++] = atomic64_read(&sub->count);
-+ values[n++] = atomic64_read_unchecked(&sub->count);
- if (read_format & PERF_FORMAT_ID)
- values[n++] = primary_event_id(sub);
-
-@@ -3525,12 +3525,12 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event)
- * need to add enough zero bytes after the string to handle
- * the 64bit alignment we do later.
- */
-- buf = kzalloc(PATH_MAX + sizeof(u64), GFP_KERNEL);
-+ buf = kzalloc(PATH_MAX, GFP_KERNEL);
- if (!buf) {
- name = strncpy(tmp, "//enomem", sizeof(tmp));
- goto got_name;
- }
-- name = d_path(&file->f_path, buf, PATH_MAX);
-+ name = d_path(&file->f_path, buf, PATH_MAX - sizeof(u64));
- if (IS_ERR(name)) {
- name = strncpy(tmp, "//toolong", sizeof(tmp));
- goto got_name;
-@@ -3783,7 +3783,7 @@ static void perf_swevent_add(struct perf_event *event, u64 nr,
- {
- struct hw_perf_event *hwc = &event->hw;
-
-- atomic64_add(nr, &event->count);
-+ atomic64_add_unchecked(nr, &event->count);
-
- if (!hwc->sample_period)
- return;
-@@ -4040,9 +4040,9 @@ static void cpu_clock_perf_event_update(struct perf_event *event)
- u64 now;
-
- now = cpu_clock(cpu);
-- prev = atomic64_read(&event->hw.prev_count);
-- atomic64_set(&event->hw.prev_count, now);
-- atomic64_add(now - prev, &event->count);
-+ prev = atomic64_read_unchecked(&event->hw.prev_count);
-+ atomic64_set_unchecked(&event->hw.prev_count, now);
-+ atomic64_add_unchecked(now - prev, &event->count);
- }
-
- static int cpu_clock_perf_event_enable(struct perf_event *event)
-@@ -4050,7 +4050,7 @@ static int cpu_clock_perf_event_enable(struct perf_event *event)
- struct hw_perf_event *hwc = &event->hw;
- int cpu = raw_smp_processor_id();
-
-- atomic64_set(&hwc->prev_count, cpu_clock(cpu));
-+ atomic64_set_unchecked(&hwc->prev_count, cpu_clock(cpu));
- perf_swevent_start_hrtimer(event);
-
- return 0;
-@@ -4082,9 +4082,9 @@ static void task_clock_perf_event_update(struct perf_event *event, u64 now)
- u64 prev;
- s64 delta;
-
-- prev = atomic64_xchg(&event->hw.prev_count, now);
-+ prev = atomic64_xchg_unchecked(&event->hw.prev_count, now);
- delta = now - prev;
-- atomic64_add(delta, &event->count);
-+ atomic64_add_unchecked(delta, &event->count);
- }
-
- static int task_clock_perf_event_enable(struct perf_event *event)
-@@ -4094,7 +4094,7 @@ static int task_clock_perf_event_enable(struct perf_event *event)
-
- now = event->ctx->time;
-
-- atomic64_set(&hwc->prev_count, now);
-+ atomic64_set_unchecked(&hwc->prev_count, now);
-
- perf_swevent_start_hrtimer(event);
-
-@@ -4289,7 +4289,7 @@ perf_event_alloc(struct perf_event_attr *attr,
- event->parent = parent_event;
-
- event->ns = get_pid_ns(current->nsproxy->pid_ns);
-- event->id = atomic64_inc_return(&perf_event_id);
-+ event->id = atomic64_inc_return_unchecked(&perf_event_id);
-
- event->state = PERF_EVENT_STATE_INACTIVE;
-
-@@ -4720,15 +4720,15 @@ static void sync_child_event(struct perf_event *child_event,
- if (child_event->attr.inherit_stat)
- perf_event_read_event(child_event, child);
-
-- child_val = atomic64_read(&child_event->count);
-+ child_val = atomic64_read_unchecked(&child_event->count);
-
- /*
- * Add back the child's count to the parent's count:
- */
-- atomic64_add(child_val, &parent_event->count);
-- atomic64_add(child_event->total_time_enabled,
-+ atomic64_add_unchecked(child_val, &parent_event->count);
-+ atomic64_add_unchecked(child_event->total_time_enabled,
- &parent_event->child_total_time_enabled);
-- atomic64_add(child_event->total_time_running,
-+ atomic64_add_unchecked(child_event->total_time_running,
- &parent_event->child_total_time_running);
-
- /*
-diff --git a/kernel/pid.c b/kernel/pid.c
-index fce7198..4f23a7e 100644
---- a/kernel/pid.c
-+++ b/kernel/pid.c
-@@ -33,6 +33,7 @@
- #include <linux/rculist.h>
- #include <linux/bootmem.h>
- #include <linux/hash.h>
-+#include <linux/security.h>
- #include <linux/pid_namespace.h>
- #include <linux/init_task.h>
- #include <linux/syscalls.h>
-@@ -45,7 +46,7 @@ struct pid init_struct_pid = INIT_STRUCT_PID;
-
- int pid_max = PID_MAX_DEFAULT;
-
--#define RESERVED_PIDS 300
-+#define RESERVED_PIDS 500
-
- int pid_max_min = RESERVED_PIDS + 1;
- int pid_max_max = PID_MAX_LIMIT;
-@@ -383,7 +384,14 @@ EXPORT_SYMBOL(pid_task);
- */
- struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
- {
-- return pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
-+ struct task_struct *task;
-+
-+ task = pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
-+
-+ if (gr_pid_is_chrooted(task))
-+ return NULL;
-+
-+ return task;
- }
-
- struct task_struct *find_task_by_vpid(pid_t vnr)
-@@ -391,6 +399,11 @@ struct task_struct *find_task_by_vpid(pid_t vnr)
- return find_task_by_pid_ns(vnr, current->nsproxy->pid_ns);
- }
-
-+struct task_struct *find_task_by_vpid_unrestricted(pid_t vnr)
-+{
-+ return pid_task(find_pid_ns(vnr, current->nsproxy->pid_ns), PIDTYPE_PID);
-+}
-+
- struct pid *get_task_pid(struct task_struct *task, enum pid_type type)
- {
- struct pid *pid;
-diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c
-index 5c9dc22..7652dca 100644
---- a/kernel/posix-cpu-timers.c
-+++ b/kernel/posix-cpu-timers.c
-@@ -6,9 +6,11 @@
- #include <linux/posix-timers.h>
- #include <linux/errno.h>
- #include <linux/math64.h>
-+#include <linux/security.h>
- #include <asm/uaccess.h>
- #include <linux/kernel_stat.h>
- #include <trace/events/timer.h>
-+#include <linux/random.h>
-
- /*
- * Called after updating RLIMIT_CPU to set timer expiration if necessary.
-@@ -516,6 +518,8 @@ static void cleanup_timers(struct list_head *head,
- */
- void posix_cpu_timers_exit(struct task_struct *tsk)
- {
-+ add_device_randomness((const void*) &tsk->se.sum_exec_runtime,
-+ sizeof(unsigned long long));
- cleanup_timers(tsk->cpu_timers,
- tsk->utime, tsk->stime, tsk->se.sum_exec_runtime);
-
-@@ -1697,7 +1701,7 @@ static long thread_cpu_nsleep_restart(struct restart_block *restart_block)
-
- static __init int init_posix_cpu_timers(void)
- {
-- struct k_clock process = {
-+ static struct k_clock process = {
- .clock_getres = process_cpu_clock_getres,
- .clock_get = process_cpu_clock_get,
- .clock_set = do_posix_clock_nosettime,
-@@ -1705,7 +1709,7 @@ static __init int init_posix_cpu_timers(void)
- .nsleep = process_cpu_nsleep,
- .nsleep_restart = process_cpu_nsleep_restart,
- };
-- struct k_clock thread = {
-+ static struct k_clock thread = {
- .clock_getres = thread_cpu_clock_getres,
- .clock_get = thread_cpu_clock_get,
- .clock_set = do_posix_clock_nosettime,
-diff --git a/kernel/posix-timers.c b/kernel/posix-timers.c
-index 5e76d22..f2d062c 100644
---- a/kernel/posix-timers.c
-+++ b/kernel/posix-timers.c
-@@ -42,6 +42,7 @@
- #include <linux/compiler.h>
- #include <linux/idr.h>
- #include <linux/posix-timers.h>
-+#include <linux/grsecurity.h>
- #include <linux/syscalls.h>
- #include <linux/wait.h>
- #include <linux/workqueue.h>
-@@ -131,7 +132,7 @@ static DEFINE_SPINLOCK(idr_lock);
- * which we beg off on and pass to do_sys_settimeofday().
- */
-
--static struct k_clock posix_clocks[MAX_CLOCKS];
-+static struct k_clock *posix_clocks[MAX_CLOCKS];
-
- /*
- * These ones are defined below.
-@@ -157,8 +158,8 @@ static inline void unlock_timer(struct k_itimer *timr, unsigned long flags)
- */
- #define CLOCK_DISPATCH(clock, call, arglist) \
- ((clock) < 0 ? posix_cpu_##call arglist : \
-- (posix_clocks[clock].call != NULL \
-- ? (*posix_clocks[clock].call) arglist : common_##call arglist))
-+ (posix_clocks[clock]->call != NULL \
-+ ? (*posix_clocks[clock]->call) arglist : common_##call arglist))
-
- /*
- * Default clock hook functions when the struct k_clock passed
-@@ -172,7 +173,7 @@ static inline int common_clock_getres(const clockid_t which_clock,
- struct timespec *tp)
- {
- tp->tv_sec = 0;
-- tp->tv_nsec = posix_clocks[which_clock].res;
-+ tp->tv_nsec = posix_clocks[which_clock]->res;
- return 0;
- }
-
-@@ -217,9 +218,11 @@ static inline int invalid_clockid(const clockid_t which_clock)
- return 0;
- if ((unsigned) which_clock >= MAX_CLOCKS)
- return 1;
-- if (posix_clocks[which_clock].clock_getres != NULL)
-+ if (posix_clocks[which_clock] == NULL)
-+ return 1;
-+ if (posix_clocks[which_clock]->clock_getres != NULL)
- return 0;
-- if (posix_clocks[which_clock].res != 0)
-+ if (posix_clocks[which_clock]->res != 0)
- return 0;
- return 1;
- }
-@@ -266,29 +269,29 @@ int posix_get_coarse_res(const clockid_t which_clock, struct timespec *tp)
- */
- static __init int init_posix_timers(void)
- {
-- struct k_clock clock_realtime = {
-+ static struct k_clock clock_realtime = {
- .clock_getres = hrtimer_get_res,
- };
-- struct k_clock clock_monotonic = {
-+ static struct k_clock clock_monotonic = {
- .clock_getres = hrtimer_get_res,
- .clock_get = posix_ktime_get_ts,
- .clock_set = do_posix_clock_nosettime,
- };
-- struct k_clock clock_monotonic_raw = {
-+ static struct k_clock clock_monotonic_raw = {
- .clock_getres = hrtimer_get_res,
- .clock_get = posix_get_monotonic_raw,
- .clock_set = do_posix_clock_nosettime,
- .timer_create = no_timer_create,
- .nsleep = no_nsleep,
- };
-- struct k_clock clock_realtime_coarse = {
-+ static struct k_clock clock_realtime_coarse = {
- .clock_getres = posix_get_coarse_res,
- .clock_get = posix_get_realtime_coarse,
- .clock_set = do_posix_clock_nosettime,
- .timer_create = no_timer_create,
- .nsleep = no_nsleep,
- };
-- struct k_clock clock_monotonic_coarse = {
-+ static struct k_clock clock_monotonic_coarse = {
- .clock_getres = posix_get_coarse_res,
- .clock_get = posix_get_monotonic_coarse,
- .clock_set = do_posix_clock_nosettime,
-@@ -296,6 +299,8 @@ static __init int init_posix_timers(void)
- .nsleep = no_nsleep,
- };
-
-+ pax_track_stack();
-+
- register_posix_clock(CLOCK_REALTIME, &clock_realtime);
- register_posix_clock(CLOCK_MONOTONIC, &clock_monotonic);
- register_posix_clock(CLOCK_MONOTONIC_RAW, &clock_monotonic_raw);
-@@ -484,7 +489,7 @@ void register_posix_clock(const clockid_t clock_id, struct k_clock *new_clock)
- return;
- }
-
-- posix_clocks[clock_id] = *new_clock;
-+ posix_clocks[clock_id] = new_clock;
- }
- EXPORT_SYMBOL_GPL(register_posix_clock);
-
-@@ -948,6 +953,13 @@ SYSCALL_DEFINE2(clock_settime, const clockid_t, which_clock,
- if (copy_from_user(&new_tp, tp, sizeof (*tp)))
- return -EFAULT;
-
-+ /* only the CLOCK_REALTIME clock can be set, all other clocks
-+ have their clock_set fptr set to a nosettime dummy function
-+ CLOCK_REALTIME has a NULL clock_set fptr which causes it to
-+ call common_clock_set, which calls do_sys_settimeofday, which
-+ we hook
-+ */
-+
- return CLOCK_DISPATCH(which_clock, clock_set, (which_clock, &new_tp));
- }
-
-diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
-index 04a9e90..bc355aa 100644
---- a/kernel/power/hibernate.c
-+++ b/kernel/power/hibernate.c
-@@ -48,14 +48,14 @@ enum {
-
- static int hibernation_mode = HIBERNATION_SHUTDOWN;
-
--static struct platform_hibernation_ops *hibernation_ops;
-+static const struct platform_hibernation_ops *hibernation_ops;
-
- /**
- * hibernation_set_ops - set the global hibernate operations
- * @ops: the hibernation operations to use in subsequent hibernation transitions
- */
-
--void hibernation_set_ops(struct platform_hibernation_ops *ops)
-+void hibernation_set_ops(const struct platform_hibernation_ops *ops)
- {
- if (ops && !(ops->begin && ops->end && ops->pre_snapshot
- && ops->prepare && ops->finish && ops->enter && ops->pre_restore
-diff --git a/kernel/power/poweroff.c b/kernel/power/poweroff.c
-index e8b3370..484c2e4 100644
---- a/kernel/power/poweroff.c
-+++ b/kernel/power/poweroff.c
-@@ -37,7 +37,7 @@ static struct sysrq_key_op sysrq_poweroff_op = {
- .enable_mask = SYSRQ_ENABLE_BOOT,
- };
-
--static int pm_sysrq_init(void)
-+static int __init pm_sysrq_init(void)
- {
- register_sysrq_key('o', &sysrq_poweroff_op);
- return 0;
-diff --git a/kernel/power/process.c b/kernel/power/process.c
-index e7cd671..56d5f459 100644
---- a/kernel/power/process.c
-+++ b/kernel/power/process.c
-@@ -37,12 +37,15 @@ static int try_to_freeze_tasks(bool sig_only)
- struct timeval start, end;
- u64 elapsed_csecs64;
- unsigned int elapsed_csecs;
-+ bool timedout = false;
-
- do_gettimeofday(&start);
-
- end_time = jiffies + TIMEOUT;
- do {
- todo = 0;
-+ if (time_after(jiffies, end_time))
-+ timedout = true;
- read_lock(&tasklist_lock);
- do_each_thread(g, p) {
- if (frozen(p) || !freezeable(p))
-@@ -57,15 +60,17 @@ static int try_to_freeze_tasks(bool sig_only)
- * It is "frozen enough". If the task does wake
- * up, it will immediately call try_to_freeze.
- */
-- if (!task_is_stopped_or_traced(p) &&
-- !freezer_should_skip(p))
-+ if (!task_is_stopped_or_traced(p) && !freezer_should_skip(p)) {
- todo++;
-+ if (timedout) {
-+ printk(KERN_ERR "Task refusing to freeze:\n");
-+ sched_show_task(p);
-+ }
-+ }
- } while_each_thread(g, p);
- read_unlock(&tasklist_lock);
- yield(); /* Yield is okay here */
-- if (time_after(jiffies, end_time))
-- break;
-- } while (todo);
-+ } while (todo && !timedout);
-
- do_gettimeofday(&end);
- elapsed_csecs64 = timeval_to_ns(&end) - timeval_to_ns(&start);
-diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c
-index 40dd021..fb30ceb 100644
---- a/kernel/power/suspend.c
-+++ b/kernel/power/suspend.c
-@@ -23,13 +23,13 @@ const char *const pm_states[PM_SUSPEND_MAX] = {
- [PM_SUSPEND_MEM] = "mem",
- };
-
--static struct platform_suspend_ops *suspend_ops;
-+static const struct platform_suspend_ops *suspend_ops;
-
- /**
- * suspend_set_ops - Set the global suspend method table.
- * @ops: Pointer to ops structure.
- */
--void suspend_set_ops(struct platform_suspend_ops *ops)
-+void suspend_set_ops(const struct platform_suspend_ops *ops)
- {
- mutex_lock(&pm_mutex);
- suspend_ops = ops;
-diff --git a/kernel/printk.c b/kernel/printk.c
-index 4cade47..4ddd097 100644
---- a/kernel/printk.c
-+++ b/kernel/printk.c
-@@ -33,6 +33,7 @@
- #include <linux/bootmem.h>
- #include <linux/syscalls.h>
- #include <linux/kexec.h>
-+#include <linux/syslog.h>
-
- #include <asm/uaccess.h>
-
-@@ -256,38 +257,30 @@ static inline void boot_delay_msec(void)
- }
- #endif
-
--/*
-- * Commands to do_syslog:
-- *
-- * 0 -- Close the log. Currently a NOP.
-- * 1 -- Open the log. Currently a NOP.
-- * 2 -- Read from the log.
-- * 3 -- Read all messages remaining in the ring buffer.
-- * 4 -- Read and clear all messages remaining in the ring buffer
-- * 5 -- Clear ring buffer.
-- * 6 -- Disable printk's to console
-- * 7 -- Enable printk's to console
-- * 8 -- Set level of messages printed to console
-- * 9 -- Return number of unread characters in the log buffer
-- * 10 -- Return size of the log buffer
-- */
--int do_syslog(int type, char __user *buf, int len)
-+int do_syslog(int type, char __user *buf, int len, bool from_file)
- {
- unsigned i, j, limit, count;
- int do_clear = 0;
- char c;
- int error = 0;
-
-- error = security_syslog(type);
-+#ifdef CONFIG_GRKERNSEC_DMESG
-+ if (grsec_enable_dmesg &&
-+ (!from_file || (from_file && type == SYSLOG_ACTION_OPEN)) &&
-+ !capable(CAP_SYS_ADMIN))
-+ return -EPERM;
-+#endif
-+
-+ error = security_syslog(type, from_file);
- if (error)
- return error;
-
- switch (type) {
-- case 0: /* Close log */
-+ case SYSLOG_ACTION_CLOSE: /* Close log */
- break;
-- case 1: /* Open log */
-+ case SYSLOG_ACTION_OPEN: /* Open log */
- break;
-- case 2: /* Read from log */
-+ case SYSLOG_ACTION_READ: /* Read from log */
- error = -EINVAL;
- if (!buf || len < 0)
- goto out;
-@@ -318,10 +311,12 @@ int do_syslog(int type, char __user *buf, int len)
- if (!error)
- error = i;
- break;
-- case 4: /* Read/clear last kernel messages */
-+ /* Read/clear last kernel messages */
-+ case SYSLOG_ACTION_READ_CLEAR:
- do_clear = 1;
- /* FALL THRU */
-- case 3: /* Read last kernel messages */
-+ /* Read last kernel messages */
-+ case SYSLOG_ACTION_READ_ALL:
- error = -EINVAL;
- if (!buf || len < 0)
- goto out;
-@@ -374,21 +369,25 @@ int do_syslog(int type, char __user *buf, int len)
- }
- }
- break;
-- case 5: /* Clear ring buffer */
-+ /* Clear ring buffer */
-+ case SYSLOG_ACTION_CLEAR:
- logged_chars = 0;
- break;
-- case 6: /* Disable logging to console */
-+ /* Disable logging to console */
-+ case SYSLOG_ACTION_CONSOLE_OFF:
- if (saved_console_loglevel == -1)
- saved_console_loglevel = console_loglevel;
- console_loglevel = minimum_console_loglevel;
- break;
-- case 7: /* Enable logging to console */
-+ /* Enable logging to console */
-+ case SYSLOG_ACTION_CONSOLE_ON:
- if (saved_console_loglevel != -1) {
- console_loglevel = saved_console_loglevel;
- saved_console_loglevel = -1;
- }
- break;
-- case 8: /* Set level of messages printed to console */
-+ /* Set level of messages printed to console */
-+ case SYSLOG_ACTION_CONSOLE_LEVEL:
- error = -EINVAL;
- if (len < 1 || len > 8)
- goto out;
-@@ -399,10 +398,12 @@ int do_syslog(int type, char __user *buf, int len)
- saved_console_loglevel = -1;
- error = 0;
- break;
-- case 9: /* Number of chars in the log buffer */
-+ /* Number of chars in the log buffer */
-+ case SYSLOG_ACTION_SIZE_UNREAD:
- error = log_end - log_start;
- break;
-- case 10: /* Size of the log buffer */
-+ /* Size of the log buffer */
-+ case SYSLOG_ACTION_SIZE_BUFFER:
- error = log_buf_len;
- break;
- default:
-@@ -415,7 +416,7 @@ out:
-
- SYSCALL_DEFINE3(syslog, int, type, char __user *, buf, int, len)
- {
-- return do_syslog(type, buf, len);
-+ return do_syslog(type, buf, len, SYSLOG_FROM_CALL);
- }
-
- /*
-@@ -1153,6 +1154,18 @@ void console_start(struct console *console)
- }
- EXPORT_SYMBOL(console_start);
-
-+static int __read_mostly keep_bootcon = 0;
-+
-+static int __init keep_bootcon_setup(char *str)
-+{
-+ keep_bootcon = 1;
-+ printk(KERN_INFO "debug: skip boot console de-registration.\n");
-+
-+ return 0;
-+}
-+
-+early_param("keep_bootcon", keep_bootcon_setup);
-+
- /*
- * The console driver calls this routine during kernel initialization
- * to register the console printing procedure with printk() and to
-@@ -1299,7 +1312,9 @@ void register_console(struct console *newcon)
- * users know there might be something in the kernel's log buffer that
- * went to the bootconsole (that they do not see on the real console)
- */
-- if (bcon && ((newcon->flags & (CON_CONSDEV | CON_BOOT)) == CON_CONSDEV)) {
-+ if (bcon &&
-+ ((newcon->flags & (CON_CONSDEV | CON_BOOT)) == CON_CONSDEV) &&
-+ !keep_bootcon) {
- /* we need to iterate through twice, to make sure we print
- * everything out, before we unregister the console(s)
- */
-diff --git a/kernel/profile.c b/kernel/profile.c
-index dfadc5b..7f59404 100644
---- a/kernel/profile.c
-+++ b/kernel/profile.c
-@@ -39,7 +39,7 @@ struct profile_hit {
- /* Oprofile timer tick hook */
- static int (*timer_hook)(struct pt_regs *) __read_mostly;
-
--static atomic_t *prof_buffer;
-+static atomic_unchecked_t *prof_buffer;
- static unsigned long prof_len, prof_shift;
-
- int prof_on __read_mostly;
-@@ -283,7 +283,7 @@ static void profile_flip_buffers(void)
- hits[i].pc = 0;
- continue;
- }
-- atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
-+ atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
- hits[i].hits = hits[i].pc = 0;
- }
- }
-@@ -346,9 +346,9 @@ void profile_hits(int type, void *__pc, unsigned int nr_hits)
- * Add the current hit(s) and flush the write-queue out
- * to the global buffer:
- */
-- atomic_add(nr_hits, &prof_buffer[pc]);
-+ atomic_add_unchecked(nr_hits, &prof_buffer[pc]);
- for (i = 0; i < NR_PROFILE_HIT; ++i) {
-- atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
-+ atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
- hits[i].pc = hits[i].hits = 0;
- }
- out:
-@@ -426,7 +426,7 @@ void profile_hits(int type, void *__pc, unsigned int nr_hits)
- if (prof_on != type || !prof_buffer)
- return;
- pc = ((unsigned long)__pc - (unsigned long)_stext) >> prof_shift;
-- atomic_add(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
-+ atomic_add_unchecked(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
- }
- #endif /* !CONFIG_SMP */
- EXPORT_SYMBOL_GPL(profile_hits);
-@@ -517,7 +517,7 @@ read_profile(struct file *file, char __user *buf, size_t count, loff_t *ppos)
- return -EFAULT;
- buf++; p++; count--; read++;
- }
-- pnt = (char *)prof_buffer + p - sizeof(atomic_t);
-+ pnt = (char *)prof_buffer + p - sizeof(atomic_unchecked_t);
- if (copy_to_user(buf, (void *)pnt, count))
- return -EFAULT;
- read += count;
-@@ -548,7 +548,7 @@ static ssize_t write_profile(struct file *file, const char __user *buf,
- }
- #endif
- profile_discard_flip_buffers();
-- memset(prof_buffer, 0, prof_len * sizeof(atomic_t));
-+ memset(prof_buffer, 0, prof_len * sizeof(atomic_unchecked_t));
- return count;
- }
-
-diff --git a/kernel/ptrace.c b/kernel/ptrace.c
-index 05625f6..702665c 100644
---- a/kernel/ptrace.c
-+++ b/kernel/ptrace.c
-@@ -117,7 +117,8 @@ int ptrace_check_attach(struct task_struct *child, int kill)
- return ret;
- }
-
--int __ptrace_may_access(struct task_struct *task, unsigned int mode)
-+static int __ptrace_may_access(struct task_struct *task, unsigned int mode,
-+ unsigned int log)
- {
- const struct cred *cred = current_cred(), *tcred;
-
-@@ -141,7 +142,9 @@ int __ptrace_may_access(struct task_struct *task, unsigned int mode)
- cred->gid != tcred->egid ||
- cred->gid != tcred->sgid ||
- cred->gid != tcred->gid) &&
-- !capable(CAP_SYS_PTRACE)) {
-+ ((!log && !capable_nolog(CAP_SYS_PTRACE)) ||
-+ (log && !capable(CAP_SYS_PTRACE)))
-+ ) {
- rcu_read_unlock();
- return -EPERM;
- }
-@@ -149,7 +152,9 @@ int __ptrace_may_access(struct task_struct *task, unsigned int mode)
- smp_rmb();
- if (task->mm)
- dumpable = get_dumpable(task->mm);
-- if (!dumpable && !capable(CAP_SYS_PTRACE))
-+ if (!dumpable &&
-+ ((!log && !capable_nolog(CAP_SYS_PTRACE)) ||
-+ (log && !capable(CAP_SYS_PTRACE))))
- return -EPERM;
-
- return security_ptrace_access_check(task, mode);
-@@ -159,7 +164,16 @@ bool ptrace_may_access(struct task_struct *task, unsigned int mode)
- {
- int err;
- task_lock(task);
-- err = __ptrace_may_access(task, mode);
-+ err = __ptrace_may_access(task, mode, 0);
-+ task_unlock(task);
-+ return !err;
-+}
-+
-+bool ptrace_may_access_log(struct task_struct *task, unsigned int mode)
-+{
-+ int err;
-+ task_lock(task);
-+ err = __ptrace_may_access(task, mode, 1);
- task_unlock(task);
- return !err;
- }
-@@ -182,11 +196,11 @@ int ptrace_attach(struct task_struct *task)
- * under ptrace.
- */
- retval = -ERESTARTNOINTR;
-- if (mutex_lock_interruptible(&task->cred_guard_mutex))
-+ if (mutex_lock_interruptible(&task->signal->cred_guard_mutex))
- goto out;
-
- task_lock(task);
-- retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH);
-+ retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH, 1);
- task_unlock(task);
- if (retval)
- goto unlock_creds;
-@@ -199,7 +213,7 @@ int ptrace_attach(struct task_struct *task)
- goto unlock_tasklist;
-
- task->ptrace = PT_PTRACED;
-- if (capable(CAP_SYS_PTRACE))
-+ if (capable_nolog(CAP_SYS_PTRACE))
- task->ptrace |= PT_PTRACE_CAP;
-
- __ptrace_link(task, current);
-@@ -209,7 +223,7 @@ int ptrace_attach(struct task_struct *task)
- unlock_tasklist:
- write_unlock_irq(&tasklist_lock);
- unlock_creds:
-- mutex_unlock(&task->cred_guard_mutex);
-+ mutex_unlock(&task->signal->cred_guard_mutex);
- out:
- return retval;
- }
-@@ -351,6 +365,8 @@ int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __user *dst
- {
- int copied = 0;
-
-+ pax_track_stack();
-+
- while (len > 0) {
- char buf[128];
- int this_len, retval;
-@@ -376,6 +392,8 @@ int ptrace_writedata(struct task_struct *tsk, char __user *src, unsigned long ds
- {
- int copied = 0;
-
-+ pax_track_stack();
-+
- while (len > 0) {
- char buf[128];
- int this_len, retval;
-@@ -517,6 +535,8 @@ int ptrace_request(struct task_struct *child, long request,
- int ret = -EIO;
- siginfo_t siginfo;
-
-+ pax_track_stack();
-+
- switch (request) {
- case PTRACE_PEEKTEXT:
- case PTRACE_PEEKDATA:
-@@ -532,18 +552,18 @@ int ptrace_request(struct task_struct *child, long request,
- ret = ptrace_setoptions(child, data);
- break;
- case PTRACE_GETEVENTMSG:
-- ret = put_user(child->ptrace_message, (unsigned long __user *) data);
-+ ret = put_user(child->ptrace_message, (__force unsigned long __user *) data);
- break;
-
- case PTRACE_GETSIGINFO:
- ret = ptrace_getsiginfo(child, &siginfo);
- if (!ret)
-- ret = copy_siginfo_to_user((siginfo_t __user *) data,
-+ ret = copy_siginfo_to_user((__force siginfo_t __user *) data,
- &siginfo);
- break;
-
- case PTRACE_SETSIGINFO:
-- if (copy_from_user(&siginfo, (siginfo_t __user *) data,
-+ if (copy_from_user(&siginfo, (__force siginfo_t __user *) data,
- sizeof siginfo))
- ret = -EFAULT;
- else
-@@ -621,14 +641,21 @@ SYSCALL_DEFINE4(ptrace, long, request, long, pid, long, addr, long, data)
- goto out;
- }
-
-+ if (gr_handle_ptrace(child, request)) {
-+ ret = -EPERM;
-+ goto out_put_task_struct;
-+ }
-+
- if (request == PTRACE_ATTACH) {
- ret = ptrace_attach(child);
- /*
- * Some architectures need to do book-keeping after
- * a ptrace attach.
- */
-- if (!ret)
-+ if (!ret) {
- arch_ptrace_attach(child);
-+ gr_audit_ptrace(child);
-+ }
- goto out_put_task_struct;
- }
-
-@@ -653,7 +680,7 @@ int generic_ptrace_peekdata(struct task_struct *tsk, long addr, long data)
- copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
- if (copied != sizeof(tmp))
- return -EIO;
-- return put_user(tmp, (unsigned long __user *)data);
-+ return put_user(tmp, (__force unsigned long __user *)data);
- }
-
- int generic_ptrace_pokedata(struct task_struct *tsk, long addr, long data)
-@@ -675,6 +702,8 @@ int compat_ptrace_request(struct task_struct *child, compat_long_t request,
- siginfo_t siginfo;
- int ret;
-
-+ pax_track_stack();
-+
- switch (request) {
- case PTRACE_PEEKTEXT:
- case PTRACE_PEEKDATA:
-@@ -740,14 +769,21 @@ asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
- goto out;
- }
-
-+ if (gr_handle_ptrace(child, request)) {
-+ ret = -EPERM;
-+ goto out_put_task_struct;
-+ }
-+
- if (request == PTRACE_ATTACH) {
- ret = ptrace_attach(child);
- /*
- * Some architectures need to do book-keeping after
- * a ptrace attach.
- */
-- if (!ret)
-+ if (!ret) {
- arch_ptrace_attach(child);
-+ gr_audit_ptrace(child);
-+ }
- goto out_put_task_struct;
- }
-
-diff --git a/kernel/rcutorture.c b/kernel/rcutorture.c
-index 697c0a0..2402696 100644
---- a/kernel/rcutorture.c
-+++ b/kernel/rcutorture.c
-@@ -118,12 +118,12 @@ static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_count) =
- { 0 };
- static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_batch) =
- { 0 };
--static atomic_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
--static atomic_t n_rcu_torture_alloc;
--static atomic_t n_rcu_torture_alloc_fail;
--static atomic_t n_rcu_torture_free;
--static atomic_t n_rcu_torture_mberror;
--static atomic_t n_rcu_torture_error;
-+static atomic_unchecked_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
-+static atomic_unchecked_t n_rcu_torture_alloc;
-+static atomic_unchecked_t n_rcu_torture_alloc_fail;
-+static atomic_unchecked_t n_rcu_torture_free;
-+static atomic_unchecked_t n_rcu_torture_mberror;
-+static atomic_unchecked_t n_rcu_torture_error;
- static long n_rcu_torture_timers;
- static struct list_head rcu_torture_removed;
- static cpumask_var_t shuffle_tmp_mask;
-@@ -187,11 +187,11 @@ rcu_torture_alloc(void)
-
- spin_lock_bh(&rcu_torture_lock);
- if (list_empty(&rcu_torture_freelist)) {
-- atomic_inc(&n_rcu_torture_alloc_fail);
-+ atomic_inc_unchecked(&n_rcu_torture_alloc_fail);
- spin_unlock_bh(&rcu_torture_lock);
- return NULL;
- }
-- atomic_inc(&n_rcu_torture_alloc);
-+ atomic_inc_unchecked(&n_rcu_torture_alloc);
- p = rcu_torture_freelist.next;
- list_del_init(p);
- spin_unlock_bh(&rcu_torture_lock);
-@@ -204,7 +204,7 @@ rcu_torture_alloc(void)
- static void
- rcu_torture_free(struct rcu_torture *p)
- {
-- atomic_inc(&n_rcu_torture_free);
-+ atomic_inc_unchecked(&n_rcu_torture_free);
- spin_lock_bh(&rcu_torture_lock);
- list_add_tail(&p->rtort_free, &rcu_torture_freelist);
- spin_unlock_bh(&rcu_torture_lock);
-@@ -319,7 +319,7 @@ rcu_torture_cb(struct rcu_head *p)
- i = rp->rtort_pipe_count;
- if (i > RCU_TORTURE_PIPE_LEN)
- i = RCU_TORTURE_PIPE_LEN;
-- atomic_inc(&rcu_torture_wcount[i]);
-+ atomic_inc_unchecked(&rcu_torture_wcount[i]);
- if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
- rp->rtort_mbtest = 0;
- rcu_torture_free(rp);
-@@ -359,7 +359,7 @@ static void rcu_sync_torture_deferred_free(struct rcu_torture *p)
- i = rp->rtort_pipe_count;
- if (i > RCU_TORTURE_PIPE_LEN)
- i = RCU_TORTURE_PIPE_LEN;
-- atomic_inc(&rcu_torture_wcount[i]);
-+ atomic_inc_unchecked(&rcu_torture_wcount[i]);
- if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
- rp->rtort_mbtest = 0;
- list_del(&rp->rtort_free);
-@@ -653,7 +653,7 @@ rcu_torture_writer(void *arg)
- i = old_rp->rtort_pipe_count;
- if (i > RCU_TORTURE_PIPE_LEN)
- i = RCU_TORTURE_PIPE_LEN;
-- atomic_inc(&rcu_torture_wcount[i]);
-+ atomic_inc_unchecked(&rcu_torture_wcount[i]);
- old_rp->rtort_pipe_count++;
- cur_ops->deferred_free(old_rp);
- }
-@@ -718,7 +718,7 @@ static void rcu_torture_timer(unsigned long unused)
- return;
- }
- if (p->rtort_mbtest == 0)
-- atomic_inc(&n_rcu_torture_mberror);
-+ atomic_inc_unchecked(&n_rcu_torture_mberror);
- spin_lock(&rand_lock);
- cur_ops->read_delay(&rand);
- n_rcu_torture_timers++;
-@@ -776,7 +776,7 @@ rcu_torture_reader(void *arg)
- continue;
- }
- if (p->rtort_mbtest == 0)
-- atomic_inc(&n_rcu_torture_mberror);
-+ atomic_inc_unchecked(&n_rcu_torture_mberror);
- cur_ops->read_delay(&rand);
- preempt_disable();
- pipe_count = p->rtort_pipe_count;
-@@ -834,17 +834,17 @@ rcu_torture_printk(char *page)
- rcu_torture_current,
- rcu_torture_current_version,
- list_empty(&rcu_torture_freelist),
-- atomic_read(&n_rcu_torture_alloc),
-- atomic_read(&n_rcu_torture_alloc_fail),
-- atomic_read(&n_rcu_torture_free),
-- atomic_read(&n_rcu_torture_mberror),
-+ atomic_read_unchecked(&n_rcu_torture_alloc),
-+ atomic_read_unchecked(&n_rcu_torture_alloc_fail),
-+ atomic_read_unchecked(&n_rcu_torture_free),
-+ atomic_read_unchecked(&n_rcu_torture_mberror),
- n_rcu_torture_timers);
-- if (atomic_read(&n_rcu_torture_mberror) != 0)
-+ if (atomic_read_unchecked(&n_rcu_torture_mberror) != 0)
- cnt += sprintf(&page[cnt], " !!!");
- cnt += sprintf(&page[cnt], "\n%s%s ", torture_type, TORTURE_FLAG);
- if (i > 1) {
- cnt += sprintf(&page[cnt], "!!! ");
-- atomic_inc(&n_rcu_torture_error);
-+ atomic_inc_unchecked(&n_rcu_torture_error);
- WARN_ON_ONCE(1);
- }
- cnt += sprintf(&page[cnt], "Reader Pipe: ");
-@@ -858,7 +858,7 @@ rcu_torture_printk(char *page)
- cnt += sprintf(&page[cnt], "Free-Block Circulation: ");
- for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
- cnt += sprintf(&page[cnt], " %d",
-- atomic_read(&rcu_torture_wcount[i]));
-+ atomic_read_unchecked(&rcu_torture_wcount[i]));
- }
- cnt += sprintf(&page[cnt], "\n");
- if (cur_ops->stats)
-@@ -1084,7 +1084,7 @@ rcu_torture_cleanup(void)
-
- if (cur_ops->cleanup)
- cur_ops->cleanup();
-- if (atomic_read(&n_rcu_torture_error))
-+ if (atomic_read_unchecked(&n_rcu_torture_error))
- rcu_torture_print_module_parms("End of test: FAILURE");
- else
- rcu_torture_print_module_parms("End of test: SUCCESS");
-@@ -1138,13 +1138,13 @@ rcu_torture_init(void)
-
- rcu_torture_current = NULL;
- rcu_torture_current_version = 0;
-- atomic_set(&n_rcu_torture_alloc, 0);
-- atomic_set(&n_rcu_torture_alloc_fail, 0);
-- atomic_set(&n_rcu_torture_free, 0);
-- atomic_set(&n_rcu_torture_mberror, 0);
-- atomic_set(&n_rcu_torture_error, 0);
-+ atomic_set_unchecked(&n_rcu_torture_alloc, 0);
-+ atomic_set_unchecked(&n_rcu_torture_alloc_fail, 0);
-+ atomic_set_unchecked(&n_rcu_torture_free, 0);
-+ atomic_set_unchecked(&n_rcu_torture_mberror, 0);
-+ atomic_set_unchecked(&n_rcu_torture_error, 0);
- for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++)
-- atomic_set(&rcu_torture_wcount[i], 0);
-+ atomic_set_unchecked(&rcu_torture_wcount[i], 0);
- for_each_possible_cpu(cpu) {
- for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
- per_cpu(rcu_torture_count, cpu)[i] = 0;
-diff --git a/kernel/rcutree.c b/kernel/rcutree.c
-index 683c4f3..97f54c6 100644
---- a/kernel/rcutree.c
-+++ b/kernel/rcutree.c
-@@ -1303,7 +1303,7 @@ __rcu_process_callbacks(struct rcu_state *rsp, struct rcu_data *rdp)
- /*
- * Do softirq processing for the current CPU.
- */
--static void rcu_process_callbacks(struct softirq_action *unused)
-+static void rcu_process_callbacks(void)
- {
- /*
- * Memory references from any prior RCU read-side critical sections
-diff --git a/kernel/rcutree_plugin.h b/kernel/rcutree_plugin.h
-index c03edf7..ac1b341 100644
---- a/kernel/rcutree_plugin.h
-+++ b/kernel/rcutree_plugin.h
-@@ -145,7 +145,7 @@ static void rcu_preempt_note_context_switch(int cpu)
- */
- void __rcu_read_lock(void)
- {
-- ACCESS_ONCE(current->rcu_read_lock_nesting)++;
-+ ACCESS_ONCE_RW(current->rcu_read_lock_nesting)++;
- barrier(); /* needed if we ever invoke rcu_read_lock in rcutree.c */
- }
- EXPORT_SYMBOL_GPL(__rcu_read_lock);
-@@ -251,7 +251,7 @@ void __rcu_read_unlock(void)
- struct task_struct *t = current;
-
- barrier(); /* needed if we ever invoke rcu_read_unlock in rcutree.c */
-- if (--ACCESS_ONCE(t->rcu_read_lock_nesting) == 0 &&
-+ if (--ACCESS_ONCE_RW(t->rcu_read_lock_nesting) == 0 &&
- unlikely(ACCESS_ONCE(t->rcu_read_unlock_special)))
- rcu_read_unlock_special(t);
- }
-diff --git a/kernel/relay.c b/kernel/relay.c
-index bf343f5..908e9ee 100644
---- a/kernel/relay.c
-+++ b/kernel/relay.c
-@@ -1228,7 +1228,7 @@ static int subbuf_splice_actor(struct file *in,
- unsigned int flags,
- int *nonpad_ret)
- {
-- unsigned int pidx, poff, total_len, subbuf_pages, nr_pages, ret;
-+ unsigned int pidx, poff, total_len, subbuf_pages, nr_pages;
- struct rchan_buf *rbuf = in->private_data;
- unsigned int subbuf_size = rbuf->chan->subbuf_size;
- uint64_t pos = (uint64_t) *ppos;
-@@ -1247,6 +1247,9 @@ static int subbuf_splice_actor(struct file *in,
- .ops = &relay_pipe_buf_ops,
- .spd_release = relay_page_release,
- };
-+ ssize_t ret;
-+
-+ pax_track_stack();
-
- if (rbuf->subbufs_produced == rbuf->subbufs_consumed)
- return 0;
-diff --git a/kernel/resource.c b/kernel/resource.c
-index fb11a58..4e61ae1 100644
---- a/kernel/resource.c
-+++ b/kernel/resource.c
-@@ -132,8 +132,18 @@ static const struct file_operations proc_iomem_operations = {
-
- static int __init ioresources_init(void)
- {
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+ proc_create("ioports", S_IRUSR, NULL, &proc_ioports_operations);
-+ proc_create("iomem", S_IRUSR, NULL, &proc_iomem_operations);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ proc_create("ioports", S_IRUSR | S_IRGRP, NULL, &proc_ioports_operations);
-+ proc_create("iomem", S_IRUSR | S_IRGRP, NULL, &proc_iomem_operations);
-+#endif
-+#else
- proc_create("ioports", 0, NULL, &proc_ioports_operations);
- proc_create("iomem", 0, NULL, &proc_iomem_operations);
-+#endif
- return 0;
- }
- __initcall(ioresources_init);
-diff --git a/kernel/rtmutex-tester.c b/kernel/rtmutex-tester.c
-index a56f629..1fc4989 100644
---- a/kernel/rtmutex-tester.c
-+++ b/kernel/rtmutex-tester.c
-@@ -21,7 +21,7 @@
- #define MAX_RT_TEST_MUTEXES 8
-
- static spinlock_t rttest_lock;
--static atomic_t rttest_event;
-+static atomic_unchecked_t rttest_event;
-
- struct test_thread_data {
- int opcode;
-@@ -64,7 +64,7 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
-
- case RTTEST_LOCKCONT:
- td->mutexes[td->opdata] = 1;
-- td->event = atomic_add_return(1, &rttest_event);
-+ td->event = atomic_add_return_unchecked(1, &rttest_event);
- return 0;
-
- case RTTEST_RESET:
-@@ -82,7 +82,7 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
- return 0;
-
- case RTTEST_RESETEVENT:
-- atomic_set(&rttest_event, 0);
-+ atomic_set_unchecked(&rttest_event, 0);
- return 0;
-
- default:
-@@ -99,9 +99,9 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
- return ret;
-
- td->mutexes[id] = 1;
-- td->event = atomic_add_return(1, &rttest_event);
-+ td->event = atomic_add_return_unchecked(1, &rttest_event);
- rt_mutex_lock(&mutexes[id]);
-- td->event = atomic_add_return(1, &rttest_event);
-+ td->event = atomic_add_return_unchecked(1, &rttest_event);
- td->mutexes[id] = 4;
- return 0;
-
-@@ -112,9 +112,9 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
- return ret;
-
- td->mutexes[id] = 1;
-- td->event = atomic_add_return(1, &rttest_event);
-+ td->event = atomic_add_return_unchecked(1, &rttest_event);
- ret = rt_mutex_lock_interruptible(&mutexes[id], 0);
-- td->event = atomic_add_return(1, &rttest_event);
-+ td->event = atomic_add_return_unchecked(1, &rttest_event);
- td->mutexes[id] = ret ? 0 : 4;
- return ret ? -EINTR : 0;
-
-@@ -123,9 +123,9 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
- if (id < 0 || id >= MAX_RT_TEST_MUTEXES || td->mutexes[id] != 4)
- return ret;
-
-- td->event = atomic_add_return(1, &rttest_event);
-+ td->event = atomic_add_return_unchecked(1, &rttest_event);
- rt_mutex_unlock(&mutexes[id]);
-- td->event = atomic_add_return(1, &rttest_event);
-+ td->event = atomic_add_return_unchecked(1, &rttest_event);
- td->mutexes[id] = 0;
- return 0;
-
-@@ -187,7 +187,7 @@ void schedule_rt_mutex_test(struct rt_mutex *mutex)
- break;
-
- td->mutexes[dat] = 2;
-- td->event = atomic_add_return(1, &rttest_event);
-+ td->event = atomic_add_return_unchecked(1, &rttest_event);
- break;
-
- case RTTEST_LOCKBKL:
-@@ -208,7 +208,7 @@ void schedule_rt_mutex_test(struct rt_mutex *mutex)
- return;
-
- td->mutexes[dat] = 3;
-- td->event = atomic_add_return(1, &rttest_event);
-+ td->event = atomic_add_return_unchecked(1, &rttest_event);
- break;
-
- case RTTEST_LOCKNOWAIT:
-@@ -220,7 +220,7 @@ void schedule_rt_mutex_test(struct rt_mutex *mutex)
- return;
-
- td->mutexes[dat] = 1;
-- td->event = atomic_add_return(1, &rttest_event);
-+ td->event = atomic_add_return_unchecked(1, &rttest_event);
- return;
-
- case RTTEST_LOCKBKL:
-diff --git a/kernel/rtmutex.c b/kernel/rtmutex.c
-index 29bd4ba..8c5de90 100644
---- a/kernel/rtmutex.c
-+++ b/kernel/rtmutex.c
-@@ -511,7 +511,7 @@ static void wakeup_next_waiter(struct rt_mutex *lock)
- */
- spin_lock_irqsave(&pendowner->pi_lock, flags);
-
-- WARN_ON(!pendowner->pi_blocked_on);
-+ BUG_ON(!pendowner->pi_blocked_on);
- WARN_ON(pendowner->pi_blocked_on != waiter);
- WARN_ON(pendowner->pi_blocked_on->lock != lock);
-
-diff --git a/kernel/sched.c b/kernel/sched.c
-index 0591df8..dcf3f9f 100644
---- a/kernel/sched.c
-+++ b/kernel/sched.c
-@@ -2618,7 +2618,8 @@ out:
- */
- int wake_up_process(struct task_struct *p)
- {
-- return try_to_wake_up(p, TASK_ALL, 0);
-+ WARN_ON(task_is_stopped_or_traced(p));
-+ return try_to_wake_up(p, TASK_NORMAL, 0);
- }
- EXPORT_SYMBOL(wake_up_process);
-
-@@ -5043,7 +5044,7 @@ out:
- * In CONFIG_NO_HZ case, the idle load balance owner will do the
- * rebalancing for all the cpus for whom scheduler ticks are stopped.
- */
--static void run_rebalance_domains(struct softirq_action *h)
-+static void run_rebalance_domains(void)
- {
- int this_cpu = smp_processor_id();
- struct rq *this_rq = cpu_rq(this_cpu);
-@@ -5700,6 +5701,8 @@ asmlinkage void __sched schedule(void)
- struct rq *rq;
- int cpu;
-
-+ pax_track_stack();
-+
- need_resched:
- preempt_disable();
- cpu = smp_processor_id();
-@@ -5770,7 +5773,7 @@ EXPORT_SYMBOL(schedule);
- * Look out! "owner" is an entirely speculative pointer
- * access and not reliable.
- */
--int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner)
-+int mutex_spin_on_owner(struct mutex *lock, struct task_struct *owner)
- {
- unsigned int cpu;
- struct rq *rq;
-@@ -5784,10 +5787,10 @@ int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner)
- * DEBUG_PAGEALLOC could have unmapped it if
- * the mutex owner just released it and exited.
- */
-- if (probe_kernel_address(&owner->cpu, cpu))
-+ if (probe_kernel_address(&task_thread_info(owner)->cpu, cpu))
- return 0;
- #else
-- cpu = owner->cpu;
-+ cpu = task_thread_info(owner)->cpu;
- #endif
-
- /*
-@@ -5816,7 +5819,7 @@ int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner)
- /*
- * Is that owner really running on that cpu?
- */
-- if (task_thread_info(rq->curr) != owner || need_resched())
-+ if (rq->curr != owner || need_resched())
- return 0;
-
- cpu_relax();
-@@ -6359,6 +6362,8 @@ int can_nice(const struct task_struct *p, const int nice)
- /* convert nice value [19,-20] to rlimit style value [1,40] */
- int nice_rlim = 20 - nice;
-
-+ gr_learn_resource(p, RLIMIT_NICE, nice_rlim, 1);
-+
- return (nice_rlim <= p->signal->rlim[RLIMIT_NICE].rlim_cur ||
- capable(CAP_SYS_NICE));
- }
-@@ -6392,7 +6397,8 @@ SYSCALL_DEFINE1(nice, int, increment)
- if (nice > 19)
- nice = 19;
-
-- if (increment < 0 && !can_nice(current, nice))
-+ if (increment < 0 && (!can_nice(current, nice) ||
-+ gr_handle_chroot_nice()))
- return -EPERM;
-
- retval = security_task_setnice(current, nice);
-@@ -8774,7 +8780,7 @@ static void init_sched_groups_power(int cpu, struct sched_domain *sd)
- long power;
- int weight;
-
-- WARN_ON(!sd || !sd->groups);
-+ BUG_ON(!sd || !sd->groups);
-
- if (cpu != group_first_cpu(sd->groups))
- return;
-diff --git a/kernel/signal.c b/kernel/signal.c
-index 2494827..cda80a0 100644
---- a/kernel/signal.c
-+++ b/kernel/signal.c
-@@ -41,12 +41,12 @@
-
- static struct kmem_cache *sigqueue_cachep;
-
--static void __user *sig_handler(struct task_struct *t, int sig)
-+static __sighandler_t sig_handler(struct task_struct *t, int sig)
- {
- return t->sighand->action[sig - 1].sa.sa_handler;
- }
-
--static int sig_handler_ignored(void __user *handler, int sig)
-+static int sig_handler_ignored(__sighandler_t handler, int sig)
- {
- /* Is it explicitly or implicitly ignored? */
- return handler == SIG_IGN ||
-@@ -56,7 +56,7 @@ static int sig_handler_ignored(void __user *handler, int sig)
- static int sig_task_ignored(struct task_struct *t, int sig,
- int from_ancestor_ns)
- {
-- void __user *handler;
-+ __sighandler_t handler;
-
- handler = sig_handler(t, sig);
-
-@@ -207,6 +207,9 @@ static struct sigqueue *__sigqueue_alloc(struct task_struct *t, gfp_t flags,
- */
- user = get_uid(__task_cred(t)->user);
- atomic_inc(&user->sigpending);
-+
-+ if (!override_rlimit)
-+ gr_learn_resource(t, RLIMIT_SIGPENDING, atomic_read(&user->sigpending), 1);
- if (override_rlimit ||
- atomic_read(&user->sigpending) <=
- t->signal->rlim[RLIMIT_SIGPENDING].rlim_cur)
-@@ -327,7 +330,7 @@ flush_signal_handlers(struct task_struct *t, int force_default)
-
- int unhandled_signal(struct task_struct *tsk, int sig)
- {
-- void __user *handler = tsk->sighand->action[sig-1].sa.sa_handler;
-+ __sighandler_t handler = tsk->sighand->action[sig-1].sa.sa_handler;
- if (is_global_init(tsk))
- return 1;
- if (handler != SIG_IGN && handler != SIG_DFL)
-@@ -627,6 +630,13 @@ static int check_kill_permission(int sig, struct siginfo *info,
- }
- }
-
-+ /* allow glibc communication via tgkill to other threads in our
-+ thread group */
-+ if ((info == SEND_SIG_NOINFO || info->si_code != SI_TKILL ||
-+ sig != (SIGRTMIN+1) || task_tgid_vnr(t) != info->si_pid)
-+ && gr_handle_signal(t, sig))
-+ return -EPERM;
-+
- return security_task_kill(t, info, sig, 0);
- }
-
-@@ -968,7 +978,7 @@ __group_send_sig_info(int sig, struct siginfo *info, struct task_struct *p)
- return send_signal(sig, info, p, 1);
- }
-
--static int
-+int
- specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t)
- {
- return send_signal(sig, info, t, 0);
-@@ -1005,6 +1015,7 @@ force_sig_info(int sig, struct siginfo *info, struct task_struct *t)
- unsigned long int flags;
- int ret, blocked, ignored;
- struct k_sigaction *action;
-+ int is_unhandled = 0;
-
- spin_lock_irqsave(&t->sighand->siglock, flags);
- action = &t->sighand->action[sig-1];
-@@ -1019,9 +1030,18 @@ force_sig_info(int sig, struct siginfo *info, struct task_struct *t)
- }
- if (action->sa.sa_handler == SIG_DFL)
- t->signal->flags &= ~SIGNAL_UNKILLABLE;
-+ if (action->sa.sa_handler == SIG_IGN || action->sa.sa_handler == SIG_DFL)
-+ is_unhandled = 1;
- ret = specific_send_sig_info(sig, info, t);
- spin_unlock_irqrestore(&t->sighand->siglock, flags);
-
-+ /* only deal with unhandled signals, java etc trigger SIGSEGV during
-+ normal operation */
-+ if (is_unhandled) {
-+ gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, t);
-+ gr_handle_crash(t, sig);
-+ }
-+
- return ret;
- }
-
-@@ -1081,8 +1101,11 @@ int group_send_sig_info(int sig, struct siginfo *info, struct task_struct *p)
- {
- int ret = check_kill_permission(sig, info, p);
-
-- if (!ret && sig)
-+ if (!ret && sig) {
- ret = do_send_sig_info(sig, info, p, true);
-+ if (!ret)
-+ gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, p);
-+ }
-
- return ret;
- }
-@@ -1644,6 +1667,8 @@ void ptrace_notify(int exit_code)
- {
- siginfo_t info;
-
-+ pax_track_stack();
-+
- BUG_ON((exit_code & (0x7f | ~0xffff)) != SIGTRAP);
-
- memset(&info, 0, sizeof info);
-@@ -2275,7 +2300,15 @@ do_send_specific(pid_t tgid, pid_t pid, int sig, struct siginfo *info)
- int error = -ESRCH;
-
- rcu_read_lock();
-- p = find_task_by_vpid(pid);
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
-+ /* allow glibc communication via tgkill to other threads in our
-+ thread group */
-+ if (grsec_enable_chroot_findtask && info->si_code == SI_TKILL &&
-+ sig == (SIGRTMIN+1) && tgid == info->si_pid)
-+ p = find_task_by_vpid_unrestricted(pid);
-+ else
-+#endif
-+ p = find_task_by_vpid(pid);
- if (p && (tgid <= 0 || task_tgid_vnr(p) == tgid)) {
- error = check_kill_permission(sig, info, p);
- /*
-diff --git a/kernel/smp.c b/kernel/smp.c
-index aa9cff3..631a0de 100644
---- a/kernel/smp.c
-+++ b/kernel/smp.c
-@@ -522,22 +522,22 @@ int smp_call_function(void (*func)(void *), void *info, int wait)
- }
- EXPORT_SYMBOL(smp_call_function);
-
--void ipi_call_lock(void)
-+void ipi_call_lock(void) __acquires(call_function.lock)
- {
- spin_lock(&call_function.lock);
- }
-
--void ipi_call_unlock(void)
-+void ipi_call_unlock(void) __releases(call_function.lock)
- {
- spin_unlock(&call_function.lock);
- }
-
--void ipi_call_lock_irq(void)
-+void ipi_call_lock_irq(void) __acquires(call_function.lock)
- {
- spin_lock_irq(&call_function.lock);
- }
-
--void ipi_call_unlock_irq(void)
-+void ipi_call_unlock_irq(void) __releases(call_function.lock)
- {
- spin_unlock_irq(&call_function.lock);
- }
-diff --git a/kernel/softirq.c b/kernel/softirq.c
-index 04a0252..580c512 100644
---- a/kernel/softirq.c
-+++ b/kernel/softirq.c
-@@ -56,7 +56,7 @@ static struct softirq_action softirq_vec[NR_SOFTIRQS] __cacheline_aligned_in_smp
-
- static DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
-
--char *softirq_to_name[NR_SOFTIRQS] = {
-+const char * const softirq_to_name[NR_SOFTIRQS] = {
- "HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL",
- "TASKLET", "SCHED", "HRTIMER", "RCU"
- };
-@@ -206,7 +206,7 @@ EXPORT_SYMBOL(local_bh_enable_ip);
-
- asmlinkage void __do_softirq(void)
- {
-- struct softirq_action *h;
-+ const struct softirq_action *h;
- __u32 pending;
- int max_restart = MAX_SOFTIRQ_RESTART;
- int cpu;
-@@ -233,7 +233,7 @@ restart:
- kstat_incr_softirqs_this_cpu(h - softirq_vec);
-
- trace_softirq_entry(h, softirq_vec);
-- h->action(h);
-+ h->action();
- trace_softirq_exit(h, softirq_vec);
- if (unlikely(prev_count != preempt_count())) {
- printk(KERN_ERR "huh, entered softirq %td %s %p"
-@@ -363,9 +363,11 @@ void raise_softirq(unsigned int nr)
- local_irq_restore(flags);
- }
-
--void open_softirq(int nr, void (*action)(struct softirq_action *))
-+void open_softirq(int nr, void (*action)(void))
- {
-- softirq_vec[nr].action = action;
-+ pax_open_kernel();
-+ *(void **)&softirq_vec[nr].action = action;
-+ pax_close_kernel();
- }
-
- /*
-@@ -419,7 +421,7 @@ void __tasklet_hi_schedule_first(struct tasklet_struct *t)
-
- EXPORT_SYMBOL(__tasklet_hi_schedule_first);
-
--static void tasklet_action(struct softirq_action *a)
-+static void tasklet_action(void)
- {
- struct tasklet_struct *list;
-
-@@ -454,7 +456,7 @@ static void tasklet_action(struct softirq_action *a)
- }
- }
-
--static void tasklet_hi_action(struct softirq_action *a)
-+static void tasklet_hi_action(void)
- {
- struct tasklet_struct *list;
-
-diff --git a/kernel/sys.c b/kernel/sys.c
-index e9512b1..f07185f 100644
---- a/kernel/sys.c
-+++ b/kernel/sys.c
-@@ -133,6 +133,12 @@ static int set_one_prio(struct task_struct *p, int niceval, int error)
- error = -EACCES;
- goto out;
- }
-+
-+ if (gr_handle_chroot_setpriority(p, niceval)) {
-+ error = -EACCES;
-+ goto out;
-+ }
-+
- no_nice = security_task_setnice(p, niceval);
- if (no_nice) {
- error = no_nice;
-@@ -190,10 +196,10 @@ SYSCALL_DEFINE3(setpriority, int, which, int, who, int, niceval)
- !(user = find_user(who)))
- goto out_unlock; /* No processes for this user */
-
-- do_each_thread(g, p)
-+ do_each_thread(g, p) {
- if (__task_cred(p)->uid == who)
- error = set_one_prio(p, niceval, error);
-- while_each_thread(g, p);
-+ } while_each_thread(g, p);
- if (who != cred->uid)
- free_uid(user); /* For find_user() */
- break;
-@@ -253,13 +259,13 @@ SYSCALL_DEFINE2(getpriority, int, which, int, who)
- !(user = find_user(who)))
- goto out_unlock; /* No processes for this user */
-
-- do_each_thread(g, p)
-+ do_each_thread(g, p) {
- if (__task_cred(p)->uid == who) {
- niceval = 20 - task_nice(p);
- if (niceval > retval)
- retval = niceval;
- }
-- while_each_thread(g, p);
-+ } while_each_thread(g, p);
- if (who != cred->uid)
- free_uid(user); /* for find_user() */
- break;
-@@ -509,6 +515,9 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, gid_t, egid)
- goto error;
- }
-
-+ if (gr_check_group_change(new->gid, new->egid, -1))
-+ goto error;
-+
- if (rgid != (gid_t) -1 ||
- (egid != (gid_t) -1 && egid != old->gid))
- new->sgid = new->egid;
-@@ -542,6 +551,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
- goto error;
-
- retval = -EPERM;
-+
-+ if (gr_check_group_change(gid, gid, gid))
-+ goto error;
-+
- if (capable(CAP_SETGID))
- new->gid = new->egid = new->sgid = new->fsgid = gid;
- else if (gid == old->gid || gid == old->sgid)
-@@ -559,7 +572,7 @@ error:
- /*
- * change the user struct in a credentials set to match the new UID
- */
--static int set_user(struct cred *new)
-+int set_user(struct cred *new)
- {
- struct user_struct *new_user;
-
-@@ -567,12 +580,19 @@ static int set_user(struct cred *new)
- if (!new_user)
- return -EAGAIN;
-
-+ /*
-+ * We don't fail in case of NPROC limit excess here because too many
-+ * poorly written programs don't check set*uid() return code, assuming
-+ * it never fails if called by root. We may still enforce NPROC limit
-+ * for programs doing set*uid()+execve() by harmlessly deferring the
-+ * failure to the execve() stage.
-+ */
- if (atomic_read(&new_user->processes) >=
- current->signal->rlim[RLIMIT_NPROC].rlim_cur &&
-- new_user != INIT_USER) {
-- free_uid(new_user);
-- return -EAGAIN;
-- }
-+ new_user != INIT_USER)
-+ current->flags |= PF_NPROC_EXCEEDED;
-+ else
-+ current->flags &= ~PF_NPROC_EXCEEDED;
-
- free_uid(new->user);
- new->user = new_user;
-@@ -627,6 +647,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, uid_t, euid)
- goto error;
- }
-
-+ if (gr_check_user_change(new->uid, new->euid, -1))
-+ goto error;
-+
- if (new->uid != old->uid) {
- retval = set_user(new);
- if (retval < 0)
-@@ -675,6 +698,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
- goto error;
-
- retval = -EPERM;
-+
-+ if (gr_check_crash_uid(uid))
-+ goto error;
-+ if (gr_check_user_change(uid, uid, uid))
-+ goto error;
-+
- if (capable(CAP_SETUID)) {
- new->suid = new->uid = uid;
- if (uid != old->uid) {
-@@ -732,6 +761,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid, uid_t, euid, uid_t, suid)
- goto error;
- }
-
-+ if (gr_check_user_change(ruid, euid, -1))
-+ goto error;
-+
- if (ruid != (uid_t) -1) {
- new->uid = ruid;
- if (ruid != old->uid) {
-@@ -800,6 +832,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid, gid_t, egid, gid_t, sgid)
- goto error;
- }
-
-+ if (gr_check_group_change(rgid, egid, -1))
-+ goto error;
-+
- if (rgid != (gid_t) -1)
- new->gid = rgid;
- if (egid != (gid_t) -1)
-@@ -849,6 +884,9 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
- if (security_task_setuid(uid, (uid_t)-1, (uid_t)-1, LSM_SETID_FS) < 0)
- goto error;
-
-+ if (gr_check_user_change(-1, -1, uid))
-+ goto error;
-+
- if (uid == old->uid || uid == old->euid ||
- uid == old->suid || uid == old->fsuid ||
- capable(CAP_SETUID)) {
-@@ -889,6 +927,9 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
- if (gid == old->gid || gid == old->egid ||
- gid == old->sgid || gid == old->fsgid ||
- capable(CAP_SETGID)) {
-+ if (gr_check_group_change(-1, -1, gid))
-+ goto error;
-+
- if (gid != old_fsgid) {
- new->fsgid = gid;
- goto change_okay;
-@@ -1454,7 +1495,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
- error = get_dumpable(me->mm);
- break;
- case PR_SET_DUMPABLE:
-- if (arg2 < 0 || arg2 > 1) {
-+ if (arg2 > 1) {
- error = -EINVAL;
- break;
- }
-diff --git a/kernel/sysctl.c b/kernel/sysctl.c
-index b8bd058..ab6a76be 100644
---- a/kernel/sysctl.c
-+++ b/kernel/sysctl.c
-@@ -63,6 +63,13 @@
- static int deprecated_sysctl_warning(struct __sysctl_args *args);
-
- #if defined(CONFIG_SYSCTL)
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+extern __u32 gr_handle_sysctl(const ctl_table *table, const int op);
-+extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
-+ const int op);
-+extern int gr_handle_chroot_sysctl(const int op);
-
- /* External variables not in a header file. */
- extern int C_A_D;
-@@ -168,6 +175,7 @@ static int proc_do_cad_pid(struct ctl_table *table, int write,
- static int proc_taint(struct ctl_table *table, int write,
- void __user *buffer, size_t *lenp, loff_t *ppos);
- #endif
-+extern ctl_table grsecurity_table[];
-
- static struct ctl_table root_table[];
- static struct ctl_table_root sysctl_table_root;
-@@ -200,6 +208,21 @@ extern struct ctl_table epoll_table[];
- int sysctl_legacy_va_layout;
- #endif
-
-+#ifdef CONFIG_PAX_SOFTMODE
-+static ctl_table pax_table[] = {
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "softmode",
-+ .data = &pax_softmode,
-+ .maxlen = sizeof(unsigned int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+
-+ { .ctl_name = 0 }
-+};
-+#endif
-+
- extern int prove_locking;
- extern int lock_stat;
-
-@@ -251,6 +274,24 @@ static int max_wakeup_granularity_ns = NSEC_PER_SEC; /* 1 second */
- #endif
-
- static struct ctl_table kern_table[] = {
-+#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "grsecurity",
-+ .mode = 0500,
-+ .child = grsecurity_table,
-+ },
-+#endif
-+
-+#ifdef CONFIG_PAX_SOFTMODE
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "pax",
-+ .mode = 0500,
-+ .child = pax_table,
-+ },
-+#endif
-+
- {
- .ctl_name = CTL_UNNUMBERED,
- .procname = "sched_child_runs_first",
-@@ -567,8 +608,8 @@ static struct ctl_table kern_table[] = {
- .data = &modprobe_path,
- .maxlen = KMOD_PATH_LEN,
- .mode = 0644,
-- .proc_handler = &proc_dostring,
-- .strategy = &sysctl_string,
-+ .proc_handler = &proc_dostring_modpriv,
-+ .strategy = &sysctl_string_modpriv,
- },
- {
- .ctl_name = CTL_UNNUMBERED,
-@@ -1247,6 +1288,13 @@ static struct ctl_table vm_table[] = {
- .mode = 0644,
- .proc_handler = &proc_dointvec
- },
-+ {
-+ .procname = "heap_stack_gap",
-+ .data = &sysctl_heap_stack_gap,
-+ .maxlen = sizeof(sysctl_heap_stack_gap),
-+ .mode = 0644,
-+ .proc_handler = proc_doulongvec_minmax,
-+ },
- #else
- {
- .ctl_name = CTL_UNNUMBERED,
-@@ -1803,6 +1851,8 @@ static int do_sysctl_strategy(struct ctl_table_root *root,
- return 0;
- }
-
-+static int sysctl_perm_nochk(struct ctl_table_root *root, struct ctl_table *table, int op);
-+
- static int parse_table(int __user *name, int nlen,
- void __user *oldval, size_t __user *oldlenp,
- void __user *newval, size_t newlen,
-@@ -1821,7 +1871,7 @@ repeat:
- if (n == table->ctl_name) {
- int error;
- if (table->child) {
-- if (sysctl_perm(root, table, MAY_EXEC))
-+ if (sysctl_perm_nochk(root, table, MAY_EXEC))
- return -EPERM;
- name++;
- nlen--;
-@@ -1906,6 +1956,33 @@ int sysctl_perm(struct ctl_table_root *root, struct ctl_table *table, int op)
- int error;
- int mode;
-
-+ if (table->parent != NULL && table->parent->procname != NULL &&
-+ table->procname != NULL &&
-+ gr_handle_sysctl_mod(table->parent->procname, table->procname, op))
-+ return -EACCES;
-+ if (gr_handle_chroot_sysctl(op))
-+ return -EACCES;
-+ error = gr_handle_sysctl(table, op);
-+ if (error)
-+ return error;
-+
-+ error = security_sysctl(table, op & (MAY_READ | MAY_WRITE | MAY_EXEC));
-+ if (error)
-+ return error;
-+
-+ if (root->permissions)
-+ mode = root->permissions(root, current->nsproxy, table);
-+ else
-+ mode = table->mode;
-+
-+ return test_perm(mode, op);
-+}
-+
-+int sysctl_perm_nochk(struct ctl_table_root *root, struct ctl_table *table, int op)
-+{
-+ int error;
-+ int mode;
-+
- error = security_sysctl(table, op & (MAY_READ | MAY_WRITE | MAY_EXEC));
- if (error)
- return error;
-@@ -2335,6 +2412,16 @@ int proc_dostring(struct ctl_table *table, int write,
- buffer, lenp, ppos);
- }
-
-+int proc_dostring_modpriv(struct ctl_table *table, int write,
-+ void __user *buffer, size_t *lenp, loff_t *ppos)
-+{
-+ if (write && !capable(CAP_SYS_MODULE))
-+ return -EPERM;
-+
-+ return _proc_do_string(table->data, table->maxlen, write,
-+ buffer, lenp, ppos);
-+}
-+
-
- static int do_proc_dointvec_conv(int *negp, unsigned long *lvalp,
- int *valp,
-@@ -2609,7 +2696,7 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
- vleft = table->maxlen / sizeof(unsigned long);
- left = *lenp;
-
-- for (; left && vleft--; i++, min++, max++, first=0) {
-+ for (; left && vleft--; i++, first=0) {
- if (write) {
- while (left) {
- char c;
-@@ -2910,6 +2997,12 @@ int proc_dostring(struct ctl_table *table, int write,
- return -ENOSYS;
- }
-
-+int proc_dostring_modpriv(struct ctl_table *table, int write,
-+ void __user *buffer, size_t *lenp, loff_t *ppos)
-+{
-+ return -ENOSYS;
-+}
-+
- int proc_dointvec(struct ctl_table *table, int write,
- void __user *buffer, size_t *lenp, loff_t *ppos)
- {
-@@ -3038,6 +3131,16 @@ int sysctl_string(struct ctl_table *table,
- return 1;
- }
-
-+int sysctl_string_modpriv(struct ctl_table *table,
-+ void __user *oldval, size_t __user *oldlenp,
-+ void __user *newval, size_t newlen)
-+{
-+ if (newval && newlen && !capable(CAP_SYS_MODULE))
-+ return -EPERM;
-+
-+ return sysctl_string(table, oldval, oldlenp, newval, newlen);
-+}
-+
- /*
- * This function makes sure that all of the integers in the vector
- * are between the minimum and maximum values given in the arrays
-@@ -3182,6 +3285,13 @@ int sysctl_string(struct ctl_table *table,
- return -ENOSYS;
- }
-
-+int sysctl_string_modpriv(struct ctl_table *table,
-+ void __user *oldval, size_t __user *oldlenp,
-+ void __user *newval, size_t newlen)
-+{
-+ return -ENOSYS;
-+}
-+
- int sysctl_intvec(struct ctl_table *table,
- void __user *oldval, size_t __user *oldlenp,
- void __user *newval, size_t newlen)
-@@ -3246,6 +3356,7 @@ EXPORT_SYMBOL(proc_dointvec_minmax);
- EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
- EXPORT_SYMBOL(proc_dointvec_ms_jiffies);
- EXPORT_SYMBOL(proc_dostring);
-+EXPORT_SYMBOL(proc_dostring_modpriv);
- EXPORT_SYMBOL(proc_doulongvec_minmax);
- EXPORT_SYMBOL(proc_doulongvec_ms_jiffies_minmax);
- EXPORT_SYMBOL(register_sysctl_table);
-@@ -3254,5 +3365,6 @@ EXPORT_SYMBOL(sysctl_intvec);
- EXPORT_SYMBOL(sysctl_jiffies);
- EXPORT_SYMBOL(sysctl_ms_jiffies);
- EXPORT_SYMBOL(sysctl_string);
-+EXPORT_SYMBOL(sysctl_string_modpriv);
- EXPORT_SYMBOL(sysctl_data);
- EXPORT_SYMBOL(unregister_sysctl_table);
-diff --git a/kernel/sysctl_check.c b/kernel/sysctl_check.c
-index 469193c..ea3ecb2 100644
---- a/kernel/sysctl_check.c
-+++ b/kernel/sysctl_check.c
-@@ -1489,10 +1489,12 @@ int sysctl_check_table(struct nsproxy *namespaces, struct ctl_table *table)
- } else {
- if ((table->strategy == sysctl_data) ||
- (table->strategy == sysctl_string) ||
-+ (table->strategy == sysctl_string_modpriv) ||
- (table->strategy == sysctl_intvec) ||
- (table->strategy == sysctl_jiffies) ||
- (table->strategy == sysctl_ms_jiffies) ||
- (table->proc_handler == proc_dostring) ||
-+ (table->proc_handler == proc_dostring_modpriv) ||
- (table->proc_handler == proc_dointvec) ||
- (table->proc_handler == proc_dointvec_minmax) ||
- (table->proc_handler == proc_dointvec_jiffies) ||
-diff --git a/kernel/taskstats.c b/kernel/taskstats.c
-index a4ef542..798bcd7 100644
---- a/kernel/taskstats.c
-+++ b/kernel/taskstats.c
-@@ -26,9 +26,12 @@
- #include <linux/cgroup.h>
- #include <linux/fs.h>
- #include <linux/file.h>
-+#include <linux/grsecurity.h>
- #include <net/genetlink.h>
- #include <asm/atomic.h>
-
-+extern int gr_is_taskstats_denied(int pid);
-+
- /*
- * Maximum length of a cpumask that can be specified in
- * the TASKSTATS_CMD_ATTR_REGISTER/DEREGISTER_CPUMASK attribute
-@@ -442,6 +445,9 @@ static int taskstats_user_cmd(struct sk_buff *skb, struct genl_info *info)
- size_t size;
- cpumask_var_t mask;
-
-+ if (gr_is_taskstats_denied(current->pid))
-+ return -EACCES;
-+
- if (!alloc_cpumask_var(&mask, GFP_KERNEL))
- return -ENOMEM;
-
-diff --git a/kernel/time.c b/kernel/time.c
-index 33df60e..ca768bd 100644
---- a/kernel/time.c
-+++ b/kernel/time.c
-@@ -165,6 +165,11 @@ int do_sys_settimeofday(struct timespec *tv, struct timezone *tz)
- return error;
-
- if (tz) {
-+ /* we log in do_settimeofday called below, so don't log twice
-+ */
-+ if (!tv)
-+ gr_log_timechange();
-+
- /* SMP safe, global irq locking makes it work. */
- sys_tz = *tz;
- update_vsyscall_tz();
-@@ -240,7 +245,7 @@ EXPORT_SYMBOL(current_fs_time);
- * Avoid unnecessary multiplications/divisions in the
- * two most common HZ cases:
- */
--unsigned int inline jiffies_to_msecs(const unsigned long j)
-+inline unsigned int jiffies_to_msecs(const unsigned long j)
- {
- #if HZ <= MSEC_PER_SEC && !(MSEC_PER_SEC % HZ)
- return (MSEC_PER_SEC / HZ) * j;
-@@ -256,7 +261,7 @@ unsigned int inline jiffies_to_msecs(const unsigned long j)
- }
- EXPORT_SYMBOL(jiffies_to_msecs);
-
--unsigned int inline jiffies_to_usecs(const unsigned long j)
-+inline unsigned int jiffies_to_usecs(const unsigned long j)
- {
- #if HZ <= USEC_PER_SEC && !(USEC_PER_SEC % HZ)
- return (USEC_PER_SEC / HZ) * j;
-diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
-index 57b953f..06f149f 100644
---- a/kernel/time/tick-broadcast.c
-+++ b/kernel/time/tick-broadcast.c
-@@ -116,7 +116,7 @@ int tick_device_uses_broadcast(struct clock_event_device *dev, int cpu)
- * then clear the broadcast bit.
- */
- if (!(dev->features & CLOCK_EVT_FEAT_C3STOP)) {
-- int cpu = smp_processor_id();
-+ cpu = smp_processor_id();
-
- cpumask_clear_cpu(cpu, tick_get_broadcast_mask());
- tick_broadcast_clear_oneshot(cpu);
-diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
-index 3d35af3..7936e72 100644
---- a/kernel/time/timekeeping.c
-+++ b/kernel/time/timekeeping.c
-@@ -14,6 +14,7 @@
- #include <linux/init.h>
- #include <linux/mm.h>
- #include <linux/sched.h>
-+#include <linux/grsecurity.h>
- #include <linux/sysdev.h>
- #include <linux/clocksource.h>
- #include <linux/jiffies.h>
-@@ -208,7 +209,7 @@ void update_xtime_cache(u64 nsec)
- */
- struct timespec ts = xtime;
- timespec_add_ns(&ts, nsec);
-- ACCESS_ONCE(xtime_cache) = ts;
-+ ACCESS_ONCE_RW(xtime_cache) = ts;
- }
-
- #ifdef CONFIG_GENERIC_TIME
-@@ -357,6 +358,8 @@ int do_settimeofday(struct timespec *tv)
- if (!timespec_valid_strict(tv))
- return -EINVAL;
-
-+ gr_log_timechange();
-+
- write_seqlock_irqsave(&xtime_lock, flags);
-
- timekeeping_forward_now();
-diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c
-index 54c0dda..e9095d9 100644
---- a/kernel/time/timer_list.c
-+++ b/kernel/time/timer_list.c
-@@ -38,12 +38,16 @@ DECLARE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases);
-
- static void print_name_offset(struct seq_file *m, void *sym)
- {
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ SEQ_printf(m, "<%p>", NULL);
-+#else
- char symname[KSYM_NAME_LEN];
-
- if (lookup_symbol_name((unsigned long)sym, symname) < 0)
- SEQ_printf(m, "<%p>", sym);
- else
- SEQ_printf(m, "%s", symname);
-+#endif
- }
-
- static void
-@@ -112,7 +116,11 @@ next_one:
- static void
- print_base(struct seq_file *m, struct hrtimer_clock_base *base, u64 now)
- {
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ SEQ_printf(m, " .base: %p\n", NULL);
-+#else
- SEQ_printf(m, " .base: %p\n", base);
-+#endif
- SEQ_printf(m, " .index: %d\n",
- base->index);
- SEQ_printf(m, " .resolution: %Lu nsecs\n",
-@@ -289,7 +297,11 @@ static int __init init_timer_list_procfs(void)
- {
- struct proc_dir_entry *pe;
-
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+ pe = proc_create("timer_list", 0400, NULL, &timer_list_fops);
-+#else
- pe = proc_create("timer_list", 0444, NULL, &timer_list_fops);
-+#endif
- if (!pe)
- return -ENOMEM;
- return 0;
-diff --git a/kernel/time/timer_stats.c b/kernel/time/timer_stats.c
-index ee5681f..862e921 100644
---- a/kernel/time/timer_stats.c
-+++ b/kernel/time/timer_stats.c
-@@ -116,7 +116,7 @@ static ktime_t time_start, time_stop;
- static unsigned long nr_entries;
- static struct entry entries[MAX_ENTRIES];
-
--static atomic_t overflow_count;
-+static atomic_unchecked_t overflow_count;
-
- /*
- * The entries are in a hash-table, for fast lookup:
-@@ -140,7 +140,7 @@ static void reset_entries(void)
- nr_entries = 0;
- memset(entries, 0, sizeof(entries));
- memset(tstat_hash_table, 0, sizeof(tstat_hash_table));
-- atomic_set(&overflow_count, 0);
-+ atomic_set_unchecked(&overflow_count, 0);
- }
-
- static struct entry *alloc_entry(void)
-@@ -261,7 +261,7 @@ void timer_stats_update_stats(void *timer, pid_t pid, void *startf,
- if (likely(entry))
- entry->count++;
- else
-- atomic_inc(&overflow_count);
-+ atomic_inc_unchecked(&overflow_count);
-
- out_unlock:
- spin_unlock_irqrestore(lock, flags);
-@@ -269,12 +269,16 @@ void timer_stats_update_stats(void *timer, pid_t pid, void *startf,
-
- static void print_name_offset(struct seq_file *m, unsigned long addr)
- {
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ seq_printf(m, "<%p>", NULL);
-+#else
- char symname[KSYM_NAME_LEN];
-
- if (lookup_symbol_name(addr, symname) < 0)
-- seq_printf(m, "<%p>", (void *)addr);
-+ seq_printf(m, "<%pK>", (void *)addr);
- else
- seq_printf(m, "%s", symname);
-+#endif
- }
-
- static int tstats_show(struct seq_file *m, void *v)
-@@ -300,9 +304,9 @@ static int tstats_show(struct seq_file *m, void *v)
-
- seq_puts(m, "Timer Stats Version: v0.2\n");
- seq_printf(m, "Sample period: %ld.%03ld s\n", period.tv_sec, ms);
-- if (atomic_read(&overflow_count))
-+ if (atomic_read_unchecked(&overflow_count))
- seq_printf(m, "Overflow: %d entries\n",
-- atomic_read(&overflow_count));
-+ atomic_read_unchecked(&overflow_count));
-
- for (i = 0; i < nr_entries; i++) {
- entry = entries + i;
-@@ -415,7 +419,11 @@ static int __init init_tstats_procfs(void)
- {
- struct proc_dir_entry *pe;
-
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+ pe = proc_create("timer_stats", 0600, NULL, &tstats_fops);
-+#else
- pe = proc_create("timer_stats", 0644, NULL, &tstats_fops);
-+#endif
- if (!pe)
- return -ENOMEM;
- return 0;
-diff --git a/kernel/timer.c b/kernel/timer.c
-index cb3c1f1..e643008 100644
---- a/kernel/timer.c
-+++ b/kernel/timer.c
-@@ -1213,7 +1213,7 @@ void update_process_times(int user_tick)
- /*
- * This function runs timers and the timer-tq in bottom half context.
- */
--static void run_timer_softirq(struct softirq_action *h)
-+static void run_timer_softirq(void)
- {
- struct tvec_base *base = __get_cpu_var(tvec_bases);
-
-@@ -1645,7 +1645,7 @@ static int __cpuinit timer_cpu_notify(struct notifier_block *self,
- return NOTIFY_OK;
- }
-
--static struct notifier_block __cpuinitdata timers_nb = {
-+static struct notifier_block __cpuinitconst timers_nb = {
- .notifier_call = timer_cpu_notify,
- };
-
-diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
-index d9d6206..f19467e 100644
---- a/kernel/trace/blktrace.c
-+++ b/kernel/trace/blktrace.c
-@@ -313,7 +313,7 @@ static ssize_t blk_dropped_read(struct file *filp, char __user *buffer,
- struct blk_trace *bt = filp->private_data;
- char buf[16];
-
-- snprintf(buf, sizeof(buf), "%u\n", atomic_read(&bt->dropped));
-+ snprintf(buf, sizeof(buf), "%u\n", atomic_read_unchecked(&bt->dropped));
-
- return simple_read_from_buffer(buffer, count, ppos, buf, strlen(buf));
- }
-@@ -376,7 +376,7 @@ static int blk_subbuf_start_callback(struct rchan_buf *buf, void *subbuf,
- return 1;
-
- bt = buf->chan->private_data;
-- atomic_inc(&bt->dropped);
-+ atomic_inc_unchecked(&bt->dropped);
- return 0;
- }
-
-@@ -477,7 +477,7 @@ int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
-
- bt->dir = dir;
- bt->dev = dev;
-- atomic_set(&bt->dropped, 0);
-+ atomic_set_unchecked(&bt->dropped, 0);
-
- ret = -EIO;
- bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt,
-diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
-index 4872937..26ba80f 100644
---- a/kernel/trace/ftrace.c
-+++ b/kernel/trace/ftrace.c
-@@ -1100,13 +1100,18 @@ ftrace_code_disable(struct module *mod, struct dyn_ftrace *rec)
-
- ip = rec->ip;
-
-+ ret = ftrace_arch_code_modify_prepare();
-+ FTRACE_WARN_ON(ret);
-+ if (ret)
-+ return 0;
-+
- ret = ftrace_make_nop(mod, rec, MCOUNT_ADDR);
-+ FTRACE_WARN_ON(ftrace_arch_code_modify_post_process());
- if (ret) {
- ftrace_bug(ret, ip);
- rec->flags |= FTRACE_FL_FAILED;
-- return 0;
- }
-- return 1;
-+ return ret ? 0 : 1;
- }
-
- /*
-@@ -2726,7 +2731,7 @@ static int ftrace_module_notify(struct notifier_block *self,
-
- struct notifier_block ftrace_module_nb = {
- .notifier_call = ftrace_module_notify,
-- .priority = 0,
-+ .priority = INT_MAX, /* Run before anything that can use kprobes */
- };
-
- extern unsigned long __start_mcount_loc[];
-@@ -3068,8 +3073,6 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,
- #ifdef CONFIG_FUNCTION_GRAPH_TRACER
-
- static int ftrace_graph_active;
--static struct notifier_block ftrace_suspend_notifier;
--
- int ftrace_graph_entry_stub(struct ftrace_graph_ent *trace)
- {
- return 0;
-@@ -3213,6 +3216,10 @@ ftrace_suspend_notifier_call(struct notifier_block *bl, unsigned long state,
- return NOTIFY_DONE;
- }
-
-+static struct notifier_block ftrace_suspend_notifier = {
-+ .notifier_call = ftrace_suspend_notifier_call
-+};
-+
- int register_ftrace_graph(trace_func_graph_ret_t retfunc,
- trace_func_graph_ent_t entryfunc)
- {
-@@ -3226,7 +3233,6 @@ int register_ftrace_graph(trace_func_graph_ret_t retfunc,
- goto out;
- }
-
-- ftrace_suspend_notifier.notifier_call = ftrace_suspend_notifier_call;
- register_pm_notifier(&ftrace_suspend_notifier);
-
- ftrace_graph_active++;
-diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
-index e749a05..029a15b 100644
---- a/kernel/trace/ring_buffer.c
-+++ b/kernel/trace/ring_buffer.c
-@@ -325,9 +325,9 @@ struct buffer_data_page {
- */
- struct buffer_page {
- struct list_head list; /* list of buffer pages */
-- local_t write; /* index for next write */
-+ local_unchecked_t write; /* index for next write */
- unsigned read; /* index for next read */
-- local_t entries; /* entries on this page */
-+ local_unchecked_t entries; /* entries on this page */
- struct buffer_data_page *page; /* Actual data page */
- };
-
-@@ -427,8 +427,8 @@ struct ring_buffer_per_cpu {
- struct buffer_page *tail_page; /* write to tail */
- struct buffer_page *commit_page; /* committed pages */
- struct buffer_page *reader_page;
-- local_t commit_overrun;
-- local_t overrun;
-+ local_unchecked_t commit_overrun;
-+ local_unchecked_t overrun;
- local_t entries;
- local_t committing;
- local_t commits;
-@@ -606,7 +606,7 @@ static struct list_head *rb_list_head(struct list_head *list)
- * the reader page). But if the next page is a header page,
- * its flags will be non zero.
- */
--static int inline
-+static inline int
- rb_is_head_page(struct ring_buffer_per_cpu *cpu_buffer,
- struct buffer_page *page, struct list_head *list)
- {
-@@ -820,8 +820,8 @@ static int rb_tail_page_update(struct ring_buffer_per_cpu *cpu_buffer,
- *
- * We add a counter to the write field to denote this.
- */
-- old_write = local_add_return(RB_WRITE_INTCNT, &next_page->write);
-- old_entries = local_add_return(RB_WRITE_INTCNT, &next_page->entries);
-+ old_write = local_add_return_unchecked(RB_WRITE_INTCNT, &next_page->write);
-+ old_entries = local_add_return_unchecked(RB_WRITE_INTCNT, &next_page->entries);
-
- /*
- * Just make sure we have seen our old_write and synchronize
-@@ -849,8 +849,8 @@ static int rb_tail_page_update(struct ring_buffer_per_cpu *cpu_buffer,
- * cmpxchg to only update if an interrupt did not already
- * do it for us. If the cmpxchg fails, we don't care.
- */
-- (void)local_cmpxchg(&next_page->write, old_write, val);
-- (void)local_cmpxchg(&next_page->entries, old_entries, eval);
-+ (void)local_cmpxchg_unchecked(&next_page->write, old_write, val);
-+ (void)local_cmpxchg_unchecked(&next_page->entries, old_entries, eval);
-
- /*
- * No need to worry about races with clearing out the commit.
-@@ -1397,7 +1397,7 @@ rb_iter_head_event(struct ring_buffer_iter *iter)
-
- static inline unsigned long rb_page_write(struct buffer_page *bpage)
- {
-- return local_read(&bpage->write) & RB_WRITE_MASK;
-+ return local_read_unchecked(&bpage->write) & RB_WRITE_MASK;
- }
-
- static inline unsigned rb_page_commit(struct buffer_page *bpage)
-@@ -1407,7 +1407,7 @@ static inline unsigned rb_page_commit(struct buffer_page *bpage)
-
- static inline unsigned long rb_page_entries(struct buffer_page *bpage)
- {
-- return local_read(&bpage->entries) & RB_WRITE_MASK;
-+ return local_read_unchecked(&bpage->entries) & RB_WRITE_MASK;
- }
-
- /* Size is determined by what has been commited */
-@@ -1603,7 +1603,7 @@ rb_handle_head_page(struct ring_buffer_per_cpu *cpu_buffer,
- * it is our responsibility to update
- * the counters.
- */
-- local_add(entries, &cpu_buffer->overrun);
-+ local_add_unchecked(entries, &cpu_buffer->overrun);
-
- /*
- * The entries will be zeroed out when we move the
-@@ -1744,7 +1744,7 @@ rb_reset_tail(struct ring_buffer_per_cpu *cpu_buffer,
- * must fill the old tail_page with padding.
- */
- if (tail >= BUF_PAGE_SIZE) {
-- local_sub(length, &tail_page->write);
-+ local_sub_unchecked(length, &tail_page->write);
- return;
- }
-
-@@ -1769,7 +1769,7 @@ rb_reset_tail(struct ring_buffer_per_cpu *cpu_buffer,
- rb_event_set_padding(event);
-
- /* Set the write back to the previous setting */
-- local_sub(length, &tail_page->write);
-+ local_sub_unchecked(length, &tail_page->write);
- return;
- }
-
-@@ -1781,7 +1781,7 @@ rb_reset_tail(struct ring_buffer_per_cpu *cpu_buffer,
-
- /* Set write to end of buffer */
- length = (tail + length) - BUF_PAGE_SIZE;
-- local_sub(length, &tail_page->write);
-+ local_sub_unchecked(length, &tail_page->write);
- }
-
- static struct ring_buffer_event *
-@@ -1804,7 +1804,7 @@ rb_move_tail(struct ring_buffer_per_cpu *cpu_buffer,
- * about it.
- */
- if (unlikely(next_page == commit_page)) {
-- local_inc(&cpu_buffer->commit_overrun);
-+ local_inc_unchecked(&cpu_buffer->commit_overrun);
- goto out_reset;
- }
-
-@@ -1858,7 +1858,7 @@ rb_move_tail(struct ring_buffer_per_cpu *cpu_buffer,
- cpu_buffer->tail_page) &&
- (cpu_buffer->commit_page ==
- cpu_buffer->reader_page))) {
-- local_inc(&cpu_buffer->commit_overrun);
-+ local_inc_unchecked(&cpu_buffer->commit_overrun);
- goto out_reset;
- }
- }
-@@ -1900,7 +1900,7 @@ __rb_reserve_next(struct ring_buffer_per_cpu *cpu_buffer,
- /* we just need to protect against interrupts */
- barrier();
- tail_page = cpu_buffer->tail_page;
-- write = local_add_return(length, &tail_page->write);
-+ write = local_add_return_unchecked(length, &tail_page->write);
-
- /* set write to only the index of the write */
- write &= RB_WRITE_MASK;
-@@ -1919,7 +1919,7 @@ __rb_reserve_next(struct ring_buffer_per_cpu *cpu_buffer,
-
- /* The passed in type is zero for DATA */
- if (likely(!type))
-- local_inc(&tail_page->entries);
-+ local_inc_unchecked(&tail_page->entries);
-
- /*
- * If this is the first commit on the page, then update
-@@ -1949,7 +1949,7 @@ rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer,
-
- if (bpage->page == (void *)addr && rb_page_write(bpage) == old_index) {
- unsigned long write_mask =
-- local_read(&bpage->write) & ~RB_WRITE_MASK;
-+ local_read_unchecked(&bpage->write) & ~RB_WRITE_MASK;
- /*
- * This is on the tail page. It is possible that
- * a write could come in and move the tail page
-@@ -1958,7 +1958,7 @@ rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer,
- */
- old_index += write_mask;
- new_index += write_mask;
-- index = local_cmpxchg(&bpage->write, old_index, new_index);
-+ index = local_cmpxchg_unchecked(&bpage->write, old_index, new_index);
- if (index == old_index)
- return 1;
- }
-@@ -2363,7 +2363,7 @@ rb_decrement_entry(struct ring_buffer_per_cpu *cpu_buffer,
-
- /* Do the likely case first */
- if (likely(bpage->page == (void *)addr)) {
-- local_dec(&bpage->entries);
-+ local_dec_unchecked(&bpage->entries);
- return;
- }
-
-@@ -2375,7 +2375,7 @@ rb_decrement_entry(struct ring_buffer_per_cpu *cpu_buffer,
- start = bpage;
- do {
- if (bpage->page == (void *)addr) {
-- local_dec(&bpage->entries);
-+ local_dec_unchecked(&bpage->entries);
- return;
- }
- rb_inc_page(cpu_buffer, &bpage);
-@@ -2610,7 +2610,7 @@ unsigned long ring_buffer_entries_cpu(struct ring_buffer *buffer, int cpu)
- return 0;
-
- cpu_buffer = buffer->buffers[cpu];
-- ret = (local_read(&cpu_buffer->entries) - local_read(&cpu_buffer->overrun))
-+ ret = (local_read(&cpu_buffer->entries) - local_read_unchecked(&cpu_buffer->overrun))
- - cpu_buffer->read;
-
- return ret;
-@@ -2631,7 +2631,7 @@ unsigned long ring_buffer_overrun_cpu(struct ring_buffer *buffer, int cpu)
- return 0;
-
- cpu_buffer = buffer->buffers[cpu];
-- ret = local_read(&cpu_buffer->overrun);
-+ ret = local_read_unchecked(&cpu_buffer->overrun);
-
- return ret;
- }
-@@ -2652,7 +2652,7 @@ ring_buffer_commit_overrun_cpu(struct ring_buffer *buffer, int cpu)
- return 0;
-
- cpu_buffer = buffer->buffers[cpu];
-- ret = local_read(&cpu_buffer->commit_overrun);
-+ ret = local_read_unchecked(&cpu_buffer->commit_overrun);
-
- return ret;
- }
-@@ -2675,7 +2675,7 @@ unsigned long ring_buffer_entries(struct ring_buffer *buffer)
- for_each_buffer_cpu(buffer, cpu) {
- cpu_buffer = buffer->buffers[cpu];
- entries += (local_read(&cpu_buffer->entries) -
-- local_read(&cpu_buffer->overrun)) - cpu_buffer->read;
-+ local_read_unchecked(&cpu_buffer->overrun)) - cpu_buffer->read;
- }
-
- return entries;
-@@ -2698,7 +2698,7 @@ unsigned long ring_buffer_overruns(struct ring_buffer *buffer)
- /* if you care about this being correct, lock the buffer */
- for_each_buffer_cpu(buffer, cpu) {
- cpu_buffer = buffer->buffers[cpu];
-- overruns += local_read(&cpu_buffer->overrun);
-+ overruns += local_read_unchecked(&cpu_buffer->overrun);
- }
-
- return overruns;
-@@ -2867,8 +2867,8 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
- /*
- * Reset the reader page to size zero.
- */
-- local_set(&cpu_buffer->reader_page->write, 0);
-- local_set(&cpu_buffer->reader_page->entries, 0);
-+ local_set_unchecked(&cpu_buffer->reader_page->write, 0);
-+ local_set_unchecked(&cpu_buffer->reader_page->entries, 0);
- local_set(&cpu_buffer->reader_page->page->commit, 0);
-
- spin:
-@@ -3360,8 +3360,8 @@ rb_reset_cpu(struct ring_buffer_per_cpu *cpu_buffer)
-
- cpu_buffer->head_page
- = list_entry(cpu_buffer->pages, struct buffer_page, list);
-- local_set(&cpu_buffer->head_page->write, 0);
-- local_set(&cpu_buffer->head_page->entries, 0);
-+ local_set_unchecked(&cpu_buffer->head_page->write, 0);
-+ local_set_unchecked(&cpu_buffer->head_page->entries, 0);
- local_set(&cpu_buffer->head_page->page->commit, 0);
-
- cpu_buffer->head_page->read = 0;
-@@ -3370,13 +3370,13 @@ rb_reset_cpu(struct ring_buffer_per_cpu *cpu_buffer)
- cpu_buffer->commit_page = cpu_buffer->head_page;
-
- INIT_LIST_HEAD(&cpu_buffer->reader_page->list);
-- local_set(&cpu_buffer->reader_page->write, 0);
-- local_set(&cpu_buffer->reader_page->entries, 0);
-+ local_set_unchecked(&cpu_buffer->reader_page->write, 0);
-+ local_set_unchecked(&cpu_buffer->reader_page->entries, 0);
- local_set(&cpu_buffer->reader_page->page->commit, 0);
- cpu_buffer->reader_page->read = 0;
-
-- local_set(&cpu_buffer->commit_overrun, 0);
-- local_set(&cpu_buffer->overrun, 0);
-+ local_set_unchecked(&cpu_buffer->commit_overrun, 0);
-+ local_set_unchecked(&cpu_buffer->overrun, 0);
- local_set(&cpu_buffer->entries, 0);
- local_set(&cpu_buffer->committing, 0);
- local_set(&cpu_buffer->commits, 0);
-@@ -3752,8 +3752,8 @@ int ring_buffer_read_page(struct ring_buffer *buffer,
- rb_init_page(bpage);
- bpage = reader->page;
- reader->page = *data_page;
-- local_set(&reader->write, 0);
-- local_set(&reader->entries, 0);
-+ local_set_unchecked(&reader->write, 0);
-+ local_set_unchecked(&reader->entries, 0);
- reader->read = 0;
- *data_page = bpage;
- }
-diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
-index a2a2d1f..7f32b09 100644
---- a/kernel/trace/trace.c
-+++ b/kernel/trace/trace.c
-@@ -3193,6 +3193,8 @@ static ssize_t tracing_splice_read_pipe(struct file *filp,
- size_t rem;
- unsigned int i;
-
-+ pax_track_stack();
-+
- /* copy the tracer to avoid using a global lock all around */
- mutex_lock(&trace_types_lock);
- if (unlikely(old_tracer != current_trace && current_trace)) {
-@@ -3659,6 +3661,8 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
- int entries, size, i;
- size_t ret;
-
-+ pax_track_stack();
-+
- if (*ppos & (PAGE_SIZE - 1)) {
- WARN_ONCE(1, "Ftrace: previous read must page-align\n");
- return -EINVAL;
-@@ -3816,10 +3820,9 @@ static const struct file_operations tracing_dyn_info_fops = {
- };
- #endif
-
--static struct dentry *d_tracer;
--
- struct dentry *tracing_init_dentry(void)
- {
-+ static struct dentry *d_tracer;
- static int once;
-
- if (d_tracer)
-@@ -3839,10 +3842,9 @@ struct dentry *tracing_init_dentry(void)
- return d_tracer;
- }
-
--static struct dentry *d_percpu;
--
- struct dentry *tracing_dentry_percpu(void)
- {
-+ static struct dentry *d_percpu;
- static int once;
- struct dentry *d_tracer;
-
-diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
-index d128f65..f37b4af 100644
---- a/kernel/trace/trace_events.c
-+++ b/kernel/trace/trace_events.c
-@@ -951,13 +951,10 @@ static LIST_HEAD(ftrace_module_file_list);
- * Modules must own their file_operations to keep up with
- * reference counting.
- */
-+
- struct ftrace_module_file_ops {
- struct list_head list;
- struct module *mod;
-- struct file_operations id;
-- struct file_operations enable;
-- struct file_operations format;
-- struct file_operations filter;
- };
-
- static void remove_subsystem_dir(const char *name)
-@@ -1004,17 +1001,12 @@ trace_create_file_ops(struct module *mod)
-
- file_ops->mod = mod;
-
-- file_ops->id = ftrace_event_id_fops;
-- file_ops->id.owner = mod;
--
-- file_ops->enable = ftrace_enable_fops;
-- file_ops->enable.owner = mod;
--
-- file_ops->filter = ftrace_event_filter_fops;
-- file_ops->filter.owner = mod;
--
-- file_ops->format = ftrace_event_format_fops;
-- file_ops->format.owner = mod;
-+ pax_open_kernel();
-+ *(void **)&mod->trace_id.owner = mod;
-+ *(void **)&mod->trace_enable.owner = mod;
-+ *(void **)&mod->trace_filter.owner = mod;
-+ *(void **)&mod->trace_format.owner = mod;
-+ pax_close_kernel();
-
- list_add(&file_ops->list, &ftrace_module_file_list);
-
-@@ -1063,8 +1055,8 @@ static void trace_module_add_events(struct module *mod)
- call->mod = mod;
- list_add(&call->list, &ftrace_events);
- event_create_dir(call, d_events,
-- &file_ops->id, &file_ops->enable,
-- &file_ops->filter, &file_ops->format);
-+ &mod->trace_id, &mod->trace_enable,
-+ &mod->trace_filter, &mod->trace_format);
- }
- }
-
-diff --git a/kernel/trace/trace_mmiotrace.c b/kernel/trace/trace_mmiotrace.c
-index 0acd834..b800b56 100644
---- a/kernel/trace/trace_mmiotrace.c
-+++ b/kernel/trace/trace_mmiotrace.c
-@@ -23,7 +23,7 @@ struct header_iter {
- static struct trace_array *mmio_trace_array;
- static bool overrun_detected;
- static unsigned long prev_overruns;
--static atomic_t dropped_count;
-+static atomic_unchecked_t dropped_count;
-
- static void mmio_reset_data(struct trace_array *tr)
- {
-@@ -126,7 +126,7 @@ static void mmio_close(struct trace_iterator *iter)
-
- static unsigned long count_overruns(struct trace_iterator *iter)
- {
-- unsigned long cnt = atomic_xchg(&dropped_count, 0);
-+ unsigned long cnt = atomic_xchg_unchecked(&dropped_count, 0);
- unsigned long over = ring_buffer_overruns(iter->tr->buffer);
-
- if (over > prev_overruns)
-@@ -316,7 +316,7 @@ static void __trace_mmiotrace_rw(struct trace_array *tr,
- event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_RW,
- sizeof(*entry), 0, pc);
- if (!event) {
-- atomic_inc(&dropped_count);
-+ atomic_inc_unchecked(&dropped_count);
- return;
- }
- entry = ring_buffer_event_data(event);
-@@ -346,7 +346,7 @@ static void __trace_mmiotrace_map(struct trace_array *tr,
- event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_MAP,
- sizeof(*entry), 0, pc);
- if (!event) {
-- atomic_inc(&dropped_count);
-+ atomic_inc_unchecked(&dropped_count);
- return;
- }
- entry = ring_buffer_event_data(event);
-diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
-index b6c12c6..e61376e 100644
---- a/kernel/trace/trace_output.c
-+++ b/kernel/trace/trace_output.c
-@@ -237,7 +237,7 @@ int trace_seq_path(struct trace_seq *s, struct path *path)
- return 0;
- p = d_path(path, s->buffer + s->len, PAGE_SIZE - s->len);
- if (!IS_ERR(p)) {
-- p = mangle_path(s->buffer + s->len, p, "\n");
-+ p = mangle_path(s->buffer + s->len, p, "\n\\");
- if (p) {
- s->len = p - s->buffer;
- return 1;
-@@ -711,14 +711,16 @@ int register_ftrace_event(struct trace_event *event)
- goto out;
- }
-
-+ pax_open_kernel();
- if (event->trace == NULL)
-- event->trace = trace_nop_print;
-+ *(void **)&event->trace = trace_nop_print;
- if (event->raw == NULL)
-- event->raw = trace_nop_print;
-+ *(void **)&event->raw = trace_nop_print;
- if (event->hex == NULL)
-- event->hex = trace_nop_print;
-+ *(void **)&event->hex = trace_nop_print;
- if (event->binary == NULL)
-- event->binary = trace_nop_print;
-+ *(void **)&event->binary = trace_nop_print;
-+ pax_close_kernel();
-
- key = event->type & (EVENT_HASHSIZE - 1);
-
-diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
-index 8504ac7..ecf0adb 100644
---- a/kernel/trace/trace_stack.c
-+++ b/kernel/trace/trace_stack.c
-@@ -50,7 +50,7 @@ static inline void check_stack(void)
- return;
-
- /* we do not handle interrupt stacks yet */
-- if (!object_is_on_stack(&this_size))
-+ if (!object_starts_on_stack(&this_size))
- return;
-
- local_irq_save(flags);
-diff --git a/kernel/trace/trace_workqueue.c b/kernel/trace/trace_workqueue.c
-index 40cafb0..d5ead43 100644
---- a/kernel/trace/trace_workqueue.c
-+++ b/kernel/trace/trace_workqueue.c
-@@ -21,7 +21,7 @@ struct cpu_workqueue_stats {
- int cpu;
- pid_t pid;
- /* Can be inserted from interrupt or user context, need to be atomic */
-- atomic_t inserted;
-+ atomic_unchecked_t inserted;
- /*
- * Don't need to be atomic, works are serialized in a single workqueue thread
- * on a single CPU.
-@@ -58,7 +58,7 @@ probe_workqueue_insertion(struct task_struct *wq_thread,
- spin_lock_irqsave(&workqueue_cpu_stat(cpu)->lock, flags);
- list_for_each_entry(node, &workqueue_cpu_stat(cpu)->list, list) {
- if (node->pid == wq_thread->pid) {
-- atomic_inc(&node->inserted);
-+ atomic_inc_unchecked(&node->inserted);
- goto found;
- }
- }
-@@ -205,7 +205,7 @@ static int workqueue_stat_show(struct seq_file *s, void *p)
- tsk = get_pid_task(pid, PIDTYPE_PID);
- if (tsk) {
- seq_printf(s, "%3d %6d %6u %s\n", cws->cpu,
-- atomic_read(&cws->inserted), cws->executed,
-+ atomic_read_unchecked(&cws->inserted), cws->executed,
- tsk->comm);
- put_task_struct(tsk);
- }
-diff --git a/kernel/user.c b/kernel/user.c
-index 1b91701..8795237 100644
---- a/kernel/user.c
-+++ b/kernel/user.c
-@@ -159,6 +159,7 @@ struct user_struct *alloc_uid(struct user_namespace *ns, uid_t uid)
- spin_lock_irq(&uidhash_lock);
- up = uid_hash_find(uid, hashent);
- if (up) {
-+ put_user_ns(ns);
- key_put(new->uid_keyring);
- key_put(new->session_keyring);
- kmem_cache_free(uid_cachep, new);
-diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
-index 234ceb1..ad74049 100644
---- a/lib/Kconfig.debug
-+++ b/lib/Kconfig.debug
-@@ -905,7 +905,7 @@ config LATENCYTOP
- select STACKTRACE
- select SCHEDSTATS
- select SCHED_DEBUG
-- depends on HAVE_LATENCYTOP_SUPPORT
-+ depends on HAVE_LATENCYTOP_SUPPORT && !GRKERNSEC_HIDESYM
- help
- Enable this option if you want to use the LatencyTOP tool
- to find out which userspace is blocking on what kernel operations.
-diff --git a/lib/Makefile b/lib/Makefile
-index 5ecf2ba..dcd31ba 100644
---- a/lib/Makefile
-+++ b/lib/Makefile
-@@ -42,7 +42,7 @@ obj-$(CONFIG_GENERIC_FIND_LAST_BIT) += find_last_bit.o
- obj-$(CONFIG_GENERIC_HWEIGHT) += hweight.o
- obj-$(CONFIG_LOCK_KERNEL) += kernel_lock.o
- obj-$(CONFIG_DEBUG_PREEMPT) += smp_processor_id.o
--obj-$(CONFIG_DEBUG_LIST) += list_debug.o
-+obj-y += list_debug.o
- obj-$(CONFIG_DEBUG_OBJECTS) += debugobjects.o
-
- ifneq ($(CONFIG_HAVE_DEC_LOCK),y)
-diff --git a/lib/bitmap.c b/lib/bitmap.c
-index 7025658..8d14cab 100644
---- a/lib/bitmap.c
-+++ b/lib/bitmap.c
-@@ -341,7 +341,7 @@ int __bitmap_parse(const char *buf, unsigned int buflen,
- {
- int c, old_c, totaldigits, ndigits, nchunks, nbits;
- u32 chunk;
-- const char __user *ubuf = buf;
-+ const char __user *ubuf = (const char __force_user *)buf;
-
- bitmap_zero(maskp, nmaskbits);
-
-@@ -426,7 +426,7 @@ int bitmap_parse_user(const char __user *ubuf,
- {
- if (!access_ok(VERIFY_READ, ubuf, ulen))
- return -EFAULT;
-- return __bitmap_parse((const char *)ubuf, ulen, 1, maskp, nmaskbits);
-+ return __bitmap_parse((const char __force_kernel *)ubuf, ulen, 1, maskp, nmaskbits);
- }
- EXPORT_SYMBOL(bitmap_parse_user);
-
-diff --git a/lib/bug.c b/lib/bug.c
-index 300e41a..2779eb0 100644
---- a/lib/bug.c
-+++ b/lib/bug.c
-@@ -135,6 +135,8 @@ enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs)
- return BUG_TRAP_TYPE_NONE;
-
- bug = find_bug(bugaddr);
-+ if (!bug)
-+ return BUG_TRAP_TYPE_NONE;
-
- printk(KERN_EMERG "------------[ cut here ]------------\n");
-
-diff --git a/lib/debugobjects.c b/lib/debugobjects.c
-index 2b413db..e21d207 100644
---- a/lib/debugobjects.c
-+++ b/lib/debugobjects.c
-@@ -277,7 +277,7 @@ static void debug_object_is_on_stack(void *addr, int onstack)
- if (limit > 4)
- return;
-
-- is_on_stack = object_is_on_stack(addr);
-+ is_on_stack = object_starts_on_stack(addr);
- if (is_on_stack == onstack)
- return;
-
-diff --git a/lib/devres.c b/lib/devres.c
-index 72c8909..7543868 100644
---- a/lib/devres.c
-+++ b/lib/devres.c
-@@ -80,7 +80,7 @@ void devm_iounmap(struct device *dev, void __iomem *addr)
- {
- iounmap(addr);
- WARN_ON(devres_destroy(dev, devm_ioremap_release, devm_ioremap_match,
-- (void *)addr));
-+ (void __force *)addr));
- }
- EXPORT_SYMBOL(devm_iounmap);
-
-@@ -140,7 +140,7 @@ void devm_ioport_unmap(struct device *dev, void __iomem *addr)
- {
- ioport_unmap(addr);
- WARN_ON(devres_destroy(dev, devm_ioport_map_release,
-- devm_ioport_map_match, (void *)addr));
-+ devm_ioport_map_match, (void __force *)addr));
- }
- EXPORT_SYMBOL(devm_ioport_unmap);
-
-diff --git a/lib/div64.c b/lib/div64.c
-index a111eb8..5b49191 100644
---- a/lib/div64.c
-+++ b/lib/div64.c
-@@ -77,26 +77,58 @@ s64 div_s64_rem(s64 dividend, s32 divisor, s32 *remainder)
- EXPORT_SYMBOL(div_s64_rem);
- #endif
-
--/* 64bit divisor, dividend and result. dynamic precision */
-+/**
-+ * div64_u64 - unsigned 64bit divide with 64bit divisor
-+ * @dividend: 64bit dividend
-+ * @divisor: 64bit divisor
-+ *
-+ * This implementation is a modified version of the algorithm proposed
-+ * by the book 'Hacker's Delight'. The original source and full proof
-+ * can be found here and is available for use without restriction.
-+ *
-+ * 'http://www.hackersdelight.org/HDcode/newCode/divDouble.c'
-+ */
- #ifndef div64_u64
- u64 div64_u64(u64 dividend, u64 divisor)
- {
-- u32 high, d;
-+ u32 high = divisor >> 32;
-+ u64 quot;
-
-- high = divisor >> 32;
-- if (high) {
-- unsigned int shift = fls(high);
-+ if (high == 0) {
-+ quot = div_u64(dividend, divisor);
-+ } else {
-+ int n = 1 + fls(high);
-+ quot = div_u64(dividend >> n, divisor >> n);
-
-- d = divisor >> shift;
-- dividend >>= shift;
-- } else
-- d = divisor;
-+ if (quot != 0)
-+ quot--;
-+ if ((dividend - quot * divisor) >= divisor)
-+ quot++;
-+ }
-
-- return div_u64(dividend, d);
-+ return quot;
- }
- EXPORT_SYMBOL(div64_u64);
- #endif
-
-+/**
-+ * div64_s64 - signed 64bit divide with 64bit divisor
-+ * @dividend: 64bit dividend
-+ * @divisor: 64bit divisor
-+ */
-+#ifndef div64_s64
-+s64 div64_s64(s64 dividend, s64 divisor)
-+{
-+ s64 quot, t;
-+
-+ quot = div64_u64(abs64(dividend), abs64(divisor));
-+ t = (dividend ^ divisor) >> 63;
-+
-+ return (quot ^ t) - t;
-+}
-+EXPORT_SYMBOL(div64_s64);
-+#endif
-+
- #endif /* BITS_PER_LONG == 32 */
-
- /*
-diff --git a/lib/dma-debug.c b/lib/dma-debug.c
-index 084e879..4f85cf6 100644
---- a/lib/dma-debug.c
-+++ b/lib/dma-debug.c
-@@ -696,7 +696,7 @@ static int dma_debug_device_change(struct notifier_block *nb, unsigned long acti
-
- void dma_debug_add_bus(struct bus_type *bus)
- {
-- struct notifier_block *nb;
-+ notifier_block_no_const *nb;
-
- if (global_disable)
- return;
-@@ -861,7 +861,7 @@ out:
-
- static void check_for_stack(struct device *dev, void *addr)
- {
-- if (object_is_on_stack(addr))
-+ if (object_starts_on_stack(addr))
- err_printk(dev, NULL, "DMA-API: device driver maps memory from"
- "stack [addr=%p]\n", addr);
- }
-diff --git a/lib/idr.c b/lib/idr.c
-index eda7ba3..915dfae 100644
---- a/lib/idr.c
-+++ b/lib/idr.c
-@@ -156,7 +156,7 @@ static int sub_alloc(struct idr *idp, int *starting_id, struct idr_layer **pa)
- id = (id | ((1 << (IDR_BITS * l)) - 1)) + 1;
-
- /* if already at the top layer, we need to grow */
-- if (id >= 1 << (idp->layers * IDR_BITS)) {
-+ if (id >= (1 << (idp->layers * IDR_BITS))) {
- *starting_id = id;
- return IDR_NEED_TO_GROW;
- }
-diff --git a/lib/inflate.c b/lib/inflate.c
-index d102559..4215f31 100644
---- a/lib/inflate.c
-+++ b/lib/inflate.c
-@@ -266,7 +266,7 @@ static void free(void *where)
- malloc_ptr = free_mem_ptr;
- }
- #else
--#define malloc(a) kmalloc(a, GFP_KERNEL)
-+#define malloc(a) kmalloc((a), GFP_KERNEL)
- #define free(a) kfree(a)
- #endif
-
-diff --git a/lib/ioremap.c b/lib/ioremap.c
-index 14c6078..65526a1 100644
---- a/lib/ioremap.c
-+++ b/lib/ioremap.c
-@@ -37,7 +37,7 @@ static inline int ioremap_pmd_range(pud_t *pud, unsigned long addr,
- unsigned long next;
-
- phys_addr -= addr;
-- pmd = pmd_alloc(&init_mm, pud, addr);
-+ pmd = pmd_alloc_kernel(&init_mm, pud, addr);
- if (!pmd)
- return -ENOMEM;
- do {
-@@ -55,7 +55,7 @@ static inline int ioremap_pud_range(pgd_t *pgd, unsigned long addr,
- unsigned long next;
-
- phys_addr -= addr;
-- pud = pud_alloc(&init_mm, pgd, addr);
-+ pud = pud_alloc_kernel(&init_mm, pgd, addr);
- if (!pud)
- return -ENOMEM;
- do {
-diff --git a/lib/is_single_threaded.c b/lib/is_single_threaded.c
-index bd2bea9..6b3c95e 100644
---- a/lib/is_single_threaded.c
-+++ b/lib/is_single_threaded.c
-@@ -22,6 +22,9 @@ bool current_is_single_threaded(void)
- struct task_struct *p, *t;
- bool ret;
-
-+ if (!mm)
-+ return true;
-+
- if (atomic_read(&task->signal->live) != 1)
- return false;
-
-diff --git a/lib/kobject.c b/lib/kobject.c
-index b512b74..8115eb1 100644
---- a/lib/kobject.c
-+++ b/lib/kobject.c
-@@ -700,7 +700,7 @@ static ssize_t kobj_attr_store(struct kobject *kobj, struct attribute *attr,
- return ret;
- }
-
--struct sysfs_ops kobj_sysfs_ops = {
-+const struct sysfs_ops kobj_sysfs_ops = {
- .show = kobj_attr_show,
- .store = kobj_attr_store,
- };
-@@ -789,7 +789,7 @@ static struct kobj_type kset_ktype = {
- * If the kset was not able to be created, NULL will be returned.
- */
- static struct kset *kset_create(const char *name,
-- struct kset_uevent_ops *uevent_ops,
-+ const struct kset_uevent_ops *uevent_ops,
- struct kobject *parent_kobj)
- {
- struct kset *kset;
-@@ -832,7 +832,7 @@ static struct kset *kset_create(const char *name,
- * If the kset was not able to be created, NULL will be returned.
- */
- struct kset *kset_create_and_add(const char *name,
-- struct kset_uevent_ops *uevent_ops,
-+ const struct kset_uevent_ops *uevent_ops,
- struct kobject *parent_kobj)
- {
- struct kset *kset;
-diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
-index 507b821..0bf8ed0 100644
---- a/lib/kobject_uevent.c
-+++ b/lib/kobject_uevent.c
-@@ -95,7 +95,7 @@ int kobject_uevent_env(struct kobject *kobj, enum kobject_action action,
- const char *subsystem;
- struct kobject *top_kobj;
- struct kset *kset;
-- struct kset_uevent_ops *uevent_ops;
-+ const struct kset_uevent_ops *uevent_ops;
- u64 seq;
- int i = 0;
- int retval = 0;
-diff --git a/lib/kref.c b/lib/kref.c
-index 9ecd6e8..12c94c1 100644
---- a/lib/kref.c
-+++ b/lib/kref.c
-@@ -61,7 +61,7 @@ void kref_get(struct kref *kref)
- */
- int kref_put(struct kref *kref, void (*release)(struct kref *kref))
- {
-- WARN_ON(release == NULL);
-+ BUG_ON(release == NULL);
- WARN_ON(release == (void (*)(struct kref *))kfree);
-
- if (atomic_dec_and_test(&kref->refcount)) {
-diff --git a/lib/list_debug.c b/lib/list_debug.c
-index 1a39f4e..bdc3153 100644
---- a/lib/list_debug.c
-+++ b/lib/list_debug.c
-@@ -8,7 +8,9 @@
-
- #include <linux/module.h>
- #include <linux/list.h>
-+#include <linux/mm.h>
-
-+#ifdef CONFIG_DEBUG_LIST
- /*
- * Insert a new entry between two known consecutive entries.
- *
-@@ -16,18 +18,31 @@
- * the prev/next entries already!
- */
-
--void __list_add(struct list_head *new,
-- struct list_head *prev,
-- struct list_head *next)
-+static bool __list_add_debug(struct list_head *new,
-+ struct list_head *prev,
-+ struct list_head *next)
- {
-- WARN(next->prev != prev,
-+ if (WARN(next->prev != prev,
- "list_add corruption. next->prev should be "
- "prev (%p), but was %p. (next=%p).\n",
-- prev, next->prev, next);
-- WARN(prev->next != next,
-+ prev, next->prev, next) ||
-+ WARN(prev->next != next,
- "list_add corruption. prev->next should be "
- "next (%p), but was %p. (prev=%p).\n",
-- next, prev->next, prev);
-+ next, prev->next, prev) ||
-+ WARN(new == prev || new == next,
-+ "list_add double add: new=%p, prev=%p, next=%p.\n",
-+ new, prev, next))
-+ return false;
-+ return true;
-+}
-+
-+void __list_add(struct list_head *new,
-+ struct list_head *prev,
-+ struct list_head *next)
-+{
-+ if (!__list_add_debug(new, prev, next))
-+ return;
- next->prev = new;
- new->next = next;
- new->prev = prev;
-@@ -41,16 +56,61 @@ EXPORT_SYMBOL(__list_add);
- * Note: list_empty on entry does not return true after this, the entry is
- * in an undefined state.
- */
--void list_del(struct list_head *entry)
-+static bool list_del_debug(struct list_head *entry)
- {
-- WARN(entry->prev->next != entry,
-+ if (WARN(entry->prev->next != entry,
- "list_del corruption. prev->next should be %p, "
-- "but was %p\n", entry, entry->prev->next);
-- WARN(entry->next->prev != entry,
-+ "but was %p\n", entry, entry->prev->next) ||
-+ WARN(entry->next->prev != entry,
- "list_del corruption. next->prev should be %p, "
-- "but was %p\n", entry, entry->next->prev);
-+ "but was %p\n", entry, entry->next->prev))
-+ return false;
-+ return true;
-+}
-+
-+void list_del(struct list_head *entry)
-+{
-+ if (!list_del_debug(entry))
-+ return;
- __list_del(entry->prev, entry->next);
- entry->next = LIST_POISON1;
- entry->prev = LIST_POISON2;
- }
- EXPORT_SYMBOL(list_del);
-+#endif
-+
-+void pax_list_add_tail(struct list_head *new, struct list_head *head)
-+{
-+ struct list_head *prev, *next;
-+
-+ prev = head->prev;
-+ next = head;
-+
-+#ifdef CONFIG_DEBUG_LIST
-+ if (!__list_add_debug(new, prev, next))
-+ return;
-+#endif
-+
-+ pax_open_kernel();
-+ next->prev = new;
-+ new->next = next;
-+ new->prev = prev;
-+ prev->next = new;
-+ pax_close_kernel();
-+}
-+EXPORT_SYMBOL(pax_list_add_tail);
-+
-+void pax_list_del(struct list_head *entry)
-+{
-+#ifdef CONFIG_DEBUG_LIST
-+ if (!list_del_debug(entry))
-+ return;
-+#endif
-+
-+ pax_open_kernel();
-+ __list_del(entry->prev, entry->next);
-+ entry->next = LIST_POISON1;
-+ entry->prev = LIST_POISON2;
-+ pax_close_kernel();
-+}
-+EXPORT_SYMBOL(pax_list_del);
-diff --git a/lib/radix-tree.c b/lib/radix-tree.c
-index 92cdd99..a8149d7 100644
---- a/lib/radix-tree.c
-+++ b/lib/radix-tree.c
-@@ -81,7 +81,7 @@ struct radix_tree_preload {
- int nr;
- struct radix_tree_node *nodes[RADIX_TREE_MAX_PATH];
- };
--static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads) = { 0, };
-+static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads);
-
- static inline gfp_t root_gfp_mask(struct radix_tree_root *root)
- {
-diff --git a/lib/random32.c b/lib/random32.c
-index 217d5c4..45aba8a 100644
---- a/lib/random32.c
-+++ b/lib/random32.c
-@@ -61,7 +61,7 @@ static u32 __random32(struct rnd_state *state)
- */
- static inline u32 __seed(u32 x, u32 m)
- {
-- return (x < m) ? x + m : x;
-+ return (x <= m) ? x + m + 1 : x;
- }
-
- /**
-diff --git a/lib/vsprintf.c b/lib/vsprintf.c
-index 33bed5e..8a1afdf 100644
---- a/lib/vsprintf.c
-+++ b/lib/vsprintf.c
-@@ -16,6 +16,9 @@
- * - scnprintf and vscnprintf
- */
-
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+#define __INCLUDED_BY_HIDESYM 1
-+#endif
- #include <stdarg.h>
- #include <linux/module.h>
- #include <linux/types.h>
-@@ -546,12 +549,12 @@ static char *number(char *buf, char *end, unsigned long long num,
- return buf;
- }
-
--static char *string(char *buf, char *end, char *s, struct printf_spec spec)
-+static char *string(char *buf, char *end, const char *s, struct printf_spec spec)
- {
- int len, i;
-
- if ((unsigned long)s < PAGE_SIZE)
-- s = "<NULL>";
-+ s = "(null)";
-
- len = strnlen(s, spec.precision);
-
-@@ -581,7 +584,7 @@ static char *symbol_string(char *buf, char *end, void *ptr,
- unsigned long value = (unsigned long) ptr;
- #ifdef CONFIG_KALLSYMS
- char sym[KSYM_SYMBOL_LEN];
-- if (ext != 'f' && ext != 's')
-+ if (ext != 'f' && ext != 's' && ext != 'a')
- sprint_symbol(sym, value);
- else
- kallsyms_lookup(value, NULL, NULL, NULL, sym);
-@@ -801,6 +804,8 @@ static char *ip4_addr_string(char *buf, char *end, const u8 *addr,
- * - 'f' For simple symbolic function names without offset
- * - 'S' For symbolic direct pointers with offset
- * - 's' For symbolic direct pointers without offset
-+ * - 'A' For symbolic direct pointers with offset approved for use with GRKERNSEC_HIDESYM
-+ * - 'a' For symbolic direct pointers without offset approved for use with GRKERNSEC_HIDESYM
- * - 'R' For a struct resource pointer, it prints the range of
- * addresses (not the name nor the flags)
- * - 'M' For a 6-byte MAC address, it prints the address in the
-@@ -822,7 +827,7 @@ static char *pointer(const char *fmt, char *buf, char *end, void *ptr,
- struct printf_spec spec)
- {
- if (!ptr)
-- return string(buf, end, "(null)", spec);
-+ return string(buf, end, "(nil)", spec);
-
- switch (*fmt) {
- case 'F':
-@@ -831,6 +836,14 @@ static char *pointer(const char *fmt, char *buf, char *end, void *ptr,
- case 's':
- /* Fallthrough */
- case 'S':
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ break;
-+#else
-+ return symbol_string(buf, end, ptr, spec, *fmt);
-+#endif
-+ case 'a':
-+ /* Fallthrough */
-+ case 'A':
- return symbol_string(buf, end, ptr, spec, *fmt);
- case 'R':
- return resource_string(buf, end, ptr, spec);
-@@ -853,7 +866,22 @@ static char *pointer(const char *fmt, char *buf, char *end, void *ptr,
- return ip4_addr_string(buf, end, ptr, spec, fmt);
- }
- break;
-+ case 'P':
-+ break;
- }
-+
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ /* 'P' = approved pointers to copy to userland,
-+ as in the /proc/kallsyms case, as we make it display nothing
-+ for non-root users, and the real contents for root users
-+ */
-+ if ((unsigned long)ptr > TASK_SIZE && *fmt != 'P' && is_usercopy_object(buf)) {
-+ printk(KERN_ALERT "grsec: kernel infoleak detected! Please report this log to spender@grsecurity.net.\n");
-+ dump_stack();
-+ ptr = NULL;
-+ }
-+#endif
-+
- spec.flags |= SMALL;
- if (spec.field_width == -1) {
- spec.field_width = 2*sizeof(void *);
-@@ -1445,7 +1473,7 @@ do { \
- size_t len;
- if ((unsigned long)save_str > (unsigned long)-PAGE_SIZE
- || (unsigned long)save_str < PAGE_SIZE)
-- save_str = "<NULL>";
-+ save_str = "(null)";
- len = strlen(save_str);
- if (str + len + 1 < end)
- memcpy(str, save_str, len + 1);
-@@ -1555,11 +1583,11 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
- typeof(type) value; \
- if (sizeof(type) == 8) { \
- args = PTR_ALIGN(args, sizeof(u32)); \
-- *(u32 *)&value = *(u32 *)args; \
-- *((u32 *)&value + 1) = *(u32 *)(args + 4); \
-+ *(u32 *)&value = *(const u32 *)args; \
-+ *((u32 *)&value + 1) = *(const u32 *)(args + 4); \
- } else { \
- args = PTR_ALIGN(args, sizeof(type)); \
-- value = *(typeof(type) *)args; \
-+ value = *(const typeof(type) *)args; \
- } \
- args += sizeof(type); \
- value; \
-@@ -1622,7 +1650,7 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
- const char *str_arg = args;
- size_t len = strlen(str_arg);
- args += len + 1;
-- str = string(str, end, (char *)str_arg, spec);
-+ str = string(str, end, str_arg, spec);
- break;
- }
-
-diff --git a/localversion-grsec b/localversion-grsec
-new file mode 100644
-index 0000000..7cd6065
---- /dev/null
-+++ b/localversion-grsec
-@@ -0,0 +1 @@
-+-grsec
-diff --git a/mm/Kconfig b/mm/Kconfig
-index 2c19c0b..f3c3f83 100644
---- a/mm/Kconfig
-+++ b/mm/Kconfig
-@@ -228,7 +228,7 @@ config KSM
- config DEFAULT_MMAP_MIN_ADDR
- int "Low address space to protect from user allocation"
- depends on MMU
-- default 4096
-+ default 65536
- help
- This is the portion of low virtual memory which should be protected
- from userspace allocation. Keeping a user from writing to low pages
-diff --git a/mm/backing-dev.c b/mm/backing-dev.c
-index d824401..9f5244a 100644
---- a/mm/backing-dev.c
-+++ b/mm/backing-dev.c
-@@ -271,7 +271,7 @@ static void bdi_task_init(struct backing_dev_info *bdi,
- list_add_tail_rcu(&wb->list, &bdi->wb_list);
- spin_unlock(&bdi->wb_lock);
-
-- tsk->flags |= PF_FLUSHER | PF_SWAPWRITE;
-+ tsk->flags |= PF_SWAPWRITE;
- set_freezable();
-
- /*
-@@ -489,7 +489,7 @@ static void bdi_add_to_pending(struct rcu_head *head)
- * Add the default flusher task that gets created for any bdi
- * that has dirty data pending writeout
- */
--void static bdi_add_default_flusher_task(struct backing_dev_info *bdi)
-+static void bdi_add_default_flusher_task(struct backing_dev_info *bdi)
- {
- if (!bdi_cap_writeback_dirty(bdi))
- return;
-diff --git a/mm/filemap.c b/mm/filemap.c
-index a1fe378..e26702f 100644
---- a/mm/filemap.c
-+++ b/mm/filemap.c
-@@ -1631,7 +1631,7 @@ int generic_file_mmap(struct file * file, struct vm_area_struct * vma)
- struct address_space *mapping = file->f_mapping;
-
- if (!mapping->a_ops->readpage)
-- return -ENOEXEC;
-+ return -ENODEV;
- file_accessed(file);
- vma->vm_ops = &generic_file_vm_ops;
- vma->vm_flags |= VM_CAN_NONLINEAR;
-@@ -2024,6 +2024,7 @@ inline int generic_write_checks(struct file *file, loff_t *pos, size_t *count, i
- *pos = i_size_read(inode);
-
- if (limit != RLIM_INFINITY) {
-+ gr_learn_resource(current, RLIMIT_FSIZE,*pos, 0);
- if (*pos >= limit) {
- send_sig(SIGXFSZ, current, 0);
- return -EFBIG;
-diff --git a/mm/fremap.c b/mm/fremap.c
-index b6ec85a..a24ac22 100644
---- a/mm/fremap.c
-+++ b/mm/fremap.c
-@@ -153,6 +153,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
- retry:
- vma = find_vma(mm, start);
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (vma && (mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_MAYEXEC))
-+ goto out;
-+#endif
-+
- /*
- * Make sure the vma is shared, that it supports prefaulting,
- * and that the remapped range is valid and fully within
-@@ -221,7 +226,7 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
- /*
- * drop PG_Mlocked flag for over-mapped range
- */
-- unsigned int saved_flags = vma->vm_flags;
-+ unsigned long saved_flags = vma->vm_flags;
- munlock_vma_pages_range(vma, start, start + size);
- vma->vm_flags = saved_flags;
- }
-diff --git a/mm/highmem.c b/mm/highmem.c
-index 9c1e627..5ca9447 100644
---- a/mm/highmem.c
-+++ b/mm/highmem.c
-@@ -116,9 +116,10 @@ static void flush_all_zero_pkmaps(void)
- * So no dangers, even with speculative execution.
- */
- page = pte_page(pkmap_page_table[i]);
-+ pax_open_kernel();
- pte_clear(&init_mm, (unsigned long)page_address(page),
- &pkmap_page_table[i]);
--
-+ pax_close_kernel();
- set_page_address(page, NULL);
- need_flush = 1;
- }
-@@ -177,9 +178,11 @@ start:
- }
- }
- vaddr = PKMAP_ADDR(last_pkmap_nr);
-+
-+ pax_open_kernel();
- set_pte_at(&init_mm, vaddr,
- &(pkmap_page_table[last_pkmap_nr]), mk_pte(page, kmap_prot));
--
-+ pax_close_kernel();
- pkmap_count[last_pkmap_nr] = 1;
- set_page_address(page, (void *)vaddr);
-
-diff --git a/mm/hugetlb.c b/mm/hugetlb.c
-index 20f9240..0c488e1 100644
---- a/mm/hugetlb.c
-+++ b/mm/hugetlb.c
-@@ -1772,6 +1772,15 @@ static void hugetlb_vm_op_open(struct vm_area_struct *vma)
- kref_get(&reservations->refs);
- }
-
-+static void resv_map_put(struct vm_area_struct *vma)
-+{
-+ struct resv_map *reservations = vma_resv_map(vma);
-+
-+ if (!reservations)
-+ return;
-+ kref_put(&reservations->refs, resv_map_release);
-+}
-+
- static void hugetlb_vm_op_close(struct vm_area_struct *vma)
- {
- struct hstate *h = hstate_vma(vma);
-@@ -1788,7 +1797,7 @@ static void hugetlb_vm_op_close(struct vm_area_struct *vma)
- reserve = (end - start) -
- region_count(&reservations->regions, start, end);
-
-- kref_put(&reservations->refs, resv_map_release);
-+ resv_map_put(vma);
-
- if (reserve) {
- hugetlb_acct_memory(h, -reserve);
-@@ -2012,6 +2021,26 @@ static int unmap_ref_private(struct mm_struct *mm, struct vm_area_struct *vma,
- return 1;
- }
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+static void pax_mirror_huge_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m)
-+{
-+ struct mm_struct *mm = vma->vm_mm;
-+ struct vm_area_struct *vma_m;
-+ unsigned long address_m;
-+ pte_t *ptep_m;
-+
-+ vma_m = pax_find_mirror_vma(vma);
-+ if (!vma_m)
-+ return;
-+
-+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
-+ address_m = address + SEGMEXEC_TASK_SIZE;
-+ ptep_m = huge_pte_offset(mm, address_m & HPAGE_MASK);
-+ get_page(page_m);
-+ set_huge_pte_at(mm, address_m, ptep_m, make_huge_pte(vma_m, page_m, 0));
-+}
-+#endif
-+
- static int hugetlb_cow(struct mm_struct *mm, struct vm_area_struct *vma,
- unsigned long address, pte_t *ptep, pte_t pte,
- struct page *pagecache_page)
-@@ -2083,6 +2112,11 @@ retry_avoidcopy:
- huge_ptep_clear_flush(vma, address, ptep);
- set_huge_pte_at(mm, address, ptep,
- make_huge_pte(vma, new_page, 1));
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ pax_mirror_huge_pte(vma, address, new_page);
-+#endif
-+
- /* Make the old page be freed below */
- new_page = old_page;
- }
-@@ -2214,6 +2248,10 @@ retry:
- && (vma->vm_flags & VM_SHARED)));
- set_huge_pte_at(mm, address, ptep, new_pte);
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ pax_mirror_huge_pte(vma, address, page);
-+#endif
-+
- if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) {
- /* Optimization, do the COW without a second fault */
- ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page);
-@@ -2242,6 +2280,28 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
- static DEFINE_MUTEX(hugetlb_instantiation_mutex);
- struct hstate *h = hstate_vma(vma);
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m;
-+
-+ vma_m = pax_find_mirror_vma(vma);
-+ if (vma_m) {
-+ unsigned long address_m;
-+
-+ if (vma->vm_start > vma_m->vm_start) {
-+ address_m = address;
-+ address -= SEGMEXEC_TASK_SIZE;
-+ vma = vma_m;
-+ h = hstate_vma(vma);
-+ } else
-+ address_m = address + SEGMEXEC_TASK_SIZE;
-+
-+ if (!huge_pte_alloc(mm, address_m, huge_page_size(h)))
-+ return VM_FAULT_OOM;
-+ address_m &= HPAGE_MASK;
-+ unmap_hugepage_range(vma, address_m, address_m + HPAGE_SIZE, NULL);
-+ }
-+#endif
-+
- ptep = huge_pte_alloc(mm, address, huge_page_size(h));
- if (!ptep)
- return VM_FAULT_OOM;
-@@ -2472,12 +2532,16 @@ int hugetlb_reserve_pages(struct inode *inode,
- set_vma_resv_flags(vma, HPAGE_RESV_OWNER);
- }
-
-- if (chg < 0)
-- return chg;
-+ if (chg < 0) {
-+ ret = chg;
-+ goto out_err;
-+ }
-
- /* There must be enough pages in the subpool for the mapping */
-- if (hugepage_subpool_get_pages(spool, chg))
-- return -ENOSPC;
-+ if (hugepage_subpool_get_pages(spool, chg)) {
-+ ret = -ENOSPC;
-+ goto out_err;
-+ }
-
- /*
- * Check enough hugepages are available for the reservation.
-@@ -2486,7 +2550,7 @@ int hugetlb_reserve_pages(struct inode *inode,
- ret = hugetlb_acct_memory(h, chg);
- if (ret < 0) {
- hugepage_subpool_put_pages(spool, chg);
-- return ret;
-+ goto out_err;
- }
-
- /*
-@@ -2503,6 +2567,10 @@ int hugetlb_reserve_pages(struct inode *inode,
- if (!vma || vma->vm_flags & VM_MAYSHARE)
- region_add(&inode->i_mapping->private_list, from, to);
- return 0;
-+out_err:
-+ if (vma)
-+ resv_map_put(vma);
-+ return ret;
- }
-
- void hugetlb_unreserve_pages(struct inode *inode, long offset, long freed)
-diff --git a/mm/internal.h b/mm/internal.h
-index f03e8e2..7354343 100644
---- a/mm/internal.h
-+++ b/mm/internal.h
-@@ -49,6 +49,7 @@ extern void putback_lru_page(struct page *page);
- * in mm/page_alloc.c
- */
- extern void __free_pages_bootmem(struct page *page, unsigned int order);
-+extern void free_compound_page(struct page *page);
- extern void prep_compound_page(struct page *page, unsigned long order);
-
-
-diff --git a/mm/kmemleak.c b/mm/kmemleak.c
-index c346660..33486fe 100644
---- a/mm/kmemleak.c
-+++ b/mm/kmemleak.c
-@@ -358,7 +358,7 @@ static void print_unreferenced(struct seq_file *seq,
-
- for (i = 0; i < object->trace_len; i++) {
- void *ptr = (void *)object->trace[i];
-- seq_printf(seq, " [<%p>] %pS\n", ptr, ptr);
-+ seq_printf(seq, " [<%pP>] %pA\n", ptr, ptr);
- }
- }
-
-@@ -1677,7 +1677,7 @@ static int __init kmemleak_late_init(void)
- return -ENOMEM;
- }
-
-- dentry = debugfs_create_file("kmemleak", S_IRUGO, NULL, NULL,
-+ dentry = debugfs_create_file("kmemleak", S_IRUSR, NULL, NULL,
- &kmemleak_fops);
- if (!dentry)
- pr_warning("Failed to create the debugfs kmemleak file\n");
-diff --git a/mm/maccess.c b/mm/maccess.c
-index 9073695..1127f348 100644
---- a/mm/maccess.c
-+++ b/mm/maccess.c
-@@ -14,7 +14,7 @@
- * Safely read from address @src to the buffer at @dst. If a kernel fault
- * happens, handle that and return -EFAULT.
- */
--long probe_kernel_read(void *dst, void *src, size_t size)
-+long probe_kernel_read(void *dst, const void *src, size_t size)
- {
- long ret;
- mm_segment_t old_fs = get_fs();
-@@ -22,7 +22,7 @@ long probe_kernel_read(void *dst, void *src, size_t size)
- set_fs(KERNEL_DS);
- pagefault_disable();
- ret = __copy_from_user_inatomic(dst,
-- (__force const void __user *)src, size);
-+ (const void __force_user *)src, size);
- pagefault_enable();
- set_fs(old_fs);
-
-@@ -39,14 +39,14 @@ EXPORT_SYMBOL_GPL(probe_kernel_read);
- * Safely write to address @dst from the buffer at @src. If a kernel fault
- * happens, handle that and return -EFAULT.
- */
--long notrace __weak probe_kernel_write(void *dst, void *src, size_t size)
-+long notrace __weak probe_kernel_write(void *dst, const void *src, size_t size)
- {
- long ret;
- mm_segment_t old_fs = get_fs();
-
- set_fs(KERNEL_DS);
- pagefault_disable();
-- ret = __copy_to_user_inatomic((__force void __user *)dst, src, size);
-+ ret = __copy_to_user_inatomic((void __force_user *)dst, src, size);
- pagefault_enable();
- set_fs(old_fs);
-
-diff --git a/mm/madvise.c b/mm/madvise.c
-index e405c5f..c96726f 100644
---- a/mm/madvise.c
-+++ b/mm/madvise.c
-@@ -12,6 +12,7 @@
- #include <linux/hugetlb.h>
- #include <linux/sched.h>
- #include <linux/ksm.h>
-+#include <linux/fs.h>
- #include <linux/file.h>
-
- /*
-@@ -45,6 +46,10 @@ static long madvise_behavior(struct vm_area_struct * vma,
- pgoff_t pgoff;
- unsigned long new_flags = vma->vm_flags;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m;
-+#endif
-+
- switch (behavior) {
- case MADV_NORMAL:
- new_flags = new_flags & ~VM_RAND_READ & ~VM_SEQ_READ;
-@@ -104,6 +109,13 @@ success:
- /*
- * vm_flags is protected by the mmap_sem held in write mode.
- */
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ vma_m = pax_find_mirror_vma(vma);
-+ if (vma_m)
-+ vma_m->vm_flags = new_flags & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT);
-+#endif
-+
- vma->vm_flags = new_flags;
-
- out:
-@@ -162,6 +174,11 @@ static long madvise_dontneed(struct vm_area_struct * vma,
- struct vm_area_struct ** prev,
- unsigned long start, unsigned long end)
- {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m;
-+#endif
-+
- *prev = vma;
- if (vma->vm_flags & (VM_LOCKED|VM_HUGETLB|VM_PFNMAP))
- return -EINVAL;
-@@ -174,6 +191,21 @@ static long madvise_dontneed(struct vm_area_struct * vma,
- zap_page_range(vma, start, end - start, &details);
- } else
- zap_page_range(vma, start, end - start, NULL);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ vma_m = pax_find_mirror_vma(vma);
-+ if (vma_m) {
-+ if (unlikely(vma->vm_flags & VM_NONLINEAR)) {
-+ struct zap_details details = {
-+ .nonlinear_vma = vma_m,
-+ .last_index = ULONG_MAX,
-+ };
-+ zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, &details);
-+ } else
-+ zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, NULL);
-+ }
-+#endif
-+
- return 0;
- }
-
-@@ -225,6 +257,7 @@ static long madvise_remove(struct vm_area_struct *vma,
- error = vmtruncate_range(mapping->host, offset, endoff);
- fput(f);
- down_read(¤t->mm->mmap_sem);
-+ fput(f);
- return error;
- }
-
-@@ -369,6 +402,16 @@ SYSCALL_DEFINE3(madvise, unsigned long, start, size_t, len_in, int, behavior)
- if (end < start)
- goto out;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
-+ if (end > SEGMEXEC_TASK_SIZE)
-+ goto out;
-+ } else
-+#endif
-+
-+ if (end > TASK_SIZE)
-+ goto out;
-+
- error = 0;
- if (end == start)
- goto out;
-diff --git a/mm/memory-failure.c b/mm/memory-failure.c
-index 8aeba53..b4a4198 100644
---- a/mm/memory-failure.c
-+++ b/mm/memory-failure.c
-@@ -46,7 +46,7 @@ int sysctl_memory_failure_early_kill __read_mostly = 0;
-
- int sysctl_memory_failure_recovery __read_mostly = 1;
-
--atomic_long_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
-+atomic_long_unchecked_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
-
- /*
- * Send all the processes who have the page mapped an ``action optional''
-@@ -64,7 +64,7 @@ static int kill_proc_ao(struct task_struct *t, unsigned long addr, int trapno,
- si.si_signo = SIGBUS;
- si.si_errno = 0;
- si.si_code = BUS_MCEERR_AO;
-- si.si_addr = (void *)addr;
-+ si.si_addr = (void __user *)addr;
- #ifdef __ARCH_SI_TRAPNO
- si.si_trapno = trapno;
- #endif
-@@ -745,7 +745,7 @@ int __memory_failure(unsigned long pfn, int trapno, int ref)
- return 0;
- }
-
-- atomic_long_add(1, &mce_bad_pages);
-+ atomic_long_add_unchecked(1, &mce_bad_pages);
-
- /*
- * We need/can do nothing about count=0 pages.
-diff --git a/mm/memory.c b/mm/memory.c
-index 6c836d3..b2296e1 100644
---- a/mm/memory.c
-+++ b/mm/memory.c
-@@ -187,8 +187,12 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
- return;
-
- pmd = pmd_offset(pud, start);
-+
-+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_PER_CPU_PGD)
- pud_clear(pud);
- pmd_free_tlb(tlb, pmd, start);
-+#endif
-+
- }
-
- static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
-@@ -219,9 +223,12 @@ static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
- if (end - 1 > ceiling - 1)
- return;
-
-+#if !defined(CONFIG_X86_64) || !defined(CONFIG_PAX_PER_CPU_PGD)
- pud = pud_offset(pgd, start);
- pgd_clear(pgd);
- pud_free_tlb(tlb, pud, start);
-+#endif
-+
- }
-
- /*
-@@ -1251,10 +1258,10 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
- (VM_MAYREAD | VM_MAYWRITE) : (VM_READ | VM_WRITE);
- i = 0;
-
-- do {
-+ while (nr_pages) {
- struct vm_area_struct *vma;
-
-- vma = find_extend_vma(mm, start);
-+ vma = find_vma(mm, start);
- if (!vma && in_gate_area(tsk, start)) {
- unsigned long pg = start & PAGE_MASK;
- struct vm_area_struct *gate_vma = get_gate_vma(tsk);
-@@ -1306,7 +1313,7 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
- continue;
- }
-
-- if (!vma ||
-+ if (!vma || start < vma->vm_start ||
- (vma->vm_flags & (VM_IO | VM_PFNMAP)) ||
- !(vm_flags & vma->vm_flags))
- return i ? : -EFAULT;
-@@ -1381,7 +1388,7 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
- start += PAGE_SIZE;
- nr_pages--;
- } while (nr_pages && start < vma->vm_end);
-- } while (nr_pages);
-+ }
- return i;
- }
-
-@@ -1526,6 +1533,10 @@ static int insert_page(struct vm_area_struct *vma, unsigned long addr,
- page_add_file_rmap(page);
- set_pte_at(mm, addr, pte, mk_pte(page, prot));
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ pax_mirror_file_pte(vma, addr, page, ptl);
-+#endif
-+
- retval = 0;
- pte_unmap_unlock(pte, ptl);
- return retval;
-@@ -1560,10 +1571,22 @@ out:
- int vm_insert_page(struct vm_area_struct *vma, unsigned long addr,
- struct page *page)
- {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m;
-+#endif
-+
- if (addr < vma->vm_start || addr >= vma->vm_end)
- return -EFAULT;
- if (!page_count(page))
- return -EINVAL;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ vma_m = pax_find_mirror_vma(vma);
-+ if (vma_m)
-+ vma_m->vm_flags |= VM_INSERTPAGE;
-+#endif
-+
- vma->vm_flags |= VM_INSERTPAGE;
- return insert_page(vma, addr, page, vma->vm_page_prot);
- }
-@@ -1649,6 +1672,7 @@ int vm_insert_mixed(struct vm_area_struct *vma, unsigned long addr,
- unsigned long pfn)
- {
- BUG_ON(!(vma->vm_flags & VM_MIXEDMAP));
-+ BUG_ON(vma->vm_mirror);
-
- if (addr < vma->vm_start || addr >= vma->vm_end)
- return -EFAULT;
-@@ -1855,7 +1879,9 @@ static int apply_to_pmd_range(struct mm_struct *mm, pud_t *pud,
-
- BUG_ON(pud_huge(*pud));
-
-- pmd = pmd_alloc(mm, pud, addr);
-+ pmd = (mm == &init_mm) ?
-+ pmd_alloc_kernel(mm, pud, addr) :
-+ pmd_alloc(mm, pud, addr);
- if (!pmd)
- return -ENOMEM;
- do {
-@@ -1875,7 +1901,9 @@ static int apply_to_pud_range(struct mm_struct *mm, pgd_t *pgd,
- unsigned long next;
- int err;
-
-- pud = pud_alloc(mm, pgd, addr);
-+ pud = (mm == &init_mm) ?
-+ pud_alloc_kernel(mm, pgd, addr) :
-+ pud_alloc(mm, pgd, addr);
- if (!pud)
- return -ENOMEM;
- do {
-@@ -1977,6 +2005,186 @@ static inline void cow_user_page(struct page *dst, struct page *src, unsigned lo
- copy_user_highpage(dst, src, va, vma);
- }
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+static void pax_unmap_mirror_pte(struct vm_area_struct *vma, unsigned long address, pmd_t *pmd)
-+{
-+ struct mm_struct *mm = vma->vm_mm;
-+ spinlock_t *ptl;
-+ pte_t *pte, entry;
-+
-+ pte = pte_offset_map_lock(mm, pmd, address, &ptl);
-+ entry = *pte;
-+ if (!pte_present(entry)) {
-+ if (!pte_none(entry)) {
-+ BUG_ON(pte_file(entry));
-+ free_swap_and_cache(pte_to_swp_entry(entry));
-+ pte_clear_not_present_full(mm, address, pte, 0);
-+ }
-+ } else {
-+ struct page *page;
-+
-+ flush_cache_page(vma, address, pte_pfn(entry));
-+ entry = ptep_clear_flush(vma, address, pte);
-+ BUG_ON(pte_dirty(entry));
-+ page = vm_normal_page(vma, address, entry);
-+ if (page) {
-+ update_hiwater_rss(mm);
-+ if (PageAnon(page))
-+ dec_mm_counter(mm, anon_rss);
-+ else
-+ dec_mm_counter(mm, file_rss);
-+ page_remove_rmap(page);
-+ page_cache_release(page);
-+ }
-+ }
-+ pte_unmap_unlock(pte, ptl);
-+}
-+
-+/* PaX: if vma is mirrored, synchronize the mirror's PTE
-+ *
-+ * the ptl of the lower mapped page is held on entry and is not released on exit
-+ * or inside to ensure atomic changes to the PTE states (swapout, mremap, munmap, etc)
-+ */
-+static void pax_mirror_anon_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
-+{
-+ struct mm_struct *mm = vma->vm_mm;
-+ unsigned long address_m;
-+ spinlock_t *ptl_m;
-+ struct vm_area_struct *vma_m;
-+ pmd_t *pmd_m;
-+ pte_t *pte_m, entry_m;
-+
-+ BUG_ON(!page_m || !PageAnon(page_m));
-+
-+ vma_m = pax_find_mirror_vma(vma);
-+ if (!vma_m)
-+ return;
-+
-+ BUG_ON(!PageLocked(page_m));
-+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
-+ address_m = address + SEGMEXEC_TASK_SIZE;
-+ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
-+ pte_m = pte_offset_map_nested(pmd_m, address_m);
-+ ptl_m = pte_lockptr(mm, pmd_m);
-+ if (ptl != ptl_m) {
-+ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
-+ if (!pte_none(*pte_m))
-+ goto out;
-+ }
-+
-+ entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
-+ page_cache_get(page_m);
-+ page_add_anon_rmap(page_m, vma_m, address_m);
-+ inc_mm_counter(mm, anon_rss);
-+ set_pte_at(mm, address_m, pte_m, entry_m);
-+ update_mmu_cache(vma_m, address_m, entry_m);
-+out:
-+ if (ptl != ptl_m)
-+ spin_unlock(ptl_m);
-+ pte_unmap_nested(pte_m);
-+ unlock_page(page_m);
-+}
-+
-+void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
-+{
-+ struct mm_struct *mm = vma->vm_mm;
-+ unsigned long address_m;
-+ spinlock_t *ptl_m;
-+ struct vm_area_struct *vma_m;
-+ pmd_t *pmd_m;
-+ pte_t *pte_m, entry_m;
-+
-+ BUG_ON(!page_m || PageAnon(page_m));
-+
-+ vma_m = pax_find_mirror_vma(vma);
-+ if (!vma_m)
-+ return;
-+
-+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
-+ address_m = address + SEGMEXEC_TASK_SIZE;
-+ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
-+ pte_m = pte_offset_map_nested(pmd_m, address_m);
-+ ptl_m = pte_lockptr(mm, pmd_m);
-+ if (ptl != ptl_m) {
-+ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
-+ if (!pte_none(*pte_m))
-+ goto out;
-+ }
-+
-+ entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
-+ page_cache_get(page_m);
-+ page_add_file_rmap(page_m);
-+ inc_mm_counter(mm, file_rss);
-+ set_pte_at(mm, address_m, pte_m, entry_m);
-+ update_mmu_cache(vma_m, address_m, entry_m);
-+out:
-+ if (ptl != ptl_m)
-+ spin_unlock(ptl_m);
-+ pte_unmap_nested(pte_m);
-+}
-+
-+static void pax_mirror_pfn_pte(struct vm_area_struct *vma, unsigned long address, unsigned long pfn_m, spinlock_t *ptl)
-+{
-+ struct mm_struct *mm = vma->vm_mm;
-+ unsigned long address_m;
-+ spinlock_t *ptl_m;
-+ struct vm_area_struct *vma_m;
-+ pmd_t *pmd_m;
-+ pte_t *pte_m, entry_m;
-+
-+ vma_m = pax_find_mirror_vma(vma);
-+ if (!vma_m)
-+ return;
-+
-+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
-+ address_m = address + SEGMEXEC_TASK_SIZE;
-+ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
-+ pte_m = pte_offset_map_nested(pmd_m, address_m);
-+ ptl_m = pte_lockptr(mm, pmd_m);
-+ if (ptl != ptl_m) {
-+ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
-+ if (!pte_none(*pte_m))
-+ goto out;
-+ }
-+
-+ entry_m = pfn_pte(pfn_m, vma_m->vm_page_prot);
-+ set_pte_at(mm, address_m, pte_m, entry_m);
-+out:
-+ if (ptl != ptl_m)
-+ spin_unlock(ptl_m);
-+ pte_unmap_nested(pte_m);
-+}
-+
-+static void pax_mirror_pte(struct vm_area_struct *vma, unsigned long address, pte_t *pte, pmd_t *pmd, spinlock_t *ptl)
-+{
-+ struct page *page_m;
-+ pte_t entry;
-+
-+ if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC))
-+ goto out;
-+
-+ entry = *pte;
-+ page_m = vm_normal_page(vma, address, entry);
-+ if (!page_m)
-+ pax_mirror_pfn_pte(vma, address, pte_pfn(entry), ptl);
-+ else if (PageAnon(page_m)) {
-+ if (pax_find_mirror_vma(vma)) {
-+ pte_unmap_unlock(pte, ptl);
-+ lock_page(page_m);
-+ pte = pte_offset_map_lock(vma->vm_mm, pmd, address, &ptl);
-+ if (pte_same(entry, *pte))
-+ pax_mirror_anon_pte(vma, address, page_m, ptl);
-+ else
-+ unlock_page(page_m);
-+ }
-+ } else
-+ pax_mirror_file_pte(vma, address, page_m, ptl);
-+
-+out:
-+ pte_unmap_unlock(pte, ptl);
-+}
-+#endif
-+
- /*
- * This routine handles present pages, when users try to write
- * to a shared page. It is done by copying the page to a new address
-@@ -2156,6 +2364,12 @@ gotten:
- */
- page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
- if (likely(pte_same(*page_table, orig_pte))) {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (pax_find_mirror_vma(vma))
-+ BUG_ON(!trylock_page(new_page));
-+#endif
-+
- if (old_page) {
- if (!PageAnon(old_page)) {
- dec_mm_counter(mm, file_rss);
-@@ -2207,6 +2421,10 @@ gotten:
- page_remove_rmap(old_page);
- }
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ pax_mirror_anon_pte(vma, address, new_page, ptl);
-+#endif
-+
- /* Free the old page.. */
- new_page = old_page;
- ret |= VM_FAULT_WRITE;
-@@ -2606,6 +2824,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
- swap_free(entry);
- if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
- try_to_free_swap(page);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((flags & FAULT_FLAG_WRITE) || !pax_find_mirror_vma(vma))
-+#endif
-+
- unlock_page(page);
-
- if (flags & FAULT_FLAG_WRITE) {
-@@ -2617,6 +2840,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
-
- /* No need to invalidate - it was non-present before */
- update_mmu_cache(vma, address, pte);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ pax_mirror_anon_pte(vma, address, page, ptl);
-+#endif
-+
- unlock:
- pte_unmap_unlock(page_table, ptl);
- out:
-@@ -2632,40 +2860,6 @@ out_release:
- }
-
- /*
-- * This is like a special single-page "expand_{down|up}wards()",
-- * except we must first make sure that 'address{-|+}PAGE_SIZE'
-- * doesn't hit another vma.
-- */
--static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address)
--{
-- address &= PAGE_MASK;
-- if ((vma->vm_flags & VM_GROWSDOWN) && address == vma->vm_start) {
-- struct vm_area_struct *prev = vma->vm_prev;
--
-- /*
-- * Is there a mapping abutting this one below?
-- *
-- * That's only ok if it's the same stack mapping
-- * that has gotten split..
-- */
-- if (prev && prev->vm_end == address)
-- return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
--
-- expand_stack(vma, address - PAGE_SIZE);
-- }
-- if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
-- struct vm_area_struct *next = vma->vm_next;
--
-- /* As VM_GROWSDOWN but s/below/above/ */
-- if (next && next->vm_start == address + PAGE_SIZE)
-- return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
--
-- expand_upwards(vma, address + PAGE_SIZE);
-- }
-- return 0;
--}
--
--/*
- * We enter with non-exclusive mmap_sem (to exclude vma changes,
- * but allow concurrent faults), and pte mapped but not yet locked.
- * We return with mmap_sem still held, but pte unmapped and unlocked.
-@@ -2674,27 +2868,23 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
- unsigned long address, pte_t *page_table, pmd_t *pmd,
- unsigned int flags)
- {
-- struct page *page;
-+ struct page *page = NULL;
- spinlock_t *ptl;
- pte_t entry;
-
-- pte_unmap(page_table);
--
-- /* Check if we need to add a guard page to the stack */
-- if (check_stack_guard_page(vma, address) < 0)
-- return VM_FAULT_SIGBUS;
--
-- /* Use the zero-page for reads */
- if (!(flags & FAULT_FLAG_WRITE)) {
- entry = pte_mkspecial(pfn_pte(my_zero_pfn(address),
- vma->vm_page_prot));
-- page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
-+ ptl = pte_lockptr(mm, pmd);
-+ spin_lock(ptl);
- if (!pte_none(*page_table))
- goto unlock;
- goto setpte;
- }
-
- /* Allocate our own private page. */
-+ pte_unmap(page_table);
-+
- if (unlikely(anon_vma_prepare(vma)))
- goto oom;
- page = alloc_zeroed_user_highpage_movable(vma, address);
-@@ -2713,6 +2903,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
- if (!pte_none(*page_table))
- goto release;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (pax_find_mirror_vma(vma))
-+ BUG_ON(!trylock_page(page));
-+#endif
-+
- inc_mm_counter(mm, anon_rss);
- page_add_new_anon_rmap(page, vma, address);
- setpte:
-@@ -2720,6 +2915,12 @@ setpte:
-
- /* No need to invalidate - it was non-present before */
- update_mmu_cache(vma, address, entry);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (page)
-+ pax_mirror_anon_pte(vma, address, page, ptl);
-+#endif
-+
- unlock:
- pte_unmap_unlock(page_table, ptl);
- return 0;
-@@ -2862,6 +3063,12 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
- */
- /* Only go through if we didn't race with anybody else... */
- if (likely(pte_same(*page_table, orig_pte))) {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (anon && pax_find_mirror_vma(vma))
-+ BUG_ON(!trylock_page(page));
-+#endif
-+
- flush_icache_page(vma, page);
- entry = mk_pte(page, vma->vm_page_prot);
- if (flags & FAULT_FLAG_WRITE)
-@@ -2881,6 +3088,14 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
-
- /* no need to invalidate: a not-present page won't be cached */
- update_mmu_cache(vma, address, entry);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (anon)
-+ pax_mirror_anon_pte(vma, address, page, ptl);
-+ else
-+ pax_mirror_file_pte(vma, address, page, ptl);
-+#endif
-+
- } else {
- if (charged)
- mem_cgroup_uncharge_page(page);
-@@ -3028,6 +3243,12 @@ static inline int handle_pte_fault(struct mm_struct *mm,
- if (flags & FAULT_FLAG_WRITE)
- flush_tlb_page(vma, address);
- }
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ pax_mirror_pte(vma, address, pte, pmd, ptl);
-+ return 0;
-+#endif
-+
- unlock:
- pte_unmap_unlock(pte, ptl);
- return 0;
-@@ -3044,6 +3265,10 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
- pmd_t *pmd;
- pte_t *pte;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m;
-+#endif
-+
- __set_current_state(TASK_RUNNING);
-
- count_vm_event(PGFAULT);
-@@ -3051,6 +3276,34 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
- if (unlikely(is_vm_hugetlb_page(vma)))
- return hugetlb_fault(mm, vma, address, flags);
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ vma_m = pax_find_mirror_vma(vma);
-+ if (vma_m) {
-+ unsigned long address_m;
-+ pgd_t *pgd_m;
-+ pud_t *pud_m;
-+ pmd_t *pmd_m;
-+
-+ if (vma->vm_start > vma_m->vm_start) {
-+ address_m = address;
-+ address -= SEGMEXEC_TASK_SIZE;
-+ vma = vma_m;
-+ } else
-+ address_m = address + SEGMEXEC_TASK_SIZE;
-+
-+ pgd_m = pgd_offset(mm, address_m);
-+ pud_m = pud_alloc(mm, pgd_m, address_m);
-+ if (!pud_m)
-+ return VM_FAULT_OOM;
-+ pmd_m = pmd_alloc(mm, pud_m, address_m);
-+ if (!pmd_m)
-+ return VM_FAULT_OOM;
-+ if (!pmd_present(*pmd_m) && __pte_alloc(mm, pmd_m, address_m))
-+ return VM_FAULT_OOM;
-+ pax_unmap_mirror_pte(vma_m, address_m, pmd_m);
-+ }
-+#endif
-+
- pgd = pgd_offset(mm, address);
- pud = pud_alloc(mm, pgd, address);
- if (!pud)
-@@ -3086,6 +3339,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
- spin_unlock(&mm->page_table_lock);
- return 0;
- }
-+
-+int __pud_alloc_kernel(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
-+{
-+ pud_t *new = pud_alloc_one(mm, address);
-+ if (!new)
-+ return -ENOMEM;
-+
-+ smp_wmb(); /* See comment in __pte_alloc */
-+
-+ spin_lock(&mm->page_table_lock);
-+ if (pgd_present(*pgd)) /* Another has populated it */
-+ pud_free(mm, new);
-+ else
-+ pgd_populate_kernel(mm, pgd, new);
-+ spin_unlock(&mm->page_table_lock);
-+ return 0;
-+}
- #endif /* __PAGETABLE_PUD_FOLDED */
-
- #ifndef __PAGETABLE_PMD_FOLDED
-@@ -3116,6 +3386,30 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
- spin_unlock(&mm->page_table_lock);
- return 0;
- }
-+
-+int __pmd_alloc_kernel(struct mm_struct *mm, pud_t *pud, unsigned long address)
-+{
-+ pmd_t *new = pmd_alloc_one(mm, address);
-+ if (!new)
-+ return -ENOMEM;
-+
-+ smp_wmb(); /* See comment in __pte_alloc */
-+
-+ spin_lock(&mm->page_table_lock);
-+#ifndef __ARCH_HAS_4LEVEL_HACK
-+ if (pud_present(*pud)) /* Another has populated it */
-+ pmd_free(mm, new);
-+ else
-+ pud_populate_kernel(mm, pud, new);
-+#else
-+ if (pgd_present(*pud)) /* Another has populated it */
-+ pmd_free(mm, new);
-+ else
-+ pgd_populate_kernel(mm, pud, new);
-+#endif /* __ARCH_HAS_4LEVEL_HACK */
-+ spin_unlock(&mm->page_table_lock);
-+ return 0;
-+}
- #endif /* __PAGETABLE_PMD_FOLDED */
-
- int make_pages_present(unsigned long addr, unsigned long end)
-@@ -3148,7 +3442,7 @@ static int __init gate_vma_init(void)
- gate_vma.vm_start = FIXADDR_USER_START;
- gate_vma.vm_end = FIXADDR_USER_END;
- gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
-- gate_vma.vm_page_prot = __P101;
-+ gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
- /*
- * Make sure the vDSO gets into every core dump.
- * Dumping its contents makes post-mortem fully interpretable later
-diff --git a/mm/mempolicy.c b/mm/mempolicy.c
-index a6563fb..a99e912 100644
---- a/mm/mempolicy.c
-+++ b/mm/mempolicy.c
-@@ -573,6 +573,10 @@ static int mbind_range(struct vm_area_struct *vma, unsigned long start,
- struct vm_area_struct *next;
- int err;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m;
-+#endif
-+
- err = 0;
- for (; vma && vma->vm_start < end; vma = next) {
- next = vma->vm_next;
-@@ -584,6 +588,16 @@ static int mbind_range(struct vm_area_struct *vma, unsigned long start,
- err = policy_vma(vma, new);
- if (err)
- break;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ vma_m = pax_find_mirror_vma(vma);
-+ if (vma_m) {
-+ err = policy_vma(vma_m, new);
-+ if (err)
-+ break;
-+ }
-+#endif
-+
- }
- return err;
- }
-@@ -1002,6 +1016,17 @@ static long do_mbind(unsigned long start, unsigned long len,
-
- if (end < start)
- return -EINVAL;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC) {
-+ if (end > SEGMEXEC_TASK_SIZE)
-+ return -EINVAL;
-+ } else
-+#endif
-+
-+ if (end > TASK_SIZE)
-+ return -EINVAL;
-+
- if (end == start)
- return 0;
-
-@@ -1207,6 +1232,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
- if (!mm)
- return -EINVAL;
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ if (mm != current->mm &&
-+ (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
-+ err = -EPERM;
-+ goto out;
-+ }
-+#endif
-+
- /*
- * Check if this process has the right to modify the specified
- * process. The right exists if the process has administrative
-@@ -1216,8 +1249,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
- rcu_read_lock();
- tcred = __task_cred(task);
- if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
-- cred->uid != tcred->suid && cred->uid != tcred->uid &&
-- !capable(CAP_SYS_NICE)) {
-+ cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
- rcu_read_unlock();
- err = -EPERM;
- goto out;
-@@ -2367,6 +2399,12 @@ static inline void check_huge_range(struct vm_area_struct *vma,
- }
- #endif
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
-+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
-+ _mm->pax_flags & MF_PAX_SEGMEXEC))
-+#endif
-+
- /*
- * Display pages allocated per node and memory policy via /proc.
- */
-@@ -2381,6 +2419,13 @@ int show_numa_map(struct seq_file *m, void *v)
- int n;
- char buffer[50];
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ if (current->exec_id != m->exec_id) {
-+ gr_log_badprocpid("numa_maps");
-+ return 0;
-+ }
-+#endif
-+
- if (!mm)
- return 0;
-
-@@ -2392,11 +2437,15 @@ int show_numa_map(struct seq_file *m, void *v)
- mpol_to_str(buffer, sizeof(buffer), pol, 0);
- mpol_cond_put(pol);
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ seq_printf(m, "%08lx %s", PAX_RAND_FLAGS(vma->vm_mm) ? 0UL : vma->vm_start, buffer);
-+#else
- seq_printf(m, "%08lx %s", vma->vm_start, buffer);
-+#endif
-
- if (file) {
- seq_printf(m, " file=");
-- seq_path(m, &file->f_path, "\n\t= ");
-+ seq_path(m, &file->f_path, "\n\t\\= ");
- } else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
- seq_printf(m, " heap");
- } else if (vma->vm_start <= mm->start_stack &&
-diff --git a/mm/migrate.c b/mm/migrate.c
-index aaca868..2ebecdc 100644
---- a/mm/migrate.c
-+++ b/mm/migrate.c
-@@ -916,6 +916,8 @@ static int do_pages_move(struct mm_struct *mm, struct task_struct *task,
- unsigned long chunk_start;
- int err;
-
-+ pax_track_stack();
-+
- task_nodes = cpuset_mems_allowed(task);
-
- err = -ENOMEM;
-@@ -1106,6 +1108,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
- if (!mm)
- return -EINVAL;
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ if (mm != current->mm &&
-+ (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
-+ err = -EPERM;
-+ goto out;
-+ }
-+#endif
-+
- /*
- * Check if this process has the right to modify the specified
- * process. The right exists if the process has administrative
-@@ -1115,8 +1125,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
- rcu_read_lock();
- tcred = __task_cred(task);
- if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
-- cred->uid != tcred->suid && cred->uid != tcred->uid &&
-- !capable(CAP_SYS_NICE)) {
-+ cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
- rcu_read_unlock();
- err = -EPERM;
- goto out;
-diff --git a/mm/mlock.c b/mm/mlock.c
-index 2d846cf..8d5cdd8 100644
---- a/mm/mlock.c
-+++ b/mm/mlock.c
-@@ -13,6 +13,7 @@
- #include <linux/pagemap.h>
- #include <linux/mempolicy.h>
- #include <linux/syscalls.h>
-+#include <linux/security.h>
- #include <linux/sched.h>
- #include <linux/module.h>
- #include <linux/rmap.h>
-@@ -138,13 +139,6 @@ void munlock_vma_page(struct page *page)
- }
- }
-
--static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
--{
-- return (vma->vm_flags & VM_GROWSDOWN) &&
-- (vma->vm_start == addr) &&
-- !vma_stack_continue(vma->vm_prev, addr);
--}
--
- /**
- * __mlock_vma_pages_range() - mlock a range of pages in the vma.
- * @vma: target vma
-@@ -177,12 +171,6 @@ static long __mlock_vma_pages_range(struct vm_area_struct *vma,
- if (vma->vm_flags & VM_WRITE)
- gup_flags |= FOLL_WRITE;
-
-- /* We don't try to access the guard page of a stack vma */
-- if (stack_guard_page(vma, start)) {
-- addr += PAGE_SIZE;
-- nr_pages--;
-- }
--
- while (nr_pages > 0) {
- int i;
-
-@@ -440,7 +428,7 @@ static int do_mlock(unsigned long start, size_t len, int on)
- {
- unsigned long nstart, end, tmp;
- struct vm_area_struct * vma, * prev;
-- int error;
-+ int error = 0;
-
- len = PAGE_ALIGN(len);
- end = start + len;
-@@ -448,6 +436,9 @@ static int do_mlock(unsigned long start, size_t len, int on)
- return -EINVAL;
- if (end == start)
- return 0;
-+ if (end > TASK_SIZE)
-+ return -EINVAL;
-+
- vma = find_vma_prev(current->mm, start, &prev);
- if (!vma || vma->vm_start > start)
- return -ENOMEM;
-@@ -458,6 +449,11 @@ static int do_mlock(unsigned long start, size_t len, int on)
- for (nstart = start ; ; ) {
- unsigned int newflags;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
-+ break;
-+#endif
-+
- /* Here we know that vma->vm_start <= nstart < vma->vm_end. */
-
- newflags = vma->vm_flags | VM_LOCKED;
-@@ -507,6 +503,7 @@ SYSCALL_DEFINE2(mlock, unsigned long, start, size_t, len)
- lock_limit >>= PAGE_SHIFT;
-
- /* check against resource limits */
-+ gr_learn_resource(current, RLIMIT_MEMLOCK, (current->mm->locked_vm << PAGE_SHIFT) + len, 1);
- if ((locked <= lock_limit) || capable(CAP_IPC_LOCK))
- error = do_mlock(start, len, 1);
- up_write(¤t->mm->mmap_sem);
-@@ -528,17 +525,23 @@ SYSCALL_DEFINE2(munlock, unsigned long, start, size_t, len)
- static int do_mlockall(int flags)
- {
- struct vm_area_struct * vma, * prev = NULL;
-- unsigned int def_flags = 0;
-
- if (flags & MCL_FUTURE)
-- def_flags = VM_LOCKED;
-- current->mm->def_flags = def_flags;
-+ current->mm->def_flags |= VM_LOCKED;
-+ else
-+ current->mm->def_flags &= ~VM_LOCKED;
- if (flags == MCL_FUTURE)
- goto out;
-
- for (vma = current->mm->mmap; vma ; vma = prev->vm_next) {
-- unsigned int newflags;
-+ unsigned long newflags;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
-+ break;
-+#endif
-+
-+ BUG_ON(vma->vm_end > TASK_SIZE);
- newflags = vma->vm_flags | VM_LOCKED;
- if (!(flags & MCL_CURRENT))
- newflags &= ~VM_LOCKED;
-@@ -570,6 +573,7 @@ SYSCALL_DEFINE1(mlockall, int, flags)
- lock_limit >>= PAGE_SHIFT;
-
- ret = -ENOMEM;
-+ gr_learn_resource(current, RLIMIT_MEMLOCK, current->mm->total_vm << PAGE_SHIFT, 1);
- if (!(flags & MCL_CURRENT) || (current->mm->total_vm <= lock_limit) ||
- capable(CAP_IPC_LOCK))
- ret = do_mlockall(flags);
-diff --git a/mm/mmap.c b/mm/mmap.c
-index 4b80cbf..5645eab 100644
---- a/mm/mmap.c
-+++ b/mm/mmap.c
-@@ -29,6 +29,7 @@
- #include <linux/rmap.h>
- #include <linux/mmu_notifier.h>
- #include <linux/perf_event.h>
-+#include <linux/random.h>
-
- #include <asm/uaccess.h>
- #include <asm/cacheflush.h>
-@@ -45,6 +46,16 @@
- #define arch_rebalance_pgtables(addr, len) (addr)
- #endif
-
-+static inline void verify_mm_writelocked(struct mm_struct *mm)
-+{
-+#if defined(CONFIG_DEBUG_VM) || defined(CONFIG_PAX)
-+ if (unlikely(down_read_trylock(&mm->mmap_sem))) {
-+ up_read(&mm->mmap_sem);
-+ BUG();
-+ }
-+#endif
-+}
-+
- static void unmap_region(struct mm_struct *mm,
- struct vm_area_struct *vma, struct vm_area_struct *prev,
- unsigned long start, unsigned long end);
-@@ -70,22 +81,32 @@ static void unmap_region(struct mm_struct *mm,
- * x: (no) no x: (no) yes x: (no) yes x: (yes) yes
- *
- */
--pgprot_t protection_map[16] = {
-+pgprot_t protection_map[16] __read_only = {
- __P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111,
- __S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111
- };
-
- pgprot_t vm_get_page_prot(unsigned long vm_flags)
- {
-- return __pgprot(pgprot_val(protection_map[vm_flags &
-+ pgprot_t prot = __pgprot(pgprot_val(protection_map[vm_flags &
- (VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |
- pgprot_val(arch_vm_get_page_prot(vm_flags)));
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
-+ if (!nx_enabled &&
-+ (vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC &&
-+ (vm_flags & (VM_READ | VM_WRITE)))
-+ prot = __pgprot(pte_val(pte_exprotect(__pte(pgprot_val(prot)))));
-+#endif
-+
-+ return prot;
- }
- EXPORT_SYMBOL(vm_get_page_prot);
-
- int sysctl_overcommit_memory = OVERCOMMIT_GUESS; /* heuristic overcommit */
- int sysctl_overcommit_ratio = 50; /* default is 50% */
- int sysctl_max_map_count __read_mostly = DEFAULT_MAX_MAP_COUNT;
-+unsigned long sysctl_heap_stack_gap __read_mostly = 64*1024;
- struct percpu_counter vm_committed_as;
-
- /*
-@@ -231,6 +252,7 @@ static struct vm_area_struct *remove_vma(struct vm_area_struct *vma)
- struct vm_area_struct *next = vma->vm_next;
-
- might_sleep();
-+ BUG_ON(vma->vm_mirror);
- if (vma->vm_ops && vma->vm_ops->close)
- vma->vm_ops->close(vma);
- if (vma->vm_file) {
-@@ -267,6 +289,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
- * not page aligned -Ram Gupta
- */
- rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
-+ gr_learn_resource(current, RLIMIT_DATA, (brk - mm->start_brk) + (mm->end_data - mm->start_data), 1);
- if (rlim < RLIM_INFINITY && (brk - mm->start_brk) +
- (mm->end_data - mm->start_data) > rlim)
- goto out;
-@@ -704,6 +727,12 @@ static int
- can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
- struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
- {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_start == SEGMEXEC_TASK_SIZE)
-+ return 0;
-+#endif
-+
- if (is_mergeable_vma(vma, file, vm_flags) &&
- is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
- if (vma->vm_pgoff == vm_pgoff)
-@@ -723,6 +752,12 @@ static int
- can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
- struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
- {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end == SEGMEXEC_TASK_SIZE)
-+ return 0;
-+#endif
-+
- if (is_mergeable_vma(vma, file, vm_flags) &&
- is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
- pgoff_t vm_pglen;
-@@ -765,12 +800,19 @@ can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
- struct vm_area_struct *vma_merge(struct mm_struct *mm,
- struct vm_area_struct *prev, unsigned long addr,
- unsigned long end, unsigned long vm_flags,
-- struct anon_vma *anon_vma, struct file *file,
-+ struct anon_vma *anon_vma, struct file *file,
- pgoff_t pgoff, struct mempolicy *policy)
- {
- pgoff_t pglen = (end - addr) >> PAGE_SHIFT;
- struct vm_area_struct *area, *next;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE, end_m = end + SEGMEXEC_TASK_SIZE;
-+ struct vm_area_struct *area_m = NULL, *next_m = NULL, *prev_m = NULL;
-+
-+ BUG_ON((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE < end);
-+#endif
-+
- /*
- * We later require that vma->vm_flags == vm_flags,
- * so this tests vma->vm_flags & VM_SPECIAL, too.
-@@ -786,6 +828,15 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
- if (next && next->vm_end == end) /* cases 6, 7, 8 */
- next = next->vm_next;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (prev)
-+ prev_m = pax_find_mirror_vma(prev);
-+ if (area)
-+ area_m = pax_find_mirror_vma(area);
-+ if (next)
-+ next_m = pax_find_mirror_vma(next);
-+#endif
-+
- /*
- * Can it merge with the predecessor?
- */
-@@ -805,9 +856,24 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
- /* cases 1, 6 */
- vma_adjust(prev, prev->vm_start,
- next->vm_end, prev->vm_pgoff, NULL);
-- } else /* cases 2, 5, 7 */
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (prev_m)
-+ vma_adjust(prev_m, prev_m->vm_start,
-+ next_m->vm_end, prev_m->vm_pgoff, NULL);
-+#endif
-+
-+ } else { /* cases 2, 5, 7 */
- vma_adjust(prev, prev->vm_start,
- end, prev->vm_pgoff, NULL);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (prev_m)
-+ vma_adjust(prev_m, prev_m->vm_start,
-+ end_m, prev_m->vm_pgoff, NULL);
-+#endif
-+
-+ }
- return prev;
- }
-
-@@ -818,12 +884,27 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
- mpol_equal(policy, vma_policy(next)) &&
- can_vma_merge_before(next, vm_flags,
- anon_vma, file, pgoff+pglen)) {
-- if (prev && addr < prev->vm_end) /* case 4 */
-+ if (prev && addr < prev->vm_end) { /* case 4 */
- vma_adjust(prev, prev->vm_start,
- addr, prev->vm_pgoff, NULL);
-- else /* cases 3, 8 */
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (prev_m)
-+ vma_adjust(prev_m, prev_m->vm_start,
-+ addr_m, prev_m->vm_pgoff, NULL);
-+#endif
-+
-+ } else { /* cases 3, 8 */
- vma_adjust(area, addr, next->vm_end,
- next->vm_pgoff - pglen, NULL);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (area_m)
-+ vma_adjust(area_m, addr_m, next_m->vm_end,
-+ next_m->vm_pgoff - pglen, NULL);
-+#endif
-+
-+ }
- return area;
- }
-
-@@ -898,14 +979,11 @@ none:
- void vm_stat_account(struct mm_struct *mm, unsigned long flags,
- struct file *file, long pages)
- {
-- const unsigned long stack_flags
-- = VM_STACK_FLAGS & (VM_GROWSUP|VM_GROWSDOWN);
--
- if (file) {
- mm->shared_vm += pages;
- if ((flags & (VM_EXEC|VM_WRITE)) == VM_EXEC)
- mm->exec_vm += pages;
-- } else if (flags & stack_flags)
-+ } else if (flags & (VM_GROWSUP|VM_GROWSDOWN))
- mm->stack_vm += pages;
- if (flags & (VM_RESERVED|VM_IO))
- mm->reserved_vm += pages;
-@@ -932,7 +1010,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
- * (the exception is when the underlying filesystem is noexec
- * mounted, in which case we dont add PROT_EXEC.)
- */
-- if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
-+ if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
- if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC)))
- prot |= PROT_EXEC;
-
-@@ -958,7 +1036,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
- /* Obtain the address to map to. we verify (or select) it and ensure
- * that it represents a valid section of the address space.
- */
-- addr = get_unmapped_area(file, addr, len, pgoff, flags);
-+ addr = get_unmapped_area(file, addr, len, pgoff, flags | ((prot & PROT_EXEC) ? MAP_EXECUTABLE : 0));
- if (addr & ~PAGE_MASK)
- return addr;
-
-@@ -969,6 +1047,36 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
- vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |
- mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
-
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (mm->pax_flags & MF_PAX_MPROTECT) {
-+#ifndef CONFIG_PAX_MPROTECT_COMPAT
-+ if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC)) {
-+ gr_log_rwxmmap(file);
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+ vm_flags &= ~VM_EXEC;
-+#else
-+ return -EPERM;
-+#endif
-+
-+ }
-+
-+ if (!(vm_flags & VM_EXEC))
-+ vm_flags &= ~VM_MAYEXEC;
-+#else
-+ if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
-+ vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
-+#endif
-+ else
-+ vm_flags &= ~VM_MAYWRITE;
-+ }
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
-+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && file)
-+ vm_flags &= ~VM_PAGEEXEC;
-+#endif
-+
- if (flags & MAP_LOCKED)
- if (!can_do_mlock())
- return -EPERM;
-@@ -980,6 +1088,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
- locked += mm->locked_vm;
- lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
- lock_limit >>= PAGE_SHIFT;
-+ gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
- if (locked > lock_limit && !capable(CAP_IPC_LOCK))
- return -EAGAIN;
- }
-@@ -1053,6 +1162,9 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
- if (error)
- return error;
-
-+ if (!gr_acl_handle_mmap(file, prot))
-+ return -EACCES;
-+
- return mmap_region(file, addr, len, flags, vm_flags, pgoff);
- }
- EXPORT_SYMBOL(do_mmap_pgoff);
-@@ -1065,10 +1177,10 @@ EXPORT_SYMBOL(do_mmap_pgoff);
- */
- int vma_wants_writenotify(struct vm_area_struct *vma)
- {
-- unsigned int vm_flags = vma->vm_flags;
-+ unsigned long vm_flags = vma->vm_flags;
-
- /* If it was private or non-writable, the write bit is already clear */
-- if ((vm_flags & (VM_WRITE|VM_SHARED)) != ((VM_WRITE|VM_SHARED)))
-+ if ((vm_flags & (VM_WRITE|VM_SHARED)) != (VM_WRITE|VM_SHARED))
- return 0;
-
- /* The backer wishes to know when pages are first written to? */
-@@ -1117,14 +1229,24 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
- unsigned long charged = 0;
- struct inode *inode = file ? file->f_path.dentry->d_inode : NULL;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m = NULL;
-+#endif
-+
-+ /*
-+ * mm->mmap_sem is required to protect against another thread
-+ * changing the mappings in case we sleep.
-+ */
-+ verify_mm_writelocked(mm);
-+
- /* Clear old maps */
- error = -ENOMEM;
--munmap_back:
- vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
- if (vma && vma->vm_start < addr + len) {
- if (do_munmap(mm, addr, len))
- return -ENOMEM;
-- goto munmap_back;
-+ vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
-+ BUG_ON(vma && vma->vm_start < addr + len);
- }
-
- /* Check against address space limit. */
-@@ -1173,6 +1295,16 @@ munmap_back:
- goto unacct_error;
- }
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vm_flags & VM_EXEC)) {
-+ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
-+ if (!vma_m) {
-+ error = -ENOMEM;
-+ goto free_vma;
-+ }
-+ }
-+#endif
-+
- vma->vm_mm = mm;
- vma->vm_start = addr;
- vma->vm_end = addr + len;
-@@ -1180,8 +1312,9 @@ munmap_back:
- vma->vm_page_prot = vm_get_page_prot(vm_flags);
- vma->vm_pgoff = pgoff;
-
-+ error = -EINVAL; /* when rejecting VM_GROWSDOWN|VM_GROWSUP */
-+
- if (file) {
-- error = -EINVAL;
- if (vm_flags & (VM_GROWSDOWN|VM_GROWSUP))
- goto free_vma;
- if (vm_flags & VM_DENYWRITE) {
-@@ -1195,6 +1328,19 @@ munmap_back:
- error = file->f_op->mmap(file, vma);
- if (error)
- goto unmap_and_free_vma;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (vma_m && (vm_flags & VM_EXECUTABLE))
-+ added_exe_file_vma(mm);
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
-+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && !(vma->vm_flags & VM_SPECIAL)) {
-+ vma->vm_flags |= VM_PAGEEXEC;
-+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
-+ }
-+#endif
-+
- if (vm_flags & VM_EXECUTABLE)
- added_exe_file_vma(mm);
-
-@@ -1207,6 +1353,8 @@ munmap_back:
- pgoff = vma->vm_pgoff;
- vm_flags = vma->vm_flags;
- } else if (vm_flags & VM_SHARED) {
-+ if (unlikely(vm_flags & (VM_GROWSDOWN|VM_GROWSUP)))
-+ goto free_vma;
- error = shmem_zero_setup(vma);
- if (error)
- goto free_vma;
-@@ -1218,6 +1366,11 @@ munmap_back:
- vma_link(mm, vma, prev, rb_link, rb_parent);
- file = vma->vm_file;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (vma_m)
-+ pax_mirror_vma(vma_m, vma);
-+#endif
-+
- /* Once vma denies write, undo our temporary denial count */
- if (correct_wcount)
- atomic_inc(&inode->i_writecount);
-@@ -1226,6 +1379,7 @@ out:
-
- mm->total_vm += len >> PAGE_SHIFT;
- vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
-+ track_exec_limit(mm, addr, addr + len, vm_flags);
- if (vm_flags & VM_LOCKED) {
- /*
- * makes pages present; downgrades, drops, reacquires mmap_sem
-@@ -1248,6 +1402,12 @@ unmap_and_free_vma:
- unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
- charged = 0;
- free_vma:
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (vma_m)
-+ kmem_cache_free(vm_area_cachep, vma_m);
-+#endif
-+
- kmem_cache_free(vm_area_cachep, vma);
- unacct_error:
- if (charged)
-@@ -1255,6 +1415,62 @@ unacct_error:
- return error;
- }
-
-+#ifdef CONFIG_GRKERNSEC_RAND_THREADSTACK
-+unsigned long gr_rand_threadstack_offset(const struct mm_struct *mm, const struct file *filp, unsigned long flags)
-+{
-+ if ((mm->pax_flags & MF_PAX_RANDMMAP) && !filp && (flags & MAP_STACK))
-+ return (random32() & 0xFF) << PAGE_SHIFT;
-+
-+ return 0;
-+}
-+#endif
-+
-+bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len, unsigned long offset)
-+{
-+ if (!vma) {
-+#ifdef CONFIG_STACK_GROWSUP
-+ if (addr > sysctl_heap_stack_gap)
-+ vma = find_vma(current->mm, addr - sysctl_heap_stack_gap);
-+ else
-+ vma = find_vma(current->mm, 0);
-+ if (vma && (vma->vm_flags & VM_GROWSUP))
-+ return false;
-+#endif
-+ return true;
-+ }
-+
-+ if (addr + len > vma->vm_start)
-+ return false;
-+
-+ if (vma->vm_flags & VM_GROWSDOWN)
-+ return sysctl_heap_stack_gap <= vma->vm_start - addr - len;
-+#ifdef CONFIG_STACK_GROWSUP
-+ else if (vma->vm_prev && (vma->vm_prev->vm_flags & VM_GROWSUP))
-+ return addr - vma->vm_prev->vm_end <= sysctl_heap_stack_gap;
-+#endif
-+ else if (offset)
-+ return offset <= vma->vm_start - addr - len;
-+
-+ return true;
-+}
-+
-+unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len, unsigned long offset)
-+{
-+ if (vma->vm_start < len)
-+ return -ENOMEM;
-+
-+ if (!(vma->vm_flags & VM_GROWSDOWN)) {
-+ if (offset <= vma->vm_start - len)
-+ return vma->vm_start - len - offset;
-+ else
-+ return -ENOMEM;
-+ }
-+
-+ if (sysctl_heap_stack_gap <= vma->vm_start - len)
-+ return vma->vm_start - len - sysctl_heap_stack_gap;
-+ return -ENOMEM;
-+}
-+
- /* Get an address range which is currently unmapped.
- * For shmat() with addr=0.
- *
-@@ -1281,18 +1497,23 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
- if (flags & MAP_FIXED)
- return addr;
-
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- if (addr) {
- addr = PAGE_ALIGN(addr);
-- vma = find_vma(mm, addr);
-- if (TASK_SIZE - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-- return addr;
-+ if (TASK_SIZE - len >= addr) {
-+ vma = find_vma(mm, addr);
-+ if (check_heap_stack_gap(vma, addr, len))
-+ return addr;
-+ }
- }
- if (len > mm->cached_hole_size) {
-- start_addr = addr = mm->free_area_cache;
-+ start_addr = addr = mm->free_area_cache;
- } else {
-- start_addr = addr = TASK_UNMAPPED_BASE;
-- mm->cached_hole_size = 0;
-+ start_addr = addr = mm->mmap_base;
-+ mm->cached_hole_size = 0;
- }
-
- full_search:
-@@ -1303,34 +1524,40 @@ full_search:
- * Start a new search - just in case we missed
- * some holes.
- */
-- if (start_addr != TASK_UNMAPPED_BASE) {
-- addr = TASK_UNMAPPED_BASE;
-- start_addr = addr;
-+ if (start_addr != mm->mmap_base) {
-+ start_addr = addr = mm->mmap_base;
- mm->cached_hole_size = 0;
- goto full_search;
- }
- return -ENOMEM;
- }
-- if (!vma || addr + len <= vma->vm_start) {
-- /*
-- * Remember the place where we stopped the search:
-- */
-- mm->free_area_cache = addr + len;
-- return addr;
-- }
-+ if (check_heap_stack_gap(vma, addr, len))
-+ break;
- if (addr + mm->cached_hole_size < vma->vm_start)
- mm->cached_hole_size = vma->vm_start - addr;
- addr = vma->vm_end;
- }
-+
-+ /*
-+ * Remember the place where we stopped the search:
-+ */
-+ mm->free_area_cache = addr + len;
-+ return addr;
- }
- #endif
-
- void arch_unmap_area(struct mm_struct *mm, unsigned long addr)
- {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
-+ return;
-+#endif
-+
- /*
- * Is this a new hole at the lowest possible address?
- */
-- if (addr >= TASK_UNMAPPED_BASE && addr < mm->free_area_cache) {
-+ if (addr >= mm->mmap_base && addr < mm->free_area_cache) {
- mm->free_area_cache = addr;
- mm->cached_hole_size = ~0UL;
- }
-@@ -1348,7 +1575,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- {
- struct vm_area_struct *vma;
- struct mm_struct *mm = current->mm;
-- unsigned long addr = addr0;
-+ unsigned long base = mm->mmap_base, addr = addr0;
-
- /* requested length too big for entire address space */
- if (len > TASK_SIZE)
-@@ -1357,13 +1584,18 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- if (flags & MAP_FIXED)
- return addr;
-
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- /* requesting a specific address */
- if (addr) {
- addr = PAGE_ALIGN(addr);
-- vma = find_vma(mm, addr);
-- if (TASK_SIZE - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-- return addr;
-+ if (TASK_SIZE - len >= addr) {
-+ vma = find_vma(mm, addr);
-+ if (check_heap_stack_gap(vma, addr, len))
-+ return addr;
-+ }
- }
-
- /* check if free_area_cache is useful for us */
-@@ -1378,7 +1610,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- /* make sure it can fit in the remaining address space */
- if (addr > len) {
- vma = find_vma(mm, addr-len);
-- if (!vma || addr <= vma->vm_start)
-+ if (check_heap_stack_gap(vma, addr - len, len))
- /* remember the address as a hint for next time */
- return (mm->free_area_cache = addr-len);
- }
-@@ -1395,7 +1627,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- * return with success:
- */
- vma = find_vma(mm, addr);
-- if (!vma || addr+len <= vma->vm_start)
-+ if (check_heap_stack_gap(vma, addr, len))
- /* remember the address as a hint for next time */
- return (mm->free_area_cache = addr);
-
-@@ -1404,8 +1636,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- mm->cached_hole_size = vma->vm_start - addr;
-
- /* try just below the current vma->vm_start */
-- addr = vma->vm_start-len;
-- } while (len < vma->vm_start);
-+ addr = skip_heap_stack_gap(vma, len);
-+ } while (!IS_ERR_VALUE(addr));
-
- bottomup:
- /*
-@@ -1414,13 +1646,21 @@ bottomup:
- * can happen with large stack limits and large mmap()
- * allocations.
- */
-+ mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base += mm->delta_mmap;
-+#endif
-+
-+ mm->free_area_cache = mm->mmap_base;
- mm->cached_hole_size = ~0UL;
-- mm->free_area_cache = TASK_UNMAPPED_BASE;
- addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
- /*
- * Restore the topdown base:
- */
-- mm->free_area_cache = mm->mmap_base;
-+ mm->mmap_base = base;
-+ mm->free_area_cache = base;
- mm->cached_hole_size = ~0UL;
-
- return addr;
-@@ -1429,6 +1669,12 @@ bottomup:
-
- void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
- {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
-+ return;
-+#endif
-+
- /*
- * Is this a new hole at the highest possible address?
- */
-@@ -1436,8 +1682,10 @@ void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
- mm->free_area_cache = addr;
-
- /* dont allow allocations above current base */
-- if (mm->free_area_cache > mm->mmap_base)
-+ if (mm->free_area_cache > mm->mmap_base) {
- mm->free_area_cache = mm->mmap_base;
-+ mm->cached_hole_size = ~0UL;
-+ }
- }
-
- unsigned long
-@@ -1510,40 +1758,49 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
-
- EXPORT_SYMBOL(find_vma);
-
--/* Same as find_vma, but also return a pointer to the previous VMA in *pprev. */
-+/*
-+ * Same as find_vma, but also return a pointer to the previous VMA in *pprev.
-+ */
- struct vm_area_struct *
- find_vma_prev(struct mm_struct *mm, unsigned long addr,
- struct vm_area_struct **pprev)
- {
-- struct vm_area_struct *vma = NULL, *prev = NULL;
-- struct rb_node *rb_node;
-- if (!mm)
-- goto out;
--
-- /* Guard against addr being lower than the first VMA */
-- vma = mm->mmap;
--
-- /* Go through the RB tree quickly. */
-- rb_node = mm->mm_rb.rb_node;
--
-- while (rb_node) {
-- struct vm_area_struct *vma_tmp;
-- vma_tmp = rb_entry(rb_node, struct vm_area_struct, vm_rb);
--
-- if (addr < vma_tmp->vm_end) {
-- rb_node = rb_node->rb_left;
-- } else {
-- prev = vma_tmp;
-- if (!prev->vm_next || (addr < prev->vm_next->vm_end))
-- break;
-+ struct vm_area_struct *vma;
-+
-+ vma = find_vma(mm, addr);
-+ if (vma) {
-+ *pprev = vma->vm_prev;
-+ } else {
-+ struct rb_node *rb_node = mm->mm_rb.rb_node;
-+ *pprev = NULL;
-+ while (rb_node) {
-+ *pprev = rb_entry(rb_node, struct vm_area_struct, vm_rb);
- rb_node = rb_node->rb_right;
- }
- }
-+ return vma;
-+}
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma)
-+{
-+ struct vm_area_struct *vma_m;
-
--out:
-- *pprev = prev;
-- return prev ? prev->vm_next : vma;
-+ BUG_ON(!vma || vma->vm_start >= vma->vm_end);
-+ if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC)) {
-+ BUG_ON(vma->vm_mirror);
-+ return NULL;
-+ }
-+ BUG_ON(vma->vm_start < SEGMEXEC_TASK_SIZE && SEGMEXEC_TASK_SIZE < vma->vm_end);
-+ vma_m = vma->vm_mirror;
-+ BUG_ON(!vma_m || vma_m->vm_mirror != vma);
-+ BUG_ON(vma->vm_file != vma_m->vm_file);
-+ BUG_ON(vma->vm_end - vma->vm_start != vma_m->vm_end - vma_m->vm_start);
-+ BUG_ON(vma->vm_pgoff != vma_m->vm_pgoff || vma->anon_vma != vma_m->anon_vma);
-+ BUG_ON((vma->vm_flags ^ vma_m->vm_flags) & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED | VM_RESERVED));
-+ return vma_m;
- }
-+#endif
-
- /*
- * Verify that the stack growth is acceptable and
-@@ -1561,6 +1818,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
- return -ENOMEM;
-
- /* Stack limit test */
-+ gr_learn_resource(current, RLIMIT_STACK, size, 1);
- if (size > rlim[RLIMIT_STACK].rlim_cur)
- return -ENOMEM;
-
-@@ -1570,6 +1828,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
- unsigned long limit;
- locked = mm->locked_vm + grow;
- limit = rlim[RLIMIT_MEMLOCK].rlim_cur >> PAGE_SHIFT;
-+ gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
- if (locked > limit && !capable(CAP_IPC_LOCK))
- return -ENOMEM;
- }
-@@ -1600,37 +1859,48 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
- * PA-RISC uses this for its stack; IA64 for its Register Backing Store.
- * vma is the last one with address > vma->vm_end. Have to extend vma.
- */
-+#ifndef CONFIG_IA64
-+static
-+#endif
- int expand_upwards(struct vm_area_struct *vma, unsigned long address)
- {
- int error;
-+ bool locknext;
-
- if (!(vma->vm_flags & VM_GROWSUP))
- return -EFAULT;
-
-+ /* Also guard against wrapping around to address 0. */
-+ if (address < PAGE_ALIGN(address+1))
-+ address = PAGE_ALIGN(address+1);
-+ else
-+ return -ENOMEM;
-+
- /*
- * We must make sure the anon_vma is allocated
- * so that the anon_vma locking is not a noop.
- */
- if (unlikely(anon_vma_prepare(vma)))
- return -ENOMEM;
-+ locknext = vma->vm_next && (vma->vm_next->vm_flags & VM_GROWSDOWN);
-+ if (locknext && anon_vma_prepare(vma->vm_next))
-+ return -ENOMEM;
- anon_vma_lock(vma);
-+ if (locknext)
-+ anon_vma_lock(vma->vm_next);
-
- /*
- * vma->vm_start/vm_end cannot change under us because the caller
- * is required to hold the mmap_sem in read mode. We need the
-- * anon_vma lock to serialize against concurrent expand_stacks.
-- * Also guard against wrapping around to address 0.
-+ * anon_vma locks to serialize against concurrent expand_stacks
-+ * and expand_upwards.
- */
-- if (address < PAGE_ALIGN(address+4))
-- address = PAGE_ALIGN(address+4);
-- else {
-- anon_vma_unlock(vma);
-- return -ENOMEM;
-- }
- error = 0;
-
- /* Somebody else might have raced and expanded it already */
-- if (address > vma->vm_end) {
-+ if (vma->vm_next && (vma->vm_next->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && vma->vm_next->vm_start - address < sysctl_heap_stack_gap)
-+ error = -ENOMEM;
-+ else if (address > vma->vm_end && (!locknext || vma->vm_next->vm_start >= address)) {
- unsigned long size, grow;
-
- size = address - vma->vm_start;
-@@ -1643,6 +1913,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
- vma->vm_end = address;
- }
- }
-+ if (locknext)
-+ anon_vma_unlock(vma->vm_next);
- anon_vma_unlock(vma);
- return error;
- }
-@@ -1655,6 +1927,8 @@ static int expand_downwards(struct vm_area_struct *vma,
- unsigned long address)
- {
- int error;
-+ bool lockprev = false;
-+ struct vm_area_struct *prev;
-
- /*
- * We must make sure the anon_vma is allocated
-@@ -1668,6 +1942,15 @@ static int expand_downwards(struct vm_area_struct *vma,
- if (error)
- return error;
-
-+ prev = vma->vm_prev;
-+#if defined(CONFIG_STACK_GROWSUP) || defined(CONFIG_IA64)
-+ lockprev = prev && (prev->vm_flags & VM_GROWSUP);
-+#endif
-+ if (lockprev && anon_vma_prepare(prev))
-+ return -ENOMEM;
-+ if (lockprev)
-+ anon_vma_lock(prev);
-+
- anon_vma_lock(vma);
-
- /*
-@@ -1677,9 +1960,17 @@ static int expand_downwards(struct vm_area_struct *vma,
- */
-
- /* Somebody else might have raced and expanded it already */
-- if (address < vma->vm_start) {
-+ if (prev && (prev->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && address - prev->vm_end < sysctl_heap_stack_gap)
-+ error = -ENOMEM;
-+ else if (address < vma->vm_start && (!lockprev || prev->vm_end <= address)) {
- unsigned long size, grow;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m;
-+
-+ vma_m = pax_find_mirror_vma(vma);
-+#endif
-+
- size = vma->vm_end - address;
- grow = (vma->vm_start - address) >> PAGE_SHIFT;
-
-@@ -1689,10 +1980,22 @@ static int expand_downwards(struct vm_area_struct *vma,
- if (!error) {
- vma->vm_start = address;
- vma->vm_pgoff -= grow;
-+ track_exec_limit(vma->vm_mm, vma->vm_start, vma->vm_end, vma->vm_flags);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (vma_m) {
-+ vma_m->vm_start -= grow << PAGE_SHIFT;
-+ vma_m->vm_pgoff -= grow;
-+ }
-+#endif
-+
-+
- }
- }
- }
- anon_vma_unlock(vma);
-+ if (lockprev)
-+ anon_vma_unlock(prev);
- return error;
- }
-
-@@ -1768,6 +2071,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
- do {
- long nrpages = vma_pages(vma);
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE)) {
-+ vma = remove_vma(vma);
-+ continue;
-+ }
-+#endif
-+
- mm->total_vm -= nrpages;
- vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
- vma = remove_vma(vma);
-@@ -1813,6 +2123,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
- insertion_point = (prev ? &prev->vm_next : &mm->mmap);
- vma->vm_prev = NULL;
- do {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (vma->vm_mirror) {
-+ BUG_ON(!vma->vm_mirror->vm_mirror || vma->vm_mirror->vm_mirror != vma);
-+ vma->vm_mirror->vm_mirror = NULL;
-+ vma->vm_mirror->vm_flags &= ~VM_EXEC;
-+ vma->vm_mirror = NULL;
-+ }
-+#endif
-+
- rb_erase(&vma->vm_rb, &mm->mm_rb);
- mm->map_count--;
- tail_vma = vma;
-@@ -1840,10 +2160,25 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
- struct mempolicy *pol;
- struct vm_area_struct *new;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m, *new_m = NULL;
-+ unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE;
-+#endif
-+
- if (is_vm_hugetlb_page(vma) && (addr &
- ~(huge_page_mask(hstate_vma(vma)))))
- return -EINVAL;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ vma_m = pax_find_mirror_vma(vma);
-+
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC) {
-+ BUG_ON(vma->vm_end > SEGMEXEC_TASK_SIZE);
-+ if (mm->map_count >= sysctl_max_map_count-1)
-+ return -ENOMEM;
-+ } else
-+#endif
-+
- if (mm->map_count >= sysctl_max_map_count)
- return -ENOMEM;
-
-@@ -1851,6 +2186,16 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
- if (!new)
- return -ENOMEM;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (vma_m) {
-+ new_m = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
-+ if (!new_m) {
-+ kmem_cache_free(vm_area_cachep, new);
-+ return -ENOMEM;
-+ }
-+ }
-+#endif
-+
- /* most fields are the same, copy all, and then fixup */
- *new = *vma;
-
-@@ -1861,8 +2206,29 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
- new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
- }
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (vma_m) {
-+ *new_m = *vma_m;
-+ new_m->vm_mirror = new;
-+ new->vm_mirror = new_m;
-+
-+ if (new_below)
-+ new_m->vm_end = addr_m;
-+ else {
-+ new_m->vm_start = addr_m;
-+ new_m->vm_pgoff += ((addr_m - vma_m->vm_start) >> PAGE_SHIFT);
-+ }
-+ }
-+#endif
-+
- pol = mpol_dup(vma_policy(vma));
- if (IS_ERR(pol)) {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (new_m)
-+ kmem_cache_free(vm_area_cachep, new_m);
-+#endif
-+
- kmem_cache_free(vm_area_cachep, new);
- return PTR_ERR(pol);
- }
-@@ -1883,6 +2249,28 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
- else
- vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (vma_m) {
-+ mpol_get(pol);
-+ vma_set_policy(new_m, pol);
-+
-+ if (new_m->vm_file) {
-+ get_file(new_m->vm_file);
-+ if (vma_m->vm_flags & VM_EXECUTABLE)
-+ added_exe_file_vma(mm);
-+ }
-+
-+ if (new_m->vm_ops && new_m->vm_ops->open)
-+ new_m->vm_ops->open(new_m);
-+
-+ if (new_below)
-+ vma_adjust(vma_m, addr_m, vma_m->vm_end, vma_m->vm_pgoff +
-+ ((addr_m - new_m->vm_start) >> PAGE_SHIFT), new_m);
-+ else
-+ vma_adjust(vma_m, vma_m->vm_start, addr_m, vma_m->vm_pgoff, new_m);
-+ }
-+#endif
-+
- return 0;
- }
-
-@@ -1891,11 +2279,30 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
- * work. This now handles partial unmappings.
- * Jeremy Fitzhardinge <jeremy@goop.org>
- */
-+#ifdef CONFIG_PAX_SEGMEXEC
- int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
- {
-+ int ret = __do_munmap(mm, start, len);
-+ if (ret || !(mm->pax_flags & MF_PAX_SEGMEXEC))
-+ return ret;
-+
-+ return __do_munmap(mm, start + SEGMEXEC_TASK_SIZE, len);
-+}
-+
-+int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
-+#else
-+int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
-+#endif
-+{
- unsigned long end;
- struct vm_area_struct *vma, *prev, *last;
-
-+ /*
-+ * mm->mmap_sem is required to protect against another thread
-+ * changing the mappings in case we sleep.
-+ */
-+ verify_mm_writelocked(mm);
-+
- if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
- return -EINVAL;
-
-@@ -1959,6 +2366,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
- /* Fix up all other VM information */
- remove_vma_list(mm, vma);
-
-+ track_exec_limit(mm, start, end, 0UL);
-+
- return 0;
- }
-
-@@ -1971,22 +2380,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
-
- profile_munmap(addr);
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) &&
-+ (len > SEGMEXEC_TASK_SIZE || addr > SEGMEXEC_TASK_SIZE-len))
-+ return -EINVAL;
-+#endif
-+
- down_write(&mm->mmap_sem);
- ret = do_munmap(mm, addr, len);
- up_write(&mm->mmap_sem);
- return ret;
- }
-
--static inline void verify_mm_writelocked(struct mm_struct *mm)
--{
--#ifdef CONFIG_DEBUG_VM
-- if (unlikely(down_read_trylock(&mm->mmap_sem))) {
-- WARN_ON(1);
-- up_read(&mm->mmap_sem);
-- }
--#endif
--}
--
- /*
- * this is really a simplified "do_mmap". it only handles
- * anonymous maps. eventually we may be able to do some
-@@ -2000,6 +2405,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
- struct rb_node ** rb_link, * rb_parent;
- pgoff_t pgoff = addr >> PAGE_SHIFT;
- int error;
-+ unsigned long charged;
-
- len = PAGE_ALIGN(len);
- if (!len)
-@@ -2011,16 +2417,30 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
-
- flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
-
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+ if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+ flags &= ~VM_EXEC;
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (mm->pax_flags & MF_PAX_MPROTECT)
-+ flags &= ~VM_MAYEXEC;
-+#endif
-+
-+ }
-+#endif
-+
- error = get_unmapped_area(NULL, addr, len, 0, MAP_FIXED);
- if (error & ~PAGE_MASK)
- return error;
-
-+ charged = len >> PAGE_SHIFT;
-+
- /*
- * mlock MCL_FUTURE?
- */
- if (mm->def_flags & VM_LOCKED) {
- unsigned long locked, lock_limit;
-- locked = len >> PAGE_SHIFT;
-+ locked = charged;
- locked += mm->locked_vm;
- lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
- lock_limit >>= PAGE_SHIFT;
-@@ -2037,22 +2457,22 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
- /*
- * Clear old maps. this also does some error checking for us
- */
-- munmap_back:
- vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
- if (vma && vma->vm_start < addr + len) {
- if (do_munmap(mm, addr, len))
- return -ENOMEM;
-- goto munmap_back;
-+ vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
-+ BUG_ON(vma && vma->vm_start < addr + len);
- }
-
- /* Check against address space limits *after* clearing old maps... */
-- if (!may_expand_vm(mm, len >> PAGE_SHIFT))
-+ if (!may_expand_vm(mm, charged))
- return -ENOMEM;
-
- if (mm->map_count > sysctl_max_map_count)
- return -ENOMEM;
-
-- if (security_vm_enough_memory(len >> PAGE_SHIFT))
-+ if (security_vm_enough_memory(charged))
- return -ENOMEM;
-
- /* Can we just expand an old private anonymous mapping? */
-@@ -2066,7 +2486,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
- */
- vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
- if (!vma) {
-- vm_unacct_memory(len >> PAGE_SHIFT);
-+ vm_unacct_memory(charged);
- return -ENOMEM;
- }
-
-@@ -2078,11 +2498,12 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
- vma->vm_page_prot = vm_get_page_prot(flags);
- vma_link(mm, vma, prev, rb_link, rb_parent);
- out:
-- mm->total_vm += len >> PAGE_SHIFT;
-+ mm->total_vm += charged;
- if (flags & VM_LOCKED) {
- if (!mlock_vma_pages_range(vma, addr, addr + len))
-- mm->locked_vm += (len >> PAGE_SHIFT);
-+ mm->locked_vm += charged;
- }
-+ track_exec_limit(mm, addr, addr + len, flags);
- return addr;
- }
-
-@@ -2129,8 +2550,10 @@ void exit_mmap(struct mm_struct *mm)
- * Walk the list again, actually closing and freeing it,
- * with preemption enabled, without holding any MM locks.
- */
-- while (vma)
-+ while (vma) {
-+ vma->vm_mirror = NULL;
- vma = remove_vma(vma);
-+ }
-
- BUG_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT);
- }
-@@ -2144,6 +2567,10 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
- struct vm_area_struct * __vma, * prev;
- struct rb_node ** rb_link, * rb_parent;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m = NULL;
-+#endif
-+
- /*
- * The vm_pgoff of a purely anonymous vma should be irrelevant
- * until its first write fault, when page's anon_vma and index
-@@ -2166,7 +2593,22 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
- if ((vma->vm_flags & VM_ACCOUNT) &&
- security_vm_enough_memory_mm(mm, vma_pages(vma)))
- return -ENOMEM;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_EXEC)) {
-+ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
-+ if (!vma_m)
-+ return -ENOMEM;
-+ }
-+#endif
-+
- vma_link(mm, vma, prev, rb_link, rb_parent);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (vma_m)
-+ pax_mirror_vma(vma_m, vma);
-+#endif
-+
- return 0;
- }
-
-@@ -2184,6 +2626,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
- struct rb_node **rb_link, *rb_parent;
- struct mempolicy *pol;
-
-+ BUG_ON(vma->vm_mirror);
-+
- /*
- * If anonymous vma has not yet been faulted, update new pgoff
- * to match new location, to increase its chance of merging.
-@@ -2227,6 +2671,35 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
- return new_vma;
- }
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+void pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma)
-+{
-+ struct vm_area_struct *prev_m;
-+ struct rb_node **rb_link_m, *rb_parent_m;
-+ struct mempolicy *pol_m;
-+
-+ BUG_ON(!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC));
-+ BUG_ON(vma->vm_mirror || vma_m->vm_mirror);
-+ BUG_ON(!mpol_equal(vma_policy(vma), vma_policy(vma_m)));
-+ *vma_m = *vma;
-+ pol_m = vma_policy(vma_m);
-+ mpol_get(pol_m);
-+ vma_set_policy(vma_m, pol_m);
-+ vma_m->vm_start += SEGMEXEC_TASK_SIZE;
-+ vma_m->vm_end += SEGMEXEC_TASK_SIZE;
-+ vma_m->vm_flags &= ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED);
-+ vma_m->vm_page_prot = vm_get_page_prot(vma_m->vm_flags);
-+ if (vma_m->vm_file)
-+ get_file(vma_m->vm_file);
-+ if (vma_m->vm_ops && vma_m->vm_ops->open)
-+ vma_m->vm_ops->open(vma_m);
-+ find_vma_prepare(vma->vm_mm, vma_m->vm_start, &prev_m, &rb_link_m, &rb_parent_m);
-+ vma_link(vma->vm_mm, vma_m, prev_m, rb_link_m, rb_parent_m);
-+ vma_m->vm_mirror = vma;
-+ vma->vm_mirror = vma_m;
-+}
-+#endif
-+
- /*
- * Return true if the calling process may expand its vm space by the passed
- * number of pages
-@@ -2238,6 +2711,12 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages)
-
- lim = current->signal->rlim[RLIMIT_AS].rlim_cur >> PAGE_SHIFT;
-
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ cur -= mm->brk_gap;
-+#endif
-+
-+ gr_learn_resource(current, RLIMIT_AS, (cur + npages) << PAGE_SHIFT, 1);
- if (cur + npages > lim)
- return 0;
- return 1;
-@@ -2307,6 +2786,22 @@ int install_special_mapping(struct mm_struct *mm,
- vma->vm_start = addr;
- vma->vm_end = addr + len;
-
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (mm->pax_flags & MF_PAX_MPROTECT) {
-+#ifndef CONFIG_PAX_MPROTECT_COMPAT
-+ if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC))
-+ return -EPERM;
-+ if (!(vm_flags & VM_EXEC))
-+ vm_flags &= ~VM_MAYEXEC;
-+#else
-+ if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
-+ vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
-+#endif
-+ else
-+ vm_flags &= ~VM_MAYWRITE;
-+ }
-+#endif
-+
- vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND;
- vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
-
-diff --git a/mm/mprotect.c b/mm/mprotect.c
-index 1737c7e..c7faeb4 100644
---- a/mm/mprotect.c
-+++ b/mm/mprotect.c
-@@ -24,10 +24,16 @@
- #include <linux/mmu_notifier.h>
- #include <linux/migrate.h>
- #include <linux/perf_event.h>
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+#include <linux/elf.h>
-+#endif
-+
- #include <asm/uaccess.h>
- #include <asm/pgtable.h>
- #include <asm/cacheflush.h>
- #include <asm/tlbflush.h>
-+#include <asm/mmu_context.h>
-
- #ifndef pgprot_modify
- static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
-@@ -132,6 +138,48 @@ static void change_protection(struct vm_area_struct *vma,
- flush_tlb_range(vma, start, end);
- }
-
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+/* called while holding the mmap semaphor for writing except stack expansion */
-+void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot)
-+{
-+ unsigned long oldlimit, newlimit = 0UL;
-+
-+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || nx_enabled)
-+ return;
-+
-+ spin_lock(&mm->page_table_lock);
-+ oldlimit = mm->context.user_cs_limit;
-+ if ((prot & VM_EXEC) && oldlimit < end)
-+ /* USER_CS limit moved up */
-+ newlimit = end;
-+ else if (!(prot & VM_EXEC) && start < oldlimit && oldlimit <= end)
-+ /* USER_CS limit moved down */
-+ newlimit = start;
-+
-+ if (newlimit) {
-+ mm->context.user_cs_limit = newlimit;
-+
-+#ifdef CONFIG_SMP
-+ wmb();
-+ cpus_clear(mm->context.cpu_user_cs_mask);
-+ cpu_set(smp_processor_id(), mm->context.cpu_user_cs_mask);
-+#endif
-+
-+ set_user_cs(mm->context.user_cs_base, mm->context.user_cs_limit, smp_processor_id());
-+ }
-+ spin_unlock(&mm->page_table_lock);
-+ if (newlimit == end) {
-+ struct vm_area_struct *vma = find_vma(mm, oldlimit);
-+
-+ for (; vma && vma->vm_start < end; vma = vma->vm_next)
-+ if (is_vm_hugetlb_page(vma))
-+ hugetlb_change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot);
-+ else
-+ change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot, vma_wants_writenotify(vma));
-+ }
-+}
-+#endif
-+
- int
- mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
- unsigned long start, unsigned long end, unsigned long newflags)
-@@ -144,11 +192,29 @@ mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
- int error;
- int dirty_accountable = 0;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m = NULL;
-+ unsigned long start_m, end_m;
-+
-+ start_m = start + SEGMEXEC_TASK_SIZE;
-+ end_m = end + SEGMEXEC_TASK_SIZE;
-+#endif
-+
- if (newflags == oldflags) {
- *pprev = vma;
- return 0;
- }
-
-+ if (newflags & (VM_READ | VM_WRITE | VM_EXEC)) {
-+ struct vm_area_struct *prev = vma->vm_prev, *next = vma->vm_next;
-+
-+ if (next && (next->vm_flags & VM_GROWSDOWN) && sysctl_heap_stack_gap > next->vm_start - end)
-+ return -ENOMEM;
-+
-+ if (prev && (prev->vm_flags & VM_GROWSUP) && sysctl_heap_stack_gap > start - prev->vm_end)
-+ return -ENOMEM;
-+ }
-+
- /*
- * If we make a private mapping writable we increase our commit;
- * but (without finer accounting) cannot reduce our commit if we
-@@ -165,6 +231,38 @@ mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
- }
- }
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && ((oldflags ^ newflags) & VM_EXEC)) {
-+ if (start != vma->vm_start) {
-+ error = split_vma(mm, vma, start, 1);
-+ if (error)
-+ goto fail;
-+ BUG_ON(!*pprev || (*pprev)->vm_next == vma);
-+ *pprev = (*pprev)->vm_next;
-+ }
-+
-+ if (end != vma->vm_end) {
-+ error = split_vma(mm, vma, end, 0);
-+ if (error)
-+ goto fail;
-+ }
-+
-+ if (pax_find_mirror_vma(vma)) {
-+ error = __do_munmap(mm, start_m, end_m - start_m);
-+ if (error)
-+ goto fail;
-+ } else {
-+ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
-+ if (!vma_m) {
-+ error = -ENOMEM;
-+ goto fail;
-+ }
-+ vma->vm_flags = newflags;
-+ pax_mirror_vma(vma_m, vma);
-+ }
-+ }
-+#endif
-+
- /*
- * First try to merge with previous and/or next vma.
- */
-@@ -195,9 +293,21 @@ success:
- * vm_flags and vm_page_prot are protected by the mmap_sem
- * held in write mode.
- */
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (newflags & VM_EXEC) && ((vma->vm_flags ^ newflags) & VM_READ))
-+ pax_find_mirror_vma(vma)->vm_flags ^= VM_READ;
-+#endif
-+
- vma->vm_flags = newflags;
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (mm->binfmt && mm->binfmt->handle_mprotect)
-+ mm->binfmt->handle_mprotect(vma, newflags);
-+#endif
-+
- vma->vm_page_prot = pgprot_modify(vma->vm_page_prot,
-- vm_get_page_prot(newflags));
-+ vm_get_page_prot(vma->vm_flags));
-
- if (vma_wants_writenotify(vma)) {
- vma->vm_page_prot = vm_get_page_prot(newflags & ~VM_SHARED);
-@@ -239,6 +349,17 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
- end = start + len;
- if (end <= start)
- return -ENOMEM;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
-+ if (end > SEGMEXEC_TASK_SIZE)
-+ return -EINVAL;
-+ } else
-+#endif
-+
-+ if (end > TASK_SIZE)
-+ return -EINVAL;
-+
- if (!arch_validate_prot(prot))
- return -EINVAL;
-
-@@ -246,7 +367,7 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
- /*
- * Does the application expect PROT_READ to imply PROT_EXEC:
- */
-- if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
-+ if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
- prot |= PROT_EXEC;
-
- vm_flags = calc_vm_prot_bits(prot);
-@@ -278,6 +399,11 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
- if (start > vma->vm_start)
- prev = vma;
-
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (current->mm->binfmt && current->mm->binfmt->handle_mprotect)
-+ current->mm->binfmt->handle_mprotect(vma, vm_flags);
-+#endif
-+
- for (nstart = start ; ; ) {
- unsigned long newflags;
-
-@@ -287,6 +413,14 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
-
- /* newflags >> 4 shift VM_MAY% in place of VM_% */
- if ((newflags & ~(newflags >> 4)) & (VM_READ | VM_WRITE | VM_EXEC)) {
-+ if (prot & (PROT_WRITE | PROT_EXEC))
-+ gr_log_rwxmprotect(vma->vm_file);
-+
-+ error = -EACCES;
-+ goto out;
-+ }
-+
-+ if (!gr_acl_handle_mprotect(vma->vm_file, prot)) {
- error = -EACCES;
- goto out;
- }
-@@ -301,6 +435,9 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
- error = mprotect_fixup(vma, &prev, nstart, tmp, newflags);
- if (error)
- goto out;
-+
-+ track_exec_limit(current->mm, nstart, tmp, vm_flags);
-+
- nstart = tmp;
-
- if (nstart < prev->vm_end)
-diff --git a/mm/mremap.c b/mm/mremap.c
-index 3e98d79..1706cec 100644
---- a/mm/mremap.c
-+++ b/mm/mremap.c
-@@ -112,6 +112,12 @@ static void move_ptes(struct vm_area_struct *vma, pmd_t *old_pmd,
- continue;
- pte = ptep_clear_flush(vma, old_addr, old_pte);
- pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
-+
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+ if (!nx_enabled && (new_vma->vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC)
-+ pte = pte_exprotect(pte);
-+#endif
-+
- set_pte_at(mm, new_addr, new_pte, pte);
- }
-
-@@ -271,6 +277,11 @@ static struct vm_area_struct *vma_to_resize(unsigned long addr,
- if (is_vm_hugetlb_page(vma))
- goto Einval;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (pax_find_mirror_vma(vma))
-+ goto Einval;
-+#endif
-+
- /* We can't remap across vm area boundaries */
- if (old_len > vma->vm_end - addr)
- goto Efault;
-@@ -327,20 +338,25 @@ static unsigned long mremap_to(unsigned long addr,
- unsigned long ret = -EINVAL;
- unsigned long charged = 0;
- unsigned long map_flags;
-+ unsigned long pax_task_size = TASK_SIZE;
-
- if (new_addr & ~PAGE_MASK)
- goto out;
-
-- if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len)
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+ pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+ pax_task_size -= PAGE_SIZE;
-+
-+ if (new_len > TASK_SIZE || new_addr > pax_task_size - new_len)
- goto out;
-
- /* Check if the location we're moving into overlaps the
- * old location at all, and fail if it does.
- */
-- if ((new_addr <= addr) && (new_addr+new_len) > addr)
-- goto out;
--
-- if ((addr <= new_addr) && (addr+old_len) > new_addr)
-+ if (addr + old_len > new_addr && new_addr + new_len > addr)
- goto out;
-
- ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
-@@ -412,6 +428,7 @@ unsigned long do_mremap(unsigned long addr,
- struct vm_area_struct *vma;
- unsigned long ret = -EINVAL;
- unsigned long charged = 0;
-+ unsigned long pax_task_size = TASK_SIZE;
-
- if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
- goto out;
-@@ -430,6 +447,17 @@ unsigned long do_mremap(unsigned long addr,
- if (!new_len)
- goto out;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+ pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+ pax_task_size -= PAGE_SIZE;
-+
-+ if (new_len > pax_task_size || addr > pax_task_size-new_len ||
-+ old_len > pax_task_size || addr > pax_task_size-old_len)
-+ goto out;
-+
- if (flags & MREMAP_FIXED) {
- if (flags & MREMAP_MAYMOVE)
- ret = mremap_to(addr, old_len, new_addr, new_len);
-@@ -476,6 +504,7 @@ unsigned long do_mremap(unsigned long addr,
- addr + new_len);
- }
- ret = addr;
-+ track_exec_limit(vma->vm_mm, vma->vm_start, addr + new_len, vma->vm_flags);
- goto out;
- }
- }
-@@ -502,7 +531,13 @@ unsigned long do_mremap(unsigned long addr,
- ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
- if (ret)
- goto out;
-+
-+ map_flags = vma->vm_flags;
- ret = move_vma(vma, addr, old_len, new_len, new_addr);
-+ if (!(ret & ~PAGE_MASK)) {
-+ track_exec_limit(current->mm, addr, addr + old_len, 0UL);
-+ track_exec_limit(current->mm, new_addr, new_addr + new_len, map_flags);
-+ }
- }
- out:
- if (ret & ~PAGE_MASK)
-diff --git a/mm/nommu.c b/mm/nommu.c
-index 406e8d4..53970d3 100644
---- a/mm/nommu.c
-+++ b/mm/nommu.c
-@@ -67,7 +67,6 @@ int sysctl_overcommit_memory = OVERCOMMIT_GUESS; /* heuristic overcommit */
- int sysctl_overcommit_ratio = 50; /* default is 50% */
- int sysctl_max_map_count = DEFAULT_MAX_MAP_COUNT;
- int sysctl_nr_trim_pages = CONFIG_NOMMU_INITIAL_TRIM_EXCESS;
--int heap_stack_gap = 0;
-
- atomic_long_t mmap_pages_allocated;
-
-@@ -761,15 +760,6 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
- EXPORT_SYMBOL(find_vma);
-
- /*
-- * find a VMA
-- * - we don't extend stack VMAs under NOMMU conditions
-- */
--struct vm_area_struct *find_extend_vma(struct mm_struct *mm, unsigned long addr)
--{
-- return find_vma(mm, addr);
--}
--
--/*
- * expand a stack to a given address
- * - not supported under NOMMU conditions
- */
-diff --git a/mm/page_alloc.c b/mm/page_alloc.c
-index 3ecab7e..594a471 100644
---- a/mm/page_alloc.c
-+++ b/mm/page_alloc.c
-@@ -289,7 +289,7 @@ out:
- * This usage means that zero-order pages may not be compound.
- */
-
--static void free_compound_page(struct page *page)
-+void free_compound_page(struct page *page)
- {
- __free_pages_ok(page, compound_order(page));
- }
-@@ -587,6 +587,10 @@ static void __free_pages_ok(struct page *page, unsigned int order)
- int bad = 0;
- int wasMlocked = __TestClearPageMlocked(page);
-
-+#ifdef CONFIG_PAX_MEMORY_SANITIZE
-+ unsigned long index = 1UL << order;
-+#endif
-+
- kmemcheck_free_shadow(page, order);
-
- for (i = 0 ; i < (1 << order) ; ++i)
-@@ -599,6 +603,12 @@ static void __free_pages_ok(struct page *page, unsigned int order)
- debug_check_no_obj_freed(page_address(page),
- PAGE_SIZE << order);
- }
-+
-+#ifdef CONFIG_PAX_MEMORY_SANITIZE
-+ for (; index; --index)
-+ sanitize_highpage(page + index - 1);
-+#endif
-+
- arch_free_page(page, order);
- kernel_map_pages(page, 1 << order, 0);
-
-@@ -702,8 +712,10 @@ static int prep_new_page(struct page *page, int order, gfp_t gfp_flags)
- arch_alloc_page(page, order);
- kernel_map_pages(page, 1 << order, 1);
-
-+#ifndef CONFIG_PAX_MEMORY_SANITIZE
- if (gfp_flags & __GFP_ZERO)
- prep_zero_page(page, order, gfp_flags);
-+#endif
-
- if (order && (gfp_flags & __GFP_COMP))
- prep_compound_page(page, order);
-@@ -1097,6 +1109,11 @@ static void free_hot_cold_page(struct page *page, int cold)
- debug_check_no_locks_freed(page_address(page), PAGE_SIZE);
- debug_check_no_obj_freed(page_address(page), PAGE_SIZE);
- }
-+
-+#ifdef CONFIG_PAX_MEMORY_SANITIZE
-+ sanitize_highpage(page);
-+#endif
-+
- arch_free_page(page, 0);
- kernel_map_pages(page, 1, 0);
-
-@@ -2179,6 +2196,8 @@ void show_free_areas(void)
- int cpu;
- struct zone *zone;
-
-+ pax_track_stack();
-+
- for_each_populated_zone(zone) {
- show_node(zone);
- printk("%s per-cpu:\n", zone->name);
-@@ -3736,7 +3755,7 @@ static void __init setup_usemap(struct pglist_data *pgdat,
- zone->pageblock_flags = alloc_bootmem_node(pgdat, usemapsize);
- }
- #else
--static void inline setup_usemap(struct pglist_data *pgdat,
-+static inline void setup_usemap(struct pglist_data *pgdat,
- struct zone *zone, unsigned long zonesize) {}
- #endif /* CONFIG_SPARSEMEM */
-
-diff --git a/mm/percpu.c b/mm/percpu.c
-index c90614a..5f7b7b8 100644
---- a/mm/percpu.c
-+++ b/mm/percpu.c
-@@ -115,7 +115,7 @@ static unsigned int pcpu_low_unit_cpu __read_mostly;
- static unsigned int pcpu_high_unit_cpu __read_mostly;
-
- /* the address of the first chunk which starts with the kernel static area */
--void *pcpu_base_addr __read_mostly;
-+void *pcpu_base_addr __read_only;
- EXPORT_SYMBOL_GPL(pcpu_base_addr);
-
- static const int *pcpu_unit_map __read_mostly; /* cpu -> unit */
-diff --git a/mm/rmap.c b/mm/rmap.c
-index dd43373..d848cd7 100644
---- a/mm/rmap.c
-+++ b/mm/rmap.c
-@@ -121,6 +121,17 @@ int anon_vma_prepare(struct vm_area_struct *vma)
- /* page_table_lock to protect against threads */
- spin_lock(&mm->page_table_lock);
- if (likely(!vma->anon_vma)) {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m = pax_find_mirror_vma(vma);
-+
-+ if (vma_m) {
-+ BUG_ON(vma_m->anon_vma);
-+ vma_m->anon_vma = anon_vma;
-+ list_add_tail(&vma_m->anon_vma_node, &anon_vma->head);
-+ }
-+#endif
-+
- vma->anon_vma = anon_vma;
- list_add_tail(&vma->anon_vma_node, &anon_vma->head);
- allocated = NULL;
-diff --git a/mm/shmem.c b/mm/shmem.c
-index 3e0005b..1d659a8 100644
---- a/mm/shmem.c
-+++ b/mm/shmem.c
-@@ -31,7 +31,7 @@
- #include <linux/swap.h>
- #include <linux/ima.h>
-
--static struct vfsmount *shm_mnt;
-+struct vfsmount *shm_mnt;
-
- #ifdef CONFIG_SHMEM
- /*
-@@ -1061,6 +1061,8 @@ static int shmem_writepage(struct page *page, struct writeback_control *wbc)
- goto unlock;
- }
- entry = shmem_swp_entry(info, index, NULL);
-+ if (!entry)
-+ goto unlock;
- if (entry->val) {
- /*
- * The more uptodate page coming down from a stacked
-@@ -1144,6 +1146,8 @@ static struct page *shmem_swapin(swp_entry_t entry, gfp_t gfp,
- struct vm_area_struct pvma;
- struct page *page;
-
-+ pax_track_stack();
-+
- spol = mpol_cond_copy(&mpol,
- mpol_shared_policy_lookup(&info->policy, idx));
-
-@@ -1962,7 +1966,7 @@ static int shmem_symlink(struct inode *dir, struct dentry *dentry, const char *s
-
- info = SHMEM_I(inode);
- inode->i_size = len-1;
-- if (len <= (char *)inode - (char *)info) {
-+ if (len <= (char *)inode - (char *)info && len <= 64) {
- /* do it inline */
- memcpy(info, symname, len);
- inode->i_op = &shmem_symlink_inline_operations;
-@@ -2310,8 +2314,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent)
- int err = -ENOMEM;
-
- /* Round up to L1_CACHE_BYTES to resist false sharing */
-- sbinfo = kzalloc(max((int)sizeof(struct shmem_sb_info),
-- L1_CACHE_BYTES), GFP_KERNEL);
-+ sbinfo = kzalloc(max(sizeof(struct shmem_sb_info), L1_CACHE_BYTES), GFP_KERNEL);
- if (!sbinfo)
- return -ENOMEM;
-
-diff --git a/mm/slab.c b/mm/slab.c
-index c8d466a..a2cb875 100644
---- a/mm/slab.c
-+++ b/mm/slab.c
-@@ -174,7 +174,7 @@
-
- /* Legal flag mask for kmem_cache_create(). */
- #if DEBUG
--# define CREATE_MASK (SLAB_RED_ZONE | \
-+# define CREATE_MASK (SLAB_USERCOPY | SLAB_RED_ZONE | \
- SLAB_POISON | SLAB_HWCACHE_ALIGN | \
- SLAB_CACHE_DMA | \
- SLAB_STORE_USER | \
-@@ -182,7 +182,7 @@
- SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
- SLAB_DEBUG_OBJECTS | SLAB_NOLEAKTRACE | SLAB_NOTRACK)
- #else
--# define CREATE_MASK (SLAB_HWCACHE_ALIGN | \
-+# define CREATE_MASK (SLAB_USERCOPY | SLAB_HWCACHE_ALIGN | \
- SLAB_CACHE_DMA | \
- SLAB_RECLAIM_ACCOUNT | SLAB_PANIC | \
- SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
-@@ -308,7 +308,7 @@ struct kmem_list3 {
- * Need this for bootstrapping a per node allocator.
- */
- #define NUM_INIT_LISTS (3 * MAX_NUMNODES)
--struct kmem_list3 __initdata initkmem_list3[NUM_INIT_LISTS];
-+struct kmem_list3 initkmem_list3[NUM_INIT_LISTS];
- #define CACHE_CACHE 0
- #define SIZE_AC MAX_NUMNODES
- #define SIZE_L3 (2 * MAX_NUMNODES)
-@@ -409,10 +409,10 @@ static void kmem_list3_init(struct kmem_list3 *parent)
- if ((x)->max_freeable < i) \
- (x)->max_freeable = i; \
- } while (0)
--#define STATS_INC_ALLOCHIT(x) atomic_inc(&(x)->allochit)
--#define STATS_INC_ALLOCMISS(x) atomic_inc(&(x)->allocmiss)
--#define STATS_INC_FREEHIT(x) atomic_inc(&(x)->freehit)
--#define STATS_INC_FREEMISS(x) atomic_inc(&(x)->freemiss)
-+#define STATS_INC_ALLOCHIT(x) atomic_inc_unchecked(&(x)->allochit)
-+#define STATS_INC_ALLOCMISS(x) atomic_inc_unchecked(&(x)->allocmiss)
-+#define STATS_INC_FREEHIT(x) atomic_inc_unchecked(&(x)->freehit)
-+#define STATS_INC_FREEMISS(x) atomic_inc_unchecked(&(x)->freemiss)
- #else
- #define STATS_INC_ACTIVE(x) do { } while (0)
- #define STATS_DEC_ACTIVE(x) do { } while (0)
-@@ -558,7 +558,7 @@ static inline void *index_to_obj(struct kmem_cache *cache, struct slab *slab,
- * reciprocal_divide(offset, cache->reciprocal_buffer_size)
- */
- static inline unsigned int obj_to_index(const struct kmem_cache *cache,
-- const struct slab *slab, void *obj)
-+ const struct slab *slab, const void *obj)
- {
- u32 offset = (obj - slab->s_mem);
- return reciprocal_divide(offset, cache->reciprocal_buffer_size);
-@@ -579,10 +579,11 @@ EXPORT_SYMBOL(malloc_sizes);
- struct cache_names {
- char *name;
- char *name_dma;
-+ char *name_usercopy;
- };
-
- static struct cache_names __initdata cache_names[] = {
--#define CACHE(x) { .name = "size-" #x, .name_dma = "size-" #x "(DMA)" },
-+#define CACHE(x) { .name = "size-" #x, .name_dma = "size-" #x "(DMA)", .name_usercopy = "size-" #x "(USERCOPY)" },
- #include <linux/kmalloc_sizes.h>
- {NULL,}
- #undef CACHE
-@@ -719,6 +720,12 @@ static inline struct kmem_cache *__find_general_cachep(size_t size,
- if (unlikely(gfpflags & GFP_DMA))
- return csizep->cs_dmacachep;
- #endif
-+
-+#ifdef CONFIG_PAX_USERCOPY_SLABS
-+ if (unlikely(gfpflags & GFP_USERCOPY))
-+ return csizep->cs_usercopycachep;
-+#endif
-+
- return csizep->cs_cachep;
- }
-
-@@ -1453,7 +1460,7 @@ void __init kmem_cache_init(void)
- sizes[INDEX_AC].cs_cachep = kmem_cache_create(names[INDEX_AC].name,
- sizes[INDEX_AC].cs_size,
- ARCH_KMALLOC_MINALIGN,
-- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
-+ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
- NULL);
-
- if (INDEX_AC != INDEX_L3) {
-@@ -1461,7 +1468,7 @@ void __init kmem_cache_init(void)
- kmem_cache_create(names[INDEX_L3].name,
- sizes[INDEX_L3].cs_size,
- ARCH_KMALLOC_MINALIGN,
-- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
-+ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
- NULL);
- }
-
-@@ -1479,7 +1486,7 @@ void __init kmem_cache_init(void)
- sizes->cs_cachep = kmem_cache_create(names->name,
- sizes->cs_size,
- ARCH_KMALLOC_MINALIGN,
-- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
-+ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
- NULL);
- }
- #ifdef CONFIG_ZONE_DMA
-@@ -1491,6 +1498,16 @@ void __init kmem_cache_init(void)
- SLAB_PANIC,
- NULL);
- #endif
-+
-+#ifdef CONFIG_PAX_USERCOPY_SLABS
-+ sizes->cs_usercopycachep = kmem_cache_create(
-+ names->name_usercopy,
-+ sizes->cs_size,
-+ ARCH_KMALLOC_MINALIGN,
-+ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
-+ NULL);
-+#endif
-+
- sizes++;
- names++;
- }
-@@ -4211,10 +4228,10 @@ static int s_show(struct seq_file *m, void *p)
- }
- /* cpu stats */
- {
-- unsigned long allochit = atomic_read(&cachep->allochit);
-- unsigned long allocmiss = atomic_read(&cachep->allocmiss);
-- unsigned long freehit = atomic_read(&cachep->freehit);
-- unsigned long freemiss = atomic_read(&cachep->freemiss);
-+ unsigned long allochit = atomic_read_unchecked(&cachep->allochit);
-+ unsigned long allocmiss = atomic_read_unchecked(&cachep->allocmiss);
-+ unsigned long freehit = atomic_read_unchecked(&cachep->freehit);
-+ unsigned long freemiss = atomic_read_unchecked(&cachep->freemiss);
-
- seq_printf(m, " : cpustat %6lu %6lu %6lu %6lu",
- allochit, allocmiss, freehit, freemiss);
-@@ -4471,15 +4488,79 @@ static const struct file_operations proc_slabstats_operations = {
-
- static int __init slab_proc_init(void)
- {
-- proc_create("slabinfo",S_IWUSR|S_IRUGO,NULL,&proc_slabinfo_operations);
-+ mode_t gr_mode = S_IRUGO;
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+ gr_mode = S_IRUSR;
-+#endif
-+
-+ proc_create("slabinfo",S_IWUSR|gr_mode,NULL,&proc_slabinfo_operations);
- #ifdef CONFIG_DEBUG_SLAB_LEAK
-- proc_create("slab_allocators", 0, NULL, &proc_slabstats_operations);
-+ proc_create("slab_allocators", gr_mode, NULL, &proc_slabstats_operations);
- #endif
- return 0;
- }
- module_init(slab_proc_init);
- #endif
-
-+bool is_usercopy_object(const void *ptr)
-+{
-+ struct page *page;
-+ struct kmem_cache *cachep;
-+
-+ if (ZERO_OR_NULL_PTR(ptr))
-+ return false;
-+
-+ if (!slab_is_available())
-+ return false;
-+
-+ if (!virt_addr_valid(ptr))
-+ return false;
-+
-+ page = virt_to_head_page(ptr);
-+
-+ if (!PageSlab(page))
-+ return false;
-+
-+ cachep = page_get_cache(page);
-+ return cachep->flags & SLAB_USERCOPY;
-+}
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+const char *check_heap_object(const void *ptr, unsigned long n)
-+{
-+ struct page *page;
-+ struct kmem_cache *cachep;
-+ struct slab *slabp;
-+ unsigned int objnr;
-+ unsigned long offset;
-+
-+ if (ZERO_OR_NULL_PTR(ptr))
-+ return "<null>";
-+
-+ if (!virt_addr_valid(ptr))
-+ return NULL;
-+
-+ page = virt_to_head_page(ptr);
-+
-+ if (!PageSlab(page))
-+ return NULL;
-+
-+ cachep = page_get_cache(page);
-+ if (!(cachep->flags & SLAB_USERCOPY))
-+ return cachep->name;
-+
-+ slabp = page_get_slab(page);
-+ objnr = obj_to_index(cachep, slabp, ptr);
-+ BUG_ON(objnr >= cachep->num);
-+ offset = ptr - index_to_obj(cachep, slabp, objnr) - obj_offset(cachep);
-+ if (offset <= obj_size(cachep) && n <= obj_size(cachep) - offset)
-+ return NULL;
-+
-+ return cachep->name;
-+}
-+#endif
-+
- /**
- * ksize - get the actual amount of memory allocated for a given object
- * @objp: Pointer to the object
-diff --git a/mm/slob.c b/mm/slob.c
-index 837ebd6..1ef41ba 100644
---- a/mm/slob.c
-+++ b/mm/slob.c
-@@ -29,7 +29,7 @@
- * If kmalloc is asked for objects of PAGE_SIZE or larger, it calls
- * alloc_pages() directly, allocating compound pages so the page order
- * does not have to be separately tracked, and also stores the exact
-- * allocation size in page->private so that it can be used to accurately
-+ * allocation size in slob_page->size so that it can be used to accurately
- * provide ksize(). These objects are detected in kfree() because slob_page()
- * is false for them.
- *
-@@ -58,6 +58,7 @@
- */
-
- #include <linux/kernel.h>
-+#include <linux/sched.h>
- #include <linux/slab.h>
- #include <linux/mm.h>
- #include <linux/swap.h> /* struct reclaim_state */
-@@ -100,7 +101,8 @@ struct slob_page {
- unsigned long flags; /* mandatory */
- atomic_t _count; /* mandatory */
- slobidx_t units; /* free units left in page */
-- unsigned long pad[2];
-+ unsigned long pad[1];
-+ unsigned long size; /* size when >=PAGE_SIZE */
- slob_t *free; /* first free slob_t in page */
- struct list_head list; /* linked list of free pages */
- };
-@@ -133,7 +135,7 @@ static LIST_HEAD(free_slob_large);
- */
- static inline int is_slob_page(struct slob_page *sp)
- {
-- return PageSlab((struct page *)sp);
-+ return PageSlab((struct page *)sp) && !sp->size;
- }
-
- static inline void set_slob_page(struct slob_page *sp)
-@@ -148,7 +150,7 @@ static inline void clear_slob_page(struct slob_page *sp)
-
- static inline struct slob_page *slob_page(const void *addr)
- {
-- return (struct slob_page *)virt_to_page(addr);
-+ return (struct slob_page *)virt_to_head_page(addr);
- }
-
- /*
-@@ -208,7 +210,7 @@ static void set_slob(slob_t *s, slobidx_t size, slob_t *next)
- /*
- * Return the size of a slob block.
- */
--static slobidx_t slob_units(slob_t *s)
-+static slobidx_t slob_units(const slob_t *s)
- {
- if (s->units > 0)
- return s->units;
-@@ -218,7 +220,7 @@ static slobidx_t slob_units(slob_t *s)
- /*
- * Return the next free slob block pointer after this one.
- */
--static slob_t *slob_next(slob_t *s)
-+static slob_t *slob_next(const slob_t *s)
- {
- slob_t *base = (slob_t *)((unsigned long)s & PAGE_MASK);
- slobidx_t next;
-@@ -233,7 +235,7 @@ static slob_t *slob_next(slob_t *s)
- /*
- * Returns true if s is the last free block in its page.
- */
--static int slob_last(slob_t *s)
-+static int slob_last(const slob_t *s)
- {
- return !((unsigned long)slob_next(s) & ~PAGE_MASK);
- }
-@@ -252,6 +254,7 @@ static void *slob_new_pages(gfp_t gfp, int order, int node)
- if (!page)
- return NULL;
-
-+ set_slob_page(page);
- return page_address(page);
- }
-
-@@ -368,11 +371,11 @@ static void *slob_alloc(size_t size, gfp_t gfp, int align, int node)
- if (!b)
- return NULL;
- sp = slob_page(b);
-- set_slob_page(sp);
-
- spin_lock_irqsave(&slob_lock, flags);
- sp->units = SLOB_UNITS(PAGE_SIZE);
- sp->free = b;
-+ sp->size = 0;
- INIT_LIST_HEAD(&sp->list);
- set_slob(b, SLOB_UNITS(PAGE_SIZE), b + SLOB_UNITS(PAGE_SIZE));
- set_slob_page_free(sp, slob_list);
-@@ -475,10 +478,9 @@ out:
- #define ARCH_SLAB_MINALIGN __alignof__(unsigned long)
- #endif
-
--void *__kmalloc_node(size_t size, gfp_t gfp, int node)
-+static void *__kmalloc_node_align(size_t size, gfp_t gfp, int node, int align)
- {
-- unsigned int *m;
-- int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
-+ slob_t *m;
- void *ret;
-
- lockdep_trace_alloc(gfp);
-@@ -491,7 +493,10 @@ void *__kmalloc_node(size_t size, gfp_t gfp, int node)
-
- if (!m)
- return NULL;
-- *m = size;
-+ BUILD_BUG_ON(ARCH_KMALLOC_MINALIGN < 2 * SLOB_UNIT);
-+ BUILD_BUG_ON(ARCH_SLAB_MINALIGN < 2 * SLOB_UNIT);
-+ m[0].units = size;
-+ m[1].units = align;
- ret = (void *)m + align;
-
- trace_kmalloc_node(_RET_IP_, ret,
-@@ -501,16 +506,25 @@ void *__kmalloc_node(size_t size, gfp_t gfp, int node)
-
- ret = slob_new_pages(gfp | __GFP_COMP, get_order(size), node);
- if (ret) {
-- struct page *page;
-- page = virt_to_page(ret);
-- page->private = size;
-+ struct slob_page *sp;
-+ sp = slob_page(ret);
-+ sp->size = size;
- }
-
- trace_kmalloc_node(_RET_IP_, ret,
- size, PAGE_SIZE << order, gfp, node);
- }
-
-- kmemleak_alloc(ret, size, 1, gfp);
-+ return ret;
-+}
-+
-+void *__kmalloc_node(size_t size, gfp_t gfp, int node)
-+{
-+ int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
-+ void *ret = __kmalloc_node_align(size, gfp, node, align);
-+
-+ if (!ZERO_OR_NULL_PTR(ret))
-+ kmemleak_alloc(ret, size, 1, gfp);
- return ret;
- }
- EXPORT_SYMBOL(__kmalloc_node);
-@@ -528,13 +542,88 @@ void kfree(const void *block)
- sp = slob_page(block);
- if (is_slob_page(sp)) {
- int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
-- unsigned int *m = (unsigned int *)(block - align);
-- slob_free(m, *m + align);
-- } else
-+ slob_t *m = (slob_t *)(block - align);
-+ slob_free(m, m[0].units + align);
-+ } else {
-+ clear_slob_page(sp);
-+ free_slob_page(sp);
-+ sp->size = 0;
- put_page(&sp->page);
-+ }
- }
- EXPORT_SYMBOL(kfree);
-
-+bool is_usercopy_object(const void *ptr)
-+{
-+ if (!slab_is_available())
-+ return false;
-+
-+ // PAX: TODO
-+
-+ return false;
-+}
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+const char *check_heap_object(const void *ptr, unsigned long n)
-+{
-+ struct slob_page *sp;
-+ const slob_t *free;
-+ const void *base;
-+ unsigned long flags;
-+
-+ if (ZERO_OR_NULL_PTR(ptr))
-+ return "<null>";
-+
-+ if (!virt_addr_valid(ptr))
-+ return NULL;
-+
-+ sp = slob_page(ptr);
-+ if (!PageSlab((struct page *)sp))
-+ return NULL;
-+
-+ if (sp->size) {
-+ base = page_address(&sp->page);
-+ if (base <= ptr && n <= sp->size - (ptr - base))
-+ return NULL;
-+ return "<slob>";
-+ }
-+
-+ /* some tricky double walking to find the chunk */
-+ spin_lock_irqsave(&slob_lock, flags);
-+ base = (void *)((unsigned long)ptr & PAGE_MASK);
-+ free = sp->free;
-+
-+ while ((void *)free <= ptr) {
-+ base = free + slob_units(free);
-+ free = slob_next(free);
-+ }
-+
-+ while (base < (void *)free) {
-+ slobidx_t m = ((slob_t *)base)[0].units, align = ((slob_t *)base)[1].units;
-+ int size = SLOB_UNIT * SLOB_UNITS(m + align);
-+ int offset;
-+
-+ if (ptr < base + align)
-+ break;
-+
-+ offset = ptr - base - align;
-+ if (offset >= m) {
-+ base += size;
-+ continue;
-+ }
-+
-+ if (n > m - offset)
-+ break;
-+
-+ spin_unlock_irqrestore(&slob_lock, flags);
-+ return NULL;
-+ }
-+
-+ spin_unlock_irqrestore(&slob_lock, flags);
-+ return "<slob>";
-+}
-+#endif
-+
- /* can't use ksize for kmem_cache_alloc memory, only kmalloc */
- size_t ksize(const void *block)
- {
-@@ -547,10 +636,10 @@ size_t ksize(const void *block)
- sp = slob_page(block);
- if (is_slob_page(sp)) {
- int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
-- unsigned int *m = (unsigned int *)(block - align);
-- return SLOB_UNITS(*m) * SLOB_UNIT;
-+ slob_t *m = (slob_t *)(block - align);
-+ return SLOB_UNITS(m[0].units) * SLOB_UNIT;
- } else
-- return sp->page.private;
-+ return sp->size;
- }
- EXPORT_SYMBOL(ksize);
-
-@@ -566,8 +655,13 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
- {
- struct kmem_cache *c;
-
-+#ifdef CONFIG_PAX_USERCOPY_SLABS
-+ c = __kmalloc_node_align(sizeof(struct kmem_cache),
-+ GFP_KERNEL, -1, ARCH_KMALLOC_MINALIGN);
-+#else
- c = slob_alloc(sizeof(struct kmem_cache),
- GFP_KERNEL, ARCH_KMALLOC_MINALIGN, -1);
-+#endif
-
- if (c) {
- c->name = name;
-@@ -605,17 +699,25 @@ void *kmem_cache_alloc_node(struct kmem_cache *c, gfp_t flags, int node)
- {
- void *b;
-
-+#ifdef CONFIG_PAX_USERCOPY_SLABS
-+ b = __kmalloc_node_align(c->size, flags, node, c->align);
-+#else
- if (c->size < PAGE_SIZE) {
- b = slob_alloc(c->size, flags, c->align, node);
- trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
- SLOB_UNITS(c->size) * SLOB_UNIT,
- flags, node);
- } else {
-+ struct slob_page *sp;
-+
- b = slob_new_pages(flags, get_order(c->size), node);
-+ sp = slob_page(b);
-+ sp->size = c->size;
- trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
- PAGE_SIZE << get_order(c->size),
- flags, node);
- }
-+#endif
-
- if (c->ctor)
- c->ctor(b);
-@@ -627,10 +729,16 @@ EXPORT_SYMBOL(kmem_cache_alloc_node);
-
- static void __kmem_cache_free(void *b, int size)
- {
-- if (size < PAGE_SIZE)
-+ struct slob_page *sp = slob_page(b);
-+
-+ if (is_slob_page(sp))
- slob_free(b, size);
-- else
-+ else {
-+ clear_slob_page(sp);
-+ free_slob_page(sp);
-+ sp->size = 0;
- slob_free_pages(b, get_order(size));
-+ }
- }
-
- static void kmem_rcu_free(struct rcu_head *head)
-@@ -643,18 +751,32 @@ static void kmem_rcu_free(struct rcu_head *head)
-
- void kmem_cache_free(struct kmem_cache *c, void *b)
- {
-+ int size = c->size;
-+
-+#ifdef CONFIG_PAX_USERCOPY_SLABS
-+ if (size + c->align < PAGE_SIZE) {
-+ size += c->align;
-+ b -= c->align;
-+ }
-+#endif
-+
- kmemleak_free_recursive(b, c->flags);
- if (unlikely(c->flags & SLAB_DESTROY_BY_RCU)) {
- struct slob_rcu *slob_rcu;
-- slob_rcu = b + (c->size - sizeof(struct slob_rcu));
-+ slob_rcu = b + (size - sizeof(struct slob_rcu));
- INIT_RCU_HEAD(&slob_rcu->head);
-- slob_rcu->size = c->size;
-+ slob_rcu->size = size;
- call_rcu(&slob_rcu->head, kmem_rcu_free);
- } else {
-- __kmem_cache_free(b, c->size);
-+ __kmem_cache_free(b, size);
- }
-
-+#ifdef CONFIG_PAX_USERCOPY_SLABS
-+ trace_kfree(_RET_IP_, b);
-+#else
- trace_kmem_cache_free(_RET_IP_, b);
-+#endif
-+
- }
- EXPORT_SYMBOL(kmem_cache_free);
-
-diff --git a/mm/slub.c b/mm/slub.c
-index 4996fc7..2ecab0a 100644
---- a/mm/slub.c
-+++ b/mm/slub.c
-@@ -201,7 +201,7 @@ struct track {
-
- enum track_item { TRACK_ALLOC, TRACK_FREE };
-
--#ifdef CONFIG_SLUB_DEBUG
-+#if defined(CONFIG_SLUB_DEBUG) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
- static int sysfs_slab_add(struct kmem_cache *);
- static int sysfs_slab_alias(struct kmem_cache *, const char *);
- static void sysfs_slab_remove(struct kmem_cache *);
-@@ -410,7 +410,7 @@ static void print_track(const char *s, struct track *t)
- if (!t->addr)
- return;
-
-- printk(KERN_ERR "INFO: %s in %pS age=%lu cpu=%u pid=%d\n",
-+ printk(KERN_ERR "INFO: %s in %pA age=%lu cpu=%u pid=%d\n",
- s, (void *)t->addr, jiffies - t->when, t->cpu, t->pid);
- }
-
-@@ -1893,6 +1893,8 @@ void kmem_cache_free(struct kmem_cache *s, void *x)
-
- page = virt_to_head_page(x);
-
-+ BUG_ON(!PageSlab(page));
-+
- slab_free(s, page, x, _RET_IP_);
-
- trace_kmem_cache_free(_RET_IP_, x);
-@@ -1937,7 +1939,7 @@ static int slub_min_objects;
- * Merge control. If this is set then no merging of slab caches will occur.
- * (Could be removed. This was introduced to pacify the merge skeptics.)
- */
--static int slub_nomerge;
-+static int slub_nomerge = 1;
-
- /*
- * Calculate the order of allocation given an slab object size.
-@@ -2493,7 +2495,7 @@ static int kmem_cache_open(struct kmem_cache *s, gfp_t gfpflags,
- * list to avoid pounding the page allocator excessively.
- */
- set_min_partial(s, ilog2(s->size));
-- s->refcount = 1;
-+ atomic_set(&s->refcount, 1);
- #ifdef CONFIG_NUMA
- s->remote_node_defrag_ratio = 1000;
- #endif
-@@ -2630,8 +2632,7 @@ static inline int kmem_cache_close(struct kmem_cache *s)
- void kmem_cache_destroy(struct kmem_cache *s)
- {
- down_write(&slub_lock);
-- s->refcount--;
-- if (!s->refcount) {
-+ if (atomic_dec_and_test(&s->refcount)) {
- list_del(&s->list);
- up_write(&slub_lock);
- if (kmem_cache_close(s)) {
-@@ -2691,12 +2692,10 @@ static int __init setup_slub_nomerge(char *str)
- __setup("slub_nomerge", setup_slub_nomerge);
-
- static struct kmem_cache *create_kmalloc_cache(struct kmem_cache *s,
-- const char *name, int size, gfp_t gfp_flags)
-+ const char *name, int size, gfp_t gfp_flags, unsigned int flags)
- {
-- unsigned int flags = 0;
--
- if (gfp_flags & SLUB_DMA)
-- flags = SLAB_CACHE_DMA;
-+ flags |= SLAB_CACHE_DMA;
-
- /*
- * This function is called with IRQs disabled during early-boot on
-@@ -2792,6 +2791,10 @@ out:
- }
- #endif
-
-+#ifdef CONFIG_PAX_USERCOPY_SLABS
-+static struct kmem_cache kmalloc_caches_usercopy[SLUB_PAGE_SHIFT];
-+#endif
-+
- /*
- * Conversion table for small slabs sizes / 8 to the index in the
- * kmalloc array. This is necessary for slabs < 192 since we have non power
-@@ -2847,6 +2850,13 @@ static struct kmem_cache *get_slab(size_t size, gfp_t flags)
- return dma_kmalloc_cache(index, flags);
-
- #endif
-+
-+#ifdef CONFIG_PAX_USERCOPY_SLABS
-+ if (flags & SLAB_USERCOPY)
-+ return &kmalloc_caches_usercopy[index];
-+
-+#endif
-+
- return &kmalloc_caches[index];
- }
-
-@@ -2915,6 +2925,59 @@ void *__kmalloc_node(size_t size, gfp_t flags, int node)
- EXPORT_SYMBOL(__kmalloc_node);
- #endif
-
-+bool is_usercopy_object(const void *ptr)
-+{
-+ struct page *page;
-+ struct kmem_cache *s;
-+
-+ if (ZERO_OR_NULL_PTR(ptr))
-+ return false;
-+
-+ if (!slab_is_available())
-+ return false;
-+
-+ if (!virt_addr_valid(ptr))
-+ return false;
-+
-+ page = virt_to_head_page(ptr);
-+
-+ if (!PageSlab(page))
-+ return false;
-+
-+ s = page->slab;
-+ return s->flags & SLAB_USERCOPY;
-+}
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+const char *check_heap_object(const void *ptr, unsigned long n)
-+{
-+ struct page *page;
-+ struct kmem_cache *s;
-+ unsigned long offset;
-+
-+ if (ZERO_OR_NULL_PTR(ptr))
-+ return "<null>";
-+
-+ if (!virt_addr_valid(ptr))
-+ return NULL;
-+
-+ page = get_object_page(ptr);
-+
-+ if (!page)
-+ return NULL;
-+
-+ s = page->slab;
-+ if (!(s->flags & SLAB_USERCOPY))
-+ return s->name;
-+
-+ offset = (ptr - page_address(page)) % s->size;
-+ if (offset <= s->objsize && n <= s->objsize - offset)
-+ return NULL;
-+
-+ return s->name;
-+}
-+#endif
-+
- size_t ksize(const void *object)
- {
- struct page *page;
-@@ -3185,8 +3248,8 @@ void __init kmem_cache_init(void)
- * kmem_cache_open for slab_state == DOWN.
- */
- create_kmalloc_cache(&kmalloc_caches[0], "kmem_cache_node",
-- sizeof(struct kmem_cache_node), GFP_NOWAIT);
-- kmalloc_caches[0].refcount = -1;
-+ sizeof(struct kmem_cache_node), GFP_NOWAIT, 0);
-+ atomic_set(&kmalloc_caches[0].refcount, -1);
- caches++;
-
- hotplug_memory_notifier(slab_memory_callback, SLAB_CALLBACK_PRI);
-@@ -3198,18 +3261,18 @@ void __init kmem_cache_init(void)
- /* Caches that are not of the two-to-the-power-of size */
- if (KMALLOC_MIN_SIZE <= 32) {
- create_kmalloc_cache(&kmalloc_caches[1],
-- "kmalloc-96", 96, GFP_NOWAIT);
-+ "kmalloc-96", 96, GFP_NOWAIT, SLAB_USERCOPY);
- caches++;
- }
- if (KMALLOC_MIN_SIZE <= 64) {
- create_kmalloc_cache(&kmalloc_caches[2],
-- "kmalloc-192", 192, GFP_NOWAIT);
-+ "kmalloc-192", 192, GFP_NOWAIT, SLAB_USERCOPY);
- caches++;
- }
-
- for (i = KMALLOC_SHIFT_LOW; i < SLUB_PAGE_SHIFT; i++) {
- create_kmalloc_cache(&kmalloc_caches[i],
-- "kmalloc", 1 << i, GFP_NOWAIT);
-+ "kmalloc", 1 << i, GFP_NOWAIT, SLAB_USERCOPY);
- caches++;
- }
-
-@@ -3267,6 +3330,20 @@ void __init kmem_cache_init(void)
- kmem_size = sizeof(struct kmem_cache);
- #endif
-
-+#ifdef CONFIG_PAX_USERCOPY_SLABS
-+ for (i = 0; i < SLUB_PAGE_SHIFT; i++) {
-+ struct kmem_cache *s = &kmalloc_caches[i];
-+
-+ if (s->size) {
-+ char *name = kasprintf(GFP_NOWAIT, "kmalloc-usercopy-%d", s->objsize);
-+
-+ BUG_ON(!name);
-+ create_kmalloc_cache(&kmalloc_caches_usercopy[i], name,
-+ s->objsize, GFP_NOWAIT, SLAB_USERCOPY);
-+ }
-+ }
-+#endif
-+
- printk(KERN_INFO
- "SLUB: Genslabs=%d, HWalign=%d, Order=%d-%d, MinObjects=%d,"
- " CPUs=%d, Nodes=%d\n",
-@@ -3293,7 +3370,7 @@ static int slab_unmergeable(struct kmem_cache *s)
- /*
- * We may have set a slab to be unmergeable during bootstrap.
- */
-- if (s->refcount < 0)
-+ if (atomic_read(&s->refcount) < 0)
- return 1;
-
- return 0;
-@@ -3353,7 +3430,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
- if (s) {
- int cpu;
-
-- s->refcount++;
-+ atomic_inc(&s->refcount);
- /*
- * Adjust the object sizes so that we clear
- * the complete object on kzalloc.
-@@ -3372,7 +3449,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
-
- if (sysfs_slab_alias(s, name)) {
- down_write(&slub_lock);
-- s->refcount--;
-+ atomic_dec(&s->refcount);
- up_write(&slub_lock);
- goto err;
- }
-@@ -4101,7 +4178,7 @@ SLAB_ATTR_RO(ctor);
-
- static ssize_t aliases_show(struct kmem_cache *s, char *buf)
- {
-- return sprintf(buf, "%d\n", s->refcount - 1);
-+ return sprintf(buf, "%d\n", atomic_read(&s->refcount) - 1);
- }
- SLAB_ATTR_RO(aliases);
-
-@@ -4503,7 +4580,7 @@ static void kmem_cache_release(struct kobject *kobj)
- kfree(s);
- }
-
--static struct sysfs_ops slab_sysfs_ops = {
-+static const struct sysfs_ops slab_sysfs_ops = {
- .show = slab_attr_show,
- .store = slab_attr_store,
- };
-@@ -4522,7 +4599,7 @@ static int uevent_filter(struct kset *kset, struct kobject *kobj)
- return 0;
- }
-
--static struct kset_uevent_ops slab_uevent_ops = {
-+static const struct kset_uevent_ops slab_uevent_ops = {
- .filter = uevent_filter,
- };
-
-@@ -4564,6 +4641,7 @@ static char *create_unique_id(struct kmem_cache *s)
- return name;
- }
-
-+#if defined(CONFIG_SLUB_DEBUG) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
- static int sysfs_slab_add(struct kmem_cache *s)
- {
- int err;
-@@ -4619,6 +4697,7 @@ static void sysfs_slab_remove(struct kmem_cache *s)
- kobject_del(&s->kobj);
- kobject_put(&s->kobj);
- }
-+#endif
-
- /*
- * Need to buffer aliases during bootup until sysfs becomes
-@@ -4632,6 +4711,7 @@ struct saved_alias {
-
- static struct saved_alias *alias_list;
-
-+#if defined(CONFIG_SLUB_DEBUG) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
- static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
- {
- struct saved_alias *al;
-@@ -4654,6 +4734,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
- alias_list = al;
- return 0;
- }
-+#endif
-
- static int __init slab_sysfs_init(void)
- {
-@@ -4785,7 +4866,13 @@ static const struct file_operations proc_slabinfo_operations = {
-
- static int __init slab_proc_init(void)
- {
-- proc_create("slabinfo", S_IRUGO, NULL, &proc_slabinfo_operations);
-+ mode_t gr_mode = S_IRUGO;
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+ gr_mode = S_IRUSR;
-+#endif
-+
-+ proc_create("slabinfo", gr_mode, NULL, &proc_slabinfo_operations);
- return 0;
- }
- module_init(slab_proc_init);
-diff --git a/mm/sparse-vmemmap.c b/mm/sparse-vmemmap.c
-index d9714bd..ce08e28 100644
---- a/mm/sparse-vmemmap.c
-+++ b/mm/sparse-vmemmap.c
-@@ -108,7 +108,7 @@ pud_t * __meminit vmemmap_pud_populate(pgd_t *pgd, unsigned long addr, int node)
- void *p = vmemmap_alloc_block(PAGE_SIZE, node);
- if (!p)
- return NULL;
-- pud_populate(&init_mm, pud, p);
-+ pud_populate_kernel(&init_mm, pud, p);
- }
- return pud;
- }
-@@ -120,7 +120,7 @@ pgd_t * __meminit vmemmap_pgd_populate(unsigned long addr, int node)
- void *p = vmemmap_alloc_block(PAGE_SIZE, node);
- if (!p)
- return NULL;
-- pgd_populate(&init_mm, pgd, p);
-+ pgd_populate_kernel(&init_mm, pgd, p);
- }
- return pgd;
- }
-diff --git a/mm/swap.c b/mm/swap.c
-index 308e57d..5de19c0 100644
---- a/mm/swap.c
-+++ b/mm/swap.c
-@@ -30,6 +30,7 @@
- #include <linux/notifier.h>
- #include <linux/backing-dev.h>
- #include <linux/memcontrol.h>
-+#include <linux/hugetlb.h>
-
- #include "internal.h"
-
-@@ -65,6 +66,8 @@ static void put_compound_page(struct page *page)
- compound_page_dtor *dtor;
-
- dtor = get_compound_page_dtor(page);
-+ if (!PageHuge(page))
-+ BUG_ON(dtor != free_compound_page);
- (*dtor)(page);
- }
- }
-diff --git a/mm/util.c b/mm/util.c
-index e48b493..24a601d 100644
---- a/mm/util.c
-+++ b/mm/util.c
-@@ -228,6 +228,12 @@ EXPORT_SYMBOL(strndup_user);
- void arch_pick_mmap_layout(struct mm_struct *mm)
- {
- mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- mm->get_unmapped_area = arch_get_unmapped_area;
- mm->unmap_area = arch_unmap_area;
- }
-diff --git a/mm/vmalloc.c b/mm/vmalloc.c
-index f34ffd0..1251316 100644
---- a/mm/vmalloc.c
-+++ b/mm/vmalloc.c
-@@ -40,8 +40,19 @@ static void vunmap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end)
-
- pte = pte_offset_kernel(pmd, addr);
- do {
-- pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
-- WARN_ON(!pte_none(ptent) && !pte_present(ptent));
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr < (unsigned long)MODULES_EXEC_END) {
-+ BUG_ON(!pte_exec(*pte));
-+ set_pte_at(&init_mm, addr, pte, pfn_pte(__pa(addr) >> PAGE_SHIFT, PAGE_KERNEL_EXEC));
-+ continue;
-+ }
-+#endif
-+
-+ {
-+ pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
-+ WARN_ON(!pte_none(ptent) && !pte_present(ptent));
-+ }
- } while (pte++, addr += PAGE_SIZE, addr != end);
- }
-
-@@ -101,16 +112,31 @@ static int vmap_pte_range(pmd_t *pmd, unsigned long addr,
- pte = pte_alloc_kernel(pmd, addr);
- if (!pte)
- return -ENOMEM;
-+
-+ pax_open_kernel();
- do {
- struct page *page = pages[*nr];
-
-- if (WARN_ON(!pte_none(*pte)))
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ if (!(pgprot_val(prot) & _PAGE_NX))
-+ BUG_ON(!pte_exec(*pte) || pte_pfn(*pte) != __pa(addr) >> PAGE_SHIFT);
-+ else
-+#endif
-+
-+ if (!pte_none(*pte)) {
-+ pax_close_kernel();
-+ WARN_ON(1);
- return -EBUSY;
-- if (WARN_ON(!page))
-+ }
-+ if (!page) {
-+ pax_close_kernel();
-+ WARN_ON(1);
- return -ENOMEM;
-+ }
- set_pte_at(&init_mm, addr, pte, mk_pte(page, prot));
- (*nr)++;
- } while (pte++, addr += PAGE_SIZE, addr != end);
-+ pax_close_kernel();
- return 0;
- }
-
-@@ -120,7 +146,7 @@ static int vmap_pmd_range(pud_t *pud, unsigned long addr,
- pmd_t *pmd;
- unsigned long next;
-
-- pmd = pmd_alloc(&init_mm, pud, addr);
-+ pmd = pmd_alloc_kernel(&init_mm, pud, addr);
- if (!pmd)
- return -ENOMEM;
- do {
-@@ -137,7 +163,7 @@ static int vmap_pud_range(pgd_t *pgd, unsigned long addr,
- pud_t *pud;
- unsigned long next;
-
-- pud = pud_alloc(&init_mm, pgd, addr);
-+ pud = pud_alloc_kernel(&init_mm, pgd, addr);
- if (!pud)
- return -ENOMEM;
- do {
-@@ -192,11 +218,20 @@ int is_vmalloc_or_module_addr(const void *x)
- * and fall back on vmalloc() if that fails. Others
- * just put it in the vmalloc space.
- */
--#if defined(CONFIG_MODULES) && defined(MODULES_VADDR)
-+#ifdef CONFIG_MODULES
-+#ifdef MODULES_VADDR
- unsigned long addr = (unsigned long)x;
- if (addr >= MODULES_VADDR && addr < MODULES_END)
- return 1;
- #endif
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ if (x >= (const void *)MODULES_EXEC_VADDR && x < (const void *)MODULES_EXEC_END)
-+ return 1;
-+#endif
-+
-+#endif
-+
- return is_vmalloc_addr(x);
- }
-
-@@ -217,8 +252,14 @@ struct page *vmalloc_to_page(const void *vmalloc_addr)
-
- if (!pgd_none(*pgd)) {
- pud_t *pud = pud_offset(pgd, addr);
-+#ifdef CONFIG_X86
-+ if (!pud_large(*pud))
-+#endif
- if (!pud_none(*pud)) {
- pmd_t *pmd = pmd_offset(pud, addr);
-+#ifdef CONFIG_X86
-+ if (!pmd_large(*pmd))
-+#endif
- if (!pmd_none(*pmd)) {
- pte_t *ptep, pte;
-
-@@ -292,13 +333,13 @@ static void __insert_vmap_area(struct vmap_area *va)
- struct rb_node *tmp;
-
- while (*p) {
-- struct vmap_area *tmp;
-+ struct vmap_area *varea;
-
- parent = *p;
-- tmp = rb_entry(parent, struct vmap_area, rb_node);
-- if (va->va_start < tmp->va_end)
-+ varea = rb_entry(parent, struct vmap_area, rb_node);
-+ if (va->va_start < varea->va_end)
- p = &(*p)->rb_left;
-- else if (va->va_end > tmp->va_start)
-+ else if (va->va_end > varea->va_start)
- p = &(*p)->rb_right;
- else
- BUG();
-@@ -323,7 +364,7 @@ static void purge_vmap_area_lazy(void);
- * Allocate a region of KVA of the specified size and alignment, within the
- * vstart and vend.
- */
--static struct vmap_area *alloc_vmap_area(unsigned long size,
-+static __size_overflow(1) struct vmap_area *alloc_vmap_area(unsigned long size,
- unsigned long align,
- unsigned long vstart, unsigned long vend,
- int node, gfp_t gfp_mask)
-@@ -1245,6 +1286,16 @@ static struct vm_struct *__get_vm_area_node(unsigned long size,
- struct vm_struct *area;
-
- BUG_ON(in_interrupt());
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
-+ if (flags & VM_KERNEXEC) {
-+ if (start != VMALLOC_START || end != VMALLOC_END)
-+ return NULL;
-+ start = (unsigned long)MODULES_EXEC_VADDR;
-+ end = (unsigned long)MODULES_EXEC_END;
-+ }
-+#endif
-+
- if (flags & VM_IOREMAP) {
- int bit = fls(size);
-
-@@ -1484,6 +1535,11 @@ void *vmap(struct page **pages, unsigned int count,
- if (count > totalram_pages)
- return NULL;
-
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
-+ if (!(pgprot_val(prot) & _PAGE_NX))
-+ flags |= VM_KERNEXEC;
-+#endif
-+
- area = get_vm_area_caller((count << PAGE_SHIFT), flags,
- __builtin_return_address(0));
- if (!area)
-@@ -1594,6 +1650,14 @@ static void *__vmalloc_node(unsigned long size, unsigned long align,
- if (!size || (size >> PAGE_SHIFT) > totalram_pages)
- return NULL;
-
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
-+ if (!(pgprot_val(prot) & _PAGE_NX))
-+ area = __get_vm_area_node(size, align, VM_ALLOC | VM_UNLIST | VM_KERNEXEC,
-+ VMALLOC_START, VMALLOC_END, node,
-+ gfp_mask, caller);
-+ else
-+#endif
-+
- area = __get_vm_area_node(size, align, VM_ALLOC | VM_UNLIST,
- VMALLOC_START, VMALLOC_END, node,
- gfp_mask, caller);
-@@ -1698,10 +1762,9 @@ EXPORT_SYMBOL(vmalloc_node);
- * For tight control over page level allocator and protection flags
- * use __vmalloc() instead.
- */
--
- void *vmalloc_exec(unsigned long size)
- {
-- return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
-+ return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, PAGE_KERNEL_EXEC,
- -1, __builtin_return_address(0));
- }
-
-@@ -1998,6 +2061,8 @@ int remap_vmalloc_range(struct vm_area_struct *vma, void *addr,
- unsigned long uaddr = vma->vm_start;
- unsigned long usize = vma->vm_end - vma->vm_start;
-
-+ BUG_ON(vma->vm_mirror);
-+
- if ((PAGE_SIZE-1) & (unsigned long)addr)
- return -EINVAL;
-
-@@ -2250,8 +2315,8 @@ struct vm_struct **pcpu_get_vm_areas(const unsigned long *offsets,
- return NULL;
- }
-
-- vms = kzalloc(sizeof(vms[0]) * nr_vms, gfp_mask);
-- vas = kzalloc(sizeof(vas[0]) * nr_vms, gfp_mask);
-+ vms = kcalloc(nr_vms, sizeof(vms[0]), gfp_mask);
-+ vas = kcalloc(nr_vms, sizeof(vas[0]), gfp_mask);
- if (!vas || !vms)
- goto err_free;
-
-@@ -2433,7 +2498,7 @@ static int s_show(struct seq_file *m, void *p)
- {
- struct vm_struct *v = p;
-
-- seq_printf(m, "0x%p-0x%p %7ld",
-+ seq_printf(m, "0x%pP-0x%pP %7ld",
- v->addr, v->addr + v->size, v->size);
-
- if (v->caller) {
-diff --git a/mm/vmscan.c b/mm/vmscan.c
-index 4649929..738db2b 100644
---- a/mm/vmscan.c
-+++ b/mm/vmscan.c
-@@ -2241,6 +2241,8 @@ static int kswapd(void *p)
- balance_pgdat(pgdat, order);
- }
- }
-+
-+ current->reclaim_state = NULL;
- return 0;
- }
-
-diff --git a/mm/vmstat.c b/mm/vmstat.c
-index 42d76c6..5643dc4 100644
---- a/mm/vmstat.c
-+++ b/mm/vmstat.c
-@@ -74,7 +74,7 @@ void vm_events_fold_cpu(int cpu)
- *
- * vm_stat contains the global counters
- */
--atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
-+atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
- EXPORT_SYMBOL(vm_stat);
-
- #ifdef CONFIG_SMP
-@@ -324,7 +324,7 @@ void refresh_cpu_vm_stats(int cpu)
- v = p->vm_stat_diff[i];
- p->vm_stat_diff[i] = 0;
- local_irq_restore(flags);
-- atomic_long_add(v, &zone->vm_stat[i]);
-+ atomic_long_add_unchecked(v, &zone->vm_stat[i]);
- global_diff[i] += v;
- #ifdef CONFIG_NUMA
- /* 3 seconds idle till flush */
-@@ -362,7 +362,7 @@ void refresh_cpu_vm_stats(int cpu)
-
- for (i = 0; i < NR_VM_ZONE_STAT_ITEMS; i++)
- if (global_diff[i])
-- atomic_long_add(global_diff[i], &vm_stat[i]);
-+ atomic_long_add_unchecked(global_diff[i], &vm_stat[i]);
- }
-
- #endif
-@@ -953,10 +953,20 @@ static int __init setup_vmstat(void)
- start_cpu_timer(cpu);
- #endif
- #ifdef CONFIG_PROC_FS
-- proc_create("buddyinfo", S_IRUGO, NULL, &fragmentation_file_operations);
-- proc_create("pagetypeinfo", S_IRUGO, NULL, &pagetypeinfo_file_ops);
-- proc_create("vmstat", S_IRUGO, NULL, &proc_vmstat_file_operations);
-- proc_create("zoneinfo", S_IRUGO, NULL, &proc_zoneinfo_file_operations);
-+ {
-+ mode_t gr_mode = S_IRUGO;
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+ gr_mode = S_IRUSR;
-+#endif
-+ proc_create("buddyinfo", gr_mode, NULL, &fragmentation_file_operations);
-+ proc_create("pagetypeinfo", gr_mode, NULL, &pagetypeinfo_file_ops);
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+ proc_create("vmstat", gr_mode | S_IRGRP, NULL, &proc_vmstat_file_operations);
-+#else
-+ proc_create("vmstat", gr_mode, NULL, &proc_vmstat_file_operations);
-+#endif
-+ proc_create("zoneinfo", gr_mode, NULL, &proc_zoneinfo_file_operations);
-+ }
- #endif
- return 0;
- }
-diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
-index a29c5ab..d841655 100644
---- a/net/8021q/vlan.c
-+++ b/net/8021q/vlan.c
-@@ -547,7 +547,7 @@ out:
- return NOTIFY_DONE;
- }
-
--static struct notifier_block vlan_notifier_block __read_mostly = {
-+static struct notifier_block vlan_notifier_block = {
- .notifier_call = vlan_device_event,
- };
-
-@@ -622,8 +622,7 @@ static int vlan_ioctl_handler(struct net *net, void __user *arg)
- err = -EPERM;
- if (!capable(CAP_NET_ADMIN))
- break;
-- if ((args.u.name_type >= 0) &&
-- (args.u.name_type < VLAN_NAME_TYPE_HIGHEST)) {
-+ if (args.u.name_type < VLAN_NAME_TYPE_HIGHEST) {
- struct vlan_net *vn;
-
- vn = net_generic(net, vlan_net_id);
-diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
-index a2d2984..f9eb711 100644
---- a/net/9p/trans_fd.c
-+++ b/net/9p/trans_fd.c
-@@ -419,7 +419,7 @@ static int p9_fd_write(struct p9_client *client, void *v, int len)
- oldfs = get_fs();
- set_fs(get_ds());
- /* The cast to a user pointer is valid due to the set_fs() */
-- ret = vfs_write(ts->wr, (__force void __user *)v, len, &ts->wr->f_pos);
-+ ret = vfs_write(ts->wr, (void __force_user *)v, len, &ts->wr->f_pos);
- set_fs(oldfs);
-
- if (ret <= 0 && ret != -ERESTARTSYS && ret != -EAGAIN)
-diff --git a/net/atm/atm_misc.c b/net/atm/atm_misc.c
-index 02cc7e7..4514f1b 100644
---- a/net/atm/atm_misc.c
-+++ b/net/atm/atm_misc.c
-@@ -19,7 +19,7 @@ int atm_charge(struct atm_vcc *vcc,int truesize)
- if (atomic_read(&sk_atm(vcc)->sk_rmem_alloc) <= sk_atm(vcc)->sk_rcvbuf)
- return 1;
- atm_return(vcc,truesize);
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- return 0;
- }
-
-@@ -41,7 +41,7 @@ struct sk_buff *atm_alloc_charge(struct atm_vcc *vcc,int pdu_size,
- }
- }
- atm_return(vcc,guess);
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- return NULL;
- }
-
-@@ -88,7 +88,7 @@ int atm_pcr_goal(const struct atm_trafprm *tp)
-
- void sonet_copy_stats(struct k_sonet_stats *from,struct sonet_stats *to)
- {
--#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
-+#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
- __SONET_ITEMS
- #undef __HANDLE_ITEM
- }
-@@ -96,7 +96,7 @@ void sonet_copy_stats(struct k_sonet_stats *from,struct sonet_stats *to)
-
- void sonet_subtract_stats(struct k_sonet_stats *from,struct sonet_stats *to)
- {
--#define __HANDLE_ITEM(i) atomic_sub(to->i,&from->i)
-+#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i,&from->i)
- __SONET_ITEMS
- #undef __HANDLE_ITEM
- }
-diff --git a/net/atm/common.c b/net/atm/common.c
-index 950bd16..0baf05e 100644
---- a/net/atm/common.c
-+++ b/net/atm/common.c
-@@ -749,6 +749,7 @@ int vcc_getsockopt(struct socket *sock, int level, int optname,
- if (!vcc->dev ||
- !test_bit(ATM_VF_ADDR,&vcc->flags))
- return -ENOTCONN;
-+ memset(&pvc, 0, sizeof(pvc));
- pvc.sap_family = AF_ATMPVC;
- pvc.sap_addr.itf = vcc->dev->number;
- pvc.sap_addr.vpi = vcc->vpi;
-diff --git a/net/atm/lec.h b/net/atm/lec.h
-index 9d14d19..5c145f3 100644
---- a/net/atm/lec.h
-+++ b/net/atm/lec.h
-@@ -48,7 +48,7 @@ struct lane2_ops {
- const u8 *tlvs, u32 sizeoftlvs);
- void (*associate_indicator) (struct net_device *dev, const u8 *mac_addr,
- const u8 *tlvs, u32 sizeoftlvs);
--};
-+} __no_const;
-
- /*
- * ATM LAN Emulation supports both LLC & Dix Ethernet EtherType
-diff --git a/net/atm/mpoa_caches.c b/net/atm/mpoa_caches.c
-index 4504a4b..1733f1e 100644
---- a/net/atm/mpoa_caches.c
-+++ b/net/atm/mpoa_caches.c
-@@ -498,6 +498,8 @@ static void clear_expired(struct mpoa_client *client)
- struct timeval now;
- struct k_message msg;
-
-+ pax_track_stack();
-+
- do_gettimeofday(&now);
-
- write_lock_irq(&client->egress_lock);
-diff --git a/net/atm/proc.c b/net/atm/proc.c
-index ab8419a..aa91497 100644
---- a/net/atm/proc.c
-+++ b/net/atm/proc.c
-@@ -43,9 +43,9 @@ static void add_stats(struct seq_file *seq, const char *aal,
- const struct k_atm_aal_stats *stats)
- {
- seq_printf(seq, "%s ( %d %d %d %d %d )", aal,
-- atomic_read(&stats->tx),atomic_read(&stats->tx_err),
-- atomic_read(&stats->rx),atomic_read(&stats->rx_err),
-- atomic_read(&stats->rx_drop));
-+ atomic_read_unchecked(&stats->tx),atomic_read_unchecked(&stats->tx_err),
-+ atomic_read_unchecked(&stats->rx),atomic_read_unchecked(&stats->rx_err),
-+ atomic_read_unchecked(&stats->rx_drop));
- }
-
- static void atm_dev_info(struct seq_file *seq, const struct atm_dev *dev)
-@@ -188,7 +188,12 @@ static void vcc_info(struct seq_file *seq, struct atm_vcc *vcc)
- {
- struct sock *sk = sk_atm(vcc);
-
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ seq_printf(seq, "%p ", NULL);
-+#else
- seq_printf(seq, "%p ", vcc);
-+#endif
-+
- if (!vcc->dev)
- seq_printf(seq, "Unassigned ");
- else
-@@ -214,7 +219,11 @@ static void svc_info(struct seq_file *seq, struct atm_vcc *vcc)
- {
- if (!vcc->dev)
- seq_printf(seq, sizeof(void *) == 4 ?
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ "N/A@%p%10s" : "N/A@%p%2s", NULL, "");
-+#else
- "N/A@%p%10s" : "N/A@%p%2s", vcc, "");
-+#endif
- else
- seq_printf(seq, "%3d %3d %5d ",
- vcc->dev->number, vcc->vpi, vcc->vci);
-diff --git a/net/atm/pvc.c b/net/atm/pvc.c
-index d4c0245..5f6d1fb 100644
---- a/net/atm/pvc.c
-+++ b/net/atm/pvc.c
-@@ -92,7 +92,8 @@ static int pvc_getname(struct socket *sock,struct sockaddr *sockaddr,
-
- if (!vcc->dev || !test_bit(ATM_VF_ADDR,&vcc->flags)) return -ENOTCONN;
- *sockaddr_len = sizeof(struct sockaddr_atmpvc);
-- addr = (struct sockaddr_atmpvc *) sockaddr;
-+ addr = (struct sockaddr_atmpvc *)sockaddr;
-+ memset(addr, 0, sizeof(*addr));
- addr->sap_family = AF_ATMPVC;
- addr->sap_addr.itf = vcc->dev->number;
- addr->sap_addr.vpi = vcc->vpi;
-diff --git a/net/atm/resources.c b/net/atm/resources.c
-index 56b7322..c48b84e 100644
---- a/net/atm/resources.c
-+++ b/net/atm/resources.c
-@@ -161,7 +161,7 @@ void atm_dev_deregister(struct atm_dev *dev)
- static void copy_aal_stats(struct k_atm_aal_stats *from,
- struct atm_aal_stats *to)
- {
--#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
-+#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
- __AAL_STAT_ITEMS
- #undef __HANDLE_ITEM
- }
-@@ -170,7 +170,7 @@ static void copy_aal_stats(struct k_atm_aal_stats *from,
- static void subtract_aal_stats(struct k_atm_aal_stats *from,
- struct atm_aal_stats *to)
- {
--#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
-+#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i, &from->i)
- __AAL_STAT_ITEMS
- #undef __HANDLE_ITEM
- }
-diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
-index 75302a9..09e36d3 100644
---- a/net/bluetooth/hci_sock.c
-+++ b/net/bluetooth/hci_sock.c
-@@ -511,7 +511,7 @@ static int hci_sock_setsockopt(struct socket *sock, int level, int optname, char
- uf.event_mask[1] = *((u32 *) f->event_mask + 1);
- }
-
-- len = min_t(unsigned int, len, sizeof(uf));
-+ len = min((size_t)len, sizeof(uf));
- if (copy_from_user(&uf, optval, len)) {
- err = -EFAULT;
- break;
-@@ -576,6 +576,7 @@ static int hci_sock_getsockopt(struct socket *sock, int level, int optname, char
- {
- struct hci_filter *f = &hci_pi(sk)->filter;
-
-+ memset(&uf, 0, sizeof(uf));
- uf.type_mask = f->type_mask;
- uf.opcode = f->opcode;
- uf.event_mask[0] = *((u32 *) f->event_mask + 0);
-diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
-index 1ae3f80..c5d763b 100644
---- a/net/bluetooth/rfcomm/sock.c
-+++ b/net/bluetooth/rfcomm/sock.c
-@@ -543,6 +543,7 @@ static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int *
-
- BT_DBG("sock %p, sk %p", sock, sk);
-
-+ memset(sa, 0, sizeof(*sa));
- sa->rc_family = AF_BLUETOOTH;
- sa->rc_channel = rfcomm_pi(sk)->channel;
- if (peer)
-@@ -792,7 +793,7 @@ static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, c
-
- sec.level = BT_SECURITY_LOW;
-
-- len = min_t(unsigned int, sizeof(sec), optlen);
-+ len = min(sizeof(sec), len);
- if (copy_from_user((char *) &sec, optval, len)) {
- err = -EFAULT;
- break;
-diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
-index 5f6a305..00b8f21 100644
---- a/net/bluetooth/rfcomm/tty.c
-+++ b/net/bluetooth/rfcomm/tty.c
-@@ -472,7 +472,8 @@ static int rfcomm_get_dev_list(void __user *arg)
-
- size = sizeof(*dl) + dev_num * sizeof(*di);
-
-- if (!(dl = kmalloc(size, GFP_KERNEL)))
-+ dl = kzalloc(size, GFP_KERNEL);
-+ if (!dl)
- return -ENOMEM;
-
- di = dl->dev_info;
-diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
-index 8567d47..bba2292 100644
---- a/net/bridge/br_private.h
-+++ b/net/bridge/br_private.h
-@@ -255,7 +255,7 @@ extern void br_ifinfo_notify(int event, struct net_bridge_port *port);
-
- #ifdef CONFIG_SYSFS
- /* br_sysfs_if.c */
--extern struct sysfs_ops brport_sysfs_ops;
-+extern const struct sysfs_ops brport_sysfs_ops;
- extern int br_sysfs_addif(struct net_bridge_port *p);
-
- /* br_sysfs_br.c */
-diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
-index 9a52ac5..c97538e 100644
---- a/net/bridge/br_stp_if.c
-+++ b/net/bridge/br_stp_if.c
-@@ -146,7 +146,7 @@ static void br_stp_stop(struct net_bridge *br)
- char *envp[] = { NULL };
-
- if (br->stp_enabled == BR_USER_STP) {
-- r = call_usermodehelper(BR_STP_PROG, argv, envp, 1);
-+ r = call_usermodehelper(BR_STP_PROG, argv, envp, UMH_WAIT_PROC);
- printk(KERN_INFO "%s: userspace STP stopped, return code %d\n",
- br->dev->name, r);
-
-diff --git a/net/bridge/br_sysfs_if.c b/net/bridge/br_sysfs_if.c
-index 820643a..ce77fb3 100644
---- a/net/bridge/br_sysfs_if.c
-+++ b/net/bridge/br_sysfs_if.c
-@@ -220,7 +220,7 @@ static ssize_t brport_store(struct kobject * kobj,
- return ret;
- }
-
--struct sysfs_ops brport_sysfs_ops = {
-+const struct sysfs_ops brport_sysfs_ops = {
- .show = brport_show,
- .store = brport_store,
- };
-diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
-index d73d47f..72df42a 100644
---- a/net/bridge/netfilter/ebtables.c
-+++ b/net/bridge/netfilter/ebtables.c
-@@ -1337,6 +1337,8 @@ static int copy_everything_to_user(struct ebt_table *t, void __user *user,
- unsigned int entries_size, nentries;
- char *entries;
-
-+ pax_track_stack();
-+
- if (cmd == EBT_SO_GET_ENTRIES) {
- entries_size = t->private->entries_size;
- nentries = t->private->nentries;
-diff --git a/net/can/af_can.c b/net/can/af_can.c
-index 6068321..a460dd0 100644
---- a/net/can/af_can.c
-+++ b/net/can/af_can.c
-@@ -849,7 +849,7 @@ static struct net_proto_family can_family_ops __read_mostly = {
- };
-
- /* notifier block for netdevice event */
--static struct notifier_block can_netdev_notifier __read_mostly = {
-+static struct notifier_block can_netdev_notifier = {
- .notifier_call = can_notifier,
- };
-
-diff --git a/net/can/bcm.c b/net/can/bcm.c
-index 2ffd2e0..e002f92 100644
---- a/net/can/bcm.c
-+++ b/net/can/bcm.c
-@@ -164,9 +164,15 @@ static int bcm_proc_show(struct seq_file *m, void *v)
- struct bcm_sock *bo = bcm_sk(sk);
- struct bcm_op *op;
-
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ seq_printf(m, ">>> socket %p", NULL);
-+ seq_printf(m, " / sk %p", NULL);
-+ seq_printf(m, " / bo %p", NULL);
-+#else
- seq_printf(m, ">>> socket %p", sk->sk_socket);
- seq_printf(m, " / sk %p", sk);
- seq_printf(m, " / bo %p", bo);
-+#endif
- seq_printf(m, " / dropped %lu", bo->dropped_usr_msgs);
- seq_printf(m, " / bound %s", bcm_proc_getifname(ifname, bo->ifindex));
- seq_printf(m, " <<<\n");
-@@ -1091,6 +1097,9 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
- op->sk = sk;
- op->ifindex = ifindex;
-
-+ /* ifindex for timeout events w/o previous frame reception */
-+ op->rx_ifindex = ifindex;
-+
- /* initialize uninitialized (kzalloc) structure */
- hrtimer_init(&op->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
- op->timer.function = bcm_rx_timeout_handler;
-diff --git a/net/compat.c b/net/compat.c
-index 9559afc..6c62f69 100644
---- a/net/compat.c
-+++ b/net/compat.c
-@@ -69,9 +69,9 @@ int get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr __user *umsg)
- __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
- __get_user(kmsg->msg_flags, &umsg->msg_flags))
- return -EFAULT;
-- kmsg->msg_name = compat_ptr(tmp1);
-- kmsg->msg_iov = compat_ptr(tmp2);
-- kmsg->msg_control = compat_ptr(tmp3);
-+ kmsg->msg_name = (void __force_kernel *)compat_ptr(tmp1);
-+ kmsg->msg_iov = (void __force_kernel *)compat_ptr(tmp2);
-+ kmsg->msg_control = (void __force_kernel *)compat_ptr(tmp3);
- return 0;
- }
-
-@@ -94,7 +94,7 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
- kern_msg->msg_name = NULL;
-
- tot_len = iov_from_user_compat_to_kern(kern_iov,
-- (struct compat_iovec __user *)kern_msg->msg_iov,
-+ (struct compat_iovec __force_user *)kern_msg->msg_iov,
- kern_msg->msg_iovlen);
- if (tot_len >= 0)
- kern_msg->msg_iov = kern_iov;
-@@ -114,20 +114,20 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
-
- #define CMSG_COMPAT_FIRSTHDR(msg) \
- (((msg)->msg_controllen) >= sizeof(struct compat_cmsghdr) ? \
-- (struct compat_cmsghdr __user *)((msg)->msg_control) : \
-+ (struct compat_cmsghdr __force_user *)((msg)->msg_control) : \
- (struct compat_cmsghdr __user *)NULL)
-
- #define CMSG_COMPAT_OK(ucmlen, ucmsg, mhdr) \
- ((ucmlen) >= sizeof(struct compat_cmsghdr) && \
- (ucmlen) <= (unsigned long) \
- ((mhdr)->msg_controllen - \
-- ((char *)(ucmsg) - (char *)(mhdr)->msg_control)))
-+ ((char __force_kernel *)(ucmsg) - (char *)(mhdr)->msg_control)))
-
- static inline struct compat_cmsghdr __user *cmsg_compat_nxthdr(struct msghdr *msg,
- struct compat_cmsghdr __user *cmsg, int cmsg_len)
- {
- char __user *ptr = (char __user *)cmsg + CMSG_COMPAT_ALIGN(cmsg_len);
-- if ((unsigned long)(ptr + 1 - (char __user *)msg->msg_control) >
-+ if ((unsigned long)(ptr + 1 - (char __force_user *)msg->msg_control) >
- msg->msg_controllen)
- return NULL;
- return (struct compat_cmsghdr __user *)ptr;
-@@ -219,7 +219,7 @@ int put_cmsg_compat(struct msghdr *kmsg, int level, int type, int len, void *dat
- {
- struct compat_timeval ctv;
- struct compat_timespec cts[3];
-- struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __user *) kmsg->msg_control;
-+ struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __force_user *) kmsg->msg_control;
- struct compat_cmsghdr cmhdr;
- int cmlen;
-
-@@ -271,7 +271,7 @@ int put_cmsg_compat(struct msghdr *kmsg, int level, int type, int len, void *dat
-
- void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm)
- {
-- struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __user *) kmsg->msg_control;
-+ struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __force_user *) kmsg->msg_control;
- int fdmax = (kmsg->msg_controllen - sizeof(struct compat_cmsghdr)) / sizeof(int);
- int fdnum = scm->fp->count;
- struct file **fp = scm->fp->fp;
-@@ -433,7 +433,7 @@ static int do_get_sock_timeout(struct socket *sock, int level, int optname,
- len = sizeof(ktime);
- old_fs = get_fs();
- set_fs(KERNEL_DS);
-- err = sock_getsockopt(sock, level, optname, (char *) &ktime, &len);
-+ err = sock_getsockopt(sock, level, optname, (char __force_user *) &ktime, (int __force_user *)&len);
- set_fs(old_fs);
-
- if (!err) {
-@@ -570,7 +570,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
- case MCAST_JOIN_GROUP:
- case MCAST_LEAVE_GROUP:
- {
-- struct compat_group_req __user *gr32 = (void *)optval;
-+ struct compat_group_req __user *gr32 = (void __user *)optval;
- struct group_req __user *kgr =
- compat_alloc_user_space(sizeof(struct group_req));
- u32 interface;
-@@ -591,7 +591,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
- case MCAST_BLOCK_SOURCE:
- case MCAST_UNBLOCK_SOURCE:
- {
-- struct compat_group_source_req __user *gsr32 = (void *)optval;
-+ struct compat_group_source_req __user *gsr32 = (void __user *)optval;
- struct group_source_req __user *kgsr = compat_alloc_user_space(
- sizeof(struct group_source_req));
- u32 interface;
-@@ -612,7 +612,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
- }
- case MCAST_MSFILTER:
- {
-- struct compat_group_filter __user *gf32 = (void *)optval;
-+ struct compat_group_filter __user *gf32 = (void __user *)optval;
- struct group_filter __user *kgf;
- u32 interface, fmode, numsrc;
-
-@@ -765,7 +765,7 @@ asmlinkage long compat_sys_socketcall(int call, u32 __user *args)
-
- if (call < SYS_SOCKET || call > SYS_ACCEPT4)
- return -EINVAL;
-- if (copy_from_user(a, args, nas[call]))
-+ if (nas[call] > sizeof a || copy_from_user(a, args, nas[call]))
- return -EFAULT;
- a0 = a[0];
- a1 = a[1];
-diff --git a/net/core/dev.c b/net/core/dev.c
-index 46e2a29..ab7b15e 100644
---- a/net/core/dev.c
-+++ b/net/core/dev.c
-@@ -1047,10 +1047,14 @@ void dev_load(struct net *net, const char *name)
- if (no_module && capable(CAP_NET_ADMIN))
- no_module = request_module("netdev-%s", name);
- if (no_module && capable(CAP_SYS_MODULE)) {
-+#ifdef CONFIG_GRKERNSEC_MODHARDEN
-+ ___request_module(true, "grsec_modharden_netdev", "%s", name);
-+#else
- if (!request_module("%s", name))
- pr_err("Loading kernel module for a network device "
- "with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%s "
- "instead\n", name);
-+#endif
- }
- }
- EXPORT_SYMBOL(dev_load);
-@@ -1655,7 +1659,7 @@ static inline int illegal_highdma(struct net_device *dev, struct sk_buff *skb)
-
- struct dev_gso_cb {
- void (*destructor)(struct sk_buff *skb);
--};
-+} __no_const;
-
- #define DEV_GSO_CB(skb) ((struct dev_gso_cb *)(skb)->cb)
-
-@@ -2064,7 +2068,7 @@ int netif_rx_ni(struct sk_buff *skb)
- }
- EXPORT_SYMBOL(netif_rx_ni);
-
--static void net_tx_action(struct softirq_action *h)
-+static void net_tx_action(void)
- {
- struct softnet_data *sd = &__get_cpu_var(softnet_data);
-
-@@ -2828,7 +2832,7 @@ void netif_napi_del(struct napi_struct *napi)
- EXPORT_SYMBOL(netif_napi_del);
-
-
--static void net_rx_action(struct softirq_action *h)
-+static void net_rx_action(void)
- {
- struct list_head *list = &__get_cpu_var(softnet_data).poll_list;
- unsigned long time_limit = jiffies + 2;
-@@ -3264,8 +3268,13 @@ static int ptype_seq_show(struct seq_file *seq, void *v)
- else
- seq_printf(seq, "%04x", ntohs(pt->type));
-
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ seq_printf(seq, " %-8s %p\n",
-+ pt->dev ? pt->dev->name : "", NULL);
-+#else
- seq_printf(seq, " %-8s %pF\n",
- pt->dev ? pt->dev->name : "", pt->func);
-+#endif
- }
-
- return 0;
-diff --git a/net/core/flow.c b/net/core/flow.c
-index 9601587..8c4824e 100644
---- a/net/core/flow.c
-+++ b/net/core/flow.c
-@@ -35,11 +35,11 @@ struct flow_cache_entry {
- atomic_t *object_ref;
- };
-
--atomic_t flow_cache_genid = ATOMIC_INIT(0);
-+atomic_unchecked_t flow_cache_genid = ATOMIC_INIT(0);
-
- static u32 flow_hash_shift;
- #define flow_hash_size (1 << flow_hash_shift)
--static DEFINE_PER_CPU(struct flow_cache_entry **, flow_tables) = { NULL };
-+static DEFINE_PER_CPU(struct flow_cache_entry **, flow_tables);
-
- #define flow_table(cpu) (per_cpu(flow_tables, cpu))
-
-@@ -52,7 +52,7 @@ struct flow_percpu_info {
- u32 hash_rnd;
- int count;
- };
--static DEFINE_PER_CPU(struct flow_percpu_info, flow_hash_info) = { 0 };
-+static DEFINE_PER_CPU(struct flow_percpu_info, flow_hash_info);
-
- #define flow_hash_rnd_recalc(cpu) \
- (per_cpu(flow_hash_info, cpu).hash_rnd_recalc)
-@@ -69,7 +69,7 @@ struct flow_flush_info {
- atomic_t cpuleft;
- struct completion completion;
- };
--static DEFINE_PER_CPU(struct tasklet_struct, flow_flush_tasklets) = { NULL };
-+static DEFINE_PER_CPU(struct tasklet_struct, flow_flush_tasklets);
-
- #define flow_flush_tasklet(cpu) (&per_cpu(flow_flush_tasklets, cpu))
-
-@@ -190,7 +190,7 @@ void *flow_cache_lookup(struct net *net, struct flowi *key, u16 family, u8 dir,
- if (fle->family == family &&
- fle->dir == dir &&
- flow_key_compare(key, &fle->key) == 0) {
-- if (fle->genid == atomic_read(&flow_cache_genid)) {
-+ if (fle->genid == atomic_read_unchecked(&flow_cache_genid)) {
- void *ret = fle->object;
-
- if (ret)
-@@ -228,7 +228,7 @@ nocache:
- err = resolver(net, key, family, dir, &obj, &obj_ref);
-
- if (fle && !err) {
-- fle->genid = atomic_read(&flow_cache_genid);
-+ fle->genid = atomic_read_unchecked(&flow_cache_genid);
-
- if (fle->object)
- atomic_dec(fle->object_ref);
-@@ -258,7 +258,7 @@ static void flow_cache_flush_tasklet(unsigned long data)
-
- fle = flow_table(cpu)[i];
- for (; fle; fle = fle->next) {
-- unsigned genid = atomic_read(&flow_cache_genid);
-+ unsigned genid = atomic_read_unchecked(&flow_cache_genid);
-
- if (!fle->object || fle->genid == genid)
- continue;
-diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
-index 9d70042..ef608bd 100644
---- a/net/core/rtnetlink.c
-+++ b/net/core/rtnetlink.c
-@@ -160,11 +160,13 @@ int __rtnl_register(int protocol, int msgtype,
- rtnl_msg_handlers[protocol] = tab;
- }
-
-+ pax_open_kernel();
- if (doit)
-- tab[msgindex].doit = doit;
-+ *(void **)&tab[msgindex].doit = doit;
-
- if (dumpit)
-- tab[msgindex].dumpit = dumpit;
-+ *(void **)&tab[msgindex].dumpit = dumpit;
-+ pax_close_kernel();
-
- return 0;
- }
-@@ -208,8 +210,10 @@ int rtnl_unregister(int protocol, int msgtype)
- if (rtnl_msg_handlers[protocol] == NULL)
- return -ENOENT;
-
-- rtnl_msg_handlers[protocol][msgindex].doit = NULL;
-- rtnl_msg_handlers[protocol][msgindex].dumpit = NULL;
-+ pax_open_kernel();
-+ *(void **)&rtnl_msg_handlers[protocol][msgindex].doit = NULL;
-+ *(void **)&rtnl_msg_handlers[protocol][msgindex].dumpit = NULL;
-+ pax_close_kernel();
-
- return 0;
- }
-diff --git a/net/core/scm.c b/net/core/scm.c
-index d98eafc..1a190a9 100644
---- a/net/core/scm.c
-+++ b/net/core/scm.c
-@@ -191,7 +191,7 @@ error:
- int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
- {
- struct cmsghdr __user *cm
-- = (__force struct cmsghdr __user *)msg->msg_control;
-+ = (struct cmsghdr __force_user *)msg->msg_control;
- struct cmsghdr cmhdr;
- int cmlen = CMSG_LEN(len);
- int err;
-@@ -214,7 +214,7 @@ int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
- err = -EFAULT;
- if (copy_to_user(cm, &cmhdr, sizeof cmhdr))
- goto out;
-- if (copy_to_user(CMSG_DATA(cm), data, cmlen - sizeof(struct cmsghdr)))
-+ if (copy_to_user((void __force_user *)CMSG_DATA((void __force_kernel *)cm), data, cmlen - sizeof(struct cmsghdr)))
- goto out;
- cmlen = CMSG_SPACE(len);
- if (msg->msg_controllen < cmlen)
-@@ -229,7 +229,7 @@ out:
- void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
- {
- struct cmsghdr __user *cm
-- = (__force struct cmsghdr __user*)msg->msg_control;
-+ = (struct cmsghdr __force_user *)msg->msg_control;
-
- int fdmax = 0;
- int fdnum = scm->fp->count;
-@@ -249,7 +249,7 @@ void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
- if (fdnum < fdmax)
- fdmax = fdnum;
-
-- for (i=0, cmfptr=(__force int __user *)CMSG_DATA(cm); i<fdmax;
-+ for (i=0, cmfptr=(int __force_user *)CMSG_DATA((void __force_kernel *)cm); i<fdmax;
- i++, cmfptr++)
- {
- int new_fd;
-diff --git a/net/core/secure_seq.c b/net/core/secure_seq.c
-index 45329d7..626aaa6 100644
---- a/net/core/secure_seq.c
-+++ b/net/core/secure_seq.c
-@@ -57,7 +57,7 @@ __u32 secure_tcpv6_sequence_number(__be32 *saddr, __be32 *daddr,
- EXPORT_SYMBOL(secure_tcpv6_sequence_number);
-
- u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
-- __be16 dport)
-+ __be16 dport)
- {
- u32 secret[MD5_MESSAGE_BYTES / 4];
- u32 hash[MD5_DIGEST_WORDS];
-@@ -71,7 +71,6 @@ u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
- secret[i] = net_secret[i];
-
- md5_transform(hash, secret);
--
- return hash[0];
- }
- #endif
-diff --git a/net/core/skbuff.c b/net/core/skbuff.c
-index 72ff527..a014894 100644
---- a/net/core/skbuff.c
-+++ b/net/core/skbuff.c
-@@ -1544,6 +1544,8 @@ int skb_splice_bits(struct sk_buff *skb, unsigned int offset,
- struct sk_buff *frag_iter;
- struct sock *sk = skb->sk;
-
-+ pax_track_stack();
-+
- /*
- * __skb_splice_bits() only fails if the output has no room left,
- * so no point in going over the frag_list for the error case.
-diff --git a/net/core/sock.c b/net/core/sock.c
-index 4538a34..d53ed34 100644
---- a/net/core/sock.c
-+++ b/net/core/sock.c
-@@ -562,7 +562,8 @@ set_rcvbuf:
-
- case SO_KEEPALIVE:
- #ifdef CONFIG_INET
-- if (sk->sk_protocol == IPPROTO_TCP)
-+ if (sk->sk_protocol == IPPROTO_TCP &&
-+ sk->sk_type == SOCK_STREAM)
- tcp_set_keepalive(sk, valbool);
- #endif
- sock_valbool_flag(sk, SOCK_KEEPOPEN, valbool);
-@@ -864,11 +865,15 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
- break;
-
- case SO_PEERCRED:
-+ {
-+ struct ucred peercred;
- if (len > sizeof(sk->sk_peercred))
- len = sizeof(sk->sk_peercred);
-- if (copy_to_user(optval, &sk->sk_peercred, len))
-+ peercred = sk->sk_peercred;
-+ if (copy_to_user(optval, &peercred, len))
- return -EFAULT;
- goto lenout;
-+ }
-
- case SO_PEERNAME:
- {
-@@ -1895,7 +1900,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
- */
- smp_wmb();
- atomic_set(&sk->sk_refcnt, 1);
-- atomic_set(&sk->sk_drops, 0);
-+ atomic_set_unchecked(&sk->sk_drops, 0);
- }
- EXPORT_SYMBOL(sock_init_data);
-
-diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c
-index 34dcc79..f51ed45 100644
---- a/net/dccp/ccids/ccid3.c
-+++ b/net/dccp/ccids/ccid3.c
-@@ -604,20 +604,29 @@ static void ccid3_hc_tx_get_info(struct sock *sk, struct tcp_info *info)
- static int ccid3_hc_tx_getsockopt(struct sock *sk, const int optname, int len,
- u32 __user *optval, int __user *optlen)
- {
-- const struct ccid3_hc_tx_sock *hctx;
-+ const struct ccid3_hc_tx_sock *hc = ccid3_hc_tx_sk(sk);
-+ struct tfrc_tx_info tfrc;
- const void *val;
-
- /* Listen socks doesn't have a private CCID block */
- if (sk->sk_state == DCCP_LISTEN)
- return -EINVAL;
-
-- hctx = ccid3_hc_tx_sk(sk);
- switch (optname) {
- case DCCP_SOCKOPT_CCID_TX_INFO:
-- if (len < sizeof(hctx->ccid3hctx_tfrc))
-+ if (len < sizeof(tfrc))
- return -EINVAL;
-- len = sizeof(hctx->ccid3hctx_tfrc);
-- val = &hctx->ccid3hctx_tfrc;
-+
-+ memset(&tfrc, 0, sizeof(tfrc));
-+ tfrc.tfrctx_x = hc->ccid3hctx_x;
-+ tfrc.tfrctx_x_recv = hc->ccid3hctx_x_recv;
-+ tfrc.tfrctx_x_calc = hc->ccid3hctx_x_calc;
-+ tfrc.tfrctx_rtt = hc->ccid3hctx_rtt;
-+ tfrc.tfrctx_p = hc->ccid3hctx_p;
-+ tfrc.tfrctx_rto = hc->ccid3hctx_t_rto;
-+ tfrc.tfrctx_ipi = hc->ccid3hctx_t_ipi;
-+ len = sizeof(tfrc);
-+ val = &tfrc;
- break;
- default:
- return -ENOPROTOOPT;
-diff --git a/net/decnet/sysctl_net_decnet.c b/net/decnet/sysctl_net_decnet.c
-index 2036568..c55883d 100644
---- a/net/decnet/sysctl_net_decnet.c
-+++ b/net/decnet/sysctl_net_decnet.c
-@@ -206,7 +206,7 @@ static int dn_node_address_handler(ctl_table *table, int write,
-
- if (len > *lenp) len = *lenp;
-
-- if (copy_to_user(buffer, addr, len))
-+ if (len > sizeof addr || copy_to_user(buffer, addr, len))
- return -EFAULT;
-
- *lenp = len;
-@@ -327,7 +327,7 @@ static int dn_def_dev_handler(ctl_table *table, int write,
-
- if (len > *lenp) len = *lenp;
-
-- if (copy_to_user(buffer, devname, len))
-+ if (len > sizeof devname || copy_to_user(buffer, devname, len))
- return -EFAULT;
-
- *lenp = len;
-diff --git a/net/econet/Kconfig b/net/econet/Kconfig
-index 39a2d29..f39c0fe 100644
---- a/net/econet/Kconfig
-+++ b/net/econet/Kconfig
-@@ -4,7 +4,7 @@
-
- config ECONET
- tristate "Acorn Econet/AUN protocols (EXPERIMENTAL)"
-- depends on EXPERIMENTAL && INET
-+ depends on EXPERIMENTAL && INET && BROKEN
- ---help---
- Econet is a fairly old and slow networking protocol mainly used by
- Acorn computers to access file and print servers. It uses native
-diff --git a/net/ieee802154/dgram.c b/net/ieee802154/dgram.c
-index a413b1b..380849c 100644
---- a/net/ieee802154/dgram.c
-+++ b/net/ieee802154/dgram.c
-@@ -318,7 +318,7 @@ out:
- static int dgram_rcv_skb(struct sock *sk, struct sk_buff *skb)
- {
- if (sock_queue_rcv_skb(sk, skb) < 0) {
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- kfree_skb(skb);
- return NET_RX_DROP;
- }
-diff --git a/net/ieee802154/raw.c b/net/ieee802154/raw.c
-index 30e74ee..bfc6ee0 100644
---- a/net/ieee802154/raw.c
-+++ b/net/ieee802154/raw.c
-@@ -206,7 +206,7 @@ out:
- static int raw_rcv_skb(struct sock *sk, struct sk_buff *skb)
- {
- if (sock_queue_rcv_skb(sk, skb) < 0) {
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- kfree_skb(skb);
- return NET_RX_DROP;
- }
-diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
-index dba56d2..acee5d6 100644
---- a/net/ipv4/inet_diag.c
-+++ b/net/ipv4/inet_diag.c
-@@ -113,8 +113,13 @@ static int inet_csk_diag_fill(struct sock *sk,
- r->idiag_retrans = 0;
-
- r->id.idiag_if = sk->sk_bound_dev_if;
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ r->id.idiag_cookie[0] = 0;
-+ r->id.idiag_cookie[1] = 0;
-+#else
- r->id.idiag_cookie[0] = (u32)(unsigned long)sk;
- r->id.idiag_cookie[1] = (u32)(((unsigned long)sk >> 31) >> 1);
-+#endif
-
- r->id.idiag_sport = inet->sport;
- r->id.idiag_dport = inet->dport;
-@@ -200,8 +205,15 @@ static int inet_twsk_diag_fill(struct inet_timewait_sock *tw,
- r->idiag_family = tw->tw_family;
- r->idiag_retrans = 0;
- r->id.idiag_if = tw->tw_bound_dev_if;
-+
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ r->id.idiag_cookie[0] = 0;
-+ r->id.idiag_cookie[1] = 0;
-+#else
- r->id.idiag_cookie[0] = (u32)(unsigned long)tw;
- r->id.idiag_cookie[1] = (u32)(((unsigned long)tw >> 31) >> 1);
-+#endif
-+
- r->id.idiag_sport = tw->tw_sport;
- r->id.idiag_dport = tw->tw_dport;
- r->id.idiag_src[0] = tw->tw_rcv_saddr;
-@@ -284,12 +296,14 @@ static int inet_diag_get_exact(struct sk_buff *in_skb,
- if (sk == NULL)
- goto unlock;
-
-+#ifndef CONFIG_GRKERNSEC_HIDESYM
- err = -ESTALE;
- if ((req->id.idiag_cookie[0] != INET_DIAG_NOCOOKIE ||
- req->id.idiag_cookie[1] != INET_DIAG_NOCOOKIE) &&
- ((u32)(unsigned long)sk != req->id.idiag_cookie[0] ||
- (u32)((((unsigned long)sk) >> 31) >> 1) != req->id.idiag_cookie[1]))
- goto out;
-+#endif
-
- err = -ENOMEM;
- rep = alloc_skb(NLMSG_SPACE((sizeof(struct inet_diag_msg) +
-@@ -579,8 +593,14 @@ static int inet_diag_fill_req(struct sk_buff *skb, struct sock *sk,
- r->idiag_retrans = req->retrans;
-
- r->id.idiag_if = sk->sk_bound_dev_if;
-+
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ r->id.idiag_cookie[0] = 0;
-+ r->id.idiag_cookie[1] = 0;
-+#else
- r->id.idiag_cookie[0] = (u32)(unsigned long)req;
- r->id.idiag_cookie[1] = (u32)(((unsigned long)req >> 31) >> 1);
-+#endif
-
- tmo = req->expires - jiffies;
- if (tmo < 0)
-diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
-index d717267..56de7e7 100644
---- a/net/ipv4/inet_hashtables.c
-+++ b/net/ipv4/inet_hashtables.c
-@@ -18,12 +18,15 @@
- #include <linux/sched.h>
- #include <linux/slab.h>
- #include <linux/wait.h>
-+#include <linux/security.h>
-
- #include <net/inet_connection_sock.h>
- #include <net/inet_hashtables.h>
- #include <net/secure_seq.h>
- #include <net/ip.h>
-
-+extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
-+
- /*
- * Allocate and initialize a new local port bind bucket.
- * The bindhash mutex for snum's hash chain must be held here.
-@@ -491,6 +494,8 @@ ok:
- }
- spin_unlock(&head->lock);
-
-+ gr_update_task_in_ip_table(current, inet_sk(sk));
-+
- if (tw) {
- inet_twsk_deschedule(tw, death_row);
- inet_twsk_put(tw);
-diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
-index 13b229f..6956484 100644
---- a/net/ipv4/inetpeer.c
-+++ b/net/ipv4/inetpeer.c
-@@ -367,6 +367,8 @@ struct inet_peer *inet_getpeer(__be32 daddr, int create)
- struct inet_peer *p, *n;
- struct inet_peer **stack[PEER_MAXDEPTH], ***stackptr;
-
-+ pax_track_stack();
-+
- /* Look up for the address quickly. */
- read_lock_bh(&peer_pool_lock);
- p = lookup(daddr, NULL);
-@@ -390,7 +392,7 @@ struct inet_peer *inet_getpeer(__be32 daddr, int create)
- return NULL;
- n->v4daddr = daddr;
- atomic_set(&n->refcnt, 1);
-- atomic_set(&n->rid, 0);
-+ atomic_set_unchecked(&n->rid, 0);
- n->ip_id_count = secure_ip_id(daddr);
- n->tcp_ts_stamp = 0;
-
-diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
-index d3fe10b..feeafc9 100644
---- a/net/ipv4/ip_fragment.c
-+++ b/net/ipv4/ip_fragment.c
-@@ -255,7 +255,7 @@ static inline int ip_frag_too_far(struct ipq *qp)
- return 0;
-
- start = qp->rid;
-- end = atomic_inc_return(&peer->rid);
-+ end = atomic_inc_return_unchecked(&peer->rid);
- qp->rid = end;
-
- rc = qp->q.fragments && (end - start) > max;
-diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
-index e982b5c..f079d75 100644
---- a/net/ipv4/ip_sockglue.c
-+++ b/net/ipv4/ip_sockglue.c
-@@ -1015,6 +1015,8 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
- int val;
- int len;
-
-+ pax_track_stack();
-+
- if (level != SOL_IP)
- return -EOPNOTSUPP;
-
-@@ -1173,7 +1175,7 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
- if (sk->sk_type != SOCK_STREAM)
- return -ENOPROTOOPT;
-
-- msg.msg_control = optval;
-+ msg.msg_control = (void __force_kernel *)optval;
- msg.msg_controllen = len;
- msg.msg_flags = 0;
-
-diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
-index f8d04c2..c1188f2 100644
---- a/net/ipv4/ipconfig.c
-+++ b/net/ipv4/ipconfig.c
-@@ -295,7 +295,7 @@ static int __init ic_devinet_ioctl(unsigned int cmd, struct ifreq *arg)
-
- mm_segment_t oldfs = get_fs();
- set_fs(get_ds());
-- res = devinet_ioctl(&init_net, cmd, (struct ifreq __user *) arg);
-+ res = devinet_ioctl(&init_net, cmd, (struct ifreq __force_user *) arg);
- set_fs(oldfs);
- return res;
- }
-@@ -306,7 +306,7 @@ static int __init ic_dev_ioctl(unsigned int cmd, struct ifreq *arg)
-
- mm_segment_t oldfs = get_fs();
- set_fs(get_ds());
-- res = dev_ioctl(&init_net, cmd, (struct ifreq __user *) arg);
-+ res = dev_ioctl(&init_net, cmd, (struct ifreq __force_user *) arg);
- set_fs(oldfs);
- return res;
- }
-@@ -317,7 +317,7 @@ static int __init ic_route_ioctl(unsigned int cmd, struct rtentry *arg)
-
- mm_segment_t oldfs = get_fs();
- set_fs(get_ds());
-- res = ip_rt_ioctl(&init_net, cmd, (void __user *) arg);
-+ res = ip_rt_ioctl(&init_net, cmd, (void __force_user *) arg);
- set_fs(oldfs);
- return res;
- }
-diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
-index c8b0cc3..df2154c 100644
---- a/net/ipv4/netfilter/arp_tables.c
-+++ b/net/ipv4/netfilter/arp_tables.c
-@@ -900,14 +900,14 @@ static int compat_table_info(const struct xt_table_info *info,
- }
- #endif
-
--static int get_info(struct net *net, void __user *user, int *len, int compat)
-+static int get_info(struct net *net, void __user *user, int len, int compat)
- {
- char name[ARPT_TABLE_MAXNAMELEN];
- struct xt_table *t;
- int ret;
-
-- if (*len != sizeof(struct arpt_getinfo)) {
-- duprintf("length %u != %Zu\n", *len,
-+ if (len != sizeof(struct arpt_getinfo)) {
-+ duprintf("length %u != %Zu\n", len,
- sizeof(struct arpt_getinfo));
- return -EINVAL;
- }
-@@ -934,6 +934,7 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
- private = &tmp;
- }
- #endif
-+ memset(&info, 0, sizeof(info));
- info.valid_hooks = t->valid_hooks;
- memcpy(info.hook_entry, private->hook_entry,
- sizeof(info.hook_entry));
-@@ -943,7 +944,7 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
- info.size = private->size;
- strcpy(info.name, name);
-
-- if (copy_to_user(user, &info, *len) != 0)
-+ if (copy_to_user(user, &info, len) != 0)
- ret = -EFAULT;
- else
- ret = 0;
-@@ -1702,7 +1703,7 @@ static int compat_do_arpt_get_ctl(struct sock *sk, int cmd, void __user *user,
-
- switch (cmd) {
- case ARPT_SO_GET_INFO:
-- ret = get_info(sock_net(sk), user, len, 1);
-+ ret = get_info(sock_net(sk), user, *len, 1);
- break;
- case ARPT_SO_GET_ENTRIES:
- ret = compat_get_entries(sock_net(sk), user, len);
-@@ -1747,7 +1748,7 @@ static int do_arpt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len
-
- switch (cmd) {
- case ARPT_SO_GET_INFO:
-- ret = get_info(sock_net(sk), user, len, 0);
-+ ret = get_info(sock_net(sk), user, *len, 0);
- break;
-
- case ARPT_SO_GET_ENTRIES:
-diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
-index c156db2..e772975 100644
---- a/net/ipv4/netfilter/ip_queue.c
-+++ b/net/ipv4/netfilter/ip_queue.c
-@@ -286,6 +286,9 @@ ipq_mangle_ipv4(ipq_verdict_msg_t *v, struct nf_queue_entry *e)
-
- if (v->data_len < sizeof(*user_iph))
- return 0;
-+ if (v->data_len > 65535)
-+ return -EMSGSIZE;
-+
- diff = v->data_len - e->skb->len;
- if (diff < 0) {
- if (pskb_trim(e->skb, v->data_len))
-@@ -409,7 +412,8 @@ ipq_dev_drop(int ifindex)
- static inline void
- __ipq_rcv_skb(struct sk_buff *skb)
- {
-- int status, type, pid, flags, nlmsglen, skblen;
-+ int status, type, pid, flags;
-+ unsigned int nlmsglen, skblen;
- struct nlmsghdr *nlh;
-
- skblen = skb->len;
-diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
-index 0606db1..2f32531 100644
---- a/net/ipv4/netfilter/ip_tables.c
-+++ b/net/ipv4/netfilter/ip_tables.c
-@@ -1107,14 +1107,14 @@ static int compat_table_info(const struct xt_table_info *info,
- }
- #endif
-
--static int get_info(struct net *net, void __user *user, int *len, int compat)
-+static int get_info(struct net *net, void __user *user, int len, int compat)
- {
- char name[IPT_TABLE_MAXNAMELEN];
- struct xt_table *t;
- int ret;
-
-- if (*len != sizeof(struct ipt_getinfo)) {
-- duprintf("length %u != %zu\n", *len,
-+ if (len != sizeof(struct ipt_getinfo)) {
-+ duprintf("length %u != %zu\n", len,
- sizeof(struct ipt_getinfo));
- return -EINVAL;
- }
-@@ -1141,6 +1141,7 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
- private = &tmp;
- }
- #endif
-+ memset(&info, 0, sizeof(info));
- info.valid_hooks = t->valid_hooks;
- memcpy(info.hook_entry, private->hook_entry,
- sizeof(info.hook_entry));
-@@ -1150,7 +1151,7 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
- info.size = private->size;
- strcpy(info.name, name);
-
-- if (copy_to_user(user, &info, *len) != 0)
-+ if (copy_to_user(user, &info, len) != 0)
- ret = -EFAULT;
- else
- ret = 0;
-@@ -1979,7 +1980,7 @@ compat_do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
-
- switch (cmd) {
- case IPT_SO_GET_INFO:
-- ret = get_info(sock_net(sk), user, len, 1);
-+ ret = get_info(sock_net(sk), user, *len, 1);
- break;
- case IPT_SO_GET_ENTRIES:
- ret = compat_get_entries(sock_net(sk), user, len);
-@@ -2026,7 +2027,7 @@ do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
-
- switch (cmd) {
- case IPT_SO_GET_INFO:
-- ret = get_info(sock_net(sk), user, len, 0);
-+ ret = get_info(sock_net(sk), user, *len, 0);
- break;
-
- case IPT_SO_GET_ENTRIES:
-diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
-index f25542c..5a0b902 100644
---- a/net/ipv4/proc.c
-+++ b/net/ipv4/proc.c
-@@ -232,7 +232,6 @@ static const struct snmp_mib snmp4_net_list[] = {
- SNMP_MIB_ITEM("TCPDSACKOfoSent", LINUX_MIB_TCPDSACKOFOSENT),
- SNMP_MIB_ITEM("TCPDSACKRecv", LINUX_MIB_TCPDSACKRECV),
- SNMP_MIB_ITEM("TCPDSACKOfoRecv", LINUX_MIB_TCPDSACKOFORECV),
-- SNMP_MIB_ITEM("TCPAbortOnSyn", LINUX_MIB_TCPABORTONSYN),
- SNMP_MIB_ITEM("TCPAbortOnData", LINUX_MIB_TCPABORTONDATA),
- SNMP_MIB_ITEM("TCPAbortOnClose", LINUX_MIB_TCPABORTONCLOSE),
- SNMP_MIB_ITEM("TCPAbortOnMemory", LINUX_MIB_TCPABORTONMEMORY),
-@@ -249,6 +248,8 @@ static const struct snmp_mib snmp4_net_list[] = {
- SNMP_MIB_ITEM("TCPSackShifted", LINUX_MIB_SACKSHIFTED),
- SNMP_MIB_ITEM("TCPSackMerged", LINUX_MIB_SACKMERGED),
- SNMP_MIB_ITEM("TCPSackShiftFallback", LINUX_MIB_SACKSHIFTFALLBACK),
-+ SNMP_MIB_ITEM("TCPChallengeACK", LINUX_MIB_TCPCHALLENGEACK),
-+ SNMP_MIB_ITEM("TCPSYNChallenge", LINUX_MIB_TCPSYNCHALLENGE),
- SNMP_MIB_SENTINEL
- };
-
-diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
-index ab996f9..3da5f96 100644
---- a/net/ipv4/raw.c
-+++ b/net/ipv4/raw.c
-@@ -292,7 +292,7 @@ static int raw_rcv_skb(struct sock * sk, struct sk_buff * skb)
- /* Charge it to the socket. */
-
- if (sock_queue_rcv_skb(sk, skb) < 0) {
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- kfree_skb(skb);
- return NET_RX_DROP;
- }
-@@ -303,7 +303,7 @@ static int raw_rcv_skb(struct sock * sk, struct sk_buff * skb)
- int raw_rcv(struct sock *sk, struct sk_buff *skb)
- {
- if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb)) {
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- kfree_skb(skb);
- return NET_RX_DROP;
- }
-@@ -724,16 +724,23 @@ static int raw_init(struct sock *sk)
-
- static int raw_seticmpfilter(struct sock *sk, char __user *optval, int optlen)
- {
-+ struct icmp_filter filter;
-+
-+ if (optlen < 0)
-+ return -EINVAL;
- if (optlen > sizeof(struct icmp_filter))
- optlen = sizeof(struct icmp_filter);
-- if (copy_from_user(&raw_sk(sk)->filter, optval, optlen))
-+ if (copy_from_user(&filter, optval, optlen))
- return -EFAULT;
-+ raw_sk(sk)->filter = filter;
-+
- return 0;
- }
-
- static int raw_geticmpfilter(struct sock *sk, char __user *optval, int __user *optlen)
- {
- int len, ret = -EFAULT;
-+ struct icmp_filter filter;
-
- if (get_user(len, optlen))
- goto out;
-@@ -743,8 +750,9 @@ static int raw_geticmpfilter(struct sock *sk, char __user *optval, int __user *o
- if (len > sizeof(struct icmp_filter))
- len = sizeof(struct icmp_filter);
- ret = -EFAULT;
-- if (put_user(len, optlen) ||
-- copy_to_user(optval, &raw_sk(sk)->filter, len))
-+ filter = raw_sk(sk)->filter;
-+ if (put_user(len, optlen) || len > sizeof filter ||
-+ copy_to_user(optval, &filter, len))
- goto out;
- ret = 0;
- out: return ret;
-@@ -954,7 +962,13 @@ static void raw_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
- sk_wmem_alloc_get(sp),
- sk_rmem_alloc_get(sp),
- 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
-- atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
-+ atomic_read(&sp->sk_refcnt),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
-+ sp,
-+#endif
-+ atomic_read_unchecked(&sp->sk_drops));
- }
-
- static int raw_seq_show(struct seq_file *seq, void *v)
-diff --git a/net/ipv4/route.c b/net/ipv4/route.c
-index 58f141b..b759702 100644
---- a/net/ipv4/route.c
-+++ b/net/ipv4/route.c
-@@ -269,7 +269,7 @@ static inline unsigned int rt_hash(__be32 daddr, __be32 saddr, int idx,
-
- static inline int rt_genid(struct net *net)
- {
-- return atomic_read(&net->ipv4.rt_genid);
-+ return atomic_read_unchecked(&net->ipv4.rt_genid);
- }
-
- #ifdef CONFIG_PROC_FS
-@@ -889,7 +889,7 @@ static void rt_cache_invalidate(struct net *net)
- unsigned char shuffle;
-
- get_random_bytes(&shuffle, sizeof(shuffle));
-- atomic_add(shuffle + 1U, &net->ipv4.rt_genid);
-+ atomic_add_unchecked(shuffle + 1U, &net->ipv4.rt_genid);
- }
-
- /*
-@@ -3357,7 +3357,7 @@ static __net_initdata struct pernet_operations sysctl_route_ops = {
-
- static __net_init int rt_secret_timer_init(struct net *net)
- {
-- atomic_set(&net->ipv4.rt_genid,
-+ atomic_set_unchecked(&net->ipv4.rt_genid,
- (int) ((num_physpages ^ (num_physpages>>8)) ^
- (jiffies ^ (jiffies >> 7))));
-
-diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
-index 2dcf04d..4656638 100644
---- a/net/ipv4/sysctl_net_ipv4.c
-+++ b/net/ipv4/sysctl_net_ipv4.c
-@@ -638,6 +638,13 @@ static struct ctl_table ipv4_table[] = {
- .mode = 0644,
- .proc_handler = proc_dointvec
- },
-+ {
-+ .procname = "tcp_challenge_ack_limit",
-+ .data = &sysctl_tcp_challenge_ack_limit,
-+ .maxlen = sizeof(int),
-+ .mode = 0644,
-+ .proc_handler = proc_dointvec
-+ },
- #ifdef CONFIG_NET_DMA
- {
- .ctl_name = NET_TCP_DMA_COPYBREAK,
-diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
-index b9644d8..537313b 100644
---- a/net/ipv4/tcp.c
-+++ b/net/ipv4/tcp.c
-@@ -2084,6 +2084,8 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
- int val;
- int err = 0;
-
-+ pax_track_stack();
-+
- /* This is a string value all the others are int's */
- if (optname == TCP_CONGESTION) {
- char name[TCP_CA_NAME_MAX];
-@@ -2354,6 +2356,8 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
- struct tcp_sock *tp = tcp_sk(sk);
- int val, len;
-
-+ pax_track_stack();
-+
- if (get_user(len, optlen))
- return -EFAULT;
-
-diff --git a/net/ipv4/tcp_illinois.c b/net/ipv4/tcp_illinois.c
-index 1eba160b..c35d91f 100644
---- a/net/ipv4/tcp_illinois.c
-+++ b/net/ipv4/tcp_illinois.c
-@@ -313,11 +313,13 @@ static void tcp_illinois_info(struct sock *sk, u32 ext,
- .tcpv_rttcnt = ca->cnt_rtt,
- .tcpv_minrtt = ca->base_rtt,
- };
-- u64 t = ca->sum_rtt;
-
-- do_div(t, ca->cnt_rtt);
-- info.tcpv_rtt = t;
-+ if (info.tcpv_rttcnt > 0) {
-+ u64 t = ca->sum_rtt;
-
-+ do_div(t, info.tcpv_rttcnt);
-+ info.tcpv_rtt = t;
-+ }
- nla_put(skb, INET_DIAG_VEGASINFO, sizeof(info), &info);
- }
- }
-diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
-index db755c4..07d671b 100644
---- a/net/ipv4/tcp_input.c
-+++ b/net/ipv4/tcp_input.c
-@@ -82,6 +82,9 @@ int sysctl_tcp_dsack __read_mostly = 1;
- int sysctl_tcp_app_win __read_mostly = 31;
- int sysctl_tcp_adv_win_scale __read_mostly = 2;
-
-+/* rfc5961 challenge ack rate limiting */
-+int sysctl_tcp_challenge_ack_limit = 100;
-+
- int sysctl_tcp_stdurg __read_mostly;
- int sysctl_tcp_rfc1337 __read_mostly;
- int sysctl_tcp_max_orphans __read_mostly = NR_FILE;
-@@ -3564,6 +3567,24 @@ static int tcp_process_frto(struct sock *sk, int flag)
- return 0;
- }
-
-+/* RFC 5961 7 [ACK Throttling] */
-+static void tcp_send_challenge_ack(struct sock *sk)
-+{
-+ /* unprotected vars, we dont care of overwrites */
-+ static u32 challenge_timestamp;
-+ static unsigned int challenge_count;
-+ u32 now = jiffies / HZ;
-+
-+ if (now != challenge_timestamp) {
-+ challenge_timestamp = now;
-+ challenge_count = 0;
-+ }
-+ if (++challenge_count <= sysctl_tcp_challenge_ack_limit) {
-+ NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPCHALLENGEACK);
-+ tcp_send_ack(sk);
-+ }
-+}
-+
- /* This routine deals with incoming acks, but not outgoing ones. */
- static int tcp_ack(struct sock *sk, struct sk_buff *skb, int flag)
- {
-@@ -3580,8 +3601,14 @@ static int tcp_ack(struct sock *sk, struct sk_buff *skb, int flag)
- /* If the ack is older than previous acks
- * then we can probably ignore it.
- */
-- if (before(ack, prior_snd_una))
-+ if (before(ack, prior_snd_una)) {
-+ /* RFC 5961 5.2 [Blind Data Injection Attack].[Mitigation] */
-+ if (before(ack, prior_snd_una - tp->max_window)) {
-+ tcp_send_challenge_ack(sk);
-+ return -1;
-+ }
- goto old_ack;
-+ }
-
- /* If the ack includes data we haven't sent yet, discard
- * this segment (RFC793 Section 3.9).
-@@ -4528,7 +4555,7 @@ static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb,
- * simplifies code)
- */
- static void
--tcp_collapse(struct sock *sk, struct sk_buff_head *list,
-+__intentional_overflow(5,6) tcp_collapse(struct sock *sk, struct sk_buff_head *list,
- struct sk_buff *head, struct sk_buff *tail,
- u32 start, u32 end)
- {
-@@ -5069,8 +5096,8 @@ out:
- /* Does PAWS and seqno based validation of an incoming segment, flags will
- * play significant role here.
- */
--static int tcp_validate_incoming(struct sock *sk, struct sk_buff *skb,
-- struct tcphdr *th, int syn_inerr)
-+static bool tcp_validate_incoming(struct sock *sk, struct sk_buff *skb,
-+ const struct tcphdr *th, int syn_inerr)
- {
- struct tcp_sock *tp = tcp_sk(sk);
-
-@@ -5093,38 +5120,48 @@ static int tcp_validate_incoming(struct sock *sk, struct sk_buff *skb,
- * an acknowledgment should be sent in reply (unless the RST
- * bit is set, if so drop the segment and return)".
- */
-- if (!th->rst)
-+ if (!th->rst) {
-+ if (th->syn)
-+ goto syn_challenge;
- tcp_send_dupack(sk, skb);
-+ }
- goto discard;
- }
-
- /* Step 2: check RST bit */
- if (th->rst) {
-- tcp_reset(sk);
-+ /* RFC 5961 3.2 :
-+ * If sequence number exactly matches RCV.NXT, then
-+ * RESET the connection
-+ * else
-+ * Send a challenge ACK
-+ */
-+ if (TCP_SKB_CB(skb)->seq == tp->rcv_nxt)
-+ tcp_reset(sk);
-+ else
-+ tcp_send_challenge_ack(sk);
- goto discard;
- }
-
-- /* ts_recent update must be made after we are sure that the packet
-- * is in window.
-- */
-- tcp_replace_ts_recent(tp, TCP_SKB_CB(skb)->seq);
--
- /* step 3: check security and precedence [ignored] */
-
-- /* step 4: Check for a SYN in window. */
-- if (th->syn && !before(TCP_SKB_CB(skb)->seq, tp->rcv_nxt)) {
-+ /* step 4: Check for a SYN
-+ * RFC 5691 4.2 : Send a challenge ack
-+ */
-+ if (th->syn) {
-+syn_challenge:
- if (syn_inerr)
- TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
-- NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPABORTONSYN);
-- tcp_reset(sk);
-- return -1;
-+ NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPSYNCHALLENGE);
-+ tcp_send_challenge_ack(sk);
-+ goto discard;
- }
-
-- return 1;
-+ return true;
-
- discard:
- __kfree_skb(skb);
-- return 0;
-+ return false;
- }
-
- /*
-@@ -5154,7 +5191,6 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
- struct tcphdr *th, unsigned len)
- {
- struct tcp_sock *tp = tcp_sk(sk);
-- int res;
-
- /*
- * Header prediction.
-@@ -5330,18 +5366,25 @@ slow_path:
- if (len < (th->doff << 2) || tcp_checksum_complete_user(sk, skb))
- goto csum_error;
-
-+ if (!th->ack)
-+ goto discard;
-+
- /*
- * Standard slow path.
- */
-
-- res = tcp_validate_incoming(sk, skb, th, 1);
-- if (res <= 0)
-- return -res;
-+ if (!tcp_validate_incoming(sk, skb, th, 1))
-+ return 0;
-
- step5:
-- if (th->ack && tcp_ack(sk, skb, FLAG_SLOWPATH) < 0)
-+ if (tcp_ack(sk, skb, FLAG_SLOWPATH) < 0)
- goto discard;
-
-+ /* ts_recent update must be made after we are sure that the packet
-+ * is in window.
-+ */
-+ tcp_replace_ts_recent(tp, TCP_SKB_CB(skb)->seq);
-+
- tcp_rcv_rtt_measure_ts(sk, skb);
-
- /* Process urgent data. */
-@@ -5542,6 +5585,7 @@ discard:
- tcp_paws_reject(&tp->rx_opt, 0))
- goto discard_and_undo;
-
-+#ifndef CONFIG_GRKERNSEC_NO_SIMULT_CONNECT
- if (th->syn) {
- /* We see SYN without ACK. It is attempt of
- * simultaneous connect with crossed SYNs.
-@@ -5590,6 +5634,7 @@ discard:
- goto discard;
- #endif
- }
-+#endif
- /* "fifth, if neither of the SYN or RST bits is set then
- * drop the segment and return."
- */
-@@ -5618,7 +5663,6 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
- struct tcp_sock *tp = tcp_sk(sk);
- struct inet_connection_sock *icsk = inet_csk(sk);
- int queued = 0;
-- int res;
-
- tp->rx_opt.saw_tstamp = 0;
-
-@@ -5634,7 +5678,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
- goto discard;
-
- if (th->syn) {
-- if (th->fin)
-+ if (th->fin || th->urg || th->psh)
- goto discard;
- if (icsk->icsk_af_ops->conn_request(sk, skb) < 0)
- return 1;
-@@ -5673,12 +5717,14 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
- return 0;
- }
-
-- res = tcp_validate_incoming(sk, skb, th, 0);
-- if (res <= 0)
-- return -res;
-+ if (!th->ack)
-+ goto discard;
-+
-+ if (!tcp_validate_incoming(sk, skb, th, 0))
-+ return 0;
-
- /* step 5: check the ACK field */
-- if (th->ack) {
-+ if (true) {
- int acceptable = tcp_ack(sk, skb, FLAG_SLOWPATH) > 0;
-
- switch (sk->sk_state) {
-@@ -5789,8 +5835,12 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
- }
- break;
- }
-- } else
-- goto discard;
-+ }
-+
-+ /* ts_recent update must be made after we are sure that the packet
-+ * is in window.
-+ */
-+ tcp_replace_ts_recent(tp, TCP_SKB_CB(skb)->seq);
-
- /* step 6: check the URG bit */
- tcp_urg(sk, skb, th);
-diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
-index 6a4e832..7eb316b 100644
---- a/net/ipv4/tcp_ipv4.c
-+++ b/net/ipv4/tcp_ipv4.c
-@@ -85,6 +85,9 @@
- int sysctl_tcp_tw_reuse __read_mostly;
- int sysctl_tcp_low_latency __read_mostly;
-
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+extern int grsec_enable_blackhole;
-+#endif
-
- #ifdef CONFIG_TCP_MD5SIG
- static struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk,
-@@ -1541,6 +1544,9 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
- return 0;
-
- reset:
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ if (!grsec_enable_blackhole)
-+#endif
- tcp_v4_send_reset(rsk, skb);
- discard:
- kfree_skb(skb);
-@@ -1602,12 +1608,20 @@ int tcp_v4_rcv(struct sk_buff *skb)
- TCP_SKB_CB(skb)->sacked = 0;
-
- sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
-- if (!sk)
-+ if (!sk) {
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ ret = 1;
-+#endif
- goto no_tcp_socket;
-+ }
-
- process:
-- if (sk->sk_state == TCP_TIME_WAIT)
-+ if (sk->sk_state == TCP_TIME_WAIT) {
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ ret = 2;
-+#endif
- goto do_time_wait;
-+ }
-
- if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
- goto discard_and_relse;
-@@ -1649,6 +1663,10 @@ no_tcp_socket:
- bad_packet:
- TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
- } else {
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ if (!grsec_enable_blackhole || (ret == 1 &&
-+ (skb->dev->flags & IFF_LOOPBACK)))
-+#endif
- tcp_v4_send_reset(NULL, skb);
- }
-
-@@ -2236,7 +2254,11 @@ static void get_openreq4(struct sock *sk, struct request_sock *req,
- 0, /* non standard timer */
- 0, /* open_requests have no inode */
- atomic_read(&sk->sk_refcnt),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
- req,
-+#endif
- len);
- }
-
-@@ -2278,7 +2300,12 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
- sock_i_uid(sk),
- icsk->icsk_probes_out,
- sock_i_ino(sk),
-- atomic_read(&sk->sk_refcnt), sk,
-+ atomic_read(&sk->sk_refcnt),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
-+ sk,
-+#endif
- jiffies_to_clock_t(icsk->icsk_rto),
- jiffies_to_clock_t(icsk->icsk_ack.ato),
- (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
-@@ -2306,7 +2333,13 @@ static void get_timewait4_sock(struct inet_timewait_sock *tw,
- " %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p%n",
- i, src, srcp, dest, destp, tw->tw_substate, 0, 0,
- 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
-- atomic_read(&tw->tw_refcnt), tw, len);
-+ atomic_read(&tw->tw_refcnt),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
-+ tw,
-+#endif
-+ len);
- }
-
- #define TMPSZ 150
-diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
-index 4c03598..e09a8e8 100644
---- a/net/ipv4/tcp_minisocks.c
-+++ b/net/ipv4/tcp_minisocks.c
-@@ -26,6 +26,10 @@
- #include <net/inet_common.h>
- #include <net/xfrm.h>
-
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+extern int grsec_enable_blackhole;
-+#endif
-+
- #ifdef CONFIG_SYSCTL
- #define SYNC_INIT 0 /* let the user enable it */
- #else
-@@ -672,6 +676,10 @@ listen_overflow:
-
- embryonic_reset:
- NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
-+
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ if (!grsec_enable_blackhole)
-+#endif
- if (!(flg & TCP_FLAG_RST))
- req->rsk_ops->send_reset(sk, skb);
-
-diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
-index af83bdf..ec91cb2 100644
---- a/net/ipv4/tcp_output.c
-+++ b/net/ipv4/tcp_output.c
-@@ -2234,6 +2234,8 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
- __u8 *md5_hash_location;
- int mss;
-
-+ pax_track_stack();
-+
- skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15, 1, GFP_ATOMIC);
- if (skb == NULL)
- return NULL;
-diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
-index 59f5b5e..193860f 100644
---- a/net/ipv4/tcp_probe.c
-+++ b/net/ipv4/tcp_probe.c
-@@ -200,7 +200,7 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf,
- if (cnt + width >= len)
- break;
-
-- if (copy_to_user(buf + cnt, tbuf, width))
-+ if (width > sizeof tbuf || copy_to_user(buf + cnt, tbuf, width))
- return -EFAULT;
- cnt += width;
- }
-diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
-index 57d5501..a9ed13a 100644
---- a/net/ipv4/tcp_timer.c
-+++ b/net/ipv4/tcp_timer.c
-@@ -21,6 +21,10 @@
- #include <linux/module.h>
- #include <net/tcp.h>
-
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+extern int grsec_lastack_retries;
-+#endif
-+
- int sysctl_tcp_syn_retries __read_mostly = TCP_SYN_RETRIES;
- int sysctl_tcp_synack_retries __read_mostly = TCP_SYNACK_RETRIES;
- int sysctl_tcp_keepalive_time __read_mostly = TCP_KEEPALIVE_TIME;
-@@ -164,6 +168,13 @@ static int tcp_write_timeout(struct sock *sk)
- }
- }
-
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ if ((sk->sk_state == TCP_LAST_ACK) &&
-+ (grsec_lastack_retries > 0) &&
-+ (grsec_lastack_retries < retry_until))
-+ retry_until = grsec_lastack_retries;
-+#endif
-+
- if (retransmits_timed_out(sk, retry_until)) {
- /* Has it gone just too far? */
- tcp_write_err(sk);
-diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
-index 8e28770..72105c8 100644
---- a/net/ipv4/udp.c
-+++ b/net/ipv4/udp.c
-@@ -86,6 +86,7 @@
- #include <linux/types.h>
- #include <linux/fcntl.h>
- #include <linux/module.h>
-+#include <linux/security.h>
- #include <linux/socket.h>
- #include <linux/sockios.h>
- #include <linux/igmp.h>
-@@ -106,6 +107,10 @@
- #include <net/xfrm.h>
- #include "udp_impl.h"
-
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+extern int grsec_enable_blackhole;
-+#endif
-+
- struct udp_table udp_table;
- EXPORT_SYMBOL(udp_table);
-
-@@ -371,6 +376,9 @@ found:
- return s;
- }
-
-+extern int gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb);
-+extern int gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr);
-+
- /*
- * This routine is called by the ICMP module when it gets some
- * sort of error condition. If err < 0 then the socket should
-@@ -639,9 +647,18 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
- dport = usin->sin_port;
- if (dport == 0)
- return -EINVAL;
-+
-+ err = gr_search_udp_sendmsg(sk, usin);
-+ if (err)
-+ return err;
- } else {
- if (sk->sk_state != TCP_ESTABLISHED)
- return -EDESTADDRREQ;
-+
-+ err = gr_search_udp_sendmsg(sk, NULL);
-+ if (err)
-+ return err;
-+
- daddr = inet->daddr;
- dport = inet->dport;
- /* Open fast path for connected socket.
-@@ -945,6 +962,10 @@ try_again:
- if (!skb)
- goto out;
-
-+ err = gr_search_udp_recvmsg(sk, skb);
-+ if (err)
-+ goto out_free;
-+
- ulen = skb->len - sizeof(struct udphdr);
- copied = len;
- if (copied > ulen)
-@@ -1068,7 +1089,7 @@ static int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
- if (rc == -ENOMEM) {
- UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
- is_udplite);
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- }
- goto drop;
- }
-@@ -1338,6 +1359,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
- goto csum_error;
-
- UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
-+#endif
- icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
-
- /*
-@@ -1758,8 +1782,13 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
- sk_wmem_alloc_get(sp),
- sk_rmem_alloc_get(sp),
- 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
-- atomic_read(&sp->sk_refcnt), sp,
-- atomic_read(&sp->sk_drops), len);
-+ atomic_read(&sp->sk_refcnt),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
-+ sp,
-+#endif
-+ atomic_read_unchecked(&sp->sk_drops), len);
- }
-
- int udp4_seq_show(struct seq_file *seq, void *v)
-diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
-index 8ac3d09..fc58c5f 100644
---- a/net/ipv6/addrconf.c
-+++ b/net/ipv6/addrconf.c
-@@ -2053,7 +2053,7 @@ int addrconf_set_dstaddr(struct net *net, void __user *arg)
- p.iph.ihl = 5;
- p.iph.protocol = IPPROTO_IPV6;
- p.iph.ttl = 64;
-- ifr.ifr_ifru.ifru_data = (__force void __user *)&p;
-+ ifr.ifr_ifru.ifru_data = (void __force_user *)&p;
-
- if (ops->ndo_do_ioctl) {
- mm_segment_t oldfs = get_fs();
-diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
-index af597c7..a3c5697 100644
---- a/net/ipv6/esp6.c
-+++ b/net/ipv6/esp6.c
-@@ -146,7 +146,6 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
- struct esp_data *esp = x->data;
-
- /* skb is pure payload to encrypt */
-- err = -ENOMEM;
-
- /* Round to block size */
- clen = skb->len;
-@@ -164,8 +163,10 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
- nfrags = err;
-
- tmp = esp_alloc_tmp(aead, nfrags + 1);
-- if (!tmp)
-+ if (!tmp) {
-+ err = -ENOMEM;
- goto error;
-+ }
-
- iv = esp_tmp_iv(aead, tmp);
- req = esp_tmp_givreq(aead, iv);
-diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
-index cc4797d..7cfdfcc 100644
---- a/net/ipv6/inet6_connection_sock.c
-+++ b/net/ipv6/inet6_connection_sock.c
-@@ -152,7 +152,7 @@ void __inet6_csk_dst_store(struct sock *sk, struct dst_entry *dst,
- #ifdef CONFIG_XFRM
- {
- struct rt6_info *rt = (struct rt6_info *)dst;
-- rt->rt6i_flow_cache_genid = atomic_read(&flow_cache_genid);
-+ rt->rt6i_flow_cache_genid = atomic_read_unchecked(&flow_cache_genid);
- }
- #endif
- }
-@@ -167,7 +167,7 @@ struct dst_entry *__inet6_csk_dst_check(struct sock *sk, u32 cookie)
- #ifdef CONFIG_XFRM
- if (dst) {
- struct rt6_info *rt = (struct rt6_info *)dst;
-- if (rt->rt6i_flow_cache_genid != atomic_read(&flow_cache_genid)) {
-+ if (rt->rt6i_flow_cache_genid != atomic_read_unchecked(&flow_cache_genid)) {
- sk->sk_dst_cache = NULL;
- dst_release(dst);
- dst = NULL;
-diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
-index 093e9b2..f72cddb 100644
---- a/net/ipv6/inet6_hashtables.c
-+++ b/net/ipv6/inet6_hashtables.c
-@@ -119,7 +119,7 @@ out:
- }
- EXPORT_SYMBOL(__inet6_lookup_established);
-
--static int inline compute_score(struct sock *sk, struct net *net,
-+static inline int compute_score(struct sock *sk, struct net *net,
- const unsigned short hnum,
- const struct in6_addr *daddr,
- const int dif)
-diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
-index 4f7aaf6..f7acf45 100644
---- a/net/ipv6/ipv6_sockglue.c
-+++ b/net/ipv6/ipv6_sockglue.c
-@@ -130,6 +130,8 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
- int val, valbool;
- int retv = -ENOPROTOOPT;
-
-+ pax_track_stack();
-+
- if (optval == NULL)
- val=0;
- else {
-@@ -881,6 +883,8 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
- int len;
- int val;
-
-+ pax_track_stack();
-+
- if (ip6_mroute_opt(optname))
- return ip6_mroute_getsockopt(sk, optname, optval, optlen);
-
-@@ -922,7 +926,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
- if (sk->sk_type != SOCK_STREAM)
- return -ENOPROTOOPT;
-
-- msg.msg_control = optval;
-+ msg.msg_control = (void __force_kernel *)optval;
- msg.msg_controllen = len;
- msg.msg_flags = 0;
-
-diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
-index 1cf3f0c..1d4376f 100644
---- a/net/ipv6/netfilter/ip6_queue.c
-+++ b/net/ipv6/netfilter/ip6_queue.c
-@@ -287,6 +287,9 @@ ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct nf_queue_entry *e)
-
- if (v->data_len < sizeof(*user_iph))
- return 0;
-+ if (v->data_len > 65535)
-+ return -EMSGSIZE;
-+
- diff = v->data_len - e->skb->len;
- if (diff < 0) {
- if (pskb_trim(e->skb, v->data_len))
-@@ -411,7 +414,8 @@ ipq_dev_drop(int ifindex)
- static inline void
- __ipq_rcv_skb(struct sk_buff *skb)
- {
-- int status, type, pid, flags, nlmsglen, skblen;
-+ int status, type, pid, flags;
-+ unsigned int nlmsglen, skblen;
- struct nlmsghdr *nlh;
-
- skblen = skb->len;
-diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
-index 78b5a36..4a6941c 100644
---- a/net/ipv6/netfilter/ip6_tables.c
-+++ b/net/ipv6/netfilter/ip6_tables.c
-@@ -1139,14 +1139,14 @@ static int compat_table_info(const struct xt_table_info *info,
- }
- #endif
-
--static int get_info(struct net *net, void __user *user, int *len, int compat)
-+static int get_info(struct net *net, void __user *user, int len, int compat)
- {
- char name[IP6T_TABLE_MAXNAMELEN];
- struct xt_table *t;
- int ret;
-
-- if (*len != sizeof(struct ip6t_getinfo)) {
-- duprintf("length %u != %zu\n", *len,
-+ if (len != sizeof(struct ip6t_getinfo)) {
-+ duprintf("length %u != %zu\n", len,
- sizeof(struct ip6t_getinfo));
- return -EINVAL;
- }
-@@ -1173,6 +1173,7 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
- private = &tmp;
- }
- #endif
-+ memset(&info, 0, sizeof(info));
- info.valid_hooks = t->valid_hooks;
- memcpy(info.hook_entry, private->hook_entry,
- sizeof(info.hook_entry));
-@@ -1182,7 +1183,7 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
- info.size = private->size;
- strcpy(info.name, name);
-
-- if (copy_to_user(user, &info, *len) != 0)
-+ if (copy_to_user(user, &info, len) != 0)
- ret = -EFAULT;
- else
- ret = 0;
-@@ -2014,7 +2015,7 @@ compat_do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
-
- switch (cmd) {
- case IP6T_SO_GET_INFO:
-- ret = get_info(sock_net(sk), user, len, 1);
-+ ret = get_info(sock_net(sk), user, *len, 1);
- break;
- case IP6T_SO_GET_ENTRIES:
- ret = compat_get_entries(sock_net(sk), user, len);
-@@ -2061,7 +2062,7 @@ do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
-
- switch (cmd) {
- case IP6T_SO_GET_INFO:
-- ret = get_info(sock_net(sk), user, len, 0);
-+ ret = get_info(sock_net(sk), user, *len, 0);
- break;
-
- case IP6T_SO_GET_ENTRIES:
-diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
-index 4f24570..b813b34 100644
---- a/net/ipv6/raw.c
-+++ b/net/ipv6/raw.c
-@@ -375,14 +375,14 @@ static inline int rawv6_rcv_skb(struct sock * sk, struct sk_buff * skb)
- {
- if ((raw6_sk(sk)->checksum || sk->sk_filter) &&
- skb_checksum_complete(skb)) {
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- kfree_skb(skb);
- return NET_RX_DROP;
- }
-
- /* Charge it to the socket. */
- if (sock_queue_rcv_skb(sk,skb)<0) {
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- kfree_skb(skb);
- return NET_RX_DROP;
- }
-@@ -403,7 +403,7 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
- struct raw6_sock *rp = raw6_sk(sk);
-
- if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) {
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- kfree_skb(skb);
- return NET_RX_DROP;
- }
-@@ -427,7 +427,7 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
-
- if (inet->hdrincl) {
- if (skb_checksum_complete(skb)) {
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- kfree_skb(skb);
- return NET_RX_DROP;
- }
-@@ -518,7 +518,7 @@ csum_copy_err:
- as some normal condition.
- */
- err = (flags&MSG_DONTWAIT) ? -EAGAIN : -EHOSTUNREACH;
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- goto out;
- }
-
-@@ -600,7 +600,7 @@ out:
- return err;
- }
-
--static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
-+static int rawv6_send_hdrinc(struct sock *sk, void *from, unsigned int length,
- struct flowi *fl, struct rt6_info *rt,
- unsigned int flags)
- {
-@@ -738,6 +738,8 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
- u16 proto;
- int err;
-
-+ pax_track_stack();
-+
- /* Rough check on arithmetic overflow,
- better check is made in ip6_append_data().
- */
-@@ -916,12 +918,17 @@ do_confirm:
- static int rawv6_seticmpfilter(struct sock *sk, int level, int optname,
- char __user *optval, int optlen)
- {
-+ struct icmp6_filter filter;
-+
- switch (optname) {
- case ICMPV6_FILTER:
-+ if (optlen < 0)
-+ return -EINVAL;
- if (optlen > sizeof(struct icmp6_filter))
- optlen = sizeof(struct icmp6_filter);
-- if (copy_from_user(&raw6_sk(sk)->filter, optval, optlen))
-+ if (copy_from_user(&filter, optval, optlen))
- return -EFAULT;
-+ raw6_sk(sk)->filter = filter;
- return 0;
- default:
- return -ENOPROTOOPT;
-@@ -934,6 +941,7 @@ static int rawv6_geticmpfilter(struct sock *sk, int level, int optname,
- char __user *optval, int __user *optlen)
- {
- int len;
-+ struct icmp6_filter filter;
-
- switch (optname) {
- case ICMPV6_FILTER:
-@@ -945,7 +953,8 @@ static int rawv6_geticmpfilter(struct sock *sk, int level, int optname,
- len = sizeof(struct icmp6_filter);
- if (put_user(len, optlen))
- return -EFAULT;
-- if (copy_to_user(optval, &raw6_sk(sk)->filter, len))
-+ filter = raw6_sk(sk)->filter;
-+ if (len > sizeof filter || copy_to_user(optval, &filter, len))
- return -EFAULT;
- return 0;
- default:
-@@ -1241,7 +1250,13 @@ static void raw6_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
- 0, 0L, 0,
- sock_i_uid(sp), 0,
- sock_i_ino(sp),
-- atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
-+ atomic_read(&sp->sk_refcnt),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
-+ sp,
-+#endif
-+ atomic_read_unchecked(&sp->sk_drops));
- }
-
- static int raw6_seq_show(struct seq_file *seq, void *v)
-diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
-index faae6df..d4430c1 100644
---- a/net/ipv6/tcp_ipv6.c
-+++ b/net/ipv6/tcp_ipv6.c
-@@ -89,6 +89,10 @@ static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
- }
- #endif
-
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+extern int grsec_enable_blackhole;
-+#endif
-+
- static void tcp_v6_hash(struct sock *sk)
- {
- if (sk->sk_state != TCP_CLOSE) {
-@@ -1579,6 +1583,9 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
- return 0;
-
- reset:
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ if (!grsec_enable_blackhole)
-+#endif
- tcp_v6_send_reset(sk, skb);
- discard:
- if (opt_skb)
-@@ -1656,12 +1663,20 @@ static int tcp_v6_rcv(struct sk_buff *skb)
- TCP_SKB_CB(skb)->sacked = 0;
-
- sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
-- if (!sk)
-+ if (!sk) {
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ ret = 1;
-+#endif
- goto no_tcp_socket;
-+ }
-
- process:
-- if (sk->sk_state == TCP_TIME_WAIT)
-+ if (sk->sk_state == TCP_TIME_WAIT) {
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ ret = 2;
-+#endif
- goto do_time_wait;
-+ }
-
- if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
- goto discard_and_relse;
-@@ -1701,6 +1716,10 @@ no_tcp_socket:
- bad_packet:
- TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
- } else {
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ if (!grsec_enable_blackhole || (ret == 1 &&
-+ (skb->dev->flags & IFF_LOOPBACK)))
-+#endif
- tcp_v6_send_reset(NULL, skb);
- }
-
-@@ -1916,7 +1935,13 @@ static void get_openreq6(struct seq_file *seq,
- uid,
- 0, /* non standard timer */
- 0, /* open_requests have no inode */
-- 0, req);
-+ 0,
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL
-+#else
-+ req
-+#endif
-+ );
- }
-
- static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
-@@ -1966,7 +1991,12 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
- sock_i_uid(sp),
- icsk->icsk_probes_out,
- sock_i_ino(sp),
-- atomic_read(&sp->sk_refcnt), sp,
-+ atomic_read(&sp->sk_refcnt),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
-+ sp,
-+#endif
- jiffies_to_clock_t(icsk->icsk_rto),
- jiffies_to_clock_t(icsk->icsk_ack.ato),
- (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
-@@ -2001,7 +2031,13 @@ static void get_timewait6_sock(struct seq_file *seq,
- dest->s6_addr32[2], dest->s6_addr32[3], destp,
- tw->tw_substate, 0, 0,
- 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
-- atomic_read(&tw->tw_refcnt), tw);
-+ atomic_read(&tw->tw_refcnt),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL
-+#else
-+ tw
-+#endif
-+ );
- }
-
- static int tcp6_seq_show(struct seq_file *seq, void *v)
-diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
-index 9cc6289..052c521 100644
---- a/net/ipv6/udp.c
-+++ b/net/ipv6/udp.c
-@@ -49,6 +49,10 @@
- #include <linux/seq_file.h>
- #include "udp_impl.h"
-
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+extern int grsec_enable_blackhole;
-+#endif
-+
- int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
- {
- const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr;
-@@ -391,7 +395,7 @@ int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
- if (rc == -ENOMEM) {
- UDP6_INC_STATS_BH(sock_net(sk),
- UDP_MIB_RCVBUFERRORS, is_udplite);
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- }
- goto drop;
- }
-@@ -590,6 +594,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
- UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
- proto == IPPROTO_UDPLITE);
-
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
-+#endif
- icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0, dev);
-
- kfree_skb(skb);
-@@ -1209,8 +1216,13 @@ static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket
- 0, 0L, 0,
- sock_i_uid(sp), 0,
- sock_i_ino(sp),
-- atomic_read(&sp->sk_refcnt), sp,
-- atomic_read(&sp->sk_drops));
-+ atomic_read(&sp->sk_refcnt),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
-+ sp,
-+#endif
-+ atomic_read_unchecked(&sp->sk_drops));
- }
-
- int udp6_seq_show(struct seq_file *seq, void *v)
-diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
-index 48bb1e3..5980e6e 100644
---- a/net/ipv6/xfrm6_tunnel.c
-+++ b/net/ipv6/xfrm6_tunnel.c
-@@ -258,7 +258,7 @@ static int xfrm6_tunnel_rcv(struct sk_buff *skb)
- __be32 spi;
-
- spi = xfrm6_tunnel_spi_lookup((xfrm_address_t *)&iph->saddr);
-- return xfrm6_rcv_spi(skb, IPPROTO_IPV6, spi) > 0 ? : 0;
-+ return xfrm6_rcv_spi(skb, IPPROTO_IPV6, spi);
- }
-
- static int xfrm6_tunnel_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
-diff --git a/net/irda/ircomm/ircomm_tty.c b/net/irda/ircomm/ircomm_tty.c
-index 811984d..11f59b7 100644
---- a/net/irda/ircomm/ircomm_tty.c
-+++ b/net/irda/ircomm/ircomm_tty.c
-@@ -280,16 +280,16 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
- add_wait_queue(&self->open_wait, &wait);
-
- IRDA_DEBUG(2, "%s(%d):block_til_ready before block on %s open_count=%d\n",
-- __FILE__,__LINE__, tty->driver->name, self->open_count );
-+ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
-
- /* As far as I can see, we protect open_count - Jean II */
- spin_lock_irqsave(&self->spinlock, flags);
- if (!tty_hung_up_p(filp)) {
- extra_count = 1;
-- self->open_count--;
-+ local_dec(&self->open_count);
- }
- spin_unlock_irqrestore(&self->spinlock, flags);
-- self->blocked_open++;
-+ local_inc(&self->blocked_open);
-
- while (1) {
- if (tty->termios->c_cflag & CBAUD) {
-@@ -329,7 +329,7 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
- }
-
- IRDA_DEBUG(1, "%s(%d):block_til_ready blocking on %s open_count=%d\n",
-- __FILE__,__LINE__, tty->driver->name, self->open_count );
-+ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
-
- schedule();
- }
-@@ -340,13 +340,13 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
- if (extra_count) {
- /* ++ is not atomic, so this should be protected - Jean II */
- spin_lock_irqsave(&self->spinlock, flags);
-- self->open_count++;
-+ local_inc(&self->open_count);
- spin_unlock_irqrestore(&self->spinlock, flags);
- }
-- self->blocked_open--;
-+ local_dec(&self->blocked_open);
-
- IRDA_DEBUG(1, "%s(%d):block_til_ready after blocking on %s open_count=%d\n",
-- __FILE__,__LINE__, tty->driver->name, self->open_count);
-+ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count));
-
- if (!retval)
- self->flags |= ASYNC_NORMAL_ACTIVE;
-@@ -415,14 +415,14 @@ static int ircomm_tty_open(struct tty_struct *tty, struct file *filp)
- }
- /* ++ is not atomic, so this should be protected - Jean II */
- spin_lock_irqsave(&self->spinlock, flags);
-- self->open_count++;
-+ local_inc(&self->open_count);
-
- tty->driver_data = self;
- self->tty = tty;
- spin_unlock_irqrestore(&self->spinlock, flags);
-
- IRDA_DEBUG(1, "%s(), %s%d, count = %d\n", __func__ , tty->driver->name,
-- self->line, self->open_count);
-+ self->line, local_read(&self->open_count));
-
- /* Not really used by us, but lets do it anyway */
- self->tty->low_latency = (self->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
-@@ -511,7 +511,7 @@ static void ircomm_tty_close(struct tty_struct *tty, struct file *filp)
- return;
- }
-
-- if ((tty->count == 1) && (self->open_count != 1)) {
-+ if ((tty->count == 1) && (local_read(&self->open_count) != 1)) {
- /*
- * Uh, oh. tty->count is 1, which means that the tty
- * structure will be freed. state->count should always
-@@ -521,16 +521,16 @@ static void ircomm_tty_close(struct tty_struct *tty, struct file *filp)
- */
- IRDA_DEBUG(0, "%s(), bad serial port count; "
- "tty->count is 1, state->count is %d\n", __func__ ,
-- self->open_count);
-- self->open_count = 1;
-+ local_read(&self->open_count));
-+ local_set(&self->open_count, 1);
- }
-
-- if (--self->open_count < 0) {
-+ if (local_dec_return(&self->open_count) < 0) {
- IRDA_ERROR("%s(), bad serial port count for ttys%d: %d\n",
-- __func__, self->line, self->open_count);
-- self->open_count = 0;
-+ __func__, self->line, local_read(&self->open_count));
-+ local_set(&self->open_count, 0);
- }
-- if (self->open_count) {
-+ if (local_read(&self->open_count)) {
- spin_unlock_irqrestore(&self->spinlock, flags);
-
- IRDA_DEBUG(0, "%s(), open count > 0\n", __func__ );
-@@ -562,7 +562,7 @@ static void ircomm_tty_close(struct tty_struct *tty, struct file *filp)
- tty->closing = 0;
- self->tty = NULL;
-
-- if (self->blocked_open) {
-+ if (local_read(&self->blocked_open)) {
- if (self->close_delay)
- schedule_timeout_interruptible(self->close_delay);
- wake_up_interruptible(&self->open_wait);
-@@ -1017,7 +1017,7 @@ static void ircomm_tty_hangup(struct tty_struct *tty)
- spin_lock_irqsave(&self->spinlock, flags);
- self->flags &= ~ASYNC_NORMAL_ACTIVE;
- self->tty = NULL;
-- self->open_count = 0;
-+ local_set(&self->open_count, 0);
- spin_unlock_irqrestore(&self->spinlock, flags);
-
- wake_up_interruptible(&self->open_wait);
-@@ -1369,7 +1369,7 @@ static void ircomm_tty_line_info(struct ircomm_tty_cb *self, struct seq_file *m)
- seq_putc(m, '\n');
-
- seq_printf(m, "Role: %s\n", self->client ? "client" : "server");
-- seq_printf(m, "Open count: %d\n", self->open_count);
-+ seq_printf(m, "Open count: %d\n", local_read(&self->open_count));
- seq_printf(m, "Max data size: %d\n", self->max_data_size);
- seq_printf(m, "Max header size: %d\n", self->max_header_size);
-
-diff --git a/net/irda/irttp.c b/net/irda/irttp.c
-index 9cb79f9..d35d057 100644
---- a/net/irda/irttp.c
-+++ b/net/irda/irttp.c
-@@ -439,6 +439,7 @@ struct tsap_cb *irttp_open_tsap(__u8 stsap_sel, int credit, notify_t *notify)
- lsap = irlmp_open_lsap(stsap_sel, &ttp_notify, 0);
- if (lsap == NULL) {
- IRDA_WARNING("%s: unable to allocate LSAP!!\n", __func__);
-+ __irttp_close_tsap(self);
- return NULL;
- }
-
-diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
-index bada1b9..f325943 100644
---- a/net/iucv/af_iucv.c
-+++ b/net/iucv/af_iucv.c
-@@ -651,10 +651,10 @@ static int iucv_sock_autobind(struct sock *sk)
-
- write_lock_bh(&iucv_sk_list.lock);
-
-- sprintf(name, "%08x", atomic_inc_return(&iucv_sk_list.autobind_name));
-+ sprintf(name, "%08x", atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
- while (__iucv_get_sock_by_name(name)) {
- sprintf(name, "%08x",
-- atomic_inc_return(&iucv_sk_list.autobind_name));
-+ atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
- }
-
- write_unlock_bh(&iucv_sk_list.lock);
-diff --git a/net/key/af_key.c b/net/key/af_key.c
-index 4e98193..439b449 100644
---- a/net/key/af_key.c
-+++ b/net/key/af_key.c
-@@ -2489,6 +2489,8 @@ static int pfkey_migrate(struct sock *sk, struct sk_buff *skb,
- struct xfrm_migrate m[XFRM_MAX_DEPTH];
- struct xfrm_kmaddress k;
-
-+ pax_track_stack();
-+
- if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC - 1],
- ext_hdrs[SADB_EXT_ADDRESS_DST - 1]) ||
- !ext_hdrs[SADB_X_EXT_POLICY - 1]) {
-@@ -3660,7 +3662,11 @@ static int pfkey_seq_show(struct seq_file *f, void *v)
- seq_printf(f ,"sk RefCnt Rmem Wmem User Inode\n");
- else
- seq_printf(f ,"%p %-6d %-6u %-6u %-6u %-6lu\n",
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
- s,
-+#endif
- atomic_read(&s->sk_refcnt),
- sk_rmem_alloc_get(s),
- sk_wmem_alloc_get(s),
-diff --git a/net/lapb/lapb_iface.c b/net/lapb/lapb_iface.c
-index bda96d1..c038b72 100644
---- a/net/lapb/lapb_iface.c
-+++ b/net/lapb/lapb_iface.c
-@@ -157,7 +157,7 @@ int lapb_register(struct net_device *dev, struct lapb_register_struct *callbacks
- goto out;
-
- lapb->dev = dev;
-- lapb->callbacks = *callbacks;
-+ lapb->callbacks = callbacks;
-
- __lapb_insert_cb(lapb);
-
-@@ -379,32 +379,32 @@ int lapb_data_received(struct net_device *dev, struct sk_buff *skb)
-
- void lapb_connect_confirmation(struct lapb_cb *lapb, int reason)
- {
-- if (lapb->callbacks.connect_confirmation)
-- lapb->callbacks.connect_confirmation(lapb->dev, reason);
-+ if (lapb->callbacks->connect_confirmation)
-+ lapb->callbacks->connect_confirmation(lapb->dev, reason);
- }
-
- void lapb_connect_indication(struct lapb_cb *lapb, int reason)
- {
-- if (lapb->callbacks.connect_indication)
-- lapb->callbacks.connect_indication(lapb->dev, reason);
-+ if (lapb->callbacks->connect_indication)
-+ lapb->callbacks->connect_indication(lapb->dev, reason);
- }
-
- void lapb_disconnect_confirmation(struct lapb_cb *lapb, int reason)
- {
-- if (lapb->callbacks.disconnect_confirmation)
-- lapb->callbacks.disconnect_confirmation(lapb->dev, reason);
-+ if (lapb->callbacks->disconnect_confirmation)
-+ lapb->callbacks->disconnect_confirmation(lapb->dev, reason);
- }
-
- void lapb_disconnect_indication(struct lapb_cb *lapb, int reason)
- {
-- if (lapb->callbacks.disconnect_indication)
-- lapb->callbacks.disconnect_indication(lapb->dev, reason);
-+ if (lapb->callbacks->disconnect_indication)
-+ lapb->callbacks->disconnect_indication(lapb->dev, reason);
- }
-
- int lapb_data_indication(struct lapb_cb *lapb, struct sk_buff *skb)
- {
-- if (lapb->callbacks.data_indication)
-- return lapb->callbacks.data_indication(lapb->dev, skb);
-+ if (lapb->callbacks->data_indication)
-+ return lapb->callbacks->data_indication(lapb->dev, skb);
-
- kfree_skb(skb);
- return NET_RX_SUCCESS; /* For now; must be != NET_RX_DROP */
-@@ -414,8 +414,8 @@ int lapb_data_transmit(struct lapb_cb *lapb, struct sk_buff *skb)
- {
- int used = 0;
-
-- if (lapb->callbacks.data_transmit) {
-- lapb->callbacks.data_transmit(lapb->dev, skb);
-+ if (lapb->callbacks->data_transmit) {
-+ lapb->callbacks->data_transmit(lapb->dev, skb);
- used = 1;
- }
-
-diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
-index 2da8d14..606b6ad 100644
---- a/net/llc/af_llc.c
-+++ b/net/llc/af_llc.c
-@@ -912,14 +912,13 @@ static int llc_ui_getname(struct socket *sock, struct sockaddr *uaddr,
- struct sockaddr_llc sllc;
- struct sock *sk = sock->sk;
- struct llc_sock *llc = llc_sk(sk);
-- int rc = 0;
-+ int rc = -EBADF;
-
- memset(&sllc, 0, sizeof(sllc));
- lock_sock(sk);
- if (sock_flag(sk, SOCK_ZAPPED))
- goto out;
- *uaddrlen = sizeof(sllc);
-- memset(uaddr, 0, *uaddrlen);
- if (peer) {
- rc = -ENOTCONN;
- if (sk->sk_state != TCP_ESTABLISHED)
-diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
-index fe2d3f8..e57f683 100644
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -1369,7 +1369,7 @@ static int ieee80211_set_bitrate_mask(struct wiphy *wiphy,
- return err;
- }
-
--struct cfg80211_ops mac80211_config_ops = {
-+const struct cfg80211_ops mac80211_config_ops = {
- .add_virtual_intf = ieee80211_add_iface,
- .del_virtual_intf = ieee80211_del_iface,
- .change_virtual_intf = ieee80211_change_iface,
-diff --git a/net/mac80211/cfg.h b/net/mac80211/cfg.h
-index 7d7879f..2d51f62 100644
---- a/net/mac80211/cfg.h
-+++ b/net/mac80211/cfg.h
-@@ -4,6 +4,6 @@
- #ifndef __CFG_H
- #define __CFG_H
-
--extern struct cfg80211_ops mac80211_config_ops;
-+extern const struct cfg80211_ops mac80211_config_ops;
-
- #endif /* __CFG_H */
-diff --git a/net/mac80211/debugfs_key.c b/net/mac80211/debugfs_key.c
-index 99c7525..9cb4937 100644
---- a/net/mac80211/debugfs_key.c
-+++ b/net/mac80211/debugfs_key.c
-@@ -211,9 +211,13 @@ static ssize_t key_key_read(struct file *file, char __user *userbuf,
- size_t count, loff_t *ppos)
- {
- struct ieee80211_key *key = file->private_data;
-- int i, res, bufsize = 2 * key->conf.keylen + 2;
-+ int i, bufsize = 2 * key->conf.keylen + 2;
- char *buf = kmalloc(bufsize, GFP_KERNEL);
- char *p = buf;
-+ ssize_t res;
-+
-+ if (buf == NULL)
-+ return -ENOMEM;
-
- for (i = 0; i < key->conf.keylen; i++)
- p += scnprintf(p, bufsize + buf - p, "%02x", key->conf.key[i]);
-diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
-index 33a2e89..08650c8 100644
---- a/net/mac80211/debugfs_sta.c
-+++ b/net/mac80211/debugfs_sta.c
-@@ -124,6 +124,8 @@ static ssize_t sta_agg_status_read(struct file *file, char __user *userbuf,
- int i;
- struct sta_info *sta = file->private_data;
-
-+ pax_track_stack();
-+
- spin_lock_bh(&sta->lock);
- p += scnprintf(p, sizeof(buf)+buf-p, "next dialog_token is %#02x\n",
- sta->ampdu_mlme.dialog_token_allocator + 1);
-diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
-index ca62bfe..6657a03 100644
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -25,6 +25,7 @@
- #include <linux/etherdevice.h>
- #include <net/cfg80211.h>
- #include <net/mac80211.h>
-+#include <asm/local.h>
- #include "key.h"
- #include "sta_info.h"
-
-@@ -635,7 +636,7 @@ struct ieee80211_local {
- /* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
- spinlock_t queue_stop_reason_lock;
-
-- int open_count;
-+ local_t open_count;
- int monitors, cooked_mntrs;
- /* number of interfaces with corresponding FIF_ flags */
- int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll;
-diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
-index 079c500..eb3c6d4 100644
---- a/net/mac80211/iface.c
-+++ b/net/mac80211/iface.c
-@@ -166,7 +166,7 @@ static int ieee80211_open(struct net_device *dev)
- break;
- }
-
-- if (local->open_count == 0) {
-+ if (local_read(&local->open_count) == 0) {
- res = drv_start(local);
- if (res)
- goto err_del_bss;
-@@ -196,7 +196,7 @@ static int ieee80211_open(struct net_device *dev)
- * Validate the MAC address for this device.
- */
- if (!is_valid_ether_addr(dev->dev_addr)) {
-- if (!local->open_count)
-+ if (!local_read(&local->open_count))
- drv_stop(local);
- return -EADDRNOTAVAIL;
- }
-@@ -292,7 +292,7 @@ static int ieee80211_open(struct net_device *dev)
-
- hw_reconf_flags |= __ieee80211_recalc_idle(local);
-
-- local->open_count++;
-+ local_inc(&local->open_count);
- if (hw_reconf_flags) {
- ieee80211_hw_config(local, hw_reconf_flags);
- /*
-@@ -320,7 +320,7 @@ static int ieee80211_open(struct net_device *dev)
- err_del_interface:
- drv_remove_interface(local, &conf);
- err_stop:
-- if (!local->open_count)
-+ if (!local_read(&local->open_count))
- drv_stop(local);
- err_del_bss:
- sdata->bss = NULL;
-@@ -420,7 +420,7 @@ static int ieee80211_stop(struct net_device *dev)
- WARN_ON(!list_empty(&sdata->u.ap.vlans));
- }
-
-- local->open_count--;
-+ local_dec(&local->open_count);
-
- switch (sdata->vif.type) {
- case NL80211_IFTYPE_AP_VLAN:
-@@ -526,7 +526,7 @@ static int ieee80211_stop(struct net_device *dev)
-
- ieee80211_recalc_ps(local, -1);
-
-- if (local->open_count == 0) {
-+ if (local_read(&local->open_count) == 0) {
- ieee80211_clear_tx_pending(local);
- ieee80211_stop_device(local);
-
-diff --git a/net/mac80211/main.c b/net/mac80211/main.c
-index 2dfe176..74e4388 100644
---- a/net/mac80211/main.c
-+++ b/net/mac80211/main.c
-@@ -145,7 +145,7 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
- local->hw.conf.power_level = power;
- }
-
-- if (changed && local->open_count) {
-+ if (changed && local_read(&local->open_count)) {
- ret = drv_config(local, changed);
- /*
- * Goal:
-diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
-index e67eea7..fcc227e 100644
---- a/net/mac80211/mlme.c
-+++ b/net/mac80211/mlme.c
-@@ -1438,6 +1438,8 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
- bool have_higher_than_11mbit = false, newsta = false;
- u16 ap_ht_cap_flags;
-
-+ pax_track_stack();
-+
- /*
- * AssocResp and ReassocResp have identical structure, so process both
- * of them in this function.
-diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
-index e535f1c..4d733d1 100644
---- a/net/mac80211/pm.c
-+++ b/net/mac80211/pm.c
-@@ -107,7 +107,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
- }
-
- /* stop hardware - this must stop RX */
-- if (local->open_count)
-+ if (local_read(&local->open_count))
- ieee80211_stop_device(local);
-
- local->suspended = true;
-diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
-index b33efc4..0a2efb6 100644
---- a/net/mac80211/rate.c
-+++ b/net/mac80211/rate.c
-@@ -287,7 +287,7 @@ int ieee80211_init_rate_ctrl_alg(struct ieee80211_local *local,
- struct rate_control_ref *ref, *old;
-
- ASSERT_RTNL();
-- if (local->open_count)
-+ if (local_read(&local->open_count))
- return -EBUSY;
-
- ref = rate_control_alloc(name, local);
-diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
-index b1d7904..57e4da7 100644
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -173,7 +173,7 @@ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr,
- return cpu_to_le16(dur);
- }
-
--static int inline is_ieee80211_device(struct ieee80211_local *local,
-+static inline int is_ieee80211_device(struct ieee80211_local *local,
- struct net_device *dev)
- {
- return local == wdev_priv(dev->ieee80211_ptr);
-diff --git a/net/mac80211/util.c b/net/mac80211/util.c
-index 31b1085..48fb26d 100644
---- a/net/mac80211/util.c
-+++ b/net/mac80211/util.c
-@@ -1042,7 +1042,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
- local->resuming = true;
-
- /* restart hardware */
-- if (local->open_count) {
-+ if (local_read(&local->open_count)) {
- /*
- * Upon resume hardware can sometimes be goofy due to
- * various platform / driver / bus issues, so restarting
-diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
-index 634d14a..b35a608 100644
---- a/net/netfilter/Kconfig
-+++ b/net/netfilter/Kconfig
-@@ -635,6 +635,16 @@ config NETFILTER_XT_MATCH_ESP
-
- To compile it as a module, choose M here. If unsure, say N.
-
-+config NETFILTER_XT_MATCH_GRADM
-+ tristate '"gradm" match support'
-+ depends on NETFILTER_XTABLES && NETFILTER_ADVANCED
-+ depends on GRKERNSEC && !GRKERNSEC_NO_RBAC
-+ ---help---
-+ The gradm match allows to match on grsecurity RBAC being enabled.
-+ It is useful when iptables rules are applied early on bootup to
-+ prevent connections to the machine (except from a trusted host)
-+ while the RBAC system is disabled.
-+
- config NETFILTER_XT_MATCH_HASHLIMIT
- tristate '"hashlimit" match support'
- depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
-diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
-index 49f62ee..a17b2c6 100644
---- a/net/netfilter/Makefile
-+++ b/net/netfilter/Makefile
-@@ -68,6 +68,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_CONNTRACK) += xt_conntrack.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_DCCP) += xt_dccp.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_DSCP) += xt_dscp.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) += xt_esp.o
-+obj-$(CONFIG_NETFILTER_XT_MATCH_GRADM) += xt_gradm.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o
-diff --git a/net/netfilter/ipvs/ip_vs_app.c b/net/netfilter/ipvs/ip_vs_app.c
-index 3c7e427..724043c 100644
---- a/net/netfilter/ipvs/ip_vs_app.c
-+++ b/net/netfilter/ipvs/ip_vs_app.c
-@@ -564,7 +564,7 @@ static const struct file_operations ip_vs_app_fops = {
- .open = ip_vs_app_open,
- .read = seq_read,
- .llseek = seq_lseek,
-- .release = seq_release,
-+ .release = seq_release_net,
- };
- #endif
-
-diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
-index 95682e5..457dbac 100644
---- a/net/netfilter/ipvs/ip_vs_conn.c
-+++ b/net/netfilter/ipvs/ip_vs_conn.c
-@@ -453,10 +453,10 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, struct ip_vs_dest *dest)
- /* if the connection is not template and is created
- * by sync, preserve the activity flag.
- */
-- cp->flags |= atomic_read(&dest->conn_flags) &
-+ cp->flags |= atomic_read_unchecked(&dest->conn_flags) &
- (~IP_VS_CONN_F_INACTIVE);
- else
-- cp->flags |= atomic_read(&dest->conn_flags);
-+ cp->flags |= atomic_read_unchecked(&dest->conn_flags);
- cp->dest = dest;
-
- IP_VS_DBG_BUF(7, "Bind-dest %s c:%s:%d v:%s:%d "
-@@ -723,7 +723,7 @@ ip_vs_conn_new(int af, int proto, const union nf_inet_addr *caddr, __be16 cport,
- atomic_set(&cp->refcnt, 1);
-
- atomic_set(&cp->n_control, 0);
-- atomic_set(&cp->in_pkts, 0);
-+ atomic_set_unchecked(&cp->in_pkts, 0);
-
- atomic_inc(&ip_vs_conn_count);
- if (flags & IP_VS_CONN_F_NO_CPORT)
-@@ -871,7 +871,7 @@ static const struct file_operations ip_vs_conn_fops = {
- .open = ip_vs_conn_open,
- .read = seq_read,
- .llseek = seq_lseek,
-- .release = seq_release,
-+ .release = seq_release_net,
- };
-
- static const char *ip_vs_origin_name(unsigned flags)
-@@ -934,7 +934,7 @@ static const struct file_operations ip_vs_conn_sync_fops = {
- .open = ip_vs_conn_sync_open,
- .read = seq_read,
- .llseek = seq_lseek,
-- .release = seq_release,
-+ .release = seq_release_net,
- };
-
- #endif
-@@ -961,7 +961,7 @@ static inline int todrop_entry(struct ip_vs_conn *cp)
-
- /* Don't drop the entry if its number of incoming packets is not
- located in [0, 8] */
-- i = atomic_read(&cp->in_pkts);
-+ i = atomic_read_unchecked(&cp->in_pkts);
- if (i > 8 || i < 0) return 0;
-
- if (!todrop_rate[i]) return 0;
-diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
-index b95699f..5fee919 100644
---- a/net/netfilter/ipvs/ip_vs_core.c
-+++ b/net/netfilter/ipvs/ip_vs_core.c
-@@ -485,7 +485,7 @@ int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,
- ret = cp->packet_xmit(skb, cp, pp);
- /* do not touch skb anymore */
-
-- atomic_inc(&cp->in_pkts);
-+ atomic_inc_unchecked(&cp->in_pkts);
- ip_vs_conn_put(cp);
- return ret;
- }
-@@ -1357,7 +1357,7 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb,
- * Sync connection if it is about to close to
- * encorage the standby servers to update the connections timeout
- */
-- pkts = atomic_add_return(1, &cp->in_pkts);
-+ pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
- if (af == AF_INET &&
- (ip_vs_sync_state & IP_VS_STATE_MASTER) &&
- (((cp->protocol != IPPROTO_TCP ||
-diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
-index 02b2610..2d89424 100644
---- a/net/netfilter/ipvs/ip_vs_ctl.c
-+++ b/net/netfilter/ipvs/ip_vs_ctl.c
-@@ -792,7 +792,7 @@ __ip_vs_update_dest(struct ip_vs_service *svc,
- ip_vs_rs_hash(dest);
- write_unlock_bh(&__ip_vs_rs_lock);
- }
-- atomic_set(&dest->conn_flags, conn_flags);
-+ atomic_set_unchecked(&dest->conn_flags, conn_flags);
-
- /* bind the service */
- if (!dest->svc) {
-@@ -1888,7 +1888,7 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
- " %-7s %-6d %-10d %-10d\n",
- &dest->addr.in6,
- ntohs(dest->port),
-- ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
-+ ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
- atomic_read(&dest->weight),
- atomic_read(&dest->activeconns),
- atomic_read(&dest->inactconns));
-@@ -1899,7 +1899,7 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
- "%-7s %-6d %-10d %-10d\n",
- ntohl(dest->addr.ip),
- ntohs(dest->port),
-- ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
-+ ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
- atomic_read(&dest->weight),
- atomic_read(&dest->activeconns),
- atomic_read(&dest->inactconns));
-@@ -1927,7 +1927,7 @@ static const struct file_operations ip_vs_info_fops = {
- .open = ip_vs_info_open,
- .read = seq_read,
- .llseek = seq_lseek,
-- .release = seq_release_private,
-+ .release = seq_release_net,
- };
-
- #endif
-@@ -1976,7 +1976,7 @@ static const struct file_operations ip_vs_stats_fops = {
- .open = ip_vs_stats_seq_open,
- .read = seq_read,
- .llseek = seq_lseek,
-- .release = single_release,
-+ .release = single_release_net,
- };
-
- #endif
-@@ -2292,7 +2292,7 @@ __ip_vs_get_dest_entries(const struct ip_vs_get_dests *get,
-
- entry.addr = dest->addr.ip;
- entry.port = dest->port;
-- entry.conn_flags = atomic_read(&dest->conn_flags);
-+ entry.conn_flags = atomic_read_unchecked(&dest->conn_flags);
- entry.weight = atomic_read(&dest->weight);
- entry.u_threshold = dest->u_threshold;
- entry.l_threshold = dest->l_threshold;
-@@ -2353,6 +2353,8 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
- unsigned char arg[128];
- int ret = 0;
-
-+ pax_track_stack();
-+
- if (!capable(CAP_NET_ADMIN))
- return -EPERM;
-
-@@ -2802,7 +2804,7 @@ static int ip_vs_genl_fill_dest(struct sk_buff *skb, struct ip_vs_dest *dest)
- NLA_PUT_U16(skb, IPVS_DEST_ATTR_PORT, dest->port);
-
- NLA_PUT_U32(skb, IPVS_DEST_ATTR_FWD_METHOD,
-- atomic_read(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
-+ atomic_read_unchecked(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
- NLA_PUT_U32(skb, IPVS_DEST_ATTR_WEIGHT, atomic_read(&dest->weight));
- NLA_PUT_U32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold);
- NLA_PUT_U32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold);
-diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
-index e177f0d..55e8581 100644
---- a/net/netfilter/ipvs/ip_vs_sync.c
-+++ b/net/netfilter/ipvs/ip_vs_sync.c
-@@ -438,7 +438,7 @@ static void ip_vs_process_message(const char *buffer, const size_t buflen)
-
- if (opt)
- memcpy(&cp->in_seq, opt, sizeof(*opt));
-- atomic_set(&cp->in_pkts, sysctl_ip_vs_sync_threshold[0]);
-+ atomic_set_unchecked(&cp->in_pkts, sysctl_ip_vs_sync_threshold[0]);
- cp->state = state;
- cp->old_state = cp->state;
- /*
-diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
-index 30b3189..e2e4b55 100644
---- a/net/netfilter/ipvs/ip_vs_xmit.c
-+++ b/net/netfilter/ipvs/ip_vs_xmit.c
-@@ -875,7 +875,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
- else
- rc = NF_ACCEPT;
- /* do not touch skb anymore */
-- atomic_inc(&cp->in_pkts);
-+ atomic_inc_unchecked(&cp->in_pkts);
- goto out;
- }
-
-@@ -949,7 +949,7 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
- else
- rc = NF_ACCEPT;
- /* do not touch skb anymore */
-- atomic_inc(&cp->in_pkts);
-+ atomic_inc_unchecked(&cp->in_pkts);
- goto out;
- }
-
-diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
-index 8df3477..ec49230 100644
---- a/net/netfilter/nf_conntrack_core.c
-+++ b/net/netfilter/nf_conntrack_core.c
-@@ -1298,6 +1298,10 @@ err_proto:
- #define UNCONFIRMED_NULLS_VAL ((1<<30)+0)
- #define DYING_NULLS_VAL ((1<<30)+1)
-
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+static atomic_unchecked_t conntrack_cache_id = ATOMIC_INIT(0);
-+#endif
-+
- static int nf_conntrack_init_net(struct net *net)
- {
- int ret;
-@@ -1311,7 +1315,11 @@ static int nf_conntrack_init_net(struct net *net)
- goto err_stat;
- }
-
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ net->ct.slabname = kasprintf(GFP_KERNEL, "nf_conntrack_%08lx", atomic_inc_return_unchecked(&conntrack_cache_id));
-+#else
- net->ct.slabname = kasprintf(GFP_KERNEL, "nf_conntrack_%p", net);
-+#endif
- if (!net->ct.slabname) {
- ret = -ENOMEM;
- goto err_slabname;
-diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
-index d521718..d0fd7a1 100644
---- a/net/netfilter/nf_conntrack_netlink.c
-+++ b/net/netfilter/nf_conntrack_netlink.c
-@@ -706,7 +706,7 @@ ctnetlink_parse_tuple_proto(struct nlattr *attr,
- static int
- ctnetlink_parse_tuple(const struct nlattr * const cda[],
- struct nf_conntrack_tuple *tuple,
-- enum ctattr_tuple type, u_int8_t l3num)
-+ enum ctattr_type type, u_int8_t l3num)
- {
- struct nlattr *tb[CTA_TUPLE_MAX+1];
- int err;
-diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
-index f900dc3..5e45346 100644
---- a/net/netfilter/nfnetlink_log.c
-+++ b/net/netfilter/nfnetlink_log.c
-@@ -68,7 +68,7 @@ struct nfulnl_instance {
- };
-
- static DEFINE_RWLOCK(instances_lock);
--static atomic_t global_seq;
-+static atomic_unchecked_t global_seq;
-
- #define INSTANCE_BUCKETS 16
- static struct hlist_head instance_table[INSTANCE_BUCKETS];
-@@ -493,7 +493,7 @@ __build_packet_message(struct nfulnl_instance *inst,
- /* global sequence number */
- if (inst->flags & NFULNL_CFG_F_SEQ_GLOBAL)
- NLA_PUT_BE32(inst->skb, NFULA_SEQ_GLOBAL,
-- htonl(atomic_inc_return(&global_seq)));
-+ htonl(atomic_inc_return_unchecked(&global_seq)));
-
- if (data_len) {
- struct nlattr *nla;
-diff --git a/net/netfilter/xt_gradm.c b/net/netfilter/xt_gradm.c
-new file mode 100644
-index 0000000..725bece
---- /dev/null
-+++ b/net/netfilter/xt_gradm.c
-@@ -0,0 +1,51 @@
-+/*
-+ * gradm match for netfilter
-+ * Copyright © Zbigniew Krzystolik, 2010
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License; either version
-+ * 2 or 3 as published by the Free Software Foundation.
-+ */
-+#include <linux/module.h>
-+#include <linux/moduleparam.h>
-+#include <linux/skbuff.h>
-+#include <linux/netfilter/x_tables.h>
-+#include <linux/grsecurity.h>
-+#include <linux/netfilter/xt_gradm.h>
-+
-+static bool
-+gradm_mt(const struct sk_buff *skb, const struct xt_match_param *par)
-+{
-+ const struct xt_gradm_mtinfo *info = par->matchinfo;
-+ bool retval = false;
-+ if (gr_acl_is_enabled())
-+ retval = true;
-+ return retval ^ info->invflags;
-+}
-+
-+static struct xt_match gradm_mt_reg __read_mostly = {
-+ .name = "gradm",
-+ .revision = 0,
-+ .family = NFPROTO_UNSPEC,
-+ .match = gradm_mt,
-+ .matchsize = XT_ALIGN(sizeof(struct xt_gradm_mtinfo)),
-+ .me = THIS_MODULE,
-+};
-+
-+static int __init gradm_mt_init(void)
-+{
-+ return xt_register_match(&gradm_mt_reg);
-+}
-+
-+static void __exit gradm_mt_exit(void)
-+{
-+ xt_unregister_match(&gradm_mt_reg);
-+}
-+
-+module_init(gradm_mt_init);
-+module_exit(gradm_mt_exit);
-+MODULE_AUTHOR("Zbigniew Krzystolik <zbyniu@destrukcja.pl>");
-+MODULE_DESCRIPTION("Xtables: Grsecurity RBAC match");
-+MODULE_LICENSE("GPL");
-+MODULE_ALIAS("ipt_gradm");
-+MODULE_ALIAS("ip6t_gradm");
-diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
-index fc91ff6..2458eea 100644
---- a/net/netlink/af_netlink.c
-+++ b/net/netlink/af_netlink.c
-@@ -733,7 +733,7 @@ static void netlink_overrun(struct sock *sk)
- sk->sk_error_report(sk);
- }
- }
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- }
-
- static struct sock *netlink_getsockbypid(struct sock *ssk, u32 pid)
-@@ -1303,8 +1303,10 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
- return -EINVAL;
- dst_pid = addr->nl_pid;
- dst_group = ffs(addr->nl_groups);
-- if (dst_group && !netlink_capable(sock, NL_NONROOT_SEND))
-- return -EPERM;
-+ err = -EPERM;
-+ if ((dst_group || dst_pid) &&
-+ !netlink_capable(sock, NL_NONROOT_SEND))
-+ goto out;
- } else {
- dst_pid = nlk->dst_pid;
- dst_group = nlk->dst_group;
-@@ -1966,15 +1968,23 @@ static int netlink_seq_show(struct seq_file *seq, void *v)
- struct netlink_sock *nlk = nlk_sk(s);
-
- seq_printf(seq, "%p %-3d %-6d %08x %-8d %-8d %p %-8d %-8d\n",
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
- s,
-+#endif
- s->sk_protocol,
- nlk->pid,
- nlk->groups ? (u32)nlk->groups[0] : 0,
- sk_rmem_alloc_get(s),
- sk_wmem_alloc_get(s),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
- nlk->cb,
-+#endif
- atomic_read(&s->sk_refcnt),
-- atomic_read(&s->sk_drops)
-+ atomic_read_unchecked(&s->sk_drops)
- );
-
- }
-@@ -2060,6 +2070,27 @@ static void __net_exit netlink_net_exit(struct net *net)
- #endif
- }
-
-+static void __init netlink_add_usersock_entry(void)
-+{
-+ unsigned long *listeners;
-+ int groups = 32;
-+
-+ listeners = kzalloc(NLGRPSZ(groups) + sizeof(struct listeners_rcu_head),
-+ GFP_KERNEL);
-+ if (!listeners)
-+ panic("netlink_add_usersock_entry: Cannot allocate listneres\n");
-+
-+ netlink_table_grab();
-+
-+ nl_table[NETLINK_USERSOCK].groups = groups;
-+ nl_table[NETLINK_USERSOCK].listeners = listeners;
-+ nl_table[NETLINK_USERSOCK].module = THIS_MODULE;
-+ nl_table[NETLINK_USERSOCK].registered = 1;
-+ nl_table[NETLINK_USERSOCK].nl_nonroot = NL_NONROOT_SEND;
-+
-+ netlink_table_ungrab();
-+}
-+
- static struct pernet_operations __net_initdata netlink_net_ops = {
- .init = netlink_net_init,
- .exit = netlink_net_exit,
-@@ -2108,6 +2139,8 @@ static int __init netlink_proto_init(void)
- hash->rehash_time = jiffies;
- }
-
-+ netlink_add_usersock_entry();
-+
- sock_register(&netlink_family_ops);
- register_pernet_subsys(&netlink_net_ops);
- /* The netlink device handler may be needed early. */
-diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
-index 7a83495..ab0062f 100644
---- a/net/netrom/af_netrom.c
-+++ b/net/netrom/af_netrom.c
-@@ -838,6 +838,7 @@ static int nr_getname(struct socket *sock, struct sockaddr *uaddr,
- struct sock *sk = sock->sk;
- struct nr_sock *nr = nr_sk(sk);
-
-+ memset(sax, 0, sizeof(*sax));
- lock_sock(sk);
- if (peer != 0) {
- if (sk->sk_state != TCP_ESTABLISHED) {
-@@ -852,7 +853,6 @@ static int nr_getname(struct socket *sock, struct sockaddr *uaddr,
- *uaddr_len = sizeof(struct full_sockaddr_ax25);
- } else {
- sax->fsa_ax25.sax25_family = AF_NETROM;
-- sax->fsa_ax25.sax25_ndigis = 0;
- sax->fsa_ax25.sax25_call = nr->source_addr;
- *uaddr_len = sizeof(struct sockaddr_ax25);
- }
-diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
-index 35cfa79..8ad1123 100644
---- a/net/packet/af_packet.c
-+++ b/net/packet/af_packet.c
-@@ -1724,7 +1724,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
- case PACKET_DROP_MEMBERSHIP:
- {
- struct packet_mreq_max mreq;
-- int len = optlen;
-+ unsigned int len = optlen;
- memset(&mreq, 0, sizeof(mreq));
- if (len < sizeof(struct packet_mreq))
- return -EINVAL;
-@@ -1895,7 +1895,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
- case PACKET_HDRLEN:
- if (len > sizeof(int))
- len = sizeof(int);
-- if (copy_from_user(&val, optval, len))
-+ if (len > sizeof(val) || copy_from_user(&val, optval, len))
- return -EFAULT;
- switch (val) {
- case TPACKET_V1:
-@@ -2429,7 +2429,11 @@ static int packet_seq_show(struct seq_file *seq, void *v)
-
- seq_printf(seq,
- "%p %-6d %-4d %04x %-5d %1d %-6u %-6u %-6lu\n",
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
- s,
-+#endif
- atomic_read(&s->sk_refcnt),
- s->sk_type,
- ntohs(po->num),
-diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
-index 519ff9d..a422a90 100644
---- a/net/phonet/af_phonet.c
-+++ b/net/phonet/af_phonet.c
-@@ -41,7 +41,7 @@ static struct phonet_protocol *phonet_proto_get(int protocol)
- {
- struct phonet_protocol *pp;
-
-- if (protocol >= PHONET_NPROTO)
-+ if (protocol < 0 || protocol >= PHONET_NPROTO)
- return NULL;
-
- spin_lock(&proto_tab_lock);
-@@ -402,7 +402,7 @@ int __init_or_module phonet_proto_register(int protocol,
- {
- int err = 0;
-
-- if (protocol >= PHONET_NPROTO)
-+ if (protocol < 0 || protocol >= PHONET_NPROTO)
- return -EINVAL;
-
- err = proto_register(pp->prot, 1);
-diff --git a/net/phonet/datagram.c b/net/phonet/datagram.c
-index ef5c75c..2b6c2fa 100644
---- a/net/phonet/datagram.c
-+++ b/net/phonet/datagram.c
-@@ -162,7 +162,7 @@ static int pn_backlog_rcv(struct sock *sk, struct sk_buff *skb)
- if (err < 0) {
- kfree_skb(skb);
- if (err == -ENOMEM)
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- }
- return err ? NET_RX_DROP : NET_RX_SUCCESS;
- }
-diff --git a/net/phonet/pep.c b/net/phonet/pep.c
-index 7481d70..6957dbf 100644
---- a/net/phonet/pep.c
-+++ b/net/phonet/pep.c
-@@ -348,7 +348,7 @@ static int pipe_do_rcv(struct sock *sk, struct sk_buff *skb)
-
- case PNS_PEP_CTRL_REQ:
- if (skb_queue_len(&pn->ctrlreq_queue) >= PNPIPE_CTRLREQ_MAX) {
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- break;
- }
- __skb_pull(skb, 4);
-@@ -362,12 +362,12 @@ static int pipe_do_rcv(struct sock *sk, struct sk_buff *skb)
- if (!err)
- return 0;
- if (err == -ENOMEM)
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- break;
- }
-
- if (pn->rx_credits == 0) {
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- err = -ENOBUFS;
- break;
- }
-diff --git a/net/phonet/socket.c b/net/phonet/socket.c
-index aa5b5a9..c09b4f8 100644
---- a/net/phonet/socket.c
-+++ b/net/phonet/socket.c
-@@ -482,8 +482,13 @@ static int pn_sock_seq_show(struct seq_file *seq, void *v)
- sk->sk_state,
- sk_wmem_alloc_get(sk), sk_rmem_alloc_get(sk),
- sock_i_uid(sk), sock_i_ino(sk),
-- atomic_read(&sk->sk_refcnt), sk,
-- atomic_read(&sk->sk_drops), &len);
-+ atomic_read(&sk->sk_refcnt),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
-+ sk,
-+#endif
-+ atomic_read_unchecked(&sk->sk_drops), &len);
- }
- seq_printf(seq, "%*s\n", 127 - len, "");
- return 0;
-diff --git a/net/rds/Kconfig b/net/rds/Kconfig
-index ec753b3..821187c 100644
---- a/net/rds/Kconfig
-+++ b/net/rds/Kconfig
-@@ -1,7 +1,7 @@
-
- config RDS
- tristate "The RDS Protocol (EXPERIMENTAL)"
-- depends on INET && EXPERIMENTAL
-+ depends on INET && EXPERIMENTAL && BROKEN
- ---help---
- The RDS (Reliable Datagram Sockets) protocol provides reliable,
- sequenced delivery of datagrams over Infiniband, iWARP,
-diff --git a/net/rds/cong.c b/net/rds/cong.c
-index dd2711d..1c7ed12 100644
---- a/net/rds/cong.c
-+++ b/net/rds/cong.c
-@@ -77,7 +77,7 @@
- * finds that the saved generation number is smaller than the global generation
- * number, it wakes up the process.
- */
--static atomic_t rds_cong_generation = ATOMIC_INIT(0);
-+static atomic_unchecked_t rds_cong_generation = ATOMIC_INIT(0);
-
- /*
- * Congestion monitoring
-@@ -232,7 +232,7 @@ void rds_cong_map_updated(struct rds_cong_map *map, uint64_t portmask)
- rdsdebug("waking map %p for %pI4\n",
- map, &map->m_addr);
- rds_stats_inc(s_cong_update_received);
-- atomic_inc(&rds_cong_generation);
-+ atomic_inc_unchecked(&rds_cong_generation);
- if (waitqueue_active(&map->m_waitq))
- wake_up(&map->m_waitq);
- if (waitqueue_active(&rds_poll_waitq))
-@@ -258,7 +258,7 @@ EXPORT_SYMBOL_GPL(rds_cong_map_updated);
-
- int rds_cong_updated_since(unsigned long *recent)
- {
-- unsigned long gen = atomic_read(&rds_cong_generation);
-+ unsigned long gen = atomic_read_unchecked(&rds_cong_generation);
-
- if (likely(*recent == gen))
- return 0;
-diff --git a/net/rds/iw_rdma.c b/net/rds/iw_rdma.c
-index de4a1b1..94ec861 100644
---- a/net/rds/iw_rdma.c
-+++ b/net/rds/iw_rdma.c
-@@ -181,6 +181,8 @@ int rds_iw_update_cm_id(struct rds_iw_device *rds_iwdev, struct rdma_cm_id *cm_i
- struct rdma_cm_id *pcm_id;
- int rc;
-
-+ pax_track_stack();
-+
- src_addr = (struct sockaddr_in *)&cm_id->route.addr.src_addr;
- dst_addr = (struct sockaddr_in *)&cm_id->route.addr.dst_addr;
-
-diff --git a/net/rds/recv.c b/net/rds/recv.c
-index 6a2654a..c45a881c 100644
---- a/net/rds/recv.c
-+++ b/net/rds/recv.c
-@@ -410,6 +410,8 @@ int rds_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
-
- rdsdebug("size %zu flags 0x%x timeo %ld\n", size, msg_flags, timeo);
-
-+ msg->msg_namelen = 0;
-+
- if (msg_flags & MSG_OOB)
- goto out;
-
-@@ -486,6 +488,7 @@ int rds_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
- sin->sin_port = inc->i_hdr.h_sport;
- sin->sin_addr.s_addr = inc->i_saddr;
- memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
-+ msg->msg_namelen = sizeof(*sin);
- }
- break;
- }
-diff --git a/net/rds/tcp.c b/net/rds/tcp.c
-index b5198ae..8b9fb90 100644
---- a/net/rds/tcp.c
-+++ b/net/rds/tcp.c
-@@ -57,7 +57,7 @@ void rds_tcp_nonagle(struct socket *sock)
- int val = 1;
-
- set_fs(KERNEL_DS);
-- sock->ops->setsockopt(sock, SOL_TCP, TCP_NODELAY, (char __user *)&val,
-+ sock->ops->setsockopt(sock, SOL_TCP, TCP_NODELAY, (char __force_user *)&val,
- sizeof(val));
- set_fs(oldfs);
- }
-diff --git a/net/rds/tcp_send.c b/net/rds/tcp_send.c
-index ab545e0..4079b3b 100644
---- a/net/rds/tcp_send.c
-+++ b/net/rds/tcp_send.c
-@@ -43,7 +43,7 @@ static void rds_tcp_cork(struct socket *sock, int val)
-
- oldfs = get_fs();
- set_fs(KERNEL_DS);
-- sock->ops->setsockopt(sock, SOL_TCP, TCP_CORK, (char __user *)&val,
-+ sock->ops->setsockopt(sock, SOL_TCP, TCP_CORK, (char __force_user *)&val,
- sizeof(val));
- set_fs(oldfs);
- }
-diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
-index a86afce..8657bce 100644
---- a/net/rxrpc/af_rxrpc.c
-+++ b/net/rxrpc/af_rxrpc.c
-@@ -38,7 +38,7 @@ static const struct proto_ops rxrpc_rpc_ops;
- __be32 rxrpc_epoch;
-
- /* current debugging ID */
--atomic_t rxrpc_debug_id;
-+atomic_unchecked_t rxrpc_debug_id;
-
- /* count of skbs currently in use */
- atomic_t rxrpc_n_skbs;
-diff --git a/net/rxrpc/ar-ack.c b/net/rxrpc/ar-ack.c
-index b4a2209..539106c 100644
---- a/net/rxrpc/ar-ack.c
-+++ b/net/rxrpc/ar-ack.c
-@@ -174,7 +174,7 @@ static void rxrpc_resend(struct rxrpc_call *call)
-
- _enter("{%d,%d,%d,%d},",
- call->acks_hard, call->acks_unacked,
-- atomic_read(&call->sequence),
-+ atomic_read_unchecked(&call->sequence),
- CIRC_CNT(call->acks_head, call->acks_tail, call->acks_winsz));
-
- stop = 0;
-@@ -198,7 +198,7 @@ static void rxrpc_resend(struct rxrpc_call *call)
-
- /* each Tx packet has a new serial number */
- sp->hdr.serial =
-- htonl(atomic_inc_return(&call->conn->serial));
-+ htonl(atomic_inc_return_unchecked(&call->conn->serial));
-
- hdr = (struct rxrpc_header *) txb->head;
- hdr->serial = sp->hdr.serial;
-@@ -401,7 +401,7 @@ static void rxrpc_rotate_tx_window(struct rxrpc_call *call, u32 hard)
- */
- static void rxrpc_clear_tx_window(struct rxrpc_call *call)
- {
-- rxrpc_rotate_tx_window(call, atomic_read(&call->sequence));
-+ rxrpc_rotate_tx_window(call, atomic_read_unchecked(&call->sequence));
- }
-
- /*
-@@ -627,7 +627,7 @@ process_further:
-
- latest = ntohl(sp->hdr.serial);
- hard = ntohl(ack.firstPacket);
-- tx = atomic_read(&call->sequence);
-+ tx = atomic_read_unchecked(&call->sequence);
-
- _proto("Rx ACK %%%u { m=%hu f=#%u p=#%u s=%%%u r=%s n=%u }",
- latest,
-@@ -840,6 +840,8 @@ void rxrpc_process_call(struct work_struct *work)
- u32 abort_code = RX_PROTOCOL_ERROR;
- u8 *acks = NULL;
-
-+ pax_track_stack();
-+
- //printk("\n--------------------\n");
- _enter("{%d,%s,%lx} [%lu]",
- call->debug_id, rxrpc_call_states[call->state], call->events,
-@@ -1159,7 +1161,7 @@ void rxrpc_process_call(struct work_struct *work)
- goto maybe_reschedule;
-
- send_ACK_with_skew:
-- ack.maxSkew = htons(atomic_read(&call->conn->hi_serial) -
-+ ack.maxSkew = htons(atomic_read_unchecked(&call->conn->hi_serial) -
- ntohl(ack.serial));
- send_ACK:
- mtu = call->conn->trans->peer->if_mtu;
-@@ -1171,7 +1173,7 @@ send_ACK:
- ackinfo.rxMTU = htonl(5692);
- ackinfo.jumbo_max = htonl(4);
-
-- hdr.serial = htonl(atomic_inc_return(&call->conn->serial));
-+ hdr.serial = htonl(atomic_inc_return_unchecked(&call->conn->serial));
- _proto("Tx ACK %%%u { m=%hu f=#%u p=#%u s=%%%u r=%s n=%u }",
- ntohl(hdr.serial),
- ntohs(ack.maxSkew),
-@@ -1189,7 +1191,7 @@ send_ACK:
- send_message:
- _debug("send message");
-
-- hdr.serial = htonl(atomic_inc_return(&call->conn->serial));
-+ hdr.serial = htonl(atomic_inc_return_unchecked(&call->conn->serial));
- _proto("Tx %s %%%u", rxrpc_pkts[hdr.type], ntohl(hdr.serial));
- send_message_2:
-
-diff --git a/net/rxrpc/ar-call.c b/net/rxrpc/ar-call.c
-index bc0019f..e1b4b24 100644
---- a/net/rxrpc/ar-call.c
-+++ b/net/rxrpc/ar-call.c
-@@ -82,7 +82,7 @@ static struct rxrpc_call *rxrpc_alloc_call(gfp_t gfp)
- spin_lock_init(&call->lock);
- rwlock_init(&call->state_lock);
- atomic_set(&call->usage, 1);
-- call->debug_id = atomic_inc_return(&rxrpc_debug_id);
-+ call->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
- call->state = RXRPC_CALL_CLIENT_SEND_REQUEST;
-
- memset(&call->sock_node, 0xed, sizeof(call->sock_node));
-diff --git a/net/rxrpc/ar-connection.c b/net/rxrpc/ar-connection.c
-index 9f1ce84..ff8d061 100644
---- a/net/rxrpc/ar-connection.c
-+++ b/net/rxrpc/ar-connection.c
-@@ -205,7 +205,7 @@ static struct rxrpc_connection *rxrpc_alloc_connection(gfp_t gfp)
- rwlock_init(&conn->lock);
- spin_lock_init(&conn->state_lock);
- atomic_set(&conn->usage, 1);
-- conn->debug_id = atomic_inc_return(&rxrpc_debug_id);
-+ conn->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
- conn->avail_calls = RXRPC_MAXCALLS;
- conn->size_align = 4;
- conn->header_size = sizeof(struct rxrpc_header);
-diff --git a/net/rxrpc/ar-connevent.c b/net/rxrpc/ar-connevent.c
-index 0505cdc..f0748ce 100644
---- a/net/rxrpc/ar-connevent.c
-+++ b/net/rxrpc/ar-connevent.c
-@@ -109,7 +109,7 @@ static int rxrpc_abort_connection(struct rxrpc_connection *conn,
-
- len = iov[0].iov_len + iov[1].iov_len;
-
-- hdr.serial = htonl(atomic_inc_return(&conn->serial));
-+ hdr.serial = htonl(atomic_inc_return_unchecked(&conn->serial));
- _proto("Tx CONN ABORT %%%u { %d }", ntohl(hdr.serial), abort_code);
-
- ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 2, len);
-diff --git a/net/rxrpc/ar-input.c b/net/rxrpc/ar-input.c
-index f98c802..9e8488e 100644
---- a/net/rxrpc/ar-input.c
-+++ b/net/rxrpc/ar-input.c
-@@ -339,9 +339,9 @@ void rxrpc_fast_process_packet(struct rxrpc_call *call, struct sk_buff *skb)
- /* track the latest serial number on this connection for ACK packet
- * information */
- serial = ntohl(sp->hdr.serial);
-- hi_serial = atomic_read(&call->conn->hi_serial);
-+ hi_serial = atomic_read_unchecked(&call->conn->hi_serial);
- while (serial > hi_serial)
-- hi_serial = atomic_cmpxchg(&call->conn->hi_serial, hi_serial,
-+ hi_serial = atomic_cmpxchg_unchecked(&call->conn->hi_serial, hi_serial,
- serial);
-
- /* request ACK generation for any ACK or DATA packet that requests
-diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
-index 7043b29..06edcdf 100644
---- a/net/rxrpc/ar-internal.h
-+++ b/net/rxrpc/ar-internal.h
-@@ -272,8 +272,8 @@ struct rxrpc_connection {
- int error; /* error code for local abort */
- int debug_id; /* debug ID for printks */
- unsigned call_counter; /* call ID counter */
-- atomic_t serial; /* packet serial number counter */
-- atomic_t hi_serial; /* highest serial number received */
-+ atomic_unchecked_t serial; /* packet serial number counter */
-+ atomic_unchecked_t hi_serial; /* highest serial number received */
- u8 avail_calls; /* number of calls available */
- u8 size_align; /* data size alignment (for security) */
- u8 header_size; /* rxrpc + security header size */
-@@ -346,7 +346,7 @@ struct rxrpc_call {
- spinlock_t lock;
- rwlock_t state_lock; /* lock for state transition */
- atomic_t usage;
-- atomic_t sequence; /* Tx data packet sequence counter */
-+ atomic_unchecked_t sequence; /* Tx data packet sequence counter */
- u32 abort_code; /* local/remote abort code */
- enum { /* current state of call */
- RXRPC_CALL_CLIENT_SEND_REQUEST, /* - client sending request phase */
-@@ -420,7 +420,7 @@ static inline void rxrpc_abort_call(struct rxrpc_call *call, u32 abort_code)
- */
- extern atomic_t rxrpc_n_skbs;
- extern __be32 rxrpc_epoch;
--extern atomic_t rxrpc_debug_id;
-+extern atomic_unchecked_t rxrpc_debug_id;
- extern struct workqueue_struct *rxrpc_workqueue;
-
- /*
-diff --git a/net/rxrpc/ar-key.c b/net/rxrpc/ar-key.c
-index 74697b2..10f9b77 100644
---- a/net/rxrpc/ar-key.c
-+++ b/net/rxrpc/ar-key.c
-@@ -88,11 +88,11 @@ static int rxrpc_instantiate_xdr_rxkad(struct key *key, const __be32 *xdr,
- return ret;
-
- plen -= sizeof(*token);
-- token = kmalloc(sizeof(*token), GFP_KERNEL);
-+ token = kzalloc(sizeof(*token), GFP_KERNEL);
- if (!token)
- return -ENOMEM;
-
-- token->kad = kmalloc(plen, GFP_KERNEL);
-+ token->kad = kzalloc(plen, GFP_KERNEL);
- if (!token->kad) {
- kfree(token);
- return -ENOMEM;
-@@ -730,10 +730,10 @@ static int rxrpc_instantiate(struct key *key, const void *data, size_t datalen)
- goto error;
-
- ret = -ENOMEM;
-- token = kmalloc(sizeof(*token), GFP_KERNEL);
-+ token = kzalloc(sizeof(*token), GFP_KERNEL);
- if (!token)
- goto error;
-- token->kad = kmalloc(plen, GFP_KERNEL);
-+ token->kad = kzalloc(plen, GFP_KERNEL);
- if (!token->kad)
- goto error_free;
-
-diff --git a/net/rxrpc/ar-local.c b/net/rxrpc/ar-local.c
-index 807535f..5b7f19e 100644
---- a/net/rxrpc/ar-local.c
-+++ b/net/rxrpc/ar-local.c
-@@ -44,7 +44,7 @@ struct rxrpc_local *rxrpc_alloc_local(struct sockaddr_rxrpc *srx)
- spin_lock_init(&local->lock);
- rwlock_init(&local->services_lock);
- atomic_set(&local->usage, 1);
-- local->debug_id = atomic_inc_return(&rxrpc_debug_id);
-+ local->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
- memcpy(&local->srx, srx, sizeof(*srx));
- }
-
-diff --git a/net/rxrpc/ar-output.c b/net/rxrpc/ar-output.c
-index cc9102c..7d3888e 100644
---- a/net/rxrpc/ar-output.c
-+++ b/net/rxrpc/ar-output.c
-@@ -680,9 +680,9 @@ static int rxrpc_send_data(struct kiocb *iocb,
- sp->hdr.cid = call->cid;
- sp->hdr.callNumber = call->call_id;
- sp->hdr.seq =
-- htonl(atomic_inc_return(&call->sequence));
-+ htonl(atomic_inc_return_unchecked(&call->sequence));
- sp->hdr.serial =
-- htonl(atomic_inc_return(&conn->serial));
-+ htonl(atomic_inc_return_unchecked(&conn->serial));
- sp->hdr.type = RXRPC_PACKET_TYPE_DATA;
- sp->hdr.userStatus = 0;
- sp->hdr.securityIndex = conn->security_ix;
-diff --git a/net/rxrpc/ar-peer.c b/net/rxrpc/ar-peer.c
-index edc026c..4bd4e2d 100644
---- a/net/rxrpc/ar-peer.c
-+++ b/net/rxrpc/ar-peer.c
-@@ -86,7 +86,7 @@ static struct rxrpc_peer *rxrpc_alloc_peer(struct sockaddr_rxrpc *srx,
- INIT_LIST_HEAD(&peer->error_targets);
- spin_lock_init(&peer->lock);
- atomic_set(&peer->usage, 1);
-- peer->debug_id = atomic_inc_return(&rxrpc_debug_id);
-+ peer->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
- memcpy(&peer->srx, srx, sizeof(*srx));
-
- rxrpc_assess_MTU_size(peer);
-diff --git a/net/rxrpc/ar-proc.c b/net/rxrpc/ar-proc.c
-index 38047f7..9f48511 100644
---- a/net/rxrpc/ar-proc.c
-+++ b/net/rxrpc/ar-proc.c
-@@ -164,8 +164,8 @@ static int rxrpc_connection_seq_show(struct seq_file *seq, void *v)
- atomic_read(&conn->usage),
- rxrpc_conn_states[conn->state],
- key_serial(conn->key),
-- atomic_read(&conn->serial),
-- atomic_read(&conn->hi_serial));
-+ atomic_read_unchecked(&conn->serial),
-+ atomic_read_unchecked(&conn->hi_serial));
-
- return 0;
- }
-diff --git a/net/rxrpc/ar-transport.c b/net/rxrpc/ar-transport.c
-index 0936e1a..437c640 100644
---- a/net/rxrpc/ar-transport.c
-+++ b/net/rxrpc/ar-transport.c
-@@ -46,7 +46,7 @@ static struct rxrpc_transport *rxrpc_alloc_transport(struct rxrpc_local *local,
- spin_lock_init(&trans->client_lock);
- rwlock_init(&trans->conn_lock);
- atomic_set(&trans->usage, 1);
-- trans->debug_id = atomic_inc_return(&rxrpc_debug_id);
-+ trans->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
-
- if (peer->srx.transport.family == AF_INET) {
- switch (peer->srx.transport_type) {
-diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c
-index 713ac59..306f6ae 100644
---- a/net/rxrpc/rxkad.c
-+++ b/net/rxrpc/rxkad.c
-@@ -210,6 +210,8 @@ static int rxkad_secure_packet_encrypt(const struct rxrpc_call *call,
- u16 check;
- int nsg;
-
-+ pax_track_stack();
-+
- sp = rxrpc_skb(skb);
-
- _enter("");
-@@ -337,6 +339,8 @@ static int rxkad_verify_packet_auth(const struct rxrpc_call *call,
- u16 check;
- int nsg;
-
-+ pax_track_stack();
-+
- _enter("");
-
- sp = rxrpc_skb(skb);
-@@ -609,7 +613,7 @@ static int rxkad_issue_challenge(struct rxrpc_connection *conn)
-
- len = iov[0].iov_len + iov[1].iov_len;
-
-- hdr.serial = htonl(atomic_inc_return(&conn->serial));
-+ hdr.serial = htonl(atomic_inc_return_unchecked(&conn->serial));
- _proto("Tx CHALLENGE %%%u", ntohl(hdr.serial));
-
- ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 2, len);
-@@ -659,7 +663,7 @@ static int rxkad_send_response(struct rxrpc_connection *conn,
-
- len = iov[0].iov_len + iov[1].iov_len + iov[2].iov_len;
-
-- hdr->serial = htonl(atomic_inc_return(&conn->serial));
-+ hdr->serial = htonl(atomic_inc_return_unchecked(&conn->serial));
- _proto("Tx RESPONSE %%%u", ntohl(hdr->serial));
-
- ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 3, len);
-diff --git a/net/sctp/auth.c b/net/sctp/auth.c
-index 914c419..7a16d2c 100644
---- a/net/sctp/auth.c
-+++ b/net/sctp/auth.c
-@@ -81,7 +81,7 @@ static struct sctp_auth_bytes *sctp_auth_create_key(__u32 key_len, gfp_t gfp)
- struct sctp_auth_bytes *key;
-
- /* Verify that we are not going to overflow INT_MAX */
-- if ((INT_MAX - key_len) < sizeof(struct sctp_auth_bytes))
-+ if (key_len > (INT_MAX - sizeof(struct sctp_auth_bytes)))
- return NULL;
-
- /* Allocate the shared key */
-diff --git a/net/sctp/chunk.c b/net/sctp/chunk.c
-index acf7c4d..b29621d 100644
---- a/net/sctp/chunk.c
-+++ b/net/sctp/chunk.c
-@@ -272,7 +272,7 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
- goto errout;
- err = sctp_user_addto_chunk(chunk, offset, len, msgh->msg_iov);
- if (err < 0)
-- goto errout;
-+ goto errout_chunk_free;
-
- offset += len;
-
-@@ -308,7 +308,7 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
- __skb_pull(chunk->skb, (__u8 *)chunk->chunk_hdr
- - (__u8 *)chunk->skb->data);
- if (err < 0)
-- goto errout;
-+ goto errout_chunk_free;
-
- sctp_datamsg_assign(msg, chunk);
- list_add_tail(&chunk->frag_list, &msg->chunks);
-@@ -316,6 +316,9 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
-
- return msg;
-
-+errout_chunk_free:
-+ sctp_chunk_free(chunk);
-+
- errout:
- list_for_each_safe(pos, temp, &msg->chunks) {
- list_del_init(pos);
-diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
-index bb280e6..747720f 100644
---- a/net/sctp/ipv6.c
-+++ b/net/sctp/ipv6.c
-@@ -1013,7 +1013,7 @@ void sctp_v6_pf_init(void)
-
- void sctp_v6_pf_exit(void)
- {
-- list_del(&sctp_af_inet6.list);
-+ pax_list_del((struct list_head *)&sctp_af_inet6.list);
- }
-
- /* Initialize IPv6 support and register with socket layer. */
-diff --git a/net/sctp/proc.c b/net/sctp/proc.c
-index d093cbf..9fc36fc 100644
---- a/net/sctp/proc.c
-+++ b/net/sctp/proc.c
-@@ -213,7 +213,12 @@ static int sctp_eps_seq_show(struct seq_file *seq, void *v)
- sctp_for_each_hentry(epb, node, &head->chain) {
- ep = sctp_ep(epb);
- sk = epb->sk;
-- seq_printf(seq, "%8p %8p %-3d %-3d %-4d %-5d %5d %5lu ", ep, sk,
-+ seq_printf(seq, "%8p %8p %-3d %-3d %-4d %-5d %5d %5lu ",
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL, NULL,
-+#else
-+ ep, sk,
-+#endif
- sctp_sk(sk)->type, sk->sk_state, hash,
- epb->bind_addr.port,
- sock_i_uid(sk), sock_i_ino(sk));
-@@ -320,7 +325,12 @@ static int sctp_assocs_seq_show(struct seq_file *seq, void *v)
- seq_printf(seq,
- "%8p %8p %-3d %-3d %-2d %-4d "
- "%4d %8d %8d %7d %5lu %-5d %5d ",
-- assoc, sk, sctp_sk(sk)->type, sk->sk_state,
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL, NULL,
-+#else
-+ assoc, sk,
-+#endif
-+ sctp_sk(sk)->type, sk->sk_state,
- assoc->state, hash,
- assoc->assoc_id,
- assoc->sndbuf_used,
-diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
-index 619f965..bed845a 100644
---- a/net/sctp/protocol.c
-+++ b/net/sctp/protocol.c
-@@ -727,8 +727,10 @@ int sctp_register_af(struct sctp_af *af)
- return 0;
- }
-
-- INIT_LIST_HEAD(&af->list);
-- list_add_tail(&af->list, &sctp_address_families);
-+ pax_open_kernel();
-+ INIT_LIST_HEAD((struct list_head *)&af->list);
-+ pax_close_kernel();
-+ pax_list_add_tail((struct list_head *)&af->list, &sctp_address_families);
- return 1;
- }
-
-@@ -1015,7 +1017,7 @@ static void sctp_v4_pf_init(void)
-
- static void sctp_v4_pf_exit(void)
- {
-- list_del(&sctp_af_inet.list);
-+ pax_list_del((struct list_head *)&sctp_af_inet.list);
- }
-
- static int sctp_v4_protosw_init(void)
-diff --git a/net/sctp/socket.c b/net/sctp/socket.c
-index 1f9843e..9cd0edd 100644
---- a/net/sctp/socket.c
-+++ b/net/sctp/socket.c
-@@ -5810,7 +5810,6 @@ pp_found:
- */
- int reuse = sk->sk_reuse;
- struct sock *sk2;
-- struct hlist_node *node;
-
- SCTP_DEBUG_PRINTK("sctp_get_port() found a possible match\n");
- if (pp->fastreuse && sk->sk_reuse &&
-diff --git a/net/sctp/transport.c b/net/sctp/transport.c
-index e04c9f8..51bc18e 100644
---- a/net/sctp/transport.c
-+++ b/net/sctp/transport.c
-@@ -355,7 +355,7 @@ void sctp_transport_update_rto(struct sctp_transport *tp, __u32 rtt)
- * 1/8, rto_alpha would be expressed as 3.
- */
- tp->rttvar = tp->rttvar - (tp->rttvar >> sctp_rto_beta)
-- + ((abs(tp->srtt - rtt)) >> sctp_rto_beta);
-+ + (((__u32)abs64((__s64)tp->srtt - (__s64)rtt)) >> sctp_rto_beta);
- tp->srtt = tp->srtt - (tp->srtt >> sctp_rto_alpha)
- + (rtt >> sctp_rto_alpha);
- } else {
-diff --git a/net/socket.c b/net/socket.c
-index d449812..4ac08d3c 100644
---- a/net/socket.c
-+++ b/net/socket.c
-@@ -87,6 +87,7 @@
- #include <linux/wireless.h>
- #include <linux/nsproxy.h>
- #include <linux/magic.h>
-+#include <linux/in.h>
-
- #include <asm/uaccess.h>
- #include <asm/unistd.h>
-@@ -97,6 +98,21 @@
- #include <net/sock.h>
- #include <linux/netfilter.h>
-
-+extern void gr_attach_curr_ip(const struct sock *sk);
-+extern int gr_handle_sock_all(const int family, const int type,
-+ const int protocol);
-+extern int gr_handle_sock_server(const struct sockaddr *sck);
-+extern int gr_handle_sock_server_other(const struct sock *sck);
-+extern int gr_handle_sock_client(const struct sockaddr *sck);
-+extern int gr_search_connect(struct socket * sock,
-+ struct sockaddr_in * addr);
-+extern int gr_search_bind(struct socket * sock,
-+ struct sockaddr_in * addr);
-+extern int gr_search_listen(struct socket * sock);
-+extern int gr_search_accept(struct socket * sock);
-+extern int gr_search_socket(const int domain, const int type,
-+ const int protocol);
-+
- static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
- static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
- unsigned long nr_segs, loff_t pos);
-@@ -298,7 +314,7 @@ static int sockfs_get_sb(struct file_system_type *fs_type,
- mnt);
- }
-
--static struct vfsmount *sock_mnt __read_mostly;
-+struct vfsmount *sock_mnt __read_mostly;
-
- static struct file_system_type sock_fs_type = {
- .name = "sockfs",
-@@ -1154,6 +1170,8 @@ static int __sock_create(struct net *net, int family, int type, int protocol,
- return -EAFNOSUPPORT;
- if (type < 0 || type >= SOCK_MAX)
- return -EINVAL;
-+ if (protocol < 0)
-+ return -EINVAL;
-
- /* Compatibility.
-
-@@ -1283,6 +1301,16 @@ SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
- if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
- flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
-
-+ if(!gr_search_socket(family, type, protocol)) {
-+ retval = -EACCES;
-+ goto out;
-+ }
-+
-+ if (gr_handle_sock_all(family, type, protocol)) {
-+ retval = -EACCES;
-+ goto out;
-+ }
-+
- retval = sock_create(family, type, protocol, &sock);
- if (retval < 0)
- goto out;
-@@ -1415,6 +1443,14 @@ SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
- if (sock) {
- err = move_addr_to_kernel(umyaddr, addrlen, (struct sockaddr *)&address);
- if (err >= 0) {
-+ if (gr_handle_sock_server((struct sockaddr *)&address)) {
-+ err = -EACCES;
-+ goto error;
-+ }
-+ err = gr_search_bind(sock, (struct sockaddr_in *)&address);
-+ if (err)
-+ goto error;
-+
- err = security_socket_bind(sock,
- (struct sockaddr *)&address,
- addrlen);
-@@ -1423,6 +1459,7 @@ SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
- (struct sockaddr *)
- &address, addrlen);
- }
-+error:
- fput_light(sock->file, fput_needed);
- }
- return err;
-@@ -1446,10 +1483,20 @@ SYSCALL_DEFINE2(listen, int, fd, int, backlog)
- if ((unsigned)backlog > somaxconn)
- backlog = somaxconn;
-
-+ if (gr_handle_sock_server_other(sock->sk)) {
-+ err = -EPERM;
-+ goto error;
-+ }
-+
-+ err = gr_search_listen(sock);
-+ if (err)
-+ goto error;
-+
- err = security_socket_listen(sock, backlog);
- if (!err)
- err = sock->ops->listen(sock, backlog);
-
-+error:
- fput_light(sock->file, fput_needed);
- }
- return err;
-@@ -1492,6 +1539,18 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
- newsock->type = sock->type;
- newsock->ops = sock->ops;
-
-+ if (gr_handle_sock_server_other(sock->sk)) {
-+ err = -EPERM;
-+ sock_release(newsock);
-+ goto out_put;
-+ }
-+
-+ err = gr_search_accept(sock);
-+ if (err) {
-+ sock_release(newsock);
-+ goto out_put;
-+ }
-+
- /*
- * We don't need try_module_get here, as the listening socket (sock)
- * has the protocol module (sock->ops->owner) held.
-@@ -1534,6 +1593,8 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
- fd_install(newfd, newfile);
- err = newfd;
-
-+ gr_attach_curr_ip(newsock->sk);
-+
- out_put:
- fput_light(sock->file, fput_needed);
- out:
-@@ -1571,6 +1632,7 @@ SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
- int, addrlen)
- {
- struct socket *sock;
-+ struct sockaddr *sck;
- struct sockaddr_storage address;
- int err, fput_needed;
-
-@@ -1581,6 +1643,17 @@ SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
- if (err < 0)
- goto out_put;
-
-+ sck = (struct sockaddr *)&address;
-+
-+ if (gr_handle_sock_client(sck)) {
-+ err = -EACCES;
-+ goto out_put;
-+ }
-+
-+ err = gr_search_connect(sock, (struct sockaddr_in *)sck);
-+ if (err)
-+ goto out_put;
-+
- err =
- security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
- if (err)
-@@ -1882,6 +1955,8 @@ SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned, flags)
- int err, ctl_len, iov_size, total_len;
- int fput_needed;
-
-+ pax_track_stack();
-+
- err = -EFAULT;
- if (MSG_CMSG_COMPAT & flags) {
- if (get_compat_msghdr(&msg_sys, msg_compat))
-@@ -2022,7 +2097,7 @@ SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
- * kernel msghdr to use the kernel address space)
- */
-
-- uaddr = (__force void __user *)msg_sys.msg_name;
-+ uaddr = (void __force_user *)msg_sys.msg_name;
- uaddr_len = COMPAT_NAMELEN(msg);
- if (MSG_CMSG_COMPAT & flags) {
- err = verify_compat_iovec(&msg_sys, iov,
-diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
-index 9b3941d..d80b670 100644
---- a/net/sunrpc/sched.c
-+++ b/net/sunrpc/sched.c
-@@ -234,10 +234,10 @@ static int rpc_wait_bit_killable(void *word)
- #ifdef RPC_DEBUG
- static void rpc_task_set_debuginfo(struct rpc_task *task)
- {
-- static atomic_t rpc_pid;
-+ static atomic_unchecked_t rpc_pid;
-
- task->tk_magic = RPC_TASK_MAGIC_ID;
-- task->tk_pid = atomic_inc_return(&rpc_pid);
-+ task->tk_pid = atomic_inc_return_unchecked(&rpc_pid);
- }
- #else
- static inline void rpc_task_set_debuginfo(struct rpc_task *task)
-diff --git a/net/sunrpc/xprtrdma/svc_rdma.c b/net/sunrpc/xprtrdma/svc_rdma.c
-index 35fb68b..236a8bf 100644
---- a/net/sunrpc/xprtrdma/svc_rdma.c
-+++ b/net/sunrpc/xprtrdma/svc_rdma.c
-@@ -59,15 +59,15 @@ unsigned int svcrdma_max_req_size = RPCRDMA_MAX_REQ_SIZE;
- static unsigned int min_max_inline = 4096;
- static unsigned int max_max_inline = 65536;
-
--atomic_t rdma_stat_recv;
--atomic_t rdma_stat_read;
--atomic_t rdma_stat_write;
--atomic_t rdma_stat_sq_starve;
--atomic_t rdma_stat_rq_starve;
--atomic_t rdma_stat_rq_poll;
--atomic_t rdma_stat_rq_prod;
--atomic_t rdma_stat_sq_poll;
--atomic_t rdma_stat_sq_prod;
-+atomic_unchecked_t rdma_stat_recv;
-+atomic_unchecked_t rdma_stat_read;
-+atomic_unchecked_t rdma_stat_write;
-+atomic_unchecked_t rdma_stat_sq_starve;
-+atomic_unchecked_t rdma_stat_rq_starve;
-+atomic_unchecked_t rdma_stat_rq_poll;
-+atomic_unchecked_t rdma_stat_rq_prod;
-+atomic_unchecked_t rdma_stat_sq_poll;
-+atomic_unchecked_t rdma_stat_sq_prod;
-
- /* Temporary NFS request map and context caches */
- struct kmem_cache *svc_rdma_map_cachep;
-@@ -105,7 +105,7 @@ static int read_reset_stat(ctl_table *table, int write,
- len -= *ppos;
- if (len > *lenp)
- len = *lenp;
-- if (len && copy_to_user(buffer, str_buf, len))
-+ if (len > sizeof str_buf || (len && copy_to_user(buffer, str_buf, len)))
- return -EFAULT;
- *lenp = len;
- *ppos += len;
-@@ -149,63 +149,63 @@ static ctl_table svcrdma_parm_table[] = {
- {
- .procname = "rdma_stat_read",
- .data = &rdma_stat_read,
-- .maxlen = sizeof(atomic_t),
-+ .maxlen = sizeof(atomic_unchecked_t),
- .mode = 0644,
- .proc_handler = &read_reset_stat,
- },
- {
- .procname = "rdma_stat_recv",
- .data = &rdma_stat_recv,
-- .maxlen = sizeof(atomic_t),
-+ .maxlen = sizeof(atomic_unchecked_t),
- .mode = 0644,
- .proc_handler = &read_reset_stat,
- },
- {
- .procname = "rdma_stat_write",
- .data = &rdma_stat_write,
-- .maxlen = sizeof(atomic_t),
-+ .maxlen = sizeof(atomic_unchecked_t),
- .mode = 0644,
- .proc_handler = &read_reset_stat,
- },
- {
- .procname = "rdma_stat_sq_starve",
- .data = &rdma_stat_sq_starve,
-- .maxlen = sizeof(atomic_t),
-+ .maxlen = sizeof(atomic_unchecked_t),
- .mode = 0644,
- .proc_handler = &read_reset_stat,
- },
- {
- .procname = "rdma_stat_rq_starve",
- .data = &rdma_stat_rq_starve,
-- .maxlen = sizeof(atomic_t),
-+ .maxlen = sizeof(atomic_unchecked_t),
- .mode = 0644,
- .proc_handler = &read_reset_stat,
- },
- {
- .procname = "rdma_stat_rq_poll",
- .data = &rdma_stat_rq_poll,
-- .maxlen = sizeof(atomic_t),
-+ .maxlen = sizeof(atomic_unchecked_t),
- .mode = 0644,
- .proc_handler = &read_reset_stat,
- },
- {
- .procname = "rdma_stat_rq_prod",
- .data = &rdma_stat_rq_prod,
-- .maxlen = sizeof(atomic_t),
-+ .maxlen = sizeof(atomic_unchecked_t),
- .mode = 0644,
- .proc_handler = &read_reset_stat,
- },
- {
- .procname = "rdma_stat_sq_poll",
- .data = &rdma_stat_sq_poll,
-- .maxlen = sizeof(atomic_t),
-+ .maxlen = sizeof(atomic_unchecked_t),
- .mode = 0644,
- .proc_handler = &read_reset_stat,
- },
- {
- .procname = "rdma_stat_sq_prod",
- .data = &rdma_stat_sq_prod,
-- .maxlen = sizeof(atomic_t),
-+ .maxlen = sizeof(atomic_unchecked_t),
- .mode = 0644,
- .proc_handler = &read_reset_stat,
- },
-diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
-index 9e88438..8ed5cf0 100644
---- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
-+++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
-@@ -495,7 +495,7 @@ next_sge:
- svc_rdma_put_context(ctxt, 0);
- goto out;
- }
-- atomic_inc(&rdma_stat_read);
-+ atomic_inc_unchecked(&rdma_stat_read);
-
- if (read_wr.num_sge < chl_map->ch[ch_no].count) {
- chl_map->ch[ch_no].count -= read_wr.num_sge;
-@@ -606,7 +606,7 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp)
- dto_q);
- list_del_init(&ctxt->dto_q);
- } else {
-- atomic_inc(&rdma_stat_rq_starve);
-+ atomic_inc_unchecked(&rdma_stat_rq_starve);
- clear_bit(XPT_DATA, &xprt->xpt_flags);
- ctxt = NULL;
- }
-@@ -626,7 +626,7 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp)
- dprintk("svcrdma: processing ctxt=%p on xprt=%p, rqstp=%p, status=%d\n",
- ctxt, rdma_xprt, rqstp, ctxt->wc_status);
- BUG_ON(ctxt->wc_status != IB_WC_SUCCESS);
-- atomic_inc(&rdma_stat_recv);
-+ atomic_inc_unchecked(&rdma_stat_recv);
-
- /* Build up the XDR from the receive buffers. */
- rdma_build_arg_xdr(rqstp, ctxt, ctxt->byte_len);
-diff --git a/net/sunrpc/xprtrdma/svc_rdma_sendto.c b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
-index f11be72..7aad4e8 100644
---- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
-+++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
-@@ -328,7 +328,7 @@ static int send_write(struct svcxprt_rdma *xprt, struct svc_rqst *rqstp,
- write_wr.wr.rdma.remote_addr = to;
-
- /* Post It */
-- atomic_inc(&rdma_stat_write);
-+ atomic_inc_unchecked(&rdma_stat_write);
- if (svc_rdma_send(xprt, &write_wr))
- goto err;
- return 0;
-diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
-index 3fa5751..030ba89 100644
---- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
-+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
-@@ -292,7 +292,7 @@ static void rq_cq_reap(struct svcxprt_rdma *xprt)
- return;
-
- ib_req_notify_cq(xprt->sc_rq_cq, IB_CQ_NEXT_COMP);
-- atomic_inc(&rdma_stat_rq_poll);
-+ atomic_inc_unchecked(&rdma_stat_rq_poll);
-
- while ((ret = ib_poll_cq(xprt->sc_rq_cq, 1, &wc)) > 0) {
- ctxt = (struct svc_rdma_op_ctxt *)(unsigned long)wc.wr_id;
-@@ -314,7 +314,7 @@ static void rq_cq_reap(struct svcxprt_rdma *xprt)
- }
-
- if (ctxt)
-- atomic_inc(&rdma_stat_rq_prod);
-+ atomic_inc_unchecked(&rdma_stat_rq_prod);
-
- set_bit(XPT_DATA, &xprt->sc_xprt.xpt_flags);
- /*
-@@ -386,7 +386,7 @@ static void sq_cq_reap(struct svcxprt_rdma *xprt)
- return;
-
- ib_req_notify_cq(xprt->sc_sq_cq, IB_CQ_NEXT_COMP);
-- atomic_inc(&rdma_stat_sq_poll);
-+ atomic_inc_unchecked(&rdma_stat_sq_poll);
- while ((ret = ib_poll_cq(cq, 1, &wc)) > 0) {
- if (wc.status != IB_WC_SUCCESS)
- /* Close the transport */
-@@ -404,7 +404,7 @@ static void sq_cq_reap(struct svcxprt_rdma *xprt)
- }
-
- if (ctxt)
-- atomic_inc(&rdma_stat_sq_prod);
-+ atomic_inc_unchecked(&rdma_stat_sq_prod);
- }
-
- static void sq_comp_handler(struct ib_cq *cq, void *cq_context)
-@@ -1260,7 +1260,7 @@ int svc_rdma_send(struct svcxprt_rdma *xprt, struct ib_send_wr *wr)
- spin_lock_bh(&xprt->sc_lock);
- if (xprt->sc_sq_depth < atomic_read(&xprt->sc_sq_count) + wr_count) {
- spin_unlock_bh(&xprt->sc_lock);
-- atomic_inc(&rdma_stat_sq_starve);
-+ atomic_inc_unchecked(&rdma_stat_sq_starve);
-
- /* See if we can opportunistically reap SQ WR to make room */
- sq_cq_reap(xprt);
-diff --git a/net/sysctl_net.c b/net/sysctl_net.c
-index 0b15d72..7934fbb 100644
---- a/net/sysctl_net.c
-+++ b/net/sysctl_net.c
-@@ -46,7 +46,7 @@ static int net_ctl_permissions(struct ctl_table_root *root,
- struct ctl_table *table)
- {
- /* Allow network administrator to have same access as root. */
-- if (capable(CAP_NET_ADMIN)) {
-+ if (capable_nolog(CAP_NET_ADMIN)) {
- int mode = (table->mode >> 6) & 7;
- return (mode << 6) | (mode << 3) | mode;
- }
-diff --git a/net/tipc/eth_media.c b/net/tipc/eth_media.c
-index 524ba56..8f2f836 100644
---- a/net/tipc/eth_media.c
-+++ b/net/tipc/eth_media.c
-@@ -60,7 +60,6 @@ struct eth_bearer {
-
- static struct eth_bearer eth_bearers[MAX_ETH_BEARERS];
- static int eth_started = 0;
--static struct notifier_block notifier;
-
- /**
- * send_msg - send a TIPC message out over an Ethernet interface
-@@ -258,6 +257,11 @@ static char *eth_addr2str(struct tipc_media_addr *a, char *str_buf, int str_size
- * with OS for notifications about device state changes.
- */
-
-+static struct notifier_block notifier = {
-+ .notifier_call = &recv_notification,
-+ .priority = 0,
-+};
-+
- int tipc_eth_media_start(void)
- {
- struct tipc_media_addr bcast_addr;
-@@ -278,8 +282,6 @@ int tipc_eth_media_start(void)
- if (res)
- return res;
-
-- notifier.notifier_call = &recv_notification;
-- notifier.priority = 0;
- res = register_netdevice_notifier(¬ifier);
- if (!res)
- eth_started = 1;
-diff --git a/net/tipc/link.c b/net/tipc/link.c
-index dd4c18b..f40d38d 100644
---- a/net/tipc/link.c
-+++ b/net/tipc/link.c
-@@ -1418,7 +1418,7 @@ again:
-
- if (!sect_rest) {
- sect_rest = msg_sect[++curr_sect].iov_len;
-- sect_crs = (const unchar *)msg_sect[curr_sect].iov_base;
-+ sect_crs = (const unchar __user *)msg_sect[curr_sect].iov_base;
- }
-
- if (sect_rest < fragm_rest)
-@@ -1437,7 +1437,7 @@ error:
- }
- } else
- skb_copy_to_linear_data_offset(buf, fragm_crs,
-- sect_crs, sz);
-+ (const void __force_kernel *)sect_crs, sz);
- sect_crs += sz;
- sect_rest -= sz;
- fragm_crs += sz;
-diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
-index 0747d8a..e8bf3f3 100644
---- a/net/tipc/subscr.c
-+++ b/net/tipc/subscr.c
-@@ -104,7 +104,7 @@ static void subscr_send_event(struct subscription *sub,
- {
- struct iovec msg_sect;
-
-- msg_sect.iov_base = (void *)&sub->evt;
-+ msg_sect.iov_base = (void __force_user *)&sub->evt;
- msg_sect.iov_len = sizeof(struct tipc_event);
-
- sub->evt.event = htohl(event, sub->swap);
-diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index db8d51a..608692d 100644
---- a/net/unix/af_unix.c
-+++ b/net/unix/af_unix.c
-@@ -745,6 +745,12 @@ static struct sock *unix_find_other(struct net *net,
- err = -ECONNREFUSED;
- if (!S_ISSOCK(inode->i_mode))
- goto put_fail;
-+
-+ if (!gr_acl_handle_unix(path.dentry, path.mnt)) {
-+ err = -EACCES;
-+ goto put_fail;
-+ }
-+
- u = unix_find_socket_byinode(net, inode);
- if (!u)
- goto put_fail;
-@@ -765,6 +771,13 @@ static struct sock *unix_find_other(struct net *net,
- if (u) {
- struct dentry *dentry;
- dentry = unix_sk(u)->dentry;
-+
-+ if (!gr_handle_chroot_unix(u->sk_peercred.pid)) {
-+ err = -EPERM;
-+ sock_put(u);
-+ goto fail;
-+ }
-+
- if (dentry)
- touch_atime(unix_sk(u)->mnt, dentry);
- } else
-@@ -850,11 +863,18 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
- err = security_path_mknod(&nd.path, dentry, mode, 0);
- if (err)
- goto out_mknod_drop_write;
-+ if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
-+ err = -EACCES;
-+ goto out_mknod_drop_write;
-+ }
- err = vfs_mknod(nd.path.dentry->d_inode, dentry, mode, 0);
- out_mknod_drop_write:
- mnt_drop_write(nd.path.mnt);
- if (err)
- goto out_mknod_dput;
-+
-+ gr_handle_create(dentry, nd.path.mnt);
-+
- mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
- dput(nd.path.dentry);
- nd.path.dentry = dentry;
-@@ -2211,7 +2231,11 @@ static int unix_seq_show(struct seq_file *seq, void *v)
- unix_state_lock(s);
-
- seq_printf(seq, "%p: %08X %08X %08X %04X %02X %5lu",
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
- s,
-+#endif
- atomic_read(&s->sk_refcnt),
- 0,
- s->sk_state == TCP_LISTEN ? __SO_ACCEPTCON : 0,
-diff --git a/net/wireless/wext.c b/net/wireless/wext.c
-index a2e4c60..0979cbe 100644
---- a/net/wireless/wext.c
-+++ b/net/wireless/wext.c
-@@ -816,8 +816,7 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
- */
-
- /* Support for very large requests */
-- if ((descr->flags & IW_DESCR_FLAG_NOMAX) &&
-- (user_length > descr->max_tokens)) {
-+ if (user_length > descr->max_tokens) {
- /* Allow userspace to GET more than max so
- * we can support any size GET requests.
- * There is still a limit : -ENOMEM.
-@@ -854,22 +853,6 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
- }
- }
-
-- if (IW_IS_GET(cmd) && !(descr->flags & IW_DESCR_FLAG_NOMAX)) {
-- /*
-- * If this is a GET, but not NOMAX, it means that the extra
-- * data is not bounded by userspace, but by max_tokens. Thus
-- * set the length to max_tokens. This matches the extra data
-- * allocation.
-- * The driver should fill it with the number of tokens it
-- * provided, and it may check iwp->length rather than having
-- * knowledge of max_tokens. If the driver doesn't change the
-- * iwp->length, this ioctl just copies back max_token tokens
-- * filled with zeroes. Hopefully the driver isn't claiming
-- * them to be valid data.
-- */
-- iwp->length = descr->max_tokens;
-- }
--
- err = handler(dev, info, (union iwreq_data *) iwp, extra);
-
- iwp->length += essid_compat;
-diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
-index cb81ca3..e15d49a 100644
---- a/net/xfrm/xfrm_policy.c
-+++ b/net/xfrm/xfrm_policy.c
-@@ -586,7 +586,7 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
- hlist_add_head(&policy->bydst, chain);
- xfrm_pol_hold(policy);
- net->xfrm.policy_count[dir]++;
-- atomic_inc(&flow_cache_genid);
-+ atomic_inc_unchecked(&flow_cache_genid);
- if (delpol)
- __xfrm_policy_unlink(delpol, dir);
- policy->index = delpol ? delpol->index : xfrm_gen_index(net, dir);
-@@ -669,7 +669,7 @@ struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u8 type, int dir,
- write_unlock_bh(&xfrm_policy_lock);
-
- if (ret && delete) {
-- atomic_inc(&flow_cache_genid);
-+ atomic_inc_unchecked(&flow_cache_genid);
- xfrm_policy_kill(ret);
- }
- return ret;
-@@ -710,7 +710,7 @@ struct xfrm_policy *xfrm_policy_byid(struct net *net, u8 type, int dir, u32 id,
- write_unlock_bh(&xfrm_policy_lock);
-
- if (ret && delete) {
-- atomic_inc(&flow_cache_genid);
-+ atomic_inc_unchecked(&flow_cache_genid);
- xfrm_policy_kill(ret);
- }
- return ret;
-@@ -824,7 +824,7 @@ int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info)
- }
-
- }
-- atomic_inc(&flow_cache_genid);
-+ atomic_inc_unchecked(&flow_cache_genid);
- out:
- write_unlock_bh(&xfrm_policy_lock);
- return err;
-@@ -1088,7 +1088,7 @@ int xfrm_policy_delete(struct xfrm_policy *pol, int dir)
- write_unlock_bh(&xfrm_policy_lock);
- if (pol) {
- if (dir < XFRM_POLICY_MAX)
-- atomic_inc(&flow_cache_genid);
-+ atomic_inc_unchecked(&flow_cache_genid);
- xfrm_policy_kill(pol);
- return 0;
- }
-@@ -1477,7 +1477,7 @@ free_dst:
- goto out;
- }
-
--static int inline
-+static inline int
- xfrm_dst_alloc_copy(void **target, void *src, int size)
- {
- if (!*target) {
-@@ -1489,7 +1489,7 @@ xfrm_dst_alloc_copy(void **target, void *src, int size)
- return 0;
- }
-
--static int inline
-+static inline int
- xfrm_dst_update_parent(struct dst_entry *dst, struct xfrm_selector *sel)
- {
- #ifdef CONFIG_XFRM_SUB_POLICY
-@@ -1501,7 +1501,7 @@ xfrm_dst_update_parent(struct dst_entry *dst, struct xfrm_selector *sel)
- #endif
- }
-
--static int inline
-+static inline int
- xfrm_dst_update_origin(struct dst_entry *dst, struct flowi *fl)
- {
- #ifdef CONFIG_XFRM_SUB_POLICY
-@@ -1537,7 +1537,7 @@ int __xfrm_lookup(struct net *net, struct dst_entry **dst_p, struct flowi *fl,
- u8 dir = policy_to_flow_dir(XFRM_POLICY_OUT);
-
- restart:
-- genid = atomic_read(&flow_cache_genid);
-+ genid = atomic_read_unchecked(&flow_cache_genid);
- policy = NULL;
- for (pi = 0; pi < ARRAY_SIZE(pols); pi++)
- pols[pi] = NULL;
-@@ -1680,7 +1680,7 @@ restart:
- goto error;
- }
- if (nx == -EAGAIN ||
-- genid != atomic_read(&flow_cache_genid)) {
-+ genid != atomic_read_unchecked(&flow_cache_genid)) {
- xfrm_pols_put(pols, npols);
- goto restart;
- }
-diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
-index f2f7c63..9e0e8cf 100644
---- a/net/xfrm/xfrm_state.c
-+++ b/net/xfrm/xfrm_state.c
-@@ -281,7 +281,9 @@ int xfrm_register_mode(struct xfrm_mode *mode, int family)
- if (!try_module_get(afinfo->owner))
- goto out;
-
-- mode->afinfo = afinfo;
-+ pax_open_kernel();
-+ *(void **)&mode->afinfo = afinfo;
-+ pax_close_kernel();
- modemap[mode->encap] = mode;
- err = 0;
-
-@@ -2040,8 +2042,10 @@ int xfrm_init_state(struct xfrm_state *x)
- goto error;
-
- x->outer_mode = xfrm_get_mode(x->props.mode, family);
-- if (x->outer_mode == NULL)
-+ if (x->outer_mode == NULL) {
-+ err = -EPROTONOSUPPORT;
- goto error;
-+ }
-
- x->km.state = XFRM_STATE_VALID;
-
-diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
-index b95a2d6..f6a9e08 100644
---- a/net/xfrm/xfrm_user.c
-+++ b/net/xfrm/xfrm_user.c
-@@ -224,7 +224,7 @@ static int attach_one_algo(struct xfrm_algo **algpp, u8 *props,
- if (!p)
- return -ENOMEM;
-
-- strcpy(p->alg_name, algo->name);
-+ strncpy(p->alg_name, algo->name, sizeof(p->alg_name));
- *algpp = p;
- return 0;
- }
-@@ -506,6 +506,7 @@ out:
-
- static void copy_to_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
- {
-+ memset(p, 0, sizeof(*p));
- memcpy(&p->id, &x->id, sizeof(p->id));
- memcpy(&p->sel, &x->sel, sizeof(p->sel));
- memcpy(&p->lft, &x->lft, sizeof(p->lft));
-@@ -646,6 +647,7 @@ static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb,
- {
- struct xfrm_dump_info info;
- struct sk_buff *skb;
-+ int err;
-
- skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
- if (!skb)
-@@ -656,9 +658,10 @@ static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb,
- info.nlmsg_seq = seq;
- info.nlmsg_flags = 0;
-
-- if (dump_one_state(x, 0, &info)) {
-+ err = dump_one_state(x, 0, &info);
-+ if (err) {
- kfree_skb(skb);
-- return NULL;
-+ return ERR_PTR(err);
- }
-
- return skb;
-@@ -1075,6 +1078,7 @@ static void copy_from_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy
-
- static void copy_to_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p, int dir)
- {
-+ memset(p, 0, sizeof(*p));
- memcpy(&p->sel, &xp->selector, sizeof(p->sel));
- memcpy(&p->lft, &xp->lft, sizeof(p->lft));
- memcpy(&p->curlft, &xp->curlft, sizeof(p->curlft));
-@@ -1169,6 +1173,8 @@ static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb)
- struct xfrm_user_tmpl vec[XFRM_MAX_DEPTH];
- int i;
-
-+ pax_track_stack();
-+
- if (xp->xfrm_nr == 0)
- return 0;
-
-@@ -1176,6 +1182,7 @@ static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb)
- struct xfrm_user_tmpl *up = &vec[i];
- struct xfrm_tmpl *kp = &xp->xfrm_vec[i];
-
-+ memset(up, 0, sizeof(*up));
- memcpy(&up->id, &kp->id, sizeof(up->id));
- up->family = kp->encap_family;
- memcpy(&up->saddr, &kp->saddr, sizeof(up->saddr));
-@@ -1784,6 +1791,8 @@ static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
- int err;
- int n = 0;
-
-+ pax_track_stack();
-+
- if (attrs[XFRMA_MIGRATE] == NULL)
- return -EINVAL;
-
-diff --git a/samples/kobject/kset-example.c b/samples/kobject/kset-example.c
-index 45b7d56..19e828c 100644
---- a/samples/kobject/kset-example.c
-+++ b/samples/kobject/kset-example.c
-@@ -87,7 +87,7 @@ static ssize_t foo_attr_store(struct kobject *kobj,
- }
-
- /* Our custom sysfs_ops that we will associate with our ktype later on */
--static struct sysfs_ops foo_sysfs_ops = {
-+static const struct sysfs_ops foo_sysfs_ops = {
- .show = foo_attr_show,
- .store = foo_attr_store,
- };
-diff --git a/scripts/Makefile.build b/scripts/Makefile.build
-index 341b589..29fffe0 100644
---- a/scripts/Makefile.build
-+++ b/scripts/Makefile.build
-@@ -59,7 +59,7 @@ endif
- endif
-
- # Do not include host rules unless needed
--ifneq ($(hostprogs-y)$(hostprogs-m),)
-+ifneq ($(hostprogs-y)$(hostprogs-m)$(hostlibs-y)$(hostlibs-m)$(hostcxxlibs-y)$(hostcxxlibs-m),)
- include scripts/Makefile.host
- endif
-
-diff --git a/scripts/Makefile.clean b/scripts/Makefile.clean
-index 6f89fbb..53adc9c 100644
---- a/scripts/Makefile.clean
-+++ b/scripts/Makefile.clean
-@@ -43,7 +43,8 @@ subdir-ymn := $(addprefix $(obj)/,$(subdir-ymn))
- __clean-files := $(extra-y) $(always) \
- $(targets) $(clean-files) \
- $(host-progs) \
-- $(hostprogs-y) $(hostprogs-m) $(hostprogs-)
-+ $(hostprogs-y) $(hostprogs-m) $(hostprogs-) \
-+ $(hostlibs-y) $(hostlibs-m) $(hostlibs-)
-
- # as clean-files is given relative to the current directory, this adds
- # a $(obj) prefix, except for absolute paths
-diff --git a/scripts/Makefile.host b/scripts/Makefile.host
-index 1ac414f..38575f7 100644
---- a/scripts/Makefile.host
-+++ b/scripts/Makefile.host
-@@ -31,6 +31,8 @@
- # Note: Shared libraries consisting of C++ files are not supported
-
- __hostprogs := $(sort $(hostprogs-y) $(hostprogs-m))
-+__hostlibs := $(sort $(hostlibs-y) $(hostlibs-m))
-+__hostcxxlibs := $(sort $(hostcxxlibs-y) $(hostcxxlibs-m))
-
- # C code
- # Executables compiled from a single .c file
-@@ -54,11 +56,15 @@ host-cxxobjs := $(sort $(foreach m,$(host-cxxmulti),$($(m)-cxxobjs)))
- # Shared libaries (only .c supported)
- # Shared libraries (.so) - all .so files referenced in "xxx-objs"
- host-cshlib := $(sort $(filter %.so, $(host-cobjs)))
-+host-cshlib += $(sort $(filter %.so, $(__hostlibs)))
-+host-cxxshlib := $(sort $(filter %.so, $(__hostcxxlibs)))
- # Remove .so files from "xxx-objs"
- host-cobjs := $(filter-out %.so,$(host-cobjs))
-+host-cxxobjs := $(filter-out %.so,$(host-cxxobjs))
-
--#Object (.o) files used by the shared libaries
-+# Object (.o) files used by the shared libaries
- host-cshobjs := $(sort $(foreach m,$(host-cshlib),$($(m:.so=-objs))))
-+host-cxxshobjs := $(sort $(foreach m,$(host-cxxshlib),$($(m:.so=-objs))))
-
- # output directory for programs/.o files
- # hostprogs-y := tools/build may have been specified. Retrieve directory
-@@ -82,7 +88,9 @@ host-cobjs := $(addprefix $(obj)/,$(host-cobjs))
- host-cxxmulti := $(addprefix $(obj)/,$(host-cxxmulti))
- host-cxxobjs := $(addprefix $(obj)/,$(host-cxxobjs))
- host-cshlib := $(addprefix $(obj)/,$(host-cshlib))
-+host-cxxshlib := $(addprefix $(obj)/,$(host-cxxshlib))
- host-cshobjs := $(addprefix $(obj)/,$(host-cshobjs))
-+host-cxxshobjs := $(addprefix $(obj)/,$(host-cxxshobjs))
- host-objdirs := $(addprefix $(obj)/,$(host-objdirs))
-
- obj-dirs += $(host-objdirs)
-@@ -156,6 +164,13 @@ quiet_cmd_host-cshobjs = HOSTCC -fPIC $@
- $(host-cshobjs): $(obj)/%.o: $(src)/%.c FORCE
- $(call if_changed_dep,host-cshobjs)
-
-+# Compile .c file, create position independent .o file
-+# host-cxxshobjs -> .o
-+quiet_cmd_host-cxxshobjs = HOSTCXX -fPIC $@
-+ cmd_host-cxxshobjs = $(HOSTCXX) $(hostcxx_flags) -fPIC -c -o $@ $<
-+$(host-cxxshobjs): $(obj)/%.o: $(src)/%.c FORCE
-+ $(call if_changed_dep,host-cxxshobjs)
-+
- # Link a shared library, based on position independent .o files
- # *.o -> .so shared library (host-cshlib)
- quiet_cmd_host-cshlib = HOSTLLD -shared $@
-@@ -165,6 +180,15 @@ quiet_cmd_host-cshlib = HOSTLLD -shared $@
- $(host-cshlib): $(obj)/%: $(host-cshobjs) FORCE
- $(call if_changed,host-cshlib)
-
-+# Link a shared library, based on position independent .o files
-+# *.o -> .so shared library (host-cxxshlib)
-+quiet_cmd_host-cxxshlib = HOSTLLD -shared $@
-+ cmd_host-cxxshlib = $(HOSTCXX) $(HOSTLDFLAGS) -shared -o $@ \
-+ $(addprefix $(obj)/,$($(@F:.so=-objs))) \
-+ $(HOST_LOADLIBES) $(HOSTLOADLIBES_$(@F))
-+$(host-cxxshlib): $(obj)/%: $(host-cxxshobjs) FORCE
-+ $(call if_changed,host-cxxshlib)
-+
- targets += $(host-csingle) $(host-cmulti) $(host-cobjs)\
-- $(host-cxxmulti) $(host-cxxobjs) $(host-cshlib) $(host-cshobjs)
-+ $(host-cxxmulti) $(host-cxxobjs) $(host-cshlib) $(host-cshobjs) $(host-cxxshlib) $(host-cxxshobjs)
-
-diff --git a/scripts/basic/fixdep.c b/scripts/basic/fixdep.c
-index 6bf21f8..c0546b3 100644
---- a/scripts/basic/fixdep.c
-+++ b/scripts/basic/fixdep.c
-@@ -162,7 +162,7 @@ static void grow_config(int len)
- /*
- * Lookup a value in the configuration string.
- */
--static int is_defined_config(const char * name, int len)
-+static int is_defined_config(const char * name, unsigned int len)
- {
- const char * pconfig;
- const char * plast = str_config + len_config - len;
-@@ -199,7 +199,7 @@ static void clear_config(void)
- /*
- * Record the use of a CONFIG_* word.
- */
--static void use_config(char *m, int slen)
-+static void use_config(char *m, unsigned int slen)
- {
- char s[PATH_MAX];
- char *p;
-@@ -222,9 +222,9 @@ static void use_config(char *m, int slen)
-
- static void parse_config_file(char *map, size_t len)
- {
-- int *end = (int *) (map + len);
-+ unsigned int *end = (unsigned int *) (map + len);
- /* start at +1, so that p can never be < map */
-- int *m = (int *) map + 1;
-+ unsigned int *m = (unsigned int *) map + 1;
- char *p, *q;
-
- for (; m < end; m++) {
-@@ -371,7 +371,7 @@ static void print_deps(void)
- static void traps(void)
- {
- static char test[] __attribute__((aligned(sizeof(int)))) = "CONF";
-- int *p = (int *)test;
-+ unsigned int *p = (unsigned int *)test;
-
- if (*p != INT_CONF) {
- fprintf(stderr, "fixdep: sizeof(int) != 4 or wrong endianess? %#x\n",
-diff --git a/scripts/gcc-plugin.sh b/scripts/gcc-plugin.sh
-new file mode 100644
-index 0000000..008ac1a
---- /dev/null
-+++ b/scripts/gcc-plugin.sh
-@@ -0,0 +1,17 @@
-+#!/bin/bash
-+plugincc=`$1 -x c -shared - -o /dev/null -I\`$3 -print-file-name=plugin\`/include 2>&1 <<EOF
-+#include "gcc-plugin.h"
-+#include "tree.h"
-+#include "tm.h"
-+#include "rtl.h"
-+#ifdef ENABLE_BUILD_WITH_CXX
-+#warning $2
-+#else
-+#warning $1
-+#endif
-+EOF`
-+if [ $? -eq 0 ]
-+then
-+ [[ "$plugincc" =~ "$1" ]] && echo "$1"
-+ [[ "$plugincc" =~ "$2" ]] && echo "$2"
-+fi
-diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
-index 62a9025..65b82ad 100644
---- a/scripts/mod/file2alias.c
-+++ b/scripts/mod/file2alias.c
-@@ -72,7 +72,7 @@ static void device_id_check(const char *modname, const char *device_id,
- unsigned long size, unsigned long id_size,
- void *symval)
- {
-- int i;
-+ unsigned int i;
-
- if (size % id_size || size < id_size) {
- if (cross_build != 0)
-@@ -102,7 +102,7 @@ static void device_id_check(const char *modname, const char *device_id,
- /* USB is special because the bcdDevice can be matched against a numeric range */
- /* Looks like "usb:vNpNdNdcNdscNdpNicNiscNipN" */
- static void do_usb_entry(struct usb_device_id *id,
-- unsigned int bcdDevice_initial, int bcdDevice_initial_digits,
-+ unsigned int bcdDevice_initial, unsigned int bcdDevice_initial_digits,
- unsigned char range_lo, unsigned char range_hi,
- struct module *mod)
- {
-@@ -151,7 +151,7 @@ static void do_usb_entry_multi(struct usb_device_id *id, struct module *mod)
- {
- unsigned int devlo, devhi;
- unsigned char chi, clo;
-- int ndigits;
-+ unsigned int ndigits;
-
- id->match_flags = TO_NATIVE(id->match_flags);
- id->idVendor = TO_NATIVE(id->idVendor);
-@@ -368,7 +368,7 @@ static void do_pnp_device_entry(void *symval, unsigned long size,
- for (i = 0; i < count; i++) {
- const char *id = (char *)devs[i].id;
- char acpi_id[sizeof(devs[0].id)];
-- int j;
-+ unsigned int j;
-
- buf_printf(&mod->dev_table_buf,
- "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
-@@ -398,7 +398,7 @@ static void do_pnp_card_entries(void *symval, unsigned long size,
-
- for (j = 0; j < PNP_MAX_DEVICES; j++) {
- const char *id = (char *)card->devs[j].id;
-- int i2, j2;
-+ unsigned int i2, j2;
- int dup = 0;
-
- if (!id[0])
-@@ -424,7 +424,7 @@ static void do_pnp_card_entries(void *symval, unsigned long size,
- /* add an individual alias for every device entry */
- if (!dup) {
- char acpi_id[sizeof(card->devs[0].id)];
-- int k;
-+ unsigned int k;
-
- buf_printf(&mod->dev_table_buf,
- "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
-@@ -699,7 +699,7 @@ static void dmi_ascii_filter(char *d, const char *s)
- static int do_dmi_entry(const char *filename, struct dmi_system_id *id,
- char *alias)
- {
-- int i, j;
-+ unsigned int i, j;
-
- sprintf(alias, "dmi*");
-
-diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
-index 03efeab..35e35ff 100644
---- a/scripts/mod/modpost.c
-+++ b/scripts/mod/modpost.c
-@@ -764,7 +764,7 @@ static void check_section(const char *modname, struct elf_info *elf,
-
- #define ALL_INIT_DATA_SECTIONS \
- ".init.setup$", ".init.rodata$", \
-- ".devinit.rodata$", ".cpuinit.rodata$", ".meminit.rodata$" \
-+ ".devinit.rodata$", ".cpuinit.rodata$", ".meminit.rodata$", \
- ".init.data$", ".devinit.data$", ".cpuinit.data$", ".meminit.data$"
- #define ALL_EXIT_DATA_SECTIONS \
- ".exit.data$", ".devexit.data$", ".cpuexit.data$", ".memexit.data$"
-@@ -835,6 +835,7 @@ enum mismatch {
- INIT_TO_EXIT,
- EXIT_TO_INIT,
- EXPORT_TO_INIT_EXIT,
-+ DATA_TO_TEXT
- };
-
- struct sectioncheck {
-@@ -920,6 +921,12 @@ const struct sectioncheck sectioncheck[] = {
- .fromsec = { "__ksymtab*", NULL },
- .tosec = { INIT_SECTIONS, EXIT_SECTIONS, NULL },
- .mismatch = EXPORT_TO_INIT_EXIT
-+},
-+/* Do not reference code from writable data */
-+{
-+ .fromsec = { DATA_SECTIONS, NULL },
-+ .tosec = { TEXT_SECTIONS, NULL },
-+ .mismatch = DATA_TO_TEXT
- }
- };
-
-@@ -1024,10 +1031,10 @@ static Elf_Sym *find_elf_symbol(struct elf_info *elf, Elf64_Sword addr,
- continue;
- if (ELF_ST_TYPE(sym->st_info) == STT_SECTION)
- continue;
-- if (sym->st_value == addr)
-- return sym;
- /* Find a symbol nearby - addr are maybe negative */
- d = sym->st_value - addr;
-+ if (d == 0)
-+ return sym;
- if (d < 0)
- d = addr - sym->st_value;
- if (d < distance) {
-@@ -1268,6 +1275,14 @@ static void report_sec_mismatch(const char *modname, enum mismatch mismatch,
- "Fix this by removing the %sannotation of %s "
- "or drop the export.\n",
- tosym, sec2annotation(tosec), sec2annotation(tosec), tosym);
-+ case DATA_TO_TEXT:
-+#if 0
-+ fprintf(stderr,
-+ "The %s %s:%s references\n"
-+ "the %s %s:%s%s\n",
-+ from, fromsec, fromsym, to, tosec, tosym, to_p);
-+#endif
-+ break;
- case NO_MISMATCH:
- /* To get warnings on missing members */
- break;
-@@ -1495,7 +1510,7 @@ static void section_rel(const char *modname, struct elf_info *elf,
- static void check_sec_ref(struct module *mod, const char *modname,
- struct elf_info *elf)
- {
-- int i;
-+ unsigned int i;
- Elf_Shdr *sechdrs = elf->sechdrs;
-
- /* Walk through all sections */
-@@ -1651,7 +1666,7 @@ void __attribute__((format(printf, 2, 3))) buf_printf(struct buffer *buf,
- va_end(ap);
- }
-
--void buf_write(struct buffer *buf, const char *s, int len)
-+void buf_write(struct buffer *buf, const char *s, unsigned int len)
- {
- if (buf->size - buf->pos < len) {
- buf->size += len + SZ;
-@@ -1863,7 +1878,7 @@ static void write_if_changed(struct buffer *b, const char *fname)
- if (fstat(fileno(file), &st) < 0)
- goto close_write;
-
-- if (st.st_size != b->pos)
-+ if (st.st_size != (off_t)b->pos)
- goto close_write;
-
- tmp = NOFAIL(malloc(b->pos));
-diff --git a/scripts/mod/modpost.h b/scripts/mod/modpost.h
-index 09f58e3..4b66092 100644
---- a/scripts/mod/modpost.h
-+++ b/scripts/mod/modpost.h
-@@ -92,15 +92,15 @@ void *do_nofail(void *ptr, const char *expr);
-
- struct buffer {
- char *p;
-- int pos;
-- int size;
-+ unsigned int pos;
-+ unsigned int size;
- };
-
- void __attribute__((format(printf, 2, 3)))
- buf_printf(struct buffer *buf, const char *fmt, ...);
-
- void
--buf_write(struct buffer *buf, const char *s, int len);
-+buf_write(struct buffer *buf, const char *s, unsigned int len);
-
- struct module {
- struct module *next;
-diff --git a/scripts/mod/sumversion.c b/scripts/mod/sumversion.c
-index ecf9c7d..d52b38e 100644
---- a/scripts/mod/sumversion.c
-+++ b/scripts/mod/sumversion.c
-@@ -455,7 +455,7 @@ static void write_version(const char *filename, const char *sum,
- goto out;
- }
-
-- if (write(fd, sum, strlen(sum)+1) != strlen(sum)+1) {
-+ if (write(fd, sum, strlen(sum)+1) != (ssize_t)strlen(sum)+1) {
- warn("writing sum in %s failed: %s\n",
- filename, strerror(errno));
- goto out;
-diff --git a/scripts/package/mkspec b/scripts/package/mkspec
-index 47bdd2f..d4d4e93 100755
---- a/scripts/package/mkspec
-+++ b/scripts/package/mkspec
-@@ -70,7 +70,7 @@ echo 'mkdir -p $RPM_BUILD_ROOT/boot $RPM_BUILD_ROOT/lib/modules'
- echo 'mkdir -p $RPM_BUILD_ROOT/lib/firmware'
- echo "%endif"
-
--echo 'INSTALL_MOD_PATH=$RPM_BUILD_ROOT make %{_smp_mflags} KBUILD_SRC= modules_install'
-+echo 'INSTALL_MOD_PATH=$RPM_BUILD_ROOT make %{?_smp_mflags} KBUILD_SRC= modules_install'
- echo "%ifarch ia64"
- echo 'cp $KBUILD_IMAGE $RPM_BUILD_ROOT'"/boot/efi/vmlinuz-$KERNELRELEASE"
- echo 'ln -s '"efi/vmlinuz-$KERNELRELEASE" '$RPM_BUILD_ROOT'"/boot/"
-diff --git a/scripts/pnmtologo.c b/scripts/pnmtologo.c
-index 5c11312..72742b5 100644
---- a/scripts/pnmtologo.c
-+++ b/scripts/pnmtologo.c
-@@ -237,14 +237,14 @@ static void write_header(void)
- fprintf(out, " * Linux logo %s\n", logoname);
- fputs(" */\n\n", out);
- fputs("#include <linux/linux_logo.h>\n\n", out);
-- fprintf(out, "static unsigned char %s_data[] __initdata = {\n",
-+ fprintf(out, "static unsigned char %s_data[] = {\n",
- logoname);
- }
-
- static void write_footer(void)
- {
- fputs("\n};\n\n", out);
-- fprintf(out, "const struct linux_logo %s __initconst = {\n", logoname);
-+ fprintf(out, "const struct linux_logo %s = {\n", logoname);
- fprintf(out, "\t.type\t\t= %s,\n", logo_types[logo_type]);
- fprintf(out, "\t.width\t\t= %d,\n", logo_width);
- fprintf(out, "\t.height\t\t= %d,\n", logo_height);
-@@ -374,7 +374,7 @@ static void write_logo_clut224(void)
- fputs("\n};\n\n", out);
-
- /* write logo clut */
-- fprintf(out, "static unsigned char %s_clut[] __initdata = {\n",
-+ fprintf(out, "static unsigned char %s_clut[] = {\n",
- logoname);
- write_hex_cnt = 0;
- for (i = 0; i < logo_clutsize; i++) {
-diff --git a/scripts/tags.sh b/scripts/tags.sh
-index d52f7a0..b66cdd9 100755
---- a/scripts/tags.sh
-+++ b/scripts/tags.sh
-@@ -93,6 +93,11 @@ docscope()
- cscope -b -f cscope.out
- }
-
-+dogtags()
-+{
-+ all_sources | gtags -i -f -
-+}
-+
- exuberant()
- {
- all_sources | xargs $1 -a \
-@@ -164,6 +169,10 @@ case "$1" in
- docscope
- ;;
-
-+ "gtags")
-+ dogtags
-+ ;;
-+
- "tags")
- rm -f tags
- xtags ctags
-diff --git a/security/Kconfig b/security/Kconfig
-index fb363cd..9fc4cfa 100644
---- a/security/Kconfig
-+++ b/security/Kconfig
-@@ -4,6 +4,896 @@
-
- menu "Security options"
-
-+menu "Grsecurity"
-+
-+ config ARCH_TRACK_EXEC_LIMIT
-+ bool
-+
-+ config PAX_KERNEXEC_PLUGIN
-+ bool
-+
-+ config PAX_PER_CPU_PGD
-+ bool
-+
-+ config TASK_SIZE_MAX_SHIFT
-+ int
-+ depends on X86_64
-+ default 47 if !PAX_PER_CPU_PGD
-+ default 42 if PAX_PER_CPU_PGD
-+
-+ config PAX_ENABLE_PAE
-+ bool
-+ default y if (X86_32 && (MPENTIUM4 || MK8 || MPSC || MCORE2 || MATOM))
-+
-+ config PAX_USERCOPY_SLABS
-+ bool
-+
-+config GRKERNSEC
-+ bool "Grsecurity"
-+ select CRYPTO
-+ select CRYPTO_SHA256
-+ select PROC_FS
-+ select STOP_MACHINE
-+ help
-+ If you say Y here, you will be able to configure many features
-+ that will enhance the security of your system. It is highly
-+ recommended that you say Y here and read through the help
-+ for each option so that you fully understand the features and
-+ can evaluate their usefulness for your machine.
-+
-+choice
-+ prompt "Configuration Method"
-+ depends on GRKERNSEC
-+ default GRKERNSEC_CONFIG_CUSTOM
-+ help
-+
-+config GRKERNSEC_CONFIG_AUTO
-+ bool "Automatic"
-+ help
-+ If you choose this configuration method, you'll be able to answer a small
-+ number of simple questions about how you plan to use this kernel.
-+ The settings of grsecurity and PaX will be automatically configured for
-+ the highest commonly-used settings within the provided constraints.
-+
-+ If you require additional configuration, custom changes can still be made
-+ from the "custom configuration" menu.
-+
-+config GRKERNSEC_CONFIG_CUSTOM
-+ bool "Custom"
-+ help
-+ If you choose this configuration method, you'll be able to configure all
-+ grsecurity and PaX settings manually. Via this method, no options are
-+ automatically enabled.
-+
-+endchoice
-+
-+choice
-+ prompt "Usage Type"
-+ depends on (GRKERNSEC && GRKERNSEC_CONFIG_AUTO)
-+ default GRKERNSEC_CONFIG_SERVER
-+ help
-+
-+config GRKERNSEC_CONFIG_SERVER
-+ bool "Server"
-+ help
-+ Choose this option if you plan to use this kernel on a server.
-+
-+config GRKERNSEC_CONFIG_DESKTOP
-+ bool "Desktop"
-+ help
-+ Choose this option if you plan to use this kernel on a desktop.
-+
-+endchoice
-+
-+choice
-+ prompt "Virtualization Type"
-+ depends on (GRKERNSEC && X86 && GRKERNSEC_CONFIG_AUTO)
-+ default GRKERNSEC_CONFIG_VIRT_NONE
-+ help
-+
-+config GRKERNSEC_CONFIG_VIRT_NONE
-+ bool "None"
-+ help
-+ Choose this option if this kernel will be run on bare metal.
-+
-+config GRKERNSEC_CONFIG_VIRT_GUEST
-+ bool "Guest"
-+ help
-+ Choose this option if this kernel will be run as a VM guest.
-+
-+config GRKERNSEC_CONFIG_VIRT_HOST
-+ bool "Host"
-+ help
-+ Choose this option if this kernel will be run as a VM host.
-+
-+endchoice
-+
-+choice
-+ prompt "Virtualization Hardware"
-+ depends on (GRKERNSEC && X86 && GRKERNSEC_CONFIG_AUTO && (GRKERNSEC_CONFIG_VIRT_GUEST || GRKERNSEC_CONFIG_VIRT_HOST))
-+ help
-+
-+config GRKERNSEC_CONFIG_VIRT_EPT
-+ bool "EPT/RVI Processor Support"
-+ depends on X86
-+ help
-+ Choose this option if your CPU supports the EPT or RVI features of 2nd-gen
-+ hardware virtualization. This allows for additional kernel hardening protections
-+ to operate without additional performance impact.
-+
-+ To see if your Intel processor supports EPT, see:
-+ http://ark.intel.com/Products/VirtualizationTechnology
-+ (Most Core i3/5/7 support EPT)
-+
-+ To see if your AMD processor supports RVI, see:
-+ http://support.amd.com/us/kbarticles/Pages/GPU120AMDRVICPUsHyperVWin8.aspx
-+
-+config GRKERNSEC_CONFIG_VIRT_SOFT
-+ bool "First-gen/No Hardware Virtualization"
-+ help
-+ Choose this option if you use an Atom/Pentium/Core 2 processor that either doesn't
-+ support hardware virtualization or doesn't support the EPT/RVI extensions.
-+
-+endchoice
-+
-+choice
-+ prompt "Virtualization Software"
-+ depends on (GRKERNSEC && GRKERNSEC_CONFIG_AUTO && (GRKERNSEC_CONFIG_VIRT_GUEST || GRKERNSEC_CONFIG_VIRT_HOST))
-+ help
-+
-+config GRKERNSEC_CONFIG_VIRT_XEN
-+ bool "Xen"
-+ help
-+ Choose this option if this kernel is running as a Xen guest or host.
-+
-+config GRKERNSEC_CONFIG_VIRT_VMWARE
-+ bool "VMWare"
-+ help
-+ Choose this option if this kernel is running as a VMWare guest or host.
-+
-+config GRKERNSEC_CONFIG_VIRT_KVM
-+ bool "KVM"
-+ help
-+ Choose this option if this kernel is running as a KVM guest or host.
-+
-+config GRKERNSEC_CONFIG_VIRT_VIRTUALBOX
-+ bool "VirtualBox"
-+ help
-+ Choose this option if this kernel is running as a VirtualBox guest or host.
-+
-+endchoice
-+
-+choice
-+ prompt "Required Priorities"
-+ depends on (GRKERNSEC && GRKERNSEC_CONFIG_AUTO)
-+ default GRKERNSEC_CONFIG_PRIORITY_PERF
-+ help
-+
-+config GRKERNSEC_CONFIG_PRIORITY_PERF
-+ bool "Performance"
-+ help
-+ Choose this option if performance is of highest priority for this deployment
-+ of grsecurity. Features like UDEREF on a 64bit kernel, kernel stack clearing,
-+ and freed memory sanitizing will be disabled.
-+
-+config GRKERNSEC_CONFIG_PRIORITY_SECURITY
-+ bool "Security"
-+ help
-+ Choose this option if security is of highest priority for this deployment of
-+ grsecurity. UDEREF, kernel stack clearing, and freed memory sanitizing will
-+ be enabled for this kernel. In a worst-case scenario, these features can
-+ introduce a 20% performance hit (UDEREF on x64 contributing half of this hit).
-+
-+endchoice
-+
-+menu "Default Special Groups"
-+depends on (GRKERNSEC && GRKERNSEC_CONFIG_AUTO)
-+
-+config GRKERNSEC_PROC_GID
-+ int "GID exempted from /proc restrictions"
-+ default 1001
-+ help
-+ Setting this GID determines which group will be exempted from
-+ grsecurity's /proc restrictions, allowing users of the specified
-+ group to view network statistics and the existence of other users'
-+ processes on the system. This GID may also be chosen at boot time
-+ via "grsec_proc_gid=" on the kernel commandline.
-+
-+config GRKERNSEC_TPE_UNTRUSTED_GID
-+ int "GID for TPE-untrusted users"
-+ depends on GRKERNSEC_CONFIG_SERVER && GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
-+ default 1005
-+ help
-+ Setting this GID determines which group untrusted users should
-+ be added to. These users will be placed under grsecurity's Trusted Path
-+ Execution mechanism, preventing them from executing their own binaries.
-+ The users will only be able to execute binaries in directories owned and
-+ writable only by the root user. If the sysctl option is enabled, a sysctl
-+ option with name "tpe_gid" is created.
-+
-+config GRKERNSEC_TPE_TRUSTED_GID
-+ int "GID for TPE-trusted users"
-+ depends on GRKERNSEC_CONFIG_SERVER && GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
-+ default 1005
-+ help
-+ Setting this GID determines what group TPE restrictions will be
-+ *disabled* for. If the sysctl option is enabled, a sysctl option
-+ with name "tpe_gid" is created.
-+
-+config GRKERNSEC_SYMLINKOWN_GID
-+ int "GID for users with kernel-enforced SymlinksIfOwnerMatch"
-+ depends on GRKERNSEC_CONFIG_SERVER
-+ default 1006
-+ help
-+ Setting this GID determines what group kernel-enforced
-+ SymlinksIfOwnerMatch will be enabled for. If the sysctl option
-+ is enabled, a sysctl option with name "symlinkown_gid" is created.
-+
-+
-+endmenu
-+
-+menu "Customize Configuration"
-+depends on GRKERNSEC
-+
-+menu "PaX"
-+
-+config PAX
-+ bool "Enable various PaX features"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC && (ALPHA || ARM || AVR32 || IA64 || MIPS || PARISC || PPC || SPARC || X86)
-+ help
-+ This allows you to enable various PaX features. PaX adds
-+ intrusion prevention mechanisms to the kernel that reduce
-+ the risks posed by exploitable memory corruption bugs.
-+
-+menu "PaX Control"
-+ depends on PAX
-+
-+config PAX_SOFTMODE
-+ bool 'Support soft mode'
-+ help
-+ Enabling this option will allow you to run PaX in soft mode, that
-+ is, PaX features will not be enforced by default, only on executables
-+ marked explicitly. You must also enable PT_PAX_FLAGS or XATTR_PAX_FLAGS
-+ support as they are the only way to mark executables for soft mode use.
-+
-+ Soft mode can be activated by using the "pax_softmode=1" kernel command
-+ line option on boot. Furthermore you can control various PaX features
-+ at runtime via the entries in /proc/sys/kernel/pax.
-+
-+config PAX_EI_PAX
-+ bool 'Use legacy ELF header marking'
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ Enabling this option will allow you to control PaX features on
-+ a per executable basis via the 'chpax' utility available at
-+ http://pax.grsecurity.net/. The control flags will be read from
-+ an otherwise reserved part of the ELF header. This marking has
-+ numerous drawbacks (no support for soft-mode, toolchain does not
-+ know about the non-standard use of the ELF header) therefore it
-+ has been deprecated in favour of PT_PAX_FLAGS and XATTR_PAX_FLAGS
-+ support.
-+
-+ Note that if you enable PT_PAX_FLAGS or XATTR_PAX_FLAGS marking
-+ support as well, they will override the legacy EI_PAX marks.
-+
-+ If you enable none of the marking options then all applications
-+ will run with PaX enabled on them by default.
-+
-+config PAX_PT_PAX_FLAGS
-+ bool 'Use ELF program header marking'
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ Enabling this option will allow you to control PaX features on
-+ a per executable basis via the 'paxctl' utility available at
-+ http://pax.grsecurity.net/. The control flags will be read from
-+ a PaX specific ELF program header (PT_PAX_FLAGS). This marking
-+ has the benefits of supporting both soft mode and being fully
-+ integrated into the toolchain (the binutils patch is available
-+ from http://pax.grsecurity.net).
-+
-+ Note that if you enable the legacy EI_PAX marking support as well,
-+ the EI_PAX marks will be overridden by the PT_PAX_FLAGS marks.
-+
-+ If you enable both PT_PAX_FLAGS and XATTR_PAX_FLAGS support then you
-+ must make sure that the marks are the same if a binary has both marks.
-+
-+ If you enable none of the marking options then all applications
-+ will run with PaX enabled on them by default.
-+
-+config PAX_XATTR_PAX_FLAGS
-+ bool 'Use filesystem extended attributes marking'
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ select CIFS_XATTR if CIFS
-+ select EXT2_FS_XATTR if EXT2_FS
-+ select EXT3_FS_XATTR if EXT3_FS
-+ select EXT4_FS_XATTR if EXT4_FS
-+ select JFFS2_FS_XATTR if JFFS2_FS
-+ select REISERFS_FS_XATTR if REISERFS_FS
-+ select UBIFS_FS_XATTR if UBIFS_FS
-+ help
-+ Enabling this option will allow you to control PaX features on
-+ a per executable basis via the 'setfattr' utility. The control
-+ flags will be read from the user.pax.flags extended attribute of
-+ the file. This marking has the benefit of supporting binary-only
-+ applications that self-check themselves (e.g., skype) and would
-+ not tolerate chpax/paxctl changes. The main drawback is that
-+ extended attributes are not supported by some filesystems (e.g.,
-+ isofs, squashfs, tmpfs, udf, vfat) so copying files through such
-+ filesystems will lose the extended attributes and these PaX markings.
-+
-+ Note that if you enable the legacy EI_PAX marking support as well,
-+ the EI_PAX marks will be overridden by the XATTR_PAX_FLAGS marks.
-+
-+ If you enable both PT_PAX_FLAGS and XATTR_PAX_FLAGS support then you
-+ must make sure that the marks are the same if a binary has both marks.
-+
-+ If you enable none of the marking options then all applications
-+ will run with PaX enabled on them by default.
-+
-+choice
-+ prompt 'MAC system integration'
-+ default PAX_HAVE_ACL_FLAGS
-+ help
-+ Mandatory Access Control systems have the option of controlling
-+ PaX flags on a per executable basis, choose the method supported
-+ by your particular system.
-+
-+ - "none": if your MAC system does not interact with PaX,
-+ - "direct": if your MAC system defines pax_set_initial_flags() itself,
-+ - "hook": if your MAC system uses the pax_set_initial_flags_func callback.
-+
-+ NOTE: this option is for developers/integrators only.
-+
-+ config PAX_NO_ACL_FLAGS
-+ bool 'none'
-+
-+ config PAX_HAVE_ACL_FLAGS
-+ bool 'direct'
-+
-+ config PAX_HOOK_ACL_FLAGS
-+ bool 'hook'
-+endchoice
-+
-+endmenu
-+
-+menu "Non-executable pages"
-+ depends on PAX
-+
-+config PAX_NOEXEC
-+ bool "Enforce non-executable pages"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on ALPHA || (ARM && (CPU_V6 || CPU_V7)) || IA64 || MIPS || PARISC || PPC || S390 || SPARC || X86
-+ help
-+ By design some architectures do not allow for protecting memory
-+ pages against execution or even if they do, Linux does not make
-+ use of this feature. In practice this means that if a page is
-+ readable (such as the stack or heap) it is also executable.
-+
-+ There is a well known exploit technique that makes use of this
-+ fact and a common programming mistake where an attacker can
-+ introduce code of his choice somewhere in the attacked program's
-+ memory (typically the stack or the heap) and then execute it.
-+
-+ If the attacked program was running with different (typically
-+ higher) privileges than that of the attacker, then he can elevate
-+ his own privilege level (e.g. get a root shell, write to files for
-+ which he does not have write access to, etc).
-+
-+ Enabling this option will let you choose from various features
-+ that prevent the injection and execution of 'foreign' code in
-+ a program.
-+
-+ This will also break programs that rely on the old behaviour and
-+ expect that dynamically allocated memory via the malloc() family
-+ of functions is executable (which it is not). Notable examples
-+ are the XFree86 4.x server, the java runtime and wine.
-+
-+config PAX_PAGEEXEC
-+ bool "Paging based non-executable pages"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on PAX_NOEXEC && (!X86_32 || M586 || M586TSC || M586MMX || M686 || MPENTIUMII || MPENTIUMIII || MPENTIUMM || MCORE2 || MATOM || MPENTIUM4 || MPSC || MK7 || MK8 || MWINCHIPC6 || MWINCHIP2 || MWINCHIP3D || MVIAC3_2 || MVIAC7)
-+ select S390_SWITCH_AMODE if S390
-+ select S390_EXEC_PROTECT if S390
-+ select ARCH_TRACK_EXEC_LIMIT if X86_32
-+ help
-+ This implementation is based on the paging feature of the CPU.
-+ On i386 without hardware non-executable bit support there is a
-+ variable but usually low performance impact, however on Intel's
-+ P4 core based CPUs it is very high so you should not enable this
-+ for kernels meant to be used on such CPUs.
-+
-+ On alpha, avr32, ia64, parisc, sparc, sparc64, x86_64 and i386
-+ with hardware non-executable bit support there is no performance
-+ impact, on ppc the impact is negligible.
-+
-+ Note that several architectures require various emulations due to
-+ badly designed userland ABIs, this will cause a performance impact
-+ but will disappear as soon as userland is fixed. For example, ppc
-+ userland MUST have been built with secure-plt by a recent toolchain.
-+
-+config PAX_SEGMEXEC
-+ bool "Segmentation based non-executable pages"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on PAX_NOEXEC && X86_32
-+ help
-+ This implementation is based on the segmentation feature of the
-+ CPU and has a very small performance impact, however applications
-+ will be limited to a 1.5 GB address space instead of the normal
-+ 3 GB.
-+
-+config PAX_EMUTRAMP
-+ bool "Emulate trampolines" if (PAX_PAGEEXEC || PAX_SEGMEXEC) && (PARISC || X86)
-+ default y if PARISC
-+ help
-+ There are some programs and libraries that for one reason or
-+ another attempt to execute special small code snippets from
-+ non-executable memory pages. Most notable examples are the
-+ signal handler return code generated by the kernel itself and
-+ the GCC trampolines.
-+
-+ If you enabled CONFIG_PAX_PAGEEXEC or CONFIG_PAX_SEGMEXEC then
-+ such programs will no longer work under your kernel.
-+
-+ As a remedy you can say Y here and use the 'chpax' or 'paxctl'
-+ utilities to enable trampoline emulation for the affected programs
-+ yet still have the protection provided by the non-executable pages.
-+
-+ On parisc you MUST enable this option and EMUSIGRT as well, otherwise
-+ your system will not even boot.
-+
-+ Alternatively you can say N here and use the 'chpax' or 'paxctl'
-+ utilities to disable CONFIG_PAX_PAGEEXEC and CONFIG_PAX_SEGMEXEC
-+ for the affected files.
-+
-+ NOTE: enabling this feature *may* open up a loophole in the
-+ protection provided by non-executable pages that an attacker
-+ could abuse. Therefore the best solution is to not have any
-+ files on your system that would require this option. This can
-+ be achieved by not using libc5 (which relies on the kernel
-+ signal handler return code) and not using or rewriting programs
-+ that make use of the nested function implementation of GCC.
-+ Skilled users can just fix GCC itself so that it implements
-+ nested function calls in a way that does not interfere with PaX.
-+
-+config PAX_EMUSIGRT
-+ bool "Automatically emulate sigreturn trampolines"
-+ depends on PAX_EMUTRAMP && PARISC
-+ default y
-+ help
-+ Enabling this option will have the kernel automatically detect
-+ and emulate signal return trampolines executing on the stack
-+ that would otherwise lead to task termination.
-+
-+ This solution is intended as a temporary one for users with
-+ legacy versions of libc (libc5, glibc 2.0, uClibc before 0.9.17,
-+ Modula-3 runtime, etc) or executables linked to such, basically
-+ everything that does not specify its own SA_RESTORER function in
-+ normal executable memory like glibc 2.1+ does.
-+
-+ On parisc you MUST enable this option, otherwise your system will
-+ not even boot.
-+
-+ NOTE: this feature cannot be disabled on a per executable basis
-+ and since it *does* open up a loophole in the protection provided
-+ by non-executable pages, the best solution is to not have any
-+ files on your system that would require this option.
-+
-+config PAX_MPROTECT
-+ bool "Restrict mprotect()"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on (PAX_PAGEEXEC || PAX_SEGMEXEC)
-+ help
-+ Enabling this option will prevent programs from
-+ - changing the executable status of memory pages that were
-+ not originally created as executable,
-+ - making read-only executable pages writable again,
-+ - creating executable pages from anonymous memory,
-+ - making read-only-after-relocations (RELRO) data pages writable again.
-+
-+ You should say Y here to complete the protection provided by
-+ the enforcement of non-executable pages.
-+
-+ NOTE: you can use the 'chpax' or 'paxctl' utilities to control
-+ this feature on a per file basis.
-+
-+config PAX_MPROTECT_COMPAT
-+ bool "Use legacy/compat protection demoting (read help)"
-+ default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_DESKTOP)
-+ depends on PAX_MPROTECT
-+ help
-+ The current implementation of PAX_MPROTECT denies RWX allocations/mprotects
-+ by sending the proper error code to the application. For some broken
-+ userland, this can cause problems with Python or other applications. The
-+ current implementation however allows for applications like clamav to
-+ detect if JIT compilation/execution is allowed and to fall back gracefully
-+ to an interpreter-based mode if it does not. While we encourage everyone
-+ to use the current implementation as-is and push upstream to fix broken
-+ userland (note that the RWX logging option can assist with this), in some
-+ environments this may not be possible. Having to disable MPROTECT
-+ completely on certain binaries reduces the security benefit of PaX,
-+ so this option is provided for those environments to revert to the old
-+ behavior.
-+
-+config PAX_ELFRELOCS
-+ bool "Allow ELF text relocations (read help)"
-+ depends on PAX_MPROTECT
-+ default n
-+ help
-+ Non-executable pages and mprotect() restrictions are effective
-+ in preventing the introduction of new executable code into an
-+ attacked task's address space. There remain only two venues
-+ for this kind of attack: if the attacker can execute already
-+ existing code in the attacked task then he can either have it
-+ create and mmap() a file containing his code or have it mmap()
-+ an already existing ELF library that does not have position
-+ independent code in it and use mprotect() on it to make it
-+ writable and copy his code there. While protecting against
-+ the former approach is beyond PaX, the latter can be prevented
-+ by having only PIC ELF libraries on one's system (which do not
-+ need to relocate their code). If you are sure this is your case,
-+ as is the case with all modern Linux distributions, then leave
-+ this option disabled. You should say 'n' here.
-+
-+config PAX_ETEXECRELOCS
-+ bool "Allow ELF ET_EXEC text relocations"
-+ depends on PAX_MPROTECT && (ALPHA || IA64 || PARISC)
-+ select PAX_ELFRELOCS
-+ default y
-+ help
-+ On some architectures there are incorrectly created applications
-+ that require text relocations and would not work without enabling
-+ this option. If you are an alpha, ia64 or parisc user, you should
-+ enable this option and disable it once you have made sure that
-+ none of your applications need it.
-+
-+config PAX_EMUPLT
-+ bool "Automatically emulate ELF PLT"
-+ depends on PAX_MPROTECT && (ALPHA || PARISC || SPARC)
-+ default y
-+ help
-+ Enabling this option will have the kernel automatically detect
-+ and emulate the Procedure Linkage Table entries in ELF files.
-+ On some architectures such entries are in writable memory, and
-+ become non-executable leading to task termination. Therefore
-+ it is mandatory that you enable this option on alpha, parisc,
-+ sparc and sparc64, otherwise your system would not even boot.
-+
-+ NOTE: this feature *does* open up a loophole in the protection
-+ provided by the non-executable pages, therefore the proper
-+ solution is to modify the toolchain to produce a PLT that does
-+ not need to be writable.
-+
-+config PAX_DLRESOLVE
-+ bool 'Emulate old glibc resolver stub'
-+ depends on PAX_EMUPLT && SPARC
-+ default n
-+ help
-+ This option is needed if userland has an old glibc (before 2.4)
-+ that puts a 'save' instruction into the runtime generated resolver
-+ stub that needs special emulation.
-+
-+config PAX_KERNEXEC
-+ bool "Enforce non-executable kernel pages"
-+ default y if GRKERNSEC_CONFIG_AUTO && (GRKERNSEC_CONFIG_VIRT_NONE || (GRKERNSEC_CONFIG_VIRT_EPT && GRKERNSEC_CONFIG_VIRT_GUEST) || (GRKERNSEC_CONFIG_VIRT_EPT && GRKERNSEC_CONFIG_VIRT_KVM))
-+ depends on X86 && (!X86_32 || X86_WP_WORKS_OK) && !XEN
-+ select PAX_PER_CPU_PGD if X86_64 || (X86_32 && X86_PAE)
-+ select PAX_KERNEXEC_PLUGIN if X86_64
-+ help
-+ This is the kernel land equivalent of PAGEEXEC and MPROTECT,
-+ that is, enabling this option will make it harder to inject
-+ and execute 'foreign' code in kernel memory itself.
-+
-+choice
-+ prompt "Return Address Instrumentation Method"
-+ default PAX_KERNEXEC_PLUGIN_METHOD_BTS
-+ depends on PAX_KERNEXEC_PLUGIN
-+ help
-+ Select the method used to instrument function pointer dereferences.
-+ Note that binary modules cannot be instrumented by this approach.
-+
-+ Note that the implementation requires a gcc with plugin support,
-+ i.e., gcc 4.5 or newer. You may need to install the supporting
-+ headers explicitly in addition to the normal gcc package.
-+
-+ config PAX_KERNEXEC_PLUGIN_METHOD_BTS
-+ bool "bts"
-+ help
-+ This method is compatible with binary only modules but has
-+ a higher runtime overhead.
-+
-+ config PAX_KERNEXEC_PLUGIN_METHOD_OR
-+ bool "or"
-+ depends on !PARAVIRT
-+ help
-+ This method is incompatible with binary only modules but has
-+ a lower runtime overhead.
-+endchoice
-+
-+config PAX_KERNEXEC_PLUGIN_METHOD
-+ string
-+ default "bts" if PAX_KERNEXEC_PLUGIN_METHOD_BTS
-+ default "or" if PAX_KERNEXEC_PLUGIN_METHOD_OR
-+ default ""
-+
-+config PAX_KERNEXEC_MODULE_TEXT
-+ int "Minimum amount of memory reserved for module code"
-+ default "4" if (!GRKERNSEC_CONFIG_AUTO || GRKERNSEC_CONFIG_SERVER)
-+ default "12" if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_DESKTOP)
-+ depends on PAX_KERNEXEC && X86_32 && MODULES
-+ help
-+ Due to implementation details the kernel must reserve a fixed
-+ amount of memory for module code at compile time that cannot be
-+ changed at runtime. Here you can specify the minimum amount
-+ in MB that will be reserved. Due to the same implementation
-+ details this size will always be rounded up to the next 2/4 MB
-+ boundary (depends on PAE) so the actually available memory for
-+ module code will usually be more than this minimum.
-+
-+ The default 4 MB should be enough for most users but if you have
-+ an excessive number of modules (e.g., most distribution configs
-+ compile many drivers as modules) or use huge modules such as
-+ nvidia's kernel driver, you will need to adjust this amount.
-+ A good rule of thumb is to look at your currently loaded kernel
-+ modules and add up their sizes.
-+
-+endmenu
-+
-+menu "Address Space Layout Randomization"
-+ depends on PAX
-+
-+config PAX_ASLR
-+ bool "Address Space Layout Randomization"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ Many if not most exploit techniques rely on the knowledge of
-+ certain addresses in the attacked program. The following options
-+ will allow the kernel to apply a certain amount of randomization
-+ to specific parts of the program thereby forcing an attacker to
-+ guess them in most cases. Any failed guess will most likely crash
-+ the attacked program which allows the kernel to detect such attempts
-+ and react on them. PaX itself provides no reaction mechanisms,
-+ instead it is strongly encouraged that you make use of Nergal's
-+ segvguard (ftp://ftp.pl.openwall.com/misc/segvguard/) or grsecurity's
-+ (http://www.grsecurity.net/) built-in crash detection features or
-+ develop one yourself.
-+
-+ By saying Y here you can choose to randomize the following areas:
-+ - top of the task's kernel stack
-+ - top of the task's userland stack
-+ - base address for mmap() requests that do not specify one
-+ (this includes all libraries)
-+ - base address of the main executable
-+
-+ It is strongly recommended to say Y here as address space layout
-+ randomization has negligible impact on performance yet it provides
-+ a very effective protection.
-+
-+ NOTE: you can use the 'chpax' or 'paxctl' utilities to control
-+ this feature on a per file basis.
-+
-+config PAX_RANDKSTACK
-+ bool "Randomize kernel stack base"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on X86_TSC && X86
-+ help
-+ By saying Y here the kernel will randomize every task's kernel
-+ stack on every system call. This will not only force an attacker
-+ to guess it but also prevent him from making use of possible
-+ leaked information about it.
-+
-+ Since the kernel stack is a rather scarce resource, randomization
-+ may cause unexpected stack overflows, therefore you should very
-+ carefully test your system. Note that once enabled in the kernel
-+ configuration, this feature cannot be disabled on a per file basis.
-+
-+config PAX_RANDUSTACK
-+ bool "Randomize user stack base"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on PAX_ASLR
-+ help
-+ By saying Y here the kernel will randomize every task's userland
-+ stack. The randomization is done in two steps where the second
-+ one may apply a big amount of shift to the top of the stack and
-+ cause problems for programs that want to use lots of memory (more
-+ than 2.5 GB if SEGMEXEC is not active, or 1.25 GB when it is).
-+ For this reason the second step can be controlled by 'chpax' or
-+ 'paxctl' on a per file basis.
-+
-+config PAX_RANDMMAP
-+ bool "Randomize mmap() base"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on PAX_ASLR
-+ help
-+ By saying Y here the kernel will use a randomized base address for
-+ mmap() requests that do not specify one themselves. As a result
-+ all dynamically loaded libraries will appear at random addresses
-+ and therefore be harder to exploit by a technique where an attacker
-+ attempts to execute library code for his purposes (e.g. spawn a
-+ shell from an exploited program that is running at an elevated
-+ privilege level).
-+
-+ Furthermore, if a program is relinked as a dynamic ELF file, its
-+ base address will be randomized as well, completing the full
-+ randomization of the address space layout. Attacking such programs
-+ becomes a guess game. You can find an example of doing this at
-+ http://pax.grsecurity.net/et_dyn.tar.gz and practical samples at
-+ http://www.grsecurity.net/grsec-gcc-specs.tar.gz .
-+
-+ NOTE: you can use the 'chpax' or 'paxctl' utilities to control this
-+ feature on a per file basis.
-+
-+endmenu
-+
-+menu "Miscellaneous hardening features"
-+
-+config PAX_MEMORY_SANITIZE
-+ bool "Sanitize all freed memory"
-+ default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_PRIORITY_SECURITY)
-+ depends on !HIBERNATION
-+ help
-+ By saying Y here the kernel will erase memory pages as soon as they
-+ are freed. This in turn reduces the lifetime of data stored in the
-+ pages, making it less likely that sensitive information such as
-+ passwords, cryptographic secrets, etc stay in memory for too long.
-+
-+ This is especially useful for programs whose runtime is short, long
-+ lived processes and the kernel itself benefit from this as long as
-+ they operate on whole memory pages and ensure timely freeing of pages
-+ that may hold sensitive information.
-+
-+ The tradeoff is performance impact, on a single CPU system kernel
-+ compilation sees a 3% slowdown, other systems and workloads may vary
-+ and you are advised to test this feature on your expected workload
-+ before deploying it.
-+
-+ Note that this feature does not protect data stored in live pages,
-+ e.g., process memory swapped to disk may stay there for a long time.
-+
-+config PAX_MEMORY_STACKLEAK
-+ bool "Sanitize kernel stack"
-+ default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_PRIORITY_SECURITY)
-+ depends on X86
-+ help
-+ By saying Y here the kernel will erase the kernel stack before it
-+ returns from a system call. This in turn reduces the information
-+ that a kernel stack leak bug can reveal.
-+
-+ Note that such a bug can still leak information that was put on
-+ the stack by the current system call (the one eventually triggering
-+ the bug) but traces of earlier system calls on the kernel stack
-+ cannot leak anymore.
-+
-+ The tradeoff is performance impact, on a single CPU system kernel
-+ compilation sees a 1% slowdown, other systems and workloads may vary
-+ and you are advised to test this feature on your expected workload
-+ before deploying it.
-+
-+ Note that the full feature requires a gcc with plugin support,
-+ i.e., gcc 4.5 or newer. You may need to install the supporting
-+ headers explicitly in addition to the normal gcc package. Using
-+ older gcc versions means that functions with large enough stack
-+ frames may leave uninitialized memory behind that may be exposed
-+ to a later syscall leaking the stack.
-+
-+config PAX_MEMORY_UDEREF
-+ bool "Prevent invalid userland pointer dereference"
-+ default y if GRKERNSEC_CONFIG_AUTO && (X86_32 || (X86_64 && GRKERNSEC_CONFIG_PRIORITY_SECURITY)) && (GRKERNSEC_CONFIG_VIRT_NONE || GRKERNSEC_CONFIG_VIRT_EPT)
-+ depends on X86 && !UML_X86 && !XEN
-+ select PAX_PER_CPU_PGD if X86_64
-+ help
-+ By saying Y here the kernel will be prevented from dereferencing
-+ userland pointers in contexts where the kernel expects only kernel
-+ pointers. This is both a useful runtime debugging feature and a
-+ security measure that prevents exploiting a class of kernel bugs.
-+
-+ The tradeoff is that some virtualization solutions may experience
-+ a huge slowdown and therefore you should not enable this feature
-+ for kernels meant to run in such environments. Whether a given VM
-+ solution is affected or not is best determined by simply trying it
-+ out, the performance impact will be obvious right on boot as this
-+ mechanism engages from very early on. A good rule of thumb is that
-+ VMs running on CPUs without hardware virtualization support (i.e.,
-+ the majority of IA-32 CPUs) will likely experience the slowdown.
-+
-+config PAX_REFCOUNT
-+ bool "Prevent various kernel object reference counter overflows"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on GRKERNSEC && ((ARM && (CPU_32v6 || CPU_32v6K || CPU_32v7)) || SPARC64 || X86)
-+ help
-+ By saying Y here the kernel will detect and prevent overflowing
-+ various (but not all) kinds of object reference counters. Such
-+ overflows can normally occur due to bugs only and are often, if
-+ not always, exploitable.
-+
-+ The tradeoff is that data structures protected by an overflowed
-+ refcount will never be freed and therefore will leak memory. Note
-+ that this leak also happens even without this protection but in
-+ that case the overflow can eventually trigger the freeing of the
-+ data structure while it is still being used elsewhere, resulting
-+ in the exploitable situation that this feature prevents.
-+
-+ Since this has a negligible performance impact, you should enable
-+ this feature.
-+
-+config PAX_USERCOPY
-+ bool "Harden heap object copies between kernel and userland"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on ARM || IA64 || PPC || SPARC || X86
-+ depends on GRKERNSEC && (SLAB || SLUB || SLOB)
-+ select PAX_USERCOPY_SLABS
-+ help
-+ By saying Y here the kernel will enforce the size of heap objects
-+ when they are copied in either direction between the kernel and
-+ userland, even if only a part of the heap object is copied.
-+
-+ Specifically, this checking prevents information leaking from the
-+ kernel heap during kernel to userland copies (if the kernel heap
-+ object is otherwise fully initialized) and prevents kernel heap
-+ overflows during userland to kernel copies.
-+
-+ Note that the current implementation provides the strictest bounds
-+ checks for the SLUB allocator.
-+
-+ Enabling this option also enables per-slab cache protection against
-+ data in a given cache being copied into/out of via userland
-+ accessors. Though the whitelist of regions will be reduced over
-+ time, it notably protects important data structures like task structs.
-+
-+ Since this has a negligible performance impact, you should enable
-+ this feature.
-+
-+
-+config PAX_USERCOPY_DEBUG
-+ bool
-+ depends on X86 && PAX_USERCOPY
-+ default n
-+
-+config PAX_SIZE_OVERFLOW
-+ bool "Prevent various integer overflows in function size parameters"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on X86
-+ help
-+ By saying Y here the kernel recomputes expressions of function
-+ arguments marked by a size_overflow attribute with double integer
-+ precision (DImode/TImode for 32/64 bit integer types).
-+
-+ The recomputed argument is checked against TYPE_MAX and an event
-+ is logged on overflow and the triggering process is killed.
-+
-+ Homepage: http://www.grsecurity.net/~ephox/overflow_plugin/
-+
-+ Note that the implementation requires a gcc with plugin support,
-+ i.e., gcc 4.5 or newer. You may need to install the supporting
-+ headers explicitly in addition to the normal gcc package.
-+
-+config PAX_LATENT_ENTROPY
-+ bool "Generate some entropy during boot"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ By saying Y here the kernel will instrument early boot code to
-+ extract some entropy from both original and artificially created
-+ program state. This will help especially embedded systems where
-+ there is little 'natural' source of entropy normally. The cost
-+ is some slowdown of the boot process.
-+
-+ Note that the implementation requires a gcc with plugin support,
-+ i.e., gcc 4.5 or newer. You may need to install the supporting
-+ headers explicitly in addition to the normal gcc package.
-+
-+ Note that entropy extracted this way is not cryptographically
-+ secure!
-+
-+endmenu
-+
-+endmenu
-+
-+source grsecurity/Kconfig
-+
-+endmenu
-+
-+endmenu
-+
- config KEYS
- bool "Enable access key retention support"
- help
-@@ -146,7 +1036,7 @@ config INTEL_TXT
- config LSM_MMAP_MIN_ADDR
- int "Low address space for LSM to protect from user allocation"
- depends on SECURITY && SECURITY_SELINUX
-- default 65536
-+ default 32768
- help
- This is the portion of low virtual memory which should be protected
- from userspace allocation. Keeping a user from writing to low pages
-diff --git a/security/capability.c b/security/capability.c
-index fce07a7..5f12858 100644
---- a/security/capability.c
-+++ b/security/capability.c
-@@ -890,7 +890,7 @@ static void cap_audit_rule_free(void *lsmrule)
- }
- #endif /* CONFIG_AUDIT */
-
--struct security_operations default_security_ops = {
-+struct security_operations default_security_ops __read_only = {
- .name = "default",
- };
-
-diff --git a/security/commoncap.c b/security/commoncap.c
-index ee9d623..11b4a78 100644
---- a/security/commoncap.c
-+++ b/security/commoncap.c
-@@ -27,7 +27,9 @@
- #include <linux/sched.h>
- #include <linux/prctl.h>
- #include <linux/securebits.h>
-+#include <linux/syslog.h>
- #include <linux/personality.h>
-+#include <net/sock.h>
-
- /*
- * If a non-root user executes a setuid-root binary in
-@@ -51,9 +53,18 @@ static void warn_setuid_and_fcaps_mixed(char *fname)
- }
- }
-
-+#ifdef CONFIG_NET
-+extern kernel_cap_t gr_cap_rtnetlink(struct sock *sk);
-+#endif
-+
- int cap_netlink_send(struct sock *sk, struct sk_buff *skb)
- {
-+#ifdef CONFIG_NET
-+ NETLINK_CB(skb).eff_cap = gr_cap_rtnetlink(sk);
-+#else
- NETLINK_CB(skb).eff_cap = current_cap();
-+#endif
-+
- return 0;
- }
-
-@@ -240,6 +251,45 @@ static inline void bprm_clear_caps(struct linux_binprm *bprm)
- bprm->cap_effective = false;
- }
-
-+/* returns:
-+ 1 for suid privilege
-+ 2 for sgid privilege
-+ 3 for fscap privilege
-+*/
-+int is_privileged_binary(const struct dentry *dentry)
-+{
-+ struct cpu_vfs_cap_data capdata;
-+ struct inode *inode = dentry->d_inode;
-+
-+ if (!inode || S_ISDIR(inode->i_mode))
-+ return 0;
-+
-+ if (inode->i_mode & S_ISUID)
-+ return 1;
-+ if ((inode->i_mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))
-+ return 2;
-+
-+ if (!get_vfs_caps_from_disk(dentry, &capdata)) {
-+ if (!cap_isclear(capdata.inheritable) || !cap_isclear(capdata.permitted))
-+ return 3;
-+ }
-+
-+ return 0;
-+}
-+
-+/* returns 1 for suid root privilege
-+ returns 3 for fscap privilege
-+*/
-+int is_root_privileged_binary(const struct dentry *dentry)
-+{
-+ int ret = is_privileged_binary(dentry);
-+ if (ret == 3)
-+ return ret;
-+ if (ret == 1 && dentry->d_inode->i_uid == 0)
-+ return ret;
-+ return 0;
-+}
-+
- #ifdef CONFIG_SECURITY_FILE_CAPABILITIES
-
- /**
-@@ -588,6 +638,9 @@ int cap_bprm_secureexec(struct linux_binprm *bprm)
- {
- const struct cred *cred = current_cred();
-
-+ if (gr_acl_enable_at_secure())
-+ return 1;
-+
- if (cred->uid != 0) {
- if (bprm->cap_effective)
- return 1;
-@@ -962,13 +1015,18 @@ error:
- /**
- * cap_syslog - Determine whether syslog function is permitted
- * @type: Function requested
-+ * @from_file: Whether this request came from an open file (i.e. /proc)
- *
- * Determine whether the current process is permitted to use a particular
- * syslog function, returning 0 if permission is granted, -ve if not.
- */
--int cap_syslog(int type)
-+int cap_syslog(int type, bool from_file)
- {
-- if ((type != 3 && type != 10) && !capable(CAP_SYS_ADMIN))
-+ /* /proc/kmsg can open be opened by CAP_SYS_ADMIN */
-+ if (type != SYSLOG_ACTION_OPEN && from_file)
-+ return 0;
-+ if ((type != SYSLOG_ACTION_READ_ALL &&
-+ type != SYSLOG_ACTION_SIZE_BUFFER) && !capable(CAP_SYS_ADMIN))
- return -EPERM;
- return 0;
- }
-diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
-index 165eb53..b1db4eb 100644
---- a/security/integrity/ima/ima.h
-+++ b/security/integrity/ima/ima.h
-@@ -84,8 +84,8 @@ void ima_add_violation(struct inode *inode, const unsigned char *filename,
- extern spinlock_t ima_queue_lock;
-
- struct ima_h_table {
-- atomic_long_t len; /* number of stored measurements in the list */
-- atomic_long_t violations;
-+ atomic_long_unchecked_t len; /* number of stored measurements in the list */
-+ atomic_long_unchecked_t violations;
- struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE];
- };
- extern struct ima_h_table ima_htable;
-diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
-index 852bf85..35d6df3 100644
---- a/security/integrity/ima/ima_api.c
-+++ b/security/integrity/ima/ima_api.c
-@@ -74,7 +74,7 @@ void ima_add_violation(struct inode *inode, const unsigned char *filename,
- int result;
-
- /* can overflow, only indicator */
-- atomic_long_inc(&ima_htable.violations);
-+ atomic_long_inc_unchecked(&ima_htable.violations);
-
- entry = kmalloc(sizeof(*entry), GFP_KERNEL);
- if (!entry) {
-diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
-index 0c72c9c..433e29b 100644
---- a/security/integrity/ima/ima_fs.c
-+++ b/security/integrity/ima/ima_fs.c
-@@ -27,12 +27,12 @@
- static int valid_policy = 1;
- #define TMPBUFLEN 12
- static ssize_t ima_show_htable_value(char __user *buf, size_t count,
-- loff_t *ppos, atomic_long_t *val)
-+ loff_t *ppos, atomic_long_unchecked_t *val)
- {
- char tmpbuf[TMPBUFLEN];
- ssize_t len;
-
-- len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read(val));
-+ len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read_unchecked(val));
- return simple_read_from_buffer(buf, count, ppos, tmpbuf, len);
- }
-
-diff --git a/security/integrity/ima/ima_queue.c b/security/integrity/ima/ima_queue.c
-index e19316d..339f7ae 100644
---- a/security/integrity/ima/ima_queue.c
-+++ b/security/integrity/ima/ima_queue.c
-@@ -78,7 +78,7 @@ static int ima_add_digest_entry(struct ima_template_entry *entry)
- INIT_LIST_HEAD(&qe->later);
- list_add_tail_rcu(&qe->later, &ima_measurements);
-
-- atomic_long_inc(&ima_htable.len);
-+ atomic_long_inc_unchecked(&ima_htable.len);
- key = ima_hash_key(entry->digest);
- hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]);
- return 0;
-diff --git a/security/keys/keyring.c b/security/keys/keyring.c
-index e031952..c9a535d 100644
---- a/security/keys/keyring.c
-+++ b/security/keys/keyring.c
-@@ -214,15 +214,15 @@ static long keyring_read(const struct key *keyring,
- ret = -EFAULT;
-
- for (loop = 0; loop < klist->nkeys; loop++) {
-+ key_serial_t serial;
- key = klist->keys[loop];
-+ serial = key->serial;
-
- tmp = sizeof(key_serial_t);
- if (tmp > buflen)
- tmp = buflen;
-
-- if (copy_to_user(buffer,
-- &key->serial,
-- tmp) != 0)
-+ if (copy_to_user(buffer, &serial, tmp))
- goto error;
-
- buflen -= tmp;
-diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
-index 931cfda..e71808a 100644
---- a/security/keys/process_keys.c
-+++ b/security/keys/process_keys.c
-@@ -208,7 +208,7 @@ static int install_process_keyring(void)
- ret = install_process_keyring_to_cred(new);
- if (ret < 0) {
- abort_creds(new);
-- return ret != -EEXIST ?: 0;
-+ return ret != -EEXIST ? ret : 0;
- }
-
- return commit_creds(new);
-diff --git a/security/min_addr.c b/security/min_addr.c
-index d9f9425..c28cef4 100644
---- a/security/min_addr.c
-+++ b/security/min_addr.c
-@@ -14,6 +14,7 @@ unsigned long dac_mmap_min_addr = CONFIG_DEFAULT_MMAP_MIN_ADDR;
- */
- static void update_mmap_min_addr(void)
- {
-+#ifndef SPARC
- #ifdef CONFIG_LSM_MMAP_MIN_ADDR
- if (dac_mmap_min_addr > CONFIG_LSM_MMAP_MIN_ADDR)
- mmap_min_addr = dac_mmap_min_addr;
-@@ -22,6 +23,7 @@ static void update_mmap_min_addr(void)
- #else
- mmap_min_addr = dac_mmap_min_addr;
- #endif
-+#endif
- }
-
- /*
-diff --git a/security/root_plug.c b/security/root_plug.c
-index 2f7ffa6..0455400 100644
---- a/security/root_plug.c
-+++ b/security/root_plug.c
-@@ -70,7 +70,7 @@ static int rootplug_bprm_check_security (struct linux_binprm *bprm)
- return 0;
- }
-
--static struct security_operations rootplug_security_ops = {
-+static struct security_operations rootplug_security_ops __read_only = {
- .bprm_check_security = rootplug_bprm_check_security,
- };
-
-diff --git a/security/security.c b/security/security.c
-index c4c6732..7abf13b 100644
---- a/security/security.c
-+++ b/security/security.c
-@@ -24,7 +24,7 @@ static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1];
- extern struct security_operations default_security_ops;
- extern void security_fixup_ops(struct security_operations *ops);
-
--struct security_operations *security_ops; /* Initialized to NULL */
-+struct security_operations *security_ops __read_only; /* Initialized to NULL */
-
- static inline int verify(struct security_operations *ops)
- {
-@@ -106,7 +106,7 @@ int __init security_module_enable(struct security_operations *ops)
- * If there is already a security module registered with the kernel,
- * an error will be returned. Otherwise %0 is returned on success.
- */
--int register_security(struct security_operations *ops)
-+int __init register_security(struct security_operations *ops)
- {
- if (verify(ops)) {
- printk(KERN_DEBUG "%s could not verify "
-@@ -199,9 +199,9 @@ int security_quota_on(struct dentry *dentry)
- return security_ops->quota_on(dentry);
- }
-
--int security_syslog(int type)
-+int security_syslog(int type, bool from_file)
- {
-- return security_ops->syslog(type);
-+ return security_ops->syslog(type, from_file);
- }
-
- int security_settime(struct timespec *ts, struct timezone *tz)
-diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
-index a106754..ca3a589 100644
---- a/security/selinux/hooks.c
-+++ b/security/selinux/hooks.c
-@@ -76,6 +76,7 @@
- #include <linux/selinux.h>
- #include <linux/mutex.h>
- #include <linux/posix-timers.h>
-+#include <linux/syslog.h>
-
- #include "avc.h"
- #include "objsec.h"
-@@ -131,7 +132,7 @@ int selinux_enabled = 1;
- * Minimal support for a secondary security module,
- * just to allow the use of the capability module.
- */
--static struct security_operations *secondary_ops;
-+static struct security_operations *secondary_ops __read_only;
-
- /* Lists of inode and superblock security structures initialized
- before the policy was loaded. */
-@@ -2050,29 +2051,30 @@ static int selinux_quota_on(struct dentry *dentry)
- return dentry_has_perm(cred, NULL, dentry, FILE__QUOTAON);
- }
-
--static int selinux_syslog(int type)
-+static int selinux_syslog(int type, bool from_file)
- {
- int rc;
-
-- rc = cap_syslog(type);
-+ rc = cap_syslog(type, from_file);
- if (rc)
- return rc;
-
- switch (type) {
-- case 3: /* Read last kernel messages */
-- case 10: /* Return size of the log buffer */
-+ case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
-+ case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
- rc = task_has_system(current, SYSTEM__SYSLOG_READ);
- break;
-- case 6: /* Disable logging to console */
-- case 7: /* Enable logging to console */
-- case 8: /* Set level of messages printed to console */
-+ case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
-+ case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
-+ /* Set level of messages printed to console */
-+ case SYSLOG_ACTION_CONSOLE_LEVEL:
- rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
- break;
-- case 0: /* Close log */
-- case 1: /* Open log */
-- case 2: /* Read from log */
-- case 4: /* Read/clear last kernel messages */
-- case 5: /* Clear ring buffer */
-+ case SYSLOG_ACTION_CLOSE: /* Close log */
-+ case SYSLOG_ACTION_OPEN: /* Open log */
-+ case SYSLOG_ACTION_READ: /* Read from log */
-+ case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
-+ case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
- default:
- rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
- break;
-@@ -5457,7 +5459,7 @@ static int selinux_key_getsecurity(struct key *key, char **_buffer)
-
- #endif
-
--static struct security_operations selinux_ops = {
-+static struct security_operations selinux_ops __read_only = {
- .name = "selinux",
-
- .ptrace_access_check = selinux_ptrace_access_check,
-@@ -5841,7 +5843,9 @@ int selinux_disable(void)
- avc_disable();
-
- /* Reset security_ops to the secondary module, dummy or capability. */
-+ pax_open_kernel();
- security_ops = secondary_ops;
-+ pax_close_kernel();
-
- /* Unregister netfilter hooks. */
- selinux_nf_ip_exit();
-diff --git a/security/selinux/include/xfrm.h b/security/selinux/include/xfrm.h
-index 13128f9..c23c736 100644
---- a/security/selinux/include/xfrm.h
-+++ b/security/selinux/include/xfrm.h
-@@ -48,7 +48,7 @@ int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall);
-
- static inline void selinux_xfrm_notify_policyload(void)
- {
-- atomic_inc(&flow_cache_genid);
-+ atomic_inc_unchecked(&flow_cache_genid);
- }
- #else
- static inline int selinux_xfrm_enabled(void)
-diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
-index ff17820..d68084c 100644
---- a/security/selinux/ss/services.c
-+++ b/security/selinux/ss/services.c
-@@ -1715,6 +1715,8 @@ int security_load_policy(void *data, size_t len)
- int rc = 0;
- struct policy_file file = { data, len }, *fp = &file;
-
-+ pax_track_stack();
-+
- if (!ss_initialized) {
- avtab_cache_init();
- if (policydb_read(&policydb, fp)) {
-diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
-index c33b6bb..b51f19e 100644
---- a/security/smack/smack_lsm.c
-+++ b/security/smack/smack_lsm.c
-@@ -157,12 +157,12 @@ static int smack_ptrace_traceme(struct task_struct *ptp)
- *
- * Returns 0 on success, error code otherwise.
- */
--static int smack_syslog(int type)
-+static int smack_syslog(int type, bool from_file)
- {
- int rc;
- char *sp = current_security();
-
-- rc = cap_syslog(type);
-+ rc = cap_syslog(type, from_file);
- if (rc != 0)
- return rc;
-
-@@ -3073,7 +3073,7 @@ static int smack_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
- return 0;
- }
-
--struct security_operations smack_ops = {
-+struct security_operations smack_ops __read_only = {
- .name = "smack",
-
- .ptrace_access_check = smack_ptrace_access_check,
-diff --git a/security/tomoyo/tomoyo.c b/security/tomoyo/tomoyo.c
-index 9548a09..9a5f384 100644
---- a/security/tomoyo/tomoyo.c
-+++ b/security/tomoyo/tomoyo.c
-@@ -275,7 +275,7 @@ static int tomoyo_dentry_open(struct file *f, const struct cred *cred)
- * tomoyo_security_ops is a "struct security_operations" which is used for
- * registering TOMOYO.
- */
--static struct security_operations tomoyo_security_ops = {
-+static struct security_operations tomoyo_security_ops __read_only = {
- .name = "tomoyo",
- .cred_alloc_blank = tomoyo_cred_alloc_blank,
- .cred_prepare = tomoyo_cred_prepare,
-diff --git a/sound/aoa/codecs/onyx.c b/sound/aoa/codecs/onyx.c
-index 84bb07d..c2ab6b6 100644
---- a/sound/aoa/codecs/onyx.c
-+++ b/sound/aoa/codecs/onyx.c
-@@ -53,7 +53,7 @@ struct onyx {
- spdif_locked:1,
- analog_locked:1,
- original_mute:2;
-- int open_count;
-+ local_t open_count;
- struct codec_info *codec_info;
-
- /* mutex serializes concurrent access to the device
-@@ -752,7 +752,7 @@ static int onyx_open(struct codec_info_item *cii,
- struct onyx *onyx = cii->codec_data;
-
- mutex_lock(&onyx->mutex);
-- onyx->open_count++;
-+ local_inc(&onyx->open_count);
- mutex_unlock(&onyx->mutex);
-
- return 0;
-@@ -764,8 +764,7 @@ static int onyx_close(struct codec_info_item *cii,
- struct onyx *onyx = cii->codec_data;
-
- mutex_lock(&onyx->mutex);
-- onyx->open_count--;
-- if (!onyx->open_count)
-+ if (local_dec_and_test(&onyx->open_count))
- onyx->spdif_locked = onyx->analog_locked = 0;
- mutex_unlock(&onyx->mutex);
-
-diff --git a/sound/aoa/codecs/onyx.h b/sound/aoa/codecs/onyx.h
-index ffd2025..df062c9 100644
---- a/sound/aoa/codecs/onyx.h
-+++ b/sound/aoa/codecs/onyx.h
-@@ -11,6 +11,7 @@
- #include <linux/i2c.h>
- #include <asm/pmac_low_i2c.h>
- #include <asm/prom.h>
-+#include <asm/local.h>
-
- /* PCM3052 register definitions */
-
-diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
-index d9c9635..bc0a5a2 100644
---- a/sound/core/oss/pcm_oss.c
-+++ b/sound/core/oss/pcm_oss.c
-@@ -1395,7 +1395,7 @@ static ssize_t snd_pcm_oss_write1(struct snd_pcm_substream *substream, const cha
- }
- } else {
- tmp = snd_pcm_oss_write2(substream,
-- (const char __force *)buf,
-+ (const char __force_kernel *)buf,
- runtime->oss.period_bytes, 0);
- if (tmp <= 0)
- goto err;
-@@ -1483,7 +1483,7 @@ static ssize_t snd_pcm_oss_read1(struct snd_pcm_substream *substream, char __use
- xfer += tmp;
- runtime->oss.buffer_used -= tmp;
- } else {
-- tmp = snd_pcm_oss_read2(substream, (char __force *)buf,
-+ tmp = snd_pcm_oss_read2(substream, (char __force_kernel *)buf,
- runtime->oss.period_bytes, 0);
- if (tmp <= 0)
- goto err;
-diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c
-index 038232d..7dd9e5c 100644
---- a/sound/core/pcm_compat.c
-+++ b/sound/core/pcm_compat.c
-@@ -30,7 +30,7 @@ static int snd_pcm_ioctl_delay_compat(struct snd_pcm_substream *substream,
- int err;
-
- fs = snd_enter_user();
-- err = snd_pcm_delay(substream, &delay);
-+ err = snd_pcm_delay(substream, (snd_pcm_sframes_t __force_user *)&delay);
- snd_leave_user(fs);
- if (err < 0)
- return err;
-diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
-index e6d2d97..4843949 100644
---- a/sound/core/pcm_native.c
-+++ b/sound/core/pcm_native.c
-@@ -2747,11 +2747,11 @@ int snd_pcm_kernel_ioctl(struct snd_pcm_substream *substream,
- switch (substream->stream) {
- case SNDRV_PCM_STREAM_PLAYBACK:
- result = snd_pcm_playback_ioctl1(NULL, substream, cmd,
-- (void __user *)arg);
-+ (void __force_user *)arg);
- break;
- case SNDRV_PCM_STREAM_CAPTURE:
- result = snd_pcm_capture_ioctl1(NULL, substream, cmd,
-- (void __user *)arg);
-+ (void __force_user *)arg);
- break;
- default:
- result = -EINVAL;
-diff --git a/sound/core/seq/seq_device.c b/sound/core/seq/seq_device.c
-index 1f99767..14636533 100644
---- a/sound/core/seq/seq_device.c
-+++ b/sound/core/seq/seq_device.c
-@@ -63,7 +63,7 @@ struct ops_list {
- int argsize; /* argument size */
-
- /* operators */
-- struct snd_seq_dev_ops ops;
-+ struct snd_seq_dev_ops *ops;
-
- /* registred devices */
- struct list_head dev_list; /* list of devices */
-@@ -332,7 +332,7 @@ int snd_seq_device_register_driver(char *id, struct snd_seq_dev_ops *entry,
-
- mutex_lock(&ops->reg_mutex);
- /* copy driver operators */
-- ops->ops = *entry;
-+ ops->ops = entry;
- ops->driver |= DRIVER_LOADED;
- ops->argsize = argsize;
-
-@@ -462,7 +462,7 @@ static int init_device(struct snd_seq_device *dev, struct ops_list *ops)
- dev->name, ops->id, ops->argsize, dev->argsize);
- return -EINVAL;
- }
-- if (ops->ops.init_device(dev) >= 0) {
-+ if (ops->ops->init_device(dev) >= 0) {
- dev->status = SNDRV_SEQ_DEVICE_REGISTERED;
- ops->num_init_devices++;
- } else {
-@@ -489,7 +489,7 @@ static int free_device(struct snd_seq_device *dev, struct ops_list *ops)
- dev->name, ops->id, ops->argsize, dev->argsize);
- return -EINVAL;
- }
-- if ((result = ops->ops.free_device(dev)) >= 0 || result == -ENXIO) {
-+ if ((result = ops->ops->free_device(dev)) >= 0 || result == -ENXIO) {
- dev->status = SNDRV_SEQ_DEVICE_FREE;
- dev->driver_data = NULL;
- ops->num_init_devices--;
-diff --git a/sound/drivers/mts64.c b/sound/drivers/mts64.c
-index 9284829..ac8e8b2 100644
---- a/sound/drivers/mts64.c
-+++ b/sound/drivers/mts64.c
-@@ -27,6 +27,7 @@
- #include <sound/initval.h>
- #include <sound/rawmidi.h>
- #include <sound/control.h>
-+#include <asm/local.h>
-
- #define CARD_NAME "Miditerminal 4140"
- #define DRIVER_NAME "MTS64"
-@@ -65,7 +66,7 @@ struct mts64 {
- struct pardevice *pardev;
- int pardev_claimed;
-
-- int open_count;
-+ local_t open_count;
- int current_midi_output_port;
- int current_midi_input_port;
- u8 mode[MTS64_NUM_INPUT_PORTS];
-@@ -695,7 +696,7 @@ static int snd_mts64_rawmidi_open(struct snd_rawmidi_substream *substream)
- {
- struct mts64 *mts = substream->rmidi->private_data;
-
-- if (mts->open_count == 0) {
-+ if (local_read(&mts->open_count) == 0) {
- /* We don't need a spinlock here, because this is just called
- if the device has not been opened before.
- So there aren't any IRQs from the device */
-@@ -703,7 +704,7 @@ static int snd_mts64_rawmidi_open(struct snd_rawmidi_substream *substream)
-
- msleep(50);
- }
-- ++(mts->open_count);
-+ local_inc(&mts->open_count);
-
- return 0;
- }
-@@ -713,8 +714,7 @@ static int snd_mts64_rawmidi_close(struct snd_rawmidi_substream *substream)
- struct mts64 *mts = substream->rmidi->private_data;
- unsigned long flags;
-
-- --(mts->open_count);
-- if (mts->open_count == 0) {
-+ if (local_dec_return(&mts->open_count) == 0) {
- /* We need the spinlock_irqsave here because we can still
- have IRQs at this point */
- spin_lock_irqsave(&mts->lock, flags);
-@@ -723,8 +723,8 @@ static int snd_mts64_rawmidi_close(struct snd_rawmidi_substream *substream)
-
- msleep(500);
-
-- } else if (mts->open_count < 0)
-- mts->open_count = 0;
-+ } else if (local_read(&mts->open_count) < 0)
-+ local_set(&mts->open_count, 0);
-
- return 0;
- }
-diff --git a/sound/drivers/opl4/opl4_lib.c b/sound/drivers/opl4/opl4_lib.c
-index 01997f2..cbc1195 100644
---- a/sound/drivers/opl4/opl4_lib.c
-+++ b/sound/drivers/opl4/opl4_lib.c
-@@ -27,7 +27,7 @@ MODULE_AUTHOR("Clemens Ladisch <clemens@ladisch.de>");
- MODULE_DESCRIPTION("OPL4 driver");
- MODULE_LICENSE("GPL");
-
--static void inline snd_opl4_wait(struct snd_opl4 *opl4)
-+static inline void snd_opl4_wait(struct snd_opl4 *opl4)
- {
- int timeout = 10;
- while ((inb(opl4->fm_port) & OPL4_STATUS_BUSY) && --timeout > 0)
-diff --git a/sound/drivers/portman2x4.c b/sound/drivers/portman2x4.c
-index 60158e2..0a0cc1a 100644
---- a/sound/drivers/portman2x4.c
-+++ b/sound/drivers/portman2x4.c
-@@ -46,6 +46,7 @@
- #include <sound/initval.h>
- #include <sound/rawmidi.h>
- #include <sound/control.h>
-+#include <asm/local.h>
-
- #define CARD_NAME "Portman 2x4"
- #define DRIVER_NAME "portman"
-@@ -83,7 +84,7 @@ struct portman {
- struct pardevice *pardev;
- int pardev_claimed;
-
-- int open_count;
-+ local_t open_count;
- int mode[PORTMAN_NUM_INPUT_PORTS];
- struct snd_rawmidi_substream *midi_input[PORTMAN_NUM_INPUT_PORTS];
- };
-diff --git a/sound/oss/sb_audio.c b/sound/oss/sb_audio.c
-index 733b014..56ce96f 100644
---- a/sound/oss/sb_audio.c
-+++ b/sound/oss/sb_audio.c
-@@ -901,7 +901,7 @@ sb16_copy_from_user(int dev,
- buf16 = (signed short *)(localbuf + localoffs);
- while (c)
- {
-- locallen = (c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
-+ locallen = ((unsigned)c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
- if (copy_from_user(lbuf8,
- userbuf+useroffs + p,
- locallen))
-diff --git a/sound/oss/swarm_cs4297a.c b/sound/oss/swarm_cs4297a.c
-index 3136c88..28ad950 100644
---- a/sound/oss/swarm_cs4297a.c
-+++ b/sound/oss/swarm_cs4297a.c
-@@ -2577,7 +2577,6 @@ static int __init cs4297a_init(void)
- {
- struct cs4297a_state *s;
- u32 pwr, id;
-- mm_segment_t fs;
- int rval;
- #ifndef CONFIG_BCM_CS4297A_CSWARM
- u64 cfg;
-@@ -2667,22 +2666,23 @@ static int __init cs4297a_init(void)
- if (!rval) {
- char *sb1250_duart_present;
-
-+#if 0
-+ mm_segment_t fs;
- fs = get_fs();
- set_fs(KERNEL_DS);
--#if 0
- val = SOUND_MASK_LINE;
- mixer_ioctl(s, SOUND_MIXER_WRITE_RECSRC, (unsigned long) &val);
- for (i = 0; i < ARRAY_SIZE(initvol); i++) {
- val = initvol[i].vol;
- mixer_ioctl(s, initvol[i].mixch, (unsigned long) &val);
- }
-+ set_fs(fs);
- // cs4297a_write_ac97(s, 0x18, 0x0808);
- #else
- // cs4297a_write_ac97(s, 0x5e, 0x180);
- cs4297a_write_ac97(s, 0x02, 0x0808);
- cs4297a_write_ac97(s, 0x18, 0x0808);
- #endif
-- set_fs(fs);
-
- list_add(&s->list, &cs4297a_devs);
-
-diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c
-index 78288db..0406809 100644
---- a/sound/pci/ac97/ac97_codec.c
-+++ b/sound/pci/ac97/ac97_codec.c
-@@ -1952,7 +1952,7 @@ static int snd_ac97_dev_disconnect(struct snd_device *device)
- }
-
- /* build_ops to do nothing */
--static struct snd_ac97_build_ops null_build_ops;
-+static const struct snd_ac97_build_ops null_build_ops;
-
- #ifdef CONFIG_SND_AC97_POWER_SAVE
- static void do_update_power(struct work_struct *work)
-diff --git a/sound/pci/ac97/ac97_patch.c b/sound/pci/ac97/ac97_patch.c
-index eeb2e23..82bf625 100644
---- a/sound/pci/ac97/ac97_patch.c
-+++ b/sound/pci/ac97/ac97_patch.c
-@@ -371,7 +371,7 @@ static int patch_yamaha_ymf743_build_spdif(struct snd_ac97 *ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_yamaha_ymf743_ops = {
-+static const struct snd_ac97_build_ops patch_yamaha_ymf743_ops = {
- .build_spdif = patch_yamaha_ymf743_build_spdif,
- .build_3d = patch_yamaha_ymf7x3_3d,
- };
-@@ -455,7 +455,7 @@ static int patch_yamaha_ymf753_post_spdif(struct snd_ac97 * ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_yamaha_ymf753_ops = {
-+static const struct snd_ac97_build_ops patch_yamaha_ymf753_ops = {
- .build_3d = patch_yamaha_ymf7x3_3d,
- .build_post_spdif = patch_yamaha_ymf753_post_spdif
- };
-@@ -502,7 +502,7 @@ static int patch_wolfson_wm9703_specific(struct snd_ac97 * ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_wolfson_wm9703_ops = {
-+static const struct snd_ac97_build_ops patch_wolfson_wm9703_ops = {
- .build_specific = patch_wolfson_wm9703_specific,
- };
-
-@@ -533,7 +533,7 @@ static int patch_wolfson_wm9704_specific(struct snd_ac97 * ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_wolfson_wm9704_ops = {
-+static const struct snd_ac97_build_ops patch_wolfson_wm9704_ops = {
- .build_specific = patch_wolfson_wm9704_specific,
- };
-
-@@ -555,7 +555,7 @@ static int patch_wolfson_wm9705_specific(struct snd_ac97 * ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_wolfson_wm9705_ops = {
-+static const struct snd_ac97_build_ops patch_wolfson_wm9705_ops = {
- .build_specific = patch_wolfson_wm9705_specific,
- };
-
-@@ -692,7 +692,7 @@ static int patch_wolfson_wm9711_specific(struct snd_ac97 * ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_wolfson_wm9711_ops = {
-+static const struct snd_ac97_build_ops patch_wolfson_wm9711_ops = {
- .build_specific = patch_wolfson_wm9711_specific,
- };
-
-@@ -886,7 +886,7 @@ static void patch_wolfson_wm9713_resume (struct snd_ac97 * ac97)
- }
- #endif
-
--static struct snd_ac97_build_ops patch_wolfson_wm9713_ops = {
-+static const struct snd_ac97_build_ops patch_wolfson_wm9713_ops = {
- .build_specific = patch_wolfson_wm9713_specific,
- .build_3d = patch_wolfson_wm9713_3d,
- #ifdef CONFIG_PM
-@@ -991,7 +991,7 @@ static int patch_sigmatel_stac97xx_specific(struct snd_ac97 * ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_sigmatel_stac9700_ops = {
-+static const struct snd_ac97_build_ops patch_sigmatel_stac9700_ops = {
- .build_3d = patch_sigmatel_stac9700_3d,
- .build_specific = patch_sigmatel_stac97xx_specific
- };
-@@ -1038,7 +1038,7 @@ static int patch_sigmatel_stac9708_specific(struct snd_ac97 *ac97)
- return patch_sigmatel_stac97xx_specific(ac97);
- }
-
--static struct snd_ac97_build_ops patch_sigmatel_stac9708_ops = {
-+static const struct snd_ac97_build_ops patch_sigmatel_stac9708_ops = {
- .build_3d = patch_sigmatel_stac9708_3d,
- .build_specific = patch_sigmatel_stac9708_specific
- };
-@@ -1267,7 +1267,7 @@ static int patch_sigmatel_stac9758_specific(struct snd_ac97 *ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_sigmatel_stac9758_ops = {
-+static const struct snd_ac97_build_ops patch_sigmatel_stac9758_ops = {
- .build_3d = patch_sigmatel_stac9700_3d,
- .build_specific = patch_sigmatel_stac9758_specific
- };
-@@ -1342,7 +1342,7 @@ static int patch_cirrus_build_spdif(struct snd_ac97 * ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_cirrus_ops = {
-+static const struct snd_ac97_build_ops patch_cirrus_ops = {
- .build_spdif = patch_cirrus_build_spdif
- };
-
-@@ -1399,7 +1399,7 @@ static int patch_conexant_build_spdif(struct snd_ac97 * ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_conexant_ops = {
-+static const struct snd_ac97_build_ops patch_conexant_ops = {
- .build_spdif = patch_conexant_build_spdif
- };
-
-@@ -1575,7 +1575,7 @@ static void patch_ad1881_chained(struct snd_ac97 * ac97, int unchained_idx, int
- }
- }
-
--static struct snd_ac97_build_ops patch_ad1881_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1881_build_ops = {
- #ifdef CONFIG_PM
- .resume = ad18xx_resume
- #endif
-@@ -1662,7 +1662,7 @@ static int patch_ad1885_specific(struct snd_ac97 * ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_ad1885_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1885_build_ops = {
- .build_specific = &patch_ad1885_specific,
- #ifdef CONFIG_PM
- .resume = ad18xx_resume
-@@ -1689,7 +1689,7 @@ static int patch_ad1886_specific(struct snd_ac97 * ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_ad1886_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1886_build_ops = {
- .build_specific = &patch_ad1886_specific,
- #ifdef CONFIG_PM
- .resume = ad18xx_resume
-@@ -1896,7 +1896,7 @@ static int patch_ad1981a_specific(struct snd_ac97 * ac97)
- ARRAY_SIZE(snd_ac97_ad1981x_jack_sense));
- }
-
--static struct snd_ac97_build_ops patch_ad1981a_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1981a_build_ops = {
- .build_post_spdif = patch_ad198x_post_spdif,
- .build_specific = patch_ad1981a_specific,
- #ifdef CONFIG_PM
-@@ -1952,7 +1952,7 @@ static int patch_ad1981b_specific(struct snd_ac97 *ac97)
- ARRAY_SIZE(snd_ac97_ad1981x_jack_sense));
- }
-
--static struct snd_ac97_build_ops patch_ad1981b_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1981b_build_ops = {
- .build_post_spdif = patch_ad198x_post_spdif,
- .build_specific = patch_ad1981b_specific,
- #ifdef CONFIG_PM
-@@ -2091,7 +2091,7 @@ static int patch_ad1888_specific(struct snd_ac97 *ac97)
- return patch_build_controls(ac97, snd_ac97_ad1888_controls, ARRAY_SIZE(snd_ac97_ad1888_controls));
- }
-
--static struct snd_ac97_build_ops patch_ad1888_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1888_build_ops = {
- .build_post_spdif = patch_ad198x_post_spdif,
- .build_specific = patch_ad1888_specific,
- #ifdef CONFIG_PM
-@@ -2140,7 +2140,7 @@ static int patch_ad1980_specific(struct snd_ac97 *ac97)
- return patch_build_controls(ac97, &snd_ac97_ad198x_2cmic, 1);
- }
-
--static struct snd_ac97_build_ops patch_ad1980_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1980_build_ops = {
- .build_post_spdif = patch_ad198x_post_spdif,
- .build_specific = patch_ad1980_specific,
- #ifdef CONFIG_PM
-@@ -2255,7 +2255,7 @@ static int patch_ad1985_specific(struct snd_ac97 *ac97)
- ARRAY_SIZE(snd_ac97_ad1985_controls));
- }
-
--static struct snd_ac97_build_ops patch_ad1985_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1985_build_ops = {
- .build_post_spdif = patch_ad198x_post_spdif,
- .build_specific = patch_ad1985_specific,
- #ifdef CONFIG_PM
-@@ -2547,7 +2547,7 @@ static int patch_ad1986_specific(struct snd_ac97 *ac97)
- ARRAY_SIZE(snd_ac97_ad1985_controls));
- }
-
--static struct snd_ac97_build_ops patch_ad1986_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1986_build_ops = {
- .build_post_spdif = patch_ad198x_post_spdif,
- .build_specific = patch_ad1986_specific,
- #ifdef CONFIG_PM
-@@ -2652,7 +2652,7 @@ static int patch_alc650_specific(struct snd_ac97 * ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_alc650_ops = {
-+static const struct snd_ac97_build_ops patch_alc650_ops = {
- .build_specific = patch_alc650_specific,
- .update_jacks = alc650_update_jacks
- };
-@@ -2804,7 +2804,7 @@ static int patch_alc655_specific(struct snd_ac97 * ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_alc655_ops = {
-+static const struct snd_ac97_build_ops patch_alc655_ops = {
- .build_specific = patch_alc655_specific,
- .update_jacks = alc655_update_jacks
- };
-@@ -2916,7 +2916,7 @@ static int patch_alc850_specific(struct snd_ac97 *ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_alc850_ops = {
-+static const struct snd_ac97_build_ops patch_alc850_ops = {
- .build_specific = patch_alc850_specific,
- .update_jacks = alc850_update_jacks
- };
-@@ -2978,7 +2978,7 @@ static int patch_cm9738_specific(struct snd_ac97 * ac97)
- return patch_build_controls(ac97, snd_ac97_cm9738_controls, ARRAY_SIZE(snd_ac97_cm9738_controls));
- }
-
--static struct snd_ac97_build_ops patch_cm9738_ops = {
-+static const struct snd_ac97_build_ops patch_cm9738_ops = {
- .build_specific = patch_cm9738_specific,
- .update_jacks = cm9738_update_jacks
- };
-@@ -3069,7 +3069,7 @@ static int patch_cm9739_post_spdif(struct snd_ac97 * ac97)
- return patch_build_controls(ac97, snd_ac97_cm9739_controls_spdif, ARRAY_SIZE(snd_ac97_cm9739_controls_spdif));
- }
-
--static struct snd_ac97_build_ops patch_cm9739_ops = {
-+static const struct snd_ac97_build_ops patch_cm9739_ops = {
- .build_specific = patch_cm9739_specific,
- .build_post_spdif = patch_cm9739_post_spdif,
- .update_jacks = cm9739_update_jacks
-@@ -3243,7 +3243,7 @@ static int patch_cm9761_specific(struct snd_ac97 * ac97)
- return patch_build_controls(ac97, snd_ac97_cm9761_controls, ARRAY_SIZE(snd_ac97_cm9761_controls));
- }
-
--static struct snd_ac97_build_ops patch_cm9761_ops = {
-+static const struct snd_ac97_build_ops patch_cm9761_ops = {
- .build_specific = patch_cm9761_specific,
- .build_post_spdif = patch_cm9761_post_spdif,
- .update_jacks = cm9761_update_jacks
-@@ -3339,7 +3339,7 @@ static int patch_cm9780_specific(struct snd_ac97 *ac97)
- return patch_build_controls(ac97, cm9780_controls, ARRAY_SIZE(cm9780_controls));
- }
-
--static struct snd_ac97_build_ops patch_cm9780_ops = {
-+static const struct snd_ac97_build_ops patch_cm9780_ops = {
- .build_specific = patch_cm9780_specific,
- .build_post_spdif = patch_cm9761_post_spdif /* identical with CM9761 */
- };
-@@ -3459,7 +3459,7 @@ static int patch_vt1616_specific(struct snd_ac97 * ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_vt1616_ops = {
-+static const struct snd_ac97_build_ops patch_vt1616_ops = {
- .build_specific = patch_vt1616_specific
- };
-
-@@ -3813,7 +3813,7 @@ static int patch_it2646_specific(struct snd_ac97 * ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_it2646_ops = {
-+static const struct snd_ac97_build_ops patch_it2646_ops = {
- .build_specific = patch_it2646_specific,
- .update_jacks = it2646_update_jacks
- };
-@@ -3847,7 +3847,7 @@ static int patch_si3036_specific(struct snd_ac97 * ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_si3036_ops = {
-+static const struct snd_ac97_build_ops patch_si3036_ops = {
- .build_specific = patch_si3036_specific,
- };
-
-@@ -3914,7 +3914,7 @@ static int patch_ucb1400_specific(struct snd_ac97 * ac97)
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_ucb1400_ops = {
-+static const struct snd_ac97_build_ops patch_ucb1400_ops = {
- .build_specific = patch_ucb1400_specific,
- };
-
-diff --git a/sound/pci/hda/patch_atihdmi.c b/sound/pci/hda/patch_atihdmi.c
-index fb684f0..2b11cea 100644
---- a/sound/pci/hda/patch_atihdmi.c
-+++ b/sound/pci/hda/patch_atihdmi.c
-@@ -177,7 +177,7 @@ static int patch_atihdmi(struct hda_codec *codec)
- */
- spec->multiout.dig_out_nid = CVT_NID;
-
-- codec->patch_ops = atihdmi_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &atihdmi_patch_ops, sizeof(atihdmi_patch_ops));
-
- return 0;
- }
-diff --git a/sound/pci/hda/patch_intelhdmi.c b/sound/pci/hda/patch_intelhdmi.c
-index 7c23016..c5bfdd7 100644
---- a/sound/pci/hda/patch_intelhdmi.c
-+++ b/sound/pci/hda/patch_intelhdmi.c
-@@ -511,10 +511,10 @@ static void hdmi_non_intrinsic_event(struct hda_codec *codec, unsigned int res)
- cp_ready);
-
- /* TODO */
-- if (cp_state)
-- ;
-- if (cp_ready)
-- ;
-+ if (cp_state) {
-+ }
-+ if (cp_ready) {
-+ }
- }
-
-
-@@ -656,7 +656,7 @@ static int do_patch_intel_hdmi(struct hda_codec *codec)
- spec->multiout.dig_out_nid = cvt_nid;
-
- codec->spec = spec;
-- codec->patch_ops = intel_hdmi_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &intel_hdmi_patch_ops, sizeof(intel_hdmi_patch_ops));
-
- snd_hda_eld_proc_new(codec, &spec->sink_eld);
-
-diff --git a/sound/pci/hda/patch_nvhdmi.c b/sound/pci/hda/patch_nvhdmi.c
-index 6afdab0..68ed352 100644
---- a/sound/pci/hda/patch_nvhdmi.c
-+++ b/sound/pci/hda/patch_nvhdmi.c
-@@ -367,7 +367,7 @@ static int patch_nvhdmi_8ch(struct hda_codec *codec)
- spec->multiout.max_channels = 8;
- spec->multiout.dig_out_nid = Nv_Master_Convert_nid;
-
-- codec->patch_ops = nvhdmi_patch_ops_8ch;
-+ memcpy((void *)&codec->patch_ops, &nvhdmi_patch_ops_8ch, sizeof(nvhdmi_patch_ops_8ch));
-
- return 0;
- }
-@@ -386,7 +386,7 @@ static int patch_nvhdmi_2ch(struct hda_codec *codec)
- spec->multiout.max_channels = 2;
- spec->multiout.dig_out_nid = Nv_Master_Convert_nid;
-
-- codec->patch_ops = nvhdmi_patch_ops_2ch;
-+ memcpy((void *)&codec->patch_ops, &nvhdmi_patch_ops_2ch, sizeof(nvhdmi_patch_ops_2ch));
-
- return 0;
- }
-diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
-index 2fcd70d..a143eaf 100644
---- a/sound/pci/hda/patch_sigmatel.c
-+++ b/sound/pci/hda/patch_sigmatel.c
-@@ -5220,7 +5220,7 @@ again:
- snd_hda_codec_write_cache(codec, nid, 0,
- AC_VERB_SET_CONNECT_SEL, num_dacs);
-
-- codec->patch_ops = stac92xx_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &stac92xx_patch_ops, sizeof(stac92xx_patch_ops));
-
- codec->proc_widget_hook = stac92hd_proc_hook;
-
-@@ -5294,7 +5294,7 @@ static int patch_stac92hd71bxx(struct hda_codec *codec)
- return -ENOMEM;
-
- codec->spec = spec;
-- codec->patch_ops = stac92xx_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &stac92xx_patch_ops, sizeof(stac92xx_patch_ops));
- spec->num_pins = STAC92HD71BXX_NUM_PINS;
- switch (codec->vendor_id) {
- case 0x111d76b6:
-diff --git a/sound/pci/intel8x0m.c b/sound/pci/intel8x0m.c
-index 9e7d12e..3e3bc64 100644
---- a/sound/pci/intel8x0m.c
-+++ b/sound/pci/intel8x0m.c
-@@ -1264,7 +1264,7 @@ static struct shortname_table {
- { 0x5455, "ALi M5455" },
- { 0x746d, "AMD AMD8111" },
- #endif
-- { 0 },
-+ { 0, },
- };
-
- static int __devinit snd_intel8x0m_probe(struct pci_dev *pci,
-diff --git a/sound/pci/ymfpci/ymfpci_main.c b/sound/pci/ymfpci/ymfpci_main.c
-index 5518371..45cf7ac 100644
---- a/sound/pci/ymfpci/ymfpci_main.c
-+++ b/sound/pci/ymfpci/ymfpci_main.c
-@@ -202,8 +202,8 @@ static void snd_ymfpci_hw_stop(struct snd_ymfpci *chip)
- if ((snd_ymfpci_readl(chip, YDSXGR_STATUS) & 2) == 0)
- break;
- }
-- if (atomic_read(&chip->interrupt_sleep_count)) {
-- atomic_set(&chip->interrupt_sleep_count, 0);
-+ if (atomic_read_unchecked(&chip->interrupt_sleep_count)) {
-+ atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
- wake_up(&chip->interrupt_sleep);
- }
- __end:
-@@ -787,7 +787,7 @@ static void snd_ymfpci_irq_wait(struct snd_ymfpci *chip)
- continue;
- init_waitqueue_entry(&wait, current);
- add_wait_queue(&chip->interrupt_sleep, &wait);
-- atomic_inc(&chip->interrupt_sleep_count);
-+ atomic_inc_unchecked(&chip->interrupt_sleep_count);
- schedule_timeout_uninterruptible(msecs_to_jiffies(50));
- remove_wait_queue(&chip->interrupt_sleep, &wait);
- }
-@@ -825,8 +825,8 @@ static irqreturn_t snd_ymfpci_interrupt(int irq, void *dev_id)
- snd_ymfpci_writel(chip, YDSXGR_MODE, mode);
- spin_unlock(&chip->reg_lock);
-
-- if (atomic_read(&chip->interrupt_sleep_count)) {
-- atomic_set(&chip->interrupt_sleep_count, 0);
-+ if (atomic_read_unchecked(&chip->interrupt_sleep_count)) {
-+ atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
- wake_up(&chip->interrupt_sleep);
- }
- }
-@@ -2369,7 +2369,7 @@ int __devinit snd_ymfpci_create(struct snd_card *card,
- spin_lock_init(&chip->reg_lock);
- spin_lock_init(&chip->voice_lock);
- init_waitqueue_head(&chip->interrupt_sleep);
-- atomic_set(&chip->interrupt_sleep_count, 0);
-+ atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
- chip->card = card;
- chip->pci = pci;
- chip->irq = -1;
-diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
-index 0a1b2f6..d999b21 100644
---- a/sound/soc/soc-core.c
-+++ b/sound/soc/soc-core.c
-@@ -1107,13 +1107,15 @@ static int soc_new_pcm(struct snd_soc_device *socdev,
-
- dai_link->pcm = pcm;
- pcm->private_data = rtd;
-- soc_pcm_ops.mmap = platform->pcm_ops->mmap;
-- soc_pcm_ops.pointer = platform->pcm_ops->pointer;
-- soc_pcm_ops.ioctl = platform->pcm_ops->ioctl;
-- soc_pcm_ops.copy = platform->pcm_ops->copy;
-- soc_pcm_ops.silence = platform->pcm_ops->silence;
-- soc_pcm_ops.ack = platform->pcm_ops->ack;
-- soc_pcm_ops.page = platform->pcm_ops->page;
-+ pax_open_kernel();
-+ *(void **)&soc_pcm_ops.mmap = platform->pcm_ops->mmap;
-+ *(void **)&soc_pcm_ops.pointer = platform->pcm_ops->pointer;
-+ *(void **)&soc_pcm_ops.ioctl = platform->pcm_ops->ioctl;
-+ *(void **)&soc_pcm_ops.copy = platform->pcm_ops->copy;
-+ *(void **)&soc_pcm_ops.silence = platform->pcm_ops->silence;
-+ *(void **)&soc_pcm_ops.ack = platform->pcm_ops->ack;
-+ *(void **)&soc_pcm_ops.page = platform->pcm_ops->page;
-+ pax_close_kernel();
-
- if (playback)
- snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_PLAYBACK, &soc_pcm_ops);
-diff --git a/sound/usb/usbaudio.c b/sound/usb/usbaudio.c
-index 79633ea..9732e90 100644
---- a/sound/usb/usbaudio.c
-+++ b/sound/usb/usbaudio.c
-@@ -963,12 +963,12 @@ static int snd_usb_pcm_playback_trigger(struct snd_pcm_substream *substream,
- switch (cmd) {
- case SNDRV_PCM_TRIGGER_START:
- case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
-- subs->ops.prepare = prepare_playback_urb;
-+ *(void **)&subs->ops.prepare = prepare_playback_urb;
- return 0;
- case SNDRV_PCM_TRIGGER_STOP:
- return deactivate_urbs(subs, 0, 0);
- case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
-- subs->ops.prepare = prepare_nodata_playback_urb;
-+ *(void **)&subs->ops.prepare = prepare_nodata_playback_urb;
- return 0;
- default:
- return -EINVAL;
-@@ -985,15 +985,15 @@ static int snd_usb_pcm_capture_trigger(struct snd_pcm_substream *substream,
-
- switch (cmd) {
- case SNDRV_PCM_TRIGGER_START:
-- subs->ops.retire = retire_capture_urb;
-+ *(void **)&subs->ops.retire = retire_capture_urb;
- return start_urbs(subs, substream->runtime);
- case SNDRV_PCM_TRIGGER_STOP:
- return deactivate_urbs(subs, 0, 0);
- case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
-- subs->ops.retire = retire_paused_capture_urb;
-+ *(void **)&subs->ops.retire = retire_paused_capture_urb;
- return 0;
- case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
-- subs->ops.retire = retire_capture_urb;
-+ *(void **)&subs->ops.retire = retire_capture_urb;
- return 0;
- default:
- return -EINVAL;
-@@ -1542,7 +1542,7 @@ static int snd_usb_pcm_prepare(struct snd_pcm_substream *substream)
- /* for playback, submit the URBs now; otherwise, the first hwptr_done
- * updates for all URBs would happen at the same time when starting */
- if (subs->direction == SNDRV_PCM_STREAM_PLAYBACK) {
-- subs->ops.prepare = prepare_nodata_playback_urb;
-+ *(void **)&subs->ops.prepare = prepare_nodata_playback_urb;
- return start_urbs(subs, runtime);
- } else
- return 0;
-@@ -2228,14 +2228,14 @@ static void init_substream(struct snd_usb_stream *as, int stream, struct audiofo
- subs->direction = stream;
- subs->dev = as->chip->dev;
- if (snd_usb_get_speed(subs->dev) == USB_SPEED_FULL) {
-- subs->ops = audio_urb_ops[stream];
-+ memcpy((void *)&subs->ops, &audio_urb_ops[stream], sizeof(subs->ops));
- } else {
-- subs->ops = audio_urb_ops_high_speed[stream];
-+ memcpy((void *)&subs->ops, &audio_urb_ops_high_speed[stream], sizeof(subs->ops));
- switch (as->chip->usb_id) {
- case USB_ID(0x041e, 0x3f02): /* E-Mu 0202 USB */
- case USB_ID(0x041e, 0x3f04): /* E-Mu 0404 USB */
- case USB_ID(0x041e, 0x3f0a): /* E-Mu Tracker Pre */
-- subs->ops.retire_sync = retire_playback_sync_urb_hs_emu;
-+ *(void **)&subs->ops.retire_sync = retire_playback_sync_urb_hs_emu;
- break;
- }
- }
-diff --git a/tools/gcc/.gitignore b/tools/gcc/.gitignore
-new file mode 100644
-index 0000000..50f2f2f
---- /dev/null
-+++ b/tools/gcc/.gitignore
-@@ -0,0 +1 @@
-+size_overflow_hash.h
-diff --git a/tools/gcc/Makefile b/tools/gcc/Makefile
-new file mode 100644
-index 0000000..1d09b7e
---- /dev/null
-+++ b/tools/gcc/Makefile
-@@ -0,0 +1,43 @@
-+#CC := gcc
-+#PLUGIN_SOURCE_FILES := pax_plugin.c
-+#PLUGIN_OBJECT_FILES := $(patsubst %.c,%.o,$(PLUGIN_SOURCE_FILES))
-+GCCPLUGINS_DIR := $(shell $(CC) -print-file-name=plugin)
-+#CFLAGS += -I$(GCCPLUGINS_DIR)/include -fPIC -O2 -Wall -W -std=gnu99
-+
-+ifeq ($(PLUGINCC),$(HOSTCC))
-+HOSTLIBS := hostlibs
-+HOST_EXTRACFLAGS += -I$(GCCPLUGINS_DIR)/include -I$(GCCPLUGINS_DIR)/include/c-family -std=gnu99 -ggdb
-+else
-+HOSTLIBS := hostcxxlibs
-+HOST_EXTRACXXFLAGS += -I$(GCCPLUGINS_DIR)/include -I$(GCCPLUGINS_DIR)/include/c-family -std=gnu++98 -ggdb -Wno-unused-parameter
-+endif
-+
-+$(HOSTLIBS)-y := constify_plugin.so
-+$(HOSTLIBS)-$(CONFIG_PAX_MEMORY_STACKLEAK) += stackleak_plugin.so
-+$(HOSTLIBS)-$(CONFIG_KALLOCSTAT_PLUGIN) += kallocstat_plugin.so
-+$(HOSTLIBS)-$(CONFIG_PAX_KERNEXEC_PLUGIN) += kernexec_plugin.so
-+$(HOSTLIBS)-$(CONFIG_CHECKER_PLUGIN) += checker_plugin.so
-+$(HOSTLIBS)-y += colorize_plugin.so
-+$(HOSTLIBS)-$(CONFIG_PAX_SIZE_OVERFLOW) += size_overflow_plugin.so
-+$(HOSTLIBS)-$(CONFIG_PAX_LATENT_ENTROPY) += latent_entropy_plugin.so
-+
-+always := $($(HOSTLIBS)-y)
-+
-+constify_plugin-objs := constify_plugin.o
-+stackleak_plugin-objs := stackleak_plugin.o
-+kallocstat_plugin-objs := kallocstat_plugin.o
-+kernexec_plugin-objs := kernexec_plugin.o
-+checker_plugin-objs := checker_plugin.o
-+colorize_plugin-objs := colorize_plugin.o
-+size_overflow_plugin-objs := size_overflow_plugin.o
-+latent_entropy_plugin-objs := latent_entropy_plugin.o
-+
-+$(obj)/size_overflow_plugin.o: $(objtree)/$(obj)/size_overflow_hash.h
-+
-+quiet_cmd_build_size_overflow_hash = GENHASH $@
-+ cmd_build_size_overflow_hash = \
-+ $(CONFIG_SHELL) $(srctree)/$(src)/generate_size_overflow_hash.sh -d $< -o $@
-+$(objtree)/$(obj)/size_overflow_hash.h: $(src)/size_overflow_hash.data FORCE
-+ $(call if_changed,build_size_overflow_hash)
-+
-+targets += size_overflow_hash.h
-diff --git a/tools/gcc/checker_plugin.c b/tools/gcc/checker_plugin.c
-new file mode 100644
-index 0000000..d41b5af
---- /dev/null
-+++ b/tools/gcc/checker_plugin.c
-@@ -0,0 +1,171 @@
-+/*
-+ * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
-+ * Licensed under the GPL v2
-+ *
-+ * Note: the choice of the license means that the compilation process is
-+ * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
-+ * but for the kernel it doesn't matter since it doesn't link against
-+ * any of the gcc libraries
-+ *
-+ * gcc plugin to implement various sparse (source code checker) features
-+ *
-+ * TODO:
-+ * - define separate __iomem, __percpu and __rcu address spaces (lots of code to patch)
-+ *
-+ * BUGS:
-+ * - none known
-+ */
-+#include "gcc-plugin.h"
-+#include "config.h"
-+#include "system.h"
-+#include "coretypes.h"
-+#include "tree.h"
-+#include "tree-pass.h"
-+#include "flags.h"
-+#include "intl.h"
-+#include "toplev.h"
-+#include "plugin.h"
-+//#include "expr.h" where are you...
-+#include "diagnostic.h"
-+#include "plugin-version.h"
-+#include "tm.h"
-+#include "function.h"
-+#include "basic-block.h"
-+#include "gimple.h"
-+#include "rtl.h"
-+#include "emit-rtl.h"
-+#include "tree-flow.h"
-+#include "target.h"
-+
-+extern void c_register_addr_space (const char *str, addr_space_t as);
-+extern enum machine_mode default_addr_space_pointer_mode (addr_space_t);
-+extern enum machine_mode default_addr_space_address_mode (addr_space_t);
-+extern bool default_addr_space_valid_pointer_mode(enum machine_mode mode, addr_space_t as);
-+extern bool default_addr_space_legitimate_address_p(enum machine_mode mode, rtx mem, bool strict, addr_space_t as);
-+extern rtx default_addr_space_legitimize_address(rtx x, rtx oldx, enum machine_mode mode, addr_space_t as);
-+
-+extern void print_gimple_stmt(FILE *, gimple, int, int);
-+extern rtx emit_move_insn(rtx x, rtx y);
-+
-+int plugin_is_GPL_compatible;
-+
-+static struct plugin_info checker_plugin_info = {
-+ .version = "201111150100",
-+};
-+
-+#define ADDR_SPACE_KERNEL 0
-+#define ADDR_SPACE_FORCE_KERNEL 1
-+#define ADDR_SPACE_USER 2
-+#define ADDR_SPACE_FORCE_USER 3
-+#define ADDR_SPACE_IOMEM 0
-+#define ADDR_SPACE_FORCE_IOMEM 0
-+#define ADDR_SPACE_PERCPU 0
-+#define ADDR_SPACE_FORCE_PERCPU 0
-+#define ADDR_SPACE_RCU 0
-+#define ADDR_SPACE_FORCE_RCU 0
-+
-+static enum machine_mode checker_addr_space_pointer_mode(addr_space_t addrspace)
-+{
-+ return default_addr_space_pointer_mode(ADDR_SPACE_GENERIC);
-+}
-+
-+static enum machine_mode checker_addr_space_address_mode(addr_space_t addrspace)
-+{
-+ return default_addr_space_address_mode(ADDR_SPACE_GENERIC);
-+}
-+
-+static bool checker_addr_space_valid_pointer_mode(enum machine_mode mode, addr_space_t as)
-+{
-+ return default_addr_space_valid_pointer_mode(mode, as);
-+}
-+
-+static bool checker_addr_space_legitimate_address_p(enum machine_mode mode, rtx mem, bool strict, addr_space_t as)
-+{
-+ return default_addr_space_legitimate_address_p(mode, mem, strict, ADDR_SPACE_GENERIC);
-+}
-+
-+static rtx checker_addr_space_legitimize_address(rtx x, rtx oldx, enum machine_mode mode, addr_space_t as)
-+{
-+ return default_addr_space_legitimize_address(x, oldx, mode, as);
-+}
-+
-+static bool checker_addr_space_subset_p(addr_space_t subset, addr_space_t superset)
-+{
-+ if (subset == ADDR_SPACE_FORCE_KERNEL && superset == ADDR_SPACE_KERNEL)
-+ return true;
-+
-+ if (subset == ADDR_SPACE_FORCE_USER && superset == ADDR_SPACE_USER)
-+ return true;
-+
-+ if (subset == ADDR_SPACE_FORCE_IOMEM && superset == ADDR_SPACE_IOMEM)
-+ return true;
-+
-+ if (subset == ADDR_SPACE_KERNEL && superset == ADDR_SPACE_FORCE_USER)
-+ return true;
-+
-+ if (subset == ADDR_SPACE_KERNEL && superset == ADDR_SPACE_FORCE_IOMEM)
-+ return true;
-+
-+ if (subset == ADDR_SPACE_USER && superset == ADDR_SPACE_FORCE_KERNEL)
-+ return true;
-+
-+ if (subset == ADDR_SPACE_IOMEM && superset == ADDR_SPACE_FORCE_KERNEL)
-+ return true;
-+
-+ return subset == superset;
-+}
-+
-+static rtx checker_addr_space_convert(rtx op, tree from_type, tree to_type)
-+{
-+// addr_space_t from_as = TYPE_ADDR_SPACE(TREE_TYPE(from_type));
-+// addr_space_t to_as = TYPE_ADDR_SPACE(TREE_TYPE(to_type));
-+
-+ return op;
-+}
-+
-+static void register_checker_address_spaces(void *event_data, void *data)
-+{
-+ c_register_addr_space("__kernel", ADDR_SPACE_KERNEL);
-+ c_register_addr_space("__force_kernel", ADDR_SPACE_FORCE_KERNEL);
-+ c_register_addr_space("__user", ADDR_SPACE_USER);
-+ c_register_addr_space("__force_user", ADDR_SPACE_FORCE_USER);
-+// c_register_addr_space("__iomem", ADDR_SPACE_IOMEM);
-+// c_register_addr_space("__force_iomem", ADDR_SPACE_FORCE_IOMEM);
-+// c_register_addr_space("__percpu", ADDR_SPACE_PERCPU);
-+// c_register_addr_space("__force_percpu", ADDR_SPACE_FORCE_PERCPU);
-+// c_register_addr_space("__rcu", ADDR_SPACE_RCU);
-+// c_register_addr_space("__force_rcu", ADDR_SPACE_FORCE_RCU);
-+
-+ targetm.addr_space.pointer_mode = checker_addr_space_pointer_mode;
-+ targetm.addr_space.address_mode = checker_addr_space_address_mode;
-+ targetm.addr_space.valid_pointer_mode = checker_addr_space_valid_pointer_mode;
-+ targetm.addr_space.legitimate_address_p = checker_addr_space_legitimate_address_p;
-+// targetm.addr_space.legitimize_address = checker_addr_space_legitimize_address;
-+ targetm.addr_space.subset_p = checker_addr_space_subset_p;
-+ targetm.addr_space.convert = checker_addr_space_convert;
-+}
-+
-+int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
-+{
-+ const char * const plugin_name = plugin_info->base_name;
-+ const int argc = plugin_info->argc;
-+ const struct plugin_argument * const argv = plugin_info->argv;
-+ int i;
-+
-+ if (!plugin_default_version_check(version, &gcc_version)) {
-+ error(G_("incompatible gcc/plugin versions"));
-+ return 1;
-+ }
-+
-+ register_callback(plugin_name, PLUGIN_INFO, NULL, &checker_plugin_info);
-+
-+ for (i = 0; i < argc; ++i)
-+ error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
-+
-+ if (TARGET_64BIT == 0)
-+ return 0;
-+
-+ register_callback(plugin_name, PLUGIN_PRAGMAS, register_checker_address_spaces, NULL);
-+
-+ return 0;
-+}
-diff --git a/tools/gcc/colorize_plugin.c b/tools/gcc/colorize_plugin.c
-new file mode 100644
-index 0000000..846aeb0
---- /dev/null
-+++ b/tools/gcc/colorize_plugin.c
-@@ -0,0 +1,148 @@
-+/*
-+ * Copyright 2012 by PaX Team <pageexec@freemail.hu>
-+ * Licensed under the GPL v2
-+ *
-+ * Note: the choice of the license means that the compilation process is
-+ * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
-+ * but for the kernel it doesn't matter since it doesn't link against
-+ * any of the gcc libraries
-+ *
-+ * gcc plugin to colorize diagnostic output
-+ *
-+ */
-+
-+#include "gcc-plugin.h"
-+#include "config.h"
-+#include "system.h"
-+#include "coretypes.h"
-+#include "tree.h"
-+#include "tree-pass.h"
-+#include "flags.h"
-+#include "intl.h"
-+#include "toplev.h"
-+#include "plugin.h"
-+#include "diagnostic.h"
-+#include "plugin-version.h"
-+#include "tm.h"
-+
-+int plugin_is_GPL_compatible;
-+
-+static struct plugin_info colorize_plugin_info = {
-+ .version = "201203092200",
-+ .help = NULL,
-+};
-+
-+#define GREEN "\033[32m\033[2m"
-+#define LIGHTGREEN "\033[32m\033[1m"
-+#define YELLOW "\033[33m\033[2m"
-+#define LIGHTYELLOW "\033[33m\033[1m"
-+#define RED "\033[31m\033[2m"
-+#define LIGHTRED "\033[31m\033[1m"
-+#define BLUE "\033[34m\033[2m"
-+#define LIGHTBLUE "\033[34m\033[1m"
-+#define BRIGHT "\033[m\033[1m"
-+#define NORMAL "\033[m"
-+
-+static diagnostic_starter_fn old_starter;
-+static diagnostic_finalizer_fn old_finalizer;
-+
-+static void start_colorize(diagnostic_context *context, diagnostic_info *diagnostic)
-+{
-+ const char *color;
-+ char *newprefix;
-+
-+ switch (diagnostic->kind) {
-+ case DK_NOTE:
-+ color = LIGHTBLUE;
-+ break;
-+
-+ case DK_PEDWARN:
-+ case DK_WARNING:
-+ color = LIGHTYELLOW;
-+ break;
-+
-+ case DK_ERROR:
-+ case DK_FATAL:
-+ case DK_ICE:
-+ case DK_PERMERROR:
-+ case DK_SORRY:
-+ color = LIGHTRED;
-+ break;
-+
-+ default:
-+ color = NORMAL;
-+ }
-+
-+ old_starter(context, diagnostic);
-+ if (-1 == asprintf(&newprefix, "%s%s" NORMAL, color, context->printer->prefix))
-+ return;
-+ pp_destroy_prefix(context->printer);
-+ pp_set_prefix(context->printer, newprefix);
-+}
-+
-+static void finalize_colorize(diagnostic_context *context, diagnostic_info *diagnostic)
-+{
-+ old_finalizer(context, diagnostic);
-+}
-+
-+static void colorize_arm(void)
-+{
-+ old_starter = diagnostic_starter(global_dc);
-+ old_finalizer = diagnostic_finalizer(global_dc);
-+
-+ diagnostic_starter(global_dc) = start_colorize;
-+ diagnostic_finalizer(global_dc) = finalize_colorize;
-+}
-+
-+static unsigned int execute_colorize_rearm(void)
-+{
-+ if (diagnostic_starter(global_dc) == start_colorize)
-+ return 0;
-+
-+ colorize_arm();
-+ return 0;
-+}
-+
-+struct simple_ipa_opt_pass pass_ipa_colorize_rearm = {
-+ .pass = {
-+ .type = SIMPLE_IPA_PASS,
-+ .name = "colorize_rearm",
-+ .gate = NULL,
-+ .execute = execute_colorize_rearm,
-+ .sub = NULL,
-+ .next = NULL,
-+ .static_pass_number = 0,
-+ .tv_id = TV_NONE,
-+ .properties_required = 0,
-+ .properties_provided = 0,
-+ .properties_destroyed = 0,
-+ .todo_flags_start = 0,
-+ .todo_flags_finish = 0
-+ }
-+};
-+
-+static void colorize_start_unit(void *gcc_data, void *user_data)
-+{
-+ colorize_arm();
-+}
-+
-+int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
-+{
-+ const char * const plugin_name = plugin_info->base_name;
-+ struct register_pass_info colorize_rearm_pass_info = {
-+ .pass = &pass_ipa_colorize_rearm.pass,
-+ .reference_pass_name = "*free_lang_data",
-+ .ref_pass_instance_number = 1,
-+ .pos_op = PASS_POS_INSERT_AFTER
-+ };
-+
-+ if (!plugin_default_version_check(version, &gcc_version)) {
-+ error(G_("incompatible gcc/plugin versions"));
-+ return 1;
-+ }
-+
-+ register_callback(plugin_name, PLUGIN_INFO, NULL, &colorize_plugin_info);
-+ register_callback(plugin_name, PLUGIN_START_UNIT, &colorize_start_unit, NULL);
-+ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &colorize_rearm_pass_info);
-+ return 0;
-+}
-diff --git a/tools/gcc/constify_plugin.c b/tools/gcc/constify_plugin.c
-new file mode 100644
-index 0000000..1742271
---- /dev/null
-+++ b/tools/gcc/constify_plugin.c
-@@ -0,0 +1,349 @@
-+/*
-+ * Copyright 2011 by Emese Revfy <re.emese@gmail.com>
-+ * Copyright 2011-2013 by PaX Team <pageexec@freemail.hu>
-+ * Licensed under the GPL v2, or (at your option) v3
-+ *
-+ * This gcc plugin constifies all structures which contain only function pointers or are explicitly marked for constification.
-+ *
-+ * Homepage:
-+ * http://www.grsecurity.net/~ephox/const_plugin/
-+ *
-+ * Usage:
-+ * $ gcc -I`gcc -print-file-name=plugin`/include -fPIC -shared -O2 -o constify_plugin.so constify_plugin.c
-+ * $ gcc -fplugin=constify_plugin.so test.c -O2
-+ */
-+
-+#include "gcc-plugin.h"
-+#include "config.h"
-+#include "system.h"
-+#include "coretypes.h"
-+#include "tree.h"
-+#include "tree-pass.h"
-+#include "flags.h"
-+#include "intl.h"
-+#include "toplev.h"
-+#include "plugin.h"
-+#include "diagnostic.h"
-+#include "plugin-version.h"
-+#include "tm.h"
-+#include "function.h"
-+#include "basic-block.h"
-+#include "gimple.h"
-+#include "rtl.h"
-+#include "emit-rtl.h"
-+#include "tree-flow.h"
-+
-+#define C_TYPE_FIELDS_READONLY(TYPE) TREE_LANG_FLAG_1(TYPE)
-+
-+int plugin_is_GPL_compatible;
-+
-+static struct plugin_info const_plugin_info = {
-+ .version = "201301150230",
-+ .help = "no-constify\tturn off constification\n",
-+};
-+
-+static tree get_field_type(tree field)
-+{
-+ return strip_array_types(TREE_TYPE(field));
-+}
-+
-+static bool walk_struct(tree node);
-+static void deconstify_tree(tree node);
-+
-+static void deconstify_type(tree type)
-+{
-+ tree field;
-+
-+ for (field = TYPE_FIELDS(type); field; field = TREE_CHAIN(field)) {
-+ tree fieldtype = get_field_type(field);
-+
-+ if (TREE_CODE(fieldtype) != RECORD_TYPE && TREE_CODE(fieldtype) != UNION_TYPE)
-+ continue;
-+ if (!TYPE_READONLY(fieldtype))
-+ continue;
-+ if (!walk_struct(fieldtype))
-+ continue;
-+
-+ deconstify_tree(field);
-+ TREE_READONLY(field) = 0;
-+ }
-+ TYPE_READONLY(type) = 0;
-+ C_TYPE_FIELDS_READONLY(type) = 0;
-+}
-+
-+static void deconstify_tree(tree node)
-+{
-+ tree old_type, new_type, field;
-+
-+// TREE_READONLY(node) = 0;
-+ old_type = TREE_TYPE(node);
-+ while (TREE_CODE(old_type) == ARRAY_TYPE && TREE_CODE(TREE_TYPE(old_type)) != ARRAY_TYPE) {
-+ node = old_type;
-+ old_type = TREE_TYPE(old_type);
-+ }
-+
-+ gcc_assert(TREE_CODE(old_type) == RECORD_TYPE || TREE_CODE(old_type) == UNION_TYPE);
-+ gcc_assert(TYPE_READONLY(old_type) && (TYPE_QUALS(old_type) & TYPE_QUAL_CONST));
-+
-+ new_type = build_qualified_type(old_type, TYPE_QUALS(old_type) & ~TYPE_QUAL_CONST);
-+ TYPE_FIELDS(new_type) = copy_list(TYPE_FIELDS(new_type));
-+ for (field = TYPE_FIELDS(new_type); field; field = TREE_CHAIN(field))
-+ DECL_FIELD_CONTEXT(field) = new_type;
-+
-+ deconstify_type(new_type);
-+
-+ TREE_TYPE(node) = new_type;
-+}
-+
-+static tree handle_no_const_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
-+{
-+ tree type;
-+
-+ *no_add_attrs = true;
-+ if (TREE_CODE(*node) == FUNCTION_DECL) {
-+ error("%qE attribute does not apply to functions", name);
-+ return NULL_TREE;
-+ }
-+
-+ if (TREE_CODE(*node) == VAR_DECL) {
-+ error("%qE attribute does not apply to variables", name);
-+ return NULL_TREE;
-+ }
-+
-+ if (TYPE_P(*node)) {
-+ if (TREE_CODE(*node) == RECORD_TYPE || TREE_CODE(*node) == UNION_TYPE)
-+ *no_add_attrs = false;
-+ else
-+ error("%qE attribute applies to struct and union types only", name);
-+ return NULL_TREE;
-+ }
-+
-+ type = TREE_TYPE(*node);
-+
-+ if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE) {
-+ error("%qE attribute applies to struct and union types only", name);
-+ return NULL_TREE;
-+ }
-+
-+ if (lookup_attribute(IDENTIFIER_POINTER(name), TYPE_ATTRIBUTES(type))) {
-+ error("%qE attribute is already applied to the type", name);
-+ return NULL_TREE;
-+ }
-+
-+ if (TREE_CODE(*node) == TYPE_DECL && !TYPE_READONLY(type)) {
-+ error("%qE attribute used on type that is not constified", name);
-+ return NULL_TREE;
-+ }
-+
-+ if (TREE_CODE(*node) == TYPE_DECL) {
-+ deconstify_tree(*node);
-+ return NULL_TREE;
-+ }
-+
-+ return NULL_TREE;
-+}
-+
-+static void constify_type(tree type)
-+{
-+ TYPE_READONLY(type) = 1;
-+ C_TYPE_FIELDS_READONLY(type) = 1;
-+}
-+
-+static tree handle_do_const_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
-+{
-+ *no_add_attrs = true;
-+ if (!TYPE_P(*node)) {
-+ error("%qE attribute applies to types only", name);
-+ return NULL_TREE;
-+ }
-+
-+ if (TREE_CODE(*node) != RECORD_TYPE && TREE_CODE(*node) != UNION_TYPE) {
-+ error("%qE attribute applies to struct and union types only", name);
-+ return NULL_TREE;
-+ }
-+
-+ *no_add_attrs = false;
-+ constify_type(*node);
-+ return NULL_TREE;
-+}
-+
-+static struct attribute_spec no_const_attr = {
-+ .name = "no_const",
-+ .min_length = 0,
-+ .max_length = 0,
-+ .decl_required = false,
-+ .type_required = false,
-+ .function_type_required = false,
-+ .handler = handle_no_const_attribute,
-+#if BUILDING_GCC_VERSION >= 4007
-+ .affects_type_identity = true
-+#endif
-+};
-+
-+static struct attribute_spec do_const_attr = {
-+ .name = "do_const",
-+ .min_length = 0,
-+ .max_length = 0,
-+ .decl_required = false,
-+ .type_required = false,
-+ .function_type_required = false,
-+ .handler = handle_do_const_attribute,
-+#if BUILDING_GCC_VERSION >= 4007
-+ .affects_type_identity = true
-+#endif
-+};
-+
-+static void register_attributes(void *event_data, void *data)
-+{
-+ register_attribute(&no_const_attr);
-+ register_attribute(&do_const_attr);
-+}
-+
-+static bool is_fptr(tree field)
-+{
-+ tree ptr = get_field_type(field);
-+
-+ if (TREE_CODE(ptr) != POINTER_TYPE)
-+ return false;
-+
-+ return TREE_CODE(TREE_TYPE(ptr)) == FUNCTION_TYPE;
-+}
-+
-+static bool walk_struct(tree node)
-+{
-+ tree field;
-+
-+ if (TYPE_FIELDS(node) == NULL_TREE)
-+ return false;
-+
-+ if (lookup_attribute("do_const", TYPE_ATTRIBUTES(node)))
-+ return true;
-+
-+ if (lookup_attribute("no_const", TYPE_ATTRIBUTES(node))) {
-+ gcc_assert(!TYPE_READONLY(node));
-+ deconstify_type(node);
-+ return false;
-+ }
-+
-+ for (field = TYPE_FIELDS(node); field; field = TREE_CHAIN(field)) {
-+ tree type = get_field_type(field);
-+ enum tree_code code = TREE_CODE(type);
-+
-+ if (node == type)
-+ return false;
-+ if (code == RECORD_TYPE || code == UNION_TYPE) {
-+ if (!(walk_struct(type)))
-+ return false;
-+ } else if (!is_fptr(field) && !TREE_READONLY(field))
-+ return false;
-+ }
-+ return true;
-+}
-+
-+static void finish_type(void *event_data, void *data)
-+{
-+ tree type = (tree)event_data;
-+
-+ if (type == NULL_TREE || type == error_mark_node)
-+ return;
-+
-+ if (TYPE_READONLY(type))
-+ return;
-+
-+ if (walk_struct(type))
-+ constify_type(type);
-+ else
-+ deconstify_type(type);
-+}
-+
-+static unsigned int check_local_variables(void)
-+{
-+ unsigned int ret = 0;
-+ tree var;
-+ referenced_var_iterator rvi;
-+
-+#if BUILDING_GCC_VERSION == 4005
-+ FOR_EACH_REFERENCED_VAR(var, rvi) {
-+#else
-+ FOR_EACH_REFERENCED_VAR(cfun, var, rvi) {
-+#endif
-+ tree type = TREE_TYPE(var);
-+
-+ if (!DECL_P(var) || TREE_STATIC(var) || DECL_EXTERNAL(var))
-+ continue;
-+
-+ if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE)
-+ continue;
-+
-+ if (!TYPE_READONLY(type))
-+ continue;
-+
-+// if (lookup_attribute("no_const", DECL_ATTRIBUTES(var)))
-+// continue;
-+
-+// if (lookup_attribute("no_const", TYPE_ATTRIBUTES(type)))
-+// continue;
-+
-+ if (walk_struct(type)) {
-+ error_at(DECL_SOURCE_LOCATION(var), "constified variable %qE cannot be local", var);
-+ ret = 1;
-+ }
-+ }
-+ return ret;
-+}
-+
-+struct gimple_opt_pass pass_local_variable = {
-+ {
-+ .type = GIMPLE_PASS,
-+ .name = "check_local_variables",
-+ .gate = NULL,
-+ .execute = check_local_variables,
-+ .sub = NULL,
-+ .next = NULL,
-+ .static_pass_number = 0,
-+ .tv_id = TV_NONE,
-+ .properties_required = 0,
-+ .properties_provided = 0,
-+ .properties_destroyed = 0,
-+ .todo_flags_start = 0,
-+ .todo_flags_finish = 0
-+ }
-+};
-+
-+int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
-+{
-+ const char * const plugin_name = plugin_info->base_name;
-+ const int argc = plugin_info->argc;
-+ const struct plugin_argument * const argv = plugin_info->argv;
-+ int i;
-+ bool constify = true;
-+
-+ struct register_pass_info local_variable_pass_info = {
-+ .pass = &pass_local_variable.pass,
-+ .reference_pass_name = "ssa",
-+ .ref_pass_instance_number = 1,
-+ .pos_op = PASS_POS_INSERT_BEFORE
-+ };
-+
-+ if (!plugin_default_version_check(version, &gcc_version)) {
-+ error(G_("incompatible gcc/plugin versions"));
-+ return 1;
-+ }
-+
-+ for (i = 0; i < argc; ++i) {
-+ if (!(strcmp(argv[i].key, "no-constify"))) {
-+ constify = false;
-+ continue;
-+ }
-+ error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
-+ }
-+
-+ register_callback(plugin_name, PLUGIN_INFO, NULL, &const_plugin_info);
-+ if (constify) {
-+ register_callback(plugin_name, PLUGIN_FINISH_TYPE, finish_type, NULL);
-+ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &local_variable_pass_info);
-+ }
-+ register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
-+
-+ return 0;
-+}
-diff --git a/tools/gcc/generate_size_overflow_hash.sh b/tools/gcc/generate_size_overflow_hash.sh
-new file mode 100644
-index 0000000..e518932
---- /dev/null
-+++ b/tools/gcc/generate_size_overflow_hash.sh
-@@ -0,0 +1,94 @@
-+#!/bin/bash
-+
-+# This script generates the hash table (size_overflow_hash.h) for the size_overflow gcc plugin (size_overflow_plugin.c).
-+
-+header1="size_overflow_hash.h"
-+database="size_overflow_hash.data"
-+n=65536
-+
-+usage() {
-+cat <<EOF
-+usage: $0 options
-+OPTIONS:
-+ -h|--help help
-+ -o header file
-+ -d database file
-+ -n hash array size
-+EOF
-+ return 0
-+}
-+
-+while true
-+do
-+ case "$1" in
-+ -h|--help) usage && exit 0;;
-+ -n) n=$2; shift 2;;
-+ -o) header1="$2"; shift 2;;
-+ -d) database="$2"; shift 2;;
-+ --) shift 1; break ;;
-+ *) break ;;
-+ esac
-+done
-+
-+create_defines() {
-+ for i in `seq 0 31`
-+ do
-+ echo -e "#define PARAM"$i" (1U << "$i")" >> "$header1"
-+ done
-+ echo >> "$header1"
-+}
-+
-+create_structs() {
-+ rm -f "$header1"
-+
-+ create_defines
-+
-+ cat "$database" | while read data
-+ do
-+ data_array=($data)
-+ struct_hash_name="${data_array[0]}"
-+ funcn="${data_array[1]}"
-+ params="${data_array[2]}"
-+ next="${data_array[4]}"
-+
-+ echo "const struct size_overflow_hash $struct_hash_name = {" >> "$header1"
-+
-+ echo -e "\t.next\t= $next,\n\t.name\t= \"$funcn\"," >> "$header1"
-+ echo -en "\t.param\t= " >> "$header1"
-+ line=
-+ for param_num in ${params//-/ };
-+ do
-+ line="${line}PARAM"$param_num"|"
-+ done
-+
-+ echo -e "${line%?},\n};\n" >> "$header1"
-+ done
-+}
-+
-+create_headers() {
-+ echo "const struct size_overflow_hash * const size_overflow_hash[$n] = {" >> "$header1"
-+}
-+
-+create_array_elements() {
-+ index=0
-+ grep -v "nohasharray" $database | sort -n -k 4 | while read data
-+ do
-+ data_array=($data)
-+ i="${data_array[3]}"
-+ hash="${data_array[0]}"
-+ while [[ $index -lt $i ]]
-+ do
-+ echo -e "\t["$index"]\t= NULL," >> "$header1"
-+ index=$(($index + 1))
-+ done
-+ index=$(($index + 1))
-+ echo -e "\t["$i"]\t= &"$hash"," >> "$header1"
-+ done
-+ echo '};' >> $header1
-+}
-+
-+create_structs
-+create_headers
-+create_array_elements
-+
-+exit 0
-diff --git a/tools/gcc/kallocstat_plugin.c b/tools/gcc/kallocstat_plugin.c
-new file mode 100644
-index 0000000..a86e422
---- /dev/null
-+++ b/tools/gcc/kallocstat_plugin.c
-@@ -0,0 +1,167 @@
-+/*
-+ * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
-+ * Licensed under the GPL v2
-+ *
-+ * Note: the choice of the license means that the compilation process is
-+ * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
-+ * but for the kernel it doesn't matter since it doesn't link against
-+ * any of the gcc libraries
-+ *
-+ * gcc plugin to find the distribution of k*alloc sizes
-+ *
-+ * TODO:
-+ *
-+ * BUGS:
-+ * - none known
-+ */
-+#include "gcc-plugin.h"
-+#include "config.h"
-+#include "system.h"
-+#include "coretypes.h"
-+#include "tree.h"
-+#include "tree-pass.h"
-+#include "flags.h"
-+#include "intl.h"
-+#include "toplev.h"
-+#include "plugin.h"
-+//#include "expr.h" where are you...
-+#include "diagnostic.h"
-+#include "plugin-version.h"
-+#include "tm.h"
-+#include "function.h"
-+#include "basic-block.h"
-+#include "gimple.h"
-+#include "rtl.h"
-+#include "emit-rtl.h"
-+
-+extern void print_gimple_stmt(FILE *, gimple, int, int);
-+
-+int plugin_is_GPL_compatible;
-+
-+static const char * const kalloc_functions[] = {
-+ "__kmalloc",
-+ "kmalloc",
-+ "kmalloc_large",
-+ "kmalloc_node",
-+ "kmalloc_order",
-+ "kmalloc_order_trace",
-+ "kmalloc_slab",
-+ "kzalloc",
-+ "kzalloc_node",
-+};
-+
-+static struct plugin_info kallocstat_plugin_info = {
-+ .version = "201111150100",
-+};
-+
-+static unsigned int execute_kallocstat(void);
-+
-+static struct gimple_opt_pass kallocstat_pass = {
-+ .pass = {
-+ .type = GIMPLE_PASS,
-+ .name = "kallocstat",
-+ .gate = NULL,
-+ .execute = execute_kallocstat,
-+ .sub = NULL,
-+ .next = NULL,
-+ .static_pass_number = 0,
-+ .tv_id = TV_NONE,
-+ .properties_required = 0,
-+ .properties_provided = 0,
-+ .properties_destroyed = 0,
-+ .todo_flags_start = 0,
-+ .todo_flags_finish = 0
-+ }
-+};
-+
-+static bool is_kalloc(const char *fnname)
-+{
-+ size_t i;
-+
-+ for (i = 0; i < ARRAY_SIZE(kalloc_functions); i++)
-+ if (!strcmp(fnname, kalloc_functions[i]))
-+ return true;
-+ return false;
-+}
-+
-+static unsigned int execute_kallocstat(void)
-+{
-+ basic_block bb;
-+
-+ // 1. loop through BBs and GIMPLE statements
-+ FOR_EACH_BB(bb) {
-+ gimple_stmt_iterator gsi;
-+ for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
-+ // gimple match:
-+ tree fndecl, size;
-+ gimple call_stmt;
-+ const char *fnname;
-+
-+ // is it a call
-+ call_stmt = gsi_stmt(gsi);
-+ if (!is_gimple_call(call_stmt))
-+ continue;
-+ fndecl = gimple_call_fndecl(call_stmt);
-+ if (fndecl == NULL_TREE)
-+ continue;
-+ if (TREE_CODE(fndecl) != FUNCTION_DECL)
-+ continue;
-+
-+ // is it a call to k*alloc
-+ fnname = IDENTIFIER_POINTER(DECL_NAME(fndecl));
-+ if (!is_kalloc(fnname))
-+ continue;
-+
-+ // is the size arg the result of a simple const assignment
-+ size = gimple_call_arg(call_stmt, 0);
-+ while (true) {
-+ gimple def_stmt;
-+ expanded_location xloc;
-+ size_t size_val;
-+
-+ if (TREE_CODE(size) != SSA_NAME)
-+ break;
-+ def_stmt = SSA_NAME_DEF_STMT(size);
-+ if (!def_stmt || !is_gimple_assign(def_stmt))
-+ break;
-+ if (gimple_num_ops(def_stmt) != 2)
-+ break;
-+ size = gimple_assign_rhs1(def_stmt);
-+ if (!TREE_CONSTANT(size))
-+ continue;
-+ xloc = expand_location(gimple_location(def_stmt));
-+ if (!xloc.file)
-+ xloc = expand_location(DECL_SOURCE_LOCATION(current_function_decl));
-+ size_val = TREE_INT_CST_LOW(size);
-+ fprintf(stderr, "kallocsize: %8zu %8zx %s %s:%u\n", size_val, size_val, fnname, xloc.file, xloc.line);
-+ break;
-+ }
-+//print_gimple_stmt(stderr, call_stmt, 0, TDF_LINENO);
-+//debug_tree(gimple_call_fn(call_stmt));
-+//print_node(stderr, "pax", fndecl, 4);
-+ }
-+ }
-+
-+ return 0;
-+}
-+
-+int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
-+{
-+ const char * const plugin_name = plugin_info->base_name;
-+ struct register_pass_info kallocstat_pass_info = {
-+ .pass = &kallocstat_pass.pass,
-+ .reference_pass_name = "ssa",
-+ .ref_pass_instance_number = 1,
-+ .pos_op = PASS_POS_INSERT_AFTER
-+ };
-+
-+ if (!plugin_default_version_check(version, &gcc_version)) {
-+ error(G_("incompatible gcc/plugin versions"));
-+ return 1;
-+ }
-+
-+ register_callback(plugin_name, PLUGIN_INFO, NULL, &kallocstat_plugin_info);
-+ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kallocstat_pass_info);
-+
-+ return 0;
-+}
-diff --git a/tools/gcc/kernexec_plugin.c b/tools/gcc/kernexec_plugin.c
-new file mode 100644
-index 0000000..8856202
---- /dev/null
-+++ b/tools/gcc/kernexec_plugin.c
-@@ -0,0 +1,432 @@
-+/*
-+ * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
-+ * Licensed under the GPL v2
-+ *
-+ * Note: the choice of the license means that the compilation process is
-+ * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
-+ * but for the kernel it doesn't matter since it doesn't link against
-+ * any of the gcc libraries
-+ *
-+ * gcc plugin to make KERNEXEC/amd64 almost as good as it is on i386
-+ *
-+ * TODO:
-+ *
-+ * BUGS:
-+ * - none known
-+ */
-+#include "gcc-plugin.h"
-+#include "config.h"
-+#include "system.h"
-+#include "coretypes.h"
-+#include "tree.h"
-+#include "tree-pass.h"
-+#include "flags.h"
-+#include "intl.h"
-+#include "toplev.h"
-+#include "plugin.h"
-+//#include "expr.h" where are you...
-+#include "diagnostic.h"
-+#include "plugin-version.h"
-+#include "tm.h"
-+#include "function.h"
-+#include "basic-block.h"
-+#include "gimple.h"
-+#include "rtl.h"
-+#include "emit-rtl.h"
-+#include "tree-flow.h"
-+
-+extern void print_gimple_stmt(FILE *, gimple, int, int);
-+extern rtx emit_move_insn(rtx x, rtx y);
-+
-+#if BUILDING_GCC_VERSION <= 4006
-+#define ANY_RETURN_P(rtx) (GET_CODE(rtx) == RETURN)
-+#endif
-+
-+int plugin_is_GPL_compatible;
-+
-+static struct plugin_info kernexec_plugin_info = {
-+ .version = "201111291120",
-+ .help = "method=[bts|or]\tinstrumentation method\n"
-+};
-+
-+static unsigned int execute_kernexec_reload(void);
-+static unsigned int execute_kernexec_fptr(void);
-+static unsigned int execute_kernexec_retaddr(void);
-+static bool kernexec_cmodel_check(void);
-+
-+static void (*kernexec_instrument_fptr)(gimple_stmt_iterator *);
-+static void (*kernexec_instrument_retaddr)(rtx);
-+
-+static struct gimple_opt_pass kernexec_reload_pass = {
-+ .pass = {
-+ .type = GIMPLE_PASS,
-+ .name = "kernexec_reload",
-+ .gate = kernexec_cmodel_check,
-+ .execute = execute_kernexec_reload,
-+ .sub = NULL,
-+ .next = NULL,
-+ .static_pass_number = 0,
-+ .tv_id = TV_NONE,
-+ .properties_required = 0,
-+ .properties_provided = 0,
-+ .properties_destroyed = 0,
-+ .todo_flags_start = 0,
-+ .todo_flags_finish = TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_remove_unused_locals | TODO_update_ssa_no_phi
-+ }
-+};
-+
-+static struct gimple_opt_pass kernexec_fptr_pass = {
-+ .pass = {
-+ .type = GIMPLE_PASS,
-+ .name = "kernexec_fptr",
-+ .gate = kernexec_cmodel_check,
-+ .execute = execute_kernexec_fptr,
-+ .sub = NULL,
-+ .next = NULL,
-+ .static_pass_number = 0,
-+ .tv_id = TV_NONE,
-+ .properties_required = 0,
-+ .properties_provided = 0,
-+ .properties_destroyed = 0,
-+ .todo_flags_start = 0,
-+ .todo_flags_finish = TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_remove_unused_locals | TODO_update_ssa_no_phi
-+ }
-+};
-+
-+static struct rtl_opt_pass kernexec_retaddr_pass = {
-+ .pass = {
-+ .type = RTL_PASS,
-+ .name = "kernexec_retaddr",
-+ .gate = kernexec_cmodel_check,
-+ .execute = execute_kernexec_retaddr,
-+ .sub = NULL,
-+ .next = NULL,
-+ .static_pass_number = 0,
-+ .tv_id = TV_NONE,
-+ .properties_required = 0,
-+ .properties_provided = 0,
-+ .properties_destroyed = 0,
-+ .todo_flags_start = 0,
-+ .todo_flags_finish = TODO_dump_func | TODO_ggc_collect
-+ }
-+};
-+
-+static bool kernexec_cmodel_check(void)
-+{
-+ tree section;
-+
-+ if (ix86_cmodel != CM_KERNEL)
-+ return false;
-+
-+ section = lookup_attribute("section", DECL_ATTRIBUTES(current_function_decl));
-+ if (!section || !TREE_VALUE(section))
-+ return true;
-+
-+ section = TREE_VALUE(TREE_VALUE(section));
-+ if (strncmp(TREE_STRING_POINTER(section), ".vsyscall_", 10))
-+ return true;
-+
-+ return false;
-+}
-+
-+/*
-+ * add special KERNEXEC instrumentation: reload %r10 after it has been clobbered
-+ */
-+static void kernexec_reload_fptr_mask(gimple_stmt_iterator *gsi)
-+{
-+ gimple asm_movabs_stmt;
-+
-+ // build asm volatile("movabs $0x8000000000000000, %%r10\n\t" : : : );
-+ asm_movabs_stmt = gimple_build_asm_vec("movabs $0x8000000000000000, %%r10\n\t", NULL, NULL, NULL, NULL);
-+ gimple_asm_set_volatile(asm_movabs_stmt, true);
-+ gsi_insert_after(gsi, asm_movabs_stmt, GSI_CONTINUE_LINKING);
-+ update_stmt(asm_movabs_stmt);
-+}
-+
-+/*
-+ * find all asm() stmts that clobber r10 and add a reload of r10
-+ */
-+static unsigned int execute_kernexec_reload(void)
-+{
-+ basic_block bb;
-+
-+ // 1. loop through BBs and GIMPLE statements
-+ FOR_EACH_BB(bb) {
-+ gimple_stmt_iterator gsi;
-+
-+ for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
-+ // gimple match: __asm__ ("" : : : "r10");
-+ gimple asm_stmt;
-+ size_t nclobbers;
-+
-+ // is it an asm ...
-+ asm_stmt = gsi_stmt(gsi);
-+ if (gimple_code(asm_stmt) != GIMPLE_ASM)
-+ continue;
-+
-+ // ... clobbering r10
-+ nclobbers = gimple_asm_nclobbers(asm_stmt);
-+ while (nclobbers--) {
-+ tree op = gimple_asm_clobber_op(asm_stmt, nclobbers);
-+ if (strcmp(TREE_STRING_POINTER(TREE_VALUE(op)), "r10"))
-+ continue;
-+ kernexec_reload_fptr_mask(&gsi);
-+//print_gimple_stmt(stderr, asm_stmt, 0, TDF_LINENO);
-+ break;
-+ }
-+ }
-+ }
-+
-+ return 0;
-+}
-+
-+/*
-+ * add special KERNEXEC instrumentation: force MSB of fptr to 1, which will produce
-+ * a non-canonical address from a userland ptr and will just trigger a GPF on dereference
-+ */
-+static void kernexec_instrument_fptr_bts(gimple_stmt_iterator *gsi)
-+{
-+ gimple assign_intptr, assign_new_fptr, call_stmt;
-+ tree intptr, old_fptr, new_fptr, kernexec_mask;
-+
-+ call_stmt = gsi_stmt(*gsi);
-+ old_fptr = gimple_call_fn(call_stmt);
-+
-+ // create temporary unsigned long variable used for bitops and cast fptr to it
-+ intptr = create_tmp_var(long_unsigned_type_node, "kernexec_bts");
-+ add_referenced_var(intptr);
-+ mark_sym_for_renaming(intptr);
-+ assign_intptr = gimple_build_assign(intptr, fold_convert(long_unsigned_type_node, old_fptr));
-+ gsi_insert_before(gsi, assign_intptr, GSI_SAME_STMT);
-+ update_stmt(assign_intptr);
-+
-+ // apply logical or to temporary unsigned long and bitmask
-+ kernexec_mask = build_int_cstu(long_long_unsigned_type_node, 0x8000000000000000LL);
-+// kernexec_mask = build_int_cstu(long_long_unsigned_type_node, 0xffffffff80000000LL);
-+ assign_intptr = gimple_build_assign(intptr, fold_build2(BIT_IOR_EXPR, long_long_unsigned_type_node, intptr, kernexec_mask));
-+ gsi_insert_before(gsi, assign_intptr, GSI_SAME_STMT);
-+ update_stmt(assign_intptr);
-+
-+ // cast temporary unsigned long back to a temporary fptr variable
-+ new_fptr = create_tmp_var(TREE_TYPE(old_fptr), "kernexec_fptr");
-+ add_referenced_var(new_fptr);
-+ mark_sym_for_renaming(new_fptr);
-+ assign_new_fptr = gimple_build_assign(new_fptr, fold_convert(TREE_TYPE(old_fptr), intptr));
-+ gsi_insert_before(gsi, assign_new_fptr, GSI_SAME_STMT);
-+ update_stmt(assign_new_fptr);
-+
-+ // replace call stmt fn with the new fptr
-+ gimple_call_set_fn(call_stmt, new_fptr);
-+ update_stmt(call_stmt);
-+}
-+
-+static void kernexec_instrument_fptr_or(gimple_stmt_iterator *gsi)
-+{
-+ gimple asm_or_stmt, call_stmt;
-+ tree old_fptr, new_fptr, input, output;
-+ VEC(tree, gc) *inputs = NULL;
-+ VEC(tree, gc) *outputs = NULL;
-+
-+ call_stmt = gsi_stmt(*gsi);
-+ old_fptr = gimple_call_fn(call_stmt);
-+
-+ // create temporary fptr variable
-+ new_fptr = create_tmp_var(TREE_TYPE(old_fptr), "kernexec_or");
-+ add_referenced_var(new_fptr);
-+ mark_sym_for_renaming(new_fptr);
-+
-+ // build asm volatile("orq %%r10, %0\n\t" : "=r"(new_fptr) : "0"(old_fptr));
-+ input = build_tree_list(NULL_TREE, build_string(2, "0"));
-+ input = chainon(NULL_TREE, build_tree_list(input, old_fptr));
-+ output = build_tree_list(NULL_TREE, build_string(3, "=r"));
-+ output = chainon(NULL_TREE, build_tree_list(output, new_fptr));
-+ VEC_safe_push(tree, gc, inputs, input);
-+ VEC_safe_push(tree, gc, outputs, output);
-+ asm_or_stmt = gimple_build_asm_vec("orq %%r10, %0\n\t", inputs, outputs, NULL, NULL);
-+ gimple_asm_set_volatile(asm_or_stmt, true);
-+ gsi_insert_before(gsi, asm_or_stmt, GSI_SAME_STMT);
-+ update_stmt(asm_or_stmt);
-+
-+ // replace call stmt fn with the new fptr
-+ gimple_call_set_fn(call_stmt, new_fptr);
-+ update_stmt(call_stmt);
-+}
-+
-+/*
-+ * find all C level function pointer dereferences and forcibly set the highest bit of the pointer
-+ */
-+static unsigned int execute_kernexec_fptr(void)
-+{
-+ basic_block bb;
-+
-+ // 1. loop through BBs and GIMPLE statements
-+ FOR_EACH_BB(bb) {
-+ gimple_stmt_iterator gsi;
-+
-+ for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
-+ // gimple match: h_1 = get_fptr (); D.2709_3 = h_1 (x_2(D));
-+ tree fn;
-+ gimple call_stmt;
-+
-+ // is it a call ...
-+ call_stmt = gsi_stmt(gsi);
-+ if (!is_gimple_call(call_stmt))
-+ continue;
-+ fn = gimple_call_fn(call_stmt);
-+ if (TREE_CODE(fn) == ADDR_EXPR)
-+ continue;
-+ if (TREE_CODE(fn) != SSA_NAME)
-+ gcc_unreachable();
-+
-+ // ... through a function pointer
-+ fn = SSA_NAME_VAR(fn);
-+ if (TREE_CODE(fn) != VAR_DECL && TREE_CODE(fn) != PARM_DECL)
-+ continue;
-+ fn = TREE_TYPE(fn);
-+ if (TREE_CODE(fn) != POINTER_TYPE)
-+ continue;
-+ fn = TREE_TYPE(fn);
-+ if (TREE_CODE(fn) != FUNCTION_TYPE)
-+ continue;
-+
-+ kernexec_instrument_fptr(&gsi);
-+
-+//debug_tree(gimple_call_fn(call_stmt));
-+//print_gimple_stmt(stderr, call_stmt, 0, TDF_LINENO);
-+ }
-+ }
-+
-+ return 0;
-+}
-+
-+// add special KERNEXEC instrumentation: btsq $63,(%rsp) just before retn
-+static void kernexec_instrument_retaddr_bts(rtx insn)
-+{
-+ rtx btsq;
-+ rtvec argvec, constraintvec, labelvec;
-+ int line;
-+
-+ // create asm volatile("btsq $63,(%%rsp)":::)
-+ argvec = rtvec_alloc(0);
-+ constraintvec = rtvec_alloc(0);
-+ labelvec = rtvec_alloc(0);
-+ line = expand_location(RTL_LOCATION(insn)).line;
-+ btsq = gen_rtx_ASM_OPERANDS(VOIDmode, "btsq $63,(%%rsp)", empty_string, 0, argvec, constraintvec, labelvec, line);
-+ MEM_VOLATILE_P(btsq) = 1;
-+// RTX_FRAME_RELATED_P(btsq) = 1; // not for ASM_OPERANDS
-+ emit_insn_before(btsq, insn);
-+}
-+
-+// add special KERNEXEC instrumentation: orq %r10,(%rsp) just before retn
-+static void kernexec_instrument_retaddr_or(rtx insn)
-+{
-+ rtx orq;
-+ rtvec argvec, constraintvec, labelvec;
-+ int line;
-+
-+ // create asm volatile("orq %%r10,(%%rsp)":::)
-+ argvec = rtvec_alloc(0);
-+ constraintvec = rtvec_alloc(0);
-+ labelvec = rtvec_alloc(0);
-+ line = expand_location(RTL_LOCATION(insn)).line;
-+ orq = gen_rtx_ASM_OPERANDS(VOIDmode, "orq %%r10,(%%rsp)", empty_string, 0, argvec, constraintvec, labelvec, line);
-+ MEM_VOLATILE_P(orq) = 1;
-+// RTX_FRAME_RELATED_P(orq) = 1; // not for ASM_OPERANDS
-+ emit_insn_before(orq, insn);
-+}
-+
-+/*
-+ * find all asm level function returns and forcibly set the highest bit of the return address
-+ */
-+static unsigned int execute_kernexec_retaddr(void)
-+{
-+ rtx insn;
-+
-+ // 1. find function returns
-+ for (insn = get_insns(); insn; insn = NEXT_INSN(insn)) {
-+ // rtl match: (jump_insn 41 40 42 2 (return) fptr.c:42 634 {return_internal} (nil))
-+ // (jump_insn 12 9 11 2 (parallel [ (return) (unspec [ (0) ] UNSPEC_REP) ]) fptr.c:46 635 {return_internal_long} (nil))
-+ // (jump_insn 97 96 98 6 (simple_return) fptr.c:50 -1 (nil) -> simple_return)
-+ rtx body;
-+
-+ // is it a retn
-+ if (!JUMP_P(insn))
-+ continue;
-+ body = PATTERN(insn);
-+ if (GET_CODE(body) == PARALLEL)
-+ body = XVECEXP(body, 0, 0);
-+ if (!ANY_RETURN_P(body))
-+ continue;
-+ kernexec_instrument_retaddr(insn);
-+ }
-+
-+// print_simple_rtl(stderr, get_insns());
-+// print_rtl(stderr, get_insns());
-+
-+ return 0;
-+}
-+
-+int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
-+{
-+ const char * const plugin_name = plugin_info->base_name;
-+ const int argc = plugin_info->argc;
-+ const struct plugin_argument * const argv = plugin_info->argv;
-+ int i;
-+ struct register_pass_info kernexec_reload_pass_info = {
-+ .pass = &kernexec_reload_pass.pass,
-+ .reference_pass_name = "ssa",
-+ .ref_pass_instance_number = 1,
-+ .pos_op = PASS_POS_INSERT_AFTER
-+ };
-+ struct register_pass_info kernexec_fptr_pass_info = {
-+ .pass = &kernexec_fptr_pass.pass,
-+ .reference_pass_name = "ssa",
-+ .ref_pass_instance_number = 1,
-+ .pos_op = PASS_POS_INSERT_AFTER
-+ };
-+ struct register_pass_info kernexec_retaddr_pass_info = {
-+ .pass = &kernexec_retaddr_pass.pass,
-+ .reference_pass_name = "pro_and_epilogue",
-+ .ref_pass_instance_number = 1,
-+ .pos_op = PASS_POS_INSERT_AFTER
-+ };
-+
-+ if (!plugin_default_version_check(version, &gcc_version)) {
-+ error(G_("incompatible gcc/plugin versions"));
-+ return 1;
-+ }
-+
-+ register_callback(plugin_name, PLUGIN_INFO, NULL, &kernexec_plugin_info);
-+
-+ if (TARGET_64BIT == 0)
-+ return 0;
-+
-+ for (i = 0; i < argc; ++i) {
-+ if (!strcmp(argv[i].key, "method")) {
-+ if (!argv[i].value) {
-+ error(G_("no value supplied for option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
-+ continue;
-+ }
-+ if (!strcmp(argv[i].value, "bts")) {
-+ kernexec_instrument_fptr = kernexec_instrument_fptr_bts;
-+ kernexec_instrument_retaddr = kernexec_instrument_retaddr_bts;
-+ } else if (!strcmp(argv[i].value, "or")) {
-+ kernexec_instrument_fptr = kernexec_instrument_fptr_or;
-+ kernexec_instrument_retaddr = kernexec_instrument_retaddr_or;
-+ fix_register("r10", 1, 1);
-+ } else
-+ error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
-+ continue;
-+ }
-+ error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
-+ }
-+ if (!kernexec_instrument_fptr || !kernexec_instrument_retaddr)
-+ error(G_("no instrumentation method was selected via '-fplugin-arg-%s-method'"), plugin_name);
-+
-+ if (kernexec_instrument_fptr == kernexec_instrument_fptr_or)
-+ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kernexec_reload_pass_info);
-+ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kernexec_fptr_pass_info);
-+ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kernexec_retaddr_pass_info);
-+
-+ return 0;
-+}
-diff --git a/tools/gcc/latent_entropy_plugin.c b/tools/gcc/latent_entropy_plugin.c
-new file mode 100644
-index 0000000..b8008f7
---- /dev/null
-+++ b/tools/gcc/latent_entropy_plugin.c
-@@ -0,0 +1,295 @@
-+/*
-+ * Copyright 2012 by the PaX Team <pageexec@freemail.hu>
-+ * Licensed under the GPL v2
-+ *
-+ * Note: the choice of the license means that the compilation process is
-+ * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
-+ * but for the kernel it doesn't matter since it doesn't link against
-+ * any of the gcc libraries
-+ *
-+ * gcc plugin to help generate a little bit of entropy from program state,
-+ * used during boot in the kernel
-+ *
-+ * TODO:
-+ * - add ipa pass to identify not explicitly marked candidate functions
-+ * - mix in more program state (function arguments/return values, loop variables, etc)
-+ * - more instrumentation control via attribute parameters
-+ *
-+ * BUGS:
-+ * - LTO needs -flto-partition=none for now
-+ */
-+#include "gcc-plugin.h"
-+#include "config.h"
-+#include "system.h"
-+#include "coretypes.h"
-+#include "tree.h"
-+#include "tree-pass.h"
-+#include "flags.h"
-+#include "intl.h"
-+#include "toplev.h"
-+#include "plugin.h"
-+//#include "expr.h" where are you...
-+#include "diagnostic.h"
-+#include "plugin-version.h"
-+#include "tm.h"
-+#include "function.h"
-+#include "basic-block.h"
-+#include "gimple.h"
-+#include "rtl.h"
-+#include "emit-rtl.h"
-+#include "tree-flow.h"
-+
-+int plugin_is_GPL_compatible;
-+
-+static tree latent_entropy_decl;
-+
-+static struct plugin_info latent_entropy_plugin_info = {
-+ .version = "201207271820",
-+ .help = NULL
-+};
-+
-+static unsigned int execute_latent_entropy(void);
-+static bool gate_latent_entropy(void);
-+
-+static struct gimple_opt_pass latent_entropy_pass = {
-+ .pass = {
-+ .type = GIMPLE_PASS,
-+ .name = "latent_entropy",
-+ .gate = gate_latent_entropy,
-+ .execute = execute_latent_entropy,
-+ .sub = NULL,
-+ .next = NULL,
-+ .static_pass_number = 0,
-+ .tv_id = TV_NONE,
-+ .properties_required = PROP_gimple_leh | PROP_cfg,
-+ .properties_provided = 0,
-+ .properties_destroyed = 0,
-+ .todo_flags_start = 0, //TODO_verify_ssa | TODO_verify_flow | TODO_verify_stmts,
-+ .todo_flags_finish = TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_update_ssa
-+ }
-+};
-+
-+static tree handle_latent_entropy_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
-+{
-+ if (TREE_CODE(*node) != FUNCTION_DECL) {
-+ *no_add_attrs = true;
-+ error("%qE attribute only applies to functions", name);
-+ }
-+ return NULL_TREE;
-+}
-+
-+static struct attribute_spec latent_entropy_attr = {
-+ .name = "latent_entropy",
-+ .min_length = 0,
-+ .max_length = 0,
-+ .decl_required = true,
-+ .type_required = false,
-+ .function_type_required = false,
-+ .handler = handle_latent_entropy_attribute,
-+#if BUILDING_GCC_VERSION >= 4007
-+ .affects_type_identity = false
-+#endif
-+};
-+
-+static void register_attributes(void *event_data, void *data)
-+{
-+ register_attribute(&latent_entropy_attr);
-+}
-+
-+static bool gate_latent_entropy(void)
-+{
-+ tree latent_entropy_attr;
-+
-+ latent_entropy_attr = lookup_attribute("latent_entropy", DECL_ATTRIBUTES(current_function_decl));
-+ return latent_entropy_attr != NULL_TREE;
-+}
-+
-+static unsigned HOST_WIDE_INT seed;
-+static unsigned HOST_WIDE_INT get_random_const(void)
-+{
-+ seed = (seed >> 1U) ^ (-(seed & 1ULL) & 0xD800000000000000ULL);
-+ return seed;
-+}
-+
-+static enum tree_code get_op(tree *rhs)
-+{
-+ static enum tree_code op;
-+ unsigned HOST_WIDE_INT random_const;
-+
-+ random_const = get_random_const();
-+
-+ switch (op) {
-+ case BIT_XOR_EXPR:
-+ op = PLUS_EXPR;
-+ break;
-+
-+ case PLUS_EXPR:
-+ if (rhs) {
-+ op = LROTATE_EXPR;
-+ random_const &= HOST_BITS_PER_WIDE_INT - 1;
-+ break;
-+ }
-+
-+ case LROTATE_EXPR:
-+ default:
-+ op = BIT_XOR_EXPR;
-+ break;
-+ }
-+ if (rhs)
-+ *rhs = build_int_cstu(unsigned_intDI_type_node, random_const);
-+ return op;
-+}
-+
-+static void perturb_local_entropy(basic_block bb, tree local_entropy)
-+{
-+ gimple_stmt_iterator gsi;
-+ gimple assign;
-+ tree addxorrol, rhs;
-+ enum tree_code op;
-+
-+ op = get_op(&rhs);
-+ addxorrol = fold_build2_loc(UNKNOWN_LOCATION, op, unsigned_intDI_type_node, local_entropy, rhs);
-+ assign = gimple_build_assign(local_entropy, addxorrol);
-+ find_referenced_vars_in(assign);
-+//debug_bb(bb);
-+ gsi = gsi_after_labels(bb);
-+ gsi_insert_before(&gsi, assign, GSI_NEW_STMT);
-+ update_stmt(assign);
-+}
-+
-+static void perturb_latent_entropy(basic_block bb, tree rhs)
-+{
-+ gimple_stmt_iterator gsi;
-+ gimple assign;
-+ tree addxorrol, temp;
-+
-+ // 1. create temporary copy of latent_entropy
-+ temp = create_tmp_var(unsigned_intDI_type_node, "temp_latent_entropy");
-+ add_referenced_var(temp);
-+ mark_sym_for_renaming(temp);
-+
-+ // 2. read...
-+ assign = gimple_build_assign(temp, latent_entropy_decl);
-+ find_referenced_vars_in(assign);
-+ gsi = gsi_after_labels(bb);
-+ gsi_insert_after(&gsi, assign, GSI_NEW_STMT);
-+ update_stmt(assign);
-+
-+ // 3. ...modify...
-+ addxorrol = fold_build2_loc(UNKNOWN_LOCATION, get_op(NULL), unsigned_intDI_type_node, temp, rhs);
-+ assign = gimple_build_assign(temp, addxorrol);
-+ find_referenced_vars_in(assign);
-+ gsi_insert_after(&gsi, assign, GSI_NEW_STMT);
-+ update_stmt(assign);
-+
-+ // 4. ...write latent_entropy
-+ assign = gimple_build_assign(latent_entropy_decl, temp);
-+ find_referenced_vars_in(assign);
-+ gsi_insert_after(&gsi, assign, GSI_NEW_STMT);
-+ update_stmt(assign);
-+}
-+
-+static unsigned int execute_latent_entropy(void)
-+{
-+ basic_block bb;
-+ gimple assign;
-+ gimple_stmt_iterator gsi;
-+ tree local_entropy;
-+
-+ if (!latent_entropy_decl) {
-+ struct varpool_node *node;
-+
-+ for (node = varpool_nodes; node; node = node->next) {
-+ tree var = node->decl;
-+ if (strcmp(IDENTIFIER_POINTER(DECL_NAME(var)), "latent_entropy"))
-+ continue;
-+ latent_entropy_decl = var;
-+// debug_tree(var);
-+ break;
-+ }
-+ if (!latent_entropy_decl) {
-+// debug_tree(current_function_decl);
-+ return 0;
-+ }
-+ }
-+
-+//fprintf(stderr, "latent_entropy: %s\n", IDENTIFIER_POINTER(DECL_NAME(current_function_decl)));
-+
-+ // 1. create local entropy variable
-+ local_entropy = create_tmp_var(unsigned_intDI_type_node, "local_entropy");
-+ add_referenced_var(local_entropy);
-+ mark_sym_for_renaming(local_entropy);
-+
-+ // 2. initialize local entropy variable
-+ bb = split_block_after_labels(ENTRY_BLOCK_PTR)->dest;
-+ if (dom_info_available_p(CDI_DOMINATORS))
-+ set_immediate_dominator(CDI_DOMINATORS, bb, ENTRY_BLOCK_PTR);
-+ gsi = gsi_start_bb(bb);
-+
-+ assign = gimple_build_assign(local_entropy, build_int_cstu(unsigned_intDI_type_node, get_random_const()));
-+// gimple_set_location(assign, loc);
-+ find_referenced_vars_in(assign);
-+ gsi_insert_after(&gsi, assign, GSI_NEW_STMT);
-+ update_stmt(assign);
-+ bb = bb->next_bb;
-+
-+ // 3. instrument each BB with an operation on the local entropy variable
-+ while (bb != EXIT_BLOCK_PTR) {
-+ perturb_local_entropy(bb, local_entropy);
-+ bb = bb->next_bb;
-+ };
-+
-+ // 4. mix local entropy into the global entropy variable
-+ perturb_latent_entropy(EXIT_BLOCK_PTR->prev_bb, local_entropy);
-+ return 0;
-+}
-+
-+static void start_unit_callback(void *gcc_data, void *user_data)
-+{
-+#if BUILDING_GCC_VERSION >= 4007
-+ seed = get_random_seed(false);
-+#else
-+ sscanf(get_random_seed(false), "%" HOST_WIDE_INT_PRINT "x", &seed);
-+ seed *= seed;
-+#endif
-+
-+ if (in_lto_p)
-+ return;
-+
-+ // extern u64 latent_entropy
-+ latent_entropy_decl = build_decl(UNKNOWN_LOCATION, VAR_DECL, get_identifier("latent_entropy"), unsigned_intDI_type_node);
-+
-+ TREE_STATIC(latent_entropy_decl) = 1;
-+ TREE_PUBLIC(latent_entropy_decl) = 1;
-+ TREE_USED(latent_entropy_decl) = 1;
-+ TREE_THIS_VOLATILE(latent_entropy_decl) = 1;
-+ DECL_EXTERNAL(latent_entropy_decl) = 1;
-+ DECL_ARTIFICIAL(latent_entropy_decl) = 0;
-+ DECL_INITIAL(latent_entropy_decl) = NULL;
-+// DECL_ASSEMBLER_NAME(latent_entropy_decl);
-+// varpool_finalize_decl(latent_entropy_decl);
-+// varpool_mark_needed_node(latent_entropy_decl);
-+}
-+
-+int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
-+{
-+ const char * const plugin_name = plugin_info->base_name;
-+ struct register_pass_info latent_entropy_pass_info = {
-+ .pass = &latent_entropy_pass.pass,
-+ .reference_pass_name = "optimized",
-+ .ref_pass_instance_number = 1,
-+ .pos_op = PASS_POS_INSERT_BEFORE
-+ };
-+
-+ if (!plugin_default_version_check(version, &gcc_version)) {
-+ error(G_("incompatible gcc/plugin versions"));
-+ return 1;
-+ }
-+
-+ register_callback(plugin_name, PLUGIN_INFO, NULL, &latent_entropy_plugin_info);
-+ register_callback ("start_unit", PLUGIN_START_UNIT, &start_unit_callback, NULL);
-+ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &latent_entropy_pass_info);
-+ register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
-+
-+ return 0;
-+}
-diff --git a/tools/gcc/size_overflow_hash.data b/tools/gcc/size_overflow_hash.data
-new file mode 100644
-index 0000000..7cfdcc5
---- /dev/null
-+++ b/tools/gcc/size_overflow_hash.data
-@@ -0,0 +1,2565 @@
-+ipw_queue_tx_init_49161 ipw_queue_tx_init 3 49161 NULL
-+scsi_nl_send_vendor_msg_16394 scsi_nl_send_vendor_msg 5 16394 NULL
-+acpi_video_bus_write_POST_30039 acpi_video_bus_write_POST 3 30039 NULL
-+recent_mt_proc_write_8206 recent_mt_proc_write 3 8206 NULL
-+alloc_trdev_16399 alloc_trdev 1 16399 NULL
-+rds_sendmsg_40976 rds_sendmsg 4 40976 NULL
-+econet_recvmsg_40978 econet_recvmsg 4 40978 NULL
-+rt2x00debug_write_bbp_8212 rt2x00debug_write_bbp 3 8212 NULL
-+diva_os_malloc_16406 diva_os_malloc 2 16406 NULL
-+compat_sock_setsockopt_23 compat_sock_setsockopt 5 23 NULL
-+play_iframe_8219 play_iframe 3 8219 NULL
-+rxrpc_server_keyring_16431 rxrpc_server_keyring 3 16431 NULL
-+usbvideo_rvmalloc_17758 usbvideo_rvmalloc 1 17758 NULL
-+sel_read_policyvers_55 sel_read_policyvers 3 55 NULL nohasharray
-+padzero_55 padzero 1 55 &sel_read_policyvers_55
-+cfg80211_disconnected_57 cfg80211_disconnected 4 57 NULL
-+read_file_blob_57406 read_file_blob 3 57406 NULL
-+sctp_getsockopt_primary_addr_24639 sctp_getsockopt_primary_addr 2 24639 NULL
-+hpsb_write_49217 hpsb_write 6 49217 NULL
-+enclosure_register_57412 enclosure_register 3 57412 NULL
-+t3_init_l2t_8261 t3_init_l2t 1 8261 NULL
-+_req_append_segment_41031 _req_append_segment 2 41031 NULL
-+netlink_change_ngroups_16457 netlink_change_ngroups 2 16457 NULL
-+mISDN_sock_sendmsg_41035 mISDN_sock_sendmsg 4 41035 NULL
-+DepcaSignature_80 DepcaSignature 2 80 NULL nohasharray
-+crypto_authenc_setkey_80 crypto_authenc_setkey 3 80 &DepcaSignature_80
-+init_cdev_8274 init_cdev 1 8274 NULL
-+__mwl8k_cmd_mac_multicast_adr_57427 __mwl8k_cmd_mac_multicast_adr 2 57427 NULL
-+copy_to_user_fromio_57432 copy_to_user_fromio 3 57432 NULL
-+i2400m_queue_work_41051 i2400m_queue_work 5 41051 NULL
-+snd_korg1212_copy_to_92 snd_korg1212_copy_to 6 92 NULL
-+load_msg_95 load_msg 2 95 NULL
-+sctp_tsnmap_grow_32784 sctp_tsnmap_grow 2 32784 NULL
-+new_tape_buffer_32866 new_tape_buffer 2 32866 NULL
-+wm8400_i2c_write_49251 wm8400_i2c_write 3 49251 NULL
-+sctp_make_fwdtsn_53265 sctp_make_fwdtsn 3 53265 NULL
-+sys_pselect6_57449 sys_pselect6 1 57449 NULL
-+biovec_create_pools_9575 biovec_create_pools 2 9575 NULL
-+tracing_readme_read_16493 tracing_readme_read 3 16493 NULL
-+acpi_system_write_sleep_57456 acpi_system_write_sleep 3 57456 NULL
-+ieee80211_send_probe_req_49265 ieee80211_send_probe_req 6 49265 NULL
-+cfg80211_inform_bss_frame_41078 cfg80211_inform_bss_frame 4 41078 NULL
-+sisusb_clear_vram_57466 sisusb_clear_vram 2-3 57466 NULL
-+snd_cs4281_BA0_read_6847 snd_cs4281_BA0_read 5-6 6847 NULL
-+osd_req_add_get_attr_list_49278 osd_req_add_get_attr_list 3 49278 NULL
-+sysctl_string_modpriv_32895 sysctl_string_modpriv 5 32895 NULL
-+construct_key_and_link_8321 construct_key_and_link 4 8321 NULL
-+leaf_dealloc_24706 leaf_dealloc 3 24706 NULL
-+init_q_132 init_q 4 132 NULL
-+ipwireless_send_packet_8328 ipwireless_send_packet 4 8328 NULL
-+memstick_alloc_host_142 memstick_alloc_host 1 142 NULL
-+uio_read_49300 uio_read 3 49300 NULL
-+btrfs_mksubvol_150 btrfs_mksubvol 3 150 NULL
-+tracing_entries_read_8345 tracing_entries_read 3 8345 NULL
-+oom_adjust_write_41116 oom_adjust_write 3 41116 NULL
-+copy_in_user_57502 copy_in_user 3 57502 NULL
-+simple_attr_read_24738 simple_attr_read 3 24738 NULL
-+ath_rxbuf_alloc_24745 ath_rxbuf_alloc 2 24745 NULL
-+init_tag_map_57515 init_tag_map 3 57515 NULL
-+cmm_read_57520 cmm_read 3 57520 NULL
-+kgdb_hex2mem_24755 kgdb_hex2mem 3 24755 NULL
-+lpfc_debugfs_read_16566 lpfc_debugfs_read 3 16566 NULL
-+DoC_Probe_57534 DoC_Probe 1 57534 NULL
-+pcpu_embed_first_chunk_24224 pcpu_embed_first_chunk 3 24224 NULL
-+agp_allocate_memory_wrap_16576 agp_allocate_memory_wrap 1 16576 NULL nohasharray
-+new_partial_datagram_16576 new_partial_datagram 4 16576 &agp_allocate_memory_wrap_16576
-+mI_alloc_skb_24770 mI_alloc_skb 1 24770 NULL
-+iscsi_session_setup_196 iscsi_session_setup 4-5 196 NULL
-+decode_asn1_bitstring_198 decode_asn1_bitstring 4 198 NULL
-+xdi_copy_from_user_8395 xdi_copy_from_user 4 8395 NULL
-+joydev_ioctl_common_49359 joydev_ioctl_common 2 49359 NULL
-+dvb_ca_write_41171 dvb_ca_write 3 41171 NULL
-+cache_read_24790 cache_read 3 24790 NULL
-+store_cpufv_215 store_cpufv 4 215 NULL
-+compat_filldir_32999 compat_filldir 3 32999 NULL
-+ieee80211_if_read_auto_open_plinks_38268 ieee80211_if_read_auto_open_plinks 3 38268 NULL nohasharray
-+mthca_alloc_icm_table_38268 mthca_alloc_icm_table 3-4 38268 &ieee80211_if_read_auto_open_plinks_38268
-+iscsi_alloc_session_49390 iscsi_alloc_session 3 49390 NULL
-+xfs_readdir_41200 xfs_readdir 3 41200 NULL
-+wl1271_rx_handle_data_47827 wl1271_rx_handle_data 2 47827 NULL
-+dvb_usercopy_16640 dvb_usercopy 3 16640 NULL
-+proc_scsi_write_proc_267 proc_scsi_write_proc 3 267 NULL
-+ip_append_data_41234 ip_append_data 4-5 41234 NULL
-+platform_device_register_data_16660 platform_device_register_data 5 16660 NULL
-+sk_stream_alloc_skb_57622 sk_stream_alloc_skb 2 57622 NULL
-+iwl_dbgfs_ucode_general_stats_read_49199 iwl_dbgfs_ucode_general_stats_read 3 49199 NULL
-+probe_kernel_read_49437 probe_kernel_read 3 49437 NULL
-+sisusbcon_putcs_57630 sisusbcon_putcs 3 57630 NULL
-+hpsb_make_readpacket_34181 hpsb_make_readpacket 4 34181 NULL
-+pnp_alloc_24869 pnp_alloc 1 24869 NULL
-+hiddev_compat_ioctl_41255 hiddev_compat_ioctl 2 41255 NULL
-+stats_dot11RTSSuccessCount_read_33065 stats_dot11RTSSuccessCount_read 3 33065 NULL
-+sel_read_checkreqprot_33068 sel_read_checkreqprot 3 33068 NULL
-+queues_read_24877 queues_read 3 24877 NULL
-+dlm_new_lockspace_16688 dlm_new_lockspace 2 16688 NULL
-+platform_device_add_data_310 platform_device_add_data 3 310 NULL
-+agp_3_5_isochronous_node_enable_49465 agp_3_5_isochronous_node_enable 3 49465 NULL
-+iwl_dbgfs_tx_statistics_read_314 iwl_dbgfs_tx_statistics_read 3 314 NULL nohasharray
-+dn_setsockopt_314 dn_setsockopt 5 314 &iwl_dbgfs_tx_statistics_read_314
-+sys_mq_timedsend_57661 sys_mq_timedsend 3 57661 NULL
-+r3964_write_57662 r3964_write 4 57662 NULL
-+xfs_iformat_local_49472 xfs_iformat_local 4 49472 NULL
-+dn_nsp_do_disc_49474 dn_nsp_do_disc 2-6 49474 NULL
-+alloc_context_41283 alloc_context 1 41283 NULL
-+__lgwrite_57669 __lgwrite 4 57669 NULL
-+sctp_recvmsg_23265 sctp_recvmsg 4 23265 NULL
-+acpi_processor_write_throttling_16712 acpi_processor_write_throttling 3 16712 NULL
-+isr_decrypt_done_read_49490 isr_decrypt_done_read 3 49490 NULL
-+ieee80211_fragment_33112 ieee80211_fragment 4 33112 NULL
-+write_node_33121 write_node 4 33121 NULL
-+ip_vs_icmp_xmit_57701 ip_vs_icmp_xmit 4 57701 NULL
-+i2400m_rx_stats_read_57706 i2400m_rx_stats_read 3 57706 NULL
-+CIFSSMBWrite_33131 CIFSSMBWrite 4 33131 NULL
-+iscsi_recv_pdu_16755 iscsi_recv_pdu 4 16755 NULL
-+user_update_41332 user_update 3 41332 NULL
-+cmtp_send_interopmsg_376 cmtp_send_interopmsg 7 376 NULL
-+cache_slow_downcall_8570 cache_slow_downcall 2 8570 NULL
-+lbs_getscantable_24955 lbs_getscantable 3 24955 NULL
-+isr_dma0_done_read_8574 isr_dma0_done_read 3 8574 NULL
-+nfs4_init_slot_table_33152 nfs4_init_slot_table 2 33152 NULL
-+sys_rt_sigpending_24961 sys_rt_sigpending 2 24961 NULL
-+ip_nat_sip_expect_57732 ip_nat_sip_expect 6 57732 NULL
-+add_rx_skb_8257 add_rx_skb 3 8257 NULL
-+do_fcntl_31468 do_fcntl 3 31468 NULL
-+compat_sys_set_mempolicy_57742 compat_sys_set_mempolicy 3 57742 NULL nohasharray
-+pppol2tp_recvmsg_57742 pppol2tp_recvmsg 4 57742 &compat_sys_set_mempolicy_57742
-+sctp_make_op_error_space_5528 sctp_make_op_error_space 3 5528 NULL
-+tun_get_user_33178 tun_get_user 3 33178 NULL
-+llc_ui_sendmsg_24987 llc_ui_sendmsg 4 24987 NULL
-+kmp_init_41373 kmp_init 2 41373 NULL
-+lbs_rdmac_read_418 lbs_rdmac_read 3 418 NULL
-+ntfs_malloc_nofs_49572 ntfs_malloc_nofs 1 49572 NULL
-+alloc_chunk_49575 alloc_chunk 1 49575 NULL
-+sctp_setsockopt_default_send_param_49578 sctp_setsockopt_default_send_param 3 49578 NULL nohasharray
-+hidraw_report_event_49578 hidraw_report_event 3 49578 &sctp_setsockopt_default_send_param_49578
-+key_conf_hw_key_idx_read_25003 key_conf_hw_key_idx_read 3 25003 NULL
-+shash_setkey_unaligned_8620 shash_setkey_unaligned 3 8620 NULL
-+dm_vcalloc_16814 dm_vcalloc 1-2 16814 NULL
-+dataflash_read_fact_otp_33204 dataflash_read_fact_otp 3-2 33204 NULL
-+isr_commands_read_41398 isr_commands_read 3 41398 NULL
-+pp_read_33210 pp_read 3 33210 NULL
-+sys_flistxattr_41407 sys_flistxattr 3 41407 NULL
-+scsi_mode_sense_16835 scsi_mode_sense 5 16835 NULL
-+ivtv_read_57796 ivtv_read 3 57796 NULL
-+isr_wakeups_read_49607 isr_wakeups_read 3 49607 NULL
-+xfs_iext_add_41422 xfs_iext_add 3 41422 NULL
-+heap_init_49617 heap_init 2 49617 NULL
-+isdn_ppp_fill_rq_41428 isdn_ppp_fill_rq 2 41428 NULL
-+smk_write_doi_49621 smk_write_doi 3 49621 NULL
-+_alloc_get_attr_desc_470 _alloc_get_attr_desc 2 470 NULL
-+lbs_rdrf_read_41431 lbs_rdrf_read 3 41431 NULL
-+receive_packet_12367 receive_packet 2 12367 NULL
-+ntfs_file_buffered_write_41442 ntfs_file_buffered_write 4-6 41442 NULL
-+pcpu_build_alloc_info_41443 pcpu_build_alloc_info 3 41443 NULL
-+lbs_bcnmiss_read_8678 lbs_bcnmiss_read 3 8678 NULL
-+st_write_16874 st_write 3 16874 NULL
-+copy_to_user_57835 copy_to_user 3 57835 NULL
-+pidlist_resize_496 pidlist_resize 2 496 NULL
-+mangle_eprt_packet_16882 mangle_eprt_packet 5 16882 NULL
-+flash_read_57843 flash_read 3 57843 NULL
-+cachefiles_cook_key_33274 cachefiles_cook_key 2 33274 NULL
-+rds_message_map_pages_31487 rds_message_map_pages 2 31487 NULL
-+arcfb_write_8702 arcfb_write 3 8702 NULL
-+cxio_hal_init_rhdl_resource_25104 cxio_hal_init_rhdl_resource 1 25104 NULL
-+sock_wmalloc_16472 sock_wmalloc 2 16472 NULL
-+snd_rawmidi_kernel_write_25106 snd_rawmidi_kernel_write 3 25106 NULL
-+wep_interrupt_read_41492 wep_interrupt_read 3 41492 NULL
-+tracing_max_lat_write_8728 tracing_max_lat_write 3 8728 NULL
-+hpfs_translate_name_41497 hpfs_translate_name 3 41497 NULL
-+mcs7830_get_reg_33308 mcs7830_get_reg 3 33308 NULL
-+snd_gf1_mem_proc_dump_16926 snd_gf1_mem_proc_dump 5-6 16926 NULL
-+dn_def_dev_strategy_51973 dn_def_dev_strategy 5 51973 NULL
-+sys_gethostname_49698 sys_gethostname 2 49698 NULL
-+vhci_read_47878 vhci_read 3 47878 NULL
-+devres_alloc_551 devres_alloc 2 551 NULL
-+xt_alloc_table_info_57903 xt_alloc_table_info 1 57903 NULL
-+em28xx_init_isoc_8755 em28xx_init_isoc 2-3 8755 NULL
-+emi26_writememory_57908 emi26_writememory 4 57908 NULL
-+hpsb_create_hostinfo_49717 hpsb_create_hostinfo 3 49717 NULL
-+joydev_compat_ioctl_8765 joydev_compat_ioctl 2 8765 NULL
-+joydev_ioctl_33343 joydev_ioctl 2 33343 NULL
-+compat_sys_preadv_583 compat_sys_preadv 3 583 NULL
-+sys_fsetxattr_49736 sys_fsetxattr 4 49736 NULL
-+create_xattr_datum_33356 create_xattr_datum 5 33356 NULL
-+sel_read_handle_unknown_57933 sel_read_handle_unknown 3 57933 NULL
-+sys_fgetxattr_25166 sys_fgetxattr 4 25166 NULL
-+ipath_init_qp_table_25167 ipath_init_qp_table 2 25167 NULL
-+zd_usb_iowrite16v_49744 zd_usb_iowrite16v 3 49744 NULL
-+cache_do_downcall_6926 cache_do_downcall 3 6926 NULL
-+rx_57944 rx 4 57944 NULL
-+sctp_getsockopt_local_addrs_25178 sctp_getsockopt_local_addrs 2 25178 NULL
-+key_conf_keylen_read_49758 key_conf_keylen_read 3 49758 NULL
-+cpuset_common_file_read_8800 cpuset_common_file_read 5 8800 NULL
-+sctp_ulpevent_new_33377 sctp_ulpevent_new 1 33377 NULL
-+fuse_conn_waiting_read_49762 fuse_conn_waiting_read 3 49762 NULL
-+ieee80211_if_read_dropped_frames_no_route_33383 ieee80211_if_read_dropped_frames_no_route 3 33383 NULL
-+viafb_dfpl_proc_write_627 viafb_dfpl_proc_write 3 627 NULL
-+hfc_empty_fifo_57972 hfc_empty_fifo 2 57972 NULL
-+metronomefb_write_8823 metronomefb_write 3 8823 NULL
-+tw_change_queue_depth_57980 tw_change_queue_depth 2 57980 NULL
-+iwm_if_alloc_17027 iwm_if_alloc 1 17027 NULL
-+hpsb_alloc_packet_49798 hpsb_alloc_packet 1 49798 NULL
-+sys_dup3_33421 sys_dup3 2 33421 NULL
-+nfs4_acl_new_49806 nfs4_acl_new 1 49806 NULL
-+rx_reset_counter_read_58001 rx_reset_counter_read 3 58001 NULL
-+mon_stat_read_25238 mon_stat_read 3 25238 NULL
-+wa_nep_queue_8858 wa_nep_queue 2 8858 NULL
-+ntfs_copy_from_user_iovec_49829 ntfs_copy_from_user_iovec 3-6 49829 NULL
-+iwl_dbgfs_ucode_rx_stats_read_58023 iwl_dbgfs_ucode_rx_stats_read 3 58023 NULL
-+read_cis_cache_17069 read_cis_cache 4 17069 NULL
-+sta_tx_fragments_read_49841 sta_tx_fragments_read 3 49841 NULL
-+mempool_create_kmalloc_pool_41650 mempool_create_kmalloc_pool 1 41650 NULL
-+simple_transaction_read_17076 simple_transaction_read 3 17076 NULL
-+squashfs_cache_init_41656 squashfs_cache_init 2 41656 NULL
-+tracing_max_lat_read_8890 tracing_max_lat_read 3 8890 NULL
-+crypto_alloc_instance2_25277 crypto_alloc_instance2 3 25277 NULL
-+vfs_writev_25278 vfs_writev 3 25278 NULL
-+alloc_async_14208 alloc_async 1 14208 NULL
-+sys_dup2_25284 sys_dup2 2 25284 NULL
-+create_entry_33479 create_entry 2 33479 NULL
-+ipath_resize_cq_712 ipath_resize_cq 2 712 NULL
-+sys_preadv_17100 sys_preadv 3 17100 NULL
-+sctp_setsockopt_bindx_49870 sctp_setsockopt_bindx 3 49870 NULL
-+ip_setsockopt_33487 ip_setsockopt 5 33487 NULL
-+rds_message_copy_from_user_41682 rds_message_copy_from_user 2 41682 NULL
-+xfs_da_buf_make_25303 xfs_da_buf_make 1 25303 NULL
-+write_mem_17114 write_mem 3 17114 NULL
-+res_counter_read_33499 res_counter_read 4 33499 NULL
-+sctp_setsockopt_peer_addr_params_734 sctp_setsockopt_peer_addr_params 3 734 NULL
-+cm4040_write_58079 cm4040_write 3 58079 NULL
-+fb_read_33506 fb_read 3 33506 NULL
-+rfcomm_wmalloc_58090 rfcomm_wmalloc 2 58090 NULL
-+fast_shmem_write_8942 fast_shmem_write 5 8942 NULL
-+ahash_setkey_unaligned_33521 ahash_setkey_unaligned 3 33521 NULL
-+dvb_video_write_754 dvb_video_write 3 754 NULL
-+bdx_tx_db_init_41719 bdx_tx_db_init 2 41719 NULL
-+alloc_ldt_21972 alloc_ldt 2 21972 NULL
-+sys_pwritev_41722 sys_pwritev 3 41722 NULL
-+ib_send_cm_mra_60202 ib_send_cm_mra 4 60202 NULL
-+deliver_packet_767 deliver_packet 3 767 NULL
-+sel_write_member_28800 sel_write_member 3 28800 NULL
-+usb_allocate_stream_buffers_8964 usb_allocate_stream_buffers 3 8964 NULL
-+drm_mode_crtc_set_gamma_size_54742 drm_mode_crtc_set_gamma_size 2 54742 NULL
-+venus_mkdir_8967 venus_mkdir 4 8967 NULL
-+vol_cdev_read_8968 vol_cdev_read 3 8968 NULL nohasharray
-+seq_open_net_8968 seq_open_net 4 8968 &vol_cdev_read_8968
-+befs_nls2utf_17163 befs_nls2utf 3 17163 NULL
-+savemem_58129 savemem 3 58129 NULL
-+fillonedir_41746 fillonedir 3 41746 NULL
-+ipv6_flowlabel_opt_58135 ipv6_flowlabel_opt 3 58135 NULL nohasharray
-+slhc_init_58135 slhc_init 1-2 58135 &ipv6_flowlabel_opt_58135
-+sel_read_mls_25369 sel_read_mls 3 25369 NULL
-+if_writecmd_815 if_writecmd 2 815 NULL
-+rtl8169_alloc_rx_skb_25392 rtl8169_alloc_rx_skb 4-5 25392 NULL
-+viafb_dfph_proc_write_49288 viafb_dfph_proc_write 3 49288 NULL
-+sctp_getsockopt_associnfo_58169 sctp_getsockopt_associnfo 2 58169 NULL
-+read_fifo_826 read_fifo 3 826 NULL
-+jffs2_do_create_25404 jffs2_do_create 6 25404 NULL
-+dn_recvmsg_17213 dn_recvmsg 4 17213 NULL
-+enic_rq_alloc_skb_17220 enic_rq_alloc_skb 2 17220 NULL
-+et61x251_read_25420 et61x251_read 3 25420 NULL
-+garmin_write_bulk_58191 garmin_write_bulk 3 58191 NULL
-+asix_write_cmd_58192 asix_write_cmd 5 58192 NULL
-+um_idi_read_850 um_idi_read 3 850 NULL
-+__module_alloc_50004 __module_alloc 1 50004 NULL
-+cxio_init_resource_fifo_25429 cxio_init_resource_fifo 3 25429 NULL
-+sco_send_frame_41815 sco_send_frame 3 41815 NULL
-+isdn_read_50021 isdn_read 3 50021 NULL
-+snd_gus_dram_peek_9062 snd_gus_dram_peek 4 9062 NULL
-+o2net_send_message_vec_879 o2net_send_message_vec 4 879 NULL
-+alloc_ep_17269 alloc_ep 1 17269 NULL
-+ieee80211_if_read_aid_9705 ieee80211_if_read_aid 3 9705 NULL
-+generic_file_buffered_write_25464 generic_file_buffered_write 4 25464 NULL
-+do_ip_setsockopt_41852 do_ip_setsockopt 5 41852 NULL
-+raw_recvmsg_17277 raw_recvmsg 4 17277 NULL
-+alloc_ebda_hpc_50046 alloc_ebda_hpc 1-2 50046 NULL
-+keyctl_instantiate_key_41855 keyctl_instantiate_key 3 41855 NULL
-+create_queues_9088 create_queues 2-3 9088 NULL
-+ldm_frag_add_5611 ldm_frag_add 2 5611 NULL
-+f_audio_buffer_alloc_41110 f_audio_buffer_alloc 1 41110 NULL
-+minstrel_stats_read_17290 minstrel_stats_read 3 17290 NULL
-+fuse_conn_max_background_write_50061 fuse_conn_max_background_write 3 50061 NULL
-+read_file_debug_58256 read_file_debug 3 58256 NULL
-+sys_fcntl_19267 sys_fcntl 3 19267 NULL
-+skb_pad_17302 skb_pad 2 17302 NULL
-+tracing_trace_options_write_153 tracing_trace_options_write 3 153 NULL
-+btmrvl_hsstate_read_920 btmrvl_hsstate_read 3 920 NULL
-+ivtv_buf_copy_from_user_25502 ivtv_buf_copy_from_user 4 25502 NULL
-+acpi_ds_build_internal_package_obj_58271 acpi_ds_build_internal_package_obj 3 58271 NULL
-+snd_pcm_plugin_build_25505 snd_pcm_plugin_build 5 25505 NULL
-+dev_set_alias_50084 dev_set_alias 3 50084 NULL
-+tcp_mark_head_lost_50087 tcp_mark_head_lost 2 50087 NULL
-+iwm_umac_set_config_var_17320 iwm_umac_set_config_var 4 17320 NULL
-+sys_keyctl_33708 sys_keyctl 4 33708 NULL nohasharray
-+netlink_sendmsg_33708 netlink_sendmsg 4 33708 &sys_keyctl_33708
-+ata_host_alloc_pinfo_17325 ata_host_alloc_pinfo 3 17325 NULL
-+get_free_de_33714 get_free_de 2 33714 NULL
-+pvr2_stream_buffer_count_33719 pvr2_stream_buffer_count 2 33719 NULL
-+get_packet_41914 get_packet 3 41914 NULL
-+get_fdb_entries_41916 get_fdb_entries 3 41916 NULL
-+sctp_make_heartbeat_958 sctp_make_heartbeat 4 958 NULL
-+sys_msgrcv_959 sys_msgrcv 3 959 NULL
-+csr1212_new_leaf_50112 csr1212_new_leaf 3 50112 NULL
-+ieee80211_if_read_dot11MeshTTL_58307 ieee80211_if_read_dot11MeshTTL 3 58307 NULL
-+serverworks_create_gatt_pages_46582 serverworks_create_gatt_pages 1 46582 NULL
-+ieee80211_if_read_path_refresh_time_25545 ieee80211_if_read_path_refresh_time 3 25545 NULL
-+hpsb_iso_xmit_init_19277 hpsb_iso_xmit_init 3 19277 NULL
-+dispatch_write_17361 dispatch_write 3 17361 NULL
-+copy_items_50140 copy_items 6 50140 NULL
-+isr_irqs_read_9181 isr_irqs_read 3 9181 NULL
-+pcim_iomap_58334 pcim_iomap 3 58334 NULL
-+diva_init_dma_map_58336 diva_init_dma_map 3 58336 NULL
-+xfs_buf_associate_memory_17915 xfs_buf_associate_memory 3 17915 NULL
-+zd_rfwrite_locked_17381 zd_rfwrite_locked 3 17381 NULL
-+hashtab_create_33769 hashtab_create 3 33769 NULL
-+alloc_group_attrs_9194 alloc_group_attrs 2 9194 NULL
-+alloc_fdtable_17389 alloc_fdtable 1 17389 NULL
-+xfrm_dst_alloc_copy_3034 xfrm_dst_alloc_copy 3 3034 NULL
-+vmalloc_to_sg_58354 vmalloc_to_sg 2 58354 NULL
-+aac_nark_ioremap_50163 aac_nark_ioremap 2 50163 NULL nohasharray
-+kmalloc_node_50163 kmalloc_node 1 50163 &aac_nark_ioremap_50163
-+cx24116_writeregN_41975 cx24116_writeregN 4 41975 NULL
-+usbtmc_write_64340 usbtmc_write 3 64340 NULL
-+ubi_resize_volume_50172 ubi_resize_volume 2 50172 NULL
-+__devres_alloc_25598 __devres_alloc 2 25598 NULL
-+l2cap_create_connless_pdu_9222 l2cap_create_connless_pdu 3 9222 NULL
-+ib_send_cm_drep_50186 ib_send_cm_drep 3 50186 NULL
-+sctp_getsockopt_delayed_ack_9232 sctp_getsockopt_delayed_ack 2 9232 NULL
-+mwl8k_prepare_multicast_42499 mwl8k_prepare_multicast 2 42499 NULL
-+proc_coredump_filter_write_25625 proc_coredump_filter_write 3 25625 NULL
-+pool_allocate_42012 pool_allocate 3 42012 NULL
-+l2cap_sock_setsockopt_50207 l2cap_sock_setsockopt 5 50207 NULL
-+sctp_make_init_58401 sctp_make_init 4 58401 NULL
-+ieee80211_skb_resize_50211 ieee80211_skb_resize 3 50211 NULL
-+gigaset_initdriver_1060 gigaset_initdriver 2 1060 NULL
-+islpci_mgt_transmit_34133 islpci_mgt_transmit 5 34133 NULL
-+ieee80211_if_read_peer_45233 ieee80211_if_read_peer 3 45233 NULL
-+acpi_ut_create_buffer_object_42030 acpi_ut_create_buffer_object 1 42030 NULL
-+agp_create_memory_1075 agp_create_memory 1 1075 NULL
-+__hwahc_op_set_gtk_42038 __hwahc_op_set_gtk 4 42038 NULL
-+iscsi_offload_mesg_58425 iscsi_offload_mesg 5 58425 NULL
-+mon_bin_compat_ioctl_50234 mon_bin_compat_ioctl 3 50234 NULL
-+probe_bios_17467 probe_bios 1 17467 NULL
-+irda_sendmsg_ultra_42047 irda_sendmsg_ultra 4 42047 NULL
-+jffs2_do_link_42048 jffs2_do_link 6 42048 NULL
-+stats_transmitted_frame_count_read_33861 stats_transmitted_frame_count_read 3 33861 NULL
-+afs_extract_data_50261 afs_extract_data 5 50261 NULL
-+compat_sys_select_16131 compat_sys_select 1 16131 NULL
-+sta_inactive_ms_read_25690 sta_inactive_ms_read 3 25690 NULL
-+iwl_dbgfs_stations_read_9309 iwl_dbgfs_stations_read 3 9309 NULL
-+compat_do_ipt_set_ctl_58466 compat_do_ipt_set_ctl 4 58466 NULL
-+scsi_execute_req_42088 scsi_execute_req 5 42088 NULL
-+dm_table_create_35687 dm_table_create 3 35687 NULL
-+rxrpc_setsockopt_50286 rxrpc_setsockopt 5 50286 NULL
-+vmalloc_32_1135 vmalloc_32 1 1135 NULL
-+ibmasm_new_command_25714 ibmasm_new_command 2 25714 NULL
-+snd_rme96_capture_copy_58484 snd_rme96_capture_copy 5 58484 NULL
-+restore_i387_fxsave_17528 restore_i387_fxsave 2 17528 NULL
-+submit_inquiry_42108 submit_inquiry 3 42108 NULL
-+sel_write_context_25726 sel_write_context 3 25726 NULL nohasharray
-+__alloc_bootmem_low_node_25726 __alloc_bootmem_low_node 2 25726 &sel_write_context_25726
-+sysfs_read_file_42113 sysfs_read_file 3 42113 NULL
-+mcs_unwrap_fir_25733 mcs_unwrap_fir 3 25733 NULL
-+nfs_pagein_one_58502 nfs_pagein_one 3 58502 NULL
-+xlog_do_log_recovery_17550 xlog_do_log_recovery 3 17550 NULL
-+__copy_to_user_17551 __copy_to_user 3 17551 NULL
-+ipv6_renew_options_28867 ipv6_renew_options 5 28867 NULL
-+vc_resize_3585 vc_resize 2-3 3585 NULL
-+sel_read_avc_cache_threshold_33942 sel_read_avc_cache_threshold 3 33942 NULL
-+copy_from_user_17559 copy_from_user 3 17559 NULL
-+ipc_alloc_1192 ipc_alloc 1 1192 NULL
-+ib_create_send_mad_1196 ib_create_send_mad 5 1196 NULL
-+rndis_add_response_58544 rndis_add_response 2 58544 NULL
-+efx_tsoh_heap_alloc_58545 efx_tsoh_heap_alloc 2 58545 NULL
-+isdn_ppp_read_50356 isdn_ppp_read 4 50356 NULL
-+read_9397 read 3 9397 NULL
-+i2cdev_read_1206 i2cdev_read 3 1206 NULL
-+tracing_buffers_read_11124 tracing_buffers_read 3 11124 NULL
-+acpi_ut_create_package_object_17594 acpi_ut_create_package_object 1 17594 NULL
-+pmcraid_copy_sglist_38431 pmcraid_copy_sglist 3 38431 NULL
-+event_rx_pool_read_25792 event_rx_pool_read 3 25792 NULL
-+get_skb_63008 get_skb 2 63008 NULL
-+blk_init_tags_30592 blk_init_tags 1 30592 NULL
-+oprofilefs_str_to_user_42182 oprofilefs_str_to_user 3 42182 NULL
-+sg_read_25799 sg_read 3 25799 NULL
-+sl_alloc_bufs_50380 sl_alloc_bufs 2 50380 NULL
-+ipw_packet_received_skb_1230 ipw_packet_received_skb 2 1230 NULL
-+sys32_rt_sigpending_25814 sys32_rt_sigpending 2 25814 NULL
-+xlog_recover_add_to_cont_trans_58583 xlog_recover_add_to_cont_trans 3 58583 NULL
-+realloc_buffer_25816 realloc_buffer 2 25816 NULL
-+skb_make_writable_24783 skb_make_writable 2 24783 NULL
-+pwr_missing_bcns_read_25824 pwr_missing_bcns_read 3 25824 NULL
-+gdth_search_isa_58595 gdth_search_isa 1 58595 NULL
-+__ntfs_malloc_34022 __ntfs_malloc 1 34022 NULL
-+iwl3945_sta_dbgfs_stats_table_read_28882 iwl3945_sta_dbgfs_stats_table_read 3 28882 NULL
-+mcs_unwrap_mir_9455 mcs_unwrap_mir 3 9455 NULL
-+ppp_write_34034 ppp_write 3 34034 NULL
-+ioctl_private_iw_point_1273 ioctl_private_iw_point 7 1273 NULL
-+packet_setsockopt_17662 packet_setsockopt 5 17662 NULL
-+module_alloc_update_bounds_rx_58634 module_alloc_update_bounds_rx 1 58634 NULL
-+btmrvl_hsmode_write_42252 btmrvl_hsmode_write 3 42252 NULL
-+dsp_tone_hw_message_17678 dsp_tone_hw_message 3 17678 NULL
-+ulog_alloc_skb_23427 ulog_alloc_skb 1 23427 NULL
-+pgctrl_write_50453 pgctrl_write 3 50453 NULL
-+pwr_enable_ps_read_17686 pwr_enable_ps_read 3 17686 NULL
-+lp_write_9511 lp_write 3 9511 NULL
-+venus_rename_17707 venus_rename 4-5 17707 NULL
-+neigh_hash_grow_1324 neigh_hash_grow 2 1324 NULL
-+cdrom_read_cdda_50478 cdrom_read_cdda 4 50478 NULL
-+scsi_tgt_kspace_exec_9522 scsi_tgt_kspace_exec 8 9522 NULL
-+zd_usb_ioread16v_17715 zd_usb_ioread16v 4 17715 NULL
-+do_jffs2_setxattr_25910 do_jffs2_setxattr 5 25910 NULL
-+read_file_dma_9530 read_file_dma 3 9530 NULL
-+zd_usb_rfwrite_42300 zd_usb_rfwrite 3 42300 NULL
-+sel_read_perm_42302 sel_read_perm 3 42302 NULL
-+write_int_38453 write_int 3 38453 NULL
-+sctp_setsockopt_del_key_42304 sctp_setsockopt_del_key 3 42304 NULL nohasharray
-+ulong_read_file_42304 ulong_read_file 3 42304 &sctp_setsockopt_del_key_42304
-+pwr_rcvd_awake_beacons_read_50505 pwr_rcvd_awake_beacons_read 3 50505 NULL
-+snd_es1938_capture_copy_25930 snd_es1938_capture_copy 5 25930 NULL
-+key_flags_read_25931 key_flags_read 3 25931 NULL
-+audit_log_n_untrustedstring_9548 audit_log_n_untrustedstring 3 9548 NULL
-+ipx_sendmsg_1362 ipx_sendmsg 4 1362 NULL
-+init_exception_table_34132 init_exception_table 2 34132 NULL
-+sctp_make_op_error_25941 sctp_make_op_error 5 25941 NULL
-+fw_node_create_9559 fw_node_create 2 9559 NULL
-+sctp_getsockopt_nodelay_9560 sctp_getsockopt_nodelay 2 9560 NULL
-+kobj_map_9566 kobj_map 2-3 9566 NULL
-+btrfs_copy_from_user_9568 btrfs_copy_from_user 3-1 9568 NULL
-+ip_nat_sdp_port_17763 ip_nat_sdp_port 5 17763 NULL
-+cxgb3i_ddp_make_gl_34150 cxgb3i_ddp_make_gl 1 34150 NULL
-+sctp_setsockopt_initmsg_1383 sctp_setsockopt_initmsg 3 1383 NULL
-+do_msgsnd_1387 do_msgsnd 4 1387 NULL
-+cosa_read_25966 cosa_read 3 25966 NULL
-+ide_raw_taskfile_42355 ide_raw_taskfile 4 42355 NULL
-+rngapi_reset_34366 rngapi_reset 3 34366 NULL nohasharray
-+p54_alloc_skb_34366 p54_alloc_skb 3 34366 &rngapi_reset_34366
-+file_read_actor_1401 file_read_actor 4 1401 NULL
-+av7110_ipack_init_46655 av7110_ipack_init 2 46655 NULL
-+hci_si_event_1404 hci_si_event 3 1404 NULL
-+udp_setsockopt_25985 udp_setsockopt 5 25985 NULL
-+do_sync_9604 do_sync 1 9604 NULL
-+snd_emu10k1_fx8010_read_9605 snd_emu10k1_fx8010_read 5-6 9605 NULL nohasharray
-+sysprof_sample_read_9605 sysprof_sample_read 3 9605 &snd_emu10k1_fx8010_read_9605
-+compat_readv_30273 compat_readv 3 30273 NULL
-+agp_allocate_memory_58761 agp_allocate_memory 2 58761 NULL
-+fz_hash_alloc_50580 fz_hash_alloc 1 50580 NULL
-+pep_reply_50582 pep_reply 5 50582 NULL
-+mtd_write_34207 mtd_write 3 34207 NULL
-+sge_rx_50594 sge_rx 3 50594 NULL
-+stack_max_size_read_1445 stack_max_size_read 3 1445 NULL
-+xlog_find_verify_log_record_18870 xlog_find_verify_log_record 2 18870 NULL
-+__videobuf_copy_to_user_1454 __videobuf_copy_to_user 3 1454 NULL
-+selinux_inode_post_setxattr_26037 selinux_inode_post_setxattr 4 26037 NULL
-+tx_queue_len_read_1463 tx_queue_len_read 3 1463 NULL
-+uvc_alloc_buffers_9656 uvc_alloc_buffers 2-3 9656 NULL
-+queue_received_packet_9657 queue_received_packet 5 9657 NULL
-+sctp_getsockopt_initmsg_26042 sctp_getsockopt_initmsg 2 26042 NULL
-+ep_read_58813 ep_read 3 58813 NULL
-+netpoll_send_udp_58955 netpoll_send_udp 3 58955 NULL
-+snd_opl4_mem_proc_write_9670 snd_opl4_mem_proc_write 5-6 9670 NULL
-+pci_enable_sriov_35745 pci_enable_sriov 2 35745 NULL
-+sisusb_send_bulk_msg_17864 sisusb_send_bulk_msg 3 17864 NULL
-+simple_transaction_get_50633 simple_transaction_get 3 50633 NULL
-+key_conf_keyidx_read_42443 key_conf_keyidx_read 3 42443 NULL
-+alloc_sja1000dev_17868 alloc_sja1000dev 1 17868 NULL
-+keyctl_update_key_26061 keyctl_update_key 3 26061 NULL
-+sta_num_ps_buf_frames_read_1488 sta_num_ps_buf_frames_read 3 1488 NULL
-+orinoco_set_key_17878 orinoco_set_key 5-7 17878 NULL
-+cifs_write_9687 cifs_write 3 9687 NULL
-+command_write_58841 command_write 3 58841 NULL
-+compat_sys_pwritev_17886 compat_sys_pwritev 3 17886 NULL
-+ocfs2_readlink_50656 ocfs2_readlink 3 50656 NULL
-+sys_readv_50664 sys_readv 3 50664 NULL
-+ps_upsd_timeouts_read_28924 ps_upsd_timeouts_read 3 28924 NULL
-+recover_peb_29238 recover_peb 6-7 29238 NULL
-+snd_usb_ctl_msg_26092 snd_usb_ctl_msg 8 26092 NULL
-+udp_manip_pkt_50770 udp_manip_pkt 2 50770 NULL
-+recover_head_17904 recover_head 3 17904 NULL
-+iwl_dbgfs_traffic_log_read_58870 iwl_dbgfs_traffic_log_read 3 58870 NULL
-+dabusb_read_58873 dabusb_read 3 58873 NULL
-+dccp_feat_register_sp_17914 dccp_feat_register_sp 5 17914 NULL
-+btmrvl_psstate_read_50683 btmrvl_psstate_read 3 50683 NULL
-+srp_iu_pool_alloc_17920 srp_iu_pool_alloc 2 17920 NULL
-+tun_alloc_skb_41216 tun_alloc_skb 2-4-3 41216 NULL
-+gs_alloc_req_58883 gs_alloc_req 2 58883 NULL
-+cs553x_init_one_58886 cs553x_init_one 3 58886 NULL
-+sysctl_tcp_congestion_control_27564 sysctl_tcp_congestion_control 5 27564 NULL
-+tsf_read_58892 tsf_read 3 58892 NULL
-+user_instantiate_26131 user_instantiate 3 26131 NULL
-+vmalloc_node_58700 vmalloc_node 1 58700 NULL
-+skb_cow_26138 skb_cow 2 26138 NULL
-+smk_write_netlbladdr_42525 smk_write_netlbladdr 3 42525 NULL
-+__alloc_percpu_9764 __alloc_percpu 1 9764 NULL
-+snd_emux_create_port_42533 snd_emux_create_port 3 42533 NULL
-+do_sigpending_9766 do_sigpending 2 9766 NULL
-+iwl_dbgfs_disable_ht40_read_35761 iwl_dbgfs_disable_ht40_read 3 35761 NULL
-+kgdb_mem2hex_1578 kgdb_mem2hex 3 1578 NULL
-+__blk_queue_init_tags_9778 __blk_queue_init_tags 2 9778 NULL
-+copy_oldmem_page_26164 copy_oldmem_page 3-1 26164 NULL
-+ieee80211_if_read_dot11MeshHWMPnetDiameterTraversalTime_1589 ieee80211_if_read_dot11MeshHWMPnetDiameterTraversalTime 3 1589 NULL
-+snd_mem_proc_write_9786 snd_mem_proc_write 3 9786 NULL
-+fc_frame_alloc_1596 fc_frame_alloc 2 1596 NULL
-+udp_recvmsg_42558 udp_recvmsg 4 42558 NULL
-+smk_write_cipso_17989 smk_write_cipso 3 17989 NULL
-+skb_padto_50759 skb_padto 2 50759 NULL
-+reiserfs_resize_34377 reiserfs_resize 2 34377 NULL
-+get_registers_26187 get_registers 3 26187 NULL
-+ttm_bo_fbdev_io_9805 ttm_bo_fbdev_io 4 9805 NULL
-+btmrvl_hscmd_read_1614 btmrvl_hscmd_read 3 1614 NULL
-+av7110_vbi_write_34384 av7110_vbi_write 3 34384 NULL
-+usbvision_v4l2_read_34386 usbvision_v4l2_read 3 34386 NULL
-+snd_pcm_oss_write2_27332 snd_pcm_oss_write2 3 27332 NULL
-+udpv6_recvmsg_9813 udpv6_recvmsg 4 9813 NULL
-+pvr2_v4l2_read_18006 pvr2_v4l2_read 3 18006 NULL
-+xfs_idata_realloc_26199 xfs_idata_realloc 2 26199 NULL
-+mce_write_26201 mce_write 3 26201 NULL
-+bio_alloc_map_data_50782 bio_alloc_map_data 1-2 50782 NULL
-+ivtv_read_pos_34400 ivtv_read_pos 3 34400 NULL
-+__pskb_pull_42602 __pskb_pull 2 42602 NULL
-+cifs_write_end_1643 cifs_write_end 5 1643 NULL
-+tpm_write_50798 tpm_write 3 50798 NULL
-+btmrvl_hsmode_read_1647 btmrvl_hsmode_read 3 1647 NULL
-+dvb_dvr_set_buffer_size_9840 dvb_dvr_set_buffer_size 2 9840 NULL
-+store_sys_hwmon_26225 store_sys_hwmon 3 26225 NULL
-+write_flush_50803 write_flush 3 50803 NULL
-+rxrpc_recvmsg_26233 rxrpc_recvmsg 4 26233 NULL
-+ikconfig_read_current_1658 ikconfig_read_current 3 1658 NULL
-+ip_vs_icmp_xmit_v6_18045 ip_vs_icmp_xmit_v6 4 18045 NULL
-+dvb_play_50814 dvb_play 3 50814 NULL
-+ep_write_59008 ep_write 3 59008 NULL
-+sys_move_pages_42626 sys_move_pages 2 42626 NULL
-+sctp_make_heartbeat_ack_34411 sctp_make_heartbeat_ack 4 34411 NULL
-+ddebug_proc_write_18055 ddebug_proc_write 3 18055 NULL
-+pmcraid_alloc_sglist_9864 pmcraid_alloc_sglist 1 9864 NULL
-+sta_tx_retry_count_read_59021 sta_tx_retry_count_read 3 59021 NULL
-+scsi_activate_tcq_42640 scsi_activate_tcq 2 42640 NULL
-+configfs_read_file_1683 configfs_read_file 3 1683 NULL
-+kvm_read_guest_page_18074 kvm_read_guest_page 5 18074 NULL
-+sctp_make_abort_34459 sctp_make_abort 3 34459 NULL
-+selinux_transaction_write_59038 selinux_transaction_write 3 59038 NULL
-+get_vm_area_18080 get_vm_area 1 18080 NULL
-+bm_register_write_9893 bm_register_write 3 9893 NULL nohasharray
-+snd_midi_event_new_9893 snd_midi_event_new 1 9893 &bm_register_write_9893
-+handle_rx_packet_58993 handle_rx_packet 3 58993 NULL
-+iwm_rx_packet_alloc_9898 iwm_rx_packet_alloc 3 9898 NULL
-+i2o_parm_field_get_34477 i2o_parm_field_get 5 34477 NULL
-+pdu_write_u_1710 pdu_write_u 3 1710 NULL
-+coda_psdev_write_1711 coda_psdev_write 3 1711 NULL
-+iraw_encode_18099 iraw_encode 2-3 18099 NULL
-+udf_alloc_i_data_35786 udf_alloc_i_data 2 35786 NULL
-+netlink_kernel_create_18110 netlink_kernel_create 3 18110 NULL
-+sis190_try_rx_copy_57069 sis190_try_rx_copy 3 57069 NULL
-+request_key_and_link_42693 request_key_and_link 4 42693 NULL
-+snd_pcm_plug_alloc_42339 snd_pcm_plug_alloc 2 42339 NULL
-+pwr_wake_on_host_read_26321 pwr_wake_on_host_read 3 26321 NULL
-+snd_pcm_plugin_alloc_12580 snd_pcm_plugin_alloc 2 12580 NULL
-+cafe_deliver_buffer_1755 cafe_deliver_buffer 3 1755 NULL
-+set_rxd_buffer_pointer_9950 set_rxd_buffer_pointer 8 9950 NULL
-+tcp_sacktag_walk_26339 tcp_sacktag_walk 5-6 26339 NULL
-+selinux_inode_setsecurity_18148 selinux_inode_setsecurity 4 18148 NULL
-+csum_partial_copy_fromiovecend_9957 csum_partial_copy_fromiovecend 3-4 9957 NULL
-+tracing_stats_read_34537 tracing_stats_read 3 34537 NULL
-+hdpvr_i2c_read_26347 hdpvr_i2c_read 4 26347 NULL
-+cosa_write_1774 cosa_write 3 1774 NULL
-+set_aoe_iflist_42737 set_aoe_iflist 2 42737 NULL
-+hugetlbfs_read_actor_34547 hugetlbfs_read_actor 2-5-4 34547 NULL
-+ax25_setsockopt_42740 ax25_setsockopt 5 42740 NULL
-+create_rsb_42744 create_rsb 3 42744 NULL
-+fc_change_queue_depth_18169 fc_change_queue_depth 2 18169 NULL
-+sysctl_uts_string_17797 sysctl_uts_string 5 17797 NULL
-+dup_to_netobj_26363 dup_to_netobj 3 26363 NULL
-+sock_bindtodevice_50942 sock_bindtodevice 3 50942 NULL
-+cryptd_alloc_instance_18048 cryptd_alloc_instance 2-3 18048 NULL
-+nfs_readdata_alloc_9990 nfs_readdata_alloc 1 9990 NULL
-+asn1_octets_decode_9991 asn1_octets_decode 2 9991 NULL
-+framebuffer_alloc_59145 framebuffer_alloc 1 59145 NULL
-+sta_tx_packets_read_50955 sta_tx_packets_read 3 50955 NULL
-+radeon_compat_ioctl_59150 radeon_compat_ioctl 2 59150 NULL
-+velocity_rx_copy_34583 velocity_rx_copy 2 34583 NULL
-+x25_recvmsg_42777 x25_recvmsg 4 42777 NULL
-+init_send_hfcd_34586 init_send_hfcd 1 34586 NULL
-+cryptd_hash_setkey_42781 cryptd_hash_setkey 3 42781 NULL
-+kmsg_write_26398 kmsg_write 3 26398 NULL
-+orinoco_add_extscan_result_18207 orinoco_add_extscan_result 3 18207 NULL
-+do_ipv6_setsockopt_18215 do_ipv6_setsockopt 5 18215 NULL
-+setup_window_59178 setup_window 7-5-4-2 59178 NULL
-+cx18_copy_buf_to_user_50990 cx18_copy_buf_to_user 4 50990 NULL
-+timeout_write_50991 timeout_write 3 50991 NULL
-+fw_device_op_compat_ioctl_42804 fw_device_op_compat_ioctl 2 42804 NULL
-+sctp_getsockopt_peeloff_59190 sctp_getsockopt_peeloff 2 59190 NULL
-+proc_write_51003 proc_write 3 51003 NULL
-+set_arg_42824 set_arg 3 42824 NULL
-+pagemap_read_26441 pagemap_read 3 26441 NULL
-+xfs_iext_realloc_indirect_59211 xfs_iext_realloc_indirect 2 59211 NULL
-+rfcomm_sock_setsockopt_18254 rfcomm_sock_setsockopt 5 18254 NULL
-+lbs_dev_info_51023 lbs_dev_info 3 51023 NULL
-+net_assign_generic_59217 net_assign_generic 2 59217 NULL
-+audit_log_n_string_31705 audit_log_n_string 3 31705 NULL
-+fuse_conn_congestion_threshold_read_51028 fuse_conn_congestion_threshold_read 3 51028 NULL
-+qdisc_class_hash_alloc_18262 qdisc_class_hash_alloc 1 18262 NULL
-+write_essid_42840 write_essid 3 42840 NULL
-+hidp_queue_report_1881 hidp_queue_report 3 1881 NULL
-+dev_config_8506 dev_config 3 8506 NULL
-+dump_midi_51040 dump_midi 3 51040 NULL
-+tty_prepare_flip_string_flags_59240 tty_prepare_flip_string_flags 4 59240 NULL
-+cxacru_cm_get_array_4412 cxacru_cm_get_array 4 4412 NULL
-+cxgb3i_alloc_big_mem_18283 cxgb3i_alloc_big_mem 1 18283 NULL
-+do_arpt_set_ctl_51053 do_arpt_set_ctl 4 51053 NULL
-+pccard_store_cis_10094 pccard_store_cis 5 10094 NULL
-+ib_alloc_device_26483 ib_alloc_device 1 26483 NULL
-+ulong_write_file_26485 ulong_write_file 3 26485 NULL
-+wusb_prf_64_51065 wusb_prf_64 7 51065 NULL
-+isr_fiqs_read_34687 isr_fiqs_read 3 34687 NULL
-+pskb_expand_head_42881 pskb_expand_head 2-3 42881 NULL
-+ip6ip6_err_18308 ip6ip6_err 5 18308 NULL
-+read_vmcore_26501 read_vmcore 3 26501 NULL
-+hptiop_adjust_disk_queue_depth_34698 hptiop_adjust_disk_queue_depth 2 34698 NULL
-+alloc_skb_55439 alloc_skb 1 55439 NULL
-+xpc_kmalloc_cacheline_aligned_42895 xpc_kmalloc_cacheline_aligned 1 42895 NULL
-+jbd2_journal_init_revoke_51088 jbd2_journal_init_revoke 2 51088 NULL
-+ecryptfs_send_message_18322 ecryptfs_send_message 2 18322 NULL
-+iwm_rx_handle_24899 iwm_rx_handle 3 24899 NULL
-+pcpu_get_vm_areas_26522 pcpu_get_vm_areas 3 26522 NULL
-+btmrvl_hscfgcmd_read_56303 btmrvl_hscfgcmd_read 3 56303 NULL
-+read_file_wiphy_51103 read_file_wiphy 3 51103 NULL
-+ieee80211_if_read_num_sta_ps_34722 ieee80211_if_read_num_sta_ps 3 34722 NULL
-+aes_decrypt_packets_read_10155 aes_decrypt_packets_read 3 10155 NULL
-+rds_message_inc_copy_to_user_26540 rds_message_inc_copy_to_user 3 26540 NULL
-+rx_out_of_mem_read_10157 rx_out_of_mem_read 3 10157 NULL
-+reg_w_ixbuf_34736 reg_w_ixbuf 4 34736 NULL
-+zd_ioread32v_26545 zd_ioread32v 4 26545 NULL
-+pwr_power_save_off_read_18355 pwr_power_save_off_read 3 18355 NULL
-+asd_store_update_bios_10165 asd_store_update_bios 4 10165 NULL
-+fd_copyout_59323 fd_copyout 3 59323 NULL
-+sctp_getsockopt_maxburst_42941 sctp_getsockopt_maxburst 2 42941 NULL
-+sel_read_avc_hash_stats_1984 sel_read_avc_hash_stats 3 1984 NULL
-+solos_param_store_34755 solos_param_store 4 34755 NULL
-+arlan_rx_interrupt_10184 arlan_rx_interrupt 4 10184 NULL
-+xfs_trans_get_efd_51148 xfs_trans_get_efd 3 51148 NULL
-+xfs_attrmulti_attr_set_59346 xfs_attrmulti_attr_set 4 59346 NULL
-+vcc_recvmsg_37198 vcc_recvmsg 4 37198 NULL
-+hpsb_make_streampacket_21071 hpsb_make_streampacket 3 21071 NULL
-+proc_write_mled_51169 proc_write_mled 3 51169 NULL
-+write_flush_pipefs_2021 write_flush_pipefs 3 2021 NULL
-+__copy_in_user_34790 __copy_in_user 3 34790 NULL
-+snd_nm256_playback_copy_38567 snd_nm256_playback_copy 5 38567 NULL
-+tipc_log_resize_34803 tipc_log_resize 1 34803 NULL
-+devm_ioremap_nocache_2036 devm_ioremap_nocache 3-2 2036 NULL
-+create_snapshot_51195 create_snapshot 4 51195 NULL
-+fc_frame_alloc_fill_59394 fc_frame_alloc_fill 2 59394 NULL
-+pwr_fix_tsf_ps_read_26627 pwr_fix_tsf_ps_read 3 26627 NULL
-+sctp_getsockopt_fragment_interleave_51215 sctp_getsockopt_fragment_interleave 2 51215 NULL
-+acpi_video_bus_write_DOS_2064 acpi_video_bus_write_DOS 3 2064 NULL
-+isr_rx_mem_overflow_read_43025 isr_rx_mem_overflow_read 3 43025 NULL
-+cciss_proc_write_10259 cciss_proc_write 3 10259 NULL
-+b43_debugfs_write_34838 b43_debugfs_write 3 34838 NULL
-+subbuf_read_actor_2071 subbuf_read_actor 3 2071 NULL
-+fuse_perform_write_18457 fuse_perform_write 4 18457 NULL
-+regset_tls_set_18459 regset_tls_set 4 18459 NULL
-+iwl_dbgfs_current_sleep_command_read_2081 iwl_dbgfs_current_sleep_command_read 3 2081 NULL
-+acpi_system_write_wakeup_device_34853 acpi_system_write_wakeup_device 3 34853 NULL
-+parse_table_59430 parse_table 6 59430 NULL
-+drm_property_create_51239 drm_property_create 4 51239 NULL
-+stats_rx_expand_skb_head2_read_59439 stats_rx_expand_skb_head2_read 3 59439 NULL
-+idetape_chrdev_read_2097 idetape_chrdev_read 3 2097 NULL
-+audit_expand_2098 audit_expand 2 2098 NULL
-+st_read_51251 st_read 3 51251 NULL
-+udpv6_setsockopt_18487 udpv6_setsockopt 5 18487 NULL
-+ecryptfs_encrypt_and_encode_filename_2109 ecryptfs_encrypt_and_encode_filename 6 2109 NULL
-+compat_dccp_setsockopt_51263 compat_dccp_setsockopt 5 51263 NULL
-+fwnet_pd_new_39947 fwnet_pd_new 4 39947 NULL
-+enable_read_2117 enable_read 3 2117 NULL
-+dvb_audio_write_51275 dvb_audio_write 3 51275 NULL
-+ipwireless_network_packet_received_51277 ipwireless_network_packet_received 4 51277 NULL
-+wl1251_build_probe_req_10318 wl1251_build_probe_req 3 10318 NULL
-+_xfs_buf_get_pages_59472 _xfs_buf_get_pages 2 59472 NULL
-+tomoyo_read_43089 tomoyo_read 3 43089 NULL
-+snd_gus_dram_poke_18525 snd_gus_dram_poke 4 18525 NULL
-+cdrom_read_cdda_old_27664 cdrom_read_cdda_old 4 27664 NULL
-+arcmsr_adjust_disk_queue_depth_34916 arcmsr_adjust_disk_queue_depth 2 34916 NULL
-+mlx4_init_icm_table_2151 mlx4_init_icm_table 4-5 2151 NULL
-+HDLC_Encode_7186 HDLC_Encode 2-3 7186 NULL
-+ib_copy_from_udata_59502 ib_copy_from_udata 3 59502 NULL
-+seq_copy_in_user_18543 seq_copy_in_user 3 18543 NULL
-+dv1394_write_18547 dv1394_write 3 18547 NULL
-+stats_rx_handlers_fragments_read_10356 stats_rx_handlers_fragments_read 3 10356 NULL
-+alloc_hippi_dev_51320 alloc_hippi_dev 1 51320 NULL
-+fb_sys_write_33130 fb_sys_write 3 33130 NULL
-+mthca_buf_alloc_35861 mthca_buf_alloc 2 35861 NULL
-+get_scq_2177 get_scq 1 2177 NULL
-+alloc_fddidev_15382 alloc_fddidev 1 15382 NULL
-+srp_ring_alloc_26760 srp_ring_alloc 2 26760 NULL
-+alloc_smp_req_51337 alloc_smp_req 1 51337 NULL
-+ecryptfs_decode_and_decrypt_filename_10379 ecryptfs_decode_and_decrypt_filename 5 10379 NULL
-+sta_tx_retry_failed_read_10381 sta_tx_retry_failed_read 3 10381 NULL
-+skb_gro_header_slow_34958 skb_gro_header_slow 2 34958 NULL
-+debug_output_18575 debug_output 3 18575 NULL
-+do_compat_pselect_10398 do_compat_pselect 1 10398 NULL
-+__netdev_alloc_skb_18595 __netdev_alloc_skb 2 18595 NULL
-+slabinfo_write_18600 slabinfo_write 3 18600 NULL
-+init_copy_kstat_irqs_34985 init_copy_kstat_irqs 4 34985 NULL
-+radeon_kms_compat_ioctl_51371 radeon_kms_compat_ioctl 2 51371 NULL
-+iowarrior_write_18604 iowarrior_write 3 18604 NULL
-+vhci_write_2224 vhci_write 3 2224 NULL
-+nfsd_cache_update_59574 nfsd_cache_update 3 59574 NULL
-+l2cap_skbuff_fromiovec_35003 l2cap_skbuff_fromiovec 3-4 35003 NULL
-+from_buffer_18625 from_buffer 3 18625 NULL
-+uio_write_43202 uio_write 3 43202 NULL
-+memdup_user_59590 memdup_user 2 59590 NULL
-+alloc_etherdev_mq_compat_2247 alloc_etherdev_mq_compat 1 2247 NULL
-+iso_callback_43208 iso_callback 3 43208 NULL
-+smk_write_load_26829 smk_write_load 3 26829 NULL
-+sel_write_avc_cache_threshold_2256 sel_write_avc_cache_threshold 3 2256 NULL
-+coda_psdev_read_35029 coda_psdev_read 3 35029 NULL
-+packet_sendmsg_24954 packet_sendmsg 4 24954 NULL
-+ecryptfs_miscdev_write_26847 ecryptfs_miscdev_write 3 26847 NULL
-+blk_register_region_51424 blk_register_region 1-2 51424 NULL
-+mga_ioremap_8571 mga_ioremap 2-1 8571 NULL
-+econet_sendmsg_51430 econet_sendmsg 4 51430 NULL
-+event_phy_transmit_error_read_10471 event_phy_transmit_error_read 3 10471 NULL
-+edge_tty_recv_18667 edge_tty_recv 4 18667 NULL
-+btmrvl_gpiogap_write_35053 btmrvl_gpiogap_write 3 35053 NULL
-+sel_read_class_12669 sel_read_class 3 12669 NULL
-+stats_received_fragment_count_read_59643 stats_received_fragment_count_read 3 59643 NULL
-+ubifs_setxattr_59650 ubifs_setxattr 4 59650 NULL nohasharray
-+hidraw_read_59650 hidraw_read 3 59650 &ubifs_setxattr_59650
-+kvm_clear_guest_page_2308 kvm_clear_guest_page 4 2308 NULL
-+sel_write_disable_10511 sel_write_disable 3 10511 NULL
-+store_ifalias_35088 store_ifalias 4 35088 NULL
-+____alloc_ei_netdev_51475 ____alloc_ei_netdev 1 51475 NULL
-+rds_message_alloc_10517 rds_message_alloc 1 10517 NULL
-+alloc_dca_provider_59670 alloc_dca_provider 2 59670 NULL
-+blk_rq_map_user_iov_16772 blk_rq_map_user_iov 5 16772 NULL
-+snmp_mib_init_10526 snmp_mib_init 2 10526 NULL
-+get_vm_area_caller_10527 get_vm_area_caller 1 10527 NULL
-+capi_write_35104 capi_write 3 35104 NULL
-+ide_settings_proc_write_35110 ide_settings_proc_write 3 35110 NULL
-+sriov_enable_59689 sriov_enable 2 59689 NULL
-+x25_asy_change_mtu_26928 x25_asy_change_mtu 2 26928 NULL
-+mic_calc_failure_read_59700 mic_calc_failure_read 3 59700 NULL
-+scsi_tgt_copy_sense_26933 scsi_tgt_copy_sense 3 26933 NULL
-+pwr_ps_enter_read_26935 pwr_ps_enter_read 3 26935 NULL nohasharray
-+sctp_setsockopt_adaptation_layer_26935 sctp_setsockopt_adaptation_layer 3 26935 &pwr_ps_enter_read_26935
-+hecubafb_write_26942 hecubafb_write 3 26942 NULL
-+wep_packets_read_18751 wep_packets_read 3 18751 NULL
-+rose_recvmsg_2368 rose_recvmsg 4 2368 NULL
-+perf_mmap_data_alloc_43335 perf_mmap_data_alloc 2 43335 NULL
-+unix_stream_sendmsg_61455 unix_stream_sendmsg 4 61455 NULL
-+prism2_info_scanresults_59729 prism2_info_scanresults 3 59729 NULL
-+iscsi_conn_setup_35159 iscsi_conn_setup 2 35159 NULL
-+ieee80211_if_read_bssid_35161 ieee80211_if_read_bssid 3 35161 NULL
-+alloc_fcdev_18780 alloc_fcdev 1 18780 NULL
-+__alloc_eip_netdev_51549 __alloc_eip_netdev 1 51549 NULL
-+compat_sys_move_pages_5861 compat_sys_move_pages 2 5861 NULL
-+otp_read_10594 otp_read 2-5-4 10594 NULL
-+rxpipe_rx_prep_beacon_drop_read_2403 rxpipe_rx_prep_beacon_drop_read 3 2403 NULL
-+isdn_v110_open_2418 isdn_v110_open 3 2418 NULL
-+long_retry_limit_read_59766 long_retry_limit_read 3 59766 NULL
-+blk_msg_write_13655 blk_msg_write 3 13655 NULL
-+ima_show_htable_violations_10619 ima_show_htable_violations 3 10619 NULL
-+cxgb3_get_cpl_reply_skb_10620 cxgb3_get_cpl_reply_skb 2 10620 NULL
-+sta_agg_status_read_14058 sta_agg_status_read 3 14058 NULL
-+venus_remove_59781 venus_remove 4 59781 NULL
-+ioremap_nocache_2439 ioremap_nocache 2-1 2439 NULL
-+sys_modify_ldt_18824 sys_modify_ldt 3 18824 NULL
-+unix_stream_recvmsg_35210 unix_stream_recvmsg 4 35210 NULL
-+tty_buffer_find_2443 tty_buffer_find 2 2443 NULL
-+xlog_do_recover_59789 xlog_do_recover 3 59789 NULL
-+stats_tx_handlers_drop_fragment_read_45464 stats_tx_handlers_drop_fragment_read 3 45464 NULL
-+rfcomm_tty_write_51603 rfcomm_tty_write 3 51603 NULL
-+ipw_write_59807 ipw_write 3 59807 NULL
-+l1oip_socket_parse_4507 l1oip_socket_parse 4 4507 NULL
-+scsi_init_shared_tag_map_59812 scsi_init_shared_tag_map 2 59812 NULL
-+ni65_alloc_mem_10664 ni65_alloc_mem 3 10664 NULL
-+b43legacy_debugfs_read_2473 b43legacy_debugfs_read 3 2473 NULL
-+usb_alloc_urb_43436 usb_alloc_urb 1 43436 NULL
-+sctp_setsockopt_events_18862 sctp_setsockopt_events 3 18862 NULL
-+btmrvl_txdnldready_read_413 btmrvl_txdnldready_read 3 413 NULL
-+dns_resolve_server_name_to_ip_51632 dns_resolve_server_name_to_ip 1 51632 NULL
-+set_fd_set_35249 set_fd_set 1 35249 NULL
-+wiphy_new_2482 wiphy_new 2 2482 NULL
-+pl2303_buf_alloc_35251 pl2303_buf_alloc 1 35251 NULL
-+ieee80211_if_read_dot11MeshHWMPmaxPREQretries_59829 ieee80211_if_read_dot11MeshHWMPmaxPREQretries 3 59829 NULL
-+qla2x00_change_queue_depth_43446 qla2x00_change_queue_depth 2 43446 NULL
-+ioapic_setup_resources_35255 ioapic_setup_resources 1 35255 NULL
-+tcp_push_10680 tcp_push 3 10680 NULL
-+sctp_auth_create_key_51641 sctp_auth_create_key 1 51641 NULL
-+c101_run_37279 c101_run 2 37279 NULL
-+iscsi_create_session_51647 iscsi_create_session 3 51647 NULL
-+___alloc_bootmem_node_18882 ___alloc_bootmem_node 2 18882 NULL
-+tun_put_user_59849 tun_put_user 4 59849 NULL
-+alloc_fdmem_27083 alloc_fdmem 1 27083 NULL
-+irda_recvmsg_stream_35280 irda_recvmsg_stream 4 35280 NULL
-+btmrvl_hscmd_write_27089 btmrvl_hscmd_write 3 27089 NULL
-+isr_rx_rdys_read_35283 isr_rx_rdys_read 3 35283 NULL
-+selinux_inode_setxattr_10708 selinux_inode_setxattr 4 10708 NULL
-+ps_upsd_utilization_read_51669 ps_upsd_utilization_read 3 51669 NULL
-+alloc_arch_preferred_bootmem_27097 alloc_arch_preferred_bootmem 2 27097 NULL
-+pvr2_ioread_read_10720 pvr2_ioread_read 3 10720 NULL nohasharray
-+shash_async_setkey_10720 shash_async_setkey 3 10720 &pvr2_ioread_read_10720
-+sctp_setsockopt_associnfo_51684 sctp_setsockopt_associnfo 3 51684 NULL
-+__iscsi_complete_pdu_10726 __iscsi_complete_pdu 4 10726 NULL
-+pvr2_ioread_set_sync_key_59882 pvr2_ioread_set_sync_key 3 59882 NULL
-+l2cap_sock_recvmsg_59886 l2cap_sock_recvmsg 4 59886 NULL
-+tracing_read_pipe_35312 tracing_read_pipe 3 35312 NULL
-+sctp_getsockopt_maxseg_10737 sctp_getsockopt_maxseg 2 10737 NULL
-+compat_sys_msgsnd_10738 compat_sys_msgsnd 2 10738 NULL
-+sel_write_access_51704 sel_write_access 3 51704 NULL
-+dvb_net_ioctl_43516 dvb_net_ioctl 3 43516 NULL
-+stats_tx_handlers_queued_read_35325 stats_tx_handlers_queued_read 3 35325 NULL
-+do_readlink_43518 do_readlink 2 43518 NULL
-+compat_sys_migrate_pages_3157 compat_sys_migrate_pages 2 3157 NULL
-+fallback_on_nodma_alloc_35332 fallback_on_nodma_alloc 2 35332 NULL
-+drm_compat_ioctl_51717 drm_compat_ioctl 2 51717 NULL
-+pms_capture_27142 pms_capture 4 27142 NULL
-+btmrvl_hscfgcmd_write_27143 btmrvl_hscfgcmd_write 3 27143 NULL
-+gspca_dev_probe_2570 gspca_dev_probe 4 2570 NULL
-+sg_read_oxfer_51724 sg_read_oxfer 3 51724 NULL
-+kvm_read_guest_atomic_10765 kvm_read_guest_atomic 4 10765 NULL
-+cachefiles_daemon_write_43535 cachefiles_daemon_write 3 43535 NULL
-+store_pwm1_enable_2577 store_pwm1_enable 4 2577 NULL
-+pwc_video_read_51735 pwc_video_read 3 51735 NULL
-+hid_parse_report_51737 hid_parse_report 3 51737 NULL
-+compat_filldir64_35354 compat_filldir64 3 35354 NULL
-+i2400m_net_rx_27170 i2400m_net_rx 5 27170 NULL
-+mld_newpack_50950 mld_newpack 2 50950 NULL
-+aac_change_queue_depth_51753 aac_change_queue_depth 2 51753 NULL
-+ath_rx_init_43564 ath_rx_init 2 43564 NULL
-+acpi_video_device_write_brightness_43565 acpi_video_device_write_brightness 3 43565 NULL
-+dapm_widget_power_read_file_59950 dapm_widget_power_read_file 3 59950 NULL
-+sys_bind_10799 sys_bind 3 10799 NULL
-+ip_ufo_append_data_27187 ip_ufo_append_data 5-7-6 27187 NULL
-+ioremap_prot_51764 ioremap_prot 2-1 51764 NULL
-+rpc_malloc_43573 rpc_malloc 2 43573 NULL
-+it821x_firmware_command_8628 it821x_firmware_command 3 8628 NULL
-+smk_write_logging_2618 smk_write_logging 3 2618 NULL
-+aun_incoming_10814 aun_incoming 3 10814 NULL
-+usbvideo_register_59982 usbvideo_register 2 59982 NULL
-+send_command_10832 send_command 4 10832 NULL
-+lro_gen_skb_2644 lro_gen_skb 6 2644 NULL
-+osd_req_read_kern_59990 osd_req_read_kern 5 59990 NULL
-+lbs_sleepparams_read_10840 lbs_sleepparams_read 3 10840 NULL
-+pppol2tp_sendmsg_56420 pppol2tp_sendmsg 4 56420 NULL
-+proc_read_43614 proc_read 3 43614 NULL
-+dma_memcpy_pg_to_iovec_1725 dma_memcpy_pg_to_iovec 6 1725 NULL
-+rxrpc_request_key_27235 rxrpc_request_key 3 27235 NULL
-+fuse_conn_max_background_read_10855 fuse_conn_max_background_read 3 10855 NULL
-+mthca_init_cq_60011 mthca_init_cq 2 60011 NULL
-+register_device_60015 register_device 3-2 60015 NULL
-+snd_pcm_oss_write1_10872 snd_pcm_oss_write1 3 10872 NULL
-+osd_req_list_dev_partitions_60027 osd_req_list_dev_partitions 4 60027 NULL
-+sys_sched_getaffinity_60033 sys_sched_getaffinity 2 60033 NULL
-+do_ip6t_set_ctl_60040 do_ip6t_set_ctl 4 60040 NULL
-+do_readv_writev_51849 do_readv_writev 4 51849 NULL
-+uhci_debug_read_5911 uhci_debug_read 3 5911 NULL
-+pmcraid_change_queue_depth_60044 pmcraid_change_queue_depth 2 60044 NULL
-+memcpy_fromiovecend_2707 memcpy_fromiovecend 3-4 2707 NULL
-+cgroup_write_string_10900 cgroup_write_string 5 10900 NULL
-+pointer_size_read_51863 pointer_size_read 3 51863 NULL
-+load_module_60056 load_module 2 60056 NULL
-+get_indirect_ea_51869 get_indirect_ea 4 51869 NULL
-+compat_writev_60063 compat_writev 3 60063 NULL
-+sta_last_seq_ctrl_read_19106 sta_last_seq_ctrl_read 3 19106 NULL
-+__copy_from_user_10918 __copy_from_user 3 10918 NULL
-+user_read_51881 user_read 3 51881 NULL
-+copy_from_buf_27308 copy_from_buf 4-2 27308 NULL
-+__xip_file_write_2733 __xip_file_write 3-4 2733 NULL
-+proc_write_bluetooth_34589 proc_write_bluetooth 3 34589 NULL
-+rxrpc_kernel_send_data_60083 rxrpc_kernel_send_data 3 60083 NULL
-+hidp_send_ctrl_message_43702 hidp_send_ctrl_message 4 43702 NULL
-+smb_do_alloc_request_43708 smb_do_alloc_request 2 43708 NULL
-+iwl_calib_set_10944 iwl_calib_set 3 10944 NULL
-+async_setkey_35521 async_setkey 3 35521 NULL
-+alloc_irdadev_19140 alloc_irdadev 1 19140 NULL
-+gfs2_readlink_10958 gfs2_readlink 3 10958 NULL
-+rxpipe_tx_xfr_host_int_trig_rx_data_read_35538 rxpipe_tx_xfr_host_int_trig_rx_data_read 3 35538 NULL
-+snd_rme32_playback_copy_43732 snd_rme32_playback_copy 5 43732 NULL
-+ttm_bo_kmap_60118 ttm_bo_kmap 3 60118 NULL
-+fuse_conn_congestion_threshold_write_43736 fuse_conn_congestion_threshold_write 3 43736 NULL
-+alloc_context_3194 alloc_context 1 3194 NULL
-+bm_entry_read_10976 bm_entry_read 3 10976 NULL
-+pcbit_stat_27364 pcbit_stat 2 27364 NULL
-+gigaset_initcs_43753 gigaset_initcs 2 43753 NULL
-+sctp_setsockopt_active_key_43755 sctp_setsockopt_active_key 3 43755 NULL
-+xfrm_hash_alloc_10997 xfrm_hash_alloc 1 10997 NULL
-+lbs_highsnr_read_5931 lbs_highsnr_read 3 5931 NULL
-+init_state_60165 init_state 2 60165 NULL
-+fast_shmem_read_2823 fast_shmem_read 5 2823 NULL
-+sel_read_enforce_2828 sel_read_enforce 3 2828 NULL
-+__copy_to_user_inatomic_19214 __copy_to_user_inatomic 3 19214 NULL
-+sg_build_sgat_60179 sg_build_sgat 3 60179 NULL nohasharray
-+jffs2_alloc_full_dirent_60179 jffs2_alloc_full_dirent 1 60179 &sg_build_sgat_60179
-+kernel_readv_35617 kernel_readv 3 35617 NULL
-+hci_send_cmd_43810 hci_send_cmd 3 43810 NULL
-+sys_lgetxattr_45531 sys_lgetxattr 4 45531 NULL
-+cxio_init_resource_fifo_random_43814 cxio_init_resource_fifo_random 3 43814 NULL
-+sta_tx_bytes_read_55197 sta_tx_bytes_read 3 55197 NULL
-+tda10048_writeregbulk_11050 tda10048_writeregbulk 4 11050 NULL
-+skb_copy_datagram_from_iovec_52014 skb_copy_datagram_from_iovec 2-5-4 52014 NULL
-+move_addr_to_user_2868 move_addr_to_user 2 2868 NULL
-+ieee80211_alloc_hw_43829 ieee80211_alloc_hw 1 43829 NULL
-+vxge_rx_alloc_52024 vxge_rx_alloc 3 52024 NULL
-+acpi_system_read_dsdt_19261 acpi_system_read_dsdt 3 19261 NULL
-+p54_download_eeprom_43842 p54_download_eeprom 4 43842 NULL
-+spi_register_board_info_35651 spi_register_board_info 2 35651 NULL
-+read_flush_43851 read_flush 3 43851 NULL
-+dma_rx_errors_read_52045 dma_rx_errors_read 3 52045 NULL
-+cmm_write_2896 cmm_write 3 2896 NULL
-+request_lock_35670 request_lock 4 35670 NULL
-+vicam_read_2904 vicam_read 3 2904 NULL
-+compat_sys_kexec_load_35674 compat_sys_kexec_load 2 35674 NULL
-+compat_sys_fcntl64_60256 compat_sys_fcntl64 3 60256 NULL
-+qc_capture_19298 qc_capture 3 19298 NULL
-+stats_tx_expand_skb_head_cloned_read_11107 stats_tx_expand_skb_head_cloned_read 3 11107 NULL
-+gdth_isa_probe_one_48925 gdth_isa_probe_one 1 48925 NULL
-+hcd_buffer_alloc_27495 hcd_buffer_alloc 2 27495 NULL
-+event_tx_stuck_read_19305 event_tx_stuck_read 3 19305 NULL
-+rds_page_copy_user_35691 rds_page_copy_user 4 35691 NULL
-+tracing_entries_write_60563 tracing_entries_write 3 60563 NULL
-+printer_write_60276 printer_write 3 60276 NULL
-+garmin_read_process_27509 garmin_read_process 3 27509 NULL
-+alloc_alien_cache_11127 alloc_alien_cache 2 11127 NULL
-+nsm_get_handle_52089 nsm_get_handle 4 52089 NULL
-+__pskb_pull_tail_60287 __pskb_pull_tail 2 60287 NULL
-+gs_buf_alloc_25067 gs_buf_alloc 2 25067 NULL
-+cfg80211_inform_bss_19332 cfg80211_inform_bss 8 19332 NULL
-+ib_copy_to_udata_27525 ib_copy_to_udata 3 27525 NULL
-+dn_nsp_return_disc_60296 dn_nsp_return_disc 2 60296 NULL
-+do_xip_mapping_read_60297 do_xip_mapping_read 5 60297 NULL
-+prism2_sta_send_mgmt_43916 prism2_sta_send_mgmt 5 43916 NULL
-+ppp_cp_event_2965 ppp_cp_event 6 2965 NULL
-+acpi_os_map_memory_11161 acpi_os_map_memory 2-1 11161 NULL
-+retry_count_read_52129 retry_count_read 3 52129 NULL
-+ioremap_default_64667 ioremap_default 2-1 64667 NULL
-+ioat2_alloc_ring_11172 ioat2_alloc_ring 2 11172 NULL
-+read_zero_19366 read_zero 3 19366 NULL
-+stats_dot11RTSFailureCount_read_43948 stats_dot11RTSFailureCount_read 3 43948 NULL
-+stats_multiple_retry_count_read_60334 stats_multiple_retry_count_read 3 60334 NULL
-+hysdn_conf_write_52145 hysdn_conf_write 3 52145 NULL
-+store_cardr_2997 store_cardr 4 2997 NULL
-+libipw_alloc_txb_27579 libipw_alloc_txb 1-3-2 27579 NULL
-+stats_rx_handlers_drop_passive_scan_read_52160 stats_rx_handlers_drop_passive_scan_read 3 52160 NULL
-+uv_ptc_proc_write_19394 uv_ptc_proc_write 3 19394 NULL
-+ieee80211_if_read_dot11MeshRetryTimeout_52168 ieee80211_if_read_dot11MeshRetryTimeout 3 52168 NULL
-+mga_compat_ioctl_52170 mga_compat_ioctl 2 52170 NULL
-+ar9170_rx_copy_data_35787 ar9170_rx_copy_data 2 35787 NULL
-+depth_write_3021 depth_write 3 3021 NULL
-+dccp_setsockopt_60367 dccp_setsockopt 5 60367 NULL
-+store_fan1_input_35793 store_fan1_input 4 35793 NULL
-+recent_old_proc_write_43473 recent_old_proc_write 3 43473 NULL
-+fast_rx_path_59214 fast_rx_path 3 59214 NULL
-+tipc_cfg_reply_alloc_27606 tipc_cfg_reply_alloc 1 27606 NULL
-+bcm_recvmsg_43992 bcm_recvmsg 4 43992 NULL
-+proc_pid_readlink_52186 proc_pid_readlink 3 52186 NULL
-+iwl_dbgfs_sleep_level_override_read_3038 iwl_dbgfs_sleep_level_override_read 3 3038 NULL
-+dvbdmx_write_19423 dvbdmx_write 3 19423 NULL
-+zd_rfwritev_locked_35812 zd_rfwritev_locked 4 35812 NULL
-+cnic_alloc_dma_34641 cnic_alloc_dma 3 34641 NULL
-+early_node_mem_52200 early_node_mem 4 52200 NULL
-+mthca_alloc_resize_buf_60394 mthca_alloc_resize_buf 3 60394 NULL
-+write_flush_procfs_44011 write_flush_procfs 3 44011 NULL
-+__videobuf_alloc_11253 __videobuf_alloc 1 11253 NULL
-+read_flush_procfs_27642 read_flush_procfs 3 27642 NULL
-+iscsi_if_send_reply_52219 iscsi_if_send_reply 7 52219 NULL
-+dac960_user_command_proc_write_3071 dac960_user_command_proc_write 3 3071 NULL
-+hugetlbfs_read_11268 hugetlbfs_read 3 11268 NULL
-+_alloc_mISDN_skb_52232 _alloc_mISDN_skb 3 52232 NULL
-+excessive_retries_read_60425 excessive_retries_read 3 60425 NULL
-+ip_vs_skb_replace_3083 ip_vs_skb_replace 4-6 3083 NULL
-+proc_write_brn_3084 proc_write_brn 3 3084 NULL
-+tstats_write_60432 tstats_write 3 60432 NULL nohasharray
-+kmalloc_60432 kmalloc 1 60432 &tstats_write_60432
-+refill_pool_19477 refill_pool 2 19477 NULL
-+fl_create_52248 fl_create 4 52248 NULL
-+rx_data_60442 rx_data 4 60442 NULL
-+iwm_ntf_rx_packet_60452 iwm_ntf_rx_packet 3 60452 NULL
-+sisusbcon_do_font_op_52271 sisusbcon_do_font_op 9 52271 NULL
-+uwb_rc_cmd_done_35892 uwb_rc_cmd_done 4 35892 NULL
-+l2cap_sar_segment_sdu_27701 l2cap_sar_segment_sdu 3 27701 NULL
-+skb_realloc_headroom_19516 skb_realloc_headroom 2 19516 NULL
-+atm_alloc_charge_19517 atm_alloc_charge 2 19517 NULL nohasharray
-+dev_alloc_skb_19517 dev_alloc_skb 1 19517 &atm_alloc_charge_19517
-+mb_cache_create_35903 mb_cache_create 4-5 35903 NULL
-+construct_key_11329 construct_key 3 11329 NULL
-+crypto_shash_setkey_60483 crypto_shash_setkey 3 60483 NULL
-+fill_write_buffer_3142 fill_write_buffer 3 3142 NULL
-+disk_expand_part_tbl_30561 disk_expand_part_tbl 2 30561 NULL
-+igmpv3_newpack_35912 igmpv3_newpack 2 35912 NULL
-+kernel_setsockopt_35913 kernel_setsockopt 5 35913 NULL
-+reg_w_buf_27724 reg_w_buf 3 27724 NULL
-+dccp_listen_start_35918 dccp_listen_start 2 35918 NULL
-+ip6_append_data_60501 ip6_append_data 4-5 60501 NULL
-+a4t_cs_init_27734 a4t_cs_init 3 27734 NULL
-+dvb_generic_ioctl_3257 dvb_generic_ioctl 3 3257 NULL
-+sel_write_create_11353 sel_write_create 3 11353 NULL
-+tracing_set_trace_read_44122 tracing_set_trace_read 3 44122 NULL
-+put_cmsg_compat_35937 put_cmsg_compat 4 35937 NULL
-+drm_vblank_init_11362 drm_vblank_init 2 11362 NULL
-+ath_tx_init_60515 ath_tx_init 2 60515 NULL
-+bt_skb_alloc_6404 bt_skb_alloc 1 6404 NULL
-+ntfs_rl_split_52328 ntfs_rl_split 2-4 52328 NULL
-+ocfs2_control_message_19564 ocfs2_control_message 3 19564 NULL
-+ieee80211_key_alloc_11373 ieee80211_key_alloc 3 11373 NULL
-+compat_do_ip6t_set_ctl_3184 compat_do_ip6t_set_ctl 4 3184 NULL
-+cgroup_read_s64_19570 cgroup_read_s64 5 19570 NULL
-+hysdn_sched_rx_60533 hysdn_sched_rx 3 60533 NULL
-+kcalloc_27770 kcalloc 1-2 27770 NULL
-+bm_status_read_19583 bm_status_read 3 19583 NULL
-+dev_irnet_write_11398 dev_irnet_write 3 11398 NULL
-+acl_alloc_35979 acl_alloc 1 35979 NULL
-+copy_entries_to_user_52367 copy_entries_to_user 1 52367 NULL
-+___alloc_bootmem_11410 ___alloc_bootmem 1 11410 NULL
-+str_to_user_11411 str_to_user 2 11411 NULL
-+trace_options_read_11419 trace_options_read 3 11419 NULL
-+isdn_writebuf_stub_52383 isdn_writebuf_stub 4 52383 NULL
-+kimage_crash_alloc_3233 kimage_crash_alloc 3 3233 NULL
-+mptscsih_change_queue_depth_44196 mptscsih_change_queue_depth 2 44196 NULL
-+console_store_36007 console_store 4 36007 NULL
-+key_key_read_3241 key_key_read 3 3241 NULL
-+aer_inject_write_52399 aer_inject_write 3 52399 NULL
-+ieee80211_if_read_dot11MeshHWMPactivePathTimeout_7368 ieee80211_if_read_dot11MeshHWMPactivePathTimeout 3 7368 NULL
-+snd_hdspm_playback_copy_52405 snd_hdspm_playback_copy 5 52405 NULL
-+sta_rx_dropped_read_27830 sta_rx_dropped_read 3 27830 NULL
-+sys_listxattr_27833 sys_listxattr 3 27833 NULL
-+aac_rx_ioremap_52410 aac_rx_ioremap 2 52410 NULL
-+um_idi_write_18293 um_idi_write 3 18293 NULL
-+cgroup_file_write_52417 cgroup_file_write 3 52417 NULL
-+srp_alloc_iu_44227 srp_alloc_iu 2 44227 NULL
-+cifs_partialpagewrite_60612 cifs_partialpagewrite 2-3 60612 NULL
-+usbvision_rvmalloc_19655 usbvision_rvmalloc 1 19655 NULL
-+LoadBitmap_19658 LoadBitmap 2 19658 NULL
-+scsi_track_queue_full_44239 scsi_track_queue_full 2 44239 NULL
-+get_new_cssid_51665 get_new_cssid 2 51665 NULL
-+read_profile_27859 read_profile 3 27859 NULL
-+stats_rx_handlers_drop_read_3284 stats_rx_handlers_drop_read 3 3284 NULL
-+acl_alloc_stack_init_60630 acl_alloc_stack_init 1 60630 NULL
-+enlarge_skb_44248 enlarge_skb 2 44248 NULL
-+sys_init_module_36047 sys_init_module 2 36047 NULL
-+ubifs_recover_leb_60639 ubifs_recover_leb 3 60639 NULL
-+btmrvl_psmode_read_22395 btmrvl_psmode_read 3 22395 NULL
-+stack_max_size_write_36068 stack_max_size_write 3 36068 NULL
-+oom_adjust_read_25127 oom_adjust_read 3 25127 NULL
-+sd_do_mode_sense_11507 sd_do_mode_sense 5 11507 NULL
-+unix_seqpacket_sendmsg_27893 unix_seqpacket_sendmsg 4 27893 NULL
-+kmem_zalloc_11510 kmem_zalloc 1 11510 NULL
-+ubi_eba_write_leb_st_27896 ubi_eba_write_leb_st 5 27896 NULL
-+ieee80211_if_read_dot11MeshConfirmTimeout_60670 ieee80211_if_read_dot11MeshConfirmTimeout 3 60670 NULL
-+gluebi_write_27905 gluebi_write 3 27905 NULL
-+aac_rkt_ioremap_3333 aac_rkt_ioremap 2 3333 NULL
-+sctp_make_init_ack_3335 sctp_make_init_ack 4 3335 NULL
-+read_from_oldmem_3337 read_from_oldmem 2 3337 NULL
-+sctp_getsockopt_context_52490 sctp_getsockopt_context 2 52490 NULL
-+skb_cow_head_52495 skb_cow_head 2 52495 NULL
-+vga_arb_write_36112 vga_arb_write 3 36112 NULL
-+do_sysctl_strategy_11541 do_sysctl_strategy 6 11541 NULL
-+l1oip_socket_recv_56537 l1oip_socket_recv 6 56537 NULL
-+memcpy_toiovecend_19736 memcpy_toiovecend 3-4 19736 NULL
-+iser_rcv_completion_63364 iser_rcv_completion 2 63364 NULL
-+dispatch_proc_write_44320 dispatch_proc_write 3 44320 NULL
-+vmalloc_exec_36132 vmalloc_exec 1 36132 NULL
-+p9_client_read_19750 p9_client_read 5 19750 NULL
-+sctp_getsockopt_peer_addrs_old_11565 sctp_getsockopt_peer_addrs_old 2 11565 NULL nohasharray
-+skb_cow_data_11565 skb_cow_data 2 11565 &sctp_getsockopt_peer_addrs_old_11565
-+raw_recvmsg_52529 raw_recvmsg 4 52529 NULL
-+copy_from_user_toio_31966 copy_from_user_toio 3 31966 NULL
-+sctp_make_abort_violation_27959 sctp_make_abort_violation 4 27959 NULL
-+tracing_clock_write_27961 tracing_clock_write 3 27961 NULL
-+b1_alloc_card_36155 b1_alloc_card 1 36155 NULL
-+oprofilefs_ulong_to_user_11582 oprofilefs_ulong_to_user 3 11582 NULL
-+start_isoc_chain_565 start_isoc_chain 2 565 NULL
-+blk_queue_init_tags_44355 blk_queue_init_tags 2 44355 NULL
-+saa7146_vmalloc_build_pgtable_19780 saa7146_vmalloc_build_pgtable 2 19780 NULL
-+dccpprobe_read_52549 dccpprobe_read 3 52549 NULL
-+snd_korg1212_copy_from_36169 snd_korg1212_copy_from 6 36169 NULL
-+fw_device_op_ioctl_11595 fw_device_op_ioctl 2 11595 NULL
-+ipx_recvmsg_44366 ipx_recvmsg 4 44366 NULL
-+hycapi_rx_capipkt_11602 hycapi_rx_capipkt 3 11602 NULL
-+msix_map_region_3411 msix_map_region 3 3411 NULL
-+sys_kexec_load_14222 sys_kexec_load 2 14222 NULL
-+rts_threshold_read_44384 rts_threshold_read 3 44384 NULL
-+pci_add_cap_save_buffer_3426 pci_add_cap_save_buffer 3 3426 NULL
-+sel_write_checkreqprot_60774 sel_write_checkreqprot 3 60774 NULL
-+opticon_write_60775 opticon_write 4 60775 NULL
-+snd_rawmidi_write_28008 snd_rawmidi_write 3 28008 NULL
-+acl_alloc_num_60778 acl_alloc_num 1-2 60778 NULL
-+aoedev_flush_44398 aoedev_flush 2 44398 NULL
-+stats_tx_handlers_drop_not_assoc_read_28015 stats_tx_handlers_drop_not_assoc_read 3 28015 NULL
-+irda_setsockopt_19824 irda_setsockopt 5 19824 NULL
-+nfs4_write_cached_acl_44402 nfs4_write_cached_acl 3 44402 NULL
-+get_packet_pg_28023 get_packet_pg 4 28023 NULL
-+osst_do_scsi_44410 osst_do_scsi 4 44410 NULL
-+cosa_net_setup_rx_38594 cosa_net_setup_rx 2 38594 NULL
-+security_context_to_sid_19839 security_context_to_sid 2 19839 NULL
-+sisusb_send_bridge_packet_11649 sisusb_send_bridge_packet 2 11649 NULL
-+atomic_stats_read_36228 atomic_stats_read 3 36228 NULL
-+sctp_setsockopt_maxburst_28041 sctp_setsockopt_maxburst 3 28041 NULL
-+alloc_skb_fclone_3467 alloc_skb_fclone 1 3467 NULL
-+proc_fault_inject_write_21058 proc_fault_inject_write 3 21058 NULL
-+dlm_lock_19858 dlm_lock 6 19858 NULL
-+cx231xx_init_vbi_isoc_28053 cx231xx_init_vbi_isoc 2-3 28053 NULL
-+ide_queue_pc_tail_11673 ide_queue_pc_tail 5 11673 NULL
-+cfg80211_roamed_28061 cfg80211_roamed 4-6 28061 NULL
-+compat_sys_mbind_36256 compat_sys_mbind 5 36256 NULL
-+dvb_demux_do_ioctl_38811 dvb_demux_do_ioctl 4 38811 NULL
-+security_context_to_sid_default_3492 security_context_to_sid_default 2 3492 NULL nohasharray
-+efi_ioremap_3492 efi_ioremap 2-1 3492 &security_context_to_sid_default_3492
-+iwm_ntf_calib_res_11686 iwm_ntf_calib_res 3 11686 NULL
-+sctp_setsockopt_hmac_ident_11687 sctp_setsockopt_hmac_ident 3 11687 NULL
-+edac_pci_alloc_ctl_info_63388 edac_pci_alloc_ctl_info 1 63388 NULL
-+sysctl_ipc_registered_data_36266 sysctl_ipc_registered_data 5 36266 NULL
-+snd_ctl_elem_user_tlv_11695 snd_ctl_elem_user_tlv 3 11695 NULL
-+pwr_tx_with_ps_read_60851 pwr_tx_with_ps_read 3 60851 NULL
-+usb_buffer_alloc_36276 usb_buffer_alloc 2 36276 NULL
-+codec_reg_read_file_36280 codec_reg_read_file 3 36280 NULL
-+iscsi_complete_pdu_48372 iscsi_complete_pdu 4 48372 NULL
-+gdth_init_isa_28091 gdth_init_isa 1 28091 NULL
-+ql_dump_hw_cb_3518 ql_dump_hw_cb 2 3518 NULL
-+ieee80211_send_auth_60865 ieee80211_send_auth 5 60865 NULL
-+sctp_getsockopt_rtoinfo_62027 sctp_getsockopt_rtoinfo 2 62027 NULL
-+diva_alloc_dma_map_23798 diva_alloc_dma_map 2 23798 NULL
-+aes_decrypt_interrupt_read_19910 aes_decrypt_interrupt_read 3 19910 NULL
-+ps_upsd_max_apturn_read_19918 ps_upsd_max_apturn_read 3 19918 NULL
-+ieee80211_if_read_dropped_frames_ttl_44500 ieee80211_if_read_dropped_frames_ttl 3 44500 NULL
-+iwl_dbgfs_sram_read_44505 iwl_dbgfs_sram_read 3 44505 NULL
-+get_vm_area_node_44507 get_vm_area_node 1 44507 NULL
-+vgacon_adjust_height_28124 vgacon_adjust_height 2 28124 NULL
-+spidev_write_44510 spidev_write 3 44510 NULL
-+proc_write_wled_592 proc_write_wled 3 592 NULL
-+iwl_dbgfs_rx_queue_read_19943 iwl_dbgfs_rx_queue_read 3 19943 NULL
-+fat_compat_ioctl_filldir_36328 fat_compat_ioctl_filldir 3 36328 NULL
-+iwl_dbgfs_qos_read_11753 iwl_dbgfs_qos_read 3 11753 NULL
-+hpsb_alloc_host_3562 hpsb_alloc_host 2 3562 NULL
-+alloc_smp_resp_3566 alloc_smp_resp 1 3566 NULL
-+jbd2_journal_init_revoke_table_36336 jbd2_journal_init_revoke_table 1 36336 NULL
-+zd_ioread32v_locked_19953 zd_ioread32v_locked 4 19953 NULL
-+mgt_set_varlen_60916 mgt_set_varlen 4 60916 NULL
-+compat_sys_setsockopt_3326 compat_sys_setsockopt 5 3326 NULL
-+sys_msgsnd_44537 sys_msgsnd 3 44537 NULL
-+stats_dot11FCSErrorCount_read_28154 stats_dot11FCSErrorCount_read 3 28154 NULL
-+ax25_send_frame_19964 ax25_send_frame 2 19964 NULL
-+blkcipher_next_slow_52733 blkcipher_next_slow 4-3 52733 NULL
-+relay_alloc_page_array_52735 relay_alloc_page_array 1 52735 NULL
-+xfs_buf_get_noaddr_52736 xfs_buf_get_noaddr 1 52736 NULL
-+v9fs_file_readn_36353 v9fs_file_readn 4 36353 NULL
-+ivtv_v4l2_read_1964 ivtv_v4l2_read 3 1964 NULL
-+iscsi_nop_out_rsp_51117 iscsi_nop_out_rsp 4 51117 NULL
-+attach_hdlc_protocol_19986 attach_hdlc_protocol 3 19986 NULL
-+mtd_do_writeoob_36373 mtd_do_writeoob 4 36373 NULL
-+vring_new_virtqueue_36374 vring_new_virtqueue 1 36374 NULL
-+sctp_getsockopt_events_3607 sctp_getsockopt_events 2 3607 NULL
-+sctp_getsockopt_partial_delivery_point_60952 sctp_getsockopt_partial_delivery_point 2 60952 NULL
-+key_algorithm_read_57946 key_algorithm_read 3 57946 NULL
-+cafe_v4l_read_52766 cafe_v4l_read 3 52766 NULL
-+proc_fdinfo_read_62043 proc_fdinfo_read 3 62043 NULL
-+sctp_make_datafrag_empty_34737 sctp_make_datafrag_empty 3 34737 NULL
-+ppp_tx_cp_62044 ppp_tx_cp 5 62044 NULL
-+pcpu_fc_alloc_11818 pcpu_fc_alloc 2 11818 NULL
-+aligned_kmalloc_3628 aligned_kmalloc 1 3628 NULL
-+afs_alloc_flat_call_36399 afs_alloc_flat_call 2-3 36399 NULL
-+snd_pcm_alloc_vmalloc_buffer_44595 snd_pcm_alloc_vmalloc_buffer 2 44595 NULL
-+sctp_setsockopt_maxseg_11829 sctp_setsockopt_maxseg 3 11829 NULL
-+dsp_cmx_send_member_15625 dsp_cmx_send_member 2 15625 NULL
-+cm_copy_private_data_3649 cm_copy_private_data 2 3649 NULL
-+i915_compat_ioctl_3656 i915_compat_ioctl 2 3656 NULL
-+sctp_getsockopt_mappedv4_20044 sctp_getsockopt_mappedv4 2 20044 NULL
-+compat_udp_setsockopt_38840 compat_udp_setsockopt 5 38840 NULL
-+send_video_command_6073 send_video_command 4 6073 NULL nohasharray
-+sctp_setsockopt_connectx_6073 sctp_setsockopt_connectx 3 6073 &send_video_command_6073
-+ecryptfs_copy_filename_11868 ecryptfs_copy_filename 4 11868 NULL
-+sctp_tsnmap_init_36446 sctp_tsnmap_init 2 36446 NULL
-+alloc_ieee80211_20063 alloc_ieee80211 1 20063 NULL
-+pwr_rcvd_beacons_read_52836 pwr_rcvd_beacons_read 3 52836 NULL
-+_l2_alloc_skb_11883 _l2_alloc_skb 1 11883 NULL
-+stats_tx_handlers_drop_read_44654 stats_tx_handlers_drop_read 3 44654 NULL
-+proc_pid_attr_read_10173 proc_pid_attr_read 3 10173 NULL
-+rawv6_sendmsg_20080 rawv6_sendmsg 4 20080 NULL
-+fuse_conn_limit_read_20084 fuse_conn_limit_read 3 20084 NULL
-+btmrvl_psmode_write_3703 btmrvl_psmode_write 3 3703 NULL
-+symtab_init_61050 symtab_init 2 61050 NULL
-+alloc_ctrl_packet_44667 alloc_ctrl_packet 1 44667 NULL
-+mon_bin_get_event_52863 mon_bin_get_event 4 52863 NULL
-+tower_write_8580 tower_write 3 8580 NULL
-+kmalloc_slab_11917 kmalloc_slab 1 11917 NULL
-+__hidp_send_ctrl_message_28303 __hidp_send_ctrl_message 4 28303 NULL
-+edge_buf_alloc_36498 edge_buf_alloc 1 36498 NULL
-+buf_acquire_3736 buf_acquire 1 3736 NULL
-+ci_ll_write_3740 ci_ll_write 4 3740 NULL
-+snd_pcm_oss_read_28317 snd_pcm_oss_read 3 28317 NULL
-+__hwahc_op_set_ptk_36510 __hwahc_op_set_ptk 5 36510 NULL
-+dccp_feat_clone_sp_val_11942 dccp_feat_clone_sp_val 3 11942 NULL
-+pms_read_53873 pms_read 3 53873 NULL
-+ieee80211_if_read_fwded_frames_36520 ieee80211_if_read_fwded_frames 3 36520 NULL
-+mempool_create_node_44715 mempool_create_node 1 44715 NULL
-+replay_bud_56605 replay_bud 3 56605 NULL
-+__alloc_bootmem_node_1992 __alloc_bootmem_node 2 1992 NULL
-+bm_entry_write_28338 bm_entry_write 3 28338 NULL
-+_zd_iowrite32v_locked_44725 _zd_iowrite32v_locked 3 44725 NULL
-+tcp_copy_to_iovec_28344 tcp_copy_to_iovec 3 28344 NULL
-+clusterip_proc_write_44729 clusterip_proc_write 3 44729 NULL
-+cpu_type_read_36540 cpu_type_read 3 36540 NULL
-+hpsb_node_write_52928 hpsb_node_write 4 52928 NULL
-+snd_seq_oss_readq_new_14283 snd_seq_oss_readq_new 2 14283 NULL
-+key_tx_rx_count_read_44742 key_tx_rx_count_read 3 44742 NULL
-+xfs_dir2_leaf_getdents_23841 xfs_dir2_leaf_getdents 3 23841 NULL
-+read_flush_pipefs_20171 read_flush_pipefs 3 20171 NULL
-+wep_addr_key_count_read_20174 wep_addr_key_count_read 3 20174 NULL
-+sctp_setsockopt_auth_key_3793 sctp_setsockopt_auth_key 3 3793 NULL
-+afs_proc_cells_write_61139 afs_proc_cells_write 3 61139 NULL
-+store_disp_52952 store_disp 4 52952 NULL
-+mangle_epsv_packet_36571 mangle_epsv_packet 5 36571 NULL
-+sys_writev_28384 sys_writev 3 28384 NULL
-+dlmfs_file_read_28385 dlmfs_file_read 3 28385 NULL
-+ssb_bus_scan_36578 ssb_bus_scan 2 36578 NULL
-+ncp_file_write_3813 ncp_file_write 3 3813 NULL
-+put_cmsg_36589 put_cmsg 4 36589 NULL
-+__vmalloc_61168 __vmalloc 1 61168 NULL
-+llc_ui_recvmsg_3826 llc_ui_recvmsg 4 3826 NULL
-+sctp_setsockopt_44788 sctp_setsockopt 5 44788 NULL
-+pcnet32_realloc_rx_ring_36598 pcnet32_realloc_rx_ring 3 36598 NULL
-+event_oom_late_read_61175 event_oom_late_read 3 61175 NULL
-+sys_lsetxattr_61177 sys_lsetxattr 4 61177 NULL
-+rx_dropped_read_44799 rx_dropped_read 3 44799 NULL
-+fat_ioctl_filldir_36621 fat_ioctl_filldir 3 36621 NULL
-+smk_read_onlycap_3855 smk_read_onlycap 3 3855 NULL
-+rose_sendmsg_20249 rose_sendmsg 4 20249 NULL
-+get_fd_set_3866 get_fd_set 1 3866 NULL
-+jffs2_security_setxattr_20253 jffs2_security_setxattr 4 20253 NULL
-+ubi_dbg_dump_flash_3870 ubi_dbg_dump_flash 4 3870 NULL
-+sisusb_write_44834 sisusb_write 3 44834 NULL
-+sta_rx_fragments_read_44835 sta_rx_fragments_read 3 44835 NULL
-+acpi_system_read_fadt_3876 acpi_system_read_fadt 3 3876 NULL
-+mlx4_init_cmpt_table_11569 mlx4_init_cmpt_table 3 11569 NULL
-+ubifs_leb_write_61226 ubifs_leb_write 5-4 61226 NULL
-+garp_attr_create_3883 garp_attr_create 3 3883 NULL
-+cpia_write_proc_20268 cpia_write_proc 3 20268 NULL
-+ubifs_recover_log_leb_12079 ubifs_recover_log_leb 3 12079 NULL
-+uea_send_modem_cmd_3888 uea_send_modem_cmd 3 3888 NULL
-+nvram_write_3894 nvram_write 3 3894 NULL
-+osd_req_list_collection_objects_36664 osd_req_list_collection_objects 5 36664 NULL
-+sysctl_ipc_data_3903 sysctl_ipc_data 5 3903 NULL
-+vcs_write_3910 vcs_write 3 3910 NULL
-+compat_sys_msgrcv_7482 compat_sys_msgrcv 2 7482 NULL
-+compat_udpv6_setsockopt_42981 compat_udpv6_setsockopt 5 42981 NULL
-+do_tty_write_44896 do_tty_write 5 44896 NULL
-+snd_cs4281_BA1_read_20323 snd_cs4281_BA1_read 5-6 20323 NULL
-+_scsih_change_queue_depth_44902 _scsih_change_queue_depth 2 44902 NULL
-+xfs_handle_to_dentry_12135 xfs_handle_to_dentry 3 12135 NULL
-+sys_add_key_61288 sys_add_key 4 61288 NULL
-+rawv6_seticmpfilter_12137 rawv6_seticmpfilter 5 12137 NULL
-+platform_device_register_simple_61290 platform_device_register_simple 4 61290 NULL
-+proc_write_tled_3947 proc_write_tled 3 3947 NULL
-+i2400m_tx_stats_read_28527 i2400m_tx_stats_read 3 28527 NULL
-+btmrvl_sdio_host_to_card_12152 btmrvl_sdio_host_to_card 3 12152 NULL
-+gfs2_glock_nq_m_20347 gfs2_glock_nq_m 1 20347 NULL
-+l2cap_send_cmd_3678 l2cap_send_cmd 4 3678 NULL
-+sel_read_policycap_28544 sel_read_policycap 3 28544 NULL
-+mptctl_getiocinfo_28545 mptctl_getiocinfo 2 28545 NULL
-+snd_rawmidi_kernel_read1_36740 snd_rawmidi_kernel_read1 4 36740 NULL
-+b43legacy_debugfs_write_28556 b43legacy_debugfs_write 3 28556 NULL
-+dma_memcpy_to_iovec_12173 dma_memcpy_to_iovec 5 12173 NULL
-+pcpu_mem_alloc_3987 pcpu_mem_alloc 1 3987 NULL
-+inet_dccp_listen_28565 inet_dccp_listen 2 28565 NULL
-+do_add_counters_3992 do_add_counters 3 3992 NULL
-+mic_rx_pkts_read_27972 mic_rx_pkts_read 3 27972 NULL
-+ip_generic_getfrag_12187 ip_generic_getfrag 3-4 12187 NULL
-+st5481_setup_isocpipes_61340 st5481_setup_isocpipes 6-4 61340 NULL
-+acpi_video_device_write_state_61342 acpi_video_device_write_state 3 61342 NULL
-+ip4ip6_err_36772 ip4ip6_err 5 36772 NULL
-+ieee80211_if_read_dot11MeshMaxPeerLinks_23878 ieee80211_if_read_dot11MeshMaxPeerLinks 3 23878 NULL
-+snd_hdsp_capture_copy_4011 snd_hdsp_capture_copy 5 4011 NULL
-+nfsd_read_20406 nfsd_read 6 20406 NULL
-+receive_copy_12216 receive_copy 3 12216 NULL
-+proc_fault_inject_read_36802 proc_fault_inject_read 3 36802 NULL
-+stats_tx_expand_skb_head_read_53188 stats_tx_expand_skb_head_read 3 53188 NULL
-+change_xattr_61390 change_xattr 5 61390 NULL
-+find_skb_20431 find_skb 2 20431 NULL
-+hiddev_ioctl_36816 hiddev_ioctl 2 36816 NULL
-+tcp_fragment_20436 tcp_fragment 3 20436 NULL
-+ib_uverbs_unmarshall_recv_12251 ib_uverbs_unmarshall_recv 5 12251 NULL
-+vstusb_write_45021 vstusb_write 3 45021 NULL nohasharray
-+ptrace_writedata_45021 ptrace_writedata 4 45021 &vstusb_write_45021
-+simple_alloc_urb_60420 simple_alloc_urb 3 60420 NULL
-+sys_sethostname_42962 sys_sethostname 2 42962 NULL
-+shash_compat_setkey_12267 shash_compat_setkey 3 12267 NULL
-+add_sctp_bind_addr_12269 add_sctp_bind_addr 3 12269 NULL
-+sctp_make_asconf_4078 sctp_make_asconf 3 4078 NULL
-+vhci_get_user_45039 vhci_get_user 3 45039 NULL
-+compat_ipv6_setsockopt_20468 compat_ipv6_setsockopt 5 20468 NULL
-+keyctl_describe_key_36853 keyctl_describe_key 3 36853 NULL
-+blk_queue_resize_tags_28670 blk_queue_resize_tags 2 28670 NULL
-+sel_write_user_45060 sel_write_user 3 45060 NULL
-+sbp2util_node_write_no_wait_7510 sbp2util_node_write_no_wait 4 7510 NULL
-+iwm_notif_send_12295 iwm_notif_send 6 12295 NULL
-+__dev_alloc_skb_28681 __dev_alloc_skb 1 28681 NULL
-+__videobuf_copy_stream_20490 __videobuf_copy_stream 3 20490 NULL
-+svc_setsockopt_36876 svc_setsockopt 5 36876 NULL
-+snd_mixart_BA0_read_45069 snd_mixart_BA0_read 5-6 45069 NULL
-+fast_user_write_20494 fast_user_write 5 20494 NULL
-+ipr_change_queue_depth_53263 ipr_change_queue_depth 2 53263 NULL
-+allocate_buffers_4113 allocate_buffers 2 4113 NULL
-+ib_ucm_alloc_data_36885 ib_ucm_alloc_data 3 36885 NULL
-+bt_sock_recvmsg_12316 bt_sock_recvmsg 4 12316 NULL
-+selinux_inode_notifysecctx_36896 selinux_inode_notifysecctx 3 36896 NULL
-+user_dlm_lock_56667 user_dlm_lock 6 56667 NULL
-+pwc_rvmalloc_12325 pwc_rvmalloc 1 12325 NULL
-+dvb_dvr_read_17073 dvb_dvr_read 3 17073 NULL
-+xfs_iext_realloc_direct_20521 xfs_iext_realloc_direct 2 20521 NULL
-+sctp_getsockopt_disable_fragments_12330 sctp_getsockopt_disable_fragments 2 12330 NULL
-+pcbit_writecmd_12332 pcbit_writecmd 2 12332 NULL
-+__get_vm_area_node_55305 __get_vm_area_node 1 55305 NULL
-+amd_create_gatt_pages_20537 amd_create_gatt_pages 1 20537 NULL
-+usbdev_read_45114 usbdev_read 3 45114 NULL
-+spi_execute_28736 spi_execute 5 28736 NULL
-+snd_pcm_aio_write_28738 snd_pcm_aio_write 3 28738 NULL
-+mptctl_ioctl_12355 mptctl_ioctl 2 12355 NULL
-+get_alua_req_4166 get_alua_req 3 4166 NULL
-+blk_dropped_read_4168 blk_dropped_read 3 4168 NULL
-+venus_create_20555 venus_create 4 20555 NULL
-+ftrace_profile_write_53327 ftrace_profile_write 3 53327 NULL
-+expand_files_17080 expand_files 2 17080 NULL
-+read_file_bool_4180 read_file_bool 3 4180 NULL
-+send_to_tty_45141 send_to_tty 3 45141 NULL
-+write_leb_36957 write_leb 5 36957 NULL
-+xfs_iext_inline_to_direct_12384 xfs_iext_inline_to_direct 2 12384 NULL
-+stats_transmitted_fragment_count_read_28770 stats_transmitted_fragment_count_read 3 28770 NULL
-+device_write_45156 device_write 3 45156 NULL
-+_osd_req_list_objects_4204 _osd_req_list_objects 6 4204 NULL
-+trace_options_core_write_61551 trace_options_core_write 3 61551 NULL
-+dvb_net_sec_callback_28786 dvb_net_sec_callback 2 28786 NULL
-+gem_alloc_skb_59411 gem_alloc_skb 1 59411 NULL
-+sctp_getsockopt_local_addrs_old_4220 sctp_getsockopt_local_addrs_old 2 4220 NULL
-+vring_add_indirect_4224 vring_add_indirect 3-4 4224 NULL
-+pwr_disable_ps_read_13176 pwr_disable_ps_read 3 13176 NULL
-+cgroup_file_read_28804 cgroup_file_read 3 28804 NULL
-+snd_sb_csp_load_user_45190 snd_sb_csp_load_user 3 45190 NULL
-+setxattr_37006 setxattr 4 37006 NULL
-+add_child_45201 add_child 4 45201 NULL
-+seq_open_private_61589 seq_open_private 3 61589 NULL
-+__get_vm_area_61599 __get_vm_area 1 61599 NULL
-+netlink_recvmsg_61600 netlink_recvmsg 4 61600 NULL
-+store_lssw_43035 store_lssw 4 43035 NULL nohasharray
-+wep_default_key_count_read_43035 wep_default_key_count_read 3 43035 &store_lssw_43035
-+spi_alloc_master_45223 spi_alloc_master 2 45223 NULL
-+ubi_eba_write_leb_19826 ubi_eba_write_leb 6-5 19826 NULL
-+vp_request_msix_vectors_28849 vp_request_msix_vectors 2 28849 NULL
-+configfs_write_file_61621 configfs_write_file 3 61621 NULL
-+event_enable_write_45238 event_enable_write 3 45238 NULL
-+ieee80211_if_read_drop_unencrypted_37053 ieee80211_if_read_drop_unencrypted 3 37053 NULL
-+ieee80211_rx_bss_info_61630 ieee80211_rx_bss_info 3 61630 NULL
-+isr_cmd_cmplt_read_53439 isr_cmd_cmplt_read 3 53439 NULL
-+_fc_frame_alloc_28865 _fc_frame_alloc 2 28865 NULL
-+i2o_parm_table_get_61635 i2o_parm_table_get 6 61635 NULL
-+snd_hdsp_playback_copy_20676 snd_hdsp_playback_copy 5 20676 NULL
-+x25_sendmsg_12487 x25_sendmsg 4 12487 NULL
-+dvb_dmxdev_buffer_read_20682 dvb_dmxdev_buffer_read 4 20682 NULL
-+pipe_iov_copy_to_user_3447 pipe_iov_copy_to_user 3 3447 NULL
-+dvb_ringbuffer_pkt_read_user_4303 dvb_ringbuffer_pkt_read_user 3-5-2 4303 NULL
-+resize_stripes_61650 resize_stripes 2 61650 NULL
-+n2_run_53459 n2_run 3 53459 NULL
-+packet_sendmsg_spkt_28885 packet_sendmsg_spkt 4 28885 NULL
-+parse_command_37079 parse_command 2 37079 NULL
-+hpsb_make_writepacket_61656 hpsb_make_writepacket 5 61656 NULL
-+drm_agp_allocate_memory_15738 drm_agp_allocate_memory 2 15738 NULL
-+rds_tcp_data_recv_53476 rds_tcp_data_recv 3 53476 NULL
-+ftdi_write_20710 ftdi_write 4 20710 NULL
-+snd_rawmidi_kernel_read_4328 snd_rawmidi_kernel_read 3 4328 NULL
-+iowarrior_read_53483 iowarrior_read 3 53483 NULL
-+osd_req_write_kern_53486 osd_req_write_kern 5 53486 NULL
-+snd_pcm_oss_sync1_45298 snd_pcm_oss_sync1 2 45298 NULL
-+security_context_to_sid_force_20724 security_context_to_sid_force 2 20724 NULL
-+tso_fragment_12539 tso_fragment 3 12539 NULL
-+filter_read_61692 filter_read 3 61692 NULL
-+ar9170_alloc_4355 ar9170_alloc 1 4355 NULL
-+__copy_from_user_inatomic_4365 __copy_from_user_inatomic 3 4365 NULL
-+vol_cdev_direct_write_20751 vol_cdev_direct_write 3 20751 NULL
-+ipc_rcu_alloc_21208 ipc_rcu_alloc 1 21208 NULL nohasharray
-+frame_alloc_21208 frame_alloc 2 21208 &ipc_rcu_alloc_21208
-+zc0301_read_53524 zc0301_read 3 53524 NULL
-+sys_setdomainname_4373 sys_setdomainname 2 4373 NULL
-+fragmentation_threshold_read_61718 fragmentation_threshold_read 3 61718 NULL
-+snd_rme9652_capture_copy_10287 snd_rme9652_capture_copy 5 10287 NULL
-+copy_vm86_regs_from_user_45340 copy_vm86_regs_from_user 3 45340 NULL
-+se401_read_58074 se401_read 3 58074 NULL
-+hvc_alloc_12579 hvc_alloc 4 12579 NULL
-+irda_sendmsg_4388 irda_sendmsg 4 4388 NULL
-+pcpu_extend_area_map_12589 pcpu_extend_area_map 2 12589 NULL
-+read_file_interrupt_61742 read_file_interrupt 3 61742 NULL
-+vhci_put_user_12604 vhci_put_user 4 12604 NULL
-+sctp_getsockopt_adaptation_layer_45375 sctp_getsockopt_adaptation_layer 2 45375 NULL
-+hci_sock_setsockopt_28993 hci_sock_setsockopt 5 28993 NULL
-+neigh_hash_alloc_52619 neigh_hash_alloc 1 52619 NULL
-+sys_sendto_20809 sys_sendto 6 20809 NULL
-+w9968cf_read_53582 w9968cf_read 3 53582 NULL nohasharray
-+set_registers_53582 set_registers 3 53582 &w9968cf_read_53582
-+stats_rx_handlers_drop_short_read_45391 stats_rx_handlers_drop_short_read 3 45391 NULL
-+do_pages_stat_4437 do_pages_stat 2 4437 NULL
-+lane2_associate_req_45398 lane2_associate_req 4 45398 NULL
-+ieee80211_rx_mgmt_probe_resp_12634 ieee80211_rx_mgmt_probe_resp 4 12634 NULL
-+pn_sendmsg_12640 pn_sendmsg 4 12640 NULL
-+pfkey_recvmsg_53604 pfkey_recvmsg 4 53604 NULL
-+sys_fcntl64_29031 sys_fcntl64 3 29031 NULL
-+nr_recvmsg_12649 nr_recvmsg 4 12649 NULL
-+__do_replace_37227 __do_replace 5 37227 NULL
-+dn_alloc_send_pskb_4465 dn_alloc_send_pskb 2 4465 NULL
-+at76_set_card_command_4471 at76_set_card_command 4 4471 NULL
-+hdpvr_i2c_write_61816 hdpvr_i2c_write 4 61816 NULL
-+rxrpc_sendmsg_29049 rxrpc_sendmsg 4 29049 NULL nohasharray
-+hpsb_read_29049 hpsb_read 6 29049 &rxrpc_sendmsg_29049
-+___alloc_bootmem_nopanic_53626 ___alloc_bootmem_nopanic 1 53626 NULL
-+recv_control_msg_4476 recv_control_msg 5 4476 NULL
-+tty_buffer_alloc_45437 tty_buffer_alloc 2 45437 NULL
-+sys_semtimedop_4486 sys_semtimedop 3 4486 NULL
-+udp_sendmsg_4492 udp_sendmsg 4 4492 NULL
-+sctp_getsockopt_peer_addr_params_53645 sctp_getsockopt_peer_addr_params 2 53645 NULL
-+nr_sendmsg_53656 nr_sendmsg 4 53656 NULL
-+rb_simple_write_20890 rb_simple_write 3 20890 NULL
-+sisusb_send_packet_20891 sisusb_send_packet 2 20891 NULL
-+tracing_read_dyn_info_45468 tracing_read_dyn_info 3 45468 NULL
-+key_icverrors_read_20895 key_icverrors_read 3 20895 NULL
-+srp_target_alloc_37288 srp_target_alloc 3 37288 NULL
-+sctp_getsockopt_active_key_45483 sctp_getsockopt_active_key 2 45483 NULL
-+ieee80211_if_read_num_buffered_multicast_12716 ieee80211_if_read_num_buffered_multicast 3 12716 NULL
-+compat_sys_readv_20911 compat_sys_readv 3 20911 NULL
-+fuse_fill_write_pages_53682 fuse_fill_write_pages 4 53682 NULL
-+sys_llistxattr_4532 sys_llistxattr 3 4532 NULL
-+isdn_ppp_write_29109 isdn_ppp_write 4 29109 NULL
-+jffs2_write_dirent_37311 jffs2_write_dirent 5 37311 NULL
-+key_rx_spec_read_12736 key_rx_spec_read 3 12736 NULL
-+kmem_zalloc_greedy_45507 kmem_zalloc_greedy 2-3 45507 NULL
-+videobuf_vmalloc_to_sg_4548 videobuf_vmalloc_to_sg 2 4548 NULL
-+clear_refs_write_61904 clear_refs_write 3 61904 NULL
-+scsi_mode_select_37330 scsi_mode_select 6 37330 NULL
-+rxrpc_server_sendmsg_37331 rxrpc_server_sendmsg 4 37331 NULL
-+ieee80211_if_read_dot11MeshMaxRetries_12756 ieee80211_if_read_dot11MeshMaxRetries 3 12756 NULL
-+hpsb_iso_common_init_45525 hpsb_iso_common_init 4 45525 NULL
-+proc_scsi_write_29142 proc_scsi_write 3 29142 NULL
-+reshape_ring_29147 reshape_ring 2 29147 NULL
-+cgroup_read_u64_45532 cgroup_read_u64 5 45532 NULL
-+au0828_init_isoc_61917 au0828_init_isoc 2-3 61917 NULL
-+copy_macs_45534 copy_macs 4 45534 NULL
-+sctp_sendmsg_61919 sctp_sendmsg 4 61919 NULL
-+listxattr_12769 listxattr 3 12769 NULL
-+wdm_write_53735 wdm_write 3 53735 NULL
-+snd_rme9652_playback_copy_20970 snd_rme9652_playback_copy 5 20970 NULL
-+send_bulk_static_data_61932 send_bulk_static_data 3 61932 NULL
-+mempool_create_29437 mempool_create 1 29437 NULL
-+sock_alloc_send_pskb_21246 sock_alloc_send_pskb 2 21246 NULL
-+stats_dot11ACKFailureCount_read_45558 stats_dot11ACKFailureCount_read 3 45558 NULL
-+venus_rmdir_45564 venus_rmdir 4 45564 NULL
-+scsi_adjust_queue_depth_12802 scsi_adjust_queue_depth 3 12802 NULL
-+__copy_from_user_inatomic_nocache_49921 __copy_from_user_inatomic_nocache 3 49921 NULL
-+xfs_inumbers_fmt_12817 xfs_inumbers_fmt 3 12817 NULL
-+ipath_create_cq_45586 ipath_create_cq 2 45586 NULL
-+wusb_prf_256_29203 wusb_prf_256 7 29203 NULL
-+rdma_set_ib_paths_45592 rdma_set_ib_paths 3 45592 NULL
-+iwl_dbgfs_tx_queue_read_4635 iwl_dbgfs_tx_queue_read 3 4635 NULL
-+rds_iw_inc_copy_to_user_29214 rds_iw_inc_copy_to_user 3 29214 NULL
-+sys_getxattr_37418 sys_getxattr 4 37418 NULL
-+hci_sock_sendmsg_37420 hci_sock_sendmsg 4 37420 NULL
-+bnx2i_send_nl_mesg_48562 bnx2i_send_nl_mesg 4 48562 NULL
-+spidev_ioctl_12846 spidev_ioctl 2 12846 NULL
-+audit_log_n_hex_45617 audit_log_n_hex 3 45617 NULL
-+devm_ioremap_29235 devm_ioremap 3-2 29235 NULL nohasharray
-+squashfs_read_table_29235 squashfs_read_table 4 29235 &devm_ioremap_29235
-+lbs_threshold_read_21046 lbs_threshold_read 5 21046 NULL
-+xfs_iext_insert_53815 xfs_iext_insert 3 53815 NULL
-+saa_write_45625 saa_write 3 45625 NULL
-+security_context_to_sid_core_29248 security_context_to_sid_core 2 29248 NULL
-+node_read_45634 node_read 4 45634 NULL
-+jffs2_do_unlink_62020 jffs2_do_unlink 4 62020 NULL
-+mempool_kmalloc_53831 mempool_kmalloc 2 53831 NULL
-+cx18_read_pos_4683 cx18_read_pos 3 4683 NULL
-+gru_alloc_gts_37453 gru_alloc_gts 2-3 37453 NULL
-+short_retry_limit_read_4687 short_retry_limit_read 3 4687 NULL
-+pmcraid_build_passthrough_ioadls_62034 pmcraid_build_passthrough_ioadls 2 62034 NULL
-+videobuf_pages_to_sg_53849 videobuf_pages_to_sg 2 53849 NULL
-+event_calibration_read_21083 event_calibration_read 3 21083 NULL
-+acpi_thermal_write_polling_45660 acpi_thermal_write_polling 3 45660 NULL
-+prism2_set_genericelement_29277 prism2_set_genericelement 3 29277 NULL
-+sctp_user_addto_chunk_62047 sctp_user_addto_chunk 2-3 62047 NULL
-+compat_mpctl_ioctl_45671 compat_mpctl_ioctl 2 45671 NULL
-+iscsi_change_queue_depth_37480 iscsi_change_queue_depth 2 37480 NULL
-+do_pselect_62061 do_pselect 1 62061 NULL
-+btmrvl_gpiogap_read_4718 btmrvl_gpiogap_read 3 4718 NULL
-+dgram_sendmsg_45679 dgram_sendmsg 4 45679 NULL
-+kmem_realloc_37489 kmem_realloc 2 37489 NULL
-+ati_create_gatt_pages_4722 ati_create_gatt_pages 1 4722 NULL nohasharray
-+show_header_4722 show_header 3 4722 &ati_create_gatt_pages_4722
-+groups_alloc_7614 groups_alloc 1 7614 NULL
-+sn9c102_read_29305 sn9c102_read 3 29305 NULL
-+pcpu_alloc_bootmem_62074 pcpu_alloc_bootmem 2 62074 NULL
-+smk_write_ambient_45691 smk_write_ambient 3 45691 NULL
-+ci_ll_init_12930 ci_ll_init 3 12930 NULL
-+unix_dgram_sendmsg_45699 unix_dgram_sendmsg 4 45699 NULL
-+sg_proc_write_adio_45704 sg_proc_write_adio 3 45704 NULL
-+vmalloc_32_user_37519 vmalloc_32_user 1 37519 NULL
-+proc_file_read_53905 proc_file_read 3 53905 NULL
-+dvb_ca_en50221_init_45718 dvb_ca_en50221_init 4 45718 NULL
-+__alloc_ei_netdev_29338 __alloc_ei_netdev 1 29338 NULL
-+new_skb_21148 new_skb 1 21148 NULL
-+bcsp_prepare_pkt_12961 bcsp_prepare_pkt 3 12961 NULL
-+l2cap_sock_setsockopt_old_29346 l2cap_sock_setsockopt_old 4 29346 NULL
-+bm_status_write_12964 bm_status_write 3 12964 NULL
-+ttm_agp_populate_11718 ttm_agp_populate 2 11718 NULL
-+snd_cs46xx_io_read_45734 snd_cs46xx_io_read 5-6 45734 NULL
-+usb_serial_generic_write_53927 usb_serial_generic_write 4 53927 NULL
-+cxgb_alloc_mem_24007 cxgb_alloc_mem 1 24007 NULL
-+rw_copy_check_uvector_45748 rw_copy_check_uvector 3 45748 NULL
-+stats_retry_count_read_21177 stats_retry_count_read 3 21177 NULL
-+sctp_make_chunk_12986 sctp_make_chunk 4 12986 NULL
-+acpi_tb_install_table_12988 acpi_tb_install_table 1 12988 NULL
-+tracing_mark_write_62143 tracing_mark_write 3 62143 NULL
-+mthca_setup_cmd_doorbells_53954 mthca_setup_cmd_doorbells 2 53954 NULL
-+ncp__vol2io_4804 ncp__vol2io 5 4804 NULL
-+iwl_tx_queue_init_4807 iwl_tx_queue_init 3 4807 NULL
-+hpsb_node_read_53963 hpsb_node_read 4 53963 NULL
-+cx18_v4l2_read_21196 cx18_v4l2_read 3 21196 NULL
-+mangle_rfc959_packet_21197 mangle_rfc959_packet 5 21197 NULL
-+alloc_ts_config_45775 alloc_ts_config 1 45775 NULL
-+idetape_chrdev_write_53976 idetape_chrdev_write 3 53976 NULL
-+subsystem_filter_write_13022 subsystem_filter_write 3 13022 NULL
-+raw_setsockopt_45800 raw_setsockopt 5 45800 NULL
-+alloc_upcall_62186 alloc_upcall 2 62186 NULL
-+lbs_rdbbp_read_45805 lbs_rdbbp_read 3 45805 NULL
-+NCR_700_change_queue_depth_45806 NCR_700_change_queue_depth 2 45806 NULL
-+cifs_user_write_29424 cifs_user_write 3 29424 NULL
-+ubi_eba_atomic_leb_change_13041 ubi_eba_atomic_leb_change 5 13041 NULL
-+pcpu_alloc_alloc_info_45813 pcpu_alloc_alloc_info 1-2 45813 NULL
-+input_ff_create_21240 input_ff_create 2 21240 NULL
-+sock_kmalloc_62205 sock_kmalloc 2 62205 NULL
-+key_tx_spec_read_4862 key_tx_spec_read 3 4862 NULL
-+__dn_setsockopt_13060 __dn_setsockopt 5 13060 NULL
-+alloc_fd_37637 alloc_fd 1 37637 NULL
-+hid_register_field_4874 hid_register_field 2-3 4874 NULL
-+tcp_dma_try_early_copy_37651 tcp_dma_try_early_copy 3 37651 NULL
-+ipxrtr_route_packet_54036 ipxrtr_route_packet 4 54036 NULL
-+vga_arb_read_4886 vga_arb_read 3 4886 NULL
-+sys_ipc_4889 sys_ipc 3 4889 NULL
-+bio_copy_user_iov_37660 bio_copy_user_iov 4 37660 NULL
-+rfcomm_sock_sendmsg_37661 rfcomm_sock_sendmsg 4 37661 NULL
-+arm_write_29476 arm_write 6 29476 NULL
-+isdn_write_45863 isdn_write 3 45863 NULL
-+send_control_msg_62261 send_control_msg 5 62261 NULL
-+snd_rme96_playback_copy_13111 snd_rme96_playback_copy 5 13111 NULL
-+get_rdac_req_45882 get_rdac_req 3 45882 NULL
-+store_cpufv_disabled_43809 store_cpufv_disabled 4 43809 NULL
-+btmrvl_pscmd_write_29504 btmrvl_pscmd_write 3 29504 NULL
-+ntfs_rl_insert_4931 ntfs_rl_insert 2-4 4931 NULL
-+ata_scsi_change_queue_depth_37702 ata_scsi_change_queue_depth 2 37702 NULL
-+iwl_dbgfs_led_read_45896 iwl_dbgfs_led_read 3 45896 NULL
-+ftrace_profile_read_21327 ftrace_profile_read 3 21327 NULL
-+mon_bin_ioctl_21336 mon_bin_ioctl 4 21336 NULL
-+sta_last_qual_read_62297 sta_last_qual_read 3 62297 NULL
-+create_xattr_54106 create_xattr 5 54106 NULL
-+udplite_getfrag_14479 udplite_getfrag 3-4 14479 NULL
-+tomoyo_alloc_37728 tomoyo_alloc 1 37728 NULL
-+devm_kzalloc_4966 devm_kzalloc 2 4966 NULL
-+compat_rawv6_setsockopt_4967 compat_rawv6_setsockopt 5 4967 NULL
-+udf_sb_alloc_partition_maps_62313 udf_sb_alloc_partition_maps 2 62313 NULL
-+alloc_mr_45935 alloc_mr 1 45935 NULL
-+read_enabled_file_bool_37744 read_enabled_file_bool 3 37744 NULL
-+hfcpci_empty_bfifo_62323 hfcpci_empty_bfifo 4 62323 NULL
-+ocfs2_control_cfu_37750 ocfs2_control_cfu 2 37750 NULL
-+isr_host_acknowledges_read_54136 isr_host_acknowledges_read 3 54136 NULL
-+idetape_queue_rw_tail_29562 idetape_queue_rw_tail 3 29562 NULL
-+alloc_orinocodev_21371 alloc_orinocodev 1 21371 NULL
-+handle_eviocgbit_4991 handle_eviocgbit 2 4991 NULL
-+ds_ioctl_45954 ds_ioctl 3 45954 NULL
-+lbs_lowsnr_read_29571 lbs_lowsnr_read 3 29571 NULL
-+dccp_setsockopt_cscov_37766 dccp_setsockopt_cscov 2 37766 NULL
-+asn1_oid_decode_4999 asn1_oid_decode 2 4999 NULL
-+flash_write_62354 flash_write 3 62354 NULL
-+rb_simple_read_45972 rb_simple_read 3 45972 NULL
-+mmc_ext_csd_read_13205 mmc_ext_csd_read 3 13205 NULL
-+memcpy_toiovec_54166 memcpy_toiovec 3 54166 NULL
-+ezusb_writememory_45976 ezusb_writememory 4 45976 NULL
-+acpi_os_read_memory_54186 acpi_os_read_memory 3-1 54186 NULL
-+smk_read_logging_37804 smk_read_logging 3 37804 NULL
-+store_bluetooth_21320 store_bluetooth 4 21320 NULL
-+cru_detect_11272 cru_detect 1 11272 NULL
-+asix_read_cmd_13245 asix_read_cmd 5 13245 NULL
-+init_tid_tabs_13252 init_tid_tabs 2-4-3 13252 NULL
-+concat_writev_21451 concat_writev 3 21451 NULL
-+sierra_setup_urb_46029 sierra_setup_urb 5 46029 NULL
-+__register_chrdev_54223 __register_chrdev 2-3 54223 NULL
-+sta_rx_bytes_read_46037 sta_rx_bytes_read 3 46037 NULL
-+sctp_make_abort_user_29654 sctp_make_abort_user 3 29654 NULL
-+snd_midi_channel_alloc_set_28153 snd_midi_channel_alloc_set 1 28153 NULL
-+snd_mixart_BA1_read_5082 snd_mixart_BA1_read 5-6 5082 NULL
-+o2hb_debug_read_37851 o2hb_debug_read 3 37851 NULL
-+udplite_manip_pkt_62433 udplite_manip_pkt 2 62433 NULL
-+netdev_alloc_skb_62437 netdev_alloc_skb 2 62437 NULL
-+fwnet_receive_packet_46054 fwnet_receive_packet 10 46054 NULL
-+vring_add_buf_36348 vring_add_buf 3-4 36348 NULL
-+new_lockspace_29674 new_lockspace 2 29674 NULL
-+pn_recvmsg_30887 pn_recvmsg 4 30887 NULL
-+dma_tx_errors_read_46060 dma_tx_errors_read 3 46060 NULL
-+sound_write_5102 sound_write 3 5102 NULL
-+read_file_xmit_21487 read_file_xmit 3 21487 NULL
-+wusb_prf_54261 wusb_prf 7 54261 NULL nohasharray
-+audio_write_54261 audio_write 4 54261 &wusb_prf_54261
-+ssb_bus_ssbbus_register_2217 ssb_bus_ssbbus_register 2 2217 NULL
-+sys_setxattr_37880 sys_setxattr 4 37880 NULL
-+dvb_net_sec_37884 dvb_net_sec 3 37884 NULL
-+sel_commit_bools_write_46077 sel_commit_bools_write 3 46077 NULL
-+ps_pspoll_timeouts_read_11776 ps_pspoll_timeouts_read 3 11776 NULL
-+sta_last_noise_read_62466 sta_last_noise_read 3 62466 NULL
-+dbg_leb_change_19969 dbg_leb_change 4 19969 NULL
-+nf_nat_mangle_udp_packet_13321 nf_nat_mangle_udp_packet 5-7 13321 NULL
-+dma_skb_copy_datagram_iovec_21516 dma_skb_copy_datagram_iovec 3-5 21516 NULL
-+ata_host_alloc_46094 ata_host_alloc 2 46094 NULL
-+us122l_ctl_msg_13330 us122l_ctl_msg 8 13330 NULL
-+dlm_alloc_pagevec_54296 dlm_alloc_pagevec 1 54296 NULL
-+sysprof_sample_write_62489 sysprof_sample_write 3 62489 NULL
-+skb_copy_expand_7685 skb_copy_expand 2-3 7685 NULL nohasharray
-+acpi_ex_allocate_name_string_7685 acpi_ex_allocate_name_string 2-1 7685 &skb_copy_expand_7685
-+mlx4_en_create_rx_ring_62498 mlx4_en_create_rx_ring 3 62498 NULL
-+emi62_writememory_29731 emi62_writememory 4 29731 NULL
-+mlx4_ib_alloc_fast_reg_page_list_46119 mlx4_ib_alloc_fast_reg_page_list 2 46119 NULL
-+pkt_alloc_packet_data_37928 pkt_alloc_packet_data 1 37928 NULL
-+rxrpc_send_data_21553 rxrpc_send_data 5 21553 NULL
-+iwl_dbgfs_status_read_5171 iwl_dbgfs_status_read 3 5171 NULL
-+pn_raw_send_54330 pn_raw_send 2 54330 NULL
-+pep_sendmsg_62524 pep_sendmsg 4 62524 NULL
-+megaraid_change_queue_depth_13375 megaraid_change_queue_depth 2 13375 NULL
-+iso_sched_alloc_13377 iso_sched_alloc 1 13377 NULL nohasharray
-+wep_key_not_found_read_13377 wep_key_not_found_read 3 13377 &iso_sched_alloc_13377
-+ar9170_handle_mpdu_37956 ar9170_handle_mpdu 3 37956 NULL
-+cxio_hal_init_resource_29771 cxio_hal_init_resource 2-7-6 29771 NULL
-+__netlink_change_ngroups_46156 __netlink_change_ngroups 2 46156 NULL
-+sco_sock_sendmsg_62542 sco_sock_sendmsg 4 62542 NULL
-+_osd_realloc_seg_54352 _osd_realloc_seg 3 54352 NULL
-+visor_write_37975 visor_write 4 37975 NULL
-+tcf_hash_create_54360 tcf_hash_create 4 54360 NULL
-+ppp_cp_parse_cr_5214 ppp_cp_parse_cr 4 5214 NULL
-+snd_emu10k1_synth_copy_from_user_9061 snd_emu10k1_synth_copy_from_user 3-5 9061 NULL
-+vfs_readlink_54368 vfs_readlink 3 54368 NULL
-+pep_recvmsg_19402 pep_recvmsg 4 19402 NULL
-+ocfs2_acl_from_xattr_21604 ocfs2_acl_from_xattr 2 21604 NULL
-+subsystem_filter_read_62310 subsystem_filter_read 3 62310 NULL
-+vxge_os_dma_malloc_46184 vxge_os_dma_malloc 2 46184 NULL
-+do_dccp_setsockopt_54377 do_dccp_setsockopt 5 54377 NULL
-+ssb_ioremap_5228 ssb_ioremap 2 5228 NULL
-+xfrm_user_policy_62573 xfrm_user_policy 4 62573 NULL
-+xlog_do_recovery_pass_21618 xlog_do_recovery_pass 3 21618 NULL
-+snd_pcm_oss_read2_54387 snd_pcm_oss_read2 3 54387 NULL
-+isdn_ppp_skb_push_5236 isdn_ppp_skb_push 2 5236 NULL
-+vfs_readv_38011 vfs_readv 3 38011 NULL
-+keyring_read_13438 keyring_read 3 13438 NULL
-+sctp_setsockopt_peer_primary_addr_13440 sctp_setsockopt_peer_primary_addr 3 13440 NULL
-+compat_sys_semtimedop_3606 compat_sys_semtimedop 3 3606 NULL
-+tcp_update_scoreboard_21639 tcp_update_scoreboard 2 21639 NULL
-+dsp_write_46218 dsp_write 2 46218 NULL
-+prism2_send_mgmt_62605 prism2_send_mgmt 4 62605 NULL nohasharray
-+nfsd_vfs_read_62605 nfsd_vfs_read 6 62605 &prism2_send_mgmt_62605
-+store_wlan_38040 store_wlan 4 38040 NULL
-+dev_write_7708 dev_write 3 7708 NULL
-+nsm_create_handle_38060 nsm_create_handle 4 38060 NULL
-+atalk_sendmsg_21677 atalk_sendmsg 4 21677 NULL
-+ipv6_setsockopt_29871 ipv6_setsockopt 5 29871 NULL
-+sisusb_copy_memory_35016 sisusb_copy_memory 4 35016 NULL
-+tomoyo_read_control_21682 tomoyo_read_control 3 21682 NULL
-+lpfc_sli4_queue_alloc_62646 lpfc_sli4_queue_alloc 3 62646 NULL
-+alloc_ltalkdev_38071 alloc_ltalkdev 1 38071 NULL
-+evdev_ioctl_handler_21705 evdev_ioctl_handler 2 21705 NULL
-+request_key_auth_new_38092 request_key_auth_new 3 38092 NULL
-+drm_sman_init_21710 drm_sman_init 2 21710 NULL
-+tracing_trace_options_read_51405 tracing_trace_options_read 3 51405 NULL
-+ipath_cdev_init_37752 ipath_cdev_init 1 37752 NULL
-+sctp_tsnmap_mark_13527 sctp_tsnmap_mark 2 13527 NULL
-+bm_init_13529 bm_init 2 13529 NULL
-+check586_29914 check586 2 29914 NULL
-+snd_pcm_oss_write_38108 snd_pcm_oss_write 3 38108 NULL
-+printer_req_alloc_62687 printer_req_alloc 2 62687 NULL nohasharray
-+iwl_dbgfs_rx_statistics_read_62687 iwl_dbgfs_rx_statistics_read 3 62687 &printer_req_alloc_62687
-+ccid3_hc_rx_getsockopt_62331 ccid3_hc_rx_getsockopt 3 62331 NULL
-+reiserfs_allocate_list_bitmaps_21732 reiserfs_allocate_list_bitmaps 3 21732 NULL
-+ioremap_wc_62695 ioremap_wc 2-1 62695 NULL
-+pg_read_17276 pg_read 3 17276 NULL
-+l2cap_create_basic_pdu_54508 l2cap_create_basic_pdu 3 54508 NULL
-+ps_pspoll_utilization_read_5361 ps_pspoll_utilization_read 3 5361 NULL
-+cgroup_write_X64_54514 cgroup_write_X64 5 54514 NULL
-+rxpipe_descr_host_int_trig_rx_data_read_22001 rxpipe_descr_host_int_trig_rx_data_read 3 22001 NULL
-+bioset_integrity_create_62708 bioset_integrity_create 2 62708 NULL
-+__hwahc_dev_set_key_46328 __hwahc_dev_set_key 5 46328 NULL
-+mthca_alloc_init_21754 mthca_alloc_init 2 21754 NULL
-+l2down_create_21755 l2down_create 4 21755 NULL
-+csr1212_rom_cache_malloc_46339 csr1212_rom_cache_malloc 2 46339 NULL
-+__ntfs_copy_from_user_iovec_inatomic_38153 __ntfs_copy_from_user_iovec_inatomic 3-4 38153 NULL
-+aem_read_sensor_21770 aem_read_sensor 5 21770 NULL
-+gen_pool_add_21776 gen_pool_add 3 21776 NULL
-+squashfs_read_id_index_table_5394 squashfs_read_id_index_table 3 5394 NULL
-+iwl_dbgfs_chain_noise_read_46355 iwl_dbgfs_chain_noise_read 3 46355 NULL
-+cache_write_13589 cache_write 3 13589 NULL
-+mpt_lan_receive_post_turbo_13592 mpt_lan_receive_post_turbo 2 13592 NULL
-+key_replays_read_62746 key_replays_read 3 62746 NULL
-+smk_write_direct_46363 smk_write_direct 3 46363 NULL
-+aac_sa_ioremap_13596 aac_sa_ioremap 2 13596 NULL nohasharray
-+irias_new_octseq_value_13596 irias_new_octseq_value 2 13596 &aac_sa_ioremap_13596
-+irias_add_octseq_attrib_29983 irias_add_octseq_attrib 4 29983 NULL
-+cdev_add_38176 cdev_add 2-3 38176 NULL
-+__ioremap_caller_21800 __ioremap_caller 2-1 21800 NULL
-+swap_cgroup_swapon_13614 swap_cgroup_swapon 2 13614 NULL
-+nfsd_vfs_write_54577 nfsd_vfs_write 6 54577 NULL
-+ax25_sendmsg_62770 ax25_sendmsg 4 62770 NULL
-+rt2x00debug_write_rf_38195 rt2x00debug_write_rf 3 38195 NULL
-+stats_frame_duplicate_count_read_54582 stats_frame_duplicate_count_read 3 54582 NULL nohasharray
-+fw_iso_buffer_init_54582 fw_iso_buffer_init 3 54582 &stats_frame_duplicate_count_read_54582
-+get_ucode_user_38202 get_ucode_user 3 38202 NULL
-+acpi_system_debug_proc_write_43231 acpi_system_debug_proc_write 3 43231 NULL
-+fuse_file_aio_write_46399 fuse_file_aio_write 4 46399 NULL
-+packet_snd_13634 packet_snd 3 13634 NULL
-+osd_req_list_partition_collections_38223 osd_req_list_partition_collections 5 38223 NULL
-+sfi_map_table_5462 sfi_map_table 1 5462 NULL
-+xfs_efd_init_5463 xfs_efd_init 3 5463 NULL
-+scsi_vpd_inquiry_30040 scsi_vpd_inquiry 4 30040 NULL
-+inet_csk_listen_start_38233 inet_csk_listen_start 2 38233 NULL
-+cache_downcall_13666 cache_downcall 3 13666 NULL
-+xfs_efi_init_5476 xfs_efi_init 2 5476 NULL
-+mtrr_write_59622 mtrr_write 3 59622 NULL
-+acpi_tb_check_xsdt_21862 acpi_tb_check_xsdt 1 21862 NULL
-+ip_nat_sdp_media_60740 ip_nat_sdp_media 7 60740 NULL
-+cifs_security_flags_proc_write_5484 cifs_security_flags_proc_write 3 5484 NULL
-+cp210x_set_config_46447 cp210x_set_config 4 46447 NULL
-+cnic_init_id_tbl_21872 cnic_init_id_tbl 2 21872 NULL
-+sisusbcon_bmove_21873 sisusbcon_bmove 5-7-6 21873 NULL
-+tty_write_5494 tty_write 3 5494 NULL
-+rx_fcs_err_read_62844 rx_fcs_err_read 3 62844 NULL
-+proc_write_lcd_30077 proc_write_lcd 3 30077 NULL
-+teiup_create_43201 teiup_create 3 43201 NULL
-+filldir64_46469 filldir64 3 46469 NULL
-+snd_midi_channel_init_set_30092 snd_midi_channel_init_set 1 30092 NULL
-+spidev_message_5518 spidev_message 3 5518 NULL
-+vmemmap_alloc_block_43245 vmemmap_alloc_block 1 43245 NULL
-+bio_kmalloc_54672 bio_kmalloc 2 54672 NULL
-+event_format_read_54674 event_format_read 3 54674 NULL
-+nfs_writedata_alloc_62868 nfs_writedata_alloc 1 62868 NULL
-+zd_mac_rx_38296 zd_mac_rx 3 38296 NULL
-+dv1394_read_21920 dv1394_read 3 21920 NULL
-+aoechr_write_62883 aoechr_write 3 62883 NULL
-+resize_info_buffer_62889 resize_info_buffer 2 62889 NULL
-+if_spi_host_to_card_62890 if_spi_host_to_card 4 62890 NULL
-+addtgt_54703 addtgt 3 54703 NULL
-+mthca_alloc_cq_buf_46512 mthca_alloc_cq_buf 3 46512 NULL
-+audit_unpack_string_13748 audit_unpack_string 3 13748 NULL
-+isr_rx_headers_read_38325 isr_rx_headers_read 3 38325 NULL
-+rfkill_fop_read_54711 rfkill_fop_read 3 54711 NULL
-+recv_stream_30138 recv_stream 4 30138 NULL
-+mempool_create_slab_pool_62907 mempool_create_slab_pool 1 62907 NULL
-+getdqbuf_62908 getdqbuf 1 62908 NULL
-+bdx_rxdb_create_46525 bdx_rxdb_create 1 46525 NULL
-+bioset_create_5580 bioset_create 1 5580 NULL
-+ocfs2_control_write_54737 ocfs2_control_write 3 54737 NULL
-+fb_sys_read_13778 fb_sys_read 3 13778 NULL
-+kzalloc_54740 kzalloc 1 54740 NULL
-+ipath_reg_phys_mr_23918 ipath_reg_phys_mr 3 23918 NULL
-+do_msgrcv_5590 do_msgrcv 4 5590 NULL
-+wep_iv_read_54744 wep_iv_read 3 54744 NULL
-+stats_tx_status_drop_read_10279 stats_tx_status_drop_read 3 10279 NULL
-+arm_read_46556 arm_read 5 46556 NULL
-+agp_create_user_memory_62955 agp_create_user_memory 1 62955 NULL
-+sctp_sf_abort_violation_38380 sctp_sf_abort_violation 6 38380 NULL
-+mempool_create_page_pool_30189 mempool_create_page_pool 1 30189 NULL
-+nf_nat_mangle_tcp_packet_8643 nf_nat_mangle_tcp_packet 5-7 8643 NULL
-+sock_setsockopt_50088 sock_setsockopt 5 50088 NULL
-+dn_sendmsg_38390 dn_sendmsg 4 38390 NULL
-+random_read_13815 random_read 3 13815 NULL
-+usblp_ioctl_30203 usblp_ioctl 2 30203 NULL
-+stats_multicast_transmitted_frame_count_read_54788 stats_multicast_transmitted_frame_count_read 3 54788 NULL
-+_send_control_msg_46598 _send_control_msg 6 46598 NULL
-+flexcop_device_kmalloc_54793 flexcop_device_kmalloc 1 54793 NULL
-+snd_ac97_pcm_assign_30218 snd_ac97_pcm_assign 2 30218 NULL
-+ti_recv_22027 ti_recv 4 22027 NULL
-+iwm_wdev_alloc_38415 iwm_wdev_alloc 1 38415 NULL
-+ieee80211_if_read_dtim_count_38419 ieee80211_if_read_dtim_count 3 38419 NULL
-+dccp_manip_pkt_30229 dccp_manip_pkt 2 30229 NULL
-+parse_arg_5657 parse_arg 2 5657 NULL
-+evdev_ioctl_compat_13851 evdev_ioctl_compat 2 13851 NULL
-+pcnet32_realloc_tx_ring_38428 pcnet32_realloc_tx_ring 3 38428 NULL
-+aes_decrypt_fail_read_54815 aes_decrypt_fail_read 3 54815 NULL
-+request_key_async_with_auxdata_46624 request_key_async_with_auxdata 4 46624 NULL
-+zd_usb_read_fw_22049 zd_usb_read_fw 4 22049 NULL
-+atalk_recvmsg_22053 atalk_recvmsg 4 22053 NULL
-+ip_send_reply_46635 ip_send_reply 4 46635 NULL
-+compat_ip_setsockopt_13870 compat_ip_setsockopt 5 13870 NULL
-+generic_perform_write_54832 generic_perform_write 3 54832 NULL
-+write_rio_54837 write_rio 3 54837 NULL
-+rawv6_recvmsg_30265 rawv6_recvmsg 4 30265 NULL
-+gigaset_write_cmd_5693 gigaset_write_cmd 3 5693 NULL
-+edac_mc_alloc_54846 edac_mc_alloc 1 54846 NULL
-+isr_pci_pm_read_30271 isr_pci_pm_read 3 30271 NULL
-+scsi_host_alloc_63041 scsi_host_alloc 2 63041 NULL
-+printer_read_54851 printer_read 3 54851 NULL
-+alloc_ep_req_54860 alloc_ep_req 2 54860 NULL
-+sctp_getsockopt_default_send_param_63056 sctp_getsockopt_default_send_param 2 63056 NULL
-+unlink1_63059 unlink1 3 63059 NULL
-+qla2x00_get_ctx_sp_13912 qla2x00_get_ctx_sp 3 13912 NULL
-+tracing_saved_cmdlines_read_21434 tracing_saved_cmdlines_read 3 21434 NULL
-+dispatch_ioctl_32357 dispatch_ioctl 2 32357 NULL
-+replay_log_leb_18704 replay_log_leb 3 18704 NULL
-+alloc_data_packet_46698 alloc_data_packet 1 46698 NULL
-+ath_descdma_setup_22128 ath_descdma_setup 5 22128 NULL
-+sysctl_string_13937 sysctl_string 5 13937 NULL
-+get_packet_5747 get_packet 3 5747 NULL
-+event_rx_mismatch_read_38518 event_rx_mismatch_read 3 38518 NULL
-+ieee80211_if_read_min_discovery_timeout_13946 ieee80211_if_read_min_discovery_timeout 3 13946 NULL
-+wep_decrypt_fail_read_58567 wep_decrypt_fail_read 3 58567 NULL
-+iscsi_pool_init_54913 iscsi_pool_init 2-4 54913 NULL
-+iwl_dbgfs_sensitivity_read_63116 iwl_dbgfs_sensitivity_read 3 63116 NULL
-+sctp_setsockopt_autoclose_5775 sctp_setsockopt_autoclose 3 5775 NULL
-+com90xx_found_13974 com90xx_found 3 13974 NULL
-+compat_sys_writev_5784 compat_sys_writev 3 5784 NULL
-+qcam_read_13977 qcam_read 3 13977 NULL
-+__vxge_hw_blockpool_malloc_5786 __vxge_hw_blockpool_malloc 2 5786 NULL
-+dvb_demux_read_13981 dvb_demux_read 3 13981 NULL
-+ib_send_cm_rtu_63138 ib_send_cm_rtu 3 63138 NULL
-+irda_sendmsg_dgram_38563 irda_sendmsg_dgram 4 38563 NULL
-+ieee80211_bss_info_update_13991 ieee80211_bss_info_update 4 13991 NULL
-+sys_get_mempolicy_30379 sys_get_mempolicy 3 30379 NULL
-+skb_copy_datagram_iovec_5806 skb_copy_datagram_iovec 2-4 5806 NULL
-+trace_options_core_read_47390 trace_options_core_read 3 47390 NULL
-+c4_add_card_54968 c4_add_card 3 54968 NULL
-+__proc_file_read_54978 __proc_file_read 3 54978 NULL
-+_queue_data_54983 _queue_data 4 54983 NULL
-+smb_alloc_request_46798 smb_alloc_request 2 46798 NULL
-+rfcomm_sock_recvmsg_22227 rfcomm_sock_recvmsg 4 22227 NULL
-+setup_req_5848 setup_req 3 5848 NULL
-+rds_ib_inc_copy_to_user_55007 rds_ib_inc_copy_to_user 3 55007 NULL
-+icn_writecmd_38629 icn_writecmd 2 38629 NULL
-+xfs_iroot_realloc_46826 xfs_iroot_realloc 2 46826 NULL
-+audit_init_entry_38644 audit_init_entry 1 38644 NULL
-+dvb_dvr_do_ioctl_46839 dvb_dvr_do_ioctl 4 46839 NULL
-+enable_write_30456 enable_write 3 30456 NULL
-+urandom_read_30462 urandom_read 3 30462 NULL
-+mmc_send_cxd_data_38655 mmc_send_cxd_data 5 38655 NULL
-+module_alloc_update_bounds_rw_63233 module_alloc_update_bounds_rw 1 63233 NULL
-+smctr_process_rx_packet_13270 smctr_process_rx_packet 2 13270 NULL
-+do_proc_readlink_14096 do_proc_readlink 3 14096 NULL
-+write_head_30481 write_head 4 30481 NULL
-+adu_write_30487 adu_write 3 30487 NULL
-+compat_sys_pselect6_14105 compat_sys_pselect6 1 14105 NULL
-+__netdev_alloc_skb_ip_align_55067 __netdev_alloc_skb_ip_align 2 55067 NULL
-+mesh_table_alloc_22305 mesh_table_alloc 1 22305 NULL
-+stats_rx_handlers_queued_read_5922 stats_rx_handlers_queued_read 3 5922 NULL nohasharray
-+ttm_bo_kmap_ttm_5922 ttm_bo_kmap_ttm 3 5922 &stats_rx_handlers_queued_read_5922
-+iscsi_iser_recv_41948 iscsi_iser_recv 4 41948 NULL
-+fcp_request_22315 fcp_request 6 22315 NULL
-+udpv6_sendmsg_22316 udpv6_sendmsg 4 22316 NULL
-+stats_tx_handlers_drop_unencrypted_read_46898 stats_tx_handlers_drop_unencrypted_read 3 46898 NULL
-+edac_device_alloc_ctl_info_5941 edac_device_alloc_ctl_info 1 5941 NULL
-+ntfs_rl_replace_14136 ntfs_rl_replace 2-4 14136 NULL
-+init_kstat_irqs_18740 init_kstat_irqs 3 18740 NULL
-+tcp_collapse_63294 tcp_collapse 5-6 63294 NULL
-+isdn_ppp_ccp_xmit_reset_63297 isdn_ppp_ccp_xmit_reset 6 63297 NULL
-+rxpipe_beacon_buffer_thres_host_int_trig_rx_data_read_55106 rxpipe_beacon_buffer_thres_host_int_trig_rx_data_read 3 55106 NULL
-+tipc_subseq_alloc_5957 tipc_subseq_alloc 1 5957 NULL
-+tracing_ctrl_read_46922 tracing_ctrl_read 3 46922 NULL
-+fb_write_46924 fb_write 3 46924 NULL
-+dns_resolver_instantiate_63314 dns_resolver_instantiate 3 63314 NULL
-+alloc_candev_22356 alloc_candev 1 22356 NULL
-+btmrvl_curpsmode_read_46939 btmrvl_curpsmode_read 3 46939 NULL
-+crypto_ahash_setkey_55134 crypto_ahash_setkey 3 55134 NULL
-+hdlcdev_rx_997 hdlcdev_rx 3 997 NULL
-+filldir_55137 filldir 3 55137 NULL
-+evdev_ioctl_22371 evdev_ioctl 2 22371 NULL
-+__sctp_setsockopt_connectx_46949 __sctp_setsockopt_connectx 3 46949 NULL
-+do_sysctl_28306 do_sysctl 6 28306 NULL
-+proc_info_read_63344 proc_info_read 3 63344 NULL
-+sysctl_data_55157 sysctl_data 5 55157 NULL
-+platform_device_add_resources_13289 platform_device_add_resources 3 13289 NULL
-+tcp_manip_pkt_14202 tcp_manip_pkt 2 14202 NULL
-+iwl_dbgfs_thermal_throttling_read_38779 iwl_dbgfs_thermal_throttling_read 3 38779 NULL
-+ubifs_leb_change_22399 ubifs_leb_change 4 22399 NULL
-+snd_gus_dram_write_38784 snd_gus_dram_write 4 38784 NULL
-+gre_manip_pkt_38785 gre_manip_pkt 2 38785 NULL
-+ps_upsd_max_sptime_read_63362 ps_upsd_max_sptime_read 3 63362 NULL
-+zoran_write_22404 zoran_write 3 22404 NULL
-+sctp_getsockopt_peer_addr_info_6024 sctp_getsockopt_peer_addr_info 2 6024 NULL
-+xfs_dir2_block_to_sf_37868 xfs_dir2_block_to_sf 3 37868 NULL
-+idmouse_read_63374 idmouse_read 3 63374 NULL
-+sgl_map_user_pages_30610 sgl_map_user_pages 2 30610 NULL
-+sel_write_bool_46996 sel_write_bool 3 46996 NULL
-+ntfs_rl_append_6037 ntfs_rl_append 2-4 6037 NULL
-+ttm_bo_io_47000 ttm_bo_io 5 47000 NULL
-+sel_write_relabel_55195 sel_write_relabel 3 55195 NULL
-+blk_rq_map_kern_47004 blk_rq_map_kern 4 47004 NULL
-+ipv6_renew_option_38813 ipv6_renew_option 3 38813 NULL
-+sched_feat_write_55202 sched_feat_write 3 55202 NULL
-+dma_declare_coherent_memory_14244 dma_declare_coherent_memory 4-2 14244 NULL
-+ht40allow_map_read_55209 ht40allow_map_read 3 55209 NULL nohasharray
-+isdn_net_ciscohdlck_alloc_skb_55209 isdn_net_ciscohdlck_alloc_skb 2 55209 &ht40allow_map_read_55209
-+compat_raw_setsockopt_30634 compat_raw_setsockopt 5 30634 NULL
-+sys_select_38827 sys_select 1 38827 NULL
-+rxpipe_missed_beacon_host_int_trig_rx_data_read_63405 rxpipe_missed_beacon_host_int_trig_rx_data_read 3 63405 NULL
-+do_raw_setsockopt_55215 do_raw_setsockopt 5 55215 NULL
-+extract_entropy_user_26952 extract_entropy_user 3 26952 NULL
-+sctp_abort_pkt_new_55218 sctp_abort_pkt_new 5 55218 NULL
-+fib_hash_alloc_63412 fib_hash_alloc 1 63412 NULL
-+twa_change_queue_depth_30648 twa_change_queue_depth 2 30648 NULL
-+handle_received_packet_22457 handle_received_packet 3 22457 NULL
-+noack_read_63419 noack_read 3 63419 NULL
-+mtd_do_readoob_30654 mtd_do_readoob 3 30654 NULL
-+add_numbered_child_14273 add_numbered_child 5 14273 NULL
-+l2cap_sock_sendmsg_63427 l2cap_sock_sendmsg 4 63427 NULL
-+icmp_manip_pkt_48801 icmp_manip_pkt 2 48801 NULL
-+agp_remap_30665 agp_remap 2 30665 NULL
-+extend_mmcfg_14282 extend_mmcfg 1 14282 NULL
-+interfaces_38859 interfaces 2 38859 NULL
-+iwl_dbgfs_tx_power_read_14285 iwl_dbgfs_tx_power_read 3 14285 NULL
-+memcpy_fromiovec_55247 memcpy_fromiovec 3 55247 NULL
-+nfsd_symlink_63442 nfsd_symlink 6 63442 NULL
-+ieee80211_if_read_dot11MeshHWMPpreqMinInterval_24208 ieee80211_if_read_dot11MeshHWMPpreqMinInterval 3 24208 NULL
-+cache_write_procfs_22491 cache_write_procfs 3 22491 NULL
-+read_default_ldt_14302 read_default_ldt 2 14302 NULL
-+write_62671 write 3 62671 NULL
-+dccp_setsockopt_ccid_30701 dccp_setsockopt_ccid 4 30701 NULL
-+scsi_deactivate_tcq_47086 scsi_deactivate_tcq 2 47086 NULL nohasharray
-+oti6858_buf_alloc_47086 oti6858_buf_alloc 1 47086 &scsi_deactivate_tcq_47086
-+snd_info_entry_write_63474 snd_info_entry_write 3 63474 NULL
-+ieee80211_if_read_capab_55294 ieee80211_if_read_capab 3 55294 NULL
-+read_kcore_63488 read_kcore 3 63488 NULL
-+lbs_debugfs_read_30721 lbs_debugfs_read 3 30721 NULL
-+__skb_cow_39254 __skb_cow 2 39254 NULL
-+strategy_allowed_congestion_control_63497 strategy_allowed_congestion_control 5 63497 NULL
-+ivtv_copy_buf_to_user_6159 ivtv_copy_buf_to_user 4 6159 NULL
-+pskb_may_pull_22546 pskb_may_pull 2 22546 NULL
-+mousedev_read_47123 mousedev_read 3 47123 NULL
-+ctrl_out_55321 ctrl_out 3 55321 NULL
-+agp_alloc_page_array_22554 agp_alloc_page_array 1 22554 NULL
-+vdma_mem_alloc_6171 vdma_mem_alloc 1 6171 NULL
-+wl1251_cmd_template_set_6172 wl1251_cmd_template_set 4 6172 NULL
-+ether1394_write_6180 ether1394_write 6 6180 NULL
-+ses_recv_diag_47143 ses_recv_diag 4 47143 NULL nohasharray
-+acpi_ut_initialize_buffer_47143 acpi_ut_initialize_buffer 2 47143 &ses_recv_diag_47143
-+sock_rmalloc_59740 sock_rmalloc 2 59740 NULL nohasharray
-+ieee80211_if_read_fwded_unicast_59740 ieee80211_if_read_fwded_unicast 3 59740 &sock_rmalloc_59740
-+ubi_more_leb_change_data_63534 ubi_more_leb_change_data 4 63534 NULL
-+fuse_conn_limit_write_30777 fuse_conn_limit_write 3 30777 NULL
-+rs_sta_dbgfs_rate_scale_data_read_47165 rs_sta_dbgfs_rate_scale_data_read 3 47165 NULL
-+append_to_buffer_63550 append_to_buffer 3 63550 NULL
-+smk_write_onlycap_14400 smk_write_onlycap 3 14400 NULL
-+acpi_system_read_event_55362 acpi_system_read_event 3 55362 NULL
-+kvm_write_guest_page_63555 kvm_write_guest_page 5 63555 NULL
-+isp1760_register_14408 isp1760_register 2-1 14408 NULL
-+sd_alloc_ctl_entry_29708 sd_alloc_ctl_entry 1 29708 NULL
-+OSDSetBlock_38986 OSDSetBlock 2-4 38986 NULL
-+svc_pool_map_alloc_arrays_47181 svc_pool_map_alloc_arrays 2 47181 NULL
-+mtd_concat_create_14416 mtd_concat_create 2 14416 NULL
-+mqueue_read_file_6228 mqueue_read_file 3 6228 NULL
-+ioremap_cache_47189 ioremap_cache 2-1 47189 NULL
-+ubi_write_30809 ubi_write 5-4 30809 NULL
-+smk_read_doi_30813 smk_read_doi 3 30813 NULL
-+get_nodes_39012 get_nodes 3 39012 NULL
-+module_alloc_update_bounds_47205 module_alloc_update_bounds 1 47205 NULL
-+fbcon_prepare_logo_6246 fbcon_prepare_logo 5 6246 NULL
-+sctp_setsockopt_connectx_old_22631 sctp_setsockopt_connectx_old 3 22631 NULL
-+pwr_wake_on_timer_exp_read_22640 pwr_wake_on_timer_exp_read 3 22640 NULL
-+mthca_map_reg_5664 mthca_map_reg 3-2 5664 NULL
-+sctp_setsockopt_auth_chunk_30843 sctp_setsockopt_auth_chunk 3 30843 NULL
-+xfs_iext_remove_39040 xfs_iext_remove 3 39040 NULL
-+options_write_47243 options_write 3 47243 NULL
-+module_alloc_63630 module_alloc 1 63630 NULL
-+ntfs_malloc_nofs_nofail_63631 ntfs_malloc_nofs_nofail 1 63631 NULL
-+proc_loginuid_write_63648 proc_loginuid_write 3 63648 NULL
-+__vxge_hw_channel_allocate_55462 __vxge_hw_channel_allocate 3 55462 NULL
-+store_sys_acpi_14503 store_sys_acpi 3 14503 NULL
-+rtl8169_try_rx_copy_55465 rtl8169_try_rx_copy 3 55465 NULL
-+hidraw_ioctl_63658 hidraw_ioctl 2 63658 NULL
-+ocfs2_debug_read_14507 ocfs2_debug_read 3 14507 NULL
-+tty_audit_log_47280 tty_audit_log 8 47280 NULL
-+fc_host_post_vendor_event_30903 fc_host_post_vendor_event 3 30903 NULL
-+rawv6_send_hdrinc_55480 rawv6_send_hdrinc 3 55480 NULL
-+i2o_pool_alloc_55485 i2o_pool_alloc 4 55485 NULL
-+usb_serial_multi_urb_write_22718 usb_serial_multi_urb_write 4 22718 NULL
-+tx_internal_desc_overflow_read_47300 tx_internal_desc_overflow_read 3 47300 NULL
-+iommu_map_mmio_space_30919 iommu_map_mmio_space 1 30919 NULL
-+dataflash_read_user_otp_14536 dataflash_read_user_otp 3-2 14536 NULL nohasharray
-+ep0_write_14536 ep0_write 3 14536 &dataflash_read_user_otp_14536
-+ax25_output_22736 ax25_output 2 22736 NULL
-+drm_vmalloc_dma_14550 drm_vmalloc_dma 1 14550 NULL
-+cmtp_add_msgpart_9252 cmtp_add_msgpart 4 9252 NULL
-+sctp_setsockopt_rtoinfo_30941 sctp_setsockopt_rtoinfo 3 30941 NULL
-+hfcpci_empty_fifo_2427 hfcpci_empty_fifo 4 2427 NULL
-+wv_packet_read_39140 wv_packet_read 3 39140 NULL
-+wl1251_hw_scan_61137 wl1251_hw_scan 3 61137 NULL nohasharray
-+squashfs_read_fragment_index_table_61137 squashfs_read_fragment_index_table 3 61137 &wl1251_hw_scan_61137
-+_proc_do_string_6376 _proc_do_string 2 6376 NULL
-+alloc_ring_39151 alloc_ring 2-4 39151 NULL
-+sctp_getsockopt_assoc_number_6384 sctp_getsockopt_assoc_number 2 6384 NULL
-+proc_coredump_filter_read_39153 proc_coredump_filter_read 3 39153 NULL
-+nfqnl_mangle_14583 nfqnl_mangle 2 14583 NULL
-+ieee80211_if_read_dot11MeshHoldingTimeout_47356 ieee80211_if_read_dot11MeshHoldingTimeout 3 47356 NULL
-+idmap_pipe_downcall_14591 idmap_pipe_downcall 3 14591 NULL
-+selinux_secctx_to_secid_63744 selinux_secctx_to_secid 2 63744 NULL
-+sta_rx_packets_read_22788 sta_rx_packets_read 3 22788 NULL
-+get_info_55681 get_info 3 55681 NULL
-+mangle_sdp_packet_30986 mangle_sdp_packet 8 30986 NULL
-+__bio_map_kern_47379 __bio_map_kern 2-3 47379 NULL
-+ubi_more_update_data_39189 ubi_more_update_data 4 39189 NULL
-+snd_pcm_oss_read1_63771 snd_pcm_oss_read1 3 63771 NULL
-+xfs_trans_get_efi_7898 xfs_trans_get_efi 2 7898 NULL
-+l2up_create_6430 l2up_create 3 6430 NULL
-+__alloc_bootmem_node_nopanic_6432 __alloc_bootmem_node_nopanic 2 6432 NULL
-+pfkey_sendmsg_47394 pfkey_sendmsg 4 47394 NULL
-+ivtv_v4l2_write_39226 ivtv_v4l2_write 3 39226 NULL
-+selinux_setprocattr_55611 selinux_setprocattr 4 55611 NULL
-+copy_nodes_to_user_63807 copy_nodes_to_user 2 63807 NULL
-+befs_utf2nls_25628 befs_utf2nls 3 25628 NULL
-+read_file_rcstat_22854 read_file_rcstat 3 22854 NULL
-+pktgen_if_write_55628 pktgen_if_write 3 55628 NULL
-+acpi_thermal_write_cooling_mode_31053 acpi_thermal_write_cooling_mode 3 31053 NULL
-+snd_opl4_mem_proc_read_63774 snd_opl4_mem_proc_read 5-6 63774 NULL
-+compat_sys_mq_timedsend_31060 compat_sys_mq_timedsend 3 31060 NULL
-+sel_write_load_63830 sel_write_load 3 63830 NULL
-+lbs_failcount_read_31063 lbs_failcount_read 3 31063 NULL
-+got_frame_16028 got_frame 2 16028 NULL
-+dvb_dmxdev_set_buffer_size_55643 dvb_dmxdev_set_buffer_size 2 55643 NULL
-+proc_pid_attr_write_63845 proc_pid_attr_write 3 63845 NULL
-+expand_fdtable_39273 expand_fdtable 2 39273 NULL
-+read_oldmem_55658 read_oldmem 3 55658 NULL
-+stats_rx_expand_skb_head_read_47467 stats_rx_expand_skb_head_read 3 47467 NULL
-+usblp_new_writeurb_22894 usblp_new_writeurb 2 22894 NULL
-+mdc800_device_read_22896 mdc800_device_read 3 22896 NULL
-+sctp_setsockopt_context_31091 sctp_setsockopt_context 3 31091 NULL
-+tpm_read_50344 tpm_read 3 50344 NULL
-+sfi_map_memory_5183 sfi_map_memory 2-1 5183 NULL
-+newpart_47485 newpart 6 47485 NULL
-+stats_rx_handlers_drop_nullfunc_read_39294 stats_rx_handlers_drop_nullfunc_read 3 39294 NULL
-+dvb_dvr_ioctl_39317 dvb_dvr_ioctl 3 39317 NULL
-+sg_kmalloc_50240 sg_kmalloc 1 50240 NULL
-+inet_listen_14723 inet_listen 2 14723 NULL
-+compat_sys_get_mempolicy_31109 compat_sys_get_mempolicy 3 31109 NULL
-+core_sys_select_47494 core_sys_select 1 47494 NULL
-+store_pwm1_62529 store_pwm1 4 62529 NULL
-+depth_read_31112 depth_read 3 31112 NULL
-+sisusb_write_mem_bulk_29678 sisusb_write_mem_bulk 4 29678 NULL
-+__vmalloc_node_39308 __vmalloc_node 1 39308 NULL
-+libfc_host_alloc_7917 libfc_host_alloc 2 7917 NULL
-+alloc_arraycache_47505 alloc_arraycache 2 47505 NULL
-+unlink_simple_47506 unlink_simple 3 47506 NULL
-+rndis_set_oid_6547 rndis_set_oid 4 6547 NULL
-+wdm_read_6549 wdm_read 3 6549 NULL
-+fb_alloc_cmap_6554 fb_alloc_cmap 2 6554 NULL
-+divas_write_63901 divas_write 3 63901 NULL
-+store_camera_14751 store_camera 4 14751 NULL
-+kimage_normal_alloc_31140 kimage_normal_alloc 3 31140 NULL
-+w9966_v4l_read_31148 w9966_v4l_read 3 31148 NULL
-+alloc_sglist_22960 alloc_sglist 1-3-2 22960 NULL
-+uvc_alloc_urb_buffers_63922 uvc_alloc_urb_buffers 3-2 63922 NULL
-+bt_skb_send_alloc_6581 bt_skb_send_alloc 2 6581 NULL
-+__copy_from_user_nocache_39351 __copy_from_user_nocache 3 39351 NULL
-+__alloc_bootmem_low_43423 __alloc_bootmem_low 1 43423 NULL
-+esp_alloc_tmp_55741 esp_alloc_tmp 2 55741 NULL
-+sta_dev_read_14782 sta_dev_read 3 14782 NULL
-+ch_do_scsi_31171 ch_do_scsi 4 31171 NULL
-+afs_send_simple_reply_63940 afs_send_simple_reply 3 63940 NULL
-+cycx_setup_47562 cycx_setup 4 47562 NULL
-+remote_settings_file_write_22987 remote_settings_file_write 3 22987 NULL
-+mangle_packet_47567 mangle_packet 5-7 47567 NULL
-+read_ldt_47570 read_ldt 2 47570 NULL
-+create_attr_set_22861 create_attr_set 1 22861 NULL
-+pci_iomap_47575 pci_iomap 3 47575 NULL
-+acpi_ex_system_memory_space_handler_31192 acpi_ex_system_memory_space_handler 2 31192 NULL
-+ecryptfs_filldir_6622 ecryptfs_filldir 3 6622 NULL
-+scsi_execute_33596 scsi_execute 5 33596 NULL
-+dn_alloc_skb_6631 dn_alloc_skb 2 6631 NULL
-+do_tune_cpucache_14828 do_tune_cpucache 2 14828 NULL
-+viafb_dvp0_proc_write_23023 viafb_dvp0_proc_write 3 23023 NULL
-+atm_get_addr_31221 atm_get_addr 3 31221 NULL
-+uwb_rc_neh_grok_event_55799 uwb_rc_neh_grok_event 3 55799 NULL
-+intel_i810_alloc_by_type_31226 intel_i810_alloc_by_type 1 31226 NULL
-+uea_request_47613 uea_request 4 47613 NULL
-+cache_read_pipefs_47615 cache_read_pipefs 3 47615 NULL
-+alloc_agpphysmem_i8xx_39427 alloc_agpphysmem_i8xx 1 39427 NULL
-+tcp_recvmsg_31238 tcp_recvmsg 4 31238 NULL
-+lcd_write_14857 lcd_write 3 14857 NULL nohasharray
-+__krealloc_14857 __krealloc 2 14857 &lcd_write_14857
-+get_user_cpu_mask_14861 get_user_cpu_mask 2 14861 NULL
-+kmemdup_64015 kmemdup 2 64015 NULL
-+sta_rx_duplicates_read_47633 sta_rx_duplicates_read 3 47633 NULL
-+alloc_ringbuf_31251 alloc_ringbuf 1 31251 NULL
-+reiserfs_add_entry_23062 reiserfs_add_entry 4 23062 NULL nohasharray
-+unix_seqpacket_recvmsg_23062 unix_seqpacket_recvmsg 4 23062 &reiserfs_add_entry_23062
-+process_rcvd_data_6679 process_rcvd_data 3 6679 NULL
-+sb16_copy_from_user_55836 sb16_copy_from_user 10-7-6 55836 NULL
-+frequency_read_64031 frequency_read 3 64031 NULL
-+sys_semop_39457 sys_semop 3 39457 NULL
-+vm_map_ram_23078 vm_map_ram 2 23078 NULL nohasharray
-+raw_sendmsg_23078 raw_sendmsg 4 23078 &vm_map_ram_23078
-+ether1394_data_handler_2481 ether1394_data_handler 5 2481 NULL
-+sriov_enable_migration_14889 sriov_enable_migration 2 14889 NULL
-+ps_pspoll_max_apturn_read_6699 ps_pspoll_max_apturn_read 3 6699 NULL
-+isr_tx_procs_read_23084 isr_tx_procs_read 3 23084 NULL
-+tracing_set_trace_write_57096 tracing_set_trace_write 3 57096 NULL
-+setkey_unaligned_39474 setkey_unaligned 3 39474 NULL
-+rt2x00debug_write_eeprom_23091 rt2x00debug_write_eeprom 3 23091 NULL
-+hcd_alloc_coherent_55862 hcd_alloc_coherent 5 55862 NULL
-+ntfs_ucstonls_23097 ntfs_ucstonls 3-5 23097 NULL
-+sky2_receive_13407 sky2_receive 2 13407 NULL
-+krealloc_14908 krealloc 2 14908 NULL
-+pipe_iov_copy_from_user_23102 pipe_iov_copy_from_user 3 23102 NULL
-+jffs2_user_setxattr_39488 jffs2_user_setxattr 4 39488 NULL
-+stats_tx_handlers_drop_unauth_port_read_16139 stats_tx_handlers_drop_unauth_port_read 3 16139 NULL
-+ip_recv_error_23109 ip_recv_error 3 23109 NULL
-+uvc_simplify_fraction_31303 uvc_simplify_fraction 3 31303 NULL
-+drm_mode_create_tv_properties_23122 drm_mode_create_tv_properties 2 23122 NULL
-+sisusbcon_scroll_31315 sisusbcon_scroll 5-3-2 31315 NULL
-+packet_recvmsg_47700 packet_recvmsg 4 47700 NULL
-+command_file_write_31318 command_file_write 3 31318 NULL
-+lbs_highrssi_read_64089 lbs_highrssi_read 3 64089 NULL
-+unix_dgram_recvmsg_14952 unix_dgram_recvmsg 4 14952 NULL
-+sfi_check_table_6772 sfi_check_table 1 6772 NULL
-+bits_to_user_47733 bits_to_user 3-2 47733 NULL
-+netxen_alloc_sds_rings_13417 netxen_alloc_sds_rings 2 13417 NULL
-+ftrace_pid_read_14970 ftrace_pid_read 3 14970 NULL
-+help_14971 help 4 14971 NULL
-+iwl_dbgfs_channels_read_6784 iwl_dbgfs_channels_read 3 6784 NULL
-+ieee80211_if_read_6785 ieee80211_if_read 3 6785 NULL
-+pp_write_39554 pp_write 3 39554 NULL
-+br_send_bpdu_29669 br_send_bpdu 3 29669 NULL
-+create_reply_packet_6789 create_reply_packet 3 6789 NULL
-+hdlcdrv_register_6792 hdlcdrv_register 2 6792 NULL
-+usblp_write_23178 usblp_write 3 23178 NULL
-+setkey_14987 setkey 3 14987 NULL
-+xprt_rdma_allocate_31372 xprt_rdma_allocate 2 31372 NULL
-+gss_pipe_downcall_23182 gss_pipe_downcall 3 23182 NULL
-+handle_response_55951 handle_response 5 55951 NULL
-+ieee80211_if_read_fwded_mcast_39571 ieee80211_if_read_fwded_mcast 3 39571 NULL
-+fix_unclean_leb_23188 fix_unclean_leb 3 23188 NULL
-+simple_read_from_buffer_55957 simple_read_from_buffer 2-5 55957 NULL
-+handle_response_icmp_39574 handle_response_icmp 7 39574 NULL
-+acpi_processor_write_limit_23201 acpi_processor_write_limit 3 23201 NULL
-+rvmalloc_46873 rvmalloc 1 46873 NULL
-+cistpl_vers_1_15023 cistpl_vers_1 4 15023 NULL
-+vmap_15025 vmap 2 15025 NULL
-+key_ifindex_read_31411 key_ifindex_read 3 31411 NULL
-+mcs7830_set_reg_31413 mcs7830_set_reg 3 31413 NULL
-+mon_bin_read_6841 mon_bin_read 3 6841 NULL
-+tty_buffer_request_room_23228 tty_buffer_request_room 2 23228 NULL
-+xlog_get_bp_23229 xlog_get_bp 2 23229 NULL
-+__kmalloc_23231 __kmalloc 1 23231 NULL
-+rxrpc_client_sendmsg_23236 rxrpc_client_sendmsg 5 23236 NULL
-+ubi_leb_write_41691 ubi_leb_write 5-4 41691 NULL
-+store_lslvl_15059 store_lslvl 4 15059 NULL
-+ssb_bus_pcmciabus_register_56020 ssb_bus_pcmciabus_register 3 56020 NULL
-+smk_read_ambient_61220 smk_read_ambient 3 61220 NULL
-+ntfs_copy_from_user_15072 ntfs_copy_from_user 3-5 15072 NULL
-+pppoe_recvmsg_15073 pppoe_recvmsg 4 15073 NULL
-+find_rsb_39650 find_rsb 3 39650 NULL
-+snd_rme32_capture_copy_39653 snd_rme32_capture_copy 5 39653 NULL
-+dm_write_2513 dm_write 3 2513 NULL
-+raw_seticmpfilter_6888 raw_seticmpfilter 3 6888 NULL
-+prism2_info_hostscanresults_39657 prism2_info_hostscanresults 3 39657 NULL
-+dlmfs_file_write_6892 dlmfs_file_write 3 6892 NULL
-+ubifs_write_node_15088 ubifs_write_node 5-3 15088 NULL
-+stv680_read_31473 stv680_read 3 31473 NULL
-+tipc_cltr_prepare_routing_msg_56052 tipc_cltr_prepare_routing_msg 1 56052 NULL
-+doc_probe_23285 doc_probe 1 23285 NULL
-+v4l_stk_read_39672 v4l_stk_read 3 39672 NULL
-+dccp_sendmsg_56058 dccp_sendmsg 4 56058 NULL
-+proc_sessionid_read_6911 proc_sessionid_read 3 6911 NULL
-+ieee80211_rx_mgmt_probe_resp_6918 ieee80211_rx_mgmt_probe_resp 3 6918 NULL
-+__alloc_bootmem_31498 __alloc_bootmem 1 31498 NULL
-+i2cdev_write_23310 i2cdev_write 3 23310 NULL
-+dma_region_alloc_56079 dma_region_alloc 2 56079 NULL
-+nl_pid_hash_zalloc_23314 nl_pid_hash_zalloc 1 23314 NULL
-+ftrace_pid_write_39710 ftrace_pid_write 3 39710 NULL
-+event_id_read_64288 event_id_read 3 64288 NULL nohasharray
-+xfs_dir_cilookup_result_64288 xfs_dir_cilookup_result 3 64288 &event_id_read_64288
-+nfs_flush_one_23329 nfs_flush_one 3 23329 NULL
-+store_gps_42118 store_gps 4 42118 NULL
-+timeout_read_47915 timeout_read 3 47915 NULL
-+hpsb_iso_recv_init_31535 hpsb_iso_recv_init 3 31535 NULL
-+hidraw_write_31536 hidraw_write 3 31536 NULL
-+page_readlink_23346 page_readlink 3 23346 NULL
-+videobuf_dma_init_kernel_6963 videobuf_dma_init_kernel 3 6963 NULL
-+sta_tx_filtered_read_6973 sta_tx_filtered_read 3 6973 NULL
-+stats_tx_handlers_drop_wep_read_47944 stats_tx_handlers_drop_wep_read 3 47944 NULL
-+sisusbcon_clear_64329 sisusbcon_clear 3-5-4 64329 NULL
-+tcp_write_xmit_39755 tcp_write_xmit 2 39755 NULL
-+request_key_async_6990 request_key_async 4 6990 NULL
-+dccp_setsockopt_service_65336 dccp_setsockopt_service 4 65336 NULL
-+dabusb_writemem_39764 dabusb_writemem 4 39764 NULL
-+do_write_orph_node_64343 do_write_orph_node 2 64343 NULL
-+iscsi_create_endpoint_15193 iscsi_create_endpoint 1 15193 NULL
-+osst_write_31581 osst_write 3 31581 NULL
-+tracing_cpumask_read_7010 tracing_cpumask_read 3 7010 NULL
-+rawv6_setsockopt_56165 rawv6_setsockopt 5 56165 NULL
-+diva_xdi_write_63975 diva_xdi_write 4 63975 NULL
-+llc_alloc_frame_64366 llc_alloc_frame 4 64366 NULL
-+mempool_resize_47983 mempool_resize 2 47983 NULL
-+hid_report_raw_event_7024 hid_report_raw_event 4 7024 NULL
-+ieee80211_if_read_max_ratectrl_rateidx_64369 ieee80211_if_read_max_ratectrl_rateidx 3 64369 NULL
-+ib_umad_write_47993 ib_umad_write 3 47993 NULL
-+ilo_write_64378 ilo_write 3 64378 NULL
-+iscsi_host_alloc_36671 iscsi_host_alloc 2 36671 NULL
-+ipath_get_base_info_7043 ipath_get_base_info 3 7043 NULL
-+__fc_frame_alloc_23432 __fc_frame_alloc 1 23432 NULL
-+acpi_fan_write_state_39818 acpi_fan_write_state 3 39818 NULL
-+sys_migrate_pages_39825 sys_migrate_pages 2 39825 NULL
-+pidlist_allocate_64404 pidlist_allocate 1 64404 NULL
-+cache_read_procfs_52882 cache_read_procfs 3 52882 NULL
-+rx_hdr_overflow_read_64407 rx_hdr_overflow_read 3 64407 NULL
-+beiscsi_process_async_pdu_39834 beiscsi_process_async_pdu 7 39834 NULL
-+drm_alloc_agp_48031 drm_alloc_agp 2 48031 NULL
-+hci_sock_recvmsg_7072 hci_sock_recvmsg 4 7072 NULL
-+snd_card_create_64418 snd_card_create 4 64418 NULL nohasharray
-+keyctl_get_security_64418 keyctl_get_security 3 64418 &snd_card_create_64418
-+cp210x_get_config_56229 cp210x_get_config 4 56229 NULL
-+spi_dv_device_echo_buffer_39846 spi_dv_device_echo_buffer 2-3 39846 NULL
-+pppoe_sendmsg_48039 pppoe_sendmsg 4 48039 NULL
-+zd_ioread16v_locked_7082 zd_ioread16v_locked 4 7082 NULL
-+dn_nsp_send_disc_23469 dn_nsp_send_disc 2 23469 NULL
-+do_ipt_set_ctl_56238 do_ipt_set_ctl 4 56238 NULL
-+store_status_7088 store_status 2 7088 NULL
-+__lgread_31668 __lgread 4 31668 NULL
-+fd_copyin_56247 fd_copyin 3 56247 NULL
-+wpan_phy_alloc_48056 wpan_phy_alloc 1 48056 NULL
-+ax25_recvmsg_64441 ax25_recvmsg 4 64441 NULL
-+sys_connect_15291 sys_connect 3 15291 NULL nohasharray
-+xlate_dev_mem_ptr_15291 xlate_dev_mem_ptr 1 15291 &sys_connect_15291
-+linear_conf_23485 linear_conf 2 23485 NULL nohasharray
-+divasa_remap_pci_bar_23485 divasa_remap_pci_bar 3-4 23485 &linear_conf_23485
-+posix_acl_alloc_48063 posix_acl_alloc 1 48063 NULL
-+event_filter_read_23494 event_filter_read 3 23494 NULL
-+tpm_tis_init_15304 tpm_tis_init 3-2 15304 NULL
-+msnd_fifo_alloc_23179 msnd_fifo_alloc 2 23179 NULL
-+sys_setsockopt_35320 sys_setsockopt 5 35320 NULL
-+pkt_add_39897 pkt_add 3 39897 NULL
-+write_led_23517 write_led 2 23517 NULL
-+ip_vs_create_timeout_table_64478 ip_vs_create_timeout_table 2 64478 NULL
-+send_mpa_reject_7135 send_mpa_reject 3 7135 NULL
-+mmc_alloc_host_48097 mmc_alloc_host 1 48097 NULL
-+skb_copy_datagram_const_iovec_48102 skb_copy_datagram_const_iovec 2-5-4 48102 NULL
-+dvb_aplay_56296 dvb_aplay 3 56296 NULL
-+alloc_large_system_hash_64490 alloc_large_system_hash 2 64490 NULL
-+sctp_make_asconf_ack_31726 sctp_make_asconf_ack 3 31726 NULL
-+aes_encrypt_interrupt_read_39919 aes_encrypt_interrupt_read 3 39919 NULL
-+ima_show_measurements_count_23536 ima_show_measurements_count 3 23536 NULL
-+snd_hdspm_capture_copy_48113 snd_hdspm_capture_copy 5 48113 NULL
-+squashfs_read_inode_lookup_table_7160 squashfs_read_inode_lookup_table 3 7160 NULL
-+get_arg_5694 get_arg 3 5694 NULL
-+acpi_ut_create_string_object_15360 acpi_ut_create_string_object 1 15360 NULL
-+slow_kernel_write_15362 slow_kernel_write 6 15362 NULL
-+snd_seq_device_new_31753 snd_seq_device_new 4 31753 NULL
-+journal_init_revoke_table_56331 journal_init_revoke_table 1 56331 NULL
-+ses_send_diag_64527 ses_send_diag 4 64527 NULL
-+tcp_match_skb_to_sack_23568 tcp_match_skb_to_sack 3-4 23568 NULL
-+snd_rawmidi_read_56337 snd_rawmidi_read 3 56337 NULL
-+venus_symlink_23570 venus_symlink 4-6 23570 NULL
-+tty_prepare_flip_string_39955 tty_prepare_flip_string 3 39955 NULL
-+__tcp_push_pending_frames_48148 __tcp_push_pending_frames 2 48148 NULL
-+iwl_dbgfs_interrupt_read_23574 iwl_dbgfs_interrupt_read 3 23574 NULL
-+ipv6_recv_error_56347 ipv6_recv_error 3 56347 NULL
-+vxge_os_dma_malloc_async_56348 vxge_os_dma_malloc_async 3 56348 NULL
-+isr_dma1_done_read_48159 isr_dma1_done_read 3 48159 NULL
-+strip_change_mtu_33968 strip_change_mtu 2 33968 NULL
-+cifs_spnego_key_instantiate_23588 cifs_spnego_key_instantiate 3 23588 NULL
-+tracing_clock_read_39975 tracing_clock_read 3 39975 NULL
-+broadsheetfb_write_39976 broadsheetfb_write 3 39976 NULL
-+sctp_datamsg_from_user_55342 sctp_datamsg_from_user 4 55342 NULL
-+iov_iter_copy_from_user_atomic_56368 iov_iter_copy_from_user_atomic 4 56368 NULL
-+dev_read_56369 dev_read 3 56369 NULL
-+mthca_array_init_39987 mthca_array_init 2 39987 NULL
-+diva_os_alloc_message_buffer_64568 diva_os_alloc_message_buffer 1 64568 NULL
-+ecryptfs_send_message_locked_31801 ecryptfs_send_message_locked 2 31801 NULL
-+islpci_mgt_transaction_23610 islpci_mgt_transaction 5 23610 NULL
-+isr_rx_procs_read_31804 isr_rx_procs_read 3 31804 NULL
-+node_write_29878 node_write 4 29878 NULL
-+sys32_ipc_7238 sys32_ipc 3 7238 NULL
-+sta_last_signal_read_31818 sta_last_signal_read 3 31818 NULL
-+iwl_dbgfs_ucode_tx_stats_read_31611 iwl_dbgfs_ucode_tx_stats_read 3 31611 NULL
-+dvb_ca_en50221_io_write_43533 dvb_ca_en50221_io_write 3 43533 NULL
-+ocfs2_control_read_56405 ocfs2_control_read 3 56405 NULL
-+ivtvfb_write_40023 ivtvfb_write 3 40023 NULL
-+use_pool_64607 use_pool 2 64607 NULL
-+__get_vm_area_caller_56416 __get_vm_area_caller 1 56416 NULL nohasharray
-+acpi_os_write_memory_56416 acpi_os_write_memory 3-1 56416 &__get_vm_area_caller_56416
-+store_msg_56417 store_msg 3 56417 NULL
-+__i2400mu_send_barker_23652 __i2400mu_send_barker 3 23652 NULL
-+dvb_demux_ioctl_65382 dvb_demux_ioctl 3 65382 NULL
-+vmalloc_15464 vmalloc 1 15464 NULL
-+r128_compat_ioctl_39250 r128_compat_ioctl 2 39250 NULL
-+stats_failed_count_read_9244 stats_failed_count_read 3 9244 NULL
-+nfsctl_transaction_read_48250 nfsctl_transaction_read 3 48250 NULL
-+stats_rx_handlers_drop_defrag_read_56448 stats_rx_handlers_drop_defrag_read 3 56448 NULL
-+cx231xx_init_isoc_56453 cx231xx_init_isoc 2-3 56453 NULL
-+xfs_dir2_sf_addname_hard_54254 xfs_dir2_sf_addname_hard 3 54254 NULL
-+cache_write_pipefs_48270 cache_write_pipefs 3 48270 NULL
-+osd_req_list_partition_objects_56464 osd_req_list_partition_objects 5 56464 NULL
-+usbvideo_v4l_read_48274 usbvideo_v4l_read 3 48274 NULL
-+cx18_read_23699 cx18_read 3 23699 NULL
-+add_partition_15515 add_partition 2 15515 NULL
-+pkt_bio_alloc_48284 pkt_bio_alloc 1 48284 NULL
-+mtd_read_48289 mtd_read 3 48289 NULL
-+sock_alloc_send_skb_23720 sock_alloc_send_skb 2 23720 NULL
-+osst_execute_17607 osst_execute 7-6 17607 NULL
-+kmem_alloc_31920 kmem_alloc 1 31920 NULL
-+sctp_setsockopt_delayed_ack_40129 sctp_setsockopt_delayed_ack 3 40129 NULL
-+cfg80211_connect_result_56515 cfg80211_connect_result 4-6 56515 NULL
-+iov_iter_copy_from_user_31942 iov_iter_copy_from_user 4 31942 NULL nohasharray
-+read_mem_31942 read_mem 3 31942 &iov_iter_copy_from_user_31942
-+__feat_register_sp_64712 __feat_register_sp 6 64712 NULL
-+pwr_elp_enter_read_5324 pwr_elp_enter_read 3 5324 NULL
-+proc_self_readlink_38094 proc_self_readlink 3 38094 NULL
-+store_ledd_43312 store_ledd 4 43312 NULL
-+iwch_alloc_fastreg_pbl_40153 iwch_alloc_fastreg_pbl 2 40153 NULL
-+ip_options_get_56538 ip_options_get 4 56538 NULL
-+ep0_read_38095 ep0_read 3 38095 NULL
-+sctp_getsockopt_sctp_status_56540 sctp_getsockopt_sctp_status 2 56540 NULL
-+vstusb_read_23774 vstusb_read 3 23774 NULL
-+pt_write_40159 pt_write 3 40159 NULL
-+capinc_tty_write_28539 capinc_tty_write 3 28539 NULL
-+sl_change_mtu_7396 sl_change_mtu 2 7396 NULL
-+allocate_cnodes_5329 allocate_cnodes 1 5329 NULL
-+skb_add_data_48363 skb_add_data 3 48363 NULL
-+bio_map_kern_64751 bio_map_kern 3 64751 NULL
-+rt2x00debug_write_csr_64753 rt2x00debug_write_csr 3 64753 NULL
-+mlx4_en_create_tx_ring_64756 mlx4_en_create_tx_ring 3 64756 NULL
-+map_addr_48373 map_addr 5 48373 NULL
-+drm_property_create_blob_7414 drm_property_create_blob 2 7414 NULL
-+rx_path_reset_read_23801 rx_path_reset_read 3 23801 NULL
-+rs_sta_dbgfs_stats_table_read_56573 rs_sta_dbgfs_stats_table_read 3 56573 NULL
-+compat_fillonedir_15620 compat_fillonedir 3 15620 NULL
-+ipr_alloc_ucode_buffer_40199 ipr_alloc_ucode_buffer 1 40199 NULL
-+proc_write_node_15624 proc_write_node 3 15624 NULL
-+acpi_os_allocate_14892 acpi_os_allocate 1 14892 NULL
-+system_enable_read_25815 system_enable_read 3 25815 NULL
-+allocate_probes_40204 allocate_probes 1 40204 NULL
-+proc_loginuid_read_15631 proc_loginuid_read 3 15631 NULL
-+__earlyonly_bootmem_alloc_23824 __earlyonly_bootmem_alloc 2 23824 NULL
-+acpi_battery_write_alarm_1240 acpi_battery_write_alarm 3 1240 NULL
-+isr_low_rssi_read_64789 isr_low_rssi_read 3 64789 NULL
-+ip_options_get_alloc_7448 ip_options_get_alloc 1 7448 NULL
-+joydev_handle_JSIOCSBTNMAP_15643 joydev_handle_JSIOCSBTNMAP 3 15643 NULL
-+lbs_debugfs_write_48413 lbs_debugfs_write 3 48413 NULL
-+nfsctl_transaction_write_64800 nfsctl_transaction_write 3 64800 NULL
-+event_filter_write_56609 event_filter_write 3 56609 NULL
-+sctp_manip_pkt_40620 sctp_manip_pkt 2 40620 NULL
-+iwl_dbgfs_nvm_read_23845 iwl_dbgfs_nvm_read 3 23845 NULL
-+compat_sys_fcntl_15654 compat_sys_fcntl 3 15654 NULL
-+pwr_tx_without_ps_read_48423 pwr_tx_without_ps_read 3 48423 NULL
-+rfkill_fop_write_64808 rfkill_fop_write 3 64808 NULL
-+p54_init_common_23850 p54_init_common 1 23850 NULL
-+osst_read_40237 osst_read 3 40237 NULL
-+sys_sched_setaffinity_32046 sys_sched_setaffinity 2 32046 NULL
-+garp_request_join_7471 garp_request_join 4 7471 NULL
-+ecryptfs_send_miscdev_64816 ecryptfs_send_miscdev 2 64816 NULL
-+ubi_leb_change_14899 ubi_leb_change 4 14899 NULL
-+unix_bind_15668 unix_bind 3 15668 NULL
-+dm_read_15674 dm_read 3 15674 NULL
-+do_kimage_alloc_64827 do_kimage_alloc 3 64827 NULL
-+proc_scsi_devinfo_write_32064 proc_scsi_devinfo_write 3 32064 NULL
-+xip_file_read_58592 xip_file_read 3 58592 NULL
-+evdev_do_ioctl_24459 evdev_do_ioctl 2 24459 NULL
-+rs_sta_dbgfs_scale_table_read_40262 rs_sta_dbgfs_scale_table_read 3 40262 NULL
-+reqsk_queue_alloc_40272 reqsk_queue_alloc 2 40272 NULL
-+sdhci_alloc_host_7509 sdhci_alloc_host 2 7509 NULL
-+dlm_dir_lookup_56662 dlm_dir_lookup 4 56662 NULL
-+rx_xfr_hint_trig_read_40283 rx_xfr_hint_trig_read 3 40283 NULL
-+iwch_reject_cr_23901 iwch_reject_cr 3 23901 NULL
-+ip6_ufo_append_data_40301 ip6_ufo_append_data 5-7-6 40301 NULL
-+snd_gus_dram_read_56686 snd_gus_dram_read 4 56686 NULL
-+ubi_io_write_data_40305 ubi_io_write_data 5 40305 NULL
-+send_control_msg_48498 send_control_msg 6 48498 NULL
-+alloc_etherdev_mq_56698 alloc_etherdev_mq 1-2 56698 NULL
-+diva_os_copy_to_user_48508 diva_os_copy_to_user 4 48508 NULL
-+dvb_ringbuffer_read_user_56702 dvb_ringbuffer_read_user 3 56702 NULL
-+dgram_recvmsg_23104 dgram_recvmsg 4 23104 NULL
-+__alloc_skb_23940 __alloc_skb 1 23940 NULL
-+sta_flags_read_56710 sta_flags_read 3 56710 NULL
-+ipv6_getsockopt_sticky_56711 ipv6_getsockopt_sticky 5 56711 NULL
-+HiSax_readstatus_15752 HiSax_readstatus 2 15752 NULL
-+sg_proc_write_dressz_46316 sg_proc_write_dressz 3 46316 NULL
-+alloc_tx_32143 alloc_tx 2 32143 NULL
-+compat_do_arpt_set_ctl_12184 compat_do_arpt_set_ctl 4 12184 NULL
-+ieee80211_if_read_force_unicast_rateidx_32147 ieee80211_if_read_force_unicast_rateidx 3 32147 NULL
-+__wa_xfer_setup_segs_56725 __wa_xfer_setup_segs 2 56725 NULL
-+do_test_15766 do_test 1 15766 NULL
-+mmio_read_40348 mmio_read 4 40348 NULL
-+v9fs_file_read_40858 v9fs_file_read 3 40858 NULL
-+sta_wep_weak_iv_count_read_64069 sta_wep_weak_iv_count_read 3 64069 NULL
-+nfsd_write_54809 nfsd_write 6 54809 NULL
-+venus_link_32165 venus_link 5 32165 NULL
-+event_rx_mem_empty_read_40363 event_rx_mem_empty_read 3 40363 NULL
-+drm_agp_bind_pages_56748 drm_agp_bind_pages 3 56748 NULL
-+ntfs_rl_realloc_nofail_32173 ntfs_rl_realloc_nofail 3 32173 NULL
-+ubifs_wbuf_write_nolock_64946 ubifs_wbuf_write_nolock 3 64946 NULL
-+smk_read_direct_15803 smk_read_direct 3 15803 NULL
-+fwnet_incoming_packet_40380 fwnet_incoming_packet 3 40380 NULL
-+ip_options_get_from_user_64958 ip_options_get_from_user 4 64958 NULL
-+wusb_ccm_mac_32199 wusb_ccm_mac 7 32199 NULL
-+csr1212_append_new_cache_32202 csr1212_append_new_cache 2 32202 NULL
-+afs_proc_rootcell_write_15822 afs_proc_rootcell_write 3 15822 NULL
-+cciss_allocate_sg_chain_blocks_5368 cciss_allocate_sg_chain_blocks 3-2 5368 NULL
-+oprofilefs_ulong_from_user_57251 oprofilefs_ulong_from_user 3 57251 NULL
-+iscsi_create_conn_50425 iscsi_create_conn 2 50425 NULL
-+alloc_netdev_mq_24028 alloc_netdev_mq 1-4 24028 NULL
-+event_enable_read_7074 event_enable_read 3 7074 NULL
-+xlog_recover_add_to_trans_48614 xlog_recover_add_to_trans 3 48614 NULL
-+pskb_pull_65005 pskb_pull 2 65005 NULL
-+lbs_lowrssi_read_32242 lbs_lowrssi_read 3 32242 NULL
-+agp_generic_alloc_user_9470 agp_generic_alloc_user 1 9470 NULL
-+ubi_io_write_15870 ubi_io_write 5 15870 NULL
-+ntfs_rl_realloc_56831 ntfs_rl_realloc 3 56831 NULL
-+do_ip_vs_set_ctl_48641 do_ip_vs_set_ctl 4 48641 NULL
-+__mptctl_ioctl_15875 __mptctl_ioctl 2 15875 NULL
-+proc_write_ledd_48644 proc_write_ledd 3 48644 NULL
-+sl_realloc_bufs_64086 sl_realloc_bufs 2 64086 NULL
-+insert_dent_65034 insert_dent 7 65034 NULL
-+blkcipher_copy_iv_24075 blkcipher_copy_iv 3 24075 NULL
-+acpi_os_allocate_zeroed_37422 acpi_os_allocate_zeroed 1 37422 NULL
-+snd_rawmidi_kernel_write1_56847 snd_rawmidi_kernel_write1 4 56847 NULL
-+stats_multicast_received_frame_count_read_24083 stats_multicast_received_frame_count_read 3 24083 NULL
-+l2cap_create_iframe_pdu_51801 l2cap_create_iframe_pdu 3 51801 NULL
-+aes_encrypt_packets_read_48666 aes_encrypt_packets_read 3 48666 NULL
-+sm501_create_subdev_48668 sm501_create_subdev 3-4 48668 NULL nohasharray
-+sys_setgroups_48668 sys_setgroups 1 48668 &sm501_create_subdev_48668
-+l3_alloc_skb_32289 l3_alloc_skb 1 32289 NULL
-+l2cap_build_cmd_48676 l2cap_build_cmd 4 48676 NULL
-+request_key_auth_read_24109 request_key_auth_read 3 24109 NULL
-+sbp2util_notify_fetch_agent_40494 sbp2util_notify_fetch_agent 4 40494 NULL
-+efivar_create_sysfs_entry_56882 efivar_create_sysfs_entry 1 56882 NULL
-+vmalloc_user_32308 vmalloc_user 1 32308 NULL
-+hysdn_log_write_48694 hysdn_log_write 3 48694 NULL
-+manip_pkt_7741 manip_pkt 3 7741 NULL
-+recv_msg_48709 recv_msg 4 48709 NULL
-+vxge_device_register_7752 vxge_device_register 4 7752 NULL
-+irnet_ctrl_write_24139 irnet_ctrl_write 3 24139 NULL
-+revalidate_19043 revalidate 2 19043 NULL
-+remap_pci_mem_15966 remap_pci_mem 1-2 15966 NULL
-+ima_write_policy_40548 ima_write_policy 3 40548 NULL
-+journal_init_revoke_56933 journal_init_revoke 2 56933 NULL
-+sel_read_initcon_32362 sel_read_initcon 3 32362 NULL
-+dlm_allocate_rsb_56941 dlm_allocate_rsb 2 56941 NULL
-+bnx2_nvram_write_7790 bnx2_nvram_write 4-2 7790 NULL
-+diva_os_copy_from_user_7792 diva_os_copy_from_user 4 7792 NULL
-+adu_read_24177 adu_read 3 24177 NULL
-+send_mpa_reply_32372 send_mpa_reply 3 32372 NULL
-+usbtmc_read_32377 usbtmc_read 3 32377 NULL
-+get_entry_16003 get_entry 4 16003 NULL nohasharray
-+alloc_vm_area_16003 alloc_vm_area 1 16003 &get_entry_16003
-+event_buffer_read_48772 event_buffer_read 3 48772 NULL
-+xfs_iext_add_indirect_multi_32400 xfs_iext_add_indirect_multi 3 32400 NULL
-+viafb_vt1636_proc_write_16018 viafb_vt1636_proc_write 3 16018 NULL
-+dlm_user_request_8131 dlm_user_request 6 8131 NULL
-+skge_rx_get_40598 skge_rx_get 3 40598 NULL
-+debug_buffer_read_24220 debug_buffer_read 3 24220 NULL
-+ssb_bus_register_65183 ssb_bus_register 3 65183 NULL
-+snd_pcm_aio_read_13900 snd_pcm_aio_read 3 13900 NULL
-+cypress_buf_alloc_32417 cypress_buf_alloc 1 32417 NULL
-+waiters_read_40902 waiters_read 3 40902 NULL
-+vlsi_alloc_ring_57003 vlsi_alloc_ring 3-4 57003 NULL
-+sel_read_bool_24236 sel_read_bool 3 24236 NULL
-+tcp_push_one_48816 tcp_push_one 2 48816 NULL
-+drm_ioctl_65206 drm_ioctl 3 65206 NULL
-+nfulnl_alloc_skb_65207 nfulnl_alloc_skb 2 65207 NULL
-+dccp_recvmsg_16056 dccp_recvmsg 4 16056 NULL
-+atomic_counters_read_48827 atomic_counters_read 3 48827 NULL
-+vc_do_resize_48842 vc_do_resize 3-4 48842 NULL
-+acpi_tb_parse_root_table_53455 acpi_tb_parse_root_table 1 53455 NULL
-+dvb_dmxdev_read_sec_7892 dvb_dmxdev_read_sec 4 7892 NULL
-+snd_nm256_capture_copy_28622 snd_nm256_capture_copy 5 28622 NULL
-+kfifo_alloc_65242 kfifo_alloc 1 65242 NULL
-+viafb_dvp1_proc_write_48864 viafb_dvp1_proc_write 3 48864 NULL
-+iso_alloc_urb_57061 iso_alloc_urb 4 57061 NULL
-+isr_tx_exch_complete_read_16103 isr_tx_exch_complete_read 3 16103 NULL
-+pcmcia_replace_cis_57066 pcmcia_replace_cis 3 57066 NULL
-+ide_driver_proc_write_32493 ide_driver_proc_write 3 32493 NULL
-+dma_tx_requested_read_16110 dma_tx_requested_read 3 16110 NULL nohasharray
-+isr_hw_pm_mode_changes_read_16110 isr_hw_pm_mode_changes_read 3 16110 &dma_tx_requested_read_16110
-+dvb_ca_en50221_io_ioctl_16113 dvb_ca_en50221_io_ioctl 3 16113 NULL
-+sys_setgroups16_48882 sys_setgroups16 1 48882 NULL
-+btmrvl_pscmd_read_24308 btmrvl_pscmd_read 3 24308 NULL
-+system_enable_write_61396 system_enable_write 3 61396 NULL
-+raw_send_hdrinc_7937 raw_send_hdrinc 3 7937 NULL
-+mac_drv_rx_init_48898 mac_drv_rx_init 2 48898 NULL nohasharray
-+joydev_handle_JSIOCSAXMAP_48898 joydev_handle_JSIOCSAXMAP 3 48898 &mac_drv_rx_init_48898
-+sisusbcon_scroll_area_25899 sisusbcon_scroll_area 3-4 25899 NULL
-+xdi_copy_to_user_48900 xdi_copy_to_user 4 48900 NULL
-+compat_core_sys_select_65285 compat_core_sys_select 1 65285 NULL
-+fsm_init_16134 fsm_init 2 16134 NULL
-+hysdn_rx_netpkt_16136 hysdn_rx_netpkt 3 16136 NULL
-+__seq_open_private_40715 __seq_open_private 3 40715 NULL
-+redirected_tty_write_65297 redirected_tty_write 3 65297 NULL
-+ilo_read_32531 ilo_read 3 32531 NULL
-+ieee80211_if_read_estab_plinks_32533 ieee80211_if_read_estab_plinks 3 32533 NULL
-+ioremap_23172 ioremap 2-1 23172 NULL
-+sysfs_write_file_57116 sysfs_write_file 3 57116 NULL
-+csr1212_new_descriptor_leaf_57117 csr1212_new_descriptor_leaf 4 57117 NULL
-+jffs2_trusted_setxattr_65310 jffs2_trusted_setxattr 4 65310 NULL
-+kzalloc_node_24352 kzalloc_node 1 24352 NULL
-+trace_options_write_48275 trace_options_write 3 48275 NULL
-+format_devstat_counter_32550 format_devstat_counter 3 32550 NULL
-+xfs_iext_remove_direct_40744 xfs_iext_remove_direct 3 40744 NULL
-+cfi_read_pri_24366 cfi_read_pri 3 24366 NULL
-+ima_show_htable_value_57136 ima_show_htable_value 2 57136 NULL
-+aes_encrypt_fail_read_32562 aes_encrypt_fail_read 3 32562 NULL
-+sys_mbind_7990 sys_mbind 5 7990 NULL
-+proc_write_disp_16184 proc_write_disp 3 16184 NULL
-+pg_write_40766 pg_write 3 40766 NULL
-+event_heart_beat_read_48961 event_heart_beat_read 3 48961 NULL
-+uea_idma_write_64139 uea_idma_write 3 64139 NULL
-+ecryptfs_readlink_40775 ecryptfs_readlink 3 40775 NULL
-+dma_rx_requested_read_65354 dma_rx_requested_read 3 65354 NULL
-+getxattr_24398 getxattr 4 24398 NULL
-+stk_prepare_sio_buffers_57168 stk_prepare_sio_buffers 2 57168 NULL
-+vcs_read_8017 vcs_read 3 8017 NULL
-+read_file_beacon_32595 read_file_beacon 3 32595 NULL
-+create_table_16213 create_table 2 16213 NULL
-+rx_hw_stuck_read_57179 rx_hw_stuck_read 3 57179 NULL
-+_alloc_set_attr_list_48991 _alloc_set_attr_list 4 48991 NULL
-+sys_set_mempolicy_32608 sys_set_mempolicy 3 32608 NULL
-+atomic_read_file_16227 atomic_read_file 3 16227 NULL
-+sel_write_enforce_48998 sel_write_enforce 3 48998 NULL
-+b43_debugfs_read_24425 b43_debugfs_read 3 24425 NULL
-+netdev_alloc_skb_ip_align_40811 netdev_alloc_skb_ip_align 2 40811 NULL
-+ieee80211_rx_mgmt_beacon_24430 ieee80211_rx_mgmt_beacon 3 24430 NULL
-+trace_parser_get_init_31379 trace_parser_get_init 2 31379 NULL
-+__alloc_bootmem_nopanic_65397 __alloc_bootmem_nopanic 1 65397 NULL
-+trace_seq_to_user_65398 trace_seq_to_user 3 65398 NULL
-+irda_recvmsg_dgram_32631 irda_recvmsg_dgram 4 32631 NULL
-+rcname_read_25919 rcname_read 3 25919 NULL
-+skb_copy_to_page_8071 skb_copy_to_page 6 8071 NULL
-+alloc_targets_8074 alloc_targets 2 8074 NULL
-+tifm_alloc_adapter_10903 tifm_alloc_adapter 1 10903 NULL
-+drm_calloc_large_65421 drm_calloc_large 1-2 65421 NULL
-+generic_readlink_32654 generic_readlink 3 32654 NULL
-+skb_copy_and_csum_datagram_iovec_24466 skb_copy_and_csum_datagram_iovec 2 24466 NULL
-+ttm_bo_ioremap_40854 ttm_bo_ioremap 4-3-2 40854 NULL
-+xpc_kzalloc_cacheline_aligned_65433 xpc_kzalloc_cacheline_aligned 1 65433 NULL
-+drm_fb_helper_init_crtc_count_32666 drm_fb_helper_init_crtc_count 2-3 32666 NULL
-+fbcon_do_set_font_4079 fbcon_do_set_font 2-3 4079 NULL
-+move_addr_to_kernel_32673 move_addr_to_kernel 2 32673 NULL
-+stk_allocate_buffers_16291 stk_allocate_buffers 2 16291 NULL
-+__cxio_init_resource_fifo_16295 __cxio_init_resource_fifo 3 16295 NULL
-+hid_input_report_32458 hid_input_report 4 32458 NULL
-+rsc_mgr_init_16299 rsc_mgr_init 3 16299 NULL
-+venus_lookup_8121 venus_lookup 4 8121 NULL
-+ccid3_hc_tx_getsockopt_16314 ccid3_hc_tx_getsockopt 3 16314 NULL
-+dmam_declare_coherent_memory_43679 dmam_declare_coherent_memory 4-2 43679 NULL
-+io_mapping_create_wc_1354 io_mapping_create_wc 1-2 1354 NULL
-+read_buf_20469 read_buf 2 20469 NULL
-+request_key_with_auxdata_24515 request_key_with_auxdata 4 24515 NULL
-+scsi_register_49094 scsi_register 2 49094 NULL
-+isdn_add_channels_40905 isdn_add_channels 3 40905 NULL
-+compat_do_readv_writev_49102 compat_do_readv_writev 4 49102 NULL
-+vol_cdev_write_40915 vol_cdev_write 3 40915 NULL
-+named_prepare_buf_24532 named_prepare_buf 2 24532 NULL
-+hdpvr_read_9273 hdpvr_read 3 9273 NULL
-+alloc_dr_65495 alloc_dr 2 65495 NULL
-+intel_i830_alloc_by_type_40921 intel_i830_alloc_by_type 1 40921 NULL
-+ftdi_elan_write_57309 ftdi_elan_write 3 57309 NULL
-+total_ps_buffered_read_16365 total_ps_buffered_read 3 16365 NULL
-+stats_read_ul_32751 stats_read_ul 3 32751 NULL
-+pt_read_49136 pt_read 3 49136 NULL
-+snd_vx_create_40948 snd_vx_create 4 40948 NULL
-+dbg_leb_write_20478 dbg_leb_write 5-4 20478 NULL
-+iscsi_tcp_conn_setup_16376 iscsi_tcp_conn_setup 2 16376 NULL
-+tracing_ctrl_write_42324 tracing_ctrl_write 3 42324 NULL nohasharray
-+hysdn_conf_read_42324 hysdn_conf_read 3 42324 &tracing_ctrl_write_42324
-+check_mirror_57342 check_mirror 2-1 57342 NULL nohasharray
-+usblp_read_57342 usblp_read 3 57342 &check_mirror_57342
-+atyfb_setup_generic_49151 atyfb_setup_generic 3 49151 NULL
-diff --git a/tools/gcc/size_overflow_plugin.c b/tools/gcc/size_overflow_plugin.c
-new file mode 100644
-index 0000000..792ee60
---- /dev/null
-+++ b/tools/gcc/size_overflow_plugin.c
-@@ -0,0 +1,1930 @@
-+/*
-+ * Copyright 2011, 2012 by Emese Revfy <re.emese@gmail.com>
-+ * Licensed under the GPL v2, or (at your option) v3
-+ *
-+ * Homepage:
-+ * http://www.grsecurity.net/~ephox/overflow_plugin/
-+ *
-+ * This plugin recomputes expressions of function arguments marked by a size_overflow attribute
-+ * with double integer precision (DImode/TImode for 32/64 bit integer types).
-+ * The recomputed argument is checked against TYPE_MAX and an event is logged on overflow and the triggering process is killed.
-+ *
-+ * Usage:
-+ * $ gcc -I`gcc -print-file-name=plugin`/include/c-family -I`gcc -print-file-name=plugin`/include -fPIC -shared -O2 -ggdb -Wall -W -Wno-missing-field-initializers -o size_overflow_plugin.so size_overflow_plugin.c
-+ * $ gcc -fplugin=size_overflow_plugin.so test.c -O2
-+ */
-+
-+#include "gcc-plugin.h"
-+#include "config.h"
-+#include "system.h"
-+#include "coretypes.h"
-+#include "tree.h"
-+#include "tree-pass.h"
-+#include "intl.h"
-+#include "plugin-version.h"
-+#include "tm.h"
-+#include "toplev.h"
-+#include "function.h"
-+#include "tree-flow.h"
-+#include "plugin.h"
-+#include "gimple.h"
-+#include "c-common.h"
-+#include "diagnostic.h"
-+#include "cfgloop.h"
-+
-+#if BUILDING_GCC_VERSION >= 4007
-+#include "c-tree.h"
-+#else
-+#define C_DECL_IMPLICIT(EXP) DECL_LANG_FLAG_2 (EXP)
-+#endif
-+
-+struct size_overflow_hash {
-+ const struct size_overflow_hash * const next;
-+ const char * const name;
-+ const unsigned int param;
-+};
-+
-+#include "size_overflow_hash.h"
-+
-+enum marked {
-+ MARKED_NO, MARKED_YES, MARKED_NOT_INTENTIONAL
-+};
-+
-+static unsigned int call_count = 0;
-+
-+#define __unused __attribute__((__unused__))
-+#define NAME(node) IDENTIFIER_POINTER(DECL_NAME(node))
-+#define NAME_LEN(node) IDENTIFIER_LENGTH(DECL_NAME(node))
-+#define BEFORE_STMT true
-+#define AFTER_STMT false
-+#define CREATE_NEW_VAR NULL_TREE
-+#define CODES_LIMIT 32
-+#define MAX_PARAM 32
-+#define MY_STMT GF_PLF_1
-+#define NO_CAST_CHECK GF_PLF_2
-+
-+#if BUILDING_GCC_VERSION == 4005
-+#define DECL_CHAIN(NODE) (TREE_CHAIN(DECL_MINIMAL_CHECK(NODE)))
-+#endif
-+
-+int plugin_is_GPL_compatible;
-+void debug_gimple_stmt(gimple gs);
-+
-+static tree expand(struct pointer_set_t *visited, tree lhs);
-+static bool pre_expand(struct pointer_set_t *visited, const_tree lhs);
-+static tree report_size_overflow_decl;
-+static const_tree const_char_ptr_type_node;
-+static unsigned int handle_function(void);
-+static void check_size_overflow(gimple stmt, tree size_overflow_type, tree cast_rhs, tree rhs, bool before);
-+static tree get_size_overflow_type(gimple stmt, const_tree node);
-+static tree dup_assign(struct pointer_set_t *visited, gimple oldstmt, const_tree node, tree rhs1, tree rhs2, tree __unused rhs3);
-+
-+static struct plugin_info size_overflow_plugin_info = {
-+ .version = "20130109beta",
-+ .help = "no-size-overflow\tturn off size overflow checking\n",
-+};
-+
-+static tree handle_size_overflow_attribute(tree *node, tree __unused name, tree args, int __unused flags, bool *no_add_attrs)
-+{
-+ unsigned int arg_count;
-+ enum tree_code code = TREE_CODE(*node);
-+
-+ switch (code) {
-+ case FUNCTION_DECL:
-+ arg_count = type_num_arguments(TREE_TYPE(*node));
-+ break;
-+ case FUNCTION_TYPE:
-+ case METHOD_TYPE:
-+ arg_count = type_num_arguments(*node);
-+ break;
-+ default:
-+ *no_add_attrs = true;
-+ error("%s: %qE attribute only applies to functions", __func__, name);
-+ return NULL_TREE;
-+ }
-+
-+ for (; args; args = TREE_CHAIN(args)) {
-+ tree position = TREE_VALUE(args);
-+ if (TREE_CODE(position) != INTEGER_CST || TREE_INT_CST_HIGH(position) || TREE_INT_CST_LOW(position) < 1 || TREE_INT_CST_LOW(position) > arg_count ) {
-+ error("%s: parameter %u is outside range.", __func__, (unsigned int)TREE_INT_CST_LOW(position));
-+ *no_add_attrs = true;
-+ }
-+ }
-+ return NULL_TREE;
-+}
-+
-+static const char* get_asm_name(tree node)
-+{
-+ return IDENTIFIER_POINTER(DECL_ASSEMBLER_NAME(node));
-+}
-+
-+static tree handle_intentional_overflow_attribute(tree *node, tree __unused name, tree args, int __unused flags, bool *no_add_attrs)
-+{
-+ unsigned int arg_count, arg_num;
-+ enum tree_code code = TREE_CODE(*node);
-+
-+ switch (code) {
-+ case FUNCTION_DECL:
-+ arg_count = type_num_arguments(TREE_TYPE(*node));
-+ break;
-+ case FUNCTION_TYPE:
-+ case METHOD_TYPE:
-+ arg_count = type_num_arguments(*node);
-+ break;
-+ case FIELD_DECL:
-+ arg_num = TREE_INT_CST_LOW(TREE_VALUE(args));
-+ if (arg_num != 0) {
-+ *no_add_attrs = true;
-+ error("%s: %qE attribute parameter can only be 0 in structure fields", __func__, name);
-+ }
-+ return NULL_TREE;
-+ default:
-+ *no_add_attrs = true;
-+ error("%qE attribute only applies to functions", name);
-+ return NULL_TREE;
-+ }
-+
-+ for (; args; args = TREE_CHAIN(args)) {
-+ tree position = TREE_VALUE(args);
-+ if (TREE_CODE(position) != INTEGER_CST || TREE_INT_CST_HIGH(position) || TREE_INT_CST_LOW(position) > arg_count ) {
-+ error("%s: parameter %u is outside range.", __func__, (unsigned int)TREE_INT_CST_LOW(position));
-+ *no_add_attrs = true;
-+ }
-+ }
-+ return NULL_TREE;
-+}
-+
-+static struct attribute_spec size_overflow_attr = {
-+ .name = "size_overflow",
-+ .min_length = 1,
-+ .max_length = -1,
-+ .decl_required = true,
-+ .type_required = false,
-+ .function_type_required = false,
-+ .handler = handle_size_overflow_attribute,
-+#if BUILDING_GCC_VERSION >= 4007
-+ .affects_type_identity = false
-+#endif
-+};
-+
-+static struct attribute_spec intentional_overflow_attr = {
-+ .name = "intentional_overflow",
-+ .min_length = 1,
-+ .max_length = -1,
-+ .decl_required = true,
-+ .type_required = false,
-+ .function_type_required = false,
-+ .handler = handle_intentional_overflow_attribute,
-+#if BUILDING_GCC_VERSION >= 4007
-+ .affects_type_identity = false
-+#endif
-+};
-+
-+static void register_attributes(void __unused *event_data, void __unused *data)
-+{
-+ register_attribute(&size_overflow_attr);
-+ register_attribute(&intentional_overflow_attr);
-+}
-+
-+// http://www.team5150.com/~andrew/noncryptohashzoo2~/CrapWow.html
-+static unsigned int CrapWow(const char *key, unsigned int len, unsigned int seed)
-+{
-+#define cwfold( a, b, lo, hi ) { p = (unsigned int)(a) * (unsigned long long)(b); lo ^= (unsigned int)p; hi ^= (unsigned int)(p >> 32); }
-+#define cwmixa( in ) { cwfold( in, m, k, h ); }
-+#define cwmixb( in ) { cwfold( in, n, h, k ); }
-+
-+ unsigned int m = 0x57559429;
-+ unsigned int n = 0x5052acdb;
-+ const unsigned int *key4 = (const unsigned int *)key;
-+ unsigned int h = len;
-+ unsigned int k = len + seed + n;
-+ unsigned long long p;
-+
-+ while (len >= 8) {
-+ cwmixb(key4[0]) cwmixa(key4[1]) key4 += 2;
-+ len -= 8;
-+ }
-+ if (len >= 4) {
-+ cwmixb(key4[0]) key4 += 1;
-+ len -= 4;
-+ }
-+ if (len)
-+ cwmixa(key4[0] & ((1 << (len * 8)) - 1 ));
-+ cwmixb(h ^ (k + n));
-+ return k ^ h;
-+
-+#undef cwfold
-+#undef cwmixa
-+#undef cwmixb
-+}
-+
-+static inline unsigned int get_hash_num(const char *fndecl, const char *tree_codes, unsigned int len, unsigned int seed)
-+{
-+ unsigned int fn = CrapWow(fndecl, strlen(fndecl), seed) & 0xffff;
-+ unsigned int codes = CrapWow(tree_codes, len, seed) & 0xffff;
-+ return fn ^ codes;
-+}
-+
-+static inline tree get_original_function_decl(tree fndecl)
-+{
-+ if (DECL_ABSTRACT_ORIGIN(fndecl))
-+ return DECL_ABSTRACT_ORIGIN(fndecl);
-+ return fndecl;
-+}
-+
-+static inline gimple get_def_stmt(const_tree node)
-+{
-+ gcc_assert(node != NULL_TREE);
-+ gcc_assert(TREE_CODE(node) == SSA_NAME);
-+ return SSA_NAME_DEF_STMT(node);
-+}
-+
-+static unsigned char get_tree_code(const_tree type)
-+{
-+ switch (TREE_CODE(type)) {
-+ case ARRAY_TYPE:
-+ return 0;
-+ case BOOLEAN_TYPE:
-+ return 1;
-+ case ENUMERAL_TYPE:
-+ return 2;
-+ case FUNCTION_TYPE:
-+ return 3;
-+ case INTEGER_TYPE:
-+ return 4;
-+ case POINTER_TYPE:
-+ return 5;
-+ case RECORD_TYPE:
-+ return 6;
-+ case UNION_TYPE:
-+ return 7;
-+ case VOID_TYPE:
-+ return 8;
-+ case REAL_TYPE:
-+ return 9;
-+ case VECTOR_TYPE:
-+ return 10;
-+ case REFERENCE_TYPE:
-+ return 11;
-+ case OFFSET_TYPE:
-+ return 12;
-+ case COMPLEX_TYPE:
-+ return 13;
-+ default:
-+ debug_tree((tree)type);
-+ gcc_unreachable();
-+ }
-+}
-+
-+static size_t add_type_codes(const_tree type, unsigned char *tree_codes, size_t len)
-+{
-+ gcc_assert(type != NULL_TREE);
-+
-+ while (type && len < CODES_LIMIT) {
-+ tree_codes[len] = get_tree_code(type);
-+ len++;
-+ type = TREE_TYPE(type);
-+ }
-+ return len;
-+}
-+
-+static unsigned int get_function_decl(const_tree fndecl, unsigned char *tree_codes)
-+{
-+ const_tree arg, result, arg_field, type = TREE_TYPE(fndecl);
-+ enum tree_code code = TREE_CODE(type);
-+ size_t len = 0;
-+
-+ gcc_assert(code == FUNCTION_TYPE || code == METHOD_TYPE);
-+
-+ arg = TYPE_ARG_TYPES(type);
-+ // skip builtins __builtin_constant_p
-+ if (!arg && DECL_BUILT_IN(fndecl))
-+ return 0;
-+
-+ if (TREE_CODE_CLASS(code) == tcc_type)
-+ result = type;
-+ else
-+ result = DECL_RESULT(fndecl);
-+
-+ gcc_assert(result != NULL_TREE);
-+ len = add_type_codes(TREE_TYPE(result), tree_codes, len);
-+
-+ if (arg == NULL_TREE) {
-+ gcc_assert(CODE_CONTAINS_STRUCT(TREE_CODE(fndecl), TS_DECL_NON_COMMON));
-+ arg_field = DECL_ARGUMENT_FLD(fndecl);
-+ if (arg_field == NULL_TREE)
-+ return 0;
-+ arg = TREE_TYPE(arg_field);
-+ len = add_type_codes(arg, tree_codes, len);
-+ gcc_assert(len != 0);
-+ return len;
-+ }
-+
-+ gcc_assert(arg != NULL_TREE && TREE_CODE(arg) == TREE_LIST);
-+ while (arg && len < CODES_LIMIT) {
-+ len = add_type_codes(TREE_VALUE(arg), tree_codes, len);
-+ arg = TREE_CHAIN(arg);
-+ }
-+
-+ gcc_assert(len != 0);
-+ return len;
-+}
-+
-+static const struct size_overflow_hash *get_function_hash(tree fndecl)
-+{
-+ unsigned int hash;
-+ const struct size_overflow_hash *entry;
-+ unsigned char tree_codes[CODES_LIMIT];
-+ size_t len;
-+ const char *func_name = get_asm_name(fndecl);
-+
-+ len = get_function_decl(fndecl, tree_codes);
-+ if (len == 0)
-+ return NULL;
-+
-+ hash = get_hash_num(func_name, (const char*) tree_codes, len, 0);
-+
-+ entry = size_overflow_hash[hash];
-+ while (entry) {
-+ if (!strcmp(entry->name, func_name))
-+ return entry;
-+ entry = entry->next;
-+ }
-+
-+ return NULL;
-+}
-+
-+static void check_arg_type(const_tree arg)
-+{
-+ const_tree type = TREE_TYPE(arg);
-+ enum tree_code code = TREE_CODE(type);
-+
-+ if (code == BOOLEAN_TYPE)
-+ return;
-+
-+ gcc_assert(code == INTEGER_TYPE || code == ENUMERAL_TYPE ||
-+ (code == POINTER_TYPE && TREE_CODE(TREE_TYPE(type)) == VOID_TYPE) ||
-+ (code == POINTER_TYPE && TREE_CODE(TREE_TYPE(type)) == INTEGER_TYPE));
-+}
-+
-+static unsigned int find_arg_number(const_tree arg, tree func)
-+{
-+ tree var;
-+ unsigned int argnum = 1;
-+
-+ if (TREE_CODE(arg) == SSA_NAME)
-+ arg = SSA_NAME_VAR(arg);
-+
-+ for (var = DECL_ARGUMENTS(func); var; var = TREE_CHAIN(var)) {
-+ if (strcmp(NAME(arg), NAME(var))) {
-+ argnum++;
-+ continue;
-+ }
-+ check_arg_type(var);
-+ return argnum;
-+ }
-+ gcc_unreachable();
-+}
-+
-+static tree create_new_var(tree type)
-+{
-+ tree new_var = create_tmp_var(type, "cicus");
-+
-+ add_referenced_var(new_var);
-+ mark_sym_for_renaming(new_var);
-+ return new_var;
-+}
-+
-+static gimple create_binary_assign(enum tree_code code, gimple stmt, tree rhs1, tree rhs2)
-+{
-+ gimple assign;
-+ gimple_stmt_iterator gsi = gsi_for_stmt(stmt);
-+ tree type = TREE_TYPE(rhs1);
-+ tree lhs = create_new_var(type);
-+
-+ gcc_assert(types_compatible_p(type, TREE_TYPE(rhs2)));
-+ assign = gimple_build_assign_with_ops(code, lhs, rhs1, rhs2);
-+ gimple_set_lhs(assign, make_ssa_name(lhs, assign));
-+
-+ gsi_insert_before(&gsi, assign, GSI_NEW_STMT);
-+ update_stmt(assign);
-+ gimple_set_plf(assign, MY_STMT, true);
-+ return assign;
-+}
-+
-+static bool is_bool(const_tree node)
-+{
-+ const_tree type;
-+
-+ if (node == NULL_TREE)
-+ return false;
-+
-+ type = TREE_TYPE(node);
-+ if (!INTEGRAL_TYPE_P(type))
-+ return false;
-+ if (TREE_CODE(type) == BOOLEAN_TYPE)
-+ return true;
-+ if (TYPE_PRECISION(type) == 1)
-+ return true;
-+ return false;
-+}
-+
-+static tree cast_a_tree(tree type, tree var)
-+{
-+ gcc_assert(type != NULL_TREE);
-+ gcc_assert(var != NULL_TREE);
-+ gcc_assert(fold_convertible_p(type, var));
-+
-+ return fold_convert(type, var);
-+}
-+
-+static gimple build_cast_stmt(tree dst_type, tree rhs, tree lhs, gimple_stmt_iterator *gsi, bool before)
-+{
-+ gimple assign;
-+
-+ gcc_assert(dst_type != NULL_TREE && rhs != NULL_TREE);
-+ if (gsi_end_p(*gsi) && before == AFTER_STMT)
-+ gcc_unreachable();
-+
-+ if (lhs == CREATE_NEW_VAR)
-+ lhs = create_new_var(dst_type);
-+
-+ assign = gimple_build_assign(lhs, cast_a_tree(dst_type, rhs));
-+
-+ if (!gsi_end_p(*gsi)) {
-+ location_t loc = gimple_location(gsi_stmt(*gsi));
-+ gimple_set_location(assign, loc);
-+ }
-+
-+ gimple_set_lhs(assign, make_ssa_name(lhs, assign));
-+
-+ if (before)
-+ gsi_insert_before(gsi, assign, GSI_NEW_STMT);
-+ else
-+ gsi_insert_after(gsi, assign, GSI_NEW_STMT);
-+ update_stmt(assign);
-+ gimple_set_plf(assign, MY_STMT, true);
-+
-+ return assign;
-+}
-+
-+static tree cast_to_new_size_overflow_type(gimple stmt, tree rhs, tree size_overflow_type, bool before)
-+{
-+ gimple assign;
-+ gimple_stmt_iterator gsi;
-+
-+ if (rhs == NULL_TREE)
-+ return NULL_TREE;
-+
-+ if (types_compatible_p(TREE_TYPE(rhs), size_overflow_type) && gimple_plf(stmt, MY_STMT))
-+ return rhs;
-+
-+ gsi = gsi_for_stmt(stmt);
-+ assign = build_cast_stmt(size_overflow_type, rhs, CREATE_NEW_VAR, &gsi, before);
-+ gimple_set_plf(assign, MY_STMT, true);
-+ return gimple_get_lhs(assign);
-+}
-+
-+static tree cast_to_TI_type(gimple stmt, tree node)
-+{
-+ gimple_stmt_iterator gsi;
-+ gimple cast_stmt;
-+ tree type = TREE_TYPE(node);
-+
-+ if (types_compatible_p(type, intTI_type_node))
-+ return node;
-+
-+ gsi = gsi_for_stmt(stmt);
-+ cast_stmt = build_cast_stmt(intTI_type_node, node, CREATE_NEW_VAR, &gsi, BEFORE_STMT);
-+ gimple_set_plf(cast_stmt, MY_STMT, true);
-+ return gimple_get_lhs(cast_stmt);
-+}
-+
-+static tree create_assign(struct pointer_set_t *visited, gimple oldstmt, tree rhs1, bool before)
-+{
-+ tree lhs;
-+ gimple_stmt_iterator gsi;
-+
-+ if (rhs1 == NULL_TREE) {
-+ debug_gimple_stmt(oldstmt);
-+ error("%s: rhs1 is NULL_TREE", __func__);
-+ gcc_unreachable();
-+ }
-+
-+ switch (gimple_code(oldstmt)) {
-+ case GIMPLE_ASM:
-+ lhs = rhs1;
-+ break;
-+ case GIMPLE_CALL:
-+ lhs = gimple_call_lhs(oldstmt);
-+ break;
-+ case GIMPLE_ASSIGN:
-+ lhs = gimple_get_lhs(oldstmt);
-+ break;
-+ default:
-+ debug_gimple_stmt(oldstmt);
-+ gcc_unreachable();
-+ }
-+
-+ gsi = gsi_for_stmt(oldstmt);
-+ pointer_set_insert(visited, oldstmt);
-+ if (lookup_stmt_eh_lp(oldstmt) != 0) {
-+ basic_block next_bb, cur_bb;
-+ const_edge e;
-+
-+ gcc_assert(before == false);
-+ gcc_assert(stmt_can_throw_internal(oldstmt));
-+ gcc_assert(gimple_code(oldstmt) == GIMPLE_CALL);
-+ gcc_assert(!gsi_end_p(gsi));
-+
-+ cur_bb = gimple_bb(oldstmt);
-+ next_bb = cur_bb->next_bb;
-+ e = find_edge(cur_bb, next_bb);
-+ gcc_assert(e != NULL);
-+ gcc_assert(e->flags & EDGE_FALLTHRU);
-+
-+ gsi = gsi_after_labels(next_bb);
-+ gcc_assert(!gsi_end_p(gsi));
-+
-+ before = true;
-+ oldstmt = gsi_stmt(gsi);
-+ }
-+
-+ return cast_to_new_size_overflow_type(oldstmt, rhs1, get_size_overflow_type(oldstmt, lhs), before);
-+}
-+
-+static tree dup_assign(struct pointer_set_t *visited, gimple oldstmt, const_tree node, tree rhs1, tree rhs2, tree __unused rhs3)
-+{
-+ gimple stmt;
-+ gimple_stmt_iterator gsi;
-+ tree size_overflow_type, new_var, lhs = gimple_get_lhs(oldstmt);
-+
-+ if (gimple_plf(oldstmt, MY_STMT))
-+ return lhs;
-+
-+ if (gimple_num_ops(oldstmt) != 4 && rhs1 == NULL_TREE) {
-+ rhs1 = gimple_assign_rhs1(oldstmt);
-+ rhs1 = create_assign(visited, oldstmt, rhs1, BEFORE_STMT);
-+ }
-+ if (gimple_num_ops(oldstmt) == 3 && rhs2 == NULL_TREE) {
-+ rhs2 = gimple_assign_rhs2(oldstmt);
-+ rhs2 = create_assign(visited, oldstmt, rhs2, BEFORE_STMT);
-+ }
-+
-+ stmt = gimple_copy(oldstmt);
-+ gimple_set_location(stmt, gimple_location(oldstmt));
-+ gimple_set_plf(stmt, MY_STMT, true);
-+
-+ if (gimple_assign_rhs_code(oldstmt) == WIDEN_MULT_EXPR)
-+ gimple_assign_set_rhs_code(stmt, MULT_EXPR);
-+
-+ size_overflow_type = get_size_overflow_type(oldstmt, node);
-+
-+ if (is_bool(lhs))
-+ new_var = SSA_NAME_VAR(lhs);
-+ else
-+ new_var = create_new_var(size_overflow_type);
-+ new_var = make_ssa_name(new_var, stmt);
-+ gimple_set_lhs(stmt, new_var);
-+
-+ if (rhs1 != NULL_TREE)
-+ gimple_assign_set_rhs1(stmt, rhs1);
-+
-+ if (rhs2 != NULL_TREE)
-+ gimple_assign_set_rhs2(stmt, rhs2);
-+#if BUILDING_GCC_VERSION >= 4007
-+ if (rhs3 != NULL_TREE)
-+ gimple_assign_set_rhs3(stmt, rhs3);
-+#endif
-+ gimple_set_vuse(stmt, gimple_vuse(oldstmt));
-+ gimple_set_vdef(stmt, gimple_vdef(oldstmt));
-+
-+ gsi = gsi_for_stmt(oldstmt);
-+ gsi_insert_after(&gsi, stmt, GSI_SAME_STMT);
-+ update_stmt(stmt);
-+ pointer_set_insert(visited, oldstmt);
-+ return gimple_get_lhs(stmt);
-+}
-+
-+static gimple overflow_create_phi_node(gimple oldstmt, tree result)
-+{
-+ basic_block bb;
-+ gimple phi;
-+ gimple_stmt_iterator gsi = gsi_for_stmt(oldstmt);
-+
-+ bb = gsi_bb(gsi);
-+
-+ phi = create_phi_node(result, bb);
-+ gsi = gsi_last(phi_nodes(bb));
-+ gsi_remove(&gsi, false);
-+
-+ gsi = gsi_for_stmt(oldstmt);
-+ gsi_insert_after(&gsi, phi, GSI_NEW_STMT);
-+ gimple_set_bb(phi, bb);
-+ gimple_set_plf(phi, MY_STMT, true);
-+ return phi;
-+}
-+
-+static basic_block create_a_first_bb(void)
-+{
-+ basic_block first_bb;
-+
-+ first_bb = split_block_after_labels(ENTRY_BLOCK_PTR)->dest;
-+ gcc_assert(dom_info_available_p(CDI_DOMINATORS));
-+ set_immediate_dominator(CDI_DOMINATORS, first_bb, ENTRY_BLOCK_PTR);
-+ return first_bb;
-+}
-+
-+static tree cast_old_phi_arg(gimple oldstmt, tree size_overflow_type, tree arg, tree new_var, unsigned int i)
-+{
-+ basic_block bb;
-+ const_gimple newstmt;
-+ gimple_stmt_iterator gsi;
-+ bool before = BEFORE_STMT;
-+
-+ if (TREE_CODE(arg) == SSA_NAME && gimple_code(get_def_stmt(arg)) != GIMPLE_NOP) {
-+ gsi = gsi_for_stmt(get_def_stmt(arg));
-+ newstmt = build_cast_stmt(size_overflow_type, arg, new_var, &gsi, AFTER_STMT);
-+ return gimple_get_lhs(newstmt);
-+ }
-+
-+ bb = gimple_phi_arg_edge(oldstmt, i)->src;
-+ gsi = gsi_after_labels(bb);
-+ if (bb->index == 0) {
-+ bb = create_a_first_bb();
-+ gsi = gsi_start_bb(bb);
-+ }
-+ newstmt = build_cast_stmt(size_overflow_type, arg, new_var, &gsi, before);
-+ return gimple_get_lhs(newstmt);
-+}
-+
-+static const_gimple handle_new_phi_arg(const_tree arg, tree new_var, tree new_rhs)
-+{
-+ gimple newstmt;
-+ gimple_stmt_iterator gsi;
-+ void (*gsi_insert)(gimple_stmt_iterator *, gimple, enum gsi_iterator_update);
-+ gimple def_newstmt = get_def_stmt(new_rhs);
-+
-+ gsi_insert = gsi_insert_after;
-+ gsi = gsi_for_stmt(def_newstmt);
-+
-+ switch (gimple_code(get_def_stmt(arg))) {
-+ case GIMPLE_PHI:
-+ newstmt = gimple_build_assign(new_var, new_rhs);
-+ gsi = gsi_after_labels(gimple_bb(def_newstmt));
-+ gsi_insert = gsi_insert_before;
-+ break;
-+ case GIMPLE_ASM:
-+ case GIMPLE_CALL:
-+ newstmt = gimple_build_assign(new_var, new_rhs);
-+ break;
-+ case GIMPLE_ASSIGN:
-+ newstmt = gimple_build_assign(new_var, gimple_get_lhs(def_newstmt));
-+ break;
-+ default:
-+ /* unknown gimple_code (handle_build_new_phi_arg) */
-+ gcc_unreachable();
-+ }
-+
-+ gimple_set_lhs(newstmt, make_ssa_name(new_var, newstmt));
-+ gsi_insert(&gsi, newstmt, GSI_NEW_STMT);
-+ gimple_set_plf(newstmt, MY_STMT, true);
-+ update_stmt(newstmt);
-+ return newstmt;
-+}
-+
-+static tree build_new_phi_arg(struct pointer_set_t *visited, tree size_overflow_type, tree arg, tree new_var)
-+{
-+ const_gimple newstmt;
-+ gimple def_stmt;
-+ tree new_rhs;
-+
-+ new_rhs = expand(visited, arg);
-+ if (new_rhs == NULL_TREE)
-+ return NULL_TREE;
-+
-+ def_stmt = get_def_stmt(new_rhs);
-+ if (gimple_code(def_stmt) == GIMPLE_NOP)
-+ return NULL_TREE;
-+ new_rhs = cast_to_new_size_overflow_type(def_stmt, new_rhs, size_overflow_type, AFTER_STMT);
-+
-+ newstmt = handle_new_phi_arg(arg, new_var, new_rhs);
-+ return gimple_get_lhs(newstmt);
-+}
-+
-+static tree build_new_phi(struct pointer_set_t *visited, tree orig_result)
-+{
-+ gimple phi, oldstmt = get_def_stmt(orig_result);
-+ tree new_result, size_overflow_type;
-+ unsigned int i;
-+ unsigned int n = gimple_phi_num_args(oldstmt);
-+
-+ size_overflow_type = get_size_overflow_type(oldstmt, orig_result);
-+
-+ new_result = create_new_var(size_overflow_type);
-+
-+ pointer_set_insert(visited, oldstmt);
-+ phi = overflow_create_phi_node(oldstmt, new_result);
-+ for (i = 0; i < n; i++) {
-+ tree arg, lhs;
-+
-+ arg = gimple_phi_arg_def(oldstmt, i);
-+ if (is_gimple_constant(arg))
-+ arg = cast_a_tree(size_overflow_type, arg);
-+ lhs = build_new_phi_arg(visited, size_overflow_type, arg, new_result);
-+ if (lhs == NULL_TREE)
-+ lhs = cast_old_phi_arg(oldstmt, size_overflow_type, arg, new_result, i);
-+ add_phi_arg(phi, lhs, gimple_phi_arg_edge(oldstmt, i), gimple_location(oldstmt));
-+ }
-+
-+ update_stmt(phi);
-+ return gimple_phi_result(phi);
-+}
-+
-+static tree change_assign_rhs(gimple stmt, const_tree orig_rhs, tree new_rhs)
-+{
-+ const_gimple assign;
-+ gimple_stmt_iterator gsi = gsi_for_stmt(stmt);
-+ tree origtype = TREE_TYPE(orig_rhs);
-+
-+ gcc_assert(gimple_code(stmt) == GIMPLE_ASSIGN);
-+
-+ assign = build_cast_stmt(origtype, new_rhs, CREATE_NEW_VAR, &gsi, BEFORE_STMT);
-+ return gimple_get_lhs(assign);
-+}
-+
-+static void change_rhs1(gimple stmt, tree new_rhs1)
-+{
-+ tree assign_rhs;
-+ const_tree rhs = gimple_assign_rhs1(stmt);
-+
-+ assign_rhs = change_assign_rhs(stmt, rhs, new_rhs1);
-+ gimple_assign_set_rhs1(stmt, assign_rhs);
-+ update_stmt(stmt);
-+}
-+
-+static bool check_mode_type(const_gimple stmt)
-+{
-+ const_tree lhs = gimple_get_lhs(stmt);
-+ const_tree lhs_type = TREE_TYPE(lhs);
-+ const_tree rhs_type = TREE_TYPE(gimple_assign_rhs1(stmt));
-+ enum machine_mode lhs_mode = TYPE_MODE(lhs_type);
-+ enum machine_mode rhs_mode = TYPE_MODE(rhs_type);
-+
-+ if (rhs_mode == lhs_mode && TYPE_UNSIGNED(rhs_type) == TYPE_UNSIGNED(lhs_type))
-+ return false;
-+
-+ if (rhs_mode == SImode && lhs_mode == DImode && (TYPE_UNSIGNED(rhs_type) || !TYPE_UNSIGNED(lhs_type)))
-+ return false;
-+
-+ // skip lhs check on signed SI -> HI cast or signed SI -> QI cast
-+ if (rhs_mode == SImode && !TYPE_UNSIGNED(rhs_type) && (lhs_mode == HImode || lhs_mode == QImode))
-+ return false;
-+
-+ return true;
-+}
-+
-+static bool check_undefined_integer_operation(const_gimple stmt)
-+{
-+ const_gimple def_stmt;
-+ const_tree lhs = gimple_get_lhs(stmt);
-+ const_tree rhs1 = gimple_assign_rhs1(stmt);
-+ const_tree rhs1_type = TREE_TYPE(rhs1);
-+ const_tree lhs_type = TREE_TYPE(lhs);
-+
-+ if (TYPE_MODE(rhs1_type) != TYPE_MODE(lhs_type) || TYPE_UNSIGNED(rhs1_type) == TYPE_UNSIGNED(lhs_type))
-+ return false;
-+
-+ def_stmt = get_def_stmt(rhs1);
-+ if (gimple_code(def_stmt) != GIMPLE_ASSIGN)
-+ return false;
-+
-+ if (gimple_assign_rhs_code(def_stmt) != MINUS_EXPR)
-+ return false;
-+ return true;
-+}
-+
-+static bool is_a_cast_and_const_overflow(const_tree no_const_rhs)
-+{
-+ const_tree rhs1, lhs, rhs1_type, lhs_type;
-+ enum machine_mode lhs_mode, rhs_mode;
-+ gimple def_stmt = get_def_stmt(no_const_rhs);
-+
-+ if (!gimple_assign_cast_p(def_stmt))
-+ return false;
-+
-+ rhs1 = gimple_assign_rhs1(def_stmt);
-+ lhs = gimple_get_lhs(def_stmt);
-+ rhs1_type = TREE_TYPE(rhs1);
-+ lhs_type = TREE_TYPE(lhs);
-+ rhs_mode = TYPE_MODE(rhs1_type);
-+ lhs_mode = TYPE_MODE(lhs_type);
-+ if (TYPE_UNSIGNED(lhs_type) == TYPE_UNSIGNED(rhs1_type) || lhs_mode != rhs_mode)
-+ return false;
-+
-+ return true;
-+}
-+
-+static tree create_cast_assign(struct pointer_set_t *visited, gimple stmt)
-+{
-+ tree rhs1 = gimple_assign_rhs1(stmt);
-+ tree lhs = gimple_get_lhs(stmt);
-+ const_tree rhs1_type = TREE_TYPE(rhs1);
-+ const_tree lhs_type = TREE_TYPE(lhs);
-+
-+ if (TYPE_UNSIGNED(rhs1_type) == TYPE_UNSIGNED(lhs_type))
-+ return create_assign(visited, stmt, lhs, AFTER_STMT);
-+
-+ return create_assign(visited, stmt, rhs1, AFTER_STMT);
-+}
-+
-+static tree handle_unary_rhs(struct pointer_set_t *visited, gimple stmt)
-+{
-+ tree size_overflow_type, lhs = gimple_get_lhs(stmt);
-+ tree new_rhs1 = NULL_TREE;
-+ tree rhs1 = gimple_assign_rhs1(stmt);
-+ const_tree rhs1_type = TREE_TYPE(rhs1);
-+ const_tree lhs_type = TREE_TYPE(lhs);
-+
-+ if (gimple_plf(stmt, MY_STMT))
-+ return lhs;
-+
-+ if (TREE_CODE(rhs1_type) == POINTER_TYPE)
-+ return create_assign(visited, stmt, lhs, AFTER_STMT);
-+
-+ new_rhs1 = expand(visited, rhs1);
-+
-+ if (new_rhs1 == NULL_TREE)
-+ return create_cast_assign(visited, stmt);
-+
-+ if (gimple_plf(stmt, NO_CAST_CHECK))
-+ return dup_assign(visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
-+
-+ if (gimple_assign_rhs_code(stmt) == BIT_NOT_EXPR) {
-+ size_overflow_type = get_size_overflow_type(stmt, rhs1);
-+ new_rhs1 = cast_to_new_size_overflow_type(stmt, new_rhs1, size_overflow_type, BEFORE_STMT);
-+ check_size_overflow(stmt, size_overflow_type, new_rhs1, rhs1, BEFORE_STMT);
-+ return create_assign(visited, stmt, lhs, AFTER_STMT);
-+ }
-+
-+ if (!gimple_assign_cast_p(stmt) || check_undefined_integer_operation(stmt))
-+ return dup_assign(visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
-+
-+ if (TYPE_UNSIGNED(rhs1_type) != TYPE_UNSIGNED(lhs_type))
-+ return dup_assign(visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
-+
-+ size_overflow_type = get_size_overflow_type(stmt, rhs1);
-+ new_rhs1 = cast_to_new_size_overflow_type(stmt, new_rhs1, size_overflow_type, BEFORE_STMT);
-+
-+ check_size_overflow(stmt, size_overflow_type, new_rhs1, rhs1, BEFORE_STMT);
-+
-+ change_rhs1(stmt, new_rhs1);
-+
-+ if (!check_mode_type(stmt))
-+ return create_assign(visited, stmt, lhs, AFTER_STMT);
-+
-+ size_overflow_type = get_size_overflow_type(stmt, lhs);
-+ new_rhs1 = cast_to_new_size_overflow_type(stmt, new_rhs1, size_overflow_type, BEFORE_STMT);
-+
-+ check_size_overflow(stmt, size_overflow_type, new_rhs1, lhs, BEFORE_STMT);
-+
-+ return create_assign(visited, stmt, lhs, AFTER_STMT);
-+}
-+
-+static tree handle_unary_ops(struct pointer_set_t *visited, gimple stmt)
-+{
-+ tree rhs1, lhs = gimple_get_lhs(stmt);
-+ gimple def_stmt = get_def_stmt(lhs);
-+
-+ gcc_assert(gimple_code(def_stmt) != GIMPLE_NOP);
-+ rhs1 = gimple_assign_rhs1(def_stmt);
-+
-+ if (is_gimple_constant(rhs1))
-+ return create_assign(visited, def_stmt, lhs, AFTER_STMT);
-+
-+ gcc_assert(TREE_CODE(rhs1) != COND_EXPR);
-+ switch (TREE_CODE(rhs1)) {
-+ case SSA_NAME:
-+ return handle_unary_rhs(visited, def_stmt);
-+ case ARRAY_REF:
-+ case BIT_FIELD_REF:
-+ case ADDR_EXPR:
-+ case COMPONENT_REF:
-+ case INDIRECT_REF:
-+#if BUILDING_GCC_VERSION >= 4006
-+ case MEM_REF:
-+#endif
-+ case TARGET_MEM_REF:
-+ return create_assign(visited, def_stmt, lhs, AFTER_STMT);
-+ case PARM_DECL:
-+ case VAR_DECL:
-+ return create_assign(visited, stmt, lhs, AFTER_STMT);
-+
-+ default:
-+ debug_gimple_stmt(def_stmt);
-+ debug_tree(rhs1);
-+ gcc_unreachable();
-+ }
-+}
-+
-+static void insert_cond(basic_block cond_bb, tree arg, enum tree_code cond_code, tree type_value)
-+{
-+ gimple cond_stmt;
-+ gimple_stmt_iterator gsi = gsi_last_bb(cond_bb);
-+
-+ cond_stmt = gimple_build_cond(cond_code, arg, type_value, NULL_TREE, NULL_TREE);
-+ gsi_insert_after(&gsi, cond_stmt, GSI_CONTINUE_LINKING);
-+ update_stmt(cond_stmt);
-+}
-+
-+static tree create_string_param(tree string)
-+{
-+ tree i_type, a_type;
-+ const int length = TREE_STRING_LENGTH(string);
-+
-+ gcc_assert(length > 0);
-+
-+ i_type = build_index_type(build_int_cst(NULL_TREE, length - 1));
-+ a_type = build_array_type(char_type_node, i_type);
-+
-+ TREE_TYPE(string) = a_type;
-+ TREE_CONSTANT(string) = 1;
-+ TREE_READONLY(string) = 1;
-+
-+ return build1(ADDR_EXPR, ptr_type_node, string);
-+}
-+
-+static void insert_cond_result(basic_block bb_true, const_gimple stmt, const_tree arg, bool min)
-+{
-+ gimple func_stmt;
-+ const_gimple def_stmt;
-+ const_tree loc_line;
-+ tree loc_file, ssa_name, current_func;
-+ expanded_location xloc;
-+ char *ssa_name_buf;
-+ int len;
-+ gimple_stmt_iterator gsi = gsi_start_bb(bb_true);
-+
-+ def_stmt = get_def_stmt(arg);
-+ xloc = expand_location(gimple_location(def_stmt));
-+
-+ if (!gimple_has_location(def_stmt)) {
-+ xloc = expand_location(gimple_location(stmt));
-+ if (!gimple_has_location(stmt))
-+ xloc = expand_location(DECL_SOURCE_LOCATION(current_function_decl));
-+ }
-+
-+ loc_line = build_int_cstu(unsigned_type_node, xloc.line);
-+
-+ loc_file = build_string(strlen(xloc.file) + 1, xloc.file);
-+ loc_file = create_string_param(loc_file);
-+
-+ current_func = build_string(NAME_LEN(current_function_decl) + 1, NAME(current_function_decl));
-+ current_func = create_string_param(current_func);
-+
-+ gcc_assert(DECL_NAME(SSA_NAME_VAR(arg)) != NULL);
-+ call_count++;
-+ len = asprintf(&ssa_name_buf, "%s_%u %s, count: %u\n", NAME(SSA_NAME_VAR(arg)), SSA_NAME_VERSION(arg), min ? "min" : "max", call_count);
-+ gcc_assert(len > 0);
-+ ssa_name = build_string(len + 1, ssa_name_buf);
-+ free(ssa_name_buf);
-+ ssa_name = create_string_param(ssa_name);
-+
-+ // void report_size_overflow(const char *file, unsigned int line, const char *func, const char *ssa_name)
-+ func_stmt = gimple_build_call(report_size_overflow_decl, 4, loc_file, loc_line, current_func, ssa_name);
-+
-+ gsi_insert_after(&gsi, func_stmt, GSI_CONTINUE_LINKING);
-+}
-+
-+static void __unused print_the_code_insertions(const_gimple stmt)
-+{
-+ location_t loc = gimple_location(stmt);
-+
-+ inform(loc, "Integer size_overflow check applied here.");
-+}
-+
-+static void insert_check_size_overflow(gimple stmt, enum tree_code cond_code, tree arg, tree type_value, bool before, bool min)
-+{
-+ basic_block cond_bb, join_bb, bb_true;
-+ edge e;
-+ gimple_stmt_iterator gsi = gsi_for_stmt(stmt);
-+
-+ cond_bb = gimple_bb(stmt);
-+ if (before)
-+ gsi_prev(&gsi);
-+ if (gsi_end_p(gsi))
-+ e = split_block_after_labels(cond_bb);
-+ else
-+ e = split_block(cond_bb, gsi_stmt(gsi));
-+ cond_bb = e->src;
-+ join_bb = e->dest;
-+ e->flags = EDGE_FALSE_VALUE;
-+ e->probability = REG_BR_PROB_BASE;
-+
-+ bb_true = create_empty_bb(cond_bb);
-+ make_edge(cond_bb, bb_true, EDGE_TRUE_VALUE);
-+ make_edge(cond_bb, join_bb, EDGE_FALSE_VALUE);
-+ make_edge(bb_true, join_bb, EDGE_FALLTHRU);
-+
-+ gcc_assert(dom_info_available_p(CDI_DOMINATORS));
-+ set_immediate_dominator(CDI_DOMINATORS, bb_true, cond_bb);
-+ set_immediate_dominator(CDI_DOMINATORS, join_bb, cond_bb);
-+
-+ if (current_loops != NULL) {
-+ gcc_assert(cond_bb->loop_father == join_bb->loop_father);
-+ add_bb_to_loop(bb_true, cond_bb->loop_father);
-+ }
-+
-+ insert_cond(cond_bb, arg, cond_code, type_value);
-+ insert_cond_result(bb_true, stmt, arg, min);
-+
-+// print_the_code_insertions(stmt);
-+}
-+
-+static void check_size_overflow(gimple stmt, tree size_overflow_type, tree cast_rhs, tree rhs, bool before)
-+{
-+ const_tree rhs_type = TREE_TYPE(rhs);
-+ tree cast_rhs_type, type_max_type, type_min_type, type_max, type_min;
-+
-+ gcc_assert(rhs_type != NULL_TREE);
-+ if (TREE_CODE(rhs_type) == POINTER_TYPE)
-+ return;
-+
-+ gcc_assert(TREE_CODE(rhs_type) == INTEGER_TYPE || TREE_CODE(rhs_type) == BOOLEAN_TYPE || TREE_CODE(rhs_type) == ENUMERAL_TYPE);
-+
-+ type_max = cast_a_tree(size_overflow_type, TYPE_MAX_VALUE(rhs_type));
-+ // typemax (-1) < typemin (0)
-+ if (TREE_OVERFLOW(type_max))
-+ return;
-+
-+ type_min = cast_a_tree(size_overflow_type, TYPE_MIN_VALUE(rhs_type));
-+
-+ cast_rhs_type = TREE_TYPE(cast_rhs);
-+ type_max_type = TREE_TYPE(type_max);
-+ type_min_type = TREE_TYPE(type_min);
-+ gcc_assert(types_compatible_p(cast_rhs_type, type_max_type));
-+ gcc_assert(types_compatible_p(type_max_type, type_min_type));
-+
-+ insert_check_size_overflow(stmt, GT_EXPR, cast_rhs, type_max, before, false);
-+ insert_check_size_overflow(stmt, LT_EXPR, cast_rhs, type_min, before, true);
-+}
-+
-+static tree get_size_overflow_type_for_intentional_overflow(gimple def_stmt, tree change_rhs)
-+{
-+ gimple change_rhs_def_stmt;
-+ tree lhs = gimple_get_lhs(def_stmt);
-+ tree lhs_type = TREE_TYPE(lhs);
-+ tree rhs1_type = TREE_TYPE(gimple_assign_rhs1(def_stmt));
-+ tree rhs2_type = TREE_TYPE(gimple_assign_rhs2(def_stmt));
-+
-+ if (change_rhs == NULL_TREE)
-+ return get_size_overflow_type(def_stmt, lhs);
-+
-+ change_rhs_def_stmt = get_def_stmt(change_rhs);
-+
-+ if (TREE_CODE_CLASS(gimple_assign_rhs_code(def_stmt)) == tcc_comparison)
-+ return get_size_overflow_type(change_rhs_def_stmt, change_rhs);
-+
-+ if (gimple_assign_rhs_code(def_stmt) == LSHIFT_EXPR)
-+ return get_size_overflow_type(change_rhs_def_stmt, change_rhs);
-+
-+ if (gimple_assign_rhs_code(def_stmt) == RSHIFT_EXPR)
-+ return get_size_overflow_type(change_rhs_def_stmt, change_rhs);
-+
-+ if (!types_compatible_p(lhs_type, rhs1_type) || !types_compatible_p(rhs1_type, rhs2_type)) {
-+ debug_gimple_stmt(def_stmt);
-+ gcc_unreachable();
-+ }
-+
-+ return get_size_overflow_type(def_stmt, lhs);
-+}
-+
-+static bool is_a_constant_overflow(const_gimple stmt, const_tree rhs)
-+{
-+ if (gimple_assign_rhs_code(stmt) == MIN_EXPR)
-+ return false;
-+ if (!is_gimple_constant(rhs))
-+ return false;
-+ return true;
-+}
-+
-+static bool is_subtraction_special(const_gimple stmt)
-+{
-+ gimple rhs1_def_stmt, rhs2_def_stmt;
-+ const_tree rhs1_def_stmt_rhs1, rhs2_def_stmt_rhs1, rhs1_def_stmt_lhs, rhs2_def_stmt_lhs;
-+ enum machine_mode rhs1_def_stmt_rhs1_mode, rhs2_def_stmt_rhs1_mode, rhs1_def_stmt_lhs_mode, rhs2_def_stmt_lhs_mode;
-+ const_tree rhs1 = gimple_assign_rhs1(stmt);
-+ const_tree rhs2 = gimple_assign_rhs2(stmt);
-+
-+ if (is_gimple_constant(rhs1) || is_gimple_constant(rhs2))
-+ return false;
-+
-+ gcc_assert(TREE_CODE(rhs1) == SSA_NAME && TREE_CODE(rhs2) == SSA_NAME);
-+
-+ if (gimple_assign_rhs_code(stmt) != MINUS_EXPR)
-+ return false;
-+
-+ rhs1_def_stmt = get_def_stmt(rhs1);
-+ rhs2_def_stmt = get_def_stmt(rhs2);
-+ if (!gimple_assign_cast_p(rhs1_def_stmt) || !gimple_assign_cast_p(rhs2_def_stmt))
-+ return false;
-+
-+ rhs1_def_stmt_rhs1 = gimple_assign_rhs1(rhs1_def_stmt);
-+ rhs2_def_stmt_rhs1 = gimple_assign_rhs1(rhs2_def_stmt);
-+ rhs1_def_stmt_lhs = gimple_get_lhs(rhs1_def_stmt);
-+ rhs2_def_stmt_lhs = gimple_get_lhs(rhs2_def_stmt);
-+ rhs1_def_stmt_rhs1_mode = TYPE_MODE(TREE_TYPE(rhs1_def_stmt_rhs1));
-+ rhs2_def_stmt_rhs1_mode = TYPE_MODE(TREE_TYPE(rhs2_def_stmt_rhs1));
-+ rhs1_def_stmt_lhs_mode = TYPE_MODE(TREE_TYPE(rhs1_def_stmt_lhs));
-+ rhs2_def_stmt_lhs_mode = TYPE_MODE(TREE_TYPE(rhs2_def_stmt_lhs));
-+ if (GET_MODE_BITSIZE(rhs1_def_stmt_rhs1_mode) <= GET_MODE_BITSIZE(rhs1_def_stmt_lhs_mode))
-+ return false;
-+ if (GET_MODE_BITSIZE(rhs2_def_stmt_rhs1_mode) <= GET_MODE_BITSIZE(rhs2_def_stmt_lhs_mode))
-+ return false;
-+
-+ gimple_set_plf(rhs1_def_stmt, NO_CAST_CHECK, true);
-+ gimple_set_plf(rhs2_def_stmt, NO_CAST_CHECK, true);
-+ return true;
-+}
-+
-+static tree get_def_stmt_rhs(const_tree var)
-+{
-+ tree rhs1, def_stmt_rhs1;
-+ gimple rhs1_def_stmt, def_stmt_rhs1_def_stmt, def_stmt;
-+
-+ def_stmt = get_def_stmt(var);
-+ gcc_assert(gimple_code(def_stmt) != GIMPLE_NOP && gimple_plf(def_stmt, MY_STMT) && gimple_assign_cast_p(def_stmt));
-+
-+ rhs1 = gimple_assign_rhs1(def_stmt);
-+ rhs1_def_stmt = get_def_stmt(rhs1);
-+ if (!gimple_assign_cast_p(rhs1_def_stmt))
-+ return rhs1;
-+
-+ def_stmt_rhs1 = gimple_assign_rhs1(rhs1_def_stmt);
-+ def_stmt_rhs1_def_stmt = get_def_stmt(def_stmt_rhs1);
-+
-+ switch (gimple_code(def_stmt_rhs1_def_stmt)) {
-+ case GIMPLE_CALL:
-+ case GIMPLE_NOP:
-+ case GIMPLE_ASM:
-+ return def_stmt_rhs1;
-+ case GIMPLE_ASSIGN:
-+ return rhs1;
-+ default:
-+ debug_gimple_stmt(def_stmt_rhs1_def_stmt);
-+ gcc_unreachable();
-+ }
-+}
-+
-+static tree handle_integer_truncation(struct pointer_set_t *visited, const_tree lhs)
-+{
-+ tree new_rhs1, new_rhs2;
-+ tree new_rhs1_def_stmt_rhs1, new_rhs2_def_stmt_rhs1, new_lhs;
-+ gimple assign, stmt = get_def_stmt(lhs);
-+ tree rhs1 = gimple_assign_rhs1(stmt);
-+ tree rhs2 = gimple_assign_rhs2(stmt);
-+
-+ if (!is_subtraction_special(stmt))
-+ return NULL_TREE;
-+
-+ new_rhs1 = expand(visited, rhs1);
-+ new_rhs2 = expand(visited, rhs2);
-+
-+ new_rhs1_def_stmt_rhs1 = get_def_stmt_rhs(new_rhs1);
-+ new_rhs2_def_stmt_rhs1 = get_def_stmt_rhs(new_rhs2);
-+
-+ if (!types_compatible_p(TREE_TYPE(new_rhs1_def_stmt_rhs1), TREE_TYPE(new_rhs2_def_stmt_rhs1))) {
-+ new_rhs1_def_stmt_rhs1 = cast_to_TI_type(stmt, new_rhs1_def_stmt_rhs1);
-+ new_rhs2_def_stmt_rhs1 = cast_to_TI_type(stmt, new_rhs2_def_stmt_rhs1);
-+ }
-+
-+ assign = create_binary_assign(MINUS_EXPR, stmt, new_rhs1_def_stmt_rhs1, new_rhs2_def_stmt_rhs1);
-+ new_lhs = gimple_get_lhs(assign);
-+ check_size_overflow(assign, TREE_TYPE(new_lhs), new_lhs, rhs1, AFTER_STMT);
-+
-+ return dup_assign(visited, stmt, lhs, new_rhs1, new_rhs2, NULL_TREE);
-+}
-+
-+static bool is_a_neg_overflow(const_gimple stmt, const_tree rhs)
-+{
-+ const_gimple def_stmt;
-+
-+ if (TREE_CODE(rhs) != SSA_NAME)
-+ return false;
-+
-+ if (gimple_assign_rhs_code(stmt) != PLUS_EXPR)
-+ return false;
-+
-+ def_stmt = get_def_stmt(rhs);
-+ if (gimple_code(def_stmt) != GIMPLE_ASSIGN || gimple_assign_rhs_code(def_stmt) != BIT_NOT_EXPR)
-+ return false;
-+
-+ return true;
-+}
-+
-+static tree handle_intentional_overflow(struct pointer_set_t *visited, bool check_overflow, gimple stmt, tree change_rhs, tree new_rhs1, tree new_rhs2)
-+{
-+ tree new_rhs, size_overflow_type, orig_rhs;
-+ void (*gimple_assign_set_rhs)(gimple, tree);
-+ tree rhs1 = gimple_assign_rhs1(stmt);
-+ tree rhs2 = gimple_assign_rhs2(stmt);
-+ tree lhs = gimple_get_lhs(stmt);
-+
-+ if (change_rhs == NULL_TREE)
-+ return create_assign(visited, stmt, lhs, AFTER_STMT);
-+
-+ if (new_rhs2 == NULL_TREE) {
-+ size_overflow_type = get_size_overflow_type_for_intentional_overflow(stmt, new_rhs1);
-+ new_rhs2 = cast_a_tree(size_overflow_type, rhs2);
-+ orig_rhs = rhs1;
-+ gimple_assign_set_rhs = &gimple_assign_set_rhs1;
-+ } else {
-+ size_overflow_type = get_size_overflow_type_for_intentional_overflow(stmt, new_rhs2);
-+ new_rhs1 = cast_a_tree(size_overflow_type, rhs1);
-+ orig_rhs = rhs2;
-+ gimple_assign_set_rhs = &gimple_assign_set_rhs2;
-+ }
-+
-+ change_rhs = cast_to_new_size_overflow_type(stmt, change_rhs, size_overflow_type, BEFORE_STMT);
-+
-+ if (check_overflow)
-+ check_size_overflow(stmt, size_overflow_type, change_rhs, orig_rhs, BEFORE_STMT);
-+
-+ new_rhs = change_assign_rhs(stmt, orig_rhs, change_rhs);
-+ gimple_assign_set_rhs(stmt, new_rhs);
-+ update_stmt(stmt);
-+
-+ return create_assign(visited, stmt, lhs, AFTER_STMT);
-+}
-+
-+static tree handle_binary_ops(struct pointer_set_t *visited, tree lhs)
-+{
-+ tree rhs1, rhs2, new_lhs;
-+ gimple def_stmt = get_def_stmt(lhs);
-+ tree new_rhs1 = NULL_TREE;
-+ tree new_rhs2 = NULL_TREE;
-+
-+ rhs1 = gimple_assign_rhs1(def_stmt);
-+ rhs2 = gimple_assign_rhs2(def_stmt);
-+
-+ /* no DImode/TImode division in the 32/64 bit kernel */
-+ switch (gimple_assign_rhs_code(def_stmt)) {
-+ case RDIV_EXPR:
-+ case TRUNC_DIV_EXPR:
-+ case CEIL_DIV_EXPR:
-+ case FLOOR_DIV_EXPR:
-+ case ROUND_DIV_EXPR:
-+ case TRUNC_MOD_EXPR:
-+ case CEIL_MOD_EXPR:
-+ case FLOOR_MOD_EXPR:
-+ case ROUND_MOD_EXPR:
-+ case EXACT_DIV_EXPR:
-+ case POINTER_PLUS_EXPR:
-+ case BIT_AND_EXPR:
-+ return create_assign(visited, def_stmt, lhs, AFTER_STMT);
-+ default:
-+ break;
-+ }
-+
-+ new_lhs = handle_integer_truncation(visited, lhs);
-+ if (new_lhs != NULL_TREE)
-+ return new_lhs;
-+
-+ if (TREE_CODE(rhs1) == SSA_NAME)
-+ new_rhs1 = expand(visited, rhs1);
-+ if (TREE_CODE(rhs2) == SSA_NAME)
-+ new_rhs2 = expand(visited, rhs2);
-+
-+ if (is_a_neg_overflow(def_stmt, rhs2))
-+ return handle_intentional_overflow(visited, true, def_stmt, new_rhs1, new_rhs1, NULL_TREE);
-+ if (is_a_neg_overflow(def_stmt, rhs1))
-+ return handle_intentional_overflow(visited, true, def_stmt, new_rhs2, NULL_TREE, new_rhs2);
-+
-+ if (is_a_constant_overflow(def_stmt, rhs2))
-+ return handle_intentional_overflow(visited, !is_a_cast_and_const_overflow(rhs1), def_stmt, new_rhs1, new_rhs1, NULL_TREE);
-+ if (is_a_constant_overflow(def_stmt, rhs1))
-+ return handle_intentional_overflow(visited, !is_a_cast_and_const_overflow(rhs2), def_stmt, new_rhs2, NULL_TREE, new_rhs2);
-+
-+ return dup_assign(visited, def_stmt, lhs, new_rhs1, new_rhs2, NULL_TREE);
-+}
-+
-+#if BUILDING_GCC_VERSION >= 4007
-+static tree get_new_rhs(struct pointer_set_t *visited, tree size_overflow_type, tree rhs)
-+{
-+ if (is_gimple_constant(rhs))
-+ return cast_a_tree(size_overflow_type, rhs);
-+ if (TREE_CODE(rhs) != SSA_NAME)
-+ return NULL_TREE;
-+ return expand(visited, rhs);
-+}
-+
-+static tree handle_ternary_ops(struct pointer_set_t *visited, tree lhs)
-+{
-+ tree rhs1, rhs2, rhs3, new_rhs1, new_rhs2, new_rhs3, size_overflow_type;
-+ gimple def_stmt = get_def_stmt(lhs);
-+
-+ size_overflow_type = get_size_overflow_type(def_stmt, lhs);
-+
-+ rhs1 = gimple_assign_rhs1(def_stmt);
-+ rhs2 = gimple_assign_rhs2(def_stmt);
-+ rhs3 = gimple_assign_rhs3(def_stmt);
-+ new_rhs1 = get_new_rhs(visited, size_overflow_type, rhs1);
-+ new_rhs2 = get_new_rhs(visited, size_overflow_type, rhs2);
-+ new_rhs3 = get_new_rhs(visited, size_overflow_type, rhs3);
-+
-+ return dup_assign(visited, def_stmt, lhs, new_rhs1, new_rhs2, new_rhs3);
-+}
-+#endif
-+
-+static tree get_size_overflow_type(gimple stmt, const_tree node)
-+{
-+ const_tree type;
-+ tree new_type;
-+
-+ gcc_assert(node != NULL_TREE);
-+
-+ type = TREE_TYPE(node);
-+
-+ if (gimple_plf(stmt, MY_STMT))
-+ return TREE_TYPE(node);
-+
-+ switch (TYPE_MODE(type)) {
-+ case QImode:
-+ new_type = intHI_type_node;
-+ break;
-+ case HImode:
-+ new_type = intSI_type_node;
-+ break;
-+ case SImode:
-+ new_type = intDI_type_node;
-+ break;
-+ case DImode:
-+ if (LONG_TYPE_SIZE == GET_MODE_BITSIZE(SImode))
-+ new_type = intDI_type_node;
-+ else
-+ new_type = intTI_type_node;
-+ break;
-+ default:
-+ debug_tree((tree)node);
-+ error("%s: unsupported gcc configuration.", __func__);
-+ gcc_unreachable();
-+ }
-+
-+ if (TYPE_QUALS(type) != 0)
-+ return build_qualified_type(new_type, TYPE_QUALS(type));
-+ return new_type;
-+}
-+
-+static tree expand_visited(gimple def_stmt)
-+{
-+ const_gimple next_stmt;
-+ gimple_stmt_iterator gsi = gsi_for_stmt(def_stmt);
-+
-+ gsi_next(&gsi);
-+ next_stmt = gsi_stmt(gsi);
-+
-+ gcc_assert(gimple_plf((gimple)next_stmt, MY_STMT));
-+
-+ switch (gimple_code(next_stmt)) {
-+ case GIMPLE_ASSIGN:
-+ return gimple_get_lhs(next_stmt);
-+ case GIMPLE_PHI:
-+ return gimple_phi_result(next_stmt);
-+ case GIMPLE_CALL:
-+ return gimple_call_lhs(next_stmt);
-+ default:
-+ return NULL_TREE;
-+ }
-+}
-+
-+static tree expand(struct pointer_set_t *visited, tree lhs)
-+{
-+ gimple def_stmt;
-+ enum tree_code code = TREE_CODE(TREE_TYPE(lhs));
-+
-+ if (is_gimple_constant(lhs))
-+ return NULL_TREE;
-+
-+ if (TREE_CODE(lhs) == ADDR_EXPR)
-+ return NULL_TREE;
-+
-+ if (code == REAL_TYPE)
-+ return NULL_TREE;
-+
-+ gcc_assert(code == INTEGER_TYPE || code == POINTER_TYPE || code == BOOLEAN_TYPE || code == ENUMERAL_TYPE);
-+
-+ def_stmt = get_def_stmt(lhs);
-+
-+ if (!def_stmt || gimple_code(def_stmt) == GIMPLE_NOP)
-+ return NULL_TREE;
-+
-+ if (gimple_plf(def_stmt, MY_STMT))
-+ return lhs;
-+
-+ if (pointer_set_contains(visited, def_stmt))
-+ return expand_visited(def_stmt);
-+
-+ switch (gimple_code(def_stmt)) {
-+ case GIMPLE_PHI:
-+ return build_new_phi(visited, lhs);
-+ case GIMPLE_CALL:
-+ case GIMPLE_ASM:
-+ return create_assign(visited, def_stmt, lhs, AFTER_STMT);
-+ case GIMPLE_ASSIGN:
-+ switch (gimple_num_ops(def_stmt)) {
-+ case 2:
-+ return handle_unary_ops(visited, def_stmt);
-+ case 3:
-+ return handle_binary_ops(visited, lhs);
-+#if BUILDING_GCC_VERSION >= 4007
-+ case 4:
-+ return handle_ternary_ops(visited, lhs);
-+#endif
-+ }
-+ default:
-+ debug_gimple_stmt(def_stmt);
-+ error("%s: unknown gimple code", __func__);
-+ gcc_unreachable();
-+ }
-+}
-+
-+static void change_function_arg(gimple stmt, const_tree origarg, unsigned int argnum, tree newarg)
-+{
-+ const_gimple assign;
-+ gimple_stmt_iterator gsi = gsi_for_stmt(stmt);
-+ tree origtype = TREE_TYPE(origarg);
-+
-+ gcc_assert(gimple_code(stmt) == GIMPLE_CALL);
-+
-+ assign = build_cast_stmt(origtype, newarg, CREATE_NEW_VAR, &gsi, BEFORE_STMT);
-+
-+ gimple_call_set_arg(stmt, argnum, gimple_get_lhs(assign));
-+ update_stmt(stmt);
-+}
-+
-+static bool get_function_arg(unsigned int* argnum, const_tree fndecl)
-+{
-+ const char *origid;
-+ tree arg;
-+ const_tree origarg;
-+
-+ if (!DECL_ABSTRACT_ORIGIN(fndecl))
-+ return true;
-+
-+ origarg = DECL_ARGUMENTS(DECL_ABSTRACT_ORIGIN(fndecl));
-+ while (origarg && *argnum) {
-+ (*argnum)--;
-+ origarg = TREE_CHAIN(origarg);
-+ }
-+
-+ gcc_assert(*argnum == 0);
-+
-+ gcc_assert(origarg != NULL_TREE);
-+ origid = NAME(origarg);
-+ *argnum = 0;
-+ for (arg = DECL_ARGUMENTS(fndecl); arg; arg = TREE_CHAIN(arg)) {
-+ if (!strcmp(origid, NAME(arg)))
-+ return true;
-+ (*argnum)++;
-+ }
-+ return false;
-+}
-+
-+static bool skip_types(const_tree var)
-+{
-+ const_tree type;
-+
-+ switch (TREE_CODE(var)) {
-+ case ADDR_EXPR:
-+#if BUILDING_GCC_VERSION >= 4006
-+ case MEM_REF:
-+#endif
-+ case ARRAY_REF:
-+ case BIT_FIELD_REF:
-+ case INDIRECT_REF:
-+ case TARGET_MEM_REF:
-+ case VAR_DECL:
-+ return true;
-+ default:
-+ break;
-+ }
-+
-+ type = TREE_TYPE(TREE_TYPE(var));
-+ if (!type)
-+ return false;
-+ switch (TREE_CODE(type)) {
-+ case RECORD_TYPE:
-+ return true;
-+ default:
-+ break;
-+ }
-+
-+ return false;
-+}
-+
-+static bool walk_phi(struct pointer_set_t *visited, const_tree result)
-+{
-+ gimple phi = get_def_stmt(result);
-+ unsigned int i, n = gimple_phi_num_args(phi);
-+
-+ if (!phi)
-+ return false;
-+
-+ pointer_set_insert(visited, phi);
-+ for (i = 0; i < n; i++) {
-+ const_tree arg = gimple_phi_arg_def(phi, i);
-+ if (pre_expand(visited, arg))
-+ return true;
-+ }
-+ return false;
-+}
-+
-+static bool walk_unary_ops(struct pointer_set_t *visited, const_tree lhs)
-+{
-+ gimple def_stmt = get_def_stmt(lhs);
-+ const_tree rhs;
-+
-+ if (!def_stmt)
-+ return false;
-+
-+ rhs = gimple_assign_rhs1(def_stmt);
-+ if (pre_expand(visited, rhs))
-+ return true;
-+ return false;
-+}
-+
-+static bool walk_binary_ops(struct pointer_set_t *visited, const_tree lhs)
-+{
-+ bool rhs1_found, rhs2_found;
-+ gimple def_stmt = get_def_stmt(lhs);
-+ const_tree rhs1, rhs2;
-+
-+ if (!def_stmt)
-+ return false;
-+
-+ rhs1 = gimple_assign_rhs1(def_stmt);
-+ rhs2 = gimple_assign_rhs2(def_stmt);
-+ rhs1_found = pre_expand(visited, rhs1);
-+ rhs2_found = pre_expand(visited, rhs2);
-+
-+ return rhs1_found || rhs2_found;
-+}
-+
-+static const_tree search_field_decl(const_tree comp_ref)
-+{
-+ const_tree field = NULL_TREE;
-+ unsigned int i, len = TREE_OPERAND_LENGTH(comp_ref);
-+
-+ for (i = 0; i < len; i++) {
-+ field = TREE_OPERAND(comp_ref, i);
-+ if (TREE_CODE(field) == FIELD_DECL)
-+ break;
-+ }
-+ gcc_assert(TREE_CODE(field) == FIELD_DECL);
-+ return field;
-+}
-+
-+static enum marked mark_status(const_tree fndecl, unsigned int argnum)
-+{
-+ const_tree attr, p;
-+
-+ attr = lookup_attribute("intentional_overflow", DECL_ATTRIBUTES(fndecl));
-+ if (!attr || !TREE_VALUE(attr))
-+ return MARKED_NO;
-+
-+ p = TREE_VALUE(attr);
-+ if (!TREE_INT_CST_LOW(TREE_VALUE(p)))
-+ return MARKED_NOT_INTENTIONAL;
-+
-+ do {
-+ if (argnum == TREE_INT_CST_LOW(TREE_VALUE(p)))
-+ return MARKED_YES;
-+ p = TREE_CHAIN(p);
-+ } while (p);
-+
-+ return MARKED_NO;
-+}
-+
-+static void print_missing_msg(tree func, unsigned int argnum)
-+{
-+ unsigned int new_hash;
-+ size_t len;
-+ unsigned char tree_codes[CODES_LIMIT];
-+ location_t loc = DECL_SOURCE_LOCATION(func);
-+ const char *curfunc = get_asm_name(func);
-+
-+ len = get_function_decl(func, tree_codes);
-+ new_hash = get_hash_num(curfunc, (const char *) tree_codes, len, 0);
-+ inform(loc, "Function %s is missing from the size_overflow hash table +%s+%u+%u+", curfunc, curfunc, argnum, new_hash);
-+}
-+
-+static unsigned int search_missing_attribute(const_tree arg)
-+{
-+ const_tree type = TREE_TYPE(arg);
-+ tree func = get_original_function_decl(current_function_decl);
-+ unsigned int argnum;
-+ const struct size_overflow_hash *hash;
-+
-+ gcc_assert(TREE_CODE(arg) != COMPONENT_REF);
-+
-+ if (TREE_CODE(type) == POINTER_TYPE)
-+ return 0;
-+
-+ argnum = find_arg_number(arg, func);
-+ if (argnum == 0)
-+ return 0;
-+
-+ if (lookup_attribute("size_overflow", DECL_ATTRIBUTES(func)))
-+ return argnum;
-+
-+ hash = get_function_hash(func);
-+ if (!hash || !(hash->param & (1U << argnum))) {
-+ print_missing_msg(func, argnum);
-+ return 0;
-+ }
-+ return argnum;
-+}
-+
-+static bool is_already_marked(const_tree lhs)
-+{
-+ unsigned int argnum;
-+ const_tree fndecl;
-+
-+ argnum = search_missing_attribute(lhs);
-+ fndecl = get_original_function_decl(current_function_decl);
-+ if (argnum && mark_status(fndecl, argnum) == MARKED_YES)
-+ return true;
-+ return false;
-+}
-+
-+static bool pre_expand(struct pointer_set_t *visited, const_tree lhs)
-+{
-+ const_gimple def_stmt;
-+
-+ if (is_gimple_constant(lhs))
-+ return false;
-+
-+ if (skip_types(lhs))
-+ return false;
-+
-+ // skip char type (FIXME: only kernel)
-+ if (TYPE_MODE(TREE_TYPE(lhs)) == QImode)
-+ return false;
-+
-+ if (TREE_CODE(lhs) == PARM_DECL)
-+ return is_already_marked(lhs);
-+
-+ if (TREE_CODE(lhs) == COMPONENT_REF) {
-+ const_tree field, attr;
-+
-+ field = search_field_decl(lhs);
-+ attr = lookup_attribute("intentional_overflow", DECL_ATTRIBUTES(field));
-+ if (!attr || !TREE_VALUE(attr))
-+ return false;
-+ return true;
-+ }
-+
-+ def_stmt = get_def_stmt(lhs);
-+
-+ if (!def_stmt)
-+ return false;
-+
-+ if (pointer_set_contains(visited, def_stmt))
-+ return false;
-+
-+ switch (gimple_code(def_stmt)) {
-+ case GIMPLE_NOP:
-+ if (TREE_CODE(SSA_NAME_VAR(lhs)) == PARM_DECL)
-+ return is_already_marked(lhs);
-+ return false;
-+ case GIMPLE_PHI:
-+ return walk_phi(visited, lhs);
-+ case GIMPLE_CALL:
-+ case GIMPLE_ASM:
-+ return false;
-+ case GIMPLE_ASSIGN:
-+ switch (gimple_num_ops(def_stmt)) {
-+ case 2:
-+ return walk_unary_ops(visited, lhs);
-+ case 3:
-+ return walk_binary_ops(visited, lhs);
-+ }
-+ default:
-+ debug_gimple_stmt((gimple)def_stmt);
-+ error("%s: unknown gimple code", __func__);
-+ gcc_unreachable();
-+ }
-+}
-+
-+static bool search_attributes(tree fndecl, const_tree arg, unsigned int argnum)
-+{
-+ struct pointer_set_t *visited;
-+ bool is_found;
-+ enum marked is_marked;
-+ location_t loc;
-+
-+ visited = pointer_set_create();
-+ is_found = pre_expand(visited, arg);
-+ pointer_set_destroy(visited);
-+
-+ is_marked = mark_status(fndecl, argnum + 1);
-+ if ((is_found && is_marked == MARKED_YES) || is_marked == MARKED_NOT_INTENTIONAL)
-+ return true;
-+
-+ if (is_found) {
-+ loc = DECL_SOURCE_LOCATION(fndecl);
-+ inform(loc, "The intentional_overflow attribute is missing from +%s+%u+", get_asm_name(fndecl), argnum + 1);
-+ return true;
-+ }
-+ return false;
-+}
-+
-+static void handle_function_arg(gimple stmt, tree fndecl, unsigned int argnum)
-+{
-+ struct pointer_set_t *visited;
-+ tree arg, newarg;
-+ bool match;
-+
-+ match = get_function_arg(&argnum, fndecl);
-+ if (!match)
-+ return;
-+ gcc_assert(gimple_call_num_args(stmt) > argnum);
-+ arg = gimple_call_arg(stmt, argnum);
-+ if (arg == NULL_TREE)
-+ return;
-+
-+ if (is_gimple_constant(arg))
-+ return;
-+
-+ if (search_attributes(fndecl, arg, argnum))
-+ return;
-+
-+ if (TREE_CODE(arg) != SSA_NAME)
-+ return;
-+
-+ check_arg_type(arg);
-+
-+ visited = pointer_set_create();
-+ newarg = expand(visited, arg);
-+ pointer_set_destroy(visited);
-+
-+ if (newarg == NULL_TREE)
-+ return;
-+
-+ change_function_arg(stmt, arg, argnum, newarg);
-+
-+ check_size_overflow(stmt, TREE_TYPE(newarg), newarg, arg, BEFORE_STMT);
-+}
-+
-+static void handle_function_by_attribute(gimple stmt, const_tree attr, tree fndecl)
-+{
-+ tree p = TREE_VALUE(attr);
-+ do {
-+ handle_function_arg(stmt, fndecl, TREE_INT_CST_LOW(TREE_VALUE(p))-1);
-+ p = TREE_CHAIN(p);
-+ } while (p);
-+}
-+
-+static void handle_function_by_hash(gimple stmt, tree fndecl)
-+{
-+ tree orig_fndecl;
-+ unsigned int num;
-+ const struct size_overflow_hash *hash;
-+
-+ orig_fndecl = get_original_function_decl(fndecl);
-+ if (C_DECL_IMPLICIT(orig_fndecl))
-+ return;
-+ hash = get_function_hash(orig_fndecl);
-+ if (!hash)
-+ return;
-+
-+ for (num = 1; num <= MAX_PARAM; num++)
-+ if (hash->param & (1U << num))
-+ handle_function_arg(stmt, fndecl, num - 1);
-+}
-+
-+static void set_plf_false(void)
-+{
-+ basic_block bb;
-+
-+ FOR_ALL_BB(bb) {
-+ gimple_stmt_iterator si;
-+
-+ for (si = gsi_start_bb(bb); !gsi_end_p(si); gsi_next(&si))
-+ gimple_set_plf(gsi_stmt(si), MY_STMT, false);
-+ for (si = gsi_start_phis(bb); !gsi_end_p(si); gsi_next(&si))
-+ gimple_set_plf(gsi_stmt(si), MY_STMT, false);
-+ }
-+}
-+
-+static unsigned int handle_function(void)
-+{
-+ basic_block next, bb = ENTRY_BLOCK_PTR->next_bb;
-+
-+ set_plf_false();
-+
-+ do {
-+ gimple_stmt_iterator gsi;
-+ next = bb->next_bb;
-+
-+ for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
-+ tree fndecl, attr;
-+ gimple stmt = gsi_stmt(gsi);
-+
-+ if (!(is_gimple_call(stmt)))
-+ continue;
-+ fndecl = gimple_call_fndecl(stmt);
-+ if (fndecl == NULL_TREE)
-+ continue;
-+ if (gimple_call_num_args(stmt) == 0)
-+ continue;
-+ attr = lookup_attribute("size_overflow", DECL_ATTRIBUTES(fndecl));
-+ if (!attr || !TREE_VALUE(attr))
-+ handle_function_by_hash(stmt, fndecl);
-+ else
-+ handle_function_by_attribute(stmt, attr, fndecl);
-+ gsi = gsi_for_stmt(stmt);
-+ next = gimple_bb(stmt)->next_bb;
-+ }
-+ bb = next;
-+ } while (bb);
-+ return 0;
-+}
-+
-+static struct gimple_opt_pass size_overflow_pass = {
-+ .pass = {
-+ .type = GIMPLE_PASS,
-+ .name = "size_overflow",
-+ .gate = NULL,
-+ .execute = handle_function,
-+ .sub = NULL,
-+ .next = NULL,
-+ .static_pass_number = 0,
-+ .tv_id = TV_NONE,
-+ .properties_required = PROP_cfg | PROP_referenced_vars,
-+ .properties_provided = 0,
-+ .properties_destroyed = 0,
-+ .todo_flags_start = 0,
-+ .todo_flags_finish = TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_remove_unused_locals | TODO_update_ssa_no_phi | TODO_cleanup_cfg | TODO_ggc_collect | TODO_verify_flow
-+ }
-+};
-+
-+static void start_unit_callback(void __unused *gcc_data, void __unused *user_data)
-+{
-+ tree fntype;
-+
-+ const_char_ptr_type_node = build_pointer_type(build_type_variant(char_type_node, 1, 0));
-+
-+ // void report_size_overflow(const char *loc_file, unsigned int loc_line, const char *current_func, const char *ssa_var)
-+ fntype = build_function_type_list(void_type_node,
-+ const_char_ptr_type_node,
-+ unsigned_type_node,
-+ const_char_ptr_type_node,
-+ const_char_ptr_type_node,
-+ NULL_TREE);
-+ report_size_overflow_decl = build_fn_decl("report_size_overflow", fntype);
-+
-+ DECL_ASSEMBLER_NAME(report_size_overflow_decl);
-+ TREE_PUBLIC(report_size_overflow_decl) = 1;
-+ DECL_EXTERNAL(report_size_overflow_decl) = 1;
-+ DECL_ARTIFICIAL(report_size_overflow_decl) = 1;
-+ TREE_THIS_VOLATILE(report_size_overflow_decl) = 1;
-+}
-+
-+int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
-+{
-+ int i;
-+ const char * const plugin_name = plugin_info->base_name;
-+ const int argc = plugin_info->argc;
-+ const struct plugin_argument * const argv = plugin_info->argv;
-+ bool enable = true;
-+
-+ struct register_pass_info size_overflow_pass_info = {
-+ .pass = &size_overflow_pass.pass,
-+ .reference_pass_name = "ssa",
-+ .ref_pass_instance_number = 1,
-+ .pos_op = PASS_POS_INSERT_AFTER
-+ };
-+
-+ if (!plugin_default_version_check(version, &gcc_version)) {
-+ error(G_("incompatible gcc/plugin versions"));
-+ return 1;
-+ }
-+
-+ for (i = 0; i < argc; ++i) {
-+ if (!strcmp(argv[i].key, "no-size-overflow")) {
-+ enable = false;
-+ continue;
-+ }
-+ error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
-+ }
-+
-+ register_callback(plugin_name, PLUGIN_INFO, NULL, &size_overflow_plugin_info);
-+ if (enable) {
-+ register_callback("start_unit", PLUGIN_START_UNIT, &start_unit_callback, NULL);
-+ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &size_overflow_pass_info);
-+ }
-+ register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
-+
-+ return 0;
-+}
-diff --git a/tools/gcc/stackleak_plugin.c b/tools/gcc/stackleak_plugin.c
-new file mode 100644
-index 0000000..38d2014
---- /dev/null
-+++ b/tools/gcc/stackleak_plugin.c
-@@ -0,0 +1,313 @@
-+/*
-+ * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
-+ * Licensed under the GPL v2
-+ *
-+ * Note: the choice of the license means that the compilation process is
-+ * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
-+ * but for the kernel it doesn't matter since it doesn't link against
-+ * any of the gcc libraries
-+ *
-+ * gcc plugin to help implement various PaX features
-+ *
-+ * - track lowest stack pointer
-+ *
-+ * TODO:
-+ * - initialize all local variables
-+ *
-+ * BUGS:
-+ * - none known
-+ */
-+#include "gcc-plugin.h"
-+#include "config.h"
-+#include "system.h"
-+#include "coretypes.h"
-+#include "tree.h"
-+#include "tree-pass.h"
-+#include "flags.h"
-+#include "intl.h"
-+#include "toplev.h"
-+#include "plugin.h"
-+//#include "expr.h" where are you...
-+#include "diagnostic.h"
-+#include "plugin-version.h"
-+#include "tm.h"
-+#include "function.h"
-+#include "basic-block.h"
-+#include "gimple.h"
-+#include "rtl.h"
-+#include "emit-rtl.h"
-+
-+extern void print_gimple_stmt(FILE *, gimple, int, int);
-+
-+int plugin_is_GPL_compatible;
-+
-+static int track_frame_size = -1;
-+static const char track_function[] = "pax_track_stack";
-+static const char check_function[] = "pax_check_alloca";
-+static bool init_locals;
-+
-+static struct plugin_info stackleak_plugin_info = {
-+ .version = "201203140940",
-+ .help = "track-lowest-sp=nn\ttrack sp in functions whose frame size is at least nn bytes\n"
-+// "initialize-locals\t\tforcibly initialize all stack frames\n"
-+};
-+
-+static bool gate_stackleak_track_stack(void);
-+static unsigned int execute_stackleak_tree_instrument(void);
-+static unsigned int execute_stackleak_final(void);
-+
-+static struct gimple_opt_pass stackleak_tree_instrument_pass = {
-+ .pass = {
-+ .type = GIMPLE_PASS,
-+ .name = "stackleak_tree_instrument",
-+ .gate = gate_stackleak_track_stack,
-+ .execute = execute_stackleak_tree_instrument,
-+ .sub = NULL,
-+ .next = NULL,
-+ .static_pass_number = 0,
-+ .tv_id = TV_NONE,
-+ .properties_required = PROP_gimple_leh | PROP_cfg,
-+ .properties_provided = 0,
-+ .properties_destroyed = 0,
-+ .todo_flags_start = 0, //TODO_verify_ssa | TODO_verify_flow | TODO_verify_stmts,
-+ .todo_flags_finish = TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_update_ssa
-+ }
-+};
-+
-+static struct rtl_opt_pass stackleak_final_rtl_opt_pass = {
-+ .pass = {
-+ .type = RTL_PASS,
-+ .name = "stackleak_final",
-+ .gate = gate_stackleak_track_stack,
-+ .execute = execute_stackleak_final,
-+ .sub = NULL,
-+ .next = NULL,
-+ .static_pass_number = 0,
-+ .tv_id = TV_NONE,
-+ .properties_required = 0,
-+ .properties_provided = 0,
-+ .properties_destroyed = 0,
-+ .todo_flags_start = 0,
-+ .todo_flags_finish = TODO_dump_func
-+ }
-+};
-+
-+static bool gate_stackleak_track_stack(void)
-+{
-+ return track_frame_size >= 0;
-+}
-+
-+static void stackleak_check_alloca(gimple_stmt_iterator *gsi)
-+{
-+ gimple check_alloca;
-+ tree fntype, fndecl, alloca_size;
-+
-+ fntype = build_function_type_list(void_type_node, long_unsigned_type_node, NULL_TREE);
-+ fndecl = build_fn_decl(check_function, fntype);
-+ DECL_ASSEMBLER_NAME(fndecl); // for LTO
-+
-+ // insert call to void pax_check_alloca(unsigned long size)
-+ alloca_size = gimple_call_arg(gsi_stmt(*gsi), 0);
-+ check_alloca = gimple_build_call(fndecl, 1, alloca_size);
-+ gsi_insert_before(gsi, check_alloca, GSI_SAME_STMT);
-+}
-+
-+static void stackleak_add_instrumentation(gimple_stmt_iterator *gsi)
-+{
-+ gimple track_stack;
-+ tree fntype, fndecl;
-+
-+ fntype = build_function_type_list(void_type_node, NULL_TREE);
-+ fndecl = build_fn_decl(track_function, fntype);
-+ DECL_ASSEMBLER_NAME(fndecl); // for LTO
-+
-+ // insert call to void pax_track_stack(void)
-+ track_stack = gimple_build_call(fndecl, 0);
-+ gsi_insert_after(gsi, track_stack, GSI_CONTINUE_LINKING);
-+}
-+
-+#if BUILDING_GCC_VERSION == 4005
-+static bool gimple_call_builtin_p(gimple stmt, enum built_in_function code)
-+{
-+ tree fndecl;
-+
-+ if (!is_gimple_call(stmt))
-+ return false;
-+ fndecl = gimple_call_fndecl(stmt);
-+ if (!fndecl)
-+ return false;
-+ if (DECL_BUILT_IN_CLASS(fndecl) != BUILT_IN_NORMAL)
-+ return false;
-+// print_node(stderr, "pax", fndecl, 4);
-+ return DECL_FUNCTION_CODE(fndecl) == code;
-+}
-+#endif
-+
-+static bool is_alloca(gimple stmt)
-+{
-+ if (gimple_call_builtin_p(stmt, BUILT_IN_ALLOCA))
-+ return true;
-+
-+#if BUILDING_GCC_VERSION >= 4007
-+ if (gimple_call_builtin_p(stmt, BUILT_IN_ALLOCA_WITH_ALIGN))
-+ return true;
-+#endif
-+
-+ return false;
-+}
-+
-+static unsigned int execute_stackleak_tree_instrument(void)
-+{
-+ basic_block bb, entry_bb;
-+ bool prologue_instrumented = false, is_leaf = true;
-+
-+ entry_bb = ENTRY_BLOCK_PTR_FOR_FUNCTION(cfun)->next_bb;
-+
-+ // 1. loop through BBs and GIMPLE statements
-+ FOR_EACH_BB(bb) {
-+ gimple_stmt_iterator gsi;
-+
-+ for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
-+ gimple stmt;
-+
-+ stmt = gsi_stmt(gsi);
-+
-+ if (is_gimple_call(stmt))
-+ is_leaf = false;
-+
-+ // gimple match: align 8 built-in BUILT_IN_NORMAL:BUILT_IN_ALLOCA attributes <tree_list 0xb7576450>
-+ if (!is_alloca(stmt))
-+ continue;
-+
-+ // 2. insert stack overflow check before each __builtin_alloca call
-+ stackleak_check_alloca(&gsi);
-+
-+ // 3. insert track call after each __builtin_alloca call
-+ stackleak_add_instrumentation(&gsi);
-+ if (bb == entry_bb)
-+ prologue_instrumented = true;
-+ }
-+ }
-+
-+ // special cases for some bad linux code: taking the address of static inline functions will materialize them
-+ // but we mustn't instrument some of them as the resulting stack alignment required by the function call ABI
-+ // will break other assumptions regarding the expected (but not otherwise enforced) register clobbering ABI.
-+ // case in point: native_save_fl on amd64 when optimized for size clobbers rdx if it were instrumented here.
-+ if (is_leaf && !TREE_PUBLIC(current_function_decl) && DECL_DECLARED_INLINE_P(current_function_decl))
-+ return 0;
-+ if (is_leaf && !strncmp(IDENTIFIER_POINTER(DECL_NAME(current_function_decl)), "_paravirt_", 10))
-+ return 0;
-+
-+ // 4. insert track call at the beginning
-+ if (!prologue_instrumented) {
-+ gimple_stmt_iterator gsi;
-+
-+ bb = split_block_after_labels(ENTRY_BLOCK_PTR)->dest;
-+ if (dom_info_available_p(CDI_DOMINATORS))
-+ set_immediate_dominator(CDI_DOMINATORS, bb, ENTRY_BLOCK_PTR);
-+ gsi = gsi_start_bb(bb);
-+ stackleak_add_instrumentation(&gsi);
-+ }
-+
-+ return 0;
-+}
-+
-+static unsigned int execute_stackleak_final(void)
-+{
-+ rtx insn;
-+
-+ if (cfun->calls_alloca)
-+ return 0;
-+
-+ // keep calls only if function frame is big enough
-+ if (get_frame_size() >= track_frame_size)
-+ return 0;
-+
-+ // 1. find pax_track_stack calls
-+ for (insn = get_insns(); insn; insn = NEXT_INSN(insn)) {
-+ // rtl match: (call_insn 8 7 9 3 (call (mem (symbol_ref ("pax_track_stack") [flags 0x41] <function_decl 0xb7470e80 pax_track_stack>) [0 S1 A8]) (4)) -1 (nil) (nil))
-+ rtx body;
-+
-+ if (!CALL_P(insn))
-+ continue;
-+ body = PATTERN(insn);
-+ if (GET_CODE(body) != CALL)
-+ continue;
-+ body = XEXP(body, 0);
-+ if (GET_CODE(body) != MEM)
-+ continue;
-+ body = XEXP(body, 0);
-+ if (GET_CODE(body) != SYMBOL_REF)
-+ continue;
-+ if (strcmp(XSTR(body, 0), track_function))
-+ continue;
-+// warning(0, "track_frame_size: %d %ld %d", cfun->calls_alloca, get_frame_size(), track_frame_size);
-+ // 2. delete call
-+ insn = delete_insn_and_edges(insn);
-+#if BUILDING_GCC_VERSION >= 4007
-+ if (GET_CODE(insn) == NOTE && NOTE_KIND(insn) == NOTE_INSN_CALL_ARG_LOCATION)
-+ insn = delete_insn_and_edges(insn);
-+#endif
-+ }
-+
-+// print_simple_rtl(stderr, get_insns());
-+// print_rtl(stderr, get_insns());
-+// warning(0, "track_frame_size: %d %ld %d", cfun->calls_alloca, get_frame_size(), track_frame_size);
-+
-+ return 0;
-+}
-+
-+int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
-+{
-+ const char * const plugin_name = plugin_info->base_name;
-+ const int argc = plugin_info->argc;
-+ const struct plugin_argument * const argv = plugin_info->argv;
-+ int i;
-+ struct register_pass_info stackleak_tree_instrument_pass_info = {
-+ .pass = &stackleak_tree_instrument_pass.pass,
-+// .reference_pass_name = "tree_profile",
-+ .reference_pass_name = "optimized",
-+ .ref_pass_instance_number = 1,
-+ .pos_op = PASS_POS_INSERT_BEFORE
-+ };
-+ struct register_pass_info stackleak_final_pass_info = {
-+ .pass = &stackleak_final_rtl_opt_pass.pass,
-+ .reference_pass_name = "final",
-+ .ref_pass_instance_number = 1,
-+ .pos_op = PASS_POS_INSERT_BEFORE
-+ };
-+
-+ if (!plugin_default_version_check(version, &gcc_version)) {
-+ error(G_("incompatible gcc/plugin versions"));
-+ return 1;
-+ }
-+
-+ register_callback(plugin_name, PLUGIN_INFO, NULL, &stackleak_plugin_info);
-+
-+ for (i = 0; i < argc; ++i) {
-+ if (!strcmp(argv[i].key, "track-lowest-sp")) {
-+ if (!argv[i].value) {
-+ error(G_("no value supplied for option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
-+ continue;
-+ }
-+ track_frame_size = atoi(argv[i].value);
-+ if (argv[i].value[0] < '0' || argv[i].value[0] > '9' || track_frame_size < 0)
-+ error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
-+ continue;
-+ }
-+ if (!strcmp(argv[i].key, "initialize-locals")) {
-+ if (argv[i].value) {
-+ error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
-+ continue;
-+ }
-+ init_locals = true;
-+ continue;
-+ }
-+ error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
-+ }
-+
-+ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &stackleak_tree_instrument_pass_info);
-+ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &stackleak_final_pass_info);
-+
-+ return 0;
-+}
-diff --git a/usr/gen_init_cpio.c b/usr/gen_init_cpio.c
-index 83b3dde..835bee7 100644
---- a/usr/gen_init_cpio.c
-+++ b/usr/gen_init_cpio.c
-@@ -299,7 +299,7 @@ static int cpio_mkfile(const char *name, const char *location,
- int retval;
- int rc = -1;
- int namesize;
-- int i;
-+ unsigned int i;
-
- mode |= S_IFREG;
-
-@@ -383,9 +383,10 @@ static char *cpio_replace_env(char *new_location)
- *env_var = *expanded = '\0';
- strncat(env_var, start + 2, end - start - 2);
- strncat(expanded, new_location, start - new_location);
-- strncat(expanded, getenv(env_var), PATH_MAX);
-- strncat(expanded, end + 1, PATH_MAX);
-+ strncat(expanded, getenv(env_var), PATH_MAX - strlen(expanded));
-+ strncat(expanded, end + 1, PATH_MAX - strlen(expanded));
- strncpy(new_location, expanded, PATH_MAX);
-+ new_location[PATH_MAX] = 0;
- } else
- break;
- }
-diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
-index 82b6fdc..3a1bf69 100644
---- a/virt/kvm/kvm_main.c
-+++ b/virt/kvm/kvm_main.c
-@@ -81,7 +81,12 @@ static cpumask_var_t cpus_hardware_enabled;
- struct kmem_cache *kvm_vcpu_cache;
- EXPORT_SYMBOL_GPL(kvm_vcpu_cache);
-
--static __read_mostly struct preempt_ops kvm_preempt_ops;
-+static void kvm_sched_in(struct preempt_notifier *pn, int cpu);
-+static void kvm_sched_out(struct preempt_notifier *pn, struct task_struct *next);
-+static struct preempt_ops kvm_preempt_ops = {
-+ .sched_in = kvm_sched_in,
-+ .sched_out = kvm_sched_out,
-+};
-
- struct dentry *kvm_debugfs_dir;
-
-@@ -2573,7 +2578,7 @@ asmlinkage void kvm_handle_fault_on_reboot(void)
- if (kvm_rebooting)
- /* spin while reset goes on */
- while (true)
-- ;
-+ cpu_relax();
- /* Fault while not rebooting. We want the trace. */
- BUG();
- }
-@@ -2793,7 +2798,7 @@ static void kvm_sched_out(struct preempt_notifier *pn,
- kvm_arch_vcpu_put(vcpu);
- }
-
--int kvm_init(void *opaque, unsigned int vcpu_size,
-+int kvm_init(const void *opaque, unsigned int vcpu_size,
- struct module *module)
- {
- int r;
-@@ -2846,15 +2851,17 @@ int kvm_init(void *opaque, unsigned int vcpu_size,
- /* A kmem cache lets us meet the alignment requirements of fx_save. */
- kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size,
- __alignof__(struct kvm_vcpu),
-- 0, NULL);
-+ SLAB_USERCOPY, NULL);
- if (!kvm_vcpu_cache) {
- r = -ENOMEM;
- goto out_free_5;
- }
-
-- kvm_chardev_ops.owner = module;
-- kvm_vm_fops.owner = module;
-- kvm_vcpu_fops.owner = module;
-+ pax_open_kernel();
-+ *(void **)&kvm_chardev_ops.owner = module;
-+ *(void **)&kvm_vm_fops.owner = module;
-+ *(void **)&kvm_vcpu_fops.owner = module;
-+ pax_close_kernel();
-
- r = misc_register(&kvm_dev);
- if (r) {
-@@ -2862,9 +2869,6 @@ int kvm_init(void *opaque, unsigned int vcpu_size,
- goto out_free;
- }
-
-- kvm_preempt_ops.sched_in = kvm_sched_in;
-- kvm_preempt_ops.sched_out = kvm_sched_out;
--
- kvm_init_debug();
-
- return 0;
^ permalink raw reply related [flat|nested] 13+ messages in thread* [gentoo-commits] proj/hardened-patchset:master commit in: 2.6.32/
@ 2012-10-10 2:42 Anthony G. Basile
0 siblings, 0 replies; 13+ messages in thread
From: Anthony G. Basile @ 2012-10-10 2:42 UTC (permalink / raw
To: gentoo-commits
commit: 31dd59490141185e95b1c0cc15928aa6354bff8e
Author: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Wed Oct 10 02:40:52 2012 +0000
Commit: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Wed Oct 10 02:40:52 2012 +0000
URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-patchset.git;a=commit;h=31dd5949
2.6.32/1059_linux-2.6.32.60.patch: fix mismatched Makefile hunk
---
2.6.32/1059_linux-2.6.32.60.patch | 13 -------------
1 files changed, 0 insertions(+), 13 deletions(-)
diff --git a/2.6.32/1059_linux-2.6.32.60.patch b/2.6.32/1059_linux-2.6.32.60.patch
index 99e5234..5f975dd 100644
--- a/2.6.32/1059_linux-2.6.32.60.patch
+++ b/2.6.32/1059_linux-2.6.32.60.patch
@@ -44,19 +44,6 @@ index 613da5d..334258c 100644
S: Maintained
F: drivers/char/random.c
-diff --git a/Makefile b/Makefile
-index 3a9a721..b0e245e 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,7 +1,7 @@
- VERSION = 2
- PATCHLEVEL = 6
- SUBLEVEL = 32
--EXTRAVERSION = .59
-+EXTRAVERSION = .60
- NAME = Man-Eating Seals of Antiquity
-
- # *DOCUMENTATION*
diff --git a/arch/arm/kernel/sys_arm.c b/arch/arm/kernel/sys_arm.c
index ae4027b..2dd070f 100644
--- a/arch/arm/kernel/sys_arm.c
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [gentoo-commits] proj/hardened-patchset:master commit in: 2.6.32/
@ 2012-10-10 1:23 Anthony G. Basile
0 siblings, 0 replies; 13+ messages in thread
From: Anthony G. Basile @ 2012-10-10 1:23 UTC (permalink / raw
To: gentoo-commits
commit: de3883dba048395656c7bb851d74cdb0c154c5a8
Author: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Wed Oct 10 01:22:22 2012 +0000
Commit: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Wed Oct 10 01:22:22 2012 +0000
URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-patchset.git;a=commit;h=de3883db
Grsec/PaX: 2.9.1-2.6.32.60-201210091739
---
2.6.32/0000_README | 6 +-
2.6.32/1059_linux-2.6.32.60.patch | 7753 ++++++++++++++++++++
..._grsecurity-2.9.1-2.6.32.60-201210091739.patch} | 3808 +---------
3 files changed, 8048 insertions(+), 3519 deletions(-)
diff --git a/2.6.32/0000_README b/2.6.32/0000_README
index 05a4857..c809bde 100644
--- a/2.6.32/0000_README
+++ b/2.6.32/0000_README
@@ -30,7 +30,11 @@ Patch: 1058_linux-2.6.32.59.patch
From: http://www.kernel.org
Desc: Linux 2.6.32.59
-Patch: 4420_grsecurity-2.9.1-2.6.32.59-201210071703.patch
+Patch: 1059_linux-2.6.32.60.patch
+From: http://www.kernel.org
+Desc: Linux 2.6.32.59
+
+Patch: 4420_grsecurity-2.9.1-2.6.32.60-201210091739.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/2.6.32/1059_linux-2.6.32.60.patch b/2.6.32/1059_linux-2.6.32.60.patch
new file mode 100644
index 0000000..99e5234
--- /dev/null
+++ b/2.6.32/1059_linux-2.6.32.60.patch
@@ -0,0 +1,7753 @@
+diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
+index c840e7d..14c7fb0 100644
+--- a/Documentation/kernel-parameters.txt
++++ b/Documentation/kernel-parameters.txt
+@@ -1725,6 +1725,11 @@ and is between 256 and 4096 characters. It is defined in the file
+
+ noresidual [PPC] Don't use residual data on PReP machines.
+
++ nordrand [X86] Disable the direct use of the RDRAND
++ instruction even if it is supported by the
++ processor. RDRAND is still available to user
++ space applications.
++
+ noresume [SWSUSP] Disables resume and restores original swap
+ space.
+
+diff --git a/Documentation/stable_kernel_rules.txt b/Documentation/stable_kernel_rules.txt
+index e6e482f..3c9d7ac 100644
+--- a/Documentation/stable_kernel_rules.txt
++++ b/Documentation/stable_kernel_rules.txt
+@@ -12,6 +12,12 @@ Rules on what kind of patches are accepted, and which ones are not, into the
+ marked CONFIG_BROKEN), an oops, a hang, data corruption, a real
+ security issue, or some "oh, that's not good" issue. In short, something
+ critical.
++ - Serious issues as reported by a user of a distribution kernel may also
++ be considered if they fix a notable performance or interactivity issue.
++ As these fixes are not as obvious and have a higher risk of a subtle
++ regression they should only be submitted by a distribution kernel
++ maintainer and include an addendum linking to a bugzilla entry if it
++ exists and additional information on the user-visible impact.
+ - New device IDs and quirks are also accepted.
+ - No "theoretical race condition" issues, unless an explanation of how the
+ race can be exploited is also provided.
+diff --git a/MAINTAINERS b/MAINTAINERS
+index 613da5d..334258c 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -4379,7 +4379,7 @@ F: Documentation/blockdev/ramdisk.txt
+ F: drivers/block/brd.c
+
+ RANDOM NUMBER DRIVER
+-M: Matt Mackall <mpm@selenic.com>
++M: Theodore Ts'o" <tytso@mit.edu>
+ S: Maintained
+ F: drivers/char/random.c
+
+diff --git a/Makefile b/Makefile
+index 3a9a721..b0e245e 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ VERSION = 2
+ PATCHLEVEL = 6
+ SUBLEVEL = 32
+-EXTRAVERSION = .59
++EXTRAVERSION = .60
+ NAME = Man-Eating Seals of Antiquity
+
+ # *DOCUMENTATION*
+diff --git a/arch/arm/kernel/sys_arm.c b/arch/arm/kernel/sys_arm.c
+index ae4027b..2dd070f 100644
+--- a/arch/arm/kernel/sys_arm.c
++++ b/arch/arm/kernel/sys_arm.c
+@@ -240,7 +240,7 @@ int kernel_execve(const char *filename, char *const argv[], char *const envp[])
+ "Ir" (THREAD_START_SP - sizeof(regs)),
+ "r" (®s),
+ "Ir" (sizeof(regs))
+- : "r0", "r1", "r2", "r3", "ip", "lr", "memory");
++ : "r0", "r1", "r2", "r3", "r8", "r9", "ip", "lr", "memory");
+
+ out:
+ return ret;
+diff --git a/arch/ia64/include/asm/unistd.h b/arch/ia64/include/asm/unistd.h
+index 5a5347f..08a0e5c 100644
+--- a/arch/ia64/include/asm/unistd.h
++++ b/arch/ia64/include/asm/unistd.h
+@@ -311,11 +311,12 @@
+ #define __NR_preadv 1319
+ #define __NR_pwritev 1320
+ #define __NR_rt_tgsigqueueinfo 1321
++#define __NR_accept4 1334
+
+ #ifdef __KERNEL__
+
+
+-#define NR_syscalls 298 /* length of syscall table */
++#define NR_syscalls 311 /* length of syscall table */
+
+ /*
+ * The following defines stop scripts/checksyscalls.sh from complaining about
+diff --git a/arch/ia64/kernel/entry.S b/arch/ia64/kernel/entry.S
+index d0e7d37..e3be543 100644
+--- a/arch/ia64/kernel/entry.S
++++ b/arch/ia64/kernel/entry.S
+@@ -1806,6 +1806,19 @@ sys_call_table:
+ data8 sys_preadv
+ data8 sys_pwritev // 1320
+ data8 sys_rt_tgsigqueueinfo
++ data8 sys_ni_syscall
++ data8 sys_ni_syscall
++ data8 sys_ni_syscall
++ data8 sys_ni_syscall // 1325
++ data8 sys_ni_syscall
++ data8 sys_ni_syscall
++ data8 sys_ni_syscall
++ data8 sys_ni_syscall
++ data8 sys_ni_syscall // 1330
++ data8 sys_ni_syscall
++ data8 sys_ni_syscall
++ data8 sys_ni_syscall
++ data8 sys_accept4
+
+ .org sys_call_table + 8*NR_syscalls // guard against failures to increase NR_syscalls
+ #endif /* __IA64_ASM_PARAVIRTUALIZED_NATIVE */
+diff --git a/arch/ia64/kernel/irq_ia64.c b/arch/ia64/kernel/irq_ia64.c
+index dd9d7b5..463b8a7 100644
+--- a/arch/ia64/kernel/irq_ia64.c
++++ b/arch/ia64/kernel/irq_ia64.c
+@@ -24,7 +24,6 @@
+ #include <linux/kernel_stat.h>
+ #include <linux/slab.h>
+ #include <linux/ptrace.h>
+-#include <linux/random.h> /* for rand_initialize_irq() */
+ #include <linux/signal.h>
+ #include <linux/smp.h>
+ #include <linux/threads.h>
+diff --git a/arch/ia64/kvm/kvm-ia64.c b/arch/ia64/kvm/kvm-ia64.c
+index 2eb6365..0edba06 100644
+--- a/arch/ia64/kvm/kvm-ia64.c
++++ b/arch/ia64/kvm/kvm-ia64.c
+@@ -1185,6 +1185,11 @@ out:
+
+ #define PALE_RESET_ENTRY 0x80000000ffffffb0UL
+
++bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu)
++{
++ return irqchip_in_kernel(vcpu->kvm) == (vcpu->arch.apic != NULL);
++}
++
+ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
+ {
+ struct kvm_vcpu *v;
+diff --git a/arch/mips/include/asm/thread_info.h b/arch/mips/include/asm/thread_info.h
+index 845da21..0e50757 100644
+--- a/arch/mips/include/asm/thread_info.h
++++ b/arch/mips/include/asm/thread_info.h
+@@ -60,6 +60,8 @@ struct thread_info {
+ register struct thread_info *__current_thread_info __asm__("$28");
+ #define current_thread_info() __current_thread_info
+
++#endif /* !__ASSEMBLY__ */
++
+ /* thread information allocation */
+ #if defined(CONFIG_PAGE_SIZE_4KB) && defined(CONFIG_32BIT)
+ #define THREAD_SIZE_ORDER (1)
+@@ -93,8 +95,6 @@ register struct thread_info *__current_thread_info __asm__("$28");
+
+ #define free_thread_info(info) kfree(info)
+
+-#endif /* !__ASSEMBLY__ */
+-
+ #define PREEMPT_ACTIVE 0x10000000
+
+ /*
+diff --git a/arch/mips/kernel/vmlinux.lds.S b/arch/mips/kernel/vmlinux.lds.S
+index 162b299..d5c95d6 100644
+--- a/arch/mips/kernel/vmlinux.lds.S
++++ b/arch/mips/kernel/vmlinux.lds.S
+@@ -1,5 +1,6 @@
+ #include <asm/asm-offsets.h>
+ #include <asm/page.h>
++#include <asm/thread_info.h>
+ #include <asm-generic/vmlinux.lds.h>
+
+ #undef mips
+@@ -70,7 +71,7 @@ SECTIONS
+ .data : { /* Data */
+ . = . + DATAOFFSET; /* for CONFIG_MAPPED_KERNEL */
+
+- INIT_TASK_DATA(PAGE_SIZE)
++ INIT_TASK_DATA(THREAD_SIZE)
+ NOSAVE_DATA
+ CACHELINE_ALIGNED_DATA(1 << CONFIG_MIPS_L1_CACHE_SHIFT)
+ DATA_DATA
+diff --git a/arch/parisc/include/asm/atomic.h b/arch/parisc/include/asm/atomic.h
+index 8bc9e96..6ee459d 100644
+--- a/arch/parisc/include/asm/atomic.h
++++ b/arch/parisc/include/asm/atomic.h
+@@ -248,7 +248,7 @@ static __inline__ int atomic_add_unless(atomic_t *v, int a, int u)
+
+ #define atomic_sub_and_test(i,v) (atomic_sub_return((i),(v)) == 0)
+
+-#define ATOMIC_INIT(i) ((atomic_t) { (i) })
++#define ATOMIC_INIT(i) { (i) }
+
+ #define smp_mb__before_atomic_dec() smp_mb()
+ #define smp_mb__after_atomic_dec() smp_mb()
+@@ -257,7 +257,7 @@ static __inline__ int atomic_add_unless(atomic_t *v, int a, int u)
+
+ #ifdef CONFIG_64BIT
+
+-#define ATOMIC64_INIT(i) ((atomic64_t) { (i) })
++#define ATOMIC64_INIT(i) { (i) }
+
+ static __inline__ int
+ __atomic64_add_return(s64 i, atomic64_t *v)
+diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
+index 32a7c30..6ce44dd 100644
+--- a/arch/powerpc/include/asm/reg.h
++++ b/arch/powerpc/include/asm/reg.h
+@@ -870,7 +870,8 @@
+ /* Macros for setting and retrieving special purpose registers */
+ #ifndef __ASSEMBLY__
+ #define mfmsr() ({unsigned long rval; \
+- asm volatile("mfmsr %0" : "=r" (rval)); rval;})
++ asm volatile("mfmsr %0" : "=r" (rval) : \
++ : "memory"); rval;})
+ #ifdef CONFIG_PPC64
+ #define __mtmsrd(v, l) asm volatile("mtmsrd %0," __stringify(l) \
+ : : "r" (v) : "memory")
+diff --git a/arch/powerpc/kernel/ftrace.c b/arch/powerpc/kernel/ftrace.c
+index ce1f3e4..eda40d2 100644
+--- a/arch/powerpc/kernel/ftrace.c
++++ b/arch/powerpc/kernel/ftrace.c
+@@ -244,9 +244,9 @@ __ftrace_make_nop(struct module *mod,
+
+ /*
+ * On PPC32 the trampoline looks like:
+- * 0x3d, 0x60, 0x00, 0x00 lis r11,sym@ha
+- * 0x39, 0x6b, 0x00, 0x00 addi r11,r11,sym@l
+- * 0x7d, 0x69, 0x03, 0xa6 mtctr r11
++ * 0x3d, 0x80, 0x00, 0x00 lis r12,sym@ha
++ * 0x39, 0x8c, 0x00, 0x00 addi r12,r12,sym@l
++ * 0x7d, 0x89, 0x03, 0xa6 mtctr r12
+ * 0x4e, 0x80, 0x04, 0x20 bctr
+ */
+
+@@ -261,9 +261,9 @@ __ftrace_make_nop(struct module *mod,
+ pr_devel(" %08x %08x ", jmp[0], jmp[1]);
+
+ /* verify that this is what we expect it to be */
+- if (((jmp[0] & 0xffff0000) != 0x3d600000) ||
+- ((jmp[1] & 0xffff0000) != 0x396b0000) ||
+- (jmp[2] != 0x7d6903a6) ||
++ if (((jmp[0] & 0xffff0000) != 0x3d800000) ||
++ ((jmp[1] & 0xffff0000) != 0x398c0000) ||
++ (jmp[2] != 0x7d8903a6) ||
+ (jmp[3] != 0x4e800420)) {
+ printk(KERN_ERR "Not a trampoline\n");
+ return -EINVAL;
+diff --git a/arch/powerpc/kernel/module_32.c b/arch/powerpc/kernel/module_32.c
+index f832773..449a7e0 100644
+--- a/arch/powerpc/kernel/module_32.c
++++ b/arch/powerpc/kernel/module_32.c
+@@ -187,8 +187,8 @@ int apply_relocate(Elf32_Shdr *sechdrs,
+
+ static inline int entry_matches(struct ppc_plt_entry *entry, Elf32_Addr val)
+ {
+- if (entry->jump[0] == 0x3d600000 + ((val + 0x8000) >> 16)
+- && entry->jump[1] == 0x396b0000 + (val & 0xffff))
++ if (entry->jump[0] == 0x3d800000 + ((val + 0x8000) >> 16)
++ && entry->jump[1] == 0x398c0000 + (val & 0xffff))
+ return 1;
+ return 0;
+ }
+@@ -215,10 +215,9 @@ static uint32_t do_plt_call(void *location,
+ entry++;
+ }
+
+- /* Stolen from Paul Mackerras as well... */
+- entry->jump[0] = 0x3d600000+((val+0x8000)>>16); /* lis r11,sym@ha */
+- entry->jump[1] = 0x396b0000 + (val&0xffff); /* addi r11,r11,sym@l*/
+- entry->jump[2] = 0x7d6903a6; /* mtctr r11 */
++ entry->jump[0] = 0x3d800000+((val+0x8000)>>16); /* lis r12,sym@ha */
++ entry->jump[1] = 0x398c0000 + (val&0xffff); /* addi r12,r12,sym@l*/
++ entry->jump[2] = 0x7d8903a6; /* mtctr r12 */
+ entry->jump[3] = 0x4e800420; /* bctr */
+
+ DEBUGP("Initialized plt for 0x%x at %p\n", val, entry);
+diff --git a/arch/powerpc/platforms/powermac/smp.c b/arch/powerpc/platforms/powermac/smp.c
+index b40c22d..7f66d0c 100644
+--- a/arch/powerpc/platforms/powermac/smp.c
++++ b/arch/powerpc/platforms/powermac/smp.c
+@@ -402,7 +402,7 @@ static struct irqaction psurge_irqaction = {
+
+ static void __init smp_psurge_setup_cpu(int cpu_nr)
+ {
+- if (cpu_nr != 0)
++ if (cpu_nr != 0 || !psurge_start)
+ return;
+
+ /* reset the entry point so if we get another intr we won't
+diff --git a/arch/sparc/Makefile b/arch/sparc/Makefile
+index 113225b..0538555 100644
+--- a/arch/sparc/Makefile
++++ b/arch/sparc/Makefile
+@@ -31,7 +31,7 @@ UTS_MACHINE := sparc
+
+ #KBUILD_CFLAGS += -g -pipe -fcall-used-g5 -fcall-used-g7
+ KBUILD_CFLAGS += -m32 -pipe -mno-fpu -fcall-used-g5 -fcall-used-g7
+-KBUILD_AFLAGS += -m32
++KBUILD_AFLAGS += -m32 -Wa,-Av8
+
+ #LDFLAGS_vmlinux = -N -Ttext 0xf0004000
+ # Since 2.5.40, the first stage is left not btfix-ed.
+diff --git a/arch/sparc/kernel/ds.c b/arch/sparc/kernel/ds.c
+index 4a700f4..6a831bd 100644
+--- a/arch/sparc/kernel/ds.c
++++ b/arch/sparc/kernel/ds.c
+@@ -1242,4 +1242,4 @@ static int __init ds_init(void)
+ return vio_register_driver(&ds_driver);
+ }
+
+-subsys_initcall(ds_init);
++fs_initcall(ds_init);
+diff --git a/arch/sparc/kernel/rtrap_64.S b/arch/sparc/kernel/rtrap_64.S
+index fd3cee4..cc4b1ff 100644
+--- a/arch/sparc/kernel/rtrap_64.S
++++ b/arch/sparc/kernel/rtrap_64.S
+@@ -20,11 +20,6 @@
+
+ .text
+ .align 32
+-__handle_softirq:
+- call do_softirq
+- nop
+- ba,a,pt %xcc, __handle_softirq_continue
+- nop
+ __handle_preemption:
+ call schedule
+ wrpr %g0, RTRAP_PSTATE, %pstate
+@@ -159,9 +154,7 @@ rtrap:
+ cmp %l1, 0
+
+ /* mm/ultra.S:xcall_report_regs KNOWS about this load. */
+- bne,pn %icc, __handle_softirq
+ ldx [%sp + PTREGS_OFF + PT_V9_TSTATE], %l1
+-__handle_softirq_continue:
+ rtrap_xcall:
+ sethi %hi(0xf << 20), %l4
+ and %l1, %l4, %l4
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index 73ae02a..aa889d6 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -1428,6 +1428,15 @@ config ARCH_USES_PG_UNCACHED
+ def_bool y
+ depends on X86_PAT
+
++config ARCH_RANDOM
++ def_bool y
++ prompt "x86 architectural random number generator" if EXPERT
++ ---help---
++ Enable the x86 architectural RDRAND instruction
++ (Intel Bull Mountain technology) to generate random numbers.
++ If supported, this is a high bandwidth, cryptographically
++ secure hardware random number generator.
++
+ config EFI
+ bool "EFI runtime service support"
+ depends on ACPI
+diff --git a/arch/x86/include/asm/archrandom.h b/arch/x86/include/asm/archrandom.h
+new file mode 100644
+index 0000000..0d9ec77
+--- /dev/null
++++ b/arch/x86/include/asm/archrandom.h
+@@ -0,0 +1,75 @@
++/*
++ * This file is part of the Linux kernel.
++ *
++ * Copyright (c) 2011, Intel Corporation
++ * Authors: Fenghua Yu <fenghua.yu@intel.com>,
++ * H. Peter Anvin <hpa@linux.intel.com>
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms and conditions of the GNU General Public License,
++ * version 2, as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
++ * more details.
++ *
++ * You should have received a copy of the GNU General Public License along with
++ * this program; if not, write to the Free Software Foundation, Inc.,
++ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
++ *
++ */
++
++#ifndef ASM_X86_ARCHRANDOM_H
++#define ASM_X86_ARCHRANDOM_H
++
++#include <asm/processor.h>
++#include <asm/cpufeature.h>
++#include <asm/alternative.h>
++#include <asm/nops.h>
++
++#define RDRAND_RETRY_LOOPS 10
++
++#define RDRAND_INT ".byte 0x0f,0xc7,0xf0"
++#ifdef CONFIG_X86_64
++# define RDRAND_LONG ".byte 0x48,0x0f,0xc7,0xf0"
++#else
++# define RDRAND_LONG RDRAND_INT
++#endif
++
++#ifdef CONFIG_ARCH_RANDOM
++
++#define GET_RANDOM(name, type, rdrand, nop) \
++static inline int name(type *v) \
++{ \
++ int ok; \
++ alternative_io("movl $0, %0\n\t" \
++ nop, \
++ "\n1: " rdrand "\n\t" \
++ "jc 2f\n\t" \
++ "decl %0\n\t" \
++ "jnz 1b\n\t" \
++ "2:", \
++ X86_FEATURE_RDRAND, \
++ ASM_OUTPUT2("=r" (ok), "=a" (*v)), \
++ "0" (RDRAND_RETRY_LOOPS)); \
++ return ok; \
++}
++
++#ifdef CONFIG_X86_64
++
++GET_RANDOM(arch_get_random_long, unsigned long, RDRAND_LONG, ASM_NOP5);
++GET_RANDOM(arch_get_random_int, unsigned int, RDRAND_INT, ASM_NOP4);
++
++#else
++
++GET_RANDOM(arch_get_random_long, unsigned long, RDRAND_LONG, ASM_NOP3);
++GET_RANDOM(arch_get_random_int, unsigned int, RDRAND_INT, ASM_NOP3);
++
++#endif /* CONFIG_X86_64 */
++
++#endif /* CONFIG_ARCH_RANDOM */
++
++extern void x86_init_rdrand(struct cpuinfo_x86 *c);
++
++#endif /* ASM_X86_ARCHRANDOM_H */
+diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
+index 1efb1fa..27929b8 100644
+--- a/arch/x86/include/asm/cpufeature.h
++++ b/arch/x86/include/asm/cpufeature.h
+@@ -124,6 +124,8 @@
+ #define X86_FEATURE_XSAVE (4*32+26) /* XSAVE/XRSTOR/XSETBV/XGETBV */
+ #define X86_FEATURE_OSXSAVE (4*32+27) /* "" XSAVE enabled in the OS */
+ #define X86_FEATURE_AVX (4*32+28) /* Advanced Vector Extensions */
++#define X86_FEATURE_F16C (4*32+29) /* 16-bit fp conversions */
++#define X86_FEATURE_RDRAND (4*32+30) /* The RDRAND instruction */
+ #define X86_FEATURE_HYPERVISOR (4*32+31) /* Running on a hypervisor */
+
+ /* VIA/Cyrix/Centaur-defined CPU features, CPUID level 0xC0000001, word 5 */
+diff --git a/arch/x86/include/asm/k8.h b/arch/x86/include/asm/k8.h
+index f0746f4..41845d2 100644
+--- a/arch/x86/include/asm/k8.h
++++ b/arch/x86/include/asm/k8.h
+@@ -1,11 +1,13 @@
+ #ifndef _ASM_X86_K8_H
+ #define _ASM_X86_K8_H
+
++#include <linux/ioport.h>
+ #include <linux/pci.h>
+
+ extern struct pci_device_id k8_nb_ids[];
+
+ extern int early_is_k8_nb(u32 value);
++extern struct resource *amd_get_mmconfig_range(struct resource *res);
+ extern struct pci_dev **k8_northbridges;
+ extern int num_k8_northbridges;
+ extern int cache_k8_northbridges(void);
+diff --git a/arch/x86/include/asm/kvm_emulate.h b/arch/x86/include/asm/kvm_emulate.h
+index 5ed59ec..cc44e3d 100644
+--- a/arch/x86/include/asm/kvm_emulate.h
++++ b/arch/x86/include/asm/kvm_emulate.h
+@@ -109,6 +109,8 @@ struct x86_emulate_ops {
+ unsigned int bytes,
+ struct kvm_vcpu *vcpu);
+
++ bool (*get_cpuid)(struct x86_emulate_ctxt *ctxt,
++ u32 *eax, u32 *ebx, u32 *ecx, u32 *edx);
+ };
+
+ /* Type, address-of, and value of an instruction's operand. */
+@@ -190,6 +192,19 @@ struct x86_emulate_ctxt {
+ #define X86EMUL_MODE_HOST X86EMUL_MODE_PROT64
+ #endif
+
++/* CPUID vendors */
++#define X86EMUL_CPUID_VENDOR_AuthenticAMD_ebx 0x68747541
++#define X86EMUL_CPUID_VENDOR_AuthenticAMD_ecx 0x444d4163
++#define X86EMUL_CPUID_VENDOR_AuthenticAMD_edx 0x69746e65
++
++#define X86EMUL_CPUID_VENDOR_AMDisbetterI_ebx 0x69444d41
++#define X86EMUL_CPUID_VENDOR_AMDisbetterI_ecx 0x21726574
++#define X86EMUL_CPUID_VENDOR_AMDisbetterI_edx 0x74656273
++
++#define X86EMUL_CPUID_VENDOR_GenuineIntel_ebx 0x756e6547
++#define X86EMUL_CPUID_VENDOR_GenuineIntel_ecx 0x6c65746e
++#define X86EMUL_CPUID_VENDOR_GenuineIntel_edx 0x49656e69
++
+ int x86_decode_insn(struct x86_emulate_ctxt *ctxt,
+ struct x86_emulate_ops *ops);
+ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt,
+diff --git a/arch/x86/include/asm/timer.h b/arch/x86/include/asm/timer.h
+index b93a9aa..18e1ca7 100644
+--- a/arch/x86/include/asm/timer.h
++++ b/arch/x86/include/asm/timer.h
+@@ -63,14 +63,10 @@ DECLARE_PER_CPU(unsigned long long, cyc2ns_offset);
+
+ static inline unsigned long long __cycles_2_ns(unsigned long long cyc)
+ {
+- unsigned long long quot;
+- unsigned long long rem;
+ int cpu = smp_processor_id();
+ unsigned long long ns = per_cpu(cyc2ns_offset, cpu);
+- quot = (cyc >> CYC2NS_SCALE_FACTOR);
+- rem = cyc & ((1ULL << CYC2NS_SCALE_FACTOR) - 1);
+- ns += quot * per_cpu(cyc2ns, cpu) +
+- ((rem * per_cpu(cyc2ns, cpu)) >> CYC2NS_SCALE_FACTOR);
++ ns += mult_frac(cyc, per_cpu(cyc2ns, cpu),
++ (1UL << CYC2NS_SCALE_FACTOR));
+ return ns;
+ }
+
+diff --git a/arch/x86/kernel/cpu/Makefile b/arch/x86/kernel/cpu/Makefile
+index ff502cc..1f537a2 100644
+--- a/arch/x86/kernel/cpu/Makefile
++++ b/arch/x86/kernel/cpu/Makefile
+@@ -14,6 +14,7 @@ CFLAGS_common.o := $(nostackp)
+ obj-y := intel_cacheinfo.o addon_cpuid_features.o
+ obj-y += proc.o capflags.o powerflags.o common.o
+ obj-y += vmware.o hypervisor.o sched.o
++obj-y += rdrand.o
+
+ obj-$(CONFIG_X86_32) += bugs.o cmpxchg.o
+ obj-$(CONFIG_X86_64) += bugs_64.o
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index 4e34d10..ba1a1dd 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -15,6 +15,7 @@
+ #include <asm/stackprotector.h>
+ #include <asm/perf_event.h>
+ #include <asm/mmu_context.h>
++#include <asm/archrandom.h>
+ #include <asm/hypervisor.h>
+ #include <asm/processor.h>
+ #include <asm/sections.h>
+@@ -815,6 +816,7 @@ static void __cpuinit identify_cpu(struct cpuinfo_x86 *c)
+ #endif
+
+ init_hypervisor(c);
++ x86_init_rdrand(c);
+
+ /*
+ * Clear/Set all flags overriden by options, need do it
+diff --git a/arch/x86/kernel/cpu/rdrand.c b/arch/x86/kernel/cpu/rdrand.c
+new file mode 100644
+index 0000000..feca286
+--- /dev/null
++++ b/arch/x86/kernel/cpu/rdrand.c
+@@ -0,0 +1,73 @@
++/*
++ * This file is part of the Linux kernel.
++ *
++ * Copyright (c) 2011, Intel Corporation
++ * Authors: Fenghua Yu <fenghua.yu@intel.com>,
++ * H. Peter Anvin <hpa@linux.intel.com>
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms and conditions of the GNU General Public License,
++ * version 2, as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
++ * more details.
++ *
++ * You should have received a copy of the GNU General Public License along with
++ * this program; if not, write to the Free Software Foundation, Inc.,
++ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
++ *
++ */
++
++#include <asm/processor.h>
++#include <asm/archrandom.h>
++#include <asm/sections.h>
++
++static int __init x86_rdrand_setup(char *s)
++{
++ setup_clear_cpu_cap(X86_FEATURE_RDRAND);
++ return 1;
++}
++__setup("nordrand", x86_rdrand_setup);
++
++/* We can't use arch_get_random_long() here since alternatives haven't run */
++static inline int rdrand_long(unsigned long *v)
++{
++ int ok;
++ asm volatile("1: " RDRAND_LONG "\n\t"
++ "jc 2f\n\t"
++ "decl %0\n\t"
++ "jnz 1b\n\t"
++ "2:"
++ : "=r" (ok), "=a" (*v)
++ : "0" (RDRAND_RETRY_LOOPS));
++ return ok;
++}
++
++/*
++ * Force a reseed cycle; we are architecturally guaranteed a reseed
++ * after no more than 512 128-bit chunks of random data. This also
++ * acts as a test of the CPU capability.
++ */
++#define RESEED_LOOP ((512*128)/sizeof(unsigned long))
++
++void __cpuinit x86_init_rdrand(struct cpuinfo_x86 *c)
++{
++#ifdef CONFIG_ARCH_RANDOM
++ unsigned long tmp;
++ int i, count, ok;
++
++ if (!cpu_has(c, X86_FEATURE_RDRAND))
++ return; /* Nothing to do */
++
++ for (count = i = 0; i < RESEED_LOOP; i++) {
++ ok = rdrand_long(&tmp);
++ if (ok)
++ count++;
++ }
++
++ if (count != RESEED_LOOP)
++ clear_cpu_cap(c, X86_FEATURE_RDRAND);
++#endif
++}
+diff --git a/arch/x86/kernel/k8.c b/arch/x86/kernel/k8.c
+index 9b89546..2831a32 100644
+--- a/arch/x86/kernel/k8.c
++++ b/arch/x86/kernel/k8.c
+@@ -87,6 +87,37 @@ int __init early_is_k8_nb(u32 device)
+ return 0;
+ }
+
++struct resource *amd_get_mmconfig_range(struct resource *res)
++{
++ u32 address;
++ u64 base, msr;
++ unsigned segn_busn_bits;
++
++ if (boot_cpu_data.x86_vendor != X86_VENDOR_AMD)
++ return NULL;
++
++ /* assume all cpus from fam10h have mmconfig */
++ if (boot_cpu_data.x86 < 0x10)
++ return NULL;
++
++ address = MSR_FAM10H_MMIO_CONF_BASE;
++ rdmsrl(address, msr);
++
++ /* mmconfig is not enabled */
++ if (!(msr & FAM10H_MMIO_CONF_ENABLE))
++ return NULL;
++
++ base = msr & (FAM10H_MMIO_CONF_BASE_MASK<<FAM10H_MMIO_CONF_BASE_SHIFT);
++
++ segn_busn_bits = (msr >> FAM10H_MMIO_CONF_BUSRANGE_SHIFT) &
++ FAM10H_MMIO_CONF_BUSRANGE_MASK;
++
++ res->flags = IORESOURCE_MEM;
++ res->start = base;
++ res->end = base + (1ULL<<(segn_busn_bits + 20)) - 1;
++ return res;
++}
++
+ void k8_flush_garts(void)
+ {
+ int flushed, i;
+diff --git a/arch/x86/kernel/tls.c b/arch/x86/kernel/tls.c
+index 6bb7b85..bcfec2d 100644
+--- a/arch/x86/kernel/tls.c
++++ b/arch/x86/kernel/tls.c
+@@ -163,7 +163,7 @@ int regset_tls_get(struct task_struct *target, const struct user_regset *regset,
+ {
+ const struct desc_struct *tls;
+
+- if (pos > GDT_ENTRY_TLS_ENTRIES * sizeof(struct user_desc) ||
++ if (pos >= GDT_ENTRY_TLS_ENTRIES * sizeof(struct user_desc) ||
+ (pos % sizeof(struct user_desc)) != 0 ||
+ (count % sizeof(struct user_desc)) != 0)
+ return -EINVAL;
+@@ -198,7 +198,7 @@ int regset_tls_set(struct task_struct *target, const struct user_regset *regset,
+ struct user_desc infobuf[GDT_ENTRY_TLS_ENTRIES];
+ const struct user_desc *info;
+
+- if (pos > GDT_ENTRY_TLS_ENTRIES * sizeof(struct user_desc) ||
++ if (pos >= GDT_ENTRY_TLS_ENTRIES * sizeof(struct user_desc) ||
+ (pos % sizeof(struct user_desc)) != 0 ||
+ (count % sizeof(struct user_desc)) != 0)
+ return -EINVAL;
+diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
+index bc07543..9972276 100644
+--- a/arch/x86/kernel/tsc.c
++++ b/arch/x86/kernel/tsc.c
+@@ -623,7 +623,8 @@ static void set_cyc2ns_scale(unsigned long cpu_khz, int cpu)
+
+ if (cpu_khz) {
+ *scale = (NSEC_PER_MSEC << CYC2NS_SCALE_FACTOR)/cpu_khz;
+- *offset = ns_now - (tsc_now * *scale >> CYC2NS_SCALE_FACTOR);
++ *offset = ns_now - mult_frac(tsc_now, *scale,
++ (1UL << CYC2NS_SCALE_FACTOR));
+ }
+
+ sched_clock_idle_wakeup_event(0);
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index 1350e43..aa2d905 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -1495,20 +1495,73 @@ setup_syscalls_segments(struct x86_emulate_ctxt *ctxt,
+ ss->present = 1;
+ }
+
++static bool em_syscall_is_enabled(struct x86_emulate_ctxt *ctxt,
++ struct x86_emulate_ops *ops)
++{
++ u32 eax, ebx, ecx, edx;
++
++ /*
++ * syscall should always be enabled in longmode - so only become
++ * vendor specific (cpuid) if other modes are active...
++ */
++ if (ctxt->mode == X86EMUL_MODE_PROT64)
++ return true;
++
++ eax = 0x00000000;
++ ecx = 0x00000000;
++ if (ops->get_cpuid(ctxt, &eax, &ebx, &ecx, &edx)) {
++ /*
++ * Intel ("GenuineIntel")
++ * remark: Intel CPUs only support "syscall" in 64bit
++ * longmode. Also an 64bit guest with a
++ * 32bit compat-app running will #UD !! While this
++ * behaviour can be fixed (by emulating) into AMD
++ * response - CPUs of AMD can't behave like Intel.
++ */
++ if (ebx == X86EMUL_CPUID_VENDOR_GenuineIntel_ebx &&
++ ecx == X86EMUL_CPUID_VENDOR_GenuineIntel_ecx &&
++ edx == X86EMUL_CPUID_VENDOR_GenuineIntel_edx)
++ return false;
++
++ /* AMD ("AuthenticAMD") */
++ if (ebx == X86EMUL_CPUID_VENDOR_AuthenticAMD_ebx &&
++ ecx == X86EMUL_CPUID_VENDOR_AuthenticAMD_ecx &&
++ edx == X86EMUL_CPUID_VENDOR_AuthenticAMD_edx)
++ return true;
++
++ /* AMD ("AMDisbetter!") */
++ if (ebx == X86EMUL_CPUID_VENDOR_AMDisbetterI_ebx &&
++ ecx == X86EMUL_CPUID_VENDOR_AMDisbetterI_ecx &&
++ edx == X86EMUL_CPUID_VENDOR_AMDisbetterI_edx)
++ return true;
++ }
++
++ /* default: (not Intel, not AMD), apply Intel's stricter rules... */
++ return false;
++}
++
+ static int
+-emulate_syscall(struct x86_emulate_ctxt *ctxt)
++emulate_syscall(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
+ {
+ struct decode_cache *c = &ctxt->decode;
+ struct kvm_segment cs, ss;
+ u64 msr_data;
++ u64 efer = 0;
+
+ /* syscall is not available in real mode */
+ if (c->lock_prefix || ctxt->mode == X86EMUL_MODE_REAL
+ || ctxt->mode == X86EMUL_MODE_VM86)
+ return -1;
+
++ if (!(em_syscall_is_enabled(ctxt, ops)))
++ return -1;
++
++ kvm_x86_ops->get_msr(ctxt->vcpu, MSR_EFER, &efer);
+ setup_syscalls_segments(ctxt, &cs, &ss);
+
++ if (!(efer & EFER_SCE))
++ return -1;
++
+ kvm_x86_ops->get_msr(ctxt->vcpu, MSR_STAR, &msr_data);
+ msr_data >>= 32;
+ cs.selector = (u16)(msr_data & 0xfffc);
+@@ -2342,7 +2395,7 @@ twobyte_insn:
+ }
+ break;
+ case 0x05: /* syscall */
+- if (emulate_syscall(ctxt) == -1)
++ if (emulate_syscall(ctxt, ops) == -1)
+ goto cannot_emulate;
+ else
+ goto writeback;
+diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
+index 88ad162..7e361b4 100644
+--- a/arch/x86/kvm/i8254.c
++++ b/arch/x86/kvm/i8254.c
+@@ -277,11 +277,15 @@ static struct kvm_timer_ops kpit_ops = {
+ .is_periodic = kpit_is_periodic,
+ };
+
+-static void create_pit_timer(struct kvm_kpit_state *ps, u32 val, int is_period)
++static void create_pit_timer(struct kvm *kvm, u32 val, int is_period)
+ {
++ struct kvm_kpit_state *ps = &kvm->arch.vpit->pit_state;
+ struct kvm_timer *pt = &ps->pit_timer;
+ s64 interval;
+
++ if (!irqchip_in_kernel(kvm))
++ return;
++
+ interval = muldiv64(val, NSEC_PER_SEC, KVM_PIT_FREQ);
+
+ pr_debug("pit: create pit timer, interval is %llu nsec\n", interval);
+@@ -333,13 +337,13 @@ static void pit_load_count(struct kvm *kvm, int channel, u32 val)
+ /* FIXME: enhance mode 4 precision */
+ case 4:
+ if (!(ps->flags & KVM_PIT_FLAGS_HPET_LEGACY)) {
+- create_pit_timer(ps, val, 0);
++ create_pit_timer(kvm, val, 0);
+ }
+ break;
+ case 2:
+ case 3:
+ if (!(ps->flags & KVM_PIT_FLAGS_HPET_LEGACY)){
+- create_pit_timer(ps, val, 1);
++ create_pit_timer(kvm, val, 1);
+ }
+ break;
+ default:
+diff --git a/arch/x86/kvm/irq.h b/arch/x86/kvm/irq.h
+index 7d6058a..85a8721 100644
+--- a/arch/x86/kvm/irq.h
++++ b/arch/x86/kvm/irq.h
+@@ -85,7 +85,11 @@ static inline struct kvm_pic *pic_irqchip(struct kvm *kvm)
+
+ static inline int irqchip_in_kernel(struct kvm *kvm)
+ {
+- return pic_irqchip(kvm) != NULL;
++ int ret;
++
++ ret = (pic_irqchip(kvm) != NULL);
++ smp_rmb();
++ return ret;
+ }
+
+ void kvm_pic_reset(struct kvm_kpic_state *s);
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index df1cefb..271fddf 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -2273,25 +2273,42 @@ long kvm_arch_vm_ioctl(struct file *filp,
+ if (r)
+ goto out;
+ break;
+- case KVM_CREATE_IRQCHIP:
++ case KVM_CREATE_IRQCHIP: {
++ struct kvm_pic *vpic;
++
++ mutex_lock(&kvm->lock);
++ r = -EEXIST;
++ if (kvm->arch.vpic)
++ goto create_irqchip_unlock;
++ r = -EINVAL;
++ if (atomic_read(&kvm->online_vcpus))
++ goto create_irqchip_unlock;
+ r = -ENOMEM;
+- kvm->arch.vpic = kvm_create_pic(kvm);
+- if (kvm->arch.vpic) {
++ vpic = kvm_create_pic(kvm);
++ if (vpic) {
+ r = kvm_ioapic_init(kvm);
+ if (r) {
+- kfree(kvm->arch.vpic);
+- kvm->arch.vpic = NULL;
+- goto out;
++ kfree(vpic);
++ goto create_irqchip_unlock;
+ }
+ } else
+- goto out;
++ goto create_irqchip_unlock;
++ smp_wmb();
++ kvm->arch.vpic = vpic;
++ smp_wmb();
+ r = kvm_setup_default_irq_routing(kvm);
+ if (r) {
++ mutex_lock(&kvm->irq_lock);
+ kfree(kvm->arch.vpic);
+ kfree(kvm->arch.vioapic);
+- goto out;
++ kvm->arch.vpic = NULL;
++ kvm->arch.vioapic = NULL;
++ mutex_unlock(&kvm->irq_lock);
+ }
++ create_irqchip_unlock:
++ mutex_unlock(&kvm->lock);
+ break;
++ }
+ case KVM_CREATE_PIT:
+ u.pit_config.flags = KVM_PIT_SPEAKER_DUMMY;
+ goto create_pit;
+@@ -2871,12 +2888,35 @@ void kvm_report_emulation_failure(struct kvm_vcpu *vcpu, const char *context)
+ }
+ EXPORT_SYMBOL_GPL(kvm_report_emulation_failure);
+
++static bool emulator_get_cpuid(struct x86_emulate_ctxt *ctxt,
++ u32 *eax, u32 *ebx, u32 *ecx, u32 *edx)
++{
++ struct kvm_cpuid_entry2 *cpuid = NULL;
++
++ if (eax && ecx)
++ cpuid = kvm_find_cpuid_entry(ctxt->vcpu,
++ *eax, *ecx);
++
++ if (cpuid) {
++ *eax = cpuid->eax;
++ *ecx = cpuid->ecx;
++ if (ebx)
++ *ebx = cpuid->ebx;
++ if (edx)
++ *edx = cpuid->edx;
++ return true;
++ }
++
++ return false;
++}
++
+ static struct x86_emulate_ops emulate_ops = {
+ .read_std = kvm_read_guest_virt_system,
+ .fetch = kvm_fetch_guest_virt,
+ .read_emulated = emulator_read_emulated,
+ .write_emulated = emulator_write_emulated,
+ .cmpxchg_emulated = emulator_cmpxchg_emulated,
++ .get_cpuid = emulator_get_cpuid,
+ };
+
+ static void cache_all_regs(struct kvm_vcpu *vcpu)
+@@ -4990,6 +5030,11 @@ void kvm_arch_check_processor_compat(void *rtn)
+ kvm_x86_ops->check_processor_compatibility(rtn);
+ }
+
++bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu)
++{
++ return irqchip_in_kernel(vcpu->kvm) == (vcpu->arch.apic != NULL);
++}
++
+ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
+ {
+ struct page *page;
+diff --git a/arch/x86/lib/delay.c b/arch/x86/lib/delay.c
+index ff485d3..b6372ce 100644
+--- a/arch/x86/lib/delay.c
++++ b/arch/x86/lib/delay.c
+@@ -48,9 +48,9 @@ static void delay_loop(unsigned long loops)
+ }
+
+ /* TSC based delay: */
+-static void delay_tsc(unsigned long loops)
++static void delay_tsc(unsigned long __loops)
+ {
+- unsigned long bclock, now;
++ u32 bclock, now, loops = __loops;
+ int cpu;
+
+ preempt_disable();
+diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
+index 8ac0d76..249ad57 100644
+--- a/arch/x86/mm/fault.c
++++ b/arch/x86/mm/fault.c
+@@ -223,15 +223,14 @@ void vmalloc_sync_all(void)
+ address >= TASK_SIZE && address < FIXADDR_TOP;
+ address += PMD_SIZE) {
+
+- unsigned long flags;
+ struct page *page;
+
+- spin_lock_irqsave(&pgd_lock, flags);
++ spin_lock(&pgd_lock);
+ list_for_each_entry(page, &pgd_list, lru) {
+ if (!vmalloc_sync_one(page_address(page), address))
+ break;
+ }
+- spin_unlock_irqrestore(&pgd_lock, flags);
++ spin_unlock(&pgd_lock);
+ }
+ }
+
+@@ -331,13 +330,12 @@ void vmalloc_sync_all(void)
+ address += PGDIR_SIZE) {
+
+ const pgd_t *pgd_ref = pgd_offset_k(address);
+- unsigned long flags;
+ struct page *page;
+
+ if (pgd_none(*pgd_ref))
+ continue;
+
+- spin_lock_irqsave(&pgd_lock, flags);
++ spin_lock(&pgd_lock);
+ list_for_each_entry(page, &pgd_list, lru) {
+ pgd_t *pgd;
+ pgd = (pgd_t *)page_address(page) + pgd_index(address);
+@@ -346,7 +344,7 @@ void vmalloc_sync_all(void)
+ else
+ BUG_ON(pgd_page_vaddr(*pgd) != pgd_page_vaddr(*pgd_ref));
+ }
+- spin_unlock_irqrestore(&pgd_lock, flags);
++ spin_unlock(&pgd_lock);
+ }
+ }
+
+diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
+index dd38bfb..6d44087 100644
+--- a/arch/x86/mm/pageattr.c
++++ b/arch/x86/mm/pageattr.c
+@@ -56,12 +56,10 @@ static unsigned long direct_pages_count[PG_LEVEL_NUM];
+
+ void update_page_count(int level, unsigned long pages)
+ {
+- unsigned long flags;
+-
+ /* Protect against CPA */
+- spin_lock_irqsave(&pgd_lock, flags);
++ spin_lock(&pgd_lock);
+ direct_pages_count[level] += pages;
+- spin_unlock_irqrestore(&pgd_lock, flags);
++ spin_unlock(&pgd_lock);
+ }
+
+ static void split_page_count(int level)
+@@ -354,7 +352,7 @@ static int
+ try_preserve_large_page(pte_t *kpte, unsigned long address,
+ struct cpa_data *cpa)
+ {
+- unsigned long nextpage_addr, numpages, pmask, psize, flags, addr, pfn;
++ unsigned long nextpage_addr, numpages, pmask, psize, addr, pfn;
+ pte_t new_pte, old_pte, *tmp;
+ pgprot_t old_prot, new_prot;
+ int i, do_split = 1;
+@@ -363,7 +361,7 @@ try_preserve_large_page(pte_t *kpte, unsigned long address,
+ if (cpa->force_split)
+ return 1;
+
+- spin_lock_irqsave(&pgd_lock, flags);
++ spin_lock(&pgd_lock);
+ /*
+ * Check for races, another CPU might have split this page
+ * up already:
+@@ -458,14 +456,14 @@ try_preserve_large_page(pte_t *kpte, unsigned long address,
+ }
+
+ out_unlock:
+- spin_unlock_irqrestore(&pgd_lock, flags);
++ spin_unlock(&pgd_lock);
+
+ return do_split;
+ }
+
+ static int split_large_page(pte_t *kpte, unsigned long address)
+ {
+- unsigned long flags, pfn, pfninc = 1;
++ unsigned long pfn, pfninc = 1;
+ unsigned int i, level;
+ pte_t *pbase, *tmp;
+ pgprot_t ref_prot;
+@@ -479,7 +477,7 @@ static int split_large_page(pte_t *kpte, unsigned long address)
+ if (!base)
+ return -ENOMEM;
+
+- spin_lock_irqsave(&pgd_lock, flags);
++ spin_lock(&pgd_lock);
+ /*
+ * Check for races, another CPU might have split this page
+ * up for us already:
+@@ -551,7 +549,7 @@ out_unlock:
+ */
+ if (base)
+ __free_page(base);
+- spin_unlock_irqrestore(&pgd_lock, flags);
++ spin_unlock(&pgd_lock);
+
+ return 0;
+ }
+diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
+index e0e6fad..cb7cfc8 100644
+--- a/arch/x86/mm/pgtable.c
++++ b/arch/x86/mm/pgtable.c
+@@ -110,14 +110,12 @@ static void pgd_ctor(pgd_t *pgd)
+
+ static void pgd_dtor(pgd_t *pgd)
+ {
+- unsigned long flags; /* can be called from interrupt context */
+-
+ if (SHARED_KERNEL_PMD)
+ return;
+
+- spin_lock_irqsave(&pgd_lock, flags);
++ spin_lock(&pgd_lock);
+ pgd_list_del(pgd);
+- spin_unlock_irqrestore(&pgd_lock, flags);
++ spin_unlock(&pgd_lock);
+ }
+
+ /*
+@@ -248,7 +246,6 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
+ {
+ pgd_t *pgd;
+ pmd_t *pmds[PREALLOCATED_PMDS];
+- unsigned long flags;
+
+ pgd = (pgd_t *)__get_free_page(PGALLOC_GFP);
+
+@@ -268,12 +265,12 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
+ * respect to anything walking the pgd_list, so that they
+ * never see a partially populated pgd.
+ */
+- spin_lock_irqsave(&pgd_lock, flags);
++ spin_lock(&pgd_lock);
+
+ pgd_ctor(pgd);
+ pgd_prepopulate_pmd(mm, pgd, pmds);
+
+- spin_unlock_irqrestore(&pgd_lock, flags);
++ spin_unlock(&pgd_lock);
+
+ return pgd;
+
+diff --git a/arch/x86/oprofile/backtrace.c b/arch/x86/oprofile/backtrace.c
+index 829edf0..b50a280 100644
+--- a/arch/x86/oprofile/backtrace.c
++++ b/arch/x86/oprofile/backtrace.c
+@@ -71,9 +71,9 @@ copy_from_user_nmi(void *to, const void __user *from, unsigned long n)
+ offset = addr & (PAGE_SIZE - 1);
+ size = min(PAGE_SIZE - offset, n - len);
+
+- map = kmap_atomic(page, KM_USER0);
++ map = kmap_atomic(page, KM_NMI);
+ memcpy(to, map+offset, size);
+- kunmap_atomic(map, KM_USER0);
++ kunmap_atomic(map, KM_NMI);
+ put_page(page);
+
+ len += size;
+diff --git a/arch/x86/pci/amd_bus.c b/arch/x86/pci/amd_bus.c
+index 572ee97..aae9931 100644
+--- a/arch/x86/pci/amd_bus.c
++++ b/arch/x86/pci/amd_bus.c
+@@ -3,6 +3,7 @@
+ #include <linux/topology.h>
+ #include <linux/cpu.h>
+ #include <asm/pci_x86.h>
++#include <asm/k8.h>
+
+ #ifdef CONFIG_X86_64
+ #include <asm/pci-direct.h>
+@@ -190,34 +191,6 @@ static struct pci_hostbridge_probe pci_probes[] __initdata = {
+ { 0, 0x18, PCI_VENDOR_ID_AMD, 0x1300 },
+ };
+
+-static u64 __initdata fam10h_mmconf_start;
+-static u64 __initdata fam10h_mmconf_end;
+-static void __init get_pci_mmcfg_amd_fam10h_range(void)
+-{
+- u32 address;
+- u64 base, msr;
+- unsigned segn_busn_bits;
+-
+- /* assume all cpus from fam10h have mmconf */
+- if (boot_cpu_data.x86 < 0x10)
+- return;
+-
+- address = MSR_FAM10H_MMIO_CONF_BASE;
+- rdmsrl(address, msr);
+-
+- /* mmconfig is not enable */
+- if (!(msr & FAM10H_MMIO_CONF_ENABLE))
+- return;
+-
+- base = msr & (FAM10H_MMIO_CONF_BASE_MASK<<FAM10H_MMIO_CONF_BASE_SHIFT);
+-
+- segn_busn_bits = (msr >> FAM10H_MMIO_CONF_BUSRANGE_SHIFT) &
+- FAM10H_MMIO_CONF_BUSRANGE_MASK;
+-
+- fam10h_mmconf_start = base;
+- fam10h_mmconf_end = base + (1ULL<<(segn_busn_bits + 20)) - 1;
+-}
+-
+ /**
+ * early_fill_mp_bus_to_node()
+ * called before pcibios_scan_root and pci_scan_bus
+@@ -243,6 +216,9 @@ static int __init early_fill_mp_bus_info(void)
+ struct res_range range[RANGE_NUM];
+ u64 val;
+ u32 address;
++ struct resource fam10h_mmconf_res, *fam10h_mmconf;
++ u64 fam10h_mmconf_start;
++ u64 fam10h_mmconf_end;
+
+ if (!early_pci_allowed())
+ return -1;
+@@ -367,11 +343,16 @@ static int __init early_fill_mp_bus_info(void)
+ update_range(range, 0, end - 1);
+
+ /* get mmconfig */
+- get_pci_mmcfg_amd_fam10h_range();
++ fam10h_mmconf = amd_get_mmconfig_range(&fam10h_mmconf_res);
+ /* need to take out mmconf range */
+- if (fam10h_mmconf_end) {
+- printk(KERN_DEBUG "Fam 10h mmconf [%llx, %llx]\n", fam10h_mmconf_start, fam10h_mmconf_end);
++ if (fam10h_mmconf) {
++ printk(KERN_DEBUG "Fam 10h mmconf %pR\n", fam10h_mmconf);
++ fam10h_mmconf_start = fam10h_mmconf->start;
++ fam10h_mmconf_end = fam10h_mmconf->end;
+ update_range(range, fam10h_mmconf_start, fam10h_mmconf_end);
++ } else {
++ fam10h_mmconf_start = 0;
++ fam10h_mmconf_end = 0;
+ }
+
+ /* mmio resource */
+diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
+index 0087b00..d52f895 100644
+--- a/arch/x86/xen/enlighten.c
++++ b/arch/x86/xen/enlighten.c
+@@ -945,7 +945,10 @@ static const struct pv_cpu_ops xen_cpu_ops __initdata = {
+ .wbinvd = native_wbinvd,
+
+ .read_msr = native_read_msr_safe,
++ .rdmsr_regs = native_rdmsr_safe_regs,
+ .write_msr = xen_write_msr_safe,
++ .wrmsr_regs = native_wrmsr_safe_regs,
++
+ .read_tsc = native_read_tsc,
+ .read_pmc = native_read_pmc,
+
+diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
+index 3f90a2c..8f4452c 100644
+--- a/arch/x86/xen/mmu.c
++++ b/arch/x86/xen/mmu.c
+@@ -987,10 +987,9 @@ static void xen_pgd_pin(struct mm_struct *mm)
+ */
+ void xen_mm_pin_all(void)
+ {
+- unsigned long flags;
+ struct page *page;
+
+- spin_lock_irqsave(&pgd_lock, flags);
++ spin_lock(&pgd_lock);
+
+ list_for_each_entry(page, &pgd_list, lru) {
+ if (!PagePinned(page)) {
+@@ -999,7 +998,7 @@ void xen_mm_pin_all(void)
+ }
+ }
+
+- spin_unlock_irqrestore(&pgd_lock, flags);
++ spin_unlock(&pgd_lock);
+ }
+
+ /*
+@@ -1100,10 +1099,9 @@ static void xen_pgd_unpin(struct mm_struct *mm)
+ */
+ void xen_mm_unpin_all(void)
+ {
+- unsigned long flags;
+ struct page *page;
+
+- spin_lock_irqsave(&pgd_lock, flags);
++ spin_lock(&pgd_lock);
+
+ list_for_each_entry(page, &pgd_list, lru) {
+ if (PageSavePinned(page)) {
+@@ -1113,7 +1111,7 @@ void xen_mm_unpin_all(void)
+ }
+ }
+
+- spin_unlock_irqrestore(&pgd_lock, flags);
++ spin_unlock(&pgd_lock);
+ }
+
+ void xen_activate_mm(struct mm_struct *prev, struct mm_struct *next)
+diff --git a/arch/x86/xen/xen-asm.S b/arch/x86/xen/xen-asm.S
+index 79d7362..3e45aa0 100644
+--- a/arch/x86/xen/xen-asm.S
++++ b/arch/x86/xen/xen-asm.S
+@@ -96,7 +96,7 @@ ENTRY(xen_restore_fl_direct)
+
+ /* check for unmasked and pending */
+ cmpw $0x0001, PER_CPU_VAR(xen_vcpu_info) + XEN_vcpu_info_pending
+- jz 1f
++ jnz 1f
+ 2: call check_events
+ 1:
+ ENDPATCH(xen_restore_fl_direct)
+diff --git a/block/blk-ioc.c b/block/blk-ioc.c
+index d4ed600..cbdabb0 100644
+--- a/block/blk-ioc.c
++++ b/block/blk-ioc.c
+@@ -66,22 +66,22 @@ static void cfq_exit(struct io_context *ioc)
+ }
+
+ /* Called by the exitting task */
+-void exit_io_context(void)
++void exit_io_context(struct task_struct *task)
+ {
+ struct io_context *ioc;
+
+- task_lock(current);
+- ioc = current->io_context;
+- current->io_context = NULL;
+- task_unlock(current);
++ task_lock(task);
++ ioc = task->io_context;
++ task->io_context = NULL;
++ task_unlock(task);
+
+ if (atomic_dec_and_test(&ioc->nr_tasks)) {
+ if (ioc->aic && ioc->aic->exit)
+ ioc->aic->exit(ioc->aic);
+ cfq_exit(ioc);
+
+- put_io_context(ioc);
+ }
++ put_io_context(ioc);
+ }
+
+ struct io_context *alloc_io_context(gfp_t gfp_flags, int node)
+diff --git a/crypto/sha512_generic.c b/crypto/sha512_generic.c
+index 107f6f7..dd30f40 100644
+--- a/crypto/sha512_generic.c
++++ b/crypto/sha512_generic.c
+@@ -174,7 +174,7 @@ sha512_update(struct shash_desc *desc, const u8 *data, unsigned int len)
+ index = sctx->count[0] & 0x7f;
+
+ /* Update number of bytes */
+- if (!(sctx->count[0] += len))
++ if ((sctx->count[0] += len) < len)
+ sctx->count[1]++;
+
+ part_len = 128 - index;
+diff --git a/drivers/acpi/ac.c b/drivers/acpi/ac.c
+index b6ed60b..bc3f918 100644
+--- a/drivers/acpi/ac.c
++++ b/drivers/acpi/ac.c
+@@ -287,7 +287,9 @@ static int acpi_ac_add(struct acpi_device *device)
+ ac->charger.properties = ac_props;
+ ac->charger.num_properties = ARRAY_SIZE(ac_props);
+ ac->charger.get_property = get_ac_property;
+- power_supply_register(&ac->device->dev, &ac->charger);
++ result = power_supply_register(&ac->device->dev, &ac->charger);
++ if (result)
++ goto end;
+ #endif
+
+ printk(KERN_INFO PREFIX "%s [%s] (%s)\n",
+diff --git a/drivers/block/cciss_scsi.c b/drivers/block/cciss_scsi.c
+index 3315268..ad8e592 100644
+--- a/drivers/block/cciss_scsi.c
++++ b/drivers/block/cciss_scsi.c
+@@ -747,17 +747,7 @@ complete_scsi_command( CommandList_struct *cp, int timeout, __u32 tag)
+ {
+ case CMD_TARGET_STATUS:
+ /* Pass it up to the upper layers... */
+- if( ei->ScsiStatus)
+- {
+-#if 0
+- printk(KERN_WARNING "cciss: cmd %p "
+- "has SCSI Status = %x\n",
+- cp,
+- ei->ScsiStatus);
+-#endif
+- cmd->result |= (ei->ScsiStatus < 1);
+- }
+- else { /* scsi status is zero??? How??? */
++ if (!ei->ScsiStatus) {
+
+ /* Ordinarily, this case should never happen, but there is a bug
+ in some released firmware revisions that allows it to happen
+diff --git a/drivers/block/sx8.c b/drivers/block/sx8.c
+index a7c4184..bcbfc20 100644
+--- a/drivers/block/sx8.c
++++ b/drivers/block/sx8.c
+@@ -1116,7 +1116,7 @@ static inline void carm_handle_resp(struct carm_host *host,
+ break;
+ case MISC_GET_FW_VER: {
+ struct carm_fw_ver *ver = (struct carm_fw_ver *)
+- mem + sizeof(struct carm_msg_get_fw_ver);
++ (mem + sizeof(struct carm_msg_get_fw_ver));
+ if (!error) {
+ host->fw_ver = le32_to_cpu(ver->version);
+ host->flags |= (ver->features & FL_FW_VER_MASK);
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 75185a6..a562761 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -470,15 +470,10 @@ static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags)
+
+ pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress);
+
+- urb->dev = data->udev;
+- urb->pipe = pipe;
+- urb->context = hdev;
+- urb->complete = btusb_isoc_complete;
+- urb->interval = data->isoc_rx_ep->bInterval;
++ usb_fill_int_urb(urb, data->udev, pipe, buf, size, btusb_isoc_complete,
++ hdev, data->isoc_rx_ep->bInterval);
+
+ urb->transfer_flags = URB_FREE_BUFFER | URB_ISO_ASAP;
+- urb->transfer_buffer = buf;
+- urb->transfer_buffer_length = size;
+
+ __fill_isoc_descriptor(urb, size,
+ le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize));
+diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
+index e3d4eda..d68e2f5 100644
+--- a/drivers/bluetooth/hci_ldisc.c
++++ b/drivers/bluetooth/hci_ldisc.c
+@@ -312,9 +312,11 @@ static void hci_uart_tty_close(struct tty_struct *tty)
+ hci_uart_close(hdev);
+
+ if (test_and_clear_bit(HCI_UART_PROTO_SET, &hu->flags)) {
++ if (hdev) {
++ hci_unregister_dev(hdev);
++ hci_free_dev(hdev);
++ }
+ hu->proto->close(hu);
+- hci_unregister_dev(hdev);
+- hci_free_dev(hdev);
+ }
+ }
+ }
+diff --git a/drivers/char/random.c b/drivers/char/random.c
+index 3a19e2d..446b20a 100644
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -125,20 +125,32 @@
+ * The current exported interfaces for gathering environmental noise
+ * from the devices are:
+ *
++ * void add_device_randomness(const void *buf, unsigned int size);
+ * void add_input_randomness(unsigned int type, unsigned int code,
+ * unsigned int value);
+- * void add_interrupt_randomness(int irq);
++ * void add_interrupt_randomness(int irq, int irq_flags);
++ * void add_disk_randomness(struct gendisk *disk);
++ *
++ * add_device_randomness() is for adding data to the random pool that
++ * is likely to differ between two devices (or possibly even per boot).
++ * This would be things like MAC addresses or serial numbers, or the
++ * read-out of the RTC. This does *not* add any actual entropy to the
++ * pool, but it initializes the pool to different values for devices
++ * that might otherwise be identical and have very little entropy
++ * available to them (particularly common in the embedded world).
+ *
+ * add_input_randomness() uses the input layer interrupt timing, as well as
+ * the event type information from the hardware.
+ *
+- * add_interrupt_randomness() uses the inter-interrupt timing as random
+- * inputs to the entropy pool. Note that not all interrupts are good
+- * sources of randomness! For example, the timer interrupts is not a
+- * good choice, because the periodicity of the interrupts is too
+- * regular, and hence predictable to an attacker. Disk interrupts are
+- * a better measure, since the timing of the disk interrupts are more
+- * unpredictable.
++ * add_interrupt_randomness() uses the interrupt timing as random
++ * inputs to the entropy pool. Using the cycle counters and the irq source
++ * as inputs, it feeds the randomness roughly once a second.
++ *
++ * add_disk_randomness() uses what amounts to the seek time of block
++ * layer request events, on a per-disk_devt basis, as input to the
++ * entropy pool. Note that high-speed solid state drives with very low
++ * seek times do not make for good sources of entropy, as their seek
++ * times are usually fairly consistent.
+ *
+ * All of these routines try to estimate how many bits of randomness a
+ * particular randomness source. They do this by keeping track of the
+@@ -241,6 +253,8 @@
+ #include <linux/percpu.h>
+ #include <linux/cryptohash.h>
+ #include <linux/fips.h>
++#include <linux/ptrace.h>
++#include <linux/kmemcheck.h>
+
+ #ifdef CONFIG_GENERIC_HARDIRQS
+ # include <linux/irq.h>
+@@ -249,6 +263,7 @@
+ #include <asm/processor.h>
+ #include <asm/uaccess.h>
+ #include <asm/irq.h>
++#include <asm/irq_regs.h>
+ #include <asm/io.h>
+
+ /*
+@@ -257,6 +272,9 @@
+ #define INPUT_POOL_WORDS 128
+ #define OUTPUT_POOL_WORDS 32
+ #define SEC_XFER_SIZE 512
++#define EXTRACT_SIZE 10
++
++#define LONGS(x) (((x) + sizeof(unsigned long) - 1)/sizeof(unsigned long))
+
+ /*
+ * The minimum number of bits of entropy before we wake up a read on
+@@ -406,15 +424,17 @@ struct entropy_store {
+ struct poolinfo *poolinfo;
+ __u32 *pool;
+ const char *name;
+- int limit;
+ struct entropy_store *pull;
++ int limit;
+
+ /* read-write data: */
+ spinlock_t lock;
+ unsigned add_ptr;
++ unsigned input_rotate;
+ int entropy_count;
+- int input_rotate;
+- __u8 *last_data;
++ int entropy_total;
++ unsigned int initialized:1;
++ __u8 last_data[EXTRACT_SIZE];
+ };
+
+ static __u32 input_pool_data[INPUT_POOL_WORDS];
+@@ -446,6 +466,10 @@ static struct entropy_store nonblocking_pool = {
+ .pool = nonblocking_pool_data
+ };
+
++static __u32 const twist_table[8] = {
++ 0x00000000, 0x3b6e20c8, 0x76dc4190, 0x4db26158,
++ 0xedb88320, 0xd6d6a3e8, 0x9b64c2b0, 0xa00ae278 };
++
+ /*
+ * This function adds bytes into the entropy "pool". It does not
+ * update the entropy estimate. The caller should call
+@@ -456,29 +480,24 @@ static struct entropy_store nonblocking_pool = {
+ * it's cheap to do so and helps slightly in the expected case where
+ * the entropy is concentrated in the low-order bits.
+ */
+-static void mix_pool_bytes_extract(struct entropy_store *r, const void *in,
+- int nbytes, __u8 out[64])
++static void __mix_pool_bytes(struct entropy_store *r, const void *in,
++ int nbytes, __u8 out[64])
+ {
+- static __u32 const twist_table[8] = {
+- 0x00000000, 0x3b6e20c8, 0x76dc4190, 0x4db26158,
+- 0xedb88320, 0xd6d6a3e8, 0x9b64c2b0, 0xa00ae278 };
+ unsigned long i, j, tap1, tap2, tap3, tap4, tap5;
+ int input_rotate;
+ int wordmask = r->poolinfo->poolwords - 1;
+ const char *bytes = in;
+ __u32 w;
+- unsigned long flags;
+
+- /* Taps are constant, so we can load them without holding r->lock. */
+ tap1 = r->poolinfo->tap1;
+ tap2 = r->poolinfo->tap2;
+ tap3 = r->poolinfo->tap3;
+ tap4 = r->poolinfo->tap4;
+ tap5 = r->poolinfo->tap5;
+
+- spin_lock_irqsave(&r->lock, flags);
+- input_rotate = r->input_rotate;
+- i = r->add_ptr;
++ smp_rmb();
++ input_rotate = ACCESS_ONCE(r->input_rotate);
++ i = ACCESS_ONCE(r->add_ptr);
+
+ /* mix one byte at a time to simplify size handling and churn faster */
+ while (nbytes--) {
+@@ -505,19 +524,53 @@ static void mix_pool_bytes_extract(struct entropy_store *r, const void *in,
+ input_rotate += i ? 7 : 14;
+ }
+
+- r->input_rotate = input_rotate;
+- r->add_ptr = i;
++ ACCESS_ONCE(r->input_rotate) = input_rotate;
++ ACCESS_ONCE(r->add_ptr) = i;
++ smp_wmb();
+
+ if (out)
+ for (j = 0; j < 16; j++)
+ ((__u32 *)out)[j] = r->pool[(i - j) & wordmask];
++}
+
++static void mix_pool_bytes(struct entropy_store *r, const void *in,
++ int nbytes, __u8 out[64])
++{
++ unsigned long flags;
++
++ spin_lock_irqsave(&r->lock, flags);
++ __mix_pool_bytes(r, in, nbytes, out);
+ spin_unlock_irqrestore(&r->lock, flags);
+ }
+
+-static void mix_pool_bytes(struct entropy_store *r, const void *in, int bytes)
++struct fast_pool {
++ __u32 pool[4];
++ unsigned long last;
++ unsigned short count;
++ unsigned char rotate;
++ unsigned char last_timer_intr;
++};
++
++/*
++ * This is a fast mixing routine used by the interrupt randomness
++ * collector. It's hardcoded for an 128 bit pool and assumes that any
++ * locks that might be needed are taken by the caller.
++ */
++static void fast_mix(struct fast_pool *f, const void *in, int nbytes)
+ {
+- mix_pool_bytes_extract(r, in, bytes, NULL);
++ const char *bytes = in;
++ __u32 w;
++ unsigned i = f->count;
++ unsigned input_rotate = f->rotate;
++
++ while (nbytes--) {
++ w = rol32(*bytes++, input_rotate & 31) ^ f->pool[i & 3] ^
++ f->pool[(i + 1) & 3];
++ f->pool[i & 3] = (w >> 3) ^ twist_table[w & 7];
++ input_rotate += (i++ & 3) ? 7 : 14;
++ }
++ f->count = i;
++ f->rotate = input_rotate;
+ }
+
+ /*
+@@ -525,30 +578,34 @@ static void mix_pool_bytes(struct entropy_store *r, const void *in, int bytes)
+ */
+ static void credit_entropy_bits(struct entropy_store *r, int nbits)
+ {
+- unsigned long flags;
+- int entropy_count;
++ int entropy_count, orig;
+
+ if (!nbits)
+ return;
+
+- spin_lock_irqsave(&r->lock, flags);
+-
+ DEBUG_ENT("added %d entropy credits to %s\n", nbits, r->name);
+- entropy_count = r->entropy_count;
++retry:
++ entropy_count = orig = ACCESS_ONCE(r->entropy_count);
+ entropy_count += nbits;
+ if (entropy_count < 0) {
+ DEBUG_ENT("negative entropy/overflow\n");
+ entropy_count = 0;
+ } else if (entropy_count > r->poolinfo->POOLBITS)
+ entropy_count = r->poolinfo->POOLBITS;
+- r->entropy_count = entropy_count;
++ if (cmpxchg(&r->entropy_count, orig, entropy_count) != orig)
++ goto retry;
++
++ if (!r->initialized && nbits > 0) {
++ r->entropy_total += nbits;
++ if (r->entropy_total > 128)
++ r->initialized = 1;
++ }
+
+ /* should we wake readers? */
+ if (r == &input_pool && entropy_count >= random_read_wakeup_thresh) {
+ wake_up_interruptible(&random_read_wait);
+ kill_fasync(&fasync, SIGIO, POLL_IN);
+ }
+- spin_unlock_irqrestore(&r->lock, flags);
+ }
+
+ /*********************************************************************
+@@ -564,42 +621,24 @@ struct timer_rand_state {
+ unsigned dont_count_entropy:1;
+ };
+
+-#ifndef CONFIG_GENERIC_HARDIRQS
+-
+-static struct timer_rand_state *irq_timer_state[NR_IRQS];
+-
+-static struct timer_rand_state *get_timer_rand_state(unsigned int irq)
+-{
+- return irq_timer_state[irq];
+-}
+-
+-static void set_timer_rand_state(unsigned int irq,
+- struct timer_rand_state *state)
+-{
+- irq_timer_state[irq] = state;
+-}
+-
+-#else
+-
+-static struct timer_rand_state *get_timer_rand_state(unsigned int irq)
+-{
+- struct irq_desc *desc;
+-
+- desc = irq_to_desc(irq);
+-
+- return desc->timer_rand_state;
+-}
+-
+-static void set_timer_rand_state(unsigned int irq,
+- struct timer_rand_state *state)
++/*
++ * Add device- or boot-specific data to the input and nonblocking
++ * pools to help initialize them to unique values.
++ *
++ * None of this adds any entropy, it is meant to avoid the
++ * problem of the nonblocking pool having similar initial state
++ * across largely identical devices.
++ */
++void add_device_randomness(const void *buf, unsigned int size)
+ {
+- struct irq_desc *desc;
+-
+- desc = irq_to_desc(irq);
++ unsigned long time = get_cycles() ^ jiffies;
+
+- desc->timer_rand_state = state;
++ mix_pool_bytes(&input_pool, buf, size, NULL);
++ mix_pool_bytes(&input_pool, &time, sizeof(time), NULL);
++ mix_pool_bytes(&nonblocking_pool, buf, size, NULL);
++ mix_pool_bytes(&nonblocking_pool, &time, sizeof(time), NULL);
+ }
+-#endif
++EXPORT_SYMBOL(add_device_randomness);
+
+ static struct timer_rand_state input_timer_state;
+
+@@ -616,8 +655,8 @@ static struct timer_rand_state input_timer_state;
+ static void add_timer_randomness(struct timer_rand_state *state, unsigned num)
+ {
+ struct {
+- cycles_t cycles;
+ long jiffies;
++ unsigned cycles;
+ unsigned num;
+ } sample;
+ long delta, delta2, delta3;
+@@ -631,7 +670,7 @@ static void add_timer_randomness(struct timer_rand_state *state, unsigned num)
+ sample.jiffies = jiffies;
+ sample.cycles = get_cycles();
+ sample.num = num;
+- mix_pool_bytes(&input_pool, &sample, sizeof(sample));
++ mix_pool_bytes(&input_pool, &sample, sizeof(sample), NULL);
+
+ /*
+ * Calculate number of bits of randomness we probably added.
+@@ -688,17 +727,48 @@ void add_input_randomness(unsigned int type, unsigned int code,
+ }
+ EXPORT_SYMBOL_GPL(add_input_randomness);
+
+-void add_interrupt_randomness(int irq)
++static DEFINE_PER_CPU(struct fast_pool, irq_randomness);
++
++void add_interrupt_randomness(int irq, int irq_flags)
+ {
+- struct timer_rand_state *state;
++ struct entropy_store *r;
++ struct fast_pool *fast_pool = &__get_cpu_var(irq_randomness);
++ struct pt_regs *regs = get_irq_regs();
++ unsigned long now = jiffies;
++ __u32 input[4], cycles = get_cycles();
++
++ input[0] = cycles ^ jiffies;
++ input[1] = irq;
++ if (regs) {
++ __u64 ip = instruction_pointer(regs);
++ input[2] = ip;
++ input[3] = ip >> 32;
++ }
+
+- state = get_timer_rand_state(irq);
++ fast_mix(fast_pool, input, sizeof(input));
+
+- if (state == NULL)
++ if ((fast_pool->count & 1023) &&
++ !time_after(now, fast_pool->last + HZ))
+ return;
+
+- DEBUG_ENT("irq event %d\n", irq);
+- add_timer_randomness(state, 0x100 + irq);
++ fast_pool->last = now;
++
++ r = nonblocking_pool.initialized ? &input_pool : &nonblocking_pool;
++ __mix_pool_bytes(r, &fast_pool->pool, sizeof(fast_pool->pool), NULL);
++ /*
++ * If we don't have a valid cycle counter, and we see
++ * back-to-back timer interrupts, then skip giving credit for
++ * any entropy.
++ */
++ if (cycles == 0) {
++ if (irq_flags & __IRQF_TIMER) {
++ if (fast_pool->last_timer_intr)
++ return;
++ fast_pool->last_timer_intr = 1;
++ } else
++ fast_pool->last_timer_intr = 0;
++ }
++ credit_entropy_bits(r, 1);
+ }
+
+ #ifdef CONFIG_BLOCK
+@@ -714,8 +784,6 @@ void add_disk_randomness(struct gendisk *disk)
+ }
+ #endif
+
+-#define EXTRACT_SIZE 10
+-
+ /*********************************************************************
+ *
+ * Entropy extraction routines
+@@ -732,7 +800,7 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
+ */
+ static void xfer_secondary_pool(struct entropy_store *r, size_t nbytes)
+ {
+- __u32 tmp[OUTPUT_POOL_WORDS];
++ __u32 tmp[OUTPUT_POOL_WORDS];
+
+ if (r->pull && r->entropy_count < nbytes * 8 &&
+ r->entropy_count < r->poolinfo->POOLBITS) {
+@@ -751,7 +819,7 @@ static void xfer_secondary_pool(struct entropy_store *r, size_t nbytes)
+
+ bytes = extract_entropy(r->pull, tmp, bytes,
+ random_read_wakeup_thresh / 8, rsvd);
+- mix_pool_bytes(r, tmp, bytes);
++ mix_pool_bytes(r, tmp, bytes, NULL);
+ credit_entropy_bits(r, bytes*8);
+ }
+ }
+@@ -810,13 +878,19 @@ static size_t account(struct entropy_store *r, size_t nbytes, int min,
+ static void extract_buf(struct entropy_store *r, __u8 *out)
+ {
+ int i;
+- __u32 hash[5], workspace[SHA_WORKSPACE_WORDS];
++ union {
++ __u32 w[5];
++ unsigned long l[LONGS(EXTRACT_SIZE)];
++ } hash;
++ __u32 workspace[SHA_WORKSPACE_WORDS];
+ __u8 extract[64];
++ unsigned long flags;
+
+ /* Generate a hash across the pool, 16 words (512 bits) at a time */
+- sha_init(hash);
++ sha_init(hash.w);
++ spin_lock_irqsave(&r->lock, flags);
+ for (i = 0; i < r->poolinfo->poolwords; i += 16)
+- sha_transform(hash, (__u8 *)(r->pool + i), workspace);
++ sha_transform(hash.w, (__u8 *)(r->pool + i), workspace);
+
+ /*
+ * We mix the hash back into the pool to prevent backtracking
+@@ -827,13 +901,14 @@ static void extract_buf(struct entropy_store *r, __u8 *out)
+ * brute-forcing the feedback as hard as brute-forcing the
+ * hash.
+ */
+- mix_pool_bytes_extract(r, hash, sizeof(hash), extract);
++ __mix_pool_bytes(r, hash.w, sizeof(hash.w), extract);
++ spin_unlock_irqrestore(&r->lock, flags);
+
+ /*
+ * To avoid duplicates, we atomically extract a portion of the
+ * pool while mixing, and hash one final time.
+ */
+- sha_transform(hash, extract, workspace);
++ sha_transform(hash.w, extract, workspace);
+ memset(extract, 0, sizeof(extract));
+ memset(workspace, 0, sizeof(workspace));
+
+@@ -842,19 +917,30 @@ static void extract_buf(struct entropy_store *r, __u8 *out)
+ * pattern, we fold it in half. Thus, we always feed back
+ * twice as much data as we output.
+ */
+- hash[0] ^= hash[3];
+- hash[1] ^= hash[4];
+- hash[2] ^= rol32(hash[2], 16);
+- memcpy(out, hash, EXTRACT_SIZE);
+- memset(hash, 0, sizeof(hash));
++ hash.w[0] ^= hash.w[3];
++ hash.w[1] ^= hash.w[4];
++ hash.w[2] ^= rol32(hash.w[2], 16);
++
++ /*
++ * If we have a architectural hardware random number
++ * generator, mix that in, too.
++ */
++ for (i = 0; i < LONGS(EXTRACT_SIZE); i++) {
++ unsigned long v;
++ if (!arch_get_random_long(&v))
++ break;
++ hash.l[i] ^= v;
++ }
++
++ memcpy(out, &hash, EXTRACT_SIZE);
++ memset(&hash, 0, sizeof(hash));
+ }
+
+ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
+- size_t nbytes, int min, int reserved)
++ size_t nbytes, int min, int reserved)
+ {
+ ssize_t ret = 0, i;
+ __u8 tmp[EXTRACT_SIZE];
+- unsigned long flags;
+
+ xfer_secondary_pool(r, nbytes);
+ nbytes = account(r, nbytes, min, reserved);
+@@ -862,7 +948,9 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
+ while (nbytes) {
+ extract_buf(r, tmp);
+
+- if (r->last_data) {
++ if (fips_enabled) {
++ unsigned long flags;
++
+ spin_lock_irqsave(&r->lock, flags);
+ if (!memcmp(tmp, r->last_data, EXTRACT_SIZE))
+ panic("Hardware RNG duplicated output!\n");
+@@ -921,8 +1009,9 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf,
+
+ /*
+ * This function is the exported kernel interface. It returns some
+- * number of good random numbers, suitable for seeding TCP sequence
+- * numbers, etc.
++ * number of good random numbers, suitable for key generation, seeding
++ * TCP sequence numbers, etc. It does not use the hw random number
++ * generator, if available; use get_random_bytes_arch() for that.
+ */
+ void get_random_bytes(void *buf, int nbytes)
+ {
+@@ -931,6 +1020,38 @@ void get_random_bytes(void *buf, int nbytes)
+ EXPORT_SYMBOL(get_random_bytes);
+
+ /*
++ * This function will use the architecture-specific hardware random
++ * number generator if it is available. The arch-specific hw RNG will
++ * almost certainly be faster than what we can do in software, but it
++ * is impossible to verify that it is implemented securely (as
++ * opposed, to, say, the AES encryption of a sequence number using a
++ * key known by the NSA). So it's useful if we need the speed, but
++ * only if we're willing to trust the hardware manufacturer not to
++ * have put in a back door.
++ */
++void get_random_bytes_arch(void *buf, int nbytes)
++{
++ char *p = buf;
++
++ while (nbytes) {
++ unsigned long v;
++ int chunk = min(nbytes, (int)sizeof(unsigned long));
++
++ if (!arch_get_random_long(&v))
++ break;
++
++ memcpy(p, &v, chunk);
++ p += chunk;
++ nbytes -= chunk;
++ }
++
++ if (nbytes)
++ extract_entropy(&nonblocking_pool, p, nbytes, 0, 0);
++}
++EXPORT_SYMBOL(get_random_bytes_arch);
++
++
++/*
+ * init_std_data - initialize pool with system data
+ *
+ * @r: pool to initialize
+@@ -941,21 +1062,31 @@ EXPORT_SYMBOL(get_random_bytes);
+ */
+ static void init_std_data(struct entropy_store *r)
+ {
+- ktime_t now;
+- unsigned long flags;
++ int i;
++ ktime_t now = ktime_get_real();
++ unsigned long rv;
+
+- spin_lock_irqsave(&r->lock, flags);
+ r->entropy_count = 0;
+- spin_unlock_irqrestore(&r->lock, flags);
+-
+- now = ktime_get_real();
+- mix_pool_bytes(r, &now, sizeof(now));
+- mix_pool_bytes(r, utsname(), sizeof(*(utsname())));
+- /* Enable continuous test in fips mode */
+- if (fips_enabled)
+- r->last_data = kmalloc(EXTRACT_SIZE, GFP_KERNEL);
++ r->entropy_total = 0;
++ mix_pool_bytes(r, &now, sizeof(now), NULL);
++ for (i = r->poolinfo->POOLBYTES; i > 0; i -= sizeof(rv)) {
++ if (!arch_get_random_long(&rv))
++ break;
++ mix_pool_bytes(r, &rv, sizeof(rv), NULL);
++ }
++ mix_pool_bytes(r, utsname(), sizeof(*(utsname())), NULL);
+ }
+
++/*
++ * Note that setup_arch() may call add_device_randomness()
++ * long before we get here. This allows seeding of the pools
++ * with some platform dependent data very early in the boot
++ * process. But it limits our options here. We must use
++ * statically allocated structures that already have all
++ * initializations complete at compile time. We should also
++ * take care not to overwrite the precious per platform data
++ * we were given.
++ */
+ static int rand_initialize(void)
+ {
+ init_std_data(&input_pool);
+@@ -965,24 +1096,6 @@ static int rand_initialize(void)
+ }
+ module_init(rand_initialize);
+
+-void rand_initialize_irq(int irq)
+-{
+- struct timer_rand_state *state;
+-
+- state = get_timer_rand_state(irq);
+-
+- if (state)
+- return;
+-
+- /*
+- * If kzalloc returns null, we just won't use that entropy
+- * source.
+- */
+- state = kzalloc(sizeof(struct timer_rand_state), GFP_KERNEL);
+- if (state)
+- set_timer_rand_state(irq, state);
+-}
+-
+ #ifdef CONFIG_BLOCK
+ void rand_initialize_disk(struct gendisk *disk)
+ {
+@@ -1090,7 +1203,7 @@ write_pool(struct entropy_store *r, const char __user *buffer, size_t count)
+ count -= bytes;
+ p += bytes;
+
+- mix_pool_bytes(r, buf, bytes);
++ mix_pool_bytes(r, buf, bytes, NULL);
+ cond_resched();
+ }
+
+@@ -1231,10 +1344,15 @@ static int proc_do_uuid(ctl_table *table, int write,
+ uuid = table->data;
+ if (!uuid) {
+ uuid = tmp_uuid;
+- uuid[8] = 0;
+- }
+- if (uuid[8] == 0)
+ generate_random_uuid(uuid);
++ } else {
++ static DEFINE_SPINLOCK(bootid_spinlock);
++
++ spin_lock(&bootid_spinlock);
++ if (!uuid[8])
++ generate_random_uuid(uuid);
++ spin_unlock(&bootid_spinlock);
++ }
+
+ sprintf(buf, "%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-"
+ "%02x%02x%02x%02x%02x%02x",
+@@ -1357,9 +1475,14 @@ late_initcall(random_int_secret_init);
+ DEFINE_PER_CPU(__u32 [MD5_DIGEST_WORDS], get_random_int_hash);
+ unsigned int get_random_int(void)
+ {
+- __u32 *hash = get_cpu_var(get_random_int_hash);
++ __u32 *hash;
+ unsigned int ret;
+
++ if (arch_get_random_int(&ret))
++ return ret;
++
++ hash = get_cpu_var(get_random_int_hash);
++
+ hash[0] += current->pid + jiffies + get_cycles();
+ md5_transform(hash, random_int_secret);
+ ret = hash[0];
+diff --git a/drivers/char/tty_audit.c b/drivers/char/tty_audit.c
+index ac16fbe..dd4691a 100644
+--- a/drivers/char/tty_audit.c
++++ b/drivers/char/tty_audit.c
+@@ -94,8 +94,10 @@ static void tty_audit_buf_push(struct task_struct *tsk, uid_t loginuid,
+ {
+ if (buf->valid == 0)
+ return;
+- if (audit_enabled == 0)
++ if (audit_enabled == 0) {
++ buf->valid = 0;
+ return;
++ }
+ tty_audit_log("tty", tsk, loginuid, sessionid, buf->major, buf->minor,
+ buf->data, buf->valid);
+ buf->valid = 0;
+diff --git a/drivers/dma/ioat/dma_v2.c b/drivers/dma/ioat/dma_v2.c
+index 5cc37af..d1be371 100644
+--- a/drivers/dma/ioat/dma_v2.c
++++ b/drivers/dma/ioat/dma_v2.c
+@@ -51,48 +51,40 @@ MODULE_PARM_DESC(ioat_ring_max_alloc_order,
+
+ void __ioat2_issue_pending(struct ioat2_dma_chan *ioat)
+ {
+- void * __iomem reg_base = ioat->base.reg_base;
++ struct ioat_chan_common *chan = &ioat->base;
+
+- ioat->pending = 0;
+ ioat->dmacount += ioat2_ring_pending(ioat);
+ ioat->issued = ioat->head;
+ /* make descriptor updates globally visible before notifying channel */
+ wmb();
+- writew(ioat->dmacount, reg_base + IOAT_CHAN_DMACOUNT_OFFSET);
+- dev_dbg(to_dev(&ioat->base),
++ writew(ioat->dmacount, chan->reg_base + IOAT_CHAN_DMACOUNT_OFFSET);
++ dev_dbg(to_dev(chan),
+ "%s: head: %#x tail: %#x issued: %#x count: %#x\n",
+ __func__, ioat->head, ioat->tail, ioat->issued, ioat->dmacount);
+ }
+
+-void ioat2_issue_pending(struct dma_chan *chan)
++void ioat2_issue_pending(struct dma_chan *c)
+ {
+- struct ioat2_dma_chan *ioat = to_ioat2_chan(chan);
++ struct ioat2_dma_chan *ioat = to_ioat2_chan(c);
+
+- spin_lock_bh(&ioat->ring_lock);
+- if (ioat->pending == 1)
++ if (ioat2_ring_pending(ioat)) {
++ spin_lock_bh(&ioat->ring_lock);
+ __ioat2_issue_pending(ioat);
+- spin_unlock_bh(&ioat->ring_lock);
++ spin_unlock_bh(&ioat->ring_lock);
++ }
+ }
+
+ /**
+ * ioat2_update_pending - log pending descriptors
+ * @ioat: ioat2+ channel
+ *
+- * set pending to '1' unless pending is already set to '2', pending == 2
+- * indicates that submission is temporarily blocked due to an in-flight
+- * reset. If we are already above the ioat_pending_level threshold then
+- * just issue pending.
+- *
+- * called with ring_lock held
++ * Check if the number of unsubmitted descriptors has exceeded the
++ * watermark. Called with ring_lock held
+ */
+ static void ioat2_update_pending(struct ioat2_dma_chan *ioat)
+ {
+- if (unlikely(ioat->pending == 2))
+- return;
+- else if (ioat2_ring_pending(ioat) > ioat_pending_level)
++ if (ioat2_ring_pending(ioat) > ioat_pending_level)
+ __ioat2_issue_pending(ioat);
+- else
+- ioat->pending = 1;
+ }
+
+ static void __ioat2_start_null_desc(struct ioat2_dma_chan *ioat)
+@@ -546,7 +538,6 @@ int ioat2_alloc_chan_resources(struct dma_chan *c)
+ ioat->head = 0;
+ ioat->issued = 0;
+ ioat->tail = 0;
+- ioat->pending = 0;
+ ioat->alloc_order = order;
+ spin_unlock_bh(&ioat->ring_lock);
+
+@@ -815,7 +806,6 @@ void ioat2_free_chan_resources(struct dma_chan *c)
+
+ chan->last_completion = 0;
+ chan->completion_dma = 0;
+- ioat->pending = 0;
+ ioat->dmacount = 0;
+ }
+
+diff --git a/drivers/dma/ioat/dma_v2.h b/drivers/dma/ioat/dma_v2.h
+index 3afad8d..d211335 100644
+--- a/drivers/dma/ioat/dma_v2.h
++++ b/drivers/dma/ioat/dma_v2.h
+@@ -47,7 +47,6 @@ extern int ioat_ring_alloc_order;
+ * @head: allocated index
+ * @issued: hardware notification point
+ * @tail: cleanup index
+- * @pending: lock free indicator for issued != head
+ * @dmacount: identical to 'head' except for occasionally resetting to zero
+ * @alloc_order: log2 of the number of allocated descriptors
+ * @ring: software ring buffer implementation of hardware ring
+@@ -61,7 +60,6 @@ struct ioat2_dma_chan {
+ u16 tail;
+ u16 dmacount;
+ u16 alloc_order;
+- int pending;
+ struct ioat_ring_ent **ring;
+ spinlock_t ring_lock;
+ };
+diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
+index 3a2ccb0..10a4246 100644
+--- a/drivers/firmware/dmi_scan.c
++++ b/drivers/firmware/dmi_scan.c
+@@ -6,6 +6,7 @@
+ #include <linux/efi.h>
+ #include <linux/bootmem.h>
+ #include <linux/slab.h>
++#include <linux/random.h>
+ #include <asm/dmi.h>
+
+ /*
+@@ -111,6 +112,8 @@ static int __init dmi_walk_early(void (*decode)(const struct dmi_header *,
+
+ dmi_table(buf, dmi_len, dmi_num, decode, NULL);
+
++ add_device_randomness(buf, dmi_len);
++
+ dmi_iounmap(buf, dmi_len);
+ return 0;
+ }
+diff --git a/drivers/firmware/pcdp.c b/drivers/firmware/pcdp.c
+index 51e0e2d..a330492 100644
+--- a/drivers/firmware/pcdp.c
++++ b/drivers/firmware/pcdp.c
+@@ -95,7 +95,7 @@ efi_setup_pcdp_console(char *cmdline)
+ if (efi.hcdp == EFI_INVALID_TABLE_ADDR)
+ return -ENODEV;
+
+- pcdp = ioremap(efi.hcdp, 4096);
++ pcdp = early_ioremap(efi.hcdp, 4096);
+ printk(KERN_INFO "PCDP: v%d at 0x%lx\n", pcdp->rev, efi.hcdp);
+
+ if (strstr(cmdline, "console=hcdp")) {
+@@ -131,6 +131,6 @@ efi_setup_pcdp_console(char *cmdline)
+ }
+
+ out:
+- iounmap(pcdp);
++ early_iounmap(pcdp, 4096);
+ return rc;
+ }
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 79cc437..25b3e90 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -4355,17 +4355,18 @@ static void intel_init_display(struct drm_device *dev)
+ dev_priv->display.update_wm = g4x_update_wm;
+ else if (IS_I965G(dev))
+ dev_priv->display.update_wm = i965_update_wm;
+- else if (IS_I9XX(dev) || IS_MOBILE(dev)) {
++ else if (IS_I9XX(dev)) {
+ dev_priv->display.update_wm = i9xx_update_wm;
+ dev_priv->display.get_fifo_size = i9xx_get_fifo_size;
++ } else if (IS_I85X(dev)) {
++ dev_priv->display.update_wm = i9xx_update_wm;
++ dev_priv->display.get_fifo_size = i85x_get_fifo_size;
+ } else {
+- if (IS_I85X(dev))
+- dev_priv->display.get_fifo_size = i85x_get_fifo_size;
+- else if (IS_845G(dev))
++ dev_priv->display.update_wm = i830_update_wm;
++ if (IS_845G(dev))
+ dev_priv->display.get_fifo_size = i845_get_fifo_size;
+ else
+ dev_priv->display.get_fifo_size = i830_get_fifo_size;
+- dev_priv->display.update_wm = i830_update_wm;
+ }
+ }
+
+diff --git a/drivers/mfd/wm831x-otp.c b/drivers/mfd/wm831x-otp.c
+index f742745..b90f3e0 100644
+--- a/drivers/mfd/wm831x-otp.c
++++ b/drivers/mfd/wm831x-otp.c
+@@ -18,6 +18,7 @@
+ #include <linux/bcd.h>
+ #include <linux/delay.h>
+ #include <linux/mfd/core.h>
++#include <linux/random.h>
+
+ #include <linux/mfd/wm831x/core.h>
+ #include <linux/mfd/wm831x/otp.h>
+@@ -66,6 +67,7 @@ static DEVICE_ATTR(unique_id, 0444, wm831x_unique_id_show, NULL);
+
+ int wm831x_otp_init(struct wm831x *wm831x)
+ {
++ char uuid[WM831X_UNIQUE_ID_LEN];
+ int ret;
+
+ ret = device_create_file(wm831x->dev, &dev_attr_unique_id);
+@@ -73,6 +75,12 @@ int wm831x_otp_init(struct wm831x *wm831x)
+ dev_err(wm831x->dev, "Unique ID attribute not created: %d\n",
+ ret);
+
++ ret = wm831x_unique_id_read(wm831x, uuid);
++ if (ret == 0)
++ add_device_randomness(uuid, sizeof(uuid));
++ else
++ dev_err(wm831x->dev, "Failed to read UUID: %d\n", ret);
++
+ return ret;
+ }
+
+diff --git a/drivers/mtd/nand/cafe_nand.c b/drivers/mtd/nand/cafe_nand.c
+index c828d9a..97b9c7b 100644
+--- a/drivers/mtd/nand/cafe_nand.c
++++ b/drivers/mtd/nand/cafe_nand.c
+@@ -103,7 +103,7 @@ static const char *part_probes[] = { "cmdlinepart", "RedBoot", NULL };
+ static int cafe_device_ready(struct mtd_info *mtd)
+ {
+ struct cafe_priv *cafe = mtd->priv;
+- int result = !!(cafe_readl(cafe, NAND_STATUS) | 0x40000000);
++ int result = !!(cafe_readl(cafe, NAND_STATUS) & 0x40000000);
+ uint32_t irqs = cafe_readl(cafe, NAND_IRQ);
+
+ cafe_writel(cafe, irqs, NAND_IRQ);
+diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c
+index 403bfb6..adc862f 100644
+--- a/drivers/net/atlx/atl1.c
++++ b/drivers/net/atlx/atl1.c
+@@ -2478,7 +2478,7 @@ static irqreturn_t atl1_intr(int irq, void *data)
+ "pcie phy link down %x\n", status);
+ if (netif_running(adapter->netdev)) { /* reset MAC */
+ iowrite32(0, adapter->hw.hw_addr + REG_IMR);
+- schedule_work(&adapter->pcie_dma_to_rst_task);
++ schedule_work(&adapter->reset_dev_task);
+ return IRQ_HANDLED;
+ }
+ }
+@@ -2490,7 +2490,7 @@ static irqreturn_t atl1_intr(int irq, void *data)
+ "pcie DMA r/w error (status = 0x%x)\n",
+ status);
+ iowrite32(0, adapter->hw.hw_addr + REG_IMR);
+- schedule_work(&adapter->pcie_dma_to_rst_task);
++ schedule_work(&adapter->reset_dev_task);
+ return IRQ_HANDLED;
+ }
+
+@@ -2635,10 +2635,10 @@ static void atl1_down(struct atl1_adapter *adapter)
+ atl1_clean_rx_ring(adapter);
+ }
+
+-static void atl1_tx_timeout_task(struct work_struct *work)
++static void atl1_reset_dev_task(struct work_struct *work)
+ {
+ struct atl1_adapter *adapter =
+- container_of(work, struct atl1_adapter, tx_timeout_task);
++ container_of(work, struct atl1_adapter, reset_dev_task);
+ struct net_device *netdev = adapter->netdev;
+
+ netif_device_detach(netdev);
+@@ -3050,12 +3050,10 @@ static int __devinit atl1_probe(struct pci_dev *pdev,
+ (unsigned long)adapter);
+ adapter->phy_timer_pending = false;
+
+- INIT_WORK(&adapter->tx_timeout_task, atl1_tx_timeout_task);
++ INIT_WORK(&adapter->reset_dev_task, atl1_reset_dev_task);
+
+ INIT_WORK(&adapter->link_chg_task, atlx_link_chg_task);
+
+- INIT_WORK(&adapter->pcie_dma_to_rst_task, atl1_tx_timeout_task);
+-
+ err = register_netdev(netdev);
+ if (err)
+ goto err_common;
+diff --git a/drivers/net/atlx/atl1.h b/drivers/net/atlx/atl1.h
+index 146372f..0494e514 100644
+--- a/drivers/net/atlx/atl1.h
++++ b/drivers/net/atlx/atl1.h
+@@ -762,9 +762,8 @@ struct atl1_adapter {
+ u16 link_speed;
+ u16 link_duplex;
+ spinlock_t lock;
+- struct work_struct tx_timeout_task;
++ struct work_struct reset_dev_task;
+ struct work_struct link_chg_task;
+- struct work_struct pcie_dma_to_rst_task;
+
+ struct timer_list phy_config_timer;
+ bool phy_timer_pending;
+diff --git a/drivers/net/atlx/atlx.c b/drivers/net/atlx/atlx.c
+index 3dc0142..ce09b95 100644
+--- a/drivers/net/atlx/atlx.c
++++ b/drivers/net/atlx/atlx.c
+@@ -189,7 +189,7 @@ static void atlx_tx_timeout(struct net_device *netdev)
+ {
+ struct atlx_adapter *adapter = netdev_priv(netdev);
+ /* Do the reset outside of interrupt context */
+- schedule_work(&adapter->tx_timeout_task);
++ schedule_work(&adapter->reset_dev_task);
+ }
+
+ /*
+diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
+index 223990d..05308e6 100644
+--- a/drivers/net/bonding/bond_3ad.c
++++ b/drivers/net/bonding/bond_3ad.c
+@@ -1471,8 +1471,11 @@ static struct aggregator *ad_agg_selection_test(struct aggregator *best,
+
+ static int agg_device_up(const struct aggregator *agg)
+ {
+- return (netif_running(agg->slave->dev) &&
+- netif_carrier_ok(agg->slave->dev));
++ struct port *port = agg->lag_ports;
++ if (!port)
++ return 0;
++ return (netif_running(port->slave->dev) &&
++ netif_carrier_ok(port->slave->dev));
+ }
+
+ /**
+diff --git a/drivers/net/dl2k.c b/drivers/net/dl2k.c
+index 7fa7a90..c2f9313 100644
+--- a/drivers/net/dl2k.c
++++ b/drivers/net/dl2k.c
+@@ -1279,55 +1279,21 @@ rio_ioctl (struct net_device *dev, struct ifreq *rq, int cmd)
+ {
+ int phy_addr;
+ struct netdev_private *np = netdev_priv(dev);
+- struct mii_data *miidata = (struct mii_data *) &rq->ifr_ifru;
+-
+- struct netdev_desc *desc;
+- int i;
++ struct mii_ioctl_data *miidata = if_mii(rq);
+
+ phy_addr = np->phy_addr;
+ switch (cmd) {
+- case SIOCDEVPRIVATE:
+- break;
+-
+- case SIOCDEVPRIVATE + 1:
+- miidata->out_value = mii_read (dev, phy_addr, miidata->reg_num);
++ case SIOCGMIIPHY:
++ miidata->phy_id = phy_addr;
+ break;
+- case SIOCDEVPRIVATE + 2:
+- mii_write (dev, phy_addr, miidata->reg_num, miidata->in_value);
++ case SIOCGMIIREG:
++ miidata->val_out = mii_read (dev, phy_addr, miidata->reg_num);
+ break;
+- case SIOCDEVPRIVATE + 3:
+- break;
+- case SIOCDEVPRIVATE + 4:
+- break;
+- case SIOCDEVPRIVATE + 5:
+- netif_stop_queue (dev);
++ case SIOCSMIIREG:
++ if (!capable(CAP_NET_ADMIN))
++ return -EPERM;
++ mii_write (dev, phy_addr, miidata->reg_num, miidata->val_in);
+ break;
+- case SIOCDEVPRIVATE + 6:
+- netif_wake_queue (dev);
+- break;
+- case SIOCDEVPRIVATE + 7:
+- printk
+- ("tx_full=%x cur_tx=%lx old_tx=%lx cur_rx=%lx old_rx=%lx\n",
+- netif_queue_stopped(dev), np->cur_tx, np->old_tx, np->cur_rx,
+- np->old_rx);
+- break;
+- case SIOCDEVPRIVATE + 8:
+- printk("TX ring:\n");
+- for (i = 0; i < TX_RING_SIZE; i++) {
+- desc = &np->tx_ring[i];
+- printk
+- ("%02x:cur:%08x next:%08x status:%08x frag1:%08x frag0:%08x",
+- i,
+- (u32) (np->tx_ring_dma + i * sizeof (*desc)),
+- (u32)le64_to_cpu(desc->next_desc),
+- (u32)le64_to_cpu(desc->status),
+- (u32)(le64_to_cpu(desc->fraginfo) >> 32),
+- (u32)le64_to_cpu(desc->fraginfo));
+- printk ("\n");
+- }
+- printk ("\n");
+- break;
+-
+ default:
+ return -EOPNOTSUPP;
+ }
+@@ -1448,7 +1414,7 @@ mii_wait_link (struct net_device *dev, int wait)
+
+ do {
+ bmsr = mii_read (dev, phy_addr, MII_BMSR);
+- if (bmsr & MII_BMSR_LINK_STATUS)
++ if (bmsr & BMSR_LSTATUS)
+ return 0;
+ mdelay (1);
+ } while (--wait > 0);
+@@ -1469,60 +1435,60 @@ mii_get_media (struct net_device *dev)
+
+ bmsr = mii_read (dev, phy_addr, MII_BMSR);
+ if (np->an_enable) {
+- if (!(bmsr & MII_BMSR_AN_COMPLETE)) {
++ if (!(bmsr & BMSR_ANEGCOMPLETE)) {
+ /* Auto-Negotiation not completed */
+ return -1;
+ }
+- negotiate = mii_read (dev, phy_addr, MII_ANAR) &
+- mii_read (dev, phy_addr, MII_ANLPAR);
+- mscr = mii_read (dev, phy_addr, MII_MSCR);
+- mssr = mii_read (dev, phy_addr, MII_MSSR);
+- if (mscr & MII_MSCR_1000BT_FD && mssr & MII_MSSR_LP_1000BT_FD) {
++ negotiate = mii_read (dev, phy_addr, MII_ADVERTISE) &
++ mii_read (dev, phy_addr, MII_LPA);
++ mscr = mii_read (dev, phy_addr, MII_CTRL1000);
++ mssr = mii_read (dev, phy_addr, MII_STAT1000);
++ if (mscr & ADVERTISE_1000FULL && mssr & LPA_1000FULL) {
+ np->speed = 1000;
+ np->full_duplex = 1;
+ printk (KERN_INFO "Auto 1000 Mbps, Full duplex\n");
+- } else if (mscr & MII_MSCR_1000BT_HD && mssr & MII_MSSR_LP_1000BT_HD) {
++ } else if (mscr & ADVERTISE_1000HALF && mssr & LPA_1000HALF) {
+ np->speed = 1000;
+ np->full_duplex = 0;
+ printk (KERN_INFO "Auto 1000 Mbps, Half duplex\n");
+- } else if (negotiate & MII_ANAR_100BX_FD) {
++ } else if (negotiate & ADVERTISE_100FULL) {
+ np->speed = 100;
+ np->full_duplex = 1;
+ printk (KERN_INFO "Auto 100 Mbps, Full duplex\n");
+- } else if (negotiate & MII_ANAR_100BX_HD) {
++ } else if (negotiate & ADVERTISE_100HALF) {
+ np->speed = 100;
+ np->full_duplex = 0;
+ printk (KERN_INFO "Auto 100 Mbps, Half duplex\n");
+- } else if (negotiate & MII_ANAR_10BT_FD) {
++ } else if (negotiate & ADVERTISE_10FULL) {
+ np->speed = 10;
+ np->full_duplex = 1;
+ printk (KERN_INFO "Auto 10 Mbps, Full duplex\n");
+- } else if (negotiate & MII_ANAR_10BT_HD) {
++ } else if (negotiate & ADVERTISE_10HALF) {
+ np->speed = 10;
+ np->full_duplex = 0;
+ printk (KERN_INFO "Auto 10 Mbps, Half duplex\n");
+ }
+- if (negotiate & MII_ANAR_PAUSE) {
++ if (negotiate & ADVERTISE_PAUSE_CAP) {
+ np->tx_flow &= 1;
+ np->rx_flow &= 1;
+- } else if (negotiate & MII_ANAR_ASYMMETRIC) {
++ } else if (negotiate & ADVERTISE_PAUSE_ASYM) {
+ np->tx_flow = 0;
+ np->rx_flow &= 1;
+ }
+ /* else tx_flow, rx_flow = user select */
+ } else {
+ __u16 bmcr = mii_read (dev, phy_addr, MII_BMCR);
+- switch (bmcr & (MII_BMCR_SPEED_100 | MII_BMCR_SPEED_1000)) {
+- case MII_BMCR_SPEED_1000:
++ switch (bmcr & (BMCR_SPEED100 | BMCR_SPEED1000)) {
++ case BMCR_SPEED1000:
+ printk (KERN_INFO "Operating at 1000 Mbps, ");
+ break;
+- case MII_BMCR_SPEED_100:
++ case BMCR_SPEED100:
+ printk (KERN_INFO "Operating at 100 Mbps, ");
+ break;
+ case 0:
+ printk (KERN_INFO "Operating at 10 Mbps, ");
+ }
+- if (bmcr & MII_BMCR_DUPLEX_MODE) {
++ if (bmcr & BMCR_FULLDPLX) {
+ printk (KERN_CONT "Full duplex\n");
+ } else {
+ printk (KERN_CONT "Half duplex\n");
+@@ -1556,24 +1522,22 @@ mii_set_media (struct net_device *dev)
+ if (np->an_enable) {
+ /* Advertise capabilities */
+ bmsr = mii_read (dev, phy_addr, MII_BMSR);
+- anar = mii_read (dev, phy_addr, MII_ANAR) &
+- ~MII_ANAR_100BX_FD &
+- ~MII_ANAR_100BX_HD &
+- ~MII_ANAR_100BT4 &
+- ~MII_ANAR_10BT_FD &
+- ~MII_ANAR_10BT_HD;
+- if (bmsr & MII_BMSR_100BX_FD)
+- anar |= MII_ANAR_100BX_FD;
+- if (bmsr & MII_BMSR_100BX_HD)
+- anar |= MII_ANAR_100BX_HD;
+- if (bmsr & MII_BMSR_100BT4)
+- anar |= MII_ANAR_100BT4;
+- if (bmsr & MII_BMSR_10BT_FD)
+- anar |= MII_ANAR_10BT_FD;
+- if (bmsr & MII_BMSR_10BT_HD)
+- anar |= MII_ANAR_10BT_HD;
+- anar |= MII_ANAR_PAUSE | MII_ANAR_ASYMMETRIC;
+- mii_write (dev, phy_addr, MII_ANAR, anar);
++ anar = mii_read (dev, phy_addr, MII_ADVERTISE) &
++ ~(ADVERTISE_100FULL | ADVERTISE_10FULL |
++ ADVERTISE_100HALF | ADVERTISE_10HALF |
++ ADVERTISE_100BASE4);
++ if (bmsr & BMSR_100FULL)
++ anar |= ADVERTISE_100FULL;
++ if (bmsr & BMSR_100HALF)
++ anar |= ADVERTISE_100HALF;
++ if (bmsr & BMSR_100BASE4)
++ anar |= ADVERTISE_100BASE4;
++ if (bmsr & BMSR_10FULL)
++ anar |= ADVERTISE_10FULL;
++ if (bmsr & BMSR_10HALF)
++ anar |= ADVERTISE_10HALF;
++ anar |= ADVERTISE_PAUSE_CAP | ADVERTISE_PAUSE_ASYM;
++ mii_write (dev, phy_addr, MII_ADVERTISE, anar);
+
+ /* Enable Auto crossover */
+ pscr = mii_read (dev, phy_addr, MII_PHY_SCR);
+@@ -1581,8 +1545,8 @@ mii_set_media (struct net_device *dev)
+ mii_write (dev, phy_addr, MII_PHY_SCR, pscr);
+
+ /* Soft reset PHY */
+- mii_write (dev, phy_addr, MII_BMCR, MII_BMCR_RESET);
+- bmcr = MII_BMCR_AN_ENABLE | MII_BMCR_RESTART_AN | MII_BMCR_RESET;
++ mii_write (dev, phy_addr, MII_BMCR, BMCR_RESET);
++ bmcr = BMCR_ANENABLE | BMCR_ANRESTART | BMCR_RESET;
+ mii_write (dev, phy_addr, MII_BMCR, bmcr);
+ mdelay(1);
+ } else {
+@@ -1594,7 +1558,7 @@ mii_set_media (struct net_device *dev)
+
+ /* 2) PHY Reset */
+ bmcr = mii_read (dev, phy_addr, MII_BMCR);
+- bmcr |= MII_BMCR_RESET;
++ bmcr |= BMCR_RESET;
+ mii_write (dev, phy_addr, MII_BMCR, bmcr);
+
+ /* 3) Power Down */
+@@ -1603,25 +1567,25 @@ mii_set_media (struct net_device *dev)
+ mdelay (100); /* wait a certain time */
+
+ /* 4) Advertise nothing */
+- mii_write (dev, phy_addr, MII_ANAR, 0);
++ mii_write (dev, phy_addr, MII_ADVERTISE, 0);
+
+ /* 5) Set media and Power Up */
+- bmcr = MII_BMCR_POWER_DOWN;
++ bmcr = BMCR_PDOWN;
+ if (np->speed == 100) {
+- bmcr |= MII_BMCR_SPEED_100;
++ bmcr |= BMCR_SPEED100;
+ printk (KERN_INFO "Manual 100 Mbps, ");
+ } else if (np->speed == 10) {
+ printk (KERN_INFO "Manual 10 Mbps, ");
+ }
+ if (np->full_duplex) {
+- bmcr |= MII_BMCR_DUPLEX_MODE;
++ bmcr |= BMCR_FULLDPLX;
+ printk (KERN_CONT "Full duplex\n");
+ } else {
+ printk (KERN_CONT "Half duplex\n");
+ }
+ #if 0
+ /* Set 1000BaseT Master/Slave setting */
+- mscr = mii_read (dev, phy_addr, MII_MSCR);
++ mscr = mii_read (dev, phy_addr, MII_CTRL1000);
+ mscr |= MII_MSCR_CFG_ENABLE;
+ mscr &= ~MII_MSCR_CFG_VALUE = 0;
+ #endif
+@@ -1644,7 +1608,7 @@ mii_get_media_pcs (struct net_device *dev)
+
+ bmsr = mii_read (dev, phy_addr, PCS_BMSR);
+ if (np->an_enable) {
+- if (!(bmsr & MII_BMSR_AN_COMPLETE)) {
++ if (!(bmsr & BMSR_ANEGCOMPLETE)) {
+ /* Auto-Negotiation not completed */
+ return -1;
+ }
+@@ -1669,7 +1633,7 @@ mii_get_media_pcs (struct net_device *dev)
+ } else {
+ __u16 bmcr = mii_read (dev, phy_addr, PCS_BMCR);
+ printk (KERN_INFO "Operating at 1000 Mbps, ");
+- if (bmcr & MII_BMCR_DUPLEX_MODE) {
++ if (bmcr & BMCR_FULLDPLX) {
+ printk (KERN_CONT "Full duplex\n");
+ } else {
+ printk (KERN_CONT "Half duplex\n");
+@@ -1702,7 +1666,7 @@ mii_set_media_pcs (struct net_device *dev)
+ if (np->an_enable) {
+ /* Advertise capabilities */
+ esr = mii_read (dev, phy_addr, PCS_ESR);
+- anar = mii_read (dev, phy_addr, MII_ANAR) &
++ anar = mii_read (dev, phy_addr, MII_ADVERTISE) &
+ ~PCS_ANAR_HALF_DUPLEX &
+ ~PCS_ANAR_FULL_DUPLEX;
+ if (esr & (MII_ESR_1000BT_HD | MII_ESR_1000BX_HD))
+@@ -1710,22 +1674,21 @@ mii_set_media_pcs (struct net_device *dev)
+ if (esr & (MII_ESR_1000BT_FD | MII_ESR_1000BX_FD))
+ anar |= PCS_ANAR_FULL_DUPLEX;
+ anar |= PCS_ANAR_PAUSE | PCS_ANAR_ASYMMETRIC;
+- mii_write (dev, phy_addr, MII_ANAR, anar);
++ mii_write (dev, phy_addr, MII_ADVERTISE, anar);
+
+ /* Soft reset PHY */
+- mii_write (dev, phy_addr, MII_BMCR, MII_BMCR_RESET);
+- bmcr = MII_BMCR_AN_ENABLE | MII_BMCR_RESTART_AN |
+- MII_BMCR_RESET;
++ mii_write (dev, phy_addr, MII_BMCR, BMCR_RESET);
++ bmcr = BMCR_ANENABLE | BMCR_ANRESTART | BMCR_RESET;
+ mii_write (dev, phy_addr, MII_BMCR, bmcr);
+ mdelay(1);
+ } else {
+ /* Force speed setting */
+ /* PHY Reset */
+- bmcr = MII_BMCR_RESET;
++ bmcr = BMCR_RESET;
+ mii_write (dev, phy_addr, MII_BMCR, bmcr);
+ mdelay(10);
+ if (np->full_duplex) {
+- bmcr = MII_BMCR_DUPLEX_MODE;
++ bmcr = BMCR_FULLDPLX;
+ printk (KERN_INFO "Manual full duplex\n");
+ } else {
+ bmcr = 0;
+@@ -1735,7 +1698,7 @@ mii_set_media_pcs (struct net_device *dev)
+ mdelay(10);
+
+ /* Advertise nothing */
+- mii_write (dev, phy_addr, MII_ANAR, 0);
++ mii_write (dev, phy_addr, MII_ADVERTISE, 0);
+ }
+ return 0;
+ }
+diff --git a/drivers/net/dl2k.h b/drivers/net/dl2k.h
+index 266ec87..cde8ecd 100644
+--- a/drivers/net/dl2k.h
++++ b/drivers/net/dl2k.h
+@@ -28,6 +28,7 @@
+ #include <linux/init.h>
+ #include <linux/crc32.h>
+ #include <linux/ethtool.h>
++#include <linux/mii.h>
+ #include <linux/bitops.h>
+ #include <asm/processor.h> /* Processor type for cache alignment. */
+ #include <asm/io.h>
+@@ -271,20 +272,9 @@ enum RFS_bits {
+ #define MII_RESET_TIME_OUT 10000
+ /* MII register */
+ enum _mii_reg {
+- MII_BMCR = 0,
+- MII_BMSR = 1,
+- MII_PHY_ID1 = 2,
+- MII_PHY_ID2 = 3,
+- MII_ANAR = 4,
+- MII_ANLPAR = 5,
+- MII_ANER = 6,
+- MII_ANNPT = 7,
+- MII_ANLPRNP = 8,
+- MII_MSCR = 9,
+- MII_MSSR = 10,
+- MII_ESR = 15,
+ MII_PHY_SCR = 16,
+ };
++
+ /* PCS register */
+ enum _pcs_reg {
+ PCS_BMCR = 0,
+@@ -297,102 +287,6 @@ enum _pcs_reg {
+ PCS_ESR = 15,
+ };
+
+-/* Basic Mode Control Register */
+-enum _mii_bmcr {
+- MII_BMCR_RESET = 0x8000,
+- MII_BMCR_LOOP_BACK = 0x4000,
+- MII_BMCR_SPEED_LSB = 0x2000,
+- MII_BMCR_AN_ENABLE = 0x1000,
+- MII_BMCR_POWER_DOWN = 0x0800,
+- MII_BMCR_ISOLATE = 0x0400,
+- MII_BMCR_RESTART_AN = 0x0200,
+- MII_BMCR_DUPLEX_MODE = 0x0100,
+- MII_BMCR_COL_TEST = 0x0080,
+- MII_BMCR_SPEED_MSB = 0x0040,
+- MII_BMCR_SPEED_RESERVED = 0x003f,
+- MII_BMCR_SPEED_10 = 0,
+- MII_BMCR_SPEED_100 = MII_BMCR_SPEED_LSB,
+- MII_BMCR_SPEED_1000 = MII_BMCR_SPEED_MSB,
+-};
+-
+-/* Basic Mode Status Register */
+-enum _mii_bmsr {
+- MII_BMSR_100BT4 = 0x8000,
+- MII_BMSR_100BX_FD = 0x4000,
+- MII_BMSR_100BX_HD = 0x2000,
+- MII_BMSR_10BT_FD = 0x1000,
+- MII_BMSR_10BT_HD = 0x0800,
+- MII_BMSR_100BT2_FD = 0x0400,
+- MII_BMSR_100BT2_HD = 0x0200,
+- MII_BMSR_EXT_STATUS = 0x0100,
+- MII_BMSR_PREAMBLE_SUPP = 0x0040,
+- MII_BMSR_AN_COMPLETE = 0x0020,
+- MII_BMSR_REMOTE_FAULT = 0x0010,
+- MII_BMSR_AN_ABILITY = 0x0008,
+- MII_BMSR_LINK_STATUS = 0x0004,
+- MII_BMSR_JABBER_DETECT = 0x0002,
+- MII_BMSR_EXT_CAP = 0x0001,
+-};
+-
+-/* ANAR */
+-enum _mii_anar {
+- MII_ANAR_NEXT_PAGE = 0x8000,
+- MII_ANAR_REMOTE_FAULT = 0x4000,
+- MII_ANAR_ASYMMETRIC = 0x0800,
+- MII_ANAR_PAUSE = 0x0400,
+- MII_ANAR_100BT4 = 0x0200,
+- MII_ANAR_100BX_FD = 0x0100,
+- MII_ANAR_100BX_HD = 0x0080,
+- MII_ANAR_10BT_FD = 0x0020,
+- MII_ANAR_10BT_HD = 0x0010,
+- MII_ANAR_SELECTOR = 0x001f,
+- MII_IEEE8023_CSMACD = 0x0001,
+-};
+-
+-/* ANLPAR */
+-enum _mii_anlpar {
+- MII_ANLPAR_NEXT_PAGE = MII_ANAR_NEXT_PAGE,
+- MII_ANLPAR_REMOTE_FAULT = MII_ANAR_REMOTE_FAULT,
+- MII_ANLPAR_ASYMMETRIC = MII_ANAR_ASYMMETRIC,
+- MII_ANLPAR_PAUSE = MII_ANAR_PAUSE,
+- MII_ANLPAR_100BT4 = MII_ANAR_100BT4,
+- MII_ANLPAR_100BX_FD = MII_ANAR_100BX_FD,
+- MII_ANLPAR_100BX_HD = MII_ANAR_100BX_HD,
+- MII_ANLPAR_10BT_FD = MII_ANAR_10BT_FD,
+- MII_ANLPAR_10BT_HD = MII_ANAR_10BT_HD,
+- MII_ANLPAR_SELECTOR = MII_ANAR_SELECTOR,
+-};
+-
+-/* Auto-Negotiation Expansion Register */
+-enum _mii_aner {
+- MII_ANER_PAR_DETECT_FAULT = 0x0010,
+- MII_ANER_LP_NEXTPAGABLE = 0x0008,
+- MII_ANER_NETXTPAGABLE = 0x0004,
+- MII_ANER_PAGE_RECEIVED = 0x0002,
+- MII_ANER_LP_NEGOTIABLE = 0x0001,
+-};
+-
+-/* MASTER-SLAVE Control Register */
+-enum _mii_mscr {
+- MII_MSCR_TEST_MODE = 0xe000,
+- MII_MSCR_CFG_ENABLE = 0x1000,
+- MII_MSCR_CFG_VALUE = 0x0800,
+- MII_MSCR_PORT_VALUE = 0x0400,
+- MII_MSCR_1000BT_FD = 0x0200,
+- MII_MSCR_1000BT_HD = 0X0100,
+-};
+-
+-/* MASTER-SLAVE Status Register */
+-enum _mii_mssr {
+- MII_MSSR_CFG_FAULT = 0x8000,
+- MII_MSSR_CFG_RES = 0x4000,
+- MII_MSSR_LOCAL_RCV_STATUS = 0x2000,
+- MII_MSSR_REMOTE_RCVR = 0x1000,
+- MII_MSSR_LP_1000BT_FD = 0x0800,
+- MII_MSSR_LP_1000BT_HD = 0x0400,
+- MII_MSSR_IDLE_ERR_COUNT = 0x00ff,
+-};
+-
+ /* IEEE Extened Status Register */
+ enum _mii_esr {
+ MII_ESR_1000BX_FD = 0x8000,
+@@ -471,13 +365,6 @@ struct ioctl_data {
+ char *data;
+ };
+
+-struct mii_data {
+- __u16 reserved;
+- __u16 reg_num;
+- __u16 in_value;
+- __u16 out_value;
+-};
+-
+ /* The Rx and Tx buffer descriptors. */
+ struct netdev_desc {
+ __le64 next_desc;
+diff --git a/drivers/net/ks8851_mll.c b/drivers/net/ks8851_mll.c
+index c0ceebc..4e3a69c 100644
+--- a/drivers/net/ks8851_mll.c
++++ b/drivers/net/ks8851_mll.c
+@@ -35,7 +35,7 @@
+ #define DRV_NAME "ks8851_mll"
+
+ static u8 KS_DEFAULT_MAC_ADDRESS[] = { 0x00, 0x10, 0xA1, 0x86, 0x95, 0x11 };
+-#define MAX_RECV_FRAMES 32
++#define MAX_RECV_FRAMES 255
+ #define MAX_BUF_SIZE 2048
+ #define TX_BUF_SIZE 2000
+ #define RX_BUF_SIZE 2000
+diff --git a/drivers/net/netxen/netxen_nic.h b/drivers/net/netxen/netxen_nic.h
+index e52af5b..50d2af8 100644
+--- a/drivers/net/netxen/netxen_nic.h
++++ b/drivers/net/netxen/netxen_nic.h
+@@ -700,7 +700,8 @@ struct netxen_recv_context {
+ #define NX_CDRP_CMD_READ_PEXQ_PARAMETERS 0x0000001c
+ #define NX_CDRP_CMD_GET_LIC_CAPABILITIES 0x0000001d
+ #define NX_CDRP_CMD_READ_MAX_LRO_PER_BOARD 0x0000001e
+-#define NX_CDRP_CMD_MAX 0x0000001f
++#define NX_CDRP_CMD_CONFIG_GBE_PORT 0x0000001f
++#define NX_CDRP_CMD_MAX 0x00000020
+
+ #define NX_RCODE_SUCCESS 0
+ #define NX_RCODE_NO_HOST_MEM 1
+@@ -1015,6 +1016,7 @@ typedef struct {
+ #define NX_FW_CAPABILITY_BDG (1 << 8)
+ #define NX_FW_CAPABILITY_FVLANTX (1 << 9)
+ #define NX_FW_CAPABILITY_HW_LRO (1 << 10)
++#define NX_FW_CAPABILITY_GBE_LINK_CFG (1 << 11)
+
+ /* module types */
+ #define LINKEVENT_MODULE_NOT_PRESENT 1
+@@ -1323,6 +1325,9 @@ int netxen_config_ipaddr(struct netxen_adapter *adapter, u32 ip, int cmd);
+ int netxen_linkevent_request(struct netxen_adapter *adapter, int enable);
+ void netxen_advert_link_change(struct netxen_adapter *adapter, int linkup);
+
++int nx_fw_cmd_set_gbe_port(struct netxen_adapter *adapter,
++ u32 speed, u32 duplex, u32 autoneg);
++
+ int nx_fw_cmd_set_mtu(struct netxen_adapter *adapter, int mtu);
+ int netxen_nic_change_mtu(struct net_device *netdev, int new_mtu);
+ int netxen_config_hw_lro(struct netxen_adapter *adapter, int enable);
+diff --git a/drivers/net/netxen/netxen_nic_ctx.c b/drivers/net/netxen/netxen_nic_ctx.c
+index 9cb8f68..f48cdb2 100644
+--- a/drivers/net/netxen/netxen_nic_ctx.c
++++ b/drivers/net/netxen/netxen_nic_ctx.c
+@@ -112,6 +112,21 @@ nx_fw_cmd_set_mtu(struct netxen_adapter *adapter, int mtu)
+ return 0;
+ }
+
++int
++nx_fw_cmd_set_gbe_port(struct netxen_adapter *adapter,
++ u32 speed, u32 duplex, u32 autoneg)
++{
++
++ return netxen_issue_cmd(adapter,
++ adapter->ahw.pci_func,
++ NXHAL_VERSION,
++ speed,
++ duplex,
++ autoneg,
++ NX_CDRP_CMD_CONFIG_GBE_PORT);
++
++}
++
+ static int
+ nx_fw_cmd_create_rx_ctx(struct netxen_adapter *adapter)
+ {
+diff --git a/drivers/net/netxen/netxen_nic_ethtool.c b/drivers/net/netxen/netxen_nic_ethtool.c
+index 714f387..7e34840 100644
+--- a/drivers/net/netxen/netxen_nic_ethtool.c
++++ b/drivers/net/netxen/netxen_nic_ethtool.c
+@@ -216,7 +216,6 @@ skip:
+ check_sfp_module = netif_running(dev) &&
+ adapter->has_link_events;
+ } else {
+- ecmd->autoneg = AUTONEG_ENABLE;
+ ecmd->supported |= (SUPPORTED_TP |SUPPORTED_Autoneg);
+ ecmd->advertising |=
+ (ADVERTISED_TP | ADVERTISED_Autoneg);
+@@ -254,53 +253,24 @@ static int
+ netxen_nic_set_settings(struct net_device *dev, struct ethtool_cmd *ecmd)
+ {
+ struct netxen_adapter *adapter = netdev_priv(dev);
+- __u32 status;
++ int ret;
+
+- /* read which mode */
+- if (adapter->ahw.port_type == NETXEN_NIC_GBE) {
+- /* autonegotiation */
+- if (adapter->phy_write
+- && adapter->phy_write(adapter,
+- NETXEN_NIU_GB_MII_MGMT_ADDR_AUTONEG,
+- ecmd->autoneg) != 0)
+- return -EIO;
+- else
+- adapter->link_autoneg = ecmd->autoneg;
++ if (adapter->ahw.port_type != NETXEN_NIC_GBE)
++ return -EOPNOTSUPP;
+
+- if (adapter->phy_read
+- && adapter->phy_read(adapter,
+- NETXEN_NIU_GB_MII_MGMT_ADDR_PHY_STATUS,
+- &status) != 0)
+- return -EIO;
++ if (!(adapter->capabilities & NX_FW_CAPABILITY_GBE_LINK_CFG))
++ return -EOPNOTSUPP;
+
+- /* speed */
+- switch (ecmd->speed) {
+- case SPEED_10:
+- netxen_set_phy_speed(status, 0);
+- break;
+- case SPEED_100:
+- netxen_set_phy_speed(status, 1);
+- break;
+- case SPEED_1000:
+- netxen_set_phy_speed(status, 2);
+- break;
+- }
+- /* set duplex mode */
+- if (ecmd->duplex == DUPLEX_HALF)
+- netxen_clear_phy_duplex(status);
+- if (ecmd->duplex == DUPLEX_FULL)
+- netxen_set_phy_duplex(status);
+- if (adapter->phy_write
+- && adapter->phy_write(adapter,
+- NETXEN_NIU_GB_MII_MGMT_ADDR_PHY_STATUS,
+- *((int *)&status)) != 0)
+- return -EIO;
+- else {
+- adapter->link_speed = ecmd->speed;
+- adapter->link_duplex = ecmd->duplex;
+- }
+- } else
++ ret = nx_fw_cmd_set_gbe_port(adapter, ecmd->speed, ecmd->duplex,
++ ecmd->autoneg);
++ if (ret == NX_RCODE_NOT_SUPPORTED)
+ return -EOPNOTSUPP;
++ else if (ret)
++ return -EIO;
++
++ adapter->link_speed = ecmd->speed;
++ adapter->link_duplex = ecmd->duplex;
++ adapter->link_autoneg = ecmd->autoneg;
+
+ if (!netif_running(dev))
+ return 0;
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index 0f77aca..894ad84 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -1121,10 +1121,12 @@ static long tun_chr_ioctl(struct file *file, unsigned int cmd,
+ int sndbuf;
+ int ret;
+
+- if (cmd == TUNSETIFF || _IOC_TYPE(cmd) == 0x89)
++ if (cmd == TUNSETIFF || _IOC_TYPE(cmd) == 0x89) {
+ if (copy_from_user(&ifr, argp, sizeof ifr))
+ return -EFAULT;
+-
++ } else {
++ memset(&ifr, 0, sizeof(ifr));
++ }
+ if (cmd == TUNGETFEATURES) {
+ /* Currently this just means: "what IFF flags are valid?".
+ * This is needed because we never checked for invalid flags on
+diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c
+index e391ef9..fd8e335 100644
+--- a/drivers/net/usb/kaweth.c
++++ b/drivers/net/usb/kaweth.c
+@@ -1325,7 +1325,7 @@ static int kaweth_internal_control_msg(struct usb_device *usb_dev,
+ int retv;
+ int length = 0; /* shut up GCC */
+
+- urb = usb_alloc_urb(0, GFP_NOIO);
++ urb = usb_alloc_urb(0, GFP_ATOMIC);
+ if (!urb)
+ return -ENOMEM;
+
+diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
+index da33dce..07f69ee 100644
+--- a/drivers/net/usb/usbnet.c
++++ b/drivers/net/usb/usbnet.c
+@@ -584,6 +584,14 @@ static int unlink_urbs (struct usbnet *dev, struct sk_buff_head *q)
+ entry = (struct skb_data *) skb->cb;
+ urb = entry->urb;
+
++ /*
++ * Get reference count of the URB to avoid it to be
++ * freed during usb_unlink_urb, which may trigger
++ * use-after-free problem inside usb_unlink_urb since
++ * usb_unlink_urb is always racing with .complete
++ * handler(include defer_bh).
++ */
++ usb_get_urb(urb);
+ spin_unlock_irqrestore(&q->lock, flags);
+ // during some PM-driven resume scenarios,
+ // these (async) unlinks complete immediately
+@@ -592,6 +600,7 @@ static int unlink_urbs (struct usbnet *dev, struct sk_buff_head *q)
+ devdbg (dev, "unlink urb err, %d", retval);
+ else
+ count++;
++ usb_put_urb(urb);
+ spin_lock_irqsave(&q->lock, flags);
+ }
+ spin_unlock_irqrestore (&q->lock, flags);
+@@ -989,7 +998,6 @@ static void tx_complete (struct urb *urb)
+ }
+ }
+
+- urb->dev = NULL;
+ entry->state = tx_done;
+ defer_bh(dev, skb, &dev->txq);
+ }
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 1e42381..d0959af 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2550,6 +2550,40 @@ static void __devinit fixup_ti816x_class(struct pci_dev* dev)
+ }
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_TI, 0xb800, fixup_ti816x_class);
+
++/*
++ * Some BIOS implementations leave the Intel GPU interrupts enabled,
++ * even though no one is handling them (f.e. i915 driver is never loaded).
++ * Additionally the interrupt destination is not set up properly
++ * and the interrupt ends up -somewhere-.
++ *
++ * These spurious interrupts are "sticky" and the kernel disables
++ * the (shared) interrupt line after 100.000+ generated interrupts.
++ *
++ * Fix it by disabling the still enabled interrupts.
++ * This resolves crashes often seen on monitor unplug.
++ */
++#define I915_DEIER_REG 0x4400c
++static void __devinit disable_igfx_irq(struct pci_dev *dev)
++{
++ void __iomem *regs = pci_iomap(dev, 0, 0);
++ if (regs == NULL) {
++ dev_warn(&dev->dev, "igfx quirk: Can't iomap PCI device\n");
++ return;
++ }
++
++ /* Check if any interrupt line is still enabled */
++ if (readl(regs + I915_DEIER_REG) != 0) {
++ dev_warn(&dev->dev, "BIOS left Intel GPU interrupts enabled; "
++ "disabling\n");
++
++ writel(0, regs + I915_DEIER_REG);
++ }
++
++ pci_iounmap(dev, regs);
++}
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0102, disable_igfx_irq);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x010a, disable_igfx_irq);
++
+ static void pci_do_fixups(struct pci_dev *dev, struct pci_fixup *f,
+ struct pci_fixup *end)
+ {
+diff --git a/drivers/pnp/quirks.c b/drivers/pnp/quirks.c
+index eb39d26..253996c 100644
+--- a/drivers/pnp/quirks.c
++++ b/drivers/pnp/quirks.c
+@@ -300,9 +300,9 @@ static void quirk_system_pci_resources(struct pnp_dev *dev)
+ }
+ }
+
+-#ifdef CONFIG_AMD_NB
++#ifdef CONFIG_K8_NB
+
+-#include <asm/amd_nb.h>
++#include <asm/k8.h>
+
+ static void quirk_amd_mmconfig_area(struct pnp_dev *dev)
+ {
+@@ -366,7 +366,7 @@ static struct pnp_fixup pnp_fixups[] = {
+ /* PnP resources that might overlap PCI BARs */
+ {"PNP0c01", quirk_system_pci_resources},
+ {"PNP0c02", quirk_system_pci_resources},
+-#ifdef CONFIG_AMD_NB
++#ifdef CONFIG_K8_NB
+ {"PNP0c01", quirk_amd_mmconfig_area},
+ #endif
+ {""}
+diff --git a/drivers/rtc/rtc-wm831x.c b/drivers/rtc/rtc-wm831x.c
+index 79795cd..daefe66 100644
+--- a/drivers/rtc/rtc-wm831x.c
++++ b/drivers/rtc/rtc-wm831x.c
+@@ -23,7 +23,7 @@
+ #include <linux/mfd/wm831x/core.h>
+ #include <linux/delay.h>
+ #include <linux/platform_device.h>
+-
++#include <linux/random.h>
+
+ /*
+ * R16416 (0x4020) - RTC Write Counter
+@@ -95,6 +95,26 @@ struct wm831x_rtc {
+ unsigned int alarm_enabled:1;
+ };
+
++static void wm831x_rtc_add_randomness(struct wm831x *wm831x)
++{
++ int ret;
++ u16 reg;
++
++ /*
++ * The write counter contains a pseudo-random number which is
++ * regenerated every time we set the RTC so it should be a
++ * useful per-system source of entropy.
++ */
++ ret = wm831x_reg_read(wm831x, WM831X_RTC_WRITE_COUNTER);
++ if (ret >= 0) {
++ reg = ret;
++ add_device_randomness(®, sizeof(reg));
++ } else {
++ dev_warn(wm831x->dev, "Failed to read RTC write counter: %d\n",
++ ret);
++ }
++}
++
+ /*
+ * Read current time and date in RTC
+ */
+@@ -464,6 +484,8 @@ static int wm831x_rtc_probe(struct platform_device *pdev)
+ alm_irq, ret);
+ }
+
++ wm831x_rtc_add_randomness(wm831x);
++
+ return 0;
+
+ err:
+diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
+index b10ee2a..1bdfde1 100644
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -754,7 +754,7 @@ static struct domain_device *sas_ex_discover_end_dev(
+ }
+
+ /* See if this phy is part of a wide port */
+-static int sas_ex_join_wide_port(struct domain_device *parent, int phy_id)
++static bool sas_ex_join_wide_port(struct domain_device *parent, int phy_id)
+ {
+ struct ex_phy *phy = &parent->ex_dev.ex_phy[phy_id];
+ int i;
+@@ -770,11 +770,11 @@ static int sas_ex_join_wide_port(struct domain_device *parent, int phy_id)
+ sas_port_add_phy(ephy->port, phy->phy);
+ phy->port = ephy->port;
+ phy->phy_state = PHY_DEVICE_DISCOVERED;
+- return 0;
++ return true;
+ }
+ }
+
+- return -ENODEV;
++ return false;
+ }
+
+ static struct domain_device *sas_ex_discover_expander(
+@@ -912,8 +912,7 @@ static int sas_ex_discover_dev(struct domain_device *dev, int phy_id)
+ return res;
+ }
+
+- res = sas_ex_join_wide_port(dev, phy_id);
+- if (!res) {
++ if (sas_ex_join_wide_port(dev, phy_id)) {
+ SAS_DPRINTK("Attaching ex phy%d to wide port %016llx\n",
+ phy_id, SAS_ADDR(ex_phy->attached_sas_addr));
+ return res;
+@@ -958,8 +957,7 @@ static int sas_ex_discover_dev(struct domain_device *dev, int phy_id)
+ if (SAS_ADDR(ex->ex_phy[i].attached_sas_addr) ==
+ SAS_ADDR(child->sas_addr)) {
+ ex->ex_phy[i].phy_state= PHY_DEVICE_DISCOVERED;
+- res = sas_ex_join_wide_port(dev, i);
+- if (!res)
++ if (sas_ex_join_wide_port(dev, i))
+ SAS_DPRINTK("Attaching ex phy%d to wide port %016llx\n",
+ i, SAS_ADDR(ex->ex_phy[i].attached_sas_addr));
+
+@@ -1812,32 +1810,20 @@ static int sas_discover_new(struct domain_device *dev, int phy_id)
+ {
+ struct ex_phy *ex_phy = &dev->ex_dev.ex_phy[phy_id];
+ struct domain_device *child;
+- bool found = false;
+- int res, i;
++ int res;
+
+ SAS_DPRINTK("ex %016llx phy%d new device attached\n",
+ SAS_ADDR(dev->sas_addr), phy_id);
+ res = sas_ex_phy_discover(dev, phy_id);
+ if (res)
+- goto out;
+- /* to support the wide port inserted */
+- for (i = 0; i < dev->ex_dev.num_phys; i++) {
+- struct ex_phy *ex_phy_temp = &dev->ex_dev.ex_phy[i];
+- if (i == phy_id)
+- continue;
+- if (SAS_ADDR(ex_phy_temp->attached_sas_addr) ==
+- SAS_ADDR(ex_phy->attached_sas_addr)) {
+- found = true;
+- break;
+- }
+- }
+- if (found) {
+- sas_ex_join_wide_port(dev, phy_id);
++ return res;
++
++ if (sas_ex_join_wide_port(dev, phy_id))
+ return 0;
+- }
++
+ res = sas_ex_discover_devices(dev, phy_id);
+- if (!res)
+- goto out;
++ if (res)
++ return res;
+ list_for_each_entry(child, &dev->ex_dev.children, siblings) {
+ if (SAS_ADDR(child->sas_addr) ==
+ SAS_ADDR(ex_phy->attached_sas_addr)) {
+@@ -1847,7 +1833,6 @@ static int sas_discover_new(struct domain_device *dev, int phy_id)
+ break;
+ }
+ }
+-out:
+ return res;
+ }
+
+@@ -1946,9 +1931,7 @@ int sas_ex_revalidate_domain(struct domain_device *port_dev)
+ struct domain_device *dev = NULL;
+
+ res = sas_find_bcast_dev(port_dev, &dev);
+- if (res)
+- goto out;
+- if (dev) {
++ while (res == 0 && dev) {
+ struct expander_device *ex = &dev->ex_dev;
+ int i = 0, phy_id;
+
+@@ -1960,8 +1943,10 @@ int sas_ex_revalidate_domain(struct domain_device *port_dev)
+ res = sas_rediscover(dev, phy_id);
+ i = phy_id + 1;
+ } while (i < ex->num_phys);
++
++ dev = NULL;
++ res = sas_find_bcast_dev(port_dev, &dev);
+ }
+-out:
+ return res;
+ }
+
+diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
+index 573921d..3890793 100644
+--- a/drivers/scsi/scsi_error.c
++++ b/drivers/scsi/scsi_error.c
+@@ -1550,6 +1550,20 @@ static void scsi_restart_operations(struct Scsi_Host *shost)
+ * requests are started.
+ */
+ scsi_run_host_queues(shost);
++
++ /*
++ * if eh is active and host_eh_scheduled is pending we need to re-run
++ * recovery. we do this check after scsi_run_host_queues() to allow
++ * everything pent up since the last eh run a chance to make forward
++ * progress before we sync again. Either we'll immediately re-run
++ * recovery or scsi_device_unbusy() will wake us again when these
++ * pending commands complete.
++ */
++ spin_lock_irqsave(shost->host_lock, flags);
++ if (shost->host_eh_scheduled)
++ if (scsi_host_set_state(shost, SHOST_RECOVERY))
++ WARN_ON(scsi_host_set_state(shost, SHOST_CANCEL_RECOVERY));
++ spin_unlock_irqrestore(shost->host_lock, flags);
+ }
+
+ /**
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index 8df12522..e28f9b0 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -482,15 +482,26 @@ static void scsi_run_queue(struct request_queue *q)
+ */
+ static void scsi_requeue_command(struct request_queue *q, struct scsi_cmnd *cmd)
+ {
++ struct scsi_device *sdev = cmd->device;
+ struct request *req = cmd->request;
+ unsigned long flags;
+
++ /*
++ * We need to hold a reference on the device to avoid the queue being
++ * killed after the unlock and before scsi_run_queue is invoked which
++ * may happen because scsi_unprep_request() puts the command which
++ * releases its reference on the device.
++ */
++ get_device(&sdev->sdev_gendev);
++
+ spin_lock_irqsave(q->queue_lock, flags);
+ scsi_unprep_request(req);
+ blk_requeue_request(q, req);
+ spin_unlock_irqrestore(q->queue_lock, flags);
+
+ scsi_run_queue(q);
++
++ put_device(&sdev->sdev_gendev);
+ }
+
+ void scsi_next_command(struct scsi_cmnd *cmd)
+diff --git a/drivers/scsi/scsi_priv.h b/drivers/scsi/scsi_priv.h
+index 1fbf7c7..11c0085 100644
+--- a/drivers/scsi/scsi_priv.h
++++ b/drivers/scsi/scsi_priv.h
+@@ -107,6 +107,7 @@ extern void scsi_exit_procfs(void);
+ #endif /* CONFIG_PROC_FS */
+
+ /* scsi_scan.c */
++extern int scsi_complete_async_scans(void);
+ extern int scsi_scan_host_selected(struct Scsi_Host *, unsigned int,
+ unsigned int, unsigned int, int);
+ extern void scsi_forget_host(struct Scsi_Host *);
+diff --git a/drivers/scsi/scsi_wait_scan.c b/drivers/scsi/scsi_wait_scan.c
+index 74708fc..5c22bda 100644
+--- a/drivers/scsi/scsi_wait_scan.c
++++ b/drivers/scsi/scsi_wait_scan.c
+@@ -13,6 +13,7 @@
+ #include <linux/module.h>
+ #include <linux/device.h>
+ #include <scsi/scsi_scan.h>
++#include "scsi_priv.h"
+
+ static int __init wait_scan_init(void)
+ {
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 653f853..8ad9dfb 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1120,7 +1120,8 @@ skip_normal_probe:
+ }
+
+
+- if (data_interface->cur_altsetting->desc.bNumEndpoints < 2)
++ if (data_interface->cur_altsetting->desc.bNumEndpoints < 2 ||
++ control_interface->cur_altsetting->desc.bNumEndpoints == 0)
+ return -EINVAL;
+
+ epctrl = &control_interface->cur_altsetting->endpoint[0].desc;
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index d71514b..37f2899 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -441,6 +441,8 @@ retry:
+ goto retry;
+ }
+ if (!desc->reslength) { /* zero length read */
++ dev_dbg(&desc->intf->dev, "%s: zero length - clearing WDM_READ\n", __func__);
++ clear_bit(WDM_READ, &desc->flags);
+ spin_unlock_irq(&desc->iuspin);
+ goto retry;
+ }
+diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
+index df1e873..48742ff 100644
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -1454,10 +1454,14 @@ static int processcompl_compat(struct async *as, void __user * __user *arg)
+ void __user *addr = as->userurb;
+ unsigned int i;
+
+- if (as->userbuffer && urb->actual_length)
+- if (copy_to_user(as->userbuffer, urb->transfer_buffer,
+- urb->actual_length))
++ if (as->userbuffer && urb->actual_length) {
++ if (urb->number_of_packets > 0) /* Isochronous */
++ i = urb->transfer_buffer_length;
++ else /* Non-Isoc */
++ i = urb->actual_length;
++ if (copy_to_user(as->userbuffer, urb->transfer_buffer, i))
+ return -EFAULT;
++ }
+ if (put_user(as->status, &userurb->status))
+ return -EFAULT;
+ if (put_user(urb->actual_length, &userurb->actual_length))
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 2b428fc..02aad50 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -23,6 +23,7 @@
+ #include <linux/mutex.h>
+ #include <linux/freezer.h>
+ #include <linux/usb/quirks.h>
++#include <linux/random.h>
+
+ #include <asm/uaccess.h>
+ #include <asm/byteorder.h>
+@@ -458,10 +459,8 @@ hub_clear_tt_buffer (struct usb_device *hdev, u16 devinfo, u16 tt)
+ * talking to TTs must queue control transfers (not just bulk and iso), so
+ * both can talk to the same hub concurrently.
+ */
+-static void hub_tt_work(struct work_struct *work)
++void _hub_tt_work(struct usb_hub *hub)
+ {
+- struct usb_hub *hub =
+- container_of(work, struct usb_hub, tt.clear_work);
+ unsigned long flags;
+ int limit = 100;
+
+@@ -496,6 +495,14 @@ static void hub_tt_work(struct work_struct *work)
+ spin_unlock_irqrestore (&hub->tt.lock, flags);
+ }
+
++void hub_tt_work(struct work_struct *work)
++{
++ struct usb_hub *hub =
++ container_of(work, struct usb_hub, tt.clear_work);
++
++ _hub_tt_work(hub);
++}
++
+ /**
+ * usb_hub_clear_tt_buffer - clear control/bulk TT state in high speed hub
+ * @urb: an URB associated with the failed or incomplete split transaction
+@@ -543,7 +550,20 @@ int usb_hub_clear_tt_buffer(struct urb *urb)
+ /* tell keventd to clear state for this TT */
+ spin_lock_irqsave (&tt->lock, flags);
+ list_add_tail (&clear->clear_list, &tt->clear_list);
+- schedule_work(&tt->clear_work);
++ /* don't schedule on kevent if we're running on keventd (e.g.,
++ * in hid_reset we can get here on kevent) unless on >=2.6.36
++ */
++ if (!current_is_keventd())
++ /* put it on keventd */
++ schedule_work(&tt->clear_work);
++ else {
++ /* let khubd do it */
++ struct usb_hub *hub =
++ container_of(&tt->clear_work, struct usb_hub,
++ tt.clear_work);
++ kick_khubd(hub);
++ }
++
+ spin_unlock_irqrestore (&tt->lock, flags);
+ return 0;
+ }
+@@ -1812,6 +1832,14 @@ int usb_new_device(struct usb_device *udev)
+ /* Tell the world! */
+ announce_device(udev);
+
++ if (udev->serial)
++ add_device_randomness(udev->serial, strlen(udev->serial));
++ if (udev->product)
++ add_device_randomness(udev->product, strlen(udev->product));
++ if (udev->manufacturer)
++ add_device_randomness(udev->manufacturer,
++ strlen(udev->manufacturer));
++
+ /* Register the device. The device driver is responsible
+ * for configuring the device and invoking the add-device
+ * notifier chain (used by usbfs and possibly others).
+@@ -3274,6 +3302,10 @@ static void hub_events(void)
+ if (hub->quiescing)
+ goto loop_autopm;
+
++ /* _hub_tt_work usually run on keventd */
++ if (!list_empty(&hub->tt.clear_list))
++ _hub_tt_work(hub);
++
+ if (hub->error) {
+ dev_dbg (hub_dev, "resetting for error %d\n",
+ hub->error);
+diff --git a/drivers/usb/early/ehci-dbgp.c b/drivers/usb/early/ehci-dbgp.c
+index 1206a26..7565f55 100644
+--- a/drivers/usb/early/ehci-dbgp.c
++++ b/drivers/usb/early/ehci-dbgp.c
+@@ -449,7 +449,7 @@ static int dbgp_ehci_startup(void)
+ writel(FLAG_CF, &ehci_regs->configured_flag);
+
+ /* Wait until the controller is no longer halted */
+- loop = 10;
++ loop = 1000;
+ do {
+ status = readl(&ehci_regs->status);
+ if (!(status & STS_HALT))
+diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
+index 0ff157a..981b604 100644
+--- a/drivers/usb/host/pci-quirks.c
++++ b/drivers/usb/host/pci-quirks.c
+@@ -458,9 +458,13 @@ static void __devinit quirk_usb_handoff_xhci(struct pci_dev *pdev)
+ }
+ }
+
+- /* Disable any BIOS SMIs */
+- writel(XHCI_LEGACY_DISABLE_SMI,
+- base + ext_cap_offset + XHCI_LEGACY_CONTROL_OFFSET);
++ val = readl(base + ext_cap_offset + XHCI_LEGACY_CONTROL_OFFSET);
++ /* Mask off (turn off) any enabled SMIs */
++ val &= XHCI_LEGACY_DISABLE_SMI;
++ /* Mask all SMI events bits, RW1C */
++ val |= XHCI_LEGACY_SMI_EVENTS;
++ /* Disable any BIOS SMIs and clear all SMI events*/
++ writel(val, base + ext_cap_offset + XHCI_LEGACY_CONTROL_OFFSET);
+
+ hc_init:
+ op_reg_base = base + XHCI_HC_LENGTH(readl(base));
+diff --git a/drivers/usb/host/xhci-ext-caps.h b/drivers/usb/host/xhci-ext-caps.h
+index 78c4eda..e2acc97 100644
+--- a/drivers/usb/host/xhci-ext-caps.h
++++ b/drivers/usb/host/xhci-ext-caps.h
+@@ -62,8 +62,9 @@
+ /* USB Legacy Support Control and Status Register - section 7.1.2 */
+ /* Add this offset, plus the value of xECP in HCCPARAMS to the base address */
+ #define XHCI_LEGACY_CONTROL_OFFSET (0x04)
+-/* bits 1:2, 5:12, and 17:19 need to be preserved; bits 21:28 should be zero */
+-#define XHCI_LEGACY_DISABLE_SMI ((0x3 << 1) + (0xff << 5) + (0x7 << 17))
++/* bits 1:3, 5:12, and 17:19 need to be preserved; bits 21:28 should be zero */
++#define XHCI_LEGACY_DISABLE_SMI ((0x7 << 1) + (0xff << 5) + (0x7 << 17))
++#define XHCI_LEGACY_SMI_EVENTS (0x7 << 29)
+
+ /* command register values to disable interrupts and halt the HC */
+ /* start/stop HC execution - do not write unless HC is halted*/
+diff --git a/drivers/usb/host/xhci-hcd.c b/drivers/usb/host/xhci-hcd.c
+index 56661a2..0641633 100644
+--- a/drivers/usb/host/xhci-hcd.c
++++ b/drivers/usb/host/xhci-hcd.c
+@@ -150,7 +150,7 @@ int xhci_reset(struct xhci_hcd *xhci)
+ xhci_to_hcd(xhci)->state = HC_STATE_HALT;
+
+ ret = handshake(xhci, &xhci->op_regs->command,
+- CMD_RESET, 0, 250 * 1000);
++ CMD_RESET, 0, 10 * 1000 * 1000);
+ if (ret)
+ return ret;
+
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index 8c29073..776fd43 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -934,11 +934,6 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
+ int i;
+
+ /* Free the Event Ring Segment Table and the actual Event Ring */
+- if (xhci->ir_set) {
+- xhci_writel(xhci, 0, &xhci->ir_set->erst_size);
+- xhci_write_64(xhci, 0, &xhci->ir_set->erst_base);
+- xhci_write_64(xhci, 0, &xhci->ir_set->erst_dequeue);
+- }
+ size = sizeof(struct xhci_erst_entry)*(xhci->erst.num_entries);
+ if (xhci->erst.entries)
+ pci_free_consistent(pdev, size,
+@@ -950,7 +945,7 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
+ xhci->event_ring = NULL;
+ xhci_dbg(xhci, "Freed event ring\n");
+
+- xhci_write_64(xhci, 0, &xhci->op_regs->cmd_ring);
++ xhci->cmd_ring_reserved_trbs = 0;
+ if (xhci->cmd_ring)
+ xhci_ring_free(xhci, xhci->cmd_ring);
+ xhci->cmd_ring = NULL;
+@@ -969,7 +964,6 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
+ xhci->device_pool = NULL;
+ xhci_dbg(xhci, "Freed device context pool\n");
+
+- xhci_write_64(xhci, 0, &xhci->op_regs->dcbaa_ptr);
+ if (xhci->dcbaa)
+ pci_free_consistent(pdev, sizeof(*xhci->dcbaa),
+ xhci->dcbaa, xhci->dcbaa->dma);
+@@ -1146,6 +1140,8 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
+
+ fail:
+ xhci_warn(xhci, "Couldn't initialize memory\n");
++ xhci_halt(xhci);
++ xhci_reset(xhci);
+ xhci_mem_cleanup(xhci);
+ return -ENOMEM;
+ }
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 0a1ccaa..c374beb 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -1784,7 +1784,8 @@ static int ftdi_8u2232c_probe(struct usb_serial *serial)
+
+ dbg("%s", __func__);
+
+- if (strcmp(udev->manufacturer, "CALAO Systems") == 0)
++ if ((udev->manufacturer) &&
++ (strcmp(udev->manufacturer, "CALAO Systems") == 0))
+ return ftdi_jtag_probe(serial);
+
+ return 0;
+diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
+index 9fdcee2..61829b8 100644
+--- a/drivers/usb/serial/mos7840.c
++++ b/drivers/usb/serial/mos7840.c
+@@ -1181,9 +1181,12 @@ static int mos7840_chars_in_buffer(struct tty_struct *tty)
+ }
+
+ spin_lock_irqsave(&mos7840_port->pool_lock, flags);
+- for (i = 0; i < NUM_URBS; ++i)
+- if (mos7840_port->busy[i])
+- chars += URB_TRANSFER_BUFFER_SIZE;
++ for (i = 0; i < NUM_URBS; ++i) {
++ if (mos7840_port->busy[i]) {
++ struct urb *urb = mos7840_port->write_urb_pool[i];
++ chars += urb->transfer_buffer_length;
++ }
++ }
+ spin_unlock_irqrestore(&mos7840_port->pool_lock, flags);
+ dbg("%s - returns %d", __func__, chars);
+ return chars;
+diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
+index f23f3b4..5429bc5 100644
+--- a/drivers/usb/serial/usb-serial.c
++++ b/drivers/usb/serial/usb-serial.c
+@@ -1083,6 +1083,12 @@ int usb_serial_probe(struct usb_interface *interface,
+ serial->attached = 1;
+ }
+
++ /* Avoid race with tty_open and serial_install by setting the
++ * disconnected flag and not clearing it until all ports have been
++ * registered.
++ */
++ serial->disconnected = 1;
++
+ if (get_free_serial(serial, num_ports, &minor) == NULL) {
+ dev_err(&interface->dev, "No more free serial devices\n");
+ goto probe_error;
+@@ -1105,6 +1111,8 @@ int usb_serial_probe(struct usb_interface *interface,
+ }
+ }
+
++ serial->disconnected = 0;
++
+ usb_serial_console_init(debug, minor);
+
+ exit:
+diff --git a/drivers/video/uvesafb.c b/drivers/video/uvesafb.c
+index 54fbb29..6623a2e 100644
+--- a/drivers/video/uvesafb.c
++++ b/drivers/video/uvesafb.c
+@@ -814,8 +814,15 @@ static int __devinit uvesafb_vbe_init(struct fb_info *info)
+ par->pmi_setpal = pmi_setpal;
+ par->ypan = ypan;
+
+- if (par->pmi_setpal || par->ypan)
+- uvesafb_vbe_getpmi(task, par);
++ if (par->pmi_setpal || par->ypan) {
++ if (__supported_pte_mask & _PAGE_NX) {
++ par->pmi_setpal = par->ypan = 0;
++ printk(KERN_WARNING "uvesafb: NX protection is actively."
++ "We have better not to use the PMI.\n");
++ } else {
++ uvesafb_vbe_getpmi(task, par);
++ }
++ }
+ #else
+ /* The protected mode interface is not available on non-x86. */
+ par->pmi_setpal = par->ypan = 0;
+diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c
+index c0861e7..8aac2d6 100644
+--- a/fs/btrfs/async-thread.c
++++ b/fs/btrfs/async-thread.c
+@@ -211,10 +211,17 @@ static noinline int run_ordered_completions(struct btrfs_workers *workers,
+
+ work->ordered_func(work);
+
+- /* now take the lock again and call the freeing code */
++ /* now take the lock again and drop our item from the list */
+ spin_lock(&workers->order_lock);
+ list_del(&work->order_list);
++ spin_unlock(&workers->order_lock);
++
++ /*
++ * we don't want to call the ordered free functions
++ * with the lock held though
++ */
+ work->ordered_free(work);
++ spin_lock(&workers->order_lock);
+ }
+
+ spin_unlock(&workers->order_lock);
+diff --git a/fs/compat.c b/fs/compat.c
+index d1e2411..46b93d1 100644
+--- a/fs/compat.c
++++ b/fs/compat.c
+@@ -1208,11 +1208,14 @@ compat_sys_readv(unsigned long fd, const struct compat_iovec __user *vec,
+ struct file *file;
+ int fput_needed;
+ ssize_t ret;
++ loff_t pos;
+
+ file = fget_light(fd, &fput_needed);
+ if (!file)
+ return -EBADF;
+- ret = compat_readv(file, vec, vlen, &file->f_pos);
++ pos = file->f_pos;
++ ret = compat_readv(file, vec, vlen, &pos);
++ file->f_pos = pos;
+ fput_light(file, fput_needed);
+ return ret;
+ }
+@@ -1265,11 +1268,14 @@ compat_sys_writev(unsigned long fd, const struct compat_iovec __user *vec,
+ struct file *file;
+ int fput_needed;
+ ssize_t ret;
++ loff_t pos;
+
+ file = fget_light(fd, &fput_needed);
+ if (!file)
+ return -EBADF;
+- ret = compat_writev(file, vec, vlen, &file->f_pos);
++ pos = file->f_pos;
++ ret = compat_writev(file, vec, vlen, &pos);
++ file->f_pos = pos;
+ fput_light(file, fput_needed);
+ return ret;
+ }
+diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
+index 90a6087..3c1dbc0 100644
+--- a/fs/ecryptfs/inode.c
++++ b/fs/ecryptfs/inode.c
+@@ -777,6 +777,9 @@ static int truncate_upper(struct dentry *dentry, struct iattr *ia,
+ goto out;
+ }
+ crypt_stat = &ecryptfs_inode_to_private(dentry->d_inode)->crypt_stat;
++ if (crypt_stat->flags & ECRYPTFS_NEW_FILE)
++ crypt_stat->flags &= ~(ECRYPTFS_NEW_FILE);
++
+ /* Set up a fake ecryptfs file, this is used to interface with
+ * the file in the underlying filesystem so that the
+ * truncation has an effect there as well. */
+@@ -1035,6 +1038,8 @@ ecryptfs_setxattr(struct dentry *dentry, const char *name, const void *value,
+ rc = lower_dentry->d_inode->i_op->setxattr(lower_dentry, name, value,
+ size, flags);
+ mutex_unlock(&lower_dentry->d_inode->i_mutex);
++ if (!rc)
++ fsstack_copy_attr_all(dentry->d_inode, lower_dentry->d_inode, NULL);
+ out:
+ return rc;
+ }
+diff --git a/fs/ecryptfs/kthread.c b/fs/ecryptfs/kthread.c
+index e14cf7e..5ffc900 100644
+--- a/fs/ecryptfs/kthread.c
++++ b/fs/ecryptfs/kthread.c
+@@ -148,7 +148,7 @@ int ecryptfs_privileged_open(struct file **lower_file,
+ (*lower_file) = dentry_open(lower_dentry, lower_mnt, flags, cred);
+ if (!IS_ERR(*lower_file))
+ goto out;
+- if (flags & O_RDONLY) {
++ if ((flags & O_ACCMODE) == O_RDONLY) {
+ rc = PTR_ERR((*lower_file));
+ goto out;
+ }
+diff --git a/fs/eventpoll.c b/fs/eventpoll.c
+index f539204..ff57421 100644
+--- a/fs/eventpoll.c
++++ b/fs/eventpoll.c
+@@ -200,6 +200,12 @@ struct eventpoll {
+
+ /* The user that created the eventpoll descriptor */
+ struct user_struct *user;
++
++ struct file *file;
++
++ /* used to optimize loop detection check */
++ int visited;
++ struct list_head visited_list_link;
+ };
+
+ /* Wait structure used by the poll hooks */
+@@ -258,6 +264,15 @@ static struct kmem_cache *epi_cache __read_mostly;
+ /* Slab cache used to allocate "struct eppoll_entry" */
+ static struct kmem_cache *pwq_cache __read_mostly;
+
++/* Visited nodes during ep_loop_check(), so we can unset them when we finish */
++static LIST_HEAD(visited_list);
++
++/*
++ * List of files with newly added links, where we may need to limit the number
++ * of emanating paths. Protected by the epmutex.
++ */
++static LIST_HEAD(tfile_check_list);
++
+ #ifdef CONFIG_SYSCTL
+
+ #include <linux/sysctl.h>
+@@ -277,6 +292,12 @@ ctl_table epoll_table[] = {
+ };
+ #endif /* CONFIG_SYSCTL */
+
++static const struct file_operations eventpoll_fops;
++
++static inline int is_file_epoll(struct file *f)
++{
++ return f->f_op == &eventpoll_fops;
++}
+
+ /* Setup the structure that is used as key for the RB tree */
+ static inline void ep_set_ffd(struct epoll_filefd *ffd,
+@@ -300,6 +321,11 @@ static inline int ep_is_linked(struct list_head *p)
+ return !list_empty(p);
+ }
+
++static inline struct eppoll_entry *ep_pwq_from_wait(wait_queue_t *p)
++{
++ return container_of(p, struct eppoll_entry, wait);
++}
++
+ /* Get the "struct epitem" from a wait queue pointer */
+ static inline struct epitem *ep_item_from_wait(wait_queue_t *p)
+ {
+@@ -434,6 +460,18 @@ static void ep_poll_safewake(wait_queue_head_t *wq)
+ put_cpu();
+ }
+
++static void ep_remove_wait_queue(struct eppoll_entry *pwq)
++{
++ wait_queue_head_t *whead;
++
++ rcu_read_lock();
++ /* If it is cleared by POLLFREE, it should be rcu-safe */
++ whead = rcu_dereference(pwq->whead);
++ if (whead)
++ remove_wait_queue(whead, &pwq->wait);
++ rcu_read_unlock();
++}
++
+ /*
+ * This function unregisters poll callbacks from the associated file
+ * descriptor. Must be called with "mtx" held (or "epmutex" if called from
+@@ -448,7 +486,7 @@ static void ep_unregister_pollwait(struct eventpoll *ep, struct epitem *epi)
+ pwq = list_first_entry(lsthead, struct eppoll_entry, llink);
+
+ list_del(&pwq->llink);
+- remove_wait_queue(pwq->whead, &pwq->wait);
++ ep_remove_wait_queue(pwq);
+ kmem_cache_free(pwq_cache, pwq);
+ }
+ }
+@@ -698,12 +736,6 @@ static const struct file_operations eventpoll_fops = {
+ .poll = ep_eventpoll_poll
+ };
+
+-/* Fast test to see if the file is an evenpoll file */
+-static inline int is_file_epoll(struct file *f)
+-{
+- return f->f_op == &eventpoll_fops;
+-}
+-
+ /*
+ * This is called from eventpoll_release() to unlink files from the eventpoll
+ * interface. We need to have this facility to cleanup correctly files that are
+@@ -814,6 +846,17 @@ static int ep_poll_callback(wait_queue_t *wait, unsigned mode, int sync, void *k
+ struct epitem *epi = ep_item_from_wait(wait);
+ struct eventpoll *ep = epi->ep;
+
++ if ((unsigned long)key & POLLFREE) {
++ ep_pwq_from_wait(wait)->whead = NULL;
++ /*
++ * whead = NULL above can race with ep_remove_wait_queue()
++ * which can do another remove_wait_queue() after us, so we
++ * can't use __remove_wait_queue(). whead->lock is held by
++ * the caller.
++ */
++ list_del_init(&wait->task_list);
++ }
++
+ spin_lock_irqsave(&ep->lock, flags);
+
+ /*
+@@ -913,6 +956,103 @@ static void ep_rbtree_insert(struct eventpoll *ep, struct epitem *epi)
+ rb_insert_color(&epi->rbn, &ep->rbr);
+ }
+
++
++
++#define PATH_ARR_SIZE 5
++/*
++ * These are the number paths of length 1 to 5, that we are allowing to emanate
++ * from a single file of interest. For example, we allow 1000 paths of length
++ * 1, to emanate from each file of interest. This essentially represents the
++ * potential wakeup paths, which need to be limited in order to avoid massive
++ * uncontrolled wakeup storms. The common use case should be a single ep which
++ * is connected to n file sources. In this case each file source has 1 path
++ * of length 1. Thus, the numbers below should be more than sufficient. These
++ * path limits are enforced during an EPOLL_CTL_ADD operation, since a modify
++ * and delete can't add additional paths. Protected by the epmutex.
++ */
++static const int path_limits[PATH_ARR_SIZE] = { 1000, 500, 100, 50, 10 };
++static int path_count[PATH_ARR_SIZE];
++
++static int path_count_inc(int nests)
++{
++ /* Allow an arbitrary number of depth 1 paths */
++ if (nests == 0)
++ return 0;
++
++ if (++path_count[nests] > path_limits[nests])
++ return -1;
++ return 0;
++}
++
++static void path_count_init(void)
++{
++ int i;
++
++ for (i = 0; i < PATH_ARR_SIZE; i++)
++ path_count[i] = 0;
++}
++
++static int reverse_path_check_proc(void *priv, void *cookie, int call_nests)
++{
++ int error = 0;
++ struct file *file = priv;
++ struct file *child_file;
++ struct epitem *epi;
++
++ list_for_each_entry(epi, &file->f_ep_links, fllink) {
++ child_file = epi->ep->file;
++ if (is_file_epoll(child_file)) {
++ if (list_empty(&child_file->f_ep_links)) {
++ if (path_count_inc(call_nests)) {
++ error = -1;
++ break;
++ }
++ } else {
++ error = ep_call_nested(&poll_loop_ncalls,
++ EP_MAX_NESTS,
++ reverse_path_check_proc,
++ child_file, child_file,
++ current);
++ }
++ if (error != 0)
++ break;
++ } else {
++ printk(KERN_ERR "reverse_path_check_proc: "
++ "file is not an ep!\n");
++ }
++ }
++ return error;
++}
++
++/**
++ * reverse_path_check - The tfile_check_list is list of file *, which have
++ * links that are proposed to be newly added. We need to
++ * make sure that those added links don't add too many
++ * paths such that we will spend all our time waking up
++ * eventpoll objects.
++ *
++ * Returns: Returns zero if the proposed links don't create too many paths,
++ * -1 otherwise.
++ */
++static int reverse_path_check(void)
++{
++ int length = 0;
++ int error = 0;
++ struct file *current_file;
++
++ /* let's call this for all tfiles */
++ list_for_each_entry(current_file, &tfile_check_list, f_tfile_llink) {
++ length++;
++ path_count_init();
++ error = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
++ reverse_path_check_proc, current_file,
++ current_file, current);
++ if (error)
++ break;
++ }
++ return error;
++}
++
+ /*
+ * Must be called with "mtx" held.
+ */
+@@ -973,6 +1113,11 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event,
+ */
+ ep_rbtree_insert(ep, epi);
+
++ /* now check if we've created too many backpaths */
++ error = -EINVAL;
++ if (reverse_path_check())
++ goto error_remove_epi;
++
+ /* We have to drop the new item inside our item list to keep track of it */
+ spin_lock_irqsave(&ep->lock, flags);
+
+@@ -997,6 +1142,14 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event,
+
+ return 0;
+
++error_remove_epi:
++ spin_lock(&tfile->f_lock);
++ if (ep_is_linked(&epi->fllink))
++ list_del_init(&epi->fllink);
++ spin_unlock(&tfile->f_lock);
++
++ rb_erase(&epi->rbn, &ep->rbr);
++
+ error_unregister:
+ ep_unregister_pollwait(ep, epi);
+
+@@ -1223,18 +1376,36 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests)
+ int error = 0;
+ struct file *file = priv;
+ struct eventpoll *ep = file->private_data;
++ struct eventpoll *ep_tovisit;
+ struct rb_node *rbp;
+ struct epitem *epi;
+
+ mutex_lock_nested(&ep->mtx, call_nests + 1);
++ ep->visited = 1;
++ list_add(&ep->visited_list_link, &visited_list);
+ for (rbp = rb_first(&ep->rbr); rbp; rbp = rb_next(rbp)) {
+ epi = rb_entry(rbp, struct epitem, rbn);
+ if (unlikely(is_file_epoll(epi->ffd.file))) {
++ ep_tovisit = epi->ffd.file->private_data;
++ if (ep_tovisit->visited)
++ continue;
+ error = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
+- ep_loop_check_proc, epi->ffd.file,
+- epi->ffd.file->private_data, current);
++ ep_loop_check_proc, epi->ffd.file,
++ ep_tovisit, current);
+ if (error != 0)
+ break;
++ } else {
++ /*
++ * If we've reached a file that is not associated with
++ * an ep, then we need to check if the newly added
++ * links are going to add too many wakeup paths. We do
++ * this by adding it to the tfile_check_list, if it's
++ * not already there, and calling reverse_path_check()
++ * during ep_insert().
++ */
++ if (list_empty(&epi->ffd.file->f_tfile_llink))
++ list_add(&epi->ffd.file->f_tfile_llink,
++ &tfile_check_list);
+ }
+ }
+ mutex_unlock(&ep->mtx);
+@@ -1255,8 +1426,31 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests)
+ */
+ static int ep_loop_check(struct eventpoll *ep, struct file *file)
+ {
+- return ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
++ int ret;
++ struct eventpoll *ep_cur, *ep_next;
++
++ ret = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
+ ep_loop_check_proc, file, ep, current);
++ /* clear visited list */
++ list_for_each_entry_safe(ep_cur, ep_next, &visited_list,
++ visited_list_link) {
++ ep_cur->visited = 0;
++ list_del(&ep_cur->visited_list_link);
++ }
++ return ret;
++}
++
++static void clear_tfile_check_list(void)
++{
++ struct file *file;
++
++ /* first clear the tfile_check_list */
++ while (!list_empty(&tfile_check_list)) {
++ file = list_first_entry(&tfile_check_list, struct file,
++ f_tfile_llink);
++ list_del_init(&file->f_tfile_llink);
++ }
++ INIT_LIST_HEAD(&tfile_check_list);
+ }
+
+ /*
+@@ -1264,8 +1458,9 @@ static int ep_loop_check(struct eventpoll *ep, struct file *file)
+ */
+ SYSCALL_DEFINE1(epoll_create1, int, flags)
+ {
+- int error;
++ int error, fd;
+ struct eventpoll *ep = NULL;
++ struct file *file;
+
+ /* Check the EPOLL_* constant for consistency. */
+ BUILD_BUG_ON(EPOLL_CLOEXEC != O_CLOEXEC);
+@@ -1282,11 +1477,25 @@ SYSCALL_DEFINE1(epoll_create1, int, flags)
+ * Creates all the items needed to setup an eventpoll file. That is,
+ * a file structure and a free file descriptor.
+ */
+- error = anon_inode_getfd("[eventpoll]", &eventpoll_fops, ep,
+- flags & O_CLOEXEC);
+- if (error < 0)
+- ep_free(ep);
+-
++ fd = get_unused_fd_flags(O_RDWR | (flags & O_CLOEXEC));
++ if (fd < 0) {
++ error = fd;
++ goto out_free_ep;
++ }
++ file = anon_inode_getfile("[eventpoll]", &eventpoll_fops, ep,
++ O_RDWR | (flags & O_CLOEXEC));
++ if (IS_ERR(file)) {
++ error = PTR_ERR(file);
++ goto out_free_fd;
++ }
++ fd_install(fd, file);
++ ep->file = file;
++ return fd;
++
++out_free_fd:
++ put_unused_fd(fd);
++out_free_ep:
++ ep_free(ep);
+ return error;
+ }
+
+@@ -1352,21 +1561,29 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
+ /*
+ * When we insert an epoll file descriptor, inside another epoll file
+ * descriptor, there is the change of creating closed loops, which are
+- * better be handled here, than in more critical paths.
++ * better be handled here, than in more critical paths. While we are
++ * checking for loops we also determine the list of files reachable
++ * and hang them on the tfile_check_list, so we can check that we
++ * haven't created too many possible wakeup paths.
+ *
+- * We hold epmutex across the loop check and the insert in this case, in
+- * order to prevent two separate inserts from racing and each doing the
+- * insert "at the same time" such that ep_loop_check passes on both
+- * before either one does the insert, thereby creating a cycle.
++ * We need to hold the epmutex across both ep_insert and ep_remove
++ * b/c we want to make sure we are looking at a coherent view of
++ * epoll network.
+ */
+- if (unlikely(is_file_epoll(tfile) && op == EPOLL_CTL_ADD)) {
++ if (op == EPOLL_CTL_ADD || op == EPOLL_CTL_DEL) {
+ mutex_lock(&epmutex);
+ did_lock_epmutex = 1;
+- error = -ELOOP;
+- if (ep_loop_check(ep, tfile) != 0)
+- goto error_tgt_fput;
+ }
+-
++ if (op == EPOLL_CTL_ADD) {
++ if (is_file_epoll(tfile)) {
++ error = -ELOOP;
++ if (ep_loop_check(ep, tfile) != 0) {
++ clear_tfile_check_list();
++ goto error_tgt_fput;
++ }
++ } else
++ list_add(&tfile->f_tfile_llink, &tfile_check_list);
++ }
+
+ mutex_lock_nested(&ep->mtx, 0);
+
+@@ -1385,6 +1602,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
+ error = ep_insert(ep, &epds, tfile, fd);
+ } else
+ error = -EEXIST;
++ clear_tfile_check_list();
+ break;
+ case EPOLL_CTL_DEL:
+ if (epi)
+@@ -1403,7 +1621,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
+ mutex_unlock(&ep->mtx);
+
+ error_tgt_fput:
+- if (unlikely(did_lock_epmutex))
++ if (did_lock_epmutex)
+ mutex_unlock(&epmutex);
+
+ fput(tfile);
+diff --git a/fs/ext3/ialloc.c b/fs/ext3/ialloc.c
+index b399912..108f4fc 100644
+--- a/fs/ext3/ialloc.c
++++ b/fs/ext3/ialloc.c
+@@ -575,8 +575,12 @@ got:
+ if (IS_DIRSYNC(inode))
+ handle->h_sync = 1;
+ if (insert_inode_locked(inode) < 0) {
+- err = -EINVAL;
+- goto fail_drop;
++ /*
++ * Likely a bitmap corruption causing inode to be allocated
++ * twice.
++ */
++ err = -EIO;
++ goto fail;
+ }
+ spin_lock(&sbi->s_next_gen_lock);
+ inode->i_generation = sbi->s_next_generation++;
+diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
+index f9d6937..3191a30 100644
+--- a/fs/ext3/inode.c
++++ b/fs/ext3/inode.c
+@@ -2948,6 +2948,8 @@ static int ext3_do_update_inode(handle_t *handle,
+ struct ext3_inode_info *ei = EXT3_I(inode);
+ struct buffer_head *bh = iloc->bh;
+ int err = 0, rc, block;
++ int need_datasync = 0;
++ __le32 disksize;
+
+ again:
+ /* we can't allow multiple procs in here at once, its a bit racey */
+@@ -2985,7 +2987,11 @@ again:
+ raw_inode->i_gid_high = 0;
+ }
+ raw_inode->i_links_count = cpu_to_le16(inode->i_nlink);
+- raw_inode->i_size = cpu_to_le32(ei->i_disksize);
++ disksize = cpu_to_le32(ei->i_disksize);
++ if (disksize != raw_inode->i_size) {
++ need_datasync = 1;
++ raw_inode->i_size = disksize;
++ }
+ raw_inode->i_atime = cpu_to_le32(inode->i_atime.tv_sec);
+ raw_inode->i_ctime = cpu_to_le32(inode->i_ctime.tv_sec);
+ raw_inode->i_mtime = cpu_to_le32(inode->i_mtime.tv_sec);
+@@ -3001,8 +3007,11 @@ again:
+ if (!S_ISREG(inode->i_mode)) {
+ raw_inode->i_dir_acl = cpu_to_le32(ei->i_dir_acl);
+ } else {
+- raw_inode->i_size_high =
+- cpu_to_le32(ei->i_disksize >> 32);
++ disksize = cpu_to_le32(ei->i_disksize >> 32);
++ if (disksize != raw_inode->i_size_high) {
++ raw_inode->i_size_high = disksize;
++ need_datasync = 1;
++ }
+ if (ei->i_disksize > 0x7fffffffULL) {
+ struct super_block *sb = inode->i_sb;
+ if (!EXT3_HAS_RO_COMPAT_FEATURE(sb,
+@@ -3055,6 +3064,8 @@ again:
+ ei->i_state &= ~EXT3_STATE_NEW;
+
+ atomic_set(&ei->i_sync_tid, handle->h_transaction->t_tid);
++ if (need_datasync)
++ atomic_set(&ei->i_datasync_tid, handle->h_transaction->t_tid);
+ out_brelse:
+ brelse (bh);
+ ext3_std_error(inode->i_sb, err);
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 93f7999..b4402c8 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -358,6 +358,8 @@ static int ext4_valid_extent(struct inode *inode, struct ext4_extent *ext)
+ ext4_fsblk_t block = ext_pblock(ext);
+ int len = ext4_ext_get_actual_len(ext);
+
++ if (len == 0)
++ return 0;
+ return ext4_data_block_valid(EXT4_SB(inode->i_sb), block, len);
+ }
+
+diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
+index 55a93f5..29d9055 100644
+--- a/fs/ext4/ialloc.c
++++ b/fs/ext4/ialloc.c
+@@ -1015,8 +1015,12 @@ got:
+ if (IS_DIRSYNC(inode))
+ ext4_handle_sync(handle);
+ if (insert_inode_locked(inode) < 0) {
+- err = -EINVAL;
+- goto fail_drop;
++ /*
++ * Likely a bitmap corruption causing inode to be allocated
++ * twice.
++ */
++ err = -EIO;
++ goto fail;
+ }
+ spin_lock(&sbi->s_next_gen_lock);
+ inode->i_generation = sbi->s_next_generation++;
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 72ba88f..efe6363 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -1112,6 +1112,15 @@ void ext4_da_update_reserve_space(struct inode *inode,
+ used = ei->i_reserved_data_blocks;
+ }
+
++ if (unlikely(ei->i_allocated_meta_blocks > ei->i_reserved_meta_blocks)) {
++ ext4_msg(inode->i_sb, KERN_NOTICE, "%s: ino %lu, allocated %d "
++ "with only %d reserved metadata blocks\n", __func__,
++ inode->i_ino, ei->i_allocated_meta_blocks,
++ ei->i_reserved_meta_blocks);
++ WARN_ON(1);
++ ei->i_allocated_meta_blocks = ei->i_reserved_meta_blocks;
++ }
++
+ /* Update per-inode reservations */
+ ei->i_reserved_data_blocks -= used;
+ used += ei->i_allocated_meta_blocks;
+diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
+index 4787ae6..b359543 100644
+--- a/fs/fuse/dir.c
++++ b/fs/fuse/dir.c
+@@ -855,6 +855,7 @@ int fuse_update_attributes(struct inode *inode, struct kstat *stat,
+ if (stat) {
+ generic_fillattr(inode, stat);
+ stat->mode = fi->orig_i_mode;
++ stat->ino = fi->orig_ino;
+ }
+ }
+
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index f6104a95..102d582 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -1664,7 +1664,7 @@ static int fuse_verify_ioctl_iov(struct iovec *iov, size_t count)
+ size_t n;
+ u32 max = FUSE_MAX_PAGES_PER_REQ << PAGE_SHIFT;
+
+- for (n = 0; n < count; n++) {
++ for (n = 0; n < count; n++, iov++) {
+ if (iov->iov_len > (size_t) max)
+ return -ENOMEM;
+ max -= iov->iov_len;
+diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
+index e6d614d..829acee 100644
+--- a/fs/fuse/fuse_i.h
++++ b/fs/fuse/fuse_i.h
+@@ -76,6 +76,9 @@ struct fuse_inode {
+ preserve the original mode */
+ mode_t orig_i_mode;
+
++ /** 64 bit inode number */
++ u64 orig_ino;
++
+ /** Version of last attribute change */
+ u64 attr_version;
+
+diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
+index 1a822ce..c95186c 100644
+--- a/fs/fuse/inode.c
++++ b/fs/fuse/inode.c
+@@ -86,6 +86,7 @@ static struct inode *fuse_alloc_inode(struct super_block *sb)
+ fi->nlookup = 0;
+ fi->attr_version = 0;
+ fi->writectr = 0;
++ fi->orig_ino = 0;
+ INIT_LIST_HEAD(&fi->write_files);
+ INIT_LIST_HEAD(&fi->queued_writes);
+ INIT_LIST_HEAD(&fi->writepages);
+@@ -140,6 +141,18 @@ static int fuse_remount_fs(struct super_block *sb, int *flags, char *data)
+ return 0;
+ }
+
++/*
++ * ino_t is 32-bits on 32-bit arch. We have to squash the 64-bit value down
++ * so that it will fit.
++ */
++static ino_t fuse_squash_ino(u64 ino64)
++{
++ ino_t ino = (ino_t) ino64;
++ if (sizeof(ino_t) < sizeof(u64))
++ ino ^= ino64 >> (sizeof(u64) - sizeof(ino_t)) * 8;
++ return ino;
++}
++
+ void fuse_change_attributes_common(struct inode *inode, struct fuse_attr *attr,
+ u64 attr_valid)
+ {
+@@ -149,7 +162,7 @@ void fuse_change_attributes_common(struct inode *inode, struct fuse_attr *attr,
+ fi->attr_version = ++fc->attr_version;
+ fi->i_time = attr_valid;
+
+- inode->i_ino = attr->ino;
++ inode->i_ino = fuse_squash_ino(attr->ino);
+ inode->i_mode = (inode->i_mode & S_IFMT) | (attr->mode & 07777);
+ inode->i_nlink = attr->nlink;
+ inode->i_uid = attr->uid;
+@@ -175,6 +188,8 @@ void fuse_change_attributes_common(struct inode *inode, struct fuse_attr *attr,
+ fi->orig_i_mode = inode->i_mode;
+ if (!(fc->flags & FUSE_DEFAULT_PERMISSIONS))
+ inode->i_mode &= ~S_ISVTX;
++
++ fi->orig_ino = attr->ino;
+ }
+
+ void fuse_change_attributes(struct inode *inode, struct fuse_attr *attr,
+diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c
+index f6874ac..a0786c6 100644
+--- a/fs/hfsplus/catalog.c
++++ b/fs/hfsplus/catalog.c
+@@ -329,6 +329,10 @@ int hfsplus_rename_cat(u32 cnid,
+ err = hfs_brec_find(&src_fd);
+ if (err)
+ goto out;
++ if (src_fd.entrylength > sizeof(entry) || src_fd.entrylength < 0) {
++ err = -EIO;
++ goto out;
++ }
+
+ hfs_bnode_read(src_fd.bnode, &entry, src_fd.entryoffset,
+ src_fd.entrylength);
+diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c
+index 5f40236..f4300ff7 100644
+--- a/fs/hfsplus/dir.c
++++ b/fs/hfsplus/dir.c
+@@ -138,6 +138,11 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir)
+ filp->f_pos++;
+ /* fall through */
+ case 1:
++ if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
++ err = -EIO;
++ goto out;
++ }
++
+ hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength);
+ if (be16_to_cpu(entry.type) != HFSPLUS_FOLDER_THREAD) {
+ printk(KERN_ERR "hfs: bad catalog folder thread\n");
+@@ -168,6 +173,12 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir)
+ err = -EIO;
+ goto out;
+ }
++
++ if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
++ err = -EIO;
++ goto out;
++ }
++
+ hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength);
+ type = be16_to_cpu(entry.type);
+ len = HFSPLUS_MAX_STRLEN;
+diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
+index 87a1258..2179de8 100644
+--- a/fs/hugetlbfs/inode.c
++++ b/fs/hugetlbfs/inode.c
+@@ -601,9 +601,15 @@ static int hugetlbfs_statfs(struct dentry *dentry, struct kstatfs *buf)
+ spin_lock(&sbinfo->stat_lock);
+ /* If no limits set, just report 0 for max/free/used
+ * blocks, like simple_statfs() */
+- if (sbinfo->max_blocks >= 0) {
+- buf->f_blocks = sbinfo->max_blocks;
+- buf->f_bavail = buf->f_bfree = sbinfo->free_blocks;
++ if (sbinfo->spool) {
++ long free_pages;
++
++ spin_lock(&sbinfo->spool->lock);
++ buf->f_blocks = sbinfo->spool->max_hpages;
++ free_pages = sbinfo->spool->max_hpages
++ - sbinfo->spool->used_hpages;
++ buf->f_bavail = buf->f_bfree = free_pages;
++ spin_unlock(&sbinfo->spool->lock);
+ buf->f_files = sbinfo->max_inodes;
+ buf->f_ffree = sbinfo->free_inodes;
+ }
+@@ -619,6 +625,10 @@ static void hugetlbfs_put_super(struct super_block *sb)
+
+ if (sbi) {
+ sb->s_fs_info = NULL;
++
++ if (sbi->spool)
++ hugepage_put_subpool(sbi->spool);
++
+ kfree(sbi);
+ }
+ }
+@@ -842,10 +852,14 @@ hugetlbfs_fill_super(struct super_block *sb, void *data, int silent)
+ sb->s_fs_info = sbinfo;
+ sbinfo->hstate = config.hstate;
+ spin_lock_init(&sbinfo->stat_lock);
+- sbinfo->max_blocks = config.nr_blocks;
+- sbinfo->free_blocks = config.nr_blocks;
+ sbinfo->max_inodes = config.nr_inodes;
+ sbinfo->free_inodes = config.nr_inodes;
++ sbinfo->spool = NULL;
++ if (config.nr_blocks != -1) {
++ sbinfo->spool = hugepage_new_subpool(config.nr_blocks);
++ if (!sbinfo->spool)
++ goto out_free;
++ }
+ sb->s_maxbytes = MAX_LFS_FILESIZE;
+ sb->s_blocksize = huge_page_size(config.hstate);
+ sb->s_blocksize_bits = huge_page_shift(config.hstate);
+@@ -865,38 +879,12 @@ hugetlbfs_fill_super(struct super_block *sb, void *data, int silent)
+ sb->s_root = root;
+ return 0;
+ out_free:
++ if (sbinfo->spool)
++ kfree(sbinfo->spool);
+ kfree(sbinfo);
+ return -ENOMEM;
+ }
+
+-int hugetlb_get_quota(struct address_space *mapping, long delta)
+-{
+- int ret = 0;
+- struct hugetlbfs_sb_info *sbinfo = HUGETLBFS_SB(mapping->host->i_sb);
+-
+- if (sbinfo->free_blocks > -1) {
+- spin_lock(&sbinfo->stat_lock);
+- if (sbinfo->free_blocks - delta >= 0)
+- sbinfo->free_blocks -= delta;
+- else
+- ret = -ENOMEM;
+- spin_unlock(&sbinfo->stat_lock);
+- }
+-
+- return ret;
+-}
+-
+-void hugetlb_put_quota(struct address_space *mapping, long delta)
+-{
+- struct hugetlbfs_sb_info *sbinfo = HUGETLBFS_SB(mapping->host->i_sb);
+-
+- if (sbinfo->free_blocks > -1) {
+- spin_lock(&sbinfo->stat_lock);
+- sbinfo->free_blocks += delta;
+- spin_unlock(&sbinfo->stat_lock);
+- }
+-}
+-
+ static int hugetlbfs_get_sb(struct file_system_type *fs_type,
+ int flags, const char *dev_name, void *data, struct vfsmount *mnt)
+ {
+diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
+index a051270..5c156ad 100644
+--- a/fs/jbd2/transaction.c
++++ b/fs/jbd2/transaction.c
+@@ -1822,6 +1822,8 @@ zap_buffer_unlocked:
+ clear_buffer_mapped(bh);
+ clear_buffer_req(bh);
+ clear_buffer_new(bh);
++ clear_buffer_delay(bh);
++ clear_buffer_unwritten(bh);
+ bh->b_bdev = NULL;
+ return may_free;
+ }
+diff --git a/fs/locks.c b/fs/locks.c
+index a8794f2..fde92d1 100644
+--- a/fs/locks.c
++++ b/fs/locks.c
+@@ -291,7 +291,7 @@ static int flock_make_lock(struct file *filp, struct file_lock **lock,
+ return 0;
+ }
+
+-static int assign_type(struct file_lock *fl, int type)
++static int assign_type(struct file_lock *fl, long type)
+ {
+ switch (type) {
+ case F_RDLCK:
+@@ -444,7 +444,7 @@ static const struct lock_manager_operations lease_manager_ops = {
+ /*
+ * Initialize a lease, use the default lock manager operations
+ */
+-static int lease_init(struct file *filp, int type, struct file_lock *fl)
++static int lease_init(struct file *filp, long type, struct file_lock *fl)
+ {
+ if (assign_type(fl, type) != 0)
+ return -EINVAL;
+@@ -462,7 +462,7 @@ static int lease_init(struct file *filp, int type, struct file_lock *fl)
+ }
+
+ /* Allocate a file_lock initialised to this type of lease */
+-static struct file_lock *lease_alloc(struct file *filp, int type)
++static struct file_lock *lease_alloc(struct file *filp, long type)
+ {
+ struct file_lock *fl = locks_alloc_lock();
+ int error = -ENOMEM;
+diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c
+index 3f8881d..59d9304 100644
+--- a/fs/nfs/nfs3proc.c
++++ b/fs/nfs/nfs3proc.c
+@@ -66,7 +66,7 @@ do_proc_get_root(struct rpc_clnt *client, struct nfs_fh *fhandle,
+ nfs_fattr_init(info->fattr);
+ status = rpc_call_sync(client, &msg, 0);
+ dprintk("%s: reply fsinfo: %d\n", __func__, status);
+- if (!(info->fattr->valid & NFS_ATTR_FATTR)) {
++ if (status == 0 && !(info->fattr->valid & NFS_ATTR_FATTR)) {
+ msg.rpc_proc = &nfs3_procedures[NFS3PROC_GETATTR];
+ msg.rpc_resp = info->fattr;
+ status = rpc_call_sync(client, &msg, 0);
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 3c759df..21c7190 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -1586,6 +1586,7 @@ static int _nfs4_do_open(struct inode *dir, struct path *path, fmode_t fmode, in
+ goto err_opendata_put;
+ if (server->caps & NFS_CAP_POSIX_LOCK)
+ set_bit(NFS_STATE_POSIX_LOCKS, &state->flags);
++ nfs_revalidate_inode(server, state->inode);
+ nfs4_opendata_put(opendata);
+ nfs4_put_state_owner(sp);
+ *res = state;
+diff --git a/fs/nfs/super.c b/fs/nfs/super.c
+index c346808..9a3f15b 100644
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -2934,4 +2934,6 @@ out:
+ return error;
+ }
+
++MODULE_ALIAS("nfs4");
++
+ #endif /* CONFIG_NFS_V4 */
+diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
+index 4a82a96..6d27757 100644
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -1955,7 +1955,7 @@ out_acl:
+ if (bmval0 & FATTR4_WORD0_CASE_INSENSITIVE) {
+ if ((buflen -= 4) < 0)
+ goto out_resource;
+- WRITE32(1);
++ WRITE32(0);
+ }
+ if (bmval0 & FATTR4_WORD0_CASE_PRESERVING) {
+ if ((buflen -= 4) < 0)
+diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
+index ad391a8..149a8a1 100644
+--- a/fs/nilfs2/the_nilfs.c
++++ b/fs/nilfs2/the_nilfs.c
+@@ -478,6 +478,7 @@ static int nilfs_load_super_block(struct the_nilfs *nilfs,
+ brelse(sbh[1]);
+ sbh[1] = NULL;
+ sbp[1] = NULL;
++ valid[1] = 0;
+ swp = 0;
+ }
+ if (!valid[swp]) {
+diff --git a/fs/signalfd.c b/fs/signalfd.c
+index d98bea8..02c25d7 100644
+--- a/fs/signalfd.c
++++ b/fs/signalfd.c
+@@ -29,6 +29,21 @@
+ #include <linux/signalfd.h>
+ #include <linux/syscalls.h>
+
++void signalfd_cleanup(struct sighand_struct *sighand)
++{
++ wait_queue_head_t *wqh = &sighand->signalfd_wqh;
++ /*
++ * The lockless check can race with remove_wait_queue() in progress,
++ * but in this case its caller should run under rcu_read_lock() and
++ * sighand_cachep is SLAB_DESTROY_BY_RCU, we can safely return.
++ */
++ if (likely(!waitqueue_active(wqh)))
++ return;
++
++ /* wait_queue_t->func(POLLFREE) should do remove_wait_queue() */
++ wake_up_poll(wqh, POLLHUP | POLLFREE);
++}
++
+ struct signalfd_ctx {
+ sigset_t sigmask;
+ };
+diff --git a/fs/udf/file.c b/fs/udf/file.c
+index b80cbd7..78bdef3 100644
+--- a/fs/udf/file.c
++++ b/fs/udf/file.c
+@@ -40,20 +40,24 @@
+ #include "udf_i.h"
+ #include "udf_sb.h"
+
+-static int udf_adinicb_readpage(struct file *file, struct page *page)
++static void __udf_adinicb_readpage(struct page *page)
+ {
+ struct inode *inode = page->mapping->host;
+ char *kaddr;
+ struct udf_inode_info *iinfo = UDF_I(inode);
+
+- BUG_ON(!PageLocked(page));
+-
+ kaddr = kmap(page);
+- memset(kaddr, 0, PAGE_CACHE_SIZE);
+ memcpy(kaddr, iinfo->i_ext.i_data + iinfo->i_lenEAttr, inode->i_size);
++ memset(kaddr + inode->i_size, 0, PAGE_CACHE_SIZE - inode->i_size);
+ flush_dcache_page(page);
+ SetPageUptodate(page);
+ kunmap(page);
++}
++
++static int udf_adinicb_readpage(struct file *file, struct page *page)
++{
++ BUG_ON(!PageLocked(page));
++ __udf_adinicb_readpage(page);
+ unlock_page(page);
+
+ return 0;
+@@ -78,6 +82,25 @@ static int udf_adinicb_writepage(struct page *page,
+ return 0;
+ }
+
++static int udf_adinicb_write_begin(struct file *file,
++ struct address_space *mapping, loff_t pos,
++ unsigned len, unsigned flags, struct page **pagep,
++ void **fsdata)
++{
++ struct page *page;
++
++ if (WARN_ON_ONCE(pos >= PAGE_CACHE_SIZE))
++ return -EIO;
++ page = grab_cache_page_write_begin(mapping, 0, flags);
++ if (!page)
++ return -ENOMEM;
++ *pagep = page;
++
++ if (!PageUptodate(page) && len != PAGE_CACHE_SIZE)
++ __udf_adinicb_readpage(page);
++ return 0;
++}
++
+ static int udf_adinicb_write_end(struct file *file,
+ struct address_space *mapping,
+ loff_t pos, unsigned len, unsigned copied,
+@@ -100,8 +123,8 @@ const struct address_space_operations udf_adinicb_aops = {
+ .readpage = udf_adinicb_readpage,
+ .writepage = udf_adinicb_writepage,
+ .sync_page = block_sync_page,
+- .write_begin = simple_write_begin,
+- .write_end = udf_adinicb_write_end,
++ .write_begin = udf_adinicb_write_begin,
++ .write_end = udf_adinicb_write_end,
+ };
+
+ static ssize_t udf_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
+diff --git a/fs/udf/super.c b/fs/udf/super.c
+index ee6b3af..0045ebc 100644
+--- a/fs/udf/super.c
++++ b/fs/udf/super.c
+@@ -57,6 +57,7 @@
+ #include <linux/seq_file.h>
+ #include <linux/bitmap.h>
+ #include <linux/crc-itu-t.h>
++#include <linux/log2.h>
+ #include <asm/byteorder.h>
+
+ #include "udf_sb.h"
+@@ -1239,16 +1240,65 @@ out_bh:
+ return ret;
+ }
+
++static int udf_load_sparable_map(struct super_block *sb,
++ struct udf_part_map *map,
++ struct sparablePartitionMap *spm)
++{
++ uint32_t loc;
++ uint16_t ident;
++ struct sparingTable *st;
++ struct udf_sparing_data *sdata = &map->s_type_specific.s_sparing;
++ int i;
++ struct buffer_head *bh;
++
++ map->s_partition_type = UDF_SPARABLE_MAP15;
++ sdata->s_packet_len = le16_to_cpu(spm->packetLength);
++ if (!is_power_of_2(sdata->s_packet_len)) {
++ udf_error(sb, __func__, "error loading logical volume descriptor: "
++ "Invalid packet length %u\n",
++ (unsigned)sdata->s_packet_len);
++ return -EIO;
++ }
++ if (spm->numSparingTables > 4) {
++ udf_error(sb, __func__, "error loading logical volume descriptor: "
++ "Too many sparing tables (%d)\n",
++ (int)spm->numSparingTables);
++ return -EIO;
++ }
++
++ for (i = 0; i < spm->numSparingTables; i++) {
++ loc = le32_to_cpu(spm->locSparingTable[i]);
++ bh = udf_read_tagged(sb, loc, loc, &ident);
++ if (!bh)
++ continue;
++
++ st = (struct sparingTable *)bh->b_data;
++ if (ident != 0 ||
++ strncmp(st->sparingIdent.ident, UDF_ID_SPARING,
++ strlen(UDF_ID_SPARING)) ||
++ sizeof(*st) + le16_to_cpu(st->reallocationTableLen) >
++ sb->s_blocksize) {
++ brelse(bh);
++ continue;
++ }
++
++ sdata->s_spar_map[i] = bh;
++ }
++ map->s_partition_func = udf_get_pblock_spar15;
++ return 0;
++}
++
+ static int udf_load_logicalvol(struct super_block *sb, sector_t block,
+ struct kernel_lb_addr *fileset)
+ {
+ struct logicalVolDesc *lvd;
+- int i, j, offset;
++ int i, offset;
+ uint8_t type;
+ struct udf_sb_info *sbi = UDF_SB(sb);
+ struct genericPartitionMap *gpm;
+ uint16_t ident;
+ struct buffer_head *bh;
++ unsigned int table_len;
+ int ret = 0;
+
+ bh = udf_read_tagged(sb, block, block, &ident);
+@@ -1257,6 +1307,15 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block,
+ BUG_ON(ident != TAG_IDENT_LVD);
+ lvd = (struct logicalVolDesc *)bh->b_data;
+
++ table_len = le32_to_cpu(lvd->mapTableLength);
++ if (table_len > sb->s_blocksize - sizeof(*lvd)) {
++ udf_error(sb, __func__, "error loading logical volume descriptor: "
++ "Partition table too long (%u > %lu)\n", table_len,
++ sb->s_blocksize - sizeof(*lvd));
++ ret = 1;
++ goto out_bh;
++ }
++
+ i = udf_sb_alloc_partition_maps(sb, le32_to_cpu(lvd->numPartitionMaps));
+ if (i != 0) {
+ ret = i;
+@@ -1264,7 +1323,7 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block,
+ }
+
+ for (i = 0, offset = 0;
+- i < sbi->s_partitions && offset < le32_to_cpu(lvd->mapTableLength);
++ i < sbi->s_partitions && offset < table_len;
+ i++, offset += gpm->partitionMapLength) {
+ struct udf_part_map *map = &sbi->s_partmaps[i];
+ gpm = (struct genericPartitionMap *)
+@@ -1299,38 +1358,11 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block,
+ } else if (!strncmp(upm2->partIdent.ident,
+ UDF_ID_SPARABLE,
+ strlen(UDF_ID_SPARABLE))) {
+- uint32_t loc;
+- struct sparingTable *st;
+- struct sparablePartitionMap *spm =
+- (struct sparablePartitionMap *)gpm;
+-
+- map->s_partition_type = UDF_SPARABLE_MAP15;
+- map->s_type_specific.s_sparing.s_packet_len =
+- le16_to_cpu(spm->packetLength);
+- for (j = 0; j < spm->numSparingTables; j++) {
+- struct buffer_head *bh2;
+-
+- loc = le32_to_cpu(
+- spm->locSparingTable[j]);
+- bh2 = udf_read_tagged(sb, loc, loc,
+- &ident);
+- map->s_type_specific.s_sparing.
+- s_spar_map[j] = bh2;
+-
+- if (bh2 == NULL)
+- continue;
+-
+- st = (struct sparingTable *)bh2->b_data;
+- if (ident != 0 || strncmp(
+- st->sparingIdent.ident,
+- UDF_ID_SPARING,
+- strlen(UDF_ID_SPARING))) {
+- brelse(bh2);
+- map->s_type_specific.s_sparing.
+- s_spar_map[j] = NULL;
+- }
++ if (udf_load_sparable_map(sb, map,
++ (struct sparablePartitionMap *)gpm) < 0) {
++ ret = 1;
++ goto out_bh;
+ }
+- map->s_partition_func = udf_get_pblock_spar15;
+ } else if (!strncmp(upm2->partIdent.ident,
+ UDF_ID_METADATA,
+ strlen(UDF_ID_METADATA))) {
+diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
+index 844a99b..bae2c99 100644
+--- a/fs/xfs/xfs_log_recover.c
++++ b/fs/xfs/xfs_log_recover.c
+@@ -3298,37 +3298,26 @@ xlog_recover_process_iunlinks(
+ */
+ continue;
+ }
++ /*
++ * Unlock the buffer so that it can be acquired in the normal
++ * course of the transaction to truncate and free each inode.
++ * Because we are not racing with anyone else here for the AGI
++ * buffer, we don't even need to hold it locked to read the
++ * initial unlinked bucket entries out of the buffer. We keep
++ * buffer reference though, so that it stays pinned in memory
++ * while we need the buffer.
++ */
+ agi = XFS_BUF_TO_AGI(agibp);
++ xfs_buf_unlock(agibp);
+
+ for (bucket = 0; bucket < XFS_AGI_UNLINKED_BUCKETS; bucket++) {
+ agino = be32_to_cpu(agi->agi_unlinked[bucket]);
+ while (agino != NULLAGINO) {
+- /*
+- * Release the agi buffer so that it can
+- * be acquired in the normal course of the
+- * transaction to truncate and free the inode.
+- */
+- xfs_buf_relse(agibp);
+-
+ agino = xlog_recover_process_one_iunlink(mp,
+ agno, agino, bucket);
+-
+- /*
+- * Reacquire the agibuffer and continue around
+- * the loop. This should never fail as we know
+- * the buffer was good earlier on.
+- */
+- error = xfs_read_agi(mp, NULL, agno, &agibp);
+- ASSERT(error == 0);
+- agi = XFS_BUF_TO_AGI(agibp);
+ }
+ }
+-
+- /*
+- * Release the buffer for the current agi so we can
+- * go on to the next one.
+- */
+- xfs_buf_relse(agibp);
++ xfs_buf_rele(agibp);
+ }
+
+ mp->m_dmevmask = mp_dmevmask;
+diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
+index 8f32f50..1a07e03 100644
+--- a/fs/xfs/xfs_vnodeops.c
++++ b/fs/xfs/xfs_vnodeops.c
+@@ -554,7 +554,7 @@ xfs_readlink(
+ char *link)
+ {
+ xfs_mount_t *mp = ip->i_mount;
+- int pathlen;
++ xfs_fsize_t pathlen;
+ int error = 0;
+
+ xfs_itrace_entry(ip);
+@@ -564,13 +564,21 @@ xfs_readlink(
+
+ xfs_ilock(ip, XFS_ILOCK_SHARED);
+
+- ASSERT((ip->i_d.di_mode & S_IFMT) == S_IFLNK);
+- ASSERT(ip->i_d.di_size <= MAXPATHLEN);
+-
+ pathlen = ip->i_d.di_size;
+ if (!pathlen)
+ goto out;
+
++ if (pathlen < 0 || pathlen > MAXPATHLEN) {
++ xfs_fs_cmn_err(CE_ALERT, mp,
++ "%s: inode (%llu) bad symlink length (%lld)",
++ __func__, (unsigned long long) ip->i_ino,
++ (long long) pathlen);
++ ASSERT(0);
++ error = XFS_ERROR(EFSCORRUPTED);
++ goto out;
++ }
++
++
+ if (ip->i_df.if_flags & XFS_IFINLINE) {
+ memcpy(link, ip->i_df.if_u1.if_data, pathlen);
+ link[pathlen] = '\0';
+diff --git a/include/asm-generic/poll.h b/include/asm-generic/poll.h
+index 44bce83..9ce7f44 100644
+--- a/include/asm-generic/poll.h
++++ b/include/asm-generic/poll.h
+@@ -28,6 +28,8 @@
+ #define POLLRDHUP 0x2000
+ #endif
+
++#define POLLFREE 0x4000 /* currently only for epoll */
++
+ struct pollfd {
+ int fd;
+ short events;
+diff --git a/include/linux/eventpoll.h b/include/linux/eventpoll.h
+index f6856a5..ca399c5 100644
+--- a/include/linux/eventpoll.h
++++ b/include/linux/eventpoll.h
+@@ -61,6 +61,7 @@ struct file;
+ static inline void eventpoll_init_file(struct file *file)
+ {
+ INIT_LIST_HEAD(&file->f_ep_links);
++ INIT_LIST_HEAD(&file->f_tfile_llink);
+ }
+
+
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 1b9a47a..860cb6d 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -941,6 +941,7 @@ struct file {
+ #ifdef CONFIG_EPOLL
+ /* Used by fs/eventpoll.c to link all the hooks to this file */
+ struct list_head f_ep_links;
++ struct list_head f_tfile_llink;
+ #endif /* #ifdef CONFIG_EPOLL */
+ struct address_space *f_mapping;
+ #ifdef CONFIG_DEBUG_WRITECOUNT
+diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h
+index 040b679..b4f0b3f 100644
+--- a/include/linux/hrtimer.h
++++ b/include/linux/hrtimer.h
+@@ -159,6 +159,7 @@ struct hrtimer_clock_base {
+ * and timers
+ * @clock_base: array of clock bases for this cpu
+ * @curr_timer: the timer which is executing a callback right now
++ * @clock_was_set: Indicates that clock was set from irq context.
+ * @expires_next: absolute time of the next event which was scheduled
+ * via clock_set_next_event()
+ * @hres_active: State of high resolution mode
+@@ -171,6 +172,7 @@ struct hrtimer_clock_base {
+ struct hrtimer_cpu_base {
+ spinlock_t lock;
+ struct hrtimer_clock_base clock_base[HRTIMER_MAX_CLOCK_BASES];
++ unsigned int clock_was_set;
+ #ifdef CONFIG_HIGH_RES_TIMERS
+ ktime_t expires_next;
+ int hres_active;
+@@ -280,6 +282,8 @@ extern void hrtimer_peek_ahead_timers(void);
+ # define MONOTONIC_RES_NSEC HIGH_RES_NSEC
+ # define KTIME_MONOTONIC_RES KTIME_HIGH_RES
+
++extern void clock_was_set_delayed(void);
++
+ #else
+
+ # define MONOTONIC_RES_NSEC LOW_RES_NSEC
+@@ -308,11 +312,14 @@ static inline int hrtimer_is_hres_active(struct hrtimer *timer)
+ {
+ return 0;
+ }
++
++static inline void clock_was_set_delayed(void) { }
++
+ #endif
+
+ extern ktime_t ktime_get(void);
+ extern ktime_t ktime_get_real(void);
+-
++extern ktime_t ktime_get_update_offsets(ktime_t *offs_real);
+
+ DECLARE_PER_CPU(struct tick_device, tick_cpu_device);
+
+diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
+index 41a59af..6b3feef 100644
+--- a/include/linux/hugetlb.h
++++ b/include/linux/hugetlb.h
+@@ -12,6 +12,15 @@ struct user_struct;
+ #include <linux/shm.h>
+ #include <asm/tlbflush.h>
+
++struct hugepage_subpool {
++ spinlock_t lock;
++ long count;
++ long max_hpages, used_hpages;
++};
++
++struct hugepage_subpool *hugepage_new_subpool(long nr_blocks);
++void hugepage_put_subpool(struct hugepage_subpool *spool);
++
+ int PageHuge(struct page *page);
+
+ static inline int is_vm_hugetlb_page(struct vm_area_struct *vma)
+@@ -138,12 +147,11 @@ struct hugetlbfs_config {
+ };
+
+ struct hugetlbfs_sb_info {
+- long max_blocks; /* blocks allowed */
+- long free_blocks; /* blocks free */
+ long max_inodes; /* inodes allowed */
+ long free_inodes; /* inodes free */
+ spinlock_t stat_lock;
+ struct hstate *hstate;
++ struct hugepage_subpool *spool;
+ };
+
+
+@@ -166,8 +174,6 @@ extern const struct file_operations hugetlbfs_file_operations;
+ extern const struct vm_operations_struct hugetlb_vm_ops;
+ struct file *hugetlb_file_setup(const char *name, size_t size, int acct,
+ struct user_struct **user, int creat_flags);
+-int hugetlb_get_quota(struct address_space *mapping, long delta);
+-void hugetlb_put_quota(struct address_space *mapping, long delta);
+
+ static inline int is_file_hugepages(struct file *file)
+ {
+diff --git a/include/linux/iocontext.h b/include/linux/iocontext.h
+index eb73632..19abfc1 100644
+--- a/include/linux/iocontext.h
++++ b/include/linux/iocontext.h
+@@ -94,14 +94,15 @@ static inline struct io_context *ioc_task_link(struct io_context *ioc)
+ return NULL;
+ }
+
++struct task_struct;
+ #ifdef CONFIG_BLOCK
+ int put_io_context(struct io_context *ioc);
+-void exit_io_context(void);
++void exit_io_context(struct task_struct *task);
+ struct io_context *get_io_context(gfp_t gfp_flags, int node);
+ struct io_context *alloc_io_context(gfp_t gfp_flags, int node);
+ void copy_io_context(struct io_context **pdst, struct io_context **psrc);
+ #else
+-static inline void exit_io_context(void)
++static inline void exit_io_context(struct task_struct *task)
+ {
+ }
+
+diff --git a/include/linux/irq.h b/include/linux/irq.h
+index 9e5f45a..2333710 100644
+--- a/include/linux/irq.h
++++ b/include/linux/irq.h
+@@ -174,7 +174,6 @@ struct irq_2_iommu;
+ */
+ struct irq_desc {
+ unsigned int irq;
+- struct timer_rand_state *timer_rand_state;
+ unsigned int *kstat_irqs;
+ #ifdef CONFIG_INTR_REMAP
+ struct irq_2_iommu *irq_2_iommu;
+diff --git a/include/linux/kernel.h b/include/linux/kernel.h
+index 9acb92d..3526cd4 100644
+--- a/include/linux/kernel.h
++++ b/include/linux/kernel.h
+@@ -55,6 +55,19 @@ extern const char linux_proc_banner[];
+ } \
+ )
+
++/*
++ * Multiplies an integer by a fraction, while avoiding unnecessary
++ * overflow or loss of precision.
++ */
++#define mult_frac(x, numer, denom)( \
++{ \
++ typeof(x) quot = (x) / (denom); \
++ typeof(x) rem = (x) % (denom); \
++ (quot * (numer)) + ((rem * (numer)) / (denom)); \
++} \
++)
++
++
+ #define _RET_IP_ (unsigned long)__builtin_return_address(0)
+ #define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
+
+diff --git a/include/linux/ktime.h b/include/linux/ktime.h
+index ce59832..ecdf64e 100644
+--- a/include/linux/ktime.h
++++ b/include/linux/ktime.h
+@@ -58,13 +58,6 @@ union ktime {
+
+ typedef union ktime ktime_t; /* Kill this */
+
+-#define KTIME_MAX ((s64)~((u64)1 << 63))
+-#if (BITS_PER_LONG == 64)
+-# define KTIME_SEC_MAX (KTIME_MAX / NSEC_PER_SEC)
+-#else
+-# define KTIME_SEC_MAX LONG_MAX
+-#endif
+-
+ /*
+ * ktime_t definitions when using the 64-bit scalar representation:
+ */
+diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
+index c728a50..8bfed57 100644
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -556,5 +556,12 @@ static inline bool kvm_vcpu_is_bsp(struct kvm_vcpu *vcpu)
+ {
+ return vcpu->kvm->bsp_vcpu_id == vcpu->vcpu_id;
+ }
++
++bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu);
++
++#else
++
++static inline bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu) { return true; }
++
+ #endif
+ #endif
+diff --git a/include/linux/random.h b/include/linux/random.h
+index 2948046..1864957 100644
+--- a/include/linux/random.h
++++ b/include/linux/random.h
+@@ -44,13 +44,13 @@ struct rand_pool_info {
+
+ #ifdef __KERNEL__
+
+-extern void rand_initialize_irq(int irq);
+-
++extern void add_device_randomness(const void *, unsigned int);
+ extern void add_input_randomness(unsigned int type, unsigned int code,
+ unsigned int value);
+-extern void add_interrupt_randomness(int irq);
++extern void add_interrupt_randomness(int irq, int irq_flags);
+
+ extern void get_random_bytes(void *buf, int nbytes);
++extern void get_random_bytes_arch(void *buf, int nbytes);
+ void generate_random_uuid(unsigned char uuid_out[16]);
+
+ #ifndef MODULE
+@@ -63,6 +63,19 @@ unsigned long randomize_range(unsigned long start, unsigned long end, unsigned l
+ u32 random32(void);
+ void srandom32(u32 seed);
+
++#ifdef CONFIG_ARCH_RANDOM
++# include <asm/archrandom.h>
++#else
++static inline int arch_get_random_long(unsigned long *v)
++{
++ return 0;
++}
++static inline int arch_get_random_int(unsigned int *v)
++{
++ return 0;
++}
++#endif
++
+ #endif /* __KERNEL___ */
+
+ #endif /* _LINUX_RANDOM_H */
+diff --git a/include/linux/signalfd.h b/include/linux/signalfd.h
+index b363b91..ed9b65e 100644
+--- a/include/linux/signalfd.h
++++ b/include/linux/signalfd.h
+@@ -60,13 +60,16 @@ static inline void signalfd_notify(struct task_struct *tsk, int sig)
+ wake_up(&tsk->sighand->signalfd_wqh);
+ }
+
++extern void signalfd_cleanup(struct sighand_struct *sighand);
++
+ #else /* CONFIG_SIGNALFD */
+
+ static inline void signalfd_notify(struct task_struct *tsk, int sig) { }
+
++static inline void signalfd_cleanup(struct sighand_struct *sighand) { }
++
+ #endif /* CONFIG_SIGNALFD */
+
+ #endif /* __KERNEL__ */
+
+ #endif /* _LINUX_SIGNALFD_H */
+-
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index bcdd660..4e647bb 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -1312,6 +1312,16 @@ static inline void skb_set_mac_header(struct sk_buff *skb, const int offset)
+ }
+ #endif /* NET_SKBUFF_DATA_USES_OFFSET */
+
++static inline void skb_mac_header_rebuild(struct sk_buff *skb)
++{
++ if (skb_mac_header_was_set(skb)) {
++ const unsigned char *old_mac = skb_mac_header(skb);
++
++ skb_set_mac_header(skb, -skb->mac_len);
++ memmove(skb_mac_header(skb), old_mac, skb->mac_len);
++ }
++}
++
+ static inline int skb_transport_offset(const struct sk_buff *skb)
+ {
+ return skb_transport_header(skb) - skb->data;
+diff --git a/include/linux/time.h b/include/linux/time.h
+index 6e026e4..bc93987 100644
+--- a/include/linux/time.h
++++ b/include/linux/time.h
+@@ -91,11 +91,36 @@ static inline struct timespec timespec_sub(struct timespec lhs,
+ return ts_delta;
+ }
+
++#define KTIME_MAX ((s64)~((u64)1 << 63))
++#if (BITS_PER_LONG == 64)
++# define KTIME_SEC_MAX (KTIME_MAX / NSEC_PER_SEC)
++#else
++# define KTIME_SEC_MAX LONG_MAX
++#endif
++
+ /*
+ * Returns true if the timespec is norm, false if denorm:
+ */
+-#define timespec_valid(ts) \
+- (((ts)->tv_sec >= 0) && (((unsigned long) (ts)->tv_nsec) < NSEC_PER_SEC))
++static inline bool timespec_valid(const struct timespec *ts)
++{
++ /* Dates before 1970 are bogus */
++ if (ts->tv_sec < 0)
++ return false;
++ /* Can't have more nanoseconds then a second */
++ if ((unsigned long)ts->tv_nsec >= NSEC_PER_SEC)
++ return false;
++ return true;
++}
++
++static inline bool timespec_valid_strict(const struct timespec *ts)
++{
++ if (!timespec_valid(ts))
++ return false;
++ /* Disallow values that could overflow ktime_t */
++ if ((unsigned long long)ts->tv_sec >= KTIME_SEC_MAX)
++ return false;
++ return true;
++}
+
+ extern struct timespec xtime;
+ extern struct timespec wall_to_monotonic;
+diff --git a/include/linux/timex.h b/include/linux/timex.h
+index e6967d1..3b587b4 100644
+--- a/include/linux/timex.h
++++ b/include/linux/timex.h
+@@ -271,7 +271,7 @@ static inline int ntp_synced(void)
+ /* Returns how long ticks are at present, in ns / 2^NTP_SCALE_SHIFT. */
+ extern u64 tick_length;
+
+-extern void second_overflow(void);
++extern int second_overflow(unsigned long secs);
+ extern void update_ntp_one_tick(void);
+ extern int do_adjtimex(struct timex *);
+
+diff --git a/include/net/rose.h b/include/net/rose.h
+index 5ba9f02..555dd19 100644
+--- a/include/net/rose.h
++++ b/include/net/rose.h
+@@ -14,6 +14,12 @@
+
+ #define ROSE_MIN_LEN 3
+
++#define ROSE_CALL_REQ_ADDR_LEN_OFF 3
++#define ROSE_CALL_REQ_ADDR_LEN_VAL 0xAA /* each address is 10 digits */
++#define ROSE_CALL_REQ_DEST_ADDR_OFF 4
++#define ROSE_CALL_REQ_SRC_ADDR_OFF 9
++#define ROSE_CALL_REQ_FACILITIES_OFF 14
++
+ #define ROSE_GFI 0x10
+ #define ROSE_Q_BIT 0x80
+ #define ROSE_D_BIT 0x40
+@@ -214,7 +220,7 @@ extern void rose_requeue_frames(struct sock *);
+ extern int rose_validate_nr(struct sock *, unsigned short);
+ extern void rose_write_internal(struct sock *, int);
+ extern int rose_decode(struct sk_buff *, int *, int *, int *, int *, int *);
+-extern int rose_parse_facilities(unsigned char *, struct rose_facilities_struct *);
++extern int rose_parse_facilities(unsigned char *, unsigned int, struct rose_facilities_struct *);
+ extern void rose_disconnect(struct sock *, int, int, int);
+
+ /* rose_timer.c */
+diff --git a/kernel/cred.c b/kernel/cred.c
+index 0b5b5fc..9c06d10 100644
+--- a/kernel/cred.c
++++ b/kernel/cred.c
+@@ -443,6 +443,8 @@ int copy_creds(struct task_struct *p, unsigned long clone_flags)
+
+ mutex_init(&p->cred_guard_mutex);
+
++ p->replacement_session_keyring = NULL;
++
+ if (
+ #ifdef CONFIG_KEYS
+ !p->cred->thread_keyring &&
+diff --git a/kernel/exit.c b/kernel/exit.c
+index 0f8fae3..a2a1659 100644
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -1020,7 +1020,7 @@ NORET_TYPE void do_exit(long code)
+ tsk->flags |= PF_EXITPIDONE;
+
+ if (tsk->io_context)
+- exit_io_context();
++ exit_io_context(tsk);
+
+ if (tsk->splice_pipe)
+ __free_pipe_info(tsk->splice_pipe);
+diff --git a/kernel/fork.c b/kernel/fork.c
+index 4bde56f..c28f804 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -64,6 +64,7 @@
+ #include <linux/magic.h>
+ #include <linux/perf_event.h>
+ #include <linux/posix-timers.h>
++#include <linux/signalfd.h>
+
+ #include <asm/pgtable.h>
+ #include <asm/pgalloc.h>
+@@ -815,8 +816,10 @@ static int copy_sighand(unsigned long clone_flags, struct task_struct *tsk)
+
+ void __cleanup_sighand(struct sighand_struct *sighand)
+ {
+- if (atomic_dec_and_test(&sighand->count))
++ if (atomic_dec_and_test(&sighand->count)) {
++ signalfd_cleanup(sighand);
+ kmem_cache_free(sighand_cachep, sighand);
++ }
+ }
+
+
+@@ -1299,7 +1302,8 @@ bad_fork_free_pid:
+ if (pid != &init_struct_pid)
+ free_pid(pid);
+ bad_fork_cleanup_io:
+- put_io_context(p->io_context);
++ if (p->io_context)
++ exit_io_context(p);
+ bad_fork_cleanup_namespaces:
+ exit_task_namespaces(p);
+ bad_fork_cleanup_mm:
+diff --git a/kernel/futex.c b/kernel/futex.c
+index fb98c9f..9c5ffe1 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -264,17 +264,29 @@ again:
+
+ page = compound_head(page);
+ lock_page(page);
++
++ /*
++ * If page->mapping is NULL, then it cannot be a PageAnon
++ * page; but it might be the ZERO_PAGE or in the gate area or
++ * in a special mapping (all cases which we are happy to fail);
++ * or it may have been a good file page when get_user_pages_fast
++ * found it, but truncated or holepunched or subjected to
++ * invalidate_complete_page2 before we got the page lock (also
++ * cases which we are happy to fail). And we hold a reference,
++ * so refcount care in invalidate_complete_page's remove_mapping
++ * prevents drop_caches from setting mapping to NULL beneath us.
++ *
++ * The case we do have to guard against is when memory pressure made
++ * shmem_writepage move it from filecache to swapcache beneath us:
++ * an unlikely race, but we do need to retry for page->mapping.
++ */
+ if (!page->mapping) {
++ int shmem_swizzled = PageSwapCache(page);
+ unlock_page(page);
+ put_page(page);
+- /*
+- * ZERO_PAGE pages don't have a mapping. Avoid a busy loop
+- * trying to find one. RW mapping would have COW'd (and thus
+- * have a mapping) so this page is RO and won't ever change.
+- */
+- if ((page == ZERO_PAGE(address)))
+- return -EFAULT;
+- goto again;
++ if (shmem_swizzled)
++ goto again;
++ return -EFAULT;
+ }
+
+ /*
+@@ -2192,11 +2204,11 @@ int handle_early_requeue_pi_wakeup(struct futex_hash_bucket *hb,
+ * @uaddr2: the pi futex we will take prior to returning to user-space
+ *
+ * The caller will wait on uaddr and will be requeued by futex_requeue() to
+- * uaddr2 which must be PI aware. Normal wakeup will wake on uaddr2 and
+- * complete the acquisition of the rt_mutex prior to returning to userspace.
+- * This ensures the rt_mutex maintains an owner when it has waiters; without
+- * one, the pi logic wouldn't know which task to boost/deboost, if there was a
+- * need to.
++ * uaddr2 which must be PI aware and unique from uaddr. Normal wakeup will wake
++ * on uaddr2 and complete the acquisition of the rt_mutex prior to returning to
++ * userspace. This ensures the rt_mutex maintains an owner when it has waiters;
++ * without one, the pi logic would not know which task to boost/deboost, if
++ * there was a need to.
+ *
+ * We call schedule in futex_wait_queue_me() when we enqueue and return there
+ * via the following:
+@@ -2233,6 +2245,9 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, int fshared,
+ struct futex_q q;
+ int res, ret;
+
++ if (uaddr == uaddr2)
++ return -EINVAL;
++
+ if (!bitset)
+ return -EINVAL;
+
+@@ -2306,7 +2321,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, int fshared,
+ * signal. futex_unlock_pi() will not destroy the lock_ptr nor
+ * the pi_state.
+ */
+- WARN_ON(!&q.pi_state);
++ WARN_ON(!q.pi_state);
+ pi_mutex = &q.pi_state->pi_mutex;
+ ret = rt_mutex_finish_proxy_lock(pi_mutex, to, &rt_waiter, 1);
+ debug_rt_mutex_free_waiter(&rt_waiter);
+@@ -2333,7 +2348,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, int fshared,
+ * fault, unlock the rt_mutex and return the fault to userspace.
+ */
+ if (ret == -EFAULT) {
+- if (rt_mutex_owner(pi_mutex) == current)
++ if (pi_mutex && rt_mutex_owner(pi_mutex) == current)
+ rt_mutex_unlock(pi_mutex);
+ } else if (ret == -EINTR) {
+ /*
+diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
+index a6e9d00..2818422 100644
+--- a/kernel/hrtimer.c
++++ b/kernel/hrtimer.c
+@@ -603,6 +603,12 @@ static int hrtimer_reprogram(struct hrtimer *timer,
+ return res;
+ }
+
++static inline ktime_t hrtimer_update_base(struct hrtimer_cpu_base *base)
++{
++ ktime_t *offs_real = &base->clock_base[CLOCK_REALTIME].offset;
++
++ return ktime_get_update_offsets(offs_real);
++}
+
+ /*
+ * Retrigger next event is called after clock was set
+@@ -612,26 +618,15 @@ static int hrtimer_reprogram(struct hrtimer *timer,
+ static void retrigger_next_event(void *arg)
+ {
+ struct hrtimer_cpu_base *base;
+- struct timespec realtime_offset;
+- unsigned long seq;
+
+ if (!hrtimer_hres_active())
+ return;
+
+- do {
+- seq = read_seqbegin(&xtime_lock);
+- set_normalized_timespec(&realtime_offset,
+- -wall_to_monotonic.tv_sec,
+- -wall_to_monotonic.tv_nsec);
+- } while (read_seqretry(&xtime_lock, seq));
+-
+ base = &__get_cpu_var(hrtimer_bases);
+
+ /* Adjust CLOCK_REALTIME offset */
+ spin_lock(&base->lock);
+- base->clock_base[CLOCK_REALTIME].offset =
+- timespec_to_ktime(realtime_offset);
+-
++ hrtimer_update_base(base);
+ hrtimer_force_reprogram(base, 0);
+ spin_unlock(&base->lock);
+ }
+@@ -731,13 +726,25 @@ static int hrtimer_switch_to_hres(void)
+ base->clock_base[CLOCK_MONOTONIC].resolution = KTIME_HIGH_RES;
+
+ tick_setup_sched_timer();
+-
+ /* "Retrigger" the interrupt to get things going */
+ retrigger_next_event(NULL);
+ local_irq_restore(flags);
+ return 1;
+ }
+
++/*
++ * Called from timekeeping code to reprogramm the hrtimer interrupt
++ * device. If called from the timer interrupt context we defer it to
++ * softirq context.
++ */
++void clock_was_set_delayed(void)
++{
++ struct hrtimer_cpu_base *cpu_base = &__get_cpu_var(hrtimer_bases);
++
++ cpu_base->clock_was_set = 1;
++ __raise_softirq_irqoff(HRTIMER_SOFTIRQ);
++}
++
+ #else
+
+ static inline int hrtimer_hres_active(void) { return 0; }
+@@ -1250,11 +1257,10 @@ void hrtimer_interrupt(struct clock_event_device *dev)
+ cpu_base->nr_events++;
+ dev->next_event.tv64 = KTIME_MAX;
+
+- entry_time = now = ktime_get();
++ spin_lock(&cpu_base->lock);
++ entry_time = now = hrtimer_update_base(cpu_base);
+ retry:
+ expires_next.tv64 = KTIME_MAX;
+-
+- spin_lock(&cpu_base->lock);
+ /*
+ * We set expires_next to KTIME_MAX here with cpu_base->lock
+ * held to prevent that a timer is enqueued in our queue via
+@@ -1328,8 +1334,12 @@ retry:
+ * We need to prevent that we loop forever in the hrtimer
+ * interrupt routine. We give it 3 attempts to avoid
+ * overreacting on some spurious event.
++ *
++ * Acquire base lock for updating the offsets and retrieving
++ * the current time.
+ */
+- now = ktime_get();
++ spin_lock(&cpu_base->lock);
++ now = hrtimer_update_base(cpu_base);
+ cpu_base->nr_retries++;
+ if (++retries < 3)
+ goto retry;
+@@ -1341,6 +1351,7 @@ retry:
+ */
+ cpu_base->nr_hangs++;
+ cpu_base->hang_detected = 1;
++ spin_unlock(&cpu_base->lock);
+ delta = ktime_sub(now, entry_time);
+ if (delta.tv64 > cpu_base->max_hang_time.tv64)
+ cpu_base->max_hang_time = delta;
+@@ -1393,6 +1404,13 @@ void hrtimer_peek_ahead_timers(void)
+
+ static void run_hrtimer_softirq(struct softirq_action *h)
+ {
++ struct hrtimer_cpu_base *cpu_base = &__get_cpu_var(hrtimer_bases);
++
++ if (cpu_base->clock_was_set) {
++ cpu_base->clock_was_set = 0;
++ clock_was_set();
++ }
++
+ hrtimer_peek_ahead_timers();
+ }
+
+diff --git a/kernel/irq/handle.c b/kernel/irq/handle.c
+index 17c71bb..27fd0a6 100644
+--- a/kernel/irq/handle.c
++++ b/kernel/irq/handle.c
+@@ -370,7 +370,7 @@ static void warn_no_thread(unsigned int irq, struct irqaction *action)
+ irqreturn_t handle_IRQ_event(unsigned int irq, struct irqaction *action)
+ {
+ irqreturn_t ret, retval = IRQ_NONE;
+- unsigned int status = 0;
++ unsigned int flags = 0;
+
+ if (!(action->flags & IRQF_DISABLED))
+ local_irq_enable_in_hardirq();
+@@ -413,7 +413,7 @@ irqreturn_t handle_IRQ_event(unsigned int irq, struct irqaction *action)
+
+ /* Fall through to add to randomness */
+ case IRQ_HANDLED:
+- status |= action->flags;
++ flags |= action->flags;
+ break;
+
+ default:
+@@ -424,8 +424,7 @@ irqreturn_t handle_IRQ_event(unsigned int irq, struct irqaction *action)
+ action = action->next;
+ } while (action);
+
+- if (status & IRQF_SAMPLE_RANDOM)
+- add_interrupt_randomness(irq);
++ add_interrupt_randomness(irq, flags);
+ local_irq_disable();
+
+ return retval;
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index 315705c..5dd29f3 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -633,22 +633,6 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
+
+ if (desc->chip == &no_irq_chip)
+ return -ENOSYS;
+- /*
+- * Some drivers like serial.c use request_irq() heavily,
+- * so we have to be careful not to interfere with a
+- * running system.
+- */
+- if (new->flags & IRQF_SAMPLE_RANDOM) {
+- /*
+- * This function might sleep, we want to call it first,
+- * outside of the atomic block.
+- * Yes, this might clear the entropy pool if the wrong
+- * driver is attempted to be loaded, without actually
+- * installing a new handler, but is this really a problem,
+- * only the sysadmin is able to do this.
+- */
+- rand_initialize_irq(irq);
+- }
+
+ /* Oneshot interrupts are not allowed with shared */
+ if ((new->flags & IRQF_ONESHOT) && (new->flags & IRQF_SHARED))
+@@ -1021,7 +1005,6 @@ EXPORT_SYMBOL(free_irq);
+ *
+ * IRQF_SHARED Interrupt is shared
+ * IRQF_DISABLED Disable local interrupts while processing
+- * IRQF_SAMPLE_RANDOM The interrupt can be used for entropy
+ * IRQF_TRIGGER_* Specify active edge(s) or level
+ *
+ */
+diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
+index cd9a40b..fd6e5f2 100644
+--- a/kernel/sched_fair.c
++++ b/kernel/sched_fair.c
+@@ -862,6 +862,9 @@ check_preempt_tick(struct cfs_rq *cfs_rq, struct sched_entity *curr)
+ struct sched_entity *se = __pick_next_entity(cfs_rq);
+ s64 delta = curr->vruntime - se->vruntime;
+
++ if (delta < 0)
++ return;
++
+ if (delta > ideal_runtime)
+ resched_task(rq_of(cfs_rq)->curr);
+ }
+diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
+index 4800f93..264928c 100644
+--- a/kernel/time/ntp.c
++++ b/kernel/time/ntp.c
+@@ -28,8 +28,6 @@ unsigned long tick_nsec;
+ u64 tick_length;
+ static u64 tick_length_base;
+
+-static struct hrtimer leap_timer;
+-
+ #define MAX_TICKADJ 500LL /* usecs */
+ #define MAX_TICKADJ_SCALED \
+ (((MAX_TICKADJ * NSEC_PER_USEC) << NTP_SCALE_SHIFT) / NTP_INTERVAL_FREQ)
+@@ -108,7 +106,7 @@ static inline s64 ntp_update_offset_fll(s64 offset64, long secs)
+ {
+ time_status &= ~STA_MODE;
+
+- if (secs < MINSEC)
++ if ((s32)secs < MINSEC)
+ return 0;
+
+ if (!(time_status & STA_FLL) && (secs <= MAXSEC))
+@@ -180,60 +178,64 @@ void ntp_clear(void)
+ }
+
+ /*
+- * Leap second processing. If in leap-insert state at the end of the
+- * day, the system clock is set back one second; if in leap-delete
+- * state, the system clock is set ahead one second.
++ * this routine handles the overflow of the microsecond field
++ *
++ * The tricky bits of code to handle the accurate clock support
++ * were provided by Dave Mills (Mills@UDEL.EDU) of NTP fame.
++ * They were originally developed for SUN and DEC kernels.
++ * All the kudos should go to Dave for this stuff.
++ *
++ * Also handles leap second processing, and returns leap offset
+ */
+-static enum hrtimer_restart ntp_leap_second(struct hrtimer *timer)
++int second_overflow(unsigned long secs)
+ {
+- enum hrtimer_restart res = HRTIMER_NORESTART;
+-
+- write_seqlock(&xtime_lock);
++ int leap = 0;
++ s64 delta;
+
++ /*
++ * Leap second processing. If in leap-insert state at the end of the
++ * day, the system clock is set back one second; if in leap-delete
++ * state, the system clock is set ahead one second.
++ */
+ switch (time_state) {
+ case TIME_OK:
++ if (time_status & STA_INS)
++ time_state = TIME_INS;
++ else if (time_status & STA_DEL)
++ time_state = TIME_DEL;
+ break;
+ case TIME_INS:
+- timekeeping_leap_insert(-1);
+- time_state = TIME_OOP;
+- printk(KERN_NOTICE
+- "Clock: inserting leap second 23:59:60 UTC\n");
+- hrtimer_add_expires_ns(&leap_timer, NSEC_PER_SEC);
+- res = HRTIMER_RESTART;
++ if (!(time_status & STA_INS))
++ time_state = TIME_OK;
++ else if (secs % 86400 == 0) {
++ leap = -1;
++ time_state = TIME_OOP;
++ time_tai++;
++ printk(KERN_NOTICE
++ "Clock: inserting leap second 23:59:60 UTC\n");
++ }
+ break;
+ case TIME_DEL:
+- timekeeping_leap_insert(1);
+- time_tai--;
+- time_state = TIME_WAIT;
+- printk(KERN_NOTICE
+- "Clock: deleting leap second 23:59:59 UTC\n");
++ if (!(time_status & STA_DEL))
++ time_state = TIME_OK;
++ else if ((secs + 1) % 86400 == 0) {
++ leap = 1;
++ time_tai--;
++ time_state = TIME_WAIT;
++ printk(KERN_NOTICE
++ "Clock: deleting leap second 23:59:59 UTC\n");
++ }
+ break;
+ case TIME_OOP:
+- time_tai++;
+ time_state = TIME_WAIT;
+- /* fall through */
++ break;
++
+ case TIME_WAIT:
+ if (!(time_status & (STA_INS | STA_DEL)))
+ time_state = TIME_OK;
+ break;
+ }
+
+- write_sequnlock(&xtime_lock);
+-
+- return res;
+-}
+-
+-/*
+- * this routine handles the overflow of the microsecond field
+- *
+- * The tricky bits of code to handle the accurate clock support
+- * were provided by Dave Mills (Mills@UDEL.EDU) of NTP fame.
+- * They were originally developed for SUN and DEC kernels.
+- * All the kudos should go to Dave for this stuff.
+- */
+-void second_overflow(void)
+-{
+- s64 delta;
+
+ /* Bump the maxerror field */
+ time_maxerror += MAXFREQ / NSEC_PER_USEC;
+@@ -253,23 +255,25 @@ void second_overflow(void)
+ tick_length += delta;
+
+ if (!time_adjust)
+- return;
++ goto out;
+
+ if (time_adjust > MAX_TICKADJ) {
+ time_adjust -= MAX_TICKADJ;
+ tick_length += MAX_TICKADJ_SCALED;
+- return;
++ goto out;
+ }
+
+ if (time_adjust < -MAX_TICKADJ) {
+ time_adjust += MAX_TICKADJ;
+ tick_length -= MAX_TICKADJ_SCALED;
+- return;
++ goto out;
+ }
+
+ tick_length += (s64)(time_adjust * NSEC_PER_USEC / NTP_INTERVAL_FREQ)
+ << NTP_SCALE_SHIFT;
+ time_adjust = 0;
++out:
++ return leap;
+ }
+
+ #ifdef CONFIG_GENERIC_CMOS_UPDATE
+@@ -331,27 +335,6 @@ static void notify_cmos_timer(void)
+ static inline void notify_cmos_timer(void) { }
+ #endif
+
+-/*
+- * Start the leap seconds timer:
+- */
+-static inline void ntp_start_leap_timer(struct timespec *ts)
+-{
+- long now = ts->tv_sec;
+-
+- if (time_status & STA_INS) {
+- time_state = TIME_INS;
+- now += 86400 - now % 86400;
+- hrtimer_start(&leap_timer, ktime_set(now, 0), HRTIMER_MODE_ABS);
+-
+- return;
+- }
+-
+- if (time_status & STA_DEL) {
+- time_state = TIME_DEL;
+- now += 86400 - (now + 1) % 86400;
+- hrtimer_start(&leap_timer, ktime_set(now, 0), HRTIMER_MODE_ABS);
+- }
+-}
+
+ /*
+ * Propagate a new txc->status value into the NTP state:
+@@ -374,22 +357,6 @@ static inline void process_adj_status(struct timex *txc, struct timespec *ts)
+ time_status &= STA_RONLY;
+ time_status |= txc->status & ~STA_RONLY;
+
+- switch (time_state) {
+- case TIME_OK:
+- ntp_start_leap_timer(ts);
+- break;
+- case TIME_INS:
+- case TIME_DEL:
+- time_state = TIME_OK;
+- ntp_start_leap_timer(ts);
+- case TIME_WAIT:
+- if (!(time_status & (STA_INS | STA_DEL)))
+- time_state = TIME_OK;
+- break;
+- case TIME_OOP:
+- hrtimer_restart(&leap_timer);
+- break;
+- }
+ }
+ /*
+ * Called with the xtime lock held, so we can access and modify
+@@ -469,9 +436,6 @@ int do_adjtimex(struct timex *txc)
+ (txc->tick < 900000/USER_HZ ||
+ txc->tick > 1100000/USER_HZ))
+ return -EINVAL;
+-
+- if (txc->modes & ADJ_STATUS && time_state != TIME_OK)
+- hrtimer_cancel(&leap_timer);
+ }
+
+ getnstimeofday(&ts);
+@@ -549,6 +513,4 @@ __setup("ntp_tick_adj=", ntp_tick_adj_setup);
+ void __init ntp_init(void)
+ {
+ ntp_clear();
+- hrtimer_init(&leap_timer, CLOCK_REALTIME, HRTIMER_MODE_ABS);
+- leap_timer.function = ntp_leap_second;
+ }
+diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
+index 4a71cff..3d35af3 100644
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -161,11 +161,39 @@ struct timespec xtime __attribute__ ((aligned (16)));
+ struct timespec wall_to_monotonic __attribute__ ((aligned (16)));
+ static struct timespec total_sleep_time;
+
++/* Offset clock monotonic -> clock realtime */
++static ktime_t offs_real;
++
++/* Offset clock monotonic -> clock boottime */
++static ktime_t offs_boot;
++
+ /*
+ * The raw monotonic time for the CLOCK_MONOTONIC_RAW posix clock.
+ */
+ struct timespec raw_time;
+
++/* must hold write on xtime_lock */
++static void update_rt_offset(void)
++{
++ struct timespec tmp, *wtm = &wall_to_monotonic;
++
++ set_normalized_timespec(&tmp, -wtm->tv_sec, -wtm->tv_nsec);
++ offs_real = timespec_to_ktime(tmp);
++}
++
++/* must hold write on xtime_lock */
++static void timekeeping_update(bool clearntp)
++{
++ if (clearntp) {
++ timekeeper.ntp_error = 0;
++ ntp_clear();
++ }
++ update_rt_offset();
++ update_vsyscall(&xtime, timekeeper.clock, timekeeper.mult);
++}
++
++
++
+ /* flag for if timekeeping is suspended */
+ int __read_mostly timekeeping_suspended;
+
+@@ -183,14 +211,6 @@ void update_xtime_cache(u64 nsec)
+ ACCESS_ONCE(xtime_cache) = ts;
+ }
+
+-/* must hold xtime_lock */
+-void timekeeping_leap_insert(int leapsecond)
+-{
+- xtime.tv_sec += leapsecond;
+- wall_to_monotonic.tv_sec -= leapsecond;
+- update_vsyscall(&xtime, timekeeper.clock, timekeeper.mult);
+-}
+-
+ #ifdef CONFIG_GENERIC_TIME
+
+ /**
+@@ -334,7 +354,7 @@ int do_settimeofday(struct timespec *tv)
+ struct timespec ts_delta;
+ unsigned long flags;
+
+- if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC)
++ if (!timespec_valid_strict(tv))
+ return -EINVAL;
+
+ write_seqlock_irqsave(&xtime_lock, flags);
+@@ -349,10 +369,7 @@ int do_settimeofday(struct timespec *tv)
+
+ update_xtime_cache(0);
+
+- timekeeper.ntp_error = 0;
+- ntp_clear();
+-
+- update_vsyscall(&xtime, timekeeper.clock, timekeeper.mult);
++ timekeeping_update(true);
+
+ write_sequnlock_irqrestore(&xtime_lock, flags);
+
+@@ -553,7 +570,20 @@ void __init timekeeping_init(void)
+ struct timespec now, boot;
+
+ read_persistent_clock(&now);
++ if (!timespec_valid_strict(&now)) {
++ printk("WARNING: Persistent clock returned invalid value!\n"
++ " Check your CMOS/BIOS settings.\n");
++ now.tv_sec = 0;
++ now.tv_nsec = 0;
++ }
++
+ read_boot_clock(&boot);
++ if (!timespec_valid_strict(&boot)) {
++ printk("WARNING: Boot clock returned invalid value!\n"
++ " Check your CMOS/BIOS settings.\n");
++ boot.tv_sec = 0;
++ boot.tv_nsec = 0;
++ }
+
+ write_seqlock_irqsave(&xtime_lock, flags);
+
+@@ -575,6 +605,7 @@ void __init timekeeping_init(void)
+ set_normalized_timespec(&wall_to_monotonic,
+ -boot.tv_sec, -boot.tv_nsec);
+ update_xtime_cache(0);
++ update_rt_offset();
+ total_sleep_time.tv_sec = 0;
+ total_sleep_time.tv_nsec = 0;
+ write_sequnlock_irqrestore(&xtime_lock, flags);
+@@ -583,6 +614,12 @@ void __init timekeeping_init(void)
+ /* time in seconds when suspend began */
+ static struct timespec timekeeping_suspend_time;
+
++static void update_sleep_time(struct timespec t)
++{
++ total_sleep_time = t;
++ offs_boot = timespec_to_ktime(t);
++}
++
+ /**
+ * timekeeping_resume - Resumes the generic timekeeping subsystem.
+ * @dev: unused
+@@ -606,13 +643,14 @@ static int timekeeping_resume(struct sys_device *dev)
+ ts = timespec_sub(ts, timekeeping_suspend_time);
+ xtime = timespec_add_safe(xtime, ts);
+ wall_to_monotonic = timespec_sub(wall_to_monotonic, ts);
+- total_sleep_time = timespec_add_safe(total_sleep_time, ts);
++ update_sleep_time(timespec_add_safe(total_sleep_time, ts));
+ }
+ update_xtime_cache(0);
+ /* re-base the last cycle value */
+ timekeeper.clock->cycle_last = timekeeper.clock->read(timekeeper.clock);
+ timekeeper.ntp_error = 0;
+ timekeeping_suspended = 0;
++ timekeeping_update(false);
+ write_sequnlock_irqrestore(&xtime_lock, flags);
+
+ touch_softlockup_watchdog();
+@@ -769,6 +807,10 @@ void update_wall_time(void)
+ #else
+ offset = timekeeper.cycle_interval;
+ #endif
++ /* Check if there's really nothing to do */
++ if (offset < timekeeper.cycle_interval)
++ return;
++
+ timekeeper.xtime_nsec = (s64)xtime.tv_nsec << timekeeper.shift;
+
+ /* normally this loop will run just once, however in the
+@@ -783,9 +825,14 @@ void update_wall_time(void)
+
+ timekeeper.xtime_nsec += timekeeper.xtime_interval;
+ if (timekeeper.xtime_nsec >= nsecps) {
++ int leap;
+ timekeeper.xtime_nsec -= nsecps;
+ xtime.tv_sec++;
+- second_overflow();
++ leap = second_overflow(xtime.tv_sec);
++ xtime.tv_sec += leap;
++ wall_to_monotonic.tv_sec -= leap;
++ if (leap)
++ clock_was_set_delayed();
+ }
+
+ raw_time.tv_nsec += timekeeper.raw_interval;
+@@ -837,8 +884,7 @@ void update_wall_time(void)
+ nsecs = clocksource_cyc2ns(offset, timekeeper.mult, timekeeper.shift);
+ update_xtime_cache(nsecs);
+
+- /* check to see if there is a new clocksource to use */
+- update_vsyscall(&xtime, timekeeper.clock, timekeeper.mult);
++ timekeeping_update(false);
+ }
+
+ /**
+@@ -915,3 +961,35 @@ struct timespec get_monotonic_coarse(void)
+ now.tv_nsec + mono.tv_nsec);
+ return now;
+ }
++
++#ifdef CONFIG_HIGH_RES_TIMERS
++/**
++ * ktime_get_update_offsets - hrtimer helper
++ * @real: pointer to storage for monotonic -> realtime offset
++ *
++ * Returns current monotonic time and updates the offsets
++ * Called from hrtimer_interupt() or retrigger_next_event()
++ */
++ktime_t ktime_get_update_offsets(ktime_t *real)
++{
++ ktime_t now;
++ unsigned int seq;
++ u64 secs, nsecs;
++
++ do {
++ seq = read_seqbegin(&xtime_lock);
++
++ secs = xtime.tv_sec;
++ nsecs = xtime.tv_nsec;
++ nsecs += timekeeping_get_ns();
++ /* If arch requires, add in gettimeoffset() */
++ nsecs += arch_gettimeoffset();
++
++ *real = offs_real;
++ } while (read_seqretry(&xtime_lock, seq));
++
++ now = ktime_add_ns(ktime_set(secs, 0), nsecs);
++ now = ktime_sub(now, *real);
++ return now;
++}
++#endif
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 67e526b..b617e0c 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -772,6 +772,7 @@ int current_is_keventd(void)
+ return ret;
+
+ }
++EXPORT_SYMBOL_GPL(current_is_keventd);
+
+ static struct cpu_workqueue_struct *
+ init_cpu_workqueue(struct workqueue_struct *wq, int cpu)
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 5e1e508..20f9240 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -49,6 +49,84 @@ static unsigned long __initdata default_hstate_size;
+ */
+ static DEFINE_SPINLOCK(hugetlb_lock);
+
++static inline void unlock_or_release_subpool(struct hugepage_subpool *spool)
++{
++ bool free = (spool->count == 0) && (spool->used_hpages == 0);
++
++ spin_unlock(&spool->lock);
++
++ /* If no pages are used, and no other handles to the subpool
++ * remain, free the subpool the subpool remain */
++ if (free)
++ kfree(spool);
++}
++
++struct hugepage_subpool *hugepage_new_subpool(long nr_blocks)
++{
++ struct hugepage_subpool *spool;
++
++ spool = kmalloc(sizeof(*spool), GFP_KERNEL);
++ if (!spool)
++ return NULL;
++
++ spin_lock_init(&spool->lock);
++ spool->count = 1;
++ spool->max_hpages = nr_blocks;
++ spool->used_hpages = 0;
++
++ return spool;
++}
++
++void hugepage_put_subpool(struct hugepage_subpool *spool)
++{
++ spin_lock(&spool->lock);
++ BUG_ON(!spool->count);
++ spool->count--;
++ unlock_or_release_subpool(spool);
++}
++
++static int hugepage_subpool_get_pages(struct hugepage_subpool *spool,
++ long delta)
++{
++ int ret = 0;
++
++ if (!spool)
++ return 0;
++
++ spin_lock(&spool->lock);
++ if ((spool->used_hpages + delta) <= spool->max_hpages) {
++ spool->used_hpages += delta;
++ } else {
++ ret = -ENOMEM;
++ }
++ spin_unlock(&spool->lock);
++
++ return ret;
++}
++
++static void hugepage_subpool_put_pages(struct hugepage_subpool *spool,
++ long delta)
++{
++ if (!spool)
++ return;
++
++ spin_lock(&spool->lock);
++ spool->used_hpages -= delta;
++ /* If hugetlbfs_put_super couldn't free spool due to
++ * an outstanding quota reference, free it now. */
++ unlock_or_release_subpool(spool);
++}
++
++static inline struct hugepage_subpool *subpool_inode(struct inode *inode)
++{
++ return HUGETLBFS_SB(inode->i_sb)->spool;
++}
++
++static inline struct hugepage_subpool *subpool_vma(struct vm_area_struct *vma)
++{
++ return subpool_inode(vma->vm_file->f_dentry->d_inode);
++}
++
+ /*
+ * Region tracking -- allows tracking of reservations and instantiated pages
+ * across the pages in a mapping.
+@@ -541,9 +619,9 @@ static void free_huge_page(struct page *page)
+ */
+ struct hstate *h = page_hstate(page);
+ int nid = page_to_nid(page);
+- struct address_space *mapping;
++ struct hugepage_subpool *spool =
++ (struct hugepage_subpool *)page_private(page);
+
+- mapping = (struct address_space *) page_private(page);
+ set_page_private(page, 0);
+ page->mapping = NULL;
+ BUG_ON(page_count(page));
+@@ -558,8 +636,7 @@ static void free_huge_page(struct page *page)
+ enqueue_huge_page(h, page);
+ }
+ spin_unlock(&hugetlb_lock);
+- if (mapping)
+- hugetlb_put_quota(mapping, 1);
++ hugepage_subpool_put_pages(spool, 1);
+ }
+
+ static void prep_new_huge_page(struct hstate *h, struct page *page, int nid)
+@@ -927,11 +1004,12 @@ static void return_unused_surplus_pages(struct hstate *h,
+ /*
+ * Determine if the huge page at addr within the vma has an associated
+ * reservation. Where it does not we will need to logically increase
+- * reservation and actually increase quota before an allocation can occur.
+- * Where any new reservation would be required the reservation change is
+- * prepared, but not committed. Once the page has been quota'd allocated
+- * an instantiated the change should be committed via vma_commit_reservation.
+- * No action is required on failure.
++ * reservation and actually increase subpool usage before an allocation
++ * can occur. Where any new reservation would be required the
++ * reservation change is prepared, but not committed. Once the page
++ * has been allocated from the subpool and instantiated the change should
++ * be committed via vma_commit_reservation. No action is required on
++ * failure.
+ */
+ static long vma_needs_reservation(struct hstate *h,
+ struct vm_area_struct *vma, unsigned long addr)
+@@ -980,24 +1058,24 @@ static void vma_commit_reservation(struct hstate *h,
+ static struct page *alloc_huge_page(struct vm_area_struct *vma,
+ unsigned long addr, int avoid_reserve)
+ {
++ struct hugepage_subpool *spool = subpool_vma(vma);
+ struct hstate *h = hstate_vma(vma);
+ struct page *page;
+- struct address_space *mapping = vma->vm_file->f_mapping;
+- struct inode *inode = mapping->host;
+ long chg;
+
+ /*
+- * Processes that did not create the mapping will have no reserves and
+- * will not have accounted against quota. Check that the quota can be
+- * made before satisfying the allocation
+- * MAP_NORESERVE mappings may also need pages and quota allocated
+- * if no reserve mapping overlaps.
++ * Processes that did not create the mapping will have no
++ * reserves and will not have accounted against subpool
++ * limit. Check that the subpool limit can be made before
++ * satisfying the allocation MAP_NORESERVE mappings may also
++ * need pages and subpool limit allocated allocated if no reserve
++ * mapping overlaps.
+ */
+ chg = vma_needs_reservation(h, vma, addr);
+ if (chg < 0)
+ return ERR_PTR(-VM_FAULT_OOM);
+ if (chg)
+- if (hugetlb_get_quota(inode->i_mapping, chg))
++ if (hugepage_subpool_get_pages(spool, chg))
+ return ERR_PTR(-VM_FAULT_SIGBUS);
+
+ spin_lock(&hugetlb_lock);
+@@ -1007,13 +1085,13 @@ static struct page *alloc_huge_page(struct vm_area_struct *vma,
+ if (!page) {
+ page = alloc_buddy_huge_page(h, vma, addr);
+ if (!page) {
+- hugetlb_put_quota(inode->i_mapping, chg);
++ hugepage_subpool_put_pages(spool, chg);
+ return ERR_PTR(-VM_FAULT_SIGBUS);
+ }
+ }
+
+ set_page_refcounted(page);
+- set_page_private(page, (unsigned long) mapping);
++ set_page_private(page, (unsigned long)spool);
+
+ vma_commit_reservation(h, vma, addr);
+
+@@ -1698,6 +1776,7 @@ static void hugetlb_vm_op_close(struct vm_area_struct *vma)
+ {
+ struct hstate *h = hstate_vma(vma);
+ struct resv_map *reservations = vma_resv_map(vma);
++ struct hugepage_subpool *spool = subpool_vma(vma);
+ unsigned long reserve;
+ unsigned long start;
+ unsigned long end;
+@@ -1713,7 +1792,7 @@ static void hugetlb_vm_op_close(struct vm_area_struct *vma)
+
+ if (reserve) {
+ hugetlb_acct_memory(h, -reserve);
+- hugetlb_put_quota(vma->vm_file->f_mapping, reserve);
++ hugepage_subpool_put_pages(spool, reserve);
+ }
+ }
+ }
+@@ -1910,7 +1989,7 @@ static int unmap_ref_private(struct mm_struct *mm, struct vm_area_struct *vma,
+ address = address & huge_page_mask(h);
+ pgoff = ((address - vma->vm_start) >> PAGE_SHIFT)
+ + (vma->vm_pgoff >> PAGE_SHIFT);
+- mapping = (struct address_space *)page_private(page);
++ mapping = vma->vm_file->f_dentry->d_inode->i_mapping;
+
+ vma_prio_tree_foreach(iter_vma, &iter, &mapping->i_mmap, pgoff, pgoff) {
+ /* Do not unmap the current VMA */
+@@ -2364,11 +2443,12 @@ int hugetlb_reserve_pages(struct inode *inode,
+ {
+ long ret, chg;
+ struct hstate *h = hstate_inode(inode);
++ struct hugepage_subpool *spool = subpool_inode(inode);
+
+ /*
+ * Only apply hugepage reservation if asked. At fault time, an
+ * attempt will be made for VM_NORESERVE to allocate a page
+- * and filesystem quota without using reserves
++ * without using reserves
+ */
+ if (acctflag & VM_NORESERVE)
+ return 0;
+@@ -2395,17 +2475,17 @@ int hugetlb_reserve_pages(struct inode *inode,
+ if (chg < 0)
+ return chg;
+
+- /* There must be enough filesystem quota for the mapping */
+- if (hugetlb_get_quota(inode->i_mapping, chg))
++ /* There must be enough pages in the subpool for the mapping */
++ if (hugepage_subpool_get_pages(spool, chg))
+ return -ENOSPC;
+
+ /*
+ * Check enough hugepages are available for the reservation.
+- * Hand back the quota if there are not
++ * Hand the pages back to the subpool if there are not
+ */
+ ret = hugetlb_acct_memory(h, chg);
+ if (ret < 0) {
+- hugetlb_put_quota(inode->i_mapping, chg);
++ hugepage_subpool_put_pages(spool, chg);
+ return ret;
+ }
+
+@@ -2429,11 +2509,12 @@ void hugetlb_unreserve_pages(struct inode *inode, long offset, long freed)
+ {
+ struct hstate *h = hstate_inode(inode);
+ long chg = region_truncate(&inode->i_mapping->private_list, offset);
++ struct hugepage_subpool *spool = subpool_inode(inode);
+
+ spin_lock(&inode->i_lock);
+ inode->i_blocks -= (blocks_per_huge_page(h) * freed);
+ spin_unlock(&inode->i_lock);
+
+- hugetlb_put_quota(inode->i_mapping, (chg - freed));
++ hugepage_subpool_put_pages(spool, (chg - freed));
+ hugetlb_acct_memory(h, -(chg - freed));
+ }
+diff --git a/mm/madvise.c b/mm/madvise.c
+index 35b1479..e405c5f 100644
+--- a/mm/madvise.c
++++ b/mm/madvise.c
+@@ -12,6 +12,7 @@
+ #include <linux/hugetlb.h>
+ #include <linux/sched.h>
+ #include <linux/ksm.h>
++#include <linux/file.h>
+
+ /*
+ * Any behaviour which results in changes to the vma->vm_flags needs to
+@@ -190,14 +191,16 @@ static long madvise_remove(struct vm_area_struct *vma,
+ struct address_space *mapping;
+ loff_t offset, endoff;
+ int error;
++ struct file *f;
+
+ *prev = NULL; /* tell sys_madvise we drop mmap_sem */
+
+ if (vma->vm_flags & (VM_LOCKED|VM_NONLINEAR|VM_HUGETLB))
+ return -EINVAL;
+
+- if (!vma->vm_file || !vma->vm_file->f_mapping
+- || !vma->vm_file->f_mapping->host) {
++ f = vma->vm_file;
++
++ if (!f || !f->f_mapping || !f->f_mapping->host) {
+ return -EINVAL;
+ }
+
+@@ -211,9 +214,16 @@ static long madvise_remove(struct vm_area_struct *vma,
+ endoff = (loff_t)(end - vma->vm_start - 1)
+ + ((loff_t)vma->vm_pgoff << PAGE_SHIFT);
+
+- /* vmtruncate_range needs to take i_mutex and i_alloc_sem */
++ /*
++ * vmtruncate_range may need to take i_mutex and i_alloc_sem.
++ * We need to explicitly grab a reference because the vma (and
++ * hence the vma's reference to the file) can go away as soon as
++ * we drop mmap_sem.
++ */
++ get_file(f);
+ up_read(¤t->mm->mmap_sem);
+ error = vmtruncate_range(mapping->host, offset, endoff);
++ fput(f);
+ down_read(¤t->mm->mmap_sem);
+ return error;
+ }
+diff --git a/mm/mempolicy.c b/mm/mempolicy.c
+index 3c6e3e2..a6563fb 100644
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -2259,7 +2259,7 @@ int mpol_to_str(char *buffer, int maxlen, struct mempolicy *pol, int no_context)
+ break;
+
+ default:
+- BUG();
++ return -EINVAL;
+ }
+
+ l = strlen(policy_types[mode]);
+diff --git a/mm/mmu_notifier.c b/mm/mmu_notifier.c
+index 7e33f2c..8aa875c 100644
+--- a/mm/mmu_notifier.c
++++ b/mm/mmu_notifier.c
+@@ -32,6 +32,24 @@
+ void __mmu_notifier_release(struct mm_struct *mm)
+ {
+ struct mmu_notifier *mn;
++ struct hlist_node *n;
++
++ /*
++ * RCU here will block mmu_notifier_unregister until
++ * ->release returns.
++ */
++ rcu_read_lock();
++ hlist_for_each_entry_rcu(mn, n, &mm->mmu_notifier_mm->list, hlist)
++ /*
++ * if ->release runs before mmu_notifier_unregister it
++ * must be handled as it's the only way for the driver
++ * to flush all existing sptes and stop the driver
++ * from establishing any more sptes before all the
++ * pages in the mm are freed.
++ */
++ if (mn->ops->release)
++ mn->ops->release(mn, mm);
++ rcu_read_unlock();
+
+ spin_lock(&mm->mmu_notifier_mm->lock);
+ while (unlikely(!hlist_empty(&mm->mmu_notifier_mm->list))) {
+@@ -45,23 +63,6 @@ void __mmu_notifier_release(struct mm_struct *mm)
+ * mmu_notifier_unregister to return.
+ */
+ hlist_del_init_rcu(&mn->hlist);
+- /*
+- * RCU here will block mmu_notifier_unregister until
+- * ->release returns.
+- */
+- rcu_read_lock();
+- spin_unlock(&mm->mmu_notifier_mm->lock);
+- /*
+- * if ->release runs before mmu_notifier_unregister it
+- * must be handled as it's the only way for the driver
+- * to flush all existing sptes and stop the driver
+- * from establishing any more sptes before all the
+- * pages in the mm are freed.
+- */
+- if (mn->ops->release)
+- mn->ops->release(mn, mm);
+- rcu_read_unlock();
+- spin_lock(&mm->mmu_notifier_mm->lock);
+ }
+ spin_unlock(&mm->mmu_notifier_mm->lock);
+
+@@ -263,16 +264,13 @@ void mmu_notifier_unregister(struct mmu_notifier *mn, struct mm_struct *mm)
+ {
+ BUG_ON(atomic_read(&mm->mm_count) <= 0);
+
+- spin_lock(&mm->mmu_notifier_mm->lock);
+ if (!hlist_unhashed(&mn->hlist)) {
+- hlist_del_rcu(&mn->hlist);
+-
+ /*
+ * RCU here will force exit_mmap to wait ->release to finish
+ * before freeing the pages.
+ */
+ rcu_read_lock();
+- spin_unlock(&mm->mmu_notifier_mm->lock);
++
+ /*
+ * exit_mmap will block in mmu_notifier_release to
+ * guarantee ->release is called before freeing the
+@@ -281,8 +279,11 @@ void mmu_notifier_unregister(struct mmu_notifier *mn, struct mm_struct *mm)
+ if (mn->ops->release)
+ mn->ops->release(mn, mm);
+ rcu_read_unlock();
+- } else
++
++ spin_lock(&mm->mmu_notifier_mm->lock);
++ hlist_del_rcu(&mn->hlist);
+ spin_unlock(&mm->mmu_notifier_mm->lock);
++ }
+
+ /*
+ * Wait any running method to finish, of course including
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 84a0705..46e2a29 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -1133,6 +1133,7 @@ int dev_open(struct net_device *dev)
+ /*
+ * ... and announce new interface.
+ */
++ add_device_randomness(dev->dev_addr, dev->addr_len);
+ call_netdevice_notifiers(NETDEV_UP, dev);
+ }
+
+@@ -4268,6 +4269,7 @@ int dev_set_mac_address(struct net_device *dev, struct sockaddr *sa)
+ err = ops->ndo_set_mac_address(dev, sa);
+ if (!err)
+ call_netdevice_notifiers(NETDEV_CHANGEADDR, dev);
++ add_device_randomness(dev->dev_addr, dev->addr_len);
+ return err;
+ }
+ EXPORT_SYMBOL(dev_set_mac_address);
+@@ -4871,6 +4873,7 @@ int register_netdevice(struct net_device *dev)
+ dev_init_scheduler(dev);
+ dev_hold(dev);
+ list_netdevice(dev);
++ add_device_randomness(dev->dev_addr, dev->addr_len);
+
+ /* Notify protocols, that a new device appeared. */
+ ret = call_netdevice_notifiers(NETDEV_REGISTER, dev);
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index d4fd895..9d70042 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -817,6 +817,7 @@ static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
+ goto errout;
+ send_addr_notify = 1;
+ modified = 1;
++ add_device_randomness(dev->dev_addr, dev->addr_len);
+ }
+
+ if (tb[IFLA_MTU]) {
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 025f924..72ff527 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -2989,6 +2989,8 @@ static void sock_rmem_free(struct sk_buff *skb)
+ */
+ int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
+ {
++ int len = skb->len;
++
+ if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
+ (unsigned)sk->sk_rcvbuf)
+ return -ENOMEM;
+@@ -3000,7 +3002,7 @@ int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
+
+ skb_queue_tail(&sk->sk_error_queue, skb);
+ if (!sock_flag(sk, SOCK_DEAD))
+- sk->sk_data_ready(sk, skb->len);
++ sk->sk_data_ready(sk, len);
+ return 0;
+ }
+ EXPORT_SYMBOL(sock_queue_err_skb);
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 6605e75..4538a34 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -1391,6 +1391,11 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
+ gfp_t gfp_mask;
+ long timeo;
+ int err;
++ int npages = (data_len + (PAGE_SIZE - 1)) >> PAGE_SHIFT;
++
++ err = -EMSGSIZE;
++ if (npages > MAX_SKB_FRAGS)
++ goto failure;
+
+ gfp_mask = sk->sk_allocation;
+ if (gfp_mask & __GFP_WAIT)
+@@ -1409,14 +1414,12 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
+ if (atomic_read(&sk->sk_wmem_alloc) < sk->sk_sndbuf) {
+ skb = alloc_skb(header_len, gfp_mask);
+ if (skb) {
+- int npages;
+ int i;
+
+ /* No pages, we're done... */
+ if (!data_len)
+ break;
+
+- npages = (data_len + (PAGE_SIZE - 1)) >> PAGE_SHIFT;
+ skb->truesize += data_len;
+ skb_shinfo(skb)->nr_frags = npages;
+ for (i = 0; i < npages; i++) {
+diff --git a/net/dccp/ccid.h b/net/dccp/ccid.h
+index facedd2..ab260b0 100644
+--- a/net/dccp/ccid.h
++++ b/net/dccp/ccid.h
+@@ -214,7 +214,7 @@ static inline int ccid_hc_rx_getsockopt(struct ccid *ccid, struct sock *sk,
+ u32 __user *optval, int __user *optlen)
+ {
+ int rc = -ENOPROTOOPT;
+- if (ccid->ccid_ops->ccid_hc_rx_getsockopt != NULL)
++ if (ccid != NULL && ccid->ccid_ops->ccid_hc_rx_getsockopt != NULL)
+ rc = ccid->ccid_ops->ccid_hc_rx_getsockopt(sk, optname, len,
+ optval, optlen);
+ return rc;
+@@ -225,7 +225,7 @@ static inline int ccid_hc_tx_getsockopt(struct ccid *ccid, struct sock *sk,
+ u32 __user *optval, int __user *optlen)
+ {
+ int rc = -ENOPROTOOPT;
+- if (ccid->ccid_ops->ccid_hc_tx_getsockopt != NULL)
++ if (ccid != NULL && ccid->ccid_ops->ccid_hc_tx_getsockopt != NULL)
+ rc = ccid->ccid_ops->ccid_hc_tx_getsockopt(sk, optname, len,
+ optval, optlen);
+ return rc;
+diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
+index 039cc1f..10f8f8d 100644
+--- a/net/ipv4/cipso_ipv4.c
++++ b/net/ipv4/cipso_ipv4.c
+@@ -1726,8 +1726,10 @@ int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option)
+ case CIPSO_V4_TAG_LOCAL:
+ /* This is a non-standard tag that we only allow for
+ * local connections, so if the incoming interface is
+- * not the loopback device drop the packet. */
+- if (!(skb->dev->flags & IFF_LOOPBACK)) {
++ * not the loopback device drop the packet. Further,
++ * there is no legitimate reason for setting this from
++ * userspace so reject it if skb is NULL. */
++ if (skb == NULL || !(skb->dev->flags & IFF_LOOPBACK)) {
+ err_offset = opt_iter;
+ goto validate_return_locked;
+ }
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index f095659..b9644d8 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -838,8 +838,7 @@ new_segment:
+ wait_for_sndbuf:
+ set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
+ wait_for_memory:
+- if (copied)
+- tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
++ tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
+
+ if ((err = sk_stream_wait_memory(sk, &timeo)) != 0)
+ goto do_error;
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index ce1ce82..db755c4 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -5239,7 +5239,9 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
+ if (tp->copied_seq == tp->rcv_nxt &&
+ len - tcp_header_len <= tp->ucopy.len) {
+ #ifdef CONFIG_NET_DMA
+- if (tcp_dma_try_early_copy(sk, skb, tcp_header_len)) {
++ if (tp->ucopy.task == current &&
++ sock_owned_by_user(sk) &&
++ tcp_dma_try_early_copy(sk, skb, tcp_header_len)) {
+ copied_early = 1;
+ eaten = 1;
+ }
+@@ -5632,6 +5634,8 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
+ goto discard;
+
+ if (th->syn) {
++ if (th->fin)
++ goto discard;
+ if (icsk->icsk_af_ops->conn_request(sk, skb) < 0)
+ return 1;
+
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index 6fc7961..6a4e832 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -406,6 +406,9 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
+ !icsk->icsk_backoff)
+ break;
+
++ if (sock_owned_by_user(sk))
++ break;
++
+ icsk->icsk_backoff--;
+ inet_csk(sk)->icsk_rto = __tcp_set_rto(tp) <<
+ icsk->icsk_backoff;
+@@ -420,11 +423,6 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
+ if (remaining) {
+ inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
+ remaining, TCP_RTO_MAX);
+- } else if (sock_owned_by_user(sk)) {
+- /* RTO revert clocked out retransmission,
+- * but socket is locked. Will defer. */
+- inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
+- HZ/20, TCP_RTO_MAX);
+ } else {
+ /* RTO revert clocked out retransmission.
+ * Will retransmit now */
+diff --git a/net/ipv4/xfrm4_mode_beet.c b/net/ipv4/xfrm4_mode_beet.c
+index 6341818..e3db3f9 100644
+--- a/net/ipv4/xfrm4_mode_beet.c
++++ b/net/ipv4/xfrm4_mode_beet.c
+@@ -110,10 +110,7 @@ static int xfrm4_beet_input(struct xfrm_state *x, struct sk_buff *skb)
+
+ skb_push(skb, sizeof(*iph));
+ skb_reset_network_header(skb);
+-
+- memmove(skb->data - skb->mac_len, skb_mac_header(skb),
+- skb->mac_len);
+- skb_set_mac_header(skb, -skb->mac_len);
++ skb_mac_header_rebuild(skb);
+
+ xfrm4_beet_make_header(skb);
+
+diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c
+index 3444f3b..5d1d1fd 100644
+--- a/net/ipv4/xfrm4_mode_tunnel.c
++++ b/net/ipv4/xfrm4_mode_tunnel.c
+@@ -65,7 +65,6 @@ static int xfrm4_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
+
+ static int xfrm4_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
+ {
+- const unsigned char *old_mac;
+ int err = -EINVAL;
+
+ if (XFRM_MODE_SKB_CB(skb)->protocol != IPPROTO_IPIP)
+@@ -83,10 +82,9 @@ static int xfrm4_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
+ if (!(x->props.flags & XFRM_STATE_NOECN))
+ ipip_ecn_decapsulate(skb);
+
+- old_mac = skb_mac_header(skb);
+- skb_set_mac_header(skb, -skb->mac_len);
+- memmove(skb_mac_header(skb), old_mac, skb->mac_len);
+ skb_reset_network_header(skb);
++ skb_mac_header_rebuild(skb);
++
+ err = 0;
+
+ out:
+diff --git a/net/ipv6/xfrm6_mode_beet.c b/net/ipv6/xfrm6_mode_beet.c
+index bbd48b1..6cc7a45 100644
+--- a/net/ipv6/xfrm6_mode_beet.c
++++ b/net/ipv6/xfrm6_mode_beet.c
+@@ -82,7 +82,6 @@ static int xfrm6_beet_output(struct xfrm_state *x, struct sk_buff *skb)
+ static int xfrm6_beet_input(struct xfrm_state *x, struct sk_buff *skb)
+ {
+ struct ipv6hdr *ip6h;
+- const unsigned char *old_mac;
+ int size = sizeof(struct ipv6hdr);
+ int err;
+
+@@ -92,10 +91,7 @@ static int xfrm6_beet_input(struct xfrm_state *x, struct sk_buff *skb)
+
+ __skb_push(skb, size);
+ skb_reset_network_header(skb);
+-
+- old_mac = skb_mac_header(skb);
+- skb_set_mac_header(skb, -skb->mac_len);
+- memmove(skb_mac_header(skb), old_mac, skb->mac_len);
++ skb_mac_header_rebuild(skb);
+
+ xfrm6_beet_make_header(skb);
+
+diff --git a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c
+index 3927832..672c0da 100644
+--- a/net/ipv6/xfrm6_mode_tunnel.c
++++ b/net/ipv6/xfrm6_mode_tunnel.c
+@@ -61,7 +61,6 @@ static int xfrm6_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
+ static int xfrm6_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
+ {
+ int err = -EINVAL;
+- const unsigned char *old_mac;
+
+ if (XFRM_MODE_SKB_CB(skb)->protocol != IPPROTO_IPV6)
+ goto out;
+@@ -78,10 +77,9 @@ static int xfrm6_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
+ if (!(x->props.flags & XFRM_STATE_NOECN))
+ ipip6_ecn_decapsulate(skb);
+
+- old_mac = skb_mac_header(skb);
+- skb_set_mac_header(skb, -skb->mac_len);
+- memmove(skb_mac_header(skb), old_mac, skb->mac_len);
+ skb_reset_network_header(skb);
++ skb_mac_header_rebuild(skb);
++
+ err = 0;
+
+ out:
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index 5a7dcdf..fc91ff6 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -821,12 +821,19 @@ int netlink_attachskb(struct sock *sk, struct sk_buff *skb,
+ return 0;
+ }
+
+-int netlink_sendskb(struct sock *sk, struct sk_buff *skb)
++static int __netlink_sendskb(struct sock *sk, struct sk_buff *skb)
+ {
+ int len = skb->len;
+
+ skb_queue_tail(&sk->sk_receive_queue, skb);
+ sk->sk_data_ready(sk, len);
++ return len;
++}
++
++int netlink_sendskb(struct sock *sk, struct sk_buff *skb)
++{
++ int len = __netlink_sendskb(sk, skb);
++
+ sock_put(sk);
+ return len;
+ }
+@@ -951,8 +958,7 @@ static inline int netlink_broadcast_deliver(struct sock *sk,
+ if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf &&
+ !test_bit(0, &nlk->state)) {
+ skb_set_owner_r(skb, sk);
+- skb_queue_tail(&sk->sk_receive_queue, skb);
+- sk->sk_data_ready(sk, skb->len);
++ __netlink_sendskb(sk, skb);
+ return atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf;
+ }
+ return -1;
+@@ -1665,10 +1671,8 @@ static int netlink_dump(struct sock *sk)
+
+ if (sk_filter(sk, skb))
+ kfree_skb(skb);
+- else {
+- skb_queue_tail(&sk->sk_receive_queue, skb);
+- sk->sk_data_ready(sk, skb->len);
+- }
++ else
++ __netlink_sendskb(sk, skb);
+ return 0;
+ }
+
+@@ -1680,10 +1684,8 @@ static int netlink_dump(struct sock *sk)
+
+ if (sk_filter(sk, skb))
+ kfree_skb(skb);
+- else {
+- skb_queue_tail(&sk->sk_receive_queue, skb);
+- sk->sk_data_ready(sk, skb->len);
+- }
++ else
++ __netlink_sendskb(sk, skb);
+
+ if (cb->done)
+ cb->done(cb);
+diff --git a/net/phonet/pep.c b/net/phonet/pep.c
+index 9cdd35e..7481d70 100644
+--- a/net/phonet/pep.c
++++ b/net/phonet/pep.c
+@@ -851,6 +851,9 @@ static int pep_sendmsg(struct kiocb *iocb, struct sock *sk,
+ int flags = msg->msg_flags;
+ int err, done;
+
++ if (len > 65535)
++ return -EMSGSIZE;
++
+ if (msg->msg_flags & MSG_OOB || !(msg->msg_flags & MSG_EOR))
+ return -EOPNOTSUPP;
+
+diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
+index 7d188bc..523efbb 100644
+--- a/net/rose/af_rose.c
++++ b/net/rose/af_rose.c
+@@ -983,7 +983,7 @@ int rose_rx_call_request(struct sk_buff *skb, struct net_device *dev, struct ros
+ struct sock *make;
+ struct rose_sock *make_rose;
+ struct rose_facilities_struct facilities;
+- int n, len;
++ int n;
+
+ skb->sk = NULL; /* Initially we don't know who it's for */
+
+@@ -992,9 +992,9 @@ int rose_rx_call_request(struct sk_buff *skb, struct net_device *dev, struct ros
+ */
+ memset(&facilities, 0x00, sizeof(struct rose_facilities_struct));
+
+- len = (((skb->data[3] >> 4) & 0x0F) + 1) >> 1;
+- len += (((skb->data[3] >> 0) & 0x0F) + 1) >> 1;
+- if (!rose_parse_facilities(skb->data + len + 4, &facilities)) {
++ if (!rose_parse_facilities(skb->data + ROSE_CALL_REQ_FACILITIES_OFF,
++ skb->len - ROSE_CALL_REQ_FACILITIES_OFF,
++ &facilities)) {
+ rose_transmit_clear_request(neigh, lci, ROSE_INVALID_FACILITY, 76);
+ return 0;
+ }
+diff --git a/net/rose/rose_loopback.c b/net/rose/rose_loopback.c
+index 114df6e..37965b8 100644
+--- a/net/rose/rose_loopback.c
++++ b/net/rose/rose_loopback.c
+@@ -72,9 +72,20 @@ static void rose_loopback_timer(unsigned long param)
+ unsigned int lci_i, lci_o;
+
+ while ((skb = skb_dequeue(&loopback_queue)) != NULL) {
++ if (skb->len < ROSE_MIN_LEN) {
++ kfree_skb(skb);
++ continue;
++ }
+ lci_i = ((skb->data[0] << 8) & 0xF00) + ((skb->data[1] << 0) & 0x0FF);
+ frametype = skb->data[2];
+- dest = (rose_address *)(skb->data + 4);
++ if (frametype == ROSE_CALL_REQUEST &&
++ (skb->len <= ROSE_CALL_REQ_FACILITIES_OFF ||
++ skb->data[ROSE_CALL_REQ_ADDR_LEN_OFF] !=
++ ROSE_CALL_REQ_ADDR_LEN_VAL)) {
++ kfree_skb(skb);
++ continue;
++ }
++ dest = (rose_address *)(skb->data + ROSE_CALL_REQ_DEST_ADDR_OFF);
+ lci_o = 0xFFF - lci_i;
+
+ skb_reset_transport_header(skb);
+diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
+index 08230fa..1646b25 100644
+--- a/net/rose/rose_route.c
++++ b/net/rose/rose_route.c
+@@ -852,7 +852,7 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25)
+ unsigned int lci, new_lci;
+ unsigned char cause, diagnostic;
+ struct net_device *dev;
+- int len, res = 0;
++ int res = 0;
+ char buf[11];
+
+ #if 0
+@@ -860,10 +860,17 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25)
+ return res;
+ #endif
+
++ if (skb->len < ROSE_MIN_LEN)
++ return res;
+ frametype = skb->data[2];
+ lci = ((skb->data[0] << 8) & 0xF00) + ((skb->data[1] << 0) & 0x0FF);
+- src_addr = (rose_address *)(skb->data + 9);
+- dest_addr = (rose_address *)(skb->data + 4);
++ if (frametype == ROSE_CALL_REQUEST &&
++ (skb->len <= ROSE_CALL_REQ_FACILITIES_OFF ||
++ skb->data[ROSE_CALL_REQ_ADDR_LEN_OFF] !=
++ ROSE_CALL_REQ_ADDR_LEN_VAL))
++ return res;
++ src_addr = (rose_address *)(skb->data + ROSE_CALL_REQ_SRC_ADDR_OFF);
++ dest_addr = (rose_address *)(skb->data + ROSE_CALL_REQ_DEST_ADDR_OFF);
+
+ spin_lock_bh(&rose_neigh_list_lock);
+ spin_lock_bh(&rose_route_list_lock);
+@@ -1001,12 +1008,11 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25)
+ goto out;
+ }
+
+- len = (((skb->data[3] >> 4) & 0x0F) + 1) >> 1;
+- len += (((skb->data[3] >> 0) & 0x0F) + 1) >> 1;
+-
+ memset(&facilities, 0x00, sizeof(struct rose_facilities_struct));
+
+- if (!rose_parse_facilities(skb->data + len + 4, &facilities)) {
++ if (!rose_parse_facilities(skb->data + ROSE_CALL_REQ_FACILITIES_OFF,
++ skb->len - ROSE_CALL_REQ_FACILITIES_OFF,
++ &facilities)) {
+ rose_transmit_clear_request(rose_neigh, lci, ROSE_INVALID_FACILITY, 76);
+ goto out;
+ }
+diff --git a/net/rose/rose_subr.c b/net/rose/rose_subr.c
+index 07bca7d..32e5c9f 100644
+--- a/net/rose/rose_subr.c
++++ b/net/rose/rose_subr.c
+@@ -141,7 +141,7 @@ void rose_write_internal(struct sock *sk, int frametype)
+ *dptr++ = ROSE_GFI | lci1;
+ *dptr++ = lci2;
+ *dptr++ = frametype;
+- *dptr++ = 0xAA;
++ *dptr++ = ROSE_CALL_REQ_ADDR_LEN_VAL;
+ memcpy(dptr, &rose->dest_addr, ROSE_ADDR_LEN);
+ dptr += ROSE_ADDR_LEN;
+ memcpy(dptr, &rose->source_addr, ROSE_ADDR_LEN);
+@@ -245,12 +245,16 @@ static int rose_parse_national(unsigned char *p, struct rose_facilities_struct *
+ do {
+ switch (*p & 0xC0) {
+ case 0x00:
++ if (len < 2)
++ return -1;
+ p += 2;
+ n += 2;
+ len -= 2;
+ break;
+
+ case 0x40:
++ if (len < 3)
++ return -1;
+ if (*p == FAC_NATIONAL_RAND)
+ facilities->rand = ((p[1] << 8) & 0xFF00) + ((p[2] << 0) & 0x00FF);
+ p += 3;
+@@ -259,32 +263,48 @@ static int rose_parse_national(unsigned char *p, struct rose_facilities_struct *
+ break;
+
+ case 0x80:
++ if (len < 4)
++ return -1;
+ p += 4;
+ n += 4;
+ len -= 4;
+ break;
+
+ case 0xC0:
++ if (len < 2)
++ return -1;
+ l = p[1];
++ if (len < 2 + l)
++ return -1;
+ if (*p == FAC_NATIONAL_DEST_DIGI) {
+ if (!fac_national_digis_received) {
++ if (l < AX25_ADDR_LEN)
++ return -1;
+ memcpy(&facilities->source_digis[0], p + 2, AX25_ADDR_LEN);
+ facilities->source_ndigis = 1;
+ }
+ }
+ else if (*p == FAC_NATIONAL_SRC_DIGI) {
+ if (!fac_national_digis_received) {
++ if (l < AX25_ADDR_LEN)
++ return -1;
+ memcpy(&facilities->dest_digis[0], p + 2, AX25_ADDR_LEN);
+ facilities->dest_ndigis = 1;
+ }
+ }
+ else if (*p == FAC_NATIONAL_FAIL_CALL) {
++ if (l < AX25_ADDR_LEN)
++ return -1;
+ memcpy(&facilities->fail_call, p + 2, AX25_ADDR_LEN);
+ }
+ else if (*p == FAC_NATIONAL_FAIL_ADD) {
++ if (l < 1 + ROSE_ADDR_LEN)
++ return -1;
+ memcpy(&facilities->fail_addr, p + 3, ROSE_ADDR_LEN);
+ }
+ else if (*p == FAC_NATIONAL_DIGIS) {
++ if (l % AX25_ADDR_LEN)
++ return -1;
+ fac_national_digis_received = 1;
+ facilities->source_ndigis = 0;
+ facilities->dest_ndigis = 0;
+@@ -318,24 +338,32 @@ static int rose_parse_ccitt(unsigned char *p, struct rose_facilities_struct *fac
+ do {
+ switch (*p & 0xC0) {
+ case 0x00:
++ if (len < 2)
++ return -1;
+ p += 2;
+ n += 2;
+ len -= 2;
+ break;
+
+ case 0x40:
++ if (len < 3)
++ return -1;
+ p += 3;
+ n += 3;
+ len -= 3;
+ break;
+
+ case 0x80:
++ if (len < 4)
++ return -1;
+ p += 4;
+ n += 4;
+ len -= 4;
+ break;
+
+ case 0xC0:
++ if (len < 2)
++ return -1;
+ l = p[1];
+
+ /* Prevent overflows*/
+@@ -364,49 +392,44 @@ static int rose_parse_ccitt(unsigned char *p, struct rose_facilities_struct *fac
+ return n;
+ }
+
+-int rose_parse_facilities(unsigned char *p,
++int rose_parse_facilities(unsigned char *p, unsigned packet_len,
+ struct rose_facilities_struct *facilities)
+ {
+ int facilities_len, len;
+
+ facilities_len = *p++;
+
+- if (facilities_len == 0)
++ if (facilities_len == 0 || (unsigned)facilities_len > packet_len)
+ return 0;
+
+- while (facilities_len > 0) {
+- if (*p == 0x00) {
+- facilities_len--;
+- p++;
+-
+- switch (*p) {
+- case FAC_NATIONAL: /* National */
+- len = rose_parse_national(p + 1, facilities, facilities_len - 1);
+- if (len < 0)
+- return 0;
+- facilities_len -= len + 1;
+- p += len + 1;
+- break;
+-
+- case FAC_CCITT: /* CCITT */
+- len = rose_parse_ccitt(p + 1, facilities, facilities_len - 1);
+- if (len < 0)
+- return 0;
+- facilities_len -= len + 1;
+- p += len + 1;
+- break;
+-
+- default:
+- printk(KERN_DEBUG "ROSE: rose_parse_facilities - unknown facilities family %02X\n", *p);
+- facilities_len--;
+- p++;
+- break;
+- }
+- } else
+- break; /* Error in facilities format */
++ while (facilities_len >= 3 && *p == 0x00) {
++ facilities_len--;
++ p++;
++
++ switch (*p) {
++ case FAC_NATIONAL: /* National */
++ len = rose_parse_national(p + 1, facilities, facilities_len - 1);
++ break;
++
++ case FAC_CCITT: /* CCITT */
++ len = rose_parse_ccitt(p + 1, facilities, facilities_len - 1);
++ break;
++
++ default:
++ printk(KERN_DEBUG "ROSE: rose_parse_facilities - unknown facilities family %02X\n", *p);
++ len = 1;
++ break;
++ }
++
++ if (len < 0)
++ return 0;
++ if (WARN_ON(len >= facilities_len))
++ return 0;
++ facilities_len -= len + 1;
++ p += len + 1;
+ }
+
+- return 1;
++ return facilities_len == 0;
+ }
+
+ static int rose_create_facilities(unsigned char *buffer, struct rose_sock *rose)
+diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c
+index 40408d5..bf98414 100644
+--- a/net/sched/sch_gred.c
++++ b/net/sched/sch_gred.c
+@@ -544,11 +544,8 @@ static int gred_dump(struct Qdisc *sch, struct sk_buff *skb)
+ opt.packets = q->packetsin;
+ opt.bytesin = q->bytesin;
+
+- if (gred_wred_mode(table)) {
+- q->parms.qidlestart =
+- table->tab[table->def]->parms.qidlestart;
+- q->parms.qavg = table->tab[table->def]->parms.qavg;
+- }
++ if (gred_wred_mode(table))
++ gred_load_wred_set(table, q);
+
+ opt.qave = red_calc_qavg(&q->parms, q->parms.qavg);
+
+diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
+index 2b88295..0ae345a 100644
+--- a/net/sched/sch_netem.c
++++ b/net/sched/sch_netem.c
+@@ -199,12 +199,10 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
+ * do it now in software before we mangle it.
+ */
+ if (q->corrupt && q->corrupt >= get_crandom(&q->corrupt_cor)) {
+- if (!(skb = skb_unshare(skb, GFP_ATOMIC))
+- || (skb->ip_summed == CHECKSUM_PARTIAL
+- && skb_checksum_help(skb))) {
+- sch->qstats.drops++;
+- return NET_XMIT_DROP;
+- }
++ if (!(skb = skb_unshare(skb, GFP_ATOMIC)) ||
++ (skb->ip_summed == CHECKSUM_PARTIAL &&
++ skb_checksum_help(skb)))
++ return qdisc_drop(skb, sch);
+
+ skb->data[net_random() % skb_headlen(skb)] ^= 1<<(net_random() % 8);
+ }
+diff --git a/net/sctp/input.c b/net/sctp/input.c
+index 254afea..e8e73f1 100644
+--- a/net/sctp/input.c
++++ b/net/sctp/input.c
+@@ -739,15 +739,12 @@ static void __sctp_unhash_endpoint(struct sctp_endpoint *ep)
+
+ epb = &ep->base;
+
+- if (hlist_unhashed(&epb->node))
+- return;
+-
+ epb->hashent = sctp_ep_hashfn(epb->bind_addr.port);
+
+ head = &sctp_ep_hashtable[epb->hashent];
+
+ sctp_write_lock(&head->lock);
+- __hlist_del(&epb->node);
++ hlist_del_init(&epb->node);
+ sctp_write_unlock(&head->lock);
+ }
+
+@@ -828,7 +825,7 @@ static void __sctp_unhash_established(struct sctp_association *asoc)
+ head = &sctp_assoc_hashtable[epb->hashent];
+
+ sctp_write_lock(&head->lock);
+- __hlist_del(&epb->node);
++ hlist_del_init(&epb->node);
+ sctp_write_unlock(&head->lock);
+ }
+
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 3a95fcb..1f9843e 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -1142,8 +1142,14 @@ out_free:
+ SCTP_DEBUG_PRINTK("About to exit __sctp_connect() free asoc: %p"
+ " kaddrs: %p err: %d\n",
+ asoc, kaddrs, err);
+- if (asoc)
++ if (asoc) {
++ /* sctp_primitive_ASSOCIATE may have added this association
++ * To the hash table, try to unhash it, just in case, its a noop
++ * if it wasn't hashed so we're safe
++ */
++ sctp_unhash_established(asoc);
+ sctp_association_free(asoc);
++ }
+ return err;
+ }
+
+@@ -1851,8 +1857,10 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
+ goto out_unlock;
+
+ out_free:
+- if (new_asoc)
++ if (new_asoc) {
++ sctp_unhash_established(asoc);
+ sctp_association_free(asoc);
++ }
+ out_unlock:
+ sctp_release_sock(sk);
+
+diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
+index 25f7801..e3fea46 100644
+--- a/net/sunrpc/cache.c
++++ b/net/sunrpc/cache.c
+@@ -719,6 +719,8 @@ static ssize_t cache_do_downcall(char *kaddr, const char __user *buf,
+ {
+ ssize_t ret;
+
++ if (count == 0)
++ return -EINVAL;
+ if (copy_from_user(kaddr, buf, count))
+ return -EFAULT;
+ kaddr[count] = '\0';
+diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
+index ac94477..9b3941d 100644
+--- a/net/sunrpc/sched.c
++++ b/net/sunrpc/sched.c
+@@ -485,14 +485,18 @@ EXPORT_SYMBOL_GPL(rpc_wake_up_next);
+ */
+ void rpc_wake_up(struct rpc_wait_queue *queue)
+ {
+- struct rpc_task *task, *next;
+ struct list_head *head;
+
+ spin_lock_bh(&queue->lock);
+ head = &queue->tasks[queue->maxpriority];
+ for (;;) {
+- list_for_each_entry_safe(task, next, head, u.tk_wait.list)
++ while (!list_empty(head)) {
++ struct rpc_task *task;
++ task = list_first_entry(head,
++ struct rpc_task,
++ u.tk_wait.list);
+ rpc_wake_up_task_queue_locked(queue, task);
++ }
+ if (head == &queue->tasks[0])
+ break;
+ head--;
+@@ -510,13 +514,16 @@ EXPORT_SYMBOL_GPL(rpc_wake_up);
+ */
+ void rpc_wake_up_status(struct rpc_wait_queue *queue, int status)
+ {
+- struct rpc_task *task, *next;
+ struct list_head *head;
+
+ spin_lock_bh(&queue->lock);
+ head = &queue->tasks[queue->maxpriority];
+ for (;;) {
+- list_for_each_entry_safe(task, next, head, u.tk_wait.list) {
++ while (!list_empty(head)) {
++ struct rpc_task *task;
++ task = list_first_entry(head,
++ struct rpc_task,
++ u.tk_wait.list);
+ task->tk_status = status;
+ rpc_wake_up_task_queue_locked(queue, task);
+ }
+diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
+index 314320a..8d72660 100644
+--- a/net/sunrpc/svc_xprt.c
++++ b/net/sunrpc/svc_xprt.c
+@@ -304,7 +304,6 @@ static void svc_thread_dequeue(struct svc_pool *pool, struct svc_rqst *rqstp)
+ */
+ void svc_xprt_enqueue(struct svc_xprt *xprt)
+ {
+- struct svc_serv *serv = xprt->xpt_server;
+ struct svc_pool *pool;
+ struct svc_rqst *rqstp;
+ int cpu;
+@@ -381,8 +380,6 @@ void svc_xprt_enqueue(struct svc_xprt *xprt)
+ rqstp, rqstp->rq_xprt);
+ rqstp->rq_xprt = xprt;
+ svc_xprt_get(xprt);
+- rqstp->rq_reserved = serv->sv_max_mesg;
+- atomic_add(rqstp->rq_reserved, &xprt->xpt_reserved);
+ rqstp->rq_waking = 1;
+ pool->sp_nwaking++;
+ pool->sp_stats.threads_woken++;
+@@ -667,8 +664,6 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
+ if (xprt) {
+ rqstp->rq_xprt = xprt;
+ svc_xprt_get(xprt);
+- rqstp->rq_reserved = serv->sv_max_mesg;
+- atomic_add(rqstp->rq_reserved, &xprt->xpt_reserved);
+ } else {
+ /* No data pending. Go to sleep */
+ svc_thread_enqueue(pool, rqstp);
+@@ -758,6 +753,8 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
+ } else
+ len = xprt->xpt_ops->xpo_recvfrom(rqstp);
+ dprintk("svc: got len=%d\n", len);
++ rqstp->rq_reserved = serv->sv_max_mesg;
++ atomic_add(rqstp->rq_reserved, &xprt->xpt_reserved);
+ }
+
+ /* No data, incomplete (TCP) read, or accept() */
+@@ -811,7 +808,8 @@ int svc_send(struct svc_rqst *rqstp)
+
+ /* Grab mutex to serialize outgoing data. */
+ mutex_lock(&xprt->xpt_mutex);
+- if (test_bit(XPT_DEAD, &xprt->xpt_flags))
++ if (test_bit(XPT_DEAD, &xprt->xpt_flags)
++ || test_bit(XPT_CLOSE, &xprt->xpt_flags))
+ len = -ENOTCONN;
+ else
+ len = xprt->xpt_ops->xpo_sendto(rqstp);
+diff --git a/net/wanrouter/wanmain.c b/net/wanrouter/wanmain.c
+index 258daa8..0d8380a 100644
+--- a/net/wanrouter/wanmain.c
++++ b/net/wanrouter/wanmain.c
+@@ -603,36 +603,31 @@ static int wanrouter_device_new_if(struct wan_device *wandev,
+ * successfully, add it to the interface list.
+ */
+
+- if (dev->name == NULL) {
+- err = -EINVAL;
+- } else {
++#ifdef WANDEBUG
++ printk(KERN_INFO "%s: registering interface %s...\n",
++ wanrouter_modname, dev->name);
++#endif
+
+- #ifdef WANDEBUG
+- printk(KERN_INFO "%s: registering interface %s...\n",
+- wanrouter_modname, dev->name);
+- #endif
+-
+- err = register_netdev(dev);
+- if (!err) {
+- struct net_device *slave = NULL;
+- unsigned long smp_flags=0;
+-
+- lock_adapter_irq(&wandev->lock, &smp_flags);
+-
+- if (wandev->dev == NULL) {
+- wandev->dev = dev;
+- } else {
+- for (slave=wandev->dev;
+- DEV_TO_SLAVE(slave);
+- slave = DEV_TO_SLAVE(slave))
+- DEV_TO_SLAVE(slave) = dev;
+- }
+- ++wandev->ndev;
+-
+- unlock_adapter_irq(&wandev->lock, &smp_flags);
+- err = 0; /* done !!! */
+- goto out;
++ err = register_netdev(dev);
++ if (!err) {
++ struct net_device *slave = NULL;
++ unsigned long smp_flags=0;
++
++ lock_adapter_irq(&wandev->lock, &smp_flags);
++
++ if (wandev->dev == NULL) {
++ wandev->dev = dev;
++ } else {
++ for (slave=wandev->dev;
++ DEV_TO_SLAVE(slave);
++ slave = DEV_TO_SLAVE(slave))
++ DEV_TO_SLAVE(slave) = dev;
+ }
++ ++wandev->ndev;
++
++ unlock_adapter_irq(&wandev->lock, &smp_flags);
++ err = 0; /* done !!! */
++ goto out;
+ }
+ if (wandev->del_if)
+ wandev->del_if(wandev, dev);
+diff --git a/security/commoncap.c b/security/commoncap.c
+index fe30751..ee9d623 100644
+--- a/security/commoncap.c
++++ b/security/commoncap.c
+@@ -27,6 +27,7 @@
+ #include <linux/sched.h>
+ #include <linux/prctl.h>
+ #include <linux/securebits.h>
++#include <linux/personality.h>
+
+ /*
+ * If a non-root user executes a setuid-root binary in
+@@ -511,6 +512,11 @@ int cap_bprm_set_creds(struct linux_binprm *bprm)
+ }
+ skip:
+
++ /* if we have fs caps, clear dangerous personality flags */
++ if (!cap_issubset(new->cap_permitted, old->cap_permitted))
++ bprm->per_clear |= PER_CLEAR_ON_SETID;
++
++
+ /* Don't let someone trace a set[ug]id/setpcap binary with the revised
+ * credentials unless they have the appropriate permit
+ */
+diff --git a/sound/drivers/mpu401/mpu401_uart.c b/sound/drivers/mpu401/mpu401_uart.c
+index 2af0999..74f5a3d 100644
+--- a/sound/drivers/mpu401/mpu401_uart.c
++++ b/sound/drivers/mpu401/mpu401_uart.c
+@@ -554,6 +554,7 @@ int snd_mpu401_uart_new(struct snd_card *card, int device,
+ spin_lock_init(&mpu->output_lock);
+ spin_lock_init(&mpu->timer_lock);
+ mpu->hardware = hardware;
++ mpu->irq = -1;
+ if (! (info_flags & MPU401_INFO_INTEGRATED)) {
+ int res_size = hardware == MPU401_HW_PC98II ? 4 : 2;
+ mpu->res = request_region(port, res_size, "MPU401 UART");
+diff --git a/sound/pci/echoaudio/echoaudio_dsp.c b/sound/pci/echoaudio/echoaudio_dsp.c
+index 4df51ef..5d14b7a 100644
+--- a/sound/pci/echoaudio/echoaudio_dsp.c
++++ b/sound/pci/echoaudio/echoaudio_dsp.c
+@@ -474,7 +474,7 @@ static int load_firmware(struct echoaudio *chip)
+ const struct firmware *fw;
+ int box_type, err;
+
+- if (snd_BUG_ON(!chip->dsp_code_to_load || !chip->comm_page))
++ if (snd_BUG_ON(!chip->comm_page))
+ return -EPERM;
+
+ /* See if the ASIC is present and working - only if the DSP is already loaded */
+diff --git a/sound/pci/hda/hda_proc.c b/sound/pci/hda/hda_proc.c
+index 2b3d859..9294d40 100644
+--- a/sound/pci/hda/hda_proc.c
++++ b/sound/pci/hda/hda_proc.c
+@@ -340,7 +340,7 @@ static void print_digital_conv(struct snd_info_buffer *buffer,
+ if (digi1 & AC_DIG1_EMPHASIS)
+ snd_iprintf(buffer, " Preemphasis");
+ if (digi1 & AC_DIG1_COPYRIGHT)
+- snd_iprintf(buffer, " Copyright");
++ snd_iprintf(buffer, " Non-Copyright");
+ if (digi1 & AC_DIG1_NONAUDIO)
+ snd_iprintf(buffer, " Non-Audio");
+ if (digi1 & AC_DIG1_PROFESSIONAL)
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index 4f3434f..82b6fdc 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -43,6 +43,8 @@
+ #include <linux/swap.h>
+ #include <linux/bitops.h>
+ #include <linux/spinlock.h>
++#include <linux/namei.h>
++#include <linux/fs.h>
+
+ #include <asm/processor.h>
+ #include <asm/io.h>
+@@ -575,12 +577,76 @@ out:
+ return r;
+ }
+
++/*
++ * We want to test whether the caller has been granted permissions to
++ * use this device. To be able to configure and control the device,
++ * the user needs access to PCI configuration space and BAR resources.
++ * These are accessed through PCI sysfs. PCI config space is often
++ * passed to the process calling this ioctl via file descriptor, so we
++ * can't rely on access to that file. We can check for permissions
++ * on each of the BAR resource files, which is a pretty clear
++ * indicator that the user has been granted access to the device.
++ */
++static int probe_sysfs_permissions(struct pci_dev *dev)
++{
++#ifdef CONFIG_SYSFS
++ int i;
++ bool bar_found = false;
++
++ for (i = PCI_STD_RESOURCES; i <= PCI_STD_RESOURCE_END; i++) {
++ char *kpath, *syspath;
++ struct path path;
++ struct inode *inode;
++ int r;
++
++ if (!pci_resource_len(dev, i))
++ continue;
++
++ kpath = kobject_get_path(&dev->dev.kobj, GFP_KERNEL);
++ if (!kpath)
++ return -ENOMEM;
++
++ /* Per sysfs-rules, sysfs is always at /sys */
++ syspath = kasprintf(GFP_KERNEL, "/sys%s/resource%d", kpath, i);
++ kfree(kpath);
++ if (!syspath)
++ return -ENOMEM;
++
++ r = kern_path(syspath, LOOKUP_FOLLOW, &path);
++ kfree(syspath);
++ if (r)
++ return r;
++
++ inode = path.dentry->d_inode;
++
++ r = inode_permission(inode, MAY_READ | MAY_WRITE | MAY_ACCESS);
++ path_put(&path);
++ if (r)
++ return r;
++
++ bar_found = true;
++ }
++
++ /* If no resources, probably something special */
++ if (!bar_found)
++ return -EPERM;
++
++ return 0;
++#else
++ return -EINVAL; /* No way to control the device without sysfs */
++#endif
++}
++
+ static int kvm_vm_ioctl_assign_device(struct kvm *kvm,
+ struct kvm_assigned_pci_dev *assigned_dev)
+ {
+ int r = 0;
+ struct kvm_assigned_dev_kernel *match;
+ struct pci_dev *dev;
++ u8 header_type;
++
++ if (!(assigned_dev->flags & KVM_DEV_ASSIGN_ENABLE_IOMMU))
++ return -EINVAL;
+
+ down_read(&kvm->slots_lock);
+ mutex_lock(&kvm->lock);
+@@ -607,6 +673,18 @@ static int kvm_vm_ioctl_assign_device(struct kvm *kvm,
+ r = -EINVAL;
+ goto out_free;
+ }
++
++ /* Don't allow bridges to be assigned */
++ pci_read_config_byte(dev, PCI_HEADER_TYPE, &header_type);
++ if ((header_type & PCI_HEADER_TYPE) != PCI_HEADER_TYPE_NORMAL) {
++ r = -EPERM;
++ goto out_put;
++ }
++
++ r = probe_sysfs_permissions(dev);
++ if (r)
++ goto out_put;
++
+ if (pci_enable_device(dev)) {
+ printk(KERN_INFO "%s: Could not enable PCI device\n", __func__);
+ r = -EBUSY;
+@@ -635,16 +713,14 @@ static int kvm_vm_ioctl_assign_device(struct kvm *kvm,
+
+ list_add(&match->list, &kvm->arch.assigned_dev_head);
+
+- if (assigned_dev->flags & KVM_DEV_ASSIGN_ENABLE_IOMMU) {
+- if (!kvm->arch.iommu_domain) {
+- r = kvm_iommu_map_guest(kvm);
+- if (r)
+- goto out_list_del;
+- }
+- r = kvm_assign_device(kvm, match);
++ if (!kvm->arch.iommu_domain) {
++ r = kvm_iommu_map_guest(kvm);
+ if (r)
+ goto out_list_del;
+ }
++ r = kvm_assign_device(kvm, match);
++ if (r)
++ goto out_list_del;
+
+ out:
+ mutex_unlock(&kvm->lock);
+@@ -683,8 +759,7 @@ static int kvm_vm_ioctl_deassign_device(struct kvm *kvm,
+ goto out;
+ }
+
+- if (match->flags & KVM_DEV_ASSIGN_ENABLE_IOMMU)
+- kvm_deassign_device(kvm, match);
++ kvm_deassign_device(kvm, match);
+
+ kvm_free_assigned_device(kvm, match);
+
+@@ -1782,6 +1857,10 @@ static int kvm_vm_ioctl_create_vcpu(struct kvm *kvm, u32 id)
+ return r;
+
+ mutex_lock(&kvm->lock);
++ if (!kvm_vcpu_compatible(vcpu)) {
++ r = -EINVAL;
++ goto vcpu_destroy;
++ }
+ if (atomic_read(&kvm->online_vcpus) == KVM_MAX_VCPUS) {
+ r = -EINVAL;
+ goto vcpu_destroy;
diff --git a/2.6.32/4420_grsecurity-2.9.1-2.6.32.59-201210071703.patch b/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201210091739.patch
similarity index 97%
rename from 2.6.32/4420_grsecurity-2.9.1-2.6.32.59-201210071703.patch
rename to 2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201210091739.patch
index 3166836..03d0618 100644
--- a/2.6.32/4420_grsecurity-2.9.1-2.6.32.59-201210071703.patch
+++ b/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201210091739.patch
@@ -189,7 +189,7 @@ index e1efc40..3569a2f 100644
zconf.hash.c
+zoffset.h
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
-index c840e7d..0f7d099 100644
+index 14c7fb0..0f7d099 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -806,6 +806,9 @@ and is between 256 and 4096 characters. It is defined in the file
@@ -215,19 +215,7 @@ index c840e7d..0f7d099 100644
i2c_bus= [HW] Override the default board specific I2C bus speed
or register an additional I2C bus that is not
registered from board initialization code.
-@@ -1725,6 +1734,11 @@ and is between 256 and 4096 characters. It is defined in the file
-
- noresidual [PPC] Don't use residual data on PReP machines.
-
-+ nordrand [X86] Disable the direct use of the RDRAND
-+ instruction even if it is supported by the
-+ processor. RDRAND is still available to user
-+ space applications.
-+
- noresume [SWSUSP] Disables resume and restores original swap
- space.
-
-@@ -1837,6 +1851,13 @@ and is between 256 and 4096 characters. It is defined in the file
+@@ -1842,6 +1851,13 @@ and is between 256 and 4096 characters. It is defined in the file
the specified number of seconds. This is to be used if
your oopses keep scrolling off the screen.
@@ -242,7 +230,7 @@ index c840e7d..0f7d099 100644
pcd. [PARIDE]
diff --git a/MAINTAINERS b/MAINTAINERS
-index 613da5d..4fe3eda 100644
+index 334258c..1e8f4ff 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -5725,6 +5725,14 @@ L: netdev@vger.kernel.org
@@ -261,7 +249,7 @@ index 613da5d..4fe3eda 100644
M: Liam Girdwood <lrg@slimlogic.co.uk>
M: Mark Brown <broonie@opensource.wolfsonmicro.com>
diff --git a/Makefile b/Makefile
-index 3a9a721..20e2d81 100644
+index b0e245e..e5894da 100644
--- a/Makefile
+++ b/Makefile
@@ -221,8 +221,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -2724,22 +2712,6 @@ index 0a0c77b..8e55a81 100644
. = __phys_per_cpu_start + PERCPU_PAGE_SIZE; /* ensure percpu data fits
* into percpu page size
*/
-diff --git a/arch/ia64/kvm/kvm-ia64.c b/arch/ia64/kvm/kvm-ia64.c
-index 2eb6365..416122b 100644
---- a/arch/ia64/kvm/kvm-ia64.c
-+++ b/arch/ia64/kvm/kvm-ia64.c
-@@ -1185,6 +1185,11 @@ out:
-
- #define PALE_RESET_ENTRY 0x80000000ffffffb0UL
-
-+bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu)
-+{
-+ return irqchip_in_kernel(vcpu->kcm) == (vcpu->arch.apic != NULL);
-+}
-+
- int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
- {
- struct kvm_vcpu *v;
diff --git a/arch/ia64/mm/fault.c b/arch/ia64/mm/fault.c
index 19261a9..1611b7a 100644
--- a/arch/ia64/mm/fault.c
@@ -3077,7 +3049,7 @@ index 83b5509..9fa24a23 100644
#endif /* _ASM_SYSTEM_H */
diff --git a/arch/mips/include/asm/thread_info.h b/arch/mips/include/asm/thread_info.h
-index 845da21..f2a91b9 100644
+index 0e50757..4e9432c 100644
--- a/arch/mips/include/asm/thread_info.h
+++ b/arch/mips/include/asm/thread_info.h
@@ -120,6 +120,8 @@ register struct thread_info *__current_thread_info __asm__("$28");
@@ -3387,7 +3359,7 @@ index bdc1f9a..e8de5c5 100644
#define L1_CACHE_TAG_VALID 0x00000001 /* cache tag valid bit */
diff --git a/arch/parisc/include/asm/atomic.h b/arch/parisc/include/asm/atomic.h
-index 8bc9e96..26554f8 100644
+index 6ee459d..71c1831 100644
--- a/arch/parisc/include/asm/atomic.h
+++ b/arch/parisc/include/asm/atomic.h
@@ -336,6 +336,16 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
@@ -4136,7 +4108,7 @@ index 8c34149..78f425a 100644
unsigned long data);
diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
-index 32a7c30..be3a8bb 100644
+index 6ce44dd..e054dcc 100644
--- a/arch/powerpc/include/asm/reg.h
+++ b/arch/powerpc/include/asm/reg.h
@@ -191,6 +191,7 @@
@@ -4578,7 +4550,7 @@ index 477c663..4f50234 100644
const Elf_Shdr *sechdrs,
const char *name)
diff --git a/arch/powerpc/kernel/module_32.c b/arch/powerpc/kernel/module_32.c
-index f832773..0507238 100644
+index 449a7e0..5cb1140 100644
--- a/arch/powerpc/kernel/module_32.c
+++ b/arch/powerpc/kernel/module_32.c
@@ -162,7 +162,7 @@ int module_frob_arch_sections(Elf32_Ehdr *hdr,
@@ -5811,7 +5783,7 @@ index 05ef538..dc9c857 100644
config SPARC64
def_bool 64BIT
diff --git a/arch/sparc/Makefile b/arch/sparc/Makefile
-index 113225b..7fd04e7 100644
+index 0538555..c826059 100644
--- a/arch/sparc/Makefile
+++ b/arch/sparc/Makefile
@@ -75,7 +75,7 @@ drivers-$(CONFIG_OPROFILE) += arch/sparc/oprofile/
@@ -6495,16 +6467,6 @@ index 2782681..77ded84 100644
extra-y := head_$(BITS).o
extra-y += init_task.o
-diff --git a/arch/sparc/kernel/ds.c b/arch/sparc/kernel/ds.c
-index 4a700f4..6a831bd 100644
---- a/arch/sparc/kernel/ds.c
-+++ b/arch/sparc/kernel/ds.c
-@@ -1242,4 +1242,4 @@ static int __init ds_init(void)
- return vio_register_driver(&ds_driver);
- }
-
--subsys_initcall(ds_init);
-+fs_initcall(ds_init);
diff --git a/arch/sparc/kernel/iommu.c b/arch/sparc/kernel/iommu.c
index 7690cc2..ece64c9 100644
--- a/arch/sparc/kernel/iommu.c
@@ -6714,32 +6676,6 @@ index 4ae91dc..c2e705e 100644
if (unlikely(current->audit_context)) {
unsigned long tstate = regs->tstate;
int result = AUDITSC_SUCCESS;
-diff --git a/arch/sparc/kernel/rtrap_64.S b/arch/sparc/kernel/rtrap_64.S
-index fd3cee4..cc4b1ff 100644
---- a/arch/sparc/kernel/rtrap_64.S
-+++ b/arch/sparc/kernel/rtrap_64.S
-@@ -20,11 +20,6 @@
-
- .text
- .align 32
--__handle_softirq:
-- call do_softirq
-- nop
-- ba,a,pt %xcc, __handle_softirq_continue
-- nop
- __handle_preemption:
- call schedule
- wrpr %g0, RTRAP_PSTATE, %pstate
-@@ -159,9 +154,7 @@ rtrap:
- cmp %l1, 0
-
- /* mm/ultra.S:xcall_report_regs KNOWS about this load. */
-- bne,pn %icc, __handle_softirq
- ldx [%sp + PTREGS_OFF + PT_V9_TSTATE], %l1
--__handle_softirq_continue:
- rtrap_xcall:
- sethi %hi(0xf << 20), %l4
- and %l1, %l4, %l4
diff --git a/arch/sparc/kernel/sigutil_64.c b/arch/sparc/kernel/sigutil_64.c
index 6edc4e5..06a69b4 100644
--- a/arch/sparc/kernel/sigutil_64.c
@@ -8664,7 +8600,7 @@ index d1b93c4..ae1b7fd 100644
void default_idle(void);
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
-index 73ae02a..1468e63 100644
+index aa889d6..1468e63 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -223,7 +223,7 @@ config X86_TRAMPOLINE
@@ -8703,23 +8639,7 @@ index 73ae02a..1468e63 100644
default 0x40000000 if VMSPLIT_1G
default 0xC0000000
depends on X86_32
-@@ -1428,6 +1428,15 @@ config ARCH_USES_PG_UNCACHED
- def_bool y
- depends on X86_PAT
-
-+config ARCH_RANDOM
-+ def_bool y
-+ prompt "x86 architectural random number generator" if EXPERT
-+ ---help---
-+ Enable the x86 architectural RDRAND instruction
-+ (Intel Bull Mountain technology) to generate random numbers.
-+ If supported, this is a high bandwidth, cryptographically
-+ secure hardware random number generator.
-+
- config EFI
- bool "EFI runtime service support"
- depends on ACPI
-@@ -1460,6 +1469,7 @@ config SECCOMP
+@@ -1469,6 +1469,7 @@ config SECCOMP
config CC_STACKPROTECTOR
bool "Enable -fstack-protector buffer overflow detection (EXPERIMENTAL)"
@@ -8727,7 +8647,7 @@ index 73ae02a..1468e63 100644
---help---
This option turns on the -fstack-protector GCC feature. This
feature puts, at the beginning of functions, a canary value on
-@@ -1517,6 +1527,7 @@ config KEXEC_JUMP
+@@ -1526,6 +1527,7 @@ config KEXEC_JUMP
config PHYSICAL_START
hex "Physical address where the kernel is loaded" if (EMBEDDED || CRASH_DUMP)
default "0x1000000"
@@ -8735,7 +8655,7 @@ index 73ae02a..1468e63 100644
---help---
This gives the physical address where the kernel is loaded.
-@@ -1581,6 +1592,7 @@ config PHYSICAL_ALIGN
+@@ -1590,6 +1592,7 @@ config PHYSICAL_ALIGN
hex
prompt "Alignment value to which kernel should be aligned" if X86_32
default "0x1000000"
@@ -8743,7 +8663,7 @@ index 73ae02a..1468e63 100644
range 0x2000 0x1000000
---help---
This value puts the alignment restrictions on physical address
-@@ -1612,9 +1624,10 @@ config HOTPLUG_CPU
+@@ -1621,9 +1624,10 @@ config HOTPLUG_CPU
Say N if you want to disable CPU hotplug.
config COMPAT_VDSO
@@ -9342,6 +9262,25 @@ index 11e8c6e..fdbb1ed 100644
}
/*
+diff --git a/arch/x86/boot/video-vga.c b/arch/x86/boot/video-vga.c
+index 819caa1..f32eba9 100644
+--- a/arch/x86/boot/video-vga.c
++++ b/arch/x86/boot/video-vga.c
+@@ -41,13 +41,12 @@ static __videocard video_vga;
+ static u8 vga_set_basic_mode(void)
+ {
+ struct biosregs ireg, oreg;
+- u16 ax;
+ u8 rows;
+ u8 mode;
+
+ initregs(&ireg);
+
+- ax = 0x0f00;
++ ireg.ax = 0x0f00;
+ intcall(0x10, &ireg, &oreg);
+ mode = oreg.al;
+
diff --git a/arch/x86/boot/video.c b/arch/x86/boot/video.c
index d42da38..787cdf3 100644
--- a/arch/x86/boot/video.c
@@ -10212,87 +10151,6 @@ index 20370c6..a2eb9b0 100644
"setc %%bl\n\t"
"popl %%ebp\n\t"
"popl %%edi\n\t"
-diff --git a/arch/x86/include/asm/archrandom.h b/arch/x86/include/asm/archrandom.h
-new file mode 100644
-index 0000000..0d9ec77
---- /dev/null
-+++ b/arch/x86/include/asm/archrandom.h
-@@ -0,0 +1,75 @@
-+/*
-+ * This file is part of the Linux kernel.
-+ *
-+ * Copyright (c) 2011, Intel Corporation
-+ * Authors: Fenghua Yu <fenghua.yu@intel.com>,
-+ * H. Peter Anvin <hpa@linux.intel.com>
-+ *
-+ * This program is free software; you can redistribute it and/or modify it
-+ * under the terms and conditions of the GNU General Public License,
-+ * version 2, as published by the Free Software Foundation.
-+ *
-+ * This program is distributed in the hope it will be useful, but WITHOUT
-+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
-+ * more details.
-+ *
-+ * You should have received a copy of the GNU General Public License along with
-+ * this program; if not, write to the Free Software Foundation, Inc.,
-+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-+ *
-+ */
-+
-+#ifndef ASM_X86_ARCHRANDOM_H
-+#define ASM_X86_ARCHRANDOM_H
-+
-+#include <asm/processor.h>
-+#include <asm/cpufeature.h>
-+#include <asm/alternative.h>
-+#include <asm/nops.h>
-+
-+#define RDRAND_RETRY_LOOPS 10
-+
-+#define RDRAND_INT ".byte 0x0f,0xc7,0xf0"
-+#ifdef CONFIG_X86_64
-+# define RDRAND_LONG ".byte 0x48,0x0f,0xc7,0xf0"
-+#else
-+# define RDRAND_LONG RDRAND_INT
-+#endif
-+
-+#ifdef CONFIG_ARCH_RANDOM
-+
-+#define GET_RANDOM(name, type, rdrand, nop) \
-+static inline int name(type *v) \
-+{ \
-+ int ok; \
-+ alternative_io("movl $0, %0\n\t" \
-+ nop, \
-+ "\n1: " rdrand "\n\t" \
-+ "jc 2f\n\t" \
-+ "decl %0\n\t" \
-+ "jnz 1b\n\t" \
-+ "2:", \
-+ X86_FEATURE_RDRAND, \
-+ ASM_OUTPUT2("=r" (ok), "=a" (*v)), \
-+ "0" (RDRAND_RETRY_LOOPS)); \
-+ return ok; \
-+}
-+
-+#ifdef CONFIG_X86_64
-+
-+GET_RANDOM(arch_get_random_long, unsigned long, RDRAND_LONG, ASM_NOP5);
-+GET_RANDOM(arch_get_random_int, unsigned int, RDRAND_INT, ASM_NOP4);
-+
-+#else
-+
-+GET_RANDOM(arch_get_random_long, unsigned long, RDRAND_LONG, ASM_NOP3);
-+GET_RANDOM(arch_get_random_int, unsigned int, RDRAND_INT, ASM_NOP3);
-+
-+#endif /* CONFIG_X86_64 */
-+
-+#endif /* CONFIG_ARCH_RANDOM */
-+
-+extern void x86_init_rdrand(struct cpuinfo_x86 *c);
-+
-+#endif /* ASM_X86_ARCHRANDOM_H */
diff --git a/arch/x86/include/asm/atomic_32.h b/arch/x86/include/asm/atomic_32.h
index dc5a667..7a2470f 100644
--- a/arch/x86/include/asm/atomic_32.h
@@ -11739,18 +11597,6 @@ index 46fc474..b02b0f9 100644
len, sum, NULL, err_ptr);
if (len)
-diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
-index 1efb1fa..9e2957c 100644
---- a/arch/x86/include/asm/cpufeature.h
-+++ b/arch/x86/include/asm/cpufeature.h
-@@ -124,6 +124,7 @@
- #define X86_FEATURE_XSAVE (4*32+26) /* XSAVE/XRSTOR/XSETBV/XGETBV */
- #define X86_FEATURE_OSXSAVE (4*32+27) /* "" XSAVE enabled in the OS */
- #define X86_FEATURE_AVX (4*32+28) /* Advanced Vector Extensions */
-+#define X86_FEATURE_RDRAND (4*32+30) /* The RDRAND instruction */
- #define X86_FEATURE_HYPERVISOR (4*32+31) /* Running on a hypervisor */
-
- /* VIA/Cyrix/Centaur-defined CPU features, CPUID level 0xC0000001, word 5 */
diff --git a/arch/x86/include/asm/desc.h b/arch/x86/include/asm/desc.h
index 617bd56..7b047a1 100644
--- a/arch/x86/include/asm/desc.h
@@ -12339,39 +12185,6 @@ index 4fe681d..bb6d40c 100644
#define flush_insn_slot(p) do { } while (0)
-diff --git a/arch/x86/include/asm/kvm_emulate.h b/arch/x86/include/asm/kvm_emulate.h
-index 5ed59ec..cc44e3d 100644
---- a/arch/x86/include/asm/kvm_emulate.h
-+++ b/arch/x86/include/asm/kvm_emulate.h
-@@ -109,6 +109,8 @@ struct x86_emulate_ops {
- unsigned int bytes,
- struct kvm_vcpu *vcpu);
-
-+ bool (*get_cpuid)(struct x86_emulate_ctxt *ctxt,
-+ u32 *eax, u32 *ebx, u32 *ecx, u32 *edx);
- };
-
- /* Type, address-of, and value of an instruction's operand. */
-@@ -190,6 +192,19 @@ struct x86_emulate_ctxt {
- #define X86EMUL_MODE_HOST X86EMUL_MODE_PROT64
- #endif
-
-+/* CPUID vendors */
-+#define X86EMUL_CPUID_VENDOR_AuthenticAMD_ebx 0x68747541
-+#define X86EMUL_CPUID_VENDOR_AuthenticAMD_ecx 0x444d4163
-+#define X86EMUL_CPUID_VENDOR_AuthenticAMD_edx 0x69746e65
-+
-+#define X86EMUL_CPUID_VENDOR_AMDisbetterI_ebx 0x69444d41
-+#define X86EMUL_CPUID_VENDOR_AMDisbetterI_ecx 0x21726574
-+#define X86EMUL_CPUID_VENDOR_AMDisbetterI_edx 0x74656273
-+
-+#define X86EMUL_CPUID_VENDOR_GenuineIntel_ebx 0x756e6547
-+#define X86EMUL_CPUID_VENDOR_GenuineIntel_ecx 0x6c65746e
-+#define X86EMUL_CPUID_VENDOR_GenuineIntel_edx 0x49656e69
-+
- int x86_decode_insn(struct x86_emulate_ctxt *ctxt,
- struct x86_emulate_ops *ops);
- int x86_emulate_insn(struct x86_emulate_ctxt *ctxt,
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index 08bc2ff..2e88d1f 100644
--- a/arch/x86/include/asm/kvm_host.h
@@ -15832,10 +15645,10 @@ index 4a6aeed..371de20 100644
BLANK();
OFFSET(XEN_vcpu_info_mask, vcpu_info, evtchn_upcall_mask);
diff --git a/arch/x86/kernel/cpu/Makefile b/arch/x86/kernel/cpu/Makefile
-index ff502cc..a7cb6c6 100644
+index 1f537a2..a7cb6c6 100644
--- a/arch/x86/kernel/cpu/Makefile
+++ b/arch/x86/kernel/cpu/Makefile
-@@ -7,13 +7,10 @@ ifdef CONFIG_FUNCTION_TRACER
+@@ -7,10 +7,6 @@ ifdef CONFIG_FUNCTION_TRACER
CFLAGS_REMOVE_common.o = -pg
endif
@@ -15846,10 +15659,6 @@ index ff502cc..a7cb6c6 100644
obj-y := intel_cacheinfo.o addon_cpuid_features.o
obj-y += proc.o capflags.o powerflags.o common.o
obj-y += vmware.o hypervisor.o sched.o
-+obj-y += rdrand.o
-
- obj-$(CONFIG_X86_32) += bugs.o cmpxchg.o
- obj-$(CONFIG_X86_64) += bugs_64.o
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index 6e082dc..a0b5f36 100644
--- a/arch/x86/kernel/cpu/amd.c
@@ -15864,18 +15673,10 @@ index 6e082dc..a0b5f36 100644
if (c->x86_model == 3 && c->x86_mask == 0)
size = 64;
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
-index 4e34d10..1a4b0af 100644
+index ba1a1dd..1a4b0af 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
-@@ -15,6 +15,7 @@
- #include <asm/stackprotector.h>
- #include <asm/perf_event.h>
- #include <asm/mmu_context.h>
-+#include <asm/archrandom.h>
- #include <asm/hypervisor.h>
- #include <asm/processor.h>
- #include <asm/sections.h>
-@@ -83,60 +84,6 @@ static const struct cpu_dev __cpuinitconst default_cpu = {
+@@ -84,60 +84,6 @@ static const struct cpu_dev __cpuinitconst default_cpu = {
static const struct cpu_dev *this_cpu __cpuinitdata = &default_cpu;
@@ -15936,7 +15737,7 @@ index 4e34d10..1a4b0af 100644
static int __init x86_xsave_setup(char *s)
{
setup_clear_cpu_cap(X86_FEATURE_XSAVE);
-@@ -344,7 +291,7 @@ void switch_to_new_gdt(int cpu)
+@@ -345,7 +291,7 @@ void switch_to_new_gdt(int cpu)
{
struct desc_ptr gdt_descr;
@@ -15945,7 +15746,7 @@ index 4e34d10..1a4b0af 100644
gdt_descr.size = GDT_SIZE - 1;
load_gdt(&gdt_descr);
/* Reload the per-cpu base */
-@@ -798,6 +745,10 @@ static void __cpuinit identify_cpu(struct cpuinfo_x86 *c)
+@@ -799,6 +745,10 @@ static void __cpuinit identify_cpu(struct cpuinfo_x86 *c)
/* Filter out anything that depends on CPUID levels we don't have */
filter_cpuid_features(c, true);
@@ -15956,15 +15757,7 @@ index 4e34d10..1a4b0af 100644
/* If the model name is still unset, do table lookup. */
if (!c->x86_model_id[0]) {
const char *p;
-@@ -815,6 +766,7 @@ static void __cpuinit identify_cpu(struct cpuinfo_x86 *c)
- #endif
-
- init_hypervisor(c);
-+ x86_init_rdrand(c);
-
- /*
- * Clear/Set all flags overriden by options, need do it
-@@ -980,6 +932,9 @@ static __init int setup_disablecpuid(char *arg)
+@@ -982,6 +932,9 @@ static __init int setup_disablecpuid(char *arg)
}
__setup("clearcpuid=", setup_disablecpuid);
@@ -15974,7 +15767,7 @@ index 4e34d10..1a4b0af 100644
#ifdef CONFIG_X86_64
struct desc_ptr idt_descr = { NR_VECTORS * 16 - 1, (unsigned long) idt_table };
-@@ -995,7 +950,7 @@ DEFINE_PER_CPU(struct task_struct *, current_task) ____cacheline_aligned =
+@@ -997,7 +950,7 @@ DEFINE_PER_CPU(struct task_struct *, current_task) ____cacheline_aligned =
EXPORT_PER_CPU_SYMBOL(current_task);
DEFINE_PER_CPU(unsigned long, kernel_stack) =
@@ -15983,7 +15776,7 @@ index 4e34d10..1a4b0af 100644
EXPORT_PER_CPU_SYMBOL(kernel_stack);
DEFINE_PER_CPU(char *, irq_stack_ptr) =
-@@ -1060,7 +1015,7 @@ struct pt_regs * __cpuinit idle_regs(struct pt_regs *regs)
+@@ -1062,7 +1015,7 @@ struct pt_regs * __cpuinit idle_regs(struct pt_regs *regs)
{
memset(regs, 0, sizeof(struct pt_regs));
regs->fs = __KERNEL_PERCPU;
@@ -15992,7 +15785,7 @@ index 4e34d10..1a4b0af 100644
return regs;
}
-@@ -1101,7 +1056,7 @@ void __cpuinit cpu_init(void)
+@@ -1103,7 +1056,7 @@ void __cpuinit cpu_init(void)
int i;
cpu = stack_smp_processor_id();
@@ -16001,7 +15794,7 @@ index 4e34d10..1a4b0af 100644
orig_ist = &per_cpu(orig_ist, cpu);
#ifdef CONFIG_NUMA
-@@ -1127,7 +1082,7 @@ void __cpuinit cpu_init(void)
+@@ -1129,7 +1082,7 @@ void __cpuinit cpu_init(void)
switch_to_new_gdt(cpu);
loadsegment(fs, 0);
@@ -16010,7 +15803,7 @@ index 4e34d10..1a4b0af 100644
memset(me->thread.tls_array, 0, GDT_ENTRY_TLS_ENTRIES * 8);
syscall_init();
-@@ -1136,7 +1091,6 @@ void __cpuinit cpu_init(void)
+@@ -1138,7 +1091,6 @@ void __cpuinit cpu_init(void)
wrmsrl(MSR_KERNEL_GS_BASE, 0);
barrier();
@@ -16018,7 +15811,7 @@ index 4e34d10..1a4b0af 100644
if (cpu != 0)
enable_x2apic();
-@@ -1199,7 +1153,7 @@ void __cpuinit cpu_init(void)
+@@ -1201,7 +1153,7 @@ void __cpuinit cpu_init(void)
{
int cpu = smp_processor_id();
struct task_struct *curr = current;
@@ -16438,85 +16231,6 @@ index 898df97..9e82503 100644
static struct wd_ops intel_arch_wd_ops __read_mostly = {
.reserve = single_msr_reserve,
.unreserve = single_msr_unreserve,
-diff --git a/arch/x86/kernel/cpu/rdrand.c b/arch/x86/kernel/cpu/rdrand.c
-new file mode 100644
-index 0000000..feca286
---- /dev/null
-+++ b/arch/x86/kernel/cpu/rdrand.c
-@@ -0,0 +1,73 @@
-+/*
-+ * This file is part of the Linux kernel.
-+ *
-+ * Copyright (c) 2011, Intel Corporation
-+ * Authors: Fenghua Yu <fenghua.yu@intel.com>,
-+ * H. Peter Anvin <hpa@linux.intel.com>
-+ *
-+ * This program is free software; you can redistribute it and/or modify it
-+ * under the terms and conditions of the GNU General Public License,
-+ * version 2, as published by the Free Software Foundation.
-+ *
-+ * This program is distributed in the hope it will be useful, but WITHOUT
-+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
-+ * more details.
-+ *
-+ * You should have received a copy of the GNU General Public License along with
-+ * this program; if not, write to the Free Software Foundation, Inc.,
-+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-+ *
-+ */
-+
-+#include <asm/processor.h>
-+#include <asm/archrandom.h>
-+#include <asm/sections.h>
-+
-+static int __init x86_rdrand_setup(char *s)
-+{
-+ setup_clear_cpu_cap(X86_FEATURE_RDRAND);
-+ return 1;
-+}
-+__setup("nordrand", x86_rdrand_setup);
-+
-+/* We can't use arch_get_random_long() here since alternatives haven't run */
-+static inline int rdrand_long(unsigned long *v)
-+{
-+ int ok;
-+ asm volatile("1: " RDRAND_LONG "\n\t"
-+ "jc 2f\n\t"
-+ "decl %0\n\t"
-+ "jnz 1b\n\t"
-+ "2:"
-+ : "=r" (ok), "=a" (*v)
-+ : "0" (RDRAND_RETRY_LOOPS));
-+ return ok;
-+}
-+
-+/*
-+ * Force a reseed cycle; we are architecturally guaranteed a reseed
-+ * after no more than 512 128-bit chunks of random data. This also
-+ * acts as a test of the CPU capability.
-+ */
-+#define RESEED_LOOP ((512*128)/sizeof(unsigned long))
-+
-+void __cpuinit x86_init_rdrand(struct cpuinfo_x86 *c)
-+{
-+#ifdef CONFIG_ARCH_RANDOM
-+ unsigned long tmp;
-+ int i, count, ok;
-+
-+ if (!cpu_has(c, X86_FEATURE_RDRAND))
-+ return; /* Nothing to do */
-+
-+ for (count = i = 0; i < RESEED_LOOP; i++) {
-+ ok = rdrand_long(&tmp);
-+ if (ok)
-+ count++;
-+ }
-+
-+ if (count != RESEED_LOOP)
-+ clear_cpu_cap(c, X86_FEATURE_RDRAND);
-+#endif
-+}
diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c
index ff95824..2ffdcb5 100644
--- a/arch/x86/kernel/crash.c
@@ -22400,7 +22114,7 @@ index be25734..87fe232 100644
return pc;
}
diff --git a/arch/x86/kernel/tls.c b/arch/x86/kernel/tls.c
-index 6bb7b85..aeb81c2 100644
+index bcfec2d..aeb81c2 100644
--- a/arch/x86/kernel/tls.c
+++ b/arch/x86/kernel/tls.c
@@ -85,6 +85,11 @@ int do_set_thread_area(struct task_struct *p, int idx,
@@ -22415,24 +22129,7 @@ index 6bb7b85..aeb81c2 100644
set_tls_desc(p, idx, &info, 1);
return 0;
-@@ -163,7 +168,7 @@ int regset_tls_get(struct task_struct *target, const struct user_regset *regset,
- {
- const struct desc_struct *tls;
-
-- if (pos > GDT_ENTRY_TLS_ENTRIES * sizeof(struct user_desc) ||
-+ if (pos >= GDT_ENTRY_TLS_ENTRIES * sizeof(struct user_desc) ||
- (pos % sizeof(struct user_desc)) != 0 ||
- (count % sizeof(struct user_desc)) != 0)
- return -EINVAL;
-@@ -198,14 +203,14 @@ int regset_tls_set(struct task_struct *target, const struct user_regset *regset,
- struct user_desc infobuf[GDT_ENTRY_TLS_ENTRIES];
- const struct user_desc *info;
-
-- if (pos > GDT_ENTRY_TLS_ENTRIES * sizeof(struct user_desc) ||
-+ if (pos >= GDT_ENTRY_TLS_ENTRIES * sizeof(struct user_desc) ||
- (pos % sizeof(struct user_desc)) != 0 ||
- (count % sizeof(struct user_desc)) != 0)
- return -EINVAL;
+@@ -205,7 +210,7 @@ int regset_tls_set(struct task_struct *target, const struct user_regset *regset,
if (kbuf)
info = kbuf;
@@ -23542,7 +23239,7 @@ index c5ee17e..d63218f 100644
if (unlikely(err)) {
/*
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
-index 1350e43..d7384e3 100644
+index aa2d905..d7384e3 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -81,8 +81,8 @@
@@ -23581,144 +23278,6 @@ index 1350e43..d7384e3 100644
switch ((_dst).bytes) { \
case 1: \
____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b"); \
-@@ -1495,20 +1493,73 @@ setup_syscalls_segments(struct x86_emulate_ctxt *ctxt,
- ss->present = 1;
- }
-
-+static bool em_syscall_is_enabled(struct x86_emulate_ctxt *ctxt,
-+ struct x86_emulate_ops *ops)
-+{
-+ u32 eax, ebx, ecx, edx;
-+
-+ /*
-+ * syscall should always be enabled in longmode - so only become
-+ * vendor specific (cpuid) if other modes are active...
-+ */
-+ if (ctxt->mode == X86EMUL_MODE_PROT64)
-+ return true;
-+
-+ eax = 0x00000000;
-+ ecx = 0x00000000;
-+ if (ops->get_cpuid(ctxt, &eax, &ebx, &ecx, &edx)) {
-+ /*
-+ * Intel ("GenuineIntel")
-+ * remark: Intel CPUs only support "syscall" in 64bit
-+ * longmode. Also an 64bit guest with a
-+ * 32bit compat-app running will #UD !! While this
-+ * behaviour can be fixed (by emulating) into AMD
-+ * response - CPUs of AMD can't behave like Intel.
-+ */
-+ if (ebx == X86EMUL_CPUID_VENDOR_GenuineIntel_ebx &&
-+ ecx == X86EMUL_CPUID_VENDOR_GenuineIntel_ecx &&
-+ edx == X86EMUL_CPUID_VENDOR_GenuineIntel_edx)
-+ return false;
-+
-+ /* AMD ("AuthenticAMD") */
-+ if (ebx == X86EMUL_CPUID_VENDOR_AuthenticAMD_ebx &&
-+ ecx == X86EMUL_CPUID_VENDOR_AuthenticAMD_ecx &&
-+ edx == X86EMUL_CPUID_VENDOR_AuthenticAMD_edx)
-+ return true;
-+
-+ /* AMD ("AMDisbetter!") */
-+ if (ebx == X86EMUL_CPUID_VENDOR_AMDisbetterI_ebx &&
-+ ecx == X86EMUL_CPUID_VENDOR_AMDisbetterI_ecx &&
-+ edx == X86EMUL_CPUID_VENDOR_AMDisbetterI_edx)
-+ return true;
-+ }
-+
-+ /* default: (not Intel, not AMD), apply Intel's stricter rules... */
-+ return false;
-+}
-+
- static int
--emulate_syscall(struct x86_emulate_ctxt *ctxt)
-+emulate_syscall(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
- {
- struct decode_cache *c = &ctxt->decode;
- struct kvm_segment cs, ss;
- u64 msr_data;
-+ u64 efer = 0;
-
- /* syscall is not available in real mode */
- if (c->lock_prefix || ctxt->mode == X86EMUL_MODE_REAL
- || ctxt->mode == X86EMUL_MODE_VM86)
- return -1;
-
-+ if (!(em_syscall_is_enabled(ctxt, ops)))
-+ return -1;
-+
-+ kvm_x86_ops->get_msr(ctxt->vcpu, MSR_EFER, &efer);
- setup_syscalls_segments(ctxt, &cs, &ss);
-
-+ if (!(efer & EFER_SCE))
-+ return -1;
-+
- kvm_x86_ops->get_msr(ctxt->vcpu, MSR_STAR, &msr_data);
- msr_data >>= 32;
- cs.selector = (u16)(msr_data & 0xfffc);
-@@ -2342,7 +2393,7 @@ twobyte_insn:
- }
- break;
- case 0x05: /* syscall */
-- if (emulate_syscall(ctxt) == -1)
-+ if (emulate_syscall(ctxt, ops) == -1)
- goto cannot_emulate;
- else
- goto writeback;
-diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
-index 88ad162..7e361b4 100644
---- a/arch/x86/kvm/i8254.c
-+++ b/arch/x86/kvm/i8254.c
-@@ -277,11 +277,15 @@ static struct kvm_timer_ops kpit_ops = {
- .is_periodic = kpit_is_periodic,
- };
-
--static void create_pit_timer(struct kvm_kpit_state *ps, u32 val, int is_period)
-+static void create_pit_timer(struct kvm *kvm, u32 val, int is_period)
- {
-+ struct kvm_kpit_state *ps = &kvm->arch.vpit->pit_state;
- struct kvm_timer *pt = &ps->pit_timer;
- s64 interval;
-
-+ if (!irqchip_in_kernel(kvm))
-+ return;
-+
- interval = muldiv64(val, NSEC_PER_SEC, KVM_PIT_FREQ);
-
- pr_debug("pit: create pit timer, interval is %llu nsec\n", interval);
-@@ -333,13 +337,13 @@ static void pit_load_count(struct kvm *kvm, int channel, u32 val)
- /* FIXME: enhance mode 4 precision */
- case 4:
- if (!(ps->flags & KVM_PIT_FLAGS_HPET_LEGACY)) {
-- create_pit_timer(ps, val, 0);
-+ create_pit_timer(kvm, val, 0);
- }
- break;
- case 2:
- case 3:
- if (!(ps->flags & KVM_PIT_FLAGS_HPET_LEGACY)){
-- create_pit_timer(ps, val, 1);
-+ create_pit_timer(kvm, val, 1);
- }
- break;
- default:
-diff --git a/arch/x86/kvm/irq.h b/arch/x86/kvm/irq.h
-index 7d6058a..85a8721 100644
---- a/arch/x86/kvm/irq.h
-+++ b/arch/x86/kvm/irq.h
-@@ -85,7 +85,11 @@ static inline struct kvm_pic *pic_irqchip(struct kvm *kvm)
-
- static inline int irqchip_in_kernel(struct kvm *kvm)
- {
-- return pic_irqchip(kvm) != NULL;
-+ int ret;
-+
-+ ret = (pic_irqchip(kvm) != NULL);
-+ smp_rmb();
-+ return ret;
- }
-
- void kvm_pic_reset(struct kvm_kpic_state *s);
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index 8dfeaaa..4daa395 100644
--- a/arch/x86/kvm/lapic.c
@@ -23895,7 +23454,7 @@ index e6d925f..6bde4d6 100644
.disabled_by_bios = vmx_disabled_by_bios,
.hardware_setup = hardware_setup,
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index df1cefb..ea708b4 100644
+index 271fddf..ea708b4 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -82,7 +82,7 @@ static void update_cr8_intercept(struct kvm_vcpu *vcpu);
@@ -23964,94 +23523,7 @@ index df1cefb..ea708b4 100644
return -EINVAL;
if (irqchip_in_kernel(vcpu->kvm))
return -ENXIO;
-@@ -2273,25 +2282,42 @@ long kvm_arch_vm_ioctl(struct file *filp,
- if (r)
- goto out;
- break;
-- case KVM_CREATE_IRQCHIP:
-+ case KVM_CREATE_IRQCHIP: {
-+ struct kvm_pic *vpic;
-+
-+ mutex_lock(&kvm->lock);
-+ r = -EEXIST;
-+ if (kvm->arch.vpic)
-+ goto create_irqchip_unlock;
-+ r = -EINVAL;
-+ if (atomic_read(&kvm->online_vcpus))
-+ goto create_irqchip_unlock;
- r = -ENOMEM;
-- kvm->arch.vpic = kvm_create_pic(kvm);
-- if (kvm->arch.vpic) {
-+ vpic = kvm_create_pic(kvm);
-+ if (vpic) {
- r = kvm_ioapic_init(kvm);
- if (r) {
-- kfree(kvm->arch.vpic);
-- kvm->arch.vpic = NULL;
-- goto out;
-+ kfree(vpic);
-+ goto create_irqchip_unlock;
- }
- } else
-- goto out;
-+ goto create_irqchip_unlock;
-+ smp_wmb();
-+ kvm->arch.vpic = vpic;
-+ smp_wmb();
- r = kvm_setup_default_irq_routing(kvm);
- if (r) {
-+ mutex_lock(&kvm->irq_lock);
- kfree(kvm->arch.vpic);
- kfree(kvm->arch.vioapic);
-- goto out;
-+ kvm->arch.vpic = NULL;
-+ kvm->arch.vioapic = NULL;
-+ mutex_unlock(&kvm->irq_lock);
- }
-+ create_irqchip_unlock:
-+ mutex_unlock(&kvm->lock);
- break;
-+ }
- case KVM_CREATE_PIT:
- u.pit_config.flags = KVM_PIT_SPEAKER_DUMMY;
- goto create_pit;
-@@ -2871,12 +2897,35 @@ void kvm_report_emulation_failure(struct kvm_vcpu *vcpu, const char *context)
- }
- EXPORT_SYMBOL_GPL(kvm_report_emulation_failure);
-
-+static bool emulator_get_cpuid(struct x86_emulate_ctxt *ctxt,
-+ u32 *eax, u32 *ebx, u32 *ecx, u32 *edx)
-+{
-+ struct kvm_cpuid_entry2 *cpuid = NULL;
-+
-+ if (eax && ecx)
-+ cpuid = kvm_find_cpuid_entry(ctxt->vcpu,
-+ *eax, *ecx);
-+
-+ if (cpuid) {
-+ *eax = cpuid->eax;
-+ *ecx = cpuid->ecx;
-+ if (ebx)
-+ *ebx = cpuid->ebx;
-+ if (edx)
-+ *edx = cpuid->edx;
-+ return true;
-+ }
-+
-+ return false;
-+}
-+
- static struct x86_emulate_ops emulate_ops = {
- .read_std = kvm_read_guest_virt_system,
- .fetch = kvm_fetch_guest_virt,
- .read_emulated = emulator_read_emulated,
- .write_emulated = emulator_write_emulated,
- .cmpxchg_emulated = emulator_cmpxchg_emulated,
-+ .get_cpuid = emulator_get_cpuid,
- };
-
- static void cache_all_regs(struct kvm_vcpu *vcpu)
-@@ -3260,10 +3309,10 @@ static struct notifier_block kvmclock_cpufreq_notifier_block = {
+@@ -3300,10 +3309,10 @@ static struct notifier_block kvmclock_cpufreq_notifier_block = {
.notifier_call = kvmclock_cpufreq_notifier
};
@@ -24064,18 +23536,6 @@ index df1cefb..ea708b4 100644
if (kvm_x86_ops) {
printk(KERN_ERR "kvm: already loaded the other module\n");
-@@ -4990,6 +5039,11 @@ void kvm_arch_check_processor_compat(void *rtn)
- kvm_x86_ops->check_processor_compatibility(rtn);
- }
-
-+bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu)
-+{
-+ return irqchip_in_kernel(vcpu->kvm) == (vcpu->arch.apic != NULL);
-+}
-+
- int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
- {
- struct page *page;
diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
index 7e59dc1..80b8a7b 100644
--- a/arch/x86/lguest/boot.c
@@ -24950,22 +24410,6 @@ index 459b58a..9570bc7 100644
len, isum, NULL, errp);
}
EXPORT_SYMBOL(csum_partial_copy_to_user);
-diff --git a/arch/x86/lib/delay.c b/arch/x86/lib/delay.c
-index ff485d3..b6372ce 100644
---- a/arch/x86/lib/delay.c
-+++ b/arch/x86/lib/delay.c
-@@ -48,9 +48,9 @@ static void delay_loop(unsigned long loops)
- }
-
- /* TSC based delay: */
--static void delay_tsc(unsigned long loops)
-+static void delay_tsc(unsigned long __loops)
- {
-- unsigned long bclock, now;
-+ u32 bclock, now, loops = __loops;
- int cpu;
-
- preempt_disable();
diff --git a/arch/x86/lib/getuser.S b/arch/x86/lib/getuser.S
index 51f1504..ddac4c1 100644
--- a/arch/x86/lib/getuser.S
@@ -26661,7 +26105,7 @@ index 61b41ca..5fef66a 100644
extern u32 pnp_bios_is_utter_crap;
pnp_bios_is_utter_crap = 1;
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
-index 8ac0d76..ca501e2 100644
+index 249ad57..bbe82fd 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -11,10 +11,19 @@
@@ -26752,18 +26196,17 @@ index 8ac0d76..ca501e2 100644
DEFINE_SPINLOCK(pgd_lock);
LIST_HEAD(pgd_list);
-@@ -224,11 +267,24 @@ void vmalloc_sync_all(void)
+@@ -223,11 +266,23 @@ void vmalloc_sync_all(void)
+ address >= TASK_SIZE && address < FIXADDR_TOP;
address += PMD_SIZE) {
- unsigned long flags;
-+
+#ifdef CONFIG_PAX_PER_CPU_PGD
+ unsigned long cpu;
+#else
struct page *page;
+#endif
- spin_lock_irqsave(&pgd_lock, flags);
+ spin_lock(&pgd_lock);
+
+#ifdef CONFIG_PAX_PER_CPU_PGD
+ for (cpu = 0; cpu < nr_cpu_ids; ++cpu) {
@@ -26777,8 +26220,8 @@ index 8ac0d76..ca501e2 100644
+ if (!vmalloc_sync_one(pgd, address))
break;
}
- spin_unlock_irqrestore(&pgd_lock, flags);
-@@ -258,6 +314,11 @@ static noinline int vmalloc_fault(unsigned long address)
+ spin_unlock(&pgd_lock);
+@@ -257,6 +312,11 @@ static noinline int vmalloc_fault(unsigned long address)
* an interrupt in the middle of a task switch..
*/
pgd_paddr = read_cr3();
@@ -26790,10 +26233,10 @@ index 8ac0d76..ca501e2 100644
pmd_k = vmalloc_sync_one(__va(pgd_paddr), address);
if (!pmd_k)
return -1;
-@@ -332,15 +393,27 @@ void vmalloc_sync_all(void)
+@@ -330,15 +390,27 @@ void vmalloc_sync_all(void)
+ address += PGDIR_SIZE) {
const pgd_t *pgd_ref = pgd_offset_k(address);
- unsigned long flags;
+
+#ifdef CONFIG_PAX_PER_CPU_PGD
+ unsigned long cpu;
@@ -26804,7 +26247,7 @@ index 8ac0d76..ca501e2 100644
if (pgd_none(*pgd_ref))
continue;
- spin_lock_irqsave(&pgd_lock, flags);
+ spin_lock(&pgd_lock);
+
+#ifdef CONFIG_PAX_PER_CPU_PGD
+ for (cpu = 0; cpu < nr_cpu_ids; ++cpu) {
@@ -26818,7 +26261,7 @@ index 8ac0d76..ca501e2 100644
if (pgd_none(*pgd))
set_pgd(pgd, *pgd_ref);
else
-@@ -373,7 +446,14 @@ static noinline int vmalloc_fault(unsigned long address)
+@@ -371,7 +443,14 @@ static noinline int vmalloc_fault(unsigned long address)
* happen within a race in page table update. In the later
* case just flush:
*/
@@ -26833,7 +26276,7 @@ index 8ac0d76..ca501e2 100644
pgd_ref = pgd_offset_k(address);
if (pgd_none(*pgd_ref))
return -1;
-@@ -535,7 +615,7 @@ static int is_errata93(struct pt_regs *regs, unsigned long address)
+@@ -533,7 +612,7 @@ static int is_errata93(struct pt_regs *regs, unsigned long address)
static int is_errata100(struct pt_regs *regs, unsigned long address)
{
#ifdef CONFIG_X86_64
@@ -26842,7 +26285,7 @@ index 8ac0d76..ca501e2 100644
return 1;
#endif
return 0;
-@@ -562,7 +642,7 @@ static int is_f00f_bug(struct pt_regs *regs, unsigned long address)
+@@ -560,7 +639,7 @@ static int is_f00f_bug(struct pt_regs *regs, unsigned long address)
}
static const char nx_warning[] = KERN_CRIT
@@ -26851,7 +26294,7 @@ index 8ac0d76..ca501e2 100644
static void
show_fault_oops(struct pt_regs *regs, unsigned long error_code,
-@@ -571,15 +651,26 @@ show_fault_oops(struct pt_regs *regs, unsigned long error_code,
+@@ -569,15 +648,26 @@ show_fault_oops(struct pt_regs *regs, unsigned long error_code,
if (!oops_may_print())
return;
@@ -26880,7 +26323,7 @@ index 8ac0d76..ca501e2 100644
printk(KERN_ALERT "BUG: unable to handle kernel ");
if (address < PAGE_SIZE)
printk(KERN_CONT "NULL pointer dereference");
-@@ -705,6 +796,23 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
+@@ -703,6 +793,23 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
{
struct task_struct *tsk = current;
@@ -26904,7 +26347,7 @@ index 8ac0d76..ca501e2 100644
/* User mode accesses just cause a SIGSEGV */
if (error_code & PF_USER) {
/*
-@@ -722,6 +830,21 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
+@@ -720,6 +827,21 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
if (is_errata100(regs, address))
return;
@@ -26926,7 +26369,7 @@ index 8ac0d76..ca501e2 100644
if (unlikely(show_unhandled_signals))
show_signal_msg(regs, error_code, address, tsk);
-@@ -818,7 +941,7 @@ do_sigbus(struct pt_regs *regs, unsigned long error_code, unsigned long address,
+@@ -816,7 +938,7 @@ do_sigbus(struct pt_regs *regs, unsigned long error_code, unsigned long address,
if (fault & VM_FAULT_HWPOISON) {
printk(KERN_ERR
"MCE: Killing %s:%d due to hardware memory corruption fault at %lx\n",
@@ -26935,7 +26378,7 @@ index 8ac0d76..ca501e2 100644
code = BUS_MCEERR_AR;
}
#endif
-@@ -857,6 +980,99 @@ static int spurious_fault_check(unsigned long error_code, pte_t *pte)
+@@ -855,6 +977,99 @@ static int spurious_fault_check(unsigned long error_code, pte_t *pte)
return 1;
}
@@ -27035,7 +26478,7 @@ index 8ac0d76..ca501e2 100644
/*
* Handle a spurious fault caused by a stale TLB entry.
*
-@@ -923,6 +1139,9 @@ int show_unhandled_signals = 1;
+@@ -921,6 +1136,9 @@ int show_unhandled_signals = 1;
static inline int
access_error(unsigned long error_code, int write, struct vm_area_struct *vma)
{
@@ -27045,7 +26488,7 @@ index 8ac0d76..ca501e2 100644
if (write) {
/* write, present and write, not present: */
if (unlikely(!(vma->vm_flags & VM_WRITE)))
-@@ -956,16 +1175,30 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
+@@ -954,16 +1172,30 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
{
struct vm_area_struct *vma;
struct task_struct *tsk;
@@ -27081,7 +26524,7 @@ index 8ac0d76..ca501e2 100644
/*
* Detect and handle instructions that would cause a page fault for
-@@ -1026,7 +1259,7 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
+@@ -1024,7 +1256,7 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
* User-mode registers count as a user access even for any
* potential system fault or CPU buglet:
*/
@@ -27090,7 +26533,7 @@ index 8ac0d76..ca501e2 100644
local_irq_enable();
error_code |= PF_USER;
} else {
-@@ -1080,6 +1313,11 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
+@@ -1078,6 +1310,11 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
might_sleep();
}
@@ -27102,7 +26545,7 @@ index 8ac0d76..ca501e2 100644
vma = find_vma(mm, address);
if (unlikely(!vma)) {
bad_area(regs, error_code, address);
-@@ -1091,18 +1329,24 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
+@@ -1089,18 +1326,24 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
bad_area(regs, error_code, address);
return;
}
@@ -27138,7 +26581,7 @@ index 8ac0d76..ca501e2 100644
if (unlikely(expand_stack(vma, address))) {
bad_area(regs, error_code, address);
return;
-@@ -1146,3 +1390,292 @@ good_area:
+@@ -1144,3 +1387,292 @@ good_area:
up_read(&mm->mmap_sem);
}
@@ -28496,10 +27939,10 @@ index e1d1069..2251ff3 100644
struct split_state {
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
-index dd38bfb..b72c63e 100644
+index 6d44087..cf48aa6 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
-@@ -261,16 +261,17 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
+@@ -259,16 +259,17 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
* PCI BIOS based config access (CONFIG_PCI_GOBIOS) support.
*/
if (within(pfn, BIOS_BEGIN >> PAGE_SHIFT, BIOS_END >> PAGE_SHIFT))
@@ -28520,7 +27963,7 @@ index dd38bfb..b72c63e 100644
/*
* The .rodata section needs to be read-only. Using the pfn
* catches all aliases.
-@@ -278,6 +279,14 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
+@@ -276,6 +277,14 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
if (within(pfn, __pa((unsigned long)__start_rodata) >> PAGE_SHIFT,
__pa((unsigned long)__end_rodata) >> PAGE_SHIFT))
pgprot_val(forbidden) |= _PAGE_RW;
@@ -28535,7 +27978,7 @@ index dd38bfb..b72c63e 100644
prot = __pgprot(pgprot_val(prot) & ~pgprot_val(forbidden));
-@@ -331,23 +340,37 @@ EXPORT_SYMBOL_GPL(lookup_address);
+@@ -329,23 +338,37 @@ EXPORT_SYMBOL_GPL(lookup_address);
static void __set_pmd_pte(pte_t *kpte, unsigned long address, pte_t pte)
{
/* change init_mm */
@@ -28676,7 +28119,7 @@ index df3d5c8..c2223e1 100644
p += get_opcode(p, &opcode);
for (i = 0; i < ARRAY_SIZE(imm_wop); i++)
diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
-index e0e6fad..7fe300d 100644
+index cb7cfc8..84a438a 100644
--- a/arch/x86/mm/pgtable.c
+++ b/arch/x86/mm/pgtable.c
@@ -83,9 +83,64 @@ static inline void pgd_list_del(pgd_t *pgd)
@@ -28746,15 +28189,15 @@ index e0e6fad..7fe300d 100644
static void pgd_ctor(pgd_t *pgd)
{
/* If the pgd points to a shared pagetable level (either the
-@@ -119,6 +174,7 @@ static void pgd_dtor(pgd_t *pgd)
+@@ -117,6 +172,7 @@ static void pgd_dtor(pgd_t *pgd)
pgd_list_del(pgd);
- spin_unlock_irqrestore(&pgd_lock, flags);
+ spin_unlock(&pgd_lock);
}
+#endif
/*
* List of all pgd's needed for non-PAE so it can invalidate entries
-@@ -131,7 +187,7 @@ static void pgd_dtor(pgd_t *pgd)
+@@ -129,7 +185,7 @@ static void pgd_dtor(pgd_t *pgd)
* -- wli
*/
@@ -28763,7 +28206,7 @@ index e0e6fad..7fe300d 100644
/*
* In PAE mode, we need to do a cr3 reload (=tlb flush) when
* updating the top-level pagetable entries to guarantee the
-@@ -143,7 +199,7 @@ static void pgd_dtor(pgd_t *pgd)
+@@ -141,7 +197,7 @@ static void pgd_dtor(pgd_t *pgd)
* not shared between pagetables (!SHARED_KERNEL_PMDS), we allocate
* and initialize the kernel pmds here.
*/
@@ -28772,7 +28215,7 @@ index e0e6fad..7fe300d 100644
void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
{
-@@ -161,36 +217,38 @@ void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
+@@ -159,36 +215,38 @@ void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
*/
flush_tlb_mm(mm);
}
@@ -28822,7 +28265,7 @@ index e0e6fad..7fe300d 100644
return -ENOMEM;
}
-@@ -203,51 +261,56 @@ static int preallocate_pmds(pmd_t *pmds[])
+@@ -201,51 +259,55 @@ static int preallocate_pmds(pmd_t *pmds[])
* preallocate which never got a corresponding vma will need to be
* freed manually.
*/
@@ -28892,11 +28335,10 @@ index e0e6fad..7fe300d 100644
pgd_t *pgd;
- pmd_t *pmds[PREALLOCATED_PMDS];
+ pxd_t *pxds[PREALLOCATED_PXDS];
-+
- unsigned long flags;
pgd = (pgd_t *)__get_free_page(PGALLOC_GFP);
-@@ -257,11 +320,11 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
+
+@@ -254,11 +316,11 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
mm->pgd = pgd;
@@ -28910,14 +28352,14 @@ index e0e6fad..7fe300d 100644
/*
* Make sure that pre-populating the pmds is atomic with
-@@ -271,14 +334,14 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
- spin_lock_irqsave(&pgd_lock, flags);
+@@ -268,14 +330,14 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
+ spin_lock(&pgd_lock);
pgd_ctor(pgd);
- pgd_prepopulate_pmd(mm, pgd, pmds);
+ pgd_prepopulate_pxd(mm, pgd, pxds);
- spin_unlock_irqrestore(&pgd_lock, flags);
+ spin_unlock(&pgd_lock);
return pgd;
@@ -28928,7 +28370,7 @@ index e0e6fad..7fe300d 100644
out_free_pgd:
free_page((unsigned long)pgd);
out:
-@@ -287,7 +350,7 @@ out:
+@@ -284,7 +346,7 @@ out:
void pgd_free(struct mm_struct *mm, pgd_t *pgd)
{
@@ -29041,7 +28483,7 @@ index 36fe08e..b123d3a 100644
EXPORT_SYMBOL_GPL(leave_mm);
diff --git a/arch/x86/oprofile/backtrace.c b/arch/x86/oprofile/backtrace.c
-index 829edf0..672adb3 100644
+index b50a280..ada6ded 100644
--- a/arch/x86/oprofile/backtrace.c
+++ b/arch/x86/oprofile/backtrace.c
@@ -115,7 +115,7 @@ x86_backtrace(struct pt_regs * const regs, unsigned int depth)
@@ -29841,7 +29283,7 @@ index 21e1aeb..2c0b3c4 100644
-}
-__setup("vdso=", vdso_setup);
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
-index 0087b00..ba03036 100644
+index d52f895..ba03036 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -71,8 +71,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
@@ -29881,18 +29323,7 @@ index 0087b00..ba03036 100644
}
#endif
-@@ -945,7 +943,10 @@ static const struct pv_cpu_ops xen_cpu_ops __initdata = {
- .wbinvd = native_wbinvd,
-
- .read_msr = native_read_msr_safe,
-+ .rdmsr_regs = native_rdmsr_safe_regs,
- .write_msr = xen_write_msr_safe,
-+ .wrmsr_regs = native_wrmsr_safe_regs,
-+
- .read_tsc = native_read_tsc,
- .read_pmc = native_read_pmc,
-
-@@ -993,7 +994,7 @@ static const struct pv_apic_ops xen_apic_ops __initdata = {
+@@ -996,7 +994,7 @@ static const struct pv_apic_ops xen_apic_ops __initdata = {
#endif
};
@@ -29901,7 +29332,7 @@ index 0087b00..ba03036 100644
{
struct sched_shutdown r = { .reason = reason };
-@@ -1001,17 +1002,17 @@ static void xen_reboot(int reason)
+@@ -1004,17 +1002,17 @@ static void xen_reboot(int reason)
BUG();
}
@@ -29922,7 +29353,7 @@ index 0087b00..ba03036 100644
{
xen_reboot(SHUTDOWN_poweroff);
}
-@@ -1095,9 +1096,20 @@ asmlinkage void __init xen_start_kernel(void)
+@@ -1098,9 +1096,20 @@ asmlinkage void __init xen_start_kernel(void)
*/
__userpte_alloc_gfp &= ~__GFP_HIGHMEM;
@@ -29945,7 +29376,7 @@ index 0087b00..ba03036 100644
#endif
xen_setup_features();
-@@ -1129,13 +1141,6 @@ asmlinkage void __init xen_start_kernel(void)
+@@ -1132,13 +1141,6 @@ asmlinkage void __init xen_start_kernel(void)
machine_ops = xen_machine_ops;
@@ -29960,10 +29391,10 @@ index 0087b00..ba03036 100644
pgd = (pgd_t *)xen_start_info->pt_base;
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
-index 3f90a2c..2c2ad84 100644
+index 8f4452c..38873e5 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
-@@ -1719,6 +1719,9 @@ __init pgd_t *xen_setup_kernel_pagetable(pgd_t *pgd,
+@@ -1717,6 +1717,9 @@ __init pgd_t *xen_setup_kernel_pagetable(pgd_t *pgd,
convert_pfn_mfn(init_level4_pgt);
convert_pfn_mfn(level3_ident_pgt);
convert_pfn_mfn(level3_kernel_pgt);
@@ -29973,7 +29404,7 @@ index 3f90a2c..2c2ad84 100644
l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd);
l2 = m2v(l3[pud_index(__START_KERNEL_map)].pud);
-@@ -1737,7 +1740,11 @@ __init pgd_t *xen_setup_kernel_pagetable(pgd_t *pgd,
+@@ -1735,7 +1738,11 @@ __init pgd_t *xen_setup_kernel_pagetable(pgd_t *pgd,
set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
@@ -29985,7 +29416,7 @@ index 3f90a2c..2c2ad84 100644
set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
-@@ -1860,6 +1867,7 @@ static __init void xen_post_allocator_init(void)
+@@ -1858,6 +1865,7 @@ static __init void xen_post_allocator_init(void)
pv_mmu_ops.set_pud = xen_set_pud;
#if PAGETABLE_LEVELS == 4
pv_mmu_ops.set_pgd = xen_set_pgd;
@@ -29993,7 +29424,7 @@ index 3f90a2c..2c2ad84 100644
#endif
/* This will work as long as patching hasn't happened yet
-@@ -1946,6 +1954,7 @@ static const struct pv_mmu_ops xen_mmu_ops __initdata = {
+@@ -1944,6 +1952,7 @@ static const struct pv_mmu_ops xen_mmu_ops __initdata = {
.pud_val = PV_CALLEE_SAVE(xen_pud_val),
.make_pud = PV_CALLEE_SAVE(xen_make_pud),
.set_pgd = xen_set_pgd_hyper,
@@ -30069,19 +29500,6 @@ index a96204a..fca9b8e 100644
#endif
xen_setup_runstate_info(cpu);
xen_setup_timer(cpu);
-diff --git a/arch/x86/xen/xen-asm.S b/arch/x86/xen/xen-asm.S
-index 79d7362..3e45aa0 100644
---- a/arch/x86/xen/xen-asm.S
-+++ b/arch/x86/xen/xen-asm.S
-@@ -96,7 +96,7 @@ ENTRY(xen_restore_fl_direct)
-
- /* check for unmasked and pending */
- cmpw $0x0001, PER_CPU_VAR(xen_vcpu_info) + XEN_vcpu_info_pending
-- jz 1f
-+ jnz 1f
- 2: call check_events
- 1:
- ENDPATCH(xen_restore_fl_direct)
diff --git a/arch/x86/xen/xen-asm_32.S b/arch/x86/xen/xen-asm_32.S
index 9a95a9c..4f39e774 100644
--- a/arch/x86/xen/xen-asm_32.S
@@ -30216,39 +29634,6 @@ index 15c6308..96e83c2 100644
.show = &integrity_attr_show,
.store = &integrity_attr_store,
};
-diff --git a/block/blk-ioc.c b/block/blk-ioc.c
-index d4ed600..cbdabb0 100644
---- a/block/blk-ioc.c
-+++ b/block/blk-ioc.c
-@@ -66,22 +66,22 @@ static void cfq_exit(struct io_context *ioc)
- }
-
- /* Called by the exitting task */
--void exit_io_context(void)
-+void exit_io_context(struct task_struct *task)
- {
- struct io_context *ioc;
-
-- task_lock(current);
-- ioc = current->io_context;
-- current->io_context = NULL;
-- task_unlock(current);
-+ task_lock(task);
-+ ioc = task->io_context;
-+ task->io_context = NULL;
-+ task_unlock(task);
-
- if (atomic_dec_and_test(&ioc->nr_tasks)) {
- if (ioc->aic && ioc->aic->exit)
- ioc->aic->exit(ioc->aic);
- cfq_exit(ioc);
-
-- put_io_context(ioc);
- }
-+ put_io_context(ioc);
- }
-
- struct io_context *alloc_io_context(gfp_t gfp_flags, int node)
diff --git a/block/blk-iopoll.c b/block/blk-iopoll.c
index ca56420..f2fc409 100644
--- a/block/blk-iopoll.c
@@ -34675,65 +34060,10 @@ index 62f282e..e45c45c 100644
cdev_init(&ptmx_cdev, &ptmx_fops);
if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
diff --git a/drivers/char/random.c b/drivers/char/random.c
-index 3a19e2d..7d9aaad 100644
+index 446b20a..8657325 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
-@@ -125,20 +125,32 @@
- * The current exported interfaces for gathering environmental noise
- * from the devices are:
- *
-+ * void add_device_randomness(const void *buf, unsigned int size);
- * void add_input_randomness(unsigned int type, unsigned int code,
- * unsigned int value);
-- * void add_interrupt_randomness(int irq);
-+ * void add_interrupt_randomness(int irq, int irq_flags);
-+ * void add_disk_randomness(struct gendisk *disk);
-+ *
-+ * add_device_randomness() is for adding data to the random pool that
-+ * is likely to differ between two devices (or possibly even per boot).
-+ * This would be things like MAC addresses or serial numbers, or the
-+ * read-out of the RTC. This does *not* add any actual entropy to the
-+ * pool, but it initializes the pool to different values for devices
-+ * that might otherwise be identical and have very little entropy
-+ * available to them (particularly common in the embedded world).
- *
- * add_input_randomness() uses the input layer interrupt timing, as well as
- * the event type information from the hardware.
- *
-- * add_interrupt_randomness() uses the inter-interrupt timing as random
-- * inputs to the entropy pool. Note that not all interrupts are good
-- * sources of randomness! For example, the timer interrupts is not a
-- * good choice, because the periodicity of the interrupts is too
-- * regular, and hence predictable to an attacker. Disk interrupts are
-- * a better measure, since the timing of the disk interrupts are more
-- * unpredictable.
-+ * add_interrupt_randomness() uses the interrupt timing as random
-+ * inputs to the entropy pool. Using the cycle counters and the irq source
-+ * as inputs, it feeds the randomness roughly once a second.
-+ *
-+ * add_disk_randomness() uses what amounts to the seek time of block
-+ * layer request events, on a per-disk_devt basis, as input to the
-+ * entropy pool. Note that high-speed solid state drives with very low
-+ * seek times do not make for good sources of entropy, as their seek
-+ * times are usually fairly consistent.
- *
- * All of these routines try to estimate how many bits of randomness a
- * particular randomness source. They do this by keeping track of the
-@@ -241,6 +253,7 @@
- #include <linux/percpu.h>
- #include <linux/cryptohash.h>
- #include <linux/fips.h>
-+#include <linux/ptrace.h>
-
- #ifdef CONFIG_GENERIC_HARDIRQS
- # include <linux/irq.h>
-@@ -249,14 +262,23 @@
- #include <asm/processor.h>
- #include <asm/uaccess.h>
- #include <asm/irq.h>
-+#include <asm/irq_regs.h>
- #include <asm/io.h>
-
+@@ -269,8 +269,13 @@
/*
* Configuration information
*/
@@ -34745,13 +34075,9 @@ index 3a19e2d..7d9aaad 100644
#define OUTPUT_POOL_WORDS 32
+#endif
#define SEC_XFER_SIZE 512
-+#define EXTRACT_SIZE 10
-+
-+#define LONGS(x) (((x) + sizeof(unsigned long) - 1)/sizeof(unsigned long))
+ #define EXTRACT_SIZE 10
- /*
- * The minimum number of bits of entropy before we wake up a read on
-@@ -292,10 +314,17 @@ static struct poolinfo {
+@@ -310,10 +315,17 @@ static struct poolinfo {
int poolwords;
int tap1, tap2, tap3, tap4, tap5;
} poolinfo_table[] = {
@@ -34769,261 +34095,21 @@ index 3a19e2d..7d9aaad 100644
#if 0
/* x^2048 + x^1638 + x^1231 + x^819 + x^411 + x + 1 -- 115 */
{ 2048, 1638, 1231, 819, 411, 1 },
-@@ -412,9 +441,11 @@ struct entropy_store {
- /* read-write data: */
- spinlock_t lock;
- unsigned add_ptr;
-+ unsigned input_rotate;
- int entropy_count;
-- int input_rotate;
-- __u8 *last_data;
-+ int entropy_total;
-+ unsigned int initialized:1;
-+ __u8 last_data[EXTRACT_SIZE];
- };
-
- static __u32 input_pool_data[INPUT_POOL_WORDS];
-@@ -446,6 +477,10 @@ static struct entropy_store nonblocking_pool = {
- .pool = nonblocking_pool_data
- };
-
-+static __u32 const twist_table[8] = {
-+ 0x00000000, 0x3b6e20c8, 0x76dc4190, 0x4db26158,
-+ 0xedb88320, 0xd6d6a3e8, 0x9b64c2b0, 0xa00ae278 };
-+
- /*
- * This function adds bytes into the entropy "pool". It does not
- * update the entropy estimate. The caller should call
-@@ -456,29 +491,24 @@ static struct entropy_store nonblocking_pool = {
- * it's cheap to do so and helps slightly in the expected case where
- * the entropy is concentrated in the low-order bits.
- */
--static void mix_pool_bytes_extract(struct entropy_store *r, const void *in,
-- int nbytes, __u8 out[64])
-+static void __mix_pool_bytes(struct entropy_store *r, const void *in,
-+ int nbytes, __u8 out[64])
- {
-- static __u32 const twist_table[8] = {
-- 0x00000000, 0x3b6e20c8, 0x76dc4190, 0x4db26158,
-- 0xedb88320, 0xd6d6a3e8, 0x9b64c2b0, 0xa00ae278 };
- unsigned long i, j, tap1, tap2, tap3, tap4, tap5;
- int input_rotate;
- int wordmask = r->poolinfo->poolwords - 1;
- const char *bytes = in;
- __u32 w;
-- unsigned long flags;
-
-- /* Taps are constant, so we can load them without holding r->lock. */
- tap1 = r->poolinfo->tap1;
- tap2 = r->poolinfo->tap2;
- tap3 = r->poolinfo->tap3;
- tap4 = r->poolinfo->tap4;
- tap5 = r->poolinfo->tap5;
-
-- spin_lock_irqsave(&r->lock, flags);
-- input_rotate = r->input_rotate;
-- i = r->add_ptr;
-+ smp_rmb();
-+ input_rotate = ACCESS_ONCE(r->input_rotate);
-+ i = ACCESS_ONCE(r->add_ptr);
-
- /* mix one byte at a time to simplify size handling and churn faster */
- while (nbytes--) {
-@@ -505,19 +535,53 @@ static void mix_pool_bytes_extract(struct entropy_store *r, const void *in,
+@@ -524,8 +536,8 @@ static void __mix_pool_bytes(struct entropy_store *r, const void *in,
input_rotate += i ? 7 : 14;
}
-- r->input_rotate = input_rotate;
-- r->add_ptr = i;
+- ACCESS_ONCE(r->input_rotate) = input_rotate;
+- ACCESS_ONCE(r->add_ptr) = i;
+ ACCESS_ONCE_RW(r->input_rotate) = input_rotate;
+ ACCESS_ONCE_RW(r->add_ptr) = i;
-+ smp_wmb();
+ smp_wmb();
if (out)
- for (j = 0; j < 16; j++)
- ((__u32 *)out)[j] = r->pool[(i - j) & wordmask];
-+}
-
-+static void mix_pool_bytes(struct entropy_store *r, const void *in,
-+ int nbytes, __u8 out[64])
-+{
-+ unsigned long flags;
-+
-+ spin_lock_irqsave(&r->lock, flags);
-+ __mix_pool_bytes(r, in, nbytes, out);
- spin_unlock_irqrestore(&r->lock, flags);
- }
-
--static void mix_pool_bytes(struct entropy_store *r, const void *in, int bytes)
-+struct fast_pool {
-+ __u32 pool[4];
-+ unsigned long last;
-+ unsigned short count;
-+ unsigned char rotate;
-+ unsigned char last_timer_intr;
-+};
-+
-+/*
-+ * This is a fast mixing routine used by the interrupt randomness
-+ * collector. It's hardcoded for an 128 bit pool and assumes that any
-+ * locks that might be needed are taken by the caller.
-+ */
-+static void fast_mix(struct fast_pool *f, const void *in, int nbytes)
- {
-- mix_pool_bytes_extract(r, in, bytes, NULL);
-+ const char *bytes = in;
-+ __u32 w;
-+ unsigned i = f->count;
-+ unsigned input_rotate = f->rotate;
-+
-+ while (nbytes--) {
-+ w = rol32(*bytes++, input_rotate & 31) ^ f->pool[i & 3] ^
-+ f->pool[(i + 1) & 3];
-+ f->pool[i & 3] = (w >> 3) ^ twist_table[w & 7];
-+ input_rotate += (i++ & 3) ? 7 : 14;
-+ }
-+ f->count = i;
-+ f->rotate = input_rotate;
- }
-
- /*
-@@ -525,30 +589,34 @@ static void mix_pool_bytes(struct entropy_store *r, const void *in, int bytes)
- */
- static void credit_entropy_bits(struct entropy_store *r, int nbits)
- {
-- unsigned long flags;
-- int entropy_count;
-+ int entropy_count, orig;
-
- if (!nbits)
- return;
-
-- spin_lock_irqsave(&r->lock, flags);
--
- DEBUG_ENT("added %d entropy credits to %s\n", nbits, r->name);
-- entropy_count = r->entropy_count;
-+retry:
-+ entropy_count = orig = ACCESS_ONCE(r->entropy_count);
- entropy_count += nbits;
- if (entropy_count < 0) {
- DEBUG_ENT("negative entropy/overflow\n");
- entropy_count = 0;
- } else if (entropy_count > r->poolinfo->POOLBITS)
- entropy_count = r->poolinfo->POOLBITS;
-- r->entropy_count = entropy_count;
-+ if (cmpxchg(&r->entropy_count, orig, entropy_count) != orig)
-+ goto retry;
-+
-+ if (!r->initialized && nbits > 0) {
-+ r->entropy_total += nbits;
-+ if (r->entropy_total > 128)
-+ r->initialized = 1;
-+ }
-
- /* should we wake readers? */
- if (r == &input_pool && entropy_count >= random_read_wakeup_thresh) {
- wake_up_interruptible(&random_read_wait);
- kill_fasync(&fasync, SIGIO, POLL_IN);
- }
-- spin_unlock_irqrestore(&r->lock, flags);
- }
-
- /*********************************************************************
-@@ -601,6 +669,25 @@ static void set_timer_rand_state(unsigned int irq,
- }
- #endif
-
-+/*
-+ * Add device- or boot-specific data to the input and nonblocking
-+ * pools to help initialize them to unique values.
-+ *
-+ * None of this adds any entropy, it is meant to avoid the
-+ * problem of the nonblocking pool having similar initial state
-+ * across largely identical devices.
-+ */
-+void add_device_randomness(const void *buf, unsigned int size)
-+{
-+ unsigned long time = get_cycles() ^ jiffies;
-+
-+ mix_pool_bytes(&input_pool, buf, size, NULL);
-+ mix_pool_bytes(&input_pool, &time, sizeof(time), NULL);
-+ mix_pool_bytes(&nonblocking_pool, buf, size, NULL);
-+ mix_pool_bytes(&nonblocking_pool, &time, sizeof(time), NULL);
-+}
-+EXPORT_SYMBOL(add_device_randomness);
-+
- static struct timer_rand_state input_timer_state;
-
- /*
-@@ -631,7 +718,7 @@ static void add_timer_randomness(struct timer_rand_state *state, unsigned num)
- sample.jiffies = jiffies;
- sample.cycles = get_cycles();
- sample.num = num;
-- mix_pool_bytes(&input_pool, &sample, sizeof(sample));
-+ mix_pool_bytes(&input_pool, &sample, sizeof(sample), NULL);
-
- /*
- * Calculate number of bits of randomness we probably added.
-@@ -688,17 +775,48 @@ void add_input_randomness(unsigned int type, unsigned int code,
- }
- EXPORT_SYMBOL_GPL(add_input_randomness);
-
--void add_interrupt_randomness(int irq)
-+static DEFINE_PER_CPU(struct fast_pool, irq_randomness);
-+
-+void add_interrupt_randomness(int irq, int irq_flags)
- {
-- struct timer_rand_state *state;
-+ struct entropy_store *r;
-+ struct fast_pool *fast_pool = &__get_cpu_var(irq_randomness);
-+ struct pt_regs *regs = get_irq_regs();
-+ unsigned long now = jiffies;
-+ __u32 input[4], cycles = get_cycles();
-
-- state = get_timer_rand_state(irq);
-+ input[0] = cycles ^ jiffies;
-+ input[1] = irq;
-+ if (regs) {
-+ __u64 ip = instruction_pointer(regs);
-+ input[2] = ip;
-+ input[3] = ip >> 32;
-+ }
-
-- if (state == NULL)
-+ fast_mix(fast_pool, input, sizeof(input));
-+
-+ if ((fast_pool->count & 255) &&
-+ !time_after(now, fast_pool->last + HZ))
- return;
-
-- DEBUG_ENT("irq event %d\n", irq);
-- add_timer_randomness(state, 0x100 + irq);
-+ fast_pool->last = now;
-+
-+ r = nonblocking_pool.initialized ? &input_pool : &nonblocking_pool;
-+ __mix_pool_bytes(r, &fast_pool->pool, sizeof(fast_pool->pool), NULL);
-+ /*
-+ * If we don't have a valid cycle counter, and we see
-+ * back-to-back timer interrupts, then skip giving credit for
-+ * any entropy.
-+ */
-+ if (cycles == 0) {
-+ if (irq_flags & __IRQF_TIMER) {
-+ if (fast_pool->last_timer_intr)
-+ return;
-+ fast_pool->last_timer_intr = 1;
-+ } else
-+ fast_pool->last_timer_intr = 0;
-+ }
-+ credit_entropy_bits(r, 1);
- }
-
- #ifdef CONFIG_BLOCK
-@@ -714,7 +832,16 @@ void add_disk_randomness(struct gendisk *disk)
+@@ -784,6 +796,17 @@ void add_disk_randomness(struct gendisk *disk)
}
#endif
--#define EXTRACT_SIZE 10
+#ifdef CONFIG_PAX_LATENT_ENTROPY
+u64 latent_entropy;
+
@@ -35034,117 +34120,11 @@ index 3a19e2d..7d9aaad 100644
+// printk(KERN_INFO "PAX: transferring latent entropy: %16llx\n", latent_entropy);
+}
+#endif
-
++
/*********************************************************************
*
-@@ -732,7 +859,7 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
- */
- static void xfer_secondary_pool(struct entropy_store *r, size_t nbytes)
- {
-- __u32 tmp[OUTPUT_POOL_WORDS];
-+ __u32 tmp[OUTPUT_POOL_WORDS];
-
- if (r->pull && r->entropy_count < nbytes * 8 &&
- r->entropy_count < r->poolinfo->POOLBITS) {
-@@ -751,7 +878,7 @@ static void xfer_secondary_pool(struct entropy_store *r, size_t nbytes)
-
- bytes = extract_entropy(r->pull, tmp, bytes,
- random_read_wakeup_thresh / 8, rsvd);
-- mix_pool_bytes(r, tmp, bytes);
-+ mix_pool_bytes(r, tmp, bytes, NULL);
- credit_entropy_bits(r, bytes*8);
- }
- }
-@@ -810,13 +937,19 @@ static size_t account(struct entropy_store *r, size_t nbytes, int min,
- static void extract_buf(struct entropy_store *r, __u8 *out)
- {
- int i;
-- __u32 hash[5], workspace[SHA_WORKSPACE_WORDS];
-+ union {
-+ __u32 w[5];
-+ unsigned long l[LONGS(EXTRACT_SIZE)];
-+ } hash;
-+ __u32 workspace[SHA_WORKSPACE_WORDS];
- __u8 extract[64];
-+ unsigned long flags;
-
- /* Generate a hash across the pool, 16 words (512 bits) at a time */
-- sha_init(hash);
-+ sha_init(hash.w);
-+ spin_lock_irqsave(&r->lock, flags);
- for (i = 0; i < r->poolinfo->poolwords; i += 16)
-- sha_transform(hash, (__u8 *)(r->pool + i), workspace);
-+ sha_transform(hash.w, (__u8 *)(r->pool + i), workspace);
-
- /*
- * We mix the hash back into the pool to prevent backtracking
-@@ -827,13 +960,14 @@ static void extract_buf(struct entropy_store *r, __u8 *out)
- * brute-forcing the feedback as hard as brute-forcing the
- * hash.
- */
-- mix_pool_bytes_extract(r, hash, sizeof(hash), extract);
-+ __mix_pool_bytes(r, hash.w, sizeof(hash.w), extract);
-+ spin_unlock_irqrestore(&r->lock, flags);
-
- /*
- * To avoid duplicates, we atomically extract a portion of the
- * pool while mixing, and hash one final time.
- */
-- sha_transform(hash, extract, workspace);
-+ sha_transform(hash.w, extract, workspace);
- memset(extract, 0, sizeof(extract));
- memset(workspace, 0, sizeof(workspace));
-
-@@ -842,19 +976,30 @@ static void extract_buf(struct entropy_store *r, __u8 *out)
- * pattern, we fold it in half. Thus, we always feed back
- * twice as much data as we output.
- */
-- hash[0] ^= hash[3];
-- hash[1] ^= hash[4];
-- hash[2] ^= rol32(hash[2], 16);
-- memcpy(out, hash, EXTRACT_SIZE);
-- memset(hash, 0, sizeof(hash));
-+ hash.w[0] ^= hash.w[3];
-+ hash.w[1] ^= hash.w[4];
-+ hash.w[2] ^= rol32(hash.w[2], 16);
-+
-+ /*
-+ * If we have a architectural hardware random number
-+ * generator, mix that in, too.
-+ */
-+ for (i = 0; i < LONGS(EXTRACT_SIZE); i++) {
-+ unsigned long v;
-+ if (!arch_get_random_long(&v))
-+ break;
-+ hash.l[i] ^= v;
-+ }
-+
-+ memcpy(out, &hash, EXTRACT_SIZE);
-+ memset(&hash, 0, sizeof(hash));
- }
-
- static ssize_t extract_entropy(struct entropy_store *r, void *buf,
-- size_t nbytes, int min, int reserved)
-+ size_t nbytes, int min, int reserved)
- {
- ssize_t ret = 0, i;
- __u8 tmp[EXTRACT_SIZE];
-- unsigned long flags;
-
- xfer_secondary_pool(r, nbytes);
- nbytes = account(r, nbytes, min, reserved);
-@@ -862,7 +1007,9 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
- while (nbytes) {
- extract_buf(r, tmp);
-
-- if (r->last_data) {
-+ if (fips_enabled) {
-+ unsigned long flags;
-+
- spin_lock_irqsave(&r->lock, flags);
- if (!memcmp(tmp, r->last_data, EXTRACT_SIZE))
- panic("Hardware RNG duplicated output!\n");
-@@ -926,7 +1073,21 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf,
+ * Entropy extraction routines
+@@ -1015,7 +1038,21 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf,
*/
void get_random_bytes(void *buf, int nbytes)
{
@@ -35167,47 +34147,7 @@ index 3a19e2d..7d9aaad 100644
}
EXPORT_SYMBOL(get_random_bytes);
-@@ -941,19 +1102,19 @@ EXPORT_SYMBOL(get_random_bytes);
- */
- static void init_std_data(struct entropy_store *r)
- {
-- ktime_t now;
-- unsigned long flags;
-+ int i;
-+ ktime_t now = ktime_get_real();
-+ unsigned long rv;
-
-- spin_lock_irqsave(&r->lock, flags);
- r->entropy_count = 0;
-- spin_unlock_irqrestore(&r->lock, flags);
--
-- now = ktime_get_real();
-- mix_pool_bytes(r, &now, sizeof(now));
-- mix_pool_bytes(r, utsname(), sizeof(*(utsname())));
-- /* Enable continuous test in fips mode */
-- if (fips_enabled)
-- r->last_data = kmalloc(EXTRACT_SIZE, GFP_KERNEL);
-+ r->entropy_total = 0;
-+ mix_pool_bytes(r, &now, sizeof(now), NULL);
-+ for (i = r->poolinfo->POOLBYTES; i > 0; i -= sizeof(rv)) {
-+ if (!arch_get_random_long(&rv))
-+ break;
-+ mix_pool_bytes(r, &rv, sizeof(rv), NULL);
-+ }
-+ mix_pool_bytes(r, utsname(), sizeof(*(utsname())), NULL);
- }
-
- static int rand_initialize(void)
-@@ -1090,7 +1251,7 @@ write_pool(struct entropy_store *r, const char __user *buffer, size_t count)
- count -= bytes;
- p += bytes;
-
-- mix_pool_bytes(r, buf, bytes);
-+ mix_pool_bytes(r, buf, bytes, NULL);
- cond_resched();
- }
-
-@@ -1209,7 +1370,7 @@ EXPORT_SYMBOL(generate_random_uuid);
+@@ -1322,7 +1359,7 @@ EXPORT_SYMBOL(generate_random_uuid);
#include <linux/sysctl.h>
static int min_read_thresh = 8, min_write_thresh;
@@ -35216,26 +34156,7 @@ index 3a19e2d..7d9aaad 100644
static int max_write_thresh = INPUT_POOL_WORDS * 32;
static char sysctl_bootid[16];
-@@ -1231,10 +1392,15 @@ static int proc_do_uuid(ctl_table *table, int write,
- uuid = table->data;
- if (!uuid) {
- uuid = tmp_uuid;
-- uuid[8] = 0;
-- }
-- if (uuid[8] == 0)
- generate_random_uuid(uuid);
-+ } else {
-+ static DEFINE_SPINLOCK(bootid_spinlock);
-+
-+ spin_lock(&bootid_spinlock);
-+ if (!uuid[8])
-+ generate_random_uuid(uuid);
-+ spin_unlock(&bootid_spinlock);
-+ }
-
- sprintf(buf, "%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-"
- "%02x%02x%02x%02x%02x%02x",
-@@ -1279,6 +1445,7 @@ static int uuid_strategy(ctl_table *table,
+@@ -1397,6 +1434,7 @@ static int uuid_strategy(ctl_table *table,
}
static int sysctl_poolsize = INPUT_POOL_WORDS * 32;
@@ -35243,7 +34164,7 @@ index 3a19e2d..7d9aaad 100644
ctl_table random_table[] = {
{
.ctl_name = RANDOM_POOLSIZE,
-@@ -1354,12 +1521,17 @@ late_initcall(random_int_secret_init);
+@@ -1472,7 +1510,7 @@ late_initcall(random_int_secret_init);
* value is not cryptographically secure but for several uses the cost of
* depleting entropy is too high
*/
@@ -35251,18 +34172,7 @@ index 3a19e2d..7d9aaad 100644
+static DEFINE_PER_CPU(__u32 [MD5_DIGEST_WORDS], get_random_int_hash);
unsigned int get_random_int(void)
{
-- __u32 *hash = get_cpu_var(get_random_int_hash);
-+ __u32 *hash;
- unsigned int ret;
-
-+ if (arch_get_random_int(&ret))
-+ return ret;
-+
-+ hash = get_cpu_var(get_random_int_hash);
-+
- hash[0] += current->pid + jiffies + get_cycles();
- md5_transform(hash, random_int_secret);
- ret = hash[0];
+ __u32 *hash;
diff --git a/drivers/char/rocket.c b/drivers/char/rocket.c
index 0e29a23..0efc2c2 100644
--- a/drivers/char/rocket.c
@@ -35413,22 +34323,6 @@ index bf2170f..ce8cab9 100644
acpi_os_unmap_memory(virt, len);
return 0;
-diff --git a/drivers/char/tty_audit.c b/drivers/char/tty_audit.c
-index ac16fbe..dd4691a 100644
---- a/drivers/char/tty_audit.c
-+++ b/drivers/char/tty_audit.c
-@@ -94,8 +94,10 @@ static void tty_audit_buf_push(struct task_struct *tsk, uid_t loginuid,
- {
- if (buf->valid == 0)
- return;
-- if (audit_enabled == 0)
-+ if (audit_enabled == 0) {
-+ buf->valid = 0;
- return;
-+ }
- tty_audit_log("tty", tsk, loginuid, sessionid, buf->major, buf->minor,
- buf->data, buf->valid);
- buf->valid = 0;
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index 123cedf..6664cb4 100644
--- a/drivers/char/tty_io.c
@@ -36152,27 +35046,10 @@ index 7ff6e75..a2965d9 100644
void fw_card_initialize(struct fw_card *card,
const struct fw_card_driver *driver, struct device *device);
diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
-index 3a2ccb0..8365cd1 100644
+index 10a4246..8365cd1 100644
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
-@@ -6,6 +6,7 @@
- #include <linux/efi.h>
- #include <linux/bootmem.h>
- #include <linux/slab.h>
-+#include <linux/random.h>
- #include <asm/dmi.h>
-
- /*
-@@ -111,6 +112,8 @@ static int __init dmi_walk_early(void (*decode)(const struct dmi_header *,
-
- dmi_table(buf, dmi_len, dmi_num, decode, NULL);
-
-+ add_device_randomness(buf, dmi_len);
-+
- dmi_iounmap(buf, dmi_len);
- return 0;
- }
-@@ -391,11 +394,6 @@ void __init dmi_scan_machine(void)
+@@ -394,11 +394,6 @@ void __init dmi_scan_machine(void)
}
}
else {
@@ -36184,7 +35061,7 @@ index 3a2ccb0..8365cd1 100644
p = dmi_ioremap(0xF0000, 0x10000);
if (p == NULL)
goto error;
-@@ -667,7 +665,7 @@ int dmi_walk(void (*decode)(const struct dmi_header *, void *),
+@@ -670,7 +665,7 @@ int dmi_walk(void (*decode)(const struct dmi_header *, void *),
if (buf == NULL)
return -1;
@@ -41450,19 +40327,6 @@ index 726a1b8..f46b460 100644
DEBUG(MTD_DEBUG_LEVEL0, "MTD_ioctl\n");
size = (cmd & IOCSIZE_MASK) >> IOCSIZE_SHIFT;
-diff --git a/drivers/mtd/nand/cafe_nand.c b/drivers/mtd/nand/cafe_nand.c
-index c828d9a..97b9c7b 100644
---- a/drivers/mtd/nand/cafe_nand.c
-+++ b/drivers/mtd/nand/cafe_nand.c
-@@ -103,7 +103,7 @@ static const char *part_probes[] = { "cmdlinepart", "RedBoot", NULL };
- static int cafe_device_ready(struct mtd_info *mtd)
- {
- struct cafe_priv *cafe = mtd->priv;
-- int result = !!(cafe_readl(cafe, NAND_STATUS) | 0x40000000);
-+ int result = !!(cafe_readl(cafe, NAND_STATUS) & 0x40000000);
- uint32_t irqs = cafe_readl(cafe, NAND_IRQ);
-
- cafe_writel(cafe, irqs, NAND_IRQ);
diff --git a/drivers/mtd/nftlcore.c b/drivers/mtd/nftlcore.c
index 1002e18..26d82d5 100644
--- a/drivers/mtd/nftlcore.c
@@ -54173,94 +53037,11 @@ index 032cfe0..411af379 100644
/*
* Card information is normally at VPD_BASE but some early cards had
* it at 0.
-diff --git a/drivers/net/dl2k.c b/drivers/net/dl2k.c
-index 7fa7a90..fef924d 100644
---- a/drivers/net/dl2k.c
-+++ b/drivers/net/dl2k.c
-@@ -1279,55 +1279,21 @@ rio_ioctl (struct net_device *dev, struct ifreq *rq, int cmd)
- {
- int phy_addr;
- struct netdev_private *np = netdev_priv(dev);
-- struct mii_data *miidata = (struct mii_data *) &rq->ifr_ifru;
--
-- struct netdev_desc *desc;
-- int i;
-+ struct mii_ioctl_data *miidata = if_mii(rq);
-
- phy_addr = np->phy_addr;
- switch (cmd) {
-- case SIOCDEVPRIVATE:
-+ case SIOCGMIIPHY:
-+ miidata->phy_id = phy_addr;
- break;
--
-- case SIOCDEVPRIVATE + 1:
-- miidata->out_value = mii_read (dev, phy_addr, miidata->reg_num);
-+ case SIOCGMIIREG:
-+ miidata->val_out = mii_read (dev, phy_addr, miidata->reg_num);
- break;
-- case SIOCDEVPRIVATE + 2:
-- mii_write (dev, phy_addr, miidata->reg_num, miidata->in_value);
-+ case SIOCSMIIREG:
-+ if (!capable(CAP_NET_ADMIN))
-+ return -EPERM;
-+ mii_write (dev, phy_addr, miidata->reg_num, miidata->val_in);
- break;
-- case SIOCDEVPRIVATE + 3:
-- break;
-- case SIOCDEVPRIVATE + 4:
-- break;
-- case SIOCDEVPRIVATE + 5:
-- netif_stop_queue (dev);
-- break;
-- case SIOCDEVPRIVATE + 6:
-- netif_wake_queue (dev);
-- break;
-- case SIOCDEVPRIVATE + 7:
-- printk
-- ("tx_full=%x cur_tx=%lx old_tx=%lx cur_rx=%lx old_rx=%lx\n",
-- netif_queue_stopped(dev), np->cur_tx, np->old_tx, np->cur_rx,
-- np->old_rx);
-- break;
-- case SIOCDEVPRIVATE + 8:
-- printk("TX ring:\n");
-- for (i = 0; i < TX_RING_SIZE; i++) {
-- desc = &np->tx_ring[i];
-- printk
-- ("%02x:cur:%08x next:%08x status:%08x frag1:%08x frag0:%08x",
-- i,
-- (u32) (np->tx_ring_dma + i * sizeof (*desc)),
-- (u32)le64_to_cpu(desc->next_desc),
-- (u32)le64_to_cpu(desc->status),
-- (u32)(le64_to_cpu(desc->fraginfo) >> 32),
-- (u32)le64_to_cpu(desc->fraginfo));
-- printk ("\n");
-- }
-- printk ("\n");
-- break;
--
- default:
- return -EOPNOTSUPP;
- }
diff --git a/drivers/net/dl2k.h b/drivers/net/dl2k.h
-index 266ec87..466b2f5 100644
+index cde8ecd..db944d3 100644
--- a/drivers/net/dl2k.h
+++ b/drivers/net/dl2k.h
-@@ -471,13 +471,6 @@ struct ioctl_data {
- char *data;
- };
-
--struct mii_data {
-- __u16 reserved;
-- __u16 reg_num;
-- __u16 in_value;
-- __u16 out_value;
--};
--
- /* The Rx and Tx buffer descriptors. */
- struct netdev_desc {
- __le64 next_desc;
-@@ -551,4 +544,7 @@ MODULE_DEVICE_TABLE (pci, rio_pci_tbl);
+@@ -438,4 +438,7 @@ MODULE_DEVICE_TABLE (pci, rio_pci_tbl);
#define DEFAULT_RXT 750
#define DEFAULT_TXC 1
#define MAX_TXC 8
@@ -55615,23 +54396,6 @@ index b38d3b7..b1cff23 100644
{ /* Sometime a Level-One switch card. */
"Winbond W89c840", CanHaveMII | HasBrokenTx | FDXOnNoMII},
{ "Winbond W89c840", CanHaveMII | HasBrokenTx},
-diff --git a/drivers/net/tun.c b/drivers/net/tun.c
-index 0f77aca..a69420d 100644
---- a/drivers/net/tun.c
-+++ b/drivers/net/tun.c
-@@ -1121,9 +1121,11 @@ static long tun_chr_ioctl(struct file *file, unsigned int cmd,
- int sndbuf;
- int ret;
-
-- if (cmd == TUNSETIFF || _IOC_TYPE(cmd) == 0x89)
-+ if (cmd == TUNSETIFF || _IOC_TYPE(cmd) == 0x89) {
- if (copy_from_user(&ifr, argp, sizeof ifr))
- return -EFAULT;
-+ } else
-+ memset(&ifr, 0, sizeof(ifr));
-
- if (cmd == TUNGETFEATURES) {
- /* Currently this just means: "what IFF flags are valid?".
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index f450bc9..2b747c8 100644
--- a/drivers/net/usb/hso.c
@@ -60267,10 +59031,10 @@ index bc3e363..e1a8e50 100644
return errsts;
memset(arr, 0, sizeof(arr));
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
-index 8df12522..c4c1472 100644
+index e28f9b0..030e4b5 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
-@@ -1389,7 +1389,7 @@ static void scsi_kill_request(struct request *req, struct request_queue *q)
+@@ -1400,7 +1400,7 @@ static void scsi_kill_request(struct request *req, struct request_queue *q)
shost = sdev->host;
scsi_init_cmd_errh(cmd);
cmd->result = DID_NO_CONNECT << 16;
@@ -60279,7 +59043,7 @@ index 8df12522..c4c1472 100644
/*
* SCSI request completion path will do scsi_device_unbusy(),
-@@ -1420,9 +1420,9 @@ static void scsi_softirq_done(struct request *rq)
+@@ -1431,9 +1431,9 @@ static void scsi_softirq_done(struct request *rq)
*/
cmd->serial_number = 0;
@@ -63306,33 +62070,6 @@ index bcbe104..9cfd1c6 100644
void usb_mon_deregister(void);
#else
-diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
-index 2b428fc..f0b27f8 100644
---- a/drivers/usb/core/hub.c
-+++ b/drivers/usb/core/hub.c
-@@ -23,6 +23,7 @@
- #include <linux/mutex.h>
- #include <linux/freezer.h>
- #include <linux/usb/quirks.h>
-+#include <linux/random.h>
-
- #include <asm/uaccess.h>
- #include <asm/byteorder.h>
-@@ -1812,6 +1813,14 @@ int usb_new_device(struct usb_device *udev)
- /* Tell the world! */
- announce_device(udev);
-
-+ if (udev->serial)
-+ add_device_randomness(udev->serial, strlen(udev->serial));
-+ if (udev->product)
-+ add_device_randomness(udev->product, strlen(udev->product));
-+ if (udev->manufacturer)
-+ add_device_randomness(udev->manufacturer,
-+ strlen(udev->manufacturer));
-+
- /* Register the device. The device driver is responsible
- * for configuring the device and invoking the add-device
- * notifier chain (used by usbfs and possibly others).
diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c
index 62ff5e7..530b74e 100644
--- a/drivers/usb/misc/appledisplay.c
@@ -66683,7 +65420,7 @@ index d94c57f..912984c 100644
.update_status = riva_bl_update_status,
};
diff --git a/drivers/video/uvesafb.c b/drivers/video/uvesafb.c
-index 54fbb29..37bab4b 100644
+index 6623a2e..d748f10 100644
--- a/drivers/video/uvesafb.c
+++ b/drivers/video/uvesafb.c
@@ -18,6 +18,7 @@
@@ -66745,7 +65482,7 @@ index 54fbb29..37bab4b 100644
printk(KERN_INFO "uvesafb: protected mode interface info at "
"%04x:%04x\n",
(u16)task->t.regs.es, (u16)task->t.regs.edi);
-@@ -1799,6 +1822,11 @@ out:
+@@ -1806,6 +1829,11 @@ out:
if (par->vbe_modes)
kfree(par->vbe_modes);
@@ -66757,7 +65494,7 @@ index 54fbb29..37bab4b 100644
framebuffer_release(info);
return err;
}
-@@ -1825,6 +1853,12 @@ static int uvesafb_remove(struct platform_device *dev)
+@@ -1832,6 +1860,12 @@ static int uvesafb_remove(struct platform_device *dev)
kfree(par->vbe_state_orig);
if (par->vbe_state_saved)
kfree(par->vbe_state_saved);
@@ -68930,7 +67667,7 @@ index a5bf577..6d19845 100644
return hit;
}
diff --git a/fs/compat.c b/fs/compat.c
-index d1e2411..84978fe 100644
+index 46b93d1..84978fe 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -133,8 +133,8 @@ asmlinkage long compat_sys_utimes(char __user *filename, struct compat_timeval _
@@ -69051,39 +67788,7 @@ index d1e2411..84978fe 100644
goto out;
if (!file->f_op)
goto out;
-@@ -1208,11 +1226,14 @@ compat_sys_readv(unsigned long fd, const struct compat_iovec __user *vec,
- struct file *file;
- int fput_needed;
- ssize_t ret;
-+ loff_t pos;
-
- file = fget_light(fd, &fput_needed);
- if (!file)
- return -EBADF;
-- ret = compat_readv(file, vec, vlen, &file->f_pos);
-+ pos = file->f_pos;
-+ ret = compat_readv(file, vec, vlen, &pos);
-+ file->f_pos = pos;
- fput_light(file, fput_needed);
- return ret;
- }
-@@ -1265,11 +1286,14 @@ compat_sys_writev(unsigned long fd, const struct compat_iovec __user *vec,
- struct file *file;
- int fput_needed;
- ssize_t ret;
-+ loff_t pos;
-
- file = fget_light(fd, &fput_needed);
- if (!file)
- return -EBADF;
-- ret = compat_writev(file, vec, vlen, &file->f_pos);
-+ pos = file->f_pos;
-+ ret = compat_writev(file, vec, vlen, &pos);
-+ file->f_pos = pos;
- fput_light(file, fput_needed);
- return ret;
- }
-@@ -1463,11 +1487,35 @@ int compat_do_execve(char * filename,
+@@ -1469,11 +1487,35 @@ int compat_do_execve(char * filename,
compat_uptr_t __user *envp,
struct pt_regs * regs)
{
@@ -69119,7 +67824,7 @@ index d1e2411..84978fe 100644
retval = unshare_files(&displaced);
if (retval)
-@@ -1493,12 +1541,26 @@ int compat_do_execve(char * filename,
+@@ -1499,12 +1541,26 @@ int compat_do_execve(char * filename,
if (IS_ERR(file))
goto out_unmark;
@@ -69146,7 +67851,7 @@ index d1e2411..84978fe 100644
retval = bprm_mm_init(bprm);
if (retval)
goto out_file;
-@@ -1515,24 +1577,63 @@ int compat_do_execve(char * filename,
+@@ -1521,24 +1577,63 @@ int compat_do_execve(char * filename,
if (retval < 0)
goto out;
@@ -69214,7 +67919,7 @@ index d1e2411..84978fe 100644
current->fs->in_exec = 0;
current->in_execve = 0;
acct_update_integrals(current);
-@@ -1541,6 +1642,14 @@ int compat_do_execve(char * filename,
+@@ -1547,6 +1642,14 @@ int compat_do_execve(char * filename,
put_files_struct(displaced);
return retval;
@@ -69229,7 +67934,7 @@ index d1e2411..84978fe 100644
out:
if (bprm->mm) {
acct_arg_size(bprm, 0);
-@@ -1711,6 +1820,8 @@ int compat_core_sys_select(int n, compat_ulong_t __user *inp,
+@@ -1717,6 +1820,8 @@ int compat_core_sys_select(int n, compat_ulong_t __user *inp,
struct fdtable *fdt;
long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
@@ -69238,7 +67943,7 @@ index d1e2411..84978fe 100644
if (n < 0)
goto out_nofds;
-@@ -2151,7 +2262,7 @@ asmlinkage long compat_sys_nfsservctl(int cmd,
+@@ -2157,7 +2262,7 @@ asmlinkage long compat_sys_nfsservctl(int cmd,
oldfs = get_fs();
set_fs(KERNEL_DS);
/* The __user pointer casts are valid because of the set_fs() */
@@ -69475,7 +68180,7 @@ index 502b09f..49129f4 100644
.flush = ecryptfs_flush,
.release = ecryptfs_release,
diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
-index 90a6087..fa05803 100644
+index 3c1dbc0..250e1b4 100644
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -647,7 +647,7 @@ static int ecryptfs_readlink_lower(struct dentry *dentry, char **buf,
@@ -69497,423 +68202,19 @@ index 90a6087..fa05803 100644
if (rc < 0)
goto out_free;
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
-index f539204..f65f88a 100644
+index ff57421..f65f88a 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
-@@ -200,6 +200,12 @@ struct eventpoll {
-
- /* The user that created the eventpoll descriptor */
- struct user_struct *user;
-+
-+ struct file *file;
-+
-+ /* used to optimize loop detection check */
-+ int visited;
-+ struct list_head visited_list_link;
- };
-
- /* Wait structure used by the poll hooks */
-@@ -258,6 +264,15 @@ static struct kmem_cache *epi_cache __read_mostly;
- /* Slab cache used to allocate "struct eppoll_entry" */
- static struct kmem_cache *pwq_cache __read_mostly;
-
-+/* Visited nodes during ep_loop_check(), so we can unset them when we finish */
-+static LIST_HEAD(visited_list);
-+
-+/*
-+ * List of files with newly added links, where we may need to limit the number
-+ * of emanating paths. Protected by the epmutex.
-+ */
-+static LIST_HEAD(tfile_check_list);
-+
- #ifdef CONFIG_SYSCTL
-
- #include <linux/sysctl.h>
-@@ -277,6 +292,12 @@ ctl_table epoll_table[] = {
- };
- #endif /* CONFIG_SYSCTL */
-
-+static const struct file_operations eventpoll_fops;
-+
-+static inline int is_file_epoll(struct file *f)
-+{
-+ return f->f_op == &eventpoll_fops;
-+}
-
- /* Setup the structure that is used as key for the RB tree */
- static inline void ep_set_ffd(struct epoll_filefd *ffd,
-@@ -300,6 +321,11 @@ static inline int ep_is_linked(struct list_head *p)
- return !list_empty(p);
- }
-
-+static inline struct eppoll_entry *ep_pwq_from_wait(wait_queue_t *p)
-+{
-+ return container_of(p, struct eppoll_entry, wait);
-+}
-+
- /* Get the "struct epitem" from a wait queue pointer */
- static inline struct epitem *ep_item_from_wait(wait_queue_t *p)
- {
-@@ -434,6 +460,18 @@ static void ep_poll_safewake(wait_queue_head_t *wq)
- put_cpu();
- }
-
-+static void ep_remove_wait_queue(struct eppoll_entry *pwq)
-+{
-+ wait_queue_head_t *whead;
-+
-+ rcu_read_lock();
-+ /* If it is cleared by POLLFREE, it should be rcu-safe */
-+ whead = rcu_dereference(pwq->whead);
-+ if (whead)
-+ remove_wait_queue(whead, &pwq->wait);
-+ rcu_read_unlock();
-+}
-+
- /*
- * This function unregisters poll callbacks from the associated file
- * descriptor. Must be called with "mtx" held (or "epmutex" if called from
-@@ -448,7 +486,7 @@ static void ep_unregister_pollwait(struct eventpoll *ep, struct epitem *epi)
- pwq = list_first_entry(lsthead, struct eppoll_entry, llink);
-
- list_del(&pwq->llink);
-- remove_wait_queue(pwq->whead, &pwq->wait);
-+ ep_remove_wait_queue(pwq);
- kmem_cache_free(pwq_cache, pwq);
- }
- }
-@@ -698,12 +736,6 @@ static const struct file_operations eventpoll_fops = {
- .poll = ep_eventpoll_poll
- };
-
--/* Fast test to see if the file is an evenpoll file */
--static inline int is_file_epoll(struct file *f)
--{
-- return f->f_op == &eventpoll_fops;
--}
--
- /*
- * This is called from eventpoll_release() to unlink files from the eventpoll
- * interface. We need to have this facility to cleanup correctly files that are
-@@ -814,6 +846,17 @@ static int ep_poll_callback(wait_queue_t *wait, unsigned mode, int sync, void *k
- struct epitem *epi = ep_item_from_wait(wait);
- struct eventpoll *ep = epi->ep;
-
-+ if ((unsigned long)key & POLLFREE) {
-+ ep_pwq_from_wait(wait)->whead = NULL;
-+ /*
-+ * whead = NULL above can race with ep_remove_wait_queue()
-+ * which can do another remove_wait_queue() after us, so we
-+ * can't use __remove_wait_queue(). whead->lock is held by
-+ * the caller.
-+ */
-+ list_del_init(&wait->task_list);
-+ }
-+
- spin_lock_irqsave(&ep->lock, flags);
-
- /*
-@@ -913,6 +956,103 @@ static void ep_rbtree_insert(struct eventpoll *ep, struct epitem *epi)
- rb_insert_color(&epi->rbn, &ep->rbr);
- }
-
-+
-+
-+#define PATH_ARR_SIZE 5
-+/*
-+ * These are the number paths of length 1 to 5, that we are allowing to emanate
-+ * from a single file of interest. For example, we allow 1000 paths of length
-+ * 1, to emanate from each file of interest. This essentially represents the
-+ * potential wakeup paths, which need to be limited in order to avoid massive
-+ * uncontrolled wakeup storms. The common use case should be a single ep which
-+ * is connected to n file sources. In this case each file source has 1 path
-+ * of length 1. Thus, the numbers below should be more than sufficient. These
-+ * path limits are enforced during an EPOLL_CTL_ADD operation, since a modify
-+ * and delete can't add additional paths. Protected by the epmutex.
-+ */
-+static const int path_limits[PATH_ARR_SIZE] = { 1000, 500, 100, 50, 10 };
-+static int path_count[PATH_ARR_SIZE];
-+
-+static int path_count_inc(int nests)
-+{
-+ /* Allow an arbitrary number of depth 1 paths */
-+ if (nests == 0)
-+ return 0;
-+
-+ if (++path_count[nests] > path_limits[nests])
-+ return -1;
-+ return 0;
-+}
-+
-+static void path_count_init(void)
-+{
-+ int i;
-+
-+ for (i = 0; i < PATH_ARR_SIZE; i++)
-+ path_count[i] = 0;
-+}
-+
-+static int reverse_path_check_proc(void *priv, void *cookie, int call_nests)
-+{
-+ int error = 0;
-+ struct file *file = priv;
-+ struct file *child_file;
-+ struct epitem *epi;
-+
-+ list_for_each_entry(epi, &file->f_ep_links, fllink) {
-+ child_file = epi->ep->file;
-+ if (is_file_epoll(child_file)) {
-+ if (list_empty(&child_file->f_ep_links)) {
-+ if (path_count_inc(call_nests)) {
-+ error = -1;
-+ break;
-+ }
-+ } else {
-+ error = ep_call_nested(&poll_loop_ncalls,
-+ EP_MAX_NESTS,
-+ reverse_path_check_proc,
-+ child_file, child_file,
-+ current);
-+ }
-+ if (error != 0)
-+ break;
-+ } else {
-+ printk(KERN_ERR "reverse_path_check_proc: "
-+ "file is not an ep!\n");
-+ }
-+ }
-+ return error;
-+}
-+
-+/**
-+ * reverse_path_check - The tfile_check_list is list of file *, which have
-+ * links that are proposed to be newly added. We need to
-+ * make sure that those added links don't add too many
-+ * paths such that we will spend all our time waking up
-+ * eventpoll objects.
-+ *
-+ * Returns: Returns zero if the proposed links don't create too many paths,
-+ * -1 otherwise.
-+ */
-+static int reverse_path_check(void)
-+{
-+ int length = 0;
-+ int error = 0;
-+ struct file *current_file;
-+
-+ /* let's call this for all tfiles */
-+ list_for_each_entry(current_file, &tfile_check_list, f_tfile_llink) {
-+ length++;
-+ path_count_init();
-+ error = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
-+ reverse_path_check_proc, current_file,
-+ current_file, current);
-+ if (error)
-+ break;
-+ }
-+ return error;
-+}
-+
- /*
- * Must be called with "mtx" held.
- */
-@@ -973,6 +1113,11 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event,
- */
- ep_rbtree_insert(ep, epi);
-
-+ /* now check if we've created too many backpaths */
-+ error = -EINVAL;
-+ if (reverse_path_check())
-+ goto error_remove_epi;
-+
- /* We have to drop the new item inside our item list to keep track of it */
- spin_lock_irqsave(&ep->lock, flags);
-
-@@ -997,6 +1142,14 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event,
-
- return 0;
-
-+error_remove_epi:
-+ spin_lock(&tfile->f_lock);
-+ if (ep_is_linked(&epi->fllink))
-+ list_del_init(&epi->fllink);
-+ spin_unlock(&tfile->f_lock);
-+
-+ rb_erase(&epi->rbn, &ep->rbr);
-+
- error_unregister:
- ep_unregister_pollwait(ep, epi);
-
-@@ -1223,18 +1376,36 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests)
- int error = 0;
- struct file *file = priv;
- struct eventpoll *ep = file->private_data;
-+ struct eventpoll *ep_tovisit;
- struct rb_node *rbp;
- struct epitem *epi;
-
- mutex_lock_nested(&ep->mtx, call_nests + 1);
-+ ep->visited = 1;
-+ list_add(&ep->visited_list_link, &visited_list);
- for (rbp = rb_first(&ep->rbr); rbp; rbp = rb_next(rbp)) {
- epi = rb_entry(rbp, struct epitem, rbn);
- if (unlikely(is_file_epoll(epi->ffd.file))) {
-+ ep_tovisit = epi->ffd.file->private_data;
-+ if (ep_tovisit->visited)
-+ continue;
- error = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
-- ep_loop_check_proc, epi->ffd.file,
-- epi->ffd.file->private_data, current);
-+ ep_loop_check_proc, epi->ffd.file,
-+ ep_tovisit, current);
- if (error != 0)
- break;
-+ } else {
-+ /*
-+ * If we've reached a file that is not associated with
-+ * an ep, then we need to check if the newly added
-+ * links are going to add too many wakeup paths. We do
-+ * this by adding it to the tfile_check_list, if it's
-+ * not already there, and calling reverse_path_check()
-+ * during ep_insert().
-+ */
-+ if (list_empty(&epi->ffd.file->f_tfile_llink))
-+ list_add(&epi->ffd.file->f_tfile_llink,
-+ &tfile_check_list);
- }
+@@ -1488,8 +1488,8 @@ SYSCALL_DEFINE1(epoll_create1, int, flags)
+ error = PTR_ERR(file);
+ goto out_free_fd;
}
- mutex_unlock(&ep->mtx);
-@@ -1255,8 +1426,31 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests)
- */
- static int ep_loop_check(struct eventpoll *ep, struct file *file)
- {
-- return ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
-+ int ret;
-+ struct eventpoll *ep_cur, *ep_next;
-+
-+ ret = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
- ep_loop_check_proc, file, ep, current);
-+ /* clear visited list */
-+ list_for_each_entry_safe(ep_cur, ep_next, &visited_list,
-+ visited_list_link) {
-+ ep_cur->visited = 0;
-+ list_del(&ep_cur->visited_list_link);
-+ }
-+ return ret;
-+}
-+
-+static void clear_tfile_check_list(void)
-+{
-+ struct file *file;
-+
-+ /* first clear the tfile_check_list */
-+ while (!list_empty(&tfile_check_list)) {
-+ file = list_first_entry(&tfile_check_list, struct file,
-+ f_tfile_llink);
-+ list_del_init(&file->f_tfile_llink);
-+ }
-+ INIT_LIST_HEAD(&tfile_check_list);
- }
-
- /*
-@@ -1264,8 +1458,9 @@ static int ep_loop_check(struct eventpoll *ep, struct file *file)
- */
- SYSCALL_DEFINE1(epoll_create1, int, flags)
- {
-- int error;
-+ int error, fd;
- struct eventpoll *ep = NULL;
-+ struct file *file;
-
- /* Check the EPOLL_* constant for consistency. */
- BUILD_BUG_ON(EPOLL_CLOEXEC != O_CLOEXEC);
-@@ -1282,11 +1477,25 @@ SYSCALL_DEFINE1(epoll_create1, int, flags)
- * Creates all the items needed to setup an eventpoll file. That is,
- * a file structure and a free file descriptor.
- */
-- error = anon_inode_getfd("[eventpoll]", &eventpoll_fops, ep,
-- flags & O_CLOEXEC);
-- if (error < 0)
-- ep_free(ep);
-+ fd = get_unused_fd_flags(O_RDWR | (flags & O_CLOEXEC));
-+ if (fd < 0) {
-+ error = fd;
-+ goto out_free_ep;
-+ }
-+ file = anon_inode_getfile("[eventpoll]", &eventpoll_fops, ep,
-+ O_RDWR | (flags & O_CLOEXEC));
-+ if (IS_ERR(file)) {
-+ error = PTR_ERR(file);
-+ goto out_free_fd;
-+ }
-+ ep->file = file;
+- fd_install(fd, file);
+ ep->file = file;
+ fd_install(fd, file);
-+ return fd;
+ return fd;
-+out_free_fd:
-+ put_unused_fd(fd);
-+out_free_ep:
-+ ep_free(ep);
- return error;
- }
-
-@@ -1352,21 +1561,29 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
- /*
- * When we insert an epoll file descriptor, inside another epoll file
- * descriptor, there is the change of creating closed loops, which are
-- * better be handled here, than in more critical paths.
-+ * better be handled here, than in more critical paths. While we are
-+ * checking for loops we also determine the list of files reachable
-+ * and hang them on the tfile_check_list, so we can check that we
-+ * haven't created too many possible wakeup paths.
- *
-- * We hold epmutex across the loop check and the insert in this case, in
-- * order to prevent two separate inserts from racing and each doing the
-- * insert "at the same time" such that ep_loop_check passes on both
-- * before either one does the insert, thereby creating a cycle.
-+ * We need to hold the epmutex across both ep_insert and ep_remove
-+ * b/c we want to make sure we are looking at a coherent view of
-+ * epoll network.
- */
-- if (unlikely(is_file_epoll(tfile) && op == EPOLL_CTL_ADD)) {
-+ if (op == EPOLL_CTL_ADD || op == EPOLL_CTL_DEL) {
- mutex_lock(&epmutex);
- did_lock_epmutex = 1;
-- error = -ELOOP;
-- if (ep_loop_check(ep, tfile) != 0)
-- goto error_tgt_fput;
- }
--
-+ if (op == EPOLL_CTL_ADD) {
-+ if (is_file_epoll(tfile)) {
-+ error = -ELOOP;
-+ if (ep_loop_check(ep, tfile) != 0) {
-+ clear_tfile_check_list();
-+ goto error_tgt_fput;
-+ }
-+ } else
-+ list_add(&tfile->f_tfile_llink, &tfile_check_list);
-+ }
-
- mutex_lock_nested(&ep->mtx, 0);
-
-@@ -1385,6 +1602,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
- error = ep_insert(ep, &epds, tfile, fd);
- } else
- error = -EEXIST;
-+ clear_tfile_check_list();
- break;
- case EPOLL_CTL_DEL:
- if (epi)
-@@ -1403,7 +1621,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
- mutex_unlock(&ep->mtx);
-
- error_tgt_fput:
-- if (unlikely(did_lock_epmutex))
-+ if (did_lock_epmutex)
- mutex_unlock(&epmutex);
-
- fput(tfile);
+ out_free_fd:
diff --git a/fs/exec.c b/fs/exec.c
index 86fafc6..25f0d1a 100644
--- a/fs/exec.c
@@ -72599,10 +70900,10 @@ index 1facb395..7f48557 100644
}
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
-index 4787ae6..73efff7 100644
+index b359543..d212be4 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
-@@ -1127,7 +1127,7 @@ static char *read_link(struct dentry *dentry)
+@@ -1128,7 +1128,7 @@ static char *read_link(struct dentry *dentry)
return link;
}
@@ -72647,7 +70948,7 @@ index 4463297..4fed53b 100644
};
diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c
-index f6874ac..46904bd 100644
+index a0786c6..46904bd 100644
--- a/fs/hfsplus/catalog.c
+++ b/fs/hfsplus/catalog.c
@@ -157,6 +157,8 @@ int hfsplus_find_cat(struct super_block *sb, u32 cnid,
@@ -72677,19 +70978,8 @@ index f6874ac..46904bd 100644
dprint(DBG_CAT_MOD, "rename_cat: %u - %lu,%s - %lu,%s\n", cnid, src_dir->i_ino, src_name->name,
dst_dir->i_ino, dst_name->name);
sb = src_dir->i_sb;
-@@ -329,6 +335,10 @@ int hfsplus_rename_cat(u32 cnid,
- err = hfs_brec_find(&src_fd);
- if (err)
- goto out;
-+ if (src_fd.entrylength > sizeof(entry) || src_fd.entrylength < 0) {
-+ err = -EIO;
-+ goto out;
-+ }
-
- hfs_bnode_read(src_fd.bnode, &entry, src_fd.entryoffset,
- src_fd.entrylength);
diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c
-index 5f40236..6ec38b2 100644
+index f4300ff7..6ec38b2 100644
--- a/fs/hfsplus/dir.c
+++ b/fs/hfsplus/dir.c
@@ -121,6 +121,8 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir)
@@ -72701,31 +70991,6 @@ index 5f40236..6ec38b2 100644
if (filp->f_pos >= inode->i_size)
return 0;
-@@ -138,6 +140,11 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir)
- filp->f_pos++;
- /* fall through */
- case 1:
-+ if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
-+ err = -EIO;
-+ goto out;
-+ }
-+
- hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength);
- if (be16_to_cpu(entry.type) != HFSPLUS_FOLDER_THREAD) {
- printk(KERN_ERR "hfs: bad catalog folder thread\n");
-@@ -168,6 +175,12 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir)
- err = -EIO;
- goto out;
- }
-+
-+ if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
-+ err = -EIO;
-+ goto out;
-+ }
-+
- hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength);
- type = be16_to_cpu(entry.type);
- len = HFSPLUS_MAX_STRLEN;
diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c
index 1bcf597..905a251 100644
--- a/fs/hfsplus/inode.c
@@ -72784,98 +71049,10 @@ index 43022f3..7298079 100644
if (!sbi)
return -ENOMEM;
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
-index 87a1258..80c3284 100644
+index 2179de8..80c3284 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
-@@ -601,9 +601,15 @@ static int hugetlbfs_statfs(struct dentry *dentry, struct kstatfs *buf)
- spin_lock(&sbinfo->stat_lock);
- /* If no limits set, just report 0 for max/free/used
- * blocks, like simple_statfs() */
-- if (sbinfo->max_blocks >= 0) {
-- buf->f_blocks = sbinfo->max_blocks;
-- buf->f_bavail = buf->f_bfree = sbinfo->free_blocks;
-+ if (sbinfo->spool) {
-+ long free_pages;
-+
-+ spin_lock(&sbinfo->spool->lock);
-+ buf->f_blocks = sbinfo->spool->max_hpages;
-+ free_pages = sbinfo->spool->max_hpages
-+ - sbinfo->spool->used_hpages;
-+ buf->f_bavail = buf->f_bfree = free_pages;
-+ spin_unlock(&sbinfo->spool->lock);
- buf->f_files = sbinfo->max_inodes;
- buf->f_ffree = sbinfo->free_inodes;
- }
-@@ -619,6 +625,10 @@ static void hugetlbfs_put_super(struct super_block *sb)
-
- if (sbi) {
- sb->s_fs_info = NULL;
-+
-+ if (sbi->spool)
-+ hugepage_put_subpool(sbi->spool);
-+
- kfree(sbi);
- }
- }
-@@ -842,10 +852,14 @@ hugetlbfs_fill_super(struct super_block *sb, void *data, int silent)
- sb->s_fs_info = sbinfo;
- sbinfo->hstate = config.hstate;
- spin_lock_init(&sbinfo->stat_lock);
-- sbinfo->max_blocks = config.nr_blocks;
-- sbinfo->free_blocks = config.nr_blocks;
- sbinfo->max_inodes = config.nr_inodes;
- sbinfo->free_inodes = config.nr_inodes;
-+ sbinfo->spool = NULL;
-+ if (config.nr_blocks != -1) {
-+ sbinfo->spool = hugepage_new_subpool(config.nr_blocks);
-+ if (!sbinfo->spool)
-+ goto out_free;
-+ }
- sb->s_maxbytes = MAX_LFS_FILESIZE;
- sb->s_blocksize = huge_page_size(config.hstate);
- sb->s_blocksize_bits = huge_page_shift(config.hstate);
-@@ -865,38 +879,12 @@ hugetlbfs_fill_super(struct super_block *sb, void *data, int silent)
- sb->s_root = root;
- return 0;
- out_free:
-+ if (sbinfo->spool)
-+ kfree(sbinfo->spool);
- kfree(sbinfo);
- return -ENOMEM;
- }
-
--int hugetlb_get_quota(struct address_space *mapping, long delta)
--{
-- int ret = 0;
-- struct hugetlbfs_sb_info *sbinfo = HUGETLBFS_SB(mapping->host->i_sb);
--
-- if (sbinfo->free_blocks > -1) {
-- spin_lock(&sbinfo->stat_lock);
-- if (sbinfo->free_blocks - delta >= 0)
-- sbinfo->free_blocks -= delta;
-- else
-- ret = -ENOMEM;
-- spin_unlock(&sbinfo->stat_lock);
-- }
--
-- return ret;
--}
--
--void hugetlb_put_quota(struct address_space *mapping, long delta)
--{
-- struct hugetlbfs_sb_info *sbinfo = HUGETLBFS_SB(mapping->host->i_sb);
--
-- if (sbinfo->free_blocks > -1) {
-- spin_lock(&sbinfo->stat_lock);
-- sbinfo->free_blocks += delta;
-- spin_unlock(&sbinfo->stat_lock);
-- }
--}
--
- static int hugetlbfs_get_sb(struct file_system_type *fs_type,
- int flags, const char *dev_name, void *data, struct vfsmount *mnt)
- {
-@@ -909,7 +897,7 @@ static struct file_system_type hugetlbfs_fs_type = {
+@@ -897,7 +897,7 @@ static struct file_system_type hugetlbfs_fs_type = {
.kill_sb = kill_litter_super,
};
@@ -72940,19 +71117,6 @@ index b0435dd..81ee0be 100644
jbd_debug(1, "Start checkpoint\n");
/*
-diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
-index a051270..5c156ad 100644
---- a/fs/jbd2/transaction.c
-+++ b/fs/jbd2/transaction.c
-@@ -1822,6 +1822,8 @@ zap_buffer_unlocked:
- clear_buffer_mapped(bh);
- clear_buffer_req(bh);
- clear_buffer_new(bh);
-+ clear_buffer_delay(bh);
-+ clear_buffer_unwritten(bh);
- bh->b_bdev = NULL;
- return may_free;
- }
diff --git a/fs/jffs2/compr_rtime.c b/fs/jffs2/compr_rtime.c
index 546d153..736896c 100644
--- a/fs/jffs2/compr_rtime.c
@@ -73109,7 +71273,7 @@ index 1a54ae1..6a16c27 100644
static DEFINE_MUTEX(nlmsvc_mutex);
diff --git a/fs/locks.c b/fs/locks.c
-index a8794f2..6256b88 100644
+index fde92d1..6256b88 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -145,10 +145,28 @@ static LIST_HEAD(blocked_list);
@@ -73161,33 +71325,6 @@ index a8794f2..6256b88 100644
}
EXPORT_SYMBOL(locks_init_lock);
-@@ -291,7 +301,7 @@ static int flock_make_lock(struct file *filp, struct file_lock **lock,
- return 0;
- }
-
--static int assign_type(struct file_lock *fl, int type)
-+static int assign_type(struct file_lock *fl, long type)
- {
- switch (type) {
- case F_RDLCK:
-@@ -444,7 +454,7 @@ static const struct lock_manager_operations lease_manager_ops = {
- /*
- * Initialize a lease, use the default lock manager operations
- */
--static int lease_init(struct file *filp, int type, struct file_lock *fl)
-+static int lease_init(struct file *filp, long type, struct file_lock *fl)
- {
- if (assign_type(fl, type) != 0)
- return -EINVAL;
-@@ -462,7 +472,7 @@ static int lease_init(struct file *filp, int type, struct file_lock *fl)
- }
-
- /* Allocate a file_lock initialised to this type of lease */
--static struct file_lock *lease_alloc(struct file *filp, int type)
-+static struct file_lock *lease_alloc(struct file *filp, long type)
- {
- struct file_lock *fl = locks_alloc_lock();
- int error = -ENOMEM;
@@ -2007,16 +2017,16 @@ void locks_remove_flock(struct file *filp)
return;
@@ -73934,7 +72071,7 @@ index cfc3391..dcc083a 100644
(long long) lock->lk_offset,
(long long) lock->lk_length);
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
-index 4a82a96..0d5fb49 100644
+index 6d27757..d046ba1 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -1751,6 +1751,8 @@ nfsd4_encode_fattr(struct svc_fh *fhp, struct svc_export *exp,
@@ -74000,18 +72137,6 @@ index f6af760..d0adf34 100644
len = argv[n].v_size * argv[n].v_nmembs;
base = (void __user *)(unsigned long)argv[n].v_base;
if (len == 0) {
-diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
-index ad391a8..149a8a1 100644
---- a/fs/nilfs2/the_nilfs.c
-+++ b/fs/nilfs2/the_nilfs.c
-@@ -478,6 +478,7 @@ static int nilfs_load_super_block(struct the_nilfs *nilfs,
- brelse(sbh[1]);
- sbh[1] = NULL;
- sbp[1] = NULL;
-+ valid[1] = 0;
- swp = 0;
- }
- if (!valid[swp]) {
diff --git a/fs/notify/dnotify/dnotify.c b/fs/notify/dnotify/dnotify.c
index 7e54e52..9337248 100644
--- a/fs/notify/dnotify/dnotify.c
@@ -76448,32 +74573,6 @@ index eae7d9d..c6bba46 100644
int res = -ENOMEM;
if (op) {
-diff --git a/fs/signalfd.c b/fs/signalfd.c
-index d98bea8..02c25d7 100644
---- a/fs/signalfd.c
-+++ b/fs/signalfd.c
-@@ -29,6 +29,21 @@
- #include <linux/signalfd.h>
- #include <linux/syscalls.h>
-
-+void signalfd_cleanup(struct sighand_struct *sighand)
-+{
-+ wait_queue_head_t *wqh = &sighand->signalfd_wqh;
-+ /*
-+ * The lockless check can race with remove_wait_queue() in progress,
-+ * but in this case its caller should run under rcu_read_lock() and
-+ * sighand_cachep is SLAB_DESTROY_BY_RCU, we can safely return.
-+ */
-+ if (likely(!waitqueue_active(wqh)))
-+ return;
-+
-+ /* wait_queue_t->func(POLLFREE) should do remove_wait_queue() */
-+ wake_up_poll(wqh, POLLHUP | POLLFREE);
-+}
-+
- struct signalfd_ctx {
- sigset_t sigmask;
- };
diff --git a/fs/smbfs/proc.c b/fs/smbfs/proc.c
index 71c29b6..54694dd 100644
--- a/fs/smbfs/proc.c
@@ -76879,85 +74978,10 @@ index 21dad8c..b754151 100644
if (connectable && !S_ISDIR(inode->i_mode)) {
diff --git a/fs/udf/super.c b/fs/udf/super.c
-index ee6b3af..ab17bcd 100644
+index 0045ebc..d069fda 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
-@@ -57,6 +57,7 @@
- #include <linux/seq_file.h>
- #include <linux/bitmap.h>
- #include <linux/crc-itu-t.h>
-+#include <linux/log2.h>
- #include <asm/byteorder.h>
-
- #include "udf_sb.h"
-@@ -1239,16 +1240,65 @@ out_bh:
- return ret;
- }
-
-+static int udf_load_sparable_map(struct super_block *sb,
-+ struct udf_part_map *map,
-+ struct sparablePartitionMap *spm)
-+{
-+ uint32_t loc;
-+ uint16_t ident;
-+ struct sparingTable *st;
-+ struct udf_sparing_data *sdata = &map->s_type_specific.s_sparing;
-+ int i;
-+ struct buffer_head *bh;
-+
-+ map->s_partition_type = UDF_SPARABLE_MAP15;
-+ sdata->s_packet_len = le16_to_cpu(spm->packetLength);
-+ if (!is_power_of_2(sdata->s_packet_len)) {
-+ udf_error(sb, __func__, "error loading logical volume descriptor: "
-+ "Invalid packet length %u\n",
-+ (unsigned)sdata->s_packet_len);
-+ return -EIO;
-+ }
-+ if (spm->numSparingTables > 4) {
-+ udf_error(sb, __func__, "error loading logical volume descriptor: "
-+ "Too many sparing tables (%d)\n",
-+ (int)spm->numSparingTables);
-+ return -EIO;
-+ }
-+
-+ for (i = 0; i < spm->numSparingTables; i++) {
-+ loc = le32_to_cpu(spm->locSparingTable[i]);
-+ bh = udf_read_tagged(sb, loc, loc, &ident);
-+ if (!bh)
-+ continue;
-+
-+ st = (struct sparingTable *)bh->b_data;
-+ if (ident != 0 ||
-+ strncmp(st->sparingIdent.ident, UDF_ID_SPARING,
-+ strlen(UDF_ID_SPARING)) ||
-+ sizeof(*st) + le16_to_cpu(st->reallocationTableLen) >
-+ sb->s_blocksize) {
-+ brelse(bh);
-+ continue;
-+ }
-+
-+ sdata->s_spar_map[i] = bh;
-+ }
-+ map->s_partition_func = udf_get_pblock_spar15;
-+ return 0;
-+}
-+
- static int udf_load_logicalvol(struct super_block *sb, sector_t block,
- struct kernel_lb_addr *fileset)
- {
- struct logicalVolDesc *lvd;
-- int i, j, offset;
-+ int i, offset;
- uint8_t type;
- struct udf_sb_info *sbi = UDF_SB(sb);
- struct genericPartitionMap *gpm;
- uint16_t ident;
- struct buffer_head *bh;
-+ unsigned int table_len;
- int ret = 0;
-
- bh = udf_read_tagged(sb, block, block, &ident);
-@@ -1256,6 +1306,13 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block,
+@@ -1306,6 +1306,13 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block,
return 1;
BUG_ON(ident != TAG_IDENT_LVD);
lvd = (struct logicalVolDesc *)bh->b_data;
@@ -76969,59 +74993,8 @@ index ee6b3af..ab17bcd 100644
+ goto out_bh;
+ }
- i = udf_sb_alloc_partition_maps(sb, le32_to_cpu(lvd->numPartitionMaps));
- if (i != 0) {
-@@ -1264,7 +1321,7 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block,
- }
-
- for (i = 0, offset = 0;
-- i < sbi->s_partitions && offset < le32_to_cpu(lvd->mapTableLength);
-+ i < sbi->s_partitions && offset < table_len;
- i++, offset += gpm->partitionMapLength) {
- struct udf_part_map *map = &sbi->s_partmaps[i];
- gpm = (struct genericPartitionMap *)
-@@ -1299,38 +1356,9 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block,
- } else if (!strncmp(upm2->partIdent.ident,
- UDF_ID_SPARABLE,
- strlen(UDF_ID_SPARABLE))) {
-- uint32_t loc;
-- struct sparingTable *st;
-- struct sparablePartitionMap *spm =
-- (struct sparablePartitionMap *)gpm;
--
-- map->s_partition_type = UDF_SPARABLE_MAP15;
-- map->s_type_specific.s_sparing.s_packet_len =
-- le16_to_cpu(spm->packetLength);
-- for (j = 0; j < spm->numSparingTables; j++) {
-- struct buffer_head *bh2;
--
-- loc = le32_to_cpu(
-- spm->locSparingTable[j]);
-- bh2 = udf_read_tagged(sb, loc, loc,
-- &ident);
-- map->s_type_specific.s_sparing.
-- s_spar_map[j] = bh2;
--
-- if (bh2 == NULL)
-- continue;
--
-- st = (struct sparingTable *)bh2->b_data;
-- if (ident != 0 || strncmp(
-- st->sparingIdent.ident,
-- UDF_ID_SPARING,
-- strlen(UDF_ID_SPARING))) {
-- brelse(bh2);
-- map->s_type_specific.s_sparing.
-- s_spar_map[j] = NULL;
-- }
-- }
-- map->s_partition_func = udf_get_pblock_spar15;
-+ if (udf_load_sparable_map(sb, map,
-+ (struct sparablePartitionMap *)gpm) < 0)
-+ goto out_bh;
- } else if (!strncmp(upm2->partIdent.ident,
- UDF_ID_METADATA,
- strlen(UDF_ID_METADATA))) {
+ table_len = le32_to_cpu(lvd->mapTableLength);
+ if (table_len > sb->s_blocksize - sizeof(*lvd)) {
diff --git a/fs/utimes.c b/fs/utimes.c
index e4c75db..b4df0e0 100644
--- a/fs/utimes.c
@@ -77218,41 +75191,6 @@ index e89734e..5e84d8d 100644
off & 0x7fffffff, ino, DT_UNKNOWN)) {
*offset = off & 0x7fffffff;
return 0;
-diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
-index 8f32f50..5db8d65 100644
---- a/fs/xfs/xfs_vnodeops.c
-+++ b/fs/xfs/xfs_vnodeops.c
-@@ -554,7 +554,7 @@ xfs_readlink(
- char *link)
- {
- xfs_mount_t *mp = ip->i_mount;
-- int pathlen;
-+ xfs_fsize_t pathlen;
- int error = 0;
-
- xfs_itrace_entry(ip);
-@@ -564,13 +564,18 @@ xfs_readlink(
-
- xfs_ilock(ip, XFS_ILOCK_SHARED);
-
-- ASSERT((ip->i_d.di_mode & S_IFMT) == S_IFLNK);
-- ASSERT(ip->i_d.di_size <= MAXPATHLEN);
--
- pathlen = ip->i_d.di_size;
- if (!pathlen)
- goto out;
-
-+ if (pathlen < 0 || pathlen > MAXPATHLEN) {
-+ xfs_fs_cmn_err(CE_ALERT, mp, "%s: inode (%llu) symlink length (%d) too long",
-+ __func__, (unsigned long long)ip->i_ino, pathlen);
-+ ASSERT(0);
-+ error = XFS_ERROR(EFSCORRUPTED);
-+ goto out;
-+ }
-+
- if (ip->i_df.if_flags & XFS_IFINLINE) {
- memcpy(link, ip->i_df.if_u1.if_data, pathlen);
- link[pathlen] = '\0';
diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig
new file mode 100644
index 0000000..5012f34
@@ -87976,19 +85914,6 @@ index e2bd73e..fea8ed3 100644
#endif /* !__ASSEMBLY__ */
#endif /* _ASM_GENERIC_PGTABLE_H */
-diff --git a/include/asm-generic/poll.h b/include/asm-generic/poll.h
-index 44bce83..9ce7f44 100644
---- a/include/asm-generic/poll.h
-+++ b/include/asm-generic/poll.h
-@@ -28,6 +28,8 @@
- #define POLLRDHUP 0x2000
- #endif
-
-+#define POLLFREE 0x4000 /* currently only for epoll */
-+
- struct pollfd {
- int fd;
- short events;
diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index b6e818f..21aa58a 100644
--- a/include/asm-generic/vmlinux.lds.h
@@ -88772,20 +86697,8 @@ index 90a4ed0..d652617 100644
#endif
-diff --git a/include/linux/eventpoll.h b/include/linux/eventpoll.h
-index f6856a5..ca399c5 100644
---- a/include/linux/eventpoll.h
-+++ b/include/linux/eventpoll.h
-@@ -61,6 +61,7 @@ struct file;
- static inline void eventpoll_init_file(struct file *file)
- {
- INIT_LIST_HEAD(&file->f_ep_links);
-+ INIT_LIST_HEAD(&file->f_tfile_llink);
- }
-
-
diff --git a/include/linux/fs.h b/include/linux/fs.h
-index 1b9a47a..9236f46 100644
+index 860cb6d..9236f46 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -568,41 +568,41 @@ typedef int (*read_actor_t)(read_descriptor_t *, struct page *,
@@ -88847,15 +86760,7 @@ index 1b9a47a..9236f46 100644
};
/*
-@@ -941,6 +941,7 @@ struct file {
- #ifdef CONFIG_EPOLL
- /* Used by fs/eventpoll.c to link all the hooks to this file */
- struct list_head f_ep_links;
-+ struct list_head f_tfile_llink;
- #endif /* #ifdef CONFIG_EPOLL */
- struct address_space *f_mapping;
- #ifdef CONFIG_DEBUG_WRITECOUNT
-@@ -1031,19 +1032,19 @@ static inline int file_check_writeable(struct file *filp)
+@@ -1032,19 +1032,19 @@ static inline int file_check_writeable(struct file *filp)
typedef struct files_struct *fl_owner_t;
struct file_lock_operations {
@@ -88885,7 +86790,7 @@ index 1b9a47a..9236f46 100644
};
struct lock_manager {
-@@ -1442,7 +1443,7 @@ struct fiemap_extent_info {
+@@ -1443,7 +1443,7 @@ struct fiemap_extent_info {
unsigned int fi_flags; /* Flags as passed from user */
unsigned int fi_extents_mapped; /* Number of mapped extents */
unsigned int fi_extents_max; /* Size of fiemap_extent array */
@@ -88894,7 +86799,7 @@ index 1b9a47a..9236f46 100644
* array */
};
int fiemap_fill_next_extent(struct fiemap_extent_info *info, u64 logical,
-@@ -1512,7 +1513,8 @@ struct file_operations {
+@@ -1513,7 +1513,8 @@ struct file_operations {
ssize_t (*splice_write)(struct pipe_inode_info *, struct file *, loff_t *, size_t, unsigned int);
ssize_t (*splice_read)(struct file *, loff_t *, struct pipe_inode_info *, size_t, unsigned int);
int (*setlease)(struct file *, long, struct file_lock **);
@@ -88904,7 +86809,7 @@ index 1b9a47a..9236f46 100644
struct inode_operations {
int (*create) (struct inode *,struct dentry *,int, struct nameidata *);
-@@ -1559,30 +1561,30 @@ extern ssize_t vfs_writev(struct file *, const struct iovec __user *,
+@@ -1560,30 +1561,30 @@ extern ssize_t vfs_writev(struct file *, const struct iovec __user *,
unsigned long, loff_t *);
struct super_operations {
@@ -88955,7 +86860,7 @@ index 1b9a47a..9236f46 100644
};
/*
-@@ -1952,6 +1954,7 @@ extern void unregister_blkdev(unsigned int, const char *);
+@@ -1953,6 +1954,7 @@ extern void unregister_blkdev(unsigned int, const char *);
extern struct block_device *bdget(dev_t);
extern struct block_device *bdgrab(struct block_device *bdev);
extern void bd_set_size(struct block_device *, loff_t size);
@@ -90168,49 +88073,6 @@ index 211ff44..00ab6d7 100644
static inline void zero_user_segments(struct page *page,
unsigned start1, unsigned end1,
unsigned start2, unsigned end2)
-diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
-index 41a59af..6b3feef 100644
---- a/include/linux/hugetlb.h
-+++ b/include/linux/hugetlb.h
-@@ -12,6 +12,15 @@ struct user_struct;
- #include <linux/shm.h>
- #include <asm/tlbflush.h>
-
-+struct hugepage_subpool {
-+ spinlock_t lock;
-+ long count;
-+ long max_hpages, used_hpages;
-+};
-+
-+struct hugepage_subpool *hugepage_new_subpool(long nr_blocks);
-+void hugepage_put_subpool(struct hugepage_subpool *spool);
-+
- int PageHuge(struct page *page);
-
- static inline int is_vm_hugetlb_page(struct vm_area_struct *vma)
-@@ -138,12 +147,11 @@ struct hugetlbfs_config {
- };
-
- struct hugetlbfs_sb_info {
-- long max_blocks; /* blocks allowed */
-- long free_blocks; /* blocks free */
- long max_inodes; /* inodes allowed */
- long free_inodes; /* inodes free */
- spinlock_t stat_lock;
- struct hstate *hstate;
-+ struct hugepage_subpool *spool;
- };
-
-
-@@ -166,8 +174,6 @@ extern const struct file_operations hugetlbfs_file_operations;
- extern const struct vm_operations_struct hugetlb_vm_ops;
- struct file *hugetlb_file_setup(const char *name, size_t size, int acct,
- struct user_struct **user, int creat_flags);
--int hugetlb_get_quota(struct address_space *mapping, long delta);
--void hugetlb_put_quota(struct address_space *mapping, long delta);
-
- static inline int is_file_hugepages(struct file *file)
- {
diff --git a/include/linux/i2c.h b/include/linux/i2c.h
index 7b40cda..24eb44e 100644
--- a/include/linux/i2c.h
@@ -90363,33 +88225,11 @@ index c739150..be577b5 100644
extern void softirq_init(void);
#define __raise_softirq_irqoff(nr) do { or_softirq_pending(1UL << (nr)); } while (0)
extern void raise_softirq_irqoff(unsigned int nr);
-diff --git a/include/linux/iocontext.h b/include/linux/iocontext.h
-index eb73632..19abfc1 100644
---- a/include/linux/iocontext.h
-+++ b/include/linux/iocontext.h
-@@ -94,14 +94,15 @@ static inline struct io_context *ioc_task_link(struct io_context *ioc)
- return NULL;
- }
-
-+struct task_struct;
- #ifdef CONFIG_BLOCK
- int put_io_context(struct io_context *ioc);
--void exit_io_context(void);
-+void exit_io_context(struct task_struct *task);
- struct io_context *get_io_context(gfp_t gfp_flags, int node);
- struct io_context *alloc_io_context(gfp_t gfp_flags, int node);
- void copy_io_context(struct io_context **pdst, struct io_context **psrc);
- #else
--static inline void exit_io_context(void)
-+static inline void exit_io_context(struct task_struct *task)
- {
- }
-
diff --git a/include/linux/irq.h b/include/linux/irq.h
-index 9e5f45a..025865b 100644
+index 2333710..74767a7 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
-@@ -438,12 +438,12 @@ extern int set_irq_msi(unsigned int irq, struct msi_desc *entry);
+@@ -437,12 +437,12 @@ extern int set_irq_msi(unsigned int irq, struct msi_desc *entry);
static inline bool alloc_desc_masks(struct irq_desc *desc, int node,
bool boot)
{
@@ -90542,7 +88382,7 @@ index 58ae8e0..3950d3c 100644
static inline struct kset *to_kset(struct kobject *kobj)
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
-index c728a50..07be660 100644
+index 8bfed57..07be660 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -210,7 +210,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vcpu);
@@ -90563,19 +88403,6 @@ index c728a50..07be660 100644
void kvm_arch_exit(void);
int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
-@@ -556,5 +556,12 @@ static inline bool kvm_vcpu_is_bsp(struct kvm_vcpu *vcpu)
- {
- return vcpu->kvm->bsp_vcpu_id == vcpu->vcpu_id;
- }
-+
-+bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu);
-+
-+#else
-+
-+static inline bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu) { return true; }
-+
- #endif
- #endif
diff --git a/include/linux/libata.h b/include/linux/libata.h
index a069916..223edde 100644
--- a/include/linux/libata.h
@@ -91364,28 +89191,23 @@ index 7456d7d..6c1cfc9 100644
static inline int ptrace_reparented(struct task_struct *child)
{
diff --git a/include/linux/random.h b/include/linux/random.h
-index 2948046..16bad29 100644
+index 1864957..e98160a 100644
--- a/include/linux/random.h
+++ b/include/linux/random.h
-@@ -46,9 +46,14 @@ struct rand_pool_info {
-
- extern void rand_initialize_irq(int irq);
-
-+extern void add_device_randomness(const void *, unsigned int);
- extern void add_input_randomness(unsigned int type, unsigned int code,
+@@ -49,6 +49,10 @@ extern void add_input_randomness(unsigned int type, unsigned int code,
unsigned int value);
--extern void add_interrupt_randomness(int irq);
-+extern void add_interrupt_randomness(int irq, int irq_flags);
-+
+ extern void add_interrupt_randomness(int irq, int irq_flags);
+
+#ifdef CONFIG_PAX_LATENT_ENTROPY
+extern void transfer_latent_entropy(void);
+#endif
-
++
extern void get_random_bytes(void *buf, int nbytes);
+ extern void get_random_bytes_arch(void *buf, int nbytes);
void generate_random_uuid(unsigned char uuid_out[16]);
-@@ -63,6 +68,24 @@ unsigned long randomize_range(unsigned long start, unsigned long end, unsigned l
- u32 random32(void);
- void srandom32(u32 seed);
+@@ -76,6 +80,24 @@ static inline int arch_get_random_int(unsigned int *v)
+ }
+ #endif
+static inline unsigned long pax_get_random_long(void)
+{
@@ -91932,30 +89754,8 @@ index eca6235..c7417ed 100644
};
/* shm_mode upper byte flags */
-diff --git a/include/linux/signalfd.h b/include/linux/signalfd.h
-index b363b91..ed9b65e 100644
---- a/include/linux/signalfd.h
-+++ b/include/linux/signalfd.h
-@@ -60,13 +60,16 @@ static inline void signalfd_notify(struct task_struct *tsk, int sig)
- wake_up(&tsk->sighand->signalfd_wqh);
- }
-
-+extern void signalfd_cleanup(struct sighand_struct *sighand);
-+
- #else /* CONFIG_SIGNALFD */
-
- static inline void signalfd_notify(struct task_struct *tsk, int sig) { }
-
-+static inline void signalfd_cleanup(struct sighand_struct *sighand) { }
-+
- #endif /* CONFIG_SIGNALFD */
-
- #endif /* __KERNEL__ */
-
- #endif /* _LINUX_SIGNALFD_H */
--
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
-index bcdd660..f06bb1a 100644
+index 4e647bb..23b3911 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -14,6 +14,7 @@
@@ -92002,7 +89802,7 @@ index bcdd660..f06bb1a 100644
}
/**
-@@ -1367,7 +1368,7 @@ static inline int skb_network_offset(const struct sk_buff *skb)
+@@ -1377,7 +1378,7 @@ static inline int skb_network_offset(const struct sk_buff *skb)
* headroom, you should not reduce this.
*/
#ifndef NET_SKB_PAD
@@ -92011,7 +89811,7 @@ index bcdd660..f06bb1a 100644
#endif
extern int ___pskb_trim(struct sk_buff *skb, unsigned int len);
-@@ -1489,6 +1490,22 @@ static inline struct sk_buff *netdev_alloc_skb(struct net_device *dev,
+@@ -1499,6 +1500,22 @@ static inline struct sk_buff *netdev_alloc_skb(struct net_device *dev,
return __netdev_alloc_skb(dev, length, GFP_ATOMIC);
}
@@ -92034,7 +89834,7 @@ index bcdd660..f06bb1a 100644
extern struct page *__netdev_alloc_page(struct net_device *dev, gfp_t gfp_mask);
/**
-@@ -1740,7 +1757,7 @@ extern struct sk_buff *skb_recv_datagram(struct sock *sk, unsigned flags,
+@@ -1750,7 +1767,7 @@ extern struct sk_buff *skb_recv_datagram(struct sock *sk, unsigned flags,
int noblock, int *err);
extern unsigned int datagram_poll(struct file *file, struct socket *sock,
struct poll_table_struct *wait);
@@ -93142,32 +90942,6 @@ index 9a4b8b7..e49e077 100644
#ifdef CONFIG_IP_MROUTE
struct sock *mroute_sk;
-diff --git a/include/net/rose.h b/include/net/rose.h
-index 5ba9f02..555dd19 100644
---- a/include/net/rose.h
-+++ b/include/net/rose.h
-@@ -14,6 +14,12 @@
-
- #define ROSE_MIN_LEN 3
-
-+#define ROSE_CALL_REQ_ADDR_LEN_OFF 3
-+#define ROSE_CALL_REQ_ADDR_LEN_VAL 0xAA /* each address is 10 digits */
-+#define ROSE_CALL_REQ_DEST_ADDR_OFF 4
-+#define ROSE_CALL_REQ_SRC_ADDR_OFF 9
-+#define ROSE_CALL_REQ_FACILITIES_OFF 14
-+
- #define ROSE_GFI 0x10
- #define ROSE_Q_BIT 0x80
- #define ROSE_D_BIT 0x40
-@@ -214,7 +220,7 @@ extern void rose_requeue_frames(struct sock *);
- extern int rose_validate_nr(struct sock *, unsigned short);
- extern void rose_write_internal(struct sock *, int);
- extern int rose_decode(struct sk_buff *, int *, int *, int *, int *, int *);
--extern int rose_parse_facilities(unsigned char *, struct rose_facilities_struct *);
-+extern int rose_parse_facilities(unsigned char *, unsigned int, struct rose_facilities_struct *);
- extern void rose_disconnect(struct sock *, int, int, int);
-
- /* rose_timer.c */
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index 8a6d529..171f401 100644
--- a/include/net/sctp/sctp.h
@@ -94706,7 +92480,7 @@ index 3f2f04f..4e53ded 100644
/* If set, cpu_up and cpu_down will return -EBUSY and do nothing.
* Should always be manipulated under cpu_add_remove_lock
diff --git a/kernel/cred.c b/kernel/cred.c
-index 0b5b5fc..2a2f00d 100644
+index 9c06d10..5b211dc 100644
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -160,6 +160,8 @@ static void put_cred_rcu(struct rcu_head *rcu)
@@ -94796,9 +92570,9 @@ index 0b5b5fc..2a2f00d 100644
+
+ p->replacement_session_keyring = NULL;
- if (
- #ifdef CONFIG_KEYS
-@@ -523,11 +546,13 @@ error_put:
+ p->replacement_session_keyring = NULL;
+
+@@ -525,11 +548,13 @@ error_put:
* Always returns 0 thus allowing this function to be tail-called at the end
* of, say, sys_setgid().
*/
@@ -94813,7 +92587,7 @@ index 0b5b5fc..2a2f00d 100644
kdebug("commit_creds(%p{%d,%d})", new,
atomic_read(&new->usage),
read_cred_subscribers(new));
-@@ -544,6 +569,8 @@ int commit_creds(struct cred *new)
+@@ -546,6 +571,8 @@ int commit_creds(struct cred *new)
get_cred(new); /* we will require a ref for the subj creds too */
@@ -94822,7 +92596,7 @@ index 0b5b5fc..2a2f00d 100644
/* dumpability changes */
if (old->euid != new->euid ||
old->egid != new->egid ||
-@@ -563,10 +590,8 @@ int commit_creds(struct cred *new)
+@@ -565,10 +592,8 @@ int commit_creds(struct cred *new)
key_fsgid_changed(task);
/* do it
@@ -94835,7 +92609,7 @@ index 0b5b5fc..2a2f00d 100644
*/
alter_cred_subscribers(new, 2);
if (new->user != old->user)
-@@ -595,8 +620,105 @@ int commit_creds(struct cred *new)
+@@ -597,8 +622,105 @@ int commit_creds(struct cred *new)
put_cred(old);
return 0;
}
@@ -94941,7 +92715,7 @@ index 0b5b5fc..2a2f00d 100644
/**
* abort_creds - Discard a set of credentials and unlock the current task
* @new: The credentials that were going to be applied
-@@ -606,6 +728,8 @@ EXPORT_SYMBOL(commit_creds);
+@@ -608,6 +730,8 @@ EXPORT_SYMBOL(commit_creds);
*/
void abort_creds(struct cred *new)
{
@@ -94950,7 +92724,7 @@ index 0b5b5fc..2a2f00d 100644
kdebug("abort_creds(%p{%d,%d})", new,
atomic_read(&new->usage),
read_cred_subscribers(new));
-@@ -629,6 +753,8 @@ const struct cred *override_creds(const struct cred *new)
+@@ -631,6 +755,8 @@ const struct cred *override_creds(const struct cred *new)
{
const struct cred *old = current->cred;
@@ -94959,7 +92733,7 @@ index 0b5b5fc..2a2f00d 100644
kdebug("override_creds(%p{%d,%d})", new,
atomic_read(&new->usage),
read_cred_subscribers(new));
-@@ -658,6 +784,8 @@ void revert_creds(const struct cred *old)
+@@ -660,6 +786,8 @@ void revert_creds(const struct cred *old)
{
const struct cred *override = current->cred;
@@ -94968,7 +92742,7 @@ index 0b5b5fc..2a2f00d 100644
kdebug("revert_creds(%p{%d,%d})", old,
atomic_read(&old->usage),
read_cred_subscribers(old));
-@@ -704,6 +832,8 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
+@@ -706,6 +834,8 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
const struct cred *old;
struct cred *new;
@@ -94977,7 +92751,7 @@ index 0b5b5fc..2a2f00d 100644
new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
if (!new)
return NULL;
-@@ -758,6 +888,8 @@ EXPORT_SYMBOL(prepare_kernel_cred);
+@@ -760,6 +890,8 @@ EXPORT_SYMBOL(prepare_kernel_cred);
*/
int set_security_override(struct cred *new, u32 secid)
{
@@ -94986,7 +92760,7 @@ index 0b5b5fc..2a2f00d 100644
return security_kernel_act_as(new, secid);
}
EXPORT_SYMBOL(set_security_override);
-@@ -777,6 +909,8 @@ int set_security_override_from_ctx(struct cred *new, const char *secctx)
+@@ -779,6 +911,8 @@ int set_security_override_from_ctx(struct cred *new, const char *secctx)
u32 secid;
int ret;
@@ -94996,7 +92770,7 @@ index 0b5b5fc..2a2f00d 100644
if (ret < 0)
return ret;
diff --git a/kernel/exit.c b/kernel/exit.c
-index 0f8fae3..66af9b1 100644
+index a2a1659..66af9b1 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -55,6 +55,10 @@
@@ -95097,15 +92871,6 @@ index 0f8fae3..66af9b1 100644
exit_mm(tsk);
if (group_dead)
-@@ -1020,7 +1049,7 @@ NORET_TYPE void do_exit(long code)
- tsk->flags |= PF_EXITPIDONE;
-
- if (tsk->io_context)
-- exit_io_context();
-+ exit_io_context(tsk);
-
- if (tsk->splice_pipe)
- __free_pipe_info(tsk->splice_pipe);
@@ -1059,7 +1088,7 @@ SYSCALL_DEFINE1(exit, int, error_code)
* Take down every thread in the group. This is called by fatal signals
* as well as by sys_exit_group (below).
@@ -95125,18 +92890,10 @@ index 0f8fae3..66af9b1 100644
get_task_struct(p);
read_unlock(&tasklist_lock);
diff --git a/kernel/fork.c b/kernel/fork.c
-index 4bde56f..cccd645 100644
+index c28f804..cccd645 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
-@@ -64,6 +64,7 @@
- #include <linux/magic.h>
- #include <linux/perf_event.h>
- #include <linux/posix-timers.h>
-+#include <linux/signalfd.h>
-
- #include <asm/pgtable.h>
- #include <asm/pgalloc.h>
-@@ -239,21 +240,26 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
+@@ -240,21 +240,26 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
}
err = arch_dup_task_struct(tsk, orig);
@@ -95171,7 +92928,7 @@ index 4bde56f..cccd645 100644
#endif
/* One for us, one for whoever does the "release_task()" (usually parent) */
-@@ -293,8 +299,8 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
+@@ -294,8 +299,8 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
mm->locked_vm = 0;
mm->mmap = NULL;
mm->mmap_cache = NULL;
@@ -95182,7 +92939,7 @@ index 4bde56f..cccd645 100644
mm->map_count = 0;
cpumask_clear(mm_cpumask(mm));
mm->mm_rb = RB_ROOT;
-@@ -318,7 +324,7 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
+@@ -319,7 +324,7 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
}
charge = 0;
if (mpnt->vm_flags & VM_ACCOUNT) {
@@ -95191,7 +92948,7 @@ index 4bde56f..cccd645 100644
if (security_vm_enough_memory(len))
goto fail_nomem;
charge = len;
-@@ -335,6 +341,7 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
+@@ -336,6 +341,7 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
tmp->vm_flags &= ~VM_LOCKED;
tmp->vm_mm = mm;
tmp->vm_next = tmp->vm_prev = NULL;
@@ -95199,7 +92956,7 @@ index 4bde56f..cccd645 100644
anon_vma_link(tmp);
file = tmp->vm_file;
if (file) {
-@@ -384,6 +391,31 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
+@@ -385,6 +391,31 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
if (retval)
goto out;
}
@@ -95231,7 +92988,7 @@ index 4bde56f..cccd645 100644
/* a new mm has just been created */
arch_dup_mmap(oldmm, mm);
retval = 0;
-@@ -734,13 +766,14 @@ static int copy_fs(unsigned long clone_flags, struct task_struct *tsk)
+@@ -735,13 +766,14 @@ static int copy_fs(unsigned long clone_flags, struct task_struct *tsk)
write_unlock(&fs->lock);
return -EAGAIN;
}
@@ -95247,19 +93004,7 @@ index 4bde56f..cccd645 100644
return 0;
}
-@@ -815,8 +848,10 @@ static int copy_sighand(unsigned long clone_flags, struct task_struct *tsk)
-
- void __cleanup_sighand(struct sighand_struct *sighand)
- {
-- if (atomic_dec_and_test(&sighand->count))
-+ if (atomic_dec_and_test(&sighand->count)) {
-+ signalfd_cleanup(sighand);
- kmem_cache_free(sighand_cachep, sighand);
-+ }
- }
-
-
-@@ -910,6 +945,8 @@ static int copy_signal(unsigned long clone_flags, struct task_struct *tsk)
+@@ -913,6 +945,8 @@ static int copy_signal(unsigned long clone_flags, struct task_struct *tsk)
sig->oom_adj = current->signal->oom_adj;
@@ -95268,7 +93013,7 @@ index 4bde56f..cccd645 100644
return 0;
}
-@@ -1033,12 +1070,16 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+@@ -1036,12 +1070,16 @@ static struct task_struct *copy_process(unsigned long clone_flags,
DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
#endif
retval = -EAGAIN;
@@ -95287,7 +93032,7 @@ index 4bde56f..cccd645 100644
retval = copy_creds(p, clone_flags);
if (retval < 0)
-@@ -1233,6 +1274,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+@@ -1236,6 +1274,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
/* Need tasklist lock for parent etc handling! */
write_lock_irq(&tasklist_lock);
@@ -95297,17 +93042,7 @@ index 4bde56f..cccd645 100644
/* CLONE_PARENT re-uses the old parent */
if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) {
p->real_parent = current->real_parent;
-@@ -1299,7 +1343,8 @@ bad_fork_free_pid:
- if (pid != &init_struct_pid)
- free_pid(pid);
- bad_fork_cleanup_io:
-- put_io_context(p->io_context);
-+ if (p->io_context)
-+ exit_io_context(p);
- bad_fork_cleanup_namespaces:
- exit_task_namespaces(p);
- bad_fork_cleanup_mm:
-@@ -1333,6 +1378,8 @@ bad_fork_cleanup_count:
+@@ -1337,6 +1378,8 @@ bad_fork_cleanup_count:
bad_fork_free:
free_task(p);
fork_out:
@@ -95316,7 +93051,7 @@ index 4bde56f..cccd645 100644
return ERR_PTR(retval);
}
-@@ -1426,6 +1473,8 @@ long do_fork(unsigned long clone_flags,
+@@ -1430,6 +1473,8 @@ long do_fork(unsigned long clone_flags,
if (clone_flags & CLONE_PARENT_SETTID)
put_user(nr, parent_tidptr);
@@ -95325,7 +93060,7 @@ index 4bde56f..cccd645 100644
if (clone_flags & CLONE_VFORK) {
p->vfork_done = &vfork;
init_completion(&vfork);
-@@ -1558,7 +1607,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
+@@ -1562,7 +1607,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
return 0;
/* don't need lock here; in the worst case we'll do useless copy */
@@ -95334,7 +93069,7 @@ index 4bde56f..cccd645 100644
return 0;
*new_fsp = copy_fs_struct(fs);
-@@ -1681,7 +1730,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
+@@ -1685,7 +1730,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
fs = current->fs;
write_lock(&fs->lock);
current->fs = new_fs;
@@ -95345,7 +93080,7 @@ index 4bde56f..cccd645 100644
else
new_fs = fs;
diff --git a/kernel/futex.c b/kernel/futex.c
-index fb98c9f..f8c336d 100644
+index 9c5ffe1..05b7eb1 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -54,6 +54,7 @@
@@ -95368,7 +93103,7 @@ index fb98c9f..f8c336d 100644
/*
* The futex address must be "naturally" aligned.
*/
-@@ -1819,6 +1825,8 @@ static int futex_wait(u32 __user *uaddr, int fshared,
+@@ -1831,6 +1837,8 @@ static int futex_wait(u32 __user *uaddr, int fshared,
struct futex_q q;
int ret;
@@ -95377,7 +93112,7 @@ index fb98c9f..f8c336d 100644
if (!bitset)
return -EINVAL;
-@@ -1871,7 +1879,7 @@ retry:
+@@ -1883,7 +1891,7 @@ retry:
restart = ¤t_thread_info()->restart_block;
restart->fn = futex_wait_restart;
@@ -95386,45 +93121,16 @@ index fb98c9f..f8c336d 100644
restart->futex.val = val;
restart->futex.time = abs_time->tv64;
restart->futex.bitset = bitset;
-@@ -2192,11 +2200,11 @@ int handle_early_requeue_pi_wakeup(struct futex_hash_bucket *hb,
- * @uaddr2: the pi futex we will take prior to returning to user-space
- *
- * The caller will wait on uaddr and will be requeued by futex_requeue() to
-- * uaddr2 which must be PI aware. Normal wakeup will wake on uaddr2 and
-- * complete the acquisition of the rt_mutex prior to returning to userspace.
-- * This ensures the rt_mutex maintains an owner when it has waiters; without
-- * one, the pi logic wouldn't know which task to boost/deboost, if there was a
-- * need to.
-+ * uaddr2 which must be PI aware and unique from uaddr. Normal wakeup will wake
-+ * on uaddr2 and complete the acquisition of the rt_mutex prior to returning to
-+ * userspace. This ensures the rt_mutex maintains an owner when it has waiters;
-+ * without one, the pi logic would not know which task to boost/deboost, if
-+ * there was a need to.
- *
- * We call schedule in futex_wait_queue_me() when we enqueue and return there
- * via the following:
-@@ -2233,6 +2241,11 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, int fshared,
+@@ -2245,6 +2253,8 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, int fshared,
struct futex_q q;
int res, ret;
+ pax_track_stack();
+
-+ if (uaddr == uaddr2)
-+ return -EINVAL;
-+
- if (!bitset)
+ if (uaddr == uaddr2)
return -EINVAL;
-@@ -2333,7 +2346,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, int fshared,
- * fault, unlock the rt_mutex and return the fault to userspace.
- */
- if (ret == -EFAULT) {
-- if (rt_mutex_owner(pi_mutex) == current)
-+ if (pi_mutex && rt_mutex_owner(pi_mutex) == current)
- rt_mutex_unlock(pi_mutex);
- } else if (ret == -EINTR) {
- /*
-@@ -2423,6 +2436,10 @@ SYSCALL_DEFINE3(get_robust_list, int, pid,
+@@ -2438,6 +2448,10 @@ SYSCALL_DEFINE3(get_robust_list, int, pid,
if (!p)
goto err_unlock;
ret = -EPERM;
@@ -95435,7 +93141,7 @@ index fb98c9f..f8c336d 100644
pcred = __task_cred(p);
if (cred->euid != pcred->euid &&
cred->euid != pcred->uid &&
-@@ -2489,7 +2506,7 @@ retry:
+@@ -2504,7 +2518,7 @@ retry:
*/
static inline int fetch_robust_entry(struct robust_list __user **entry,
struct robust_list __user * __user *head,
@@ -95444,7 +93150,7 @@ index fb98c9f..f8c336d 100644
{
unsigned long uentry;
-@@ -2670,6 +2687,7 @@ static int __init futex_init(void)
+@@ -2685,6 +2699,7 @@ static int __init futex_init(void)
{
u32 curval;
int i;
@@ -95452,7 +93158,7 @@ index fb98c9f..f8c336d 100644
/*
* This will fail and we want it. Some arch implementations do
-@@ -2681,7 +2699,10 @@ static int __init futex_init(void)
+@@ -2696,7 +2711,10 @@ static int __init futex_init(void)
* implementation, the non functional ones will return
* -ENOSYS.
*/
@@ -95522,50 +93228,18 @@ index 9b22d03..6295b62 100644
prev->next = info->next;
else
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
-index a6e9d00..a0da4f9 100644
+index 2818422..b63eb19 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
-@@ -1391,7 +1391,7 @@ void hrtimer_peek_ahead_timers(void)
+@@ -1402,7 +1402,7 @@ void hrtimer_peek_ahead_timers(void)
local_irq_restore(flags);
}
-static void run_hrtimer_softirq(struct softirq_action *h)
+static void run_hrtimer_softirq(void)
{
- hrtimer_peek_ahead_timers();
- }
-diff --git a/kernel/irq/handle.c b/kernel/irq/handle.c
-index 17c71bb..27fd0a6 100644
---- a/kernel/irq/handle.c
-+++ b/kernel/irq/handle.c
-@@ -370,7 +370,7 @@ static void warn_no_thread(unsigned int irq, struct irqaction *action)
- irqreturn_t handle_IRQ_event(unsigned int irq, struct irqaction *action)
- {
- irqreturn_t ret, retval = IRQ_NONE;
-- unsigned int status = 0;
-+ unsigned int flags = 0;
-
- if (!(action->flags & IRQF_DISABLED))
- local_irq_enable_in_hardirq();
-@@ -413,7 +413,7 @@ irqreturn_t handle_IRQ_event(unsigned int irq, struct irqaction *action)
+ struct hrtimer_cpu_base *cpu_base = &__get_cpu_var(hrtimer_bases);
- /* Fall through to add to randomness */
- case IRQ_HANDLED:
-- status |= action->flags;
-+ flags |= action->flags;
- break;
-
- default:
-@@ -424,8 +424,7 @@ irqreturn_t handle_IRQ_event(unsigned int irq, struct irqaction *action)
- action = action->next;
- } while (action);
-
-- if (status & IRQF_SAMPLE_RANDOM)
-- add_interrupt_randomness(irq);
-+ add_interrupt_randomness(irq, flags);
- local_irq_disable();
-
- return retval;
diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
index 8b6b8b6..6bc87df 100644
--- a/kernel/kallsyms.c
@@ -99033,7 +96707,7 @@ index 57b953f..06f149f 100644
cpumask_clear_cpu(cpu, tick_get_broadcast_mask());
tick_broadcast_clear_oneshot(cpu);
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
-index 4a71cff..ffb5548 100644
+index 3d35af3..7936e72 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -14,6 +14,7 @@
@@ -99044,7 +96718,7 @@ index 4a71cff..ffb5548 100644
#include <linux/sysdev.h>
#include <linux/clocksource.h>
#include <linux/jiffies.h>
-@@ -180,7 +181,7 @@ void update_xtime_cache(u64 nsec)
+@@ -208,7 +209,7 @@ void update_xtime_cache(u64 nsec)
*/
struct timespec ts = xtime;
timespec_add_ns(&ts, nsec);
@@ -99052,9 +96726,9 @@ index 4a71cff..ffb5548 100644
+ ACCESS_ONCE_RW(xtime_cache) = ts;
}
- /* must hold xtime_lock */
-@@ -337,6 +338,8 @@ int do_settimeofday(struct timespec *tv)
- if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC)
+ #ifdef CONFIG_GENERIC_TIME
+@@ -357,6 +358,8 @@ int do_settimeofday(struct timespec *tv)
+ if (!timespec_valid_strict(tv))
return -EINVAL;
+ gr_log_timechange();
@@ -99956,184 +97630,10 @@ index 9c1e627..5ca9447 100644
set_page_address(page, (void *)vaddr);
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
-index 5e1e508..0c488e1 100644
+index 20f9240..0c488e1 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
-@@ -49,6 +49,84 @@ static unsigned long __initdata default_hstate_size;
- */
- static DEFINE_SPINLOCK(hugetlb_lock);
-
-+static inline void unlock_or_release_subpool(struct hugepage_subpool *spool)
-+{
-+ bool free = (spool->count == 0) && (spool->used_hpages == 0);
-+
-+ spin_unlock(&spool->lock);
-+
-+ /* If no pages are used, and no other handles to the subpool
-+ * remain, free the subpool the subpool remain */
-+ if (free)
-+ kfree(spool);
-+}
-+
-+struct hugepage_subpool *hugepage_new_subpool(long nr_blocks)
-+{
-+ struct hugepage_subpool *spool;
-+
-+ spool = kmalloc(sizeof(*spool), GFP_KERNEL);
-+ if (!spool)
-+ return NULL;
-+
-+ spin_lock_init(&spool->lock);
-+ spool->count = 1;
-+ spool->max_hpages = nr_blocks;
-+ spool->used_hpages = 0;
-+
-+ return spool;
-+}
-+
-+void hugepage_put_subpool(struct hugepage_subpool *spool)
-+{
-+ spin_lock(&spool->lock);
-+ BUG_ON(!spool->count);
-+ spool->count--;
-+ unlock_or_release_subpool(spool);
-+}
-+
-+static int hugepage_subpool_get_pages(struct hugepage_subpool *spool,
-+ long delta)
-+{
-+ int ret = 0;
-+
-+ if (!spool)
-+ return 0;
-+
-+ spin_lock(&spool->lock);
-+ if ((spool->used_hpages + delta) <= spool->max_hpages) {
-+ spool->used_hpages += delta;
-+ } else {
-+ ret = -ENOMEM;
-+ }
-+ spin_unlock(&spool->lock);
-+
-+ return ret;
-+}
-+
-+static void hugepage_subpool_put_pages(struct hugepage_subpool *spool,
-+ long delta)
-+{
-+ if (!spool)
-+ return;
-+
-+ spin_lock(&spool->lock);
-+ spool->used_hpages -= delta;
-+ /* If hugetlbfs_put_super couldn't free spool due to
-+ * an outstanding quota reference, free it now. */
-+ unlock_or_release_subpool(spool);
-+}
-+
-+static inline struct hugepage_subpool *subpool_inode(struct inode *inode)
-+{
-+ return HUGETLBFS_SB(inode->i_sb)->spool;
-+}
-+
-+static inline struct hugepage_subpool *subpool_vma(struct vm_area_struct *vma)
-+{
-+ return subpool_inode(vma->vm_file->f_dentry->d_inode);
-+}
-+
- /*
- * Region tracking -- allows tracking of reservations and instantiated pages
- * across the pages in a mapping.
-@@ -541,9 +619,9 @@ static void free_huge_page(struct page *page)
- */
- struct hstate *h = page_hstate(page);
- int nid = page_to_nid(page);
-- struct address_space *mapping;
-+ struct hugepage_subpool *spool =
-+ (struct hugepage_subpool *)page_private(page);
-
-- mapping = (struct address_space *) page_private(page);
- set_page_private(page, 0);
- page->mapping = NULL;
- BUG_ON(page_count(page));
-@@ -558,8 +636,7 @@ static void free_huge_page(struct page *page)
- enqueue_huge_page(h, page);
- }
- spin_unlock(&hugetlb_lock);
-- if (mapping)
-- hugetlb_put_quota(mapping, 1);
-+ hugepage_subpool_put_pages(spool, 1);
- }
-
- static void prep_new_huge_page(struct hstate *h, struct page *page, int nid)
-@@ -927,11 +1004,12 @@ static void return_unused_surplus_pages(struct hstate *h,
- /*
- * Determine if the huge page at addr within the vma has an associated
- * reservation. Where it does not we will need to logically increase
-- * reservation and actually increase quota before an allocation can occur.
-- * Where any new reservation would be required the reservation change is
-- * prepared, but not committed. Once the page has been quota'd allocated
-- * an instantiated the change should be committed via vma_commit_reservation.
-- * No action is required on failure.
-+ * reservation and actually increase subpool usage before an allocation
-+ * can occur. Where any new reservation would be required the
-+ * reservation change is prepared, but not committed. Once the page
-+ * has been allocated from the subpool and instantiated the change should
-+ * be committed via vma_commit_reservation. No action is required on
-+ * failure.
- */
- static long vma_needs_reservation(struct hstate *h,
- struct vm_area_struct *vma, unsigned long addr)
-@@ -980,24 +1058,24 @@ static void vma_commit_reservation(struct hstate *h,
- static struct page *alloc_huge_page(struct vm_area_struct *vma,
- unsigned long addr, int avoid_reserve)
- {
-+ struct hugepage_subpool *spool = subpool_vma(vma);
- struct hstate *h = hstate_vma(vma);
- struct page *page;
-- struct address_space *mapping = vma->vm_file->f_mapping;
-- struct inode *inode = mapping->host;
- long chg;
-
- /*
-- * Processes that did not create the mapping will have no reserves and
-- * will not have accounted against quota. Check that the quota can be
-- * made before satisfying the allocation
-- * MAP_NORESERVE mappings may also need pages and quota allocated
-- * if no reserve mapping overlaps.
-+ * Processes that did not create the mapping will have no
-+ * reserves and will not have accounted against subpool
-+ * limit. Check that the subpool limit can be made before
-+ * satisfying the allocation MAP_NORESERVE mappings may also
-+ * need pages and subpool limit allocated allocated if no reserve
-+ * mapping overlaps.
- */
- chg = vma_needs_reservation(h, vma, addr);
- if (chg < 0)
- return ERR_PTR(-VM_FAULT_OOM);
- if (chg)
-- if (hugetlb_get_quota(inode->i_mapping, chg))
-+ if (hugepage_subpool_get_pages(spool, chg))
- return ERR_PTR(-VM_FAULT_SIGBUS);
-
- spin_lock(&hugetlb_lock);
-@@ -1007,13 +1085,13 @@ static struct page *alloc_huge_page(struct vm_area_struct *vma,
- if (!page) {
- page = alloc_buddy_huge_page(h, vma, addr);
- if (!page) {
-- hugetlb_put_quota(inode->i_mapping, chg);
-+ hugepage_subpool_put_pages(spool, chg);
- return ERR_PTR(-VM_FAULT_SIGBUS);
- }
- }
-
- set_page_refcounted(page);
-- set_page_private(page, (unsigned long) mapping);
-+ set_page_private(page, (unsigned long)spool);
-
- vma_commit_reservation(h, vma, addr);
-
-@@ -1694,10 +1772,20 @@ static void hugetlb_vm_op_open(struct vm_area_struct *vma)
+@@ -1772,6 +1772,15 @@ static void hugetlb_vm_op_open(struct vm_area_struct *vma)
kref_get(&reservations->refs);
}
@@ -100149,12 +97649,7 @@ index 5e1e508..0c488e1 100644
static void hugetlb_vm_op_close(struct vm_area_struct *vma)
{
struct hstate *h = hstate_vma(vma);
- struct resv_map *reservations = vma_resv_map(vma);
-+ struct hugepage_subpool *spool = subpool_vma(vma);
- unsigned long reserve;
- unsigned long start;
- unsigned long end;
-@@ -1709,11 +1797,11 @@ static void hugetlb_vm_op_close(struct vm_area_struct *vma)
+@@ -1788,7 +1797,7 @@ static void hugetlb_vm_op_close(struct vm_area_struct *vma)
reserve = (end - start) -
region_count(&reservations->regions, start, end);
@@ -100163,21 +97658,7 @@ index 5e1e508..0c488e1 100644
if (reserve) {
hugetlb_acct_memory(h, -reserve);
-- hugetlb_put_quota(vma->vm_file->f_mapping, reserve);
-+ hugepage_subpool_put_pages(spool, reserve);
- }
- }
- }
-@@ -1910,7 +1998,7 @@ static int unmap_ref_private(struct mm_struct *mm, struct vm_area_struct *vma,
- address = address & huge_page_mask(h);
- pgoff = ((address - vma->vm_start) >> PAGE_SHIFT)
- + (vma->vm_pgoff >> PAGE_SHIFT);
-- mapping = (struct address_space *)page_private(page);
-+ mapping = vma->vm_file->f_dentry->d_inode->i_mapping;
-
- vma_prio_tree_foreach(iter_vma, &iter, &mapping->i_mmap, pgoff, pgoff) {
- /* Do not unmap the current VMA */
-@@ -1933,6 +2021,26 @@ static int unmap_ref_private(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2012,6 +2021,26 @@ static int unmap_ref_private(struct mm_struct *mm, struct vm_area_struct *vma,
return 1;
}
@@ -100204,7 +97685,7 @@ index 5e1e508..0c488e1 100644
static int hugetlb_cow(struct mm_struct *mm, struct vm_area_struct *vma,
unsigned long address, pte_t *ptep, pte_t pte,
struct page *pagecache_page)
-@@ -2004,6 +2112,11 @@ retry_avoidcopy:
+@@ -2083,6 +2112,11 @@ retry_avoidcopy:
huge_ptep_clear_flush(vma, address, ptep);
set_huge_pte_at(mm, address, ptep,
make_huge_pte(vma, new_page, 1));
@@ -100216,7 +97697,7 @@ index 5e1e508..0c488e1 100644
/* Make the old page be freed below */
new_page = old_page;
}
-@@ -2135,6 +2248,10 @@ retry:
+@@ -2214,6 +2248,10 @@ retry:
&& (vma->vm_flags & VM_SHARED)));
set_huge_pte_at(mm, address, ptep, new_pte);
@@ -100227,7 +97708,7 @@ index 5e1e508..0c488e1 100644
if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) {
/* Optimization, do the COW without a second fault */
ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page);
-@@ -2163,6 +2280,28 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2242,6 +2280,28 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
static DEFINE_MUTEX(hugetlb_instantiation_mutex);
struct hstate *h = hstate_vma(vma);
@@ -100256,21 +97737,7 @@ index 5e1e508..0c488e1 100644
ptep = huge_pte_alloc(mm, address, huge_page_size(h));
if (!ptep)
return VM_FAULT_OOM;
-@@ -2364,11 +2503,12 @@ int hugetlb_reserve_pages(struct inode *inode,
- {
- long ret, chg;
- struct hstate *h = hstate_inode(inode);
-+ struct hugepage_subpool *spool = subpool_inode(inode);
-
- /*
- * Only apply hugepage reservation if asked. At fault time, an
- * attempt will be made for VM_NORESERVE to allocate a page
-- * and filesystem quota without using reserves
-+ * without using reserves
- */
- if (acctflag & VM_NORESERVE)
- return 0;
-@@ -2392,21 +2532,25 @@ int hugetlb_reserve_pages(struct inode *inode,
+@@ -2472,12 +2532,16 @@ int hugetlb_reserve_pages(struct inode *inode,
set_vma_resv_flags(vma, HPAGE_RESV_OWNER);
}
@@ -100281,10 +97748,9 @@ index 5e1e508..0c488e1 100644
+ goto out_err;
+ }
-- /* There must be enough filesystem quota for the mapping */
-- if (hugetlb_get_quota(inode->i_mapping, chg))
+ /* There must be enough pages in the subpool for the mapping */
+- if (hugepage_subpool_get_pages(spool, chg))
- return -ENOSPC;
-+ /* There must be enough pages in the subpool for the mapping */
+ if (hugepage_subpool_get_pages(spool, chg)) {
+ ret = -ENOSPC;
+ goto out_err;
@@ -100292,19 +97758,16 @@ index 5e1e508..0c488e1 100644
/*
* Check enough hugepages are available for the reservation.
-- * Hand back the quota if there are not
-+ * Hand the pages back to the subpool if there are not
- */
+@@ -2486,7 +2550,7 @@ int hugetlb_reserve_pages(struct inode *inode,
ret = hugetlb_acct_memory(h, chg);
if (ret < 0) {
-- hugetlb_put_quota(inode->i_mapping, chg);
+ hugepage_subpool_put_pages(spool, chg);
- return ret;
-+ hugepage_subpool_put_pages(spool, chg);
+ goto out_err;
}
/*
-@@ -2423,17 +2567,22 @@ int hugetlb_reserve_pages(struct inode *inode,
+@@ -2503,6 +2567,10 @@ int hugetlb_reserve_pages(struct inode *inode,
if (!vma || vma->vm_flags & VM_MAYSHARE)
region_add(&inode->i_mapping->private_list, from, to);
return 0;
@@ -100315,19 +97778,6 @@ index 5e1e508..0c488e1 100644
}
void hugetlb_unreserve_pages(struct inode *inode, long offset, long freed)
- {
- struct hstate *h = hstate_inode(inode);
- long chg = region_truncate(&inode->i_mapping->private_list, offset);
-+ struct hugepage_subpool *spool = subpool_inode(inode);
-
- spin_lock(&inode->i_lock);
- inode->i_blocks -= (blocks_per_huge_page(h) * freed);
- spin_unlock(&inode->i_lock);
-
-- hugetlb_put_quota(inode->i_mapping, (chg - freed));
-+ hugepage_subpool_put_pages(spool, (chg - freed));
- hugetlb_acct_memory(h, -(chg - freed));
- }
diff --git a/mm/internal.h b/mm/internal.h
index f03e8e2..7354343 100644
--- a/mm/internal.h
@@ -100393,19 +97843,18 @@ index 9073695..1127f348 100644
set_fs(old_fs);
diff --git a/mm/madvise.c b/mm/madvise.c
-index 35b1479..d5de85b 100644
+index e405c5f..c96726f 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
-@@ -12,6 +12,8 @@
+@@ -12,6 +12,7 @@
#include <linux/hugetlb.h>
#include <linux/sched.h>
#include <linux/ksm.h>
+#include <linux/fs.h>
-+#include <linux/file.h>
+ #include <linux/file.h>
/*
- * Any behaviour which results in changes to the vma->vm_flags needs to
-@@ -44,6 +46,10 @@ static long madvise_behavior(struct vm_area_struct * vma,
+@@ -45,6 +46,10 @@ static long madvise_behavior(struct vm_area_struct * vma,
pgoff_t pgoff;
unsigned long new_flags = vma->vm_flags;
@@ -100416,7 +97865,7 @@ index 35b1479..d5de85b 100644
switch (behavior) {
case MADV_NORMAL:
new_flags = new_flags & ~VM_RAND_READ & ~VM_SEQ_READ;
-@@ -103,6 +109,13 @@ success:
+@@ -104,6 +109,13 @@ success:
/*
* vm_flags is protected by the mmap_sem held in write mode.
*/
@@ -100430,7 +97879,7 @@ index 35b1479..d5de85b 100644
vma->vm_flags = new_flags;
out:
-@@ -161,6 +174,11 @@ static long madvise_dontneed(struct vm_area_struct * vma,
+@@ -162,6 +174,11 @@ static long madvise_dontneed(struct vm_area_struct * vma,
struct vm_area_struct ** prev,
unsigned long start, unsigned long end)
{
@@ -100442,7 +97891,7 @@ index 35b1479..d5de85b 100644
*prev = vma;
if (vma->vm_flags & (VM_LOCKED|VM_HUGETLB|VM_PFNMAP))
return -EINVAL;
-@@ -173,6 +191,21 @@ static long madvise_dontneed(struct vm_area_struct * vma,
+@@ -174,6 +191,21 @@ static long madvise_dontneed(struct vm_area_struct * vma,
zap_page_range(vma, start, end - start, &details);
} else
zap_page_range(vma, start, end - start, NULL);
@@ -100464,47 +97913,15 @@ index 35b1479..d5de85b 100644
return 0;
}
-@@ -190,16 +223,17 @@ static long madvise_remove(struct vm_area_struct *vma,
- struct address_space *mapping;
- loff_t offset, endoff;
- int error;
-+ struct file *f;
-
- *prev = NULL; /* tell sys_madvise we drop mmap_sem */
-
- if (vma->vm_flags & (VM_LOCKED|VM_NONLINEAR|VM_HUGETLB))
- return -EINVAL;
-
-- if (!vma->vm_file || !vma->vm_file->f_mapping
-- || !vma->vm_file->f_mapping->host) {
-- return -EINVAL;
-- }
-+ f = vma->vm_file;
-+
-+ if (!f || !f->f_mapping || !f->f_mapping->host)
-+ return -EINVAL;
-
- if ((vma->vm_flags & (VM_SHARED|VM_WRITE)) != (VM_SHARED|VM_WRITE))
- return -EACCES;
-@@ -211,10 +245,16 @@ static long madvise_remove(struct vm_area_struct *vma,
- endoff = (loff_t)(end - vma->vm_start - 1)
- + ((loff_t)vma->vm_pgoff << PAGE_SHIFT);
-
-- /* vmtruncate_range needs to take i_mutex and i_alloc_sem */
-+ /* vmtruncate_range needs to take i_mutex and i_alloc_sem. We need to
-+ * explicitly grab a reference because the vma (and hence the
-+ * vma's reference to the file) can go away as soon as we drop
-+ * mmap_sem.
-+ */
-+ get_file(f);
- up_read(¤t->mm->mmap_sem);
+@@ -225,6 +257,7 @@ static long madvise_remove(struct vm_area_struct *vma,
error = vmtruncate_range(mapping->host, offset, endoff);
+ fput(f);
down_read(¤t->mm->mmap_sem);
+ fput(f);
return error;
}
-@@ -359,6 +399,16 @@ SYSCALL_DEFINE3(madvise, unsigned long, start, size_t, len_in, int, behavior)
+@@ -369,6 +402,16 @@ SYSCALL_DEFINE3(madvise, unsigned long, start, size_t, len_in, int, behavior)
if (end < start)
goto out;
@@ -101163,7 +98580,7 @@ index 6c836d3..b2296e1 100644
* Make sure the vDSO gets into every core dump.
* Dumping its contents makes post-mortem fully interpretable later
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
-index 3c6e3e2..a99e912 100644
+index a6563fb..a99e912 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -573,6 +573,10 @@ static int mbind_range(struct vm_area_struct *vma, unsigned long start,
@@ -101237,15 +98654,6 @@ index 3c6e3e2..a99e912 100644
rcu_read_unlock();
err = -EPERM;
goto out;
-@@ -2259,7 +2291,7 @@ int mpol_to_str(char *buffer, int maxlen, struct mempolicy *pol, int no_context)
- break;
-
- default:
-- BUG();
-+ return -EINVAL;
- }
-
- l = strlen(policy_types[mode]);
@@ -2367,6 +2399,12 @@ static inline void check_huge_range(struct vm_area_struct *vma,
}
#endif
@@ -104942,7 +102350,7 @@ index 9559afc..6c62f69 100644
a0 = a[0];
a1 = a[1];
diff --git a/net/core/dev.c b/net/core/dev.c
-index 84a0705..fb849b8 100644
+index 46e2a29..681cc4f 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1047,10 +1047,14 @@ void dev_load(struct net *net, const char *name)
@@ -104960,19 +102368,7 @@ index 84a0705..fb849b8 100644
}
}
EXPORT_SYMBOL(dev_load);
-@@ -1129,10 +1133,7 @@ int dev_open(struct net_device *dev)
- * Wakeup transmit queue engine
- */
- dev_activate(dev);
--
-- /*
-- * ... and announce new interface.
-- */
-+ add_device_randomness(dev->dev_addr, dev->addr_len);
- call_netdevice_notifiers(NETDEV_UP, dev);
- }
-
-@@ -1654,7 +1655,7 @@ static inline int illegal_highdma(struct net_device *dev, struct sk_buff *skb)
+@@ -1655,7 +1659,7 @@ static inline int illegal_highdma(struct net_device *dev, struct sk_buff *skb)
struct dev_gso_cb {
void (*destructor)(struct sk_buff *skb);
@@ -104981,7 +102377,7 @@ index 84a0705..fb849b8 100644
#define DEV_GSO_CB(skb) ((struct dev_gso_cb *)(skb)->cb)
-@@ -2063,7 +2064,7 @@ int netif_rx_ni(struct sk_buff *skb)
+@@ -2064,7 +2068,7 @@ int netif_rx_ni(struct sk_buff *skb)
}
EXPORT_SYMBOL(netif_rx_ni);
@@ -104990,7 +102386,7 @@ index 84a0705..fb849b8 100644
{
struct softnet_data *sd = &__get_cpu_var(softnet_data);
-@@ -2827,7 +2828,7 @@ void netif_napi_del(struct napi_struct *napi)
+@@ -2828,7 +2832,7 @@ void netif_napi_del(struct napi_struct *napi)
EXPORT_SYMBOL(netif_napi_del);
@@ -104999,22 +102395,6 @@ index 84a0705..fb849b8 100644
{
struct list_head *list = &__get_cpu_var(softnet_data).poll_list;
unsigned long time_limit = jiffies + 2;
-@@ -4268,6 +4269,7 @@ int dev_set_mac_address(struct net_device *dev, struct sockaddr *sa)
- err = ops->ndo_set_mac_address(dev, sa);
- if (!err)
- call_netdevice_notifiers(NETDEV_CHANGEADDR, dev);
-+ add_device_randomness(dev->dev_addr, dev->addr_len);
- return err;
- }
- EXPORT_SYMBOL(dev_set_mac_address);
-@@ -4871,6 +4873,7 @@ int register_netdevice(struct net_device *dev)
- dev_init_scheduler(dev);
- dev_hold(dev);
- list_netdevice(dev);
-+ add_device_randomness(dev->dev_addr, dev->addr_len);
-
- /* Notify protocols, that a new device appeared. */
- ret = call_netdevice_notifiers(NETDEV_REGISTER, dev);
diff --git a/net/core/flow.c b/net/core/flow.c
index 9601587..8c4824e 100644
--- a/net/core/flow.c
@@ -105079,7 +102459,7 @@ index 9601587..8c4824e 100644
if (!fle->object || fle->genid == genid)
continue;
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
-index d4fd895..9adcdc5 100644
+index 9d70042..9adcdc5 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -57,7 +57,7 @@ struct rtnl_link
@@ -105091,14 +102471,6 @@ index d4fd895..9adcdc5 100644
static DEFINE_MUTEX(rtnl_mutex);
-@@ -817,6 +817,7 @@ static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
- goto errout;
- send_addr_notify = 1;
- modified = 1;
-+ add_device_randomness(dev->dev_addr, dev->addr_len);
- }
-
- if (tb[IFLA_MTU]) {
diff --git a/net/core/scm.c b/net/core/scm.c
index d98eafc..1a190a9 100644
--- a/net/core/scm.c
@@ -105161,7 +102533,7 @@ index 45329d7..626aaa6 100644
}
#endif
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
-index 025f924..a014894 100644
+index 72ff527..a014894 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -1544,6 +1544,8 @@ int skb_splice_bits(struct sk_buff *skb, unsigned int offset,
@@ -105173,26 +102545,8 @@ index 025f924..a014894 100644
/*
* __skb_splice_bits() only fails if the output has no room left,
* so no point in going over the frag_list for the error case.
-@@ -2989,6 +2991,8 @@ static void sock_rmem_free(struct sk_buff *skb)
- */
- int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
- {
-+ int len = skb->len;
-+
- if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
- (unsigned)sk->sk_rcvbuf)
- return -ENOMEM;
-@@ -3000,7 +3004,7 @@ int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
-
- skb_queue_tail(&sk->sk_error_queue, skb);
- if (!sock_flag(sk, SOCK_DEAD))
-- sk->sk_data_ready(sk, skb->len);
-+ sk->sk_data_ready(sk, len);
- return 0;
- }
- EXPORT_SYMBOL(sock_queue_err_skb);
diff --git a/net/core/sock.c b/net/core/sock.c
-index 6605e75..d53ed34 100644
+index 4538a34..d53ed34 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -562,7 +562,8 @@ set_rcvbuf:
@@ -105222,34 +102576,7 @@ index 6605e75..d53ed34 100644
case SO_PEERNAME:
{
-@@ -1391,6 +1396,11 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
- gfp_t gfp_mask;
- long timeo;
- int err;
-+ int npages = (data_len + (PAGE_SIZE - 1)) >> PAGE_SHIFT;
-+
-+ err = -EMSGSIZE;
-+ if (npages > MAX_SKB_FRAGS)
-+ goto failure;
-
- gfp_mask = sk->sk_allocation;
- if (gfp_mask & __GFP_WAIT)
-@@ -1409,14 +1419,12 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
- if (atomic_read(&sk->sk_wmem_alloc) < sk->sk_sndbuf) {
- skb = alloc_skb(header_len, gfp_mask);
- if (skb) {
-- int npages;
- int i;
-
- /* No pages, we're done... */
- if (!data_len)
- break;
-
-- npages = (data_len + (PAGE_SIZE - 1)) >> PAGE_SHIFT;
- skb->truesize += data_len;
- skb_shinfo(skb)->nr_frags = npages;
- for (i = 0; i < npages; i++) {
-@@ -1892,7 +1900,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
+@@ -1895,7 +1900,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
*/
smp_wmb();
atomic_set(&sk->sk_refcnt, 1);
@@ -105258,28 +102585,6 @@ index 6605e75..d53ed34 100644
}
EXPORT_SYMBOL(sock_init_data);
-diff --git a/net/dccp/ccid.h b/net/dccp/ccid.h
-index facedd2..ab260b0 100644
---- a/net/dccp/ccid.h
-+++ b/net/dccp/ccid.h
-@@ -214,7 +214,7 @@ static inline int ccid_hc_rx_getsockopt(struct ccid *ccid, struct sock *sk,
- u32 __user *optval, int __user *optlen)
- {
- int rc = -ENOPROTOOPT;
-- if (ccid->ccid_ops->ccid_hc_rx_getsockopt != NULL)
-+ if (ccid != NULL && ccid->ccid_ops->ccid_hc_rx_getsockopt != NULL)
- rc = ccid->ccid_ops->ccid_hc_rx_getsockopt(sk, optname, len,
- optval, optlen);
- return rc;
-@@ -225,7 +225,7 @@ static inline int ccid_hc_tx_getsockopt(struct ccid *ccid, struct sock *sk,
- u32 __user *optval, int __user *optlen)
- {
- int rc = -ENOPROTOOPT;
-- if (ccid->ccid_ops->ccid_hc_tx_getsockopt != NULL)
-+ if (ccid != NULL && ccid->ccid_ops->ccid_hc_tx_getsockopt != NULL)
- rc = ccid->ccid_ops->ccid_hc_tx_getsockopt(sk, optname, len,
- optval, optlen);
- return rc;
diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c
index 34dcc79..f51ed45 100644
--- a/net/dccp/ccids/ccid3.c
@@ -105380,23 +102685,6 @@ index 30e74ee..bfc6ee0 100644
kfree_skb(skb);
return NET_RX_DROP;
}
-diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
-index 039cc1f..10f8f8d 100644
---- a/net/ipv4/cipso_ipv4.c
-+++ b/net/ipv4/cipso_ipv4.c
-@@ -1726,8 +1726,10 @@ int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option)
- case CIPSO_V4_TAG_LOCAL:
- /* This is a non-standard tag that we only allow for
- * local connections, so if the incoming interface is
-- * not the loopback device drop the packet. */
-- if (!(skb->dev->flags & IFF_LOOPBACK)) {
-+ * not the loopback device drop the packet. Further,
-+ * there is no legitimate reason for setting this from
-+ * userspace so reject it if skb is NULL. */
-+ if (skb == NULL || !(skb->dev->flags & IFF_LOOPBACK)) {
- err_offset = opt_iter;
- goto validate_return_locked;
- }
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index dba56d2..acee5d6 100644
--- a/net/ipv4/inet_diag.c
@@ -105822,20 +103110,10 @@ index 58f141b..b759702 100644
(jiffies ^ (jiffies >> 7))));
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
-index f095659..537313b 100644
+index b9644d8..537313b 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
-@@ -838,8 +838,7 @@ new_segment:
- wait_for_sndbuf:
- set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
- wait_for_memory:
-- if (copied)
-- tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
-+ tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
-
- if ((err = sk_stream_wait_memory(sk, &timeo)) != 0)
- goto do_error;
-@@ -2085,6 +2084,8 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
+@@ -2084,6 +2084,8 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
int val;
int err = 0;
@@ -105844,7 +103122,7 @@ index f095659..537313b 100644
/* This is a string value all the others are int's */
if (optname == TCP_CONGESTION) {
char name[TCP_CA_NAME_MAX];
-@@ -2355,6 +2356,8 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
+@@ -2354,6 +2356,8 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
struct tcp_sock *tp = tcp_sk(sk);
int val, len;
@@ -105854,7 +103132,7 @@ index f095659..537313b 100644
return -EFAULT;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
-index ce1ce82..81b2dcd 100644
+index db755c4..04481e4 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4528,7 +4528,7 @@ static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb,
@@ -105866,17 +103144,17 @@ index ce1ce82..81b2dcd 100644
struct sk_buff *head, struct sk_buff *tail,
u32 start, u32 end)
{
-@@ -5632,6 +5632,8 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
+@@ -5634,7 +5634,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
goto discard;
if (th->syn) {
+- if (th->fin)
+ if (th->fin || th->urg || th->psh)
-+ goto discard;
+ goto discard;
if (icsk->icsk_af_ops->conn_request(sk, skb) < 0)
return 1;
-
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
-index 6fc7961..33bad4a 100644
+index 6a4e832..7eb316b 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -85,6 +85,9 @@
@@ -105889,7 +103167,7 @@ index 6fc7961..33bad4a 100644
#ifdef CONFIG_TCP_MD5SIG
static struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk,
-@@ -1543,6 +1546,9 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
+@@ -1541,6 +1544,9 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
return 0;
reset:
@@ -105899,7 +103177,7 @@ index 6fc7961..33bad4a 100644
tcp_v4_send_reset(rsk, skb);
discard:
kfree_skb(skb);
-@@ -1604,12 +1610,20 @@ int tcp_v4_rcv(struct sk_buff *skb)
+@@ -1602,12 +1608,20 @@ int tcp_v4_rcv(struct sk_buff *skb)
TCP_SKB_CB(skb)->sacked = 0;
sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
@@ -105922,7 +103200,7 @@ index 6fc7961..33bad4a 100644
if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
goto discard_and_relse;
-@@ -1651,6 +1665,10 @@ no_tcp_socket:
+@@ -1649,6 +1663,10 @@ no_tcp_socket:
bad_packet:
TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
} else {
@@ -105933,7 +103211,7 @@ index 6fc7961..33bad4a 100644
tcp_v4_send_reset(NULL, skb);
}
-@@ -2238,7 +2256,11 @@ static void get_openreq4(struct sock *sk, struct request_sock *req,
+@@ -2236,7 +2254,11 @@ static void get_openreq4(struct sock *sk, struct request_sock *req,
0, /* non standard timer */
0, /* open_requests have no inode */
atomic_read(&sk->sk_refcnt),
@@ -105945,7 +103223,7 @@ index 6fc7961..33bad4a 100644
len);
}
-@@ -2280,7 +2302,12 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
+@@ -2278,7 +2300,12 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
sock_i_uid(sk),
icsk->icsk_probes_out,
sock_i_ino(sk),
@@ -105959,7 +103237,7 @@ index 6fc7961..33bad4a 100644
jiffies_to_clock_t(icsk->icsk_rto),
jiffies_to_clock_t(icsk->icsk_ack.ato),
(icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
-@@ -2308,7 +2335,13 @@ static void get_timewait4_sock(struct inet_timewait_sock *tw,
+@@ -2306,7 +2333,13 @@ static void get_timewait4_sock(struct inet_timewait_sock *tw,
" %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p%n",
i, src, srcp, dest, destp, tw->tw_substate, 0, 0,
3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
@@ -107442,7 +104720,7 @@ index 0000000..b1bac76
+MODULE_ALIAS("ipt_gradm");
+MODULE_ALIAS("ip6t_gradm");
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
-index 5a7dcdf..9f97b61 100644
+index fc91ff6..2458eea 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -733,7 +733,7 @@ static void netlink_overrun(struct sock *sk)
@@ -107454,7 +104732,7 @@ index 5a7dcdf..9f97b61 100644
}
static struct sock *netlink_getsockbypid(struct sock *ssk, u32 pid)
-@@ -1297,8 +1297,10 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
+@@ -1303,8 +1303,10 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
return -EINVAL;
dst_pid = addr->nl_pid;
dst_group = ffs(addr->nl_groups);
@@ -107467,7 +104745,7 @@ index 5a7dcdf..9f97b61 100644
} else {
dst_pid = nlk->dst_pid;
dst_group = nlk->dst_group;
-@@ -1964,15 +1966,23 @@ static int netlink_seq_show(struct seq_file *seq, void *v)
+@@ -1966,15 +1968,23 @@ static int netlink_seq_show(struct seq_file *seq, void *v)
struct netlink_sock *nlk = nlk_sk(s);
seq_printf(seq, "%p %-3d %-6d %08x %-8d %-8d %p %-8d %-8d\n",
@@ -107492,7 +104770,7 @@ index 5a7dcdf..9f97b61 100644
);
}
-@@ -2058,6 +2068,27 @@ static void __net_exit netlink_net_exit(struct net *net)
+@@ -2060,6 +2070,27 @@ static void __net_exit netlink_net_exit(struct net *net)
#endif
}
@@ -107520,7 +104798,7 @@ index 5a7dcdf..9f97b61 100644
static struct pernet_operations __net_initdata netlink_net_ops = {
.init = netlink_net_init,
.exit = netlink_net_exit,
-@@ -2106,6 +2137,8 @@ static int __init netlink_proto_init(void)
+@@ -2108,6 +2139,8 @@ static int __init netlink_proto_init(void)
hash->rehash_time = jiffies;
}
@@ -107619,7 +104897,7 @@ index ef5c75c..2b6c2fa 100644
return err ? NET_RX_DROP : NET_RX_SUCCESS;
}
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
-index 9cdd35e..16cd850 100644
+index 7481d70..6957dbf 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -348,7 +348,7 @@ static int pipe_do_rcv(struct sock *sk, struct sk_buff *skb)
@@ -107770,294 +105048,6 @@ index ab545e0..4079b3b 100644
sizeof(val));
set_fs(oldfs);
}
-diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
-index 7d188bc..523efbb 100644
---- a/net/rose/af_rose.c
-+++ b/net/rose/af_rose.c
-@@ -983,7 +983,7 @@ int rose_rx_call_request(struct sk_buff *skb, struct net_device *dev, struct ros
- struct sock *make;
- struct rose_sock *make_rose;
- struct rose_facilities_struct facilities;
-- int n, len;
-+ int n;
-
- skb->sk = NULL; /* Initially we don't know who it's for */
-
-@@ -992,9 +992,9 @@ int rose_rx_call_request(struct sk_buff *skb, struct net_device *dev, struct ros
- */
- memset(&facilities, 0x00, sizeof(struct rose_facilities_struct));
-
-- len = (((skb->data[3] >> 4) & 0x0F) + 1) >> 1;
-- len += (((skb->data[3] >> 0) & 0x0F) + 1) >> 1;
-- if (!rose_parse_facilities(skb->data + len + 4, &facilities)) {
-+ if (!rose_parse_facilities(skb->data + ROSE_CALL_REQ_FACILITIES_OFF,
-+ skb->len - ROSE_CALL_REQ_FACILITIES_OFF,
-+ &facilities)) {
- rose_transmit_clear_request(neigh, lci, ROSE_INVALID_FACILITY, 76);
- return 0;
- }
-diff --git a/net/rose/rose_loopback.c b/net/rose/rose_loopback.c
-index 114df6e..37965b8 100644
---- a/net/rose/rose_loopback.c
-+++ b/net/rose/rose_loopback.c
-@@ -72,9 +72,20 @@ static void rose_loopback_timer(unsigned long param)
- unsigned int lci_i, lci_o;
-
- while ((skb = skb_dequeue(&loopback_queue)) != NULL) {
-+ if (skb->len < ROSE_MIN_LEN) {
-+ kfree_skb(skb);
-+ continue;
-+ }
- lci_i = ((skb->data[0] << 8) & 0xF00) + ((skb->data[1] << 0) & 0x0FF);
- frametype = skb->data[2];
-- dest = (rose_address *)(skb->data + 4);
-+ if (frametype == ROSE_CALL_REQUEST &&
-+ (skb->len <= ROSE_CALL_REQ_FACILITIES_OFF ||
-+ skb->data[ROSE_CALL_REQ_ADDR_LEN_OFF] !=
-+ ROSE_CALL_REQ_ADDR_LEN_VAL)) {
-+ kfree_skb(skb);
-+ continue;
-+ }
-+ dest = (rose_address *)(skb->data + ROSE_CALL_REQ_DEST_ADDR_OFF);
- lci_o = 0xFFF - lci_i;
-
- skb_reset_transport_header(skb);
-diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
-index 08230fa..1646b25 100644
---- a/net/rose/rose_route.c
-+++ b/net/rose/rose_route.c
-@@ -852,7 +852,7 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25)
- unsigned int lci, new_lci;
- unsigned char cause, diagnostic;
- struct net_device *dev;
-- int len, res = 0;
-+ int res = 0;
- char buf[11];
-
- #if 0
-@@ -860,10 +860,17 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25)
- return res;
- #endif
-
-+ if (skb->len < ROSE_MIN_LEN)
-+ return res;
- frametype = skb->data[2];
- lci = ((skb->data[0] << 8) & 0xF00) + ((skb->data[1] << 0) & 0x0FF);
-- src_addr = (rose_address *)(skb->data + 9);
-- dest_addr = (rose_address *)(skb->data + 4);
-+ if (frametype == ROSE_CALL_REQUEST &&
-+ (skb->len <= ROSE_CALL_REQ_FACILITIES_OFF ||
-+ skb->data[ROSE_CALL_REQ_ADDR_LEN_OFF] !=
-+ ROSE_CALL_REQ_ADDR_LEN_VAL))
-+ return res;
-+ src_addr = (rose_address *)(skb->data + ROSE_CALL_REQ_SRC_ADDR_OFF);
-+ dest_addr = (rose_address *)(skb->data + ROSE_CALL_REQ_DEST_ADDR_OFF);
-
- spin_lock_bh(&rose_neigh_list_lock);
- spin_lock_bh(&rose_route_list_lock);
-@@ -1001,12 +1008,11 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25)
- goto out;
- }
-
-- len = (((skb->data[3] >> 4) & 0x0F) + 1) >> 1;
-- len += (((skb->data[3] >> 0) & 0x0F) + 1) >> 1;
--
- memset(&facilities, 0x00, sizeof(struct rose_facilities_struct));
-
-- if (!rose_parse_facilities(skb->data + len + 4, &facilities)) {
-+ if (!rose_parse_facilities(skb->data + ROSE_CALL_REQ_FACILITIES_OFF,
-+ skb->len - ROSE_CALL_REQ_FACILITIES_OFF,
-+ &facilities)) {
- rose_transmit_clear_request(rose_neigh, lci, ROSE_INVALID_FACILITY, 76);
- goto out;
- }
-diff --git a/net/rose/rose_subr.c b/net/rose/rose_subr.c
-index 07bca7d..32e5c9f 100644
---- a/net/rose/rose_subr.c
-+++ b/net/rose/rose_subr.c
-@@ -141,7 +141,7 @@ void rose_write_internal(struct sock *sk, int frametype)
- *dptr++ = ROSE_GFI | lci1;
- *dptr++ = lci2;
- *dptr++ = frametype;
-- *dptr++ = 0xAA;
-+ *dptr++ = ROSE_CALL_REQ_ADDR_LEN_VAL;
- memcpy(dptr, &rose->dest_addr, ROSE_ADDR_LEN);
- dptr += ROSE_ADDR_LEN;
- memcpy(dptr, &rose->source_addr, ROSE_ADDR_LEN);
-@@ -245,12 +245,16 @@ static int rose_parse_national(unsigned char *p, struct rose_facilities_struct *
- do {
- switch (*p & 0xC0) {
- case 0x00:
-+ if (len < 2)
-+ return -1;
- p += 2;
- n += 2;
- len -= 2;
- break;
-
- case 0x40:
-+ if (len < 3)
-+ return -1;
- if (*p == FAC_NATIONAL_RAND)
- facilities->rand = ((p[1] << 8) & 0xFF00) + ((p[2] << 0) & 0x00FF);
- p += 3;
-@@ -259,32 +263,48 @@ static int rose_parse_national(unsigned char *p, struct rose_facilities_struct *
- break;
-
- case 0x80:
-+ if (len < 4)
-+ return -1;
- p += 4;
- n += 4;
- len -= 4;
- break;
-
- case 0xC0:
-+ if (len < 2)
-+ return -1;
- l = p[1];
-+ if (len < 2 + l)
-+ return -1;
- if (*p == FAC_NATIONAL_DEST_DIGI) {
- if (!fac_national_digis_received) {
-+ if (l < AX25_ADDR_LEN)
-+ return -1;
- memcpy(&facilities->source_digis[0], p + 2, AX25_ADDR_LEN);
- facilities->source_ndigis = 1;
- }
- }
- else if (*p == FAC_NATIONAL_SRC_DIGI) {
- if (!fac_national_digis_received) {
-+ if (l < AX25_ADDR_LEN)
-+ return -1;
- memcpy(&facilities->dest_digis[0], p + 2, AX25_ADDR_LEN);
- facilities->dest_ndigis = 1;
- }
- }
- else if (*p == FAC_NATIONAL_FAIL_CALL) {
-+ if (l < AX25_ADDR_LEN)
-+ return -1;
- memcpy(&facilities->fail_call, p + 2, AX25_ADDR_LEN);
- }
- else if (*p == FAC_NATIONAL_FAIL_ADD) {
-+ if (l < 1 + ROSE_ADDR_LEN)
-+ return -1;
- memcpy(&facilities->fail_addr, p + 3, ROSE_ADDR_LEN);
- }
- else if (*p == FAC_NATIONAL_DIGIS) {
-+ if (l % AX25_ADDR_LEN)
-+ return -1;
- fac_national_digis_received = 1;
- facilities->source_ndigis = 0;
- facilities->dest_ndigis = 0;
-@@ -318,24 +338,32 @@ static int rose_parse_ccitt(unsigned char *p, struct rose_facilities_struct *fac
- do {
- switch (*p & 0xC0) {
- case 0x00:
-+ if (len < 2)
-+ return -1;
- p += 2;
- n += 2;
- len -= 2;
- break;
-
- case 0x40:
-+ if (len < 3)
-+ return -1;
- p += 3;
- n += 3;
- len -= 3;
- break;
-
- case 0x80:
-+ if (len < 4)
-+ return -1;
- p += 4;
- n += 4;
- len -= 4;
- break;
-
- case 0xC0:
-+ if (len < 2)
-+ return -1;
- l = p[1];
-
- /* Prevent overflows*/
-@@ -364,49 +392,44 @@ static int rose_parse_ccitt(unsigned char *p, struct rose_facilities_struct *fac
- return n;
- }
-
--int rose_parse_facilities(unsigned char *p,
-+int rose_parse_facilities(unsigned char *p, unsigned packet_len,
- struct rose_facilities_struct *facilities)
- {
- int facilities_len, len;
-
- facilities_len = *p++;
-
-- if (facilities_len == 0)
-+ if (facilities_len == 0 || (unsigned)facilities_len > packet_len)
- return 0;
-
-- while (facilities_len > 0) {
-- if (*p == 0x00) {
-- facilities_len--;
-- p++;
-+ while (facilities_len >= 3 && *p == 0x00) {
-+ facilities_len--;
-+ p++;
-
-- switch (*p) {
-- case FAC_NATIONAL: /* National */
-- len = rose_parse_national(p + 1, facilities, facilities_len - 1);
-- if (len < 0)
-- return 0;
-- facilities_len -= len + 1;
-- p += len + 1;
-- break;
-+ switch (*p) {
-+ case FAC_NATIONAL: /* National */
-+ len = rose_parse_national(p + 1, facilities, facilities_len - 1);
-+ break;
-
-- case FAC_CCITT: /* CCITT */
-- len = rose_parse_ccitt(p + 1, facilities, facilities_len - 1);
-- if (len < 0)
-- return 0;
-- facilities_len -= len + 1;
-- p += len + 1;
-- break;
-+ case FAC_CCITT: /* CCITT */
-+ len = rose_parse_ccitt(p + 1, facilities, facilities_len - 1);
-+ break;
-
-- default:
-- printk(KERN_DEBUG "ROSE: rose_parse_facilities - unknown facilities family %02X\n", *p);
-- facilities_len--;
-- p++;
-- break;
-- }
-- } else
-- break; /* Error in facilities format */
-+ default:
-+ printk(KERN_DEBUG "ROSE: rose_parse_facilities - unknown facilities family %02X\n", *p);
-+ len = 1;
-+ break;
-+ }
-+
-+ if (len < 0)
-+ return 0;
-+ if (WARN_ON(len >= facilities_len))
-+ return 0;
-+ facilities_len -= len + 1;
-+ p += len + 1;
- }
-
-- return 1;
-+ return facilities_len == 0;
- }
-
- static int rose_create_facilities(unsigned char *buffer, struct rose_sock *rose)
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index a86afce..8657bce 100644
--- a/net/rxrpc/af_rxrpc.c
@@ -108389,36 +105379,6 @@ index 914c419..7a16d2c 100644
return NULL;
/* Allocate the shared key */
-diff --git a/net/sctp/input.c b/net/sctp/input.c
-index 254afea..e8e73f1 100644
---- a/net/sctp/input.c
-+++ b/net/sctp/input.c
-@@ -739,15 +739,12 @@ static void __sctp_unhash_endpoint(struct sctp_endpoint *ep)
-
- epb = &ep->base;
-
-- if (hlist_unhashed(&epb->node))
-- return;
--
- epb->hashent = sctp_ep_hashfn(epb->bind_addr.port);
-
- head = &sctp_ep_hashtable[epb->hashent];
-
- sctp_write_lock(&head->lock);
-- __hlist_del(&epb->node);
-+ hlist_del_init(&epb->node);
- sctp_write_unlock(&head->lock);
- }
-
-@@ -828,7 +825,7 @@ static void __sctp_unhash_established(struct sctp_association *asoc)
- head = &sctp_assoc_hashtable[epb->hashent];
-
- sctp_write_lock(&head->lock);
-- __hlist_del(&epb->node);
-+ hlist_del_init(&epb->node);
- sctp_write_unlock(&head->lock);
- }
-
diff --git a/net/sctp/proc.c b/net/sctp/proc.c
index d093cbf..9fc36fc 100644
--- a/net/sctp/proc.c
@@ -108452,38 +105412,10 @@ index d093cbf..9fc36fc 100644
assoc->assoc_id,
assoc->sndbuf_used,
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
-index 3a95fcb..9cd0edd 100644
+index 1f9843e..9cd0edd 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
-@@ -1142,8 +1142,14 @@ out_free:
- SCTP_DEBUG_PRINTK("About to exit __sctp_connect() free asoc: %p"
- " kaddrs: %p err: %d\n",
- asoc, kaddrs, err);
-- if (asoc)
-+ if (asoc) {
-+ /* sctp_primitive_ASSOCIATE may have added this association
-+ * To the hash table, try to unhash it, just in case, its a noop
-+ * if it wasn't hashed so we're safe
-+ */
-+ sctp_unhash_established(asoc);
- sctp_association_free(asoc);
-+ }
- return err;
- }
-
-@@ -1851,8 +1857,10 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
- goto out_unlock;
-
- out_free:
-- if (new_asoc)
-+ if (new_asoc) {
-+ sctp_unhash_established(asoc);
- sctp_association_free(asoc);
-+ }
- out_unlock:
- sctp_release_sock(sk);
-
-@@ -5802,7 +5810,6 @@ pp_found:
+@@ -5810,7 +5810,6 @@ pp_found:
*/
int reuse = sk->sk_reuse;
struct sock *sk2;
@@ -108677,7 +105609,7 @@ index d449812..4ac08d3c 100644
if (MSG_CMSG_COMPAT & flags) {
err = verify_compat_iovec(&msg_sys, iov,
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
-index ac94477..8afe5c3 100644
+index 9b3941d..d80b670 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -234,10 +234,10 @@ static int rpc_wait_bit_killable(void *word)
@@ -110600,20 +107532,20 @@ index fce07a7..5f12858 100644
};
diff --git a/security/commoncap.c b/security/commoncap.c
-index fe30751..11b4a78 100644
+index ee9d623..11b4a78 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
-@@ -27,6 +27,9 @@
+@@ -27,7 +27,9 @@
#include <linux/sched.h>
#include <linux/prctl.h>
#include <linux/securebits.h>
+#include <linux/syslog.h>
-+#include <linux/personality.h>
+ #include <linux/personality.h>
+#include <net/sock.h>
/*
* If a non-root user executes a setuid-root binary in
-@@ -50,9 +53,18 @@ static void warn_setuid_and_fcaps_mixed(char *fname)
+@@ -51,9 +53,18 @@ static void warn_setuid_and_fcaps_mixed(char *fname)
}
}
@@ -110632,7 +107564,7 @@ index fe30751..11b4a78 100644
return 0;
}
-@@ -239,6 +251,45 @@ static inline void bprm_clear_caps(struct linux_binprm *bprm)
+@@ -240,6 +251,45 @@ static inline void bprm_clear_caps(struct linux_binprm *bprm)
bprm->cap_effective = false;
}
@@ -110678,19 +107610,7 @@ index fe30751..11b4a78 100644
#ifdef CONFIG_SECURITY_FILE_CAPABILITIES
/**
-@@ -511,6 +562,11 @@ int cap_bprm_set_creds(struct linux_binprm *bprm)
- }
- skip:
-
-+ /* if we have fs caps, clear dangerous personality flags */
-+ if (!cap_issubset(new->cap_permitted, old->cap_permitted))
-+ bprm->per_clear |= PER_CLEAR_ON_SETID;
-+
-+
- /* Don't let someone trace a set[ug]id/setpcap binary with the revised
- * credentials unless they have the appropriate permit
- */
-@@ -582,6 +638,9 @@ int cap_bprm_secureexec(struct linux_binprm *bprm)
+@@ -588,6 +638,9 @@ int cap_bprm_secureexec(struct linux_binprm *bprm)
{
const struct cred *cred = current_cred();
@@ -110700,7 +107620,7 @@ index fe30751..11b4a78 100644
if (cred->uid != 0) {
if (bprm->cap_effective)
return 1;
-@@ -956,13 +1015,18 @@ error:
+@@ -962,13 +1015,18 @@ error:
/**
* cap_syslog - Determine whether syslog function is permitted
* @type: Function requested
@@ -118443,158 +115363,10 @@ index 83b3dde..835bee7 100644
break;
}
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
-index 4f3434f..c807237 100644
+index 82b6fdc..c807237 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
-@@ -43,6 +43,8 @@
- #include <linux/swap.h>
- #include <linux/bitops.h>
- #include <linux/spinlock.h>
-+#include <linux/namei.h>
-+#include <linux/fs.h>
-
- #include <asm/processor.h>
- #include <asm/io.h>
-@@ -575,12 +577,76 @@ out:
- return r;
- }
-
-+/*
-+ * We want to test whether the caller has been granted permissions to
-+ * use this device. To be able to configure and control the device,
-+ * the user needs access to PCI configuration space and BAR resources.
-+ * These are accessed through PCI sysfs. PCI config space is often
-+ * passed to the process calling this ioctl via file descriptor, so we
-+ * can't rely on access to that file. We can check for permissions
-+ * on each of the BAR resource files, which is a pretty clear
-+ * indicator that the user has been granted access to the device.
-+ */
-+static int probe_sysfs_permissions(struct pci_dev *dev)
-+{
-+#ifdef CONFIG_SYSFS
-+ int i;
-+ bool bar_found = false;
-+
-+ for (i = PCI_STD_RESOURCES; i <= PCI_STD_RESOURCE_END; i++) {
-+ char *kpath, *syspath;
-+ struct path path;
-+ struct inode *inode;
-+ int r;
-+
-+ if (!pci_resource_len(dev, i))
-+ continue;
-+
-+ kpath = kobject_get_path(&dev->dev.kobj, GFP_KERNEL);
-+ if (!kpath)
-+ return -ENOMEM;
-+
-+ /* Per sysfs-rules, sysfs is always at /sys */
-+ syspath = kasprintf(GFP_KERNEL, "/sys%s/resource%d", kpath, i);
-+ kfree(kpath);
-+ if (!syspath)
-+ return -ENOMEM;
-+
-+ r = kern_path(syspath, LOOKUP_FOLLOW, &path);
-+ kfree(syspath);
-+ if (r)
-+ return r;
-+
-+ inode = path.dentry->d_inode;
-+
-+ r = inode_permission(inode, MAY_READ | MAY_WRITE | MAY_ACCESS);
-+ path_put(&path);
-+ if (r)
-+ return r;
-+
-+ bar_found = true;
-+ }
-+
-+ /* If no resources, probably something special */
-+ if (!bar_found)
-+ return -EPERM;
-+
-+ return 0;
-+#else
-+ return -EINVAL; /* No way to control the device without sysfs */
-+#endif
-+}
-+
- static int kvm_vm_ioctl_assign_device(struct kvm *kvm,
- struct kvm_assigned_pci_dev *assigned_dev)
- {
- int r = 0;
- struct kvm_assigned_dev_kernel *match;
- struct pci_dev *dev;
-+ u8 header_type;
-+
-+ if (!(assigned_dev->flags & KVM_DEV_ASSIGN_ENABLE_IOMMU))
-+ return -EINVAL;
-
- down_read(&kvm->slots_lock);
- mutex_lock(&kvm->lock);
-@@ -607,6 +673,18 @@ static int kvm_vm_ioctl_assign_device(struct kvm *kvm,
- r = -EINVAL;
- goto out_free;
- }
-+
-+ /* Don't allow bridges to be assigned */
-+ pci_read_config_byte(dev, PCI_HEADER_TYPE, &header_type);
-+ if ((header_type & PCI_HEADER_TYPE) != PCI_HEADER_TYPE_NORMAL) {
-+ r = -EPERM;
-+ goto out_put;
-+ }
-+
-+ r = probe_sysfs_permissions(dev);
-+ if (r)
-+ goto out_put;
-+
- if (pci_enable_device(dev)) {
- printk(KERN_INFO "%s: Could not enable PCI device\n", __func__);
- r = -EBUSY;
-@@ -635,16 +713,14 @@ static int kvm_vm_ioctl_assign_device(struct kvm *kvm,
-
- list_add(&match->list, &kvm->arch.assigned_dev_head);
-
-- if (assigned_dev->flags & KVM_DEV_ASSIGN_ENABLE_IOMMU) {
-- if (!kvm->arch.iommu_domain) {
-- r = kvm_iommu_map_guest(kvm);
-- if (r)
-- goto out_list_del;
-- }
-- r = kvm_assign_device(kvm, match);
-+ if (!kvm->arch.iommu_domain) {
-+ r = kvm_iommu_map_guest(kvm);
- if (r)
- goto out_list_del;
- }
-+ r = kvm_assign_device(kvm, match);
-+ if (r)
-+ goto out_list_del;
-
- out:
- mutex_unlock(&kvm->lock);
-@@ -683,8 +759,7 @@ static int kvm_vm_ioctl_deassign_device(struct kvm *kvm,
- goto out;
- }
-
-- if (match->flags & KVM_DEV_ASSIGN_ENABLE_IOMMU)
-- kvm_deassign_device(kvm, match);
-+ kvm_deassign_device(kvm, match);
-
- kvm_free_assigned_device(kvm, match);
-
-@@ -1782,6 +1857,10 @@ static int kvm_vm_ioctl_create_vcpu(struct kvm *kvm, u32 id)
- return r;
-
- mutex_lock(&kvm->lock);
-+ if (!kvm_vcpu_compatible(vcpu)) {
-+ r = -EINVAL;
-+ goto vcpu_destroy;
-+ }
- if (atomic_read(&kvm->online_vcpus) == KVM_MAX_VCPUS) {
- r = -EINVAL;
- goto vcpu_destroy;
-@@ -2494,7 +2573,7 @@ asmlinkage void kvm_handle_fault_on_reboot(void)
+@@ -2573,7 +2573,7 @@ asmlinkage void kvm_handle_fault_on_reboot(void)
if (kvm_rebooting)
/* spin while reset goes on */
while (true)
@@ -118603,7 +115375,7 @@ index 4f3434f..c807237 100644
/* Fault while not rebooting. We want the trace. */
BUG();
}
-@@ -2714,7 +2793,7 @@ static void kvm_sched_out(struct preempt_notifier *pn,
+@@ -2793,7 +2793,7 @@ static void kvm_sched_out(struct preempt_notifier *pn,
kvm_arch_vcpu_put(vcpu);
}
@@ -118612,7 +115384,7 @@ index 4f3434f..c807237 100644
struct module *module)
{
int r;
-@@ -2767,15 +2846,17 @@ int kvm_init(void *opaque, unsigned int vcpu_size,
+@@ -2846,15 +2846,17 @@ int kvm_init(void *opaque, unsigned int vcpu_size,
/* A kmem cache lets us meet the alignment requirements of fx_save. */
kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size,
__alignof__(struct kvm_vcpu),
^ permalink raw reply related [flat|nested] 13+ messages in thread* [gentoo-commits] proj/hardened-patchset:master commit in: 2.6.32/
@ 2012-07-16 17:04 Anthony G. Basile
0 siblings, 0 replies; 13+ messages in thread
From: Anthony G. Basile @ 2012-07-16 17:04 UTC (permalink / raw
To: gentoo-commits
commit: 75bb877cacf6562099253561a08332e334c40668
Author: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Mon Jul 16 17:03:52 2012 +0000
Commit: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Mon Jul 16 17:03:52 2012 +0000
URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-patchset.git;a=commit;h=75bb877c
Grsec/PaX: 2.9.1-2.6.32.59-201207150915 - fix stop_machine* compile error
---
2.6.32/0000_README | 2 +-
..._grsecurity-2.9.1-2.6.32.59-201207150915.patch} | 122 +++++++++++---------
2 files changed, 70 insertions(+), 54 deletions(-)
diff --git a/2.6.32/0000_README b/2.6.32/0000_README
index 3cd1e97..4c6a85a 100644
--- a/2.6.32/0000_README
+++ b/2.6.32/0000_README
@@ -30,7 +30,7 @@ Patch: 1058_linux-2.6.32.59.patch
From: http://www.kernel.org
Desc: Linux 2.6.32.59
-Patch: 4420_grsecurity-2.9.1-2.6.32.59-201207122159.patch
+Patch: 4420_grsecurity-2.9.1-2.6.32.59-201207150915.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/2.6.32/4420_grsecurity-2.9.1-2.6.32.59-201207122159.patch b/2.6.32/4420_grsecurity-2.9.1-2.6.32.59-201207150915.patch
similarity index 99%
rename from 2.6.32/4420_grsecurity-2.9.1-2.6.32.59-201207122159.patch
rename to 2.6.32/4420_grsecurity-2.9.1-2.6.32.59-201207150915.patch
index 614255d..06ab77c 100644
--- a/2.6.32/4420_grsecurity-2.9.1-2.6.32.59-201207122159.patch
+++ b/2.6.32/4420_grsecurity-2.9.1-2.6.32.59-201207150915.patch
@@ -48172,7 +48172,7 @@ index a3394b4..f871d8c 100644
+ u32 hdr_cksum;
+};
diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
-index 000e377..f501aa3 100644
+index 000e377..709dc47 100644
--- a/drivers/net/benet/be_main.c
+++ b/drivers/net/benet/be_main.c
@@ -1,18 +1,18 @@
@@ -48906,7 +48906,7 @@ index 000e377..f501aa3 100644
be_dws_cpu_to_le(hdr, sizeof(*hdr));
return copied;
-@@ -434,19 +713,70 @@ static netdev_tx_t be_xmit(struct sk_buff *skb,
+@@ -434,19 +713,72 @@ static netdev_tx_t be_xmit(struct sk_buff *skb,
struct net_device *netdev)
{
struct be_adapter *adapter = netdev_priv(netdev);
@@ -48975,6 +48975,8 @@ index 000e377..f501aa3 100644
+
+ copied = make_tx_wrbs(adapter, txq, skb, wrb_cnt, dummy_wrb);
if (copied) {
++ int gso_segs = skb_shinfo(skb)->gso_segs;
++
/* record the sent skb in the sent_skb table */
- BUG_ON(tx_obj->sent_skb_list[start]);
- tx_obj->sent_skb_list[start] = skb;
@@ -48983,7 +48985,7 @@ index 000e377..f501aa3 100644
/* Ensure txq has space for the next skb; Else stop the queue
* *BEFORE* ringing the tx doorbell, so that we serialze the
-@@ -454,16 +784,21 @@ static netdev_tx_t be_xmit(struct sk_buff *skb,
+@@ -454,16 +786,20 @@ static netdev_tx_t be_xmit(struct sk_buff *skb,
*/
if ((BE_MAX_TX_FRAG_COUNT + atomic_read(&txq->used)) >=
txq->len) {
@@ -48995,19 +48997,19 @@ index 000e377..f501aa3 100644
be_txq_notify(adapter, txq->id, wrb_cnt);
- be_tx_stats_update(adapter, wrb_cnt, copied,
+- skb_shinfo(skb)->gso_segs, stopped);
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 32)
+ netdev->trans_start = jiffies;
+#endif
+
-+ be_tx_stats_update(txo, wrb_cnt, copied,
- skb_shinfo(skb)->gso_segs, stopped);
++ be_tx_stats_update(txo, wrb_cnt, copied, gso_segs, stopped);
} else {
txq->head = start;
+tx_drop:
dev_kfree_skb_any(skb);
}
return NETDEV_TX_OK;
-@@ -473,10 +808,12 @@ static int be_change_mtu(struct net_device *netdev, int new_mtu)
+@@ -473,10 +809,12 @@ static int be_change_mtu(struct net_device *netdev, int new_mtu)
{
struct be_adapter *adapter = netdev_priv(netdev);
if (new_mtu < BE_MIN_MTU ||
@@ -49022,7 +49024,7 @@ index 000e377..f501aa3 100644
return -EINVAL;
}
dev_info(&adapter->pdev->dev, "MTU changed from %d to %d bytes\n",
-@@ -486,17 +823,19 @@ static int be_change_mtu(struct net_device *netdev, int new_mtu)
+@@ -486,17 +824,19 @@ static int be_change_mtu(struct net_device *netdev, int new_mtu)
}
/*
@@ -49048,7 +49050,7 @@ index 000e377..f501aa3 100644
/* Construct VLAN Table to give to HW */
for (i = 0; i < VLAN_GROUP_ARRAY_LEN; i++) {
if (adapter->vlan_tag[i]) {
-@@ -504,47 +843,46 @@ static int be_vid_config(struct be_adapter *adapter)
+@@ -504,47 +844,46 @@ static int be_vid_config(struct be_adapter *adapter)
ntags++;
}
}
@@ -49111,7 +49113,7 @@ index 000e377..f501aa3 100644
}
static void be_set_multicast_list(struct net_device *netdev)
-@@ -552,7 +890,7 @@ static void be_set_multicast_list(struct net_device *netdev)
+@@ -552,7 +891,7 @@ static void be_set_multicast_list(struct net_device *netdev)
struct be_adapter *adapter = netdev_priv(netdev);
if (netdev->flags & IFF_PROMISC) {
@@ -49120,7 +49122,7 @@ index 000e377..f501aa3 100644
adapter->promiscuous = true;
goto done;
}
-@@ -560,81 +898,244 @@ static void be_set_multicast_list(struct net_device *netdev)
+@@ -560,81 +899,244 @@ static void be_set_multicast_list(struct net_device *netdev)
/* BE was previously in promiscous mode; disable it */
if (adapter->promiscuous) {
adapter->promiscuous = false;
@@ -49405,7 +49407,7 @@ index 000e377..f501aa3 100644
atomic_dec(&rxq->used);
return rx_page_info;
-@@ -642,20 +1143,26 @@ get_rx_page_info(struct be_adapter *adapter, u16 frag_idx)
+@@ -642,20 +1144,26 @@ get_rx_page_info(struct be_adapter *adapter, u16 frag_idx)
/* Throwaway the data in the Rx completion */
static void be_rx_compl_discard(struct be_adapter *adapter,
@@ -49439,7 +49441,7 @@ index 000e377..f501aa3 100644
}
}
-@@ -663,29 +1170,24 @@ static void be_rx_compl_discard(struct be_adapter *adapter,
+@@ -663,29 +1171,24 @@ static void be_rx_compl_discard(struct be_adapter *adapter,
* skb_fill_rx_data forms a complete skb for an ether frame
* indicated by rxcp.
*/
@@ -49477,7 +49479,7 @@ index 000e377..f501aa3 100644
memcpy(skb->data, start, hdr_len);
skb->len = curr_frag_len;
if (curr_frag_len <= BE_HDR_LEN) { /* tiny packet */
-@@ -702,21 +1204,19 @@ static void skb_fill_rx_data(struct be_adapter *adapter,
+@@ -702,21 +1205,19 @@ static void skb_fill_rx_data(struct be_adapter *adapter,
skb->data_len = curr_frag_len - hdr_len;
skb->tail += hdr_len;
}
@@ -49508,7 +49510,7 @@ index 000e377..f501aa3 100644
/* Coalesce all frags from the same physical page in one slot */
if (page_info->page_offset == 0) {
-@@ -735,99 +1235,122 @@ static void skb_fill_rx_data(struct be_adapter *adapter,
+@@ -735,99 +1236,122 @@ static void skb_fill_rx_data(struct be_adapter *adapter,
skb->len += curr_frag_len;
skb->data_len += curr_frag_len;
@@ -49688,7 +49690,7 @@ index 000e377..f501aa3 100644
curr_frag_len = min(remaining, rx_frag_size);
-@@ -845,55 +1368,129 @@ static void be_rx_compl_process_gro(struct be_adapter *adapter,
+@@ -845,55 +1369,129 @@ static void be_rx_compl_process_gro(struct be_adapter *adapter,
skb_shinfo(skb)->frags[j].size += curr_frag_len;
remaining -= curr_frag_len;
@@ -49847,7 +49849,7 @@ index 000e377..f501aa3 100644
static inline struct page *be_alloc_pages(u32 size)
{
gfp_t alloc_flags = GFP_ATOMIC;
-@@ -907,11 +1504,12 @@ static inline struct page *be_alloc_pages(u32 size)
+@@ -907,11 +1505,12 @@ static inline struct page *be_alloc_pages(u32 size)
* Allocate a page, split it to fragments of size rx_frag_size and post as
* receive buffers to BE
*/
@@ -49864,7 +49866,7 @@ index 000e377..f501aa3 100644
struct page *pagep = NULL;
struct be_eth_rx_d *rxd;
u64 page_dmaaddr = 0, frag_dmaaddr;
-@@ -922,7 +1520,7 @@ static void be_post_rx_frags(struct be_adapter *adapter)
+@@ -922,7 +1521,7 @@ static void be_post_rx_frags(struct be_adapter *adapter)
if (!pagep) {
pagep = be_alloc_pages(adapter->big_page_size);
if (unlikely(!pagep)) {
@@ -49873,7 +49875,7 @@ index 000e377..f501aa3 100644
break;
}
page_dmaaddr = pci_map_page(adapter->pdev, pagep, 0,
-@@ -941,7 +1539,6 @@ static void be_post_rx_frags(struct be_adapter *adapter)
+@@ -941,7 +1540,6 @@ static void be_post_rx_frags(struct be_adapter *adapter)
rxd = queue_head_node(rxq);
rxd->fragpa_lo = cpu_to_le32(frag_dmaaddr & 0xFFFFFFFF);
rxd->fragpa_hi = cpu_to_le32(upper_32_bits(frag_dmaaddr));
@@ -49881,7 +49883,7 @@ index 000e377..f501aa3 100644
/* Any space left in the current big page for another frag? */
if ((page_offset + rx_frag_size + rx_frag_size) >
-@@ -949,17 +1546,24 @@ static void be_post_rx_frags(struct be_adapter *adapter)
+@@ -949,17 +1547,24 @@ static void be_post_rx_frags(struct be_adapter *adapter)
pagep = NULL;
page_info->last_page_user = true;
}
@@ -49908,7 +49910,7 @@ index 000e377..f501aa3 100644
}
return;
-@@ -972,6 +1576,7 @@ static struct be_eth_tx_compl *be_tx_compl_get(struct be_queue_info *tx_cq)
+@@ -972,6 +1577,7 @@ static struct be_eth_tx_compl *be_tx_compl_get(struct be_queue_info *tx_cq)
if (txcp->dw[offsetof(struct amap_eth_tx_compl, valid) / 32] == 0)
return NULL;
@@ -49916,7 +49918,7 @@ index 000e377..f501aa3 100644
be_dws_le_to_cpu(txcp, sizeof(*txcp));
txcp->dw[offsetof(struct amap_eth_tx_compl, valid) / 32] = 0;
-@@ -980,11 +1585,14 @@ static struct be_eth_tx_compl *be_tx_compl_get(struct be_queue_info *tx_cq)
+@@ -980,11 +1586,14 @@ static struct be_eth_tx_compl *be_tx_compl_get(struct be_queue_info *tx_cq)
return txcp;
}
@@ -49934,7 +49936,7 @@ index 000e377..f501aa3 100644
u16 cur_index, num_wrbs = 0;
cur_index = txq->tail;
-@@ -992,15 +1600,31 @@ static void be_tx_compl_process(struct be_adapter *adapter, u16 last_index)
+@@ -992,15 +1601,31 @@ static void be_tx_compl_process(struct be_adapter *adapter, u16 last_index)
BUG_ON(!sent_skb);
sent_skbs[cur_index] = NULL;
@@ -49970,7 +49972,7 @@ index 000e377..f501aa3 100644
}
static inline struct be_eq_entry *event_get(struct be_eq_obj *eq_obj)
-@@ -1010,13 +1634,15 @@ static inline struct be_eq_entry *event_get(struct be_eq_obj *eq_obj)
+@@ -1010,13 +1635,15 @@ static inline struct be_eq_entry *event_get(struct be_eq_obj *eq_obj)
if (!eqe->evt)
return NULL;
@@ -49987,7 +49989,7 @@ index 000e377..f501aa3 100644
{
struct be_eq_entry *eqe;
u16 num = 0;
-@@ -1029,7 +1655,10 @@ static int event_handle(struct be_adapter *adapter,
+@@ -1029,7 +1656,10 @@ static int event_handle(struct be_adapter *adapter,
/* Deal with any spurious interrupts that come
* without events
*/
@@ -49999,7 +50001,7 @@ index 000e377..f501aa3 100644
if (num)
napi_schedule(&eq_obj->napi);
-@@ -1053,49 +1682,55 @@ static void be_eq_clean(struct be_adapter *adapter,
+@@ -1053,49 +1683,55 @@ static void be_eq_clean(struct be_adapter *adapter,
be_eq_notify(adapter, eq_obj->q.id, false, true, num);
}
@@ -50068,7 +50070,7 @@ index 000e377..f501aa3 100644
}
if (atomic_read(&txq->used) == 0 || ++timeo > 200)
-@@ -1107,6 +1742,17 @@ static void be_tx_compl_clean(struct be_adapter *adapter)
+@@ -1107,6 +1743,17 @@ static void be_tx_compl_clean(struct be_adapter *adapter)
if (atomic_read(&txq->used))
dev_err(&adapter->pdev->dev, "%d pending tx-completions\n",
atomic_read(&txq->used));
@@ -50086,7 +50088,7 @@ index 000e377..f501aa3 100644
}
static void be_mcc_queues_destroy(struct be_adapter *adapter)
-@@ -1145,8 +1791,9 @@ static int be_mcc_queues_create(struct be_adapter *adapter)
+@@ -1145,8 +1792,9 @@ static int be_mcc_queues_create(struct be_adapter *adapter)
goto mcc_cq_destroy;
/* Ask BE to create MCC queue */
@@ -50097,7 +50099,7 @@ index 000e377..f501aa3 100644
return 0;
-@@ -1163,16 +1810,20 @@ err:
+@@ -1163,16 +1811,20 @@ err:
static void be_tx_queues_destroy(struct be_adapter *adapter)
{
struct be_queue_info *q;
@@ -50126,7 +50128,7 @@ index 000e377..f501aa3 100644
/* Clear any residual events */
be_eq_clean(adapter, &adapter->tx_eq);
-@@ -1183,168 +1834,210 @@ static void be_tx_queues_destroy(struct be_adapter *adapter)
+@@ -1183,168 +1835,210 @@ static void be_tx_queues_destroy(struct be_adapter *adapter)
be_queue_free(adapter, q);
}
@@ -50439,7 +50441,7 @@ index 000e377..f501aa3 100644
return IRQ_HANDLED;
}
-@@ -1353,48 +2046,72 @@ static irqreturn_t be_msix_tx_mcc(int irq, void *dev)
+@@ -1353,48 +2047,72 @@ static irqreturn_t be_msix_tx_mcc(int irq, void *dev)
{
struct be_adapter *adapter = dev;
@@ -50533,7 +50535,7 @@ index 000e377..f501aa3 100644
/* All consumed */
if (work_done < budget) {
-@@ -1404,40 +2121,13 @@ int be_poll_rx(struct napi_struct *napi, int budget)
+@@ -1404,40 +2122,13 @@ int be_poll_rx(struct napi_struct *napi, int budget)
/* More to be consumed; continue with interrupts disabled */
be_cq_notify(adapter, rx_cq->id, false, work_done);
}
@@ -50578,7 +50580,7 @@ index 000e377..f501aa3 100644
/* As TX and MCC share the same EQ check for both TX and MCC completions.
* For TX/MCC we don't honour budget; consume everything
*/
-@@ -1446,96 +2136,264 @@ static int be_poll_tx_mcc(struct napi_struct *napi, int budget)
+@@ -1446,96 +2137,264 @@ static int be_poll_tx_mcc(struct napi_struct *napi, int budget)
struct be_eq_obj *tx_eq = container_of(napi, struct be_eq_obj, napi);
struct be_adapter *adapter =
container_of(tx_eq, struct be_adapter, tx_eq);
@@ -50879,7 +50881,7 @@ index 000e377..f501aa3 100644
return status;
}
-@@ -1544,10 +2402,13 @@ static int be_irq_register(struct be_adapter *adapter)
+@@ -1544,10 +2403,13 @@ static int be_irq_register(struct be_adapter *adapter)
struct net_device *netdev = adapter->netdev;
int status;
@@ -50894,7 +50896,7 @@ index 000e377..f501aa3 100644
}
/* INTx */
-@@ -1567,87 +2428,363 @@ done:
+@@ -1567,87 +2429,363 @@ done:
static void be_irq_unregister(struct be_adapter *adapter)
{
struct net_device *netdev = adapter->netdev;
@@ -51293,7 +51295,7 @@ index 000e377..f501aa3 100644
status = be_tx_queues_create(adapter);
if (status != 0)
goto if_destroy;
-@@ -1656,10 +2793,15 @@ static int be_setup(struct be_adapter *adapter)
+@@ -1656,10 +2794,15 @@ static int be_setup(struct be_adapter *adapter)
if (status != 0)
goto tx_qs_destroy;
@@ -51309,7 +51311,7 @@ index 000e377..f501aa3 100644
return 0;
rx_qs_destroy:
-@@ -1667,158 +2809,392 @@ rx_qs_destroy:
+@@ -1667,158 +2810,392 @@ rx_qs_destroy:
tx_qs_destroy:
be_tx_queues_destroy(adapter);
if_destroy:
@@ -51803,7 +51805,7 @@ index 000e377..f501aa3 100644
strcpy(fw_file, func);
status = request_firmware(&fw, fw_file, &adapter->pdev->dev);
-@@ -1826,34 +3202,9 @@ int be_load_fw(struct be_adapter *adapter, u8 *func)
+@@ -1826,34 +3203,9 @@ int be_load_fw(struct be_adapter *adapter, u8 *func)
goto fw_exit;
p = fw->data;
@@ -51839,7 +51841,7 @@ index 000e377..f501aa3 100644
flash_cmd.size = sizeof(struct be_cmd_write_flashrom) + 32*1024;
flash_cmd.va = pci_alloc_consistent(adapter->pdev, flash_cmd.size,
&flash_cmd.dma);
-@@ -1864,12 +3215,25 @@ int be_load_fw(struct be_adapter *adapter, u8 *func)
+@@ -1864,12 +3216,25 @@ int be_load_fw(struct be_adapter *adapter, u8 *func)
goto fw_exit;
}
@@ -51871,7 +51873,7 @@ index 000e377..f501aa3 100644
}
pci_free_consistent(adapter->pdev, flash_cmd.size, flash_cmd.va,
-@@ -1879,14 +3243,14 @@ int be_load_fw(struct be_adapter *adapter, u8 *func)
+@@ -1879,14 +3244,14 @@ int be_load_fw(struct be_adapter *adapter, u8 *func)
goto fw_exit;
}
@@ -51888,7 +51890,7 @@ index 000e377..f501aa3 100644
.ndo_open = be_open,
.ndo_stop = be_close,
.ndo_start_xmit = be_xmit,
-@@ -1898,15 +3262,32 @@ static struct net_device_ops be_netdev_ops = {
+@@ -1898,15 +3263,32 @@ static struct net_device_ops be_netdev_ops = {
.ndo_vlan_rx_register = be_vlan_register,
.ndo_vlan_rx_add_vid = be_vlan_add_vid,
.ndo_vlan_rx_kill_vid = be_vlan_rem_vid,
@@ -51924,7 +51926,7 @@ index 000e377..f501aa3 100644
netdev->flags |= IFF_MULTICAST;
-@@ -1918,17 +3299,30 @@ static void be_netdev_init(struct net_device *netdev)
+@@ -1918,17 +3300,30 @@ static void be_netdev_init(struct net_device *netdev)
netif_set_gso_max_size(netdev, 65535);
@@ -51961,7 +51963,7 @@ index 000e377..f501aa3 100644
}
static void be_unmap_pci_bars(struct be_adapter *adapter)
-@@ -1937,37 +3331,62 @@ static void be_unmap_pci_bars(struct be_adapter *adapter)
+@@ -1937,37 +3332,62 @@ static void be_unmap_pci_bars(struct be_adapter *adapter)
iounmap(adapter->csr);
if (adapter->db)
iounmap(adapter->db);
@@ -52041,7 +52043,7 @@ index 000e377..f501aa3 100644
return 0;
pci_map_err:
-@@ -1985,40 +3404,69 @@ static void be_ctrl_cleanup(struct be_adapter *adapter)
+@@ -1985,40 +3405,69 @@ static void be_ctrl_cleanup(struct be_adapter *adapter)
if (mem->va)
pci_free_consistent(adapter->pdev, mem->size,
mem->va, mem->dma);
@@ -52117,7 +52119,7 @@ index 000e377..f501aa3 100644
if (cmd->va)
pci_free_consistent(adapter->pdev, cmd->size,
-@@ -2027,10 +3475,12 @@ static void be_stats_cleanup(struct be_adapter *adapter)
+@@ -2027,10 +3476,12 @@ static void be_stats_cleanup(struct be_adapter *adapter)
static int be_stats_init(struct be_adapter *adapter)
{
@@ -52133,7 +52135,7 @@ index 000e377..f501aa3 100644
cmd->va = pci_alloc_consistent(adapter->pdev, cmd->size, &cmd->dma);
if (cmd->va == NULL)
return -1;
-@@ -2041,9 +3491,17 @@ static int be_stats_init(struct be_adapter *adapter)
+@@ -2041,9 +3492,17 @@ static int be_stats_init(struct be_adapter *adapter)
static void __devexit be_remove(struct pci_dev *pdev)
{
struct be_adapter *adapter = pci_get_drvdata(pdev);
@@ -52151,7 +52153,7 @@ index 000e377..f501aa3 100644
unregister_netdev(adapter->netdev);
be_clear(adapter);
-@@ -2052,36 +3510,203 @@ static void __devexit be_remove(struct pci_dev *pdev)
+@@ -2052,36 +3511,203 @@ static void __devexit be_remove(struct pci_dev *pdev)
be_ctrl_cleanup(adapter);
@@ -52366,7 +52368,7 @@ index 000e377..f501aa3 100644
return status;
}
-@@ -2091,7 +3716,7 @@ static int __devinit be_probe(struct pci_dev *pdev,
+@@ -2091,7 +3717,7 @@ static int __devinit be_probe(struct pci_dev *pdev,
int status = 0;
struct be_adapter *adapter;
struct net_device *netdev;
@@ -52375,7 +52377,7 @@ index 000e377..f501aa3 100644
status = pci_enable_device(pdev);
if (status)
-@@ -2102,31 +3727,22 @@ static int __devinit be_probe(struct pci_dev *pdev,
+@@ -2102,31 +3728,22 @@ static int __devinit be_probe(struct pci_dev *pdev,
goto disable_dev;
pci_set_master(pdev);
@@ -52414,7 +52416,7 @@ index 000e377..f501aa3 100644
status = pci_set_dma_mask(pdev, DMA_BIT_MASK(64));
if (!status) {
-@@ -2139,46 +3755,150 @@ static int __devinit be_probe(struct pci_dev *pdev,
+@@ -2139,46 +3756,150 @@ static int __devinit be_probe(struct pci_dev *pdev,
}
}
@@ -52577,7 +52579,7 @@ index 000e377..f501aa3 100644
rel_reg:
pci_release_regions(pdev);
disable_dev:
-@@ -2193,6 +3913,10 @@ static int be_suspend(struct pci_dev *pdev, pm_message_t state)
+@@ -2193,6 +3914,10 @@ static int be_suspend(struct pci_dev *pdev, pm_message_t state)
struct be_adapter *adapter = pci_get_drvdata(pdev);
struct net_device *netdev = adapter->netdev;
@@ -52588,7 +52590,7 @@ index 000e377..f501aa3 100644
netif_device_detach(netdev);
if (netif_running(netdev)) {
rtnl_lock();
-@@ -2202,6 +3926,7 @@ static int be_suspend(struct pci_dev *pdev, pm_message_t state)
+@@ -2202,6 +3927,7 @@ static int be_suspend(struct pci_dev *pdev, pm_message_t state)
be_cmd_get_flow_control(adapter, &adapter->tx_fc, &adapter->rx_fc);
be_clear(adapter);
@@ -52596,7 +52598,7 @@ index 000e377..f501aa3 100644
pci_save_state(pdev);
pci_disable_device(pdev);
pci_set_power_state(pdev, pci_choose_state(pdev, state));
-@@ -2223,6 +3948,12 @@ static int be_resume(struct pci_dev *pdev)
+@@ -2223,6 +3949,12 @@ static int be_resume(struct pci_dev *pdev)
pci_set_power_state(pdev, 0);
pci_restore_state(pdev);
@@ -52609,7 +52611,7 @@ index 000e377..f501aa3 100644
be_setup(adapter);
if (netif_running(netdev)) {
rtnl_lock();
-@@ -2230,28 +3961,152 @@ static int be_resume(struct pci_dev *pdev)
+@@ -2230,28 +3962,152 @@ static int be_resume(struct pci_dev *pdev)
rtnl_unlock();
}
netif_device_attach(netdev);
@@ -92302,6 +92304,20 @@ index d30732c..e4992cd 100644
size = i_size_read(path.dentry->d_inode);
shm_unlock(shp);
+diff --git a/kernel/Makefile b/kernel/Makefile
+index d7c13d2..13de8d7 100644
+--- a/kernel/Makefile
++++ b/kernel/Makefile
+@@ -66,7 +66,9 @@ obj-$(CONFIG_USER_NS) += user_namespace.o
+ obj-$(CONFIG_PID_NS) += pid_namespace.o
+ obj-$(CONFIG_IKCONFIG) += configs.o
+ obj-$(CONFIG_RESOURCE_COUNTERS) += res_counter.o
++ifeq ($(CONFIG_SMP),y)
+ obj-$(CONFIG_STOP_MACHINE) += stop_machine.o
++endif
+ obj-$(CONFIG_KPROBES_SANITY_TEST) += test_kprobes.o
+ obj-$(CONFIG_AUDIT) += audit.o auditfilter.o audit_watch.o
+ obj-$(CONFIG_AUDITSYSCALL) += auditsc.o
diff --git a/kernel/acct.c b/kernel/acct.c
index a6605ca..ca91111 100644
--- a/kernel/acct.c
^ permalink raw reply related [flat|nested] 13+ messages in thread* [gentoo-commits] proj/hardened-patchset:master commit in: 2.6.32/
@ 2012-05-28 12:57 Anthony G. Basile
0 siblings, 0 replies; 13+ messages in thread
From: Anthony G. Basile @ 2012-05-28 12:57 UTC (permalink / raw
To: gentoo-commits
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=UTF-8, Size: 2853501 bytes --]
commit: d1a5a44686ef3af87783594d88148ec95aba776c
Author: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Mon May 28 12:57:41 2012 +0000
Commit: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Mon May 28 12:57:41 2012 +0000
URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-patchset.git;a=commit;h=d1a5a446
Fix 2.6.32/4420_grsecurity-2.9-2.6.32.59-201205271952.patch
---
...420_grsecurity-2.9-2.6.32.59-201205271952.patch |86301 +++++++++++++++++++-
1 files changed, 86300 insertions(+), 1 deletions(-)
diff --git a/2.6.32/4420_grsecurity-2.9-2.6.32.59-201205271952.patch b/2.6.32/4420_grsecurity-2.9-2.6.32.59-201205271952.patch
index b54be17..dc0f735 100644
--- a/2.6.32/4420_grsecurity-2.9-2.6.32.59-201205271952.patch
+++ b/2.6.32/4420_grsecurity-2.9-2.6.32.59-201205271952.patch
@@ -33837,4 +33837,86303 @@ index 3a19e2d..1b8116a3 100644
@@ -1209,7 +1221,7 @@ EXPORT_SYMBOL(generate_random_uuid);
#include <linux/sysctl.h>
- static int min_read_thresh = 8, min_wr
\ No newline at end of file
+ static int min_read_thresh = 8, min_write_thresh;
+-static int max_read_thresh = INPUT_POOL_WORDS * 32;
++static int max_read_thresh = OUTPUT_POOL_WORDS * 32;
+ static int max_write_thresh = INPUT_POOL_WORDS * 32;
+ static char sysctl_bootid[16];
+
+@@ -1231,10 +1243,15 @@ static int proc_do_uuid(ctl_table *table, int write,
+ uuid = table->data;
+ if (!uuid) {
+ uuid = tmp_uuid;
+- uuid[8] = 0;
+- }
+- if (uuid[8] == 0)
+ generate_random_uuid(uuid);
++ } else {
++ static DEFINE_SPINLOCK(bootid_spinlock);
++
++ spin_lock(&bootid_spinlock);
++ if (!uuid[8])
++ generate_random_uuid(uuid);
++ spin_unlock(&bootid_spinlock);
++ }
+
+ sprintf(buf, "%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-"
+ "%02x%02x%02x%02x%02x%02x",
+diff --git a/drivers/char/rocket.c b/drivers/char/rocket.c
+index 0e29a23..0efc2c2 100644
+--- a/drivers/char/rocket.c
++++ b/drivers/char/rocket.c
+@@ -1266,6 +1266,8 @@ static int get_ports(struct r_port *info, struct rocket_ports __user *retports)
+ struct rocket_ports tmp;
+ int board;
+
++ pax_track_stack();
++
+ if (!retports)
+ return -EFAULT;
+ memset(&tmp, 0, sizeof (tmp));
+diff --git a/drivers/char/sonypi.c b/drivers/char/sonypi.c
+index 8c262aa..4d3b058 100644
+--- a/drivers/char/sonypi.c
++++ b/drivers/char/sonypi.c
+@@ -55,6 +55,7 @@
+ #include <asm/uaccess.h>
+ #include <asm/io.h>
+ #include <asm/system.h>
++#include <asm/local.h>
+
+ #include <linux/sonypi.h>
+
+@@ -491,7 +492,7 @@ static struct sonypi_device {
+ spinlock_t fifo_lock;
+ wait_queue_head_t fifo_proc_list;
+ struct fasync_struct *fifo_async;
+- int open_count;
++ local_t open_count;
+ int model;
+ struct input_dev *input_jog_dev;
+ struct input_dev *input_key_dev;
+@@ -895,7 +896,7 @@ static int sonypi_misc_fasync(int fd, struct file *filp, int on)
+ static int sonypi_misc_release(struct inode *inode, struct file *file)
+ {
+ mutex_lock(&sonypi_device.lock);
+- sonypi_device.open_count--;
++ local_dec(&sonypi_device.open_count);
+ mutex_unlock(&sonypi_device.lock);
+ return 0;
+ }
+@@ -905,9 +906,9 @@ static int sonypi_misc_open(struct inode *inode, struct file *file)
+ lock_kernel();
+ mutex_lock(&sonypi_device.lock);
+ /* Flush input queue on first open */
+- if (!sonypi_device.open_count)
++ if (!local_read(&sonypi_device.open_count))
+ kfifo_reset(sonypi_device.fifo);
+- sonypi_device.open_count++;
++ local_inc(&sonypi_device.open_count);
+ mutex_unlock(&sonypi_device.lock);
+ unlock_kernel();
+ return 0;
+diff --git a/drivers/char/stallion.c b/drivers/char/stallion.c
+index db6dcfa..13834cb 100644
+--- a/drivers/char/stallion.c
++++ b/drivers/char/stallion.c
+@@ -2448,6 +2448,8 @@ static int stl_getportstruct(struct stlport __user *arg)
+ struct stlport stl_dummyport;
+ struct stlport *portp;
+
++ pax_track_stack();
++
+ if (copy_from_user(&stl_dummyport, arg, sizeof(struct stlport)))
+ return -EFAULT;
+ portp = stl_getport(stl_dummyport.brdnr, stl_dummyport.panelnr,
+diff --git a/drivers/char/sysrq.c b/drivers/char/sysrq.c
+index 44203ff..09a3678 100644
+--- a/drivers/char/sysrq.c
++++ b/drivers/char/sysrq.c
+@@ -591,7 +591,7 @@ EXPORT_SYMBOL(unregister_sysrq_key);
+ static ssize_t write_sysrq_trigger(struct file *file, const char __user *buf,
+ size_t count, loff_t *ppos)
+ {
+- if (count) {
++ if (count && capable(CAP_SYS_ADMIN)) {
+ char c;
+
+ if (get_user(c, buf))
+diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
+index a0789f6..cea3902 100644
+--- a/drivers/char/tpm/tpm.c
++++ b/drivers/char/tpm/tpm.c
+@@ -405,7 +405,7 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
+ chip->vendor.req_complete_val)
+ goto out_recv;
+
+- if ((status == chip->vendor.req_canceled)) {
++ if (status == chip->vendor.req_canceled) {
+ dev_err(chip->dev, "Operation Canceled\n");
+ rc = -ECANCELED;
+ goto out;
+@@ -824,6 +824,8 @@ ssize_t tpm_show_pubek(struct device *dev, struct device_attribute *attr,
+
+ struct tpm_chip *chip = dev_get_drvdata(dev);
+
++ pax_track_stack();
++
+ tpm_cmd.header.in = tpm_readpubek_header;
+ err = transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE,
+ "attempting to read the PUBEK");
+diff --git a/drivers/char/tpm/tpm_bios.c b/drivers/char/tpm/tpm_bios.c
+index bf2170f..ce8cab9 100644
+--- a/drivers/char/tpm/tpm_bios.c
++++ b/drivers/char/tpm/tpm_bios.c
+@@ -172,7 +172,7 @@ static void *tpm_bios_measurements_start(struct seq_file *m, loff_t *pos)
+ event = addr;
+
+ if ((event->event_type == 0 && event->event_size == 0) ||
+- ((addr + sizeof(struct tcpa_event) + event->event_size) >= limit))
++ (event->event_size >= limit - addr - sizeof(struct tcpa_event)))
+ return NULL;
+
+ return addr;
+@@ -197,7 +197,7 @@ static void *tpm_bios_measurements_next(struct seq_file *m, void *v,
+ return NULL;
+
+ if ((event->event_type == 0 && event->event_size == 0) ||
+- ((v + sizeof(struct tcpa_event) + event->event_size) >= limit))
++ (event->event_size >= limit - v - sizeof(struct tcpa_event)))
+ return NULL;
+
+ (*pos)++;
+@@ -290,7 +290,8 @@ static int tpm_binary_bios_measurements_show(struct seq_file *m, void *v)
+ int i;
+
+ for (i = 0; i < sizeof(struct tcpa_event) + event->event_size; i++)
+- seq_putc(m, data[i]);
++ if (!seq_putc(m, data[i]))
++ return -EFAULT;
+
+ return 0;
+ }
+@@ -409,8 +410,13 @@ static int read_log(struct tpm_bios_log *log)
+ log->bios_event_log_end = log->bios_event_log + len;
+
+ virt = acpi_os_map_memory(start, len);
++ if (!virt) {
++ kfree(log->bios_event_log);
++ log->bios_event_log = NULL;
++ return -EFAULT;
++ }
+
+- memcpy(log->bios_event_log, virt, len);
++ memcpy(log->bios_event_log, (const char __force_kernel *)virt, len);
+
+ acpi_os_unmap_memory(virt, len);
+ return 0;
+diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
+index 123cedf..6664cb4 100644
+--- a/drivers/char/tty_io.c
++++ b/drivers/char/tty_io.c
+@@ -146,7 +146,7 @@ static int tty_open(struct inode *, struct file *);
+ static int tty_release(struct inode *, struct file *);
+ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
+ #ifdef CONFIG_COMPAT
+-static long tty_compat_ioctl(struct file *file, unsigned int cmd,
++long tty_compat_ioctl(struct file *file, unsigned int cmd,
+ unsigned long arg);
+ #else
+ #define tty_compat_ioctl NULL
+@@ -1774,6 +1774,7 @@ got_driver:
+
+ if (IS_ERR(tty)) {
+ mutex_unlock(&tty_mutex);
++ tty_driver_kref_put(driver);
+ return PTR_ERR(tty);
+ }
+ }
+@@ -2603,8 +2604,10 @@ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ return retval;
+ }
+
++EXPORT_SYMBOL(tty_ioctl);
++
+ #ifdef CONFIG_COMPAT
+-static long tty_compat_ioctl(struct file *file, unsigned int cmd,
++long tty_compat_ioctl(struct file *file, unsigned int cmd,
+ unsigned long arg)
+ {
+ struct inode *inode = file->f_dentry->d_inode;
+@@ -2628,6 +2631,8 @@ static long tty_compat_ioctl(struct file *file, unsigned int cmd,
+
+ return retval;
+ }
++
++EXPORT_SYMBOL(tty_compat_ioctl);
+ #endif
+
+ /*
+@@ -3073,7 +3078,7 @@ EXPORT_SYMBOL_GPL(get_current_tty);
+
+ void tty_default_fops(struct file_operations *fops)
+ {
+- *fops = tty_fops;
++ memcpy((void *)fops, &tty_fops, sizeof(tty_fops));
+ }
+
+ /*
+diff --git a/drivers/char/tty_ldisc.c b/drivers/char/tty_ldisc.c
+index d814a3d..b55b9c9 100644
+--- a/drivers/char/tty_ldisc.c
++++ b/drivers/char/tty_ldisc.c
+@@ -74,7 +74,7 @@ static void put_ldisc(struct tty_ldisc *ld)
+ if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) {
+ struct tty_ldisc_ops *ldo = ld->ops;
+
+- ldo->refcount--;
++ atomic_dec(&ldo->refcount);
+ module_put(ldo->owner);
+ spin_unlock_irqrestore(&tty_ldisc_lock, flags);
+
+@@ -109,7 +109,7 @@ int tty_register_ldisc(int disc, struct tty_ldisc_ops *new_ldisc)
+ spin_lock_irqsave(&tty_ldisc_lock, flags);
+ tty_ldiscs[disc] = new_ldisc;
+ new_ldisc->num = disc;
+- new_ldisc->refcount = 0;
++ atomic_set(&new_ldisc->refcount, 0);
+ spin_unlock_irqrestore(&tty_ldisc_lock, flags);
+
+ return ret;
+@@ -137,7 +137,7 @@ int tty_unregister_ldisc(int disc)
+ return -EINVAL;
+
+ spin_lock_irqsave(&tty_ldisc_lock, flags);
+- if (tty_ldiscs[disc]->refcount)
++ if (atomic_read(&tty_ldiscs[disc]->refcount))
+ ret = -EBUSY;
+ else
+ tty_ldiscs[disc] = NULL;
+@@ -158,7 +158,7 @@ static struct tty_ldisc_ops *get_ldops(int disc)
+ if (ldops) {
+ ret = ERR_PTR(-EAGAIN);
+ if (try_module_get(ldops->owner)) {
+- ldops->refcount++;
++ atomic_inc(&ldops->refcount);
+ ret = ldops;
+ }
+ }
+@@ -171,7 +171,7 @@ static void put_ldops(struct tty_ldisc_ops *ldops)
+ unsigned long flags;
+
+ spin_lock_irqsave(&tty_ldisc_lock, flags);
+- ldops->refcount--;
++ atomic_dec(&ldops->refcount);
+ module_put(ldops->owner);
+ spin_unlock_irqrestore(&tty_ldisc_lock, flags);
+ }
+diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
+index a035ae3..c27fe2c 100644
+--- a/drivers/char/virtio_console.c
++++ b/drivers/char/virtio_console.c
+@@ -133,7 +133,9 @@ static int get_chars(u32 vtermno, char *buf, int count)
+ * virtqueue, so we let the drivers do some boutique early-output thing. */
+ int __init virtio_cons_early_init(int (*put_chars)(u32, const char *, int))
+ {
+- virtio_cons.put_chars = put_chars;
++ pax_open_kernel();
++ *(void **)&virtio_cons.put_chars = put_chars;
++ pax_close_kernel();
+ return hvc_instantiate(0, 0, &virtio_cons);
+ }
+
+@@ -213,11 +215,13 @@ static int __devinit virtcons_probe(struct virtio_device *dev)
+ out_vq = vqs[1];
+
+ /* Start using the new console output. */
+- virtio_cons.get_chars = get_chars;
+- virtio_cons.put_chars = put_chars;
+- virtio_cons.notifier_add = notifier_add_vio;
+- virtio_cons.notifier_del = notifier_del_vio;
+- virtio_cons.notifier_hangup = notifier_del_vio;
++ pax_open_kernel();
++ *(void **)&virtio_cons.get_chars = get_chars;
++ *(void **)&virtio_cons.put_chars = put_chars;
++ *(void **)&virtio_cons.notifier_add = notifier_add_vio;
++ *(void **)&virtio_cons.notifier_del = notifier_del_vio;
++ *(void **)&virtio_cons.notifier_hangup = notifier_del_vio;
++ pax_close_kernel();
+
+ /* The first argument of hvc_alloc() is the virtual console number, so
+ * we use zero. The second argument is the parameter for the
+diff --git a/drivers/char/vt.c b/drivers/char/vt.c
+index 0c80c68..53d59c1 100644
+--- a/drivers/char/vt.c
++++ b/drivers/char/vt.c
+@@ -243,7 +243,7 @@ EXPORT_SYMBOL_GPL(unregister_vt_notifier);
+
+ static void notify_write(struct vc_data *vc, unsigned int unicode)
+ {
+- struct vt_notifier_param param = { .vc = vc, unicode = unicode };
++ struct vt_notifier_param param = { .vc = vc, .c = unicode };
+ atomic_notifier_call_chain(&vt_notifier_list, VT_WRITE, ¶m);
+ }
+
+diff --git a/drivers/char/vt_ioctl.c b/drivers/char/vt_ioctl.c
+index 6351a26..999af95 100644
+--- a/drivers/char/vt_ioctl.c
++++ b/drivers/char/vt_ioctl.c
+@@ -210,9 +210,6 @@ do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm, struct kbd_str
+ if (copy_from_user(&tmp, user_kbe, sizeof(struct kbentry)))
+ return -EFAULT;
+
+- if (!capable(CAP_SYS_TTY_CONFIG))
+- perm = 0;
+-
+ switch (cmd) {
+ case KDGKBENT:
+ key_map = key_maps[s];
+@@ -224,8 +221,12 @@ do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm, struct kbd_str
+ val = (i ? K_HOLE : K_NOSUCHMAP);
+ return put_user(val, &user_kbe->kb_value);
+ case KDSKBENT:
++ if (!capable(CAP_SYS_TTY_CONFIG))
++ perm = 0;
++
+ if (!perm)
+ return -EPERM;
++
+ if (!i && v == K_NOSUCHMAP) {
+ /* deallocate map */
+ key_map = key_maps[s];
+@@ -325,9 +326,6 @@ do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
+ int i, j, k;
+ int ret;
+
+- if (!capable(CAP_SYS_TTY_CONFIG))
+- perm = 0;
+-
+ kbs = kmalloc(sizeof(*kbs), GFP_KERNEL);
+ if (!kbs) {
+ ret = -ENOMEM;
+@@ -361,6 +359,9 @@ do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
+ kfree(kbs);
+ return ((p && *p) ? -EOVERFLOW : 0);
+ case KDSKBSENT:
++ if (!capable(CAP_SYS_TTY_CONFIG))
++ perm = 0;
++
+ if (!perm) {
+ ret = -EPERM;
+ goto reterr;
+diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
+index c7ae026..1769c1d 100644
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -750,7 +750,7 @@ static void cpufreq_sysfs_release(struct kobject *kobj)
+ complete(&policy->kobj_unregister);
+ }
+
+-static struct sysfs_ops sysfs_ops = {
++static const struct sysfs_ops sysfs_ops = {
+ .show = show,
+ .store = store,
+ };
+diff --git a/drivers/cpuidle/sysfs.c b/drivers/cpuidle/sysfs.c
+index 97b0038..2056670 100644
+--- a/drivers/cpuidle/sysfs.c
++++ b/drivers/cpuidle/sysfs.c
+@@ -191,7 +191,7 @@ static ssize_t cpuidle_store(struct kobject * kobj, struct attribute * attr,
+ return ret;
+ }
+
+-static struct sysfs_ops cpuidle_sysfs_ops = {
++static const struct sysfs_ops cpuidle_sysfs_ops = {
+ .show = cpuidle_show,
+ .store = cpuidle_store,
+ };
+@@ -277,7 +277,7 @@ static ssize_t cpuidle_state_show(struct kobject * kobj,
+ return ret;
+ }
+
+-static struct sysfs_ops cpuidle_state_sysfs_ops = {
++static const struct sysfs_ops cpuidle_state_sysfs_ops = {
+ .show = cpuidle_state_show,
+ };
+
+@@ -294,7 +294,7 @@ static struct kobj_type ktype_state_cpuidle = {
+ .release = cpuidle_state_sysfs_release,
+ };
+
+-static void inline cpuidle_free_state_kobj(struct cpuidle_device *device, int i)
++static inline void cpuidle_free_state_kobj(struct cpuidle_device *device, int i)
+ {
+ kobject_put(&device->kobjs[i]->kobj);
+ wait_for_completion(&device->kobjs[i]->kobj_unregister);
+diff --git a/drivers/crypto/hifn_795x.c b/drivers/crypto/hifn_795x.c
+index 5f753fc..0377ae9 100644
+--- a/drivers/crypto/hifn_795x.c
++++ b/drivers/crypto/hifn_795x.c
+@@ -1655,6 +1655,8 @@ static int hifn_test(struct hifn_device *dev, int encdec, u8 snum)
+ 0xCA, 0x34, 0x2B, 0x2E};
+ struct scatterlist sg;
+
++ pax_track_stack();
++
+ memset(src, 0, sizeof(src));
+ memset(ctx.key, 0, sizeof(ctx.key));
+
+diff --git a/drivers/crypto/padlock-aes.c b/drivers/crypto/padlock-aes.c
+index 71e6482..de8d96c 100644
+--- a/drivers/crypto/padlock-aes.c
++++ b/drivers/crypto/padlock-aes.c
+@@ -108,6 +108,8 @@ static int aes_set_key(struct crypto_tfm *tfm, const u8 *in_key,
+ struct crypto_aes_ctx gen_aes;
+ int cpu;
+
++ pax_track_stack();
++
+ if (key_len % 8) {
+ *flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
+ return -EINVAL;
+diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c
+index dcc4ab7..cc834bb 100644
+--- a/drivers/dma/ioat/dma.c
++++ b/drivers/dma/ioat/dma.c
+@@ -1146,7 +1146,7 @@ ioat_attr_show(struct kobject *kobj, struct attribute *attr, char *page)
+ return entry->show(&chan->common, page);
+ }
+
+-struct sysfs_ops ioat_sysfs_ops = {
++const struct sysfs_ops ioat_sysfs_ops = {
+ .show = ioat_attr_show,
+ };
+
+diff --git a/drivers/dma/ioat/dma.h b/drivers/dma/ioat/dma.h
+index bbc3e78..f2db62c 100644
+--- a/drivers/dma/ioat/dma.h
++++ b/drivers/dma/ioat/dma.h
+@@ -347,7 +347,7 @@ bool ioat_cleanup_preamble(struct ioat_chan_common *chan,
+ unsigned long *phys_complete);
+ void ioat_kobject_add(struct ioatdma_device *device, struct kobj_type *type);
+ void ioat_kobject_del(struct ioatdma_device *device);
+-extern struct sysfs_ops ioat_sysfs_ops;
++extern const struct sysfs_ops ioat_sysfs_ops;
+ extern struct ioat_sysfs_entry ioat_version_attr;
+ extern struct ioat_sysfs_entry ioat_cap_attr;
+ #endif /* IOATDMA_H */
+diff --git a/drivers/dma/ioat/dma_v3.c b/drivers/dma/ioat/dma_v3.c
+index 9908c9e..3ceb0e5 100644
+--- a/drivers/dma/ioat/dma_v3.c
++++ b/drivers/dma/ioat/dma_v3.c
+@@ -71,10 +71,10 @@
+ /* provide a lookup table for setting the source address in the base or
+ * extended descriptor of an xor or pq descriptor
+ */
+-static const u8 xor_idx_to_desc __read_mostly = 0xd0;
+-static const u8 xor_idx_to_field[] __read_mostly = { 1, 4, 5, 6, 7, 0, 1, 2 };
+-static const u8 pq_idx_to_desc __read_mostly = 0xf8;
+-static const u8 pq_idx_to_field[] __read_mostly = { 1, 4, 5, 0, 1, 2, 4, 5 };
++static const u8 xor_idx_to_desc = 0xd0;
++static const u8 xor_idx_to_field[] = { 1, 4, 5, 6, 7, 0, 1, 2 };
++static const u8 pq_idx_to_desc = 0xf8;
++static const u8 pq_idx_to_field[] = { 1, 4, 5, 0, 1, 2, 4, 5 };
+
+ static dma_addr_t xor_get_src(struct ioat_raw_descriptor *descs[2], int idx)
+ {
+diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
+index 85c464a..afd1e73 100644
+--- a/drivers/edac/amd64_edac.c
++++ b/drivers/edac/amd64_edac.c
+@@ -3099,7 +3099,7 @@ static void __devexit amd64_remove_one_instance(struct pci_dev *pdev)
+ * PCI core identifies what devices are on a system during boot, and then
+ * inquiry this table to see if this driver is for a given device found.
+ */
+-static const struct pci_device_id amd64_pci_table[] __devinitdata = {
++static const struct pci_device_id amd64_pci_table[] __devinitconst = {
+ {
+ .vendor = PCI_VENDOR_ID_AMD,
+ .device = PCI_DEVICE_ID_AMD_K8_NB_MEMCTL,
+diff --git a/drivers/edac/amd76x_edac.c b/drivers/edac/amd76x_edac.c
+index 2b95f1a..4f52793 100644
+--- a/drivers/edac/amd76x_edac.c
++++ b/drivers/edac/amd76x_edac.c
+@@ -322,7 +322,7 @@ static void __devexit amd76x_remove_one(struct pci_dev *pdev)
+ edac_mc_free(mci);
+ }
+
+-static const struct pci_device_id amd76x_pci_tbl[] __devinitdata = {
++static const struct pci_device_id amd76x_pci_tbl[] __devinitconst = {
+ {
+ PCI_VEND_DEV(AMD, FE_GATE_700C), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ AMD762},
+diff --git a/drivers/edac/e752x_edac.c b/drivers/edac/e752x_edac.c
+index d205d49..74c9672 100644
+--- a/drivers/edac/e752x_edac.c
++++ b/drivers/edac/e752x_edac.c
+@@ -1282,7 +1282,7 @@ static void __devexit e752x_remove_one(struct pci_dev *pdev)
+ edac_mc_free(mci);
+ }
+
+-static const struct pci_device_id e752x_pci_tbl[] __devinitdata = {
++static const struct pci_device_id e752x_pci_tbl[] __devinitconst = {
+ {
+ PCI_VEND_DEV(INTEL, 7520_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ E7520},
+diff --git a/drivers/edac/e7xxx_edac.c b/drivers/edac/e7xxx_edac.c
+index c7d11cc..c59c1ca 100644
+--- a/drivers/edac/e7xxx_edac.c
++++ b/drivers/edac/e7xxx_edac.c
+@@ -526,7 +526,7 @@ static void __devexit e7xxx_remove_one(struct pci_dev *pdev)
+ edac_mc_free(mci);
+ }
+
+-static const struct pci_device_id e7xxx_pci_tbl[] __devinitdata = {
++static const struct pci_device_id e7xxx_pci_tbl[] __devinitconst = {
+ {
+ PCI_VEND_DEV(INTEL, 7205_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ E7205},
+diff --git a/drivers/edac/edac_device_sysfs.c b/drivers/edac/edac_device_sysfs.c
+index 5376457..5fdedbc 100644
+--- a/drivers/edac/edac_device_sysfs.c
++++ b/drivers/edac/edac_device_sysfs.c
+@@ -137,7 +137,7 @@ static ssize_t edac_dev_ctl_info_store(struct kobject *kobj,
+ }
+
+ /* edac_dev file operations for an 'ctl_info' */
+-static struct sysfs_ops device_ctl_info_ops = {
++static const struct sysfs_ops device_ctl_info_ops = {
+ .show = edac_dev_ctl_info_show,
+ .store = edac_dev_ctl_info_store
+ };
+@@ -373,7 +373,7 @@ static ssize_t edac_dev_instance_store(struct kobject *kobj,
+ }
+
+ /* edac_dev file operations for an 'instance' */
+-static struct sysfs_ops device_instance_ops = {
++static const struct sysfs_ops device_instance_ops = {
+ .show = edac_dev_instance_show,
+ .store = edac_dev_instance_store
+ };
+@@ -476,7 +476,7 @@ static ssize_t edac_dev_block_store(struct kobject *kobj,
+ }
+
+ /* edac_dev file operations for a 'block' */
+-static struct sysfs_ops device_block_ops = {
++static const struct sysfs_ops device_block_ops = {
+ .show = edac_dev_block_show,
+ .store = edac_dev_block_store
+ };
+diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
+index e1d4ce0..88840e9 100644
+--- a/drivers/edac/edac_mc_sysfs.c
++++ b/drivers/edac/edac_mc_sysfs.c
+@@ -245,7 +245,7 @@ static ssize_t csrowdev_store(struct kobject *kobj, struct attribute *attr,
+ return -EIO;
+ }
+
+-static struct sysfs_ops csrowfs_ops = {
++static const struct sysfs_ops csrowfs_ops = {
+ .show = csrowdev_show,
+ .store = csrowdev_store
+ };
+@@ -575,7 +575,7 @@ static ssize_t mcidev_store(struct kobject *kobj, struct attribute *attr,
+ }
+
+ /* Intermediate show/store table */
+-static struct sysfs_ops mci_ops = {
++static const struct sysfs_ops mci_ops = {
+ .show = mcidev_show,
+ .store = mcidev_store
+ };
+diff --git a/drivers/edac/edac_pci_sysfs.c b/drivers/edac/edac_pci_sysfs.c
+index 422728c..d8d9c88 100644
+--- a/drivers/edac/edac_pci_sysfs.c
++++ b/drivers/edac/edac_pci_sysfs.c
+@@ -25,8 +25,8 @@ static int edac_pci_log_pe = 1; /* log PCI parity errors */
+ static int edac_pci_log_npe = 1; /* log PCI non-parity error errors */
+ static int edac_pci_poll_msec = 1000; /* one second workq period */
+
+-static atomic_t pci_parity_count = ATOMIC_INIT(0);
+-static atomic_t pci_nonparity_count = ATOMIC_INIT(0);
++static atomic_unchecked_t pci_parity_count = ATOMIC_INIT(0);
++static atomic_unchecked_t pci_nonparity_count = ATOMIC_INIT(0);
+
+ static struct kobject *edac_pci_top_main_kobj;
+ static atomic_t edac_pci_sysfs_refcount = ATOMIC_INIT(0);
+@@ -121,7 +121,7 @@ static ssize_t edac_pci_instance_store(struct kobject *kobj,
+ }
+
+ /* fs_ops table */
+-static struct sysfs_ops pci_instance_ops = {
++static const struct sysfs_ops pci_instance_ops = {
+ .show = edac_pci_instance_show,
+ .store = edac_pci_instance_store
+ };
+@@ -261,7 +261,7 @@ static ssize_t edac_pci_dev_store(struct kobject *kobj,
+ return -EIO;
+ }
+
+-static struct sysfs_ops edac_pci_sysfs_ops = {
++static const struct sysfs_ops edac_pci_sysfs_ops = {
+ .show = edac_pci_dev_show,
+ .store = edac_pci_dev_store
+ };
+@@ -579,7 +579,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
+ edac_printk(KERN_CRIT, EDAC_PCI,
+ "Signaled System Error on %s\n",
+ pci_name(dev));
+- atomic_inc(&pci_nonparity_count);
++ atomic_inc_unchecked(&pci_nonparity_count);
+ }
+
+ if (status & (PCI_STATUS_PARITY)) {
+@@ -587,7 +587,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
+ "Master Data Parity Error on %s\n",
+ pci_name(dev));
+
+- atomic_inc(&pci_parity_count);
++ atomic_inc_unchecked(&pci_parity_count);
+ }
+
+ if (status & (PCI_STATUS_DETECTED_PARITY)) {
+@@ -595,7 +595,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
+ "Detected Parity Error on %s\n",
+ pci_name(dev));
+
+- atomic_inc(&pci_parity_count);
++ atomic_inc_unchecked(&pci_parity_count);
+ }
+ }
+
+@@ -616,7 +616,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
+ edac_printk(KERN_CRIT, EDAC_PCI, "Bridge "
+ "Signaled System Error on %s\n",
+ pci_name(dev));
+- atomic_inc(&pci_nonparity_count);
++ atomic_inc_unchecked(&pci_nonparity_count);
+ }
+
+ if (status & (PCI_STATUS_PARITY)) {
+@@ -624,7 +624,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
+ "Master Data Parity Error on "
+ "%s\n", pci_name(dev));
+
+- atomic_inc(&pci_parity_count);
++ atomic_inc_unchecked(&pci_parity_count);
+ }
+
+ if (status & (PCI_STATUS_DETECTED_PARITY)) {
+@@ -632,7 +632,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
+ "Detected Parity Error on %s\n",
+ pci_name(dev));
+
+- atomic_inc(&pci_parity_count);
++ atomic_inc_unchecked(&pci_parity_count);
+ }
+ }
+ }
+@@ -674,7 +674,7 @@ void edac_pci_do_parity_check(void)
+ if (!check_pci_errors)
+ return;
+
+- before_count = atomic_read(&pci_parity_count);
++ before_count = atomic_read_unchecked(&pci_parity_count);
+
+ /* scan all PCI devices looking for a Parity Error on devices and
+ * bridges.
+@@ -686,7 +686,7 @@ void edac_pci_do_parity_check(void)
+ /* Only if operator has selected panic on PCI Error */
+ if (edac_pci_get_panic_on_pe()) {
+ /* If the count is different 'after' from 'before' */
+- if (before_count != atomic_read(&pci_parity_count))
++ if (before_count != atomic_read_unchecked(&pci_parity_count))
+ panic("EDAC: PCI Parity Error");
+ }
+ }
+diff --git a/drivers/edac/i3000_edac.c b/drivers/edac/i3000_edac.c
+index 6c9a0f2..9c1cf7e 100644
+--- a/drivers/edac/i3000_edac.c
++++ b/drivers/edac/i3000_edac.c
+@@ -471,7 +471,7 @@ static void __devexit i3000_remove_one(struct pci_dev *pdev)
+ edac_mc_free(mci);
+ }
+
+-static const struct pci_device_id i3000_pci_tbl[] __devinitdata = {
++static const struct pci_device_id i3000_pci_tbl[] __devinitconst = {
+ {
+ PCI_VEND_DEV(INTEL, 3000_HB), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ I3000},
+diff --git a/drivers/edac/i3200_edac.c b/drivers/edac/i3200_edac.c
+index fde4db9..fe108f9 100644
+--- a/drivers/edac/i3200_edac.c
++++ b/drivers/edac/i3200_edac.c
+@@ -444,7 +444,7 @@ static void __devexit i3200_remove_one(struct pci_dev *pdev)
+ edac_mc_free(mci);
+ }
+
+-static const struct pci_device_id i3200_pci_tbl[] __devinitdata = {
++static const struct pci_device_id i3200_pci_tbl[] __devinitconst = {
+ {
+ PCI_VEND_DEV(INTEL, 3200_HB), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ I3200},
+diff --git a/drivers/edac/i5000_edac.c b/drivers/edac/i5000_edac.c
+index adc10a2..57d4ccf 100644
+--- a/drivers/edac/i5000_edac.c
++++ b/drivers/edac/i5000_edac.c
+@@ -1516,7 +1516,7 @@ static void __devexit i5000_remove_one(struct pci_dev *pdev)
+ *
+ * The "E500P" device is the first device supported.
+ */
+-static const struct pci_device_id i5000_pci_tbl[] __devinitdata = {
++static const struct pci_device_id i5000_pci_tbl[] __devinitconst = {
+ {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_I5000_DEV16),
+ .driver_data = I5000P},
+
+diff --git a/drivers/edac/i5100_edac.c b/drivers/edac/i5100_edac.c
+index 22db05a..b2b5503 100644
+--- a/drivers/edac/i5100_edac.c
++++ b/drivers/edac/i5100_edac.c
+@@ -944,7 +944,7 @@ static void __devexit i5100_remove_one(struct pci_dev *pdev)
+ edac_mc_free(mci);
+ }
+
+-static const struct pci_device_id i5100_pci_tbl[] __devinitdata = {
++static const struct pci_device_id i5100_pci_tbl[] __devinitconst = {
+ /* Device 16, Function 0, Channel 0 Memory Map, Error Flag/Mask, ... */
+ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_5100_16) },
+ { 0, }
+diff --git a/drivers/edac/i5400_edac.c b/drivers/edac/i5400_edac.c
+index f99d106..f050710 100644
+--- a/drivers/edac/i5400_edac.c
++++ b/drivers/edac/i5400_edac.c
+@@ -1383,7 +1383,7 @@ static void __devexit i5400_remove_one(struct pci_dev *pdev)
+ *
+ * The "E500P" device is the first device supported.
+ */
+-static const struct pci_device_id i5400_pci_tbl[] __devinitdata = {
++static const struct pci_device_id i5400_pci_tbl[] __devinitconst = {
+ {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_5400_ERR)},
+ {0,} /* 0 terminated list. */
+ };
+diff --git a/drivers/edac/i82443bxgx_edac.c b/drivers/edac/i82443bxgx_edac.c
+index 577760a..9ce16ce 100644
+--- a/drivers/edac/i82443bxgx_edac.c
++++ b/drivers/edac/i82443bxgx_edac.c
+@@ -381,7 +381,7 @@ static void __devexit i82443bxgx_edacmc_remove_one(struct pci_dev *pdev)
+
+ EXPORT_SYMBOL_GPL(i82443bxgx_edacmc_remove_one);
+
+-static const struct pci_device_id i82443bxgx_pci_tbl[] __devinitdata = {
++static const struct pci_device_id i82443bxgx_pci_tbl[] __devinitconst = {
+ {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443BX_0)},
+ {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443BX_2)},
+ {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443GX_0)},
+diff --git a/drivers/edac/i82860_edac.c b/drivers/edac/i82860_edac.c
+index c0088ba..64a7b98 100644
+--- a/drivers/edac/i82860_edac.c
++++ b/drivers/edac/i82860_edac.c
+@@ -271,7 +271,7 @@ static void __devexit i82860_remove_one(struct pci_dev *pdev)
+ edac_mc_free(mci);
+ }
+
+-static const struct pci_device_id i82860_pci_tbl[] __devinitdata = {
++static const struct pci_device_id i82860_pci_tbl[] __devinitconst = {
+ {
+ PCI_VEND_DEV(INTEL, 82860_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ I82860},
+diff --git a/drivers/edac/i82875p_edac.c b/drivers/edac/i82875p_edac.c
+index b2d83b9..a34357b 100644
+--- a/drivers/edac/i82875p_edac.c
++++ b/drivers/edac/i82875p_edac.c
+@@ -512,7 +512,7 @@ static void __devexit i82875p_remove_one(struct pci_dev *pdev)
+ edac_mc_free(mci);
+ }
+
+-static const struct pci_device_id i82875p_pci_tbl[] __devinitdata = {
++static const struct pci_device_id i82875p_pci_tbl[] __devinitconst = {
+ {
+ PCI_VEND_DEV(INTEL, 82875_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ I82875P},
+diff --git a/drivers/edac/i82975x_edac.c b/drivers/edac/i82975x_edac.c
+index 2eed3ea..87bbbd1 100644
+--- a/drivers/edac/i82975x_edac.c
++++ b/drivers/edac/i82975x_edac.c
+@@ -586,7 +586,7 @@ static void __devexit i82975x_remove_one(struct pci_dev *pdev)
+ edac_mc_free(mci);
+ }
+
+-static const struct pci_device_id i82975x_pci_tbl[] __devinitdata = {
++static const struct pci_device_id i82975x_pci_tbl[] __devinitconst = {
+ {
+ PCI_VEND_DEV(INTEL, 82975_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ I82975X
+diff --git a/drivers/edac/r82600_edac.c b/drivers/edac/r82600_edac.c
+index 9900675..78ac2b6 100644
+--- a/drivers/edac/r82600_edac.c
++++ b/drivers/edac/r82600_edac.c
+@@ -374,7 +374,7 @@ static void __devexit r82600_remove_one(struct pci_dev *pdev)
+ edac_mc_free(mci);
+ }
+
+-static const struct pci_device_id r82600_pci_tbl[] __devinitdata = {
++static const struct pci_device_id r82600_pci_tbl[] __devinitconst = {
+ {
+ PCI_DEVICE(PCI_VENDOR_ID_RADISYS, R82600_BRIDGE_ID)
+ },
+diff --git a/drivers/edac/x38_edac.c b/drivers/edac/x38_edac.c
+index d4ec605..4cfec4e 100644
+--- a/drivers/edac/x38_edac.c
++++ b/drivers/edac/x38_edac.c
+@@ -441,7 +441,7 @@ static void __devexit x38_remove_one(struct pci_dev *pdev)
+ edac_mc_free(mci);
+ }
+
+-static const struct pci_device_id x38_pci_tbl[] __devinitdata = {
++static const struct pci_device_id x38_pci_tbl[] __devinitconst = {
+ {
+ PCI_VEND_DEV(INTEL, X38_HB), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ X38},
+diff --git a/drivers/firewire/core-card.c b/drivers/firewire/core-card.c
+index 3fc2ceb..daf098f 100644
+--- a/drivers/firewire/core-card.c
++++ b/drivers/firewire/core-card.c
+@@ -558,7 +558,7 @@ void fw_card_release(struct kref *kref)
+
+ void fw_core_remove_card(struct fw_card *card)
+ {
+- struct fw_card_driver dummy_driver = dummy_driver_template;
++ fw_card_driver_no_const dummy_driver = dummy_driver_template;
+
+ card->driver->update_phy_reg(card, 4,
+ PHY_LINK_ACTIVE | PHY_CONTENDER, 0);
+diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
+index 4560d8f..36db24a 100644
+--- a/drivers/firewire/core-cdev.c
++++ b/drivers/firewire/core-cdev.c
+@@ -1141,8 +1141,7 @@ static int init_iso_resource(struct client *client,
+ int ret;
+
+ if ((request->channels == 0 && request->bandwidth == 0) ||
+- request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL ||
+- request->bandwidth < 0)
++ request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL)
+ return -EINVAL;
+
+ r = kmalloc(sizeof(*r), GFP_KERNEL);
+diff --git a/drivers/firewire/core-transaction.c b/drivers/firewire/core-transaction.c
+index da628c7..cf54a2c 100644
+--- a/drivers/firewire/core-transaction.c
++++ b/drivers/firewire/core-transaction.c
+@@ -36,6 +36,7 @@
+ #include <linux/string.h>
+ #include <linux/timer.h>
+ #include <linux/types.h>
++#include <linux/sched.h>
+
+ #include <asm/byteorder.h>
+
+@@ -344,6 +345,8 @@ int fw_run_transaction(struct fw_card *card, int tcode, int destination_id,
+ struct transaction_callback_data d;
+ struct fw_transaction t;
+
++ pax_track_stack();
++
+ init_completion(&d.done);
+ d.payload = payload;
+ fw_send_request(card, &t, tcode, destination_id, generation, speed,
+diff --git a/drivers/firewire/core.h b/drivers/firewire/core.h
+index 7ff6e75..a2965d9 100644
+--- a/drivers/firewire/core.h
++++ b/drivers/firewire/core.h
+@@ -86,6 +86,7 @@ struct fw_card_driver {
+
+ int (*stop_iso)(struct fw_iso_context *ctx);
+ };
++typedef struct fw_card_driver __no_const fw_card_driver_no_const;
+
+ void fw_card_initialize(struct fw_card *card,
+ const struct fw_card_driver *driver, struct device *device);
+diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
+index 3a2ccb0..82fd7c4 100644
+--- a/drivers/firmware/dmi_scan.c
++++ b/drivers/firmware/dmi_scan.c
+@@ -391,11 +391,6 @@ void __init dmi_scan_machine(void)
+ }
+ }
+ else {
+- /*
+- * no iounmap() for that ioremap(); it would be a no-op, but
+- * it's so early in setup that sucker gets confused into doing
+- * what it shouldn't if we actually call it.
+- */
+ p = dmi_ioremap(0xF0000, 0x10000);
+ if (p == NULL)
+ goto error;
+@@ -667,7 +662,7 @@ int dmi_walk(void (*decode)(const struct dmi_header *, void *),
+ if (buf == NULL)
+ return -1;
+
+- dmi_table(buf, dmi_len, dmi_num, decode, private_data);
++ dmi_table((char __force_kernel *)buf, dmi_len, dmi_num, decode, private_data);
+
+ iounmap(buf);
+ return 0;
+diff --git a/drivers/firmware/edd.c b/drivers/firmware/edd.c
+index 9e4f59d..110e24e 100644
+--- a/drivers/firmware/edd.c
++++ b/drivers/firmware/edd.c
+@@ -122,7 +122,7 @@ edd_attr_show(struct kobject * kobj, struct attribute *attr, char *buf)
+ return ret;
+ }
+
+-static struct sysfs_ops edd_attr_ops = {
++static const struct sysfs_ops edd_attr_ops = {
+ .show = edd_attr_show,
+ };
+
+diff --git a/drivers/firmware/efivars.c b/drivers/firmware/efivars.c
+index f4f709d..082f06e 100644
+--- a/drivers/firmware/efivars.c
++++ b/drivers/firmware/efivars.c
+@@ -362,7 +362,7 @@ static ssize_t efivar_attr_store(struct kobject *kobj, struct attribute *attr,
+ return ret;
+ }
+
+-static struct sysfs_ops efivar_attr_ops = {
++static const struct sysfs_ops efivar_attr_ops = {
+ .show = efivar_attr_show,
+ .store = efivar_attr_store,
+ };
+diff --git a/drivers/firmware/iscsi_ibft.c b/drivers/firmware/iscsi_ibft.c
+index 051d1eb..0a5d4e7 100644
+--- a/drivers/firmware/iscsi_ibft.c
++++ b/drivers/firmware/iscsi_ibft.c
+@@ -525,7 +525,7 @@ static ssize_t ibft_show_attribute(struct kobject *kobj,
+ return ret;
+ }
+
+-static struct sysfs_ops ibft_attr_ops = {
++static const struct sysfs_ops ibft_attr_ops = {
+ .show = ibft_show_attribute,
+ };
+
+diff --git a/drivers/firmware/memmap.c b/drivers/firmware/memmap.c
+index 56f9234..8c58c7b 100644
+--- a/drivers/firmware/memmap.c
++++ b/drivers/firmware/memmap.c
+@@ -74,7 +74,7 @@ static struct attribute *def_attrs[] = {
+ NULL
+ };
+
+-static struct sysfs_ops memmap_attr_ops = {
++static const struct sysfs_ops memmap_attr_ops = {
+ .show = memmap_attr_show,
+ };
+
+diff --git a/drivers/gpio/vr41xx_giu.c b/drivers/gpio/vr41xx_giu.c
+index b16c9a8..2af7d3f 100644
+--- a/drivers/gpio/vr41xx_giu.c
++++ b/drivers/gpio/vr41xx_giu.c
+@@ -204,7 +204,7 @@ static int giu_get_irq(unsigned int irq)
+ printk(KERN_ERR "spurious GIU interrupt: %04x(%04x),%04x(%04x)\n",
+ maskl, pendl, maskh, pendh);
+
+- atomic_inc(&irq_err_count);
++ atomic_inc_unchecked(&irq_err_count);
+
+ return -EINVAL;
+ }
+diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
+index bea6efc..3dc0f42 100644
+--- a/drivers/gpu/drm/drm_crtc.c
++++ b/drivers/gpu/drm/drm_crtc.c
+@@ -1323,7 +1323,7 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
+ */
+ if ((out_resp->count_modes >= mode_count) && mode_count) {
+ copied = 0;
+- mode_ptr = (struct drm_mode_modeinfo *)(unsigned long)out_resp->modes_ptr;
++ mode_ptr = (struct drm_mode_modeinfo __user *)(unsigned long)out_resp->modes_ptr;
+ list_for_each_entry(mode, &connector->modes, head) {
+ drm_crtc_convert_to_umode(&u_mode, mode);
+ if (copy_to_user(mode_ptr + copied,
+@@ -1338,8 +1338,8 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
+
+ if ((out_resp->count_props >= props_count) && props_count) {
+ copied = 0;
+- prop_ptr = (uint32_t *)(unsigned long)(out_resp->props_ptr);
+- prop_values = (uint64_t *)(unsigned long)(out_resp->prop_values_ptr);
++ prop_ptr = (uint32_t __user *)(unsigned long)(out_resp->props_ptr);
++ prop_values = (uint64_t __user *)(unsigned long)(out_resp->prop_values_ptr);
+ for (i = 0; i < DRM_CONNECTOR_MAX_PROPERTY; i++) {
+ if (connector->property_ids[i] != 0) {
+ if (put_user(connector->property_ids[i],
+@@ -1361,7 +1361,7 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
+
+ if ((out_resp->count_encoders >= encoders_count) && encoders_count) {
+ copied = 0;
+- encoder_ptr = (uint32_t *)(unsigned long)(out_resp->encoders_ptr);
++ encoder_ptr = (uint32_t __user *)(unsigned long)(out_resp->encoders_ptr);
+ for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
+ if (connector->encoder_ids[i] != 0) {
+ if (put_user(connector->encoder_ids[i],
+@@ -1513,7 +1513,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
+ }
+
+ for (i = 0; i < crtc_req->count_connectors; i++) {
+- set_connectors_ptr = (uint32_t *)(unsigned long)crtc_req->set_connectors_ptr;
++ set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr;
+ if (get_user(out_id, &set_connectors_ptr[i])) {
+ ret = -EFAULT;
+ goto out;
+@@ -2118,7 +2118,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
+ out_resp->flags = property->flags;
+
+ if ((out_resp->count_values >= value_count) && value_count) {
+- values_ptr = (uint64_t *)(unsigned long)out_resp->values_ptr;
++ values_ptr = (uint64_t __user *)(unsigned long)out_resp->values_ptr;
+ for (i = 0; i < value_count; i++) {
+ if (copy_to_user(values_ptr + i, &property->values[i], sizeof(uint64_t))) {
+ ret = -EFAULT;
+@@ -2131,7 +2131,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
+ if (property->flags & DRM_MODE_PROP_ENUM) {
+ if ((out_resp->count_enum_blobs >= enum_count) && enum_count) {
+ copied = 0;
+- enum_ptr = (struct drm_mode_property_enum *)(unsigned long)out_resp->enum_blob_ptr;
++ enum_ptr = (struct drm_mode_property_enum __user *)(unsigned long)out_resp->enum_blob_ptr;
+ list_for_each_entry(prop_enum, &property->enum_blob_list, head) {
+
+ if (copy_to_user(&enum_ptr[copied].value, &prop_enum->value, sizeof(uint64_t))) {
+@@ -2154,7 +2154,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
+ if ((out_resp->count_enum_blobs >= blob_count) && blob_count) {
+ copied = 0;
+ blob_id_ptr = (uint32_t *)(unsigned long)out_resp->enum_blob_ptr;
+- blob_length_ptr = (uint32_t *)(unsigned long)out_resp->values_ptr;
++ blob_length_ptr = (uint32_t __user *)(unsigned long)out_resp->values_ptr;
+
+ list_for_each_entry(prop_blob, &property->enum_blob_list, head) {
+ if (put_user(prop_blob->base.id, blob_id_ptr + copied)) {
+@@ -2226,7 +2226,7 @@ int drm_mode_getblob_ioctl(struct drm_device *dev,
+ blob = obj_to_blob(obj);
+
+ if (out_resp->length == blob->length) {
+- blob_ptr = (void *)(unsigned long)out_resp->data;
++ blob_ptr = (void __user *)(unsigned long)out_resp->data;
+ if (copy_to_user(blob_ptr, blob->data, blob->length)){
+ ret = -EFAULT;
+ goto done;
+diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
+index 1b8745d..92fdbf6 100644
+--- a/drivers/gpu/drm/drm_crtc_helper.c
++++ b/drivers/gpu/drm/drm_crtc_helper.c
+@@ -573,7 +573,7 @@ static bool drm_encoder_crtc_ok(struct drm_encoder *encoder,
+ struct drm_crtc *tmp;
+ int crtc_mask = 1;
+
+- WARN(!crtc, "checking null crtc?");
++ BUG_ON(!crtc);
+
+ dev = crtc->dev;
+
+@@ -642,6 +642,8 @@ bool drm_crtc_helper_set_mode(struct drm_crtc *crtc,
+
+ adjusted_mode = drm_mode_duplicate(dev, mode);
+
++ pax_track_stack();
++
+ crtc->enabled = drm_helper_crtc_in_use(crtc);
+
+ if (!crtc->enabled)
+diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
+index 0e27d98..dec8768 100644
+--- a/drivers/gpu/drm/drm_drv.c
++++ b/drivers/gpu/drm/drm_drv.c
+@@ -417,7 +417,7 @@ int drm_ioctl(struct inode *inode, struct file *filp,
+ char *kdata = NULL;
+
+ atomic_inc(&dev->ioctl_count);
+- atomic_inc(&dev->counts[_DRM_STAT_IOCTLS]);
++ atomic_inc_unchecked(&dev->counts[_DRM_STAT_IOCTLS]);
+ ++file_priv->ioctl_count;
+
+ DRM_DEBUG("pid=%d, cmd=0x%02x, nr=0x%02x, dev 0x%lx, auth=%d\n",
+diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c
+index 519161e..98c840c 100644
+--- a/drivers/gpu/drm/drm_fops.c
++++ b/drivers/gpu/drm/drm_fops.c
+@@ -66,7 +66,7 @@ static int drm_setup(struct drm_device * dev)
+ }
+
+ for (i = 0; i < ARRAY_SIZE(dev->counts); i++)
+- atomic_set(&dev->counts[i], 0);
++ atomic_set_unchecked(&dev->counts[i], 0);
+
+ dev->sigdata.lock = NULL;
+
+@@ -130,9 +130,9 @@ int drm_open(struct inode *inode, struct file *filp)
+
+ retcode = drm_open_helper(inode, filp, dev);
+ if (!retcode) {
+- atomic_inc(&dev->counts[_DRM_STAT_OPENS]);
++ atomic_inc_unchecked(&dev->counts[_DRM_STAT_OPENS]);
+ spin_lock(&dev->count_lock);
+- if (!dev->open_count++) {
++ if (local_inc_return(&dev->open_count) == 1) {
+ spin_unlock(&dev->count_lock);
+ retcode = drm_setup(dev);
+ goto out;
+@@ -435,7 +435,7 @@ int drm_release(struct inode *inode, struct file *filp)
+
+ lock_kernel();
+
+- DRM_DEBUG("open_count = %d\n", dev->open_count);
++ DRM_DEBUG("open_count = %d\n", local_read(&dev->open_count));
+
+ if (dev->driver->preclose)
+ dev->driver->preclose(dev, file_priv);
+@@ -447,7 +447,7 @@ int drm_release(struct inode *inode, struct file *filp)
+ DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %d\n",
+ task_pid_nr(current),
+ (long)old_encode_dev(file_priv->minor->device),
+- dev->open_count);
++ local_read(&dev->open_count));
+
+ /* Release any auth tokens that might point to this file_priv,
+ (do that under the drm_global_mutex) */
+@@ -529,9 +529,9 @@ int drm_release(struct inode *inode, struct file *filp)
+ * End inline drm_release
+ */
+
+- atomic_inc(&dev->counts[_DRM_STAT_CLOSES]);
++ atomic_inc_unchecked(&dev->counts[_DRM_STAT_CLOSES]);
+ spin_lock(&dev->count_lock);
+- if (!--dev->open_count) {
++ if (local_dec_and_test(&dev->open_count)) {
+ if (atomic_read(&dev->ioctl_count)) {
+ DRM_ERROR("Device busy: %d\n",
+ atomic_read(&dev->ioctl_count));
+diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
+index 8bf3770..79422805 100644
+--- a/drivers/gpu/drm/drm_gem.c
++++ b/drivers/gpu/drm/drm_gem.c
+@@ -83,11 +83,11 @@ drm_gem_init(struct drm_device *dev)
+ spin_lock_init(&dev->object_name_lock);
+ idr_init(&dev->object_name_idr);
+ atomic_set(&dev->object_count, 0);
+- atomic_set(&dev->object_memory, 0);
++ atomic_set_unchecked(&dev->object_memory, 0);
+ atomic_set(&dev->pin_count, 0);
+- atomic_set(&dev->pin_memory, 0);
++ atomic_set_unchecked(&dev->pin_memory, 0);
+ atomic_set(&dev->gtt_count, 0);
+- atomic_set(&dev->gtt_memory, 0);
++ atomic_set_unchecked(&dev->gtt_memory, 0);
+
+ mm = kzalloc(sizeof(struct drm_gem_mm), GFP_KERNEL);
+ if (!mm) {
+@@ -150,7 +150,7 @@ drm_gem_object_alloc(struct drm_device *dev, size_t size)
+ goto fput;
+ }
+ atomic_inc(&dev->object_count);
+- atomic_add(obj->size, &dev->object_memory);
++ atomic_add_unchecked(obj->size, &dev->object_memory);
+ return obj;
+ fput:
+ fput(obj->filp);
+@@ -429,7 +429,7 @@ drm_gem_object_free(struct kref *kref)
+
+ fput(obj->filp);
+ atomic_dec(&dev->object_count);
+- atomic_sub(obj->size, &dev->object_memory);
++ atomic_sub_unchecked(obj->size, &dev->object_memory);
+ kfree(obj);
+ }
+ EXPORT_SYMBOL(drm_gem_object_free);
+diff --git a/drivers/gpu/drm/drm_info.c b/drivers/gpu/drm/drm_info.c
+index f0f6c6b..34af322 100644
+--- a/drivers/gpu/drm/drm_info.c
++++ b/drivers/gpu/drm/drm_info.c
+@@ -75,10 +75,14 @@ int drm_vm_info(struct seq_file *m, void *data)
+ struct drm_local_map *map;
+ struct drm_map_list *r_list;
+
+- /* Hardcoded from _DRM_FRAME_BUFFER,
+- _DRM_REGISTERS, _DRM_SHM, _DRM_AGP, and
+- _DRM_SCATTER_GATHER and _DRM_CONSISTENT */
+- const char *types[] = { "FB", "REG", "SHM", "AGP", "SG", "PCI" };
++ static const char * const types[] = {
++ [_DRM_FRAME_BUFFER] = "FB",
++ [_DRM_REGISTERS] = "REG",
++ [_DRM_SHM] = "SHM",
++ [_DRM_AGP] = "AGP",
++ [_DRM_SCATTER_GATHER] = "SG",
++ [_DRM_CONSISTENT] = "PCI",
++ [_DRM_GEM] = "GEM" };
+ const char *type;
+ int i;
+
+@@ -89,7 +93,7 @@ int drm_vm_info(struct seq_file *m, void *data)
+ map = r_list->map;
+ if (!map)
+ continue;
+- if (map->type < 0 || map->type > 5)
++ if (map->type >= ARRAY_SIZE(types))
+ type = "??";
+ else
+ type = types[map->type];
+@@ -265,10 +269,10 @@ int drm_gem_object_info(struct seq_file *m, void* data)
+ struct drm_device *dev = node->minor->dev;
+
+ seq_printf(m, "%d objects\n", atomic_read(&dev->object_count));
+- seq_printf(m, "%d object bytes\n", atomic_read(&dev->object_memory));
++ seq_printf(m, "%d object bytes\n", atomic_read_unchecked(&dev->object_memory));
+ seq_printf(m, "%d pinned\n", atomic_read(&dev->pin_count));
+- seq_printf(m, "%d pin bytes\n", atomic_read(&dev->pin_memory));
+- seq_printf(m, "%d gtt bytes\n", atomic_read(&dev->gtt_memory));
++ seq_printf(m, "%d pin bytes\n", atomic_read_unchecked(&dev->pin_memory));
++ seq_printf(m, "%d gtt bytes\n", atomic_read_unchecked(&dev->gtt_memory));
+ seq_printf(m, "%d gtt total\n", dev->gtt_total);
+ return 0;
+ }
+@@ -288,7 +292,11 @@ int drm_vma_info(struct seq_file *m, void *data)
+ mutex_lock(&dev->struct_mutex);
+ seq_printf(m, "vma use count: %d, high_memory = %p, 0x%08llx\n",
+ atomic_read(&dev->vma_count),
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ NULL, 0);
++#else
+ high_memory, (u64)virt_to_phys(high_memory));
++#endif
+
+ list_for_each_entry(pt, &dev->vmalist, head) {
+ vma = pt->vma;
+@@ -296,14 +304,23 @@ int drm_vma_info(struct seq_file *m, void *data)
+ continue;
+ seq_printf(m,
+ "\n%5d 0x%08lx-0x%08lx %c%c%c%c%c%c 0x%08lx000",
+- pt->pid, vma->vm_start, vma->vm_end,
++ pt->pid,
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ 0, 0,
++#else
++ vma->vm_start, vma->vm_end,
++#endif
+ vma->vm_flags & VM_READ ? 'r' : '-',
+ vma->vm_flags & VM_WRITE ? 'w' : '-',
+ vma->vm_flags & VM_EXEC ? 'x' : '-',
+ vma->vm_flags & VM_MAYSHARE ? 's' : 'p',
+ vma->vm_flags & VM_LOCKED ? 'l' : '-',
+ vma->vm_flags & VM_IO ? 'i' : '-',
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ 0);
++#else
+ vma->vm_pgoff);
++#endif
+
+ #if defined(__i386__)
+ pgprot = pgprot_val(vma->vm_page_prot);
+diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
+index 282d9fd..71e5f11 100644
+--- a/drivers/gpu/drm/drm_ioc32.c
++++ b/drivers/gpu/drm/drm_ioc32.c
+@@ -463,7 +463,7 @@ static int compat_drm_infobufs(struct file *file, unsigned int cmd,
+ request = compat_alloc_user_space(nbytes);
+ if (!access_ok(VERIFY_WRITE, request, nbytes))
+ return -EFAULT;
+- list = (struct drm_buf_desc *) (request + 1);
++ list = (struct drm_buf_desc __user *) (request + 1);
+
+ if (__put_user(count, &request->count)
+ || __put_user(list, &request->list))
+@@ -525,7 +525,7 @@ static int compat_drm_mapbufs(struct file *file, unsigned int cmd,
+ request = compat_alloc_user_space(nbytes);
+ if (!access_ok(VERIFY_WRITE, request, nbytes))
+ return -EFAULT;
+- list = (struct drm_buf_pub *) (request + 1);
++ list = (struct drm_buf_pub __user *) (request + 1);
+
+ if (__put_user(count, &request->count)
+ || __put_user(list, &request->list))
+diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c
+index 9b9ff46..4ea724c 100644
+--- a/drivers/gpu/drm/drm_ioctl.c
++++ b/drivers/gpu/drm/drm_ioctl.c
+@@ -283,7 +283,7 @@ int drm_getstats(struct drm_device *dev, void *data,
+ stats->data[i].value =
+ (file_priv->master->lock.hw_lock ? file_priv->master->lock.hw_lock->lock : 0);
+ else
+- stats->data[i].value = atomic_read(&dev->counts[i]);
++ stats->data[i].value = atomic_read_unchecked(&dev->counts[i]);
+ stats->data[i].type = dev->types[i];
+ }
+
+diff --git a/drivers/gpu/drm/drm_lock.c b/drivers/gpu/drm/drm_lock.c
+index e2f70a5..c703e86 100644
+--- a/drivers/gpu/drm/drm_lock.c
++++ b/drivers/gpu/drm/drm_lock.c
+@@ -87,7 +87,7 @@ int drm_lock(struct drm_device *dev, void *data, struct drm_file *file_priv)
+ if (drm_lock_take(&master->lock, lock->context)) {
+ master->lock.file_priv = file_priv;
+ master->lock.lock_time = jiffies;
+- atomic_inc(&dev->counts[_DRM_STAT_LOCKS]);
++ atomic_inc_unchecked(&dev->counts[_DRM_STAT_LOCKS]);
+ break; /* Got lock */
+ }
+
+@@ -165,7 +165,7 @@ int drm_unlock(struct drm_device *dev, void *data, struct drm_file *file_priv)
+ return -EINVAL;
+ }
+
+- atomic_inc(&dev->counts[_DRM_STAT_UNLOCKS]);
++ atomic_inc_unchecked(&dev->counts[_DRM_STAT_UNLOCKS]);
+
+ /* kernel_context_switch isn't used by any of the x86 drm
+ * modules but is required by the Sparc driver.
+diff --git a/drivers/gpu/drm/i810/i810_dma.c b/drivers/gpu/drm/i810/i810_dma.c
+index 7d1d88cd..b9131b2 100644
+--- a/drivers/gpu/drm/i810/i810_dma.c
++++ b/drivers/gpu/drm/i810/i810_dma.c
+@@ -952,8 +952,8 @@ static int i810_dma_vertex(struct drm_device *dev, void *data,
+ dma->buflist[vertex->idx],
+ vertex->discard, vertex->used);
+
+- atomic_add(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
+- atomic_inc(&dev->counts[_DRM_STAT_DMA]);
++ atomic_add_unchecked(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
++ atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
+ sarea_priv->last_enqueue = dev_priv->counter - 1;
+ sarea_priv->last_dispatch = (int)hw_status[5];
+
+@@ -1115,8 +1115,8 @@ static int i810_dma_mc(struct drm_device *dev, void *data,
+ i810_dma_dispatch_mc(dev, dma->buflist[mc->idx], mc->used,
+ mc->last_render);
+
+- atomic_add(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
+- atomic_inc(&dev->counts[_DRM_STAT_DMA]);
++ atomic_add_unchecked(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
++ atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
+ sarea_priv->last_enqueue = dev_priv->counter - 1;
+ sarea_priv->last_dispatch = (int)hw_status[5];
+
+diff --git a/drivers/gpu/drm/i810/i810_drv.h b/drivers/gpu/drm/i810/i810_drv.h
+index 21e2691..7321edd 100644
+--- a/drivers/gpu/drm/i810/i810_drv.h
++++ b/drivers/gpu/drm/i810/i810_drv.h
+@@ -108,8 +108,8 @@ typedef struct drm_i810_private {
+ int page_flipping;
+
+ wait_queue_head_t irq_queue;
+- atomic_t irq_received;
+- atomic_t irq_emitted;
++ atomic_unchecked_t irq_received;
++ atomic_unchecked_t irq_emitted;
+
+ int front_offset;
+ } drm_i810_private_t;
+diff --git a/drivers/gpu/drm/i830/i830_drv.h b/drivers/gpu/drm/i830/i830_drv.h
+index da82afe..48a45de 100644
+--- a/drivers/gpu/drm/i830/i830_drv.h
++++ b/drivers/gpu/drm/i830/i830_drv.h
+@@ -115,8 +115,8 @@ typedef struct drm_i830_private {
+ int page_flipping;
+
+ wait_queue_head_t irq_queue;
+- atomic_t irq_received;
+- atomic_t irq_emitted;
++ atomic_unchecked_t irq_received;
++ atomic_unchecked_t irq_emitted;
+
+ int use_mi_batchbuffer_start;
+
+diff --git a/drivers/gpu/drm/i830/i830_irq.c b/drivers/gpu/drm/i830/i830_irq.c
+index 91ec2bb..6f21fab 100644
+--- a/drivers/gpu/drm/i830/i830_irq.c
++++ b/drivers/gpu/drm/i830/i830_irq.c
+@@ -47,7 +47,7 @@ irqreturn_t i830_driver_irq_handler(DRM_IRQ_ARGS)
+
+ I830_WRITE16(I830REG_INT_IDENTITY_R, temp);
+
+- atomic_inc(&dev_priv->irq_received);
++ atomic_inc_unchecked(&dev_priv->irq_received);
+ wake_up_interruptible(&dev_priv->irq_queue);
+
+ return IRQ_HANDLED;
+@@ -60,14 +60,14 @@ static int i830_emit_irq(struct drm_device * dev)
+
+ DRM_DEBUG("%s\n", __func__);
+
+- atomic_inc(&dev_priv->irq_emitted);
++ atomic_inc_unchecked(&dev_priv->irq_emitted);
+
+ BEGIN_LP_RING(2);
+ OUT_RING(0);
+ OUT_RING(GFX_OP_USER_INTERRUPT);
+ ADVANCE_LP_RING();
+
+- return atomic_read(&dev_priv->irq_emitted);
++ return atomic_read_unchecked(&dev_priv->irq_emitted);
+ }
+
+ static int i830_wait_irq(struct drm_device * dev, int irq_nr)
+@@ -79,7 +79,7 @@ static int i830_wait_irq(struct drm_device * dev, int irq_nr)
+
+ DRM_DEBUG("%s\n", __func__);
+
+- if (atomic_read(&dev_priv->irq_received) >= irq_nr)
++ if (atomic_read_unchecked(&dev_priv->irq_received) >= irq_nr)
+ return 0;
+
+ dev_priv->sarea_priv->perf_boxes |= I830_BOX_WAIT;
+@@ -88,7 +88,7 @@ static int i830_wait_irq(struct drm_device * dev, int irq_nr)
+
+ for (;;) {
+ __set_current_state(TASK_INTERRUPTIBLE);
+- if (atomic_read(&dev_priv->irq_received) >= irq_nr)
++ if (atomic_read_unchecked(&dev_priv->irq_received) >= irq_nr)
+ break;
+ if ((signed)(end - jiffies) <= 0) {
+ DRM_ERROR("timeout iir %x imr %x ier %x hwstam %x\n",
+@@ -163,8 +163,8 @@ void i830_driver_irq_preinstall(struct drm_device * dev)
+ I830_WRITE16(I830REG_HWSTAM, 0xffff);
+ I830_WRITE16(I830REG_INT_MASK_R, 0x0);
+ I830_WRITE16(I830REG_INT_ENABLE_R, 0x0);
+- atomic_set(&dev_priv->irq_received, 0);
+- atomic_set(&dev_priv->irq_emitted, 0);
++ atomic_set_unchecked(&dev_priv->irq_received, 0);
++ atomic_set_unchecked(&dev_priv->irq_emitted, 0);
+ init_waitqueue_head(&dev_priv->irq_queue);
+ }
+
+diff --git a/drivers/gpu/drm/i915/dvo.h b/drivers/gpu/drm/i915/dvo.h
+index 288fc50..c6092055 100644
+--- a/drivers/gpu/drm/i915/dvo.h
++++ b/drivers/gpu/drm/i915/dvo.h
+@@ -135,23 +135,23 @@ struct intel_dvo_dev_ops {
+ *
+ * \return singly-linked list of modes or NULL if no modes found.
+ */
+- struct drm_display_mode *(*get_modes)(struct intel_dvo_device *dvo);
++ struct drm_display_mode *(* const get_modes)(struct intel_dvo_device *dvo);
+
+ /**
+ * Clean up driver-specific bits of the output
+ */
+- void (*destroy) (struct intel_dvo_device *dvo);
++ void (* const destroy) (struct intel_dvo_device *dvo);
+
+ /**
+ * Debugging hook to dump device registers to log file
+ */
+- void (*dump_regs)(struct intel_dvo_device *dvo);
++ void (* const dump_regs)(struct intel_dvo_device *dvo);
+ };
+
+-extern struct intel_dvo_dev_ops sil164_ops;
+-extern struct intel_dvo_dev_ops ch7xxx_ops;
+-extern struct intel_dvo_dev_ops ivch_ops;
+-extern struct intel_dvo_dev_ops tfp410_ops;
+-extern struct intel_dvo_dev_ops ch7017_ops;
++extern const struct intel_dvo_dev_ops sil164_ops;
++extern const struct intel_dvo_dev_ops ch7xxx_ops;
++extern const struct intel_dvo_dev_ops ivch_ops;
++extern const struct intel_dvo_dev_ops tfp410_ops;
++extern const struct intel_dvo_dev_ops ch7017_ops;
+
+ #endif /* _INTEL_DVO_H */
+diff --git a/drivers/gpu/drm/i915/dvo_ch7017.c b/drivers/gpu/drm/i915/dvo_ch7017.c
+index 621815b..499d82e 100644
+--- a/drivers/gpu/drm/i915/dvo_ch7017.c
++++ b/drivers/gpu/drm/i915/dvo_ch7017.c
+@@ -443,7 +443,7 @@ static void ch7017_destroy(struct intel_dvo_device *dvo)
+ }
+ }
+
+-struct intel_dvo_dev_ops ch7017_ops = {
++const struct intel_dvo_dev_ops ch7017_ops = {
+ .init = ch7017_init,
+ .detect = ch7017_detect,
+ .mode_valid = ch7017_mode_valid,
+diff --git a/drivers/gpu/drm/i915/dvo_ch7xxx.c b/drivers/gpu/drm/i915/dvo_ch7xxx.c
+index a9b8962..ac769ba 100644
+--- a/drivers/gpu/drm/i915/dvo_ch7xxx.c
++++ b/drivers/gpu/drm/i915/dvo_ch7xxx.c
+@@ -356,7 +356,7 @@ static void ch7xxx_destroy(struct intel_dvo_device *dvo)
+ }
+ }
+
+-struct intel_dvo_dev_ops ch7xxx_ops = {
++const struct intel_dvo_dev_ops ch7xxx_ops = {
+ .init = ch7xxx_init,
+ .detect = ch7xxx_detect,
+ .mode_valid = ch7xxx_mode_valid,
+diff --git a/drivers/gpu/drm/i915/dvo_ivch.c b/drivers/gpu/drm/i915/dvo_ivch.c
+index aa176f9..ed2930c 100644
+--- a/drivers/gpu/drm/i915/dvo_ivch.c
++++ b/drivers/gpu/drm/i915/dvo_ivch.c
+@@ -430,7 +430,7 @@ static void ivch_destroy(struct intel_dvo_device *dvo)
+ }
+ }
+
+-struct intel_dvo_dev_ops ivch_ops= {
++const struct intel_dvo_dev_ops ivch_ops= {
+ .init = ivch_init,
+ .dpms = ivch_dpms,
+ .save = ivch_save,
+diff --git a/drivers/gpu/drm/i915/dvo_sil164.c b/drivers/gpu/drm/i915/dvo_sil164.c
+index e1c1f73..7dbebcf 100644
+--- a/drivers/gpu/drm/i915/dvo_sil164.c
++++ b/drivers/gpu/drm/i915/dvo_sil164.c
+@@ -290,7 +290,7 @@ static void sil164_destroy(struct intel_dvo_device *dvo)
+ }
+ }
+
+-struct intel_dvo_dev_ops sil164_ops = {
++const struct intel_dvo_dev_ops sil164_ops = {
+ .init = sil164_init,
+ .detect = sil164_detect,
+ .mode_valid = sil164_mode_valid,
+diff --git a/drivers/gpu/drm/i915/dvo_tfp410.c b/drivers/gpu/drm/i915/dvo_tfp410.c
+index 16dce84..7e1b6f8 100644
+--- a/drivers/gpu/drm/i915/dvo_tfp410.c
++++ b/drivers/gpu/drm/i915/dvo_tfp410.c
+@@ -323,7 +323,7 @@ static void tfp410_destroy(struct intel_dvo_device *dvo)
+ }
+ }
+
+-struct intel_dvo_dev_ops tfp410_ops = {
++const struct intel_dvo_dev_ops tfp410_ops = {
+ .init = tfp410_init,
+ .detect = tfp410_detect,
+ .mode_valid = tfp410_mode_valid,
+diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
+index 7e859d6..7d1cf2b 100644
+--- a/drivers/gpu/drm/i915/i915_debugfs.c
++++ b/drivers/gpu/drm/i915/i915_debugfs.c
+@@ -192,7 +192,7 @@ static int i915_interrupt_info(struct seq_file *m, void *data)
+ I915_READ(GTIMR));
+ }
+ seq_printf(m, "Interrupts received: %d\n",
+- atomic_read(&dev_priv->irq_received));
++ atomic_read_unchecked(&dev_priv->irq_received));
+ if (dev_priv->hw_status_page != NULL) {
+ seq_printf(m, "Current sequence: %d\n",
+ i915_get_gem_seqno(dev));
+diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
+index 5449239..7e4f68d 100644
+--- a/drivers/gpu/drm/i915/i915_drv.c
++++ b/drivers/gpu/drm/i915/i915_drv.c
+@@ -285,7 +285,7 @@ i915_pci_resume(struct pci_dev *pdev)
+ return i915_resume(dev);
+ }
+
+-static struct vm_operations_struct i915_gem_vm_ops = {
++static const struct vm_operations_struct i915_gem_vm_ops = {
+ .fault = i915_gem_fault,
+ .open = drm_gem_vm_open,
+ .close = drm_gem_vm_close,
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index 97163f7..c24c7c7 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -168,7 +168,7 @@ struct drm_i915_display_funcs {
+ /* display clock increase/decrease */
+ /* pll clock increase/decrease */
+ /* clock gating init */
+-};
++} __no_const;
+
+ typedef struct drm_i915_private {
+ struct drm_device *dev;
+@@ -197,7 +197,7 @@ typedef struct drm_i915_private {
+ int page_flipping;
+
+ wait_queue_head_t irq_queue;
+- atomic_t irq_received;
++ atomic_unchecked_t irq_received;
+ /** Protects user_irq_refcount and irq_mask_reg */
+ spinlock_t user_irq_lock;
+ /** Refcount for i915_user_irq_get() versus i915_user_irq_put(). */
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index 27a3074..eb3f959 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -102,7 +102,7 @@ i915_gem_get_aperture_ioctl(struct drm_device *dev, void *data,
+
+ args->aper_size = dev->gtt_total;
+ args->aper_available_size = (args->aper_size -
+- atomic_read(&dev->pin_memory));
++ atomic_read_unchecked(&dev->pin_memory));
+
+ return 0;
+ }
+@@ -2058,7 +2058,7 @@ i915_gem_object_unbind(struct drm_gem_object *obj)
+
+ if (obj_priv->gtt_space) {
+ atomic_dec(&dev->gtt_count);
+- atomic_sub(obj->size, &dev->gtt_memory);
++ atomic_sub_unchecked(obj->size, &dev->gtt_memory);
+
+ drm_mm_put_block(obj_priv->gtt_space);
+ obj_priv->gtt_space = NULL;
+@@ -2701,7 +2701,7 @@ i915_gem_object_bind_to_gtt(struct drm_gem_object *obj, unsigned alignment)
+ goto search_free;
+ }
+ atomic_inc(&dev->gtt_count);
+- atomic_add(obj->size, &dev->gtt_memory);
++ atomic_add_unchecked(obj->size, &dev->gtt_memory);
+
+ /* Assert that the object is not currently in any GPU domain. As it
+ * wasn't in the GTT, there shouldn't be any way it could have been in
+@@ -3755,9 +3755,9 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
+ "%d/%d gtt bytes\n",
+ atomic_read(&dev->object_count),
+ atomic_read(&dev->pin_count),
+- atomic_read(&dev->object_memory),
+- atomic_read(&dev->pin_memory),
+- atomic_read(&dev->gtt_memory),
++ atomic_read_unchecked(&dev->object_memory),
++ atomic_read_unchecked(&dev->pin_memory),
++ atomic_read_unchecked(&dev->gtt_memory),
+ dev->gtt_total);
+ }
+ goto err;
+@@ -3989,7 +3989,7 @@ i915_gem_object_pin(struct drm_gem_object *obj, uint32_t alignment)
+ */
+ if (obj_priv->pin_count == 1) {
+ atomic_inc(&dev->pin_count);
+- atomic_add(obj->size, &dev->pin_memory);
++ atomic_add_unchecked(obj->size, &dev->pin_memory);
+ if (!obj_priv->active &&
+ (obj->write_domain & I915_GEM_GPU_DOMAINS) == 0 &&
+ !list_empty(&obj_priv->list))
+@@ -4022,7 +4022,7 @@ i915_gem_object_unpin(struct drm_gem_object *obj)
+ list_move_tail(&obj_priv->list,
+ &dev_priv->mm.inactive_list);
+ atomic_dec(&dev->pin_count);
+- atomic_sub(obj->size, &dev->pin_memory);
++ atomic_sub_unchecked(obj->size, &dev->pin_memory);
+ }
+ i915_verify_inactive(dev, __FILE__, __LINE__);
+ }
+diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
+index 63f28ad..f5469da 100644
+--- a/drivers/gpu/drm/i915/i915_irq.c
++++ b/drivers/gpu/drm/i915/i915_irq.c
+@@ -528,7 +528,7 @@ irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
+ int irq_received;
+ int ret = IRQ_NONE;
+
+- atomic_inc(&dev_priv->irq_received);
++ atomic_inc_unchecked(&dev_priv->irq_received);
+
+ if (IS_IGDNG(dev))
+ return igdng_irq_handler(dev);
+@@ -1021,7 +1021,7 @@ void i915_driver_irq_preinstall(struct drm_device * dev)
+ {
+ drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+
+- atomic_set(&dev_priv->irq_received, 0);
++ atomic_set_unchecked(&dev_priv->irq_received, 0);
+
+ INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
+ INIT_WORK(&dev_priv->error_work, i915_error_work_func);
+diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
+index 5d9c6a7..d1b0e29 100644
+--- a/drivers/gpu/drm/i915/intel_sdvo.c
++++ b/drivers/gpu/drm/i915/intel_sdvo.c
+@@ -2795,7 +2795,9 @@ bool intel_sdvo_init(struct drm_device *dev, int output_device)
+ sdvo_priv->slave_addr = intel_sdvo_get_slave_addr(dev, output_device);
+
+ /* Save the bit-banging i2c functionality for use by the DDC wrapper */
+- intel_sdvo_i2c_bit_algo.functionality = intel_output->i2c_bus->algo->functionality;
++ pax_open_kernel();
++ *(void **)&intel_sdvo_i2c_bit_algo.functionality = intel_output->i2c_bus->algo->functionality;
++ pax_close_kernel();
+
+ /* Read the regs to test if we can talk to the device */
+ for (i = 0; i < 0x40; i++) {
+diff --git a/drivers/gpu/drm/mga/mga_drv.h b/drivers/gpu/drm/mga/mga_drv.h
+index be6c6b9..8615d9c 100644
+--- a/drivers/gpu/drm/mga/mga_drv.h
++++ b/drivers/gpu/drm/mga/mga_drv.h
+@@ -120,9 +120,9 @@ typedef struct drm_mga_private {
+ u32 clear_cmd;
+ u32 maccess;
+
+- atomic_t vbl_received; /**< Number of vblanks received. */
++ atomic_unchecked_t vbl_received; /**< Number of vblanks received. */
+ wait_queue_head_t fence_queue;
+- atomic_t last_fence_retired;
++ atomic_unchecked_t last_fence_retired;
+ u32 next_fence_to_post;
+
+ unsigned int fb_cpp;
+diff --git a/drivers/gpu/drm/mga/mga_irq.c b/drivers/gpu/drm/mga/mga_irq.c
+index daa6041..a28a5da 100644
+--- a/drivers/gpu/drm/mga/mga_irq.c
++++ b/drivers/gpu/drm/mga/mga_irq.c
+@@ -44,7 +44,7 @@ u32 mga_get_vblank_counter(struct drm_device *dev, int crtc)
+ if (crtc != 0)
+ return 0;
+
+- return atomic_read(&dev_priv->vbl_received);
++ return atomic_read_unchecked(&dev_priv->vbl_received);
+ }
+
+
+@@ -60,7 +60,7 @@ irqreturn_t mga_driver_irq_handler(DRM_IRQ_ARGS)
+ /* VBLANK interrupt */
+ if (status & MGA_VLINEPEN) {
+ MGA_WRITE(MGA_ICLEAR, MGA_VLINEICLR);
+- atomic_inc(&dev_priv->vbl_received);
++ atomic_inc_unchecked(&dev_priv->vbl_received);
+ drm_handle_vblank(dev, 0);
+ handled = 1;
+ }
+@@ -80,7 +80,7 @@ irqreturn_t mga_driver_irq_handler(DRM_IRQ_ARGS)
+ MGA_WRITE(MGA_PRIMEND, prim_end);
+ }
+
+- atomic_inc(&dev_priv->last_fence_retired);
++ atomic_inc_unchecked(&dev_priv->last_fence_retired);
+ DRM_WAKEUP(&dev_priv->fence_queue);
+ handled = 1;
+ }
+@@ -131,7 +131,7 @@ int mga_driver_fence_wait(struct drm_device * dev, unsigned int *sequence)
+ * using fences.
+ */
+ DRM_WAIT_ON(ret, dev_priv->fence_queue, 3 * DRM_HZ,
+- (((cur_fence = atomic_read(&dev_priv->last_fence_retired))
++ (((cur_fence = atomic_read_unchecked(&dev_priv->last_fence_retired))
+ - *sequence) <= (1 << 23)));
+
+ *sequence = cur_fence;
+diff --git a/drivers/gpu/drm/r128/r128_cce.c b/drivers/gpu/drm/r128/r128_cce.c
+index 4c39a40..b22a9ea 100644
+--- a/drivers/gpu/drm/r128/r128_cce.c
++++ b/drivers/gpu/drm/r128/r128_cce.c
+@@ -377,7 +377,7 @@ static int r128_do_init_cce(struct drm_device * dev, drm_r128_init_t * init)
+
+ /* GH: Simple idle check.
+ */
+- atomic_set(&dev_priv->idle_count, 0);
++ atomic_set_unchecked(&dev_priv->idle_count, 0);
+
+ /* We don't support anything other than bus-mastering ring mode,
+ * but the ring can be in either AGP or PCI space for the ring
+diff --git a/drivers/gpu/drm/r128/r128_drv.h b/drivers/gpu/drm/r128/r128_drv.h
+index 3c60829..4faf484 100644
+--- a/drivers/gpu/drm/r128/r128_drv.h
++++ b/drivers/gpu/drm/r128/r128_drv.h
+@@ -90,14 +90,14 @@ typedef struct drm_r128_private {
+ int is_pci;
+ unsigned long cce_buffers_offset;
+
+- atomic_t idle_count;
++ atomic_unchecked_t idle_count;
+
+ int page_flipping;
+ int current_page;
+ u32 crtc_offset;
+ u32 crtc_offset_cntl;
+
+- atomic_t vbl_received;
++ atomic_unchecked_t vbl_received;
+
+ u32 color_fmt;
+ unsigned int front_offset;
+diff --git a/drivers/gpu/drm/r128/r128_irq.c b/drivers/gpu/drm/r128/r128_irq.c
+index 69810fb..97bf17a 100644
+--- a/drivers/gpu/drm/r128/r128_irq.c
++++ b/drivers/gpu/drm/r128/r128_irq.c
+@@ -42,7 +42,7 @@ u32 r128_get_vblank_counter(struct drm_device *dev, int crtc)
+ if (crtc != 0)
+ return 0;
+
+- return atomic_read(&dev_priv->vbl_received);
++ return atomic_read_unchecked(&dev_priv->vbl_received);
+ }
+
+ irqreturn_t r128_driver_irq_handler(DRM_IRQ_ARGS)
+@@ -56,7 +56,7 @@ irqreturn_t r128_driver_irq_handler(DRM_IRQ_ARGS)
+ /* VBLANK interrupt */
+ if (status & R128_CRTC_VBLANK_INT) {
+ R128_WRITE(R128_GEN_INT_STATUS, R128_CRTC_VBLANK_INT_AK);
+- atomic_inc(&dev_priv->vbl_received);
++ atomic_inc_unchecked(&dev_priv->vbl_received);
+ drm_handle_vblank(dev, 0);
+ return IRQ_HANDLED;
+ }
+diff --git a/drivers/gpu/drm/r128/r128_state.c b/drivers/gpu/drm/r128/r128_state.c
+index af2665c..51922d2 100644
+--- a/drivers/gpu/drm/r128/r128_state.c
++++ b/drivers/gpu/drm/r128/r128_state.c
+@@ -323,10 +323,10 @@ static void r128_clear_box(drm_r128_private_t * dev_priv,
+
+ static void r128_cce_performance_boxes(drm_r128_private_t * dev_priv)
+ {
+- if (atomic_read(&dev_priv->idle_count) == 0) {
++ if (atomic_read_unchecked(&dev_priv->idle_count) == 0) {
+ r128_clear_box(dev_priv, 64, 4, 8, 8, 0, 255, 0);
+ } else {
+- atomic_set(&dev_priv->idle_count, 0);
++ atomic_set_unchecked(&dev_priv->idle_count, 0);
+ }
+ }
+
+diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
+index dd72b91..8644b3c 100644
+--- a/drivers/gpu/drm/radeon/atom.c
++++ b/drivers/gpu/drm/radeon/atom.c
+@@ -1115,6 +1115,8 @@ struct atom_context *atom_parse(struct card_info *card, void *bios)
+ char name[512];
+ int i;
+
++ pax_track_stack();
++
+ ctx->card = card;
+ ctx->bios = bios;
+
+diff --git a/drivers/gpu/drm/radeon/mkregtable.c b/drivers/gpu/drm/radeon/mkregtable.c
+index 0d79577..efaa7a5 100644
+--- a/drivers/gpu/drm/radeon/mkregtable.c
++++ b/drivers/gpu/drm/radeon/mkregtable.c
+@@ -637,14 +637,14 @@ static int parser_auth(struct table *t, const char *filename)
+ regex_t mask_rex;
+ regmatch_t match[4];
+ char buf[1024];
+- size_t end;
++ long end;
+ int len;
+ int done = 0;
+ int r;
+ unsigned o;
+ struct offset *offset;
+ char last_reg_s[10];
+- int last_reg;
++ unsigned long last_reg;
+
+ if (regcomp
+ (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
+diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
+index 6735213..38c2c67 100644
+--- a/drivers/gpu/drm/radeon/radeon.h
++++ b/drivers/gpu/drm/radeon/radeon.h
+@@ -149,7 +149,7 @@ int radeon_pm_init(struct radeon_device *rdev);
+ */
+ struct radeon_fence_driver {
+ uint32_t scratch_reg;
+- atomic_t seq;
++ atomic_unchecked_t seq;
+ uint32_t last_seq;
+ unsigned long count_timeout;
+ wait_queue_head_t queue;
+@@ -640,7 +640,7 @@ struct radeon_asic {
+ uint32_t offset, uint32_t obj_size);
+ int (*clear_surface_reg)(struct radeon_device *rdev, int reg);
+ void (*bandwidth_update)(struct radeon_device *rdev);
+-};
++} __no_const;
+
+ /*
+ * Asic structures
+diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
+index 4e928b9..d8b6008 100644
+--- a/drivers/gpu/drm/radeon/radeon_atombios.c
++++ b/drivers/gpu/drm/radeon/radeon_atombios.c
+@@ -275,6 +275,8 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev)
+ bool linkb;
+ struct radeon_i2c_bus_rec ddc_bus;
+
++ pax_track_stack();
++
+ atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset);
+
+ if (data_offset == 0)
+@@ -520,13 +522,13 @@ static uint16_t atombios_get_connector_object_id(struct drm_device *dev,
+ }
+ }
+
+-struct bios_connector {
++static struct bios_connector {
+ bool valid;
+ uint16_t line_mux;
+ uint16_t devices;
+ int connector_type;
+ struct radeon_i2c_bus_rec ddc_bus;
+-};
++} bios_connectors[ATOM_MAX_SUPPORTED_DEVICE];
+
+ bool radeon_get_atom_connector_info_from_supported_devices_table(struct
+ drm_device
+@@ -542,7 +544,6 @@ bool radeon_get_atom_connector_info_from_supported_devices_table(struct
+ uint8_t dac;
+ union atom_supported_devices *supported_devices;
+ int i, j;
+- struct bios_connector bios_connectors[ATOM_MAX_SUPPORTED_DEVICE];
+
+ atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset);
+
+diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
+index 083a181..ccccae0 100644
+--- a/drivers/gpu/drm/radeon/radeon_display.c
++++ b/drivers/gpu/drm/radeon/radeon_display.c
+@@ -482,7 +482,7 @@ void radeon_compute_pll(struct radeon_pll *pll,
+
+ if (flags & RADEON_PLL_PREFER_CLOSEST_LOWER) {
+ error = freq - current_freq;
+- error = error < 0 ? 0xffffffff : error;
++ error = (int32_t)error < 0 ? 0xffffffff : error;
+ } else
+ error = abs(current_freq - freq);
+ vco_diff = abs(vco - best_vco);
+diff --git a/drivers/gpu/drm/radeon/radeon_drv.h b/drivers/gpu/drm/radeon/radeon_drv.h
+index 76e4070..193fa7f 100644
+--- a/drivers/gpu/drm/radeon/radeon_drv.h
++++ b/drivers/gpu/drm/radeon/radeon_drv.h
+@@ -253,7 +253,7 @@ typedef struct drm_radeon_private {
+
+ /* SW interrupt */
+ wait_queue_head_t swi_queue;
+- atomic_t swi_emitted;
++ atomic_unchecked_t swi_emitted;
+ int vblank_crtc;
+ uint32_t irq_enable_reg;
+ uint32_t r500_disp_irq_reg;
+diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
+index 3beb26d..6ce9c4a 100644
+--- a/drivers/gpu/drm/radeon/radeon_fence.c
++++ b/drivers/gpu/drm/radeon/radeon_fence.c
+@@ -47,7 +47,7 @@ int radeon_fence_emit(struct radeon_device *rdev, struct radeon_fence *fence)
+ write_unlock_irqrestore(&rdev->fence_drv.lock, irq_flags);
+ return 0;
+ }
+- fence->seq = atomic_add_return(1, &rdev->fence_drv.seq);
++ fence->seq = atomic_add_return_unchecked(1, &rdev->fence_drv.seq);
+ if (!rdev->cp.ready) {
+ /* FIXME: cp is not running assume everythings is done right
+ * away
+@@ -364,7 +364,7 @@ int radeon_fence_driver_init(struct radeon_device *rdev)
+ return r;
+ }
+ WREG32(rdev->fence_drv.scratch_reg, 0);
+- atomic_set(&rdev->fence_drv.seq, 0);
++ atomic_set_unchecked(&rdev->fence_drv.seq, 0);
+ INIT_LIST_HEAD(&rdev->fence_drv.created);
+ INIT_LIST_HEAD(&rdev->fence_drv.emited);
+ INIT_LIST_HEAD(&rdev->fence_drv.signaled);
+diff --git a/drivers/gpu/drm/radeon/radeon_ioc32.c b/drivers/gpu/drm/radeon/radeon_ioc32.c
+index a1bf11d..4a123c0 100644
+--- a/drivers/gpu/drm/radeon/radeon_ioc32.c
++++ b/drivers/gpu/drm/radeon/radeon_ioc32.c
+@@ -368,7 +368,7 @@ static int compat_radeon_cp_setparam(struct file *file, unsigned int cmd,
+ request = compat_alloc_user_space(sizeof(*request));
+ if (!access_ok(VERIFY_WRITE, request, sizeof(*request))
+ || __put_user(req32.param, &request->param)
+- || __put_user((void __user *)(unsigned long)req32.value,
++ || __put_user((unsigned long)req32.value,
+ &request->value))
+ return -EFAULT;
+
+diff --git a/drivers/gpu/drm/radeon/radeon_irq.c b/drivers/gpu/drm/radeon/radeon_irq.c
+index b79ecc4..8dab92d 100644
+--- a/drivers/gpu/drm/radeon/radeon_irq.c
++++ b/drivers/gpu/drm/radeon/radeon_irq.c
+@@ -225,8 +225,8 @@ static int radeon_emit_irq(struct drm_device * dev)
+ unsigned int ret;
+ RING_LOCALS;
+
+- atomic_inc(&dev_priv->swi_emitted);
+- ret = atomic_read(&dev_priv->swi_emitted);
++ atomic_inc_unchecked(&dev_priv->swi_emitted);
++ ret = atomic_read_unchecked(&dev_priv->swi_emitted);
+
+ BEGIN_RING(4);
+ OUT_RING_REG(RADEON_LAST_SWI_REG, ret);
+@@ -352,7 +352,7 @@ int radeon_driver_irq_postinstall(struct drm_device *dev)
+ drm_radeon_private_t *dev_priv =
+ (drm_radeon_private_t *) dev->dev_private;
+
+- atomic_set(&dev_priv->swi_emitted, 0);
++ atomic_set_unchecked(&dev_priv->swi_emitted, 0);
+ DRM_INIT_WAITQUEUE(&dev_priv->swi_queue);
+
+ dev->max_vblank_count = 0x001fffff;
+diff --git a/drivers/gpu/drm/radeon/radeon_state.c b/drivers/gpu/drm/radeon/radeon_state.c
+index 4747910..48ca4b3 100644
+--- a/drivers/gpu/drm/radeon/radeon_state.c
++++ b/drivers/gpu/drm/radeon/radeon_state.c
+@@ -3021,7 +3021,7 @@ static int radeon_cp_getparam(struct drm_device *dev, void *data, struct drm_fil
+ {
+ drm_radeon_private_t *dev_priv = dev->dev_private;
+ drm_radeon_getparam_t *param = data;
+- int value;
++ int value = 0;
+
+ DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
+
+diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
+index 1381e06..0e53b17 100644
+--- a/drivers/gpu/drm/radeon/radeon_ttm.c
++++ b/drivers/gpu/drm/radeon/radeon_ttm.c
+@@ -535,27 +535,10 @@ void radeon_ttm_fini(struct radeon_device *rdev)
+ DRM_INFO("radeon: ttm finalized\n");
+ }
+
+-static struct vm_operations_struct radeon_ttm_vm_ops;
+-static const struct vm_operations_struct *ttm_vm_ops = NULL;
+-
+-static int radeon_ttm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+-{
+- struct ttm_buffer_object *bo;
+- int r;
+-
+- bo = (struct ttm_buffer_object *)vma->vm_private_data;
+- if (bo == NULL) {
+- return VM_FAULT_NOPAGE;
+- }
+- r = ttm_vm_ops->fault(vma, vmf);
+- return r;
+-}
+-
+ int radeon_mmap(struct file *filp, struct vm_area_struct *vma)
+ {
+ struct drm_file *file_priv;
+ struct radeon_device *rdev;
+- int r;
+
+ if (unlikely(vma->vm_pgoff < DRM_FILE_PAGE_OFFSET)) {
+ return drm_mmap(filp, vma);
+@@ -563,20 +546,9 @@ int radeon_mmap(struct file *filp, struct vm_area_struct *vma)
+
+ file_priv = (struct drm_file *)filp->private_data;
+ rdev = file_priv->minor->dev->dev_private;
+- if (rdev == NULL) {
++ if (!rdev)
+ return -EINVAL;
+- }
+- r = ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
+- if (unlikely(r != 0)) {
+- return r;
+- }
+- if (unlikely(ttm_vm_ops == NULL)) {
+- ttm_vm_ops = vma->vm_ops;
+- radeon_ttm_vm_ops = *ttm_vm_ops;
+- radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
+- }
+- vma->vm_ops = &radeon_ttm_vm_ops;
+- return 0;
++ return ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
+ }
+
+
+diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
+index b12ff76..0bd0c6e 100644
+--- a/drivers/gpu/drm/radeon/rs690.c
++++ b/drivers/gpu/drm/radeon/rs690.c
+@@ -302,9 +302,11 @@ void rs690_crtc_bandwidth_compute(struct radeon_device *rdev,
+ if (rdev->pm.max_bandwidth.full > rdev->pm.sideport_bandwidth.full &&
+ rdev->pm.sideport_bandwidth.full)
+ rdev->pm.max_bandwidth = rdev->pm.sideport_bandwidth;
+- read_delay_latency.full = rfixed_const(370 * 800 * 1000);
++ read_delay_latency.full = rfixed_const(800 * 1000);
+ read_delay_latency.full = rfixed_div(read_delay_latency,
+ rdev->pm.igp_sideport_mclk);
++ a.full = rfixed_const(370);
++ read_delay_latency.full = rfixed_mul(read_delay_latency, a);
+ } else {
+ if (rdev->pm.max_bandwidth.full > rdev->pm.k8_bandwidth.full &&
+ rdev->pm.k8_bandwidth.full)
+diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
+index 0ed436e..e6e7ce3 100644
+--- a/drivers/gpu/drm/ttm/ttm_bo.c
++++ b/drivers/gpu/drm/ttm/ttm_bo.c
+@@ -67,7 +67,7 @@ static struct attribute *ttm_bo_global_attrs[] = {
+ NULL
+ };
+
+-static struct sysfs_ops ttm_bo_global_ops = {
++static const struct sysfs_ops ttm_bo_global_ops = {
+ .show = &ttm_bo_global_show
+ };
+
+diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
+index 1c040d0..f9e4af8 100644
+--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
++++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
+@@ -73,7 +73,7 @@ static int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+ {
+ struct ttm_buffer_object *bo = (struct ttm_buffer_object *)
+ vma->vm_private_data;
+- struct ttm_bo_device *bdev = bo->bdev;
++ struct ttm_bo_device *bdev;
+ unsigned long bus_base;
+ unsigned long bus_offset;
+ unsigned long bus_size;
+@@ -88,6 +88,10 @@ static int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+ unsigned long address = (unsigned long)vmf->virtual_address;
+ int retval = VM_FAULT_NOPAGE;
+
++ if (!bo)
++ return VM_FAULT_NOPAGE;
++ bdev = bo->bdev;
++
+ /*
+ * Work around locking order reversal in fault / nopfn
+ * between mmap_sem and bo_reserve: Perform a trylock operation
+diff --git a/drivers/gpu/drm/ttm/ttm_global.c b/drivers/gpu/drm/ttm/ttm_global.c
+index b170071..28ae90e 100644
+--- a/drivers/gpu/drm/ttm/ttm_global.c
++++ b/drivers/gpu/drm/ttm/ttm_global.c
+@@ -36,7 +36,7 @@
+ struct ttm_global_item {
+ struct mutex mutex;
+ void *object;
+- int refcount;
++ atomic_t refcount;
+ };
+
+ static struct ttm_global_item glob[TTM_GLOBAL_NUM];
+@@ -49,7 +49,7 @@ void ttm_global_init(void)
+ struct ttm_global_item *item = &glob[i];
+ mutex_init(&item->mutex);
+ item->object = NULL;
+- item->refcount = 0;
++ atomic_set(&item->refcount, 0);
+ }
+ }
+
+@@ -59,7 +59,7 @@ void ttm_global_release(void)
+ for (i = 0; i < TTM_GLOBAL_NUM; ++i) {
+ struct ttm_global_item *item = &glob[i];
+ BUG_ON(item->object != NULL);
+- BUG_ON(item->refcount != 0);
++ BUG_ON(atomic_read(&item->refcount) != 0);
+ }
+ }
+
+@@ -70,7 +70,7 @@ int ttm_global_item_ref(struct ttm_global_reference *ref)
+ void *object;
+
+ mutex_lock(&item->mutex);
+- if (item->refcount == 0) {
++ if (atomic_read(&item->refcount) == 0) {
+ item->object = kzalloc(ref->size, GFP_KERNEL);
+ if (unlikely(item->object == NULL)) {
+ ret = -ENOMEM;
+@@ -83,7 +83,7 @@ int ttm_global_item_ref(struct ttm_global_reference *ref)
+ goto out_err;
+
+ }
+- ++item->refcount;
++ atomic_inc(&item->refcount);
+ ref->object = item->object;
+ object = item->object;
+ mutex_unlock(&item->mutex);
+@@ -100,9 +100,9 @@ void ttm_global_item_unref(struct ttm_global_reference *ref)
+ struct ttm_global_item *item = &glob[ref->global_type];
+
+ mutex_lock(&item->mutex);
+- BUG_ON(item->refcount == 0);
++ BUG_ON(atomic_read(&item->refcount) == 0);
+ BUG_ON(ref->object != item->object);
+- if (--item->refcount == 0) {
++ if (atomic_dec_and_test(&item->refcount)) {
+ ref->release(ref);
+ item->object = NULL;
+ }
+diff --git a/drivers/gpu/drm/ttm/ttm_memory.c b/drivers/gpu/drm/ttm/ttm_memory.c
+index 072c281..d8ef483 100644
+--- a/drivers/gpu/drm/ttm/ttm_memory.c
++++ b/drivers/gpu/drm/ttm/ttm_memory.c
+@@ -152,7 +152,7 @@ static struct attribute *ttm_mem_zone_attrs[] = {
+ NULL
+ };
+
+-static struct sysfs_ops ttm_mem_zone_ops = {
++static const struct sysfs_ops ttm_mem_zone_ops = {
+ .show = &ttm_mem_zone_show,
+ .store = &ttm_mem_zone_store
+ };
+diff --git a/drivers/gpu/drm/via/via_drv.h b/drivers/gpu/drm/via/via_drv.h
+index cafcb84..b8e66cc 100644
+--- a/drivers/gpu/drm/via/via_drv.h
++++ b/drivers/gpu/drm/via/via_drv.h
+@@ -51,7 +51,7 @@ typedef struct drm_via_ring_buffer {
+ typedef uint32_t maskarray_t[5];
+
+ typedef struct drm_via_irq {
+- atomic_t irq_received;
++ atomic_unchecked_t irq_received;
+ uint32_t pending_mask;
+ uint32_t enable_mask;
+ wait_queue_head_t irq_queue;
+@@ -75,7 +75,7 @@ typedef struct drm_via_private {
+ struct timeval last_vblank;
+ int last_vblank_valid;
+ unsigned usec_per_vblank;
+- atomic_t vbl_received;
++ atomic_unchecked_t vbl_received;
+ drm_via_state_t hc_state;
+ char pci_buf[VIA_PCI_BUF_SIZE];
+ const uint32_t *fire_offsets[VIA_FIRE_BUF_SIZE];
+diff --git a/drivers/gpu/drm/via/via_irq.c b/drivers/gpu/drm/via/via_irq.c
+index 5935b88..127a8a6 100644
+--- a/drivers/gpu/drm/via/via_irq.c
++++ b/drivers/gpu/drm/via/via_irq.c
+@@ -102,7 +102,7 @@ u32 via_get_vblank_counter(struct drm_device *dev, int crtc)
+ if (crtc != 0)
+ return 0;
+
+- return atomic_read(&dev_priv->vbl_received);
++ return atomic_read_unchecked(&dev_priv->vbl_received);
+ }
+
+ irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
+@@ -117,8 +117,8 @@ irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
+
+ status = VIA_READ(VIA_REG_INTERRUPT);
+ if (status & VIA_IRQ_VBLANK_PENDING) {
+- atomic_inc(&dev_priv->vbl_received);
+- if (!(atomic_read(&dev_priv->vbl_received) & 0x0F)) {
++ atomic_inc_unchecked(&dev_priv->vbl_received);
++ if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0x0F)) {
+ do_gettimeofday(&cur_vblank);
+ if (dev_priv->last_vblank_valid) {
+ dev_priv->usec_per_vblank =
+@@ -128,7 +128,7 @@ irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
+ dev_priv->last_vblank = cur_vblank;
+ dev_priv->last_vblank_valid = 1;
+ }
+- if (!(atomic_read(&dev_priv->vbl_received) & 0xFF)) {
++ if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0xFF)) {
+ DRM_DEBUG("US per vblank is: %u\n",
+ dev_priv->usec_per_vblank);
+ }
+@@ -138,7 +138,7 @@ irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
+
+ for (i = 0; i < dev_priv->num_irqs; ++i) {
+ if (status & cur_irq->pending_mask) {
+- atomic_inc(&cur_irq->irq_received);
++ atomic_inc_unchecked(&cur_irq->irq_received);
+ DRM_WAKEUP(&cur_irq->irq_queue);
+ handled = 1;
+ if (dev_priv->irq_map[drm_via_irq_dma0_td] == i) {
+@@ -244,11 +244,11 @@ via_driver_irq_wait(struct drm_device * dev, unsigned int irq, int force_sequenc
+ DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
+ ((VIA_READ(masks[irq][2]) & masks[irq][3]) ==
+ masks[irq][4]));
+- cur_irq_sequence = atomic_read(&cur_irq->irq_received);
++ cur_irq_sequence = atomic_read_unchecked(&cur_irq->irq_received);
+ } else {
+ DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
+ (((cur_irq_sequence =
+- atomic_read(&cur_irq->irq_received)) -
++ atomic_read_unchecked(&cur_irq->irq_received)) -
+ *sequence) <= (1 << 23)));
+ }
+ *sequence = cur_irq_sequence;
+@@ -286,7 +286,7 @@ void via_driver_irq_preinstall(struct drm_device * dev)
+ }
+
+ for (i = 0; i < dev_priv->num_irqs; ++i) {
+- atomic_set(&cur_irq->irq_received, 0);
++ atomic_set_unchecked(&cur_irq->irq_received, 0);
+ cur_irq->enable_mask = dev_priv->irq_masks[i][0];
+ cur_irq->pending_mask = dev_priv->irq_masks[i][1];
+ DRM_INIT_WAITQUEUE(&cur_irq->irq_queue);
+@@ -368,7 +368,7 @@ int via_wait_irq(struct drm_device *dev, void *data, struct drm_file *file_priv)
+ switch (irqwait->request.type & ~VIA_IRQ_FLAGS_MASK) {
+ case VIA_IRQ_RELATIVE:
+ irqwait->request.sequence +=
+- atomic_read(&cur_irq->irq_received);
++ atomic_read_unchecked(&cur_irq->irq_received);
+ irqwait->request.type &= ~_DRM_VBLANK_RELATIVE;
+ case VIA_IRQ_ABSOLUTE:
+ break;
+diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c
+index aa8688d..6a0140c 100644
+--- a/drivers/gpu/vga/vgaarb.c
++++ b/drivers/gpu/vga/vgaarb.c
+@@ -894,14 +894,20 @@ static ssize_t vga_arb_write(struct file *file, const char __user * buf,
+ uc = &priv->cards[i];
+ }
+
+- if (!uc)
+- return -EINVAL;
++ if (!uc) {
++ ret_val = -EINVAL;
++ goto done;
++ }
+
+- if (io_state & VGA_RSRC_LEGACY_IO && uc->io_cnt == 0)
+- return -EINVAL;
++ if (io_state & VGA_RSRC_LEGACY_IO && uc->io_cnt == 0) {
++ ret_val = -EINVAL;
++ goto done;
++ }
+
+- if (io_state & VGA_RSRC_LEGACY_MEM && uc->mem_cnt == 0)
+- return -EINVAL;
++ if (io_state & VGA_RSRC_LEGACY_MEM && uc->mem_cnt == 0) {
++ ret_val = -EINVAL;
++ goto done;
++ }
+
+ vga_put(pdev, io_state);
+
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 11f8069..4783396 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1752,7 +1752,7 @@ static bool hid_ignore(struct hid_device *hdev)
+
+ int hid_add_device(struct hid_device *hdev)
+ {
+- static atomic_t id = ATOMIC_INIT(0);
++ static atomic_unchecked_t id = ATOMIC_INIT(0);
+ int ret;
+
+ if (WARN_ON(hdev->status & HID_STAT_ADDED))
+@@ -1766,7 +1766,7 @@ int hid_add_device(struct hid_device *hdev)
+ /* XXX hack, any other cleaner solution after the driver core
+ * is converted to allow more than 20 bytes as the device name? */
+ dev_set_name(&hdev->dev, "%04X:%04X:%04X.%04X", hdev->bus,
+- hdev->vendor, hdev->product, atomic_inc_return(&id));
++ hdev->vendor, hdev->product, atomic_inc_return_unchecked(&id));
+
+ ret = device_add(&hdev->dev);
+ if (!ret)
+diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
+index 8b6ee24..70f657d 100644
+--- a/drivers/hid/usbhid/hiddev.c
++++ b/drivers/hid/usbhid/hiddev.c
+@@ -617,7 +617,7 @@ static long hiddev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ return put_user(HID_VERSION, (int __user *)arg);
+
+ case HIDIOCAPPLICATION:
+- if (arg < 0 || arg >= hid->maxapplication)
++ if (arg >= hid->maxapplication)
+ return -EINVAL;
+
+ for (i = 0; i < hid->maxcollection; i++)
+diff --git a/drivers/hwmon/lis3lv02d.c b/drivers/hwmon/lis3lv02d.c
+index 5d5ed69..f40533e 100644
+--- a/drivers/hwmon/lis3lv02d.c
++++ b/drivers/hwmon/lis3lv02d.c
+@@ -146,7 +146,7 @@ static irqreturn_t lis302dl_interrupt(int irq, void *dummy)
+ * the lid is closed. This leads to interrupts as soon as a little move
+ * is done.
+ */
+- atomic_inc(&lis3_dev.count);
++ atomic_inc_unchecked(&lis3_dev.count);
+
+ wake_up_interruptible(&lis3_dev.misc_wait);
+ kill_fasync(&lis3_dev.async_queue, SIGIO, POLL_IN);
+@@ -160,7 +160,7 @@ static int lis3lv02d_misc_open(struct inode *inode, struct file *file)
+ if (test_and_set_bit(0, &lis3_dev.misc_opened))
+ return -EBUSY; /* already open */
+
+- atomic_set(&lis3_dev.count, 0);
++ atomic_set_unchecked(&lis3_dev.count, 0);
+
+ /*
+ * The sensor can generate interrupts for free-fall and direction
+@@ -206,7 +206,7 @@ static ssize_t lis3lv02d_misc_read(struct file *file, char __user *buf,
+ add_wait_queue(&lis3_dev.misc_wait, &wait);
+ while (true) {
+ set_current_state(TASK_INTERRUPTIBLE);
+- data = atomic_xchg(&lis3_dev.count, 0);
++ data = atomic_xchg_unchecked(&lis3_dev.count, 0);
+ if (data)
+ break;
+
+@@ -244,7 +244,7 @@ out:
+ static unsigned int lis3lv02d_misc_poll(struct file *file, poll_table *wait)
+ {
+ poll_wait(file, &lis3_dev.misc_wait, wait);
+- if (atomic_read(&lis3_dev.count))
++ if (atomic_read_unchecked(&lis3_dev.count))
+ return POLLIN | POLLRDNORM;
+ return 0;
+ }
+diff --git a/drivers/hwmon/lis3lv02d.h b/drivers/hwmon/lis3lv02d.h
+index 7cdd76f..fe0efdf 100644
+--- a/drivers/hwmon/lis3lv02d.h
++++ b/drivers/hwmon/lis3lv02d.h
+@@ -201,7 +201,7 @@ struct lis3lv02d {
+
+ struct input_polled_dev *idev; /* input device */
+ struct platform_device *pdev; /* platform device */
+- atomic_t count; /* interrupt count after last read */
++ atomic_unchecked_t count; /* interrupt count after last read */
+ int xcalib; /* calibrated null value for x */
+ int ycalib; /* calibrated null value for y */
+ int zcalib; /* calibrated null value for z */
+diff --git a/drivers/hwmon/sht15.c b/drivers/hwmon/sht15.c
+index 740785e..5a5c6c6 100644
+--- a/drivers/hwmon/sht15.c
++++ b/drivers/hwmon/sht15.c
+@@ -112,7 +112,7 @@ struct sht15_data {
+ int supply_uV;
+ int supply_uV_valid;
+ struct work_struct update_supply_work;
+- atomic_t interrupt_handled;
++ atomic_unchecked_t interrupt_handled;
+ };
+
+ /**
+@@ -245,13 +245,13 @@ static inline int sht15_update_single_val(struct sht15_data *data,
+ return ret;
+
+ gpio_direction_input(data->pdata->gpio_data);
+- atomic_set(&data->interrupt_handled, 0);
++ atomic_set_unchecked(&data->interrupt_handled, 0);
+
+ enable_irq(gpio_to_irq(data->pdata->gpio_data));
+ if (gpio_get_value(data->pdata->gpio_data) == 0) {
+ disable_irq_nosync(gpio_to_irq(data->pdata->gpio_data));
+ /* Only relevant if the interrupt hasn't occured. */
+- if (!atomic_read(&data->interrupt_handled))
++ if (!atomic_read_unchecked(&data->interrupt_handled))
+ schedule_work(&data->read_work);
+ }
+ ret = wait_event_timeout(data->wait_queue,
+@@ -398,7 +398,7 @@ static irqreturn_t sht15_interrupt_fired(int irq, void *d)
+ struct sht15_data *data = d;
+ /* First disable the interrupt */
+ disable_irq_nosync(irq);
+- atomic_inc(&data->interrupt_handled);
++ atomic_inc_unchecked(&data->interrupt_handled);
+ /* Then schedule a reading work struct */
+ if (data->flag != SHT15_READING_NOTHING)
+ schedule_work(&data->read_work);
+@@ -449,11 +449,11 @@ static void sht15_bh_read_data(struct work_struct *work_s)
+ here as could have gone low in meantime so verify
+ it hasn't!
+ */
+- atomic_set(&data->interrupt_handled, 0);
++ atomic_set_unchecked(&data->interrupt_handled, 0);
+ enable_irq(gpio_to_irq(data->pdata->gpio_data));
+ /* If still not occured or another handler has been scheduled */
+ if (gpio_get_value(data->pdata->gpio_data)
+- || atomic_read(&data->interrupt_handled))
++ || atomic_read_unchecked(&data->interrupt_handled))
+ return;
+ }
+ /* Read the data back from the device */
+diff --git a/drivers/hwmon/w83791d.c b/drivers/hwmon/w83791d.c
+index 97851c5..cb40626 100644
+--- a/drivers/hwmon/w83791d.c
++++ b/drivers/hwmon/w83791d.c
+@@ -330,8 +330,8 @@ static int w83791d_detect(struct i2c_client *client, int kind,
+ struct i2c_board_info *info);
+ static int w83791d_remove(struct i2c_client *client);
+
+-static int w83791d_read(struct i2c_client *client, u8 register);
+-static int w83791d_write(struct i2c_client *client, u8 register, u8 value);
++static int w83791d_read(struct i2c_client *client, u8 reg);
++static int w83791d_write(struct i2c_client *client, u8 reg, u8 value);
+ static struct w83791d_data *w83791d_update_device(struct device *dev);
+
+ #ifdef DEBUG
+diff --git a/drivers/i2c/busses/i2c-amd756-s4882.c b/drivers/i2c/busses/i2c-amd756-s4882.c
+index 378fcb5..5e91fa8 100644
+--- a/drivers/i2c/busses/i2c-amd756-s4882.c
++++ b/drivers/i2c/busses/i2c-amd756-s4882.c
+@@ -43,7 +43,7 @@
+ extern struct i2c_adapter amd756_smbus;
+
+ static struct i2c_adapter *s4882_adapter;
+-static struct i2c_algorithm *s4882_algo;
++static i2c_algorithm_no_const *s4882_algo;
+
+ /* Wrapper access functions for multiplexed SMBus */
+ static DEFINE_MUTEX(amd756_lock);
+diff --git a/drivers/i2c/busses/i2c-nforce2-s4985.c b/drivers/i2c/busses/i2c-nforce2-s4985.c
+index 29015eb..af2d8e9 100644
+--- a/drivers/i2c/busses/i2c-nforce2-s4985.c
++++ b/drivers/i2c/busses/i2c-nforce2-s4985.c
+@@ -41,7 +41,7 @@
+ extern struct i2c_adapter *nforce2_smbus;
+
+ static struct i2c_adapter *s4985_adapter;
+-static struct i2c_algorithm *s4985_algo;
++static i2c_algorithm_no_const *s4985_algo;
+
+ /* Wrapper access functions for multiplexed SMBus */
+ static DEFINE_MUTEX(nforce2_lock);
+diff --git a/drivers/ide/aec62xx.c b/drivers/ide/aec62xx.c
+index 878f8ec..12376fc 100644
+--- a/drivers/ide/aec62xx.c
++++ b/drivers/ide/aec62xx.c
+@@ -180,7 +180,7 @@ static const struct ide_port_ops atp86x_port_ops = {
+ .cable_detect = atp86x_cable_detect,
+ };
+
+-static const struct ide_port_info aec62xx_chipsets[] __devinitdata = {
++static const struct ide_port_info aec62xx_chipsets[] __devinitconst = {
+ { /* 0: AEC6210 */
+ .name = DRV_NAME,
+ .init_chipset = init_chipset_aec62xx,
+diff --git a/drivers/ide/alim15x3.c b/drivers/ide/alim15x3.c
+index e59b6de..4b4fc65 100644
+--- a/drivers/ide/alim15x3.c
++++ b/drivers/ide/alim15x3.c
+@@ -509,7 +509,7 @@ static const struct ide_dma_ops ali_dma_ops = {
+ .dma_sff_read_status = ide_dma_sff_read_status,
+ };
+
+-static const struct ide_port_info ali15x3_chipset __devinitdata = {
++static const struct ide_port_info ali15x3_chipset __devinitconst = {
+ .name = DRV_NAME,
+ .init_chipset = init_chipset_ali15x3,
+ .init_hwif = init_hwif_ali15x3,
+diff --git a/drivers/ide/amd74xx.c b/drivers/ide/amd74xx.c
+index 628cd2e..087a414 100644
+--- a/drivers/ide/amd74xx.c
++++ b/drivers/ide/amd74xx.c
+@@ -221,7 +221,7 @@ static const struct ide_port_ops amd_port_ops = {
+ .udma_mask = udma, \
+ }
+
+-static const struct ide_port_info amd74xx_chipsets[] __devinitdata = {
++static const struct ide_port_info amd74xx_chipsets[] __devinitconst = {
+ /* 0: AMD7401 */ DECLARE_AMD_DEV(0x00, ATA_UDMA2),
+ /* 1: AMD7409 */ DECLARE_AMD_DEV(ATA_SWDMA2, ATA_UDMA4),
+ /* 2: AMD7411/7441 */ DECLARE_AMD_DEV(ATA_SWDMA2, ATA_UDMA5),
+diff --git a/drivers/ide/atiixp.c b/drivers/ide/atiixp.c
+index 837322b..837fd71 100644
+--- a/drivers/ide/atiixp.c
++++ b/drivers/ide/atiixp.c
+@@ -137,7 +137,7 @@ static const struct ide_port_ops atiixp_port_ops = {
+ .cable_detect = atiixp_cable_detect,
+ };
+
+-static const struct ide_port_info atiixp_pci_info[] __devinitdata = {
++static const struct ide_port_info atiixp_pci_info[] __devinitconst = {
+ { /* 0: IXP200/300/400/700 */
+ .name = DRV_NAME,
+ .enablebits = {{0x48,0x01,0x00}, {0x48,0x08,0x00}},
+diff --git a/drivers/ide/cmd64x.c b/drivers/ide/cmd64x.c
+index ca0c46f..d55318a 100644
+--- a/drivers/ide/cmd64x.c
++++ b/drivers/ide/cmd64x.c
+@@ -372,7 +372,7 @@ static const struct ide_dma_ops cmd646_rev1_dma_ops = {
+ .dma_sff_read_status = ide_dma_sff_read_status,
+ };
+
+-static const struct ide_port_info cmd64x_chipsets[] __devinitdata = {
++static const struct ide_port_info cmd64x_chipsets[] __devinitconst = {
+ { /* 0: CMD643 */
+ .name = DRV_NAME,
+ .init_chipset = init_chipset_cmd64x,
+diff --git a/drivers/ide/cs5520.c b/drivers/ide/cs5520.c
+index 09f98ed..cebc5bc 100644
+--- a/drivers/ide/cs5520.c
++++ b/drivers/ide/cs5520.c
+@@ -93,7 +93,7 @@ static const struct ide_port_ops cs5520_port_ops = {
+ .set_dma_mode = cs5520_set_dma_mode,
+ };
+
+-static const struct ide_port_info cyrix_chipset __devinitdata = {
++static const struct ide_port_info cyrix_chipset __devinitconst = {
+ .name = DRV_NAME,
+ .enablebits = { { 0x60, 0x01, 0x01 }, { 0x60, 0x02, 0x02 } },
+ .port_ops = &cs5520_port_ops,
+diff --git a/drivers/ide/cs5530.c b/drivers/ide/cs5530.c
+index 40bf05e..7d58ca0 100644
+--- a/drivers/ide/cs5530.c
++++ b/drivers/ide/cs5530.c
+@@ -244,7 +244,7 @@ static const struct ide_port_ops cs5530_port_ops = {
+ .udma_filter = cs5530_udma_filter,
+ };
+
+-static const struct ide_port_info cs5530_chipset __devinitdata = {
++static const struct ide_port_info cs5530_chipset __devinitconst = {
+ .name = DRV_NAME,
+ .init_chipset = init_chipset_cs5530,
+ .init_hwif = init_hwif_cs5530,
+diff --git a/drivers/ide/cs5535.c b/drivers/ide/cs5535.c
+index 983d957..53e6172 100644
+--- a/drivers/ide/cs5535.c
++++ b/drivers/ide/cs5535.c
+@@ -170,7 +170,7 @@ static const struct ide_port_ops cs5535_port_ops = {
+ .cable_detect = cs5535_cable_detect,
+ };
+
+-static const struct ide_port_info cs5535_chipset __devinitdata = {
++static const struct ide_port_info cs5535_chipset __devinitconst = {
+ .name = DRV_NAME,
+ .port_ops = &cs5535_port_ops,
+ .host_flags = IDE_HFLAG_SINGLE | IDE_HFLAG_POST_SET_MODE,
+diff --git a/drivers/ide/cy82c693.c b/drivers/ide/cy82c693.c
+index 74fc540..8e933d8 100644
+--- a/drivers/ide/cy82c693.c
++++ b/drivers/ide/cy82c693.c
+@@ -288,7 +288,7 @@ static const struct ide_port_ops cy82c693_port_ops = {
+ .set_dma_mode = cy82c693_set_dma_mode,
+ };
+
+-static const struct ide_port_info cy82c693_chipset __devinitdata = {
++static const struct ide_port_info cy82c693_chipset __devinitconst = {
+ .name = DRV_NAME,
+ .init_iops = init_iops_cy82c693,
+ .port_ops = &cy82c693_port_ops,
+diff --git a/drivers/ide/hpt366.c b/drivers/ide/hpt366.c
+index 7ce68ef..e78197d 100644
+--- a/drivers/ide/hpt366.c
++++ b/drivers/ide/hpt366.c
+@@ -507,7 +507,7 @@ static struct hpt_timings hpt37x_timings = {
+ }
+ };
+
+-static const struct hpt_info hpt36x __devinitdata = {
++static const struct hpt_info hpt36x __devinitconst = {
+ .chip_name = "HPT36x",
+ .chip_type = HPT36x,
+ .udma_mask = HPT366_ALLOW_ATA66_3 ? (HPT366_ALLOW_ATA66_4 ? ATA_UDMA4 : ATA_UDMA3) : ATA_UDMA2,
+@@ -515,7 +515,7 @@ static const struct hpt_info hpt36x __devinitdata = {
+ .timings = &hpt36x_timings
+ };
+
+-static const struct hpt_info hpt370 __devinitdata = {
++static const struct hpt_info hpt370 __devinitconst = {
+ .chip_name = "HPT370",
+ .chip_type = HPT370,
+ .udma_mask = HPT370_ALLOW_ATA100_5 ? ATA_UDMA5 : ATA_UDMA4,
+@@ -523,7 +523,7 @@ static const struct hpt_info hpt370 __devinitdata = {
+ .timings = &hpt37x_timings
+ };
+
+-static const struct hpt_info hpt370a __devinitdata = {
++static const struct hpt_info hpt370a __devinitconst = {
+ .chip_name = "HPT370A",
+ .chip_type = HPT370A,
+ .udma_mask = HPT370_ALLOW_ATA100_5 ? ATA_UDMA5 : ATA_UDMA4,
+@@ -531,7 +531,7 @@ static const struct hpt_info hpt370a __devinitdata = {
+ .timings = &hpt37x_timings
+ };
+
+-static const struct hpt_info hpt374 __devinitdata = {
++static const struct hpt_info hpt374 __devinitconst = {
+ .chip_name = "HPT374",
+ .chip_type = HPT374,
+ .udma_mask = ATA_UDMA5,
+@@ -539,7 +539,7 @@ static const struct hpt_info hpt374 __devinitdata = {
+ .timings = &hpt37x_timings
+ };
+
+-static const struct hpt_info hpt372 __devinitdata = {
++static const struct hpt_info hpt372 __devinitconst = {
+ .chip_name = "HPT372",
+ .chip_type = HPT372,
+ .udma_mask = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
+@@ -547,7 +547,7 @@ static const struct hpt_info hpt372 __devinitdata = {
+ .timings = &hpt37x_timings
+ };
+
+-static const struct hpt_info hpt372a __devinitdata = {
++static const struct hpt_info hpt372a __devinitconst = {
+ .chip_name = "HPT372A",
+ .chip_type = HPT372A,
+ .udma_mask = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
+@@ -555,7 +555,7 @@ static const struct hpt_info hpt372a __devinitdata = {
+ .timings = &hpt37x_timings
+ };
+
+-static const struct hpt_info hpt302 __devinitdata = {
++static const struct hpt_info hpt302 __devinitconst = {
+ .chip_name = "HPT302",
+ .chip_type = HPT302,
+ .udma_mask = HPT302_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
+@@ -563,7 +563,7 @@ static const struct hpt_info hpt302 __devinitdata = {
+ .timings = &hpt37x_timings
+ };
+
+-static const struct hpt_info hpt371 __devinitdata = {
++static const struct hpt_info hpt371 __devinitconst = {
+ .chip_name = "HPT371",
+ .chip_type = HPT371,
+ .udma_mask = HPT371_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
+@@ -571,7 +571,7 @@ static const struct hpt_info hpt371 __devinitdata = {
+ .timings = &hpt37x_timings
+ };
+
+-static const struct hpt_info hpt372n __devinitdata = {
++static const struct hpt_info hpt372n __devinitconst = {
+ .chip_name = "HPT372N",
+ .chip_type = HPT372N,
+ .udma_mask = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
+@@ -579,7 +579,7 @@ static const struct hpt_info hpt372n __devinitdata = {
+ .timings = &hpt37x_timings
+ };
+
+-static const struct hpt_info hpt302n __devinitdata = {
++static const struct hpt_info hpt302n __devinitconst = {
+ .chip_name = "HPT302N",
+ .chip_type = HPT302N,
+ .udma_mask = HPT302_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
+@@ -587,7 +587,7 @@ static const struct hpt_info hpt302n __devinitdata = {
+ .timings = &hpt37x_timings
+ };
+
+-static const struct hpt_info hpt371n __devinitdata = {
++static const struct hpt_info hpt371n __devinitconst = {
+ .chip_name = "HPT371N",
+ .chip_type = HPT371N,
+ .udma_mask = HPT371_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
+@@ -1422,7 +1422,7 @@ static const struct ide_dma_ops hpt36x_dma_ops = {
+ .dma_sff_read_status = ide_dma_sff_read_status,
+ };
+
+-static const struct ide_port_info hpt366_chipsets[] __devinitdata = {
++static const struct ide_port_info hpt366_chipsets[] __devinitconst = {
+ { /* 0: HPT36x */
+ .name = DRV_NAME,
+ .init_chipset = init_chipset_hpt366,
+diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
+index 2de76cc..74186a1 100644
+--- a/drivers/ide/ide-cd.c
++++ b/drivers/ide/ide-cd.c
+@@ -774,7 +774,7 @@ static void cdrom_do_block_pc(ide_drive_t *drive, struct request *rq)
+ alignment = queue_dma_alignment(q) | q->dma_pad_mask;
+ if ((unsigned long)buf & alignment
+ || blk_rq_bytes(rq) & q->dma_pad_mask
+- || object_is_on_stack(buf))
++ || object_starts_on_stack(buf))
+ drive->dma = 0;
+ }
+ }
+diff --git a/drivers/ide/ide-floppy.c b/drivers/ide/ide-floppy.c
+index fefbdfc..62ff465 100644
+--- a/drivers/ide/ide-floppy.c
++++ b/drivers/ide/ide-floppy.c
+@@ -373,6 +373,8 @@ static int ide_floppy_get_capacity(ide_drive_t *drive)
+ u8 pc_buf[256], header_len, desc_cnt;
+ int i, rc = 1, blocks, length;
+
++ pax_track_stack();
++
+ ide_debug_log(IDE_DBG_FUNC, "enter");
+
+ drive->bios_cyl = 0;
+diff --git a/drivers/ide/ide-pci-generic.c b/drivers/ide/ide-pci-generic.c
+index 39d4e01..11538ce 100644
+--- a/drivers/ide/ide-pci-generic.c
++++ b/drivers/ide/ide-pci-generic.c
+@@ -53,7 +53,7 @@ static const struct ide_port_ops netcell_port_ops = {
+ .udma_mask = ATA_UDMA6, \
+ }
+
+-static const struct ide_port_info generic_chipsets[] __devinitdata = {
++static const struct ide_port_info generic_chipsets[] __devinitconst = {
+ /* 0: Unknown */
+ DECLARE_GENERIC_PCI_DEV(0),
+
+diff --git a/drivers/ide/it8172.c b/drivers/ide/it8172.c
+index 0d266a5..aaca790 100644
+--- a/drivers/ide/it8172.c
++++ b/drivers/ide/it8172.c
+@@ -115,7 +115,7 @@ static const struct ide_port_ops it8172_port_ops = {
+ .set_dma_mode = it8172_set_dma_mode,
+ };
+
+-static const struct ide_port_info it8172_port_info __devinitdata = {
++static const struct ide_port_info it8172_port_info __devinitconst = {
+ .name = DRV_NAME,
+ .port_ops = &it8172_port_ops,
+ .enablebits = { {0x41, 0x80, 0x80}, {0x00, 0x00, 0x00} },
+diff --git a/drivers/ide/it8213.c b/drivers/ide/it8213.c
+index 4797616..4be488a 100644
+--- a/drivers/ide/it8213.c
++++ b/drivers/ide/it8213.c
+@@ -156,7 +156,7 @@ static const struct ide_port_ops it8213_port_ops = {
+ .cable_detect = it8213_cable_detect,
+ };
+
+-static const struct ide_port_info it8213_chipset __devinitdata = {
++static const struct ide_port_info it8213_chipset __devinitconst = {
+ .name = DRV_NAME,
+ .enablebits = { {0x41, 0x80, 0x80} },
+ .port_ops = &it8213_port_ops,
+diff --git a/drivers/ide/it821x.c b/drivers/ide/it821x.c
+index 51aa745..146ee60 100644
+--- a/drivers/ide/it821x.c
++++ b/drivers/ide/it821x.c
+@@ -627,7 +627,7 @@ static const struct ide_port_ops it821x_port_ops = {
+ .cable_detect = it821x_cable_detect,
+ };
+
+-static const struct ide_port_info it821x_chipset __devinitdata = {
++static const struct ide_port_info it821x_chipset __devinitconst = {
+ .name = DRV_NAME,
+ .init_chipset = init_chipset_it821x,
+ .init_hwif = init_hwif_it821x,
+diff --git a/drivers/ide/jmicron.c b/drivers/ide/jmicron.c
+index bf2be64..9270098 100644
+--- a/drivers/ide/jmicron.c
++++ b/drivers/ide/jmicron.c
+@@ -102,7 +102,7 @@ static const struct ide_port_ops jmicron_port_ops = {
+ .cable_detect = jmicron_cable_detect,
+ };
+
+-static const struct ide_port_info jmicron_chipset __devinitdata = {
++static const struct ide_port_info jmicron_chipset __devinitconst = {
+ .name = DRV_NAME,
+ .enablebits = { { 0x40, 0x01, 0x01 }, { 0x40, 0x10, 0x10 } },
+ .port_ops = &jmicron_port_ops,
+diff --git a/drivers/ide/ns87415.c b/drivers/ide/ns87415.c
+index 95327a2..73f78d8 100644
+--- a/drivers/ide/ns87415.c
++++ b/drivers/ide/ns87415.c
+@@ -293,7 +293,7 @@ static const struct ide_dma_ops ns87415_dma_ops = {
+ .dma_sff_read_status = superio_dma_sff_read_status,
+ };
+
+-static const struct ide_port_info ns87415_chipset __devinitdata = {
++static const struct ide_port_info ns87415_chipset __devinitconst = {
+ .name = DRV_NAME,
+ .init_hwif = init_hwif_ns87415,
+ .tp_ops = &ns87415_tp_ops,
+diff --git a/drivers/ide/opti621.c b/drivers/ide/opti621.c
+index f1d70d6..e1de05b 100644
+--- a/drivers/ide/opti621.c
++++ b/drivers/ide/opti621.c
+@@ -202,7 +202,7 @@ static const struct ide_port_ops opti621_port_ops = {
+ .set_pio_mode = opti621_set_pio_mode,
+ };
+
+-static const struct ide_port_info opti621_chipset __devinitdata = {
++static const struct ide_port_info opti621_chipset __devinitconst = {
+ .name = DRV_NAME,
+ .enablebits = { {0x45, 0x80, 0x00}, {0x40, 0x08, 0x00} },
+ .port_ops = &opti621_port_ops,
+diff --git a/drivers/ide/pdc202xx_new.c b/drivers/ide/pdc202xx_new.c
+index 65ba823..7311f4d 100644
+--- a/drivers/ide/pdc202xx_new.c
++++ b/drivers/ide/pdc202xx_new.c
+@@ -465,7 +465,7 @@ static const struct ide_port_ops pdcnew_port_ops = {
+ .udma_mask = udma, \
+ }
+
+-static const struct ide_port_info pdcnew_chipsets[] __devinitdata = {
++static const struct ide_port_info pdcnew_chipsets[] __devinitconst = {
+ /* 0: PDC202{68,70} */ DECLARE_PDCNEW_DEV(ATA_UDMA5),
+ /* 1: PDC202{69,71,75,76,77} */ DECLARE_PDCNEW_DEV(ATA_UDMA6),
+ };
+diff --git a/drivers/ide/pdc202xx_old.c b/drivers/ide/pdc202xx_old.c
+index cb812f3..af816ef 100644
+--- a/drivers/ide/pdc202xx_old.c
++++ b/drivers/ide/pdc202xx_old.c
+@@ -285,7 +285,7 @@ static const struct ide_dma_ops pdc2026x_dma_ops = {
+ .max_sectors = sectors, \
+ }
+
+-static const struct ide_port_info pdc202xx_chipsets[] __devinitdata = {
++static const struct ide_port_info pdc202xx_chipsets[] __devinitconst = {
+ { /* 0: PDC20246 */
+ .name = DRV_NAME,
+ .init_chipset = init_chipset_pdc202xx,
+diff --git a/drivers/ide/piix.c b/drivers/ide/piix.c
+index bf14f39..15c4b98 100644
+--- a/drivers/ide/piix.c
++++ b/drivers/ide/piix.c
+@@ -344,7 +344,7 @@ static const struct ide_port_ops ich_port_ops = {
+ .udma_mask = udma, \
+ }
+
+-static const struct ide_port_info piix_pci_info[] __devinitdata = {
++static const struct ide_port_info piix_pci_info[] __devinitconst = {
+ /* 0: MPIIX */
+ { /*
+ * MPIIX actually has only a single IDE channel mapped to
+diff --git a/drivers/ide/rz1000.c b/drivers/ide/rz1000.c
+index a6414a8..c04173e 100644
+--- a/drivers/ide/rz1000.c
++++ b/drivers/ide/rz1000.c
+@@ -38,7 +38,7 @@ static int __devinit rz1000_disable_readahead(struct pci_dev *dev)
+ }
+ }
+
+-static const struct ide_port_info rz1000_chipset __devinitdata = {
++static const struct ide_port_info rz1000_chipset __devinitconst = {
+ .name = DRV_NAME,
+ .host_flags = IDE_HFLAG_NO_DMA,
+ };
+diff --git a/drivers/ide/sc1200.c b/drivers/ide/sc1200.c
+index d467478..9203942 100644
+--- a/drivers/ide/sc1200.c
++++ b/drivers/ide/sc1200.c
+@@ -290,7 +290,7 @@ static const struct ide_dma_ops sc1200_dma_ops = {
+ .dma_sff_read_status = ide_dma_sff_read_status,
+ };
+
+-static const struct ide_port_info sc1200_chipset __devinitdata = {
++static const struct ide_port_info sc1200_chipset __devinitconst = {
+ .name = DRV_NAME,
+ .port_ops = &sc1200_port_ops,
+ .dma_ops = &sc1200_dma_ops,
+diff --git a/drivers/ide/scc_pata.c b/drivers/ide/scc_pata.c
+index 1104bb3..59c5194 100644
+--- a/drivers/ide/scc_pata.c
++++ b/drivers/ide/scc_pata.c
+@@ -811,7 +811,7 @@ static const struct ide_dma_ops scc_dma_ops = {
+ .dma_sff_read_status = scc_dma_sff_read_status,
+ };
+
+-static const struct ide_port_info scc_chipset __devinitdata = {
++static const struct ide_port_info scc_chipset __devinitconst = {
+ .name = "sccIDE",
+ .init_iops = init_iops_scc,
+ .init_dma = scc_init_dma,
+diff --git a/drivers/ide/serverworks.c b/drivers/ide/serverworks.c
+index b6554ef..6cc2cc3 100644
+--- a/drivers/ide/serverworks.c
++++ b/drivers/ide/serverworks.c
+@@ -353,7 +353,7 @@ static const struct ide_port_ops svwks_port_ops = {
+ .cable_detect = svwks_cable_detect,
+ };
+
+-static const struct ide_port_info serverworks_chipsets[] __devinitdata = {
++static const struct ide_port_info serverworks_chipsets[] __devinitconst = {
+ { /* 0: OSB4 */
+ .name = DRV_NAME,
+ .init_chipset = init_chipset_svwks,
+diff --git a/drivers/ide/setup-pci.c b/drivers/ide/setup-pci.c
+index ab3db61..afed580 100644
+--- a/drivers/ide/setup-pci.c
++++ b/drivers/ide/setup-pci.c
+@@ -542,6 +542,8 @@ int ide_pci_init_two(struct pci_dev *dev1, struct pci_dev *dev2,
+ int ret, i, n_ports = dev2 ? 4 : 2;
+ struct ide_hw hw[4], *hws[] = { NULL, NULL, NULL, NULL };
+
++ pax_track_stack();
++
+ for (i = 0; i < n_ports / 2; i++) {
+ ret = ide_setup_pci_controller(pdev[i], d, !i);
+ if (ret < 0)
+diff --git a/drivers/ide/siimage.c b/drivers/ide/siimage.c
+index d95df52..0b03a39 100644
+--- a/drivers/ide/siimage.c
++++ b/drivers/ide/siimage.c
+@@ -719,7 +719,7 @@ static const struct ide_dma_ops sil_dma_ops = {
+ .udma_mask = ATA_UDMA6, \
+ }
+
+-static const struct ide_port_info siimage_chipsets[] __devinitdata = {
++static const struct ide_port_info siimage_chipsets[] __devinitconst = {
+ /* 0: SiI680 */ DECLARE_SII_DEV(&sil_pata_port_ops),
+ /* 1: SiI3112 */ DECLARE_SII_DEV(&sil_sata_port_ops)
+ };
+diff --git a/drivers/ide/sis5513.c b/drivers/ide/sis5513.c
+index 3b88eba..ca8699d 100644
+--- a/drivers/ide/sis5513.c
++++ b/drivers/ide/sis5513.c
+@@ -561,7 +561,7 @@ static const struct ide_port_ops sis_ata133_port_ops = {
+ .cable_detect = sis_cable_detect,
+ };
+
+-static const struct ide_port_info sis5513_chipset __devinitdata = {
++static const struct ide_port_info sis5513_chipset __devinitconst = {
+ .name = DRV_NAME,
+ .init_chipset = init_chipset_sis5513,
+ .enablebits = { {0x4a, 0x02, 0x02}, {0x4a, 0x04, 0x04} },
+diff --git a/drivers/ide/sl82c105.c b/drivers/ide/sl82c105.c
+index d698da4..fca42a4 100644
+--- a/drivers/ide/sl82c105.c
++++ b/drivers/ide/sl82c105.c
+@@ -319,7 +319,7 @@ static const struct ide_dma_ops sl82c105_dma_ops = {
+ .dma_sff_read_status = ide_dma_sff_read_status,
+ };
+
+-static const struct ide_port_info sl82c105_chipset __devinitdata = {
++static const struct ide_port_info sl82c105_chipset __devinitconst = {
+ .name = DRV_NAME,
+ .init_chipset = init_chipset_sl82c105,
+ .enablebits = {{0x40,0x01,0x01}, {0x40,0x10,0x10}},
+diff --git a/drivers/ide/slc90e66.c b/drivers/ide/slc90e66.c
+index 1ccfb40..83d5779 100644
+--- a/drivers/ide/slc90e66.c
++++ b/drivers/ide/slc90e66.c
+@@ -131,7 +131,7 @@ static const struct ide_port_ops slc90e66_port_ops = {
+ .cable_detect = slc90e66_cable_detect,
+ };
+
+-static const struct ide_port_info slc90e66_chipset __devinitdata = {
++static const struct ide_port_info slc90e66_chipset __devinitconst = {
+ .name = DRV_NAME,
+ .enablebits = { {0x41, 0x80, 0x80}, {0x43, 0x80, 0x80} },
+ .port_ops = &slc90e66_port_ops,
+diff --git a/drivers/ide/tc86c001.c b/drivers/ide/tc86c001.c
+index 05a93d6..5f9e325 100644
+--- a/drivers/ide/tc86c001.c
++++ b/drivers/ide/tc86c001.c
+@@ -190,7 +190,7 @@ static const struct ide_dma_ops tc86c001_dma_ops = {
+ .dma_sff_read_status = ide_dma_sff_read_status,
+ };
+
+-static const struct ide_port_info tc86c001_chipset __devinitdata = {
++static const struct ide_port_info tc86c001_chipset __devinitconst = {
+ .name = DRV_NAME,
+ .init_hwif = init_hwif_tc86c001,
+ .port_ops = &tc86c001_port_ops,
+diff --git a/drivers/ide/triflex.c b/drivers/ide/triflex.c
+index 8773c3b..7907d6c 100644
+--- a/drivers/ide/triflex.c
++++ b/drivers/ide/triflex.c
+@@ -92,7 +92,7 @@ static const struct ide_port_ops triflex_port_ops = {
+ .set_dma_mode = triflex_set_mode,
+ };
+
+-static const struct ide_port_info triflex_device __devinitdata = {
++static const struct ide_port_info triflex_device __devinitconst = {
+ .name = DRV_NAME,
+ .enablebits = {{0x80, 0x01, 0x01}, {0x80, 0x02, 0x02}},
+ .port_ops = &triflex_port_ops,
+diff --git a/drivers/ide/trm290.c b/drivers/ide/trm290.c
+index 4b42ca0..e494a98 100644
+--- a/drivers/ide/trm290.c
++++ b/drivers/ide/trm290.c
+@@ -324,7 +324,7 @@ static struct ide_dma_ops trm290_dma_ops = {
+ .dma_check = trm290_dma_check,
+ };
+
+-static const struct ide_port_info trm290_chipset __devinitdata = {
++static const struct ide_port_info trm290_chipset __devinitconst = {
+ .name = DRV_NAME,
+ .init_hwif = init_hwif_trm290,
+ .tp_ops = &trm290_tp_ops,
+diff --git a/drivers/ide/via82cxxx.c b/drivers/ide/via82cxxx.c
+index 028de26..520d5d5 100644
+--- a/drivers/ide/via82cxxx.c
++++ b/drivers/ide/via82cxxx.c
+@@ -374,7 +374,7 @@ static const struct ide_port_ops via_port_ops = {
+ .cable_detect = via82cxxx_cable_detect,
+ };
+
+-static const struct ide_port_info via82cxxx_chipset __devinitdata = {
++static const struct ide_port_info via82cxxx_chipset __devinitconst = {
+ .name = DRV_NAME,
+ .init_chipset = init_chipset_via82cxxx,
+ .enablebits = { { 0x40, 0x02, 0x02 }, { 0x40, 0x01, 0x01 } },
+diff --git a/drivers/ieee1394/dv1394.c b/drivers/ieee1394/dv1394.c
+index 2cd00b5..14de699 100644
+--- a/drivers/ieee1394/dv1394.c
++++ b/drivers/ieee1394/dv1394.c
+@@ -739,7 +739,7 @@ static void frame_prepare(struct video_card *video, unsigned int this_frame)
+ based upon DIF section and sequence
+ */
+
+-static void inline
++static inline void
+ frame_put_packet (struct frame *f, struct packet *p)
+ {
+ int section_type = p->data[0] >> 5; /* section type is in bits 5 - 7 */
+diff --git a/drivers/ieee1394/hosts.c b/drivers/ieee1394/hosts.c
+index e947d8f..6a966b9 100644
+--- a/drivers/ieee1394/hosts.c
++++ b/drivers/ieee1394/hosts.c
+@@ -78,6 +78,7 @@ static int dummy_isoctl(struct hpsb_iso *iso, enum isoctl_cmd command,
+ }
+
+ static struct hpsb_host_driver dummy_driver = {
++ .name = "dummy",
+ .transmit_packet = dummy_transmit_packet,
+ .devctl = dummy_devctl,
+ .isoctl = dummy_isoctl
+diff --git a/drivers/ieee1394/init_ohci1394_dma.c b/drivers/ieee1394/init_ohci1394_dma.c
+index ddaab6e..8d37435 100644
+--- a/drivers/ieee1394/init_ohci1394_dma.c
++++ b/drivers/ieee1394/init_ohci1394_dma.c
+@@ -257,7 +257,7 @@ void __init init_ohci1394_dma_on_all_controllers(void)
+ for (func = 0; func < 8; func++) {
+ u32 class = read_pci_config(num,slot,func,
+ PCI_CLASS_REVISION);
+- if ((class == 0xffffffff))
++ if (class == 0xffffffff)
+ continue; /* No device at this func */
+
+ if (class>>8 != PCI_CLASS_SERIAL_FIREWIRE_OHCI)
+diff --git a/drivers/ieee1394/ohci1394.c b/drivers/ieee1394/ohci1394.c
+index 65c1429..5d8c11f 100644
+--- a/drivers/ieee1394/ohci1394.c
++++ b/drivers/ieee1394/ohci1394.c
+@@ -147,9 +147,9 @@ printk(level "%s: " fmt "\n" , OHCI1394_DRIVER_NAME , ## args)
+ printk(level "%s: fw-host%d: " fmt "\n" , OHCI1394_DRIVER_NAME, ohci->host->id , ## args)
+
+ /* Module Parameters */
+-static int phys_dma = 1;
++static int phys_dma;
+ module_param(phys_dma, int, 0444);
+-MODULE_PARM_DESC(phys_dma, "Enable physical DMA (default = 1).");
++MODULE_PARM_DESC(phys_dma, "Enable physical DMA (default = 0).");
+
+ static void dma_trm_tasklet(unsigned long data);
+ static void dma_trm_reset(struct dma_trm_ctx *d);
+diff --git a/drivers/ieee1394/sbp2.c b/drivers/ieee1394/sbp2.c
+index f199896..78c9fc8 100644
+--- a/drivers/ieee1394/sbp2.c
++++ b/drivers/ieee1394/sbp2.c
+@@ -2111,7 +2111,7 @@ MODULE_DESCRIPTION("IEEE-1394 SBP-2 protocol driver");
+ MODULE_SUPPORTED_DEVICE(SBP2_DEVICE_NAME);
+ MODULE_LICENSE("GPL");
+
+-static int sbp2_module_init(void)
++static int __init sbp2_module_init(void)
+ {
+ int ret;
+
+diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
+index a5dea6b..0cefe8f 100644
+--- a/drivers/infiniband/core/cm.c
++++ b/drivers/infiniband/core/cm.c
+@@ -112,7 +112,7 @@ static char const counter_group_names[CM_COUNTER_GROUPS]
+
+ struct cm_counter_group {
+ struct kobject obj;
+- atomic_long_t counter[CM_ATTR_COUNT];
++ atomic_long_unchecked_t counter[CM_ATTR_COUNT];
+ };
+
+ struct cm_counter_attribute {
+@@ -1386,7 +1386,7 @@ static void cm_dup_req_handler(struct cm_work *work,
+ struct ib_mad_send_buf *msg = NULL;
+ int ret;
+
+- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ counter[CM_REQ_COUNTER]);
+
+ /* Quick state check to discard duplicate REQs. */
+@@ -1764,7 +1764,7 @@ static void cm_dup_rep_handler(struct cm_work *work)
+ if (!cm_id_priv)
+ return;
+
+- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ counter[CM_REP_COUNTER]);
+ ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
+ if (ret)
+@@ -1931,7 +1931,7 @@ static int cm_rtu_handler(struct cm_work *work)
+ if (cm_id_priv->id.state != IB_CM_REP_SENT &&
+ cm_id_priv->id.state != IB_CM_MRA_REP_RCVD) {
+ spin_unlock_irq(&cm_id_priv->lock);
+- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ counter[CM_RTU_COUNTER]);
+ goto out;
+ }
+@@ -2110,7 +2110,7 @@ static int cm_dreq_handler(struct cm_work *work)
+ cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id,
+ dreq_msg->local_comm_id);
+ if (!cm_id_priv) {
+- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ counter[CM_DREQ_COUNTER]);
+ cm_issue_drep(work->port, work->mad_recv_wc);
+ return -EINVAL;
+@@ -2131,7 +2131,7 @@ static int cm_dreq_handler(struct cm_work *work)
+ case IB_CM_MRA_REP_RCVD:
+ break;
+ case IB_CM_TIMEWAIT:
+- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ counter[CM_DREQ_COUNTER]);
+ if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
+ goto unlock;
+@@ -2145,7 +2145,7 @@ static int cm_dreq_handler(struct cm_work *work)
+ cm_free_msg(msg);
+ goto deref;
+ case IB_CM_DREQ_RCVD:
+- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ counter[CM_DREQ_COUNTER]);
+ goto unlock;
+ default:
+@@ -2501,7 +2501,7 @@ static int cm_mra_handler(struct cm_work *work)
+ ib_modify_mad(cm_id_priv->av.port->mad_agent,
+ cm_id_priv->msg, timeout)) {
+ if (cm_id_priv->id.lap_state == IB_CM_MRA_LAP_RCVD)
+- atomic_long_inc(&work->port->
++ atomic_long_inc_unchecked(&work->port->
+ counter_group[CM_RECV_DUPLICATES].
+ counter[CM_MRA_COUNTER]);
+ goto out;
+@@ -2510,7 +2510,7 @@ static int cm_mra_handler(struct cm_work *work)
+ break;
+ case IB_CM_MRA_REQ_RCVD:
+ case IB_CM_MRA_REP_RCVD:
+- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ counter[CM_MRA_COUNTER]);
+ /* fall through */
+ default:
+@@ -2672,7 +2672,7 @@ static int cm_lap_handler(struct cm_work *work)
+ case IB_CM_LAP_IDLE:
+ break;
+ case IB_CM_MRA_LAP_SENT:
+- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ counter[CM_LAP_COUNTER]);
+ if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
+ goto unlock;
+@@ -2688,7 +2688,7 @@ static int cm_lap_handler(struct cm_work *work)
+ cm_free_msg(msg);
+ goto deref;
+ case IB_CM_LAP_RCVD:
+- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ counter[CM_LAP_COUNTER]);
+ goto unlock;
+ default:
+@@ -2972,7 +2972,7 @@ static int cm_sidr_req_handler(struct cm_work *work)
+ cur_cm_id_priv = cm_insert_remote_sidr(cm_id_priv);
+ if (cur_cm_id_priv) {
+ spin_unlock_irq(&cm.lock);
+- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ counter[CM_SIDR_REQ_COUNTER]);
+ goto out; /* Duplicate message. */
+ }
+@@ -3184,10 +3184,10 @@ static void cm_send_handler(struct ib_mad_agent *mad_agent,
+ if (!msg->context[0] && (attr_index != CM_REJ_COUNTER))
+ msg->retries = 1;
+
+- atomic_long_add(1 + msg->retries,
++ atomic_long_add_unchecked(1 + msg->retries,
+ &port->counter_group[CM_XMIT].counter[attr_index]);
+ if (msg->retries)
+- atomic_long_add(msg->retries,
++ atomic_long_add_unchecked(msg->retries,
+ &port->counter_group[CM_XMIT_RETRIES].
+ counter[attr_index]);
+
+@@ -3397,7 +3397,7 @@ static void cm_recv_handler(struct ib_mad_agent *mad_agent,
+ }
+
+ attr_id = be16_to_cpu(mad_recv_wc->recv_buf.mad->mad_hdr.attr_id);
+- atomic_long_inc(&port->counter_group[CM_RECV].
++ atomic_long_inc_unchecked(&port->counter_group[CM_RECV].
+ counter[attr_id - CM_ATTR_ID_OFFSET]);
+
+ work = kmalloc(sizeof *work + sizeof(struct ib_sa_path_rec) * paths,
+@@ -3595,10 +3595,10 @@ static ssize_t cm_show_counter(struct kobject *obj, struct attribute *attr,
+ cm_attr = container_of(attr, struct cm_counter_attribute, attr);
+
+ return sprintf(buf, "%ld\n",
+- atomic_long_read(&group->counter[cm_attr->index]));
++ atomic_long_read_unchecked(&group->counter[cm_attr->index]));
+ }
+
+-static struct sysfs_ops cm_counter_ops = {
++static const struct sysfs_ops cm_counter_ops = {
+ .show = cm_show_counter
+ };
+
+diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
+index 8fd3a6f..61d8075 100644
+--- a/drivers/infiniband/core/cma.c
++++ b/drivers/infiniband/core/cma.c
+@@ -2267,6 +2267,9 @@ static int cma_resolve_ib_udp(struct rdma_id_private *id_priv,
+
+ req.private_data_len = sizeof(struct cma_hdr) +
+ conn_param->private_data_len;
++ if (req.private_data_len < conn_param->private_data_len)
++ return -EINVAL;
++
+ req.private_data = kzalloc(req.private_data_len, GFP_ATOMIC);
+ if (!req.private_data)
+ return -ENOMEM;
+@@ -2314,6 +2317,9 @@ static int cma_connect_ib(struct rdma_id_private *id_priv,
+ memset(&req, 0, sizeof req);
+ offset = cma_user_data_offset(id_priv->id.ps);
+ req.private_data_len = offset + conn_param->private_data_len;
++ if (req.private_data_len < conn_param->private_data_len)
++ return -EINVAL;
++
+ private_data = kzalloc(req.private_data_len, GFP_ATOMIC);
+ if (!private_data)
+ return -ENOMEM;
+diff --git a/drivers/infiniband/core/fmr_pool.c b/drivers/infiniband/core/fmr_pool.c
+index 4507043..14ad522 100644
+--- a/drivers/infiniband/core/fmr_pool.c
++++ b/drivers/infiniband/core/fmr_pool.c
+@@ -97,8 +97,8 @@ struct ib_fmr_pool {
+
+ struct task_struct *thread;
+
+- atomic_t req_ser;
+- atomic_t flush_ser;
++ atomic_unchecked_t req_ser;
++ atomic_unchecked_t flush_ser;
+
+ wait_queue_head_t force_wait;
+ };
+@@ -179,10 +179,10 @@ static int ib_fmr_cleanup_thread(void *pool_ptr)
+ struct ib_fmr_pool *pool = pool_ptr;
+
+ do {
+- if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) < 0) {
++ if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) < 0) {
+ ib_fmr_batch_release(pool);
+
+- atomic_inc(&pool->flush_ser);
++ atomic_inc_unchecked(&pool->flush_ser);
+ wake_up_interruptible(&pool->force_wait);
+
+ if (pool->flush_function)
+@@ -190,7 +190,7 @@ static int ib_fmr_cleanup_thread(void *pool_ptr)
+ }
+
+ set_current_state(TASK_INTERRUPTIBLE);
+- if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) >= 0 &&
++ if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) >= 0 &&
+ !kthread_should_stop())
+ schedule();
+ __set_current_state(TASK_RUNNING);
+@@ -282,8 +282,8 @@ struct ib_fmr_pool *ib_create_fmr_pool(struct ib_pd *pd,
+ pool->dirty_watermark = params->dirty_watermark;
+ pool->dirty_len = 0;
+ spin_lock_init(&pool->pool_lock);
+- atomic_set(&pool->req_ser, 0);
+- atomic_set(&pool->flush_ser, 0);
++ atomic_set_unchecked(&pool->req_ser, 0);
++ atomic_set_unchecked(&pool->flush_ser, 0);
+ init_waitqueue_head(&pool->force_wait);
+
+ pool->thread = kthread_run(ib_fmr_cleanup_thread,
+@@ -411,11 +411,11 @@ int ib_flush_fmr_pool(struct ib_fmr_pool *pool)
+ }
+ spin_unlock_irq(&pool->pool_lock);
+
+- serial = atomic_inc_return(&pool->req_ser);
++ serial = atomic_inc_return_unchecked(&pool->req_ser);
+ wake_up_process(pool->thread);
+
+ if (wait_event_interruptible(pool->force_wait,
+- atomic_read(&pool->flush_ser) - serial >= 0))
++ atomic_read_unchecked(&pool->flush_ser) - serial >= 0))
+ return -EINTR;
+
+ return 0;
+@@ -525,7 +525,7 @@ int ib_fmr_pool_unmap(struct ib_pool_fmr *fmr)
+ } else {
+ list_add_tail(&fmr->list, &pool->dirty_list);
+ if (++pool->dirty_len >= pool->dirty_watermark) {
+- atomic_inc(&pool->req_ser);
++ atomic_inc_unchecked(&pool->req_ser);
+ wake_up_process(pool->thread);
+ }
+ }
+diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
+index 158a214..1558bb7 100644
+--- a/drivers/infiniband/core/sysfs.c
++++ b/drivers/infiniband/core/sysfs.c
+@@ -79,7 +79,7 @@ static ssize_t port_attr_show(struct kobject *kobj,
+ return port_attr->show(p, port_attr, buf);
+ }
+
+-static struct sysfs_ops port_sysfs_ops = {
++static const struct sysfs_ops port_sysfs_ops = {
+ .show = port_attr_show
+ };
+
+diff --git a/drivers/infiniband/core/uverbs_marshall.c b/drivers/infiniband/core/uverbs_marshall.c
+index 5440da0..1194ecb 100644
+--- a/drivers/infiniband/core/uverbs_marshall.c
++++ b/drivers/infiniband/core/uverbs_marshall.c
+@@ -40,18 +40,21 @@ void ib_copy_ah_attr_to_user(struct ib_uverbs_ah_attr *dst,
+ dst->grh.sgid_index = src->grh.sgid_index;
+ dst->grh.hop_limit = src->grh.hop_limit;
+ dst->grh.traffic_class = src->grh.traffic_class;
++ memset(&dst->grh.reserved, 0, sizeof(dst->grh.reserved));
+ dst->dlid = src->dlid;
+ dst->sl = src->sl;
+ dst->src_path_bits = src->src_path_bits;
+ dst->static_rate = src->static_rate;
+ dst->is_global = src->ah_flags & IB_AH_GRH ? 1 : 0;
+ dst->port_num = src->port_num;
++ dst->reserved = 0;
+ }
+ EXPORT_SYMBOL(ib_copy_ah_attr_to_user);
+
+ void ib_copy_qp_attr_to_user(struct ib_uverbs_qp_attr *dst,
+ struct ib_qp_attr *src)
+ {
++ dst->qp_state = src->qp_state;
+ dst->cur_qp_state = src->cur_qp_state;
+ dst->path_mtu = src->path_mtu;
+ dst->path_mig_state = src->path_mig_state;
+@@ -83,6 +86,7 @@ void ib_copy_qp_attr_to_user(struct ib_uverbs_qp_attr *dst,
+ dst->rnr_retry = src->rnr_retry;
+ dst->alt_port_num = src->alt_port_num;
+ dst->alt_timeout = src->alt_timeout;
++ memset(dst->reserved, 0, sizeof(dst->reserved));
+ }
+ EXPORT_SYMBOL(ib_copy_qp_attr_to_user);
+
+diff --git a/drivers/infiniband/hw/ipath/ipath_fs.c b/drivers/infiniband/hw/ipath/ipath_fs.c
+index 100da85..62e6b88 100644
+--- a/drivers/infiniband/hw/ipath/ipath_fs.c
++++ b/drivers/infiniband/hw/ipath/ipath_fs.c
+@@ -110,6 +110,8 @@ static ssize_t atomic_counters_read(struct file *file, char __user *buf,
+ struct infinipath_counters counters;
+ struct ipath_devdata *dd;
+
++ pax_track_stack();
++
+ dd = file->f_path.dentry->d_inode->i_private;
+ dd->ipath_f_read_counters(dd, &counters);
+
+diff --git a/drivers/infiniband/hw/nes/nes.c b/drivers/infiniband/hw/nes/nes.c
+index cbde0cf..afaf55c 100644
+--- a/drivers/infiniband/hw/nes/nes.c
++++ b/drivers/infiniband/hw/nes/nes.c
+@@ -102,7 +102,7 @@ MODULE_PARM_DESC(limit_maxrdreqsz, "Limit max read request size to 256 Bytes");
+ LIST_HEAD(nes_adapter_list);
+ static LIST_HEAD(nes_dev_list);
+
+-atomic_t qps_destroyed;
++atomic_unchecked_t qps_destroyed;
+
+ static unsigned int ee_flsh_adapter;
+ static unsigned int sysfs_nonidx_addr;
+@@ -259,7 +259,7 @@ static void nes_cqp_rem_ref_callback(struct nes_device *nesdev, struct nes_cqp_r
+ struct nes_adapter *nesadapter = nesdev->nesadapter;
+ u32 qp_id;
+
+- atomic_inc(&qps_destroyed);
++ atomic_inc_unchecked(&qps_destroyed);
+
+ /* Free the control structures */
+
+diff --git a/drivers/infiniband/hw/nes/nes.h b/drivers/infiniband/hw/nes/nes.h
+index bcc6abc..9c76b2f 100644
+--- a/drivers/infiniband/hw/nes/nes.h
++++ b/drivers/infiniband/hw/nes/nes.h
+@@ -174,17 +174,17 @@ extern unsigned int nes_debug_level;
+ extern unsigned int wqm_quanta;
+ extern struct list_head nes_adapter_list;
+
+-extern atomic_t cm_connects;
+-extern atomic_t cm_accepts;
+-extern atomic_t cm_disconnects;
+-extern atomic_t cm_closes;
+-extern atomic_t cm_connecteds;
+-extern atomic_t cm_connect_reqs;
+-extern atomic_t cm_rejects;
+-extern atomic_t mod_qp_timouts;
+-extern atomic_t qps_created;
+-extern atomic_t qps_destroyed;
+-extern atomic_t sw_qps_destroyed;
++extern atomic_unchecked_t cm_connects;
++extern atomic_unchecked_t cm_accepts;
++extern atomic_unchecked_t cm_disconnects;
++extern atomic_unchecked_t cm_closes;
++extern atomic_unchecked_t cm_connecteds;
++extern atomic_unchecked_t cm_connect_reqs;
++extern atomic_unchecked_t cm_rejects;
++extern atomic_unchecked_t mod_qp_timouts;
++extern atomic_unchecked_t qps_created;
++extern atomic_unchecked_t qps_destroyed;
++extern atomic_unchecked_t sw_qps_destroyed;
+ extern u32 mh_detected;
+ extern u32 mh_pauses_sent;
+ extern u32 cm_packets_sent;
+@@ -196,11 +196,11 @@ extern u32 cm_packets_retrans;
+ extern u32 cm_listens_created;
+ extern u32 cm_listens_destroyed;
+ extern u32 cm_backlog_drops;
+-extern atomic_t cm_loopbacks;
+-extern atomic_t cm_nodes_created;
+-extern atomic_t cm_nodes_destroyed;
+-extern atomic_t cm_accel_dropped_pkts;
+-extern atomic_t cm_resets_recvd;
++extern atomic_unchecked_t cm_loopbacks;
++extern atomic_unchecked_t cm_nodes_created;
++extern atomic_unchecked_t cm_nodes_destroyed;
++extern atomic_unchecked_t cm_accel_dropped_pkts;
++extern atomic_unchecked_t cm_resets_recvd;
+
+ extern u32 int_mod_timer_init;
+ extern u32 int_mod_cq_depth_256;
+diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c
+index 73473db..5ed06e8 100644
+--- a/drivers/infiniband/hw/nes/nes_cm.c
++++ b/drivers/infiniband/hw/nes/nes_cm.c
+@@ -69,11 +69,11 @@ u32 cm_packets_received;
+ u32 cm_listens_created;
+ u32 cm_listens_destroyed;
+ u32 cm_backlog_drops;
+-atomic_t cm_loopbacks;
+-atomic_t cm_nodes_created;
+-atomic_t cm_nodes_destroyed;
+-atomic_t cm_accel_dropped_pkts;
+-atomic_t cm_resets_recvd;
++atomic_unchecked_t cm_loopbacks;
++atomic_unchecked_t cm_nodes_created;
++atomic_unchecked_t cm_nodes_destroyed;
++atomic_unchecked_t cm_accel_dropped_pkts;
++atomic_unchecked_t cm_resets_recvd;
+
+ static inline int mini_cm_accelerated(struct nes_cm_core *,
+ struct nes_cm_node *);
+@@ -149,13 +149,13 @@ static struct nes_cm_ops nes_cm_api = {
+
+ static struct nes_cm_core *g_cm_core;
+
+-atomic_t cm_connects;
+-atomic_t cm_accepts;
+-atomic_t cm_disconnects;
+-atomic_t cm_closes;
+-atomic_t cm_connecteds;
+-atomic_t cm_connect_reqs;
+-atomic_t cm_rejects;
++atomic_unchecked_t cm_connects;
++atomic_unchecked_t cm_accepts;
++atomic_unchecked_t cm_disconnects;
++atomic_unchecked_t cm_closes;
++atomic_unchecked_t cm_connecteds;
++atomic_unchecked_t cm_connect_reqs;
++atomic_unchecked_t cm_rejects;
+
+
+ /**
+@@ -1195,7 +1195,7 @@ static struct nes_cm_node *make_cm_node(struct nes_cm_core *cm_core,
+ cm_node->rem_mac);
+
+ add_hte_node(cm_core, cm_node);
+- atomic_inc(&cm_nodes_created);
++ atomic_inc_unchecked(&cm_nodes_created);
+
+ return cm_node;
+ }
+@@ -1253,7 +1253,7 @@ static int rem_ref_cm_node(struct nes_cm_core *cm_core,
+ }
+
+ atomic_dec(&cm_core->node_cnt);
+- atomic_inc(&cm_nodes_destroyed);
++ atomic_inc_unchecked(&cm_nodes_destroyed);
+ nesqp = cm_node->nesqp;
+ if (nesqp) {
+ nesqp->cm_node = NULL;
+@@ -1320,7 +1320,7 @@ static int process_options(struct nes_cm_node *cm_node, u8 *optionsloc,
+
+ static void drop_packet(struct sk_buff *skb)
+ {
+- atomic_inc(&cm_accel_dropped_pkts);
++ atomic_inc_unchecked(&cm_accel_dropped_pkts);
+ dev_kfree_skb_any(skb);
+ }
+
+@@ -1377,7 +1377,7 @@ static void handle_rst_pkt(struct nes_cm_node *cm_node, struct sk_buff *skb,
+
+ int reset = 0; /* whether to send reset in case of err.. */
+ int passive_state;
+- atomic_inc(&cm_resets_recvd);
++ atomic_inc_unchecked(&cm_resets_recvd);
+ nes_debug(NES_DBG_CM, "Received Reset, cm_node = %p, state = %u."
+ " refcnt=%d\n", cm_node, cm_node->state,
+ atomic_read(&cm_node->ref_count));
+@@ -2000,7 +2000,7 @@ static struct nes_cm_node *mini_cm_connect(struct nes_cm_core *cm_core,
+ rem_ref_cm_node(cm_node->cm_core, cm_node);
+ return NULL;
+ }
+- atomic_inc(&cm_loopbacks);
++ atomic_inc_unchecked(&cm_loopbacks);
+ loopbackremotenode->loopbackpartner = cm_node;
+ loopbackremotenode->tcp_cntxt.rcv_wscale =
+ NES_CM_DEFAULT_RCV_WND_SCALE;
+@@ -2262,7 +2262,7 @@ static int mini_cm_recv_pkt(struct nes_cm_core *cm_core,
+ add_ref_cm_node(cm_node);
+ } else if (cm_node->state == NES_CM_STATE_TSA) {
+ rem_ref_cm_node(cm_core, cm_node);
+- atomic_inc(&cm_accel_dropped_pkts);
++ atomic_inc_unchecked(&cm_accel_dropped_pkts);
+ dev_kfree_skb_any(skb);
+ break;
+ }
+@@ -2568,7 +2568,7 @@ static int nes_cm_disconn_true(struct nes_qp *nesqp)
+
+ if ((cm_id) && (cm_id->event_handler)) {
+ if (issue_disconn) {
+- atomic_inc(&cm_disconnects);
++ atomic_inc_unchecked(&cm_disconnects);
+ cm_event.event = IW_CM_EVENT_DISCONNECT;
+ cm_event.status = disconn_status;
+ cm_event.local_addr = cm_id->local_addr;
+@@ -2590,7 +2590,7 @@ static int nes_cm_disconn_true(struct nes_qp *nesqp)
+ }
+
+ if (issue_close) {
+- atomic_inc(&cm_closes);
++ atomic_inc_unchecked(&cm_closes);
+ nes_disconnect(nesqp, 1);
+
+ cm_id->provider_data = nesqp;
+@@ -2710,7 +2710,7 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
+
+ nes_debug(NES_DBG_CM, "QP%u, cm_node=%p, jiffies = %lu listener = %p\n",
+ nesqp->hwqp.qp_id, cm_node, jiffies, cm_node->listener);
+- atomic_inc(&cm_accepts);
++ atomic_inc_unchecked(&cm_accepts);
+
+ nes_debug(NES_DBG_CM, "netdev refcnt = %u.\n",
+ atomic_read(&nesvnic->netdev->refcnt));
+@@ -2919,7 +2919,7 @@ int nes_reject(struct iw_cm_id *cm_id, const void *pdata, u8 pdata_len)
+
+ struct nes_cm_core *cm_core;
+
+- atomic_inc(&cm_rejects);
++ atomic_inc_unchecked(&cm_rejects);
+ cm_node = (struct nes_cm_node *) cm_id->provider_data;
+ loopback = cm_node->loopbackpartner;
+ cm_core = cm_node->cm_core;
+@@ -2982,7 +2982,7 @@ int nes_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
+ ntohl(cm_id->local_addr.sin_addr.s_addr),
+ ntohs(cm_id->local_addr.sin_port));
+
+- atomic_inc(&cm_connects);
++ atomic_inc_unchecked(&cm_connects);
+ nesqp->active_conn = 1;
+
+ /* cache the cm_id in the qp */
+@@ -3195,7 +3195,7 @@ static void cm_event_connected(struct nes_cm_event *event)
+ if (nesqp->destroyed) {
+ return;
+ }
+- atomic_inc(&cm_connecteds);
++ atomic_inc_unchecked(&cm_connecteds);
+ nes_debug(NES_DBG_CM, "QP%u attempting to connect to 0x%08X:0x%04X on"
+ " local port 0x%04X. jiffies = %lu.\n",
+ nesqp->hwqp.qp_id,
+@@ -3403,7 +3403,7 @@ static void cm_event_reset(struct nes_cm_event *event)
+
+ ret = cm_id->event_handler(cm_id, &cm_event);
+ cm_id->add_ref(cm_id);
+- atomic_inc(&cm_closes);
++ atomic_inc_unchecked(&cm_closes);
+ cm_event.event = IW_CM_EVENT_CLOSE;
+ cm_event.status = IW_CM_EVENT_STATUS_OK;
+ cm_event.provider_data = cm_id->provider_data;
+@@ -3439,7 +3439,7 @@ static void cm_event_mpa_req(struct nes_cm_event *event)
+ return;
+ cm_id = cm_node->cm_id;
+
+- atomic_inc(&cm_connect_reqs);
++ atomic_inc_unchecked(&cm_connect_reqs);
+ nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
+ cm_node, cm_id, jiffies);
+
+@@ -3477,7 +3477,7 @@ static void cm_event_mpa_reject(struct nes_cm_event *event)
+ return;
+ cm_id = cm_node->cm_id;
+
+- atomic_inc(&cm_connect_reqs);
++ atomic_inc_unchecked(&cm_connect_reqs);
+ nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
+ cm_node, cm_id, jiffies);
+
+diff --git a/drivers/infiniband/hw/nes/nes_nic.c b/drivers/infiniband/hw/nes/nes_nic.c
+index e593af3..870694a 100644
+--- a/drivers/infiniband/hw/nes/nes_nic.c
++++ b/drivers/infiniband/hw/nes/nes_nic.c
+@@ -1210,17 +1210,17 @@ static void nes_netdev_get_ethtool_stats(struct net_device *netdev,
+ target_stat_values[++index] = mh_detected;
+ target_stat_values[++index] = mh_pauses_sent;
+ target_stat_values[++index] = nesvnic->endnode_ipv4_tcp_retransmits;
+- target_stat_values[++index] = atomic_read(&cm_connects);
+- target_stat_values[++index] = atomic_read(&cm_accepts);
+- target_stat_values[++index] = atomic_read(&cm_disconnects);
+- target_stat_values[++index] = atomic_read(&cm_connecteds);
+- target_stat_values[++index] = atomic_read(&cm_connect_reqs);
+- target_stat_values[++index] = atomic_read(&cm_rejects);
+- target_stat_values[++index] = atomic_read(&mod_qp_timouts);
+- target_stat_values[++index] = atomic_read(&qps_created);
+- target_stat_values[++index] = atomic_read(&sw_qps_destroyed);
+- target_stat_values[++index] = atomic_read(&qps_destroyed);
+- target_stat_values[++index] = atomic_read(&cm_closes);
++ target_stat_values[++index] = atomic_read_unchecked(&cm_connects);
++ target_stat_values[++index] = atomic_read_unchecked(&cm_accepts);
++ target_stat_values[++index] = atomic_read_unchecked(&cm_disconnects);
++ target_stat_values[++index] = atomic_read_unchecked(&cm_connecteds);
++ target_stat_values[++index] = atomic_read_unchecked(&cm_connect_reqs);
++ target_stat_values[++index] = atomic_read_unchecked(&cm_rejects);
++ target_stat_values[++index] = atomic_read_unchecked(&mod_qp_timouts);
++ target_stat_values[++index] = atomic_read_unchecked(&qps_created);
++ target_stat_values[++index] = atomic_read_unchecked(&sw_qps_destroyed);
++ target_stat_values[++index] = atomic_read_unchecked(&qps_destroyed);
++ target_stat_values[++index] = atomic_read_unchecked(&cm_closes);
+ target_stat_values[++index] = cm_packets_sent;
+ target_stat_values[++index] = cm_packets_bounced;
+ target_stat_values[++index] = cm_packets_created;
+@@ -1230,11 +1230,11 @@ static void nes_netdev_get_ethtool_stats(struct net_device *netdev,
+ target_stat_values[++index] = cm_listens_created;
+ target_stat_values[++index] = cm_listens_destroyed;
+ target_stat_values[++index] = cm_backlog_drops;
+- target_stat_values[++index] = atomic_read(&cm_loopbacks);
+- target_stat_values[++index] = atomic_read(&cm_nodes_created);
+- target_stat_values[++index] = atomic_read(&cm_nodes_destroyed);
+- target_stat_values[++index] = atomic_read(&cm_accel_dropped_pkts);
+- target_stat_values[++index] = atomic_read(&cm_resets_recvd);
++ target_stat_values[++index] = atomic_read_unchecked(&cm_loopbacks);
++ target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_created);
++ target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_destroyed);
++ target_stat_values[++index] = atomic_read_unchecked(&cm_accel_dropped_pkts);
++ target_stat_values[++index] = atomic_read_unchecked(&cm_resets_recvd);
+ target_stat_values[++index] = int_mod_timer_init;
+ target_stat_values[++index] = int_mod_cq_depth_1;
+ target_stat_values[++index] = int_mod_cq_depth_4;
+diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
+index a680c42..f914deb 100644
+--- a/drivers/infiniband/hw/nes/nes_verbs.c
++++ b/drivers/infiniband/hw/nes/nes_verbs.c
+@@ -45,9 +45,9 @@
+
+ #include <rdma/ib_umem.h>
+
+-atomic_t mod_qp_timouts;
+-atomic_t qps_created;
+-atomic_t sw_qps_destroyed;
++atomic_unchecked_t mod_qp_timouts;
++atomic_unchecked_t qps_created;
++atomic_unchecked_t sw_qps_destroyed;
+
+ static void nes_unregister_ofa_device(struct nes_ib_device *nesibdev);
+
+@@ -1240,7 +1240,7 @@ static struct ib_qp *nes_create_qp(struct ib_pd *ibpd,
+ if (init_attr->create_flags)
+ return ERR_PTR(-EINVAL);
+
+- atomic_inc(&qps_created);
++ atomic_inc_unchecked(&qps_created);
+ switch (init_attr->qp_type) {
+ case IB_QPT_RC:
+ if (nes_drv_opt & NES_DRV_OPT_NO_INLINE_DATA) {
+@@ -1568,7 +1568,7 @@ static int nes_destroy_qp(struct ib_qp *ibqp)
+ struct iw_cm_event cm_event;
+ int ret;
+
+- atomic_inc(&sw_qps_destroyed);
++ atomic_inc_unchecked(&sw_qps_destroyed);
+ nesqp->destroyed = 1;
+
+ /* Blow away the connection if it exists. */
+diff --git a/drivers/input/gameport/gameport.c b/drivers/input/gameport/gameport.c
+index ac11be0..3883c04 100644
+--- a/drivers/input/gameport/gameport.c
++++ b/drivers/input/gameport/gameport.c
+@@ -515,13 +515,13 @@ EXPORT_SYMBOL(gameport_set_phys);
+ */
+ static void gameport_init_port(struct gameport *gameport)
+ {
+- static atomic_t gameport_no = ATOMIC_INIT(0);
++ static atomic_unchecked_t gameport_no = ATOMIC_INIT(0);
+
+ __module_get(THIS_MODULE);
+
+ mutex_init(&gameport->drv_mutex);
+ device_initialize(&gameport->dev);
+- dev_set_name(&gameport->dev, "gameport%lu", (unsigned long)atomic_inc_return(&gameport_no) - 1);
++ dev_set_name(&gameport->dev, "gameport%lu", (unsigned long)atomic_inc_return_unchecked(&gameport_no) - 1);
+ gameport->dev.bus = &gameport_bus;
+ gameport->dev.release = gameport_release_port;
+ if (gameport->parent)
+diff --git a/drivers/input/input.c b/drivers/input/input.c
+index c82ae82..8cfb9cb 100644
+--- a/drivers/input/input.c
++++ b/drivers/input/input.c
+@@ -1558,7 +1558,7 @@ EXPORT_SYMBOL(input_set_capability);
+ */
+ int input_register_device(struct input_dev *dev)
+ {
+- static atomic_t input_no = ATOMIC_INIT(0);
++ static atomic_unchecked_t input_no = ATOMIC_INIT(0);
+ struct input_handler *handler;
+ const char *path;
+ int error;
+@@ -1585,7 +1585,7 @@ int input_register_device(struct input_dev *dev)
+ dev->setkeycode = input_default_setkeycode;
+
+ dev_set_name(&dev->dev, "input%ld",
+- (unsigned long) atomic_inc_return(&input_no) - 1);
++ (unsigned long) atomic_inc_return_unchecked(&input_no) - 1);
+
+ error = device_add(&dev->dev);
+ if (error)
+diff --git a/drivers/input/joystick/sidewinder.c b/drivers/input/joystick/sidewinder.c
+index ca13a6b..b032b0c 100644
+--- a/drivers/input/joystick/sidewinder.c
++++ b/drivers/input/joystick/sidewinder.c
+@@ -30,6 +30,7 @@
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+ #include <linux/slab.h>
++#include <linux/sched.h>
+ #include <linux/init.h>
+ #include <linux/input.h>
+ #include <linux/gameport.h>
+@@ -428,6 +429,8 @@ static int sw_read(struct sw *sw)
+ unsigned char buf[SW_LENGTH];
+ int i;
+
++ pax_track_stack();
++
+ i = sw_read_packet(sw->gameport, buf, sw->length, 0);
+
+ if (sw->type == SW_ID_3DP && sw->length == 66 && i != 66) { /* Broken packet, try to fix */
+diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
+index 79e3edc..01412b9 100644
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -621,7 +621,7 @@ static void xpad_led_set(struct led_classdev *led_cdev,
+
+ static int xpad_led_probe(struct usb_xpad *xpad)
+ {
+- static atomic_t led_seq = ATOMIC_INIT(0);
++ static atomic_unchecked_t led_seq = ATOMIC_INIT(0);
+ long led_no;
+ struct xpad_led *led;
+ struct led_classdev *led_cdev;
+@@ -634,7 +634,7 @@ static int xpad_led_probe(struct usb_xpad *xpad)
+ if (!led)
+ return -ENOMEM;
+
+- led_no = (long)atomic_inc_return(&led_seq) - 1;
++ led_no = (long)atomic_inc_return_unchecked(&led_seq) - 1;
+
+ snprintf(led->name, sizeof(led->name), "xpad%ld", led_no);
+ led->xpad = xpad;
+diff --git a/drivers/input/serio/serio.c b/drivers/input/serio/serio.c
+index 0236f0d..c7327f1 100644
+--- a/drivers/input/serio/serio.c
++++ b/drivers/input/serio/serio.c
+@@ -527,7 +527,7 @@ static void serio_release_port(struct device *dev)
+ */
+ static void serio_init_port(struct serio *serio)
+ {
+- static atomic_t serio_no = ATOMIC_INIT(0);
++ static atomic_unchecked_t serio_no = ATOMIC_INIT(0);
+
+ __module_get(THIS_MODULE);
+
+@@ -536,7 +536,7 @@ static void serio_init_port(struct serio *serio)
+ mutex_init(&serio->drv_mutex);
+ device_initialize(&serio->dev);
+ dev_set_name(&serio->dev, "serio%ld",
+- (long)atomic_inc_return(&serio_no) - 1);
++ (long)atomic_inc_return_unchecked(&serio_no) - 1);
+ serio->dev.bus = &serio_bus;
+ serio->dev.release = serio_release_port;
+ if (serio->parent) {
+diff --git a/drivers/isdn/gigaset/common.c b/drivers/isdn/gigaset/common.c
+index 33dcd8d..2783d25 100644
+--- a/drivers/isdn/gigaset/common.c
++++ b/drivers/isdn/gigaset/common.c
+@@ -712,7 +712,7 @@ struct cardstate *gigaset_initcs(struct gigaset_driver *drv, int channels,
+ cs->commands_pending = 0;
+ cs->cur_at_seq = 0;
+ cs->gotfwver = -1;
+- cs->open_count = 0;
++ local_set(&cs->open_count, 0);
+ cs->dev = NULL;
+ cs->tty = NULL;
+ cs->tty_dev = NULL;
+diff --git a/drivers/isdn/gigaset/gigaset.h b/drivers/isdn/gigaset/gigaset.h
+index a2f6125..6a70677 100644
+--- a/drivers/isdn/gigaset/gigaset.h
++++ b/drivers/isdn/gigaset/gigaset.h
+@@ -34,6 +34,7 @@
+ #include <linux/tty_driver.h>
+ #include <linux/list.h>
+ #include <asm/atomic.h>
++#include <asm/local.h>
+
+ #define GIG_VERSION {0,5,0,0}
+ #define GIG_COMPAT {0,4,0,0}
+@@ -446,7 +447,7 @@ struct cardstate {
+ spinlock_t cmdlock;
+ unsigned curlen, cmdbytes;
+
+- unsigned open_count;
++ local_t open_count;
+ struct tty_struct *tty;
+ struct tasklet_struct if_wake_tasklet;
+ unsigned control_state;
+diff --git a/drivers/isdn/gigaset/interface.c b/drivers/isdn/gigaset/interface.c
+index b3065b8..c7e8cc9 100644
+--- a/drivers/isdn/gigaset/interface.c
++++ b/drivers/isdn/gigaset/interface.c
+@@ -165,9 +165,7 @@ static int if_open(struct tty_struct *tty, struct file *filp)
+ return -ERESTARTSYS; // FIXME -EINTR?
+ tty->driver_data = cs;
+
+- ++cs->open_count;
+-
+- if (cs->open_count == 1) {
++ if (local_inc_return(&cs->open_count) == 1) {
+ spin_lock_irqsave(&cs->lock, flags);
+ cs->tty = tty;
+ spin_unlock_irqrestore(&cs->lock, flags);
+@@ -195,10 +193,10 @@ static void if_close(struct tty_struct *tty, struct file *filp)
+
+ if (!cs->connected)
+ gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
+- else if (!cs->open_count)
++ else if (!local_read(&cs->open_count))
+ dev_warn(cs->dev, "%s: device not opened\n", __func__);
+ else {
+- if (!--cs->open_count) {
++ if (!local_dec_return(&cs->open_count)) {
+ spin_lock_irqsave(&cs->lock, flags);
+ cs->tty = NULL;
+ spin_unlock_irqrestore(&cs->lock, flags);
+@@ -233,7 +231,7 @@ static int if_ioctl(struct tty_struct *tty, struct file *file,
+ if (!cs->connected) {
+ gig_dbg(DEBUG_IF, "not connected");
+ retval = -ENODEV;
+- } else if (!cs->open_count)
++ } else if (!local_read(&cs->open_count))
+ dev_warn(cs->dev, "%s: device not opened\n", __func__);
+ else {
+ retval = 0;
+@@ -361,7 +359,7 @@ static int if_write(struct tty_struct *tty, const unsigned char *buf, int count)
+ if (!cs->connected) {
+ gig_dbg(DEBUG_IF, "not connected");
+ retval = -ENODEV;
+- } else if (!cs->open_count)
++ } else if (!local_read(&cs->open_count))
+ dev_warn(cs->dev, "%s: device not opened\n", __func__);
+ else if (cs->mstate != MS_LOCKED) {
+ dev_warn(cs->dev, "can't write to unlocked device\n");
+@@ -395,7 +393,7 @@ static int if_write_room(struct tty_struct *tty)
+ if (!cs->connected) {
+ gig_dbg(DEBUG_IF, "not connected");
+ retval = -ENODEV;
+- } else if (!cs->open_count)
++ } else if (!local_read(&cs->open_count))
+ dev_warn(cs->dev, "%s: device not opened\n", __func__);
+ else if (cs->mstate != MS_LOCKED) {
+ dev_warn(cs->dev, "can't write to unlocked device\n");
+@@ -425,7 +423,7 @@ static int if_chars_in_buffer(struct tty_struct *tty)
+
+ if (!cs->connected)
+ gig_dbg(DEBUG_IF, "not connected");
+- else if (!cs->open_count)
++ else if (!local_read(&cs->open_count))
+ dev_warn(cs->dev, "%s: device not opened\n", __func__);
+ else if (cs->mstate != MS_LOCKED)
+ dev_warn(cs->dev, "can't write to unlocked device\n");
+@@ -453,7 +451,7 @@ static void if_throttle(struct tty_struct *tty)
+
+ if (!cs->connected)
+ gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
+- else if (!cs->open_count)
++ else if (!local_read(&cs->open_count))
+ dev_warn(cs->dev, "%s: device not opened\n", __func__);
+ else {
+ //FIXME
+@@ -478,7 +476,7 @@ static void if_unthrottle(struct tty_struct *tty)
+
+ if (!cs->connected)
+ gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
+- else if (!cs->open_count)
++ else if (!local_read(&cs->open_count))
+ dev_warn(cs->dev, "%s: device not opened\n", __func__);
+ else {
+ //FIXME
+@@ -510,7 +508,7 @@ static void if_set_termios(struct tty_struct *tty, struct ktermios *old)
+ goto out;
+ }
+
+- if (!cs->open_count) {
++ if (!local_read(&cs->open_count)) {
+ dev_warn(cs->dev, "%s: device not opened\n", __func__);
+ goto out;
+ }
+diff --git a/drivers/isdn/hardware/avm/b1.c b/drivers/isdn/hardware/avm/b1.c
+index a7c0083..62a7cb6 100644
+--- a/drivers/isdn/hardware/avm/b1.c
++++ b/drivers/isdn/hardware/avm/b1.c
+@@ -173,7 +173,7 @@ int b1_load_t4file(avmcard *card, capiloaddatapart * t4file)
+ }
+ if (left) {
+ if (t4file->user) {
+- if (copy_from_user(buf, dp, left))
++ if (left > sizeof buf || copy_from_user(buf, dp, left))
+ return -EFAULT;
+ } else {
+ memcpy(buf, dp, left);
+@@ -221,7 +221,7 @@ int b1_load_config(avmcard *card, capiloaddatapart * config)
+ }
+ if (left) {
+ if (config->user) {
+- if (copy_from_user(buf, dp, left))
++ if (left > sizeof buf || copy_from_user(buf, dp, left))
+ return -EFAULT;
+ } else {
+ memcpy(buf, dp, left);
+diff --git a/drivers/isdn/hardware/eicon/capidtmf.c b/drivers/isdn/hardware/eicon/capidtmf.c
+index f130724..c373c68 100644
+--- a/drivers/isdn/hardware/eicon/capidtmf.c
++++ b/drivers/isdn/hardware/eicon/capidtmf.c
+@@ -498,6 +498,7 @@ void capidtmf_recv_block (t_capidtmf_state *p_state, byte *buffer, word leng
+ byte goertzel_result_buffer[CAPIDTMF_RECV_TOTAL_FREQUENCY_COUNT];
+ short windowed_sample_buffer[CAPIDTMF_RECV_WINDOWED_SAMPLES];
+
++ pax_track_stack();
+
+ if (p_state->recv.state & CAPIDTMF_RECV_STATE_DTMF_ACTIVE)
+ {
+diff --git a/drivers/isdn/hardware/eicon/capifunc.c b/drivers/isdn/hardware/eicon/capifunc.c
+index 4d425c6..a9be6c4 100644
+--- a/drivers/isdn/hardware/eicon/capifunc.c
++++ b/drivers/isdn/hardware/eicon/capifunc.c
+@@ -1055,6 +1055,8 @@ static int divacapi_connect_didd(void)
+ IDI_SYNC_REQ req;
+ DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
+
++ pax_track_stack();
++
+ DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
+
+ for (x = 0; x < MAX_DESCRIPTORS; x++) {
+diff --git a/drivers/isdn/hardware/eicon/diddfunc.c b/drivers/isdn/hardware/eicon/diddfunc.c
+index 3029234..ef0d9e2 100644
+--- a/drivers/isdn/hardware/eicon/diddfunc.c
++++ b/drivers/isdn/hardware/eicon/diddfunc.c
+@@ -54,6 +54,8 @@ static int DIVA_INIT_FUNCTION connect_didd(void)
+ IDI_SYNC_REQ req;
+ DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
+
++ pax_track_stack();
++
+ DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
+
+ for (x = 0; x < MAX_DESCRIPTORS; x++) {
+diff --git a/drivers/isdn/hardware/eicon/divasfunc.c b/drivers/isdn/hardware/eicon/divasfunc.c
+index d36a4c0..11e7d1a 100644
+--- a/drivers/isdn/hardware/eicon/divasfunc.c
++++ b/drivers/isdn/hardware/eicon/divasfunc.c
+@@ -161,6 +161,8 @@ static int DIVA_INIT_FUNCTION connect_didd(void)
+ IDI_SYNC_REQ req;
+ DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
+
++ pax_track_stack();
++
+ DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
+
+ for (x = 0; x < MAX_DESCRIPTORS; x++) {
+diff --git a/drivers/isdn/hardware/eicon/divasync.h b/drivers/isdn/hardware/eicon/divasync.h
+index 85784a7..a19ca98 100644
+--- a/drivers/isdn/hardware/eicon/divasync.h
++++ b/drivers/isdn/hardware/eicon/divasync.h
+@@ -146,7 +146,7 @@ typedef struct _diva_didd_add_adapter {
+ } diva_didd_add_adapter_t;
+ typedef struct _diva_didd_remove_adapter {
+ IDI_CALL p_request;
+-} diva_didd_remove_adapter_t;
++} __no_const diva_didd_remove_adapter_t;
+ typedef struct _diva_didd_read_adapter_array {
+ void * buffer;
+ dword length;
+diff --git a/drivers/isdn/hardware/eicon/idifunc.c b/drivers/isdn/hardware/eicon/idifunc.c
+index db87d51..7d09acf 100644
+--- a/drivers/isdn/hardware/eicon/idifunc.c
++++ b/drivers/isdn/hardware/eicon/idifunc.c
+@@ -188,6 +188,8 @@ static int DIVA_INIT_FUNCTION connect_didd(void)
+ IDI_SYNC_REQ req;
+ DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
+
++ pax_track_stack();
++
+ DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
+
+ for (x = 0; x < MAX_DESCRIPTORS; x++) {
+diff --git a/drivers/isdn/hardware/eicon/message.c b/drivers/isdn/hardware/eicon/message.c
+index ae89fb8..0fab299 100644
+--- a/drivers/isdn/hardware/eicon/message.c
++++ b/drivers/isdn/hardware/eicon/message.c
+@@ -4889,6 +4889,8 @@ static void sig_ind(PLCI *plci)
+ dword d;
+ word w;
+
++ pax_track_stack();
++
+ a = plci->adapter;
+ Id = ((word)plci->Id<<8)|a->Id;
+ PUT_WORD(&SS_Ind[4],0x0000);
+@@ -7484,6 +7486,8 @@ static word add_b1(PLCI *plci, API_PARSE *bp, word b_channel_info,
+ word j, n, w;
+ dword d;
+
++ pax_track_stack();
++
+
+ for(i=0;i<8;i++) bp_parms[i].length = 0;
+ for(i=0;i<2;i++) global_config[i].length = 0;
+@@ -7958,6 +7962,8 @@ static word add_b23(PLCI *plci, API_PARSE *bp)
+ const byte llc3[] = {4,3,2,2,6,6,0};
+ const byte header[] = {0,2,3,3,0,0,0};
+
++ pax_track_stack();
++
+ for(i=0;i<8;i++) bp_parms[i].length = 0;
+ for(i=0;i<6;i++) b2_config_parms[i].length = 0;
+ for(i=0;i<5;i++) b3_config_parms[i].length = 0;
+@@ -14761,6 +14767,8 @@ static void group_optimization(DIVA_CAPI_ADAPTER * a, PLCI * plci)
+ word appl_number_group_type[MAX_APPL];
+ PLCI *auxplci;
+
++ pax_track_stack();
++
+ set_group_ind_mask (plci); /* all APPLs within this inc. call are allowed to dial in */
+
+ if(!a->group_optimization_enabled)
+diff --git a/drivers/isdn/hardware/eicon/mntfunc.c b/drivers/isdn/hardware/eicon/mntfunc.c
+index a564b75..f3cf8b5 100644
+--- a/drivers/isdn/hardware/eicon/mntfunc.c
++++ b/drivers/isdn/hardware/eicon/mntfunc.c
+@@ -79,6 +79,8 @@ static int DIVA_INIT_FUNCTION connect_didd(void)
+ IDI_SYNC_REQ req;
+ DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
+
++ pax_track_stack();
++
+ DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
+
+ for (x = 0; x < MAX_DESCRIPTORS; x++) {
+diff --git a/drivers/isdn/hardware/eicon/xdi_adapter.h b/drivers/isdn/hardware/eicon/xdi_adapter.h
+index a3bd163..8956575 100644
+--- a/drivers/isdn/hardware/eicon/xdi_adapter.h
++++ b/drivers/isdn/hardware/eicon/xdi_adapter.h
+@@ -44,7 +44,7 @@ typedef struct _xdi_mbox_t {
+ typedef struct _diva_os_idi_adapter_interface {
+ diva_init_card_proc_t cleanup_adapter_proc;
+ diva_cmd_card_proc_t cmd_proc;
+-} diva_os_idi_adapter_interface_t;
++} __no_const diva_os_idi_adapter_interface_t;
+
+ typedef struct _diva_os_xdi_adapter {
+ struct list_head link;
+diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
+index adb1e8c..21b590b 100644
+--- a/drivers/isdn/i4l/isdn_common.c
++++ b/drivers/isdn/i4l/isdn_common.c
+@@ -1290,6 +1290,8 @@ isdn_ioctl(struct inode *inode, struct file *file, uint cmd, ulong arg)
+ } iocpar;
+ void __user *argp = (void __user *)arg;
+
++ pax_track_stack();
++
+ #define name iocpar.name
+ #define bname iocpar.bname
+ #define iocts iocpar.iocts
+diff --git a/drivers/isdn/i4l/isdn_net.c b/drivers/isdn/i4l/isdn_net.c
+index 90b56ed..5ed3305 100644
+--- a/drivers/isdn/i4l/isdn_net.c
++++ b/drivers/isdn/i4l/isdn_net.c
+@@ -1902,7 +1902,7 @@ static int isdn_net_header(struct sk_buff *skb, struct net_device *dev,
+ {
+ isdn_net_local *lp = netdev_priv(dev);
+ unsigned char *p;
+- ushort len = 0;
++ int len = 0;
+
+ switch (lp->p_encap) {
+ case ISDN_NET_ENCAP_ETHER:
+diff --git a/drivers/isdn/icn/icn.c b/drivers/isdn/icn/icn.c
+index bf7997a..cf091db 100644
+--- a/drivers/isdn/icn/icn.c
++++ b/drivers/isdn/icn/icn.c
+@@ -1044,7 +1044,7 @@ icn_writecmd(const u_char * buf, int len, int user, icn_card * card)
+ if (count > len)
+ count = len;
+ if (user) {
+- if (copy_from_user(msg, buf, count))
++ if (count > sizeof msg || copy_from_user(msg, buf, count))
+ return -EFAULT;
+ } else
+ memcpy(msg, buf, count);
+diff --git a/drivers/isdn/mISDN/socket.c b/drivers/isdn/mISDN/socket.c
+index feb0fa4..f76f830 100644
+--- a/drivers/isdn/mISDN/socket.c
++++ b/drivers/isdn/mISDN/socket.c
+@@ -391,6 +391,7 @@ data_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+ if (dev) {
+ struct mISDN_devinfo di;
+
++ memset(&di, 0, sizeof(di));
+ di.id = dev->id;
+ di.Dprotocols = dev->Dprotocols;
+ di.Bprotocols = dev->Bprotocols | get_all_Bprotocols();
+@@ -671,6 +672,7 @@ base_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+ if (dev) {
+ struct mISDN_devinfo di;
+
++ memset(&di, 0, sizeof(di));
+ di.id = dev->id;
+ di.Dprotocols = dev->Dprotocols;
+ di.Bprotocols = dev->Bprotocols | get_all_Bprotocols();
+diff --git a/drivers/isdn/sc/interrupt.c b/drivers/isdn/sc/interrupt.c
+index 485be8b..f0225bc 100644
+--- a/drivers/isdn/sc/interrupt.c
++++ b/drivers/isdn/sc/interrupt.c
+@@ -112,11 +112,19 @@ irqreturn_t interrupt_handler(int dummy, void *card_inst)
+ }
+ else if(callid>=0x0000 && callid<=0x7FFF)
+ {
++ int len;
++
+ pr_debug("%s: Got Incoming Call\n",
+ sc_adapter[card]->devicename);
+- strcpy(setup.phone,&(rcvmsg.msg_data.byte_array[4]));
+- strcpy(setup.eazmsn,
+- sc_adapter[card]->channel[rcvmsg.phy_link_no-1].dn);
++ len = strlcpy(setup.phone, &(rcvmsg.msg_data.byte_array[4]),
++ sizeof(setup.phone));
++ if (len >= sizeof(setup.phone))
++ continue;
++ len = strlcpy(setup.eazmsn,
++ sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn,
++ sizeof(setup.eazmsn));
++ if (len >= sizeof(setup.eazmsn))
++ continue;
+ setup.si1 = 7;
+ setup.si2 = 0;
+ setup.plan = 0;
+@@ -176,7 +184,9 @@ irqreturn_t interrupt_handler(int dummy, void *card_inst)
+ * Handle a GetMyNumber Rsp
+ */
+ if (IS_CE_MESSAGE(rcvmsg,Call,0,GetMyNumber)){
+- strcpy(sc_adapter[card]->channel[rcvmsg.phy_link_no-1].dn,rcvmsg.msg_data.byte_array);
++ strlcpy(sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn,
++ rcvmsg.msg_data.byte_array,
++ sizeof(rcvmsg.msg_data.byte_array));
+ continue;
+ }
+
+diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c
+index 8744d24..d1f9a9a 100644
+--- a/drivers/lguest/core.c
++++ b/drivers/lguest/core.c
+@@ -91,9 +91,17 @@ static __init int map_switcher(void)
+ * it's worked so far. The end address needs +1 because __get_vm_area
+ * allocates an extra guard page, so we need space for that.
+ */
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++ switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
++ VM_ALLOC | VM_KERNEXEC, SWITCHER_ADDR, SWITCHER_ADDR
++ + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
++#else
+ switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
+ VM_ALLOC, SWITCHER_ADDR, SWITCHER_ADDR
+ + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
++#endif
++
+ if (!switcher_vma) {
+ err = -ENOMEM;
+ printk("lguest: could not map switcher pages high\n");
+@@ -118,7 +126,7 @@ static __init int map_switcher(void)
+ * Now the Switcher is mapped at the right address, we can't fail!
+ * Copy in the compiled-in Switcher code (from <arch>_switcher.S).
+ */
+- memcpy(switcher_vma->addr, start_switcher_text,
++ memcpy(switcher_vma->addr, ktla_ktva(start_switcher_text),
+ end_switcher_text - start_switcher_text);
+
+ printk(KERN_INFO "lguest: mapped switcher at %p\n",
+diff --git a/drivers/lguest/x86/core.c b/drivers/lguest/x86/core.c
+index 6ae3888..8b38145 100644
+--- a/drivers/lguest/x86/core.c
++++ b/drivers/lguest/x86/core.c
+@@ -59,7 +59,7 @@ static struct {
+ /* Offset from where switcher.S was compiled to where we've copied it */
+ static unsigned long switcher_offset(void)
+ {
+- return SWITCHER_ADDR - (unsigned long)start_switcher_text;
++ return SWITCHER_ADDR - (unsigned long)ktla_ktva(start_switcher_text);
+ }
+
+ /* This cpu's struct lguest_pages. */
+@@ -100,7 +100,13 @@ static void copy_in_guest_info(struct lg_cpu *cpu, struct lguest_pages *pages)
+ * These copies are pretty cheap, so we do them unconditionally: */
+ /* Save the current Host top-level page directory.
+ */
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++ pages->state.host_cr3 = read_cr3();
++#else
+ pages->state.host_cr3 = __pa(current->mm->pgd);
++#endif
++
+ /*
+ * Set up the Guest's page tables to see this CPU's pages (and no
+ * other CPU's pages).
+@@ -535,7 +541,7 @@ void __init lguest_arch_host_init(void)
+ * compiled-in switcher code and the high-mapped copy we just made.
+ */
+ for (i = 0; i < IDT_ENTRIES; i++)
+- default_idt_entries[i] += switcher_offset();
++ default_idt_entries[i] = ktla_ktva(default_idt_entries[i]) + switcher_offset();
+
+ /*
+ * Set up the Switcher's per-cpu areas.
+@@ -618,7 +624,7 @@ void __init lguest_arch_host_init(void)
+ * it will be undisturbed when we switch. To change %cs and jump we
+ * need this structure to feed to Intel's "lcall" instruction.
+ */
+- lguest_entry.offset = (long)switch_to_guest + switcher_offset();
++ lguest_entry.offset = (long)ktla_ktva(switch_to_guest) + switcher_offset();
+ lguest_entry.segment = LGUEST_CS;
+
+ /*
+diff --git a/drivers/lguest/x86/switcher_32.S b/drivers/lguest/x86/switcher_32.S
+index 40634b0..4f5855e 100644
+--- a/drivers/lguest/x86/switcher_32.S
++++ b/drivers/lguest/x86/switcher_32.S
+@@ -87,6 +87,7 @@
+ #include <asm/page.h>
+ #include <asm/segment.h>
+ #include <asm/lguest.h>
++#include <asm/processor-flags.h>
+
+ // We mark the start of the code to copy
+ // It's placed in .text tho it's never run here
+@@ -149,6 +150,13 @@ ENTRY(switch_to_guest)
+ // Changes type when we load it: damn Intel!
+ // For after we switch over our page tables
+ // That entry will be read-only: we'd crash.
++
++#ifdef CONFIG_PAX_KERNEXEC
++ mov %cr0, %edx
++ xor $X86_CR0_WP, %edx
++ mov %edx, %cr0
++#endif
++
+ movl $(GDT_ENTRY_TSS*8), %edx
+ ltr %dx
+
+@@ -157,9 +165,15 @@ ENTRY(switch_to_guest)
+ // Let's clear it again for our return.
+ // The GDT descriptor of the Host
+ // Points to the table after two "size" bytes
+- movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %edx
++ movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %eax
+ // Clear "used" from type field (byte 5, bit 2)
+- andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%edx)
++ andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%eax)
++
++#ifdef CONFIG_PAX_KERNEXEC
++ mov %cr0, %eax
++ xor $X86_CR0_WP, %eax
++ mov %eax, %cr0
++#endif
+
+ // Once our page table's switched, the Guest is live!
+ // The Host fades as we run this final step.
+@@ -295,13 +309,12 @@ deliver_to_host:
+ // I consulted gcc, and it gave
+ // These instructions, which I gladly credit:
+ leal (%edx,%ebx,8), %eax
+- movzwl (%eax),%edx
+- movl 4(%eax), %eax
+- xorw %ax, %ax
+- orl %eax, %edx
++ movl 4(%eax), %edx
++ movw (%eax), %dx
+ // Now the address of the handler's in %edx
+ // We call it now: its "iret" drops us home.
+- jmp *%edx
++ ljmp $__KERNEL_CS, $1f
++1: jmp *%edx
+
+ // Every interrupt can come to us here
+ // But we must truly tell each apart.
+diff --git a/drivers/macintosh/macio_asic.c b/drivers/macintosh/macio_asic.c
+index 588a5b0..b71db89 100644
+--- a/drivers/macintosh/macio_asic.c
++++ b/drivers/macintosh/macio_asic.c
+@@ -701,7 +701,7 @@ static void __devexit macio_pci_remove(struct pci_dev* pdev)
+ * MacIO is matched against any Apple ID, it's probe() function
+ * will then decide wether it applies or not
+ */
+-static const struct pci_device_id __devinitdata pci_ids [] = { {
++static const struct pci_device_id __devinitconst pci_ids [] = { {
+ .vendor = PCI_VENDOR_ID_APPLE,
+ .device = PCI_ANY_ID,
+ .subvendor = PCI_ANY_ID,
+diff --git a/drivers/macintosh/via-pmu-backlight.c b/drivers/macintosh/via-pmu-backlight.c
+index a348bb0..ecd9b3f 100644
+--- a/drivers/macintosh/via-pmu-backlight.c
++++ b/drivers/macintosh/via-pmu-backlight.c
+@@ -15,7 +15,7 @@
+
+ #define MAX_PMU_LEVEL 0xFF
+
+-static struct backlight_ops pmu_backlight_data;
++static const struct backlight_ops pmu_backlight_data;
+ static DEFINE_SPINLOCK(pmu_backlight_lock);
+ static int sleeping, uses_pmu_bl;
+ static u8 bl_curve[FB_BACKLIGHT_LEVELS];
+@@ -115,7 +115,7 @@ static int pmu_backlight_get_brightness(struct backlight_device *bd)
+ return bd->props.brightness;
+ }
+
+-static struct backlight_ops pmu_backlight_data = {
++static const struct backlight_ops pmu_backlight_data = {
+ .get_brightness = pmu_backlight_get_brightness,
+ .update_status = pmu_backlight_update_status,
+
+diff --git a/drivers/macintosh/via-pmu.c b/drivers/macintosh/via-pmu.c
+index 6f308a4..b5f7ff7 100644
+--- a/drivers/macintosh/via-pmu.c
++++ b/drivers/macintosh/via-pmu.c
+@@ -2232,7 +2232,7 @@ static int pmu_sleep_valid(suspend_state_t state)
+ && (pmac_call_feature(PMAC_FTR_SLEEP_STATE, NULL, 0, -1) >= 0);
+ }
+
+-static struct platform_suspend_ops pmu_pm_ops = {
++static const struct platform_suspend_ops pmu_pm_ops = {
+ .enter = powerbook_sleep,
+ .valid = pmu_sleep_valid,
+ };
+diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
+index 818b617..4656e38 100644
+--- a/drivers/md/dm-ioctl.c
++++ b/drivers/md/dm-ioctl.c
+@@ -1437,7 +1437,7 @@ static int validate_params(uint cmd, struct dm_ioctl *param)
+ cmd == DM_LIST_VERSIONS_CMD)
+ return 0;
+
+- if ((cmd == DM_DEV_CREATE_CMD)) {
++ if (cmd == DM_DEV_CREATE_CMD) {
+ if (!*param->name) {
+ DMWARN("name not supplied when creating device");
+ return -EINVAL;
+diff --git a/drivers/md/dm-log-userspace-transfer.c b/drivers/md/dm-log-userspace-transfer.c
+index f1c8cae..59f0822 100644
+--- a/drivers/md/dm-log-userspace-transfer.c
++++ b/drivers/md/dm-log-userspace-transfer.c
+@@ -133,7 +133,7 @@ static void cn_ulog_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
+ {
+ struct dm_ulog_request *tfr = (struct dm_ulog_request *)(msg + 1);
+
+- if (!cap_raised(nsp->eff_cap, CAP_SYS_ADMIN))
++ if (!capable(CAP_SYS_ADMIN))
+ return;
+
+ spin_lock(&receiving_list_lock);
+diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
+index 6021d0a..a878643 100644
+--- a/drivers/md/dm-raid1.c
++++ b/drivers/md/dm-raid1.c
+@@ -41,7 +41,7 @@ enum dm_raid1_error {
+
+ struct mirror {
+ struct mirror_set *ms;
+- atomic_t error_count;
++ atomic_unchecked_t error_count;
+ unsigned long error_type;
+ struct dm_dev *dev;
+ sector_t offset;
+@@ -203,7 +203,7 @@ static void fail_mirror(struct mirror *m, enum dm_raid1_error error_type)
+ * simple way to tell if a device has encountered
+ * errors.
+ */
+- atomic_inc(&m->error_count);
++ atomic_inc_unchecked(&m->error_count);
+
+ if (test_and_set_bit(error_type, &m->error_type))
+ return;
+@@ -225,7 +225,7 @@ static void fail_mirror(struct mirror *m, enum dm_raid1_error error_type)
+ }
+
+ for (new = ms->mirror; new < ms->mirror + ms->nr_mirrors; new++)
+- if (!atomic_read(&new->error_count)) {
++ if (!atomic_read_unchecked(&new->error_count)) {
+ set_default_mirror(new);
+ break;
+ }
+@@ -363,7 +363,7 @@ static struct mirror *choose_mirror(struct mirror_set *ms, sector_t sector)
+ struct mirror *m = get_default_mirror(ms);
+
+ do {
+- if (likely(!atomic_read(&m->error_count)))
++ if (likely(!atomic_read_unchecked(&m->error_count)))
+ return m;
+
+ if (m-- == ms->mirror)
+@@ -377,7 +377,7 @@ static int default_ok(struct mirror *m)
+ {
+ struct mirror *default_mirror = get_default_mirror(m->ms);
+
+- return !atomic_read(&default_mirror->error_count);
++ return !atomic_read_unchecked(&default_mirror->error_count);
+ }
+
+ static int mirror_available(struct mirror_set *ms, struct bio *bio)
+@@ -484,7 +484,7 @@ static void do_reads(struct mirror_set *ms, struct bio_list *reads)
+ */
+ if (likely(region_in_sync(ms, region, 1)))
+ m = choose_mirror(ms, bio->bi_sector);
+- else if (m && atomic_read(&m->error_count))
++ else if (m && atomic_read_unchecked(&m->error_count))
+ m = NULL;
+
+ if (likely(m))
+@@ -855,7 +855,7 @@ static int get_mirror(struct mirror_set *ms, struct dm_target *ti,
+ }
+
+ ms->mirror[mirror].ms = ms;
+- atomic_set(&(ms->mirror[mirror].error_count), 0);
++ atomic_set_unchecked(&(ms->mirror[mirror].error_count), 0);
+ ms->mirror[mirror].error_type = 0;
+ ms->mirror[mirror].offset = offset;
+
+@@ -1241,7 +1241,7 @@ static void mirror_resume(struct dm_target *ti)
+ */
+ static char device_status_char(struct mirror *m)
+ {
+- if (!atomic_read(&(m->error_count)))
++ if (!atomic_read_unchecked(&(m->error_count)))
+ return 'A';
+
+ return (test_bit(DM_RAID1_WRITE_ERROR, &(m->error_type))) ? 'D' :
+diff --git a/drivers/md/dm-stripe.c b/drivers/md/dm-stripe.c
+index bd58703..9f26571 100644
+--- a/drivers/md/dm-stripe.c
++++ b/drivers/md/dm-stripe.c
+@@ -20,7 +20,7 @@ struct stripe {
+ struct dm_dev *dev;
+ sector_t physical_start;
+
+- atomic_t error_count;
++ atomic_unchecked_t error_count;
+ };
+
+ struct stripe_c {
+@@ -188,7 +188,7 @@ static int stripe_ctr(struct dm_target *ti, unsigned int argc, char **argv)
+ kfree(sc);
+ return r;
+ }
+- atomic_set(&(sc->stripe[i].error_count), 0);
++ atomic_set_unchecked(&(sc->stripe[i].error_count), 0);
+ }
+
+ ti->private = sc;
+@@ -257,7 +257,7 @@ static int stripe_status(struct dm_target *ti,
+ DMEMIT("%d ", sc->stripes);
+ for (i = 0; i < sc->stripes; i++) {
+ DMEMIT("%s ", sc->stripe[i].dev->name);
+- buffer[i] = atomic_read(&(sc->stripe[i].error_count)) ?
++ buffer[i] = atomic_read_unchecked(&(sc->stripe[i].error_count)) ?
+ 'D' : 'A';
+ }
+ buffer[i] = '\0';
+@@ -304,8 +304,8 @@ static int stripe_end_io(struct dm_target *ti, struct bio *bio,
+ */
+ for (i = 0; i < sc->stripes; i++)
+ if (!strcmp(sc->stripe[i].dev->name, major_minor)) {
+- atomic_inc(&(sc->stripe[i].error_count));
+- if (atomic_read(&(sc->stripe[i].error_count)) <
++ atomic_inc_unchecked(&(sc->stripe[i].error_count));
++ if (atomic_read_unchecked(&(sc->stripe[i].error_count)) <
+ DM_IO_ERROR_THRESHOLD)
+ queue_work(kstriped, &sc->kstriped_ws);
+ }
+diff --git a/drivers/md/dm-sysfs.c b/drivers/md/dm-sysfs.c
+index 4b04590..13a77b2 100644
+--- a/drivers/md/dm-sysfs.c
++++ b/drivers/md/dm-sysfs.c
+@@ -75,7 +75,7 @@ static struct attribute *dm_attrs[] = {
+ NULL,
+ };
+
+-static struct sysfs_ops dm_sysfs_ops = {
++static const struct sysfs_ops dm_sysfs_ops = {
+ .show = dm_attr_show,
+ };
+
+diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
+index 03345bb..332250d 100644
+--- a/drivers/md/dm-table.c
++++ b/drivers/md/dm-table.c
+@@ -376,7 +376,7 @@ static int device_area_is_invalid(struct dm_target *ti, struct dm_dev *dev,
+ if (!dev_size)
+ return 0;
+
+- if ((start >= dev_size) || (start + len > dev_size)) {
++ if ((start >= dev_size) || (len > dev_size - start)) {
+ DMWARN("%s: %s too small for target: "
+ "start=%llu, len=%llu, dev_size=%llu",
+ dm_device_name(ti->table->md), bdevname(bdev, b),
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index c988ac2..c418141 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -165,9 +165,9 @@ struct mapped_device {
+ /*
+ * Event handling.
+ */
+- atomic_t event_nr;
++ atomic_unchecked_t event_nr;
+ wait_queue_head_t eventq;
+- atomic_t uevent_seq;
++ atomic_unchecked_t uevent_seq;
+ struct list_head uevent_list;
+ spinlock_t uevent_lock; /* Protect access to uevent_list */
+
+@@ -1776,8 +1776,8 @@ static struct mapped_device *alloc_dev(int minor)
+ rwlock_init(&md->map_lock);
+ atomic_set(&md->holders, 1);
+ atomic_set(&md->open_count, 0);
+- atomic_set(&md->event_nr, 0);
+- atomic_set(&md->uevent_seq, 0);
++ atomic_set_unchecked(&md->event_nr, 0);
++ atomic_set_unchecked(&md->uevent_seq, 0);
+ INIT_LIST_HEAD(&md->uevent_list);
+ spin_lock_init(&md->uevent_lock);
+
+@@ -1927,7 +1927,7 @@ static void event_callback(void *context)
+
+ dm_send_uevents(&uevents, &disk_to_dev(md->disk)->kobj);
+
+- atomic_inc(&md->event_nr);
++ atomic_inc_unchecked(&md->event_nr);
+ wake_up(&md->eventq);
+ }
+
+@@ -2562,18 +2562,18 @@ void dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
+
+ uint32_t dm_next_uevent_seq(struct mapped_device *md)
+ {
+- return atomic_add_return(1, &md->uevent_seq);
++ return atomic_add_return_unchecked(1, &md->uevent_seq);
+ }
+
+ uint32_t dm_get_event_nr(struct mapped_device *md)
+ {
+- return atomic_read(&md->event_nr);
++ return atomic_read_unchecked(&md->event_nr);
+ }
+
+ int dm_wait_event(struct mapped_device *md, int event_nr)
+ {
+ return wait_event_interruptible(md->eventq,
+- (event_nr != atomic_read(&md->event_nr)));
++ (event_nr != atomic_read_unchecked(&md->event_nr)));
+ }
+
+ void dm_uevent_add(struct mapped_device *md, struct list_head *elist)
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 4ce6e2f..7a9530a 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -153,10 +153,10 @@ static int start_readonly;
+ * start build, activate spare
+ */
+ static DECLARE_WAIT_QUEUE_HEAD(md_event_waiters);
+-static atomic_t md_event_count;
++static atomic_unchecked_t md_event_count;
+ void md_new_event(mddev_t *mddev)
+ {
+- atomic_inc(&md_event_count);
++ atomic_inc_unchecked(&md_event_count);
+ wake_up(&md_event_waiters);
+ }
+ EXPORT_SYMBOL_GPL(md_new_event);
+@@ -166,7 +166,7 @@ EXPORT_SYMBOL_GPL(md_new_event);
+ */
+ static void md_new_event_inintr(mddev_t *mddev)
+ {
+- atomic_inc(&md_event_count);
++ atomic_inc_unchecked(&md_event_count);
+ wake_up(&md_event_waiters);
+ }
+
+@@ -1226,7 +1226,7 @@ static int super_1_load(mdk_rdev_t *rdev, mdk_rdev_t *refdev, int minor_version)
+
+ rdev->preferred_minor = 0xffff;
+ rdev->data_offset = le64_to_cpu(sb->data_offset);
+- atomic_set(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
++ atomic_set_unchecked(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
+
+ rdev->sb_size = le32_to_cpu(sb->max_dev) * 2 + 256;
+ bmask = queue_logical_block_size(rdev->bdev->bd_disk->queue)-1;
+@@ -1400,7 +1400,7 @@ static void super_1_sync(mddev_t *mddev, mdk_rdev_t *rdev)
+ else
+ sb->resync_offset = cpu_to_le64(0);
+
+- sb->cnt_corrected_read = cpu_to_le32(atomic_read(&rdev->corrected_errors));
++ sb->cnt_corrected_read = cpu_to_le32(atomic_read_unchecked(&rdev->corrected_errors));
+
+ sb->raid_disks = cpu_to_le32(mddev->raid_disks);
+ sb->size = cpu_to_le64(mddev->dev_sectors);
+@@ -2222,7 +2222,7 @@ __ATTR(state, S_IRUGO|S_IWUSR, state_show, state_store);
+ static ssize_t
+ errors_show(mdk_rdev_t *rdev, char *page)
+ {
+- return sprintf(page, "%d\n", atomic_read(&rdev->corrected_errors));
++ return sprintf(page, "%d\n", atomic_read_unchecked(&rdev->corrected_errors));
+ }
+
+ static ssize_t
+@@ -2231,7 +2231,7 @@ errors_store(mdk_rdev_t *rdev, const char *buf, size_t len)
+ char *e;
+ unsigned long n = simple_strtoul(buf, &e, 10);
+ if (*buf && (*e == 0 || *e == '\n')) {
+- atomic_set(&rdev->corrected_errors, n);
++ atomic_set_unchecked(&rdev->corrected_errors, n);
+ return len;
+ }
+ return -EINVAL;
+@@ -2525,7 +2525,7 @@ static void rdev_free(struct kobject *ko)
+ mdk_rdev_t *rdev = container_of(ko, mdk_rdev_t, kobj);
+ kfree(rdev);
+ }
+-static struct sysfs_ops rdev_sysfs_ops = {
++static const struct sysfs_ops rdev_sysfs_ops = {
+ .show = rdev_attr_show,
+ .store = rdev_attr_store,
+ };
+@@ -2574,8 +2574,8 @@ static mdk_rdev_t *md_import_device(dev_t newdev, int super_format, int super_mi
+ rdev->data_offset = 0;
+ rdev->sb_events = 0;
+ atomic_set(&rdev->nr_pending, 0);
+- atomic_set(&rdev->read_errors, 0);
+- atomic_set(&rdev->corrected_errors, 0);
++ atomic_set_unchecked(&rdev->read_errors, 0);
++ atomic_set_unchecked(&rdev->corrected_errors, 0);
+
+ size = rdev->bdev->bd_inode->i_size >> BLOCK_SIZE_BITS;
+ if (!size) {
+@@ -3895,7 +3895,7 @@ static void md_free(struct kobject *ko)
+ kfree(mddev);
+ }
+
+-static struct sysfs_ops md_sysfs_ops = {
++static const struct sysfs_ops md_sysfs_ops = {
+ .show = md_attr_show,
+ .store = md_attr_store,
+ };
+@@ -4482,7 +4482,8 @@ out:
+ err = 0;
+ blk_integrity_unregister(disk);
+ md_new_event(mddev);
+- sysfs_notify_dirent(mddev->sysfs_state);
++ if (mddev->sysfs_state)
++ sysfs_notify_dirent(mddev->sysfs_state);
+ return err;
+ }
+
+@@ -5962,7 +5963,7 @@ static int md_seq_show(struct seq_file *seq, void *v)
+
+ spin_unlock(&pers_lock);
+ seq_printf(seq, "\n");
+- mi->event = atomic_read(&md_event_count);
++ mi->event = atomic_read_unchecked(&md_event_count);
+ return 0;
+ }
+ if (v == (void*)2) {
+@@ -6051,7 +6052,7 @@ static int md_seq_show(struct seq_file *seq, void *v)
+ chunk_kb ? "KB" : "B");
+ if (bitmap->file) {
+ seq_printf(seq, ", file: ");
+- seq_path(seq, &bitmap->file->f_path, " \t\n");
++ seq_path(seq, &bitmap->file->f_path, " \t\n\\");
+ }
+
+ seq_printf(seq, "\n");
+@@ -6085,7 +6086,7 @@ static int md_seq_open(struct inode *inode, struct file *file)
+ else {
+ struct seq_file *p = file->private_data;
+ p->private = mi;
+- mi->event = atomic_read(&md_event_count);
++ mi->event = atomic_read_unchecked(&md_event_count);
+ }
+ return error;
+ }
+@@ -6101,7 +6102,7 @@ static unsigned int mdstat_poll(struct file *filp, poll_table *wait)
+ /* always allow read */
+ mask = POLLIN | POLLRDNORM;
+
+- if (mi->event != atomic_read(&md_event_count))
++ if (mi->event != atomic_read_unchecked(&md_event_count))
+ mask |= POLLERR | POLLPRI;
+ return mask;
+ }
+@@ -6145,7 +6146,7 @@ static int is_mddev_idle(mddev_t *mddev, int init)
+ struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
+ curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
+ (int)part_stat_read(&disk->part0, sectors[1]) -
+- atomic_read(&disk->sync_io);
++ atomic_read_unchecked(&disk->sync_io);
+ /* sync IO will cause sync_io to increase before the disk_stats
+ * as sync_io is counted when a request starts, and
+ * disk_stats is counted when it completes.
+diff --git a/drivers/md/md.h b/drivers/md/md.h
+index 87430fe..0024a4c 100644
+--- a/drivers/md/md.h
++++ b/drivers/md/md.h
+@@ -94,10 +94,10 @@ struct mdk_rdev_s
+ * only maintained for arrays that
+ * support hot removal
+ */
+- atomic_t read_errors; /* number of consecutive read errors that
++ atomic_unchecked_t read_errors; /* number of consecutive read errors that
+ * we have tried to ignore.
+ */
+- atomic_t corrected_errors; /* number of corrected read errors,
++ atomic_unchecked_t corrected_errors; /* number of corrected read errors,
+ * for reporting to userspace and storing
+ * in superblock.
+ */
+@@ -304,7 +304,7 @@ static inline void rdev_dec_pending(mdk_rdev_t *rdev, mddev_t *mddev)
+
+ static inline void md_sync_acct(struct block_device *bdev, unsigned long nr_sectors)
+ {
+- atomic_add(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
++ atomic_add_unchecked(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
+ }
+
+ struct mdk_personality
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index 968cb14..f0ad2e4 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -1415,7 +1415,7 @@ static void sync_request_write(mddev_t *mddev, r1bio_t *r1_bio)
+ if (r1_bio->bios[d]->bi_end_io != end_sync_read)
+ continue;
+ rdev = conf->mirrors[d].rdev;
+- atomic_add(s, &rdev->corrected_errors);
++ atomic_add_unchecked(s, &rdev->corrected_errors);
+ if (sync_page_io(rdev->bdev,
+ sect + rdev->data_offset,
+ s<<9,
+@@ -1564,7 +1564,7 @@ static void fix_read_error(conf_t *conf, int read_disk,
+ /* Well, this device is dead */
+ md_error(mddev, rdev);
+ else {
+- atomic_add(s, &rdev->corrected_errors);
++ atomic_add_unchecked(s, &rdev->corrected_errors);
+ printk(KERN_INFO
+ "raid1:%s: read error corrected "
+ "(%d sectors at %llu on %s)\n",
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 1b4e232..cf0f534b 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -1255,7 +1255,7 @@ static void end_sync_read(struct bio *bio, int error)
+ if (test_bit(BIO_UPTODATE, &bio->bi_flags))
+ set_bit(R10BIO_Uptodate, &r10_bio->state);
+ else {
+- atomic_add(r10_bio->sectors,
++ atomic_add_unchecked(r10_bio->sectors,
+ &conf->mirrors[d].rdev->corrected_errors);
+ if (!test_bit(MD_RECOVERY_SYNC, &conf->mddev->recovery))
+ md_error(r10_bio->mddev,
+@@ -1520,7 +1520,7 @@ static void fix_read_error(conf_t *conf, mddev_t *mddev, r10bio_t *r10_bio)
+ test_bit(In_sync, &rdev->flags)) {
+ atomic_inc(&rdev->nr_pending);
+ rcu_read_unlock();
+- atomic_add(s, &rdev->corrected_errors);
++ atomic_add_unchecked(s, &rdev->corrected_errors);
+ if (sync_page_io(rdev->bdev,
+ r10_bio->devs[sl].addr +
+ sect + rdev->data_offset,
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index 883215d..675bf47 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -482,7 +482,7 @@ static void ops_run_io(struct stripe_head *sh, struct stripe_head_state *s)
+ bi->bi_next = NULL;
+ if ((rw & WRITE) &&
+ test_bit(R5_ReWrite, &sh->dev[i].flags))
+- atomic_add(STRIPE_SECTORS,
++ atomic_add_unchecked(STRIPE_SECTORS,
+ &rdev->corrected_errors);
+ generic_make_request(bi);
+ } else {
+@@ -1517,15 +1517,15 @@ static void raid5_end_read_request(struct bio * bi, int error)
+ clear_bit(R5_ReadError, &sh->dev[i].flags);
+ clear_bit(R5_ReWrite, &sh->dev[i].flags);
+ }
+- if (atomic_read(&conf->disks[i].rdev->read_errors))
+- atomic_set(&conf->disks[i].rdev->read_errors, 0);
++ if (atomic_read_unchecked(&conf->disks[i].rdev->read_errors))
++ atomic_set_unchecked(&conf->disks[i].rdev->read_errors, 0);
+ } else {
+ const char *bdn = bdevname(conf->disks[i].rdev->bdev, b);
+ int retry = 0;
+ rdev = conf->disks[i].rdev;
+
+ clear_bit(R5_UPTODATE, &sh->dev[i].flags);
+- atomic_inc(&rdev->read_errors);
++ atomic_inc_unchecked(&rdev->read_errors);
+ if (conf->mddev->degraded >= conf->max_degraded)
+ printk_rl(KERN_WARNING
+ "raid5:%s: read error not correctable "
+@@ -1543,7 +1543,7 @@ static void raid5_end_read_request(struct bio * bi, int error)
+ (unsigned long long)(sh->sector
+ + rdev->data_offset),
+ bdn);
+- else if (atomic_read(&rdev->read_errors)
++ else if (atomic_read_unchecked(&rdev->read_errors)
+ > conf->max_nr_stripes)
+ printk(KERN_WARNING
+ "raid5:%s: Too many read errors, failing device %s.\n",
+@@ -1870,6 +1870,7 @@ static sector_t compute_blocknr(struct stripe_head *sh, int i, int previous)
+ sector_t r_sector;
+ struct stripe_head sh2;
+
++ pax_track_stack();
+
+ chunk_offset = sector_div(new_sector, sectors_per_chunk);
+ stripe = new_sector;
+diff --git a/drivers/media/common/saa7146_hlp.c b/drivers/media/common/saa7146_hlp.c
+index 05bde9c..2f31d40 100644
+--- a/drivers/media/common/saa7146_hlp.c
++++ b/drivers/media/common/saa7146_hlp.c
+@@ -353,6 +353,8 @@ static void calculate_clipping_registers_rect(struct saa7146_dev *dev, struct sa
+
+ int x[32], y[32], w[32], h[32];
+
++ pax_track_stack();
++
+ /* clear out memory */
+ memset(&line_list[0], 0x00, sizeof(u32)*32);
+ memset(&pixel_list[0], 0x00, sizeof(u32)*32);
+diff --git a/drivers/media/dvb/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
+index cb22da5..82b686e 100644
+--- a/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
++++ b/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
+@@ -590,6 +590,8 @@ static int dvb_ca_en50221_read_data(struct dvb_ca_private *ca, int slot, u8 * eb
+ u8 buf[HOST_LINK_BUF_SIZE];
+ int i;
+
++ pax_track_stack();
++
+ dprintk("%s\n", __func__);
+
+ /* check if we have space for a link buf in the rx_buffer */
+@@ -1285,6 +1287,8 @@ static ssize_t dvb_ca_en50221_io_write(struct file *file,
+ unsigned long timeout;
+ int written;
+
++ pax_track_stack();
++
+ dprintk("%s\n", __func__);
+
+ /* Incoming packet has a 2 byte header. hdr[0] = slot_id, hdr[1] = connection_id */
+diff --git a/drivers/media/dvb/dvb-core/dvb_demux.h b/drivers/media/dvb/dvb-core/dvb_demux.h
+index 2fe05d0..a3289c4 100644
+--- a/drivers/media/dvb/dvb-core/dvb_demux.h
++++ b/drivers/media/dvb/dvb-core/dvb_demux.h
+@@ -71,7 +71,7 @@ struct dvb_demux_feed {
+ union {
+ dmx_ts_cb ts;
+ dmx_section_cb sec;
+- } cb;
++ } __no_const cb;
+
+ struct dvb_demux *demux;
+ void *priv;
+diff --git a/drivers/media/dvb/dvb-core/dvbdev.c b/drivers/media/dvb/dvb-core/dvbdev.c
+index 94159b9..376bd8e 100644
+--- a/drivers/media/dvb/dvb-core/dvbdev.c
++++ b/drivers/media/dvb/dvb-core/dvbdev.c
+@@ -191,7 +191,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev,
+ const struct dvb_device *template, void *priv, int type)
+ {
+ struct dvb_device *dvbdev;
+- struct file_operations *dvbdevfops;
++ file_operations_no_const *dvbdevfops;
+ struct device *clsdev;
+ int minor;
+ int id;
+diff --git a/drivers/media/dvb/dvb-usb/cxusb.c b/drivers/media/dvb/dvb-usb/cxusb.c
+index 2a53dd0..db8c07a 100644
+--- a/drivers/media/dvb/dvb-usb/cxusb.c
++++ b/drivers/media/dvb/dvb-usb/cxusb.c
+@@ -1040,7 +1040,7 @@ static struct dib0070_config dib7070p_dib0070_config = {
+ struct dib0700_adapter_state {
+ int (*set_param_save) (struct dvb_frontend *,
+ struct dvb_frontend_parameters *);
+-};
++} __no_const;
+
+ static int dib7070_set_param_override(struct dvb_frontend *fe,
+ struct dvb_frontend_parameters *fep)
+diff --git a/drivers/media/dvb/dvb-usb/dib0700_core.c b/drivers/media/dvb/dvb-usb/dib0700_core.c
+index db7f7f7..f55e96f 100644
+--- a/drivers/media/dvb/dvb-usb/dib0700_core.c
++++ b/drivers/media/dvb/dvb-usb/dib0700_core.c
+@@ -332,6 +332,8 @@ int dib0700_download_firmware(struct usb_device *udev, const struct firmware *fw
+
+ u8 buf[260];
+
++ pax_track_stack();
++
+ while ((ret = dvb_usb_get_hexline(fw, &hx, &pos)) > 0) {
+ deb_fwdata("writing to address 0x%08x (buffer: 0x%02x %02x)\n",hx.addr, hx.len, hx.chk);
+
+diff --git a/drivers/media/dvb/dvb-usb/dib0700_devices.c b/drivers/media/dvb/dvb-usb/dib0700_devices.c
+index 524acf5..5ffc403 100644
+--- a/drivers/media/dvb/dvb-usb/dib0700_devices.c
++++ b/drivers/media/dvb/dvb-usb/dib0700_devices.c
+@@ -28,7 +28,7 @@ MODULE_PARM_DESC(force_lna_activation, "force the activation of Low-Noise-Amplif
+
+ struct dib0700_adapter_state {
+ int (*set_param_save) (struct dvb_frontend *, struct dvb_frontend_parameters *);
+-};
++} __no_const;
+
+ /* Hauppauge Nova-T 500 (aka Bristol)
+ * has a LNA on GPIO0 which is enabled by setting 1 */
+diff --git a/drivers/media/dvb/frontends/dib3000.h b/drivers/media/dvb/frontends/dib3000.h
+index ba91735..4261d84 100644
+--- a/drivers/media/dvb/frontends/dib3000.h
++++ b/drivers/media/dvb/frontends/dib3000.h
+@@ -39,7 +39,7 @@ struct dib_fe_xfer_ops
+ int (*fifo_ctrl)(struct dvb_frontend *fe, int onoff);
+ int (*pid_ctrl)(struct dvb_frontend *fe, int index, int pid, int onoff);
+ int (*tuner_pass_ctrl)(struct dvb_frontend *fe, int onoff, u8 pll_ctrl);
+-};
++} __no_const;
+
+ #if defined(CONFIG_DVB_DIB3000MB) || (defined(CONFIG_DVB_DIB3000MB_MODULE) && defined(MODULE))
+ extern struct dvb_frontend* dib3000mb_attach(const struct dib3000_config* config,
+diff --git a/drivers/media/dvb/frontends/or51211.c b/drivers/media/dvb/frontends/or51211.c
+index c709ce6..b3fe620 100644
+--- a/drivers/media/dvb/frontends/or51211.c
++++ b/drivers/media/dvb/frontends/or51211.c
+@@ -113,6 +113,8 @@ static int or51211_load_firmware (struct dvb_frontend* fe,
+ u8 tudata[585];
+ int i;
+
++ pax_track_stack();
++
+ dprintk("Firmware is %zd bytes\n",fw->size);
+
+ /* Get eprom data */
+diff --git a/drivers/media/radio/radio-cadet.c b/drivers/media/radio/radio-cadet.c
+index 482d0f3..ee1e202 100644
+--- a/drivers/media/radio/radio-cadet.c
++++ b/drivers/media/radio/radio-cadet.c
+@@ -347,7 +347,7 @@ static ssize_t cadet_read(struct file *file, char __user *data, size_t count, lo
+ while (i < count && dev->rdsin != dev->rdsout)
+ readbuf[i++] = dev->rdsbuf[dev->rdsout++];
+
+- if (copy_to_user(data, readbuf, i))
++ if (i > sizeof readbuf || copy_to_user(data, readbuf, i))
+ return -EFAULT;
+ return i;
+ }
+diff --git a/drivers/media/video/cx18/cx18-driver.c b/drivers/media/video/cx18/cx18-driver.c
+index 6dd51e2..0359b92 100644
+--- a/drivers/media/video/cx18/cx18-driver.c
++++ b/drivers/media/video/cx18/cx18-driver.c
+@@ -56,7 +56,7 @@ static struct pci_device_id cx18_pci_tbl[] __devinitdata = {
+
+ MODULE_DEVICE_TABLE(pci, cx18_pci_tbl);
+
+-static atomic_t cx18_instance = ATOMIC_INIT(0);
++static atomic_unchecked_t cx18_instance = ATOMIC_INIT(0);
+
+ /* Parameter declarations */
+ static int cardtype[CX18_MAX_CARDS];
+@@ -288,6 +288,8 @@ void cx18_read_eeprom(struct cx18 *cx, struct tveeprom *tv)
+ struct i2c_client c;
+ u8 eedata[256];
+
++ pax_track_stack();
++
+ memset(&c, 0, sizeof(c));
+ strlcpy(c.name, "cx18 tveeprom tmp", sizeof(c.name));
+ c.adapter = &cx->i2c_adap[0];
+@@ -800,7 +802,7 @@ static int __devinit cx18_probe(struct pci_dev *pci_dev,
+ struct cx18 *cx;
+
+ /* FIXME - module parameter arrays constrain max instances */
+- i = atomic_inc_return(&cx18_instance) - 1;
++ i = atomic_inc_return_unchecked(&cx18_instance) - 1;
+ if (i >= CX18_MAX_CARDS) {
+ printk(KERN_ERR "cx18: cannot manage card %d, driver has a "
+ "limit of 0 - %d\n", i, CX18_MAX_CARDS - 1);
+diff --git a/drivers/media/video/ivtv/ivtv-driver.c b/drivers/media/video/ivtv/ivtv-driver.c
+index 463ec34..2f4625a 100644
+--- a/drivers/media/video/ivtv/ivtv-driver.c
++++ b/drivers/media/video/ivtv/ivtv-driver.c
+@@ -79,7 +79,7 @@ static struct pci_device_id ivtv_pci_tbl[] __devinitdata = {
+ MODULE_DEVICE_TABLE(pci,ivtv_pci_tbl);
+
+ /* ivtv instance counter */
+-static atomic_t ivtv_instance = ATOMIC_INIT(0);
++static atomic_unchecked_t ivtv_instance = ATOMIC_INIT(0);
+
+ /* Parameter declarations */
+ static int cardtype[IVTV_MAX_CARDS];
+diff --git a/drivers/media/video/omap24xxcam.c b/drivers/media/video/omap24xxcam.c
+index 5fc4ac0..652a54a 100644
+--- a/drivers/media/video/omap24xxcam.c
++++ b/drivers/media/video/omap24xxcam.c
+@@ -401,7 +401,7 @@ static void omap24xxcam_vbq_complete(struct omap24xxcam_sgdma *sgdma,
+ spin_unlock_irqrestore(&cam->core_enable_disable_lock, flags);
+
+ do_gettimeofday(&vb->ts);
+- vb->field_count = atomic_add_return(2, &fh->field_count);
++ vb->field_count = atomic_add_return_unchecked(2, &fh->field_count);
+ if (csr & csr_error) {
+ vb->state = VIDEOBUF_ERROR;
+ if (!atomic_read(&fh->cam->in_reset)) {
+diff --git a/drivers/media/video/omap24xxcam.h b/drivers/media/video/omap24xxcam.h
+index 2ce67f5..cf26a5b 100644
+--- a/drivers/media/video/omap24xxcam.h
++++ b/drivers/media/video/omap24xxcam.h
+@@ -533,7 +533,7 @@ struct omap24xxcam_fh {
+ spinlock_t vbq_lock; /* spinlock for the videobuf queue */
+ struct videobuf_queue vbq;
+ struct v4l2_pix_format pix; /* serialise pix by vbq->lock */
+- atomic_t field_count; /* field counter for videobuf_buffer */
++ atomic_unchecked_t field_count; /* field counter for videobuf_buffer */
+ /* accessing cam here doesn't need serialisation: it's constant */
+ struct omap24xxcam_device *cam;
+ };
+diff --git a/drivers/media/video/pvrusb2/pvrusb2-eeprom.c b/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
+index 299afa4..eb47459 100644
+--- a/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
++++ b/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
+@@ -119,6 +119,8 @@ int pvr2_eeprom_analyze(struct pvr2_hdw *hdw)
+ u8 *eeprom;
+ struct tveeprom tvdata;
+
++ pax_track_stack();
++
+ memset(&tvdata,0,sizeof(tvdata));
+
+ eeprom = pvr2_eeprom_fetch(hdw);
+diff --git a/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h b/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h
+index 5b152ff..3320638 100644
+--- a/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h
++++ b/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h
+@@ -195,7 +195,7 @@ struct pvr2_hdw {
+
+ /* I2C stuff */
+ struct i2c_adapter i2c_adap;
+- struct i2c_algorithm i2c_algo;
++ i2c_algorithm_no_const i2c_algo;
+ pvr2_i2c_func i2c_func[PVR2_I2C_FUNC_CNT];
+ int i2c_cx25840_hack_state;
+ int i2c_linked;
+diff --git a/drivers/media/video/saa7134/saa6752hs.c b/drivers/media/video/saa7134/saa6752hs.c
+index 1eabff6..8e2313a 100644
+--- a/drivers/media/video/saa7134/saa6752hs.c
++++ b/drivers/media/video/saa7134/saa6752hs.c
+@@ -683,6 +683,8 @@ static int saa6752hs_init(struct v4l2_subdev *sd, u32 leading_null_bytes)
+ unsigned char localPAT[256];
+ unsigned char localPMT[256];
+
++ pax_track_stack();
++
+ /* Set video format - must be done first as it resets other settings */
+ set_reg8(client, 0x41, h->video_format);
+
+diff --git a/drivers/media/video/saa7164/saa7164-cmd.c b/drivers/media/video/saa7164/saa7164-cmd.c
+index 9c1d3ac..b1b49e9 100644
+--- a/drivers/media/video/saa7164/saa7164-cmd.c
++++ b/drivers/media/video/saa7164/saa7164-cmd.c
+@@ -87,6 +87,8 @@ int saa7164_irq_dequeue(struct saa7164_dev *dev)
+ wait_queue_head_t *q = 0;
+ dprintk(DBGLVL_CMD, "%s()\n", __func__);
+
++ pax_track_stack();
++
+ /* While any outstand message on the bus exists... */
+ do {
+
+@@ -126,6 +128,8 @@ int saa7164_cmd_dequeue(struct saa7164_dev *dev)
+ u8 tmp[512];
+ dprintk(DBGLVL_CMD, "%s()\n", __func__);
+
++ pax_track_stack();
++
+ while (loop) {
+
+ tmComResInfo_t tRsp = { 0, 0, 0, 0, 0, 0 };
+diff --git a/drivers/media/video/usbvideo/ibmcam.c b/drivers/media/video/usbvideo/ibmcam.c
+index b085496..cde0270 100644
+--- a/drivers/media/video/usbvideo/ibmcam.c
++++ b/drivers/media/video/usbvideo/ibmcam.c
+@@ -3947,15 +3947,15 @@ static struct usb_device_id id_table[] = {
+ static int __init ibmcam_init(void)
+ {
+ struct usbvideo_cb cbTbl;
+- memset(&cbTbl, 0, sizeof(cbTbl));
+- cbTbl.probe = ibmcam_probe;
+- cbTbl.setupOnOpen = ibmcam_setup_on_open;
+- cbTbl.videoStart = ibmcam_video_start;
+- cbTbl.videoStop = ibmcam_video_stop;
+- cbTbl.processData = ibmcam_ProcessIsocData;
+- cbTbl.postProcess = usbvideo_DeinterlaceFrame;
+- cbTbl.adjustPicture = ibmcam_adjust_picture;
+- cbTbl.getFPS = ibmcam_calculate_fps;
++ memset((void *)&cbTbl, 0, sizeof(cbTbl));
++ *(void **)&cbTbl.probe = ibmcam_probe;
++ *(void **)&cbTbl.setupOnOpen = ibmcam_setup_on_open;
++ *(void **)&cbTbl.videoStart = ibmcam_video_start;
++ *(void **)&cbTbl.videoStop = ibmcam_video_stop;
++ *(void **)&cbTbl.processData = ibmcam_ProcessIsocData;
++ *(void **)&cbTbl.postProcess = usbvideo_DeinterlaceFrame;
++ *(void **)&cbTbl.adjustPicture = ibmcam_adjust_picture;
++ *(void **)&cbTbl.getFPS = ibmcam_calculate_fps;
+ return usbvideo_register(
+ &cams,
+ MAX_IBMCAM,
+diff --git a/drivers/media/video/usbvideo/konicawc.c b/drivers/media/video/usbvideo/konicawc.c
+index 31d57f2..600b735 100644
+--- a/drivers/media/video/usbvideo/konicawc.c
++++ b/drivers/media/video/usbvideo/konicawc.c
+@@ -225,7 +225,7 @@ static void konicawc_register_input(struct konicawc *cam, struct usb_device *dev
+ int error;
+
+ usb_make_path(dev, cam->input_physname, sizeof(cam->input_physname));
+- strncat(cam->input_physname, "/input0", sizeof(cam->input_physname));
++ strlcat(cam->input_physname, "/input0", sizeof(cam->input_physname));
+
+ cam->input = input_dev = input_allocate_device();
+ if (!input_dev) {
+@@ -935,16 +935,16 @@ static int __init konicawc_init(void)
+ struct usbvideo_cb cbTbl;
+ printk(KERN_INFO KBUILD_MODNAME ": " DRIVER_VERSION ":"
+ DRIVER_DESC "\n");
+- memset(&cbTbl, 0, sizeof(cbTbl));
+- cbTbl.probe = konicawc_probe;
+- cbTbl.setupOnOpen = konicawc_setup_on_open;
+- cbTbl.processData = konicawc_process_isoc;
+- cbTbl.getFPS = konicawc_calculate_fps;
+- cbTbl.setVideoMode = konicawc_set_video_mode;
+- cbTbl.startDataPump = konicawc_start_data;
+- cbTbl.stopDataPump = konicawc_stop_data;
+- cbTbl.adjustPicture = konicawc_adjust_picture;
+- cbTbl.userFree = konicawc_free_uvd;
++ memset((void * )&cbTbl, 0, sizeof(cbTbl));
++ *(void **)&cbTbl.probe = konicawc_probe;
++ *(void **)&cbTbl.setupOnOpen = konicawc_setup_on_open;
++ *(void **)&cbTbl.processData = konicawc_process_isoc;
++ *(void **)&cbTbl.getFPS = konicawc_calculate_fps;
++ *(void **)&cbTbl.setVideoMode = konicawc_set_video_mode;
++ *(void **)&cbTbl.startDataPump = konicawc_start_data;
++ *(void **)&cbTbl.stopDataPump = konicawc_stop_data;
++ *(void **)&cbTbl.adjustPicture = konicawc_adjust_picture;
++ *(void **)&cbTbl.userFree = konicawc_free_uvd;
+ return usbvideo_register(
+ &cams,
+ MAX_CAMERAS,
+diff --git a/drivers/media/video/usbvideo/quickcam_messenger.c b/drivers/media/video/usbvideo/quickcam_messenger.c
+index 803d3e4..c4d1b96 100644
+--- a/drivers/media/video/usbvideo/quickcam_messenger.c
++++ b/drivers/media/video/usbvideo/quickcam_messenger.c
+@@ -89,7 +89,7 @@ static void qcm_register_input(struct qcm *cam, struct usb_device *dev)
+ int error;
+
+ usb_make_path(dev, cam->input_physname, sizeof(cam->input_physname));
+- strncat(cam->input_physname, "/input0", sizeof(cam->input_physname));
++ strlcat(cam->input_physname, "/input0", sizeof(cam->input_physname));
+
+ cam->input = input_dev = input_allocate_device();
+ if (!input_dev) {
+diff --git a/drivers/media/video/usbvideo/ultracam.c b/drivers/media/video/usbvideo/ultracam.c
+index fbd1b63..292f9f0 100644
+--- a/drivers/media/video/usbvideo/ultracam.c
++++ b/drivers/media/video/usbvideo/ultracam.c
+@@ -655,14 +655,14 @@ static int __init ultracam_init(void)
+ {
+ struct usbvideo_cb cbTbl;
+ memset(&cbTbl, 0, sizeof(cbTbl));
+- cbTbl.probe = ultracam_probe;
+- cbTbl.setupOnOpen = ultracam_setup_on_open;
+- cbTbl.videoStart = ultracam_video_start;
+- cbTbl.videoStop = ultracam_video_stop;
+- cbTbl.processData = ultracam_ProcessIsocData;
+- cbTbl.postProcess = usbvideo_DeinterlaceFrame;
+- cbTbl.adjustPicture = ultracam_adjust_picture;
+- cbTbl.getFPS = ultracam_calculate_fps;
++ *(void **)&cbTbl.probe = ultracam_probe;
++ *(void **)&cbTbl.setupOnOpen = ultracam_setup_on_open;
++ *(void **)&cbTbl.videoStart = ultracam_video_start;
++ *(void **)&cbTbl.videoStop = ultracam_video_stop;
++ *(void **)&cbTbl.processData = ultracam_ProcessIsocData;
++ *(void **)&cbTbl.postProcess = usbvideo_DeinterlaceFrame;
++ *(void **)&cbTbl.adjustPicture = ultracam_adjust_picture;
++ *(void **)&cbTbl.getFPS = ultracam_calculate_fps;
+ return usbvideo_register(
+ &cams,
+ MAX_CAMERAS,
+diff --git a/drivers/media/video/usbvideo/usbvideo.c b/drivers/media/video/usbvideo/usbvideo.c
+index dea8b32..34f6878 100644
+--- a/drivers/media/video/usbvideo/usbvideo.c
++++ b/drivers/media/video/usbvideo/usbvideo.c
+@@ -697,15 +697,15 @@ int usbvideo_register(
+ __func__, cams, base_size, num_cams);
+
+ /* Copy callbacks, apply defaults for those that are not set */
+- memmove(&cams->cb, cbTbl, sizeof(cams->cb));
++ memmove((void *)&cams->cb, cbTbl, sizeof(cams->cb));
+ if (cams->cb.getFrame == NULL)
+- cams->cb.getFrame = usbvideo_GetFrame;
++ *(void **)&cams->cb.getFrame = usbvideo_GetFrame;
+ if (cams->cb.disconnect == NULL)
+- cams->cb.disconnect = usbvideo_Disconnect;
++ *(void **)&cams->cb.disconnect = usbvideo_Disconnect;
+ if (cams->cb.startDataPump == NULL)
+- cams->cb.startDataPump = usbvideo_StartDataPump;
++ *(void **)&cams->cb.startDataPump = usbvideo_StartDataPump;
+ if (cams->cb.stopDataPump == NULL)
+- cams->cb.stopDataPump = usbvideo_StopDataPump;
++ *(void **)&cams->cb.stopDataPump = usbvideo_StopDataPump;
+
+ cams->num_cameras = num_cams;
+ cams->cam = (struct uvd *) &cams[1];
+diff --git a/drivers/media/video/usbvideo/usbvideo.h b/drivers/media/video/usbvideo/usbvideo.h
+index c66985b..7fa143a 100644
+--- a/drivers/media/video/usbvideo/usbvideo.h
++++ b/drivers/media/video/usbvideo/usbvideo.h
+@@ -268,7 +268,7 @@ struct usbvideo_cb {
+ int (*startDataPump)(struct uvd *uvd);
+ void (*stopDataPump)(struct uvd *uvd);
+ int (*setVideoMode)(struct uvd *uvd, struct video_window *vw);
+-};
++} __no_const;
+
+ struct usbvideo {
+ int num_cameras; /* As allocated */
+diff --git a/drivers/media/video/usbvision/usbvision-core.c b/drivers/media/video/usbvision/usbvision-core.c
+index e0f91e4..37554ea 100644
+--- a/drivers/media/video/usbvision/usbvision-core.c
++++ b/drivers/media/video/usbvision/usbvision-core.c
+@@ -820,6 +820,8 @@ static enum ParseState usbvision_parse_compress(struct usb_usbvision *usbvision,
+ unsigned char rv, gv, bv;
+ static unsigned char *Y, *U, *V;
+
++ pax_track_stack();
++
+ frame = usbvision->curFrame;
+ imageSize = frame->frmwidth * frame->frmheight;
+ if ( (frame->v4l2_format.format == V4L2_PIX_FMT_YUV422P) ||
+diff --git a/drivers/media/video/v4l2-device.c b/drivers/media/video/v4l2-device.c
+index 0d06e7c..3d17d24 100644
+--- a/drivers/media/video/v4l2-device.c
++++ b/drivers/media/video/v4l2-device.c
+@@ -50,9 +50,9 @@ int v4l2_device_register(struct device *dev, struct v4l2_device *v4l2_dev)
+ EXPORT_SYMBOL_GPL(v4l2_device_register);
+
+ int v4l2_device_set_name(struct v4l2_device *v4l2_dev, const char *basename,
+- atomic_t *instance)
++ atomic_unchecked_t *instance)
+ {
+- int num = atomic_inc_return(instance) - 1;
++ int num = atomic_inc_return_unchecked(instance) - 1;
+ int len = strlen(basename);
+
+ if (basename[len - 1] >= '0' && basename[len - 1] <= '9')
+diff --git a/drivers/media/video/videobuf-dma-sg.c b/drivers/media/video/videobuf-dma-sg.c
+index 032ebae..6a3532c 100644
+--- a/drivers/media/video/videobuf-dma-sg.c
++++ b/drivers/media/video/videobuf-dma-sg.c
+@@ -693,6 +693,8 @@ void *videobuf_sg_alloc(size_t size)
+ {
+ struct videobuf_queue q;
+
++ pax_track_stack();
++
+ /* Required to make generic handler to call __videobuf_alloc */
+ q.int_ops = &sg_ops;
+
+diff --git a/drivers/message/fusion/mptbase.c b/drivers/message/fusion/mptbase.c
+index b6992b7..9fa7547 100644
+--- a/drivers/message/fusion/mptbase.c
++++ b/drivers/message/fusion/mptbase.c
+@@ -6709,8 +6709,14 @@ procmpt_iocinfo_read(char *buf, char **start, off_t offset, int request, int *eo
+ len += sprintf(buf+len, " MaxChainDepth = 0x%02x frames\n", ioc->facts.MaxChainDepth);
+ len += sprintf(buf+len, " MinBlockSize = 0x%02x bytes\n", 4*ioc->facts.BlockSize);
+
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ len += sprintf(buf+len, " RequestFrames @ 0x%p (Dma @ 0x%p)\n",
++ NULL, NULL);
++#else
+ len += sprintf(buf+len, " RequestFrames @ 0x%p (Dma @ 0x%p)\n",
+ (void *)ioc->req_frames, (void *)(ulong)ioc->req_frames_dma);
++#endif
++
+ /*
+ * Rounding UP to nearest 4-kB boundary here...
+ */
+diff --git a/drivers/message/fusion/mptsas.c b/drivers/message/fusion/mptsas.c
+index 83873e3..e360e9a 100644
+--- a/drivers/message/fusion/mptsas.c
++++ b/drivers/message/fusion/mptsas.c
+@@ -436,6 +436,23 @@ mptsas_is_end_device(struct mptsas_devinfo * attached)
+ return 0;
+ }
+
++static inline void
++mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
++{
++ if (phy_info->port_details) {
++ phy_info->port_details->rphy = rphy;
++ dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
++ ioc->name, rphy));
++ }
++
++ if (rphy) {
++ dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
++ &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
++ dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
++ ioc->name, rphy, rphy->dev.release));
++ }
++}
++
+ /* no mutex */
+ static void
+ mptsas_port_delete(MPT_ADAPTER *ioc, struct mptsas_portinfo_details * port_details)
+@@ -474,23 +491,6 @@ mptsas_get_rphy(struct mptsas_phyinfo *phy_info)
+ return NULL;
+ }
+
+-static inline void
+-mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
+-{
+- if (phy_info->port_details) {
+- phy_info->port_details->rphy = rphy;
+- dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
+- ioc->name, rphy));
+- }
+-
+- if (rphy) {
+- dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
+- &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
+- dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
+- ioc->name, rphy, rphy->dev.release));
+- }
+-}
+-
+ static inline struct sas_port *
+ mptsas_get_port(struct mptsas_phyinfo *phy_info)
+ {
+diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c
+index bd096ca..332cf76 100644
+--- a/drivers/message/fusion/mptscsih.c
++++ b/drivers/message/fusion/mptscsih.c
+@@ -1248,15 +1248,16 @@ mptscsih_info(struct Scsi_Host *SChost)
+
+ h = shost_priv(SChost);
+
+- if (h) {
+- if (h->info_kbuf == NULL)
+- if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
+- return h->info_kbuf;
+- h->info_kbuf[0] = '\0';
++ if (!h)
++ return NULL;
+
+- mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
+- h->info_kbuf[size-1] = '\0';
+- }
++ if (h->info_kbuf == NULL)
++ if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
++ return h->info_kbuf;
++ h->info_kbuf[0] = '\0';
++
++ mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
++ h->info_kbuf[size-1] = '\0';
+
+ return h->info_kbuf;
+ }
+diff --git a/drivers/message/i2o/i2o_config.c b/drivers/message/i2o/i2o_config.c
+index efba702..59b2c0f 100644
+--- a/drivers/message/i2o/i2o_config.c
++++ b/drivers/message/i2o/i2o_config.c
+@@ -787,6 +787,8 @@ static int i2o_cfg_passthru(unsigned long arg)
+ struct i2o_message *msg;
+ unsigned int iop;
+
++ pax_track_stack();
++
+ if (get_user(iop, &cmd->iop) || get_user(user_msg, &cmd->msg))
+ return -EFAULT;
+
+diff --git a/drivers/message/i2o/i2o_proc.c b/drivers/message/i2o/i2o_proc.c
+index 7045c45..c07b170 100644
+--- a/drivers/message/i2o/i2o_proc.c
++++ b/drivers/message/i2o/i2o_proc.c
+@@ -259,13 +259,6 @@ static char *scsi_devices[] = {
+ "Array Controller Device"
+ };
+
+-static char *chtostr(u8 * chars, int n)
+-{
+- char tmp[256];
+- tmp[0] = 0;
+- return strncat(tmp, (char *)chars, n);
+-}
+-
+ static int i2o_report_query_status(struct seq_file *seq, int block_status,
+ char *group)
+ {
+@@ -842,8 +835,7 @@ static int i2o_seq_show_ddm_table(struct seq_file *seq, void *v)
+
+ seq_printf(seq, "%-#7x", ddm_table.i2o_vendor_id);
+ seq_printf(seq, "%-#8x", ddm_table.module_id);
+- seq_printf(seq, "%-29s",
+- chtostr(ddm_table.module_name_version, 28));
++ seq_printf(seq, "%-.28s", ddm_table.module_name_version);
+ seq_printf(seq, "%9d ", ddm_table.data_size);
+ seq_printf(seq, "%8d", ddm_table.code_size);
+
+@@ -944,8 +936,8 @@ static int i2o_seq_show_drivers_stored(struct seq_file *seq, void *v)
+
+ seq_printf(seq, "%-#7x", dst->i2o_vendor_id);
+ seq_printf(seq, "%-#8x", dst->module_id);
+- seq_printf(seq, "%-29s", chtostr(dst->module_name_version, 28));
+- seq_printf(seq, "%-9s", chtostr(dst->date, 8));
++ seq_printf(seq, "%-.28s", dst->module_name_version);
++ seq_printf(seq, "%-.8s", dst->date);
+ seq_printf(seq, "%8d ", dst->module_size);
+ seq_printf(seq, "%8d ", dst->mpb_size);
+ seq_printf(seq, "0x%04x", dst->module_flags);
+@@ -1276,14 +1268,10 @@ static int i2o_seq_show_dev_identity(struct seq_file *seq, void *v)
+ seq_printf(seq, "Device Class : %s\n", i2o_get_class_name(work16[0]));
+ seq_printf(seq, "Owner TID : %0#5x\n", work16[2]);
+ seq_printf(seq, "Parent TID : %0#5x\n", work16[3]);
+- seq_printf(seq, "Vendor info : %s\n",
+- chtostr((u8 *) (work32 + 2), 16));
+- seq_printf(seq, "Product info : %s\n",
+- chtostr((u8 *) (work32 + 6), 16));
+- seq_printf(seq, "Description : %s\n",
+- chtostr((u8 *) (work32 + 10), 16));
+- seq_printf(seq, "Product rev. : %s\n",
+- chtostr((u8 *) (work32 + 14), 8));
++ seq_printf(seq, "Vendor info : %.16s\n", (u8 *) (work32 + 2));
++ seq_printf(seq, "Product info : %.16s\n", (u8 *) (work32 + 6));
++ seq_printf(seq, "Description : %.16s\n", (u8 *) (work32 + 10));
++ seq_printf(seq, "Product rev. : %.8s\n", (u8 *) (work32 + 14));
+
+ seq_printf(seq, "Serial number : ");
+ print_serial_number(seq, (u8 *) (work32 + 16),
+@@ -1328,10 +1316,8 @@ static int i2o_seq_show_ddm_identity(struct seq_file *seq, void *v)
+ }
+
+ seq_printf(seq, "Registering DDM TID : 0x%03x\n", result.ddm_tid);
+- seq_printf(seq, "Module name : %s\n",
+- chtostr(result.module_name, 24));
+- seq_printf(seq, "Module revision : %s\n",
+- chtostr(result.module_rev, 8));
++ seq_printf(seq, "Module name : %.24s\n", result.module_name);
++ seq_printf(seq, "Module revision : %.8s\n", result.module_rev);
+
+ seq_printf(seq, "Serial number : ");
+ print_serial_number(seq, result.serial_number, sizeof(result) - 36);
+@@ -1362,14 +1348,10 @@ static int i2o_seq_show_uinfo(struct seq_file *seq, void *v)
+ return 0;
+ }
+
+- seq_printf(seq, "Device name : %s\n",
+- chtostr(result.device_name, 64));
+- seq_printf(seq, "Service name : %s\n",
+- chtostr(result.service_name, 64));
+- seq_printf(seq, "Physical name : %s\n",
+- chtostr(result.physical_location, 64));
+- seq_printf(seq, "Instance number : %s\n",
+- chtostr(result.instance_number, 4));
++ seq_printf(seq, "Device name : %.64s\n", result.device_name);
++ seq_printf(seq, "Service name : %.64s\n", result.service_name);
++ seq_printf(seq, "Physical name : %.64s\n", result.physical_location);
++ seq_printf(seq, "Instance number : %.4s\n", result.instance_number);
+
+ return 0;
+ }
+diff --git a/drivers/message/i2o/iop.c b/drivers/message/i2o/iop.c
+index 27cf4af..b1205b8 100644
+--- a/drivers/message/i2o/iop.c
++++ b/drivers/message/i2o/iop.c
+@@ -110,10 +110,10 @@ u32 i2o_cntxt_list_add(struct i2o_controller * c, void *ptr)
+
+ spin_lock_irqsave(&c->context_list_lock, flags);
+
+- if (unlikely(atomic_inc_and_test(&c->context_list_counter)))
+- atomic_inc(&c->context_list_counter);
++ if (unlikely(atomic_inc_and_test_unchecked(&c->context_list_counter)))
++ atomic_inc_unchecked(&c->context_list_counter);
+
+- entry->context = atomic_read(&c->context_list_counter);
++ entry->context = atomic_read_unchecked(&c->context_list_counter);
+
+ list_add(&entry->list, &c->context_list);
+
+@@ -1076,7 +1076,7 @@ struct i2o_controller *i2o_iop_alloc(void)
+
+ #if BITS_PER_LONG == 64
+ spin_lock_init(&c->context_list_lock);
+- atomic_set(&c->context_list_counter, 0);
++ atomic_set_unchecked(&c->context_list_counter, 0);
+ INIT_LIST_HEAD(&c->context_list);
+ #endif
+
+diff --git a/drivers/mfd/ab3100-core.c b/drivers/mfd/ab3100-core.c
+index 78e3e85..66c9a0d 100644
+--- a/drivers/mfd/ab3100-core.c
++++ b/drivers/mfd/ab3100-core.c
+@@ -777,7 +777,7 @@ struct ab_family_id {
+ char *name;
+ };
+
+-static const struct ab_family_id ids[] __initdata = {
++static const struct ab_family_id ids[] __initconst = {
+ /* AB3100 */
+ {
+ .id = 0xc0,
+diff --git a/drivers/mfd/wm8350-i2c.c b/drivers/mfd/wm8350-i2c.c
+index 8d8c932..8104515 100644
+--- a/drivers/mfd/wm8350-i2c.c
++++ b/drivers/mfd/wm8350-i2c.c
+@@ -43,6 +43,8 @@ static int wm8350_i2c_write_device(struct wm8350 *wm8350, char reg,
+ u8 msg[(WM8350_MAX_REGISTER << 1) + 1];
+ int ret;
+
++ pax_track_stack();
++
+ if (bytes > ((WM8350_MAX_REGISTER << 1) + 1))
+ return -EINVAL;
+
+diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c
+index e4ff50b..4cc3f04 100644
+--- a/drivers/misc/kgdbts.c
++++ b/drivers/misc/kgdbts.c
+@@ -118,7 +118,7 @@
+ } while (0)
+ #define MAX_CONFIG_LEN 40
+
+-static struct kgdb_io kgdbts_io_ops;
++static const struct kgdb_io kgdbts_io_ops;
+ static char get_buf[BUFMAX];
+ static int get_buf_cnt;
+ static char put_buf[BUFMAX];
+@@ -1102,7 +1102,7 @@ static void kgdbts_post_exp_handler(void)
+ module_put(THIS_MODULE);
+ }
+
+-static struct kgdb_io kgdbts_io_ops = {
++static const struct kgdb_io kgdbts_io_ops = {
+ .name = "kgdbts",
+ .read_char = kgdbts_get_char,
+ .write_char = kgdbts_put_char,
+diff --git a/drivers/misc/sgi-gru/gruhandles.c b/drivers/misc/sgi-gru/gruhandles.c
+index 37e7cfc..67cfb76 100644
+--- a/drivers/misc/sgi-gru/gruhandles.c
++++ b/drivers/misc/sgi-gru/gruhandles.c
+@@ -39,8 +39,8 @@ struct mcs_op_statistic mcs_op_statistics[mcsop_last];
+
+ static void update_mcs_stats(enum mcs_op op, unsigned long clks)
+ {
+- atomic_long_inc(&mcs_op_statistics[op].count);
+- atomic_long_add(clks, &mcs_op_statistics[op].total);
++ atomic_long_inc_unchecked(&mcs_op_statistics[op].count);
++ atomic_long_add_unchecked(clks, &mcs_op_statistics[op].total);
+ if (mcs_op_statistics[op].max < clks)
+ mcs_op_statistics[op].max = clks;
+ }
+diff --git a/drivers/misc/sgi-gru/gruprocfs.c b/drivers/misc/sgi-gru/gruprocfs.c
+index 3f2375c..467c6e6 100644
+--- a/drivers/misc/sgi-gru/gruprocfs.c
++++ b/drivers/misc/sgi-gru/gruprocfs.c
+@@ -32,9 +32,9 @@
+
+ #define printstat(s, f) printstat_val(s, &gru_stats.f, #f)
+
+-static void printstat_val(struct seq_file *s, atomic_long_t *v, char *id)
++static void printstat_val(struct seq_file *s, atomic_long_unchecked_t *v, char *id)
+ {
+- unsigned long val = atomic_long_read(v);
++ unsigned long val = atomic_long_read_unchecked(v);
+
+ if (val)
+ seq_printf(s, "%16lu %s\n", val, id);
+@@ -136,8 +136,8 @@ static int mcs_statistics_show(struct seq_file *s, void *p)
+ "cch_interrupt_sync", "cch_deallocate", "tgh_invalidate"};
+
+ for (op = 0; op < mcsop_last; op++) {
+- count = atomic_long_read(&mcs_op_statistics[op].count);
+- total = atomic_long_read(&mcs_op_statistics[op].total);
++ count = atomic_long_read_unchecked(&mcs_op_statistics[op].count);
++ total = atomic_long_read_unchecked(&mcs_op_statistics[op].total);
+ max = mcs_op_statistics[op].max;
+ seq_printf(s, "%-20s%12ld%12ld%12ld\n", id[op], count,
+ count ? total / count : 0, max);
+diff --git a/drivers/misc/sgi-gru/grutables.h b/drivers/misc/sgi-gru/grutables.h
+index 46990bc..4a251b5 100644
+--- a/drivers/misc/sgi-gru/grutables.h
++++ b/drivers/misc/sgi-gru/grutables.h
+@@ -167,84 +167,84 @@ extern unsigned int gru_max_gids;
+ * GRU statistics.
+ */
+ struct gru_stats_s {
+- atomic_long_t vdata_alloc;
+- atomic_long_t vdata_free;
+- atomic_long_t gts_alloc;
+- atomic_long_t gts_free;
+- atomic_long_t vdata_double_alloc;
+- atomic_long_t gts_double_allocate;
+- atomic_long_t assign_context;
+- atomic_long_t assign_context_failed;
+- atomic_long_t free_context;
+- atomic_long_t load_user_context;
+- atomic_long_t load_kernel_context;
+- atomic_long_t lock_kernel_context;
+- atomic_long_t unlock_kernel_context;
+- atomic_long_t steal_user_context;
+- atomic_long_t steal_kernel_context;
+- atomic_long_t steal_context_failed;
+- atomic_long_t nopfn;
+- atomic_long_t break_cow;
+- atomic_long_t asid_new;
+- atomic_long_t asid_next;
+- atomic_long_t asid_wrap;
+- atomic_long_t asid_reuse;
+- atomic_long_t intr;
+- atomic_long_t intr_mm_lock_failed;
+- atomic_long_t call_os;
+- atomic_long_t call_os_offnode_reference;
+- atomic_long_t call_os_check_for_bug;
+- atomic_long_t call_os_wait_queue;
+- atomic_long_t user_flush_tlb;
+- atomic_long_t user_unload_context;
+- atomic_long_t user_exception;
+- atomic_long_t set_context_option;
+- atomic_long_t migrate_check;
+- atomic_long_t migrated_retarget;
+- atomic_long_t migrated_unload;
+- atomic_long_t migrated_unload_delay;
+- atomic_long_t migrated_nopfn_retarget;
+- atomic_long_t migrated_nopfn_unload;
+- atomic_long_t tlb_dropin;
+- atomic_long_t tlb_dropin_fail_no_asid;
+- atomic_long_t tlb_dropin_fail_upm;
+- atomic_long_t tlb_dropin_fail_invalid;
+- atomic_long_t tlb_dropin_fail_range_active;
+- atomic_long_t tlb_dropin_fail_idle;
+- atomic_long_t tlb_dropin_fail_fmm;
+- atomic_long_t tlb_dropin_fail_no_exception;
+- atomic_long_t tlb_dropin_fail_no_exception_war;
+- atomic_long_t tfh_stale_on_fault;
+- atomic_long_t mmu_invalidate_range;
+- atomic_long_t mmu_invalidate_page;
+- atomic_long_t mmu_clear_flush_young;
+- atomic_long_t flush_tlb;
+- atomic_long_t flush_tlb_gru;
+- atomic_long_t flush_tlb_gru_tgh;
+- atomic_long_t flush_tlb_gru_zero_asid;
++ atomic_long_unchecked_t vdata_alloc;
++ atomic_long_unchecked_t vdata_free;
++ atomic_long_unchecked_t gts_alloc;
++ atomic_long_unchecked_t gts_free;
++ atomic_long_unchecked_t vdata_double_alloc;
++ atomic_long_unchecked_t gts_double_allocate;
++ atomic_long_unchecked_t assign_context;
++ atomic_long_unchecked_t assign_context_failed;
++ atomic_long_unchecked_t free_context;
++ atomic_long_unchecked_t load_user_context;
++ atomic_long_unchecked_t load_kernel_context;
++ atomic_long_unchecked_t lock_kernel_context;
++ atomic_long_unchecked_t unlock_kernel_context;
++ atomic_long_unchecked_t steal_user_context;
++ atomic_long_unchecked_t steal_kernel_context;
++ atomic_long_unchecked_t steal_context_failed;
++ atomic_long_unchecked_t nopfn;
++ atomic_long_unchecked_t break_cow;
++ atomic_long_unchecked_t asid_new;
++ atomic_long_unchecked_t asid_next;
++ atomic_long_unchecked_t asid_wrap;
++ atomic_long_unchecked_t asid_reuse;
++ atomic_long_unchecked_t intr;
++ atomic_long_unchecked_t intr_mm_lock_failed;
++ atomic_long_unchecked_t call_os;
++ atomic_long_unchecked_t call_os_offnode_reference;
++ atomic_long_unchecked_t call_os_check_for_bug;
++ atomic_long_unchecked_t call_os_wait_queue;
++ atomic_long_unchecked_t user_flush_tlb;
++ atomic_long_unchecked_t user_unload_context;
++ atomic_long_unchecked_t user_exception;
++ atomic_long_unchecked_t set_context_option;
++ atomic_long_unchecked_t migrate_check;
++ atomic_long_unchecked_t migrated_retarget;
++ atomic_long_unchecked_t migrated_unload;
++ atomic_long_unchecked_t migrated_unload_delay;
++ atomic_long_unchecked_t migrated_nopfn_retarget;
++ atomic_long_unchecked_t migrated_nopfn_unload;
++ atomic_long_unchecked_t tlb_dropin;
++ atomic_long_unchecked_t tlb_dropin_fail_no_asid;
++ atomic_long_unchecked_t tlb_dropin_fail_upm;
++ atomic_long_unchecked_t tlb_dropin_fail_invalid;
++ atomic_long_unchecked_t tlb_dropin_fail_range_active;
++ atomic_long_unchecked_t tlb_dropin_fail_idle;
++ atomic_long_unchecked_t tlb_dropin_fail_fmm;
++ atomic_long_unchecked_t tlb_dropin_fail_no_exception;
++ atomic_long_unchecked_t tlb_dropin_fail_no_exception_war;
++ atomic_long_unchecked_t tfh_stale_on_fault;
++ atomic_long_unchecked_t mmu_invalidate_range;
++ atomic_long_unchecked_t mmu_invalidate_page;
++ atomic_long_unchecked_t mmu_clear_flush_young;
++ atomic_long_unchecked_t flush_tlb;
++ atomic_long_unchecked_t flush_tlb_gru;
++ atomic_long_unchecked_t flush_tlb_gru_tgh;
++ atomic_long_unchecked_t flush_tlb_gru_zero_asid;
+
+- atomic_long_t copy_gpa;
++ atomic_long_unchecked_t copy_gpa;
+
+- atomic_long_t mesq_receive;
+- atomic_long_t mesq_receive_none;
+- atomic_long_t mesq_send;
+- atomic_long_t mesq_send_failed;
+- atomic_long_t mesq_noop;
+- atomic_long_t mesq_send_unexpected_error;
+- atomic_long_t mesq_send_lb_overflow;
+- atomic_long_t mesq_send_qlimit_reached;
+- atomic_long_t mesq_send_amo_nacked;
+- atomic_long_t mesq_send_put_nacked;
+- atomic_long_t mesq_qf_not_full;
+- atomic_long_t mesq_qf_locked;
+- atomic_long_t mesq_qf_noop_not_full;
+- atomic_long_t mesq_qf_switch_head_failed;
+- atomic_long_t mesq_qf_unexpected_error;
+- atomic_long_t mesq_noop_unexpected_error;
+- atomic_long_t mesq_noop_lb_overflow;
+- atomic_long_t mesq_noop_qlimit_reached;
+- atomic_long_t mesq_noop_amo_nacked;
+- atomic_long_t mesq_noop_put_nacked;
++ atomic_long_unchecked_t mesq_receive;
++ atomic_long_unchecked_t mesq_receive_none;
++ atomic_long_unchecked_t mesq_send;
++ atomic_long_unchecked_t mesq_send_failed;
++ atomic_long_unchecked_t mesq_noop;
++ atomic_long_unchecked_t mesq_send_unexpected_error;
++ atomic_long_unchecked_t mesq_send_lb_overflow;
++ atomic_long_unchecked_t mesq_send_qlimit_reached;
++ atomic_long_unchecked_t mesq_send_amo_nacked;
++ atomic_long_unchecked_t mesq_send_put_nacked;
++ atomic_long_unchecked_t mesq_qf_not_full;
++ atomic_long_unchecked_t mesq_qf_locked;
++ atomic_long_unchecked_t mesq_qf_noop_not_full;
++ atomic_long_unchecked_t mesq_qf_switch_head_failed;
++ atomic_long_unchecked_t mesq_qf_unexpected_error;
++ atomic_long_unchecked_t mesq_noop_unexpected_error;
++ atomic_long_unchecked_t mesq_noop_lb_overflow;
++ atomic_long_unchecked_t mesq_noop_qlimit_reached;
++ atomic_long_unchecked_t mesq_noop_amo_nacked;
++ atomic_long_unchecked_t mesq_noop_put_nacked;
+
+ };
+
+@@ -252,8 +252,8 @@ enum mcs_op {cchop_allocate, cchop_start, cchop_interrupt, cchop_interrupt_sync,
+ cchop_deallocate, tghop_invalidate, mcsop_last};
+
+ struct mcs_op_statistic {
+- atomic_long_t count;
+- atomic_long_t total;
++ atomic_long_unchecked_t count;
++ atomic_long_unchecked_t total;
+ unsigned long max;
+ };
+
+@@ -276,7 +276,7 @@ extern struct mcs_op_statistic mcs_op_statistics[mcsop_last];
+
+ #define STAT(id) do { \
+ if (gru_options & OPT_STATS) \
+- atomic_long_inc(&gru_stats.id); \
++ atomic_long_inc_unchecked(&gru_stats.id); \
+ } while (0)
+
+ #ifdef CONFIG_SGI_GRU_DEBUG
+diff --git a/drivers/misc/sgi-xp/xp.h b/drivers/misc/sgi-xp/xp.h
+index 2275126..12a9dbfb 100644
+--- a/drivers/misc/sgi-xp/xp.h
++++ b/drivers/misc/sgi-xp/xp.h
+@@ -289,7 +289,7 @@ struct xpc_interface {
+ xpc_notify_func, void *);
+ void (*received) (short, int, void *);
+ enum xp_retval (*partid_to_nasids) (short, void *);
+-};
++} __no_const;
+
+ extern struct xpc_interface xpc_interface;
+
+diff --git a/drivers/misc/sgi-xp/xpc.h b/drivers/misc/sgi-xp/xpc.h
+index b94d5f7..7f494c5 100644
+--- a/drivers/misc/sgi-xp/xpc.h
++++ b/drivers/misc/sgi-xp/xpc.h
+@@ -835,6 +835,7 @@ struct xpc_arch_operations {
+ void (*received_payload) (struct xpc_channel *, void *);
+ void (*notify_senders_of_disconnect) (struct xpc_channel *);
+ };
++typedef struct xpc_arch_operations __no_const xpc_arch_operations_no_const;
+
+ /* struct xpc_partition act_state values (for XPC HB) */
+
+@@ -876,7 +877,7 @@ extern struct xpc_registration xpc_registrations[];
+ /* found in xpc_main.c */
+ extern struct device *xpc_part;
+ extern struct device *xpc_chan;
+-extern struct xpc_arch_operations xpc_arch_ops;
++extern xpc_arch_operations_no_const xpc_arch_ops;
+ extern int xpc_disengage_timelimit;
+ extern int xpc_disengage_timedout;
+ extern int xpc_activate_IRQ_rcvd;
+diff --git a/drivers/misc/sgi-xp/xpc_main.c b/drivers/misc/sgi-xp/xpc_main.c
+index fd3688a..7e211a4 100644
+--- a/drivers/misc/sgi-xp/xpc_main.c
++++ b/drivers/misc/sgi-xp/xpc_main.c
+@@ -169,7 +169,7 @@ static struct notifier_block xpc_die_notifier = {
+ .notifier_call = xpc_system_die,
+ };
+
+-struct xpc_arch_operations xpc_arch_ops;
++xpc_arch_operations_no_const xpc_arch_ops;
+
+ /*
+ * Timer function to enforce the timelimit on the partition disengage.
+diff --git a/drivers/misc/sgi-xp/xpc_sn2.c b/drivers/misc/sgi-xp/xpc_sn2.c
+index 8b70e03..700bda6 100644
+--- a/drivers/misc/sgi-xp/xpc_sn2.c
++++ b/drivers/misc/sgi-xp/xpc_sn2.c
+@@ -2350,7 +2350,7 @@ xpc_received_payload_sn2(struct xpc_channel *ch, void *payload)
+ xpc_acknowledge_msgs_sn2(ch, get, msg->flags);
+ }
+
+-static struct xpc_arch_operations xpc_arch_ops_sn2 = {
++static const struct xpc_arch_operations xpc_arch_ops_sn2 = {
+ .setup_partitions = xpc_setup_partitions_sn2,
+ .teardown_partitions = xpc_teardown_partitions_sn2,
+ .process_activate_IRQ_rcvd = xpc_process_activate_IRQ_rcvd_sn2,
+@@ -2413,7 +2413,9 @@ xpc_init_sn2(void)
+ int ret;
+ size_t buf_size;
+
+- xpc_arch_ops = xpc_arch_ops_sn2;
++ pax_open_kernel();
++ memcpy((void *)&xpc_arch_ops, &xpc_arch_ops_sn2, sizeof(xpc_arch_ops_sn2));
++ pax_close_kernel();
+
+ if (offsetof(struct xpc_msg_sn2, payload) > XPC_MSG_HDR_MAX_SIZE) {
+ dev_err(xpc_part, "header portion of struct xpc_msg_sn2 is "
+diff --git a/drivers/misc/sgi-xp/xpc_uv.c b/drivers/misc/sgi-xp/xpc_uv.c
+index 8e08d71..7cb8c9b 100644
+--- a/drivers/misc/sgi-xp/xpc_uv.c
++++ b/drivers/misc/sgi-xp/xpc_uv.c
+@@ -1669,7 +1669,7 @@ xpc_received_payload_uv(struct xpc_channel *ch, void *payload)
+ XPC_DEACTIVATE_PARTITION(&xpc_partitions[ch->partid], ret);
+ }
+
+-static struct xpc_arch_operations xpc_arch_ops_uv = {
++static const struct xpc_arch_operations xpc_arch_ops_uv = {
+ .setup_partitions = xpc_setup_partitions_uv,
+ .teardown_partitions = xpc_teardown_partitions_uv,
+ .process_activate_IRQ_rcvd = xpc_process_activate_IRQ_rcvd_uv,
+@@ -1729,7 +1729,9 @@ static struct xpc_arch_operations xpc_arch_ops_uv = {
+ int
+ xpc_init_uv(void)
+ {
+- xpc_arch_ops = xpc_arch_ops_uv;
++ pax_open_kernel();
++ memcpy((void *)&xpc_arch_ops, &xpc_arch_ops_uv, sizeof(xpc_arch_ops_uv));
++ pax_close_kernel();
+
+ if (sizeof(struct xpc_notify_mq_msghdr_uv) > XPC_MSG_HDR_MAX_SIZE) {
+ dev_err(xpc_part, "xpc_notify_mq_msghdr_uv is larger than %d\n",
+diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c
+index 6fd20b42..650efe3 100644
+--- a/drivers/mmc/host/sdhci-pci.c
++++ b/drivers/mmc/host/sdhci-pci.c
+@@ -297,7 +297,7 @@ static const struct sdhci_pci_fixes sdhci_via = {
+ .probe = via_probe,
+ };
+
+-static const struct pci_device_id pci_ids[] __devinitdata = {
++static const struct pci_device_id pci_ids[] __devinitconst = {
+ {
+ .vendor = PCI_VENDOR_ID_RICOH,
+ .device = PCI_DEVICE_ID_RICOH_R5C822,
+diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
+index e7563a9..5f90ce5 100644
+--- a/drivers/mtd/chips/cfi_cmdset_0001.c
++++ b/drivers/mtd/chips/cfi_cmdset_0001.c
+@@ -743,6 +743,8 @@ static int chip_ready (struct map_info *map, struct flchip *chip, unsigned long
+ struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
+ unsigned long timeo = jiffies + HZ;
+
++ pax_track_stack();
++
+ /* Prevent setting state FL_SYNCING for chip in suspended state. */
+ if (mode == FL_SYNCING && chip->oldstate != FL_READY)
+ goto sleep;
+@@ -1642,6 +1644,8 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
+ unsigned long initial_adr;
+ int initial_len = len;
+
++ pax_track_stack();
++
+ wbufsize = cfi_interleave(cfi) << cfi->cfiq->MaxBufWriteSize;
+ adr += chip->start;
+ initial_adr = adr;
+@@ -1860,6 +1864,8 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
+ int retries = 3;
+ int ret;
+
++ pax_track_stack();
++
+ adr += chip->start;
+
+ retry:
+diff --git a/drivers/mtd/chips/cfi_cmdset_0020.c b/drivers/mtd/chips/cfi_cmdset_0020.c
+index 0667a67..3ab97ed 100644
+--- a/drivers/mtd/chips/cfi_cmdset_0020.c
++++ b/drivers/mtd/chips/cfi_cmdset_0020.c
+@@ -255,6 +255,8 @@ static inline int do_read_onechip(struct map_info *map, struct flchip *chip, lof
+ unsigned long cmd_addr;
+ struct cfi_private *cfi = map->fldrv_priv;
+
++ pax_track_stack();
++
+ adr += chip->start;
+
+ /* Ensure cmd read/writes are aligned. */
+@@ -428,6 +430,8 @@ static inline int do_write_buffer(struct map_info *map, struct flchip *chip,
+ DECLARE_WAITQUEUE(wait, current);
+ int wbufsize, z;
+
++ pax_track_stack();
++
+ /* M58LW064A requires bus alignment for buffer wriets -- saw */
+ if (adr & (map_bankwidth(map)-1))
+ return -EINVAL;
+@@ -742,6 +746,8 @@ static inline int do_erase_oneblock(struct map_info *map, struct flchip *chip, u
+ DECLARE_WAITQUEUE(wait, current);
+ int ret = 0;
+
++ pax_track_stack();
++
+ adr += chip->start;
+
+ /* Let's determine this according to the interleave only once */
+@@ -1047,6 +1053,8 @@ static inline int do_lock_oneblock(struct map_info *map, struct flchip *chip, un
+ unsigned long timeo = jiffies + HZ;
+ DECLARE_WAITQUEUE(wait, current);
+
++ pax_track_stack();
++
+ adr += chip->start;
+
+ /* Let's determine this according to the interleave only once */
+@@ -1196,6 +1204,8 @@ static inline int do_unlock_oneblock(struct map_info *map, struct flchip *chip,
+ unsigned long timeo = jiffies + HZ;
+ DECLARE_WAITQUEUE(wait, current);
+
++ pax_track_stack();
++
+ adr += chip->start;
+
+ /* Let's determine this according to the interleave only once */
+diff --git a/drivers/mtd/devices/doc2000.c b/drivers/mtd/devices/doc2000.c
+index 5bf5f46..c5de373 100644
+--- a/drivers/mtd/devices/doc2000.c
++++ b/drivers/mtd/devices/doc2000.c
+@@ -776,7 +776,7 @@ static int doc_write(struct mtd_info *mtd, loff_t to, size_t len,
+
+ /* The ECC will not be calculated correctly if less than 512 is written */
+ /* DBB-
+- if (len != 0x200 && eccbuf)
++ if (len != 0x200)
+ printk(KERN_WARNING
+ "ECC needs a full sector write (adr: %lx size %lx)\n",
+ (long) to, (long) len);
+diff --git a/drivers/mtd/devices/doc2001.c b/drivers/mtd/devices/doc2001.c
+index 0990f78..bb4e8a4 100644
+--- a/drivers/mtd/devices/doc2001.c
++++ b/drivers/mtd/devices/doc2001.c
+@@ -393,7 +393,7 @@ static int doc_read (struct mtd_info *mtd, loff_t from, size_t len,
+ struct Nand *mychip = &this->chips[from >> (this->chipshift)];
+
+ /* Don't allow read past end of device */
+- if (from >= this->totlen)
++ if (from >= this->totlen || !len)
+ return -EINVAL;
+
+ /* Don't allow a single read to cross a 512-byte block boundary */
+diff --git a/drivers/mtd/ftl.c b/drivers/mtd/ftl.c
+index e56d6b4..f07e6cf 100644
+--- a/drivers/mtd/ftl.c
++++ b/drivers/mtd/ftl.c
+@@ -474,6 +474,8 @@ static int copy_erase_unit(partition_t *part, uint16_t srcunit,
+ loff_t offset;
+ uint16_t srcunitswap = cpu_to_le16(srcunit);
+
++ pax_track_stack();
++
+ eun = &part->EUNInfo[srcunit];
+ xfer = &part->XferInfo[xferunit];
+ DEBUG(2, "ftl_cs: copying block 0x%x to 0x%x\n",
+diff --git a/drivers/mtd/inftlcore.c b/drivers/mtd/inftlcore.c
+index 8aca552..146446e 100755
+--- a/drivers/mtd/inftlcore.c
++++ b/drivers/mtd/inftlcore.c
+@@ -260,6 +260,8 @@ static u16 INFTL_foldchain(struct INFTLrecord *inftl, unsigned thisVUC, unsigned
+ struct inftl_oob oob;
+ size_t retlen;
+
++ pax_track_stack();
++
+ DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_foldchain(inftl=%p,thisVUC=%d,"
+ "pending=%d)\n", inftl, thisVUC, pendingblock);
+
+diff --git a/drivers/mtd/inftlmount.c b/drivers/mtd/inftlmount.c
+index 32e82ae..ed50953 100644
+--- a/drivers/mtd/inftlmount.c
++++ b/drivers/mtd/inftlmount.c
+@@ -54,6 +54,8 @@ static int find_boot_record(struct INFTLrecord *inftl)
+ struct INFTLPartition *ip;
+ size_t retlen;
+
++ pax_track_stack();
++
+ DEBUG(MTD_DEBUG_LEVEL3, "INFTL: find_boot_record(inftl=%p)\n", inftl);
+
+ /*
+diff --git a/drivers/mtd/lpddr/qinfo_probe.c b/drivers/mtd/lpddr/qinfo_probe.c
+index 79bf40f..fe5f8fd 100644
+--- a/drivers/mtd/lpddr/qinfo_probe.c
++++ b/drivers/mtd/lpddr/qinfo_probe.c
+@@ -106,6 +106,8 @@ static int lpddr_pfow_present(struct map_info *map, struct lpddr_private *lpddr)
+ {
+ map_word pfow_val[4];
+
++ pax_track_stack();
++
+ /* Check identification string */
+ pfow_val[0] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_P);
+ pfow_val[1] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_F);
+diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
+index 726a1b8..f46b460 100644
+--- a/drivers/mtd/mtdchar.c
++++ b/drivers/mtd/mtdchar.c
+@@ -461,6 +461,8 @@ static int mtd_ioctl(struct inode *inode, struct file *file,
+ u_long size;
+ struct mtd_info_user info;
+
++ pax_track_stack();
++
+ DEBUG(MTD_DEBUG_LEVEL0, "MTD_ioctl\n");
+
+ size = (cmd & IOCSIZE_MASK) >> IOCSIZE_SHIFT;
+diff --git a/drivers/mtd/nftlcore.c b/drivers/mtd/nftlcore.c
+index 1002e18..26d82d5 100644
+--- a/drivers/mtd/nftlcore.c
++++ b/drivers/mtd/nftlcore.c
+@@ -254,6 +254,8 @@ static u16 NFTL_foldchain (struct NFTLrecord *nftl, unsigned thisVUC, unsigned p
+ int inplace = 1;
+ size_t retlen;
+
++ pax_track_stack();
++
+ memset(BlockMap, 0xff, sizeof(BlockMap));
+ memset(BlockFreeFound, 0, sizeof(BlockFreeFound));
+
+diff --git a/drivers/mtd/nftlmount.c b/drivers/mtd/nftlmount.c
+index 8b22b18..6fada85 100644
+--- a/drivers/mtd/nftlmount.c
++++ b/drivers/mtd/nftlmount.c
+@@ -23,6 +23,7 @@
+ #include <asm/errno.h>
+ #include <linux/delay.h>
+ #include <linux/slab.h>
++#include <linux/sched.h>
+ #include <linux/mtd/mtd.h>
+ #include <linux/mtd/nand.h>
+ #include <linux/mtd/nftl.h>
+@@ -44,6 +45,8 @@ static int find_boot_record(struct NFTLrecord *nftl)
+ struct mtd_info *mtd = nftl->mbd.mtd;
+ unsigned int i;
+
++ pax_track_stack();
++
+ /* Assume logical EraseSize == physical erasesize for starting the scan.
+ We'll sort it out later if we find a MediaHeader which says otherwise */
+ /* Actually, we won't. The new DiskOnChip driver has already scanned
+diff --git a/drivers/net/atlx/atl2.c b/drivers/net/atlx/atl2.c
+index ab68886..ca405e8 100644
+--- a/drivers/net/atlx/atl2.c
++++ b/drivers/net/atlx/atl2.c
+@@ -2845,7 +2845,7 @@ static void atl2_force_ps(struct atl2_hw *hw)
+ */
+
+ #define ATL2_PARAM(X, desc) \
+- static const int __devinitdata X[ATL2_MAX_NIC + 1] = ATL2_PARAM_INIT; \
++ static const int __devinitconst X[ATL2_MAX_NIC + 1] = ATL2_PARAM_INIT; \
+ MODULE_PARM(X, "1-" __MODULE_STRING(ATL2_MAX_NIC) "i"); \
+ MODULE_PARM_DESC(X, desc);
+ #else
+diff --git a/drivers/net/benet/Makefile b/drivers/net/benet/Makefile
+index a60cd80..0ed11ef 100644
+--- a/drivers/net/benet/Makefile
++++ b/drivers/net/benet/Makefile
+@@ -1,7 +1,9 @@
+ #
+-# Makefile to build the network driver for ServerEngine's BladeEngine.
++# Makefile to build the be2net network driver
+ #
+
++EXTRA_CFLAGS += -DCONFIG_PALAU
++
+ obj-$(CONFIG_BE2NET) += be2net.o
+
+-be2net-y := be_main.o be_cmds.o be_ethtool.o
++be2net-y := be_main.o be_cmds.o be_ethtool.o be_compat.o be_misc.o
+diff --git a/drivers/net/benet/be.h b/drivers/net/benet/be.h
+index 5c74ff0..7382603 100644
+--- a/drivers/net/benet/be.h
++++ b/drivers/net/benet/be.h
+@@ -1,18 +1,18 @@
+ /*
+- * Copyright (C) 2005 - 2009 ServerEngines
++ * Copyright (C) 2005 - 2011 Emulex
+ * All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License version 2
+- * as published by the Free Software Foundation. The full GNU General
++ * as published by the Free Software Foundation. The full GNU General
+ * Public License is included in this distribution in the file called COPYING.
+ *
+ * Contact Information:
+- * linux-drivers@serverengines.com
++ * linux-drivers@emulex.com
+ *
+- * ServerEngines
+- * 209 N. Fair Oaks Ave
+- * Sunnyvale, CA 94085
++ * Emulex
++ * 3333 Susan Street
++ * Costa Mesa, CA 92626
+ */
+
+ #ifndef BE_H
+@@ -29,32 +29,53 @@
+ #include <linux/workqueue.h>
+ #include <linux/interrupt.h>
+ #include <linux/firmware.h>
++#include <linux/jhash.h>
++#ifndef CONFIG_PALAU
++#include <linux/inet_lro.h>
++#endif
+
++#ifdef CONFIG_PALAU
++#include "be_compat.h"
++#endif
+ #include "be_hw.h"
+
+-#define DRV_VER "2.101.205"
++#ifdef CONFIG_PALAU
++#include "version.h"
++#define DRV_VER STR_BE_MAJOR "." STR_BE_MINOR "."\
++ STR_BE_BUILD "." STR_BE_BRANCH
++#else
++#define DRV_VER "2.0.348"
++#endif
+ #define DRV_NAME "be2net"
+-#define BE_NAME "ServerEngines BladeEngine2 10Gbps NIC"
+-#define BE3_NAME "ServerEngines BladeEngine3 10Gbps NIC"
+-#define OC_NAME "Emulex OneConnect 10Gbps NIC"
+-#define OC_NAME1 "Emulex OneConnect 10Gbps NIC (be3)"
+-#define DRV_DESC BE_NAME "Driver"
++#define BE_NAME "Emulex BladeEngine2"
++#define BE3_NAME "Emulex BladeEngine3"
++#define OC_NAME "Emulex OneConnect"
++#define OC_NAME_BE OC_NAME "(be3)"
++#define OC_NAME_LANCER OC_NAME "(Lancer)"
++#define DRV_DESC "Emulex OneConnect 10Gbps NIC Driver"
+
+-#define BE_VENDOR_ID 0x19a2
++#define BE_VENDOR_ID 0x19a2
++#define EMULEX_VENDOR_ID 0x10df
+ #define BE_DEVICE_ID1 0x211
+ #define BE_DEVICE_ID2 0x221
+-#define OC_DEVICE_ID1 0x700
+-#define OC_DEVICE_ID2 0x701
+-#define OC_DEVICE_ID3 0x710
++#define OC_DEVICE_ID1 0x700 /* Device Id for BE2 cards */
++#define OC_DEVICE_ID2 0x710 /* Device Id for BE3 cards */
++#define OC_DEVICE_ID3 0xe220 /* Device id for Lancer cards */
++
++#define OC_SUBSYS_DEVICE_ID1 0xE602
++#define OC_SUBSYS_DEVICE_ID2 0xE642
++#define OC_SUBSYS_DEVICE_ID3 0xE612
++#define OC_SUBSYS_DEVICE_ID4 0xE652
+
+ static inline char *nic_name(struct pci_dev *pdev)
+ {
+ switch (pdev->device) {
+ case OC_DEVICE_ID1:
+- case OC_DEVICE_ID2:
+ return OC_NAME;
++ case OC_DEVICE_ID2:
++ return OC_NAME_BE;
+ case OC_DEVICE_ID3:
+- return OC_NAME1;
++ return OC_NAME_LANCER;
+ case BE_DEVICE_ID2:
+ return BE3_NAME;
+ default:
+@@ -63,7 +84,7 @@ static inline char *nic_name(struct pci_dev *pdev)
+ }
+
+ /* Number of bytes of an RX frame that are copied to skb->data */
+-#define BE_HDR_LEN 64
++#define BE_HDR_LEN ((u16) 64)
+ #define BE_MAX_JUMBO_FRAME_SIZE 9018
+ #define BE_MIN_MTU 256
+
+@@ -79,10 +100,24 @@ static inline char *nic_name(struct pci_dev *pdev)
+ #define MCC_Q_LEN 128 /* total size not to exceed 8 pages */
+ #define MCC_CQ_LEN 256
+
++#define MAX_RSS_QS 4 /* BE limit is 4 queues/port */
++
++#define MAX_RX_QS (MAX_RSS_QS + 1)
++
++#ifdef MQ_TX
++#define MAX_TX_QS 8
++#else
++#define MAX_TX_QS 1
++#endif
++
++#define BE_MAX_MSIX_VECTORS (MAX_RX_QS + 1)/* RSS qs + 1 def Rx + Tx */
+ #define BE_NAPI_WEIGHT 64
+-#define MAX_RX_POST BE_NAPI_WEIGHT /* Frags posted at a time */
++#define MAX_RX_POST BE_NAPI_WEIGHT /* Frags posted at a time */
+ #define RX_FRAGS_REFILL_WM (RX_Q_LEN - MAX_RX_POST)
+
++#define BE_MAX_LRO_DESCRIPTORS 16
++#define BE_MAX_FRAGS_PER_FRAME (min((u32) 16, (u32) MAX_SKB_FRAGS))
++
+ #define FW_VER_LEN 32
+
+ struct be_dma_mem {
+@@ -127,6 +162,11 @@ static inline void *queue_tail_node(struct be_queue_info *q)
+ return q->dma_mem.va + q->tail * q->entry_size;
+ }
+
++static inline void *queue_index_node(struct be_queue_info *q, u16 index)
++{
++ return q->dma_mem.va + index * q->entry_size;
++}
++
+ static inline void queue_head_inc(struct be_queue_info *q)
+ {
+ index_inc(&q->head, q->len);
+@@ -137,6 +177,7 @@ static inline void queue_tail_inc(struct be_queue_info *q)
+ index_inc(&q->tail, q->len);
+ }
+
++
+ struct be_eq_obj {
+ struct be_queue_info q;
+ char desc[32];
+@@ -146,6 +187,7 @@ struct be_eq_obj {
+ u16 min_eqd; /* in usecs */
+ u16 max_eqd; /* in usecs */
+ u16 cur_eqd; /* in usecs */
++ u8 eq_idx;
+
+ struct napi_struct napi;
+ };
+@@ -153,49 +195,20 @@ struct be_eq_obj {
+ struct be_mcc_obj {
+ struct be_queue_info q;
+ struct be_queue_info cq;
++ bool rearm_cq;
+ };
+
+-struct be_drvr_stats {
++struct be_tx_stats {
+ u32 be_tx_reqs; /* number of TX requests initiated */
+ u32 be_tx_stops; /* number of times TX Q was stopped */
+- u32 be_fwd_reqs; /* number of send reqs through forwarding i/f */
+ u32 be_tx_wrbs; /* number of tx WRBs used */
+- u32 be_tx_events; /* number of tx completion events */
+ u32 be_tx_compl; /* number of tx completion entries processed */
+ ulong be_tx_jiffies;
+ u64 be_tx_bytes;
+ u64 be_tx_bytes_prev;
+ u64 be_tx_pkts;
+ u32 be_tx_rate;
+-
+- u32 cache_barrier[16];
+-
+- u32 be_ethrx_post_fail;/* number of ethrx buffer alloc failures */
+- u32 be_polls; /* number of times NAPI called poll function */
+- u32 be_rx_events; /* number of ucast rx completion events */
+- u32 be_rx_compl; /* number of rx completion entries processed */
+- ulong be_rx_jiffies;
+- u64 be_rx_bytes;
+- u64 be_rx_bytes_prev;
+- u64 be_rx_pkts;
+- u32 be_rx_rate;
+- /* number of non ether type II frames dropped where
+- * frame len > length field of Mac Hdr */
+- u32 be_802_3_dropped_frames;
+- /* number of non ether type II frames malformed where
+- * in frame len < length field of Mac Hdr */
+- u32 be_802_3_malformed_frames;
+- u32 be_rxcp_err; /* Num rx completion entries w/ err set. */
+- ulong rx_fps_jiffies; /* jiffies at last FPS calc */
+- u32 be_rx_frags;
+- u32 be_prev_rx_frags;
+- u32 be_rx_fps; /* Rx frags per second */
+-};
+-
+-struct be_stats_obj {
+- struct be_drvr_stats drvr_stats;
+- struct net_device_stats net_stats;
+- struct be_dma_mem cmd;
++ u32 be_ipv6_ext_hdr_tx_drop;
+ };
+
+ struct be_tx_obj {
+@@ -203,23 +216,124 @@ struct be_tx_obj {
+ struct be_queue_info cq;
+ /* Remember the skbs that were transmitted */
+ struct sk_buff *sent_skb_list[TX_Q_LEN];
++ struct be_tx_stats stats;
+ };
+
+ /* Struct to remember the pages posted for rx frags */
+ struct be_rx_page_info {
+ struct page *page;
+- dma_addr_t bus;
++ DEFINE_DMA_UNMAP_ADDR(bus);
+ u16 page_offset;
+ bool last_page_user;
+ };
+
++struct be_rx_stats {
++ u32 rx_post_fail;/* number of ethrx buffer alloc failures */
++ u32 rx_polls; /* number of times NAPI called poll function */
++ u32 rx_events; /* number of ucast rx completion events */
++ u32 rx_compl; /* number of rx completion entries processed */
++ ulong rx_jiffies;
++ u64 rx_bytes;
++ u64 rx_bytes_prev;
++ u64 rx_pkts;
++ u32 rx_rate;
++ u32 rx_mcast_pkts;
++ u32 rxcp_err; /* Num rx completion entries w/ err set. */
++ ulong rx_fps_jiffies; /* jiffies at last FPS calc */
++ u32 rx_frags;
++ u32 prev_rx_frags;
++ u32 rx_fps; /* Rx frags per second */
++ u32 rx_drops_no_frags;
++};
++
++struct be_rx_compl_info {
++ u32 rss_hash;
++ u16 vlan_tag;
++ u16 pkt_size;
++ u16 rxq_idx;
++ u16 port;
++ u8 vlanf;
++ u8 num_rcvd;
++ u8 err;
++ u8 ipf;
++ u8 tcpf;
++ u8 udpf;
++ u8 ip_csum;
++ u8 l4_csum;
++ u8 ipv6;
++ u8 vtm;
++ u8 pkt_type;
++};
++
+ struct be_rx_obj {
++ struct be_adapter *adapter;
+ struct be_queue_info q;
+ struct be_queue_info cq;
+- struct be_rx_page_info page_info_tbl[RX_Q_LEN];
++ struct be_rx_compl_info rxcp;
++ struct be_rx_page_info *page_info_tbl;
++ struct net_lro_mgr lro_mgr;
++ struct net_lro_desc lro_desc[BE_MAX_LRO_DESCRIPTORS];
++ struct be_eq_obj rx_eq;
++ struct be_rx_stats stats;
++ u8 rss_id;
++ bool rx_post_starved; /* Zero rx frags have been posted to BE */
++ u16 prev_frag_idx;
++ u32 cache_line_barrier[16];
+ };
+
+-#define BE_NUM_MSIX_VECTORS 2 /* 1 each for Tx and Rx */
++struct be_drv_stats {
++ u32 be_on_die_temperature;
++ u32 be_tx_events;
++ u32 eth_red_drops;
++ u32 rx_drops_no_pbuf;
++ u32 rx_drops_no_txpb;
++ u32 rx_drops_no_erx_descr;
++ u32 rx_drops_no_tpre_descr;
++ u32 rx_drops_too_many_frags;
++ u32 rx_drops_invalid_ring;
++ u32 forwarded_packets;
++ u32 rx_drops_mtu;
++ u32 rx_crc_errors;
++ u32 rx_alignment_symbol_errors;
++ u32 rx_pause_frames;
++ u32 rx_priority_pause_frames;
++ u32 rx_control_frames;
++ u32 rx_in_range_errors;
++ u32 rx_out_range_errors;
++ u32 rx_frame_too_long;
++ u32 rx_address_match_errors;
++ u32 rx_dropped_too_small;
++ u32 rx_dropped_too_short;
++ u32 rx_dropped_header_too_small;
++ u32 rx_dropped_tcp_length;
++ u32 rx_dropped_runt;
++ u32 rx_ip_checksum_errs;
++ u32 rx_tcp_checksum_errs;
++ u32 rx_udp_checksum_errs;
++ u32 rx_switched_unicast_packets;
++ u32 rx_switched_multicast_packets;
++ u32 rx_switched_broadcast_packets;
++ u32 tx_pauseframes;
++ u32 tx_priority_pauseframes;
++ u32 tx_controlframes;
++ u32 rxpp_fifo_overflow_drop;
++ u32 rx_input_fifo_overflow_drop;
++ u32 pmem_fifo_overflow_drop;
++ u32 jabber_events;
++};
++
++struct be_vf_cfg {
++ unsigned char vf_mac_addr[ETH_ALEN];
++ u32 vf_if_handle;
++ u32 vf_pmac_id;
++ u16 vf_def_vid;
++ u16 vf_vlan_tag;
++ u32 vf_tx_rate;
++};
++
++#define BE_INVALID_PMAC_ID 0xffffffff
++#define BE_FLAGS_DCBX (1 << 16)
++
+ struct be_adapter {
+ struct pci_dev *pdev;
+ struct net_device *netdev;
+@@ -228,7 +342,7 @@ struct be_adapter {
+ u8 __iomem *db; /* Door Bell */
+ u8 __iomem *pcicfg; /* PCI config space */
+
+- spinlock_t mbox_lock; /* For serializing mbox cmds to BE card */
++ struct mutex mbox_lock; /* For serializing mbox cmds to BE card */
+ struct be_dma_mem mbox_mem;
+ /* Mbox mem is adjusted to align to 16 bytes. The allocated addr
+ * is stored for freeing purpose */
+@@ -238,66 +352,121 @@ struct be_adapter {
+ spinlock_t mcc_lock; /* For serializing mcc cmds to BE card */
+ spinlock_t mcc_cq_lock;
+
+- struct msix_entry msix_entries[BE_NUM_MSIX_VECTORS];
+- bool msix_enabled;
++ struct msix_entry msix_entries[BE_MAX_MSIX_VECTORS];
++ u32 num_msix_vec;
+ bool isr_registered;
+
+ /* TX Rings */
+ struct be_eq_obj tx_eq;
+- struct be_tx_obj tx_obj;
++ struct be_tx_obj tx_obj[MAX_TX_QS];
++ u8 num_tx_qs;
++ u8 prio_tc_map[MAX_TX_QS]; /* prio_tc_map[prio] => tc-id */
++ u8 tc_txq_map[MAX_TX_QS]; /* tc_txq_map[tc-id] => txq index */
+
+ u32 cache_line_break[8];
+
+ /* Rx rings */
+- struct be_eq_obj rx_eq;
+- struct be_rx_obj rx_obj;
++ struct be_rx_obj rx_obj[MAX_RX_QS]; /* one default non-rss Q */
++ u32 num_rx_qs;
++
++ struct be_dma_mem stats_cmd;
++ struct net_device_stats net_stats;
++ struct be_drv_stats drv_stats;
+ u32 big_page_size; /* Compounded page size shared by rx wrbs */
+- bool rx_post_starved; /* Zero rx frags have been posted to BE */
+
+ struct vlan_group *vlan_grp;
+- u16 num_vlans;
++ u16 vlans_added;
++ u16 max_vlans; /* Number of vlans supported */
+ u8 vlan_tag[VLAN_GROUP_ARRAY_LEN];
++ u8 vlan_prio_bmap; /* Available priority BitMap */
++ u16 recommended_prio; /* Recommended Priority */
++ struct be_dma_mem rx_filter;
+
+- struct be_stats_obj stats;
+ /* Work queue used to perform periodic tasks like getting statistics */
+ struct delayed_work work;
++ u16 work_counter;
+
+- /* Ethtool knobs and info */
+- bool rx_csum; /* BE card must perform rx-checksumming */
++ u32 flags;
++ bool rx_csum; /* BE card must perform rx-checksumming */
++ u32 max_rx_coal;
+ char fw_ver[FW_VER_LEN];
+ u32 if_handle; /* Used to configure filtering */
+ u32 pmac_id; /* MAC addr handle used by BE card */
++ u32 beacon_state; /* for set_phys_id */
+
+- bool link_up;
++ bool eeh_err;
++ int link_status;
+ u32 port_num;
++ u32 hba_port_num;
+ bool promiscuous;
+- u32 cap;
++ bool wol;
++ u32 function_mode;
++ u32 function_caps;
+ u32 rx_fc; /* Rx flow control */
+ u32 tx_fc; /* Tx flow control */
++ bool ue_detected;
++ bool stats_cmd_sent;
++ bool gro_supported;
++ int link_speed;
++ u8 port_type;
++ u8 transceiver;
++ u8 autoneg;
+ u8 generation; /* BladeEngine ASIC generation */
++ u32 flash_status;
++ struct completion flash_compl;
++
++ u8 eq_next_idx;
++ bool be3_native;
++ u16 num_vfs;
++ struct be_vf_cfg *vf_cfg;
++ u8 is_virtfn;
++ u16 pvid;
++ u32 sli_family;
++ u8 port_name[4];
++ char model_number[32];
+ };
+
+ /* BladeEngine Generation numbers */
+ #define BE_GEN2 2
+ #define BE_GEN3 3
+
+-extern const struct ethtool_ops be_ethtool_ops;
++#define ON 1
++#define OFF 0
++#define lancer_chip(adapter) (adapter->pdev->device == OC_DEVICE_ID3)
++#define lancer_A0_chip(adapter) \
++ (adapter->sli_family == LANCER_A0_SLI_FAMILY)
+
+-#define drvr_stats(adapter) (&adapter->stats.drvr_stats)
++extern struct ethtool_ops be_ethtool_ops;
+
+-static inline unsigned int be_pci_func(struct be_adapter *adapter)
+-{
+- return PCI_FUNC(adapter->pdev->devfn);
+-}
++#define msix_enabled(adapter) (adapter->num_msix_vec > 0)
++#define tx_stats(txo) (&txo->stats)
++#define rx_stats(rxo) (&rxo->stats)
+
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 29)
++#define BE_SET_NETDEV_OPS(netdev, ops) be_netdev_ops_init(netdev, ops)
++#else
+ #define BE_SET_NETDEV_OPS(netdev, ops) (netdev->netdev_ops = ops)
++#endif
++
++#define for_all_rx_queues(adapter, rxo, i) \
++ for (i = 0, rxo = &adapter->rx_obj[i]; i < adapter->num_rx_qs; \
++ i++, rxo++)
++
++/* Just skip the first default non-rss queue */
++#define for_all_rss_queues(adapter, rxo, i) \
++ for (i = 0, rxo = &adapter->rx_obj[i+1]; i < (adapter->num_rx_qs - 1);\
++ i++, rxo++)
++
++#define for_all_tx_queues(adapter, txo, i) \
++ for (i = 0, txo = &adapter->tx_obj[i]; i < adapter->num_tx_qs; \
++ i++, txo++)
+
+ #define PAGE_SHIFT_4K 12
+ #define PAGE_SIZE_4K (1 << PAGE_SHIFT_4K)
+
+ /* Returns number of pages spanned by the data starting at the given addr */
+-#define PAGES_4K_SPANNED(_address, size) \
+- ((u32)((((size_t)(_address) & (PAGE_SIZE_4K - 1)) + \
++#define PAGES_4K_SPANNED(_address, size) \
++ ((u32)((((size_t)(_address) & (PAGE_SIZE_4K - 1)) + \
+ (size) + (PAGE_SIZE_4K - 1)) >> PAGE_SHIFT_4K))
+
+ /* Byte offset into the page corresponding to given address */
+@@ -305,7 +474,7 @@ static inline unsigned int be_pci_func(struct be_adapter *adapter)
+ ((size_t)(addr) & (PAGE_SIZE_4K-1))
+
+ /* Returns bit offset within a DWORD of a bitfield */
+-#define AMAP_BIT_OFFSET(_struct, field) \
++#define AMAP_BIT_OFFSET(_struct, field) \
+ (((size_t)&(((_struct *)0)->field))%32)
+
+ /* Returns the bit mask of the field that is NOT shifted into location. */
+@@ -356,6 +525,11 @@ static inline void swap_dws(void *wrb, int len)
+ #endif /* __BIG_ENDIAN */
+ }
+
++static inline bool vlan_configured(struct be_adapter *adapter)
++{
++ return adapter->vlan_grp && adapter->vlans_added;
++}
++
+ static inline u8 is_tcp_pkt(struct sk_buff *skb)
+ {
+ u8 val = 0;
+@@ -380,9 +554,65 @@ static inline u8 is_udp_pkt(struct sk_buff *skb)
+ return val;
+ }
+
++static inline u8 is_ipv6_ext_hdr(struct sk_buff *skb)
++{
++#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
++ if (ip_hdr(skb)->version == 6)
++ return ipv6_ext_hdr(ipv6_hdr(skb)->nexthdr);
++ else
++#endif
++ return 0;
++}
++
++static inline void be_check_sriov_fn_type(struct be_adapter *adapter)
++{
++ u32 sli_intf;
++
++ pci_read_config_dword(adapter->pdev, SLI_INTF_REG_OFFSET, &sli_intf);
++ adapter->is_virtfn = (sli_intf & SLI_INTF_FT_MASK) ? 1 : 0;
++}
++
++static inline void be_vf_eth_addr_generate(struct be_adapter *adapter, u8 *mac)
++{
++ u32 addr;
++
++ addr = jhash(adapter->netdev->dev_addr, ETH_ALEN, 0);
++
++ mac[5] = (u8)(addr & 0xFF);
++ mac[4] = (u8)((addr >> 8) & 0xFF);
++ mac[3] = (u8)((addr >> 16) & 0xFF);
++ /* Use the OUI programmed in hardware */
++ memcpy(mac, adapter->netdev->dev_addr, 3);
++}
++
++static inline u16 be_get_tx_vlan_tag(struct be_adapter *adapter,
++ struct sk_buff *skb)
++{
++ u8 vlan_prio = 0;
++ u16 vlan_tag = 0;
++
++ vlan_tag = vlan_tx_tag_get(skb);
++ vlan_prio = (vlan_tag & VLAN_PRIO_MASK) >> VLAN_PRIO_SHIFT;
++ /* If vlan priority provided by OS is NOT in available bmap */
++ if (!(adapter->vlan_prio_bmap & (1 << vlan_prio)))
++ vlan_tag = (vlan_tag & ~VLAN_PRIO_MASK) |
++ adapter->recommended_prio;
++
++ return vlan_tag;
++}
++
++#define be_physfn(adapter) (!adapter->is_virtfn)
++
+ extern void be_cq_notify(struct be_adapter *adapter, u16 qid, bool arm,
+ u16 num_popped);
+-extern void be_link_status_update(struct be_adapter *adapter, bool link_up);
++extern void be_link_status_update(struct be_adapter *adapter, int link_status);
+ extern void netdev_stats_update(struct be_adapter *adapter);
++extern void be_parse_stats(struct be_adapter *adapter);
+ extern int be_load_fw(struct be_adapter *adapter, u8 *func);
++
++#ifdef CONFIG_PALAU
++extern void be_sysfs_create_group(struct be_adapter *adapter);
++extern void be_sysfs_remove_group(struct be_adapter *adapter);
++#endif
++
+ #endif /* BE_H */
+diff --git a/drivers/net/benet/be_cmds.c b/drivers/net/benet/be_cmds.c
+index 28a0eda..b4ca89c 100644
+--- a/drivers/net/benet/be_cmds.c
++++ b/drivers/net/benet/be_cmds.c
+@@ -1,30 +1,45 @@
+ /*
+- * Copyright (C) 2005 - 2009 ServerEngines
++ * Copyright (C) 2005 - 2011 Emulex
+ * All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License version 2
+- * as published by the Free Software Foundation. The full GNU General
++ * as published by the Free Software Foundation. The full GNU General
+ * Public License is included in this distribution in the file called COPYING.
+ *
+ * Contact Information:
+- * linux-drivers@serverengines.com
++ * linux-drivers@emulex.com
+ *
+- * ServerEngines
+- * 209 N. Fair Oaks Ave
+- * Sunnyvale, CA 94085
++ * Emulex
++ * 3333 Susan Street
++ * Costa Mesa, CA 92626
+ */
+
+ #include "be.h"
+ #include "be_cmds.h"
+
++/* Must be a power of 2 or else MODULO will BUG_ON */
++static int be_get_temp_freq = 64;
++
++static inline void *embedded_payload(struct be_mcc_wrb *wrb)
++{
++ return wrb->payload.embedded_payload;
++}
++
+ static void be_mcc_notify(struct be_adapter *adapter)
+ {
+ struct be_queue_info *mccq = &adapter->mcc_obj.q;
+ u32 val = 0;
+
++ if (adapter->eeh_err) {
++ dev_info(&adapter->pdev->dev, "Error in Card Detected! Cannot issue commands\n");
++ return;
++ }
++
+ val |= mccq->id & DB_MCCQ_RING_ID_MASK;
+ val |= 1 << DB_MCCQ_NUM_POSTED_SHIFT;
++
++ wmb();
+ iowrite32(val, adapter->db + DB_MCCQ_OFFSET);
+ }
+
+@@ -59,21 +74,67 @@ static int be_mcc_compl_process(struct be_adapter *adapter,
+
+ compl_status = (compl->status >> CQE_STATUS_COMPL_SHIFT) &
+ CQE_STATUS_COMPL_MASK;
++
++ if ((compl->tag0 == OPCODE_COMMON_WRITE_FLASHROM) &&
++ (compl->tag1 == CMD_SUBSYSTEM_COMMON)) {
++ adapter->flash_status = compl_status;
++ complete(&adapter->flash_compl);
++ }
++
+ if (compl_status == MCC_STATUS_SUCCESS) {
+- if (compl->tag0 == OPCODE_ETH_GET_STATISTICS) {
+- struct be_cmd_resp_get_stats *resp =
+- adapter->stats.cmd.va;
+- be_dws_le_to_cpu(&resp->hw_stats,
+- sizeof(resp->hw_stats));
++ if ((compl->tag0 == OPCODE_ETH_GET_STATISTICS) &&
++ (compl->tag1 == CMD_SUBSYSTEM_ETH)) {
++ if (adapter->generation == BE_GEN3) {
++ struct be_cmd_resp_get_stats_v1 *resp =
++ adapter->stats_cmd.va;
++
++ be_dws_le_to_cpu(&resp->hw_stats,
++ sizeof(resp->hw_stats));
++ } else {
++ struct be_cmd_resp_get_stats_v0 *resp =
++ adapter->stats_cmd.va;
++
++ be_dws_le_to_cpu(&resp->hw_stats,
++ sizeof(resp->hw_stats));
++ }
++ be_parse_stats(adapter);
+ netdev_stats_update(adapter);
++ adapter->stats_cmd_sent = false;
++ }
++ if (compl->tag0 ==
++ OPCODE_COMMON_GET_CNTL_ADDITIONAL_ATTRIBUTES) {
++ struct be_mcc_wrb *mcc_wrb =
++ queue_index_node(&adapter->mcc_obj.q,
++ compl->tag1);
++ struct be_cmd_resp_get_cntl_addnl_attribs *resp =
++ embedded_payload(mcc_wrb);
++ adapter->drv_stats.be_on_die_temperature =
++ resp->on_die_temperature;
++ }
++ } else {
++ if (compl->tag0 == OPCODE_COMMON_GET_CNTL_ADDITIONAL_ATTRIBUTES)
++ be_get_temp_freq = 0;
++
++ if (compl->tag1 == MCC_WRB_PASS_THRU)
++ goto done;
++
++ if (compl_status == MCC_STATUS_NOT_SUPPORTED ||
++ compl_status == MCC_STATUS_ILLEGAL_REQUEST)
++ goto done;
++
++ if (compl_status == MCC_STATUS_UNAUTHORIZED_REQUEST) {
++ dev_warn(&adapter->pdev->dev, "This domain(VM) is not "
++ "permitted to execute this cmd (opcode %d)\n",
++ compl->tag0);
++ } else {
++ extd_status = (compl->status >> CQE_STATUS_EXTD_SHIFT) &
++ CQE_STATUS_EXTD_MASK;
++ dev_err(&adapter->pdev->dev, "Cmd (opcode %d) failed:"
++ "status %d, extd-status %d\n",
++ compl->tag0, compl_status, extd_status);
+ }
+- } else if (compl_status != MCC_STATUS_NOT_SUPPORTED) {
+- extd_status = (compl->status >> CQE_STATUS_EXTD_SHIFT) &
+- CQE_STATUS_EXTD_MASK;
+- dev_warn(&adapter->pdev->dev,
+- "Error in cmd completion: status(compl/extd)=%d/%d\n",
+- compl_status, extd_status);
+ }
++done:
+ return compl_status;
+ }
+
+@@ -82,7 +143,70 @@ static void be_async_link_state_process(struct be_adapter *adapter,
+ struct be_async_event_link_state *evt)
+ {
+ be_link_status_update(adapter,
+- evt->port_link_status == ASYNC_EVENT_LINK_UP);
++ ((evt->port_link_status & ~ASYNC_EVENT_LOGICAL) ==
++ ASYNC_EVENT_LINK_UP ? LINK_UP : LINK_DOWN));
++}
++
++/* Grp5 CoS Priority evt */
++static void be_async_grp5_cos_priority_process(struct be_adapter *adapter,
++ struct be_async_event_grp5_cos_priority *evt)
++{
++ if (evt->valid) {
++ adapter->vlan_prio_bmap = evt->available_priority_bmap;
++ adapter->recommended_prio &= ~VLAN_PRIO_MASK;
++ adapter->recommended_prio =
++ evt->reco_default_priority << VLAN_PRIO_SHIFT;
++ }
++}
++
++/* Grp5 QOS Speed evt */
++static void be_async_grp5_qos_speed_process(struct be_adapter *adapter,
++ struct be_async_event_grp5_qos_link_speed *evt)
++{
++ if (evt->physical_port == adapter->hba_port_num) {
++ /* qos_link_speed is in units of 10 Mbps */
++ adapter->link_speed = evt->qos_link_speed * 10;
++ }
++}
++
++/*Grp5 PVID evt*/
++static void be_async_grp5_pvid_state_process(struct be_adapter *adapter,
++ struct be_async_event_grp5_pvid_state *evt)
++{
++ if (evt->enabled)
++ adapter->pvid = le16_to_cpu(evt->tag) & VLAN_VID_MASK ;
++ else
++ adapter->pvid = 0;
++}
++
++static void be_async_grp5_evt_process(struct be_adapter *adapter,
++ u32 trailer, struct be_mcc_compl *evt)
++{
++ u8 event_type = 0;
++
++ event_type = (trailer >> ASYNC_TRAILER_EVENT_TYPE_SHIFT) &
++ ASYNC_TRAILER_EVENT_TYPE_MASK;
++
++ switch (event_type) {
++ case ASYNC_EVENT_COS_PRIORITY:
++ be_async_grp5_cos_priority_process(adapter,
++ (struct be_async_event_grp5_cos_priority *)evt);
++ break;
++ case ASYNC_EVENT_QOS_SPEED:
++ be_async_grp5_qos_speed_process(adapter,
++ (struct be_async_event_grp5_qos_link_speed *)evt);
++ break;
++ case ASYNC_EVENT_PVID_STATE:
++ be_async_grp5_pvid_state_process(adapter,
++ (struct be_async_event_grp5_pvid_state *)evt);
++ break;
++ case GRP5_TYPE_PRIO_TC_MAP:
++ memcpy(adapter->prio_tc_map, evt, MAX_TX_QS);
++ break;
++ default:
++ printk(KERN_WARNING "Unknown grp5 event!\n");
++ break;
++ }
+ }
+
+ static inline bool is_link_state_evt(u32 trailer)
+@@ -92,6 +216,13 @@ static inline bool is_link_state_evt(u32 trailer)
+ ASYNC_EVENT_CODE_LINK_STATE);
+ }
+
++static inline bool is_grp5_evt(u32 trailer)
++{
++ return (((trailer >> ASYNC_TRAILER_EVENT_CODE_SHIFT) &
++ ASYNC_TRAILER_EVENT_CODE_MASK) ==
++ ASYNC_EVENT_CODE_GRP_5);
++}
++
+ static struct be_mcc_compl *be_mcc_compl_get(struct be_adapter *adapter)
+ {
+ struct be_queue_info *mcc_cq = &adapter->mcc_obj.cq;
+@@ -104,46 +235,67 @@ static struct be_mcc_compl *be_mcc_compl_get(struct be_adapter *adapter)
+ return NULL;
+ }
+
+-int be_process_mcc(struct be_adapter *adapter)
++void be_async_mcc_enable(struct be_adapter *adapter)
++{
++ spin_lock_bh(&adapter->mcc_cq_lock);
++
++ be_cq_notify(adapter, adapter->mcc_obj.cq.id, true, 0);
++ adapter->mcc_obj.rearm_cq = true;
++
++ spin_unlock_bh(&adapter->mcc_cq_lock);
++}
++
++void be_async_mcc_disable(struct be_adapter *adapter)
++{
++ adapter->mcc_obj.rearm_cq = false;
++}
++
++int be_process_mcc(struct be_adapter *adapter, int *status)
+ {
+ struct be_mcc_compl *compl;
+- int num = 0, status = 0;
++ int num = 0;
++ struct be_mcc_obj *mcc_obj = &adapter->mcc_obj;
+
+ spin_lock_bh(&adapter->mcc_cq_lock);
+ while ((compl = be_mcc_compl_get(adapter))) {
+ if (compl->flags & CQE_FLAGS_ASYNC_MASK) {
+ /* Interpret flags as an async trailer */
+- BUG_ON(!is_link_state_evt(compl->flags));
+-
+- /* Interpret compl as a async link evt */
+- be_async_link_state_process(adapter,
++ if (is_link_state_evt(compl->flags))
++ be_async_link_state_process(adapter,
+ (struct be_async_event_link_state *) compl);
++ else if (is_grp5_evt(compl->flags))
++ be_async_grp5_evt_process(adapter,
++ compl->flags, compl);
++
+ } else if (compl->flags & CQE_FLAGS_COMPLETED_MASK) {
+- status = be_mcc_compl_process(adapter, compl);
+- atomic_dec(&adapter->mcc_obj.q.used);
++ *status = be_mcc_compl_process(adapter, compl);
++ atomic_dec(&mcc_obj->q.used);
+ }
+ be_mcc_compl_use(compl);
+ num++;
+ }
+
+- if (num)
+- be_cq_notify(adapter, adapter->mcc_obj.cq.id, true, num);
+-
+ spin_unlock_bh(&adapter->mcc_cq_lock);
+- return status;
++ return num;
+ }
+
+ /* Wait till no more pending mcc requests are present */
+ static int be_mcc_wait_compl(struct be_adapter *adapter)
+ {
+ #define mcc_timeout 120000 /* 12s timeout */
+- int i, status;
++ int i, num, status = 0;
++ struct be_mcc_obj *mcc_obj = &adapter->mcc_obj;
++
++ if (adapter->eeh_err)
++ return -EIO;
++
+ for (i = 0; i < mcc_timeout; i++) {
+- status = be_process_mcc(adapter);
+- if (status)
+- return status;
++ num = be_process_mcc(adapter, &status);
++ if (num)
++ be_cq_notify(adapter, mcc_obj->cq.id,
++ mcc_obj->rearm_cq, num);
+
+- if (atomic_read(&adapter->mcc_obj.q.used) == 0)
++ if (atomic_read(&mcc_obj->q.used) == 0)
+ break;
+ udelay(100);
+ }
+@@ -151,7 +303,7 @@ static int be_mcc_wait_compl(struct be_adapter *adapter)
+ dev_err(&adapter->pdev->dev, "mccq poll timed out\n");
+ return -1;
+ }
+- return 0;
++ return status;
+ }
+
+ /* Notify MCC requests and wait for completion */
+@@ -163,23 +315,34 @@ static int be_mcc_notify_wait(struct be_adapter *adapter)
+
+ static int be_mbox_db_ready_wait(struct be_adapter *adapter, void __iomem *db)
+ {
+- int cnt = 0, wait = 5;
++ int msecs = 0;
+ u32 ready;
+
++ if (adapter->eeh_err) {
++ dev_err(&adapter->pdev->dev, "Error detected in card.Cannot issue commands\n");
++ return -EIO;
++ }
+ do {
+- ready = ioread32(db) & MPU_MAILBOX_DB_RDY_MASK;
++ ready = ioread32(db);
++ if (ready == 0xffffffff) {
++ dev_err(&adapter->pdev->dev,
++ "pci slot disconnected\n");
++ return -1;
++ }
++
++ ready &= MPU_MAILBOX_DB_RDY_MASK;
+ if (ready)
+ break;
+
+- if (cnt > 4000000) {
++ if (msecs > 4000) {
+ dev_err(&adapter->pdev->dev, "mbox poll timed out\n");
++ be_detect_dump_ue(adapter);
+ return -1;
+ }
+
+- if (cnt > 50)
+- wait = 200;
+- cnt += wait;
+- udelay(wait);
++ set_current_state(TASK_UNINTERRUPTIBLE);
++ schedule_timeout(msecs_to_jiffies(1));
++ msecs++;
+ } while (true);
+
+ return 0;
+@@ -198,6 +361,11 @@ static int be_mbox_notify_wait(struct be_adapter *adapter)
+ struct be_mcc_mailbox *mbox = mbox_mem->va;
+ struct be_mcc_compl *compl = &mbox->compl;
+
++ /* wait for ready to be set */
++ status = be_mbox_db_ready_wait(adapter, db);
++ if (status != 0)
++ return status;
++
+ val |= MPU_MAILBOX_DB_HI_MASK;
+ /* at bits 2 - 31 place mbox dma addr msb bits 34 - 63 */
+ val |= (upper_32_bits(mbox_mem->dma) >> 2) << 2;
+@@ -232,7 +400,12 @@ static int be_mbox_notify_wait(struct be_adapter *adapter)
+
+ static int be_POST_stage_get(struct be_adapter *adapter, u16 *stage)
+ {
+- u32 sem = ioread32(adapter->csr + MPU_EP_SEMAPHORE_OFFSET);
++ u32 sem;
++
++ if (lancer_chip(adapter))
++ sem = ioread32(adapter->db + MPU_EP_SEMAPHORE_IF_TYPE2_OFFSET);
++ else
++ sem = ioread32(adapter->csr + MPU_EP_SEMAPHORE_OFFSET);
+
+ *stage = sem & EP_SEMAPHORE_POST_STAGE_MASK;
+ if ((sem >> EP_SEMAPHORE_POST_ERR_SHIFT) & EP_SEMAPHORE_POST_ERR_MASK)
+@@ -245,30 +418,29 @@ int be_cmd_POST(struct be_adapter *adapter)
+ {
+ u16 stage;
+ int status, timeout = 0;
++ struct device *dev = &adapter->pdev->dev;
+
+ do {
+ status = be_POST_stage_get(adapter, &stage);
+ if (status) {
+- dev_err(&adapter->pdev->dev, "POST error; stage=0x%x\n",
+- stage);
++ dev_err(dev, "POST error; stage=0x%x\n", stage);
+ return -1;
+ } else if (stage != POST_STAGE_ARMFW_RDY) {
+ set_current_state(TASK_INTERRUPTIBLE);
+- schedule_timeout(2 * HZ);
++ if (schedule_timeout(2 * HZ)) {
++ dev_err(dev, "POST cmd aborted\n");
++ return -EINTR;
++ }
+ timeout += 2;
+ } else {
+ return 0;
+ }
+- } while (timeout < 20);
++ } while (timeout < 40);
+
+- dev_err(&adapter->pdev->dev, "POST timeout; stage=0x%x\n", stage);
++ dev_err(dev, "POST timeout; stage=0x%x\n", stage);
+ return -1;
+ }
+
+-static inline void *embedded_payload(struct be_mcc_wrb *wrb)
+-{
+- return wrb->payload.embedded_payload;
+-}
+
+ static inline struct be_sge *nonembedded_sgl(struct be_mcc_wrb *wrb)
+ {
+@@ -277,7 +449,7 @@ static inline struct be_sge *nonembedded_sgl(struct be_mcc_wrb *wrb)
+
+ /* Don't touch the hdr after it's prepared */
+ static void be_wrb_hdr_prepare(struct be_mcc_wrb *wrb, int payload_len,
+- bool embedded, u8 sge_cnt)
++ bool embedded, u8 sge_cnt, u32 opcode)
+ {
+ if (embedded)
+ wrb->embedded |= MCC_WRB_EMBEDDED_MASK;
+@@ -285,7 +457,8 @@ static void be_wrb_hdr_prepare(struct be_mcc_wrb *wrb, int payload_len,
+ wrb->embedded |= (sge_cnt & MCC_WRB_SGE_CNT_MASK) <<
+ MCC_WRB_SGE_CNT_SHIFT;
+ wrb->payload_length = payload_len;
+- be_dws_cpu_to_le(wrb, 20);
++ wrb->tag0 = opcode;
++ be_dws_cpu_to_le(wrb, 8);
+ }
+
+ /* Don't touch the hdr after it's prepared */
+@@ -295,6 +468,7 @@ static void be_cmd_hdr_prepare(struct be_cmd_req_hdr *req_hdr,
+ req_hdr->opcode = opcode;
+ req_hdr->subsystem = subsystem;
+ req_hdr->request_length = cpu_to_le32(cmd_len - sizeof(*req_hdr));
++ req_hdr->version = 0;
+ }
+
+ static void be_cmd_page_addrs_prepare(struct phys_addr *pages, u32 max_pages,
+@@ -349,7 +523,11 @@ static struct be_mcc_wrb *wrb_from_mccq(struct be_adapter *adapter)
+ struct be_queue_info *mccq = &adapter->mcc_obj.q;
+ struct be_mcc_wrb *wrb;
+
+- BUG_ON(atomic_read(&mccq->used) >= mccq->len);
++ if (atomic_read(&mccq->used) >= mccq->len) {
++ dev_err(&adapter->pdev->dev, "Out of MCCQ wrbs\n");
++ return NULL;
++ }
++
+ wrb = queue_head_node(mccq);
+ queue_head_inc(mccq);
+ atomic_inc(&mccq->used);
+@@ -357,6 +535,59 @@ static struct be_mcc_wrb *wrb_from_mccq(struct be_adapter *adapter)
+ return wrb;
+ }
+
++/* Tell fw we're about to start firing cmds by writing a
++ * special pattern across the wrb hdr; uses mbox
++ */
++int be_cmd_fw_init(struct be_adapter *adapter)
++{
++ u8 *wrb;
++ int status;
++
++ if (mutex_lock_interruptible(&adapter->mbox_lock))
++ return -1;
++
++ wrb = (u8 *)wrb_from_mbox(adapter);
++ *wrb++ = 0xFF;
++ *wrb++ = 0x12;
++ *wrb++ = 0x34;
++ *wrb++ = 0xFF;
++ *wrb++ = 0xFF;
++ *wrb++ = 0x56;
++ *wrb++ = 0x78;
++ *wrb = 0xFF;
++
++ status = be_mbox_notify_wait(adapter);
++
++ mutex_unlock(&adapter->mbox_lock);
++ return status;
++}
++
++/* Tell fw we're done with firing cmds by writing a
++ * special pattern across the wrb hdr; uses mbox
++ */
++int be_cmd_fw_clean(struct be_adapter *adapter)
++{
++ u8 *wrb;
++ int status;
++
++ if (mutex_lock_interruptible(&adapter->mbox_lock))
++ return -1;
++
++ wrb = (u8 *)wrb_from_mbox(adapter);
++ *wrb++ = 0xFF;
++ *wrb++ = 0xAA;
++ *wrb++ = 0xBB;
++ *wrb++ = 0xFF;
++ *wrb++ = 0xFF;
++ *wrb++ = 0xCC;
++ *wrb++ = 0xDD;
++ *wrb = 0xFF;
++
++ status = be_mbox_notify_wait(adapter);
++
++ mutex_unlock(&adapter->mbox_lock);
++ return status;
++}
+ int be_cmd_eq_create(struct be_adapter *adapter,
+ struct be_queue_info *eq, int eq_delay)
+ {
+@@ -365,20 +596,19 @@ int be_cmd_eq_create(struct be_adapter *adapter,
+ struct be_dma_mem *q_mem = &eq->dma_mem;
+ int status;
+
+- spin_lock(&adapter->mbox_lock);
++ if (mutex_lock_interruptible(&adapter->mbox_lock))
++ return -1;
+
+ wrb = wrb_from_mbox(adapter);
+ req = embedded_payload(wrb);
+
+- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0, OPCODE_COMMON_EQ_CREATE);
+
+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
+ OPCODE_COMMON_EQ_CREATE, sizeof(*req));
+
+ req->num_pages = cpu_to_le16(PAGES_4K_SPANNED(q_mem->va, q_mem->size));
+
+- AMAP_SET_BITS(struct amap_eq_context, func, req->context,
+- be_pci_func(adapter));
+ AMAP_SET_BITS(struct amap_eq_context, valid, req->context, 1);
+ /* 4byte eqe*/
+ AMAP_SET_BITS(struct amap_eq_context, size, req->context, 0);
+@@ -397,7 +627,7 @@ int be_cmd_eq_create(struct be_adapter *adapter,
+ eq->created = true;
+ }
+
+- spin_unlock(&adapter->mbox_lock);
++ mutex_unlock(&adapter->mbox_lock);
+ return status;
+ }
+
+@@ -409,12 +639,14 @@ int be_cmd_mac_addr_query(struct be_adapter *adapter, u8 *mac_addr,
+ struct be_cmd_req_mac_query *req;
+ int status;
+
+- spin_lock(&adapter->mbox_lock);
++ if (mutex_lock_interruptible(&adapter->mbox_lock))
++ return -1;
+
+ wrb = wrb_from_mbox(adapter);
+ req = embedded_payload(wrb);
+
+- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
++ OPCODE_COMMON_NTWK_MAC_QUERY);
+
+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
+ OPCODE_COMMON_NTWK_MAC_QUERY, sizeof(*req));
+@@ -433,13 +665,13 @@ int be_cmd_mac_addr_query(struct be_adapter *adapter, u8 *mac_addr,
+ memcpy(mac_addr, resp->mac.addr, ETH_ALEN);
+ }
+
+- spin_unlock(&adapter->mbox_lock);
++ mutex_unlock(&adapter->mbox_lock);
+ return status;
+ }
+
+ /* Uses synchronous MCCQ */
+ int be_cmd_pmac_add(struct be_adapter *adapter, u8 *mac_addr,
+- u32 if_id, u32 *pmac_id)
++ u32 if_id, u32 *pmac_id, u32 domain)
+ {
+ struct be_mcc_wrb *wrb;
+ struct be_cmd_req_pmac_add *req;
+@@ -448,13 +680,19 @@ int be_cmd_pmac_add(struct be_adapter *adapter, u8 *mac_addr,
+ spin_lock_bh(&adapter->mcc_lock);
+
+ wrb = wrb_from_mccq(adapter);
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
+ req = embedded_payload(wrb);
+
+- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
++ OPCODE_COMMON_NTWK_PMAC_ADD);
+
+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
+ OPCODE_COMMON_NTWK_PMAC_ADD, sizeof(*req));
+
++ req->hdr.domain = domain;
+ req->if_id = cpu_to_le32(if_id);
+ memcpy(req->mac_address, mac_addr, ETH_ALEN);
+
+@@ -464,12 +702,13 @@ int be_cmd_pmac_add(struct be_adapter *adapter, u8 *mac_addr,
+ *pmac_id = le32_to_cpu(resp->pmac_id);
+ }
+
++err:
+ spin_unlock_bh(&adapter->mcc_lock);
+ return status;
+ }
+
+ /* Uses synchronous MCCQ */
+-int be_cmd_pmac_del(struct be_adapter *adapter, u32 if_id, u32 pmac_id)
++int be_cmd_pmac_del(struct be_adapter *adapter, u32 if_id, u32 pmac_id, u32 dom)
+ {
+ struct be_mcc_wrb *wrb;
+ struct be_cmd_req_pmac_del *req;
+@@ -478,20 +717,26 @@ int be_cmd_pmac_del(struct be_adapter *adapter, u32 if_id, u32 pmac_id)
+ spin_lock_bh(&adapter->mcc_lock);
+
+ wrb = wrb_from_mccq(adapter);
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
+ req = embedded_payload(wrb);
+
+- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
++ OPCODE_COMMON_NTWK_PMAC_DEL);
+
+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
+ OPCODE_COMMON_NTWK_PMAC_DEL, sizeof(*req));
+
++ req->hdr.domain = dom;
+ req->if_id = cpu_to_le32(if_id);
+ req->pmac_id = cpu_to_le32(pmac_id);
+
+ status = be_mcc_notify_wait(adapter);
+
++err:
+ spin_unlock_bh(&adapter->mcc_lock);
+-
+ return status;
+ }
+
+@@ -506,29 +751,51 @@ int be_cmd_cq_create(struct be_adapter *adapter,
+ void *ctxt;
+ int status;
+
+- spin_lock(&adapter->mbox_lock);
++ if (mutex_lock_interruptible(&adapter->mbox_lock))
++ return -1;
+
+ wrb = wrb_from_mbox(adapter);
+ req = embedded_payload(wrb);
+ ctxt = &req->context;
+
+- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
++ OPCODE_COMMON_CQ_CREATE);
+
+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
+ OPCODE_COMMON_CQ_CREATE, sizeof(*req));
+
+ req->num_pages = cpu_to_le16(PAGES_4K_SPANNED(q_mem->va, q_mem->size));
+
+- AMAP_SET_BITS(struct amap_cq_context, coalescwm, ctxt, coalesce_wm);
+- AMAP_SET_BITS(struct amap_cq_context, nodelay, ctxt, no_delay);
+- AMAP_SET_BITS(struct amap_cq_context, count, ctxt,
+- __ilog2_u32(cq->len/256));
+- AMAP_SET_BITS(struct amap_cq_context, valid, ctxt, 1);
+- AMAP_SET_BITS(struct amap_cq_context, solevent, ctxt, sol_evts);
+- AMAP_SET_BITS(struct amap_cq_context, eventable, ctxt, 1);
+- AMAP_SET_BITS(struct amap_cq_context, eqid, ctxt, eq->id);
+- AMAP_SET_BITS(struct amap_cq_context, armed, ctxt, 1);
+- AMAP_SET_BITS(struct amap_cq_context, func, ctxt, be_pci_func(adapter));
++ if (lancer_chip(adapter)) {
++ req->hdr.version = 2;
++ req->page_size = 1; /* 1 for 4K */
++ AMAP_SET_BITS(struct amap_cq_context_lancer, coalescwm, ctxt,
++ coalesce_wm);
++ AMAP_SET_BITS(struct amap_cq_context_lancer, nodelay, ctxt,
++ no_delay);
++ AMAP_SET_BITS(struct amap_cq_context_lancer, count, ctxt,
++ __ilog2_u32(cq->len/256));
++ AMAP_SET_BITS(struct amap_cq_context_lancer, valid, ctxt, 1);
++ AMAP_SET_BITS(struct amap_cq_context_lancer, eventable,
++ ctxt, 1);
++ AMAP_SET_BITS(struct amap_cq_context_lancer, eqid,
++ ctxt, eq->id);
++ AMAP_SET_BITS(struct amap_cq_context_lancer, armed, ctxt, 1);
++ } else {
++ AMAP_SET_BITS(struct amap_cq_context_be, coalescwm, ctxt,
++ coalesce_wm);
++ AMAP_SET_BITS(struct amap_cq_context_be, nodelay,
++ ctxt, no_delay);
++ AMAP_SET_BITS(struct amap_cq_context_be, count, ctxt,
++ __ilog2_u32(cq->len/256));
++ AMAP_SET_BITS(struct amap_cq_context_be, valid, ctxt, 1);
++ AMAP_SET_BITS(struct amap_cq_context_be, solevent,
++ ctxt, sol_evts);
++ AMAP_SET_BITS(struct amap_cq_context_be, eventable, ctxt, 1);
++ AMAP_SET_BITS(struct amap_cq_context_be, eqid, ctxt, eq->id);
++ AMAP_SET_BITS(struct amap_cq_context_be, armed, ctxt, 1);
++ }
++
+ be_dws_cpu_to_le(ctxt, sizeof(req->context));
+
+ be_cmd_page_addrs_prepare(req->pages, ARRAY_SIZE(req->pages), q_mem);
+@@ -540,8 +807,7 @@ int be_cmd_cq_create(struct be_adapter *adapter,
+ cq->created = true;
+ }
+
+- spin_unlock(&adapter->mbox_lock);
+-
++ mutex_unlock(&adapter->mbox_lock);
+ return status;
+ }
+
+@@ -553,7 +819,68 @@ static u32 be_encoded_q_len(int q_len)
+ return len_encoded;
+ }
+
+-int be_cmd_mccq_create(struct be_adapter *adapter,
++int be_cmd_mccq_ext_create(struct be_adapter *adapter,
++ struct be_queue_info *mccq,
++ struct be_queue_info *cq)
++{
++ struct be_mcc_wrb *wrb;
++ struct be_cmd_req_mcc_ext_create *req;
++ struct be_dma_mem *q_mem = &mccq->dma_mem;
++ void *ctxt;
++ int status;
++
++ if (mutex_lock_interruptible(&adapter->mbox_lock))
++ return -1;
++
++ wrb = wrb_from_mbox(adapter);
++ req = embedded_payload(wrb);
++ ctxt = &req->context;
++
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
++ OPCODE_COMMON_MCC_CREATE_EXT);
++
++ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
++ OPCODE_COMMON_MCC_CREATE_EXT, sizeof(*req));
++
++ req->num_pages = cpu_to_le16(PAGES_4K_SPANNED(q_mem->va, q_mem->size));
++ if (lancer_chip(adapter)) {
++ req->hdr.version = 1;
++ req->cq_id = cpu_to_le16(cq->id);
++
++ AMAP_SET_BITS(struct amap_mcc_context_lancer, ring_size, ctxt,
++ be_encoded_q_len(mccq->len));
++ AMAP_SET_BITS(struct amap_mcc_context_lancer, valid, ctxt, 1);
++ AMAP_SET_BITS(struct amap_mcc_context_lancer, async_cq_id,
++ ctxt, cq->id);
++ AMAP_SET_BITS(struct amap_mcc_context_lancer, async_cq_valid,
++ ctxt, 1);
++
++ } else {
++ AMAP_SET_BITS(struct amap_mcc_context_be, valid, ctxt, 1);
++ AMAP_SET_BITS(struct amap_mcc_context_be, ring_size, ctxt,
++ be_encoded_q_len(mccq->len));
++ AMAP_SET_BITS(struct amap_mcc_context_be, cq_id, ctxt, cq->id);
++ }
++
++ /* Subscribe to Link State and Group 5 Events(bits 1 and 5 set) */
++ req->async_event_bitmap[0] |= cpu_to_le32(0x00000022);
++
++ be_dws_cpu_to_le(ctxt, sizeof(req->context));
++
++ be_cmd_page_addrs_prepare(req->pages, ARRAY_SIZE(req->pages), q_mem);
++
++ status = be_mbox_notify_wait(adapter);
++ if (!status) {
++ struct be_cmd_resp_mcc_create *resp = embedded_payload(wrb);
++ mccq->id = le16_to_cpu(resp->id);
++ mccq->created = true;
++ }
++
++ mutex_unlock(&adapter->mbox_lock);
++ return status;
++}
++
++int be_cmd_mccq_org_create(struct be_adapter *adapter,
+ struct be_queue_info *mccq,
+ struct be_queue_info *cq)
+ {
+@@ -563,24 +890,25 @@ int be_cmd_mccq_create(struct be_adapter *adapter,
+ void *ctxt;
+ int status;
+
+- spin_lock(&adapter->mbox_lock);
++ if (mutex_lock_interruptible(&adapter->mbox_lock))
++ return -1;
+
+ wrb = wrb_from_mbox(adapter);
+ req = embedded_payload(wrb);
+ ctxt = &req->context;
+
+- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
++ OPCODE_COMMON_MCC_CREATE);
+
+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
+ OPCODE_COMMON_MCC_CREATE, sizeof(*req));
+
+- req->num_pages = PAGES_4K_SPANNED(q_mem->va, q_mem->size);
++ req->num_pages = cpu_to_le16(PAGES_4K_SPANNED(q_mem->va, q_mem->size));
+
+- AMAP_SET_BITS(struct amap_mcc_context, fid, ctxt, be_pci_func(adapter));
+- AMAP_SET_BITS(struct amap_mcc_context, valid, ctxt, 1);
+- AMAP_SET_BITS(struct amap_mcc_context, ring_size, ctxt,
+- be_encoded_q_len(mccq->len));
+- AMAP_SET_BITS(struct amap_mcc_context, cq_id, ctxt, cq->id);
++ AMAP_SET_BITS(struct amap_mcc_context_be, valid, ctxt, 1);
++ AMAP_SET_BITS(struct amap_mcc_context_be, ring_size, ctxt,
++ be_encoded_q_len(mccq->len));
++ AMAP_SET_BITS(struct amap_mcc_context_be, cq_id, ctxt, cq->id);
+
+ be_dws_cpu_to_le(ctxt, sizeof(req->context));
+
+@@ -592,75 +920,93 @@ int be_cmd_mccq_create(struct be_adapter *adapter,
+ mccq->id = le16_to_cpu(resp->id);
+ mccq->created = true;
+ }
+- spin_unlock(&adapter->mbox_lock);
+
++ mutex_unlock(&adapter->mbox_lock);
+ return status;
+ }
+
+-int be_cmd_txq_create(struct be_adapter *adapter,
+- struct be_queue_info *txq,
++int be_cmd_mccq_create(struct be_adapter *adapter,
++ struct be_queue_info *mccq,
+ struct be_queue_info *cq)
+ {
++ int status;
++
++ status = be_cmd_mccq_ext_create(adapter, mccq, cq);
++ if (status && !lancer_chip(adapter)) {
++ dev_warn(&adapter->pdev->dev, "Upgrade to F/W ver 2.102.235.0 "
++ "or newer to avoid conflicting priorities between NIC "
++ "and FCoE traffic");
++ status = be_cmd_mccq_org_create(adapter, mccq, cq);
++ }
++ return status;
++}
++
++int be_cmd_txq_create(struct be_adapter *adapter, struct be_queue_info *txq,
++ struct be_queue_info *cq, u8 *tc_id)
++{
+ struct be_mcc_wrb *wrb;
+ struct be_cmd_req_eth_tx_create *req;
+ struct be_dma_mem *q_mem = &txq->dma_mem;
+- void *ctxt;
+ int status;
+
+- spin_lock(&adapter->mbox_lock);
++ if (mutex_lock_interruptible(&adapter->mbox_lock))
++ return -1;
+
+ wrb = wrb_from_mbox(adapter);
+ req = embedded_payload(wrb);
+- ctxt = &req->context;
+-
+- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
+
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0, OPCODE_ETH_TX_CREATE);
+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_ETH, OPCODE_ETH_TX_CREATE,
+ sizeof(*req));
+
+- req->num_pages = PAGES_4K_SPANNED(q_mem->va, q_mem->size);
++ if (adapter->flags & BE_FLAGS_DCBX || lancer_chip(adapter)) {
++ req->hdr.version = 1;
++ req->if_id = cpu_to_le16(adapter->if_handle);
++ }
++ if (adapter->flags & BE_FLAGS_DCBX)
++ req->type = cpu_to_le16(ETX_QUEUE_TYPE_PRIORITY);
++ else
++ req->type = cpu_to_le16(ETX_QUEUE_TYPE_STANDARD);
+ req->ulp_num = BE_ULP1_NUM;
+- req->type = BE_ETH_TX_RING_TYPE_STANDARD;
+-
+- AMAP_SET_BITS(struct amap_tx_context, tx_ring_size, ctxt,
+- be_encoded_q_len(txq->len));
+- AMAP_SET_BITS(struct amap_tx_context, pci_func_id, ctxt,
+- be_pci_func(adapter));
+- AMAP_SET_BITS(struct amap_tx_context, ctx_valid, ctxt, 1);
+- AMAP_SET_BITS(struct amap_tx_context, cq_id_send, ctxt, cq->id);
+-
+- be_dws_cpu_to_le(ctxt, sizeof(req->context));
+-
++ req->cq_id = cpu_to_le16(cq->id);
++ req->queue_size = be_encoded_q_len(txq->len);
++ req->num_pages = PAGES_4K_SPANNED(q_mem->va, q_mem->size);
+ be_cmd_page_addrs_prepare(req->pages, ARRAY_SIZE(req->pages), q_mem);
+
+ status = be_mbox_notify_wait(adapter);
+ if (!status) {
+ struct be_cmd_resp_eth_tx_create *resp = embedded_payload(wrb);
+ txq->id = le16_to_cpu(resp->cid);
++ if (adapter->flags & BE_FLAGS_DCBX)
++ *tc_id = resp->tc_id;
+ txq->created = true;
+ }
+
+- spin_unlock(&adapter->mbox_lock);
+-
++ mutex_unlock(&adapter->mbox_lock);
+ return status;
+ }
+
+-/* Uses mbox */
++/* Uses MCC */
+ int be_cmd_rxq_create(struct be_adapter *adapter,
+ struct be_queue_info *rxq, u16 cq_id, u16 frag_size,
+- u16 max_frame_size, u32 if_id, u32 rss)
++ u16 max_frame_size, u32 if_id, u32 rss, u8 *rss_id)
+ {
+ struct be_mcc_wrb *wrb;
+ struct be_cmd_req_eth_rx_create *req;
+ struct be_dma_mem *q_mem = &rxq->dma_mem;
+ int status;
+
+- spin_lock(&adapter->mbox_lock);
++ spin_lock_bh(&adapter->mcc_lock);
+
+- wrb = wrb_from_mbox(adapter);
++ wrb = wrb_from_mccq(adapter);
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
+ req = embedded_payload(wrb);
+
+- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
++ OPCODE_ETH_RX_CREATE);
+
+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_ETH, OPCODE_ETH_RX_CREATE,
+ sizeof(*req));
+@@ -673,15 +1019,16 @@ int be_cmd_rxq_create(struct be_adapter *adapter,
+ req->max_frame_size = cpu_to_le16(max_frame_size);
+ req->rss_queue = cpu_to_le32(rss);
+
+- status = be_mbox_notify_wait(adapter);
++ status = be_mcc_notify_wait(adapter);
+ if (!status) {
+ struct be_cmd_resp_eth_rx_create *resp = embedded_payload(wrb);
+ rxq->id = le16_to_cpu(resp->id);
+ rxq->created = true;
++ *rss_id = resp->rss_id;
+ }
+
+- spin_unlock(&adapter->mbox_lock);
+-
++err:
++ spin_unlock_bh(&adapter->mcc_lock);
+ return status;
+ }
+
+@@ -696,13 +1043,12 @@ int be_cmd_q_destroy(struct be_adapter *adapter, struct be_queue_info *q,
+ u8 subsys = 0, opcode = 0;
+ int status;
+
+- spin_lock(&adapter->mbox_lock);
++ if (mutex_lock_interruptible(&adapter->mbox_lock))
++ return -1;
+
+ wrb = wrb_from_mbox(adapter);
+ req = embedded_payload(wrb);
+
+- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
+-
+ switch (queue_type) {
+ case QTYPE_EQ:
+ subsys = CMD_SUBSYSTEM_COMMON;
+@@ -727,13 +1073,47 @@ int be_cmd_q_destroy(struct be_adapter *adapter, struct be_queue_info *q,
+ default:
+ BUG();
+ }
++
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0, opcode);
++
+ be_cmd_hdr_prepare(&req->hdr, subsys, opcode, sizeof(*req));
+ req->id = cpu_to_le16(q->id);
+
+ status = be_mbox_notify_wait(adapter);
++ if (!status)
++ q->created = false;
+
+- spin_unlock(&adapter->mbox_lock);
++ mutex_unlock(&adapter->mbox_lock);
++ return status;
++}
+
++/* Uses MCC */
++int be_cmd_rxq_destroy(struct be_adapter *adapter, struct be_queue_info *q)
++{
++ struct be_mcc_wrb *wrb;
++ struct be_cmd_req_q_destroy *req;
++ int status;
++
++ spin_lock_bh(&adapter->mcc_lock);
++
++ wrb = wrb_from_mccq(adapter);
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
++ req = embedded_payload(wrb);
++
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0, OPCODE_ETH_RX_DESTROY);
++ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_ETH, OPCODE_ETH_RX_DESTROY,
++ sizeof(*req));
++ req->id = cpu_to_le16(q->id);
++
++ status = be_mcc_notify_wait(adapter);
++ if (!status)
++ q->created = false;
++
++err:
++ spin_unlock_bh(&adapter->mcc_lock);
+ return status;
+ }
+
+@@ -741,22 +1121,26 @@ int be_cmd_q_destroy(struct be_adapter *adapter, struct be_queue_info *q,
+ * Uses mbox
+ */
+ int be_cmd_if_create(struct be_adapter *adapter, u32 cap_flags, u32 en_flags,
+- u8 *mac, bool pmac_invalid, u32 *if_handle, u32 *pmac_id)
++ u8 *mac, bool pmac_invalid, u32 *if_handle, u32 *pmac_id,
++ u32 domain)
+ {
+ struct be_mcc_wrb *wrb;
+ struct be_cmd_req_if_create *req;
+ int status;
+
+- spin_lock(&adapter->mbox_lock);
++ if (mutex_lock_interruptible(&adapter->mbox_lock))
++ return -1;
+
+ wrb = wrb_from_mbox(adapter);
+ req = embedded_payload(wrb);
+
+- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
++ OPCODE_COMMON_NTWK_INTERFACE_CREATE);
+
+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
+ OPCODE_COMMON_NTWK_INTERFACE_CREATE, sizeof(*req));
+
++ req->hdr.domain = domain;
+ req->capability_flags = cpu_to_le32(cap_flags);
+ req->enable_flags = cpu_to_le32(en_flags);
+ req->pmac_invalid = pmac_invalid;
+@@ -771,33 +1155,35 @@ int be_cmd_if_create(struct be_adapter *adapter, u32 cap_flags, u32 en_flags,
+ *pmac_id = le32_to_cpu(resp->pmac_id);
+ }
+
+- spin_unlock(&adapter->mbox_lock);
++ mutex_unlock(&adapter->mbox_lock);
+ return status;
+ }
+
+ /* Uses mbox */
+-int be_cmd_if_destroy(struct be_adapter *adapter, u32 interface_id)
++int be_cmd_if_destroy(struct be_adapter *adapter, u32 interface_id, u32 domain)
+ {
+ struct be_mcc_wrb *wrb;
+ struct be_cmd_req_if_destroy *req;
+ int status;
+
+- spin_lock(&adapter->mbox_lock);
++ if (mutex_lock_interruptible(&adapter->mbox_lock))
++ return -1;
+
+ wrb = wrb_from_mbox(adapter);
+ req = embedded_payload(wrb);
+
+- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
++ OPCODE_COMMON_NTWK_INTERFACE_DESTROY);
+
+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
+ OPCODE_COMMON_NTWK_INTERFACE_DESTROY, sizeof(*req));
+
++ req->hdr.domain = domain;
+ req->interface_id = cpu_to_le32(interface_id);
+
+ status = be_mbox_notify_wait(adapter);
+
+- spin_unlock(&adapter->mbox_lock);
+-
++ mutex_unlock(&adapter->mbox_lock);
+ return status;
+ }
+
+@@ -808,33 +1194,48 @@ int be_cmd_if_destroy(struct be_adapter *adapter, u32 interface_id)
+ int be_cmd_get_stats(struct be_adapter *adapter, struct be_dma_mem *nonemb_cmd)
+ {
+ struct be_mcc_wrb *wrb;
+- struct be_cmd_req_get_stats *req;
++ struct be_cmd_req_hdr *hdr;
+ struct be_sge *sge;
++ int status = 0;
++
++ if (MODULO(adapter->work_counter, be_get_temp_freq) == 0)
++ be_cmd_get_die_temperature(adapter);
+
+ spin_lock_bh(&adapter->mcc_lock);
+
+ wrb = wrb_from_mccq(adapter);
+- req = nonemb_cmd->va;
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
++ hdr = nonemb_cmd->va;
+ sge = nonembedded_sgl(wrb);
+
+- be_wrb_hdr_prepare(wrb, sizeof(*req), false, 1);
+- wrb->tag0 = OPCODE_ETH_GET_STATISTICS;
++ be_wrb_hdr_prepare(wrb, nonemb_cmd->size, false, 1,
++ OPCODE_ETH_GET_STATISTICS);
+
+- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_ETH,
+- OPCODE_ETH_GET_STATISTICS, sizeof(*req));
++ be_cmd_hdr_prepare(hdr, CMD_SUBSYSTEM_ETH,
++ OPCODE_ETH_GET_STATISTICS, nonemb_cmd->size);
++
++ if (adapter->generation == BE_GEN3)
++ hdr->version = 1;
++
++ wrb->tag1 = CMD_SUBSYSTEM_ETH;
+ sge->pa_hi = cpu_to_le32(upper_32_bits(nonemb_cmd->dma));
+ sge->pa_lo = cpu_to_le32(nonemb_cmd->dma & 0xFFFFFFFF);
+ sge->len = cpu_to_le32(nonemb_cmd->size);
+
+ be_mcc_notify(adapter);
++ adapter->stats_cmd_sent = true;
+
++err:
+ spin_unlock_bh(&adapter->mcc_lock);
+- return 0;
++ return status;
+ }
+
+ /* Uses synchronous mcc */
+ int be_cmd_link_status_query(struct be_adapter *adapter,
+- bool *link_up)
++ int *link_status, u8 *mac_speed, u16 *link_speed, u32 dom)
+ {
+ struct be_mcc_wrb *wrb;
+ struct be_cmd_req_link_status *req;
+@@ -843,50 +1244,216 @@ int be_cmd_link_status_query(struct be_adapter *adapter,
+ spin_lock_bh(&adapter->mcc_lock);
+
+ wrb = wrb_from_mccq(adapter);
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
+ req = embedded_payload(wrb);
+
+- *link_up = false;
++ *link_status = LINK_DOWN;
+
+- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
++ OPCODE_COMMON_NTWK_LINK_STATUS_QUERY);
+
+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
+ OPCODE_COMMON_NTWK_LINK_STATUS_QUERY, sizeof(*req));
+
++ req->hdr.domain = dom;
++
+ status = be_mcc_notify_wait(adapter);
+ if (!status) {
+ struct be_cmd_resp_link_status *resp = embedded_payload(wrb);
+- if (resp->mac_speed != PHY_LINK_SPEED_ZERO)
+- *link_up = true;
++ if (resp->mac_speed != PHY_LINK_SPEED_ZERO) {
++ *link_status = LINK_UP;
++ *link_speed = le16_to_cpu(resp->link_speed);
++ *mac_speed = resp->mac_speed;
++ }
+ }
+
++err:
+ spin_unlock_bh(&adapter->mcc_lock);
+ return status;
+ }
+
+-/* Uses Mbox */
+-int be_cmd_get_fw_ver(struct be_adapter *adapter, char *fw_ver)
++/* Uses synchronous mcc */
++int be_cmd_get_die_temperature(struct be_adapter *adapter)
++{
++ struct be_mcc_wrb *wrb;
++ struct be_cmd_req_get_cntl_addnl_attribs *req;
++ u16 mccq_index;
++ int status;
++
++ spin_lock_bh(&adapter->mcc_lock);
++
++ mccq_index = adapter->mcc_obj.q.head;
++
++ wrb = wrb_from_mccq(adapter);
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
++ req = embedded_payload(wrb);
++
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
++ OPCODE_COMMON_GET_CNTL_ADDITIONAL_ATTRIBUTES);
++
++ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
++ OPCODE_COMMON_GET_CNTL_ADDITIONAL_ATTRIBUTES, sizeof(*req));
++
++ wrb->tag1 = mccq_index;
++
++ be_mcc_notify(adapter);
++
++err:
++ spin_unlock_bh(&adapter->mcc_lock);
++ return status;
++}
++
++
++/* Uses synchronous mcc */
++int be_cmd_get_reg_len(struct be_adapter *adapter, u32 *log_size)
++{
++ struct be_mcc_wrb *wrb;
++ struct be_cmd_req_get_fat *req;
++ int status;
++
++ spin_lock_bh(&adapter->mcc_lock);
++
++ wrb = wrb_from_mccq(adapter);
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
++ req = embedded_payload(wrb);
++
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
++ OPCODE_COMMON_MANAGE_FAT);
++
++ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
++ OPCODE_COMMON_MANAGE_FAT, sizeof(*req));
++ req->fat_operation = cpu_to_le32(QUERY_FAT);
++ status = be_mcc_notify_wait(adapter);
++ if (!status) {
++ struct be_cmd_resp_get_fat *resp = embedded_payload(wrb);
++ if (log_size && resp->log_size)
++ *log_size = le32_to_cpu(resp->log_size) -
++ sizeof(u32);
++ }
++err:
++ spin_unlock_bh(&adapter->mcc_lock);
++ return status;
++}
++
++void be_cmd_get_regs(struct be_adapter *adapter, u32 buf_len, void *buf)
++{
++ struct be_dma_mem get_fat_cmd;
++ struct be_mcc_wrb *wrb;
++ struct be_cmd_req_get_fat *req;
++ struct be_sge *sge;
++ u32 offset = 0, total_size, buf_size,
++ log_offset = sizeof(u32), payload_len;
++ int status;
++
++ if (buf_len == 0)
++ return;
++
++ total_size = buf_len;
++
++ get_fat_cmd.size = sizeof(struct be_cmd_req_get_fat) + 60*1024;
++ get_fat_cmd.va = pci_alloc_consistent(adapter->pdev,
++ get_fat_cmd.size,
++ &get_fat_cmd.dma);
++ if (!get_fat_cmd.va) {
++ status = -ENOMEM;
++ dev_err(&adapter->pdev->dev,
++ "Memory allocation failure while retrieving FAT data\n");
++ return;
++ }
++
++ spin_lock_bh(&adapter->mcc_lock);
++
++ while (total_size) {
++ buf_size = min(total_size, (u32)60*1024);
++ total_size -= buf_size;
++
++ wrb = wrb_from_mccq(adapter);
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
++ req = get_fat_cmd.va;
++ sge = nonembedded_sgl(wrb);
++
++ payload_len = sizeof(struct be_cmd_req_get_fat) + buf_size;
++ be_wrb_hdr_prepare(wrb, payload_len, false, 1,
++ OPCODE_COMMON_MANAGE_FAT);
++
++ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
++ OPCODE_COMMON_MANAGE_FAT, payload_len);
++
++ sge->pa_hi = cpu_to_le32(upper_32_bits(get_fat_cmd.dma));
++ sge->pa_lo = cpu_to_le32(get_fat_cmd.dma & 0xFFFFFFFF);
++ sge->len = cpu_to_le32(get_fat_cmd.size);
++
++ req->fat_operation = cpu_to_le32(RETRIEVE_FAT);
++ req->read_log_offset = cpu_to_le32(log_offset);
++ req->read_log_length = cpu_to_le32(buf_size);
++ req->data_buffer_size = cpu_to_le32(buf_size);
++
++ status = be_mcc_notify_wait(adapter);
++ if (!status) {
++ struct be_cmd_resp_get_fat *resp = get_fat_cmd.va;
++ memcpy(buf + offset,
++ resp->data_buffer,
++ le32_to_cpu(resp->read_log_length));
++ } else {
++ dev_err(&adapter->pdev->dev, "FAT Table Retrieve error\n");
++ goto err;
++ }
++ offset += buf_size;
++ log_offset += buf_size;
++ }
++err:
++ pci_free_consistent(adapter->pdev, get_fat_cmd.size,
++ get_fat_cmd.va,
++ get_fat_cmd.dma);
++ spin_unlock_bh(&adapter->mcc_lock);
++}
++
++/* Uses synchronous mcc */
++int be_cmd_get_fw_ver(struct be_adapter *adapter, char *fw_ver,
++ char *fw_on_flash)
+ {
+ struct be_mcc_wrb *wrb;
+ struct be_cmd_req_get_fw_version *req;
+ int status;
+
+- spin_lock(&adapter->mbox_lock);
++ spin_lock_bh(&adapter->mcc_lock);
++
++ wrb = wrb_from_mccq(adapter);
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
+
+- wrb = wrb_from_mbox(adapter);
+ req = embedded_payload(wrb);
+
+- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
++ OPCODE_COMMON_GET_FW_VERSION);
+
+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
+ OPCODE_COMMON_GET_FW_VERSION, sizeof(*req));
+
+- status = be_mbox_notify_wait(adapter);
++ status = be_mcc_notify_wait(adapter);
+ if (!status) {
+ struct be_cmd_resp_get_fw_version *resp = embedded_payload(wrb);
+- strncpy(fw_ver, resp->firmware_version_string, FW_VER_LEN);
++ strncpy(fw_ver, resp->firmware_version_string, FW_VER_LEN-1);
++ if (fw_on_flash)
++ strncpy(fw_on_flash, resp->fw_on_flash_version_string,
++ FW_VER_LEN-1);
+ }
+-
+- spin_unlock(&adapter->mbox_lock);
++err:
++ spin_unlock_bh(&adapter->mcc_lock);
+ return status;
+ }
+
+@@ -897,13 +1464,19 @@ int be_cmd_modify_eqd(struct be_adapter *adapter, u32 eq_id, u32 eqd)
+ {
+ struct be_mcc_wrb *wrb;
+ struct be_cmd_req_modify_eq_delay *req;
++ int status = 0;
+
+ spin_lock_bh(&adapter->mcc_lock);
+
+ wrb = wrb_from_mccq(adapter);
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
+ req = embedded_payload(wrb);
+
+- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
++ OPCODE_COMMON_MODIFY_EQ_DELAY);
+
+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
+ OPCODE_COMMON_MODIFY_EQ_DELAY, sizeof(*req));
+@@ -915,8 +1488,9 @@ int be_cmd_modify_eqd(struct be_adapter *adapter, u32 eq_id, u32 eqd)
+
+ be_mcc_notify(adapter);
+
++err:
+ spin_unlock_bh(&adapter->mcc_lock);
+- return 0;
++ return status;
+ }
+
+ /* Uses sycnhronous mcc */
+@@ -930,9 +1504,14 @@ int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array,
+ spin_lock_bh(&adapter->mcc_lock);
+
+ wrb = wrb_from_mccq(adapter);
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
+ req = embedded_payload(wrb);
+
+- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
++ OPCODE_COMMON_NTWK_VLAN_CONFIG);
+
+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
+ OPCODE_COMMON_NTWK_VLAN_CONFIG, sizeof(*req));
+@@ -948,79 +1527,63 @@ int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array,
+
+ status = be_mcc_notify_wait(adapter);
+
++err:
+ spin_unlock_bh(&adapter->mcc_lock);
+ return status;
+ }
+
+-/* Uses MCC for this command as it may be called in BH context
+- * Uses synchronous mcc
+- */
+-int be_cmd_promiscuous_config(struct be_adapter *adapter, u8 port_num, bool en)
++int be_cmd_rx_filter(struct be_adapter *adapter, u32 flags, u32 value)
+ {
+ struct be_mcc_wrb *wrb;
+- struct be_cmd_req_promiscuous_config *req;
++ struct be_dma_mem *mem = &adapter->rx_filter;
++ struct be_cmd_req_rx_filter *req = mem->va;
++ struct be_sge *sge;
+ int status;
+
+ spin_lock_bh(&adapter->mcc_lock);
+
+ wrb = wrb_from_mccq(adapter);
+- req = embedded_payload(wrb);
+-
+- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
+-
+- be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_ETH,
+- OPCODE_ETH_PROMISCUOUS, sizeof(*req));
+-
+- if (port_num)
+- req->port1_promiscuous = en;
+- else
+- req->port0_promiscuous = en;
+-
+- status = be_mcc_notify_wait(adapter);
+-
+- spin_unlock_bh(&adapter->mcc_lock);
+- return status;
+-}
+-
+-/*
+- * Uses MCC for this command as it may be called in BH context
+- * (mc == NULL) => multicast promiscous
+- */
+-int be_cmd_multicast_set(struct be_adapter *adapter, u32 if_id,
+- struct dev_mc_list *mc_list, u32 mc_count)
+-{
+-#define BE_MAX_MC 32 /* set mcast promisc if > 32 */
+- struct be_mcc_wrb *wrb;
+- struct be_cmd_req_mcast_mac_config *req;
+-
+- spin_lock_bh(&adapter->mcc_lock);
+-
+- wrb = wrb_from_mccq(adapter);
+- req = embedded_payload(wrb);
+-
+- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
+-
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
++ sge = nonembedded_sgl(wrb);
++ sge->pa_hi = cpu_to_le32(upper_32_bits(mem->dma));
++ sge->pa_lo = cpu_to_le32(mem->dma & 0xFFFFFFFF);
++ sge->len = cpu_to_le32(mem->size);
++ be_wrb_hdr_prepare(wrb, sizeof(*req), false, 1,
++ OPCODE_COMMON_NTWK_RX_FILTER);
++
++ memset(req, 0, sizeof(*req));
+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
+- OPCODE_COMMON_NTWK_MULTICAST_SET, sizeof(*req));
++ OPCODE_COMMON_NTWK_RX_FILTER, sizeof(*req));
+
+- req->interface_id = if_id;
+- if (mc_list && mc_count <= BE_MAX_MC) {
+- int i;
+- struct dev_mc_list *mc;
+-
+- req->num_mac = cpu_to_le16(mc_count);
+-
+- for (mc = mc_list, i = 0; mc; mc = mc->next, i++)
+- memcpy(req->mac[i].byte, mc->dmi_addr, ETH_ALEN);
++ req->if_id = cpu_to_le32(adapter->if_handle);
++ if (flags & IFF_PROMISC) {
++ req->if_flags_mask = cpu_to_le32(BE_IF_FLAGS_PROMISCUOUS |
++ BE_IF_FLAGS_VLAN_PROMISCUOUS);
++ if (value == ON)
++ req->if_flags = cpu_to_le32(BE_IF_FLAGS_PROMISCUOUS |
++ BE_IF_FLAGS_VLAN_PROMISCUOUS);
++ } else if (flags & IFF_ALLMULTI) {
++ req->if_flags_mask = req->if_flags =
++ cpu_to_le32(BE_IF_FLAGS_MCAST_PROMISCUOUS);
+ } else {
+- req->promiscuous = 1;
+- }
++ struct netdev_hw_addr *ha;
++ int i = 0;
+
+- be_mcc_notify_wait(adapter);
++ req->if_flags_mask = req->if_flags =
++ cpu_to_le32(BE_IF_FLAGS_MULTICAST);
++ req->mcast_num = cpu_to_le16(netdev_mc_count(adapter->netdev));
++ netdev_for_each_mc_addr(ha, adapter->netdev)
++ memcpy(req->mcast_mac[i++].byte, ha->DMI_ADDR,
++ ETH_ALEN);
++ }
++ status = be_mcc_notify_wait(adapter);
+
++err:
+ spin_unlock_bh(&adapter->mcc_lock);
+-
+- return 0;
++ return status;
+ }
+
+ /* Uses synchrounous mcc */
+@@ -1033,9 +1596,14 @@ int be_cmd_set_flow_control(struct be_adapter *adapter, u32 tx_fc, u32 rx_fc)
+ spin_lock_bh(&adapter->mcc_lock);
+
+ wrb = wrb_from_mccq(adapter);
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
+ req = embedded_payload(wrb);
+
+- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
++ OPCODE_COMMON_SET_FLOW_CONTROL);
+
+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
+ OPCODE_COMMON_SET_FLOW_CONTROL, sizeof(*req));
+@@ -1045,6 +1613,7 @@ int be_cmd_set_flow_control(struct be_adapter *adapter, u32 tx_fc, u32 rx_fc)
+
+ status = be_mcc_notify_wait(adapter);
+
++err:
+ spin_unlock_bh(&adapter->mcc_lock);
+ return status;
+ }
+@@ -1059,9 +1628,14 @@ int be_cmd_get_flow_control(struct be_adapter *adapter, u32 *tx_fc, u32 *rx_fc)
+ spin_lock_bh(&adapter->mcc_lock);
+
+ wrb = wrb_from_mccq(adapter);
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
+ req = embedded_payload(wrb);
+
+- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
++ OPCODE_COMMON_GET_FLOW_CONTROL);
+
+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
+ OPCODE_COMMON_GET_FLOW_CONTROL, sizeof(*req));
+@@ -1074,23 +1648,27 @@ int be_cmd_get_flow_control(struct be_adapter *adapter, u32 *tx_fc, u32 *rx_fc)
+ *rx_fc = le16_to_cpu(resp->rx_flow_control);
+ }
+
++err:
+ spin_unlock_bh(&adapter->mcc_lock);
+ return status;
+ }
+
+ /* Uses mbox */
+-int be_cmd_query_fw_cfg(struct be_adapter *adapter, u32 *port_num, u32 *cap)
++int be_cmd_query_fw_cfg(struct be_adapter *adapter, u32 *port_num,
++ u32 *mode, u32 *function_caps)
+ {
+ struct be_mcc_wrb *wrb;
+ struct be_cmd_req_query_fw_cfg *req;
+ int status;
+
+- spin_lock(&adapter->mbox_lock);
++ if (mutex_lock_interruptible(&adapter->mbox_lock))
++ return -1;
+
+ wrb = wrb_from_mbox(adapter);
+ req = embedded_payload(wrb);
+
+- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
++ OPCODE_COMMON_QUERY_FIRMWARE_CONFIG);
+
+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
+ OPCODE_COMMON_QUERY_FIRMWARE_CONFIG, sizeof(*req));
+@@ -1099,10 +1677,11 @@ int be_cmd_query_fw_cfg(struct be_adapter *adapter, u32 *port_num, u32 *cap)
+ if (!status) {
+ struct be_cmd_resp_query_fw_cfg *resp = embedded_payload(wrb);
+ *port_num = le32_to_cpu(resp->phys_port);
+- *cap = le32_to_cpu(resp->function_cap);
++ *mode = le32_to_cpu(resp->function_mode);
++ *function_caps = le32_to_cpu(resp->function_caps);
+ }
+
+- spin_unlock(&adapter->mbox_lock);
++ mutex_unlock(&adapter->mbox_lock);
+ return status;
+ }
+
+@@ -1113,19 +1692,161 @@ int be_cmd_reset_function(struct be_adapter *adapter)
+ struct be_cmd_req_hdr *req;
+ int status;
+
+- spin_lock(&adapter->mbox_lock);
++ if (mutex_lock_interruptible(&adapter->mbox_lock))
++ return -1;
+
+ wrb = wrb_from_mbox(adapter);
+ req = embedded_payload(wrb);
+
+- be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
++ OPCODE_COMMON_FUNCTION_RESET);
+
+ be_cmd_hdr_prepare(req, CMD_SUBSYSTEM_COMMON,
+ OPCODE_COMMON_FUNCTION_RESET, sizeof(*req));
+
+ status = be_mbox_notify_wait(adapter);
+
+- spin_unlock(&adapter->mbox_lock);
++ mutex_unlock(&adapter->mbox_lock);
++ return status;
++}
++
++int be_cmd_rss_config(struct be_adapter *adapter, u8 *rsstable, u16 table_size)
++{
++ struct be_mcc_wrb *wrb;
++ struct be_cmd_req_rss_config *req;
++ u32 myhash[10] = {0x0123, 0x4567, 0x89AB, 0xCDEF, 0x01EF,
++ 0x0123, 0x4567, 0x89AB, 0xCDEF, 0x01EF};
++ int status;
++
++ if (mutex_lock_interruptible(&adapter->mbox_lock))
++ return -1;
++
++ wrb = wrb_from_mbox(adapter);
++ req = embedded_payload(wrb);
++
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
++ OPCODE_ETH_RSS_CONFIG);
++
++ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_ETH,
++ OPCODE_ETH_RSS_CONFIG, sizeof(*req));
++
++ req->if_id = cpu_to_le32(adapter->if_handle);
++ req->enable_rss = cpu_to_le16(RSS_ENABLE_TCP_IPV4 | RSS_ENABLE_IPV4);
++ req->cpu_table_size_log2 = cpu_to_le16(fls(table_size) - 1);
++ memcpy(req->cpu_table, rsstable, table_size);
++ memcpy(req->hash, myhash, sizeof(myhash));
++ be_dws_cpu_to_le(req->hash, sizeof(req->hash));
++
++ status = be_mbox_notify_wait(adapter);
++
++ mutex_unlock(&adapter->mbox_lock);
++ return status;
++}
++
++/* Uses sync mcc */
++int be_cmd_set_beacon_state(struct be_adapter *adapter, u8 port_num,
++ u8 bcn, u8 sts, u8 state)
++{
++ struct be_mcc_wrb *wrb;
++ struct be_cmd_req_enable_disable_beacon *req;
++ int status;
++
++ spin_lock_bh(&adapter->mcc_lock);
++
++ wrb = wrb_from_mccq(adapter);
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
++ req = embedded_payload(wrb);
++
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
++ OPCODE_COMMON_ENABLE_DISABLE_BEACON);
++
++ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
++ OPCODE_COMMON_ENABLE_DISABLE_BEACON, sizeof(*req));
++
++ req->port_num = port_num;
++ req->beacon_state = state;
++ req->beacon_duration = bcn;
++ req->status_duration = sts;
++
++ status = be_mcc_notify_wait(adapter);
++
++err:
++ spin_unlock_bh(&adapter->mcc_lock);
++ return status;
++}
++
++/* Uses sync mcc */
++int be_cmd_get_beacon_state(struct be_adapter *adapter, u8 port_num, u32 *state)
++{
++ struct be_mcc_wrb *wrb;
++ struct be_cmd_req_get_beacon_state *req;
++ int status;
++
++ spin_lock_bh(&adapter->mcc_lock);
++
++ wrb = wrb_from_mccq(adapter);
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
++ req = embedded_payload(wrb);
++
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
++ OPCODE_COMMON_GET_BEACON_STATE);
++
++ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
++ OPCODE_COMMON_GET_BEACON_STATE, sizeof(*req));
++
++ req->port_num = port_num;
++
++ status = be_mcc_notify_wait(adapter);
++ if (!status) {
++ struct be_cmd_resp_get_beacon_state *resp =
++ embedded_payload(wrb);
++ *state = resp->beacon_state;
++ }
++
++err:
++ spin_unlock_bh(&adapter->mcc_lock);
++ return status;
++}
++
++/* Uses sync mcc */
++int be_cmd_read_port_type(struct be_adapter *adapter, u32 port,
++ u8 *connector)
++{
++ struct be_mcc_wrb *wrb;
++ struct be_cmd_req_port_type *req;
++ int status;
++
++ spin_lock_bh(&adapter->mcc_lock);
++
++ wrb = wrb_from_mccq(adapter);
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
++ req = embedded_payload(wrb);
++
++ be_wrb_hdr_prepare(wrb, sizeof(struct be_cmd_resp_port_type), true, 0,
++ OPCODE_COMMON_READ_TRANSRECV_DATA);
++
++ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
++ OPCODE_COMMON_READ_TRANSRECV_DATA, sizeof(*req));
++
++ req->port = cpu_to_le32(port);
++ req->page_num = cpu_to_le32(TR_PAGE_A0);
++ status = be_mcc_notify_wait(adapter);
++ if (!status) {
++ struct be_cmd_resp_port_type *resp = embedded_payload(wrb);
++ *connector = resp->data.connector;
++ }
++
++err:
++ spin_unlock_bh(&adapter->mcc_lock);
+ return status;
+ }
+
+@@ -1133,16 +1854,24 @@ int be_cmd_write_flashrom(struct be_adapter *adapter, struct be_dma_mem *cmd,
+ u32 flash_type, u32 flash_opcode, u32 buf_size)
+ {
+ struct be_mcc_wrb *wrb;
+- struct be_cmd_write_flashrom *req = cmd->va;
++ struct be_cmd_write_flashrom *req;
+ struct be_sge *sge;
+ int status;
+
+ spin_lock_bh(&adapter->mcc_lock);
++ adapter->flash_status = 0;
+
+ wrb = wrb_from_mccq(adapter);
++ if (!wrb) {
++ status = -EBUSY;
++ goto err_unlock;
++ }
++ req = cmd->va;
+ sge = nonembedded_sgl(wrb);
+
+- be_wrb_hdr_prepare(wrb, cmd->size, false, 1);
++ be_wrb_hdr_prepare(wrb, cmd->size, false, 1,
++ OPCODE_COMMON_WRITE_FLASHROM);
++ wrb->tag1 = CMD_SUBSYSTEM_COMMON;
+
+ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
+ OPCODE_COMMON_WRITE_FLASHROM, cmd->size);
+@@ -1154,8 +1883,852 @@ int be_cmd_write_flashrom(struct be_adapter *adapter, struct be_dma_mem *cmd,
+ req->params.op_code = cpu_to_le32(flash_opcode);
+ req->params.data_buf_size = cpu_to_le32(buf_size);
+
++ be_mcc_notify(adapter);
++ spin_unlock_bh(&adapter->mcc_lock);
++
++ if (!wait_for_completion_timeout(&adapter->flash_compl,
++ msecs_to_jiffies(40000)))
++ status = -1;
++ else
++ status = adapter->flash_status;
++
++ return status;
++
++err_unlock:
++ spin_unlock_bh(&adapter->mcc_lock);
++ return status;
++}
++
++int be_cmd_get_flash_crc(struct be_adapter *adapter, u8 *flashed_crc,
++ int offset)
++{
++ struct be_mcc_wrb *wrb;
++ struct be_cmd_write_flashrom *req;
++ int status;
++
++ spin_lock_bh(&adapter->mcc_lock);
++
++ wrb = wrb_from_mccq(adapter);
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
++ req = embedded_payload(wrb);
++
++ be_wrb_hdr_prepare(wrb, sizeof(*req)+4, true, 0,
++ OPCODE_COMMON_READ_FLASHROM);
++
++ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
++ OPCODE_COMMON_READ_FLASHROM, sizeof(*req)+4);
++
++ req->params.op_type = cpu_to_le32(IMG_TYPE_REDBOOT);
++ req->params.op_code = cpu_to_le32(FLASHROM_OPER_REPORT);
++ req->params.offset = cpu_to_le32(offset);
++ req->params.data_buf_size = cpu_to_le32(0x4);
++
++ status = be_mcc_notify_wait(adapter);
++ if (!status)
++ memcpy(flashed_crc, req->params.data_buf, 4);
++
++err:
++ spin_unlock_bh(&adapter->mcc_lock);
++ return status;
++}
++
++int be_cmd_enable_magic_wol(struct be_adapter *adapter, u8 *mac,
++ struct be_dma_mem *nonemb_cmd)
++{
++ struct be_mcc_wrb *wrb;
++ struct be_cmd_req_acpi_wol_magic_config *req;
++ struct be_sge *sge;
++ int status;
++
++ spin_lock_bh(&adapter->mcc_lock);
++
++ wrb = wrb_from_mccq(adapter);
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
++ req = nonemb_cmd->va;
++ sge = nonembedded_sgl(wrb);
++
++ be_wrb_hdr_prepare(wrb, sizeof(*req), false, 1,
++ OPCODE_ETH_ACPI_WOL_MAGIC_CONFIG);
++
++ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_ETH,
++ OPCODE_ETH_ACPI_WOL_MAGIC_CONFIG, sizeof(*req));
++ memcpy(req->magic_mac, mac, ETH_ALEN);
++
++ sge->pa_hi = cpu_to_le32(upper_32_bits(nonemb_cmd->dma));
++ sge->pa_lo = cpu_to_le32(nonemb_cmd->dma & 0xFFFFFFFF);
++ sge->len = cpu_to_le32(nonemb_cmd->size);
++
++ status = be_mcc_notify_wait(adapter);
++
++err:
++ spin_unlock_bh(&adapter->mcc_lock);
++ return status;
++}
++
++int be_cmd_set_loopback(struct be_adapter *adapter, u8 port_num,
++ u8 loopback_type, u8 enable)
++{
++ struct be_mcc_wrb *wrb;
++ struct be_cmd_req_set_lmode *req;
++ int status;
++
++ spin_lock_bh(&adapter->mcc_lock);
++
++ wrb = wrb_from_mccq(adapter);
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
++
++ req = embedded_payload(wrb);
++
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
++ OPCODE_LOWLEVEL_SET_LOOPBACK_MODE);
++
++ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_LOWLEVEL,
++ OPCODE_LOWLEVEL_SET_LOOPBACK_MODE,
++ sizeof(*req));
++
++ req->src_port = port_num;
++ req->dest_port = port_num;
++ req->loopback_type = loopback_type;
++ req->loopback_state = enable;
++
++ status = be_mcc_notify_wait(adapter);
++err:
++ spin_unlock_bh(&adapter->mcc_lock);
++ return status;
++}
++
++int be_cmd_loopback_test(struct be_adapter *adapter, u32 port_num,
++ u32 loopback_type, u32 pkt_size, u32 num_pkts, u64 pattern)
++{
++ struct be_mcc_wrb *wrb;
++ struct be_cmd_req_loopback_test *req;
++ int status;
++
++ spin_lock_bh(&adapter->mcc_lock);
++
++ wrb = wrb_from_mccq(adapter);
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
++
++ req = embedded_payload(wrb);
++
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
++ OPCODE_LOWLEVEL_LOOPBACK_TEST);
++
++ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_LOWLEVEL,
++ OPCODE_LOWLEVEL_LOOPBACK_TEST, sizeof(*req));
++ req->hdr.timeout = cpu_to_le32(4);
++
++ req->pattern = cpu_to_le64(pattern);
++ req->src_port = cpu_to_le32(port_num);
++ req->dest_port = cpu_to_le32(port_num);
++ req->pkt_size = cpu_to_le32(pkt_size);
++ req->num_pkts = cpu_to_le32(num_pkts);
++ req->loopback_type = cpu_to_le32(loopback_type);
++
++ status = be_mcc_notify_wait(adapter);
++ if (!status) {
++ struct be_cmd_resp_loopback_test *resp = embedded_payload(wrb);
++ status = le32_to_cpu(resp->status);
++ }
++
++err:
++ spin_unlock_bh(&adapter->mcc_lock);
++ return status;
++}
++
++int be_cmd_ddr_dma_test(struct be_adapter *adapter, u64 pattern,
++ u32 byte_cnt, struct be_dma_mem *cmd)
++{
++ struct be_mcc_wrb *wrb;
++ struct be_cmd_req_ddrdma_test *req;
++ struct be_sge *sge;
++ int status;
++ int i, j = 0;
++
++ spin_lock_bh(&adapter->mcc_lock);
++
++ wrb = wrb_from_mccq(adapter);
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
++ req = cmd->va;
++ sge = nonembedded_sgl(wrb);
++ be_wrb_hdr_prepare(wrb, cmd->size, false, 1,
++ OPCODE_LOWLEVEL_HOST_DDR_DMA);
++ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_LOWLEVEL,
++ OPCODE_LOWLEVEL_HOST_DDR_DMA, cmd->size);
++
++ sge->pa_hi = cpu_to_le32(upper_32_bits(cmd->dma));
++ sge->pa_lo = cpu_to_le32(cmd->dma & 0xFFFFFFFF);
++ sge->len = cpu_to_le32(cmd->size);
++
++ req->pattern = cpu_to_le64(pattern);
++ req->byte_count = cpu_to_le32(byte_cnt);
++ for (i = 0; i < byte_cnt; i++) {
++ req->snd_buff[i] = (u8)(pattern >> (j*8));
++ j++;
++ if (j > 7)
++ j = 0;
++ }
++
++ status = be_mcc_notify_wait(adapter);
++
++ if (!status) {
++ struct be_cmd_resp_ddrdma_test *resp;
++ resp = cmd->va;
++ if ((memcmp(resp->rcv_buff, req->snd_buff, byte_cnt) != 0) ||
++ resp->snd_err) {
++ status = -1;
++ }
++ }
++
++err:
++ spin_unlock_bh(&adapter->mcc_lock);
++ return status;
++}
++
++int be_cmd_get_seeprom_data(struct be_adapter *adapter,
++ struct be_dma_mem *nonemb_cmd)
++{
++ struct be_mcc_wrb *wrb;
++ struct be_cmd_req_seeprom_read *req;
++ struct be_sge *sge;
++ int status;
++
++ spin_lock_bh(&adapter->mcc_lock);
++
++ wrb = wrb_from_mccq(adapter);
++ req = nonemb_cmd->va;
++ sge = nonembedded_sgl(wrb);
++
++ be_wrb_hdr_prepare(wrb, sizeof(*req), false, 1,
++ OPCODE_COMMON_SEEPROM_READ);
++
++ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
++ OPCODE_COMMON_SEEPROM_READ, sizeof(*req));
++
++ sge->pa_hi = cpu_to_le32(upper_32_bits(nonemb_cmd->dma));
++ sge->pa_lo = cpu_to_le32(nonemb_cmd->dma & 0xFFFFFFFF);
++ sge->len = cpu_to_le32(nonemb_cmd->size);
++
++ status = be_mcc_notify_wait(adapter);
++
++ spin_unlock_bh(&adapter->mcc_lock);
++ return status;
++}
++
++int be_cmd_get_phy_info(struct be_adapter *adapter,
++ struct be_phy_info *phy_info)
++{
++ struct be_mcc_wrb *wrb;
++ struct be_cmd_req_get_phy_info *req;
++ struct be_sge *sge;
++ struct be_dma_mem cmd;
++ struct be_phy_info *resp_phy_info;
++ int status;
++
++ spin_lock_bh(&adapter->mcc_lock);
++ wrb = wrb_from_mccq(adapter);
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
++ cmd.size = sizeof(struct be_cmd_req_get_phy_info);
++ cmd.va = pci_alloc_consistent(adapter->pdev, cmd.size,
++ &cmd.dma);
++ if (!cmd.va) {
++ dev_err(&adapter->pdev->dev, "Memory alloc failure\n");
++ status = -ENOMEM;
++ goto err;
++ }
++
++ req = cmd.va;
++ sge = nonembedded_sgl(wrb);
++
++ be_wrb_hdr_prepare(wrb, sizeof(*req), false, 1,
++ OPCODE_COMMON_GET_PHY_DETAILS);
++
++ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
++ OPCODE_COMMON_GET_PHY_DETAILS,
++ sizeof(*req));
++
++ sge->pa_hi = cpu_to_le32(upper_32_bits(cmd.dma));
++ sge->pa_lo = cpu_to_le32(cmd.dma & 0xFFFFFFFF);
++ sge->len = cpu_to_le32(cmd.size);
++
++ status = be_mcc_notify_wait(adapter);
++ if (!status) {
++ resp_phy_info = cmd.va + sizeof(struct be_cmd_req_hdr);
++ phy_info->phy_type = le16_to_cpu(resp_phy_info->phy_type);
++ phy_info->interface_type =
++ le16_to_cpu(resp_phy_info->interface_type);
++ phy_info->auto_speeds_supported =
++ le16_to_cpu(resp_phy_info->auto_speeds_supported);
++ phy_info->fixed_speeds_supported =
++ le16_to_cpu(resp_phy_info->fixed_speeds_supported);
++ phy_info->misc_params =
++ le32_to_cpu(resp_phy_info->misc_params);
++ }
++ pci_free_consistent(adapter->pdev, cmd.size,
++ cmd.va, cmd.dma);
++err:
++ spin_unlock_bh(&adapter->mcc_lock);
++ return status;
++}
++
++int be_cmd_set_qos(struct be_adapter *adapter, u32 bps, u32 domain)
++{
++ struct be_mcc_wrb *wrb;
++ struct be_cmd_req_set_qos *req;
++ int status;
++
++ spin_lock_bh(&adapter->mcc_lock);
++
++ wrb = wrb_from_mccq(adapter);
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
++
++ req = embedded_payload(wrb);
++
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
++ OPCODE_COMMON_SET_QOS);
++
++ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
++ OPCODE_COMMON_SET_QOS, sizeof(*req));
++
++ req->hdr.domain = domain;
++ req->valid_bits = cpu_to_le32(BE_QOS_BITS_NIC);
++ req->max_bps_nic = cpu_to_le32(bps);
++
++ status = be_mcc_notify_wait(adapter);
++err:
++ spin_unlock_bh(&adapter->mcc_lock);
++ return status;
++}
++
++int be_cmd_get_cntl_attributes(struct be_adapter *adapter)
++{
++ struct be_mcc_wrb *wrb;
++ struct be_cmd_req_cntl_attribs *req;
++ struct be_cmd_resp_cntl_attribs *resp;
++ struct be_sge *sge;
++ int status;
++ int payload_len = max(sizeof(*req), sizeof(*resp));
++ struct mgmt_controller_attrib *attribs;
++ struct be_dma_mem attribs_cmd;
++
++ memset(&attribs_cmd, 0, sizeof(struct be_dma_mem));
++ attribs_cmd.size = sizeof(struct be_cmd_resp_cntl_attribs);
++ attribs_cmd.va = pci_alloc_consistent(adapter->pdev, attribs_cmd.size,
++ &attribs_cmd.dma);
++ if (!attribs_cmd.va) {
++ dev_err(&adapter->pdev->dev,
++ "Memory allocation failure\n");
++ return -ENOMEM;
++ }
++
++ if (mutex_lock_interruptible(&adapter->mbox_lock))
++ return -1;
++
++ wrb = wrb_from_mbox(adapter);
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
++ req = attribs_cmd.va;
++ sge = nonembedded_sgl(wrb);
++
++ be_wrb_hdr_prepare(wrb, payload_len, false, 1,
++ OPCODE_COMMON_GET_CNTL_ATTRIBUTES);
++ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
++ OPCODE_COMMON_GET_CNTL_ATTRIBUTES, payload_len);
++ sge->pa_hi = cpu_to_le32(upper_32_bits(attribs_cmd.dma));
++ sge->pa_lo = cpu_to_le32(attribs_cmd.dma & 0xFFFFFFFF);
++ sge->len = cpu_to_le32(attribs_cmd.size);
++
++ status = be_mbox_notify_wait(adapter);
++ if (!status) {
++ attribs = (struct mgmt_controller_attrib *)(attribs_cmd.va +
++ sizeof(struct be_cmd_resp_hdr));
++ adapter->hba_port_num = attribs->hba_attribs.phy_port;
++ strncpy(adapter->model_number,
++ attribs->hba_attribs.controller_model_number, 31);
++ }
++
++err:
++ mutex_unlock(&adapter->mbox_lock);
++ pci_free_consistent(adapter->pdev, attribs_cmd.size, attribs_cmd.va,
++ attribs_cmd.dma);
++ return status;
++}
++
++/* Uses mbox */
++int be_cmd_req_native_mode(struct be_adapter *adapter)
++{
++ struct be_mcc_wrb *wrb;
++ struct be_cmd_req_set_func_cap *req;
++ int status;
++
++ if (mutex_lock_interruptible(&adapter->mbox_lock))
++ return -1;
++
++ wrb = wrb_from_mbox(adapter);
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
++
++ req = embedded_payload(wrb);
++
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
++ OPCODE_COMMON_SET_DRIVER_FUNCTION_CAP);
++
++ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
++ OPCODE_COMMON_SET_DRIVER_FUNCTION_CAP, sizeof(*req));
++
++ req->valid_cap_flags = cpu_to_le32(CAPABILITY_SW_TIMESTAMPS |
++ CAPABILITY_BE3_NATIVE_ERX_API);
++ req->cap_flags = cpu_to_le32(CAPABILITY_BE3_NATIVE_ERX_API);
++
++ status = be_mbox_notify_wait(adapter);
++ if (!status) {
++ struct be_cmd_resp_set_func_cap *resp = embedded_payload(wrb);
++ adapter->be3_native = le32_to_cpu(resp->cap_flags) &
++ CAPABILITY_BE3_NATIVE_ERX_API;
++ }
++err:
++ mutex_unlock(&adapter->mbox_lock);
++ return status;
++}
++
++static void encode_port_names(struct be_adapter *adapter)
++{
++ switch (adapter->port_name[adapter->hba_port_num]) {
++ case '0':
++ adapter->port_name[adapter->hba_port_num] = 0;
++ break;
++ case '1':
++ adapter->port_name[adapter->hba_port_num] = 1;
++ break;
++ case '2':
++ adapter->port_name[adapter->hba_port_num] = 2;
++ break;
++ case '3':
++ adapter->port_name[adapter->hba_port_num] = 3;
++ break;
++ case '4':
++ adapter->port_name[adapter->hba_port_num] = 4;
++ break;
++ case 'A':
++ adapter->port_name[adapter->hba_port_num] = 5;
++ break;
++ case 'B':
++ adapter->port_name[adapter->hba_port_num] = 6;
++ break;
++ case 'C':
++ adapter->port_name[adapter->hba_port_num] = 7;
++ break;
++ case 'D':
++ adapter->port_name[adapter->hba_port_num] = 8;
++ break;
++ }
++}
++
++int be_cmd_query_port_names_v0(struct be_adapter *adapter, u8 *port_name)
++{
++ struct be_mcc_wrb *wrb;
++ struct be_cmd_req_get_port_name *req;
++ int status;
++
++ spin_lock_bh(&adapter->mcc_lock);
++
++ wrb = wrb_from_mccq(adapter);
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
++
++ req = embedded_payload(wrb);
++
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
++ OPCODE_COMMON_GET_PORT_NAME);
++ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
++ OPCODE_COMMON_GET_PORT_NAME, sizeof(*req));
++
++ status = be_mcc_notify_wait(adapter);
++ if (!status) {
++ struct be_cmd_resp_get_port_name *resp = embedded_payload(wrb);
++ port_name[0] = resp->port0_name;
++ port_name[1] = resp->port1_name;
++ }
++
++err:
++ spin_unlock_bh(&adapter->mcc_lock);
++
++ if(!status)
++ encode_port_names(adapter);
++ return status;
++}
++
++int be_cmd_query_port_names_v1(struct be_adapter *adapter, u8 *port_name)
++{
++ struct be_mcc_wrb *wrb;
++ struct be_cmd_req_get_port_name *req;
++ int status;
++
++ spin_lock_bh(&adapter->mcc_lock);
++
++ wrb = wrb_from_mccq(adapter);
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
++ req = embedded_payload(wrb);
++
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
++ OPCODE_COMMON_GET_PORT_NAME);
++ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
++ OPCODE_COMMON_GET_PORT_NAME, sizeof(*req));
++ req->hdr.version = 1;
++
+ status = be_mcc_notify_wait(adapter);
++ if (!status) {
++ struct be_cmd_resp_get_port_name_v1 *resp = embedded_payload(wrb);
++ port_name[0] = resp->port0_name;
++ port_name[1] = resp->port1_name;
++ port_name[2] = resp->port2_name;
++ port_name[3] = resp->port3_name;
++ }
++
++err:
++ spin_unlock_bh(&adapter->mcc_lock);
++
++ if (!status)
++ encode_port_names(adapter);
++ return status;
++}
++
++int be_cmd_req_pg_pfc(struct be_adapter *adapter, int *fw_num_txqs)
++{
++ struct be_mcc_wrb *wrb;
++ struct be_cmd_req_pg *req;
++ int status, num = 0;
++ bool query = true;
++
++ *fw_num_txqs = MAX_TX_QS;
++
++ if (mutex_lock_interruptible(&adapter->mbox_lock))
++ return -1;
++
++enable_pfc:
++ wrb = wrb_from_mbox(adapter);
++ req = embedded_payload(wrb);
++
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
++ OPCODE_ETH_PG_FEATURE_QUERY_REQUEST);
++
++ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_ETH,
++ OPCODE_ETH_PG_FEATURE_QUERY_REQUEST, sizeof(*req));
++
++ if (query)
++ req->query |= cpu_to_le32(REQ_PG_QUERY);
++ req->pfc_pg |= cpu_to_le32(REQ_PG_FEAT);
++
++ status = be_mbox_notify_wait(adapter);
++ if (!status) {
++ struct be_cmd_resp_pg *resp = embedded_payload(wrb);
++ if (query) {
++ if (le32_to_cpu(resp->pfc_pg) & REQ_PG_FEAT) {
++ num = le32_to_cpu(resp->num_tx_rings);
++ query = false;
++ goto enable_pfc;
++ }
++ } else {
++ adapter->flags |= BE_FLAGS_DCBX;
++ *fw_num_txqs = num;
++ }
++ }
++
++ mutex_unlock(&adapter->mbox_lock);
++ return status;
++}
++
++/* Set privilege(s) for a function */
++int be_cmd_set_fn_privileges(struct be_adapter *adapter, u32 mask, u32 *prev,
++ u32 domain)
++{
++ struct be_mcc_wrb *wrb;
++ struct be_cmd_req_set_fn_privileges *req;
++ int status;
++
++ spin_lock_bh(&adapter->mcc_lock);
++
++ wrb = wrb_from_mccq(adapter);
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
++
++ req = embedded_payload(wrb);
++
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
++ OPCODE_COMMON_SET_FN_PRIVILEGES);
++
++ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
++ OPCODE_COMMON_SET_FN_PRIVILEGES, sizeof(*req));
++
++ req->hdr.domain = domain;
++ req->privilege_mask = cpu_to_le32(mask);
++
++ status = be_mcc_notify_wait(adapter);
++
++err:
++ spin_unlock_bh(&adapter->mcc_lock);
++ return status;
++}
++
++/* Get privilege(s) for a function */
++int be_cmd_get_fn_privileges(struct be_adapter *adapter, u32 *privilege,
++ u32 domain)
++{
++ struct be_mcc_wrb *wrb;
++ struct be_cmd_req_get_fn_privileges *req;
++ int status;
++
++ spin_lock_bh(&adapter->mcc_lock);
++
++ wrb = wrb_from_mccq(adapter);
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
++
++ req = embedded_payload(wrb);
++
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
++ OPCODE_COMMON_GET_FN_PRIVILEGES);
+
++ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
++ OPCODE_COMMON_GET_FN_PRIVILEGES, sizeof(*req));
++
++ req->hdr.domain = domain;
++
++ status = be_mcc_notify_wait(adapter);
++ if (!status) {
++ struct be_cmd_resp_get_fn_privileges *resp =
++ embedded_payload(wrb);
++ *privilege = le32_to_cpu(resp->privilege_mask);
++ } else
++ *privilege = 0;
++
++err:
++ spin_unlock_bh(&adapter->mcc_lock);
++ return status;
++}
++
++/* Set Hyper switch config */
++int be_cmd_set_hsw_config(struct be_adapter *adapter, u16 pvid,
++ u32 domain, u16 intf_id)
++{
++ struct be_mcc_wrb *wrb;
++ struct be_cmd_req_set_hsw_config *req;
++ void *ctxt;
++ int status;
++
++ spin_lock_bh(&adapter->mcc_lock);
++
++ wrb = wrb_from_mccq(adapter);
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
++
++ req = embedded_payload(wrb);
++ ctxt = &req->context;
++
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
++ OPCODE_COMMON_SET_HSW_CONFIG);
++
++ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
++ OPCODE_COMMON_SET_HSW_CONFIG, sizeof(*req));
++
++ req->hdr.domain = domain;
++ AMAP_SET_BITS(struct amap_set_hsw_context, interface_id, ctxt, intf_id);
++ if (pvid) {
++ AMAP_SET_BITS(struct amap_set_hsw_context, pvid_valid, ctxt, 1);
++ AMAP_SET_BITS(struct amap_set_hsw_context, pvid, ctxt, pvid);
++ }
++
++ be_dws_cpu_to_le(req->context, sizeof(req->context));
++ status = be_mcc_notify_wait(adapter);
++
++err:
++ spin_unlock_bh(&adapter->mcc_lock);
++ return status;
++}
++
++/* Get Hyper switch config */
++int be_cmd_get_hsw_config(struct be_adapter *adapter, u16 *pvid,
++ u32 domain, u16 intf_id)
++{
++ struct be_mcc_wrb *wrb;
++ struct be_cmd_req_get_hsw_config *req;
++ void *ctxt;
++ int status;
++ u16 vid;
++
++ spin_lock_bh(&adapter->mcc_lock);
++
++ wrb = wrb_from_mccq(adapter);
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
++
++ req = embedded_payload(wrb);
++ ctxt = &req->context;
++
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
++ OPCODE_COMMON_GET_HSW_CONFIG);
++
++ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
++ OPCODE_COMMON_GET_HSW_CONFIG, sizeof(*req));
++
++ req->hdr.domain = domain;
++ AMAP_SET_BITS(struct amap_get_hsw_req_context, interface_id, ctxt,
++ intf_id);
++ AMAP_SET_BITS(struct amap_get_hsw_req_context, pvid_valid, ctxt, 1);
++ be_dws_cpu_to_le(req->context, sizeof(req->context));
++
++ status = be_mcc_notify_wait(adapter);
++ if (!status) {
++ struct be_cmd_resp_get_hsw_config *resp =
++ embedded_payload(wrb);
++ be_dws_le_to_cpu(&resp->context,
++ sizeof(resp->context));
++ vid = AMAP_GET_BITS(struct amap_get_hsw_resp_context,
++ pvid, &resp->context);
++ *pvid = le16_to_cpu(vid);
++ }
++
++err:
++ spin_unlock_bh(&adapter->mcc_lock);
++ return status;
++}
++
++int be_cmd_get_port_speed(struct be_adapter *adapter,
++ u8 port_num, u16 *dac_cable_len, u16 *port_speed)
++{
++ struct be_mcc_wrb *wrb;
++ struct be_cmd_req_get_port_speed *req;
++ int status = 0;
++
++ spin_lock_bh(&adapter->mcc_lock);
++
++ wrb = wrb_from_mccq(adapter);
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
++
++ req = embedded_payload(wrb);
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
++ OPCODE_COMMON_NTWK_GET_LINK_SPEED);
++ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
++ OPCODE_COMMON_NTWK_GET_LINK_SPEED,
++ sizeof(*req));
++ req->port_num = port_num;
++ status = be_mcc_notify_wait(adapter);
++ if (!status) {
++ struct be_cmd_resp_get_port_speed *resp =
++ embedded_payload(wrb);
++ *dac_cable_len = resp->dac_cable_length;
++ *port_speed = resp->mac_speed;
++ }
++
++err:
++ spin_unlock_bh(&adapter->mcc_lock);
++ return status;
++}
++
++int be_cmd_set_port_speed_v1(struct be_adapter *adapter,
++ u8 port_num, u16 mac_speed,
++ u16 dac_cable_len)
++{
++ struct be_mcc_wrb *wrb;
++ struct be_cmd_req_set_port_speed_v1 *req;
++ int status = 0;
++
++ spin_lock_bh(&adapter->mcc_lock);
++
++ wrb = wrb_from_mccq(adapter);
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
++ req = embedded_payload(wrb);
++ be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
++ OPCODE_COMMON_NTWK_SET_LINK_SPEED);
++
++ be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
++ OPCODE_COMMON_NTWK_SET_LINK_SPEED,
++ sizeof(*req));
++ req->hdr.version=1;
++
++ req->port_num = port_num;
++ req->virt_port = port_num;
++ req->mac_speed = mac_speed;
++ req->dac_cable_length = dac_cable_len;
++ status = be_mcc_notify_wait(adapter);
++err:
++ spin_unlock_bh(&adapter->mcc_lock);
++ return status;
++}
++
++
++/* Uses sync mcc */
++#ifdef CONFIG_PALAU
++int be_cmd_pass_ext_ioctl(struct be_adapter *adapter, dma_addr_t dma,
++ int req_size, void *va)
++{
++ struct be_mcc_wrb *wrb;
++ struct be_sge *sge;
++ int status;
++ struct be_cmd_req_hdr *hdr = (struct be_cmd_req_hdr *) va;
++
++ spin_lock_bh(&adapter->mcc_lock);
++
++ wrb = wrb_from_mccq(adapter);
++ if (!wrb) {
++ status = -EBUSY;
++ goto err;
++ }
++ sge = nonembedded_sgl(wrb);
++
++ be_wrb_hdr_prepare(wrb, req_size, false, 1, hdr->opcode);
++ wrb->tag1 = MCC_WRB_PASS_THRU;
++ sge->pa_hi = cpu_to_le32(upper_32_bits(dma));
++ sge->pa_lo = cpu_to_le32(dma & 0xFFFFFFFF);
++ sge->len = cpu_to_le32(req_size);
++
++ status = be_mcc_notify_wait(adapter);
++err:
+ spin_unlock_bh(&adapter->mcc_lock);
+ return status;
+ }
++#endif
+diff --git a/drivers/net/benet/be_cmds.h b/drivers/net/benet/be_cmds.h
+index ad33d55..35aa5c7 100644
+--- a/drivers/net/benet/be_cmds.h
++++ b/drivers/net/benet/be_cmds.h
+@@ -1,20 +1,23 @@
+ /*
+- * Copyright (C) 2005 - 2009 ServerEngines
++ * Copyright (C) 2005 - 2011 Emulex
+ * All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License version 2
+- * as published by the Free Software Foundation. The full GNU General
++ * as published by the Free Software Foundation. The full GNU General
+ * Public License is included in this distribution in the file called COPYING.
+ *
+ * Contact Information:
+- * linux-drivers@serverengines.com
++ * linux-drivers@emulex.com
+ *
+- * ServerEngines
+- * 209 N. Fair Oaks Ave
+- * Sunnyvale, CA 94085
++ * Emulex
++ * 3333 Susan Street
++ * Costa Mesa, CA 92626
+ */
+
++#ifndef BE_CMDS_H
++#define BE_CMDS_H
++
+ /*
+ * The driver sends configuration and managements command requests to the
+ * firmware in the BE. These requests are communicated to the processor
+@@ -29,9 +32,10 @@ struct be_sge {
+ u32 len;
+ };
+
+-#define MCC_WRB_EMBEDDED_MASK 1 /* bit 0 of dword 0*/
++#define MCC_WRB_EMBEDDED_MASK 1 /* bit 0 of dword 0*/
+ #define MCC_WRB_SGE_CNT_SHIFT 3 /* bits 3 - 7 of dword 0 */
+ #define MCC_WRB_SGE_CNT_MASK 0x1F /* bits 3 - 7 of dword 0 */
++#define MCC_WRB_PASS_THRU 0xFF /* this wrb is used for pass thru cmd */
+ struct be_mcc_wrb {
+ u32 embedded; /* dword 0 */
+ u32 payload_length; /* dword 1 */
+@@ -44,24 +48,19 @@ struct be_mcc_wrb {
+ } payload;
+ };
+
+-#define CQE_FLAGS_VALID_MASK (1 << 31)
+-#define CQE_FLAGS_ASYNC_MASK (1 << 30)
+-#define CQE_FLAGS_COMPLETED_MASK (1 << 28)
+-#define CQE_FLAGS_CONSUMED_MASK (1 << 27)
++#define CQE_FLAGS_VALID_MASK (1 << 31)
++#define CQE_FLAGS_ASYNC_MASK (1 << 30)
++#define CQE_FLAGS_COMPLETED_MASK (1 << 28)
++#define CQE_FLAGS_CONSUMED_MASK (1 << 27)
+
+ /* Completion Status */
+ enum {
+- MCC_STATUS_SUCCESS = 0x0,
+-/* The client does not have sufficient privileges to execute the command */
+- MCC_STATUS_INSUFFICIENT_PRIVILEGES = 0x1,
+-/* A parameter in the command was invalid. */
+- MCC_STATUS_INVALID_PARAMETER = 0x2,
+-/* There are insufficient chip resources to execute the command */
+- MCC_STATUS_INSUFFICIENT_RESOURCES = 0x3,
+-/* The command is completing because the queue was getting flushed */
+- MCC_STATUS_QUEUE_FLUSHING = 0x4,
+-/* The command is completing with a DMA error */
+- MCC_STATUS_DMA_FAILED = 0x5,
++ MCC_STATUS_SUCCESS = 0,
++ MCC_STATUS_FAILED = 1,
++ MCC_STATUS_ILLEGAL_REQUEST = 2,
++ MCC_STATUS_ILLEGAL_FIELD = 3,
++ MCC_STATUS_INSUFFICIENT_BUFFER = 4,
++ MCC_STATUS_UNAUTHORIZED_REQUEST = 5,
+ MCC_STATUS_NOT_SUPPORTED = 66
+ };
+
+@@ -81,15 +80,24 @@ struct be_mcc_compl {
+ * mcc_compl is interpreted as follows:
+ */
+ #define ASYNC_TRAILER_EVENT_CODE_SHIFT 8 /* bits 8 - 15 */
++#define ASYNC_TRAILER_EVENT_TYPE_SHIFT 16 /* bits 16 - 23 */
+ #define ASYNC_TRAILER_EVENT_CODE_MASK 0xFF
++#define ASYNC_TRAILER_EVENT_TYPE_MASK 0xFF
+ #define ASYNC_EVENT_CODE_LINK_STATE 0x1
++#define ASYNC_EVENT_CODE_GRP_5 0x5
++#define ASYNC_EVENT_QOS_SPEED 0x1
++#define ASYNC_EVENT_COS_PRIORITY 0x2
++#define ASYNC_EVENT_PVID_STATE 0x3
++#define GRP5_TYPE_PRIO_TC_MAP 4
++
+ struct be_async_event_trailer {
+ u32 code;
+ };
+
+ enum {
+- ASYNC_EVENT_LINK_DOWN = 0x0,
+- ASYNC_EVENT_LINK_UP = 0x1
++ ASYNC_EVENT_LINK_DOWN = 0x0,
++ ASYNC_EVENT_LINK_UP = 0x1,
++ ASYNC_EVENT_LOGICAL = 0x2
+ };
+
+ /* When the event code of an async trailer is link-state, the mcc_compl
+@@ -101,7 +109,51 @@ struct be_async_event_link_state {
+ u8 port_duplex;
+ u8 port_speed;
+ u8 port_fault;
+- u8 rsvd0[7];
++ u8 rsvd0;
++ u16 qos_link_speed;
++ u32 event_tag;
++ struct be_async_event_trailer trailer;
++} __packed;
++
++/* When the event code of an async trailer is GRP-5 and event_type is QOS_SPEED
++ * the mcc_compl must be interpreted as follows
++ */
++struct be_async_event_grp5_qos_link_speed {
++ u8 physical_port;
++ u8 rsvd[5];
++ u16 qos_link_speed;
++ u32 event_tag;
++ struct be_async_event_trailer trailer;
++} __packed;
++
++/* When the event code of an async trailer is GRP5 and event type is
++ * CoS-Priority, the mcc_compl must be interpreted as follows
++ */
++struct be_async_event_grp5_cos_priority {
++ u8 physical_port;
++ u8 available_priority_bmap;
++ u8 reco_default_priority;
++ u8 valid;
++ u8 rsvd0;
++ u8 event_tag;
++ struct be_async_event_trailer trailer;
++} __packed;
++
++/* When the event code of an async trailer is GRP5 and event type is
++ * PVID state, the mcc_compl must be interpreted as follows
++ */
++struct be_async_event_grp5_pvid_state {
++ u8 enabled;
++ u8 rsvd0;
++ u16 tag;
++ u32 event_tag;
++ u32 rsvd1;
++ struct be_async_event_trailer trailer;
++} __packed;
++
++/* GRP5 prio-tc-map event */
++struct be_async_event_grp5_prio_tc_map {
++ u8 prio_tc_map[8]; /* map[prio] -> tc_id */
+ struct be_async_event_trailer trailer;
+ } __packed;
+
+@@ -111,41 +163,68 @@ struct be_mcc_mailbox {
+ };
+
+ #define CMD_SUBSYSTEM_COMMON 0x1
+-#define CMD_SUBSYSTEM_ETH 0x3
++#define CMD_SUBSYSTEM_ETH 0x3
++#define CMD_SUBSYSTEM_LOWLEVEL 0xb
+
+ #define OPCODE_COMMON_NTWK_MAC_QUERY 1
+ #define OPCODE_COMMON_NTWK_MAC_SET 2
+ #define OPCODE_COMMON_NTWK_MULTICAST_SET 3
+-#define OPCODE_COMMON_NTWK_VLAN_CONFIG 4
++#define OPCODE_COMMON_NTWK_VLAN_CONFIG 4
+ #define OPCODE_COMMON_NTWK_LINK_STATUS_QUERY 5
++#define OPCODE_COMMON_READ_FLASHROM 6
+ #define OPCODE_COMMON_WRITE_FLASHROM 7
+ #define OPCODE_COMMON_CQ_CREATE 12
+ #define OPCODE_COMMON_EQ_CREATE 13
+-#define OPCODE_COMMON_MCC_CREATE 21
+-#define OPCODE_COMMON_NTWK_RX_FILTER 34
++#define OPCODE_COMMON_MCC_CREATE 21
++#define OPCODE_COMMON_SET_QOS 28
++#define OPCODE_COMMON_MCC_CREATE_EXT 90
++#define OPCODE_COMMON_SEEPROM_READ 30
++#define OPCODE_COMMON_GET_CNTL_ATTRIBUTES 32
++#define OPCODE_COMMON_NTWK_RX_FILTER 34
+ #define OPCODE_COMMON_GET_FW_VERSION 35
+ #define OPCODE_COMMON_SET_FLOW_CONTROL 36
+ #define OPCODE_COMMON_GET_FLOW_CONTROL 37
+ #define OPCODE_COMMON_SET_FRAME_SIZE 39
+ #define OPCODE_COMMON_MODIFY_EQ_DELAY 41
+ #define OPCODE_COMMON_FIRMWARE_CONFIG 42
+-#define OPCODE_COMMON_NTWK_INTERFACE_CREATE 50
+-#define OPCODE_COMMON_NTWK_INTERFACE_DESTROY 51
+-#define OPCODE_COMMON_MCC_DESTROY 53
+-#define OPCODE_COMMON_CQ_DESTROY 54
+-#define OPCODE_COMMON_EQ_DESTROY 55
++#define OPCODE_COMMON_NTWK_INTERFACE_CREATE 50
++#define OPCODE_COMMON_NTWK_INTERFACE_DESTROY 51
++#define OPCODE_COMMON_MCC_DESTROY 53
++#define OPCODE_COMMON_CQ_DESTROY 54
++#define OPCODE_COMMON_EQ_DESTROY 55
++#define OPCODE_COMMON_NTWK_SET_LINK_SPEED 57
+ #define OPCODE_COMMON_QUERY_FIRMWARE_CONFIG 58
+ #define OPCODE_COMMON_NTWK_PMAC_ADD 59
+ #define OPCODE_COMMON_NTWK_PMAC_DEL 60
+ #define OPCODE_COMMON_FUNCTION_RESET 61
++#define OPCODE_COMMON_MANAGE_FAT 68
++#define OPCODE_COMMON_ENABLE_DISABLE_BEACON 69
++#define OPCODE_COMMON_GET_BEACON_STATE 70
++#define OPCODE_COMMON_READ_TRANSRECV_DATA 73
++#define OPCODE_COMMON_GET_PORT_NAME 77
++#define OPCODE_COMMON_SET_FN_PRIVILEGES 100
++#define OPCODE_COMMON_GET_PHY_DETAILS 102
++#define OPCODE_COMMON_SET_DRIVER_FUNCTION_CAP 103
++#define OPCODE_COMMON_GET_CNTL_ADDITIONAL_ATTRIBUTES 121
++#define OPCODE_COMMON_NTWK_GET_LINK_SPEED 134
++#define OPCODE_COMMON_GET_HSW_CONFIG 152
++#define OPCODE_COMMON_SET_HSW_CONFIG 153
++#define OPCODE_COMMON_GET_FN_PRIVILEGES 170
+
++#define OPCODE_ETH_RSS_CONFIG 1
+ #define OPCODE_ETH_ACPI_CONFIG 2
+ #define OPCODE_ETH_PROMISCUOUS 3
+ #define OPCODE_ETH_GET_STATISTICS 4
+ #define OPCODE_ETH_TX_CREATE 7
+-#define OPCODE_ETH_RX_CREATE 8
+-#define OPCODE_ETH_TX_DESTROY 9
+-#define OPCODE_ETH_RX_DESTROY 10
++#define OPCODE_ETH_RX_CREATE 8
++#define OPCODE_ETH_TX_DESTROY 9
++#define OPCODE_ETH_RX_DESTROY 10
++#define OPCODE_ETH_ACPI_WOL_MAGIC_CONFIG 12
++#define OPCODE_ETH_PG_FEATURE_QUERY_REQUEST 23
++
++#define OPCODE_LOWLEVEL_HOST_DDR_DMA 17
++#define OPCODE_LOWLEVEL_LOOPBACK_TEST 18
++#define OPCODE_LOWLEVEL_SET_LOOPBACK_MODE 19
+
+ struct be_cmd_req_hdr {
+ u8 opcode; /* dword 0 */
+@@ -159,7 +238,7 @@ struct be_cmd_req_hdr {
+ };
+
+ #define RESP_HDR_INFO_OPCODE_SHIFT 0 /* bits 0 - 7 */
+-#define RESP_HDR_INFO_SUBSYS_SHIFT 8 /* bits 8 - 15 */
++#define RESP_HDR_INFO_SUBSYS_SHIFT 8 /* bits 8 - 15 */
+ struct be_cmd_resp_hdr {
+ u32 info; /* dword 0 */
+ u32 status; /* dword 1 */
+@@ -265,7 +344,7 @@ struct be_cmd_req_pmac_del {
+ /******************** Create CQ ***************************/
+ /* Pseudo amap definition in which each bit of the actual structure is defined
+ * as a byte: used to calculate offset/shift/mask of each field */
+-struct amap_cq_context {
++struct amap_cq_context_be {
+ u8 cidx[11]; /* dword 0*/
+ u8 rsvd0; /* dword 0*/
+ u8 coalescwm[2]; /* dword 0*/
+@@ -288,11 +367,28 @@ struct amap_cq_context {
+ u8 rsvd5[32]; /* dword 3*/
+ } __packed;
+
++struct amap_cq_context_lancer {
++ u8 rsvd0[12]; /* dword 0*/
++ u8 coalescwm[2]; /* dword 0*/
++ u8 nodelay; /* dword 0*/
++ u8 rsvd1[12]; /* dword 0*/
++ u8 count[2]; /* dword 0*/
++ u8 valid; /* dword 0*/
++ u8 rsvd2; /* dword 0*/
++ u8 eventable; /* dword 0*/
++ u8 eqid[16]; /* dword 1*/
++ u8 rsvd3[15]; /* dword 1*/
++ u8 armed; /* dword 1*/
++ u8 rsvd4[32]; /* dword 2*/
++ u8 rsvd5[32]; /* dword 3*/
++} __packed;
++
+ struct be_cmd_req_cq_create {
+ struct be_cmd_req_hdr hdr;
+ u16 num_pages;
+- u16 rsvd0;
+- u8 context[sizeof(struct amap_cq_context) / 8];
++ u8 page_size;
++ u8 rsvd0;
++ u8 context[sizeof(struct amap_cq_context_be) / 8];
+ struct phys_addr pages[8];
+ } __packed;
+
+@@ -302,10 +398,28 @@ struct be_cmd_resp_cq_create {
+ u16 rsvd0;
+ } __packed;
+
++struct be_cmd_req_get_fat {
++ struct be_cmd_req_hdr hdr;
++ u32 fat_operation;
++ u32 read_log_offset;
++ u32 read_log_length;
++ u32 data_buffer_size;
++ u32 data_buffer[1];
++} __packed;
++
++struct be_cmd_resp_get_fat {
++ struct be_cmd_resp_hdr hdr;
++ u32 log_size;
++ u32 read_log_length;
++ u32 rsvd[2];
++ u32 data_buffer[1];
++} __packed;
++
++
+ /******************** Create MCCQ ***************************/
+ /* Pseudo amap definition in which each bit of the actual structure is defined
+ * as a byte: used to calculate offset/shift/mask of each field */
+-struct amap_mcc_context {
++struct amap_mcc_context_be {
+ u8 con_index[14];
+ u8 rsvd0[2];
+ u8 ring_size[4];
+@@ -320,11 +434,31 @@ struct amap_mcc_context {
+ u8 rsvd2[32];
+ } __packed;
+
++struct amap_mcc_context_lancer {
++ u8 async_cq_id[16];
++ u8 ring_size[4];
++ u8 rsvd0[12];
++ u8 rsvd1[31];
++ u8 valid;
++ u8 async_cq_valid[1];
++ u8 rsvd2[31];
++ u8 rsvd3[32];
++} __packed;
++
+ struct be_cmd_req_mcc_create {
+ struct be_cmd_req_hdr hdr;
+ u16 num_pages;
+- u16 rsvd0;
+- u8 context[sizeof(struct amap_mcc_context) / 8];
++ u16 cq_id;
++ u8 context[sizeof(struct amap_mcc_context_be) / 8];
++ struct phys_addr pages[8];
++} __packed;
++
++struct be_cmd_req_mcc_ext_create {
++ struct be_cmd_req_hdr hdr;
++ u16 num_pages;
++ u16 cq_id;
++ u32 async_event_bitmap[1];
++ u8 context[sizeof(struct amap_mcc_context_be) / 8];
+ struct phys_addr pages[8];
+ } __packed;
+
+@@ -335,49 +469,32 @@ struct be_cmd_resp_mcc_create {
+ } __packed;
+
+ /******************** Create TxQ ***************************/
+-#define BE_ETH_TX_RING_TYPE_STANDARD 2
++#define ETX_QUEUE_TYPE_STANDARD 0x2
++#define ETX_QUEUE_TYPE_PRIORITY 0x10
+ #define BE_ULP1_NUM 1
+
+-/* Pseudo amap definition in which each bit of the actual structure is defined
+- * as a byte: used to calculate offset/shift/mask of each field */
+-struct amap_tx_context {
+- u8 rsvd0[16]; /* dword 0 */
+- u8 tx_ring_size[4]; /* dword 0 */
+- u8 rsvd1[26]; /* dword 0 */
+- u8 pci_func_id[8]; /* dword 1 */
+- u8 rsvd2[9]; /* dword 1 */
+- u8 ctx_valid; /* dword 1 */
+- u8 cq_id_send[16]; /* dword 2 */
+- u8 rsvd3[16]; /* dword 2 */
+- u8 rsvd4[32]; /* dword 3 */
+- u8 rsvd5[32]; /* dword 4 */
+- u8 rsvd6[32]; /* dword 5 */
+- u8 rsvd7[32]; /* dword 6 */
+- u8 rsvd8[32]; /* dword 7 */
+- u8 rsvd9[32]; /* dword 8 */
+- u8 rsvd10[32]; /* dword 9 */
+- u8 rsvd11[32]; /* dword 10 */
+- u8 rsvd12[32]; /* dword 11 */
+- u8 rsvd13[32]; /* dword 12 */
+- u8 rsvd14[32]; /* dword 13 */
+- u8 rsvd15[32]; /* dword 14 */
+- u8 rsvd16[32]; /* dword 15 */
+-} __packed;
+-
+ struct be_cmd_req_eth_tx_create {
+ struct be_cmd_req_hdr hdr;
+ u8 num_pages;
+ u8 ulp_num;
+- u8 type;
+- u8 bound_port;
+- u8 context[sizeof(struct amap_tx_context) / 8];
++ u16 type;
++ u16 if_id;
++ u8 queue_size;
++ u8 rsvd1;
++ u32 rsvd2;
++ u16 cq_id;
++ u16 rsvd3;
++ u32 rsvd4[13];
+ struct phys_addr pages[8];
+ } __packed;
+
+ struct be_cmd_resp_eth_tx_create {
+ struct be_cmd_resp_hdr hdr;
+ u16 cid;
+- u16 rsvd0;
++ u16 rid;
++ u32 db_offset;
++ u8 tc_id;
++ u8 rsvd0[3];
+ } __packed;
+
+ /******************** Create RxQ ***************************/
+@@ -396,7 +513,7 @@ struct be_cmd_req_eth_rx_create {
+ struct be_cmd_resp_eth_rx_create {
+ struct be_cmd_resp_hdr hdr;
+ u16 id;
+- u8 cpu_id;
++ u8 rss_id;
+ u8 rsvd0;
+ } __packed;
+
+@@ -429,14 +546,15 @@ enum be_if_flags {
+ BE_IF_FLAGS_VLAN = 0x100,
+ BE_IF_FLAGS_MCAST_PROMISCUOUS = 0x200,
+ BE_IF_FLAGS_PASS_L2_ERRORS = 0x400,
+- BE_IF_FLAGS_PASS_L3L4_ERRORS = 0x800
++ BE_IF_FLAGS_PASS_L3L4_ERRORS = 0x800,
++ BE_IF_FLAGS_MULTICAST = 0x1000
+ };
+
+ /* An RX interface is an object with one or more MAC addresses and
+ * filtering capabilities. */
+ struct be_cmd_req_if_create {
+ struct be_cmd_req_hdr hdr;
+- u32 version; /* ignore currntly */
++ u32 version; /* ignore currently */
+ u32 capability_flags;
+ u32 enable_flags;
+ u8 mac_addr[ETH_ALEN];
+@@ -458,7 +576,7 @@ struct be_cmd_req_if_destroy {
+ };
+
+ /*************** HW Stats Get **********************************/
+-struct be_port_rxf_stats {
++struct be_port_rxf_stats_v0 {
+ u32 rx_bytes_lsd; /* dword 0*/
+ u32 rx_bytes_msd; /* dword 1*/
+ u32 rx_total_frames; /* dword 2*/
+@@ -527,8 +645,8 @@ struct be_port_rxf_stats {
+ u32 rx_input_fifo_overflow; /* dword 65*/
+ };
+
+-struct be_rxf_stats {
+- struct be_port_rxf_stats port[2];
++struct be_rxf_stats_v0 {
++ struct be_port_rxf_stats_v0 port[2];
+ u32 rx_drops_no_pbuf; /* dword 132*/
+ u32 rx_drops_no_txpb; /* dword 133*/
+ u32 rx_drops_no_erx_descr; /* dword 134*/
+@@ -545,31 +663,51 @@ struct be_rxf_stats {
+ u32 rx_drops_invalid_ring; /* dword 145*/
+ u32 forwarded_packets; /* dword 146*/
+ u32 rx_drops_mtu; /* dword 147*/
+- u32 rsvd0[15];
++ u32 rsvd0[7];
++ u32 port0_jabber_events;
++ u32 port1_jabber_events;
++ u32 rsvd1[6];
+ };
+
+-struct be_erx_stats {
++struct be_erx_stats_v0 {
+ u32 rx_drops_no_fragments[44]; /* dwordS 0 to 43*/
+- u32 debug_wdma_sent_hold; /* dword 44*/
+- u32 debug_wdma_pbfree_sent_hold; /* dword 45*/
+- u32 debug_wdma_zerobyte_pbfree_sent_hold; /* dword 46*/
+- u32 debug_pmem_pbuf_dealloc; /* dword 47*/
++ u32 rsvd[4];
+ };
+
+-struct be_hw_stats {
+- struct be_rxf_stats rxf;
++struct be_pmem_stats {
++ u32 eth_red_drops;
++ u32 rsvd[5];
++};
++
++struct be_hw_stats_v0 {
++ struct be_rxf_stats_v0 rxf;
+ u32 rsvd[48];
+- struct be_erx_stats erx;
++ struct be_erx_stats_v0 erx;
++ struct be_pmem_stats pmem;
+ };
+
+-struct be_cmd_req_get_stats {
++struct be_cmd_req_get_stats_v0 {
+ struct be_cmd_req_hdr hdr;
+- u8 rsvd[sizeof(struct be_hw_stats)];
++ u8 rsvd[sizeof(struct be_hw_stats_v0)];
+ };
+
+-struct be_cmd_resp_get_stats {
++struct be_cmd_resp_get_stats_v0 {
+ struct be_cmd_resp_hdr hdr;
+- struct be_hw_stats hw_stats;
++ struct be_hw_stats_v0 hw_stats;
++};
++
++struct be_cmd_req_get_cntl_addnl_attribs {
++ struct be_cmd_req_hdr hdr;
++ u8 rsvd[8];
++};
++
++struct be_cmd_resp_get_cntl_addnl_attribs {
++ struct be_cmd_resp_hdr hdr;
++ u16 ipl_file_number;
++ u8 ipl_file_version;
++ u8 rsvd0;
++ u8 on_die_temperature; /* in degrees centigrade*/
++ u8 rsvd1[3];
+ };
+
+ struct be_cmd_req_vlan_config {
+@@ -581,30 +719,22 @@ struct be_cmd_req_vlan_config {
+ u16 normal_vlan[64];
+ } __packed;
+
+-struct be_cmd_req_promiscuous_config {
+- struct be_cmd_req_hdr hdr;
+- u8 port0_promiscuous;
+- u8 port1_promiscuous;
+- u16 rsvd0;
+-} __packed;
+-
++/******************** RX FILTER ******************************/
++#define BE_MAX_MC 64 /* set mcast promisc if > 64 */
+ struct macaddr {
+ u8 byte[ETH_ALEN];
+ };
+
+-struct be_cmd_req_mcast_mac_config {
++struct be_cmd_req_rx_filter {
+ struct be_cmd_req_hdr hdr;
+- u16 num_mac;
+- u8 promiscuous;
+- u8 interface_id;
+- struct macaddr mac[32];
+-} __packed;
+-
+-static inline struct be_hw_stats *
+-hw_stats_from_cmd(struct be_cmd_resp_get_stats *cmd)
+-{
+- return &cmd->hw_stats;
+-}
++ u32 global_flags_mask;
++ u32 global_flags;
++ u32 if_flags_mask;
++ u32 if_flags;
++ u32 if_id;
++ u32 mcast_num;
++ struct macaddr mcast_mac[BE_MAX_MC];
++};
+
+ /******************** Link Status Query *******************/
+ struct be_cmd_req_link_status {
+@@ -619,13 +749,18 @@ enum {
+ };
+
+ enum {
+- PHY_LINK_SPEED_ZERO = 0x0, /* => No link */
++ PHY_LINK_SPEED_ZERO = 0x0, /* => No link */
+ PHY_LINK_SPEED_10MBPS = 0x1,
+ PHY_LINK_SPEED_100MBPS = 0x2,
+ PHY_LINK_SPEED_1GBPS = 0x3,
+ PHY_LINK_SPEED_10GBPS = 0x4
+ };
+
++enum {
++ LINK_DOWN = 0x0,
++ LINK_UP = 0X1
++};
++
+ struct be_cmd_resp_link_status {
+ struct be_cmd_resp_hdr hdr;
+ u8 physical_port;
+@@ -634,9 +769,47 @@ struct be_cmd_resp_link_status {
+ u8 mac_fault;
+ u8 mgmt_mac_duplex;
+ u8 mgmt_mac_speed;
+- u16 rsvd0;
++ u16 link_speed;
++ u32 logical_link_status;
+ } __packed;
+
++/******************** Port Identification ***************************/
++/* Identifies the type of port attached to NIC */
++struct be_cmd_req_port_type {
++ struct be_cmd_req_hdr hdr;
++ u32 page_num;
++ u32 port;
++};
++
++enum {
++ TR_PAGE_A0 = 0xa0,
++ TR_PAGE_A2 = 0xa2
++};
++
++struct be_cmd_resp_port_type {
++ struct be_cmd_resp_hdr hdr;
++ u32 page_num;
++ u32 port;
++ struct data {
++ u8 identifier;
++ u8 identifier_ext;
++ u8 connector;
++ u8 transceiver[8];
++ u8 rsvd0[3];
++ u8 length_km;
++ u8 length_hm;
++ u8 length_om1;
++ u8 length_om2;
++ u8 length_cu;
++ u8 length_cu_m;
++ u8 vendor_name[16];
++ u8 rsvd;
++ u8 vendor_oui[3];
++ u8 vendor_pn[16];
++ u8 vendor_rev[4];
++ } data;
++};
++
+ /******************** Get FW Version *******************/
+ struct be_cmd_req_get_fw_version {
+ struct be_cmd_req_hdr hdr;
+@@ -686,9 +859,13 @@ struct be_cmd_resp_modify_eq_delay {
+ } __packed;
+
+ /******************** Get FW Config *******************/
++#define FLEX10_MODE 0x400
++#define VNIC_MODE 0x20000
++#define UMC_ENABLED 0x1000000
++
+ struct be_cmd_req_query_fw_cfg {
+ struct be_cmd_req_hdr hdr;
+- u32 rsvd[30];
++ u32 rsvd[31];
+ };
+
+ struct be_cmd_resp_query_fw_cfg {
+@@ -696,10 +873,61 @@ struct be_cmd_resp_query_fw_cfg {
+ u32 be_config_number;
+ u32 asic_revision;
+ u32 phys_port;
+- u32 function_cap;
++ u32 function_mode;
+ u32 rsvd[26];
++ u32 function_caps;
+ };
+
++/******************** RSS Config *******************/
++/* RSS types */
++#define RSS_ENABLE_NONE 0x0
++#define RSS_ENABLE_IPV4 0x1
++#define RSS_ENABLE_TCP_IPV4 0x2
++#define RSS_ENABLE_IPV6 0x4
++#define RSS_ENABLE_TCP_IPV6 0x8
++
++struct be_cmd_req_rss_config {
++ struct be_cmd_req_hdr hdr;
++ u32 if_id;
++ u16 enable_rss;
++ u16 cpu_table_size_log2;
++ u32 hash[10];
++ u8 cpu_table[128];
++ u8 flush;
++ u8 rsvd0[3];
++};
++
++/******************** Port Beacon ***************************/
++
++#define BEACON_STATE_ENABLED 0x1
++#define BEACON_STATE_DISABLED 0x0
++
++struct be_cmd_req_enable_disable_beacon {
++ struct be_cmd_req_hdr hdr;
++ u8 port_num;
++ u8 beacon_state;
++ u8 beacon_duration;
++ u8 status_duration;
++} __packed;
++
++struct be_cmd_resp_enable_disable_beacon {
++ struct be_cmd_resp_hdr resp_hdr;
++ u32 rsvd0;
++} __packed;
++
++struct be_cmd_req_get_beacon_state {
++ struct be_cmd_req_hdr hdr;
++ u8 port_num;
++ u8 rsvd0;
++ u16 rsvd1;
++} __packed;
++
++struct be_cmd_resp_get_beacon_state {
++ struct be_cmd_resp_hdr resp_hdr;
++ u8 beacon_state;
++ u8 rsvd0[3];
++} __packed;
++
+ /****************** Firmware Flash ******************/
+ struct flashrom_params {
+ u32 op_code;
+@@ -714,17 +942,468 @@ struct be_cmd_write_flashrom {
+ struct flashrom_params params;
+ };
+
++/************************ WOL *******************************/
++struct be_cmd_req_acpi_wol_magic_config {
++ struct be_cmd_req_hdr hdr;
++ u32 rsvd0[145];
++ u8 magic_mac[6];
++ u8 rsvd2[2];
++} __packed;
++
++/********************** LoopBack test *********************/
++struct be_cmd_req_loopback_test {
++ struct be_cmd_req_hdr hdr;
++ u32 loopback_type;
++ u32 num_pkts;
++ u64 pattern;
++ u32 src_port;
++ u32 dest_port;
++ u32 pkt_size;
++};
++
++struct be_cmd_resp_loopback_test {
++ struct be_cmd_resp_hdr resp_hdr;
++ u32 status;
++ u32 num_txfer;
++ u32 num_rx;
++ u32 miscomp_off;
++ u32 ticks_compl;
++};
++
++struct be_cmd_req_set_lmode {
++ struct be_cmd_req_hdr hdr;
++ u8 src_port;
++ u8 dest_port;
++ u8 loopback_type;
++ u8 loopback_state;
++};
++
++struct be_cmd_resp_set_lmode {
++ struct be_cmd_resp_hdr resp_hdr;
++ u8 rsvd0[4];
++};
++
++/********************** DDR DMA test *********************/
++struct be_cmd_req_ddrdma_test {
++ struct be_cmd_req_hdr hdr;
++ u64 pattern;
++ u32 byte_count;
++ u32 rsvd0;
++ u8 snd_buff[4096];
++ u8 rsvd1[4096];
++};
++
++struct be_cmd_resp_ddrdma_test {
++ struct be_cmd_resp_hdr hdr;
++ u64 pattern;
++ u32 byte_cnt;
++ u32 snd_err;
++ u8 rsvd0[4096];
++ u8 rcv_buff[4096];
++};
++
++/*********************** SEEPROM Read ***********************/
++
++#define BE_READ_SEEPROM_LEN 1024
++struct be_cmd_req_seeprom_read {
++ struct be_cmd_req_hdr hdr;
++ u8 rsvd0[BE_READ_SEEPROM_LEN];
++};
++
++struct be_cmd_resp_seeprom_read {
++ struct be_cmd_req_hdr hdr;
++ u8 seeprom_data[BE_READ_SEEPROM_LEN];
++};
++
++enum {
++ PHY_TYPE_CX4_10GB = 0,
++ PHY_TYPE_XFP_10GB,
++ PHY_TYPE_SFP_1GB,
++ PHY_TYPE_SFP_PLUS_10GB,
++ PHY_TYPE_KR_10GB,
++ PHY_TYPE_KX4_10GB,
++ PHY_TYPE_BASET_10GB,
++ PHY_TYPE_BASET_1GB,
++ PHY_TYPE_BASEX_1GB,
++ PHY_TYPE_SGMII,
++ PHY_TYPE_DISABLED = 255
++};
++
++#define BE_AN_EN 0x2
++#define BE_PAUSE_SYM_EN 0x80
++
++struct be_cmd_req_get_phy_info {
++ struct be_cmd_req_hdr hdr;
++ u8 rsvd0[24];
++};
++
++struct be_phy_info {
++ u16 phy_type;
++ u16 interface_type;
++ u32 misc_params;
++ u16 ext_phy_details;
++ u16 rsvd;
++ u16 auto_speeds_supported;
++ u16 fixed_speeds_supported;
++ u32 future_use[2];
++};
++
++struct be_cmd_resp_get_phy_info {
++ struct be_cmd_req_hdr hdr;
++ struct be_phy_info phy_info;
++};
++
++/*********************** Set QOS ***********************/
++
++#define BE_QOS_BITS_NIC 1
++
++struct be_cmd_req_set_qos {
++ struct be_cmd_req_hdr hdr;
++ u32 valid_bits;
++ u32 max_bps_nic;
++ u32 rsvd[7];
++};
++
++struct be_cmd_resp_set_qos {
++ struct be_cmd_resp_hdr hdr;
++ u32 rsvd;
++};
++
++/*********************** Controller Attributes ***********************/
++struct be_cmd_req_cntl_attribs {
++ struct be_cmd_req_hdr hdr;
++};
++
++struct be_cmd_resp_cntl_attribs {
++ struct be_cmd_resp_hdr hdr;
++ struct mgmt_controller_attrib attribs;
++};
++
++/******************* get port names ***************/
++struct be_cmd_req_get_port_name {
++ struct be_cmd_req_hdr hdr;
++ u32 rsvd0;
++};
++
++struct be_cmd_resp_get_port_name {
++ struct be_cmd_req_hdr hdr;
++ u8 port0_name;
++ u8 port1_name;
++ u8 rsvd0[2];
++};
++
++struct be_cmd_resp_get_port_name_v1 {
++ struct be_cmd_req_hdr hdr;
++ u32 pt : 2;
++ u32 rsvd0 : 30;
++ u8 port0_name;
++ u8 port1_name;
++ u8 port2_name;
++ u8 port3_name;
++};
++
++/*********************** Set driver function ***********************/
++#define CAPABILITY_SW_TIMESTAMPS 2
++#define CAPABILITY_BE3_NATIVE_ERX_API 4
++
++struct be_cmd_req_set_func_cap {
++ struct be_cmd_req_hdr hdr;
++ u32 valid_cap_flags;
++ u32 cap_flags;
++ u8 rsvd[212];
++};
++
++struct be_cmd_resp_set_func_cap {
++ struct be_cmd_resp_hdr hdr;
++ u32 valid_cap_flags;
++ u32 cap_flags;
++ u8 rsvd[212];
++};
++
++/*********************** PG Query Request ****************************/
++#define REQ_PG_QUERY 0x1
++#define REQ_PG_FEAT 0x1
++struct be_cmd_req_pg {
++ struct be_cmd_req_hdr hdr;
++ u32 query;
++ u32 pfc_pg;
++};
++
++struct be_cmd_resp_pg {
++ struct be_cmd_resp_hdr hdr;
++ u32 pfc_pg;
++ u32 num_tx_rings;
++};
++
++/*********************** Function Privileges ***********************/
++enum {
++ BE_PRIV_DEFAULT = 0x1,
++ BE_PRIV_LNKQUERY = 0x2,
++ BE_PRIV_LNKSTATS = 0x4,
++ BE_PRIV_LNKMGMT = 0x8,
++ BE_PRIV_LNKDIAG = 0x10,
++ BE_PRIV_UTILQUERY = 0x20,
++ BE_PRIV_FILTMGMT = 0x40,
++ BE_PRIV_IFACEMGMT = 0x80,
++ BE_PRIV_VHADM = 0x100,
++ BE_PRIV_DEVCFG = 0x200,
++ BE_PRIV_DEVSEC = 0x400
++};
++
++struct be_cmd_req_get_fn_privileges {
++ struct be_cmd_req_hdr hdr;
++ u32 rsvd;
++};
++
++struct be_cmd_resp_get_fn_privileges {
++ struct be_cmd_resp_hdr hdr;
++ u32 privilege_mask;
++};
++
++struct be_cmd_req_set_fn_privileges {
++ struct be_cmd_req_hdr hdr;
++ u32 privilege_mask;
++};
++
++struct be_cmd_resp_set_fn_privileges {
++ struct be_cmd_resp_hdr hdr;
++ u32 prev_privilege_mask;
++};
++
++/*********************** HSW Config ***********************/
++struct amap_set_hsw_context {
++ u8 interface_id[16];
++ u8 rsvd0[14];
++ u8 pvid_valid;
++ u8 rsvd1;
++ u8 rsvd2[16];
++ u8 pvid[16];
++ u8 rsvd3[32];
++ u8 rsvd4[32];
++ u8 rsvd5[32];
++} __packed;
++
++struct be_cmd_req_set_hsw_config {
++ struct be_cmd_req_hdr hdr;
++ u8 context[sizeof(struct amap_set_hsw_context) / 8];
++} __packed;
++
++struct be_cmd_resp_set_hsw_config {
++ struct be_cmd_resp_hdr hdr;
++ u32 rsvd;
++};
++
++struct amap_get_hsw_req_context {
++ u8 interface_id[16];
++ u8 rsvd0[14];
++ u8 pvid_valid;
++ u8 pport;
++} __packed;
++
++struct amap_get_hsw_resp_context {
++ u8 rsvd1[16];
++ u8 pvid[16];
++ u8 rsvd2[32];
++ u8 rsvd3[32];
++ u8 rsvd4[32];
++} __packed;
++
++struct be_cmd_req_get_hsw_config {
++ struct be_cmd_req_hdr hdr;
++ u8 context[sizeof(struct amap_get_hsw_req_context) / 8];
++} __packed;
++
++struct be_cmd_resp_get_hsw_config {
++ struct be_cmd_resp_hdr hdr;
++ u8 context[sizeof(struct amap_get_hsw_resp_context) / 8];
++ u32 rsvd;
++};
++
++/*************** Set speed ********************/
++struct be_cmd_req_set_port_speed_v1 {
++ struct be_cmd_req_hdr hdr;
++ u8 port_num;
++ u8 virt_port;
++ u16 mac_speed;
++ u16 dac_cable_length;
++ u16 rsvd0;
++};
++
++struct be_cmd_resp_set_port_speed_v1 {
++ struct be_cmd_resp_hdr hdr;
++ u32 rsvd0;
++};
++
++/************** get port speed *******************/
++struct be_cmd_req_get_port_speed {
++ struct be_cmd_req_hdr hdr;
++ u8 port_num;
++};
++
++struct be_cmd_resp_get_port_speed {
++ struct be_cmd_req_hdr hdr;
++ u16 mac_speed;
++ u16 dac_cable_length;
++};
++
++/*************** HW Stats Get v1 **********************************/
++#define BE_TXP_SW_SZ 48
++struct be_port_rxf_stats_v1 {
++ u32 rsvd0[12];
++ u32 rx_crc_errors;
++ u32 rx_alignment_symbol_errors;
++ u32 rx_pause_frames;
++ u32 rx_priority_pause_frames;
++ u32 rx_control_frames;
++ u32 rx_in_range_errors;
++ u32 rx_out_range_errors;
++ u32 rx_frame_too_long;
++ u32 rx_address_match_errors;
++ u32 rx_dropped_too_small;
++ u32 rx_dropped_too_short;
++ u32 rx_dropped_header_too_small;
++ u32 rx_dropped_tcp_length;
++ u32 rx_dropped_runt;
++ u32 rsvd1[10];
++ u32 rx_ip_checksum_errs;
++ u32 rx_tcp_checksum_errs;
++ u32 rx_udp_checksum_errs;
++ u32 rsvd2[7];
++ u32 rx_switched_unicast_packets;
++ u32 rx_switched_multicast_packets;
++ u32 rx_switched_broadcast_packets;
++ u32 rsvd3[3];
++ u32 tx_pauseframes;
++ u32 tx_priority_pauseframes;
++ u32 tx_controlframes;
++ u32 rsvd4[10];
++ u32 rxpp_fifo_overflow_drop;
++ u32 rx_input_fifo_overflow_drop;
++ u32 pmem_fifo_overflow_drop;
++ u32 jabber_events;
++ u32 rsvd5[3];
++};
++
++
++struct be_rxf_stats_v1 {
++ struct be_port_rxf_stats_v1 port[4];
++ u32 rsvd0[2];
++ u32 rx_drops_no_pbuf;
++ u32 rx_drops_no_txpb;
++ u32 rx_drops_no_erx_descr;
++ u32 rx_drops_no_tpre_descr;
++ u32 rsvd1[6];
++ u32 rx_drops_too_many_frags;
++ u32 rx_drops_invalid_ring;
++ u32 forwarded_packets;
++ u32 rx_drops_mtu;
++ u32 rsvd2[14];
++};
++
++struct be_erx_stats_v1 {
++ u32 rx_drops_no_fragments[68]; /* dwordS 0 to 67*/
++ u32 rsvd[4];
++};
++
++struct be_hw_stats_v1 {
++ struct be_rxf_stats_v1 rxf;
++ u32 rsvd0[BE_TXP_SW_SZ];
++ struct be_erx_stats_v1 erx;
++ struct be_pmem_stats pmem;
++ u32 rsvd1[3];
++};
++
++struct be_cmd_req_get_stats_v1 {
++ struct be_cmd_req_hdr hdr;
++ u8 rsvd[sizeof(struct be_hw_stats_v1)];
++};
++
++struct be_cmd_resp_get_stats_v1 {
++ struct be_cmd_resp_hdr hdr;
++ struct be_hw_stats_v1 hw_stats;
++};
++
++static inline void *
++hw_stats_from_cmd(struct be_adapter *adapter)
++{
++ if (adapter->generation == BE_GEN3) {
++ struct be_cmd_resp_get_stats_v1 *cmd = adapter->stats_cmd.va;
++
++ return &cmd->hw_stats;
++ } else {
++ struct be_cmd_resp_get_stats_v0 *cmd = adapter->stats_cmd.va;
++
++ return &cmd->hw_stats;
++ }
++}
++
++static inline void *be_port_rxf_stats_from_cmd(struct be_adapter *adapter)
++{
++ if (adapter->generation == BE_GEN3) {
++ struct be_hw_stats_v1 *hw_stats = hw_stats_from_cmd(adapter);
++ struct be_rxf_stats_v1 *rxf_stats = &hw_stats->rxf;
++
++ return &rxf_stats->port[adapter->port_num];
++ } else {
++ struct be_hw_stats_v0 *hw_stats = hw_stats_from_cmd(adapter);
++ struct be_rxf_stats_v0 *rxf_stats = &hw_stats->rxf;
++
++ return &rxf_stats->port[adapter->port_num];
++ }
++}
++
++static inline void *be_rxf_stats_from_cmd(struct be_adapter *adapter)
++{
++ if (adapter->generation == BE_GEN3) {
++ struct be_hw_stats_v1 *hw_stats = hw_stats_from_cmd(adapter);
++
++ return &hw_stats->rxf;
++ } else {
++ struct be_hw_stats_v0 *hw_stats = hw_stats_from_cmd(adapter);
++
++ return &hw_stats->rxf;
++ }
++}
++
++static inline void *be_erx_stats_from_cmd(struct be_adapter *adapter)
++{
++ if (adapter->generation == BE_GEN3) {
++ struct be_hw_stats_v1 *hw_stats = hw_stats_from_cmd(adapter);
++
++ return &hw_stats->erx;
++ } else {
++ struct be_hw_stats_v0 *hw_stats = hw_stats_from_cmd(adapter);
++
++ return &hw_stats->erx;
++ }
++}
++
++static inline void *be_pmem_stats_from_cmd(struct be_adapter *adapter)
++{
++ if (adapter->generation == BE_GEN3) {
++ struct be_hw_stats_v1 *hw_stats = hw_stats_from_cmd(adapter);
++
++ return &hw_stats->pmem;
++ } else {
++ struct be_hw_stats_v0 *hw_stats = hw_stats_from_cmd(adapter);
++
++ return &hw_stats->pmem;
++ }
++}
++
+ extern int be_pci_fnum_get(struct be_adapter *adapter);
+ extern int be_cmd_POST(struct be_adapter *adapter);
+ extern int be_cmd_mac_addr_query(struct be_adapter *adapter, u8 *mac_addr,
+ u8 type, bool permanent, u32 if_handle);
+ extern int be_cmd_pmac_add(struct be_adapter *adapter, u8 *mac_addr,
+- u32 if_id, u32 *pmac_id);
+-extern int be_cmd_pmac_del(struct be_adapter *adapter, u32 if_id, u32 pmac_id);
++ u32 if_id, u32 *pmac_id, u32 domain);
++extern int be_cmd_pmac_del(struct be_adapter *adapter, u32 if_id, u32 pmac_id,
++ u32 domain);
+ extern int be_cmd_if_create(struct be_adapter *adapter, u32 cap_flags,
+ u32 en_flags, u8 *mac, bool pmac_invalid,
+- u32 *if_handle, u32 *pmac_id);
+-extern int be_cmd_if_destroy(struct be_adapter *adapter, u32 if_handle);
++ u32 *if_handle, u32 *pmac_id, u32 domain);
++extern int be_cmd_if_destroy(struct be_adapter *adapter, u32 if_handle,
++ u32 domain);
+ extern int be_cmd_eq_create(struct be_adapter *adapter,
+ struct be_queue_info *eq, int eq_delay);
+ extern int be_cmd_cq_create(struct be_adapter *adapter,
+@@ -736,36 +1415,92 @@ extern int be_cmd_mccq_create(struct be_adapter *adapter,
+ struct be_queue_info *cq);
+ extern int be_cmd_txq_create(struct be_adapter *adapter,
+ struct be_queue_info *txq,
+- struct be_queue_info *cq);
++ struct be_queue_info *cq, u8 *tc_id);
+ extern int be_cmd_rxq_create(struct be_adapter *adapter,
+ struct be_queue_info *rxq, u16 cq_id,
+ u16 frag_size, u16 max_frame_size, u32 if_id,
+- u32 rss);
++ u32 rss, u8 *rss_id);
+ extern int be_cmd_q_destroy(struct be_adapter *adapter, struct be_queue_info *q,
+ int type);
++extern int be_cmd_rxq_destroy(struct be_adapter *adapter,
++ struct be_queue_info *q);
+ extern int be_cmd_link_status_query(struct be_adapter *adapter,
+- bool *link_up);
++ int *link_status, u8 *mac_speed, u16 *link_speed, u32 dom);
+ extern int be_cmd_reset(struct be_adapter *adapter);
+ extern int be_cmd_get_stats(struct be_adapter *adapter,
+ struct be_dma_mem *nonemb_cmd);
+-extern int be_cmd_get_fw_ver(struct be_adapter *adapter, char *fw_ver);
++extern int be_cmd_get_fw_ver(struct be_adapter *adapter, char *fw_ver,
++ char *fw_on_flash);
+
+ extern int be_cmd_modify_eqd(struct be_adapter *adapter, u32 eq_id, u32 eqd);
+ extern int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id,
+ u16 *vtag_array, u32 num, bool untagged,
+ bool promiscuous);
+-extern int be_cmd_promiscuous_config(struct be_adapter *adapter,
+- u8 port_num, bool en);
+-extern int be_cmd_multicast_set(struct be_adapter *adapter, u32 if_id,
+- struct dev_mc_list *mc_list, u32 mc_count);
++extern int be_cmd_rx_filter(struct be_adapter *adapter, u32 flags, u32 status);
+ extern int be_cmd_set_flow_control(struct be_adapter *adapter,
+ u32 tx_fc, u32 rx_fc);
+ extern int be_cmd_get_flow_control(struct be_adapter *adapter,
+ u32 *tx_fc, u32 *rx_fc);
+-extern int be_cmd_query_fw_cfg(struct be_adapter *adapter,
+- u32 *port_num, u32 *cap);
++extern int be_cmd_query_fw_cfg(struct be_adapter *adapter, u32 *port_num,
++ u32 *function_mode, u32 *functions_caps);
+ extern int be_cmd_reset_function(struct be_adapter *adapter);
+-extern int be_process_mcc(struct be_adapter *adapter);
++extern int be_cmd_rss_config(struct be_adapter *adapter, u8 *rsstable,
++ u16 table_size);
++extern int be_process_mcc(struct be_adapter *adapter, int *status);
++extern int be_cmd_set_beacon_state(struct be_adapter *adapter,
++ u8 port_num, u8 beacon, u8 status, u8 state);
++extern int be_cmd_get_beacon_state(struct be_adapter *adapter,
++ u8 port_num, u32 *state);
++extern int be_cmd_read_port_type(struct be_adapter *adapter, u32 port,
++ u8 *connector);
+ extern int be_cmd_write_flashrom(struct be_adapter *adapter,
+ struct be_dma_mem *cmd, u32 flash_oper,
+ u32 flash_opcode, u32 buf_size);
++int be_cmd_get_flash_crc(struct be_adapter *adapter, u8 *flashed_crc,
++ int offset);
++extern int be_cmd_enable_magic_wol(struct be_adapter *adapter, u8 *mac,
++ struct be_dma_mem *nonemb_cmd);
++extern int be_cmd_fw_init(struct be_adapter *adapter);
++extern int be_cmd_fw_clean(struct be_adapter *adapter);
++extern void be_async_mcc_enable(struct be_adapter *adapter);
++extern void be_async_mcc_disable(struct be_adapter *adapter);
++extern int be_cmd_loopback_test(struct be_adapter *adapter, u32 port_num,
++ u32 loopback_type, u32 pkt_size,
++ u32 num_pkts, u64 pattern);
++extern int be_cmd_ddr_dma_test(struct be_adapter *adapter, u64 pattern,
++ u32 byte_cnt, struct be_dma_mem *cmd);
++extern int be_cmd_get_seeprom_data(struct be_adapter *adapter,
++ struct be_dma_mem *nonemb_cmd);
++extern int be_cmd_set_loopback(struct be_adapter *adapter, u8 port_num,
++ u8 loopback_type, u8 enable);
++extern int be_cmd_get_phy_info(struct be_adapter *adapter,
++ struct be_phy_info *phy_info);
++extern int be_cmd_set_qos(struct be_adapter *adapter, u32 bps, u32 domain);
++extern void be_detect_dump_ue(struct be_adapter *adapter);
++extern int be_cmd_get_die_temperature(struct be_adapter *adapter);
++extern int be_cmd_get_cntl_attributes(struct be_adapter *adapter);
++extern int be_cmd_get_reg_len(struct be_adapter *adapter, u32 *log_size);
++extern void be_cmd_get_regs(struct be_adapter *adapter, u32 buf_len, void *buf);
++extern int be_cmd_req_native_mode(struct be_adapter *adapter);
++extern int be_cmd_query_port_names_v0(struct be_adapter *adapter, u8 *port_name);
++extern int be_cmd_query_port_names_v1(struct be_adapter *adapter, u8 *port_name);
++extern int be_cmd_req_pg_pfc(struct be_adapter *adapter, int *fw_num_txqs);
++
++extern int be_cmd_get_fn_privileges(struct be_adapter *adapter,
++ u32 *privilege, u32 domain);
++extern int be_cmd_set_fn_privileges(struct be_adapter *adapter,
++ u32 mask, u32 *prev, u32 domain);
++extern int be_cmd_set_hsw_config(struct be_adapter *adapter, u16 pvid,
++ u32 domain, u16 intf_id);
++extern int be_cmd_get_hsw_config(struct be_adapter *adapter, u16 *pvid,
++ u32 domain, u16 intf_id);
++extern int be_cmd_set_port_speed_v1(struct be_adapter *adapter, u8 port_num,
++ u16 mac_speed, u16 dac_cable_len);
++extern int be_cmd_get_port_speed(struct be_adapter *adapter, u8 port_num,
++ u16 *dac_cable_len, u16 *port_speed);
++#ifdef CONFIG_PALAU
++int be_cmd_pass_ext_ioctl(struct be_adapter *adapter, dma_addr_t dma,
++ int req_size, void *va);
++#endif
++
++#endif /* !BE_CMDS_H */
+diff --git a/drivers/net/benet/be_compat.c b/drivers/net/benet/be_compat.c
+new file mode 100644
+index 0000000..bdd1dba
+--- /dev/null
++++ b/drivers/net/benet/be_compat.c
+@@ -0,0 +1,630 @@
++/*
++ * Copyright (C) 2005 - 2011 Emulex
++ * All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License version 2
++ * as published by the Free Software Foundation. The full GNU General
++ * Public License is included in this distribution in the file called COPYING.
++ *
++ * Contact Information:
++ * linux-drivers@emulex.com
++ *
++ * Emulex
++ * 3333 Susan Street
++ * Costa Mesa, CA 92626
++ */
++
++#include "be.h"
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 28)
++void be_netdev_ops_init(struct net_device *netdev, struct net_device_ops *ops)
++{
++ netdev->open = ops->ndo_open;
++ netdev->stop = ops->ndo_stop;
++ netdev->hard_start_xmit = ops->ndo_start_xmit;
++ netdev->set_mac_address = ops->ndo_set_mac_address;
++ netdev->get_stats = ops->ndo_get_stats;
++ netdev->set_multicast_list = ops->ndo_set_rx_mode;
++ netdev->change_mtu = ops->ndo_change_mtu;
++ netdev->vlan_rx_register = ops->ndo_vlan_rx_register;
++ netdev->vlan_rx_add_vid = ops->ndo_vlan_rx_add_vid;
++ netdev->vlan_rx_kill_vid = ops->ndo_vlan_rx_kill_vid;
++ netdev->do_ioctl = ops->ndo_do_ioctl;
++#ifdef CONFIG_NET_POLL_CONTROLLER
++ netdev->poll_controller = ops->ndo_poll_controller;
++#endif
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
++ netdev->select_queue = ops->ndo_select_queue;
++#endif
++}
++#endif
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 28)
++int eth_validate_addr(struct net_device *netdev)
++{
++ return 0;
++}
++#endif
++
++/* New NAPI backport */
++#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 24)
++
++int be_poll_compat(struct net_device *netdev, int *budget)
++{
++ struct napi_struct *napi = netdev->priv;
++ u32 work_done, can_do;
++
++ can_do = min(*budget, netdev->quota);
++ work_done = napi->poll(napi, can_do);
++
++ *budget -= work_done;
++ netdev->quota -= work_done;
++ if (napi->rx)
++ return (work_done >= can_do);
++ return 0;
++}
++
++
++#endif /* New NAPI backport */
++
++int be_netif_napi_add(struct net_device *netdev,
++ struct napi_struct *napi,
++ int (*poll) (struct napi_struct *, int), int weight)
++{
++#ifdef HAVE_SIMULATED_MULTI_NAPI
++ struct be_adapter *adapter = netdev_priv(netdev);
++ struct net_device *nd;
++
++ nd = alloc_netdev(0, "", ether_setup);
++ if (!nd)
++ return -ENOMEM;
++ nd->priv = napi;
++ nd->weight = BE_NAPI_WEIGHT;
++ nd->poll = be_poll_compat;
++ set_bit(__LINK_STATE_START, &nd->state);
++
++ if (napi == &adapter->rx_obj[0].rx_eq.napi)
++ napi->rx = true;
++ napi->poll = poll;
++ napi->dev = nd;
++#ifdef RHEL_NEW_NAPI
++ napi->napi.dev = netdev;
++#endif
++ return 0;
++#else
++ netif_napi_add(netdev, napi, poll, weight);
++ return 0;
++#endif
++}
++void be_netif_napi_del(struct net_device *netdev)
++{
++#ifdef HAVE_SIMULATED_MULTI_NAPI
++ struct be_adapter *adapter = netdev_priv(netdev);
++ struct napi_struct *napi;
++ struct be_rx_obj *rxo;
++ int i;
++
++ for_all_rx_queues(adapter, rxo, i) {
++ napi = &rxo->rx_eq.napi;
++ if (napi->dev) {
++ free_netdev(napi->dev);
++ napi->dev = NULL;
++ }
++ }
++
++ napi = &adapter->tx_eq.napi;
++ if (napi->dev) {
++ free_netdev(napi->dev);
++ napi->dev = NULL;
++ }
++#endif
++}
++/* INET_LRO backport */
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 27)
++
++#define TCP_HDR_LEN(tcph) (tcph->doff << 2)
++#define IP_HDR_LEN(iph) (iph->ihl << 2)
++#define TCP_PAYLOAD_LENGTH(iph, tcph) (ntohs(iph->tot_len) - IP_HDR_LEN(iph) \
++ - TCP_HDR_LEN(tcph))
++
++#define IPH_LEN_WO_OPTIONS 5
++#define TCPH_LEN_WO_OPTIONS 5
++#define TCPH_LEN_W_TIMESTAMP 8
++
++#define LRO_MAX_PG_HLEN 64
++#define LRO_INC_STATS(lro_mgr, attr) { lro_mgr->stats.attr++; }
++/*
++ * Basic tcp checks whether packet is suitable for LRO
++ */
++static int lro_tcp_ip_check(struct iphdr *iph, struct tcphdr *tcph,
++ int len, struct net_lro_desc *lro_desc)
++{
++ /* check ip header: don't aggregate padded frames */
++ if (ntohs(iph->tot_len) != len)
++ return -1;
++
++ if (iph->ihl != IPH_LEN_WO_OPTIONS)
++ return -1;
++
++ if (tcph->cwr || tcph->ece || tcph->urg || !tcph->ack
++ || tcph->rst || tcph->syn || tcph->fin)
++ return -1;
++
++ if (INET_ECN_is_ce(ipv4_get_dsfield(iph)))
++ return -1;
++
++ if (tcph->doff != TCPH_LEN_WO_OPTIONS
++ && tcph->doff != TCPH_LEN_W_TIMESTAMP)
++ return -1;
++
++ /* check tcp options (only timestamp allowed) */
++ if (tcph->doff == TCPH_LEN_W_TIMESTAMP) {
++ u32 *topt = (u32 *)(tcph + 1);
++
++ if (*topt != htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16)
++ | (TCPOPT_TIMESTAMP << 8)
++ | TCPOLEN_TIMESTAMP))
++ return -1;
++
++ /* timestamp should be in right order */
++ topt++;
++ if (lro_desc && after(ntohl(lro_desc->tcp_rcv_tsval),
++ ntohl(*topt)))
++ return -1;
++
++ /* timestamp reply should not be zero */
++ topt++;
++ if (*topt == 0)
++ return -1;
++ }
++
++ return 0;
++}
++
++static void lro_update_tcp_ip_header(struct net_lro_desc *lro_desc)
++{
++ struct iphdr *iph = lro_desc->iph;
++ struct tcphdr *tcph = lro_desc->tcph;
++ u32 *p;
++ __wsum tcp_hdr_csum;
++
++ tcph->ack_seq = lro_desc->tcp_ack;
++ tcph->window = lro_desc->tcp_window;
++
++ if (lro_desc->tcp_saw_tstamp) {
++ p = (u32 *)(tcph + 1);
++ *(p+2) = lro_desc->tcp_rcv_tsecr;
++ }
++
++ iph->tot_len = htons(lro_desc->ip_tot_len);
++
++ iph->check = 0;
++ iph->check = ip_fast_csum((u8 *)lro_desc->iph, iph->ihl);
++
++ tcph->check = 0;
++ tcp_hdr_csum = csum_partial((u8 *)tcph, TCP_HDR_LEN(tcph), 0);
++ lro_desc->data_csum = csum_add(lro_desc->data_csum, tcp_hdr_csum);
++ tcph->check = csum_tcpudp_magic(iph->saddr, iph->daddr,
++ lro_desc->ip_tot_len -
++ IP_HDR_LEN(iph), IPPROTO_TCP,
++ lro_desc->data_csum);
++}
++
++static __wsum lro_tcp_data_csum(struct iphdr *iph, struct tcphdr *tcph, int len)
++{
++ __wsum tcp_csum;
++ __wsum tcp_hdr_csum;
++ __wsum tcp_ps_hdr_csum;
++
++ tcp_csum = ~csum_unfold(tcph->check);
++ tcp_hdr_csum = csum_partial((u8 *)tcph, TCP_HDR_LEN(tcph), tcp_csum);
++
++ tcp_ps_hdr_csum = csum_tcpudp_nofold(iph->saddr, iph->daddr,
++ len + TCP_HDR_LEN(tcph),
++ IPPROTO_TCP, 0);
++
++ return csum_sub(csum_sub(tcp_csum, tcp_hdr_csum),
++ tcp_ps_hdr_csum);
++}
++
++static void lro_init_desc(struct net_lro_desc *lro_desc, struct sk_buff *skb,
++ struct iphdr *iph, struct tcphdr *tcph,
++ u16 vlan_tag, struct vlan_group *vgrp)
++{
++ int nr_frags;
++ u32 *ptr;
++ u32 tcp_data_len = TCP_PAYLOAD_LENGTH(iph, tcph);
++
++ nr_frags = skb_shinfo(skb)->nr_frags;
++ lro_desc->parent = skb;
++ lro_desc->next_frag = &(skb_shinfo(skb)->frags[nr_frags]);
++ lro_desc->iph = iph;
++ lro_desc->tcph = tcph;
++ lro_desc->tcp_next_seq = ntohl(tcph->seq) + tcp_data_len;
++ lro_desc->tcp_ack = ntohl(tcph->ack_seq);
++ lro_desc->tcp_window = tcph->window;
++
++ lro_desc->pkt_aggr_cnt = 1;
++ lro_desc->ip_tot_len = ntohs(iph->tot_len);
++
++ if (tcph->doff == 8) {
++ ptr = (u32 *)(tcph+1);
++ lro_desc->tcp_saw_tstamp = 1;
++ lro_desc->tcp_rcv_tsval = *(ptr+1);
++ lro_desc->tcp_rcv_tsecr = *(ptr+2);
++ }
++
++ lro_desc->mss = tcp_data_len;
++ lro_desc->vgrp = vgrp;
++ lro_desc->vlan_tag = vlan_tag;
++ lro_desc->active = 1;
++
++ if (tcp_data_len)
++ lro_desc->data_csum = lro_tcp_data_csum(iph, tcph,
++ tcp_data_len);
++
++ if (!tcp_data_len)
++ lro_desc->ack_cnt++;
++}
++
++static inline void lro_clear_desc(struct net_lro_desc *lro_desc)
++{
++ memset(lro_desc, 0, sizeof(struct net_lro_desc));
++}
++
++static void lro_add_common(struct net_lro_desc *lro_desc, struct iphdr *iph,
++ struct tcphdr *tcph, int tcp_data_len)
++{
++ struct sk_buff *parent = lro_desc->parent;
++ u32 *topt;
++
++ lro_desc->pkt_aggr_cnt++;
++ lro_desc->ip_tot_len += tcp_data_len;
++ lro_desc->tcp_next_seq += tcp_data_len;
++ lro_desc->tcp_window = tcph->window;
++ lro_desc->tcp_ack = tcph->ack_seq;
++
++ /* don't update tcp_rcv_tsval, would not work with PAWS */
++ if (lro_desc->tcp_saw_tstamp) {
++ topt = (u32 *) (tcph + 1);
++ lro_desc->tcp_rcv_tsecr = *(topt + 2);
++ }
++
++ if (tcp_data_len)
++ lro_desc->data_csum = csum_block_add(lro_desc->data_csum,
++ lro_tcp_data_csum(iph, tcph,
++ tcp_data_len),
++ parent->len);
++
++ parent->len += tcp_data_len;
++ parent->data_len += tcp_data_len;
++ if (tcp_data_len > lro_desc->mss)
++ lro_desc->mss = tcp_data_len;
++}
++
++static void lro_add_frags(struct net_lro_desc *lro_desc,
++ int len, int hlen, int truesize,
++ struct skb_frag_struct *skb_frags,
++ struct iphdr *iph, struct tcphdr *tcph)
++{
++ struct sk_buff *skb = lro_desc->parent;
++ int tcp_data_len = TCP_PAYLOAD_LENGTH(iph, tcph);
++
++ lro_add_common(lro_desc, iph, tcph, tcp_data_len);
++
++ skb->truesize += truesize;
++
++ if (!tcp_data_len) {
++ put_page(skb_frags[0].page);
++ lro_desc->ack_cnt++;
++ return;
++ }
++
++ skb_frags[0].page_offset += hlen;
++ skb_frags[0].size -= hlen;
++
++ while (tcp_data_len > 0) {
++ *(lro_desc->next_frag) = *skb_frags;
++ tcp_data_len -= skb_frags->size;
++ lro_desc->next_frag++;
++ skb_frags++;
++ skb_shinfo(skb)->nr_frags++;
++ }
++}
++
++static int lro_check_tcp_conn(struct net_lro_desc *lro_desc,
++ struct iphdr *iph,
++ struct tcphdr *tcph)
++{
++ if ((lro_desc->iph->saddr != iph->saddr)
++ || (lro_desc->iph->daddr != iph->daddr)
++ || (lro_desc->tcph->source != tcph->source)
++ || (lro_desc->tcph->dest != tcph->dest))
++ return -1;
++ return 0;
++}
++
++static struct net_lro_desc *lro_get_desc(struct net_lro_mgr *lro_mgr,
++ struct net_lro_desc *lro_arr,
++ struct iphdr *iph,
++ struct tcphdr *tcph)
++{
++ struct net_lro_desc *lro_desc = NULL;
++ struct net_lro_desc *tmp;
++ int max_desc = lro_mgr->max_desc;
++ int i;
++
++ for (i = 0; i < max_desc; i++) {
++ tmp = &lro_arr[i];
++ if (tmp->active)
++ if (!lro_check_tcp_conn(tmp, iph, tcph)) {
++ lro_desc = tmp;
++ goto out;
++ }
++ }
++
++ for (i = 0; i < max_desc; i++) {
++ if (!lro_arr[i].active) {
++ lro_desc = &lro_arr[i];
++ goto out;
++ }
++ }
++
++ LRO_INC_STATS(lro_mgr, no_desc);
++out:
++ return lro_desc;
++}
++
++static void lro_flush(struct net_lro_mgr *lro_mgr,
++ struct net_lro_desc *lro_desc)
++{
++ struct be_adapter *adapter = netdev_priv(lro_mgr->dev);
++
++ if (lro_desc->pkt_aggr_cnt > 1)
++ lro_update_tcp_ip_header(lro_desc);
++
++ skb_shinfo(lro_desc->parent)->gso_size = lro_desc->mss;
++
++ if (lro_desc->vgrp) {
++ if (test_bit(LRO_F_NAPI, &lro_mgr->features))
++ vlan_hwaccel_receive_skb(lro_desc->parent,
++ lro_desc->vgrp,
++ lro_desc->vlan_tag);
++ else
++ vlan_hwaccel_rx(lro_desc->parent,
++ lro_desc->vgrp,
++ lro_desc->vlan_tag);
++
++ } else {
++ if (test_bit(LRO_F_NAPI, &lro_mgr->features))
++ netif_receive_skb(lro_desc->parent);
++ else
++ netif_rx(lro_desc->parent);
++ }
++
++ LRO_INC_STATS(lro_mgr, flushed);
++ lro_clear_desc(lro_desc);
++}
++
++static struct sk_buff *lro_gen_skb(struct net_lro_mgr *lro_mgr,
++ struct skb_frag_struct *frags,
++ int len, int true_size,
++ void *mac_hdr,
++ int hlen, __wsum sum,
++ u32 ip_summed)
++{
++ struct sk_buff *skb;
++ struct skb_frag_struct *skb_frags;
++ int data_len = len;
++ int hdr_len = min(len, hlen);
++
++ skb = netdev_alloc_skb(lro_mgr->dev, hlen);
++ if (!skb)
++ return NULL;
++
++ skb->len = len;
++ skb->data_len = len - hdr_len;
++ skb->truesize += true_size;
++ skb->tail += hdr_len;
++
++ memcpy(skb->data, mac_hdr, hdr_len);
++
++ if (skb->data_len) {
++ skb_frags = skb_shinfo(skb)->frags;
++ while (data_len > 0) {
++ *skb_frags = *frags;
++ data_len -= frags->size;
++ skb_frags++;
++ frags++;
++ skb_shinfo(skb)->nr_frags++;
++ }
++ skb_shinfo(skb)->frags[0].page_offset += hdr_len;
++ skb_shinfo(skb)->frags[0].size -= hdr_len;
++ } else {
++ put_page(frags[0].page);
++ }
++
++
++ skb->ip_summed = ip_summed;
++ skb->csum = sum;
++ skb->protocol = eth_type_trans(skb, lro_mgr->dev);
++ return skb;
++}
++
++static struct sk_buff *__lro_proc_segment(struct net_lro_mgr *lro_mgr,
++ struct skb_frag_struct *frags,
++ int len, int true_size,
++ struct vlan_group *vgrp,
++ u16 vlan_tag, void *priv, __wsum sum)
++{
++ struct net_lro_desc *lro_desc;
++ struct iphdr *iph;
++ struct tcphdr *tcph;
++ struct sk_buff *skb;
++ u64 flags;
++ void *mac_hdr;
++ int mac_hdr_len;
++ int hdr_len = LRO_MAX_PG_HLEN;
++ int vlan_hdr_len = 0;
++ u8 pad_bytes;
++
++ if (!lro_mgr->get_frag_header
++ || lro_mgr->get_frag_header(frags, (void *)&mac_hdr, (void *)&iph,
++ (void *)&tcph, &flags, priv)) {
++ mac_hdr = page_address(frags->page) + frags->page_offset;
++ goto out1;
++ }
++
++ if (!(flags & LRO_IPV4) || !(flags & LRO_TCP))
++ goto out1;
++
++ hdr_len = (int)((void *)(tcph) + TCP_HDR_LEN(tcph) - mac_hdr);
++ mac_hdr_len = (int)((void *)(iph) - mac_hdr);
++
++ lro_desc = lro_get_desc(lro_mgr, lro_mgr->lro_arr, iph, tcph);
++ if (!lro_desc)
++ goto out1;
++
++ pad_bytes = len - (ntohs(iph->tot_len) + mac_hdr_len);
++ if (!TCP_PAYLOAD_LENGTH(iph, tcph) && pad_bytes) {
++ len -= pad_bytes; /* trim the packet */
++ frags[0].size -= pad_bytes;
++ true_size -= pad_bytes;
++ }
++
++ if (!lro_desc->active) { /* start new lro session */
++ if (lro_tcp_ip_check(iph, tcph, len - mac_hdr_len, NULL))
++ goto out1;
++
++ skb = lro_gen_skb(lro_mgr, frags, len, true_size, mac_hdr,
++ hdr_len, 0, lro_mgr->ip_summed_aggr);
++ if (!skb)
++ goto out;
++
++ if ((skb->protocol == htons(ETH_P_8021Q))
++ && !test_bit(LRO_F_EXTRACT_VLAN_ID, &lro_mgr->features))
++ vlan_hdr_len = VLAN_HLEN;
++
++ iph = (void *)(skb->data + vlan_hdr_len);
++ tcph = (void *)((u8 *)skb->data + vlan_hdr_len
++ + IP_HDR_LEN(iph));
++
++ lro_init_desc(lro_desc, skb, iph, tcph, vlan_tag, vgrp);
++ LRO_INC_STATS(lro_mgr, aggregated);
++ return 0;
++ }
++
++ if (lro_desc->tcp_next_seq != ntohl(tcph->seq))
++ goto out2;
++
++ if (lro_tcp_ip_check(iph, tcph, len - mac_hdr_len, lro_desc))
++ goto out2;
++
++ lro_add_frags(lro_desc, len, hdr_len, true_size, frags, iph, tcph);
++ LRO_INC_STATS(lro_mgr, aggregated);
++
++ if ((skb_shinfo(lro_desc->parent)->nr_frags >= lro_mgr->max_aggr) ||
++ lro_desc->parent->len > (0xFFFF - lro_mgr->dev->mtu))
++ lro_flush(lro_mgr, lro_desc);
++
++ return NULL;
++
++out2: /* send aggregated packets to the stack */
++ lro_flush(lro_mgr, lro_desc);
++
++out1: /* Original packet has to be posted to the stack */
++ skb = lro_gen_skb(lro_mgr, frags, len, true_size, mac_hdr,
++ hdr_len, sum, lro_mgr->ip_summed);
++out:
++ return skb;
++}
++
++void lro_receive_frags_compat(struct net_lro_mgr *lro_mgr,
++ struct skb_frag_struct *frags,
++ int len, int true_size, void *priv, __wsum sum)
++{
++ struct sk_buff *skb;
++
++ skb = __lro_proc_segment(lro_mgr, frags, len, true_size, NULL, 0,
++ priv, sum);
++ if (!skb)
++ return;
++
++ if (test_bit(LRO_F_NAPI, &lro_mgr->features))
++ netif_receive_skb(skb);
++ else
++ netif_rx(skb);
++}
++
++void lro_vlan_hwaccel_receive_frags_compat(struct net_lro_mgr *lro_mgr,
++ struct skb_frag_struct *frags,
++ int len, int true_size,
++ struct vlan_group *vgrp,
++ u16 vlan_tag, void *priv, __wsum sum)
++{
++ struct sk_buff *skb;
++
++ skb = __lro_proc_segment(lro_mgr, frags, len, true_size, vgrp,
++ vlan_tag, priv, sum);
++ if (!skb)
++ return;
++
++ if (test_bit(LRO_F_NAPI, &lro_mgr->features))
++ vlan_hwaccel_receive_skb(skb, vgrp, vlan_tag);
++ else
++ vlan_hwaccel_rx(skb, vgrp, vlan_tag);
++}
++
++void lro_flush_all_compat(struct net_lro_mgr *lro_mgr)
++{
++ int i;
++ struct net_lro_desc *lro_desc = lro_mgr->lro_arr;
++
++ for (i = 0; i < lro_mgr->max_desc; i++) {
++ if (lro_desc[i].active)
++ lro_flush(lro_mgr, &lro_desc[i]);
++ }
++}
++#endif /* INET_LRO backport */
++
++#ifndef TX_MQ
++struct net_device *alloc_etherdev_mq_compat(int sizeof_priv,
++ unsigned int queue_count)
++{
++ return alloc_etherdev(sizeof_priv);
++}
++
++void netif_wake_subqueue_compat(struct net_device *dev, u16 queue_index)
++{
++ netif_wake_queue(dev);
++}
++
++void netif_stop_subqueue_compat(struct net_device *dev, u16 queue_index)
++{
++ netif_stop_queue(dev);
++}
++
++int __netif_subqueue_stopped_compat(const struct net_device *dev,
++ u16 queue_index)
++{
++ return netif_queue_stopped(dev);
++}
++
++u16 skb_get_queue_mapping_compat(const struct sk_buff *skb)
++{
++ return 0;
++}
++
++void netif_set_real_num_tx_queues_compat(struct net_device *dev,
++ unsigned int txq)
++{
++ return;
++}
++
++u16 skb_tx_hash_compat(const struct net_device *dev,
++ const struct sk_buff *skb)
++{
++ return 0;
++}
++#endif
+diff --git a/drivers/net/benet/be_compat.h b/drivers/net/benet/be_compat.h
+new file mode 100644
+index 0000000..8ceecc8
+--- /dev/null
++++ b/drivers/net/benet/be_compat.h
+@@ -0,0 +1,621 @@
++/*
++ * Copyright (C) 2005 - 2011 Emulex
++ * All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License version 2
++ * as published by the Free Software Foundation. The full GNU General
++ * Public License is included in this distribution in the file called COPYING.
++ *
++ * Contact Information:
++ * linux-drivers@emulex.com
++ *
++ * Emulex
++ * 3333 Susan Street
++ * Costa Mesa, CA 92626
++ */
++
++#ifndef BE_COMPAT_H
++#define BE_COMPAT_H
++
++/****************** RHEL5 and SLES10 backport ***************************/
++#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 18)
++
++#ifndef upper_32_bits
++#define upper_32_bits(n) ((u32)(((n) >> 16) >> 16))
++#endif
++
++#ifndef CHECKSUM_PARTIAL
++#define CHECKSUM_PARTIAL CHECKSUM_HW
++#define CHECKSUM_COMPLETE CHECKSUM_HW
++#endif
++
++#if !defined(ip_hdr)
++#define ip_hdr(skb) (skb->nh.iph)
++#define ipv6_hdr(skb) (skb->nh.ipv6h)
++#endif
++
++#if !defined(__packed)
++#define __packed __attribute__ ((packed))
++#endif
++
++#if !defined(RHEL_MINOR)
++/* Only for RH5U1 (Maui) and SLES10 NIC driver */
++enum {
++ false = 0,
++ true = 1
++};
++#if LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 18)
++/* Only for RH5U1 (Maui) NIC driver */
++static inline __attribute__((const))
++int __ilog2_u32(u32 n)
++{
++ return fls(n) - 1;
++}
++#endif
++#endif
++
++#define ETH_FCS_LEN 4
++#define bool u8
++#ifndef PTR_ALIGN
++#define PTR_ALIGN(p, a) ((typeof(p)) \
++ ALIGN((unsigned long)(p), (a)))
++#endif
++#define list_first_entry(ptr, type, member) \
++ list_entry((ptr)->next, type, member)
++
++#if (defined(RHEL_MINOR) && RHEL_MINOR < 6) || \
++ LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 16)
++#define DEFINE_PCI_DEVICE_TABLE(_table) struct pci_device_id _table[] \
++ __devinitdata
++#endif
++
++/* Backport of request_irq */
++typedef irqreturn_t(*backport_irq_handler_t) (int, void *);
++static inline int
++backport_request_irq(unsigned int irq, irqreturn_t(*handler) (int, void *),
++ unsigned long flags, const char *dev_name, void *dev_id)
++{
++ return request_irq(irq,
++ (irqreturn_t(*) (int, void *, struct pt_regs *))handler,
++ flags, dev_name, dev_id);
++}
++#define request_irq backport_request_irq
++
++#endif /*** RHEL5 and SLES10 backport ***/
++
++#if !defined(__packed)
++#define __packed __attribute__ ((packed))
++#endif
++
++/****************** SLES10 only backport ***************************/
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 18)
++
++#include <linux/tifm.h>
++
++#define FIELD_SIZEOF(t, f) (sizeof(((t *)0)->f))
++#define IRQF_SHARED SA_SHIRQ
++#define CHECKSUM_PARTIAL CHECKSUM_HW
++#define CHECKSUM_COMPLETE CHECKSUM_HW
++#define DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d))
++#define NETIF_F_IPV6_CSUM NETIF_F_IP_CSUM
++#define NETIF_F_TSO6 NETIF_F_TSO
++
++
++static inline struct sk_buff *netdev_alloc_skb(struct net_device *dev,
++ unsigned int length)
++{
++ /* 16 == NET_PAD_SKB */
++ struct sk_buff *skb;
++ skb = alloc_skb(length + 16, GFP_ATOMIC);
++ if (likely(skb != NULL)) {
++ skb_reserve(skb, 16);
++ skb->dev = dev;
++ }
++ return skb;
++}
++
++#define PCI_SAVE_STATE(x)
++
++#else /* SLES10 only backport */
++
++#define PCI_SAVE_STATE(x) pci_save_state(x)
++
++#endif /* SLES10 only backport */
++
++#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 31)
++#define netdev_tx_t int
++#endif
++
++#ifndef VLAN_PRIO_MASK
++#define VLAN_PRIO_MASK 0xe000 /* Priority Code Point */
++#define VLAN_PRIO_SHIFT 13
++#endif
++
++/*
++ * Backport of netdev ops struct
++ */
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 28)
++struct net_device_ops {
++ int (*ndo_init)(struct net_device *dev);
++ void (*ndo_uninit)(struct net_device *dev);
++ int (*ndo_open)(struct net_device *dev);
++ int (*ndo_stop)(struct net_device *dev);
++ int (*ndo_start_xmit) (struct sk_buff *skb, struct net_device *dev);
++ u16 (*ndo_select_queue)(struct net_device *dev,
++ struct sk_buff *skb);
++ void (*ndo_change_rx_flags)(struct net_device *dev, int flags);
++ void (*ndo_set_rx_mode)(struct net_device *dev);
++ void (*ndo_set_multicast_list)(struct net_device *dev);
++ int (*ndo_set_mac_address)(struct net_device *dev, void *addr);
++ int (*ndo_validate_addr)(struct net_device *dev);
++ int (*ndo_do_ioctl)(struct net_device *dev,
++ struct ifreq *ifr, int cmd);
++ int (*ndo_set_config)(struct net_device *dev, struct ifmap *map);
++ int (*ndo_change_mtu)(struct net_device *dev, int new_mtu);
++ int (*ndo_neigh_setup)(struct net_device *dev,
++ struct neigh_parms *);
++ void (*ndo_tx_timeout) (struct net_device *dev);
++
++ struct net_device_stats* (*ndo_get_stats)(struct net_device *dev);
++
++ void (*ndo_vlan_rx_register)(struct net_device *dev,
++ struct vlan_group *grp);
++ void (*ndo_vlan_rx_add_vid)(struct net_device *dev,
++ unsigned short vid);
++ void (*ndo_vlan_rx_kill_vid)(struct net_device *dev,
++ unsigned short vid);
++#ifdef CONFIG_NET_POLL_CONTROLLER
++#define HAVE_NETDEV_POLL
++ void (*ndo_poll_controller)(struct net_device *dev);
++#endif
++};
++extern void be_netdev_ops_init(struct net_device *netdev,
++ struct net_device_ops *ops);
++extern int eth_validate_addr(struct net_device *);
++
++#endif /* Netdev ops backport */
++
++#if LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 29)
++#undef NETIF_F_GRO
++#endif
++
++#ifdef NO_GRO
++#if ((defined(RHEL_MAJOR) && (RHEL_MAJOR == 5)))
++#undef NETIF_F_GRO
++#endif
++#endif
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 32)
++#define HAVE_ETHTOOL_FLASH
++#endif
++
++/*
++ * Backport of NAPI
++ */
++#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 24)
++
++#if defined(RHEL_MINOR) && (RHEL_MINOR > 3)
++#define RHEL_NEW_NAPI
++#endif
++
++/* We need a new struct that has some meta data beyond rhel 5.4's napi_struct
++ * to fix rhel5.4's half-baked new napi implementation.
++ * We don't want to use rhel 5.4's broken napi_complete; so
++ * define a new be_napi_complete that executes the logic only for Rx
++ */
++
++#ifdef RHEL_NEW_NAPI
++#define napi_complete be_napi_complete
++typedef struct napi_struct rhel_napi_struct;
++#endif
++#define napi_struct be_napi_struct
++#define napi_gro_frags(napi) napi_gro_frags((rhel_napi_struct *) napi)
++#define vlan_gro_frags(napi, vlan_grp, vid)\
++ vlan_gro_frags((rhel_napi_struct *) napi, vlan_grp, vid)
++#define napi_get_frags(napi) napi_get_frags((rhel_napi_struct *) napi)
++
++struct napi_struct {
++#ifdef RHEL_NEW_NAPI
++ rhel_napi_struct napi; /* must be the first member */
++#endif
++ struct net_device *dev;
++ int (*poll) (struct napi_struct *napi, int budget);
++ bool rx;
++};
++
++static inline void napi_complete(struct napi_struct *napi)
++{
++#ifdef NETIF_F_GRO
++ napi_gro_flush((rhel_napi_struct *)napi);
++#endif
++ netif_rx_complete(napi->dev);
++}
++
++static inline void napi_schedule(struct napi_struct *napi)
++{
++ netif_rx_schedule(napi->dev);
++}
++
++static inline void napi_enable(struct napi_struct *napi)
++{
++ netif_poll_enable(napi->dev);
++}
++
++static inline void napi_disable(struct napi_struct *napi)
++{
++ netif_poll_disable(napi->dev);
++}
++
++#if (defined(RHEL_MINOR) && RHEL_MINOR < 6) || \
++ LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 16)
++static inline void vlan_group_set_device(struct vlan_group *vg,
++ u16 vlan_id,
++ struct net_device *dev)
++{
++ struct net_device **array;
++ if (!vg)
++ return;
++ array = vg->vlan_devices;
++ array[vlan_id] = dev;
++}
++#endif
++
++#endif /* New NAPI backport */
++
++extern int be_netif_napi_add(struct net_device *netdev,
++ struct napi_struct *napi,
++ int (*poll) (struct napi_struct *, int), int weight);
++extern void be_netif_napi_del(struct net_device *netdev);
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 27)
++#define HAVE_SIMULATED_MULTI_NAPI
++#endif
++
++/************** Backport of Delayed work queues interface ****************/
++#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 19)
++#if (defined(RHEL_MINOR) && RHEL_MINOR < 6) || \
++ LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 16)
++struct delayed_work {
++ struct work_struct work;
++};
++#endif
++
++#define INIT_DELAYED_WORK(_work, _func) \
++ INIT_WORK(&(_work)->work, _func, &(_work)->work)
++
++static inline int backport_cancel_delayed_work_sync(struct delayed_work *work)
++{
++ cancel_rearming_delayed_work(&work->work);
++ return 0;
++}
++#define cancel_delayed_work_sync backport_cancel_delayed_work_sync
++
++static inline int backport_schedule_delayed_work(struct delayed_work *work,
++ unsigned long delay)
++{
++ if (unlikely(!delay))
++ return schedule_work(&work->work);
++ else
++ return schedule_delayed_work(&work->work, delay);
++}
++#define schedule_delayed_work backport_schedule_delayed_work
++#endif /* backport delayed workqueue */
++
++
++/************** Backport of INET_LRO **********************************/
++#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 18)
++
++#include <linux/inet_lro.h>
++
++#else
++
++#if LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 18)
++
++#if defined(RHEL_MINOR) && RHEL_MINOR < 6
++typedef __u16 __bitwise __sum16;
++typedef __u32 __bitwise __wsum;
++#endif
++
++#if ((defined(RHEL_MAJOR) && (RHEL_MAJOR == 5) && (RHEL_MINOR <= 3)) || \
++ (!defined(RHEL_MINOR)))
++static inline __wsum csum_unfold(__sum16 n)
++{
++ return (__force __wsum)n;
++}
++#endif
++
++#endif
++
++#define lro_flush_all lro_flush_all_compat
++#define lro_vlan_hwaccel_receive_frags lro_vlan_hwaccel_receive_frags_compat
++#define lro_receive_frags lro_receive_frags_compat
++
++struct net_lro_stats {
++ unsigned long aggregated;
++ unsigned long flushed;
++ unsigned long no_desc;
++};
++
++struct net_lro_desc {
++ struct sk_buff *parent;
++ struct sk_buff *last_skb;
++ struct skb_frag_struct *next_frag;
++ struct iphdr *iph;
++ struct tcphdr *tcph;
++ struct vlan_group *vgrp;
++ __wsum data_csum;
++ u32 tcp_rcv_tsecr;
++ u32 tcp_rcv_tsval;
++ u32 tcp_ack;
++ u32 tcp_next_seq;
++ u32 skb_tot_frags_len;
++ u32 ack_cnt;
++ u16 ip_tot_len;
++ u16 tcp_saw_tstamp; /* timestamps enabled */
++ u16 tcp_window;
++ u16 vlan_tag;
++ int pkt_aggr_cnt; /* counts aggregated packets */
++ int vlan_packet;
++ int mss;
++ int active;
++};
++
++struct net_lro_mgr {
++ struct net_device *dev;
++ struct net_lro_stats stats;
++
++ /* LRO features */
++ unsigned long features;
++#define LRO_F_NAPI 1 /* Pass packets to stack via NAPI */
++#define LRO_F_EXTRACT_VLAN_ID 2 /* Set flag if VLAN IDs are extracted
++ from received packets and eth protocol
++ is still ETH_P_8021Q */
++
++ u32 ip_summed; /* Set in non generated SKBs in page mode */
++ u32 ip_summed_aggr; /* Set in aggregated SKBs: CHECKSUM_UNNECESSARY
++ * or CHECKSUM_NONE */
++
++ int max_desc; /* Max number of LRO descriptors */
++ int max_aggr; /* Max number of LRO packets to be aggregated */
++
++ struct net_lro_desc *lro_arr; /* Array of LRO descriptors */
++
++ /* Optimized driver functions
++ * get_skb_header: returns tcp and ip header for packet in SKB
++ */
++ int (*get_skb_header)(struct sk_buff *skb, void **ip_hdr,
++ void **tcpudp_hdr, u64 *hdr_flags, void *priv);
++
++ /* hdr_flags: */
++#define LRO_IPV4 1 /* ip_hdr is IPv4 header */
++#define LRO_TCP 2 /* tcpudp_hdr is TCP header */
++
++ /*
++ * get_frag_header: returns mac, tcp and ip header for packet in SKB
++ *
++ * @hdr_flags: Indicate what kind of LRO has to be done
++ * (IPv4/IPv6/TCP/UDP)
++ */
++ int (*get_frag_header)(struct skb_frag_struct *frag, void **mac_hdr,
++ void **ip_hdr, void **tcpudp_hdr, u64 *hdr_flags,
++ void *priv);
++};
++
++extern void lro_receive_skb(struct net_lro_mgr *lro_mgr, struct sk_buff *skb,
++ void *priv);
++
++extern void lro_vlan_hwaccel_receive_skb(struct net_lro_mgr *lro_mgr,
++ struct sk_buff *skb, struct vlan_group *vgrp,
++ u16 vlan_tag, void *priv);
++
++/* This functions aggregate fragments and generate SKBs do pass
++ * the packets to the stack.
++ *
++ * @lro_mgr: LRO manager to use
++ * @frags: Fragment to be processed. Must contain entire header in first
++ * element.
++ * @len: Length of received data
++ * @true_size: Actual size of memory the fragment is consuming
++ * @priv: Private data that may be used by driver functions
++ * (for example get_tcp_ip_hdr)
++ */
++extern void lro_receive_frags_compat(struct net_lro_mgr *lro_mgr,
++ struct skb_frag_struct *frags, int len, int true_size,
++ void *priv, __wsum sum);
++
++extern void lro_vlan_hwaccel_receive_frags_compat(struct net_lro_mgr *lro_mgr,
++ struct skb_frag_struct *frags, int len, int true_size,
++ struct vlan_group *vgrp, u16 vlan_tag, void *priv,
++ __wsum sum);
++
++/* Forward all aggregated SKBs held by lro_mgr to network stack */
++extern void lro_flush_all_compat(struct net_lro_mgr *lro_mgr);
++
++extern void lro_flush_pkt(struct net_lro_mgr *lro_mgr, struct iphdr *iph,
++ struct tcphdr *tcph);
++#endif /* backport of inet_lro */
++
++#ifndef ETHTOOL_FLASH_MAX_FILENAME
++#define ETHTOOL_FLASH_MAX_FILENAME 128
++#endif
++
++#if defined(CONFIG_XEN) && !defined(NETIF_F_GRO)
++#define BE_INIT_FRAGS_PER_FRAME (u32) 1
++#else
++#define BE_INIT_FRAGS_PER_FRAME (min((u32) 16, (u32) MAX_SKB_FRAGS))
++#endif
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 32)
++#ifdef CONFIG_PCI_IOV
++#if (!(defined(RHEL_MAJOR) && (RHEL_MAJOR == 5) && (RHEL_MINOR == 6)))
++#undef CONFIG_PCI_IOV
++#endif
++#endif
++#endif
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 20)
++#define dev_to_node(dev) -1
++#endif
++
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 32)
++#if (!(defined(RHEL_MAJOR) && (RHEL_MAJOR == 5) && (RHEL_MINOR > 6)))
++static inline struct sk_buff *netdev_alloc_skb_ip_align(struct net_device *dev,
++ unsigned int length)
++{
++ struct sk_buff *skb = netdev_alloc_skb(dev, length + NET_IP_ALIGN);
++
++ if (NET_IP_ALIGN && skb)
++ skb_reserve(skb, NET_IP_ALIGN);
++ return skb;
++}
++#endif
++#endif
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 26)
++#ifndef netif_set_gso_max_size
++#define netif_set_gso_max_size(netdev, size) do {} while (0)
++#endif
++#endif
++
++#if (LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 18))
++#if defined(RHEL_MINOR) && (RHEL_MINOR <= 4)
++static inline int skb_is_gso_v6(const struct sk_buff *skb)
++{
++ return skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6;
++}
++#endif
++#endif
++
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 18))
++static inline int skb_is_gso_v6(const struct sk_buff *skb)
++{
++ return (ip_hdr(skb)->version == 6);
++}
++#endif
++
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 18))
++#define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
++#endif
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 32)
++#if ((defined(RHEL_MAJOR) && (RHEL_MAJOR == 6)))
++#define HAVE_SRIOV_CONFIG
++#endif
++#endif
++
++#ifndef NETIF_F_VLAN_SG
++#define NETIF_F_VLAN_SG NETIF_F_SG
++#endif
++
++#ifndef NETIF_F_VLAN_CSUM
++#define NETIF_F_VLAN_CSUM NETIF_F_HW_CSUM
++#endif
++
++#ifndef NETIF_F_VLAN_TSO
++#define NETIF_F_VLAN_TSO NETIF_F_TSO
++#endif
++
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 27))
++#define vlan_features features
++#endif
++
++#ifndef DEFINE_DMA_UNMAP_ADDR
++#define DEFINE_DMA_UNMAP_ADDR(bus) dma_addr_t bus
++#endif
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 0, 0)
++
++#ifndef netdev_mc_count
++#define netdev_mc_count(nd) (nd->mc_count)
++#endif
++
++#ifndef netdev_hw_addr
++#define netdev_hw_addr dev_mc_list
++#endif
++
++#ifndef netdev_for_each_mc_addr
++#define netdev_for_each_mc_addr(ha, nd) \
++ for (ha = (nd)->mc_list; ha; ha = ha->next)
++#endif
++
++#define DMI_ADDR dmi_addr
++#else
++#define DMI_ADDR addr
++#endif
++
++#ifndef VLAN_GROUP_ARRAY_LEN
++#define VLAN_GROUP_ARRAY_LEN VLAN_N_VID
++#endif
++/**************************** Multi TXQ Support ******************************/
++
++/* Supported only in RHEL6 and SL11.1 (barring one execption) */
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 32)
++#define MQ_TX
++#endif
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 27)
++#define alloc_etherdev_mq(sz, cnt) alloc_etherdev(sz)
++#define skb_get_queue_mapping(skb) 0
++#define skb_tx_hash(dev, skb) 0
++#define netif_set_real_num_tx_queues(dev, txq) do {} while(0)
++#define netif_wake_subqueue(dev, idx) netif_wake_queue(dev)
++#define netif_stop_subqueue(dev, idx) netif_stop_queue(dev)
++#define __netif_subqueue_stopped(dev, idx) netif_queue_stopped(dev)
++#endif /* < 2.6.27 */
++
++#if ((LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && \
++ (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 32)))
++#define skb_tx_hash(dev, skb) 0
++#define netif_set_real_num_tx_queues(dev, txq) do {} while(0)
++#endif
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 32)
++#define netif_set_real_num_tx_queues be_set_real_num_tx_queues
++static inline void be_set_real_num_tx_queues(struct net_device *dev,
++ unsigned int txq)
++{
++ dev->real_num_tx_queues = txq;
++}
++#endif
++
++#include <linux/if_vlan.h>
++static inline void be_reset_skb_tx_vlan(struct sk_buff *skb)
++{
++#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 18)
++ skb->vlan_tci = 0;
++#else
++ struct vlan_skb_tx_cookie *cookie;
++
++ cookie = VLAN_TX_SKB_CB(skb);
++ cookie->magic = 0;
++#endif
++}
++
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 18))
++static inline void skb_set_network_header(struct sk_buff *skb, const int offset)
++{
++ skb->nh.raw = skb->data + offset;
++}
++#endif
++
++static inline struct sk_buff *be_vlan_put_tag(struct sk_buff *skb,
++ unsigned short vlan_tag)
++{
++ struct sk_buff *new_skb = __vlan_put_tag(skb, vlan_tag);
++ /* On kernel versions < 2.6.27 the __vlan_put_tag() function
++ * distorts the network layer hdr pointer in the skb which
++ * affects the detection of UDP/TCP packets down the line in
++ * wrb_fill_hdr().This work-around sets it right.
++ */
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 27))
++ skb_set_network_header(new_skb, VLAN_ETH_HLEN);
++#endif
++ return new_skb;
++}
++
++#ifndef ACCESS_ONCE
++#define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x))
++#endif
++
++#endif /* BE_COMPAT_H */
+diff --git a/drivers/net/benet/be_ethtool.c b/drivers/net/benet/be_ethtool.c
+index f0fd95b..37bad99 100644
+--- a/drivers/net/benet/be_ethtool.c
++++ b/drivers/net/benet/be_ethtool.c
+@@ -1,18 +1,18 @@
+ /*
+- * Copyright (C) 2005 - 2009 ServerEngines
++ * Copyright (C) 2005 - 2011 Emulex
+ * All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License version 2
+- * as published by the Free Software Foundation. The full GNU General
++ * as published by the Free Software Foundation. The full GNU General
+ * Public License is included in this distribution in the file called COPYING.
+ *
+ * Contact Information:
+- * linux-drivers@serverengines.com
++ * linux-drivers@emulex.com
+ *
+- * ServerEngines
+- * 209 N. Fair Oaks Ave
+- * Sunnyvale, CA 94085
++ * Emulex
++ * 3333 Susan Street
++ * Costa Mesa, CA 92626
+ */
+
+ #include "be.h"
+@@ -26,21 +26,19 @@ struct be_ethtool_stat {
+ int offset;
+ };
+
+-enum {NETSTAT, PORTSTAT, MISCSTAT, DRVSTAT, ERXSTAT};
++enum {NETSTAT, DRVSTAT_TX, DRVSTAT_RX, DRVSTAT};
+ #define FIELDINFO(_struct, field) FIELD_SIZEOF(_struct, field), \
+ offsetof(_struct, field)
+-#define NETSTAT_INFO(field) #field, NETSTAT,\
++#define NETSTAT_INFO(field) #field, NETSTAT,\
+ FIELDINFO(struct net_device_stats,\
+ field)
+-#define DRVSTAT_INFO(field) #field, DRVSTAT,\
+- FIELDINFO(struct be_drvr_stats, field)
+-#define MISCSTAT_INFO(field) #field, MISCSTAT,\
+- FIELDINFO(struct be_rxf_stats, field)
+-#define PORTSTAT_INFO(field) #field, PORTSTAT,\
+- FIELDINFO(struct be_port_rxf_stats, \
++#define DRVSTAT_TX_INFO(field) #field, DRVSTAT_TX,\
++ FIELDINFO(struct be_tx_stats, field)
++#define DRVSTAT_RX_INFO(field) #field, DRVSTAT_RX,\
++ FIELDINFO(struct be_rx_stats, field)
++#define DRVSTAT_INFO(field) #field, DRVSTAT,\
++ FIELDINFO(struct be_drv_stats, \
+ field)
+-#define ERXSTAT_INFO(field) #field, ERXSTAT,\
+- FIELDINFO(struct be_erx_stats, field)
+
+ static const struct be_ethtool_stat et_stats[] = {
+ {NETSTAT_INFO(rx_packets)},
+@@ -51,70 +49,131 @@ static const struct be_ethtool_stat et_stats[] = {
+ {NETSTAT_INFO(tx_errors)},
+ {NETSTAT_INFO(rx_dropped)},
+ {NETSTAT_INFO(tx_dropped)},
+- {DRVSTAT_INFO(be_tx_reqs)},
+- {DRVSTAT_INFO(be_tx_stops)},
+- {DRVSTAT_INFO(be_fwd_reqs)},
+- {DRVSTAT_INFO(be_tx_wrbs)},
+- {DRVSTAT_INFO(be_polls)},
+ {DRVSTAT_INFO(be_tx_events)},
+- {DRVSTAT_INFO(be_rx_events)},
+- {DRVSTAT_INFO(be_tx_compl)},
+- {DRVSTAT_INFO(be_rx_compl)},
+- {DRVSTAT_INFO(be_ethrx_post_fail)},
+- {DRVSTAT_INFO(be_802_3_dropped_frames)},
+- {DRVSTAT_INFO(be_802_3_malformed_frames)},
+- {DRVSTAT_INFO(be_tx_rate)},
+- {DRVSTAT_INFO(be_rx_rate)},
+- {PORTSTAT_INFO(rx_unicast_frames)},
+- {PORTSTAT_INFO(rx_multicast_frames)},
+- {PORTSTAT_INFO(rx_broadcast_frames)},
+- {PORTSTAT_INFO(rx_crc_errors)},
+- {PORTSTAT_INFO(rx_alignment_symbol_errors)},
+- {PORTSTAT_INFO(rx_pause_frames)},
+- {PORTSTAT_INFO(rx_control_frames)},
+- {PORTSTAT_INFO(rx_in_range_errors)},
+- {PORTSTAT_INFO(rx_out_range_errors)},
+- {PORTSTAT_INFO(rx_frame_too_long)},
+- {PORTSTAT_INFO(rx_address_match_errors)},
+- {PORTSTAT_INFO(rx_vlan_mismatch)},
+- {PORTSTAT_INFO(rx_dropped_too_small)},
+- {PORTSTAT_INFO(rx_dropped_too_short)},
+- {PORTSTAT_INFO(rx_dropped_header_too_small)},
+- {PORTSTAT_INFO(rx_dropped_tcp_length)},
+- {PORTSTAT_INFO(rx_dropped_runt)},
+- {PORTSTAT_INFO(rx_fifo_overflow)},
+- {PORTSTAT_INFO(rx_input_fifo_overflow)},
+- {PORTSTAT_INFO(rx_ip_checksum_errs)},
+- {PORTSTAT_INFO(rx_tcp_checksum_errs)},
+- {PORTSTAT_INFO(rx_udp_checksum_errs)},
+- {PORTSTAT_INFO(rx_non_rss_packets)},
+- {PORTSTAT_INFO(rx_ipv4_packets)},
+- {PORTSTAT_INFO(rx_ipv6_packets)},
+- {PORTSTAT_INFO(tx_unicastframes)},
+- {PORTSTAT_INFO(tx_multicastframes)},
+- {PORTSTAT_INFO(tx_broadcastframes)},
+- {PORTSTAT_INFO(tx_pauseframes)},
+- {PORTSTAT_INFO(tx_controlframes)},
+- {MISCSTAT_INFO(rx_drops_no_pbuf)},
+- {MISCSTAT_INFO(rx_drops_no_txpb)},
+- {MISCSTAT_INFO(rx_drops_no_erx_descr)},
+- {MISCSTAT_INFO(rx_drops_no_tpre_descr)},
+- {MISCSTAT_INFO(rx_drops_too_many_frags)},
+- {MISCSTAT_INFO(rx_drops_invalid_ring)},
+- {MISCSTAT_INFO(forwarded_packets)},
+- {MISCSTAT_INFO(rx_drops_mtu)},
+- {ERXSTAT_INFO(rx_drops_no_fragments)},
++ {DRVSTAT_INFO(rx_crc_errors)},
++ {DRVSTAT_INFO(rx_alignment_symbol_errors)},
++ {DRVSTAT_INFO(rx_pause_frames)},
++ {DRVSTAT_INFO(rx_control_frames)},
++ {DRVSTAT_INFO(rx_in_range_errors)},
++ {DRVSTAT_INFO(rx_out_range_errors)},
++ {DRVSTAT_INFO(rx_frame_too_long)},
++ {DRVSTAT_INFO(rx_address_match_errors)},
++ {DRVSTAT_INFO(rx_dropped_too_small)},
++ {DRVSTAT_INFO(rx_dropped_too_short)},
++ {DRVSTAT_INFO(rx_dropped_header_too_small)},
++ {DRVSTAT_INFO(rx_dropped_tcp_length)},
++ {DRVSTAT_INFO(rx_dropped_runt)},
++ {DRVSTAT_INFO(rxpp_fifo_overflow_drop)},
++ {DRVSTAT_INFO(rx_input_fifo_overflow_drop)},
++ {DRVSTAT_INFO(rx_ip_checksum_errs)},
++ {DRVSTAT_INFO(rx_tcp_checksum_errs)},
++ {DRVSTAT_INFO(rx_udp_checksum_errs)},
++ {DRVSTAT_INFO(rx_switched_unicast_packets)},
++ {DRVSTAT_INFO(rx_switched_multicast_packets)},
++ {DRVSTAT_INFO(rx_switched_broadcast_packets)},
++ {DRVSTAT_INFO(tx_pauseframes)},
++ {DRVSTAT_INFO(tx_controlframes)},
++ {DRVSTAT_INFO(rx_priority_pause_frames)},
++ {DRVSTAT_INFO(pmem_fifo_overflow_drop)},
++ {DRVSTAT_INFO(jabber_events)},
++ {DRVSTAT_INFO(rx_drops_no_pbuf)},
++ {DRVSTAT_INFO(rx_drops_no_txpb)},
++ {DRVSTAT_INFO(rx_drops_no_erx_descr)},
++ {DRVSTAT_INFO(rx_drops_no_tpre_descr)},
++ {DRVSTAT_INFO(rx_drops_too_many_frags)},
++ {DRVSTAT_INFO(rx_drops_invalid_ring)},
++ {DRVSTAT_INFO(forwarded_packets)},
++ {DRVSTAT_INFO(rx_drops_mtu)},
++ {DRVSTAT_INFO(eth_red_drops)},
++ {DRVSTAT_INFO(be_on_die_temperature)}
+ };
+ #define ETHTOOL_STATS_NUM ARRAY_SIZE(et_stats)
+
++/* Stats related to multi RX queues */
++static const struct be_ethtool_stat et_rx_stats[] = {
++ {DRVSTAT_RX_INFO(rx_bytes)},
++ {DRVSTAT_RX_INFO(rx_pkts)},
++ {DRVSTAT_RX_INFO(rx_rate)},
++ {DRVSTAT_RX_INFO(rx_polls)},
++ {DRVSTAT_RX_INFO(rx_events)},
++ {DRVSTAT_RX_INFO(rx_compl)},
++ {DRVSTAT_RX_INFO(rx_mcast_pkts)},
++ {DRVSTAT_RX_INFO(rx_post_fail)},
++ {DRVSTAT_RX_INFO(rx_drops_no_frags)}
++};
++#define ETHTOOL_RXSTATS_NUM (ARRAY_SIZE(et_rx_stats))
++
++/* Stats related to multi TX queues */
++static const struct be_ethtool_stat et_tx_stats[] = {
++ {DRVSTAT_TX_INFO(be_tx_rate)},
++ {DRVSTAT_TX_INFO(be_tx_reqs)},
++ {DRVSTAT_TX_INFO(be_tx_wrbs)},
++ {DRVSTAT_TX_INFO(be_tx_stops)},
++ {DRVSTAT_TX_INFO(be_tx_compl)},
++ {DRVSTAT_TX_INFO(be_ipv6_ext_hdr_tx_drop)}
++};
++#define ETHTOOL_TXSTATS_NUM (ARRAY_SIZE(et_tx_stats))
++
++static const char et_self_tests[][ETH_GSTRING_LEN] = {
++ "MAC Loopback test",
++ "PHY Loopback test",
++ "External Loopback test",
++ "DDR DMA test",
++ "Link test"
++};
++
++#define ETHTOOL_TESTS_NUM ARRAY_SIZE(et_self_tests)
++#define BE_MAC_LOOPBACK 0x0
++#define BE_PHY_LOOPBACK 0x1
++#define BE_ONE_PORT_EXT_LOOPBACK 0x2
++#define BE_NO_LOOPBACK 0xff
++
++/* MAC speed valid values */
++#define SPEED_DEFAULT 0x0
++#define SPEED_FORCED_10GB 0x1
++#define SPEED_FORCED_1GB 0x2
++#define SPEED_AUTONEG_10GB 0x3
++#define SPEED_AUTONEG_1GB 0x4
++#define SPEED_AUTONEG_100MB 0x5
++#define SPEED_AUTONEG_10GB_1GB 0x6
++#define SPEED_AUTONEG_10GB_1GB_100MB 0x7
++#define SPEED_AUTONEG_1GB_100MB 0x8
++#define SPEED_AUTONEG_10MB 0x9
++#define SPEED_AUTONEG_1GB_100MB_10MB 0xa
++#define SPEED_AUTONEG_100MB_10MB 0xb
++#define SPEED_FORCED_100MB 0xc
++#define SPEED_FORCED_10MB 0xd
++
++
++
+ static void
+ be_get_drvinfo(struct net_device *netdev, struct ethtool_drvinfo *drvinfo)
+ {
+ struct be_adapter *adapter = netdev_priv(netdev);
++ int len;
++ char fw_on_flash[FW_VER_LEN];
++
++ memset(fw_on_flash, 0 , sizeof(fw_on_flash));
++
++ be_cmd_get_fw_ver(adapter, adapter->fw_ver,
++ fw_on_flash);
+
+ strcpy(drvinfo->driver, DRV_NAME);
+ strcpy(drvinfo->version, DRV_VER);
++
+ strncpy(drvinfo->fw_version, adapter->fw_ver, FW_VER_LEN);
++ if (memcmp(adapter->fw_ver, fw_on_flash,
++ FW_VER_LEN) != 0) {
++ len = strlen(drvinfo->fw_version);
++ strncpy(drvinfo->fw_version+len, " [",
++ FW_VER_LEN-len-1);
++ len = strlen(drvinfo->fw_version);
++ strncpy(drvinfo->fw_version+len, fw_on_flash,
++ FW_VER_LEN-len-1);
++ len = strlen(drvinfo->fw_version);
++ strncpy(drvinfo->fw_version+len, "]", FW_VER_LEN-len-1);
++ }
++
+ strcpy(drvinfo->bus_info, pci_name(adapter->pdev));
+ drvinfo->testinfo_len = 0;
+ drvinfo->regdump_len = 0;
+@@ -122,12 +181,37 @@ be_get_drvinfo(struct net_device *netdev, struct ethtool_drvinfo *drvinfo)
+ }
+
+ static int
++be_get_reg_len(struct net_device *netdev)
++{
++ struct be_adapter *adapter = netdev_priv(netdev);
++ u32 log_size = 0;
++
++ if (be_physfn(adapter))
++ be_cmd_get_reg_len(adapter, &log_size);
++
++ return log_size;
++}
++
++static void
++be_get_regs(struct net_device *netdev, struct ethtool_regs *regs, void *buf)
++{
++ struct be_adapter *adapter = netdev_priv(netdev);
++
++ if (be_physfn(adapter)) {
++ memset(buf, 0, regs->len);
++ be_cmd_get_regs(adapter, regs->len, buf);
++ }
++}
++
++static int
+ be_get_coalesce(struct net_device *netdev, struct ethtool_coalesce *coalesce)
+ {
+ struct be_adapter *adapter = netdev_priv(netdev);
+- struct be_eq_obj *rx_eq = &adapter->rx_eq;
++ struct be_eq_obj *rx_eq = &adapter->rx_obj[0].rx_eq;
+ struct be_eq_obj *tx_eq = &adapter->tx_eq;
+
++ coalesce->rx_max_coalesced_frames = adapter->max_rx_coal;
++
+ coalesce->rx_coalesce_usecs = rx_eq->cur_eqd;
+ coalesce->rx_coalesce_usecs_high = rx_eq->max_eqd;
+ coalesce->rx_coalesce_usecs_low = rx_eq->min_eqd;
+@@ -149,25 +233,52 @@ static int
+ be_set_coalesce(struct net_device *netdev, struct ethtool_coalesce *coalesce)
+ {
+ struct be_adapter *adapter = netdev_priv(netdev);
+- struct be_eq_obj *rx_eq = &adapter->rx_eq;
++ struct be_rx_obj *rxo;
++ struct be_eq_obj *rx_eq;
+ struct be_eq_obj *tx_eq = &adapter->tx_eq;
+ u32 tx_max, tx_min, tx_cur;
+ u32 rx_max, rx_min, rx_cur;
+- int status = 0;
++ int status = 0, i;
+
+ if (coalesce->use_adaptive_tx_coalesce == 1)
+ return -EINVAL;
++ adapter->max_rx_coal = coalesce->rx_max_coalesced_frames;
++ if (adapter->max_rx_coal > BE_MAX_FRAGS_PER_FRAME)
++ adapter->max_rx_coal = BE_MAX_FRAGS_PER_FRAME;
+
+- /* if AIC is being turned on now, start with an EQD of 0 */
+- if (rx_eq->enable_aic == 0 &&
+- coalesce->use_adaptive_rx_coalesce == 1) {
+- rx_eq->cur_eqd = 0;
++ for_all_rx_queues(adapter, rxo, i) {
++ rx_eq = &rxo->rx_eq;
++
++ if (!rx_eq->enable_aic && coalesce->use_adaptive_rx_coalesce)
++ rx_eq->cur_eqd = 0;
++ rx_eq->enable_aic = coalesce->use_adaptive_rx_coalesce;
++
++ rx_max = coalesce->rx_coalesce_usecs_high;
++ rx_min = coalesce->rx_coalesce_usecs_low;
++ rx_cur = coalesce->rx_coalesce_usecs;
++
++ if (rx_eq->enable_aic) {
++ if (rx_max > BE_MAX_EQD)
++ rx_max = BE_MAX_EQD;
++ if (rx_min > rx_max)
++ rx_min = rx_max;
++ rx_eq->max_eqd = rx_max;
++ rx_eq->min_eqd = rx_min;
++ if (rx_eq->cur_eqd > rx_max)
++ rx_eq->cur_eqd = rx_max;
++ if (rx_eq->cur_eqd < rx_min)
++ rx_eq->cur_eqd = rx_min;
++ } else {
++ if (rx_cur > BE_MAX_EQD)
++ rx_cur = BE_MAX_EQD;
++ if (rx_eq->cur_eqd != rx_cur) {
++ status = be_cmd_modify_eqd(adapter, rx_eq->q.id,
++ rx_cur);
++ if (!status)
++ rx_eq->cur_eqd = rx_cur;
++ }
++ }
+ }
+- rx_eq->enable_aic = coalesce->use_adaptive_rx_coalesce;
+-
+- rx_max = coalesce->rx_coalesce_usecs_high;
+- rx_min = coalesce->rx_coalesce_usecs_low;
+- rx_cur = coalesce->rx_coalesce_usecs;
+
+ tx_max = coalesce->tx_coalesce_usecs_high;
+ tx_min = coalesce->tx_coalesce_usecs_low;
+@@ -181,27 +292,6 @@ be_set_coalesce(struct net_device *netdev, struct ethtool_coalesce *coalesce)
+ tx_eq->cur_eqd = tx_cur;
+ }
+
+- if (rx_eq->enable_aic) {
+- if (rx_max > BE_MAX_EQD)
+- rx_max = BE_MAX_EQD;
+- if (rx_min > rx_max)
+- rx_min = rx_max;
+- rx_eq->max_eqd = rx_max;
+- rx_eq->min_eqd = rx_min;
+- if (rx_eq->cur_eqd > rx_max)
+- rx_eq->cur_eqd = rx_max;
+- if (rx_eq->cur_eqd < rx_min)
+- rx_eq->cur_eqd = rx_min;
+- } else {
+- if (rx_cur > BE_MAX_EQD)
+- rx_cur = BE_MAX_EQD;
+- if (rx_eq->cur_eqd != rx_cur) {
+- status = be_cmd_modify_eqd(adapter, rx_eq->q.id,
+- rx_cur);
+- if (!status)
+- rx_eq->cur_eqd = rx_cur;
+- }
+- }
+ return 0;
+ }
+
+@@ -229,81 +319,294 @@ be_get_ethtool_stats(struct net_device *netdev,
+ struct ethtool_stats *stats, uint64_t *data)
+ {
+ struct be_adapter *adapter = netdev_priv(netdev);
+- struct be_drvr_stats *drvr_stats = &adapter->stats.drvr_stats;
+- struct be_hw_stats *hw_stats = hw_stats_from_cmd(adapter->stats.cmd.va);
+- struct be_rxf_stats *rxf_stats = &hw_stats->rxf;
+- struct be_port_rxf_stats *port_stats =
+- &rxf_stats->port[adapter->port_num];
+- struct net_device_stats *net_stats = &adapter->stats.net_stats;
+- struct be_erx_stats *erx_stats = &hw_stats->erx;
++ struct be_rx_obj *rxo;
++ struct be_tx_obj *txo;
+ void *p = NULL;
+- int i;
++ int i, j, base;
+
+ for (i = 0; i < ETHTOOL_STATS_NUM; i++) {
+ switch (et_stats[i].type) {
+ case NETSTAT:
+- p = net_stats;
++ p = &adapter->net_stats;
+ break;
+ case DRVSTAT:
+- p = drvr_stats;
+- break;
+- case PORTSTAT:
+- p = port_stats;
+- break;
+- case MISCSTAT:
+- p = rxf_stats;
+- break;
+- case ERXSTAT: /* Currently only one ERX stat is provided */
+- p = (u32 *)erx_stats + adapter->rx_obj.q.id;
++ p = &adapter->drv_stats;
+ break;
+ }
+
+ p = (u8 *)p + et_stats[i].offset;
+ data[i] = (et_stats[i].size == sizeof(u64)) ?
+- *(u64 *)p: *(u32 *)p;
++ *(u64 *)p:(*(u32 *)p);
+ }
+
+- return;
++ base = ETHTOOL_STATS_NUM;
++ for_all_rx_queues(adapter, rxo, j) {
++ for (i = 0; i < ETHTOOL_RXSTATS_NUM; i++) {
++ p = (u8 *)&rxo->stats + et_rx_stats[i].offset;
++ data[base + j * ETHTOOL_RXSTATS_NUM + i] =
++ (et_rx_stats[i].size == sizeof(u64)) ?
++ *(u64 *)p: *(u32 *)p;
++ }
++ }
++
++ base = ETHTOOL_STATS_NUM + adapter->num_rx_qs * ETHTOOL_RXSTATS_NUM;
++ for_all_tx_queues(adapter, txo, j) {
++ for (i = 0; i < ETHTOOL_TXSTATS_NUM; i++) {
++ p = (u8 *)&txo->stats + et_tx_stats[i].offset;
++ data[base + j * ETHTOOL_TXSTATS_NUM + i] =
++ (et_tx_stats[i].size == sizeof(u64)) ?
++ *(u64 *)p: *(u32 *)p;
++ }
++ }
+ }
+
+ static void
+ be_get_stat_strings(struct net_device *netdev, uint32_t stringset,
+ uint8_t *data)
+ {
+- int i;
++ struct be_adapter *adapter = netdev_priv(netdev);
++ int i, j;
++
+ switch (stringset) {
+ case ETH_SS_STATS:
+ for (i = 0; i < ETHTOOL_STATS_NUM; i++) {
+ memcpy(data, et_stats[i].desc, ETH_GSTRING_LEN);
+ data += ETH_GSTRING_LEN;
+ }
++ for (i = 0; i < adapter->num_rx_qs; i++) {
++ for (j = 0; j < ETHTOOL_RXSTATS_NUM; j++) {
++ sprintf(data, "rxq%d: %s", i,
++ et_rx_stats[j].desc);
++ data += ETH_GSTRING_LEN;
++ }
++ }
++ for (i = 0; i < adapter->num_tx_qs; i++) {
++ for (j = 0; j < ETHTOOL_TXSTATS_NUM; j++) {
++ sprintf(data, "txq%d: %s", i,
++ et_tx_stats[j].desc);
++ data += ETH_GSTRING_LEN;
++ }
++ }
++ break;
++ case ETH_SS_TEST:
++ for (i = 0; i < ETHTOOL_TESTS_NUM; i++) {
++ memcpy(data, et_self_tests[i], ETH_GSTRING_LEN);
++ data += ETH_GSTRING_LEN;
++ }
+ break;
+ }
+ }
+
++#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 0, 0)
+ static int be_get_stats_count(struct net_device *netdev)
+ {
+- return ETHTOOL_STATS_NUM;
++ struct be_adapter *adapter = netdev_priv(netdev);
++
++ return ETHTOOL_STATS_NUM + adapter->num_rx_qs * ETHTOOL_RXSTATS_NUM
++ + adapter->num_tx_qs * ETHTOOL_TXSTATS_NUM;
+ }
++static int
++be_self_test_count(struct net_device *dev)
++{
++ return ETHTOOL_TESTS_NUM;
++}
++#else
++
++static int be_get_sset_count(struct net_device *netdev, int stringset)
++{
++ struct be_adapter *adapter = netdev_priv(netdev);
++
++ switch (stringset) {
++ case ETH_SS_TEST:
++ return ETHTOOL_TESTS_NUM;
++ case ETH_SS_STATS:
++ return ETHTOOL_STATS_NUM +
++ adapter->num_rx_qs * ETHTOOL_RXSTATS_NUM +
++ adapter->num_tx_qs * ETHTOOL_TXSTATS_NUM;
++ default:
++ return -EINVAL;
++ }
++}
++#endif
+
+ static int be_get_settings(struct net_device *netdev, struct ethtool_cmd *ecmd)
+ {
+- ecmd->speed = SPEED_10000;
++ struct be_adapter *adapter = netdev_priv(netdev);
++ struct be_phy_info phy_info;
++ u8 mac_speed = 0;
++ u16 link_speed = 0;
++ int link_status = LINK_DOWN;
++ int status;
++
++ if ((adapter->link_speed < 0) || (!(netdev->flags & IFF_UP))) {
++ status = be_cmd_link_status_query(adapter, &link_status,
++ &mac_speed, &link_speed, 0);
++
++ be_link_status_update(adapter, link_status);
++ /* link_speed is in units of 10 Mbps */
++ if (link_speed) {
++ ecmd->speed = link_speed*10;
++ } else {
++ switch (mac_speed) {
++ case PHY_LINK_SPEED_10MBPS:
++ ecmd->speed = SPEED_10;
++ break;
++ case PHY_LINK_SPEED_100MBPS:
++ ecmd->speed = SPEED_100;
++ break;
++ case PHY_LINK_SPEED_1GBPS:
++ ecmd->speed = SPEED_1000;
++ break;
++ case PHY_LINK_SPEED_10GBPS:
++ ecmd->speed = SPEED_10000;
++ break;
++ case PHY_LINK_SPEED_ZERO:
++ ecmd->speed = 0;
++ break;
++ }
++ }
++
++ status = be_cmd_get_phy_info(adapter, &phy_info);
++ if (!status) {
++ switch (phy_info.interface_type) {
++ case PHY_TYPE_XFP_10GB:
++ case PHY_TYPE_SFP_1GB:
++ case PHY_TYPE_SFP_PLUS_10GB:
++ ecmd->port = PORT_FIBRE;
++ break;
++ default:
++ ecmd->port = PORT_TP;
++ break;
++ }
++
++ switch (phy_info.interface_type) {
++ case PHY_TYPE_KR_10GB:
++ case PHY_TYPE_KX4_10GB:
++ ecmd->transceiver = XCVR_INTERNAL;
++ break;
++ default:
++ ecmd->transceiver = XCVR_EXTERNAL;
++ break;
++ }
++
++ if (phy_info.auto_speeds_supported) {
++ ecmd->supported |= SUPPORTED_Autoneg;
++ ecmd->autoneg = AUTONEG_ENABLE;
++ ecmd->advertising |= ADVERTISED_Autoneg;
++ }
++
++ if (phy_info.misc_params & BE_PAUSE_SYM_EN) {
++ ecmd->supported |= SUPPORTED_Pause;
++ ecmd->advertising |= ADVERTISED_Pause;
++ }
++
++ }
++
++ /* Save for future use */
++ adapter->link_speed = ecmd->speed;
++ adapter->port_type = ecmd->port;
++ adapter->transceiver = ecmd->transceiver;
++ adapter->autoneg = ecmd->autoneg;
++ } else {
++ ecmd->speed = adapter->link_speed;
++ ecmd->port = adapter->port_type;
++ ecmd->transceiver = adapter->transceiver;
++ ecmd->autoneg = adapter->autoneg;
++ }
++
+ ecmd->duplex = DUPLEX_FULL;
+- ecmd->autoneg = AUTONEG_DISABLE;
++ ecmd->phy_address = (adapter->hba_port_num << 4) |
++ (adapter->port_name[adapter->hba_port_num]);
++ switch (ecmd->port) {
++ case PORT_FIBRE:
++ ecmd->supported = (SUPPORTED_10000baseT_Full | SUPPORTED_FIBRE);
++ break;
++ case PORT_TP:
++ ecmd->supported = (SUPPORTED_10000baseT_Full | SUPPORTED_TP);
++ break;
++ }
++
++ if (ecmd->autoneg) {
++ ecmd->supported |= SUPPORTED_1000baseT_Full;
++ ecmd->advertising |= (ADVERTISED_10000baseT_Full |
++ ADVERTISED_1000baseT_Full);
++ }
++
+ return 0;
+ }
+
++static int be_set_settings(struct net_device *netdev,
++ struct ethtool_cmd *ecmd)
++{
++ struct be_adapter *adapter = netdev_priv(netdev);
++ struct be_phy_info phy_info;
++ u16 mac_speed=0;
++ u16 dac_cable_len=0;
++ u16 port_speed = 0;
++ int status;
++
++ status = be_cmd_get_phy_info(adapter, &phy_info);
++ if (status) {
++ dev_warn(&adapter->pdev->dev, "port speed set failed.\n");
++ return status;
++ }
++
++ if (ecmd->autoneg == AUTONEG_ENABLE) {
++ switch(phy_info.interface_type) {
++ case PHY_TYPE_SFP_1GB:
++ case PHY_TYPE_BASET_1GB:
++ case PHY_TYPE_BASEX_1GB:
++ case PHY_TYPE_SGMII:
++ mac_speed = SPEED_AUTONEG_1GB_100MB_10MB;
++ break;
++ case PHY_TYPE_SFP_PLUS_10GB:
++ dev_warn(&adapter->pdev->dev,
++ "Autoneg not supported on this module. \n");
++ return -EINVAL;
++ case PHY_TYPE_KR_10GB:
++ case PHY_TYPE_KX4_10GB:
++ mac_speed = SPEED_AUTONEG_10GB_1GB;
++ break;
++ case PHY_TYPE_BASET_10GB:
++ mac_speed = SPEED_AUTONEG_10GB_1GB_100MB;
++ break;
++ }
++ } else if(ecmd->autoneg == AUTONEG_DISABLE) {
++ if(ecmd->speed == SPEED_10) {
++ mac_speed = SPEED_FORCED_10MB;
++ } else if(ecmd->speed == SPEED_100) {
++ mac_speed = SPEED_FORCED_100MB;
++ } else if(ecmd->speed == SPEED_1000) {
++ mac_speed = SPEED_FORCED_1GB;
++ } else if(ecmd->speed == SPEED_10000) {
++ mac_speed = SPEED_FORCED_10GB;
++ }
++ }
++
++ status = be_cmd_get_port_speed(adapter, adapter->hba_port_num,
++ &dac_cable_len, &port_speed);
++
++ if (!status && port_speed != mac_speed)
++ status = be_cmd_set_port_speed_v1(adapter,
++ adapter->hba_port_num, mac_speed,
++ dac_cable_len);
++ if (status)
++ dev_warn(&adapter->pdev->dev, "port speed set failed.\n");
++
++ return status;
++
++}
++
+ static void
+ be_get_ringparam(struct net_device *netdev, struct ethtool_ringparam *ring)
+ {
+ struct be_adapter *adapter = netdev_priv(netdev);
+
+- ring->rx_max_pending = adapter->rx_obj.q.len;
+- ring->tx_max_pending = adapter->tx_obj.q.len;
++ ring->rx_max_pending = adapter->rx_obj[0].q.len;
++ ring->tx_max_pending = adapter->tx_obj[0].q.len;
+
+- ring->rx_pending = atomic_read(&adapter->rx_obj.q.used);
+- ring->tx_pending = atomic_read(&adapter->tx_obj.q.used);
++ ring->rx_pending = atomic_read(&adapter->rx_obj[0].q.used);
++ ring->tx_pending = atomic_read(&adapter->tx_obj[0].q.used);
+ }
+
+ static void
+@@ -312,7 +615,7 @@ be_get_pauseparam(struct net_device *netdev, struct ethtool_pauseparam *ecmd)
+ struct be_adapter *adapter = netdev_priv(netdev);
+
+ be_cmd_get_flow_control(adapter, &ecmd->tx_pause, &ecmd->rx_pause);
+- ecmd->autoneg = 0;
++ ecmd->autoneg = adapter->autoneg;
+ }
+
+ static int
+@@ -334,6 +637,203 @@ be_set_pauseparam(struct net_device *netdev, struct ethtool_pauseparam *ecmd)
+ return status;
+ }
+
++#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 0, 0)
++static int
++be_phys_id(struct net_device *netdev, u32 data)
++{
++ struct be_adapter *adapter = netdev_priv(netdev);
++ int status;
++ u32 cur;
++
++ be_cmd_get_beacon_state(adapter, adapter->hba_port_num, &cur);
++
++ if (cur == BEACON_STATE_ENABLED)
++ return 0;
++
++ if (data < 2)
++ data = 2;
++
++ status = be_cmd_set_beacon_state(adapter, adapter->hba_port_num, 0, 0,
++ BEACON_STATE_ENABLED);
++ set_current_state(TASK_INTERRUPTIBLE);
++ schedule_timeout(data*HZ);
++
++ status = be_cmd_set_beacon_state(adapter, adapter->hba_port_num, 0, 0,
++ BEACON_STATE_DISABLED);
++
++ return status;
++}
++#else
++static int
++be_set_phys_id(struct net_device *netdev,
++ enum ethtool_phys_id_state state)
++{
++ struct be_adapter *adapter = netdev_priv(netdev);
++
++ switch (state) {
++ case ETHTOOL_ID_ACTIVE:
++ be_cmd_get_beacon_state(adapter, adapter->hba_port_num,
++ &adapter->beacon_state);
++ return 1; /* cycle on/off once per second */
++
++ case ETHTOOL_ID_ON:
++ be_cmd_set_beacon_state(adapter, adapter->hba_port_num, 0, 0,
++ BEACON_STATE_ENABLED);
++ break;
++
++ case ETHTOOL_ID_OFF:
++ be_cmd_set_beacon_state(adapter, adapter->hba_port_num, 0, 0,
++ BEACON_STATE_DISABLED);
++ break;
++
++ case ETHTOOL_ID_INACTIVE:
++ be_cmd_set_beacon_state(adapter, adapter->hba_port_num, 0, 0,
++ adapter->beacon_state);
++ }
++
++ return 0;
++}
++#endif
++
++static bool
++be_is_wol_supported(struct be_adapter *adapter)
++{
++ struct pci_dev *pdev = adapter->pdev;
++
++ if (!be_physfn(adapter))
++ return false;
++
++ switch (pdev->subsystem_device) {
++ case OC_SUBSYS_DEVICE_ID1:
++ case OC_SUBSYS_DEVICE_ID2:
++ case OC_SUBSYS_DEVICE_ID3:
++ case OC_SUBSYS_DEVICE_ID4:
++ return false;
++ default:
++ return true;
++ }
++}
++
++static void
++be_get_wol(struct net_device *netdev, struct ethtool_wolinfo *wol)
++{
++ struct be_adapter *adapter = netdev_priv(netdev);
++
++ if (be_is_wol_supported(adapter))
++ wol->supported = WAKE_MAGIC;
++ if (adapter->wol)
++ wol->wolopts = WAKE_MAGIC;
++ else
++ wol->wolopts = 0;
++ memset(&wol->sopass, 0, sizeof(wol->sopass));
++}
++
++static int
++be_set_wol(struct net_device *netdev, struct ethtool_wolinfo *wol)
++{
++ struct be_adapter *adapter = netdev_priv(netdev);
++
++ if (wol->wolopts & ~WAKE_MAGIC)
++ return -EOPNOTSUPP;
++
++ if (!be_is_wol_supported(adapter)) {
++ dev_warn(&adapter->pdev->dev,
++ "WOL not supported for this subsystemid: %x\n",
++ adapter->pdev->subsystem_device);
++ return -EOPNOTSUPP;
++ }
++
++ if (wol->wolopts & WAKE_MAGIC)
++ adapter->wol = true;
++ else
++ adapter->wol = false;
++
++ return 0;
++}
++
++static int
++be_test_ddr_dma(struct be_adapter *adapter)
++{
++ int ret, i;
++ struct be_dma_mem ddrdma_cmd;
++ u64 pattern[2] = {0x5a5a5a5a5a5a5a5aULL, 0xa5a5a5a5a5a5a5a5ULL};
++
++ ddrdma_cmd.size = sizeof(struct be_cmd_req_ddrdma_test);
++ ddrdma_cmd.va = pci_alloc_consistent(adapter->pdev, ddrdma_cmd.size,
++ &ddrdma_cmd.dma);
++ if (!ddrdma_cmd.va) {
++ dev_err(&adapter->pdev->dev, "Memory allocation failure\n");
++ return -ENOMEM;
++ }
++
++ for (i = 0; i < 2; i++) {
++ ret = be_cmd_ddr_dma_test(adapter, pattern[i],
++ 4096, &ddrdma_cmd);
++ if (ret != 0)
++ goto err;
++ }
++
++err:
++ pci_free_consistent(adapter->pdev, ddrdma_cmd.size,
++ ddrdma_cmd.va, ddrdma_cmd.dma);
++ return ret;
++}
++
++static u64 be_loopback_test(struct be_adapter *adapter, u8 loopback_type,
++ u64 *status)
++{
++ be_cmd_set_loopback(adapter, adapter->hba_port_num,
++ loopback_type, 1);
++ *status = be_cmd_loopback_test(adapter, adapter->hba_port_num,
++ loopback_type, 1500,
++ 2, 0xabc);
++ be_cmd_set_loopback(adapter, adapter->hba_port_num,
++ BE_NO_LOOPBACK, 1);
++ return *status;
++}
++
++static void
++be_self_test(struct net_device *netdev, struct ethtool_test *test, u64 *data)
++{
++ struct be_adapter *adapter = netdev_priv(netdev);
++ int link_status;
++ u8 mac_speed = 0;
++ u16 qos_link_speed = 0;
++
++ memset(data, 0, sizeof(u64) * ETHTOOL_TESTS_NUM);
++
++ if (test->flags & ETH_TEST_FL_OFFLINE) {
++ if (be_loopback_test(adapter, BE_MAC_LOOPBACK,
++ &data[0]) != 0) {
++ test->flags |= ETH_TEST_FL_FAILED;
++ }
++ if (be_loopback_test(adapter, BE_PHY_LOOPBACK,
++ &data[1]) != 0) {
++ test->flags |= ETH_TEST_FL_FAILED;
++ }
++ if (be_loopback_test(adapter, BE_ONE_PORT_EXT_LOOPBACK,
++ &data[2]) != 0) {
++ test->flags |= ETH_TEST_FL_FAILED;
++ }
++ }
++
++ if (be_test_ddr_dma(adapter) != 0) {
++ data[3] = 1;
++ test->flags |= ETH_TEST_FL_FAILED;
++ }
++
++ if (be_cmd_link_status_query(adapter, &link_status, &mac_speed,
++ &qos_link_speed, 0) != 0) {
++ test->flags |= ETH_TEST_FL_FAILED;
++ data[4] = -1;
++ } else if (!mac_speed) {
++ test->flags |= ETH_TEST_FL_FAILED;
++ data[4] = 1;
++ }
++
++}
++
++#ifdef HAVE_ETHTOOL_FLASH
+ static int
+ be_do_flash(struct net_device *netdev, struct ethtool_flash *efl)
+ {
+@@ -347,11 +847,73 @@ be_do_flash(struct net_device *netdev, struct ethtool_flash *efl)
+
+ return be_load_fw(adapter, file_name);
+ }
++#endif
+
+-const struct ethtool_ops be_ethtool_ops = {
++static int
++be_get_eeprom_len(struct net_device *netdev)
++{
++ return BE_READ_SEEPROM_LEN;
++}
++
++static int
++be_read_eeprom(struct net_device *netdev, struct ethtool_eeprom *eeprom,
++ uint8_t *data)
++{
++ struct be_adapter *adapter = netdev_priv(netdev);
++ struct be_dma_mem eeprom_cmd;
++ struct be_cmd_resp_seeprom_read *resp;
++ int status;
++
++ if (!eeprom->len)
++ return -EINVAL;
++
++ eeprom->magic = BE_VENDOR_ID | (adapter->pdev->device<<16);
++
++ memset(&eeprom_cmd, 0, sizeof(struct be_dma_mem));
++ eeprom_cmd.size = sizeof(struct be_cmd_req_seeprom_read);
++ eeprom_cmd.va = pci_alloc_consistent(adapter->pdev, eeprom_cmd.size,
++ &eeprom_cmd.dma);
++
++ if (!eeprom_cmd.va) {
++ dev_err(&adapter->pdev->dev,
++ "Memory allocation failure. Could not read eeprom\n");
++ return -ENOMEM;
++ }
++
++ status = be_cmd_get_seeprom_data(adapter, &eeprom_cmd);
++
++ if (!status) {
++ resp = (struct be_cmd_resp_seeprom_read *) eeprom_cmd.va;
++ memcpy(data, resp->seeprom_data + eeprom->offset, eeprom->len);
++ }
++ pci_free_consistent(adapter->pdev, eeprom_cmd.size, eeprom_cmd.va,
++ eeprom_cmd.dma);
++
++ return status;
++}
++
++static int be_set_tso(struct net_device *netdev, uint32_t data)
++{
++ if (data) {
++ netdev->features |= NETIF_F_TSO;
++ netdev->features |= NETIF_F_TSO6;
++ } else {
++ netdev->features &= ~NETIF_F_TSO;
++ netdev->features &= ~NETIF_F_TSO6;
++ }
++ return 0;
++}
++
++
++struct ethtool_ops be_ethtool_ops = {
+ .get_settings = be_get_settings,
++ .set_settings = be_set_settings,
+ .get_drvinfo = be_get_drvinfo,
++ .get_wol = be_get_wol,
++ .set_wol = be_set_wol,
+ .get_link = ethtool_op_get_link,
++ .get_eeprom_len = be_get_eeprom_len,
++ .get_eeprom = be_read_eeprom,
+ .get_coalesce = be_get_coalesce,
+ .set_coalesce = be_set_coalesce,
+ .get_ringparam = be_get_ringparam,
+@@ -364,9 +926,21 @@ const struct ethtool_ops be_ethtool_ops = {
+ .get_sg = ethtool_op_get_sg,
+ .set_sg = ethtool_op_set_sg,
+ .get_tso = ethtool_op_get_tso,
+- .set_tso = ethtool_op_set_tso,
++ .set_tso = be_set_tso,
+ .get_strings = be_get_stat_strings,
++#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 0, 0)
++ .phys_id = be_phys_id,
+ .get_stats_count = be_get_stats_count,
++ .self_test_count = be_self_test_count,
++#else
++ .set_phys_id = be_set_phys_id,
++ .get_sset_count = be_get_sset_count,
++#endif
+ .get_ethtool_stats = be_get_ethtool_stats,
++ .get_regs_len = be_get_reg_len,
++ .get_regs = be_get_regs,
++#ifdef HAVE_ETHTOOL_FLASH
+ .flash_device = be_do_flash,
++#endif
++ .self_test = be_self_test
+ };
+diff --git a/drivers/net/benet/be_hw.h b/drivers/net/benet/be_hw.h
+index a3394b4..f871d8c 100644
+--- a/drivers/net/benet/be_hw.h
++++ b/drivers/net/benet/be_hw.h
+@@ -1,18 +1,18 @@
+ /*
+- * Copyright (C) 2005 - 2009 ServerEngines
++ * Copyright (C) 2005 - 2011 Emulex
+ * All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License version 2
+- * as published by the Free Software Foundation. The full GNU General
++ * as published by the Free Software Foundation. The full GNU General
+ * Public License is included in this distribution in the file called COPYING.
+ *
+ * Contact Information:
+- * linux-drivers@serverengines.com
++ * linux-drivers@emulex.com
+ *
+- * ServerEngines
+- * 209 N. Fair Oaks Ave
+- * Sunnyvale, CA 94085
++ * Emulex
++ * 3333 Susan Street
++ * Costa Mesa, CA 92626
+ */
+
+ /********* Mailbox door bell *************/
+@@ -26,24 +26,34 @@
+ * queue entry.
+ */
+ #define MPU_MAILBOX_DB_OFFSET 0x160
+-#define MPU_MAILBOX_DB_RDY_MASK 0x1 /* bit 0 */
++#define MPU_MAILBOX_DB_RDY_MASK 0x1 /* bit 0 */
+ #define MPU_MAILBOX_DB_HI_MASK 0x2 /* bit 1 */
+
+-#define MPU_EP_CONTROL 0
++#define MPU_EP_CONTROL 0
+
+ /********** MPU semphore ******************/
+-#define MPU_EP_SEMAPHORE_OFFSET 0xac
++#define MPU_EP_SEMAPHORE_OFFSET 0xac
++#define MPU_EP_SEMAPHORE_IF_TYPE2_OFFSET 0x400
+ #define EP_SEMAPHORE_POST_STAGE_MASK 0x0000FFFF
+ #define EP_SEMAPHORE_POST_ERR_MASK 0x1
+ #define EP_SEMAPHORE_POST_ERR_SHIFT 31
+ /* MPU semphore POST stage values */
+-#define POST_STAGE_AWAITING_HOST_RDY 0x1 /* FW awaiting goahead from host */
+-#define POST_STAGE_HOST_RDY 0x2 /* Host has given go-ahed to FW */
++#define POST_STAGE_AWAITING_HOST_RDY 0x1 /* FW awaiting goahead from host */
++#define POST_STAGE_HOST_RDY 0x2 /* Host has given go-ahed to FW */
+ #define POST_STAGE_BE_RESET 0x3 /* Host wants to reset chip */
+ #define POST_STAGE_ARMFW_RDY 0xc000 /* FW is done with POST */
+
++/* Lancer SLIPORT_CONTROL SLIPORT_STATUS registers */
++#define SLIPORT_STATUS_OFFSET 0x404
++#define SLIPORT_CONTROL_OFFSET 0x408
++
++#define SLIPORT_STATUS_ERR_MASK 0x80000000
++#define SLIPORT_STATUS_RN_MASK 0x01000000
++#define SLIPORT_STATUS_RDY_MASK 0x00800000
++#define SLI_PORT_CONTROL_IP_MASK 0x08000000
++
+ /********* Memory BAR register ************/
+-#define PCICFG_MEMBAR_CTRL_INT_CTRL_OFFSET 0xfc
++#define PCICFG_MEMBAR_CTRL_INT_CTRL_OFFSET 0xfc
+ /* Host Interrupt Enable, if set interrupts are enabled although "PCI Interrupt
+ * Disable" may still globally block interrupts in addition to individual
+ * interrupt masks; a mechanism for the device driver to block all interrupts
+@@ -52,13 +62,70 @@
+ */
+ #define MEMBAR_CTRL_INT_CTRL_HOSTINTR_MASK (1 << 29) /* bit 29 */
+
++/********* Link Status CSR ****************/
++#define PCICFG_PCIE_LINK_STATUS_OFFSET 0xd0
++#define PCIE_LINK_STATUS_SPEED_MASK 0xFF /* bits 16 - 19 */
++#define PCIE_LINK_STATUS_SPEED_SHIFT 16
++#define PCIE_LINK_STATUS_NEG_WIDTH_MASK 0x3F /* bits 20 - 25 */
++#define PCIE_LINK_STATUS_NEG_WIDTH_SHIFT 20
++
++/********* Link Capability CSR ************/
++#define PCICFG_PCIE_LINK_CAP_OFFSET 0xcc
++#define PCIE_LINK_CAP_MAX_SPEED_MASK 0xFF /* bits 0 - 3 */
++#define PCIE_LINK_CAP_MAX_SPEED_SHIFT 0
++#define PCIE_LINK_CAP_MAX_WIDTH_MASK 0x3F /* bits 4 - 9 */
++#define PCIE_LINK_CAP_MAX_WIDTH_SHIFT 4
++
++/********* PCI Function Capability ************/
++#define BE_FUNCTION_CAPS_UNCLASSIFIED_STATS 0x1
++#define BE_FUNCTION_CAPS_RSS 0x2
++#define BE_FUNCTION_CAPS_PROMISCUOUS 0x4
++#define BE_FUNCTION_CAPS_LEGACY_MODE 0x8
++
++/********* Power managment (WOL) **********/
++#define PCICFG_PM_CONTROL_OFFSET 0x44
++#define PCICFG_PM_CONTROL_MASK 0x108 /* bits 3 & 8 */
++
++/********* Online Control Registers *******/
++#define PCICFG_ONLINE0 0xB0
++#define PCICFG_ONLINE1 0xB4
++
++/********* UE Status and Mask Registers ***/
++#define PCICFG_UE_STATUS_LOW 0xA0
++#define PCICFG_UE_STATUS_HIGH 0xA4
++#define PCICFG_UE_STATUS_LOW_MASK 0xA8
++#define PCICFG_UE_STATUS_HI_MASK 0xAC
++
++/******** SLI_INTF ***********************/
++#define SLI_INTF_REG_OFFSET 0x58
++#define SLI_INTF_VALID_MASK 0xE0000000
++#define SLI_INTF_VALID 0xC0000000
++#define SLI_INTF_HINT2_MASK 0x1F000000
++#define SLI_INTF_HINT2_SHIFT 24
++#define SLI_INTF_HINT1_MASK 0x00FF0000
++#define SLI_INTF_HINT1_SHIFT 16
++#define SLI_INTF_FAMILY_MASK 0x00000F00
++#define SLI_INTF_FAMILY_SHIFT 8
++#define SLI_INTF_IF_TYPE_MASK 0x0000F000
++#define SLI_INTF_IF_TYPE_SHIFT 12
++#define SLI_INTF_REV_MASK 0x000000F0
++#define SLI_INTF_REV_SHIFT 4
++#define SLI_INTF_FT_MASK 0x00000001
++
++/* SLI family */
++#define BE_SLI_FAMILY 0x0
++#define LANCER_A0_SLI_FAMILY 0xA
++
+ /********* ISR0 Register offset **********/
+-#define CEV_ISR0_OFFSET 0xC18
++#define CEV_ISR0_OFFSET 0xC18
+ #define CEV_ISR_SIZE 4
+
+ /********* Event Q door bell *************/
+ #define DB_EQ_OFFSET DB_CQ_OFFSET
+ #define DB_EQ_RING_ID_MASK 0x1FF /* bits 0 - 8 */
++#define DB_EQ_RING_ID_EXT_MASK 0x3e00 /* bits 9-13 */
++#define DB_EQ_RING_ID_EXT_MASK_SHIFT (2) /* qid bits 9-13 placing at 11-15 */
++
+ /* Clear the interrupt for this eq */
+ #define DB_EQ_CLR_SHIFT (9) /* bit 9 */
+ /* Must be 1 */
+@@ -69,12 +136,16 @@
+ #define DB_EQ_REARM_SHIFT (29) /* bit 29 */
+
+ /********* Compl Q door bell *************/
+-#define DB_CQ_OFFSET 0x120
++#define DB_CQ_OFFSET 0x120
+ #define DB_CQ_RING_ID_MASK 0x3FF /* bits 0 - 9 */
++#define DB_CQ_RING_ID_EXT_MASK 0x7C00 /* bits 10-14 */
++#define DB_CQ_RING_ID_EXT_MASK_SHIFT (1) /* qid bits 10-14
++ placing at 11-15 */
++
+ /* Number of event entries processed */
+-#define DB_CQ_NUM_POPPED_SHIFT (16) /* bits 16 - 28 */
++#define DB_CQ_NUM_POPPED_SHIFT (16) /* bits 16 - 28 */
+ /* Rearm bit */
+-#define DB_CQ_REARM_SHIFT (29) /* bit 29 */
++#define DB_CQ_REARM_SHIFT (29) /* bit 29 */
+
+ /********** TX ULP door bell *************/
+ #define DB_TXULP1_OFFSET 0x60
+@@ -84,25 +155,103 @@
+ #define DB_TXULP_NUM_POSTED_MASK 0x3FFF /* bits 16 - 29 */
+
+ /********** RQ(erx) door bell ************/
+-#define DB_RQ_OFFSET 0x100
++#define DB_RQ_OFFSET 0x100
+ #define DB_RQ_RING_ID_MASK 0x3FF /* bits 0 - 9 */
+ /* Number of rx frags posted */
+ #define DB_RQ_NUM_POSTED_SHIFT (24) /* bits 24 - 31 */
+
+ /********** MCC door bell ************/
+-#define DB_MCCQ_OFFSET 0x140
++#define DB_MCCQ_OFFSET 0x140
+ #define DB_MCCQ_RING_ID_MASK 0x7FF /* bits 0 - 10 */
+ /* Number of entries posted */
+ #define DB_MCCQ_NUM_POSTED_SHIFT (16) /* bits 16 - 29 */
+
++/********** SRIOV VF PCICFG OFFSET ********/
++#define SRIOV_VF_PCICFG_OFFSET (4096)
++
++/********** FAT TABLE ********/
++#define RETRIEVE_FAT 0
++#define QUERY_FAT 1
++
++/* Flashrom related descriptors */
++#define IMAGE_TYPE_FIRMWARE 160
++#define IMAGE_TYPE_BOOTCODE 224
++#define IMAGE_TYPE_OPTIONROM 32
++
++#define NUM_FLASHDIR_ENTRIES 32
++
++#define IMG_TYPE_ISCSI_ACTIVE 0
++#define IMG_TYPE_REDBOOT 1
++#define IMG_TYPE_BIOS 2
++#define IMG_TYPE_PXE_BIOS 3
++#define IMG_TYPE_FCOE_BIOS 8
++#define IMG_TYPE_ISCSI_BACKUP 9
++#define IMG_TYPE_FCOE_FW_ACTIVE 10
++#define IMG_TYPE_FCOE_FW_BACKUP 11
++#define IMG_TYPE_NCSI_FW 13
++#define IMG_TYPE_PHY_FW 99
++#define TN_8022 13
++
++#define ILLEGAL_IOCTL_REQ 2
++#define FLASHROM_OPER_PHY_FLASH 9
++#define FLASHROM_OPER_PHY_SAVE 10
++#define FLASHROM_OPER_FLASH 1
++#define FLASHROM_OPER_SAVE 2
++#define FLASHROM_OPER_REPORT 4
++
++#define FLASH_IMAGE_MAX_SIZE_g2 (1310720) /* Max firmware image size */
++#define FLASH_BIOS_IMAGE_MAX_SIZE_g2 (262144) /* Max OPTION ROM image sz */
++#define FLASH_REDBOOT_IMAGE_MAX_SIZE_g2 (262144) /* Max Redboot image sz */
++#define FLASH_IMAGE_MAX_SIZE_g3 (2097152) /* Max firmware image size */
++#define FLASH_BIOS_IMAGE_MAX_SIZE_g3 (524288) /* Max OPTION ROM image sz */
++#define FLASH_REDBOOT_IMAGE_MAX_SIZE_g3 (1048576) /* Max Redboot image sz */
++#define FLASH_NCSI_IMAGE_MAX_SIZE_g3 (262144)
++#define FLASH_PHY_FW_IMAGE_MAX_SIZE_g3 (262144)
++
++#define FLASH_NCSI_MAGIC (0x16032009)
++#define FLASH_NCSI_DISABLED (0)
++#define FLASH_NCSI_ENABLED (1)
++
++#define FLASH_NCSI_BITFILE_HDR_OFFSET (0x600000)
++
++/* Offsets for components on Flash. */
++#define FLASH_iSCSI_PRIMARY_IMAGE_START_g2 (1048576)
++#define FLASH_iSCSI_BACKUP_IMAGE_START_g2 (2359296)
++#define FLASH_FCoE_PRIMARY_IMAGE_START_g2 (3670016)
++#define FLASH_FCoE_BACKUP_IMAGE_START_g2 (4980736)
++#define FLASH_iSCSI_BIOS_START_g2 (7340032)
++#define FLASH_PXE_BIOS_START_g2 (7864320)
++#define FLASH_FCoE_BIOS_START_g2 (524288)
++#define FLASH_REDBOOT_START_g2 (0)
++
++#define FLASH_NCSI_START_g3 (15990784)
++#define FLASH_iSCSI_PRIMARY_IMAGE_START_g3 (2097152)
++#define FLASH_iSCSI_BACKUP_IMAGE_START_g3 (4194304)
++#define FLASH_FCoE_PRIMARY_IMAGE_START_g3 (6291456)
++#define FLASH_FCoE_BACKUP_IMAGE_START_g3 (8388608)
++#define FLASH_iSCSI_BIOS_START_g3 (12582912)
++#define FLASH_PXE_BIOS_START_g3 (13107200)
++#define FLASH_FCoE_BIOS_START_g3 (13631488)
++#define FLASH_REDBOOT_START_g3 (262144)
++#define FLASH_PHY_FW_START_g3 (1310720)
++
++/************* Rx Packet Type Encoding **************/
++#define BE_UNICAST_PACKET 0
++#define BE_MULTICAST_PACKET 1
++#define BE_BROADCAST_PACKET 2
++#define BE_RSVD_PACKET 3
++
+ /*
+ * BE descriptors: host memory data structures whose formats
+ * are hardwired in BE silicon.
+ */
+ /* Event Queue Descriptor */
+-#define EQ_ENTRY_VALID_MASK 0x1 /* bit 0 */
+-#define EQ_ENTRY_RES_ID_MASK 0xFFFF /* bits 16 - 31 */
+-#define EQ_ENTRY_RES_ID_SHIFT 16
++#define EQ_ENTRY_VALID_MASK 0x1 /* bit 0 */
++#define EQ_ENTRY_RES_ID_MASK 0xFFFF /* bits 16 - 31 */
++#define EQ_ENTRY_RES_ID_SHIFT 16
++
++#define BE_MAC_PROMISCUOUS 62 /* Promiscuous mode */
++
+ struct be_eq_entry {
+ u32 evt;
+ };
+@@ -126,7 +275,7 @@ struct amap_eth_hdr_wrb {
+ u8 event;
+ u8 crc;
+ u8 forward;
+- u8 ipsec;
++ u8 lso6;
+ u8 mgmt;
+ u8 ipcs;
+ u8 udpcs;
+@@ -151,7 +300,7 @@ struct be_eth_hdr_wrb {
+ * offset/shift/mask of each field */
+ struct amap_eth_tx_compl {
+ u8 wrb_index[16]; /* dword 0 */
+- u8 ct[2]; /* dword 0 */
++ u8 ct[2]; /* dword 0 */
+ u8 port[2]; /* dword 0 */
+ u8 rsvd0[8]; /* dword 0 */
+ u8 status[4]; /* dword 0 */
+@@ -179,10 +328,10 @@ struct be_eth_rx_d {
+
+ /* RX Compl Queue Descriptor */
+
+-/* Pseudo amap definition for eth_rx_compl in which each bit of the
+- * actual structure is defined as a byte: used to calculate
++/* Pseudo amap definition for BE2 and BE3 legacy mode eth_rx_compl in which
++ * each bit of the actual structure is defined as a byte: used to calculate
+ * offset/shift/mask of each field */
+-struct amap_eth_rx_compl {
++struct amap_eth_rx_compl_v0 {
+ u8 vlan_tag[16]; /* dword 0 */
+ u8 pktsize[14]; /* dword 0 */
+ u8 port; /* dword 0 */
+@@ -213,39 +362,91 @@ struct amap_eth_rx_compl {
+ u8 rsshash[32]; /* dword 3 */
+ } __packed;
+
++/* Pseudo amap definition for BE3 native mode eth_rx_compl in which
++ * each bit of the actual structure is defined as a byte: used to calculate
++ * offset/shift/mask of each field */
++struct amap_eth_rx_compl_v1 {
++ u8 vlan_tag[16]; /* dword 0 */
++ u8 pktsize[14]; /* dword 0 */
++ u8 vtp; /* dword 0 */
++ u8 ip_opt; /* dword 0 */
++ u8 err; /* dword 1 */
++ u8 rsshp; /* dword 1 */
++ u8 ipf; /* dword 1 */
++ u8 tcpf; /* dword 1 */
++ u8 udpf; /* dword 1 */
++ u8 ipcksm; /* dword 1 */
++ u8 l4_cksm; /* dword 1 */
++ u8 ip_version; /* dword 1 */
++ u8 macdst[7]; /* dword 1 */
++ u8 rsvd0; /* dword 1 */
++ u8 fragndx[10]; /* dword 1 */
++ u8 ct[2]; /* dword 1 */
++ u8 sw; /* dword 1 */
++ u8 numfrags[3]; /* dword 1 */
++ u8 rss_flush; /* dword 2 */
++ u8 cast_enc[2]; /* dword 2 */
++ u8 vtm; /* dword 2 */
++ u8 rss_bank; /* dword 2 */
++ u8 port[2]; /* dword 2 */
++ u8 vntagp; /* dword 2 */
++ u8 header_len[8]; /* dword 2 */
++ u8 header_split[2]; /* dword 2 */
++ u8 rsvd1[13]; /* dword 2 */
++ u8 valid; /* dword 2 */
++ u8 rsshash[32]; /* dword 3 */
++} __packed;
++
+ struct be_eth_rx_compl {
+ u32 dw[4];
+ };
+
+-/* Flashrom related descriptors */
+-#define IMAGE_TYPE_FIRMWARE 160
+-#define IMAGE_TYPE_BOOTCODE 224
+-#define IMAGE_TYPE_OPTIONROM 32
++struct mgmt_hba_attribs {
++ u8 flashrom_version_string[32];
++ u8 manufacturer_name[32];
++ u32 supported_modes;
++ u32 rsvd0[3];
++ u8 ncsi_ver_string[12];
++ u32 default_extended_timeout;
++ u8 controller_model_number[32];
++ u8 controller_description[64];
++ u8 controller_serial_number[32];
++ u8 ip_version_string[32];
++ u8 firmware_version_string[32];
++ u8 bios_version_string[32];
++ u8 redboot_version_string[32];
++ u8 driver_version_string[32];
++ u8 fw_on_flash_version_string[32];
++ u32 functionalities_supported;
++ u16 max_cdblength;
++ u8 asic_revision;
++ u8 generational_guid[16];
++ u8 hba_port_count;
++ u16 default_link_down_timeout;
++ u8 iscsi_ver_min_max;
++ u8 multifunction_device;
++ u8 cache_valid;
++ u8 hba_status;
++ u8 max_domains_supported;
++ u8 phy_port;
++ u32 firmware_post_status;
++ u32 hba_mtu[8];
++ u32 rsvd1[4];
++};
+
+-#define NUM_FLASHDIR_ENTRIES 32
+-
+-#define FLASHROM_TYPE_ISCSI_ACTIVE 0
+-#define FLASHROM_TYPE_BIOS 2
+-#define FLASHROM_TYPE_PXE_BIOS 3
+-#define FLASHROM_TYPE_FCOE_BIOS 8
+-#define FLASHROM_TYPE_ISCSI_BACKUP 9
+-#define FLASHROM_TYPE_FCOE_FW_ACTIVE 10
+-#define FLASHROM_TYPE_FCOE_FW_BACKUP 11
+-
+-#define FLASHROM_OPER_FLASH 1
+-#define FLASHROM_OPER_SAVE 2
+-
+-#define FLASH_IMAGE_MAX_SIZE (1310720) /* Max firmware image size */
+-#define FLASH_BIOS_IMAGE_MAX_SIZE (262144) /* Max OPTION ROM image sz */
+-
+-/* Offsets for components on Flash. */
+-#define FLASH_iSCSI_PRIMARY_IMAGE_START (1048576)
+-#define FLASH_iSCSI_BACKUP_IMAGE_START (2359296)
+-#define FLASH_FCoE_PRIMARY_IMAGE_START (3670016)
+-#define FLASH_FCoE_BACKUP_IMAGE_START (4980736)
+-#define FLASH_iSCSI_BIOS_START (7340032)
+-#define FLASH_PXE_BIOS_START (7864320)
+-#define FLASH_FCoE_BIOS_START (524288)
++struct mgmt_controller_attrib {
++ struct mgmt_hba_attribs hba_attribs;
++ u16 pci_vendor_id;
++ u16 pci_device_id;
++ u16 pci_sub_vendor_id;
++ u16 pci_sub_system_id;
++ u8 pci_bus_number;
++ u8 pci_device_number;
++ u8 pci_function_number;
++ u8 interface_type;
++ u64 unique_identifier;
++ u32 rsvd0[5];
++};
+
+ struct controller_id {
+ u32 vendor;
+@@ -254,7 +455,20 @@ struct controller_id {
+ u32 subdevice;
+ };
+
+-struct flash_file_hdr {
++struct flash_comp {
++ unsigned long offset;
++ int optype;
++ int size;
++};
++
++struct image_hdr {
++ u32 imageid;
++ u32 imageoffset;
++ u32 imagelength;
++ u32 image_checksum;
++ u8 image_version[32];
++};
++struct flash_file_hdr_g2 {
+ u8 sign[32];
+ u32 cksum;
+ u32 antidote;
+@@ -266,6 +480,17 @@ struct flash_file_hdr {
+ u8 build[24];
+ };
+
++struct flash_file_hdr_g3 {
++ u8 sign[52];
++ u8 ufi_version[4];
++ u32 file_len;
++ u32 cksum;
++ u32 antidote;
++ u32 num_imgs;
++ u8 build[24];
++ u8 rsvd[32];
++};
++
+ struct flash_section_hdr {
+ u32 format_rev;
+ u32 cksum;
+@@ -299,3 +524,19 @@ struct flash_section_info {
+ struct flash_section_hdr fsec_hdr;
+ struct flash_section_entry fsec_entry[32];
+ };
++
++struct flash_ncsi_image_hdr {
++ u32 magic;
++ u8 hdr_len;
++ u8 type;
++ u16 hdr_ver;
++ u8 rsvd0[2];
++ u16 load_offset;
++ u32 len;
++ u32 flash_offset;
++ u8 ver[16];
++ u8 name[24];
++ u32 img_cksum;
++ u8 rsvd1[4];
++ u32 hdr_cksum;
++};
+diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
+index 000e377..f501aa3 100644
+--- a/drivers/net/benet/be_main.c
++++ b/drivers/net/benet/be_main.c
+@@ -1,18 +1,18 @@
+ /*
+- * Copyright (C) 2005 - 2009 ServerEngines
++ * Copyright (C) 2005 - 2011 Emulex
+ * All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License version 2
+- * as published by the Free Software Foundation. The full GNU General
++ * as published by the Free Software Foundation. The full GNU General
+ * Public License is included in this distribution in the file called COPYING.
+ *
+ * Contact Information:
+- * linux-drivers@serverengines.com
++ * linux-drivers@emulex.com
+ *
+- * ServerEngines
+- * 209 N. Fair Oaks Ave
+- * Sunnyvale, CA 94085
++ * Emulex
++ * 3333 Susan Street
++ * Costa Mesa, CA 92626
+ */
+
+ #include "be.h"
+@@ -22,23 +22,119 @@
+ MODULE_VERSION(DRV_VER);
+ MODULE_DEVICE_TABLE(pci, be_dev_ids);
+ MODULE_DESCRIPTION(DRV_DESC " " DRV_VER);
+-MODULE_AUTHOR("ServerEngines Corporation");
++MODULE_AUTHOR("Emulex Corporation");
+ MODULE_LICENSE("GPL");
++MODULE_INFO(supported, "external");
+
+-static unsigned int rx_frag_size = 2048;
+-module_param(rx_frag_size, uint, S_IRUGO);
+-MODULE_PARM_DESC(rx_frag_size, "Size of a fragment that holds rcvd data.");
++static ushort rx_frag_size = 2048;
++static unsigned int num_vfs;
++static unsigned int msix = 1;
++module_param(rx_frag_size, ushort, S_IRUGO);
++module_param(num_vfs, uint, S_IRUGO);
++module_param(msix, uint, S_IRUGO);
++MODULE_PARM_DESC(rx_frag_size, "Size of receive fragment buffer"
++ " - 2048 (default), 4096 or 8192");
++MODULE_PARM_DESC(num_vfs, "Number of PCI VFs to initialize");
++MODULE_PARM_DESC(msix, "Enable and disable the MSI"
++ "x (By default MSIx is enabled)");
++static unsigned int gro = 1;
++module_param(gro, uint, S_IRUGO);
++MODULE_PARM_DESC(gro, "Enable or Disable GRO. Enabled by default");
++
++static unsigned int multi_rxq = true;
++module_param(multi_rxq, uint, S_IRUGO);
++MODULE_PARM_DESC(multi_rxq, "Multi Rx Queue support. Enabled by default");
+
+ static DEFINE_PCI_DEVICE_TABLE(be_dev_ids) = {
+ { PCI_DEVICE(BE_VENDOR_ID, BE_DEVICE_ID1) },
+ { PCI_DEVICE(BE_VENDOR_ID, BE_DEVICE_ID2) },
+ { PCI_DEVICE(BE_VENDOR_ID, OC_DEVICE_ID1) },
+ { PCI_DEVICE(BE_VENDOR_ID, OC_DEVICE_ID2) },
+- { PCI_DEVICE(BE_VENDOR_ID, OC_DEVICE_ID3) },
++ /*
++ * Lancer is not part of Palau 4.0
++ * { PCI_DEVICE(EMULEX_VENDOR_ID, OC_DEVICE_ID3)},
++ */
+ { 0 }
+ };
+ MODULE_DEVICE_TABLE(pci, be_dev_ids);
+
++/* UE Status Low CSR */
++static char *ue_status_low_desc[] = {
++ "CEV",
++ "CTX",
++ "DBUF",
++ "ERX",
++ "Host",
++ "MPU",
++ "NDMA",
++ "PTC ",
++ "RDMA ",
++ "RXF ",
++ "RXIPS ",
++ "RXULP0 ",
++ "RXULP1 ",
++ "RXULP2 ",
++ "TIM ",
++ "TPOST ",
++ "TPRE ",
++ "TXIPS ",
++ "TXULP0 ",
++ "TXULP1 ",
++ "UC ",
++ "WDMA ",
++ "TXULP2 ",
++ "HOST1 ",
++ "P0_OB_LINK ",
++ "P1_OB_LINK ",
++ "HOST_GPIO ",
++ "MBOX ",
++ "AXGMAC0",
++ "AXGMAC1",
++ "JTAG",
++ "MPU_INTPEND"
++};
++
++/* UE Status High CSR */
++static char *ue_status_hi_desc[] = {
++ "LPCMEMHOST",
++ "MGMT_MAC",
++ "PCS0ONLINE",
++ "MPU_IRAM",
++ "PCS1ONLINE",
++ "PCTL0",
++ "PCTL1",
++ "PMEM",
++ "RR",
++ "TXPB",
++ "RXPP",
++ "XAUI",
++ "TXP",
++ "ARM",
++ "IPC",
++ "HOST2",
++ "HOST3",
++ "HOST4",
++ "HOST5",
++ "HOST6",
++ "HOST7",
++ "HOST8",
++ "HOST9",
++ "NETC",
++ "Unknown",
++ "Unknown",
++ "Unknown",
++ "Unknown",
++ "Unknown",
++ "Unknown",
++ "Unknown",
++ "Unknown"
++};
++
++static inline bool be_multi_rxq(struct be_adapter *adapter)
++{
++ return (adapter->num_rx_qs > 1);
++}
++
+ static void be_queue_free(struct be_adapter *adapter, struct be_queue_info *q)
+ {
+ struct be_dma_mem *mem = &q->dma_mem;
+@@ -69,6 +165,9 @@ static void be_intr_set(struct be_adapter *adapter, bool enable)
+ u32 reg = ioread32(addr);
+ u32 enabled = reg & MEMBAR_CTRL_INT_CTRL_HOSTINTR_MASK;
+
++ if (adapter->eeh_err)
++ return;
++
+ if (!enabled && enable)
+ reg |= MEMBAR_CTRL_INT_CTRL_HOSTINTR_MASK;
+ else if (enabled && !enable)
+@@ -84,6 +183,8 @@ static void be_rxq_notify(struct be_adapter *adapter, u16 qid, u16 posted)
+ u32 val = 0;
+ val |= qid & DB_RQ_RING_ID_MASK;
+ val |= posted << DB_RQ_NUM_POSTED_SHIFT;
++
++ wmb();
+ iowrite32(val, adapter->db + DB_RQ_OFFSET);
+ }
+
+@@ -92,6 +193,8 @@ static void be_txq_notify(struct be_adapter *adapter, u16 qid, u16 posted)
+ u32 val = 0;
+ val |= qid & DB_TXULP_RING_ID_MASK;
+ val |= (posted & DB_TXULP_NUM_POSTED_MASK) << DB_TXULP_NUM_POSTED_SHIFT;
++
++ wmb();
+ iowrite32(val, adapter->db + DB_TXULP1_OFFSET);
+ }
+
+@@ -100,6 +203,12 @@ static void be_eq_notify(struct be_adapter *adapter, u16 qid,
+ {
+ u32 val = 0;
+ val |= qid & DB_EQ_RING_ID_MASK;
++ val |= ((qid & DB_EQ_RING_ID_EXT_MASK) <<
++ DB_EQ_RING_ID_EXT_MASK_SHIFT);
++
++ if (adapter->eeh_err)
++ return;
++
+ if (arm)
+ val |= 1 << DB_EQ_REARM_SHIFT;
+ if (clear_int)
+@@ -113,6 +222,12 @@ void be_cq_notify(struct be_adapter *adapter, u16 qid, bool arm, u16 num_popped)
+ {
+ u32 val = 0;
+ val |= qid & DB_CQ_RING_ID_MASK;
++ val |= ((qid & DB_CQ_RING_ID_EXT_MASK) <<
++ DB_CQ_RING_ID_EXT_MASK_SHIFT);
++
++ if (adapter->eeh_err)
++ return;
++
+ if (arm)
+ val |= 1 << DB_CQ_REARM_SHIFT;
+ val |= num_popped << DB_CQ_NUM_POPPED_SHIFT;
+@@ -124,96 +239,250 @@ static int be_mac_addr_set(struct net_device *netdev, void *p)
+ struct be_adapter *adapter = netdev_priv(netdev);
+ struct sockaddr *addr = p;
+ int status = 0;
++ u8 current_mac[ETH_ALEN];
++ u32 pmac_id = adapter->pmac_id;
+
+- status = be_cmd_pmac_del(adapter, adapter->if_handle, adapter->pmac_id);
++ if (!is_valid_ether_addr(addr->sa_data))
++ return -EADDRNOTAVAIL;
++
++ status = be_cmd_mac_addr_query(adapter, current_mac,
++ MAC_ADDRESS_TYPE_NETWORK, false,
++ adapter->if_handle);
+ if (status)
+- return status;
++ goto err;
++
++ if (!memcmp(addr->sa_data, current_mac, ETH_ALEN))
++ goto done;
+
+ status = be_cmd_pmac_add(adapter, (u8 *)addr->sa_data,
+- adapter->if_handle, &adapter->pmac_id);
+- if (!status)
++ adapter->if_handle, &adapter->pmac_id, 0);
++
++ if (!status) {
++ status = be_cmd_pmac_del(adapter, adapter->if_handle,
++ pmac_id, 0);
+ memcpy(netdev->dev_addr, addr->sa_data, netdev->addr_len);
++ goto done;
++ }
+
+- return status;
++err:
++ if (status == MCC_STATUS_UNAUTHORIZED_REQUEST)
++ return -EPERM;
++ else
++ dev_err(&adapter->pdev->dev, "MAC %pM set Failed\n",
++ addr->sa_data);
++done:
++ return status;
++}
++
++static void populate_be2_stats(struct be_adapter *adapter)
++{
++
++ struct be_drv_stats *drvs = &adapter->drv_stats;
++ struct be_pmem_stats *pmem_sts = be_pmem_stats_from_cmd(adapter);
++ struct be_port_rxf_stats_v0 *port_stats =
++ be_port_rxf_stats_from_cmd(adapter);
++ struct be_rxf_stats_v0 *rxf_stats =
++ be_rxf_stats_from_cmd(adapter);
++
++ drvs->rx_pause_frames = port_stats->rx_pause_frames;
++ drvs->rx_crc_errors = port_stats->rx_crc_errors;
++ drvs->rx_control_frames = port_stats->rx_control_frames;
++ drvs->rx_in_range_errors = port_stats->rx_in_range_errors;
++ drvs->rx_frame_too_long = port_stats->rx_frame_too_long;
++ drvs->rx_dropped_runt = port_stats->rx_dropped_runt;
++ drvs->rx_ip_checksum_errs = port_stats->rx_ip_checksum_errs;
++ drvs->rx_tcp_checksum_errs = port_stats->rx_tcp_checksum_errs;
++ drvs->rx_udp_checksum_errs = port_stats->rx_udp_checksum_errs;
++ drvs->rxpp_fifo_overflow_drop = port_stats->rx_fifo_overflow;
++ drvs->rx_dropped_tcp_length = port_stats->rx_dropped_tcp_length;
++ drvs->rx_dropped_too_small = port_stats->rx_dropped_too_small;
++ drvs->rx_dropped_too_short = port_stats->rx_dropped_too_short;
++ drvs->rx_out_range_errors = port_stats->rx_out_range_errors;
++ drvs->rx_input_fifo_overflow_drop =
++ port_stats->rx_input_fifo_overflow;
++ drvs->rx_dropped_header_too_small =
++ port_stats->rx_dropped_header_too_small;
++ drvs->rx_address_match_errors =
++ port_stats->rx_address_match_errors;
++ drvs->rx_alignment_symbol_errors =
++ port_stats->rx_alignment_symbol_errors;
++
++ drvs->tx_pauseframes = port_stats->tx_pauseframes;
++ drvs->tx_controlframes = port_stats->tx_controlframes;
++
++ if (adapter->port_num)
++ drvs->jabber_events =
++ rxf_stats->port1_jabber_events;
++ else
++ drvs->jabber_events =
++ rxf_stats->port0_jabber_events;
++ drvs->rx_drops_no_pbuf = rxf_stats->rx_drops_no_pbuf;
++ drvs->rx_drops_no_txpb = rxf_stats->rx_drops_no_txpb;
++ drvs->rx_drops_no_erx_descr = rxf_stats->rx_drops_no_erx_descr;
++ drvs->rx_drops_invalid_ring = rxf_stats->rx_drops_invalid_ring;
++ drvs->forwarded_packets = rxf_stats->forwarded_packets;
++ drvs->rx_drops_mtu = rxf_stats->rx_drops_mtu;
++ drvs->rx_drops_no_tpre_descr =
++ rxf_stats->rx_drops_no_tpre_descr;
++ drvs->rx_drops_too_many_frags =
++ rxf_stats->rx_drops_too_many_frags;
++ adapter->drv_stats.eth_red_drops = pmem_sts->eth_red_drops;
++}
++
++static void populate_be3_stats(struct be_adapter *adapter)
++{
++ struct be_drv_stats *drvs = &adapter->drv_stats;
++ struct be_pmem_stats *pmem_sts = be_pmem_stats_from_cmd(adapter);
++
++ struct be_rxf_stats_v1 *rxf_stats =
++ be_rxf_stats_from_cmd(adapter);
++ struct be_port_rxf_stats_v1 *port_stats =
++ be_port_rxf_stats_from_cmd(adapter);
++
++ drvs->pmem_fifo_overflow_drop = port_stats->pmem_fifo_overflow_drop;
++ drvs->rx_priority_pause_frames = port_stats->rx_priority_pause_frames;
++ drvs->rx_pause_frames = port_stats->rx_pause_frames;
++ drvs->rx_crc_errors = port_stats->rx_crc_errors;
++ drvs->rx_control_frames = port_stats->rx_control_frames;
++ drvs->rx_in_range_errors = port_stats->rx_in_range_errors;
++ drvs->rx_frame_too_long = port_stats->rx_frame_too_long;
++ drvs->rx_dropped_runt = port_stats->rx_dropped_runt;
++ drvs->rx_ip_checksum_errs = port_stats->rx_ip_checksum_errs;
++ drvs->rx_tcp_checksum_errs = port_stats->rx_tcp_checksum_errs;
++ drvs->rx_udp_checksum_errs = port_stats->rx_udp_checksum_errs;
++ drvs->rx_dropped_tcp_length = port_stats->rx_dropped_tcp_length;
++ drvs->rx_dropped_too_small = port_stats->rx_dropped_too_small;
++ drvs->rx_dropped_too_short = port_stats->rx_dropped_too_short;
++ drvs->rx_out_range_errors = port_stats->rx_out_range_errors;
++ drvs->rx_dropped_header_too_small =
++ port_stats->rx_dropped_header_too_small;
++ drvs->rx_input_fifo_overflow_drop =
++ port_stats->rx_input_fifo_overflow_drop;
++ drvs->rx_address_match_errors =
++ port_stats->rx_address_match_errors;
++ drvs->rx_alignment_symbol_errors =
++ port_stats->rx_alignment_symbol_errors;
++ drvs->rxpp_fifo_overflow_drop =
++ port_stats->rxpp_fifo_overflow_drop;
++ drvs->tx_pauseframes = port_stats->tx_pauseframes;
++ drvs->tx_controlframes = port_stats->tx_controlframes;
++ drvs->jabber_events = port_stats->jabber_events;
++ drvs->rx_drops_no_pbuf = rxf_stats->rx_drops_no_pbuf;
++ drvs->rx_drops_no_txpb = rxf_stats->rx_drops_no_txpb;
++ drvs->rx_drops_no_erx_descr = rxf_stats->rx_drops_no_erx_descr;
++ drvs->rx_drops_invalid_ring = rxf_stats->rx_drops_invalid_ring;
++ drvs->forwarded_packets = rxf_stats->forwarded_packets;
++ drvs->rx_drops_mtu = rxf_stats->rx_drops_mtu;
++ drvs->rx_drops_no_tpre_descr =
++ rxf_stats->rx_drops_no_tpre_descr;
++ drvs->rx_drops_too_many_frags =
++ rxf_stats->rx_drops_too_many_frags;
++ adapter->drv_stats.eth_red_drops = pmem_sts->eth_red_drops;
++}
++
++
++static void accumulate_16bit_val(u32 *acc, u16 val)
++{
++#define lo(x) (x & 0xFFFF)
++#define hi(x) (x & 0xFFFF0000)
++ bool wrapped = val < lo(*acc);
++ u32 newacc = hi(*acc) + val;
++
++ if (wrapped)
++ newacc += 65536;
++ ACCESS_ONCE_RW(*acc) = newacc;
++}
++
++void be_parse_stats(struct be_adapter *adapter)
++{
++ struct be_erx_stats_v1 *erx = be_erx_stats_from_cmd(adapter);
++ struct be_rx_obj *rxo;
++ int i;
++
++ if (adapter->generation == BE_GEN3) {
++ populate_be3_stats(adapter);
++ } else {
++ populate_be2_stats(adapter);
++ }
++
++ /* as erx_v1 is longer than v0, ok to use v1 defn for v0 access */
++ for_all_rx_queues(adapter, rxo, i) {
++ /* below erx HW counter can actually wrap around after
++ * 65535. Driver accumulates a 32-bit value
++ */
++ accumulate_16bit_val(&rx_stats(rxo)->rx_drops_no_frags,
++ (u16)erx->rx_drops_no_fragments[rxo->q.id]);
++ }
+ }
+
+ void netdev_stats_update(struct be_adapter *adapter)
+ {
+- struct be_hw_stats *hw_stats = hw_stats_from_cmd(adapter->stats.cmd.va);
+- struct be_rxf_stats *rxf_stats = &hw_stats->rxf;
+- struct be_port_rxf_stats *port_stats =
+- &rxf_stats->port[adapter->port_num];
+- struct net_device_stats *dev_stats = &adapter->stats.net_stats;
+- struct be_erx_stats *erx_stats = &hw_stats->erx;
++ struct be_drv_stats *drvs = &adapter->drv_stats;
++ struct net_device_stats *dev_stats = &adapter->net_stats;
++ struct be_rx_obj *rxo;
++ struct be_tx_obj *txo;
++ unsigned long pkts = 0, bytes = 0, mcast = 0, drops = 0;
++ int i;
+
+- dev_stats->rx_packets = drvr_stats(adapter)->be_rx_pkts;
+- dev_stats->tx_packets = drvr_stats(adapter)->be_tx_pkts;
+- dev_stats->rx_bytes = drvr_stats(adapter)->be_rx_bytes;
+- dev_stats->tx_bytes = drvr_stats(adapter)->be_tx_bytes;
++ for_all_rx_queues(adapter, rxo, i) {
++ pkts += rx_stats(rxo)->rx_pkts;
++ bytes += rx_stats(rxo)->rx_bytes;
++ mcast += rx_stats(rxo)->rx_mcast_pkts;
++ drops += rx_stats(rxo)->rx_drops_no_frags;
++ }
++ dev_stats->rx_packets = pkts;
++ dev_stats->rx_bytes = bytes;
++ dev_stats->multicast = mcast;
++ dev_stats->rx_dropped = drops;
++
++ pkts = bytes = 0;
++ for_all_tx_queues(adapter, txo, i) {
++ pkts += tx_stats(txo)->be_tx_pkts;
++ bytes += tx_stats(txo)->be_tx_bytes;
++ }
++ dev_stats->tx_packets = pkts;
++ dev_stats->tx_bytes = bytes;
+
+ /* bad pkts received */
+- dev_stats->rx_errors = port_stats->rx_crc_errors +
+- port_stats->rx_alignment_symbol_errors +
+- port_stats->rx_in_range_errors +
+- port_stats->rx_out_range_errors +
+- port_stats->rx_frame_too_long +
+- port_stats->rx_dropped_too_small +
+- port_stats->rx_dropped_too_short +
+- port_stats->rx_dropped_header_too_small +
+- port_stats->rx_dropped_tcp_length +
+- port_stats->rx_dropped_runt +
+- port_stats->rx_tcp_checksum_errs +
+- port_stats->rx_ip_checksum_errs +
+- port_stats->rx_udp_checksum_errs;
+-
+- /* no space in linux buffers: best possible approximation */
+- dev_stats->rx_dropped = erx_stats->rx_drops_no_fragments[0];
++ dev_stats->rx_errors = drvs->rx_crc_errors +
++ drvs->rx_alignment_symbol_errors +
++ drvs->rx_in_range_errors +
++ drvs->rx_out_range_errors +
++ drvs->rx_frame_too_long +
++ drvs->rx_dropped_too_small +
++ drvs->rx_dropped_too_short +
++ drvs->rx_dropped_header_too_small +
++ drvs->rx_dropped_tcp_length +
++ drvs->rx_dropped_runt +
++ drvs->rx_tcp_checksum_errs +
++ drvs->rx_ip_checksum_errs +
++ drvs->rx_udp_checksum_errs;
+
+ /* detailed rx errors */
+- dev_stats->rx_length_errors = port_stats->rx_in_range_errors +
+- port_stats->rx_out_range_errors +
+- port_stats->rx_frame_too_long;
++ dev_stats->rx_length_errors = drvs->rx_in_range_errors +
++ drvs->rx_out_range_errors +
++ drvs->rx_frame_too_long;
+
+- /* receive ring buffer overflow */
+- dev_stats->rx_over_errors = 0;
+-
+- dev_stats->rx_crc_errors = port_stats->rx_crc_errors;
++ dev_stats->rx_crc_errors = drvs->rx_crc_errors;
+
+ /* frame alignment errors */
+- dev_stats->rx_frame_errors = port_stats->rx_alignment_symbol_errors;
++ dev_stats->rx_frame_errors = drvs->rx_alignment_symbol_errors;
+
+ /* receiver fifo overrun */
+ /* drops_no_pbuf is no per i/f, it's per BE card */
+- dev_stats->rx_fifo_errors = port_stats->rx_fifo_overflow +
+- port_stats->rx_input_fifo_overflow +
+- rxf_stats->rx_drops_no_pbuf;
+- /* receiver missed packetd */
+- dev_stats->rx_missed_errors = 0;
+-
+- /* packet transmit problems */
+- dev_stats->tx_errors = 0;
+-
+- /* no space available in linux */
+- dev_stats->tx_dropped = 0;
+-
+- dev_stats->multicast = port_stats->rx_multicast_frames;
+- dev_stats->collisions = 0;
+-
+- /* detailed tx_errors */
+- dev_stats->tx_aborted_errors = 0;
+- dev_stats->tx_carrier_errors = 0;
+- dev_stats->tx_fifo_errors = 0;
+- dev_stats->tx_heartbeat_errors = 0;
+- dev_stats->tx_window_errors = 0;
++ dev_stats->rx_fifo_errors = drvs->rxpp_fifo_overflow_drop +
++ drvs->rx_input_fifo_overflow_drop +
++ drvs->rx_drops_no_pbuf;
+ }
+
+-void be_link_status_update(struct be_adapter *adapter, bool link_up)
++void be_link_status_update(struct be_adapter *adapter, int link_status)
+ {
+ struct net_device *netdev = adapter->netdev;
+
+ /* If link came up or went down */
+- if (adapter->link_up != link_up) {
+- if (link_up) {
++ if (adapter->link_status != link_status) {
++ adapter->link_speed = -1;
++ if (link_status == LINK_UP) {
+ netif_start_queue(netdev);
+ netif_carrier_on(netdev);
+ printk(KERN_INFO "%s: Link up\n", netdev->name);
+@@ -222,15 +491,15 @@ void be_link_status_update(struct be_adapter *adapter, bool link_up)
+ netif_carrier_off(netdev);
+ printk(KERN_INFO "%s: Link down\n", netdev->name);
+ }
+- adapter->link_up = link_up;
++ adapter->link_status = link_status;
+ }
+ }
+
+ /* Update the EQ delay n BE based on the RX frags consumed / sec */
+-static void be_rx_eqd_update(struct be_adapter *adapter)
++static void be_rx_eqd_update(struct be_adapter *adapter, struct be_rx_obj *rxo)
+ {
+- struct be_eq_obj *rx_eq = &adapter->rx_eq;
+- struct be_drvr_stats *stats = &adapter->stats.drvr_stats;
++ struct be_eq_obj *rx_eq = &rxo->rx_eq;
++ struct be_rx_stats *stats = &rxo->stats;
+ ulong now = jiffies;
+ u32 eqd;
+
+@@ -247,19 +516,17 @@ static void be_rx_eqd_update(struct be_adapter *adapter)
+ if ((now - stats->rx_fps_jiffies) < HZ)
+ return;
+
+- stats->be_rx_fps = (stats->be_rx_frags - stats->be_prev_rx_frags) /
++ stats->rx_fps = (stats->rx_frags - stats->prev_rx_frags) /
+ ((now - stats->rx_fps_jiffies) / HZ);
+
+ stats->rx_fps_jiffies = now;
+- stats->be_prev_rx_frags = stats->be_rx_frags;
+- eqd = stats->be_rx_fps / 110000;
++ stats->prev_rx_frags = stats->rx_frags;
++ eqd = stats->rx_fps / 110000;
+ eqd = eqd << 3;
+ if (eqd > rx_eq->max_eqd)
+ eqd = rx_eq->max_eqd;
+ if (eqd < rx_eq->min_eqd)
+ eqd = rx_eq->min_eqd;
+- if (eqd < 10)
+- eqd = 0;
+ if (eqd != rx_eq->cur_eqd)
+ be_cmd_modify_eqd(adapter, rx_eq->q.id, eqd);
+
+@@ -270,7 +537,7 @@ static struct net_device_stats *be_get_stats(struct net_device *dev)
+ {
+ struct be_adapter *adapter = netdev_priv(dev);
+
+- return &adapter->stats.net_stats;
++ return &adapter->net_stats;
+ }
+
+ static u32 be_calc_rate(u64 bytes, unsigned long ticks)
+@@ -284,9 +551,9 @@ static u32 be_calc_rate(u64 bytes, unsigned long ticks)
+ return rate;
+ }
+
+-static void be_tx_rate_update(struct be_adapter *adapter)
++static void be_tx_rate_update(struct be_tx_obj *txo)
+ {
+- struct be_drvr_stats *stats = drvr_stats(adapter);
++ struct be_tx_stats *stats = tx_stats(txo);
+ ulong now = jiffies;
+
+ /* Wrapped around? */
+@@ -305,10 +572,11 @@ static void be_tx_rate_update(struct be_adapter *adapter)
+ }
+ }
+
+-static void be_tx_stats_update(struct be_adapter *adapter,
++static void be_tx_stats_update(struct be_tx_obj *txo,
+ u32 wrb_cnt, u32 copied, u32 gso_segs, bool stopped)
+ {
+- struct be_drvr_stats *stats = drvr_stats(adapter);
++ struct be_tx_stats *stats = tx_stats(txo);
++
+ stats->be_tx_reqs++;
+ stats->be_tx_wrbs += wrb_cnt;
+ stats->be_tx_bytes += copied;
+@@ -318,7 +586,8 @@ static void be_tx_stats_update(struct be_adapter *adapter,
+ }
+
+ /* Determine number of WRB entries needed to xmit data in an skb */
+-static u32 wrb_cnt_for_skb(struct sk_buff *skb, bool *dummy)
++static u32 wrb_cnt_for_skb(struct be_adapter *adapter, struct sk_buff *skb,
++ bool *dummy)
+ {
+ int cnt = (skb->len > skb->data_len);
+
+@@ -326,12 +595,13 @@ static u32 wrb_cnt_for_skb(struct sk_buff *skb, bool *dummy)
+
+ /* to account for hdr wrb */
+ cnt++;
+- if (cnt & 1) {
++ if (lancer_chip(adapter) || !(cnt & 1)) {
++ *dummy = false;
++ } else {
+ /* add a dummy to make it an even num */
+ cnt++;
+ *dummy = true;
+- } else
+- *dummy = false;
++ }
+ BUG_ON(cnt > BE_MAX_TX_FRAG_COUNT);
+ return cnt;
+ }
+@@ -343,17 +613,31 @@ static inline void wrb_fill(struct be_eth_wrb *wrb, u64 addr, int len)
+ wrb->frag_len = len & ETH_WRB_FRAG_LEN_MASK;
+ }
+
+-static void wrb_fill_hdr(struct be_eth_hdr_wrb *hdr, struct sk_buff *skb,
+- bool vlan, u32 wrb_cnt, u32 len)
++static void wrb_fill_hdr(struct be_adapter *adapter, struct be_eth_hdr_wrb *hdr,
++ struct sk_buff *skb, u32 wrb_cnt, u32 len)
+ {
++ u16 vlan_tag = 0;
++
+ memset(hdr, 0, sizeof(*hdr));
+
+ AMAP_SET_BITS(struct amap_eth_hdr_wrb, crc, hdr, 1);
+
+- if (skb_shinfo(skb)->gso_segs > 1 && skb_shinfo(skb)->gso_size) {
++ if (skb_is_gso(skb)) {
+ AMAP_SET_BITS(struct amap_eth_hdr_wrb, lso, hdr, 1);
+ AMAP_SET_BITS(struct amap_eth_hdr_wrb, lso_mss,
+ hdr, skb_shinfo(skb)->gso_size);
++ if (skb_is_gso_v6(skb) && !lancer_chip(adapter))
++ AMAP_SET_BITS(struct amap_eth_hdr_wrb, lso6, hdr, 1);
++
++ if (lancer_A0_chip(adapter)) {
++ AMAP_SET_BITS(struct amap_eth_hdr_wrb, ipcs, hdr, 1);
++ if (is_tcp_pkt(skb))
++ AMAP_SET_BITS(struct amap_eth_hdr_wrb,
++ tcpcs, hdr, 1);
++ else if (is_udp_pkt(skb))
++ AMAP_SET_BITS(struct amap_eth_hdr_wrb,
++ udpcs, hdr, 1);
++ }
+ } else if (skb->ip_summed == CHECKSUM_PARTIAL) {
+ if (is_tcp_pkt(skb))
+ AMAP_SET_BITS(struct amap_eth_hdr_wrb, tcpcs, hdr, 1);
+@@ -361,10 +645,10 @@ static void wrb_fill_hdr(struct be_eth_hdr_wrb *hdr, struct sk_buff *skb,
+ AMAP_SET_BITS(struct amap_eth_hdr_wrb, udpcs, hdr, 1);
+ }
+
+- if (vlan && vlan_tx_tag_present(skb)) {
++ if (adapter->vlan_grp && vlan_tx_tag_present(skb)) {
+ AMAP_SET_BITS(struct amap_eth_hdr_wrb, vlan, hdr, 1);
+- AMAP_SET_BITS(struct amap_eth_hdr_wrb, vlan_tag,
+- hdr, vlan_tx_tag_get(skb));
++ vlan_tag = be_get_tx_vlan_tag(adapter, skb);
++ AMAP_SET_BITS(struct amap_eth_hdr_wrb, vlan_tag, hdr, vlan_tag);
+ }
+
+ AMAP_SET_BITS(struct amap_eth_hdr_wrb, event, hdr, 1);
+@@ -374,14 +658,13 @@ static void wrb_fill_hdr(struct be_eth_hdr_wrb *hdr, struct sk_buff *skb,
+ }
+
+
+-static int make_tx_wrbs(struct be_adapter *adapter,
++static int make_tx_wrbs(struct be_adapter *adapter, struct be_queue_info *txq,
+ struct sk_buff *skb, u32 wrb_cnt, bool dummy_wrb)
+ {
+- u64 busaddr;
+- u32 i, copied = 0;
++ dma_addr_t busaddr;
++ int i, copied = 0;
+ struct pci_dev *pdev = adapter->pdev;
+ struct sk_buff *first_skb = skb;
+- struct be_queue_info *txq = &adapter->tx_obj.q;
+ struct be_eth_wrb *wrb;
+ struct be_eth_hdr_wrb *hdr;
+
+@@ -389,15 +672,11 @@ static int make_tx_wrbs(struct be_adapter *adapter,
+ atomic_add(wrb_cnt, &txq->used);
+ queue_head_inc(txq);
+
+- if (skb_dma_map(&pdev->dev, skb, DMA_TO_DEVICE)) {
+- dev_err(&pdev->dev, "TX DMA mapping failed\n");
+- return 0;
+- }
+-
+ if (skb->len > skb->data_len) {
+- int len = skb->len - skb->data_len;
++ int len = skb_headlen(skb);
++ busaddr = pci_map_single(pdev, skb->data, len,
++ PCI_DMA_TODEVICE);
+ wrb = queue_head_node(txq);
+- busaddr = skb_shinfo(skb)->dma_head;
+ wrb_fill(wrb, busaddr, len);
+ be_dws_cpu_to_le(wrb, sizeof(*wrb));
+ queue_head_inc(txq);
+@@ -407,8 +686,9 @@ static int make_tx_wrbs(struct be_adapter *adapter,
+ for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+ struct skb_frag_struct *frag =
+ &skb_shinfo(skb)->frags[i];
+-
+- busaddr = skb_shinfo(skb)->dma_maps[i];
++ busaddr = pci_map_page(pdev, frag->page,
++ frag->page_offset,
++ frag->size, PCI_DMA_TODEVICE);
+ wrb = queue_head_node(txq);
+ wrb_fill(wrb, busaddr, frag->size);
+ be_dws_cpu_to_le(wrb, sizeof(*wrb));
+@@ -423,8 +703,7 @@ static int make_tx_wrbs(struct be_adapter *adapter,
+ queue_head_inc(txq);
+ }
+
+- wrb_fill_hdr(hdr, first_skb, adapter->vlan_grp ? true : false,
+- wrb_cnt, copied);
++ wrb_fill_hdr(adapter, hdr, first_skb, wrb_cnt, copied);
+ be_dws_cpu_to_le(hdr, sizeof(*hdr));
+
+ return copied;
+@@ -434,19 +713,70 @@ static netdev_tx_t be_xmit(struct sk_buff *skb,
+ struct net_device *netdev)
+ {
+ struct be_adapter *adapter = netdev_priv(netdev);
+- struct be_tx_obj *tx_obj = &adapter->tx_obj;
+- struct be_queue_info *txq = &tx_obj->q;
++ struct be_tx_obj *txo = &adapter->tx_obj[skb_get_queue_mapping(skb)];
++ struct be_queue_info *txq = &txo->q;
+ u32 wrb_cnt = 0, copied = 0;
+ u32 start = txq->head;
+ bool dummy_wrb, stopped = false;
+
+- wrb_cnt = wrb_cnt_for_skb(skb, &dummy_wrb);
++ if (unlikely((skb_shinfo(skb)->gso_segs > 1) &&
++ skb_shinfo(skb)->gso_size && is_ipv6_ext_hdr(skb))) {
++ tx_stats(txo)->be_ipv6_ext_hdr_tx_drop++;
++ goto tx_drop;
++ }
+
+- copied = make_tx_wrbs(adapter, skb, wrb_cnt, dummy_wrb);
++ /* If the skb is a large pkt forwarded to this interface
++ * after being LRO'd on another interface, drop the pkt.
++ * HW cannot handle such pkts. LRO must be disabled when
++ * using the server as a router.
++ */
++ if (!skb_is_gso(skb)) {
++ int eth_hdr_len = ntohs(skb->protocol) == ETH_P_8021Q ?
++ VLAN_ETH_HLEN : ETH_HLEN;
++
++ if ((skb->len - eth_hdr_len) > adapter->netdev->mtu)
++ goto tx_drop;
++ }
++
++ /* The ASIC is calculating checksum for Vlan tagged pkts
++ * though CSO is disabled.
++ * To work around this, insert the Vlan tag in the driver
++ * and donot set the vlan bit, cso bit in the Tx WRB.
++ */
++ if (unlikely(vlan_tx_tag_present(skb) &&
++ ((skb->ip_summed != CHECKSUM_PARTIAL) || (skb->len <= 60)))) {
++ /* Bug 28694: Don't embed the host VLAN tag in SKB
++ * when UMC mode enabled on that interface
++ */
++ if (!(adapter->function_mode & UMC_ENABLED)) {
++ skb = skb_share_check(skb, GFP_ATOMIC);
++ if (unlikely(!skb))
++ goto tx_drop;
++
++ skb = be_vlan_put_tag(skb,
++ be_get_tx_vlan_tag(adapter, skb));
++ if (unlikely(!skb))
++ goto tx_drop;
++
++ be_reset_skb_tx_vlan(skb);
++ }
++ }
++
++ /* Bug 12422: the stack can send us skbs with length more than 65535
++ * BE cannot handle such requests. Hack the extra data out and drop it.
++ */
++ if (skb->len > 65535) {
++ int err = __pskb_trim(skb, 65535);
++ BUG_ON(err);
++ }
++
++ wrb_cnt = wrb_cnt_for_skb(adapter, skb, &dummy_wrb);
++
++ copied = make_tx_wrbs(adapter, txq, skb, wrb_cnt, dummy_wrb);
+ if (copied) {
+ /* record the sent skb in the sent_skb table */
+- BUG_ON(tx_obj->sent_skb_list[start]);
+- tx_obj->sent_skb_list[start] = skb;
++ BUG_ON(txo->sent_skb_list[start]);
++ txo->sent_skb_list[start] = skb;
+
+ /* Ensure txq has space for the next skb; Else stop the queue
+ * *BEFORE* ringing the tx doorbell, so that we serialze the
+@@ -454,16 +784,21 @@ static netdev_tx_t be_xmit(struct sk_buff *skb,
+ */
+ if ((BE_MAX_TX_FRAG_COUNT + atomic_read(&txq->used)) >=
+ txq->len) {
+- netif_stop_queue(netdev);
++ netif_stop_subqueue(netdev, skb_get_queue_mapping(skb));
+ stopped = true;
+ }
+
+ be_txq_notify(adapter, txq->id, wrb_cnt);
+
+- be_tx_stats_update(adapter, wrb_cnt, copied,
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 32)
++ netdev->trans_start = jiffies;
++#endif
++
++ be_tx_stats_update(txo, wrb_cnt, copied,
+ skb_shinfo(skb)->gso_segs, stopped);
+ } else {
+ txq->head = start;
++tx_drop:
+ dev_kfree_skb_any(skb);
+ }
+ return NETDEV_TX_OK;
+@@ -473,10 +808,12 @@ static int be_change_mtu(struct net_device *netdev, int new_mtu)
+ {
+ struct be_adapter *adapter = netdev_priv(netdev);
+ if (new_mtu < BE_MIN_MTU ||
+- new_mtu > BE_MAX_JUMBO_FRAME_SIZE) {
++ new_mtu > (BE_MAX_JUMBO_FRAME_SIZE -
++ (ETH_HLEN + ETH_FCS_LEN))) {
+ dev_info(&adapter->pdev->dev,
+ "MTU must be between %d and %d bytes\n",
+- BE_MIN_MTU, BE_MAX_JUMBO_FRAME_SIZE);
++ BE_MIN_MTU,
++ (BE_MAX_JUMBO_FRAME_SIZE - (ETH_HLEN + ETH_FCS_LEN)));
+ return -EINVAL;
+ }
+ dev_info(&adapter->pdev->dev, "MTU changed from %d to %d bytes\n",
+@@ -486,17 +823,19 @@ static int be_change_mtu(struct net_device *netdev, int new_mtu)
+ }
+
+ /*
+- * if there are BE_NUM_VLANS_SUPPORTED or lesser number of VLANS configured,
+- * program them in BE. If more than BE_NUM_VLANS_SUPPORTED are configured,
+- * set the BE in promiscuous VLAN mode.
++ * A max of 64 (BE_NUM_VLANS_SUPPORTED) vlans can be configured in BE.
++ * If the user configures more, place BE in vlan promiscuous mode.
+ */
+-static int be_vid_config(struct be_adapter *adapter)
++static int be_vid_config(struct be_adapter *adapter, bool vf, u32 vf_num)
+ {
+ u16 vtag[BE_NUM_VLANS_SUPPORTED];
+ u16 ntags = 0, i;
+- int status;
++ int status = 0;
+
+- if (adapter->num_vlans <= BE_NUM_VLANS_SUPPORTED) {
++ /* No need to change the VLAN state if the I/F is in promiscous */
++ if (adapter->promiscuous)
++ return 0;
++ if (adapter->vlans_added <= adapter->max_vlans) {
+ /* Construct VLAN Table to give to HW */
+ for (i = 0; i < VLAN_GROUP_ARRAY_LEN; i++) {
+ if (adapter->vlan_tag[i]) {
+@@ -504,47 +843,46 @@ static int be_vid_config(struct be_adapter *adapter)
+ ntags++;
+ }
+ }
+- status = be_cmd_vlan_config(adapter, adapter->if_handle,
+- vtag, ntags, 1, 0);
++ /* Send command only if there is something to be programmed */
++ if (ntags)
++ status = be_cmd_vlan_config(adapter, adapter->if_handle,
++ vtag, ntags, 1, 0);
+ } else {
+ status = be_cmd_vlan_config(adapter, adapter->if_handle,
+- NULL, 0, 1, 1);
++ NULL, 0, 1, 1);
+ }
++
+ return status;
+ }
+
+ static void be_vlan_register(struct net_device *netdev, struct vlan_group *grp)
+ {
+ struct be_adapter *adapter = netdev_priv(netdev);
+- struct be_eq_obj *rx_eq = &adapter->rx_eq;
+- struct be_eq_obj *tx_eq = &adapter->tx_eq;
+
+- be_eq_notify(adapter, rx_eq->q.id, false, false, 0);
+- be_eq_notify(adapter, tx_eq->q.id, false, false, 0);
+ adapter->vlan_grp = grp;
+- be_eq_notify(adapter, rx_eq->q.id, true, false, 0);
+- be_eq_notify(adapter, tx_eq->q.id, true, false, 0);
+ }
+
+ static void be_vlan_add_vid(struct net_device *netdev, u16 vid)
+ {
+ struct be_adapter *adapter = netdev_priv(netdev);
+
+- adapter->num_vlans++;
++ adapter->vlans_added++;
++
+ adapter->vlan_tag[vid] = 1;
+-
+- be_vid_config(adapter);
++ if (adapter->vlans_added <= (adapter->max_vlans + 1))
++ be_vid_config(adapter, false, 0);
+ }
+
+ static void be_vlan_rem_vid(struct net_device *netdev, u16 vid)
+ {
+ struct be_adapter *adapter = netdev_priv(netdev);
+
+- adapter->num_vlans--;
+- adapter->vlan_tag[vid] = 0;
+-
++ adapter->vlans_added--;
+ vlan_group_set_device(adapter->vlan_grp, vid, NULL);
+- be_vid_config(adapter);
++
++ adapter->vlan_tag[vid] = 0;
++ if (adapter->vlans_added <= adapter->max_vlans)
++ be_vid_config(adapter, false, 0);
+ }
+
+ static void be_set_multicast_list(struct net_device *netdev)
+@@ -552,7 +890,7 @@ static void be_set_multicast_list(struct net_device *netdev)
+ struct be_adapter *adapter = netdev_priv(netdev);
+
+ if (netdev->flags & IFF_PROMISC) {
+- be_cmd_promiscuous_config(adapter, adapter->port_num, 1);
++ be_cmd_rx_filter(adapter, IFF_PROMISC, ON);
+ adapter->promiscuous = true;
+ goto done;
+ }
+@@ -560,81 +898,244 @@ static void be_set_multicast_list(struct net_device *netdev)
+ /* BE was previously in promiscous mode; disable it */
+ if (adapter->promiscuous) {
+ adapter->promiscuous = false;
+- be_cmd_promiscuous_config(adapter, adapter->port_num, 0);
++ be_cmd_rx_filter(adapter, IFF_PROMISC, OFF);
++
++ if (adapter->vlans_added)
++ be_vid_config(adapter, false, 0);
+ }
+
+- if (netdev->flags & IFF_ALLMULTI) {
+- be_cmd_multicast_set(adapter, adapter->if_handle, NULL, 0);
++ /* Enable multicast promisc if num configured exceeds what we support */
++ if (netdev->flags & IFF_ALLMULTI ||
++ netdev_mc_count(netdev) > BE_MAX_MC) {
++ be_cmd_rx_filter(adapter, IFF_ALLMULTI, ON);
+ goto done;
+ }
+
+- be_cmd_multicast_set(adapter, adapter->if_handle, netdev->mc_list,
+- netdev->mc_count);
++ be_cmd_rx_filter(adapter, IFF_MULTICAST, ON);
+ done:
+ return;
+ }
+
+-static void be_rx_rate_update(struct be_adapter *adapter)
++#ifdef HAVE_SRIOV_CONFIG
++static int be_set_vf_mac(struct net_device *netdev, int vf, u8 *mac)
+ {
+- struct be_drvr_stats *stats = drvr_stats(adapter);
++ struct be_adapter *adapter = netdev_priv(netdev);
++ int status;
++
++ if (adapter->num_vfs == 0)
++ return -EPERM;
++
++ if (!is_valid_ether_addr(mac) || (vf >= adapter->num_vfs))
++ return -EINVAL;
++
++ if (adapter->vf_cfg[vf].vf_pmac_id != BE_INVALID_PMAC_ID)
++ status = be_cmd_pmac_del(adapter,
++ adapter->vf_cfg[vf].vf_if_handle,
++ adapter->vf_cfg[vf].vf_pmac_id, vf + 1);
++
++ status = be_cmd_pmac_add(adapter, mac,
++ adapter->vf_cfg[vf].vf_if_handle,
++ &adapter->vf_cfg[vf].vf_pmac_id, vf + 1);
++
++ if (status)
++ dev_err(&adapter->pdev->dev, "MAC %pM set on VF %d Failed\n",
++ mac, vf);
++ else
++ memcpy(adapter->vf_cfg[vf].vf_mac_addr, mac, ETH_ALEN);
++
++ return status;
++}
++
++static int be_get_vf_config(struct net_device *netdev, int vf,
++ struct ifla_vf_info *vi)
++{
++ struct be_adapter *adapter = netdev_priv(netdev);
++
++ if (adapter->num_vfs == 0)
++ return -EPERM;
++
++ if (vf >= adapter->num_vfs)
++ return -EINVAL;
++
++ vi->vf = vf;
++ vi->tx_rate = adapter->vf_cfg[vf].vf_tx_rate;
++ vi->vlan = adapter->vf_cfg[vf].vf_vlan_tag & VLAN_VID_MASK;
++ vi->qos = adapter->vf_cfg[vf].vf_vlan_tag >> VLAN_PRIO_SHIFT;
++ memcpy(&vi->mac, adapter->vf_cfg[vf].vf_mac_addr, ETH_ALEN);
++
++ return 0;
++}
++
++/*
++ * Entry point to configure vlan behavior for a VF.
++ * 1. By default a VF is vlan Challenged.
++ * 2. It may or may not have Transparent Tagging enabled.
++ * 3. Vlan privilege for a VF can be toggled using special VID 4095.
++ * 4. When removing the Vlan privilege for a VF there is no need set default vid
++ * 5. Transparent Tagging configured for a VF resets its Vlan privilege
++ * 6. To disable the current Transparet Tagging for a VF:
++ * 6a. run the last iproute command with vlan set to 0.
++ * 6b. programing the default vid will disable Transparent Tagging in ARM/ASIC
++ */
++static int be_set_vf_vlan(struct net_device *netdev,
++ int vf, u16 vlan, u8 qos)
++{
++ struct be_adapter *adapter = netdev_priv(netdev);
++ int status = 0;
++ u32 en = 0;
++
++ if (adapter->num_vfs == 0)
++ return -EPERM;
++
++ if ((vf >= adapter->num_vfs) || (vlan > 4095) || (qos > 7))
++ return -EINVAL;
++
++ status = be_cmd_get_fn_privileges(adapter, &en, vf + 1);
++ if (status)
++ goto sts;
++
++ if (vlan == 4095) {
++ if (en & BE_PRIV_FILTMGMT) {
++ /* Knock off filtering privileges */
++ en &= ~BE_PRIV_FILTMGMT;
++ } else {
++ en |= BE_PRIV_FILTMGMT;
++ /* Transparent Tagging is currently enabled, Reset it */
++ if (adapter->vf_cfg[vf].vf_vlan_tag) {
++ adapter->vf_cfg[vf].vf_vlan_tag = 0;
++ vlan = adapter->vf_cfg[vf].vf_def_vid;
++ be_cmd_set_hsw_config(adapter, vlan, vf + 1,
++ adapter->vf_cfg[vf].vf_if_handle);
++ }
++ }
++
++ adapter->vf_cfg[vf].vf_vlan_tag = 0;
++ status = be_cmd_set_fn_privileges(adapter, en, NULL, vf + 1);
++
++ goto sts;
++ }
++
++ if (vlan || qos) {
++ if (en & BE_PRIV_FILTMGMT) {
++ /* Check privilege and reset it to default */
++ en &= ~BE_PRIV_FILTMGMT;
++ be_cmd_set_fn_privileges(adapter, en, NULL, vf + 1);
++ }
++
++ vlan |= qos << VLAN_PRIO_SHIFT;
++ if (adapter->vf_cfg[vf].vf_vlan_tag != vlan) {
++ /* If this is new value, program it. Else skip. */
++ adapter->vf_cfg[vf].vf_vlan_tag = vlan;
++
++ status = be_cmd_set_hsw_config(adapter, vlan,
++ vf + 1, adapter->vf_cfg[vf].vf_if_handle);
++ }
++
++ } else {
++ /* Reset Transparent Vlan Tagging. */
++ adapter->vf_cfg[vf].vf_vlan_tag = 0;
++ vlan = adapter->vf_cfg[vf].vf_def_vid;
++ status = be_cmd_set_hsw_config(adapter, vlan, vf + 1,
++ adapter->vf_cfg[vf].vf_if_handle);
++ }
++
++sts:
++ if (status)
++ dev_info(&adapter->pdev->dev,
++ "VLAN %d config on VF %d failed\n", vlan, vf);
++ return status;
++}
++
++static int be_set_vf_tx_rate(struct net_device *netdev,
++ int vf, int rate)
++{
++ struct be_adapter *adapter = netdev_priv(netdev);
++ int status = 0;
++
++ if (adapter->num_vfs == 0)
++ return -EPERM;
++
++ if ((vf >= adapter->num_vfs) || (rate < 0))
++ return -EINVAL;
++
++ if (rate > 10000)
++ rate = 10000;
++
++ adapter->vf_cfg[vf].vf_tx_rate = rate;
++ status = be_cmd_set_qos(adapter, rate / 10, vf + 1);
++
++ if (status)
++ dev_info(&adapter->pdev->dev,
++ "tx rate %d on VF %d failed\n", rate, vf);
++ return status;
++}
++#endif /* HAVE_SRIOV_CONFIG */
++
++static void be_rx_rate_update(struct be_rx_obj *rxo)
++{
++ struct be_rx_stats *stats = &rxo->stats;
+ ulong now = jiffies;
+
+ /* Wrapped around */
+- if (time_before(now, stats->be_rx_jiffies)) {
+- stats->be_rx_jiffies = now;
++ if (time_before(now, stats->rx_jiffies)) {
++ stats->rx_jiffies = now;
+ return;
+ }
+
+ /* Update the rate once in two seconds */
+- if ((now - stats->be_rx_jiffies) < 2 * HZ)
++ if ((now - stats->rx_jiffies) < 2 * HZ)
+ return;
+
+- stats->be_rx_rate = be_calc_rate(stats->be_rx_bytes
+- - stats->be_rx_bytes_prev,
+- now - stats->be_rx_jiffies);
+- stats->be_rx_jiffies = now;
+- stats->be_rx_bytes_prev = stats->be_rx_bytes;
++ stats->rx_rate = be_calc_rate(stats->rx_bytes - stats->rx_bytes_prev,
++ now - stats->rx_jiffies);
++ stats->rx_jiffies = now;
++ stats->rx_bytes_prev = stats->rx_bytes;
+ }
+
+-static void be_rx_stats_update(struct be_adapter *adapter,
+- u32 pktsize, u16 numfrags)
++static void be_rx_stats_update(struct be_rx_obj *rxo,
++ struct be_rx_compl_info *rxcp)
+ {
+- struct be_drvr_stats *stats = drvr_stats(adapter);
++ struct be_rx_stats *stats = &rxo->stats;
+
+- stats->be_rx_compl++;
+- stats->be_rx_frags += numfrags;
+- stats->be_rx_bytes += pktsize;
+- stats->be_rx_pkts++;
++ stats->rx_compl++;
++ stats->rx_frags += rxcp->num_rcvd;
++ stats->rx_bytes += rxcp->pkt_size;
++ stats->rx_pkts++;
++ if (rxcp->pkt_type == BE_MULTICAST_PACKET)
++ stats->rx_mcast_pkts++;
++ if (rxcp->err)
++ stats->rxcp_err++;
+ }
+
+-static inline bool do_pkt_csum(struct be_eth_rx_compl *rxcp, bool cso)
++static inline bool csum_passed(struct be_rx_compl_info *rxcp)
+ {
+- u8 l4_cksm, ip_version, ipcksm, tcpf = 0, udpf = 0, ipv6_chk;
+-
+- l4_cksm = AMAP_GET_BITS(struct amap_eth_rx_compl, l4_cksm, rxcp);
+- ipcksm = AMAP_GET_BITS(struct amap_eth_rx_compl, ipcksm, rxcp);
+- ip_version = AMAP_GET_BITS(struct amap_eth_rx_compl, ip_version, rxcp);
+- if (ip_version) {
+- tcpf = AMAP_GET_BITS(struct amap_eth_rx_compl, tcpf, rxcp);
+- udpf = AMAP_GET_BITS(struct amap_eth_rx_compl, udpf, rxcp);
+- }
+- ipv6_chk = (ip_version && (tcpf || udpf));
+-
+- return ((l4_cksm && ipv6_chk && ipcksm) && cso) ? false : true;
++ /* L4 checksum is not reliable for non TCP/UDP packets.
++ * Also ignore ipcksm for ipv6 pkts */
++ return (rxcp->tcpf || rxcp->udpf) && rxcp->l4_csum &&
++ (rxcp->ip_csum || rxcp->ipv6);
+ }
+
+ static struct be_rx_page_info *
+-get_rx_page_info(struct be_adapter *adapter, u16 frag_idx)
++get_rx_page_info(struct be_adapter *adapter, struct be_rx_obj *rxo,
++ u16 frag_idx)
+ {
+ struct be_rx_page_info *rx_page_info;
+- struct be_queue_info *rxq = &adapter->rx_obj.q;
++ struct be_queue_info *rxq = &rxo->q;
+
+- rx_page_info = &adapter->rx_obj.page_info_tbl[frag_idx];
+- BUG_ON(!rx_page_info->page);
++ rx_page_info = &rxo->page_info_tbl[frag_idx];
++ if (!rx_page_info->page) {
++ printk(KERN_EMERG "curr_idx=%d prev_dix=%d rxq->head=%d\n",
++ frag_idx, rxo->prev_frag_idx, rxq->head);
++ BUG_ON(!rx_page_info->page);
++ }
+
+- if (rx_page_info->last_page_user)
++ if (rx_page_info->last_page_user) {
+ pci_unmap_page(adapter->pdev, pci_unmap_addr(rx_page_info, bus),
+ adapter->big_page_size, PCI_DMA_FROMDEVICE);
++ rx_page_info->last_page_user = false;
++ }
++
++ rxo->prev_frag_idx = frag_idx;
+
+ atomic_dec(&rxq->used);
+ return rx_page_info;
+@@ -642,20 +1143,26 @@ get_rx_page_info(struct be_adapter *adapter, u16 frag_idx)
+
+ /* Throwaway the data in the Rx completion */
+ static void be_rx_compl_discard(struct be_adapter *adapter,
+- struct be_eth_rx_compl *rxcp)
++ struct be_rx_obj *rxo,
++ struct be_rx_compl_info *rxcp)
+ {
+- struct be_queue_info *rxq = &adapter->rx_obj.q;
++ struct be_queue_info *rxq = &rxo->q;
+ struct be_rx_page_info *page_info;
+- u16 rxq_idx, i, num_rcvd;
++ u16 i;
++ bool oob_error;
++ u16 num_rcvd = rxcp->num_rcvd;
+
+- rxq_idx = AMAP_GET_BITS(struct amap_eth_rx_compl, fragndx, rxcp);
+- num_rcvd = AMAP_GET_BITS(struct amap_eth_rx_compl, numfrags, rxcp);
++ oob_error = lancer_A0_chip(adapter) && rxcp->err;
++
++ /* In case of OOB error num_rcvd will be 1 more than actual */
++ if (oob_error && num_rcvd)
++ num_rcvd -= 1;
+
+ for (i = 0; i < num_rcvd; i++) {
+- page_info = get_rx_page_info(adapter, rxq_idx);
++ page_info = get_rx_page_info(adapter, rxo, rxcp->rxq_idx);
+ put_page(page_info->page);
+ memset(page_info, 0, sizeof(*page_info));
+- index_inc(&rxq_idx, rxq->len);
++ index_inc(&rxcp->rxq_idx, rxq->len);
+ }
+ }
+
+@@ -663,29 +1170,24 @@ static void be_rx_compl_discard(struct be_adapter *adapter,
+ * skb_fill_rx_data forms a complete skb for an ether frame
+ * indicated by rxcp.
+ */
+-static void skb_fill_rx_data(struct be_adapter *adapter,
+- struct sk_buff *skb, struct be_eth_rx_compl *rxcp)
++static void skb_fill_rx_data(struct be_adapter *adapter, struct be_rx_obj *rxo,
++ struct sk_buff *skb, struct be_rx_compl_info *rxcp)
+ {
+- struct be_queue_info *rxq = &adapter->rx_obj.q;
++ struct be_queue_info *rxq = &rxo->q;
+ struct be_rx_page_info *page_info;
+- u16 rxq_idx, i, num_rcvd, j;
+- u32 pktsize, hdr_len, curr_frag_len, size;
++ u16 i, j;
++ u16 hdr_len, curr_frag_len, remaining;
+ u8 *start;
+
+- rxq_idx = AMAP_GET_BITS(struct amap_eth_rx_compl, fragndx, rxcp);
+- pktsize = AMAP_GET_BITS(struct amap_eth_rx_compl, pktsize, rxcp);
+- num_rcvd = AMAP_GET_BITS(struct amap_eth_rx_compl, numfrags, rxcp);
+-
+- page_info = get_rx_page_info(adapter, rxq_idx);
+-
++ page_info = get_rx_page_info(adapter, rxo, rxcp->rxq_idx);
+ start = page_address(page_info->page) + page_info->page_offset;
+ prefetch(start);
+
+ /* Copy data in the first descriptor of this completion */
+- curr_frag_len = min(pktsize, rx_frag_size);
++ curr_frag_len = min(rxcp->pkt_size, rx_frag_size);
+
+ /* Copy the header portion into skb_data */
+- hdr_len = min((u32)BE_HDR_LEN, curr_frag_len);
++ hdr_len = min(BE_HDR_LEN, curr_frag_len);
+ memcpy(skb->data, start, hdr_len);
+ skb->len = curr_frag_len;
+ if (curr_frag_len <= BE_HDR_LEN) { /* tiny packet */
+@@ -702,21 +1204,19 @@ static void skb_fill_rx_data(struct be_adapter *adapter,
+ skb->data_len = curr_frag_len - hdr_len;
+ skb->tail += hdr_len;
+ }
+- memset(page_info, 0, sizeof(*page_info));
++ page_info->page = NULL;
+
+- if (pktsize <= rx_frag_size) {
+- BUG_ON(num_rcvd != 1);
+- goto done;
++ if (rxcp->pkt_size <= rx_frag_size) {
++ BUG_ON(rxcp->num_rcvd != 1);
++ return;
+ }
+
+ /* More frags present for this completion */
+- size = pktsize;
+- for (i = 1, j = 0; i < num_rcvd; i++) {
+- size -= curr_frag_len;
+- index_inc(&rxq_idx, rxq->len);
+- page_info = get_rx_page_info(adapter, rxq_idx);
+-
+- curr_frag_len = min(size, rx_frag_size);
++ index_inc(&rxcp->rxq_idx, rxq->len);
++ remaining = rxcp->pkt_size - curr_frag_len;
++ for (i = 1, j = 0; i < rxcp->num_rcvd; i++) {
++ page_info = get_rx_page_info(adapter, rxo, rxcp->rxq_idx);
++ curr_frag_len = min(remaining, rx_frag_size);
+
+ /* Coalesce all frags from the same physical page in one slot */
+ if (page_info->page_offset == 0) {
+@@ -735,99 +1235,122 @@ static void skb_fill_rx_data(struct be_adapter *adapter,
+ skb->len += curr_frag_len;
+ skb->data_len += curr_frag_len;
+
+- memset(page_info, 0, sizeof(*page_info));
++ remaining -= curr_frag_len;
++ index_inc(&rxcp->rxq_idx, rxq->len);
++ page_info->page = NULL;
+ }
+ BUG_ON(j > MAX_SKB_FRAGS);
+-
+-done:
+- be_rx_stats_update(adapter, pktsize, num_rcvd);
+- return;
+ }
+
+-/* Process the RX completion indicated by rxcp when GRO is disabled */
++/* Process the RX completion indicated by rxcp when LRO is disabled */
+ static void be_rx_compl_process(struct be_adapter *adapter,
+- struct be_eth_rx_compl *rxcp)
++ struct be_rx_obj *rxo,
++ struct be_rx_compl_info *rxcp)
+ {
+ struct sk_buff *skb;
+- u32 vlanf, vid;
+- u8 vtm;
+
+- vlanf = AMAP_GET_BITS(struct amap_eth_rx_compl, vtp, rxcp);
+- vtm = AMAP_GET_BITS(struct amap_eth_rx_compl, vtm, rxcp);
+-
+- /* vlanf could be wrongly set in some cards.
+- * ignore if vtm is not set */
+- if ((adapter->cap == 0x400) && !vtm)
+- vlanf = 0;
+-
+- skb = netdev_alloc_skb(adapter->netdev, BE_HDR_LEN + NET_IP_ALIGN);
+- if (!skb) {
++ skb = netdev_alloc_skb_ip_align(adapter->netdev, BE_HDR_LEN);
++ if (unlikely(!skb)) {
+ if (net_ratelimit())
+ dev_warn(&adapter->pdev->dev, "skb alloc failed\n");
+- be_rx_compl_discard(adapter, rxcp);
++ be_rx_compl_discard(adapter, rxo, rxcp);
+ return;
+ }
+
+- skb_reserve(skb, NET_IP_ALIGN);
++ skb_fill_rx_data(adapter, rxo, skb, rxcp);
+
+- skb_fill_rx_data(adapter, skb, rxcp);
+-
+- if (do_pkt_csum(rxcp, adapter->rx_csum))
+- skb->ip_summed = CHECKSUM_NONE;
+- else
++ if (likely(adapter->rx_csum && csum_passed(rxcp)))
+ skb->ip_summed = CHECKSUM_UNNECESSARY;
++ else
++ skb->ip_summed = CHECKSUM_NONE;
+
+ skb->truesize = skb->len + sizeof(struct sk_buff);
++ if (unlikely(rxcp->vlanf) &&
++ unlikely(!vlan_configured(adapter))) {
++ __vlan_put_tag(skb, rxcp->vlan_tag);
++ }
+ skb->protocol = eth_type_trans(skb, adapter->netdev);
+ skb->dev = adapter->netdev;
+
+- if (vlanf) {
+- if (!adapter->vlan_grp || adapter->num_vlans == 0) {
+- kfree_skb(skb);
+- return;
+- }
+- vid = AMAP_GET_BITS(struct amap_eth_rx_compl, vlan_tag, rxcp);
+- vid = be16_to_cpu(vid);
+- vlan_hwaccel_receive_skb(skb, adapter->vlan_grp, vid);
+- } else {
++ if (unlikely(rxcp->vlanf) &&
++ vlan_configured(adapter))
++ vlan_hwaccel_receive_skb(skb, adapter->vlan_grp,
++ rxcp->vlan_tag);
++ else
+ netif_receive_skb(skb);
++
++ return;
++}
++
++/* Process the RX completion indicated by rxcp when LRO is enabled */
++static void be_rx_compl_process_lro(struct be_adapter *adapter,
++ struct be_rx_obj *rxo,
++ struct be_rx_compl_info *rxcp)
++{
++ struct be_rx_page_info *page_info;
++ struct skb_frag_struct rx_frags[BE_MAX_FRAGS_PER_FRAME];
++ struct be_queue_info *rxq = &rxo->q;
++ u16 remaining, curr_frag_len;
++ u16 i, j;
++
++ remaining = rxcp->pkt_size;
++ for (i = 0, j = -1; i < rxcp->num_rcvd; i++) {
++ page_info = get_rx_page_info(adapter, rxo, rxcp->rxq_idx);
++
++ curr_frag_len = min(remaining, rx_frag_size);
++
++ /* Coalesce all frags from the same physical page in one slot */
++ if (i == 0 || page_info->page_offset == 0) {
++ /* First frag or Fresh page */
++ j++;
++ rx_frags[j].page = page_info->page;
++ rx_frags[j].page_offset = page_info->page_offset;
++ rx_frags[j].size = 0;
++ } else {
++ put_page(page_info->page);
++ }
++ rx_frags[j].size += curr_frag_len;
++
++ remaining -= curr_frag_len;
++ index_inc(&rxcp->rxq_idx, rxq->len);
++ memset(page_info, 0, sizeof(*page_info));
++ }
++ BUG_ON(j > MAX_SKB_FRAGS);
++
++ if (likely(!rxcp->vlanf)) {
++ lro_receive_frags(&rxo->lro_mgr, rx_frags, rxcp->pkt_size,
++ rxcp->pkt_size, NULL, 0);
++ } else {
++ lro_vlan_hwaccel_receive_frags(&rxo->lro_mgr, rx_frags,
++ rxcp->pkt_size, rxcp->pkt_size, adapter->vlan_grp,
++ rxcp->vlan_tag, NULL, 0);
+ }
+
+ return;
+ }
+
+ /* Process the RX completion indicated by rxcp when GRO is enabled */
+-static void be_rx_compl_process_gro(struct be_adapter *adapter,
+- struct be_eth_rx_compl *rxcp)
++void be_rx_compl_process_gro(struct be_adapter *adapter,
++ struct be_rx_obj *rxo,
++ struct be_rx_compl_info *rxcp)
+ {
++#ifdef NETIF_F_GRO
+ struct be_rx_page_info *page_info;
+ struct sk_buff *skb = NULL;
+- struct be_queue_info *rxq = &adapter->rx_obj.q;
+- struct be_eq_obj *eq_obj = &adapter->rx_eq;
+- u32 num_rcvd, pkt_size, remaining, vlanf, curr_frag_len;
+- u16 i, rxq_idx = 0, vid, j;
+- u8 vtm;
+-
+- num_rcvd = AMAP_GET_BITS(struct amap_eth_rx_compl, numfrags, rxcp);
+- pkt_size = AMAP_GET_BITS(struct amap_eth_rx_compl, pktsize, rxcp);
+- vlanf = AMAP_GET_BITS(struct amap_eth_rx_compl, vtp, rxcp);
+- rxq_idx = AMAP_GET_BITS(struct amap_eth_rx_compl, fragndx, rxcp);
+- vtm = AMAP_GET_BITS(struct amap_eth_rx_compl, vtm, rxcp);
+-
+- /* vlanf could be wrongly set in some cards.
+- * ignore if vtm is not set */
+- if ((adapter->cap == 0x400) && !vtm)
+- vlanf = 0;
++ struct be_queue_info *rxq = &rxo->q;
++ struct be_eq_obj *eq_obj = &rxo->rx_eq;
++ u16 remaining, curr_frag_len;
++ u16 i, j;
+
+ skb = napi_get_frags(&eq_obj->napi);
+ if (!skb) {
+- be_rx_compl_discard(adapter, rxcp);
++ be_rx_compl_discard(adapter, rxo, rxcp);
+ return;
+ }
+
+- remaining = pkt_size;
+- for (i = 0, j = -1; i < num_rcvd; i++) {
+- page_info = get_rx_page_info(adapter, rxq_idx);
++ remaining = rxcp->pkt_size;
++ for (i = 0, j = -1; i < rxcp->num_rcvd; i++) {
++ page_info = get_rx_page_info(adapter, rxo, rxcp->rxq_idx);
+
+ curr_frag_len = min(remaining, rx_frag_size);
+
+@@ -845,55 +1368,129 @@ static void be_rx_compl_process_gro(struct be_adapter *adapter,
+ skb_shinfo(skb)->frags[j].size += curr_frag_len;
+
+ remaining -= curr_frag_len;
+- index_inc(&rxq_idx, rxq->len);
++ index_inc(&rxcp->rxq_idx, rxq->len);
+ memset(page_info, 0, sizeof(*page_info));
+ }
+ BUG_ON(j > MAX_SKB_FRAGS);
+
+ skb_shinfo(skb)->nr_frags = j + 1;
+- skb->len = pkt_size;
+- skb->data_len = pkt_size;
+- skb->truesize += pkt_size;
++ skb->len = rxcp->pkt_size;
++ skb->data_len = rxcp->pkt_size;
++ skb->truesize += rxcp->pkt_size;
+ skb->ip_summed = CHECKSUM_UNNECESSARY;
+
+- if (likely(!vlanf)) {
++ if (likely(!rxcp->vlanf))
+ napi_gro_frags(&eq_obj->napi);
+- } else {
+- vid = AMAP_GET_BITS(struct amap_eth_rx_compl, vlan_tag, rxcp);
+- vid = be16_to_cpu(vid);
++ else
++ vlan_gro_frags(&eq_obj->napi,
++ adapter->vlan_grp, rxcp->vlan_tag);
++#endif
+
+- if (!adapter->vlan_grp || adapter->num_vlans == 0)
+- return;
+-
+- vlan_gro_frags(&eq_obj->napi, adapter->vlan_grp, vid);
+- }
+-
+- be_rx_stats_update(adapter, pkt_size, num_rcvd);
+ return;
+ }
+
+-static struct be_eth_rx_compl *be_rx_compl_get(struct be_adapter *adapter)
++static void be_parse_rx_compl_v1(struct be_adapter *adapter,
++ struct be_eth_rx_compl *compl,
++ struct be_rx_compl_info *rxcp)
+ {
+- struct be_eth_rx_compl *rxcp = queue_tail_node(&adapter->rx_obj.cq);
++ rxcp->pkt_size =
++ AMAP_GET_BITS(struct amap_eth_rx_compl_v1, pktsize, compl);
++ rxcp->vlanf = AMAP_GET_BITS(struct amap_eth_rx_compl_v1, vtp, compl);
++ rxcp->err = AMAP_GET_BITS(struct amap_eth_rx_compl_v1, err, compl);
++ rxcp->tcpf = AMAP_GET_BITS(struct amap_eth_rx_compl_v1, tcpf, compl);
++ rxcp->udpf = AMAP_GET_BITS(struct amap_eth_rx_compl_v1, udpf, compl);
++ rxcp->ip_csum =
++ AMAP_GET_BITS(struct amap_eth_rx_compl_v1, ipcksm, compl);
++ rxcp->l4_csum =
++ AMAP_GET_BITS(struct amap_eth_rx_compl_v1, l4_cksm, compl);
++ rxcp->ipv6 =
++ AMAP_GET_BITS(struct amap_eth_rx_compl_v1, ip_version, compl);
++ rxcp->rxq_idx =
++ AMAP_GET_BITS(struct amap_eth_rx_compl_v1, fragndx, compl);
++ rxcp->num_rcvd =
++ AMAP_GET_BITS(struct amap_eth_rx_compl_v1, numfrags, compl);
++ rxcp->pkt_type =
++ AMAP_GET_BITS(struct amap_eth_rx_compl_v1, cast_enc, compl);
++ if (rxcp->vlanf) {
++ rxcp->vtm = AMAP_GET_BITS(struct amap_eth_rx_compl_v1, vtm,
++ compl);
++ rxcp->vlan_tag = AMAP_GET_BITS(struct amap_eth_rx_compl_v1,
++ vlan_tag, compl);
++ }
++ rxcp->port = AMAP_GET_BITS(struct amap_eth_rx_compl_v1, port, compl);
++}
+
+- if (rxcp->dw[offsetof(struct amap_eth_rx_compl, valid) / 32] == 0)
++static void be_parse_rx_compl_v0(struct be_adapter *adapter,
++ struct be_eth_rx_compl *compl,
++ struct be_rx_compl_info *rxcp)
++{
++ rxcp->pkt_size =
++ AMAP_GET_BITS(struct amap_eth_rx_compl_v0, pktsize, compl);
++ rxcp->vlanf = AMAP_GET_BITS(struct amap_eth_rx_compl_v0, vtp, compl);
++ rxcp->err = AMAP_GET_BITS(struct amap_eth_rx_compl_v0, err, compl);
++ rxcp->tcpf = AMAP_GET_BITS(struct amap_eth_rx_compl_v0, tcpf, compl);
++ rxcp->udpf = AMAP_GET_BITS(struct amap_eth_rx_compl_v0, udpf, compl);
++ rxcp->ip_csum =
++ AMAP_GET_BITS(struct amap_eth_rx_compl_v0, ipcksm, compl);
++ rxcp->l4_csum =
++ AMAP_GET_BITS(struct amap_eth_rx_compl_v0, l4_cksm, compl);
++ rxcp->ipv6 =
++ AMAP_GET_BITS(struct amap_eth_rx_compl_v0, ip_version, compl);
++ rxcp->rxq_idx =
++ AMAP_GET_BITS(struct amap_eth_rx_compl_v0, fragndx, compl);
++ rxcp->num_rcvd =
++ AMAP_GET_BITS(struct amap_eth_rx_compl_v0, numfrags, compl);
++ rxcp->pkt_type =
++ AMAP_GET_BITS(struct amap_eth_rx_compl_v0, cast_enc, compl);
++ if (rxcp->vlanf) {
++ rxcp->vtm = AMAP_GET_BITS(struct amap_eth_rx_compl_v0, vtm,
++ compl);
++ rxcp->vlan_tag = AMAP_GET_BITS(struct amap_eth_rx_compl_v0,
++ vlan_tag, compl);
++ }
++ rxcp->port = AMAP_GET_BITS(struct amap_eth_rx_compl_v0, port, compl);
++}
++
++static struct be_rx_compl_info *be_rx_compl_get(struct be_rx_obj *rxo)
++{
++ struct be_eth_rx_compl *compl = queue_tail_node(&rxo->cq);
++ struct be_rx_compl_info *rxcp = &rxo->rxcp;
++ struct be_adapter *adapter = rxo->adapter;
++
++ /* For checking the valid bit it is Ok to use either definition as the
++ * valid bit is at the same position in both v0 and v1 Rx compl */
++ if (compl->dw[offsetof(struct amap_eth_rx_compl_v1, valid) / 32] == 0)
+ return NULL;
+
+- be_dws_le_to_cpu(rxcp, sizeof(*rxcp));
++ rmb();
++ be_dws_le_to_cpu(compl, sizeof(*compl));
+
+- queue_tail_inc(&adapter->rx_obj.cq);
++ if (adapter->be3_native)
++ be_parse_rx_compl_v1(adapter, compl, rxcp);
++ else
++ be_parse_rx_compl_v0(adapter, compl, rxcp);
++
++ if (rxcp->vlanf) {
++ /* vlanf could be wrongly set in some cards.
++ * ignore if vtm is not set */
++ if ((adapter->function_mode & FLEX10_MODE) && !rxcp->vtm)
++ rxcp->vlanf = 0;
++
++ if (!lancer_chip(adapter))
++ rxcp->vlan_tag = swab16(rxcp->vlan_tag);
++
++ if ((adapter->pvid == (rxcp->vlan_tag & VLAN_VID_MASK)) &&
++ !adapter->vlan_tag[rxcp->vlan_tag])
++ rxcp->vlanf = 0;
++ }
++
++ /* As the compl has been parsed, reset it; we wont touch it again */
++ compl->dw[offsetof(struct amap_eth_rx_compl_v1, valid) / 32] = 0;
++
++ queue_tail_inc(&rxo->cq);
+ return rxcp;
+ }
+
+-/* To reset the valid bit, we need to reset the whole word as
+- * when walking the queue the valid entries are little-endian
+- * and invalid entries are host endian
+- */
+-static inline void be_rx_compl_reset(struct be_eth_rx_compl *rxcp)
+-{
+- rxcp->dw[offsetof(struct amap_eth_rx_compl, valid) / 32] = 0;
+-}
+-
+ static inline struct page *be_alloc_pages(u32 size)
+ {
+ gfp_t alloc_flags = GFP_ATOMIC;
+@@ -907,11 +1504,12 @@ static inline struct page *be_alloc_pages(u32 size)
+ * Allocate a page, split it to fragments of size rx_frag_size and post as
+ * receive buffers to BE
+ */
+-static void be_post_rx_frags(struct be_adapter *adapter)
++static void be_post_rx_frags(struct be_rx_obj *rxo)
+ {
+- struct be_rx_page_info *page_info_tbl = adapter->rx_obj.page_info_tbl;
+- struct be_rx_page_info *page_info = NULL;
+- struct be_queue_info *rxq = &adapter->rx_obj.q;
++ struct be_adapter *adapter = rxo->adapter;
++ struct be_rx_page_info *page_info_tbl = rxo->page_info_tbl;
++ struct be_rx_page_info *page_info = NULL, *prev_page_info = NULL;
++ struct be_queue_info *rxq = &rxo->q;
+ struct page *pagep = NULL;
+ struct be_eth_rx_d *rxd;
+ u64 page_dmaaddr = 0, frag_dmaaddr;
+@@ -922,7 +1520,7 @@ static void be_post_rx_frags(struct be_adapter *adapter)
+ if (!pagep) {
+ pagep = be_alloc_pages(adapter->big_page_size);
+ if (unlikely(!pagep)) {
+- drvr_stats(adapter)->be_ethrx_post_fail++;
++ rxo->stats.rx_post_fail++;
+ break;
+ }
+ page_dmaaddr = pci_map_page(adapter->pdev, pagep, 0,
+@@ -941,7 +1539,6 @@ static void be_post_rx_frags(struct be_adapter *adapter)
+ rxd = queue_head_node(rxq);
+ rxd->fragpa_lo = cpu_to_le32(frag_dmaaddr & 0xFFFFFFFF);
+ rxd->fragpa_hi = cpu_to_le32(upper_32_bits(frag_dmaaddr));
+- queue_head_inc(rxq);
+
+ /* Any space left in the current big page for another frag? */
+ if ((page_offset + rx_frag_size + rx_frag_size) >
+@@ -949,17 +1546,24 @@ static void be_post_rx_frags(struct be_adapter *adapter)
+ pagep = NULL;
+ page_info->last_page_user = true;
+ }
++
++ prev_page_info = page_info;
++ queue_head_inc(rxq);
+ page_info = &page_info_tbl[rxq->head];
+ }
+ if (pagep)
+- page_info->last_page_user = true;
++ prev_page_info->last_page_user = true;
+
++ /* Ensure that posting buffers is the last thing done by this
++ * routine to avoid racing between rx bottom-half and
++ * be_worker (process) contexts.
++ */
+ if (posted) {
+ atomic_add(posted, &rxq->used);
+ be_rxq_notify(adapter, rxq->id, posted);
+ } else if (atomic_read(&rxq->used) == 0) {
+ /* Let be_worker replenish when memory is available */
+- adapter->rx_post_starved = true;
++ rxo->rx_post_starved = true;
+ }
+
+ return;
+@@ -972,6 +1576,7 @@ static struct be_eth_tx_compl *be_tx_compl_get(struct be_queue_info *tx_cq)
+ if (txcp->dw[offsetof(struct amap_eth_tx_compl, valid) / 32] == 0)
+ return NULL;
+
++ rmb();
+ be_dws_le_to_cpu(txcp, sizeof(*txcp));
+
+ txcp->dw[offsetof(struct amap_eth_tx_compl, valid) / 32] = 0;
+@@ -980,11 +1585,14 @@ static struct be_eth_tx_compl *be_tx_compl_get(struct be_queue_info *tx_cq)
+ return txcp;
+ }
+
+-static void be_tx_compl_process(struct be_adapter *adapter, u16 last_index)
++static u16 be_tx_compl_process(struct be_adapter *adapter,
++ struct be_tx_obj *txo, u16 last_index)
+ {
+- struct be_queue_info *txq = &adapter->tx_obj.q;
+- struct sk_buff **sent_skbs = adapter->tx_obj.sent_skb_list;
++ struct be_queue_info *txq = &txo->q;
++ struct be_eth_wrb *wrb;
++ struct sk_buff **sent_skbs = txo->sent_skb_list;
+ struct sk_buff *sent_skb;
++ u64 busaddr;
+ u16 cur_index, num_wrbs = 0;
+
+ cur_index = txq->tail;
+@@ -992,15 +1600,31 @@ static void be_tx_compl_process(struct be_adapter *adapter, u16 last_index)
+ BUG_ON(!sent_skb);
+ sent_skbs[cur_index] = NULL;
+
+- do {
++ wrb = queue_tail_node(txq);
++ be_dws_le_to_cpu(wrb, sizeof(*wrb));
++ busaddr = ((u64)wrb->frag_pa_hi << 32) | (u64)wrb->frag_pa_lo;
++ if (busaddr != 0) {
++ pci_unmap_single(adapter->pdev, busaddr,
++ wrb->frag_len, PCI_DMA_TODEVICE);
++ }
++ num_wrbs++;
++ queue_tail_inc(txq);
++
++ while (cur_index != last_index) {
+ cur_index = txq->tail;
++ wrb = queue_tail_node(txq);
++ be_dws_le_to_cpu(wrb, sizeof(*wrb));
++ busaddr = ((u64)wrb->frag_pa_hi << 32) | (u64)wrb->frag_pa_lo;
++ if (busaddr != 0) {
++ pci_unmap_page(adapter->pdev, busaddr,
++ wrb->frag_len, PCI_DMA_TODEVICE);
++ }
+ num_wrbs++;
+ queue_tail_inc(txq);
+- } while (cur_index != last_index);
++ }
+
+- atomic_sub(num_wrbs, &txq->used);
+- skb_dma_unmap(&adapter->pdev->dev, sent_skb, DMA_TO_DEVICE);
+ kfree_skb(sent_skb);
++ return num_wrbs;
+ }
+
+ static inline struct be_eq_entry *event_get(struct be_eq_obj *eq_obj)
+@@ -1010,13 +1634,15 @@ static inline struct be_eq_entry *event_get(struct be_eq_obj *eq_obj)
+ if (!eqe->evt)
+ return NULL;
+
++ rmb();
+ eqe->evt = le32_to_cpu(eqe->evt);
+ queue_tail_inc(&eq_obj->q);
+ return eqe;
+ }
+
+ static int event_handle(struct be_adapter *adapter,
+- struct be_eq_obj *eq_obj)
++ struct be_eq_obj *eq_obj,
++ bool rearm)
+ {
+ struct be_eq_entry *eqe;
+ u16 num = 0;
+@@ -1029,7 +1655,10 @@ static int event_handle(struct be_adapter *adapter,
+ /* Deal with any spurious interrupts that come
+ * without events
+ */
+- be_eq_notify(adapter, eq_obj->q.id, true, true, num);
++ if (!num)
++ rearm = true;
++
++ be_eq_notify(adapter, eq_obj->q.id, rearm, true, num);
+ if (num)
+ napi_schedule(&eq_obj->napi);
+
+@@ -1053,49 +1682,55 @@ static void be_eq_clean(struct be_adapter *adapter,
+ be_eq_notify(adapter, eq_obj->q.id, false, true, num);
+ }
+
+-static void be_rx_q_clean(struct be_adapter *adapter)
++static void be_rx_q_clean(struct be_adapter *adapter, struct be_rx_obj *rxo)
+ {
+ struct be_rx_page_info *page_info;
+- struct be_queue_info *rxq = &adapter->rx_obj.q;
+- struct be_queue_info *rx_cq = &adapter->rx_obj.cq;
+- struct be_eth_rx_compl *rxcp;
++ struct be_queue_info *rxq = &rxo->q;
++ struct be_queue_info *rx_cq = &rxo->cq;
++ struct be_rx_compl_info *rxcp;
+ u16 tail;
+
+ /* First cleanup pending rx completions */
+- while ((rxcp = be_rx_compl_get(adapter)) != NULL) {
+- be_rx_compl_discard(adapter, rxcp);
+- be_rx_compl_reset(rxcp);
++ while ((rxcp = be_rx_compl_get(rxo)) != NULL) {
++ be_rx_compl_discard(adapter, rxo, rxcp);
+ be_cq_notify(adapter, rx_cq->id, true, 1);
+ }
+
+ /* Then free posted rx buffer that were not used */
+ tail = (rxq->head + rxq->len - atomic_read(&rxq->used)) % rxq->len;
+ for (; atomic_read(&rxq->used) > 0; index_inc(&tail, rxq->len)) {
+- page_info = get_rx_page_info(adapter, tail);
++ page_info = get_rx_page_info(adapter, rxo, tail);
+ put_page(page_info->page);
+ memset(page_info, 0, sizeof(*page_info));
+ }
+ BUG_ON(atomic_read(&rxq->used));
++ rxq->tail = rxq->head = 0;
+ }
+
+-static void be_tx_compl_clean(struct be_adapter *adapter)
++static void be_tx_compl_clean(struct be_adapter *adapter,
++ struct be_tx_obj *txo)
+ {
+- struct be_queue_info *tx_cq = &adapter->tx_obj.cq;
+- struct be_queue_info *txq = &adapter->tx_obj.q;
++ struct be_queue_info *tx_cq = &txo->cq;
++ struct be_queue_info *txq = &txo->q;
+ struct be_eth_tx_compl *txcp;
+- u16 end_idx, cmpl = 0, timeo = 0;
++ u16 end_idx, cmpl = 0, timeo = 0, num_wrbs = 0;
++ struct sk_buff **sent_skbs = txo->sent_skb_list;
++ struct sk_buff *sent_skb;
++ bool dummy_wrb;
+
+ /* Wait for a max of 200ms for all the tx-completions to arrive. */
+ do {
+ while ((txcp = be_tx_compl_get(tx_cq))) {
+ end_idx = AMAP_GET_BITS(struct amap_eth_tx_compl,
+ wrb_index, txcp);
+- be_tx_compl_process(adapter, end_idx);
++ num_wrbs += be_tx_compl_process(adapter, txo, end_idx);
+ cmpl++;
+ }
+ if (cmpl) {
+ be_cq_notify(adapter, tx_cq->id, false, cmpl);
++ atomic_sub(num_wrbs, &txq->used);
+ cmpl = 0;
++ num_wrbs = 0;
+ }
+
+ if (atomic_read(&txq->used) == 0 || ++timeo > 200)
+@@ -1107,6 +1742,17 @@ static void be_tx_compl_clean(struct be_adapter *adapter)
+ if (atomic_read(&txq->used))
+ dev_err(&adapter->pdev->dev, "%d pending tx-completions\n",
+ atomic_read(&txq->used));
++
++ /* free posted tx for which compls will never arrive */
++ while (atomic_read(&txq->used)) {
++ sent_skb = sent_skbs[txq->tail];
++ end_idx = txq->tail;
++ index_adv(&end_idx,
++ wrb_cnt_for_skb(adapter, sent_skb, &dummy_wrb) - 1,
++ txq->len);
++ num_wrbs = be_tx_compl_process(adapter, txo, end_idx);
++ atomic_sub(num_wrbs, &txq->used);
++ }
+ }
+
+ static void be_mcc_queues_destroy(struct be_adapter *adapter)
+@@ -1145,8 +1791,9 @@ static int be_mcc_queues_create(struct be_adapter *adapter)
+ goto mcc_cq_destroy;
+
+ /* Ask BE to create MCC queue */
+- if (be_cmd_mccq_create(adapter, q, cq))
++ if (be_cmd_mccq_create(adapter, q, cq)) {
+ goto mcc_q_free;
++ }
+
+ return 0;
+
+@@ -1163,16 +1810,20 @@ err:
+ static void be_tx_queues_destroy(struct be_adapter *adapter)
+ {
+ struct be_queue_info *q;
++ struct be_tx_obj *txo;
++ u8 i;
+
+- q = &adapter->tx_obj.q;
+- if (q->created)
+- be_cmd_q_destroy(adapter, q, QTYPE_TXQ);
+- be_queue_free(adapter, q);
++ for_all_tx_queues(adapter, txo, i) {
++ q = &txo->q;
++ if (q->created)
++ be_cmd_q_destroy(adapter, q, QTYPE_TXQ);
++ be_queue_free(adapter, q);
+
+- q = &adapter->tx_obj.cq;
+- if (q->created)
+- be_cmd_q_destroy(adapter, q, QTYPE_CQ);
+- be_queue_free(adapter, q);
++ q = &txo->cq;
++ if (q->created)
++ be_cmd_q_destroy(adapter, q, QTYPE_CQ);
++ be_queue_free(adapter, q);
++ }
+
+ /* Clear any residual events */
+ be_eq_clean(adapter, &adapter->tx_eq);
+@@ -1183,168 +1834,210 @@ static void be_tx_queues_destroy(struct be_adapter *adapter)
+ be_queue_free(adapter, q);
+ }
+
++/* One TX event queue is shared by all TX compl qs */
+ static int be_tx_queues_create(struct be_adapter *adapter)
+ {
+ struct be_queue_info *eq, *q, *cq;
++ struct be_tx_obj *txo;
++ u8 i, tc_id;
+
+ adapter->tx_eq.max_eqd = 0;
+ adapter->tx_eq.min_eqd = 0;
+ adapter->tx_eq.cur_eqd = 96;
+ adapter->tx_eq.enable_aic = false;
+- /* Alloc Tx Event queue */
++
+ eq = &adapter->tx_eq.q;
+- if (be_queue_alloc(adapter, eq, EVNT_Q_LEN, sizeof(struct be_eq_entry)))
++ if (be_queue_alloc(adapter, eq, EVNT_Q_LEN,
++ sizeof(struct be_eq_entry)))
+ return -1;
+
+- /* Ask BE to create Tx Event queue */
+ if (be_cmd_eq_create(adapter, eq, adapter->tx_eq.cur_eqd))
+- goto tx_eq_free;
+- /* Alloc TX eth compl queue */
+- cq = &adapter->tx_obj.cq;
+- if (be_queue_alloc(adapter, cq, TX_CQ_LEN,
++ goto err;
++ adapter->tx_eq.eq_idx = adapter->eq_next_idx++;
++
++ for_all_tx_queues(adapter, txo, i) {
++ cq = &txo->cq;
++ if (be_queue_alloc(adapter, cq, TX_CQ_LEN,
+ sizeof(struct be_eth_tx_compl)))
+- goto tx_eq_destroy;
++ goto err;
+
+- /* Ask BE to create Tx eth compl queue */
+- if (be_cmd_cq_create(adapter, cq, eq, false, false, 3))
+- goto tx_cq_free;
++ if (be_cmd_cq_create(adapter, cq, eq, false, false, 3))
++ goto err;
+
+- /* Alloc TX eth queue */
+- q = &adapter->tx_obj.q;
+- if (be_queue_alloc(adapter, q, TX_Q_LEN, sizeof(struct be_eth_wrb)))
+- goto tx_cq_destroy;
++ q = &txo->q;
++ if (be_queue_alloc(adapter, q, TX_Q_LEN,
++ sizeof(struct be_eth_wrb)))
++ goto err;
+
+- /* Ask BE to create Tx eth queue */
+- if (be_cmd_txq_create(adapter, q, cq))
+- goto tx_q_free;
++ if (be_cmd_txq_create(adapter, q, cq, &tc_id))
++ goto err;
++
++ if (adapter->flags & BE_FLAGS_DCBX)
++ adapter->tc_txq_map[tc_id] = i;
++ }
+ return 0;
+
+-tx_q_free:
+- be_queue_free(adapter, q);
+-tx_cq_destroy:
+- be_cmd_q_destroy(adapter, cq, QTYPE_CQ);
+-tx_cq_free:
+- be_queue_free(adapter, cq);
+-tx_eq_destroy:
+- be_cmd_q_destroy(adapter, eq, QTYPE_EQ);
+-tx_eq_free:
+- be_queue_free(adapter, eq);
++err:
++ be_tx_queues_destroy(adapter);
+ return -1;
+ }
+
+ static void be_rx_queues_destroy(struct be_adapter *adapter)
+ {
+ struct be_queue_info *q;
++ struct be_rx_obj *rxo;
++ int i;
+
+- q = &adapter->rx_obj.q;
+- if (q->created) {
+- be_cmd_q_destroy(adapter, q, QTYPE_RXQ);
+- be_rx_q_clean(adapter);
+- }
+- be_queue_free(adapter, q);
++ for_all_rx_queues(adapter, rxo, i) {
++ be_queue_free(adapter, &rxo->q);
++
++ q = &rxo->cq;
++ if (q->created)
++ be_cmd_q_destroy(adapter, q, QTYPE_CQ);
++ be_queue_free(adapter, q);
+
+- q = &adapter->rx_obj.cq;
+- if (q->created)
+- be_cmd_q_destroy(adapter, q, QTYPE_CQ);
+- be_queue_free(adapter, q);
++ q = &rxo->rx_eq.q;
++ if (q->created)
++ be_cmd_q_destroy(adapter, q, QTYPE_EQ);
++ be_queue_free(adapter, q);
+
+- /* Clear any residual events */
+- be_eq_clean(adapter, &adapter->rx_eq);
++ kfree(rxo->page_info_tbl);
++ }
++}
+
+- q = &adapter->rx_eq.q;
+- if (q->created)
+- be_cmd_q_destroy(adapter, q, QTYPE_EQ);
+- be_queue_free(adapter, q);
++/* Is BE in a multi-channel mode */
++static inline bool be_is_mc(struct be_adapter *adapter) {
++ return (adapter->function_mode & FLEX10_MODE ||
++ adapter->function_mode & VNIC_MODE ||
++ adapter->function_mode & UMC_ENABLED);
++}
++
++static u32 be_num_rxqs_want(struct be_adapter *adapter)
++{
++ if (multi_rxq && (adapter->function_caps & BE_FUNCTION_CAPS_RSS) &&
++ adapter->num_vfs == 0 && be_physfn(adapter) &&
++ !be_is_mc(adapter)) {
++ return 1 + MAX_RSS_QS; /* one default non-RSS queue */
++ } else {
++ dev_warn(&adapter->pdev->dev,
++ "No support for multiple RX queues\n");
++ return 1;
++ }
+ }
+
+ static int be_rx_queues_create(struct be_adapter *adapter)
+ {
+ struct be_queue_info *eq, *q, *cq;
+- int rc;
++ struct be_rx_obj *rxo;
++ int rc, i;
+
++ adapter->num_rx_qs = min(be_num_rxqs_want(adapter),
++ msix_enabled(adapter) ?
++ adapter->num_msix_vec - 1 : 1);
++ if (adapter->num_rx_qs != MAX_RX_QS)
++ dev_warn(&adapter->pdev->dev,
++ "Could create only %d receive queues",
++ adapter->num_rx_qs);
++
++ adapter->max_rx_coal = gro ? BE_INIT_FRAGS_PER_FRAME : 1;
+ adapter->big_page_size = (1 << get_order(rx_frag_size)) * PAGE_SIZE;
+- adapter->rx_eq.max_eqd = BE_MAX_EQD;
+- adapter->rx_eq.min_eqd = 0;
+- adapter->rx_eq.cur_eqd = 0;
+- adapter->rx_eq.enable_aic = true;
++ for_all_rx_queues(adapter, rxo, i) {
++ rxo->adapter = adapter;
++ rxo->rx_eq.max_eqd = BE_MAX_EQD;
++ rxo->rx_eq.enable_aic = true;
+
+- /* Alloc Rx Event queue */
+- eq = &adapter->rx_eq.q;
+- rc = be_queue_alloc(adapter, eq, EVNT_Q_LEN,
+- sizeof(struct be_eq_entry));
+- if (rc)
+- return rc;
++ /* EQ */
++ eq = &rxo->rx_eq.q;
++ rc = be_queue_alloc(adapter, eq, EVNT_Q_LEN,
++ sizeof(struct be_eq_entry));
++ if (rc)
++ goto err;
+
+- /* Ask BE to create Rx Event queue */
+- rc = be_cmd_eq_create(adapter, eq, adapter->rx_eq.cur_eqd);
+- if (rc)
+- goto rx_eq_free;
++ rc = be_cmd_eq_create(adapter, eq, rxo->rx_eq.cur_eqd);
++ if (rc)
++ goto err;
+
+- /* Alloc RX eth compl queue */
+- cq = &adapter->rx_obj.cq;
+- rc = be_queue_alloc(adapter, cq, RX_CQ_LEN,
+- sizeof(struct be_eth_rx_compl));
+- if (rc)
+- goto rx_eq_destroy;
++ rxo->rx_eq.eq_idx = adapter->eq_next_idx++;
+
+- /* Ask BE to create Rx eth compl queue */
+- rc = be_cmd_cq_create(adapter, cq, eq, false, false, 3);
+- if (rc)
+- goto rx_cq_free;
++ /* CQ */
++ cq = &rxo->cq;
++ rc = be_queue_alloc(adapter, cq, RX_CQ_LEN,
++ sizeof(struct be_eth_rx_compl));
++ if (rc)
++ goto err;
+
+- /* Alloc RX eth queue */
+- q = &adapter->rx_obj.q;
+- rc = be_queue_alloc(adapter, q, RX_Q_LEN, sizeof(struct be_eth_rx_d));
+- if (rc)
+- goto rx_cq_destroy;
++ rc = be_cmd_cq_create(adapter, cq, eq, false, false, 3);
++ if (rc)
++ goto err;
+
+- /* Ask BE to create Rx eth queue */
+- rc = be_cmd_rxq_create(adapter, q, cq->id, rx_frag_size,
+- BE_MAX_JUMBO_FRAME_SIZE, adapter->if_handle, false);
+- if (rc)
+- goto rx_q_free;
++ /* Rx Q - will be created in be_open() */
++ q = &rxo->q;
++ rc = be_queue_alloc(adapter, q, RX_Q_LEN,
++ sizeof(struct be_eth_rx_d));
++ if (rc)
++ goto err;
++
++ rxo->page_info_tbl = kzalloc(sizeof(struct be_rx_page_info) *
++ RX_Q_LEN, GFP_KERNEL);
++ if (!rxo->page_info_tbl)
++ goto err;
++ }
+
+ return 0;
+-rx_q_free:
+- be_queue_free(adapter, q);
+-rx_cq_destroy:
+- be_cmd_q_destroy(adapter, cq, QTYPE_CQ);
+-rx_cq_free:
+- be_queue_free(adapter, cq);
+-rx_eq_destroy:
+- be_cmd_q_destroy(adapter, eq, QTYPE_EQ);
+-rx_eq_free:
+- be_queue_free(adapter, eq);
+- return rc;
++err:
++ be_rx_queues_destroy(adapter);
++ return -1;
+ }
+
+-/* There are 8 evt ids per func. Retruns the evt id's bit number */
+-static inline int be_evt_bit_get(struct be_adapter *adapter, u32 eq_id)
++static bool event_peek(struct be_eq_obj *eq_obj)
+ {
+- return eq_id - 8 * be_pci_func(adapter);
++ struct be_eq_entry *eqe = queue_tail_node(&eq_obj->q);
++ if (!eqe->evt)
++ return false;
++ else
++ return true;
+ }
+
+ static irqreturn_t be_intx(int irq, void *dev)
+ {
+ struct be_adapter *adapter = dev;
+- int isr;
++ struct be_rx_obj *rxo;
++ int isr, i, tx = 0 , rx = 0;
+
+- isr = ioread32(adapter->csr + CEV_ISR0_OFFSET +
+- be_pci_func(adapter) * CEV_ISR_SIZE);
+- if (!isr)
+- return IRQ_NONE;
++ if (lancer_chip(adapter)) {
++ if (event_peek(&adapter->tx_eq))
++ tx = event_handle(adapter, &adapter->tx_eq, false);
++ for_all_rx_queues(adapter, rxo, i) {
++ if (event_peek(&rxo->rx_eq))
++ rx |= event_handle(adapter, &rxo->rx_eq, true);
++ }
+
+- event_handle(adapter, &adapter->tx_eq);
+- event_handle(adapter, &adapter->rx_eq);
++ if (!(tx || rx))
++ return IRQ_NONE;
++ } else {
++ isr = ioread32(adapter->csr + CEV_ISR0_OFFSET +
++ (adapter->tx_eq.q.id / 8) * CEV_ISR_SIZE);
++ if (!isr)
++ return IRQ_NONE;
++
++ if ((1 << adapter->tx_eq.eq_idx & isr))
++ event_handle(adapter, &adapter->tx_eq, false);
++
++ for_all_rx_queues(adapter, rxo, i) {
++ if ((1 << rxo->rx_eq.eq_idx & isr))
++ event_handle(adapter, &rxo->rx_eq, true);
++ }
++ }
+
+ return IRQ_HANDLED;
+ }
+
+ static irqreturn_t be_msix_rx(int irq, void *dev)
+ {
+- struct be_adapter *adapter = dev;
++ struct be_rx_obj *rxo = dev;
++ struct be_adapter *adapter = rxo->adapter;
+
+- event_handle(adapter, &adapter->rx_eq);
++ event_handle(adapter, &rxo->rx_eq, true);
+
+ return IRQ_HANDLED;
+ }
+@@ -1353,48 +2046,72 @@ static irqreturn_t be_msix_tx_mcc(int irq, void *dev)
+ {
+ struct be_adapter *adapter = dev;
+
+- event_handle(adapter, &adapter->tx_eq);
++ event_handle(adapter, &adapter->tx_eq, false);
+
+ return IRQ_HANDLED;
+ }
+
+ static inline bool do_gro(struct be_adapter *adapter,
+- struct be_eth_rx_compl *rxcp)
++ struct be_rx_compl_info *rxcp)
+ {
+- int err = AMAP_GET_BITS(struct amap_eth_rx_compl, err, rxcp);
+- int tcp_frame = AMAP_GET_BITS(struct amap_eth_rx_compl, tcpf, rxcp);
+-
+- if (err)
+- drvr_stats(adapter)->be_rxcp_err++;
+-
+- return (tcp_frame && !err) ? true : false;
++ return (!rxcp->tcpf || rxcp->err || adapter->max_rx_coal <= 1 ||
++ (rxcp->vlanf && !vlan_configured(adapter))) ?
++ false : true;
+ }
+
+ int be_poll_rx(struct napi_struct *napi, int budget)
+ {
+ struct be_eq_obj *rx_eq = container_of(napi, struct be_eq_obj, napi);
+- struct be_adapter *adapter =
+- container_of(rx_eq, struct be_adapter, rx_eq);
+- struct be_queue_info *rx_cq = &adapter->rx_obj.cq;
+- struct be_eth_rx_compl *rxcp;
++ struct be_rx_obj *rxo = container_of(rx_eq, struct be_rx_obj, rx_eq);
++ struct be_adapter *adapter = rxo->adapter;
++ struct be_queue_info *rx_cq = &rxo->cq;
++ struct be_rx_compl_info *rxcp;
+ u32 work_done;
++ bool flush_lro = false;
+
++ rxo->stats.rx_polls++;
+ for (work_done = 0; work_done < budget; work_done++) {
+- rxcp = be_rx_compl_get(adapter);
++ rxcp = be_rx_compl_get(rxo);
+ if (!rxcp)
+ break;
+
+- if (do_gro(adapter, rxcp))
+- be_rx_compl_process_gro(adapter, rxcp);
+- else
+- be_rx_compl_process(adapter, rxcp);
++ /* Is it a flush compl that has no data */
++ if (unlikely(rxcp->num_rcvd == 0))
++ continue;
+
+- be_rx_compl_reset(rxcp);
++ if (unlikely(rxcp->port != adapter->port_num)) {
++ be_rx_compl_discard(adapter, rxo, rxcp);
++ be_rx_stats_update(rxo, rxcp);
++ continue;
++ }
++
++ if (likely((lancer_A0_chip(adapter) && !rxcp->err) ||
++ !lancer_A0_chip(adapter))) {
++ if (do_gro(adapter, rxcp)) {
++ if (adapter->gro_supported) {
++ be_rx_compl_process_gro(adapter, rxo,
++ rxcp);
++ } else {
++ be_rx_compl_process_lro(adapter, rxo,
++ rxcp);
++ flush_lro = true;
++ }
++ } else {
++ be_rx_compl_process(adapter, rxo, rxcp);
++ }
++ } else if (lancer_A0_chip(adapter) && rxcp->err) {
++ be_rx_compl_discard(adapter, rxo, rxcp);
++ }
++
++ be_rx_stats_update(rxo, rxcp);
+ }
+
++ if (flush_lro)
++ lro_flush_all(&rxo->lro_mgr);
++
+ /* Refill the queue */
+- if (atomic_read(&adapter->rx_obj.q.used) < RX_FRAGS_REFILL_WM)
+- be_post_rx_frags(adapter);
++ if (work_done && atomic_read(&rxo->q.used) < RX_FRAGS_REFILL_WM)
++ be_post_rx_frags(rxo);
+
+ /* All consumed */
+ if (work_done < budget) {
+@@ -1404,40 +2121,13 @@ int be_poll_rx(struct napi_struct *napi, int budget)
+ /* More to be consumed; continue with interrupts disabled */
+ be_cq_notify(adapter, rx_cq->id, false, work_done);
+ }
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 32)
++ adapter->netdev->last_rx = jiffies;
++#endif
+ return work_done;
+ }
+
+-void be_process_tx(struct be_adapter *adapter)
+-{
+- struct be_queue_info *txq = &adapter->tx_obj.q;
+- struct be_queue_info *tx_cq = &adapter->tx_obj.cq;
+- struct be_eth_tx_compl *txcp;
+- u32 num_cmpl = 0;
+- u16 end_idx;
+-
+- while ((txcp = be_tx_compl_get(tx_cq))) {
+- end_idx = AMAP_GET_BITS(struct amap_eth_tx_compl,
+- wrb_index, txcp);
+- be_tx_compl_process(adapter, end_idx);
+- num_cmpl++;
+- }
+-
+- if (num_cmpl) {
+- be_cq_notify(adapter, tx_cq->id, true, num_cmpl);
+-
+- /* As Tx wrbs have been freed up, wake up netdev queue if
+- * it was stopped due to lack of tx wrbs.
+- */
+- if (netif_queue_stopped(adapter->netdev) &&
+- atomic_read(&txq->used) < txq->len / 2) {
+- netif_wake_queue(adapter->netdev);
+- }
+-
+- drvr_stats(adapter)->be_tx_events++;
+- drvr_stats(adapter)->be_tx_compl += num_cmpl;
+- }
+-}
+-
+ /* As TX and MCC share the same EQ check for both TX and MCC completions.
+ * For TX/MCC we don't honour budget; consume everything
+ */
+@@ -1446,96 +2136,264 @@ static int be_poll_tx_mcc(struct napi_struct *napi, int budget)
+ struct be_eq_obj *tx_eq = container_of(napi, struct be_eq_obj, napi);
+ struct be_adapter *adapter =
+ container_of(tx_eq, struct be_adapter, tx_eq);
++ struct be_tx_obj *txo;
++ struct be_eth_tx_compl *txcp;
++ int tx_compl, mcc_compl, status = 0;
++ u8 i;
++ u16 num_wrbs;
++
++ for_all_tx_queues(adapter, txo, i) {
++ tx_compl = 0;
++ num_wrbs = 0;
++ while ((txcp = be_tx_compl_get(&txo->cq))) {
++ num_wrbs += be_tx_compl_process(adapter, txo,
++ AMAP_GET_BITS(struct amap_eth_tx_compl,
++ wrb_index, txcp));
++ tx_compl++;
++ }
++ if (tx_compl) {
++ be_cq_notify(adapter, txo->cq.id, true, tx_compl);
++
++ atomic_sub(num_wrbs, &txo->q.used);
++
++ /* As Tx wrbs have been freed up, wake up netdev queue
++ * if it was stopped due to lack of tx wrbs. */
++ if (__netif_subqueue_stopped(adapter->netdev, i) &&
++ atomic_read(&txo->q.used) < txo->q.len / 2) {
++ netif_wake_subqueue(adapter->netdev, i);
++ }
++
++ adapter->drv_stats.be_tx_events++;
++ txo->stats.be_tx_compl += tx_compl;
++ }
++ }
++
++ mcc_compl = be_process_mcc(adapter, &status);
++
++ if (mcc_compl) {
++ struct be_mcc_obj *mcc_obj = &adapter->mcc_obj;
++ be_cq_notify(adapter, mcc_obj->cq.id, true, mcc_compl);
++ }
+
+ napi_complete(napi);
+
+- be_process_tx(adapter);
+-
+- be_process_mcc(adapter);
+-
++ be_eq_notify(adapter, tx_eq->q.id, true, false, 0);
+ return 1;
+ }
+
++void be_detect_dump_ue(struct be_adapter *adapter)
++{
++ u32 ue_status_lo, ue_status_hi, ue_status_lo_mask, ue_status_hi_mask;
++ u32 i;
++
++ pci_read_config_dword(adapter->pdev,
++ PCICFG_UE_STATUS_LOW, &ue_status_lo);
++ pci_read_config_dword(adapter->pdev,
++ PCICFG_UE_STATUS_HIGH, &ue_status_hi);
++ pci_read_config_dword(adapter->pdev,
++ PCICFG_UE_STATUS_LOW_MASK, &ue_status_lo_mask);
++ pci_read_config_dword(adapter->pdev,
++ PCICFG_UE_STATUS_HI_MASK, &ue_status_hi_mask);
++
++ ue_status_lo = (ue_status_lo & (~ue_status_lo_mask));
++ ue_status_hi = (ue_status_hi & (~ue_status_hi_mask));
++
++ if (ue_status_lo || ue_status_hi) {
++ adapter->ue_detected = true;
++ adapter->eeh_err = true;
++ dev_err(&adapter->pdev->dev, "UE Detected!!\n");
++ }
++
++ if (ue_status_lo) {
++ for (i = 0; ue_status_lo; ue_status_lo >>= 1, i++) {
++ if (ue_status_lo & 1)
++ dev_err(&adapter->pdev->dev,
++ "UE: %s bit set\n", ue_status_low_desc[i]);
++ }
++ }
++ if (ue_status_hi) {
++ for (i = 0; ue_status_hi; ue_status_hi >>= 1, i++) {
++ if (ue_status_hi & 1)
++ dev_err(&adapter->pdev->dev,
++ "UE: %s bit set\n", ue_status_hi_desc[i]);
++ }
++ }
++
++}
++
+ static void be_worker(struct work_struct *work)
+ {
+ struct be_adapter *adapter =
+ container_of(work, struct be_adapter, work.work);
++ struct be_rx_obj *rxo;
++ struct be_tx_obj *txo;
++ int i;
+
+- be_cmd_get_stats(adapter, &adapter->stats.cmd);
++ if (!adapter->ue_detected && !lancer_chip(adapter))
++ be_detect_dump_ue(adapter);
+
+- /* Set EQ delay */
+- be_rx_eqd_update(adapter);
++ /* when interrupts are not yet enabled, just reap any pending
++ * mcc completions */
++ if (!netif_running(adapter->netdev)) {
++ int mcc_compl, status = 0;
+
+- be_tx_rate_update(adapter);
+- be_rx_rate_update(adapter);
++ mcc_compl = be_process_mcc(adapter, &status);
+
+- if (adapter->rx_post_starved) {
+- adapter->rx_post_starved = false;
+- be_post_rx_frags(adapter);
++ if (mcc_compl) {
++ struct be_mcc_obj *mcc_obj = &adapter->mcc_obj;
++ be_cq_notify(adapter, mcc_obj->cq.id, false, mcc_compl);
++ }
++
++ goto reschedule;
++ }
++
++ if (!adapter->stats_cmd_sent)
++ be_cmd_get_stats(adapter, &adapter->stats_cmd);
++
++ for_all_tx_queues(adapter, txo, i)
++ be_tx_rate_update(txo);
++
++ for_all_rx_queues(adapter, rxo, i) {
++ be_rx_rate_update(rxo);
++ be_rx_eqd_update(adapter, rxo);
++
++ if (rxo->rx_post_starved) {
++ rxo->rx_post_starved = false;
++ be_post_rx_frags(rxo);
++ }
+ }
+
++reschedule:
++ adapter->work_counter++;
+ schedule_delayed_work(&adapter->work, msecs_to_jiffies(1000));
+ }
+
++static void be_msix_disable(struct be_adapter *adapter)
++{
++ if (msix_enabled(adapter)) {
++ pci_disable_msix(adapter->pdev);
++ adapter->num_msix_vec = 0;
++ }
++}
++
+ static void be_msix_enable(struct be_adapter *adapter)
+ {
+- int i, status;
++#define BE_MIN_MSIX_VECTORS (1 + 1) /* Rx + Tx */
++ int i, status, num_vec;
+
+- for (i = 0; i < BE_NUM_MSIX_VECTORS; i++)
++ num_vec = be_num_rxqs_want(adapter) + 1;
++
++ for (i = 0; i < num_vec; i++)
+ adapter->msix_entries[i].entry = i;
+
+- status = pci_enable_msix(adapter->pdev, adapter->msix_entries,
+- BE_NUM_MSIX_VECTORS);
+- if (status == 0)
+- adapter->msix_enabled = true;
++ status = pci_enable_msix(adapter->pdev, adapter->msix_entries, num_vec);
++ if (status == 0) {
++ goto done;
++ } else if (status >= BE_MIN_MSIX_VECTORS) {
++ num_vec = status;
++ if (pci_enable_msix(adapter->pdev, adapter->msix_entries,
++ num_vec) == 0)
++ goto done;
++ }
+ return;
++done:
++ adapter->num_msix_vec = num_vec;
++ return;
++}
++
++static void be_sriov_enable(struct be_adapter *adapter)
++{
++ be_check_sriov_fn_type(adapter);
++#ifdef CONFIG_PCI_IOV
++ if (be_physfn(adapter) && num_vfs) {
++ int status, pos;
++ u16 nvfs;
++
++ pos = pci_find_ext_capability(adapter->pdev,
++ PCI_EXT_CAP_ID_SRIOV);
++ pci_read_config_word(adapter->pdev,
++ pos + PCI_SRIOV_TOTAL_VF, &nvfs);
++ adapter->num_vfs = num_vfs;
++ if (num_vfs > nvfs) {
++ dev_info(&adapter->pdev->dev,
++ "Device supports %d VFs and not %d\n",
++ nvfs, num_vfs);
++ adapter->num_vfs = nvfs;
++ }
++
++ status = pci_enable_sriov(adapter->pdev, adapter->num_vfs);
++ if (status)
++ adapter->num_vfs = 0;
++ }
++#endif
++}
++
++static void be_sriov_disable(struct be_adapter *adapter)
++{
++#ifdef CONFIG_PCI_IOV
++ if (adapter->num_vfs > 0) {
++ pci_disable_sriov(adapter->pdev);
++ adapter->num_vfs = 0;
++ }
++#endif
+ }
+
+-static inline int be_msix_vec_get(struct be_adapter *adapter, u32 eq_id)
++static inline int be_msix_vec_get(struct be_adapter *adapter,
++ struct be_eq_obj *eq_obj)
+ {
+- return adapter->msix_entries[
+- be_evt_bit_get(adapter, eq_id)].vector;
++ return adapter->msix_entries[eq_obj->eq_idx].vector;
+ }
+
+ static int be_request_irq(struct be_adapter *adapter,
+ struct be_eq_obj *eq_obj,
+- void *handler, char *desc)
++ void *handler, char *desc, void *context)
+ {
+ struct net_device *netdev = adapter->netdev;
+ int vec;
+
+ sprintf(eq_obj->desc, "%s-%s", netdev->name, desc);
+- vec = be_msix_vec_get(adapter, eq_obj->q.id);
+- return request_irq(vec, handler, 0, eq_obj->desc, adapter);
++ vec = be_msix_vec_get(adapter, eq_obj);
++ return request_irq(vec, handler, 0, eq_obj->desc, context);
+ }
+
+-static void be_free_irq(struct be_adapter *adapter, struct be_eq_obj *eq_obj)
++static void be_free_irq(struct be_adapter *adapter, struct be_eq_obj *eq_obj,
++ void *context)
+ {
+- int vec = be_msix_vec_get(adapter, eq_obj->q.id);
+- free_irq(vec, adapter);
++ int vec = be_msix_vec_get(adapter, eq_obj);
++ free_irq(vec, context);
+ }
+
+ static int be_msix_register(struct be_adapter *adapter)
+ {
+- int status;
++ struct be_rx_obj *rxo;
++ int status, i;
++ char qname[10];
+
+- status = be_request_irq(adapter, &adapter->tx_eq, be_msix_tx_mcc, "tx");
++ status = be_request_irq(adapter, &adapter->tx_eq, be_msix_tx_mcc, "tx",
++ adapter);
+ if (status)
+ goto err;
+
+- status = be_request_irq(adapter, &adapter->rx_eq, be_msix_rx, "rx");
+- if (status)
+- goto free_tx_irq;
++ for_all_rx_queues(adapter, rxo, i) {
++ sprintf(qname, "rxq%d", i);
++ status = be_request_irq(adapter, &rxo->rx_eq, be_msix_rx,
++ qname, rxo);
++ if (status)
++ goto err_msix;
++ }
+
+ return 0;
+
+-free_tx_irq:
+- be_free_irq(adapter, &adapter->tx_eq);
++err_msix:
++ be_free_irq(adapter, &adapter->tx_eq, adapter);
++
++ for (i--, rxo = &adapter->rx_obj[i]; i >= 0; i--, rxo--)
++ be_free_irq(adapter, &rxo->rx_eq, rxo);
++
+ err:
+ dev_warn(&adapter->pdev->dev,
+ "MSIX Request IRQ failed - err %d\n", status);
+- pci_disable_msix(adapter->pdev);
+- adapter->msix_enabled = false;
++ be_msix_disable(adapter);
+ return status;
+ }
+
+@@ -1544,10 +2402,13 @@ static int be_irq_register(struct be_adapter *adapter)
+ struct net_device *netdev = adapter->netdev;
+ int status;
+
+- if (adapter->msix_enabled) {
++ if (msix_enabled(adapter)) {
+ status = be_msix_register(adapter);
+ if (status == 0)
+ goto done;
++ /* INTx is not supported for VF */
++ if (!be_physfn(adapter))
++ return status;
+ }
+
+ /* INTx */
+@@ -1567,87 +2428,363 @@ done:
+ static void be_irq_unregister(struct be_adapter *adapter)
+ {
+ struct net_device *netdev = adapter->netdev;
++ struct be_rx_obj *rxo;
++ int i;
+
+ if (!adapter->isr_registered)
+ return;
+
+ /* INTx */
+- if (!adapter->msix_enabled) {
++ if (!msix_enabled(adapter)) {
+ free_irq(netdev->irq, adapter);
+ goto done;
+ }
+
+ /* MSIx */
+- be_free_irq(adapter, &adapter->tx_eq);
+- be_free_irq(adapter, &adapter->rx_eq);
++ be_free_irq(adapter, &adapter->tx_eq, adapter);
++
++ for_all_rx_queues(adapter, rxo, i)
++ be_free_irq(adapter, &rxo->rx_eq, rxo);
++
+ done:
+ adapter->isr_registered = false;
+- return;
+ }
+
+-static int be_open(struct net_device *netdev)
++static u16 be_select_queue(struct net_device *netdev,
++ struct sk_buff *skb)
+ {
+ struct be_adapter *adapter = netdev_priv(netdev);
+- struct be_eq_obj *rx_eq = &adapter->rx_eq;
++ u8 prio;
++
++ if (adapter->num_tx_qs == 1)
++ return 0;
++
++ prio = (vlan_tx_tag_get(skb) & VLAN_PRIO_MASK) >> VLAN_PRIO_SHIFT;
++ return adapter->tc_txq_map[adapter->prio_tc_map[prio]];
++}
++
++static void be_rx_queues_clear(struct be_adapter *adapter)
++{
++ struct be_queue_info *q;
++ struct be_rx_obj *rxo;
++ int i;
++
++ for_all_rx_queues(adapter, rxo, i) {
++ q = &rxo->q;
++ if (q->created) {
++ be_cmd_rxq_destroy(adapter, q);
++ /* After the rxq is invalidated, wait for a grace time
++ * of 1ms for all dma to end and the flush compl to
++ * arrive
++ */
++ mdelay(1);
++ be_rx_q_clean(adapter, rxo);
++ }
++
++ /* Clear any residual events */
++ q = &rxo->rx_eq.q;
++ if (q->created)
++ be_eq_clean(adapter, &rxo->rx_eq);
++ }
++}
++
++static int be_close(struct net_device *netdev)
++{
++ struct be_adapter *adapter = netdev_priv(netdev);
++ struct be_rx_obj *rxo;
++ struct be_tx_obj *txo;
+ struct be_eq_obj *tx_eq = &adapter->tx_eq;
+- bool link_up;
+- int status;
++ int vec, i;
++
++ be_async_mcc_disable(adapter);
++
++ netif_stop_queue(netdev);
++ netif_carrier_off(netdev);
++ adapter->link_status = LINK_DOWN;
++
++ if (!lancer_chip(adapter))
++ be_intr_set(adapter, false);
++
++ for_all_rx_queues(adapter, rxo, i)
++ napi_disable(&rxo->rx_eq.napi);
++
++ napi_disable(&tx_eq->napi);
++
++ if (lancer_chip(adapter)) {
++ be_cq_notify(adapter, adapter->mcc_obj.cq.id, false, 0);
++ for_all_rx_queues(adapter, rxo, i)
++ be_cq_notify(adapter, rxo->cq.id, false, 0);
++ for_all_tx_queues(adapter, txo, i)
++ be_cq_notify(adapter, txo->cq.id, false, 0);
++ }
++
++ if (msix_enabled(adapter)) {
++ vec = be_msix_vec_get(adapter, tx_eq);
++ synchronize_irq(vec);
++
++ for_all_rx_queues(adapter, rxo, i) {
++ vec = be_msix_vec_get(adapter, &rxo->rx_eq);
++ synchronize_irq(vec);
++ }
++ } else {
++ synchronize_irq(netdev->irq);
++ }
++ be_irq_unregister(adapter);
++
++ /* Wait for all pending tx completions to arrive so that
++ * all tx skbs are freed.
++ */
++ for_all_tx_queues(adapter, txo, i)
++ be_tx_compl_clean(adapter, txo);
++
++ be_rx_queues_clear(adapter);
++ return 0;
++}
++
++static int be_rx_queues_setup(struct be_adapter *adapter)
++{
++ struct be_rx_obj *rxo;
++ int rc, i;
++ u8 rsstable[MAX_RSS_QS];
++
++ for_all_rx_queues(adapter, rxo, i) {
++ rc = be_cmd_rxq_create(adapter, &rxo->q, rxo->cq.id,
++ rx_frag_size, BE_MAX_JUMBO_FRAME_SIZE,
++ adapter->if_handle,
++ (i > 0) ? 1 : 0/* rss enable */, &rxo->rss_id);
++ if (rc)
++ return rc;
++ }
++
++ if (be_multi_rxq(adapter)) {
++ for_all_rss_queues(adapter, rxo, i)
++ rsstable[i] = rxo->rss_id;
++
++ rc = be_cmd_rss_config(adapter, rsstable,
++ adapter->num_rx_qs - 1);
++ if (rc)
++ return rc;
++ }
+
+ /* First time posting */
+- be_post_rx_frags(adapter);
++ for_all_rx_queues(adapter, rxo, i) {
++ be_post_rx_frags(rxo);
++ napi_enable(&rxo->rx_eq.napi);
++ }
++ return 0;
++}
++
++static int be_open(struct net_device *netdev)
++{
++ struct be_adapter *adapter = netdev_priv(netdev);
++ struct be_eq_obj *tx_eq = &adapter->tx_eq;
++ struct be_rx_obj *rxo;
++ int link_status;
++ int status, i;
++ u8 mac_speed;
++ u16 link_speed;
++
++ status = be_rx_queues_setup(adapter);
++ if (status)
++ goto err;
+
+- napi_enable(&rx_eq->napi);
+ napi_enable(&tx_eq->napi);
+
+ be_irq_register(adapter);
+
+- be_intr_set(adapter, true);
++ if (!lancer_chip(adapter))
++ be_intr_set(adapter, true);
+
+ /* The evt queues are created in unarmed state; arm them */
+- be_eq_notify(adapter, rx_eq->q.id, true, false, 0);
++ for_all_rx_queues(adapter, rxo, i) {
++ be_eq_notify(adapter, rxo->rx_eq.q.id, true, false, 0);
++ be_cq_notify(adapter, rxo->cq.id, true, 0);
++ }
+ be_eq_notify(adapter, tx_eq->q.id, true, false, 0);
+
+- /* Rx compl queue may be in unarmed state; rearm it */
+- be_cq_notify(adapter, adapter->rx_obj.cq.id, true, 0);
++ /* Now that interrupts are on we can process async mcc */
++ be_async_mcc_enable(adapter);
+
+- status = be_cmd_link_status_query(adapter, &link_up);
++ status = be_cmd_link_status_query(adapter, &link_status, &mac_speed,
++ &link_speed, 0);
+ if (status)
+- goto ret_sts;
+- be_link_status_update(adapter, link_up);
++ goto err;
++ be_link_status_update(adapter, link_status);
+
+- status = be_vid_config(adapter);
++ status = be_vid_config(adapter, false, 0);
+ if (status)
+- goto ret_sts;
++ goto err;
+
+- status = be_cmd_set_flow_control(adapter,
+- adapter->tx_fc, adapter->rx_fc);
+- if (status)
+- goto ret_sts;
++ if (be_physfn(adapter)) {
++ status = be_cmd_set_flow_control(adapter,
++ adapter->tx_fc, adapter->rx_fc);
++ if (status)
++ goto err;
++ }
++
++ return 0;
++err:
++ be_close(adapter->netdev);
++ return -EIO;
++}
++
++static int be_setup_wol(struct be_adapter *adapter, bool enable)
++{
++ struct be_dma_mem cmd;
++ int status = 0;
++ u8 mac[ETH_ALEN];
++
++ memset(mac, 0, ETH_ALEN);
++
++ cmd.size = sizeof(struct be_cmd_req_acpi_wol_magic_config);
++ cmd.va = pci_alloc_consistent(adapter->pdev, cmd.size, &cmd.dma);
++ if (cmd.va == NULL)
++ return -1;
++ memset(cmd.va, 0, cmd.size);
++
++ if (enable) {
++ status = pci_write_config_dword(adapter->pdev,
++ PCICFG_PM_CONTROL_OFFSET, PCICFG_PM_CONTROL_MASK);
++ if (status) {
++ dev_err(&adapter->pdev->dev,
++ "Could not enable Wake-on-lan\n");
++ pci_free_consistent(adapter->pdev, cmd.size, cmd.va,
++ cmd.dma);
++ return status;
++ }
++ status = be_cmd_enable_magic_wol(adapter,
++ adapter->netdev->dev_addr, &cmd);
++ pci_enable_wake(adapter->pdev, PCI_D3hot, 1);
++ pci_enable_wake(adapter->pdev, PCI_D3cold, 1);
++ } else {
++ status = be_cmd_enable_magic_wol(adapter, mac, &cmd);
++ pci_enable_wake(adapter->pdev, PCI_D3hot, 0);
++ pci_enable_wake(adapter->pdev, PCI_D3cold, 0);
++ }
++
++ pci_free_consistent(adapter->pdev, cmd.size, cmd.va, cmd.dma);
++ return status;
++}
++
++/*
++ * Generate a seed MAC address from the PF MAC Address using jhash.
++ * MAC Address for VFs are assigned incrementally starting from the seed.
++ * These addresses are programmed in the ASIC by the PF and the VF driver
++ * queries for the MAC address during its probe.
++ */
++static inline int be_vf_eth_addr_config(struct be_adapter *adapter)
++{
++ u32 vf = 0;
++ int status = 0;
++ u8 mac[ETH_ALEN];
++
++ be_vf_eth_addr_generate(adapter, mac);
++
++ for (vf = 0; vf < adapter->num_vfs; vf++) {
++ status = be_cmd_pmac_add(adapter, mac,
++ adapter->vf_cfg[vf].vf_if_handle,
++ &adapter->vf_cfg[vf].vf_pmac_id,
++ vf + 1);
++ if (status)
++ dev_err(&adapter->pdev->dev,
++ "Mac address add failed for VF %d\n", vf);
++ else
++ memcpy(adapter->vf_cfg[vf].vf_mac_addr, mac, ETH_ALEN);
+
+- schedule_delayed_work(&adapter->work, msecs_to_jiffies(100));
+-ret_sts:
++ mac[5] += 1;
++ }
+ return status;
+ }
+
++static inline void be_vf_eth_addr_rem(struct be_adapter *adapter)
++{
++ u32 vf;
++
++ for (vf = 0; vf < adapter->num_vfs; vf++) {
++ if (adapter->vf_cfg[vf].vf_pmac_id != BE_INVALID_PMAC_ID)
++ be_cmd_pmac_del(adapter,
++ adapter->vf_cfg[vf].vf_if_handle,
++ adapter->vf_cfg[vf].vf_pmac_id, vf + 1);
++ }
++}
++
++static int be_num_txqs_want(struct be_adapter *adapter)
++{
++ if (adapter->num_vfs > 0 || be_is_mc(adapter) ||
++ lancer_chip(adapter) || !be_physfn(adapter) ||
++ adapter->generation == BE_GEN2)
++ return 1;
++ else
++ return MAX_TX_QS;
++}
++
+ static int be_setup(struct be_adapter *adapter)
+ {
+ struct net_device *netdev = adapter->netdev;
+- u32 cap_flags, en_flags;
+- int status;
+-
+- cap_flags = BE_IF_FLAGS_UNTAGGED | BE_IF_FLAGS_BROADCAST |
+- BE_IF_FLAGS_MCAST_PROMISCUOUS |
+- BE_IF_FLAGS_PROMISCUOUS |
+- BE_IF_FLAGS_PASS_L3L4_ERRORS;
+- en_flags = BE_IF_FLAGS_UNTAGGED | BE_IF_FLAGS_BROADCAST |
+- BE_IF_FLAGS_PASS_L3L4_ERRORS;
++ int status, fw_num_txqs, num_txqs;
++ u32 cap_flags, en_flags, vf = 0;
++ u8 mac[ETH_ALEN];
++
++ num_txqs = be_num_txqs_want(adapter);
++ if (num_txqs > 1) {
++ be_cmd_req_pg_pfc(adapter, &fw_num_txqs);
++ num_txqs = min(num_txqs, fw_num_txqs);
++ }
++ adapter->num_tx_qs = num_txqs;
++ if (adapter->num_tx_qs != MAX_TX_QS)
++ netif_set_real_num_tx_queues(adapter->netdev,
++ adapter->num_tx_qs);
++
++ be_cmd_req_native_mode(adapter);
++
++ cap_flags = en_flags = BE_IF_FLAGS_UNTAGGED |
++ BE_IF_FLAGS_BROADCAST |
++ BE_IF_FLAGS_MULTICAST;
++
++ if (be_physfn(adapter)) {
++ if (adapter->function_caps & BE_FUNCTION_CAPS_RSS) {
++ cap_flags |= BE_IF_FLAGS_RSS;
++ en_flags |= BE_IF_FLAGS_RSS;
++ }
++ cap_flags |= BE_IF_FLAGS_MCAST_PROMISCUOUS |
++ BE_IF_FLAGS_PROMISCUOUS;
++ if (!lancer_A0_chip(adapter)) {
++ cap_flags |= BE_IF_FLAGS_PASS_L3L4_ERRORS;
++ en_flags |= BE_IF_FLAGS_PASS_L3L4_ERRORS;
++ }
++ }
+
+ status = be_cmd_if_create(adapter, cap_flags, en_flags,
+ netdev->dev_addr, false/* pmac_invalid */,
+- &adapter->if_handle, &adapter->pmac_id);
++ &adapter->if_handle, &adapter->pmac_id, 0);
+ if (status != 0)
+ goto do_none;
+
++ if (be_physfn(adapter)) {
++ while (vf < adapter->num_vfs) {
++ cap_flags = en_flags = BE_IF_FLAGS_UNTAGGED |
++ BE_IF_FLAGS_BROADCAST;
++ status = be_cmd_if_create(adapter, cap_flags,
++ en_flags, mac, true,
++ &adapter->vf_cfg[vf].vf_if_handle,
++ NULL, vf+1);
++ if (status) {
++ dev_err(&adapter->pdev->dev,
++ "Interface Create failed for VF %d\n", vf);
++ goto if_destroy;
++ }
++ adapter->vf_cfg[vf].vf_pmac_id = BE_INVALID_PMAC_ID;
++ vf++;
++ }
++ } else {
++ status = be_cmd_mac_addr_query(adapter, mac,
++ MAC_ADDRESS_TYPE_NETWORK, false, adapter->if_handle);
++ if (!status) {
++ memcpy(adapter->netdev->dev_addr, mac, ETH_ALEN);
++ memcpy(adapter->netdev->perm_addr, mac, ETH_ALEN);
++ }
++ }
++
+ status = be_tx_queues_create(adapter);
+ if (status != 0)
+ goto if_destroy;
+@@ -1656,10 +2793,15 @@ static int be_setup(struct be_adapter *adapter)
+ if (status != 0)
+ goto tx_qs_destroy;
+
++ /* Allow all priorities by default. A GRP5 evt may modify this */
++ adapter->vlan_prio_bmap = 0xff;
++
+ status = be_mcc_queues_create(adapter);
+ if (status != 0)
+ goto rx_qs_destroy;
+
++ adapter->link_speed = -1;
++
+ return 0;
+
+ rx_qs_destroy:
+@@ -1667,158 +2809,392 @@ rx_qs_destroy:
+ tx_qs_destroy:
+ be_tx_queues_destroy(adapter);
+ if_destroy:
+- be_cmd_if_destroy(adapter, adapter->if_handle);
++ if (be_physfn(adapter)) {
++ for (vf = 0; vf < adapter->num_vfs; vf++)
++ if (adapter->vf_cfg[vf].vf_if_handle)
++ be_cmd_if_destroy(adapter,
++ adapter->vf_cfg[vf].vf_if_handle,
++ vf + 1);
++ }
++ be_cmd_if_destroy(adapter, adapter->if_handle, 0);
+ do_none:
+ return status;
+ }
+
+ static int be_clear(struct be_adapter *adapter)
+ {
++ int vf;
++
++ if (be_physfn(adapter) && adapter->num_vfs)
++ be_vf_eth_addr_rem(adapter);
++
+ be_mcc_queues_destroy(adapter);
+ be_rx_queues_destroy(adapter);
+ be_tx_queues_destroy(adapter);
++ adapter->eq_next_idx = 0;
+
+- be_cmd_if_destroy(adapter, adapter->if_handle);
++ if (be_physfn(adapter)) {
++ for (vf = 0; vf < adapter->num_vfs; vf++)
++ if (adapter->vf_cfg[vf].vf_if_handle)
++ be_cmd_if_destroy(adapter,
++ adapter->vf_cfg[vf].vf_if_handle, vf + 1);
++ }
++ be_cmd_if_destroy(adapter, adapter->if_handle, 0);
+
++ /* tell fw we're done with firing cmds */
++ be_cmd_fw_clean(adapter);
+ return 0;
+ }
+
+-static int be_close(struct net_device *netdev)
++static void be_cpy_drv_ver(struct be_adapter *adapter, void *va)
++{
++ struct mgmt_controller_attrib *attrib =
++ (struct mgmt_controller_attrib *) ((u8*) va +
++ sizeof(struct be_cmd_resp_hdr));
++
++ memcpy(attrib->hba_attribs.driver_version_string,
++ DRV_VER, sizeof(DRV_VER));
++ attrib->pci_bus_number = adapter->pdev->bus->number;
++ attrib->pci_device_number = PCI_SLOT(adapter->pdev->devfn);
++ return;
++}
++
++#define IOCTL_COOKIE "SERVERENGINES CORP"
++static int be_do_ioctl(struct net_device *netdev,
++ struct ifreq *ifr, int cmd)
+ {
+ struct be_adapter *adapter = netdev_priv(netdev);
+- struct be_eq_obj *rx_eq = &adapter->rx_eq;
+- struct be_eq_obj *tx_eq = &adapter->tx_eq;
+- int vec;
++ struct be_cmd_req_hdr req;
++ struct be_cmd_resp_hdr *resp;
++ void *data = ifr->ifr_data;
++ void *ioctl_ptr;
++ void *va;
++ dma_addr_t dma;
++ u32 req_size;
++ int status, ret = 0;
++ u8 cookie[32];
++
++ switch (cmd) {
++ case SIOCDEVPRIVATE:
++ if (copy_from_user(cookie, data, strlen(IOCTL_COOKIE)))
++ return -EFAULT;
++
++ if (memcmp(cookie, IOCTL_COOKIE, strlen(IOCTL_COOKIE)))
++ return -EINVAL;
+
+- cancel_delayed_work_sync(&adapter->work);
++ ioctl_ptr = (u8 *)data + strlen(IOCTL_COOKIE);
++ if (copy_from_user(&req, ioctl_ptr,
++ sizeof(struct be_cmd_req_hdr)))
++ return -EFAULT;
+
+- netif_stop_queue(netdev);
+- netif_carrier_off(netdev);
+- adapter->link_up = false;
++ req_size = le32_to_cpu(req.request_length);
++ if (req_size > 65536)
++ return -EINVAL;
+
+- be_intr_set(adapter, false);
++ req_size += sizeof(struct be_cmd_req_hdr);
++ va = pci_alloc_consistent(adapter->pdev, req_size, &dma);
++ if (!va)
++ return -ENOMEM;
++ if (copy_from_user(va, ioctl_ptr, req_size)) {
++ ret = -EFAULT;
++ break;
++ }
+
+- if (adapter->msix_enabled) {
+- vec = be_msix_vec_get(adapter, tx_eq->q.id);
+- synchronize_irq(vec);
+- vec = be_msix_vec_get(adapter, rx_eq->q.id);
+- synchronize_irq(vec);
+- } else {
+- synchronize_irq(netdev->irq);
++ status = be_cmd_pass_ext_ioctl(adapter, dma, req_size, va);
++ if (status == -1) {
++ ret = -EIO;
++ break;
++ }
++
++ resp = (struct be_cmd_resp_hdr *) va;
++ if (!status) {
++ if (req.opcode == OPCODE_COMMON_GET_CNTL_ATTRIBUTES)
++ be_cpy_drv_ver(adapter, va);
++ }
++
++ if (copy_to_user(ioctl_ptr, va, req_size)) {
++ ret = -EFAULT;
++ break;
++ }
++ break;
++ default:
++ return -EOPNOTSUPP;
+ }
+- be_irq_unregister(adapter);
+
+- napi_disable(&rx_eq->napi);
+- napi_disable(&tx_eq->napi);
++ if (va)
++ pci_free_consistent(adapter->pdev, req_size, va, dma);
++
++ return ret;
++}
++
++#ifdef CONFIG_NET_POLL_CONTROLLER
++static void be_netpoll(struct net_device *netdev)
++{
++ struct be_adapter *adapter = netdev_priv(netdev);
++ struct be_rx_obj *rxo;
++ int i;
+
+- /* Wait for all pending tx completions to arrive so that
+- * all tx skbs are freed.
+- */
+- be_tx_compl_clean(adapter);
++ event_handle(adapter, &adapter->tx_eq, false);
++ for_all_rx_queues(adapter, rxo, i)
++ event_handle(adapter, &rxo->rx_eq, true);
++
++ return;
++}
++#endif
++
++static int be_get_frag_header(struct skb_frag_struct *frag, void **mac_hdr,
++ void **ip_hdr, void **tcpudp_hdr,
++ u64 *hdr_flags, void *priv)
++{
++ struct ethhdr *eh;
++ struct vlan_ethhdr *veh;
++ struct iphdr *iph;
++ u8 *va = page_address(frag->page) + frag->page_offset;
++ unsigned long ll_hlen;
++
++ prefetch(va);
++ eh = (struct ethhdr *)va;
++ *mac_hdr = eh;
++ ll_hlen = ETH_HLEN;
++ if (eh->h_proto != htons(ETH_P_IP)) {
++ if (eh->h_proto == htons(ETH_P_8021Q)) {
++ veh = (struct vlan_ethhdr *)va;
++ if (veh->h_vlan_encapsulated_proto != htons(ETH_P_IP))
++ return -1;
++
++ ll_hlen += VLAN_HLEN;
++ } else {
++ return -1;
++ }
++ }
++ *hdr_flags = LRO_IPV4;
++ iph = (struct iphdr *)(va + ll_hlen);
++ *ip_hdr = iph;
++ if (iph->protocol != IPPROTO_TCP)
++ return -1;
++ *hdr_flags |= LRO_TCP;
++ *tcpudp_hdr = (u8 *) (*ip_hdr) + (iph->ihl << 2);
+
+ return 0;
+ }
+
+-#define FW_FILE_HDR_SIGN "ServerEngines Corp. "
++static void be_lro_init(struct be_adapter *adapter, struct net_device *netdev)
++{
++ struct net_lro_mgr *lro_mgr;
++ struct be_rx_obj *rxo;
++ int i;
++
++ for_all_rx_queues(adapter, rxo, i) {
++ lro_mgr = &rxo->lro_mgr;
++ lro_mgr->dev = netdev;
++ lro_mgr->features = LRO_F_NAPI;
++ lro_mgr->ip_summed = CHECKSUM_UNNECESSARY;
++ lro_mgr->ip_summed_aggr = CHECKSUM_UNNECESSARY;
++ lro_mgr->max_desc = BE_MAX_LRO_DESCRIPTORS;
++ lro_mgr->lro_arr = rxo->lro_desc;
++ lro_mgr->get_frag_header = be_get_frag_header;
++ lro_mgr->max_aggr = BE_MAX_FRAGS_PER_FRAME;
++ }
++
++#ifdef NETIF_F_GRO
++ netdev->features |= NETIF_F_GRO;
++ adapter->gro_supported = true;
++#endif
++}
++
++#define FW_FILE_HDR_SIGN "ServerEngines Corp. "
+ char flash_cookie[2][16] = {"*** SE FLAS",
+ "H DIRECTORY *** "};
+-static int be_flash_image(struct be_adapter *adapter,
++
++static bool be_flash_redboot(struct be_adapter *adapter,
++ const u8 *p, u32 img_start, int image_size,
++ int hdr_size)
++{
++ u32 crc_offset;
++ u8 flashed_crc[4];
++ int status;
++
++ crc_offset = hdr_size + img_start + image_size - 4;
++
++ p += crc_offset;
++
++ status = be_cmd_get_flash_crc(adapter, flashed_crc,
++ (image_size - 4));
++ if (status) {
++ dev_err(&adapter->pdev->dev,
++ "could not get crc from flash, not flashing redboot\n");
++ return false;
++ }
++
++ /*update redboot only if crc does not match*/
++ if (!memcmp(flashed_crc, p, 4))
++ return false;
++ else
++ return true;
++}
++
++static bool phy_flashing_required(struct be_adapter *adapter)
++{
++ int status = 0;
++ struct be_phy_info phy_info;
++
++ status = be_cmd_get_phy_info(adapter, &phy_info);
++ if (status)
++ return false;
++ if ((phy_info.phy_type == TN_8022) &&
++ (phy_info.interface_type == PHY_TYPE_BASET_10GB)) {
++ return true;
++ }
++ return false;
++}
++
++static int be_flash_data(struct be_adapter *adapter,
+ const struct firmware *fw,
+- struct be_dma_mem *flash_cmd, u32 flash_type)
++ struct be_dma_mem *flash_cmd, int num_of_images)
++
+ {
+- int status;
+- u32 flash_op, image_offset = 0, total_bytes, image_size = 0;
++ int status = 0, i, filehdr_size = 0;
++ u32 total_bytes = 0, flash_op;
+ int num_bytes;
+ const u8 *p = fw->data;
+ struct be_cmd_write_flashrom *req = flash_cmd->va;
++ struct flash_comp *pflashcomp;
++ int num_comp;
+
+- switch (flash_type) {
+- case FLASHROM_TYPE_ISCSI_ACTIVE:
+- image_offset = FLASH_iSCSI_PRIMARY_IMAGE_START;
+- image_size = FLASH_IMAGE_MAX_SIZE;
+- break;
+- case FLASHROM_TYPE_ISCSI_BACKUP:
+- image_offset = FLASH_iSCSI_BACKUP_IMAGE_START;
+- image_size = FLASH_IMAGE_MAX_SIZE;
+- break;
+- case FLASHROM_TYPE_FCOE_FW_ACTIVE:
+- image_offset = FLASH_FCoE_PRIMARY_IMAGE_START;
+- image_size = FLASH_IMAGE_MAX_SIZE;
+- break;
+- case FLASHROM_TYPE_FCOE_FW_BACKUP:
+- image_offset = FLASH_FCoE_BACKUP_IMAGE_START;
+- image_size = FLASH_IMAGE_MAX_SIZE;
+- break;
+- case FLASHROM_TYPE_BIOS:
+- image_offset = FLASH_iSCSI_BIOS_START;
+- image_size = FLASH_BIOS_IMAGE_MAX_SIZE;
+- break;
+- case FLASHROM_TYPE_FCOE_BIOS:
+- image_offset = FLASH_FCoE_BIOS_START;
+- image_size = FLASH_BIOS_IMAGE_MAX_SIZE;
+- break;
+- case FLASHROM_TYPE_PXE_BIOS:
+- image_offset = FLASH_PXE_BIOS_START;
+- image_size = FLASH_BIOS_IMAGE_MAX_SIZE;
+- break;
+- default:
+- return 0;
++ struct flash_comp gen3_flash_types[10] = {
++ { FLASH_iSCSI_PRIMARY_IMAGE_START_g3, IMG_TYPE_ISCSI_ACTIVE,
++ FLASH_IMAGE_MAX_SIZE_g3},
++ { FLASH_REDBOOT_START_g3, IMG_TYPE_REDBOOT,
++ FLASH_REDBOOT_IMAGE_MAX_SIZE_g3},
++ { FLASH_iSCSI_BIOS_START_g3, IMG_TYPE_BIOS,
++ FLASH_BIOS_IMAGE_MAX_SIZE_g3},
++ { FLASH_PXE_BIOS_START_g3, IMG_TYPE_PXE_BIOS,
++ FLASH_BIOS_IMAGE_MAX_SIZE_g3},
++ { FLASH_FCoE_BIOS_START_g3, IMG_TYPE_FCOE_BIOS,
++ FLASH_BIOS_IMAGE_MAX_SIZE_g3},
++ { FLASH_iSCSI_BACKUP_IMAGE_START_g3, IMG_TYPE_ISCSI_BACKUP,
++ FLASH_IMAGE_MAX_SIZE_g3},
++ { FLASH_FCoE_PRIMARY_IMAGE_START_g3, IMG_TYPE_FCOE_FW_ACTIVE,
++ FLASH_IMAGE_MAX_SIZE_g3},
++ { FLASH_FCoE_BACKUP_IMAGE_START_g3, IMG_TYPE_FCOE_FW_BACKUP,
++ FLASH_IMAGE_MAX_SIZE_g3},
++ { FLASH_NCSI_START_g3, IMG_TYPE_NCSI_FW,
++ FLASH_NCSI_IMAGE_MAX_SIZE_g3},
++ { FLASH_PHY_FW_START_g3, IMG_TYPE_PHY_FW,
++ FLASH_PHY_FW_IMAGE_MAX_SIZE_g3}
++ };
++ struct flash_comp gen2_flash_types[8] = {
++ { FLASH_iSCSI_PRIMARY_IMAGE_START_g2, IMG_TYPE_ISCSI_ACTIVE,
++ FLASH_IMAGE_MAX_SIZE_g2},
++ { FLASH_REDBOOT_START_g2, IMG_TYPE_REDBOOT,
++ FLASH_REDBOOT_IMAGE_MAX_SIZE_g2},
++ { FLASH_iSCSI_BIOS_START_g2, IMG_TYPE_BIOS,
++ FLASH_BIOS_IMAGE_MAX_SIZE_g2},
++ { FLASH_PXE_BIOS_START_g2, IMG_TYPE_PXE_BIOS,
++ FLASH_BIOS_IMAGE_MAX_SIZE_g2},
++ { FLASH_FCoE_BIOS_START_g2, IMG_TYPE_FCOE_BIOS,
++ FLASH_BIOS_IMAGE_MAX_SIZE_g2},
++ { FLASH_iSCSI_BACKUP_IMAGE_START_g2, IMG_TYPE_ISCSI_BACKUP,
++ FLASH_IMAGE_MAX_SIZE_g2},
++ { FLASH_FCoE_PRIMARY_IMAGE_START_g2, IMG_TYPE_FCOE_FW_ACTIVE,
++ FLASH_IMAGE_MAX_SIZE_g2},
++ { FLASH_FCoE_BACKUP_IMAGE_START_g2, IMG_TYPE_FCOE_FW_BACKUP,
++ FLASH_IMAGE_MAX_SIZE_g2}
++ };
++ if (adapter->generation == BE_GEN3) {
++ pflashcomp = gen3_flash_types;
++ filehdr_size = sizeof(struct flash_file_hdr_g3);
++ num_comp = ARRAY_SIZE(gen3_flash_types);
++ } else {
++ pflashcomp = gen2_flash_types;
++ filehdr_size = sizeof(struct flash_file_hdr_g2);
++ num_comp = ARRAY_SIZE(gen2_flash_types);
+ }
++ for (i = 0; i < num_comp; i++) {
++ if ((pflashcomp[i].optype == IMG_TYPE_NCSI_FW) &&
++ memcmp(adapter->fw_ver, "3.102.148.0", 11) < 0)
++ continue;
++ if (pflashcomp[i].optype == IMG_TYPE_PHY_FW) {
++ if (!phy_flashing_required(adapter))
++ continue;
++ }
++ if ((pflashcomp[i].optype == IMG_TYPE_REDBOOT) &&
++ (!be_flash_redboot(adapter, fw->data,
++ pflashcomp[i].offset, pflashcomp[i].size, filehdr_size +
++ (num_of_images * sizeof(struct image_hdr)))))
++ continue;
+
+- p += sizeof(struct flash_file_hdr) + image_offset;
+- if (p + image_size > fw->data + fw->size)
+- return -1;
+-
+- total_bytes = image_size;
+-
+- while (total_bytes) {
+- if (total_bytes > 32*1024)
+- num_bytes = 32*1024;
+- else
+- num_bytes = total_bytes;
+- total_bytes -= num_bytes;
+-
+- if (!total_bytes)
+- flash_op = FLASHROM_OPER_FLASH;
+- else
+- flash_op = FLASHROM_OPER_SAVE;
+- memcpy(req->params.data_buf, p, num_bytes);
+- p += num_bytes;
+- status = be_cmd_write_flashrom(adapter, flash_cmd,
+- flash_type, flash_op, num_bytes);
+- if (status) {
+- dev_err(&adapter->pdev->dev,
+- "cmd to write to flash rom failed. type/op %d/%d\n",
+- flash_type, flash_op);
++ p = fw->data;
++ p += filehdr_size + pflashcomp[i].offset
++ + (num_of_images * sizeof(struct image_hdr));
++ if (p + pflashcomp[i].size > fw->data + fw->size)
+ return -1;
++ total_bytes = pflashcomp[i].size;
++ while (total_bytes) {
++ if (total_bytes > 32*1024)
++ num_bytes = 32*1024;
++ else
++ num_bytes = total_bytes;
++ total_bytes -= num_bytes;
++ if (!total_bytes) {
++ if (pflashcomp[i].optype == IMG_TYPE_PHY_FW)
++ flash_op = FLASHROM_OPER_PHY_FLASH;
++ else
++ flash_op = FLASHROM_OPER_FLASH;
++ } else {
++ if (pflashcomp[i].optype == IMG_TYPE_PHY_FW)
++ flash_op = FLASHROM_OPER_PHY_SAVE;
++ else
++ flash_op = FLASHROM_OPER_SAVE;
++ }
++ memcpy(req->params.data_buf, p, num_bytes);
++ p += num_bytes;
++ status = be_cmd_write_flashrom(adapter, flash_cmd,
++ pflashcomp[i].optype, flash_op, num_bytes);
++ if (status) {
++ if ((status == ILLEGAL_IOCTL_REQ) &&
++ (pflashcomp[i].optype ==
++ IMG_TYPE_PHY_FW))
++ break;
++ dev_err(&adapter->pdev->dev,
++ "cmd to write to flash rom failed.\n");
++ return -1;
++ }
++ yield();
+ }
+- yield();
+ }
+-
+ return 0;
+ }
+
++static int get_ufigen_type(struct flash_file_hdr_g2 *fhdr)
++{
++ if (fhdr == NULL)
++ return 0;
++ if (fhdr->build[0] == '3')
++ return BE_GEN3;
++ else if (fhdr->build[0] == '2')
++ return BE_GEN2;
++ else
++ return 0;
++}
++
+ int be_load_fw(struct be_adapter *adapter, u8 *func)
+ {
+ char fw_file[ETHTOOL_FLASH_MAX_FILENAME];
+ const struct firmware *fw;
+- struct flash_file_hdr *fhdr;
+- struct flash_section_info *fsec = NULL;
++ struct flash_file_hdr_g2 *fhdr;
++ struct flash_file_hdr_g3 *fhdr3;
++ struct image_hdr *img_hdr_ptr = NULL;
+ struct be_dma_mem flash_cmd;
+- int status;
++ int status, i = 0, num_imgs = 0;
+ const u8 *p;
+- bool entry_found = false;
+- int flash_type;
+- char fw_ver[FW_VER_LEN];
+- char fw_cfg;
+
+- status = be_cmd_get_fw_ver(adapter, fw_ver);
+- if (status)
+- return status;
++ if (!netif_running(adapter->netdev)) {
++ dev_err(&adapter->pdev->dev,
++ "Firmware load not allowed (interface is down)\n");
++ return -1;
++ }
+
+- fw_cfg = *(fw_ver + 2);
+- if (fw_cfg == '0')
+- fw_cfg = '1';
+ strcpy(fw_file, func);
+
+ status = request_firmware(&fw, fw_file, &adapter->pdev->dev);
+@@ -1826,34 +3202,9 @@ int be_load_fw(struct be_adapter *adapter, u8 *func)
+ goto fw_exit;
+
+ p = fw->data;
+- fhdr = (struct flash_file_hdr *) p;
+- if (memcmp(fhdr->sign, FW_FILE_HDR_SIGN, strlen(FW_FILE_HDR_SIGN))) {
+- dev_err(&adapter->pdev->dev,
+- "Firmware(%s) load error (signature did not match)\n",
+- fw_file);
+- status = -1;
+- goto fw_exit;
+- }
+-
++ fhdr = (struct flash_file_hdr_g2 *) p;
+ dev_info(&adapter->pdev->dev, "Flashing firmware file %s\n", fw_file);
+
+- p += sizeof(struct flash_file_hdr);
+- while (p < (fw->data + fw->size)) {
+- fsec = (struct flash_section_info *)p;
+- if (!memcmp(flash_cookie, fsec->cookie, sizeof(flash_cookie))) {
+- entry_found = true;
+- break;
+- }
+- p += 32;
+- }
+-
+- if (!entry_found) {
+- status = -1;
+- dev_err(&adapter->pdev->dev,
+- "Flash cookie not found in firmware image\n");
+- goto fw_exit;
+- }
+-
+ flash_cmd.size = sizeof(struct be_cmd_write_flashrom) + 32*1024;
+ flash_cmd.va = pci_alloc_consistent(adapter->pdev, flash_cmd.size,
+ &flash_cmd.dma);
+@@ -1864,12 +3215,25 @@ int be_load_fw(struct be_adapter *adapter, u8 *func)
+ goto fw_exit;
+ }
+
+- for (flash_type = FLASHROM_TYPE_ISCSI_ACTIVE;
+- flash_type <= FLASHROM_TYPE_FCOE_FW_BACKUP; flash_type++) {
+- status = be_flash_image(adapter, fw, &flash_cmd,
+- flash_type);
+- if (status)
+- break;
++ if ((adapter->generation == BE_GEN3) &&
++ (get_ufigen_type(fhdr) == BE_GEN3)) {
++ fhdr3 = (struct flash_file_hdr_g3 *) fw->data;
++ num_imgs = le32_to_cpu(fhdr3->num_imgs);
++ for (i = 0; i < num_imgs; i++) {
++ img_hdr_ptr = (struct image_hdr *) (fw->data +
++ (sizeof(struct flash_file_hdr_g3) +
++ i * sizeof(struct image_hdr)));
++ if (le32_to_cpu(img_hdr_ptr->imageid) == 1)
++ status = be_flash_data(adapter, fw, &flash_cmd,
++ num_imgs);
++ }
++ } else if ((adapter->generation == BE_GEN2) &&
++ (get_ufigen_type(fhdr) == BE_GEN2)) {
++ status = be_flash_data(adapter, fw, &flash_cmd, 0);
++ } else {
++ dev_err(&adapter->pdev->dev,
++ "UFI and Interface are not compatible for flashing\n");
++ status = -1;
+ }
+
+ pci_free_consistent(adapter->pdev, flash_cmd.size, flash_cmd.va,
+@@ -1879,14 +3243,14 @@ int be_load_fw(struct be_adapter *adapter, u8 *func)
+ goto fw_exit;
+ }
+
+- dev_info(&adapter->pdev->dev, "Firmware flashed succesfully\n");
++ dev_info(&adapter->pdev->dev, "Firmware flashed successfully\n");
+
+ fw_exit:
+ release_firmware(fw);
+ return status;
+ }
+
+-static struct net_device_ops be_netdev_ops = {
++static net_device_ops_no_const be_netdev_ops = {
+ .ndo_open = be_open,
+ .ndo_stop = be_close,
+ .ndo_start_xmit = be_xmit,
+@@ -1898,15 +3262,32 @@ static struct net_device_ops be_netdev_ops = {
+ .ndo_vlan_rx_register = be_vlan_register,
+ .ndo_vlan_rx_add_vid = be_vlan_add_vid,
+ .ndo_vlan_rx_kill_vid = be_vlan_rem_vid,
++#ifdef HAVE_SRIOV_CONFIG
++ .ndo_set_vf_mac = be_set_vf_mac,
++ .ndo_set_vf_vlan = be_set_vf_vlan,
++ .ndo_set_vf_tx_rate = be_set_vf_tx_rate,
++ .ndo_get_vf_config = be_get_vf_config,
++#endif
++ .ndo_do_ioctl = be_do_ioctl,
++#ifdef CONFIG_NET_POLL_CONTROLLER
++ .ndo_poll_controller = be_netpoll,
++#endif
+ };
+
+-static void be_netdev_init(struct net_device *netdev)
++static int be_netdev_init(struct net_device *netdev)
+ {
+ struct be_adapter *adapter = netdev_priv(netdev);
++ struct be_rx_obj *rxo;
++ int i, status = 0;
+
+ netdev->features |= NETIF_F_SG | NETIF_F_HW_VLAN_RX | NETIF_F_TSO |
+- NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_FILTER | NETIF_F_HW_CSUM |
+- NETIF_F_GRO;
++ NETIF_F_HW_VLAN_TX | NETIF_F_HW_CSUM | NETIF_F_TSO6;
++
++ netdev->vlan_features |= NETIF_F_SG | NETIF_F_TSO | NETIF_F_TSO6 |
++ NETIF_F_HW_CSUM;
++
++ netdev->features |= NETIF_F_VLAN_SG | NETIF_F_VLAN_TSO |
++ NETIF_F_VLAN_CSUM;
+
+ netdev->flags |= IFF_MULTICAST;
+
+@@ -1918,17 +3299,30 @@ static void be_netdev_init(struct net_device *netdev)
+
+ netif_set_gso_max_size(netdev, 65535);
+
++ if (adapter->flags & BE_FLAGS_DCBX)
++ be_netdev_ops.ndo_select_queue = be_select_queue;
+ BE_SET_NETDEV_OPS(netdev, &be_netdev_ops);
+-
++
+ SET_ETHTOOL_OPS(netdev, &be_ethtool_ops);
+
+- netif_napi_add(netdev, &adapter->rx_eq.napi, be_poll_rx,
+- BE_NAPI_WEIGHT);
+- netif_napi_add(netdev, &adapter->tx_eq.napi, be_poll_tx_mcc,
++ be_lro_init(adapter, netdev);
++
++ for_all_rx_queues(adapter, rxo, i) {
++ status = be_netif_napi_add(netdev, &rxo->rx_eq.napi, be_poll_rx,
++ BE_NAPI_WEIGHT);
++ if (status) {
++ dev_err(&adapter->pdev->dev, "dummy netdev alloc fail"
++ "for rxo:%d\n", i);
++ return status;
++ }
++ }
++ status = be_netif_napi_add(netdev, &adapter->tx_eq.napi, be_poll_tx_mcc,
+ BE_NAPI_WEIGHT);
++ if (status)
++ dev_err(&adapter->pdev->dev, "dummy netdev alloc fail"
++ "for tx\n");
+
+- netif_carrier_off(netdev);
+- netif_stop_queue(netdev);
++ return status;
+ }
+
+ static void be_unmap_pci_bars(struct be_adapter *adapter)
+@@ -1937,37 +3331,62 @@ static void be_unmap_pci_bars(struct be_adapter *adapter)
+ iounmap(adapter->csr);
+ if (adapter->db)
+ iounmap(adapter->db);
+- if (adapter->pcicfg)
++ if (adapter->pcicfg && be_physfn(adapter))
+ iounmap(adapter->pcicfg);
+ }
+
+ static int be_map_pci_bars(struct be_adapter *adapter)
+ {
++ struct pci_dev *pdev = adapter->pdev;
+ u8 __iomem *addr;
+- int pcicfg_reg;
++ int pcicfg_reg, db_reg;
+
+- addr = ioremap_nocache(pci_resource_start(adapter->pdev, 2),
+- pci_resource_len(adapter->pdev, 2));
+- if (addr == NULL)
+- return -ENOMEM;
+- adapter->csr = addr;
++ if (lancer_chip(adapter)) {
++ addr = ioremap_nocache(pci_resource_start(pdev, 0),
++ pci_resource_len(adapter->pdev, 0));
++ if (addr == NULL)
++ return -ENOMEM;
++ adapter->db = addr;
++ return 0;
++ }
+
+- addr = ioremap_nocache(pci_resource_start(adapter->pdev, 4),
+- 128 * 1024);
+- if (addr == NULL)
+- goto pci_map_err;
+- adapter->db = addr;
++ if (be_physfn(adapter)) {
++ addr = ioremap_nocache(pci_resource_start(pdev, 2),
++ pci_resource_len(pdev, 2));
++ if (addr == NULL)
++ return -ENOMEM;
++ adapter->csr = addr;
++ adapter->netdev->mem_start = pci_resource_start(pdev, 2);
++ adapter->netdev->mem_end = pci_resource_start(pdev, 2) +
++ pci_resource_len(pdev, 2);
++ }
+
+- if (adapter->generation == BE_GEN2)
++ if (adapter->generation == BE_GEN2) {
+ pcicfg_reg = 1;
+- else
++ db_reg = 4;
++ } else {
+ pcicfg_reg = 0;
++ if (be_physfn(adapter))
++ db_reg = 4;
++ else
++ db_reg = 0;
++ }
+
+- addr = ioremap_nocache(pci_resource_start(adapter->pdev, pcicfg_reg),
+- pci_resource_len(adapter->pdev, pcicfg_reg));
++ addr = ioremap_nocache(pci_resource_start(pdev, db_reg),
++ pci_resource_len(pdev, db_reg));
+ if (addr == NULL)
+ goto pci_map_err;
+- adapter->pcicfg = addr;
++ adapter->db = addr;
++
++ if (be_physfn(adapter)) {
++ addr = ioremap_nocache(
++ pci_resource_start(pdev, pcicfg_reg),
++ pci_resource_len(pdev, pcicfg_reg));
++ if (addr == NULL)
++ goto pci_map_err;
++ adapter->pcicfg = addr;
++ } else
++ adapter->pcicfg = adapter->db + SRIOV_VF_PCICFG_OFFSET;
+
+ return 0;
+ pci_map_err:
+@@ -1985,40 +3404,69 @@ static void be_ctrl_cleanup(struct be_adapter *adapter)
+ if (mem->va)
+ pci_free_consistent(adapter->pdev, mem->size,
+ mem->va, mem->dma);
++
++ mem = &adapter->rx_filter;
++ if (mem->va)
++ pci_free_consistent(adapter->pdev, mem->size,
++ mem->va, mem->dma);
+ }
+
+ static int be_ctrl_init(struct be_adapter *adapter)
+ {
+ struct be_dma_mem *mbox_mem_alloc = &adapter->mbox_mem_alloced;
+ struct be_dma_mem *mbox_mem_align = &adapter->mbox_mem;
++ struct be_dma_mem *rx_filter = &adapter->rx_filter;
+ int status;
+
+ status = be_map_pci_bars(adapter);
+ if (status)
+- return status;
++ goto done;
+
+ mbox_mem_alloc->size = sizeof(struct be_mcc_mailbox) + 16;
+ mbox_mem_alloc->va = pci_alloc_consistent(adapter->pdev,
+ mbox_mem_alloc->size, &mbox_mem_alloc->dma);
+ if (!mbox_mem_alloc->va) {
+- be_unmap_pci_bars(adapter);
+- return -1;
++ status = -ENOMEM;
++ goto unmap_pci_bars;
+ }
++
+ mbox_mem_align->size = sizeof(struct be_mcc_mailbox);
+ mbox_mem_align->va = PTR_ALIGN(mbox_mem_alloc->va, 16);
+ mbox_mem_align->dma = PTR_ALIGN(mbox_mem_alloc->dma, 16);
+ memset(mbox_mem_align->va, 0, sizeof(struct be_mcc_mailbox));
+- spin_lock_init(&adapter->mbox_lock);
++
++ rx_filter->size = sizeof(struct be_cmd_req_rx_filter);
++ rx_filter->va = pci_alloc_consistent(adapter->pdev, rx_filter->size,
++ &rx_filter->dma);
++ if (rx_filter->va == NULL) {
++ status = -ENOMEM;
++ goto free_mbox;
++ }
++ memset(rx_filter->va, 0, rx_filter->size);
++
++ mutex_init(&adapter->mbox_lock);
+ spin_lock_init(&adapter->mcc_lock);
+ spin_lock_init(&adapter->mcc_cq_lock);
+
++ init_completion(&adapter->flash_compl);
++
++ PCI_SAVE_STATE(adapter->pdev);
+ return 0;
++
++free_mbox:
++ pci_free_consistent(adapter->pdev, mbox_mem_alloc->size,
++ mbox_mem_alloc->va, mbox_mem_alloc->dma);
++
++unmap_pci_bars:
++ be_unmap_pci_bars(adapter);
++
++done:
++ return status;
+ }
+
+ static void be_stats_cleanup(struct be_adapter *adapter)
+ {
+- struct be_stats_obj *stats = &adapter->stats;
+- struct be_dma_mem *cmd = &stats->cmd;
++ struct be_dma_mem *cmd = &adapter->stats_cmd;
+
+ if (cmd->va)
+ pci_free_consistent(adapter->pdev, cmd->size,
+@@ -2027,10 +3475,12 @@ static void be_stats_cleanup(struct be_adapter *adapter)
+
+ static int be_stats_init(struct be_adapter *adapter)
+ {
+- struct be_stats_obj *stats = &adapter->stats;
+- struct be_dma_mem *cmd = &stats->cmd;
++ struct be_dma_mem *cmd = &adapter->stats_cmd;
+
+- cmd->size = sizeof(struct be_cmd_req_get_stats);
++ if (adapter->generation == BE_GEN2)
++ cmd->size = sizeof(struct be_cmd_req_get_stats_v0);
++ else
++ cmd->size = sizeof(struct be_cmd_req_get_stats_v1);
+ cmd->va = pci_alloc_consistent(adapter->pdev, cmd->size, &cmd->dma);
+ if (cmd->va == NULL)
+ return -1;
+@@ -2041,9 +3491,17 @@ static int be_stats_init(struct be_adapter *adapter)
+ static void __devexit be_remove(struct pci_dev *pdev)
+ {
+ struct be_adapter *adapter = pci_get_drvdata(pdev);
++
+ if (!adapter)
+ return;
+
++ cancel_delayed_work_sync(&adapter->work);
++
++#ifdef CONFIG_PALAU
++ be_sysfs_remove_group(adapter);
++#endif
++
++ /* be_close() gets called if the device is open by unregister */
+ unregister_netdev(adapter->netdev);
+
+ be_clear(adapter);
+@@ -2052,36 +3510,203 @@ static void __devexit be_remove(struct pci_dev *pdev)
+
+ be_ctrl_cleanup(adapter);
+
+- if (adapter->msix_enabled) {
+- pci_disable_msix(adapter->pdev);
+- adapter->msix_enabled = false;
+- }
++ kfree(adapter->vf_cfg);
++ be_sriov_disable(adapter);
++
++ be_msix_disable(adapter);
+
+ pci_set_drvdata(pdev, NULL);
+ pci_release_regions(pdev);
+ pci_disable_device(pdev);
+-
++ be_netif_napi_del(adapter->netdev);
+ free_netdev(adapter->netdev);
+ }
+
+-static int be_hw_up(struct be_adapter *adapter)
++static void be_pcie_slot_check(struct be_adapter *adapter)
++{
++ u32 curr, max, width, max_wd, speed, max_sp;
++
++ pci_read_config_dword(adapter->pdev, PCICFG_PCIE_LINK_STATUS_OFFSET,
++ &curr);
++ width = (curr >> PCIE_LINK_STATUS_NEG_WIDTH_SHIFT) &
++ PCIE_LINK_STATUS_NEG_WIDTH_MASK;
++ speed = (curr >> PCIE_LINK_STATUS_SPEED_SHIFT) &
++ PCIE_LINK_STATUS_SPEED_MASK;
++
++ pci_read_config_dword(adapter->pdev, PCICFG_PCIE_LINK_CAP_OFFSET,
++ &max);
++ max_wd = (max >> PCIE_LINK_CAP_MAX_WIDTH_SHIFT) &
++ PCIE_LINK_CAP_MAX_WIDTH_MASK;
++ max_sp = (max >> PCIE_LINK_CAP_MAX_SPEED_SHIFT) &
++ PCIE_LINK_CAP_MAX_SPEED_MASK;
++
++ if (width < max_wd || speed < max_sp)
++ dev_warn(&adapter->pdev->dev,
++ "Found network device in a Gen%s x%d PCIe slot. It "
++ "should be in a Gen2 x%d slot for best performance\n",
++ speed < max_sp ? "1" : "2", width, max_wd);
++}
++
++static int be_get_ioctl_version(char *fw_version) {
++ char *str[4];
++ int i;
++ int val[4];
++ char *endptr;
++
++ if(!fw_version)
++ return 0;
++ for(i=0; i<3; i++) {
++ str[i] = strsep(&fw_version, ".");
++ val[i] = simple_strtol(str[i], &endptr, 10);
++ }
++
++ if (val[0]>4 || (val[0]>3 && val[2]>143))
++ return 1;
++ return 0;
++}
++
++static int be_get_port_names(struct be_adapter *adapter)
+ {
+ int status;
++ int ver;
+
+- status = be_cmd_POST(adapter);
++ status = be_cmd_get_fw_ver(adapter,
++ adapter->fw_ver, NULL);
+ if (status)
+ return status;
++ ver = be_get_ioctl_version(adapter->fw_ver);
++ if (ver && (adapter->generation == BE_GEN3))
++ status = be_cmd_query_port_names_v1(adapter,
++ adapter->port_name);
++ else
++ status = be_cmd_query_port_names_v0(adapter,
++ adapter->port_name);
++ return status;
++}
+
+- status = be_cmd_reset_function(adapter);
++static int be_get_config(struct be_adapter *adapter)
++{
++ int status;
++ u8 mac[ETH_ALEN];
++
++ status = be_cmd_query_fw_cfg(adapter, &adapter->port_num,
++ &adapter->function_mode,
++ &adapter->function_caps);
+ if (status)
+ return status;
+
+- status = be_cmd_get_fw_ver(adapter, adapter->fw_ver);
++ status = be_cmd_get_cntl_attributes(adapter);
+ if (status)
+ return status;
+
+- status = be_cmd_query_fw_cfg(adapter,
+- &adapter->port_num, &adapter->cap);
++ memset(mac, 0, ETH_ALEN);
++ be_pcie_slot_check(adapter);
++
++ if (be_physfn(adapter)) {
++ status = be_cmd_mac_addr_query(adapter, mac,
++ MAC_ADDRESS_TYPE_NETWORK, true /*permanent */, 0);
++
++ if (status)
++ return status;
++
++ if (!is_valid_ether_addr(mac))
++ return -EADDRNOTAVAIL;
++
++ memcpy(adapter->netdev->dev_addr, mac, ETH_ALEN);
++ memcpy(adapter->netdev->perm_addr, mac, ETH_ALEN);
++ }
++
++ if (adapter->function_mode & FLEX10_MODE)
++ adapter->max_vlans = BE_NUM_VLANS_SUPPORTED/8;
++ else
++ adapter->max_vlans = BE_NUM_VLANS_SUPPORTED;
++
++ return 0;
++}
++
++static int be_dev_family_check(struct be_adapter *adapter)
++{
++ struct pci_dev *pdev = adapter->pdev;
++ u32 sli_intf = 0, if_type;
++
++ switch (pdev->device) {
++ case BE_DEVICE_ID1:
++ case OC_DEVICE_ID1:
++ adapter->generation = BE_GEN2;
++ break;
++ case BE_DEVICE_ID2:
++ case OC_DEVICE_ID2:
++ adapter->generation = BE_GEN3;
++ break;
++ case OC_DEVICE_ID3:
++ pci_read_config_dword(pdev, SLI_INTF_REG_OFFSET, &sli_intf);
++ if_type = (sli_intf & SLI_INTF_IF_TYPE_MASK) >>
++ SLI_INTF_IF_TYPE_SHIFT;
++
++ if (((sli_intf & SLI_INTF_VALID_MASK) != SLI_INTF_VALID) ||
++ if_type != 0x02) {
++ dev_err(&pdev->dev, "SLI_INTF reg val is not valid\n");
++ return -EINVAL;
++ }
++ if (num_vfs > 0) {
++ dev_err(&pdev->dev, "VFs not supported\n");
++ return -EINVAL;
++ }
++ adapter->sli_family = ((sli_intf & SLI_INTF_FAMILY_MASK) >>
++ SLI_INTF_FAMILY_SHIFT);
++ adapter->generation = BE_GEN3;
++ break;
++ default:
++ adapter->generation = 0;
++ }
++ return 0;
++}
++
++static int lancer_wait_ready(struct be_adapter *adapter)
++{
++#define SLIPORT_READY_TIMEOUT 500
++ u32 sliport_status;
++ int status = 0, i;
++
++ for (i = 0; i < SLIPORT_READY_TIMEOUT; i++) {
++ sliport_status = ioread32(adapter->db + SLIPORT_STATUS_OFFSET);
++ if (sliport_status & SLIPORT_STATUS_RDY_MASK)
++ break;
++
++ msleep(20);
++ }
++
++ if (i == SLIPORT_READY_TIMEOUT)
++ status = -1;
++
++ return status;
++}
++
++static int lancer_test_and_set_rdy_state(struct be_adapter *adapter)
++{
++ int status;
++ u32 sliport_status, err, reset_needed;
++ status = lancer_wait_ready(adapter);
++ if (!status) {
++ sliport_status = ioread32(adapter->db + SLIPORT_STATUS_OFFSET);
++ err = sliport_status & SLIPORT_STATUS_ERR_MASK;
++ reset_needed = sliport_status & SLIPORT_STATUS_RN_MASK;
++ if (err && reset_needed) {
++ iowrite32(SLI_PORT_CONTROL_IP_MASK,
++ adapter->db + SLIPORT_CONTROL_OFFSET);
++
++ /* check adapter has corrected the error */
++ status = lancer_wait_ready(adapter);
++ sliport_status = ioread32(adapter->db +
++ SLIPORT_STATUS_OFFSET);
++ sliport_status &= (SLIPORT_STATUS_ERR_MASK |
++ SLIPORT_STATUS_RN_MASK);
++ if (status || sliport_status)
++ status = -1;
++ } else if (err || reset_needed) {
++ status = -1;
++ }
++ }
+ return status;
+ }
+
+@@ -2091,7 +3716,7 @@ static int __devinit be_probe(struct pci_dev *pdev,
+ int status = 0;
+ struct be_adapter *adapter;
+ struct net_device *netdev;
+- u8 mac[ETH_ALEN];
++ u32 en;
+
+ status = pci_enable_device(pdev);
+ if (status)
+@@ -2102,31 +3727,22 @@ static int __devinit be_probe(struct pci_dev *pdev,
+ goto disable_dev;
+ pci_set_master(pdev);
+
+- netdev = alloc_etherdev(sizeof(struct be_adapter));
++ netdev = alloc_etherdev_mq(sizeof(struct be_adapter), MAX_TX_QS);
+ if (netdev == NULL) {
+ status = -ENOMEM;
+ goto rel_reg;
+ }
+ adapter = netdev_priv(netdev);
+
+- switch (pdev->device) {
+- case BE_DEVICE_ID1:
+- case OC_DEVICE_ID1:
+- adapter->generation = BE_GEN2;
+- break;
+- case BE_DEVICE_ID2:
+- case OC_DEVICE_ID2:
+- adapter->generation = BE_GEN3;
+- break;
+- default:
+- adapter->generation = 0;
+- }
+-
+ adapter->pdev = pdev;
++
++ status = be_dev_family_check(adapter);
++ if (status)
++ goto free_netdev;
++
+ pci_set_drvdata(pdev, adapter);
+ adapter->netdev = netdev;
+-
+- be_msix_enable(adapter);
++ SET_NETDEV_DEV(netdev, &pdev->dev);
+
+ status = pci_set_dma_mask(pdev, DMA_BIT_MASK(64));
+ if (!status) {
+@@ -2139,46 +3755,150 @@ static int __devinit be_probe(struct pci_dev *pdev,
+ }
+ }
+
++ be_sriov_enable(adapter);
++ if (adapter->num_vfs > 0) {
++ adapter->vf_cfg = kcalloc(adapter->num_vfs,
++ sizeof(struct be_vf_cfg), GFP_KERNEL);
++
++ if (!adapter->vf_cfg)
++ goto free_netdev;
++ }
++
+ status = be_ctrl_init(adapter);
+ if (status)
+- goto free_netdev;
++ goto free_vf_cfg;
++
++ if (lancer_chip(adapter)) {
++ status = lancer_test_and_set_rdy_state(adapter);
++ if (status) {
++ dev_err(&pdev->dev, "Adapter in non recoverable error\n");
++ goto ctrl_clean;
++ }
++ }
++
++ /* sync up with fw's ready state */
++ if (be_physfn(adapter)) {
++ status = be_cmd_POST(adapter);
++ if (status)
++ goto ctrl_clean;
++ }
++
++ /* tell fw we're ready to fire cmds */
++ status = be_cmd_fw_init(adapter);
++ if (status)
++ goto ctrl_clean;
++
++ status = be_cmd_reset_function(adapter);
++ if (status)
++ goto ctrl_clean;
+
+ status = be_stats_init(adapter);
+ if (status)
+ goto ctrl_clean;
+
+- status = be_hw_up(adapter);
++ status = be_get_config(adapter);
+ if (status)
+ goto stats_clean;
+
+- status = be_cmd_mac_addr_query(adapter, mac, MAC_ADDRESS_TYPE_NETWORK,
+- true /* permanent */, 0);
+- if (status)
+- goto stats_clean;
+- memcpy(netdev->dev_addr, mac, ETH_ALEN);
++ /* This bit is zero in normal boot case, but in crash kernel case this
++ is not cleared. clear this bit here, until we are ready with the irqs
++ i.e in be_open call.*/
++ if (!lancer_chip(adapter))
++ be_intr_set(adapter, false);
++
++ if (msix)
++ be_msix_enable(adapter);
+
+ INIT_DELAYED_WORK(&adapter->work, be_worker);
+- be_netdev_init(netdev);
+- SET_NETDEV_DEV(netdev, &adapter->pdev->dev);
+
+ status = be_setup(adapter);
+ if (status)
+- goto stats_clean;
++ goto msix_disable;
++
++ /* Initilize the link status to -1 */
++ adapter->link_status = -1;
++
++ status = be_netdev_init(netdev);
++ if (status)
++ goto unsetup;
++
+ status = register_netdev(netdev);
+ if (status != 0)
+ goto unsetup;
+
+- dev_info(&pdev->dev, "%s port %d\n", nic_name(pdev), adapter->port_num);
++ be_cmd_get_fw_ver(adapter, adapter->fw_ver, NULL);
++
++ if (be_physfn(adapter) && adapter->num_vfs) {
++ u8 mac_speed;
++ int link_status;
++ u16 def_vlan, vf, lnk_speed;
++
++ status = be_vf_eth_addr_config(adapter);
++ if (status)
++ goto unreg_netdev;
++
++ for (vf = 0; vf < adapter->num_vfs; vf++) {
++ status = be_cmd_get_hsw_config(adapter, &def_vlan,
++ vf + 1, adapter->vf_cfg[vf].vf_if_handle);
++ if (!status)
++ adapter->vf_cfg[vf].vf_def_vid = def_vlan;
++ else
++ goto unreg_netdev;
++
++ status = be_cmd_link_status_query(adapter, &link_status,
++ &mac_speed, &lnk_speed, vf + 1);
++ if (!status)
++ adapter->vf_cfg[vf].vf_tx_rate = lnk_speed * 10;
++ else
++ goto unreg_netdev;
++ }
++ }
++ if (be_physfn(adapter)) {
++ /* Temp fix ofr bug# 23034. Till ARM
++ * f/w fixes privilege lvl */
++ be_get_port_names(adapter);
++ }
++
++ /* Enable Vlan capability based on privileges.
++ * PF will have Vlan capability anyway. */
++ be_cmd_get_fn_privileges(adapter, &en, 0);
++
++ if ((en & (BE_PRIV_FILTMGMT | BE_PRIV_VHADM | BE_PRIV_DEVCFG)) ||
++ be_physfn(adapter))
++ netdev->features |= NETIF_F_HW_VLAN_FILTER;
++ else
++ netdev->features |= NETIF_F_VLAN_CHALLENGED;
++
++ dev_info(&pdev->dev, "%s: numa node %d\n", netdev->name,
++ dev_to_node(&pdev->dev));
++ dev_info(&pdev->dev, "%s %s \"%s\" port %d\n", nic_name(pdev),
++ (adapter->port_num > 1 ? "1Gbps NIC" : "10Gbps NIC"),
++ adapter->model_number, adapter->hba_port_num);
++
++
++#ifdef CONFIG_PALAU
++ be_sysfs_create_group(adapter);
++#endif
++ schedule_delayed_work(&adapter->work, msecs_to_jiffies(100));
+ return 0;
+
++unreg_netdev:
++ unregister_netdev(netdev);
+ unsetup:
+ be_clear(adapter);
++msix_disable:
++ be_msix_disable(adapter);
+ stats_clean:
+ be_stats_cleanup(adapter);
+ ctrl_clean:
+ be_ctrl_cleanup(adapter);
++free_vf_cfg:
++ kfree(adapter->vf_cfg);
+ free_netdev:
+- free_netdev(adapter->netdev);
++ be_sriov_disable(adapter);
++ be_netif_napi_del(netdev);
++ free_netdev(netdev);
++ pci_set_drvdata(pdev, NULL);
+ rel_reg:
+ pci_release_regions(pdev);
+ disable_dev:
+@@ -2193,6 +3913,10 @@ static int be_suspend(struct pci_dev *pdev, pm_message_t state)
+ struct be_adapter *adapter = pci_get_drvdata(pdev);
+ struct net_device *netdev = adapter->netdev;
+
++ cancel_delayed_work_sync(&adapter->work);
++ if (adapter->wol)
++ be_setup_wol(adapter, true);
++
+ netif_device_detach(netdev);
+ if (netif_running(netdev)) {
+ rtnl_lock();
+@@ -2202,6 +3926,7 @@ static int be_suspend(struct pci_dev *pdev, pm_message_t state)
+ be_cmd_get_flow_control(adapter, &adapter->tx_fc, &adapter->rx_fc);
+ be_clear(adapter);
+
++ be_msix_disable(adapter);
+ pci_save_state(pdev);
+ pci_disable_device(pdev);
+ pci_set_power_state(pdev, pci_choose_state(pdev, state));
+@@ -2223,6 +3948,12 @@ static int be_resume(struct pci_dev *pdev)
+ pci_set_power_state(pdev, 0);
+ pci_restore_state(pdev);
+
++ be_msix_enable(adapter);
++ /* tell fw we're ready to fire cmds */
++ status = be_cmd_fw_init(adapter);
++ if (status)
++ return status;
++
+ be_setup(adapter);
+ if (netif_running(netdev)) {
+ rtnl_lock();
+@@ -2230,28 +3961,152 @@ static int be_resume(struct pci_dev *pdev)
+ rtnl_unlock();
+ }
+ netif_device_attach(netdev);
++
++ if (adapter->wol)
++ be_setup_wol(adapter, false);
++
++ schedule_delayed_work(&adapter->work, msecs_to_jiffies(100));
+ return 0;
+ }
+
++/*
++ * An FLR will stop BE from DMAing any data.
++ */
++static void be_shutdown(struct pci_dev *pdev)
++{
++ struct be_adapter *adapter = pci_get_drvdata(pdev);
++
++ if (!adapter)
++ return;
++
++ cancel_delayed_work_sync(&adapter->work);
++
++ netif_device_detach(adapter->netdev);
++
++ if (adapter->wol)
++ be_setup_wol(adapter, true);
++
++ be_cmd_reset_function(adapter);
++
++ pci_disable_device(pdev);
++}
++
++static pci_ers_result_t be_eeh_err_detected(struct pci_dev *pdev,
++ pci_channel_state_t state)
++{
++ struct be_adapter *adapter = pci_get_drvdata(pdev);
++ struct net_device *netdev = adapter->netdev;
++
++ dev_err(&adapter->pdev->dev, "EEH error detected\n");
++
++ adapter->eeh_err = true;
++
++ netif_device_detach(netdev);
++
++ if (netif_running(netdev)) {
++ rtnl_lock();
++ be_close(netdev);
++ rtnl_unlock();
++ }
++ be_clear(adapter);
++
++ if (state == pci_channel_io_perm_failure)
++ return PCI_ERS_RESULT_DISCONNECT;
++
++ pci_disable_device(pdev);
++
++ return PCI_ERS_RESULT_NEED_RESET;
++}
++
++static pci_ers_result_t be_eeh_reset(struct pci_dev *pdev)
++{
++ struct be_adapter *adapter = pci_get_drvdata(pdev);
++ int status;
++
++ dev_info(&adapter->pdev->dev, "EEH reset\n");
++ adapter->eeh_err = false;
++
++ status = pci_enable_device(pdev);
++ if (status)
++ return PCI_ERS_RESULT_DISCONNECT;
++
++ pci_set_master(pdev);
++ pci_set_power_state(pdev, 0);
++ pci_restore_state(pdev);
++
++ /* Check if card is ok and fw is ready */
++ status = be_cmd_POST(adapter);
++ if (status)
++ return PCI_ERS_RESULT_DISCONNECT;
++
++ return PCI_ERS_RESULT_RECOVERED;
++}
++
++static void be_eeh_resume(struct pci_dev *pdev)
++{
++ int status = 0;
++ struct be_adapter *adapter = pci_get_drvdata(pdev);
++ struct net_device *netdev = adapter->netdev;
++
++ dev_info(&adapter->pdev->dev, "EEH resume\n");
++
++ pci_save_state(pdev);
++
++ /* tell fw we're ready to fire cmds */
++ status = be_cmd_fw_init(adapter);
++ if (status)
++ goto err;
++
++ status = be_setup(adapter);
++ if (status)
++ goto err;
++
++ if (netif_running(netdev)) {
++ status = be_open(netdev);
++ if (status)
++ goto err;
++ }
++ netif_device_attach(netdev);
++ return;
++err:
++ dev_err(&adapter->pdev->dev, "EEH resume failed\n");
++ return;
++}
++
++static struct pci_error_handlers be_eeh_handlers = {
++ .error_detected = be_eeh_err_detected,
++ .slot_reset = be_eeh_reset,
++ .resume = be_eeh_resume,
++};
++
+ static struct pci_driver be_driver = {
+ .name = DRV_NAME,
+ .id_table = be_dev_ids,
+ .probe = be_probe,
+ .remove = be_remove,
+ .suspend = be_suspend,
+- .resume = be_resume
++ .resume = be_resume,
++ .shutdown = be_shutdown,
++ .err_handler = &be_eeh_handlers
+ };
+
+ static int __init be_init_module(void)
+ {
+- if (rx_frag_size != 8192 && rx_frag_size != 4096
+- && rx_frag_size != 2048) {
++ if (rx_frag_size != 8192 && rx_frag_size != 4096 &&
++ rx_frag_size != 2048) {
+ printk(KERN_WARNING DRV_NAME
+ " : Module param rx_frag_size must be 2048/4096/8192."
+ " Using 2048\n");
+ rx_frag_size = 2048;
+ }
+
++ if (!msix && num_vfs > 0) {
++ printk(KERN_WARNING DRV_NAME
++ " : MSIx required for num_vfs > 0. Ignoring msix=0\n");
++ msix = 1;
++ }
++
++
+ return pci_register_driver(&be_driver);
+ }
+ module_init(be_init_module);
+diff --git a/drivers/net/benet/be_misc.c b/drivers/net/benet/be_misc.c
+new file mode 100644
+index 0000000..4ab499f
+--- /dev/null
++++ b/drivers/net/benet/be_misc.c
+@@ -0,0 +1,106 @@
++/*
++ * Copyright (C) 2005 - 2011 Emulex
++ * All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License version 2
++ * as published by the Free Software Foundation. The full GNU General
++ * Public License is included in this distribution in the file called COPYING.
++ *
++ * Contact Information:
++ * linux-drivers@emulex.com
++ *
++ * Emulex
++ * 3333 Susan Street
++ * Costa Mesa, CA 92626
++ */
++#include "be.h"
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 24)
++static ssize_t
++flash_fw_store(struct class_device *cd, const char *buf, size_t len)
++{
++ struct be_adapter *adapter =
++ netdev_priv(container_of(cd, struct net_device, class_dev));
++ char file_name[ETHTOOL_FLASH_MAX_FILENAME];
++ int status;
++
++ if (!capable(CAP_NET_ADMIN))
++ return -EPERM;
++
++ file_name[ETHTOOL_FLASH_MAX_FILENAME - 1] = 0;
++ strncpy(file_name, buf, (ETHTOOL_FLASH_MAX_FILENAME - 1));
++
++ /* Removing new-line char given by sysfs */
++ file_name[strlen(file_name) - 1] = '\0';
++
++ status = be_load_fw(adapter, file_name);
++ if (!status)
++ return len;
++ else
++ return status;
++}
++
++static CLASS_DEVICE_ATTR(flash_fw, S_IWUSR, NULL, flash_fw_store);
++
++static struct attribute *benet_attrs[] = {
++ &class_device_attr_flash_fw.attr,
++ NULL,
++};
++#else
++
++static ssize_t
++flash_fw_store(struct device *dev, struct device_attribute *attr,
++ const char *buf, size_t len)
++{
++ struct be_adapter *adapter =
++ netdev_priv(container_of(dev, struct net_device, dev));
++ char file_name[ETHTOOL_FLASH_MAX_FILENAME];
++ int status;
++
++ if (!capable(CAP_NET_ADMIN))
++ return -EPERM;
++
++ file_name[ETHTOOL_FLASH_MAX_FILENAME - 1] = 0;
++ strncpy(file_name, buf, (ETHTOOL_FLASH_MAX_FILENAME - 1));
++
++ /* Removing new-line char given by sysfs */
++ file_name[strlen(file_name) - 1] = '\0';
++
++ status = be_load_fw(adapter, file_name);
++ if (!status)
++ return len;
++ else
++ return status;
++}
++
++static DEVICE_ATTR(flash_fw, S_IWUSR, NULL, flash_fw_store);
++
++static struct attribute *benet_attrs[] = {
++ &dev_attr_flash_fw.attr,
++ NULL,
++};
++#endif
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 24)
++#define CLASS_DEV class_dev
++#else
++#define CLASS_DEV dev
++#endif
++
++static struct attribute_group benet_attr_group = {.attrs = benet_attrs };
++
++void be_sysfs_create_group(struct be_adapter *adapter)
++{
++ int status;
++
++ status = sysfs_create_group(&adapter->netdev->CLASS_DEV.kobj,
++ &benet_attr_group);
++ if (status)
++ dev_err(&adapter->pdev->dev, "Could not create sysfs group\n");
++}
++
++void be_sysfs_remove_group(struct be_adapter *adapter)
++{
++ sysfs_remove_group(&adapter->netdev->CLASS_DEV.kobj, &benet_attr_group);
++}
+diff --git a/drivers/net/benet/be_proc.c b/drivers/net/benet/be_proc.c
+new file mode 100644
+index 0000000..0bfdb3b
+--- /dev/null
++++ b/drivers/net/benet/be_proc.c
+@@ -0,0 +1,513 @@
++/*
++ * Copyright (C) 2005 - 2011 ServerEngines
++ * All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License version 2
++ * as published by the Free Software Foundation. The full GNU General
++ * Public License is included in this distribution in the file called COPYING.
++ *
++ * Contact Information:
++ * linux-drivers@serverengines.com
++ *
++ * ServerEngines
++ * 209 N. Fair Oaks Ave
++ * Sunnyvale, CA 94085
++ */
++#include <linux/proc_fs.h>
++#include "be.h"
++
++char *be_adpt_name[] = {
++ "driver/be2net0",
++ "driver/be2net1",
++ "driver/be2net2",
++ "driver/be2net3",
++ "driver/be2net4",
++ "driver/be2net5",
++ "driver/be2net6",
++ "driver/be2net7"
++};
++
++#define MAX_BE_DEVICES 8
++struct proc_dir_entry *be_proc_dir[MAX_BE_DEVICES];
++
++/*File to read Eth Ring Information */
++#define BE_ETH_RING_FILE "eth_ring"
++#define BE_DRVR_STAT_FILE "drvr_stat"
++
++/*
++ * this file enables user to read a 32 bit CSR register.
++ * to read 32 bit value of a register at offset 0x1234,
++ * first write the offset 0x1234 (echo "0x1234") in
++ * the file and then read the value from this file.
++ * the written offset is latched until another value is written
++ */
++#define BE_CSR_R_FILE "csrr"
++/*
++ * this file enables user to write to a 32 bit CSR register.
++ * to write a value 0xdeadbeef to a register at offset 0x1234,
++ * write 0x1234 0xdeadbeef (echo "0x1234 0xdeadbeeb") to
++ * the file.
++ */
++#define BE_CSR_W_FILE "csrw"
++
++#define BE_PROC_MODE 0600
++
++static char read_eth_ring_buf[4096];
++static int read_eth_ring_count;
++
++/*
++ * Get Various Eth Ring Properties
++ */
++static int proc_eth_read_ring(char *page, char **start,
++ off_t off, int count, int *eof, void *data)
++{
++ int i, n;
++ char *p = read_eth_ring_buf;
++ struct be_adapter *adapter = (struct be_adapter *) data;
++
++ if (off == 0) {
++ /* Reset read_eth_ring_count */
++ read_eth_ring_count = 0;
++
++ n = sprintf(p, " PhyAddr VirtAddr Size TotalEntries ProducerIndex ConsumerIndex NumUsed\n");
++ p += n;
++ read_eth_ring_count += n;
++
++ n = sprintf(p, " ------- -------- ---- ------------ ------------- ------------- -------\n");
++ p += n;
++ read_eth_ring_count += n;
++
++ n = sprintf(p, "%s", "EthSendRing");
++ p += n;
++ read_eth_ring_count += n;
++
++ n = sprintf(p, " %7lx %8p %4u %12u %13u %13u %7u \n",
++ (long) adapter->tx_obj.q.dma_mem.dma,
++ (void *)adapter->tx_obj.q.dma_mem.va,
++ (u32) (adapter->tx_obj.q.len *
++ sizeof(struct be_eth_wrb)),
++ adapter->tx_obj.q.len, adapter->tx_obj.q.head,
++ adapter->tx_obj.q.tail,
++ atomic_read(&adapter->tx_obj.q.used));
++
++ p += n;
++ read_eth_ring_count += n;
++
++ /* Get Eth Send Compl Queue Details */
++ n = sprintf(p, "%s", "EthSendCmplRing");
++ p += n;
++ read_eth_ring_count += n;
++
++ n = sprintf(p, " %7lx %8p %4u %12u %13s %13u %7s\n",
++ (long)adapter->tx_obj.cq.dma_mem.dma,
++ (void *)adapter->tx_obj.cq.dma_mem.va,
++ (u32) (adapter->tx_obj.cq.len *
++ sizeof(struct be_eth_tx_compl)),
++ adapter->tx_obj.cq.len, "NA",
++ adapter->tx_obj.cq.tail, "NA");
++
++ p += n;
++ read_eth_ring_count += n;
++ /* Get Eth Rx Queue Details */
++ n = sprintf(p, "%s", "EthRxRing");
++ p += n;
++ read_eth_ring_count += n;
++
++ n = sprintf(p, " %7lx %8p %4u %12u %13u %13s %7u \n",
++ (long)adapter->rx_obj.q.dma_mem.dma,
++ (void *)adapter->rx_obj.q.dma_mem.va,
++ (u32) (adapter->rx_obj.q.len *
++ sizeof(struct be_eth_rx_d)),
++ adapter->rx_obj.q.len, adapter->rx_obj.q.head,"NA",
++ atomic_read(&adapter->rx_obj.q.used));
++ p += n;
++ read_eth_ring_count += n;
++
++ /* Get Eth Unicast Rx Compl Queue Details */
++ n = sprintf(p, "%s", "EthRxCmplRing");
++ p += n;
++ read_eth_ring_count += n;
++
++ n = sprintf(p, " %7lx %8p %4u %12u %13s %13u %7s\n",
++ (long)adapter->rx_obj.cq.dma_mem.dma,
++ (void *)adapter->rx_obj.cq.dma_mem.va,
++ (u32) (adapter->rx_obj.cq.len *
++ sizeof(struct be_eth_rx_compl)),
++ adapter->rx_obj.cq.len, "NA",
++ adapter->rx_obj.cq.tail, "NA");
++ p += n;
++ read_eth_ring_count += n;
++
++ /* Get Eth Event Queue Details */
++ n = sprintf(p, "%s", "EthTxEventRing");
++ p += n;
++ read_eth_ring_count += n;
++
++ n = sprintf(p,
++ " %7lx %8p %4u %12u %13s %13u %7s\n",
++ (long) adapter->tx_eq.q.dma_mem.dma,
++ (void *)adapter->tx_eq.q.dma_mem.va,
++ (u32) (adapter->tx_eq.q.len *
++ sizeof(struct be_eq_entry)),
++ adapter->tx_eq.q.len, "NA",
++ adapter->tx_eq.q.tail, "NA");
++
++ p += n;
++ read_eth_ring_count += n;
++
++ /* Get Eth Event Queue Details */
++ n = sprintf(p, "%s", "EthRxEventRing");
++ p += n;
++ read_eth_ring_count += n;
++
++ n = sprintf(p,
++ " %7lx %8p %4u %12u %13s %13u %7s\n",
++ (long) adapter->rx_eq.q.dma_mem.dma,
++ (void *)adapter->rx_eq.q.dma_mem.va,
++ (u32) (adapter->rx_eq.q.len *
++ sizeof(struct be_eq_entry)),
++ adapter->rx_eq.q.len, "NA",
++ adapter->rx_eq.q.tail, "NA");
++
++ p += n;
++ read_eth_ring_count += n;
++ }
++
++ *start = page;
++ /* copy whatever we can */
++ if (count < (read_eth_ring_count - off)) {
++ i = count;
++ *eof = 0; /* More bytes left */
++ } else {
++ i = read_eth_ring_count - off;
++ *eof = 1; /* Nothing left. indicate EOF */
++ }
++
++ memcpy(page, read_eth_ring_buf + off, i);
++ return (i);
++}
++
++static int proc_eth_write_ring(struct file *file,
++ const char *buffer, unsigned long count,
++ void *data)
++{
++ return (count); /* we do not support write */
++}
++
++/*
++ * read the driver stats.
++ */
++static int proc_read_drvr_stat(char *page, char **start,
++ off_t off, int count, int *eof, void *data)
++{
++ int n, lro_cp;
++ char *p = page;
++ struct be_adapter *adapter = (struct be_adapter *) data;
++ struct net_device *netdev = adapter->netdev;
++
++ if (off == 0) {
++ n = sprintf(p, "interface = %s\n", netdev->name);
++ p += n;
++ n = sprintf(p, "tx_reqs = %d\n",
++ drvr_stats(adapter)->be_tx_reqs);
++ p += n;
++ n = sprintf(p, "tx_stops = %d\n",
++ drvr_stats(adapter)->be_tx_stops);
++ p += n;
++ n = sprintf(p, "fwd_reqs = %d\n",
++ drvr_stats(adapter)->be_fwd_reqs);
++ p += n;
++ n = sprintf(p, "tx_wrbs = %d\n",
++ drvr_stats(adapter)->be_tx_wrbs);
++ p += n;
++ n = sprintf(p, "rx_poll = %d\n", drvr_stats(adapter)->be_rx_polls);
++ p += n;
++ n = sprintf(p, "tx_events = %d\n",
++ drvr_stats(adapter)->be_tx_events);
++ p += n;
++ n = sprintf(p, "rx_events = %d\n",
++ drvr_stats(adapter)->be_rx_events);
++ p += n;
++ n = sprintf(p, "tx_compl = %d\n",
++ drvr_stats(adapter)->be_tx_compl);
++ p += n;
++ n = sprintf(p, "rx_compl = %d\n",
++ drvr_stats(adapter)->be_rx_compl);
++ p += n;
++ n = sprintf(p, "ethrx_post_fail = %d\n",
++ drvr_stats(adapter)->be_ethrx_post_fail);
++ p += n;
++ n = sprintf(p, "802.3_dropped_frames = %d\n",
++ drvr_stats(adapter)->be_802_3_dropped_frames);
++ p += n;
++ n = sprintf(p, "802.3_malformed_frames = %d\n",
++ drvr_stats(adapter)->be_802_3_malformed_frames);
++ p += n;
++ n = sprintf(p, "eth_tx_rate = %d\n",
++ drvr_stats(adapter)->be_tx_rate);
++ p += n;
++ n = sprintf(p, "eth_rx_rate = %d\n",
++ drvr_stats(adapter)->be_rx_rate);
++ p += n;
++
++ lro_cp = (drvr_stats(adapter)->be_lro_hgram_data[0] +
++ drvr_stats(adapter)->be_lro_hgram_data[1] +
++ drvr_stats(adapter)->be_lro_hgram_data[2] +
++ drvr_stats(adapter)->be_lro_hgram_data[3] +
++ drvr_stats(adapter)->be_lro_hgram_data[4] +
++ drvr_stats(adapter)->be_lro_hgram_data[5] +
++ drvr_stats(adapter)->be_lro_hgram_data[6] +
++ drvr_stats(adapter)->be_lro_hgram_data[7])/100;
++ lro_cp = (lro_cp == 0) ? 1 : lro_cp; /* avoid divide by 0 */
++ n = sprintf(p,
++ "LRO data count %% histogram (1, 2-3, 4-5,..,>=16) = "
++ "%d, %d, %d, %d - %d, %d, %d, %d\n",
++ drvr_stats(adapter)->be_lro_hgram_data[0]/lro_cp,
++ drvr_stats(adapter)->be_lro_hgram_data[1]/lro_cp,
++ drvr_stats(adapter)->be_lro_hgram_data[2]/lro_cp,
++ drvr_stats(adapter)->be_lro_hgram_data[3]/lro_cp,
++ drvr_stats(adapter)->be_lro_hgram_data[4]/lro_cp,
++ drvr_stats(adapter)->be_lro_hgram_data[5]/lro_cp,
++ drvr_stats(adapter)->be_lro_hgram_data[6]/lro_cp,
++ drvr_stats(adapter)->be_lro_hgram_data[7]/lro_cp);
++ p += n;
++
++ lro_cp = (drvr_stats(adapter)->be_lro_hgram_ack[0] +
++ drvr_stats(adapter)->be_lro_hgram_ack[1] +
++ drvr_stats(adapter)->be_lro_hgram_ack[2] +
++ drvr_stats(adapter)->be_lro_hgram_ack[3] +
++ drvr_stats(adapter)->be_lro_hgram_ack[4] +
++ drvr_stats(adapter)->be_lro_hgram_ack[5] +
++ drvr_stats(adapter)->be_lro_hgram_ack[6] +
++ drvr_stats(adapter)->be_lro_hgram_ack[7])/100;
++ lro_cp = (lro_cp == 0) ? 1 : lro_cp; /* avoid divide by 0 */
++ n = sprintf(p,
++ "LRO ack count %% histogram (1, 2-3, 4-5,..,>=16) = "
++ "%d, %d, %d, %d - %d, %d, %d, %d\n",
++ drvr_stats(adapter)->be_lro_hgram_ack[0]/lro_cp,
++ drvr_stats(adapter)->be_lro_hgram_ack[1]/lro_cp,
++ drvr_stats(adapter)->be_lro_hgram_ack[2]/lro_cp,
++ drvr_stats(adapter)->be_lro_hgram_ack[3]/lro_cp,
++ drvr_stats(adapter)->be_lro_hgram_ack[4]/lro_cp,
++ drvr_stats(adapter)->be_lro_hgram_ack[5]/lro_cp,
++ drvr_stats(adapter)->be_lro_hgram_ack[6]/lro_cp,
++ drvr_stats(adapter)->be_lro_hgram_ack[7]/lro_cp);
++ p += n;
++ n = sprintf(p, "rx_eq_delay = %d \n", adapter->rx_eq.cur_eqd);
++ p += n;
++ n = sprintf(p, "rx frags per sec=%d \n",
++ drvr_stats(adapter)->be_rx_fps);
++ p += n;
++
++ }
++ *eof = 1;
++ return (p - page);
++}
++
++static int proc_write_drvr_stat(struct file *file,
++ const char *buffer, unsigned long count,
++ void *data)
++{
++ struct be_adapter *adapter = (struct be_adapter *) data;
++
++ memset(&(adapter->stats.drvr_stats), 0,
++ sizeof(adapter->stats.drvr_stats));
++ return (count); /* we do not support write */
++}
++
++#if 0
++/* the following are some of the functions that are needed here
++ * until all initializations are done by MPU.
++ */
++
++u32
++CsrReadDr(void* BaseAddress, u32 Offset)
++{
++ u32 *rp;
++
++ rp = (u32 *) (((u8 *) BaseAddress) + Offset);
++ return (*rp);
++}
++
++/*!
++
++@brief
++ This routine writes to a register located within the CSR
++ space for a given function object.
++
++@param
++ FuncObj - Pointer to the function object to read from.
++
++@param
++ Offset - The Offset (in bytes) to write to within the function's CSR space.
++
++@param
++ Value - The value to write to the register.
++
++@return
++
++@note
++ IRQL: any
++
++*/
++void
++CsrWriteDr(void* BaseAddress, u32 Offset, u32 Value)
++{
++ u32 *Register;
++
++ Register = (u32 *) (((u8 *) BaseAddress) + Offset);
++
++ //TRACE(DL_INFO, "CsrWrite[ %X ] <= %X", Register, Value);
++ *Register = Value;
++}
++u32 be_proc_csrr_offset = -1; /* to latch the offset of next CSR Read req. */
++
++/*
++ * read the csr_r file. return the 32 bit register value from
++ * CSR space at offset latched in the global location
++ * be_proc_csrr_offset
++ */
++static int proc_read_csr_r(char *page, char **start,
++ off_t off, int count, int *eof, void *data)
++{
++ struct be_adapter * adapter = (struct be_adapter *)data;
++ u32 val;
++ int n = 0;
++ if (be_proc_csrr_offset == -1)
++ return -EINVAL;
++
++ if (off == 0) {
++ /* read the CSR at offset be_proc_csrr_offset and return */
++ val = CsrReadDr(adapter->csr_va, be_proc_csrr_offset);
++ n = sprintf(page, "0x%x\n", val);
++ }
++ *eof = 1;
++ return n;
++}
++
++/*
++ * save the written value in be_proc_csrr_offset for next
++ * read from the file
++ */
++static int proc_write_csr_r(struct file *file,
++ const char *buffer, unsigned long count, void *data)
++{
++ char buf[64];
++ u32 n;
++
++ if (count > sizeof(buf) + 1)
++ return -EINVAL;
++ if (copy_from_user(buf, buffer, count))
++ return -EFAULT;
++ buf[count] = '\0';
++
++ n = simple_strtoul(buf, NULL, 16);
++ if (n < 0x50000)
++ be_proc_csrr_offset = n;
++ return (count);
++}
++
++/*
++ * return the latched offset for reading the csr_r file.
++ */
++static int proc_read_csr_w(char *page, char **start,
++ off_t off, int count, int *eof, void *data)
++{
++
++ *eof = 1;
++ return sprintf(page, "0x%x\n", be_proc_csrr_offset);
++}
++
++/*
++ * the incoming string is of the form "<offset> <value>"
++ * where the offset is the offset of the register to be written
++ * and value is the value to be written.
++ */
++static int proc_write_csr_w(struct file *file,
++ const char *buffer, unsigned long count,
++ void *data)
++{
++ char buf[64];
++ char *p;
++ u32 n, val;
++ struct be_adapter * adapter = (struct be_adapter *)data;
++
++ if (count > sizeof(buf) + 1)
++ return -EINVAL;
++ if (copy_from_user(buf, buffer, count))
++ return -EFAULT;
++ buf[count] = '\0';
++
++ n = simple_strtoul(buf, &p, 16);
++ if (n > 0x50000)
++ return -EINVAL;
++
++ /* now get the actual value to be written */
++ while (*p == ' ' || *p == '\t')
++ p++;
++ val = simple_strtoul(p, NULL, 16);
++ CsrWriteDr(adapter->csr_va, n, val);
++ return (count);
++}
++#endif
++
++void be_init_procfs(struct be_adapter *adapter, int adapt_num)
++{
++ static struct proc_dir_entry *pde;
++
++ if (adapt_num > MAX_BE_DEVICES - 1)
++ return;
++
++ /* create directory */
++ be_proc_dir[adapt_num] =
++ proc_mkdir(be_adpt_name[adapt_num], NULL);
++ if (be_proc_dir[adapt_num]) {
++ (be_proc_dir[adapt_num])->owner = THIS_MODULE;
++ }
++
++ pde = create_proc_entry(BE_ETH_RING_FILE, BE_PROC_MODE,
++ be_proc_dir[adapt_num]);
++ if (pde) {
++ pde->read_proc = proc_eth_read_ring;
++ pde->write_proc = proc_eth_write_ring;
++ pde->data = adapter;
++ pde->owner = THIS_MODULE;
++ }
++
++ pde = create_proc_entry(BE_DRVR_STAT_FILE, BE_PROC_MODE,
++ be_proc_dir[adapt_num]);
++ if (pde) {
++ pde->read_proc = proc_read_drvr_stat;
++ pde->write_proc = proc_write_drvr_stat;
++ pde->data = adapter;
++ pde->owner = THIS_MODULE;
++ }
++
++#if 0
++ if ((pde = create_proc_entry(BE_CSR_R_FILE, BE_PROC_MODE, be_proc_dir[adapt_num]))) {
++ pde->read_proc = proc_read_csr_r;
++ pde->write_proc = proc_write_csr_r;
++ pde->data = adapter;
++ pde->owner = THIS_MODULE;
++ }
++
++ if ((pde = create_proc_entry(BE_CSR_W_FILE, BE_PROC_MODE, be_proc_dir[adapt_num]))) {
++ pde->read_proc = proc_read_csr_w;
++ pde->write_proc = proc_write_csr_w;
++ pde->data = adapter;
++ pde->owner = THIS_MODULE;
++ }
++#endif
++}
++
++void be_cleanup_procfs(struct be_adapter *adapter, int adapt_num)
++{
++ if (adapt_num > MAX_BE_DEVICES - 1)
++ return;
++ remove_proc_entry(BE_ETH_RING_FILE, be_proc_dir[adapt_num]);
++ remove_proc_entry(BE_DRVR_STAT_FILE, be_proc_dir[adapt_num]);
++ remove_proc_entry(BE_CSR_R_FILE, be_proc_dir[adapt_num]);
++ remove_proc_entry(BE_CSR_W_FILE, be_proc_dir[adapt_num]);
++ remove_proc_entry(be_adpt_name[adapt_num], NULL);
++}
+diff --git a/drivers/net/benet/version.h b/drivers/net/benet/version.h
+new file mode 100644
+index 0000000..c7ed692
+--- /dev/null
++++ b/drivers/net/benet/version.h
+@@ -0,0 +1,51 @@
++#define STR_BE_BRANCH "0"
++#define STR_BE_BUILD "479"
++#define STR_BE_DOT "0"
++#define STR_BE_MINOR "0"
++#define STR_BE_MAJOR "4"
++
++#define BE_BRANCH 0
++#define BE_BUILD 479
++#define BE_DOT 0
++#define BE_MINOR 0
++#define BE_MAJOR 4
++
++#define MGMT_BRANCH 0
++#define MGMT_BUILDNUM 479
++#define MGMT_MINOR 0
++#define MGMT_MAJOR 4
++
++#define BE_REDBOOT_VERSION "2.0.5.0"
++
++//start-auto
++#define BUILD_MONTH "12"
++#define BUILD_MONTH_NAME "December"
++#define BUILD_DAY "6"
++#define BUILD_YEAR "2011"
++#define BUILD_24HOUR "21"
++#define BUILD_12HOUR "9"
++#define BUILD_AM_PM "PM"
++#define BUILD_MIN "48"
++#define BUILD_SEC "05"
++#define BUILD_MONTH_NUMBER 12
++#define BUILD_DAY_NUMBER 6
++#define BUILD_YEAR_NUMBER 2011
++#define BUILD_24HOUR_NUMBER 21
++#define BUILD_12HOUR_NUMBER 9
++#define BUILD_MIN_NUMBER 48
++#define BUILD_SEC_NUMBER 5
++#undef MAJOR_BUILD
++#undef MINOR_BUILD
++#undef DOT_BUILD
++#define NUMBERED_BUILD
++#undef BRANCH_BUILD
++//end-auto
++
++#define ELX_FCOE_XROM_BIOS_VER "7.03a1"
++#define ELX_FCoE_X86_VER "4.02a1"
++#define ELX_FCoE_EFI_VER "5.01a1"
++#define ELX_FCoE_FCODE_VER "4.01a0"
++#define ELX_PXE_BIOS_VER "3.00a5"
++#define ELX_UEFI_NIC_VER "2.10A10"
++#define ELX_UEFI_FCODE_VER "1.10A0"
++#define ELX_ISCSI_BIOS_VER "1.00A8"
+diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
+index 4874b2b..67f8526 100644
+--- a/drivers/net/bnx2.c
++++ b/drivers/net/bnx2.c
+@@ -5809,6 +5809,8 @@ bnx2_test_nvram(struct bnx2 *bp)
+ int rc = 0;
+ u32 magic, csum;
+
++ pax_track_stack();
++
+ if ((rc = bnx2_nvram_read(bp, 0, data, 4)) != 0)
+ goto test_nvram_done;
+
+diff --git a/drivers/net/cxgb3/l2t.h b/drivers/net/cxgb3/l2t.h
+index fd3eb07..8a6978d 100644
+--- a/drivers/net/cxgb3/l2t.h
++++ b/drivers/net/cxgb3/l2t.h
+@@ -86,7 +86,7 @@ typedef void (*arp_failure_handler_func)(struct t3cdev * dev,
+ */
+ struct l2t_skb_cb {
+ arp_failure_handler_func arp_failure_handler;
+-};
++} __no_const;
+
+ #define L2T_SKB_CB(skb) ((struct l2t_skb_cb *)(skb)->cb)
+
+diff --git a/drivers/net/cxgb3/t3_hw.c b/drivers/net/cxgb3/t3_hw.c
+index 032cfe0..411af379 100644
+--- a/drivers/net/cxgb3/t3_hw.c
++++ b/drivers/net/cxgb3/t3_hw.c
+@@ -699,6 +699,8 @@ static int get_vpd_params(struct adapter *adapter, struct vpd_params *p)
+ int i, addr, ret;
+ struct t3_vpd vpd;
+
++ pax_track_stack();
++
+ /*
+ * Card information is normally at VPD_BASE but some early cards had
+ * it at 0.
+diff --git a/drivers/net/dl2k.c b/drivers/net/dl2k.c
+index 7fa7a90..fef924d 100644
+--- a/drivers/net/dl2k.c
++++ b/drivers/net/dl2k.c
+@@ -1279,55 +1279,21 @@ rio_ioctl (struct net_device *dev, struct ifreq *rq, int cmd)
+ {
+ int phy_addr;
+ struct netdev_private *np = netdev_priv(dev);
+- struct mii_data *miidata = (struct mii_data *) &rq->ifr_ifru;
+-
+- struct netdev_desc *desc;
+- int i;
++ struct mii_ioctl_data *miidata = if_mii(rq);
+
+ phy_addr = np->phy_addr;
+ switch (cmd) {
+- case SIOCDEVPRIVATE:
++ case SIOCGMIIPHY:
++ miidata->phy_id = phy_addr;
+ break;
+-
+- case SIOCDEVPRIVATE + 1:
+- miidata->out_value = mii_read (dev, phy_addr, miidata->reg_num);
++ case SIOCGMIIREG:
++ miidata->val_out = mii_read (dev, phy_addr, miidata->reg_num);
+ break;
+- case SIOCDEVPRIVATE + 2:
+- mii_write (dev, phy_addr, miidata->reg_num, miidata->in_value);
++ case SIOCSMIIREG:
++ if (!capable(CAP_NET_ADMIN))
++ return -EPERM;
++ mii_write (dev, phy_addr, miidata->reg_num, miidata->val_in);
+ break;
+- case SIOCDEVPRIVATE + 3:
+- break;
+- case SIOCDEVPRIVATE + 4:
+- break;
+- case SIOCDEVPRIVATE + 5:
+- netif_stop_queue (dev);
+- break;
+- case SIOCDEVPRIVATE + 6:
+- netif_wake_queue (dev);
+- break;
+- case SIOCDEVPRIVATE + 7:
+- printk
+- ("tx_full=%x cur_tx=%lx old_tx=%lx cur_rx=%lx old_rx=%lx\n",
+- netif_queue_stopped(dev), np->cur_tx, np->old_tx, np->cur_rx,
+- np->old_rx);
+- break;
+- case SIOCDEVPRIVATE + 8:
+- printk("TX ring:\n");
+- for (i = 0; i < TX_RING_SIZE; i++) {
+- desc = &np->tx_ring[i];
+- printk
+- ("%02x:cur:%08x next:%08x status:%08x frag1:%08x frag0:%08x",
+- i,
+- (u32) (np->tx_ring_dma + i * sizeof (*desc)),
+- (u32)le64_to_cpu(desc->next_desc),
+- (u32)le64_to_cpu(desc->status),
+- (u32)(le64_to_cpu(desc->fraginfo) >> 32),
+- (u32)le64_to_cpu(desc->fraginfo));
+- printk ("\n");
+- }
+- printk ("\n");
+- break;
+-
+ default:
+ return -EOPNOTSUPP;
+ }
+diff --git a/drivers/net/dl2k.h b/drivers/net/dl2k.h
+index 266ec87..466b2f5 100644
+--- a/drivers/net/dl2k.h
++++ b/drivers/net/dl2k.h
+@@ -471,13 +471,6 @@ struct ioctl_data {
+ char *data;
+ };
+
+-struct mii_data {
+- __u16 reserved;
+- __u16 reg_num;
+- __u16 in_value;
+- __u16 out_value;
+-};
+-
+ /* The Rx and Tx buffer descriptors. */
+ struct netdev_desc {
+ __le64 next_desc;
+@@ -551,4 +544,7 @@ MODULE_DEVICE_TABLE (pci, rio_pci_tbl);
+ #define DEFAULT_RXT 750
+ #define DEFAULT_TXC 1
+ #define MAX_TXC 8
++
++#include <linux/mii.h>
++
+ #endif /* __DL2K_H__ */
+diff --git a/drivers/net/e1000e/82571.c b/drivers/net/e1000e/82571.c
+index d1e0563..b9e129c 100644
+--- a/drivers/net/e1000e/82571.c
++++ b/drivers/net/e1000e/82571.c
+@@ -212,7 +212,7 @@ static s32 e1000_init_mac_params_82571(struct e1000_adapter *adapter)
+ {
+ struct e1000_hw *hw = &adapter->hw;
+ struct e1000_mac_info *mac = &hw->mac;
+- struct e1000_mac_operations *func = &mac->ops;
++ e1000_mac_operations_no_const *func = &mac->ops;
+ u32 swsm = 0;
+ u32 swsm2 = 0;
+ bool force_clear_smbi = false;
+@@ -1656,7 +1656,7 @@ static void e1000_clear_hw_cntrs_82571(struct e1000_hw *hw)
+ temp = er32(ICRXDMTC);
+ }
+
+-static struct e1000_mac_operations e82571_mac_ops = {
++static const struct e1000_mac_operations e82571_mac_ops = {
+ /* .check_mng_mode: mac type dependent */
+ /* .check_for_link: media type dependent */
+ .id_led_init = e1000e_id_led_init,
+@@ -1674,7 +1674,7 @@ static struct e1000_mac_operations e82571_mac_ops = {
+ .setup_led = e1000e_setup_led_generic,
+ };
+
+-static struct e1000_phy_operations e82_phy_ops_igp = {
++static const struct e1000_phy_operations e82_phy_ops_igp = {
+ .acquire_phy = e1000_get_hw_semaphore_82571,
+ .check_reset_block = e1000e_check_reset_block_generic,
+ .commit_phy = NULL,
+@@ -1691,7 +1691,7 @@ static struct e1000_phy_operations e82_phy_ops_igp = {
+ .cfg_on_link_up = NULL,
+ };
+
+-static struct e1000_phy_operations e82_phy_ops_m88 = {
++static const struct e1000_phy_operations e82_phy_ops_m88 = {
+ .acquire_phy = e1000_get_hw_semaphore_82571,
+ .check_reset_block = e1000e_check_reset_block_generic,
+ .commit_phy = e1000e_phy_sw_reset,
+@@ -1708,7 +1708,7 @@ static struct e1000_phy_operations e82_phy_ops_m88 = {
+ .cfg_on_link_up = NULL,
+ };
+
+-static struct e1000_phy_operations e82_phy_ops_bm = {
++static const struct e1000_phy_operations e82_phy_ops_bm = {
+ .acquire_phy = e1000_get_hw_semaphore_82571,
+ .check_reset_block = e1000e_check_reset_block_generic,
+ .commit_phy = e1000e_phy_sw_reset,
+@@ -1725,7 +1725,7 @@ static struct e1000_phy_operations e82_phy_ops_bm = {
+ .cfg_on_link_up = NULL,
+ };
+
+-static struct e1000_nvm_operations e82571_nvm_ops = {
++static const struct e1000_nvm_operations e82571_nvm_ops = {
+ .acquire_nvm = e1000_acquire_nvm_82571,
+ .read_nvm = e1000e_read_nvm_eerd,
+ .release_nvm = e1000_release_nvm_82571,
+diff --git a/drivers/net/e1000e/e1000.h b/drivers/net/e1000e/e1000.h
+index 47db9bd..fa58ccd 100644
+--- a/drivers/net/e1000e/e1000.h
++++ b/drivers/net/e1000e/e1000.h
+@@ -375,9 +375,9 @@ struct e1000_info {
+ u32 pba;
+ u32 max_hw_frame_size;
+ s32 (*get_variants)(struct e1000_adapter *);
+- struct e1000_mac_operations *mac_ops;
+- struct e1000_phy_operations *phy_ops;
+- struct e1000_nvm_operations *nvm_ops;
++ const struct e1000_mac_operations *mac_ops;
++ const struct e1000_phy_operations *phy_ops;
++ const struct e1000_nvm_operations *nvm_ops;
+ };
+
+ /* hardware capability, feature, and workaround flags */
+diff --git a/drivers/net/e1000e/es2lan.c b/drivers/net/e1000e/es2lan.c
+index ae5d736..e9a93a1 100644
+--- a/drivers/net/e1000e/es2lan.c
++++ b/drivers/net/e1000e/es2lan.c
+@@ -207,7 +207,7 @@ static s32 e1000_init_mac_params_80003es2lan(struct e1000_adapter *adapter)
+ {
+ struct e1000_hw *hw = &adapter->hw;
+ struct e1000_mac_info *mac = &hw->mac;
+- struct e1000_mac_operations *func = &mac->ops;
++ e1000_mac_operations_no_const *func = &mac->ops;
+
+ /* Set media type */
+ switch (adapter->pdev->device) {
+@@ -1365,7 +1365,7 @@ static void e1000_clear_hw_cntrs_80003es2lan(struct e1000_hw *hw)
+ temp = er32(ICRXDMTC);
+ }
+
+-static struct e1000_mac_operations es2_mac_ops = {
++static const struct e1000_mac_operations es2_mac_ops = {
+ .id_led_init = e1000e_id_led_init,
+ .check_mng_mode = e1000e_check_mng_mode_generic,
+ /* check_for_link dependent on media type */
+@@ -1383,7 +1383,7 @@ static struct e1000_mac_operations es2_mac_ops = {
+ .setup_led = e1000e_setup_led_generic,
+ };
+
+-static struct e1000_phy_operations es2_phy_ops = {
++static const struct e1000_phy_operations es2_phy_ops = {
+ .acquire_phy = e1000_acquire_phy_80003es2lan,
+ .check_reset_block = e1000e_check_reset_block_generic,
+ .commit_phy = e1000e_phy_sw_reset,
+@@ -1400,7 +1400,7 @@ static struct e1000_phy_operations es2_phy_ops = {
+ .cfg_on_link_up = e1000_cfg_on_link_up_80003es2lan,
+ };
+
+-static struct e1000_nvm_operations es2_nvm_ops = {
++static const struct e1000_nvm_operations es2_nvm_ops = {
+ .acquire_nvm = e1000_acquire_nvm_80003es2lan,
+ .read_nvm = e1000e_read_nvm_eerd,
+ .release_nvm = e1000_release_nvm_80003es2lan,
+diff --git a/drivers/net/e1000e/hw.h b/drivers/net/e1000e/hw.h
+index 11f3b7c..6381887 100644
+--- a/drivers/net/e1000e/hw.h
++++ b/drivers/net/e1000e/hw.h
+@@ -753,6 +753,7 @@ struct e1000_mac_operations {
+ s32 (*setup_physical_interface)(struct e1000_hw *);
+ s32 (*setup_led)(struct e1000_hw *);
+ };
++typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
+
+ /* Function pointers for the PHY. */
+ struct e1000_phy_operations {
+@@ -774,6 +775,7 @@ struct e1000_phy_operations {
+ s32 (*write_phy_reg_locked)(struct e1000_hw *, u32, u16);
+ s32 (*cfg_on_link_up)(struct e1000_hw *);
+ };
++typedef struct e1000_phy_operations __no_const e1000_phy_operations_no_const;
+
+ /* Function pointers for the NVM. */
+ struct e1000_nvm_operations {
+@@ -785,9 +787,10 @@ struct e1000_nvm_operations {
+ s32 (*validate_nvm)(struct e1000_hw *);
+ s32 (*write_nvm)(struct e1000_hw *, u16, u16, u16 *);
+ };
++typedef struct e1000_nvm_operations __no_const e1000_nvm_operations_no_const;
+
+ struct e1000_mac_info {
+- struct e1000_mac_operations ops;
++ e1000_mac_operations_no_const ops;
+
+ u8 addr[6];
+ u8 perm_addr[6];
+@@ -823,7 +826,7 @@ struct e1000_mac_info {
+ };
+
+ struct e1000_phy_info {
+- struct e1000_phy_operations ops;
++ e1000_phy_operations_no_const ops;
+
+ enum e1000_phy_type type;
+
+@@ -857,7 +860,7 @@ struct e1000_phy_info {
+ };
+
+ struct e1000_nvm_info {
+- struct e1000_nvm_operations ops;
++ e1000_nvm_operations_no_const ops;
+
+ enum e1000_nvm_type type;
+ enum e1000_nvm_override override;
+diff --git a/drivers/net/e1000e/ich8lan.c b/drivers/net/e1000e/ich8lan.c
+index de39f9a..e28d3e0 100644
+--- a/drivers/net/e1000e/ich8lan.c
++++ b/drivers/net/e1000e/ich8lan.c
+@@ -3463,7 +3463,7 @@ static void e1000_clear_hw_cntrs_ich8lan(struct e1000_hw *hw)
+ }
+ }
+
+-static struct e1000_mac_operations ich8_mac_ops = {
++static const struct e1000_mac_operations ich8_mac_ops = {
+ .id_led_init = e1000e_id_led_init,
+ .check_mng_mode = e1000_check_mng_mode_ich8lan,
+ .check_for_link = e1000_check_for_copper_link_ich8lan,
+@@ -3481,7 +3481,7 @@ static struct e1000_mac_operations ich8_mac_ops = {
+ /* id_led_init dependent on mac type */
+ };
+
+-static struct e1000_phy_operations ich8_phy_ops = {
++static const struct e1000_phy_operations ich8_phy_ops = {
+ .acquire_phy = e1000_acquire_swflag_ich8lan,
+ .check_reset_block = e1000_check_reset_block_ich8lan,
+ .commit_phy = NULL,
+@@ -3497,7 +3497,7 @@ static struct e1000_phy_operations ich8_phy_ops = {
+ .write_phy_reg = e1000e_write_phy_reg_igp,
+ };
+
+-static struct e1000_nvm_operations ich8_nvm_ops = {
++static const struct e1000_nvm_operations ich8_nvm_ops = {
+ .acquire_nvm = e1000_acquire_nvm_ich8lan,
+ .read_nvm = e1000_read_nvm_ich8lan,
+ .release_nvm = e1000_release_nvm_ich8lan,
+diff --git a/drivers/net/fealnx.c b/drivers/net/fealnx.c
+index 18d5fbb..542d96d 100644
+--- a/drivers/net/fealnx.c
++++ b/drivers/net/fealnx.c
+@@ -151,7 +151,7 @@ struct chip_info {
+ int flags;
+ };
+
+-static const struct chip_info skel_netdrv_tbl[] __devinitdata = {
++static const struct chip_info skel_netdrv_tbl[] __devinitconst = {
+ { "100/10M Ethernet PCI Adapter", HAS_MII_XCVR },
+ { "100/10M Ethernet PCI Adapter", HAS_CHIP_XCVR },
+ { "1000/100/10M Ethernet PCI Adapter", HAS_MII_XCVR },
+diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
+index 0e5b54b..b503f82 100644
+--- a/drivers/net/hamradio/6pack.c
++++ b/drivers/net/hamradio/6pack.c
+@@ -461,6 +461,8 @@ static void sixpack_receive_buf(struct tty_struct *tty,
+ unsigned char buf[512];
+ int count1;
+
++ pax_track_stack();
++
+ if (!count)
+ return;
+
+diff --git a/drivers/net/ibmveth.c b/drivers/net/ibmveth.c
+index 5862282..7cce8cb 100644
+--- a/drivers/net/ibmveth.c
++++ b/drivers/net/ibmveth.c
+@@ -1577,7 +1577,7 @@ static struct attribute * veth_pool_attrs[] = {
+ NULL,
+ };
+
+-static struct sysfs_ops veth_pool_ops = {
++static const struct sysfs_ops veth_pool_ops = {
+ .show = veth_pool_show,
+ .store = veth_pool_store,
+ };
+diff --git a/drivers/net/igb/e1000_82575.c b/drivers/net/igb/e1000_82575.c
+index d617f2d..57b5309 100644
+--- a/drivers/net/igb/e1000_82575.c
++++ b/drivers/net/igb/e1000_82575.c
+@@ -1411,7 +1411,7 @@ void igb_vmdq_set_replication_pf(struct e1000_hw *hw, bool enable)
+ wr32(E1000_VT_CTL, vt_ctl);
+ }
+
+-static struct e1000_mac_operations e1000_mac_ops_82575 = {
++static const struct e1000_mac_operations e1000_mac_ops_82575 = {
+ .reset_hw = igb_reset_hw_82575,
+ .init_hw = igb_init_hw_82575,
+ .check_for_link = igb_check_for_link_82575,
+@@ -1420,13 +1420,13 @@ static struct e1000_mac_operations e1000_mac_ops_82575 = {
+ .get_speed_and_duplex = igb_get_speed_and_duplex_copper,
+ };
+
+-static struct e1000_phy_operations e1000_phy_ops_82575 = {
++static const struct e1000_phy_operations e1000_phy_ops_82575 = {
+ .acquire = igb_acquire_phy_82575,
+ .get_cfg_done = igb_get_cfg_done_82575,
+ .release = igb_release_phy_82575,
+ };
+
+-static struct e1000_nvm_operations e1000_nvm_ops_82575 = {
++static const struct e1000_nvm_operations e1000_nvm_ops_82575 = {
+ .acquire = igb_acquire_nvm_82575,
+ .read = igb_read_nvm_eerd,
+ .release = igb_release_nvm_82575,
+diff --git a/drivers/net/igb/e1000_hw.h b/drivers/net/igb/e1000_hw.h
+index 72081df..d855cf5 100644
+--- a/drivers/net/igb/e1000_hw.h
++++ b/drivers/net/igb/e1000_hw.h
+@@ -288,6 +288,7 @@ struct e1000_mac_operations {
+ s32 (*read_mac_addr)(struct e1000_hw *);
+ s32 (*get_speed_and_duplex)(struct e1000_hw *, u16 *, u16 *);
+ };
++typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
+
+ struct e1000_phy_operations {
+ s32 (*acquire)(struct e1000_hw *);
+@@ -303,6 +304,7 @@ struct e1000_phy_operations {
+ s32 (*set_d3_lplu_state)(struct e1000_hw *, bool);
+ s32 (*write_reg)(struct e1000_hw *, u32, u16);
+ };
++typedef struct e1000_phy_operations __no_const e1000_phy_operations_no_const;
+
+ struct e1000_nvm_operations {
+ s32 (*acquire)(struct e1000_hw *);
+@@ -310,6 +312,7 @@ struct e1000_nvm_operations {
+ void (*release)(struct e1000_hw *);
+ s32 (*write)(struct e1000_hw *, u16, u16, u16 *);
+ };
++typedef struct e1000_nvm_operations __no_const e1000_nvm_operations_no_const;
+
+ struct e1000_info {
+ s32 (*get_invariants)(struct e1000_hw *);
+@@ -321,7 +324,7 @@ struct e1000_info {
+ extern const struct e1000_info e1000_82575_info;
+
+ struct e1000_mac_info {
+- struct e1000_mac_operations ops;
++ e1000_mac_operations_no_const ops;
+
+ u8 addr[6];
+ u8 perm_addr[6];
+@@ -365,7 +368,7 @@ struct e1000_mac_info {
+ };
+
+ struct e1000_phy_info {
+- struct e1000_phy_operations ops;
++ e1000_phy_operations_no_const ops;
+
+ enum e1000_phy_type type;
+
+@@ -400,7 +403,7 @@ struct e1000_phy_info {
+ };
+
+ struct e1000_nvm_info {
+- struct e1000_nvm_operations ops;
++ e1000_nvm_operations_no_const ops;
+
+ enum e1000_nvm_type type;
+ enum e1000_nvm_override override;
+@@ -446,6 +449,7 @@ struct e1000_mbx_operations {
+ s32 (*check_for_ack)(struct e1000_hw *, u16);
+ s32 (*check_for_rst)(struct e1000_hw *, u16);
+ };
++typedef struct e1000_mbx_operations __no_const e1000_mbx_operations_no_const;
+
+ struct e1000_mbx_stats {
+ u32 msgs_tx;
+@@ -457,7 +461,7 @@ struct e1000_mbx_stats {
+ };
+
+ struct e1000_mbx_info {
+- struct e1000_mbx_operations ops;
++ e1000_mbx_operations_no_const ops;
+ struct e1000_mbx_stats stats;
+ u32 timeout;
+ u32 usec_delay;
+diff --git a/drivers/net/igbvf/vf.h b/drivers/net/igbvf/vf.h
+index 1e8ce37..549c453 100644
+--- a/drivers/net/igbvf/vf.h
++++ b/drivers/net/igbvf/vf.h
+@@ -187,9 +187,10 @@ struct e1000_mac_operations {
+ s32 (*read_mac_addr)(struct e1000_hw *);
+ s32 (*set_vfta)(struct e1000_hw *, u16, bool);
+ };
++typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
+
+ struct e1000_mac_info {
+- struct e1000_mac_operations ops;
++ e1000_mac_operations_no_const ops;
+ u8 addr[6];
+ u8 perm_addr[6];
+
+@@ -211,6 +212,7 @@ struct e1000_mbx_operations {
+ s32 (*check_for_ack)(struct e1000_hw *);
+ s32 (*check_for_rst)(struct e1000_hw *);
+ };
++typedef struct e1000_mbx_operations __no_const e1000_mbx_operations_no_const;
+
+ struct e1000_mbx_stats {
+ u32 msgs_tx;
+@@ -222,7 +224,7 @@ struct e1000_mbx_stats {
+ };
+
+ struct e1000_mbx_info {
+- struct e1000_mbx_operations ops;
++ e1000_mbx_operations_no_const ops;
+ struct e1000_mbx_stats stats;
+ u32 timeout;
+ u32 usec_delay;
+diff --git a/drivers/net/iseries_veth.c b/drivers/net/iseries_veth.c
+index aa7286b..a61394f 100644
+--- a/drivers/net/iseries_veth.c
++++ b/drivers/net/iseries_veth.c
+@@ -384,7 +384,7 @@ static struct attribute *veth_cnx_default_attrs[] = {
+ NULL
+ };
+
+-static struct sysfs_ops veth_cnx_sysfs_ops = {
++static const struct sysfs_ops veth_cnx_sysfs_ops = {
+ .show = veth_cnx_attribute_show
+ };
+
+@@ -441,7 +441,7 @@ static struct attribute *veth_port_default_attrs[] = {
+ NULL
+ };
+
+-static struct sysfs_ops veth_port_sysfs_ops = {
++static const struct sysfs_ops veth_port_sysfs_ops = {
+ .show = veth_port_attribute_show
+ };
+
+diff --git a/drivers/net/ixgb/ixgb_main.c b/drivers/net/ixgb/ixgb_main.c
+index 8aa44dc..fa1e797 100644
+--- a/drivers/net/ixgb/ixgb_main.c
++++ b/drivers/net/ixgb/ixgb_main.c
+@@ -1052,6 +1052,8 @@ ixgb_set_multi(struct net_device *netdev)
+ u32 rctl;
+ int i;
+
++ pax_track_stack();
++
+ /* Check for Promiscuous and All Multicast modes */
+
+ rctl = IXGB_READ_REG(hw, RCTL);
+diff --git a/drivers/net/ixgb/ixgb_param.c b/drivers/net/ixgb/ixgb_param.c
+index af35e1d..8781785 100644
+--- a/drivers/net/ixgb/ixgb_param.c
++++ b/drivers/net/ixgb/ixgb_param.c
+@@ -260,6 +260,9 @@ void __devinit
+ ixgb_check_options(struct ixgb_adapter *adapter)
+ {
+ int bd = adapter->bd_number;
++
++ pax_track_stack();
++
+ if (bd >= IXGB_MAX_NIC) {
+ printk(KERN_NOTICE
+ "Warning: no configuration for board #%i\n", bd);
+diff --git a/drivers/net/ixgbe/ixgbe_type.h b/drivers/net/ixgbe/ixgbe_type.h
+index b17aa73..ed74540 100644
+--- a/drivers/net/ixgbe/ixgbe_type.h
++++ b/drivers/net/ixgbe/ixgbe_type.h
+@@ -2327,6 +2327,7 @@ struct ixgbe_eeprom_operations {
+ s32 (*validate_checksum)(struct ixgbe_hw *, u16 *);
+ s32 (*update_checksum)(struct ixgbe_hw *);
+ };
++typedef struct ixgbe_eeprom_operations __no_const ixgbe_eeprom_operations_no_const;
+
+ struct ixgbe_mac_operations {
+ s32 (*init_hw)(struct ixgbe_hw *);
+@@ -2376,6 +2377,7 @@ struct ixgbe_mac_operations {
+ /* Flow Control */
+ s32 (*fc_enable)(struct ixgbe_hw *, s32);
+ };
++typedef struct ixgbe_mac_operations __no_const ixgbe_mac_operations_no_const;
+
+ struct ixgbe_phy_operations {
+ s32 (*identify)(struct ixgbe_hw *);
+@@ -2394,9 +2396,10 @@ struct ixgbe_phy_operations {
+ s32 (*read_i2c_eeprom)(struct ixgbe_hw *, u8 , u8 *);
+ s32 (*write_i2c_eeprom)(struct ixgbe_hw *, u8, u8);
+ };
++typedef struct ixgbe_phy_operations __no_const ixgbe_phy_operations_no_const;
+
+ struct ixgbe_eeprom_info {
+- struct ixgbe_eeprom_operations ops;
++ ixgbe_eeprom_operations_no_const ops;
+ enum ixgbe_eeprom_type type;
+ u32 semaphore_delay;
+ u16 word_size;
+@@ -2404,7 +2407,7 @@ struct ixgbe_eeprom_info {
+ };
+
+ struct ixgbe_mac_info {
+- struct ixgbe_mac_operations ops;
++ ixgbe_mac_operations_no_const ops;
+ enum ixgbe_mac_type type;
+ u8 addr[IXGBE_ETH_LENGTH_OF_ADDRESS];
+ u8 perm_addr[IXGBE_ETH_LENGTH_OF_ADDRESS];
+@@ -2423,7 +2426,7 @@ struct ixgbe_mac_info {
+ };
+
+ struct ixgbe_phy_info {
+- struct ixgbe_phy_operations ops;
++ ixgbe_phy_operations_no_const ops;
+ struct mdio_if_info mdio;
+ enum ixgbe_phy_type type;
+ u32 id;
+diff --git a/drivers/net/mlx4/main.c b/drivers/net/mlx4/main.c
+index 291a505..2543756 100644
+--- a/drivers/net/mlx4/main.c
++++ b/drivers/net/mlx4/main.c
+@@ -38,6 +38,7 @@
+ #include <linux/errno.h>
+ #include <linux/pci.h>
+ #include <linux/dma-mapping.h>
++#include <linux/sched.h>
+
+ #include <linux/mlx4/device.h>
+ #include <linux/mlx4/doorbell.h>
+@@ -730,6 +731,8 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
+ u64 icm_size;
+ int err;
+
++ pax_track_stack();
++
+ err = mlx4_QUERY_FW(dev);
+ if (err) {
+ if (err == -EACCES)
+diff --git a/drivers/net/niu.c b/drivers/net/niu.c
+index 2dce134..fa5ce75 100644
+--- a/drivers/net/niu.c
++++ b/drivers/net/niu.c
+@@ -9128,6 +9128,8 @@ static void __devinit niu_try_msix(struct niu *np, u8 *ldg_num_map)
+ int i, num_irqs, err;
+ u8 first_ldg;
+
++ pax_track_stack();
++
+ first_ldg = (NIU_NUM_LDG / parent->num_ports) * np->port;
+ for (i = 0; i < (NIU_NUM_LDG / parent->num_ports); i++)
+ ldg_num_map[i] = first_ldg + i;
+diff --git a/drivers/net/pcnet32.c b/drivers/net/pcnet32.c
+index c1b3f09..97cd8c4 100644
+--- a/drivers/net/pcnet32.c
++++ b/drivers/net/pcnet32.c
+@@ -79,7 +79,7 @@ static int cards_found;
+ /*
+ * VLB I/O addresses
+ */
+-static unsigned int pcnet32_portlist[] __initdata =
++static unsigned int pcnet32_portlist[] __devinitdata =
+ { 0x300, 0x320, 0x340, 0x360, 0 };
+
+ static int pcnet32_debug = 0;
+@@ -267,7 +267,7 @@ struct pcnet32_private {
+ struct sk_buff **rx_skbuff;
+ dma_addr_t *tx_dma_addr;
+ dma_addr_t *rx_dma_addr;
+- struct pcnet32_access a;
++ struct pcnet32_access *a;
+ spinlock_t lock; /* Guard lock */
+ unsigned int cur_rx, cur_tx; /* The next free ring entry */
+ unsigned int rx_ring_size; /* current rx ring size */
+@@ -457,9 +457,9 @@ static void pcnet32_netif_start(struct net_device *dev)
+ u16 val;
+
+ netif_wake_queue(dev);
+- val = lp->a.read_csr(ioaddr, CSR3);
++ val = lp->a->read_csr(ioaddr, CSR3);
+ val &= 0x00ff;
+- lp->a.write_csr(ioaddr, CSR3, val);
++ lp->a->write_csr(ioaddr, CSR3, val);
+ napi_enable(&lp->napi);
+ }
+
+@@ -744,7 +744,7 @@ static u32 pcnet32_get_link(struct net_device *dev)
+ r = mii_link_ok(&lp->mii_if);
+ } else if (lp->chip_version >= PCNET32_79C970A) {
+ ulong ioaddr = dev->base_addr; /* card base I/O address */
+- r = (lp->a.read_bcr(ioaddr, 4) != 0xc0);
++ r = (lp->a->read_bcr(ioaddr, 4) != 0xc0);
+ } else { /* can not detect link on really old chips */
+ r = 1;
+ }
+@@ -806,7 +806,7 @@ static int pcnet32_set_ringparam(struct net_device *dev,
+ pcnet32_netif_stop(dev);
+
+ spin_lock_irqsave(&lp->lock, flags);
+- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
++ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
+
+ size = min(ering->tx_pending, (unsigned int)TX_MAX_RING_SIZE);
+
+@@ -886,7 +886,7 @@ static void pcnet32_ethtool_test(struct net_device *dev,
+ static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
+ {
+ struct pcnet32_private *lp = netdev_priv(dev);
+- struct pcnet32_access *a = &lp->a; /* access to registers */
++ struct pcnet32_access *a = lp->a; /* access to registers */
+ ulong ioaddr = dev->base_addr; /* card base I/O address */
+ struct sk_buff *skb; /* sk buff */
+ int x, i; /* counters */
+@@ -906,21 +906,21 @@ static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
+ pcnet32_netif_stop(dev);
+
+ spin_lock_irqsave(&lp->lock, flags);
+- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
++ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
+
+ numbuffs = min(numbuffs, (int)min(lp->rx_ring_size, lp->tx_ring_size));
+
+ /* Reset the PCNET32 */
+- lp->a.reset(ioaddr);
+- lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
++ lp->a->reset(ioaddr);
++ lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
+
+ /* switch pcnet32 to 32bit mode */
+- lp->a.write_bcr(ioaddr, 20, 2);
++ lp->a->write_bcr(ioaddr, 20, 2);
+
+ /* purge & init rings but don't actually restart */
+ pcnet32_restart(dev, 0x0000);
+
+- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
++ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
+
+ /* Initialize Transmit buffers. */
+ size = data_len + 15;
+@@ -966,10 +966,10 @@ static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
+
+ /* set int loopback in CSR15 */
+ x = a->read_csr(ioaddr, CSR15) & 0xfffc;
+- lp->a.write_csr(ioaddr, CSR15, x | 0x0044);
++ lp->a->write_csr(ioaddr, CSR15, x | 0x0044);
+
+ teststatus = cpu_to_le16(0x8000);
+- lp->a.write_csr(ioaddr, CSR0, CSR0_START); /* Set STRT bit */
++ lp->a->write_csr(ioaddr, CSR0, CSR0_START); /* Set STRT bit */
+
+ /* Check status of descriptors */
+ for (x = 0; x < numbuffs; x++) {
+@@ -990,7 +990,7 @@ static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
+ }
+ }
+
+- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
++ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
+ wmb();
+ if (netif_msg_hw(lp) && netif_msg_pktdata(lp)) {
+ printk(KERN_DEBUG "%s: RX loopback packets:\n", dev->name);
+@@ -1039,7 +1039,7 @@ static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
+ pcnet32_restart(dev, CSR0_NORMAL);
+ } else {
+ pcnet32_purge_rx_ring(dev);
+- lp->a.write_bcr(ioaddr, 20, 4); /* return to 16bit mode */
++ lp->a->write_bcr(ioaddr, 20, 4); /* return to 16bit mode */
+ }
+ spin_unlock_irqrestore(&lp->lock, flags);
+
+@@ -1049,7 +1049,7 @@ static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
+ static void pcnet32_led_blink_callback(struct net_device *dev)
+ {
+ struct pcnet32_private *lp = netdev_priv(dev);
+- struct pcnet32_access *a = &lp->a;
++ struct pcnet32_access *a = lp->a;
+ ulong ioaddr = dev->base_addr;
+ unsigned long flags;
+ int i;
+@@ -1066,7 +1066,7 @@ static void pcnet32_led_blink_callback(struct net_device *dev)
+ static int pcnet32_phys_id(struct net_device *dev, u32 data)
+ {
+ struct pcnet32_private *lp = netdev_priv(dev);
+- struct pcnet32_access *a = &lp->a;
++ struct pcnet32_access *a = lp->a;
+ ulong ioaddr = dev->base_addr;
+ unsigned long flags;
+ int i, regs[4];
+@@ -1112,7 +1112,7 @@ static int pcnet32_suspend(struct net_device *dev, unsigned long *flags,
+ {
+ int csr5;
+ struct pcnet32_private *lp = netdev_priv(dev);
+- struct pcnet32_access *a = &lp->a;
++ struct pcnet32_access *a = lp->a;
+ ulong ioaddr = dev->base_addr;
+ int ticks;
+
+@@ -1388,8 +1388,8 @@ static int pcnet32_poll(struct napi_struct *napi, int budget)
+ spin_lock_irqsave(&lp->lock, flags);
+ if (pcnet32_tx(dev)) {
+ /* reset the chip to clear the error condition, then restart */
+- lp->a.reset(ioaddr);
+- lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
++ lp->a->reset(ioaddr);
++ lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
+ pcnet32_restart(dev, CSR0_START);
+ netif_wake_queue(dev);
+ }
+@@ -1401,12 +1401,12 @@ static int pcnet32_poll(struct napi_struct *napi, int budget)
+ __napi_complete(napi);
+
+ /* clear interrupt masks */
+- val = lp->a.read_csr(ioaddr, CSR3);
++ val = lp->a->read_csr(ioaddr, CSR3);
+ val &= 0x00ff;
+- lp->a.write_csr(ioaddr, CSR3, val);
++ lp->a->write_csr(ioaddr, CSR3, val);
+
+ /* Set interrupt enable. */
+- lp->a.write_csr(ioaddr, CSR0, CSR0_INTEN);
++ lp->a->write_csr(ioaddr, CSR0, CSR0_INTEN);
+
+ spin_unlock_irqrestore(&lp->lock, flags);
+ }
+@@ -1429,7 +1429,7 @@ static void pcnet32_get_regs(struct net_device *dev, struct ethtool_regs *regs,
+ int i, csr0;
+ u16 *buff = ptr;
+ struct pcnet32_private *lp = netdev_priv(dev);
+- struct pcnet32_access *a = &lp->a;
++ struct pcnet32_access *a = lp->a;
+ ulong ioaddr = dev->base_addr;
+ unsigned long flags;
+
+@@ -1466,9 +1466,9 @@ static void pcnet32_get_regs(struct net_device *dev, struct ethtool_regs *regs,
+ for (j = 0; j < PCNET32_MAX_PHYS; j++) {
+ if (lp->phymask & (1 << j)) {
+ for (i = 0; i < PCNET32_REGS_PER_PHY; i++) {
+- lp->a.write_bcr(ioaddr, 33,
++ lp->a->write_bcr(ioaddr, 33,
+ (j << 5) | i);
+- *buff++ = lp->a.read_bcr(ioaddr, 34);
++ *buff++ = lp->a->read_bcr(ioaddr, 34);
+ }
+ }
+ }
+@@ -1858,7 +1858,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
+ ((cards_found >= MAX_UNITS) || full_duplex[cards_found]))
+ lp->options |= PCNET32_PORT_FD;
+
+- lp->a = *a;
++ lp->a = a;
+
+ /* prior to register_netdev, dev->name is not yet correct */
+ if (pcnet32_alloc_ring(dev, pci_name(lp->pci_dev))) {
+@@ -1917,7 +1917,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
+ if (lp->mii) {
+ /* lp->phycount and lp->phymask are set to 0 by memset above */
+
+- lp->mii_if.phy_id = ((lp->a.read_bcr(ioaddr, 33)) >> 5) & 0x1f;
++ lp->mii_if.phy_id = ((lp->a->read_bcr(ioaddr, 33)) >> 5) & 0x1f;
+ /* scan for PHYs */
+ for (i = 0; i < PCNET32_MAX_PHYS; i++) {
+ unsigned short id1, id2;
+@@ -1938,7 +1938,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
+ "Found PHY %04x:%04x at address %d.\n",
+ id1, id2, i);
+ }
+- lp->a.write_bcr(ioaddr, 33, (lp->mii_if.phy_id) << 5);
++ lp->a->write_bcr(ioaddr, 33, (lp->mii_if.phy_id) << 5);
+ if (lp->phycount > 1) {
+ lp->options |= PCNET32_PORT_MII;
+ }
+@@ -2109,10 +2109,10 @@ static int pcnet32_open(struct net_device *dev)
+ }
+
+ /* Reset the PCNET32 */
+- lp->a.reset(ioaddr);
++ lp->a->reset(ioaddr);
+
+ /* switch pcnet32 to 32bit mode */
+- lp->a.write_bcr(ioaddr, 20, 2);
++ lp->a->write_bcr(ioaddr, 20, 2);
+
+ if (netif_msg_ifup(lp))
+ printk(KERN_DEBUG
+@@ -2122,14 +2122,14 @@ static int pcnet32_open(struct net_device *dev)
+ (u32) (lp->init_dma_addr));
+
+ /* set/reset autoselect bit */
+- val = lp->a.read_bcr(ioaddr, 2) & ~2;
++ val = lp->a->read_bcr(ioaddr, 2) & ~2;
+ if (lp->options & PCNET32_PORT_ASEL)
+ val |= 2;
+- lp->a.write_bcr(ioaddr, 2, val);
++ lp->a->write_bcr(ioaddr, 2, val);
+
+ /* handle full duplex setting */
+ if (lp->mii_if.full_duplex) {
+- val = lp->a.read_bcr(ioaddr, 9) & ~3;
++ val = lp->a->read_bcr(ioaddr, 9) & ~3;
+ if (lp->options & PCNET32_PORT_FD) {
+ val |= 1;
+ if (lp->options == (PCNET32_PORT_FD | PCNET32_PORT_AUI))
+@@ -2139,14 +2139,14 @@ static int pcnet32_open(struct net_device *dev)
+ if (lp->chip_version == 0x2627)
+ val |= 3;
+ }
+- lp->a.write_bcr(ioaddr, 9, val);
++ lp->a->write_bcr(ioaddr, 9, val);
+ }
+
+ /* set/reset GPSI bit in test register */
+- val = lp->a.read_csr(ioaddr, 124) & ~0x10;
++ val = lp->a->read_csr(ioaddr, 124) & ~0x10;
+ if ((lp->options & PCNET32_PORT_PORTSEL) == PCNET32_PORT_GPSI)
+ val |= 0x10;
+- lp->a.write_csr(ioaddr, 124, val);
++ lp->a->write_csr(ioaddr, 124, val);
+
+ /* Allied Telesyn AT 2700/2701 FX are 100Mbit only and do not negotiate */
+ if (pdev && pdev->subsystem_vendor == PCI_VENDOR_ID_AT &&
+@@ -2167,24 +2167,24 @@ static int pcnet32_open(struct net_device *dev)
+ * duplex, and/or enable auto negotiation, and clear DANAS
+ */
+ if (lp->mii && !(lp->options & PCNET32_PORT_ASEL)) {
+- lp->a.write_bcr(ioaddr, 32,
+- lp->a.read_bcr(ioaddr, 32) | 0x0080);
++ lp->a->write_bcr(ioaddr, 32,
++ lp->a->read_bcr(ioaddr, 32) | 0x0080);
+ /* disable Auto Negotiation, set 10Mpbs, HD */
+- val = lp->a.read_bcr(ioaddr, 32) & ~0xb8;
++ val = lp->a->read_bcr(ioaddr, 32) & ~0xb8;
+ if (lp->options & PCNET32_PORT_FD)
+ val |= 0x10;
+ if (lp->options & PCNET32_PORT_100)
+ val |= 0x08;
+- lp->a.write_bcr(ioaddr, 32, val);
++ lp->a->write_bcr(ioaddr, 32, val);
+ } else {
+ if (lp->options & PCNET32_PORT_ASEL) {
+- lp->a.write_bcr(ioaddr, 32,
+- lp->a.read_bcr(ioaddr,
++ lp->a->write_bcr(ioaddr, 32,
++ lp->a->read_bcr(ioaddr,
+ 32) | 0x0080);
+ /* enable auto negotiate, setup, disable fd */
+- val = lp->a.read_bcr(ioaddr, 32) & ~0x98;
++ val = lp->a->read_bcr(ioaddr, 32) & ~0x98;
+ val |= 0x20;
+- lp->a.write_bcr(ioaddr, 32, val);
++ lp->a->write_bcr(ioaddr, 32, val);
+ }
+ }
+ } else {
+@@ -2197,10 +2197,10 @@ static int pcnet32_open(struct net_device *dev)
+ * There is really no good other way to handle multiple PHYs
+ * other than turning off all automatics
+ */
+- val = lp->a.read_bcr(ioaddr, 2);
+- lp->a.write_bcr(ioaddr, 2, val & ~2);
+- val = lp->a.read_bcr(ioaddr, 32);
+- lp->a.write_bcr(ioaddr, 32, val & ~(1 << 7)); /* stop MII manager */
++ val = lp->a->read_bcr(ioaddr, 2);
++ lp->a->write_bcr(ioaddr, 2, val & ~2);
++ val = lp->a->read_bcr(ioaddr, 32);
++ lp->a->write_bcr(ioaddr, 32, val & ~(1 << 7)); /* stop MII manager */
+
+ if (!(lp->options & PCNET32_PORT_ASEL)) {
+ /* setup ecmd */
+@@ -2210,7 +2210,7 @@ static int pcnet32_open(struct net_device *dev)
+ ecmd.speed =
+ lp->
+ options & PCNET32_PORT_100 ? SPEED_100 : SPEED_10;
+- bcr9 = lp->a.read_bcr(ioaddr, 9);
++ bcr9 = lp->a->read_bcr(ioaddr, 9);
+
+ if (lp->options & PCNET32_PORT_FD) {
+ ecmd.duplex = DUPLEX_FULL;
+@@ -2219,7 +2219,7 @@ static int pcnet32_open(struct net_device *dev)
+ ecmd.duplex = DUPLEX_HALF;
+ bcr9 |= ~(1 << 0);
+ }
+- lp->a.write_bcr(ioaddr, 9, bcr9);
++ lp->a->write_bcr(ioaddr, 9, bcr9);
+ }
+
+ for (i = 0; i < PCNET32_MAX_PHYS; i++) {
+@@ -2252,9 +2252,9 @@ static int pcnet32_open(struct net_device *dev)
+
+ #ifdef DO_DXSUFLO
+ if (lp->dxsuflo) { /* Disable transmit stop on underflow */
+- val = lp->a.read_csr(ioaddr, CSR3);
++ val = lp->a->read_csr(ioaddr, CSR3);
+ val |= 0x40;
+- lp->a.write_csr(ioaddr, CSR3, val);
++ lp->a->write_csr(ioaddr, CSR3, val);
+ }
+ #endif
+
+@@ -2270,11 +2270,11 @@ static int pcnet32_open(struct net_device *dev)
+ napi_enable(&lp->napi);
+
+ /* Re-initialize the PCNET32, and start it when done. */
+- lp->a.write_csr(ioaddr, 1, (lp->init_dma_addr & 0xffff));
+- lp->a.write_csr(ioaddr, 2, (lp->init_dma_addr >> 16));
++ lp->a->write_csr(ioaddr, 1, (lp->init_dma_addr & 0xffff));
++ lp->a->write_csr(ioaddr, 2, (lp->init_dma_addr >> 16));
+
+- lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
+- lp->a.write_csr(ioaddr, CSR0, CSR0_INIT);
++ lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
++ lp->a->write_csr(ioaddr, CSR0, CSR0_INIT);
+
+ netif_start_queue(dev);
+
+@@ -2286,20 +2286,20 @@ static int pcnet32_open(struct net_device *dev)
+
+ i = 0;
+ while (i++ < 100)
+- if (lp->a.read_csr(ioaddr, CSR0) & CSR0_IDON)
++ if (lp->a->read_csr(ioaddr, CSR0) & CSR0_IDON)
+ break;
+ /*
+ * We used to clear the InitDone bit, 0x0100, here but Mark Stockton
+ * reports that doing so triggers a bug in the '974.
+ */
+- lp->a.write_csr(ioaddr, CSR0, CSR0_NORMAL);
++ lp->a->write_csr(ioaddr, CSR0, CSR0_NORMAL);
+
+ if (netif_msg_ifup(lp))
+ printk(KERN_DEBUG
+ "%s: pcnet32 open after %d ticks, init block %#x csr0 %4.4x.\n",
+ dev->name, i,
+ (u32) (lp->init_dma_addr),
+- lp->a.read_csr(ioaddr, CSR0));
++ lp->a->read_csr(ioaddr, CSR0));
+
+ spin_unlock_irqrestore(&lp->lock, flags);
+
+@@ -2313,7 +2313,7 @@ static int pcnet32_open(struct net_device *dev)
+ * Switch back to 16bit mode to avoid problems with dumb
+ * DOS packet driver after a warm reboot
+ */
+- lp->a.write_bcr(ioaddr, 20, 4);
++ lp->a->write_bcr(ioaddr, 20, 4);
+
+ err_free_irq:
+ spin_unlock_irqrestore(&lp->lock, flags);
+@@ -2420,7 +2420,7 @@ static void pcnet32_restart(struct net_device *dev, unsigned int csr0_bits)
+
+ /* wait for stop */
+ for (i = 0; i < 100; i++)
+- if (lp->a.read_csr(ioaddr, CSR0) & CSR0_STOP)
++ if (lp->a->read_csr(ioaddr, CSR0) & CSR0_STOP)
+ break;
+
+ if (i >= 100 && netif_msg_drv(lp))
+@@ -2433,13 +2433,13 @@ static void pcnet32_restart(struct net_device *dev, unsigned int csr0_bits)
+ return;
+
+ /* ReInit Ring */
+- lp->a.write_csr(ioaddr, CSR0, CSR0_INIT);
++ lp->a->write_csr(ioaddr, CSR0, CSR0_INIT);
+ i = 0;
+ while (i++ < 1000)
+- if (lp->a.read_csr(ioaddr, CSR0) & CSR0_IDON)
++ if (lp->a->read_csr(ioaddr, CSR0) & CSR0_IDON)
+ break;
+
+- lp->a.write_csr(ioaddr, CSR0, csr0_bits);
++ lp->a->write_csr(ioaddr, CSR0, csr0_bits);
+ }
+
+ static void pcnet32_tx_timeout(struct net_device *dev)
+@@ -2452,8 +2452,8 @@ static void pcnet32_tx_timeout(struct net_device *dev)
+ if (pcnet32_debug & NETIF_MSG_DRV)
+ printk(KERN_ERR
+ "%s: transmit timed out, status %4.4x, resetting.\n",
+- dev->name, lp->a.read_csr(ioaddr, CSR0));
+- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
++ dev->name, lp->a->read_csr(ioaddr, CSR0));
++ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
+ dev->stats.tx_errors++;
+ if (netif_msg_tx_err(lp)) {
+ int i;
+@@ -2497,7 +2497,7 @@ static netdev_tx_t pcnet32_start_xmit(struct sk_buff *skb,
+ if (netif_msg_tx_queued(lp)) {
+ printk(KERN_DEBUG
+ "%s: pcnet32_start_xmit() called, csr0 %4.4x.\n",
+- dev->name, lp->a.read_csr(ioaddr, CSR0));
++ dev->name, lp->a->read_csr(ioaddr, CSR0));
+ }
+
+ /* Default status -- will not enable Successful-TxDone
+@@ -2528,7 +2528,7 @@ static netdev_tx_t pcnet32_start_xmit(struct sk_buff *skb,
+ dev->stats.tx_bytes += skb->len;
+
+ /* Trigger an immediate send poll. */
+- lp->a.write_csr(ioaddr, CSR0, CSR0_INTEN | CSR0_TXPOLL);
++ lp->a->write_csr(ioaddr, CSR0, CSR0_INTEN | CSR0_TXPOLL);
+
+ dev->trans_start = jiffies;
+
+@@ -2555,18 +2555,18 @@ pcnet32_interrupt(int irq, void *dev_id)
+
+ spin_lock(&lp->lock);
+
+- csr0 = lp->a.read_csr(ioaddr, CSR0);
++ csr0 = lp->a->read_csr(ioaddr, CSR0);
+ while ((csr0 & 0x8f00) && --boguscnt >= 0) {
+ if (csr0 == 0xffff) {
+ break; /* PCMCIA remove happened */
+ }
+ /* Acknowledge all of the current interrupt sources ASAP. */
+- lp->a.write_csr(ioaddr, CSR0, csr0 & ~0x004f);
++ lp->a->write_csr(ioaddr, CSR0, csr0 & ~0x004f);
+
+ if (netif_msg_intr(lp))
+ printk(KERN_DEBUG
+ "%s: interrupt csr0=%#2.2x new csr=%#2.2x.\n",
+- dev->name, csr0, lp->a.read_csr(ioaddr, CSR0));
++ dev->name, csr0, lp->a->read_csr(ioaddr, CSR0));
+
+ /* Log misc errors. */
+ if (csr0 & 0x4000)
+@@ -2595,19 +2595,19 @@ pcnet32_interrupt(int irq, void *dev_id)
+ if (napi_schedule_prep(&lp->napi)) {
+ u16 val;
+ /* set interrupt masks */
+- val = lp->a.read_csr(ioaddr, CSR3);
++ val = lp->a->read_csr(ioaddr, CSR3);
+ val |= 0x5f00;
+- lp->a.write_csr(ioaddr, CSR3, val);
++ lp->a->write_csr(ioaddr, CSR3, val);
+
+ __napi_schedule(&lp->napi);
+ break;
+ }
+- csr0 = lp->a.read_csr(ioaddr, CSR0);
++ csr0 = lp->a->read_csr(ioaddr, CSR0);
+ }
+
+ if (netif_msg_intr(lp))
+ printk(KERN_DEBUG "%s: exiting interrupt, csr0=%#4.4x.\n",
+- dev->name, lp->a.read_csr(ioaddr, CSR0));
++ dev->name, lp->a->read_csr(ioaddr, CSR0));
+
+ spin_unlock(&lp->lock);
+
+@@ -2627,21 +2627,21 @@ static int pcnet32_close(struct net_device *dev)
+
+ spin_lock_irqsave(&lp->lock, flags);
+
+- dev->stats.rx_missed_errors = lp->a.read_csr(ioaddr, 112);
++ dev->stats.rx_missed_errors = lp->a->read_csr(ioaddr, 112);
+
+ if (netif_msg_ifdown(lp))
+ printk(KERN_DEBUG
+ "%s: Shutting down ethercard, status was %2.2x.\n",
+- dev->name, lp->a.read_csr(ioaddr, CSR0));
++ dev->name, lp->a->read_csr(ioaddr, CSR0));
+
+ /* We stop the PCNET32 here -- it occasionally polls memory if we don't. */
+- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
++ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
+
+ /*
+ * Switch back to 16bit mode to avoid problems with dumb
+ * DOS packet driver after a warm reboot
+ */
+- lp->a.write_bcr(ioaddr, 20, 4);
++ lp->a->write_bcr(ioaddr, 20, 4);
+
+ spin_unlock_irqrestore(&lp->lock, flags);
+
+@@ -2664,7 +2664,7 @@ static struct net_device_stats *pcnet32_get_stats(struct net_device *dev)
+ unsigned long flags;
+
+ spin_lock_irqsave(&lp->lock, flags);
+- dev->stats.rx_missed_errors = lp->a.read_csr(ioaddr, 112);
++ dev->stats.rx_missed_errors = lp->a->read_csr(ioaddr, 112);
+ spin_unlock_irqrestore(&lp->lock, flags);
+
+ return &dev->stats;
+@@ -2686,10 +2686,10 @@ static void pcnet32_load_multicast(struct net_device *dev)
+ if (dev->flags & IFF_ALLMULTI) {
+ ib->filter[0] = cpu_to_le32(~0U);
+ ib->filter[1] = cpu_to_le32(~0U);
+- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER, 0xffff);
+- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+1, 0xffff);
+- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+2, 0xffff);
+- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+3, 0xffff);
++ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER, 0xffff);
++ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+1, 0xffff);
++ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+2, 0xffff);
++ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+3, 0xffff);
+ return;
+ }
+ /* clear the multicast filter */
+@@ -2710,7 +2710,7 @@ static void pcnet32_load_multicast(struct net_device *dev)
+ mcast_table[crc >> 4] |= cpu_to_le16(1 << (crc & 0xf));
+ }
+ for (i = 0; i < 4; i++)
+- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER + i,
++ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER + i,
+ le16_to_cpu(mcast_table[i]));
+ return;
+ }
+@@ -2726,7 +2726,7 @@ static void pcnet32_set_multicast_list(struct net_device *dev)
+
+ spin_lock_irqsave(&lp->lock, flags);
+ suspended = pcnet32_suspend(dev, &flags, 0);
+- csr15 = lp->a.read_csr(ioaddr, CSR15);
++ csr15 = lp->a->read_csr(ioaddr, CSR15);
+ if (dev->flags & IFF_PROMISC) {
+ /* Log any net taps. */
+ if (netif_msg_hw(lp))
+@@ -2735,21 +2735,21 @@ static void pcnet32_set_multicast_list(struct net_device *dev)
+ lp->init_block->mode =
+ cpu_to_le16(0x8000 | (lp->options & PCNET32_PORT_PORTSEL) <<
+ 7);
+- lp->a.write_csr(ioaddr, CSR15, csr15 | 0x8000);
++ lp->a->write_csr(ioaddr, CSR15, csr15 | 0x8000);
+ } else {
+ lp->init_block->mode =
+ cpu_to_le16((lp->options & PCNET32_PORT_PORTSEL) << 7);
+- lp->a.write_csr(ioaddr, CSR15, csr15 & 0x7fff);
++ lp->a->write_csr(ioaddr, CSR15, csr15 & 0x7fff);
+ pcnet32_load_multicast(dev);
+ }
+
+ if (suspended) {
+ int csr5;
+ /* clear SUSPEND (SPND) - CSR5 bit 0 */
+- csr5 = lp->a.read_csr(ioaddr, CSR5);
+- lp->a.write_csr(ioaddr, CSR5, csr5 & (~CSR5_SUSPEND));
++ csr5 = lp->a->read_csr(ioaddr, CSR5);
++ lp->a->write_csr(ioaddr, CSR5, csr5 & (~CSR5_SUSPEND));
+ } else {
+- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
++ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
+ pcnet32_restart(dev, CSR0_NORMAL);
+ netif_wake_queue(dev);
+ }
+@@ -2767,8 +2767,8 @@ static int mdio_read(struct net_device *dev, int phy_id, int reg_num)
+ if (!lp->mii)
+ return 0;
+
+- lp->a.write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
+- val_out = lp->a.read_bcr(ioaddr, 34);
++ lp->a->write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
++ val_out = lp->a->read_bcr(ioaddr, 34);
+
+ return val_out;
+ }
+@@ -2782,8 +2782,8 @@ static void mdio_write(struct net_device *dev, int phy_id, int reg_num, int val)
+ if (!lp->mii)
+ return;
+
+- lp->a.write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
+- lp->a.write_bcr(ioaddr, 34, val);
++ lp->a->write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
++ lp->a->write_bcr(ioaddr, 34, val);
+ }
+
+ static int pcnet32_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
+@@ -2862,7 +2862,7 @@ static void pcnet32_check_media(struct net_device *dev, int verbose)
+ curr_link = mii_link_ok(&lp->mii_if);
+ } else {
+ ulong ioaddr = dev->base_addr; /* card base I/O address */
+- curr_link = (lp->a.read_bcr(ioaddr, 4) != 0xc0);
++ curr_link = (lp->a->read_bcr(ioaddr, 4) != 0xc0);
+ }
+ if (!curr_link) {
+ if (prev_link || verbose) {
+@@ -2887,13 +2887,13 @@ static void pcnet32_check_media(struct net_device *dev, int verbose)
+ (ecmd.duplex ==
+ DUPLEX_FULL) ? "full" : "half");
+ }
+- bcr9 = lp->a.read_bcr(dev->base_addr, 9);
++ bcr9 = lp->a->read_bcr(dev->base_addr, 9);
+ if ((bcr9 & (1 << 0)) != lp->mii_if.full_duplex) {
+ if (lp->mii_if.full_duplex)
+ bcr9 |= (1 << 0);
+ else
+ bcr9 &= ~(1 << 0);
+- lp->a.write_bcr(dev->base_addr, 9, bcr9);
++ lp->a->write_bcr(dev->base_addr, 9, bcr9);
+ }
+ } else {
+ if (netif_msg_link(lp))
+diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c
+index 9235901..d31e726 100644
+--- a/drivers/net/pppol2tp.c
++++ b/drivers/net/pppol2tp.c
+@@ -1174,7 +1174,7 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
+
+ /* Get routing info from the tunnel socket */
+ skb_dst_drop(skb);
+- skb_dst_set(skb, dst_clone(__sk_dst_get(sk_tun)));
++ skb_dst_set(skb, dst_clone(__sk_dst_check(sk_tun, 0)));
+ pppol2tp_skb_set_owner_w(skb, sk_tun);
+
+ /* Calculate UDP checksum if configured to do so */
+diff --git a/drivers/net/sis190.c b/drivers/net/sis190.c
+index 7cc9898..6eb50d3 100644
+--- a/drivers/net/sis190.c
++++ b/drivers/net/sis190.c
+@@ -1598,7 +1598,7 @@ static int __devinit sis190_get_mac_addr_from_eeprom(struct pci_dev *pdev,
+ static int __devinit sis190_get_mac_addr_from_apc(struct pci_dev *pdev,
+ struct net_device *dev)
+ {
+- static const u16 __devinitdata ids[] = { 0x0965, 0x0966, 0x0968 };
++ static const u16 __devinitconst ids[] = { 0x0965, 0x0966, 0x0968 };
+ struct sis190_private *tp = netdev_priv(dev);
+ struct pci_dev *isa_bridge;
+ u8 reg, tmp8;
+diff --git a/drivers/net/sundance.c b/drivers/net/sundance.c
+index e13685a..60c948c 100644
+--- a/drivers/net/sundance.c
++++ b/drivers/net/sundance.c
+@@ -225,7 +225,7 @@ enum {
+ struct pci_id_info {
+ const char *name;
+ };
+-static const struct pci_id_info pci_id_tbl[] __devinitdata = {
++static const struct pci_id_info pci_id_tbl[] __devinitconst = {
+ {"D-Link DFE-550TX FAST Ethernet Adapter"},
+ {"D-Link DFE-550FX 100Mbps Fiber-optics Adapter"},
+ {"D-Link DFE-580TX 4 port Server Adapter"},
+diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
+index 529f55a..cccaa18 100644
+--- a/drivers/net/tg3.h
++++ b/drivers/net/tg3.h
+@@ -95,6 +95,7 @@
+ #define CHIPREV_ID_5750_A0 0x4000
+ #define CHIPREV_ID_5750_A1 0x4001
+ #define CHIPREV_ID_5750_A3 0x4003
++#define CHIPREV_ID_5750_C1 0x4201
+ #define CHIPREV_ID_5750_C2 0x4202
+ #define CHIPREV_ID_5752_A0_HW 0x5000
+ #define CHIPREV_ID_5752_A0 0x6000
+diff --git a/drivers/net/tokenring/abyss.c b/drivers/net/tokenring/abyss.c
+index b9db1b5..720f9ce 100644
+--- a/drivers/net/tokenring/abyss.c
++++ b/drivers/net/tokenring/abyss.c
+@@ -451,10 +451,12 @@ static struct pci_driver abyss_driver = {
+
+ static int __init abyss_init (void)
+ {
+- abyss_netdev_ops = tms380tr_netdev_ops;
++ pax_open_kernel();
++ memcpy((void *)&abyss_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
+
+- abyss_netdev_ops.ndo_open = abyss_open;
+- abyss_netdev_ops.ndo_stop = abyss_close;
++ *(void **)&abyss_netdev_ops.ndo_open = abyss_open;
++ *(void **)&abyss_netdev_ops.ndo_stop = abyss_close;
++ pax_close_kernel();
+
+ return pci_register_driver(&abyss_driver);
+ }
+diff --git a/drivers/net/tokenring/madgemc.c b/drivers/net/tokenring/madgemc.c
+index 456f8bf..373e56d 100644
+--- a/drivers/net/tokenring/madgemc.c
++++ b/drivers/net/tokenring/madgemc.c
+@@ -755,9 +755,11 @@ static struct mca_driver madgemc_driver = {
+
+ static int __init madgemc_init (void)
+ {
+- madgemc_netdev_ops = tms380tr_netdev_ops;
+- madgemc_netdev_ops.ndo_open = madgemc_open;
+- madgemc_netdev_ops.ndo_stop = madgemc_close;
++ pax_open_kernel();
++ memcpy((void *)&madgemc_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
++ *(void **)&madgemc_netdev_ops.ndo_open = madgemc_open;
++ *(void **)&madgemc_netdev_ops.ndo_stop = madgemc_close;
++ pax_close_kernel();
+
+ return mca_register_driver (&madgemc_driver);
+ }
+diff --git a/drivers/net/tokenring/proteon.c b/drivers/net/tokenring/proteon.c
+index 16e8783..925bd49 100644
+--- a/drivers/net/tokenring/proteon.c
++++ b/drivers/net/tokenring/proteon.c
+@@ -353,9 +353,11 @@ static int __init proteon_init(void)
+ struct platform_device *pdev;
+ int i, num = 0, err = 0;
+
+- proteon_netdev_ops = tms380tr_netdev_ops;
+- proteon_netdev_ops.ndo_open = proteon_open;
+- proteon_netdev_ops.ndo_stop = tms380tr_close;
++ pax_open_kernel();
++ memcpy((void *)&proteon_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
++ *(void **)&proteon_netdev_ops.ndo_open = proteon_open;
++ *(void **)&proteon_netdev_ops.ndo_stop = tms380tr_close;
++ pax_close_kernel();
+
+ err = platform_driver_register(&proteon_driver);
+ if (err)
+diff --git a/drivers/net/tokenring/skisa.c b/drivers/net/tokenring/skisa.c
+index 46db5c5..37c1536 100644
+--- a/drivers/net/tokenring/skisa.c
++++ b/drivers/net/tokenring/skisa.c
+@@ -363,9 +363,11 @@ static int __init sk_isa_init(void)
+ struct platform_device *pdev;
+ int i, num = 0, err = 0;
+
+- sk_isa_netdev_ops = tms380tr_netdev_ops;
+- sk_isa_netdev_ops.ndo_open = sk_isa_open;
+- sk_isa_netdev_ops.ndo_stop = tms380tr_close;
++ pax_open_kernel();
++ memcpy((void *)&sk_isa_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
++ *(void **)&sk_isa_netdev_ops.ndo_open = sk_isa_open;
++ *(void **)&sk_isa_netdev_ops.ndo_stop = tms380tr_close;
++ pax_close_kernel();
+
+ err = platform_driver_register(&sk_isa_driver);
+ if (err)
+diff --git a/drivers/net/tulip/de2104x.c b/drivers/net/tulip/de2104x.c
+index 74e5ba4..5cf6bc9 100644
+--- a/drivers/net/tulip/de2104x.c
++++ b/drivers/net/tulip/de2104x.c
+@@ -1785,6 +1785,8 @@ static void __devinit de21041_get_srom_info (struct de_private *de)
+ struct de_srom_info_leaf *il;
+ void *bufp;
+
++ pax_track_stack();
++
+ /* download entire eeprom */
+ for (i = 0; i < DE_EEPROM_WORDS; i++)
+ ((__le16 *)ee_data)[i] =
+diff --git a/drivers/net/tulip/de4x5.c b/drivers/net/tulip/de4x5.c
+index a8349b7..90f9dfe 100644
+--- a/drivers/net/tulip/de4x5.c
++++ b/drivers/net/tulip/de4x5.c
+@@ -5472,7 +5472,7 @@ de4x5_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
+ for (i=0; i<ETH_ALEN; i++) {
+ tmp.addr[i] = dev->dev_addr[i];
+ }
+- if (copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
++ if (ioc->len > sizeof tmp.addr || copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
+ break;
+
+ case DE4X5_SET_HWADDR: /* Set the hardware address */
+@@ -5512,7 +5512,7 @@ de4x5_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
+ spin_lock_irqsave(&lp->lock, flags);
+ memcpy(&statbuf, &lp->pktStats, ioc->len);
+ spin_unlock_irqrestore(&lp->lock, flags);
+- if (copy_to_user(ioc->data, &statbuf, ioc->len))
++ if (ioc->len > sizeof statbuf || copy_to_user(ioc->data, &statbuf, ioc->len))
+ return -EFAULT;
+ break;
+ }
+diff --git a/drivers/net/tulip/eeprom.c b/drivers/net/tulip/eeprom.c
+index 391acd3..56d11cd 100644
+--- a/drivers/net/tulip/eeprom.c
++++ b/drivers/net/tulip/eeprom.c
+@@ -80,7 +80,7 @@ static struct eeprom_fixup eeprom_fixups[] __devinitdata = {
+ {NULL}};
+
+
+-static const char *block_name[] __devinitdata = {
++static const char *block_name[] __devinitconst = {
+ "21140 non-MII",
+ "21140 MII PHY",
+ "21142 Serial PHY",
+diff --git a/drivers/net/tulip/winbond-840.c b/drivers/net/tulip/winbond-840.c
+index b38d3b7..b1cff23 100644
+--- a/drivers/net/tulip/winbond-840.c
++++ b/drivers/net/tulip/winbond-840.c
+@@ -235,7 +235,7 @@ struct pci_id_info {
+ int drv_flags; /* Driver use, intended as capability flags. */
+ };
+
+-static const struct pci_id_info pci_id_tbl[] __devinitdata = {
++static const struct pci_id_info pci_id_tbl[] __devinitconst = {
+ { /* Sometime a Level-One switch card. */
+ "Winbond W89c840", CanHaveMII | HasBrokenTx | FDXOnNoMII},
+ { "Winbond W89c840", CanHaveMII | HasBrokenTx},
+diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
+index f450bc9..2b747c8 100644
+--- a/drivers/net/usb/hso.c
++++ b/drivers/net/usb/hso.c
+@@ -71,7 +71,7 @@
+ #include <asm/byteorder.h>
+ #include <linux/serial_core.h>
+ #include <linux/serial.h>
+-
++#include <asm/local.h>
+
+ #define DRIVER_VERSION "1.2"
+ #define MOD_AUTHOR "Option Wireless"
+@@ -258,7 +258,7 @@ struct hso_serial {
+
+ /* from usb_serial_port */
+ struct tty_struct *tty;
+- int open_count;
++ local_t open_count;
+ spinlock_t serial_lock;
+
+ int (*write_data) (struct hso_serial *serial);
+@@ -1180,7 +1180,7 @@ static void put_rxbuf_data_and_resubmit_ctrl_urb(struct hso_serial *serial)
+ struct urb *urb;
+
+ urb = serial->rx_urb[0];
+- if (serial->open_count > 0) {
++ if (local_read(&serial->open_count) > 0) {
+ count = put_rxbuf_data(urb, serial);
+ if (count == -1)
+ return;
+@@ -1216,7 +1216,7 @@ static void hso_std_serial_read_bulk_callback(struct urb *urb)
+ DUMP1(urb->transfer_buffer, urb->actual_length);
+
+ /* Anyone listening? */
+- if (serial->open_count == 0)
++ if (local_read(&serial->open_count) == 0)
+ return;
+
+ if (status == 0) {
+@@ -1311,8 +1311,7 @@ static int hso_serial_open(struct tty_struct *tty, struct file *filp)
+ spin_unlock_irq(&serial->serial_lock);
+
+ /* check for port already opened, if not set the termios */
+- serial->open_count++;
+- if (serial->open_count == 1) {
++ if (local_inc_return(&serial->open_count) == 1) {
+ tty->low_latency = 1;
+ serial->rx_state = RX_IDLE;
+ /* Force default termio settings */
+@@ -1325,7 +1324,7 @@ static int hso_serial_open(struct tty_struct *tty, struct file *filp)
+ result = hso_start_serial_device(serial->parent, GFP_KERNEL);
+ if (result) {
+ hso_stop_serial_device(serial->parent);
+- serial->open_count--;
++ local_dec(&serial->open_count);
+ kref_put(&serial->parent->ref, hso_serial_ref_free);
+ }
+ } else {
+@@ -1362,10 +1361,10 @@ static void hso_serial_close(struct tty_struct *tty, struct file *filp)
+
+ /* reset the rts and dtr */
+ /* do the actual close */
+- serial->open_count--;
++ local_dec(&serial->open_count);
+
+- if (serial->open_count <= 0) {
+- serial->open_count = 0;
++ if (local_read(&serial->open_count) <= 0) {
++ local_set(&serial->open_count, 0);
+ spin_lock_irq(&serial->serial_lock);
+ if (serial->tty == tty) {
+ serial->tty->driver_data = NULL;
+@@ -1447,7 +1446,7 @@ static void hso_serial_set_termios(struct tty_struct *tty, struct ktermios *old)
+
+ /* the actual setup */
+ spin_lock_irqsave(&serial->serial_lock, flags);
+- if (serial->open_count)
++ if (local_read(&serial->open_count))
+ _hso_serial_set_termios(tty, old);
+ else
+ tty->termios = old;
+@@ -3097,7 +3096,7 @@ static int hso_resume(struct usb_interface *iface)
+ /* Start all serial ports */
+ for (i = 0; i < HSO_SERIAL_TTY_MINORS; i++) {
+ if (serial_table[i] && (serial_table[i]->interface == iface)) {
+- if (dev2ser(serial_table[i])->open_count) {
++ if (local_read(&dev2ser(serial_table[i])->open_count)) {
+ result =
+ hso_start_serial_device(serial_table[i], GFP_NOIO);
+ hso_kick_transmit(dev2ser(serial_table[i]));
+diff --git a/drivers/net/vxge/vxge-config.h b/drivers/net/vxge/vxge-config.h
+index 3e94f0c..ffdd926 100644
+--- a/drivers/net/vxge/vxge-config.h
++++ b/drivers/net/vxge/vxge-config.h
+@@ -474,7 +474,7 @@ struct vxge_hw_uld_cbs {
+ void (*link_down)(struct __vxge_hw_device *devh);
+ void (*crit_err)(struct __vxge_hw_device *devh,
+ enum vxge_hw_event type, u64 ext_data);
+-};
++} __no_const;
+
+ /*
+ * struct __vxge_hw_blockpool_entry - Block private data structure
+diff --git a/drivers/net/vxge/vxge-main.c b/drivers/net/vxge/vxge-main.c
+index 068d7a9..35293de 100644
+--- a/drivers/net/vxge/vxge-main.c
++++ b/drivers/net/vxge/vxge-main.c
+@@ -93,6 +93,8 @@ static inline void VXGE_COMPLETE_VPATH_TX(struct vxge_fifo *fifo)
+ struct sk_buff *completed[NR_SKB_COMPLETED];
+ int more;
+
++ pax_track_stack();
++
+ do {
+ more = 0;
+ skb_ptr = completed;
+@@ -1779,6 +1781,8 @@ static enum vxge_hw_status vxge_rth_configure(struct vxgedev *vdev)
+ u8 mtable[256] = {0}; /* CPU to vpath mapping */
+ int index;
+
++ pax_track_stack();
++
+ /*
+ * Filling
+ * - itable with bucket numbers
+diff --git a/drivers/net/vxge/vxge-traffic.h b/drivers/net/vxge/vxge-traffic.h
+index 461742b..81be42e 100644
+--- a/drivers/net/vxge/vxge-traffic.h
++++ b/drivers/net/vxge/vxge-traffic.h
+@@ -2123,7 +2123,7 @@ struct vxge_hw_mempool_cbs {
+ struct vxge_hw_mempool_dma *dma_object,
+ u32 index,
+ u32 is_last);
+-};
++} __no_const;
+
+ void
+ __vxge_hw_mempool_destroy(
+diff --git a/drivers/net/wan/cycx_x25.c b/drivers/net/wan/cycx_x25.c
+index cd8cb95..4153b79 100644
+--- a/drivers/net/wan/cycx_x25.c
++++ b/drivers/net/wan/cycx_x25.c
+@@ -1017,6 +1017,8 @@ static void hex_dump(char *msg, unsigned char *p, int len)
+ unsigned char hex[1024],
+ * phex = hex;
+
++ pax_track_stack();
++
+ if (len >= (sizeof(hex) / 2))
+ len = (sizeof(hex) / 2) - 1;
+
+diff --git a/drivers/net/wan/hdlc_x25.c b/drivers/net/wan/hdlc_x25.c
+index aa9248f..a4e3c3b 100644
+--- a/drivers/net/wan/hdlc_x25.c
++++ b/drivers/net/wan/hdlc_x25.c
+@@ -136,16 +136,16 @@ static netdev_tx_t x25_xmit(struct sk_buff *skb, struct net_device *dev)
+
+ static int x25_open(struct net_device *dev)
+ {
+- struct lapb_register_struct cb;
++ static struct lapb_register_struct cb = {
++ .connect_confirmation = x25_connected,
++ .connect_indication = x25_connected,
++ .disconnect_confirmation = x25_disconnected,
++ .disconnect_indication = x25_disconnected,
++ .data_indication = x25_data_indication,
++ .data_transmit = x25_data_transmit
++ };
+ int result;
+
+- cb.connect_confirmation = x25_connected;
+- cb.connect_indication = x25_connected;
+- cb.disconnect_confirmation = x25_disconnected;
+- cb.disconnect_indication = x25_disconnected;
+- cb.data_indication = x25_data_indication;
+- cb.data_transmit = x25_data_transmit;
+-
+ result = lapb_register(dev, &cb);
+ if (result != LAPB_OK)
+ return result;
+diff --git a/drivers/net/wimax/i2400m/usb-fw.c b/drivers/net/wimax/i2400m/usb-fw.c
+index 5ad287c..783b020 100644
+--- a/drivers/net/wimax/i2400m/usb-fw.c
++++ b/drivers/net/wimax/i2400m/usb-fw.c
+@@ -263,6 +263,8 @@ ssize_t i2400mu_bus_bm_wait_for_ack(struct i2400m *i2400m,
+ int do_autopm = 1;
+ DECLARE_COMPLETION_ONSTACK(notif_completion);
+
++ pax_track_stack();
++
+ d_fnstart(8, dev, "(i2400m %p ack %p size %zu)\n",
+ i2400m, ack, ack_size);
+ BUG_ON(_ack == i2400m->bm_ack_buf);
+diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
+index 6c26840..62c97c3 100644
+--- a/drivers/net/wireless/airo.c
++++ b/drivers/net/wireless/airo.c
+@@ -3003,6 +3003,8 @@ static void airo_process_scan_results (struct airo_info *ai) {
+ BSSListElement * loop_net;
+ BSSListElement * tmp_net;
+
++ pax_track_stack();
++
+ /* Blow away current list of scan results */
+ list_for_each_entry_safe (loop_net, tmp_net, &ai->network_list, list) {
+ list_move_tail (&loop_net->list, &ai->network_free_list);
+@@ -3783,6 +3785,8 @@ static u16 setup_card(struct airo_info *ai, u8 *mac, int lock)
+ WepKeyRid wkr;
+ int rc;
+
++ pax_track_stack();
++
+ memset( &mySsid, 0, sizeof( mySsid ) );
+ kfree (ai->flash);
+ ai->flash = NULL;
+@@ -4758,6 +4762,8 @@ static int proc_stats_rid_open( struct inode *inode,
+ __le32 *vals = stats.vals;
+ int len;
+
++ pax_track_stack();
++
+ if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
+ return -ENOMEM;
+ data = (struct proc_data *)file->private_data;
+@@ -5487,6 +5493,8 @@ static int proc_BSSList_open( struct inode *inode, struct file *file ) {
+ /* If doLoseSync is not 1, we won't do a Lose Sync */
+ int doLoseSync = -1;
+
++ pax_track_stack();
++
+ if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
+ return -ENOMEM;
+ data = (struct proc_data *)file->private_data;
+@@ -7193,6 +7201,8 @@ static int airo_get_aplist(struct net_device *dev,
+ int i;
+ int loseSync = capable(CAP_NET_ADMIN) ? 1: -1;
+
++ pax_track_stack();
++
+ qual = kmalloc(IW_MAX_AP * sizeof(*qual), GFP_KERNEL);
+ if (!qual)
+ return -ENOMEM;
+@@ -7753,6 +7763,8 @@ static void airo_read_wireless_stats(struct airo_info *local)
+ CapabilityRid cap_rid;
+ __le32 *vals = stats_rid.vals;
+
++ pax_track_stack();
++
+ /* Get stats out of the card */
+ clear_bit(JOB_WSTATS, &local->jobs);
+ if (local->power.event) {
+diff --git a/drivers/net/wireless/ath/ath5k/debug.c b/drivers/net/wireless/ath/ath5k/debug.c
+index 747508c..82e965d 100644
+--- a/drivers/net/wireless/ath/ath5k/debug.c
++++ b/drivers/net/wireless/ath/ath5k/debug.c
+@@ -205,6 +205,8 @@ static ssize_t read_file_beacon(struct file *file, char __user *user_buf,
+ unsigned int v;
+ u64 tsf;
+
++ pax_track_stack();
++
+ v = ath5k_hw_reg_read(sc->ah, AR5K_BEACON);
+ len += snprintf(buf+len, sizeof(buf)-len,
+ "%-24s0x%08x\tintval: %d\tTIM: 0x%x\n",
+@@ -318,6 +320,8 @@ static ssize_t read_file_debug(struct file *file, char __user *user_buf,
+ unsigned int len = 0;
+ unsigned int i;
+
++ pax_track_stack();
++
+ len += snprintf(buf+len, sizeof(buf)-len,
+ "DEBUG LEVEL: 0x%08x\n\n", sc->debug.level);
+
+diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
+index 2be4c22..593b1eb 100644
+--- a/drivers/net/wireless/ath/ath9k/debug.c
++++ b/drivers/net/wireless/ath/ath9k/debug.c
+@@ -220,6 +220,8 @@ static ssize_t read_file_interrupt(struct file *file, char __user *user_buf,
+ char buf[512];
+ unsigned int len = 0;
+
++ pax_track_stack();
++
+ len += snprintf(buf + len, sizeof(buf) - len,
+ "%8s: %10u\n", "RX", sc->debug.stats.istats.rxok);
+ len += snprintf(buf + len, sizeof(buf) - len,
+@@ -360,6 +362,8 @@ static ssize_t read_file_wiphy(struct file *file, char __user *user_buf,
+ int i;
+ u8 addr[ETH_ALEN];
+
++ pax_track_stack();
++
+ len += snprintf(buf + len, sizeof(buf) - len,
+ "primary: %s (%s chan=%d ht=%d)\n",
+ wiphy_name(sc->pri_wiphy->hw->wiphy),
+diff --git a/drivers/net/wireless/b43/debugfs.c b/drivers/net/wireless/b43/debugfs.c
+index 80b19a4..dab3a45 100644
+--- a/drivers/net/wireless/b43/debugfs.c
++++ b/drivers/net/wireless/b43/debugfs.c
+@@ -43,7 +43,7 @@ static struct dentry *rootdir;
+ struct b43_debugfs_fops {
+ ssize_t (*read)(struct b43_wldev *dev, char *buf, size_t bufsize);
+ int (*write)(struct b43_wldev *dev, const char *buf, size_t count);
+- struct file_operations fops;
++ const struct file_operations fops;
+ /* Offset of struct b43_dfs_file in struct b43_dfsentry */
+ size_t file_struct_offset;
+ };
+diff --git a/drivers/net/wireless/b43legacy/debugfs.c b/drivers/net/wireless/b43legacy/debugfs.c
+index 1f85ac5..c99b4b4 100644
+--- a/drivers/net/wireless/b43legacy/debugfs.c
++++ b/drivers/net/wireless/b43legacy/debugfs.c
+@@ -44,7 +44,7 @@ static struct dentry *rootdir;
+ struct b43legacy_debugfs_fops {
+ ssize_t (*read)(struct b43legacy_wldev *dev, char *buf, size_t bufsize);
+ int (*write)(struct b43legacy_wldev *dev, const char *buf, size_t count);
+- struct file_operations fops;
++ const struct file_operations fops;
+ /* Offset of struct b43legacy_dfs_file in struct b43legacy_dfsentry */
+ size_t file_struct_offset;
+ /* Take wl->irq_lock before calling read/write? */
+diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
+index 43102bf..3b569c3 100644
+--- a/drivers/net/wireless/ipw2x00/ipw2100.c
++++ b/drivers/net/wireless/ipw2x00/ipw2100.c
+@@ -2014,6 +2014,8 @@ static int ipw2100_set_essid(struct ipw2100_priv *priv, char *essid,
+ int err;
+ DECLARE_SSID_BUF(ssid);
+
++ pax_track_stack();
++
+ IPW_DEBUG_HC("SSID: '%s'\n", print_ssid(ssid, essid, ssid_len));
+
+ if (ssid_len)
+@@ -5380,6 +5382,8 @@ static int ipw2100_set_key(struct ipw2100_priv *priv,
+ struct ipw2100_wep_key *wep_key = (void *)cmd.host_command_parameters;
+ int err;
+
++ pax_track_stack();
++
+ IPW_DEBUG_HC("WEP_KEY_INFO: index = %d, len = %d/%d\n",
+ idx, keylen, len);
+
+diff --git a/drivers/net/wireless/ipw2x00/libipw_rx.c b/drivers/net/wireless/ipw2x00/libipw_rx.c
+index 282b1f7..169f0cf 100644
+--- a/drivers/net/wireless/ipw2x00/libipw_rx.c
++++ b/drivers/net/wireless/ipw2x00/libipw_rx.c
+@@ -1566,6 +1566,8 @@ static void libipw_process_probe_response(struct libipw_device
+ unsigned long flags;
+ DECLARE_SSID_BUF(ssid);
+
++ pax_track_stack();
++
+ LIBIPW_DEBUG_SCAN("'%s' (%pM"
+ "): %c%c%c%c %c%c%c%c-%c%c%c%c %c%c%c%c\n",
+ print_ssid(ssid, info_element->data, info_element->len),
+diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
+index 950267a..80d5fd2 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
+@@ -137,7 +137,7 @@ static struct iwl_lib_ops iwl1000_lib = {
+ },
+ };
+
+-static struct iwl_ops iwl1000_ops = {
++static const struct iwl_ops iwl1000_ops = {
+ .ucode = &iwl5000_ucode,
+ .lib = &iwl1000_lib,
+ .hcmd = &iwl5000_hcmd,
+diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
+index 56bfcc3..b348020 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
++++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
+@@ -2874,7 +2874,7 @@ static struct iwl_hcmd_utils_ops iwl3945_hcmd_utils = {
+ .build_addsta_hcmd = iwl3945_build_addsta_hcmd,
+ };
+
+-static struct iwl_ops iwl3945_ops = {
++static const struct iwl_ops iwl3945_ops = {
+ .ucode = &iwl3945_ucode,
+ .lib = &iwl3945_lib,
+ .hcmd = &iwl3945_hcmd,
+diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
+index 585b8d4..e142963 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
++++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
+@@ -2345,7 +2345,7 @@ static struct iwl_lib_ops iwl4965_lib = {
+ },
+ };
+
+-static struct iwl_ops iwl4965_ops = {
++static const struct iwl_ops iwl4965_ops = {
+ .ucode = &iwl4965_ucode,
+ .lib = &iwl4965_lib,
+ .hcmd = &iwl4965_hcmd,
+diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
+index 1f423f2..e37c192 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
+@@ -1633,14 +1633,14 @@ static struct iwl_lib_ops iwl5150_lib = {
+ },
+ };
+
+-struct iwl_ops iwl5000_ops = {
++const struct iwl_ops iwl5000_ops = {
+ .ucode = &iwl5000_ucode,
+ .lib = &iwl5000_lib,
+ .hcmd = &iwl5000_hcmd,
+ .utils = &iwl5000_hcmd_utils,
+ };
+
+-static struct iwl_ops iwl5150_ops = {
++static const struct iwl_ops iwl5150_ops = {
+ .ucode = &iwl5000_ucode,
+ .lib = &iwl5150_lib,
+ .hcmd = &iwl5000_hcmd,
+diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
+index 1473452..f07d5e1 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
+@@ -146,7 +146,7 @@ static struct iwl_hcmd_utils_ops iwl6000_hcmd_utils = {
+ .calc_rssi = iwl5000_calc_rssi,
+ };
+
+-static struct iwl_ops iwl6000_ops = {
++static const struct iwl_ops iwl6000_ops = {
+ .ucode = &iwl5000_ucode,
+ .lib = &iwl6000_lib,
+ .hcmd = &iwl5000_hcmd,
+diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+index 1a3dfa2..b3e0a61 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+@@ -857,6 +857,8 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
+ u8 active_index = 0;
+ s32 tpt = 0;
+
++ pax_track_stack();
++
+ IWL_DEBUG_RATE_LIMIT(priv, "get frame ack response, update rate scale window\n");
+
+ if (!ieee80211_is_data(hdr->frame_control) ||
+@@ -2722,6 +2724,8 @@ static void rs_fill_link_cmd(struct iwl_priv *priv,
+ u8 valid_tx_ant = 0;
+ struct iwl_link_quality_cmd *lq_cmd = &lq_sta->lq;
+
++ pax_track_stack();
++
+ /* Override starting rate (index 0) if needed for debug purposes */
+ rs_dbgfs_set_mcs(lq_sta, &new_rate, index);
+
+diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
+index 0e56d78..6a3c107 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
+@@ -2911,7 +2911,9 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ if (iwl_debug_level & IWL_DL_INFO)
+ dev_printk(KERN_DEBUG, &(pdev->dev),
+ "Disabling hw_scan\n");
+- iwl_hw_ops.hw_scan = NULL;
++ pax_open_kernel();
++ *(void **)&iwl_hw_ops.hw_scan = NULL;
++ pax_close_kernel();
+ }
+
+ hw = iwl_alloc_all(cfg, &iwl_hw_ops);
+diff --git a/drivers/net/wireless/iwlwifi/iwl-debug.h b/drivers/net/wireless/iwlwifi/iwl-debug.h
+index cbc6290..eb323d7 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-debug.h
++++ b/drivers/net/wireless/iwlwifi/iwl-debug.h
+@@ -118,8 +118,8 @@ void iwl_dbgfs_unregister(struct iwl_priv *priv);
+ #endif
+
+ #else
+-#define IWL_DEBUG(__priv, level, fmt, args...)
+-#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...)
++#define IWL_DEBUG(__priv, level, fmt, args...) do {} while (0)
++#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...) do {} while (0)
+ static inline void iwl_print_hex_dump(struct iwl_priv *priv, int level,
+ void *p, u32 len)
+ {}
+diff --git a/drivers/net/wireless/iwlwifi/iwl-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
+index a198bcf..8e68233 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-debugfs.c
++++ b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
+@@ -524,6 +524,8 @@ static ssize_t iwl_dbgfs_status_read(struct file *file,
+ int pos = 0;
+ const size_t bufsz = sizeof(buf);
+
++ pax_track_stack();
++
+ pos += scnprintf(buf + pos, bufsz - pos, "STATUS_HCMD_ACTIVE:\t %d\n",
+ test_bit(STATUS_HCMD_ACTIVE, &priv->status));
+ pos += scnprintf(buf + pos, bufsz - pos, "STATUS_HCMD_SYNC_ACTIVE: %d\n",
+@@ -658,6 +660,8 @@ static ssize_t iwl_dbgfs_qos_read(struct file *file, char __user *user_buf,
+ const size_t bufsz = sizeof(buf);
+ ssize_t ret;
+
++ pax_track_stack();
++
+ for (i = 0; i < AC_NUM; i++) {
+ pos += scnprintf(buf + pos, bufsz - pos,
+ "\tcw_min\tcw_max\taifsn\ttxop\n");
+diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
+index 3539ea4..b174bfa 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
++++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
+@@ -68,7 +68,7 @@ struct iwl_tx_queue;
+
+ /* shared structures from iwl-5000.c */
+ extern struct iwl_mod_params iwl50_mod_params;
+-extern struct iwl_ops iwl5000_ops;
++extern const struct iwl_ops iwl5000_ops;
+ extern struct iwl_ucode_ops iwl5000_ucode;
+ extern struct iwl_lib_ops iwl5000_lib;
+ extern struct iwl_hcmd_ops iwl5000_hcmd;
+diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
+index 619590d..69235ee 100644
+--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
++++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
+@@ -3927,7 +3927,9 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
+ */
+ if (iwl3945_mod_params.disable_hw_scan) {
+ IWL_DEBUG_INFO(priv, "Disabling hw_scan\n");
+- iwl3945_hw_ops.hw_scan = NULL;
++ pax_open_kernel();
++ *(void **)&iwl3945_hw_ops.hw_scan = NULL;
++ pax_close_kernel();
+ }
+
+
+diff --git a/drivers/net/wireless/iwmc3200wifi/debugfs.c b/drivers/net/wireless/iwmc3200wifi/debugfs.c
+index 1465379..fe4d78b 100644
+--- a/drivers/net/wireless/iwmc3200wifi/debugfs.c
++++ b/drivers/net/wireless/iwmc3200wifi/debugfs.c
+@@ -299,6 +299,8 @@ static ssize_t iwm_debugfs_fw_err_read(struct file *filp,
+ int buf_len = 512;
+ size_t len = 0;
+
++ pax_track_stack();
++
+ if (*ppos != 0)
+ return 0;
+ if (count < sizeof(buf))
+diff --git a/drivers/net/wireless/libertas/debugfs.c b/drivers/net/wireless/libertas/debugfs.c
+index 893a55c..7f66a50 100644
+--- a/drivers/net/wireless/libertas/debugfs.c
++++ b/drivers/net/wireless/libertas/debugfs.c
+@@ -708,7 +708,7 @@ out_unlock:
+ struct lbs_debugfs_files {
+ const char *name;
+ int perm;
+- struct file_operations fops;
++ const struct file_operations fops;
+ };
+
+ static const struct lbs_debugfs_files debugfs_files[] = {
+diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
+index 2ecbedb..42704f0 100644
+--- a/drivers/net/wireless/rndis_wlan.c
++++ b/drivers/net/wireless/rndis_wlan.c
+@@ -1176,7 +1176,7 @@ static int set_rts_threshold(struct usbnet *usbdev, u32 rts_threshold)
+
+ devdbg(usbdev, "set_rts_threshold %i", rts_threshold);
+
+- if (rts_threshold < 0 || rts_threshold > 2347)
++ if (rts_threshold > 2347)
+ rts_threshold = 2347;
+
+ tmp = cpu_to_le32(rts_threshold);
+diff --git a/drivers/oprofile/buffer_sync.c b/drivers/oprofile/buffer_sync.c
+index 334ccd6..47f8944 100644
+--- a/drivers/oprofile/buffer_sync.c
++++ b/drivers/oprofile/buffer_sync.c
+@@ -342,7 +342,7 @@ static void add_data(struct op_entry *entry, struct mm_struct *mm)
+ if (cookie == NO_COOKIE)
+ offset = pc;
+ if (cookie == INVALID_COOKIE) {
+- atomic_inc(&oprofile_stats.sample_lost_no_mapping);
++ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
+ offset = pc;
+ }
+ if (cookie != last_cookie) {
+@@ -386,14 +386,14 @@ add_sample(struct mm_struct *mm, struct op_sample *s, int in_kernel)
+ /* add userspace sample */
+
+ if (!mm) {
+- atomic_inc(&oprofile_stats.sample_lost_no_mm);
++ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mm);
+ return 0;
+ }
+
+ cookie = lookup_dcookie(mm, s->eip, &offset);
+
+ if (cookie == INVALID_COOKIE) {
+- atomic_inc(&oprofile_stats.sample_lost_no_mapping);
++ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
+ return 0;
+ }
+
+@@ -562,7 +562,7 @@ void sync_buffer(int cpu)
+ /* ignore backtraces if failed to add a sample */
+ if (state == sb_bt_start) {
+ state = sb_bt_ignore;
+- atomic_inc(&oprofile_stats.bt_lost_no_mapping);
++ atomic_inc_unchecked(&oprofile_stats.bt_lost_no_mapping);
+ }
+ }
+ release_mm(mm);
+diff --git a/drivers/oprofile/event_buffer.c b/drivers/oprofile/event_buffer.c
+index 5df60a6..72f5c1c 100644
+--- a/drivers/oprofile/event_buffer.c
++++ b/drivers/oprofile/event_buffer.c
+@@ -53,7 +53,7 @@ void add_event_entry(unsigned long value)
+ }
+
+ if (buffer_pos == buffer_size) {
+- atomic_inc(&oprofile_stats.event_lost_overflow);
++ atomic_inc_unchecked(&oprofile_stats.event_lost_overflow);
+ return;
+ }
+
+diff --git a/drivers/oprofile/oprof.c b/drivers/oprofile/oprof.c
+index dc8a042..fe5f315 100644
+--- a/drivers/oprofile/oprof.c
++++ b/drivers/oprofile/oprof.c
+@@ -110,7 +110,7 @@ static void switch_worker(struct work_struct *work)
+ if (oprofile_ops.switch_events())
+ return;
+
+- atomic_inc(&oprofile_stats.multiplex_counter);
++ atomic_inc_unchecked(&oprofile_stats.multiplex_counter);
+ start_switch_worker();
+ }
+
+diff --git a/drivers/oprofile/oprofile_stats.c b/drivers/oprofile/oprofile_stats.c
+index 61689e8..387f7f8 100644
+--- a/drivers/oprofile/oprofile_stats.c
++++ b/drivers/oprofile/oprofile_stats.c
+@@ -30,11 +30,11 @@ void oprofile_reset_stats(void)
+ cpu_buf->sample_invalid_eip = 0;
+ }
+
+- atomic_set(&oprofile_stats.sample_lost_no_mm, 0);
+- atomic_set(&oprofile_stats.sample_lost_no_mapping, 0);
+- atomic_set(&oprofile_stats.event_lost_overflow, 0);
+- atomic_set(&oprofile_stats.bt_lost_no_mapping, 0);
+- atomic_set(&oprofile_stats.multiplex_counter, 0);
++ atomic_set_unchecked(&oprofile_stats.sample_lost_no_mm, 0);
++ atomic_set_unchecked(&oprofile_stats.sample_lost_no_mapping, 0);
++ atomic_set_unchecked(&oprofile_stats.event_lost_overflow, 0);
++ atomic_set_unchecked(&oprofile_stats.bt_lost_no_mapping, 0);
++ atomic_set_unchecked(&oprofile_stats.multiplex_counter, 0);
+ }
+
+
+diff --git a/drivers/oprofile/oprofile_stats.h b/drivers/oprofile/oprofile_stats.h
+index 0b54e46..a37c527 100644
+--- a/drivers/oprofile/oprofile_stats.h
++++ b/drivers/oprofile/oprofile_stats.h
+@@ -13,11 +13,11 @@
+ #include <asm/atomic.h>
+
+ struct oprofile_stat_struct {
+- atomic_t sample_lost_no_mm;
+- atomic_t sample_lost_no_mapping;
+- atomic_t bt_lost_no_mapping;
+- atomic_t event_lost_overflow;
+- atomic_t multiplex_counter;
++ atomic_unchecked_t sample_lost_no_mm;
++ atomic_unchecked_t sample_lost_no_mapping;
++ atomic_unchecked_t bt_lost_no_mapping;
++ atomic_unchecked_t event_lost_overflow;
++ atomic_unchecked_t multiplex_counter;
+ };
+
+ extern struct oprofile_stat_struct oprofile_stats;
+diff --git a/drivers/oprofile/oprofilefs.c b/drivers/oprofile/oprofilefs.c
+index 2766a6d..80c77e2 100644
+--- a/drivers/oprofile/oprofilefs.c
++++ b/drivers/oprofile/oprofilefs.c
+@@ -187,7 +187,7 @@ static const struct file_operations atomic_ro_fops = {
+
+
+ int oprofilefs_create_ro_atomic(struct super_block *sb, struct dentry *root,
+- char const *name, atomic_t *val)
++ char const *name, atomic_unchecked_t *val)
+ {
+ struct dentry *d = __oprofilefs_create_file(sb, root, name,
+ &atomic_ro_fops, 0444);
+diff --git a/drivers/parisc/pdc_stable.c b/drivers/parisc/pdc_stable.c
+index 13a64bc..ad62835 100644
+--- a/drivers/parisc/pdc_stable.c
++++ b/drivers/parisc/pdc_stable.c
+@@ -481,7 +481,7 @@ pdcspath_attr_store(struct kobject *kobj, struct attribute *attr,
+ return ret;
+ }
+
+-static struct sysfs_ops pdcspath_attr_ops = {
++static const struct sysfs_ops pdcspath_attr_ops = {
+ .show = pdcspath_attr_show,
+ .store = pdcspath_attr_store,
+ };
+diff --git a/drivers/parport/procfs.c b/drivers/parport/procfs.c
+index 8eefe56..40751a7 100644
+--- a/drivers/parport/procfs.c
++++ b/drivers/parport/procfs.c
+@@ -64,7 +64,7 @@ static int do_active_device(ctl_table *table, int write,
+
+ *ppos += len;
+
+- return copy_to_user(result, buffer, len) ? -EFAULT : 0;
++ return (len > sizeof buffer || copy_to_user(result, buffer, len)) ? -EFAULT : 0;
+ }
+
+ #ifdef CONFIG_PARPORT_1284
+@@ -106,7 +106,7 @@ static int do_autoprobe(ctl_table *table, int write,
+
+ *ppos += len;
+
+- return copy_to_user (result, buffer, len) ? -EFAULT : 0;
++ return (len > sizeof buffer || copy_to_user (result, buffer, len)) ? -EFAULT : 0;
+ }
+ #endif /* IEEE1284.3 support. */
+
+diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
+index 73e7d8e..c80f3d2 100644
+--- a/drivers/pci/hotplug/acpiphp_glue.c
++++ b/drivers/pci/hotplug/acpiphp_glue.c
+@@ -111,7 +111,7 @@ static int post_dock_fixups(struct notifier_block *nb, unsigned long val,
+ }
+
+
+-static struct acpi_dock_ops acpiphp_dock_ops = {
++static const struct acpi_dock_ops acpiphp_dock_ops = {
+ .handler = handle_hotplug_event_func,
+ };
+
+diff --git a/drivers/pci/hotplug/cpci_hotplug.h b/drivers/pci/hotplug/cpci_hotplug.h
+index 9fff878..ad0ad53 100644
+--- a/drivers/pci/hotplug/cpci_hotplug.h
++++ b/drivers/pci/hotplug/cpci_hotplug.h
+@@ -59,7 +59,7 @@ struct cpci_hp_controller_ops {
+ int (*hardware_test) (struct slot* slot, u32 value);
+ u8 (*get_power) (struct slot* slot);
+ int (*set_power) (struct slot* slot, int value);
+-};
++} __no_const;
+
+ struct cpci_hp_controller {
+ unsigned int irq;
+diff --git a/drivers/pci/hotplug/cpqphp_nvram.c b/drivers/pci/hotplug/cpqphp_nvram.c
+index 76ba8a1..20ca857 100644
+--- a/drivers/pci/hotplug/cpqphp_nvram.c
++++ b/drivers/pci/hotplug/cpqphp_nvram.c
+@@ -428,9 +428,13 @@ static u32 store_HRT (void __iomem *rom_start)
+
+ void compaq_nvram_init (void __iomem *rom_start)
+ {
++
++#ifndef CONFIG_PAX_KERNEXEC
+ if (rom_start) {
+ compaq_int15_entry_point = (rom_start + ROM_INT15_PHY_ADDR - ROM_PHY_ADDR);
+ }
++#endif
++
+ dbg("int15 entry = %p\n", compaq_int15_entry_point);
+
+ /* initialize our int15 lock */
+diff --git a/drivers/pci/hotplug/fakephp.c b/drivers/pci/hotplug/fakephp.c
+index 6151389..0a894ef 100644
+--- a/drivers/pci/hotplug/fakephp.c
++++ b/drivers/pci/hotplug/fakephp.c
+@@ -73,7 +73,7 @@ static void legacy_release(struct kobject *kobj)
+ }
+
+ static struct kobj_type legacy_ktype = {
+- .sysfs_ops = &(struct sysfs_ops){
++ .sysfs_ops = &(const struct sysfs_ops){
+ .store = legacy_store, .show = legacy_show
+ },
+ .release = &legacy_release,
+diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
+index 5b680df..fe05b7e 100644
+--- a/drivers/pci/intel-iommu.c
++++ b/drivers/pci/intel-iommu.c
+@@ -2643,7 +2643,7 @@ error:
+ return 0;
+ }
+
+-static dma_addr_t intel_map_page(struct device *dev, struct page *page,
++dma_addr_t intel_map_page(struct device *dev, struct page *page,
+ unsigned long offset, size_t size,
+ enum dma_data_direction dir,
+ struct dma_attrs *attrs)
+@@ -2719,7 +2719,7 @@ static void add_unmap(struct dmar_domain *dom, struct iova *iova)
+ spin_unlock_irqrestore(&async_umap_flush_lock, flags);
+ }
+
+-static void intel_unmap_page(struct device *dev, dma_addr_t dev_addr,
++void intel_unmap_page(struct device *dev, dma_addr_t dev_addr,
+ size_t size, enum dma_data_direction dir,
+ struct dma_attrs *attrs)
+ {
+@@ -2768,7 +2768,7 @@ static void intel_unmap_page(struct device *dev, dma_addr_t dev_addr,
+ }
+ }
+
+-static void *intel_alloc_coherent(struct device *hwdev, size_t size,
++void *intel_alloc_coherent(struct device *hwdev, size_t size,
+ dma_addr_t *dma_handle, gfp_t flags)
+ {
+ void *vaddr;
+@@ -2800,7 +2800,7 @@ static void *intel_alloc_coherent(struct device *hwdev, size_t size,
+ return NULL;
+ }
+
+-static void intel_free_coherent(struct device *hwdev, size_t size, void *vaddr,
++void intel_free_coherent(struct device *hwdev, size_t size, void *vaddr,
+ dma_addr_t dma_handle)
+ {
+ int order;
+@@ -2812,7 +2812,7 @@ static void intel_free_coherent(struct device *hwdev, size_t size, void *vaddr,
+ free_pages((unsigned long)vaddr, order);
+ }
+
+-static void intel_unmap_sg(struct device *hwdev, struct scatterlist *sglist,
++void intel_unmap_sg(struct device *hwdev, struct scatterlist *sglist,
+ int nelems, enum dma_data_direction dir,
+ struct dma_attrs *attrs)
+ {
+@@ -2872,7 +2872,7 @@ static int intel_nontranslate_map_sg(struct device *hddev,
+ return nelems;
+ }
+
+-static int intel_map_sg(struct device *hwdev, struct scatterlist *sglist, int nelems,
++int intel_map_sg(struct device *hwdev, struct scatterlist *sglist, int nelems,
+ enum dma_data_direction dir, struct dma_attrs *attrs)
+ {
+ int i;
+@@ -2941,12 +2941,12 @@ static int intel_map_sg(struct device *hwdev, struct scatterlist *sglist, int ne
+ return nelems;
+ }
+
+-static int intel_mapping_error(struct device *dev, dma_addr_t dma_addr)
++int intel_mapping_error(struct device *dev, dma_addr_t dma_addr)
+ {
+ return !dma_addr;
+ }
+
+-struct dma_map_ops intel_dma_ops = {
++const struct dma_map_ops intel_dma_ops = {
+ .alloc_coherent = intel_alloc_coherent,
+ .free_coherent = intel_free_coherent,
+ .map_sg = intel_map_sg,
+diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
+index 5b7056c..607bc94 100644
+--- a/drivers/pci/pcie/aspm.c
++++ b/drivers/pci/pcie/aspm.c
+@@ -27,9 +27,9 @@
+ #define MODULE_PARAM_PREFIX "pcie_aspm."
+
+ /* Note: those are not register definitions */
+-#define ASPM_STATE_L0S_UP (1) /* Upstream direction L0s state */
+-#define ASPM_STATE_L0S_DW (2) /* Downstream direction L0s state */
+-#define ASPM_STATE_L1 (4) /* L1 state */
++#define ASPM_STATE_L0S_UP (1U) /* Upstream direction L0s state */
++#define ASPM_STATE_L0S_DW (2U) /* Downstream direction L0s state */
++#define ASPM_STATE_L1 (4U) /* L1 state */
+ #define ASPM_STATE_L0S (ASPM_STATE_L0S_UP | ASPM_STATE_L0S_DW)
+ #define ASPM_STATE_ALL (ASPM_STATE_L0S | ASPM_STATE_L1)
+
+diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
+index 8105e32..ca10419 100644
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -62,14 +62,14 @@ static ssize_t pci_bus_show_cpuaffinity(struct device *dev,
+ return ret;
+ }
+
+-static ssize_t inline pci_bus_show_cpumaskaffinity(struct device *dev,
++static inline ssize_t pci_bus_show_cpumaskaffinity(struct device *dev,
+ struct device_attribute *attr,
+ char *buf)
+ {
+ return pci_bus_show_cpuaffinity(dev, 0, attr, buf);
+ }
+
+-static ssize_t inline pci_bus_show_cpulistaffinity(struct device *dev,
++static inline ssize_t pci_bus_show_cpulistaffinity(struct device *dev,
+ struct device_attribute *attr,
+ char *buf)
+ {
+diff --git a/drivers/pci/proc.c b/drivers/pci/proc.c
+index a03ad8c..024b0da 100644
+--- a/drivers/pci/proc.c
++++ b/drivers/pci/proc.c
+@@ -480,7 +480,16 @@ static const struct file_operations proc_bus_pci_dev_operations = {
+ static int __init pci_proc_init(void)
+ {
+ struct pci_dev *dev = NULL;
++
++#ifdef CONFIG_GRKERNSEC_PROC_ADD
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++ proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR, NULL);
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++ proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
++#endif
++#else
+ proc_bus_pci_dir = proc_mkdir("bus/pci", NULL);
++#endif
+ proc_create("devices", 0, proc_bus_pci_dir,
+ &proc_bus_pci_dev_operations);
+ proc_initialized = 1;
+diff --git a/drivers/pci/slot.c b/drivers/pci/slot.c
+index 8c02b6c..5584d8e 100644
+--- a/drivers/pci/slot.c
++++ b/drivers/pci/slot.c
+@@ -29,7 +29,7 @@ static ssize_t pci_slot_attr_store(struct kobject *kobj,
+ return attribute->store ? attribute->store(slot, buf, len) : -EIO;
+ }
+
+-static struct sysfs_ops pci_slot_sysfs_ops = {
++static const struct sysfs_ops pci_slot_sysfs_ops = {
+ .show = pci_slot_attr_show,
+ .store = pci_slot_attr_store,
+ };
+diff --git a/drivers/pcmcia/pcmcia_ioctl.c b/drivers/pcmcia/pcmcia_ioctl.c
+index 30cf71d2..50938f1 100644
+--- a/drivers/pcmcia/pcmcia_ioctl.c
++++ b/drivers/pcmcia/pcmcia_ioctl.c
+@@ -819,7 +819,7 @@ static int ds_ioctl(struct inode * inode, struct file * file,
+ return -EFAULT;
+ }
+ }
+- buf = kmalloc(sizeof(ds_ioctl_arg_t), GFP_KERNEL);
++ buf = kzalloc(sizeof(ds_ioctl_arg_t), GFP_KERNEL);
+ if (!buf)
+ return -ENOMEM;
+
+diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
+index 52183c4..b224c69 100644
+--- a/drivers/platform/x86/acer-wmi.c
++++ b/drivers/platform/x86/acer-wmi.c
+@@ -918,7 +918,7 @@ static int update_bl_status(struct backlight_device *bd)
+ return 0;
+ }
+
+-static struct backlight_ops acer_bl_ops = {
++static const struct backlight_ops acer_bl_ops = {
+ .get_brightness = read_brightness,
+ .update_status = update_bl_status,
+ };
+diff --git a/drivers/platform/x86/asus-laptop.c b/drivers/platform/x86/asus-laptop.c
+index 767cb61..a87380b 100644
+--- a/drivers/platform/x86/asus-laptop.c
++++ b/drivers/platform/x86/asus-laptop.c
+@@ -250,7 +250,7 @@ static struct backlight_device *asus_backlight_device;
+ */
+ static int read_brightness(struct backlight_device *bd);
+ static int update_bl_status(struct backlight_device *bd);
+-static struct backlight_ops asusbl_ops = {
++static const struct backlight_ops asusbl_ops = {
+ .get_brightness = read_brightness,
+ .update_status = update_bl_status,
+ };
+diff --git a/drivers/platform/x86/asus_acpi.c b/drivers/platform/x86/asus_acpi.c
+index d66c07a..a4abaac 100644
+--- a/drivers/platform/x86/asus_acpi.c
++++ b/drivers/platform/x86/asus_acpi.c
+@@ -1396,7 +1396,7 @@ static int asus_hotk_remove(struct acpi_device *device, int type)
+ return 0;
+ }
+
+-static struct backlight_ops asus_backlight_data = {
++static const struct backlight_ops asus_backlight_data = {
+ .get_brightness = read_brightness,
+ .update_status = set_brightness_status,
+ };
+diff --git a/drivers/platform/x86/compal-laptop.c b/drivers/platform/x86/compal-laptop.c
+index 11003bb..550ff1b 100644
+--- a/drivers/platform/x86/compal-laptop.c
++++ b/drivers/platform/x86/compal-laptop.c
+@@ -163,7 +163,7 @@ static int bl_update_status(struct backlight_device *b)
+ return set_lcd_level(b->props.brightness);
+ }
+
+-static struct backlight_ops compalbl_ops = {
++static const struct backlight_ops compalbl_ops = {
+ .get_brightness = bl_get_brightness,
+ .update_status = bl_update_status,
+ };
+diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
+index 07a74da..9dc99fa 100644
+--- a/drivers/platform/x86/dell-laptop.c
++++ b/drivers/platform/x86/dell-laptop.c
+@@ -318,7 +318,7 @@ static int dell_get_intensity(struct backlight_device *bd)
+ return buffer.output[1];
+ }
+
+-static struct backlight_ops dell_ops = {
++static const struct backlight_ops dell_ops = {
+ .get_brightness = dell_get_intensity,
+ .update_status = dell_send_intensity,
+ };
+diff --git a/drivers/platform/x86/eeepc-laptop.c b/drivers/platform/x86/eeepc-laptop.c
+index c533b1c..5c81f22 100644
+--- a/drivers/platform/x86/eeepc-laptop.c
++++ b/drivers/platform/x86/eeepc-laptop.c
+@@ -245,7 +245,7 @@ static struct device *eeepc_hwmon_device;
+ */
+ static int read_brightness(struct backlight_device *bd);
+ static int update_bl_status(struct backlight_device *bd);
+-static struct backlight_ops eeepcbl_ops = {
++static const struct backlight_ops eeepcbl_ops = {
+ .get_brightness = read_brightness,
+ .update_status = update_bl_status,
+ };
+diff --git a/drivers/platform/x86/fujitsu-laptop.c b/drivers/platform/x86/fujitsu-laptop.c
+index bcd4ba8..a249b35 100644
+--- a/drivers/platform/x86/fujitsu-laptop.c
++++ b/drivers/platform/x86/fujitsu-laptop.c
+@@ -436,7 +436,7 @@ static int bl_update_status(struct backlight_device *b)
+ return ret;
+ }
+
+-static struct backlight_ops fujitsubl_ops = {
++static const struct backlight_ops fujitsubl_ops = {
+ .get_brightness = bl_get_brightness,
+ .update_status = bl_update_status,
+ };
+diff --git a/drivers/platform/x86/msi-laptop.c b/drivers/platform/x86/msi-laptop.c
+index 759763d..1093ba2 100644
+--- a/drivers/platform/x86/msi-laptop.c
++++ b/drivers/platform/x86/msi-laptop.c
+@@ -161,7 +161,7 @@ static int bl_update_status(struct backlight_device *b)
+ return set_lcd_level(b->props.brightness);
+ }
+
+-static struct backlight_ops msibl_ops = {
++static const struct backlight_ops msibl_ops = {
+ .get_brightness = bl_get_brightness,
+ .update_status = bl_update_status,
+ };
+diff --git a/drivers/platform/x86/panasonic-laptop.c b/drivers/platform/x86/panasonic-laptop.c
+index fe7cf01..9012d8d 100644
+--- a/drivers/platform/x86/panasonic-laptop.c
++++ b/drivers/platform/x86/panasonic-laptop.c
+@@ -352,7 +352,7 @@ static int bl_set_status(struct backlight_device *bd)
+ return acpi_pcc_write_sset(pcc, SINF_DC_CUR_BRIGHT, bright);
+ }
+
+-static struct backlight_ops pcc_backlight_ops = {
++static const struct backlight_ops pcc_backlight_ops = {
+ .get_brightness = bl_get,
+ .update_status = bl_set_status,
+ };
+diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
+index a2a742c..b37e25e 100644
+--- a/drivers/platform/x86/sony-laptop.c
++++ b/drivers/platform/x86/sony-laptop.c
+@@ -850,7 +850,7 @@ static int sony_backlight_get_brightness(struct backlight_device *bd)
+ }
+
+ static struct backlight_device *sony_backlight_device;
+-static struct backlight_ops sony_backlight_ops = {
++static const struct backlight_ops sony_backlight_ops = {
+ .update_status = sony_backlight_update_status,
+ .get_brightness = sony_backlight_get_brightness,
+ };
+diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
+index 68271ae..5e8fb10 100644
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -2139,7 +2139,7 @@ static int hotkey_mask_get(void)
+ return 0;
+ }
+
+-void static hotkey_mask_warn_incomplete_mask(void)
++static void hotkey_mask_warn_incomplete_mask(void)
+ {
+ /* log only what the user can fix... */
+ const u32 wantedmask = hotkey_driver_mask &
+@@ -6125,7 +6125,7 @@ static void tpacpi_brightness_notify_change(void)
+ BACKLIGHT_UPDATE_HOTKEY);
+ }
+
+-static struct backlight_ops ibm_backlight_data = {
++static const struct backlight_ops ibm_backlight_data = {
+ .get_brightness = brightness_get,
+ .update_status = brightness_update_status,
+ };
+diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c
+index 51c0a8b..0786629 100644
+--- a/drivers/platform/x86/toshiba_acpi.c
++++ b/drivers/platform/x86/toshiba_acpi.c
+@@ -671,7 +671,7 @@ static acpi_status remove_device(void)
+ return AE_OK;
+ }
+
+-static struct backlight_ops toshiba_backlight_data = {
++static const struct backlight_ops toshiba_backlight_data = {
+ .get_brightness = get_lcd,
+ .update_status = set_lcd_status,
+ };
+diff --git a/drivers/pnp/pnpbios/bioscalls.c b/drivers/pnp/pnpbios/bioscalls.c
+index fc83783c..cf370d7 100644
+--- a/drivers/pnp/pnpbios/bioscalls.c
++++ b/drivers/pnp/pnpbios/bioscalls.c
+@@ -60,7 +60,7 @@ do { \
+ set_desc_limit(&gdt[(selname) >> 3], (size) - 1); \
+ } while(0)
+
+-static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
++static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
+ (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
+
+ /*
+@@ -97,7 +97,10 @@ static inline u16 call_pnp_bios(u16 func, u16 arg1, u16 arg2, u16 arg3,
+
+ cpu = get_cpu();
+ save_desc_40 = get_cpu_gdt_table(cpu)[0x40 / 8];
++
++ pax_open_kernel();
+ get_cpu_gdt_table(cpu)[0x40 / 8] = bad_bios_desc;
++ pax_close_kernel();
+
+ /* On some boxes IRQ's during PnP BIOS calls are deadly. */
+ spin_lock_irqsave(&pnp_bios_lock, flags);
+@@ -135,7 +138,10 @@ static inline u16 call_pnp_bios(u16 func, u16 arg1, u16 arg2, u16 arg3,
+ :"memory");
+ spin_unlock_irqrestore(&pnp_bios_lock, flags);
+
++ pax_open_kernel();
+ get_cpu_gdt_table(cpu)[0x40 / 8] = save_desc_40;
++ pax_close_kernel();
++
+ put_cpu();
+
+ /* If we get here and this is set then the PnP BIOS faulted on us. */
+@@ -469,7 +475,7 @@ int pnp_bios_read_escd(char *data, u32 nvram_base)
+ return status;
+ }
+
+-void pnpbios_calls_init(union pnp_bios_install_struct *header)
++void __init pnpbios_calls_init(union pnp_bios_install_struct *header)
+ {
+ int i;
+
+@@ -477,6 +483,8 @@ void pnpbios_calls_init(union pnp_bios_install_struct *header)
+ pnp_bios_callpoint.offset = header->fields.pm16offset;
+ pnp_bios_callpoint.segment = PNP_CS16;
+
++ pax_open_kernel();
++
+ for_each_possible_cpu(i) {
+ struct desc_struct *gdt = get_cpu_gdt_table(i);
+ if (!gdt)
+@@ -488,4 +496,6 @@ void pnpbios_calls_init(union pnp_bios_install_struct *header)
+ set_desc_base(&gdt[GDT_ENTRY_PNPBIOS_DS],
+ (unsigned long)__va(header->fields.pm16dseg));
+ }
++
++ pax_close_kernel();
+ }
+diff --git a/drivers/pnp/resource.c b/drivers/pnp/resource.c
+index ba97654..66b99d4 100644
+--- a/drivers/pnp/resource.c
++++ b/drivers/pnp/resource.c
+@@ -355,7 +355,7 @@ int pnp_check_irq(struct pnp_dev *dev, struct resource *res)
+ return 1;
+
+ /* check if the resource is valid */
+- if (*irq < 0 || *irq > 15)
++ if (*irq > 15)
+ return 0;
+
+ /* check if the resource is reserved */
+@@ -419,7 +419,7 @@ int pnp_check_dma(struct pnp_dev *dev, struct resource *res)
+ return 1;
+
+ /* check if the resource is valid */
+- if (*dma < 0 || *dma == 4 || *dma > 7)
++ if (*dma == 4 || *dma > 7)
+ return 0;
+
+ /* check if the resource is reserved */
+diff --git a/drivers/power/bq27x00_battery.c b/drivers/power/bq27x00_battery.c
+index 62bb981..24a2dc9 100644
+--- a/drivers/power/bq27x00_battery.c
++++ b/drivers/power/bq27x00_battery.c
+@@ -44,7 +44,7 @@ struct bq27x00_device_info;
+ struct bq27x00_access_methods {
+ int (*read)(u8 reg, int *rt_value, int b_single,
+ struct bq27x00_device_info *di);
+-};
++} __no_const;
+
+ struct bq27x00_device_info {
+ struct device *dev;
+diff --git a/drivers/rtc/rtc-dev.c b/drivers/rtc/rtc-dev.c
+index 62227cd..b5b538b 100644
+--- a/drivers/rtc/rtc-dev.c
++++ b/drivers/rtc/rtc-dev.c
+@@ -14,6 +14,7 @@
+ #include <linux/module.h>
+ #include <linux/rtc.h>
+ #include <linux/sched.h>
++#include <linux/grsecurity.h>
+ #include "rtc-core.h"
+
+ static dev_t rtc_devt;
+@@ -357,6 +358,8 @@ static long rtc_dev_ioctl(struct file *file,
+ if (copy_from_user(&tm, uarg, sizeof(tm)))
+ return -EFAULT;
+
++ gr_log_timechange();
++
+ return rtc_set_time(rtc, &tm);
+
+ case RTC_PIE_ON:
+diff --git a/drivers/s390/cio/qdio_perf.c b/drivers/s390/cio/qdio_perf.c
+index 968e3c7..fbc637a 100644
+--- a/drivers/s390/cio/qdio_perf.c
++++ b/drivers/s390/cio/qdio_perf.c
+@@ -31,51 +31,51 @@ static struct proc_dir_entry *qdio_perf_pde;
+ static int qdio_perf_proc_show(struct seq_file *m, void *v)
+ {
+ seq_printf(m, "Number of qdio interrupts\t\t\t: %li\n",
+- (long)atomic_long_read(&perf_stats.qdio_int));
++ (long)atomic_long_read_unchecked(&perf_stats.qdio_int));
+ seq_printf(m, "Number of PCI interrupts\t\t\t: %li\n",
+- (long)atomic_long_read(&perf_stats.pci_int));
++ (long)atomic_long_read_unchecked(&perf_stats.pci_int));
+ seq_printf(m, "Number of adapter interrupts\t\t\t: %li\n",
+- (long)atomic_long_read(&perf_stats.thin_int));
++ (long)atomic_long_read_unchecked(&perf_stats.thin_int));
+ seq_printf(m, "\n");
+ seq_printf(m, "Inbound tasklet runs\t\t\t\t: %li\n",
+- (long)atomic_long_read(&perf_stats.tasklet_inbound));
++ (long)atomic_long_read_unchecked(&perf_stats.tasklet_inbound));
+ seq_printf(m, "Outbound tasklet runs\t\t\t\t: %li\n",
+- (long)atomic_long_read(&perf_stats.tasklet_outbound));
++ (long)atomic_long_read_unchecked(&perf_stats.tasklet_outbound));
+ seq_printf(m, "Adapter interrupt tasklet runs/loops\t\t: %li/%li\n",
+- (long)atomic_long_read(&perf_stats.tasklet_thinint),
+- (long)atomic_long_read(&perf_stats.tasklet_thinint_loop));
++ (long)atomic_long_read_unchecked(&perf_stats.tasklet_thinint),
++ (long)atomic_long_read_unchecked(&perf_stats.tasklet_thinint_loop));
+ seq_printf(m, "Adapter interrupt inbound tasklet runs/loops\t: %li/%li\n",
+- (long)atomic_long_read(&perf_stats.thinint_inbound),
+- (long)atomic_long_read(&perf_stats.thinint_inbound_loop));
++ (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound),
++ (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound_loop));
+ seq_printf(m, "\n");
+ seq_printf(m, "Number of SIGA In issued\t\t\t: %li\n",
+- (long)atomic_long_read(&perf_stats.siga_in));
++ (long)atomic_long_read_unchecked(&perf_stats.siga_in));
+ seq_printf(m, "Number of SIGA Out issued\t\t\t: %li\n",
+- (long)atomic_long_read(&perf_stats.siga_out));
++ (long)atomic_long_read_unchecked(&perf_stats.siga_out));
+ seq_printf(m, "Number of SIGA Sync issued\t\t\t: %li\n",
+- (long)atomic_long_read(&perf_stats.siga_sync));
++ (long)atomic_long_read_unchecked(&perf_stats.siga_sync));
+ seq_printf(m, "\n");
+ seq_printf(m, "Number of inbound transfers\t\t\t: %li\n",
+- (long)atomic_long_read(&perf_stats.inbound_handler));
++ (long)atomic_long_read_unchecked(&perf_stats.inbound_handler));
+ seq_printf(m, "Number of outbound transfers\t\t\t: %li\n",
+- (long)atomic_long_read(&perf_stats.outbound_handler));
++ (long)atomic_long_read_unchecked(&perf_stats.outbound_handler));
+ seq_printf(m, "\n");
+ seq_printf(m, "Number of fast requeues (outg. SBAL w/o SIGA)\t: %li\n",
+- (long)atomic_long_read(&perf_stats.fast_requeue));
++ (long)atomic_long_read_unchecked(&perf_stats.fast_requeue));
+ seq_printf(m, "Number of outbound target full condition\t: %li\n",
+- (long)atomic_long_read(&perf_stats.outbound_target_full));
++ (long)atomic_long_read_unchecked(&perf_stats.outbound_target_full));
+ seq_printf(m, "Number of outbound tasklet mod_timer calls\t: %li\n",
+- (long)atomic_long_read(&perf_stats.debug_tl_out_timer));
++ (long)atomic_long_read_unchecked(&perf_stats.debug_tl_out_timer));
+ seq_printf(m, "Number of stop polling calls\t\t\t: %li\n",
+- (long)atomic_long_read(&perf_stats.debug_stop_polling));
++ (long)atomic_long_read_unchecked(&perf_stats.debug_stop_polling));
+ seq_printf(m, "AI inbound tasklet loops after stop polling\t: %li\n",
+- (long)atomic_long_read(&perf_stats.thinint_inbound_loop2));
++ (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound_loop2));
+ seq_printf(m, "QEBSM EQBS total/incomplete\t\t\t: %li/%li\n",
+- (long)atomic_long_read(&perf_stats.debug_eqbs_all),
+- (long)atomic_long_read(&perf_stats.debug_eqbs_incomplete));
++ (long)atomic_long_read_unchecked(&perf_stats.debug_eqbs_all),
++ (long)atomic_long_read_unchecked(&perf_stats.debug_eqbs_incomplete));
+ seq_printf(m, "QEBSM SQBS total/incomplete\t\t\t: %li/%li\n",
+- (long)atomic_long_read(&perf_stats.debug_sqbs_all),
+- (long)atomic_long_read(&perf_stats.debug_sqbs_incomplete));
++ (long)atomic_long_read_unchecked(&perf_stats.debug_sqbs_all),
++ (long)atomic_long_read_unchecked(&perf_stats.debug_sqbs_incomplete));
+ seq_printf(m, "\n");
+ return 0;
+ }
+diff --git a/drivers/s390/cio/qdio_perf.h b/drivers/s390/cio/qdio_perf.h
+index ff4504c..b3604c3 100644
+--- a/drivers/s390/cio/qdio_perf.h
++++ b/drivers/s390/cio/qdio_perf.h
+@@ -13,46 +13,46 @@
+
+ struct qdio_perf_stats {
+ /* interrupt handler calls */
+- atomic_long_t qdio_int;
+- atomic_long_t pci_int;
+- atomic_long_t thin_int;
++ atomic_long_unchecked_t qdio_int;
++ atomic_long_unchecked_t pci_int;
++ atomic_long_unchecked_t thin_int;
+
+ /* tasklet runs */
+- atomic_long_t tasklet_inbound;
+- atomic_long_t tasklet_outbound;
+- atomic_long_t tasklet_thinint;
+- atomic_long_t tasklet_thinint_loop;
+- atomic_long_t thinint_inbound;
+- atomic_long_t thinint_inbound_loop;
+- atomic_long_t thinint_inbound_loop2;
++ atomic_long_unchecked_t tasklet_inbound;
++ atomic_long_unchecked_t tasklet_outbound;
++ atomic_long_unchecked_t tasklet_thinint;
++ atomic_long_unchecked_t tasklet_thinint_loop;
++ atomic_long_unchecked_t thinint_inbound;
++ atomic_long_unchecked_t thinint_inbound_loop;
++ atomic_long_unchecked_t thinint_inbound_loop2;
+
+ /* signal adapter calls */
+- atomic_long_t siga_out;
+- atomic_long_t siga_in;
+- atomic_long_t siga_sync;
++ atomic_long_unchecked_t siga_out;
++ atomic_long_unchecked_t siga_in;
++ atomic_long_unchecked_t siga_sync;
+
+ /* misc */
+- atomic_long_t inbound_handler;
+- atomic_long_t outbound_handler;
+- atomic_long_t fast_requeue;
+- atomic_long_t outbound_target_full;
++ atomic_long_unchecked_t inbound_handler;
++ atomic_long_unchecked_t outbound_handler;
++ atomic_long_unchecked_t fast_requeue;
++ atomic_long_unchecked_t outbound_target_full;
+
+ /* for debugging */
+- atomic_long_t debug_tl_out_timer;
+- atomic_long_t debug_stop_polling;
+- atomic_long_t debug_eqbs_all;
+- atomic_long_t debug_eqbs_incomplete;
+- atomic_long_t debug_sqbs_all;
+- atomic_long_t debug_sqbs_incomplete;
++ atomic_long_unchecked_t debug_tl_out_timer;
++ atomic_long_unchecked_t debug_stop_polling;
++ atomic_long_unchecked_t debug_eqbs_all;
++ atomic_long_unchecked_t debug_eqbs_incomplete;
++ atomic_long_unchecked_t debug_sqbs_all;
++ atomic_long_unchecked_t debug_sqbs_incomplete;
+ };
+
+ extern struct qdio_perf_stats perf_stats;
+ extern int qdio_performance_stats;
+
+-static inline void qdio_perf_stat_inc(atomic_long_t *count)
++static inline void qdio_perf_stat_inc(atomic_long_unchecked_t *count)
+ {
+ if (qdio_performance_stats)
+- atomic_long_inc(count);
++ atomic_long_inc_unchecked(count);
+ }
+
+ int qdio_setup_perf_stats(void);
+diff --git a/drivers/scsi/3w-sas.c b/drivers/scsi/3w-sas.c
+new file mode 100644
+index 0000000..7d18a18
+--- /dev/null
++++ b/drivers/scsi/3w-sas.c
+@@ -0,0 +1,1933 @@
++/*
++ 3w-sas.c -- LSI 3ware SAS/SATA-RAID Controller device driver for Linux.
++
++ Written By: Adam Radford <linuxraid@lsi.com>
++
++ Copyright (C) 2009 LSI Corporation.
++
++ This program is free software; you can redistribute it and/or modify
++ it under the terms of the GNU General Public License as published by
++ the Free Software Foundation; version 2 of the License.
++
++ This program is distributed in the hope that it will be useful,
++ but WITHOUT ANY WARRANTY; without even the implied warranty of
++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
++ GNU General Public License for more details.
++
++ NO WARRANTY
++ THE PROGRAM IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OR
++ CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED INCLUDING, WITHOUT
++ LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE, NON-INFRINGEMENT,
++ MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each Recipient is
++ solely responsible for determining the appropriateness of using and
++ distributing the Program and assumes all risks associated with its
++ exercise of rights under this Agreement, including but not limited to
++ the risks and costs of program errors, damage to or loss of data,
++ programs or equipment, and unavailability or interruption of operations.
++
++ DISCLAIMER OF LIABILITY
++ NEITHER RECIPIENT NOR ANY CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY
++ DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
++ DAMAGES (INCLUDING WITHOUT LIMITATION LOST PROFITS), HOWEVER CAUSED AND
++ ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
++ TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
++ USE OR DISTRIBUTION OF THE PROGRAM OR THE EXERCISE OF ANY RIGHTS GRANTED
++ HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES
++
++ You should have received a copy of the GNU General Public License
++ along with this program; if not, write to the Free Software
++ Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
++
++ Controllers supported by this driver:
++
++ LSI 3ware 9750 6Gb/s SAS/SATA-RAID
++
++ Bugs/Comments/Suggestions should be mailed to:
++ linuxraid@lsi.com
++
++ For more information, goto:
++ http://www.lsi.com
++
++ History
++ -------
++ 3.26.00.000 - Initial driver release.
++*/
++
++#include <linux/module.h>
++#include <linux/reboot.h>
++#include <linux/spinlock.h>
++#include <linux/interrupt.h>
++#include <linux/moduleparam.h>
++#include <linux/errno.h>
++#include <linux/types.h>
++#include <linux/delay.h>
++#include <linux/pci.h>
++#include <linux/time.h>
++#include <linux/mutex.h>
++#include <linux/smp_lock.h>
++#include <asm/io.h>
++#include <asm/irq.h>
++#include <asm/uaccess.h>
++#include <scsi/scsi.h>
++#include <scsi/scsi_host.h>
++#include <scsi/scsi_tcq.h>
++#include <scsi/scsi_cmnd.h>
++#include "3w-sas.h"
++
++/* Globals */
++#define TW_DRIVER_VERSION "3.26.00.028-2.6.32RH"
++static TW_Device_Extension *twl_device_extension_list[TW_MAX_SLOT];
++static unsigned int twl_device_extension_count;
++static int twl_major = -1;
++extern struct timezone sys_tz;
++
++/* Module parameters */
++MODULE_AUTHOR ("LSI");
++MODULE_DESCRIPTION ("LSI 3ware SAS/SATA-RAID Linux Driver");
++MODULE_LICENSE("GPL");
++MODULE_VERSION(TW_DRIVER_VERSION);
++
++static int use_msi = 0;
++module_param(use_msi, int, S_IRUGO);
++MODULE_PARM_DESC(use_msi, "Use Message Signaled Interrupts. Default: 0");
++
++/* Function prototypes */
++static int twl_reset_device_extension(TW_Device_Extension *tw_dev, int ioctl_reset);
++
++/* Functions */
++
++/* This function returns AENs through sysfs */
++static ssize_t twl_sysfs_aen_read(struct file *filp, struct kobject *kobj,
++ struct bin_attribute *bin_attr,
++ char *outbuf, loff_t offset, size_t count)
++{
++ struct device *dev = container_of(kobj, struct device, kobj);
++ struct Scsi_Host *shost = class_to_shost(dev);
++ TW_Device_Extension *tw_dev = (TW_Device_Extension *)shost->hostdata;
++ unsigned long flags = 0;
++ ssize_t ret;
++
++ if (!capable(CAP_SYS_ADMIN))
++ return -EACCES;
++
++ spin_lock_irqsave(tw_dev->host->host_lock, flags);
++ ret = memory_read_from_buffer(outbuf, count, &offset, tw_dev->event_queue[0], sizeof(TW_Event) * TW_Q_LENGTH);
++ spin_unlock_irqrestore(tw_dev->host->host_lock, flags);
++
++ return ret;
++} /* End twl_sysfs_aen_read() */
++
++/* aen_read sysfs attribute initializer */
++static struct bin_attribute twl_sysfs_aen_read_attr = {
++ .attr = {
++ .name = "3ware_aen_read",
++ .mode = S_IRUSR,
++ },
++ .size = 0,
++ .read = twl_sysfs_aen_read
++};
++
++/* This function returns driver compatibility info through sysfs */
++static ssize_t twl_sysfs_compat_info(struct file *filp, struct kobject *kobj,
++ struct bin_attribute *bin_attr,
++ char *outbuf, loff_t offset, size_t count)
++{
++ struct device *dev = container_of(kobj, struct device, kobj);
++ struct Scsi_Host *shost = class_to_shost(dev);
++ TW_Device_Extension *tw_dev = (TW_Device_Extension *)shost->hostdata;
++ unsigned long flags = 0;
++ ssize_t ret;
++
++ if (!capable(CAP_SYS_ADMIN))
++ return -EACCES;
++
++ spin_lock_irqsave(tw_dev->host->host_lock, flags);
++ ret = memory_read_from_buffer(outbuf, count, &offset, &tw_dev->tw_compat_info, sizeof(TW_Compatibility_Info));
++ spin_unlock_irqrestore(tw_dev->host->host_lock, flags);
++
++ return ret;
++} /* End twl_sysfs_compat_info() */
++
++/* compat_info sysfs attribute initializer */
++static struct bin_attribute twl_sysfs_compat_info_attr = {
++ .attr = {
++ .name = "3ware_compat_info",
++ .mode = S_IRUSR,
++ },
++ .size = 0,
++ .read = twl_sysfs_compat_info
++};
++
++/* Show some statistics about the card */
++static ssize_t twl_show_stats(struct device *dev,
++ struct device_attribute *attr, char *buf)
++{
++ struct Scsi_Host *host = class_to_shost(dev);
++ TW_Device_Extension *tw_dev = (TW_Device_Extension *)host->hostdata;
++ unsigned long flags = 0;
++ ssize_t len;
++
++ spin_lock_irqsave(tw_dev->host->host_lock, flags);
++ len = snprintf(buf, PAGE_SIZE, "3w-sas Driver version: %s\n"
++ "Current commands posted: %4d\n"
++ "Max commands posted: %4d\n"
++ "Last sgl length: %4d\n"
++ "Max sgl length: %4d\n"
++ "Last sector count: %4d\n"
++ "Max sector count: %4d\n"
++ "SCSI Host Resets: %4d\n"
++ "AEN's: %4d\n",
++ TW_DRIVER_VERSION,
++ tw_dev->posted_request_count,
++ tw_dev->max_posted_request_count,
++ tw_dev->sgl_entries,
++ tw_dev->max_sgl_entries,
++ tw_dev->sector_count,
++ tw_dev->max_sector_count,
++ tw_dev->num_resets,
++ tw_dev->aen_count);
++ spin_unlock_irqrestore(tw_dev->host->host_lock, flags);
++ return len;
++} /* End twl_show_stats() */
++
++/* This function will set a devices queue depth */
++static int twl_change_queue_depth(struct scsi_device *sdev, int queue_depth,
++ int reason)
++{
++ if (reason != SCSI_QDEPTH_DEFAULT)
++ return -EOPNOTSUPP;
++
++ if (queue_depth > TW_Q_LENGTH-2)
++ queue_depth = TW_Q_LENGTH-2;
++ scsi_adjust_queue_depth(sdev, MSG_ORDERED_TAG, queue_depth);
++ return queue_depth;
++} /* End twl_change_queue_depth() */
++
++/* stats sysfs attribute initializer */
++static struct device_attribute twl_host_stats_attr = {
++ .attr = {
++ .name = "3ware_stats",
++ .mode = S_IRUGO,
++ },
++ .show = twl_show_stats
++};
++
++/* Host attributes initializer */
++static struct device_attribute *twl_host_attrs[] = {
++ &twl_host_stats_attr,
++ NULL,
++};
++
++/* This function will look up an AEN severity string */
++static char *twl_aen_severity_lookup(unsigned char severity_code)
++{
++ char *retval = NULL;
++
++ if ((severity_code < (unsigned char) TW_AEN_SEVERITY_ERROR) ||
++ (severity_code > (unsigned char) TW_AEN_SEVERITY_DEBUG))
++ goto out;
++
++ retval = twl_aen_severity_table[severity_code];
++out:
++ return retval;
++} /* End twl_aen_severity_lookup() */
++
++/* This function will queue an event */
++static void twl_aen_queue_event(TW_Device_Extension *tw_dev, TW_Command_Apache_Header *header)
++{
++ u32 local_time;
++ struct timeval time;
++ TW_Event *event;
++ unsigned short aen;
++ char host[16];
++ char *error_str;
++
++ tw_dev->aen_count++;
++
++ /* Fill out event info */
++ event = tw_dev->event_queue[tw_dev->error_index];
++
++ host[0] = '\0';
++ if (tw_dev->host)
++ sprintf(host, " scsi%d:", tw_dev->host->host_no);
++
++ aen = le16_to_cpu(header->status_block.error);
++ memset(event, 0, sizeof(TW_Event));
++
++ event->severity = TW_SEV_OUT(header->status_block.severity__reserved);
++ do_gettimeofday(&time);
++ local_time = (u32)(time.tv_sec - (sys_tz.tz_minuteswest * 60));
++ event->time_stamp_sec = local_time;
++ event->aen_code = aen;
++ event->retrieved = TW_AEN_NOT_RETRIEVED;
++ event->sequence_id = tw_dev->error_sequence_id;
++ tw_dev->error_sequence_id++;
++
++ /* Check for embedded error string */
++ error_str = &(header->err_specific_desc[strlen(header->err_specific_desc)+1]);
++
++ header->err_specific_desc[sizeof(header->err_specific_desc) - 1] = '\0';
++ event->parameter_len = strlen(header->err_specific_desc);
++ memcpy(event->parameter_data, header->err_specific_desc, event->parameter_len + 1 + strlen(error_str));
++ if (event->severity != TW_AEN_SEVERITY_DEBUG)
++ printk(KERN_WARNING "3w-sas:%s AEN: %s (0x%02X:0x%04X): %s:%s.\n",
++ host,
++ twl_aen_severity_lookup(TW_SEV_OUT(header->status_block.severity__reserved)),
++ TW_MESSAGE_SOURCE_CONTROLLER_EVENT, aen, error_str,
++ header->err_specific_desc);
++ else
++ tw_dev->aen_count--;
++
++ tw_dev->error_index = (tw_dev->error_index + 1 ) % TW_Q_LENGTH;
++} /* End twl_aen_queue_event() */
++
++/* This function will attempt to post a command packet to the board */
++static int twl_post_command_packet(TW_Device_Extension *tw_dev, int request_id)
++{
++ dma_addr_t command_que_value;
++
++ command_que_value = tw_dev->command_packet_phys[request_id];
++ command_que_value += TW_COMMAND_OFFSET;
++
++ /* First write upper 4 bytes */
++ writel((u32)((u64)command_que_value >> 32), TWL_HIBQPH_REG_ADDR(tw_dev));
++ /* Then the lower 4 bytes */
++ writel((u32)(command_que_value | TWL_PULL_MODE), TWL_HIBQPL_REG_ADDR(tw_dev));
++
++ tw_dev->state[request_id] = TW_S_POSTED;
++ tw_dev->posted_request_count++;
++ if (tw_dev->posted_request_count > tw_dev->max_posted_request_count)
++ tw_dev->max_posted_request_count = tw_dev->posted_request_count;
++
++ return 0;
++} /* End twl_post_command_packet() */
++
++/* This function will perform a pci-dma mapping for a scatter gather list */
++static int twl_map_scsi_sg_data(TW_Device_Extension *tw_dev, int request_id)
++{
++ int use_sg;
++ struct scsi_cmnd *cmd = tw_dev->srb[request_id];
++
++ use_sg = scsi_dma_map(cmd);
++ if (!use_sg)
++ return 0;
++ else if (use_sg < 0) {
++ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1, "Failed to map scatter gather list");
++ return 0;
++ }
++
++ cmd->SCp.phase = TW_PHASE_SGLIST;
++ cmd->SCp.have_data_in = use_sg;
++
++ return use_sg;
++} /* End twl_map_scsi_sg_data() */
++
++/* This function hands scsi cdb's to the firmware */
++static int twl_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, char *cdb, int use_sg, TW_SG_Entry_ISO *sglistarg)
++{
++ TW_Command_Full *full_command_packet;
++ TW_Command_Apache *command_packet;
++ int i, sg_count;
++ struct scsi_cmnd *srb = NULL;
++ struct scatterlist *sglist = NULL, *sg;
++ int retval = 1;
++
++ if (tw_dev->srb[request_id]) {
++ srb = tw_dev->srb[request_id];
++ if (scsi_sglist(srb))
++ sglist = scsi_sglist(srb);
++ }
++
++ /* Initialize command packet */
++ full_command_packet = tw_dev->command_packet_virt[request_id];
++ full_command_packet->header.header_desc.size_header = 128;
++ full_command_packet->header.status_block.error = 0;
++ full_command_packet->header.status_block.severity__reserved = 0;
++
++ command_packet = &full_command_packet->command.newcommand;
++ command_packet->status = 0;
++ command_packet->opcode__reserved = TW_OPRES_IN(0, TW_OP_EXECUTE_SCSI);
++
++ /* We forced 16 byte cdb use earlier */
++ if (!cdb)
++ memcpy(command_packet->cdb, srb->cmnd, TW_MAX_CDB_LEN);
++ else
++ memcpy(command_packet->cdb, cdb, TW_MAX_CDB_LEN);
++
++ if (srb) {
++ command_packet->unit = srb->device->id;
++ command_packet->request_id__lunl =
++ cpu_to_le16(TW_REQ_LUN_IN(srb->device->lun, request_id));
++ } else {
++ command_packet->request_id__lunl =
++ cpu_to_le16(TW_REQ_LUN_IN(0, request_id));
++ command_packet->unit = 0;
++ }
++
++ command_packet->sgl_offset = 16;
++
++ if (!sglistarg) {
++ /* Map sglist from scsi layer to cmd packet */
++ if (scsi_sg_count(srb)) {
++ sg_count = twl_map_scsi_sg_data(tw_dev, request_id);
++ if (sg_count == 0)
++ goto out;
++
++ scsi_for_each_sg(srb, sg, sg_count, i) {
++ command_packet->sg_list[i].address = TW_CPU_TO_SGL(sg_dma_address(sg));
++ command_packet->sg_list[i].length = TW_CPU_TO_SGL(sg_dma_len(sg));
++ }
++ command_packet->sgl_entries__lunh = cpu_to_le16(TW_REQ_LUN_IN((srb->device->lun >> 4), scsi_sg_count(tw_dev->srb[request_id])));
++ }
++ } else {
++ /* Internal cdb post */
++ for (i = 0; i < use_sg; i++) {
++ command_packet->sg_list[i].address = TW_CPU_TO_SGL(sglistarg[i].address);
++ command_packet->sg_list[i].length = TW_CPU_TO_SGL(sglistarg[i].length);
++ }
++ command_packet->sgl_entries__lunh = cpu_to_le16(TW_REQ_LUN_IN(0, use_sg));
++ }
++
++ /* Update some stats */
++ if (srb) {
++ tw_dev->sector_count = scsi_bufflen(srb) / 512;
++ if (tw_dev->sector_count > tw_dev->max_sector_count)
++ tw_dev->max_sector_count = tw_dev->sector_count;
++ tw_dev->sgl_entries = scsi_sg_count(srb);
++ if (tw_dev->sgl_entries > tw_dev->max_sgl_entries)
++ tw_dev->max_sgl_entries = tw_dev->sgl_entries;
++ }
++
++ /* Now post the command to the board */
++ retval = twl_post_command_packet(tw_dev, request_id);
++
++out:
++ return retval;
++} /* End twl_scsiop_execute_scsi() */
++
++/* This function will read the aen queue from the isr */
++static int twl_aen_read_queue(TW_Device_Extension *tw_dev, int request_id)
++{
++ char cdb[TW_MAX_CDB_LEN];
++ TW_SG_Entry_ISO sglist[1];
++ TW_Command_Full *full_command_packet;
++ int retval = 1;
++
++ full_command_packet = tw_dev->command_packet_virt[request_id];
++ memset(full_command_packet, 0, sizeof(TW_Command_Full));
++
++ /* Initialize cdb */
++ memset(&cdb, 0, TW_MAX_CDB_LEN);
++ cdb[0] = REQUEST_SENSE; /* opcode */
++ cdb[4] = TW_ALLOCATION_LENGTH; /* allocation length */
++
++ /* Initialize sglist */
++ memset(&sglist, 0, sizeof(TW_SG_Entry_ISO));
++ sglist[0].length = TW_SECTOR_SIZE;
++ sglist[0].address = tw_dev->generic_buffer_phys[request_id];
++
++ /* Mark internal command */
++ tw_dev->srb[request_id] = NULL;
++
++ /* Now post the command packet */
++ if (twl_scsiop_execute_scsi(tw_dev, request_id, cdb, 1, sglist)) {
++ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x2, "Post failed while reading AEN queue");
++ goto out;
++ }
++ retval = 0;
++out:
++ return retval;
++} /* End twl_aen_read_queue() */
++
++/* This function will sync firmware time with the host time */
++static void twl_aen_sync_time(TW_Device_Extension *tw_dev, int request_id)
++{
++ u32 schedulertime;
++ struct timeval utc;
++ TW_Command_Full *full_command_packet;
++ TW_Command *command_packet;
++ TW_Param_Apache *param;
++ u32 local_time;
++
++ /* Fill out the command packet */
++ full_command_packet = tw_dev->command_packet_virt[request_id];
++ memset(full_command_packet, 0, sizeof(TW_Command_Full));
++ command_packet = &full_command_packet->command.oldcommand;
++ command_packet->opcode__sgloffset = TW_OPSGL_IN(2, TW_OP_SET_PARAM);
++ command_packet->request_id = request_id;
++ command_packet->byte8_offset.param.sgl[0].address = TW_CPU_TO_SGL(tw_dev->generic_buffer_phys[request_id]);
++ command_packet->byte8_offset.param.sgl[0].length = TW_CPU_TO_SGL(TW_SECTOR_SIZE);
++ command_packet->size = TW_COMMAND_SIZE;
++ command_packet->byte6_offset.parameter_count = cpu_to_le16(1);
++
++ /* Setup the param */
++ param = (TW_Param_Apache *)tw_dev->generic_buffer_virt[request_id];
++ memset(param, 0, TW_SECTOR_SIZE);
++ param->table_id = cpu_to_le16(TW_TIMEKEEP_TABLE | 0x8000); /* Controller time keep table */
++ param->parameter_id = cpu_to_le16(0x3); /* SchedulerTime */
++ param->parameter_size_bytes = cpu_to_le16(4);
++
++ /* Convert system time in UTC to local time seconds since last
++ Sunday 12:00AM */
++ do_gettimeofday(&utc);
++ local_time = (u32)(utc.tv_sec - (sys_tz.tz_minuteswest * 60));
++ schedulertime = local_time - (3 * 86400);
++ schedulertime = cpu_to_le32(schedulertime % 604800);
++
++ memcpy(param->data, &schedulertime, sizeof(u32));
++
++ /* Mark internal command */
++ tw_dev->srb[request_id] = NULL;
++
++ /* Now post the command */
++ twl_post_command_packet(tw_dev, request_id);
++} /* End twl_aen_sync_time() */
++
++/* This function will assign an available request id */
++static void twl_get_request_id(TW_Device_Extension *tw_dev, int *request_id)
++{
++ *request_id = tw_dev->free_queue[tw_dev->free_head];
++ tw_dev->free_head = (tw_dev->free_head + 1) % TW_Q_LENGTH;
++ tw_dev->state[*request_id] = TW_S_STARTED;
++} /* End twl_get_request_id() */
++
++/* This function will free a request id */
++static void twl_free_request_id(TW_Device_Extension *tw_dev, int request_id)
++{
++ tw_dev->free_queue[tw_dev->free_tail] = request_id;
++ tw_dev->state[request_id] = TW_S_FINISHED;
++ tw_dev->free_tail = (tw_dev->free_tail + 1) % TW_Q_LENGTH;
++} /* End twl_free_request_id() */
++
++/* This function will complete an aen request from the isr */
++static int twl_aen_complete(TW_Device_Extension *tw_dev, int request_id)
++{
++ TW_Command_Full *full_command_packet;
++ TW_Command *command_packet;
++ TW_Command_Apache_Header *header;
++ unsigned short aen;
++ int retval = 1;
++
++ header = (TW_Command_Apache_Header *)tw_dev->generic_buffer_virt[request_id];
++ tw_dev->posted_request_count--;
++ aen = le16_to_cpu(header->status_block.error);
++ full_command_packet = tw_dev->command_packet_virt[request_id];
++ command_packet = &full_command_packet->command.oldcommand;
++
++ /* First check for internal completion of set param for time sync */
++ if (TW_OP_OUT(command_packet->opcode__sgloffset) == TW_OP_SET_PARAM) {
++ /* Keep reading the queue in case there are more aen's */
++ if (twl_aen_read_queue(tw_dev, request_id))
++ goto out2;
++ else {
++ retval = 0;
++ goto out;
++ }
++ }
++
++ switch (aen) {
++ case TW_AEN_QUEUE_EMPTY:
++ /* Quit reading the queue if this is the last one */
++ break;
++ case TW_AEN_SYNC_TIME_WITH_HOST:
++ twl_aen_sync_time(tw_dev, request_id);
++ retval = 0;
++ goto out;
++ default:
++ twl_aen_queue_event(tw_dev, header);
++
++ /* If there are more aen's, keep reading the queue */
++ if (twl_aen_read_queue(tw_dev, request_id))
++ goto out2;
++ else {
++ retval = 0;
++ goto out;
++ }
++ }
++ retval = 0;
++out2:
++ tw_dev->state[request_id] = TW_S_COMPLETED;
++ twl_free_request_id(tw_dev, request_id);
++ clear_bit(TW_IN_ATTENTION_LOOP, &tw_dev->flags);
++out:
++ return retval;
++} /* End twl_aen_complete() */
++
++/* This function will poll for a response */
++static int twl_poll_response(TW_Device_Extension *tw_dev, int request_id, int seconds)
++{
++ unsigned long before;
++ dma_addr_t mfa;
++ u32 regh, regl;
++ u32 response;
++ int retval = 1;
++ int found = 0;
++
++ before = jiffies;
++
++ while (!found) {
++ if (sizeof(dma_addr_t) > 4) {
++ regh = readl(TWL_HOBQPH_REG_ADDR(tw_dev));
++ regl = readl(TWL_HOBQPL_REG_ADDR(tw_dev));
++ mfa = ((u64)regh << 32) | regl;
++ } else
++ mfa = readl(TWL_HOBQPL_REG_ADDR(tw_dev));
++
++ response = (u32)mfa;
++
++ if (TW_RESID_OUT(response) == request_id)
++ found = 1;
++
++ if (time_after(jiffies, before + HZ * seconds))
++ goto out;
++
++ msleep(50);
++ }
++ retval = 0;
++out:
++ return retval;
++} /* End twl_poll_response() */
++
++/* This function will drain the aen queue */
++static int twl_aen_drain_queue(TW_Device_Extension *tw_dev, int no_check_reset)
++{
++ int request_id = 0;
++ char cdb[TW_MAX_CDB_LEN];
++ TW_SG_Entry_ISO sglist[1];
++ int finished = 0, count = 0;
++ TW_Command_Full *full_command_packet;
++ TW_Command_Apache_Header *header;
++ unsigned short aen;
++ int first_reset = 0, queue = 0, retval = 1;
++
++ if (no_check_reset)
++ first_reset = 0;
++ else
++ first_reset = 1;
++
++ full_command_packet = tw_dev->command_packet_virt[request_id];
++ memset(full_command_packet, 0, sizeof(TW_Command_Full));
++
++ /* Initialize cdb */
++ memset(&cdb, 0, TW_MAX_CDB_LEN);
++ cdb[0] = REQUEST_SENSE; /* opcode */
++ cdb[4] = TW_ALLOCATION_LENGTH; /* allocation length */
++
++ /* Initialize sglist */
++ memset(&sglist, 0, sizeof(TW_SG_Entry_ISO));
++ sglist[0].length = TW_SECTOR_SIZE;
++ sglist[0].address = tw_dev->generic_buffer_phys[request_id];
++
++ /* Mark internal command */
++ tw_dev->srb[request_id] = NULL;
++
++ do {
++ /* Send command to the board */
++ if (twl_scsiop_execute_scsi(tw_dev, request_id, cdb, 1, sglist)) {
++ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x3, "Error posting request sense");
++ goto out;
++ }
++
++ /* Now poll for completion */
++ if (twl_poll_response(tw_dev, request_id, 30)) {
++ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x4, "No valid response while draining AEN queue");
++ tw_dev->posted_request_count--;
++ goto out;
++ }
++
++ tw_dev->posted_request_count--;
++ header = (TW_Command_Apache_Header *)tw_dev->generic_buffer_virt[request_id];
++ aen = le16_to_cpu(header->status_block.error);
++ queue = 0;
++ count++;
++
++ switch (aen) {
++ case TW_AEN_QUEUE_EMPTY:
++ if (first_reset != 1)
++ goto out;
++ else
++ finished = 1;
++ break;
++ case TW_AEN_SOFT_RESET:
++ if (first_reset == 0)
++ first_reset = 1;
++ else
++ queue = 1;
++ break;
++ case TW_AEN_SYNC_TIME_WITH_HOST:
++ break;
++ default:
++ queue = 1;
++ }
++
++ /* Now queue an event info */
++ if (queue)
++ twl_aen_queue_event(tw_dev, header);
++ } while ((finished == 0) && (count < TW_MAX_AEN_DRAIN));
++
++ if (count == TW_MAX_AEN_DRAIN)
++ goto out;
++
++ retval = 0;
++out:
++ tw_dev->state[request_id] = TW_S_INITIAL;
++ return retval;
++} /* End twl_aen_drain_queue() */
++
++/* This function will allocate memory and check if it is correctly aligned */
++static int twl_allocate_memory(TW_Device_Extension *tw_dev, int size, int which)
++{
++ int i;
++ dma_addr_t dma_handle;
++ unsigned long *cpu_addr;
++ int retval = 1;
++
++ cpu_addr = pci_alloc_consistent(tw_dev->tw_pci_dev, size*TW_Q_LENGTH, &dma_handle);
++ if (!cpu_addr) {
++ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x5, "Memory allocation failed");
++ goto out;
++ }
++
++ memset(cpu_addr, 0, size*TW_Q_LENGTH);
++
++ for (i = 0; i < TW_Q_LENGTH; i++) {
++ switch(which) {
++ case 0:
++ tw_dev->command_packet_phys[i] = dma_handle+(i*size);
++ tw_dev->command_packet_virt[i] = (TW_Command_Full *)((unsigned char *)cpu_addr + (i*size));
++ break;
++ case 1:
++ tw_dev->generic_buffer_phys[i] = dma_handle+(i*size);
++ tw_dev->generic_buffer_virt[i] = (unsigned long *)((unsigned char *)cpu_addr + (i*size));
++ break;
++ case 2:
++ tw_dev->sense_buffer_phys[i] = dma_handle+(i*size);
++ tw_dev->sense_buffer_virt[i] = (TW_Command_Apache_Header *)((unsigned char *)cpu_addr + (i*size));
++ break;
++ }
++ }
++ retval = 0;
++out:
++ return retval;
++} /* End twl_allocate_memory() */
++
++/* This function will load the request id and various sgls for ioctls */
++static void twl_load_sgl(TW_Device_Extension *tw_dev, TW_Command_Full *full_command_packet, int request_id, dma_addr_t dma_handle, int length)
++{
++ TW_Command *oldcommand;
++ TW_Command_Apache *newcommand;
++ TW_SG_Entry_ISO *sgl;
++ unsigned int pae = 0;
++
++ if ((sizeof(long) < 8) && (sizeof(dma_addr_t) > 4))
++ pae = 1;
++
++ if (TW_OP_OUT(full_command_packet->command.newcommand.opcode__reserved) == TW_OP_EXECUTE_SCSI) {
++ newcommand = &full_command_packet->command.newcommand;
++ newcommand->request_id__lunl =
++ cpu_to_le16(TW_REQ_LUN_IN(TW_LUN_OUT(newcommand->request_id__lunl), request_id));
++ if (length) {
++ newcommand->sg_list[0].address = TW_CPU_TO_SGL(dma_handle + sizeof(TW_Ioctl_Buf_Apache) - 1);
++ newcommand->sg_list[0].length = TW_CPU_TO_SGL(length);
++ }
++ newcommand->sgl_entries__lunh =
++ cpu_to_le16(TW_REQ_LUN_IN(TW_LUN_OUT(newcommand->sgl_entries__lunh), length ? 1 : 0));
++ } else {
++ oldcommand = &full_command_packet->command.oldcommand;
++ oldcommand->request_id = request_id;
++
++ if (TW_SGL_OUT(oldcommand->opcode__sgloffset)) {
++ /* Load the sg list */
++ sgl = (TW_SG_Entry_ISO *)((u32 *)oldcommand+oldcommand->size - (sizeof(TW_SG_Entry_ISO)/4) + pae + (sizeof(dma_addr_t) > 4 ? 1 : 0));
++ sgl->address = TW_CPU_TO_SGL(dma_handle + sizeof(TW_Ioctl_Buf_Apache) - 1);
++ sgl->length = TW_CPU_TO_SGL(length);
++ oldcommand->size += pae;
++ oldcommand->size += sizeof(dma_addr_t) > 4 ? 1 : 0;
++ }
++ }
++} /* End twl_load_sgl() */
++
++/* This function handles ioctl for the character device
++ This interface is used by smartmontools open source software */
++static int twl_chrdev_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned long arg)
++{
++ long timeout;
++ unsigned long *cpu_addr, data_buffer_length_adjusted = 0, flags = 0;
++ dma_addr_t dma_handle;
++ int request_id = 0;
++ TW_Ioctl_Driver_Command driver_command;
++ TW_Ioctl_Buf_Apache *tw_ioctl;
++ TW_Command_Full *full_command_packet;
++ TW_Device_Extension *tw_dev = twl_device_extension_list[iminor(inode)];
++ int retval = -EFAULT;
++ void __user *argp = (void __user *)arg;
++
++ /* Only let one of these through at a time */
++ if (mutex_lock_interruptible(&tw_dev->ioctl_lock)) {
++ retval = -EINTR;
++ goto out;
++ }
++
++ /* First copy down the driver command */
++ if (copy_from_user(&driver_command, argp, sizeof(TW_Ioctl_Driver_Command)))
++ goto out2;
++
++ /* Check data buffer size */
++ if (driver_command.buffer_length > TW_MAX_SECTORS * 2048) {
++ retval = -EINVAL;
++ goto out2;
++ }
++
++ /* Hardware can only do multiple of 512 byte transfers */
++ data_buffer_length_adjusted = (driver_command.buffer_length + 511) & ~511;
++
++ /* Now allocate ioctl buf memory */
++ cpu_addr = dma_alloc_coherent(&tw_dev->tw_pci_dev->dev, data_buffer_length_adjusted+sizeof(TW_Ioctl_Buf_Apache) - 1, &dma_handle, GFP_KERNEL);
++ if (!cpu_addr) {
++ retval = -ENOMEM;
++ goto out2;
++ }
++
++ tw_ioctl = (TW_Ioctl_Buf_Apache *)cpu_addr;
++
++ /* Now copy down the entire ioctl */
++ if (copy_from_user(tw_ioctl, argp, driver_command.buffer_length + sizeof(TW_Ioctl_Buf_Apache) - 1))
++ goto out3;
++
++ /* See which ioctl we are doing */
++ switch (cmd) {
++ case TW_IOCTL_FIRMWARE_PASS_THROUGH:
++ spin_lock_irqsave(tw_dev->host->host_lock, flags);
++ twl_get_request_id(tw_dev, &request_id);
++
++ /* Flag internal command */
++ tw_dev->srb[request_id] = NULL;
++
++ /* Flag chrdev ioctl */
++ tw_dev->chrdev_request_id = request_id;
++
++ full_command_packet = (TW_Command_Full *)&tw_ioctl->firmware_command;
++
++ /* Load request id and sglist for both command types */
++ twl_load_sgl(tw_dev, full_command_packet, request_id, dma_handle, data_buffer_length_adjusted);
++
++ memcpy(tw_dev->command_packet_virt[request_id], &(tw_ioctl->firmware_command), sizeof(TW_Command_Full));
++
++ /* Now post the command packet to the controller */
++ twl_post_command_packet(tw_dev, request_id);
++ spin_unlock_irqrestore(tw_dev->host->host_lock, flags);
++
++ timeout = TW_IOCTL_CHRDEV_TIMEOUT*HZ;
++
++ /* Now wait for command to complete */
++ timeout = wait_event_timeout(tw_dev->ioctl_wqueue, tw_dev->chrdev_request_id == TW_IOCTL_CHRDEV_FREE, timeout);
++
++ /* We timed out, and didn't get an interrupt */
++ if (tw_dev->chrdev_request_id != TW_IOCTL_CHRDEV_FREE) {
++ /* Now we need to reset the board */
++ printk(KERN_WARNING "3w-sas: scsi%d: WARNING: (0x%02X:0x%04X): Character ioctl (0x%x) timed out, resetting card.\n",
++ tw_dev->host->host_no, TW_DRIVER, 0x6,
++ cmd);
++ retval = -EIO;
++ twl_reset_device_extension(tw_dev, 1);
++ goto out3;
++ }
++
++ /* Now copy in the command packet response */
++ memcpy(&(tw_ioctl->firmware_command), tw_dev->command_packet_virt[request_id], sizeof(TW_Command_Full));
++
++ /* Now complete the io */
++ spin_lock_irqsave(tw_dev->host->host_lock, flags);
++ tw_dev->posted_request_count--;
++ tw_dev->state[request_id] = TW_S_COMPLETED;
++ twl_free_request_id(tw_dev, request_id);
++ spin_unlock_irqrestore(tw_dev->host->host_lock, flags);
++ break;
++ default:
++ retval = -ENOTTY;
++ goto out3;
++ }
++
++ /* Now copy the entire response to userspace */
++ if (copy_to_user(argp, tw_ioctl, sizeof(TW_Ioctl_Buf_Apache) + driver_command.buffer_length - 1) == 0)
++ retval = 0;
++out3:
++ /* Now free ioctl buf memory */
++ dma_free_coherent(&tw_dev->tw_pci_dev->dev, data_buffer_length_adjusted+sizeof(TW_Ioctl_Buf_Apache) - 1, cpu_addr, dma_handle);
++out2:
++ mutex_unlock(&tw_dev->ioctl_lock);
++out:
++ return retval;
++} /* End twl_chrdev_ioctl() */
++
++/* This function handles open for the character device */
++static int twl_chrdev_open(struct inode *inode, struct file *file)
++{
++ unsigned int minor_number;
++ int retval = -ENODEV;
++
++ if (!capable(CAP_SYS_ADMIN)) {
++ retval = -EACCES;
++ goto out;
++ }
++
++ cycle_kernel_lock();
++ minor_number = iminor(inode);
++ if (minor_number >= twl_device_extension_count)
++ goto out;
++ retval = 0;
++out:
++ return retval;
++} /* End twl_chrdev_open() */
++
++/* File operations struct for character device */
++static const struct file_operations twl_fops = {
++ .owner = THIS_MODULE,
++ .ioctl = twl_chrdev_ioctl,
++ .open = twl_chrdev_open,
++ .release = NULL
++};
++
++/* This function passes sense data from firmware to scsi layer */
++static int twl_fill_sense(TW_Device_Extension *tw_dev, int i, int request_id, int copy_sense, int print_host)
++{
++ TW_Command_Apache_Header *header;
++ TW_Command_Full *full_command_packet;
++ unsigned short error;
++ char *error_str;
++ int retval = 1;
++
++ header = tw_dev->sense_buffer_virt[i];
++ full_command_packet = tw_dev->command_packet_virt[request_id];
++
++ /* Get embedded firmware error string */
++ error_str = &(header->err_specific_desc[strlen(header->err_specific_desc) + 1]);
++
++ /* Don't print error for Logical unit not supported during rollcall */
++ error = le16_to_cpu(header->status_block.error);
++ if ((error != TW_ERROR_LOGICAL_UNIT_NOT_SUPPORTED) && (error != TW_ERROR_UNIT_OFFLINE) && (error != TW_ERROR_INVALID_FIELD_IN_CDB)) {
++ if (print_host)
++ printk(KERN_WARNING "3w-sas: scsi%d: ERROR: (0x%02X:0x%04X): %s:%s.\n",
++ tw_dev->host->host_no,
++ TW_MESSAGE_SOURCE_CONTROLLER_ERROR,
++ header->status_block.error,
++ error_str,
++ header->err_specific_desc);
++ else
++ printk(KERN_WARNING "3w-sas: ERROR: (0x%02X:0x%04X): %s:%s.\n",
++ TW_MESSAGE_SOURCE_CONTROLLER_ERROR,
++ header->status_block.error,
++ error_str,
++ header->err_specific_desc);
++ }
++
++ if (copy_sense) {
++ memcpy(tw_dev->srb[request_id]->sense_buffer, header->sense_data, TW_SENSE_DATA_LENGTH);
++ tw_dev->srb[request_id]->result = (full_command_packet->command.newcommand.status << 1);
++ goto out;
++ }
++out:
++ return retval;
++} /* End twl_fill_sense() */
++
++/* This function will free up device extension resources */
++static void twl_free_device_extension(TW_Device_Extension *tw_dev)
++{
++ if (tw_dev->command_packet_virt[0])
++ pci_free_consistent(tw_dev->tw_pci_dev,
++ sizeof(TW_Command_Full)*TW_Q_LENGTH,
++ tw_dev->command_packet_virt[0],
++ tw_dev->command_packet_phys[0]);
++
++ if (tw_dev->generic_buffer_virt[0])
++ pci_free_consistent(tw_dev->tw_pci_dev,
++ TW_SECTOR_SIZE*TW_Q_LENGTH,
++ tw_dev->generic_buffer_virt[0],
++ tw_dev->generic_buffer_phys[0]);
++
++ if (tw_dev->sense_buffer_virt[0])
++ pci_free_consistent(tw_dev->tw_pci_dev,
++ sizeof(TW_Command_Apache_Header)*
++ TW_Q_LENGTH,
++ tw_dev->sense_buffer_virt[0],
++ tw_dev->sense_buffer_phys[0]);
++
++ kfree(tw_dev->event_queue[0]);
++} /* End twl_free_device_extension() */
++
++/* This function will get parameter table entries from the firmware */
++static void *twl_get_param(TW_Device_Extension *tw_dev, int request_id, int table_id, int parameter_id, int parameter_size_bytes)
++{
++ TW_Command_Full *full_command_packet;
++ TW_Command *command_packet;
++ TW_Param_Apache *param;
++ void *retval = NULL;
++
++ /* Setup the command packet */
++ full_command_packet = tw_dev->command_packet_virt[request_id];
++ memset(full_command_packet, 0, sizeof(TW_Command_Full));
++ command_packet = &full_command_packet->command.oldcommand;
++
++ command_packet->opcode__sgloffset = TW_OPSGL_IN(2, TW_OP_GET_PARAM);
++ command_packet->size = TW_COMMAND_SIZE;
++ command_packet->request_id = request_id;
++ command_packet->byte6_offset.block_count = cpu_to_le16(1);
++
++ /* Now setup the param */
++ param = (TW_Param_Apache *)tw_dev->generic_buffer_virt[request_id];
++ memset(param, 0, TW_SECTOR_SIZE);
++ param->table_id = cpu_to_le16(table_id | 0x8000);
++ param->parameter_id = cpu_to_le16(parameter_id);
++ param->parameter_size_bytes = cpu_to_le16(parameter_size_bytes);
++
++ command_packet->byte8_offset.param.sgl[0].address = TW_CPU_TO_SGL(tw_dev->generic_buffer_phys[request_id]);
++ command_packet->byte8_offset.param.sgl[0].length = TW_CPU_TO_SGL(TW_SECTOR_SIZE);
++
++ /* Post the command packet to the board */
++ twl_post_command_packet(tw_dev, request_id);
++
++ /* Poll for completion */
++ if (twl_poll_response(tw_dev, request_id, 30))
++ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x7, "No valid response during get param")
++ else
++ retval = (void *)&(param->data[0]);
++
++ tw_dev->posted_request_count--;
++ tw_dev->state[request_id] = TW_S_INITIAL;
++
++ return retval;
++} /* End twl_get_param() */
++
++/* This function will send an initconnection command to controller */
++static int twl_initconnection(TW_Device_Extension *tw_dev, int message_credits,
++ u32 set_features, unsigned short current_fw_srl,
++ unsigned short current_fw_arch_id,
++ unsigned short current_fw_branch,
++ unsigned short current_fw_build,
++ unsigned short *fw_on_ctlr_srl,
++ unsigned short *fw_on_ctlr_arch_id,
++ unsigned short *fw_on_ctlr_branch,
++ unsigned short *fw_on_ctlr_build,
++ u32 *init_connect_result)
++{
++ TW_Command_Full *full_command_packet;
++ TW_Initconnect *tw_initconnect;
++ int request_id = 0, retval = 1;
++
++ /* Initialize InitConnection command packet */
++ full_command_packet = tw_dev->command_packet_virt[request_id];
++ memset(full_command_packet, 0, sizeof(TW_Command_Full));
++ full_command_packet->header.header_desc.size_header = 128;
++
++ tw_initconnect = (TW_Initconnect *)&full_command_packet->command.oldcommand;
++ tw_initconnect->opcode__reserved = TW_OPRES_IN(0, TW_OP_INIT_CONNECTION);
++ tw_initconnect->request_id = request_id;
++ tw_initconnect->message_credits = cpu_to_le16(message_credits);
++ tw_initconnect->features = set_features;
++
++ /* Turn on 64-bit sgl support if we need to */
++ tw_initconnect->features |= sizeof(dma_addr_t) > 4 ? 1 : 0;
++
++ tw_initconnect->features = cpu_to_le32(tw_initconnect->features);
++
++ if (set_features & TW_EXTENDED_INIT_CONNECT) {
++ tw_initconnect->size = TW_INIT_COMMAND_PACKET_SIZE_EXTENDED;
++ tw_initconnect->fw_srl = cpu_to_le16(current_fw_srl);
++ tw_initconnect->fw_arch_id = cpu_to_le16(current_fw_arch_id);
++ tw_initconnect->fw_branch = cpu_to_le16(current_fw_branch);
++ tw_initconnect->fw_build = cpu_to_le16(current_fw_build);
++ } else
++ tw_initconnect->size = TW_INIT_COMMAND_PACKET_SIZE;
++
++ /* Send command packet to the board */
++ twl_post_command_packet(tw_dev, request_id);
++
++ /* Poll for completion */
++ if (twl_poll_response(tw_dev, request_id, 30)) {
++ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x8, "No valid response during init connection");
++ } else {
++ if (set_features & TW_EXTENDED_INIT_CONNECT) {
++ *fw_on_ctlr_srl = le16_to_cpu(tw_initconnect->fw_srl);
++ *fw_on_ctlr_arch_id = le16_to_cpu(tw_initconnect->fw_arch_id);
++ *fw_on_ctlr_branch = le16_to_cpu(tw_initconnect->fw_branch);
++ *fw_on_ctlr_build = le16_to_cpu(tw_initconnect->fw_build);
++ *init_connect_result = le32_to_cpu(tw_initconnect->result);
++ }
++ retval = 0;
++ }
++
++ tw_dev->posted_request_count--;
++ tw_dev->state[request_id] = TW_S_INITIAL;
++
++ return retval;
++} /* End twl_initconnection() */
++
++/* This function will initialize the fields of a device extension */
++static int twl_initialize_device_extension(TW_Device_Extension *tw_dev)
++{
++ int i, retval = 1;
++
++ /* Initialize command packet buffers */
++ if (twl_allocate_memory(tw_dev, sizeof(TW_Command_Full), 0)) {
++ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x9, "Command packet memory allocation failed");
++ goto out;
++ }
++
++ /* Initialize generic buffer */
++ if (twl_allocate_memory(tw_dev, TW_SECTOR_SIZE, 1)) {
++ TW_PRINTK(tw_dev->host, TW_DRIVER, 0xa, "Generic memory allocation failed");
++ goto out;
++ }
++
++ /* Allocate sense buffers */
++ if (twl_allocate_memory(tw_dev, sizeof(TW_Command_Apache_Header), 2)) {
++ TW_PRINTK(tw_dev->host, TW_DRIVER, 0xb, "Sense buffer allocation failed");
++ goto out;
++ }
++
++ /* Allocate event info space */
++ tw_dev->event_queue[0] = kcalloc(TW_Q_LENGTH, sizeof(TW_Event), GFP_KERNEL);
++ if (!tw_dev->event_queue[0]) {
++ TW_PRINTK(tw_dev->host, TW_DRIVER, 0xc, "Event info memory allocation failed");
++ goto out;
++ }
++
++ for (i = 0; i < TW_Q_LENGTH; i++) {
++ tw_dev->event_queue[i] = (TW_Event *)((unsigned char *)tw_dev->event_queue[0] + (i * sizeof(TW_Event)));
++ tw_dev->free_queue[i] = i;
++ tw_dev->state[i] = TW_S_INITIAL;
++ }
++
++ tw_dev->free_head = TW_Q_START;
++ tw_dev->free_tail = TW_Q_START;
++ tw_dev->error_sequence_id = 1;
++ tw_dev->chrdev_request_id = TW_IOCTL_CHRDEV_FREE;
++
++ mutex_init(&tw_dev->ioctl_lock);
++ init_waitqueue_head(&tw_dev->ioctl_wqueue);
++
++ retval = 0;
++out:
++ return retval;
++} /* End twl_initialize_device_extension() */
++
++/* This function will perform a pci-dma unmap */
++static void twl_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id)
++{
++ struct scsi_cmnd *cmd = tw_dev->srb[request_id];
++
++ if (cmd->SCp.phase == TW_PHASE_SGLIST)
++ scsi_dma_unmap(cmd);
++} /* End twl_unmap_scsi_data() */
++
++/* This function will handle attention interrupts */
++static int twl_handle_attention_interrupt(TW_Device_Extension *tw_dev)
++{
++ int retval = 1;
++ u32 request_id, doorbell;
++
++ /* Read doorbell status */
++ doorbell = readl(TWL_HOBDB_REG_ADDR(tw_dev));
++
++ /* Check for controller errors */
++ if (doorbell & TWL_DOORBELL_CONTROLLER_ERROR) {
++ TW_PRINTK(tw_dev->host, TW_DRIVER, 0xd, "Microcontroller Error: clearing");
++ goto out;
++ }
++
++ /* Check if we need to perform an AEN drain */
++ if (doorbell & TWL_DOORBELL_ATTENTION_INTERRUPT) {
++ if (!(test_and_set_bit(TW_IN_ATTENTION_LOOP, &tw_dev->flags))) {
++ twl_get_request_id(tw_dev, &request_id);
++ if (twl_aen_read_queue(tw_dev, request_id)) {
++ tw_dev->state[request_id] = TW_S_COMPLETED;
++ twl_free_request_id(tw_dev, request_id);
++ clear_bit(TW_IN_ATTENTION_LOOP, &tw_dev->flags);
++ }
++ }
++ }
++
++ retval = 0;
++out:
++ /* Clear doorbell interrupt */
++ TWL_CLEAR_DB_INTERRUPT(tw_dev);
++
++ /* Make sure the clear was flushed by reading it back */
++ readl(TWL_HOBDBC_REG_ADDR(tw_dev));
++
++ return retval;
++} /* End twl_handle_attention_interrupt() */
++
++/* Interrupt service routine */
++static irqreturn_t twl_interrupt(int irq, void *dev_instance)
++{
++ TW_Device_Extension *tw_dev = (TW_Device_Extension *)dev_instance;
++ int i, handled = 0, error = 0;
++ dma_addr_t mfa = 0;
++ u32 reg, regl, regh, response, request_id = 0;
++ struct scsi_cmnd *cmd;
++ TW_Command_Full *full_command_packet;
++
++ spin_lock(tw_dev->host->host_lock);
++
++ /* Read host interrupt status */
++ reg = readl(TWL_HISTAT_REG_ADDR(tw_dev));
++
++ /* Check if this is our interrupt, otherwise bail */
++ if (!(reg & TWL_HISTATUS_VALID_INTERRUPT))
++ goto twl_interrupt_bail;
++
++ handled = 1;
++
++ /* If we are resetting, bail */
++ if (test_bit(TW_IN_RESET, &tw_dev->flags))
++ goto twl_interrupt_bail;
++
++ /* Attention interrupt */
++ if (reg & TWL_HISTATUS_ATTENTION_INTERRUPT) {
++ if (twl_handle_attention_interrupt(tw_dev)) {
++ TWL_MASK_INTERRUPTS(tw_dev);
++ goto twl_interrupt_bail;
++ }
++ }
++
++ /* Response interrupt */
++ while (reg & TWL_HISTATUS_RESPONSE_INTERRUPT) {
++ if (sizeof(dma_addr_t) > 4) {
++ regh = readl(TWL_HOBQPH_REG_ADDR(tw_dev));
++ regl = readl(TWL_HOBQPL_REG_ADDR(tw_dev));
++ mfa = ((u64)regh << 32) | regl;
++ } else
++ mfa = readl(TWL_HOBQPL_REG_ADDR(tw_dev));
++
++ error = 0;
++ response = (u32)mfa;
++
++ /* Check for command packet error */
++ if (!TW_NOTMFA_OUT(response)) {
++ for (i=0;i<TW_Q_LENGTH;i++) {
++ if (tw_dev->sense_buffer_phys[i] == mfa) {
++ request_id = le16_to_cpu(tw_dev->sense_buffer_virt[i]->header_desc.request_id);
++ if (tw_dev->srb[request_id] != NULL)
++ error = twl_fill_sense(tw_dev, i, request_id, 1, 1);
++ else {
++ /* Skip ioctl error prints */
++ if (request_id != tw_dev->chrdev_request_id)
++ error = twl_fill_sense(tw_dev, i, request_id, 0, 1);
++ else
++ memcpy(tw_dev->command_packet_virt[request_id], tw_dev->sense_buffer_virt[i], sizeof(TW_Command_Apache_Header));
++ }
++
++ /* Now re-post the sense buffer */
++ writel((u32)((u64)tw_dev->sense_buffer_phys[i] >> 32), TWL_HOBQPH_REG_ADDR(tw_dev));
++ writel((u32)tw_dev->sense_buffer_phys[i], TWL_HOBQPL_REG_ADDR(tw_dev));
++ break;
++ }
++ }
++ } else
++ request_id = TW_RESID_OUT(response);
++
++ full_command_packet = tw_dev->command_packet_virt[request_id];
++
++ /* Check for correct state */
++ if (tw_dev->state[request_id] != TW_S_POSTED) {
++ if (tw_dev->srb[request_id] != NULL) {
++ TW_PRINTK(tw_dev->host, TW_DRIVER, 0xe, "Received a request id that wasn't posted");
++ TWL_MASK_INTERRUPTS(tw_dev);
++ goto twl_interrupt_bail;
++ }
++ }
++
++ /* Check for internal command completion */
++ if (tw_dev->srb[request_id] == NULL) {
++ if (request_id != tw_dev->chrdev_request_id) {
++ if (twl_aen_complete(tw_dev, request_id))
++ TW_PRINTK(tw_dev->host, TW_DRIVER, 0xf, "Error completing AEN during attention interrupt");
++ } else {
++ tw_dev->chrdev_request_id = TW_IOCTL_CHRDEV_FREE;
++ wake_up(&tw_dev->ioctl_wqueue);
++ }
++ } else {
++ cmd = tw_dev->srb[request_id];
++
++ if (!error)
++ cmd->result = (DID_OK << 16);
++
++ /* Report residual bytes for single sgl */
++ if ((scsi_sg_count(cmd) <= 1) && (full_command_packet->command.newcommand.status == 0)) {
++ if (full_command_packet->command.newcommand.sg_list[0].length < scsi_bufflen(tw_dev->srb[request_id]))
++ scsi_set_resid(cmd, scsi_bufflen(cmd) - full_command_packet->command.newcommand.sg_list[0].length);
++ }
++
++ /* Now complete the io */
++ tw_dev->state[request_id] = TW_S_COMPLETED;
++ twl_free_request_id(tw_dev, request_id);
++ tw_dev->posted_request_count--;
++ tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
++ twl_unmap_scsi_data(tw_dev, request_id);
++ }
++
++ /* Check for another response interrupt */
++ reg = readl(TWL_HISTAT_REG_ADDR(tw_dev));
++ }
++
++twl_interrupt_bail:
++ spin_unlock(tw_dev->host->host_lock);
++ return IRQ_RETVAL(handled);
++} /* End twl_interrupt() */
++
++/* This function will poll for a register change */
++static int twl_poll_register(TW_Device_Extension *tw_dev, void *reg, u32 value, u32 result, int seconds)
++{
++ unsigned long before;
++ int retval = 1;
++ u32 reg_value;
++
++ reg_value = readl(reg);
++ before = jiffies;
++
++ while ((reg_value & value) != result) {
++ reg_value = readl(reg);
++ if (time_after(jiffies, before + HZ * seconds))
++ goto out;
++ msleep(50);
++ }
++ retval = 0;
++out:
++ return retval;
++} /* End twl_poll_register() */
++
++/* This function will reset a controller */
++static int twl_reset_sequence(TW_Device_Extension *tw_dev, int soft_reset)
++{
++ int retval = 1;
++ int i = 0;
++ u32 status = 0;
++ unsigned short fw_on_ctlr_srl = 0, fw_on_ctlr_arch_id = 0;
++ unsigned short fw_on_ctlr_branch = 0, fw_on_ctlr_build = 0;
++ u32 init_connect_result = 0;
++ int tries = 0;
++ int do_soft_reset = soft_reset;
++
++ while (tries < TW_MAX_RESET_TRIES) {
++ /* Do a soft reset if one is needed */
++ if (do_soft_reset) {
++ TWL_SOFT_RESET(tw_dev);
++
++ /* Make sure controller is in a good state */
++ if (twl_poll_register(tw_dev, TWL_SCRPD3_REG_ADDR(tw_dev), TWL_CONTROLLER_READY, 0x0, 30)) {
++ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x10, "Controller never went non-ready during reset sequence");
++ tries++;
++ continue;
++ }
++ if (twl_poll_register(tw_dev, TWL_SCRPD3_REG_ADDR(tw_dev), TWL_CONTROLLER_READY, TWL_CONTROLLER_READY, 60)) {
++ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x11, "Controller not ready during reset sequence");
++ tries++;
++ continue;
++ }
++ }
++
++ /* Initconnect */
++ if (twl_initconnection(tw_dev, TW_INIT_MESSAGE_CREDITS,
++ TW_EXTENDED_INIT_CONNECT, TW_CURRENT_DRIVER_SRL,
++ TW_9750_ARCH_ID, TW_CURRENT_DRIVER_BRANCH,
++ TW_CURRENT_DRIVER_BUILD, &fw_on_ctlr_srl,
++ &fw_on_ctlr_arch_id, &fw_on_ctlr_branch,
++ &fw_on_ctlr_build, &init_connect_result)) {
++ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x12, "Initconnection failed while checking SRL");
++ do_soft_reset = 1;
++ tries++;
++ continue;
++ }
++
++ /* Load sense buffers */
++ while (i < TW_Q_LENGTH) {
++ writel((u32)((u64)tw_dev->sense_buffer_phys[i] >> 32), TWL_HOBQPH_REG_ADDR(tw_dev));
++ writel((u32)tw_dev->sense_buffer_phys[i], TWL_HOBQPL_REG_ADDR(tw_dev));
++
++ /* Check status for over-run after each write */
++ status = readl(TWL_STATUS_REG_ADDR(tw_dev));
++ if (!(status & TWL_STATUS_OVERRUN_SUBMIT))
++ i++;
++ }
++
++ /* Now check status */
++ status = readl(TWL_STATUS_REG_ADDR(tw_dev));
++ if (status) {
++ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x13, "Bad controller status after loading sense buffers");
++ do_soft_reset = 1;
++ tries++;
++ continue;
++ }
++
++ /* Drain the AEN queue */
++ if (twl_aen_drain_queue(tw_dev, soft_reset)) {
++ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x14, "AEN drain failed during reset sequence");
++ do_soft_reset = 1;
++ tries++;
++ continue;
++ }
++
++ /* Load rest of compatibility struct */
++ strncpy(tw_dev->tw_compat_info.driver_version, TW_DRIVER_VERSION, strlen(TW_DRIVER_VERSION));
++ tw_dev->tw_compat_info.driver_srl_high = TW_CURRENT_DRIVER_SRL;
++ tw_dev->tw_compat_info.driver_branch_high = TW_CURRENT_DRIVER_BRANCH;
++ tw_dev->tw_compat_info.driver_build_high = TW_CURRENT_DRIVER_BUILD;
++ tw_dev->tw_compat_info.driver_srl_low = TW_BASE_FW_SRL;
++ tw_dev->tw_compat_info.driver_branch_low = TW_BASE_FW_BRANCH;
++ tw_dev->tw_compat_info.driver_build_low = TW_BASE_FW_BUILD;
++ tw_dev->tw_compat_info.fw_on_ctlr_srl = fw_on_ctlr_srl;
++ tw_dev->tw_compat_info.fw_on_ctlr_branch = fw_on_ctlr_branch;
++ tw_dev->tw_compat_info.fw_on_ctlr_build = fw_on_ctlr_build;
++
++ /* If we got here, controller is in a good state */
++ retval = 0;
++ goto out;
++ }
++out:
++ return retval;
++} /* End twl_reset_sequence() */
++
++/* This function will reset a device extension */
++static int twl_reset_device_extension(TW_Device_Extension *tw_dev, int ioctl_reset)
++{
++ int i = 0, retval = 1;
++ unsigned long flags = 0;
++
++ /* Block SCSI requests while we are resetting */
++ if (ioctl_reset)
++ scsi_block_requests(tw_dev->host);
++
++ set_bit(TW_IN_RESET, &tw_dev->flags);
++ TWL_MASK_INTERRUPTS(tw_dev);
++ TWL_CLEAR_DB_INTERRUPT(tw_dev);
++
++ spin_lock_irqsave(tw_dev->host->host_lock, flags);
++
++ /* Abort all requests that are in progress */
++ for (i = 0; i < TW_Q_LENGTH; i++) {
++ if ((tw_dev->state[i] != TW_S_FINISHED) &&
++ (tw_dev->state[i] != TW_S_INITIAL) &&
++ (tw_dev->state[i] != TW_S_COMPLETED)) {
++ if (tw_dev->srb[i]) {
++ tw_dev->srb[i]->result = (DID_RESET << 16);
++ tw_dev->srb[i]->scsi_done(tw_dev->srb[i]);
++ twl_unmap_scsi_data(tw_dev, i);
++ }
++ }
++ }
++
++ /* Reset queues and counts */
++ for (i = 0; i < TW_Q_LENGTH; i++) {
++ tw_dev->free_queue[i] = i;
++ tw_dev->state[i] = TW_S_INITIAL;
++ }
++ tw_dev->free_head = TW_Q_START;
++ tw_dev->free_tail = TW_Q_START;
++ tw_dev->posted_request_count = 0;
++
++ spin_unlock_irqrestore(tw_dev->host->host_lock, flags);
++
++ if (twl_reset_sequence(tw_dev, 1))
++ goto out;
++
++ TWL_UNMASK_INTERRUPTS(tw_dev);
++
++ clear_bit(TW_IN_RESET, &tw_dev->flags);
++ tw_dev->chrdev_request_id = TW_IOCTL_CHRDEV_FREE;
++
++ retval = 0;
++out:
++ if (ioctl_reset)
++ scsi_unblock_requests(tw_dev->host);
++ return retval;
++} /* End twl_reset_device_extension() */
++
++/* This funciton returns unit geometry in cylinders/heads/sectors */
++static int twl_scsi_biosparam(struct scsi_device *sdev, struct block_device *bdev, sector_t capacity, int geom[])
++{
++ int heads, sectors, cylinders;
++ TW_Device_Extension *tw_dev;
++
++ tw_dev = (TW_Device_Extension *)sdev->host->hostdata;
++
++ if (capacity >= 0x200000) {
++ heads = 255;
++ sectors = 63;
++ cylinders = sector_div(capacity, heads * sectors);
++ } else {
++ heads = 64;
++ sectors = 32;
++ cylinders = sector_div(capacity, heads * sectors);
++ }
++
++ geom[0] = heads;
++ geom[1] = sectors;
++ geom[2] = cylinders;
++
++ return 0;
++} /* End twl_scsi_biosparam() */
++
++/* This is the new scsi eh reset function */
++static int twl_scsi_eh_reset(struct scsi_cmnd *SCpnt)
++{
++ TW_Device_Extension *tw_dev = NULL;
++ int retval = FAILED;
++
++ tw_dev = (TW_Device_Extension *)SCpnt->device->host->hostdata;
++
++ tw_dev->num_resets++;
++
++ sdev_printk(KERN_WARNING, SCpnt->device,
++ "WARNING: (0x%02X:0x%04X): Command (0x%x) timed out, resetting card.\n",
++ TW_DRIVER, 0x2c, SCpnt->cmnd[0]);
++
++ /* Make sure we are not issuing an ioctl or resetting from ioctl */
++ mutex_lock(&tw_dev->ioctl_lock);
++
++ /* Now reset the card and some of the device extension data */
++ if (twl_reset_device_extension(tw_dev, 0)) {
++ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x15, "Controller reset failed during scsi host reset");
++ goto out;
++ }
++
++ retval = SUCCESS;
++out:
++ mutex_unlock(&tw_dev->ioctl_lock);
++ return retval;
++} /* End twl_scsi_eh_reset() */
++
++/* This is the main scsi queue function to handle scsi opcodes */
++static int twl_scsi_queue(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_cmnd *))
++{
++ int request_id, retval;
++ TW_Device_Extension *tw_dev = (TW_Device_Extension *)SCpnt->device->host->hostdata;
++
++ /* If we are resetting due to timed out ioctl, report as busy */
++ if (test_bit(TW_IN_RESET, &tw_dev->flags)) {
++ retval = SCSI_MLQUEUE_HOST_BUSY;
++ goto out;
++ }
++
++ /* Save done function into scsi_cmnd struct */
++ SCpnt->scsi_done = done;
++
++ /* Get a free request id */
++ twl_get_request_id(tw_dev, &request_id);
++
++ /* Save the scsi command for use by the ISR */
++ tw_dev->srb[request_id] = SCpnt;
++
++ /* Initialize phase to zero */
++ SCpnt->SCp.phase = TW_PHASE_INITIAL;
++
++ retval = twl_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL);
++ if (retval) {
++ tw_dev->state[request_id] = TW_S_COMPLETED;
++ twl_free_request_id(tw_dev, request_id);
++ SCpnt->result = (DID_ERROR << 16);
++ done(SCpnt);
++ retval = 0;
++ }
++out:
++ return retval;
++} /* End twl_scsi_queue() */
++
++/* This function tells the controller to shut down */
++static void __twl_shutdown(TW_Device_Extension *tw_dev)
++{
++ /* Disable interrupts */
++ TWL_MASK_INTERRUPTS(tw_dev);
++
++ /* Free up the IRQ */
++ free_irq(tw_dev->tw_pci_dev->irq, tw_dev);
++
++ printk(KERN_WARNING "3w-sas: Shutting down host %d.\n", tw_dev->host->host_no);
++
++ /* Tell the card we are shutting down */
++ if (twl_initconnection(tw_dev, 1, 0, 0, 0, 0, 0, NULL, NULL, NULL, NULL, NULL)) {
++ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x16, "Connection shutdown failed");
++ } else {
++ printk(KERN_WARNING "3w-sas: Shutdown complete.\n");
++ }
++
++ /* Clear doorbell interrupt just before exit */
++ TWL_CLEAR_DB_INTERRUPT(tw_dev);
++} /* End __twl_shutdown() */
++
++/* Wrapper for __twl_shutdown */
++static void twl_shutdown(struct pci_dev *pdev)
++{
++ struct Scsi_Host *host = pci_get_drvdata(pdev);
++ TW_Device_Extension *tw_dev;
++
++ if (!host)
++ return;
++
++ tw_dev = (TW_Device_Extension *)host->hostdata;
++
++ if (tw_dev->online)
++ __twl_shutdown(tw_dev);
++} /* End twl_shutdown() */
++
++/* This function configures unit settings when a unit is coming on-line */
++static int twl_slave_configure(struct scsi_device *sdev)
++{
++ /* Force 60 second timeout */
++ blk_queue_rq_timeout(sdev->request_queue, 60 * HZ);
++
++ return 0;
++} /* End twl_slave_configure() */
++
++/* scsi_host_template initializer */
++static struct scsi_host_template driver_template = {
++ .module = THIS_MODULE,
++ .name = "3w-sas",
++ .queuecommand = twl_scsi_queue,
++ .eh_host_reset_handler = twl_scsi_eh_reset,
++ .bios_param = twl_scsi_biosparam,
++ .change_queue_depth = twl_change_queue_depth,
++ .can_queue = TW_Q_LENGTH-2,
++ .slave_configure = twl_slave_configure,
++ .this_id = -1,
++ .sg_tablesize = TW_LIBERATOR_MAX_SGL_LENGTH,
++ .max_sectors = TW_MAX_SECTORS,
++ .cmd_per_lun = TW_MAX_CMDS_PER_LUN,
++ .use_clustering = ENABLE_CLUSTERING,
++ .shost_attrs = twl_host_attrs,
++ .emulated = 1
++};
++
++/* This function will probe and initialize a card */
++static int __devinit twl_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id)
++{
++ struct Scsi_Host *host = NULL;
++ TW_Device_Extension *tw_dev;
++ resource_size_t mem_addr, mem_len;
++ int retval = -ENODEV;
++ int *ptr_phycount, phycount=0;
++
++ retval = pci_enable_device(pdev);
++ if (retval) {
++ TW_PRINTK(host, TW_DRIVER, 0x17, "Failed to enable pci device");
++ goto out_disable_device;
++ }
++
++ pci_set_master(pdev);
++ pci_try_set_mwi(pdev);
++
++ if (pci_set_dma_mask(pdev, DMA_BIT_MASK(64))
++ || pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64)))
++ if (pci_set_dma_mask(pdev, DMA_BIT_MASK(32))
++ || pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32))) {
++ TW_PRINTK(host, TW_DRIVER, 0x18, "Failed to set dma mask");
++ retval = -ENODEV;
++ goto out_disable_device;
++ }
++
++ host = scsi_host_alloc(&driver_template, sizeof(TW_Device_Extension));
++ if (!host) {
++ TW_PRINTK(host, TW_DRIVER, 0x19, "Failed to allocate memory for device extension");
++ retval = -ENOMEM;
++ goto out_disable_device;
++ }
++ tw_dev = (TW_Device_Extension *)host->hostdata;
++
++ /* Save values to device extension */
++ tw_dev->host = host;
++ tw_dev->tw_pci_dev = pdev;
++
++ if (twl_initialize_device_extension(tw_dev)) {
++ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1a, "Failed to initialize device extension");
++ goto out_free_device_extension;
++ }
++
++ /* Request IO regions */
++ retval = pci_request_regions(pdev, "3w-sas");
++ if (retval) {
++ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1b, "Failed to get mem region");
++ goto out_free_device_extension;
++ }
++
++ /* Use region 1 */
++ mem_addr = pci_resource_start(pdev, 1);
++ mem_len = pci_resource_len(pdev, 1);
++
++ /* Save base address */
++ tw_dev->base_addr = ioremap(mem_addr, mem_len);
++
++ if (!tw_dev->base_addr) {
++ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1c, "Failed to ioremap");
++ goto out_release_mem_region;
++ }
++
++ /* Disable interrupts on the card */
++ TWL_MASK_INTERRUPTS(tw_dev);
++
++ /* Initialize the card */
++ if (twl_reset_sequence(tw_dev, 0)) {
++ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1d, "Controller reset failed during probe");
++ goto out_iounmap;
++ }
++
++ /* Set host specific parameters */
++ host->max_id = TW_MAX_UNITS;
++ host->max_cmd_len = TW_MAX_CDB_LEN;
++ host->max_lun = TW_MAX_LUNS;
++ host->max_channel = 0;
++
++ /* Register the card with the kernel SCSI layer */
++ retval = scsi_add_host(host, &pdev->dev);
++ if (retval) {
++ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1e, "scsi add host failed");
++ goto out_iounmap;
++ }
++
++ pci_set_drvdata(pdev, host);
++
++ printk(KERN_WARNING "3w-sas: scsi%d: Found an LSI 3ware %s Controller at 0x%llx, IRQ: %d.\n",
++ host->host_no,
++ (char *)twl_get_param(tw_dev, 1, TW_VERSION_TABLE,
++ TW_PARAM_MODEL, TW_PARAM_MODEL_LENGTH),
++ (u64)mem_addr, pdev->irq);
++
++ ptr_phycount = twl_get_param(tw_dev, 2, TW_PARAM_PHY_SUMMARY_TABLE,
++ TW_PARAM_PHYCOUNT, TW_PARAM_PHYCOUNT_LENGTH);
++ if (ptr_phycount)
++ phycount = le32_to_cpu(*(int *)ptr_phycount);
++
++ printk(KERN_WARNING "3w-sas: scsi%d: Firmware %s, BIOS %s, Phys: %d.\n",
++ host->host_no,
++ (char *)twl_get_param(tw_dev, 1, TW_VERSION_TABLE,
++ TW_PARAM_FWVER, TW_PARAM_FWVER_LENGTH),
++ (char *)twl_get_param(tw_dev, 2, TW_VERSION_TABLE,
++ TW_PARAM_BIOSVER, TW_PARAM_BIOSVER_LENGTH),
++ phycount);
++
++ /* Try to enable MSI */
++ if (use_msi && !pci_enable_msi(pdev))
++ set_bit(TW_USING_MSI, &tw_dev->flags);
++
++ /* Now setup the interrupt handler */
++ retval = request_irq(pdev->irq, twl_interrupt, IRQF_SHARED, "3w-sas", tw_dev);
++ if (retval) {
++ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1f, "Error requesting IRQ");
++ goto out_remove_host;
++ }
++
++ twl_device_extension_list[twl_device_extension_count] = tw_dev;
++ twl_device_extension_count++;
++
++ /* Re-enable interrupts on the card */
++ TWL_UNMASK_INTERRUPTS(tw_dev);
++
++ /* Finally, scan the host */
++ scsi_scan_host(host);
++
++ /* Add sysfs binary files */
++ if (sysfs_create_bin_file(&host->shost_dev.kobj, &twl_sysfs_aen_read_attr))
++ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x20, "Failed to create sysfs binary file: 3ware_aen_read");
++ if (sysfs_create_bin_file(&host->shost_dev.kobj, &twl_sysfs_compat_info_attr))
++ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x21, "Failed to create sysfs binary file: 3ware_compat_info");
++
++ if (twl_major == -1) {
++ if ((twl_major = register_chrdev (0, "twl", &twl_fops)) < 0)
++ TW_PRINTK(host, TW_DRIVER, 0x22, "Failed to register character device");
++ }
++ tw_dev->online = 1;
++ return 0;
++
++out_remove_host:
++ if (test_bit(TW_USING_MSI, &tw_dev->flags))
++ pci_disable_msi(pdev);
++ scsi_remove_host(host);
++out_iounmap:
++ iounmap(tw_dev->base_addr);
++out_release_mem_region:
++ pci_release_regions(pdev);
++out_free_device_extension:
++ twl_free_device_extension(tw_dev);
++ scsi_host_put(host);
++out_disable_device:
++ pci_disable_device(pdev);
++
++ return retval;
++} /* End twl_probe() */
++
++/* This function is called to remove a device */
++static void twl_remove(struct pci_dev *pdev)
++{
++ struct Scsi_Host *host = pci_get_drvdata(pdev);
++ TW_Device_Extension *tw_dev;
++
++ if (!host)
++ return;
++
++ tw_dev = (TW_Device_Extension *)host->hostdata;
++
++ if (!tw_dev->online)
++ return;
++
++ /* Remove sysfs binary files */
++ sysfs_remove_bin_file(&host->shost_dev.kobj, &twl_sysfs_aen_read_attr);
++ sysfs_remove_bin_file(&host->shost_dev.kobj, &twl_sysfs_compat_info_attr);
++
++ scsi_remove_host(tw_dev->host);
++
++ /* Unregister character device */
++ if (twl_major >= 0) {
++ unregister_chrdev(twl_major, "twl");
++ twl_major = -1;
++ }
++
++ /* Shutdown the card */
++ __twl_shutdown(tw_dev);
++
++ /* Disable MSI if enabled */
++ if (test_bit(TW_USING_MSI, &tw_dev->flags))
++ pci_disable_msi(pdev);
++
++ /* Free IO remapping */
++ iounmap(tw_dev->base_addr);
++
++ /* Free up the mem region */
++ pci_release_regions(pdev);
++
++ /* Free up device extension resources */
++ twl_free_device_extension(tw_dev);
++
++ scsi_host_put(tw_dev->host);
++ pci_disable_device(pdev);
++ twl_device_extension_count--;
++} /* End twl_remove() */
++
++#ifdef CONFIG_PM
++/* This function is called on PCI suspend */
++static int twl_suspend(struct pci_dev *pdev, pm_message_t state)
++{
++ struct Scsi_Host *host = pci_get_drvdata(pdev);
++ TW_Device_Extension *tw_dev = (TW_Device_Extension *)host->hostdata;
++
++ printk(KERN_WARNING "3w-sas: Suspending host %d.\n", tw_dev->host->host_no);
++ /* Disable interrupts */
++ TWL_MASK_INTERRUPTS(tw_dev);
++
++ free_irq(tw_dev->tw_pci_dev->irq, tw_dev);
++
++ /* Tell the card we are shutting down */
++ if (twl_initconnection(tw_dev, 1, 0, 0, 0, 0, 0, NULL, NULL, NULL, NULL, NULL)) {
++ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x23, "Connection shutdown failed during suspend");
++ } else {
++ printk(KERN_WARNING "3w-sas: Suspend complete.\n");
++ }
++
++ /* Clear doorbell interrupt */
++ TWL_CLEAR_DB_INTERRUPT(tw_dev);
++
++ pci_save_state(pdev);
++ pci_disable_device(pdev);
++ pci_set_power_state(pdev, pci_choose_state(pdev, state));
++
++ return 0;
++} /* End twl_suspend() */
++
++/* This function is called on PCI resume */
++static int twl_resume(struct pci_dev *pdev)
++{
++ int retval = 0;
++ struct Scsi_Host *host = pci_get_drvdata(pdev);
++ TW_Device_Extension *tw_dev = (TW_Device_Extension *)host->hostdata;
++
++ printk(KERN_WARNING "3w-sas: Resuming host %d.\n", tw_dev->host->host_no);
++ pci_set_power_state(pdev, PCI_D0);
++ pci_enable_wake(pdev, PCI_D0, 0);
++ pci_restore_state(pdev);
++
++ retval = pci_enable_device(pdev);
++ if (retval) {
++ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x24, "Enable device failed during resume");
++ return retval;
++ }
++
++ pci_set_master(pdev);
++ pci_try_set_mwi(pdev);
++
++ if (pci_set_dma_mask(pdev, DMA_BIT_MASK(64))
++ || pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64)))
++ if (pci_set_dma_mask(pdev, DMA_BIT_MASK(32))
++ || pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32))) {
++ TW_PRINTK(host, TW_DRIVER, 0x25, "Failed to set dma mask during resume");
++ retval = -ENODEV;
++ goto out_disable_device;
++ }
++
++ /* Initialize the card */
++ if (twl_reset_sequence(tw_dev, 0)) {
++ retval = -ENODEV;
++ goto out_disable_device;
++ }
++
++ /* Now setup the interrupt handler */
++ retval = request_irq(pdev->irq, twl_interrupt, IRQF_SHARED, "3w-sas", tw_dev);
++ if (retval) {
++ TW_PRINTK(tw_dev->host, TW_DRIVER, 0x26, "Error requesting IRQ during resume");
++ retval = -ENODEV;
++ goto out_disable_device;
++ }
++
++ /* Now enable MSI if enabled */
++ if (test_bit(TW_USING_MSI, &tw_dev->flags))
++ pci_enable_msi(pdev);
++
++ /* Re-enable interrupts on the card */
++ TWL_UNMASK_INTERRUPTS(tw_dev);
++
++ printk(KERN_WARNING "3w-sas: Resume complete.\n");
++ return 0;
++
++out_disable_device:
++ scsi_remove_host(host);
++ pci_disable_device(pdev);
++
++ return retval;
++} /* End twl_resume() */
++#endif
++
++/* PCI Devices supported by this driver */
++static struct pci_device_id twl_pci_tbl[] __devinitdata = {
++ { PCI_VENDOR_ID_3WARE, PCI_DEVICE_ID_3WARE_9750,
++ PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
++ { }
++};
++MODULE_DEVICE_TABLE(pci, twl_pci_tbl);
++
++/* pci_driver initializer */
++static struct pci_driver twl_driver = {
++ .name = "3w-sas",
++ .id_table = twl_pci_tbl,
++ .probe = twl_probe,
++ .remove = twl_remove,
++#ifdef CONFIG_PM
++ .suspend = twl_suspend,
++ .resume = twl_resume,
++#endif
++ .shutdown = twl_shutdown
++};
++
++/* This function is called on driver initialization */
++static int __init twl_init(void)
++{
++ printk(KERN_WARNING "LSI 3ware SAS/SATA-RAID Controller device driver for Linux v%s.\n", TW_DRIVER_VERSION);
++
++ return pci_register_driver(&twl_driver);
++} /* End twl_init() */
++
++/* This function is called on driver exit */
++static void __exit twl_exit(void)
++{
++ pci_unregister_driver(&twl_driver);
++} /* End twl_exit() */
++
++module_init(twl_init);
++module_exit(twl_exit);
++
+diff --git a/drivers/scsi/3w-sas.h b/drivers/scsi/3w-sas.h
+new file mode 100644
+index 0000000..e620505
+--- /dev/null
++++ b/drivers/scsi/3w-sas.h
+@@ -0,0 +1,396 @@
++/*
++ 3w-sas.h -- LSI 3ware SAS/SATA-RAID Controller device driver for Linux.
++
++ Written By: Adam Radford <linuxraid@lsi.com>
++
++ Copyright (C) 2009 LSI Corporation.
++
++ This program is free software; you can redistribute it and/or modify
++ it under the terms of the GNU General Public License as published by
++ the Free Software Foundation; version 2 of the License.
++
++ This program is distributed in the hope that it will be useful,
++ but WITHOUT ANY WARRANTY; without even the implied warranty of
++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
++ GNU General Public License for more details.
++
++ NO WARRANTY
++ THE PROGRAM IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OR
++ CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED INCLUDING, WITHOUT
++ LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE, NON-INFRINGEMENT,
++ MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each Recipient is
++ solely responsible for determining the appropriateness of using and
++ distributing the Program and assumes all risks associated with its
++ exercise of rights under this Agreement, including but not limited to
++ the risks and costs of program errors, damage to or loss of data,
++ programs or equipment, and unavailability or interruption of operations.
++
++ DISCLAIMER OF LIABILITY
++ NEITHER RECIPIENT NOR ANY CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY
++ DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
++ DAMAGES (INCLUDING WITHOUT LIMITATION LOST PROFITS), HOWEVER CAUSED AND
++ ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
++ TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
++ USE OR DISTRIBUTION OF THE PROGRAM OR THE EXERCISE OF ANY RIGHTS GRANTED
++ HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES
++
++ You should have received a copy of the GNU General Public License
++ along with this program; if not, write to the Free Software
++ Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
++
++ Bugs/Comments/Suggestions should be mailed to:
++ linuxraid@lsi.com
++
++ For more information, goto:
++ http://www.lsi.com
++*/
++
++#ifndef _3W_SAS_H
++#define _3W_SAS_H
++
++/* AEN severity table */
++static char *twl_aen_severity_table[] =
++{
++ "None", "ERROR", "WARNING", "INFO", "DEBUG", (char*) 0
++};
++
++/* Liberator register offsets */
++#define TWL_STATUS 0x0 /* Status */
++#define TWL_HIBDB 0x20 /* Inbound doorbell */
++#define TWL_HISTAT 0x30 /* Host interrupt status */
++#define TWL_HIMASK 0x34 /* Host interrupt mask */
++#define TWL_HOBDB 0x9C /* Outbound doorbell */
++#define TWL_HOBDBC 0xA0 /* Outbound doorbell clear */
++#define TWL_SCRPD3 0xBC /* Scratchpad */
++#define TWL_HIBQPL 0xC0 /* Host inbound Q low */
++#define TWL_HIBQPH 0xC4 /* Host inbound Q high */
++#define TWL_HOBQPL 0xC8 /* Host outbound Q low */
++#define TWL_HOBQPH 0xCC /* Host outbound Q high */
++#define TWL_HISTATUS_VALID_INTERRUPT 0xC
++#define TWL_HISTATUS_ATTENTION_INTERRUPT 0x4
++#define TWL_HISTATUS_RESPONSE_INTERRUPT 0x8
++#define TWL_STATUS_OVERRUN_SUBMIT 0x2000
++#define TWL_ISSUE_SOFT_RESET 0x100
++#define TWL_CONTROLLER_READY 0x2000
++#define TWL_DOORBELL_CONTROLLER_ERROR 0x200000
++#define TWL_DOORBELL_ATTENTION_INTERRUPT 0x40000
++#define TWL_PULL_MODE 0x1
++
++/* Command packet opcodes used by the driver */
++#define TW_OP_INIT_CONNECTION 0x1
++#define TW_OP_GET_PARAM 0x12
++#define TW_OP_SET_PARAM 0x13
++#define TW_OP_EXECUTE_SCSI 0x10
++
++/* Asynchronous Event Notification (AEN) codes used by the driver */
++#define TW_AEN_QUEUE_EMPTY 0x0000
++#define TW_AEN_SOFT_RESET 0x0001
++#define TW_AEN_SYNC_TIME_WITH_HOST 0x031
++#define TW_AEN_SEVERITY_ERROR 0x1
++#define TW_AEN_SEVERITY_DEBUG 0x4
++#define TW_AEN_NOT_RETRIEVED 0x1
++
++/* Command state defines */
++#define TW_S_INITIAL 0x1 /* Initial state */
++#define TW_S_STARTED 0x2 /* Id in use */
++#define TW_S_POSTED 0x4 /* Posted to the controller */
++#define TW_S_COMPLETED 0x8 /* Completed by isr */
++#define TW_S_FINISHED 0x10 /* I/O completely done */
++
++/* Compatibility defines */
++#define TW_9750_ARCH_ID 10
++#define TW_CURRENT_DRIVER_SRL 40
++#define TW_CURRENT_DRIVER_BUILD 0
++#define TW_CURRENT_DRIVER_BRANCH 0
++
++/* Phase defines */
++#define TW_PHASE_INITIAL 0
++#define TW_PHASE_SGLIST 2
++
++/* Misc defines */
++#define TW_SECTOR_SIZE 512
++#define TW_MAX_UNITS 32
++#define TW_INIT_MESSAGE_CREDITS 0x100
++#define TW_INIT_COMMAND_PACKET_SIZE 0x3
++#define TW_INIT_COMMAND_PACKET_SIZE_EXTENDED 0x6
++#define TW_EXTENDED_INIT_CONNECT 0x2
++#define TW_BASE_FW_SRL 24
++#define TW_BASE_FW_BRANCH 0
++#define TW_BASE_FW_BUILD 1
++#define TW_Q_LENGTH 256
++#define TW_Q_START 0
++#define TW_MAX_SLOT 32
++#define TW_MAX_RESET_TRIES 2
++#define TW_MAX_CMDS_PER_LUN 254
++#define TW_MAX_AEN_DRAIN 255
++#define TW_IN_RESET 2
++#define TW_USING_MSI 3
++#define TW_IN_ATTENTION_LOOP 4
++#define TW_MAX_SECTORS 256
++#define TW_MAX_CDB_LEN 16
++#define TW_IOCTL_CHRDEV_TIMEOUT 60 /* 60 seconds */
++#define TW_IOCTL_CHRDEV_FREE -1
++#define TW_COMMAND_OFFSET 128 /* 128 bytes */
++#define TW_VERSION_TABLE 0x0402
++#define TW_TIMEKEEP_TABLE 0x040A
++#define TW_INFORMATION_TABLE 0x0403
++#define TW_PARAM_FWVER 3
++#define TW_PARAM_FWVER_LENGTH 16
++#define TW_PARAM_BIOSVER 4
++#define TW_PARAM_BIOSVER_LENGTH 16
++#define TW_PARAM_MODEL 8
++#define TW_PARAM_MODEL_LENGTH 16
++#define TW_PARAM_PHY_SUMMARY_TABLE 1
++#define TW_PARAM_PHYCOUNT 2
++#define TW_PARAM_PHYCOUNT_LENGTH 1
++#define TW_IOCTL_FIRMWARE_PASS_THROUGH 0x108 // Used by smartmontools
++#define TW_ALLOCATION_LENGTH 128
++#define TW_SENSE_DATA_LENGTH 18
++#define TW_ERROR_LOGICAL_UNIT_NOT_SUPPORTED 0x10a
++#define TW_ERROR_INVALID_FIELD_IN_CDB 0x10d
++#define TW_ERROR_UNIT_OFFLINE 0x128
++#define TW_MESSAGE_SOURCE_CONTROLLER_ERROR 3
++#define TW_MESSAGE_SOURCE_CONTROLLER_EVENT 4
++#define TW_DRIVER 6
++#ifndef PCI_DEVICE_ID_3WARE_9750
++#define PCI_DEVICE_ID_3WARE_9750 0x1010
++#endif
++
++/* Bitmask macros to eliminate bitfields */
++
++/* opcode: 5, reserved: 3 */
++#define TW_OPRES_IN(x,y) ((x << 5) | (y & 0x1f))
++#define TW_OP_OUT(x) (x & 0x1f)
++
++/* opcode: 5, sgloffset: 3 */
++#define TW_OPSGL_IN(x,y) ((x << 5) | (y & 0x1f))
++#define TW_SGL_OUT(x) ((x >> 5) & 0x7)
++
++/* severity: 3, reserved: 5 */
++#define TW_SEV_OUT(x) (x & 0x7)
++
++/* not_mfa: 1, reserved: 7, status: 8, request_id: 16 */
++#define TW_RESID_OUT(x) ((x >> 16) & 0xffff)
++#define TW_NOTMFA_OUT(x) (x & 0x1)
++
++/* request_id: 12, lun: 4 */
++#define TW_REQ_LUN_IN(lun, request_id) (((lun << 12) & 0xf000) | (request_id & 0xfff))
++#define TW_LUN_OUT(lun) ((lun >> 12) & 0xf)
++
++/* Register access macros */
++#define TWL_STATUS_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_STATUS)
++#define TWL_HOBQPL_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HOBQPL)
++#define TWL_HOBQPH_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HOBQPH)
++#define TWL_HOBDB_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HOBDB)
++#define TWL_HOBDBC_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HOBDBC)
++#define TWL_HIMASK_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HIMASK)
++#define TWL_HISTAT_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HISTAT)
++#define TWL_HIBQPH_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HIBQPH)
++#define TWL_HIBQPL_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HIBQPL)
++#define TWL_HIBDB_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HIBDB)
++#define TWL_SCRPD3_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_SCRPD3)
++#define TWL_MASK_INTERRUPTS(x) (writel(~0, TWL_HIMASK_REG_ADDR(tw_dev)))
++#define TWL_UNMASK_INTERRUPTS(x) (writel(~TWL_HISTATUS_VALID_INTERRUPT, TWL_HIMASK_REG_ADDR(tw_dev)))
++#define TWL_CLEAR_DB_INTERRUPT(x) (writel(~0, TWL_HOBDBC_REG_ADDR(tw_dev)))
++#define TWL_SOFT_RESET(x) (writel(TWL_ISSUE_SOFT_RESET, TWL_HIBDB_REG_ADDR(tw_dev)))
++
++/* Macros */
++#define TW_PRINTK(h,a,b,c) { \
++if (h) \
++printk(KERN_WARNING "3w-sas: scsi%d: ERROR: (0x%02X:0x%04X): %s.\n",h->host_no,a,b,c); \
++else \
++printk(KERN_WARNING "3w-sas: ERROR: (0x%02X:0x%04X): %s.\n",a,b,c); \
++}
++#define TW_MAX_LUNS 16
++#define TW_COMMAND_SIZE (sizeof(dma_addr_t) > 4 ? 6 : 4)
++#define TW_LIBERATOR_MAX_SGL_LENGTH (sizeof(dma_addr_t) > 4 ? 46 : 92)
++#define TW_LIBERATOR_MAX_SGL_LENGTH_OLD (sizeof(dma_addr_t) > 4 ? 47 : 94)
++#define TW_PADDING_LENGTH_LIBERATOR 136
++#define TW_PADDING_LENGTH_LIBERATOR_OLD 132
++#define TW_CPU_TO_SGL(x) (sizeof(dma_addr_t) > 4 ? cpu_to_le64(x) : cpu_to_le32(x))
++
++#pragma pack(1)
++
++/* SGL entry */
++typedef struct TAG_TW_SG_Entry_ISO {
++ dma_addr_t address;
++ dma_addr_t length;
++} TW_SG_Entry_ISO;
++
++/* Old Command Packet with ISO SGL */
++typedef struct TW_Command {
++ unsigned char opcode__sgloffset;
++ unsigned char size;
++ unsigned char request_id;
++ unsigned char unit__hostid;
++ /* Second DWORD */
++ unsigned char status;
++ unsigned char flags;
++ union {
++ unsigned short block_count;
++ unsigned short parameter_count;
++ } byte6_offset;
++ union {
++ struct {
++ u32 lba;
++ TW_SG_Entry_ISO sgl[TW_LIBERATOR_MAX_SGL_LENGTH_OLD];
++ unsigned char padding[TW_PADDING_LENGTH_LIBERATOR_OLD];
++ } io;
++ struct {
++ TW_SG_Entry_ISO sgl[TW_LIBERATOR_MAX_SGL_LENGTH_OLD];
++ u32 padding;
++ unsigned char padding2[TW_PADDING_LENGTH_LIBERATOR_OLD];
++ } param;
++ } byte8_offset;
++} TW_Command;
++
++/* New Command Packet with ISO SGL */
++typedef struct TAG_TW_Command_Apache {
++ unsigned char opcode__reserved;
++ unsigned char unit;
++ unsigned short request_id__lunl;
++ unsigned char status;
++ unsigned char sgl_offset;
++ unsigned short sgl_entries__lunh;
++ unsigned char cdb[16];
++ TW_SG_Entry_ISO sg_list[TW_LIBERATOR_MAX_SGL_LENGTH];
++ unsigned char padding[TW_PADDING_LENGTH_LIBERATOR];
++} TW_Command_Apache;
++
++/* New command packet header */
++typedef struct TAG_TW_Command_Apache_Header {
++ unsigned char sense_data[TW_SENSE_DATA_LENGTH];
++ struct {
++ char reserved[4];
++ unsigned short error;
++ unsigned char padding;
++ unsigned char severity__reserved;
++ } status_block;
++ unsigned char err_specific_desc[98];
++ struct {
++ unsigned char size_header;
++ unsigned short request_id;
++ unsigned char size_sense;
++ } header_desc;
++} TW_Command_Apache_Header;
++
++/* This struct is a union of the 2 command packets */
++typedef struct TAG_TW_Command_Full {
++ TW_Command_Apache_Header header;
++ union {
++ TW_Command oldcommand;
++ TW_Command_Apache newcommand;
++ } command;
++} TW_Command_Full;
++
++/* Initconnection structure */
++typedef struct TAG_TW_Initconnect {
++ unsigned char opcode__reserved;
++ unsigned char size;
++ unsigned char request_id;
++ unsigned char res2;
++ unsigned char status;
++ unsigned char flags;
++ unsigned short message_credits;
++ u32 features;
++ unsigned short fw_srl;
++ unsigned short fw_arch_id;
++ unsigned short fw_branch;
++ unsigned short fw_build;
++ u32 result;
++} TW_Initconnect;
++
++/* Event info structure */
++typedef struct TAG_TW_Event
++{
++ unsigned int sequence_id;
++ unsigned int time_stamp_sec;
++ unsigned short aen_code;
++ unsigned char severity;
++ unsigned char retrieved;
++ unsigned char repeat_count;
++ unsigned char parameter_len;
++ unsigned char parameter_data[98];
++} TW_Event;
++
++typedef struct TAG_TW_Ioctl_Driver_Command {
++ unsigned int control_code;
++ unsigned int status;
++ unsigned int unique_id;
++ unsigned int sequence_id;
++ unsigned int os_specific;
++ unsigned int buffer_length;
++} TW_Ioctl_Driver_Command;
++
++typedef struct TAG_TW_Ioctl_Apache {
++ TW_Ioctl_Driver_Command driver_command;
++ char padding[488];
++ TW_Command_Full firmware_command;
++ char data_buffer[1];
++} TW_Ioctl_Buf_Apache;
++
++/* GetParam descriptor */
++typedef struct {
++ unsigned short table_id;
++ unsigned short parameter_id;
++ unsigned short parameter_size_bytes;
++ unsigned short actual_parameter_size_bytes;
++ unsigned char data[1];
++} TW_Param_Apache;
++
++/* Compatibility information structure */
++typedef struct TAG_TW_Compatibility_Info
++{
++ char driver_version[32];
++ unsigned short working_srl;
++ unsigned short working_branch;
++ unsigned short working_build;
++ unsigned short driver_srl_high;
++ unsigned short driver_branch_high;
++ unsigned short driver_build_high;
++ unsigned short driver_srl_low;
++ unsigned short driver_branch_low;
++ unsigned short driver_build_low;
++ unsigned short fw_on_ctlr_srl;
++ unsigned short fw_on_ctlr_branch;
++ unsigned short fw_on_ctlr_build;
++} TW_Compatibility_Info;
++
++#pragma pack()
++
++typedef struct TAG_TW_Device_Extension {
++ void __iomem *base_addr;
++ unsigned long *generic_buffer_virt[TW_Q_LENGTH];
++ dma_addr_t generic_buffer_phys[TW_Q_LENGTH];
++ TW_Command_Full *command_packet_virt[TW_Q_LENGTH];
++ dma_addr_t command_packet_phys[TW_Q_LENGTH];
++ TW_Command_Apache_Header *sense_buffer_virt[TW_Q_LENGTH];
++ dma_addr_t sense_buffer_phys[TW_Q_LENGTH];
++ struct pci_dev *tw_pci_dev;
++ struct scsi_cmnd *srb[TW_Q_LENGTH];
++ unsigned char free_queue[TW_Q_LENGTH];
++ unsigned char free_head;
++ unsigned char free_tail;
++ int state[TW_Q_LENGTH];
++ unsigned int posted_request_count;
++ unsigned int max_posted_request_count;
++ unsigned int max_sgl_entries;
++ unsigned int sgl_entries;
++ unsigned int num_resets;
++ unsigned int sector_count;
++ unsigned int max_sector_count;
++ unsigned int aen_count;
++ struct Scsi_Host *host;
++ long flags;
++ TW_Event *event_queue[TW_Q_LENGTH];
++ unsigned char error_index;
++ unsigned int error_sequence_id;
++ int chrdev_request_id;
++ wait_queue_head_t ioctl_wqueue;
++ struct mutex ioctl_lock;
++ TW_Compatibility_Info tw_compat_info;
++ char online;
++} TW_Device_Extension;
++
++#endif /* _3W_SAS_H */
++
+diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c
+index 1ddcf40..a85f062 100644
+--- a/drivers/scsi/BusLogic.c
++++ b/drivers/scsi/BusLogic.c
+@@ -961,6 +961,8 @@ static int __init BusLogic_InitializeFlashPointProbeInfo(struct BusLogic_HostAda
+ static void __init BusLogic_InitializeProbeInfoList(struct BusLogic_HostAdapter
+ *PrototypeHostAdapter)
+ {
++ pax_track_stack();
++
+ /*
+ If a PCI BIOS is present, interrogate it for MultiMaster and FlashPoint
+ Host Adapters; otherwise, default to the standard ISA MultiMaster probe.
+diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
+index e11cca4..4295679 100644
+--- a/drivers/scsi/Kconfig
++++ b/drivers/scsi/Kconfig
+@@ -399,6 +399,17 @@ config SCSI_3W_9XXX
+ Please read the comments at the top of
+ <file:drivers/scsi/3w-9xxx.c>.
+
++config SCSI_3W_SAS
++ tristate "3ware 97xx SAS/SATA-RAID support"
++ depends on PCI && SCSI
++ help
++ This driver supports the LSI 3ware 9750 6Gb/s SAS/SATA-RAID cards.
++
++ <http://www.lsi.com>
++
++ Please read the comments at the top of
++ <file:drivers/scsi/3w-sas.c>.
++
+ config SCSI_7000FASST
+ tristate "7000FASST SCSI support"
+ depends on ISA && SCSI && ISA_DMA_API
+@@ -621,6 +632,14 @@ config SCSI_FLASHPOINT
+ substantial, so users of MultiMaster Host Adapters may not
+ wish to include it.
+
++config VMWARE_PVSCSI
++ tristate "VMware PVSCSI driver support"
++ depends on PCI && SCSI && X86
++ help
++ This driver supports VMware's para virtualized SCSI HBA.
++ To compile this driver as a module, choose M here: the
++ module will be called vmw_pvscsi.
++
+ config LIBFC
+ tristate "LibFC module"
+ select SCSI_FC_ATTRS
+diff --git a/drivers/scsi/Makefile b/drivers/scsi/Makefile
+index 3ad61db..c938975 100644
+--- a/drivers/scsi/Makefile
++++ b/drivers/scsi/Makefile
+@@ -113,6 +113,7 @@ obj-$(CONFIG_SCSI_MESH) += mesh.o
+ obj-$(CONFIG_SCSI_MAC53C94) += mac53c94.o
+ obj-$(CONFIG_BLK_DEV_3W_XXXX_RAID) += 3w-xxxx.o
+ obj-$(CONFIG_SCSI_3W_9XXX) += 3w-9xxx.o
++obj-$(CONFIG_SCSI_3W_SAS) += 3w-sas.o
+ obj-$(CONFIG_SCSI_PPA) += ppa.o
+ obj-$(CONFIG_SCSI_IMM) += imm.o
+ obj-$(CONFIG_JAZZ_ESP) += esp_scsi.o jazz_esp.o
+@@ -133,6 +134,7 @@ obj-$(CONFIG_SCSI_CXGB3_ISCSI) += libiscsi.o libiscsi_tcp.o cxgb3i/
+ obj-$(CONFIG_SCSI_BNX2_ISCSI) += libiscsi.o bnx2i/
+ obj-$(CONFIG_BE2ISCSI) += libiscsi.o be2iscsi/
+ obj-$(CONFIG_SCSI_PMCRAID) += pmcraid.o
++obj-$(CONFIG_VMWARE_PVSCSI) += vmw_pvscsi.o
+
+ obj-$(CONFIG_ARM) += arm/
+
+diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h
+index cdbdec9..b7d560b 100644
+--- a/drivers/scsi/aacraid/aacraid.h
++++ b/drivers/scsi/aacraid/aacraid.h
+@@ -471,7 +471,7 @@ struct adapter_ops
+ int (*adapter_scsi)(struct fib * fib, struct scsi_cmnd * cmd);
+ /* Administrative operations */
+ int (*adapter_comm)(struct aac_dev * dev, int comm);
+-};
++} __no_const;
+
+ /*
+ * Define which interrupt handler needs to be installed
+diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c
+index a5b8e7b..a6a0e43 100644
+--- a/drivers/scsi/aacraid/commctrl.c
++++ b/drivers/scsi/aacraid/commctrl.c
+@@ -481,6 +481,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
+ u32 actual_fibsize64, actual_fibsize = 0;
+ int i;
+
++ pax_track_stack();
+
+ if (dev->in_reset) {
+ dprintk((KERN_DEBUG"aacraid: send raw srb -EBUSY\n"));
+diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
+index 9b97c3e..f099725 100644
+--- a/drivers/scsi/aacraid/linit.c
++++ b/drivers/scsi/aacraid/linit.c
+@@ -91,7 +91,7 @@ static DECLARE_PCI_DEVICE_TABLE(aac_pci_tbl) = {
+ #elif defined(__devinitconst)
+ static const struct pci_device_id aac_pci_tbl[] __devinitconst = {
+ #else
+-static const struct pci_device_id aac_pci_tbl[] __devinitdata = {
++static const struct pci_device_id aac_pci_tbl[] __devinitconst = {
+ #endif
+ { 0x1028, 0x0001, 0x1028, 0x0001, 0, 0, 0 }, /* PERC 2/Si (Iguana/PERC2Si) */
+ { 0x1028, 0x0002, 0x1028, 0x0002, 0, 0, 1 }, /* PERC 3/Di (Opal/PERC3Di) */
+diff --git a/drivers/scsi/aic94xx/aic94xx_init.c b/drivers/scsi/aic94xx/aic94xx_init.c
+index 996f722..9127845 100644
+--- a/drivers/scsi/aic94xx/aic94xx_init.c
++++ b/drivers/scsi/aic94xx/aic94xx_init.c
+@@ -485,7 +485,7 @@ static ssize_t asd_show_update_bios(struct device *dev,
+ flash_error_table[i].reason);
+ }
+
+-static DEVICE_ATTR(update_bios, S_IRUGO|S_IWUGO,
++static DEVICE_ATTR(update_bios, S_IRUGO|S_IWUSR,
+ asd_show_update_bios, asd_store_update_bios);
+
+ static int asd_create_dev_attrs(struct asd_ha_struct *asd_ha)
+@@ -1011,7 +1011,7 @@ static struct sas_domain_function_template aic94xx_transport_functions = {
+ .lldd_control_phy = asd_control_phy,
+ };
+
+-static const struct pci_device_id aic94xx_pci_table[] __devinitdata = {
++static const struct pci_device_id aic94xx_pci_table[] __devinitconst = {
+ {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, 0x410),0, 0, 1},
+ {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, 0x412),0, 0, 1},
+ {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, 0x416),0, 0, 1},
+diff --git a/drivers/scsi/bfa/bfa_ioc.h b/drivers/scsi/bfa/bfa_ioc.h
+index 58efd4b..cb48dc7 100644
+--- a/drivers/scsi/bfa/bfa_ioc.h
++++ b/drivers/scsi/bfa/bfa_ioc.h
+@@ -127,7 +127,7 @@ struct bfa_ioc_cbfn_s {
+ bfa_ioc_disable_cbfn_t disable_cbfn;
+ bfa_ioc_hbfail_cbfn_t hbfail_cbfn;
+ bfa_ioc_reset_cbfn_t reset_cbfn;
+-};
++} __no_const;
+
+ /**
+ * Heartbeat failure notification queue element.
+diff --git a/drivers/scsi/bfa/bfa_iocfc.h b/drivers/scsi/bfa/bfa_iocfc.h
+index 7ad177e..5503586 100644
+--- a/drivers/scsi/bfa/bfa_iocfc.h
++++ b/drivers/scsi/bfa/bfa_iocfc.h
+@@ -61,7 +61,7 @@ struct bfa_hwif_s {
+ void (*hw_isr_mode_set)(struct bfa_s *bfa, bfa_boolean_t msix);
+ void (*hw_msix_getvecs)(struct bfa_s *bfa, u32 *vecmap,
+ u32 *nvecs, u32 *maxvec);
+-};
++} __no_const;
+ typedef void (*bfa_cb_iocfc_t) (void *cbarg, enum bfa_status status);
+
+ struct bfa_iocfc_s {
+diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c
+index 4967643..cbec06b 100644
+--- a/drivers/scsi/dpt_i2o.c
++++ b/drivers/scsi/dpt_i2o.c
+@@ -1804,6 +1804,8 @@ static int adpt_i2o_passthru(adpt_hba* pHba, u32 __user *arg)
+ dma_addr_t addr;
+ ulong flags = 0;
+
++ pax_track_stack();
++
+ memset(&msg, 0, MAX_MESSAGE_SIZE*4);
+ // get user msg size in u32s
+ if(get_user(size, &user_msg[0])){
+@@ -2297,6 +2299,8 @@ static s32 adpt_scsi_to_i2o(adpt_hba* pHba, struct scsi_cmnd* cmd, struct adpt_d
+ s32 rcode;
+ dma_addr_t addr;
+
++ pax_track_stack();
++
+ memset(msg, 0 , sizeof(msg));
+ len = scsi_bufflen(cmd);
+ direction = 0x00000000;
+diff --git a/drivers/scsi/eata.c b/drivers/scsi/eata.c
+index c7076ce..e20c67c 100644
+--- a/drivers/scsi/eata.c
++++ b/drivers/scsi/eata.c
+@@ -1087,6 +1087,8 @@ static int port_detect(unsigned long port_base, unsigned int j,
+ struct hostdata *ha;
+ char name[16];
+
++ pax_track_stack();
++
+ sprintf(name, "%s%d", driver_name, j);
+
+ if (!request_region(port_base, REGION_SIZE, driver_name)) {
+diff --git a/drivers/scsi/fcoe/libfcoe.c b/drivers/scsi/fcoe/libfcoe.c
+index 11ae5c9..891daec 100644
+--- a/drivers/scsi/fcoe/libfcoe.c
++++ b/drivers/scsi/fcoe/libfcoe.c
+@@ -809,6 +809,8 @@ static void fcoe_ctlr_recv_els(struct fcoe_ctlr *fip, struct sk_buff *skb)
+ size_t rlen;
+ size_t dlen;
+
++ pax_track_stack();
++
+ fiph = (struct fip_header *)skb->data;
+ sub = fiph->fip_subcode;
+ if (sub != FIP_SC_REQ && sub != FIP_SC_REP)
+diff --git a/drivers/scsi/fnic/fnic_main.c b/drivers/scsi/fnic/fnic_main.c
+index 71c7bbe..e93088a 100644
+--- a/drivers/scsi/fnic/fnic_main.c
++++ b/drivers/scsi/fnic/fnic_main.c
+@@ -669,7 +669,7 @@ static int __devinit fnic_probe(struct pci_dev *pdev,
+ /* Start local port initiatialization */
+
+ lp->link_up = 0;
+- lp->tt = fnic_transport_template;
++ memcpy((void *)&lp->tt, &fnic_transport_template, sizeof(fnic_transport_template));
+
+ lp->max_retry_count = fnic->config.flogi_retries;
+ lp->max_rport_retry_count = fnic->config.plogi_retries;
+diff --git a/drivers/scsi/gdth.c b/drivers/scsi/gdth.c
+index bb96d74..9ec3ce4 100644
+--- a/drivers/scsi/gdth.c
++++ b/drivers/scsi/gdth.c
+@@ -4102,6 +4102,8 @@ static int ioc_lockdrv(void __user *arg)
+ ulong flags;
+ gdth_ha_str *ha;
+
++ pax_track_stack();
++
+ if (copy_from_user(&ldrv, arg, sizeof(gdth_ioctl_lockdrv)))
+ return -EFAULT;
+ ha = gdth_find_ha(ldrv.ionode);
+@@ -4134,6 +4136,8 @@ static int ioc_resetdrv(void __user *arg, char *cmnd)
+ gdth_ha_str *ha;
+ int rval;
+
++ pax_track_stack();
++
+ if (copy_from_user(&res, arg, sizeof(gdth_ioctl_reset)) ||
+ res.number >= MAX_HDRIVES)
+ return -EFAULT;
+@@ -4169,6 +4173,8 @@ static int ioc_general(void __user *arg, char *cmnd)
+ gdth_ha_str *ha;
+ int rval;
+
++ pax_track_stack();
++
+ if (copy_from_user(&gen, arg, sizeof(gdth_ioctl_general)))
+ return -EFAULT;
+ ha = gdth_find_ha(gen.ionode);
+@@ -4625,6 +4631,9 @@ static void gdth_flush(gdth_ha_str *ha)
+ int i;
+ gdth_cmd_str gdtcmd;
+ char cmnd[MAX_COMMAND_SIZE];
++
++ pax_track_stack();
++
+ memset(cmnd, 0xff, MAX_COMMAND_SIZE);
+
+ TRACE2(("gdth_flush() hanum %d\n", ha->hanum));
+diff --git a/drivers/scsi/gdth_proc.c b/drivers/scsi/gdth_proc.c
+index 1258da3..20d8ae6 100644
+--- a/drivers/scsi/gdth_proc.c
++++ b/drivers/scsi/gdth_proc.c
+@@ -46,6 +46,9 @@ static int gdth_set_asc_info(struct Scsi_Host *host, char *buffer,
+ ulong64 paddr;
+
+ char cmnd[MAX_COMMAND_SIZE];
++
++ pax_track_stack();
++
+ memset(cmnd, 0xff, 12);
+ memset(&gdtcmd, 0, sizeof(gdth_cmd_str));
+
+@@ -174,6 +177,8 @@ static int gdth_get_info(char *buffer,char **start,off_t offset,int length,
+ gdth_hget_str *phg;
+ char cmnd[MAX_COMMAND_SIZE];
+
++ pax_track_stack();
++
+ gdtcmd = kmalloc(sizeof(*gdtcmd), GFP_KERNEL);
+ estr = kmalloc(sizeof(*estr), GFP_KERNEL);
+ if (!gdtcmd || !estr)
+diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
+index d03a926..f324286 100644
+--- a/drivers/scsi/hosts.c
++++ b/drivers/scsi/hosts.c
+@@ -40,7 +40,7 @@
+ #include "scsi_logging.h"
+
+
+-static atomic_t scsi_host_next_hn; /* host_no for next new host */
++static atomic_unchecked_t scsi_host_next_hn; /* host_no for next new host */
+
+
+ static void scsi_host_cls_release(struct device *dev)
+@@ -347,7 +347,7 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize)
+ * subtract one because we increment first then return, but we need to
+ * know what the next host number was before increment
+ */
+- shost->host_no = atomic_inc_return(&scsi_host_next_hn) - 1;
++ shost->host_no = atomic_inc_return_unchecked(&scsi_host_next_hn) - 1;
+ shost->dma_channel = 0xff;
+
+ /* These three are default values which can be overridden */
+diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
+index a601159..55e19d2 100644
+--- a/drivers/scsi/ipr.c
++++ b/drivers/scsi/ipr.c
+@@ -5286,7 +5286,7 @@ static bool ipr_qc_fill_rtf(struct ata_queued_cmd *qc)
+ return true;
+ }
+
+-static struct ata_port_operations ipr_sata_ops = {
++static const struct ata_port_operations ipr_sata_ops = {
+ .phy_reset = ipr_ata_phy_reset,
+ .hardreset = ipr_sata_reset,
+ .post_internal_cmd = ipr_ata_post_internal,
+diff --git a/drivers/scsi/ips.h b/drivers/scsi/ips.h
+index 4e49fbc..97907ff 100644
+--- a/drivers/scsi/ips.h
++++ b/drivers/scsi/ips.h
+@@ -1027,7 +1027,7 @@ typedef struct {
+ int (*intr)(struct ips_ha *);
+ void (*enableint)(struct ips_ha *);
+ uint32_t (*statupd)(struct ips_ha *);
+-} ips_hw_func_t;
++} __no_const ips_hw_func_t;
+
+ typedef struct ips_ha {
+ uint8_t ha_id[IPS_MAX_CHANNELS+1];
+diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c
+index c1c1574..a9c9348 100644
+--- a/drivers/scsi/libfc/fc_exch.c
++++ b/drivers/scsi/libfc/fc_exch.c
+@@ -86,12 +86,12 @@ struct fc_exch_mgr {
+ * all together if not used XXX
+ */
+ struct {
+- atomic_t no_free_exch;
+- atomic_t no_free_exch_xid;
+- atomic_t xid_not_found;
+- atomic_t xid_busy;
+- atomic_t seq_not_found;
+- atomic_t non_bls_resp;
++ atomic_unchecked_t no_free_exch;
++ atomic_unchecked_t no_free_exch_xid;
++ atomic_unchecked_t xid_not_found;
++ atomic_unchecked_t xid_busy;
++ atomic_unchecked_t seq_not_found;
++ atomic_unchecked_t non_bls_resp;
+ } stats;
+ };
+ #define fc_seq_exch(sp) container_of(sp, struct fc_exch, seq)
+@@ -510,7 +510,7 @@ static struct fc_exch *fc_exch_em_alloc(struct fc_lport *lport,
+ /* allocate memory for exchange */
+ ep = mempool_alloc(mp->ep_pool, GFP_ATOMIC);
+ if (!ep) {
+- atomic_inc(&mp->stats.no_free_exch);
++ atomic_inc_unchecked(&mp->stats.no_free_exch);
+ goto out;
+ }
+ memset(ep, 0, sizeof(*ep));
+@@ -557,7 +557,7 @@ out:
+ return ep;
+ err:
+ spin_unlock_bh(&pool->lock);
+- atomic_inc(&mp->stats.no_free_exch_xid);
++ atomic_inc_unchecked(&mp->stats.no_free_exch_xid);
+ mempool_free(ep, mp->ep_pool);
+ return NULL;
+ }
+@@ -690,7 +690,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
+ xid = ntohs(fh->fh_ox_id); /* we originated exch */
+ ep = fc_exch_find(mp, xid);
+ if (!ep) {
+- atomic_inc(&mp->stats.xid_not_found);
++ atomic_inc_unchecked(&mp->stats.xid_not_found);
+ reject = FC_RJT_OX_ID;
+ goto out;
+ }
+@@ -720,7 +720,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
+ ep = fc_exch_find(mp, xid);
+ if ((f_ctl & FC_FC_FIRST_SEQ) && fc_sof_is_init(fr_sof(fp))) {
+ if (ep) {
+- atomic_inc(&mp->stats.xid_busy);
++ atomic_inc_unchecked(&mp->stats.xid_busy);
+ reject = FC_RJT_RX_ID;
+ goto rel;
+ }
+@@ -731,7 +731,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
+ }
+ xid = ep->xid; /* get our XID */
+ } else if (!ep) {
+- atomic_inc(&mp->stats.xid_not_found);
++ atomic_inc_unchecked(&mp->stats.xid_not_found);
+ reject = FC_RJT_RX_ID; /* XID not found */
+ goto out;
+ }
+@@ -752,7 +752,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
+ } else {
+ sp = &ep->seq;
+ if (sp->id != fh->fh_seq_id) {
+- atomic_inc(&mp->stats.seq_not_found);
++ atomic_inc_unchecked(&mp->stats.seq_not_found);
+ reject = FC_RJT_SEQ_ID; /* sequence/exch should exist */
+ goto rel;
+ }
+@@ -1163,22 +1163,22 @@ static void fc_exch_recv_seq_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
+
+ ep = fc_exch_find(mp, ntohs(fh->fh_ox_id));
+ if (!ep) {
+- atomic_inc(&mp->stats.xid_not_found);
++ atomic_inc_unchecked(&mp->stats.xid_not_found);
+ goto out;
+ }
+ if (ep->esb_stat & ESB_ST_COMPLETE) {
+- atomic_inc(&mp->stats.xid_not_found);
++ atomic_inc_unchecked(&mp->stats.xid_not_found);
+ goto out;
+ }
+ if (ep->rxid == FC_XID_UNKNOWN)
+ ep->rxid = ntohs(fh->fh_rx_id);
+ if (ep->sid != 0 && ep->sid != ntoh24(fh->fh_d_id)) {
+- atomic_inc(&mp->stats.xid_not_found);
++ atomic_inc_unchecked(&mp->stats.xid_not_found);
+ goto rel;
+ }
+ if (ep->did != ntoh24(fh->fh_s_id) &&
+ ep->did != FC_FID_FLOGI) {
+- atomic_inc(&mp->stats.xid_not_found);
++ atomic_inc_unchecked(&mp->stats.xid_not_found);
+ goto rel;
+ }
+ sof = fr_sof(fp);
+@@ -1189,7 +1189,7 @@ static void fc_exch_recv_seq_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
+ } else {
+ sp = &ep->seq;
+ if (sp->id != fh->fh_seq_id) {
+- atomic_inc(&mp->stats.seq_not_found);
++ atomic_inc_unchecked(&mp->stats.seq_not_found);
+ goto rel;
+ }
+ }
+@@ -1249,9 +1249,9 @@ static void fc_exch_recv_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
+ sp = fc_seq_lookup_orig(mp, fp); /* doesn't hold sequence */
+
+ if (!sp)
+- atomic_inc(&mp->stats.xid_not_found);
++ atomic_inc_unchecked(&mp->stats.xid_not_found);
+ else
+- atomic_inc(&mp->stats.non_bls_resp);
++ atomic_inc_unchecked(&mp->stats.non_bls_resp);
+
+ fc_frame_free(fp);
+ }
+diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
+index 0ee989f..a582241 100644
+--- a/drivers/scsi/libsas/sas_ata.c
++++ b/drivers/scsi/libsas/sas_ata.c
+@@ -343,7 +343,7 @@ static int sas_ata_scr_read(struct ata_link *link, unsigned int sc_reg_in,
+ }
+ }
+
+-static struct ata_port_operations sas_sata_ops = {
++static const struct ata_port_operations sas_sata_ops = {
+ .phy_reset = sas_ata_phy_reset,
+ .post_internal_cmd = sas_ata_post_internal,
+ .qc_defer = ata_std_qc_defer,
+diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
+index aa10f79..5cc79e4 100644
+--- a/drivers/scsi/lpfc/lpfc.h
++++ b/drivers/scsi/lpfc/lpfc.h
+@@ -400,7 +400,7 @@ struct lpfc_vport {
+ struct dentry *debug_nodelist;
+ struct dentry *vport_debugfs_root;
+ struct lpfc_debugfs_trc *disc_trc;
+- atomic_t disc_trc_cnt;
++ atomic_unchecked_t disc_trc_cnt;
+ #endif
+ uint8_t stat_data_enabled;
+ uint8_t stat_data_blocked;
+@@ -725,8 +725,8 @@ struct lpfc_hba {
+ struct timer_list fabric_block_timer;
+ unsigned long bit_flags;
+ #define FABRIC_COMANDS_BLOCKED 0
+- atomic_t num_rsrc_err;
+- atomic_t num_cmd_success;
++ atomic_unchecked_t num_rsrc_err;
++ atomic_unchecked_t num_cmd_success;
+ unsigned long last_rsrc_error_time;
+ unsigned long last_ramp_down_time;
+ unsigned long last_ramp_up_time;
+@@ -740,7 +740,7 @@ struct lpfc_hba {
+ struct dentry *debug_dumpDif; /* BlockGuard BPL*/
+ struct dentry *debug_slow_ring_trc;
+ struct lpfc_debugfs_trc *slow_ring_trc;
+- atomic_t slow_ring_trc_cnt;
++ atomic_unchecked_t slow_ring_trc_cnt;
+ #endif
+
+ /* Used for deferred freeing of ELS data buffers */
+diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
+index 8d0f0de..7c77a62 100644
+--- a/drivers/scsi/lpfc/lpfc_debugfs.c
++++ b/drivers/scsi/lpfc/lpfc_debugfs.c
+@@ -124,7 +124,7 @@ struct lpfc_debug {
+ int len;
+ };
+
+-static atomic_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
++static atomic_unchecked_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
+ static unsigned long lpfc_debugfs_start_time = 0L;
+
+ /**
+@@ -158,7 +158,7 @@ lpfc_debugfs_disc_trc_data(struct lpfc_vport *vport, char *buf, int size)
+ lpfc_debugfs_enable = 0;
+
+ len = 0;
+- index = (atomic_read(&vport->disc_trc_cnt) + 1) &
++ index = (atomic_read_unchecked(&vport->disc_trc_cnt) + 1) &
+ (lpfc_debugfs_max_disc_trc - 1);
+ for (i = index; i < lpfc_debugfs_max_disc_trc; i++) {
+ dtp = vport->disc_trc + i;
+@@ -219,7 +219,7 @@ lpfc_debugfs_slow_ring_trc_data(struct lpfc_hba *phba, char *buf, int size)
+ lpfc_debugfs_enable = 0;
+
+ len = 0;
+- index = (atomic_read(&phba->slow_ring_trc_cnt) + 1) &
++ index = (atomic_read_unchecked(&phba->slow_ring_trc_cnt) + 1) &
+ (lpfc_debugfs_max_slow_ring_trc - 1);
+ for (i = index; i < lpfc_debugfs_max_slow_ring_trc; i++) {
+ dtp = phba->slow_ring_trc + i;
+@@ -397,6 +397,8 @@ lpfc_debugfs_dumpHBASlim_data(struct lpfc_hba *phba, char *buf, int size)
+ uint32_t *ptr;
+ char buffer[1024];
+
++ pax_track_stack();
++
+ off = 0;
+ spin_lock_irq(&phba->hbalock);
+
+@@ -634,14 +636,14 @@ lpfc_debugfs_disc_trc(struct lpfc_vport *vport, int mask, char *fmt,
+ !vport || !vport->disc_trc)
+ return;
+
+- index = atomic_inc_return(&vport->disc_trc_cnt) &
++ index = atomic_inc_return_unchecked(&vport->disc_trc_cnt) &
+ (lpfc_debugfs_max_disc_trc - 1);
+ dtp = vport->disc_trc + index;
+ dtp->fmt = fmt;
+ dtp->data1 = data1;
+ dtp->data2 = data2;
+ dtp->data3 = data3;
+- dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
++ dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
+ dtp->jif = jiffies;
+ #endif
+ return;
+@@ -672,14 +674,14 @@ lpfc_debugfs_slow_ring_trc(struct lpfc_hba *phba, char *fmt,
+ !phba || !phba->slow_ring_trc)
+ return;
+
+- index = atomic_inc_return(&phba->slow_ring_trc_cnt) &
++ index = atomic_inc_return_unchecked(&phba->slow_ring_trc_cnt) &
+ (lpfc_debugfs_max_slow_ring_trc - 1);
+ dtp = phba->slow_ring_trc + index;
+ dtp->fmt = fmt;
+ dtp->data1 = data1;
+ dtp->data2 = data2;
+ dtp->data3 = data3;
+- dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
++ dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
+ dtp->jif = jiffies;
+ #endif
+ return;
+@@ -1364,7 +1366,7 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport)
+ "slow_ring buffer\n");
+ goto debug_failed;
+ }
+- atomic_set(&phba->slow_ring_trc_cnt, 0);
++ atomic_set_unchecked(&phba->slow_ring_trc_cnt, 0);
+ memset(phba->slow_ring_trc, 0,
+ (sizeof(struct lpfc_debugfs_trc) *
+ lpfc_debugfs_max_slow_ring_trc));
+@@ -1410,7 +1412,7 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport)
+ "buffer\n");
+ goto debug_failed;
+ }
+- atomic_set(&vport->disc_trc_cnt, 0);
++ atomic_set_unchecked(&vport->disc_trc_cnt, 0);
+
+ snprintf(name, sizeof(name), "discovery_trace");
+ vport->debug_disc_trc =
+diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
+index 549bc7d..8189dbb 100644
+--- a/drivers/scsi/lpfc/lpfc_init.c
++++ b/drivers/scsi/lpfc/lpfc_init.c
+@@ -8021,8 +8021,10 @@ lpfc_init(void)
+ printk(LPFC_COPYRIGHT "\n");
+
+ if (lpfc_enable_npiv) {
+- lpfc_transport_functions.vport_create = lpfc_vport_create;
+- lpfc_transport_functions.vport_delete = lpfc_vport_delete;
++ pax_open_kernel();
++ *(void **)&lpfc_transport_functions.vport_create = lpfc_vport_create;
++ *(void **)&lpfc_transport_functions.vport_delete = lpfc_vport_delete;
++ pax_close_kernel();
+ }
+ lpfc_transport_template =
+ fc_attach_transport(&lpfc_transport_functions);
+diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
+index c88f59f..ff2a42f 100644
+--- a/drivers/scsi/lpfc/lpfc_scsi.c
++++ b/drivers/scsi/lpfc/lpfc_scsi.c
+@@ -259,7 +259,7 @@ lpfc_rampdown_queue_depth(struct lpfc_hba *phba)
+ uint32_t evt_posted;
+
+ spin_lock_irqsave(&phba->hbalock, flags);
+- atomic_inc(&phba->num_rsrc_err);
++ atomic_inc_unchecked(&phba->num_rsrc_err);
+ phba->last_rsrc_error_time = jiffies;
+
+ if ((phba->last_ramp_down_time + QUEUE_RAMP_DOWN_INTERVAL) > jiffies) {
+@@ -300,7 +300,7 @@ lpfc_rampup_queue_depth(struct lpfc_vport *vport,
+ unsigned long flags;
+ struct lpfc_hba *phba = vport->phba;
+ uint32_t evt_posted;
+- atomic_inc(&phba->num_cmd_success);
++ atomic_inc_unchecked(&phba->num_cmd_success);
+
+ if (vport->cfg_lun_queue_depth <= queue_depth)
+ return;
+@@ -343,8 +343,8 @@ lpfc_ramp_down_queue_handler(struct lpfc_hba *phba)
+ int i;
+ struct lpfc_rport_data *rdata;
+
+- num_rsrc_err = atomic_read(&phba->num_rsrc_err);
+- num_cmd_success = atomic_read(&phba->num_cmd_success);
++ num_rsrc_err = atomic_read_unchecked(&phba->num_rsrc_err);
++ num_cmd_success = atomic_read_unchecked(&phba->num_cmd_success);
+
+ vports = lpfc_create_vport_work_array(phba);
+ if (vports != NULL)
+@@ -378,8 +378,8 @@ lpfc_ramp_down_queue_handler(struct lpfc_hba *phba)
+ }
+ }
+ lpfc_destroy_vport_work_array(phba, vports);
+- atomic_set(&phba->num_rsrc_err, 0);
+- atomic_set(&phba->num_cmd_success, 0);
++ atomic_set_unchecked(&phba->num_rsrc_err, 0);
++ atomic_set_unchecked(&phba->num_cmd_success, 0);
+ }
+
+ /**
+@@ -427,8 +427,8 @@ lpfc_ramp_up_queue_handler(struct lpfc_hba *phba)
+ }
+ }
+ lpfc_destroy_vport_work_array(phba, vports);
+- atomic_set(&phba->num_rsrc_err, 0);
+- atomic_set(&phba->num_cmd_success, 0);
++ atomic_set_unchecked(&phba->num_rsrc_err, 0);
++ atomic_set_unchecked(&phba->num_cmd_success, 0);
+ }
+
+ /**
+diff --git a/drivers/scsi/megaraid/megaraid_mbox.c b/drivers/scsi/megaraid/megaraid_mbox.c
+index 234f0b7..3020aea 100644
+--- a/drivers/scsi/megaraid/megaraid_mbox.c
++++ b/drivers/scsi/megaraid/megaraid_mbox.c
+@@ -3503,6 +3503,8 @@ megaraid_cmm_register(adapter_t *adapter)
+ int rval;
+ int i;
+
++ pax_track_stack();
++
+ // Allocate memory for the base list of scb for management module.
+ adapter->uscb_list = kcalloc(MBOX_MAX_USER_CMDS, sizeof(scb_t), GFP_KERNEL);
+
+diff --git a/drivers/scsi/osd/osd_initiator.c b/drivers/scsi/osd/osd_initiator.c
+index 7a117c1..ee01e9e 100644
+--- a/drivers/scsi/osd/osd_initiator.c
++++ b/drivers/scsi/osd/osd_initiator.c
+@@ -94,6 +94,8 @@ static int _osd_print_system_info(struct osd_dev *od, void *caps)
+ int nelem = ARRAY_SIZE(get_attrs), a = 0;
+ int ret;
+
++ pax_track_stack();
++
+ or = osd_start_request(od, GFP_KERNEL);
+ if (!or)
+ return -ENOMEM;
+diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
+index 9ab8c86..9425ad3 100644
+--- a/drivers/scsi/pmcraid.c
++++ b/drivers/scsi/pmcraid.c
+@@ -189,8 +189,8 @@ static int pmcraid_slave_alloc(struct scsi_device *scsi_dev)
+ res->scsi_dev = scsi_dev;
+ scsi_dev->hostdata = res;
+ res->change_detected = 0;
+- atomic_set(&res->read_failures, 0);
+- atomic_set(&res->write_failures, 0);
++ atomic_set_unchecked(&res->read_failures, 0);
++ atomic_set_unchecked(&res->write_failures, 0);
+ rc = 0;
+ }
+ spin_unlock_irqrestore(&pinstance->resource_lock, lock_flags);
+@@ -2396,9 +2396,9 @@ static int pmcraid_error_handler(struct pmcraid_cmd *cmd)
+
+ /* If this was a SCSI read/write command keep count of errors */
+ if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_READ_CMD)
+- atomic_inc(&res->read_failures);
++ atomic_inc_unchecked(&res->read_failures);
+ else if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_WRITE_CMD)
+- atomic_inc(&res->write_failures);
++ atomic_inc_unchecked(&res->write_failures);
+
+ if (!RES_IS_GSCSI(res->cfg_entry) &&
+ masked_ioasc != PMCRAID_IOASC_HW_DEVICE_BUS_STATUS_ERROR) {
+@@ -4116,7 +4116,7 @@ static void pmcraid_worker_function(struct work_struct *workp)
+
+ pinstance = container_of(workp, struct pmcraid_instance, worker_q);
+ /* add resources only after host is added into system */
+- if (!atomic_read(&pinstance->expose_resources))
++ if (!atomic_read_unchecked(&pinstance->expose_resources))
+ return;
+
+ spin_lock_irqsave(&pinstance->resource_lock, lock_flags);
+@@ -4850,7 +4850,7 @@ static int __devinit pmcraid_init_instance(
+ init_waitqueue_head(&pinstance->reset_wait_q);
+
+ atomic_set(&pinstance->outstanding_cmds, 0);
+- atomic_set(&pinstance->expose_resources, 0);
++ atomic_set_unchecked(&pinstance->expose_resources, 0);
+
+ INIT_LIST_HEAD(&pinstance->free_res_q);
+ INIT_LIST_HEAD(&pinstance->used_res_q);
+@@ -5502,7 +5502,7 @@ static int __devinit pmcraid_probe(
+ /* Schedule worker thread to handle CCN and take care of adding and
+ * removing devices to OS
+ */
+- atomic_set(&pinstance->expose_resources, 1);
++ atomic_set_unchecked(&pinstance->expose_resources, 1);
+ schedule_work(&pinstance->worker_q);
+ return rc;
+
+diff --git a/drivers/scsi/pmcraid.h b/drivers/scsi/pmcraid.h
+index 3441b3f..6cbe8f7 100644
+--- a/drivers/scsi/pmcraid.h
++++ b/drivers/scsi/pmcraid.h
+@@ -690,7 +690,7 @@ struct pmcraid_instance {
+ atomic_t outstanding_cmds;
+
+ /* should add/delete resources to mid-layer now ?*/
+- atomic_t expose_resources;
++ atomic_unchecked_t expose_resources;
+
+ /* Tasklet to handle deferred processing */
+ struct tasklet_struct isr_tasklet[PMCRAID_NUM_MSIX_VECTORS];
+@@ -727,8 +727,8 @@ struct pmcraid_resource_entry {
+ struct list_head queue; /* link to "to be exposed" resources */
+ struct pmcraid_config_table_entry cfg_entry;
+ struct scsi_device *scsi_dev; /* Link scsi_device structure */
+- atomic_t read_failures; /* count of failed READ commands */
+- atomic_t write_failures; /* count of failed WRITE commands */
++ atomic_unchecked_t read_failures; /* count of failed READ commands */
++ atomic_unchecked_t write_failures; /* count of failed WRITE commands */
+
+ /* To indicate add/delete/modify during CCN */
+ u8 change_detected;
+diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
+index 2150618..7034215 100644
+--- a/drivers/scsi/qla2xxx/qla_def.h
++++ b/drivers/scsi/qla2xxx/qla_def.h
+@@ -2089,7 +2089,7 @@ struct isp_operations {
+
+ int (*get_flash_version) (struct scsi_qla_host *, void *);
+ int (*start_scsi) (srb_t *);
+-};
++} __no_const;
+
+ /* MSI-X Support *************************************************************/
+
+diff --git a/drivers/scsi/qla4xxx/ql4_def.h b/drivers/scsi/qla4xxx/ql4_def.h
+index 81b5f29..2ae1fad 100644
+--- a/drivers/scsi/qla4xxx/ql4_def.h
++++ b/drivers/scsi/qla4xxx/ql4_def.h
+@@ -240,7 +240,7 @@ struct ddb_entry {
+ atomic_t retry_relogin_timer; /* Min Time between relogins
+ * (4000 only) */
+ atomic_t relogin_timer; /* Max Time to wait for relogin to complete */
+- atomic_t relogin_retry_count; /* Num of times relogin has been
++ atomic_unchecked_t relogin_retry_count; /* Num of times relogin has been
+ * retried */
+
+ uint16_t port;
+diff --git a/drivers/scsi/qla4xxx/ql4_init.c b/drivers/scsi/qla4xxx/ql4_init.c
+index af8c323..515dd51 100644
+--- a/drivers/scsi/qla4xxx/ql4_init.c
++++ b/drivers/scsi/qla4xxx/ql4_init.c
+@@ -482,7 +482,7 @@ static struct ddb_entry * qla4xxx_alloc_ddb(struct scsi_qla_host *ha,
+ atomic_set(&ddb_entry->port_down_timer, ha->port_down_retry_count);
+ atomic_set(&ddb_entry->retry_relogin_timer, INVALID_ENTRY);
+ atomic_set(&ddb_entry->relogin_timer, 0);
+- atomic_set(&ddb_entry->relogin_retry_count, 0);
++ atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
+ atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
+ list_add_tail(&ddb_entry->list, &ha->ddb_list);
+ ha->fw_ddb_index_map[fw_ddb_index] = ddb_entry;
+@@ -1308,7 +1308,7 @@ int qla4xxx_process_ddb_changed(struct scsi_qla_host *ha,
+ atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
+ atomic_set(&ddb_entry->port_down_timer,
+ ha->port_down_retry_count);
+- atomic_set(&ddb_entry->relogin_retry_count, 0);
++ atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
+ atomic_set(&ddb_entry->relogin_timer, 0);
+ clear_bit(DF_RELOGIN, &ddb_entry->flags);
+ clear_bit(DF_NO_RELOGIN, &ddb_entry->flags);
+diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
+index 83c8b5e..a82b348 100644
+--- a/drivers/scsi/qla4xxx/ql4_os.c
++++ b/drivers/scsi/qla4xxx/ql4_os.c
+@@ -641,13 +641,13 @@ static void qla4xxx_timer(struct scsi_qla_host *ha)
+ ddb_entry->fw_ddb_device_state ==
+ DDB_DS_SESSION_FAILED) {
+ /* Reset retry relogin timer */
+- atomic_inc(&ddb_entry->relogin_retry_count);
++ atomic_inc_unchecked(&ddb_entry->relogin_retry_count);
+ DEBUG2(printk("scsi%ld: index[%d] relogin"
+ " timed out-retrying"
+ " relogin (%d)\n",
+ ha->host_no,
+ ddb_entry->fw_ddb_index,
+- atomic_read(&ddb_entry->
++ atomic_read_unchecked(&ddb_entry->
+ relogin_retry_count))
+ );
+ start_dpc++;
+diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
+index dd098ca..686ce01 100644
+--- a/drivers/scsi/scsi.c
++++ b/drivers/scsi/scsi.c
+@@ -652,7 +652,7 @@ int scsi_dispatch_cmd(struct scsi_cmnd *cmd)
+ unsigned long timeout;
+ int rtn = 0;
+
+- atomic_inc(&cmd->device->iorequest_cnt);
++ atomic_inc_unchecked(&cmd->device->iorequest_cnt);
+
+ /* check if the device is still usable */
+ if (unlikely(cmd->device->sdev_state == SDEV_DEL)) {
+diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
+index bc3e363..e1a8e50 100644
+--- a/drivers/scsi/scsi_debug.c
++++ b/drivers/scsi/scsi_debug.c
+@@ -1395,6 +1395,8 @@ static int resp_mode_select(struct scsi_cmnd * scp, int mselect6,
+ unsigned char arr[SDEBUG_MAX_MSELECT_SZ];
+ unsigned char *cmd = (unsigned char *)scp->cmnd;
+
++ pax_track_stack();
++
+ if ((errsts = check_readiness(scp, 1, devip)))
+ return errsts;
+ memset(arr, 0, sizeof(arr));
+@@ -1492,6 +1494,8 @@ static int resp_log_sense(struct scsi_cmnd * scp,
+ unsigned char arr[SDEBUG_MAX_LSENSE_SZ];
+ unsigned char *cmd = (unsigned char *)scp->cmnd;
+
++ pax_track_stack();
++
+ if ((errsts = check_readiness(scp, 1, devip)))
+ return errsts;
+ memset(arr, 0, sizeof(arr));
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index 8df12522..c4c1472 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -1389,7 +1389,7 @@ static void scsi_kill_request(struct request *req, struct request_queue *q)
+ shost = sdev->host;
+ scsi_init_cmd_errh(cmd);
+ cmd->result = DID_NO_CONNECT << 16;
+- atomic_inc(&cmd->device->iorequest_cnt);
++ atomic_inc_unchecked(&cmd->device->iorequest_cnt);
+
+ /*
+ * SCSI request completion path will do scsi_device_unbusy(),
+@@ -1420,9 +1420,9 @@ static void scsi_softirq_done(struct request *rq)
+ */
+ cmd->serial_number = 0;
+
+- atomic_inc(&cmd->device->iodone_cnt);
++ atomic_inc_unchecked(&cmd->device->iodone_cnt);
+ if (cmd->result)
+- atomic_inc(&cmd->device->ioerr_cnt);
++ atomic_inc_unchecked(&cmd->device->ioerr_cnt);
+
+ disposition = scsi_decide_disposition(cmd);
+ if (disposition != SUCCESS &&
+diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
+index 91a93e0..eae0fe3 100644
+--- a/drivers/scsi/scsi_sysfs.c
++++ b/drivers/scsi/scsi_sysfs.c
+@@ -662,7 +662,7 @@ show_iostat_##field(struct device *dev, struct device_attribute *attr, \
+ char *buf) \
+ { \
+ struct scsi_device *sdev = to_scsi_device(dev); \
+- unsigned long long count = atomic_read(&sdev->field); \
++ unsigned long long count = atomic_read_unchecked(&sdev->field); \
+ return snprintf(buf, 20, "0x%llx\n", count); \
+ } \
+ static DEVICE_ATTR(field, S_IRUGO, show_iostat_##field, NULL)
+diff --git a/drivers/scsi/scsi_tgt_lib.c b/drivers/scsi/scsi_tgt_lib.c
+index 1030327..f91fd30 100644
+--- a/drivers/scsi/scsi_tgt_lib.c
++++ b/drivers/scsi/scsi_tgt_lib.c
+@@ -362,7 +362,7 @@ static int scsi_map_user_pages(struct scsi_tgt_cmd *tcmd, struct scsi_cmnd *cmd,
+ int err;
+
+ dprintk("%lx %u\n", uaddr, len);
+- err = blk_rq_map_user(q, rq, NULL, (void *)uaddr, len, GFP_KERNEL);
++ err = blk_rq_map_user(q, rq, NULL, (void __user *)uaddr, len, GFP_KERNEL);
+ if (err) {
+ /*
+ * TODO: need to fixup sg_tablesize, max_segment_size,
+diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
+index db02e31..1b42ea9 100644
+--- a/drivers/scsi/scsi_transport_fc.c
++++ b/drivers/scsi/scsi_transport_fc.c
+@@ -480,7 +480,7 @@ MODULE_PARM_DESC(dev_loss_tmo,
+ * Netlink Infrastructure
+ */
+
+-static atomic_t fc_event_seq;
++static atomic_unchecked_t fc_event_seq;
+
+ /**
+ * fc_get_event_number - Obtain the next sequential FC event number
+@@ -493,7 +493,7 @@ static atomic_t fc_event_seq;
+ u32
+ fc_get_event_number(void)
+ {
+- return atomic_add_return(1, &fc_event_seq);
++ return atomic_add_return_unchecked(1, &fc_event_seq);
+ }
+ EXPORT_SYMBOL(fc_get_event_number);
+
+@@ -641,7 +641,7 @@ static __init int fc_transport_init(void)
+ {
+ int error;
+
+- atomic_set(&fc_event_seq, 0);
++ atomic_set_unchecked(&fc_event_seq, 0);
+
+ error = transport_class_register(&fc_host_class);
+ if (error)
+diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
+index de2f8c4..63c5278 100644
+--- a/drivers/scsi/scsi_transport_iscsi.c
++++ b/drivers/scsi/scsi_transport_iscsi.c
+@@ -81,7 +81,7 @@ struct iscsi_internal {
+ struct device_attribute *session_attrs[ISCSI_SESSION_ATTRS + 1];
+ };
+
+-static atomic_t iscsi_session_nr; /* sysfs session id for next new session */
++static atomic_unchecked_t iscsi_session_nr; /* sysfs session id for next new session */
+ static struct workqueue_struct *iscsi_eh_timer_workq;
+
+ /*
+@@ -728,7 +728,7 @@ int iscsi_add_session(struct iscsi_cls_session *session, unsigned int target_id)
+ int err;
+
+ ihost = shost->shost_data;
+- session->sid = atomic_add_return(1, &iscsi_session_nr);
++ session->sid = atomic_add_return_unchecked(1, &iscsi_session_nr);
+
+ if (id == ISCSI_MAX_TARGET) {
+ for (id = 0; id < ISCSI_MAX_TARGET; id++) {
+@@ -2060,7 +2060,7 @@ static __init int iscsi_transport_init(void)
+ printk(KERN_INFO "Loading iSCSI transport class v%s.\n",
+ ISCSI_TRANSPORT_VERSION);
+
+- atomic_set(&iscsi_session_nr, 0);
++ atomic_set_unchecked(&iscsi_session_nr, 0);
+
+ err = class_register(&iscsi_transport_class);
+ if (err)
+diff --git a/drivers/scsi/scsi_transport_srp.c b/drivers/scsi/scsi_transport_srp.c
+index 21a045e..ec89e03 100644
+--- a/drivers/scsi/scsi_transport_srp.c
++++ b/drivers/scsi/scsi_transport_srp.c
+@@ -33,7 +33,7 @@
+ #include "scsi_transport_srp_internal.h"
+
+ struct srp_host_attrs {
+- atomic_t next_port_id;
++ atomic_unchecked_t next_port_id;
+ };
+ #define to_srp_host_attrs(host) ((struct srp_host_attrs *)(host)->shost_data)
+
+@@ -62,7 +62,7 @@ static int srp_host_setup(struct transport_container *tc, struct device *dev,
+ struct Scsi_Host *shost = dev_to_shost(dev);
+ struct srp_host_attrs *srp_host = to_srp_host_attrs(shost);
+
+- atomic_set(&srp_host->next_port_id, 0);
++ atomic_set_unchecked(&srp_host->next_port_id, 0);
+ return 0;
+ }
+
+@@ -211,7 +211,7 @@ struct srp_rport *srp_rport_add(struct Scsi_Host *shost,
+ memcpy(rport->port_id, ids->port_id, sizeof(rport->port_id));
+ rport->roles = ids->roles;
+
+- id = atomic_inc_return(&to_srp_host_attrs(shost)->next_port_id);
++ id = atomic_inc_return_unchecked(&to_srp_host_attrs(shost)->next_port_id);
+ dev_set_name(&rport->dev, "port-%d:%d", shost->host_no, id);
+
+ transport_setup_device(&rport->dev);
+diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
+index 040f751..98a5ed2 100644
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -1064,7 +1064,7 @@ sg_ioctl(struct inode *inode, struct file *filp,
+ sdp->disk->disk_name,
+ MKDEV(SCSI_GENERIC_MAJOR, sdp->index),
+ NULL,
+- (char *)arg);
++ (char __user *)arg);
+ case BLKTRACESTART:
+ return blk_trace_startstop(sdp->device->request_queue, 1);
+ case BLKTRACESTOP:
+@@ -2292,7 +2292,7 @@ struct sg_proc_leaf {
+ const struct file_operations * fops;
+ };
+
+-static struct sg_proc_leaf sg_proc_leaf_arr[] = {
++static const struct sg_proc_leaf sg_proc_leaf_arr[] = {
+ {"allow_dio", &adio_fops},
+ {"debug", &debug_fops},
+ {"def_reserved_size", &dressz_fops},
+@@ -2307,7 +2307,7 @@ sg_proc_init(void)
+ {
+ int k, mask;
+ int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
+- struct sg_proc_leaf * leaf;
++ const struct sg_proc_leaf * leaf;
+
+ sg_proc_sgp = proc_mkdir(sg_proc_sg_dirname, NULL);
+ if (!sg_proc_sgp)
+diff --git a/drivers/scsi/sym53c8xx_2/sym_glue.c b/drivers/scsi/sym53c8xx_2/sym_glue.c
+index c19ca5e..3eb5959 100644
+--- a/drivers/scsi/sym53c8xx_2/sym_glue.c
++++ b/drivers/scsi/sym53c8xx_2/sym_glue.c
+@@ -1758,6 +1758,8 @@ static int __devinit sym2_probe(struct pci_dev *pdev,
+ int do_iounmap = 0;
+ int do_disable_device = 1;
+
++ pax_track_stack();
++
+ memset(&sym_dev, 0, sizeof(sym_dev));
+ memset(&nvram, 0, sizeof(nvram));
+ sym_dev.pdev = pdev;
+diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c
+new file mode 100644
+index 0000000..eabb432
+--- /dev/null
++++ b/drivers/scsi/vmw_pvscsi.c
+@@ -0,0 +1,1401 @@
++/*
++ * Linux driver for VMware's para-virtualized SCSI HBA.
++ *
++ * Copyright (C) 2008-2009, VMware, Inc. All Rights Reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License as published by the
++ * Free Software Foundation; version 2 of the License and no later version.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
++ * NON INFRINGEMENT. See the GNU General Public License for more
++ * details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
++ *
++ * Maintained by: Alok N Kataria <akataria@vmware.com>
++ *
++ */
++
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/moduleparam.h>
++#include <linux/types.h>
++#include <linux/interrupt.h>
++#include <linux/workqueue.h>
++#include <linux/pci.h>
++
++#include <scsi/scsi.h>
++#include <scsi/scsi_host.h>
++#include <scsi/scsi_cmnd.h>
++#include <scsi/scsi_device.h>
++
++#include "vmw_pvscsi.h"
++
++#define PVSCSI_LINUX_DRIVER_DESC "VMware PVSCSI driver"
++
++MODULE_DESCRIPTION(PVSCSI_LINUX_DRIVER_DESC);
++MODULE_AUTHOR("VMware, Inc.");
++MODULE_LICENSE("GPL");
++MODULE_VERSION(PVSCSI_DRIVER_VERSION_STRING);
++
++#define PVSCSI_DEFAULT_NUM_PAGES_PER_RING 8
++#define PVSCSI_DEFAULT_NUM_PAGES_MSG_RING 1
++#define PVSCSI_DEFAULT_QUEUE_DEPTH 64
++#define SGL_SIZE PAGE_SIZE
++
++#define pvscsi_dev(adapter) (&(adapter->dev->dev))
++
++struct pvscsi_sg_list {
++ struct PVSCSISGElement sge[PVSCSI_MAX_NUM_SG_ENTRIES_PER_SEGMENT];
++};
++
++struct pvscsi_ctx {
++ /*
++ * The index of the context in cmd_map serves as the context ID for a
++ * 1-to-1 mapping completions back to requests.
++ */
++ struct scsi_cmnd *cmd;
++ struct pvscsi_sg_list *sgl;
++ struct list_head list;
++ dma_addr_t dataPA;
++ dma_addr_t sensePA;
++ dma_addr_t sglPA;
++};
++
++struct pvscsi_adapter {
++ char *mmioBase;
++ unsigned int irq;
++ u8 rev;
++ bool use_msi;
++ bool use_msix;
++ bool use_msg;
++
++ spinlock_t hw_lock;
++
++ struct workqueue_struct *workqueue;
++ struct work_struct work;
++
++ struct PVSCSIRingReqDesc *req_ring;
++ unsigned req_pages;
++ unsigned req_depth;
++ dma_addr_t reqRingPA;
++
++ struct PVSCSIRingCmpDesc *cmp_ring;
++ unsigned cmp_pages;
++ dma_addr_t cmpRingPA;
++
++ struct PVSCSIRingMsgDesc *msg_ring;
++ unsigned msg_pages;
++ dma_addr_t msgRingPA;
++
++ struct PVSCSIRingsState *rings_state;
++ dma_addr_t ringStatePA;
++
++ struct pci_dev *dev;
++ struct Scsi_Host *host;
++
++ struct list_head cmd_pool;
++ struct pvscsi_ctx *cmd_map;
++};
++
++
++/* Command line parameters */
++static int pvscsi_ring_pages = PVSCSI_DEFAULT_NUM_PAGES_PER_RING;
++static int pvscsi_msg_ring_pages = PVSCSI_DEFAULT_NUM_PAGES_MSG_RING;
++static int pvscsi_cmd_per_lun = PVSCSI_DEFAULT_QUEUE_DEPTH;
++static bool pvscsi_disable_msi;
++static bool pvscsi_disable_msix;
++static bool pvscsi_use_msg = true;
++
++#define PVSCSI_RW (S_IRUSR | S_IWUSR)
++
++module_param_named(ring_pages, pvscsi_ring_pages, int, PVSCSI_RW);
++MODULE_PARM_DESC(ring_pages, "Number of pages per req/cmp ring - (default="
++ __stringify(PVSCSI_DEFAULT_NUM_PAGES_PER_RING) ")");
++
++module_param_named(msg_ring_pages, pvscsi_msg_ring_pages, int, PVSCSI_RW);
++MODULE_PARM_DESC(msg_ring_pages, "Number of pages for the msg ring - (default="
++ __stringify(PVSCSI_DEFAULT_NUM_PAGES_MSG_RING) ")");
++
++module_param_named(cmd_per_lun, pvscsi_cmd_per_lun, int, PVSCSI_RW);
++MODULE_PARM_DESC(cmd_per_lun, "Maximum commands per lun - (default="
++ __stringify(PVSCSI_MAX_REQ_QUEUE_DEPTH) ")");
++
++module_param_named(disable_msi, pvscsi_disable_msi, bool, PVSCSI_RW);
++MODULE_PARM_DESC(disable_msi, "Disable MSI use in driver - (default=0)");
++
++module_param_named(disable_msix, pvscsi_disable_msix, bool, PVSCSI_RW);
++MODULE_PARM_DESC(disable_msix, "Disable MSI-X use in driver - (default=0)");
++
++module_param_named(use_msg, pvscsi_use_msg, bool, PVSCSI_RW);
++MODULE_PARM_DESC(use_msg, "Use msg ring when available - (default=1)");
++
++static const struct pci_device_id pvscsi_pci_tbl[] = {
++ { PCI_VDEVICE(VMWARE, PCI_DEVICE_ID_VMWARE_PVSCSI) },
++ { 0 }
++};
++
++MODULE_DEVICE_TABLE(pci, pvscsi_pci_tbl);
++
++static struct pvscsi_ctx *
++pvscsi_find_context(const struct pvscsi_adapter *adapter, struct scsi_cmnd *cmd)
++{
++ struct pvscsi_ctx *ctx, *end;
++
++ end = &adapter->cmd_map[adapter->req_depth];
++ for (ctx = adapter->cmd_map; ctx < end; ctx++)
++ if (ctx->cmd == cmd)
++ return ctx;
++
++ return NULL;
++}
++
++static struct pvscsi_ctx *
++pvscsi_acquire_context(struct pvscsi_adapter *adapter, struct scsi_cmnd *cmd)
++{
++ struct pvscsi_ctx *ctx;
++
++ if (list_empty(&adapter->cmd_pool))
++ return NULL;
++
++ ctx = list_first_entry(&adapter->cmd_pool, struct pvscsi_ctx, list);
++ ctx->cmd = cmd;
++ list_del(&ctx->list);
++
++ return ctx;
++}
++
++static void pvscsi_release_context(struct pvscsi_adapter *adapter,
++ struct pvscsi_ctx *ctx)
++{
++ ctx->cmd = NULL;
++ list_add(&ctx->list, &adapter->cmd_pool);
++}
++
++/*
++ * Map a pvscsi_ctx struct to a context ID field value; we map to a simple
++ * non-zero integer. ctx always points to an entry in cmd_map array, hence
++ * the return value is always >=1.
++ */
++static u64 pvscsi_map_context(const struct pvscsi_adapter *adapter,
++ const struct pvscsi_ctx *ctx)
++{
++ return ctx - adapter->cmd_map + 1;
++}
++
++static struct pvscsi_ctx *
++pvscsi_get_context(const struct pvscsi_adapter *adapter, u64 context)
++{
++ return &adapter->cmd_map[context - 1];
++}
++
++static void pvscsi_reg_write(const struct pvscsi_adapter *adapter,
++ u32 offset, u32 val)
++{
++ writel(val, adapter->mmioBase + offset);
++}
++
++static u32 pvscsi_reg_read(const struct pvscsi_adapter *adapter, u32 offset)
++{
++ return readl(adapter->mmioBase + offset);
++}
++
++static u32 pvscsi_read_intr_status(const struct pvscsi_adapter *adapter)
++{
++ return pvscsi_reg_read(adapter, PVSCSI_REG_OFFSET_INTR_STATUS);
++}
++
++static void pvscsi_write_intr_status(const struct pvscsi_adapter *adapter,
++ u32 val)
++{
++ pvscsi_reg_write(adapter, PVSCSI_REG_OFFSET_INTR_STATUS, val);
++}
++
++static void pvscsi_unmask_intr(const struct pvscsi_adapter *adapter)
++{
++ u32 intr_bits;
++
++ intr_bits = PVSCSI_INTR_CMPL_MASK;
++ if (adapter->use_msg)
++ intr_bits |= PVSCSI_INTR_MSG_MASK;
++
++ pvscsi_reg_write(adapter, PVSCSI_REG_OFFSET_INTR_MASK, intr_bits);
++}
++
++static void pvscsi_mask_intr(const struct pvscsi_adapter *adapter)
++{
++ pvscsi_reg_write(adapter, PVSCSI_REG_OFFSET_INTR_MASK, 0);
++}
++
++static void pvscsi_write_cmd_desc(const struct pvscsi_adapter *adapter,
++ u32 cmd, const void *desc, size_t len)
++{
++ const u32 *ptr = desc;
++ size_t i;
++
++ len /= sizeof(*ptr);
++ pvscsi_reg_write(adapter, PVSCSI_REG_OFFSET_COMMAND, cmd);
++ for (i = 0; i < len; i++)
++ pvscsi_reg_write(adapter,
++ PVSCSI_REG_OFFSET_COMMAND_DATA, ptr[i]);
++}
++
++static void pvscsi_abort_cmd(const struct pvscsi_adapter *adapter,
++ const struct pvscsi_ctx *ctx)
++{
++ struct PVSCSICmdDescAbortCmd cmd = { 0 };
++
++ cmd.target = ctx->cmd->device->id;
++ cmd.context = pvscsi_map_context(adapter, ctx);
++
++ pvscsi_write_cmd_desc(adapter, PVSCSI_CMD_ABORT_CMD, &cmd, sizeof(cmd));
++}
++
++static void pvscsi_kick_rw_io(const struct pvscsi_adapter *adapter)
++{
++ pvscsi_reg_write(adapter, PVSCSI_REG_OFFSET_KICK_RW_IO, 0);
++}
++
++static void pvscsi_process_request_ring(const struct pvscsi_adapter *adapter)
++{
++ pvscsi_reg_write(adapter, PVSCSI_REG_OFFSET_KICK_NON_RW_IO, 0);
++}
++
++static int scsi_is_rw(unsigned char op)
++{
++ return op == READ_6 || op == WRITE_6 ||
++ op == READ_10 || op == WRITE_10 ||
++ op == READ_12 || op == WRITE_12 ||
++ op == READ_16 || op == WRITE_16;
++}
++
++static void pvscsi_kick_io(const struct pvscsi_adapter *adapter,
++ unsigned char op)
++{
++ if (scsi_is_rw(op))
++ pvscsi_kick_rw_io(adapter);
++ else
++ pvscsi_process_request_ring(adapter);
++}
++
++static void ll_adapter_reset(const struct pvscsi_adapter *adapter)
++{
++ dev_dbg(pvscsi_dev(adapter), "Adapter Reset on %p\n", adapter);
++
++ pvscsi_write_cmd_desc(adapter, PVSCSI_CMD_ADAPTER_RESET, NULL, 0);
++}
++
++static void ll_bus_reset(const struct pvscsi_adapter *adapter)
++{
++ dev_dbg(pvscsi_dev(adapter), "Reseting bus on %p\n", adapter);
++
++ pvscsi_write_cmd_desc(adapter, PVSCSI_CMD_RESET_BUS, NULL, 0);
++}
++
++static void ll_device_reset(const struct pvscsi_adapter *adapter, u32 target)
++{
++ struct PVSCSICmdDescResetDevice cmd = { 0 };
++
++ dev_dbg(pvscsi_dev(adapter), "Reseting device: target=%u\n", target);
++
++ cmd.target = target;
++
++ pvscsi_write_cmd_desc(adapter, PVSCSI_CMD_RESET_DEVICE,
++ &cmd, sizeof(cmd));
++}
++
++static void pvscsi_create_sg(struct pvscsi_ctx *ctx,
++ struct scatterlist *sg, unsigned count)
++{
++ unsigned i;
++ struct PVSCSISGElement *sge;
++
++ BUG_ON(count > PVSCSI_MAX_NUM_SG_ENTRIES_PER_SEGMENT);
++
++ sge = &ctx->sgl->sge[0];
++ for (i = 0; i < count; i++, sg++) {
++ sge[i].addr = sg_dma_address(sg);
++ sge[i].length = sg_dma_len(sg);
++ sge[i].flags = 0;
++ }
++}
++
++/*
++ * Map all data buffers for a command into PCI space and
++ * setup the scatter/gather list if needed.
++ */
++static void pvscsi_map_buffers(struct pvscsi_adapter *adapter,
++ struct pvscsi_ctx *ctx, struct scsi_cmnd *cmd,
++ struct PVSCSIRingReqDesc *e)
++{
++ unsigned count;
++ unsigned bufflen = scsi_bufflen(cmd);
++ struct scatterlist *sg;
++
++ e->dataLen = bufflen;
++ e->dataAddr = 0;
++ if (bufflen == 0)
++ return;
++
++ sg = scsi_sglist(cmd);
++ count = scsi_sg_count(cmd);
++ if (count != 0) {
++ int segs = scsi_dma_map(cmd);
++ if (segs > 1) {
++ pvscsi_create_sg(ctx, sg, segs);
++
++ e->flags |= PVSCSI_FLAG_CMD_WITH_SG_LIST;
++ ctx->sglPA = pci_map_single(adapter->dev, ctx->sgl,
++ SGL_SIZE, PCI_DMA_TODEVICE);
++ e->dataAddr = ctx->sglPA;
++ } else
++ e->dataAddr = sg_dma_address(sg);
++ } else {
++ /*
++ * In case there is no S/G list, scsi_sglist points
++ * directly to the buffer.
++ */
++ ctx->dataPA = pci_map_single(adapter->dev, sg, bufflen,
++ cmd->sc_data_direction);
++ e->dataAddr = ctx->dataPA;
++ }
++}
++
++static void pvscsi_unmap_buffers(const struct pvscsi_adapter *adapter,
++ struct pvscsi_ctx *ctx)
++{
++ struct scsi_cmnd *cmd;
++ unsigned bufflen;
++
++ cmd = ctx->cmd;
++ bufflen = scsi_bufflen(cmd);
++
++ if (bufflen != 0) {
++ unsigned count = scsi_sg_count(cmd);
++
++ if (count != 0) {
++ scsi_dma_unmap(cmd);
++ if (ctx->sglPA) {
++ pci_unmap_single(adapter->dev, ctx->sglPA,
++ SGL_SIZE, PCI_DMA_TODEVICE);
++ ctx->sglPA = 0;
++ }
++ } else
++ pci_unmap_single(adapter->dev, ctx->dataPA, bufflen,
++ cmd->sc_data_direction);
++ }
++ if (cmd->sense_buffer)
++ pci_unmap_single(adapter->dev, ctx->sensePA,
++ SCSI_SENSE_BUFFERSIZE, PCI_DMA_FROMDEVICE);
++}
++
++static int __devinit pvscsi_allocate_rings(struct pvscsi_adapter *adapter)
++{
++ adapter->rings_state = pci_alloc_consistent(adapter->dev, PAGE_SIZE,
++ &adapter->ringStatePA);
++ if (!adapter->rings_state)
++ return -ENOMEM;
++
++ adapter->req_pages = min(PVSCSI_MAX_NUM_PAGES_REQ_RING,
++ pvscsi_ring_pages);
++ adapter->req_depth = adapter->req_pages
++ * PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE;
++ adapter->req_ring = pci_alloc_consistent(adapter->dev,
++ adapter->req_pages * PAGE_SIZE,
++ &adapter->reqRingPA);
++ if (!adapter->req_ring)
++ return -ENOMEM;
++
++ adapter->cmp_pages = min(PVSCSI_MAX_NUM_PAGES_CMP_RING,
++ pvscsi_ring_pages);
++ adapter->cmp_ring = pci_alloc_consistent(adapter->dev,
++ adapter->cmp_pages * PAGE_SIZE,
++ &adapter->cmpRingPA);
++ if (!adapter->cmp_ring)
++ return -ENOMEM;
++
++ BUG_ON(!IS_ALIGNED(adapter->ringStatePA, PAGE_SIZE));
++ BUG_ON(!IS_ALIGNED(adapter->reqRingPA, PAGE_SIZE));
++ BUG_ON(!IS_ALIGNED(adapter->cmpRingPA, PAGE_SIZE));
++
++ if (!adapter->use_msg)
++ return 0;
++
++ adapter->msg_pages = min(PVSCSI_MAX_NUM_PAGES_MSG_RING,
++ pvscsi_msg_ring_pages);
++ adapter->msg_ring = pci_alloc_consistent(adapter->dev,
++ adapter->msg_pages * PAGE_SIZE,
++ &adapter->msgRingPA);
++ if (!adapter->msg_ring)
++ return -ENOMEM;
++ BUG_ON(!IS_ALIGNED(adapter->msgRingPA, PAGE_SIZE));
++
++ return 0;
++}
++
++static void pvscsi_setup_all_rings(const struct pvscsi_adapter *adapter)
++{
++ struct PVSCSICmdDescSetupRings cmd = { 0 };
++ dma_addr_t base;
++ unsigned i;
++
++ cmd.ringsStatePPN = adapter->ringStatePA >> PAGE_SHIFT;
++ cmd.reqRingNumPages = adapter->req_pages;
++ cmd.cmpRingNumPages = adapter->cmp_pages;
++
++ base = adapter->reqRingPA;
++ for (i = 0; i < adapter->req_pages; i++) {
++ cmd.reqRingPPNs[i] = base >> PAGE_SHIFT;
++ base += PAGE_SIZE;
++ }
++
++ base = adapter->cmpRingPA;
++ for (i = 0; i < adapter->cmp_pages; i++) {
++ cmd.cmpRingPPNs[i] = base >> PAGE_SHIFT;
++ base += PAGE_SIZE;
++ }
++
++ memset(adapter->rings_state, 0, PAGE_SIZE);
++ memset(adapter->req_ring, 0, adapter->req_pages * PAGE_SIZE);
++ memset(adapter->cmp_ring, 0, adapter->cmp_pages * PAGE_SIZE);
++
++ pvscsi_write_cmd_desc(adapter, PVSCSI_CMD_SETUP_RINGS,
++ &cmd, sizeof(cmd));
++
++ if (adapter->use_msg) {
++ struct PVSCSICmdDescSetupMsgRing cmd_msg = { 0 };
++
++ cmd_msg.numPages = adapter->msg_pages;
++
++ base = adapter->msgRingPA;
++ for (i = 0; i < adapter->msg_pages; i++) {
++ cmd_msg.ringPPNs[i] = base >> PAGE_SHIFT;
++ base += PAGE_SIZE;
++ }
++ memset(adapter->msg_ring, 0, adapter->msg_pages * PAGE_SIZE);
++
++ pvscsi_write_cmd_desc(adapter, PVSCSI_CMD_SETUP_MSG_RING,
++ &cmd_msg, sizeof(cmd_msg));
++ }
++}
++
++/*
++ * Pull a completion descriptor off and pass the completion back
++ * to the SCSI mid layer.
++ */
++static void pvscsi_complete_request(struct pvscsi_adapter *adapter,
++ const struct PVSCSIRingCmpDesc *e)
++{
++ struct pvscsi_ctx *ctx;
++ struct scsi_cmnd *cmd;
++ u32 btstat = e->hostStatus;
++ u32 sdstat = e->scsiStatus;
++
++ ctx = pvscsi_get_context(adapter, e->context);
++ cmd = ctx->cmd;
++ pvscsi_unmap_buffers(adapter, ctx);
++ pvscsi_release_context(adapter, ctx);
++ cmd->result = 0;
++
++ if (sdstat != SAM_STAT_GOOD &&
++ (btstat == BTSTAT_SUCCESS ||
++ btstat == BTSTAT_LINKED_COMMAND_COMPLETED ||
++ btstat == BTSTAT_LINKED_COMMAND_COMPLETED_WITH_FLAG)) {
++ cmd->result = (DID_OK << 16) | sdstat;
++ if (sdstat == SAM_STAT_CHECK_CONDITION && cmd->sense_buffer)
++ cmd->result |= (DRIVER_SENSE << 24);
++ } else
++ switch (btstat) {
++ case BTSTAT_SUCCESS:
++ case BTSTAT_LINKED_COMMAND_COMPLETED:
++ case BTSTAT_LINKED_COMMAND_COMPLETED_WITH_FLAG:
++ /* If everything went fine, let's move on.. */
++ cmd->result = (DID_OK << 16);
++ break;
++
++ case BTSTAT_DATARUN:
++ case BTSTAT_DATA_UNDERRUN:
++ /* Report residual data in underruns */
++ scsi_set_resid(cmd, scsi_bufflen(cmd) - e->dataLen);
++ cmd->result = (DID_ERROR << 16);
++ break;
++
++ case BTSTAT_SELTIMEO:
++ /* Our emulation returns this for non-connected devs */
++ cmd->result = (DID_BAD_TARGET << 16);
++ break;
++
++ case BTSTAT_LUNMISMATCH:
++ case BTSTAT_TAGREJECT:
++ case BTSTAT_BADMSG:
++ cmd->result = (DRIVER_INVALID << 24);
++ /* fall through */
++
++ case BTSTAT_HAHARDWARE:
++ case BTSTAT_INVPHASE:
++ case BTSTAT_HATIMEOUT:
++ case BTSTAT_NORESPONSE:
++ case BTSTAT_DISCONNECT:
++ case BTSTAT_HASOFTWARE:
++ case BTSTAT_BUSFREE:
++ case BTSTAT_SENSFAILED:
++ cmd->result |= (DID_ERROR << 16);
++ break;
++
++ case BTSTAT_SENTRST:
++ case BTSTAT_RECVRST:
++ case BTSTAT_BUSRESET:
++ cmd->result = (DID_RESET << 16);
++ break;
++
++ case BTSTAT_ABORTQUEUE:
++ cmd->result = (DID_ABORT << 16);
++ break;
++
++ case BTSTAT_SCSIPARITY:
++ cmd->result = (DID_PARITY << 16);
++ break;
++
++ default:
++ cmd->result = (DID_ERROR << 16);
++ scmd_printk(KERN_DEBUG, cmd,
++ "Unknown completion status: 0x%x\n",
++ btstat);
++ }
++
++ dev_dbg(&cmd->device->sdev_gendev,
++ "cmd=%p %x ctx=%p result=0x%x status=0x%x,%x\n",
++ cmd, cmd->cmnd[0], ctx, cmd->result, btstat, sdstat);
++
++ cmd->scsi_done(cmd);
++}
++
++/*
++ * barrier usage : Since the PVSCSI device is emulated, there could be cases
++ * where we may want to serialize some accesses between the driver and the
++ * emulation layer. We use compiler barriers instead of the more expensive
++ * memory barriers because PVSCSI is only supported on X86 which has strong
++ * memory access ordering.
++ */
++static void pvscsi_process_completion_ring(struct pvscsi_adapter *adapter)
++{
++ struct PVSCSIRingsState *s = adapter->rings_state;
++ struct PVSCSIRingCmpDesc *ring = adapter->cmp_ring;
++ u32 cmp_entries = s->cmpNumEntriesLog2;
++
++ while (s->cmpConsIdx != s->cmpProdIdx) {
++ struct PVSCSIRingCmpDesc *e = ring + (s->cmpConsIdx &
++ MASK(cmp_entries));
++ /*
++ * This barrier() ensures that *e is not dereferenced while
++ * the device emulation still writes data into the slot.
++ * Since the device emulation advances s->cmpProdIdx only after
++ * updating the slot we want to check it first.
++ */
++ barrier();
++ pvscsi_complete_request(adapter, e);
++ /*
++ * This barrier() ensures that compiler doesn't reorder write
++ * to s->cmpConsIdx before the read of (*e) inside
++ * pvscsi_complete_request. Otherwise, device emulation may
++ * overwrite *e before we had a chance to read it.
++ */
++ barrier();
++ s->cmpConsIdx++;
++ }
++}
++
++/*
++ * Translate a Linux SCSI request into a request ring entry.
++ */
++static int pvscsi_queue_ring(struct pvscsi_adapter *adapter,
++ struct pvscsi_ctx *ctx, struct scsi_cmnd *cmd)
++{
++ struct PVSCSIRingsState *s;
++ struct PVSCSIRingReqDesc *e;
++ struct scsi_device *sdev;
++ u32 req_entries;
++
++ s = adapter->rings_state;
++ sdev = cmd->device;
++ req_entries = s->reqNumEntriesLog2;
++
++ /*
++ * If this condition holds, we might have room on the request ring, but
++ * we might not have room on the completion ring for the response.
++ * However, we have already ruled out this possibility - we would not
++ * have successfully allocated a context if it were true, since we only
++ * have one context per request entry. Check for it anyway, since it
++ * would be a serious bug.
++ */
++ if (s->reqProdIdx - s->cmpConsIdx >= 1 << req_entries) {
++ scmd_printk(KERN_ERR, cmd, "vmw_pvscsi: "
++ "ring full: reqProdIdx=%d cmpConsIdx=%d\n",
++ s->reqProdIdx, s->cmpConsIdx);
++ return -1;
++ }
++
++ e = adapter->req_ring + (s->reqProdIdx & MASK(req_entries));
++
++ e->bus = sdev->channel;
++ e->target = sdev->id;
++ memset(e->lun, 0, sizeof(e->lun));
++ e->lun[1] = sdev->lun;
++
++ if (cmd->sense_buffer) {
++ ctx->sensePA = pci_map_single(adapter->dev, cmd->sense_buffer,
++ SCSI_SENSE_BUFFERSIZE,
++ PCI_DMA_FROMDEVICE);
++ e->senseAddr = ctx->sensePA;
++ e->senseLen = SCSI_SENSE_BUFFERSIZE;
++ } else {
++ e->senseLen = 0;
++ e->senseAddr = 0;
++ }
++ e->cdbLen = cmd->cmd_len;
++ e->vcpuHint = smp_processor_id();
++ memcpy(e->cdb, cmd->cmnd, e->cdbLen);
++
++ e->tag = SIMPLE_QUEUE_TAG;
++ if (sdev->tagged_supported &&
++ (cmd->tag == HEAD_OF_QUEUE_TAG ||
++ cmd->tag == ORDERED_QUEUE_TAG))
++ e->tag = cmd->tag;
++
++ if (cmd->sc_data_direction == DMA_FROM_DEVICE)
++ e->flags = PVSCSI_FLAG_CMD_DIR_TOHOST;
++ else if (cmd->sc_data_direction == DMA_TO_DEVICE)
++ e->flags = PVSCSI_FLAG_CMD_DIR_TODEVICE;
++ else if (cmd->sc_data_direction == DMA_NONE)
++ e->flags = PVSCSI_FLAG_CMD_DIR_NONE;
++ else
++ e->flags = 0;
++
++ pvscsi_map_buffers(adapter, ctx, cmd, e);
++
++ e->context = pvscsi_map_context(adapter, ctx);
++
++ barrier();
++
++ s->reqProdIdx++;
++
++ return 0;
++}
++
++static int pvscsi_queue(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *))
++{
++ struct Scsi_Host *host = cmd->device->host;
++ struct pvscsi_adapter *adapter = shost_priv(host);
++ struct pvscsi_ctx *ctx;
++ unsigned long flags;
++
++ spin_lock_irqsave(&adapter->hw_lock, flags);
++
++ ctx = pvscsi_acquire_context(adapter, cmd);
++ if (!ctx || pvscsi_queue_ring(adapter, ctx, cmd) != 0) {
++ if (ctx)
++ pvscsi_release_context(adapter, ctx);
++ spin_unlock_irqrestore(&adapter->hw_lock, flags);
++ return SCSI_MLQUEUE_HOST_BUSY;
++ }
++
++ cmd->scsi_done = done;
++
++ dev_dbg(&cmd->device->sdev_gendev,
++ "queued cmd %p, ctx %p, op=%x\n", cmd, ctx, cmd->cmnd[0]);
++
++ spin_unlock_irqrestore(&adapter->hw_lock, flags);
++
++ pvscsi_kick_io(adapter, cmd->cmnd[0]);
++
++ return 0;
++}
++
++static int pvscsi_abort(struct scsi_cmnd *cmd)
++{
++ struct pvscsi_adapter *adapter = shost_priv(cmd->device->host);
++ struct pvscsi_ctx *ctx;
++ unsigned long flags;
++
++ scmd_printk(KERN_DEBUG, cmd, "task abort on host %u, %p\n",
++ adapter->host->host_no, cmd);
++
++ spin_lock_irqsave(&adapter->hw_lock, flags);
++
++ /*
++ * Poll the completion ring first - we might be trying to abort
++ * a command that is waiting to be dispatched in the completion ring.
++ */
++ pvscsi_process_completion_ring(adapter);
++
++ /*
++ * If there is no context for the command, it either already succeeded
++ * or else was never properly issued. Not our problem.
++ */
++ ctx = pvscsi_find_context(adapter, cmd);
++ if (!ctx) {
++ scmd_printk(KERN_DEBUG, cmd, "Failed to abort cmd %p\n", cmd);
++ goto out;
++ }
++
++ pvscsi_abort_cmd(adapter, ctx);
++
++ pvscsi_process_completion_ring(adapter);
++
++out:
++ spin_unlock_irqrestore(&adapter->hw_lock, flags);
++ return SUCCESS;
++}
++
++/*
++ * Abort all outstanding requests. This is only safe to use if the completion
++ * ring will never be walked again or the device has been reset, because it
++ * destroys the 1-1 mapping between context field passed to emulation and our
++ * request structure.
++ */
++static void pvscsi_reset_all(struct pvscsi_adapter *adapter)
++{
++ unsigned i;
++
++ for (i = 0; i < adapter->req_depth; i++) {
++ struct pvscsi_ctx *ctx = &adapter->cmd_map[i];
++ struct scsi_cmnd *cmd = ctx->cmd;
++ if (cmd) {
++ scmd_printk(KERN_ERR, cmd,
++ "Forced reset on cmd %p\n", cmd);
++ pvscsi_unmap_buffers(adapter, ctx);
++ pvscsi_release_context(adapter, ctx);
++ cmd->result = (DID_RESET << 16);
++ cmd->scsi_done(cmd);
++ }
++ }
++}
++
++static int pvscsi_host_reset(struct scsi_cmnd *cmd)
++{
++ struct Scsi_Host *host = cmd->device->host;
++ struct pvscsi_adapter *adapter = shost_priv(host);
++ unsigned long flags;
++ bool use_msg;
++
++ scmd_printk(KERN_INFO, cmd, "SCSI Host reset\n");
++
++ spin_lock_irqsave(&adapter->hw_lock, flags);
++
++ use_msg = adapter->use_msg;
++
++ if (use_msg) {
++ adapter->use_msg = 0;
++ spin_unlock_irqrestore(&adapter->hw_lock, flags);
++
++ /*
++ * Now that we know that the ISR won't add more work on the
++ * workqueue we can safely flush any outstanding work.
++ */
++ flush_workqueue(adapter->workqueue);
++ spin_lock_irqsave(&adapter->hw_lock, flags);
++ }
++
++ /*
++ * We're going to tear down the entire ring structure and set it back
++ * up, so stalling new requests until all completions are flushed and
++ * the rings are back in place.
++ */
++
++ pvscsi_process_request_ring(adapter);
++
++ ll_adapter_reset(adapter);
++
++ /*
++ * Now process any completions. Note we do this AFTER adapter reset,
++ * which is strange, but stops races where completions get posted
++ * between processing the ring and issuing the reset. The backend will
++ * not touch the ring memory after reset, so the immediately pre-reset
++ * completion ring state is still valid.
++ */
++ pvscsi_process_completion_ring(adapter);
++
++ pvscsi_reset_all(adapter);
++ adapter->use_msg = use_msg;
++ pvscsi_setup_all_rings(adapter);
++ pvscsi_unmask_intr(adapter);
++
++ spin_unlock_irqrestore(&adapter->hw_lock, flags);
++
++ return SUCCESS;
++}
++
++static int pvscsi_bus_reset(struct scsi_cmnd *cmd)
++{
++ struct Scsi_Host *host = cmd->device->host;
++ struct pvscsi_adapter *adapter = shost_priv(host);
++ unsigned long flags;
++
++ scmd_printk(KERN_INFO, cmd, "SCSI Bus reset\n");
++
++ /*
++ * We don't want to queue new requests for this bus after
++ * flushing all pending requests to emulation, since new
++ * requests could then sneak in during this bus reset phase,
++ * so take the lock now.
++ */
++ spin_lock_irqsave(&adapter->hw_lock, flags);
++
++ pvscsi_process_request_ring(adapter);
++ ll_bus_reset(adapter);
++ pvscsi_process_completion_ring(adapter);
++
++ spin_unlock_irqrestore(&adapter->hw_lock, flags);
++
++ return SUCCESS;
++}
++
++static int pvscsi_device_reset(struct scsi_cmnd *cmd)
++{
++ struct Scsi_Host *host = cmd->device->host;
++ struct pvscsi_adapter *adapter = shost_priv(host);
++ unsigned long flags;
++
++ scmd_printk(KERN_INFO, cmd, "SCSI device reset on scsi%u:%u\n",
++ host->host_no, cmd->device->id);
++
++ /*
++ * We don't want to queue new requests for this device after flushing
++ * all pending requests to emulation, since new requests could then
++ * sneak in during this device reset phase, so take the lock now.
++ */
++ spin_lock_irqsave(&adapter->hw_lock, flags);
++
++ pvscsi_process_request_ring(adapter);
++ ll_device_reset(adapter, cmd->device->id);
++ pvscsi_process_completion_ring(adapter);
++
++ spin_unlock_irqrestore(&adapter->hw_lock, flags);
++
++ return SUCCESS;
++}
++
++static struct scsi_host_template pvscsi_template;
++
++static const char *pvscsi_info(struct Scsi_Host *host)
++{
++ struct pvscsi_adapter *adapter = shost_priv(host);
++ static char buf[256];
++
++ sprintf(buf, "VMware PVSCSI storage adapter rev %d, req/cmp/msg rings: "
++ "%u/%u/%u pages, cmd_per_lun=%u", adapter->rev,
++ adapter->req_pages, adapter->cmp_pages, adapter->msg_pages,
++ pvscsi_template.cmd_per_lun);
++
++ return buf;
++}
++
++static struct scsi_host_template pvscsi_template = {
++ .module = THIS_MODULE,
++ .name = "VMware PVSCSI Host Adapter",
++ .proc_name = "vmw_pvscsi",
++ .info = pvscsi_info,
++ .queuecommand = pvscsi_queue,
++ .this_id = -1,
++ .sg_tablesize = PVSCSI_MAX_NUM_SG_ENTRIES_PER_SEGMENT,
++ .dma_boundary = UINT_MAX,
++ .max_sectors = 0xffff,
++ .use_clustering = ENABLE_CLUSTERING,
++ .eh_abort_handler = pvscsi_abort,
++ .eh_device_reset_handler = pvscsi_device_reset,
++ .eh_bus_reset_handler = pvscsi_bus_reset,
++ .eh_host_reset_handler = pvscsi_host_reset,
++};
++
++static void pvscsi_process_msg(const struct pvscsi_adapter *adapter,
++ const struct PVSCSIRingMsgDesc *e)
++{
++ struct PVSCSIRingsState *s = adapter->rings_state;
++ struct Scsi_Host *host = adapter->host;
++ struct scsi_device *sdev;
++
++ printk(KERN_INFO "vmw_pvscsi: msg type: 0x%x - MSG RING: %u/%u (%u) \n",
++ e->type, s->msgProdIdx, s->msgConsIdx, s->msgNumEntriesLog2);
++
++ BUILD_BUG_ON(PVSCSI_MSG_LAST != 2);
++
++ if (e->type == PVSCSI_MSG_DEV_ADDED) {
++ struct PVSCSIMsgDescDevStatusChanged *desc;
++ desc = (struct PVSCSIMsgDescDevStatusChanged *)e;
++
++ printk(KERN_INFO
++ "vmw_pvscsi: msg: device added at scsi%u:%u:%u\n",
++ desc->bus, desc->target, desc->lun[1]);
++
++ if (!scsi_host_get(host))
++ return;
++
++ sdev = scsi_device_lookup(host, desc->bus, desc->target,
++ desc->lun[1]);
++ if (sdev) {
++ printk(KERN_INFO "vmw_pvscsi: device already exists\n");
++ scsi_device_put(sdev);
++ } else
++ scsi_add_device(adapter->host, desc->bus,
++ desc->target, desc->lun[1]);
++
++ scsi_host_put(host);
++ } else if (e->type == PVSCSI_MSG_DEV_REMOVED) {
++ struct PVSCSIMsgDescDevStatusChanged *desc;
++ desc = (struct PVSCSIMsgDescDevStatusChanged *)e;
++
++ printk(KERN_INFO
++ "vmw_pvscsi: msg: device removed at scsi%u:%u:%u\n",
++ desc->bus, desc->target, desc->lun[1]);
++
++ if (!scsi_host_get(host))
++ return;
++
++ sdev = scsi_device_lookup(host, desc->bus, desc->target,
++ desc->lun[1]);
++ if (sdev) {
++ scsi_remove_device(sdev);
++ scsi_device_put(sdev);
++ } else
++ printk(KERN_INFO
++ "vmw_pvscsi: failed to lookup scsi%u:%u:%u\n",
++ desc->bus, desc->target, desc->lun[1]);
++
++ scsi_host_put(host);
++ }
++}
++
++static int pvscsi_msg_pending(const struct pvscsi_adapter *adapter)
++{
++ struct PVSCSIRingsState *s = adapter->rings_state;
++
++ return s->msgProdIdx != s->msgConsIdx;
++}
++
++static void pvscsi_process_msg_ring(const struct pvscsi_adapter *adapter)
++{
++ struct PVSCSIRingsState *s = adapter->rings_state;
++ struct PVSCSIRingMsgDesc *ring = adapter->msg_ring;
++ u32 msg_entries = s->msgNumEntriesLog2;
++
++ while (pvscsi_msg_pending(adapter)) {
++ struct PVSCSIRingMsgDesc *e = ring + (s->msgConsIdx &
++ MASK(msg_entries));
++
++ barrier();
++ pvscsi_process_msg(adapter, e);
++ barrier();
++ s->msgConsIdx++;
++ }
++}
++
++static void pvscsi_msg_workqueue_handler(struct work_struct *data)
++{
++ struct pvscsi_adapter *adapter;
++
++ adapter = container_of(data, struct pvscsi_adapter, work);
++
++ pvscsi_process_msg_ring(adapter);
++}
++
++static int pvscsi_setup_msg_workqueue(struct pvscsi_adapter *adapter)
++{
++ char name[32];
++
++ if (!pvscsi_use_msg)
++ return 0;
++
++ pvscsi_reg_write(adapter, PVSCSI_REG_OFFSET_COMMAND,
++ PVSCSI_CMD_SETUP_MSG_RING);
++
++ if (pvscsi_reg_read(adapter, PVSCSI_REG_OFFSET_COMMAND_STATUS) == -1)
++ return 0;
++
++ snprintf(name, sizeof(name),
++ "vmw_pvscsi_wq_%u", adapter->host->host_no);
++
++ adapter->workqueue = create_singlethread_workqueue(name);
++ if (!adapter->workqueue) {
++ printk(KERN_ERR "vmw_pvscsi: failed to create work queue\n");
++ return 0;
++ }
++ INIT_WORK(&adapter->work, pvscsi_msg_workqueue_handler);
++
++ return 1;
++}
++
++static irqreturn_t pvscsi_isr(int irq, void *devp)
++{
++ struct pvscsi_adapter *adapter = devp;
++ int handled;
++
++ if (adapter->use_msi || adapter->use_msix)
++ handled = true;
++ else {
++ u32 val = pvscsi_read_intr_status(adapter);
++ handled = (val & PVSCSI_INTR_ALL_SUPPORTED) != 0;
++ if (handled)
++ pvscsi_write_intr_status(devp, val);
++ }
++
++ if (handled) {
++ unsigned long flags;
++
++ spin_lock_irqsave(&adapter->hw_lock, flags);
++
++ pvscsi_process_completion_ring(adapter);
++ if (adapter->use_msg && pvscsi_msg_pending(adapter))
++ queue_work(adapter->workqueue, &adapter->work);
++
++ spin_unlock_irqrestore(&adapter->hw_lock, flags);
++ }
++
++ return IRQ_RETVAL(handled);
++}
++
++static void pvscsi_free_sgls(const struct pvscsi_adapter *adapter)
++{
++ struct pvscsi_ctx *ctx = adapter->cmd_map;
++ unsigned i;
++
++ for (i = 0; i < adapter->req_depth; ++i, ++ctx)
++ kfree(ctx->sgl);
++}
++
++static int pvscsi_setup_msix(const struct pvscsi_adapter *adapter, int *irq)
++{
++ struct msix_entry entry = { 0, PVSCSI_VECTOR_COMPLETION };
++ int ret;
++
++ ret = pci_enable_msix(adapter->dev, &entry, 1);
++ if (ret)
++ return ret;
++
++ *irq = entry.vector;
++
++ return 0;
++}
++
++static void pvscsi_shutdown_intr(struct pvscsi_adapter *adapter)
++{
++ if (adapter->irq) {
++ free_irq(adapter->irq, adapter);
++ adapter->irq = 0;
++ }
++ if (adapter->use_msi) {
++ pci_disable_msi(adapter->dev);
++ adapter->use_msi = 0;
++ } else if (adapter->use_msix) {
++ pci_disable_msix(adapter->dev);
++ adapter->use_msix = 0;
++ }
++}
++
++static void pvscsi_release_resources(struct pvscsi_adapter *adapter)
++{
++ pvscsi_shutdown_intr(adapter);
++
++ if (adapter->workqueue)
++ destroy_workqueue(adapter->workqueue);
++
++ if (adapter->mmioBase)
++ pci_iounmap(adapter->dev, adapter->mmioBase);
++
++ pci_release_regions(adapter->dev);
++
++ if (adapter->cmd_map) {
++ pvscsi_free_sgls(adapter);
++ kfree(adapter->cmd_map);
++ }
++
++ if (adapter->rings_state)
++ pci_free_consistent(adapter->dev, PAGE_SIZE,
++ adapter->rings_state, adapter->ringStatePA);
++
++ if (adapter->req_ring)
++ pci_free_consistent(adapter->dev,
++ adapter->req_pages * PAGE_SIZE,
++ adapter->req_ring, adapter->reqRingPA);
++
++ if (adapter->cmp_ring)
++ pci_free_consistent(adapter->dev,
++ adapter->cmp_pages * PAGE_SIZE,
++ adapter->cmp_ring, adapter->cmpRingPA);
++
++ if (adapter->msg_ring)
++ pci_free_consistent(adapter->dev,
++ adapter->msg_pages * PAGE_SIZE,
++ adapter->msg_ring, adapter->msgRingPA);
++}
++
++/*
++ * Allocate scatter gather lists.
++ *
++ * These are statically allocated. Trying to be clever was not worth it.
++ *
++ * Dynamic allocation can fail, and we can't go deeep into the memory
++ * allocator, since we're a SCSI driver, and trying too hard to allocate
++ * memory might generate disk I/O. We also don't want to fail disk I/O
++ * in that case because we can't get an allocation - the I/O could be
++ * trying to swap out data to free memory. Since that is pathological,
++ * just use a statically allocated scatter list.
++ *
++ */
++static int __devinit pvscsi_allocate_sg(struct pvscsi_adapter *adapter)
++{
++ struct pvscsi_ctx *ctx;
++ int i;
++
++ ctx = adapter->cmd_map;
++ BUILD_BUG_ON(sizeof(struct pvscsi_sg_list) > SGL_SIZE);
++
++ for (i = 0; i < adapter->req_depth; ++i, ++ctx) {
++ ctx->sgl = kmalloc(SGL_SIZE, GFP_KERNEL);
++ ctx->sglPA = 0;
++ BUG_ON(!IS_ALIGNED(((unsigned long)ctx->sgl), PAGE_SIZE));
++ if (!ctx->sgl) {
++ for (; i >= 0; --i, --ctx) {
++ kfree(ctx->sgl);
++ ctx->sgl = NULL;
++ }
++ return -ENOMEM;
++ }
++ }
++
++ return 0;
++}
++
++static int __devinit pvscsi_probe(struct pci_dev *pdev,
++ const struct pci_device_id *id)
++{
++ struct pvscsi_adapter *adapter;
++ struct Scsi_Host *host;
++ unsigned int i;
++ int error;
++
++ error = -ENODEV;
++
++ if (pci_enable_device(pdev))
++ return error;
++
++ if (pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) == 0 &&
++ pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64)) == 0) {
++ printk(KERN_INFO "vmw_pvscsi: using 64bit dma\n");
++ } else if (pci_set_dma_mask(pdev, DMA_BIT_MASK(32)) == 0 &&
++ pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32)) == 0) {
++ printk(KERN_INFO "vmw_pvscsi: using 32bit dma\n");
++ } else {
++ printk(KERN_ERR "vmw_pvscsi: failed to set DMA mask\n");
++ goto out_disable_device;
++ }
++
++ pvscsi_template.can_queue =
++ min(PVSCSI_MAX_NUM_PAGES_REQ_RING, pvscsi_ring_pages) *
++ PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE;
++ pvscsi_template.cmd_per_lun =
++ min(pvscsi_template.can_queue, pvscsi_cmd_per_lun);
++ host = scsi_host_alloc(&pvscsi_template, sizeof(struct pvscsi_adapter));
++ if (!host) {
++ printk(KERN_ERR "vmw_pvscsi: failed to allocate host\n");
++ goto out_disable_device;
++ }
++
++ adapter = shost_priv(host);
++ memset(adapter, 0, sizeof(*adapter));
++ adapter->dev = pdev;
++ adapter->host = host;
++
++ spin_lock_init(&adapter->hw_lock);
++
++ host->max_channel = 0;
++ host->max_id = 16;
++ host->max_lun = 1;
++ host->max_cmd_len = 16;
++
++ adapter->rev = pdev->revision;
++
++ if (pci_request_regions(pdev, "vmw_pvscsi")) {
++ printk(KERN_ERR "vmw_pvscsi: pci memory selection failed\n");
++ goto out_free_host;
++ }
++
++ for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
++ if ((pci_resource_flags(pdev, i) & PCI_BASE_ADDRESS_SPACE_IO))
++ continue;
++
++ if (pci_resource_len(pdev, i) < PVSCSI_MEM_SPACE_SIZE)
++ continue;
++
++ break;
++ }
++
++ if (i == DEVICE_COUNT_RESOURCE) {
++ printk(KERN_ERR
++ "vmw_pvscsi: adapter has no suitable MMIO region\n");
++ goto out_release_resources;
++ }
++
++ adapter->mmioBase = pci_iomap(pdev, i, PVSCSI_MEM_SPACE_SIZE);
++
++ if (!adapter->mmioBase) {
++ printk(KERN_ERR
++ "vmw_pvscsi: can't iomap for BAR %d memsize %lu\n",
++ i, PVSCSI_MEM_SPACE_SIZE);
++ goto out_release_resources;
++ }
++
++ pci_set_master(pdev);
++ pci_set_drvdata(pdev, host);
++
++ ll_adapter_reset(adapter);
++
++ adapter->use_msg = pvscsi_setup_msg_workqueue(adapter);
++
++ error = pvscsi_allocate_rings(adapter);
++ if (error) {
++ printk(KERN_ERR "vmw_pvscsi: unable to allocate ring memory\n");
++ goto out_release_resources;
++ }
++
++ /*
++ * From this point on we should reset the adapter if anything goes
++ * wrong.
++ */
++ pvscsi_setup_all_rings(adapter);
++
++ adapter->cmd_map = kcalloc(adapter->req_depth,
++ sizeof(struct pvscsi_ctx), GFP_KERNEL);
++ if (!adapter->cmd_map) {
++ printk(KERN_ERR "vmw_pvscsi: failed to allocate memory.\n");
++ error = -ENOMEM;
++ goto out_reset_adapter;
++ }
++
++ INIT_LIST_HEAD(&adapter->cmd_pool);
++ for (i = 0; i < adapter->req_depth; i++) {
++ struct pvscsi_ctx *ctx = adapter->cmd_map + i;
++ list_add(&ctx->list, &adapter->cmd_pool);
++ }
++
++ error = pvscsi_allocate_sg(adapter);
++ if (error) {
++ printk(KERN_ERR "vmw_pvscsi: unable to allocate s/g table\n");
++ goto out_reset_adapter;
++ }
++
++ if (!pvscsi_disable_msix &&
++ pvscsi_setup_msix(adapter, &adapter->irq) == 0) {
++ printk(KERN_INFO "vmw_pvscsi: using MSI-X\n");
++ adapter->use_msix = 1;
++ } else if (!pvscsi_disable_msi && pci_enable_msi(pdev) == 0) {
++ printk(KERN_INFO "vmw_pvscsi: using MSI\n");
++ adapter->use_msi = 1;
++ adapter->irq = pdev->irq;
++ } else {
++ printk(KERN_INFO "vmw_pvscsi: using INTx\n");
++ adapter->irq = pdev->irq;
++ }
++
++ error = request_irq(adapter->irq, pvscsi_isr, IRQF_SHARED,
++ "vmw_pvscsi", adapter);
++ if (error) {
++ printk(KERN_ERR
++ "vmw_pvscsi: unable to request IRQ: %d\n", error);
++ adapter->irq = 0;
++ goto out_reset_adapter;
++ }
++
++ error = scsi_add_host(host, &pdev->dev);
++ if (error) {
++ printk(KERN_ERR
++ "vmw_pvscsi: scsi_add_host failed: %d\n", error);
++ goto out_reset_adapter;
++ }
++
++ dev_info(&pdev->dev, "VMware PVSCSI rev %d host #%u\n",
++ adapter->rev, host->host_no);
++
++ pvscsi_unmask_intr(adapter);
++
++ scsi_scan_host(host);
++
++ return 0;
++
++out_reset_adapter:
++ ll_adapter_reset(adapter);
++out_release_resources:
++ pvscsi_release_resources(adapter);
++out_free_host:
++ scsi_host_put(host);
++out_disable_device:
++ pci_set_drvdata(pdev, NULL);
++ pci_disable_device(pdev);
++
++ return error;
++}
++
++static void __pvscsi_shutdown(struct pvscsi_adapter *adapter)
++{
++ pvscsi_mask_intr(adapter);
++
++ if (adapter->workqueue)
++ flush_workqueue(adapter->workqueue);
++
++ pvscsi_shutdown_intr(adapter);
++
++ pvscsi_process_request_ring(adapter);
++ pvscsi_process_completion_ring(adapter);
++ ll_adapter_reset(adapter);
++}
++
++static void pvscsi_shutdown(struct pci_dev *dev)
++{
++ struct Scsi_Host *host = pci_get_drvdata(dev);
++ struct pvscsi_adapter *adapter = shost_priv(host);
++
++ __pvscsi_shutdown(adapter);
++}
++
++static void pvscsi_remove(struct pci_dev *pdev)
++{
++ struct Scsi_Host *host = pci_get_drvdata(pdev);
++ struct pvscsi_adapter *adapter = shost_priv(host);
++
++ scsi_remove_host(host);
++
++ __pvscsi_shutdown(adapter);
++ pvscsi_release_resources(adapter);
++
++ scsi_host_put(host);
++
++ pci_set_drvdata(pdev, NULL);
++ pci_disable_device(pdev);
++}
++
++static struct pci_driver pvscsi_pci_driver = {
++ .name = "vmw_pvscsi",
++ .id_table = pvscsi_pci_tbl,
++ .probe = pvscsi_probe,
++ .remove = __devexit_p(pvscsi_remove),
++ .shutdown = pvscsi_shutdown,
++};
++
++static int __init pvscsi_init(void)
++{
++ pr_info("%s - version %s\n",
++ PVSCSI_LINUX_DRIVER_DESC, PVSCSI_DRIVER_VERSION_STRING);
++ return pci_register_driver(&pvscsi_pci_driver);
++}
++
++static void __exit pvscsi_exit(void)
++{
++ pci_unregister_driver(&pvscsi_pci_driver);
++}
++
++module_init(pvscsi_init);
++module_exit(pvscsi_exit);
+diff --git a/drivers/scsi/vmw_pvscsi.h b/drivers/scsi/vmw_pvscsi.h
+new file mode 100644
+index 0000000..62e36e7
+--- /dev/null
++++ b/drivers/scsi/vmw_pvscsi.h
+@@ -0,0 +1,397 @@
++/*
++ * VMware PVSCSI header file
++ *
++ * Copyright (C) 2008-2009, VMware, Inc. All Rights Reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License as published by the
++ * Free Software Foundation; version 2 of the License and no later version.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
++ * NON INFRINGEMENT. See the GNU General Public License for more
++ * details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
++ *
++ * Maintained by: Alok N Kataria <akataria@vmware.com>
++ *
++ */
++
++#ifndef _VMW_PVSCSI_H_
++#define _VMW_PVSCSI_H_
++
++#include <linux/types.h>
++
++#define PVSCSI_DRIVER_VERSION_STRING "1.0.1.0-k"
++
++#define PVSCSI_MAX_NUM_SG_ENTRIES_PER_SEGMENT 128
++
++#define MASK(n) ((1 << (n)) - 1) /* make an n-bit mask */
++
++#define PCI_VENDOR_ID_VMWARE 0x15AD
++#define PCI_DEVICE_ID_VMWARE_PVSCSI 0x07C0
++
++/*
++ * host adapter status/error codes
++ */
++enum HostBusAdapterStatus {
++ BTSTAT_SUCCESS = 0x00, /* CCB complete normally with no errors */
++ BTSTAT_LINKED_COMMAND_COMPLETED = 0x0a,
++ BTSTAT_LINKED_COMMAND_COMPLETED_WITH_FLAG = 0x0b,
++ BTSTAT_DATA_UNDERRUN = 0x0c,
++ BTSTAT_SELTIMEO = 0x11, /* SCSI selection timeout */
++ BTSTAT_DATARUN = 0x12, /* data overrun/underrun */
++ BTSTAT_BUSFREE = 0x13, /* unexpected bus free */
++ BTSTAT_INVPHASE = 0x14, /* invalid bus phase or sequence requested by target */
++ BTSTAT_LUNMISMATCH = 0x17, /* linked CCB has different LUN from first CCB */
++ BTSTAT_SENSFAILED = 0x1b, /* auto request sense failed */
++ BTSTAT_TAGREJECT = 0x1c, /* SCSI II tagged queueing message rejected by target */
++ BTSTAT_BADMSG = 0x1d, /* unsupported message received by the host adapter */
++ BTSTAT_HAHARDWARE = 0x20, /* host adapter hardware failed */
++ BTSTAT_NORESPONSE = 0x21, /* target did not respond to SCSI ATN, sent a SCSI RST */
++ BTSTAT_SENTRST = 0x22, /* host adapter asserted a SCSI RST */
++ BTSTAT_RECVRST = 0x23, /* other SCSI devices asserted a SCSI RST */
++ BTSTAT_DISCONNECT = 0x24, /* target device reconnected improperly (w/o tag) */
++ BTSTAT_BUSRESET = 0x25, /* host adapter issued BUS device reset */
++ BTSTAT_ABORTQUEUE = 0x26, /* abort queue generated */
++ BTSTAT_HASOFTWARE = 0x27, /* host adapter software error */
++ BTSTAT_HATIMEOUT = 0x30, /* host adapter hardware timeout error */
++ BTSTAT_SCSIPARITY = 0x34, /* SCSI parity error detected */
++};
++
++/*
++ * Register offsets.
++ *
++ * These registers are accessible both via i/o space and mm i/o.
++ */
++
++enum PVSCSIRegOffset {
++ PVSCSI_REG_OFFSET_COMMAND = 0x0,
++ PVSCSI_REG_OFFSET_COMMAND_DATA = 0x4,
++ PVSCSI_REG_OFFSET_COMMAND_STATUS = 0x8,
++ PVSCSI_REG_OFFSET_LAST_STS_0 = 0x100,
++ PVSCSI_REG_OFFSET_LAST_STS_1 = 0x104,
++ PVSCSI_REG_OFFSET_LAST_STS_2 = 0x108,
++ PVSCSI_REG_OFFSET_LAST_STS_3 = 0x10c,
++ PVSCSI_REG_OFFSET_INTR_STATUS = 0x100c,
++ PVSCSI_REG_OFFSET_INTR_MASK = 0x2010,
++ PVSCSI_REG_OFFSET_KICK_NON_RW_IO = 0x3014,
++ PVSCSI_REG_OFFSET_DEBUG = 0x3018,
++ PVSCSI_REG_OFFSET_KICK_RW_IO = 0x4018,
++};
++
++/*
++ * Virtual h/w commands.
++ */
++
++enum PVSCSICommands {
++ PVSCSI_CMD_FIRST = 0, /* has to be first */
++
++ PVSCSI_CMD_ADAPTER_RESET = 1,
++ PVSCSI_CMD_ISSUE_SCSI = 2,
++ PVSCSI_CMD_SETUP_RINGS = 3,
++ PVSCSI_CMD_RESET_BUS = 4,
++ PVSCSI_CMD_RESET_DEVICE = 5,
++ PVSCSI_CMD_ABORT_CMD = 6,
++ PVSCSI_CMD_CONFIG = 7,
++ PVSCSI_CMD_SETUP_MSG_RING = 8,
++ PVSCSI_CMD_DEVICE_UNPLUG = 9,
++
++ PVSCSI_CMD_LAST = 10 /* has to be last */
++};
++
++/*
++ * Command descriptor for PVSCSI_CMD_RESET_DEVICE --
++ */
++
++struct PVSCSICmdDescResetDevice {
++ u32 target;
++ u8 lun[8];
++} __packed;
++
++/*
++ * Command descriptor for PVSCSI_CMD_ABORT_CMD --
++ *
++ * - currently does not support specifying the LUN.
++ * - _pad should be 0.
++ */
++
++struct PVSCSICmdDescAbortCmd {
++ u64 context;
++ u32 target;
++ u32 _pad;
++} __packed;
++
++/*
++ * Command descriptor for PVSCSI_CMD_SETUP_RINGS --
++ *
++ * Notes:
++ * - reqRingNumPages and cmpRingNumPages need to be power of two.
++ * - reqRingNumPages and cmpRingNumPages need to be different from 0,
++ * - reqRingNumPages and cmpRingNumPages need to be inferior to
++ * PVSCSI_SETUP_RINGS_MAX_NUM_PAGES.
++ */
++
++#define PVSCSI_SETUP_RINGS_MAX_NUM_PAGES 32
++struct PVSCSICmdDescSetupRings {
++ u32 reqRingNumPages;
++ u32 cmpRingNumPages;
++ u64 ringsStatePPN;
++ u64 reqRingPPNs[PVSCSI_SETUP_RINGS_MAX_NUM_PAGES];
++ u64 cmpRingPPNs[PVSCSI_SETUP_RINGS_MAX_NUM_PAGES];
++} __packed;
++
++/*
++ * Command descriptor for PVSCSI_CMD_SETUP_MSG_RING --
++ *
++ * Notes:
++ * - this command was not supported in the initial revision of the h/w
++ * interface. Before using it, you need to check that it is supported by
++ * writing PVSCSI_CMD_SETUP_MSG_RING to the 'command' register, then
++ * immediately after read the 'command status' register:
++ * * a value of -1 means that the cmd is NOT supported,
++ * * a value != -1 means that the cmd IS supported.
++ * If it's supported the 'command status' register should return:
++ * sizeof(PVSCSICmdDescSetupMsgRing) / sizeof(u32).
++ * - this command should be issued _after_ the usual SETUP_RINGS so that the
++ * RingsState page is already setup. If not, the command is a nop.
++ * - numPages needs to be a power of two,
++ * - numPages needs to be different from 0,
++ * - _pad should be zero.
++ */
++
++#define PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES 16
++
++struct PVSCSICmdDescSetupMsgRing {
++ u32 numPages;
++ u32 _pad;
++ u64 ringPPNs[PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES];
++} __packed;
++
++enum PVSCSIMsgType {
++ PVSCSI_MSG_DEV_ADDED = 0,
++ PVSCSI_MSG_DEV_REMOVED = 1,
++ PVSCSI_MSG_LAST = 2,
++};
++
++/*
++ * Msg descriptor.
++ *
++ * sizeof(struct PVSCSIRingMsgDesc) == 128.
++ *
++ * - type is of type enum PVSCSIMsgType.
++ * - the content of args depend on the type of event being delivered.
++ */
++
++struct PVSCSIRingMsgDesc {
++ u32 type;
++ u32 args[31];
++} __packed;
++
++struct PVSCSIMsgDescDevStatusChanged {
++ u32 type; /* PVSCSI_MSG_DEV _ADDED / _REMOVED */
++ u32 bus;
++ u32 target;
++ u8 lun[8];
++ u32 pad[27];
++} __packed;
++
++/*
++ * Rings state.
++ *
++ * - the fields:
++ * . msgProdIdx,
++ * . msgConsIdx,
++ * . msgNumEntriesLog2,
++ * .. are only used once the SETUP_MSG_RING cmd has been issued.
++ * - '_pad' helps to ensure that the msg related fields are on their own
++ * cache-line.
++ */
++
++struct PVSCSIRingsState {
++ u32 reqProdIdx;
++ u32 reqConsIdx;
++ u32 reqNumEntriesLog2;
++
++ u32 cmpProdIdx;
++ u32 cmpConsIdx;
++ u32 cmpNumEntriesLog2;
++
++ u8 _pad[104];
++
++ u32 msgProdIdx;
++ u32 msgConsIdx;
++ u32 msgNumEntriesLog2;
++} __packed;
++
++/*
++ * Request descriptor.
++ *
++ * sizeof(RingReqDesc) = 128
++ *
++ * - context: is a unique identifier of a command. It could normally be any
++ * 64bit value, however we currently store it in the serialNumber variable
++ * of struct SCSI_Command, so we have the following restrictions due to the
++ * way this field is handled in the vmkernel storage stack:
++ * * this value can't be 0,
++ * * the upper 32bit need to be 0 since serialNumber is as a u32.
++ * Currently tracked as PR 292060.
++ * - dataLen: contains the total number of bytes that need to be transferred.
++ * - dataAddr:
++ * * if PVSCSI_FLAG_CMD_WITH_SG_LIST is set: dataAddr is the PA of the first
++ * s/g table segment, each s/g segment is entirely contained on a single
++ * page of physical memory,
++ * * if PVSCSI_FLAG_CMD_WITH_SG_LIST is NOT set, then dataAddr is the PA of
++ * the buffer used for the DMA transfer,
++ * - flags:
++ * * PVSCSI_FLAG_CMD_WITH_SG_LIST: see dataAddr above,
++ * * PVSCSI_FLAG_CMD_DIR_NONE: no DMA involved,
++ * * PVSCSI_FLAG_CMD_DIR_TOHOST: transfer from device to main memory,
++ * * PVSCSI_FLAG_CMD_DIR_TODEVICE: transfer from main memory to device,
++ * * PVSCSI_FLAG_CMD_OUT_OF_BAND_CDB: reserved to handle CDBs larger than
++ * 16bytes. To be specified.
++ * - vcpuHint: vcpuId of the processor that will be most likely waiting for the
++ * completion of the i/o. For guest OSes that use lowest priority message
++ * delivery mode (such as windows), we use this "hint" to deliver the
++ * completion action to the proper vcpu. For now, we can use the vcpuId of
++ * the processor that initiated the i/o as a likely candidate for the vcpu
++ * that will be waiting for the completion..
++ * - bus should be 0: we currently only support bus 0 for now.
++ * - unused should be zero'd.
++ */
++
++#define PVSCSI_FLAG_CMD_WITH_SG_LIST (1 << 0)
++#define PVSCSI_FLAG_CMD_OUT_OF_BAND_CDB (1 << 1)
++#define PVSCSI_FLAG_CMD_DIR_NONE (1 << 2)
++#define PVSCSI_FLAG_CMD_DIR_TOHOST (1 << 3)
++#define PVSCSI_FLAG_CMD_DIR_TODEVICE (1 << 4)
++
++struct PVSCSIRingReqDesc {
++ u64 context;
++ u64 dataAddr;
++ u64 dataLen;
++ u64 senseAddr;
++ u32 senseLen;
++ u32 flags;
++ u8 cdb[16];
++ u8 cdbLen;
++ u8 lun[8];
++ u8 tag;
++ u8 bus;
++ u8 target;
++ u8 vcpuHint;
++ u8 unused[59];
++} __packed;
++
++/*
++ * Scatter-gather list management.
++ *
++ * As described above, when PVSCSI_FLAG_CMD_WITH_SG_LIST is set in the
++ * RingReqDesc.flags, then RingReqDesc.dataAddr is the PA of the first s/g
++ * table segment.
++ *
++ * - each segment of the s/g table contain a succession of struct
++ * PVSCSISGElement.
++ * - each segment is entirely contained on a single physical page of memory.
++ * - a "chain" s/g element has the flag PVSCSI_SGE_FLAG_CHAIN_ELEMENT set in
++ * PVSCSISGElement.flags and in this case:
++ * * addr is the PA of the next s/g segment,
++ * * length is undefined, assumed to be 0.
++ */
++
++struct PVSCSISGElement {
++ u64 addr;
++ u32 length;
++ u32 flags;
++} __packed;
++
++/*
++ * Completion descriptor.
++ *
++ * sizeof(RingCmpDesc) = 32
++ *
++ * - context: identifier of the command. The same thing that was specified
++ * under "context" as part of struct RingReqDesc at initiation time,
++ * - dataLen: number of bytes transferred for the actual i/o operation,
++ * - senseLen: number of bytes written into the sense buffer,
++ * - hostStatus: adapter status,
++ * - scsiStatus: device status,
++ * - _pad should be zero.
++ */
++
++struct PVSCSIRingCmpDesc {
++ u64 context;
++ u64 dataLen;
++ u32 senseLen;
++ u16 hostStatus;
++ u16 scsiStatus;
++ u32 _pad[2];
++} __packed;
++
++/*
++ * Interrupt status / IRQ bits.
++ */
++
++#define PVSCSI_INTR_CMPL_0 (1 << 0)
++#define PVSCSI_INTR_CMPL_1 (1 << 1)
++#define PVSCSI_INTR_CMPL_MASK MASK(2)
++
++#define PVSCSI_INTR_MSG_0 (1 << 2)
++#define PVSCSI_INTR_MSG_1 (1 << 3)
++#define PVSCSI_INTR_MSG_MASK (MASK(2) << 2)
++
++#define PVSCSI_INTR_ALL_SUPPORTED MASK(4)
++
++/*
++ * Number of MSI-X vectors supported.
++ */
++#define PVSCSI_MAX_INTRS 24
++
++/*
++ * Enumeration of supported MSI-X vectors
++ */
++#define PVSCSI_VECTOR_COMPLETION 0
++
++/*
++ * Misc constants for the rings.
++ */
++
++#define PVSCSI_MAX_NUM_PAGES_REQ_RING PVSCSI_SETUP_RINGS_MAX_NUM_PAGES
++#define PVSCSI_MAX_NUM_PAGES_CMP_RING PVSCSI_SETUP_RINGS_MAX_NUM_PAGES
++#define PVSCSI_MAX_NUM_PAGES_MSG_RING PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES
++
++#define PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE \
++ (PAGE_SIZE / sizeof(struct PVSCSIRingReqDesc))
++
++#define PVSCSI_MAX_REQ_QUEUE_DEPTH \
++ (PVSCSI_MAX_NUM_PAGES_REQ_RING * PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE)
++
++#define PVSCSI_MEM_SPACE_COMMAND_NUM_PAGES 1
++#define PVSCSI_MEM_SPACE_INTR_STATUS_NUM_PAGES 1
++#define PVSCSI_MEM_SPACE_MISC_NUM_PAGES 2
++#define PVSCSI_MEM_SPACE_KICK_IO_NUM_PAGES 2
++#define PVSCSI_MEM_SPACE_MSIX_NUM_PAGES 2
++
++enum PVSCSIMemSpace {
++ PVSCSI_MEM_SPACE_COMMAND_PAGE = 0,
++ PVSCSI_MEM_SPACE_INTR_STATUS_PAGE = 1,
++ PVSCSI_MEM_SPACE_MISC_PAGE = 2,
++ PVSCSI_MEM_SPACE_KICK_IO_PAGE = 4,
++ PVSCSI_MEM_SPACE_MSIX_TABLE_PAGE = 6,
++ PVSCSI_MEM_SPACE_MSIX_PBA_PAGE = 7,
++};
++
++#define PVSCSI_MEM_SPACE_NUM_PAGES \
++ (PVSCSI_MEM_SPACE_COMMAND_NUM_PAGES + \
++ PVSCSI_MEM_SPACE_INTR_STATUS_NUM_PAGES + \
++ PVSCSI_MEM_SPACE_MISC_NUM_PAGES + \
++ PVSCSI_MEM_SPACE_KICK_IO_NUM_PAGES + \
++ PVSCSI_MEM_SPACE_MSIX_NUM_PAGES)
++
++#define PVSCSI_MEM_SPACE_SIZE (PVSCSI_MEM_SPACE_NUM_PAGES * PAGE_SIZE)
++
++#endif /* _VMW_PVSCSI_H_ */
+diff --git a/drivers/serial/kgdboc.c b/drivers/serial/kgdboc.c
+index eadc1ab..2d81457 100644
+--- a/drivers/serial/kgdboc.c
++++ b/drivers/serial/kgdboc.c
+@@ -18,7 +18,7 @@
+
+ #define MAX_CONFIG_LEN 40
+
+-static struct kgdb_io kgdboc_io_ops;
++static const struct kgdb_io kgdboc_io_ops;
+
+ /* -1 = init not run yet, 0 = unconfigured, 1 = configured. */
+ static int configured = -1;
+@@ -154,7 +154,7 @@ static void kgdboc_post_exp_handler(void)
+ module_put(THIS_MODULE);
+ }
+
+-static struct kgdb_io kgdboc_io_ops = {
++static const struct kgdb_io kgdboc_io_ops = {
+ .name = "kgdboc",
+ .read_char = kgdboc_get_char,
+ .write_char = kgdboc_put_char,
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index b76f246..7f41af7 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -774,7 +774,7 @@ int spi_sync(struct spi_device *spi, struct spi_message *message)
+ EXPORT_SYMBOL_GPL(spi_sync);
+
+ /* portable code must never pass more than 32 bytes */
+-#define SPI_BUFSIZ max(32,SMP_CACHE_BYTES)
++#define SPI_BUFSIZ max(32U,SMP_CACHE_BYTES)
+
+ static u8 *buf;
+
+diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c
+index b9b37ff..19dfa23 100644
+--- a/drivers/staging/android/binder.c
++++ b/drivers/staging/android/binder.c
+@@ -2761,7 +2761,7 @@ static void binder_vma_close(struct vm_area_struct *vma)
+ binder_defer_work(proc, BINDER_DEFERRED_PUT_FILES);
+ }
+
+-static struct vm_operations_struct binder_vm_ops = {
++static const struct vm_operations_struct binder_vm_ops = {
+ .open = binder_vma_open,
+ .close = binder_vma_close,
+ };
+diff --git a/drivers/staging/b3dfg/b3dfg.c b/drivers/staging/b3dfg/b3dfg.c
+index cda26bb..39fed3f 100644
+--- a/drivers/staging/b3dfg/b3dfg.c
++++ b/drivers/staging/b3dfg/b3dfg.c
+@@ -455,7 +455,7 @@ static int b3dfg_vma_fault(struct vm_area_struct *vma,
+ return VM_FAULT_NOPAGE;
+ }
+
+-static struct vm_operations_struct b3dfg_vm_ops = {
++static const struct vm_operations_struct b3dfg_vm_ops = {
+ .fault = b3dfg_vma_fault,
+ };
+
+@@ -848,7 +848,7 @@ static int b3dfg_mmap(struct file *filp, struct vm_area_struct *vma)
+ return r;
+ }
+
+-static struct file_operations b3dfg_fops = {
++static const struct file_operations b3dfg_fops = {
+ .owner = THIS_MODULE,
+ .open = b3dfg_open,
+ .release = b3dfg_release,
+diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
+index 908f25a..c9a579b 100644
+--- a/drivers/staging/comedi/comedi_fops.c
++++ b/drivers/staging/comedi/comedi_fops.c
+@@ -1389,7 +1389,7 @@ void comedi_unmap(struct vm_area_struct *area)
+ mutex_unlock(&dev->mutex);
+ }
+
+-static struct vm_operations_struct comedi_vm_ops = {
++static const struct vm_operations_struct comedi_vm_ops = {
+ .close = comedi_unmap,
+ };
+
+diff --git a/drivers/staging/dream/qdsp5/adsp_driver.c b/drivers/staging/dream/qdsp5/adsp_driver.c
+index e55a0db..577b776 100644
+--- a/drivers/staging/dream/qdsp5/adsp_driver.c
++++ b/drivers/staging/dream/qdsp5/adsp_driver.c
+@@ -576,7 +576,7 @@ static struct adsp_device *inode_to_device(struct inode *inode)
+ static dev_t adsp_devno;
+ static struct class *adsp_class;
+
+-static struct file_operations adsp_fops = {
++static const struct file_operations adsp_fops = {
+ .owner = THIS_MODULE,
+ .open = adsp_open,
+ .unlocked_ioctl = adsp_ioctl,
+diff --git a/drivers/staging/dream/qdsp5/audio_aac.c b/drivers/staging/dream/qdsp5/audio_aac.c
+index ad2390f..4116ee8 100644
+--- a/drivers/staging/dream/qdsp5/audio_aac.c
++++ b/drivers/staging/dream/qdsp5/audio_aac.c
+@@ -1022,7 +1022,7 @@ done:
+ return rc;
+ }
+
+-static struct file_operations audio_aac_fops = {
++static const struct file_operations audio_aac_fops = {
+ .owner = THIS_MODULE,
+ .open = audio_open,
+ .release = audio_release,
+diff --git a/drivers/staging/dream/qdsp5/audio_amrnb.c b/drivers/staging/dream/qdsp5/audio_amrnb.c
+index cd818a5..870b37b 100644
+--- a/drivers/staging/dream/qdsp5/audio_amrnb.c
++++ b/drivers/staging/dream/qdsp5/audio_amrnb.c
+@@ -833,7 +833,7 @@ done:
+ return rc;
+ }
+
+-static struct file_operations audio_amrnb_fops = {
++static const struct file_operations audio_amrnb_fops = {
+ .owner = THIS_MODULE,
+ .open = audamrnb_open,
+ .release = audamrnb_release,
+diff --git a/drivers/staging/dream/qdsp5/audio_evrc.c b/drivers/staging/dream/qdsp5/audio_evrc.c
+index 4b43e18..cedafda 100644
+--- a/drivers/staging/dream/qdsp5/audio_evrc.c
++++ b/drivers/staging/dream/qdsp5/audio_evrc.c
+@@ -805,7 +805,7 @@ dma_fail:
+ return rc;
+ }
+
+-static struct file_operations audio_evrc_fops = {
++static const struct file_operations audio_evrc_fops = {
+ .owner = THIS_MODULE,
+ .open = audevrc_open,
+ .release = audevrc_release,
+diff --git a/drivers/staging/dream/qdsp5/audio_in.c b/drivers/staging/dream/qdsp5/audio_in.c
+index 3d950a2..9431118 100644
+--- a/drivers/staging/dream/qdsp5/audio_in.c
++++ b/drivers/staging/dream/qdsp5/audio_in.c
+@@ -913,7 +913,7 @@ static int audpre_open(struct inode *inode, struct file *file)
+ return 0;
+ }
+
+-static struct file_operations audio_fops = {
++static const struct file_operations audio_fops = {
+ .owner = THIS_MODULE,
+ .open = audio_in_open,
+ .release = audio_in_release,
+@@ -922,7 +922,7 @@ static struct file_operations audio_fops = {
+ .unlocked_ioctl = audio_in_ioctl,
+ };
+
+-static struct file_operations audpre_fops = {
++static const struct file_operations audpre_fops = {
+ .owner = THIS_MODULE,
+ .open = audpre_open,
+ .unlocked_ioctl = audpre_ioctl,
+diff --git a/drivers/staging/dream/qdsp5/audio_mp3.c b/drivers/staging/dream/qdsp5/audio_mp3.c
+index b95574f..286c2f4 100644
+--- a/drivers/staging/dream/qdsp5/audio_mp3.c
++++ b/drivers/staging/dream/qdsp5/audio_mp3.c
+@@ -941,7 +941,7 @@ done:
+ return rc;
+ }
+
+-static struct file_operations audio_mp3_fops = {
++static const struct file_operations audio_mp3_fops = {
+ .owner = THIS_MODULE,
+ .open = audio_open,
+ .release = audio_release,
+diff --git a/drivers/staging/dream/qdsp5/audio_out.c b/drivers/staging/dream/qdsp5/audio_out.c
+index d1adcf6..f8f9833 100644
+--- a/drivers/staging/dream/qdsp5/audio_out.c
++++ b/drivers/staging/dream/qdsp5/audio_out.c
+@@ -810,7 +810,7 @@ static int audpp_open(struct inode *inode, struct file *file)
+ return 0;
+ }
+
+-static struct file_operations audio_fops = {
++static const struct file_operations audio_fops = {
+ .owner = THIS_MODULE,
+ .open = audio_open,
+ .release = audio_release,
+@@ -819,7 +819,7 @@ static struct file_operations audio_fops = {
+ .unlocked_ioctl = audio_ioctl,
+ };
+
+-static struct file_operations audpp_fops = {
++static const struct file_operations audpp_fops = {
+ .owner = THIS_MODULE,
+ .open = audpp_open,
+ .unlocked_ioctl = audpp_ioctl,
+diff --git a/drivers/staging/dream/qdsp5/audio_qcelp.c b/drivers/staging/dream/qdsp5/audio_qcelp.c
+index f0f50e3..f6b9dbc 100644
+--- a/drivers/staging/dream/qdsp5/audio_qcelp.c
++++ b/drivers/staging/dream/qdsp5/audio_qcelp.c
+@@ -816,7 +816,7 @@ err:
+ return rc;
+ }
+
+-static struct file_operations audio_qcelp_fops = {
++static const struct file_operations audio_qcelp_fops = {
+ .owner = THIS_MODULE,
+ .open = audqcelp_open,
+ .release = audqcelp_release,
+diff --git a/drivers/staging/dream/qdsp5/snd.c b/drivers/staging/dream/qdsp5/snd.c
+index 037d7ff..5469ec3 100644
+--- a/drivers/staging/dream/qdsp5/snd.c
++++ b/drivers/staging/dream/qdsp5/snd.c
+@@ -242,7 +242,7 @@ err:
+ return rc;
+ }
+
+-static struct file_operations snd_fops = {
++static const struct file_operations snd_fops = {
+ .owner = THIS_MODULE,
+ .open = snd_open,
+ .release = snd_release,
+diff --git a/drivers/staging/dream/smd/smd_qmi.c b/drivers/staging/dream/smd/smd_qmi.c
+index d4e7d88..0ea632a 100644
+--- a/drivers/staging/dream/smd/smd_qmi.c
++++ b/drivers/staging/dream/smd/smd_qmi.c
+@@ -793,7 +793,7 @@ static int qmi_release(struct inode *ip, struct file *fp)
+ return 0;
+ }
+
+-static struct file_operations qmi_fops = {
++static const struct file_operations qmi_fops = {
+ .owner = THIS_MODULE,
+ .read = qmi_read,
+ .write = qmi_write,
+diff --git a/drivers/staging/dream/smd/smd_rpcrouter_device.c b/drivers/staging/dream/smd/smd_rpcrouter_device.c
+index cd3910b..ff053d3 100644
+--- a/drivers/staging/dream/smd/smd_rpcrouter_device.c
++++ b/drivers/staging/dream/smd/smd_rpcrouter_device.c
+@@ -214,7 +214,7 @@ static long rpcrouter_ioctl(struct file *filp, unsigned int cmd,
+ return rc;
+ }
+
+-static struct file_operations rpcrouter_server_fops = {
++static const struct file_operations rpcrouter_server_fops = {
+ .owner = THIS_MODULE,
+ .open = rpcrouter_open,
+ .release = rpcrouter_release,
+@@ -224,7 +224,7 @@ static struct file_operations rpcrouter_server_fops = {
+ .unlocked_ioctl = rpcrouter_ioctl,
+ };
+
+-static struct file_operations rpcrouter_router_fops = {
++static const struct file_operations rpcrouter_router_fops = {
+ .owner = THIS_MODULE,
+ .open = rpcrouter_open,
+ .release = rpcrouter_release,
+diff --git a/drivers/staging/dst/dcore.c b/drivers/staging/dst/dcore.c
+index c24e4e0..629999b 100644
+--- a/drivers/staging/dst/dcore.c
++++ b/drivers/staging/dst/dcore.c
+@@ -149,7 +149,7 @@ static int dst_bdev_release(struct gendisk *disk, fmode_t mode)
+ return 0;
+ }
+
+-static struct block_device_operations dst_blk_ops = {
++static const struct block_device_operations dst_blk_ops = {
+ .open = dst_bdev_open,
+ .release = dst_bdev_release,
+ .owner = THIS_MODULE,
+@@ -588,7 +588,7 @@ static struct dst_node *dst_alloc_node(struct dst_ctl *ctl,
+ n->size = ctl->size;
+
+ atomic_set(&n->refcnt, 1);
+- atomic_long_set(&n->gen, 0);
++ atomic_long_set_unchecked(&n->gen, 0);
+ snprintf(n->name, sizeof(n->name), "%s", ctl->name);
+
+ err = dst_node_sysfs_init(n);
+@@ -855,7 +855,7 @@ static void cn_dst_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
+ struct dst_node *n = NULL, *tmp;
+ unsigned int hash;
+
+- if (!cap_raised(nsp->eff_cap, CAP_SYS_ADMIN)) {
++ if (!capable(CAP_SYS_ADMIN)) {
+ err = -EPERM;
+ goto out;
+ }
+diff --git a/drivers/staging/dst/trans.c b/drivers/staging/dst/trans.c
+index 557d372..8d84422 100644
+--- a/drivers/staging/dst/trans.c
++++ b/drivers/staging/dst/trans.c
+@@ -169,7 +169,7 @@ int dst_process_bio(struct dst_node *n, struct bio *bio)
+ t->error = 0;
+ t->retries = 0;
+ atomic_set(&t->refcnt, 1);
+- t->gen = atomic_long_inc_return(&n->gen);
++ t->gen = atomic_long_inc_return_unchecked(&n->gen);
+
+ t->enc = bio_data_dir(bio);
+ dst_bio_to_cmd(bio, &t->cmd, DST_IO, t->gen);
+diff --git a/drivers/staging/et131x/et1310_tx.c b/drivers/staging/et131x/et1310_tx.c
+index 94f7752..d051514 100644
+--- a/drivers/staging/et131x/et1310_tx.c
++++ b/drivers/staging/et131x/et1310_tx.c
+@@ -710,11 +710,11 @@ inline void et131x_free_send_packet(struct et131x_adapter *etdev,
+ struct net_device_stats *stats = &etdev->net_stats;
+
+ if (pMpTcb->Flags & fMP_DEST_BROAD)
+- atomic_inc(&etdev->Stats.brdcstxmt);
++ atomic_inc_unchecked(&etdev->Stats.brdcstxmt);
+ else if (pMpTcb->Flags & fMP_DEST_MULTI)
+- atomic_inc(&etdev->Stats.multixmt);
++ atomic_inc_unchecked(&etdev->Stats.multixmt);
+ else
+- atomic_inc(&etdev->Stats.unixmt);
++ atomic_inc_unchecked(&etdev->Stats.unixmt);
+
+ if (pMpTcb->Packet) {
+ stats->tx_bytes += pMpTcb->Packet->len;
+diff --git a/drivers/staging/et131x/et131x_adapter.h b/drivers/staging/et131x/et131x_adapter.h
+index 1dfe06f..f469b4d 100644
+--- a/drivers/staging/et131x/et131x_adapter.h
++++ b/drivers/staging/et131x/et131x_adapter.h
+@@ -145,11 +145,11 @@ typedef struct _ce_stats_t {
+ * operations
+ */
+ u32 unircv; /* # multicast packets received */
+- atomic_t unixmt; /* # multicast packets for Tx */
++ atomic_unchecked_t unixmt; /* # multicast packets for Tx */
+ u32 multircv; /* # multicast packets received */
+- atomic_t multixmt; /* # multicast packets for Tx */
++ atomic_unchecked_t multixmt; /* # multicast packets for Tx */
+ u32 brdcstrcv; /* # broadcast packets received */
+- atomic_t brdcstxmt; /* # broadcast packets for Tx */
++ atomic_unchecked_t brdcstxmt; /* # broadcast packets for Tx */
+ u32 norcvbuf; /* # Rx packets discarded */
+ u32 noxmtbuf; /* # Tx packets discarded */
+
+diff --git a/drivers/staging/go7007/go7007-v4l2.c b/drivers/staging/go7007/go7007-v4l2.c
+index 4bd353a..e28f455 100644
+--- a/drivers/staging/go7007/go7007-v4l2.c
++++ b/drivers/staging/go7007/go7007-v4l2.c
+@@ -1700,7 +1700,7 @@ static int go7007_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+ return 0;
+ }
+
+-static struct vm_operations_struct go7007_vm_ops = {
++static const struct vm_operations_struct go7007_vm_ops = {
+ .open = go7007_vm_open,
+ .close = go7007_vm_close,
+ .fault = go7007_vm_fault,
+diff --git a/drivers/staging/hv/Channel.c b/drivers/staging/hv/Channel.c
+index 366dc95..b974d87 100644
+--- a/drivers/staging/hv/Channel.c
++++ b/drivers/staging/hv/Channel.c
+@@ -464,8 +464,8 @@ int VmbusChannelEstablishGpadl(struct vmbus_channel *Channel, void *Kbuffer,
+
+ DPRINT_ENTER(VMBUS);
+
+- nextGpadlHandle = atomic_read(&gVmbusConnection.NextGpadlHandle);
+- atomic_inc(&gVmbusConnection.NextGpadlHandle);
++ nextGpadlHandle = atomic_read_unchecked(&gVmbusConnection.NextGpadlHandle);
++ atomic_inc_unchecked(&gVmbusConnection.NextGpadlHandle);
+
+ VmbusChannelCreateGpadlHeader(Kbuffer, Size, &msgInfo, &msgCount);
+ ASSERT(msgInfo != NULL);
+diff --git a/drivers/staging/hv/Hv.c b/drivers/staging/hv/Hv.c
+index b12237f..01ae28a 100644
+--- a/drivers/staging/hv/Hv.c
++++ b/drivers/staging/hv/Hv.c
+@@ -161,7 +161,7 @@ static u64 HvDoHypercall(u64 Control, void *Input, void *Output)
+ u64 outputAddress = (Output) ? virt_to_phys(Output) : 0;
+ u32 outputAddressHi = outputAddress >> 32;
+ u32 outputAddressLo = outputAddress & 0xFFFFFFFF;
+- volatile void *hypercallPage = gHvContext.HypercallPage;
++ volatile void *hypercallPage = ktva_ktla(gHvContext.HypercallPage);
+
+ DPRINT_DBG(VMBUS, "Hypercall <control %llx input %p output %p>",
+ Control, Input, Output);
+diff --git a/drivers/staging/hv/VmbusApi.h b/drivers/staging/hv/VmbusApi.h
+index d089bb1..2ebc158 100644
+--- a/drivers/staging/hv/VmbusApi.h
++++ b/drivers/staging/hv/VmbusApi.h
+@@ -109,7 +109,7 @@ struct vmbus_channel_interface {
+ u32 *GpadlHandle);
+ int (*TeardownGpadl)(struct hv_device *device, u32 GpadlHandle);
+ void (*GetInfo)(struct hv_device *dev, struct hv_device_info *devinfo);
+-};
++} __no_const;
+
+ /* Base driver object */
+ struct hv_driver {
+diff --git a/drivers/staging/hv/VmbusPrivate.h b/drivers/staging/hv/VmbusPrivate.h
+index 5a37cce..6ecc88c 100644
+--- a/drivers/staging/hv/VmbusPrivate.h
++++ b/drivers/staging/hv/VmbusPrivate.h
+@@ -59,7 +59,7 @@ enum VMBUS_CONNECT_STATE {
+ struct VMBUS_CONNECTION {
+ enum VMBUS_CONNECT_STATE ConnectState;
+
+- atomic_t NextGpadlHandle;
++ atomic_unchecked_t NextGpadlHandle;
+
+ /*
+ * Represents channel interrupts. Each bit position represents a
+diff --git a/drivers/staging/hv/blkvsc_drv.c b/drivers/staging/hv/blkvsc_drv.c
+index 871a202..ca50ddf 100644
+--- a/drivers/staging/hv/blkvsc_drv.c
++++ b/drivers/staging/hv/blkvsc_drv.c
+@@ -153,7 +153,7 @@ static int blkvsc_ringbuffer_size = BLKVSC_RING_BUFFER_SIZE;
+ /* The one and only one */
+ static struct blkvsc_driver_context g_blkvsc_drv;
+
+-static struct block_device_operations block_ops = {
++static const struct block_device_operations block_ops = {
+ .owner = THIS_MODULE,
+ .open = blkvsc_open,
+ .release = blkvsc_release,
+diff --git a/drivers/staging/hv/vmbus_drv.c b/drivers/staging/hv/vmbus_drv.c
+index 6acc49a..fbc8d46 100644
+--- a/drivers/staging/hv/vmbus_drv.c
++++ b/drivers/staging/hv/vmbus_drv.c
+@@ -532,7 +532,7 @@ static int vmbus_child_device_register(struct hv_device *root_device_obj,
+ to_device_context(root_device_obj);
+ struct device_context *child_device_ctx =
+ to_device_context(child_device_obj);
+- static atomic_t device_num = ATOMIC_INIT(0);
++ static atomic_unchecked_t device_num = ATOMIC_INIT(0);
+
+ DPRINT_ENTER(VMBUS_DRV);
+
+@@ -541,7 +541,7 @@ static int vmbus_child_device_register(struct hv_device *root_device_obj,
+
+ /* Set the device name. Otherwise, device_register() will fail. */
+ dev_set_name(&child_device_ctx->device, "vmbus_0_%d",
+- atomic_inc_return(&device_num));
++ atomic_inc_return_unchecked(&device_num));
+
+ /* The new device belongs to this bus */
+ child_device_ctx->device.bus = &g_vmbus_drv.bus; /* device->dev.bus; */
+diff --git a/drivers/staging/iio/ring_generic.h b/drivers/staging/iio/ring_generic.h
+index d926189..17b19fd 100644
+--- a/drivers/staging/iio/ring_generic.h
++++ b/drivers/staging/iio/ring_generic.h
+@@ -87,7 +87,7 @@ struct iio_ring_access_funcs {
+
+ int (*is_enabled)(struct iio_ring_buffer *ring);
+ int (*enable)(struct iio_ring_buffer *ring);
+-};
++} __no_const;
+
+ /**
+ * struct iio_ring_buffer - general ring buffer structure
+diff --git a/drivers/staging/octeon/ethernet-rx.c b/drivers/staging/octeon/ethernet-rx.c
+index 1b237b7..88c624e 100644
+--- a/drivers/staging/octeon/ethernet-rx.c
++++ b/drivers/staging/octeon/ethernet-rx.c
+@@ -406,11 +406,11 @@ void cvm_oct_tasklet_rx(unsigned long unused)
+ /* Increment RX stats for virtual ports */
+ if (work->ipprt >= CVMX_PIP_NUM_INPUT_PORTS) {
+ #ifdef CONFIG_64BIT
+- atomic64_add(1, (atomic64_t *)&priv->stats.rx_packets);
+- atomic64_add(skb->len, (atomic64_t *)&priv->stats.rx_bytes);
++ atomic64_add_unchecked(1, (atomic64_unchecked_t *)&priv->stats.rx_packets);
++ atomic64_add_unchecked(skb->len, (atomic64_unchecked_t *)&priv->stats.rx_bytes);
+ #else
+- atomic_add(1, (atomic_t *)&priv->stats.rx_packets);
+- atomic_add(skb->len, (atomic_t *)&priv->stats.rx_bytes);
++ atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_packets);
++ atomic_add_unchecked(skb->len, (atomic_unchecked_t *)&priv->stats.rx_bytes);
+ #endif
+ }
+ netif_receive_skb(skb);
+@@ -424,9 +424,9 @@ void cvm_oct_tasklet_rx(unsigned long unused)
+ dev->name);
+ */
+ #ifdef CONFIG_64BIT
+- atomic64_add(1, (atomic64_t *)&priv->stats.rx_dropped);
++ atomic64_add_unchecked(1, (atomic64_t *)&priv->stats.rx_dropped);
+ #else
+- atomic_add(1, (atomic_t *)&priv->stats.rx_dropped);
++ atomic_add_unchecked(1, (atomic_t *)&priv->stats.rx_dropped);
+ #endif
+ dev_kfree_skb_irq(skb);
+ }
+diff --git a/drivers/staging/octeon/ethernet.c b/drivers/staging/octeon/ethernet.c
+index 492c502..d9909f1 100644
+--- a/drivers/staging/octeon/ethernet.c
++++ b/drivers/staging/octeon/ethernet.c
+@@ -294,11 +294,11 @@ static struct net_device_stats *cvm_oct_common_get_stats(struct net_device *dev)
+ * since the RX tasklet also increments it.
+ */
+ #ifdef CONFIG_64BIT
+- atomic64_add(rx_status.dropped_packets,
+- (atomic64_t *)&priv->stats.rx_dropped);
++ atomic64_add_unchecked(rx_status.dropped_packets,
++ (atomic64_unchecked_t *)&priv->stats.rx_dropped);
+ #else
+- atomic_add(rx_status.dropped_packets,
+- (atomic_t *)&priv->stats.rx_dropped);
++ atomic_add_unchecked(rx_status.dropped_packets,
++ (atomic_unchecked_t *)&priv->stats.rx_dropped);
+ #endif
+ }
+
+diff --git a/drivers/staging/otus/80211core/pub_zfi.h b/drivers/staging/otus/80211core/pub_zfi.h
+index a35bd5d..28fff45 100644
+--- a/drivers/staging/otus/80211core/pub_zfi.h
++++ b/drivers/staging/otus/80211core/pub_zfi.h
+@@ -531,7 +531,7 @@ struct zsCbFuncTbl
+ u8_t (*zfcbClassifyTxPacket)(zdev_t* dev, zbuf_t* buf);
+
+ void (*zfcbHwWatchDogNotify)(zdev_t* dev);
+-};
++} __no_const;
+
+ extern void zfZeroMemory(u8_t* va, u16_t length);
+ #define ZM_INIT_CB_FUNC_TABLE(p) zfZeroMemory((u8_t *)p, sizeof(struct zsCbFuncTbl));
+diff --git a/drivers/staging/panel/panel.c b/drivers/staging/panel/panel.c
+index c39a25f..696f5aa 100644
+--- a/drivers/staging/panel/panel.c
++++ b/drivers/staging/panel/panel.c
+@@ -1305,7 +1305,7 @@ static int lcd_release(struct inode *inode, struct file *file)
+ return 0;
+ }
+
+-static struct file_operations lcd_fops = {
++static const struct file_operations lcd_fops = {
+ .write = lcd_write,
+ .open = lcd_open,
+ .release = lcd_release,
+@@ -1565,7 +1565,7 @@ static int keypad_release(struct inode *inode, struct file *file)
+ return 0;
+ }
+
+-static struct file_operations keypad_fops = {
++static const struct file_operations keypad_fops = {
+ .read = keypad_read, /* read */
+ .open = keypad_open, /* open */
+ .release = keypad_release, /* close */
+diff --git a/drivers/staging/phison/phison.c b/drivers/staging/phison/phison.c
+index 270ebcb..37e46af 100644
+--- a/drivers/staging/phison/phison.c
++++ b/drivers/staging/phison/phison.c
+@@ -43,7 +43,7 @@ static struct scsi_host_template phison_sht = {
+ ATA_BMDMA_SHT(DRV_NAME),
+ };
+
+-static struct ata_port_operations phison_ops = {
++static const struct ata_port_operations phison_ops = {
+ .inherits = &ata_bmdma_port_ops,
+ .prereset = phison_pre_reset,
+ };
+diff --git a/drivers/staging/poch/poch.c b/drivers/staging/poch/poch.c
+index 2eb8e3d..57616a7 100644
+--- a/drivers/staging/poch/poch.c
++++ b/drivers/staging/poch/poch.c
+@@ -1057,7 +1057,7 @@ static int poch_ioctl(struct inode *inode, struct file *filp,
+ return 0;
+ }
+
+-static struct file_operations poch_fops = {
++static const struct file_operations poch_fops = {
+ .owner = THIS_MODULE,
+ .open = poch_open,
+ .release = poch_release,
+diff --git a/drivers/staging/pohmelfs/config.c b/drivers/staging/pohmelfs/config.c
+index 5d04bf5..d4baff2 100644
+--- a/drivers/staging/pohmelfs/config.c
++++ b/drivers/staging/pohmelfs/config.c
+@@ -531,7 +531,7 @@ static void pohmelfs_cn_callback(struct cn_msg *msg, struct netlink_skb_parms *n
+ {
+ int err;
+
+- if (!cap_raised(nsp->eff_cap, CAP_SYS_ADMIN))
++ if (!capable(CAP_SYS_ADMIN))
+ return;
+
+ switch (msg->flags) {
+diff --git a/drivers/staging/pohmelfs/inode.c b/drivers/staging/pohmelfs/inode.c
+index c94de31..19402bc 100644
+--- a/drivers/staging/pohmelfs/inode.c
++++ b/drivers/staging/pohmelfs/inode.c
+@@ -1850,7 +1850,7 @@ static int pohmelfs_fill_super(struct super_block *sb, void *data, int silent)
+ mutex_init(&psb->mcache_lock);
+ psb->mcache_root = RB_ROOT;
+ psb->mcache_timeout = msecs_to_jiffies(5000);
+- atomic_long_set(&psb->mcache_gen, 0);
++ atomic_long_set_unchecked(&psb->mcache_gen, 0);
+
+ psb->trans_max_pages = 100;
+
+@@ -1865,7 +1865,7 @@ static int pohmelfs_fill_super(struct super_block *sb, void *data, int silent)
+ INIT_LIST_HEAD(&psb->crypto_ready_list);
+ INIT_LIST_HEAD(&psb->crypto_active_list);
+
+- atomic_set(&psb->trans_gen, 1);
++ atomic_set_unchecked(&psb->trans_gen, 1);
+ atomic_long_set(&psb->total_inodes, 0);
+
+ mutex_init(&psb->state_lock);
+diff --git a/drivers/staging/pohmelfs/mcache.c b/drivers/staging/pohmelfs/mcache.c
+index e22665c..a2a9390 100644
+--- a/drivers/staging/pohmelfs/mcache.c
++++ b/drivers/staging/pohmelfs/mcache.c
+@@ -121,7 +121,7 @@ struct pohmelfs_mcache *pohmelfs_mcache_alloc(struct pohmelfs_sb *psb, u64 start
+ m->data = data;
+ m->start = start;
+ m->size = size;
+- m->gen = atomic_long_inc_return(&psb->mcache_gen);
++ m->gen = atomic_long_inc_return_unchecked(&psb->mcache_gen);
+
+ mutex_lock(&psb->mcache_lock);
+ err = pohmelfs_mcache_insert(psb, m);
+diff --git a/drivers/staging/pohmelfs/netfs.h b/drivers/staging/pohmelfs/netfs.h
+index 623a07d..4035c19 100644
+--- a/drivers/staging/pohmelfs/netfs.h
++++ b/drivers/staging/pohmelfs/netfs.h
+@@ -570,14 +570,14 @@ struct pohmelfs_config;
+ struct pohmelfs_sb {
+ struct rb_root mcache_root;
+ struct mutex mcache_lock;
+- atomic_long_t mcache_gen;
++ atomic_long_unchecked_t mcache_gen;
+ unsigned long mcache_timeout;
+
+ unsigned int idx;
+
+ unsigned int trans_retries;
+
+- atomic_t trans_gen;
++ atomic_unchecked_t trans_gen;
+
+ unsigned int crypto_attached_size;
+ unsigned int crypto_align_size;
+diff --git a/drivers/staging/pohmelfs/trans.c b/drivers/staging/pohmelfs/trans.c
+index 36a2535..0591bf4 100644
+--- a/drivers/staging/pohmelfs/trans.c
++++ b/drivers/staging/pohmelfs/trans.c
+@@ -492,7 +492,7 @@ int netfs_trans_finish(struct netfs_trans *t, struct pohmelfs_sb *psb)
+ int err;
+ struct netfs_cmd *cmd = t->iovec.iov_base;
+
+- t->gen = atomic_inc_return(&psb->trans_gen);
++ t->gen = atomic_inc_return_unchecked(&psb->trans_gen);
+
+ cmd->size = t->iovec.iov_len - sizeof(struct netfs_cmd) +
+ t->attached_size + t->attached_pages * sizeof(struct netfs_cmd);
+diff --git a/drivers/staging/sep/sep_driver.c b/drivers/staging/sep/sep_driver.c
+index f890a16..509ece8 100644
+--- a/drivers/staging/sep/sep_driver.c
++++ b/drivers/staging/sep/sep_driver.c
+@@ -2603,7 +2603,7 @@ static struct pci_driver sep_pci_driver = {
+ static dev_t sep_devno;
+
+ /* the files operations structure of the driver */
+-static struct file_operations sep_file_operations = {
++static const struct file_operations sep_file_operations = {
+ .owner = THIS_MODULE,
+ .ioctl = sep_ioctl,
+ .poll = sep_poll,
+diff --git a/drivers/staging/usbip/usbip_common.h b/drivers/staging/usbip/usbip_common.h
+index 5e16bc3..7655b10 100644
+--- a/drivers/staging/usbip/usbip_common.h
++++ b/drivers/staging/usbip/usbip_common.h
+@@ -374,7 +374,7 @@ struct usbip_device {
+ void (*shutdown)(struct usbip_device *);
+ void (*reset)(struct usbip_device *);
+ void (*unusable)(struct usbip_device *);
+- } eh_ops;
++ } __no_const eh_ops;
+ };
+
+
+diff --git a/drivers/staging/usbip/vhci.h b/drivers/staging/usbip/vhci.h
+index 57f7946..d9df23d 100644
+--- a/drivers/staging/usbip/vhci.h
++++ b/drivers/staging/usbip/vhci.h
+@@ -92,7 +92,7 @@ struct vhci_hcd {
+ unsigned resuming:1;
+ unsigned long re_timeout;
+
+- atomic_t seqnum;
++ atomic_unchecked_t seqnum;
+
+ /*
+ * NOTE:
+diff --git a/drivers/staging/usbip/vhci_hcd.c b/drivers/staging/usbip/vhci_hcd.c
+index 20cd7db..c2693ff 100644
+--- a/drivers/staging/usbip/vhci_hcd.c
++++ b/drivers/staging/usbip/vhci_hcd.c
+@@ -534,7 +534,7 @@ static void vhci_tx_urb(struct urb *urb)
+ return;
+ }
+
+- priv->seqnum = atomic_inc_return(&the_controller->seqnum);
++ priv->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
+ if (priv->seqnum == 0xffff)
+ usbip_uinfo("seqnum max\n");
+
+@@ -793,7 +793,7 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
+ return -ENOMEM;
+ }
+
+- unlink->seqnum = atomic_inc_return(&the_controller->seqnum);
++ unlink->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
+ if (unlink->seqnum == 0xffff)
+ usbip_uinfo("seqnum max\n");
+
+@@ -988,7 +988,7 @@ static int vhci_start(struct usb_hcd *hcd)
+ vdev->rhport = rhport;
+ }
+
+- atomic_set(&vhci->seqnum, 0);
++ atomic_set_unchecked(&vhci->seqnum, 0);
+ spin_lock_init(&vhci->lock);
+
+
+diff --git a/drivers/staging/usbip/vhci_rx.c b/drivers/staging/usbip/vhci_rx.c
+index 7fd76fe..673695a 100644
+--- a/drivers/staging/usbip/vhci_rx.c
++++ b/drivers/staging/usbip/vhci_rx.c
+@@ -79,7 +79,7 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev,
+ usbip_uerr("cannot find a urb of seqnum %u\n",
+ pdu->base.seqnum);
+ usbip_uinfo("max seqnum %d\n",
+- atomic_read(&the_controller->seqnum));
++ atomic_read_unchecked(&the_controller->seqnum));
+ usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
+ return;
+ }
+diff --git a/drivers/staging/vme/devices/vme_user.c b/drivers/staging/vme/devices/vme_user.c
+index 7891288..8e31300 100644
+--- a/drivers/staging/vme/devices/vme_user.c
++++ b/drivers/staging/vme/devices/vme_user.c
+@@ -136,7 +136,7 @@ static int vme_user_ioctl(struct inode *, struct file *, unsigned int,
+ static int __init vme_user_probe(struct device *, int, int);
+ static int __exit vme_user_remove(struct device *, int, int);
+
+-static struct file_operations vme_user_fops = {
++static const struct file_operations vme_user_fops = {
+ .open = vme_user_open,
+ .release = vme_user_release,
+ .read = vme_user_read,
+diff --git a/drivers/staging/vt6655/hostap.c b/drivers/staging/vt6655/hostap.c
+index 58abf44..00c1fc8 100644
+--- a/drivers/staging/vt6655/hostap.c
++++ b/drivers/staging/vt6655/hostap.c
+@@ -84,7 +84,7 @@ static int hostap_enable_hostapd(PSDevice pDevice, int rtnl_locked)
+ PSDevice apdev_priv;
+ struct net_device *dev = pDevice->dev;
+ int ret;
+- const struct net_device_ops apdev_netdev_ops = {
++ net_device_ops_no_const apdev_netdev_ops = {
+ .ndo_start_xmit = pDevice->tx_80211,
+ };
+
+diff --git a/drivers/staging/vt6656/hostap.c b/drivers/staging/vt6656/hostap.c
+index 0c8267a..db1f363 100644
+--- a/drivers/staging/vt6656/hostap.c
++++ b/drivers/staging/vt6656/hostap.c
+@@ -86,7 +86,7 @@ static int hostap_enable_hostapd(PSDevice pDevice, int rtnl_locked)
+ PSDevice apdev_priv;
+ struct net_device *dev = pDevice->dev;
+ int ret;
+- const struct net_device_ops apdev_netdev_ops = {
++ net_device_ops_no_const apdev_netdev_ops = {
+ .ndo_start_xmit = pDevice->tx_80211,
+ };
+
+diff --git a/drivers/staging/wlan-ng/hfa384x_usb.c b/drivers/staging/wlan-ng/hfa384x_usb.c
+index 925678b..da7f5ed 100644
+--- a/drivers/staging/wlan-ng/hfa384x_usb.c
++++ b/drivers/staging/wlan-ng/hfa384x_usb.c
+@@ -205,7 +205,7 @@ static void unlocked_usbctlx_complete(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx);
+
+ struct usbctlx_completor {
+ int (*complete) (struct usbctlx_completor *);
+-};
++} __no_const;
+ typedef struct usbctlx_completor usbctlx_completor_t;
+
+ static int
+diff --git a/drivers/telephony/ixj.c b/drivers/telephony/ixj.c
+index 40de151..924f268 100644
+--- a/drivers/telephony/ixj.c
++++ b/drivers/telephony/ixj.c
+@@ -4976,6 +4976,8 @@ static int ixj_daa_cid_read(IXJ *j)
+ bool mContinue;
+ char *pIn, *pOut;
+
++ pax_track_stack();
++
+ if (!SCI_Prepare(j))
+ return 0;
+
+diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
+index e941367..b631f5a 100644
+--- a/drivers/uio/uio.c
++++ b/drivers/uio/uio.c
+@@ -23,6 +23,7 @@
+ #include <linux/string.h>
+ #include <linux/kobject.h>
+ #include <linux/uio_driver.h>
++#include <asm/local.h>
+
+ #define UIO_MAX_DEVICES 255
+
+@@ -30,10 +31,10 @@ struct uio_device {
+ struct module *owner;
+ struct device *dev;
+ int minor;
+- atomic_t event;
++ atomic_unchecked_t event;
+ struct fasync_struct *async_queue;
+ wait_queue_head_t wait;
+- int vma_count;
++ local_t vma_count;
+ struct uio_info *info;
+ struct kobject *map_dir;
+ struct kobject *portio_dir;
+@@ -129,7 +130,7 @@ static ssize_t map_type_show(struct kobject *kobj, struct attribute *attr,
+ return entry->show(mem, buf);
+ }
+
+-static struct sysfs_ops map_sysfs_ops = {
++static const struct sysfs_ops map_sysfs_ops = {
+ .show = map_type_show,
+ };
+
+@@ -217,7 +218,7 @@ static ssize_t portio_type_show(struct kobject *kobj, struct attribute *attr,
+ return entry->show(port, buf);
+ }
+
+-static struct sysfs_ops portio_sysfs_ops = {
++static const struct sysfs_ops portio_sysfs_ops = {
+ .show = portio_type_show,
+ };
+
+@@ -255,7 +256,7 @@ static ssize_t show_event(struct device *dev,
+ struct uio_device *idev = dev_get_drvdata(dev);
+ if (idev)
+ return sprintf(buf, "%u\n",
+- (unsigned int)atomic_read(&idev->event));
++ (unsigned int)atomic_read_unchecked(&idev->event));
+ else
+ return -ENODEV;
+ }
+@@ -424,7 +425,7 @@ void uio_event_notify(struct uio_info *info)
+ {
+ struct uio_device *idev = info->uio_dev;
+
+- atomic_inc(&idev->event);
++ atomic_inc_unchecked(&idev->event);
+ wake_up_interruptible(&idev->wait);
+ kill_fasync(&idev->async_queue, SIGIO, POLL_IN);
+ }
+@@ -477,7 +478,7 @@ static int uio_open(struct inode *inode, struct file *filep)
+ }
+
+ listener->dev = idev;
+- listener->event_count = atomic_read(&idev->event);
++ listener->event_count = atomic_read_unchecked(&idev->event);
+ filep->private_data = listener;
+
+ if (idev->info->open) {
+@@ -528,7 +529,7 @@ static unsigned int uio_poll(struct file *filep, poll_table *wait)
+ return -EIO;
+
+ poll_wait(filep, &idev->wait, wait);
+- if (listener->event_count != atomic_read(&idev->event))
++ if (listener->event_count != atomic_read_unchecked(&idev->event))
+ return POLLIN | POLLRDNORM;
+ return 0;
+ }
+@@ -553,7 +554,7 @@ static ssize_t uio_read(struct file *filep, char __user *buf,
+ do {
+ set_current_state(TASK_INTERRUPTIBLE);
+
+- event_count = atomic_read(&idev->event);
++ event_count = atomic_read_unchecked(&idev->event);
+ if (event_count != listener->event_count) {
+ if (copy_to_user(buf, &event_count, count))
+ retval = -EFAULT;
+@@ -624,13 +625,13 @@ static int uio_find_mem_index(struct vm_area_struct *vma)
+ static void uio_vma_open(struct vm_area_struct *vma)
+ {
+ struct uio_device *idev = vma->vm_private_data;
+- idev->vma_count++;
++ local_inc(&idev->vma_count);
+ }
+
+ static void uio_vma_close(struct vm_area_struct *vma)
+ {
+ struct uio_device *idev = vma->vm_private_data;
+- idev->vma_count--;
++ local_dec(&idev->vma_count);
+ }
+
+ static int uio_vma_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+@@ -840,7 +841,7 @@ int __uio_register_device(struct module *owner,
+ idev->owner = owner;
+ idev->info = info;
+ init_waitqueue_head(&idev->wait);
+- atomic_set(&idev->event, 0);
++ atomic_set_unchecked(&idev->event, 0);
+
+ ret = uio_get_minor(idev);
+ if (ret)
+diff --git a/drivers/usb/atm/usbatm.c b/drivers/usb/atm/usbatm.c
+index fbea856..06efea6 100644
+--- a/drivers/usb/atm/usbatm.c
++++ b/drivers/usb/atm/usbatm.c
+@@ -333,7 +333,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
+ if (printk_ratelimit())
+ atm_warn(instance, "%s: OAM not supported (vpi %d, vci %d)!\n",
+ __func__, vpi, vci);
+- atomic_inc(&vcc->stats->rx_err);
++ atomic_inc_unchecked(&vcc->stats->rx_err);
+ return;
+ }
+
+@@ -361,7 +361,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
+ if (length > ATM_MAX_AAL5_PDU) {
+ atm_rldbg(instance, "%s: bogus length %u (vcc: 0x%p)!\n",
+ __func__, length, vcc);
+- atomic_inc(&vcc->stats->rx_err);
++ atomic_inc_unchecked(&vcc->stats->rx_err);
+ goto out;
+ }
+
+@@ -370,14 +370,14 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
+ if (sarb->len < pdu_length) {
+ atm_rldbg(instance, "%s: bogus pdu_length %u (sarb->len: %u, vcc: 0x%p)!\n",
+ __func__, pdu_length, sarb->len, vcc);
+- atomic_inc(&vcc->stats->rx_err);
++ atomic_inc_unchecked(&vcc->stats->rx_err);
+ goto out;
+ }
+
+ if (crc32_be(~0, skb_tail_pointer(sarb) - pdu_length, pdu_length) != 0xc704dd7b) {
+ atm_rldbg(instance, "%s: packet failed crc check (vcc: 0x%p)!\n",
+ __func__, vcc);
+- atomic_inc(&vcc->stats->rx_err);
++ atomic_inc_unchecked(&vcc->stats->rx_err);
+ goto out;
+ }
+
+@@ -387,7 +387,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
+ if (printk_ratelimit())
+ atm_err(instance, "%s: no memory for skb (length: %u)!\n",
+ __func__, length);
+- atomic_inc(&vcc->stats->rx_drop);
++ atomic_inc_unchecked(&vcc->stats->rx_drop);
+ goto out;
+ }
+
+@@ -412,7 +412,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
+
+ vcc->push(vcc, skb);
+
+- atomic_inc(&vcc->stats->rx);
++ atomic_inc_unchecked(&vcc->stats->rx);
+ out:
+ skb_trim(sarb, 0);
+ }
+@@ -616,7 +616,7 @@ static void usbatm_tx_process(unsigned long data)
+ struct atm_vcc *vcc = UDSL_SKB(skb)->atm.vcc;
+
+ usbatm_pop(vcc, skb);
+- atomic_inc(&vcc->stats->tx);
++ atomic_inc_unchecked(&vcc->stats->tx);
+
+ skb = skb_dequeue(&instance->sndqueue);
+ }
+@@ -775,11 +775,11 @@ static int usbatm_atm_proc_read(struct atm_dev *atm_dev, loff_t * pos, char *pag
+ if (!left--)
+ return sprintf(page,
+ "AAL5: tx %d ( %d err ), rx %d ( %d err, %d drop )\n",
+- atomic_read(&atm_dev->stats.aal5.tx),
+- atomic_read(&atm_dev->stats.aal5.tx_err),
+- atomic_read(&atm_dev->stats.aal5.rx),
+- atomic_read(&atm_dev->stats.aal5.rx_err),
+- atomic_read(&atm_dev->stats.aal5.rx_drop));
++ atomic_read_unchecked(&atm_dev->stats.aal5.tx),
++ atomic_read_unchecked(&atm_dev->stats.aal5.tx_err),
++ atomic_read_unchecked(&atm_dev->stats.aal5.rx),
++ atomic_read_unchecked(&atm_dev->stats.aal5.rx_err),
++ atomic_read_unchecked(&atm_dev->stats.aal5.rx_drop));
+
+ if (!left--) {
+ if (instance->disconnected)
+diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
+index 24e6205..fe5a5d4 100644
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -2216,7 +2216,7 @@ EXPORT_SYMBOL_GPL(usb_hcd_platform_shutdown);
+
+ #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
+
+-struct usb_mon_operations *mon_ops;
++const struct usb_mon_operations *mon_ops;
+
+ /*
+ * The registration is unlocked.
+@@ -2226,7 +2226,7 @@ struct usb_mon_operations *mon_ops;
+ * symbols from usbcore, usbcore gets referenced and cannot be unloaded first.
+ */
+
+-int usb_mon_register (struct usb_mon_operations *ops)
++int usb_mon_register (const struct usb_mon_operations *ops)
+ {
+
+ if (mon_ops)
+diff --git a/drivers/usb/core/hcd.h b/drivers/usb/core/hcd.h
+index bcbe104..9cfd1c6 100644
+--- a/drivers/usb/core/hcd.h
++++ b/drivers/usb/core/hcd.h
+@@ -486,13 +486,13 @@ static inline void usbfs_cleanup(void) { }
+ #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
+
+ struct usb_mon_operations {
+- void (*urb_submit)(struct usb_bus *bus, struct urb *urb);
+- void (*urb_submit_error)(struct usb_bus *bus, struct urb *urb, int err);
+- void (*urb_complete)(struct usb_bus *bus, struct urb *urb, int status);
++ void (* const urb_submit)(struct usb_bus *bus, struct urb *urb);
++ void (* const urb_submit_error)(struct usb_bus *bus, struct urb *urb, int err);
++ void (* const urb_complete)(struct usb_bus *bus, struct urb *urb, int status);
+ /* void (*urb_unlink)(struct usb_bus *bus, struct urb *urb); */
+ };
+
+-extern struct usb_mon_operations *mon_ops;
++extern const struct usb_mon_operations *mon_ops;
+
+ static inline void usbmon_urb_submit(struct usb_bus *bus, struct urb *urb)
+ {
+@@ -514,7 +514,7 @@ static inline void usbmon_urb_complete(struct usb_bus *bus, struct urb *urb,
+ (*mon_ops->urb_complete)(bus, urb, status);
+ }
+
+-int usb_mon_register(struct usb_mon_operations *ops);
++int usb_mon_register(const struct usb_mon_operations *ops);
+ void usb_mon_deregister(void);
+
+ #else
+diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c
+index 62ff5e7..530b74e 100644
+--- a/drivers/usb/misc/appledisplay.c
++++ b/drivers/usb/misc/appledisplay.c
+@@ -178,7 +178,7 @@ static int appledisplay_bl_get_brightness(struct backlight_device *bd)
+ return pdata->msgdata[1];
+ }
+
+-static struct backlight_ops appledisplay_bl_data = {
++static const struct backlight_ops appledisplay_bl_data = {
+ .get_brightness = appledisplay_bl_get_brightness,
+ .update_status = appledisplay_bl_update_status,
+ };
+diff --git a/drivers/usb/mon/mon_main.c b/drivers/usb/mon/mon_main.c
+index e0c2db3..bd8cb66 100644
+--- a/drivers/usb/mon/mon_main.c
++++ b/drivers/usb/mon/mon_main.c
+@@ -238,7 +238,7 @@ static struct notifier_block mon_nb = {
+ /*
+ * Ops
+ */
+-static struct usb_mon_operations mon_ops_0 = {
++static const struct usb_mon_operations mon_ops_0 = {
+ .urb_submit = mon_submit,
+ .urb_submit_error = mon_submit_error,
+ .urb_complete = mon_complete,
+diff --git a/drivers/usb/wusbcore/wa-hc.h b/drivers/usb/wusbcore/wa-hc.h
+index d6bea3e..60b250e 100644
+--- a/drivers/usb/wusbcore/wa-hc.h
++++ b/drivers/usb/wusbcore/wa-hc.h
+@@ -192,7 +192,7 @@ struct wahc {
+ struct list_head xfer_delayed_list;
+ spinlock_t xfer_list_lock;
+ struct work_struct xfer_work;
+- atomic_t xfer_id_count;
++ atomic_unchecked_t xfer_id_count;
+ };
+
+
+@@ -246,7 +246,7 @@ static inline void wa_init(struct wahc *wa)
+ INIT_LIST_HEAD(&wa->xfer_delayed_list);
+ spin_lock_init(&wa->xfer_list_lock);
+ INIT_WORK(&wa->xfer_work, wa_urb_enqueue_run);
+- atomic_set(&wa->xfer_id_count, 1);
++ atomic_set_unchecked(&wa->xfer_id_count, 1);
+ }
+
+ /**
+diff --git a/drivers/usb/wusbcore/wa-xfer.c b/drivers/usb/wusbcore/wa-xfer.c
+index 613a5fc..3174865 100644
+--- a/drivers/usb/wusbcore/wa-xfer.c
++++ b/drivers/usb/wusbcore/wa-xfer.c
+@@ -293,7 +293,7 @@ out:
+ */
+ static void wa_xfer_id_init(struct wa_xfer *xfer)
+ {
+- xfer->id = atomic_add_return(1, &xfer->wa->xfer_id_count);
++ xfer->id = atomic_add_return_unchecked(1, &xfer->wa->xfer_id_count);
+ }
+
+ /*
+diff --git a/drivers/uwb/wlp/messages.c b/drivers/uwb/wlp/messages.c
+index aa42fce..f8a828c 100644
+--- a/drivers/uwb/wlp/messages.c
++++ b/drivers/uwb/wlp/messages.c
+@@ -903,7 +903,7 @@ int wlp_parse_f0(struct wlp *wlp, struct sk_buff *skb)
+ size_t len = skb->len;
+ size_t used;
+ ssize_t result;
+- struct wlp_nonce enonce, rnonce;
++ struct wlp_nonce enonce = {{0}}, rnonce = {{0}};
+ enum wlp_assc_error assc_err;
+ char enonce_buf[WLP_WSS_NONCE_STRSIZE];
+ char rnonce_buf[WLP_WSS_NONCE_STRSIZE];
+diff --git a/drivers/uwb/wlp/sysfs.c b/drivers/uwb/wlp/sysfs.c
+index 0370399..6627c94 100644
+--- a/drivers/uwb/wlp/sysfs.c
++++ b/drivers/uwb/wlp/sysfs.c
+@@ -615,8 +615,7 @@ ssize_t wlp_wss_attr_store(struct kobject *kobj, struct attribute *attr,
+ return ret;
+ }
+
+-static
+-struct sysfs_ops wss_sysfs_ops = {
++static const struct sysfs_ops wss_sysfs_ops = {
+ .show = wlp_wss_attr_show,
+ .store = wlp_wss_attr_store,
+ };
+diff --git a/drivers/video/atmel_lcdfb.c b/drivers/video/atmel_lcdfb.c
+index 8c5e432..5ee90ea 100644
+--- a/drivers/video/atmel_lcdfb.c
++++ b/drivers/video/atmel_lcdfb.c
+@@ -110,7 +110,7 @@ static int atmel_bl_get_brightness(struct backlight_device *bl)
+ return lcdc_readl(sinfo, ATMEL_LCDC_CONTRAST_VAL);
+ }
+
+-static struct backlight_ops atmel_lcdc_bl_ops = {
++static const struct backlight_ops atmel_lcdc_bl_ops = {
+ .update_status = atmel_bl_update_status,
+ .get_brightness = atmel_bl_get_brightness,
+ };
+diff --git a/drivers/video/aty/aty128fb.c b/drivers/video/aty/aty128fb.c
+index e4e4d43..66bcbcc 100644
+--- a/drivers/video/aty/aty128fb.c
++++ b/drivers/video/aty/aty128fb.c
+@@ -149,7 +149,7 @@ enum {
+ };
+
+ /* Must match above enum */
+-static const char *r128_family[] __devinitdata = {
++static const char *r128_family[] __devinitconst = {
+ "AGP",
+ "PCI",
+ "PRO AGP",
+@@ -1787,7 +1787,7 @@ static int aty128_bl_get_brightness(struct backlight_device *bd)
+ return bd->props.brightness;
+ }
+
+-static struct backlight_ops aty128_bl_data = {
++static const struct backlight_ops aty128_bl_data = {
+ .get_brightness = aty128_bl_get_brightness,
+ .update_status = aty128_bl_update_status,
+ };
+diff --git a/drivers/video/aty/atyfb_base.c b/drivers/video/aty/atyfb_base.c
+index 913b4a4..9295a38 100644
+--- a/drivers/video/aty/atyfb_base.c
++++ b/drivers/video/aty/atyfb_base.c
+@@ -2225,7 +2225,7 @@ static int aty_bl_get_brightness(struct backlight_device *bd)
+ return bd->props.brightness;
+ }
+
+-static struct backlight_ops aty_bl_data = {
++static const struct backlight_ops aty_bl_data = {
+ .get_brightness = aty_bl_get_brightness,
+ .update_status = aty_bl_update_status,
+ };
+diff --git a/drivers/video/aty/radeon_backlight.c b/drivers/video/aty/radeon_backlight.c
+index 1a056ad..221bd6a 100644
+--- a/drivers/video/aty/radeon_backlight.c
++++ b/drivers/video/aty/radeon_backlight.c
+@@ -127,7 +127,7 @@ static int radeon_bl_get_brightness(struct backlight_device *bd)
+ return bd->props.brightness;
+ }
+
+-static struct backlight_ops radeon_bl_data = {
++static const struct backlight_ops radeon_bl_data = {
+ .get_brightness = radeon_bl_get_brightness,
+ .update_status = radeon_bl_update_status,
+ };
+diff --git a/drivers/video/backlight/adp5520_bl.c b/drivers/video/backlight/adp5520_bl.c
+index ad05da5..3cb2cb9 100644
+--- a/drivers/video/backlight/adp5520_bl.c
++++ b/drivers/video/backlight/adp5520_bl.c
+@@ -84,7 +84,7 @@ static int adp5520_bl_get_brightness(struct backlight_device *bl)
+ return error ? data->current_brightness : reg_val;
+ }
+
+-static struct backlight_ops adp5520_bl_ops = {
++static const struct backlight_ops adp5520_bl_ops = {
+ .update_status = adp5520_bl_update_status,
+ .get_brightness = adp5520_bl_get_brightness,
+ };
+diff --git a/drivers/video/backlight/adx_bl.c b/drivers/video/backlight/adx_bl.c
+index 2c3bdfc..d769b0b 100644
+--- a/drivers/video/backlight/adx_bl.c
++++ b/drivers/video/backlight/adx_bl.c
+@@ -61,7 +61,7 @@ static int adx_backlight_check_fb(struct fb_info *fb)
+ return 1;
+ }
+
+-static struct backlight_ops adx_backlight_ops = {
++static const struct backlight_ops adx_backlight_ops = {
+ .options = 0,
+ .update_status = adx_backlight_update_status,
+ .get_brightness = adx_backlight_get_brightness,
+diff --git a/drivers/video/backlight/atmel-pwm-bl.c b/drivers/video/backlight/atmel-pwm-bl.c
+index 505c082..6b6b3cc 100644
+--- a/drivers/video/backlight/atmel-pwm-bl.c
++++ b/drivers/video/backlight/atmel-pwm-bl.c
+@@ -113,7 +113,7 @@ static int atmel_pwm_bl_init_pwm(struct atmel_pwm_bl *pwmbl)
+ return pwm_channel_enable(&pwmbl->pwmc);
+ }
+
+-static struct backlight_ops atmel_pwm_bl_ops = {
++static const struct backlight_ops atmel_pwm_bl_ops = {
+ .get_brightness = atmel_pwm_bl_get_intensity,
+ .update_status = atmel_pwm_bl_set_intensity,
+ };
+diff --git a/drivers/video/backlight/backlight.c b/drivers/video/backlight/backlight.c
+index 5e20e6e..89025e6 100644
+--- a/drivers/video/backlight/backlight.c
++++ b/drivers/video/backlight/backlight.c
+@@ -269,7 +269,7 @@ EXPORT_SYMBOL(backlight_force_update);
+ * ERR_PTR() or a pointer to the newly allocated device.
+ */
+ struct backlight_device *backlight_device_register(const char *name,
+- struct device *parent, void *devdata, struct backlight_ops *ops)
++ struct device *parent, void *devdata, const struct backlight_ops *ops)
+ {
+ struct backlight_device *new_bd;
+ int rc;
+diff --git a/drivers/video/backlight/corgi_lcd.c b/drivers/video/backlight/corgi_lcd.c
+index 9677494..b4bcf80 100644
+--- a/drivers/video/backlight/corgi_lcd.c
++++ b/drivers/video/backlight/corgi_lcd.c
+@@ -451,7 +451,7 @@ void corgi_lcd_limit_intensity(int limit)
+ }
+ EXPORT_SYMBOL(corgi_lcd_limit_intensity);
+
+-static struct backlight_ops corgi_bl_ops = {
++static const struct backlight_ops corgi_bl_ops = {
+ .get_brightness = corgi_bl_get_intensity,
+ .update_status = corgi_bl_update_status,
+ };
+diff --git a/drivers/video/backlight/cr_bllcd.c b/drivers/video/backlight/cr_bllcd.c
+index b9fe62b..2914bf1 100644
+--- a/drivers/video/backlight/cr_bllcd.c
++++ b/drivers/video/backlight/cr_bllcd.c
+@@ -108,7 +108,7 @@ static int cr_backlight_get_intensity(struct backlight_device *bd)
+ return intensity;
+ }
+
+-static struct backlight_ops cr_backlight_ops = {
++static const struct backlight_ops cr_backlight_ops = {
+ .get_brightness = cr_backlight_get_intensity,
+ .update_status = cr_backlight_set_intensity,
+ };
+diff --git a/drivers/video/backlight/da903x_bl.c b/drivers/video/backlight/da903x_bl.c
+index 701a108..feacfd5 100644
+--- a/drivers/video/backlight/da903x_bl.c
++++ b/drivers/video/backlight/da903x_bl.c
+@@ -94,7 +94,7 @@ static int da903x_backlight_get_brightness(struct backlight_device *bl)
+ return data->current_brightness;
+ }
+
+-static struct backlight_ops da903x_backlight_ops = {
++static const struct backlight_ops da903x_backlight_ops = {
+ .update_status = da903x_backlight_update_status,
+ .get_brightness = da903x_backlight_get_brightness,
+ };
+diff --git a/drivers/video/backlight/generic_bl.c b/drivers/video/backlight/generic_bl.c
+index 6d27f62..e6d348e 100644
+--- a/drivers/video/backlight/generic_bl.c
++++ b/drivers/video/backlight/generic_bl.c
+@@ -70,7 +70,7 @@ void corgibl_limit_intensity(int limit)
+ }
+ EXPORT_SYMBOL(corgibl_limit_intensity);
+
+-static struct backlight_ops genericbl_ops = {
++static const struct backlight_ops genericbl_ops = {
+ .options = BL_CORE_SUSPENDRESUME,
+ .get_brightness = genericbl_get_intensity,
+ .update_status = genericbl_send_intensity,
+diff --git a/drivers/video/backlight/hp680_bl.c b/drivers/video/backlight/hp680_bl.c
+index 7fb4eef..f7cc528 100644
+--- a/drivers/video/backlight/hp680_bl.c
++++ b/drivers/video/backlight/hp680_bl.c
+@@ -98,7 +98,7 @@ static int hp680bl_get_intensity(struct backlight_device *bd)
+ return current_intensity;
+ }
+
+-static struct backlight_ops hp680bl_ops = {
++static const struct backlight_ops hp680bl_ops = {
+ .get_brightness = hp680bl_get_intensity,
+ .update_status = hp680bl_set_intensity,
+ };
+diff --git a/drivers/video/backlight/jornada720_bl.c b/drivers/video/backlight/jornada720_bl.c
+index 7aed256..db9071f 100644
+--- a/drivers/video/backlight/jornada720_bl.c
++++ b/drivers/video/backlight/jornada720_bl.c
+@@ -93,7 +93,7 @@ out:
+ return ret;
+ }
+
+-static struct backlight_ops jornada_bl_ops = {
++static const struct backlight_ops jornada_bl_ops = {
+ .get_brightness = jornada_bl_get_brightness,
+ .update_status = jornada_bl_update_status,
+ .options = BL_CORE_SUSPENDRESUME,
+diff --git a/drivers/video/backlight/kb3886_bl.c b/drivers/video/backlight/kb3886_bl.c
+index a38fda1..939e7b8 100644
+--- a/drivers/video/backlight/kb3886_bl.c
++++ b/drivers/video/backlight/kb3886_bl.c
+@@ -134,7 +134,7 @@ static int kb3886bl_get_intensity(struct backlight_device *bd)
+ return kb3886bl_intensity;
+ }
+
+-static struct backlight_ops kb3886bl_ops = {
++static const struct backlight_ops kb3886bl_ops = {
+ .get_brightness = kb3886bl_get_intensity,
+ .update_status = kb3886bl_send_intensity,
+ };
+diff --git a/drivers/video/backlight/locomolcd.c b/drivers/video/backlight/locomolcd.c
+index 6b488b8..00a9591 100644
+--- a/drivers/video/backlight/locomolcd.c
++++ b/drivers/video/backlight/locomolcd.c
+@@ -141,7 +141,7 @@ static int locomolcd_get_intensity(struct backlight_device *bd)
+ return current_intensity;
+ }
+
+-static struct backlight_ops locomobl_data = {
++static const struct backlight_ops locomobl_data = {
+ .get_brightness = locomolcd_get_intensity,
+ .update_status = locomolcd_set_intensity,
+ };
+diff --git a/drivers/video/backlight/mbp_nvidia_bl.c b/drivers/video/backlight/mbp_nvidia_bl.c
+index 99bdfa8..3dac448 100644
+--- a/drivers/video/backlight/mbp_nvidia_bl.c
++++ b/drivers/video/backlight/mbp_nvidia_bl.c
+@@ -33,7 +33,7 @@ struct dmi_match_data {
+ unsigned long iostart;
+ unsigned long iolen;
+ /* Backlight operations structure. */
+- struct backlight_ops backlight_ops;
++ const struct backlight_ops backlight_ops;
+ };
+
+ /* Module parameters. */
+diff --git a/drivers/video/backlight/omap1_bl.c b/drivers/video/backlight/omap1_bl.c
+index cbad67e8..3cf900e 100644
+--- a/drivers/video/backlight/omap1_bl.c
++++ b/drivers/video/backlight/omap1_bl.c
+@@ -125,7 +125,7 @@ static int omapbl_get_intensity(struct backlight_device *dev)
+ return bl->current_intensity;
+ }
+
+-static struct backlight_ops omapbl_ops = {
++static const struct backlight_ops omapbl_ops = {
+ .get_brightness = omapbl_get_intensity,
+ .update_status = omapbl_update_status,
+ };
+diff --git a/drivers/video/backlight/progear_bl.c b/drivers/video/backlight/progear_bl.c
+index 9edaf24..075786e 100644
+--- a/drivers/video/backlight/progear_bl.c
++++ b/drivers/video/backlight/progear_bl.c
+@@ -54,7 +54,7 @@ static int progearbl_get_intensity(struct backlight_device *bd)
+ return intensity - HW_LEVEL_MIN;
+ }
+
+-static struct backlight_ops progearbl_ops = {
++static const struct backlight_ops progearbl_ops = {
+ .get_brightness = progearbl_get_intensity,
+ .update_status = progearbl_set_intensity,
+ };
+diff --git a/drivers/video/backlight/pwm_bl.c b/drivers/video/backlight/pwm_bl.c
+index 8871662..df9e0b3 100644
+--- a/drivers/video/backlight/pwm_bl.c
++++ b/drivers/video/backlight/pwm_bl.c
+@@ -56,7 +56,7 @@ static int pwm_backlight_get_brightness(struct backlight_device *bl)
+ return bl->props.brightness;
+ }
+
+-static struct backlight_ops pwm_backlight_ops = {
++static const struct backlight_ops pwm_backlight_ops = {
+ .update_status = pwm_backlight_update_status,
+ .get_brightness = pwm_backlight_get_brightness,
+ };
+diff --git a/drivers/video/backlight/tosa_bl.c b/drivers/video/backlight/tosa_bl.c
+index 43edbad..e14ce4d 100644
+--- a/drivers/video/backlight/tosa_bl.c
++++ b/drivers/video/backlight/tosa_bl.c
+@@ -72,7 +72,7 @@ static int tosa_bl_get_brightness(struct backlight_device *dev)
+ return props->brightness;
+ }
+
+-static struct backlight_ops bl_ops = {
++static const struct backlight_ops bl_ops = {
+ .get_brightness = tosa_bl_get_brightness,
+ .update_status = tosa_bl_update_status,
+ };
+diff --git a/drivers/video/backlight/wm831x_bl.c b/drivers/video/backlight/wm831x_bl.c
+index 467bdb7..e32add3 100644
+--- a/drivers/video/backlight/wm831x_bl.c
++++ b/drivers/video/backlight/wm831x_bl.c
+@@ -112,7 +112,7 @@ static int wm831x_backlight_get_brightness(struct backlight_device *bl)
+ return data->current_brightness;
+ }
+
+-static struct backlight_ops wm831x_backlight_ops = {
++static const struct backlight_ops wm831x_backlight_ops = {
+ .options = BL_CORE_SUSPENDRESUME,
+ .update_status = wm831x_backlight_update_status,
+ .get_brightness = wm831x_backlight_get_brightness,
+diff --git a/drivers/video/bf54x-lq043fb.c b/drivers/video/bf54x-lq043fb.c
+index e49ae5e..db4e6f7 100644
+--- a/drivers/video/bf54x-lq043fb.c
++++ b/drivers/video/bf54x-lq043fb.c
+@@ -463,7 +463,7 @@ static int bl_get_brightness(struct backlight_device *bd)
+ return 0;
+ }
+
+-static struct backlight_ops bfin_lq043fb_bl_ops = {
++static const struct backlight_ops bfin_lq043fb_bl_ops = {
+ .get_brightness = bl_get_brightness,
+ };
+
+diff --git a/drivers/video/bfin-t350mcqb-fb.c b/drivers/video/bfin-t350mcqb-fb.c
+index 2c72a7c..d523e52 100644
+--- a/drivers/video/bfin-t350mcqb-fb.c
++++ b/drivers/video/bfin-t350mcqb-fb.c
+@@ -381,7 +381,7 @@ static int bl_get_brightness(struct backlight_device *bd)
+ return 0;
+ }
+
+-static struct backlight_ops bfin_lq043fb_bl_ops = {
++static const struct backlight_ops bfin_lq043fb_bl_ops = {
+ .get_brightness = bl_get_brightness,
+ };
+
+diff --git a/drivers/video/fbcmap.c b/drivers/video/fbcmap.c
+index f53b9f1..958bf4e 100644
+--- a/drivers/video/fbcmap.c
++++ b/drivers/video/fbcmap.c
+@@ -266,8 +266,7 @@ int fb_set_user_cmap(struct fb_cmap_user *cmap, struct fb_info *info)
+ rc = -ENODEV;
+ goto out;
+ }
+- if (cmap->start < 0 || (!info->fbops->fb_setcolreg &&
+- !info->fbops->fb_setcmap)) {
++ if (!info->fbops->fb_setcolreg && !info->fbops->fb_setcmap) {
+ rc = -EINVAL;
+ goto out1;
+ }
+diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
+index 99bbd28..ad3829e 100644
+--- a/drivers/video/fbmem.c
++++ b/drivers/video/fbmem.c
+@@ -403,7 +403,7 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image,
+ image->dx += image->width + 8;
+ }
+ } else if (rotate == FB_ROTATE_UD) {
+- for (x = 0; x < num && image->dx >= 0; x++) {
++ for (x = 0; x < num && (__s32)image->dx >= 0; x++) {
+ info->fbops->fb_imageblit(info, image);
+ image->dx -= image->width + 8;
+ }
+@@ -415,7 +415,7 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image,
+ image->dy += image->height + 8;
+ }
+ } else if (rotate == FB_ROTATE_CCW) {
+- for (x = 0; x < num && image->dy >= 0; x++) {
++ for (x = 0; x < num && (__s32)image->dy >= 0; x++) {
+ info->fbops->fb_imageblit(info, image);
+ image->dy -= image->height + 8;
+ }
+@@ -915,6 +915,8 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var)
+ int flags = info->flags;
+ int ret = 0;
+
++ pax_track_stack();
++
+ if (var->activate & FB_ACTIVATE_INV_MODE) {
+ struct fb_videomode mode1, mode2;
+
+@@ -1040,6 +1042,8 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
+ void __user *argp = (void __user *)arg;
+ long ret = 0;
+
++ pax_track_stack();
++
+ switch (cmd) {
+ case FBIOGET_VSCREENINFO:
+ if (!lock_fb_info(info))
+@@ -1119,7 +1123,7 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
+ return -EFAULT;
+ if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
+ return -EINVAL;
+- if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX)
++ if (con2fb.framebuffer >= FB_MAX)
+ return -EINVAL;
+ if (!registered_fb[con2fb.framebuffer])
+ request_module("fb%d", con2fb.framebuffer);
+diff --git a/drivers/video/geode/gx1fb_core.c b/drivers/video/geode/gx1fb_core.c
+index f20eff8..3e4f622 100644
+--- a/drivers/video/geode/gx1fb_core.c
++++ b/drivers/video/geode/gx1fb_core.c
+@@ -30,7 +30,7 @@ static int crt_option = 1;
+ static char panel_option[32] = "";
+
+ /* Modes relevant to the GX1 (taken from modedb.c) */
+-static const struct fb_videomode __initdata gx1_modedb[] = {
++static const struct fb_videomode __initconst gx1_modedb[] = {
+ /* 640x480-60 VESA */
+ { NULL, 60, 640, 480, 39682, 48, 16, 33, 10, 96, 2,
+ 0, FB_VMODE_NONINTERLACED, FB_MODE_IS_VESA },
+diff --git a/drivers/video/gxt4500.c b/drivers/video/gxt4500.c
+index 896e53d..4d87d0b 100644
+--- a/drivers/video/gxt4500.c
++++ b/drivers/video/gxt4500.c
+@@ -156,7 +156,7 @@ struct gxt4500_par {
+ static char *mode_option;
+
+ /* default mode: 1280x1024 @ 60 Hz, 8 bpp */
+-static const struct fb_videomode defaultmode __devinitdata = {
++static const struct fb_videomode defaultmode __devinitconst = {
+ .refresh = 60,
+ .xres = 1280,
+ .yres = 1024,
+@@ -581,7 +581,7 @@ static int gxt4500_blank(int blank, struct fb_info *info)
+ return 0;
+ }
+
+-static const struct fb_fix_screeninfo gxt4500_fix __devinitdata = {
++static const struct fb_fix_screeninfo gxt4500_fix __devinitconst = {
+ .id = "IBM GXT4500P",
+ .type = FB_TYPE_PACKED_PIXELS,
+ .visual = FB_VISUAL_PSEUDOCOLOR,
+diff --git a/drivers/video/i810/i810_accel.c b/drivers/video/i810/i810_accel.c
+index f5bedee..28c6028 100644
+--- a/drivers/video/i810/i810_accel.c
++++ b/drivers/video/i810/i810_accel.c
+@@ -73,6 +73,7 @@ static inline int wait_for_space(struct fb_info *info, u32 space)
+ }
+ }
+ printk("ringbuffer lockup!!!\n");
++ printk("head:%u tail:%u iring.size:%u space:%u\n", head, tail, par->iring.size, space);
+ i810_report_error(mmio);
+ par->dev_flags |= LOCKUP;
+ info->pixmap.scan_align = 1;
+diff --git a/drivers/video/i810/i810_main.c b/drivers/video/i810/i810_main.c
+index 5743ea2..457f82c 100644
+--- a/drivers/video/i810/i810_main.c
++++ b/drivers/video/i810/i810_main.c
+@@ -97,7 +97,7 @@ static int i810fb_blank (int blank_mode, struct fb_info *info);
+ static void i810fb_release_resource (struct fb_info *info, struct i810fb_par *par);
+
+ /* PCI */
+-static const char *i810_pci_list[] __devinitdata = {
++static const char *i810_pci_list[] __devinitconst = {
+ "Intel(R) 810 Framebuffer Device" ,
+ "Intel(R) 810-DC100 Framebuffer Device" ,
+ "Intel(R) 810E Framebuffer Device" ,
+diff --git a/drivers/video/logo/logo_linux_clut224.ppm b/drivers/video/logo/logo_linux_clut224.ppm
+index 3c14e43..eafa544 100644
+--- a/drivers/video/logo/logo_linux_clut224.ppm
++++ b/drivers/video/logo/logo_linux_clut224.ppm
+@@ -1,1604 +1,1123 @@
+ P3
+-# Standard 224-color Linux logo
+ 80 80
+ 255
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 6 6 6 6 6 6 10 10 10 10 10 10
+- 10 10 10 6 6 6 6 6 6 6 6 6
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 6 6 6 10 10 10 14 14 14
+- 22 22 22 26 26 26 30 30 30 34 34 34
+- 30 30 30 30 30 30 26 26 26 18 18 18
+- 14 14 14 10 10 10 6 6 6 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 1 0 0 1 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 6 6 6 14 14 14 26 26 26 42 42 42
+- 54 54 54 66 66 66 78 78 78 78 78 78
+- 78 78 78 74 74 74 66 66 66 54 54 54
+- 42 42 42 26 26 26 18 18 18 10 10 10
+- 6 6 6 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 1 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 10 10 10
+- 22 22 22 42 42 42 66 66 66 86 86 86
+- 66 66 66 38 38 38 38 38 38 22 22 22
+- 26 26 26 34 34 34 54 54 54 66 66 66
+- 86 86 86 70 70 70 46 46 46 26 26 26
+- 14 14 14 6 6 6 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 1 0 0 1 0 0 1 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 10 10 10 26 26 26
+- 50 50 50 82 82 82 58 58 58 6 6 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 6 6 6 54 54 54 86 86 86 66 66 66
+- 38 38 38 18 18 18 6 6 6 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 6 6 6 22 22 22 50 50 50
+- 78 78 78 34 34 34 2 2 6 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 6 6 6 70 70 70
+- 78 78 78 46 46 46 22 22 22 6 6 6
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 1 0 0 1 0 0 1 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 6 6 6 18 18 18 42 42 42 82 82 82
+- 26 26 26 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 2 2 6 14 14 14
+- 46 46 46 34 34 34 6 6 6 2 2 6
+- 42 42 42 78 78 78 42 42 42 18 18 18
+- 6 6 6 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 1 0 0 0 0 0 1 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 10 10 10 30 30 30 66 66 66 58 58 58
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 2 2 6 26 26 26
+- 86 86 86 101 101 101 46 46 46 10 10 10
+- 2 2 6 58 58 58 70 70 70 34 34 34
+- 10 10 10 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 1 0 0 1 0 0 1 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 14 14 14 42 42 42 86 86 86 10 10 10
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 2 2 6 30 30 30
+- 94 94 94 94 94 94 58 58 58 26 26 26
+- 2 2 6 6 6 6 78 78 78 54 54 54
+- 22 22 22 6 6 6 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 6 6 6
+- 22 22 22 62 62 62 62 62 62 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 2 2 6 26 26 26
+- 54 54 54 38 38 38 18 18 18 10 10 10
+- 2 2 6 2 2 6 34 34 34 82 82 82
+- 38 38 38 14 14 14 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 1 0 0 1 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 6 6 6
+- 30 30 30 78 78 78 30 30 30 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 2 2 6 10 10 10
+- 10 10 10 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 2 2 6 78 78 78
+- 50 50 50 18 18 18 6 6 6 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 1 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 10 10 10
+- 38 38 38 86 86 86 14 14 14 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 2 2 6 54 54 54
+- 66 66 66 26 26 26 6 6 6 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 1 0 0 1 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 14 14 14
+- 42 42 42 82 82 82 2 2 6 2 2 6
+- 2 2 6 6 6 6 10 10 10 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 2 2 6 6 6 6
+- 14 14 14 10 10 10 2 2 6 2 2 6
+- 2 2 6 2 2 6 2 2 6 18 18 18
+- 82 82 82 34 34 34 10 10 10 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 1 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 14 14 14
+- 46 46 46 86 86 86 2 2 6 2 2 6
+- 6 6 6 6 6 6 22 22 22 34 34 34
+- 6 6 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 18 18 18 34 34 34
+- 10 10 10 50 50 50 22 22 22 2 2 6
+- 2 2 6 2 2 6 2 2 6 10 10 10
+- 86 86 86 42 42 42 14 14 14 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 1 0 0 1 0 0 1 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 14 14 14
+- 46 46 46 86 86 86 2 2 6 2 2 6
+- 38 38 38 116 116 116 94 94 94 22 22 22
+- 22 22 22 2 2 6 2 2 6 2 2 6
+- 14 14 14 86 86 86 138 138 138 162 162 162
+-154 154 154 38 38 38 26 26 26 6 6 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 86 86 86 46 46 46 14 14 14 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 14 14 14
+- 46 46 46 86 86 86 2 2 6 14 14 14
+-134 134 134 198 198 198 195 195 195 116 116 116
+- 10 10 10 2 2 6 2 2 6 6 6 6
+-101 98 89 187 187 187 210 210 210 218 218 218
+-214 214 214 134 134 134 14 14 14 6 6 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 86 86 86 50 50 50 18 18 18 6 6 6
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 1 0 0 0
+- 0 0 1 0 0 1 0 0 1 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 14 14 14
+- 46 46 46 86 86 86 2 2 6 54 54 54
+-218 218 218 195 195 195 226 226 226 246 246 246
+- 58 58 58 2 2 6 2 2 6 30 30 30
+-210 210 210 253 253 253 174 174 174 123 123 123
+-221 221 221 234 234 234 74 74 74 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 70 70 70 58 58 58 22 22 22 6 6 6
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 14 14 14
+- 46 46 46 82 82 82 2 2 6 106 106 106
+-170 170 170 26 26 26 86 86 86 226 226 226
+-123 123 123 10 10 10 14 14 14 46 46 46
+-231 231 231 190 190 190 6 6 6 70 70 70
+- 90 90 90 238 238 238 158 158 158 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 70 70 70 58 58 58 22 22 22 6 6 6
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 1 0 0 0
+- 0 0 1 0 0 1 0 0 1 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 14 14 14
+- 42 42 42 86 86 86 6 6 6 116 116 116
+-106 106 106 6 6 6 70 70 70 149 149 149
+-128 128 128 18 18 18 38 38 38 54 54 54
+-221 221 221 106 106 106 2 2 6 14 14 14
+- 46 46 46 190 190 190 198 198 198 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 74 74 74 62 62 62 22 22 22 6 6 6
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 1 0 0 0
+- 0 0 1 0 0 0 0 0 1 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 14 14 14
+- 42 42 42 94 94 94 14 14 14 101 101 101
+-128 128 128 2 2 6 18 18 18 116 116 116
+-118 98 46 121 92 8 121 92 8 98 78 10
+-162 162 162 106 106 106 2 2 6 2 2 6
+- 2 2 6 195 195 195 195 195 195 6 6 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 74 74 74 62 62 62 22 22 22 6 6 6
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 1 0 0 1
+- 0 0 1 0 0 0 0 0 1 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 10 10 10
+- 38 38 38 90 90 90 14 14 14 58 58 58
+-210 210 210 26 26 26 54 38 6 154 114 10
+-226 170 11 236 186 11 225 175 15 184 144 12
+-215 174 15 175 146 61 37 26 9 2 2 6
+- 70 70 70 246 246 246 138 138 138 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 70 70 70 66 66 66 26 26 26 6 6 6
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 10 10 10
+- 38 38 38 86 86 86 14 14 14 10 10 10
+-195 195 195 188 164 115 192 133 9 225 175 15
+-239 182 13 234 190 10 232 195 16 232 200 30
+-245 207 45 241 208 19 232 195 16 184 144 12
+-218 194 134 211 206 186 42 42 42 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 50 50 50 74 74 74 30 30 30 6 6 6
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 10 10 10
+- 34 34 34 86 86 86 14 14 14 2 2 6
+-121 87 25 192 133 9 219 162 10 239 182 13
+-236 186 11 232 195 16 241 208 19 244 214 54
+-246 218 60 246 218 38 246 215 20 241 208 19
+-241 208 19 226 184 13 121 87 25 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 50 50 50 82 82 82 34 34 34 10 10 10
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 10 10 10
+- 34 34 34 82 82 82 30 30 30 61 42 6
+-180 123 7 206 145 10 230 174 11 239 182 13
+-234 190 10 238 202 15 241 208 19 246 218 74
+-246 218 38 246 215 20 246 215 20 246 215 20
+-226 184 13 215 174 15 184 144 12 6 6 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 26 26 26 94 94 94 42 42 42 14 14 14
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 10 10 10
+- 30 30 30 78 78 78 50 50 50 104 69 6
+-192 133 9 216 158 10 236 178 12 236 186 11
+-232 195 16 241 208 19 244 214 54 245 215 43
+-246 215 20 246 215 20 241 208 19 198 155 10
+-200 144 11 216 158 10 156 118 10 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 6 6 6 90 90 90 54 54 54 18 18 18
+- 6 6 6 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 10 10 10
+- 30 30 30 78 78 78 46 46 46 22 22 22
+-137 92 6 210 162 10 239 182 13 238 190 10
+-238 202 15 241 208 19 246 215 20 246 215 20
+-241 208 19 203 166 17 185 133 11 210 150 10
+-216 158 10 210 150 10 102 78 10 2 2 6
+- 6 6 6 54 54 54 14 14 14 2 2 6
+- 2 2 6 62 62 62 74 74 74 30 30 30
+- 10 10 10 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 10 10 10
+- 34 34 34 78 78 78 50 50 50 6 6 6
+- 94 70 30 139 102 15 190 146 13 226 184 13
+-232 200 30 232 195 16 215 174 15 190 146 13
+-168 122 10 192 133 9 210 150 10 213 154 11
+-202 150 34 182 157 106 101 98 89 2 2 6
+- 2 2 6 78 78 78 116 116 116 58 58 58
+- 2 2 6 22 22 22 90 90 90 46 46 46
+- 18 18 18 6 6 6 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 10 10 10
+- 38 38 38 86 86 86 50 50 50 6 6 6
+-128 128 128 174 154 114 156 107 11 168 122 10
+-198 155 10 184 144 12 197 138 11 200 144 11
+-206 145 10 206 145 10 197 138 11 188 164 115
+-195 195 195 198 198 198 174 174 174 14 14 14
+- 2 2 6 22 22 22 116 116 116 116 116 116
+- 22 22 22 2 2 6 74 74 74 70 70 70
+- 30 30 30 10 10 10 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 6 6 6 18 18 18
+- 50 50 50 101 101 101 26 26 26 10 10 10
+-138 138 138 190 190 190 174 154 114 156 107 11
+-197 138 11 200 144 11 197 138 11 192 133 9
+-180 123 7 190 142 34 190 178 144 187 187 187
+-202 202 202 221 221 221 214 214 214 66 66 66
+- 2 2 6 2 2 6 50 50 50 62 62 62
+- 6 6 6 2 2 6 10 10 10 90 90 90
+- 50 50 50 18 18 18 6 6 6 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 10 10 10 34 34 34
+- 74 74 74 74 74 74 2 2 6 6 6 6
+-144 144 144 198 198 198 190 190 190 178 166 146
+-154 121 60 156 107 11 156 107 11 168 124 44
+-174 154 114 187 187 187 190 190 190 210 210 210
+-246 246 246 253 253 253 253 253 253 182 182 182
+- 6 6 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 2 2 6 62 62 62
+- 74 74 74 34 34 34 14 14 14 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 10 10 10 22 22 22 54 54 54
+- 94 94 94 18 18 18 2 2 6 46 46 46
+-234 234 234 221 221 221 190 190 190 190 190 190
+-190 190 190 187 187 187 187 187 187 190 190 190
+-190 190 190 195 195 195 214 214 214 242 242 242
+-253 253 253 253 253 253 253 253 253 253 253 253
+- 82 82 82 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 2 2 6 14 14 14
+- 86 86 86 54 54 54 22 22 22 6 6 6
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 6 6 6 18 18 18 46 46 46 90 90 90
+- 46 46 46 18 18 18 6 6 6 182 182 182
+-253 253 253 246 246 246 206 206 206 190 190 190
+-190 190 190 190 190 190 190 190 190 190 190 190
+-206 206 206 231 231 231 250 250 250 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-202 202 202 14 14 14 2 2 6 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 42 42 42 86 86 86 42 42 42 18 18 18
+- 6 6 6 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 6 6 6
+- 14 14 14 38 38 38 74 74 74 66 66 66
+- 2 2 6 6 6 6 90 90 90 250 250 250
+-253 253 253 253 253 253 238 238 238 198 198 198
+-190 190 190 190 190 190 195 195 195 221 221 221
+-246 246 246 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 82 82 82 2 2 6 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 78 78 78 70 70 70 34 34 34
+- 14 14 14 6 6 6 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 14 14 14
+- 34 34 34 66 66 66 78 78 78 6 6 6
+- 2 2 6 18 18 18 218 218 218 253 253 253
+-253 253 253 253 253 253 253 253 253 246 246 246
+-226 226 226 231 231 231 246 246 246 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 178 178 178 2 2 6 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 18 18 18 90 90 90 62 62 62
+- 30 30 30 10 10 10 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 10 10 10 26 26 26
+- 58 58 58 90 90 90 18 18 18 2 2 6
+- 2 2 6 110 110 110 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-250 250 250 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 231 231 231 18 18 18 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 18 18 18 94 94 94
+- 54 54 54 26 26 26 10 10 10 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 6 6 6 22 22 22 50 50 50
+- 90 90 90 26 26 26 2 2 6 2 2 6
+- 14 14 14 195 195 195 250 250 250 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-250 250 250 242 242 242 54 54 54 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 2 2 6 38 38 38
+- 86 86 86 50 50 50 22 22 22 6 6 6
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 6 6 6 14 14 14 38 38 38 82 82 82
+- 34 34 34 2 2 6 2 2 6 2 2 6
+- 42 42 42 195 195 195 246 246 246 253 253 253
+-253 253 253 253 253 253 253 253 253 250 250 250
+-242 242 242 242 242 242 250 250 250 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 250 250 250 246 246 246 238 238 238
+-226 226 226 231 231 231 101 101 101 6 6 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 38 38 38 82 82 82 42 42 42 14 14 14
+- 6 6 6 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 10 10 10 26 26 26 62 62 62 66 66 66
+- 2 2 6 2 2 6 2 2 6 6 6 6
+- 70 70 70 170 170 170 206 206 206 234 234 234
+-246 246 246 250 250 250 250 250 250 238 238 238
+-226 226 226 231 231 231 238 238 238 250 250 250
+-250 250 250 250 250 250 246 246 246 231 231 231
+-214 214 214 206 206 206 202 202 202 202 202 202
+-198 198 198 202 202 202 182 182 182 18 18 18
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 62 62 62 66 66 66 30 30 30
+- 10 10 10 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 14 14 14 42 42 42 82 82 82 18 18 18
+- 2 2 6 2 2 6 2 2 6 10 10 10
+- 94 94 94 182 182 182 218 218 218 242 242 242
+-250 250 250 253 253 253 253 253 253 250 250 250
+-234 234 234 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 246 246 246
+-238 238 238 226 226 226 210 210 210 202 202 202
+-195 195 195 195 195 195 210 210 210 158 158 158
+- 6 6 6 14 14 14 50 50 50 14 14 14
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 6 6 6 86 86 86 46 46 46
+- 18 18 18 6 6 6 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 6 6 6
+- 22 22 22 54 54 54 70 70 70 2 2 6
+- 2 2 6 10 10 10 2 2 6 22 22 22
+-166 166 166 231 231 231 250 250 250 253 253 253
+-253 253 253 253 253 253 253 253 253 250 250 250
+-242 242 242 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 246 246 246
+-231 231 231 206 206 206 198 198 198 226 226 226
+- 94 94 94 2 2 6 6 6 6 38 38 38
+- 30 30 30 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 62 62 62 66 66 66
+- 26 26 26 10 10 10 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 10 10 10
+- 30 30 30 74 74 74 50 50 50 2 2 6
+- 26 26 26 26 26 26 2 2 6 106 106 106
+-238 238 238 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 246 246 246 218 218 218 202 202 202
+-210 210 210 14 14 14 2 2 6 2 2 6
+- 30 30 30 22 22 22 2 2 6 2 2 6
+- 2 2 6 2 2 6 18 18 18 86 86 86
+- 42 42 42 14 14 14 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 14 14 14
+- 42 42 42 90 90 90 22 22 22 2 2 6
+- 42 42 42 2 2 6 18 18 18 218 218 218
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 250 250 250 221 221 221
+-218 218 218 101 101 101 2 2 6 14 14 14
+- 18 18 18 38 38 38 10 10 10 2 2 6
+- 2 2 6 2 2 6 2 2 6 78 78 78
+- 58 58 58 22 22 22 6 6 6 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 6 6 6 18 18 18
+- 54 54 54 82 82 82 2 2 6 26 26 26
+- 22 22 22 2 2 6 123 123 123 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 250 250 250
+-238 238 238 198 198 198 6 6 6 38 38 38
+- 58 58 58 26 26 26 38 38 38 2 2 6
+- 2 2 6 2 2 6 2 2 6 46 46 46
+- 78 78 78 30 30 30 10 10 10 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 10 10 10 30 30 30
+- 74 74 74 58 58 58 2 2 6 42 42 42
+- 2 2 6 22 22 22 231 231 231 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 250 250 250
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 246 246 246 46 46 46 38 38 38
+- 42 42 42 14 14 14 38 38 38 14 14 14
+- 2 2 6 2 2 6 2 2 6 6 6 6
+- 86 86 86 46 46 46 14 14 14 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 6 6 6 14 14 14 42 42 42
+- 90 90 90 18 18 18 18 18 18 26 26 26
+- 2 2 6 116 116 116 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 250 250 250 238 238 238
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 94 94 94 6 6 6
+- 2 2 6 2 2 6 10 10 10 34 34 34
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 74 74 74 58 58 58 22 22 22 6 6 6
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 10 10 10 26 26 26 66 66 66
+- 82 82 82 2 2 6 38 38 38 6 6 6
+- 14 14 14 210 210 210 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 246 246 246 242 242 242
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 144 144 144 2 2 6
+- 2 2 6 2 2 6 2 2 6 46 46 46
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 42 42 42 74 74 74 30 30 30 10 10 10
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 6 6 6 14 14 14 42 42 42 90 90 90
+- 26 26 26 6 6 6 42 42 42 2 2 6
+- 74 74 74 250 250 250 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 242 242 242 242 242 242
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 182 182 182 2 2 6
+- 2 2 6 2 2 6 2 2 6 46 46 46
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 10 10 10 86 86 86 38 38 38 10 10 10
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 10 10 10 26 26 26 66 66 66 82 82 82
+- 2 2 6 22 22 22 18 18 18 2 2 6
+-149 149 149 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 234 234 234 242 242 242
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 206 206 206 2 2 6
+- 2 2 6 2 2 6 2 2 6 38 38 38
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 6 6 6 86 86 86 46 46 46 14 14 14
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 6 6 6
+- 18 18 18 46 46 46 86 86 86 18 18 18
+- 2 2 6 34 34 34 10 10 10 6 6 6
+-210 210 210 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 234 234 234 242 242 242
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 221 221 221 6 6 6
+- 2 2 6 2 2 6 6 6 6 30 30 30
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 82 82 82 54 54 54 18 18 18
+- 6 6 6 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 10 10 10
+- 26 26 26 66 66 66 62 62 62 2 2 6
+- 2 2 6 38 38 38 10 10 10 26 26 26
+-238 238 238 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 231 231 231 238 238 238
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 231 231 231 6 6 6
+- 2 2 6 2 2 6 10 10 10 30 30 30
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 66 66 66 58 58 58 22 22 22
+- 6 6 6 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 10 10 10
+- 38 38 38 78 78 78 6 6 6 2 2 6
+- 2 2 6 46 46 46 14 14 14 42 42 42
+-246 246 246 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 231 231 231 242 242 242
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 234 234 234 10 10 10
+- 2 2 6 2 2 6 22 22 22 14 14 14
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 66 66 66 62 62 62 22 22 22
+- 6 6 6 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 6 6 6 18 18 18
+- 50 50 50 74 74 74 2 2 6 2 2 6
+- 14 14 14 70 70 70 34 34 34 62 62 62
+-250 250 250 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 231 231 231 246 246 246
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 234 234 234 14 14 14
+- 2 2 6 2 2 6 30 30 30 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 66 66 66 62 62 62 22 22 22
+- 6 6 6 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 6 6 6 18 18 18
+- 54 54 54 62 62 62 2 2 6 2 2 6
+- 2 2 6 30 30 30 46 46 46 70 70 70
+-250 250 250 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 231 231 231 246 246 246
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 226 226 226 10 10 10
+- 2 2 6 6 6 6 30 30 30 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 66 66 66 58 58 58 22 22 22
+- 6 6 6 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 6 6 6 22 22 22
+- 58 58 58 62 62 62 2 2 6 2 2 6
+- 2 2 6 2 2 6 30 30 30 78 78 78
+-250 250 250 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 231 231 231 246 246 246
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 206 206 206 2 2 6
+- 22 22 22 34 34 34 18 14 6 22 22 22
+- 26 26 26 18 18 18 6 6 6 2 2 6
+- 2 2 6 82 82 82 54 54 54 18 18 18
+- 6 6 6 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 6 6 6 26 26 26
+- 62 62 62 106 106 106 74 54 14 185 133 11
+-210 162 10 121 92 8 6 6 6 62 62 62
+-238 238 238 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 231 231 231 246 246 246
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 158 158 158 18 18 18
+- 14 14 14 2 2 6 2 2 6 2 2 6
+- 6 6 6 18 18 18 66 66 66 38 38 38
+- 6 6 6 94 94 94 50 50 50 18 18 18
+- 6 6 6 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 6 6 6
+- 10 10 10 10 10 10 18 18 18 38 38 38
+- 78 78 78 142 134 106 216 158 10 242 186 14
+-246 190 14 246 190 14 156 118 10 10 10 10
+- 90 90 90 238 238 238 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 231 231 231 250 250 250
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 246 230 190
+-238 204 91 238 204 91 181 142 44 37 26 9
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 38 38 38 46 46 46
+- 26 26 26 106 106 106 54 54 54 18 18 18
+- 6 6 6 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 6 6 6 14 14 14 22 22 22
+- 30 30 30 38 38 38 50 50 50 70 70 70
+-106 106 106 190 142 34 226 170 11 242 186 14
+-246 190 14 246 190 14 246 190 14 154 114 10
+- 6 6 6 74 74 74 226 226 226 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 231 231 231 250 250 250
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 228 184 62
+-241 196 14 241 208 19 232 195 16 38 30 10
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 6 6 6 30 30 30 26 26 26
+-203 166 17 154 142 90 66 66 66 26 26 26
+- 6 6 6 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 6 6 6 18 18 18 38 38 38 58 58 58
+- 78 78 78 86 86 86 101 101 101 123 123 123
+-175 146 61 210 150 10 234 174 13 246 186 14
+-246 190 14 246 190 14 246 190 14 238 190 10
+-102 78 10 2 2 6 46 46 46 198 198 198
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 234 234 234 242 242 242
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 224 178 62
+-242 186 14 241 196 14 210 166 10 22 18 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 6 6 6 121 92 8
+-238 202 15 232 195 16 82 82 82 34 34 34
+- 10 10 10 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 14 14 14 38 38 38 70 70 70 154 122 46
+-190 142 34 200 144 11 197 138 11 197 138 11
+-213 154 11 226 170 11 242 186 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-225 175 15 46 32 6 2 2 6 22 22 22
+-158 158 158 250 250 250 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 250 250 250 242 242 242 224 178 62
+-239 182 13 236 186 11 213 154 11 46 32 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 61 42 6 225 175 15
+-238 190 10 236 186 11 112 100 78 42 42 42
+- 14 14 14 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 6 6 6
+- 22 22 22 54 54 54 154 122 46 213 154 11
+-226 170 11 230 174 11 226 170 11 226 170 11
+-236 178 12 242 186 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-241 196 14 184 144 12 10 10 10 2 2 6
+- 6 6 6 116 116 116 242 242 242 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 231 231 231 198 198 198 214 170 54
+-236 178 12 236 178 12 210 150 10 137 92 6
+- 18 14 6 2 2 6 2 2 6 2 2 6
+- 6 6 6 70 47 6 200 144 11 236 178 12
+-239 182 13 239 182 13 124 112 88 58 58 58
+- 22 22 22 6 6 6 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 10 10 10
+- 30 30 30 70 70 70 180 133 36 226 170 11
+-239 182 13 242 186 14 242 186 14 246 186 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 232 195 16 98 70 6 2 2 6
+- 2 2 6 2 2 6 66 66 66 221 221 221
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 206 206 206 198 198 198 214 166 58
+-230 174 11 230 174 11 216 158 10 192 133 9
+-163 110 8 116 81 8 102 78 10 116 81 8
+-167 114 7 197 138 11 226 170 11 239 182 13
+-242 186 14 242 186 14 162 146 94 78 78 78
+- 34 34 34 14 14 14 6 6 6 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 6 6 6
+- 30 30 30 78 78 78 190 142 34 226 170 11
+-239 182 13 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 241 196 14 203 166 17 22 18 6
+- 2 2 6 2 2 6 2 2 6 38 38 38
+-218 218 218 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-250 250 250 206 206 206 198 198 198 202 162 69
+-226 170 11 236 178 12 224 166 10 210 150 10
+-200 144 11 197 138 11 192 133 9 197 138 11
+-210 150 10 226 170 11 242 186 14 246 190 14
+-246 190 14 246 186 14 225 175 15 124 112 88
+- 62 62 62 30 30 30 14 14 14 6 6 6
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 10 10 10
+- 30 30 30 78 78 78 174 135 50 224 166 10
+-239 182 13 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 241 196 14 139 102 15
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 78 78 78 250 250 250 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-250 250 250 214 214 214 198 198 198 190 150 46
+-219 162 10 236 178 12 234 174 13 224 166 10
+-216 158 10 213 154 11 213 154 11 216 158 10
+-226 170 11 239 182 13 246 190 14 246 190 14
+-246 190 14 246 190 14 242 186 14 206 162 42
+-101 101 101 58 58 58 30 30 30 14 14 14
+- 6 6 6 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 10 10 10
+- 30 30 30 74 74 74 174 135 50 216 158 10
+-236 178 12 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 241 196 14 226 184 13
+- 61 42 6 2 2 6 2 2 6 2 2 6
+- 22 22 22 238 238 238 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 226 226 226 187 187 187 180 133 36
+-216 158 10 236 178 12 239 182 13 236 178 12
+-230 174 11 226 170 11 226 170 11 230 174 11
+-236 178 12 242 186 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 186 14 239 182 13
+-206 162 42 106 106 106 66 66 66 34 34 34
+- 14 14 14 6 6 6 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 6 6 6
+- 26 26 26 70 70 70 163 133 67 213 154 11
+-236 178 12 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 241 196 14
+-190 146 13 18 14 6 2 2 6 2 2 6
+- 46 46 46 246 246 246 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 221 221 221 86 86 86 156 107 11
+-216 158 10 236 178 12 242 186 14 246 186 14
+-242 186 14 239 182 13 239 182 13 242 186 14
+-242 186 14 246 186 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-242 186 14 225 175 15 142 122 72 66 66 66
+- 30 30 30 10 10 10 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 6 6 6
+- 26 26 26 70 70 70 163 133 67 210 150 10
+-236 178 12 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-232 195 16 121 92 8 34 34 34 106 106 106
+-221 221 221 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-242 242 242 82 82 82 18 14 6 163 110 8
+-216 158 10 236 178 12 242 186 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 242 186 14 163 133 67
+- 46 46 46 18 18 18 6 6 6 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 10 10 10
+- 30 30 30 78 78 78 163 133 67 210 150 10
+-236 178 12 246 186 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-241 196 14 215 174 15 190 178 144 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 218 218 218
+- 58 58 58 2 2 6 22 18 6 167 114 7
+-216 158 10 236 178 12 246 186 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 246 186 14 242 186 14 190 150 46
+- 54 54 54 22 22 22 6 6 6 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 14 14 14
+- 38 38 38 86 86 86 180 133 36 213 154 11
+-236 178 12 246 186 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 232 195 16 190 146 13 214 214 214
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 250 250 250 170 170 170 26 26 26
+- 2 2 6 2 2 6 37 26 9 163 110 8
+-219 162 10 239 182 13 246 186 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 186 14 236 178 12 224 166 10 142 122 72
+- 46 46 46 18 18 18 6 6 6 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 6 6 6 18 18 18
+- 50 50 50 109 106 95 192 133 9 224 166 10
+-242 186 14 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-242 186 14 226 184 13 210 162 10 142 110 46
+-226 226 226 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-253 253 253 253 253 253 253 253 253 253 253 253
+-198 198 198 66 66 66 2 2 6 2 2 6
+- 2 2 6 2 2 6 50 34 6 156 107 11
+-219 162 10 239 182 13 246 186 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 242 186 14
+-234 174 13 213 154 11 154 122 46 66 66 66
+- 30 30 30 10 10 10 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 6 6 6 22 22 22
+- 58 58 58 154 121 60 206 145 10 234 174 13
+-242 186 14 246 186 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 186 14 236 178 12 210 162 10 163 110 8
+- 61 42 6 138 138 138 218 218 218 250 250 250
+-253 253 253 253 253 253 253 253 253 250 250 250
+-242 242 242 210 210 210 144 144 144 66 66 66
+- 6 6 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 61 42 6 163 110 8
+-216 158 10 236 178 12 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 239 182 13 230 174 11 216 158 10
+-190 142 34 124 112 88 70 70 70 38 38 38
+- 18 18 18 6 6 6 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 6 6 6 22 22 22
+- 62 62 62 168 124 44 206 145 10 224 166 10
+-236 178 12 239 182 13 242 186 14 242 186 14
+-246 186 14 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 236 178 12 216 158 10 175 118 6
+- 80 54 7 2 2 6 6 6 6 30 30 30
+- 54 54 54 62 62 62 50 50 50 38 38 38
+- 14 14 14 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 6 6 6 80 54 7 167 114 7
+-213 154 11 236 178 12 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 190 14 242 186 14 239 182 13 239 182 13
+-230 174 11 210 150 10 174 135 50 124 112 88
+- 82 82 82 54 54 54 34 34 34 18 18 18
+- 6 6 6 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 6 6 6 18 18 18
+- 50 50 50 158 118 36 192 133 9 200 144 11
+-216 158 10 219 162 10 224 166 10 226 170 11
+-230 174 11 236 178 12 239 182 13 239 182 13
+-242 186 14 246 186 14 246 190 14 246 190 14
+-246 190 14 246 190 14 246 190 14 246 190 14
+-246 186 14 230 174 11 210 150 10 163 110 8
+-104 69 6 10 10 10 2 2 6 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 6 6 6 91 60 6 167 114 7
+-206 145 10 230 174 11 242 186 14 246 190 14
+-246 190 14 246 190 14 246 186 14 242 186 14
+-239 182 13 230 174 11 224 166 10 213 154 11
+-180 133 36 124 112 88 86 86 86 58 58 58
+- 38 38 38 22 22 22 10 10 10 6 6 6
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 14 14 14
+- 34 34 34 70 70 70 138 110 50 158 118 36
+-167 114 7 180 123 7 192 133 9 197 138 11
+-200 144 11 206 145 10 213 154 11 219 162 10
+-224 166 10 230 174 11 239 182 13 242 186 14
+-246 186 14 246 186 14 246 186 14 246 186 14
+-239 182 13 216 158 10 185 133 11 152 99 6
+-104 69 6 18 14 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 2 2 6 2 2 6 2 2 6
+- 2 2 6 6 6 6 80 54 7 152 99 6
+-192 133 9 219 162 10 236 178 12 239 182 13
+-246 186 14 242 186 14 239 182 13 236 178 12
+-224 166 10 206 145 10 192 133 9 154 121 60
+- 94 94 94 62 62 62 42 42 42 22 22 22
+- 14 14 14 6 6 6 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 6 6 6
+- 18 18 18 34 34 34 58 58 58 78 78 78
+-101 98 89 124 112 88 142 110 46 156 107 11
+-163 110 8 167 114 7 175 118 6 180 123 7
+-185 133 11 197 138 11 210 150 10 219 162 10
+-226 170 11 236 178 12 236 178 12 234 174 13
+-219 162 10 197 138 11 163 110 8 130 83 6
+- 91 60 6 10 10 10 2 2 6 2 2 6
+- 18 18 18 38 38 38 38 38 38 38 38 38
+- 38 38 38 38 38 38 38 38 38 38 38 38
+- 38 38 38 38 38 38 26 26 26 2 2 6
+- 2 2 6 6 6 6 70 47 6 137 92 6
+-175 118 6 200 144 11 219 162 10 230 174 11
+-234 174 13 230 174 11 219 162 10 210 150 10
+-192 133 9 163 110 8 124 112 88 82 82 82
+- 50 50 50 30 30 30 14 14 14 6 6 6
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 6 6 6 14 14 14 22 22 22 34 34 34
+- 42 42 42 58 58 58 74 74 74 86 86 86
+-101 98 89 122 102 70 130 98 46 121 87 25
+-137 92 6 152 99 6 163 110 8 180 123 7
+-185 133 11 197 138 11 206 145 10 200 144 11
+-180 123 7 156 107 11 130 83 6 104 69 6
+- 50 34 6 54 54 54 110 110 110 101 98 89
+- 86 86 86 82 82 82 78 78 78 78 78 78
+- 78 78 78 78 78 78 78 78 78 78 78 78
+- 78 78 78 82 82 82 86 86 86 94 94 94
+-106 106 106 101 101 101 86 66 34 124 80 6
+-156 107 11 180 123 7 192 133 9 200 144 11
+-206 145 10 200 144 11 192 133 9 175 118 6
+-139 102 15 109 106 95 70 70 70 42 42 42
+- 22 22 22 10 10 10 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 6 6 6 10 10 10
+- 14 14 14 22 22 22 30 30 30 38 38 38
+- 50 50 50 62 62 62 74 74 74 90 90 90
+-101 98 89 112 100 78 121 87 25 124 80 6
+-137 92 6 152 99 6 152 99 6 152 99 6
+-138 86 6 124 80 6 98 70 6 86 66 30
+-101 98 89 82 82 82 58 58 58 46 46 46
+- 38 38 38 34 34 34 34 34 34 34 34 34
+- 34 34 34 34 34 34 34 34 34 34 34 34
+- 34 34 34 34 34 34 38 38 38 42 42 42
+- 54 54 54 82 82 82 94 86 76 91 60 6
+-134 86 6 156 107 11 167 114 7 175 118 6
+-175 118 6 167 114 7 152 99 6 121 87 25
+-101 98 89 62 62 62 34 34 34 18 18 18
+- 6 6 6 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 6 6 6 6 6 6 10 10 10
+- 18 18 18 22 22 22 30 30 30 42 42 42
+- 50 50 50 66 66 66 86 86 86 101 98 89
+-106 86 58 98 70 6 104 69 6 104 69 6
+-104 69 6 91 60 6 82 62 34 90 90 90
+- 62 62 62 38 38 38 22 22 22 14 14 14
+- 10 10 10 10 10 10 10 10 10 10 10 10
+- 10 10 10 10 10 10 6 6 6 10 10 10
+- 10 10 10 10 10 10 10 10 10 14 14 14
+- 22 22 22 42 42 42 70 70 70 89 81 66
+- 80 54 7 104 69 6 124 80 6 137 92 6
+-134 86 6 116 81 8 100 82 52 86 86 86
+- 58 58 58 30 30 30 14 14 14 6 6 6
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 6 6 6 10 10 10 14 14 14
+- 18 18 18 26 26 26 38 38 38 54 54 54
+- 70 70 70 86 86 86 94 86 76 89 81 66
+- 89 81 66 86 86 86 74 74 74 50 50 50
+- 30 30 30 14 14 14 6 6 6 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 6 6 6 18 18 18 34 34 34 58 58 58
+- 82 82 82 89 81 66 89 81 66 89 81 66
+- 94 86 66 94 86 76 74 74 74 50 50 50
+- 26 26 26 14 14 14 6 6 6 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 6 6 6 6 6 6 14 14 14 18 18 18
+- 30 30 30 38 38 38 46 46 46 54 54 54
+- 50 50 50 42 42 42 30 30 30 18 18 18
+- 10 10 10 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 6 6 6 14 14 14 26 26 26
+- 38 38 38 50 50 50 58 58 58 58 58 58
+- 54 54 54 42 42 42 30 30 30 18 18 18
+- 10 10 10 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 6 6 6
+- 6 6 6 10 10 10 14 14 14 18 18 18
+- 18 18 18 14 14 14 10 10 10 6 6 6
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 6 6 6
+- 14 14 14 18 18 18 22 22 22 22 22 22
+- 18 18 18 14 14 14 10 10 10 6 6 6
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
+- 0 0 0 0 0 0 0 0 0 0 0 0
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 3 3 3 0 0 0 0 0 0
++0 0 0 0 0 0 0 0 0 0 0 0 3 3 3 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 1 1 1 0 0 0
++0 0 0 3 3 3 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 2 1 0 2 1 0 3 2 2
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 2 2 2 0 0 0 3 4 3 26 28 28
++37 38 37 37 38 37 14 17 19 2 2 2 0 0 0 2 2 2
++5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 3 3 3 0 0 0 1 1 1 6 6 6
++2 2 2 0 0 0 3 3 3 4 4 4 4 4 4 4 4 4
++4 4 5 3 3 3 1 0 0 0 0 0 1 0 0 0 0 0
++1 1 1 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++2 2 2 0 0 0 0 0 0 14 17 19 60 74 84 137 136 137
++153 152 153 137 136 137 125 124 125 60 73 81 6 6 6 3 1 0
++0 0 0 3 3 3 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 0 0 0 4 4 4 41 54 63 125 124 125
++60 73 81 6 6 6 4 0 0 3 3 3 4 4 4 4 4 4
++4 4 4 0 0 0 6 9 11 41 54 63 41 65 82 22 30 35
++2 2 2 2 1 0 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 5 5 5 5 5 5 2 2 2 0 0 0
++4 0 0 6 6 6 41 54 63 137 136 137 174 174 174 167 166 167
++165 164 165 165 164 165 163 162 163 163 162 163 125 124 125 41 54 63
++1 1 1 0 0 0 0 0 0 3 3 3 5 5 5 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 5 5 5
++3 3 3 2 0 0 4 0 0 60 73 81 156 155 156 167 166 167
++163 162 163 85 115 134 5 7 8 0 0 0 4 4 4 5 5 5
++0 0 0 2 5 5 55 98 126 90 154 193 90 154 193 72 125 159
++37 51 59 2 0 0 1 1 1 4 5 5 4 4 4 4 4 4
++4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 5 5 5 4 4 4 1 1 1 0 0 0 3 3 3
++37 38 37 125 124 125 163 162 163 174 174 174 158 157 158 158 157 158
++156 155 156 156 155 156 158 157 158 165 164 165 174 174 174 166 165 166
++125 124 125 16 19 21 1 0 0 0 0 0 0 0 0 4 4 4
++5 5 5 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 1 1 1
++0 0 0 0 0 0 37 38 37 153 152 153 174 174 174 158 157 158
++174 174 174 163 162 163 37 38 37 4 3 3 4 0 0 1 1 1
++0 0 0 22 40 52 101 161 196 101 161 196 90 154 193 101 161 196
++64 123 161 14 17 19 0 0 0 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
++5 5 5 2 2 2 0 0 0 4 0 0 24 26 27 85 115 134
++156 155 156 174 174 174 167 166 167 156 155 156 154 153 154 157 156 157
++156 155 156 156 155 156 155 154 155 153 152 153 158 157 158 167 166 167
++174 174 174 156 155 156 60 74 84 16 19 21 0 0 0 0 0 0
++1 1 1 5 5 5 5 5 5 4 4 4 4 4 4 4 4 4
++4 4 4 5 5 5 6 6 6 3 3 3 0 0 0 4 0 0
++13 16 17 60 73 81 137 136 137 165 164 165 156 155 156 153 152 153
++174 174 174 177 184 187 60 73 81 3 1 0 0 0 0 1 1 2
++22 30 35 64 123 161 136 185 209 90 154 193 90 154 193 90 154 193
++90 154 193 21 29 34 0 0 0 3 2 2 4 4 5 4 4 4
++4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 3 3 3
++0 0 0 0 0 0 10 13 16 60 74 84 157 156 157 174 174 174
++174 174 174 158 157 158 153 152 153 154 153 154 156 155 156 155 154 155
++156 155 156 155 154 155 154 153 154 157 156 157 154 153 154 153 152 153
++163 162 163 174 174 174 177 184 187 137 136 137 60 73 81 13 16 17
++4 0 0 0 0 0 3 3 3 5 5 5 4 4 4 4 4 4
++5 5 5 4 4 4 1 1 1 0 0 0 3 3 3 41 54 63
++131 129 131 174 174 174 174 174 174 174 174 174 167 166 167 174 174 174
++190 197 201 137 136 137 24 26 27 4 0 0 16 21 25 50 82 103
++90 154 193 136 185 209 90 154 193 101 161 196 101 161 196 101 161 196
++31 91 132 3 6 7 0 0 0 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 2 2 2 0 0 0 4 0 0
++4 0 0 43 57 68 137 136 137 177 184 187 174 174 174 163 162 163
++155 154 155 155 154 155 156 155 156 155 154 155 158 157 158 165 164 165
++167 166 167 166 165 166 163 162 163 157 156 157 155 154 155 155 154 155
++153 152 153 156 155 156 167 166 167 174 174 174 174 174 174 131 129 131
++41 54 63 5 5 5 0 0 0 0 0 0 3 3 3 4 4 4
++1 1 1 0 0 0 1 0 0 26 28 28 125 124 125 174 174 174
++177 184 187 174 174 174 174 174 174 156 155 156 131 129 131 137 136 137
++125 124 125 24 26 27 4 0 0 41 65 82 90 154 193 136 185 209
++136 185 209 101 161 196 53 118 160 37 112 160 90 154 193 34 86 122
++7 12 15 0 0 0 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 3 3 3 0 0 0 0 0 0 5 5 5 37 38 37
++125 124 125 167 166 167 174 174 174 167 166 167 158 157 158 155 154 155
++156 155 156 156 155 156 156 155 156 163 162 163 167 166 167 155 154 155
++137 136 137 153 152 153 156 155 156 165 164 165 163 162 163 156 155 156
++156 155 156 156 155 156 155 154 155 158 157 158 166 165 166 174 174 174
++167 166 167 125 124 125 37 38 37 1 0 0 0 0 0 0 0 0
++0 0 0 24 26 27 60 74 84 158 157 158 174 174 174 174 174 174
++166 165 166 158 157 158 125 124 125 41 54 63 13 16 17 6 6 6
++6 6 6 37 38 37 80 127 157 136 185 209 101 161 196 101 161 196
++90 154 193 28 67 93 6 10 14 13 20 25 13 20 25 6 10 14
++1 1 2 4 3 3 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++1 1 1 1 0 0 4 3 3 37 38 37 60 74 84 153 152 153
++167 166 167 167 166 167 158 157 158 154 153 154 155 154 155 156 155 156
++157 156 157 158 157 158 167 166 167 167 166 167 131 129 131 43 57 68
++26 28 28 37 38 37 60 73 81 131 129 131 165 164 165 166 165 166
++158 157 158 155 154 155 156 155 156 156 155 156 156 155 156 158 157 158
++165 164 165 174 174 174 163 162 163 60 74 84 16 19 21 13 16 17
++60 73 81 131 129 131 174 174 174 174 174 174 167 166 167 165 164 165
++137 136 137 60 73 81 24 26 27 4 0 0 4 0 0 16 19 21
++52 104 138 101 161 196 136 185 209 136 185 209 90 154 193 27 99 146
++13 20 25 4 5 7 2 5 5 4 5 7 1 1 2 0 0 0
++4 4 4 4 4 4 3 3 3 2 2 2 2 2 2 4 4 4
++4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 3 3 3 0 0 0
++0 0 0 13 16 17 60 73 81 137 136 137 174 174 174 166 165 166
++158 157 158 156 155 156 157 156 157 156 155 156 155 154 155 158 157 158
++167 166 167 174 174 174 153 152 153 60 73 81 16 19 21 4 0 0
++4 0 0 4 0 0 6 6 6 26 28 28 60 74 84 158 157 158
++174 174 174 166 165 166 157 156 157 155 154 155 156 155 156 156 155 156
++155 154 155 158 157 158 167 166 167 167 166 167 131 129 131 125 124 125
++137 136 137 167 166 167 167 166 167 174 174 174 158 157 158 125 124 125
++16 19 21 4 0 0 4 0 0 10 13 16 49 76 92 107 159 188
++136 185 209 136 185 209 90 154 193 26 108 161 22 40 52 6 10 14
++2 3 3 1 1 2 1 1 2 4 4 5 4 4 5 4 4 5
++4 4 5 2 2 1 0 0 0 0 0 0 0 0 0 2 2 2
++4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 5 5 5 3 3 3 0 0 0 1 0 0 4 0 0
++37 51 59 131 129 131 167 166 167 167 166 167 163 162 163 157 156 157
++157 156 157 155 154 155 153 152 153 157 156 157 167 166 167 174 174 174
++153 152 153 125 124 125 37 38 37 4 0 0 4 0 0 4 0 0
++4 3 3 4 3 3 4 0 0 6 6 6 4 0 0 37 38 37
++125 124 125 174 174 174 174 174 174 165 164 165 156 155 156 154 153 154
++156 155 156 156 155 156 155 154 155 163 162 163 158 157 158 163 162 163
++174 174 174 174 174 174 174 174 174 125 124 125 37 38 37 0 0 0
++4 0 0 6 9 11 41 54 63 90 154 193 136 185 209 146 190 211
++136 185 209 37 112 160 22 40 52 6 10 14 3 6 7 1 1 2
++1 1 2 3 3 3 1 1 2 3 3 3 4 4 4 4 4 4
++2 2 2 2 0 0 16 19 21 37 38 37 24 26 27 0 0 0
++0 0 0 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 5 5 5
++4 4 4 0 0 0 0 0 0 0 0 0 26 28 28 120 125 127
++158 157 158 174 174 174 165 164 165 157 156 157 155 154 155 156 155 156
++153 152 153 153 152 153 167 166 167 174 174 174 174 174 174 125 124 125
++37 38 37 4 0 0 0 0 0 4 0 0 4 3 3 4 4 4
++4 4 4 4 4 4 5 5 5 4 0 0 4 0 0 4 0 0
++4 3 3 43 57 68 137 136 137 174 174 174 174 174 174 165 164 165
++154 153 154 153 152 153 153 152 153 153 152 153 163 162 163 174 174 174
++174 174 174 153 152 153 60 73 81 6 6 6 4 0 0 4 3 3
++32 43 50 80 127 157 136 185 209 146 190 211 146 190 211 90 154 193
++28 67 93 28 67 93 40 71 93 3 6 7 1 1 2 2 5 5
++50 82 103 79 117 143 26 37 45 0 0 0 3 3 3 1 1 1
++0 0 0 41 54 63 137 136 137 174 174 174 153 152 153 60 73 81
++2 0 0 0 0 0
++4 4 4 4 4 4 4 4 4 4 4 4 6 6 6 2 2 2
++0 0 0 2 0 0 24 26 27 60 74 84 153 152 153 174 174 174
++174 174 174 157 156 157 154 153 154 156 155 156 154 153 154 153 152 153
++165 164 165 174 174 174 177 184 187 137 136 137 43 57 68 6 6 6
++4 0 0 2 0 0 3 3 3 5 5 5 5 5 5 4 4 4
++4 4 4 4 4 4 4 4 4 5 5 5 6 6 6 4 3 3
++4 0 0 4 0 0 24 26 27 60 73 81 153 152 153 174 174 174
++174 174 174 158 157 158 158 157 158 174 174 174 174 174 174 158 157 158
++60 74 84 24 26 27 4 0 0 4 0 0 17 23 27 59 113 148
++136 185 209 191 222 234 146 190 211 136 185 209 31 91 132 7 11 13
++22 40 52 101 161 196 90 154 193 6 9 11 3 4 4 43 95 132
++136 185 209 172 205 220 55 98 126 0 0 0 0 0 0 2 0 0
++26 28 28 153 152 153 177 184 187 167 166 167 177 184 187 165 164 165
++37 38 37 0 0 0
++4 4 4 4 4 4 5 5 5 5 5 5 1 1 1 0 0 0
++13 16 17 60 73 81 137 136 137 174 174 174 174 174 174 165 164 165
++153 152 153 153 152 153 155 154 155 154 153 154 158 157 158 174 174 174
++177 184 187 163 162 163 60 73 81 16 19 21 4 0 0 4 0 0
++4 3 3 4 4 4 5 5 5 5 5 5 4 4 4 5 5 5
++5 5 5 5 5 5 5 5 5 4 4 4 4 4 4 5 5 5
++6 6 6 4 0 0 4 0 0 4 0 0 24 26 27 60 74 84
++166 165 166 174 174 174 177 184 187 165 164 165 125 124 125 24 26 27
++4 0 0 4 0 0 5 5 5 50 82 103 136 185 209 172 205 220
++146 190 211 136 185 209 26 108 161 22 40 52 7 12 15 44 81 103
++71 116 144 28 67 93 37 51 59 41 65 82 100 139 164 101 161 196
++90 154 193 90 154 193 28 67 93 0 0 0 0 0 0 26 28 28
++125 124 125 167 166 167 163 162 163 153 152 153 163 162 163 174 174 174
++85 115 134 4 0 0
++4 4 4 5 5 5 4 4 4 1 0 0 4 0 0 34 47 55
++125 124 125 174 174 174 174 174 174 167 166 167 157 156 157 153 152 153
++155 154 155 155 154 155 158 157 158 166 165 166 167 166 167 154 153 154
++125 124 125 26 28 28 4 0 0 4 0 0 4 0 0 5 5 5
++5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 1 1 1
++0 0 0 0 0 0 1 1 1 4 4 4 4 4 4 4 4 4
++5 5 5 5 5 5 4 3 3 4 0 0 4 0 0 6 6 6
++37 38 37 131 129 131 137 136 137 37 38 37 0 0 0 4 0 0
++4 5 5 43 61 72 90 154 193 172 205 220 146 190 211 136 185 209
++90 154 193 28 67 93 13 20 25 43 61 72 71 116 144 44 81 103
++2 5 5 7 11 13 59 113 148 101 161 196 90 154 193 28 67 93
++13 20 25 6 10 14 0 0 0 13 16 17 60 73 81 137 136 137
++166 165 166 158 157 158 156 155 156 154 153 154 167 166 167 174 174 174
++60 73 81 4 0 0
++4 4 4 4 4 4 0 0 0 3 3 3 60 74 84 174 174 174
++174 174 174 167 166 167 163 162 163 155 154 155 157 156 157 155 154 155
++156 155 156 163 162 163 167 166 167 158 157 158 125 124 125 37 38 37
++4 3 3 4 0 0 4 0 0 6 6 6 6 6 6 5 5 5
++4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 2 3 3
++10 13 16 7 11 13 1 0 0 0 0 0 2 2 1 4 4 4
++4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 4 0 0
++4 0 0 7 11 13 13 16 17 4 0 0 3 3 3 34 47 55
++80 127 157 146 190 211 172 205 220 136 185 209 136 185 209 136 185 209
++28 67 93 22 40 52 55 98 126 55 98 126 21 29 34 7 11 13
++50 82 103 101 161 196 101 161 196 35 83 115 13 20 25 2 2 1
++1 1 2 1 1 2 37 51 59 131 129 131 174 174 174 174 174 174
++167 166 167 163 162 163 163 162 163 167 166 167 174 174 174 125 124 125
++16 19 21 4 0 0
++4 4 4 4 0 0 4 0 0 60 74 84 174 174 174 174 174 174
++158 157 158 155 154 155 155 154 155 156 155 156 155 154 155 158 157 158
++167 166 167 165 164 165 131 129 131 60 73 81 13 16 17 4 0 0
++4 0 0 4 3 3 6 6 6 4 3 3 5 5 5 4 4 4
++4 4 4 3 2 2 0 0 0 0 0 0 7 11 13 45 69 86
++80 127 157 71 116 144 43 61 72 7 11 13 0 0 0 1 1 1
++4 3 3 4 4 4 4 4 4 4 4 4 6 6 6 5 5 5
++3 2 2 4 0 0 1 0 0 21 29 34 59 113 148 136 185 209
++146 190 211 136 185 209 136 185 209 136 185 209 136 185 209 136 185 209
++68 124 159 44 81 103 22 40 52 13 16 17 43 61 72 90 154 193
++136 185 209 59 113 148 21 29 34 3 4 3 1 1 1 0 0 0
++24 26 27 125 124 125 163 162 163 174 174 174 166 165 166 165 164 165
++163 162 163 125 124 125 125 124 125 125 124 125 125 124 125 26 28 28
++4 0 0 4 3 3
++3 3 3 0 0 0 24 26 27 153 152 153 177 184 187 158 157 158
++156 155 156 156 155 156 155 154 155 155 154 155 165 164 165 174 174 174
++155 154 155 60 74 84 26 28 28 4 0 0 4 0 0 3 1 0
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 3 3
++2 0 0 0 0 0 0 0 0 32 43 50 72 125 159 101 161 196
++136 185 209 101 161 196 101 161 196 79 117 143 32 43 50 0 0 0
++0 0 0 2 2 2 4 4 4 4 4 4 3 3 3 1 0 0
++0 0 0 4 5 5 49 76 92 101 161 196 146 190 211 146 190 211
++136 185 209 136 185 209 136 185 209 136 185 209 136 185 209 90 154 193
++28 67 93 13 16 17 37 51 59 80 127 157 136 185 209 90 154 193
++22 40 52 6 9 11 3 4 3 2 2 1 16 19 21 60 73 81
++137 136 137 163 162 163 158 157 158 166 165 166 167 166 167 153 152 153
++60 74 84 37 38 37 6 6 6 13 16 17 4 0 0 1 0 0
++3 2 2 4 4 4
++3 2 2 4 0 0 37 38 37 137 136 137 167 166 167 158 157 158
++157 156 157 154 153 154 157 156 157 167 166 167 174 174 174 125 124 125
++37 38 37 4 0 0 4 0 0 4 0 0 4 3 3 4 4 4
++4 4 4 4 4 4 5 5 5 5 5 5 1 1 1 0 0 0
++0 0 0 16 21 25 55 98 126 90 154 193 136 185 209 101 161 196
++101 161 196 101 161 196 136 185 209 136 185 209 101 161 196 55 98 126
++14 17 19 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
++22 40 52 90 154 193 146 190 211 146 190 211 136 185 209 136 185 209
++136 185 209 136 185 209 136 185 209 101 161 196 35 83 115 7 11 13
++17 23 27 59 113 148 136 185 209 101 161 196 34 86 122 7 12 15
++2 5 5 3 4 3 6 6 6 60 73 81 131 129 131 163 162 163
++166 165 166 174 174 174 174 174 174 163 162 163 125 124 125 41 54 63
++13 16 17 4 0 0 4 0 0 4 0 0 1 0 0 2 2 2
++4 4 4 4 4 4
++1 1 1 2 1 0 43 57 68 137 136 137 153 152 153 153 152 153
++163 162 163 156 155 156 165 164 165 167 166 167 60 74 84 6 6 6
++4 0 0 4 0 0 5 5 5 4 4 4 4 4 4 4 4 4
++4 5 5 6 6 6 4 3 3 0 0 0 0 0 0 11 15 18
++40 71 93 100 139 164 101 161 196 101 161 196 101 161 196 101 161 196
++101 161 196 101 161 196 101 161 196 101 161 196 136 185 209 136 185 209
++101 161 196 45 69 86 6 6 6 0 0 0 17 23 27 55 98 126
++136 185 209 146 190 211 136 185 209 136 185 209 136 185 209 136 185 209
++136 185 209 136 185 209 90 154 193 22 40 52 7 11 13 50 82 103
++136 185 209 136 185 209 53 118 160 22 40 52 7 11 13 2 5 5
++3 4 3 37 38 37 125 124 125 157 156 157 166 165 166 167 166 167
++174 174 174 174 174 174 137 136 137 60 73 81 4 0 0 4 0 0
++4 0 0 4 0 0 5 5 5 3 3 3 3 3 3 4 4 4
++4 4 4 4 4 4
++4 0 0 4 0 0 41 54 63 137 136 137 125 124 125 131 129 131
++155 154 155 167 166 167 174 174 174 60 74 84 6 6 6 4 0 0
++4 3 3 6 6 6 4 4 4 4 4 4 4 4 4 5 5 5
++4 4 4 1 1 1 0 0 0 3 6 7 41 65 82 72 125 159
++101 161 196 101 161 196 101 161 196 90 154 193 90 154 193 101 161 196
++101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 136 185 209
++136 185 209 136 185 209 80 127 157 55 98 126 101 161 196 146 190 211
++136 185 209 136 185 209 136 185 209 101 161 196 136 185 209 101 161 196
++136 185 209 101 161 196 35 83 115 22 30 35 101 161 196 172 205 220
++90 154 193 28 67 93 7 11 13 2 5 5 3 4 3 13 16 17
++85 115 134 167 166 167 174 174 174 174 174 174 174 174 174 174 174 174
++167 166 167 60 74 84 13 16 17 4 0 0 4 0 0 4 3 3
++6 6 6 5 5 5 4 4 4 5 5 5 4 4 4 5 5 5
++5 5 5 5 5 5
++1 1 1 4 0 0 41 54 63 137 136 137 137 136 137 125 124 125
++131 129 131 167 166 167 157 156 157 37 38 37 6 6 6 4 0 0
++6 6 6 5 5 5 4 4 4 4 4 4 4 5 5 2 2 1
++0 0 0 0 0 0 26 37 45 58 111 146 101 161 196 101 161 196
++101 161 196 90 154 193 90 154 193 90 154 193 101 161 196 101 161 196
++101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
++101 161 196 136 185 209 136 185 209 136 185 209 146 190 211 136 185 209
++136 185 209 101 161 196 136 185 209 136 185 209 101 161 196 136 185 209
++101 161 196 136 185 209 136 185 209 136 185 209 136 185 209 16 89 141
++7 11 13 2 5 5 2 5 5 13 16 17 60 73 81 154 154 154
++174 174 174 174 174 174 174 174 174 174 174 174 163 162 163 125 124 125
++24 26 27 4 0 0 4 0 0 4 0 0 5 5 5 5 5 5
++4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 5 5 5
++5 5 5 4 4 4
++4 0 0 6 6 6 37 38 37 137 136 137 137 136 137 131 129 131
++131 129 131 153 152 153 131 129 131 26 28 28 4 0 0 4 3 3
++6 6 6 4 4 4 4 4 4 4 4 4 0 0 0 0 0 0
++13 20 25 51 88 114 90 154 193 101 161 196 101 161 196 90 154 193
++90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
++101 161 196 101 161 196 101 161 196 101 161 196 136 185 209 101 161 196
++101 161 196 136 185 209 101 161 196 136 185 209 136 185 209 101 161 196
++136 185 209 101 161 196 136 185 209 101 161 196 101 161 196 101 161 196
++136 185 209 136 185 209 136 185 209 37 112 160 21 29 34 5 7 8
++2 5 5 13 16 17 43 57 68 131 129 131 174 174 174 174 174 174
++174 174 174 167 166 167 157 156 157 125 124 125 37 38 37 4 0 0
++4 0 0 4 0 0 5 5 5 5 5 5 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++1 1 1 4 0 0 41 54 63 153 152 153 137 136 137 137 136 137
++137 136 137 153 152 153 125 124 125 24 26 27 4 0 0 3 2 2
++4 4 4 4 4 4 4 3 3 4 0 0 3 6 7 43 61 72
++64 123 161 101 161 196 90 154 193 90 154 193 90 154 193 90 154 193
++90 154 193 90 154 193 90 154 193 90 154 193 101 161 196 90 154 193
++101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
++101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
++136 185 209 101 161 196 101 161 196 136 185 209 136 185 209 101 161 196
++101 161 196 90 154 193 28 67 93 13 16 17 7 11 13 3 6 7
++37 51 59 125 124 125 163 162 163 174 174 174 167 166 167 166 165 166
++167 166 167 131 129 131 60 73 81 4 0 0 4 0 0 4 0 0
++3 3 3 5 5 5 6 6 6 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 0 0 4 0 0 41 54 63 137 136 137 153 152 153 137 136 137
++153 152 153 157 156 157 125 124 125 24 26 27 0 0 0 2 2 2
++4 4 4 4 4 4 2 0 0 0 0 0 28 67 93 90 154 193
++90 154 193 90 154 193 90 154 193 90 154 193 64 123 161 90 154 193
++90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
++90 154 193 101 161 196 101 161 196 101 161 196 90 154 193 136 185 209
++101 161 196 101 161 196 136 185 209 101 161 196 136 185 209 101 161 196
++101 161 196 101 161 196 136 185 209 101 161 196 101 161 196 90 154 193
++35 83 115 13 16 17 3 6 7 2 5 5 13 16 17 60 74 84
++154 154 154 166 165 166 165 164 165 158 157 158 163 162 163 157 156 157
++60 74 84 13 16 17 4 0 0 4 0 0 3 2 2 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++1 1 1 4 0 0 41 54 63 157 156 157 155 154 155 137 136 137
++153 152 153 158 157 158 137 136 137 26 28 28 2 0 0 2 2 2
++4 4 4 4 4 4 1 0 0 6 10 14 34 86 122 90 154 193
++64 123 161 90 154 193 64 123 161 90 154 193 90 154 193 90 154 193
++64 123 161 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
++101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
++101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
++136 185 209 101 161 196 136 185 209 90 154 193 26 108 161 22 40 52
++13 16 17 5 7 8 2 5 5 2 5 5 37 38 37 165 164 165
++174 174 174 163 162 163 154 154 154 165 164 165 167 166 167 60 73 81
++6 6 6 4 0 0 4 0 0 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 0 0 6 6 6 41 54 63 156 155 156 158 157 158 153 152 153
++156 155 156 165 164 165 137 136 137 26 28 28 0 0 0 2 2 2
++4 4 5 4 4 4 2 0 0 7 12 15 31 96 139 64 123 161
++90 154 193 64 123 161 90 154 193 90 154 193 64 123 161 90 154 193
++90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
++90 154 193 90 154 193 90 154 193 101 161 196 101 161 196 101 161 196
++101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 136 185 209
++101 161 196 136 185 209 26 108 161 22 40 52 7 11 13 5 7 8
++2 5 5 2 5 5 2 5 5 2 2 1 37 38 37 158 157 158
++174 174 174 154 154 154 156 155 156 167 166 167 165 164 165 37 38 37
++4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++3 1 0 4 0 0 60 73 81 157 156 157 163 162 163 153 152 153
++158 157 158 167 166 167 137 136 137 26 28 28 2 0 0 2 2 2
++4 5 5 4 4 4 4 0 0 7 12 15 24 86 132 26 108 161
++37 112 160 64 123 161 90 154 193 64 123 161 90 154 193 90 154 193
++90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
++90 154 193 101 161 196 90 154 193 101 161 196 101 161 196 101 161 196
++101 161 196 101 161 196 101 161 196 136 185 209 101 161 196 136 185 209
++90 154 193 35 83 115 13 16 17 13 16 17 7 11 13 3 6 7
++5 7 8 6 6 6 3 4 3 2 2 1 30 32 34 154 154 154
++167 166 167 154 154 154 154 154 154 174 174 174 165 164 165 37 38 37
++6 6 6 4 0 0 6 6 6 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 0 0 4 0 0 41 54 63 163 162 163 166 165 166 154 154 154
++163 162 163 174 174 174 137 136 137 26 28 28 0 0 0 2 2 2
++4 5 5 4 4 5 1 1 2 6 10 14 28 67 93 18 97 151
++18 97 151 18 97 151 26 108 161 37 112 160 37 112 160 90 154 193
++64 123 161 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
++90 154 193 101 161 196 101 161 196 90 154 193 101 161 196 101 161 196
++101 161 196 101 161 196 101 161 196 136 185 209 90 154 193 16 89 141
++13 20 25 7 11 13 5 7 8 5 7 8 2 5 5 4 5 5
++3 4 3 4 5 5 3 4 3 0 0 0 37 38 37 158 157 158
++174 174 174 158 157 158 158 157 158 167 166 167 174 174 174 41 54 63
++4 0 0 3 2 2 5 5 5 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++1 1 1 4 0 0 60 73 81 165 164 165 174 174 174 158 157 158
++167 166 167 174 174 174 153 152 153 26 28 28 2 0 0 2 2 2
++4 5 5 4 4 4 4 0 0 7 12 15 10 87 144 10 87 144
++18 97 151 18 97 151 18 97 151 26 108 161 26 108 161 26 108 161
++26 108 161 37 112 160 53 118 160 90 154 193 90 154 193 90 154 193
++90 154 193 90 154 193 101 161 196 101 161 196 101 161 196 101 161 196
++101 161 196 136 185 209 90 154 193 26 108 161 22 40 52 13 16 17
++7 11 13 3 6 7 5 7 8 5 7 8 2 5 5 4 5 5
++4 5 5 6 6 6 3 4 3 0 0 0 30 32 34 158 157 158
++174 174 174 156 155 156 155 154 155 165 164 165 154 153 154 37 38 37
++4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 0 0 4 0 0 60 73 81 167 166 167 174 174 174 163 162 163
++174 174 174 174 174 174 153 152 153 26 28 28 0 0 0 3 3 3
++5 5 5 4 4 4 1 1 2 7 12 15 28 67 93 18 97 151
++18 97 151 18 97 151 18 97 151 18 97 151 18 97 151 26 108 161
++26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
++90 154 193 26 108 161 90 154 193 90 154 193 90 154 193 101 161 196
++101 161 196 26 108 161 22 40 52 13 16 17 7 11 13 2 5 5
++2 5 5 6 6 6 2 5 5 4 5 5 4 5 5 4 5 5
++3 4 3 5 5 5 3 4 3 2 0 0 30 32 34 137 136 137
++153 152 153 137 136 137 131 129 131 137 136 137 131 129 131 37 38 37
++4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++1 1 1 4 0 0 60 73 81 167 166 167 174 174 174 166 165 166
++174 174 174 177 184 187 153 152 153 30 32 34 1 0 0 3 3 3
++5 5 5 4 3 3 4 0 0 7 12 15 10 87 144 10 87 144
++18 97 151 18 97 151 18 97 151 26 108 161 26 108 161 26 108 161
++26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
++26 108 161 26 108 161 26 108 161 90 154 193 90 154 193 26 108 161
++35 83 115 13 16 17 7 11 13 5 7 8 3 6 7 5 7 8
++2 5 5 6 6 6 4 5 5 4 5 5 3 4 3 4 5 5
++3 4 3 6 6 6 3 4 3 0 0 0 26 28 28 125 124 125
++131 129 131 125 124 125 125 124 125 131 129 131 131 129 131 37 38 37
++4 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++3 1 0 4 0 0 60 73 81 174 174 174 177 184 187 167 166 167
++174 174 174 177 184 187 153 152 153 30 32 34 0 0 0 3 3 3
++5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 18 97 151
++18 97 151 18 97 151 18 97 151 18 97 151 18 97 151 26 108 161
++26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
++26 108 161 90 154 193 26 108 161 26 108 161 24 86 132 13 20 25
++7 11 13 13 20 25 22 40 52 5 7 8 3 4 3 3 4 3
++4 5 5 3 4 3 4 5 5 3 4 3 4 5 5 3 4 3
++4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 125 124 125
++137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
++0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++1 1 1 4 0 0 60 73 81 174 174 174 177 184 187 174 174 174
++174 174 174 190 197 201 157 156 157 30 32 34 1 0 0 3 3 3
++5 5 5 4 3 3 4 0 0 7 12 15 10 87 144 10 87 144
++18 97 151 19 95 150 19 95 150 18 97 151 18 97 151 26 108 161
++18 97 151 26 108 161 26 108 161 26 108 161 26 108 161 90 154 193
++26 108 161 26 108 161 26 108 161 22 40 52 2 5 5 3 4 3
++28 67 93 37 112 160 34 86 122 2 5 5 3 4 3 3 4 3
++3 4 3 3 4 3 3 4 3 2 2 1 3 4 3 4 4 4
++4 5 5 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
++137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
++0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 0 0 4 0 0 60 73 81 174 174 174 177 184 187 174 174 174
++174 174 174 190 197 201 158 157 158 30 32 34 0 0 0 2 2 2
++5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 18 97 151
++10 87 144 19 95 150 19 95 150 18 97 151 18 97 151 18 97 151
++26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
++18 97 151 22 40 52 2 5 5 2 2 1 22 40 52 26 108 161
++90 154 193 37 112 160 22 40 52 3 4 3 13 20 25 22 30 35
++3 6 7 1 1 1 2 2 2 6 9 11 5 5 5 4 3 3
++4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
++137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
++0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++1 1 1 4 0 0 60 73 81 177 184 187 193 200 203 174 174 174
++177 184 187 193 200 203 163 162 163 30 32 34 4 0 0 2 2 2
++5 5 5 4 3 3 4 0 0 6 10 14 24 86 132 10 87 144
++10 87 144 10 87 144 19 95 150 19 95 150 19 95 150 18 97 151
++26 108 161 26 108 161 26 108 161 90 154 193 26 108 161 28 67 93
++6 10 14 2 5 5 13 20 25 24 86 132 37 112 160 90 154 193
++10 87 144 7 12 15 2 5 5 28 67 93 37 112 160 28 67 93
++2 2 1 7 12 15 35 83 115 28 67 93 3 6 7 1 0 0
++4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
++137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
++0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 0 0 4 0 0 60 73 81 174 174 174 190 197 201 174 174 174
++177 184 187 193 200 203 163 162 163 30 32 34 0 0 0 2 2 2
++5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
++10 87 144 16 89 141 19 95 150 10 87 144 26 108 161 26 108 161
++26 108 161 26 108 161 26 108 161 28 67 93 6 10 14 1 1 2
++7 12 15 28 67 93 26 108 161 16 89 141 24 86 132 21 29 34
++3 4 3 21 29 34 37 112 160 37 112 160 27 99 146 21 29 34
++21 29 34 26 108 161 90 154 193 35 83 115 1 1 2 2 0 0
++4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 125 124 125
++137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
++0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++3 1 0 4 0 0 60 73 81 193 200 203 193 200 203 174 174 174
++190 197 201 193 200 203 165 164 165 37 38 37 4 0 0 2 2 2
++5 5 5 4 3 3 4 0 0 6 10 14 24 86 132 10 87 144
++10 87 144 10 87 144 16 89 141 18 97 151 18 97 151 10 87 144
++24 86 132 24 86 132 13 20 25 4 5 7 4 5 7 22 40 52
++18 97 151 37 112 160 26 108 161 7 12 15 1 1 1 0 0 0
++28 67 93 37 112 160 26 108 161 28 67 93 22 40 52 28 67 93
++26 108 161 90 154 193 26 108 161 10 87 144 0 0 0 2 0 0
++4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
++137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
++0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 0 0 6 6 6 60 73 81 174 174 174 193 200 203 174 174 174
++190 197 201 193 200 203 165 164 165 30 32 34 0 0 0 2 2 2
++5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
++10 87 144 10 87 144 10 87 144 18 97 151 28 67 93 6 10 14
++0 0 0 1 1 2 4 5 7 13 20 25 16 89 141 26 108 161
++26 108 161 26 108 161 24 86 132 6 9 11 2 3 3 22 40 52
++37 112 160 16 89 141 22 40 52 28 67 93 26 108 161 26 108 161
++90 154 193 26 108 161 26 108 161 28 67 93 1 1 1 4 0 0
++4 4 4 5 5 5 3 3 3 4 0 0 26 28 28 124 126 130
++137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
++0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 0 0 4 0 0 60 73 81 193 200 203 193 200 203 174 174 174
++193 200 203 193 200 203 167 166 167 37 38 37 4 0 0 2 2 2
++5 5 5 4 4 4 4 0 0 6 10 14 28 67 93 10 87 144
++10 87 144 10 87 144 18 97 151 10 87 144 13 20 25 4 5 7
++1 1 2 1 1 1 22 40 52 26 108 161 26 108 161 26 108 161
++26 108 161 26 108 161 26 108 161 24 86 132 22 40 52 22 40 52
++22 40 52 22 40 52 10 87 144 26 108 161 26 108 161 26 108 161
++26 108 161 26 108 161 90 154 193 10 87 144 0 0 0 4 0 0
++4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
++137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
++0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
++190 197 201 205 212 215 167 166 167 30 32 34 0 0 0 2 2 2
++5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
++10 87 144 10 87 144 10 87 144 10 87 144 22 40 52 1 1 2
++2 0 0 1 1 2 24 86 132 26 108 161 26 108 161 26 108 161
++26 108 161 19 95 150 16 89 141 10 87 144 22 40 52 22 40 52
++10 87 144 26 108 161 37 112 160 26 108 161 26 108 161 26 108 161
++26 108 161 26 108 161 26 108 161 28 67 93 2 0 0 3 1 0
++4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
++137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
++0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 0 0 4 0 0 60 73 81 220 221 221 190 197 201 174 174 174
++193 200 203 193 200 203 174 174 174 37 38 37 4 0 0 2 2 2
++5 5 5 4 4 4 3 2 2 1 1 2 13 20 25 10 87 144
++10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 13 20 25
++13 20 25 22 40 52 10 87 144 18 97 151 18 97 151 26 108 161
++10 87 144 13 20 25 6 10 14 21 29 34 24 86 132 18 97 151
++26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
++26 108 161 90 154 193 18 97 151 13 20 25 0 0 0 4 3 3
++4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
++137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
++0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
++190 197 201 220 221 221 167 166 167 30 32 34 1 0 0 2 2 2
++5 5 5 4 4 4 4 4 5 2 5 5 4 5 7 13 20 25
++28 67 93 10 87 144 10 87 144 10 87 144 10 87 144 10 87 144
++10 87 144 10 87 144 18 97 151 10 87 144 18 97 151 18 97 151
++28 67 93 2 3 3 0 0 0 28 67 93 26 108 161 26 108 161
++26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
++26 108 161 10 87 144 13 20 25 1 1 2 3 2 2 4 4 4
++4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
++137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
++0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 0 0 4 0 0 60 73 81 220 221 221 190 197 201 174 174 174
++193 200 203 193 200 203 174 174 174 26 28 28 4 0 0 4 3 3
++5 5 5 4 4 4 4 4 4 4 4 5 1 1 2 2 5 5
++4 5 7 22 40 52 10 87 144 10 87 144 18 97 151 10 87 144
++10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 18 97 151
++10 87 144 28 67 93 22 40 52 10 87 144 26 108 161 18 97 151
++18 97 151 18 97 151 26 108 161 26 108 161 26 108 161 26 108 161
++22 40 52 1 1 2 0 0 0 2 3 3 4 4 4 4 4 4
++4 4 4 5 5 5 4 4 4 0 0 0 26 28 28 131 129 131
++137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
++0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
++190 197 201 220 221 221 190 197 201 41 54 63 4 0 0 2 2 2
++6 6 6 4 4 4 4 4 4 4 4 5 4 4 5 3 3 3
++1 1 2 1 1 2 6 10 14 22 40 52 10 87 144 18 97 151
++18 97 151 10 87 144 10 87 144 10 87 144 18 97 151 10 87 144
++10 87 144 18 97 151 26 108 161 18 97 151 18 97 151 10 87 144
++26 108 161 26 108 161 26 108 161 10 87 144 28 67 93 6 10 14
++1 1 2 1 1 2 4 3 3 4 4 5 4 4 4 4 4 4
++5 5 5 5 5 5 1 1 1 4 0 0 37 51 59 137 136 137
++137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
++0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 0 0 4 0 0 60 73 81 220 221 221 193 200 203 174 174 174
++193 200 203 193 200 203 220 221 221 137 136 137 13 16 17 4 0 0
++2 2 2 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5
++4 4 5 4 3 3 1 1 2 4 5 7 13 20 25 28 67 93
++10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 10 87 144
++10 87 144 18 97 151 18 97 151 10 87 144 18 97 151 26 108 161
++26 108 161 18 97 151 28 67 93 6 10 14 0 0 0 0 0 0
++2 3 3 4 5 5 4 4 5 4 4 4 4 4 4 5 5 5
++3 3 3 1 1 1 0 0 0 16 19 21 125 124 125 137 136 137
++131 129 131 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
++0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
++193 200 203 190 197 201 220 221 221 220 221 221 153 152 153 30 32 34
++0 0 0 0 0 0 2 2 2 4 4 4 4 4 4 4 4 4
++4 4 4 4 5 5 4 5 7 1 1 2 1 1 2 4 5 7
++13 20 25 28 67 93 10 87 144 18 97 151 10 87 144 10 87 144
++10 87 144 10 87 144 10 87 144 18 97 151 26 108 161 18 97 151
++28 67 93 7 12 15 0 0 0 0 0 0 2 2 1 4 4 4
++4 5 5 4 5 5 4 4 4 4 4 4 3 3 3 0 0 0
++0 0 0 0 0 0 37 38 37 125 124 125 158 157 158 131 129 131
++125 124 125 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
++0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 3 3 4 0 0 41 54 63 193 200 203 220 221 221 174 174 174
++193 200 203 193 200 203 193 200 203 220 221 221 244 246 246 193 200 203
++120 125 127 5 5 5 1 0 0 0 0 0 1 1 1 4 4 4
++4 4 4 4 4 4 4 5 5 4 5 5 4 4 5 1 1 2
++4 5 7 4 5 7 22 40 52 10 87 144 10 87 144 10 87 144
++10 87 144 10 87 144 18 97 151 10 87 144 10 87 144 13 20 25
++4 5 7 2 3 3 1 1 2 4 4 4 4 5 5 4 4 4
++4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 1 1 2
++24 26 27 60 74 84 153 152 153 163 162 163 137 136 137 125 124 125
++125 124 125 125 124 125 125 124 125 137 136 137 125 124 125 26 28 28
++0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 0 0 6 6 6 26 28 28 156 155 156 220 221 221 220 221 221
++174 174 174 193 200 203 193 200 203 193 200 203 205 212 215 220 221 221
++220 221 221 167 166 167 60 73 81 7 11 13 0 0 0 0 0 0
++3 3 3 4 4 4 4 4 4 4 4 4 4 4 5 4 4 5
++4 4 5 1 1 2 1 1 2 4 5 7 22 40 52 10 87 144
++10 87 144 10 87 144 10 87 144 22 40 52 4 5 7 1 1 2
++1 1 2 4 4 5 4 4 4 4 4 4 4 4 4 4 4 4
++5 5 5 2 2 2 0 0 0 4 0 0 16 19 21 60 73 81
++137 136 137 167 166 167 158 157 158 137 136 137 131 129 131 131 129 131
++125 124 125 125 124 125 131 129 131 155 154 155 60 74 84 5 7 8
++0 0 0 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++5 5 5 4 0 0 4 0 0 60 73 81 193 200 203 220 221 221
++193 200 203 193 200 203 193 200 203 193 200 203 205 212 215 220 221 221
++220 221 221 220 221 221 220 221 221 137 136 137 43 57 68 6 6 6
++4 0 0 1 1 1 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 5 4 4 5 3 2 2 1 1 2 2 5 5 13 20 25
++22 40 52 22 40 52 13 20 25 2 3 3 1 1 2 3 3 3
++4 5 7 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++1 1 1 0 0 0 2 3 3 41 54 63 131 129 131 166 165 166
++166 165 166 155 154 155 153 152 153 137 136 137 137 136 137 125 124 125
++125 124 125 137 136 137 137 136 137 125 124 125 37 38 37 4 3 3
++4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 3 3 6 6 6 6 6 6 13 16 17 60 73 81 167 166 167
++220 221 221 220 221 221 220 221 221 193 200 203 193 200 203 193 200 203
++205 212 215 220 221 221 220 221 221 244 246 246 205 212 215 125 124 125
++24 26 27 0 0 0 0 0 0 2 2 2 5 5 5 5 5 5
++4 4 4 4 4 4 4 4 4 4 4 5 1 1 2 4 5 7
++4 5 7 4 5 7 1 1 2 3 2 2 4 4 5 4 4 4
++4 4 4 4 4 4 5 5 5 4 4 4 0 0 0 0 0 0
++2 0 0 26 28 28 125 124 125 174 174 174 174 174 174 166 165 166
++156 155 156 153 152 153 137 136 137 137 136 137 131 129 131 137 136 137
++137 136 137 137 136 137 60 74 84 30 32 34 4 0 0 4 0 0
++5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++5 5 5 6 6 6 4 0 0 4 0 0 6 6 6 26 28 28
++125 124 125 174 174 174 220 221 221 220 221 221 220 221 221 193 200 203
++205 212 215 220 221 221 205 212 215 220 221 221 220 221 221 244 246 246
++193 200 203 60 74 84 13 16 17 4 0 0 0 0 0 3 3 3
++5 5 5 5 5 5 4 4 4 4 4 4 4 4 5 3 3 3
++1 1 2 3 3 3 4 4 5 4 4 5 4 4 4 4 4 4
++5 5 5 5 5 5 2 2 2 0 0 0 0 0 0 13 16 17
++60 74 84 174 174 174 193 200 203 174 174 174 167 166 167 163 162 163
++153 152 153 153 152 153 137 136 137 137 136 137 153 152 153 137 136 137
++125 124 125 41 54 63 24 26 27 4 0 0 4 0 0 5 5 5
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 3 3 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
++6 6 6 37 38 37 131 129 131 220 221 221 220 221 221 220 221 221
++193 200 203 193 200 203 220 221 221 205 212 215 220 221 221 244 246 246
++244 246 246 244 246 246 174 174 174 41 54 63 0 0 0 0 0 0
++0 0 0 4 4 4 5 5 5 5 5 5 4 4 4 4 4 5
++4 4 5 4 4 5 4 4 4 4 4 4 6 6 6 6 6 6
++3 3 3 0 0 0 2 0 0 13 16 17 60 73 81 156 155 156
++220 221 221 193 200 203 174 174 174 165 164 165 163 162 163 154 153 154
++153 152 153 153 152 153 158 157 158 163 162 163 137 136 137 60 73 81
++13 16 17 4 0 0 4 0 0 4 3 3 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++5 5 5 4 3 3 4 3 3 6 6 6 6 6 6 6 6 6
++6 6 6 6 6 6 6 6 6 37 38 37 167 166 167 244 246 246
++244 246 246 220 221 221 205 212 215 205 212 215 220 221 221 193 200 203
++220 221 221 244 246 246 244 246 246 244 246 246 137 136 137 37 38 37
++3 2 2 0 0 0 1 1 1 5 5 5 5 5 5 4 4 4
++4 4 4 4 4 4 4 4 4 5 5 5 4 4 4 1 1 1
++0 0 0 5 5 5 43 57 68 153 152 153 193 200 203 220 221 221
++177 184 187 174 174 174 167 166 167 166 165 166 158 157 158 157 156 157
++158 157 158 166 165 166 156 155 156 85 115 134 13 16 17 4 0 0
++4 0 0 4 0 0 5 5 5 5 5 5 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++5 5 5 4 3 3 6 6 6 6 6 6 4 0 0 6 6 6
++6 6 6 6 6 6 6 6 6 6 6 6 13 16 17 60 73 81
++177 184 187 220 221 221 220 221 221 220 221 221 205 212 215 220 221 221
++220 221 221 205 212 215 220 221 221 244 246 246 244 246 246 205 212 215
++125 124 125 30 32 34 0 0 0 0 0 0 2 2 2 5 5 5
++4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 1 0 0
++37 38 37 131 129 131 205 212 215 220 221 221 193 200 203 174 174 174
++174 174 174 174 174 174 167 166 167 165 164 165 166 165 166 167 166 167
++158 157 158 125 124 125 37 38 37 4 0 0 4 0 0 4 0 0
++4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 4 4 5 5 5 4 3 3 4 3 3 6 6 6 6 6 6
++4 0 0 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
++26 28 28 125 124 125 205 212 215 220 221 221 220 221 221 220 221 221
++205 212 215 220 221 221 205 212 215 220 221 221 220 221 221 244 246 246
++244 246 246 190 197 201 60 74 84 16 19 21 4 0 0 0 0 0
++0 0 0 0 0 0 0 0 0 0 0 0 16 19 21 120 125 127
++177 184 187 220 221 221 205 212 215 177 184 187 174 174 174 177 184 187
++174 174 174 174 174 174 167 166 167 174 174 174 166 165 166 137 136 137
++60 73 81 13 16 17 4 0 0 4 0 0 4 3 3 6 6 6
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++5 5 5 4 3 3 5 5 5 4 3 3 6 6 6 4 0 0
++6 6 6 6 6 6 4 0 0 6 6 6 4 0 0 6 6 6
++6 6 6 6 6 6 37 38 37 137 136 137 193 200 203 220 221 221
++220 221 221 205 212 215 220 221 221 205 212 215 205 212 215 220 221 221
++220 221 221 220 221 221 244 246 246 166 165 166 43 57 68 2 2 2
++0 0 0 4 0 0 16 19 21 60 73 81 157 156 157 202 210 214
++220 221 221 193 200 203 177 184 187 177 184 187 177 184 187 174 174 174
++174 174 174 174 174 174 174 174 174 157 156 157 60 74 84 24 26 27
++4 0 0 4 0 0 4 0 0 6 6 6 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 4 4 4 4 4 5 5 5 4 3 3 5 5 5 6 6 6
++6 6 6 4 0 0 6 6 6 6 6 6 6 6 6 4 0 0
++4 0 0 4 0 0 6 6 6 24 26 27 60 73 81 167 166 167
++220 221 221 220 221 221 220 221 221 205 212 215 205 212 215 205 212 215
++205 212 215 220 221 221 220 221 221 220 221 221 205 212 215 137 136 137
++60 74 84 125 124 125 137 136 137 190 197 201 220 221 221 193 200 203
++177 184 187 177 184 187 177 184 187 174 174 174 174 174 174 177 184 187
++190 197 201 174 174 174 125 124 125 37 38 37 6 6 6 4 0 0
++4 0 0 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 4 4 4 4 4 5 5 5 5 5 5 4 3 3 6 6 6
++4 0 0 6 6 6 6 6 6 6 6 6 4 0 0 6 6 6
++6 6 6 6 6 6 4 0 0 4 0 0 6 6 6 6 6 6
++125 124 125 193 200 203 244 246 246 220 221 221 205 212 215 205 212 215
++205 212 215 193 200 203 205 212 215 205 212 215 220 221 221 220 221 221
++193 200 203 193 200 203 205 212 215 193 200 203 193 200 203 177 184 187
++190 197 201 190 197 201 174 174 174 190 197 201 193 200 203 190 197 201
++153 152 153 60 73 81 4 0 0 4 0 0 4 0 0 3 2 2
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 4 3 3
++6 6 6 4 3 3 4 3 3 4 3 3 6 6 6 6 6 6
++4 0 0 6 6 6 6 6 6 6 6 6 4 0 0 4 0 0
++4 0 0 26 28 28 131 129 131 220 221 221 244 246 246 220 221 221
++205 212 215 193 200 203 205 212 215 193 200 203 193 200 203 205 212 215
++220 221 221 193 200 203 193 200 203 193 200 203 190 197 201 174 174 174
++174 174 174 190 197 201 193 200 203 193 200 203 167 166 167 125 124 125
++6 6 6 4 0 0 4 0 0 4 3 3 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
++5 5 5 4 3 3 5 5 5 6 6 6 4 3 3 5 5 5
++6 6 6 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
++4 0 0 4 0 0 6 6 6 41 54 63 158 157 158 220 221 221
++220 221 221 220 221 221 193 200 203 193 200 203 193 200 203 190 197 201
++190 197 201 190 197 201 190 197 201 190 197 201 174 174 174 193 200 203
++193 200 203 220 221 221 174 174 174 125 124 125 37 38 37 4 0 0
++4 0 0 4 3 3 6 6 6 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 5 5 5 4 3 3 4 3 3 4 3 3 5 5 5
++4 3 3 6 6 6 5 5 5 4 3 3 6 6 6 6 6 6
++6 6 6 6 6 6 4 0 0 4 0 0 13 16 17 60 73 81
++174 174 174 220 221 221 220 221 221 205 212 215 190 197 201 174 174 174
++193 200 203 174 174 174 190 197 201 174 174 174 193 200 203 220 221 221
++193 200 203 131 129 131 37 38 37 6 6 6 4 0 0 4 0 0
++6 6 6 6 6 6 4 3 3 5 5 5 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 5 5 5
++5 5 5 4 3 3 4 3 3 5 5 5 4 3 3 4 3 3
++5 5 5 6 6 6 6 6 6 4 0 0 6 6 6 6 6 6
++6 6 6 125 124 125 174 174 174 220 221 221 220 221 221 193 200 203
++193 200 203 193 200 203 193 200 203 193 200 203 220 221 221 158 157 158
++60 73 81 6 6 6 4 0 0 4 0 0 5 5 5 6 6 6
++5 5 5 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 5 5 5 5 5 5 4 3 3 5 5 5 4 3 3
++5 5 5 5 5 5 6 6 6 6 6 6 4 0 0 4 0 0
++4 0 0 4 0 0 26 28 28 125 124 125 174 174 174 193 200 203
++193 200 203 174 174 174 193 200 203 167 166 167 125 124 125 6 6 6
++6 6 6 6 6 6 4 0 0 6 6 6 6 6 6 5 5 5
++4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
++4 3 3 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
++6 6 6 4 0 0 4 0 0 6 6 6 37 38 37 125 124 125
++153 152 153 131 129 131 125 124 125 37 38 37 6 6 6 6 6 6
++6 6 6 4 0 0 6 6 6 6 6 6 4 3 3 5 5 5
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 5 5 5 5 5 5 4 3 3 5 5 5 4 3 3
++6 6 6 6 6 6 4 0 0 4 0 0 6 6 6 6 6 6
++24 26 27 24 26 27 6 6 6 6 6 6 6 6 6 4 0 0
++6 6 6 6 6 6 4 0 0 6 6 6 5 5 5 4 3 3
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 5 5 5 4 3 3 5 5 5 6 6 6
++4 0 0 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
++6 6 6 6 6 6 6 6 6 4 0 0 6 6 6 6 6 6
++4 0 0 6 6 6 6 6 6 4 3 3 5 5 5 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 5 5 5
++5 5 5 5 5 5 4 0 0 6 6 6 4 0 0 6 6 6
++6 6 6 6 6 6 6 6 6 4 0 0 6 6 6 4 0 0
++6 6 6 4 3 3 5 5 5 4 3 3 5 5 5 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
++4 3 3 6 6 6 4 3 3 6 6 6 6 6 6 6 6 6
++4 0 0 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
++6 6 6 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 5 5 5 4 3 3 5 5 5 4 0 0 6 6 6
++6 6 6 4 0 0 6 6 6 6 6 6 4 0 0 6 6 6
++4 3 3 5 5 5 5 5 5 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 5 5 5 4 3 3 5 5 5 6 6 6 4 3 3
++4 3 3 6 6 6 6 6 6 4 3 3 6 6 6 4 3 3
++5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 6 6 6
++5 5 5 4 3 3 4 3 3 4 3 3 5 5 5 5 5 5
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 4 3 3
++5 5 5 4 3 3 5 5 5 5 5 5 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
++4 4 4 4 4 4
+diff --git a/drivers/video/nvidia/nv_backlight.c b/drivers/video/nvidia/nv_backlight.c
+index 443e3c8..c443d6a 100644
+--- a/drivers/video/nvidia/nv_backlight.c
++++ b/drivers/video/nvidia/nv_backlight.c
+@@ -87,7 +87,7 @@ static int nvidia_bl_get_brightness(struct backlight_device *bd)
+ return bd->props.brightness;
+ }
+
+-static struct backlight_ops nvidia_bl_ops = {
++static const struct backlight_ops nvidia_bl_ops = {
+ .get_brightness = nvidia_bl_get_brightness,
+ .update_status = nvidia_bl_update_status,
+ };
+diff --git a/drivers/video/riva/fbdev.c b/drivers/video/riva/fbdev.c
+index d94c57f..912984c 100644
+--- a/drivers/video/riva/fbdev.c
++++ b/drivers/video/riva/fbdev.c
+@@ -331,7 +331,7 @@ static int riva_bl_get_brightness(struct backlight_device *bd)
+ return bd->props.brightness;
+ }
+
+-static struct backlight_ops riva_bl_ops = {
++static const struct backlight_ops riva_bl_ops = {
+ .get_brightness = riva_bl_get_brightness,
+ .update_status = riva_bl_update_status,
+ };
+diff --git a/drivers/video/uvesafb.c b/drivers/video/uvesafb.c
+index 54fbb29..37bab4b 100644
+--- a/drivers/video/uvesafb.c
++++ b/drivers/video/uvesafb.c
+@@ -18,6 +18,7 @@
+ #include <linux/fb.h>
+ #include <linux/io.h>
+ #include <linux/mutex.h>
++#include <linux/moduleloader.h>
+ #include <video/edid.h>
+ #include <video/uvesafb.h>
+ #ifdef CONFIG_X86
+@@ -72,7 +73,7 @@ static void uvesafb_cn_callback(struct cn_msg *msg, struct netlink_skb_parms *ns
+ struct uvesafb_task *utask;
+ struct uvesafb_ktask *task;
+
+- if (!cap_raised(nsp->eff_cap, CAP_SYS_ADMIN))
++ if (!capable(CAP_SYS_ADMIN))
+ return;
+
+ if (msg->seq >= UVESAFB_TASKS_MAX)
+@@ -120,7 +121,7 @@ static int uvesafb_helper_start(void)
+ NULL,
+ };
+
+- return call_usermodehelper(v86d_path, argv, envp, 1);
++ return call_usermodehelper(v86d_path, argv, envp, UMH_WAIT_PROC);
+ }
+
+ /*
+@@ -568,10 +569,32 @@ static int __devinit uvesafb_vbe_getpmi(struct uvesafb_ktask *task,
+ if ((task->t.regs.eax & 0xffff) != 0x4f || task->t.regs.es < 0xc000) {
+ par->pmi_setpal = par->ypan = 0;
+ } else {
++
++#ifdef CONFIG_PAX_KERNEXEC
++#ifdef CONFIG_MODULES
++ par->pmi_code = module_alloc_exec((u16)task->t.regs.ecx);
++#endif
++ if (!par->pmi_code) {
++ par->pmi_setpal = par->ypan = 0;
++ return 0;
++ }
++#endif
++
+ par->pmi_base = (u16 *)phys_to_virt(((u32)task->t.regs.es << 4)
+ + task->t.regs.edi);
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
++ pax_open_kernel();
++ memcpy(par->pmi_code, par->pmi_base, (u16)task->t.regs.ecx);
++ pax_close_kernel();
++
++ par->pmi_start = ktva_ktla(par->pmi_code + par->pmi_base[1]);
++ par->pmi_pal = ktva_ktla(par->pmi_code + par->pmi_base[2]);
++#else
+ par->pmi_start = (u8 *)par->pmi_base + par->pmi_base[1];
+ par->pmi_pal = (u8 *)par->pmi_base + par->pmi_base[2];
++#endif
++
+ printk(KERN_INFO "uvesafb: protected mode interface info at "
+ "%04x:%04x\n",
+ (u16)task->t.regs.es, (u16)task->t.regs.edi);
+@@ -1799,6 +1822,11 @@ out:
+ if (par->vbe_modes)
+ kfree(par->vbe_modes);
+
++#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
++ if (par->pmi_code)
++ module_free_exec(NULL, par->pmi_code);
++#endif
++
+ framebuffer_release(info);
+ return err;
+ }
+@@ -1825,6 +1853,12 @@ static int uvesafb_remove(struct platform_device *dev)
+ kfree(par->vbe_state_orig);
+ if (par->vbe_state_saved)
+ kfree(par->vbe_state_saved);
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
++ if (par->pmi_code)
++ module_free_exec(NULL, par->pmi_code);
++#endif
++
+ }
+
+ framebuffer_release(info);
+diff --git a/drivers/video/vesafb.c b/drivers/video/vesafb.c
+index bd37ee1..cb827e8 100644
+--- a/drivers/video/vesafb.c
++++ b/drivers/video/vesafb.c
+@@ -9,6 +9,7 @@
+ */
+
+ #include <linux/module.h>
++#include <linux/moduleloader.h>
+ #include <linux/kernel.h>
+ #include <linux/errno.h>
+ #include <linux/string.h>
+@@ -53,8 +54,8 @@ static int vram_remap __initdata; /* Set amount of memory to be used */
+ static int vram_total __initdata; /* Set total amount of memory */
+ static int pmi_setpal __read_mostly = 1; /* pmi for palette changes ??? */
+ static int ypan __read_mostly; /* 0..nothing, 1..ypan, 2..ywrap */
+-static void (*pmi_start)(void) __read_mostly;
+-static void (*pmi_pal) (void) __read_mostly;
++static void (*pmi_start)(void) __read_only;
++static void (*pmi_pal) (void) __read_only;
+ static int depth __read_mostly;
+ static int vga_compat __read_mostly;
+ /* --------------------------------------------------------------------- */
+@@ -233,6 +234,7 @@ static int __init vesafb_probe(struct platform_device *dev)
+ unsigned int size_vmode;
+ unsigned int size_remap;
+ unsigned int size_total;
++ void *pmi_code = NULL;
+
+ if (screen_info.orig_video_isVGA != VIDEO_TYPE_VLFB)
+ return -ENODEV;
+@@ -275,10 +277,6 @@ static int __init vesafb_probe(struct platform_device *dev)
+ size_remap = size_total;
+ vesafb_fix.smem_len = size_remap;
+
+-#ifndef __i386__
+- screen_info.vesapm_seg = 0;
+-#endif
+-
+ if (!request_mem_region(vesafb_fix.smem_start, size_total, "vesafb")) {
+ printk(KERN_WARNING
+ "vesafb: cannot reserve video memory at 0x%lx\n",
+@@ -315,9 +313,21 @@ static int __init vesafb_probe(struct platform_device *dev)
+ printk(KERN_INFO "vesafb: mode is %dx%dx%d, linelength=%d, pages=%d\n",
+ vesafb_defined.xres, vesafb_defined.yres, vesafb_defined.bits_per_pixel, vesafb_fix.line_length, screen_info.pages);
+
++#ifdef __i386__
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
++ pmi_code = module_alloc_exec(screen_info.vesapm_size);
++ if (!pmi_code)
++#elif !defined(CONFIG_PAX_KERNEXEC)
++ if (0)
++#endif
++
++#endif
++ screen_info.vesapm_seg = 0;
++
+ if (screen_info.vesapm_seg) {
+- printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x\n",
+- screen_info.vesapm_seg,screen_info.vesapm_off);
++ printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x %04x bytes\n",
++ screen_info.vesapm_seg,screen_info.vesapm_off,screen_info.vesapm_size);
+ }
+
+ if (screen_info.vesapm_seg < 0xc000)
+@@ -325,9 +335,25 @@ static int __init vesafb_probe(struct platform_device *dev)
+
+ if (ypan || pmi_setpal) {
+ unsigned short *pmi_base;
++
+ pmi_base = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
+- pmi_start = (void*)((char*)pmi_base + pmi_base[1]);
+- pmi_pal = (void*)((char*)pmi_base + pmi_base[2]);
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
++ pax_open_kernel();
++ memcpy(pmi_code, pmi_base, screen_info.vesapm_size);
++#else
++ pmi_code = pmi_base;
++#endif
++
++ pmi_start = (void*)((char*)pmi_code + pmi_base[1]);
++ pmi_pal = (void*)((char*)pmi_code + pmi_base[2]);
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
++ pmi_start = ktva_ktla(pmi_start);
++ pmi_pal = ktva_ktla(pmi_pal);
++ pax_close_kernel();
++#endif
++
+ printk(KERN_INFO "vesafb: pmi: set display start = %p, set palette = %p\n",pmi_start,pmi_pal);
+ if (pmi_base[3]) {
+ printk(KERN_INFO "vesafb: pmi: ports = ");
+@@ -469,6 +495,11 @@ static int __init vesafb_probe(struct platform_device *dev)
+ info->node, info->fix.id);
+ return 0;
+ err:
++
++#if defined(__i386__) && defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
++ module_free_exec(NULL, pmi_code);
++#endif
++
+ if (info->screen_base)
+ iounmap(info->screen_base);
+ framebuffer_release(info);
+diff --git a/drivers/xen/sys-hypervisor.c b/drivers/xen/sys-hypervisor.c
+index 88a60e0..6783cc2 100644
+--- a/drivers/xen/sys-hypervisor.c
++++ b/drivers/xen/sys-hypervisor.c
+@@ -425,7 +425,7 @@ static ssize_t hyp_sysfs_store(struct kobject *kobj,
+ return 0;
+ }
+
+-static struct sysfs_ops hyp_sysfs_ops = {
++static const struct sysfs_ops hyp_sysfs_ops = {
+ .show = hyp_sysfs_show,
+ .store = hyp_sysfs_store,
+ };
+diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
+index 18f74ec..3227009 100644
+--- a/fs/9p/vfs_inode.c
++++ b/fs/9p/vfs_inode.c
+@@ -1079,7 +1079,7 @@ static void *v9fs_vfs_follow_link(struct dentry *dentry, struct nameidata *nd)
+ static void
+ v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
+ {
+- char *s = nd_get_link(nd);
++ const char *s = nd_get_link(nd);
+
+ P9_DPRINTK(P9_DEBUG_VFS, " %s %s\n", dentry->d_name.name,
+ IS_ERR(s) ? "<error>" : s);
+diff --git a/fs/Kconfig.binfmt b/fs/Kconfig.binfmt
+index bb4cc5b..df5eaa0 100644
+--- a/fs/Kconfig.binfmt
++++ b/fs/Kconfig.binfmt
+@@ -86,7 +86,7 @@ config HAVE_AOUT
+
+ config BINFMT_AOUT
+ tristate "Kernel support for a.out and ECOFF binaries"
+- depends on HAVE_AOUT
++ depends on HAVE_AOUT && BROKEN
+ ---help---
+ A.out (Assembler.OUTput) is a set of formats for libraries and
+ executables used in the earliest versions of UNIX. Linux used
+diff --git a/fs/aio.c b/fs/aio.c
+index 22a19ad..d484e5b 100644
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -115,7 +115,7 @@ static int aio_setup_ring(struct kioctx *ctx)
+ size += sizeof(struct io_event) * nr_events;
+ nr_pages = (size + PAGE_SIZE-1) >> PAGE_SHIFT;
+
+- if (nr_pages < 0)
++ if (nr_pages <= 0)
+ return -EINVAL;
+
+ nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
+@@ -1089,6 +1089,8 @@ static int read_events(struct kioctx *ctx,
+ struct aio_timeout to;
+ int retry = 0;
+
++ pax_track_stack();
++
+ /* needed to zero any padding within an entry (there shouldn't be
+ * any, but C is fun!
+ */
+@@ -1382,13 +1384,18 @@ static ssize_t aio_fsync(struct kiocb *iocb)
+ static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb)
+ {
+ ssize_t ret;
++ struct iovec iovstack;
+
+ ret = rw_copy_check_uvector(type, (struct iovec __user *)kiocb->ki_buf,
+ kiocb->ki_nbytes, 1,
+- &kiocb->ki_inline_vec, &kiocb->ki_iovec);
++ &iovstack, &kiocb->ki_iovec);
+ if (ret < 0)
+ goto out;
+
++ if (kiocb->ki_iovec == &iovstack) {
++ kiocb->ki_inline_vec = iovstack;
++ kiocb->ki_iovec = &kiocb->ki_inline_vec;
++ }
+ kiocb->ki_nr_segs = kiocb->ki_nbytes;
+ kiocb->ki_cur_seg = 0;
+ /* ki_nbytes/left now reflect bytes instead of segs */
+diff --git a/fs/attr.c b/fs/attr.c
+index 96d394b..33cf5b4 100644
+--- a/fs/attr.c
++++ b/fs/attr.c
+@@ -83,6 +83,7 @@ int inode_newsize_ok(const struct inode *inode, loff_t offset)
+ unsigned long limit;
+
+ limit = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
++ gr_learn_resource(current, RLIMIT_FSIZE, (unsigned long)offset, 1);
+ if (limit != RLIM_INFINITY && offset > limit)
+ goto out_sig;
+ if (offset > inode->i_sb->s_maxbytes)
+diff --git a/fs/autofs4/symlink.c b/fs/autofs4/symlink.c
+index b4ea829..e63ef18 100644
+--- a/fs/autofs4/symlink.c
++++ b/fs/autofs4/symlink.c
+@@ -15,7 +15,7 @@
+ static void *autofs4_follow_link(struct dentry *dentry, struct nameidata *nd)
+ {
+ struct autofs_info *ino = autofs4_dentry_ino(dentry);
+- nd_set_link(nd, (char *)ino->u.symlink);
++ nd_set_link(nd, ino->u.symlink);
+ return NULL;
+ }
+
+diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
+index 136a0d6..a287331 100644
+--- a/fs/autofs4/waitq.c
++++ b/fs/autofs4/waitq.c
+@@ -60,7 +60,7 @@ static int autofs4_write(struct file *file, const void *addr, int bytes)
+ {
+ unsigned long sigpipe, flags;
+ mm_segment_t fs;
+- const char *data = (const char *)addr;
++ const char __user *data = (const char __force_user *)addr;
+ ssize_t wr = 0;
+
+ /** WARNING: this is not safe for writing more than PIPE_BUF bytes! **/
+diff --git a/fs/befs/linuxvfs.c b/fs/befs/linuxvfs.c
+index 9158c07..3f06659 100644
+--- a/fs/befs/linuxvfs.c
++++ b/fs/befs/linuxvfs.c
+@@ -498,7 +498,7 @@ static void befs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
+ {
+ befs_inode_info *befs_ino = BEFS_I(dentry->d_inode);
+ if (befs_ino->i_flags & BEFS_LONG_SYMLINK) {
+- char *link = nd_get_link(nd);
++ const char *link = nd_get_link(nd);
+ if (!IS_ERR(link))
+ kfree(link);
+ }
+diff --git a/fs/binfmt_aout.c b/fs/binfmt_aout.c
+index 0133b5a..3710d09 100644
+--- a/fs/binfmt_aout.c
++++ b/fs/binfmt_aout.c
+@@ -16,6 +16,7 @@
+ #include <linux/string.h>
+ #include <linux/fs.h>
+ #include <linux/file.h>
++#include <linux/security.h>
+ #include <linux/stat.h>
+ #include <linux/fcntl.h>
+ #include <linux/ptrace.h>
+@@ -102,6 +103,8 @@ static int aout_core_dump(long signr, struct pt_regs *regs, struct file *file, u
+ #endif
+ # define START_STACK(u) (u.start_stack)
+
++ memset(&dump, 0, sizeof(dump));
++
+ fs = get_fs();
+ set_fs(KERNEL_DS);
+ has_dumped = 1;
+@@ -113,10 +116,12 @@ static int aout_core_dump(long signr, struct pt_regs *regs, struct file *file, u
+
+ /* If the size of the dump file exceeds the rlimit, then see what would happen
+ if we wrote the stack, but not the data area. */
++ gr_learn_resource(current, RLIMIT_CORE, (dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE, 1);
+ if ((dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE > limit)
+ dump.u_dsize = 0;
+
+ /* Make sure we have enough room to write the stack and data areas. */
++ gr_learn_resource(current, RLIMIT_CORE, (dump.u_ssize + 1) * PAGE_SIZE, 1);
+ if ((dump.u_ssize + 1) * PAGE_SIZE > limit)
+ dump.u_ssize = 0;
+
+@@ -146,9 +151,7 @@ static int aout_core_dump(long signr, struct pt_regs *regs, struct file *file, u
+ dump_size = dump.u_ssize << PAGE_SHIFT;
+ DUMP_WRITE(dump_start,dump_size);
+ }
+-/* Finally dump the task struct. Not be used by gdb, but could be useful */
+- set_fs(KERNEL_DS);
+- DUMP_WRITE(current,sizeof(*current));
++/* Finally, let's not dump the task struct. Not be used by gdb, but could be useful to an attacker */
+ end_coredump:
+ set_fs(fs);
+ return has_dumped;
+@@ -249,6 +252,8 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
+ rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
+ if (rlim >= RLIM_INFINITY)
+ rlim = ~0;
++
++ gr_learn_resource(current, RLIMIT_DATA, ex.a_data + ex.a_bss, 1);
+ if (ex.a_data + ex.a_bss > rlim)
+ return -ENOMEM;
+
+@@ -274,9 +279,37 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
+ current->mm->free_area_cache = current->mm->mmap_base;
+ current->mm->cached_hole_size = 0;
+
++ retval = setup_arg_pages(bprm, STACK_TOP, EXSTACK_DEFAULT);
++ if (retval < 0) {
++ /* Someone check-me: is this error path enough? */
++ send_sig(SIGKILL, current, 0);
++ return retval;
++ }
++
+ install_exec_creds(bprm);
+ current->flags &= ~PF_FORKNOEXEC;
+
++#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
++ current->mm->pax_flags = 0UL;
++#endif
++
++#ifdef CONFIG_PAX_PAGEEXEC
++ if (!(N_FLAGS(ex) & F_PAX_PAGEEXEC)) {
++ current->mm->pax_flags |= MF_PAX_PAGEEXEC;
++
++#ifdef CONFIG_PAX_EMUTRAMP
++ if (N_FLAGS(ex) & F_PAX_EMUTRAMP)
++ current->mm->pax_flags |= MF_PAX_EMUTRAMP;
++#endif
++
++#ifdef CONFIG_PAX_MPROTECT
++ if (!(N_FLAGS(ex) & F_PAX_MPROTECT))
++ current->mm->pax_flags |= MF_PAX_MPROTECT;
++#endif
++
++ }
++#endif
++
+ if (N_MAGIC(ex) == OMAGIC) {
+ unsigned long text_addr, map_size;
+ loff_t pos;
+@@ -349,7 +382,7 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
+
+ down_write(¤t->mm->mmap_sem);
+ error = do_mmap(bprm->file, N_DATADDR(ex), ex.a_data,
+- PROT_READ | PROT_WRITE | PROT_EXEC,
++ PROT_READ | PROT_WRITE,
+ MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE,
+ fd_offset + ex.a_text);
+ up_write(¤t->mm->mmap_sem);
+@@ -367,13 +400,6 @@ beyond_if:
+ return retval;
+ }
+
+- retval = setup_arg_pages(bprm, STACK_TOP, EXSTACK_DEFAULT);
+- if (retval < 0) {
+- /* Someone check-me: is this error path enough? */
+- send_sig(SIGKILL, current, 0);
+- return retval;
+- }
+-
+ current->mm->start_stack =
+ (unsigned long) create_aout_tables((char __user *) bprm->p, bprm);
+ #ifdef __alpha__
+diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
+index a64fde6..7ce2817 100644
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -31,6 +31,7 @@
+ #include <linux/random.h>
+ #include <linux/elf.h>
+ #include <linux/utsname.h>
++#include <linux/xattr.h>
+ #include <asm/uaccess.h>
+ #include <asm/param.h>
+ #include <asm/page.h>
+@@ -50,6 +51,10 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file, un
+ #define elf_core_dump NULL
+ #endif
+
++#ifdef CONFIG_PAX_MPROTECT
++static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags);
++#endif
++
+ #if ELF_EXEC_PAGESIZE > PAGE_SIZE
+ #define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE
+ #else
+@@ -69,6 +74,11 @@ static struct linux_binfmt elf_format = {
+ .load_binary = load_elf_binary,
+ .load_shlib = load_elf_library,
+ .core_dump = elf_core_dump,
++
++#ifdef CONFIG_PAX_MPROTECT
++ .handle_mprotect= elf_handle_mprotect,
++#endif
++
+ .min_coredump = ELF_EXEC_PAGESIZE,
+ .hasvdso = 1
+ };
+@@ -77,6 +87,8 @@ static struct linux_binfmt elf_format = {
+
+ static int set_brk(unsigned long start, unsigned long end)
+ {
++ unsigned long e = end;
++
+ start = ELF_PAGEALIGN(start);
+ end = ELF_PAGEALIGN(end);
+ if (end > start) {
+@@ -87,7 +99,7 @@ static int set_brk(unsigned long start, unsigned long end)
+ if (BAD_ADDR(addr))
+ return addr;
+ }
+- current->mm->start_brk = current->mm->brk = end;
++ current->mm->start_brk = current->mm->brk = e;
+ return 0;
+ }
+
+@@ -148,12 +160,15 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
+ elf_addr_t __user *u_rand_bytes;
+ const char *k_platform = ELF_PLATFORM;
+ const char *k_base_platform = ELF_BASE_PLATFORM;
+- unsigned char k_rand_bytes[16];
++ u32 k_rand_bytes[4];
+ int items;
+ elf_addr_t *elf_info;
+ int ei_index = 0;
+ const struct cred *cred = current_cred();
+ struct vm_area_struct *vma;
++ unsigned long saved_auxv[AT_VECTOR_SIZE];
++
++ pax_track_stack();
+
+ /*
+ * In some cases (e.g. Hyper-Threading), we want to avoid L1
+@@ -195,8 +210,12 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
+ * Generate 16 random bytes for userspace PRNG seeding.
+ */
+ get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
+- u_rand_bytes = (elf_addr_t __user *)
+- STACK_ALLOC(p, sizeof(k_rand_bytes));
++ srandom32(k_rand_bytes[0] ^ random32());
++ srandom32(k_rand_bytes[1] ^ random32());
++ srandom32(k_rand_bytes[2] ^ random32());
++ srandom32(k_rand_bytes[3] ^ random32());
++ p = STACK_ROUND(p, sizeof(k_rand_bytes));
++ u_rand_bytes = (elf_addr_t __user *) p;
+ if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
+ return -EFAULT;
+
+@@ -308,9 +327,11 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
+ return -EFAULT;
+ current->mm->env_end = p;
+
++ memcpy(saved_auxv, elf_info, ei_index * sizeof(elf_addr_t));
++
+ /* Put the elf_info on the stack in the right place. */
+ sp = (elf_addr_t __user *)envp + 1;
+- if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
++ if (copy_to_user(sp, saved_auxv, ei_index * sizeof(elf_addr_t)))
+ return -EFAULT;
+ return 0;
+ }
+@@ -385,10 +406,10 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
+ {
+ struct elf_phdr *elf_phdata;
+ struct elf_phdr *eppnt;
+- unsigned long load_addr = 0;
++ unsigned long load_addr = 0, pax_task_size = TASK_SIZE;
+ int load_addr_set = 0;
+ unsigned long last_bss = 0, elf_bss = 0;
+- unsigned long error = ~0UL;
++ unsigned long error = -EINVAL;
+ unsigned long total_size;
+ int retval, i, size;
+
+@@ -434,6 +455,11 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
+ goto out_close;
+ }
+
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
++ pax_task_size = SEGMEXEC_TASK_SIZE;
++#endif
++
+ eppnt = elf_phdata;
+ for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
+ if (eppnt->p_type == PT_LOAD) {
+@@ -477,8 +503,8 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
+ k = load_addr + eppnt->p_vaddr;
+ if (BAD_ADDR(k) ||
+ eppnt->p_filesz > eppnt->p_memsz ||
+- eppnt->p_memsz > TASK_SIZE ||
+- TASK_SIZE - eppnt->p_memsz < k) {
++ eppnt->p_memsz > pax_task_size ||
++ pax_task_size - eppnt->p_memsz < k) {
+ error = -ENOMEM;
+ goto out_close;
+ }
+@@ -532,6 +558,351 @@ out:
+ return error;
+ }
+
++#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) || defined(CONFIG_PAX_XATTR_PAX_FLAGS)
++static unsigned long pax_parse_pt_pax_softmode(const struct elf_phdr * const elf_phdata)
++{
++ unsigned long pax_flags = 0UL;
++
++#ifdef CONFIG_PAX_PT_PAX_FLAGS
++
++#ifdef CONFIG_PAX_PAGEEXEC
++ if (elf_phdata->p_flags & PF_PAGEEXEC)
++ pax_flags |= MF_PAX_PAGEEXEC;
++#endif
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (elf_phdata->p_flags & PF_SEGMEXEC)
++ pax_flags |= MF_PAX_SEGMEXEC;
++#endif
++
++#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
++ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
++ if (nx_enabled)
++ pax_flags &= ~MF_PAX_SEGMEXEC;
++ else
++ pax_flags &= ~MF_PAX_PAGEEXEC;
++ }
++#endif
++
++#ifdef CONFIG_PAX_EMUTRAMP
++ if (elf_phdata->p_flags & PF_EMUTRAMP)
++ pax_flags |= MF_PAX_EMUTRAMP;
++#endif
++
++#ifdef CONFIG_PAX_MPROTECT
++ if (elf_phdata->p_flags & PF_MPROTECT)
++ pax_flags |= MF_PAX_MPROTECT;
++#endif
++
++#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
++ if (randomize_va_space && (elf_phdata->p_flags & PF_RANDMMAP))
++ pax_flags |= MF_PAX_RANDMMAP;
++#endif
++
++#endif
++
++ return pax_flags;
++}
++
++static unsigned long pax_parse_pt_pax_hardmode(const struct elf_phdr * const elf_phdata)
++{
++ unsigned long pax_flags = 0UL;
++
++#ifdef CONFIG_PAX_PT_PAX_FLAGS
++
++#ifdef CONFIG_PAX_PAGEEXEC
++ if (!(elf_phdata->p_flags & PF_NOPAGEEXEC))
++ pax_flags |= MF_PAX_PAGEEXEC;
++#endif
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (!(elf_phdata->p_flags & PF_NOSEGMEXEC))
++ pax_flags |= MF_PAX_SEGMEXEC;
++#endif
++
++#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
++ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
++ if (nx_enabled)
++ pax_flags &= ~MF_PAX_SEGMEXEC;
++ else
++ pax_flags &= ~MF_PAX_PAGEEXEC;
++ }
++#endif
++
++#ifdef CONFIG_PAX_EMUTRAMP
++ if (!(elf_phdata->p_flags & PF_NOEMUTRAMP))
++ pax_flags |= MF_PAX_EMUTRAMP;
++#endif
++
++#ifdef CONFIG_PAX_MPROTECT
++ if (!(elf_phdata->p_flags & PF_NOMPROTECT))
++ pax_flags |= MF_PAX_MPROTECT;
++#endif
++
++#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
++ if (randomize_va_space && !(elf_phdata->p_flags & PF_NORANDMMAP))
++ pax_flags |= MF_PAX_RANDMMAP;
++#endif
++
++#endif
++
++ return pax_flags;
++}
++
++static unsigned long pax_parse_ei_pax(const struct elfhdr * const elf_ex)
++{
++ unsigned long pax_flags = 0UL;
++
++#ifdef CONFIG_PAX_EI_PAX
++
++#ifdef CONFIG_PAX_PAGEEXEC
++ if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_PAGEEXEC))
++ pax_flags |= MF_PAX_PAGEEXEC;
++#endif
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_SEGMEXEC))
++ pax_flags |= MF_PAX_SEGMEXEC;
++#endif
++
++#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
++ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
++ if (nx_enabled)
++ pax_flags &= ~MF_PAX_SEGMEXEC;
++ else
++ pax_flags &= ~MF_PAX_PAGEEXEC;
++ }
++#endif
++
++#ifdef CONFIG_PAX_EMUTRAMP
++ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && (elf_ex->e_ident[EI_PAX] & EF_PAX_EMUTRAMP))
++ pax_flags |= MF_PAX_EMUTRAMP;
++#endif
++
++#ifdef CONFIG_PAX_MPROTECT
++ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && !(elf_ex->e_ident[EI_PAX] & EF_PAX_MPROTECT))
++ pax_flags |= MF_PAX_MPROTECT;
++#endif
++
++#ifdef CONFIG_PAX_ASLR
++ if (randomize_va_space && !(elf_ex->e_ident[EI_PAX] & EF_PAX_RANDMMAP))
++ pax_flags |= MF_PAX_RANDMMAP;
++#endif
++
++#else
++
++#ifdef CONFIG_PAX_PAGEEXEC
++ pax_flags |= MF_PAX_PAGEEXEC;
++#endif
++
++#ifdef CONFIG_PAX_MPROTECT
++ pax_flags |= MF_PAX_MPROTECT;
++#endif
++
++#ifdef CONFIG_PAX_RANDMMAP
++ pax_flags |= MF_PAX_RANDMMAP;
++#endif
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (!(pax_flags & MF_PAX_PAGEEXEC) || !(__supported_pte_mask & _PAGE_NX)) {
++ pax_flags &= ~MF_PAX_PAGEEXEC;
++ pax_flags |= MF_PAX_SEGMEXEC;
++ }
++#endif
++
++#endif
++
++ return pax_flags;
++}
++
++static unsigned long pax_parse_pt_pax(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata)
++{
++
++#ifdef CONFIG_PAX_PT_PAX_FLAGS
++ unsigned long i;
++
++ for (i = 0UL; i < elf_ex->e_phnum; i++)
++ if (elf_phdata[i].p_type == PT_PAX_FLAGS) {
++ if (((elf_phdata[i].p_flags & PF_PAGEEXEC) && (elf_phdata[i].p_flags & PF_NOPAGEEXEC)) ||
++ ((elf_phdata[i].p_flags & PF_SEGMEXEC) && (elf_phdata[i].p_flags & PF_NOSEGMEXEC)) ||
++ ((elf_phdata[i].p_flags & PF_EMUTRAMP) && (elf_phdata[i].p_flags & PF_NOEMUTRAMP)) ||
++ ((elf_phdata[i].p_flags & PF_MPROTECT) && (elf_phdata[i].p_flags & PF_NOMPROTECT)) ||
++ ((elf_phdata[i].p_flags & PF_RANDMMAP) && (elf_phdata[i].p_flags & PF_NORANDMMAP)))
++ return ~0UL;
++
++#ifdef CONFIG_PAX_SOFTMODE
++ if (pax_softmode)
++ return pax_parse_pt_pax_softmode(&elf_phdata[i]);
++ else
++#endif
++
++ return pax_parse_pt_pax_hardmode(&elf_phdata[i]);
++ break;
++ }
++#endif
++
++ return ~0UL;
++}
++
++#ifdef CONFIG_PAX_XATTR_PAX_FLAGS
++static unsigned long pax_parse_xattr_pax_softmode(unsigned long pax_flags_softmode)
++{
++ unsigned long pax_flags = 0UL;
++
++#ifdef CONFIG_PAX_PAGEEXEC
++ if (pax_flags_softmode & MF_PAX_PAGEEXEC)
++ pax_flags |= MF_PAX_PAGEEXEC;
++#endif
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (pax_flags_softmode & MF_PAX_SEGMEXEC)
++ pax_flags |= MF_PAX_SEGMEXEC;
++#endif
++
++#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
++ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
++ if ((__supported_pte_mask & _PAGE_NX))
++ pax_flags &= ~MF_PAX_SEGMEXEC;
++ else
++ pax_flags &= ~MF_PAX_PAGEEXEC;
++ }
++#endif
++
++#ifdef CONFIG_PAX_EMUTRAMP
++ if (pax_flags_softmode & MF_PAX_EMUTRAMP)
++ pax_flags |= MF_PAX_EMUTRAMP;
++#endif
++
++#ifdef CONFIG_PAX_MPROTECT
++ if (pax_flags_softmode & MF_PAX_MPROTECT)
++ pax_flags |= MF_PAX_MPROTECT;
++#endif
++
++#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
++ if (randomize_va_space && (pax_flags_softmode & MF_PAX_RANDMMAP))
++ pax_flags |= MF_PAX_RANDMMAP;
++#endif
++
++ return pax_flags;
++}
++
++static unsigned long pax_parse_xattr_pax_hardmode(unsigned long pax_flags_hardmode)
++{
++ unsigned long pax_flags = 0UL;
++
++#ifdef CONFIG_PAX_PAGEEXEC
++ if (!(pax_flags_hardmode & MF_PAX_PAGEEXEC))
++ pax_flags |= MF_PAX_PAGEEXEC;
++#endif
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (!(pax_flags_hardmode & MF_PAX_SEGMEXEC))
++ pax_flags |= MF_PAX_SEGMEXEC;
++#endif
++
++#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
++ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
++ if ((__supported_pte_mask & _PAGE_NX))
++ pax_flags &= ~MF_PAX_SEGMEXEC;
++ else
++ pax_flags &= ~MF_PAX_PAGEEXEC;
++ }
++#endif
++
++#ifdef CONFIG_PAX_EMUTRAMP
++ if (!(pax_flags_hardmode & MF_PAX_EMUTRAMP))
++ pax_flags |= MF_PAX_EMUTRAMP;
++#endif
++
++#ifdef CONFIG_PAX_MPROTECT
++ if (!(pax_flags_hardmode & MF_PAX_MPROTECT))
++ pax_flags |= MF_PAX_MPROTECT;
++#endif
++
++#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
++ if (randomize_va_space && !(pax_flags_hardmode & MF_PAX_RANDMMAP))
++ pax_flags |= MF_PAX_RANDMMAP;
++#endif
++
++ return pax_flags;
++}
++#endif
++
++static unsigned long pax_parse_xattr_pax(struct file * const file)
++{
++
++#ifdef CONFIG_PAX_XATTR_PAX_FLAGS
++ ssize_t xattr_size, i;
++ unsigned char xattr_value[5];
++ unsigned long pax_flags_hardmode = 0UL, pax_flags_softmode = 0UL;
++
++ xattr_size = vfs_getxattr(file->f_path.dentry, XATTR_NAME_PAX_FLAGS, xattr_value, sizeof xattr_value);
++ if (xattr_size <= 0)
++ return ~0UL;
++
++ for (i = 0; i < xattr_size; i++)
++ switch (xattr_value[i]) {
++ default:
++ return ~0UL;
++
++#define parse_flag(option1, option2, flag) \
++ case option1: \
++ pax_flags_hardmode |= MF_PAX_##flag; \
++ break; \
++ case option2: \
++ pax_flags_softmode |= MF_PAX_##flag; \
++ break;
++
++ parse_flag('p', 'P', PAGEEXEC);
++ parse_flag('e', 'E', EMUTRAMP);
++ parse_flag('m', 'M', MPROTECT);
++ parse_flag('r', 'R', RANDMMAP);
++ parse_flag('s', 'S', SEGMEXEC);
++
++#undef parse_flag
++ }
++
++ if (pax_flags_hardmode & pax_flags_softmode)
++ return ~0UL;
++
++#ifdef CONFIG_PAX_SOFTMODE
++ if (pax_softmode)
++ return pax_parse_xattr_pax_softmode(pax_flags_softmode);
++ else
++#endif
++
++ return pax_parse_xattr_pax_hardmode(pax_flags_hardmode);
++#else
++ return ~0UL;
++#endif
++
++}
++
++static long pax_parse_pax_flags(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata, struct file * const file)
++{
++ unsigned long pax_flags, pt_pax_flags, xattr_pax_flags;
++
++ pax_flags = pax_parse_ei_pax(elf_ex);
++ pt_pax_flags = pax_parse_pt_pax(elf_ex, elf_phdata);
++ xattr_pax_flags = pax_parse_xattr_pax(file);
++
++ if (pt_pax_flags == ~0UL)
++ pt_pax_flags = xattr_pax_flags;
++ else if (xattr_pax_flags == ~0UL)
++ xattr_pax_flags = pt_pax_flags;
++ if (pt_pax_flags != xattr_pax_flags)
++ return -EINVAL;
++ if (pt_pax_flags != ~0UL)
++ pax_flags = pt_pax_flags;
++
++ if (0 > pax_check_flags(&pax_flags))
++ return -EINVAL;
++
++ current->mm->pax_flags = pax_flags;
++ return 0;
++}
++#endif
++
+ /*
+ * These are the functions used to load ELF style executables and shared
+ * libraries. There is no binary dependent code anywhere else.
+@@ -548,6 +919,11 @@ static unsigned long randomize_stack_top(unsigned long stack_top)
+ {
+ unsigned int random_variable = 0;
+
++#ifdef CONFIG_PAX_RANDUSTACK
++ if (randomize_va_space)
++ return stack_top - current->mm->delta_stack;
++#endif
++
+ if ((current->flags & PF_RANDOMIZE) &&
+ !(current->personality & ADDR_NO_RANDOMIZE)) {
+ random_variable = get_random_int() & STACK_RND_MASK;
+@@ -566,7 +942,7 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+ unsigned long load_addr = 0, load_bias = 0;
+ int load_addr_set = 0;
+ char * elf_interpreter = NULL;
+- unsigned long error;
++ unsigned long error = 0;
+ struct elf_phdr *elf_ppnt, *elf_phdata;
+ unsigned long elf_bss, elf_brk;
+ int retval, i;
+@@ -576,11 +952,11 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+ unsigned long start_code, end_code, start_data, end_data;
+ unsigned long reloc_func_desc = 0;
+ int executable_stack = EXSTACK_DEFAULT;
+- unsigned long def_flags = 0;
+ struct {
+ struct elfhdr elf_ex;
+ struct elfhdr interp_elf_ex;
+ } *loc;
++ unsigned long pax_task_size = TASK_SIZE;
+
+ loc = kmalloc(sizeof(*loc), GFP_KERNEL);
+ if (!loc) {
+@@ -718,11 +1094,80 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+
+ /* OK, This is the point of no return */
+ current->flags &= ~PF_FORKNOEXEC;
+- current->mm->def_flags = def_flags;
++
++#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
++ current->mm->pax_flags = 0UL;
++#endif
++
++#ifdef CONFIG_PAX_DLRESOLVE
++ current->mm->call_dl_resolve = 0UL;
++#endif
++
++#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
++ current->mm->call_syscall = 0UL;
++#endif
++
++#ifdef CONFIG_PAX_ASLR
++ current->mm->delta_mmap = 0UL;
++ current->mm->delta_stack = 0UL;
++#endif
++
++ current->mm->def_flags = 0;
++
++#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) || defined(CONFIG_PAX_XATTR_PAX_FLAGS)
++ if (0 > pax_parse_pax_flags(&loc->elf_ex, elf_phdata, bprm->file)) {
++ send_sig(SIGKILL, current, 0);
++ goto out_free_dentry;
++ }
++#endif
++
++#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
++ pax_set_initial_flags(bprm);
++#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
++ if (pax_set_initial_flags_func)
++ (pax_set_initial_flags_func)(bprm);
++#endif
++
++#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
++ if ((current->mm->pax_flags & MF_PAX_PAGEEXEC) && !nx_enabled) {
++ current->mm->context.user_cs_limit = PAGE_SIZE;
++ current->mm->def_flags |= VM_PAGEEXEC;
++ }
++#endif
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
++ current->mm->context.user_cs_base = SEGMEXEC_TASK_SIZE;
++ current->mm->context.user_cs_limit = TASK_SIZE-SEGMEXEC_TASK_SIZE;
++ pax_task_size = SEGMEXEC_TASK_SIZE;
++ }
++#endif
++
++#if defined(CONFIG_ARCH_TRACK_EXEC_LIMIT) || defined(CONFIG_PAX_SEGMEXEC)
++ if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
++ set_user_cs(current->mm->context.user_cs_base, current->mm->context.user_cs_limit, get_cpu());
++ put_cpu();
++ }
++#endif
+
+ /* Do this immediately, since STACK_TOP as used in setup_arg_pages
+ may depend on the personality. */
+ SET_PERSONALITY(loc->elf_ex);
++
++#ifdef CONFIG_PAX_ASLR
++ if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
++ current->mm->delta_mmap = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN)-1)) << PAGE_SHIFT;
++ current->mm->delta_stack = (pax_get_random_long() & ((1UL << PAX_DELTA_STACK_LEN)-1)) << PAGE_SHIFT;
++ }
++#endif
++
++#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
++ if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
++ executable_stack = EXSTACK_DISABLE_X;
++ current->personality &= ~READ_IMPLIES_EXEC;
++ } else
++#endif
++
+ if (elf_read_implies_exec(loc->elf_ex, executable_stack))
+ current->personality |= READ_IMPLIES_EXEC;
+
+@@ -800,10 +1245,27 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+ * might try to exec. This is because the brk will
+ * follow the loader, and is not movable. */
+ #ifdef CONFIG_X86
+- load_bias = 0;
++ if (current->flags & PF_RANDOMIZE)
++ load_bias = 0;
++ else
++ load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
+ #else
+ load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
+ #endif
++
++#ifdef CONFIG_PAX_RANDMMAP
++ /* PaX: randomize base address at the default exe base if requested */
++ if ((current->mm->pax_flags & MF_PAX_RANDMMAP) && elf_interpreter) {
++#ifdef CONFIG_SPARC64
++ load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << (PAGE_SHIFT+1);
++#else
++ load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << PAGE_SHIFT;
++#endif
++ load_bias = ELF_PAGESTART(PAX_ELF_ET_DYN_BASE - vaddr + load_bias);
++ elf_flags |= MAP_FIXED;
++ }
++#endif
++
+ }
+
+ error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
+@@ -836,9 +1298,9 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+ * allowed task size. Note that p_filesz must always be
+ * <= p_memsz so it is only necessary to check p_memsz.
+ */
+- if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
+- elf_ppnt->p_memsz > TASK_SIZE ||
+- TASK_SIZE - elf_ppnt->p_memsz < k) {
++ if (k >= pax_task_size || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
++ elf_ppnt->p_memsz > pax_task_size ||
++ pax_task_size - elf_ppnt->p_memsz < k) {
+ /* set_brk can never work. Avoid overflows. */
+ send_sig(SIGKILL, current, 0);
+ retval = -EINVAL;
+@@ -877,11 +1339,40 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+ goto out_free_dentry;
+ }
+ if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
+- send_sig(SIGSEGV, current, 0);
+- retval = -EFAULT; /* Nobody gets to see this, but.. */
+- goto out_free_dentry;
++ /*
++ * This bss-zeroing can fail if the ELF
++ * file specifies odd protections. So
++ * we don't check the return value
++ */
+ }
+
++#ifdef CONFIG_PAX_RANDMMAP
++ if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
++ unsigned long start, size;
++
++ start = ELF_PAGEALIGN(elf_brk);
++ size = PAGE_SIZE + ((pax_get_random_long() & ((1UL << 22) - 1UL)) << 4);
++ down_write(¤t->mm->mmap_sem);
++ retval = -ENOMEM;
++ if (!find_vma_intersection(current->mm, start, start + size + PAGE_SIZE)) {
++ unsigned long prot = PROT_NONE;
++
++ current->mm->brk_gap = PAGE_ALIGN(size) >> PAGE_SHIFT;
++// if (current->personality & ADDR_NO_RANDOMIZE)
++// prot = PROT_READ;
++ start = do_mmap(NULL, start, size, prot, MAP_ANONYMOUS | MAP_FIXED | MAP_PRIVATE, 0);
++ retval = IS_ERR_VALUE(start) ? start : 0;
++ }
++ up_write(¤t->mm->mmap_sem);
++ if (retval == 0)
++ retval = set_brk(start + size, start + size + PAGE_SIZE);
++ if (retval < 0) {
++ send_sig(SIGKILL, current, 0);
++ goto out_free_dentry;
++ }
++ }
++#endif
++
+ if (elf_interpreter) {
+ unsigned long uninitialized_var(interp_map_addr);
+
+@@ -1112,8 +1603,10 @@ static int dump_seek(struct file *file, loff_t off)
+ unsigned long n = off;
+ if (n > PAGE_SIZE)
+ n = PAGE_SIZE;
+- if (!dump_write(file, buf, n))
++ if (!dump_write(file, buf, n)) {
++ free_page((unsigned long)buf);
+ return 0;
++ }
+ off -= n;
+ }
+ free_page((unsigned long)buf);
+@@ -1125,7 +1618,7 @@ static int dump_seek(struct file *file, loff_t off)
+ * Decide what to dump of a segment, part, all or none.
+ */
+ static unsigned long vma_dump_size(struct vm_area_struct *vma,
+- unsigned long mm_flags)
++ unsigned long mm_flags, long signr)
+ {
+ #define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type))
+
+@@ -1159,7 +1652,7 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
+ if (vma->vm_file == NULL)
+ return 0;
+
+- if (FILTER(MAPPED_PRIVATE))
++ if (signr == SIGKILL || FILTER(MAPPED_PRIVATE))
+ goto whole;
+
+ /*
+@@ -1255,8 +1748,11 @@ static int writenote(struct memelfnote *men, struct file *file,
+ #undef DUMP_WRITE
+
+ #define DUMP_WRITE(addr, nr) \
++ do { \
++ gr_learn_resource(current, RLIMIT_CORE, size + (nr), 1); \
+ if ((size += (nr)) > limit || !dump_write(file, (addr), (nr))) \
+- goto end_coredump;
++ goto end_coredump; \
++ } while (0);
+
+ static void fill_elf_header(struct elfhdr *elf, int segs,
+ u16 machine, u32 flags, u8 osabi)
+@@ -1385,9 +1881,9 @@ static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
+ {
+ elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
+ int i = 0;
+- do
++ do {
+ i += 2;
+- while (auxv[i - 2] != AT_NULL);
++ } while (auxv[i - 2] != AT_NULL);
+ fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
+ }
+
+@@ -1973,7 +2469,7 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file, un
+ phdr.p_offset = offset;
+ phdr.p_vaddr = vma->vm_start;
+ phdr.p_paddr = 0;
+- phdr.p_filesz = vma_dump_size(vma, mm_flags);
++ phdr.p_filesz = vma_dump_size(vma, mm_flags, signr);
+ phdr.p_memsz = vma->vm_end - vma->vm_start;
+ offset += phdr.p_filesz;
+ phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
+@@ -2006,7 +2502,7 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file, un
+ unsigned long addr;
+ unsigned long end;
+
+- end = vma->vm_start + vma_dump_size(vma, mm_flags);
++ end = vma->vm_start + vma_dump_size(vma, mm_flags, signr);
+
+ for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
+ struct page *page;
+@@ -2015,6 +2511,7 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file, un
+ page = get_dump_page(addr);
+ if (page) {
+ void *kaddr = kmap(page);
++ gr_learn_resource(current, RLIMIT_CORE, size + PAGE_SIZE, 1);
+ stop = ((size += PAGE_SIZE) > limit) ||
+ !dump_write(file, kaddr, PAGE_SIZE);
+ kunmap(page);
+@@ -2042,6 +2539,97 @@ out:
+
+ #endif /* USE_ELF_CORE_DUMP */
+
++#ifdef CONFIG_PAX_MPROTECT
++/* PaX: non-PIC ELF libraries need relocations on their executable segments
++ * therefore we'll grant them VM_MAYWRITE once during their life. Similarly
++ * we'll remove VM_MAYWRITE for good on RELRO segments.
++ *
++ * The checks favour ld-linux.so behaviour which operates on a per ELF segment
++ * basis because we want to allow the common case and not the special ones.
++ */
++static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags)
++{
++ struct elfhdr elf_h;
++ struct elf_phdr elf_p;
++ unsigned long i;
++ unsigned long oldflags;
++ bool is_textrel_rw, is_textrel_rx, is_relro;
++
++ if (!(vma->vm_mm->pax_flags & MF_PAX_MPROTECT))
++ return;
++
++ oldflags = vma->vm_flags & (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ);
++ newflags &= VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ;
++
++#ifdef CONFIG_PAX_ELFRELOCS
++ /* possible TEXTREL */
++ is_textrel_rw = vma->vm_file && !vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYREAD | VM_EXEC | VM_READ) && newflags == (VM_WRITE | VM_READ);
++ is_textrel_rx = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_WRITE | VM_READ) && newflags == (VM_EXEC | VM_READ);
++#else
++ is_textrel_rw = false;
++ is_textrel_rx = false;
++#endif
++
++ /* possible RELRO */
++ is_relro = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ) && newflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ);
++
++ if (!is_textrel_rw && !is_textrel_rx && !is_relro)
++ return;
++
++ if (sizeof(elf_h) != kernel_read(vma->vm_file, 0UL, (char *)&elf_h, sizeof(elf_h)) ||
++ memcmp(elf_h.e_ident, ELFMAG, SELFMAG) ||
++
++#ifdef CONFIG_PAX_ETEXECRELOCS
++ ((is_textrel_rw || is_textrel_rx) && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
++#else
++ ((is_textrel_rw || is_textrel_rx) && elf_h.e_type != ET_DYN) ||
++#endif
++
++ (is_relro && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
++ !elf_check_arch(&elf_h) ||
++ elf_h.e_phentsize != sizeof(struct elf_phdr) ||
++ elf_h.e_phnum > 65536UL / sizeof(struct elf_phdr))
++ return;
++
++ for (i = 0UL; i < elf_h.e_phnum; i++) {
++ if (sizeof(elf_p) != kernel_read(vma->vm_file, elf_h.e_phoff + i*sizeof(elf_p), (char *)&elf_p, sizeof(elf_p)))
++ return;
++ switch (elf_p.p_type) {
++ case PT_DYNAMIC:
++ if (!is_textrel_rw && !is_textrel_rx)
++ continue;
++ i = 0UL;
++ while ((i+1) * sizeof(elf_dyn) <= elf_p.p_filesz) {
++ elf_dyn dyn;
++
++ if (sizeof(dyn) != kernel_read(vma->vm_file, elf_p.p_offset + i*sizeof(dyn), (char *)&dyn, sizeof(dyn)))
++ return;
++ if (dyn.d_tag == DT_NULL)
++ return;
++ if (dyn.d_tag == DT_TEXTREL || (dyn.d_tag == DT_FLAGS && (dyn.d_un.d_val & DF_TEXTREL))) {
++ gr_log_textrel(vma);
++ if (is_textrel_rw)
++ vma->vm_flags |= VM_MAYWRITE;
++ else
++ /* PaX: disallow write access after relocs are done, hopefully noone else needs it... */
++ vma->vm_flags &= ~VM_MAYWRITE;
++ return;
++ }
++ i++;
++ }
++ return;
++
++ case PT_GNU_RELRO:
++ if (!is_relro)
++ continue;
++ if ((elf_p.p_offset >> PAGE_SHIFT) == vma->vm_pgoff && ELF_PAGEALIGN(elf_p.p_memsz) == vma->vm_end - vma->vm_start)
++ vma->vm_flags &= ~VM_MAYWRITE;
++ return;
++ }
++ }
++}
++#endif
++
+ static int __init init_elf_binfmt(void)
+ {
+ return register_binfmt(&elf_format);
+diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c
+index ca88c46..f155a60 100644
+--- a/fs/binfmt_flat.c
++++ b/fs/binfmt_flat.c
+@@ -564,7 +564,9 @@ static int load_flat_file(struct linux_binprm * bprm,
+ realdatastart = (unsigned long) -ENOMEM;
+ printk("Unable to allocate RAM for process data, errno %d\n",
+ (int)-realdatastart);
++ down_write(¤t->mm->mmap_sem);
+ do_munmap(current->mm, textpos, text_len);
++ up_write(¤t->mm->mmap_sem);
+ ret = realdatastart;
+ goto err;
+ }
+@@ -588,8 +590,10 @@ static int load_flat_file(struct linux_binprm * bprm,
+ }
+ if (IS_ERR_VALUE(result)) {
+ printk("Unable to read data+bss, errno %d\n", (int)-result);
++ down_write(¤t->mm->mmap_sem);
+ do_munmap(current->mm, textpos, text_len);
+ do_munmap(current->mm, realdatastart, data_len + extra);
++ up_write(¤t->mm->mmap_sem);
+ ret = result;
+ goto err;
+ }
+@@ -658,8 +662,10 @@ static int load_flat_file(struct linux_binprm * bprm,
+ }
+ if (IS_ERR_VALUE(result)) {
+ printk("Unable to read code+data+bss, errno %d\n",(int)-result);
++ down_write(¤t->mm->mmap_sem);
+ do_munmap(current->mm, textpos, text_len + data_len + extra +
+ MAX_SHARED_LIBS * sizeof(unsigned long));
++ up_write(¤t->mm->mmap_sem);
+ ret = result;
+ goto err;
+ }
+diff --git a/fs/bio.c b/fs/bio.c
+index e696713..4b5969d 100644
+--- a/fs/bio.c
++++ b/fs/bio.c
+@@ -78,7 +78,7 @@ static struct kmem_cache *bio_find_or_create_slab(unsigned int extra_size)
+
+ i = 0;
+ while (i < bio_slab_nr) {
+- struct bio_slab *bslab = &bio_slabs[i];
++ bslab = &bio_slabs[i];
+
+ if (!bslab->slab && entry == -1)
+ entry = i;
+@@ -841,7 +841,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
+ /*
+ * Overflow, abort
+ */
+- if (end < start)
++ if (end < start || end - start > INT_MAX - nr_pages)
+ return ERR_PTR(-EINVAL);
+
+ nr_pages += end - start;
+@@ -1236,7 +1236,7 @@ static void bio_copy_kern_endio(struct bio *bio, int err)
+ const int read = bio_data_dir(bio) == READ;
+ struct bio_map_data *bmd = bio->bi_private;
+ int i;
+- char *p = bmd->sgvecs[0].iov_base;
++ char *p = (char __force_kernel *)bmd->sgvecs[0].iov_base;
+
+ __bio_for_each_segment(bvec, bio, i, 0) {
+ char *addr = page_address(bvec->bv_page);
+diff --git a/fs/block_dev.c b/fs/block_dev.c
+index e65efa2..04fae57 100644
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -664,7 +664,7 @@ int bd_claim(struct block_device *bdev, void *holder)
+ else if (bdev->bd_contains == bdev)
+ res = 0; /* is a whole device which isn't held */
+
+- else if (bdev->bd_contains->bd_holder == bd_claim)
++ else if (bdev->bd_contains->bd_holder == (void *)bd_claim)
+ res = 0; /* is a partition of a device that is being partitioned */
+ else if (bdev->bd_contains->bd_holder != NULL)
+ res = -EBUSY; /* is a partition of a held device */
+diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
+index c4bc570..42acd8d 100644
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -461,9 +461,12 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
+ free_extent_buffer(buf);
+ add_root_to_dirty_list(root);
+ } else {
+- if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID)
+- parent_start = parent->start;
+- else
++ if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) {
++ if (parent)
++ parent_start = parent->start;
++ else
++ parent_start = 0;
++ } else
+ parent_start = 0;
+
+ WARN_ON(trans->transid != btrfs_header_generation(parent));
+@@ -3645,7 +3648,6 @@ setup_items_for_insert(struct btrfs_trans_handle *trans,
+
+ ret = 0;
+ if (slot == 0) {
+- struct btrfs_disk_key disk_key;
+ btrfs_cpu_key_to_disk(&disk_key, cpu_key);
+ ret = fixup_low_keys(trans, root, path, &disk_key, 1);
+ }
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index f447188..59c17c5 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -39,7 +39,7 @@
+ #include "tree-log.h"
+ #include "free-space-cache.h"
+
+-static struct extent_io_ops btree_extent_io_ops;
++static const struct extent_io_ops btree_extent_io_ops;
+ static void end_workqueue_fn(struct btrfs_work *work);
+ static void free_fs_root(struct btrfs_root *root);
+
+@@ -2607,7 +2607,7 @@ out:
+ return 0;
+ }
+
+-static struct extent_io_ops btree_extent_io_ops = {
++static const struct extent_io_ops btree_extent_io_ops = {
+ .write_cache_pages_lock_hook = btree_lock_page_hook,
+ .readpage_end_io_hook = btree_readpage_end_io_hook,
+ .submit_bio_hook = btree_submit_bio_hook,
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 559f724..a026171 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -7141,6 +7141,10 @@ static noinline int relocate_one_extent(struct btrfs_root *extent_root,
+ u64 group_start = group->key.objectid;
+ new_extents = kmalloc(sizeof(*new_extents),
+ GFP_NOFS);
++ if (!new_extents) {
++ ret = -ENOMEM;
++ goto out;
++ }
+ nr_extents = 1;
+ ret = get_new_locations(reloc_inode,
+ extent_key,
+diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
+index 36de250..7ec75c7 100644
+--- a/fs/btrfs/extent_io.h
++++ b/fs/btrfs/extent_io.h
+@@ -49,36 +49,36 @@ typedef int (extent_submit_bio_hook_t)(struct inode *inode, int rw,
+ struct bio *bio, int mirror_num,
+ unsigned long bio_flags);
+ struct extent_io_ops {
+- int (*fill_delalloc)(struct inode *inode, struct page *locked_page,
++ int (* const fill_delalloc)(struct inode *inode, struct page *locked_page,
+ u64 start, u64 end, int *page_started,
+ unsigned long *nr_written);
+- int (*writepage_start_hook)(struct page *page, u64 start, u64 end);
+- int (*writepage_io_hook)(struct page *page, u64 start, u64 end);
++ int (* const writepage_start_hook)(struct page *page, u64 start, u64 end);
++ int (* const writepage_io_hook)(struct page *page, u64 start, u64 end);
+ extent_submit_bio_hook_t *submit_bio_hook;
+- int (*merge_bio_hook)(struct page *page, unsigned long offset,
++ int (* const merge_bio_hook)(struct page *page, unsigned long offset,
+ size_t size, struct bio *bio,
+ unsigned long bio_flags);
+- int (*readpage_io_hook)(struct page *page, u64 start, u64 end);
+- int (*readpage_io_failed_hook)(struct bio *bio, struct page *page,
++ int (* const readpage_io_hook)(struct page *page, u64 start, u64 end);
++ int (* const readpage_io_failed_hook)(struct bio *bio, struct page *page,
+ u64 start, u64 end,
+ struct extent_state *state);
+- int (*writepage_io_failed_hook)(struct bio *bio, struct page *page,
++ int (* const writepage_io_failed_hook)(struct bio *bio, struct page *page,
+ u64 start, u64 end,
+ struct extent_state *state);
+- int (*readpage_end_io_hook)(struct page *page, u64 start, u64 end,
++ int (* const readpage_end_io_hook)(struct page *page, u64 start, u64 end,
+ struct extent_state *state);
+- int (*writepage_end_io_hook)(struct page *page, u64 start, u64 end,
++ int (* const writepage_end_io_hook)(struct page *page, u64 start, u64 end,
+ struct extent_state *state, int uptodate);
+- int (*set_bit_hook)(struct inode *inode, u64 start, u64 end,
++ int (* const set_bit_hook)(struct inode *inode, u64 start, u64 end,
+ unsigned long old, unsigned long bits);
+- int (*clear_bit_hook)(struct inode *inode, struct extent_state *state,
++ int (* const clear_bit_hook)(struct inode *inode, struct extent_state *state,
+ unsigned long bits);
+- int (*merge_extent_hook)(struct inode *inode,
++ int (* const merge_extent_hook)(struct inode *inode,
+ struct extent_state *new,
+ struct extent_state *other);
+- int (*split_extent_hook)(struct inode *inode,
++ int (* const split_extent_hook)(struct inode *inode,
+ struct extent_state *orig, u64 split);
+- int (*write_cache_pages_lock_hook)(struct page *page);
++ int (* const write_cache_pages_lock_hook)(struct page *page);
+ };
+
+ struct extent_io_tree {
+@@ -88,7 +88,7 @@ struct extent_io_tree {
+ u64 dirty_bytes;
+ spinlock_t lock;
+ spinlock_t buffer_lock;
+- struct extent_io_ops *ops;
++ const struct extent_io_ops *ops;
+ };
+
+ struct extent_state {
+diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
+index cb2849f..3718fb4 100644
+--- a/fs/btrfs/free-space-cache.c
++++ b/fs/btrfs/free-space-cache.c
+@@ -1074,8 +1074,6 @@ u64 btrfs_alloc_from_cluster(struct btrfs_block_group_cache *block_group,
+
+ while(1) {
+ if (entry->bytes < bytes || entry->offset < min_start) {
+- struct rb_node *node;
+-
+ node = rb_next(&entry->offset_index);
+ if (!node)
+ break;
+@@ -1226,7 +1224,7 @@ again:
+ */
+ while (entry->bitmap || found_bitmap ||
+ (!entry->bitmap && entry->bytes < min_bytes)) {
+- struct rb_node *node = rb_next(&entry->offset_index);
++ node = rb_next(&entry->offset_index);
+
+ if (entry->bitmap && entry->bytes > bytes + empty_size) {
+ ret = btrfs_bitmap_cluster(block_group, entry, cluster,
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index e03a836..323837e 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -63,7 +63,7 @@ static const struct inode_operations btrfs_file_inode_operations;
+ static const struct address_space_operations btrfs_aops;
+ static const struct address_space_operations btrfs_symlink_aops;
+ static const struct file_operations btrfs_dir_file_operations;
+-static struct extent_io_ops btrfs_extent_io_ops;
++static const struct extent_io_ops btrfs_extent_io_ops;
+
+ static struct kmem_cache *btrfs_inode_cachep;
+ struct kmem_cache *btrfs_trans_handle_cachep;
+@@ -925,6 +925,7 @@ static int cow_file_range_async(struct inode *inode, struct page *locked_page,
+ 1, 0, NULL, GFP_NOFS);
+ while (start < end) {
+ async_cow = kmalloc(sizeof(*async_cow), GFP_NOFS);
++ BUG_ON(!async_cow);
+ async_cow->inode = inode;
+ async_cow->root = root;
+ async_cow->locked_page = locked_page;
+@@ -4591,6 +4592,8 @@ static noinline int uncompress_inline(struct btrfs_path *path,
+ inline_size = btrfs_file_extent_inline_item_len(leaf,
+ btrfs_item_nr(leaf, path->slots[0]));
+ tmp = kmalloc(inline_size, GFP_NOFS);
++ if (!tmp)
++ return -ENOMEM;
+ ptr = btrfs_file_extent_inline_start(item);
+
+ read_extent_buffer(leaf, tmp, ptr, inline_size);
+@@ -5410,7 +5413,7 @@ fail:
+ return -ENOMEM;
+ }
+
+-static int btrfs_getattr(struct vfsmount *mnt,
++int btrfs_getattr(struct vfsmount *mnt,
+ struct dentry *dentry, struct kstat *stat)
+ {
+ struct inode *inode = dentry->d_inode;
+@@ -5422,6 +5425,14 @@ static int btrfs_getattr(struct vfsmount *mnt,
+ return 0;
+ }
+
++EXPORT_SYMBOL(btrfs_getattr);
++
++dev_t get_btrfs_dev_from_inode(struct inode *inode)
++{
++ return BTRFS_I(inode)->root->anon_super.s_dev;
++}
++EXPORT_SYMBOL(get_btrfs_dev_from_inode);
++
+ static int btrfs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ struct inode *new_dir, struct dentry *new_dentry)
+ {
+@@ -5972,7 +5983,7 @@ static const struct file_operations btrfs_dir_file_operations = {
+ .fsync = btrfs_sync_file,
+ };
+
+-static struct extent_io_ops btrfs_extent_io_ops = {
++static const struct extent_io_ops btrfs_extent_io_ops = {
+ .fill_delalloc = run_delalloc_range,
+ .submit_bio_hook = btrfs_submit_bio_hook,
+ .merge_bio_hook = btrfs_merge_bio_hook,
+diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
+index ab7ab53..94e0781 100644
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -884,7 +884,7 @@ static int __update_reloc_root(struct btrfs_root *root, int del)
+ }
+ spin_unlock(&rc->reloc_root_tree.lock);
+
+- BUG_ON((struct btrfs_root *)node->data != root);
++ BUG_ON(!node || (struct btrfs_root *)node->data != root);
+
+ if (!del) {
+ spin_lock(&rc->reloc_root_tree.lock);
+diff --git a/fs/btrfs/sysfs.c b/fs/btrfs/sysfs.c
+index a240b6f..4ce16ef 100644
+--- a/fs/btrfs/sysfs.c
++++ b/fs/btrfs/sysfs.c
+@@ -164,12 +164,12 @@ static void btrfs_root_release(struct kobject *kobj)
+ complete(&root->kobj_unregister);
+ }
+
+-static struct sysfs_ops btrfs_super_attr_ops = {
++static const struct sysfs_ops btrfs_super_attr_ops = {
+ .show = btrfs_super_attr_show,
+ .store = btrfs_super_attr_store,
+ };
+
+-static struct sysfs_ops btrfs_root_attr_ops = {
++static const struct sysfs_ops btrfs_root_attr_ops = {
+ .show = btrfs_root_attr_show,
+ .store = btrfs_root_attr_store,
+ };
+diff --git a/fs/buffer.c b/fs/buffer.c
+index 6fa5302..395d9f6 100644
+--- a/fs/buffer.c
++++ b/fs/buffer.c
+@@ -25,6 +25,7 @@
+ #include <linux/percpu.h>
+ #include <linux/slab.h>
+ #include <linux/capability.h>
++#include <linux/security.h>
+ #include <linux/blkdev.h>
+ #include <linux/file.h>
+ #include <linux/quotaops.h>
+diff --git a/fs/cachefiles/bind.c b/fs/cachefiles/bind.c
+index 3797e00..ce776f6 100644
+--- a/fs/cachefiles/bind.c
++++ b/fs/cachefiles/bind.c
+@@ -39,13 +39,11 @@ int cachefiles_daemon_bind(struct cachefiles_cache *cache, char *args)
+ args);
+
+ /* start by checking things over */
+- ASSERT(cache->fstop_percent >= 0 &&
+- cache->fstop_percent < cache->fcull_percent &&
++ ASSERT(cache->fstop_percent < cache->fcull_percent &&
+ cache->fcull_percent < cache->frun_percent &&
+ cache->frun_percent < 100);
+
+- ASSERT(cache->bstop_percent >= 0 &&
+- cache->bstop_percent < cache->bcull_percent &&
++ ASSERT(cache->bstop_percent < cache->bcull_percent &&
+ cache->bcull_percent < cache->brun_percent &&
+ cache->brun_percent < 100);
+
+diff --git a/fs/cachefiles/daemon.c b/fs/cachefiles/daemon.c
+index 4618516..bb30d01 100644
+--- a/fs/cachefiles/daemon.c
++++ b/fs/cachefiles/daemon.c
+@@ -220,7 +220,7 @@ static ssize_t cachefiles_daemon_write(struct file *file,
+ if (test_bit(CACHEFILES_DEAD, &cache->flags))
+ return -EIO;
+
+- if (datalen < 0 || datalen > PAGE_SIZE - 1)
++ if (datalen > PAGE_SIZE - 1)
+ return -EOPNOTSUPP;
+
+ /* drag the command string into the kernel so we can parse it */
+@@ -385,7 +385,7 @@ static int cachefiles_daemon_fstop(struct cachefiles_cache *cache, char *args)
+ if (args[0] != '%' || args[1] != '\0')
+ return -EINVAL;
+
+- if (fstop < 0 || fstop >= cache->fcull_percent)
++ if (fstop >= cache->fcull_percent)
+ return cachefiles_daemon_range_error(cache, args);
+
+ cache->fstop_percent = fstop;
+@@ -457,7 +457,7 @@ static int cachefiles_daemon_bstop(struct cachefiles_cache *cache, char *args)
+ if (args[0] != '%' || args[1] != '\0')
+ return -EINVAL;
+
+- if (bstop < 0 || bstop >= cache->bcull_percent)
++ if (bstop >= cache->bcull_percent)
+ return cachefiles_daemon_range_error(cache, args);
+
+ cache->bstop_percent = bstop;
+diff --git a/fs/cachefiles/internal.h b/fs/cachefiles/internal.h
+index f7c255f..fcd61de 100644
+--- a/fs/cachefiles/internal.h
++++ b/fs/cachefiles/internal.h
+@@ -56,7 +56,7 @@ struct cachefiles_cache {
+ wait_queue_head_t daemon_pollwq; /* poll waitqueue for daemon */
+ struct rb_root active_nodes; /* active nodes (can't be culled) */
+ rwlock_t active_lock; /* lock for active_nodes */
+- atomic_t gravecounter; /* graveyard uniquifier */
++ atomic_unchecked_t gravecounter; /* graveyard uniquifier */
+ unsigned frun_percent; /* when to stop culling (% files) */
+ unsigned fcull_percent; /* when to start culling (% files) */
+ unsigned fstop_percent; /* when to stop allocating (% files) */
+@@ -168,19 +168,19 @@ extern int cachefiles_check_in_use(struct cachefiles_cache *cache,
+ * proc.c
+ */
+ #ifdef CONFIG_CACHEFILES_HISTOGRAM
+-extern atomic_t cachefiles_lookup_histogram[HZ];
+-extern atomic_t cachefiles_mkdir_histogram[HZ];
+-extern atomic_t cachefiles_create_histogram[HZ];
++extern atomic_unchecked_t cachefiles_lookup_histogram[HZ];
++extern atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
++extern atomic_unchecked_t cachefiles_create_histogram[HZ];
+
+ extern int __init cachefiles_proc_init(void);
+ extern void cachefiles_proc_cleanup(void);
+ static inline
+-void cachefiles_hist(atomic_t histogram[], unsigned long start_jif)
++void cachefiles_hist(atomic_unchecked_t histogram[], unsigned long start_jif)
+ {
+ unsigned long jif = jiffies - start_jif;
+ if (jif >= HZ)
+ jif = HZ - 1;
+- atomic_inc(&histogram[jif]);
++ atomic_inc_unchecked(&histogram[jif]);
+ }
+
+ #else
+diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c
+index 14ac480..a62766c 100644
+--- a/fs/cachefiles/namei.c
++++ b/fs/cachefiles/namei.c
+@@ -250,7 +250,7 @@ try_again:
+ /* first step is to make up a grave dentry in the graveyard */
+ sprintf(nbuffer, "%08x%08x",
+ (uint32_t) get_seconds(),
+- (uint32_t) atomic_inc_return(&cache->gravecounter));
++ (uint32_t) atomic_inc_return_unchecked(&cache->gravecounter));
+
+ /* do the multiway lock magic */
+ trap = lock_rename(cache->graveyard, dir);
+diff --git a/fs/cachefiles/proc.c b/fs/cachefiles/proc.c
+index eccd339..4c1d995 100644
+--- a/fs/cachefiles/proc.c
++++ b/fs/cachefiles/proc.c
+@@ -14,9 +14,9 @@
+ #include <linux/seq_file.h>
+ #include "internal.h"
+
+-atomic_t cachefiles_lookup_histogram[HZ];
+-atomic_t cachefiles_mkdir_histogram[HZ];
+-atomic_t cachefiles_create_histogram[HZ];
++atomic_unchecked_t cachefiles_lookup_histogram[HZ];
++atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
++atomic_unchecked_t cachefiles_create_histogram[HZ];
+
+ /*
+ * display the latency histogram
+@@ -35,9 +35,9 @@ static int cachefiles_histogram_show(struct seq_file *m, void *v)
+ return 0;
+ default:
+ index = (unsigned long) v - 3;
+- x = atomic_read(&cachefiles_lookup_histogram[index]);
+- y = atomic_read(&cachefiles_mkdir_histogram[index]);
+- z = atomic_read(&cachefiles_create_histogram[index]);
++ x = atomic_read_unchecked(&cachefiles_lookup_histogram[index]);
++ y = atomic_read_unchecked(&cachefiles_mkdir_histogram[index]);
++ z = atomic_read_unchecked(&cachefiles_create_histogram[index]);
+ if (x == 0 && y == 0 && z == 0)
+ return 0;
+
+diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c
+index a6c8c6f..5cf8517 100644
+--- a/fs/cachefiles/rdwr.c
++++ b/fs/cachefiles/rdwr.c
+@@ -946,7 +946,7 @@ int cachefiles_write_page(struct fscache_storage *op, struct page *page)
+ old_fs = get_fs();
+ set_fs(KERNEL_DS);
+ ret = file->f_op->write(
+- file, (const void __user *) data, len, &pos);
++ file, (const void __force_user *) data, len, &pos);
+ set_fs(old_fs);
+ kunmap(page);
+ if (ret != len)
+diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
+index 42cec2a..2aba466 100644
+--- a/fs/cifs/cifs_debug.c
++++ b/fs/cifs/cifs_debug.c
+@@ -256,25 +256,25 @@ static ssize_t cifs_stats_proc_write(struct file *file,
+ tcon = list_entry(tmp3,
+ struct cifsTconInfo,
+ tcon_list);
+- atomic_set(&tcon->num_smbs_sent, 0);
+- atomic_set(&tcon->num_writes, 0);
+- atomic_set(&tcon->num_reads, 0);
+- atomic_set(&tcon->num_oplock_brks, 0);
+- atomic_set(&tcon->num_opens, 0);
+- atomic_set(&tcon->num_posixopens, 0);
+- atomic_set(&tcon->num_posixmkdirs, 0);
+- atomic_set(&tcon->num_closes, 0);
+- atomic_set(&tcon->num_deletes, 0);
+- atomic_set(&tcon->num_mkdirs, 0);
+- atomic_set(&tcon->num_rmdirs, 0);
+- atomic_set(&tcon->num_renames, 0);
+- atomic_set(&tcon->num_t2renames, 0);
+- atomic_set(&tcon->num_ffirst, 0);
+- atomic_set(&tcon->num_fnext, 0);
+- atomic_set(&tcon->num_fclose, 0);
+- atomic_set(&tcon->num_hardlinks, 0);
+- atomic_set(&tcon->num_symlinks, 0);
+- atomic_set(&tcon->num_locks, 0);
++ atomic_set_unchecked(&tcon->num_smbs_sent, 0);
++ atomic_set_unchecked(&tcon->num_writes, 0);
++ atomic_set_unchecked(&tcon->num_reads, 0);
++ atomic_set_unchecked(&tcon->num_oplock_brks, 0);
++ atomic_set_unchecked(&tcon->num_opens, 0);
++ atomic_set_unchecked(&tcon->num_posixopens, 0);
++ atomic_set_unchecked(&tcon->num_posixmkdirs, 0);
++ atomic_set_unchecked(&tcon->num_closes, 0);
++ atomic_set_unchecked(&tcon->num_deletes, 0);
++ atomic_set_unchecked(&tcon->num_mkdirs, 0);
++ atomic_set_unchecked(&tcon->num_rmdirs, 0);
++ atomic_set_unchecked(&tcon->num_renames, 0);
++ atomic_set_unchecked(&tcon->num_t2renames, 0);
++ atomic_set_unchecked(&tcon->num_ffirst, 0);
++ atomic_set_unchecked(&tcon->num_fnext, 0);
++ atomic_set_unchecked(&tcon->num_fclose, 0);
++ atomic_set_unchecked(&tcon->num_hardlinks, 0);
++ atomic_set_unchecked(&tcon->num_symlinks, 0);
++ atomic_set_unchecked(&tcon->num_locks, 0);
+ }
+ }
+ }
+@@ -334,41 +334,41 @@ static int cifs_stats_proc_show(struct seq_file *m, void *v)
+ if (tcon->need_reconnect)
+ seq_puts(m, "\tDISCONNECTED ");
+ seq_printf(m, "\nSMBs: %d Oplock Breaks: %d",
+- atomic_read(&tcon->num_smbs_sent),
+- atomic_read(&tcon->num_oplock_brks));
++ atomic_read_unchecked(&tcon->num_smbs_sent),
++ atomic_read_unchecked(&tcon->num_oplock_brks));
+ seq_printf(m, "\nReads: %d Bytes: %lld",
+- atomic_read(&tcon->num_reads),
++ atomic_read_unchecked(&tcon->num_reads),
+ (long long)(tcon->bytes_read));
+ seq_printf(m, "\nWrites: %d Bytes: %lld",
+- atomic_read(&tcon->num_writes),
++ atomic_read_unchecked(&tcon->num_writes),
+ (long long)(tcon->bytes_written));
+ seq_printf(m, "\nFlushes: %d",
+- atomic_read(&tcon->num_flushes));
++ atomic_read_unchecked(&tcon->num_flushes));
+ seq_printf(m, "\nLocks: %d HardLinks: %d "
+ "Symlinks: %d",
+- atomic_read(&tcon->num_locks),
+- atomic_read(&tcon->num_hardlinks),
+- atomic_read(&tcon->num_symlinks));
++ atomic_read_unchecked(&tcon->num_locks),
++ atomic_read_unchecked(&tcon->num_hardlinks),
++ atomic_read_unchecked(&tcon->num_symlinks));
+ seq_printf(m, "\nOpens: %d Closes: %d "
+ "Deletes: %d",
+- atomic_read(&tcon->num_opens),
+- atomic_read(&tcon->num_closes),
+- atomic_read(&tcon->num_deletes));
++ atomic_read_unchecked(&tcon->num_opens),
++ atomic_read_unchecked(&tcon->num_closes),
++ atomic_read_unchecked(&tcon->num_deletes));
+ seq_printf(m, "\nPosix Opens: %d "
+ "Posix Mkdirs: %d",
+- atomic_read(&tcon->num_posixopens),
+- atomic_read(&tcon->num_posixmkdirs));
++ atomic_read_unchecked(&tcon->num_posixopens),
++ atomic_read_unchecked(&tcon->num_posixmkdirs));
+ seq_printf(m, "\nMkdirs: %d Rmdirs: %d",
+- atomic_read(&tcon->num_mkdirs),
+- atomic_read(&tcon->num_rmdirs));
++ atomic_read_unchecked(&tcon->num_mkdirs),
++ atomic_read_unchecked(&tcon->num_rmdirs));
+ seq_printf(m, "\nRenames: %d T2 Renames %d",
+- atomic_read(&tcon->num_renames),
+- atomic_read(&tcon->num_t2renames));
++ atomic_read_unchecked(&tcon->num_renames),
++ atomic_read_unchecked(&tcon->num_t2renames));
+ seq_printf(m, "\nFindFirst: %d FNext %d "
+ "FClose %d",
+- atomic_read(&tcon->num_ffirst),
+- atomic_read(&tcon->num_fnext),
+- atomic_read(&tcon->num_fclose));
++ atomic_read_unchecked(&tcon->num_ffirst),
++ atomic_read_unchecked(&tcon->num_fnext),
++ atomic_read_unchecked(&tcon->num_fclose));
+ }
+ }
+ }
+diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
+index 1445407..68cb0dc 100644
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -869,7 +869,7 @@ cifs_init_request_bufs(void)
+ cifs_req_cachep = kmem_cache_create("cifs_request",
+ CIFSMaxBufSize +
+ MAX_CIFS_HDR_SIZE, 0,
+- SLAB_HWCACHE_ALIGN, NULL);
++ SLAB_HWCACHE_ALIGN | SLAB_USERCOPY, NULL);
+ if (cifs_req_cachep == NULL)
+ return -ENOMEM;
+
+@@ -896,7 +896,7 @@ cifs_init_request_bufs(void)
+ efficient to alloc 1 per page off the slab compared to 17K (5page)
+ alloc of large cifs buffers even when page debugging is on */
+ cifs_sm_req_cachep = kmem_cache_create("cifs_small_rq",
+- MAX_CIFS_SMALL_BUFFER_SIZE, 0, SLAB_HWCACHE_ALIGN,
++ MAX_CIFS_SMALL_BUFFER_SIZE, 0, SLAB_HWCACHE_ALIGN | SLAB_USERCOPY,
+ NULL);
+ if (cifs_sm_req_cachep == NULL) {
+ mempool_destroy(cifs_req_poolp);
+@@ -991,8 +991,8 @@ init_cifs(void)
+ atomic_set(&bufAllocCount, 0);
+ atomic_set(&smBufAllocCount, 0);
+ #ifdef CONFIG_CIFS_STATS2
+- atomic_set(&totBufAllocCount, 0);
+- atomic_set(&totSmBufAllocCount, 0);
++ atomic_set_unchecked(&totBufAllocCount, 0);
++ atomic_set_unchecked(&totSmBufAllocCount, 0);
+ #endif /* CONFIG_CIFS_STATS2 */
+
+ atomic_set(&midCount, 0);
+diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
+index e29581e..1c22bab 100644
+--- a/fs/cifs/cifsglob.h
++++ b/fs/cifs/cifsglob.h
+@@ -252,28 +252,28 @@ struct cifsTconInfo {
+ __u16 Flags; /* optional support bits */
+ enum statusEnum tidStatus;
+ #ifdef CONFIG_CIFS_STATS
+- atomic_t num_smbs_sent;
+- atomic_t num_writes;
+- atomic_t num_reads;
+- atomic_t num_flushes;
+- atomic_t num_oplock_brks;
+- atomic_t num_opens;
+- atomic_t num_closes;
+- atomic_t num_deletes;
+- atomic_t num_mkdirs;
+- atomic_t num_posixopens;
+- atomic_t num_posixmkdirs;
+- atomic_t num_rmdirs;
+- atomic_t num_renames;
+- atomic_t num_t2renames;
+- atomic_t num_ffirst;
+- atomic_t num_fnext;
+- atomic_t num_fclose;
+- atomic_t num_hardlinks;
+- atomic_t num_symlinks;
+- atomic_t num_locks;
+- atomic_t num_acl_get;
+- atomic_t num_acl_set;
++ atomic_unchecked_t num_smbs_sent;
++ atomic_unchecked_t num_writes;
++ atomic_unchecked_t num_reads;
++ atomic_unchecked_t num_flushes;
++ atomic_unchecked_t num_oplock_brks;
++ atomic_unchecked_t num_opens;
++ atomic_unchecked_t num_closes;
++ atomic_unchecked_t num_deletes;
++ atomic_unchecked_t num_mkdirs;
++ atomic_unchecked_t num_posixopens;
++ atomic_unchecked_t num_posixmkdirs;
++ atomic_unchecked_t num_rmdirs;
++ atomic_unchecked_t num_renames;
++ atomic_unchecked_t num_t2renames;
++ atomic_unchecked_t num_ffirst;
++ atomic_unchecked_t num_fnext;
++ atomic_unchecked_t num_fclose;
++ atomic_unchecked_t num_hardlinks;
++ atomic_unchecked_t num_symlinks;
++ atomic_unchecked_t num_locks;
++ atomic_unchecked_t num_acl_get;
++ atomic_unchecked_t num_acl_set;
+ #ifdef CONFIG_CIFS_STATS2
+ unsigned long long time_writes;
+ unsigned long long time_reads;
+@@ -414,7 +414,7 @@ static inline char CIFS_DIR_SEP(const struct cifs_sb_info *cifs_sb)
+ }
+
+ #ifdef CONFIG_CIFS_STATS
+-#define cifs_stats_inc atomic_inc
++#define cifs_stats_inc atomic_inc_unchecked
+
+ static inline void cifs_stats_bytes_written(struct cifsTconInfo *tcon,
+ unsigned int bytes)
+@@ -701,8 +701,8 @@ GLOBAL_EXTERN atomic_t tconInfoReconnectCount;
+ /* Various Debug counters */
+ GLOBAL_EXTERN atomic_t bufAllocCount; /* current number allocated */
+ #ifdef CONFIG_CIFS_STATS2
+-GLOBAL_EXTERN atomic_t totBufAllocCount; /* total allocated over all time */
+-GLOBAL_EXTERN atomic_t totSmBufAllocCount;
++GLOBAL_EXTERN atomic_unchecked_t totBufAllocCount; /* total allocated over all time */
++GLOBAL_EXTERN atomic_unchecked_t totSmBufAllocCount;
+ #endif
+ GLOBAL_EXTERN atomic_t smBufAllocCount;
+ GLOBAL_EXTERN atomic_t midCount;
+diff --git a/fs/cifs/link.c b/fs/cifs/link.c
+index fc1e048..28b3441 100644
+--- a/fs/cifs/link.c
++++ b/fs/cifs/link.c
+@@ -215,7 +215,7 @@ cifs_symlink(struct inode *inode, struct dentry *direntry, const char *symname)
+
+ void cifs_put_link(struct dentry *direntry, struct nameidata *nd, void *cookie)
+ {
+- char *p = nd_get_link(nd);
++ const char *p = nd_get_link(nd);
+ if (!IS_ERR(p))
+ kfree(p);
+ }
+diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
+index 95b82e8..12a538d 100644
+--- a/fs/cifs/misc.c
++++ b/fs/cifs/misc.c
+@@ -155,7 +155,7 @@ cifs_buf_get(void)
+ memset(ret_buf, 0, sizeof(struct smb_hdr) + 3);
+ atomic_inc(&bufAllocCount);
+ #ifdef CONFIG_CIFS_STATS2
+- atomic_inc(&totBufAllocCount);
++ atomic_inc_unchecked(&totBufAllocCount);
+ #endif /* CONFIG_CIFS_STATS2 */
+ }
+
+@@ -190,7 +190,7 @@ cifs_small_buf_get(void)
+ /* memset(ret_buf, 0, sizeof(struct smb_hdr) + 27);*/
+ atomic_inc(&smBufAllocCount);
+ #ifdef CONFIG_CIFS_STATS2
+- atomic_inc(&totSmBufAllocCount);
++ atomic_inc_unchecked(&totSmBufAllocCount);
+ #endif /* CONFIG_CIFS_STATS2 */
+
+ }
+diff --git a/fs/coda/cache.c b/fs/coda/cache.c
+index a5bf577..6d19845 100644
+--- a/fs/coda/cache.c
++++ b/fs/coda/cache.c
+@@ -24,14 +24,14 @@
+ #include <linux/coda_fs_i.h>
+ #include <linux/coda_cache.h>
+
+-static atomic_t permission_epoch = ATOMIC_INIT(0);
++static atomic_unchecked_t permission_epoch = ATOMIC_INIT(0);
+
+ /* replace or extend an acl cache hit */
+ void coda_cache_enter(struct inode *inode, int mask)
+ {
+ struct coda_inode_info *cii = ITOC(inode);
+
+- cii->c_cached_epoch = atomic_read(&permission_epoch);
++ cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch);
+ if (cii->c_uid != current_fsuid()) {
+ cii->c_uid = current_fsuid();
+ cii->c_cached_perm = mask;
+@@ -43,13 +43,13 @@ void coda_cache_enter(struct inode *inode, int mask)
+ void coda_cache_clear_inode(struct inode *inode)
+ {
+ struct coda_inode_info *cii = ITOC(inode);
+- cii->c_cached_epoch = atomic_read(&permission_epoch) - 1;
++ cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch) - 1;
+ }
+
+ /* remove all acl caches */
+ void coda_cache_clear_all(struct super_block *sb)
+ {
+- atomic_inc(&permission_epoch);
++ atomic_inc_unchecked(&permission_epoch);
+ }
+
+
+@@ -61,7 +61,7 @@ int coda_cache_check(struct inode *inode, int mask)
+
+ hit = (mask & cii->c_cached_perm) == mask &&
+ cii->c_uid == current_fsuid() &&
+- cii->c_cached_epoch == atomic_read(&permission_epoch);
++ cii->c_cached_epoch == atomic_read_unchecked(&permission_epoch);
+
+ return hit;
+ }
+diff --git a/fs/compat.c b/fs/compat.c
+index d1e2411..9a958d2 100644
+--- a/fs/compat.c
++++ b/fs/compat.c
+@@ -133,8 +133,8 @@ asmlinkage long compat_sys_utimes(char __user *filename, struct compat_timeval _
+ static int cp_compat_stat(struct kstat *stat, struct compat_stat __user *ubuf)
+ {
+ compat_ino_t ino = stat->ino;
+- typeof(ubuf->st_uid) uid = 0;
+- typeof(ubuf->st_gid) gid = 0;
++ typeof(((struct compat_stat *)0)->st_uid) uid = 0;
++ typeof(((struct compat_stat *)0)->st_gid) gid = 0;
+ int err;
+
+ SET_UID(uid, stat->uid);
+@@ -533,7 +533,7 @@ compat_sys_io_setup(unsigned nr_reqs, u32 __user *ctx32p)
+
+ set_fs(KERNEL_DS);
+ /* The __user pointer cast is valid because of the set_fs() */
+- ret = sys_io_setup(nr_reqs, (aio_context_t __user *) &ctx64);
++ ret = sys_io_setup(nr_reqs, (aio_context_t __force_user *) &ctx64);
+ set_fs(oldfs);
+ /* truncating is ok because it's a user address */
+ if (!ret)
+@@ -830,6 +830,7 @@ struct compat_old_linux_dirent {
+
+ struct compat_readdir_callback {
+ struct compat_old_linux_dirent __user *dirent;
++ struct file * file;
+ int result;
+ };
+
+@@ -847,6 +848,10 @@ static int compat_fillonedir(void *__buf, const char *name, int namlen,
+ buf->result = -EOVERFLOW;
+ return -EOVERFLOW;
+ }
++
++ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
++ return 0;
++
+ buf->result++;
+ dirent = buf->dirent;
+ if (!access_ok(VERIFY_WRITE, dirent,
+@@ -879,6 +884,7 @@ asmlinkage long compat_sys_old_readdir(unsigned int fd,
+
+ buf.result = 0;
+ buf.dirent = dirent;
++ buf.file = file;
+
+ error = vfs_readdir(file, compat_fillonedir, &buf);
+ if (buf.result)
+@@ -899,6 +905,7 @@ struct compat_linux_dirent {
+ struct compat_getdents_callback {
+ struct compat_linux_dirent __user *current_dir;
+ struct compat_linux_dirent __user *previous;
++ struct file * file;
+ int count;
+ int error;
+ };
+@@ -919,6 +926,10 @@ static int compat_filldir(void *__buf, const char *name, int namlen,
+ buf->error = -EOVERFLOW;
+ return -EOVERFLOW;
+ }
++
++ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
++ return 0;
++
+ dirent = buf->previous;
+ if (dirent) {
+ if (__put_user(offset, &dirent->d_off))
+@@ -966,6 +977,7 @@ asmlinkage long compat_sys_getdents(unsigned int fd,
+ buf.previous = NULL;
+ buf.count = count;
+ buf.error = 0;
++ buf.file = file;
+
+ error = vfs_readdir(file, compat_filldir, &buf);
+ if (error >= 0)
+@@ -987,6 +999,7 @@ out:
+ struct compat_getdents_callback64 {
+ struct linux_dirent64 __user *current_dir;
+ struct linux_dirent64 __user *previous;
++ struct file * file;
+ int count;
+ int error;
+ };
+@@ -1003,6 +1016,10 @@ static int compat_filldir64(void * __buf, const char * name, int namlen, loff_t
+ buf->error = -EINVAL; /* only used if we fail.. */
+ if (reclen > buf->count)
+ return -EINVAL;
++
++ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
++ return 0;
++
+ dirent = buf->previous;
+
+ if (dirent) {
+@@ -1054,13 +1071,14 @@ asmlinkage long compat_sys_getdents64(unsigned int fd,
+ buf.previous = NULL;
+ buf.count = count;
+ buf.error = 0;
++ buf.file = file;
+
+ error = vfs_readdir(file, compat_filldir64, &buf);
+ if (error >= 0)
+ error = buf.error;
+ lastdirent = buf.previous;
+ if (lastdirent) {
+- typeof(lastdirent->d_off) d_off = file->f_pos;
++ typeof(((struct linux_dirent64 *)0)->d_off) d_off = file->f_pos;
+ if (__put_user_unaligned(d_off, &lastdirent->d_off))
+ error = -EFAULT;
+ else
+@@ -1098,7 +1116,7 @@ static ssize_t compat_do_readv_writev(int type, struct file *file,
+ * verify all the pointers
+ */
+ ret = -EINVAL;
+- if ((nr_segs > UIO_MAXIOV) || (nr_segs <= 0))
++ if (nr_segs > UIO_MAXIOV)
+ goto out;
+ if (!file->f_op)
+ goto out;
+@@ -1463,11 +1481,35 @@ int compat_do_execve(char * filename,
+ compat_uptr_t __user *envp,
+ struct pt_regs * regs)
+ {
++#ifdef CONFIG_GRKERNSEC
++ struct file *old_exec_file;
++ struct acl_subject_label *old_acl;
++ struct rlimit old_rlim[RLIM_NLIMITS];
++#endif
+ struct linux_binprm *bprm;
+ struct file *file;
+ struct files_struct *displaced;
+ bool clear_in_exec;
+ int retval;
++ const struct cred *cred = current_cred();
++
++ /*
++ * We move the actual failure in case of RLIMIT_NPROC excess from
++ * set*uid() to execve() because too many poorly written programs
++ * don't check setuid() return code. Here we additionally recheck
++ * whether NPROC limit is still exceeded.
++ */
++ gr_learn_resource(current, RLIMIT_NPROC, atomic_read(¤t->cred->user->processes), 1);
++
++ if ((current->flags & PF_NPROC_EXCEEDED) &&
++ atomic_read(&cred->user->processes) > current->signal->rlim[RLIMIT_NPROC].rlim_cur) {
++ retval = -EAGAIN;
++ goto out_ret;
++ }
++
++ /* We're below the limit (still or again), so we don't want to make
++ * further execve() calls fail. */
++ current->flags &= ~PF_NPROC_EXCEEDED;
+
+ retval = unshare_files(&displaced);
+ if (retval)
+@@ -1493,12 +1535,26 @@ int compat_do_execve(char * filename,
+ if (IS_ERR(file))
+ goto out_unmark;
+
++ if (gr_ptrace_readexec(file, bprm->unsafe)) {
++ retval = -EPERM;
++ goto out_file;
++ }
++
+ sched_exec();
+
+ bprm->file = file;
+ bprm->filename = filename;
+ bprm->interp = filename;
+
++ if (gr_process_user_ban()) {
++ retval = -EPERM;
++ goto out_file;
++ }
++
++ retval = -EACCES;
++ if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt))
++ goto out_file;
++
+ retval = bprm_mm_init(bprm);
+ if (retval)
+ goto out_file;
+@@ -1515,24 +1571,63 @@ int compat_do_execve(char * filename,
+ if (retval < 0)
+ goto out;
+
++#ifdef CONFIG_GRKERNSEC
++ old_acl = current->acl;
++ memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
++ old_exec_file = current->exec_file;
++ get_file(file);
++ current->exec_file = file;
++#endif
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++ /* limit suid stack to 8MB
++ we saved the old limits above and will restore them if this exec fails
++ */
++ if ((bprm->cred->euid != current_euid()) || (bprm->cred->egid != current_egid()))
++ current->signal->rlim[RLIMIT_STACK].rlim_cur = 8 * 1024 * 1024;
++#endif
++
++ if (!gr_tpe_allow(file)) {
++ retval = -EACCES;
++ goto out_fail;
++ }
++
++ if (gr_check_crash_exec(file)) {
++ retval = -EACCES;
++ goto out_fail;
++ }
++
++ retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
++ bprm->unsafe);
++ if (retval < 0)
++ goto out_fail;
++
+ retval = copy_strings_kernel(1, &bprm->filename, bprm);
+ if (retval < 0)
+- goto out;
++ goto out_fail;
+
+ bprm->exec = bprm->p;
+ retval = compat_copy_strings(bprm->envc, envp, bprm);
+ if (retval < 0)
+- goto out;
++ goto out_fail;
+
+ retval = compat_copy_strings(bprm->argc, argv, bprm);
+ if (retval < 0)
+- goto out;
++ goto out_fail;
++
++ gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
++
++ gr_handle_exec_args_compat(bprm, argv);
+
+ retval = search_binary_handler(bprm, regs);
+ if (retval < 0)
+- goto out;
++ goto out_fail;
++#ifdef CONFIG_GRKERNSEC
++ if (old_exec_file)
++ fput(old_exec_file);
++#endif
+
+ /* execve succeeded */
++ increment_exec_counter();
+ current->fs->in_exec = 0;
+ current->in_execve = 0;
+ acct_update_integrals(current);
+@@ -1541,6 +1636,14 @@ int compat_do_execve(char * filename,
+ put_files_struct(displaced);
+ return retval;
+
++out_fail:
++#ifdef CONFIG_GRKERNSEC
++ current->acl = old_acl;
++ memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
++ fput(current->exec_file);
++ current->exec_file = old_exec_file;
++#endif
++
+ out:
+ if (bprm->mm) {
+ acct_arg_size(bprm, 0);
+@@ -1711,6 +1814,8 @@ int compat_core_sys_select(int n, compat_ulong_t __user *inp,
+ struct fdtable *fdt;
+ long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
+
++ pax_track_stack();
++
+ if (n < 0)
+ goto out_nofds;
+
+@@ -2151,7 +2256,7 @@ asmlinkage long compat_sys_nfsservctl(int cmd,
+ oldfs = get_fs();
+ set_fs(KERNEL_DS);
+ /* The __user pointer casts are valid because of the set_fs() */
+- err = sys_nfsservctl(cmd, (void __user *) karg, (void __user *) kres);
++ err = sys_nfsservctl(cmd, (void __force_user *) karg, (void __force_user *) kres);
+ set_fs(oldfs);
+
+ if (err)
+diff --git a/fs/compat_binfmt_elf.c b/fs/compat_binfmt_elf.c
+index 0adced2..bbb1b0d 100644
+--- a/fs/compat_binfmt_elf.c
++++ b/fs/compat_binfmt_elf.c
+@@ -29,10 +29,12 @@
+ #undef elfhdr
+ #undef elf_phdr
+ #undef elf_note
++#undef elf_dyn
+ #undef elf_addr_t
+ #define elfhdr elf32_hdr
+ #define elf_phdr elf32_phdr
+ #define elf_note elf32_note
++#define elf_dyn Elf32_Dyn
+ #define elf_addr_t Elf32_Addr
+
+ /*
+diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
+index d84e705..d8c364c 100644
+--- a/fs/compat_ioctl.c
++++ b/fs/compat_ioctl.c
+@@ -234,6 +234,8 @@ static int do_video_set_spu_palette(unsigned int fd, unsigned int cmd, unsigned
+ up = (struct compat_video_spu_palette __user *) arg;
+ err = get_user(palp, &up->palette);
+ err |= get_user(length, &up->length);
++ if (err)
++ return -EFAULT;
+
+ up_native = compat_alloc_user_space(sizeof(struct video_spu_palette));
+ err = put_user(compat_ptr(palp), &up_native->palette);
+@@ -1513,7 +1515,7 @@ static int serial_struct_ioctl(unsigned fd, unsigned cmd, unsigned long arg)
+ return -EFAULT;
+ if (__get_user(udata, &ss32->iomem_base))
+ return -EFAULT;
+- ss.iomem_base = compat_ptr(udata);
++ ss.iomem_base = (unsigned char __force_kernel *)compat_ptr(udata);
+ if (__get_user(ss.iomem_reg_shift, &ss32->iomem_reg_shift) ||
+ __get_user(ss.port_high, &ss32->port_high))
+ return -EFAULT;
+@@ -1809,7 +1811,7 @@ static int compat_ioctl_preallocate(struct file *file, unsigned long arg)
+ copy_in_user(&p->l_len, &p32->l_len, sizeof(s64)) ||
+ copy_in_user(&p->l_sysid, &p32->l_sysid, sizeof(s32)) ||
+ copy_in_user(&p->l_pid, &p32->l_pid, sizeof(u32)) ||
+- copy_in_user(&p->l_pad, &p32->l_pad, 4*sizeof(u32)))
++ copy_in_user(p->l_pad, &p32->l_pad, 4*sizeof(u32)))
+ return -EFAULT;
+
+ return ioctl_preallocate(file, p);
+diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
+index 8e48b52..f01ed91 100644
+--- a/fs/configfs/dir.c
++++ b/fs/configfs/dir.c
+@@ -1572,7 +1572,8 @@ static int configfs_readdir(struct file * filp, void * dirent, filldir_t filldir
+ }
+ for (p=q->next; p!= &parent_sd->s_children; p=p->next) {
+ struct configfs_dirent *next;
+- const char * name;
++ const unsigned char * name;
++ char d_name[sizeof(next->s_dentry->d_iname)];
+ int len;
+
+ next = list_entry(p, struct configfs_dirent,
+@@ -1581,7 +1582,12 @@ static int configfs_readdir(struct file * filp, void * dirent, filldir_t filldir
+ continue;
+
+ name = configfs_get_name(next);
+- len = strlen(name);
++ if (next->s_dentry && name == next->s_dentry->d_iname) {
++ len = next->s_dentry->d_name.len;
++ memcpy(d_name, name, len);
++ name = d_name;
++ } else
++ len = strlen(name);
+ if (next->s_dentry)
+ ino = next->s_dentry->d_inode->i_ino;
+ else
+diff --git a/fs/dcache.c b/fs/dcache.c
+index 44c0aea..a663f95 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -45,8 +45,6 @@ EXPORT_SYMBOL(dcache_lock);
+
+ static struct kmem_cache *dentry_cache __read_mostly;
+
+-#define DNAME_INLINE_LEN (sizeof(struct dentry)-offsetof(struct dentry,d_iname))
+-
+ /*
+ * This is the single most critical data structure when it comes
+ * to the dcache: the hashtable for lookups. Somebody should try
+@@ -1108,11 +1106,11 @@ struct dentry * d_alloc_root(struct inode * root_inode)
+ return res;
+ }
+
+-static inline struct hlist_head *d_hash(struct dentry *parent,
+- unsigned long hash)
++static inline struct hlist_head *d_hash(const struct dentry *parent,
++ unsigned int hash)
+ {
+- hash += ((unsigned long) parent ^ GOLDEN_RATIO_PRIME) / L1_CACHE_BYTES;
+- hash = hash ^ ((hash ^ GOLDEN_RATIO_PRIME) >> D_HASHBITS);
++ hash += (unsigned long) parent / L1_CACHE_BYTES;
++ hash = hash + (hash >> D_HASHBITS);
+ return dentry_hashtable + (hash & D_HASHMASK);
+ }
+
+@@ -2319,7 +2317,7 @@ void __init vfs_caches_init(unsigned long mempages)
+ mempages -= reserve;
+
+ names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
+- SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
++ SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_USERCOPY, NULL);
+
+ dcache_init();
+ inode_init();
+diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
+index 39c6ee8..dcee0f1 100644
+--- a/fs/debugfs/inode.c
++++ b/fs/debugfs/inode.c
+@@ -269,7 +269,11 @@ EXPORT_SYMBOL_GPL(debugfs_create_file);
+ struct dentry *debugfs_create_dir(const char *name, struct dentry *parent)
+ {
+ return debugfs_create_file(name,
++#ifdef CONFIG_GRKERNSEC_SYSFS_RESTRICT
++ S_IFDIR | S_IRWXU,
++#else
+ S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO,
++#endif
+ parent, NULL, NULL);
+ }
+ EXPORT_SYMBOL_GPL(debugfs_create_dir);
+diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c
+index c010ecf..a8d8c59 100644
+--- a/fs/dlm/lockspace.c
++++ b/fs/dlm/lockspace.c
+@@ -148,7 +148,7 @@ static void lockspace_kobj_release(struct kobject *k)
+ kfree(ls);
+ }
+
+-static struct sysfs_ops dlm_attr_ops = {
++static const struct sysfs_ops dlm_attr_ops = {
+ .show = dlm_attr_show,
+ .store = dlm_attr_store,
+ };
+diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
+index 7e164bb..62fa913 100644
+--- a/fs/ecryptfs/crypto.c
++++ b/fs/ecryptfs/crypto.c
+@@ -418,17 +418,6 @@ static int ecryptfs_encrypt_extent(struct page *enc_extent_page,
+ rc);
+ goto out;
+ }
+- if (unlikely(ecryptfs_verbosity > 0)) {
+- ecryptfs_printk(KERN_DEBUG, "Encrypting extent "
+- "with iv:\n");
+- ecryptfs_dump_hex(extent_iv, crypt_stat->iv_bytes);
+- ecryptfs_printk(KERN_DEBUG, "First 8 bytes before "
+- "encryption:\n");
+- ecryptfs_dump_hex((char *)
+- (page_address(page)
+- + (extent_offset * crypt_stat->extent_size)),
+- 8);
+- }
+ rc = ecryptfs_encrypt_page_offset(crypt_stat, enc_extent_page, 0,
+ page, (extent_offset
+ * crypt_stat->extent_size),
+@@ -441,14 +430,6 @@ static int ecryptfs_encrypt_extent(struct page *enc_extent_page,
+ goto out;
+ }
+ rc = 0;
+- if (unlikely(ecryptfs_verbosity > 0)) {
+- ecryptfs_printk(KERN_DEBUG, "Encrypt extent [0x%.16x]; "
+- "rc = [%d]\n", (extent_base + extent_offset),
+- rc);
+- ecryptfs_printk(KERN_DEBUG, "First 8 bytes after "
+- "encryption:\n");
+- ecryptfs_dump_hex((char *)(page_address(enc_extent_page)), 8);
+- }
+ out:
+ return rc;
+ }
+@@ -545,17 +526,6 @@ static int ecryptfs_decrypt_extent(struct page *page,
+ rc);
+ goto out;
+ }
+- if (unlikely(ecryptfs_verbosity > 0)) {
+- ecryptfs_printk(KERN_DEBUG, "Decrypting extent "
+- "with iv:\n");
+- ecryptfs_dump_hex(extent_iv, crypt_stat->iv_bytes);
+- ecryptfs_printk(KERN_DEBUG, "First 8 bytes before "
+- "decryption:\n");
+- ecryptfs_dump_hex((char *)
+- (page_address(enc_extent_page)
+- + (extent_offset * crypt_stat->extent_size)),
+- 8);
+- }
+ rc = ecryptfs_decrypt_page_offset(crypt_stat, page,
+ (extent_offset
+ * crypt_stat->extent_size),
+@@ -569,16 +539,6 @@ static int ecryptfs_decrypt_extent(struct page *page,
+ goto out;
+ }
+ rc = 0;
+- if (unlikely(ecryptfs_verbosity > 0)) {
+- ecryptfs_printk(KERN_DEBUG, "Decrypt extent [0x%.16x]; "
+- "rc = [%d]\n", (extent_base + extent_offset),
+- rc);
+- ecryptfs_printk(KERN_DEBUG, "First 8 bytes after "
+- "decryption:\n");
+- ecryptfs_dump_hex((char *)(page_address(page)
+- + (extent_offset
+- * crypt_stat->extent_size)), 8);
+- }
+ out:
+ return rc;
+ }
+diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
+index 502b09f..49129f4 100644
+--- a/fs/ecryptfs/file.c
++++ b/fs/ecryptfs/file.c
+@@ -348,7 +348,6 @@ const struct file_operations ecryptfs_main_fops = {
+ #ifdef CONFIG_COMPAT
+ .compat_ioctl = ecryptfs_compat_ioctl,
+ #endif
+- .mmap = generic_file_mmap,
+ .open = ecryptfs_open,
+ .flush = ecryptfs_flush,
+ .release = ecryptfs_release,
+diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
+index 90a6087..fa05803 100644
+--- a/fs/ecryptfs/inode.c
++++ b/fs/ecryptfs/inode.c
+@@ -647,7 +647,7 @@ static int ecryptfs_readlink_lower(struct dentry *dentry, char **buf,
+ old_fs = get_fs();
+ set_fs(get_ds());
+ rc = lower_dentry->d_inode->i_op->readlink(lower_dentry,
+- (char __user *)lower_buf,
++ (char __force_user *)lower_buf,
+ lower_bufsiz);
+ set_fs(old_fs);
+ if (rc < 0)
+@@ -693,7 +693,7 @@ static void *ecryptfs_follow_link(struct dentry *dentry, struct nameidata *nd)
+ }
+ old_fs = get_fs();
+ set_fs(get_ds());
+- rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
++ rc = dentry->d_inode->i_op->readlink(dentry, (__force char __user *)buf, len);
+ set_fs(old_fs);
+ if (rc < 0)
+ goto out_free;
+diff --git a/fs/exec.c b/fs/exec.c
+index 86fafc6..6a109b9 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -56,12 +56,28 @@
+ #include <linux/fsnotify.h>
+ #include <linux/fs_struct.h>
+ #include <linux/pipe_fs_i.h>
++#include <linux/random.h>
++#include <linux/seq_file.h>
++
++#ifdef CONFIG_PAX_REFCOUNT
++#include <linux/kallsyms.h>
++#include <linux/kdebug.h>
++#endif
+
+ #include <asm/uaccess.h>
+ #include <asm/mmu_context.h>
+ #include <asm/tlb.h>
+ #include "internal.h"
+
++#ifndef CONFIG_PAX_HAVE_ACL_FLAGS
++void __weak pax_set_initial_flags(struct linux_binprm *bprm) {}
++#endif
++
++#ifdef CONFIG_PAX_HOOK_ACL_FLAGS
++void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
++EXPORT_SYMBOL(pax_set_initial_flags_func);
++#endif
++
+ int core_uses_pid;
+ char core_pattern[CORENAME_MAX_SIZE] = "core";
+ unsigned int core_pipe_limit;
+@@ -178,18 +194,10 @@ struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
+ int write)
+ {
+ struct page *page;
+- int ret;
+
+-#ifdef CONFIG_STACK_GROWSUP
+- if (write) {
+- ret = expand_stack_downwards(bprm->vma, pos);
+- if (ret < 0)
+- return NULL;
+- }
+-#endif
+- ret = get_user_pages(current, bprm->mm, pos,
+- 1, write, 1, &page, NULL);
+- if (ret <= 0)
++ if (0 > expand_stack_downwards(bprm->vma, pos))
++ return NULL;
++ if (0 >= get_user_pages(current, bprm->mm, pos, 1, write, 1, &page, NULL))
+ return NULL;
+
+ if (write) {
+@@ -205,6 +213,17 @@ struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
+ if (size <= ARG_MAX)
+ return page;
+
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++ // only allow 512KB for argv+env on suid/sgid binaries
++ // to prevent easy ASLR exhaustion
++ if (((bprm->cred->euid != current_euid()) ||
++ (bprm->cred->egid != current_egid())) &&
++ (size > (512 * 1024))) {
++ put_page(page);
++ return NULL;
++ }
++#endif
++
+ /*
+ * Limit to 1/4-th the stack size for the argv+env strings.
+ * This ensures that:
+@@ -263,6 +282,11 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
+ vma->vm_end = STACK_TOP_MAX;
+ vma->vm_start = vma->vm_end - PAGE_SIZE;
+ vma->vm_flags = VM_STACK_FLAGS;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ vma->vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
++#endif
++
+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
+
+ err = security_file_mmap(NULL, 0, 0, 0, vma->vm_start, 1);
+@@ -276,6 +300,12 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
+ mm->stack_vm = mm->total_vm = 1;
+ up_write(&mm->mmap_sem);
+ bprm->p = vma->vm_end - sizeof(void *);
++
++#ifdef CONFIG_PAX_RANDUSTACK
++ if (randomize_va_space)
++ bprm->p ^= random32() & ~PAGE_MASK;
++#endif
++
+ return 0;
+ err:
+ up_write(&mm->mmap_sem);
+@@ -510,7 +540,7 @@ int copy_strings_kernel(int argc,char ** argv, struct linux_binprm *bprm)
+ int r;
+ mm_segment_t oldfs = get_fs();
+ set_fs(KERNEL_DS);
+- r = copy_strings(argc, (char __user * __user *)argv, bprm);
++ r = copy_strings(argc, (__force char __user * __user *)argv, bprm);
+ set_fs(oldfs);
+ return r;
+ }
+@@ -540,7 +570,8 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
+ unsigned long new_end = old_end - shift;
+ struct mmu_gather *tlb;
+
+- BUG_ON(new_start > new_end);
++ if (new_start >= new_end || new_start < mmap_min_addr)
++ return -ENOMEM;
+
+ /*
+ * ensure there are no vmas between where we want to go
+@@ -549,6 +580,10 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
+ if (vma != find_vma(mm, new_start))
+ return -EFAULT;
+
++#ifdef CONFIG_PAX_SEGMEXEC
++ BUG_ON(pax_find_mirror_vma(vma));
++#endif
++
+ /*
+ * cover the whole range: [new_start, old_end)
+ */
+@@ -630,10 +665,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
+ stack_top = arch_align_stack(stack_top);
+ stack_top = PAGE_ALIGN(stack_top);
+
+- if (unlikely(stack_top < mmap_min_addr) ||
+- unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr))
+- return -ENOMEM;
+-
+ stack_shift = vma->vm_end - stack_top;
+
+ bprm->p -= stack_shift;
+@@ -645,6 +676,14 @@ int setup_arg_pages(struct linux_binprm *bprm,
+ bprm->exec -= stack_shift;
+
+ down_write(&mm->mmap_sem);
++
++ /* Move stack pages down in memory. */
++ if (stack_shift) {
++ ret = shift_arg_pages(vma, stack_shift);
++ if (ret)
++ goto out_unlock;
++ }
++
+ vm_flags = VM_STACK_FLAGS;
+
+ /*
+@@ -658,19 +697,24 @@ int setup_arg_pages(struct linux_binprm *bprm,
+ vm_flags &= ~VM_EXEC;
+ vm_flags |= mm->def_flags;
+
++#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
++ if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
++ vm_flags &= ~VM_EXEC;
++
++#ifdef CONFIG_PAX_MPROTECT
++ if (mm->pax_flags & MF_PAX_MPROTECT)
++ vm_flags &= ~VM_MAYEXEC;
++#endif
++
++ }
++#endif
++
+ ret = mprotect_fixup(vma, &prev, vma->vm_start, vma->vm_end,
+ vm_flags);
+ if (ret)
+ goto out_unlock;
+ BUG_ON(prev != vma);
+
+- /* Move stack pages down in memory. */
+- if (stack_shift) {
+- ret = shift_arg_pages(vma, stack_shift);
+- if (ret)
+- goto out_unlock;
+- }
+-
+ stack_expand = EXTRA_STACK_VM_PAGES * PAGE_SIZE;
+ stack_size = vma->vm_end - vma->vm_start;
+ /*
+@@ -744,7 +788,7 @@ int kernel_read(struct file *file, loff_t offset,
+ old_fs = get_fs();
+ set_fs(get_ds());
+ /* The cast to a user pointer is valid due to the set_fs() */
+- result = vfs_read(file, (void __user *)addr, count, &pos);
++ result = vfs_read(file, (void __force_user *)addr, count, &pos);
+ set_fs(old_fs);
+ return result;
+ }
+@@ -985,6 +1029,21 @@ void set_task_comm(struct task_struct *tsk, char *buf)
+ perf_event_comm(tsk);
+ }
+
++static void filename_to_taskname(char *tcomm, const char *fn, unsigned int len)
++{
++ int i, ch;
++
++ /* Copies the binary name from after last slash */
++ for (i = 0; (ch = *(fn++)) != '\0';) {
++ if (ch == '/')
++ i = 0; /* overwrite what we wrote */
++ else
++ if (i < len - 1)
++ tcomm[i++] = ch;
++ }
++ tcomm[i] = '\0';
++}
++
+ int flush_old_exec(struct linux_binprm * bprm)
+ {
+ int retval;
+@@ -999,6 +1058,7 @@ int flush_old_exec(struct linux_binprm * bprm)
+
+ set_mm_exe_file(bprm->mm, bprm->file);
+
++ filename_to_taskname(bprm->tcomm, bprm->filename, sizeof(bprm->tcomm));
+ /*
+ * Release all of the old mmap stuff
+ */
+@@ -1023,10 +1083,6 @@ EXPORT_SYMBOL(flush_old_exec);
+
+ void setup_new_exec(struct linux_binprm * bprm)
+ {
+- int i, ch;
+- char * name;
+- char tcomm[sizeof(current->comm)];
+-
+ arch_pick_mmap_layout(current->mm);
+
+ /* This is the point of no return */
+@@ -1037,18 +1093,7 @@ void setup_new_exec(struct linux_binprm * bprm)
+ else
+ set_dumpable(current->mm, suid_dumpable);
+
+- name = bprm->filename;
+-
+- /* Copies the binary name from after last slash */
+- for (i=0; (ch = *(name++)) != '\0';) {
+- if (ch == '/')
+- i = 0; /* overwrite what we wrote */
+- else
+- if (i < (sizeof(tcomm) - 1))
+- tcomm[i++] = ch;
+- }
+- tcomm[i] = '\0';
+- set_task_comm(current, tcomm);
++ set_task_comm(current, bprm->tcomm);
+
+ /* Set the new mm task size. We have to do that late because it may
+ * depend on TIF_32BIT which is only updated in flush_thread() on
+@@ -1152,7 +1197,7 @@ int check_unsafe_exec(struct linux_binprm *bprm)
+ }
+ rcu_read_unlock();
+
+- if (p->fs->users > n_fs) {
++ if (atomic_read(&p->fs->users) > n_fs) {
+ bprm->unsafe |= LSM_UNSAFE_SHARE;
+ } else {
+ res = -EAGAIN;
+@@ -1339,6 +1384,21 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
+
+ EXPORT_SYMBOL(search_binary_handler);
+
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++DEFINE_PER_CPU(u64, exec_counter);
++static int __init init_exec_counters(void)
++{
++ unsigned int cpu;
++
++ for_each_possible_cpu(cpu) {
++ per_cpu(exec_counter, cpu) = (u64)cpu;
++ }
++
++ return 0;
++}
++early_initcall(init_exec_counters);
++#endif
++
+ /*
+ * sys_execve() executes a new program.
+ */
+@@ -1347,11 +1407,35 @@ int do_execve(char * filename,
+ char __user *__user *envp,
+ struct pt_regs * regs)
+ {
++#ifdef CONFIG_GRKERNSEC
++ struct file *old_exec_file;
++ struct acl_subject_label *old_acl;
++ struct rlimit old_rlim[RLIM_NLIMITS];
++#endif
+ struct linux_binprm *bprm;
+ struct file *file;
+ struct files_struct *displaced;
+ bool clear_in_exec;
+ int retval;
++ const struct cred *cred = current_cred();
++
++ /*
++ * We move the actual failure in case of RLIMIT_NPROC excess from
++ * set*uid() to execve() because too many poorly written programs
++ * don't check setuid() return code. Here we additionally recheck
++ * whether NPROC limit is still exceeded.
++ */
++ gr_learn_resource(current, RLIMIT_NPROC, atomic_read(¤t->cred->user->processes), 1);
++
++ if ((current->flags & PF_NPROC_EXCEEDED) &&
++ atomic_read(&cred->user->processes) > current->signal->rlim[RLIMIT_NPROC].rlim_cur) {
++ retval = -EAGAIN;
++ goto out_ret;
++ }
++
++ /* We're below the limit (still or again), so we don't want to make
++ * further execve() calls fail. */
++ current->flags &= ~PF_NPROC_EXCEEDED;
+
+ retval = unshare_files(&displaced);
+ if (retval)
+@@ -1377,12 +1461,27 @@ int do_execve(char * filename,
+ if (IS_ERR(file))
+ goto out_unmark;
+
++ if (gr_ptrace_readexec(file, bprm->unsafe)) {
++ retval = -EPERM;
++ goto out_file;
++ }
++
+ sched_exec();
+
+ bprm->file = file;
+ bprm->filename = filename;
+ bprm->interp = filename;
+
++ if (gr_process_user_ban()) {
++ retval = -EPERM;
++ goto out_file;
++ }
++
++ if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt)) {
++ retval = -EACCES;
++ goto out_file;
++ }
++
+ retval = bprm_mm_init(bprm);
+ if (retval)
+ goto out_file;
+@@ -1399,25 +1498,66 @@ int do_execve(char * filename,
+ if (retval < 0)
+ goto out;
+
++#ifdef CONFIG_GRKERNSEC
++ old_acl = current->acl;
++ memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
++ old_exec_file = current->exec_file;
++ get_file(file);
++ current->exec_file = file;
++#endif
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++ /* limit suid stack to 8MB
++ we saved the old limits above and will restore them if this exec fails
++ */
++ if (((bprm->cred->euid != current_euid()) || (bprm->cred->egid != current_egid())) &&
++ (old_rlim[RLIMIT_STACK].rlim_cur > (8 * 1024 * 1024)))
++ current->signal->rlim[RLIMIT_STACK].rlim_cur = 8 * 1024 * 1024;
++#endif
++
++ if (!gr_tpe_allow(file)) {
++ retval = -EACCES;
++ goto out_fail;
++ }
++
++ if (gr_check_crash_exec(file)) {
++ retval = -EACCES;
++ goto out_fail;
++ }
++
++ retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
++ bprm->unsafe);
++ if (retval < 0)
++ goto out_fail;
++
+ retval = copy_strings_kernel(1, &bprm->filename, bprm);
+ if (retval < 0)
+- goto out;
++ goto out_fail;
+
+ bprm->exec = bprm->p;
+ retval = copy_strings(bprm->envc, envp, bprm);
+ if (retval < 0)
+- goto out;
++ goto out_fail;
+
+ retval = copy_strings(bprm->argc, argv, bprm);
+ if (retval < 0)
+- goto out;
++ goto out_fail;
++
++ gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
++
++ gr_handle_exec_args(bprm, (const char __user *const __user *)argv);
+
+ current->flags &= ~PF_KTHREAD;
+ retval = search_binary_handler(bprm,regs);
+ if (retval < 0)
+- goto out;
++ goto out_fail;
++#ifdef CONFIG_GRKERNSEC
++ if (old_exec_file)
++ fput(old_exec_file);
++#endif
+
+ /* execve succeeded */
++
++ increment_exec_counter();
+ current->fs->in_exec = 0;
+ current->in_execve = 0;
+ acct_update_integrals(current);
+@@ -1426,6 +1566,14 @@ int do_execve(char * filename,
+ put_files_struct(displaced);
+ return retval;
+
++out_fail:
++#ifdef CONFIG_GRKERNSEC
++ current->acl = old_acl;
++ memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
++ fput(current->exec_file);
++ current->exec_file = old_exec_file;
++#endif
++
+ out:
+ if (bprm->mm) {
+ acct_arg_size(bprm, 0);
+@@ -1591,6 +1739,229 @@ out:
+ return ispipe;
+ }
+
++int pax_check_flags(unsigned long *flags)
++{
++ int retval = 0;
++
++#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_SEGMEXEC)
++ if (*flags & MF_PAX_SEGMEXEC)
++ {
++ *flags &= ~MF_PAX_SEGMEXEC;
++ retval = -EINVAL;
++ }
++#endif
++
++ if ((*flags & MF_PAX_PAGEEXEC)
++
++#ifdef CONFIG_PAX_PAGEEXEC
++ && (*flags & MF_PAX_SEGMEXEC)
++#endif
++
++ )
++ {
++ *flags &= ~MF_PAX_PAGEEXEC;
++ retval = -EINVAL;
++ }
++
++ if ((*flags & MF_PAX_MPROTECT)
++
++#ifdef CONFIG_PAX_MPROTECT
++ && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
++#endif
++
++ )
++ {
++ *flags &= ~MF_PAX_MPROTECT;
++ retval = -EINVAL;
++ }
++
++ if ((*flags & MF_PAX_EMUTRAMP)
++
++#ifdef CONFIG_PAX_EMUTRAMP
++ && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
++#endif
++
++ )
++ {
++ *flags &= ~MF_PAX_EMUTRAMP;
++ retval = -EINVAL;
++ }
++
++ return retval;
++}
++
++EXPORT_SYMBOL(pax_check_flags);
++
++#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
++void pax_report_fault(struct pt_regs *regs, void *pc, void *sp)
++{
++ struct task_struct *tsk = current;
++ struct mm_struct *mm = current->mm;
++ char *buffer_exec = (char *)__get_free_page(GFP_KERNEL);
++ char *buffer_fault = (char *)__get_free_page(GFP_KERNEL);
++ char *path_exec = NULL;
++ char *path_fault = NULL;
++ unsigned long start = 0UL, end = 0UL, offset = 0UL;
++
++ if (buffer_exec && buffer_fault) {
++ struct vm_area_struct *vma, *vma_exec = NULL, *vma_fault = NULL;
++
++ down_read(&mm->mmap_sem);
++ vma = mm->mmap;
++ while (vma && (!vma_exec || !vma_fault)) {
++ if ((vma->vm_flags & VM_EXECUTABLE) && vma->vm_file)
++ vma_exec = vma;
++ if (vma->vm_start <= (unsigned long)pc && (unsigned long)pc < vma->vm_end)
++ vma_fault = vma;
++ vma = vma->vm_next;
++ }
++ if (vma_exec) {
++ path_exec = d_path(&vma_exec->vm_file->f_path, buffer_exec, PAGE_SIZE);
++ if (IS_ERR(path_exec))
++ path_exec = "<path too long>";
++ else {
++ path_exec = mangle_path(buffer_exec, path_exec, "\t\n\\");
++ if (path_exec) {
++ *path_exec = 0;
++ path_exec = buffer_exec;
++ } else
++ path_exec = "<path too long>";
++ }
++ }
++ if (vma_fault) {
++ start = vma_fault->vm_start;
++ end = vma_fault->vm_end;
++ offset = vma_fault->vm_pgoff << PAGE_SHIFT;
++ if (vma_fault->vm_file) {
++ path_fault = d_path(&vma_fault->vm_file->f_path, buffer_fault, PAGE_SIZE);
++ if (IS_ERR(path_fault))
++ path_fault = "<path too long>";
++ else {
++ path_fault = mangle_path(buffer_fault, path_fault, "\t\n\\");
++ if (path_fault) {
++ *path_fault = 0;
++ path_fault = buffer_fault;
++ } else
++ path_fault = "<path too long>";
++ }
++ } else
++ path_fault = "<anonymous mapping>";
++ }
++ up_read(&mm->mmap_sem);
++ }
++ if (tsk->signal->curr_ip)
++ printk(KERN_ERR "PAX: From %pI4: execution attempt in: %s, %08lx-%08lx %08lx\n", &tsk->signal->curr_ip, path_fault, start, end, offset);
++ else
++ printk(KERN_ERR "PAX: execution attempt in: %s, %08lx-%08lx %08lx\n", path_fault, start, end, offset);
++ printk(KERN_ERR "PAX: terminating task: %s(%s):%d, uid/euid: %u/%u, "
++ "PC: %p, SP: %p\n", path_exec, tsk->comm, task_pid_nr(tsk),
++ task_uid(tsk), task_euid(tsk), pc, sp);
++ free_page((unsigned long)buffer_exec);
++ free_page((unsigned long)buffer_fault);
++ pax_report_insns(regs, pc, sp);
++ do_coredump(SIGKILL, SIGKILL, regs);
++}
++#endif
++
++#ifdef CONFIG_PAX_REFCOUNT
++void pax_report_refcount_overflow(struct pt_regs *regs)
++{
++ if (current->signal->curr_ip)
++ printk(KERN_ERR "PAX: From %pI4: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
++ ¤t->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
++ else
++ printk(KERN_ERR "PAX: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
++ current->comm, task_pid_nr(current), current_uid(), current_euid());
++ print_symbol(KERN_ERR "PAX: refcount overflow occured at: %s\n", instruction_pointer(regs));
++ show_regs(regs);
++ force_sig_specific(SIGKILL, current);
++}
++#endif
++
++#ifdef CONFIG_PAX_USERCOPY
++/* 0: not at all, 1: fully, 2: fully inside frame, -1: partially (implies an error) */
++int object_is_on_stack(const void *obj, unsigned long len)
++{
++ const void * const stack = task_stack_page(current);
++ const void * const stackend = stack + THREAD_SIZE;
++
++#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
++ const void *frame = NULL;
++ const void *oldframe;
++#endif
++
++ if (obj + len < obj)
++ return -1;
++
++ if (obj + len <= stack || stackend <= obj)
++ return 0;
++
++ if (obj < stack || stackend < obj + len)
++ return -1;
++
++#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
++ oldframe = __builtin_frame_address(1);
++ if (oldframe)
++ frame = __builtin_frame_address(2);
++ /*
++ low ----------------------------------------------> high
++ [saved bp][saved ip][args][local vars][saved bp][saved ip]
++ ^----------------^
++ allow copies only within here
++ */
++ while (stack <= frame && frame < stackend) {
++ /* if obj + len extends past the last frame, this
++ check won't pass and the next frame will be 0,
++ causing us to bail out and correctly report
++ the copy as invalid
++ */
++ if (obj + len <= frame)
++ return obj >= oldframe + 2 * sizeof(void *) ? 2 : -1;
++ oldframe = frame;
++ frame = *(const void * const *)frame;
++ }
++ return -1;
++#else
++ return 1;
++#endif
++}
++
++__noreturn void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type)
++{
++ if (current->signal->curr_ip)
++ printk(KERN_ERR "PAX: From %pI4: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
++ ¤t->signal->curr_ip, to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
++ else
++ printk(KERN_ERR "PAX: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
++ to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
++
++ dump_stack();
++ gr_handle_kernel_exploit();
++ do_group_exit(SIGKILL);
++}
++#endif
++
++#ifdef CONFIG_PAX_MEMORY_STACKLEAK
++void pax_track_stack(void)
++{
++ unsigned long sp = (unsigned long)&sp;
++ if (sp < current_thread_info()->lowest_stack &&
++ sp > (unsigned long)task_stack_page(current))
++ current_thread_info()->lowest_stack = sp;
++}
++EXPORT_SYMBOL(pax_track_stack);
++#endif
++
++#ifdef CONFIG_PAX_SIZE_OVERFLOW
++void report_size_overflow(const char *file, unsigned int line, const char *func)
++{
++ printk(KERN_ERR "PAX: size overflow detected in function %s %s:%u\n", func, file, line);
++ dump_stack();
++ do_group_exit(SIGKILL);
++}
++EXPORT_SYMBOL(report_size_overflow);
++#endif
++
+ static int zap_process(struct task_struct *start)
+ {
+ struct task_struct *t;
+@@ -1793,17 +2164,17 @@ static void wait_for_dump_helpers(struct file *file)
+ pipe = file->f_path.dentry->d_inode->i_pipe;
+
+ pipe_lock(pipe);
+- pipe->readers++;
+- pipe->writers--;
++ atomic_inc(&pipe->readers);
++ atomic_dec(&pipe->writers);
+
+- while ((pipe->readers > 1) && (!signal_pending(current))) {
++ while ((atomic_read(&pipe->readers) > 1) && (!signal_pending(current))) {
+ wake_up_interruptible_sync(&pipe->wait);
+ kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
+ pipe_wait(pipe);
+ }
+
+- pipe->readers--;
+- pipe->writers++;
++ atomic_dec(&pipe->readers);
++ atomic_inc(&pipe->writers);
+ pipe_unlock(pipe);
+
+ }
+@@ -1826,10 +2197,13 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+ char **helper_argv = NULL;
+ int helper_argc = 0;
+ int dump_count = 0;
+- static atomic_t core_dump_count = ATOMIC_INIT(0);
++ static atomic_unchecked_t core_dump_count = ATOMIC_INIT(0);
+
+ audit_core_dumps(signr);
+
++ if (signr == SIGSEGV || signr == SIGBUS || signr == SIGKILL || signr == SIGILL)
++ gr_handle_brute_attach(current, mm->flags);
++
+ binfmt = mm->binfmt;
+ if (!binfmt || !binfmt->core_dump)
+ goto fail;
+@@ -1874,6 +2248,8 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+ */
+ clear_thread_flag(TIF_SIGPENDING);
+
++ gr_learn_resource(current, RLIMIT_CORE, binfmt->min_coredump, 1);
++
+ /*
+ * lock_kernel() because format_corename() is controlled by sysctl, which
+ * uses lock_kernel()
+@@ -1908,7 +2284,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+ goto fail_unlock;
+ }
+
+- dump_count = atomic_inc_return(&core_dump_count);
++ dump_count = atomic_inc_return_unchecked(&core_dump_count);
+ if (core_pipe_limit && (core_pipe_limit < dump_count)) {
+ printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
+ task_tgid_vnr(current), current->comm);
+@@ -1972,7 +2348,7 @@ close_fail:
+ filp_close(file, NULL);
+ fail_dropcount:
+ if (dump_count)
+- atomic_dec(&core_dump_count);
++ atomic_dec_unchecked(&core_dump_count);
+ fail_unlock:
+ if (helper_argv)
+ argv_free(helper_argv);
+diff --git a/fs/ext2/balloc.c b/fs/ext2/balloc.c
+index 7f8d2e5..a1abdbb 100644
+--- a/fs/ext2/balloc.c
++++ b/fs/ext2/balloc.c
+@@ -1192,7 +1192,7 @@ static int ext2_has_free_blocks(struct ext2_sb_info *sbi)
+
+ free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
+ root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
+- if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
++ if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
+ sbi->s_resuid != current_fsuid() &&
+ (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
+ return 0;
+diff --git a/fs/ext3/balloc.c b/fs/ext3/balloc.c
+index 27967f9..9f2a5fb 100644
+--- a/fs/ext3/balloc.c
++++ b/fs/ext3/balloc.c
+@@ -1421,7 +1421,7 @@ static int ext3_has_free_blocks(struct ext3_sb_info *sbi)
+
+ free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
+ root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
+- if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
++ if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
+ sbi->s_resuid != current_fsuid() &&
+ (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
+ return 0;
+diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
+index e85b63c..80398e6 100644
+--- a/fs/ext4/balloc.c
++++ b/fs/ext4/balloc.c
+@@ -570,7 +570,7 @@ int ext4_has_free_blocks(struct ext4_sb_info *sbi, s64 nblocks)
+ /* Hm, nope. Are (enough) root reserved blocks available? */
+ if (sbi->s_resuid == current_fsuid() ||
+ ((sbi->s_resgid != 0) && in_group_p(sbi->s_resgid)) ||
+- capable(CAP_SYS_RESOURCE)) {
++ capable_nolog(CAP_SYS_RESOURCE)) {
+ if (free_blocks >= (nblocks + dirty_blocks))
+ return 1;
+ }
+diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
+index 67c46ed..1f237e5 100644
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -1077,19 +1077,19 @@ struct ext4_sb_info {
+
+ /* stats for buddy allocator */
+ spinlock_t s_mb_pa_lock;
+- atomic_t s_bal_reqs; /* number of reqs with len > 1 */
+- atomic_t s_bal_success; /* we found long enough chunks */
+- atomic_t s_bal_allocated; /* in blocks */
+- atomic_t s_bal_ex_scanned; /* total extents scanned */
+- atomic_t s_bal_goals; /* goal hits */
+- atomic_t s_bal_breaks; /* too long searches */
+- atomic_t s_bal_2orders; /* 2^order hits */
++ atomic_unchecked_t s_bal_reqs; /* number of reqs with len > 1 */
++ atomic_unchecked_t s_bal_success; /* we found long enough chunks */
++ atomic_unchecked_t s_bal_allocated; /* in blocks */
++ atomic_unchecked_t s_bal_ex_scanned; /* total extents scanned */
++ atomic_unchecked_t s_bal_goals; /* goal hits */
++ atomic_unchecked_t s_bal_breaks; /* too long searches */
++ atomic_unchecked_t s_bal_2orders; /* 2^order hits */
+ spinlock_t s_bal_lock;
+ unsigned long s_mb_buddies_generated;
+ unsigned long long s_mb_generation_time;
+- atomic_t s_mb_lost_chunks;
+- atomic_t s_mb_preallocated;
+- atomic_t s_mb_discarded;
++ atomic_unchecked_t s_mb_lost_chunks;
++ atomic_unchecked_t s_mb_preallocated;
++ atomic_unchecked_t s_mb_discarded;
+ atomic_t s_lock_busy;
+
+ /* locality groups */
+diff --git a/fs/ext4/file.c b/fs/ext4/file.c
+index 2a60541..7439d61 100644
+--- a/fs/ext4/file.c
++++ b/fs/ext4/file.c
+@@ -122,8 +122,8 @@ static int ext4_file_open(struct inode * inode, struct file * filp)
+ cp = d_path(&path, buf, sizeof(buf));
+ path_put(&path);
+ if (!IS_ERR(cp)) {
+- memcpy(sbi->s_es->s_last_mounted, cp,
+- sizeof(sbi->s_es->s_last_mounted));
++ strlcpy(sbi->s_es->s_last_mounted, cp,
++ sizeof(sbi->s_es->s_last_mounted));
+ sb->s_dirt = 1;
+ }
+ }
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index 42bac1b..0aab9d8 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -1755,7 +1755,7 @@ void ext4_mb_simple_scan_group(struct ext4_allocation_context *ac,
+ BUG_ON(ac->ac_b_ex.fe_len != ac->ac_g_ex.fe_len);
+
+ if (EXT4_SB(sb)->s_mb_stats)
+- atomic_inc(&EXT4_SB(sb)->s_bal_2orders);
++ atomic_inc_unchecked(&EXT4_SB(sb)->s_bal_2orders);
+
+ break;
+ }
+@@ -2131,7 +2131,7 @@ repeat:
+ ac->ac_status = AC_STATUS_CONTINUE;
+ ac->ac_flags |= EXT4_MB_HINT_FIRST;
+ cr = 3;
+- atomic_inc(&sbi->s_mb_lost_chunks);
++ atomic_inc_unchecked(&sbi->s_mb_lost_chunks);
+ goto repeat;
+ }
+ }
+@@ -2174,6 +2174,8 @@ static int ext4_mb_seq_groups_show(struct seq_file *seq, void *v)
+ ext4_grpblk_t counters[16];
+ } sg;
+
++ pax_track_stack();
++
+ group--;
+ if (group == 0)
+ seq_printf(seq, "#%-5s: %-5s %-5s %-5s "
+@@ -2534,25 +2536,25 @@ int ext4_mb_release(struct super_block *sb)
+ if (sbi->s_mb_stats) {
+ printk(KERN_INFO
+ "EXT4-fs: mballoc: %u blocks %u reqs (%u success)\n",
+- atomic_read(&sbi->s_bal_allocated),
+- atomic_read(&sbi->s_bal_reqs),
+- atomic_read(&sbi->s_bal_success));
++ atomic_read_unchecked(&sbi->s_bal_allocated),
++ atomic_read_unchecked(&sbi->s_bal_reqs),
++ atomic_read_unchecked(&sbi->s_bal_success));
+ printk(KERN_INFO
+ "EXT4-fs: mballoc: %u extents scanned, %u goal hits, "
+ "%u 2^N hits, %u breaks, %u lost\n",
+- atomic_read(&sbi->s_bal_ex_scanned),
+- atomic_read(&sbi->s_bal_goals),
+- atomic_read(&sbi->s_bal_2orders),
+- atomic_read(&sbi->s_bal_breaks),
+- atomic_read(&sbi->s_mb_lost_chunks));
++ atomic_read_unchecked(&sbi->s_bal_ex_scanned),
++ atomic_read_unchecked(&sbi->s_bal_goals),
++ atomic_read_unchecked(&sbi->s_bal_2orders),
++ atomic_read_unchecked(&sbi->s_bal_breaks),
++ atomic_read_unchecked(&sbi->s_mb_lost_chunks));
+ printk(KERN_INFO
+ "EXT4-fs: mballoc: %lu generated and it took %Lu\n",
+ sbi->s_mb_buddies_generated++,
+ sbi->s_mb_generation_time);
+ printk(KERN_INFO
+ "EXT4-fs: mballoc: %u preallocated, %u discarded\n",
+- atomic_read(&sbi->s_mb_preallocated),
+- atomic_read(&sbi->s_mb_discarded));
++ atomic_read_unchecked(&sbi->s_mb_preallocated),
++ atomic_read_unchecked(&sbi->s_mb_discarded));
+ }
+
+ free_percpu(sbi->s_locality_groups);
+@@ -3034,16 +3036,16 @@ static void ext4_mb_collect_stats(struct ext4_allocation_context *ac)
+ struct ext4_sb_info *sbi = EXT4_SB(ac->ac_sb);
+
+ if (sbi->s_mb_stats && ac->ac_g_ex.fe_len > 1) {
+- atomic_inc(&sbi->s_bal_reqs);
+- atomic_add(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
++ atomic_inc_unchecked(&sbi->s_bal_reqs);
++ atomic_add_unchecked(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
+ if (ac->ac_o_ex.fe_len >= ac->ac_g_ex.fe_len)
+- atomic_inc(&sbi->s_bal_success);
+- atomic_add(ac->ac_found, &sbi->s_bal_ex_scanned);
++ atomic_inc_unchecked(&sbi->s_bal_success);
++ atomic_add_unchecked(ac->ac_found, &sbi->s_bal_ex_scanned);
+ if (ac->ac_g_ex.fe_start == ac->ac_b_ex.fe_start &&
+ ac->ac_g_ex.fe_group == ac->ac_b_ex.fe_group)
+- atomic_inc(&sbi->s_bal_goals);
++ atomic_inc_unchecked(&sbi->s_bal_goals);
+ if (ac->ac_found > sbi->s_mb_max_to_scan)
+- atomic_inc(&sbi->s_bal_breaks);
++ atomic_inc_unchecked(&sbi->s_bal_breaks);
+ }
+
+ if (ac->ac_op == EXT4_MB_HISTORY_ALLOC)
+@@ -3443,7 +3445,7 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac)
+ trace_ext4_mb_new_inode_pa(ac, pa);
+
+ ext4_mb_use_inode_pa(ac, pa);
+- atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
++ atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
+
+ ei = EXT4_I(ac->ac_inode);
+ grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
+@@ -3503,7 +3505,7 @@ ext4_mb_new_group_pa(struct ext4_allocation_context *ac)
+ trace_ext4_mb_new_group_pa(ac, pa);
+
+ ext4_mb_use_group_pa(ac, pa);
+- atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
++ atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
+
+ grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
+ lg = ac->ac_lg;
+@@ -3607,7 +3609,7 @@ ext4_mb_release_inode_pa(struct ext4_buddy *e4b, struct buffer_head *bitmap_bh,
+ * from the bitmap and continue.
+ */
+ }
+- atomic_add(free, &sbi->s_mb_discarded);
++ atomic_add_unchecked(free, &sbi->s_mb_discarded);
+
+ return err;
+ }
+@@ -3626,7 +3628,7 @@ ext4_mb_release_group_pa(struct ext4_buddy *e4b,
+ ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit);
+ BUG_ON(group != e4b->bd_group && pa->pa_len != 0);
+ mb_free_blocks(pa->pa_inode, e4b, bit, pa->pa_len);
+- atomic_add(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
++ atomic_add_unchecked(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
+
+ if (ac) {
+ ac->ac_sb = sb;
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index f1e7077..edd86b2 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -2286,7 +2286,7 @@ static void ext4_sb_release(struct kobject *kobj)
+ }
+
+
+-static struct sysfs_ops ext4_attr_ops = {
++static const struct sysfs_ops ext4_attr_ops = {
+ .show = ext4_attr_show,
+ .store = ext4_attr_store,
+ };
+diff --git a/fs/fcntl.c b/fs/fcntl.c
+index 97e01dc..e9aab2d 100644
+--- a/fs/fcntl.c
++++ b/fs/fcntl.c
+@@ -223,6 +223,11 @@ int __f_setown(struct file *filp, struct pid *pid, enum pid_type type,
+ if (err)
+ return err;
+
++ if (gr_handle_chroot_fowner(pid, type))
++ return -ENOENT;
++ if (gr_check_protected_task_fowner(pid, type))
++ return -EACCES;
++
+ f_modown(filp, pid, type, force);
+ return 0;
+ }
+@@ -265,7 +270,7 @@ pid_t f_getown(struct file *filp)
+
+ static int f_setown_ex(struct file *filp, unsigned long arg)
+ {
+- struct f_owner_ex * __user owner_p = (void * __user)arg;
++ struct f_owner_ex __user *owner_p = (void __user *)arg;
+ struct f_owner_ex owner;
+ struct pid *pid;
+ int type;
+@@ -305,7 +310,7 @@ static int f_setown_ex(struct file *filp, unsigned long arg)
+
+ static int f_getown_ex(struct file *filp, unsigned long arg)
+ {
+- struct f_owner_ex * __user owner_p = (void * __user)arg;
++ struct f_owner_ex __user *owner_p = (void __user *)arg;
+ struct f_owner_ex owner;
+ int ret = 0;
+
+@@ -344,6 +349,7 @@ static long do_fcntl(int fd, unsigned int cmd, unsigned long arg,
+ switch (cmd) {
+ case F_DUPFD:
+ case F_DUPFD_CLOEXEC:
++ gr_learn_resource(current, RLIMIT_NOFILE, arg, 0);
+ if (arg >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
+ break;
+ err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
+diff --git a/fs/fifo.c b/fs/fifo.c
+index f8f97b8..b1f2259 100644
+--- a/fs/fifo.c
++++ b/fs/fifo.c
+@@ -59,10 +59,10 @@ static int fifo_open(struct inode *inode, struct file *filp)
+ */
+ filp->f_op = &read_pipefifo_fops;
+ pipe->r_counter++;
+- if (pipe->readers++ == 0)
++ if (atomic_inc_return(&pipe->readers) == 1)
+ wake_up_partner(inode);
+
+- if (!pipe->writers) {
++ if (!atomic_read(&pipe->writers)) {
+ if ((filp->f_flags & O_NONBLOCK)) {
+ /* suppress POLLHUP until we have
+ * seen a writer */
+@@ -83,15 +83,15 @@ static int fifo_open(struct inode *inode, struct file *filp)
+ * errno=ENXIO when there is no process reading the FIFO.
+ */
+ ret = -ENXIO;
+- if ((filp->f_flags & O_NONBLOCK) && !pipe->readers)
++ if ((filp->f_flags & O_NONBLOCK) && !atomic_read(&pipe->readers))
+ goto err;
+
+ filp->f_op = &write_pipefifo_fops;
+ pipe->w_counter++;
+- if (!pipe->writers++)
++ if (atomic_inc_return(&pipe->writers) == 1)
+ wake_up_partner(inode);
+
+- if (!pipe->readers) {
++ if (!atomic_read(&pipe->readers)) {
+ wait_for_partner(inode, &pipe->r_counter);
+ if (signal_pending(current))
+ goto err_wr;
+@@ -107,11 +107,11 @@ static int fifo_open(struct inode *inode, struct file *filp)
+ */
+ filp->f_op = &rdwr_pipefifo_fops;
+
+- pipe->readers++;
+- pipe->writers++;
++ atomic_inc(&pipe->readers);
++ atomic_inc(&pipe->writers);
+ pipe->r_counter++;
+ pipe->w_counter++;
+- if (pipe->readers == 1 || pipe->writers == 1)
++ if (atomic_read(&pipe->readers) == 1 || atomic_read(&pipe->writers) == 1)
+ wake_up_partner(inode);
+ break;
+
+@@ -125,19 +125,19 @@ static int fifo_open(struct inode *inode, struct file *filp)
+ return 0;
+
+ err_rd:
+- if (!--pipe->readers)
++ if (atomic_dec_and_test(&pipe->readers))
+ wake_up_interruptible(&pipe->wait);
+ ret = -ERESTARTSYS;
+ goto err;
+
+ err_wr:
+- if (!--pipe->writers)
++ if (atomic_dec_and_test(&pipe->writers))
+ wake_up_interruptible(&pipe->wait);
+ ret = -ERESTARTSYS;
+ goto err;
+
+ err:
+- if (!pipe->readers && !pipe->writers)
++ if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers))
+ free_pipe_info(inode);
+
+ err_nocleanup:
+diff --git a/fs/file.c b/fs/file.c
+index 87e1290..a930cc4 100644
+--- a/fs/file.c
++++ b/fs/file.c
+@@ -14,6 +14,7 @@
+ #include <linux/slab.h>
+ #include <linux/vmalloc.h>
+ #include <linux/file.h>
++#include <linux/security.h>
+ #include <linux/fdtable.h>
+ #include <linux/bitops.h>
+ #include <linux/interrupt.h>
+@@ -257,6 +258,8 @@ int expand_files(struct files_struct *files, int nr)
+ * N.B. For clone tasks sharing a files structure, this test
+ * will limit the total number of files that can be opened.
+ */
++
++ gr_learn_resource(current, RLIMIT_NOFILE, nr, 0);
+ if (nr >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
+ return -EMFILE;
+
+diff --git a/fs/filesystems.c b/fs/filesystems.c
+index a24c58e..53f91ee 100644
+--- a/fs/filesystems.c
++++ b/fs/filesystems.c
+@@ -272,7 +272,12 @@ struct file_system_type *get_fs_type(const char *name)
+ int len = dot ? dot - name : strlen(name);
+
+ fs = __get_fs_type(name, len);
++
++#ifdef CONFIG_GRKERNSEC_MODHARDEN
++ if (!fs && (___request_module(true, "grsec_modharden_fs", "%.*s", len, name) == 0))
++#else
+ if (!fs && (request_module("%.*s", len, name) == 0))
++#endif
+ fs = __get_fs_type(name, len);
+
+ if (dot && fs && !(fs->fs_flags & FS_HAS_SUBTYPE)) {
+diff --git a/fs/fs_struct.c b/fs/fs_struct.c
+index eee0590..1181166 100644
+--- a/fs/fs_struct.c
++++ b/fs/fs_struct.c
+@@ -4,6 +4,7 @@
+ #include <linux/path.h>
+ #include <linux/slab.h>
+ #include <linux/fs_struct.h>
++#include <linux/grsecurity.h>
+
+ /*
+ * Replace the fs->{rootmnt,root} with {mnt,dentry}. Put the old values.
+@@ -17,6 +18,7 @@ void set_fs_root(struct fs_struct *fs, struct path *path)
+ old_root = fs->root;
+ fs->root = *path;
+ path_get(path);
++ gr_set_chroot_entries(current, path);
+ write_unlock(&fs->lock);
+ if (old_root.dentry)
+ path_put(&old_root);
+@@ -56,6 +58,7 @@ void chroot_fs_refs(struct path *old_root, struct path *new_root)
+ && fs->root.mnt == old_root->mnt) {
+ path_get(new_root);
+ fs->root = *new_root;
++ gr_set_chroot_entries(p, new_root);
+ count++;
+ }
+ if (fs->pwd.dentry == old_root->dentry
+@@ -89,7 +92,8 @@ void exit_fs(struct task_struct *tsk)
+ task_lock(tsk);
+ write_lock(&fs->lock);
+ tsk->fs = NULL;
+- kill = !--fs->users;
++ gr_clear_chroot_entries(tsk);
++ kill = !atomic_dec_return(&fs->users);
+ write_unlock(&fs->lock);
+ task_unlock(tsk);
+ if (kill)
+@@ -102,7 +106,7 @@ struct fs_struct *copy_fs_struct(struct fs_struct *old)
+ struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL);
+ /* We don't need to lock fs - think why ;-) */
+ if (fs) {
+- fs->users = 1;
++ atomic_set(&fs->users, 1);
+ fs->in_exec = 0;
+ rwlock_init(&fs->lock);
+ fs->umask = old->umask;
+@@ -127,8 +131,9 @@ int unshare_fs_struct(void)
+
+ task_lock(current);
+ write_lock(&fs->lock);
+- kill = !--fs->users;
++ kill = !atomic_dec_return(&fs->users);
+ current->fs = new_fs;
++ gr_set_chroot_entries(current, &new_fs->root);
+ write_unlock(&fs->lock);
+ task_unlock(current);
+
+@@ -141,13 +146,13 @@ EXPORT_SYMBOL_GPL(unshare_fs_struct);
+
+ int current_umask(void)
+ {
+- return current->fs->umask;
++ return current->fs->umask | gr_acl_umask();
+ }
+ EXPORT_SYMBOL(current_umask);
+
+ /* to be mentioned only in INIT_TASK */
+ struct fs_struct init_fs = {
+- .users = 1,
++ .users = ATOMIC_INIT(1),
+ .lock = __RW_LOCK_UNLOCKED(init_fs.lock),
+ .umask = 0022,
+ };
+@@ -162,12 +167,13 @@ void daemonize_fs_struct(void)
+ task_lock(current);
+
+ write_lock(&init_fs.lock);
+- init_fs.users++;
++ atomic_inc(&init_fs.users);
+ write_unlock(&init_fs.lock);
+
+ write_lock(&fs->lock);
+ current->fs = &init_fs;
+- kill = !--fs->users;
++ gr_set_chroot_entries(current, ¤t->fs->root);
++ kill = !atomic_dec_return(&fs->users);
+ write_unlock(&fs->lock);
+
+ task_unlock(current);
+diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c
+index 9905350..02eaec4 100644
+--- a/fs/fscache/cookie.c
++++ b/fs/fscache/cookie.c
+@@ -68,11 +68,11 @@ struct fscache_cookie *__fscache_acquire_cookie(
+ parent ? (char *) parent->def->name : "<no-parent>",
+ def->name, netfs_data);
+
+- fscache_stat(&fscache_n_acquires);
++ fscache_stat_unchecked(&fscache_n_acquires);
+
+ /* if there's no parent cookie, then we don't create one here either */
+ if (!parent) {
+- fscache_stat(&fscache_n_acquires_null);
++ fscache_stat_unchecked(&fscache_n_acquires_null);
+ _leave(" [no parent]");
+ return NULL;
+ }
+@@ -87,7 +87,7 @@ struct fscache_cookie *__fscache_acquire_cookie(
+ /* allocate and initialise a cookie */
+ cookie = kmem_cache_alloc(fscache_cookie_jar, GFP_KERNEL);
+ if (!cookie) {
+- fscache_stat(&fscache_n_acquires_oom);
++ fscache_stat_unchecked(&fscache_n_acquires_oom);
+ _leave(" [ENOMEM]");
+ return NULL;
+ }
+@@ -109,13 +109,13 @@ struct fscache_cookie *__fscache_acquire_cookie(
+
+ switch (cookie->def->type) {
+ case FSCACHE_COOKIE_TYPE_INDEX:
+- fscache_stat(&fscache_n_cookie_index);
++ fscache_stat_unchecked(&fscache_n_cookie_index);
+ break;
+ case FSCACHE_COOKIE_TYPE_DATAFILE:
+- fscache_stat(&fscache_n_cookie_data);
++ fscache_stat_unchecked(&fscache_n_cookie_data);
+ break;
+ default:
+- fscache_stat(&fscache_n_cookie_special);
++ fscache_stat_unchecked(&fscache_n_cookie_special);
+ break;
+ }
+
+@@ -126,13 +126,13 @@ struct fscache_cookie *__fscache_acquire_cookie(
+ if (fscache_acquire_non_index_cookie(cookie) < 0) {
+ atomic_dec(&parent->n_children);
+ __fscache_cookie_put(cookie);
+- fscache_stat(&fscache_n_acquires_nobufs);
++ fscache_stat_unchecked(&fscache_n_acquires_nobufs);
+ _leave(" = NULL");
+ return NULL;
+ }
+ }
+
+- fscache_stat(&fscache_n_acquires_ok);
++ fscache_stat_unchecked(&fscache_n_acquires_ok);
+ _leave(" = %p", cookie);
+ return cookie;
+ }
+@@ -168,7 +168,7 @@ static int fscache_acquire_non_index_cookie(struct fscache_cookie *cookie)
+ cache = fscache_select_cache_for_object(cookie->parent);
+ if (!cache) {
+ up_read(&fscache_addremove_sem);
+- fscache_stat(&fscache_n_acquires_no_cache);
++ fscache_stat_unchecked(&fscache_n_acquires_no_cache);
+ _leave(" = -ENOMEDIUM [no cache]");
+ return -ENOMEDIUM;
+ }
+@@ -256,12 +256,12 @@ static int fscache_alloc_object(struct fscache_cache *cache,
+ object = cache->ops->alloc_object(cache, cookie);
+ fscache_stat_d(&fscache_n_cop_alloc_object);
+ if (IS_ERR(object)) {
+- fscache_stat(&fscache_n_object_no_alloc);
++ fscache_stat_unchecked(&fscache_n_object_no_alloc);
+ ret = PTR_ERR(object);
+ goto error;
+ }
+
+- fscache_stat(&fscache_n_object_alloc);
++ fscache_stat_unchecked(&fscache_n_object_alloc);
+
+ object->debug_id = atomic_inc_return(&fscache_object_debug_id);
+
+@@ -377,10 +377,10 @@ void __fscache_update_cookie(struct fscache_cookie *cookie)
+ struct fscache_object *object;
+ struct hlist_node *_p;
+
+- fscache_stat(&fscache_n_updates);
++ fscache_stat_unchecked(&fscache_n_updates);
+
+ if (!cookie) {
+- fscache_stat(&fscache_n_updates_null);
++ fscache_stat_unchecked(&fscache_n_updates_null);
+ _leave(" [no cookie]");
+ return;
+ }
+@@ -414,12 +414,12 @@ void __fscache_relinquish_cookie(struct fscache_cookie *cookie, int retire)
+ struct fscache_object *object;
+ unsigned long event;
+
+- fscache_stat(&fscache_n_relinquishes);
++ fscache_stat_unchecked(&fscache_n_relinquishes);
+ if (retire)
+- fscache_stat(&fscache_n_relinquishes_retire);
++ fscache_stat_unchecked(&fscache_n_relinquishes_retire);
+
+ if (!cookie) {
+- fscache_stat(&fscache_n_relinquishes_null);
++ fscache_stat_unchecked(&fscache_n_relinquishes_null);
+ _leave(" [no cookie]");
+ return;
+ }
+@@ -435,7 +435,7 @@ void __fscache_relinquish_cookie(struct fscache_cookie *cookie, int retire)
+
+ /* wait for the cookie to finish being instantiated (or to fail) */
+ if (test_bit(FSCACHE_COOKIE_CREATING, &cookie->flags)) {
+- fscache_stat(&fscache_n_relinquishes_waitcrt);
++ fscache_stat_unchecked(&fscache_n_relinquishes_waitcrt);
+ wait_on_bit(&cookie->flags, FSCACHE_COOKIE_CREATING,
+ fscache_wait_bit, TASK_UNINTERRUPTIBLE);
+ }
+diff --git a/fs/fscache/internal.h b/fs/fscache/internal.h
+index edd7434..0725e66 100644
+--- a/fs/fscache/internal.h
++++ b/fs/fscache/internal.h
+@@ -136,94 +136,94 @@ extern void fscache_proc_cleanup(void);
+ extern atomic_t fscache_n_ops_processed[FSCACHE_MAX_THREADS];
+ extern atomic_t fscache_n_objs_processed[FSCACHE_MAX_THREADS];
+
+-extern atomic_t fscache_n_op_pend;
+-extern atomic_t fscache_n_op_run;
+-extern atomic_t fscache_n_op_enqueue;
+-extern atomic_t fscache_n_op_deferred_release;
+-extern atomic_t fscache_n_op_release;
+-extern atomic_t fscache_n_op_gc;
+-extern atomic_t fscache_n_op_cancelled;
+-extern atomic_t fscache_n_op_rejected;
++extern atomic_unchecked_t fscache_n_op_pend;
++extern atomic_unchecked_t fscache_n_op_run;
++extern atomic_unchecked_t fscache_n_op_enqueue;
++extern atomic_unchecked_t fscache_n_op_deferred_release;
++extern atomic_unchecked_t fscache_n_op_release;
++extern atomic_unchecked_t fscache_n_op_gc;
++extern atomic_unchecked_t fscache_n_op_cancelled;
++extern atomic_unchecked_t fscache_n_op_rejected;
+
+-extern atomic_t fscache_n_attr_changed;
+-extern atomic_t fscache_n_attr_changed_ok;
+-extern atomic_t fscache_n_attr_changed_nobufs;
+-extern atomic_t fscache_n_attr_changed_nomem;
+-extern atomic_t fscache_n_attr_changed_calls;
++extern atomic_unchecked_t fscache_n_attr_changed;
++extern atomic_unchecked_t fscache_n_attr_changed_ok;
++extern atomic_unchecked_t fscache_n_attr_changed_nobufs;
++extern atomic_unchecked_t fscache_n_attr_changed_nomem;
++extern atomic_unchecked_t fscache_n_attr_changed_calls;
+
+-extern atomic_t fscache_n_allocs;
+-extern atomic_t fscache_n_allocs_ok;
+-extern atomic_t fscache_n_allocs_wait;
+-extern atomic_t fscache_n_allocs_nobufs;
+-extern atomic_t fscache_n_allocs_intr;
+-extern atomic_t fscache_n_allocs_object_dead;
+-extern atomic_t fscache_n_alloc_ops;
+-extern atomic_t fscache_n_alloc_op_waits;
++extern atomic_unchecked_t fscache_n_allocs;
++extern atomic_unchecked_t fscache_n_allocs_ok;
++extern atomic_unchecked_t fscache_n_allocs_wait;
++extern atomic_unchecked_t fscache_n_allocs_nobufs;
++extern atomic_unchecked_t fscache_n_allocs_intr;
++extern atomic_unchecked_t fscache_n_allocs_object_dead;
++extern atomic_unchecked_t fscache_n_alloc_ops;
++extern atomic_unchecked_t fscache_n_alloc_op_waits;
+
+-extern atomic_t fscache_n_retrievals;
+-extern atomic_t fscache_n_retrievals_ok;
+-extern atomic_t fscache_n_retrievals_wait;
+-extern atomic_t fscache_n_retrievals_nodata;
+-extern atomic_t fscache_n_retrievals_nobufs;
+-extern atomic_t fscache_n_retrievals_intr;
+-extern atomic_t fscache_n_retrievals_nomem;
+-extern atomic_t fscache_n_retrievals_object_dead;
+-extern atomic_t fscache_n_retrieval_ops;
+-extern atomic_t fscache_n_retrieval_op_waits;
++extern atomic_unchecked_t fscache_n_retrievals;
++extern atomic_unchecked_t fscache_n_retrievals_ok;
++extern atomic_unchecked_t fscache_n_retrievals_wait;
++extern atomic_unchecked_t fscache_n_retrievals_nodata;
++extern atomic_unchecked_t fscache_n_retrievals_nobufs;
++extern atomic_unchecked_t fscache_n_retrievals_intr;
++extern atomic_unchecked_t fscache_n_retrievals_nomem;
++extern atomic_unchecked_t fscache_n_retrievals_object_dead;
++extern atomic_unchecked_t fscache_n_retrieval_ops;
++extern atomic_unchecked_t fscache_n_retrieval_op_waits;
+
+-extern atomic_t fscache_n_stores;
+-extern atomic_t fscache_n_stores_ok;
+-extern atomic_t fscache_n_stores_again;
+-extern atomic_t fscache_n_stores_nobufs;
+-extern atomic_t fscache_n_stores_oom;
+-extern atomic_t fscache_n_store_ops;
+-extern atomic_t fscache_n_store_calls;
+-extern atomic_t fscache_n_store_pages;
+-extern atomic_t fscache_n_store_radix_deletes;
+-extern atomic_t fscache_n_store_pages_over_limit;
++extern atomic_unchecked_t fscache_n_stores;
++extern atomic_unchecked_t fscache_n_stores_ok;
++extern atomic_unchecked_t fscache_n_stores_again;
++extern atomic_unchecked_t fscache_n_stores_nobufs;
++extern atomic_unchecked_t fscache_n_stores_oom;
++extern atomic_unchecked_t fscache_n_store_ops;
++extern atomic_unchecked_t fscache_n_store_calls;
++extern atomic_unchecked_t fscache_n_store_pages;
++extern atomic_unchecked_t fscache_n_store_radix_deletes;
++extern atomic_unchecked_t fscache_n_store_pages_over_limit;
+
+-extern atomic_t fscache_n_store_vmscan_not_storing;
+-extern atomic_t fscache_n_store_vmscan_gone;
+-extern atomic_t fscache_n_store_vmscan_busy;
+-extern atomic_t fscache_n_store_vmscan_cancelled;
++extern atomic_unchecked_t fscache_n_store_vmscan_not_storing;
++extern atomic_unchecked_t fscache_n_store_vmscan_gone;
++extern atomic_unchecked_t fscache_n_store_vmscan_busy;
++extern atomic_unchecked_t fscache_n_store_vmscan_cancelled;
+
+-extern atomic_t fscache_n_marks;
+-extern atomic_t fscache_n_uncaches;
++extern atomic_unchecked_t fscache_n_marks;
++extern atomic_unchecked_t fscache_n_uncaches;
+
+-extern atomic_t fscache_n_acquires;
+-extern atomic_t fscache_n_acquires_null;
+-extern atomic_t fscache_n_acquires_no_cache;
+-extern atomic_t fscache_n_acquires_ok;
+-extern atomic_t fscache_n_acquires_nobufs;
+-extern atomic_t fscache_n_acquires_oom;
++extern atomic_unchecked_t fscache_n_acquires;
++extern atomic_unchecked_t fscache_n_acquires_null;
++extern atomic_unchecked_t fscache_n_acquires_no_cache;
++extern atomic_unchecked_t fscache_n_acquires_ok;
++extern atomic_unchecked_t fscache_n_acquires_nobufs;
++extern atomic_unchecked_t fscache_n_acquires_oom;
+
+-extern atomic_t fscache_n_updates;
+-extern atomic_t fscache_n_updates_null;
+-extern atomic_t fscache_n_updates_run;
++extern atomic_unchecked_t fscache_n_updates;
++extern atomic_unchecked_t fscache_n_updates_null;
++extern atomic_unchecked_t fscache_n_updates_run;
+
+-extern atomic_t fscache_n_relinquishes;
+-extern atomic_t fscache_n_relinquishes_null;
+-extern atomic_t fscache_n_relinquishes_waitcrt;
+-extern atomic_t fscache_n_relinquishes_retire;
++extern atomic_unchecked_t fscache_n_relinquishes;
++extern atomic_unchecked_t fscache_n_relinquishes_null;
++extern atomic_unchecked_t fscache_n_relinquishes_waitcrt;
++extern atomic_unchecked_t fscache_n_relinquishes_retire;
+
+-extern atomic_t fscache_n_cookie_index;
+-extern atomic_t fscache_n_cookie_data;
+-extern atomic_t fscache_n_cookie_special;
++extern atomic_unchecked_t fscache_n_cookie_index;
++extern atomic_unchecked_t fscache_n_cookie_data;
++extern atomic_unchecked_t fscache_n_cookie_special;
+
+-extern atomic_t fscache_n_object_alloc;
+-extern atomic_t fscache_n_object_no_alloc;
+-extern atomic_t fscache_n_object_lookups;
+-extern atomic_t fscache_n_object_lookups_negative;
+-extern atomic_t fscache_n_object_lookups_positive;
+-extern atomic_t fscache_n_object_lookups_timed_out;
+-extern atomic_t fscache_n_object_created;
+-extern atomic_t fscache_n_object_avail;
+-extern atomic_t fscache_n_object_dead;
++extern atomic_unchecked_t fscache_n_object_alloc;
++extern atomic_unchecked_t fscache_n_object_no_alloc;
++extern atomic_unchecked_t fscache_n_object_lookups;
++extern atomic_unchecked_t fscache_n_object_lookups_negative;
++extern atomic_unchecked_t fscache_n_object_lookups_positive;
++extern atomic_unchecked_t fscache_n_object_lookups_timed_out;
++extern atomic_unchecked_t fscache_n_object_created;
++extern atomic_unchecked_t fscache_n_object_avail;
++extern atomic_unchecked_t fscache_n_object_dead;
+
+-extern atomic_t fscache_n_checkaux_none;
+-extern atomic_t fscache_n_checkaux_okay;
+-extern atomic_t fscache_n_checkaux_update;
+-extern atomic_t fscache_n_checkaux_obsolete;
++extern atomic_unchecked_t fscache_n_checkaux_none;
++extern atomic_unchecked_t fscache_n_checkaux_okay;
++extern atomic_unchecked_t fscache_n_checkaux_update;
++extern atomic_unchecked_t fscache_n_checkaux_obsolete;
+
+ extern atomic_t fscache_n_cop_alloc_object;
+ extern atomic_t fscache_n_cop_lookup_object;
+@@ -247,6 +247,11 @@ static inline void fscache_stat(atomic_t *stat)
+ atomic_inc(stat);
+ }
+
++static inline void fscache_stat_unchecked(atomic_unchecked_t *stat)
++{
++ atomic_inc_unchecked(stat);
++}
++
+ static inline void fscache_stat_d(atomic_t *stat)
+ {
+ atomic_dec(stat);
+@@ -259,6 +264,7 @@ extern const struct file_operations fscache_stats_fops;
+
+ #define __fscache_stat(stat) (NULL)
+ #define fscache_stat(stat) do {} while (0)
++#define fscache_stat_unchecked(stat) do {} while (0)
+ #define fscache_stat_d(stat) do {} while (0)
+ #endif
+
+diff --git a/fs/fscache/object.c b/fs/fscache/object.c
+index e513ac5..e888d34 100644
+--- a/fs/fscache/object.c
++++ b/fs/fscache/object.c
+@@ -144,7 +144,7 @@ static void fscache_object_state_machine(struct fscache_object *object)
+ /* update the object metadata on disk */
+ case FSCACHE_OBJECT_UPDATING:
+ clear_bit(FSCACHE_OBJECT_EV_UPDATE, &object->events);
+- fscache_stat(&fscache_n_updates_run);
++ fscache_stat_unchecked(&fscache_n_updates_run);
+ fscache_stat(&fscache_n_cop_update_object);
+ object->cache->ops->update_object(object);
+ fscache_stat_d(&fscache_n_cop_update_object);
+@@ -233,7 +233,7 @@ static void fscache_object_state_machine(struct fscache_object *object)
+ spin_lock(&object->lock);
+ object->state = FSCACHE_OBJECT_DEAD;
+ spin_unlock(&object->lock);
+- fscache_stat(&fscache_n_object_dead);
++ fscache_stat_unchecked(&fscache_n_object_dead);
+ goto terminal_transit;
+
+ /* handle the parent cache of this object being withdrawn from
+@@ -248,7 +248,7 @@ static void fscache_object_state_machine(struct fscache_object *object)
+ spin_lock(&object->lock);
+ object->state = FSCACHE_OBJECT_DEAD;
+ spin_unlock(&object->lock);
+- fscache_stat(&fscache_n_object_dead);
++ fscache_stat_unchecked(&fscache_n_object_dead);
+ goto terminal_transit;
+
+ /* complain about the object being woken up once it is
+@@ -492,7 +492,7 @@ static void fscache_lookup_object(struct fscache_object *object)
+ parent->cookie->def->name, cookie->def->name,
+ object->cache->tag->name);
+
+- fscache_stat(&fscache_n_object_lookups);
++ fscache_stat_unchecked(&fscache_n_object_lookups);
+ fscache_stat(&fscache_n_cop_lookup_object);
+ ret = object->cache->ops->lookup_object(object);
+ fscache_stat_d(&fscache_n_cop_lookup_object);
+@@ -503,7 +503,7 @@ static void fscache_lookup_object(struct fscache_object *object)
+ if (ret == -ETIMEDOUT) {
+ /* probably stuck behind another object, so move this one to
+ * the back of the queue */
+- fscache_stat(&fscache_n_object_lookups_timed_out);
++ fscache_stat_unchecked(&fscache_n_object_lookups_timed_out);
+ set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
+ }
+
+@@ -526,7 +526,7 @@ void fscache_object_lookup_negative(struct fscache_object *object)
+
+ spin_lock(&object->lock);
+ if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
+- fscache_stat(&fscache_n_object_lookups_negative);
++ fscache_stat_unchecked(&fscache_n_object_lookups_negative);
+
+ /* transit here to allow write requests to begin stacking up
+ * and read requests to begin returning ENODATA */
+@@ -572,7 +572,7 @@ void fscache_obtained_object(struct fscache_object *object)
+ * result, in which case there may be data available */
+ spin_lock(&object->lock);
+ if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
+- fscache_stat(&fscache_n_object_lookups_positive);
++ fscache_stat_unchecked(&fscache_n_object_lookups_positive);
+
+ clear_bit(FSCACHE_COOKIE_NO_DATA_YET, &cookie->flags);
+
+@@ -586,7 +586,7 @@ void fscache_obtained_object(struct fscache_object *object)
+ set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
+ } else {
+ ASSERTCMP(object->state, ==, FSCACHE_OBJECT_CREATING);
+- fscache_stat(&fscache_n_object_created);
++ fscache_stat_unchecked(&fscache_n_object_created);
+
+ object->state = FSCACHE_OBJECT_AVAILABLE;
+ spin_unlock(&object->lock);
+@@ -633,7 +633,7 @@ static void fscache_object_available(struct fscache_object *object)
+ fscache_enqueue_dependents(object);
+
+ fscache_hist(fscache_obj_instantiate_histogram, object->lookup_jif);
+- fscache_stat(&fscache_n_object_avail);
++ fscache_stat_unchecked(&fscache_n_object_avail);
+
+ _leave("");
+ }
+@@ -861,7 +861,7 @@ enum fscache_checkaux fscache_check_aux(struct fscache_object *object,
+ enum fscache_checkaux result;
+
+ if (!object->cookie->def->check_aux) {
+- fscache_stat(&fscache_n_checkaux_none);
++ fscache_stat_unchecked(&fscache_n_checkaux_none);
+ return FSCACHE_CHECKAUX_OKAY;
+ }
+
+@@ -870,17 +870,17 @@ enum fscache_checkaux fscache_check_aux(struct fscache_object *object,
+ switch (result) {
+ /* entry okay as is */
+ case FSCACHE_CHECKAUX_OKAY:
+- fscache_stat(&fscache_n_checkaux_okay);
++ fscache_stat_unchecked(&fscache_n_checkaux_okay);
+ break;
+
+ /* entry requires update */
+ case FSCACHE_CHECKAUX_NEEDS_UPDATE:
+- fscache_stat(&fscache_n_checkaux_update);
++ fscache_stat_unchecked(&fscache_n_checkaux_update);
+ break;
+
+ /* entry requires deletion */
+ case FSCACHE_CHECKAUX_OBSOLETE:
+- fscache_stat(&fscache_n_checkaux_obsolete);
++ fscache_stat_unchecked(&fscache_n_checkaux_obsolete);
+ break;
+
+ default:
+diff --git a/fs/fscache/operation.c b/fs/fscache/operation.c
+index 313e79a..775240f 100644
+--- a/fs/fscache/operation.c
++++ b/fs/fscache/operation.c
+@@ -16,7 +16,7 @@
+ #include <linux/seq_file.h>
+ #include "internal.h"
+
+-atomic_t fscache_op_debug_id;
++atomic_unchecked_t fscache_op_debug_id;
+ EXPORT_SYMBOL(fscache_op_debug_id);
+
+ /**
+@@ -39,7 +39,7 @@ void fscache_enqueue_operation(struct fscache_operation *op)
+ ASSERTCMP(op->object->state, >=, FSCACHE_OBJECT_AVAILABLE);
+ ASSERTCMP(atomic_read(&op->usage), >, 0);
+
+- fscache_stat(&fscache_n_op_enqueue);
++ fscache_stat_unchecked(&fscache_n_op_enqueue);
+ switch (op->flags & FSCACHE_OP_TYPE) {
+ case FSCACHE_OP_FAST:
+ _debug("queue fast");
+@@ -76,7 +76,7 @@ static void fscache_run_op(struct fscache_object *object,
+ wake_up_bit(&op->flags, FSCACHE_OP_WAITING);
+ if (op->processor)
+ fscache_enqueue_operation(op);
+- fscache_stat(&fscache_n_op_run);
++ fscache_stat_unchecked(&fscache_n_op_run);
+ }
+
+ /*
+@@ -107,11 +107,11 @@ int fscache_submit_exclusive_op(struct fscache_object *object,
+ if (object->n_ops > 0) {
+ atomic_inc(&op->usage);
+ list_add_tail(&op->pend_link, &object->pending_ops);
+- fscache_stat(&fscache_n_op_pend);
++ fscache_stat_unchecked(&fscache_n_op_pend);
+ } else if (!list_empty(&object->pending_ops)) {
+ atomic_inc(&op->usage);
+ list_add_tail(&op->pend_link, &object->pending_ops);
+- fscache_stat(&fscache_n_op_pend);
++ fscache_stat_unchecked(&fscache_n_op_pend);
+ fscache_start_operations(object);
+ } else {
+ ASSERTCMP(object->n_in_progress, ==, 0);
+@@ -127,7 +127,7 @@ int fscache_submit_exclusive_op(struct fscache_object *object,
+ object->n_exclusive++; /* reads and writes must wait */
+ atomic_inc(&op->usage);
+ list_add_tail(&op->pend_link, &object->pending_ops);
+- fscache_stat(&fscache_n_op_pend);
++ fscache_stat_unchecked(&fscache_n_op_pend);
+ ret = 0;
+ } else {
+ /* not allowed to submit ops in any other state */
+@@ -214,11 +214,11 @@ int fscache_submit_op(struct fscache_object *object,
+ if (object->n_exclusive > 0) {
+ atomic_inc(&op->usage);
+ list_add_tail(&op->pend_link, &object->pending_ops);
+- fscache_stat(&fscache_n_op_pend);
++ fscache_stat_unchecked(&fscache_n_op_pend);
+ } else if (!list_empty(&object->pending_ops)) {
+ atomic_inc(&op->usage);
+ list_add_tail(&op->pend_link, &object->pending_ops);
+- fscache_stat(&fscache_n_op_pend);
++ fscache_stat_unchecked(&fscache_n_op_pend);
+ fscache_start_operations(object);
+ } else {
+ ASSERTCMP(object->n_exclusive, ==, 0);
+@@ -230,12 +230,12 @@ int fscache_submit_op(struct fscache_object *object,
+ object->n_ops++;
+ atomic_inc(&op->usage);
+ list_add_tail(&op->pend_link, &object->pending_ops);
+- fscache_stat(&fscache_n_op_pend);
++ fscache_stat_unchecked(&fscache_n_op_pend);
+ ret = 0;
+ } else if (object->state == FSCACHE_OBJECT_DYING ||
+ object->state == FSCACHE_OBJECT_LC_DYING ||
+ object->state == FSCACHE_OBJECT_WITHDRAWING) {
+- fscache_stat(&fscache_n_op_rejected);
++ fscache_stat_unchecked(&fscache_n_op_rejected);
+ ret = -ENOBUFS;
+ } else if (!test_bit(FSCACHE_IOERROR, &object->cache->flags)) {
+ fscache_report_unexpected_submission(object, op, ostate);
+@@ -305,7 +305,7 @@ int fscache_cancel_op(struct fscache_operation *op)
+
+ ret = -EBUSY;
+ if (!list_empty(&op->pend_link)) {
+- fscache_stat(&fscache_n_op_cancelled);
++ fscache_stat_unchecked(&fscache_n_op_cancelled);
+ list_del_init(&op->pend_link);
+ object->n_ops--;
+ if (test_bit(FSCACHE_OP_EXCLUSIVE, &op->flags))
+@@ -344,7 +344,7 @@ void fscache_put_operation(struct fscache_operation *op)
+ if (test_and_set_bit(FSCACHE_OP_DEAD, &op->flags))
+ BUG();
+
+- fscache_stat(&fscache_n_op_release);
++ fscache_stat_unchecked(&fscache_n_op_release);
+
+ if (op->release) {
+ op->release(op);
+@@ -361,7 +361,7 @@ void fscache_put_operation(struct fscache_operation *op)
+ * lock, and defer it otherwise */
+ if (!spin_trylock(&object->lock)) {
+ _debug("defer put");
+- fscache_stat(&fscache_n_op_deferred_release);
++ fscache_stat_unchecked(&fscache_n_op_deferred_release);
+
+ cache = object->cache;
+ spin_lock(&cache->op_gc_list_lock);
+@@ -423,7 +423,7 @@ void fscache_operation_gc(struct work_struct *work)
+
+ _debug("GC DEFERRED REL OBJ%x OP%x",
+ object->debug_id, op->debug_id);
+- fscache_stat(&fscache_n_op_gc);
++ fscache_stat_unchecked(&fscache_n_op_gc);
+
+ ASSERTCMP(atomic_read(&op->usage), ==, 0);
+
+diff --git a/fs/fscache/page.c b/fs/fscache/page.c
+index c598ea4..6aac13e 100644
+--- a/fs/fscache/page.c
++++ b/fs/fscache/page.c
+@@ -59,7 +59,7 @@ bool __fscache_maybe_release_page(struct fscache_cookie *cookie,
+ val = radix_tree_lookup(&cookie->stores, page->index);
+ if (!val) {
+ rcu_read_unlock();
+- fscache_stat(&fscache_n_store_vmscan_not_storing);
++ fscache_stat_unchecked(&fscache_n_store_vmscan_not_storing);
+ __fscache_uncache_page(cookie, page);
+ return true;
+ }
+@@ -89,11 +89,11 @@ bool __fscache_maybe_release_page(struct fscache_cookie *cookie,
+ spin_unlock(&cookie->stores_lock);
+
+ if (xpage) {
+- fscache_stat(&fscache_n_store_vmscan_cancelled);
+- fscache_stat(&fscache_n_store_radix_deletes);
++ fscache_stat_unchecked(&fscache_n_store_vmscan_cancelled);
++ fscache_stat_unchecked(&fscache_n_store_radix_deletes);
+ ASSERTCMP(xpage, ==, page);
+ } else {
+- fscache_stat(&fscache_n_store_vmscan_gone);
++ fscache_stat_unchecked(&fscache_n_store_vmscan_gone);
+ }
+
+ wake_up_bit(&cookie->flags, 0);
+@@ -106,7 +106,7 @@ page_busy:
+ /* we might want to wait here, but that could deadlock the allocator as
+ * the slow-work threads writing to the cache may all end up sleeping
+ * on memory allocation */
+- fscache_stat(&fscache_n_store_vmscan_busy);
++ fscache_stat_unchecked(&fscache_n_store_vmscan_busy);
+ return false;
+ }
+ EXPORT_SYMBOL(__fscache_maybe_release_page);
+@@ -130,7 +130,7 @@ static void fscache_end_page_write(struct fscache_object *object,
+ FSCACHE_COOKIE_STORING_TAG);
+ if (!radix_tree_tag_get(&cookie->stores, page->index,
+ FSCACHE_COOKIE_PENDING_TAG)) {
+- fscache_stat(&fscache_n_store_radix_deletes);
++ fscache_stat_unchecked(&fscache_n_store_radix_deletes);
+ xpage = radix_tree_delete(&cookie->stores, page->index);
+ }
+ spin_unlock(&cookie->stores_lock);
+@@ -151,7 +151,7 @@ static void fscache_attr_changed_op(struct fscache_operation *op)
+
+ _enter("{OBJ%x OP%x}", object->debug_id, op->debug_id);
+
+- fscache_stat(&fscache_n_attr_changed_calls);
++ fscache_stat_unchecked(&fscache_n_attr_changed_calls);
+
+ if (fscache_object_is_active(object)) {
+ fscache_set_op_state(op, "CallFS");
+@@ -178,11 +178,11 @@ int __fscache_attr_changed(struct fscache_cookie *cookie)
+
+ ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
+
+- fscache_stat(&fscache_n_attr_changed);
++ fscache_stat_unchecked(&fscache_n_attr_changed);
+
+ op = kzalloc(sizeof(*op), GFP_KERNEL);
+ if (!op) {
+- fscache_stat(&fscache_n_attr_changed_nomem);
++ fscache_stat_unchecked(&fscache_n_attr_changed_nomem);
+ _leave(" = -ENOMEM");
+ return -ENOMEM;
+ }
+@@ -202,7 +202,7 @@ int __fscache_attr_changed(struct fscache_cookie *cookie)
+ if (fscache_submit_exclusive_op(object, op) < 0)
+ goto nobufs;
+ spin_unlock(&cookie->lock);
+- fscache_stat(&fscache_n_attr_changed_ok);
++ fscache_stat_unchecked(&fscache_n_attr_changed_ok);
+ fscache_put_operation(op);
+ _leave(" = 0");
+ return 0;
+@@ -210,7 +210,7 @@ int __fscache_attr_changed(struct fscache_cookie *cookie)
+ nobufs:
+ spin_unlock(&cookie->lock);
+ kfree(op);
+- fscache_stat(&fscache_n_attr_changed_nobufs);
++ fscache_stat_unchecked(&fscache_n_attr_changed_nobufs);
+ _leave(" = %d", -ENOBUFS);
+ return -ENOBUFS;
+ }
+@@ -264,7 +264,7 @@ static struct fscache_retrieval *fscache_alloc_retrieval(
+ /* allocate a retrieval operation and attempt to submit it */
+ op = kzalloc(sizeof(*op), GFP_NOIO);
+ if (!op) {
+- fscache_stat(&fscache_n_retrievals_nomem);
++ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
+ return NULL;
+ }
+
+@@ -294,13 +294,13 @@ static int fscache_wait_for_deferred_lookup(struct fscache_cookie *cookie)
+ return 0;
+ }
+
+- fscache_stat(&fscache_n_retrievals_wait);
++ fscache_stat_unchecked(&fscache_n_retrievals_wait);
+
+ jif = jiffies;
+ if (wait_on_bit(&cookie->flags, FSCACHE_COOKIE_LOOKING_UP,
+ fscache_wait_bit_interruptible,
+ TASK_INTERRUPTIBLE) != 0) {
+- fscache_stat(&fscache_n_retrievals_intr);
++ fscache_stat_unchecked(&fscache_n_retrievals_intr);
+ _leave(" = -ERESTARTSYS");
+ return -ERESTARTSYS;
+ }
+@@ -318,8 +318,8 @@ static int fscache_wait_for_deferred_lookup(struct fscache_cookie *cookie)
+ */
+ static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
+ struct fscache_retrieval *op,
+- atomic_t *stat_op_waits,
+- atomic_t *stat_object_dead)
++ atomic_unchecked_t *stat_op_waits,
++ atomic_unchecked_t *stat_object_dead)
+ {
+ int ret;
+
+@@ -327,7 +327,7 @@ static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
+ goto check_if_dead;
+
+ _debug(">>> WT");
+- fscache_stat(stat_op_waits);
++ fscache_stat_unchecked(stat_op_waits);
+ if (wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
+ fscache_wait_bit_interruptible,
+ TASK_INTERRUPTIBLE) < 0) {
+@@ -344,7 +344,7 @@ static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
+
+ check_if_dead:
+ if (unlikely(fscache_object_is_dead(object))) {
+- fscache_stat(stat_object_dead);
++ fscache_stat_unchecked(stat_object_dead);
+ return -ENOBUFS;
+ }
+ return 0;
+@@ -371,7 +371,7 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
+
+ _enter("%p,%p,,,", cookie, page);
+
+- fscache_stat(&fscache_n_retrievals);
++ fscache_stat_unchecked(&fscache_n_retrievals);
+
+ if (hlist_empty(&cookie->backing_objects))
+ goto nobufs;
+@@ -405,7 +405,7 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
+ goto nobufs_unlock;
+ spin_unlock(&cookie->lock);
+
+- fscache_stat(&fscache_n_retrieval_ops);
++ fscache_stat_unchecked(&fscache_n_retrieval_ops);
+
+ /* pin the netfs read context in case we need to do the actual netfs
+ * read because we've encountered a cache read failure */
+@@ -435,15 +435,15 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
+
+ error:
+ if (ret == -ENOMEM)
+- fscache_stat(&fscache_n_retrievals_nomem);
++ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
+ else if (ret == -ERESTARTSYS)
+- fscache_stat(&fscache_n_retrievals_intr);
++ fscache_stat_unchecked(&fscache_n_retrievals_intr);
+ else if (ret == -ENODATA)
+- fscache_stat(&fscache_n_retrievals_nodata);
++ fscache_stat_unchecked(&fscache_n_retrievals_nodata);
+ else if (ret < 0)
+- fscache_stat(&fscache_n_retrievals_nobufs);
++ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
+ else
+- fscache_stat(&fscache_n_retrievals_ok);
++ fscache_stat_unchecked(&fscache_n_retrievals_ok);
+
+ fscache_put_retrieval(op);
+ _leave(" = %d", ret);
+@@ -453,7 +453,7 @@ nobufs_unlock:
+ spin_unlock(&cookie->lock);
+ kfree(op);
+ nobufs:
+- fscache_stat(&fscache_n_retrievals_nobufs);
++ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
+ _leave(" = -ENOBUFS");
+ return -ENOBUFS;
+ }
+@@ -491,7 +491,7 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
+
+ _enter("%p,,%d,,,", cookie, *nr_pages);
+
+- fscache_stat(&fscache_n_retrievals);
++ fscache_stat_unchecked(&fscache_n_retrievals);
+
+ if (hlist_empty(&cookie->backing_objects))
+ goto nobufs;
+@@ -522,7 +522,7 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
+ goto nobufs_unlock;
+ spin_unlock(&cookie->lock);
+
+- fscache_stat(&fscache_n_retrieval_ops);
++ fscache_stat_unchecked(&fscache_n_retrieval_ops);
+
+ /* pin the netfs read context in case we need to do the actual netfs
+ * read because we've encountered a cache read failure */
+@@ -552,15 +552,15 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
+
+ error:
+ if (ret == -ENOMEM)
+- fscache_stat(&fscache_n_retrievals_nomem);
++ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
+ else if (ret == -ERESTARTSYS)
+- fscache_stat(&fscache_n_retrievals_intr);
++ fscache_stat_unchecked(&fscache_n_retrievals_intr);
+ else if (ret == -ENODATA)
+- fscache_stat(&fscache_n_retrievals_nodata);
++ fscache_stat_unchecked(&fscache_n_retrievals_nodata);
+ else if (ret < 0)
+- fscache_stat(&fscache_n_retrievals_nobufs);
++ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
+ else
+- fscache_stat(&fscache_n_retrievals_ok);
++ fscache_stat_unchecked(&fscache_n_retrievals_ok);
+
+ fscache_put_retrieval(op);
+ _leave(" = %d", ret);
+@@ -570,7 +570,7 @@ nobufs_unlock:
+ spin_unlock(&cookie->lock);
+ kfree(op);
+ nobufs:
+- fscache_stat(&fscache_n_retrievals_nobufs);
++ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
+ _leave(" = -ENOBUFS");
+ return -ENOBUFS;
+ }
+@@ -594,7 +594,7 @@ int __fscache_alloc_page(struct fscache_cookie *cookie,
+
+ _enter("%p,%p,,,", cookie, page);
+
+- fscache_stat(&fscache_n_allocs);
++ fscache_stat_unchecked(&fscache_n_allocs);
+
+ if (hlist_empty(&cookie->backing_objects))
+ goto nobufs;
+@@ -621,7 +621,7 @@ int __fscache_alloc_page(struct fscache_cookie *cookie,
+ goto nobufs_unlock;
+ spin_unlock(&cookie->lock);
+
+- fscache_stat(&fscache_n_alloc_ops);
++ fscache_stat_unchecked(&fscache_n_alloc_ops);
+
+ ret = fscache_wait_for_retrieval_activation(
+ object, op,
+@@ -637,11 +637,11 @@ int __fscache_alloc_page(struct fscache_cookie *cookie,
+
+ error:
+ if (ret == -ERESTARTSYS)
+- fscache_stat(&fscache_n_allocs_intr);
++ fscache_stat_unchecked(&fscache_n_allocs_intr);
+ else if (ret < 0)
+- fscache_stat(&fscache_n_allocs_nobufs);
++ fscache_stat_unchecked(&fscache_n_allocs_nobufs);
+ else
+- fscache_stat(&fscache_n_allocs_ok);
++ fscache_stat_unchecked(&fscache_n_allocs_ok);
+
+ fscache_put_retrieval(op);
+ _leave(" = %d", ret);
+@@ -651,7 +651,7 @@ nobufs_unlock:
+ spin_unlock(&cookie->lock);
+ kfree(op);
+ nobufs:
+- fscache_stat(&fscache_n_allocs_nobufs);
++ fscache_stat_unchecked(&fscache_n_allocs_nobufs);
+ _leave(" = -ENOBUFS");
+ return -ENOBUFS;
+ }
+@@ -694,7 +694,7 @@ static void fscache_write_op(struct fscache_operation *_op)
+
+ spin_lock(&cookie->stores_lock);
+
+- fscache_stat(&fscache_n_store_calls);
++ fscache_stat_unchecked(&fscache_n_store_calls);
+
+ /* find a page to store */
+ page = NULL;
+@@ -705,7 +705,7 @@ static void fscache_write_op(struct fscache_operation *_op)
+ page = results[0];
+ _debug("gang %d [%lx]", n, page->index);
+ if (page->index > op->store_limit) {
+- fscache_stat(&fscache_n_store_pages_over_limit);
++ fscache_stat_unchecked(&fscache_n_store_pages_over_limit);
+ goto superseded;
+ }
+
+@@ -721,7 +721,7 @@ static void fscache_write_op(struct fscache_operation *_op)
+
+ if (page) {
+ fscache_set_op_state(&op->op, "Store");
+- fscache_stat(&fscache_n_store_pages);
++ fscache_stat_unchecked(&fscache_n_store_pages);
+ fscache_stat(&fscache_n_cop_write_page);
+ ret = object->cache->ops->write_page(op, page);
+ fscache_stat_d(&fscache_n_cop_write_page);
+@@ -792,7 +792,7 @@ int __fscache_write_page(struct fscache_cookie *cookie,
+ ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
+ ASSERT(PageFsCache(page));
+
+- fscache_stat(&fscache_n_stores);
++ fscache_stat_unchecked(&fscache_n_stores);
+
+ op = kzalloc(sizeof(*op), GFP_NOIO);
+ if (!op)
+@@ -844,7 +844,7 @@ int __fscache_write_page(struct fscache_cookie *cookie,
+ spin_unlock(&cookie->stores_lock);
+ spin_unlock(&object->lock);
+
+- op->op.debug_id = atomic_inc_return(&fscache_op_debug_id);
++ op->op.debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
+ op->store_limit = object->store_limit;
+
+ if (fscache_submit_op(object, &op->op) < 0)
+@@ -852,8 +852,8 @@ int __fscache_write_page(struct fscache_cookie *cookie,
+
+ spin_unlock(&cookie->lock);
+ radix_tree_preload_end();
+- fscache_stat(&fscache_n_store_ops);
+- fscache_stat(&fscache_n_stores_ok);
++ fscache_stat_unchecked(&fscache_n_store_ops);
++ fscache_stat_unchecked(&fscache_n_stores_ok);
+
+ /* the slow work queue now carries its own ref on the object */
+ fscache_put_operation(&op->op);
+@@ -861,14 +861,14 @@ int __fscache_write_page(struct fscache_cookie *cookie,
+ return 0;
+
+ already_queued:
+- fscache_stat(&fscache_n_stores_again);
++ fscache_stat_unchecked(&fscache_n_stores_again);
+ already_pending:
+ spin_unlock(&cookie->stores_lock);
+ spin_unlock(&object->lock);
+ spin_unlock(&cookie->lock);
+ radix_tree_preload_end();
+ kfree(op);
+- fscache_stat(&fscache_n_stores_ok);
++ fscache_stat_unchecked(&fscache_n_stores_ok);
+ _leave(" = 0");
+ return 0;
+
+@@ -886,14 +886,14 @@ nobufs:
+ spin_unlock(&cookie->lock);
+ radix_tree_preload_end();
+ kfree(op);
+- fscache_stat(&fscache_n_stores_nobufs);
++ fscache_stat_unchecked(&fscache_n_stores_nobufs);
+ _leave(" = -ENOBUFS");
+ return -ENOBUFS;
+
+ nomem_free:
+ kfree(op);
+ nomem:
+- fscache_stat(&fscache_n_stores_oom);
++ fscache_stat_unchecked(&fscache_n_stores_oom);
+ _leave(" = -ENOMEM");
+ return -ENOMEM;
+ }
+@@ -911,7 +911,7 @@ void __fscache_uncache_page(struct fscache_cookie *cookie, struct page *page)
+ ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
+ ASSERTCMP(page, !=, NULL);
+
+- fscache_stat(&fscache_n_uncaches);
++ fscache_stat_unchecked(&fscache_n_uncaches);
+
+ /* cache withdrawal may beat us to it */
+ if (!PageFsCache(page))
+@@ -964,7 +964,7 @@ void fscache_mark_pages_cached(struct fscache_retrieval *op,
+ unsigned long loop;
+
+ #ifdef CONFIG_FSCACHE_STATS
+- atomic_add(pagevec->nr, &fscache_n_marks);
++ atomic_add_unchecked(pagevec->nr, &fscache_n_marks);
+ #endif
+
+ for (loop = 0; loop < pagevec->nr; loop++) {
+diff --git a/fs/fscache/stats.c b/fs/fscache/stats.c
+index 46435f3a..8cddf18 100644
+--- a/fs/fscache/stats.c
++++ b/fs/fscache/stats.c
+@@ -18,95 +18,95 @@
+ /*
+ * operation counters
+ */
+-atomic_t fscache_n_op_pend;
+-atomic_t fscache_n_op_run;
+-atomic_t fscache_n_op_enqueue;
+-atomic_t fscache_n_op_requeue;
+-atomic_t fscache_n_op_deferred_release;
+-atomic_t fscache_n_op_release;
+-atomic_t fscache_n_op_gc;
+-atomic_t fscache_n_op_cancelled;
+-atomic_t fscache_n_op_rejected;
++atomic_unchecked_t fscache_n_op_pend;
++atomic_unchecked_t fscache_n_op_run;
++atomic_unchecked_t fscache_n_op_enqueue;
++atomic_unchecked_t fscache_n_op_requeue;
++atomic_unchecked_t fscache_n_op_deferred_release;
++atomic_unchecked_t fscache_n_op_release;
++atomic_unchecked_t fscache_n_op_gc;
++atomic_unchecked_t fscache_n_op_cancelled;
++atomic_unchecked_t fscache_n_op_rejected;
+
+-atomic_t fscache_n_attr_changed;
+-atomic_t fscache_n_attr_changed_ok;
+-atomic_t fscache_n_attr_changed_nobufs;
+-atomic_t fscache_n_attr_changed_nomem;
+-atomic_t fscache_n_attr_changed_calls;
++atomic_unchecked_t fscache_n_attr_changed;
++atomic_unchecked_t fscache_n_attr_changed_ok;
++atomic_unchecked_t fscache_n_attr_changed_nobufs;
++atomic_unchecked_t fscache_n_attr_changed_nomem;
++atomic_unchecked_t fscache_n_attr_changed_calls;
+
+-atomic_t fscache_n_allocs;
+-atomic_t fscache_n_allocs_ok;
+-atomic_t fscache_n_allocs_wait;
+-atomic_t fscache_n_allocs_nobufs;
+-atomic_t fscache_n_allocs_intr;
+-atomic_t fscache_n_allocs_object_dead;
+-atomic_t fscache_n_alloc_ops;
+-atomic_t fscache_n_alloc_op_waits;
++atomic_unchecked_t fscache_n_allocs;
++atomic_unchecked_t fscache_n_allocs_ok;
++atomic_unchecked_t fscache_n_allocs_wait;
++atomic_unchecked_t fscache_n_allocs_nobufs;
++atomic_unchecked_t fscache_n_allocs_intr;
++atomic_unchecked_t fscache_n_allocs_object_dead;
++atomic_unchecked_t fscache_n_alloc_ops;
++atomic_unchecked_t fscache_n_alloc_op_waits;
+
+-atomic_t fscache_n_retrievals;
+-atomic_t fscache_n_retrievals_ok;
+-atomic_t fscache_n_retrievals_wait;
+-atomic_t fscache_n_retrievals_nodata;
+-atomic_t fscache_n_retrievals_nobufs;
+-atomic_t fscache_n_retrievals_intr;
+-atomic_t fscache_n_retrievals_nomem;
+-atomic_t fscache_n_retrievals_object_dead;
+-atomic_t fscache_n_retrieval_ops;
+-atomic_t fscache_n_retrieval_op_waits;
++atomic_unchecked_t fscache_n_retrievals;
++atomic_unchecked_t fscache_n_retrievals_ok;
++atomic_unchecked_t fscache_n_retrievals_wait;
++atomic_unchecked_t fscache_n_retrievals_nodata;
++atomic_unchecked_t fscache_n_retrievals_nobufs;
++atomic_unchecked_t fscache_n_retrievals_intr;
++atomic_unchecked_t fscache_n_retrievals_nomem;
++atomic_unchecked_t fscache_n_retrievals_object_dead;
++atomic_unchecked_t fscache_n_retrieval_ops;
++atomic_unchecked_t fscache_n_retrieval_op_waits;
+
+-atomic_t fscache_n_stores;
+-atomic_t fscache_n_stores_ok;
+-atomic_t fscache_n_stores_again;
+-atomic_t fscache_n_stores_nobufs;
+-atomic_t fscache_n_stores_oom;
+-atomic_t fscache_n_store_ops;
+-atomic_t fscache_n_store_calls;
+-atomic_t fscache_n_store_pages;
+-atomic_t fscache_n_store_radix_deletes;
+-atomic_t fscache_n_store_pages_over_limit;
++atomic_unchecked_t fscache_n_stores;
++atomic_unchecked_t fscache_n_stores_ok;
++atomic_unchecked_t fscache_n_stores_again;
++atomic_unchecked_t fscache_n_stores_nobufs;
++atomic_unchecked_t fscache_n_stores_oom;
++atomic_unchecked_t fscache_n_store_ops;
++atomic_unchecked_t fscache_n_store_calls;
++atomic_unchecked_t fscache_n_store_pages;
++atomic_unchecked_t fscache_n_store_radix_deletes;
++atomic_unchecked_t fscache_n_store_pages_over_limit;
+
+-atomic_t fscache_n_store_vmscan_not_storing;
+-atomic_t fscache_n_store_vmscan_gone;
+-atomic_t fscache_n_store_vmscan_busy;
+-atomic_t fscache_n_store_vmscan_cancelled;
++atomic_unchecked_t fscache_n_store_vmscan_not_storing;
++atomic_unchecked_t fscache_n_store_vmscan_gone;
++atomic_unchecked_t fscache_n_store_vmscan_busy;
++atomic_unchecked_t fscache_n_store_vmscan_cancelled;
+
+-atomic_t fscache_n_marks;
+-atomic_t fscache_n_uncaches;
++atomic_unchecked_t fscache_n_marks;
++atomic_unchecked_t fscache_n_uncaches;
+
+-atomic_t fscache_n_acquires;
+-atomic_t fscache_n_acquires_null;
+-atomic_t fscache_n_acquires_no_cache;
+-atomic_t fscache_n_acquires_ok;
+-atomic_t fscache_n_acquires_nobufs;
+-atomic_t fscache_n_acquires_oom;
++atomic_unchecked_t fscache_n_acquires;
++atomic_unchecked_t fscache_n_acquires_null;
++atomic_unchecked_t fscache_n_acquires_no_cache;
++atomic_unchecked_t fscache_n_acquires_ok;
++atomic_unchecked_t fscache_n_acquires_nobufs;
++atomic_unchecked_t fscache_n_acquires_oom;
+
+-atomic_t fscache_n_updates;
+-atomic_t fscache_n_updates_null;
+-atomic_t fscache_n_updates_run;
++atomic_unchecked_t fscache_n_updates;
++atomic_unchecked_t fscache_n_updates_null;
++atomic_unchecked_t fscache_n_updates_run;
+
+-atomic_t fscache_n_relinquishes;
+-atomic_t fscache_n_relinquishes_null;
+-atomic_t fscache_n_relinquishes_waitcrt;
+-atomic_t fscache_n_relinquishes_retire;
++atomic_unchecked_t fscache_n_relinquishes;
++atomic_unchecked_t fscache_n_relinquishes_null;
++atomic_unchecked_t fscache_n_relinquishes_waitcrt;
++atomic_unchecked_t fscache_n_relinquishes_retire;
+
+-atomic_t fscache_n_cookie_index;
+-atomic_t fscache_n_cookie_data;
+-atomic_t fscache_n_cookie_special;
++atomic_unchecked_t fscache_n_cookie_index;
++atomic_unchecked_t fscache_n_cookie_data;
++atomic_unchecked_t fscache_n_cookie_special;
+
+-atomic_t fscache_n_object_alloc;
+-atomic_t fscache_n_object_no_alloc;
+-atomic_t fscache_n_object_lookups;
+-atomic_t fscache_n_object_lookups_negative;
+-atomic_t fscache_n_object_lookups_positive;
+-atomic_t fscache_n_object_lookups_timed_out;
+-atomic_t fscache_n_object_created;
+-atomic_t fscache_n_object_avail;
+-atomic_t fscache_n_object_dead;
++atomic_unchecked_t fscache_n_object_alloc;
++atomic_unchecked_t fscache_n_object_no_alloc;
++atomic_unchecked_t fscache_n_object_lookups;
++atomic_unchecked_t fscache_n_object_lookups_negative;
++atomic_unchecked_t fscache_n_object_lookups_positive;
++atomic_unchecked_t fscache_n_object_lookups_timed_out;
++atomic_unchecked_t fscache_n_object_created;
++atomic_unchecked_t fscache_n_object_avail;
++atomic_unchecked_t fscache_n_object_dead;
+
+-atomic_t fscache_n_checkaux_none;
+-atomic_t fscache_n_checkaux_okay;
+-atomic_t fscache_n_checkaux_update;
+-atomic_t fscache_n_checkaux_obsolete;
++atomic_unchecked_t fscache_n_checkaux_none;
++atomic_unchecked_t fscache_n_checkaux_okay;
++atomic_unchecked_t fscache_n_checkaux_update;
++atomic_unchecked_t fscache_n_checkaux_obsolete;
+
+ atomic_t fscache_n_cop_alloc_object;
+ atomic_t fscache_n_cop_lookup_object;
+@@ -133,113 +133,113 @@ static int fscache_stats_show(struct seq_file *m, void *v)
+ seq_puts(m, "FS-Cache statistics\n");
+
+ seq_printf(m, "Cookies: idx=%u dat=%u spc=%u\n",
+- atomic_read(&fscache_n_cookie_index),
+- atomic_read(&fscache_n_cookie_data),
+- atomic_read(&fscache_n_cookie_special));
++ atomic_read_unchecked(&fscache_n_cookie_index),
++ atomic_read_unchecked(&fscache_n_cookie_data),
++ atomic_read_unchecked(&fscache_n_cookie_special));
+
+ seq_printf(m, "Objects: alc=%u nal=%u avl=%u ded=%u\n",
+- atomic_read(&fscache_n_object_alloc),
+- atomic_read(&fscache_n_object_no_alloc),
+- atomic_read(&fscache_n_object_avail),
+- atomic_read(&fscache_n_object_dead));
++ atomic_read_unchecked(&fscache_n_object_alloc),
++ atomic_read_unchecked(&fscache_n_object_no_alloc),
++ atomic_read_unchecked(&fscache_n_object_avail),
++ atomic_read_unchecked(&fscache_n_object_dead));
+ seq_printf(m, "ChkAux : non=%u ok=%u upd=%u obs=%u\n",
+- atomic_read(&fscache_n_checkaux_none),
+- atomic_read(&fscache_n_checkaux_okay),
+- atomic_read(&fscache_n_checkaux_update),
+- atomic_read(&fscache_n_checkaux_obsolete));
++ atomic_read_unchecked(&fscache_n_checkaux_none),
++ atomic_read_unchecked(&fscache_n_checkaux_okay),
++ atomic_read_unchecked(&fscache_n_checkaux_update),
++ atomic_read_unchecked(&fscache_n_checkaux_obsolete));
+
+ seq_printf(m, "Pages : mrk=%u unc=%u\n",
+- atomic_read(&fscache_n_marks),
+- atomic_read(&fscache_n_uncaches));
++ atomic_read_unchecked(&fscache_n_marks),
++ atomic_read_unchecked(&fscache_n_uncaches));
+
+ seq_printf(m, "Acquire: n=%u nul=%u noc=%u ok=%u nbf=%u"
+ " oom=%u\n",
+- atomic_read(&fscache_n_acquires),
+- atomic_read(&fscache_n_acquires_null),
+- atomic_read(&fscache_n_acquires_no_cache),
+- atomic_read(&fscache_n_acquires_ok),
+- atomic_read(&fscache_n_acquires_nobufs),
+- atomic_read(&fscache_n_acquires_oom));
++ atomic_read_unchecked(&fscache_n_acquires),
++ atomic_read_unchecked(&fscache_n_acquires_null),
++ atomic_read_unchecked(&fscache_n_acquires_no_cache),
++ atomic_read_unchecked(&fscache_n_acquires_ok),
++ atomic_read_unchecked(&fscache_n_acquires_nobufs),
++ atomic_read_unchecked(&fscache_n_acquires_oom));
+
+ seq_printf(m, "Lookups: n=%u neg=%u pos=%u crt=%u tmo=%u\n",
+- atomic_read(&fscache_n_object_lookups),
+- atomic_read(&fscache_n_object_lookups_negative),
+- atomic_read(&fscache_n_object_lookups_positive),
+- atomic_read(&fscache_n_object_lookups_timed_out),
+- atomic_read(&fscache_n_object_created));
++ atomic_read_unchecked(&fscache_n_object_lookups),
++ atomic_read_unchecked(&fscache_n_object_lookups_negative),
++ atomic_read_unchecked(&fscache_n_object_lookups_positive),
++ atomic_read_unchecked(&fscache_n_object_lookups_timed_out),
++ atomic_read_unchecked(&fscache_n_object_created));
+
+ seq_printf(m, "Updates: n=%u nul=%u run=%u\n",
+- atomic_read(&fscache_n_updates),
+- atomic_read(&fscache_n_updates_null),
+- atomic_read(&fscache_n_updates_run));
++ atomic_read_unchecked(&fscache_n_updates),
++ atomic_read_unchecked(&fscache_n_updates_null),
++ atomic_read_unchecked(&fscache_n_updates_run));
+
+ seq_printf(m, "Relinqs: n=%u nul=%u wcr=%u rtr=%u\n",
+- atomic_read(&fscache_n_relinquishes),
+- atomic_read(&fscache_n_relinquishes_null),
+- atomic_read(&fscache_n_relinquishes_waitcrt),
+- atomic_read(&fscache_n_relinquishes_retire));
++ atomic_read_unchecked(&fscache_n_relinquishes),
++ atomic_read_unchecked(&fscache_n_relinquishes_null),
++ atomic_read_unchecked(&fscache_n_relinquishes_waitcrt),
++ atomic_read_unchecked(&fscache_n_relinquishes_retire));
+
+ seq_printf(m, "AttrChg: n=%u ok=%u nbf=%u oom=%u run=%u\n",
+- atomic_read(&fscache_n_attr_changed),
+- atomic_read(&fscache_n_attr_changed_ok),
+- atomic_read(&fscache_n_attr_changed_nobufs),
+- atomic_read(&fscache_n_attr_changed_nomem),
+- atomic_read(&fscache_n_attr_changed_calls));
++ atomic_read_unchecked(&fscache_n_attr_changed),
++ atomic_read_unchecked(&fscache_n_attr_changed_ok),
++ atomic_read_unchecked(&fscache_n_attr_changed_nobufs),
++ atomic_read_unchecked(&fscache_n_attr_changed_nomem),
++ atomic_read_unchecked(&fscache_n_attr_changed_calls));
+
+ seq_printf(m, "Allocs : n=%u ok=%u wt=%u nbf=%u int=%u\n",
+- atomic_read(&fscache_n_allocs),
+- atomic_read(&fscache_n_allocs_ok),
+- atomic_read(&fscache_n_allocs_wait),
+- atomic_read(&fscache_n_allocs_nobufs),
+- atomic_read(&fscache_n_allocs_intr));
++ atomic_read_unchecked(&fscache_n_allocs),
++ atomic_read_unchecked(&fscache_n_allocs_ok),
++ atomic_read_unchecked(&fscache_n_allocs_wait),
++ atomic_read_unchecked(&fscache_n_allocs_nobufs),
++ atomic_read_unchecked(&fscache_n_allocs_intr));
+ seq_printf(m, "Allocs : ops=%u owt=%u abt=%u\n",
+- atomic_read(&fscache_n_alloc_ops),
+- atomic_read(&fscache_n_alloc_op_waits),
+- atomic_read(&fscache_n_allocs_object_dead));
++ atomic_read_unchecked(&fscache_n_alloc_ops),
++ atomic_read_unchecked(&fscache_n_alloc_op_waits),
++ atomic_read_unchecked(&fscache_n_allocs_object_dead));
+
+ seq_printf(m, "Retrvls: n=%u ok=%u wt=%u nod=%u nbf=%u"
+ " int=%u oom=%u\n",
+- atomic_read(&fscache_n_retrievals),
+- atomic_read(&fscache_n_retrievals_ok),
+- atomic_read(&fscache_n_retrievals_wait),
+- atomic_read(&fscache_n_retrievals_nodata),
+- atomic_read(&fscache_n_retrievals_nobufs),
+- atomic_read(&fscache_n_retrievals_intr),
+- atomic_read(&fscache_n_retrievals_nomem));
++ atomic_read_unchecked(&fscache_n_retrievals),
++ atomic_read_unchecked(&fscache_n_retrievals_ok),
++ atomic_read_unchecked(&fscache_n_retrievals_wait),
++ atomic_read_unchecked(&fscache_n_retrievals_nodata),
++ atomic_read_unchecked(&fscache_n_retrievals_nobufs),
++ atomic_read_unchecked(&fscache_n_retrievals_intr),
++ atomic_read_unchecked(&fscache_n_retrievals_nomem));
+ seq_printf(m, "Retrvls: ops=%u owt=%u abt=%u\n",
+- atomic_read(&fscache_n_retrieval_ops),
+- atomic_read(&fscache_n_retrieval_op_waits),
+- atomic_read(&fscache_n_retrievals_object_dead));
++ atomic_read_unchecked(&fscache_n_retrieval_ops),
++ atomic_read_unchecked(&fscache_n_retrieval_op_waits),
++ atomic_read_unchecked(&fscache_n_retrievals_object_dead));
+
+ seq_printf(m, "Stores : n=%u ok=%u agn=%u nbf=%u oom=%u\n",
+- atomic_read(&fscache_n_stores),
+- atomic_read(&fscache_n_stores_ok),
+- atomic_read(&fscache_n_stores_again),
+- atomic_read(&fscache_n_stores_nobufs),
+- atomic_read(&fscache_n_stores_oom));
++ atomic_read_unchecked(&fscache_n_stores),
++ atomic_read_unchecked(&fscache_n_stores_ok),
++ atomic_read_unchecked(&fscache_n_stores_again),
++ atomic_read_unchecked(&fscache_n_stores_nobufs),
++ atomic_read_unchecked(&fscache_n_stores_oom));
+ seq_printf(m, "Stores : ops=%u run=%u pgs=%u rxd=%u olm=%u\n",
+- atomic_read(&fscache_n_store_ops),
+- atomic_read(&fscache_n_store_calls),
+- atomic_read(&fscache_n_store_pages),
+- atomic_read(&fscache_n_store_radix_deletes),
+- atomic_read(&fscache_n_store_pages_over_limit));
++ atomic_read_unchecked(&fscache_n_store_ops),
++ atomic_read_unchecked(&fscache_n_store_calls),
++ atomic_read_unchecked(&fscache_n_store_pages),
++ atomic_read_unchecked(&fscache_n_store_radix_deletes),
++ atomic_read_unchecked(&fscache_n_store_pages_over_limit));
+
+ seq_printf(m, "VmScan : nos=%u gon=%u bsy=%u can=%u\n",
+- atomic_read(&fscache_n_store_vmscan_not_storing),
+- atomic_read(&fscache_n_store_vmscan_gone),
+- atomic_read(&fscache_n_store_vmscan_busy),
+- atomic_read(&fscache_n_store_vmscan_cancelled));
++ atomic_read_unchecked(&fscache_n_store_vmscan_not_storing),
++ atomic_read_unchecked(&fscache_n_store_vmscan_gone),
++ atomic_read_unchecked(&fscache_n_store_vmscan_busy),
++ atomic_read_unchecked(&fscache_n_store_vmscan_cancelled));
+
+ seq_printf(m, "Ops : pend=%u run=%u enq=%u can=%u rej=%u\n",
+- atomic_read(&fscache_n_op_pend),
+- atomic_read(&fscache_n_op_run),
+- atomic_read(&fscache_n_op_enqueue),
+- atomic_read(&fscache_n_op_cancelled),
+- atomic_read(&fscache_n_op_rejected));
++ atomic_read_unchecked(&fscache_n_op_pend),
++ atomic_read_unchecked(&fscache_n_op_run),
++ atomic_read_unchecked(&fscache_n_op_enqueue),
++ atomic_read_unchecked(&fscache_n_op_cancelled),
++ atomic_read_unchecked(&fscache_n_op_rejected));
+ seq_printf(m, "Ops : dfr=%u rel=%u gc=%u\n",
+- atomic_read(&fscache_n_op_deferred_release),
+- atomic_read(&fscache_n_op_release),
+- atomic_read(&fscache_n_op_gc));
++ atomic_read_unchecked(&fscache_n_op_deferred_release),
++ atomic_read_unchecked(&fscache_n_op_release),
++ atomic_read_unchecked(&fscache_n_op_gc));
+
+ seq_printf(m, "CacheOp: alo=%d luo=%d luc=%d gro=%d\n",
+ atomic_read(&fscache_n_cop_alloc_object),
+diff --git a/fs/fuse/cuse.c b/fs/fuse/cuse.c
+index de792dc..448b532 100644
+--- a/fs/fuse/cuse.c
++++ b/fs/fuse/cuse.c
+@@ -576,10 +576,12 @@ static int __init cuse_init(void)
+ INIT_LIST_HEAD(&cuse_conntbl[i]);
+
+ /* inherit and extend fuse_dev_operations */
+- cuse_channel_fops = fuse_dev_operations;
+- cuse_channel_fops.owner = THIS_MODULE;
+- cuse_channel_fops.open = cuse_channel_open;
+- cuse_channel_fops.release = cuse_channel_release;
++ pax_open_kernel();
++ memcpy((void *)&cuse_channel_fops, &fuse_dev_operations, sizeof(fuse_dev_operations));
++ *(void **)&cuse_channel_fops.owner = THIS_MODULE;
++ *(void **)&cuse_channel_fops.open = cuse_channel_open;
++ *(void **)&cuse_channel_fops.release = cuse_channel_release;
++ pax_close_kernel();
+
+ cuse_class = class_create(THIS_MODULE, "cuse");
+ if (IS_ERR(cuse_class))
+diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
+index 1facb39..7f48557 100644
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -885,7 +885,7 @@ static int fuse_notify_inval_entry(struct fuse_conn *fc, unsigned int size,
+ {
+ struct fuse_notify_inval_entry_out outarg;
+ int err = -EINVAL;
+- char buf[FUSE_NAME_MAX+1];
++ char *buf = NULL;
+ struct qstr name;
+
+ if (size < sizeof(outarg))
+@@ -899,6 +899,11 @@ static int fuse_notify_inval_entry(struct fuse_conn *fc, unsigned int size,
+ if (outarg.namelen > FUSE_NAME_MAX)
+ goto err;
+
++ err = -ENOMEM;
++ buf = kmalloc(FUSE_NAME_MAX+1, GFP_KERNEL);
++ if (!buf)
++ goto err;
++
+ err = -EINVAL;
+ if (size != sizeof(outarg) + outarg.namelen + 1)
+ goto err;
+@@ -914,17 +919,15 @@ static int fuse_notify_inval_entry(struct fuse_conn *fc, unsigned int size,
+
+ down_read(&fc->killsb);
+ err = -ENOENT;
+- if (!fc->sb)
+- goto err_unlock;
+-
+- err = fuse_reverse_inval_entry(fc->sb, outarg.parent, &name);
+-
+-err_unlock:
++ if (fc->sb)
++ err = fuse_reverse_inval_entry(fc->sb, outarg.parent, &name);
+ up_read(&fc->killsb);
++ kfree(buf);
+ return err;
+
+ err:
+ fuse_copy_finish(cs);
++ kfree(buf);
+ return err;
+ }
+
+diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
+index 4787ae6..73efff7 100644
+--- a/fs/fuse/dir.c
++++ b/fs/fuse/dir.c
+@@ -1127,7 +1127,7 @@ static char *read_link(struct dentry *dentry)
+ return link;
+ }
+
+-static void free_link(char *link)
++static void free_link(const char *link)
+ {
+ if (!IS_ERR(link))
+ free_page((unsigned long) link);
+diff --git a/fs/gfs2/ops_inode.c b/fs/gfs2/ops_inode.c
+index 247436c..e650ccb 100644
+--- a/fs/gfs2/ops_inode.c
++++ b/fs/gfs2/ops_inode.c
+@@ -752,6 +752,8 @@ static int gfs2_rename(struct inode *odir, struct dentry *odentry,
+ unsigned int x;
+ int error;
+
++ pax_track_stack();
++
+ if (ndentry->d_inode) {
+ nip = GFS2_I(ndentry->d_inode);
+ if (ip == nip)
+diff --git a/fs/gfs2/sys.c b/fs/gfs2/sys.c
+index 4463297..4fed53b 100644
+--- a/fs/gfs2/sys.c
++++ b/fs/gfs2/sys.c
+@@ -49,7 +49,7 @@ static ssize_t gfs2_attr_store(struct kobject *kobj, struct attribute *attr,
+ return a->store ? a->store(sdp, buf, len) : len;
+ }
+
+-static struct sysfs_ops gfs2_attr_ops = {
++static const struct sysfs_ops gfs2_attr_ops = {
+ .show = gfs2_attr_show,
+ .store = gfs2_attr_store,
+ };
+@@ -584,7 +584,7 @@ static int gfs2_uevent(struct kset *kset, struct kobject *kobj,
+ return 0;
+ }
+
+-static struct kset_uevent_ops gfs2_uevent_ops = {
++static const struct kset_uevent_ops gfs2_uevent_ops = {
+ .uevent = gfs2_uevent,
+ };
+
+diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c
+index f6874ac..46904bd 100644
+--- a/fs/hfsplus/catalog.c
++++ b/fs/hfsplus/catalog.c
+@@ -157,6 +157,8 @@ int hfsplus_find_cat(struct super_block *sb, u32 cnid,
+ int err;
+ u16 type;
+
++ pax_track_stack();
++
+ hfsplus_cat_build_key(sb, fd->search_key, cnid, NULL);
+ err = hfs_brec_read(fd, &tmp, sizeof(hfsplus_cat_entry));
+ if (err)
+@@ -186,6 +188,8 @@ int hfsplus_create_cat(u32 cnid, struct inode *dir, struct qstr *str, struct ino
+ int entry_size;
+ int err;
+
++ pax_track_stack();
++
+ dprint(DBG_CAT_MOD, "create_cat: %s,%u(%d)\n", str->name, cnid, inode->i_nlink);
+ sb = dir->i_sb;
+ hfs_find_init(HFSPLUS_SB(sb).cat_tree, &fd);
+@@ -318,6 +322,8 @@ int hfsplus_rename_cat(u32 cnid,
+ int entry_size, type;
+ int err = 0;
+
++ pax_track_stack();
++
+ dprint(DBG_CAT_MOD, "rename_cat: %u - %lu,%s - %lu,%s\n", cnid, src_dir->i_ino, src_name->name,
+ dst_dir->i_ino, dst_name->name);
+ sb = src_dir->i_sb;
+@@ -329,6 +335,10 @@ int hfsplus_rename_cat(u32 cnid,
+ err = hfs_brec_find(&src_fd);
+ if (err)
+ goto out;
++ if (src_fd.entrylength > sizeof(entry) || src_fd.entrylength < 0) {
++ err = -EIO;
++ goto out;
++ }
+
+ hfs_bnode_read(src_fd.bnode, &entry, src_fd.entryoffset,
+ src_fd.entrylength);
+diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c
+index 5f40236..6ec38b2 100644
+--- a/fs/hfsplus/dir.c
++++ b/fs/hfsplus/dir.c
+@@ -121,6 +121,8 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir)
+ struct hfsplus_readdir_data *rd;
+ u16 type;
+
++ pax_track_stack();
++
+ if (filp->f_pos >= inode->i_size)
+ return 0;
+
+@@ -138,6 +140,11 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir)
+ filp->f_pos++;
+ /* fall through */
+ case 1:
++ if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
++ err = -EIO;
++ goto out;
++ }
++
+ hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength);
+ if (be16_to_cpu(entry.type) != HFSPLUS_FOLDER_THREAD) {
+ printk(KERN_ERR "hfs: bad catalog folder thread\n");
+@@ -168,6 +175,12 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir)
+ err = -EIO;
+ goto out;
+ }
++
++ if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
++ err = -EIO;
++ goto out;
++ }
++
+ hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength);
+ type = be16_to_cpu(entry.type);
+ len = HFSPLUS_MAX_STRLEN;
+diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c
+index 1bcf597..905a251 100644
+--- a/fs/hfsplus/inode.c
++++ b/fs/hfsplus/inode.c
+@@ -399,6 +399,8 @@ int hfsplus_cat_read_inode(struct inode *inode, struct hfs_find_data *fd)
+ int res = 0;
+ u16 type;
+
++ pax_track_stack();
++
+ type = hfs_bnode_read_u16(fd->bnode, fd->entryoffset);
+
+ HFSPLUS_I(inode).dev = 0;
+@@ -461,6 +463,8 @@ int hfsplus_cat_write_inode(struct inode *inode)
+ struct hfs_find_data fd;
+ hfsplus_cat_entry entry;
+
++ pax_track_stack();
++
+ if (HFSPLUS_IS_RSRC(inode))
+ main_inode = HFSPLUS_I(inode).rsrc_inode;
+
+diff --git a/fs/hfsplus/ioctl.c b/fs/hfsplus/ioctl.c
+index f457d2c..7ef4ad5 100644
+--- a/fs/hfsplus/ioctl.c
++++ b/fs/hfsplus/ioctl.c
+@@ -101,6 +101,8 @@ int hfsplus_setxattr(struct dentry *dentry, const char *name,
+ struct hfsplus_cat_file *file;
+ int res;
+
++ pax_track_stack();
++
+ if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
+ return -EOPNOTSUPP;
+
+@@ -143,6 +145,8 @@ ssize_t hfsplus_getxattr(struct dentry *dentry, const char *name,
+ struct hfsplus_cat_file *file;
+ ssize_t res = 0;
+
++ pax_track_stack();
++
+ if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
+ return -EOPNOTSUPP;
+
+diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
+index 43022f3..7298079 100644
+--- a/fs/hfsplus/super.c
++++ b/fs/hfsplus/super.c
+@@ -312,6 +312,8 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
+ struct nls_table *nls = NULL;
+ int err = -EINVAL;
+
++ pax_track_stack();
++
+ sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
+ if (!sbi)
+ return -ENOMEM;
+diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
+index 87a1258..5694d91 100644
+--- a/fs/hugetlbfs/inode.c
++++ b/fs/hugetlbfs/inode.c
+@@ -909,7 +909,7 @@ static struct file_system_type hugetlbfs_fs_type = {
+ .kill_sb = kill_litter_super,
+ };
+
+-static struct vfsmount *hugetlbfs_vfsmount;
++struct vfsmount *hugetlbfs_vfsmount;
+
+ static int can_do_hugetlb_shm(void)
+ {
+diff --git a/fs/ioctl.c b/fs/ioctl.c
+index 6c75110..19d2c3c 100644
+--- a/fs/ioctl.c
++++ b/fs/ioctl.c
+@@ -97,7 +97,7 @@ int fiemap_fill_next_extent(struct fiemap_extent_info *fieinfo, u64 logical,
+ u64 phys, u64 len, u32 flags)
+ {
+ struct fiemap_extent extent;
+- struct fiemap_extent *dest = fieinfo->fi_extents_start;
++ struct fiemap_extent __user *dest = fieinfo->fi_extents_start;
+
+ /* only count the extents */
+ if (fieinfo->fi_extents_max == 0) {
+@@ -207,7 +207,7 @@ static int ioctl_fiemap(struct file *filp, unsigned long arg)
+
+ fieinfo.fi_flags = fiemap.fm_flags;
+ fieinfo.fi_extents_max = fiemap.fm_extent_count;
+- fieinfo.fi_extents_start = (struct fiemap_extent *)(arg + sizeof(fiemap));
++ fieinfo.fi_extents_start = (struct fiemap_extent __user *)(arg + sizeof(fiemap));
+
+ if (fiemap.fm_extent_count != 0 &&
+ !access_ok(VERIFY_WRITE, fieinfo.fi_extents_start,
+@@ -220,7 +220,7 @@ static int ioctl_fiemap(struct file *filp, unsigned long arg)
+ error = inode->i_op->fiemap(inode, &fieinfo, fiemap.fm_start, len);
+ fiemap.fm_flags = fieinfo.fi_flags;
+ fiemap.fm_mapped_extents = fieinfo.fi_extents_mapped;
+- if (copy_to_user((char *)arg, &fiemap, sizeof(fiemap)))
++ if (copy_to_user((__force char __user *)arg, &fiemap, sizeof(fiemap)))
+ error = -EFAULT;
+
+ return error;
+diff --git a/fs/jbd/checkpoint.c b/fs/jbd/checkpoint.c
+index b0435dd..81ee0be 100644
+--- a/fs/jbd/checkpoint.c
++++ b/fs/jbd/checkpoint.c
+@@ -348,6 +348,8 @@ int log_do_checkpoint(journal_t *journal)
+ tid_t this_tid;
+ int result;
+
++ pax_track_stack();
++
+ jbd_debug(1, "Start checkpoint\n");
+
+ /*
+diff --git a/fs/jffs2/compr_rtime.c b/fs/jffs2/compr_rtime.c
+index 546d153..736896c 100644
+--- a/fs/jffs2/compr_rtime.c
++++ b/fs/jffs2/compr_rtime.c
+@@ -37,6 +37,8 @@ static int jffs2_rtime_compress(unsigned char *data_in,
+ int outpos = 0;
+ int pos=0;
+
++ pax_track_stack();
++
+ memset(positions,0,sizeof(positions));
+
+ while (pos < (*sourcelen) && outpos <= (*dstlen)-2) {
+@@ -79,6 +81,8 @@ static int jffs2_rtime_decompress(unsigned char *data_in,
+ int outpos = 0;
+ int pos=0;
+
++ pax_track_stack();
++
+ memset(positions,0,sizeof(positions));
+
+ while (outpos<destlen) {
+diff --git a/fs/jffs2/compr_rubin.c b/fs/jffs2/compr_rubin.c
+index 170d289..3254b98 100644
+--- a/fs/jffs2/compr_rubin.c
++++ b/fs/jffs2/compr_rubin.c
+@@ -314,6 +314,8 @@ static int jffs2_dynrubin_compress(unsigned char *data_in,
+ int ret;
+ uint32_t mysrclen, mydstlen;
+
++ pax_track_stack();
++
+ mysrclen = *sourcelen;
+ mydstlen = *dstlen - 8;
+
+diff --git a/fs/jffs2/erase.c b/fs/jffs2/erase.c
+index b47679b..00d65d3 100644
+--- a/fs/jffs2/erase.c
++++ b/fs/jffs2/erase.c
+@@ -434,7 +434,8 @@ static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseb
+ struct jffs2_unknown_node marker = {
+ .magic = cpu_to_je16(JFFS2_MAGIC_BITMASK),
+ .nodetype = cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
+- .totlen = cpu_to_je32(c->cleanmarker_size)
++ .totlen = cpu_to_je32(c->cleanmarker_size),
++ .hdr_crc = cpu_to_je32(0)
+ };
+
+ jffs2_prealloc_raw_node_refs(c, jeb, 1);
+diff --git a/fs/jffs2/wbuf.c b/fs/jffs2/wbuf.c
+index 5ef7bac..4fd1e3c 100644
+--- a/fs/jffs2/wbuf.c
++++ b/fs/jffs2/wbuf.c
+@@ -1012,7 +1012,8 @@ static const struct jffs2_unknown_node oob_cleanmarker =
+ {
+ .magic = constant_cpu_to_je16(JFFS2_MAGIC_BITMASK),
+ .nodetype = constant_cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
+- .totlen = constant_cpu_to_je32(8)
++ .totlen = constant_cpu_to_je32(8),
++ .hdr_crc = constant_cpu_to_je32(0)
+ };
+
+ /*
+diff --git a/fs/jffs2/xattr.c b/fs/jffs2/xattr.c
+index 082e844..52012a1 100644
+--- a/fs/jffs2/xattr.c
++++ b/fs/jffs2/xattr.c
+@@ -773,6 +773,8 @@ void jffs2_build_xattr_subsystem(struct jffs2_sb_info *c)
+
+ BUG_ON(!(c->flags & JFFS2_SB_FLAG_BUILDING));
+
++ pax_track_stack();
++
+ /* Phase.1 : Merge same xref */
+ for (i=0; i < XREF_TMPHASH_SIZE; i++)
+ xref_tmphash[i] = NULL;
+diff --git a/fs/jfs/super.c b/fs/jfs/super.c
+index 2234c73..f6e6e6b 100644
+--- a/fs/jfs/super.c
++++ b/fs/jfs/super.c
+@@ -793,7 +793,7 @@ static int __init init_jfs_fs(void)
+
+ jfs_inode_cachep =
+ kmem_cache_create("jfs_ip", sizeof(struct jfs_inode_info), 0,
+- SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD,
++ SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|SLAB_USERCOPY,
+ init_once);
+ if (jfs_inode_cachep == NULL)
+ return -ENOMEM;
+diff --git a/fs/libfs.c b/fs/libfs.c
+index ba36e93..3153fce 100644
+--- a/fs/libfs.c
++++ b/fs/libfs.c
+@@ -157,12 +157,20 @@ int dcache_readdir(struct file * filp, void * dirent, filldir_t filldir)
+
+ for (p=q->next; p != &dentry->d_subdirs; p=p->next) {
+ struct dentry *next;
++ char d_name[sizeof(next->d_iname)];
++ const unsigned char *name;
++
+ next = list_entry(p, struct dentry, d_u.d_child);
+ if (d_unhashed(next) || !next->d_inode)
+ continue;
+
+ spin_unlock(&dcache_lock);
+- if (filldir(dirent, next->d_name.name,
++ name = next->d_name.name;
++ if (name == next->d_iname) {
++ memcpy(d_name, name, next->d_name.len);
++ name = d_name;
++ }
++ if (filldir(dirent, name,
+ next->d_name.len, filp->f_pos,
+ next->d_inode->i_ino,
+ dt_type(next->d_inode)) < 0)
+diff --git a/fs/lockd/clntproc.c b/fs/lockd/clntproc.c
+index c325a83..d15b07b 100644
+--- a/fs/lockd/clntproc.c
++++ b/fs/lockd/clntproc.c
+@@ -36,11 +36,11 @@ static const struct rpc_call_ops nlmclnt_cancel_ops;
+ /*
+ * Cookie counter for NLM requests
+ */
+-static atomic_t nlm_cookie = ATOMIC_INIT(0x1234);
++static atomic_unchecked_t nlm_cookie = ATOMIC_INIT(0x1234);
+
+ void nlmclnt_next_cookie(struct nlm_cookie *c)
+ {
+- u32 cookie = atomic_inc_return(&nlm_cookie);
++ u32 cookie = atomic_inc_return_unchecked(&nlm_cookie);
+
+ memcpy(c->data, &cookie, 4);
+ c->len=4;
+@@ -621,6 +621,8 @@ nlmclnt_reclaim(struct nlm_host *host, struct file_lock *fl)
+ struct nlm_rqst reqst, *req;
+ int status;
+
++ pax_track_stack();
++
+ req = &reqst;
+ memset(req, 0, sizeof(*req));
+ locks_init_lock(&req->a_args.lock.fl);
+diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c
+index 1a54ae1..6a16c27 100644
+--- a/fs/lockd/svc.c
++++ b/fs/lockd/svc.c
+@@ -43,7 +43,7 @@
+
+ static struct svc_program nlmsvc_program;
+
+-struct nlmsvc_binding * nlmsvc_ops;
++const struct nlmsvc_binding * nlmsvc_ops;
+ EXPORT_SYMBOL_GPL(nlmsvc_ops);
+
+ static DEFINE_MUTEX(nlmsvc_mutex);
+diff --git a/fs/locks.c b/fs/locks.c
+index a8794f2..4041e55 100644
+--- a/fs/locks.c
++++ b/fs/locks.c
+@@ -145,10 +145,28 @@ static LIST_HEAD(blocked_list);
+
+ static struct kmem_cache *filelock_cache __read_mostly;
+
++static void locks_init_lock_always(struct file_lock *fl)
++{
++ fl->fl_next = NULL;
++ fl->fl_fasync = NULL;
++ fl->fl_owner = NULL;
++ fl->fl_pid = 0;
++ fl->fl_nspid = NULL;
++ fl->fl_file = NULL;
++ fl->fl_flags = 0;
++ fl->fl_type = 0;
++ fl->fl_start = fl->fl_end = 0;
++}
++
+ /* Allocate an empty lock structure. */
+ static struct file_lock *locks_alloc_lock(void)
+ {
+- return kmem_cache_alloc(filelock_cache, GFP_KERNEL);
++ struct file_lock *fl = kmem_cache_alloc(filelock_cache, GFP_KERNEL);
++
++ if (fl)
++ locks_init_lock_always(fl);
++
++ return fl;
+ }
+
+ void locks_release_private(struct file_lock *fl)
+@@ -183,17 +201,9 @@ void locks_init_lock(struct file_lock *fl)
+ INIT_LIST_HEAD(&fl->fl_link);
+ INIT_LIST_HEAD(&fl->fl_block);
+ init_waitqueue_head(&fl->fl_wait);
+- fl->fl_next = NULL;
+- fl->fl_fasync = NULL;
+- fl->fl_owner = NULL;
+- fl->fl_pid = 0;
+- fl->fl_nspid = NULL;
+- fl->fl_file = NULL;
+- fl->fl_flags = 0;
+- fl->fl_type = 0;
+- fl->fl_start = fl->fl_end = 0;
+ fl->fl_ops = NULL;
+ fl->fl_lmops = NULL;
++ locks_init_lock_always(fl);
+ }
+
+ EXPORT_SYMBOL(locks_init_lock);
+@@ -2007,16 +2017,16 @@ void locks_remove_flock(struct file *filp)
+ return;
+
+ if (filp->f_op && filp->f_op->flock) {
+- struct file_lock fl = {
++ struct file_lock flock = {
+ .fl_pid = current->tgid,
+ .fl_file = filp,
+ .fl_flags = FL_FLOCK,
+ .fl_type = F_UNLCK,
+ .fl_end = OFFSET_MAX,
+ };
+- filp->f_op->flock(filp, F_SETLKW, &fl);
+- if (fl.fl_ops && fl.fl_ops->fl_release_private)
+- fl.fl_ops->fl_release_private(&fl);
++ filp->f_op->flock(filp, F_SETLKW, &flock);
++ if (flock.fl_ops && flock.fl_ops->fl_release_private)
++ flock.fl_ops->fl_release_private(&flock);
+ }
+
+ lock_kernel();
+diff --git a/fs/mbcache.c b/fs/mbcache.c
+index ec88ff3..b843a82 100644
+--- a/fs/mbcache.c
++++ b/fs/mbcache.c
+@@ -266,9 +266,9 @@ mb_cache_create(const char *name, struct mb_cache_op *cache_op,
+ if (!cache)
+ goto fail;
+ cache->c_name = name;
+- cache->c_op.free = NULL;
++ *(void **)&cache->c_op.free = NULL;
+ if (cache_op)
+- cache->c_op.free = cache_op->free;
++ *(void **)&cache->c_op.free = cache_op->free;
+ atomic_set(&cache->c_entry_count, 0);
+ cache->c_bucket_bits = bucket_bits;
+ #ifdef MB_CACHE_INDEXES_COUNT
+diff --git a/fs/namei.c b/fs/namei.c
+index b0afbd4..8d065a1 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -224,6 +224,14 @@ int generic_permission(struct inode *inode, int mask,
+ return ret;
+
+ /*
++ * Searching includes executable on directories, else just read.
++ */
++ mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
++ if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE)))
++ if (capable(CAP_DAC_READ_SEARCH))
++ return 0;
++
++ /*
+ * Read/write DACs are always overridable.
+ * Executable DACs are overridable if at least one exec bit is set.
+ */
+@@ -231,14 +239,6 @@ int generic_permission(struct inode *inode, int mask,
+ if (capable(CAP_DAC_OVERRIDE))
+ return 0;
+
+- /*
+- * Searching includes executable on directories, else just read.
+- */
+- mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
+- if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE)))
+- if (capable(CAP_DAC_READ_SEARCH))
+- return 0;
+-
+ return -EACCES;
+ }
+
+@@ -458,7 +458,8 @@ static int exec_permission_lite(struct inode *inode)
+ if (!ret)
+ goto ok;
+
+- if (capable(CAP_DAC_OVERRIDE) || capable(CAP_DAC_READ_SEARCH))
++ if (capable_nolog(CAP_DAC_OVERRIDE) || capable(CAP_DAC_READ_SEARCH) ||
++ capable(CAP_DAC_OVERRIDE))
+ goto ok;
+
+ return ret;
+@@ -638,7 +639,7 @@ static __always_inline int __do_follow_link(struct path *path, struct nameidata
+ cookie = dentry->d_inode->i_op->follow_link(dentry, nd);
+ error = PTR_ERR(cookie);
+ if (!IS_ERR(cookie)) {
+- char *s = nd_get_link(nd);
++ const char *s = nd_get_link(nd);
+ error = 0;
+ if (s)
+ error = __vfs_follow_link(nd, s);
+@@ -669,6 +670,13 @@ static inline int do_follow_link(struct path *path, struct nameidata *nd)
+ err = security_inode_follow_link(path->dentry, nd);
+ if (err)
+ goto loop;
++
++ if (gr_handle_follow_link(path->dentry->d_parent->d_inode,
++ path->dentry->d_inode, path->dentry, nd->path.mnt)) {
++ err = -EACCES;
++ goto loop;
++ }
++
+ current->link_count++;
+ current->total_link_count++;
+ nd->depth++;
+@@ -1016,11 +1024,19 @@ return_reval:
+ break;
+ }
+ return_base:
++ if (!(nd->flags & (LOOKUP_CONTINUE | LOOKUP_PARENT)) &&
++ !gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
++ path_put(&nd->path);
++ return -ENOENT;
++ }
+ return 0;
+ out_dput:
+ path_put_conditional(&next, nd);
+ break;
+ }
++ if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt))
++ err = -ENOENT;
++
+ path_put(&nd->path);
+ return_err:
+ return err;
+@@ -1091,13 +1107,20 @@ static int do_path_lookup(int dfd, const char *name,
+ int retval = path_init(dfd, name, flags, nd);
+ if (!retval)
+ retval = path_walk(name, nd);
+- if (unlikely(!retval && !audit_dummy_context() && nd->path.dentry &&
+- nd->path.dentry->d_inode))
+- audit_inode(name, nd->path.dentry);
++
++ if (likely(!retval)) {
++ if (nd->path.dentry && nd->path.dentry->d_inode) {
++ if (*name != '/' && !gr_chroot_fchdir(nd->path.dentry, nd->path.mnt))
++ retval = -ENOENT;
++ if (!audit_dummy_context())
++ audit_inode(name, nd->path.dentry);
++ }
++ }
+ if (nd->root.mnt) {
+ path_put(&nd->root);
+ nd->root.mnt = NULL;
+ }
++
+ return retval;
+ }
+
+@@ -1576,6 +1599,20 @@ int may_open(struct path *path, int acc_mode, int flag)
+ if (error)
+ goto err_out;
+
++
++ if (gr_handle_rofs_blockwrite(dentry, path->mnt, acc_mode)) {
++ error = -EPERM;
++ goto err_out;
++ }
++ if (gr_handle_rawio(inode)) {
++ error = -EPERM;
++ goto err_out;
++ }
++ if (!gr_acl_handle_open(dentry, path->mnt, acc_mode)) {
++ error = -EACCES;
++ goto err_out;
++ }
++
+ if (flag & O_TRUNC) {
+ error = get_write_access(inode);
+ if (error)
+@@ -1620,6 +1657,17 @@ static int __open_namei_create(struct nameidata *nd, struct path *path,
+ {
+ int error;
+ struct dentry *dir = nd->path.dentry;
++ int acc_mode = ACC_MODE(flag);
++
++ if (flag & O_TRUNC)
++ acc_mode |= MAY_WRITE;
++ if (flag & O_APPEND)
++ acc_mode |= MAY_APPEND;
++
++ if (!gr_acl_handle_creat(path->dentry, dir, nd->path.mnt, flag, acc_mode, mode)) {
++ error = -EACCES;
++ goto out_unlock;
++ }
+
+ if (!IS_POSIXACL(dir->d_inode))
+ mode &= ~current_umask();
+@@ -1627,6 +1675,8 @@ static int __open_namei_create(struct nameidata *nd, struct path *path,
+ if (error)
+ goto out_unlock;
+ error = vfs_create(dir->d_inode, path->dentry, mode, nd);
++ if (!error)
++ gr_handle_create(path->dentry, nd->path.mnt);
+ out_unlock:
+ mutex_unlock(&dir->d_inode->i_mutex);
+ dput(nd->path.dentry);
+@@ -1709,6 +1759,22 @@ struct file *do_filp_open(int dfd, const char *pathname,
+ &nd, flag);
+ if (error)
+ return ERR_PTR(error);
++
++ if (gr_handle_rofs_blockwrite(nd.path.dentry, nd.path.mnt, acc_mode)) {
++ error = -EPERM;
++ goto exit;
++ }
++
++ if (gr_handle_rawio(nd.path.dentry->d_inode)) {
++ error = -EPERM;
++ goto exit;
++ }
++
++ if (!gr_acl_handle_open(nd.path.dentry, nd.path.mnt, acc_mode)) {
++ error = -EACCES;
++ goto exit;
++ }
++
+ goto ok;
+ }
+
+@@ -1795,6 +1861,19 @@ do_last:
+ /*
+ * It already exists.
+ */
++
++ if (!gr_acl_handle_hidden_file(path.dentry, path.mnt)) {
++ error = -ENOENT;
++ goto exit_mutex_unlock;
++ }
++
++ /* only check if O_CREAT is specified, all other checks need
++ to go into may_open */
++ if (gr_handle_fifo(path.dentry, path.mnt, dir, flag, acc_mode)) {
++ error = -EACCES;
++ goto exit_mutex_unlock;
++ }
++
+ mutex_unlock(&dir->d_inode->i_mutex);
+ audit_inode(pathname, path.dentry);
+
+@@ -1887,6 +1966,13 @@ do_link:
+ error = security_inode_follow_link(path.dentry, &nd);
+ if (error)
+ goto exit_dput;
++
++ if (gr_handle_follow_link(path.dentry->d_parent->d_inode, path.dentry->d_inode,
++ path.dentry, nd.path.mnt)) {
++ error = -EACCES;
++ goto exit_dput;
++ }
++
+ error = __do_follow_link(&path, &nd);
+ if (error) {
+ /* Does someone understand code flow here? Or it is only
+@@ -1984,6 +2070,10 @@ struct dentry *lookup_create(struct nameidata *nd, int is_dir)
+ }
+ return dentry;
+ eexist:
++ if (!gr_acl_handle_hidden_file(dentry, nd->path.mnt)) {
++ dput(dentry);
++ return ERR_PTR(-ENOENT);
++ }
+ dput(dentry);
+ dentry = ERR_PTR(-EEXIST);
+ fail:
+@@ -2061,6 +2151,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, int, mode,
+ error = may_mknod(mode);
+ if (error)
+ goto out_dput;
++
++ if (gr_handle_chroot_mknod(dentry, nd.path.mnt, mode)) {
++ error = -EPERM;
++ goto out_dput;
++ }
++
++ if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
++ error = -EACCES;
++ goto out_dput;
++ }
++
+ error = mnt_want_write(nd.path.mnt);
+ if (error)
+ goto out_dput;
+@@ -2081,6 +2182,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, int, mode,
+ }
+ out_drop_write:
+ mnt_drop_write(nd.path.mnt);
++
++ if (!error)
++ gr_handle_create(dentry, nd.path.mnt);
+ out_dput:
+ dput(dentry);
+ out_unlock:
+@@ -2134,6 +2238,11 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, int, mode)
+ if (IS_ERR(dentry))
+ goto out_unlock;
+
++ if (!gr_acl_handle_mkdir(dentry, nd.path.dentry, nd.path.mnt)) {
++ error = -EACCES;
++ goto out_dput;
++ }
++
+ if (!IS_POSIXACL(nd.path.dentry->d_inode))
+ mode &= ~current_umask();
+ error = mnt_want_write(nd.path.mnt);
+@@ -2145,6 +2254,10 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, int, mode)
+ error = vfs_mkdir(nd.path.dentry->d_inode, dentry, mode);
+ out_drop_write:
+ mnt_drop_write(nd.path.mnt);
++
++ if (!error)
++ gr_handle_create(dentry, nd.path.mnt);
++
+ out_dput:
+ dput(dentry);
+ out_unlock:
+@@ -2226,6 +2339,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
+ char * name;
+ struct dentry *dentry;
+ struct nameidata nd;
++ ino_t saved_ino = 0;
++ dev_t saved_dev = 0;
+
+ error = user_path_parent(dfd, pathname, &nd, &name);
+ if (error)
+@@ -2250,6 +2365,17 @@ static long do_rmdir(int dfd, const char __user *pathname)
+ error = PTR_ERR(dentry);
+ if (IS_ERR(dentry))
+ goto exit2;
++
++ if (dentry->d_inode != NULL) {
++ saved_ino = dentry->d_inode->i_ino;
++ saved_dev = gr_get_dev_from_dentry(dentry);
++
++ if (!gr_acl_handle_rmdir(dentry, nd.path.mnt)) {
++ error = -EACCES;
++ goto exit3;
++ }
++ }
++
+ error = mnt_want_write(nd.path.mnt);
+ if (error)
+ goto exit3;
+@@ -2257,6 +2383,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
+ if (error)
+ goto exit4;
+ error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
++ if (!error && (saved_dev || saved_ino))
++ gr_handle_delete(saved_ino, saved_dev);
+ exit4:
+ mnt_drop_write(nd.path.mnt);
+ exit3:
+@@ -2318,6 +2446,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
+ struct dentry *dentry;
+ struct nameidata nd;
+ struct inode *inode = NULL;
++ ino_t saved_ino = 0;
++ dev_t saved_dev = 0;
+
+ error = user_path_parent(dfd, pathname, &nd, &name);
+ if (error)
+@@ -2337,8 +2467,19 @@ static long do_unlinkat(int dfd, const char __user *pathname)
+ if (nd.last.name[nd.last.len])
+ goto slashes;
+ inode = dentry->d_inode;
+- if (inode)
++ if (inode) {
++ if (inode->i_nlink <= 1) {
++ saved_ino = inode->i_ino;
++ saved_dev = gr_get_dev_from_dentry(dentry);
++ }
++
+ atomic_inc(&inode->i_count);
++
++ if (!gr_acl_handle_unlink(dentry, nd.path.mnt)) {
++ error = -EACCES;
++ goto exit2;
++ }
++ }
+ error = mnt_want_write(nd.path.mnt);
+ if (error)
+ goto exit2;
+@@ -2346,6 +2487,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
+ if (error)
+ goto exit3;
+ error = vfs_unlink(nd.path.dentry->d_inode, dentry);
++ if (!error && (saved_ino || saved_dev))
++ gr_handle_delete(saved_ino, saved_dev);
+ exit3:
+ mnt_drop_write(nd.path.mnt);
+ exit2:
+@@ -2424,6 +2567,11 @@ SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
+ if (IS_ERR(dentry))
+ goto out_unlock;
+
++ if (!gr_acl_handle_symlink(dentry, nd.path.dentry, nd.path.mnt, from)) {
++ error = -EACCES;
++ goto out_dput;
++ }
++
+ error = mnt_want_write(nd.path.mnt);
+ if (error)
+ goto out_dput;
+@@ -2431,6 +2579,8 @@ SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
+ if (error)
+ goto out_drop_write;
+ error = vfs_symlink(nd.path.dentry->d_inode, dentry, from);
++ if (!error)
++ gr_handle_create(dentry, nd.path.mnt);
+ out_drop_write:
+ mnt_drop_write(nd.path.mnt);
+ out_dput:
+@@ -2524,6 +2674,20 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
+ error = PTR_ERR(new_dentry);
+ if (IS_ERR(new_dentry))
+ goto out_unlock;
++
++ if (gr_handle_hardlink(old_path.dentry, old_path.mnt,
++ old_path.dentry->d_inode,
++ old_path.dentry->d_inode->i_mode, to)) {
++ error = -EACCES;
++ goto out_dput;
++ }
++
++ if (!gr_acl_handle_link(new_dentry, nd.path.dentry, nd.path.mnt,
++ old_path.dentry, old_path.mnt, to)) {
++ error = -EACCES;
++ goto out_dput;
++ }
++
+ error = mnt_want_write(nd.path.mnt);
+ if (error)
+ goto out_dput;
+@@ -2531,6 +2695,8 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
+ if (error)
+ goto out_drop_write;
+ error = vfs_link(old_path.dentry, nd.path.dentry->d_inode, new_dentry);
++ if (!error)
++ gr_handle_create(new_dentry, nd.path.mnt);
+ out_drop_write:
+ mnt_drop_write(nd.path.mnt);
+ out_dput:
+@@ -2708,6 +2874,8 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
+ char *to;
+ int error;
+
++ pax_track_stack();
++
+ error = user_path_parent(olddfd, oldname, &oldnd, &from);
+ if (error)
+ goto exit;
+@@ -2764,6 +2932,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
+ if (new_dentry == trap)
+ goto exit5;
+
++ error = gr_acl_handle_rename(new_dentry, new_dir, newnd.path.mnt,
++ old_dentry, old_dir->d_inode, oldnd.path.mnt,
++ to);
++ if (error)
++ goto exit5;
++
+ error = mnt_want_write(oldnd.path.mnt);
+ if (error)
+ goto exit5;
+@@ -2773,6 +2947,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
+ goto exit6;
+ error = vfs_rename(old_dir->d_inode, old_dentry,
+ new_dir->d_inode, new_dentry);
++ if (!error)
++ gr_handle_rename(old_dir->d_inode, new_dir->d_inode, old_dentry,
++ new_dentry, oldnd.path.mnt, new_dentry->d_inode ? 1 : 0);
+ exit6:
+ mnt_drop_write(oldnd.path.mnt);
+ exit5:
+@@ -2798,6 +2975,8 @@ SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newna
+
+ int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
+ {
++ char tmpbuf[64];
++ const char *newlink;
+ int len;
+
+ len = PTR_ERR(link);
+@@ -2807,7 +2986,14 @@ int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const c
+ len = strlen(link);
+ if (len > (unsigned) buflen)
+ len = buflen;
+- if (copy_to_user(buffer, link, len))
++
++ if (len < sizeof(tmpbuf)) {
++ memcpy(tmpbuf, link, len);
++ newlink = tmpbuf;
++ } else
++ newlink = link;
++
++ if (copy_to_user(buffer, newlink, len))
+ len = -EFAULT;
+ out:
+ return len;
+diff --git a/fs/namespace.c b/fs/namespace.c
+index 2beb0fb..11a95a5 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -1083,6 +1083,9 @@ static int do_umount(struct vfsmount *mnt, int flags)
+ if (!(sb->s_flags & MS_RDONLY))
+ retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
+ up_write(&sb->s_umount);
++
++ gr_log_remount(mnt->mnt_devname, retval);
++
+ return retval;
+ }
+
+@@ -1104,6 +1107,9 @@ static int do_umount(struct vfsmount *mnt, int flags)
+ security_sb_umount_busy(mnt);
+ up_write(&namespace_sem);
+ release_mounts(&umount_list);
++
++ gr_log_unmount(mnt->mnt_devname, retval);
++
+ return retval;
+ }
+
+@@ -1962,6 +1968,16 @@ long do_mount(char *dev_name, char *dir_name, char *type_page,
+ if (retval)
+ goto dput_out;
+
++ if (gr_handle_rofs_mount(path.dentry, path.mnt, mnt_flags)) {
++ retval = -EPERM;
++ goto dput_out;
++ }
++
++ if (gr_handle_chroot_mount(path.dentry, path.mnt, dev_name)) {
++ retval = -EPERM;
++ goto dput_out;
++ }
++
+ if (flags & MS_REMOUNT)
+ retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
+ data_page);
+@@ -1976,6 +1992,9 @@ long do_mount(char *dev_name, char *dir_name, char *type_page,
+ dev_name, data_page);
+ dput_out:
+ path_put(&path);
++
++ gr_log_mount(dev_name, dir_name, retval);
++
+ return retval;
+ }
+
+@@ -2182,6 +2201,12 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
+ goto out1;
+ }
+
++ if (gr_handle_chroot_pivot()) {
++ error = -EPERM;
++ path_put(&old);
++ goto out1;
++ }
++
+ read_lock(¤t->fs->lock);
+ root = current->fs->root;
+ path_get(¤t->fs->root);
+diff --git a/fs/ncpfs/dir.c b/fs/ncpfs/dir.c
+index b8b5b30..2bd9ccb 100644
+--- a/fs/ncpfs/dir.c
++++ b/fs/ncpfs/dir.c
+@@ -275,6 +275,8 @@ __ncp_lookup_validate(struct dentry *dentry)
+ int res, val = 0, len;
+ __u8 __name[NCP_MAXPATHLEN + 1];
+
++ pax_track_stack();
++
+ parent = dget_parent(dentry);
+ dir = parent->d_inode;
+
+@@ -799,6 +801,8 @@ static struct dentry *ncp_lookup(struct inode *dir, struct dentry *dentry, struc
+ int error, res, len;
+ __u8 __name[NCP_MAXPATHLEN + 1];
+
++ pax_track_stack();
++
+ lock_kernel();
+ error = -EIO;
+ if (!ncp_conn_valid(server))
+@@ -883,10 +887,12 @@ int ncp_create_new(struct inode *dir, struct dentry *dentry, int mode,
+ int error, result, len;
+ int opmode;
+ __u8 __name[NCP_MAXPATHLEN + 1];
+-
++
+ PPRINTK("ncp_create_new: creating %s/%s, mode=%x\n",
+ dentry->d_parent->d_name.name, dentry->d_name.name, mode);
+
++ pax_track_stack();
++
+ error = -EIO;
+ lock_kernel();
+ if (!ncp_conn_valid(server))
+@@ -952,6 +958,8 @@ static int ncp_mkdir(struct inode *dir, struct dentry *dentry, int mode)
+ int error, len;
+ __u8 __name[NCP_MAXPATHLEN + 1];
+
++ pax_track_stack();
++
+ DPRINTK("ncp_mkdir: making %s/%s\n",
+ dentry->d_parent->d_name.name, dentry->d_name.name);
+
+@@ -960,6 +968,8 @@ static int ncp_mkdir(struct inode *dir, struct dentry *dentry, int mode)
+ if (!ncp_conn_valid(server))
+ goto out;
+
++ pax_track_stack();
++
+ ncp_age_dentry(server, dentry);
+ len = sizeof(__name);
+ error = ncp_io2vol(server, __name, &len, dentry->d_name.name,
+@@ -1114,6 +1124,8 @@ static int ncp_rename(struct inode *old_dir, struct dentry *old_dentry,
+ int old_len, new_len;
+ __u8 __old_name[NCP_MAXPATHLEN + 1], __new_name[NCP_MAXPATHLEN + 1];
+
++ pax_track_stack();
++
+ DPRINTK("ncp_rename: %s/%s to %s/%s\n",
+ old_dentry->d_parent->d_name.name, old_dentry->d_name.name,
+ new_dentry->d_parent->d_name.name, new_dentry->d_name.name);
+diff --git a/fs/ncpfs/inode.c b/fs/ncpfs/inode.c
+index cf98da1..da890a9 100644
+--- a/fs/ncpfs/inode.c
++++ b/fs/ncpfs/inode.c
+@@ -445,6 +445,8 @@ static int ncp_fill_super(struct super_block *sb, void *raw_data, int silent)
+ #endif
+ struct ncp_entry_info finfo;
+
++ pax_track_stack();
++
+ data.wdog_pid = NULL;
+ server = kzalloc(sizeof(struct ncp_server), GFP_KERNEL);
+ if (!server)
+diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
+index bfaef7b..e9d03ca 100644
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -156,7 +156,7 @@ static void nfs_zap_caches_locked(struct inode *inode)
+ nfsi->attrtimeo = NFS_MINATTRTIMEO(inode);
+ nfsi->attrtimeo_timestamp = jiffies;
+
+- memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_COOKIEVERF(inode)));
++ memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_I(inode)->cookieverf));
+ if (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))
+ nfsi->cache_validity |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL|NFS_INO_REVAL_PAGECACHE;
+ else
+@@ -973,16 +973,16 @@ static int nfs_size_need_update(const struct inode *inode, const struct nfs_fatt
+ return nfs_size_to_loff_t(fattr->size) > i_size_read(inode);
+ }
+
+-static atomic_long_t nfs_attr_generation_counter;
++static atomic_long_unchecked_t nfs_attr_generation_counter;
+
+ static unsigned long nfs_read_attr_generation_counter(void)
+ {
+- return atomic_long_read(&nfs_attr_generation_counter);
++ return atomic_long_read_unchecked(&nfs_attr_generation_counter);
+ }
+
+ unsigned long nfs_inc_attr_generation_counter(void)
+ {
+- return atomic_long_inc_return(&nfs_attr_generation_counter);
++ return atomic_long_inc_return_unchecked(&nfs_attr_generation_counter);
+ }
+
+ void nfs_fattr_init(struct nfs_fattr *fattr)
+diff --git a/fs/nfsd/lockd.c b/fs/nfsd/lockd.c
+index cc2f505..f6a236f 100644
+--- a/fs/nfsd/lockd.c
++++ b/fs/nfsd/lockd.c
+@@ -66,7 +66,7 @@ nlm_fclose(struct file *filp)
+ fput(filp);
+ }
+
+-static struct nlmsvc_binding nfsd_nlm_ops = {
++static const struct nlmsvc_binding nfsd_nlm_ops = {
+ .fopen = nlm_fopen, /* open file for locking */
+ .fclose = nlm_fclose, /* close file */
+ };
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index cfc3391..dcc083a 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -3459,6 +3459,8 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ unsigned int cmd;
+ int err;
+
++ pax_track_stack();
++
+ dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n",
+ (long long) lock->lk_offset,
+ (long long) lock->lk_length);
+diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
+index 4a82a96..0d5fb49 100644
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -1751,6 +1751,8 @@ nfsd4_encode_fattr(struct svc_fh *fhp, struct svc_export *exp,
+ struct nfsd4_compoundres *resp = rqstp->rq_resp;
+ u32 minorversion = resp->cstate.minorversion;
+
++ pax_track_stack();
++
+ BUG_ON(bmval1 & NFSD_WRITEONLY_ATTRS_WORD1);
+ BUG_ON(bmval0 & ~nfsd_suppattrs0(minorversion));
+ BUG_ON(bmval1 & ~nfsd_suppattrs1(minorversion));
+diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
+index 2e09588..596421d 100644
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -937,7 +937,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
+ } else {
+ oldfs = get_fs();
+ set_fs(KERNEL_DS);
+- host_err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset);
++ host_err = vfs_readv(file, (struct iovec __force_user *)vec, vlen, &offset);
+ set_fs(oldfs);
+ }
+
+@@ -1060,7 +1060,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
+
+ /* Write the data. */
+ oldfs = get_fs(); set_fs(KERNEL_DS);
+- host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
++ host_err = vfs_writev(file, (struct iovec __force_user *)vec, vlen, &offset);
+ set_fs(oldfs);
+ if (host_err < 0)
+ goto out_nfserr;
+@@ -1542,7 +1542,7 @@ nfsd_readlink(struct svc_rqst *rqstp, struct svc_fh *fhp, char *buf, int *lenp)
+ */
+
+ oldfs = get_fs(); set_fs(KERNEL_DS);
+- host_err = inode->i_op->readlink(dentry, buf, *lenp);
++ host_err = inode->i_op->readlink(dentry, (char __force_user *)buf, *lenp);
+ set_fs(oldfs);
+
+ if (host_err < 0)
+diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
+index f6af760..d0adf34 100644
+--- a/fs/nilfs2/ioctl.c
++++ b/fs/nilfs2/ioctl.c
+@@ -480,7 +480,7 @@ static int nilfs_ioctl_clean_segments(struct inode *inode, struct file *filp,
+ unsigned int cmd, void __user *argp)
+ {
+ struct nilfs_argv argv[5];
+- const static size_t argsz[5] = {
++ static const size_t argsz[5] = {
+ sizeof(struct nilfs_vdesc),
+ sizeof(struct nilfs_period),
+ sizeof(__u64),
+@@ -522,6 +522,9 @@ static int nilfs_ioctl_clean_segments(struct inode *inode, struct file *filp,
+ if (argv[n].v_nmembs > nsegs * nilfs->ns_blocks_per_segment)
+ goto out_free;
+
++ if (argv[n].v_nmembs >= UINT_MAX / argv[n].v_size)
++ goto out_free;
++
+ len = argv[n].v_size * argv[n].v_nmembs;
+ base = (void __user *)(unsigned long)argv[n].v_base;
+ if (len == 0) {
+diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
+index ad391a8..149a8a1 100644
+--- a/fs/nilfs2/the_nilfs.c
++++ b/fs/nilfs2/the_nilfs.c
+@@ -478,6 +478,7 @@ static int nilfs_load_super_block(struct the_nilfs *nilfs,
+ brelse(sbh[1]);
+ sbh[1] = NULL;
+ sbp[1] = NULL;
++ valid[1] = 0;
+ swp = 0;
+ }
+ if (!valid[swp]) {
+diff --git a/fs/notify/dnotify/dnotify.c b/fs/notify/dnotify/dnotify.c
+index 7e54e52..9337248 100644
+--- a/fs/notify/dnotify/dnotify.c
++++ b/fs/notify/dnotify/dnotify.c
+@@ -173,7 +173,7 @@ static void dnotify_free_mark(struct fsnotify_mark_entry *entry)
+ kmem_cache_free(dnotify_mark_entry_cache, dnentry);
+ }
+
+-static struct fsnotify_ops dnotify_fsnotify_ops = {
++static const struct fsnotify_ops dnotify_fsnotify_ops = {
+ .handle_event = dnotify_handle_event,
+ .should_send_event = dnotify_should_send_event,
+ .free_group_priv = NULL,
+diff --git a/fs/notify/notification.c b/fs/notify/notification.c
+index b8bf53b..c518688 100644
+--- a/fs/notify/notification.c
++++ b/fs/notify/notification.c
+@@ -57,7 +57,7 @@ static struct kmem_cache *fsnotify_event_holder_cachep;
+ * get set to 0 so it will never get 'freed'
+ */
+ static struct fsnotify_event q_overflow_event;
+-static atomic_t fsnotify_sync_cookie = ATOMIC_INIT(0);
++static atomic_unchecked_t fsnotify_sync_cookie = ATOMIC_INIT(0);
+
+ /**
+ * fsnotify_get_cookie - return a unique cookie for use in synchronizing events.
+@@ -65,7 +65,7 @@ static atomic_t fsnotify_sync_cookie = ATOMIC_INIT(0);
+ */
+ u32 fsnotify_get_cookie(void)
+ {
+- return atomic_inc_return(&fsnotify_sync_cookie);
++ return atomic_inc_return_unchecked(&fsnotify_sync_cookie);
+ }
+ EXPORT_SYMBOL_GPL(fsnotify_get_cookie);
+
+diff --git a/fs/ntfs/dir.c b/fs/ntfs/dir.c
+index 5a9e344..0f8cd28 100644
+--- a/fs/ntfs/dir.c
++++ b/fs/ntfs/dir.c
+@@ -1328,7 +1328,7 @@ find_next_index_buffer:
+ ia = (INDEX_ALLOCATION*)(kaddr + (ia_pos & ~PAGE_CACHE_MASK &
+ ~(s64)(ndir->itype.index.block_size - 1)));
+ /* Bounds checks. */
+- if (unlikely((u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
++ if (unlikely(!kaddr || (u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
+ ntfs_error(sb, "Out of bounds check failed. Corrupt directory "
+ "inode 0x%lx or driver bug.", vdir->i_ino);
+ goto err_out;
+diff --git a/fs/ntfs/file.c b/fs/ntfs/file.c
+index 663c0e3..b6868e9 100644
+--- a/fs/ntfs/file.c
++++ b/fs/ntfs/file.c
+@@ -2243,6 +2243,6 @@ const struct inode_operations ntfs_file_inode_ops = {
+ #endif /* NTFS_RW */
+ };
+
+-const struct file_operations ntfs_empty_file_ops = {};
++const struct file_operations ntfs_empty_file_ops __read_only;
+
+-const struct inode_operations ntfs_empty_inode_ops = {};
++const struct inode_operations ntfs_empty_inode_ops __read_only;
+diff --git a/fs/ocfs2/cluster/masklog.c b/fs/ocfs2/cluster/masklog.c
+index 1cd2934..880b5d2 100644
+--- a/fs/ocfs2/cluster/masklog.c
++++ b/fs/ocfs2/cluster/masklog.c
+@@ -135,7 +135,7 @@ static ssize_t mlog_store(struct kobject *obj, struct attribute *attr,
+ return mlog_mask_store(mlog_attr->mask, buf, count);
+ }
+
+-static struct sysfs_ops mlog_attr_ops = {
++static const struct sysfs_ops mlog_attr_ops = {
+ .show = mlog_show,
+ .store = mlog_store,
+ };
+diff --git a/fs/ocfs2/localalloc.c b/fs/ocfs2/localalloc.c
+index ac10f83..2cd2607 100644
+--- a/fs/ocfs2/localalloc.c
++++ b/fs/ocfs2/localalloc.c
+@@ -1188,7 +1188,7 @@ static int ocfs2_local_alloc_slide_window(struct ocfs2_super *osb,
+ goto bail;
+ }
+
+- atomic_inc(&osb->alloc_stats.moves);
++ atomic_inc_unchecked(&osb->alloc_stats.moves);
+
+ status = 0;
+ bail:
+diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
+index f010b22..9f9ed34 100644
+--- a/fs/ocfs2/namei.c
++++ b/fs/ocfs2/namei.c
+@@ -1043,6 +1043,8 @@ static int ocfs2_rename(struct inode *old_dir,
+ struct ocfs2_dir_lookup_result orphan_insert = { NULL, };
+ struct ocfs2_dir_lookup_result target_insert = { NULL, };
+
++ pax_track_stack();
++
+ /* At some point it might be nice to break this function up a
+ * bit. */
+
+diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
+index d963d86..914cfbd 100644
+--- a/fs/ocfs2/ocfs2.h
++++ b/fs/ocfs2/ocfs2.h
+@@ -217,11 +217,11 @@ enum ocfs2_vol_state
+
+ struct ocfs2_alloc_stats
+ {
+- atomic_t moves;
+- atomic_t local_data;
+- atomic_t bitmap_data;
+- atomic_t bg_allocs;
+- atomic_t bg_extends;
++ atomic_unchecked_t moves;
++ atomic_unchecked_t local_data;
++ atomic_unchecked_t bitmap_data;
++ atomic_unchecked_t bg_allocs;
++ atomic_unchecked_t bg_extends;
+ };
+
+ enum ocfs2_local_alloc_state
+diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
+index 79b5dac..d322952 100644
+--- a/fs/ocfs2/suballoc.c
++++ b/fs/ocfs2/suballoc.c
+@@ -623,7 +623,7 @@ static int ocfs2_reserve_suballoc_bits(struct ocfs2_super *osb,
+ mlog_errno(status);
+ goto bail;
+ }
+- atomic_inc(&osb->alloc_stats.bg_extends);
++ atomic_inc_unchecked(&osb->alloc_stats.bg_extends);
+
+ /* You should never ask for this much metadata */
+ BUG_ON(bits_wanted >
+@@ -1654,7 +1654,7 @@ int ocfs2_claim_metadata(struct ocfs2_super *osb,
+ mlog_errno(status);
+ goto bail;
+ }
+- atomic_inc(&osb->alloc_stats.bg_allocs);
++ atomic_inc_unchecked(&osb->alloc_stats.bg_allocs);
+
+ *blkno_start = bg_blkno + (u64) *suballoc_bit_start;
+ ac->ac_bits_given += (*num_bits);
+@@ -1728,7 +1728,7 @@ int ocfs2_claim_new_inode(struct ocfs2_super *osb,
+ mlog_errno(status);
+ goto bail;
+ }
+- atomic_inc(&osb->alloc_stats.bg_allocs);
++ atomic_inc_unchecked(&osb->alloc_stats.bg_allocs);
+
+ BUG_ON(num_bits != 1);
+
+@@ -1830,7 +1830,7 @@ int __ocfs2_claim_clusters(struct ocfs2_super *osb,
+ cluster_start,
+ num_clusters);
+ if (!status)
+- atomic_inc(&osb->alloc_stats.local_data);
++ atomic_inc_unchecked(&osb->alloc_stats.local_data);
+ } else {
+ if (min_clusters > (osb->bitmap_cpg - 1)) {
+ /* The only paths asking for contiguousness
+@@ -1858,7 +1858,7 @@ int __ocfs2_claim_clusters(struct ocfs2_super *osb,
+ ocfs2_desc_bitmap_to_cluster_off(ac->ac_inode,
+ bg_blkno,
+ bg_bit_off);
+- atomic_inc(&osb->alloc_stats.bitmap_data);
++ atomic_inc_unchecked(&osb->alloc_stats.bitmap_data);
+ }
+ }
+ if (status < 0) {
+diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
+index 9f55be4..a3f8048 100644
+--- a/fs/ocfs2/super.c
++++ b/fs/ocfs2/super.c
+@@ -284,11 +284,11 @@ static int ocfs2_osb_dump(struct ocfs2_super *osb, char *buf, int len)
+ "%10s => GlobalAllocs: %d LocalAllocs: %d "
+ "SubAllocs: %d LAWinMoves: %d SAExtends: %d\n",
+ "Stats",
+- atomic_read(&osb->alloc_stats.bitmap_data),
+- atomic_read(&osb->alloc_stats.local_data),
+- atomic_read(&osb->alloc_stats.bg_allocs),
+- atomic_read(&osb->alloc_stats.moves),
+- atomic_read(&osb->alloc_stats.bg_extends));
++ atomic_read_unchecked(&osb->alloc_stats.bitmap_data),
++ atomic_read_unchecked(&osb->alloc_stats.local_data),
++ atomic_read_unchecked(&osb->alloc_stats.bg_allocs),
++ atomic_read_unchecked(&osb->alloc_stats.moves),
++ atomic_read_unchecked(&osb->alloc_stats.bg_extends));
+
+ out += snprintf(buf + out, len - out,
+ "%10s => State: %u Descriptor: %llu Size: %u bits "
+@@ -2002,11 +2002,11 @@ static int ocfs2_initialize_super(struct super_block *sb,
+ spin_lock_init(&osb->osb_xattr_lock);
+ ocfs2_init_inode_steal_slot(osb);
+
+- atomic_set(&osb->alloc_stats.moves, 0);
+- atomic_set(&osb->alloc_stats.local_data, 0);
+- atomic_set(&osb->alloc_stats.bitmap_data, 0);
+- atomic_set(&osb->alloc_stats.bg_allocs, 0);
+- atomic_set(&osb->alloc_stats.bg_extends, 0);
++ atomic_set_unchecked(&osb->alloc_stats.moves, 0);
++ atomic_set_unchecked(&osb->alloc_stats.local_data, 0);
++ atomic_set_unchecked(&osb->alloc_stats.bitmap_data, 0);
++ atomic_set_unchecked(&osb->alloc_stats.bg_allocs, 0);
++ atomic_set_unchecked(&osb->alloc_stats.bg_extends, 0);
+
+ /* Copy the blockcheck stats from the superblock probe */
+ osb->osb_ecc_stats = *stats;
+diff --git a/fs/open.c b/fs/open.c
+index 4f01e06..2a8057a 100644
+--- a/fs/open.c
++++ b/fs/open.c
+@@ -275,6 +275,10 @@ static long do_sys_truncate(const char __user *pathname, loff_t length)
+ error = locks_verify_truncate(inode, NULL, length);
+ if (!error)
+ error = security_path_truncate(&path, length, 0);
++
++ if (!error && !gr_acl_handle_truncate(path.dentry, path.mnt))
++ error = -EACCES;
++
+ if (!error) {
+ vfs_dq_init(inode);
+ error = do_truncate(path.dentry, length, 0, NULL);
+@@ -511,6 +515,9 @@ SYSCALL_DEFINE3(faccessat, int, dfd, const char __user *, filename, int, mode)
+ if (__mnt_is_readonly(path.mnt))
+ res = -EROFS;
+
++ if (!res && !gr_acl_handle_access(path.dentry, path.mnt, mode))
++ res = -EACCES;
++
+ out_path_release:
+ path_put(&path);
+ out:
+@@ -537,6 +544,8 @@ SYSCALL_DEFINE1(chdir, const char __user *, filename)
+ if (error)
+ goto dput_and_out;
+
++ gr_log_chdir(path.dentry, path.mnt);
++
+ set_fs_pwd(current->fs, &path);
+
+ dput_and_out:
+@@ -563,6 +572,13 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd)
+ goto out_putf;
+
+ error = inode_permission(inode, MAY_EXEC | MAY_ACCESS);
++
++ if (!error && !gr_chroot_fchdir(file->f_path.dentry, file->f_path.mnt))
++ error = -EPERM;
++
++ if (!error)
++ gr_log_chdir(file->f_path.dentry, file->f_path.mnt);
++
+ if (!error)
+ set_fs_pwd(current->fs, &file->f_path);
+ out_putf:
+@@ -588,7 +604,13 @@ SYSCALL_DEFINE1(chroot, const char __user *, filename)
+ if (!capable(CAP_SYS_CHROOT))
+ goto dput_and_out;
+
++ if (gr_handle_chroot_chroot(path.dentry, path.mnt))
++ goto dput_and_out;
++
+ set_fs_root(current->fs, &path);
++
++ gr_handle_chroot_chdir(&path);
++
+ error = 0;
+ dput_and_out:
+ path_put(&path);
+@@ -596,66 +618,57 @@ out:
+ return error;
+ }
+
++static int chmod_common(struct path *path, umode_t mode)
++{
++ struct inode *inode = path->dentry->d_inode;
++ struct iattr newattrs;
++ int error;
++
++ error = mnt_want_write(path->mnt);
++ if (error)
++ return error;
++ mutex_lock(&inode->i_mutex);
++ if (!gr_acl_handle_chmod(path->dentry, path->mnt, &mode)) {
++ error = -EACCES;
++ goto out_unlock;
++ }
++ if (gr_handle_chroot_chmod(path->dentry, path->mnt, mode)) {
++ error = -EPERM;
++ goto out_unlock;
++ }
++ newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
++ newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
++ error = notify_change(path->dentry, &newattrs);
++out_unlock:
++ mutex_unlock(&inode->i_mutex);
++ mnt_drop_write(path->mnt);
++ return error;
++}
++
+ SYSCALL_DEFINE2(fchmod, unsigned int, fd, mode_t, mode)
+ {
+- struct inode * inode;
+- struct dentry * dentry;
+ struct file * file;
+ int err = -EBADF;
+- struct iattr newattrs;
+
+ file = fget(fd);
+- if (!file)
+- goto out;
+-
+- dentry = file->f_path.dentry;
+- inode = dentry->d_inode;
+-
+- audit_inode(NULL, dentry);
+-
+- err = mnt_want_write_file(file);
+- if (err)
+- goto out_putf;
+- mutex_lock(&inode->i_mutex);
+- if (mode == (mode_t) -1)
+- mode = inode->i_mode;
+- newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
+- newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
+- err = notify_change(dentry, &newattrs);
+- mutex_unlock(&inode->i_mutex);
+- mnt_drop_write(file->f_path.mnt);
+-out_putf:
+- fput(file);
+-out:
++ if (file) {
++ audit_inode(NULL, file->f_path.dentry);
++ err = chmod_common(&file->f_path, mode);
++ fput(file);
++ }
+ return err;
+ }
+
+ SYSCALL_DEFINE3(fchmodat, int, dfd, const char __user *, filename, mode_t, mode)
+ {
+ struct path path;
+- struct inode *inode;
+ int error;
+- struct iattr newattrs;
+
+ error = user_path_at(dfd, filename, LOOKUP_FOLLOW, &path);
+- if (error)
+- goto out;
+- inode = path.dentry->d_inode;
+-
+- error = mnt_want_write(path.mnt);
+- if (error)
+- goto dput_and_out;
+- mutex_lock(&inode->i_mutex);
+- if (mode == (mode_t) -1)
+- mode = inode->i_mode;
+- newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
+- newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
+- error = notify_change(path.dentry, &newattrs);
+- mutex_unlock(&inode->i_mutex);
+- mnt_drop_write(path.mnt);
+-dput_and_out:
+- path_put(&path);
+-out:
++ if (!error) {
++ error = chmod_common(&path, mode);
++ path_put(&path);
++ }
+ return error;
+ }
+
+@@ -664,12 +677,15 @@ SYSCALL_DEFINE2(chmod, const char __user *, filename, mode_t, mode)
+ return sys_fchmodat(AT_FDCWD, filename, mode);
+ }
+
+-static int chown_common(struct dentry * dentry, uid_t user, gid_t group)
++static int chown_common(struct dentry * dentry, uid_t user, gid_t group, struct vfsmount *mnt)
+ {
+ struct inode *inode = dentry->d_inode;
+ int error;
+ struct iattr newattrs;
+
++ if (!gr_acl_handle_chown(dentry, mnt))
++ return -EACCES;
++
+ newattrs.ia_valid = ATTR_CTIME;
+ if (user != (uid_t) -1) {
+ newattrs.ia_valid |= ATTR_UID;
+@@ -700,7 +716,7 @@ SYSCALL_DEFINE3(chown, const char __user *, filename, uid_t, user, gid_t, group)
+ error = mnt_want_write(path.mnt);
+ if (error)
+ goto out_release;
+- error = chown_common(path.dentry, user, group);
++ error = chown_common(path.dentry, user, group, path.mnt);
+ mnt_drop_write(path.mnt);
+ out_release:
+ path_put(&path);
+@@ -725,7 +741,7 @@ SYSCALL_DEFINE5(fchownat, int, dfd, const char __user *, filename, uid_t, user,
+ error = mnt_want_write(path.mnt);
+ if (error)
+ goto out_release;
+- error = chown_common(path.dentry, user, group);
++ error = chown_common(path.dentry, user, group, path.mnt);
+ mnt_drop_write(path.mnt);
+ out_release:
+ path_put(&path);
+@@ -744,7 +760,7 @@ SYSCALL_DEFINE3(lchown, const char __user *, filename, uid_t, user, gid_t, group
+ error = mnt_want_write(path.mnt);
+ if (error)
+ goto out_release;
+- error = chown_common(path.dentry, user, group);
++ error = chown_common(path.dentry, user, group, path.mnt);
+ mnt_drop_write(path.mnt);
+ out_release:
+ path_put(&path);
+@@ -767,7 +783,7 @@ SYSCALL_DEFINE3(fchown, unsigned int, fd, uid_t, user, gid_t, group)
+ goto out_fput;
+ dentry = file->f_path.dentry;
+ audit_inode(NULL, dentry);
+- error = chown_common(dentry, user, group);
++ error = chown_common(dentry, user, group, file->f_path.mnt);
+ mnt_drop_write(file->f_path.mnt);
+ out_fput:
+ fput(file);
+@@ -1036,7 +1052,7 @@ long do_sys_open(int dfd, const char __user *filename, int flags, int mode)
+ if (!IS_ERR(tmp)) {
+ fd = get_unused_fd_flags(flags);
+ if (fd >= 0) {
+- struct file *f = do_filp_open(dfd, tmp, flags, mode, 0);
++ struct file *f = do_filp_open(dfd, tmp, flags, mode, 0);
+ if (IS_ERR(f)) {
+ put_unused_fd(fd);
+ fd = PTR_ERR(f);
+diff --git a/fs/partitions/efi.c b/fs/partitions/efi.c
+index 6ab70f4..f4103d1 100644
+--- a/fs/partitions/efi.c
++++ b/fs/partitions/efi.c
+@@ -231,14 +231,14 @@ alloc_read_gpt_entries(struct block_device *bdev, gpt_header *gpt)
+ if (!bdev || !gpt)
+ return NULL;
+
++ if (!le32_to_cpu(gpt->num_partition_entries))
++ return NULL;
++ pte = kcalloc(le32_to_cpu(gpt->num_partition_entries), le32_to_cpu(gpt->sizeof_partition_entry), GFP_KERNEL);
++ if (!pte)
++ return NULL;
++
+ count = le32_to_cpu(gpt->num_partition_entries) *
+ le32_to_cpu(gpt->sizeof_partition_entry);
+- if (!count)
+- return NULL;
+- pte = kzalloc(count, GFP_KERNEL);
+- if (!pte)
+- return NULL;
+-
+ if (read_lba(bdev, le64_to_cpu(gpt->partition_entry_lba),
+ (u8 *) pte,
+ count) < count) {
+diff --git a/fs/partitions/ldm.c b/fs/partitions/ldm.c
+index dd6efdb..3babc6c 100644
+--- a/fs/partitions/ldm.c
++++ b/fs/partitions/ldm.c
+@@ -1311,6 +1311,7 @@ static bool ldm_frag_add (const u8 *data, int size, struct list_head *frags)
+ ldm_error ("A VBLK claims to have %d parts.", num);
+ return false;
+ }
++
+ if (rec >= num) {
+ ldm_error("REC value (%d) exceeds NUM value (%d)", rec, num);
+ return false;
+@@ -1322,7 +1323,7 @@ static bool ldm_frag_add (const u8 *data, int size, struct list_head *frags)
+ goto found;
+ }
+
+- f = kmalloc (sizeof (*f) + size*num, GFP_KERNEL);
++ f = kmalloc (size*num + sizeof (*f), GFP_KERNEL);
+ if (!f) {
+ ldm_crit ("Out of memory.");
+ return false;
+diff --git a/fs/partitions/mac.c b/fs/partitions/mac.c
+index 5765198..7f8e9e0 100644
+--- a/fs/partitions/mac.c
++++ b/fs/partitions/mac.c
+@@ -59,11 +59,11 @@ int mac_partition(struct parsed_partitions *state, struct block_device *bdev)
+ return 0; /* not a MacOS disk */
+ }
+ blocks_in_map = be32_to_cpu(part->map_count);
+- if (blocks_in_map < 0 || blocks_in_map >= DISK_MAX_PARTS) {
+- put_dev_sector(sect);
+- return 0;
+- }
+ printk(" [mac]");
++ if (blocks_in_map < 0 || blocks_in_map >= DISK_MAX_PARTS) {
++ put_dev_sector(sect);
++ return 0;
++ }
+ for (slot = 1; slot <= blocks_in_map; ++slot) {
+ int pos = slot * secsize;
+ put_dev_sector(sect);
+diff --git a/fs/pipe.c b/fs/pipe.c
+index d0cc080..8a6f211 100644
+--- a/fs/pipe.c
++++ b/fs/pipe.c
+@@ -401,9 +401,9 @@ redo:
+ }
+ if (bufs) /* More to do? */
+ continue;
+- if (!pipe->writers)
++ if (!atomic_read(&pipe->writers))
+ break;
+- if (!pipe->waiting_writers) {
++ if (!atomic_read(&pipe->waiting_writers)) {
+ /* syscall merging: Usually we must not sleep
+ * if O_NONBLOCK is set, or if we got some data.
+ * But if a writer sleeps in kernel space, then
+@@ -462,7 +462,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
+ mutex_lock(&inode->i_mutex);
+ pipe = inode->i_pipe;
+
+- if (!pipe->readers) {
++ if (!atomic_read(&pipe->readers)) {
+ send_sig(SIGPIPE, current, 0);
+ ret = -EPIPE;
+ goto out;
+@@ -511,7 +511,7 @@ redo1:
+ for (;;) {
+ int bufs;
+
+- if (!pipe->readers) {
++ if (!atomic_read(&pipe->readers)) {
+ send_sig(SIGPIPE, current, 0);
+ if (!ret)
+ ret = -EPIPE;
+@@ -597,9 +597,9 @@ redo2:
+ kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
+ do_wakeup = 0;
+ }
+- pipe->waiting_writers++;
++ atomic_inc(&pipe->waiting_writers);
+ pipe_wait(pipe);
+- pipe->waiting_writers--;
++ atomic_dec(&pipe->waiting_writers);
+ }
+ out:
+ mutex_unlock(&inode->i_mutex);
+@@ -666,7 +666,7 @@ pipe_poll(struct file *filp, poll_table *wait)
+ mask = 0;
+ if (filp->f_mode & FMODE_READ) {
+ mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0;
+- if (!pipe->writers && filp->f_version != pipe->w_counter)
++ if (!atomic_read(&pipe->writers) && filp->f_version != pipe->w_counter)
+ mask |= POLLHUP;
+ }
+
+@@ -676,7 +676,7 @@ pipe_poll(struct file *filp, poll_table *wait)
+ * Most Unices do not set POLLERR for FIFOs but on Linux they
+ * behave exactly like pipes for poll().
+ */
+- if (!pipe->readers)
++ if (!atomic_read(&pipe->readers))
+ mask |= POLLERR;
+ }
+
+@@ -690,10 +690,10 @@ pipe_release(struct inode *inode, int decr, int decw)
+
+ mutex_lock(&inode->i_mutex);
+ pipe = inode->i_pipe;
+- pipe->readers -= decr;
+- pipe->writers -= decw;
++ atomic_sub(decr, &pipe->readers);
++ atomic_sub(decw, &pipe->writers);
+
+- if (!pipe->readers && !pipe->writers) {
++ if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers)) {
+ free_pipe_info(inode);
+ } else {
+ wake_up_interruptible_sync(&pipe->wait);
+@@ -783,7 +783,7 @@ pipe_read_open(struct inode *inode, struct file *filp)
+
+ if (inode->i_pipe) {
+ ret = 0;
+- inode->i_pipe->readers++;
++ atomic_inc(&inode->i_pipe->readers);
+ }
+
+ mutex_unlock(&inode->i_mutex);
+@@ -800,7 +800,7 @@ pipe_write_open(struct inode *inode, struct file *filp)
+
+ if (inode->i_pipe) {
+ ret = 0;
+- inode->i_pipe->writers++;
++ atomic_inc(&inode->i_pipe->writers);
+ }
+
+ mutex_unlock(&inode->i_mutex);
+@@ -818,9 +818,9 @@ pipe_rdwr_open(struct inode *inode, struct file *filp)
+ if (inode->i_pipe) {
+ ret = 0;
+ if (filp->f_mode & FMODE_READ)
+- inode->i_pipe->readers++;
++ atomic_inc(&inode->i_pipe->readers);
+ if (filp->f_mode & FMODE_WRITE)
+- inode->i_pipe->writers++;
++ atomic_inc(&inode->i_pipe->writers);
+ }
+
+ mutex_unlock(&inode->i_mutex);
+@@ -905,7 +905,7 @@ void free_pipe_info(struct inode *inode)
+ inode->i_pipe = NULL;
+ }
+
+-static struct vfsmount *pipe_mnt __read_mostly;
++struct vfsmount *pipe_mnt __read_mostly;
+ static int pipefs_delete_dentry(struct dentry *dentry)
+ {
+ /*
+@@ -945,7 +945,8 @@ static struct inode * get_pipe_inode(void)
+ goto fail_iput;
+ inode->i_pipe = pipe;
+
+- pipe->readers = pipe->writers = 1;
++ atomic_set(&pipe->readers, 1);
++ atomic_set(&pipe->writers, 1);
+ inode->i_fop = &rdwr_pipefifo_fops;
+
+ /*
+diff --git a/fs/proc/Kconfig b/fs/proc/Kconfig
+index 50f8f06..c5755df 100644
+--- a/fs/proc/Kconfig
++++ b/fs/proc/Kconfig
+@@ -30,12 +30,12 @@ config PROC_FS
+
+ config PROC_KCORE
+ bool "/proc/kcore support" if !ARM
+- depends on PROC_FS && MMU
++ depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
+
+ config PROC_VMCORE
+ bool "/proc/vmcore support (EXPERIMENTAL)"
+- depends on PROC_FS && CRASH_DUMP
+- default y
++ depends on PROC_FS && CRASH_DUMP && !GRKERNSEC
++ default n
+ help
+ Exports the dump image of crashed kernel in ELF format.
+
+@@ -59,8 +59,8 @@ config PROC_SYSCTL
+ limited in memory.
+
+ config PROC_PAGE_MONITOR
+- default y
+- depends on PROC_FS && MMU
++ default n
++ depends on PROC_FS && MMU && !GRKERNSEC
+ bool "Enable /proc page monitoring" if EMBEDDED
+ help
+ Various /proc files exist to monitor process memory utilization:
+diff --git a/fs/proc/array.c b/fs/proc/array.c
+index c5ef152..28c94f7 100644
+--- a/fs/proc/array.c
++++ b/fs/proc/array.c
+@@ -60,6 +60,7 @@
+ #include <linux/tty.h>
+ #include <linux/string.h>
+ #include <linux/mman.h>
++#include <linux/grsecurity.h>
+ #include <linux/proc_fs.h>
+ #include <linux/ioport.h>
+ #include <linux/uaccess.h>
+@@ -321,6 +322,21 @@ static inline void task_context_switch_counts(struct seq_file *m,
+ p->nivcsw);
+ }
+
++#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
++static inline void task_pax(struct seq_file *m, struct task_struct *p)
++{
++ if (p->mm)
++ seq_printf(m, "PaX:\t%c%c%c%c%c\n",
++ p->mm->pax_flags & MF_PAX_PAGEEXEC ? 'P' : 'p',
++ p->mm->pax_flags & MF_PAX_EMUTRAMP ? 'E' : 'e',
++ p->mm->pax_flags & MF_PAX_MPROTECT ? 'M' : 'm',
++ p->mm->pax_flags & MF_PAX_RANDMMAP ? 'R' : 'r',
++ p->mm->pax_flags & MF_PAX_SEGMEXEC ? 'S' : 's');
++ else
++ seq_printf(m, "PaX:\t-----\n");
++}
++#endif
++
+ int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
+ struct pid *pid, struct task_struct *task)
+ {
+@@ -337,9 +353,24 @@ int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
+ task_cap(m, task);
+ cpuset_task_status_allowed(m, task);
+ task_context_switch_counts(m, task);
++
++#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
++ task_pax(m, task);
++#endif
++
++#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
++ task_grsec_rbac(m, task);
++#endif
++
+ return 0;
+ }
+
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
++ (_mm->pax_flags & MF_PAX_RANDMMAP || \
++ _mm->pax_flags & MF_PAX_SEGMEXEC))
++#endif
++
+ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
+ struct pid *pid, struct task_struct *task, int whole)
+ {
+@@ -358,9 +389,18 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
+ cputime_t cutime, cstime, utime, stime;
+ cputime_t cgtime, gtime;
+ unsigned long rsslim = 0;
+- char tcomm[sizeof(task->comm)];
++ char tcomm[sizeof(task->comm)] = { 0 };
+ unsigned long flags;
+
++ pax_track_stack();
++
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++ if (current->exec_id != m->exec_id) {
++ gr_log_badprocpid("stat");
++ return 0;
++ }
++#endif
++
+ state = *get_task_state(task);
+ vsize = eip = esp = 0;
+ permitted = ptrace_may_access(task, PTRACE_MODE_READ);
+@@ -433,6 +473,19 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
+ gtime = task_gtime(task);
+ }
+
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++ if (PAX_RAND_FLAGS(mm)) {
++ eip = 0;
++ esp = 0;
++ wchan = 0;
++ }
++#endif
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ wchan = 0;
++ eip =0;
++ esp =0;
++#endif
++
+ /* scale priority and nice values from timeslices to -20..20 */
+ /* to make it look like a "normal" Unix priority/nice value */
+ priority = task_prio(task);
+@@ -473,9 +526,15 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
+ vsize,
+ mm ? get_mm_rss(mm) : 0,
+ rsslim,
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++ PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->start_code : 1) : 0),
++ PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->end_code : 1) : 0),
++ PAX_RAND_FLAGS(mm) ? 0 : ((permitted && mm) ? mm->start_stack : 0),
++#else
+ mm ? (permitted ? mm->start_code : 1) : 0,
+ mm ? (permitted ? mm->end_code : 1) : 0,
+ (permitted && mm) ? mm->start_stack : 0,
++#endif
+ esp,
+ eip,
+ /* The signal information here is obsolete.
+@@ -517,8 +576,16 @@ int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
+ struct pid *pid, struct task_struct *task)
+ {
+ int size = 0, resident = 0, shared = 0, text = 0, lib = 0, data = 0;
+- struct mm_struct *mm = get_task_mm(task);
++ struct mm_struct *mm;
+
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++ if (current->exec_id != m->exec_id) {
++ gr_log_badprocpid("statm");
++ return 0;
++ }
++#endif
++
++ mm = get_task_mm(task);
+ if (mm) {
+ size = task_statm(mm, &shared, &text, &data, &resident);
+ mmput(mm);
+@@ -528,3 +595,18 @@ int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
+
+ return 0;
+ }
++
++#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
++int proc_pid_ipaddr(struct task_struct *task, char *buffer)
++{
++ u32 curr_ip = 0;
++ unsigned long flags;
++
++ if (lock_task_sighand(task, &flags)) {
++ curr_ip = task->signal->curr_ip;
++ unlock_task_sighand(task, &flags);
++ }
++
++ return sprintf(buffer, "%pI4\n", &curr_ip);
++}
++#endif
+diff --git a/fs/proc/base.c b/fs/proc/base.c
+index 67f7dc0..a86ad9a 100644
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -102,6 +102,22 @@ struct pid_entry {
+ union proc_op op;
+ };
+
++struct getdents_callback {
++ struct linux_dirent __user * current_dir;
++ struct linux_dirent __user * previous;
++ struct file * file;
++ int count;
++ int error;
++};
++
++static int gr_fake_filldir(void * __buf, const char *name, int namlen,
++ loff_t offset, u64 ino, unsigned int d_type)
++{
++ struct getdents_callback * buf = (struct getdents_callback *) __buf;
++ buf->error = -EINVAL;
++ return 0;
++}
++
+ #define NOD(NAME, MODE, IOP, FOP, OP) { \
+ .name = (NAME), \
+ .len = sizeof(NAME) - 1, \
+@@ -213,6 +229,9 @@ static int check_mem_permission(struct task_struct *task)
+ if (task == current)
+ return 0;
+
++ if (gr_handle_proc_ptrace(task) || gr_acl_handle_procpidmem(task))
++ return -EPERM;
++
+ /*
+ * If current is actively ptrace'ing, and would also be
+ * permitted to freshly attach with ptrace now, permit it.
+@@ -260,6 +279,9 @@ static int proc_pid_cmdline(struct task_struct *task, char * buffer)
+ if (!mm->arg_end)
+ goto out_mm; /* Shh! No looking before we're done */
+
++ if (gr_acl_handle_procpidmem(task))
++ goto out_mm;
++
+ len = mm->arg_end - mm->arg_start;
+
+ if (len > PAGE_SIZE)
+@@ -287,12 +309,28 @@ out:
+ return res;
+ }
+
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
++ (_mm->pax_flags & MF_PAX_RANDMMAP || \
++ _mm->pax_flags & MF_PAX_SEGMEXEC))
++#endif
++
+ static int proc_pid_auxv(struct task_struct *task, char *buffer)
+ {
+ int res = 0;
+ struct mm_struct *mm = get_task_mm(task);
+ if (mm) {
+ unsigned int nwords = 0;
++
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++ /* allow if we're currently ptracing this task */
++ if (PAX_RAND_FLAGS(mm) &&
++ (!(task->ptrace & PT_PTRACED) || (task->parent != current))) {
++ mmput(mm);
++ return 0;
++ }
++#endif
++
+ do {
+ nwords += 2;
+ } while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
+@@ -306,7 +344,7 @@ static int proc_pid_auxv(struct task_struct *task, char *buffer)
+ }
+
+
+-#ifdef CONFIG_KALLSYMS
++#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
+ /*
+ * Provides a wchan file via kallsyms in a proper one-value-per-file format.
+ * Returns the resolved symbol. If that fails, simply return the address.
+@@ -345,7 +383,7 @@ static void unlock_trace(struct task_struct *task)
+ mutex_unlock(&task->cred_guard_mutex);
+ }
+
+-#ifdef CONFIG_STACKTRACE
++#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
+
+ #define MAX_STACK_TRACE_DEPTH 64
+
+@@ -545,7 +583,7 @@ static int proc_pid_limits(struct task_struct *task, char *buffer)
+ return count;
+ }
+
+-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
++#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
+ static int proc_pid_syscall(struct task_struct *task, char *buffer)
+ {
+ long nr;
+@@ -574,7 +612,7 @@ static int proc_pid_syscall(struct task_struct *task, char *buffer)
+ /************************************************************************/
+
+ /* permission checks */
+-static int proc_fd_access_allowed(struct inode *inode)
++static int proc_fd_access_allowed(struct inode *inode, unsigned int log)
+ {
+ struct task_struct *task;
+ int allowed = 0;
+@@ -584,7 +622,10 @@ static int proc_fd_access_allowed(struct inode *inode)
+ */
+ task = get_proc_task(inode);
+ if (task) {
+- allowed = ptrace_may_access(task, PTRACE_MODE_READ);
++ if (log)
++ allowed = ptrace_may_access_log(task, PTRACE_MODE_READ);
++ else
++ allowed = ptrace_may_access(task, PTRACE_MODE_READ);
+ put_task_struct(task);
+ }
+ return allowed;
+@@ -806,9 +847,16 @@ static const struct file_operations proc_single_file_operations = {
+ static int mem_open(struct inode* inode, struct file* file)
+ {
+ file->private_data = (void*)((long)current->self_exec_id);
++
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++ file->f_version = current->exec_id;
++#endif
++
+ return 0;
+ }
+
++static int task_dumpable(struct task_struct *task);
++
+ static ssize_t mem_read(struct file * file, char __user * buf,
+ size_t count, loff_t *ppos)
+ {
+@@ -818,6 +866,13 @@ static ssize_t mem_read(struct file * file, char __user * buf,
+ int ret = -ESRCH;
+ struct mm_struct *mm;
+
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++ if (file->f_version != current->exec_id) {
++ gr_log_badprocpid("mem");
++ return 0;
++ }
++#endif
++
+ if (!task)
+ goto out_no_task;
+
+@@ -963,6 +1018,9 @@ static ssize_t environ_read(struct file *file, char __user *buf,
+ if (!task)
+ goto out_no_task;
+
++ if (gr_acl_handle_procpidmem(task))
++ goto out;
++
+ if (!ptrace_may_access(task, PTRACE_MODE_READ))
+ goto out;
+
+@@ -1377,7 +1435,7 @@ static void *proc_pid_follow_link(struct dentry *dentry, struct nameidata *nd)
+ path_put(&nd->path);
+
+ /* Are we allowed to snoop on the tasks file descriptors? */
+- if (!proc_fd_access_allowed(inode))
++ if (!proc_fd_access_allowed(inode,0))
+ goto out;
+
+ error = PROC_I(inode)->op.proc_get_link(inode, &nd->path);
+@@ -1417,8 +1475,18 @@ static int proc_pid_readlink(struct dentry * dentry, char __user * buffer, int b
+ struct path path;
+
+ /* Are we allowed to snoop on the tasks file descriptors? */
+- if (!proc_fd_access_allowed(inode))
+- goto out;
++ /* logging this is needed for learning on chromium to work properly,
++ but we don't want to flood the logs from 'ps' which does a readlink
++ on /proc/fd/2 of tasks in the listing, nor do we want 'ps' to learn
++ CAP_SYS_PTRACE as it's not necessary for its basic functionality
++ */
++ if (dentry->d_name.name[0] == '2' && dentry->d_name.name[1] == '\0') {
++ if (!proc_fd_access_allowed(inode,0))
++ goto out;
++ } else {
++ if (!proc_fd_access_allowed(inode,1))
++ goto out;
++ }
+
+ error = PROC_I(inode)->op.proc_get_link(inode, &path);
+ if (error)
+@@ -1483,7 +1551,11 @@ static struct inode *proc_pid_make_inode(struct super_block * sb, struct task_st
+ rcu_read_lock();
+ cred = __task_cred(task);
+ inode->i_uid = cred->euid;
++#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
++ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
++#else
+ inode->i_gid = cred->egid;
++#endif
+ rcu_read_unlock();
+ }
+ security_task_to_inode(task, inode);
+@@ -1501,6 +1573,9 @@ static int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat
+ struct inode *inode = dentry->d_inode;
+ struct task_struct *task;
+ const struct cred *cred;
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++ const struct cred *tmpcred = current_cred();
++#endif
+
+ generic_fillattr(inode, stat);
+
+@@ -1508,13 +1583,41 @@ static int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat
+ stat->uid = 0;
+ stat->gid = 0;
+ task = pid_task(proc_pid(inode), PIDTYPE_PID);
++
++ if (task && (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))) {
++ rcu_read_unlock();
++ return -ENOENT;
++ }
++
+ if (task) {
++ cred = __task_cred(task);
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++ if (!tmpcred->uid || (tmpcred->uid == cred->uid)
++#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
++ || in_group_p(CONFIG_GRKERNSEC_PROC_GID)
++#endif
++ ) {
++#endif
+ if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
++#endif
+ task_dumpable(task)) {
+- cred = __task_cred(task);
+ stat->uid = cred->euid;
++#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
++ stat->gid = CONFIG_GRKERNSEC_PROC_GID;
++#else
+ stat->gid = cred->egid;
++#endif
+ }
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++ } else {
++ rcu_read_unlock();
++ return -ENOENT;
++ }
++#endif
+ }
+ rcu_read_unlock();
+ return 0;
+@@ -1545,11 +1648,20 @@ static int pid_revalidate(struct dentry *dentry, struct nameidata *nd)
+
+ if (task) {
+ if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
++#endif
+ task_dumpable(task)) {
+ rcu_read_lock();
+ cred = __task_cred(task);
+ inode->i_uid = cred->euid;
++#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
++ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
++#else
+ inode->i_gid = cred->egid;
++#endif
+ rcu_read_unlock();
+ } else {
+ inode->i_uid = 0;
+@@ -1670,7 +1782,8 @@ static int proc_fd_info(struct inode *inode, struct path *path, char *info)
+ int fd = proc_fd(inode);
+
+ if (task) {
+- files = get_files_struct(task);
++ if (!gr_acl_handle_procpidmem(task))
++ files = get_files_struct(task);
+ put_task_struct(task);
+ }
+ if (files) {
+@@ -1922,12 +2035,22 @@ static const struct file_operations proc_fd_operations = {
+ static int proc_fd_permission(struct inode *inode, int mask)
+ {
+ int rv;
++ struct task_struct *task;
+
+ rv = generic_permission(inode, mask, NULL);
+- if (rv == 0)
+- return 0;
++
+ if (task_pid(current) == proc_pid(inode))
+ rv = 0;
++
++ task = get_proc_task(inode);
++ if (task == NULL)
++ return rv;
++
++ if (gr_acl_handle_procpidmem(task))
++ rv = -EACCES;
++
++ put_task_struct(task);
++
+ return rv;
+ }
+
+@@ -2036,6 +2159,9 @@ static struct dentry *proc_pident_lookup(struct inode *dir,
+ if (!task)
+ goto out_no_task;
+
++ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
++ goto out;
++
+ /*
+ * Yes, it does not scale. And it should not. Don't add
+ * new entries into /proc/<tgid>/ without very good reasons.
+@@ -2080,6 +2206,9 @@ static int proc_pident_readdir(struct file *filp,
+ if (!task)
+ goto out_no_task;
+
++ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
++ goto out;
++
+ ret = 0;
+ i = filp->f_pos;
+ switch (i) {
+@@ -2347,7 +2476,7 @@ static void *proc_self_follow_link(struct dentry *dentry, struct nameidata *nd)
+ static void proc_self_put_link(struct dentry *dentry, struct nameidata *nd,
+ void *cookie)
+ {
+- char *s = nd_get_link(nd);
++ const char *s = nd_get_link(nd);
+ if (!IS_ERR(s))
+ __putname(s);
+ }
+@@ -2553,7 +2682,7 @@ static const struct pid_entry tgid_base_stuff[] = {
+ #ifdef CONFIG_SCHED_DEBUG
+ REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations),
+ #endif
+-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
++#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
+ INF("syscall", S_IRUGO, proc_pid_syscall),
+ #endif
+ INF("cmdline", S_IRUGO, proc_pid_cmdline),
+@@ -2578,10 +2707,10 @@ static const struct pid_entry tgid_base_stuff[] = {
+ #ifdef CONFIG_SECURITY
+ DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
+ #endif
+-#ifdef CONFIG_KALLSYMS
++#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
+ INF("wchan", S_IRUGO, proc_pid_wchan),
+ #endif
+-#ifdef CONFIG_STACKTRACE
++#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
+ ONE("stack", S_IRUGO, proc_pid_stack),
+ #endif
+ #ifdef CONFIG_SCHEDSTATS
+@@ -2611,6 +2740,9 @@ static const struct pid_entry tgid_base_stuff[] = {
+ #ifdef CONFIG_TASK_IO_ACCOUNTING
+ INF("io", S_IRUSR, proc_tgid_io_accounting),
+ #endif
++#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
++ INF("ipaddr", S_IRUSR, proc_pid_ipaddr),
++#endif
+ };
+
+ static int proc_tgid_base_readdir(struct file * filp,
+@@ -2735,7 +2867,14 @@ static struct dentry *proc_pid_instantiate(struct inode *dir,
+ if (!inode)
+ goto out;
+
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++ inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
++ inode->i_mode = S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP;
++#else
+ inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
++#endif
+ inode->i_op = &proc_tgid_base_inode_operations;
+ inode->i_fop = &proc_tgid_base_operations;
+ inode->i_flags|=S_IMMUTABLE;
+@@ -2777,7 +2916,11 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, struct
+ if (!task)
+ goto out;
+
++ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
++ goto out_put_task;
++
+ result = proc_pid_instantiate(dir, dentry, task, NULL);
++out_put_task:
+ put_task_struct(task);
+ out:
+ return result;
+@@ -2842,6 +2985,11 @@ int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
+ {
+ unsigned int nr;
+ struct task_struct *reaper;
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++ const struct cred *tmpcred = current_cred();
++ const struct cred *itercred;
++#endif
++ filldir_t __filldir = filldir;
+ struct tgid_iter iter;
+ struct pid_namespace *ns;
+
+@@ -2865,8 +3013,27 @@ int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
+ for (iter = next_tgid(ns, iter);
+ iter.task;
+ iter.tgid += 1, iter = next_tgid(ns, iter)) {
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++ rcu_read_lock();
++ itercred = __task_cred(iter.task);
++#endif
++ if (gr_pid_is_chrooted(iter.task) || gr_check_hidden_task(iter.task)
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++ || (tmpcred->uid && (itercred->uid != tmpcred->uid)
++#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
++ && !in_group_p(CONFIG_GRKERNSEC_PROC_GID)
++#endif
++ )
++#endif
++ )
++ __filldir = &gr_fake_filldir;
++ else
++ __filldir = filldir;
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++ rcu_read_unlock();
++#endif
+ filp->f_pos = iter.tgid + TGID_OFFSET;
+- if (proc_pid_fill_cache(filp, dirent, filldir, iter) < 0) {
++ if (proc_pid_fill_cache(filp, dirent, __filldir, iter) < 0) {
+ put_task_struct(iter.task);
+ goto out;
+ }
+@@ -2892,7 +3059,7 @@ static const struct pid_entry tid_base_stuff[] = {
+ #ifdef CONFIG_SCHED_DEBUG
+ REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations),
+ #endif
+-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
++#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
+ INF("syscall", S_IRUGO, proc_pid_syscall),
+ #endif
+ INF("cmdline", S_IRUGO, proc_pid_cmdline),
+@@ -2916,10 +3083,10 @@ static const struct pid_entry tid_base_stuff[] = {
+ #ifdef CONFIG_SECURITY
+ DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
+ #endif
+-#ifdef CONFIG_KALLSYMS
++#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
+ INF("wchan", S_IRUGO, proc_pid_wchan),
+ #endif
+-#ifdef CONFIG_STACKTRACE
++#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
+ ONE("stack", S_IRUGO, proc_pid_stack),
+ #endif
+ #ifdef CONFIG_SCHEDSTATS
+diff --git a/fs/proc/cmdline.c b/fs/proc/cmdline.c
+index 82676e3..5f8518a 100644
+--- a/fs/proc/cmdline.c
++++ b/fs/proc/cmdline.c
+@@ -23,7 +23,11 @@ static const struct file_operations cmdline_proc_fops = {
+
+ static int __init proc_cmdline_init(void)
+ {
++#ifdef CONFIG_GRKERNSEC_PROC_ADD
++ proc_create_grsec("cmdline", 0, NULL, &cmdline_proc_fops);
++#else
+ proc_create("cmdline", 0, NULL, &cmdline_proc_fops);
++#endif
+ return 0;
+ }
+ module_init(proc_cmdline_init);
+diff --git a/fs/proc/devices.c b/fs/proc/devices.c
+index 59ee7da..469b4b6 100644
+--- a/fs/proc/devices.c
++++ b/fs/proc/devices.c
+@@ -64,7 +64,11 @@ static const struct file_operations proc_devinfo_operations = {
+
+ static int __init proc_devices_init(void)
+ {
++#ifdef CONFIG_GRKERNSEC_PROC_ADD
++ proc_create_grsec("devices", 0, NULL, &proc_devinfo_operations);
++#else
+ proc_create("devices", 0, NULL, &proc_devinfo_operations);
++#endif
+ return 0;
+ }
+ module_init(proc_devices_init);
+diff --git a/fs/proc/inode.c b/fs/proc/inode.c
+index d78ade3..81767f9 100644
+--- a/fs/proc/inode.c
++++ b/fs/proc/inode.c
+@@ -18,12 +18,19 @@
+ #include <linux/module.h>
+ #include <linux/smp_lock.h>
+ #include <linux/sysctl.h>
++#include <linux/grsecurity.h>
+
+ #include <asm/system.h>
+ #include <asm/uaccess.h>
+
+ #include "internal.h"
+
++#ifdef CONFIG_PROC_SYSCTL
++extern const struct inode_operations proc_sys_inode_operations;
++extern const struct inode_operations proc_sys_dir_operations;
++#endif
++
++
+ struct proc_dir_entry *de_get(struct proc_dir_entry *de)
+ {
+ atomic_inc(&de->count);
+@@ -62,6 +69,13 @@ static void proc_delete_inode(struct inode *inode)
+ de_put(de);
+ if (PROC_I(inode)->sysctl)
+ sysctl_head_put(PROC_I(inode)->sysctl);
++
++#ifdef CONFIG_PROC_SYSCTL
++ if (inode->i_op == &proc_sys_inode_operations ||
++ inode->i_op == &proc_sys_dir_operations)
++ gr_handle_delete(inode->i_ino, inode->i_sb->s_dev);
++#endif
++
+ clear_inode(inode);
+ }
+
+@@ -457,7 +471,11 @@ struct inode *proc_get_inode(struct super_block *sb, unsigned int ino,
+ if (de->mode) {
+ inode->i_mode = de->mode;
+ inode->i_uid = de->uid;
++#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
++ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
++#else
+ inode->i_gid = de->gid;
++#endif
+ }
+ if (de->size)
+ inode->i_size = de->size;
+diff --git a/fs/proc/internal.h b/fs/proc/internal.h
+index 753ca37..26bcf3b 100644
+--- a/fs/proc/internal.h
++++ b/fs/proc/internal.h
+@@ -51,6 +51,9 @@ extern int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
+ struct pid *pid, struct task_struct *task);
+ extern int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
+ struct pid *pid, struct task_struct *task);
++#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
++extern int proc_pid_ipaddr(struct task_struct *task, char *buffer);
++#endif
+ extern loff_t mem_lseek(struct file *file, loff_t offset, int orig);
+
+ extern const struct file_operations proc_maps_operations;
+diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
+index b442dac..aab29cb 100644
+--- a/fs/proc/kcore.c
++++ b/fs/proc/kcore.c
+@@ -320,6 +320,8 @@ static void elf_kcore_store_hdr(char *bufp, int nphdr, int dataoff)
+ off_t offset = 0;
+ struct kcore_list *m;
+
++ pax_track_stack();
++
+ /* setup ELF header */
+ elf = (struct elfhdr *) bufp;
+ bufp += sizeof(struct elfhdr);
+@@ -477,9 +479,10 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
+ * the addresses in the elf_phdr on our list.
+ */
+ start = kc_offset_to_vaddr(*fpos - elf_buflen);
+- if ((tsz = (PAGE_SIZE - (start & ~PAGE_MASK))) > buflen)
++ tsz = PAGE_SIZE - (start & ~PAGE_MASK);
++ if (tsz > buflen)
+ tsz = buflen;
+-
++
+ while (buflen) {
+ struct kcore_list *m;
+
+@@ -508,20 +511,23 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
+ kfree(elf_buf);
+ } else {
+ if (kern_addr_valid(start)) {
+- unsigned long n;
++ char *elf_buf;
++ mm_segment_t oldfs;
+
+- n = copy_to_user(buffer, (char *)start, tsz);
+- /*
+- * We cannot distingush between fault on source
+- * and fault on destination. When this happens
+- * we clear too and hope it will trigger the
+- * EFAULT again.
+- */
+- if (n) {
+- if (clear_user(buffer + tsz - n,
+- n))
++ elf_buf = kmalloc(tsz, GFP_KERNEL);
++ if (!elf_buf)
++ return -ENOMEM;
++ oldfs = get_fs();
++ set_fs(KERNEL_DS);
++ if (!__copy_from_user(elf_buf, (const void __user *)start, tsz)) {
++ set_fs(oldfs);
++ if (copy_to_user(buffer, elf_buf, tsz)) {
++ kfree(elf_buf);
+ return -EFAULT;
++ }
+ }
++ set_fs(oldfs);
++ kfree(elf_buf);
+ } else {
+ if (clear_user(buffer, tsz))
+ return -EFAULT;
+@@ -541,6 +547,9 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
+
+ static int open_kcore(struct inode *inode, struct file *filp)
+ {
++#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
++ return -EPERM;
++#endif
+ if (!capable(CAP_SYS_RAWIO))
+ return -EPERM;
+ if (kcore_need_update)
+diff --git a/fs/proc/kmsg.c b/fs/proc/kmsg.c
+index 7ca7834..cfe90a4 100644
+--- a/fs/proc/kmsg.c
++++ b/fs/proc/kmsg.c
+@@ -12,37 +12,37 @@
+ #include <linux/poll.h>
+ #include <linux/proc_fs.h>
+ #include <linux/fs.h>
++#include <linux/syslog.h>
+
+ #include <asm/uaccess.h>
+ #include <asm/io.h>
+
+ extern wait_queue_head_t log_wait;
+
+-extern int do_syslog(int type, char __user *bug, int count);
+-
+ static int kmsg_open(struct inode * inode, struct file * file)
+ {
+- return do_syslog(1,NULL,0);
++ return do_syslog(SYSLOG_ACTION_OPEN, NULL, 0, SYSLOG_FROM_FILE);
+ }
+
+ static int kmsg_release(struct inode * inode, struct file * file)
+ {
+- (void) do_syslog(0,NULL,0);
++ (void) do_syslog(SYSLOG_ACTION_CLOSE, NULL, 0, SYSLOG_FROM_FILE);
+ return 0;
+ }
+
+ static ssize_t kmsg_read(struct file *file, char __user *buf,
+ size_t count, loff_t *ppos)
+ {
+- if ((file->f_flags & O_NONBLOCK) && !do_syslog(9, NULL, 0))
++ if ((file->f_flags & O_NONBLOCK) &&
++ !do_syslog(SYSLOG_ACTION_SIZE_UNREAD, NULL, 0, SYSLOG_FROM_FILE))
+ return -EAGAIN;
+- return do_syslog(2, buf, count);
++ return do_syslog(SYSLOG_ACTION_READ, buf, count, SYSLOG_FROM_FILE);
+ }
+
+ static unsigned int kmsg_poll(struct file *file, poll_table *wait)
+ {
+ poll_wait(file, &log_wait, wait);
+- if (do_syslog(9, NULL, 0))
++ if (do_syslog(SYSLOG_ACTION_SIZE_UNREAD, NULL, 0, SYSLOG_FROM_FILE))
+ return POLLIN | POLLRDNORM;
+ return 0;
+ }
+diff --git a/fs/proc/meminfo.c b/fs/proc/meminfo.c
+index a65239c..ad1182a 100644
+--- a/fs/proc/meminfo.c
++++ b/fs/proc/meminfo.c
+@@ -29,6 +29,8 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
+ unsigned long pages[NR_LRU_LISTS];
+ int lru;
+
++ pax_track_stack();
++
+ /*
+ * display in kilobytes.
+ */
+@@ -149,7 +151,7 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
+ vmi.used >> 10,
+ vmi.largest_chunk >> 10
+ #ifdef CONFIG_MEMORY_FAILURE
+- ,atomic_long_read(&mce_bad_pages) << (PAGE_SHIFT - 10)
++ ,atomic_long_read_unchecked(&mce_bad_pages) << (PAGE_SHIFT - 10)
+ #endif
+ );
+
+diff --git a/fs/proc/nommu.c b/fs/proc/nommu.c
+index 9fe7d7e..cdb62c9 100644
+--- a/fs/proc/nommu.c
++++ b/fs/proc/nommu.c
+@@ -67,7 +67,7 @@ static int nommu_region_show(struct seq_file *m, struct vm_region *region)
+ if (len < 1)
+ len = 1;
+ seq_printf(m, "%*c", len, ' ');
+- seq_path(m, &file->f_path, "");
++ seq_path(m, &file->f_path, "\n\\");
+ }
+
+ seq_putc(m, '\n');
+diff --git a/fs/proc/proc_net.c b/fs/proc/proc_net.c
+index 04d1270..25e1173 100644
+--- a/fs/proc/proc_net.c
++++ b/fs/proc/proc_net.c
+@@ -104,6 +104,17 @@ static struct net *get_proc_task_net(struct inode *dir)
+ struct task_struct *task;
+ struct nsproxy *ns;
+ struct net *net = NULL;
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++ const struct cred *cred = current_cred();
++#endif
++
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++ if (cred->fsuid)
++ return net;
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++ if (cred->fsuid && !in_group_p(CONFIG_GRKERNSEC_PROC_GID))
++ return net;
++#endif
+
+ rcu_read_lock();
+ task = pid_task(proc_pid(dir), PIDTYPE_PID);
+diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
+index f667e8a..55f4d96 100644
+--- a/fs/proc/proc_sysctl.c
++++ b/fs/proc/proc_sysctl.c
+@@ -7,11 +7,13 @@
+ #include <linux/security.h>
+ #include "internal.h"
+
++extern __u32 gr_handle_sysctl(const struct ctl_table *table, const int op);
++
+ static const struct dentry_operations proc_sys_dentry_operations;
+ static const struct file_operations proc_sys_file_operations;
+-static const struct inode_operations proc_sys_inode_operations;
++const struct inode_operations proc_sys_inode_operations;
+ static const struct file_operations proc_sys_dir_file_operations;
+-static const struct inode_operations proc_sys_dir_operations;
++const struct inode_operations proc_sys_dir_operations;
+
+ static struct inode *proc_sys_make_inode(struct super_block *sb,
+ struct ctl_table_header *head, struct ctl_table *table)
+@@ -109,6 +111,9 @@ static struct dentry *proc_sys_lookup(struct inode *dir, struct dentry *dentry,
+ if (!p)
+ goto out;
+
++ if (gr_handle_sysctl(p, MAY_EXEC))
++ goto out;
++
+ err = ERR_PTR(-ENOMEM);
+ inode = proc_sys_make_inode(dir->i_sb, h ? h : head, p);
+ if (h)
+@@ -119,6 +124,9 @@ static struct dentry *proc_sys_lookup(struct inode *dir, struct dentry *dentry,
+
+ err = NULL;
+ dentry->d_op = &proc_sys_dentry_operations;
++
++ gr_handle_proc_create(dentry, inode);
++
+ d_add(dentry, inode);
+
+ out:
+@@ -200,6 +208,9 @@ static int proc_sys_fill_cache(struct file *filp, void *dirent,
+ return -ENOMEM;
+ } else {
+ child->d_op = &proc_sys_dentry_operations;
++
++ gr_handle_proc_create(child, inode);
++
+ d_add(child, inode);
+ }
+ } else {
+@@ -228,6 +239,9 @@ static int scan(struct ctl_table_header *head, ctl_table *table,
+ if (*pos < file->f_pos)
+ continue;
+
++ if (gr_handle_sysctl(table, 0))
++ continue;
++
+ res = proc_sys_fill_cache(file, dirent, filldir, head, table);
+ if (res)
+ return res;
+@@ -344,6 +358,9 @@ static int proc_sys_getattr(struct vfsmount *mnt, struct dentry *dentry, struct
+ if (IS_ERR(head))
+ return PTR_ERR(head);
+
++ if (table && gr_handle_sysctl(table, MAY_EXEC))
++ return -ENOENT;
++
+ generic_fillattr(inode, stat);
+ if (table)
+ stat->mode = (stat->mode & S_IFMT) | table->mode;
+@@ -358,17 +375,18 @@ static const struct file_operations proc_sys_file_operations = {
+ };
+
+ static const struct file_operations proc_sys_dir_file_operations = {
++ .read = generic_read_dir,
+ .readdir = proc_sys_readdir,
+ .llseek = generic_file_llseek,
+ };
+
+-static const struct inode_operations proc_sys_inode_operations = {
++const struct inode_operations proc_sys_inode_operations = {
+ .permission = proc_sys_permission,
+ .setattr = proc_sys_setattr,
+ .getattr = proc_sys_getattr,
+ };
+
+-static const struct inode_operations proc_sys_dir_operations = {
++const struct inode_operations proc_sys_dir_operations = {
+ .lookup = proc_sys_lookup,
+ .permission = proc_sys_permission,
+ .setattr = proc_sys_setattr,
+diff --git a/fs/proc/root.c b/fs/proc/root.c
+index b080b79..d957e63 100644
+--- a/fs/proc/root.c
++++ b/fs/proc/root.c
+@@ -134,7 +134,15 @@ void __init proc_root_init(void)
+ #ifdef CONFIG_PROC_DEVICETREE
+ proc_device_tree_init();
+ #endif
++#ifdef CONFIG_GRKERNSEC_PROC_ADD
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++ proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++ proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
++#endif
++#else
+ proc_mkdir("bus", NULL);
++#endif
+ proc_sys_init();
+ }
+
+diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
+index 3b7b82a..4b420b0 100644
+--- a/fs/proc/task_mmu.c
++++ b/fs/proc/task_mmu.c
+@@ -8,6 +8,7 @@
+ #include <linux/mempolicy.h>
+ #include <linux/swap.h>
+ #include <linux/swapops.h>
++#include <linux/grsecurity.h>
+
+ #include <asm/elf.h>
+ #include <asm/uaccess.h>
+@@ -46,15 +47,26 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
+ "VmStk:\t%8lu kB\n"
+ "VmExe:\t%8lu kB\n"
+ "VmLib:\t%8lu kB\n"
+- "VmPTE:\t%8lu kB\n",
+- hiwater_vm << (PAGE_SHIFT-10),
++ "VmPTE:\t%8lu kB\n"
++
++#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
++ "CsBase:\t%8lx\nCsLim:\t%8lx\n"
++#endif
++
++ ,hiwater_vm << (PAGE_SHIFT-10),
+ (total_vm - mm->reserved_vm) << (PAGE_SHIFT-10),
+ mm->locked_vm << (PAGE_SHIFT-10),
+ hiwater_rss << (PAGE_SHIFT-10),
+ total_rss << (PAGE_SHIFT-10),
+ data << (PAGE_SHIFT-10),
+ mm->stack_vm << (PAGE_SHIFT-10), text, lib,
+- (PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10);
++ (PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10
++
++#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
++ , mm->context.user_cs_base, mm->context.user_cs_limit
++#endif
++
++ );
+ }
+
+ unsigned long task_vsize(struct mm_struct *mm)
+@@ -175,7 +187,8 @@ static void m_stop(struct seq_file *m, void *v)
+ struct proc_maps_private *priv = m->private;
+ struct vm_area_struct *vma = v;
+
+- vma_stop(priv, vma);
++ if (!IS_ERR(vma))
++ vma_stop(priv, vma);
+ if (priv->task)
+ put_task_struct(priv->task);
+ }
+@@ -199,6 +212,12 @@ static int do_maps_open(struct inode *inode, struct file *file,
+ return ret;
+ }
+
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
++ (_mm->pax_flags & MF_PAX_RANDMMAP || \
++ _mm->pax_flags & MF_PAX_SEGMEXEC))
++#endif
++
+ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
+ {
+ struct mm_struct *mm = vma->vm_mm;
+@@ -206,7 +225,6 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
+ int flags = vma->vm_flags;
+ unsigned long ino = 0;
+ unsigned long long pgoff = 0;
+- unsigned long start;
+ dev_t dev = 0;
+ int len;
+
+@@ -217,20 +235,23 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
+ pgoff = ((loff_t)vma->vm_pgoff) << PAGE_SHIFT;
+ }
+
+- /* We don't show the stack guard page in /proc/maps */
+- start = vma->vm_start;
+- if (vma->vm_flags & VM_GROWSDOWN)
+- if (!vma_stack_continue(vma->vm_prev, vma->vm_start))
+- start += PAGE_SIZE;
+-
+ seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
+- start,
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++ PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_start,
++ PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_end,
++#else
++ vma->vm_start,
+ vma->vm_end,
++#endif
+ flags & VM_READ ? 'r' : '-',
+ flags & VM_WRITE ? 'w' : '-',
+ flags & VM_EXEC ? 'x' : '-',
+ flags & VM_MAYSHARE ? 's' : 'p',
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++ PAX_RAND_FLAGS(mm) ? 0UL : pgoff,
++#else
+ pgoff,
++#endif
+ MAJOR(dev), MINOR(dev), ino, &len);
+
+ /*
+@@ -239,7 +260,7 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
+ */
+ if (file) {
+ pad_len_spaces(m, len);
+- seq_path(m, &file->f_path, "\n");
++ seq_path(m, &file->f_path, "\n\\");
+ } else {
+ const char *name = arch_vma_name(vma);
+ if (!name) {
+@@ -247,8 +268,9 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
+ if (vma->vm_start <= mm->brk &&
+ vma->vm_end >= mm->start_brk) {
+ name = "[heap]";
+- } else if (vma->vm_start <= mm->start_stack &&
+- vma->vm_end >= mm->start_stack) {
++ } else if ((vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP)) ||
++ (vma->vm_start <= mm->start_stack &&
++ vma->vm_end >= mm->start_stack)) {
+ name = "[stack]";
+ }
+ } else {
+@@ -269,6 +291,13 @@ static int show_map(struct seq_file *m, void *v)
+ struct proc_maps_private *priv = m->private;
+ struct task_struct *task = priv->task;
+
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++ if (current->exec_id != m->exec_id) {
++ gr_log_badprocpid("maps");
++ return 0;
++ }
++#endif
++
+ show_map_vma(m, vma);
+
+ if (m->count < m->size) /* vma is copied successfully */
+@@ -390,10 +419,23 @@ static int show_smap(struct seq_file *m, void *v)
+ .private = &mss,
+ };
+
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++ if (current->exec_id != m->exec_id) {
++ gr_log_badprocpid("smaps");
++ return 0;
++ }
++#endif
+ memset(&mss, 0, sizeof mss);
+- mss.vma = vma;
+- if (vma->vm_mm && !is_vm_hugetlb_page(vma))
+- walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
++
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++ if (!PAX_RAND_FLAGS(vma->vm_mm)) {
++#endif
++ mss.vma = vma;
++ if (vma->vm_mm && !is_vm_hugetlb_page(vma))
++ walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++ }
++#endif
+
+ show_map_vma(m, vma);
+
+@@ -409,7 +451,11 @@ static int show_smap(struct seq_file *m, void *v)
+ "Swap: %8lu kB\n"
+ "KernelPageSize: %8lu kB\n"
+ "MMUPageSize: %8lu kB\n",
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++ PAX_RAND_FLAGS(vma->vm_mm) ? 0UL : (vma->vm_end - vma->vm_start) >> 10,
++#else
+ (vma->vm_end - vma->vm_start) >> 10,
++#endif
+ mss.resident >> 10,
+ (unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
+ mss.shared_clean >> 10,
+diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c
+index 8f5c05d..c99c76d 100644
+--- a/fs/proc/task_nommu.c
++++ b/fs/proc/task_nommu.c
+@@ -50,7 +50,7 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
+ else
+ bytes += kobjsize(mm);
+
+- if (current->fs && current->fs->users > 1)
++ if (current->fs && atomic_read(¤t->fs->users) > 1)
+ sbytes += kobjsize(current->fs);
+ else
+ bytes += kobjsize(current->fs);
+@@ -154,7 +154,7 @@ static int nommu_vma_show(struct seq_file *m, struct vm_area_struct *vma)
+ if (len < 1)
+ len = 1;
+ seq_printf(m, "%*c", len, ' ');
+- seq_path(m, &file->f_path, "");
++ seq_path(m, &file->f_path, "\n\\");
+ }
+
+ seq_putc(m, '\n');
+diff --git a/fs/readdir.c b/fs/readdir.c
+index 7723401..30059a6 100644
+--- a/fs/readdir.c
++++ b/fs/readdir.c
+@@ -16,6 +16,7 @@
+ #include <linux/security.h>
+ #include <linux/syscalls.h>
+ #include <linux/unistd.h>
++#include <linux/namei.h>
+
+ #include <asm/uaccess.h>
+
+@@ -67,6 +68,7 @@ struct old_linux_dirent {
+
+ struct readdir_callback {
+ struct old_linux_dirent __user * dirent;
++ struct file * file;
+ int result;
+ };
+
+@@ -84,6 +86,10 @@ static int fillonedir(void * __buf, const char * name, int namlen, loff_t offset
+ buf->result = -EOVERFLOW;
+ return -EOVERFLOW;
+ }
++
++ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
++ return 0;
++
+ buf->result++;
+ dirent = buf->dirent;
+ if (!access_ok(VERIFY_WRITE, dirent,
+@@ -116,6 +122,7 @@ SYSCALL_DEFINE3(old_readdir, unsigned int, fd,
+
+ buf.result = 0;
+ buf.dirent = dirent;
++ buf.file = file;
+
+ error = vfs_readdir(file, fillonedir, &buf);
+ if (buf.result)
+@@ -142,6 +149,7 @@ struct linux_dirent {
+ struct getdents_callback {
+ struct linux_dirent __user * current_dir;
+ struct linux_dirent __user * previous;
++ struct file * file;
+ int count;
+ int error;
+ };
+@@ -162,6 +170,10 @@ static int filldir(void * __buf, const char * name, int namlen, loff_t offset,
+ buf->error = -EOVERFLOW;
+ return -EOVERFLOW;
+ }
++
++ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
++ return 0;
++
+ dirent = buf->previous;
+ if (dirent) {
+ if (__put_user(offset, &dirent->d_off))
+@@ -209,6 +221,7 @@ SYSCALL_DEFINE3(getdents, unsigned int, fd,
+ buf.previous = NULL;
+ buf.count = count;
+ buf.error = 0;
++ buf.file = file;
+
+ error = vfs_readdir(file, filldir, &buf);
+ if (error >= 0)
+@@ -228,6 +241,7 @@ out:
+ struct getdents_callback64 {
+ struct linux_dirent64 __user * current_dir;
+ struct linux_dirent64 __user * previous;
++ struct file *file;
+ int count;
+ int error;
+ };
+@@ -242,6 +256,10 @@ static int filldir64(void * __buf, const char * name, int namlen, loff_t offset,
+ buf->error = -EINVAL; /* only used if we fail.. */
+ if (reclen > buf->count)
+ return -EINVAL;
++
++ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
++ return 0;
++
+ dirent = buf->previous;
+ if (dirent) {
+ if (__put_user(offset, &dirent->d_off))
+@@ -289,6 +307,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int, fd,
+
+ buf.current_dir = dirent;
+ buf.previous = NULL;
++ buf.file = file;
+ buf.count = count;
+ buf.error = 0;
+
+@@ -297,7 +316,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int, fd,
+ error = buf.error;
+ lastdirent = buf.previous;
+ if (lastdirent) {
+- typeof(lastdirent->d_off) d_off = file->f_pos;
++ typeof(((struct linux_dirent64 *)0)->d_off) d_off = file->f_pos;
+ if (__put_user(d_off, &lastdirent->d_off))
+ error = -EFAULT;
+ else
+diff --git a/fs/reiserfs/dir.c b/fs/reiserfs/dir.c
+index d42c30c..4fd8718 100644
+--- a/fs/reiserfs/dir.c
++++ b/fs/reiserfs/dir.c
+@@ -66,6 +66,8 @@ int reiserfs_readdir_dentry(struct dentry *dentry, void *dirent,
+ struct reiserfs_dir_entry de;
+ int ret = 0;
+
++ pax_track_stack();
++
+ reiserfs_write_lock(inode->i_sb);
+
+ reiserfs_check_lock_depth(inode->i_sb, "readdir");
+diff --git a/fs/reiserfs/do_balan.c b/fs/reiserfs/do_balan.c
+index 128d3f7c..8840d44 100644
+--- a/fs/reiserfs/do_balan.c
++++ b/fs/reiserfs/do_balan.c
+@@ -2058,7 +2058,7 @@ void do_balance(struct tree_balance *tb, /* tree_balance structure */
+ return;
+ }
+
+- atomic_inc(&(fs_generation(tb->tb_sb)));
++ atomic_inc_unchecked(&(fs_generation(tb->tb_sb)));
+ do_balance_starts(tb);
+
+ /* balance leaf returns 0 except if combining L R and S into
+diff --git a/fs/reiserfs/item_ops.c b/fs/reiserfs/item_ops.c
+index 72cb1cc..d0e3181 100644
+--- a/fs/reiserfs/item_ops.c
++++ b/fs/reiserfs/item_ops.c
+@@ -102,7 +102,7 @@ static void sd_print_vi(struct virtual_item *vi)
+ vi->vi_index, vi->vi_type, vi->vi_ih);
+ }
+
+-static struct item_operations stat_data_ops = {
++static const struct item_operations stat_data_ops = {
+ .bytes_number = sd_bytes_number,
+ .decrement_key = sd_decrement_key,
+ .is_left_mergeable = sd_is_left_mergeable,
+@@ -196,7 +196,7 @@ static void direct_print_vi(struct virtual_item *vi)
+ vi->vi_index, vi->vi_type, vi->vi_ih);
+ }
+
+-static struct item_operations direct_ops = {
++static const struct item_operations direct_ops = {
+ .bytes_number = direct_bytes_number,
+ .decrement_key = direct_decrement_key,
+ .is_left_mergeable = direct_is_left_mergeable,
+@@ -341,7 +341,7 @@ static void indirect_print_vi(struct virtual_item *vi)
+ vi->vi_index, vi->vi_type, vi->vi_ih);
+ }
+
+-static struct item_operations indirect_ops = {
++static const struct item_operations indirect_ops = {
+ .bytes_number = indirect_bytes_number,
+ .decrement_key = indirect_decrement_key,
+ .is_left_mergeable = indirect_is_left_mergeable,
+@@ -628,7 +628,7 @@ static void direntry_print_vi(struct virtual_item *vi)
+ printk("\n");
+ }
+
+-static struct item_operations direntry_ops = {
++static const struct item_operations direntry_ops = {
+ .bytes_number = direntry_bytes_number,
+ .decrement_key = direntry_decrement_key,
+ .is_left_mergeable = direntry_is_left_mergeable,
+@@ -724,7 +724,7 @@ static void errcatch_print_vi(struct virtual_item *vi)
+ "Invalid item type observed, run fsck ASAP");
+ }
+
+-static struct item_operations errcatch_ops = {
++static const struct item_operations errcatch_ops = {
+ errcatch_bytes_number,
+ errcatch_decrement_key,
+ errcatch_is_left_mergeable,
+@@ -746,7 +746,7 @@ static struct item_operations errcatch_ops = {
+ #error Item types must use disk-format assigned values.
+ #endif
+
+-struct item_operations *item_ops[TYPE_ANY + 1] = {
++const struct item_operations * const item_ops[TYPE_ANY + 1] = {
+ &stat_data_ops,
+ &indirect_ops,
+ &direct_ops,
+diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
+index b5fe0aa..e0e25c4 100644
+--- a/fs/reiserfs/journal.c
++++ b/fs/reiserfs/journal.c
+@@ -2329,6 +2329,8 @@ static struct buffer_head *reiserfs_breada(struct block_device *dev,
+ struct buffer_head *bh;
+ int i, j;
+
++ pax_track_stack();
++
+ bh = __getblk(dev, block, bufsize);
+ if (buffer_uptodate(bh))
+ return (bh);
+diff --git a/fs/reiserfs/namei.c b/fs/reiserfs/namei.c
+index 2715791..b8996db 100644
+--- a/fs/reiserfs/namei.c
++++ b/fs/reiserfs/namei.c
+@@ -1214,6 +1214,8 @@ static int reiserfs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ unsigned long savelink = 1;
+ struct timespec ctime;
+
++ pax_track_stack();
++
+ /* three balancings: (1) old name removal, (2) new name insertion
+ and (3) maybe "save" link insertion
+ stat data updates: (1) old directory,
+diff --git a/fs/reiserfs/procfs.c b/fs/reiserfs/procfs.c
+index 9229e55..3d2e3b7 100644
+--- a/fs/reiserfs/procfs.c
++++ b/fs/reiserfs/procfs.c
+@@ -123,7 +123,7 @@ static int show_super(struct seq_file *m, struct super_block *sb)
+ "SMALL_TAILS " : "NO_TAILS ",
+ replay_only(sb) ? "REPLAY_ONLY " : "",
+ convert_reiserfs(sb) ? "CONV " : "",
+- atomic_read(&r->s_generation_counter),
++ atomic_read_unchecked(&r->s_generation_counter),
+ SF(s_disk_reads), SF(s_disk_writes), SF(s_fix_nodes),
+ SF(s_do_balance), SF(s_unneeded_left_neighbor),
+ SF(s_good_search_by_key_reada), SF(s_bmaps),
+@@ -309,6 +309,8 @@ static int show_journal(struct seq_file *m, struct super_block *sb)
+ struct journal_params *jp = &rs->s_v1.s_journal;
+ char b[BDEVNAME_SIZE];
+
++ pax_track_stack();
++
+ seq_printf(m, /* on-disk fields */
+ "jp_journal_1st_block: \t%i\n"
+ "jp_journal_dev: \t%s[%x]\n"
+diff --git a/fs/reiserfs/stree.c b/fs/reiserfs/stree.c
+index d036ee5..4c7dca1 100644
+--- a/fs/reiserfs/stree.c
++++ b/fs/reiserfs/stree.c
+@@ -1159,6 +1159,8 @@ int reiserfs_delete_item(struct reiserfs_transaction_handle *th,
+ int iter = 0;
+ #endif
+
++ pax_track_stack();
++
+ BUG_ON(!th->t_trans_id);
+
+ init_tb_struct(th, &s_del_balance, sb, path,
+@@ -1296,6 +1298,8 @@ void reiserfs_delete_solid_item(struct reiserfs_transaction_handle *th,
+ int retval;
+ int quota_cut_bytes = 0;
+
++ pax_track_stack();
++
+ BUG_ON(!th->t_trans_id);
+
+ le_key2cpu_key(&cpu_key, key);
+@@ -1525,6 +1529,8 @@ int reiserfs_cut_from_item(struct reiserfs_transaction_handle *th,
+ int quota_cut_bytes;
+ loff_t tail_pos = 0;
+
++ pax_track_stack();
++
+ BUG_ON(!th->t_trans_id);
+
+ init_tb_struct(th, &s_cut_balance, inode->i_sb, path,
+@@ -1920,6 +1926,8 @@ int reiserfs_paste_into_item(struct reiserfs_transaction_handle *th, struct tree
+ int retval;
+ int fs_gen;
+
++ pax_track_stack();
++
+ BUG_ON(!th->t_trans_id);
+
+ fs_gen = get_generation(inode->i_sb);
+@@ -2007,6 +2015,8 @@ int reiserfs_insert_item(struct reiserfs_transaction_handle *th,
+ int fs_gen = 0;
+ int quota_bytes = 0;
+
++ pax_track_stack();
++
+ BUG_ON(!th->t_trans_id);
+
+ if (inode) { /* Do we count quotas for item? */
+diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
+index 7cb1285..c726cd0 100644
+--- a/fs/reiserfs/super.c
++++ b/fs/reiserfs/super.c
+@@ -916,6 +916,8 @@ static int reiserfs_parse_options(struct super_block *s, char *options, /* strin
+ {.option_name = NULL}
+ };
+
++ pax_track_stack();
++
+ *blocks = 0;
+ if (!options || !*options)
+ /* use default configuration: create tails, journaling on, no
+diff --git a/fs/select.c b/fs/select.c
+index fd38ce2..f5381b8 100644
+--- a/fs/select.c
++++ b/fs/select.c
+@@ -20,6 +20,7 @@
+ #include <linux/module.h>
+ #include <linux/slab.h>
+ #include <linux/poll.h>
++#include <linux/security.h>
+ #include <linux/personality.h> /* for STICKY_TIMEOUTS */
+ #include <linux/file.h>
+ #include <linux/fdtable.h>
+@@ -401,6 +402,8 @@ int do_select(int n, fd_set_bits *fds, struct timespec *end_time)
+ int retval, i, timed_out = 0;
+ unsigned long slack = 0;
+
++ pax_track_stack();
++
+ rcu_read_lock();
+ retval = max_select_fd(n, fds);
+ rcu_read_unlock();
+@@ -529,6 +532,8 @@ int core_sys_select(int n, fd_set __user *inp, fd_set __user *outp,
+ /* Allocate small arguments on the stack to save memory and be faster */
+ long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
+
++ pax_track_stack();
++
+ ret = -EINVAL;
+ if (n < 0)
+ goto out_nofds;
+@@ -821,6 +826,9 @@ int do_sys_poll(struct pollfd __user *ufds, unsigned int nfds,
+ struct poll_list *walk = head;
+ unsigned long todo = nfds;
+
++ pax_track_stack();
++
++ gr_learn_resource(current, RLIMIT_NOFILE, nfds, 1);
+ if (nfds > current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
+ return -EINVAL;
+
+diff --git a/fs/seq_file.c b/fs/seq_file.c
+index eae7d9d..b7613c6 100644
+--- a/fs/seq_file.c
++++ b/fs/seq_file.c
+@@ -9,6 +9,7 @@
+ #include <linux/module.h>
+ #include <linux/seq_file.h>
+ #include <linux/slab.h>
++#include <linux/sched.h>
+
+ #include <asm/uaccess.h>
+ #include <asm/page.h>
+@@ -40,6 +41,9 @@ int seq_open(struct file *file, const struct seq_operations *op)
+ memset(p, 0, sizeof(*p));
+ mutex_init(&p->lock);
+ p->op = op;
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++ p->exec_id = current->exec_id;
++#endif
+
+ /*
+ * Wrappers around seq_open(e.g. swaps_open) need to be
+@@ -551,7 +555,7 @@ static void single_stop(struct seq_file *p, void *v)
+ int single_open(struct file *file, int (*show)(struct seq_file *, void *),
+ void *data)
+ {
+- struct seq_operations *op = kmalloc(sizeof(*op), GFP_KERNEL);
++ seq_operations_no_const *op = kmalloc(sizeof(*op), GFP_KERNEL);
+ int res = -ENOMEM;
+
+ if (op) {
+diff --git a/fs/smbfs/proc.c b/fs/smbfs/proc.c
+index 71c29b6..54694dd 100644
+--- a/fs/smbfs/proc.c
++++ b/fs/smbfs/proc.c
+@@ -266,9 +266,9 @@ int smb_setcodepage(struct smb_sb_info *server, struct smb_nls_codepage *cp)
+
+ out:
+ if (server->local_nls != NULL && server->remote_nls != NULL)
+- server->ops->convert = convert_cp;
++ *(void **)&server->ops->convert = convert_cp;
+ else
+- server->ops->convert = convert_memcpy;
++ *(void **)&server->ops->convert = convert_memcpy;
+
+ smb_unlock_server(server);
+ return n;
+@@ -933,9 +933,9 @@ smb_newconn(struct smb_sb_info *server, struct smb_conn_opt *opt)
+
+ /* FIXME: the win9x code wants to modify these ... (seek/trunc bug) */
+ if (server->mnt->flags & SMB_MOUNT_OLDATTR) {
+- server->ops->getattr = smb_proc_getattr_core;
++ *(void **)&server->ops->getattr = smb_proc_getattr_core;
+ } else if (server->mnt->flags & SMB_MOUNT_DIRATTR) {
+- server->ops->getattr = smb_proc_getattr_ff;
++ *(void **)&server->ops->getattr = smb_proc_getattr_ff;
+ }
+
+ /* Decode server capabilities */
+@@ -3439,7 +3439,7 @@ out:
+ static void
+ install_ops(struct smb_ops *dst, struct smb_ops *src)
+ {
+- memcpy(dst, src, sizeof(void *) * SMB_OPS_NUM_STATIC);
++ memcpy((void *)dst, src, sizeof(void *) * SMB_OPS_NUM_STATIC);
+ }
+
+ /* < LANMAN2 */
+diff --git a/fs/smbfs/symlink.c b/fs/smbfs/symlink.c
+index 00b2909..2ace383 100644
+--- a/fs/smbfs/symlink.c
++++ b/fs/smbfs/symlink.c
+@@ -55,7 +55,7 @@ static void *smb_follow_link(struct dentry *dentry, struct nameidata *nd)
+
+ static void smb_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
+ {
+- char *s = nd_get_link(nd);
++ const char *s = nd_get_link(nd);
+ if (!IS_ERR(s))
+ __putname(s);
+ }
+diff --git a/fs/splice.c b/fs/splice.c
+index bb92b7c5..5aa72b0 100644
+--- a/fs/splice.c
++++ b/fs/splice.c
+@@ -185,7 +185,7 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
+ pipe_lock(pipe);
+
+ for (;;) {
+- if (!pipe->readers) {
++ if (!atomic_read(&pipe->readers)) {
+ send_sig(SIGPIPE, current, 0);
+ if (!ret)
+ ret = -EPIPE;
+@@ -239,9 +239,9 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
+ do_wakeup = 0;
+ }
+
+- pipe->waiting_writers++;
++ atomic_inc(&pipe->waiting_writers);
+ pipe_wait(pipe);
+- pipe->waiting_writers--;
++ atomic_dec(&pipe->waiting_writers);
+ }
+
+ pipe_unlock(pipe);
+@@ -285,6 +285,8 @@ __generic_file_splice_read(struct file *in, loff_t *ppos,
+ .spd_release = spd_release_page,
+ };
+
++ pax_track_stack();
++
+ index = *ppos >> PAGE_CACHE_SHIFT;
+ loff = *ppos & ~PAGE_CACHE_MASK;
+ req_pages = (len + loff + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
+@@ -521,7 +523,7 @@ static ssize_t kernel_readv(struct file *file, const struct iovec *vec,
+ old_fs = get_fs();
+ set_fs(get_ds());
+ /* The cast to a user pointer is valid due to the set_fs() */
+- res = vfs_readv(file, (const struct iovec __user *)vec, vlen, &pos);
++ res = vfs_readv(file, (const struct iovec __force_user *)vec, vlen, &pos);
+ set_fs(old_fs);
+
+ return res;
+@@ -536,7 +538,7 @@ static ssize_t kernel_write(struct file *file, const char *buf, size_t count,
+ old_fs = get_fs();
+ set_fs(get_ds());
+ /* The cast to a user pointer is valid due to the set_fs() */
+- res = vfs_write(file, (const char __user *)buf, count, &pos);
++ res = vfs_write(file, (const char __force_user *)buf, count, &pos);
+ set_fs(old_fs);
+
+ return res;
+@@ -565,6 +567,8 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
+ .spd_release = spd_release_page,
+ };
+
++ pax_track_stack();
++
+ index = *ppos >> PAGE_CACHE_SHIFT;
+ offset = *ppos & ~PAGE_CACHE_MASK;
+ nr_pages = (len + offset + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
+@@ -578,7 +582,7 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
+ goto err;
+
+ this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset);
+- vec[i].iov_base = (void __user *) page_address(page);
++ vec[i].iov_base = (__force void __user *) page_address(page);
+ vec[i].iov_len = this_len;
+ pages[i] = page;
+ spd.nr_pages++;
+@@ -800,10 +804,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
+ int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
+ {
+ while (!pipe->nrbufs) {
+- if (!pipe->writers)
++ if (!atomic_read(&pipe->writers))
+ return 0;
+
+- if (!pipe->waiting_writers && sd->num_spliced)
++ if (!atomic_read(&pipe->waiting_writers) && sd->num_spliced)
+ return 0;
+
+ if (sd->flags & SPLICE_F_NONBLOCK)
+@@ -1140,7 +1144,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
+ * out of the pipe right after the splice_to_pipe(). So set
+ * PIPE_READERS appropriately.
+ */
+- pipe->readers = 1;
++ atomic_set(&pipe->readers, 1);
+
+ current->splice_pipe = pipe;
+ }
+@@ -1593,6 +1597,8 @@ static long vmsplice_to_pipe(struct file *file, const struct iovec __user *iov,
+ .spd_release = spd_release_page,
+ };
+
++ pax_track_stack();
++
+ pipe = pipe_info(file->f_path.dentry->d_inode);
+ if (!pipe)
+ return -EBADF;
+@@ -1701,9 +1707,9 @@ static int ipipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
+ ret = -ERESTARTSYS;
+ break;
+ }
+- if (!pipe->writers)
++ if (!atomic_read(&pipe->writers))
+ break;
+- if (!pipe->waiting_writers) {
++ if (!atomic_read(&pipe->waiting_writers)) {
+ if (flags & SPLICE_F_NONBLOCK) {
+ ret = -EAGAIN;
+ break;
+@@ -1735,7 +1741,7 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
+ pipe_lock(pipe);
+
+ while (pipe->nrbufs >= PIPE_BUFFERS) {
+- if (!pipe->readers) {
++ if (!atomic_read(&pipe->readers)) {
+ send_sig(SIGPIPE, current, 0);
+ ret = -EPIPE;
+ break;
+@@ -1748,9 +1754,9 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
+ ret = -ERESTARTSYS;
+ break;
+ }
+- pipe->waiting_writers++;
++ atomic_inc(&pipe->waiting_writers);
+ pipe_wait(pipe);
+- pipe->waiting_writers--;
++ atomic_dec(&pipe->waiting_writers);
+ }
+
+ pipe_unlock(pipe);
+@@ -1786,14 +1792,14 @@ retry:
+ pipe_double_lock(ipipe, opipe);
+
+ do {
+- if (!opipe->readers) {
++ if (!atomic_read(&opipe->readers)) {
+ send_sig(SIGPIPE, current, 0);
+ if (!ret)
+ ret = -EPIPE;
+ break;
+ }
+
+- if (!ipipe->nrbufs && !ipipe->writers)
++ if (!ipipe->nrbufs && !atomic_read(&ipipe->writers))
+ break;
+
+ /*
+@@ -1893,7 +1899,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
+ pipe_double_lock(ipipe, opipe);
+
+ do {
+- if (!opipe->readers) {
++ if (!atomic_read(&opipe->readers)) {
+ send_sig(SIGPIPE, current, 0);
+ if (!ret)
+ ret = -EPIPE;
+@@ -1938,7 +1944,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
+ * return EAGAIN if we have the potential of some data in the
+ * future, otherwise just return 0
+ */
+- if (!ret && ipipe->waiting_writers && (flags & SPLICE_F_NONBLOCK))
++ if (!ret && atomic_read(&ipipe->waiting_writers) && (flags & SPLICE_F_NONBLOCK))
+ ret = -EAGAIN;
+
+ pipe_unlock(ipipe);
+diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
+index e020183..18d64b4 100644
+--- a/fs/sysfs/dir.c
++++ b/fs/sysfs/dir.c
+@@ -678,6 +678,18 @@ static int create_dir(struct kobject *kobj, struct sysfs_dirent *parent_sd,
+ struct sysfs_dirent *sd;
+ int rc;
+
++#ifdef CONFIG_GRKERNSEC_SYSFS_RESTRICT
++ const char *parent_name = parent_sd->s_name;
++
++ mode = S_IFDIR | S_IRWXU;
++
++ if ((!strcmp(parent_name, "") && (!strcmp(name, "devices") || !strcmp(name, "fs"))) ||
++ (!strcmp(parent_name, "devices") && !strcmp(name, "system")) ||
++ (!strcmp(parent_name, "fs") && (!strcmp(name, "selinux") || !strcmp(name, "fuse"))) ||
++ (!strcmp(parent_name, "system") && !strcmp(name, "cpu")))
++ mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO;
++#endif
++
+ /* allocate */
+ sd = sysfs_new_dirent(name, mode, SYSFS_DIR);
+ if (!sd)
+diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
+index 7118a38..70af853 100644
+--- a/fs/sysfs/file.c
++++ b/fs/sysfs/file.c
+@@ -44,7 +44,7 @@ static DEFINE_SPINLOCK(sysfs_open_dirent_lock);
+
+ struct sysfs_open_dirent {
+ atomic_t refcnt;
+- atomic_t event;
++ atomic_unchecked_t event;
+ wait_queue_head_t poll;
+ struct list_head buffers; /* goes through sysfs_buffer.list */
+ };
+@@ -53,7 +53,7 @@ struct sysfs_buffer {
+ size_t count;
+ loff_t pos;
+ char * page;
+- struct sysfs_ops * ops;
++ const struct sysfs_ops * ops;
+ struct mutex mutex;
+ int needs_read_fill;
+ int event;
+@@ -75,7 +75,7 @@ static int fill_read_buffer(struct dentry * dentry, struct sysfs_buffer * buffer
+ {
+ struct sysfs_dirent *attr_sd = dentry->d_fsdata;
+ struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
+- struct sysfs_ops * ops = buffer->ops;
++ const struct sysfs_ops * ops = buffer->ops;
+ int ret = 0;
+ ssize_t count;
+
+@@ -88,7 +88,7 @@ static int fill_read_buffer(struct dentry * dentry, struct sysfs_buffer * buffer
+ if (!sysfs_get_active_two(attr_sd))
+ return -ENODEV;
+
+- buffer->event = atomic_read(&attr_sd->s_attr.open->event);
++ buffer->event = atomic_read_unchecked(&attr_sd->s_attr.open->event);
+ count = ops->show(kobj, attr_sd->s_attr.attr, buffer->page);
+
+ sysfs_put_active_two(attr_sd);
+@@ -199,7 +199,7 @@ flush_write_buffer(struct dentry * dentry, struct sysfs_buffer * buffer, size_t
+ {
+ struct sysfs_dirent *attr_sd = dentry->d_fsdata;
+ struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
+- struct sysfs_ops * ops = buffer->ops;
++ const struct sysfs_ops * ops = buffer->ops;
+ int rc;
+
+ /* need attr_sd for attr and ops, its parent for kobj */
+@@ -294,7 +294,7 @@ static int sysfs_get_open_dirent(struct sysfs_dirent *sd,
+ return -ENOMEM;
+
+ atomic_set(&new_od->refcnt, 0);
+- atomic_set(&new_od->event, 1);
++ atomic_set_unchecked(&new_od->event, 1);
+ init_waitqueue_head(&new_od->poll);
+ INIT_LIST_HEAD(&new_od->buffers);
+ goto retry;
+@@ -335,7 +335,7 @@ static int sysfs_open_file(struct inode *inode, struct file *file)
+ struct sysfs_dirent *attr_sd = file->f_path.dentry->d_fsdata;
+ struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
+ struct sysfs_buffer *buffer;
+- struct sysfs_ops *ops;
++ const struct sysfs_ops *ops;
+ int error = -EACCES;
+ char *p;
+
+@@ -444,7 +444,7 @@ static unsigned int sysfs_poll(struct file *filp, poll_table *wait)
+
+ sysfs_put_active_two(attr_sd);
+
+- if (buffer->event != atomic_read(&od->event))
++ if (buffer->event != atomic_read_unchecked(&od->event))
+ goto trigger;
+
+ return DEFAULT_POLLMASK;
+@@ -463,7 +463,7 @@ void sysfs_notify_dirent(struct sysfs_dirent *sd)
+
+ od = sd->s_attr.open;
+ if (od) {
+- atomic_inc(&od->event);
++ atomic_inc_unchecked(&od->event);
+ wake_up_interruptible(&od->poll);
+ }
+
+diff --git a/fs/sysfs/symlink.c b/fs/sysfs/symlink.c
+index c5081ad..342ea86 100644
+--- a/fs/sysfs/symlink.c
++++ b/fs/sysfs/symlink.c
+@@ -204,7 +204,7 @@ static void *sysfs_follow_link(struct dentry *dentry, struct nameidata *nd)
+
+ static void sysfs_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
+ {
+- char *page = nd_get_link(nd);
++ const char *page = nd_get_link(nd);
+ if (!IS_ERR(page))
+ free_page((unsigned long)page);
+ }
+diff --git a/fs/udf/balloc.c b/fs/udf/balloc.c
+index 1e06853..b06d325 100644
+--- a/fs/udf/balloc.c
++++ b/fs/udf/balloc.c
+@@ -172,9 +172,7 @@ static void udf_bitmap_free_blocks(struct super_block *sb,
+
+ mutex_lock(&sbi->s_alloc_mutex);
+ partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
+- if (bloc->logicalBlockNum < 0 ||
+- (bloc->logicalBlockNum + count) >
+- partmap->s_partition_len) {
++ if ((bloc->logicalBlockNum + count) > partmap->s_partition_len) {
+ udf_debug("%d < %d || %d + %d > %d\n",
+ bloc->logicalBlockNum, 0, bloc->logicalBlockNum,
+ count, partmap->s_partition_len);
+@@ -436,9 +434,7 @@ static void udf_table_free_blocks(struct super_block *sb,
+
+ mutex_lock(&sbi->s_alloc_mutex);
+ partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
+- if (bloc->logicalBlockNum < 0 ||
+- (bloc->logicalBlockNum + count) >
+- partmap->s_partition_len) {
++ if ((bloc->logicalBlockNum + count) > partmap->s_partition_len) {
+ udf_debug("%d < %d || %d + %d > %d\n",
+ bloc.logicalBlockNum, 0, bloc.logicalBlockNum, count,
+ partmap->s_partition_len);
+diff --git a/fs/udf/inode.c b/fs/udf/inode.c
+index 6d24c2c..fff470f 100644
+--- a/fs/udf/inode.c
++++ b/fs/udf/inode.c
+@@ -484,6 +484,8 @@ static struct buffer_head *inode_getblk(struct inode *inode, sector_t block,
+ int goal = 0, pgoal = iinfo->i_location.logicalBlockNum;
+ int lastblock = 0;
+
++ pax_track_stack();
++
+ prev_epos.offset = udf_file_entry_alloc_offset(inode);
+ prev_epos.block = iinfo->i_location;
+ prev_epos.bh = NULL;
+diff --git a/fs/udf/misc.c b/fs/udf/misc.c
+index 9215700..bf1f68e 100644
+--- a/fs/udf/misc.c
++++ b/fs/udf/misc.c
+@@ -286,7 +286,7 @@ void udf_new_tag(char *data, uint16_t ident, uint16_t version, uint16_t snum,
+
+ u8 udf_tag_checksum(const struct tag *t)
+ {
+- u8 *data = (u8 *)t;
++ const u8 *data = (const u8 *)t;
+ u8 checksum = 0;
+ int i;
+ for (i = 0; i < sizeof(struct tag); ++i)
+diff --git a/fs/utimes.c b/fs/utimes.c
+index e4c75db..b4df0e0 100644
+--- a/fs/utimes.c
++++ b/fs/utimes.c
+@@ -1,6 +1,7 @@
+ #include <linux/compiler.h>
+ #include <linux/file.h>
+ #include <linux/fs.h>
++#include <linux/security.h>
+ #include <linux/linkage.h>
+ #include <linux/mount.h>
+ #include <linux/namei.h>
+@@ -101,6 +102,12 @@ static int utimes_common(struct path *path, struct timespec *times)
+ goto mnt_drop_write_and_out;
+ }
+ }
++
++ if (!gr_acl_handle_utime(path->dentry, path->mnt)) {
++ error = -EACCES;
++ goto mnt_drop_write_and_out;
++ }
++
+ mutex_lock(&inode->i_mutex);
+ error = notify_change(path->dentry, &newattrs);
+ mutex_unlock(&inode->i_mutex);
+diff --git a/fs/xattr.c b/fs/xattr.c
+index 6d4f6d3..cda3958 100644
+--- a/fs/xattr.c
++++ b/fs/xattr.c
+@@ -247,7 +247,7 @@ EXPORT_SYMBOL_GPL(vfs_removexattr);
+ * Extended attribute SET operations
+ */
+ static long
+-setxattr(struct dentry *d, const char __user *name, const void __user *value,
++setxattr(struct path *path, const char __user *name, const void __user *value,
+ size_t size, int flags)
+ {
+ int error;
+@@ -271,7 +271,13 @@ setxattr(struct dentry *d, const char __user *name, const void __user *value,
+ return PTR_ERR(kvalue);
+ }
+
+- error = vfs_setxattr(d, kname, kvalue, size, flags);
++ if (!gr_acl_handle_setxattr(path->dentry, path->mnt)) {
++ error = -EACCES;
++ goto out;
++ }
++
++ error = vfs_setxattr(path->dentry, kname, kvalue, size, flags);
++out:
+ kfree(kvalue);
+ return error;
+ }
+@@ -288,7 +294,7 @@ SYSCALL_DEFINE5(setxattr, const char __user *, pathname,
+ return error;
+ error = mnt_want_write(path.mnt);
+ if (!error) {
+- error = setxattr(path.dentry, name, value, size, flags);
++ error = setxattr(&path, name, value, size, flags);
+ mnt_drop_write(path.mnt);
+ }
+ path_put(&path);
+@@ -307,7 +313,7 @@ SYSCALL_DEFINE5(lsetxattr, const char __user *, pathname,
+ return error;
+ error = mnt_want_write(path.mnt);
+ if (!error) {
+- error = setxattr(path.dentry, name, value, size, flags);
++ error = setxattr(&path, name, value, size, flags);
+ mnt_drop_write(path.mnt);
+ }
+ path_put(&path);
+@@ -318,17 +324,15 @@ SYSCALL_DEFINE5(fsetxattr, int, fd, const char __user *, name,
+ const void __user *,value, size_t, size, int, flags)
+ {
+ struct file *f;
+- struct dentry *dentry;
+ int error = -EBADF;
+
+ f = fget(fd);
+ if (!f)
+ return error;
+- dentry = f->f_path.dentry;
+- audit_inode(NULL, dentry);
++ audit_inode(NULL, f->f_path.dentry);
+ error = mnt_want_write_file(f);
+ if (!error) {
+- error = setxattr(dentry, name, value, size, flags);
++ error = setxattr(&f->f_path, name, value, size, flags);
+ mnt_drop_write(f->f_path.mnt);
+ }
+ fput(f);
+diff --git a/fs/xattr_acl.c b/fs/xattr_acl.c
+index c6ad7c7..f2847a7 100644
+--- a/fs/xattr_acl.c
++++ b/fs/xattr_acl.c
+@@ -17,8 +17,8 @@
+ struct posix_acl *
+ posix_acl_from_xattr(const void *value, size_t size)
+ {
+- posix_acl_xattr_header *header = (posix_acl_xattr_header *)value;
+- posix_acl_xattr_entry *entry = (posix_acl_xattr_entry *)(header+1), *end;
++ const posix_acl_xattr_header *header = (const posix_acl_xattr_header *)value;
++ const posix_acl_xattr_entry *entry = (const posix_acl_xattr_entry *)(header+1), *end;
+ int count;
+ struct posix_acl *acl;
+ struct posix_acl_entry *acl_e;
+diff --git a/fs/xfs/linux-2.6/xfs_ioctl.c b/fs/xfs/linux-2.6/xfs_ioctl.c
+index 942362f..88f96f5 100644
+--- a/fs/xfs/linux-2.6/xfs_ioctl.c
++++ b/fs/xfs/linux-2.6/xfs_ioctl.c
+@@ -134,7 +134,7 @@ xfs_find_handle(
+ }
+
+ error = -EFAULT;
+- if (copy_to_user(hreq->ohandle, &handle, hsize) ||
++ if (hsize > sizeof handle || copy_to_user(hreq->ohandle, &handle, hsize) ||
+ copy_to_user(hreq->ohandlen, &hsize, sizeof(__s32)))
+ goto out_put;
+
+@@ -423,7 +423,7 @@ xfs_attrlist_by_handle(
+ if (IS_ERR(dentry))
+ return PTR_ERR(dentry);
+
+- kbuf = kmalloc(al_hreq.buflen, GFP_KERNEL);
++ kbuf = kzalloc(al_hreq.buflen, GFP_KERNEL);
+ if (!kbuf)
+ goto out_dput;
+
+@@ -697,7 +697,7 @@ xfs_ioc_fsgeometry_v1(
+ xfs_mount_t *mp,
+ void __user *arg)
+ {
+- xfs_fsop_geom_t fsgeo;
++ xfs_fsop_geom_t fsgeo;
+ int error;
+
+ error = xfs_fs_geometry(mp, &fsgeo, 3);
+diff --git a/fs/xfs/linux-2.6/xfs_ioctl32.c b/fs/xfs/linux-2.6/xfs_ioctl32.c
+index bad485a..479bd32 100644
+--- a/fs/xfs/linux-2.6/xfs_ioctl32.c
++++ b/fs/xfs/linux-2.6/xfs_ioctl32.c
+@@ -75,6 +75,7 @@ xfs_compat_ioc_fsgeometry_v1(
+ xfs_fsop_geom_t fsgeo;
+ int error;
+
++ memset(&fsgeo, 0, sizeof(fsgeo));
+ error = xfs_fs_geometry(mp, &fsgeo, 3);
+ if (error)
+ return -error;
+diff --git a/fs/xfs/linux-2.6/xfs_iops.c b/fs/xfs/linux-2.6/xfs_iops.c
+index 1f3b4b8..6102f6d 100644
+--- a/fs/xfs/linux-2.6/xfs_iops.c
++++ b/fs/xfs/linux-2.6/xfs_iops.c
+@@ -468,7 +468,7 @@ xfs_vn_put_link(
+ struct nameidata *nd,
+ void *p)
+ {
+- char *s = nd_get_link(nd);
++ const char *s = nd_get_link(nd);
+
+ if (!IS_ERR(s))
+ kfree(s);
+diff --git a/fs/xfs/xfs_bmap.c b/fs/xfs/xfs_bmap.c
+index 8971fb0..5fc1eb2 100644
+--- a/fs/xfs/xfs_bmap.c
++++ b/fs/xfs/xfs_bmap.c
+@@ -360,7 +360,7 @@ xfs_bmap_validate_ret(
+ int nmap,
+ int ret_nmap);
+ #else
+-#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap)
++#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap) do {} while (0)
+ #endif /* DEBUG */
+
+ #if defined(XFS_RW_TRACE)
+diff --git a/fs/xfs/xfs_dir2_sf.c b/fs/xfs/xfs_dir2_sf.c
+index e89734e..5e84d8d 100644
+--- a/fs/xfs/xfs_dir2_sf.c
++++ b/fs/xfs/xfs_dir2_sf.c
+@@ -779,7 +779,15 @@ xfs_dir2_sf_getdents(
+ }
+
+ ino = xfs_dir2_sf_get_inumber(sfp, xfs_dir2_sf_inumberp(sfep));
+- if (filldir(dirent, sfep->name, sfep->namelen,
++ if (dp->i_df.if_u1.if_data == dp->i_df.if_u2.if_inline_data) {
++ char name[sfep->namelen];
++ memcpy(name, sfep->name, sfep->namelen);
++ if (filldir(dirent, name, sfep->namelen,
++ off & 0x7fffffff, ino, DT_UNKNOWN)) {
++ *offset = off & 0x7fffffff;
++ return 0;
++ }
++ } else if (filldir(dirent, sfep->name, sfep->namelen,
+ off & 0x7fffffff, ino, DT_UNKNOWN)) {
+ *offset = off & 0x7fffffff;
+ return 0;
+diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
+index 8f32f50..b6a41e8 100644
+--- a/fs/xfs/xfs_vnodeops.c
++++ b/fs/xfs/xfs_vnodeops.c
+@@ -564,13 +564,18 @@ xfs_readlink(
+
+ xfs_ilock(ip, XFS_ILOCK_SHARED);
+
+- ASSERT((ip->i_d.di_mode & S_IFMT) == S_IFLNK);
+- ASSERT(ip->i_d.di_size <= MAXPATHLEN);
+-
+ pathlen = ip->i_d.di_size;
+ if (!pathlen)
+ goto out;
+
++ if (pathlen > MAXPATHLEN) {
++ xfs_fs_cmn_err(CE_ALERT, mp, "%s: inode (%llu) symlink length (%d) too long",
++ __func__, (unsigned long long)ip->i_ino, pathlen);
++ ASSERT(0);
++ error = XFS_ERROR(EFSCORRUPTED);
++ goto out;
++ }
++
+ if (ip->i_df.if_flags & XFS_IFINLINE) {
+ memcpy(link, ip->i_df.if_u1.if_data, pathlen);
+ link[pathlen] = '\0';
+diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig
+new file mode 100644
+index 0000000..5be91c0
+--- /dev/null
++++ b/grsecurity/Kconfig
+@@ -0,0 +1,1078 @@
++#
++# grecurity configuration
++#
++
++menu "Grsecurity"
++
++config GRKERNSEC
++ bool "Grsecurity"
++ select CRYPTO
++ select CRYPTO_SHA256
++ help
++ If you say Y here, you will be able to configure many features
++ that will enhance the security of your system. It is highly
++ recommended that you say Y here and read through the help
++ for each option so that you fully understand the features and
++ can evaluate their usefulness for your machine.
++
++choice
++ prompt "Security Level"
++ depends on GRKERNSEC
++ default GRKERNSEC_CUSTOM
++
++config GRKERNSEC_LOW
++ bool "Low"
++ select GRKERNSEC_LINK
++ select GRKERNSEC_FIFO
++ select GRKERNSEC_RANDNET
++ select GRKERNSEC_DMESG
++ select GRKERNSEC_CHROOT
++ select GRKERNSEC_CHROOT_CHDIR
++
++ help
++ If you choose this option, several of the grsecurity options will
++ be enabled that will give you greater protection against a number
++ of attacks, while assuring that none of your software will have any
++ conflicts with the additional security measures. If you run a lot
++ of unusual software, or you are having problems with the higher
++ security levels, you should say Y here. With this option, the
++ following features are enabled:
++
++ - Linking restrictions
++ - FIFO restrictions
++ - Restricted dmesg
++ - Enforced chdir("/") on chroot
++ - Runtime module disabling
++
++config GRKERNSEC_MEDIUM
++ bool "Medium"
++ select PAX
++ select PAX_EI_PAX
++ select PAX_PT_PAX_FLAGS
++ select PAX_HAVE_ACL_FLAGS
++ select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
++ select GRKERNSEC_CHROOT
++ select GRKERNSEC_CHROOT_SYSCTL
++ select GRKERNSEC_LINK
++ select GRKERNSEC_FIFO
++ select GRKERNSEC_DMESG
++ select GRKERNSEC_RANDNET
++ select GRKERNSEC_FORKFAIL
++ select GRKERNSEC_TIME
++ select GRKERNSEC_SIGNAL
++ select GRKERNSEC_CHROOT
++ select GRKERNSEC_CHROOT_UNIX
++ select GRKERNSEC_CHROOT_MOUNT
++ select GRKERNSEC_CHROOT_PIVOT
++ select GRKERNSEC_CHROOT_DOUBLE
++ select GRKERNSEC_CHROOT_CHDIR
++ select GRKERNSEC_CHROOT_MKNOD
++ select GRKERNSEC_PROC
++ select GRKERNSEC_PROC_USERGROUP
++ select PAX_RANDUSTACK
++ select PAX_ASLR
++ select PAX_RANDMMAP
++ select PAX_REFCOUNT if (X86 || SPARC64)
++ select PAX_USERCOPY if ((X86 || SPARC || PPC || ARM) && (SLAB || SLUB || SLOB))
++
++ help
++ If you say Y here, several features in addition to those included
++ in the low additional security level will be enabled. These
++ features provide even more security to your system, though in rare
++ cases they may be incompatible with very old or poorly written
++ software. If you enable this option, make sure that your auth
++ service (identd) is running as gid 1001. With this option,
++ the following features (in addition to those provided in the
++ low additional security level) will be enabled:
++
++ - Failed fork logging
++ - Time change logging
++ - Signal logging
++ - Deny mounts in chroot
++ - Deny double chrooting
++ - Deny sysctl writes in chroot
++ - Deny mknod in chroot
++ - Deny access to abstract AF_UNIX sockets out of chroot
++ - Deny pivot_root in chroot
++ - Denied reads/writes of /dev/kmem, /dev/mem, and /dev/port
++ - /proc restrictions with special GID set to 10 (usually wheel)
++ - Address Space Layout Randomization (ASLR)
++ - Prevent exploitation of most refcount overflows
++ - Bounds checking of copying between the kernel and userland
++
++config GRKERNSEC_HIGH
++ bool "High"
++ select GRKERNSEC_LINK
++ select GRKERNSEC_FIFO
++ select GRKERNSEC_DMESG
++ select GRKERNSEC_FORKFAIL
++ select GRKERNSEC_TIME
++ select GRKERNSEC_SIGNAL
++ select GRKERNSEC_CHROOT
++ select GRKERNSEC_CHROOT_SHMAT
++ select GRKERNSEC_CHROOT_UNIX
++ select GRKERNSEC_CHROOT_MOUNT
++ select GRKERNSEC_CHROOT_FCHDIR
++ select GRKERNSEC_CHROOT_PIVOT
++ select GRKERNSEC_CHROOT_DOUBLE
++ select GRKERNSEC_CHROOT_CHDIR
++ select GRKERNSEC_CHROOT_MKNOD
++ select GRKERNSEC_CHROOT_CAPS
++ select GRKERNSEC_CHROOT_SYSCTL
++ select GRKERNSEC_CHROOT_FINDTASK
++ select GRKERNSEC_SYSFS_RESTRICT
++ select GRKERNSEC_PROC
++ select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
++ select GRKERNSEC_HIDESYM
++ select GRKERNSEC_BRUTE
++ select GRKERNSEC_PROC_USERGROUP
++ select GRKERNSEC_KMEM
++ select GRKERNSEC_RESLOG
++ select GRKERNSEC_RANDNET
++ select GRKERNSEC_PROC_ADD
++ select GRKERNSEC_CHROOT_CHMOD
++ select GRKERNSEC_CHROOT_NICE
++ select GRKERNSEC_SETXID if (X86 || SPARC64 || PPC || ARM || MIPS)
++ select GRKERNSEC_AUDIT_MOUNT
++ select GRKERNSEC_MODHARDEN if (MODULES)
++ select GRKERNSEC_HARDEN_PTRACE
++ select GRKERNSEC_PTRACE_READEXEC
++ select GRKERNSEC_VM86 if (X86_32)
++ select GRKERNSEC_KERN_LOCKOUT if (X86 || ARM || PPC || SPARC)
++ select PAX
++ select PAX_RANDUSTACK
++ select PAX_ASLR
++ select PAX_RANDMMAP
++ select PAX_NOEXEC
++ select PAX_MPROTECT
++ select PAX_EI_PAX
++ select PAX_PT_PAX_FLAGS
++ select PAX_HAVE_ACL_FLAGS
++ select PAX_KERNEXEC if ((PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN)
++ select PAX_MEMORY_UDEREF if (X86 && !XEN)
++ select PAX_RANDKSTACK if (X86_TSC && X86)
++ select PAX_SEGMEXEC if (X86_32)
++ select PAX_PAGEEXEC
++ select PAX_EMUPLT if (ALPHA || PARISC || SPARC)
++ select PAX_EMUTRAMP if (PARISC)
++ select PAX_EMUSIGRT if (PARISC)
++ select PAX_ETEXECRELOCS if (ALPHA || IA64 || PARISC)
++ select PAX_ELFRELOCS if (PAX_ETEXECRELOCS || (IA64 || PPC || X86))
++ select PAX_REFCOUNT if (X86 || SPARC64)
++ select PAX_USERCOPY if ((X86 || SPARC || PPC || ARM) && (SLAB || SLUB || SLOB))
++ help
++ If you say Y here, many of the features of grsecurity will be
++ enabled, which will protect you against many kinds of attacks
++ against your system. The heightened security comes at a cost
++ of an increased chance of incompatibilities with rare software
++ on your machine. Since this security level enables PaX, you should
++ view <http://pax.grsecurity.net> and read about the PaX
++ project. While you are there, download chpax and run it on
++ binaries that cause problems with PaX. Also remember that
++ since the /proc restrictions are enabled, you must run your
++ identd as gid 1001. This security level enables the following
++ features in addition to those listed in the low and medium
++ security levels:
++
++ - Additional /proc restrictions
++ - Chmod restrictions in chroot
++ - No signals, ptrace, or viewing of processes outside of chroot
++ - Capability restrictions in chroot
++ - Deny fchdir out of chroot
++ - Priority restrictions in chroot
++ - Segmentation-based implementation of PaX
++ - Mprotect restrictions
++ - Removal of addresses from /proc/<pid>/[smaps|maps|stat]
++ - Kernel stack randomization
++ - Mount/unmount/remount logging
++ - Kernel symbol hiding
++ - Hardening of module auto-loading
++ - Ptrace restrictions
++ - Restricted vm86 mode
++ - Restricted sysfs/debugfs
++ - Active kernel exploit response
++
++config GRKERNSEC_CUSTOM
++ bool "Custom"
++ help
++ If you say Y here, you will be able to configure every grsecurity
++ option, which allows you to enable many more features that aren't
++ covered in the basic security levels. These additional features
++ include TPE, socket restrictions, and the sysctl system for
++ grsecurity. It is advised that you read through the help for
++ each option to determine its usefulness in your situation.
++
++endchoice
++
++menu "Memory Protections"
++depends on GRKERNSEC
++
++config GRKERNSEC_KMEM
++ bool "Deny reading/writing to /dev/kmem, /dev/mem, and /dev/port"
++ select STRICT_DEVMEM if (X86 || ARM || TILE || S390)
++ help
++ If you say Y here, /dev/kmem and /dev/mem won't be allowed to
++ be written to or read from to modify or leak the contents of the running
++ kernel. /dev/port will also not be allowed to be opened. If you have module
++ support disabled, enabling this will close up four ways that are
++ currently used to insert malicious code into the running kernel.
++ Even with all these features enabled, we still highly recommend that
++ you use the RBAC system, as it is still possible for an attacker to
++ modify the running kernel through privileged I/O granted by ioperm/iopl.
++ If you are not using XFree86, you may be able to stop this additional
++ case by enabling the 'Disable privileged I/O' option. Though nothing
++ legitimately writes to /dev/kmem, XFree86 does need to write to /dev/mem,
++ but only to video memory, which is the only writing we allow in this
++ case. If /dev/kmem or /dev/mem are mmaped without PROT_WRITE, they will
++ not be allowed to mprotect it with PROT_WRITE later.
++ It is highly recommended that you say Y here if you meet all the
++ conditions above.
++
++config GRKERNSEC_VM86
++ bool "Restrict VM86 mode"
++ depends on X86_32
++
++ help
++ If you say Y here, only processes with CAP_SYS_RAWIO will be able to
++ make use of a special execution mode on 32bit x86 processors called
++ Virtual 8086 (VM86) mode. XFree86 may need vm86 mode for certain
++ video cards and will still work with this option enabled. The purpose
++ of the option is to prevent exploitation of emulation errors in
++ virtualization of vm86 mode like the one discovered in VMWare in 2009.
++ Nearly all users should be able to enable this option.
++
++config GRKERNSEC_IO
++ bool "Disable privileged I/O"
++ depends on X86
++ select RTC_CLASS
++ select RTC_INTF_DEV
++ select RTC_DRV_CMOS
++
++ help
++ If you say Y here, all ioperm and iopl calls will return an error.
++ Ioperm and iopl can be used to modify the running kernel.
++ Unfortunately, some programs need this access to operate properly,
++ the most notable of which are XFree86 and hwclock. hwclock can be
++ remedied by having RTC support in the kernel, so real-time
++ clock support is enabled if this option is enabled, to ensure
++ that hwclock operates correctly. XFree86 still will not
++ operate correctly with this option enabled, so DO NOT CHOOSE Y
++ IF YOU USE XFree86. If you use XFree86 and you still want to
++ protect your kernel against modification, use the RBAC system.
++
++config GRKERNSEC_PROC_MEMMAP
++ bool "Harden ASLR against information leaks and entropy reduction"
++ default y if (PAX_NOEXEC || PAX_ASLR)
++ depends on PAX_NOEXEC || PAX_ASLR
++ help
++ If you say Y here, the /proc/<pid>/maps and /proc/<pid>/stat files will
++ give no information about the addresses of its mappings if
++ PaX features that rely on random addresses are enabled on the task.
++ In addition to sanitizing this information and disabling other
++ dangerous sources of information, this option causes reads of sensitive
++ /proc/<pid> entries where the file descriptor was opened in a different
++ task than the one performing the read. Such attempts are logged.
++ This option also limits argv/env strings for suid/sgid binaries
++ to 512KB to prevent a complete exhaustion of the stack entropy provided
++ by ASLR. Finally, it places an 8MB stack resource limit on suid/sgid
++ binaries to prevent alternative mmap layouts from being abused.
++
++ If you use PaX it is essential that you say Y here as it closes up
++ several holes that make full ASLR useless locally.
++
++config GRKERNSEC_BRUTE
++ bool "Deter exploit bruteforcing"
++ help
++ If you say Y here, attempts to bruteforce exploits against forking
++ daemons such as apache or sshd, as well as against suid/sgid binaries
++ will be deterred. When a child of a forking daemon is killed by PaX
++ or crashes due to an illegal instruction or other suspicious signal,
++ the parent process will be delayed 30 seconds upon every subsequent
++ fork until the administrator is able to assess the situation and
++ restart the daemon.
++ In the suid/sgid case, the attempt is logged, the user has all their
++ processes terminated, and they are prevented from executing any further
++ processes for 15 minutes.
++ It is recommended that you also enable signal logging in the auditing
++ section so that logs are generated when a process triggers a suspicious
++ signal.
++ If the sysctl option is enabled, a sysctl option with name
++ "deter_bruteforce" is created.
++
++config GRKERNSEC_MODHARDEN
++ bool "Harden module auto-loading"
++ depends on MODULES
++ help
++ If you say Y here, module auto-loading in response to use of some
++ feature implemented by an unloaded module will be restricted to
++ root users. Enabling this option helps defend against attacks
++ by unprivileged users who abuse the auto-loading behavior to
++ cause a vulnerable module to load that is then exploited.
++
++ If this option prevents a legitimate use of auto-loading for a
++ non-root user, the administrator can execute modprobe manually
++ with the exact name of the module mentioned in the alert log.
++ Alternatively, the administrator can add the module to the list
++ of modules loaded at boot by modifying init scripts.
++
++ Modification of init scripts will most likely be needed on
++ Ubuntu servers with encrypted home directory support enabled,
++ as the first non-root user logging in will cause the ecb(aes),
++ ecb(aes)-all, cbc(aes), and cbc(aes)-all modules to be loaded.
++
++config GRKERNSEC_HIDESYM
++ bool "Hide kernel symbols"
++ help
++ If you say Y here, getting information on loaded modules, and
++ displaying all kernel symbols through a syscall will be restricted
++ to users with CAP_SYS_MODULE. For software compatibility reasons,
++ /proc/kallsyms will be restricted to the root user. The RBAC
++ system can hide that entry even from root.
++
++ This option also prevents leaking of kernel addresses through
++ several /proc entries.
++
++ Note that this option is only effective provided the following
++ conditions are met:
++ 1) The kernel using grsecurity is not precompiled by some distribution
++ 2) You have also enabled GRKERNSEC_DMESG
++ 3) You are using the RBAC system and hiding other files such as your
++ kernel image and System.map. Alternatively, enabling this option
++ causes the permissions on /boot, /lib/modules, and the kernel
++ source directory to change at compile time to prevent
++ reading by non-root users.
++ If the above conditions are met, this option will aid in providing a
++ useful protection against local kernel exploitation of overflows
++ and arbitrary read/write vulnerabilities.
++
++config GRKERNSEC_KERN_LOCKOUT
++ bool "Active kernel exploit response"
++ depends on X86 || ARM || PPC || SPARC
++ help
++ If you say Y here, when a PaX alert is triggered due to suspicious
++ activity in the kernel (from KERNEXEC/UDEREF/USERCOPY)
++ or an OOPs occurs due to bad memory accesses, instead of just
++ terminating the offending process (and potentially allowing
++ a subsequent exploit from the same user), we will take one of two
++ actions:
++ If the user was root, we will panic the system
++ If the user was non-root, we will log the attempt, terminate
++ all processes owned by the user, then prevent them from creating
++ any new processes until the system is restarted
++ This deters repeated kernel exploitation/bruteforcing attempts
++ and is useful for later forensics.
++
++endmenu
++menu "Role Based Access Control Options"
++depends on GRKERNSEC
++
++config GRKERNSEC_RBAC_DEBUG
++ bool
++
++config GRKERNSEC_NO_RBAC
++ bool "Disable RBAC system"
++ help
++ If you say Y here, the /dev/grsec device will be removed from the kernel,
++ preventing the RBAC system from being enabled. You should only say Y
++ here if you have no intention of using the RBAC system, so as to prevent
++ an attacker with root access from misusing the RBAC system to hide files
++ and processes when loadable module support and /dev/[k]mem have been
++ locked down.
++
++config GRKERNSEC_ACL_HIDEKERN
++ bool "Hide kernel processes"
++ help
++ If you say Y here, all kernel threads will be hidden to all
++ processes but those whose subject has the "view hidden processes"
++ flag.
++
++config GRKERNSEC_ACL_MAXTRIES
++ int "Maximum tries before password lockout"
++ default 3
++ help
++ This option enforces the maximum number of times a user can attempt
++ to authorize themselves with the grsecurity RBAC system before being
++ denied the ability to attempt authorization again for a specified time.
++ The lower the number, the harder it will be to brute-force a password.
++
++config GRKERNSEC_ACL_TIMEOUT
++ int "Time to wait after max password tries, in seconds"
++ default 30
++ help
++ This option specifies the time the user must wait after attempting to
++ authorize to the RBAC system with the maximum number of invalid
++ passwords. The higher the number, the harder it will be to brute-force
++ a password.
++
++endmenu
++menu "Filesystem Protections"
++depends on GRKERNSEC
++
++config GRKERNSEC_PROC
++ bool "Proc restrictions"
++ help
++ If you say Y here, the permissions of the /proc filesystem
++ will be altered to enhance system security and privacy. You MUST
++ choose either a user only restriction or a user and group restriction.
++ Depending upon the option you choose, you can either restrict users to
++ see only the processes they themselves run, or choose a group that can
++ view all processes and files normally restricted to root if you choose
++ the "restrict to user only" option. NOTE: If you're running identd or
++ ntpd as a non-root user, you will have to run it as the group you
++ specify here.
++
++config GRKERNSEC_PROC_USER
++ bool "Restrict /proc to user only"
++ depends on GRKERNSEC_PROC
++ help
++ If you say Y here, non-root users will only be able to view their own
++ processes, and restricts them from viewing network-related information,
++ and viewing kernel symbol and module information.
++
++config GRKERNSEC_PROC_USERGROUP
++ bool "Allow special group"
++ depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
++ help
++ If you say Y here, you will be able to select a group that will be
++ able to view all processes and network-related information. If you've
++ enabled GRKERNSEC_HIDESYM, kernel and symbol information may still
++ remain hidden. This option is useful if you want to run identd as
++ a non-root user.
++
++config GRKERNSEC_PROC_GID
++ int "GID for special group"
++ depends on GRKERNSEC_PROC_USERGROUP
++ default 1001
++
++config GRKERNSEC_PROC_ADD
++ bool "Additional restrictions"
++ depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
++ help
++ If you say Y here, additional restrictions will be placed on
++ /proc that keep normal users from viewing device information and
++ slabinfo information that could be useful for exploits.
++
++config GRKERNSEC_LINK
++ bool "Linking restrictions"
++ help
++ If you say Y here, /tmp race exploits will be prevented, since users
++ will no longer be able to follow symlinks owned by other users in
++ world-writable +t directories (e.g. /tmp), unless the owner of the
++ symlink is the owner of the directory. users will also not be
++ able to hardlink to files they do not own. If the sysctl option is
++ enabled, a sysctl option with name "linking_restrictions" is created.
++
++config GRKERNSEC_FIFO
++ bool "FIFO restrictions"
++ help
++ If you say Y here, users will not be able to write to FIFOs they don't
++ own in world-writable +t directories (e.g. /tmp), unless the owner of
++ the FIFO is the same owner of the directory it's held in. If the sysctl
++ option is enabled, a sysctl option with name "fifo_restrictions" is
++ created.
++
++config GRKERNSEC_SYSFS_RESTRICT
++ bool "Sysfs/debugfs restriction"
++ depends on SYSFS
++ help
++ If you say Y here, sysfs (the pseudo-filesystem mounted at /sys) and
++ any filesystem normally mounted under it (e.g. debugfs) will be
++ mostly accessible only by root. These filesystems generally provide access
++ to hardware and debug information that isn't appropriate for unprivileged
++ users of the system. Sysfs and debugfs have also become a large source
++ of new vulnerabilities, ranging from infoleaks to local compromise.
++ There has been very little oversight with an eye toward security involved
++ in adding new exporters of information to these filesystems, so their
++ use is discouraged.
++ For reasons of compatibility, a few directories have been whitelisted
++ for access by non-root users:
++ /sys/fs/selinux
++ /sys/fs/fuse
++ /sys/devices/system/cpu
++
++config GRKERNSEC_ROFS
++ bool "Runtime read-only mount protection"
++ help
++ If you say Y here, a sysctl option with name "romount_protect" will
++ be created. By setting this option to 1 at runtime, filesystems
++ will be protected in the following ways:
++ * No new writable mounts will be allowed
++ * Existing read-only mounts won't be able to be remounted read/write
++ * Write operations will be denied on all block devices
++ This option acts independently of grsec_lock: once it is set to 1,
++ it cannot be turned off. Therefore, please be mindful of the resulting
++ behavior if this option is enabled in an init script on a read-only
++ filesystem. This feature is mainly intended for secure embedded systems.
++
++config GRKERNSEC_CHROOT
++ bool "Chroot jail restrictions"
++ help
++ If you say Y here, you will be able to choose several options that will
++ make breaking out of a chrooted jail much more difficult. If you
++ encounter no software incompatibilities with the following options, it
++ is recommended that you enable each one.
++
++config GRKERNSEC_CHROOT_MOUNT
++ bool "Deny mounts"
++ depends on GRKERNSEC_CHROOT
++ help
++ If you say Y here, processes inside a chroot will not be able to
++ mount or remount filesystems. If the sysctl option is enabled, a
++ sysctl option with name "chroot_deny_mount" is created.
++
++config GRKERNSEC_CHROOT_DOUBLE
++ bool "Deny double-chroots"
++ depends on GRKERNSEC_CHROOT
++ help
++ If you say Y here, processes inside a chroot will not be able to chroot
++ again outside the chroot. This is a widely used method of breaking
++ out of a chroot jail and should not be allowed. If the sysctl
++ option is enabled, a sysctl option with name
++ "chroot_deny_chroot" is created.
++
++config GRKERNSEC_CHROOT_PIVOT
++ bool "Deny pivot_root in chroot"
++ depends on GRKERNSEC_CHROOT
++ help
++ If you say Y here, processes inside a chroot will not be able to use
++ a function called pivot_root() that was introduced in Linux 2.3.41. It
++ works similar to chroot in that it changes the root filesystem. This
++ function could be misused in a chrooted process to attempt to break out
++ of the chroot, and therefore should not be allowed. If the sysctl
++ option is enabled, a sysctl option with name "chroot_deny_pivot" is
++ created.
++
++config GRKERNSEC_CHROOT_CHDIR
++ bool "Enforce chdir(\"/\") on all chroots"
++ depends on GRKERNSEC_CHROOT
++ help
++ If you say Y here, the current working directory of all newly-chrooted
++ applications will be set to the the root directory of the chroot.
++ The man page on chroot(2) states:
++ Note that this call does not change the current working
++ directory, so that `.' can be outside the tree rooted at
++ `/'. In particular, the super-user can escape from a
++ `chroot jail' by doing `mkdir foo; chroot foo; cd ..'.
++
++ It is recommended that you say Y here, since it's not known to break
++ any software. If the sysctl option is enabled, a sysctl option with
++ name "chroot_enforce_chdir" is created.
++
++config GRKERNSEC_CHROOT_CHMOD
++ bool "Deny (f)chmod +s"
++ depends on GRKERNSEC_CHROOT
++ help
++ If you say Y here, processes inside a chroot will not be able to chmod
++ or fchmod files to make them have suid or sgid bits. This protects
++ against another published method of breaking a chroot. If the sysctl
++ option is enabled, a sysctl option with name "chroot_deny_chmod" is
++ created.
++
++config GRKERNSEC_CHROOT_FCHDIR
++ bool "Deny fchdir out of chroot"
++ depends on GRKERNSEC_CHROOT
++ help
++ If you say Y here, a well-known method of breaking chroots by fchdir'ing
++ to a file descriptor of the chrooting process that points to a directory
++ outside the filesystem will be stopped. If the sysctl option
++ is enabled, a sysctl option with name "chroot_deny_fchdir" is created.
++
++config GRKERNSEC_CHROOT_MKNOD
++ bool "Deny mknod"
++ depends on GRKERNSEC_CHROOT
++ help
++ If you say Y here, processes inside a chroot will not be allowed to
++ mknod. The problem with using mknod inside a chroot is that it
++ would allow an attacker to create a device entry that is the same
++ as one on the physical root of your system, which could range from
++ anything from the console device to a device for your harddrive (which
++ they could then use to wipe the drive or steal data). It is recommended
++ that you say Y here, unless you run into software incompatibilities.
++ If the sysctl option is enabled, a sysctl option with name
++ "chroot_deny_mknod" is created.
++
++config GRKERNSEC_CHROOT_SHMAT
++ bool "Deny shmat() out of chroot"
++ depends on GRKERNSEC_CHROOT
++ help
++ If you say Y here, processes inside a chroot will not be able to attach
++ to shared memory segments that were created outside of the chroot jail.
++ It is recommended that you say Y here. If the sysctl option is enabled,
++ a sysctl option with name "chroot_deny_shmat" is created.
++
++config GRKERNSEC_CHROOT_UNIX
++ bool "Deny access to abstract AF_UNIX sockets out of chroot"
++ depends on GRKERNSEC_CHROOT
++ help
++ If you say Y here, processes inside a chroot will not be able to
++ connect to abstract (meaning not belonging to a filesystem) Unix
++ domain sockets that were bound outside of a chroot. It is recommended
++ that you say Y here. If the sysctl option is enabled, a sysctl option
++ with name "chroot_deny_unix" is created.
++
++config GRKERNSEC_CHROOT_FINDTASK
++ bool "Protect outside processes"
++ depends on GRKERNSEC_CHROOT
++ help
++ If you say Y here, processes inside a chroot will not be able to
++ kill, send signals with fcntl, ptrace, capget, getpgid, setpgid,
++ getsid, or view any process outside of the chroot. If the sysctl
++ option is enabled, a sysctl option with name "chroot_findtask" is
++ created.
++
++config GRKERNSEC_CHROOT_NICE
++ bool "Restrict priority changes"
++ depends on GRKERNSEC_CHROOT
++ help
++ If you say Y here, processes inside a chroot will not be able to raise
++ the priority of processes in the chroot, or alter the priority of
++ processes outside the chroot. This provides more security than simply
++ removing CAP_SYS_NICE from the process' capability set. If the
++ sysctl option is enabled, a sysctl option with name "chroot_restrict_nice"
++ is created.
++
++config GRKERNSEC_CHROOT_SYSCTL
++ bool "Deny sysctl writes"
++ depends on GRKERNSEC_CHROOT
++ help
++ If you say Y here, an attacker in a chroot will not be able to
++ write to sysctl entries, either by sysctl(2) or through a /proc
++ interface. It is strongly recommended that you say Y here. If the
++ sysctl option is enabled, a sysctl option with name
++ "chroot_deny_sysctl" is created.
++
++config GRKERNSEC_CHROOT_CAPS
++ bool "Capability restrictions"
++ depends on GRKERNSEC_CHROOT
++ help
++ If you say Y here, the capabilities on all processes within a
++ chroot jail will be lowered to stop module insertion, raw i/o,
++ system and net admin tasks, rebooting the system, modifying immutable
++ files, modifying IPC owned by another, and changing the system time.
++ This is left an option because it can break some apps. Disable this
++ if your chrooted apps are having problems performing those kinds of
++ tasks. If the sysctl option is enabled, a sysctl option with
++ name "chroot_caps" is created.
++
++endmenu
++menu "Kernel Auditing"
++depends on GRKERNSEC
++
++config GRKERNSEC_AUDIT_GROUP
++ bool "Single group for auditing"
++ help
++ If you say Y here, the exec, chdir, and (un)mount logging features
++ will only operate on a group you specify. This option is recommended
++ if you only want to watch certain users instead of having a large
++ amount of logs from the entire system. If the sysctl option is enabled,
++ a sysctl option with name "audit_group" is created.
++
++config GRKERNSEC_AUDIT_GID
++ int "GID for auditing"
++ depends on GRKERNSEC_AUDIT_GROUP
++ default 1007
++
++config GRKERNSEC_EXECLOG
++ bool "Exec logging"
++ help
++ If you say Y here, all execve() calls will be logged (since the
++ other exec*() calls are frontends to execve(), all execution
++ will be logged). Useful for shell-servers that like to keep track
++ of their users. If the sysctl option is enabled, a sysctl option with
++ name "exec_logging" is created.
++ WARNING: This option when enabled will produce a LOT of logs, especially
++ on an active system.
++
++config GRKERNSEC_RESLOG
++ bool "Resource logging"
++ help
++ If you say Y here, all attempts to overstep resource limits will
++ be logged with the resource name, the requested size, and the current
++ limit. It is highly recommended that you say Y here. If the sysctl
++ option is enabled, a sysctl option with name "resource_logging" is
++ created. If the RBAC system is enabled, the sysctl value is ignored.
++
++config GRKERNSEC_CHROOT_EXECLOG
++ bool "Log execs within chroot"
++ help
++ If you say Y here, all executions inside a chroot jail will be logged
++ to syslog. This can cause a large amount of logs if certain
++ applications (eg. djb's daemontools) are installed on the system, and
++ is therefore left as an option. If the sysctl option is enabled, a
++ sysctl option with name "chroot_execlog" is created.
++
++config GRKERNSEC_AUDIT_PTRACE
++ bool "Ptrace logging"
++ help
++ If you say Y here, all attempts to attach to a process via ptrace
++ will be logged. If the sysctl option is enabled, a sysctl option
++ with name "audit_ptrace" is created.
++
++config GRKERNSEC_AUDIT_CHDIR
++ bool "Chdir logging"
++ help
++ If you say Y here, all chdir() calls will be logged. If the sysctl
++ option is enabled, a sysctl option with name "audit_chdir" is created.
++
++config GRKERNSEC_AUDIT_MOUNT
++ bool "(Un)Mount logging"
++ help
++ If you say Y here, all mounts and unmounts will be logged. If the
++ sysctl option is enabled, a sysctl option with name "audit_mount" is
++ created.
++
++config GRKERNSEC_SIGNAL
++ bool "Signal logging"
++ help
++ If you say Y here, certain important signals will be logged, such as
++ SIGSEGV, which will as a result inform you of when a error in a program
++ occurred, which in some cases could mean a possible exploit attempt.
++ If the sysctl option is enabled, a sysctl option with name
++ "signal_logging" is created.
++
++config GRKERNSEC_FORKFAIL
++ bool "Fork failure logging"
++ help
++ If you say Y here, all failed fork() attempts will be logged.
++ This could suggest a fork bomb, or someone attempting to overstep
++ their process limit. If the sysctl option is enabled, a sysctl option
++ with name "forkfail_logging" is created.
++
++config GRKERNSEC_TIME
++ bool "Time change logging"
++ help
++ If you say Y here, any changes of the system clock will be logged.
++ If the sysctl option is enabled, a sysctl option with name
++ "timechange_logging" is created.
++
++config GRKERNSEC_PROC_IPADDR
++ bool "/proc/<pid>/ipaddr support"
++ help
++ If you say Y here, a new entry will be added to each /proc/<pid>
++ directory that contains the IP address of the person using the task.
++ The IP is carried across local TCP and AF_UNIX stream sockets.
++ This information can be useful for IDS/IPSes to perform remote response
++ to a local attack. The entry is readable by only the owner of the
++ process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
++ the RBAC system), and thus does not create privacy concerns.
++
++config GRKERNSEC_RWXMAP_LOG
++ bool 'Denied RWX mmap/mprotect logging'
++ depends on PAX_MPROTECT && !PAX_EMUPLT && !PAX_EMUSIGRT
++ help
++ If you say Y here, calls to mmap() and mprotect() with explicit
++ usage of PROT_WRITE and PROT_EXEC together will be logged when
++ denied by the PAX_MPROTECT feature. If the sysctl option is
++ enabled, a sysctl option with name "rwxmap_logging" is created.
++
++config GRKERNSEC_AUDIT_TEXTREL
++ bool 'ELF text relocations logging (READ HELP)'
++ depends on PAX_MPROTECT
++ help
++ If you say Y here, text relocations will be logged with the filename
++ of the offending library or binary. The purpose of the feature is
++ to help Linux distribution developers get rid of libraries and
++ binaries that need text relocations which hinder the future progress
++ of PaX. Only Linux distribution developers should say Y here, and
++ never on a production machine, as this option creates an information
++ leak that could aid an attacker in defeating the randomization of
++ a single memory region. If the sysctl option is enabled, a sysctl
++ option with name "audit_textrel" is created.
++
++endmenu
++
++menu "Executable Protections"
++depends on GRKERNSEC
++
++config GRKERNSEC_DMESG
++ bool "Dmesg(8) restriction"
++ help
++ If you say Y here, non-root users will not be able to use dmesg(8)
++ to view up to the last 4kb of messages in the kernel's log buffer.
++ The kernel's log buffer often contains kernel addresses and other
++ identifying information useful to an attacker in fingerprinting a
++ system for a targeted exploit.
++ If the sysctl option is enabled, a sysctl option with name "dmesg" is
++ created.
++
++config GRKERNSEC_HARDEN_PTRACE
++ bool "Deter ptrace-based process snooping"
++ help
++ If you say Y here, TTY sniffers and other malicious monitoring
++ programs implemented through ptrace will be defeated. If you
++ have been using the RBAC system, this option has already been
++ enabled for several years for all users, with the ability to make
++ fine-grained exceptions.
++
++ This option only affects the ability of non-root users to ptrace
++ processes that are not a descendent of the ptracing process.
++ This means that strace ./binary and gdb ./binary will still work,
++ but attaching to arbitrary processes will not. If the sysctl
++ option is enabled, a sysctl option with name "harden_ptrace" is
++ created.
++
++config GRKERNSEC_PTRACE_READEXEC
++ bool "Require read access to ptrace sensitive binaries"
++ help
++ If you say Y here, unprivileged users will not be able to ptrace unreadable
++ binaries. This option is useful in environments that
++ remove the read bits (e.g. file mode 4711) from suid binaries to
++ prevent infoleaking of their contents. This option adds
++ consistency to the use of that file mode, as the binary could normally
++ be read out when run without privileges while ptracing.
++
++ If the sysctl option is enabled, a sysctl option with name "ptrace_readexec"
++ is created.
++
++config GRKERNSEC_SETXID
++ bool "Enforce consistent multithreaded privileges"
++ depends on (X86 || SPARC64 || PPC || ARM || MIPS)
++ help
++ If you say Y here, a change from a root uid to a non-root uid
++ in a multithreaded application will cause the resulting uids,
++ gids, supplementary groups, and capabilities in that thread
++ to be propagated to the other threads of the process. In most
++ cases this is unnecessary, as glibc will emulate this behavior
++ on behalf of the application. Other libcs do not act in the
++ same way, allowing the other threads of the process to continue
++ running with root privileges. If the sysctl option is enabled,
++ a sysctl option with name "consistent_setxid" is created.
++
++config GRKERNSEC_TPE
++ bool "Trusted Path Execution (TPE)"
++ help
++ If you say Y here, you will be able to choose a gid to add to the
++ supplementary groups of users you want to mark as "untrusted."
++ These users will not be able to execute any files that are not in
++ root-owned directories writable only by root. If the sysctl option
++ is enabled, a sysctl option with name "tpe" is created.
++
++config GRKERNSEC_TPE_ALL
++ bool "Partially restrict all non-root users"
++ depends on GRKERNSEC_TPE
++ help
++ If you say Y here, all non-root users will be covered under
++ a weaker TPE restriction. This is separate from, and in addition to,
++ the main TPE options that you have selected elsewhere. Thus, if a
++ "trusted" GID is chosen, this restriction applies to even that GID.
++ Under this restriction, all non-root users will only be allowed to
++ execute files in directories they own that are not group or
++ world-writable, or in directories owned by root and writable only by
++ root. If the sysctl option is enabled, a sysctl option with name
++ "tpe_restrict_all" is created.
++
++config GRKERNSEC_TPE_INVERT
++ bool "Invert GID option"
++ depends on GRKERNSEC_TPE
++ help
++ If you say Y here, the group you specify in the TPE configuration will
++ decide what group TPE restrictions will be *disabled* for. This
++ option is useful if you want TPE restrictions to be applied to most
++ users on the system. If the sysctl option is enabled, a sysctl option
++ with name "tpe_invert" is created. Unlike other sysctl options, this
++ entry will default to on for backward-compatibility.
++
++config GRKERNSEC_TPE_GID
++ int "GID for untrusted users"
++ depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
++ default 1005
++ help
++ Setting this GID determines what group TPE restrictions will be
++ *enabled* for. If the sysctl option is enabled, a sysctl option
++ with name "tpe_gid" is created.
++
++config GRKERNSEC_TPE_GID
++ int "GID for trusted users"
++ depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
++ default 1005
++ help
++ Setting this GID determines what group TPE restrictions will be
++ *disabled* for. If the sysctl option is enabled, a sysctl option
++ with name "tpe_gid" is created.
++
++endmenu
++menu "Network Protections"
++depends on GRKERNSEC
++
++config GRKERNSEC_RANDNET
++ bool "Larger entropy pools"
++ help
++ If you say Y here, the entropy pools used for many features of Linux
++ and grsecurity will be doubled in size. Since several grsecurity
++ features use additional randomness, it is recommended that you say Y
++ here. Saying Y here has a similar effect as modifying
++ /proc/sys/kernel/random/poolsize.
++
++config GRKERNSEC_BLACKHOLE
++ bool "TCP/UDP blackhole and LAST_ACK DoS prevention"
++ depends on NET
++ help
++ If you say Y here, neither TCP resets nor ICMP
++ destination-unreachable packets will be sent in response to packets
++ sent to ports for which no associated listening process exists.
++ This feature supports both IPV4 and IPV6 and exempts the
++ loopback interface from blackholing. Enabling this feature
++ makes a host more resilient to DoS attacks and reduces network
++ visibility against scanners.
++
++ The blackhole feature as-implemented is equivalent to the FreeBSD
++ blackhole feature, as it prevents RST responses to all packets, not
++ just SYNs. Under most application behavior this causes no
++ problems, but applications (like haproxy) may not close certain
++ connections in a way that cleanly terminates them on the remote
++ end, leaving the remote host in LAST_ACK state. Because of this
++ side-effect and to prevent intentional LAST_ACK DoSes, this
++ feature also adds automatic mitigation against such attacks.
++ The mitigation drastically reduces the amount of time a socket
++ can spend in LAST_ACK state. If you're using haproxy and not
++ all servers it connects to have this option enabled, consider
++ disabling this feature on the haproxy host.
++
++ If the sysctl option is enabled, two sysctl options with names
++ "ip_blackhole" and "lastack_retries" will be created.
++ While "ip_blackhole" takes the standard zero/non-zero on/off
++ toggle, "lastack_retries" uses the same kinds of values as
++ "tcp_retries1" and "tcp_retries2". The default value of 4
++ prevents a socket from lasting more than 45 seconds in LAST_ACK
++ state.
++
++config GRKERNSEC_SOCKET
++ bool "Socket restrictions"
++ depends on NET
++ help
++ If you say Y here, you will be able to choose from several options.
++ If you assign a GID on your system and add it to the supplementary
++ groups of users you want to restrict socket access to, this patch
++ will perform up to three things, based on the option(s) you choose.
++
++config GRKERNSEC_SOCKET_ALL
++ bool "Deny any sockets to group"
++ depends on GRKERNSEC_SOCKET
++ help
++ If you say Y here, you will be able to choose a GID of whose users will
++ be unable to connect to other hosts from your machine or run server
++ applications from your machine. If the sysctl option is enabled, a
++ sysctl option with name "socket_all" is created.
++
++config GRKERNSEC_SOCKET_ALL_GID
++ int "GID to deny all sockets for"
++ depends on GRKERNSEC_SOCKET_ALL
++ default 1004
++ help
++ Here you can choose the GID to disable socket access for. Remember to
++ add the users you want socket access disabled for to the GID
++ specified here. If the sysctl option is enabled, a sysctl option
++ with name "socket_all_gid" is created.
++
++config GRKERNSEC_SOCKET_CLIENT
++ bool "Deny client sockets to group"
++ depends on GRKERNSEC_SOCKET
++ help
++ If you say Y here, you will be able to choose a GID of whose users will
++ be unable to connect to other hosts from your machine, but will be
++ able to run servers. If this option is enabled, all users in the group
++ you specify will have to use passive mode when initiating ftp transfers
++ from the shell on your machine. If the sysctl option is enabled, a
++ sysctl option with name "socket_client" is created.
++
++config GRKERNSEC_SOCKET_CLIENT_GID
++ int "GID to deny client sockets for"
++ depends on GRKERNSEC_SOCKET_CLIENT
++ default 1003
++ help
++ Here you can choose the GID to disable client socket access for.
++ Remember to add the users you want client socket access disabled for to
++ the GID specified here. If the sysctl option is enabled, a sysctl
++ option with name "socket_client_gid" is created.
++
++config GRKERNSEC_SOCKET_SERVER
++ bool "Deny server sockets to group"
++ depends on GRKERNSEC_SOCKET
++ help
++ If you say Y here, you will be able to choose a GID of whose users will
++ be unable to run server applications from your machine. If the sysctl
++ option is enabled, a sysctl option with name "socket_server" is created.
++
++config GRKERNSEC_SOCKET_SERVER_GID
++ int "GID to deny server sockets for"
++ depends on GRKERNSEC_SOCKET_SERVER
++ default 1002
++ help
++ Here you can choose the GID to disable server socket access for.
++ Remember to add the users you want server socket access disabled for to
++ the GID specified here. If the sysctl option is enabled, a sysctl
++ option with name "socket_server_gid" is created.
++
++endmenu
++menu "Sysctl support"
++depends on GRKERNSEC && SYSCTL
++
++config GRKERNSEC_SYSCTL
++ bool "Sysctl support"
++ help
++ If you say Y here, you will be able to change the options that
++ grsecurity runs with at bootup, without having to recompile your
++ kernel. You can echo values to files in /proc/sys/kernel/grsecurity
++ to enable (1) or disable (0) various features. All the sysctl entries
++ are mutable until the "grsec_lock" entry is set to a non-zero value.
++ All features enabled in the kernel configuration are disabled at boot
++ if you do not say Y to the "Turn on features by default" option.
++ All options should be set at startup, and the grsec_lock entry should
++ be set to a non-zero value after all the options are set.
++ *THIS IS EXTREMELY IMPORTANT*
++
++config GRKERNSEC_SYSCTL_DISTRO
++ bool "Extra sysctl support for distro makers (READ HELP)"
++ depends on GRKERNSEC_SYSCTL && GRKERNSEC_IO
++ help
++ If you say Y here, additional sysctl options will be created
++ for features that affect processes running as root. Therefore,
++ it is critical when using this option that the grsec_lock entry be
++ enabled after boot. Only distros with prebuilt kernel packages
++ with this option enabled that can ensure grsec_lock is enabled
++ after boot should use this option.
++ *Failure to set grsec_lock after boot makes all grsec features
++ this option covers useless*
++
++ Currently this option creates the following sysctl entries:
++ "Disable Privileged I/O": "disable_priv_io"
++
++config GRKERNSEC_SYSCTL_ON
++ bool "Turn on features by default"
++ depends on GRKERNSEC_SYSCTL
++ help
++ If you say Y here, instead of having all features enabled in the
++ kernel configuration disabled at boot time, the features will be
++ enabled at boot time. It is recommended you say Y here unless
++ there is some reason you would want all sysctl-tunable features to
++ be disabled by default. As mentioned elsewhere, it is important
++ to enable the grsec_lock entry once you have finished modifying
++ the sysctl entries.
++
++endmenu
++menu "Logging Options"
++depends on GRKERNSEC
++
++config GRKERNSEC_FLOODTIME
++ int "Seconds in between log messages (minimum)"
++ default 10
++ help
++ This option allows you to enforce the number of seconds between
++ grsecurity log messages. The default should be suitable for most
++ people, however, if you choose to change it, choose a value small enough
++ to allow informative logs to be produced, but large enough to
++ prevent flooding.
++
++config GRKERNSEC_FLOODBURST
++ int "Number of messages in a burst (maximum)"
++ default 6
++ help
++ This option allows you to choose the maximum number of messages allowed
++ within the flood time interval you chose in a separate option. The
++ default should be suitable for most people, however if you find that
++ many of your logs are being interpreted as flooding, you may want to
++ raise this value.
++
++endmenu
++
++endmenu
+diff --git a/grsecurity/Makefile b/grsecurity/Makefile
+new file mode 100644
+index 0000000..1b9afa9
+--- /dev/null
++++ b/grsecurity/Makefile
+@@ -0,0 +1,38 @@
++# grsecurity's ACL system was originally written in 2001 by Michael Dalton
++# during 2001-2009 it has been completely redesigned by Brad Spengler
++# into an RBAC system
++#
++# All code in this directory and various hooks inserted throughout the kernel
++# are copyright Brad Spengler - Open Source Security, Inc., and released
++# under the GPL v2 or higher
++
++KBUILD_CFLAGS += -Werror
++
++obj-y = grsec_chdir.o grsec_chroot.o grsec_exec.o grsec_fifo.o grsec_fork.o \
++ grsec_mount.o grsec_sig.o grsec_sysctl.o \
++ grsec_time.o grsec_tpe.o grsec_link.o grsec_pax.o grsec_ptrace.o
++
++obj-$(CONFIG_GRKERNSEC) += grsec_init.o grsum.o gracl.o gracl_segv.o \
++ gracl_cap.o gracl_alloc.o gracl_shm.o grsec_mem.o gracl_fs.o \
++ gracl_learn.o grsec_log.o
++obj-$(CONFIG_GRKERNSEC_RESLOG) += gracl_res.o
++
++ifdef CONFIG_NET
++obj-y += grsec_sock.o
++obj-$(CONFIG_GRKERNSEC) += gracl_ip.o
++endif
++
++ifndef CONFIG_GRKERNSEC
++obj-y += grsec_disabled.o
++endif
++
++ifdef CONFIG_GRKERNSEC_HIDESYM
++extra-y := grsec_hidesym.o
++$(obj)/grsec_hidesym.o:
++ @-chmod -f 500 /boot
++ @-chmod -f 500 /lib/modules
++ @-chmod -f 500 /lib64/modules
++ @-chmod -f 500 /lib32/modules
++ @-chmod -f 700 .
++ @echo ' grsec: protected kernel image paths'
++endif
+diff --git a/grsecurity/gracl.c b/grsecurity/gracl.c
+new file mode 100644
+index 0000000..c475143
+--- /dev/null
++++ b/grsecurity/gracl.c
+@@ -0,0 +1,4171 @@
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/sched.h>
++#include <linux/mm.h>
++#include <linux/file.h>
++#include <linux/fs.h>
++#include <linux/namei.h>
++#include <linux/mount.h>
++#include <linux/tty.h>
++#include <linux/proc_fs.h>
++#include <linux/smp_lock.h>
++#include <linux/slab.h>
++#include <linux/vmalloc.h>
++#include <linux/types.h>
++#include <linux/sysctl.h>
++#include <linux/netdevice.h>
++#include <linux/ptrace.h>
++#include <linux/gracl.h>
++#include <linux/gralloc.h>
++#include <linux/security.h>
++#include <linux/grinternal.h>
++#include <linux/pid_namespace.h>
++#include <linux/fdtable.h>
++#include <linux/percpu.h>
++
++#include <asm/uaccess.h>
++#include <asm/errno.h>
++#include <asm/mman.h>
++
++static struct acl_role_db acl_role_set;
++static struct name_db name_set;
++static struct inodev_db inodev_set;
++
++/* for keeping track of userspace pointers used for subjects, so we
++ can share references in the kernel as well
++*/
++
++static struct dentry *real_root;
++static struct vfsmount *real_root_mnt;
++
++static struct acl_subj_map_db subj_map_set;
++
++static struct acl_role_label *default_role;
++
++static struct acl_role_label *role_list;
++
++static u16 acl_sp_role_value;
++
++extern char *gr_shared_page[4];
++static DEFINE_MUTEX(gr_dev_mutex);
++DEFINE_RWLOCK(gr_inode_lock);
++
++struct gr_arg *gr_usermode;
++
++static unsigned int gr_status __read_only = GR_STATUS_INIT;
++
++extern int chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum);
++extern void gr_clear_learn_entries(void);
++
++#ifdef CONFIG_GRKERNSEC_RESLOG
++extern void gr_log_resource(const struct task_struct *task,
++ const int res, const unsigned long wanted, const int gt);
++#endif
++
++unsigned char *gr_system_salt;
++unsigned char *gr_system_sum;
++
++static struct sprole_pw **acl_special_roles = NULL;
++static __u16 num_sprole_pws = 0;
++
++static struct acl_role_label *kernel_role = NULL;
++
++static unsigned int gr_auth_attempts = 0;
++static unsigned long gr_auth_expires = 0UL;
++
++#ifdef CONFIG_NET
++extern struct vfsmount *sock_mnt;
++#endif
++extern struct vfsmount *pipe_mnt;
++extern struct vfsmount *shm_mnt;
++#ifdef CONFIG_HUGETLBFS
++extern struct vfsmount *hugetlbfs_vfsmount;
++#endif
++
++static struct acl_object_label *fakefs_obj_rw;
++static struct acl_object_label *fakefs_obj_rwx;
++
++extern int gr_init_uidset(void);
++extern void gr_free_uidset(void);
++extern void gr_remove_uid(uid_t uid);
++extern int gr_find_uid(uid_t uid);
++
++__inline__ int
++gr_acl_is_enabled(void)
++{
++ return (gr_status & GR_READY);
++}
++
++#ifdef CONFIG_BTRFS_FS
++extern dev_t get_btrfs_dev_from_inode(struct inode *inode);
++extern int btrfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat);
++#endif
++
++static inline dev_t __get_dev(const struct dentry *dentry)
++{
++#ifdef CONFIG_BTRFS_FS
++ if (dentry->d_inode->i_op && dentry->d_inode->i_op->getattr == &btrfs_getattr)
++ return get_btrfs_dev_from_inode(dentry->d_inode);
++ else
++#endif
++ return dentry->d_inode->i_sb->s_dev;
++}
++
++dev_t gr_get_dev_from_dentry(struct dentry *dentry)
++{
++ return __get_dev(dentry);
++}
++
++static char gr_task_roletype_to_char(struct task_struct *task)
++{
++ switch (task->role->roletype &
++ (GR_ROLE_DEFAULT | GR_ROLE_USER | GR_ROLE_GROUP |
++ GR_ROLE_SPECIAL)) {
++ case GR_ROLE_DEFAULT:
++ return 'D';
++ case GR_ROLE_USER:
++ return 'U';
++ case GR_ROLE_GROUP:
++ return 'G';
++ case GR_ROLE_SPECIAL:
++ return 'S';
++ }
++
++ return 'X';
++}
++
++char gr_roletype_to_char(void)
++{
++ return gr_task_roletype_to_char(current);
++}
++
++__inline__ int
++gr_acl_tpe_check(void)
++{
++ if (unlikely(!(gr_status & GR_READY)))
++ return 0;
++ if (current->role->roletype & GR_ROLE_TPE)
++ return 1;
++ else
++ return 0;
++}
++
++int
++gr_handle_rawio(const struct inode *inode)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
++ if (inode && S_ISBLK(inode->i_mode) &&
++ grsec_enable_chroot_caps && proc_is_chrooted(current) &&
++ !capable(CAP_SYS_RAWIO))
++ return 1;
++#endif
++ return 0;
++}
++
++static int
++gr_streq(const char *a, const char *b, const unsigned int lena, const unsigned int lenb)
++{
++ if (likely(lena != lenb))
++ return 0;
++
++ return !memcmp(a, b, lena);
++}
++
++static int prepend(char **buffer, int *buflen, const char *str, int namelen)
++{
++ *buflen -= namelen;
++ if (*buflen < 0)
++ return -ENAMETOOLONG;
++ *buffer -= namelen;
++ memcpy(*buffer, str, namelen);
++ return 0;
++}
++
++/* this must be called with vfsmount_lock and dcache_lock held */
++
++static char * __our_d_path(struct dentry *dentry, struct vfsmount *vfsmnt,
++ struct dentry *root, struct vfsmount *rootmnt,
++ char *buffer, int buflen)
++{
++ char * end = buffer+buflen;
++ char * retval;
++ int namelen;
++
++ *--end = '\0';
++ buflen--;
++
++ if (buflen < 1)
++ goto Elong;
++ /* Get '/' right */
++ retval = end-1;
++ *retval = '/';
++
++ for (;;) {
++ struct dentry * parent;
++
++ if (dentry == root && vfsmnt == rootmnt)
++ break;
++ if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
++ /* Global root? */
++ if (vfsmnt->mnt_parent == vfsmnt)
++ goto global_root;
++ dentry = vfsmnt->mnt_mountpoint;
++ vfsmnt = vfsmnt->mnt_parent;
++ continue;
++ }
++ parent = dentry->d_parent;
++ prefetch(parent);
++ namelen = dentry->d_name.len;
++ buflen -= namelen + 1;
++ if (buflen < 0)
++ goto Elong;
++ end -= namelen;
++ memcpy(end, dentry->d_name.name, namelen);
++ *--end = '/';
++ retval = end;
++ dentry = parent;
++ }
++
++out:
++ return retval;
++
++global_root:
++ namelen = dentry->d_name.len;
++ buflen -= namelen;
++ if (buflen < 0)
++ goto Elong;
++ retval -= namelen-1; /* hit the slash */
++ memcpy(retval, dentry->d_name.name, namelen);
++ goto out;
++Elong:
++ retval = ERR_PTR(-ENAMETOOLONG);
++ goto out;
++}
++
++static char *
++gen_full_path(struct dentry *dentry, struct vfsmount *vfsmnt,
++ struct dentry *root, struct vfsmount *rootmnt, char *buf, int buflen)
++{
++ char *retval;
++
++ retval = __our_d_path(dentry, vfsmnt, root, rootmnt, buf, buflen);
++ if (unlikely(IS_ERR(retval)))
++ retval = strcpy(buf, "<path too long>");
++ else if (unlikely(retval[1] == '/' && retval[2] == '\0'))
++ retval[1] = '\0';
++
++ return retval;
++}
++
++static char *
++__d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
++ char *buf, int buflen)
++{
++ char *res;
++
++ /* we can use real_root, real_root_mnt, because this is only called
++ by the RBAC system */
++ res = gen_full_path((struct dentry *)dentry, (struct vfsmount *)vfsmnt, real_root, real_root_mnt, buf, buflen);
++
++ return res;
++}
++
++static char *
++d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
++ char *buf, int buflen)
++{
++ char *res;
++ struct dentry *root;
++ struct vfsmount *rootmnt;
++ struct task_struct *reaper = &init_task;
++
++ /* we can't use real_root, real_root_mnt, because they belong only to the RBAC system */
++ read_lock(&reaper->fs->lock);
++ root = dget(reaper->fs->root.dentry);
++ rootmnt = mntget(reaper->fs->root.mnt);
++ read_unlock(&reaper->fs->lock);
++
++ spin_lock(&dcache_lock);
++ spin_lock(&vfsmount_lock);
++ res = gen_full_path((struct dentry *)dentry, (struct vfsmount *)vfsmnt, root, rootmnt, buf, buflen);
++ spin_unlock(&vfsmount_lock);
++ spin_unlock(&dcache_lock);
++
++ dput(root);
++ mntput(rootmnt);
++ return res;
++}
++
++static char *
++gr_to_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++ char *ret;
++ spin_lock(&dcache_lock);
++ spin_lock(&vfsmount_lock);
++ ret = __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
++ PAGE_SIZE);
++ spin_unlock(&vfsmount_lock);
++ spin_unlock(&dcache_lock);
++ return ret;
++}
++
++static char *
++gr_to_proc_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++ char *ret;
++ char *buf;
++ int buflen;
++
++ spin_lock(&dcache_lock);
++ spin_lock(&vfsmount_lock);
++ buf = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
++ ret = __d_real_path(dentry, mnt, buf, PAGE_SIZE - 6);
++ buflen = (int)(ret - buf);
++ if (buflen >= 5)
++ prepend(&ret, &buflen, "/proc", 5);
++ else
++ ret = strcpy(buf, "<path too long>");
++ spin_unlock(&vfsmount_lock);
++ spin_unlock(&dcache_lock);
++ return ret;
++}
++
++char *
++gr_to_filename_nolock(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++ return __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
++ PAGE_SIZE);
++}
++
++char *
++gr_to_filename(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
++ PAGE_SIZE);
++}
++
++char *
++gr_to_filename1(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[1], smp_processor_id()),
++ PAGE_SIZE);
++}
++
++char *
++gr_to_filename2(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[2], smp_processor_id()),
++ PAGE_SIZE);
++}
++
++char *
++gr_to_filename3(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[3], smp_processor_id()),
++ PAGE_SIZE);
++}
++
++__inline__ __u32
++to_gr_audit(const __u32 reqmode)
++{
++ /* masks off auditable permission flags, then shifts them to create
++ auditing flags, and adds the special case of append auditing if
++ we're requesting write */
++ return (((reqmode & ~GR_AUDITS) << 10) | ((reqmode & GR_WRITE) ? GR_AUDIT_APPEND : 0));
++}
++
++struct acl_subject_label *
++lookup_subject_map(const struct acl_subject_label *userp)
++{
++ unsigned int index = shash(userp, subj_map_set.s_size);
++ struct subject_map *match;
++
++ match = subj_map_set.s_hash[index];
++
++ while (match && match->user != userp)
++ match = match->next;
++
++ if (match != NULL)
++ return match->kernel;
++ else
++ return NULL;
++}
++
++static void
++insert_subj_map_entry(struct subject_map *subjmap)
++{
++ unsigned int index = shash(subjmap->user, subj_map_set.s_size);
++ struct subject_map **curr;
++
++ subjmap->prev = NULL;
++
++ curr = &subj_map_set.s_hash[index];
++ if (*curr != NULL)
++ (*curr)->prev = subjmap;
++
++ subjmap->next = *curr;
++ *curr = subjmap;
++
++ return;
++}
++
++static struct acl_role_label *
++lookup_acl_role_label(const struct task_struct *task, const uid_t uid,
++ const gid_t gid)
++{
++ unsigned int index = rhash(uid, GR_ROLE_USER, acl_role_set.r_size);
++ struct acl_role_label *match;
++ struct role_allowed_ip *ipp;
++ unsigned int x;
++ u32 curr_ip = task->signal->curr_ip;
++
++ task->signal->saved_ip = curr_ip;
++
++ match = acl_role_set.r_hash[index];
++
++ while (match) {
++ if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_USER)) == (GR_ROLE_DOMAIN | GR_ROLE_USER)) {
++ for (x = 0; x < match->domain_child_num; x++) {
++ if (match->domain_children[x] == uid)
++ goto found;
++ }
++ } else if (match->uidgid == uid && match->roletype & GR_ROLE_USER)
++ break;
++ match = match->next;
++ }
++found:
++ if (match == NULL) {
++ try_group:
++ index = rhash(gid, GR_ROLE_GROUP, acl_role_set.r_size);
++ match = acl_role_set.r_hash[index];
++
++ while (match) {
++ if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) == (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) {
++ for (x = 0; x < match->domain_child_num; x++) {
++ if (match->domain_children[x] == gid)
++ goto found2;
++ }
++ } else if (match->uidgid == gid && match->roletype & GR_ROLE_GROUP)
++ break;
++ match = match->next;
++ }
++found2:
++ if (match == NULL)
++ match = default_role;
++ if (match->allowed_ips == NULL)
++ return match;
++ else {
++ for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
++ if (likely
++ ((ntohl(curr_ip) & ipp->netmask) ==
++ (ntohl(ipp->addr) & ipp->netmask)))
++ return match;
++ }
++ match = default_role;
++ }
++ } else if (match->allowed_ips == NULL) {
++ return match;
++ } else {
++ for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
++ if (likely
++ ((ntohl(curr_ip) & ipp->netmask) ==
++ (ntohl(ipp->addr) & ipp->netmask)))
++ return match;
++ }
++ goto try_group;
++ }
++
++ return match;
++}
++
++struct acl_subject_label *
++lookup_acl_subj_label(const ino_t ino, const dev_t dev,
++ const struct acl_role_label *role)
++{
++ unsigned int index = fhash(ino, dev, role->subj_hash_size);
++ struct acl_subject_label *match;
++
++ match = role->subj_hash[index];
++
++ while (match && (match->inode != ino || match->device != dev ||
++ (match->mode & GR_DELETED))) {
++ match = match->next;
++ }
++
++ if (match && !(match->mode & GR_DELETED))
++ return match;
++ else
++ return NULL;
++}
++
++struct acl_subject_label *
++lookup_acl_subj_label_deleted(const ino_t ino, const dev_t dev,
++ const struct acl_role_label *role)
++{
++ unsigned int index = fhash(ino, dev, role->subj_hash_size);
++ struct acl_subject_label *match;
++
++ match = role->subj_hash[index];
++
++ while (match && (match->inode != ino || match->device != dev ||
++ !(match->mode & GR_DELETED))) {
++ match = match->next;
++ }
++
++ if (match && (match->mode & GR_DELETED))
++ return match;
++ else
++ return NULL;
++}
++
++static struct acl_object_label *
++lookup_acl_obj_label(const ino_t ino, const dev_t dev,
++ const struct acl_subject_label *subj)
++{
++ unsigned int index = fhash(ino, dev, subj->obj_hash_size);
++ struct acl_object_label *match;
++
++ match = subj->obj_hash[index];
++
++ while (match && (match->inode != ino || match->device != dev ||
++ (match->mode & GR_DELETED))) {
++ match = match->next;
++ }
++
++ if (match && !(match->mode & GR_DELETED))
++ return match;
++ else
++ return NULL;
++}
++
++static struct acl_object_label *
++lookup_acl_obj_label_create(const ino_t ino, const dev_t dev,
++ const struct acl_subject_label *subj)
++{
++ unsigned int index = fhash(ino, dev, subj->obj_hash_size);
++ struct acl_object_label *match;
++
++ match = subj->obj_hash[index];
++
++ while (match && (match->inode != ino || match->device != dev ||
++ !(match->mode & GR_DELETED))) {
++ match = match->next;
++ }
++
++ if (match && (match->mode & GR_DELETED))
++ return match;
++
++ match = subj->obj_hash[index];
++
++ while (match && (match->inode != ino || match->device != dev ||
++ (match->mode & GR_DELETED))) {
++ match = match->next;
++ }
++
++ if (match && !(match->mode & GR_DELETED))
++ return match;
++ else
++ return NULL;
++}
++
++static struct name_entry *
++lookup_name_entry(const char *name)
++{
++ unsigned int len = strlen(name);
++ unsigned int key = full_name_hash(name, len);
++ unsigned int index = key % name_set.n_size;
++ struct name_entry *match;
++
++ match = name_set.n_hash[index];
++
++ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len)))
++ match = match->next;
++
++ return match;
++}
++
++static struct name_entry *
++lookup_name_entry_create(const char *name)
++{
++ unsigned int len = strlen(name);
++ unsigned int key = full_name_hash(name, len);
++ unsigned int index = key % name_set.n_size;
++ struct name_entry *match;
++
++ match = name_set.n_hash[index];
++
++ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
++ !match->deleted))
++ match = match->next;
++
++ if (match && match->deleted)
++ return match;
++
++ match = name_set.n_hash[index];
++
++ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
++ match->deleted))
++ match = match->next;
++
++ if (match && !match->deleted)
++ return match;
++ else
++ return NULL;
++}
++
++static struct inodev_entry *
++lookup_inodev_entry(const ino_t ino, const dev_t dev)
++{
++ unsigned int index = fhash(ino, dev, inodev_set.i_size);
++ struct inodev_entry *match;
++
++ match = inodev_set.i_hash[index];
++
++ while (match && (match->nentry->inode != ino || match->nentry->device != dev))
++ match = match->next;
++
++ return match;
++}
++
++static void
++insert_inodev_entry(struct inodev_entry *entry)
++{
++ unsigned int index = fhash(entry->nentry->inode, entry->nentry->device,
++ inodev_set.i_size);
++ struct inodev_entry **curr;
++
++ entry->prev = NULL;
++
++ curr = &inodev_set.i_hash[index];
++ if (*curr != NULL)
++ (*curr)->prev = entry;
++
++ entry->next = *curr;
++ *curr = entry;
++
++ return;
++}
++
++static void
++__insert_acl_role_label(struct acl_role_label *role, uid_t uidgid)
++{
++ unsigned int index =
++ rhash(uidgid, role->roletype & (GR_ROLE_USER | GR_ROLE_GROUP), acl_role_set.r_size);
++ struct acl_role_label **curr;
++ struct acl_role_label *tmp, *tmp2;
++
++ curr = &acl_role_set.r_hash[index];
++
++ /* simple case, slot is empty, just set it to our role */
++ if (*curr == NULL) {
++ *curr = role;
++ } else {
++ /* example:
++ 1 -> 2 -> 3 (adding 2 -> 3 to here)
++ 2 -> 3
++ */
++ /* first check to see if we can already be reached via this slot */
++ tmp = *curr;
++ while (tmp && tmp != role)
++ tmp = tmp->next;
++ if (tmp == role) {
++ /* we don't need to add ourselves to this slot's chain */
++ return;
++ }
++ /* we need to add ourselves to this chain, two cases */
++ if (role->next == NULL) {
++ /* simple case, append the current chain to our role */
++ role->next = *curr;
++ *curr = role;
++ } else {
++ /* 1 -> 2 -> 3 -> 4
++ 2 -> 3 -> 4
++ 3 -> 4 (adding 1 -> 2 -> 3 -> 4 to here)
++ */
++ /* trickier case: walk our role's chain until we find
++ the role for the start of the current slot's chain */
++ tmp = role;
++ tmp2 = *curr;
++ while (tmp->next && tmp->next != tmp2)
++ tmp = tmp->next;
++ if (tmp->next == tmp2) {
++ /* from example above, we found 3, so just
++ replace this slot's chain with ours */
++ *curr = role;
++ } else {
++ /* we didn't find a subset of our role's chain
++ in the current slot's chain, so append their
++ chain to ours, and set us as the first role in
++ the slot's chain
++
++ we could fold this case with the case above,
++ but making it explicit for clarity
++ */
++ tmp->next = tmp2;
++ *curr = role;
++ }
++ }
++ }
++
++ return;
++}
++
++static void
++insert_acl_role_label(struct acl_role_label *role)
++{
++ int i;
++
++ if (role_list == NULL) {
++ role_list = role;
++ role->prev = NULL;
++ } else {
++ role->prev = role_list;
++ role_list = role;
++ }
++
++ /* used for hash chains */
++ role->next = NULL;
++
++ if (role->roletype & GR_ROLE_DOMAIN) {
++ for (i = 0; i < role->domain_child_num; i++)
++ __insert_acl_role_label(role, role->domain_children[i]);
++ } else
++ __insert_acl_role_label(role, role->uidgid);
++}
++
++static int
++insert_name_entry(char *name, const ino_t inode, const dev_t device, __u8 deleted)
++{
++ struct name_entry **curr, *nentry;
++ struct inodev_entry *ientry;
++ unsigned int len = strlen(name);
++ unsigned int key = full_name_hash(name, len);
++ unsigned int index = key % name_set.n_size;
++
++ curr = &name_set.n_hash[index];
++
++ while (*curr && ((*curr)->key != key || !gr_streq((*curr)->name, name, (*curr)->len, len)))
++ curr = &((*curr)->next);
++
++ if (*curr != NULL)
++ return 1;
++
++ nentry = acl_alloc(sizeof (struct name_entry));
++ if (nentry == NULL)
++ return 0;
++ ientry = acl_alloc(sizeof (struct inodev_entry));
++ if (ientry == NULL)
++ return 0;
++ ientry->nentry = nentry;
++
++ nentry->key = key;
++ nentry->name = name;
++ nentry->inode = inode;
++ nentry->device = device;
++ nentry->len = len;
++ nentry->deleted = deleted;
++
++ nentry->prev = NULL;
++ curr = &name_set.n_hash[index];
++ if (*curr != NULL)
++ (*curr)->prev = nentry;
++ nentry->next = *curr;
++ *curr = nentry;
++
++ /* insert us into the table searchable by inode/dev */
++ insert_inodev_entry(ientry);
++
++ return 1;
++}
++
++static void
++insert_acl_obj_label(struct acl_object_label *obj,
++ struct acl_subject_label *subj)
++{
++ unsigned int index =
++ fhash(obj->inode, obj->device, subj->obj_hash_size);
++ struct acl_object_label **curr;
++
++
++ obj->prev = NULL;
++
++ curr = &subj->obj_hash[index];
++ if (*curr != NULL)
++ (*curr)->prev = obj;
++
++ obj->next = *curr;
++ *curr = obj;
++
++ return;
++}
++
++static void
++insert_acl_subj_label(struct acl_subject_label *obj,
++ struct acl_role_label *role)
++{
++ unsigned int index = fhash(obj->inode, obj->device, role->subj_hash_size);
++ struct acl_subject_label **curr;
++
++ obj->prev = NULL;
++
++ curr = &role->subj_hash[index];
++ if (*curr != NULL)
++ (*curr)->prev = obj;
++
++ obj->next = *curr;
++ *curr = obj;
++
++ return;
++}
++
++/* allocating chained hash tables, so optimal size is where lambda ~ 1 */
++
++static void *
++create_table(__u32 * len, int elementsize)
++{
++ unsigned int table_sizes[] = {
++ 7, 13, 31, 61, 127, 251, 509, 1021, 2039, 4093, 8191, 16381,
++ 32749, 65521, 131071, 262139, 524287, 1048573, 2097143,
++ 4194301, 8388593, 16777213, 33554393, 67108859
++ };
++ void *newtable = NULL;
++ unsigned int pwr = 0;
++
++ while ((pwr < ((sizeof (table_sizes) / sizeof (table_sizes[0])) - 1)) &&
++ table_sizes[pwr] <= *len)
++ pwr++;
++
++ if (table_sizes[pwr] <= *len || (table_sizes[pwr] > ULONG_MAX / elementsize))
++ return newtable;
++
++ if ((table_sizes[pwr] * elementsize) <= PAGE_SIZE)
++ newtable =
++ kmalloc(table_sizes[pwr] * elementsize, GFP_KERNEL);
++ else
++ newtable = vmalloc(table_sizes[pwr] * elementsize);
++
++ *len = table_sizes[pwr];
++
++ return newtable;
++}
++
++static int
++init_variables(const struct gr_arg *arg)
++{
++ struct task_struct *reaper = &init_task;
++ unsigned int stacksize;
++
++ subj_map_set.s_size = arg->role_db.num_subjects;
++ acl_role_set.r_size = arg->role_db.num_roles + arg->role_db.num_domain_children;
++ name_set.n_size = arg->role_db.num_objects;
++ inodev_set.i_size = arg->role_db.num_objects;
++
++ if (!subj_map_set.s_size || !acl_role_set.r_size ||
++ !name_set.n_size || !inodev_set.i_size)
++ return 1;
++
++ if (!gr_init_uidset())
++ return 1;
++
++ /* set up the stack that holds allocation info */
++
++ stacksize = arg->role_db.num_pointers + 5;
++
++ if (!acl_alloc_stack_init(stacksize))
++ return 1;
++
++ /* grab reference for the real root dentry and vfsmount */
++ read_lock(&reaper->fs->lock);
++ real_root = dget(reaper->fs->root.dentry);
++ real_root_mnt = mntget(reaper->fs->root.mnt);
++ read_unlock(&reaper->fs->lock);
++
++#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
++ printk(KERN_ALERT "Obtained real root device=%d, inode=%lu\n", __get_dev(real_root), real_root->d_inode->i_ino);
++#endif
++
++ fakefs_obj_rw = acl_alloc(sizeof(struct acl_object_label));
++ if (fakefs_obj_rw == NULL)
++ return 1;
++ fakefs_obj_rw->mode = GR_FIND | GR_READ | GR_WRITE;
++
++ fakefs_obj_rwx = acl_alloc(sizeof(struct acl_object_label));
++ if (fakefs_obj_rwx == NULL)
++ return 1;
++ fakefs_obj_rwx->mode = GR_FIND | GR_READ | GR_WRITE | GR_EXEC;
++
++ subj_map_set.s_hash =
++ (struct subject_map **) create_table(&subj_map_set.s_size, sizeof(void *));
++ acl_role_set.r_hash =
++ (struct acl_role_label **) create_table(&acl_role_set.r_size, sizeof(void *));
++ name_set.n_hash = (struct name_entry **) create_table(&name_set.n_size, sizeof(void *));
++ inodev_set.i_hash =
++ (struct inodev_entry **) create_table(&inodev_set.i_size, sizeof(void *));
++
++ if (!subj_map_set.s_hash || !acl_role_set.r_hash ||
++ !name_set.n_hash || !inodev_set.i_hash)
++ return 1;
++
++ memset(subj_map_set.s_hash, 0,
++ sizeof(struct subject_map *) * subj_map_set.s_size);
++ memset(acl_role_set.r_hash, 0,
++ sizeof (struct acl_role_label *) * acl_role_set.r_size);
++ memset(name_set.n_hash, 0,
++ sizeof (struct name_entry *) * name_set.n_size);
++ memset(inodev_set.i_hash, 0,
++ sizeof (struct inodev_entry *) * inodev_set.i_size);
++
++ return 0;
++}
++
++/* free information not needed after startup
++ currently contains user->kernel pointer mappings for subjects
++*/
++
++static void
++free_init_variables(void)
++{
++ __u32 i;
++
++ if (subj_map_set.s_hash) {
++ for (i = 0; i < subj_map_set.s_size; i++) {
++ if (subj_map_set.s_hash[i]) {
++ kfree(subj_map_set.s_hash[i]);
++ subj_map_set.s_hash[i] = NULL;
++ }
++ }
++
++ if ((subj_map_set.s_size * sizeof (struct subject_map *)) <=
++ PAGE_SIZE)
++ kfree(subj_map_set.s_hash);
++ else
++ vfree(subj_map_set.s_hash);
++ }
++
++ return;
++}
++
++static void
++free_variables(void)
++{
++ struct acl_subject_label *s;
++ struct acl_role_label *r;
++ struct task_struct *task, *task2;
++ unsigned int x;
++
++ gr_clear_learn_entries();
++
++ read_lock(&tasklist_lock);
++ do_each_thread(task2, task) {
++ task->acl_sp_role = 0;
++ task->acl_role_id = 0;
++ task->acl = NULL;
++ task->role = NULL;
++ } while_each_thread(task2, task);
++ read_unlock(&tasklist_lock);
++
++ /* release the reference to the real root dentry and vfsmount */
++ if (real_root)
++ dput(real_root);
++ real_root = NULL;
++ if (real_root_mnt)
++ mntput(real_root_mnt);
++ real_root_mnt = NULL;
++
++ /* free all object hash tables */
++
++ FOR_EACH_ROLE_START(r)
++ if (r->subj_hash == NULL)
++ goto next_role;
++ FOR_EACH_SUBJECT_START(r, s, x)
++ if (s->obj_hash == NULL)
++ break;
++ if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
++ kfree(s->obj_hash);
++ else
++ vfree(s->obj_hash);
++ FOR_EACH_SUBJECT_END(s, x)
++ FOR_EACH_NESTED_SUBJECT_START(r, s)
++ if (s->obj_hash == NULL)
++ break;
++ if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
++ kfree(s->obj_hash);
++ else
++ vfree(s->obj_hash);
++ FOR_EACH_NESTED_SUBJECT_END(s)
++ if ((r->subj_hash_size * sizeof (struct acl_subject_label *)) <= PAGE_SIZE)
++ kfree(r->subj_hash);
++ else
++ vfree(r->subj_hash);
++ r->subj_hash = NULL;
++next_role:
++ FOR_EACH_ROLE_END(r)
++
++ acl_free_all();
++
++ if (acl_role_set.r_hash) {
++ if ((acl_role_set.r_size * sizeof (struct acl_role_label *)) <=
++ PAGE_SIZE)
++ kfree(acl_role_set.r_hash);
++ else
++ vfree(acl_role_set.r_hash);
++ }
++ if (name_set.n_hash) {
++ if ((name_set.n_size * sizeof (struct name_entry *)) <=
++ PAGE_SIZE)
++ kfree(name_set.n_hash);
++ else
++ vfree(name_set.n_hash);
++ }
++
++ if (inodev_set.i_hash) {
++ if ((inodev_set.i_size * sizeof (struct inodev_entry *)) <=
++ PAGE_SIZE)
++ kfree(inodev_set.i_hash);
++ else
++ vfree(inodev_set.i_hash);
++ }
++
++ gr_free_uidset();
++
++ memset(&name_set, 0, sizeof (struct name_db));
++ memset(&inodev_set, 0, sizeof (struct inodev_db));
++ memset(&acl_role_set, 0, sizeof (struct acl_role_db));
++ memset(&subj_map_set, 0, sizeof (struct acl_subj_map_db));
++
++ default_role = NULL;
++ kernel_role = NULL;
++ role_list = NULL;
++
++ return;
++}
++
++static __u32
++count_user_objs(struct acl_object_label *userp)
++{
++ struct acl_object_label o_tmp;
++ __u32 num = 0;
++
++ while (userp) {
++ if (copy_from_user(&o_tmp, userp,
++ sizeof (struct acl_object_label)))
++ break;
++
++ userp = o_tmp.prev;
++ num++;
++ }
++
++ return num;
++}
++
++static struct acl_subject_label *
++do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role);
++
++static int
++copy_user_glob(struct acl_object_label *obj)
++{
++ struct acl_object_label *g_tmp, **guser;
++ unsigned int len;
++ char *tmp;
++
++ if (obj->globbed == NULL)
++ return 0;
++
++ guser = &obj->globbed;
++ while (*guser) {
++ g_tmp = (struct acl_object_label *)
++ acl_alloc(sizeof (struct acl_object_label));
++ if (g_tmp == NULL)
++ return -ENOMEM;
++
++ if (copy_from_user(g_tmp, *guser,
++ sizeof (struct acl_object_label)))
++ return -EFAULT;
++
++ len = strnlen_user(g_tmp->filename, PATH_MAX);
++
++ if (!len || len >= PATH_MAX)
++ return -EINVAL;
++
++ if ((tmp = (char *) acl_alloc(len)) == NULL)
++ return -ENOMEM;
++
++ if (copy_from_user(tmp, g_tmp->filename, len))
++ return -EFAULT;
++ tmp[len-1] = '\0';
++ g_tmp->filename = tmp;
++
++ *guser = g_tmp;
++ guser = &(g_tmp->next);
++ }
++
++ return 0;
++}
++
++static int
++copy_user_objs(struct acl_object_label *userp, struct acl_subject_label *subj,
++ struct acl_role_label *role)
++{
++ struct acl_object_label *o_tmp;
++ unsigned int len;
++ int ret;
++ char *tmp;
++
++ while (userp) {
++ if ((o_tmp = (struct acl_object_label *)
++ acl_alloc(sizeof (struct acl_object_label))) == NULL)
++ return -ENOMEM;
++
++ if (copy_from_user(o_tmp, userp,
++ sizeof (struct acl_object_label)))
++ return -EFAULT;
++
++ userp = o_tmp->prev;
++
++ len = strnlen_user(o_tmp->filename, PATH_MAX);
++
++ if (!len || len >= PATH_MAX)
++ return -EINVAL;
++
++ if ((tmp = (char *) acl_alloc(len)) == NULL)
++ return -ENOMEM;
++
++ if (copy_from_user(tmp, o_tmp->filename, len))
++ return -EFAULT;
++ tmp[len-1] = '\0';
++ o_tmp->filename = tmp;
++
++ insert_acl_obj_label(o_tmp, subj);
++ if (!insert_name_entry(o_tmp->filename, o_tmp->inode,
++ o_tmp->device, (o_tmp->mode & GR_DELETED) ? 1 : 0))
++ return -ENOMEM;
++
++ ret = copy_user_glob(o_tmp);
++ if (ret)
++ return ret;
++
++ if (o_tmp->nested) {
++ o_tmp->nested = do_copy_user_subj(o_tmp->nested, role);
++ if (IS_ERR(o_tmp->nested))
++ return PTR_ERR(o_tmp->nested);
++
++ /* insert into nested subject list */
++ o_tmp->nested->next = role->hash->first;
++ role->hash->first = o_tmp->nested;
++ }
++ }
++
++ return 0;
++}
++
++static __u32
++count_user_subjs(struct acl_subject_label *userp)
++{
++ struct acl_subject_label s_tmp;
++ __u32 num = 0;
++
++ while (userp) {
++ if (copy_from_user(&s_tmp, userp,
++ sizeof (struct acl_subject_label)))
++ break;
++
++ userp = s_tmp.prev;
++ /* do not count nested subjects against this count, since
++ they are not included in the hash table, but are
++ attached to objects. We have already counted
++ the subjects in userspace for the allocation
++ stack
++ */
++ if (!(s_tmp.mode & GR_NESTED))
++ num++;
++ }
++
++ return num;
++}
++
++static int
++copy_user_allowedips(struct acl_role_label *rolep)
++{
++ struct role_allowed_ip *ruserip, *rtmp = NULL, *rlast;
++
++ ruserip = rolep->allowed_ips;
++
++ while (ruserip) {
++ rlast = rtmp;
++
++ if ((rtmp = (struct role_allowed_ip *)
++ acl_alloc(sizeof (struct role_allowed_ip))) == NULL)
++ return -ENOMEM;
++
++ if (copy_from_user(rtmp, ruserip,
++ sizeof (struct role_allowed_ip)))
++ return -EFAULT;
++
++ ruserip = rtmp->prev;
++
++ if (!rlast) {
++ rtmp->prev = NULL;
++ rolep->allowed_ips = rtmp;
++ } else {
++ rlast->next = rtmp;
++ rtmp->prev = rlast;
++ }
++
++ if (!ruserip)
++ rtmp->next = NULL;
++ }
++
++ return 0;
++}
++
++static int
++copy_user_transitions(struct acl_role_label *rolep)
++{
++ struct role_transition *rusertp, *rtmp = NULL, *rlast;
++
++ unsigned int len;
++ char *tmp;
++
++ rusertp = rolep->transitions;
++
++ while (rusertp) {
++ rlast = rtmp;
++
++ if ((rtmp = (struct role_transition *)
++ acl_alloc(sizeof (struct role_transition))) == NULL)
++ return -ENOMEM;
++
++ if (copy_from_user(rtmp, rusertp,
++ sizeof (struct role_transition)))
++ return -EFAULT;
++
++ rusertp = rtmp->prev;
++
++ len = strnlen_user(rtmp->rolename, GR_SPROLE_LEN);
++
++ if (!len || len >= GR_SPROLE_LEN)
++ return -EINVAL;
++
++ if ((tmp = (char *) acl_alloc(len)) == NULL)
++ return -ENOMEM;
++
++ if (copy_from_user(tmp, rtmp->rolename, len))
++ return -EFAULT;
++ tmp[len-1] = '\0';
++ rtmp->rolename = tmp;
++
++ if (!rlast) {
++ rtmp->prev = NULL;
++ rolep->transitions = rtmp;
++ } else {
++ rlast->next = rtmp;
++ rtmp->prev = rlast;
++ }
++
++ if (!rusertp)
++ rtmp->next = NULL;
++ }
++
++ return 0;
++}
++
++static struct acl_subject_label *
++do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role)
++{
++ struct acl_subject_label *s_tmp = NULL, *s_tmp2;
++ unsigned int len;
++ char *tmp;
++ __u32 num_objs;
++ struct acl_ip_label **i_tmp, *i_utmp2;
++ struct gr_hash_struct ghash;
++ struct subject_map *subjmap;
++ unsigned int i_num;
++ int err;
++
++ s_tmp = lookup_subject_map(userp);
++
++ /* we've already copied this subject into the kernel, just return
++ the reference to it, and don't copy it over again
++ */
++ if (s_tmp)
++ return(s_tmp);
++
++ if ((s_tmp = (struct acl_subject_label *)
++ acl_alloc(sizeof (struct acl_subject_label))) == NULL)
++ return ERR_PTR(-ENOMEM);
++
++ subjmap = (struct subject_map *)kmalloc(sizeof (struct subject_map), GFP_KERNEL);
++ if (subjmap == NULL)
++ return ERR_PTR(-ENOMEM);
++
++ subjmap->user = userp;
++ subjmap->kernel = s_tmp;
++ insert_subj_map_entry(subjmap);
++
++ if (copy_from_user(s_tmp, userp,
++ sizeof (struct acl_subject_label)))
++ return ERR_PTR(-EFAULT);
++
++ len = strnlen_user(s_tmp->filename, PATH_MAX);
++
++ if (!len || len >= PATH_MAX)
++ return ERR_PTR(-EINVAL);
++
++ if ((tmp = (char *) acl_alloc(len)) == NULL)
++ return ERR_PTR(-ENOMEM);
++
++ if (copy_from_user(tmp, s_tmp->filename, len))
++ return ERR_PTR(-EFAULT);
++ tmp[len-1] = '\0';
++ s_tmp->filename = tmp;
++
++ if (!strcmp(s_tmp->filename, "/"))
++ role->root_label = s_tmp;
++
++ if (copy_from_user(&ghash, s_tmp->hash, sizeof(struct gr_hash_struct)))
++ return ERR_PTR(-EFAULT);
++
++ /* copy user and group transition tables */
++
++ if (s_tmp->user_trans_num) {
++ uid_t *uidlist;
++
++ uidlist = (uid_t *)acl_alloc_num(s_tmp->user_trans_num, sizeof(uid_t));
++ if (uidlist == NULL)
++ return ERR_PTR(-ENOMEM);
++ if (copy_from_user(uidlist, s_tmp->user_transitions, s_tmp->user_trans_num * sizeof(uid_t)))
++ return ERR_PTR(-EFAULT);
++
++ s_tmp->user_transitions = uidlist;
++ }
++
++ if (s_tmp->group_trans_num) {
++ gid_t *gidlist;
++
++ gidlist = (gid_t *)acl_alloc_num(s_tmp->group_trans_num, sizeof(gid_t));
++ if (gidlist == NULL)
++ return ERR_PTR(-ENOMEM);
++ if (copy_from_user(gidlist, s_tmp->group_transitions, s_tmp->group_trans_num * sizeof(gid_t)))
++ return ERR_PTR(-EFAULT);
++
++ s_tmp->group_transitions = gidlist;
++ }
++
++ /* set up object hash table */
++ num_objs = count_user_objs(ghash.first);
++
++ s_tmp->obj_hash_size = num_objs;
++ s_tmp->obj_hash =
++ (struct acl_object_label **)
++ create_table(&(s_tmp->obj_hash_size), sizeof(void *));
++
++ if (!s_tmp->obj_hash)
++ return ERR_PTR(-ENOMEM);
++
++ memset(s_tmp->obj_hash, 0,
++ s_tmp->obj_hash_size *
++ sizeof (struct acl_object_label *));
++
++ /* add in objects */
++ err = copy_user_objs(ghash.first, s_tmp, role);
++
++ if (err)
++ return ERR_PTR(err);
++
++ /* set pointer for parent subject */
++ if (s_tmp->parent_subject) {
++ s_tmp2 = do_copy_user_subj(s_tmp->parent_subject, role);
++
++ if (IS_ERR(s_tmp2))
++ return s_tmp2;
++
++ s_tmp->parent_subject = s_tmp2;
++ }
++
++ /* add in ip acls */
++
++ if (!s_tmp->ip_num) {
++ s_tmp->ips = NULL;
++ goto insert;
++ }
++
++ i_tmp =
++ (struct acl_ip_label **) acl_alloc_num(s_tmp->ip_num,
++ sizeof (struct acl_ip_label *));
++
++ if (!i_tmp)
++ return ERR_PTR(-ENOMEM);
++
++ for (i_num = 0; i_num < s_tmp->ip_num; i_num++) {
++ *(i_tmp + i_num) =
++ (struct acl_ip_label *)
++ acl_alloc(sizeof (struct acl_ip_label));
++ if (!*(i_tmp + i_num))
++ return ERR_PTR(-ENOMEM);
++
++ if (copy_from_user
++ (&i_utmp2, s_tmp->ips + i_num,
++ sizeof (struct acl_ip_label *)))
++ return ERR_PTR(-EFAULT);
++
++ if (copy_from_user
++ (*(i_tmp + i_num), i_utmp2,
++ sizeof (struct acl_ip_label)))
++ return ERR_PTR(-EFAULT);
++
++ if ((*(i_tmp + i_num))->iface == NULL)
++ continue;
++
++ len = strnlen_user((*(i_tmp + i_num))->iface, IFNAMSIZ);
++ if (!len || len >= IFNAMSIZ)
++ return ERR_PTR(-EINVAL);
++ tmp = acl_alloc(len);
++ if (tmp == NULL)
++ return ERR_PTR(-ENOMEM);
++ if (copy_from_user(tmp, (*(i_tmp + i_num))->iface, len))
++ return ERR_PTR(-EFAULT);
++ (*(i_tmp + i_num))->iface = tmp;
++ }
++
++ s_tmp->ips = i_tmp;
++
++insert:
++ if (!insert_name_entry(s_tmp->filename, s_tmp->inode,
++ s_tmp->device, (s_tmp->mode & GR_DELETED) ? 1 : 0))
++ return ERR_PTR(-ENOMEM);
++
++ return s_tmp;
++}
++
++static int
++copy_user_subjs(struct acl_subject_label *userp, struct acl_role_label *role)
++{
++ struct acl_subject_label s_pre;
++ struct acl_subject_label * ret;
++ int err;
++
++ while (userp) {
++ if (copy_from_user(&s_pre, userp,
++ sizeof (struct acl_subject_label)))
++ return -EFAULT;
++
++ /* do not add nested subjects here, add
++ while parsing objects
++ */
++
++ if (s_pre.mode & GR_NESTED) {
++ userp = s_pre.prev;
++ continue;
++ }
++
++ ret = do_copy_user_subj(userp, role);
++
++ err = PTR_ERR(ret);
++ if (IS_ERR(ret))
++ return err;
++
++ insert_acl_subj_label(ret, role);
++
++ userp = s_pre.prev;
++ }
++
++ return 0;
++}
++
++static int
++copy_user_acl(struct gr_arg *arg)
++{
++ struct acl_role_label *r_tmp = NULL, **r_utmp, *r_utmp2;
++ struct sprole_pw *sptmp;
++ struct gr_hash_struct *ghash;
++ uid_t *domainlist;
++ unsigned int r_num;
++ unsigned int len;
++ char *tmp;
++ int err = 0;
++ __u16 i;
++ __u32 num_subjs;
++
++ /* we need a default and kernel role */
++ if (arg->role_db.num_roles < 2)
++ return -EINVAL;
++
++ /* copy special role authentication info from userspace */
++
++ num_sprole_pws = arg->num_sprole_pws;
++ acl_special_roles = (struct sprole_pw **) acl_alloc_num(num_sprole_pws, sizeof(struct sprole_pw *));
++
++ if (!acl_special_roles && num_sprole_pws)
++ return -ENOMEM;
++
++ for (i = 0; i < num_sprole_pws; i++) {
++ sptmp = (struct sprole_pw *) acl_alloc(sizeof(struct sprole_pw));
++ if (!sptmp)
++ return -ENOMEM;
++ if (copy_from_user(sptmp, arg->sprole_pws + i,
++ sizeof (struct sprole_pw)))
++ return -EFAULT;
++
++ len = strnlen_user(sptmp->rolename, GR_SPROLE_LEN);
++
++ if (!len || len >= GR_SPROLE_LEN)
++ return -EINVAL;
++
++ if ((tmp = (char *) acl_alloc(len)) == NULL)
++ return -ENOMEM;
++
++ if (copy_from_user(tmp, sptmp->rolename, len))
++ return -EFAULT;
++
++ tmp[len-1] = '\0';
++#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
++ printk(KERN_ALERT "Copying special role %s\n", tmp);
++#endif
++ sptmp->rolename = tmp;
++ acl_special_roles[i] = sptmp;
++ }
++
++ r_utmp = (struct acl_role_label **) arg->role_db.r_table;
++
++ for (r_num = 0; r_num < arg->role_db.num_roles; r_num++) {
++ r_tmp = acl_alloc(sizeof (struct acl_role_label));
++
++ if (!r_tmp)
++ return -ENOMEM;
++
++ if (copy_from_user(&r_utmp2, r_utmp + r_num,
++ sizeof (struct acl_role_label *)))
++ return -EFAULT;
++
++ if (copy_from_user(r_tmp, r_utmp2,
++ sizeof (struct acl_role_label)))
++ return -EFAULT;
++
++ len = strnlen_user(r_tmp->rolename, GR_SPROLE_LEN);
++
++ if (!len || len >= PATH_MAX)
++ return -EINVAL;
++
++ if ((tmp = (char *) acl_alloc(len)) == NULL)
++ return -ENOMEM;
++
++ if (copy_from_user(tmp, r_tmp->rolename, len))
++ return -EFAULT;
++
++ tmp[len-1] = '\0';
++ r_tmp->rolename = tmp;
++
++ if (!strcmp(r_tmp->rolename, "default")
++ && (r_tmp->roletype & GR_ROLE_DEFAULT)) {
++ default_role = r_tmp;
++ } else if (!strcmp(r_tmp->rolename, ":::kernel:::")) {
++ kernel_role = r_tmp;
++ }
++
++ if ((ghash = (struct gr_hash_struct *) acl_alloc(sizeof(struct gr_hash_struct))) == NULL)
++ return -ENOMEM;
++
++ if (copy_from_user(ghash, r_tmp->hash, sizeof(struct gr_hash_struct)))
++ return -EFAULT;
++
++ r_tmp->hash = ghash;
++
++ num_subjs = count_user_subjs(r_tmp->hash->first);
++
++ r_tmp->subj_hash_size = num_subjs;
++ r_tmp->subj_hash =
++ (struct acl_subject_label **)
++ create_table(&(r_tmp->subj_hash_size), sizeof(void *));
++
++ if (!r_tmp->subj_hash)
++ return -ENOMEM;
++
++ err = copy_user_allowedips(r_tmp);
++ if (err)
++ return err;
++
++ /* copy domain info */
++ if (r_tmp->domain_children != NULL) {
++ domainlist = acl_alloc_num(r_tmp->domain_child_num, sizeof(uid_t));
++ if (domainlist == NULL)
++ return -ENOMEM;
++
++ if (copy_from_user(domainlist, r_tmp->domain_children, r_tmp->domain_child_num * sizeof(uid_t)))
++ return -EFAULT;
++
++ r_tmp->domain_children = domainlist;
++ }
++
++ err = copy_user_transitions(r_tmp);
++ if (err)
++ return err;
++
++ memset(r_tmp->subj_hash, 0,
++ r_tmp->subj_hash_size *
++ sizeof (struct acl_subject_label *));
++
++ err = copy_user_subjs(r_tmp->hash->first, r_tmp);
++
++ if (err)
++ return err;
++
++ /* set nested subject list to null */
++ r_tmp->hash->first = NULL;
++
++ insert_acl_role_label(r_tmp);
++ }
++
++ if (default_role == NULL || kernel_role == NULL)
++ return -EINVAL;
++
++ return err;
++}
++
++static int
++gracl_init(struct gr_arg *args)
++{
++ int error = 0;
++
++ memcpy(gr_system_salt, args->salt, GR_SALT_LEN);
++ memcpy(gr_system_sum, args->sum, GR_SHA_LEN);
++
++ if (init_variables(args)) {
++ gr_log_str(GR_DONT_AUDIT_GOOD, GR_INITF_ACL_MSG, GR_VERSION);
++ error = -ENOMEM;
++ free_variables();
++ goto out;
++ }
++
++ error = copy_user_acl(args);
++ free_init_variables();
++ if (error) {
++ free_variables();
++ goto out;
++ }
++
++ if ((error = gr_set_acls(0))) {
++ free_variables();
++ goto out;
++ }
++
++ pax_open_kernel();
++ gr_status |= GR_READY;
++ pax_close_kernel();
++
++ out:
++ return error;
++}
++
++/* derived from glibc fnmatch() 0: match, 1: no match*/
++
++static int
++glob_match(const char *p, const char *n)
++{
++ char c;
++
++ while ((c = *p++) != '\0') {
++ switch (c) {
++ case '?':
++ if (*n == '\0')
++ return 1;
++ else if (*n == '/')
++ return 1;
++ break;
++ case '\\':
++ if (*n != c)
++ return 1;
++ break;
++ case '*':
++ for (c = *p++; c == '?' || c == '*'; c = *p++) {
++ if (*n == '/')
++ return 1;
++ else if (c == '?') {
++ if (*n == '\0')
++ return 1;
++ else
++ ++n;
++ }
++ }
++ if (c == '\0') {
++ return 0;
++ } else {
++ const char *endp;
++
++ if ((endp = strchr(n, '/')) == NULL)
++ endp = n + strlen(n);
++
++ if (c == '[') {
++ for (--p; n < endp; ++n)
++ if (!glob_match(p, n))
++ return 0;
++ } else if (c == '/') {
++ while (*n != '\0' && *n != '/')
++ ++n;
++ if (*n == '/' && !glob_match(p, n + 1))
++ return 0;
++ } else {
++ for (--p; n < endp; ++n)
++ if (*n == c && !glob_match(p, n))
++ return 0;
++ }
++
++ return 1;
++ }
++ case '[':
++ {
++ int not;
++ char cold;
++
++ if (*n == '\0' || *n == '/')
++ return 1;
++
++ not = (*p == '!' || *p == '^');
++ if (not)
++ ++p;
++
++ c = *p++;
++ for (;;) {
++ unsigned char fn = (unsigned char)*n;
++
++ if (c == '\0')
++ return 1;
++ else {
++ if (c == fn)
++ goto matched;
++ cold = c;
++ c = *p++;
++
++ if (c == '-' && *p != ']') {
++ unsigned char cend = *p++;
++
++ if (cend == '\0')
++ return 1;
++
++ if (cold <= fn && fn <= cend)
++ goto matched;
++
++ c = *p++;
++ }
++ }
++
++ if (c == ']')
++ break;
++ }
++ if (!not)
++ return 1;
++ break;
++ matched:
++ while (c != ']') {
++ if (c == '\0')
++ return 1;
++
++ c = *p++;
++ }
++ if (not)
++ return 1;
++ }
++ break;
++ default:
++ if (c != *n)
++ return 1;
++ }
++
++ ++n;
++ }
++
++ if (*n == '\0')
++ return 0;
++
++ if (*n == '/')
++ return 0;
++
++ return 1;
++}
++
++static struct acl_object_label *
++chk_glob_label(struct acl_object_label *globbed,
++ const struct dentry *dentry, const struct vfsmount *mnt, char **path)
++{
++ struct acl_object_label *tmp;
++
++ if (*path == NULL)
++ *path = gr_to_filename_nolock(dentry, mnt);
++
++ tmp = globbed;
++
++ while (tmp) {
++ if (!glob_match(tmp->filename, *path))
++ return tmp;
++ tmp = tmp->next;
++ }
++
++ return NULL;
++}
++
++static struct acl_object_label *
++__full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
++ const ino_t curr_ino, const dev_t curr_dev,
++ const struct acl_subject_label *subj, char **path, const int checkglob)
++{
++ struct acl_subject_label *tmpsubj;
++ struct acl_object_label *retval;
++ struct acl_object_label *retval2;
++
++ tmpsubj = (struct acl_subject_label *) subj;
++ read_lock(&gr_inode_lock);
++ do {
++ retval = lookup_acl_obj_label(curr_ino, curr_dev, tmpsubj);
++ if (retval) {
++ if (checkglob && retval->globbed) {
++ retval2 = chk_glob_label(retval->globbed, orig_dentry, orig_mnt, path);
++ if (retval2)
++ retval = retval2;
++ }
++ break;
++ }
++ } while ((tmpsubj = tmpsubj->parent_subject));
++ read_unlock(&gr_inode_lock);
++
++ return retval;
++}
++
++static __inline__ struct acl_object_label *
++full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
++ const struct dentry *curr_dentry,
++ const struct acl_subject_label *subj, char **path, const int checkglob)
++{
++ int newglob = checkglob;
++
++ /* if we aren't checking a subdirectory of the original path yet, don't do glob checking
++ as we don't want a / * rule to match instead of the / object
++ don't do this for create lookups that call this function though, since they're looking up
++ on the parent and thus need globbing checks on all paths
++ */
++ if (orig_dentry == curr_dentry && newglob != GR_CREATE_GLOB)
++ newglob = GR_NO_GLOB;
++
++ return __full_lookup(orig_dentry, orig_mnt,
++ curr_dentry->d_inode->i_ino,
++ __get_dev(curr_dentry), subj, path, newglob);
++}
++
++static struct acl_object_label *
++__chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
++ const struct acl_subject_label *subj, char *path, const int checkglob)
++{
++ struct dentry *dentry = (struct dentry *) l_dentry;
++ struct vfsmount *mnt = (struct vfsmount *) l_mnt;
++ struct acl_object_label *retval;
++
++ spin_lock(&dcache_lock);
++ spin_lock(&vfsmount_lock);
++
++ if (unlikely((mnt == shm_mnt && dentry->d_inode->i_nlink == 0) || mnt == pipe_mnt ||
++#ifdef CONFIG_NET
++ mnt == sock_mnt ||
++#endif
++#ifdef CONFIG_HUGETLBFS
++ (mnt == hugetlbfs_vfsmount && dentry->d_inode->i_nlink == 0) ||
++#endif
++ /* ignore Eric Biederman */
++ IS_PRIVATE(l_dentry->d_inode))) {
++ retval = (subj->mode & GR_SHMEXEC) ? fakefs_obj_rwx : fakefs_obj_rw;
++ goto out;
++ }
++
++ for (;;) {
++ if (dentry == real_root && mnt == real_root_mnt)
++ break;
++
++ if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
++ if (mnt->mnt_parent == mnt)
++ break;
++
++ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
++ if (retval != NULL)
++ goto out;
++
++ dentry = mnt->mnt_mountpoint;
++ mnt = mnt->mnt_parent;
++ continue;
++ }
++
++ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
++ if (retval != NULL)
++ goto out;
++
++ dentry = dentry->d_parent;
++ }
++
++ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
++
++ if (retval == NULL)
++ retval = full_lookup(l_dentry, l_mnt, real_root, subj, &path, checkglob);
++out:
++ spin_unlock(&vfsmount_lock);
++ spin_unlock(&dcache_lock);
++
++ BUG_ON(retval == NULL);
++
++ return retval;
++}
++
++static __inline__ struct acl_object_label *
++chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
++ const struct acl_subject_label *subj)
++{
++ char *path = NULL;
++ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_REG_GLOB);
++}
++
++static __inline__ struct acl_object_label *
++chk_obj_label_noglob(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
++ const struct acl_subject_label *subj)
++{
++ char *path = NULL;
++ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_NO_GLOB);
++}
++
++static __inline__ struct acl_object_label *
++chk_obj_create_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
++ const struct acl_subject_label *subj, char *path)
++{
++ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_CREATE_GLOB);
++}
++
++static struct acl_subject_label *
++chk_subj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
++ const struct acl_role_label *role)
++{
++ struct dentry *dentry = (struct dentry *) l_dentry;
++ struct vfsmount *mnt = (struct vfsmount *) l_mnt;
++ struct acl_subject_label *retval;
++
++ spin_lock(&dcache_lock);
++ spin_lock(&vfsmount_lock);
++
++ for (;;) {
++ if (dentry == real_root && mnt == real_root_mnt)
++ break;
++ if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
++ if (mnt->mnt_parent == mnt)
++ break;
++
++ read_lock(&gr_inode_lock);
++ retval =
++ lookup_acl_subj_label(dentry->d_inode->i_ino,
++ __get_dev(dentry), role);
++ read_unlock(&gr_inode_lock);
++ if (retval != NULL)
++ goto out;
++
++ dentry = mnt->mnt_mountpoint;
++ mnt = mnt->mnt_parent;
++ continue;
++ }
++
++ read_lock(&gr_inode_lock);
++ retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
++ __get_dev(dentry), role);
++ read_unlock(&gr_inode_lock);
++ if (retval != NULL)
++ goto out;
++
++ dentry = dentry->d_parent;
++ }
++
++ read_lock(&gr_inode_lock);
++ retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
++ __get_dev(dentry), role);
++ read_unlock(&gr_inode_lock);
++
++ if (unlikely(retval == NULL)) {
++ read_lock(&gr_inode_lock);
++ retval = lookup_acl_subj_label(real_root->d_inode->i_ino,
++ __get_dev(real_root), role);
++ read_unlock(&gr_inode_lock);
++ }
++out:
++ spin_unlock(&vfsmount_lock);
++ spin_unlock(&dcache_lock);
++
++ BUG_ON(retval == NULL);
++
++ return retval;
++}
++
++static void
++gr_log_learn(const struct dentry *dentry, const struct vfsmount *mnt, const __u32 mode)
++{
++ struct task_struct *task = current;
++ const struct cred *cred = current_cred();
++
++ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
++ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
++ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
++ 1UL, 1UL, gr_to_filename(dentry, mnt), (unsigned long) mode, &task->signal->saved_ip);
++
++ return;
++}
++
++static void
++gr_log_learn_sysctl(const char *path, const __u32 mode)
++{
++ struct task_struct *task = current;
++ const struct cred *cred = current_cred();
++
++ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
++ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
++ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
++ 1UL, 1UL, path, (unsigned long) mode, &task->signal->saved_ip);
++
++ return;
++}
++
++static void
++gr_log_learn_id_change(const char type, const unsigned int real,
++ const unsigned int effective, const unsigned int fs)
++{
++ struct task_struct *task = current;
++ const struct cred *cred = current_cred();
++
++ security_learn(GR_ID_LEARN_MSG, task->role->rolename, task->role->roletype,
++ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
++ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
++ type, real, effective, fs, &task->signal->saved_ip);
++
++ return;
++}
++
++__u32
++gr_search_file(const struct dentry * dentry, const __u32 mode,
++ const struct vfsmount * mnt)
++{
++ __u32 retval = mode;
++ struct acl_subject_label *curracl;
++ struct acl_object_label *currobj;
++
++ if (unlikely(!(gr_status & GR_READY)))
++ return (mode & ~GR_AUDITS);
++
++ curracl = current->acl;
++
++ currobj = chk_obj_label(dentry, mnt, curracl);
++ retval = currobj->mode & mode;
++
++ /* if we're opening a specified transfer file for writing
++ (e.g. /dev/initctl), then transfer our role to init
++ */
++ if (unlikely(currobj->mode & GR_INIT_TRANSFER && retval & GR_WRITE &&
++ current->role->roletype & GR_ROLE_PERSIST)) {
++ struct task_struct *task = init_pid_ns.child_reaper;
++
++ if (task->role != current->role) {
++ task->acl_sp_role = 0;
++ task->acl_role_id = current->acl_role_id;
++ task->role = current->role;
++ rcu_read_lock();
++ read_lock(&grsec_exec_file_lock);
++ gr_apply_subject_to_task(task);
++ read_unlock(&grsec_exec_file_lock);
++ rcu_read_unlock();
++ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_INIT_TRANSFER_MSG);
++ }
++ }
++
++ if (unlikely
++ ((curracl->mode & (GR_LEARN | GR_INHERITLEARN)) && !(mode & GR_NOPTRACE)
++ && (retval != (mode & ~(GR_AUDITS | GR_SUPPRESS))))) {
++ __u32 new_mode = mode;
++
++ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
++
++ retval = new_mode;
++
++ if (new_mode & GR_EXEC && curracl->mode & GR_INHERITLEARN)
++ new_mode |= GR_INHERIT;
++
++ if (!(mode & GR_NOLEARN))
++ gr_log_learn(dentry, mnt, new_mode);
++ }
++
++ return retval;
++}
++
++struct acl_object_label *gr_get_create_object(const struct dentry *new_dentry,
++ const struct dentry *parent,
++ const struct vfsmount *mnt)
++{
++ struct name_entry *match;
++ struct acl_object_label *matchpo;
++ struct acl_subject_label *curracl;
++ char *path;
++
++ if (unlikely(!(gr_status & GR_READY)))
++ return NULL;
++
++ preempt_disable();
++ path = gr_to_filename_rbac(new_dentry, mnt);
++ match = lookup_name_entry_create(path);
++
++ curracl = current->acl;
++
++ if (match) {
++ read_lock(&gr_inode_lock);
++ matchpo = lookup_acl_obj_label_create(match->inode, match->device, curracl);
++ read_unlock(&gr_inode_lock);
++
++ if (matchpo) {
++ preempt_enable();
++ return matchpo;
++ }
++ }
++
++ // lookup parent
++
++ matchpo = chk_obj_create_label(parent, mnt, curracl, path);
++
++ preempt_enable();
++ return matchpo;
++}
++
++__u32
++gr_check_create(const struct dentry * new_dentry, const struct dentry * parent,
++ const struct vfsmount * mnt, const __u32 mode)
++{
++ struct acl_object_label *matchpo;
++ __u32 retval;
++
++ if (unlikely(!(gr_status & GR_READY)))
++ return (mode & ~GR_AUDITS);
++
++ matchpo = gr_get_create_object(new_dentry, parent, mnt);
++
++ retval = matchpo->mode & mode;
++
++ if ((retval != (mode & ~(GR_AUDITS | GR_SUPPRESS)))
++ && (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))) {
++ __u32 new_mode = mode;
++
++ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
++
++ gr_log_learn(new_dentry, mnt, new_mode);
++ return new_mode;
++ }
++
++ return retval;
++}
++
++__u32
++gr_check_link(const struct dentry * new_dentry,
++ const struct dentry * parent_dentry,
++ const struct vfsmount * parent_mnt,
++ const struct dentry * old_dentry, const struct vfsmount * old_mnt)
++{
++ struct acl_object_label *obj;
++ __u32 oldmode, newmode;
++ __u32 needmode;
++ __u32 checkmodes = GR_FIND | GR_APPEND | GR_WRITE | GR_EXEC | GR_SETID | GR_READ |
++ GR_DELETE | GR_INHERIT;
++
++ if (unlikely(!(gr_status & GR_READY)))
++ return (GR_CREATE | GR_LINK);
++
++ obj = chk_obj_label(old_dentry, old_mnt, current->acl);
++ oldmode = obj->mode;
++
++ obj = gr_get_create_object(new_dentry, parent_dentry, parent_mnt);
++ newmode = obj->mode;
++
++ needmode = newmode & checkmodes;
++
++ // old name for hardlink must have at least the permissions of the new name
++ if ((oldmode & needmode) != needmode)
++ goto bad;
++
++ // if old name had restrictions/auditing, make sure the new name does as well
++ needmode = oldmode & (GR_NOPTRACE | GR_PTRACERD | GR_INHERIT | GR_AUDITS);
++
++ // don't allow hardlinking of suid/sgid files without permission
++ if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
++ needmode |= GR_SETID;
++
++ if ((newmode & needmode) != needmode)
++ goto bad;
++
++ // enforce minimum permissions
++ if ((newmode & (GR_CREATE | GR_LINK)) == (GR_CREATE | GR_LINK))
++ return newmode;
++bad:
++ needmode = oldmode;
++ if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
++ needmode |= GR_SETID;
++
++ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) {
++ gr_log_learn(old_dentry, old_mnt, needmode | GR_CREATE | GR_LINK);
++ return (GR_CREATE | GR_LINK);
++ } else if (newmode & GR_SUPPRESS)
++ return GR_SUPPRESS;
++ else
++ return 0;
++}
++
++int
++gr_check_hidden_task(const struct task_struct *task)
++{
++ if (unlikely(!(gr_status & GR_READY)))
++ return 0;
++
++ if (!(task->acl->mode & GR_PROCFIND) && !(current->acl->mode & GR_VIEW))
++ return 1;
++
++ return 0;
++}
++
++int
++gr_check_protected_task(const struct task_struct *task)
++{
++ if (unlikely(!(gr_status & GR_READY) || !task))
++ return 0;
++
++ if ((task->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
++ task->acl != current->acl)
++ return 1;
++
++ return 0;
++}
++
++int
++gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
++{
++ struct task_struct *p;
++ int ret = 0;
++
++ if (unlikely(!(gr_status & GR_READY) || !pid))
++ return ret;
++
++ read_lock(&tasklist_lock);
++ do_each_pid_task(pid, type, p) {
++ if ((p->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
++ p->acl != current->acl) {
++ ret = 1;
++ goto out;
++ }
++ } while_each_pid_task(pid, type, p);
++out:
++ read_unlock(&tasklist_lock);
++
++ return ret;
++}
++
++void
++gr_copy_label(struct task_struct *tsk)
++{
++ /* plain copying of fields is already done by dup_task_struct */
++ tsk->signal->used_accept = 0;
++ tsk->acl_sp_role = 0;
++ //tsk->acl_role_id = current->acl_role_id;
++ //tsk->acl = current->acl;
++ //tsk->role = current->role;
++ tsk->signal->curr_ip = current->signal->curr_ip;
++ tsk->signal->saved_ip = current->signal->saved_ip;
++ if (current->exec_file)
++ get_file(current->exec_file);
++ //tsk->exec_file = current->exec_file;
++ //tsk->is_writable = current->is_writable;
++ if (unlikely(current->signal->used_accept)) {
++ current->signal->curr_ip = 0;
++ current->signal->saved_ip = 0;
++ }
++
++ return;
++}
++
++static void
++gr_set_proc_res(struct task_struct *task)
++{
++ struct acl_subject_label *proc;
++ unsigned short i;
++
++ proc = task->acl;
++
++ if (proc->mode & (GR_LEARN | GR_INHERITLEARN))
++ return;
++
++ for (i = 0; i < RLIM_NLIMITS; i++) {
++ if (!(proc->resmask & (1 << i)))
++ continue;
++
++ task->signal->rlim[i].rlim_cur = proc->res[i].rlim_cur;
++ task->signal->rlim[i].rlim_max = proc->res[i].rlim_max;
++ }
++
++ return;
++}
++
++extern int __gr_process_user_ban(struct user_struct *user);
++
++int
++gr_check_user_change(int real, int effective, int fs)
++{
++ unsigned int i;
++ __u16 num;
++ uid_t *uidlist;
++ int curuid;
++ int realok = 0;
++ int effectiveok = 0;
++ int fsok = 0;
++
++#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
++ struct user_struct *user;
++
++ if (real == -1)
++ goto skipit;
++
++ user = find_user(real);
++ if (user == NULL)
++ goto skipit;
++
++ if (__gr_process_user_ban(user)) {
++ /* for find_user */
++ free_uid(user);
++ return 1;
++ }
++
++ /* for find_user */
++ free_uid(user);
++
++skipit:
++#endif
++
++ if (unlikely(!(gr_status & GR_READY)))
++ return 0;
++
++ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
++ gr_log_learn_id_change('u', real, effective, fs);
++
++ num = current->acl->user_trans_num;
++ uidlist = current->acl->user_transitions;
++
++ if (uidlist == NULL)
++ return 0;
++
++ if (real == -1)
++ realok = 1;
++ if (effective == -1)
++ effectiveok = 1;
++ if (fs == -1)
++ fsok = 1;
++
++ if (current->acl->user_trans_type & GR_ID_ALLOW) {
++ for (i = 0; i < num; i++) {
++ curuid = (int)uidlist[i];
++ if (real == curuid)
++ realok = 1;
++ if (effective == curuid)
++ effectiveok = 1;
++ if (fs == curuid)
++ fsok = 1;
++ }
++ } else if (current->acl->user_trans_type & GR_ID_DENY) {
++ for (i = 0; i < num; i++) {
++ curuid = (int)uidlist[i];
++ if (real == curuid)
++ break;
++ if (effective == curuid)
++ break;
++ if (fs == curuid)
++ break;
++ }
++ /* not in deny list */
++ if (i == num) {
++ realok = 1;
++ effectiveok = 1;
++ fsok = 1;
++ }
++ }
++
++ if (realok && effectiveok && fsok)
++ return 0;
++ else {
++ gr_log_int(GR_DONT_AUDIT, GR_USRCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
++ return 1;
++ }
++}
++
++int
++gr_check_group_change(int real, int effective, int fs)
++{
++ unsigned int i;
++ __u16 num;
++ gid_t *gidlist;
++ int curgid;
++ int realok = 0;
++ int effectiveok = 0;
++ int fsok = 0;
++
++ if (unlikely(!(gr_status & GR_READY)))
++ return 0;
++
++ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
++ gr_log_learn_id_change('g', real, effective, fs);
++
++ num = current->acl->group_trans_num;
++ gidlist = current->acl->group_transitions;
++
++ if (gidlist == NULL)
++ return 0;
++
++ if (real == -1)
++ realok = 1;
++ if (effective == -1)
++ effectiveok = 1;
++ if (fs == -1)
++ fsok = 1;
++
++ if (current->acl->group_trans_type & GR_ID_ALLOW) {
++ for (i = 0; i < num; i++) {
++ curgid = (int)gidlist[i];
++ if (real == curgid)
++ realok = 1;
++ if (effective == curgid)
++ effectiveok = 1;
++ if (fs == curgid)
++ fsok = 1;
++ }
++ } else if (current->acl->group_trans_type & GR_ID_DENY) {
++ for (i = 0; i < num; i++) {
++ curgid = (int)gidlist[i];
++ if (real == curgid)
++ break;
++ if (effective == curgid)
++ break;
++ if (fs == curgid)
++ break;
++ }
++ /* not in deny list */
++ if (i == num) {
++ realok = 1;
++ effectiveok = 1;
++ fsok = 1;
++ }
++ }
++
++ if (realok && effectiveok && fsok)
++ return 0;
++ else {
++ gr_log_int(GR_DONT_AUDIT, GR_GRPCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
++ return 1;
++ }
++}
++
++extern int gr_acl_is_capable(const int cap);
++
++void
++gr_set_role_label(struct task_struct *task, const uid_t uid, const uid_t gid)
++{
++ struct acl_role_label *role = task->role;
++ struct acl_subject_label *subj = NULL;
++ struct acl_object_label *obj;
++ struct file *filp;
++
++ if (unlikely(!(gr_status & GR_READY)))
++ return;
++
++ filp = task->exec_file;
++
++ /* kernel process, we'll give them the kernel role */
++ if (unlikely(!filp)) {
++ task->role = kernel_role;
++ task->acl = kernel_role->root_label;
++ return;
++ } else if (!task->role || !(task->role->roletype & GR_ROLE_SPECIAL))
++ role = lookup_acl_role_label(task, uid, gid);
++
++ /* don't change the role if we're not a privileged process */
++ if (role && task->role != role &&
++ (((role->roletype & GR_ROLE_USER) && !gr_acl_is_capable(CAP_SETUID)) ||
++ ((role->roletype & GR_ROLE_GROUP) && !gr_acl_is_capable(CAP_SETGID))))
++ return;
++
++ /* perform subject lookup in possibly new role
++ we can use this result below in the case where role == task->role
++ */
++ subj = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, role);
++
++ /* if we changed uid/gid, but result in the same role
++ and are using inheritance, don't lose the inherited subject
++ if current subject is other than what normal lookup
++ would result in, we arrived via inheritance, don't
++ lose subject
++ */
++ if (role != task->role || (!(task->acl->mode & GR_INHERITLEARN) &&
++ (subj == task->acl)))
++ task->acl = subj;
++
++ task->role = role;
++
++ task->is_writable = 0;
++
++ /* ignore additional mmap checks for processes that are writable
++ by the default ACL */
++ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
++ if (unlikely(obj->mode & GR_WRITE))
++ task->is_writable = 1;
++ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
++ if (unlikely(obj->mode & GR_WRITE))
++ task->is_writable = 1;
++
++#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
++ printk(KERN_ALERT "Set role label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
++#endif
++
++ gr_set_proc_res(task);
++
++ return;
++}
++
++int
++gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
++ const int unsafe_flags)
++{
++ struct task_struct *task = current;
++ struct acl_subject_label *newacl;
++ struct acl_object_label *obj;
++ __u32 retmode;
++
++ if (unlikely(!(gr_status & GR_READY)))
++ return 0;
++
++ newacl = chk_subj_label(dentry, mnt, task->role);
++
++ /* special handling for if we did an strace -f -p <pid> from an admin role, where pid then
++ did an exec
++ */
++ rcu_read_lock();
++ read_lock(&tasklist_lock);
++ if (task->ptrace && task->parent && ((task->parent->role->roletype & GR_ROLE_GOD) ||
++ (task->parent->acl->mode & GR_POVERRIDE))) {
++ read_unlock(&tasklist_lock);
++ rcu_read_unlock();
++ goto skip_check;
++ }
++ read_unlock(&tasklist_lock);
++ rcu_read_unlock();
++
++ if (unsafe_flags && !(task->acl->mode & GR_POVERRIDE) && (task->acl != newacl) &&
++ !(task->role->roletype & GR_ROLE_GOD) &&
++ !gr_search_file(dentry, GR_PTRACERD, mnt) &&
++ !(task->acl->mode & (GR_LEARN | GR_INHERITLEARN))) {
++ if (unsafe_flags & LSM_UNSAFE_SHARE)
++ gr_log_fs_generic(GR_DONT_AUDIT, GR_UNSAFESHARE_EXEC_ACL_MSG, dentry, mnt);
++ else
++ gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_EXEC_ACL_MSG, dentry, mnt);
++ return -EACCES;
++ }
++
++skip_check:
++
++ obj = chk_obj_label(dentry, mnt, task->acl);
++ retmode = obj->mode & (GR_INHERIT | GR_AUDIT_INHERIT);
++
++ if (!(task->acl->mode & GR_INHERITLEARN) &&
++ ((newacl->mode & GR_LEARN) || !(retmode & GR_INHERIT))) {
++ if (obj->nested)
++ task->acl = obj->nested;
++ else
++ task->acl = newacl;
++ } else if (retmode & GR_INHERIT && retmode & GR_AUDIT_INHERIT)
++ gr_log_str_fs(GR_DO_AUDIT, GR_INHERIT_ACL_MSG, task->acl->filename, dentry, mnt);
++
++ task->is_writable = 0;
++
++ /* ignore additional mmap checks for processes that are writable
++ by the default ACL */
++ obj = chk_obj_label(dentry, mnt, default_role->root_label);
++ if (unlikely(obj->mode & GR_WRITE))
++ task->is_writable = 1;
++ obj = chk_obj_label(dentry, mnt, task->role->root_label);
++ if (unlikely(obj->mode & GR_WRITE))
++ task->is_writable = 1;
++
++ gr_set_proc_res(task);
++
++#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
++ printk(KERN_ALERT "Set subject label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
++#endif
++ return 0;
++}
++
++/* always called with valid inodev ptr */
++static void
++do_handle_delete(struct inodev_entry *inodev, const ino_t ino, const dev_t dev)
++{
++ struct acl_object_label *matchpo;
++ struct acl_subject_label *matchps;
++ struct acl_subject_label *subj;
++ struct acl_role_label *role;
++ unsigned int x;
++
++ FOR_EACH_ROLE_START(role)
++ FOR_EACH_SUBJECT_START(role, subj, x)
++ if ((matchpo = lookup_acl_obj_label(ino, dev, subj)) != NULL)
++ matchpo->mode |= GR_DELETED;
++ FOR_EACH_SUBJECT_END(subj,x)
++ FOR_EACH_NESTED_SUBJECT_START(role, subj)
++ if (subj->inode == ino && subj->device == dev)
++ subj->mode |= GR_DELETED;
++ FOR_EACH_NESTED_SUBJECT_END(subj)
++ if ((matchps = lookup_acl_subj_label(ino, dev, role)) != NULL)
++ matchps->mode |= GR_DELETED;
++ FOR_EACH_ROLE_END(role)
++
++ inodev->nentry->deleted = 1;
++
++ return;
++}
++
++void
++gr_handle_delete(const ino_t ino, const dev_t dev)
++{
++ struct inodev_entry *inodev;
++
++ if (unlikely(!(gr_status & GR_READY)))
++ return;
++
++ write_lock(&gr_inode_lock);
++ inodev = lookup_inodev_entry(ino, dev);
++ if (inodev != NULL)
++ do_handle_delete(inodev, ino, dev);
++ write_unlock(&gr_inode_lock);
++
++ return;
++}
++
++static void
++update_acl_obj_label(const ino_t oldinode, const dev_t olddevice,
++ const ino_t newinode, const dev_t newdevice,
++ struct acl_subject_label *subj)
++{
++ unsigned int index = fhash(oldinode, olddevice, subj->obj_hash_size);
++ struct acl_object_label *match;
++
++ match = subj->obj_hash[index];
++
++ while (match && (match->inode != oldinode ||
++ match->device != olddevice ||
++ !(match->mode & GR_DELETED)))
++ match = match->next;
++
++ if (match && (match->inode == oldinode)
++ && (match->device == olddevice)
++ && (match->mode & GR_DELETED)) {
++ if (match->prev == NULL) {
++ subj->obj_hash[index] = match->next;
++ if (match->next != NULL)
++ match->next->prev = NULL;
++ } else {
++ match->prev->next = match->next;
++ if (match->next != NULL)
++ match->next->prev = match->prev;
++ }
++ match->prev = NULL;
++ match->next = NULL;
++ match->inode = newinode;
++ match->device = newdevice;
++ match->mode &= ~GR_DELETED;
++
++ insert_acl_obj_label(match, subj);
++ }
++
++ return;
++}
++
++static void
++update_acl_subj_label(const ino_t oldinode, const dev_t olddevice,
++ const ino_t newinode, const dev_t newdevice,
++ struct acl_role_label *role)
++{
++ unsigned int index = fhash(oldinode, olddevice, role->subj_hash_size);
++ struct acl_subject_label *match;
++
++ match = role->subj_hash[index];
++
++ while (match && (match->inode != oldinode ||
++ match->device != olddevice ||
++ !(match->mode & GR_DELETED)))
++ match = match->next;
++
++ if (match && (match->inode == oldinode)
++ && (match->device == olddevice)
++ && (match->mode & GR_DELETED)) {
++ if (match->prev == NULL) {
++ role->subj_hash[index] = match->next;
++ if (match->next != NULL)
++ match->next->prev = NULL;
++ } else {
++ match->prev->next = match->next;
++ if (match->next != NULL)
++ match->next->prev = match->prev;
++ }
++ match->prev = NULL;
++ match->next = NULL;
++ match->inode = newinode;
++ match->device = newdevice;
++ match->mode &= ~GR_DELETED;
++
++ insert_acl_subj_label(match, role);
++ }
++
++ return;
++}
++
++static void
++update_inodev_entry(const ino_t oldinode, const dev_t olddevice,
++ const ino_t newinode, const dev_t newdevice)
++{
++ unsigned int index = fhash(oldinode, olddevice, inodev_set.i_size);
++ struct inodev_entry *match;
++
++ match = inodev_set.i_hash[index];
++
++ while (match && (match->nentry->inode != oldinode ||
++ match->nentry->device != olddevice || !match->nentry->deleted))
++ match = match->next;
++
++ if (match && (match->nentry->inode == oldinode)
++ && (match->nentry->device == olddevice) &&
++ match->nentry->deleted) {
++ if (match->prev == NULL) {
++ inodev_set.i_hash[index] = match->next;
++ if (match->next != NULL)
++ match->next->prev = NULL;
++ } else {
++ match->prev->next = match->next;
++ if (match->next != NULL)
++ match->next->prev = match->prev;
++ }
++ match->prev = NULL;
++ match->next = NULL;
++ match->nentry->inode = newinode;
++ match->nentry->device = newdevice;
++ match->nentry->deleted = 0;
++
++ insert_inodev_entry(match);
++ }
++
++ return;
++}
++
++static void
++__do_handle_create(const struct name_entry *matchn, ino_t inode, dev_t dev)
++{
++ struct acl_subject_label *subj;
++ struct acl_role_label *role;
++ unsigned int x;
++
++ FOR_EACH_ROLE_START(role)
++ update_acl_subj_label(matchn->inode, matchn->device,
++ inode, dev, role);
++
++ FOR_EACH_NESTED_SUBJECT_START(role, subj)
++ if ((subj->inode == inode) && (subj->device == dev)) {
++ subj->inode = inode;
++ subj->device = dev;
++ }
++ FOR_EACH_NESTED_SUBJECT_END(subj)
++ FOR_EACH_SUBJECT_START(role, subj, x)
++ update_acl_obj_label(matchn->inode, matchn->device,
++ inode, dev, subj);
++ FOR_EACH_SUBJECT_END(subj,x)
++ FOR_EACH_ROLE_END(role)
++
++ update_inodev_entry(matchn->inode, matchn->device, inode, dev);
++
++ return;
++}
++
++static void
++do_handle_create(const struct name_entry *matchn, const struct dentry *dentry,
++ const struct vfsmount *mnt)
++{
++ ino_t ino = dentry->d_inode->i_ino;
++ dev_t dev = __get_dev(dentry);
++
++ __do_handle_create(matchn, ino, dev);
++
++ return;
++}
++
++void
++gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++ struct name_entry *matchn;
++
++ if (unlikely(!(gr_status & GR_READY)))
++ return;
++
++ preempt_disable();
++ matchn = lookup_name_entry(gr_to_filename_rbac(dentry, mnt));
++
++ if (unlikely((unsigned long)matchn)) {
++ write_lock(&gr_inode_lock);
++ do_handle_create(matchn, dentry, mnt);
++ write_unlock(&gr_inode_lock);
++ }
++ preempt_enable();
++
++ return;
++}
++
++void
++gr_handle_proc_create(const struct dentry *dentry, const struct inode *inode)
++{
++ struct name_entry *matchn;
++
++ if (unlikely(!(gr_status & GR_READY)))
++ return;
++
++ preempt_disable();
++ matchn = lookup_name_entry(gr_to_proc_filename_rbac(dentry, init_pid_ns.proc_mnt));
++
++ if (unlikely((unsigned long)matchn)) {
++ write_lock(&gr_inode_lock);
++ __do_handle_create(matchn, inode->i_ino, inode->i_sb->s_dev);
++ write_unlock(&gr_inode_lock);
++ }
++ preempt_enable();
++
++ return;
++}
++
++void
++gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
++ struct dentry *old_dentry,
++ struct dentry *new_dentry,
++ struct vfsmount *mnt, const __u8 replace)
++{
++ struct name_entry *matchn;
++ struct inodev_entry *inodev;
++ struct inode *inode = new_dentry->d_inode;
++ ino_t oldinode = old_dentry->d_inode->i_ino;
++ dev_t olddev = __get_dev(old_dentry);
++
++ /* vfs_rename swaps the name and parent link for old_dentry and
++ new_dentry
++ at this point, old_dentry has the new name, parent link, and inode
++ for the renamed file
++ if a file is being replaced by a rename, new_dentry has the inode
++ and name for the replaced file
++ */
++
++ if (unlikely(!(gr_status & GR_READY)))
++ return;
++
++ preempt_disable();
++ matchn = lookup_name_entry(gr_to_filename_rbac(old_dentry, mnt));
++
++ /* we wouldn't have to check d_inode if it weren't for
++ NFS silly-renaming
++ */
++
++ write_lock(&gr_inode_lock);
++ if (unlikely(replace && inode)) {
++ ino_t newinode = inode->i_ino;
++ dev_t newdev = __get_dev(new_dentry);
++ inodev = lookup_inodev_entry(newinode, newdev);
++ if (inodev != NULL && ((inode->i_nlink <= 1) || S_ISDIR(inode->i_mode)))
++ do_handle_delete(inodev, newinode, newdev);
++ }
++
++ inodev = lookup_inodev_entry(oldinode, olddev);
++ if (inodev != NULL && ((old_dentry->d_inode->i_nlink <= 1) || S_ISDIR(old_dentry->d_inode->i_mode)))
++ do_handle_delete(inodev, oldinode, olddev);
++
++ if (unlikely((unsigned long)matchn))
++ do_handle_create(matchn, old_dentry, mnt);
++
++ write_unlock(&gr_inode_lock);
++ preempt_enable();
++
++ return;
++}
++
++static int
++lookup_special_role_auth(__u16 mode, const char *rolename, unsigned char **salt,
++ unsigned char **sum)
++{
++ struct acl_role_label *r;
++ struct role_allowed_ip *ipp;
++ struct role_transition *trans;
++ unsigned int i;
++ int found = 0;
++ u32 curr_ip = current->signal->curr_ip;
++
++ current->signal->saved_ip = curr_ip;
++
++ /* check transition table */
++
++ for (trans = current->role->transitions; trans; trans = trans->next) {
++ if (!strcmp(rolename, trans->rolename)) {
++ found = 1;
++ break;
++ }
++ }
++
++ if (!found)
++ return 0;
++
++ /* handle special roles that do not require authentication
++ and check ip */
++
++ FOR_EACH_ROLE_START(r)
++ if (!strcmp(rolename, r->rolename) &&
++ (r->roletype & GR_ROLE_SPECIAL)) {
++ found = 0;
++ if (r->allowed_ips != NULL) {
++ for (ipp = r->allowed_ips; ipp; ipp = ipp->next) {
++ if ((ntohl(curr_ip) & ipp->netmask) ==
++ (ntohl(ipp->addr) & ipp->netmask))
++ found = 1;
++ }
++ } else
++ found = 2;
++ if (!found)
++ return 0;
++
++ if (((mode == GR_SPROLE) && (r->roletype & GR_ROLE_NOPW)) ||
++ ((mode == GR_SPROLEPAM) && (r->roletype & GR_ROLE_PAM))) {
++ *salt = NULL;
++ *sum = NULL;
++ return 1;
++ }
++ }
++ FOR_EACH_ROLE_END(r)
++
++ for (i = 0; i < num_sprole_pws; i++) {
++ if (!strcmp(rolename, acl_special_roles[i]->rolename)) {
++ *salt = acl_special_roles[i]->salt;
++ *sum = acl_special_roles[i]->sum;
++ return 1;
++ }
++ }
++
++ return 0;
++}
++
++static void
++assign_special_role(char *rolename)
++{
++ struct acl_object_label *obj;
++ struct acl_role_label *r;
++ struct acl_role_label *assigned = NULL;
++ struct task_struct *tsk;
++ struct file *filp;
++
++ FOR_EACH_ROLE_START(r)
++ if (!strcmp(rolename, r->rolename) &&
++ (r->roletype & GR_ROLE_SPECIAL)) {
++ assigned = r;
++ break;
++ }
++ FOR_EACH_ROLE_END(r)
++
++ if (!assigned)
++ return;
++
++ read_lock(&tasklist_lock);
++ read_lock(&grsec_exec_file_lock);
++
++ tsk = current->real_parent;
++ if (tsk == NULL)
++ goto out_unlock;
++
++ filp = tsk->exec_file;
++ if (filp == NULL)
++ goto out_unlock;
++
++ tsk->is_writable = 0;
++
++ tsk->acl_sp_role = 1;
++ tsk->acl_role_id = ++acl_sp_role_value;
++ tsk->role = assigned;
++ tsk->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role);
++
++ /* ignore additional mmap checks for processes that are writable
++ by the default ACL */
++ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
++ if (unlikely(obj->mode & GR_WRITE))
++ tsk->is_writable = 1;
++ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role->root_label);
++ if (unlikely(obj->mode & GR_WRITE))
++ tsk->is_writable = 1;
++
++#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
++ printk(KERN_ALERT "Assigning special role:%s subject:%s to process (%s:%d)\n", tsk->role->rolename, tsk->acl->filename, tsk->comm, tsk->pid);
++#endif
++
++out_unlock:
++ read_unlock(&grsec_exec_file_lock);
++ read_unlock(&tasklist_lock);
++ return;
++}
++
++int gr_check_secure_terminal(struct task_struct *task)
++{
++ struct task_struct *p, *p2, *p3;
++ struct files_struct *files;
++ struct fdtable *fdt;
++ struct file *our_file = NULL, *file;
++ int i;
++
++ if (task->signal->tty == NULL)
++ return 1;
++
++ files = get_files_struct(task);
++ if (files != NULL) {
++ rcu_read_lock();
++ fdt = files_fdtable(files);
++ for (i=0; i < fdt->max_fds; i++) {
++ file = fcheck_files(files, i);
++ if (file && (our_file == NULL) && (file->private_data == task->signal->tty)) {
++ get_file(file);
++ our_file = file;
++ }
++ }
++ rcu_read_unlock();
++ put_files_struct(files);
++ }
++
++ if (our_file == NULL)
++ return 1;
++
++ read_lock(&tasklist_lock);
++ do_each_thread(p2, p) {
++ files = get_files_struct(p);
++ if (files == NULL ||
++ (p->signal && p->signal->tty == task->signal->tty)) {
++ if (files != NULL)
++ put_files_struct(files);
++ continue;
++ }
++ rcu_read_lock();
++ fdt = files_fdtable(files);
++ for (i=0; i < fdt->max_fds; i++) {
++ file = fcheck_files(files, i);
++ if (file && S_ISCHR(file->f_path.dentry->d_inode->i_mode) &&
++ file->f_path.dentry->d_inode->i_rdev == our_file->f_path.dentry->d_inode->i_rdev) {
++ p3 = task;
++ while (p3->pid > 0) {
++ if (p3 == p)
++ break;
++ p3 = p3->real_parent;
++ }
++ if (p3 == p)
++ break;
++ gr_log_ttysniff(GR_DONT_AUDIT_GOOD, GR_TTYSNIFF_ACL_MSG, p);
++ gr_handle_alertkill(p);
++ rcu_read_unlock();
++ put_files_struct(files);
++ read_unlock(&tasklist_lock);
++ fput(our_file);
++ return 0;
++ }
++ }
++ rcu_read_unlock();
++ put_files_struct(files);
++ } while_each_thread(p2, p);
++ read_unlock(&tasklist_lock);
++
++ fput(our_file);
++ return 1;
++}
++
++ssize_t
++write_grsec_handler(struct file *file, const char * buf, size_t count, loff_t *ppos)
++{
++ struct gr_arg_wrapper uwrap;
++ unsigned char *sprole_salt = NULL;
++ unsigned char *sprole_sum = NULL;
++ int error = sizeof (struct gr_arg_wrapper);
++ int error2 = 0;
++
++ mutex_lock(&gr_dev_mutex);
++
++ if ((gr_status & GR_READY) && !(current->acl->mode & GR_KERNELAUTH)) {
++ error = -EPERM;
++ goto out;
++ }
++
++ if (count != sizeof (struct gr_arg_wrapper)) {
++ gr_log_int_int(GR_DONT_AUDIT_GOOD, GR_DEV_ACL_MSG, (int)count, (int)sizeof(struct gr_arg_wrapper));
++ error = -EINVAL;
++ goto out;
++ }
++
++
++ if (gr_auth_expires && time_after_eq(get_seconds(), gr_auth_expires)) {
++ gr_auth_expires = 0;
++ gr_auth_attempts = 0;
++ }
++
++ if (copy_from_user(&uwrap, buf, sizeof (struct gr_arg_wrapper))) {
++ error = -EFAULT;
++ goto out;
++ }
++
++ if ((uwrap.version != GRSECURITY_VERSION) || (uwrap.size != sizeof(struct gr_arg))) {
++ error = -EINVAL;
++ goto out;
++ }
++
++ if (copy_from_user(gr_usermode, uwrap.arg, sizeof (struct gr_arg))) {
++ error = -EFAULT;
++ goto out;
++ }
++
++ if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_SPROLEPAM &&
++ gr_auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
++ time_after(gr_auth_expires, get_seconds())) {
++ error = -EBUSY;
++ goto out;
++ }
++
++ /* if non-root trying to do anything other than use a special role,
++ do not attempt authentication, do not count towards authentication
++ locking
++ */
++
++ if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_STATUS &&
++ gr_usermode->mode != GR_UNSPROLE && gr_usermode->mode != GR_SPROLEPAM &&
++ current_uid()) {
++ error = -EPERM;
++ goto out;
++ }
++
++ /* ensure pw and special role name are null terminated */
++
++ gr_usermode->pw[GR_PW_LEN - 1] = '\0';
++ gr_usermode->sp_role[GR_SPROLE_LEN - 1] = '\0';
++
++ /* Okay.
++ * We have our enough of the argument structure..(we have yet
++ * to copy_from_user the tables themselves) . Copy the tables
++ * only if we need them, i.e. for loading operations. */
++
++ switch (gr_usermode->mode) {
++ case GR_STATUS:
++ if (gr_status & GR_READY) {
++ error = 1;
++ if (!gr_check_secure_terminal(current))
++ error = 3;
++ } else
++ error = 2;
++ goto out;
++ case GR_SHUTDOWN:
++ if ((gr_status & GR_READY)
++ && !(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
++ pax_open_kernel();
++ gr_status &= ~GR_READY;
++ pax_close_kernel();
++
++ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG);
++ free_variables();
++ memset(gr_usermode, 0, sizeof (struct gr_arg));
++ memset(gr_system_salt, 0, GR_SALT_LEN);
++ memset(gr_system_sum, 0, GR_SHA_LEN);
++ } else if (gr_status & GR_READY) {
++ gr_log_noargs(GR_DONT_AUDIT, GR_SHUTF_ACL_MSG);
++ error = -EPERM;
++ } else {
++ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTI_ACL_MSG);
++ error = -EAGAIN;
++ }
++ break;
++ case GR_ENABLE:
++ if (!(gr_status & GR_READY) && !(error2 = gracl_init(gr_usermode)))
++ gr_log_str(GR_DONT_AUDIT_GOOD, GR_ENABLE_ACL_MSG, GR_VERSION);
++ else {
++ if (gr_status & GR_READY)
++ error = -EAGAIN;
++ else
++ error = error2;
++ gr_log_str(GR_DONT_AUDIT, GR_ENABLEF_ACL_MSG, GR_VERSION);
++ }
++ break;
++ case GR_RELOAD:
++ if (!(gr_status & GR_READY)) {
++ gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOADI_ACL_MSG, GR_VERSION);
++ error = -EAGAIN;
++ } else if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
++ lock_kernel();
++
++ pax_open_kernel();
++ gr_status &= ~GR_READY;
++ pax_close_kernel();
++
++ free_variables();
++ if (!(error2 = gracl_init(gr_usermode))) {
++ unlock_kernel();
++ gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOAD_ACL_MSG, GR_VERSION);
++ } else {
++ unlock_kernel();
++ error = error2;
++ gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
++ }
++ } else {
++ gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
++ error = -EPERM;
++ }
++ break;
++ case GR_SEGVMOD:
++ if (unlikely(!(gr_status & GR_READY))) {
++ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODI_ACL_MSG);
++ error = -EAGAIN;
++ break;
++ }
++
++ if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
++ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODS_ACL_MSG);
++ if (gr_usermode->segv_device && gr_usermode->segv_inode) {
++ struct acl_subject_label *segvacl;
++ segvacl =
++ lookup_acl_subj_label(gr_usermode->segv_inode,
++ gr_usermode->segv_device,
++ current->role);
++ if (segvacl) {
++ segvacl->crashes = 0;
++ segvacl->expires = 0;
++ }
++ } else if (gr_find_uid(gr_usermode->segv_uid) >= 0) {
++ gr_remove_uid(gr_usermode->segv_uid);
++ }
++ } else {
++ gr_log_noargs(GR_DONT_AUDIT, GR_SEGVMODF_ACL_MSG);
++ error = -EPERM;
++ }
++ break;
++ case GR_SPROLE:
++ case GR_SPROLEPAM:
++ if (unlikely(!(gr_status & GR_READY))) {
++ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SPROLEI_ACL_MSG);
++ error = -EAGAIN;
++ break;
++ }
++
++ if (current->role->expires && time_after_eq(get_seconds(), current->role->expires)) {
++ current->role->expires = 0;
++ current->role->auth_attempts = 0;
++ }
++
++ if (current->role->auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
++ time_after(current->role->expires, get_seconds())) {
++ error = -EBUSY;
++ goto out;
++ }
++
++ if (lookup_special_role_auth
++ (gr_usermode->mode, gr_usermode->sp_role, &sprole_salt, &sprole_sum)
++ && ((!sprole_salt && !sprole_sum)
++ || !(chkpw(gr_usermode, sprole_salt, sprole_sum)))) {
++ char *p = "";
++ assign_special_role(gr_usermode->sp_role);
++ read_lock(&tasklist_lock);
++ if (current->real_parent)
++ p = current->real_parent->role->rolename;
++ read_unlock(&tasklist_lock);
++ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLES_ACL_MSG,
++ p, acl_sp_role_value);
++ } else {
++ gr_log_str(GR_DONT_AUDIT, GR_SPROLEF_ACL_MSG, gr_usermode->sp_role);
++ error = -EPERM;
++ if(!(current->role->auth_attempts++))
++ current->role->expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
++
++ goto out;
++ }
++ break;
++ case GR_UNSPROLE:
++ if (unlikely(!(gr_status & GR_READY))) {
++ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_UNSPROLEI_ACL_MSG);
++ error = -EAGAIN;
++ break;
++ }
++
++ if (current->role->roletype & GR_ROLE_SPECIAL) {
++ char *p = "";
++ int i = 0;
++
++ read_lock(&tasklist_lock);
++ if (current->real_parent) {
++ p = current->real_parent->role->rolename;
++ i = current->real_parent->acl_role_id;
++ }
++ read_unlock(&tasklist_lock);
++
++ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_UNSPROLES_ACL_MSG, p, i);
++ gr_set_acls(1);
++ } else {
++ error = -EPERM;
++ goto out;
++ }
++ break;
++ default:
++ gr_log_int(GR_DONT_AUDIT, GR_INVMODE_ACL_MSG, gr_usermode->mode);
++ error = -EINVAL;
++ break;
++ }
++
++ if (error != -EPERM)
++ goto out;
++
++ if(!(gr_auth_attempts++))
++ gr_auth_expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
++
++ out:
++ mutex_unlock(&gr_dev_mutex);
++ return error;
++}
++
++/* must be called with
++ rcu_read_lock();
++ read_lock(&tasklist_lock);
++ read_lock(&grsec_exec_file_lock);
++*/
++int gr_apply_subject_to_task(struct task_struct *task)
++{
++ struct acl_object_label *obj;
++ char *tmpname;
++ struct acl_subject_label *tmpsubj;
++ struct file *filp;
++ struct name_entry *nmatch;
++
++ filp = task->exec_file;
++ if (filp == NULL)
++ return 0;
++
++ /* the following is to apply the correct subject
++ on binaries running when the RBAC system
++ is enabled, when the binaries have been
++ replaced or deleted since their execution
++ -----
++ when the RBAC system starts, the inode/dev
++ from exec_file will be one the RBAC system
++ is unaware of. It only knows the inode/dev
++ of the present file on disk, or the absence
++ of it.
++ */
++ preempt_disable();
++ tmpname = gr_to_filename_rbac(filp->f_path.dentry, filp->f_path.mnt);
++
++ nmatch = lookup_name_entry(tmpname);
++ preempt_enable();
++ tmpsubj = NULL;
++ if (nmatch) {
++ if (nmatch->deleted)
++ tmpsubj = lookup_acl_subj_label_deleted(nmatch->inode, nmatch->device, task->role);
++ else
++ tmpsubj = lookup_acl_subj_label(nmatch->inode, nmatch->device, task->role);
++ if (tmpsubj != NULL)
++ task->acl = tmpsubj;
++ }
++ if (tmpsubj == NULL)
++ task->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt,
++ task->role);
++ if (task->acl) {
++ task->is_writable = 0;
++ /* ignore additional mmap checks for processes that are writable
++ by the default ACL */
++ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
++ if (unlikely(obj->mode & GR_WRITE))
++ task->is_writable = 1;
++ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
++ if (unlikely(obj->mode & GR_WRITE))
++ task->is_writable = 1;
++
++ gr_set_proc_res(task);
++
++#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
++ printk(KERN_ALERT "gr_set_acls for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
++#endif
++ } else {
++ return 1;
++ }
++
++ return 0;
++}
++
++int
++gr_set_acls(const int type)
++{
++ struct task_struct *task, *task2;
++ struct acl_role_label *role = current->role;
++ __u16 acl_role_id = current->acl_role_id;
++ const struct cred *cred;
++ int ret;
++
++ rcu_read_lock();
++ read_lock(&tasklist_lock);
++ read_lock(&grsec_exec_file_lock);
++ do_each_thread(task2, task) {
++ /* check to see if we're called from the exit handler,
++ if so, only replace ACLs that have inherited the admin
++ ACL */
++
++ if (type && (task->role != role ||
++ task->acl_role_id != acl_role_id))
++ continue;
++
++ task->acl_role_id = 0;
++ task->acl_sp_role = 0;
++
++ if (task->exec_file) {
++ cred = __task_cred(task);
++ task->role = lookup_acl_role_label(task, cred->uid, cred->gid);
++
++ ret = gr_apply_subject_to_task(task);
++ if (ret) {
++ read_unlock(&grsec_exec_file_lock);
++ read_unlock(&tasklist_lock);
++ rcu_read_unlock();
++ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_DEFACL_MSG, task->comm, task->pid);
++ return ret;
++ }
++ } else {
++ // it's a kernel process
++ task->role = kernel_role;
++ task->acl = kernel_role->root_label;
++#ifdef CONFIG_GRKERNSEC_ACL_HIDEKERN
++ task->acl->mode &= ~GR_PROCFIND;
++#endif
++ }
++ } while_each_thread(task2, task);
++ read_unlock(&grsec_exec_file_lock);
++ read_unlock(&tasklist_lock);
++ rcu_read_unlock();
++
++ return 0;
++}
++
++void
++gr_learn_resource(const struct task_struct *task,
++ const int res, const unsigned long wanted, const int gt)
++{
++ struct acl_subject_label *acl;
++ const struct cred *cred;
++
++ if (unlikely((gr_status & GR_READY) &&
++ task->acl && (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))))
++ goto skip_reslog;
++
++#ifdef CONFIG_GRKERNSEC_RESLOG
++ gr_log_resource(task, res, wanted, gt);
++#endif
++ skip_reslog:
++
++ if (unlikely(!(gr_status & GR_READY) || !wanted || res >= GR_NLIMITS))
++ return;
++
++ acl = task->acl;
++
++ if (likely(!acl || !(acl->mode & (GR_LEARN | GR_INHERITLEARN)) ||
++ !(acl->resmask & (1 << (unsigned short) res))))
++ return;
++
++ if (wanted >= acl->res[res].rlim_cur) {
++ unsigned long res_add;
++
++ res_add = wanted;
++ switch (res) {
++ case RLIMIT_CPU:
++ res_add += GR_RLIM_CPU_BUMP;
++ break;
++ case RLIMIT_FSIZE:
++ res_add += GR_RLIM_FSIZE_BUMP;
++ break;
++ case RLIMIT_DATA:
++ res_add += GR_RLIM_DATA_BUMP;
++ break;
++ case RLIMIT_STACK:
++ res_add += GR_RLIM_STACK_BUMP;
++ break;
++ case RLIMIT_CORE:
++ res_add += GR_RLIM_CORE_BUMP;
++ break;
++ case RLIMIT_RSS:
++ res_add += GR_RLIM_RSS_BUMP;
++ break;
++ case RLIMIT_NPROC:
++ res_add += GR_RLIM_NPROC_BUMP;
++ break;
++ case RLIMIT_NOFILE:
++ res_add += GR_RLIM_NOFILE_BUMP;
++ break;
++ case RLIMIT_MEMLOCK:
++ res_add += GR_RLIM_MEMLOCK_BUMP;
++ break;
++ case RLIMIT_AS:
++ res_add += GR_RLIM_AS_BUMP;
++ break;
++ case RLIMIT_LOCKS:
++ res_add += GR_RLIM_LOCKS_BUMP;
++ break;
++ case RLIMIT_SIGPENDING:
++ res_add += GR_RLIM_SIGPENDING_BUMP;
++ break;
++ case RLIMIT_MSGQUEUE:
++ res_add += GR_RLIM_MSGQUEUE_BUMP;
++ break;
++ case RLIMIT_NICE:
++ res_add += GR_RLIM_NICE_BUMP;
++ break;
++ case RLIMIT_RTPRIO:
++ res_add += GR_RLIM_RTPRIO_BUMP;
++ break;
++ case RLIMIT_RTTIME:
++ res_add += GR_RLIM_RTTIME_BUMP;
++ break;
++ }
++
++ acl->res[res].rlim_cur = res_add;
++
++ if (wanted > acl->res[res].rlim_max)
++ acl->res[res].rlim_max = res_add;
++
++ /* only log the subject filename, since resource logging is supported for
++ single-subject learning only */
++ rcu_read_lock();
++ cred = __task_cred(task);
++ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
++ task->role->roletype, cred->uid, cred->gid, acl->filename,
++ acl->filename, acl->res[res].rlim_cur, acl->res[res].rlim_max,
++ "", (unsigned long) res, &task->signal->saved_ip);
++ rcu_read_unlock();
++ }
++
++ return;
++}
++
++#if defined(CONFIG_PAX_HAVE_ACL_FLAGS) && (defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR))
++void
++pax_set_initial_flags(struct linux_binprm *bprm)
++{
++ struct task_struct *task = current;
++ struct acl_subject_label *proc;
++ unsigned long flags;
++
++ if (unlikely(!(gr_status & GR_READY)))
++ return;
++
++ flags = pax_get_flags(task);
++
++ proc = task->acl;
++
++ if (proc->pax_flags & GR_PAX_DISABLE_PAGEEXEC)
++ flags &= ~MF_PAX_PAGEEXEC;
++ if (proc->pax_flags & GR_PAX_DISABLE_SEGMEXEC)
++ flags &= ~MF_PAX_SEGMEXEC;
++ if (proc->pax_flags & GR_PAX_DISABLE_RANDMMAP)
++ flags &= ~MF_PAX_RANDMMAP;
++ if (proc->pax_flags & GR_PAX_DISABLE_EMUTRAMP)
++ flags &= ~MF_PAX_EMUTRAMP;
++ if (proc->pax_flags & GR_PAX_DISABLE_MPROTECT)
++ flags &= ~MF_PAX_MPROTECT;
++
++ if (proc->pax_flags & GR_PAX_ENABLE_PAGEEXEC)
++ flags |= MF_PAX_PAGEEXEC;
++ if (proc->pax_flags & GR_PAX_ENABLE_SEGMEXEC)
++ flags |= MF_PAX_SEGMEXEC;
++ if (proc->pax_flags & GR_PAX_ENABLE_RANDMMAP)
++ flags |= MF_PAX_RANDMMAP;
++ if (proc->pax_flags & GR_PAX_ENABLE_EMUTRAMP)
++ flags |= MF_PAX_EMUTRAMP;
++ if (proc->pax_flags & GR_PAX_ENABLE_MPROTECT)
++ flags |= MF_PAX_MPROTECT;
++
++ pax_set_flags(task, flags);
++
++ return;
++}
++#endif
++
++#ifdef CONFIG_SYSCTL
++/* Eric Biederman likes breaking userland ABI and every inode-based security
++ system to save 35kb of memory */
++
++/* we modify the passed in filename, but adjust it back before returning */
++static struct acl_object_label *gr_lookup_by_name(char *name, unsigned int len)
++{
++ struct name_entry *nmatch;
++ char *p, *lastp = NULL;
++ struct acl_object_label *obj = NULL, *tmp;
++ struct acl_subject_label *tmpsubj;
++ char c = '\0';
++
++ read_lock(&gr_inode_lock);
++
++ p = name + len - 1;
++ do {
++ nmatch = lookup_name_entry(name);
++ if (lastp != NULL)
++ *lastp = c;
++
++ if (nmatch == NULL)
++ goto next_component;
++ tmpsubj = current->acl;
++ do {
++ obj = lookup_acl_obj_label(nmatch->inode, nmatch->device, tmpsubj);
++ if (obj != NULL) {
++ tmp = obj->globbed;
++ while (tmp) {
++ if (!glob_match(tmp->filename, name)) {
++ obj = tmp;
++ goto found_obj;
++ }
++ tmp = tmp->next;
++ }
++ goto found_obj;
++ }
++ } while ((tmpsubj = tmpsubj->parent_subject));
++next_component:
++ /* end case */
++ if (p == name)
++ break;
++
++ while (*p != '/')
++ p--;
++ if (p == name)
++ lastp = p + 1;
++ else {
++ lastp = p;
++ p--;
++ }
++ c = *lastp;
++ *lastp = '\0';
++ } while (1);
++found_obj:
++ read_unlock(&gr_inode_lock);
++ /* obj returned will always be non-null */
++ return obj;
++}
++
++/* returns 0 when allowing, non-zero on error
++ op of 0 is used for readdir, so we don't log the names of hidden files
++*/
++__u32
++gr_handle_sysctl(const struct ctl_table *table, const int op)
++{
++ ctl_table *tmp;
++ const char *proc_sys = "/proc/sys";
++ char *path;
++ struct acl_object_label *obj;
++ unsigned short len = 0, pos = 0, depth = 0, i;
++ __u32 err = 0;
++ __u32 mode = 0;
++
++ if (unlikely(!(gr_status & GR_READY)))
++ return 0;
++
++ /* for now, ignore operations on non-sysctl entries if it's not a
++ readdir*/
++ if (table->child != NULL && op != 0)
++ return 0;
++
++ mode |= GR_FIND;
++ /* it's only a read if it's an entry, read on dirs is for readdir */
++ if (op & MAY_READ)
++ mode |= GR_READ;
++ if (op & MAY_WRITE)
++ mode |= GR_WRITE;
++
++ preempt_disable();
++
++ path = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
++
++ /* it's only a read/write if it's an actual entry, not a dir
++ (which are opened for readdir)
++ */
++
++ /* convert the requested sysctl entry into a pathname */
++
++ for (tmp = (ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
++ len += strlen(tmp->procname);
++ len++;
++ depth++;
++ }
++
++ if ((len + depth + strlen(proc_sys) + 1) > PAGE_SIZE) {
++ /* deny */
++ goto out;
++ }
++
++ memset(path, 0, PAGE_SIZE);
++
++ memcpy(path, proc_sys, strlen(proc_sys));
++
++ pos += strlen(proc_sys);
++
++ for (; depth > 0; depth--) {
++ path[pos] = '/';
++ pos++;
++ for (i = 1, tmp = (ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
++ if (depth == i) {
++ memcpy(path + pos, tmp->procname,
++ strlen(tmp->procname));
++ pos += strlen(tmp->procname);
++ }
++ i++;
++ }
++ }
++
++ obj = gr_lookup_by_name(path, pos);
++ err = obj->mode & (mode | to_gr_audit(mode) | GR_SUPPRESS);
++
++ if (unlikely((current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) &&
++ ((err & mode) != mode))) {
++ __u32 new_mode = mode;
++
++ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
++
++ err = 0;
++ gr_log_learn_sysctl(path, new_mode);
++ } else if (!(err & GR_FIND) && !(err & GR_SUPPRESS) && op != 0) {
++ gr_log_hidden_sysctl(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, path);
++ err = -ENOENT;
++ } else if (!(err & GR_FIND)) {
++ err = -ENOENT;
++ } else if (((err & mode) & ~GR_FIND) != (mode & ~GR_FIND) && !(err & GR_SUPPRESS)) {
++ gr_log_str4(GR_DONT_AUDIT, GR_SYSCTL_ACL_MSG, "denied",
++ path, (mode & GR_READ) ? " reading" : "",
++ (mode & GR_WRITE) ? " writing" : "");
++ err = -EACCES;
++ } else if ((err & mode) != mode) {
++ err = -EACCES;
++ } else if ((((err & mode) & ~GR_FIND) == (mode & ~GR_FIND)) && (err & GR_AUDITS)) {
++ gr_log_str4(GR_DO_AUDIT, GR_SYSCTL_ACL_MSG, "successful",
++ path, (mode & GR_READ) ? " reading" : "",
++ (mode & GR_WRITE) ? " writing" : "");
++ err = 0;
++ } else
++ err = 0;
++
++ out:
++ preempt_enable();
++
++ return err;
++}
++#endif
++
++int
++gr_handle_proc_ptrace(struct task_struct *task)
++{
++ struct file *filp;
++ struct task_struct *tmp = task;
++ struct task_struct *curtemp = current;
++ __u32 retmode;
++
++#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
++ if (unlikely(!(gr_status & GR_READY)))
++ return 0;
++#endif
++
++ read_lock(&tasklist_lock);
++ read_lock(&grsec_exec_file_lock);
++ filp = task->exec_file;
++
++ while (tmp->pid > 0) {
++ if (tmp == curtemp)
++ break;
++ tmp = tmp->real_parent;
++ }
++
++ if (!filp || (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
++ ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE))))) {
++ read_unlock(&grsec_exec_file_lock);
++ read_unlock(&tasklist_lock);
++ return 1;
++ }
++
++#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
++ if (!(gr_status & GR_READY)) {
++ read_unlock(&grsec_exec_file_lock);
++ read_unlock(&tasklist_lock);
++ return 0;
++ }
++#endif
++
++ retmode = gr_search_file(filp->f_path.dentry, GR_NOPTRACE, filp->f_path.mnt);
++ read_unlock(&grsec_exec_file_lock);
++ read_unlock(&tasklist_lock);
++
++ if (retmode & GR_NOPTRACE)
++ return 1;
++
++ if (!(current->acl->mode & GR_POVERRIDE) && !(current->role->roletype & GR_ROLE_GOD)
++ && (current->acl != task->acl || (current->acl != current->role->root_label
++ && current->pid != task->pid)))
++ return 1;
++
++ return 0;
++}
++
++void task_grsec_rbac(struct seq_file *m, struct task_struct *p)
++{
++ if (unlikely(!(gr_status & GR_READY)))
++ return;
++
++ if (!(current->role->roletype & GR_ROLE_GOD))
++ return;
++
++ seq_printf(m, "RBAC:\t%.64s:%c:%.950s\n",
++ p->role->rolename, gr_task_roletype_to_char(p),
++ p->acl->filename);
++}
++
++int
++gr_handle_ptrace(struct task_struct *task, const long request)
++{
++ struct task_struct *tmp = task;
++ struct task_struct *curtemp = current;
++ __u32 retmode;
++
++#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
++ if (unlikely(!(gr_status & GR_READY)))
++ return 0;
++#endif
++
++ if (request == PTRACE_ATTACH) {
++ read_lock(&tasklist_lock);
++ while (tmp->pid > 0) {
++ if (tmp == curtemp)
++ break;
++ tmp = tmp->real_parent;
++ }
++
++ if (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
++ ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE)))) {
++ read_unlock(&tasklist_lock);
++ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
++ return 1;
++ }
++ read_unlock(&tasklist_lock);
++ }
++
++#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
++ if (!(gr_status & GR_READY))
++ return 0;
++#endif
++
++ read_lock(&grsec_exec_file_lock);
++ if (unlikely(!task->exec_file)) {
++ read_unlock(&grsec_exec_file_lock);
++ return 0;
++ }
++
++ retmode = gr_search_file(task->exec_file->f_path.dentry, GR_PTRACERD | GR_NOPTRACE, task->exec_file->f_path.mnt);
++ read_unlock(&grsec_exec_file_lock);
++
++ if (retmode & GR_NOPTRACE) {
++ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
++ return 1;
++ }
++
++ if (retmode & GR_PTRACERD) {
++ switch (request) {
++ case PTRACE_POKETEXT:
++ case PTRACE_POKEDATA:
++ case PTRACE_POKEUSR:
++#if !defined(CONFIG_PPC32) && !defined(CONFIG_PPC64) && !defined(CONFIG_PARISC) && !defined(CONFIG_ALPHA) && !defined(CONFIG_IA64)
++ case PTRACE_SETREGS:
++ case PTRACE_SETFPREGS:
++#endif
++#ifdef CONFIG_X86
++ case PTRACE_SETFPXREGS:
++#endif
++#ifdef CONFIG_ALTIVEC
++ case PTRACE_SETVRREGS:
++#endif
++ return 1;
++ default:
++ return 0;
++ }
++ } else if (!(current->acl->mode & GR_POVERRIDE) &&
++ !(current->role->roletype & GR_ROLE_GOD) &&
++ (current->acl != task->acl)) {
++ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
++ return 1;
++ }
++
++ return 0;
++}
++
++static int is_writable_mmap(const struct file *filp)
++{
++ struct task_struct *task = current;
++ struct acl_object_label *obj, *obj2;
++
++ if (gr_status & GR_READY && !(task->acl->mode & GR_OVERRIDE) &&
++ !task->is_writable && S_ISREG(filp->f_path.dentry->d_inode->i_mode) && (filp->f_path.mnt != shm_mnt || (filp->f_path.dentry->d_inode->i_nlink > 0))) {
++ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
++ obj2 = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt,
++ task->role->root_label);
++ if (unlikely((obj->mode & GR_WRITE) || (obj2->mode & GR_WRITE))) {
++ gr_log_fs_generic(GR_DONT_AUDIT, GR_WRITLIB_ACL_MSG, filp->f_path.dentry, filp->f_path.mnt);
++ return 1;
++ }
++ }
++ return 0;
++}
++
++int
++gr_acl_handle_mmap(const struct file *file, const unsigned long prot)
++{
++ __u32 mode;
++
++ if (unlikely(!file || !(prot & PROT_EXEC)))
++ return 1;
++
++ if (is_writable_mmap(file))
++ return 0;
++
++ mode =
++ gr_search_file(file->f_path.dentry,
++ GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
++ file->f_path.mnt);
++
++ if (!gr_tpe_allow(file))
++ return 0;
++
++ if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
++ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
++ return 0;
++ } else if (unlikely(!(mode & GR_EXEC))) {
++ return 0;
++ } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
++ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
++ return 1;
++ }
++
++ return 1;
++}
++
++int
++gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
++{
++ __u32 mode;
++
++ if (unlikely(!file || !(prot & PROT_EXEC)))
++ return 1;
++
++ if (is_writable_mmap(file))
++ return 0;
++
++ mode =
++ gr_search_file(file->f_path.dentry,
++ GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
++ file->f_path.mnt);
++
++ if (!gr_tpe_allow(file))
++ return 0;
++
++ if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
++ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
++ return 0;
++ } else if (unlikely(!(mode & GR_EXEC))) {
++ return 0;
++ } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
++ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
++ return 1;
++ }
++
++ return 1;
++}
++
++void
++gr_acl_handle_psacct(struct task_struct *task, const long code)
++{
++ unsigned long runtime;
++ unsigned long cputime;
++ unsigned int wday, cday;
++ __u8 whr, chr;
++ __u8 wmin, cmin;
++ __u8 wsec, csec;
++ struct timespec timeval;
++
++ if (unlikely(!(gr_status & GR_READY) || !task->acl ||
++ !(task->acl->mode & GR_PROCACCT)))
++ return;
++
++ do_posix_clock_monotonic_gettime(&timeval);
++ runtime = timeval.tv_sec - task->start_time.tv_sec;
++ wday = runtime / (3600 * 24);
++ runtime -= wday * (3600 * 24);
++ whr = runtime / 3600;
++ runtime -= whr * 3600;
++ wmin = runtime / 60;
++ runtime -= wmin * 60;
++ wsec = runtime;
++
++ cputime = (task->utime + task->stime) / HZ;
++ cday = cputime / (3600 * 24);
++ cputime -= cday * (3600 * 24);
++ chr = cputime / 3600;
++ cputime -= chr * 3600;
++ cmin = cputime / 60;
++ cputime -= cmin * 60;
++ csec = cputime;
++
++ gr_log_procacct(GR_DO_AUDIT, GR_ACL_PROCACCT_MSG, task, wday, whr, wmin, wsec, cday, chr, cmin, csec, code);
++
++ return;
++}
++
++void gr_set_kernel_label(struct task_struct *task)
++{
++ if (gr_status & GR_READY) {
++ task->role = kernel_role;
++ task->acl = kernel_role->root_label;
++ }
++ return;
++}
++
++#ifdef CONFIG_TASKSTATS
++int gr_is_taskstats_denied(int pid)
++{
++ struct task_struct *task;
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++ const struct cred *cred;
++#endif
++ int ret = 0;
++
++ /* restrict taskstats viewing to un-chrooted root users
++ who have the 'view' subject flag if the RBAC system is enabled
++ */
++
++ rcu_read_lock();
++ read_lock(&tasklist_lock);
++ task = find_task_by_vpid(pid);
++ if (task) {
++#ifdef CONFIG_GRKERNSEC_CHROOT
++ if (proc_is_chrooted(task))
++ ret = -EACCES;
++#endif
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++ cred = __task_cred(task);
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++ if (cred->uid != 0)
++ ret = -EACCES;
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++ if (cred->uid != 0 && !groups_search(cred->group_info, CONFIG_GRKERNSEC_PROC_GID))
++ ret = -EACCES;
++#endif
++#endif
++ if (gr_status & GR_READY) {
++ if (!(task->acl->mode & GR_VIEW))
++ ret = -EACCES;
++ }
++ } else
++ ret = -ENOENT;
++
++ read_unlock(&tasklist_lock);
++ rcu_read_unlock();
++
++ return ret;
++}
++#endif
++
++/* AUXV entries are filled via a descendant of search_binary_handler
++ after we've already applied the subject for the target
++*/
++int gr_acl_enable_at_secure(void)
++{
++ if (unlikely(!(gr_status & GR_READY)))
++ return 0;
++
++ if (current->acl->mode & GR_ATSECURE)
++ return 1;
++
++ return 0;
++}
++
++int gr_acl_handle_filldir(const struct file *file, const char *name, const unsigned int namelen, const ino_t ino)
++{
++ struct task_struct *task = current;
++ struct dentry *dentry = file->f_path.dentry;
++ struct vfsmount *mnt = file->f_path.mnt;
++ struct acl_object_label *obj, *tmp;
++ struct acl_subject_label *subj;
++ unsigned int bufsize;
++ int is_not_root;
++ char *path;
++ dev_t dev = __get_dev(dentry);
++
++ if (unlikely(!(gr_status & GR_READY)))
++ return 1;
++
++ if (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))
++ return 1;
++
++ /* ignore Eric Biederman */
++ if (IS_PRIVATE(dentry->d_inode))
++ return 1;
++
++ subj = task->acl;
++ do {
++ obj = lookup_acl_obj_label(ino, dev, subj);
++ if (obj != NULL)
++ return (obj->mode & GR_FIND) ? 1 : 0;
++ } while ((subj = subj->parent_subject));
++
++ /* this is purely an optimization since we're looking for an object
++ for the directory we're doing a readdir on
++ if it's possible for any globbed object to match the entry we're
++ filling into the directory, then the object we find here will be
++ an anchor point with attached globbed objects
++ */
++ obj = chk_obj_label_noglob(dentry, mnt, task->acl);
++ if (obj->globbed == NULL)
++ return (obj->mode & GR_FIND) ? 1 : 0;
++
++ is_not_root = ((obj->filename[0] == '/') &&
++ (obj->filename[1] == '\0')) ? 0 : 1;
++ bufsize = PAGE_SIZE - namelen - is_not_root;
++
++ /* check bufsize > PAGE_SIZE || bufsize == 0 */
++ if (unlikely((bufsize - 1) > (PAGE_SIZE - 1)))
++ return 1;
++
++ preempt_disable();
++ path = d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
++ bufsize);
++
++ bufsize = strlen(path);
++
++ /* if base is "/", don't append an additional slash */
++ if (is_not_root)
++ *(path + bufsize) = '/';
++ memcpy(path + bufsize + is_not_root, name, namelen);
++ *(path + bufsize + namelen + is_not_root) = '\0';
++
++ tmp = obj->globbed;
++ while (tmp) {
++ if (!glob_match(tmp->filename, path)) {
++ preempt_enable();
++ return (tmp->mode & GR_FIND) ? 1 : 0;
++ }
++ tmp = tmp->next;
++ }
++ preempt_enable();
++ return (obj->mode & GR_FIND) ? 1 : 0;
++}
++
++#ifdef CONFIG_NETFILTER_XT_MATCH_GRADM_MODULE
++EXPORT_SYMBOL(gr_acl_is_enabled);
++#endif
++EXPORT_SYMBOL(gr_learn_resource);
++EXPORT_SYMBOL(gr_set_kernel_label);
++#ifdef CONFIG_SECURITY
++EXPORT_SYMBOL(gr_check_user_change);
++EXPORT_SYMBOL(gr_check_group_change);
++#endif
++
+diff --git a/grsecurity/gracl_alloc.c b/grsecurity/gracl_alloc.c
+new file mode 100644
+index 0000000..34fefda
+--- /dev/null
++++ b/grsecurity/gracl_alloc.c
+@@ -0,0 +1,105 @@
++#include <linux/kernel.h>
++#include <linux/mm.h>
++#include <linux/slab.h>
++#include <linux/vmalloc.h>
++#include <linux/gracl.h>
++#include <linux/grsecurity.h>
++
++static unsigned long alloc_stack_next = 1;
++static unsigned long alloc_stack_size = 1;
++static void **alloc_stack;
++
++static __inline__ int
++alloc_pop(void)
++{
++ if (alloc_stack_next == 1)
++ return 0;
++
++ kfree(alloc_stack[alloc_stack_next - 2]);
++
++ alloc_stack_next--;
++
++ return 1;
++}
++
++static __inline__ int
++alloc_push(void *buf)
++{
++ if (alloc_stack_next >= alloc_stack_size)
++ return 1;
++
++ alloc_stack[alloc_stack_next - 1] = buf;
++
++ alloc_stack_next++;
++
++ return 0;
++}
++
++void *
++acl_alloc(unsigned long len)
++{
++ void *ret = NULL;
++
++ if (!len || len > PAGE_SIZE)
++ goto out;
++
++ ret = kmalloc(len, GFP_KERNEL);
++
++ if (ret) {
++ if (alloc_push(ret)) {
++ kfree(ret);
++ ret = NULL;
++ }
++ }
++
++out:
++ return ret;
++}
++
++void *
++acl_alloc_num(unsigned long num, unsigned long len)
++{
++ if (!len || (num > (PAGE_SIZE / len)))
++ return NULL;
++
++ return acl_alloc(num * len);
++}
++
++void
++acl_free_all(void)
++{
++ if (gr_acl_is_enabled() || !alloc_stack)
++ return;
++
++ while (alloc_pop()) ;
++
++ if (alloc_stack) {
++ if ((alloc_stack_size * sizeof (void *)) <= PAGE_SIZE)
++ kfree(alloc_stack);
++ else
++ vfree(alloc_stack);
++ }
++
++ alloc_stack = NULL;
++ alloc_stack_size = 1;
++ alloc_stack_next = 1;
++
++ return;
++}
++
++int
++acl_alloc_stack_init(unsigned long size)
++{
++ if ((size * sizeof (void *)) <= PAGE_SIZE)
++ alloc_stack =
++ (void **) kmalloc(size * sizeof (void *), GFP_KERNEL);
++ else
++ alloc_stack = (void **) vmalloc(size * sizeof (void *));
++
++ alloc_stack_size = size;
++
++ if (!alloc_stack)
++ return 0;
++ else
++ return 1;
++}
+diff --git a/grsecurity/gracl_cap.c b/grsecurity/gracl_cap.c
+new file mode 100644
+index 0000000..955ddfb
+--- /dev/null
++++ b/grsecurity/gracl_cap.c
+@@ -0,0 +1,101 @@
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/sched.h>
++#include <linux/gracl.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++extern const char *captab_log[];
++extern int captab_log_entries;
++
++int
++gr_acl_is_capable(const int cap)
++{
++ struct task_struct *task = current;
++ const struct cred *cred = current_cred();
++ struct acl_subject_label *curracl;
++ kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
++ kernel_cap_t cap_audit = __cap_empty_set;
++
++ if (!gr_acl_is_enabled())
++ return 1;
++
++ curracl = task->acl;
++
++ cap_drop = curracl->cap_lower;
++ cap_mask = curracl->cap_mask;
++ cap_audit = curracl->cap_invert_audit;
++
++ while ((curracl = curracl->parent_subject)) {
++ /* if the cap isn't specified in the current computed mask but is specified in the
++ current level subject, and is lowered in the current level subject, then add
++ it to the set of dropped capabilities
++ otherwise, add the current level subject's mask to the current computed mask
++ */
++ if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
++ cap_raise(cap_mask, cap);
++ if (cap_raised(curracl->cap_lower, cap))
++ cap_raise(cap_drop, cap);
++ if (cap_raised(curracl->cap_invert_audit, cap))
++ cap_raise(cap_audit, cap);
++ }
++ }
++
++ if (!cap_raised(cap_drop, cap)) {
++ if (cap_raised(cap_audit, cap))
++ gr_log_cap(GR_DO_AUDIT, GR_CAP_ACL_MSG2, task, captab_log[cap]);
++ return 1;
++ }
++
++ curracl = task->acl;
++
++ if ((curracl->mode & (GR_LEARN | GR_INHERITLEARN))
++ && cap_raised(cred->cap_effective, cap)) {
++ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
++ task->role->roletype, cred->uid,
++ cred->gid, task->exec_file ?
++ gr_to_filename(task->exec_file->f_path.dentry,
++ task->exec_file->f_path.mnt) : curracl->filename,
++ curracl->filename, 0UL,
++ 0UL, "", (unsigned long) cap, &task->signal->saved_ip);
++ return 1;
++ }
++
++ if ((cap >= 0) && (cap < captab_log_entries) && cap_raised(cred->cap_effective, cap) && !cap_raised(cap_audit, cap))
++ gr_log_cap(GR_DONT_AUDIT, GR_CAP_ACL_MSG, task, captab_log[cap]);
++ return 0;
++}
++
++int
++gr_acl_is_capable_nolog(const int cap)
++{
++ struct acl_subject_label *curracl;
++ kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
++
++ if (!gr_acl_is_enabled())
++ return 1;
++
++ curracl = current->acl;
++
++ cap_drop = curracl->cap_lower;
++ cap_mask = curracl->cap_mask;
++
++ while ((curracl = curracl->parent_subject)) {
++ /* if the cap isn't specified in the current computed mask but is specified in the
++ current level subject, and is lowered in the current level subject, then add
++ it to the set of dropped capabilities
++ otherwise, add the current level subject's mask to the current computed mask
++ */
++ if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
++ cap_raise(cap_mask, cap);
++ if (cap_raised(curracl->cap_lower, cap))
++ cap_raise(cap_drop, cap);
++ }
++ }
++
++ if (!cap_raised(cap_drop, cap))
++ return 1;
++
++ return 0;
++}
++
+diff --git a/grsecurity/gracl_fs.c b/grsecurity/gracl_fs.c
+new file mode 100644
+index 0000000..8c4595a
+--- /dev/null
++++ b/grsecurity/gracl_fs.c
+@@ -0,0 +1,435 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/types.h>
++#include <linux/fs.h>
++#include <linux/file.h>
++#include <linux/stat.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++#include <linux/gracl.h>
++
++umode_t
++gr_acl_umask(void)
++{
++ if (unlikely(!gr_acl_is_enabled()))
++ return 0;
++
++ return current->role->umask;
++}
++
++__u32
++gr_acl_handle_hidden_file(const struct dentry * dentry,
++ const struct vfsmount * mnt)
++{
++ __u32 mode;
++
++ if (unlikely(!dentry->d_inode))
++ return GR_FIND;
++
++ mode =
++ gr_search_file(dentry, GR_FIND | GR_AUDIT_FIND | GR_SUPPRESS, mnt);
++
++ if (unlikely(mode & GR_FIND && mode & GR_AUDIT_FIND)) {
++ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
++ return mode;
++ } else if (unlikely(!(mode & GR_FIND) && !(mode & GR_SUPPRESS))) {
++ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
++ return 0;
++ } else if (unlikely(!(mode & GR_FIND)))
++ return 0;
++
++ return GR_FIND;
++}
++
++__u32
++gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
++ int acc_mode)
++{
++ __u32 reqmode = GR_FIND;
++ __u32 mode;
++
++ if (unlikely(!dentry->d_inode))
++ return reqmode;
++
++ if (acc_mode & MAY_APPEND)
++ reqmode |= GR_APPEND;
++ else if (acc_mode & MAY_WRITE)
++ reqmode |= GR_WRITE;
++ if ((acc_mode & MAY_READ) && !S_ISDIR(dentry->d_inode->i_mode))
++ reqmode |= GR_READ;
++
++ mode =
++ gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
++ mnt);
++
++ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
++ gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
++ reqmode & GR_READ ? " reading" : "",
++ reqmode & GR_WRITE ? " writing" : reqmode &
++ GR_APPEND ? " appending" : "");
++ return reqmode;
++ } else
++ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
++ {
++ gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
++ reqmode & GR_READ ? " reading" : "",
++ reqmode & GR_WRITE ? " writing" : reqmode &
++ GR_APPEND ? " appending" : "");
++ return 0;
++ } else if (unlikely((mode & reqmode) != reqmode))
++ return 0;
++
++ return reqmode;
++}
++
++__u32
++gr_acl_handle_creat(const struct dentry * dentry,
++ const struct dentry * p_dentry,
++ const struct vfsmount * p_mnt, int open_flags, int acc_mode,
++ const int imode)
++{
++ __u32 reqmode = GR_WRITE | GR_CREATE;
++ __u32 mode;
++
++ if (acc_mode & MAY_APPEND)
++ reqmode |= GR_APPEND;
++ // if a directory was required or the directory already exists, then
++ // don't count this open as a read
++ if ((acc_mode & MAY_READ) &&
++ !((open_flags & O_DIRECTORY) || (dentry->d_inode && S_ISDIR(dentry->d_inode->i_mode))))
++ reqmode |= GR_READ;
++ if ((open_flags & O_CREAT) && (imode & (S_ISUID | S_ISGID)))
++ reqmode |= GR_SETID;
++
++ mode =
++ gr_check_create(dentry, p_dentry, p_mnt,
++ reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
++
++ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
++ gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
++ reqmode & GR_READ ? " reading" : "",
++ reqmode & GR_WRITE ? " writing" : reqmode &
++ GR_APPEND ? " appending" : "");
++ return reqmode;
++ } else
++ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
++ {
++ gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
++ reqmode & GR_READ ? " reading" : "",
++ reqmode & GR_WRITE ? " writing" : reqmode &
++ GR_APPEND ? " appending" : "");
++ return 0;
++ } else if (unlikely((mode & reqmode) != reqmode))
++ return 0;
++
++ return reqmode;
++}
++
++__u32
++gr_acl_handle_access(const struct dentry * dentry, const struct vfsmount * mnt,
++ const int fmode)
++{
++ __u32 mode, reqmode = GR_FIND;
++
++ if ((fmode & S_IXOTH) && !S_ISDIR(dentry->d_inode->i_mode))
++ reqmode |= GR_EXEC;
++ if (fmode & S_IWOTH)
++ reqmode |= GR_WRITE;
++ if (fmode & S_IROTH)
++ reqmode |= GR_READ;
++
++ mode =
++ gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
++ mnt);
++
++ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
++ gr_log_fs_rbac_mode3(GR_DO_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
++ reqmode & GR_READ ? " reading" : "",
++ reqmode & GR_WRITE ? " writing" : "",
++ reqmode & GR_EXEC ? " executing" : "");
++ return reqmode;
++ } else
++ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
++ {
++ gr_log_fs_rbac_mode3(GR_DONT_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
++ reqmode & GR_READ ? " reading" : "",
++ reqmode & GR_WRITE ? " writing" : "",
++ reqmode & GR_EXEC ? " executing" : "");
++ return 0;
++ } else if (unlikely((mode & reqmode) != reqmode))
++ return 0;
++
++ return reqmode;
++}
++
++static __u32 generic_fs_handler(const struct dentry *dentry, const struct vfsmount *mnt, __u32 reqmode, const char *fmt)
++{
++ __u32 mode;
++
++ mode = gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS, mnt);
++
++ if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
++ gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, dentry, mnt);
++ return mode;
++ } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
++ gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, dentry, mnt);
++ return 0;
++ } else if (unlikely((mode & (reqmode)) != (reqmode)))
++ return 0;
++
++ return (reqmode);
++}
++
++__u32
++gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
++{
++ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_RMDIR_ACL_MSG);
++}
++
++__u32
++gr_acl_handle_unlink(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_UNLINK_ACL_MSG);
++}
++
++__u32
++gr_acl_handle_truncate(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_TRUNCATE_ACL_MSG);
++}
++
++__u32
++gr_acl_handle_utime(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_ATIME_ACL_MSG);
++}
++
++__u32
++gr_acl_handle_chmod(const struct dentry *dentry, const struct vfsmount *mnt,
++ umode_t *modeptr)
++{
++ umode_t mode;
++
++ *modeptr &= ~gr_acl_umask();
++ mode = *modeptr;
++
++ if (unlikely(dentry->d_inode && S_ISSOCK(dentry->d_inode->i_mode)))
++ return 1;
++
++ if (unlikely(mode & (S_ISUID | S_ISGID))) {
++ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
++ GR_CHMOD_ACL_MSG);
++ } else {
++ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHMOD_ACL_MSG);
++ }
++}
++
++__u32
++gr_acl_handle_chown(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHOWN_ACL_MSG);
++}
++
++__u32
++gr_acl_handle_setxattr(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_SETXATTR_ACL_MSG);
++}
++
++__u32
++gr_acl_handle_execve(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++ return generic_fs_handler(dentry, mnt, GR_EXEC, GR_EXEC_ACL_MSG);
++}
++
++__u32
++gr_acl_handle_unix(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++ return generic_fs_handler(dentry, mnt, GR_READ | GR_WRITE,
++ GR_UNIXCONNECT_ACL_MSG);
++}
++
++/* hardlinks require at minimum create and link permission,
++ any additional privilege required is based on the
++ privilege of the file being linked to
++*/
++__u32
++gr_acl_handle_link(const struct dentry * new_dentry,
++ const struct dentry * parent_dentry,
++ const struct vfsmount * parent_mnt,
++ const struct dentry * old_dentry,
++ const struct vfsmount * old_mnt, const char *to)
++{
++ __u32 mode;
++ __u32 needmode = GR_CREATE | GR_LINK;
++ __u32 needaudit = GR_AUDIT_CREATE | GR_AUDIT_LINK;
++
++ mode =
++ gr_check_link(new_dentry, parent_dentry, parent_mnt, old_dentry,
++ old_mnt);
++
++ if (unlikely(((mode & needmode) == needmode) && (mode & needaudit))) {
++ gr_log_fs_rbac_str(GR_DO_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
++ return mode;
++ } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
++ gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
++ return 0;
++ } else if (unlikely((mode & needmode) != needmode))
++ return 0;
++
++ return 1;
++}
++
++__u32
++gr_acl_handle_symlink(const struct dentry * new_dentry,
++ const struct dentry * parent_dentry,
++ const struct vfsmount * parent_mnt, const char *from)
++{
++ __u32 needmode = GR_WRITE | GR_CREATE;
++ __u32 mode;
++
++ mode =
++ gr_check_create(new_dentry, parent_dentry, parent_mnt,
++ GR_CREATE | GR_AUDIT_CREATE |
++ GR_WRITE | GR_AUDIT_WRITE | GR_SUPPRESS);
++
++ if (unlikely(mode & GR_WRITE && mode & GR_AUDITS)) {
++ gr_log_fs_str_rbac(GR_DO_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
++ return mode;
++ } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
++ gr_log_fs_str_rbac(GR_DONT_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
++ return 0;
++ } else if (unlikely((mode & needmode) != needmode))
++ return 0;
++
++ return (GR_WRITE | GR_CREATE);
++}
++
++static __u32 generic_fs_create_handler(const struct dentry *new_dentry, const struct dentry *parent_dentry, const struct vfsmount *parent_mnt, __u32 reqmode, const char *fmt)
++{
++ __u32 mode;
++
++ mode = gr_check_create(new_dentry, parent_dentry, parent_mnt, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
++
++ if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
++ gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, new_dentry, parent_mnt);
++ return mode;
++ } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
++ gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, new_dentry, parent_mnt);
++ return 0;
++ } else if (unlikely((mode & (reqmode)) != (reqmode)))
++ return 0;
++
++ return (reqmode);
++}
++
++__u32
++gr_acl_handle_mknod(const struct dentry * new_dentry,
++ const struct dentry * parent_dentry,
++ const struct vfsmount * parent_mnt,
++ const int mode)
++{
++ __u32 reqmode = GR_WRITE | GR_CREATE;
++ if (unlikely(mode & (S_ISUID | S_ISGID)))
++ reqmode |= GR_SETID;
++
++ return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
++ reqmode, GR_MKNOD_ACL_MSG);
++}
++
++__u32
++gr_acl_handle_mkdir(const struct dentry *new_dentry,
++ const struct dentry *parent_dentry,
++ const struct vfsmount *parent_mnt)
++{
++ return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
++ GR_WRITE | GR_CREATE, GR_MKDIR_ACL_MSG);
++}
++
++#define RENAME_CHECK_SUCCESS(old, new) \
++ (((old & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)) && \
++ ((new & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)))
++
++int
++gr_acl_handle_rename(struct dentry *new_dentry,
++ struct dentry *parent_dentry,
++ const struct vfsmount *parent_mnt,
++ struct dentry *old_dentry,
++ struct inode *old_parent_inode,
++ struct vfsmount *old_mnt, const char *newname)
++{
++ __u32 comp1, comp2;
++ int error = 0;
++
++ if (unlikely(!gr_acl_is_enabled()))
++ return 0;
++
++ if (!new_dentry->d_inode) {
++ comp1 = gr_check_create(new_dentry, parent_dentry, parent_mnt,
++ GR_READ | GR_WRITE | GR_CREATE | GR_AUDIT_READ |
++ GR_AUDIT_WRITE | GR_AUDIT_CREATE | GR_SUPPRESS);
++ comp2 = gr_search_file(old_dentry, GR_READ | GR_WRITE |
++ GR_DELETE | GR_AUDIT_DELETE |
++ GR_AUDIT_READ | GR_AUDIT_WRITE |
++ GR_SUPPRESS, old_mnt);
++ } else {
++ comp1 = gr_search_file(new_dentry, GR_READ | GR_WRITE |
++ GR_CREATE | GR_DELETE |
++ GR_AUDIT_CREATE | GR_AUDIT_DELETE |
++ GR_AUDIT_READ | GR_AUDIT_WRITE |
++ GR_SUPPRESS, parent_mnt);
++ comp2 =
++ gr_search_file(old_dentry,
++ GR_READ | GR_WRITE | GR_AUDIT_READ |
++ GR_DELETE | GR_AUDIT_DELETE |
++ GR_AUDIT_WRITE | GR_SUPPRESS, old_mnt);
++ }
++
++ if (RENAME_CHECK_SUCCESS(comp1, comp2) &&
++ ((comp1 & GR_AUDITS) || (comp2 & GR_AUDITS)))
++ gr_log_fs_rbac_str(GR_DO_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
++ else if (!RENAME_CHECK_SUCCESS(comp1, comp2) && !(comp1 & GR_SUPPRESS)
++ && !(comp2 & GR_SUPPRESS)) {
++ gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
++ error = -EACCES;
++ } else if (unlikely(!RENAME_CHECK_SUCCESS(comp1, comp2)))
++ error = -EACCES;
++
++ return error;
++}
++
++void
++gr_acl_handle_exit(void)
++{
++ u16 id;
++ char *rolename;
++ struct file *exec_file;
++
++ if (unlikely(current->acl_sp_role && gr_acl_is_enabled() &&
++ !(current->role->roletype & GR_ROLE_PERSIST))) {
++ id = current->acl_role_id;
++ rolename = current->role->rolename;
++ gr_set_acls(1);
++ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLEL_ACL_MSG, rolename, id);
++ }
++
++ write_lock(&grsec_exec_file_lock);
++ exec_file = current->exec_file;
++ current->exec_file = NULL;
++ write_unlock(&grsec_exec_file_lock);
++
++ if (exec_file)
++ fput(exec_file);
++}
++
++int
++gr_acl_handle_procpidmem(const struct task_struct *task)
++{
++ if (unlikely(!gr_acl_is_enabled()))
++ return 0;
++
++ if (task != current && task->acl->mode & GR_PROTPROCFD)
++ return -EACCES;
++
++ return 0;
++}
+diff --git a/grsecurity/gracl_ip.c b/grsecurity/gracl_ip.c
+new file mode 100644
+index 0000000..dd925aa
+--- /dev/null
++++ b/grsecurity/gracl_ip.c
+@@ -0,0 +1,385 @@
++#include <linux/kernel.h>
++#include <asm/uaccess.h>
++#include <asm/errno.h>
++#include <net/sock.h>
++#include <linux/file.h>
++#include <linux/fs.h>
++#include <linux/net.h>
++#include <linux/in.h>
++#include <linux/skbuff.h>
++#include <linux/ip.h>
++#include <linux/udp.h>
++#include <linux/smp_lock.h>
++#include <linux/types.h>
++#include <linux/sched.h>
++#include <linux/netdevice.h>
++#include <linux/inetdevice.h>
++#include <linux/gracl.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++#define GR_BIND 0x01
++#define GR_CONNECT 0x02
++#define GR_INVERT 0x04
++#define GR_BINDOVERRIDE 0x08
++#define GR_CONNECTOVERRIDE 0x10
++#define GR_SOCK_FAMILY 0x20
++
++static const char * gr_protocols[IPPROTO_MAX] = {
++ "ip", "icmp", "igmp", "ggp", "ipencap", "st", "tcp", "cbt",
++ "egp", "igp", "bbn-rcc", "nvp", "pup", "argus", "emcon", "xnet",
++ "chaos", "udp", "mux", "dcn", "hmp", "prm", "xns-idp", "trunk-1",
++ "trunk-2", "leaf-1", "leaf-2", "rdp", "irtp", "iso-tp4", "netblt", "mfe-nsp",
++ "merit-inp", "sep", "3pc", "idpr", "xtp", "ddp", "idpr-cmtp", "tp++",
++ "il", "ipv6", "sdrp", "ipv6-route", "ipv6-frag", "idrp", "rsvp", "gre",
++ "mhrp", "bna", "ipv6-crypt", "ipv6-auth", "i-nlsp", "swipe", "narp", "mobile",
++ "tlsp", "skip", "ipv6-icmp", "ipv6-nonxt", "ipv6-opts", "unknown:61", "cftp", "unknown:63",
++ "sat-expak", "kryptolan", "rvd", "ippc", "unknown:68", "sat-mon", "visa", "ipcv",
++ "cpnx", "cphb", "wsn", "pvp", "br-sat-mon", "sun-nd", "wb-mon", "wb-expak",
++ "iso-ip", "vmtp", "secure-vmtp", "vines", "ttp", "nfsnet-igp", "dgp", "tcf",
++ "eigrp", "ospf", "sprite-rpc", "larp", "mtp", "ax.25", "ipip", "micp",
++ "scc-sp", "etherip", "encap", "unknown:99", "gmtp", "ifmp", "pnni", "pim",
++ "aris", "scps", "qnx", "a/n", "ipcomp", "snp", "compaq-peer", "ipx-in-ip",
++ "vrrp", "pgm", "unknown:114", "l2tp", "ddx", "iatp", "stp", "srp",
++ "uti", "smp", "sm", "ptp", "isis", "fire", "crtp", "crdup",
++ "sscopmce", "iplt", "sps", "pipe", "sctp", "fc", "unkown:134", "unknown:135",
++ "unknown:136", "unknown:137", "unknown:138", "unknown:139", "unknown:140", "unknown:141", "unknown:142", "unknown:143",
++ "unknown:144", "unknown:145", "unknown:146", "unknown:147", "unknown:148", "unknown:149", "unknown:150", "unknown:151",
++ "unknown:152", "unknown:153", "unknown:154", "unknown:155", "unknown:156", "unknown:157", "unknown:158", "unknown:159",
++ "unknown:160", "unknown:161", "unknown:162", "unknown:163", "unknown:164", "unknown:165", "unknown:166", "unknown:167",
++ "unknown:168", "unknown:169", "unknown:170", "unknown:171", "unknown:172", "unknown:173", "unknown:174", "unknown:175",
++ "unknown:176", "unknown:177", "unknown:178", "unknown:179", "unknown:180", "unknown:181", "unknown:182", "unknown:183",
++ "unknown:184", "unknown:185", "unknown:186", "unknown:187", "unknown:188", "unknown:189", "unknown:190", "unknown:191",
++ "unknown:192", "unknown:193", "unknown:194", "unknown:195", "unknown:196", "unknown:197", "unknown:198", "unknown:199",
++ "unknown:200", "unknown:201", "unknown:202", "unknown:203", "unknown:204", "unknown:205", "unknown:206", "unknown:207",
++ "unknown:208", "unknown:209", "unknown:210", "unknown:211", "unknown:212", "unknown:213", "unknown:214", "unknown:215",
++ "unknown:216", "unknown:217", "unknown:218", "unknown:219", "unknown:220", "unknown:221", "unknown:222", "unknown:223",
++ "unknown:224", "unknown:225", "unknown:226", "unknown:227", "unknown:228", "unknown:229", "unknown:230", "unknown:231",
++ "unknown:232", "unknown:233", "unknown:234", "unknown:235", "unknown:236", "unknown:237", "unknown:238", "unknown:239",
++ "unknown:240", "unknown:241", "unknown:242", "unknown:243", "unknown:244", "unknown:245", "unknown:246", "unknown:247",
++ "unknown:248", "unknown:249", "unknown:250", "unknown:251", "unknown:252", "unknown:253", "unknown:254", "unknown:255",
++ };
++
++static const char * gr_socktypes[SOCK_MAX] = {
++ "unknown:0", "stream", "dgram", "raw", "rdm", "seqpacket", "unknown:6",
++ "unknown:7", "unknown:8", "unknown:9", "packet"
++ };
++
++static const char * gr_sockfamilies[AF_MAX+1] = {
++ "unspec", "unix", "inet", "ax25", "ipx", "appletalk", "netrom", "bridge", "atmpvc", "x25",
++ "inet6", "rose", "decnet", "netbeui", "security", "key", "netlink", "packet", "ash",
++ "econet", "atmsvc", "rds", "sna", "irda", "ppox", "wanpipe", "llc", "fam_27", "fam_28",
++ "tipc", "bluetooth", "iucv", "rxrpc", "isdn", "phonet", "ieee802154"
++ };
++
++const char *
++gr_proto_to_name(unsigned char proto)
++{
++ return gr_protocols[proto];
++}
++
++const char *
++gr_socktype_to_name(unsigned char type)
++{
++ return gr_socktypes[type];
++}
++
++const char *
++gr_sockfamily_to_name(unsigned char family)
++{
++ return gr_sockfamilies[family];
++}
++
++int
++gr_search_socket(const int domain, const int type, const int protocol)
++{
++ struct acl_subject_label *curr;
++ const struct cred *cred = current_cred();
++
++ if (unlikely(!gr_acl_is_enabled()))
++ goto exit;
++
++ if ((domain < 0) || (type < 0) || (protocol < 0) ||
++ (domain >= AF_MAX) || (type >= SOCK_MAX) || (protocol >= IPPROTO_MAX))
++ goto exit; // let the kernel handle it
++
++ curr = current->acl;
++
++ if (curr->sock_families[domain / 32] & (1 << (domain % 32))) {
++ /* the family is allowed, if this is PF_INET allow it only if
++ the extra sock type/protocol checks pass */
++ if (domain == PF_INET)
++ goto inet_check;
++ goto exit;
++ } else {
++ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
++ __u32 fakeip = 0;
++ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
++ current->role->roletype, cred->uid,
++ cred->gid, current->exec_file ?
++ gr_to_filename(current->exec_file->f_path.dentry,
++ current->exec_file->f_path.mnt) :
++ curr->filename, curr->filename,
++ &fakeip, domain, 0, 0, GR_SOCK_FAMILY,
++ ¤t->signal->saved_ip);
++ goto exit;
++ }
++ goto exit_fail;
++ }
++
++inet_check:
++ /* the rest of this checking is for IPv4 only */
++ if (!curr->ips)
++ goto exit;
++
++ if ((curr->ip_type & (1 << type)) &&
++ (curr->ip_proto[protocol / 32] & (1 << (protocol % 32))))
++ goto exit;
++
++ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
++ /* we don't place acls on raw sockets , and sometimes
++ dgram/ip sockets are opened for ioctl and not
++ bind/connect, so we'll fake a bind learn log */
++ if (type == SOCK_RAW || type == SOCK_PACKET) {
++ __u32 fakeip = 0;
++ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
++ current->role->roletype, cred->uid,
++ cred->gid, current->exec_file ?
++ gr_to_filename(current->exec_file->f_path.dentry,
++ current->exec_file->f_path.mnt) :
++ curr->filename, curr->filename,
++ &fakeip, 0, type,
++ protocol, GR_CONNECT, ¤t->signal->saved_ip);
++ } else if ((type == SOCK_DGRAM) && (protocol == IPPROTO_IP)) {
++ __u32 fakeip = 0;
++ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
++ current->role->roletype, cred->uid,
++ cred->gid, current->exec_file ?
++ gr_to_filename(current->exec_file->f_path.dentry,
++ current->exec_file->f_path.mnt) :
++ curr->filename, curr->filename,
++ &fakeip, 0, type,
++ protocol, GR_BIND, ¤t->signal->saved_ip);
++ }
++ /* we'll log when they use connect or bind */
++ goto exit;
++ }
++
++exit_fail:
++ if (domain == PF_INET)
++ gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(domain),
++ gr_socktype_to_name(type), gr_proto_to_name(protocol));
++ else
++ gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(domain),
++ gr_socktype_to_name(type), protocol);
++
++ return 0;
++exit:
++ return 1;
++}
++
++int check_ip_policy(struct acl_ip_label *ip, __u32 ip_addr, __u16 ip_port, __u8 protocol, const int mode, const int type, __u32 our_addr, __u32 our_netmask)
++{
++ if ((ip->mode & mode) &&
++ (ip_port >= ip->low) &&
++ (ip_port <= ip->high) &&
++ ((ntohl(ip_addr) & our_netmask) ==
++ (ntohl(our_addr) & our_netmask))
++ && (ip->proto[protocol / 32] & (1 << (protocol % 32)))
++ && (ip->type & (1 << type))) {
++ if (ip->mode & GR_INVERT)
++ return 2; // specifically denied
++ else
++ return 1; // allowed
++ }
++
++ return 0; // not specifically allowed, may continue parsing
++}
++
++static int
++gr_search_connectbind(const int full_mode, struct sock *sk,
++ struct sockaddr_in *addr, const int type)
++{
++ char iface[IFNAMSIZ] = {0};
++ struct acl_subject_label *curr;
++ struct acl_ip_label *ip;
++ struct inet_sock *isk;
++ struct net_device *dev;
++ struct in_device *idev;
++ unsigned long i;
++ int ret;
++ int mode = full_mode & (GR_BIND | GR_CONNECT);
++ __u32 ip_addr = 0;
++ __u32 our_addr;
++ __u32 our_netmask;
++ char *p;
++ __u16 ip_port = 0;
++ const struct cred *cred = current_cred();
++
++ if (unlikely(!gr_acl_is_enabled() || sk->sk_family != PF_INET))
++ return 0;
++
++ curr = current->acl;
++ isk = inet_sk(sk);
++
++ /* INADDR_ANY overriding for binds, inaddr_any_override is already in network order */
++ if ((full_mode & GR_BINDOVERRIDE) && addr->sin_addr.s_addr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0)
++ addr->sin_addr.s_addr = curr->inaddr_any_override;
++ if ((full_mode & GR_CONNECT) && isk->saddr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0) {
++ struct sockaddr_in saddr;
++ int err;
++
++ saddr.sin_family = AF_INET;
++ saddr.sin_addr.s_addr = curr->inaddr_any_override;
++ saddr.sin_port = isk->sport;
++
++ err = security_socket_bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
++ if (err)
++ return err;
++
++ err = sk->sk_socket->ops->bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
++ if (err)
++ return err;
++ }
++
++ if (!curr->ips)
++ return 0;
++
++ ip_addr = addr->sin_addr.s_addr;
++ ip_port = ntohs(addr->sin_port);
++
++ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
++ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
++ current->role->roletype, cred->uid,
++ cred->gid, current->exec_file ?
++ gr_to_filename(current->exec_file->f_path.dentry,
++ current->exec_file->f_path.mnt) :
++ curr->filename, curr->filename,
++ &ip_addr, ip_port, type,
++ sk->sk_protocol, mode, ¤t->signal->saved_ip);
++ return 0;
++ }
++
++ for (i = 0; i < curr->ip_num; i++) {
++ ip = *(curr->ips + i);
++ if (ip->iface != NULL) {
++ strncpy(iface, ip->iface, IFNAMSIZ - 1);
++ p = strchr(iface, ':');
++ if (p != NULL)
++ *p = '\0';
++ dev = dev_get_by_name(sock_net(sk), iface);
++ if (dev == NULL)
++ continue;
++ idev = in_dev_get(dev);
++ if (idev == NULL) {
++ dev_put(dev);
++ continue;
++ }
++ rcu_read_lock();
++ for_ifa(idev) {
++ if (!strcmp(ip->iface, ifa->ifa_label)) {
++ our_addr = ifa->ifa_address;
++ our_netmask = 0xffffffff;
++ ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
++ if (ret == 1) {
++ rcu_read_unlock();
++ in_dev_put(idev);
++ dev_put(dev);
++ return 0;
++ } else if (ret == 2) {
++ rcu_read_unlock();
++ in_dev_put(idev);
++ dev_put(dev);
++ goto denied;
++ }
++ }
++ } endfor_ifa(idev);
++ rcu_read_unlock();
++ in_dev_put(idev);
++ dev_put(dev);
++ } else {
++ our_addr = ip->addr;
++ our_netmask = ip->netmask;
++ ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
++ if (ret == 1)
++ return 0;
++ else if (ret == 2)
++ goto denied;
++ }
++ }
++
++denied:
++ if (mode == GR_BIND)
++ gr_log_int5_str2(GR_DONT_AUDIT, GR_BIND_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
++ else if (mode == GR_CONNECT)
++ gr_log_int5_str2(GR_DONT_AUDIT, GR_CONNECT_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
++
++ return -EACCES;
++}
++
++int
++gr_search_connect(struct socket *sock, struct sockaddr_in *addr)
++{
++ /* always allow disconnection of dgram sockets with connect */
++ if (addr->sin_family == AF_UNSPEC)
++ return 0;
++ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sock->sk, addr, sock->type);
++}
++
++int
++gr_search_bind(struct socket *sock, struct sockaddr_in *addr)
++{
++ return gr_search_connectbind(GR_BIND | GR_BINDOVERRIDE, sock->sk, addr, sock->type);
++}
++
++int gr_search_listen(struct socket *sock)
++{
++ struct sock *sk = sock->sk;
++ struct sockaddr_in addr;
++
++ addr.sin_addr.s_addr = inet_sk(sk)->saddr;
++ addr.sin_port = inet_sk(sk)->sport;
++
++ return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
++}
++
++int gr_search_accept(struct socket *sock)
++{
++ struct sock *sk = sock->sk;
++ struct sockaddr_in addr;
++
++ addr.sin_addr.s_addr = inet_sk(sk)->saddr;
++ addr.sin_port = inet_sk(sk)->sport;
++
++ return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
++}
++
++int
++gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr)
++{
++ if (addr)
++ return gr_search_connectbind(GR_CONNECT, sk, addr, SOCK_DGRAM);
++ else {
++ struct sockaddr_in sin;
++ const struct inet_sock *inet = inet_sk(sk);
++
++ sin.sin_addr.s_addr = inet->daddr;
++ sin.sin_port = inet->dport;
++
++ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
++ }
++}
++
++int
++gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb)
++{
++ struct sockaddr_in sin;
++
++ if (unlikely(skb->len < sizeof (struct udphdr)))
++ return 0; // skip this packet
++
++ sin.sin_addr.s_addr = ip_hdr(skb)->saddr;
++ sin.sin_port = udp_hdr(skb)->source;
++
++ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
++}
+diff --git a/grsecurity/gracl_learn.c b/grsecurity/gracl_learn.c
+new file mode 100644
+index 0000000..34bdd46
+--- /dev/null
++++ b/grsecurity/gracl_learn.c
+@@ -0,0 +1,208 @@
++#include <linux/kernel.h>
++#include <linux/mm.h>
++#include <linux/sched.h>
++#include <linux/poll.h>
++#include <linux/smp_lock.h>
++#include <linux/string.h>
++#include <linux/file.h>
++#include <linux/types.h>
++#include <linux/vmalloc.h>
++#include <linux/grinternal.h>
++
++extern ssize_t write_grsec_handler(struct file * file, const char __user * buf,
++ size_t count, loff_t *ppos);
++extern int gr_acl_is_enabled(void);
++
++static DECLARE_WAIT_QUEUE_HEAD(learn_wait);
++static int gr_learn_attached;
++
++/* use a 512k buffer */
++#define LEARN_BUFFER_SIZE (512 * 1024)
++
++static DEFINE_SPINLOCK(gr_learn_lock);
++static DEFINE_MUTEX(gr_learn_user_mutex);
++
++/* we need to maintain two buffers, so that the kernel context of grlearn
++ uses a semaphore around the userspace copying, and the other kernel contexts
++ use a spinlock when copying into the buffer, since they cannot sleep
++*/
++static char *learn_buffer;
++static char *learn_buffer_user;
++static int learn_buffer_len;
++static int learn_buffer_user_len;
++
++static ssize_t
++read_learn(struct file *file, char __user * buf, size_t count, loff_t * ppos)
++{
++ DECLARE_WAITQUEUE(wait, current);
++ ssize_t retval = 0;
++
++ add_wait_queue(&learn_wait, &wait);
++ set_current_state(TASK_INTERRUPTIBLE);
++ do {
++ mutex_lock(&gr_learn_user_mutex);
++ spin_lock(&gr_learn_lock);
++ if (learn_buffer_len)
++ break;
++ spin_unlock(&gr_learn_lock);
++ mutex_unlock(&gr_learn_user_mutex);
++ if (file->f_flags & O_NONBLOCK) {
++ retval = -EAGAIN;
++ goto out;
++ }
++ if (signal_pending(current)) {
++ retval = -ERESTARTSYS;
++ goto out;
++ }
++
++ schedule();
++ } while (1);
++
++ memcpy(learn_buffer_user, learn_buffer, learn_buffer_len);
++ learn_buffer_user_len = learn_buffer_len;
++ retval = learn_buffer_len;
++ learn_buffer_len = 0;
++
++ spin_unlock(&gr_learn_lock);
++
++ if (copy_to_user(buf, learn_buffer_user, learn_buffer_user_len))
++ retval = -EFAULT;
++
++ mutex_unlock(&gr_learn_user_mutex);
++out:
++ set_current_state(TASK_RUNNING);
++ remove_wait_queue(&learn_wait, &wait);
++ return retval;
++}
++
++static unsigned int
++poll_learn(struct file * file, poll_table * wait)
++{
++ poll_wait(file, &learn_wait, wait);
++
++ if (learn_buffer_len)
++ return (POLLIN | POLLRDNORM);
++
++ return 0;
++}
++
++void
++gr_clear_learn_entries(void)
++{
++ char *tmp;
++
++ mutex_lock(&gr_learn_user_mutex);
++ spin_lock(&gr_learn_lock);
++ tmp = learn_buffer;
++ learn_buffer = NULL;
++ spin_unlock(&gr_learn_lock);
++ if (tmp)
++ vfree(tmp);
++ if (learn_buffer_user != NULL) {
++ vfree(learn_buffer_user);
++ learn_buffer_user = NULL;
++ }
++ learn_buffer_len = 0;
++ mutex_unlock(&gr_learn_user_mutex);
++
++ return;
++}
++
++void
++gr_add_learn_entry(const char *fmt, ...)
++{
++ va_list args;
++ unsigned int len;
++
++ if (!gr_learn_attached)
++ return;
++
++ spin_lock(&gr_learn_lock);
++
++ /* leave a gap at the end so we know when it's "full" but don't have to
++ compute the exact length of the string we're trying to append
++ */
++ if (learn_buffer_len > LEARN_BUFFER_SIZE - 16384) {
++ spin_unlock(&gr_learn_lock);
++ wake_up_interruptible(&learn_wait);
++ return;
++ }
++ if (learn_buffer == NULL) {
++ spin_unlock(&gr_learn_lock);
++ return;
++ }
++
++ va_start(args, fmt);
++ len = vsnprintf(learn_buffer + learn_buffer_len, LEARN_BUFFER_SIZE - learn_buffer_len, fmt, args);
++ va_end(args);
++
++ learn_buffer_len += len + 1;
++
++ spin_unlock(&gr_learn_lock);
++ wake_up_interruptible(&learn_wait);
++
++ return;
++}
++
++static int
++open_learn(struct inode *inode, struct file *file)
++{
++ if (file->f_mode & FMODE_READ && gr_learn_attached)
++ return -EBUSY;
++ if (file->f_mode & FMODE_READ) {
++ int retval = 0;
++ mutex_lock(&gr_learn_user_mutex);
++ if (learn_buffer == NULL)
++ learn_buffer = vmalloc(LEARN_BUFFER_SIZE);
++ if (learn_buffer_user == NULL)
++ learn_buffer_user = vmalloc(LEARN_BUFFER_SIZE);
++ if (learn_buffer == NULL) {
++ retval = -ENOMEM;
++ goto out_error;
++ }
++ if (learn_buffer_user == NULL) {
++ retval = -ENOMEM;
++ goto out_error;
++ }
++ learn_buffer_len = 0;
++ learn_buffer_user_len = 0;
++ gr_learn_attached = 1;
++out_error:
++ mutex_unlock(&gr_learn_user_mutex);
++ return retval;
++ }
++ return 0;
++}
++
++static int
++close_learn(struct inode *inode, struct file *file)
++{
++ if (file->f_mode & FMODE_READ) {
++ char *tmp = NULL;
++ mutex_lock(&gr_learn_user_mutex);
++ spin_lock(&gr_learn_lock);
++ tmp = learn_buffer;
++ learn_buffer = NULL;
++ spin_unlock(&gr_learn_lock);
++ if (tmp)
++ vfree(tmp);
++ if (learn_buffer_user != NULL) {
++ vfree(learn_buffer_user);
++ learn_buffer_user = NULL;
++ }
++ learn_buffer_len = 0;
++ learn_buffer_user_len = 0;
++ gr_learn_attached = 0;
++ mutex_unlock(&gr_learn_user_mutex);
++ }
++
++ return 0;
++}
++
++const struct file_operations grsec_fops = {
++ .read = read_learn,
++ .write = write_grsec_handler,
++ .open = open_learn,
++ .release = close_learn,
++ .poll = poll_learn,
++};
+diff --git a/grsecurity/gracl_res.c b/grsecurity/gracl_res.c
+new file mode 100644
+index 0000000..70b2179
+--- /dev/null
++++ b/grsecurity/gracl_res.c
+@@ -0,0 +1,67 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/gracl.h>
++#include <linux/grinternal.h>
++
++static const char *restab_log[] = {
++ [RLIMIT_CPU] = "RLIMIT_CPU",
++ [RLIMIT_FSIZE] = "RLIMIT_FSIZE",
++ [RLIMIT_DATA] = "RLIMIT_DATA",
++ [RLIMIT_STACK] = "RLIMIT_STACK",
++ [RLIMIT_CORE] = "RLIMIT_CORE",
++ [RLIMIT_RSS] = "RLIMIT_RSS",
++ [RLIMIT_NPROC] = "RLIMIT_NPROC",
++ [RLIMIT_NOFILE] = "RLIMIT_NOFILE",
++ [RLIMIT_MEMLOCK] = "RLIMIT_MEMLOCK",
++ [RLIMIT_AS] = "RLIMIT_AS",
++ [RLIMIT_LOCKS] = "RLIMIT_LOCKS",
++ [RLIMIT_SIGPENDING] = "RLIMIT_SIGPENDING",
++ [RLIMIT_MSGQUEUE] = "RLIMIT_MSGQUEUE",
++ [RLIMIT_NICE] = "RLIMIT_NICE",
++ [RLIMIT_RTPRIO] = "RLIMIT_RTPRIO",
++ [RLIMIT_RTTIME] = "RLIMIT_RTTIME",
++ [GR_CRASH_RES] = "RLIMIT_CRASH"
++};
++
++void
++gr_log_resource(const struct task_struct *task,
++ const int res, const unsigned long wanted, const int gt)
++{
++ const struct cred *cred;
++ unsigned long rlim;
++
++ if (!gr_acl_is_enabled() && !grsec_resource_logging)
++ return;
++
++ // not yet supported resource
++ if (unlikely(!restab_log[res]))
++ return;
++
++ if (res == RLIMIT_CPU || res == RLIMIT_RTTIME)
++ rlim = task->signal->rlim[res].rlim_max;
++ else
++ rlim = task->signal->rlim[res].rlim_cur;
++ if (likely((rlim == RLIM_INFINITY) || (gt && wanted <= rlim) || (!gt && wanted < rlim)))
++ return;
++
++ rcu_read_lock();
++ cred = __task_cred(task);
++
++ if (res == RLIMIT_NPROC &&
++ (cap_raised(cred->cap_effective, CAP_SYS_ADMIN) ||
++ cap_raised(cred->cap_effective, CAP_SYS_RESOURCE)))
++ goto out_rcu_unlock;
++ else if (res == RLIMIT_MEMLOCK &&
++ cap_raised(cred->cap_effective, CAP_IPC_LOCK))
++ goto out_rcu_unlock;
++ else if (res == RLIMIT_NICE && cap_raised(cred->cap_effective, CAP_SYS_NICE))
++ goto out_rcu_unlock;
++ rcu_read_unlock();
++
++ gr_log_res_ulong2_str(GR_DONT_AUDIT, GR_RESOURCE_MSG, task, wanted, restab_log[res], rlim);
++
++ return;
++out_rcu_unlock:
++ rcu_read_unlock();
++ return;
++}
+diff --git a/grsecurity/gracl_segv.c b/grsecurity/gracl_segv.c
+new file mode 100644
+index 0000000..1d1b734
+--- /dev/null
++++ b/grsecurity/gracl_segv.c
+@@ -0,0 +1,284 @@
++#include <linux/kernel.h>
++#include <linux/mm.h>
++#include <asm/uaccess.h>
++#include <asm/errno.h>
++#include <asm/mman.h>
++#include <net/sock.h>
++#include <linux/file.h>
++#include <linux/fs.h>
++#include <linux/net.h>
++#include <linux/in.h>
++#include <linux/smp_lock.h>
++#include <linux/slab.h>
++#include <linux/types.h>
++#include <linux/sched.h>
++#include <linux/timer.h>
++#include <linux/gracl.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++static struct crash_uid *uid_set;
++static unsigned short uid_used;
++static DEFINE_SPINLOCK(gr_uid_lock);
++extern rwlock_t gr_inode_lock;
++extern struct acl_subject_label *
++ lookup_acl_subj_label(const ino_t inode, const dev_t dev,
++ struct acl_role_label *role);
++extern int gr_fake_force_sig(int sig, struct task_struct *t);
++
++int
++gr_init_uidset(void)
++{
++ uid_set =
++ kmalloc(GR_UIDTABLE_MAX * sizeof (struct crash_uid), GFP_KERNEL);
++ uid_used = 0;
++
++ return uid_set ? 1 : 0;
++}
++
++void
++gr_free_uidset(void)
++{
++ if (uid_set)
++ kfree(uid_set);
++
++ return;
++}
++
++int
++gr_find_uid(const uid_t uid)
++{
++ struct crash_uid *tmp = uid_set;
++ uid_t buid;
++ int low = 0, high = uid_used - 1, mid;
++
++ while (high >= low) {
++ mid = (low + high) >> 1;
++ buid = tmp[mid].uid;
++ if (buid == uid)
++ return mid;
++ if (buid > uid)
++ high = mid - 1;
++ if (buid < uid)
++ low = mid + 1;
++ }
++
++ return -1;
++}
++
++static __inline__ void
++gr_insertsort(void)
++{
++ unsigned short i, j;
++ struct crash_uid index;
++
++ for (i = 1; i < uid_used; i++) {
++ index = uid_set[i];
++ j = i;
++ while ((j > 0) && uid_set[j - 1].uid > index.uid) {
++ uid_set[j] = uid_set[j - 1];
++ j--;
++ }
++ uid_set[j] = index;
++ }
++
++ return;
++}
++
++static __inline__ void
++gr_insert_uid(const uid_t uid, const unsigned long expires)
++{
++ int loc;
++
++ if (uid_used == GR_UIDTABLE_MAX)
++ return;
++
++ loc = gr_find_uid(uid);
++
++ if (loc >= 0) {
++ uid_set[loc].expires = expires;
++ return;
++ }
++
++ uid_set[uid_used].uid = uid;
++ uid_set[uid_used].expires = expires;
++ uid_used++;
++
++ gr_insertsort();
++
++ return;
++}
++
++void
++gr_remove_uid(const unsigned short loc)
++{
++ unsigned short i;
++
++ for (i = loc + 1; i < uid_used; i++)
++ uid_set[i - 1] = uid_set[i];
++
++ uid_used--;
++
++ return;
++}
++
++int
++gr_check_crash_uid(const uid_t uid)
++{
++ int loc;
++ int ret = 0;
++
++ if (unlikely(!gr_acl_is_enabled()))
++ return 0;
++
++ spin_lock(&gr_uid_lock);
++ loc = gr_find_uid(uid);
++
++ if (loc < 0)
++ goto out_unlock;
++
++ if (time_before_eq(uid_set[loc].expires, get_seconds()))
++ gr_remove_uid(loc);
++ else
++ ret = 1;
++
++out_unlock:
++ spin_unlock(&gr_uid_lock);
++ return ret;
++}
++
++static __inline__ int
++proc_is_setxid(const struct cred *cred)
++{
++ if (cred->uid != cred->euid || cred->uid != cred->suid ||
++ cred->uid != cred->fsuid)
++ return 1;
++ if (cred->gid != cred->egid || cred->gid != cred->sgid ||
++ cred->gid != cred->fsgid)
++ return 1;
++
++ return 0;
++}
++
++void
++gr_handle_crash(struct task_struct *task, const int sig)
++{
++ struct acl_subject_label *curr;
++ struct task_struct *tsk, *tsk2;
++ const struct cred *cred;
++ const struct cred *cred2;
++
++ if (sig != SIGSEGV && sig != SIGKILL && sig != SIGBUS && sig != SIGILL)
++ return;
++
++ if (unlikely(!gr_acl_is_enabled()))
++ return;
++
++ curr = task->acl;
++
++ if (!(curr->resmask & (1 << GR_CRASH_RES)))
++ return;
++
++ if (time_before_eq(curr->expires, get_seconds())) {
++ curr->expires = 0;
++ curr->crashes = 0;
++ }
++
++ curr->crashes++;
++
++ if (!curr->expires)
++ curr->expires = get_seconds() + curr->res[GR_CRASH_RES].rlim_max;
++
++ if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
++ time_after(curr->expires, get_seconds())) {
++ rcu_read_lock();
++ cred = __task_cred(task);
++ if (cred->uid && proc_is_setxid(cred)) {
++ gr_log_crash1(GR_DONT_AUDIT, GR_SEGVSTART_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
++ spin_lock(&gr_uid_lock);
++ gr_insert_uid(cred->uid, curr->expires);
++ spin_unlock(&gr_uid_lock);
++ curr->expires = 0;
++ curr->crashes = 0;
++ read_lock(&tasklist_lock);
++ do_each_thread(tsk2, tsk) {
++ cred2 = __task_cred(tsk);
++ if (tsk != task && cred2->uid == cred->uid)
++ gr_fake_force_sig(SIGKILL, tsk);
++ } while_each_thread(tsk2, tsk);
++ read_unlock(&tasklist_lock);
++ } else {
++ gr_log_crash2(GR_DONT_AUDIT, GR_SEGVNOSUID_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
++ read_lock(&tasklist_lock);
++ read_lock(&grsec_exec_file_lock);
++ do_each_thread(tsk2, tsk) {
++ if (likely(tsk != task)) {
++ // if this thread has the same subject as the one that triggered
++ // RES_CRASH and it's the same binary, kill it
++ if (tsk->acl == task->acl && tsk->exec_file == task->exec_file)
++ gr_fake_force_sig(SIGKILL, tsk);
++ }
++ } while_each_thread(tsk2, tsk);
++ read_unlock(&grsec_exec_file_lock);
++ read_unlock(&tasklist_lock);
++ }
++ rcu_read_unlock();
++ }
++
++ return;
++}
++
++int
++gr_check_crash_exec(const struct file *filp)
++{
++ struct acl_subject_label *curr;
++
++ if (unlikely(!gr_acl_is_enabled()))
++ return 0;
++
++ read_lock(&gr_inode_lock);
++ curr = lookup_acl_subj_label(filp->f_path.dentry->d_inode->i_ino,
++ filp->f_path.dentry->d_inode->i_sb->s_dev,
++ current->role);
++ read_unlock(&gr_inode_lock);
++
++ if (!curr || !(curr->resmask & (1 << GR_CRASH_RES)) ||
++ (!curr->crashes && !curr->expires))
++ return 0;
++
++ if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
++ time_after(curr->expires, get_seconds()))
++ return 1;
++ else if (time_before_eq(curr->expires, get_seconds())) {
++ curr->crashes = 0;
++ curr->expires = 0;
++ }
++
++ return 0;
++}
++
++void
++gr_handle_alertkill(struct task_struct *task)
++{
++ struct acl_subject_label *curracl;
++ __u32 curr_ip;
++ struct task_struct *p, *p2;
++
++ if (unlikely(!gr_acl_is_enabled()))
++ return;
++
++ curracl = task->acl;
++ curr_ip = task->signal->curr_ip;
++
++ if ((curracl->mode & GR_KILLIPPROC) && curr_ip) {
++ read_lock(&tasklist_lock);
++ do_each_thread(p2, p) {
++ if (p->signal->curr_ip == curr_ip)
++ gr_fake_force_sig(SIGKILL, p);
++ } while_each_thread(p2, p);
++ read_unlock(&tasklist_lock);
++ } else if (curracl->mode & GR_KILLPROC)
++ gr_fake_force_sig(SIGKILL, task);
++
++ return;
++}
+diff --git a/grsecurity/gracl_shm.c b/grsecurity/gracl_shm.c
+new file mode 100644
+index 0000000..9d83a69
+--- /dev/null
++++ b/grsecurity/gracl_shm.c
+@@ -0,0 +1,40 @@
++#include <linux/kernel.h>
++#include <linux/mm.h>
++#include <linux/sched.h>
++#include <linux/file.h>
++#include <linux/ipc.h>
++#include <linux/gracl.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++int
++gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
++ const time_t shm_createtime, const uid_t cuid, const int shmid)
++{
++ struct task_struct *task;
++
++ if (!gr_acl_is_enabled())
++ return 1;
++
++ rcu_read_lock();
++ read_lock(&tasklist_lock);
++
++ task = find_task_by_vpid(shm_cprid);
++
++ if (unlikely(!task))
++ task = find_task_by_vpid(shm_lapid);
++
++ if (unlikely(task && (time_before_eq((unsigned long)task->start_time.tv_sec, (unsigned long)shm_createtime) ||
++ (task->pid == shm_lapid)) &&
++ (task->acl->mode & GR_PROTSHM) &&
++ (task->acl != current->acl))) {
++ read_unlock(&tasklist_lock);
++ rcu_read_unlock();
++ gr_log_int3(GR_DONT_AUDIT, GR_SHMAT_ACL_MSG, cuid, shm_cprid, shmid);
++ return 0;
++ }
++ read_unlock(&tasklist_lock);
++ rcu_read_unlock();
++
++ return 1;
++}
+diff --git a/grsecurity/grsec_chdir.c b/grsecurity/grsec_chdir.c
+new file mode 100644
+index 0000000..bc0be01
+--- /dev/null
++++ b/grsecurity/grsec_chdir.c
+@@ -0,0 +1,19 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/fs.h>
++#include <linux/file.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++void
++gr_log_chdir(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
++ if ((grsec_enable_chdir && grsec_enable_group &&
++ in_group_p(grsec_audit_gid)) || (grsec_enable_chdir &&
++ !grsec_enable_group)) {
++ gr_log_fs_generic(GR_DO_AUDIT, GR_CHDIR_AUDIT_MSG, dentry, mnt);
++ }
++#endif
++ return;
++}
+diff --git a/grsecurity/grsec_chroot.c b/grsecurity/grsec_chroot.c
+new file mode 100644
+index 0000000..197bdd5
+--- /dev/null
++++ b/grsecurity/grsec_chroot.c
+@@ -0,0 +1,386 @@
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/sched.h>
++#include <linux/file.h>
++#include <linux/fs.h>
++#include <linux/mount.h>
++#include <linux/types.h>
++#include <linux/pid_namespace.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++void gr_set_chroot_entries(struct task_struct *task, struct path *path)
++{
++#ifdef CONFIG_GRKERNSEC
++ if (task->pid > 1 && path->dentry != init_task.fs->root.dentry &&
++ path->dentry != task->nsproxy->mnt_ns->root->mnt_root)
++ task->gr_is_chrooted = 1;
++ else
++ task->gr_is_chrooted = 0;
++
++ task->gr_chroot_dentry = path->dentry;
++#endif
++ return;
++}
++
++void gr_clear_chroot_entries(struct task_struct *task)
++{
++#ifdef CONFIG_GRKERNSEC
++ task->gr_is_chrooted = 0;
++ task->gr_chroot_dentry = NULL;
++#endif
++ return;
++}
++
++int
++gr_handle_chroot_unix(const pid_t pid)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
++ struct task_struct *p;
++
++ if (unlikely(!grsec_enable_chroot_unix))
++ return 1;
++
++ if (likely(!proc_is_chrooted(current)))
++ return 1;
++
++ rcu_read_lock();
++ read_lock(&tasklist_lock);
++
++ p = find_task_by_vpid_unrestricted(pid);
++ if (unlikely(p && !have_same_root(current, p))) {
++ read_unlock(&tasklist_lock);
++ rcu_read_unlock();
++ gr_log_noargs(GR_DONT_AUDIT, GR_UNIX_CHROOT_MSG);
++ return 0;
++ }
++ read_unlock(&tasklist_lock);
++ rcu_read_unlock();
++#endif
++ return 1;
++}
++
++int
++gr_handle_chroot_nice(void)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
++ if (grsec_enable_chroot_nice && proc_is_chrooted(current)) {
++ gr_log_noargs(GR_DONT_AUDIT, GR_NICE_CHROOT_MSG);
++ return -EPERM;
++ }
++#endif
++ return 0;
++}
++
++int
++gr_handle_chroot_setpriority(struct task_struct *p, const int niceval)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
++ if (grsec_enable_chroot_nice && (niceval < task_nice(p))
++ && proc_is_chrooted(current)) {
++ gr_log_str_int(GR_DONT_AUDIT, GR_PRIORITY_CHROOT_MSG, p->comm, p->pid);
++ return -EACCES;
++ }
++#endif
++ return 0;
++}
++
++int
++gr_handle_chroot_rawio(const struct inode *inode)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
++ if (grsec_enable_chroot_caps && proc_is_chrooted(current) &&
++ inode && S_ISBLK(inode->i_mode) && !capable(CAP_SYS_RAWIO))
++ return 1;
++#endif
++ return 0;
++}
++
++int
++gr_handle_chroot_fowner(struct pid *pid, enum pid_type type)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
++ struct task_struct *p;
++ int ret = 0;
++ if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || !pid)
++ return ret;
++
++ read_lock(&tasklist_lock);
++ do_each_pid_task(pid, type, p) {
++ if (!have_same_root(current, p)) {
++ ret = 1;
++ goto out;
++ }
++ } while_each_pid_task(pid, type, p);
++out:
++ read_unlock(&tasklist_lock);
++ return ret;
++#endif
++ return 0;
++}
++
++int
++gr_pid_is_chrooted(struct task_struct *p)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
++ if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || p == NULL)
++ return 0;
++
++ if ((p->exit_state & (EXIT_ZOMBIE | EXIT_DEAD)) ||
++ !have_same_root(current, p)) {
++ return 1;
++ }
++#endif
++ return 0;
++}
++
++EXPORT_SYMBOL(gr_pid_is_chrooted);
++
++#if defined(CONFIG_GRKERNSEC_CHROOT_DOUBLE) || defined(CONFIG_GRKERNSEC_CHROOT_FCHDIR)
++int gr_is_outside_chroot(const struct dentry *u_dentry, const struct vfsmount *u_mnt)
++{
++ struct dentry *dentry = (struct dentry *)u_dentry;
++ struct vfsmount *mnt = (struct vfsmount *)u_mnt;
++ struct dentry *realroot;
++ struct vfsmount *realrootmnt;
++ struct dentry *currentroot;
++ struct vfsmount *currentmnt;
++ struct task_struct *reaper = &init_task;
++ int ret = 1;
++
++ read_lock(&reaper->fs->lock);
++ realrootmnt = mntget(reaper->fs->root.mnt);
++ realroot = dget(reaper->fs->root.dentry);
++ read_unlock(&reaper->fs->lock);
++
++ read_lock(¤t->fs->lock);
++ currentmnt = mntget(current->fs->root.mnt);
++ currentroot = dget(current->fs->root.dentry);
++ read_unlock(¤t->fs->lock);
++
++ spin_lock(&dcache_lock);
++ for (;;) {
++ if (unlikely((dentry == realroot && mnt == realrootmnt)
++ || (dentry == currentroot && mnt == currentmnt)))
++ break;
++ if (unlikely(dentry == mnt->mnt_root || IS_ROOT(dentry))) {
++ if (mnt->mnt_parent == mnt)
++ break;
++ dentry = mnt->mnt_mountpoint;
++ mnt = mnt->mnt_parent;
++ continue;
++ }
++ dentry = dentry->d_parent;
++ }
++ spin_unlock(&dcache_lock);
++
++ dput(currentroot);
++ mntput(currentmnt);
++
++ /* access is outside of chroot */
++ if (dentry == realroot && mnt == realrootmnt)
++ ret = 0;
++
++ dput(realroot);
++ mntput(realrootmnt);
++ return ret;
++}
++#endif
++
++int
++gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
++ if (!grsec_enable_chroot_fchdir)
++ return 1;
++
++ if (!proc_is_chrooted(current))
++ return 1;
++ else if (!gr_is_outside_chroot(u_dentry, u_mnt)) {
++ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_FCHDIR_MSG, u_dentry, u_mnt);
++ return 0;
++ }
++#endif
++ return 1;
++}
++
++int
++gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
++ const time_t shm_createtime)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
++ struct task_struct *p;
++ time_t starttime;
++
++ if (unlikely(!grsec_enable_chroot_shmat))
++ return 1;
++
++ if (likely(!proc_is_chrooted(current)))
++ return 1;
++
++ rcu_read_lock();
++ read_lock(&tasklist_lock);
++
++ if ((p = find_task_by_vpid_unrestricted(shm_cprid))) {
++ starttime = p->start_time.tv_sec;
++ if (time_before_eq((unsigned long)starttime, (unsigned long)shm_createtime)) {
++ if (have_same_root(current, p)) {
++ goto allow;
++ } else {
++ read_unlock(&tasklist_lock);
++ rcu_read_unlock();
++ gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
++ return 0;
++ }
++ }
++ /* creator exited, pid reuse, fall through to next check */
++ }
++ if ((p = find_task_by_vpid_unrestricted(shm_lapid))) {
++ if (unlikely(!have_same_root(current, p))) {
++ read_unlock(&tasklist_lock);
++ rcu_read_unlock();
++ gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
++ return 0;
++ }
++ }
++
++allow:
++ read_unlock(&tasklist_lock);
++ rcu_read_unlock();
++#endif
++ return 1;
++}
++
++void
++gr_log_chroot_exec(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
++ if (grsec_enable_chroot_execlog && proc_is_chrooted(current))
++ gr_log_fs_generic(GR_DO_AUDIT, GR_EXEC_CHROOT_MSG, dentry, mnt);
++#endif
++ return;
++}
++
++int
++gr_handle_chroot_mknod(const struct dentry *dentry,
++ const struct vfsmount *mnt, const int mode)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
++ if (grsec_enable_chroot_mknod && !S_ISFIFO(mode) && !S_ISREG(mode) &&
++ proc_is_chrooted(current)) {
++ gr_log_fs_generic(GR_DONT_AUDIT, GR_MKNOD_CHROOT_MSG, dentry, mnt);
++ return -EPERM;
++ }
++#endif
++ return 0;
++}
++
++int
++gr_handle_chroot_mount(const struct dentry *dentry,
++ const struct vfsmount *mnt, const char *dev_name)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
++ if (grsec_enable_chroot_mount && proc_is_chrooted(current)) {
++ gr_log_str_fs(GR_DONT_AUDIT, GR_MOUNT_CHROOT_MSG, dev_name ? dev_name : "none" , dentry, mnt);
++ return -EPERM;
++ }
++#endif
++ return 0;
++}
++
++int
++gr_handle_chroot_pivot(void)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
++ if (grsec_enable_chroot_pivot && proc_is_chrooted(current)) {
++ gr_log_noargs(GR_DONT_AUDIT, GR_PIVOT_CHROOT_MSG);
++ return -EPERM;
++ }
++#endif
++ return 0;
++}
++
++int
++gr_handle_chroot_chroot(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
++ if (grsec_enable_chroot_double && proc_is_chrooted(current) &&
++ !gr_is_outside_chroot(dentry, mnt)) {
++ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_CHROOT_MSG, dentry, mnt);
++ return -EPERM;
++ }
++#endif
++ return 0;
++}
++
++extern const char *captab_log[];
++extern int captab_log_entries;
++
++int
++gr_chroot_is_capable(const int cap)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
++ if (grsec_enable_chroot_caps && proc_is_chrooted(current)) {
++ kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
++ if (cap_raised(chroot_caps, cap)) {
++ const struct cred *creds = current_cred();
++ if (cap_raised(creds->cap_effective, cap) && cap < captab_log_entries) {
++ gr_log_cap(GR_DONT_AUDIT, GR_CAP_CHROOT_MSG, current, captab_log[cap]);
++ }
++ return 0;
++ }
++ }
++#endif
++ return 1;
++}
++
++int
++gr_chroot_is_capable_nolog(const int cap)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
++ if (grsec_enable_chroot_caps && proc_is_chrooted(current)) {
++ kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
++ if (cap_raised(chroot_caps, cap)) {
++ return 0;
++ }
++ }
++#endif
++ return 1;
++}
++
++int
++gr_handle_chroot_sysctl(const int op)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
++ if (grsec_enable_chroot_sysctl && proc_is_chrooted(current)
++ && (op & MAY_WRITE))
++ return -EACCES;
++#endif
++ return 0;
++}
++
++void
++gr_handle_chroot_chdir(struct path *path)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
++ if (grsec_enable_chroot_chdir)
++ set_fs_pwd(current->fs, path);
++#endif
++ return;
++}
++
++int
++gr_handle_chroot_chmod(const struct dentry *dentry,
++ const struct vfsmount *mnt, const int mode)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
++ /* allow chmod +s on directories, but not on files */
++ if (grsec_enable_chroot_chmod && !S_ISDIR(dentry->d_inode->i_mode) &&
++ ((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))) &&
++ proc_is_chrooted(current)) {
++ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHMOD_CHROOT_MSG, dentry, mnt);
++ return -EPERM;
++ }
++#endif
++ return 0;
++}
+diff --git a/grsecurity/grsec_disabled.c b/grsecurity/grsec_disabled.c
+new file mode 100644
+index 0000000..40545bf
+--- /dev/null
++++ b/grsecurity/grsec_disabled.c
+@@ -0,0 +1,437 @@
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/sched.h>
++#include <linux/file.h>
++#include <linux/fs.h>
++#include <linux/kdev_t.h>
++#include <linux/net.h>
++#include <linux/in.h>
++#include <linux/ip.h>
++#include <linux/skbuff.h>
++#include <linux/sysctl.h>
++
++#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
++void
++pax_set_initial_flags(struct linux_binprm *bprm)
++{
++ return;
++}
++#endif
++
++#ifdef CONFIG_SYSCTL
++__u32
++gr_handle_sysctl(const struct ctl_table * table, const int op)
++{
++ return 0;
++}
++#endif
++
++#ifdef CONFIG_TASKSTATS
++int gr_is_taskstats_denied(int pid)
++{
++ return 0;
++}
++#endif
++
++int
++gr_acl_is_enabled(void)
++{
++ return 0;
++}
++
++void
++gr_handle_proc_create(const struct dentry *dentry, const struct inode *inode)
++{
++ return;
++}
++
++int
++gr_handle_rawio(const struct inode *inode)
++{
++ return 0;
++}
++
++void
++gr_acl_handle_psacct(struct task_struct *task, const long code)
++{
++ return;
++}
++
++int
++gr_handle_ptrace(struct task_struct *task, const long request)
++{
++ return 0;
++}
++
++int
++gr_handle_proc_ptrace(struct task_struct *task)
++{
++ return 0;
++}
++
++void
++gr_learn_resource(const struct task_struct *task,
++ const int res, const unsigned long wanted, const int gt)
++{
++ return;
++}
++
++int
++gr_set_acls(const int type)
++{
++ return 0;
++}
++
++int
++gr_check_hidden_task(const struct task_struct *tsk)
++{
++ return 0;
++}
++
++int
++gr_check_protected_task(const struct task_struct *task)
++{
++ return 0;
++}
++
++int
++gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
++{
++ return 0;
++}
++
++void
++gr_copy_label(struct task_struct *tsk)
++{
++ return;
++}
++
++void
++gr_set_pax_flags(struct task_struct *task)
++{
++ return;
++}
++
++int
++gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
++ const int unsafe_share)
++{
++ return 0;
++}
++
++void
++gr_handle_delete(const ino_t ino, const dev_t dev)
++{
++ return;
++}
++
++void
++gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++ return;
++}
++
++void
++gr_handle_crash(struct task_struct *task, const int sig)
++{
++ return;
++}
++
++int
++gr_check_crash_exec(const struct file *filp)
++{
++ return 0;
++}
++
++int
++gr_check_crash_uid(const uid_t uid)
++{
++ return 0;
++}
++
++void
++gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
++ struct dentry *old_dentry,
++ struct dentry *new_dentry,
++ struct vfsmount *mnt, const __u8 replace)
++{
++ return;
++}
++
++int
++gr_search_socket(const int family, const int type, const int protocol)
++{
++ return 1;
++}
++
++int
++gr_search_connectbind(const int mode, const struct socket *sock,
++ const struct sockaddr_in *addr)
++{
++ return 0;
++}
++
++void
++gr_handle_alertkill(struct task_struct *task)
++{
++ return;
++}
++
++__u32
++gr_acl_handle_execve(const struct dentry * dentry, const struct vfsmount * mnt)
++{
++ return 1;
++}
++
++__u32
++gr_acl_handle_hidden_file(const struct dentry * dentry,
++ const struct vfsmount * mnt)
++{
++ return 1;
++}
++
++__u32
++gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
++ int acc_mode)
++{
++ return 1;
++}
++
++__u32
++gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
++{
++ return 1;
++}
++
++__u32
++gr_acl_handle_unlink(const struct dentry * dentry, const struct vfsmount * mnt)
++{
++ return 1;
++}
++
++int
++gr_acl_handle_mmap(const struct file *file, const unsigned long prot,
++ unsigned int *vm_flags)
++{
++ return 1;
++}
++
++__u32
++gr_acl_handle_truncate(const struct dentry * dentry,
++ const struct vfsmount * mnt)
++{
++ return 1;
++}
++
++__u32
++gr_acl_handle_utime(const struct dentry * dentry, const struct vfsmount * mnt)
++{
++ return 1;
++}
++
++__u32
++gr_acl_handle_access(const struct dentry * dentry,
++ const struct vfsmount * mnt, const int fmode)
++{
++ return 1;
++}
++
++__u32
++gr_acl_handle_chmod(const struct dentry * dentry, const struct vfsmount * mnt,
++ umode_t *mode)
++{
++ return 1;
++}
++
++__u32
++gr_acl_handle_chown(const struct dentry * dentry, const struct vfsmount * mnt)
++{
++ return 1;
++}
++
++__u32
++gr_acl_handle_setxattr(const struct dentry * dentry, const struct vfsmount * mnt)
++{
++ return 1;
++}
++
++void
++grsecurity_init(void)
++{
++ return;
++}
++
++umode_t gr_acl_umask(void)
++{
++ return 0;
++}
++
++__u32
++gr_acl_handle_mknod(const struct dentry * new_dentry,
++ const struct dentry * parent_dentry,
++ const struct vfsmount * parent_mnt,
++ const int mode)
++{
++ return 1;
++}
++
++__u32
++gr_acl_handle_mkdir(const struct dentry * new_dentry,
++ const struct dentry * parent_dentry,
++ const struct vfsmount * parent_mnt)
++{
++ return 1;
++}
++
++__u32
++gr_acl_handle_symlink(const struct dentry * new_dentry,
++ const struct dentry * parent_dentry,
++ const struct vfsmount * parent_mnt, const char *from)
++{
++ return 1;
++}
++
++__u32
++gr_acl_handle_link(const struct dentry * new_dentry,
++ const struct dentry * parent_dentry,
++ const struct vfsmount * parent_mnt,
++ const struct dentry * old_dentry,
++ const struct vfsmount * old_mnt, const char *to)
++{
++ return 1;
++}
++
++int
++gr_acl_handle_rename(const struct dentry *new_dentry,
++ const struct dentry *parent_dentry,
++ const struct vfsmount *parent_mnt,
++ const struct dentry *old_dentry,
++ const struct inode *old_parent_inode,
++ const struct vfsmount *old_mnt, const char *newname)
++{
++ return 0;
++}
++
++int
++gr_acl_handle_filldir(const struct file *file, const char *name,
++ const int namelen, const ino_t ino)
++{
++ return 1;
++}
++
++int
++gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
++ const time_t shm_createtime, const uid_t cuid, const int shmid)
++{
++ return 1;
++}
++
++int
++gr_search_bind(const struct socket *sock, const struct sockaddr_in *addr)
++{
++ return 0;
++}
++
++int
++gr_search_accept(const struct socket *sock)
++{
++ return 0;
++}
++
++int
++gr_search_listen(const struct socket *sock)
++{
++ return 0;
++}
++
++int
++gr_search_connect(const struct socket *sock, const struct sockaddr_in *addr)
++{
++ return 0;
++}
++
++__u32
++gr_acl_handle_unix(const struct dentry * dentry, const struct vfsmount * mnt)
++{
++ return 1;
++}
++
++__u32
++gr_acl_handle_creat(const struct dentry * dentry,
++ const struct dentry * p_dentry,
++ const struct vfsmount * p_mnt, int open_flags, int acc_mode,
++ const int imode)
++{
++ return 1;
++}
++
++void
++gr_acl_handle_exit(void)
++{
++ return;
++}
++
++int
++gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
++{
++ return 1;
++}
++
++void
++gr_set_role_label(const uid_t uid, const gid_t gid)
++{
++ return;
++}
++
++int
++gr_acl_handle_procpidmem(const struct task_struct *task)
++{
++ return 0;
++}
++
++int
++gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb)
++{
++ return 0;
++}
++
++int
++gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr)
++{
++ return 0;
++}
++
++void
++gr_set_kernel_label(struct task_struct *task)
++{
++ return;
++}
++
++int
++gr_check_user_change(int real, int effective, int fs)
++{
++ return 0;
++}
++
++int
++gr_check_group_change(int real, int effective, int fs)
++{
++ return 0;
++}
++
++int gr_acl_enable_at_secure(void)
++{
++ return 0;
++}
++
++dev_t gr_get_dev_from_dentry(struct dentry *dentry)
++{
++ return dentry->d_inode->i_sb->s_dev;
++}
++
++EXPORT_SYMBOL(gr_learn_resource);
++EXPORT_SYMBOL(gr_set_kernel_label);
++#ifdef CONFIG_SECURITY
++EXPORT_SYMBOL(gr_check_user_change);
++EXPORT_SYMBOL(gr_check_group_change);
++#endif
+diff --git a/grsecurity/grsec_exec.c b/grsecurity/grsec_exec.c
+new file mode 100644
+index 0000000..a96e155
+--- /dev/null
++++ b/grsecurity/grsec_exec.c
+@@ -0,0 +1,204 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/file.h>
++#include <linux/binfmts.h>
++#include <linux/smp_lock.h>
++#include <linux/fs.h>
++#include <linux/types.h>
++#include <linux/grdefs.h>
++#include <linux/grinternal.h>
++#include <linux/capability.h>
++#include <linux/compat.h>
++#include <linux/module.h>
++
++#include <asm/uaccess.h>
++
++#ifdef CONFIG_GRKERNSEC_EXECLOG
++static char gr_exec_arg_buf[132];
++static DEFINE_MUTEX(gr_exec_arg_mutex);
++#endif
++
++void
++gr_handle_exec_args(struct linux_binprm *bprm, const char __user *const __user *argv)
++{
++#ifdef CONFIG_GRKERNSEC_EXECLOG
++ char *grarg = gr_exec_arg_buf;
++ unsigned int i, x, execlen = 0;
++ char c;
++
++ if (!((grsec_enable_execlog && grsec_enable_group &&
++ in_group_p(grsec_audit_gid))
++ || (grsec_enable_execlog && !grsec_enable_group)))
++ return;
++
++ mutex_lock(&gr_exec_arg_mutex);
++ memset(grarg, 0, sizeof(gr_exec_arg_buf));
++
++ if (unlikely(argv == NULL))
++ goto log;
++
++ for (i = 0; i < bprm->argc && execlen < 128; i++) {
++ const char __user *p;
++ unsigned int len;
++
++ if (copy_from_user(&p, argv + i, sizeof(p)))
++ goto log;
++ if (!p)
++ goto log;
++ len = strnlen_user(p, 128 - execlen);
++ if (len > 128 - execlen)
++ len = 128 - execlen;
++ else if (len > 0)
++ len--;
++ if (copy_from_user(grarg + execlen, p, len))
++ goto log;
++
++ /* rewrite unprintable characters */
++ for (x = 0; x < len; x++) {
++ c = *(grarg + execlen + x);
++ if (c < 32 || c > 126)
++ *(grarg + execlen + x) = ' ';
++ }
++
++ execlen += len;
++ *(grarg + execlen) = ' ';
++ *(grarg + execlen + 1) = '\0';
++ execlen++;
++ }
++
++ log:
++ gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
++ bprm->file->f_path.mnt, grarg);
++ mutex_unlock(&gr_exec_arg_mutex);
++#endif
++ return;
++}
++
++#ifdef CONFIG_COMPAT
++void
++gr_handle_exec_args_compat(struct linux_binprm *bprm, compat_uptr_t __user *argv)
++{
++#ifdef CONFIG_GRKERNSEC_EXECLOG
++ char *grarg = gr_exec_arg_buf;
++ unsigned int i, x, execlen = 0;
++ char c;
++
++ if (!((grsec_enable_execlog && grsec_enable_group &&
++ in_group_p(grsec_audit_gid))
++ || (grsec_enable_execlog && !grsec_enable_group)))
++ return;
++
++ mutex_lock(&gr_exec_arg_mutex);
++ memset(grarg, 0, sizeof(gr_exec_arg_buf));
++
++ if (unlikely(argv == NULL))
++ goto log;
++
++ for (i = 0; i < bprm->argc && execlen < 128; i++) {
++ compat_uptr_t p;
++ unsigned int len;
++
++ if (get_user(p, argv + i))
++ goto log;
++ len = strnlen_user(compat_ptr(p), 128 - execlen);
++ if (len > 128 - execlen)
++ len = 128 - execlen;
++ else if (len > 0)
++ len--;
++ else
++ goto log;
++ if (copy_from_user(grarg + execlen, compat_ptr(p), len))
++ goto log;
++
++ /* rewrite unprintable characters */
++ for (x = 0; x < len; x++) {
++ c = *(grarg + execlen + x);
++ if (c < 32 || c > 126)
++ *(grarg + execlen + x) = ' ';
++ }
++
++ execlen += len;
++ *(grarg + execlen) = ' ';
++ *(grarg + execlen + 1) = '\0';
++ execlen++;
++ }
++
++ log:
++ gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
++ bprm->file->f_path.mnt, grarg);
++ mutex_unlock(&gr_exec_arg_mutex);
++#endif
++ return;
++}
++#endif
++
++#ifdef CONFIG_GRKERNSEC
++extern int gr_acl_is_capable(const int cap);
++extern int gr_acl_is_capable_nolog(const int cap);
++extern int gr_chroot_is_capable(const int cap);
++extern int gr_chroot_is_capable_nolog(const int cap);
++#endif
++
++const char *captab_log[] = {
++ "CAP_CHOWN",
++ "CAP_DAC_OVERRIDE",
++ "CAP_DAC_READ_SEARCH",
++ "CAP_FOWNER",
++ "CAP_FSETID",
++ "CAP_KILL",
++ "CAP_SETGID",
++ "CAP_SETUID",
++ "CAP_SETPCAP",
++ "CAP_LINUX_IMMUTABLE",
++ "CAP_NET_BIND_SERVICE",
++ "CAP_NET_BROADCAST",
++ "CAP_NET_ADMIN",
++ "CAP_NET_RAW",
++ "CAP_IPC_LOCK",
++ "CAP_IPC_OWNER",
++ "CAP_SYS_MODULE",
++ "CAP_SYS_RAWIO",
++ "CAP_SYS_CHROOT",
++ "CAP_SYS_PTRACE",
++ "CAP_SYS_PACCT",
++ "CAP_SYS_ADMIN",
++ "CAP_SYS_BOOT",
++ "CAP_SYS_NICE",
++ "CAP_SYS_RESOURCE",
++ "CAP_SYS_TIME",
++ "CAP_SYS_TTY_CONFIG",
++ "CAP_MKNOD",
++ "CAP_LEASE",
++ "CAP_AUDIT_WRITE",
++ "CAP_AUDIT_CONTROL",
++ "CAP_SETFCAP",
++ "CAP_MAC_OVERRIDE",
++ "CAP_MAC_ADMIN"
++};
++
++int captab_log_entries = sizeof(captab_log)/sizeof(captab_log[0]);
++
++int gr_is_capable(const int cap)
++{
++#ifdef CONFIG_GRKERNSEC
++ if (gr_acl_is_capable(cap) && gr_chroot_is_capable(cap))
++ return 1;
++ return 0;
++#else
++ return 1;
++#endif
++}
++
++int gr_is_capable_nolog(const int cap)
++{
++#ifdef CONFIG_GRKERNSEC
++ if (gr_acl_is_capable_nolog(cap) && gr_chroot_is_capable_nolog(cap))
++ return 1;
++ return 0;
++#else
++ return 1;
++#endif
++}
++
++EXPORT_SYMBOL(gr_is_capable);
++EXPORT_SYMBOL(gr_is_capable_nolog);
+diff --git a/grsecurity/grsec_fifo.c b/grsecurity/grsec_fifo.c
+new file mode 100644
+index 0000000..d3ee748
+--- /dev/null
++++ b/grsecurity/grsec_fifo.c
+@@ -0,0 +1,24 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/fs.h>
++#include <linux/file.h>
++#include <linux/grinternal.h>
++
++int
++gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
++ const struct dentry *dir, const int flag, const int acc_mode)
++{
++#ifdef CONFIG_GRKERNSEC_FIFO
++ const struct cred *cred = current_cred();
++
++ if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
++ !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
++ (dentry->d_inode->i_uid != dir->d_inode->i_uid) &&
++ (cred->fsuid != dentry->d_inode->i_uid)) {
++ if (!inode_permission(dentry->d_inode, acc_mode))
++ gr_log_fs_int2(GR_DONT_AUDIT, GR_FIFO_MSG, dentry, mnt, dentry->d_inode->i_uid, dentry->d_inode->i_gid);
++ return -EACCES;
++ }
++#endif
++ return 0;
++}
+diff --git a/grsecurity/grsec_fork.c b/grsecurity/grsec_fork.c
+new file mode 100644
+index 0000000..8ca18bf
+--- /dev/null
++++ b/grsecurity/grsec_fork.c
+@@ -0,0 +1,23 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++#include <linux/errno.h>
++
++void
++gr_log_forkfail(const int retval)
++{
++#ifdef CONFIG_GRKERNSEC_FORKFAIL
++ if (grsec_enable_forkfail && (retval == -EAGAIN || retval == -ENOMEM)) {
++ switch (retval) {
++ case -EAGAIN:
++ gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "EAGAIN");
++ break;
++ case -ENOMEM:
++ gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "ENOMEM");
++ break;
++ }
++ }
++#endif
++ return;
++}
+diff --git a/grsecurity/grsec_init.c b/grsecurity/grsec_init.c
+new file mode 100644
+index 0000000..1e995d3
+--- /dev/null
++++ b/grsecurity/grsec_init.c
+@@ -0,0 +1,278 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/mm.h>
++#include <linux/smp_lock.h>
++#include <linux/gracl.h>
++#include <linux/slab.h>
++#include <linux/vmalloc.h>
++#include <linux/percpu.h>
++#include <linux/module.h>
++
++int grsec_enable_ptrace_readexec;
++int grsec_enable_setxid;
++int grsec_enable_brute;
++int grsec_enable_link;
++int grsec_enable_dmesg;
++int grsec_enable_harden_ptrace;
++int grsec_enable_fifo;
++int grsec_enable_execlog;
++int grsec_enable_signal;
++int grsec_enable_forkfail;
++int grsec_enable_audit_ptrace;
++int grsec_enable_time;
++int grsec_enable_audit_textrel;
++int grsec_enable_group;
++int grsec_audit_gid;
++int grsec_enable_chdir;
++int grsec_enable_mount;
++int grsec_enable_rofs;
++int grsec_enable_chroot_findtask;
++int grsec_enable_chroot_mount;
++int grsec_enable_chroot_shmat;
++int grsec_enable_chroot_fchdir;
++int grsec_enable_chroot_double;
++int grsec_enable_chroot_pivot;
++int grsec_enable_chroot_chdir;
++int grsec_enable_chroot_chmod;
++int grsec_enable_chroot_mknod;
++int grsec_enable_chroot_nice;
++int grsec_enable_chroot_execlog;
++int grsec_enable_chroot_caps;
++int grsec_enable_chroot_sysctl;
++int grsec_enable_chroot_unix;
++int grsec_enable_tpe;
++int grsec_tpe_gid;
++int grsec_enable_blackhole;
++#ifdef CONFIG_IPV6_MODULE
++EXPORT_SYMBOL(grsec_enable_blackhole);
++#endif
++int grsec_lastack_retries;
++int grsec_enable_tpe_all;
++int grsec_enable_tpe_invert;
++int grsec_enable_socket_all;
++int grsec_socket_all_gid;
++int grsec_enable_socket_client;
++int grsec_socket_client_gid;
++int grsec_enable_socket_server;
++int grsec_socket_server_gid;
++int grsec_resource_logging;
++int grsec_disable_privio;
++int grsec_enable_log_rwxmaps;
++int grsec_lock;
++
++DEFINE_SPINLOCK(grsec_alert_lock);
++unsigned long grsec_alert_wtime = 0;
++unsigned long grsec_alert_fyet = 0;
++
++DEFINE_SPINLOCK(grsec_audit_lock);
++
++DEFINE_RWLOCK(grsec_exec_file_lock);
++
++char *gr_shared_page[4];
++
++char *gr_alert_log_fmt;
++char *gr_audit_log_fmt;
++char *gr_alert_log_buf;
++char *gr_audit_log_buf;
++
++extern struct gr_arg *gr_usermode;
++extern unsigned char *gr_system_salt;
++extern unsigned char *gr_system_sum;
++
++void __init
++grsecurity_init(void)
++{
++ int j;
++ /* create the per-cpu shared pages */
++
++#ifdef CONFIG_X86
++ memset((char *)(0x41a + PAGE_OFFSET), 0, 36);
++#endif
++
++ for (j = 0; j < 4; j++) {
++ gr_shared_page[j] = (char *)__alloc_percpu(PAGE_SIZE, __alignof__(unsigned long long));
++ if (gr_shared_page[j] == NULL) {
++ panic("Unable to allocate grsecurity shared page");
++ return;
++ }
++ }
++
++ /* allocate log buffers */
++ gr_alert_log_fmt = kmalloc(512, GFP_KERNEL);
++ if (!gr_alert_log_fmt) {
++ panic("Unable to allocate grsecurity alert log format buffer");
++ return;
++ }
++ gr_audit_log_fmt = kmalloc(512, GFP_KERNEL);
++ if (!gr_audit_log_fmt) {
++ panic("Unable to allocate grsecurity audit log format buffer");
++ return;
++ }
++ gr_alert_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
++ if (!gr_alert_log_buf) {
++ panic("Unable to allocate grsecurity alert log buffer");
++ return;
++ }
++ gr_audit_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
++ if (!gr_audit_log_buf) {
++ panic("Unable to allocate grsecurity audit log buffer");
++ return;
++ }
++
++ /* allocate memory for authentication structure */
++ gr_usermode = kmalloc(sizeof(struct gr_arg), GFP_KERNEL);
++ gr_system_salt = kmalloc(GR_SALT_LEN, GFP_KERNEL);
++ gr_system_sum = kmalloc(GR_SHA_LEN, GFP_KERNEL);
++
++ if (!gr_usermode || !gr_system_salt || !gr_system_sum) {
++ panic("Unable to allocate grsecurity authentication structure");
++ return;
++ }
++
++
++#ifdef CONFIG_GRKERNSEC_IO
++#if !defined(CONFIG_GRKERNSEC_SYSCTL_DISTRO)
++ grsec_disable_privio = 1;
++#elif defined(CONFIG_GRKERNSEC_SYSCTL_ON)
++ grsec_disable_privio = 1;
++#else
++ grsec_disable_privio = 0;
++#endif
++#endif
++
++#ifdef CONFIG_GRKERNSEC_TPE_INVERT
++ /* for backward compatibility, tpe_invert always defaults to on if
++ enabled in the kernel
++ */
++ grsec_enable_tpe_invert = 1;
++#endif
++
++#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
++#ifndef CONFIG_GRKERNSEC_SYSCTL
++ grsec_lock = 1;
++#endif
++
++#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
++ grsec_enable_audit_textrel = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
++ grsec_enable_log_rwxmaps = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
++ grsec_enable_group = 1;
++ grsec_audit_gid = CONFIG_GRKERNSEC_AUDIT_GID;
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
++ grsec_enable_chdir = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
++ grsec_enable_harden_ptrace = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
++ grsec_enable_mount = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_LINK
++ grsec_enable_link = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_BRUTE
++ grsec_enable_brute = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_DMESG
++ grsec_enable_dmesg = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++ grsec_enable_blackhole = 1;
++ grsec_lastack_retries = 4;
++#endif
++#ifdef CONFIG_GRKERNSEC_FIFO
++ grsec_enable_fifo = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_EXECLOG
++ grsec_enable_execlog = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_SETXID
++ grsec_enable_setxid = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_PTRACE_READEXEC
++ grsec_enable_ptrace_readexec = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_SIGNAL
++ grsec_enable_signal = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_FORKFAIL
++ grsec_enable_forkfail = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_TIME
++ grsec_enable_time = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_RESLOG
++ grsec_resource_logging = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
++ grsec_enable_chroot_findtask = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
++ grsec_enable_chroot_unix = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
++ grsec_enable_chroot_mount = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
++ grsec_enable_chroot_fchdir = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
++ grsec_enable_chroot_shmat = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
++ grsec_enable_audit_ptrace = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
++ grsec_enable_chroot_double = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
++ grsec_enable_chroot_pivot = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
++ grsec_enable_chroot_chdir = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
++ grsec_enable_chroot_chmod = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
++ grsec_enable_chroot_mknod = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
++ grsec_enable_chroot_nice = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
++ grsec_enable_chroot_execlog = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
++ grsec_enable_chroot_caps = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
++ grsec_enable_chroot_sysctl = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_TPE
++ grsec_enable_tpe = 1;
++ grsec_tpe_gid = CONFIG_GRKERNSEC_TPE_GID;
++#ifdef CONFIG_GRKERNSEC_TPE_ALL
++ grsec_enable_tpe_all = 1;
++#endif
++#endif
++#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
++ grsec_enable_socket_all = 1;
++ grsec_socket_all_gid = CONFIG_GRKERNSEC_SOCKET_ALL_GID;
++#endif
++#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
++ grsec_enable_socket_client = 1;
++ grsec_socket_client_gid = CONFIG_GRKERNSEC_SOCKET_CLIENT_GID;
++#endif
++#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
++ grsec_enable_socket_server = 1;
++ grsec_socket_server_gid = CONFIG_GRKERNSEC_SOCKET_SERVER_GID;
++#endif
++#endif
++
++ return;
++}
+diff --git a/grsecurity/grsec_link.c b/grsecurity/grsec_link.c
+new file mode 100644
+index 0000000..3efe141
+--- /dev/null
++++ b/grsecurity/grsec_link.c
+@@ -0,0 +1,43 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/fs.h>
++#include <linux/file.h>
++#include <linux/grinternal.h>
++
++int
++gr_handle_follow_link(const struct inode *parent,
++ const struct inode *inode,
++ const struct dentry *dentry, const struct vfsmount *mnt)
++{
++#ifdef CONFIG_GRKERNSEC_LINK
++ const struct cred *cred = current_cred();
++
++ if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
++ (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) &&
++ (parent->i_mode & S_IWOTH) && (cred->fsuid != inode->i_uid)) {
++ gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid);
++ return -EACCES;
++ }
++#endif
++ return 0;
++}
++
++int
++gr_handle_hardlink(const struct dentry *dentry,
++ const struct vfsmount *mnt,
++ struct inode *inode, const int mode, const char *to)
++{
++#ifdef CONFIG_GRKERNSEC_LINK
++ const struct cred *cred = current_cred();
++
++ if (grsec_enable_link && cred->fsuid != inode->i_uid &&
++ (!S_ISREG(mode) || (mode & S_ISUID) ||
++ ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) ||
++ (inode_permission(inode, MAY_READ | MAY_WRITE))) &&
++ !capable(CAP_FOWNER) && cred->uid) {
++ gr_log_fs_int2_str(GR_DONT_AUDIT, GR_HARDLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid, to);
++ return -EPERM;
++ }
++#endif
++ return 0;
++}
+diff --git a/grsecurity/grsec_log.c b/grsecurity/grsec_log.c
+new file mode 100644
+index 0000000..a45d2e9
+--- /dev/null
++++ b/grsecurity/grsec_log.c
+@@ -0,0 +1,322 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/file.h>
++#include <linux/tty.h>
++#include <linux/fs.h>
++#include <linux/grinternal.h>
++
++#ifdef CONFIG_TREE_PREEMPT_RCU
++#define DISABLE_PREEMPT() preempt_disable()
++#define ENABLE_PREEMPT() preempt_enable()
++#else
++#define DISABLE_PREEMPT()
++#define ENABLE_PREEMPT()
++#endif
++
++#define BEGIN_LOCKS(x) \
++ DISABLE_PREEMPT(); \
++ rcu_read_lock(); \
++ read_lock(&tasklist_lock); \
++ read_lock(&grsec_exec_file_lock); \
++ if (x != GR_DO_AUDIT) \
++ spin_lock(&grsec_alert_lock); \
++ else \
++ spin_lock(&grsec_audit_lock)
++
++#define END_LOCKS(x) \
++ if (x != GR_DO_AUDIT) \
++ spin_unlock(&grsec_alert_lock); \
++ else \
++ spin_unlock(&grsec_audit_lock); \
++ read_unlock(&grsec_exec_file_lock); \
++ read_unlock(&tasklist_lock); \
++ rcu_read_unlock(); \
++ ENABLE_PREEMPT(); \
++ if (x == GR_DONT_AUDIT) \
++ gr_handle_alertkill(current)
++
++enum {
++ FLOODING,
++ NO_FLOODING
++};
++
++extern char *gr_alert_log_fmt;
++extern char *gr_audit_log_fmt;
++extern char *gr_alert_log_buf;
++extern char *gr_audit_log_buf;
++
++static int gr_log_start(int audit)
++{
++ char *loglevel = (audit == GR_DO_AUDIT) ? KERN_INFO : KERN_ALERT;
++ char *fmt = (audit == GR_DO_AUDIT) ? gr_audit_log_fmt : gr_alert_log_fmt;
++ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
++#if (CONFIG_GRKERNSEC_FLOODTIME > 0 && CONFIG_GRKERNSEC_FLOODBURST > 0)
++ unsigned long curr_secs = get_seconds();
++
++ if (audit == GR_DO_AUDIT)
++ goto set_fmt;
++
++ if (!grsec_alert_wtime || time_after(curr_secs, grsec_alert_wtime + CONFIG_GRKERNSEC_FLOODTIME)) {
++ grsec_alert_wtime = curr_secs;
++ grsec_alert_fyet = 0;
++ } else if (time_before_eq(curr_secs, grsec_alert_wtime + CONFIG_GRKERNSEC_FLOODTIME)
++ && (grsec_alert_fyet < CONFIG_GRKERNSEC_FLOODBURST)) {
++ grsec_alert_fyet++;
++ } else if (grsec_alert_fyet == CONFIG_GRKERNSEC_FLOODBURST) {
++ grsec_alert_wtime = curr_secs;
++ grsec_alert_fyet++;
++ printk(KERN_ALERT "grsec: more alerts, logging disabled for %d seconds\n", CONFIG_GRKERNSEC_FLOODTIME);
++ return FLOODING;
++ }
++ else return FLOODING;
++
++set_fmt:
++#endif
++ memset(buf, 0, PAGE_SIZE);
++ if (current->signal->curr_ip && gr_acl_is_enabled()) {
++ sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: (%.64s:%c:%.950s) ");
++ snprintf(buf, PAGE_SIZE - 1, fmt, ¤t->signal->curr_ip, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
++ } else if (current->signal->curr_ip) {
++ sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: ");
++ snprintf(buf, PAGE_SIZE - 1, fmt, ¤t->signal->curr_ip);
++ } else if (gr_acl_is_enabled()) {
++ sprintf(fmt, "%s%s", loglevel, "grsec: (%.64s:%c:%.950s) ");
++ snprintf(buf, PAGE_SIZE - 1, fmt, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
++ } else {
++ sprintf(fmt, "%s%s", loglevel, "grsec: ");
++ strcpy(buf, fmt);
++ }
++
++ return NO_FLOODING;
++}
++
++static void gr_log_middle(int audit, const char *msg, va_list ap)
++ __attribute__ ((format (printf, 2, 0)));
++
++static void gr_log_middle(int audit, const char *msg, va_list ap)
++{
++ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
++ unsigned int len = strlen(buf);
++
++ vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
++
++ return;
++}
++
++static void gr_log_middle_varargs(int audit, const char *msg, ...)
++ __attribute__ ((format (printf, 2, 3)));
++
++static void gr_log_middle_varargs(int audit, const char *msg, ...)
++{
++ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
++ unsigned int len = strlen(buf);
++ va_list ap;
++
++ va_start(ap, msg);
++ vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
++ va_end(ap);
++
++ return;
++}
++
++static void gr_log_end(int audit, int append_default)
++{
++ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
++
++ if (append_default) {
++ unsigned int len = strlen(buf);
++ snprintf(buf + len, PAGE_SIZE - len - 1, DEFAULTSECMSG, DEFAULTSECARGS(current, current_cred(), __task_cred(current->real_parent)));
++ }
++
++ printk("%s\n", buf);
++
++ return;
++}
++
++void gr_log_varargs(int audit, const char *msg, int argtypes, ...)
++{
++ int logtype;
++ char *result = (audit == GR_DO_AUDIT) ? "successful" : "denied";
++ char *str1 = NULL, *str2 = NULL, *str3 = NULL;
++ void *voidptr = NULL;
++ int num1 = 0, num2 = 0;
++ unsigned long ulong1 = 0, ulong2 = 0;
++ struct dentry *dentry = NULL;
++ struct vfsmount *mnt = NULL;
++ struct file *file = NULL;
++ struct task_struct *task = NULL;
++ const struct cred *cred, *pcred;
++ va_list ap;
++
++ BEGIN_LOCKS(audit);
++ logtype = gr_log_start(audit);
++ if (logtype == FLOODING) {
++ END_LOCKS(audit);
++ return;
++ }
++ va_start(ap, argtypes);
++ switch (argtypes) {
++ case GR_TTYSNIFF:
++ task = va_arg(ap, struct task_struct *);
++ gr_log_middle_varargs(audit, msg, &task->signal->curr_ip, gr_task_fullpath0(task), task->comm, task->pid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid);
++ break;
++ case GR_SYSCTL_HIDDEN:
++ str1 = va_arg(ap, char *);
++ gr_log_middle_varargs(audit, msg, result, str1);
++ break;
++ case GR_RBAC:
++ dentry = va_arg(ap, struct dentry *);
++ mnt = va_arg(ap, struct vfsmount *);
++ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt));
++ break;
++ case GR_RBAC_STR:
++ dentry = va_arg(ap, struct dentry *);
++ mnt = va_arg(ap, struct vfsmount *);
++ str1 = va_arg(ap, char *);
++ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1);
++ break;
++ case GR_STR_RBAC:
++ str1 = va_arg(ap, char *);
++ dentry = va_arg(ap, struct dentry *);
++ mnt = va_arg(ap, struct vfsmount *);
++ gr_log_middle_varargs(audit, msg, result, str1, gr_to_filename(dentry, mnt));
++ break;
++ case GR_RBAC_MODE2:
++ dentry = va_arg(ap, struct dentry *);
++ mnt = va_arg(ap, struct vfsmount *);
++ str1 = va_arg(ap, char *);
++ str2 = va_arg(ap, char *);
++ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2);
++ break;
++ case GR_RBAC_MODE3:
++ dentry = va_arg(ap, struct dentry *);
++ mnt = va_arg(ap, struct vfsmount *);
++ str1 = va_arg(ap, char *);
++ str2 = va_arg(ap, char *);
++ str3 = va_arg(ap, char *);
++ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2, str3);
++ break;
++ case GR_FILENAME:
++ dentry = va_arg(ap, struct dentry *);
++ mnt = va_arg(ap, struct vfsmount *);
++ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt));
++ break;
++ case GR_STR_FILENAME:
++ str1 = va_arg(ap, char *);
++ dentry = va_arg(ap, struct dentry *);
++ mnt = va_arg(ap, struct vfsmount *);
++ gr_log_middle_varargs(audit, msg, str1, gr_to_filename(dentry, mnt));
++ break;
++ case GR_FILENAME_STR:
++ dentry = va_arg(ap, struct dentry *);
++ mnt = va_arg(ap, struct vfsmount *);
++ str1 = va_arg(ap, char *);
++ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), str1);
++ break;
++ case GR_FILENAME_TWO_INT:
++ dentry = va_arg(ap, struct dentry *);
++ mnt = va_arg(ap, struct vfsmount *);
++ num1 = va_arg(ap, int);
++ num2 = va_arg(ap, int);
++ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2);
++ break;
++ case GR_FILENAME_TWO_INT_STR:
++ dentry = va_arg(ap, struct dentry *);
++ mnt = va_arg(ap, struct vfsmount *);
++ num1 = va_arg(ap, int);
++ num2 = va_arg(ap, int);
++ str1 = va_arg(ap, char *);
++ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2, str1);
++ break;
++ case GR_TEXTREL:
++ file = va_arg(ap, struct file *);
++ ulong1 = va_arg(ap, unsigned long);
++ ulong2 = va_arg(ap, unsigned long);
++ gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>", ulong1, ulong2);
++ break;
++ case GR_PTRACE:
++ task = va_arg(ap, struct task_struct *);
++ gr_log_middle_varargs(audit, msg, task->exec_file ? gr_to_filename(task->exec_file->f_path.dentry, task->exec_file->f_path.mnt) : "(none)", task->comm, task->pid);
++ break;
++ case GR_RESOURCE:
++ task = va_arg(ap, struct task_struct *);
++ cred = __task_cred(task);
++ pcred = __task_cred(task->real_parent);
++ ulong1 = va_arg(ap, unsigned long);
++ str1 = va_arg(ap, char *);
++ ulong2 = va_arg(ap, unsigned long);
++ gr_log_middle_varargs(audit, msg, ulong1, str1, ulong2, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
++ break;
++ case GR_CAP:
++ task = va_arg(ap, struct task_struct *);
++ cred = __task_cred(task);
++ pcred = __task_cred(task->real_parent);
++ str1 = va_arg(ap, char *);
++ gr_log_middle_varargs(audit, msg, str1, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
++ break;
++ case GR_SIG:
++ str1 = va_arg(ap, char *);
++ voidptr = va_arg(ap, void *);
++ gr_log_middle_varargs(audit, msg, str1, voidptr);
++ break;
++ case GR_SIG2:
++ task = va_arg(ap, struct task_struct *);
++ cred = __task_cred(task);
++ pcred = __task_cred(task->real_parent);
++ num1 = va_arg(ap, int);
++ gr_log_middle_varargs(audit, msg, num1, gr_task_fullpath0(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
++ break;
++ case GR_CRASH1:
++ task = va_arg(ap, struct task_struct *);
++ cred = __task_cred(task);
++ pcred = __task_cred(task->real_parent);
++ ulong1 = va_arg(ap, unsigned long);
++ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, cred->uid, ulong1);
++ break;
++ case GR_CRASH2:
++ task = va_arg(ap, struct task_struct *);
++ cred = __task_cred(task);
++ pcred = __task_cred(task->real_parent);
++ ulong1 = va_arg(ap, unsigned long);
++ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, ulong1);
++ break;
++ case GR_RWXMAP:
++ file = va_arg(ap, struct file *);
++ gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>");
++ break;
++ case GR_PSACCT:
++ {
++ unsigned int wday, cday;
++ __u8 whr, chr;
++ __u8 wmin, cmin;
++ __u8 wsec, csec;
++ char cur_tty[64] = { 0 };
++ char parent_tty[64] = { 0 };
++
++ task = va_arg(ap, struct task_struct *);
++ wday = va_arg(ap, unsigned int);
++ cday = va_arg(ap, unsigned int);
++ whr = va_arg(ap, int);
++ chr = va_arg(ap, int);
++ wmin = va_arg(ap, int);
++ cmin = va_arg(ap, int);
++ wsec = va_arg(ap, int);
++ csec = va_arg(ap, int);
++ ulong1 = va_arg(ap, unsigned long);
++ cred = __task_cred(task);
++ pcred = __task_cred(task->real_parent);
++
++ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, &task->signal->curr_ip, tty_name(task->signal->tty, cur_tty), cred->uid, cred->euid, cred->gid, cred->egid, wday, whr, wmin, wsec, cday, chr, cmin, csec, (task->flags & PF_SIGNALED) ? "killed by signal" : "exited", ulong1, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, &task->real_parent->signal->curr_ip, tty_name(task->real_parent->signal->tty, parent_tty), pcred->uid, pcred->euid, pcred->gid, pcred->egid);
++ }
++ break;
++ default:
++ gr_log_middle(audit, msg, ap);
++ }
++ va_end(ap);
++ // these don't need DEFAULTSECARGS printed on the end
++ if (argtypes == GR_CRASH1 || argtypes == GR_CRASH2)
++ gr_log_end(audit, 0);
++ else
++ gr_log_end(audit, 1);
++ END_LOCKS(audit);
++}
+diff --git a/grsecurity/grsec_mem.c b/grsecurity/grsec_mem.c
+new file mode 100644
+index 0000000..f536303
+--- /dev/null
++++ b/grsecurity/grsec_mem.c
+@@ -0,0 +1,40 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/mm.h>
++#include <linux/mman.h>
++#include <linux/grinternal.h>
++
++void
++gr_handle_ioperm(void)
++{
++ gr_log_noargs(GR_DONT_AUDIT, GR_IOPERM_MSG);
++ return;
++}
++
++void
++gr_handle_iopl(void)
++{
++ gr_log_noargs(GR_DONT_AUDIT, GR_IOPL_MSG);
++ return;
++}
++
++void
++gr_handle_mem_readwrite(u64 from, u64 to)
++{
++ gr_log_two_u64(GR_DONT_AUDIT, GR_MEM_READWRITE_MSG, from, to);
++ return;
++}
++
++void
++gr_handle_vm86(void)
++{
++ gr_log_noargs(GR_DONT_AUDIT, GR_VM86_MSG);
++ return;
++}
++
++void
++gr_log_badprocpid(const char *entry)
++{
++ gr_log_str(GR_DONT_AUDIT, GR_BADPROCPID_MSG, entry);
++ return;
++}
+diff --git a/grsecurity/grsec_mount.c b/grsecurity/grsec_mount.c
+new file mode 100644
+index 0000000..2131422
+--- /dev/null
++++ b/grsecurity/grsec_mount.c
+@@ -0,0 +1,62 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/mount.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++void
++gr_log_remount(const char *devname, const int retval)
++{
++#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
++ if (grsec_enable_mount && (retval >= 0))
++ gr_log_str(GR_DO_AUDIT, GR_REMOUNT_AUDIT_MSG, devname ? devname : "none");
++#endif
++ return;
++}
++
++void
++gr_log_unmount(const char *devname, const int retval)
++{
++#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
++ if (grsec_enable_mount && (retval >= 0))
++ gr_log_str(GR_DO_AUDIT, GR_UNMOUNT_AUDIT_MSG, devname ? devname : "none");
++#endif
++ return;
++}
++
++void
++gr_log_mount(const char *from, const char *to, const int retval)
++{
++#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
++ if (grsec_enable_mount && (retval >= 0))
++ gr_log_str_str(GR_DO_AUDIT, GR_MOUNT_AUDIT_MSG, from ? from : "none", to);
++#endif
++ return;
++}
++
++int
++gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags)
++{
++#ifdef CONFIG_GRKERNSEC_ROFS
++ if (grsec_enable_rofs && !(mnt_flags & MNT_READONLY)) {
++ gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_MOUNT_MSG, dentry, mnt);
++ return -EPERM;
++ } else
++ return 0;
++#endif
++ return 0;
++}
++
++int
++gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode)
++{
++#ifdef CONFIG_GRKERNSEC_ROFS
++ if (grsec_enable_rofs && (acc_mode & MAY_WRITE) &&
++ dentry->d_inode && S_ISBLK(dentry->d_inode->i_mode)) {
++ gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_BLOCKWRITE_MSG, dentry, mnt);
++ return -EPERM;
++ } else
++ return 0;
++#endif
++ return 0;
++}
+diff --git a/grsecurity/grsec_pax.c b/grsecurity/grsec_pax.c
+new file mode 100644
+index 0000000..a3b12a0
+--- /dev/null
++++ b/grsecurity/grsec_pax.c
+@@ -0,0 +1,36 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/mm.h>
++#include <linux/file.h>
++#include <linux/grinternal.h>
++#include <linux/grsecurity.h>
++
++void
++gr_log_textrel(struct vm_area_struct * vma)
++{
++#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
++ if (grsec_enable_audit_textrel)
++ gr_log_textrel_ulong_ulong(GR_DO_AUDIT, GR_TEXTREL_AUDIT_MSG, vma->vm_file, vma->vm_start, vma->vm_pgoff);
++#endif
++ return;
++}
++
++void
++gr_log_rwxmmap(struct file *file)
++{
++#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
++ if (grsec_enable_log_rwxmaps)
++ gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMMAP_MSG, file);
++#endif
++ return;
++}
++
++void
++gr_log_rwxmprotect(struct file *file)
++{
++#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
++ if (grsec_enable_log_rwxmaps)
++ gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMPROTECT_MSG, file);
++#endif
++ return;
++}
+diff --git a/grsecurity/grsec_ptrace.c b/grsecurity/grsec_ptrace.c
+new file mode 100644
+index 0000000..78f8733
+--- /dev/null
++++ b/grsecurity/grsec_ptrace.c
+@@ -0,0 +1,30 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/grinternal.h>
++#include <linux/security.h>
++
++void
++gr_audit_ptrace(struct task_struct *task)
++{
++#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
++ if (grsec_enable_audit_ptrace)
++ gr_log_ptrace(GR_DO_AUDIT, GR_PTRACE_AUDIT_MSG, task);
++#endif
++ return;
++}
++
++int
++gr_ptrace_readexec(struct file *file, int unsafe_flags)
++{
++#ifdef CONFIG_GRKERNSEC_PTRACE_READEXEC
++ const struct dentry *dentry = file->f_path.dentry;
++ const struct vfsmount *mnt = file->f_path.mnt;
++
++ if (grsec_enable_ptrace_readexec && (unsafe_flags & LSM_UNSAFE_PTRACE) &&
++ (inode_permission(dentry->d_inode, MAY_READ) || !gr_acl_handle_open(dentry, mnt, MAY_READ))) {
++ gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_READEXEC_MSG, dentry, mnt);
++ return -EACCES;
++ }
++#endif
++ return 0;
++}
+diff --git a/grsecurity/grsec_sig.c b/grsecurity/grsec_sig.c
+new file mode 100644
+index 0000000..c648492
+--- /dev/null
++++ b/grsecurity/grsec_sig.c
+@@ -0,0 +1,206 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/delay.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++#include <linux/hardirq.h>
++
++char *signames[] = {
++ [SIGSEGV] = "Segmentation fault",
++ [SIGILL] = "Illegal instruction",
++ [SIGABRT] = "Abort",
++ [SIGBUS] = "Invalid alignment/Bus error"
++};
++
++void
++gr_log_signal(const int sig, const void *addr, const struct task_struct *t)
++{
++#ifdef CONFIG_GRKERNSEC_SIGNAL
++ if (grsec_enable_signal && ((sig == SIGSEGV) || (sig == SIGILL) ||
++ (sig == SIGABRT) || (sig == SIGBUS))) {
++ if (t->pid == current->pid) {
++ gr_log_sig_addr(GR_DONT_AUDIT_GOOD, GR_UNISIGLOG_MSG, signames[sig], addr);
++ } else {
++ gr_log_sig_task(GR_DONT_AUDIT_GOOD, GR_DUALSIGLOG_MSG, t, sig);
++ }
++ }
++#endif
++ return;
++}
++
++int
++gr_handle_signal(const struct task_struct *p, const int sig)
++{
++#ifdef CONFIG_GRKERNSEC
++ /* ignore the 0 signal for protected task checks */
++ if (current->pid > 1 && sig && gr_check_protected_task(p)) {
++ gr_log_sig_task(GR_DONT_AUDIT, GR_SIG_ACL_MSG, p, sig);
++ return -EPERM;
++ } else if (gr_pid_is_chrooted((struct task_struct *)p)) {
++ return -EPERM;
++ }
++#endif
++ return 0;
++}
++
++#ifdef CONFIG_GRKERNSEC
++extern int specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t);
++
++int gr_fake_force_sig(int sig, struct task_struct *t)
++{
++ unsigned long int flags;
++ int ret, blocked, ignored;
++ struct k_sigaction *action;
++
++ spin_lock_irqsave(&t->sighand->siglock, flags);
++ action = &t->sighand->action[sig-1];
++ ignored = action->sa.sa_handler == SIG_IGN;
++ blocked = sigismember(&t->blocked, sig);
++ if (blocked || ignored) {
++ action->sa.sa_handler = SIG_DFL;
++ if (blocked) {
++ sigdelset(&t->blocked, sig);
++ recalc_sigpending_and_wake(t);
++ }
++ }
++ if (action->sa.sa_handler == SIG_DFL)
++ t->signal->flags &= ~SIGNAL_UNKILLABLE;
++ ret = specific_send_sig_info(sig, SEND_SIG_PRIV, t);
++
++ spin_unlock_irqrestore(&t->sighand->siglock, flags);
++
++ return ret;
++}
++#endif
++
++#ifdef CONFIG_GRKERNSEC_BRUTE
++#define GR_USER_BAN_TIME (15 * 60)
++
++static int __get_dumpable(unsigned long mm_flags)
++{
++ int ret;
++
++ ret = mm_flags & MMF_DUMPABLE_MASK;
++ return (ret >= 2) ? 2 : ret;
++}
++#endif
++
++void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags)
++{
++#ifdef CONFIG_GRKERNSEC_BRUTE
++ uid_t uid = 0;
++
++ if (!grsec_enable_brute)
++ return;
++
++ rcu_read_lock();
++ read_lock(&tasklist_lock);
++ read_lock(&grsec_exec_file_lock);
++ if (p->real_parent && p->real_parent->exec_file == p->exec_file)
++ p->real_parent->brute = 1;
++ else {
++ const struct cred *cred = __task_cred(p), *cred2;
++ struct task_struct *tsk, *tsk2;
++
++ if (!__get_dumpable(mm_flags) && cred->uid) {
++ struct user_struct *user;
++
++ uid = cred->uid;
++
++ /* this is put upon execution past expiration */
++ user = find_user(uid);
++ if (user == NULL)
++ goto unlock;
++ user->banned = 1;
++ user->ban_expires = get_seconds() + GR_USER_BAN_TIME;
++ if (user->ban_expires == ~0UL)
++ user->ban_expires--;
++
++ do_each_thread(tsk2, tsk) {
++ cred2 = __task_cred(tsk);
++ if (tsk != p && cred2->uid == uid)
++ gr_fake_force_sig(SIGKILL, tsk);
++ } while_each_thread(tsk2, tsk);
++ }
++ }
++unlock:
++ read_unlock(&grsec_exec_file_lock);
++ read_unlock(&tasklist_lock);
++ rcu_read_unlock();
++
++ if (uid)
++ printk(KERN_ALERT "grsec: bruteforce prevention initiated against uid %u, banning for %d minutes\n", uid, GR_USER_BAN_TIME / 60);
++#endif
++ return;
++}
++
++void gr_handle_brute_check(void)
++{
++#ifdef CONFIG_GRKERNSEC_BRUTE
++ if (current->brute)
++ msleep(30 * 1000);
++#endif
++ return;
++}
++
++void gr_handle_kernel_exploit(void)
++{
++#ifdef CONFIG_GRKERNSEC_KERN_LOCKOUT
++ const struct cred *cred;
++ struct task_struct *tsk, *tsk2;
++ struct user_struct *user;
++ uid_t uid;
++
++ if (in_irq() || in_serving_softirq() || in_nmi())
++ panic("grsec: halting the system due to suspicious kernel crash caused in interrupt context");
++
++ uid = current_uid();
++
++ if (uid == 0)
++ panic("grsec: halting the system due to suspicious kernel crash caused by root");
++ else {
++ /* kill all the processes of this user, hold a reference
++ to their creds struct, and prevent them from creating
++ another process until system reset
++ */
++ printk(KERN_ALERT "grsec: banning user with uid %u until system restart for suspicious kernel crash\n", uid);
++ /* we intentionally leak this ref */
++ user = get_uid(current->cred->user);
++ if (user) {
++ user->banned = 1;
++ user->ban_expires = ~0UL;
++ }
++
++ read_lock(&tasklist_lock);
++ do_each_thread(tsk2, tsk) {
++ cred = __task_cred(tsk);
++ if (cred->uid == uid)
++ gr_fake_force_sig(SIGKILL, tsk);
++ } while_each_thread(tsk2, tsk);
++ read_unlock(&tasklist_lock);
++ }
++#endif
++}
++
++int __gr_process_user_ban(struct user_struct *user)
++{
++#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
++ if (unlikely(user->banned)) {
++ if (user->ban_expires != ~0UL && time_after_eq(get_seconds(), user->ban_expires)) {
++ user->banned = 0;
++ user->ban_expires = 0;
++ free_uid(user);
++ } else
++ return -EPERM;
++ }
++#endif
++ return 0;
++}
++
++int gr_process_user_ban(void)
++{
++#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
++ return __gr_process_user_ban(current->cred->user);
++#endif
++ return 0;
++}
+diff --git a/grsecurity/grsec_sock.c b/grsecurity/grsec_sock.c
+new file mode 100644
+index 0000000..7512ea9
+--- /dev/null
++++ b/grsecurity/grsec_sock.c
+@@ -0,0 +1,275 @@
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/sched.h>
++#include <linux/file.h>
++#include <linux/net.h>
++#include <linux/in.h>
++#include <linux/ip.h>
++#include <net/sock.h>
++#include <net/inet_sock.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++#include <linux/gracl.h>
++
++kernel_cap_t gr_cap_rtnetlink(struct sock *sock);
++EXPORT_SYMBOL(gr_cap_rtnetlink);
++
++extern int gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb);
++extern int gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr);
++
++EXPORT_SYMBOL(gr_search_udp_recvmsg);
++EXPORT_SYMBOL(gr_search_udp_sendmsg);
++
++#ifdef CONFIG_UNIX_MODULE
++EXPORT_SYMBOL(gr_acl_handle_unix);
++EXPORT_SYMBOL(gr_acl_handle_mknod);
++EXPORT_SYMBOL(gr_handle_chroot_unix);
++EXPORT_SYMBOL(gr_handle_create);
++#endif
++
++#ifdef CONFIG_GRKERNSEC
++#define gr_conn_table_size 32749
++struct conn_table_entry {
++ struct conn_table_entry *next;
++ struct signal_struct *sig;
++};
++
++struct conn_table_entry *gr_conn_table[gr_conn_table_size];
++DEFINE_SPINLOCK(gr_conn_table_lock);
++
++extern const char * gr_socktype_to_name(unsigned char type);
++extern const char * gr_proto_to_name(unsigned char proto);
++extern const char * gr_sockfamily_to_name(unsigned char family);
++
++static __inline__ int
++conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
++{
++ return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
++}
++
++static __inline__ int
++conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr,
++ __u16 sport, __u16 dport)
++{
++ if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
++ sig->gr_sport == sport && sig->gr_dport == dport))
++ return 1;
++ else
++ return 0;
++}
++
++static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
++{
++ struct conn_table_entry **match;
++ unsigned int index;
++
++ index = conn_hash(sig->gr_saddr, sig->gr_daddr,
++ sig->gr_sport, sig->gr_dport,
++ gr_conn_table_size);
++
++ newent->sig = sig;
++
++ match = &gr_conn_table[index];
++ newent->next = *match;
++ *match = newent;
++
++ return;
++}
++
++static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
++{
++ struct conn_table_entry *match, *last = NULL;
++ unsigned int index;
++
++ index = conn_hash(sig->gr_saddr, sig->gr_daddr,
++ sig->gr_sport, sig->gr_dport,
++ gr_conn_table_size);
++
++ match = gr_conn_table[index];
++ while (match && !conn_match(match->sig,
++ sig->gr_saddr, sig->gr_daddr, sig->gr_sport,
++ sig->gr_dport)) {
++ last = match;
++ match = match->next;
++ }
++
++ if (match) {
++ if (last)
++ last->next = match->next;
++ else
++ gr_conn_table[index] = NULL;
++ kfree(match);
++ }
++
++ return;
++}
++
++static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
++ __u16 sport, __u16 dport)
++{
++ struct conn_table_entry *match;
++ unsigned int index;
++
++ index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
++
++ match = gr_conn_table[index];
++ while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
++ match = match->next;
++
++ if (match)
++ return match->sig;
++ else
++ return NULL;
++}
++
++#endif
++
++void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
++{
++#ifdef CONFIG_GRKERNSEC
++ struct signal_struct *sig = task->signal;
++ struct conn_table_entry *newent;
++
++ newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
++ if (newent == NULL)
++ return;
++ /* no bh lock needed since we are called with bh disabled */
++ spin_lock(&gr_conn_table_lock);
++ gr_del_task_from_ip_table_nolock(sig);
++ sig->gr_saddr = inet->rcv_saddr;
++ sig->gr_daddr = inet->daddr;
++ sig->gr_sport = inet->sport;
++ sig->gr_dport = inet->dport;
++ gr_add_to_task_ip_table_nolock(sig, newent);
++ spin_unlock(&gr_conn_table_lock);
++#endif
++ return;
++}
++
++void gr_del_task_from_ip_table(struct task_struct *task)
++{
++#ifdef CONFIG_GRKERNSEC
++ spin_lock_bh(&gr_conn_table_lock);
++ gr_del_task_from_ip_table_nolock(task->signal);
++ spin_unlock_bh(&gr_conn_table_lock);
++#endif
++ return;
++}
++
++void
++gr_attach_curr_ip(const struct sock *sk)
++{
++#ifdef CONFIG_GRKERNSEC
++ struct signal_struct *p, *set;
++ const struct inet_sock *inet = inet_sk(sk);
++
++ if (unlikely(sk->sk_protocol != IPPROTO_TCP))
++ return;
++
++ set = current->signal;
++
++ spin_lock_bh(&gr_conn_table_lock);
++ p = gr_lookup_task_ip_table(inet->daddr, inet->rcv_saddr,
++ inet->dport, inet->sport);
++ if (unlikely(p != NULL)) {
++ set->curr_ip = p->curr_ip;
++ set->used_accept = 1;
++ gr_del_task_from_ip_table_nolock(p);
++ spin_unlock_bh(&gr_conn_table_lock);
++ return;
++ }
++ spin_unlock_bh(&gr_conn_table_lock);
++
++ set->curr_ip = inet->daddr;
++ set->used_accept = 1;
++#endif
++ return;
++}
++
++int
++gr_handle_sock_all(const int family, const int type, const int protocol)
++{
++#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
++ if (grsec_enable_socket_all && in_group_p(grsec_socket_all_gid) &&
++ (family != AF_UNIX)) {
++ if (family == AF_INET)
++ gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), gr_proto_to_name(protocol));
++ else
++ gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), protocol);
++ return -EACCES;
++ }
++#endif
++ return 0;
++}
++
++int
++gr_handle_sock_server(const struct sockaddr *sck)
++{
++#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
++ if (grsec_enable_socket_server &&
++ in_group_p(grsec_socket_server_gid) &&
++ sck && (sck->sa_family != AF_UNIX) &&
++ (sck->sa_family != AF_LOCAL)) {
++ gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
++ return -EACCES;
++ }
++#endif
++ return 0;
++}
++
++int
++gr_handle_sock_server_other(const struct sock *sck)
++{
++#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
++ if (grsec_enable_socket_server &&
++ in_group_p(grsec_socket_server_gid) &&
++ sck && (sck->sk_family != AF_UNIX) &&
++ (sck->sk_family != AF_LOCAL)) {
++ gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
++ return -EACCES;
++ }
++#endif
++ return 0;
++}
++
++int
++gr_handle_sock_client(const struct sockaddr *sck)
++{
++#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
++ if (grsec_enable_socket_client && in_group_p(grsec_socket_client_gid) &&
++ sck && (sck->sa_family != AF_UNIX) &&
++ (sck->sa_family != AF_LOCAL)) {
++ gr_log_noargs(GR_DONT_AUDIT, GR_CONNECT_MSG);
++ return -EACCES;
++ }
++#endif
++ return 0;
++}
++
++kernel_cap_t
++gr_cap_rtnetlink(struct sock *sock)
++{
++#ifdef CONFIG_GRKERNSEC
++ if (!gr_acl_is_enabled())
++ return current_cap();
++ else if (sock->sk_protocol == NETLINK_ISCSI &&
++ cap_raised(current_cap(), CAP_SYS_ADMIN) &&
++ gr_is_capable(CAP_SYS_ADMIN))
++ return current_cap();
++ else if (sock->sk_protocol == NETLINK_AUDIT &&
++ cap_raised(current_cap(), CAP_AUDIT_WRITE) &&
++ gr_is_capable(CAP_AUDIT_WRITE) &&
++ cap_raised(current_cap(), CAP_AUDIT_CONTROL) &&
++ gr_is_capable(CAP_AUDIT_CONTROL))
++ return current_cap();
++ else if (cap_raised(current_cap(), CAP_NET_ADMIN) &&
++ ((sock->sk_protocol == NETLINK_ROUTE) ?
++ gr_is_capable_nolog(CAP_NET_ADMIN) :
++ gr_is_capable(CAP_NET_ADMIN)))
++ return current_cap();
++ else
++ return __cap_empty_set;
++#else
++ return current_cap();
++#endif
++}
+diff --git a/grsecurity/grsec_sysctl.c b/grsecurity/grsec_sysctl.c
+new file mode 100644
+index 0000000..31f3258
+--- /dev/null
++++ b/grsecurity/grsec_sysctl.c
+@@ -0,0 +1,499 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/sysctl.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++int
++gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
++{
++#ifdef CONFIG_GRKERNSEC_SYSCTL
++ if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & MAY_WRITE)) {
++ gr_log_str(GR_DONT_AUDIT, GR_SYSCTL_MSG, name);
++ return -EACCES;
++ }
++#endif
++ return 0;
++}
++
++#ifdef CONFIG_GRKERNSEC_ROFS
++static int __maybe_unused one = 1;
++#endif
++
++#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
++ctl_table grsecurity_table[] = {
++#ifdef CONFIG_GRKERNSEC_SYSCTL
++#ifdef CONFIG_GRKERNSEC_SYSCTL_DISTRO
++#ifdef CONFIG_GRKERNSEC_IO
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "disable_priv_io",
++ .data = &grsec_disable_privio,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#endif
++#ifdef CONFIG_GRKERNSEC_LINK
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "linking_restrictions",
++ .data = &grsec_enable_link,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_BRUTE
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "deter_bruteforce",
++ .data = &grsec_enable_brute,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_FIFO
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "fifo_restrictions",
++ .data = &grsec_enable_fifo,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_PTRACE_READEXEC
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "ptrace_readexec",
++ .data = &grsec_enable_ptrace_readexec,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_SETXID
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "consistent_setxid",
++ .data = &grsec_enable_setxid,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "ip_blackhole",
++ .data = &grsec_enable_blackhole,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "lastack_retries",
++ .data = &grsec_lastack_retries,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_EXECLOG
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "exec_logging",
++ .data = &grsec_enable_execlog,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "rwxmap_logging",
++ .data = &grsec_enable_log_rwxmaps,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_SIGNAL
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "signal_logging",
++ .data = &grsec_enable_signal,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_FORKFAIL
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "forkfail_logging",
++ .data = &grsec_enable_forkfail,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_TIME
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "timechange_logging",
++ .data = &grsec_enable_time,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "chroot_deny_shmat",
++ .data = &grsec_enable_chroot_shmat,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "chroot_deny_unix",
++ .data = &grsec_enable_chroot_unix,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "chroot_deny_mount",
++ .data = &grsec_enable_chroot_mount,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "chroot_deny_fchdir",
++ .data = &grsec_enable_chroot_fchdir,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "chroot_deny_chroot",
++ .data = &grsec_enable_chroot_double,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "chroot_deny_pivot",
++ .data = &grsec_enable_chroot_pivot,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "chroot_enforce_chdir",
++ .data = &grsec_enable_chroot_chdir,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "chroot_deny_chmod",
++ .data = &grsec_enable_chroot_chmod,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "chroot_deny_mknod",
++ .data = &grsec_enable_chroot_mknod,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "chroot_restrict_nice",
++ .data = &grsec_enable_chroot_nice,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "chroot_execlog",
++ .data = &grsec_enable_chroot_execlog,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "chroot_caps",
++ .data = &grsec_enable_chroot_caps,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "chroot_deny_sysctl",
++ .data = &grsec_enable_chroot_sysctl,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_TPE
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "tpe",
++ .data = &grsec_enable_tpe,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "tpe_gid",
++ .data = &grsec_tpe_gid,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_TPE_INVERT
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "tpe_invert",
++ .data = &grsec_enable_tpe_invert,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_TPE_ALL
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "tpe_restrict_all",
++ .data = &grsec_enable_tpe_all,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "socket_all",
++ .data = &grsec_enable_socket_all,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "socket_all_gid",
++ .data = &grsec_socket_all_gid,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "socket_client",
++ .data = &grsec_enable_socket_client,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "socket_client_gid",
++ .data = &grsec_socket_client_gid,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "socket_server",
++ .data = &grsec_enable_socket_server,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "socket_server_gid",
++ .data = &grsec_socket_server_gid,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "audit_group",
++ .data = &grsec_enable_group,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "audit_gid",
++ .data = &grsec_audit_gid,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "audit_chdir",
++ .data = &grsec_enable_chdir,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "audit_mount",
++ .data = &grsec_enable_mount,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "audit_textrel",
++ .data = &grsec_enable_audit_textrel,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_DMESG
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "dmesg",
++ .data = &grsec_enable_dmesg,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "chroot_findtask",
++ .data = &grsec_enable_chroot_findtask,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_RESLOG
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "resource_logging",
++ .data = &grsec_resource_logging,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "audit_ptrace",
++ .data = &grsec_enable_audit_ptrace,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "harden_ptrace",
++ .data = &grsec_enable_harden_ptrace,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "grsec_lock",
++ .data = &grsec_lock,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++#endif
++#ifdef CONFIG_GRKERNSEC_ROFS
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "romount_protect",
++ .data = &grsec_enable_rofs,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec_minmax,
++ .extra1 = &one,
++ .extra2 = &one,
++ },
++#endif
++ { .ctl_name = 0 }
++};
++#endif
+diff --git a/grsecurity/grsec_time.c b/grsecurity/grsec_time.c
+new file mode 100644
+index 0000000..0dc13c3
+--- /dev/null
++++ b/grsecurity/grsec_time.c
+@@ -0,0 +1,16 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/grinternal.h>
++#include <linux/module.h>
++
++void
++gr_log_timechange(void)
++{
++#ifdef CONFIG_GRKERNSEC_TIME
++ if (grsec_enable_time)
++ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_TIME_MSG);
++#endif
++ return;
++}
++
++EXPORT_SYMBOL(gr_log_timechange);
+diff --git a/grsecurity/grsec_tpe.c b/grsecurity/grsec_tpe.c
+new file mode 100644
+index 0000000..07e0dc0
+--- /dev/null
++++ b/grsecurity/grsec_tpe.c
+@@ -0,0 +1,73 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/file.h>
++#include <linux/fs.h>
++#include <linux/grinternal.h>
++
++extern int gr_acl_tpe_check(void);
++
++int
++gr_tpe_allow(const struct file *file)
++{
++#ifdef CONFIG_GRKERNSEC
++ struct inode *inode = file->f_path.dentry->d_parent->d_inode;
++ const struct cred *cred = current_cred();
++ char *msg = NULL;
++ char *msg2 = NULL;
++
++ // never restrict root
++ if (!cred->uid)
++ return 1;
++
++ if (grsec_enable_tpe) {
++#ifdef CONFIG_GRKERNSEC_TPE_INVERT
++ if (grsec_enable_tpe_invert && !in_group_p(grsec_tpe_gid))
++ msg = "not being in trusted group";
++ else if (!grsec_enable_tpe_invert && in_group_p(grsec_tpe_gid))
++ msg = "being in untrusted group";
++#else
++ if (in_group_p(grsec_tpe_gid))
++ msg = "being in untrusted group";
++#endif
++ }
++ if (!msg && gr_acl_tpe_check())
++ msg = "being in untrusted role";
++
++ // not in any affected group/role
++ if (!msg)
++ goto next_check;
++
++ if (inode->i_uid)
++ msg2 = "file in non-root-owned directory";
++ else if (inode->i_mode & S_IWOTH)
++ msg2 = "file in world-writable directory";
++ else if (inode->i_mode & S_IWGRP)
++ msg2 = "file in group-writable directory";
++
++ if (msg && msg2) {
++ char fullmsg[70] = {0};
++ snprintf(fullmsg, sizeof(fullmsg)-1, "%s and %s", msg, msg2);
++ gr_log_str_fs(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, fullmsg, file->f_path.dentry, file->f_path.mnt);
++ return 0;
++ }
++ msg = NULL;
++next_check:
++#ifdef CONFIG_GRKERNSEC_TPE_ALL
++ if (!grsec_enable_tpe || !grsec_enable_tpe_all)
++ return 1;
++
++ if (inode->i_uid && (inode->i_uid != cred->uid))
++ msg = "directory not owned by user";
++ else if (inode->i_mode & S_IWOTH)
++ msg = "file in world-writable directory";
++ else if (inode->i_mode & S_IWGRP)
++ msg = "file in group-writable directory";
++
++ if (msg) {
++ gr_log_str_fs(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, msg, file->f_path.dentry, file->f_path.mnt);
++ return 0;
++ }
++#endif
++#endif
++ return 1;
++}
+diff --git a/grsecurity/grsum.c b/grsecurity/grsum.c
+new file mode 100644
+index 0000000..9f7b1ac
+--- /dev/null
++++ b/grsecurity/grsum.c
+@@ -0,0 +1,61 @@
++#include <linux/err.h>
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/mm.h>
++#include <linux/scatterlist.h>
++#include <linux/crypto.h>
++#include <linux/gracl.h>
++
++
++#if !defined(CONFIG_CRYPTO) || defined(CONFIG_CRYPTO_MODULE) || !defined(CONFIG_CRYPTO_SHA256) || defined(CONFIG_CRYPTO_SHA256_MODULE)
++#error "crypto and sha256 must be built into the kernel"
++#endif
++
++int
++chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum)
++{
++ char *p;
++ struct crypto_hash *tfm;
++ struct hash_desc desc;
++ struct scatterlist sg;
++ unsigned char temp_sum[GR_SHA_LEN];
++ volatile int retval = 0;
++ volatile int dummy = 0;
++ unsigned int i;
++
++ sg_init_table(&sg, 1);
++
++ tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
++ if (IS_ERR(tfm)) {
++ /* should never happen, since sha256 should be built in */
++ return 1;
++ }
++
++ desc.tfm = tfm;
++ desc.flags = 0;
++
++ crypto_hash_init(&desc);
++
++ p = salt;
++ sg_set_buf(&sg, p, GR_SALT_LEN);
++ crypto_hash_update(&desc, &sg, sg.length);
++
++ p = entry->pw;
++ sg_set_buf(&sg, p, strlen(p));
++
++ crypto_hash_update(&desc, &sg, sg.length);
++
++ crypto_hash_final(&desc, temp_sum);
++
++ memset(entry->pw, 0, GR_PW_LEN);
++
++ for (i = 0; i < GR_SHA_LEN; i++)
++ if (sum[i] != temp_sum[i])
++ retval = 1;
++ else
++ dummy = 1; // waste a cycle
++
++ crypto_free_hash(tfm);
++
++ return retval;
++}
+diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
+index 3cd9ccd..fe16d47 100644
+--- a/include/acpi/acpi_bus.h
++++ b/include/acpi/acpi_bus.h
+@@ -107,7 +107,7 @@ struct acpi_device_ops {
+ acpi_op_bind bind;
+ acpi_op_unbind unbind;
+ acpi_op_notify notify;
+-};
++} __no_const;
+
+ #define ACPI_DRIVER_ALL_NOTIFY_EVENTS 0x1 /* system AND device events */
+
+diff --git a/include/acpi/acpi_drivers.h b/include/acpi/acpi_drivers.h
+index f4906f6..71feb73 100644
+--- a/include/acpi/acpi_drivers.h
++++ b/include/acpi/acpi_drivers.h
+@@ -119,8 +119,8 @@ int acpi_processor_set_thermal_limit(acpi_handle handle, int type);
+ Dock Station
+ -------------------------------------------------------------------------- */
+ struct acpi_dock_ops {
+- acpi_notify_handler handler;
+- acpi_notify_handler uevent;
++ const acpi_notify_handler handler;
++ const acpi_notify_handler uevent;
+ };
+
+ #if defined(CONFIG_ACPI_DOCK) || defined(CONFIG_ACPI_DOCK_MODULE)
+@@ -128,7 +128,7 @@ extern int is_dock_device(acpi_handle handle);
+ extern int register_dock_notifier(struct notifier_block *nb);
+ extern void unregister_dock_notifier(struct notifier_block *nb);
+ extern int register_hotplug_dock_device(acpi_handle handle,
+- struct acpi_dock_ops *ops,
++ const struct acpi_dock_ops *ops,
+ void *context);
+ extern void unregister_hotplug_dock_device(acpi_handle handle);
+ #else
+@@ -144,7 +144,7 @@ static inline void unregister_dock_notifier(struct notifier_block *nb)
+ {
+ }
+ static inline int register_hotplug_dock_device(acpi_handle handle,
+- struct acpi_dock_ops *ops,
++ const struct acpi_dock_ops *ops,
+ void *context)
+ {
+ return -ENODEV;
+diff --git a/include/asm-generic/atomic-long.h b/include/asm-generic/atomic-long.h
+index b7babf0..a9ac9fc 100644
+--- a/include/asm-generic/atomic-long.h
++++ b/include/asm-generic/atomic-long.h
+@@ -22,6 +22,12 @@
+
+ typedef atomic64_t atomic_long_t;
+
++#ifdef CONFIG_PAX_REFCOUNT
++typedef atomic64_unchecked_t atomic_long_unchecked_t;
++#else
++typedef atomic64_t atomic_long_unchecked_t;
++#endif
++
+ #define ATOMIC_LONG_INIT(i) ATOMIC64_INIT(i)
+
+ static inline long atomic_long_read(atomic_long_t *l)
+@@ -31,6 +37,15 @@ static inline long atomic_long_read(atomic_long_t *l)
+ return (long)atomic64_read(v);
+ }
+
++#ifdef CONFIG_PAX_REFCOUNT
++static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
++{
++ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
++
++ return (long)atomic64_read_unchecked(v);
++}
++#endif
++
+ static inline void atomic_long_set(atomic_long_t *l, long i)
+ {
+ atomic64_t *v = (atomic64_t *)l;
+@@ -38,6 +53,15 @@ static inline void atomic_long_set(atomic_long_t *l, long i)
+ atomic64_set(v, i);
+ }
+
++#ifdef CONFIG_PAX_REFCOUNT
++static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
++{
++ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
++
++ atomic64_set_unchecked(v, i);
++}
++#endif
++
+ static inline void atomic_long_inc(atomic_long_t *l)
+ {
+ atomic64_t *v = (atomic64_t *)l;
+@@ -45,6 +69,15 @@ static inline void atomic_long_inc(atomic_long_t *l)
+ atomic64_inc(v);
+ }
+
++#ifdef CONFIG_PAX_REFCOUNT
++static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
++{
++ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
++
++ atomic64_inc_unchecked(v);
++}
++#endif
++
+ static inline void atomic_long_dec(atomic_long_t *l)
+ {
+ atomic64_t *v = (atomic64_t *)l;
+@@ -52,6 +85,15 @@ static inline void atomic_long_dec(atomic_long_t *l)
+ atomic64_dec(v);
+ }
+
++#ifdef CONFIG_PAX_REFCOUNT
++static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
++{
++ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
++
++ atomic64_dec_unchecked(v);
++}
++#endif
++
+ static inline void atomic_long_add(long i, atomic_long_t *l)
+ {
+ atomic64_t *v = (atomic64_t *)l;
+@@ -59,6 +101,15 @@ static inline void atomic_long_add(long i, atomic_long_t *l)
+ atomic64_add(i, v);
+ }
+
++#ifdef CONFIG_PAX_REFCOUNT
++static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
++{
++ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
++
++ atomic64_add_unchecked(i, v);
++}
++#endif
++
+ static inline void atomic_long_sub(long i, atomic_long_t *l)
+ {
+ atomic64_t *v = (atomic64_t *)l;
+@@ -115,6 +166,15 @@ static inline long atomic_long_inc_return(atomic_long_t *l)
+ return (long)atomic64_inc_return(v);
+ }
+
++#ifdef CONFIG_PAX_REFCOUNT
++static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
++{
++ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
++
++ return (long)atomic64_inc_return_unchecked(v);
++}
++#endif
++
+ static inline long atomic_long_dec_return(atomic_long_t *l)
+ {
+ atomic64_t *v = (atomic64_t *)l;
+@@ -140,6 +200,12 @@ static inline long atomic_long_add_unless(atomic_long_t *l, long a, long u)
+
+ typedef atomic_t atomic_long_t;
+
++#ifdef CONFIG_PAX_REFCOUNT
++typedef atomic_unchecked_t atomic_long_unchecked_t;
++#else
++typedef atomic_t atomic_long_unchecked_t;
++#endif
++
+ #define ATOMIC_LONG_INIT(i) ATOMIC_INIT(i)
+ static inline long atomic_long_read(atomic_long_t *l)
+ {
+@@ -148,6 +214,15 @@ static inline long atomic_long_read(atomic_long_t *l)
+ return (long)atomic_read(v);
+ }
+
++#ifdef CONFIG_PAX_REFCOUNT
++static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
++{
++ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
++
++ return (long)atomic_read_unchecked(v);
++}
++#endif
++
+ static inline void atomic_long_set(atomic_long_t *l, long i)
+ {
+ atomic_t *v = (atomic_t *)l;
+@@ -155,6 +230,15 @@ static inline void atomic_long_set(atomic_long_t *l, long i)
+ atomic_set(v, i);
+ }
+
++#ifdef CONFIG_PAX_REFCOUNT
++static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
++{
++ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
++
++ atomic_set_unchecked(v, i);
++}
++#endif
++
+ static inline void atomic_long_inc(atomic_long_t *l)
+ {
+ atomic_t *v = (atomic_t *)l;
+@@ -162,6 +246,15 @@ static inline void atomic_long_inc(atomic_long_t *l)
+ atomic_inc(v);
+ }
+
++#ifdef CONFIG_PAX_REFCOUNT
++static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
++{
++ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
++
++ atomic_inc_unchecked(v);
++}
++#endif
++
+ static inline void atomic_long_dec(atomic_long_t *l)
+ {
+ atomic_t *v = (atomic_t *)l;
+@@ -169,6 +262,15 @@ static inline void atomic_long_dec(atomic_long_t *l)
+ atomic_dec(v);
+ }
+
++#ifdef CONFIG_PAX_REFCOUNT
++static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
++{
++ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
++
++ atomic_dec_unchecked(v);
++}
++#endif
++
+ static inline void atomic_long_add(long i, atomic_long_t *l)
+ {
+ atomic_t *v = (atomic_t *)l;
+@@ -176,6 +278,15 @@ static inline void atomic_long_add(long i, atomic_long_t *l)
+ atomic_add(i, v);
+ }
+
++#ifdef CONFIG_PAX_REFCOUNT
++static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
++{
++ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
++
++ atomic_add_unchecked(i, v);
++}
++#endif
++
+ static inline void atomic_long_sub(long i, atomic_long_t *l)
+ {
+ atomic_t *v = (atomic_t *)l;
+@@ -232,6 +343,15 @@ static inline long atomic_long_inc_return(atomic_long_t *l)
+ return (long)atomic_inc_return(v);
+ }
+
++#ifdef CONFIG_PAX_REFCOUNT
++static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
++{
++ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
++
++ return (long)atomic_inc_return_unchecked(v);
++}
++#endif
++
+ static inline long atomic_long_dec_return(atomic_long_t *l)
+ {
+ atomic_t *v = (atomic_t *)l;
+@@ -255,4 +375,47 @@ static inline long atomic_long_add_unless(atomic_long_t *l, long a, long u)
+
+ #endif /* BITS_PER_LONG == 64 */
+
++#ifdef CONFIG_PAX_REFCOUNT
++static inline void pax_refcount_needs_these_functions(void)
++{
++ atomic_read_unchecked((atomic_unchecked_t *)NULL);
++ atomic_set_unchecked((atomic_unchecked_t *)NULL, 0);
++ atomic_add_unchecked(0, (atomic_unchecked_t *)NULL);
++ atomic_sub_unchecked(0, (atomic_unchecked_t *)NULL);
++ atomic_inc_unchecked((atomic_unchecked_t *)NULL);
++ (void)atomic_inc_and_test_unchecked((atomic_unchecked_t *)NULL);
++ atomic_inc_return_unchecked((atomic_unchecked_t *)NULL);
++ atomic_add_return_unchecked(0, (atomic_unchecked_t *)NULL);
++ atomic_dec_unchecked((atomic_unchecked_t *)NULL);
++ atomic_cmpxchg_unchecked((atomic_unchecked_t *)NULL, 0, 0);
++ (void)atomic_xchg_unchecked((atomic_unchecked_t *)NULL, 0);
++
++ atomic_long_read_unchecked((atomic_long_unchecked_t *)NULL);
++ atomic_long_set_unchecked((atomic_long_unchecked_t *)NULL, 0);
++ atomic_long_add_unchecked(0, (atomic_long_unchecked_t *)NULL);
++ atomic_long_inc_unchecked((atomic_long_unchecked_t *)NULL);
++ atomic_long_inc_return_unchecked((atomic_long_unchecked_t *)NULL);
++ atomic_long_dec_unchecked((atomic_long_unchecked_t *)NULL);
++}
++#else
++#define atomic_read_unchecked(v) atomic_read(v)
++#define atomic_set_unchecked(v, i) atomic_set((v), (i))
++#define atomic_add_unchecked(i, v) atomic_add((i), (v))
++#define atomic_sub_unchecked(i, v) atomic_sub((i), (v))
++#define atomic_inc_unchecked(v) atomic_inc(v)
++#define atomic_inc_and_test_unchecked(v) atomic_inc_and_test(v)
++#define atomic_inc_return_unchecked(v) atomic_inc_return(v)
++#define atomic_add_return_unchecked(i, v) atomic_add_return((i), (v))
++#define atomic_dec_unchecked(v) atomic_dec(v)
++#define atomic_cmpxchg_unchecked(v, o, n) atomic_cmpxchg((v), (o), (n))
++#define atomic_xchg_unchecked(v, i) atomic_xchg((v), (i))
++
++#define atomic_long_read_unchecked(v) atomic_long_read(v)
++#define atomic_long_set_unchecked(v, i) atomic_long_set((v), (i))
++#define atomic_long_add_unchecked(i, v) atomic_long_add((i), (v))
++#define atomic_long_inc_unchecked(v) atomic_long_inc(v)
++#define atomic_long_inc_return_unchecked(v) atomic_long_inc_return(v)
++#define atomic_long_dec_unchecked(v) atomic_long_dec(v)
++#endif
++
+ #endif /* _ASM_GENERIC_ATOMIC_LONG_H */
+diff --git a/include/asm-generic/atomic64.h b/include/asm-generic/atomic64.h
+index b18ce4f..2ee2843 100644
+--- a/include/asm-generic/atomic64.h
++++ b/include/asm-generic/atomic64.h
+@@ -16,6 +16,8 @@ typedef struct {
+ long long counter;
+ } atomic64_t;
+
++typedef atomic64_t atomic64_unchecked_t;
++
+ #define ATOMIC64_INIT(i) { (i) }
+
+ extern long long atomic64_read(const atomic64_t *v);
+@@ -39,4 +41,14 @@ extern int atomic64_add_unless(atomic64_t *v, long long a, long long u);
+ #define atomic64_dec_and_test(v) (atomic64_dec_return((v)) == 0)
+ #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1LL, 0LL)
+
++#define atomic64_read_unchecked(v) atomic64_read(v)
++#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
++#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
++#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
++#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
++#define atomic64_inc_unchecked(v) atomic64_inc(v)
++#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
++#define atomic64_dec_unchecked(v) atomic64_dec(v)
++#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
++
+ #endif /* _ASM_GENERIC_ATOMIC64_H */
+diff --git a/include/asm-generic/bug.h b/include/asm-generic/bug.h
+index d48ddf0..656a0ac 100644
+--- a/include/asm-generic/bug.h
++++ b/include/asm-generic/bug.h
+@@ -105,11 +105,11 @@ extern void warn_slowpath_null(const char *file, const int line);
+
+ #else /* !CONFIG_BUG */
+ #ifndef HAVE_ARCH_BUG
+-#define BUG() do {} while(0)
++#define BUG() do { for (;;) ; } while(0)
+ #endif
+
+ #ifndef HAVE_ARCH_BUG_ON
+-#define BUG_ON(condition) do { if (condition) ; } while(0)
++#define BUG_ON(condition) do { if (condition) for (;;) ; } while(0)
+ #endif
+
+ #ifndef HAVE_ARCH_WARN_ON
+diff --git a/include/asm-generic/cache.h b/include/asm-generic/cache.h
+index 1bfcfe5..e04c5c9 100644
+--- a/include/asm-generic/cache.h
++++ b/include/asm-generic/cache.h
+@@ -6,7 +6,7 @@
+ * cache lines need to provide their own cache.h.
+ */
+
+-#define L1_CACHE_SHIFT 5
+-#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
++#define L1_CACHE_SHIFT 5UL
++#define L1_CACHE_BYTES (1UL << L1_CACHE_SHIFT)
+
+ #endif /* __ASM_GENERIC_CACHE_H */
+diff --git a/include/asm-generic/dma-mapping-common.h b/include/asm-generic/dma-mapping-common.h
+index 6920695..41038bc 100644
+--- a/include/asm-generic/dma-mapping-common.h
++++ b/include/asm-generic/dma-mapping-common.h
+@@ -11,7 +11,7 @@ static inline dma_addr_t dma_map_single_attrs(struct device *dev, void *ptr,
+ enum dma_data_direction dir,
+ struct dma_attrs *attrs)
+ {
+- struct dma_map_ops *ops = get_dma_ops(dev);
++ const struct dma_map_ops *ops = get_dma_ops(dev);
+ dma_addr_t addr;
+
+ kmemcheck_mark_initialized(ptr, size);
+@@ -30,7 +30,7 @@ static inline void dma_unmap_single_attrs(struct device *dev, dma_addr_t addr,
+ enum dma_data_direction dir,
+ struct dma_attrs *attrs)
+ {
+- struct dma_map_ops *ops = get_dma_ops(dev);
++ const struct dma_map_ops *ops = get_dma_ops(dev);
+
+ BUG_ON(!valid_dma_direction(dir));
+ if (ops->unmap_page)
+@@ -42,7 +42,7 @@ static inline int dma_map_sg_attrs(struct device *dev, struct scatterlist *sg,
+ int nents, enum dma_data_direction dir,
+ struct dma_attrs *attrs)
+ {
+- struct dma_map_ops *ops = get_dma_ops(dev);
++ const struct dma_map_ops *ops = get_dma_ops(dev);
+ int i, ents;
+ struct scatterlist *s;
+
+@@ -59,7 +59,7 @@ static inline void dma_unmap_sg_attrs(struct device *dev, struct scatterlist *sg
+ int nents, enum dma_data_direction dir,
+ struct dma_attrs *attrs)
+ {
+- struct dma_map_ops *ops = get_dma_ops(dev);
++ const struct dma_map_ops *ops = get_dma_ops(dev);
+
+ BUG_ON(!valid_dma_direction(dir));
+ debug_dma_unmap_sg(dev, sg, nents, dir);
+@@ -71,7 +71,7 @@ static inline dma_addr_t dma_map_page(struct device *dev, struct page *page,
+ size_t offset, size_t size,
+ enum dma_data_direction dir)
+ {
+- struct dma_map_ops *ops = get_dma_ops(dev);
++ const struct dma_map_ops *ops = get_dma_ops(dev);
+ dma_addr_t addr;
+
+ kmemcheck_mark_initialized(page_address(page) + offset, size);
+@@ -85,7 +85,7 @@ static inline dma_addr_t dma_map_page(struct device *dev, struct page *page,
+ static inline void dma_unmap_page(struct device *dev, dma_addr_t addr,
+ size_t size, enum dma_data_direction dir)
+ {
+- struct dma_map_ops *ops = get_dma_ops(dev);
++ const struct dma_map_ops *ops = get_dma_ops(dev);
+
+ BUG_ON(!valid_dma_direction(dir));
+ if (ops->unmap_page)
+@@ -97,7 +97,7 @@ static inline void dma_sync_single_for_cpu(struct device *dev, dma_addr_t addr,
+ size_t size,
+ enum dma_data_direction dir)
+ {
+- struct dma_map_ops *ops = get_dma_ops(dev);
++ const struct dma_map_ops *ops = get_dma_ops(dev);
+
+ BUG_ON(!valid_dma_direction(dir));
+ if (ops->sync_single_for_cpu)
+@@ -109,7 +109,7 @@ static inline void dma_sync_single_for_device(struct device *dev,
+ dma_addr_t addr, size_t size,
+ enum dma_data_direction dir)
+ {
+- struct dma_map_ops *ops = get_dma_ops(dev);
++ const struct dma_map_ops *ops = get_dma_ops(dev);
+
+ BUG_ON(!valid_dma_direction(dir));
+ if (ops->sync_single_for_device)
+@@ -123,7 +123,7 @@ static inline void dma_sync_single_range_for_cpu(struct device *dev,
+ size_t size,
+ enum dma_data_direction dir)
+ {
+- struct dma_map_ops *ops = get_dma_ops(dev);
++ const struct dma_map_ops *ops = get_dma_ops(dev);
+
+ BUG_ON(!valid_dma_direction(dir));
+ if (ops->sync_single_range_for_cpu) {
+@@ -140,7 +140,7 @@ static inline void dma_sync_single_range_for_device(struct device *dev,
+ size_t size,
+ enum dma_data_direction dir)
+ {
+- struct dma_map_ops *ops = get_dma_ops(dev);
++ const struct dma_map_ops *ops = get_dma_ops(dev);
+
+ BUG_ON(!valid_dma_direction(dir));
+ if (ops->sync_single_range_for_device) {
+@@ -155,7 +155,7 @@ static inline void
+ dma_sync_sg_for_cpu(struct device *dev, struct scatterlist *sg,
+ int nelems, enum dma_data_direction dir)
+ {
+- struct dma_map_ops *ops = get_dma_ops(dev);
++ const struct dma_map_ops *ops = get_dma_ops(dev);
+
+ BUG_ON(!valid_dma_direction(dir));
+ if (ops->sync_sg_for_cpu)
+@@ -167,7 +167,7 @@ static inline void
+ dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg,
+ int nelems, enum dma_data_direction dir)
+ {
+- struct dma_map_ops *ops = get_dma_ops(dev);
++ const struct dma_map_ops *ops = get_dma_ops(dev);
+
+ BUG_ON(!valid_dma_direction(dir));
+ if (ops->sync_sg_for_device)
+diff --git a/include/asm-generic/emergency-restart.h b/include/asm-generic/emergency-restart.h
+index 0d68a1e..b74a761 100644
+--- a/include/asm-generic/emergency-restart.h
++++ b/include/asm-generic/emergency-restart.h
+@@ -1,7 +1,7 @@
+ #ifndef _ASM_GENERIC_EMERGENCY_RESTART_H
+ #define _ASM_GENERIC_EMERGENCY_RESTART_H
+
+-static inline void machine_emergency_restart(void)
++static inline __noreturn void machine_emergency_restart(void)
+ {
+ machine_restart(NULL);
+ }
+diff --git a/include/asm-generic/futex.h b/include/asm-generic/futex.h
+index 3c2344f..4590a7d 100644
+--- a/include/asm-generic/futex.h
++++ b/include/asm-generic/futex.h
+@@ -6,7 +6,7 @@
+ #include <asm/errno.h>
+
+ static inline int
+-futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
++futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
+ {
+ int op = (encoded_op >> 28) & 7;
+ int cmp = (encoded_op >> 24) & 15;
+@@ -48,7 +48,7 @@ futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
+ }
+
+ static inline int
+-futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval, int newval)
++futex_atomic_cmpxchg_inatomic(u32 __user *uaddr, int oldval, int newval)
+ {
+ return -ENOSYS;
+ }
+diff --git a/include/asm-generic/kmap_types.h b/include/asm-generic/kmap_types.h
+index e5f234a..cdb16b3 100644
+--- a/include/asm-generic/kmap_types.h
++++ b/include/asm-generic/kmap_types.h
+@@ -28,7 +28,8 @@ KMAP_D(15) KM_UML_USERCOPY,
+ KMAP_D(16) KM_IRQ_PTE,
+ KMAP_D(17) KM_NMI,
+ KMAP_D(18) KM_NMI_PTE,
+-KMAP_D(19) KM_TYPE_NR
++KMAP_D(19) KM_CLEARPAGE,
++KMAP_D(20) KM_TYPE_NR
+ };
+
+ #undef KMAP_D
+diff --git a/include/asm-generic/local.h b/include/asm-generic/local.h
+index fc21844..2ee9629 100644
+--- a/include/asm-generic/local.h
++++ b/include/asm-generic/local.h
+@@ -39,6 +39,7 @@ typedef struct
+ #define local_add_return(i, l) atomic_long_add_return((i), (&(l)->a))
+ #define local_sub_return(i, l) atomic_long_sub_return((i), (&(l)->a))
+ #define local_inc_return(l) atomic_long_inc_return(&(l)->a)
++#define local_dec_return(l) atomic_long_dec_return(&(l)->a)
+
+ #define local_cmpxchg(l, o, n) atomic_long_cmpxchg((&(l)->a), (o), (n))
+ #define local_xchg(l, n) atomic_long_xchg((&(l)->a), (n))
+diff --git a/include/asm-generic/pgtable-nopmd.h b/include/asm-generic/pgtable-nopmd.h
+index 725612b..9cc513a 100644
+--- a/include/asm-generic/pgtable-nopmd.h
++++ b/include/asm-generic/pgtable-nopmd.h
+@@ -1,14 +1,19 @@
+ #ifndef _PGTABLE_NOPMD_H
+ #define _PGTABLE_NOPMD_H
+
+-#ifndef __ASSEMBLY__
+-
+ #include <asm-generic/pgtable-nopud.h>
+
+-struct mm_struct;
+-
+ #define __PAGETABLE_PMD_FOLDED
+
++#define PMD_SHIFT PUD_SHIFT
++#define PTRS_PER_PMD 1
++#define PMD_SIZE (_AC(1,UL) << PMD_SHIFT)
++#define PMD_MASK (~(PMD_SIZE-1))
++
++#ifndef __ASSEMBLY__
++
++struct mm_struct;
++
+ /*
+ * Having the pmd type consist of a pud gets the size right, and allows
+ * us to conceptually access the pud entry that this pmd is folded into
+@@ -16,11 +21,6 @@ struct mm_struct;
+ */
+ typedef struct { pud_t pud; } pmd_t;
+
+-#define PMD_SHIFT PUD_SHIFT
+-#define PTRS_PER_PMD 1
+-#define PMD_SIZE (1UL << PMD_SHIFT)
+-#define PMD_MASK (~(PMD_SIZE-1))
+-
+ /*
+ * The "pud_xxx()" functions here are trivial for a folded two-level
+ * setup: the pmd is never bad, and a pmd always exists (as it's folded
+diff --git a/include/asm-generic/pgtable-nopud.h b/include/asm-generic/pgtable-nopud.h
+index 810431d..0ec4804f 100644
+--- a/include/asm-generic/pgtable-nopud.h
++++ b/include/asm-generic/pgtable-nopud.h
+@@ -1,10 +1,15 @@
+ #ifndef _PGTABLE_NOPUD_H
+ #define _PGTABLE_NOPUD_H
+
+-#ifndef __ASSEMBLY__
+-
+ #define __PAGETABLE_PUD_FOLDED
+
++#define PUD_SHIFT PGDIR_SHIFT
++#define PTRS_PER_PUD 1
++#define PUD_SIZE (_AC(1,UL) << PUD_SHIFT)
++#define PUD_MASK (~(PUD_SIZE-1))
++
++#ifndef __ASSEMBLY__
++
+ /*
+ * Having the pud type consist of a pgd gets the size right, and allows
+ * us to conceptually access the pgd entry that this pud is folded into
+@@ -12,11 +17,6 @@
+ */
+ typedef struct { pgd_t pgd; } pud_t;
+
+-#define PUD_SHIFT PGDIR_SHIFT
+-#define PTRS_PER_PUD 1
+-#define PUD_SIZE (1UL << PUD_SHIFT)
+-#define PUD_MASK (~(PUD_SIZE-1))
+-
+ /*
+ * The "pgd_xxx()" functions here are trivial for a folded two-level
+ * setup: the pud is never bad, and a pud always exists (as it's folded
+@@ -29,6 +29,7 @@ static inline void pgd_clear(pgd_t *pgd) { }
+ #define pud_ERROR(pud) (pgd_ERROR((pud).pgd))
+
+ #define pgd_populate(mm, pgd, pud) do { } while (0)
++#define pgd_populate_kernel(mm, pgd, pud) do { } while (0)
+ /*
+ * (puds are folded into pgds so this doesn't get actually called,
+ * but the define is needed for a generic inline function.)
+diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
+index e2bd73e..fea8ed3 100644
+--- a/include/asm-generic/pgtable.h
++++ b/include/asm-generic/pgtable.h
+@@ -344,6 +344,14 @@ extern void untrack_pfn_vma(struct vm_area_struct *vma, unsigned long pfn,
+ unsigned long size);
+ #endif
+
++#ifndef __HAVE_ARCH_PAX_OPEN_KERNEL
++static inline unsigned long pax_open_kernel(void) { return 0; }
++#endif
++
++#ifndef __HAVE_ARCH_PAX_CLOSE_KERNEL
++static inline unsigned long pax_close_kernel(void) { return 0; }
++#endif
++
+ #endif /* !__ASSEMBLY__ */
+
+ #endif /* _ASM_GENERIC_PGTABLE_H */
+diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
+index b6e818f..21aa58a 100644
+--- a/include/asm-generic/vmlinux.lds.h
++++ b/include/asm-generic/vmlinux.lds.h
+@@ -199,6 +199,7 @@
+ .rodata : AT(ADDR(.rodata) - LOAD_OFFSET) { \
+ VMLINUX_SYMBOL(__start_rodata) = .; \
+ *(.rodata) *(.rodata.*) \
++ *(.data.read_only) \
+ *(__vermagic) /* Kernel version magic */ \
+ *(__markers_strings) /* Markers: strings */ \
+ *(__tracepoints_strings)/* Tracepoints: strings */ \
+@@ -656,22 +657,24 @@
+ * section in the linker script will go there too. @phdr should have
+ * a leading colon.
+ *
+- * Note that this macros defines __per_cpu_load as an absolute symbol.
++ * Note that this macros defines per_cpu_load as an absolute symbol.
+ * If there is no need to put the percpu section at a predetermined
+ * address, use PERCPU().
+ */
+ #define PERCPU_VADDR(vaddr, phdr) \
+- VMLINUX_SYMBOL(__per_cpu_load) = .; \
+- .data.percpu vaddr : AT(VMLINUX_SYMBOL(__per_cpu_load) \
++ per_cpu_load = .; \
++ .data.percpu vaddr : AT(VMLINUX_SYMBOL(per_cpu_load) \
+ - LOAD_OFFSET) { \
++ VMLINUX_SYMBOL(__per_cpu_load) = . + per_cpu_load; \
+ VMLINUX_SYMBOL(__per_cpu_start) = .; \
+ *(.data.percpu.first) \
+- *(.data.percpu.page_aligned) \
+ *(.data.percpu) \
++ . = ALIGN(PAGE_SIZE); \
++ *(.data.percpu.page_aligned) \
+ *(.data.percpu.shared_aligned) \
+ VMLINUX_SYMBOL(__per_cpu_end) = .; \
+ } phdr \
+- . = VMLINUX_SYMBOL(__per_cpu_load) + SIZEOF(.data.percpu);
++ . = VMLINUX_SYMBOL(per_cpu_load) + SIZEOF(.data.percpu);
+
+ /**
+ * PERCPU - define output section for percpu area, simple version
+diff --git a/include/drm/drmP.h b/include/drm/drmP.h
+index ebab6a6..351dba1 100644
+--- a/include/drm/drmP.h
++++ b/include/drm/drmP.h
+@@ -71,6 +71,7 @@
+ #include <linux/workqueue.h>
+ #include <linux/poll.h>
+ #include <asm/pgalloc.h>
++#include <asm/local.h>
+ #include "drm.h"
+
+ #include <linux/idr.h>
+@@ -814,7 +815,7 @@ struct drm_driver {
+ void (*vgaarb_irq)(struct drm_device *dev, bool state);
+
+ /* Driver private ops for this object */
+- struct vm_operations_struct *gem_vm_ops;
++ const struct vm_operations_struct *gem_vm_ops;
+
+ int major;
+ int minor;
+@@ -917,7 +918,7 @@ struct drm_device {
+
+ /** \name Usage Counters */
+ /*@{ */
+- int open_count; /**< Outstanding files open */
++ local_t open_count; /**< Outstanding files open */
+ atomic_t ioctl_count; /**< Outstanding IOCTLs pending */
+ atomic_t vma_count; /**< Outstanding vma areas open */
+ int buf_use; /**< Buffers in use -- cannot alloc */
+@@ -928,7 +929,7 @@ struct drm_device {
+ /*@{ */
+ unsigned long counters;
+ enum drm_stat_type types[15];
+- atomic_t counts[15];
++ atomic_unchecked_t counts[15];
+ /*@} */
+
+ struct list_head filelist;
+@@ -1016,7 +1017,7 @@ struct drm_device {
+ struct pci_controller *hose;
+ #endif
+ struct drm_sg_mem *sg; /**< Scatter gather memory */
+- unsigned int num_crtcs; /**< Number of CRTCs on this device */
++ unsigned int num_crtcs; /**< Number of CRTCs on this device */
+ void *dev_private; /**< device private data */
+ void *mm_private;
+ struct address_space *dev_mapping;
+@@ -1042,11 +1043,11 @@ struct drm_device {
+ spinlock_t object_name_lock;
+ struct idr object_name_idr;
+ atomic_t object_count;
+- atomic_t object_memory;
++ atomic_unchecked_t object_memory;
+ atomic_t pin_count;
+- atomic_t pin_memory;
++ atomic_unchecked_t pin_memory;
+ atomic_t gtt_count;
+- atomic_t gtt_memory;
++ atomic_unchecked_t gtt_memory;
+ uint32_t gtt_total;
+ uint32_t invalidate_domains; /* domains pending invalidation */
+ uint32_t flush_domains; /* domains pending flush */
+diff --git a/include/drm/drm_crtc_helper.h b/include/drm/drm_crtc_helper.h
+index b29e201..3413cc9 100644
+--- a/include/drm/drm_crtc_helper.h
++++ b/include/drm/drm_crtc_helper.h
+@@ -64,7 +64,7 @@ struct drm_crtc_helper_funcs {
+
+ /* reload the current crtc LUT */
+ void (*load_lut)(struct drm_crtc *crtc);
+-};
++} __no_const;
+
+ struct drm_encoder_helper_funcs {
+ void (*dpms)(struct drm_encoder *encoder, int mode);
+@@ -85,7 +85,7 @@ struct drm_encoder_helper_funcs {
+ struct drm_connector *connector);
+ /* disable encoder when not in use - more explicit than dpms off */
+ void (*disable)(struct drm_encoder *encoder);
+-};
++} __no_const;
+
+ struct drm_connector_helper_funcs {
+ int (*get_modes)(struct drm_connector *connector);
+diff --git a/include/drm/ttm/ttm_memory.h b/include/drm/ttm/ttm_memory.h
+index b199170..6f9e64c 100644
+--- a/include/drm/ttm/ttm_memory.h
++++ b/include/drm/ttm/ttm_memory.h
+@@ -47,7 +47,7 @@
+
+ struct ttm_mem_shrink {
+ int (*do_shrink) (struct ttm_mem_shrink *);
+-};
++} __no_const;
+
+ /**
+ * struct ttm_mem_global - Global memory accounting structure.
+diff --git a/include/linux/a.out.h b/include/linux/a.out.h
+index e86dfca..40cc55f 100644
+--- a/include/linux/a.out.h
++++ b/include/linux/a.out.h
+@@ -39,6 +39,14 @@ enum machine_type {
+ M_MIPS2 = 152 /* MIPS R6000/R4000 binary */
+ };
+
++/* Constants for the N_FLAGS field */
++#define F_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
++#define F_PAX_EMUTRAMP 2 /* Emulate trampolines */
++#define F_PAX_MPROTECT 4 /* Restrict mprotect() */
++#define F_PAX_RANDMMAP 8 /* Randomize mmap() base */
++/*#define F_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
++#define F_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
++
+ #if !defined (N_MAGIC)
+ #define N_MAGIC(exec) ((exec).a_info & 0xffff)
+ #endif
+diff --git a/include/linux/atmdev.h b/include/linux/atmdev.h
+index 817b237..62c10bc 100644
+--- a/include/linux/atmdev.h
++++ b/include/linux/atmdev.h
+@@ -237,7 +237,7 @@ struct compat_atm_iobuf {
+ #endif
+
+ struct k_atm_aal_stats {
+-#define __HANDLE_ITEM(i) atomic_t i
++#define __HANDLE_ITEM(i) atomic_unchecked_t i
+ __AAL_STAT_ITEMS
+ #undef __HANDLE_ITEM
+ };
+diff --git a/include/linux/backlight.h b/include/linux/backlight.h
+index 0f5f578..8c4f884 100644
+--- a/include/linux/backlight.h
++++ b/include/linux/backlight.h
+@@ -36,18 +36,18 @@ struct backlight_device;
+ struct fb_info;
+
+ struct backlight_ops {
+- unsigned int options;
++ const unsigned int options;
+
+ #define BL_CORE_SUSPENDRESUME (1 << 0)
+
+ /* Notify the backlight driver some property has changed */
+- int (*update_status)(struct backlight_device *);
++ int (* const update_status)(struct backlight_device *);
+ /* Return the current backlight brightness (accounting for power,
+ fb_blank etc.) */
+- int (*get_brightness)(struct backlight_device *);
++ int (* const get_brightness)(struct backlight_device *);
+ /* Check if given framebuffer device is the one bound to this backlight;
+ return 0 if not, !=0 if it is. If NULL, backlight always matches the fb. */
+- int (*check_fb)(struct fb_info *);
++ int (* const check_fb)(struct fb_info *);
+ };
+
+ /* This structure defines all the properties of a backlight */
+@@ -86,7 +86,7 @@ struct backlight_device {
+ registered this device has been unloaded, and if class_get_devdata()
+ points to something in the body of that driver, it is also invalid. */
+ struct mutex ops_lock;
+- struct backlight_ops *ops;
++ const struct backlight_ops *ops;
+
+ /* The framebuffer notifier block */
+ struct notifier_block fb_notif;
+@@ -103,7 +103,7 @@ static inline void backlight_update_status(struct backlight_device *bd)
+ }
+
+ extern struct backlight_device *backlight_device_register(const char *name,
+- struct device *dev, void *devdata, struct backlight_ops *ops);
++ struct device *dev, void *devdata, const struct backlight_ops *ops);
+ extern void backlight_device_unregister(struct backlight_device *bd);
+ extern void backlight_force_update(struct backlight_device *bd,
+ enum backlight_update_reason reason);
+diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
+index a3d802e..93a2ef4 100644
+--- a/include/linux/binfmts.h
++++ b/include/linux/binfmts.h
+@@ -18,7 +18,7 @@ struct pt_regs;
+ #define BINPRM_BUF_SIZE 128
+
+ #ifdef __KERNEL__
+-#include <linux/list.h>
++#include <linux/sched.h>
+
+ #define CORENAME_MAX_SIZE 128
+
+@@ -58,6 +58,7 @@ struct linux_binprm{
+ unsigned interp_flags;
+ unsigned interp_data;
+ unsigned long loader, exec;
++ char tcomm[TASK_COMM_LEN];
+ };
+
+ extern void acct_arg_size(struct linux_binprm *bprm, unsigned long pages);
+@@ -83,6 +84,7 @@ struct linux_binfmt {
+ int (*load_binary)(struct linux_binprm *, struct pt_regs * regs);
+ int (*load_shlib)(struct file *);
+ int (*core_dump)(long signr, struct pt_regs *regs, struct file *file, unsigned long limit);
++ void (*handle_mprotect)(struct vm_area_struct *vma, unsigned long newflags);
+ unsigned long min_coredump; /* minimal dump size */
+ int hasvdso;
+ };
+diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
+index 5eb6cb0..a2906d2 100644
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -1281,7 +1281,7 @@ struct block_device_operations {
+ int (*revalidate_disk) (struct gendisk *);
+ int (*getgeo)(struct block_device *, struct hd_geometry *);
+ struct module *owner;
+-};
++} __do_const;
+
+ extern int __blkdev_driver_ioctl(struct block_device *, fmode_t, unsigned int,
+ unsigned long);
+diff --git a/include/linux/blktrace_api.h b/include/linux/blktrace_api.h
+index 3b73b99..629d21b 100644
+--- a/include/linux/blktrace_api.h
++++ b/include/linux/blktrace_api.h
+@@ -160,7 +160,7 @@ struct blk_trace {
+ struct dentry *dir;
+ struct dentry *dropped_file;
+ struct dentry *msg_file;
+- atomic_t dropped;
++ atomic_unchecked_t dropped;
+ };
+
+ extern int blk_trace_ioctl(struct block_device *, unsigned, char __user *);
+diff --git a/include/linux/byteorder/little_endian.h b/include/linux/byteorder/little_endian.h
+index 83195fb..0b0f77d 100644
+--- a/include/linux/byteorder/little_endian.h
++++ b/include/linux/byteorder/little_endian.h
+@@ -42,51 +42,51 @@
+
+ static inline __le64 __cpu_to_le64p(const __u64 *p)
+ {
+- return (__force __le64)*p;
++ return (__force const __le64)*p;
+ }
+ static inline __u64 __le64_to_cpup(const __le64 *p)
+ {
+- return (__force __u64)*p;
++ return (__force const __u64)*p;
+ }
+ static inline __le32 __cpu_to_le32p(const __u32 *p)
+ {
+- return (__force __le32)*p;
++ return (__force const __le32)*p;
+ }
+ static inline __u32 __le32_to_cpup(const __le32 *p)
+ {
+- return (__force __u32)*p;
++ return (__force const __u32)*p;
+ }
+ static inline __le16 __cpu_to_le16p(const __u16 *p)
+ {
+- return (__force __le16)*p;
++ return (__force const __le16)*p;
+ }
+ static inline __u16 __le16_to_cpup(const __le16 *p)
+ {
+- return (__force __u16)*p;
++ return (__force const __u16)*p;
+ }
+ static inline __be64 __cpu_to_be64p(const __u64 *p)
+ {
+- return (__force __be64)__swab64p(p);
++ return (__force const __be64)__swab64p(p);
+ }
+ static inline __u64 __be64_to_cpup(const __be64 *p)
+ {
+- return __swab64p((__u64 *)p);
++ return __swab64p((const __u64 *)p);
+ }
+ static inline __be32 __cpu_to_be32p(const __u32 *p)
+ {
+- return (__force __be32)__swab32p(p);
++ return (__force const __be32)__swab32p(p);
+ }
+ static inline __u32 __be32_to_cpup(const __be32 *p)
+ {
+- return __swab32p((__u32 *)p);
++ return __swab32p((const __u32 *)p);
+ }
+ static inline __be16 __cpu_to_be16p(const __u16 *p)
+ {
+- return (__force __be16)__swab16p(p);
++ return (__force const __be16)__swab16p(p);
+ }
+ static inline __u16 __be16_to_cpup(const __be16 *p)
+ {
+- return __swab16p((__u16 *)p);
++ return __swab16p((const __u16 *)p);
+ }
+ #define __cpu_to_le64s(x) do { (void)(x); } while (0)
+ #define __le64_to_cpus(x) do { (void)(x); } while (0)
+diff --git a/include/linux/cache.h b/include/linux/cache.h
+index 97e2488..e7576b9 100644
+--- a/include/linux/cache.h
++++ b/include/linux/cache.h
+@@ -16,6 +16,10 @@
+ #define __read_mostly
+ #endif
+
++#ifndef __read_only
++#define __read_only __read_mostly
++#endif
++
+ #ifndef ____cacheline_aligned
+ #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
+ #endif
+diff --git a/include/linux/capability.h b/include/linux/capability.h
+index c8f2a5f7..1618a5c 100644
+--- a/include/linux/capability.h
++++ b/include/linux/capability.h
+@@ -563,6 +563,7 @@ extern const kernel_cap_t __cap_init_eff_set;
+ (security_real_capable_noaudit((t), (cap)) == 0)
+
+ extern int capable(int cap);
++int capable_nolog(int cap);
+
+ /* audit system wants to get cap info from files as well */
+ struct dentry;
+diff --git a/include/linux/compiler-gcc4.h b/include/linux/compiler-gcc4.h
+index 450fa59..246fa19 100644
+--- a/include/linux/compiler-gcc4.h
++++ b/include/linux/compiler-gcc4.h
+@@ -14,6 +14,9 @@
+ #define __compiler_offsetof(a,b) __builtin_offsetof(a,b)
+ #define __always_inline inline __attribute__((always_inline))
+
++#ifdef SIZE_OVERFLOW_PLUGIN
++#define __size_overflow(...) __attribute__((size_overflow(__VA_ARGS__)))
++#endif
+ /*
+ * A trick to suppress uninitialized variable warning without generating any
+ * code
+@@ -36,4 +39,16 @@
+ the kernel context */
+ #define __cold __attribute__((__cold__))
+
++#define __alloc_size(...) __attribute((alloc_size(__VA_ARGS__)))
++#define __bos(ptr, arg) __builtin_object_size((ptr), (arg))
++#define __bos0(ptr) __bos((ptr), 0)
++#define __bos1(ptr) __bos((ptr), 1)
++
++#if __GNUC_MINOR__ >= 5
++#ifdef CONSTIFY_PLUGIN
++#define __no_const __attribute__((no_const))
++#define __do_const __attribute__((do_const))
++#endif
++#endif
++
+ #endif
+diff --git a/include/linux/compiler.h b/include/linux/compiler.h
+index 04fb513..6189f3b 100644
+--- a/include/linux/compiler.h
++++ b/include/linux/compiler.h
+@@ -5,11 +5,14 @@
+
+ #ifdef __CHECKER__
+ # define __user __attribute__((noderef, address_space(1)))
++# define __force_user __force __user
+ # define __kernel /* default address space */
++# define __force_kernel __force __kernel
+ # define __safe __attribute__((safe))
+ # define __force __attribute__((force))
+ # define __nocast __attribute__((nocast))
+ # define __iomem __attribute__((noderef, address_space(2)))
++# define __force_iomem __force __iomem
+ # define __acquires(x) __attribute__((context(x,0,1)))
+ # define __releases(x) __attribute__((context(x,1,0)))
+ # define __acquire(x) __context__(x,1)
+@@ -17,13 +20,34 @@
+ # define __cond_lock(x,c) ((c) ? ({ __acquire(x); 1; }) : 0)
+ extern void __chk_user_ptr(const volatile void __user *);
+ extern void __chk_io_ptr(const volatile void __iomem *);
++#elif defined(CHECKER_PLUGIN)
++//# define __user
++//# define __force_user
++//# define __kernel
++//# define __force_kernel
++# define __safe
++# define __force
++# define __nocast
++# define __iomem
++# define __force_iomem
++# define __chk_user_ptr(x) (void)0
++# define __chk_io_ptr(x) (void)0
++# define __builtin_warning(x, y...) (1)
++# define __acquires(x)
++# define __releases(x)
++# define __acquire(x) (void)0
++# define __release(x) (void)0
++# define __cond_lock(x,c) (c)
+ #else
+ # define __user
++# define __force_user
+ # define __kernel
++# define __force_kernel
+ # define __safe
+ # define __force
+ # define __nocast
+ # define __iomem
++# define __force_iomem
+ # define __chk_user_ptr(x) (void)0
+ # define __chk_io_ptr(x) (void)0
+ # define __builtin_warning(x, y...) (1)
+@@ -247,6 +271,17 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
+ # define __attribute_const__ /* unimplemented */
+ #endif
+
++#ifndef __no_const
++# define __no_const
++#endif
++
++#ifndef __do_const
++# define __do_const
++#endif
++
++#ifndef __size_overflow
++# define __size_overflow(...)
++#endif
+ /*
+ * Tell gcc if a function is cold. The compiler will assume any path
+ * directly leading to the call is unlikely.
+@@ -256,6 +291,22 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
+ #define __cold
+ #endif
+
++#ifndef __alloc_size
++#define __alloc_size(...)
++#endif
++
++#ifndef __bos
++#define __bos(ptr, arg)
++#endif
++
++#ifndef __bos0
++#define __bos0(ptr)
++#endif
++
++#ifndef __bos1
++#define __bos1(ptr)
++#endif
++
+ /* Simple shorthand for a section definition */
+ #ifndef __section
+ # define __section(S) __attribute__ ((__section__(#S)))
+@@ -278,6 +329,7 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
+ * use is to mediate communication between process-level code and irq/NMI
+ * handlers, all running on the same CPU.
+ */
+-#define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x))
++#define ACCESS_ONCE(x) (*(volatile const typeof(x) *)&(x))
++#define ACCESS_ONCE_RW(x) (*(volatile typeof(x) *)&(x))
+
+ #endif /* __LINUX_COMPILER_H */
+diff --git a/include/linux/crypto.h b/include/linux/crypto.h
+index fd92988..a3164bd 100644
+--- a/include/linux/crypto.h
++++ b/include/linux/crypto.h
+@@ -394,7 +394,7 @@ struct cipher_tfm {
+ const u8 *key, unsigned int keylen);
+ void (*cit_encrypt_one)(struct crypto_tfm *tfm, u8 *dst, const u8 *src);
+ void (*cit_decrypt_one)(struct crypto_tfm *tfm, u8 *dst, const u8 *src);
+-};
++} __no_const;
+
+ struct hash_tfm {
+ int (*init)(struct hash_desc *desc);
+@@ -415,13 +415,13 @@ struct compress_tfm {
+ int (*cot_decompress)(struct crypto_tfm *tfm,
+ const u8 *src, unsigned int slen,
+ u8 *dst, unsigned int *dlen);
+-};
++} __no_const;
+
+ struct rng_tfm {
+ int (*rng_gen_random)(struct crypto_rng *tfm, u8 *rdata,
+ unsigned int dlen);
+ int (*rng_reset)(struct crypto_rng *tfm, u8 *seed, unsigned int slen);
+-};
++} __no_const;
+
+ #define crt_ablkcipher crt_u.ablkcipher
+ #define crt_aead crt_u.aead
+diff --git a/include/linux/dcache.h b/include/linux/dcache.h
+index 30b93b2..cd7a8db 100644
+--- a/include/linux/dcache.h
++++ b/include/linux/dcache.h
+@@ -119,6 +119,8 @@ struct dentry {
+ unsigned char d_iname[DNAME_INLINE_LEN_MIN]; /* small names */
+ };
+
++#define DNAME_INLINE_LEN (sizeof(struct dentry)-offsetof(struct dentry,d_iname))
++
+ /*
+ * dentry->d_lock spinlock nesting subclasses:
+ *
+diff --git a/include/linux/decompress/mm.h b/include/linux/decompress/mm.h
+index 3e9bd6a..f4e1aa0 100644
+--- a/include/linux/decompress/mm.h
++++ b/include/linux/decompress/mm.h
+@@ -78,7 +78,7 @@ static void free(void *where)
+ * warnings when not needed (indeed large_malloc / large_free are not
+ * needed by inflate */
+
+-#define malloc(a) kmalloc(a, GFP_KERNEL)
++#define malloc(a) kmalloc((a), GFP_KERNEL)
+ #define free(a) kfree(a)
+
+ #define large_malloc(a) vmalloc(a)
+diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
+index 91b7618..92a93d32 100644
+--- a/include/linux/dma-mapping.h
++++ b/include/linux/dma-mapping.h
+@@ -16,51 +16,51 @@ enum dma_data_direction {
+ };
+
+ struct dma_map_ops {
+- void* (*alloc_coherent)(struct device *dev, size_t size,
++ void* (* const alloc_coherent)(struct device *dev, size_t size,
+ dma_addr_t *dma_handle, gfp_t gfp);
+- void (*free_coherent)(struct device *dev, size_t size,
++ void (* const free_coherent)(struct device *dev, size_t size,
+ void *vaddr, dma_addr_t dma_handle);
+- dma_addr_t (*map_page)(struct device *dev, struct page *page,
++ dma_addr_t (* const map_page)(struct device *dev, struct page *page,
+ unsigned long offset, size_t size,
+ enum dma_data_direction dir,
+ struct dma_attrs *attrs);
+- void (*unmap_page)(struct device *dev, dma_addr_t dma_handle,
++ void (* const unmap_page)(struct device *dev, dma_addr_t dma_handle,
+ size_t size, enum dma_data_direction dir,
+ struct dma_attrs *attrs);
+- int (*map_sg)(struct device *dev, struct scatterlist *sg,
++ int (* const map_sg)(struct device *dev, struct scatterlist *sg,
+ int nents, enum dma_data_direction dir,
+ struct dma_attrs *attrs);
+- void (*unmap_sg)(struct device *dev,
++ void (* const unmap_sg)(struct device *dev,
+ struct scatterlist *sg, int nents,
+ enum dma_data_direction dir,
+ struct dma_attrs *attrs);
+- void (*sync_single_for_cpu)(struct device *dev,
++ void (* const sync_single_for_cpu)(struct device *dev,
+ dma_addr_t dma_handle, size_t size,
+ enum dma_data_direction dir);
+- void (*sync_single_for_device)(struct device *dev,
++ void (* const sync_single_for_device)(struct device *dev,
+ dma_addr_t dma_handle, size_t size,
+ enum dma_data_direction dir);
+- void (*sync_single_range_for_cpu)(struct device *dev,
++ void (* const sync_single_range_for_cpu)(struct device *dev,
+ dma_addr_t dma_handle,
+ unsigned long offset,
+ size_t size,
+ enum dma_data_direction dir);
+- void (*sync_single_range_for_device)(struct device *dev,
++ void (* const sync_single_range_for_device)(struct device *dev,
+ dma_addr_t dma_handle,
+ unsigned long offset,
+ size_t size,
+ enum dma_data_direction dir);
+- void (*sync_sg_for_cpu)(struct device *dev,
++ void (* const sync_sg_for_cpu)(struct device *dev,
+ struct scatterlist *sg, int nents,
+ enum dma_data_direction dir);
+- void (*sync_sg_for_device)(struct device *dev,
++ void (* const sync_sg_for_device)(struct device *dev,
+ struct scatterlist *sg, int nents,
+ enum dma_data_direction dir);
+- int (*mapping_error)(struct device *dev, dma_addr_t dma_addr);
+- int (*dma_supported)(struct device *dev, u64 mask);
++ int (* const mapping_error)(struct device *dev, dma_addr_t dma_addr);
++ int (* const dma_supported)(struct device *dev, u64 mask);
+ int (*set_dma_mask)(struct device *dev, u64 mask);
+ int is_phys;
+-};
++} __do_const;
+
+ #define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
+
+diff --git a/include/linux/dst.h b/include/linux/dst.h
+index e26fed8..b976d9f 100644
+--- a/include/linux/dst.h
++++ b/include/linux/dst.h
+@@ -380,7 +380,7 @@ struct dst_node
+ struct thread_pool *pool;
+
+ /* Transaction IDs live here */
+- atomic_long_t gen;
++ atomic_long_unchecked_t gen;
+
+ /*
+ * How frequently and how many times transaction
+diff --git a/include/linux/elf.h b/include/linux/elf.h
+index 90a4ed0..d652617 100644
+--- a/include/linux/elf.h
++++ b/include/linux/elf.h
+@@ -49,6 +49,17 @@ typedef __s64 Elf64_Sxword;
+ #define PT_GNU_EH_FRAME 0x6474e550
+
+ #define PT_GNU_STACK (PT_LOOS + 0x474e551)
++#define PT_GNU_RELRO (PT_LOOS + 0x474e552)
++
++#define PT_PAX_FLAGS (PT_LOOS + 0x5041580)
++
++/* Constants for the e_flags field */
++#define EF_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
++#define EF_PAX_EMUTRAMP 2 /* Emulate trampolines */
++#define EF_PAX_MPROTECT 4 /* Restrict mprotect() */
++#define EF_PAX_RANDMMAP 8 /* Randomize mmap() base */
++/*#define EF_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
++#define EF_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
+
+ /* These constants define the different elf file types */
+ #define ET_NONE 0
+@@ -84,6 +95,8 @@ typedef __s64 Elf64_Sxword;
+ #define DT_DEBUG 21
+ #define DT_TEXTREL 22
+ #define DT_JMPREL 23
++#define DT_FLAGS 30
++ #define DF_TEXTREL 0x00000004
+ #define DT_ENCODING 32
+ #define OLD_DT_LOOS 0x60000000
+ #define DT_LOOS 0x6000000d
+@@ -230,6 +243,19 @@ typedef struct elf64_hdr {
+ #define PF_W 0x2
+ #define PF_X 0x1
+
++#define PF_PAGEEXEC (1U << 4) /* Enable PAGEEXEC */
++#define PF_NOPAGEEXEC (1U << 5) /* Disable PAGEEXEC */
++#define PF_SEGMEXEC (1U << 6) /* Enable SEGMEXEC */
++#define PF_NOSEGMEXEC (1U << 7) /* Disable SEGMEXEC */
++#define PF_MPROTECT (1U << 8) /* Enable MPROTECT */
++#define PF_NOMPROTECT (1U << 9) /* Disable MPROTECT */
++/*#define PF_RANDEXEC (1U << 10)*/ /* Enable RANDEXEC */
++/*#define PF_NORANDEXEC (1U << 11)*/ /* Disable RANDEXEC */
++#define PF_EMUTRAMP (1U << 12) /* Enable EMUTRAMP */
++#define PF_NOEMUTRAMP (1U << 13) /* Disable EMUTRAMP */
++#define PF_RANDMMAP (1U << 14) /* Enable RANDMMAP */
++#define PF_NORANDMMAP (1U << 15) /* Disable RANDMMAP */
++
+ typedef struct elf32_phdr{
+ Elf32_Word p_type;
+ Elf32_Off p_offset;
+@@ -322,6 +348,8 @@ typedef struct elf64_shdr {
+ #define EI_OSABI 7
+ #define EI_PAD 8
+
++#define EI_PAX 14
++
+ #define ELFMAG0 0x7f /* EI_MAG */
+ #define ELFMAG1 'E'
+ #define ELFMAG2 'L'
+@@ -386,6 +414,7 @@ extern Elf32_Dyn _DYNAMIC [];
+ #define elf_phdr elf32_phdr
+ #define elf_note elf32_note
+ #define elf_addr_t Elf32_Off
++#define elf_dyn Elf32_Dyn
+
+ #else
+
+@@ -394,6 +423,7 @@ extern Elf64_Dyn _DYNAMIC [];
+ #define elf_phdr elf64_phdr
+ #define elf_note elf64_note
+ #define elf_addr_t Elf64_Off
++#define elf_dyn Elf64_Dyn
+
+ #endif
+
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 1b9a47a..6fe2934 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -568,41 +568,41 @@ typedef int (*read_actor_t)(read_descriptor_t *, struct page *,
+ unsigned long, unsigned long);
+
+ struct address_space_operations {
+- int (*writepage)(struct page *page, struct writeback_control *wbc);
+- int (*readpage)(struct file *, struct page *);
+- void (*sync_page)(struct page *);
++ int (* const writepage)(struct page *page, struct writeback_control *wbc);
++ int (* const readpage)(struct file *, struct page *);
++ void (* const sync_page)(struct page *);
+
+ /* Write back some dirty pages from this mapping. */
+- int (*writepages)(struct address_space *, struct writeback_control *);
++ int (* const writepages)(struct address_space *, struct writeback_control *);
+
+ /* Set a page dirty. Return true if this dirtied it */
+- int (*set_page_dirty)(struct page *page);
++ int (* const set_page_dirty)(struct page *page);
+
+- int (*readpages)(struct file *filp, struct address_space *mapping,
++ int (* const readpages)(struct file *filp, struct address_space *mapping,
+ struct list_head *pages, unsigned nr_pages);
+
+- int (*write_begin)(struct file *, struct address_space *mapping,
++ int (* const write_begin)(struct file *, struct address_space *mapping,
+ loff_t pos, unsigned len, unsigned flags,
+ struct page **pagep, void **fsdata);
+- int (*write_end)(struct file *, struct address_space *mapping,
++ int (* const write_end)(struct file *, struct address_space *mapping,
+ loff_t pos, unsigned len, unsigned copied,
+ struct page *page, void *fsdata);
+
+ /* Unfortunately this kludge is needed for FIBMAP. Don't use it */
+- sector_t (*bmap)(struct address_space *, sector_t);
+- void (*invalidatepage) (struct page *, unsigned long);
+- int (*releasepage) (struct page *, gfp_t);
+- ssize_t (*direct_IO)(int, struct kiocb *, const struct iovec *iov,
++ sector_t (* const bmap)(struct address_space *, sector_t);
++ void (* const invalidatepage) (struct page *, unsigned long);
++ int (* const releasepage) (struct page *, gfp_t);
++ ssize_t (* const direct_IO)(int, struct kiocb *, const struct iovec *iov,
+ loff_t offset, unsigned long nr_segs);
+- int (*get_xip_mem)(struct address_space *, pgoff_t, int,
++ int (* const get_xip_mem)(struct address_space *, pgoff_t, int,
+ void **, unsigned long *);
+ /* migrate the contents of a page to the specified target */
+- int (*migratepage) (struct address_space *,
++ int (* const migratepage) (struct address_space *,
+ struct page *, struct page *);
+- int (*launder_page) (struct page *);
+- int (*is_partially_uptodate) (struct page *, read_descriptor_t *,
++ int (* const launder_page) (struct page *);
++ int (* const is_partially_uptodate) (struct page *, read_descriptor_t *,
+ unsigned long);
+- int (*error_remove_page)(struct address_space *, struct page *);
++ int (* const error_remove_page)(struct address_space *, struct page *);
+ };
+
+ /*
+@@ -1031,19 +1031,19 @@ static inline int file_check_writeable(struct file *filp)
+ typedef struct files_struct *fl_owner_t;
+
+ struct file_lock_operations {
+- void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
+- void (*fl_release_private)(struct file_lock *);
++ void (* const fl_copy_lock)(struct file_lock *, struct file_lock *);
++ void (* const fl_release_private)(struct file_lock *);
+ };
+
+ struct lock_manager_operations {
+- int (*fl_compare_owner)(struct file_lock *, struct file_lock *);
+- void (*fl_notify)(struct file_lock *); /* unblock callback */
+- int (*fl_grant)(struct file_lock *, struct file_lock *, int);
+- void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
+- void (*fl_release_private)(struct file_lock *);
+- void (*fl_break)(struct file_lock *);
+- int (*fl_mylease)(struct file_lock *, struct file_lock *);
+- int (*fl_change)(struct file_lock **, int);
++ int (* const fl_compare_owner)(struct file_lock *, struct file_lock *);
++ void (* const fl_notify)(struct file_lock *); /* unblock callback */
++ int (* const fl_grant)(struct file_lock *, struct file_lock *, int);
++ void (* const fl_copy_lock)(struct file_lock *, struct file_lock *);
++ void (* const fl_release_private)(struct file_lock *);
++ void (* const fl_break)(struct file_lock *);
++ int (* const fl_mylease)(struct file_lock *, struct file_lock *);
++ int (* const fl_change)(struct file_lock **, int);
+ };
+
+ struct lock_manager {
+@@ -1442,7 +1442,7 @@ struct fiemap_extent_info {
+ unsigned int fi_flags; /* Flags as passed from user */
+ unsigned int fi_extents_mapped; /* Number of mapped extents */
+ unsigned int fi_extents_max; /* Size of fiemap_extent array */
+- struct fiemap_extent *fi_extents_start; /* Start of fiemap_extent
++ struct fiemap_extent __user *fi_extents_start; /* Start of fiemap_extent
+ * array */
+ };
+ int fiemap_fill_next_extent(struct fiemap_extent_info *info, u64 logical,
+@@ -1512,7 +1512,8 @@ struct file_operations {
+ ssize_t (*splice_write)(struct pipe_inode_info *, struct file *, loff_t *, size_t, unsigned int);
+ ssize_t (*splice_read)(struct file *, loff_t *, struct pipe_inode_info *, size_t, unsigned int);
+ int (*setlease)(struct file *, long, struct file_lock **);
+-};
++} __do_const;
++typedef struct file_operations __no_const file_operations_no_const;
+
+ struct inode_operations {
+ int (*create) (struct inode *,struct dentry *,int, struct nameidata *);
+@@ -1559,30 +1560,30 @@ extern ssize_t vfs_writev(struct file *, const struct iovec __user *,
+ unsigned long, loff_t *);
+
+ struct super_operations {
+- struct inode *(*alloc_inode)(struct super_block *sb);
+- void (*destroy_inode)(struct inode *);
++ struct inode *(* const alloc_inode)(struct super_block *sb);
++ void (* const destroy_inode)(struct inode *);
+
+- void (*dirty_inode) (struct inode *);
+- int (*write_inode) (struct inode *, int);
+- void (*drop_inode) (struct inode *);
+- void (*delete_inode) (struct inode *);
+- void (*put_super) (struct super_block *);
+- void (*write_super) (struct super_block *);
+- int (*sync_fs)(struct super_block *sb, int wait);
+- int (*freeze_fs) (struct super_block *);
+- int (*unfreeze_fs) (struct super_block *);
+- int (*statfs) (struct dentry *, struct kstatfs *);
+- int (*remount_fs) (struct super_block *, int *, char *);
+- void (*clear_inode) (struct inode *);
+- void (*umount_begin) (struct super_block *);
++ void (* const dirty_inode) (struct inode *);
++ int (* const write_inode) (struct inode *, int);
++ void (* const drop_inode) (struct inode *);
++ void (* const delete_inode) (struct inode *);
++ void (* const put_super) (struct super_block *);
++ void (* const write_super) (struct super_block *);
++ int (* const sync_fs)(struct super_block *sb, int wait);
++ int (* const freeze_fs) (struct super_block *);
++ int (* const unfreeze_fs) (struct super_block *);
++ int (* const statfs) (struct dentry *, struct kstatfs *);
++ int (* const remount_fs) (struct super_block *, int *, char *);
++ void (* const clear_inode) (struct inode *);
++ void (* const umount_begin) (struct super_block *);
+
+- int (*show_options)(struct seq_file *, struct vfsmount *);
+- int (*show_stats)(struct seq_file *, struct vfsmount *);
++ int (* const show_options)(struct seq_file *, struct vfsmount *);
++ int (* const show_stats)(struct seq_file *, struct vfsmount *);
+ #ifdef CONFIG_QUOTA
+- ssize_t (*quota_read)(struct super_block *, int, char *, size_t, loff_t);
+- ssize_t (*quota_write)(struct super_block *, int, const char *, size_t, loff_t);
++ ssize_t (* const quota_read)(struct super_block *, int, char *, size_t, loff_t);
++ ssize_t (* const quota_write)(struct super_block *, int, const char *, size_t, loff_t);
+ #endif
+- int (*bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
++ int (* const bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
+ };
+
+ /*
+diff --git a/include/linux/fs_struct.h b/include/linux/fs_struct.h
+index 78a05bf..2a7d3e1 100644
+--- a/include/linux/fs_struct.h
++++ b/include/linux/fs_struct.h
+@@ -4,7 +4,7 @@
+ #include <linux/path.h>
+
+ struct fs_struct {
+- int users;
++ atomic_t users;
+ rwlock_t lock;
+ int umask;
+ int in_exec;
+diff --git a/include/linux/fscache-cache.h b/include/linux/fscache-cache.h
+index 7be0c6f..2f63a2b 100644
+--- a/include/linux/fscache-cache.h
++++ b/include/linux/fscache-cache.h
+@@ -116,7 +116,7 @@ struct fscache_operation {
+ #endif
+ };
+
+-extern atomic_t fscache_op_debug_id;
++extern atomic_unchecked_t fscache_op_debug_id;
+ extern const struct slow_work_ops fscache_op_slow_work_ops;
+
+ extern void fscache_enqueue_operation(struct fscache_operation *);
+@@ -134,7 +134,7 @@ static inline void fscache_operation_init(struct fscache_operation *op,
+ fscache_operation_release_t release)
+ {
+ atomic_set(&op->usage, 1);
+- op->debug_id = atomic_inc_return(&fscache_op_debug_id);
++ op->debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
+ op->release = release;
+ INIT_LIST_HEAD(&op->pend_link);
+ fscache_set_op_state(op, "Init");
+diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h
+index 4d6f47b..00bcedb 100644
+--- a/include/linux/fsnotify_backend.h
++++ b/include/linux/fsnotify_backend.h
+@@ -86,6 +86,7 @@ struct fsnotify_ops {
+ void (*freeing_mark)(struct fsnotify_mark_entry *entry, struct fsnotify_group *group);
+ void (*free_event_priv)(struct fsnotify_event_private_data *priv);
+ };
++typedef struct fsnotify_ops __no_const fsnotify_ops_no_const;
+
+ /*
+ * A group is a "thing" that wants to receive notification about filesystem
+diff --git a/include/linux/ftrace_event.h b/include/linux/ftrace_event.h
+index 4ec5e67..42f1eb9 100644
+--- a/include/linux/ftrace_event.h
++++ b/include/linux/ftrace_event.h
+@@ -163,7 +163,7 @@ extern int trace_define_field(struct ftrace_event_call *call,
+ int filter_type);
+ extern int trace_define_common_fields(struct ftrace_event_call *call);
+
+-#define is_signed_type(type) (((type)(-1)) < 0)
++#define is_signed_type(type) (((type)(-1)) < (type)1)
+
+ int trace_set_clr_event(const char *system, const char *event, int set);
+
+diff --git a/include/linux/genhd.h b/include/linux/genhd.h
+index 297df45..b6a74ff 100644
+--- a/include/linux/genhd.h
++++ b/include/linux/genhd.h
+@@ -161,7 +161,7 @@ struct gendisk {
+
+ struct timer_rand_state *random;
+
+- atomic_t sync_io; /* RAID */
++ atomic_unchecked_t sync_io; /* RAID */
+ struct work_struct async_notify;
+ #ifdef CONFIG_BLK_DEV_INTEGRITY
+ struct blk_integrity *integrity;
+diff --git a/include/linux/gracl.h b/include/linux/gracl.h
+new file mode 100644
+index 0000000..6c51079
+--- /dev/null
++++ b/include/linux/gracl.h
+@@ -0,0 +1,320 @@
++#ifndef GR_ACL_H
++#define GR_ACL_H
++
++#include <linux/grdefs.h>
++#include <linux/resource.h>
++#include <linux/capability.h>
++#include <linux/dcache.h>
++#include <asm/resource.h>
++
++/* Major status information */
++
++#define GR_VERSION "grsecurity 2.9"
++#define GRSECURITY_VERSION 0x2900
++
++enum {
++ GR_SHUTDOWN = 0,
++ GR_ENABLE = 1,
++ GR_SPROLE = 2,
++ GR_RELOAD = 3,
++ GR_SEGVMOD = 4,
++ GR_STATUS = 5,
++ GR_UNSPROLE = 6,
++ GR_PASSSET = 7,
++ GR_SPROLEPAM = 8,
++};
++
++/* Password setup definitions
++ * kernel/grhash.c */
++enum {
++ GR_PW_LEN = 128,
++ GR_SALT_LEN = 16,
++ GR_SHA_LEN = 32,
++};
++
++enum {
++ GR_SPROLE_LEN = 64,
++};
++
++enum {
++ GR_NO_GLOB = 0,
++ GR_REG_GLOB,
++ GR_CREATE_GLOB
++};
++
++#define GR_NLIMITS 32
++
++/* Begin Data Structures */
++
++struct sprole_pw {
++ unsigned char *rolename;
++ unsigned char salt[GR_SALT_LEN];
++ unsigned char sum[GR_SHA_LEN]; /* 256-bit SHA hash of the password */
++};
++
++struct name_entry {
++ __u32 key;
++ ino_t inode;
++ dev_t device;
++ char *name;
++ __u16 len;
++ __u8 deleted;
++ struct name_entry *prev;
++ struct name_entry *next;
++};
++
++struct inodev_entry {
++ struct name_entry *nentry;
++ struct inodev_entry *prev;
++ struct inodev_entry *next;
++};
++
++struct acl_role_db {
++ struct acl_role_label **r_hash;
++ __u32 r_size;
++};
++
++struct inodev_db {
++ struct inodev_entry **i_hash;
++ __u32 i_size;
++};
++
++struct name_db {
++ struct name_entry **n_hash;
++ __u32 n_size;
++};
++
++struct crash_uid {
++ uid_t uid;
++ unsigned long expires;
++};
++
++struct gr_hash_struct {
++ void **table;
++ void **nametable;
++ void *first;
++ __u32 table_size;
++ __u32 used_size;
++ int type;
++};
++
++/* Userspace Grsecurity ACL data structures */
++
++struct acl_subject_label {
++ char *filename;
++ ino_t inode;
++ dev_t device;
++ __u32 mode;
++ kernel_cap_t cap_mask;
++ kernel_cap_t cap_lower;
++ kernel_cap_t cap_invert_audit;
++
++ struct rlimit res[GR_NLIMITS];
++ __u32 resmask;
++
++ __u8 user_trans_type;
++ __u8 group_trans_type;
++ uid_t *user_transitions;
++ gid_t *group_transitions;
++ __u16 user_trans_num;
++ __u16 group_trans_num;
++
++ __u32 sock_families[2];
++ __u32 ip_proto[8];
++ __u32 ip_type;
++ struct acl_ip_label **ips;
++ __u32 ip_num;
++ __u32 inaddr_any_override;
++
++ __u32 crashes;
++ unsigned long expires;
++
++ struct acl_subject_label *parent_subject;
++ struct gr_hash_struct *hash;
++ struct acl_subject_label *prev;
++ struct acl_subject_label *next;
++
++ struct acl_object_label **obj_hash;
++ __u32 obj_hash_size;
++ __u16 pax_flags;
++};
++
++struct role_allowed_ip {
++ __u32 addr;
++ __u32 netmask;
++
++ struct role_allowed_ip *prev;
++ struct role_allowed_ip *next;
++};
++
++struct role_transition {
++ char *rolename;
++
++ struct role_transition *prev;
++ struct role_transition *next;
++};
++
++struct acl_role_label {
++ char *rolename;
++ uid_t uidgid;
++ __u16 roletype;
++
++ __u16 auth_attempts;
++ unsigned long expires;
++
++ struct acl_subject_label *root_label;
++ struct gr_hash_struct *hash;
++
++ struct acl_role_label *prev;
++ struct acl_role_label *next;
++
++ struct role_transition *transitions;
++ struct role_allowed_ip *allowed_ips;
++ uid_t *domain_children;
++ __u16 domain_child_num;
++
++ // __u16
++ umode_t umask;
++
++ struct acl_subject_label **subj_hash;
++ __u32 subj_hash_size;
++};
++
++struct user_acl_role_db {
++ struct acl_role_label **r_table;
++ __u32 num_pointers; /* Number of allocations to track */
++ __u32 num_roles; /* Number of roles */
++ __u32 num_domain_children; /* Number of domain children */
++ __u32 num_subjects; /* Number of subjects */
++ __u32 num_objects; /* Number of objects */
++};
++
++struct acl_object_label {
++ char *filename;
++ ino_t inode;
++ dev_t device;
++ __u32 mode;
++
++ struct acl_subject_label *nested;
++ struct acl_object_label *globbed;
++
++ /* next two structures not used */
++
++ struct acl_object_label *prev;
++ struct acl_object_label *next;
++};
++
++struct acl_ip_label {
++ char *iface;
++ __u32 addr;
++ __u32 netmask;
++ __u16 low, high;
++ __u8 mode;
++ __u32 type;
++ __u32 proto[8];
++
++ /* next two structures not used */
++
++ struct acl_ip_label *prev;
++ struct acl_ip_label *next;
++};
++
++struct gr_arg {
++ struct user_acl_role_db role_db;
++ unsigned char pw[GR_PW_LEN];
++ unsigned char salt[GR_SALT_LEN];
++ unsigned char sum[GR_SHA_LEN];
++ unsigned char sp_role[GR_SPROLE_LEN];
++ struct sprole_pw *sprole_pws;
++ dev_t segv_device;
++ ino_t segv_inode;
++ uid_t segv_uid;
++ __u16 num_sprole_pws;
++ __u16 mode;
++};
++
++struct gr_arg_wrapper {
++ struct gr_arg *arg;
++ __u32 version;
++ __u32 size;
++};
++
++struct subject_map {
++ struct acl_subject_label *user;
++ struct acl_subject_label *kernel;
++ struct subject_map *prev;
++ struct subject_map *next;
++};
++
++struct acl_subj_map_db {
++ struct subject_map **s_hash;
++ __u32 s_size;
++};
++
++/* End Data Structures Section */
++
++/* Hash functions generated by empirical testing by Brad Spengler
++ Makes good use of the low bits of the inode. Generally 0-1 times
++ in loop for successful match. 0-3 for unsuccessful match.
++ Shift/add algorithm with modulus of table size and an XOR*/
++
++static __inline__ unsigned int
++rhash(const uid_t uid, const __u16 type, const unsigned int sz)
++{
++ return ((((uid + type) << (16 + type)) ^ uid) % sz);
++}
++
++ static __inline__ unsigned int
++shash(const struct acl_subject_label *userp, const unsigned int sz)
++{
++ return ((const unsigned long)userp % sz);
++}
++
++static __inline__ unsigned int
++fhash(const ino_t ino, const dev_t dev, const unsigned int sz)
++{
++ return (((ino + dev) ^ ((ino << 13) + (ino << 23) + (dev << 9))) % sz);
++}
++
++static __inline__ unsigned int
++nhash(const char *name, const __u16 len, const unsigned int sz)
++{
++ return full_name_hash((const unsigned char *)name, len) % sz;
++}
++
++#define FOR_EACH_ROLE_START(role) \
++ role = role_list; \
++ while (role) {
++
++#define FOR_EACH_ROLE_END(role) \
++ role = role->prev; \
++ }
++
++#define FOR_EACH_SUBJECT_START(role,subj,iter) \
++ subj = NULL; \
++ iter = 0; \
++ while (iter < role->subj_hash_size) { \
++ if (subj == NULL) \
++ subj = role->subj_hash[iter]; \
++ if (subj == NULL) { \
++ iter++; \
++ continue; \
++ }
++
++#define FOR_EACH_SUBJECT_END(subj,iter) \
++ subj = subj->next; \
++ if (subj == NULL) \
++ iter++; \
++ }
++
++
++#define FOR_EACH_NESTED_SUBJECT_START(role,subj) \
++ subj = role->hash->first; \
++ while (subj != NULL) {
++
++#define FOR_EACH_NESTED_SUBJECT_END(subj) \
++ subj = subj->next; \
++ }
++
++#endif
++
+diff --git a/include/linux/gralloc.h b/include/linux/gralloc.h
+new file mode 100644
+index 0000000..323ecf2
+--- /dev/null
++++ b/include/linux/gralloc.h
+@@ -0,0 +1,9 @@
++#ifndef __GRALLOC_H
++#define __GRALLOC_H
++
++void acl_free_all(void);
++int acl_alloc_stack_init(unsigned long size);
++void *acl_alloc(unsigned long len);
++void *acl_alloc_num(unsigned long num, unsigned long len);
++
++#endif
+diff --git a/include/linux/grdefs.h b/include/linux/grdefs.h
+new file mode 100644
+index 0000000..70d6cd5
+--- /dev/null
++++ b/include/linux/grdefs.h
+@@ -0,0 +1,140 @@
++#ifndef GRDEFS_H
++#define GRDEFS_H
++
++/* Begin grsecurity status declarations */
++
++enum {
++ GR_READY = 0x01,
++ GR_STATUS_INIT = 0x00 // disabled state
++};
++
++/* Begin ACL declarations */
++
++/* Role flags */
++
++enum {
++ GR_ROLE_USER = 0x0001,
++ GR_ROLE_GROUP = 0x0002,
++ GR_ROLE_DEFAULT = 0x0004,
++ GR_ROLE_SPECIAL = 0x0008,
++ GR_ROLE_AUTH = 0x0010,
++ GR_ROLE_NOPW = 0x0020,
++ GR_ROLE_GOD = 0x0040,
++ GR_ROLE_LEARN = 0x0080,
++ GR_ROLE_TPE = 0x0100,
++ GR_ROLE_DOMAIN = 0x0200,
++ GR_ROLE_PAM = 0x0400,
++ GR_ROLE_PERSIST = 0x800
++};
++
++/* ACL Subject and Object mode flags */
++enum {
++ GR_DELETED = 0x80000000
++};
++
++/* ACL Object-only mode flags */
++enum {
++ GR_READ = 0x00000001,
++ GR_APPEND = 0x00000002,
++ GR_WRITE = 0x00000004,
++ GR_EXEC = 0x00000008,
++ GR_FIND = 0x00000010,
++ GR_INHERIT = 0x00000020,
++ GR_SETID = 0x00000040,
++ GR_CREATE = 0x00000080,
++ GR_DELETE = 0x00000100,
++ GR_LINK = 0x00000200,
++ GR_AUDIT_READ = 0x00000400,
++ GR_AUDIT_APPEND = 0x00000800,
++ GR_AUDIT_WRITE = 0x00001000,
++ GR_AUDIT_EXEC = 0x00002000,
++ GR_AUDIT_FIND = 0x00004000,
++ GR_AUDIT_INHERIT= 0x00008000,
++ GR_AUDIT_SETID = 0x00010000,
++ GR_AUDIT_CREATE = 0x00020000,
++ GR_AUDIT_DELETE = 0x00040000,
++ GR_AUDIT_LINK = 0x00080000,
++ GR_PTRACERD = 0x00100000,
++ GR_NOPTRACE = 0x00200000,
++ GR_SUPPRESS = 0x00400000,
++ GR_NOLEARN = 0x00800000,
++ GR_INIT_TRANSFER= 0x01000000
++};
++
++#define GR_AUDITS (GR_AUDIT_READ | GR_AUDIT_WRITE | GR_AUDIT_APPEND | GR_AUDIT_EXEC | \
++ GR_AUDIT_FIND | GR_AUDIT_INHERIT | GR_AUDIT_SETID | \
++ GR_AUDIT_CREATE | GR_AUDIT_DELETE | GR_AUDIT_LINK)
++
++/* ACL subject-only mode flags */
++enum {
++ GR_KILL = 0x00000001,
++ GR_VIEW = 0x00000002,
++ GR_PROTECTED = 0x00000004,
++ GR_LEARN = 0x00000008,
++ GR_OVERRIDE = 0x00000010,
++ /* just a placeholder, this mode is only used in userspace */
++ GR_DUMMY = 0x00000020,
++ GR_PROTSHM = 0x00000040,
++ GR_KILLPROC = 0x00000080,
++ GR_KILLIPPROC = 0x00000100,
++ /* just a placeholder, this mode is only used in userspace */
++ GR_NOTROJAN = 0x00000200,
++ GR_PROTPROCFD = 0x00000400,
++ GR_PROCACCT = 0x00000800,
++ GR_RELAXPTRACE = 0x00001000,
++ GR_NESTED = 0x00002000,
++ GR_INHERITLEARN = 0x00004000,
++ GR_PROCFIND = 0x00008000,
++ GR_POVERRIDE = 0x00010000,
++ GR_KERNELAUTH = 0x00020000,
++ GR_ATSECURE = 0x00040000,
++ GR_SHMEXEC = 0x00080000
++};
++
++enum {
++ GR_PAX_ENABLE_SEGMEXEC = 0x0001,
++ GR_PAX_ENABLE_PAGEEXEC = 0x0002,
++ GR_PAX_ENABLE_MPROTECT = 0x0004,
++ GR_PAX_ENABLE_RANDMMAP = 0x0008,
++ GR_PAX_ENABLE_EMUTRAMP = 0x0010,
++ GR_PAX_DISABLE_SEGMEXEC = 0x0100,
++ GR_PAX_DISABLE_PAGEEXEC = 0x0200,
++ GR_PAX_DISABLE_MPROTECT = 0x0400,
++ GR_PAX_DISABLE_RANDMMAP = 0x0800,
++ GR_PAX_DISABLE_EMUTRAMP = 0x1000,
++};
++
++enum {
++ GR_ID_USER = 0x01,
++ GR_ID_GROUP = 0x02,
++};
++
++enum {
++ GR_ID_ALLOW = 0x01,
++ GR_ID_DENY = 0x02,
++};
++
++#define GR_CRASH_RES 31
++#define GR_UIDTABLE_MAX 500
++
++/* begin resource learning section */
++enum {
++ GR_RLIM_CPU_BUMP = 60,
++ GR_RLIM_FSIZE_BUMP = 50000,
++ GR_RLIM_DATA_BUMP = 10000,
++ GR_RLIM_STACK_BUMP = 1000,
++ GR_RLIM_CORE_BUMP = 10000,
++ GR_RLIM_RSS_BUMP = 500000,
++ GR_RLIM_NPROC_BUMP = 1,
++ GR_RLIM_NOFILE_BUMP = 5,
++ GR_RLIM_MEMLOCK_BUMP = 50000,
++ GR_RLIM_AS_BUMP = 500000,
++ GR_RLIM_LOCKS_BUMP = 2,
++ GR_RLIM_SIGPENDING_BUMP = 5,
++ GR_RLIM_MSGQUEUE_BUMP = 10000,
++ GR_RLIM_NICE_BUMP = 1,
++ GR_RLIM_RTPRIO_BUMP = 1,
++ GR_RLIM_RTTIME_BUMP = 1000000
++};
++
++#endif
+diff --git a/include/linux/grinternal.h b/include/linux/grinternal.h
+new file mode 100644
+index 0000000..3826b91
+--- /dev/null
++++ b/include/linux/grinternal.h
+@@ -0,0 +1,219 @@
++#ifndef __GRINTERNAL_H
++#define __GRINTERNAL_H
++
++#ifdef CONFIG_GRKERNSEC
++
++#include <linux/fs.h>
++#include <linux/mnt_namespace.h>
++#include <linux/nsproxy.h>
++#include <linux/gracl.h>
++#include <linux/grdefs.h>
++#include <linux/grmsg.h>
++
++void gr_add_learn_entry(const char *fmt, ...)
++ __attribute__ ((format (printf, 1, 2)));
++__u32 gr_search_file(const struct dentry *dentry, const __u32 mode,
++ const struct vfsmount *mnt);
++__u32 gr_check_create(const struct dentry *new_dentry,
++ const struct dentry *parent,
++ const struct vfsmount *mnt, const __u32 mode);
++int gr_check_protected_task(const struct task_struct *task);
++__u32 to_gr_audit(const __u32 reqmode);
++int gr_set_acls(const int type);
++int gr_apply_subject_to_task(struct task_struct *task);
++int gr_acl_is_enabled(void);
++char gr_roletype_to_char(void);
++
++void gr_handle_alertkill(struct task_struct *task);
++char *gr_to_filename(const struct dentry *dentry,
++ const struct vfsmount *mnt);
++char *gr_to_filename1(const struct dentry *dentry,
++ const struct vfsmount *mnt);
++char *gr_to_filename2(const struct dentry *dentry,
++ const struct vfsmount *mnt);
++char *gr_to_filename3(const struct dentry *dentry,
++ const struct vfsmount *mnt);
++
++extern int grsec_enable_ptrace_readexec;
++extern int grsec_enable_harden_ptrace;
++extern int grsec_enable_link;
++extern int grsec_enable_fifo;
++extern int grsec_enable_shm;
++extern int grsec_enable_execlog;
++extern int grsec_enable_signal;
++extern int grsec_enable_audit_ptrace;
++extern int grsec_enable_forkfail;
++extern int grsec_enable_time;
++extern int grsec_enable_rofs;
++extern int grsec_enable_chroot_shmat;
++extern int grsec_enable_chroot_mount;
++extern int grsec_enable_chroot_double;
++extern int grsec_enable_chroot_pivot;
++extern int grsec_enable_chroot_chdir;
++extern int grsec_enable_chroot_chmod;
++extern int grsec_enable_chroot_mknod;
++extern int grsec_enable_chroot_fchdir;
++extern int grsec_enable_chroot_nice;
++extern int grsec_enable_chroot_execlog;
++extern int grsec_enable_chroot_caps;
++extern int grsec_enable_chroot_sysctl;
++extern int grsec_enable_chroot_unix;
++extern int grsec_enable_tpe;
++extern int grsec_tpe_gid;
++extern int grsec_enable_tpe_all;
++extern int grsec_enable_tpe_invert;
++extern int grsec_enable_socket_all;
++extern int grsec_socket_all_gid;
++extern int grsec_enable_socket_client;
++extern int grsec_socket_client_gid;
++extern int grsec_enable_socket_server;
++extern int grsec_socket_server_gid;
++extern int grsec_audit_gid;
++extern int grsec_enable_group;
++extern int grsec_enable_audit_textrel;
++extern int grsec_enable_log_rwxmaps;
++extern int grsec_enable_mount;
++extern int grsec_enable_chdir;
++extern int grsec_resource_logging;
++extern int grsec_enable_blackhole;
++extern int grsec_lastack_retries;
++extern int grsec_enable_brute;
++extern int grsec_lock;
++
++extern spinlock_t grsec_alert_lock;
++extern unsigned long grsec_alert_wtime;
++extern unsigned long grsec_alert_fyet;
++
++extern spinlock_t grsec_audit_lock;
++
++extern rwlock_t grsec_exec_file_lock;
++
++#define gr_task_fullpath(tsk) ((tsk)->exec_file ? \
++ gr_to_filename2((tsk)->exec_file->f_path.dentry, \
++ (tsk)->exec_file->f_vfsmnt) : "/")
++
++#define gr_parent_task_fullpath(tsk) ((tsk)->real_parent->exec_file ? \
++ gr_to_filename3((tsk)->real_parent->exec_file->f_path.dentry, \
++ (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
++
++#define gr_task_fullpath0(tsk) ((tsk)->exec_file ? \
++ gr_to_filename((tsk)->exec_file->f_path.dentry, \
++ (tsk)->exec_file->f_vfsmnt) : "/")
++
++#define gr_parent_task_fullpath0(tsk) ((tsk)->real_parent->exec_file ? \
++ gr_to_filename1((tsk)->real_parent->exec_file->f_path.dentry, \
++ (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
++
++#define proc_is_chrooted(tsk_a) ((tsk_a)->gr_is_chrooted)
++
++#define have_same_root(tsk_a,tsk_b) ((tsk_a)->gr_chroot_dentry == (tsk_b)->gr_chroot_dentry)
++
++#define DEFAULTSECARGS(task, cred, pcred) gr_task_fullpath(task), (task)->comm, \
++ (task)->pid, (cred)->uid, \
++ (cred)->euid, (cred)->gid, (cred)->egid, \
++ gr_parent_task_fullpath(task), \
++ (task)->real_parent->comm, (task)->real_parent->pid, \
++ (pcred)->uid, (pcred)->euid, \
++ (pcred)->gid, (pcred)->egid
++
++#define GR_CHROOT_CAPS {{ \
++ CAP_TO_MASK(CAP_LINUX_IMMUTABLE) | CAP_TO_MASK(CAP_NET_ADMIN) | \
++ CAP_TO_MASK(CAP_SYS_MODULE) | CAP_TO_MASK(CAP_SYS_RAWIO) | \
++ CAP_TO_MASK(CAP_SYS_PACCT) | CAP_TO_MASK(CAP_SYS_ADMIN) | \
++ CAP_TO_MASK(CAP_SYS_BOOT) | CAP_TO_MASK(CAP_SYS_TIME) | \
++ CAP_TO_MASK(CAP_NET_RAW) | CAP_TO_MASK(CAP_SYS_TTY_CONFIG) | \
++ CAP_TO_MASK(CAP_IPC_OWNER) | CAP_TO_MASK(CAP_SETFCAP), \
++ CAP_TO_MASK(CAP_MAC_ADMIN) }}
++
++#define security_learn(normal_msg,args...) \
++({ \
++ read_lock(&grsec_exec_file_lock); \
++ gr_add_learn_entry(normal_msg "\n", ## args); \
++ read_unlock(&grsec_exec_file_lock); \
++})
++
++enum {
++ GR_DO_AUDIT,
++ GR_DONT_AUDIT,
++ GR_DONT_AUDIT_GOOD
++};
++
++enum {
++ GR_TTYSNIFF,
++ GR_RBAC,
++ GR_RBAC_STR,
++ GR_STR_RBAC,
++ GR_RBAC_MODE2,
++ GR_RBAC_MODE3,
++ GR_FILENAME,
++ GR_SYSCTL_HIDDEN,
++ GR_NOARGS,
++ GR_ONE_INT,
++ GR_ONE_INT_TWO_STR,
++ GR_ONE_STR,
++ GR_STR_INT,
++ GR_TWO_STR_INT,
++ GR_TWO_INT,
++ GR_TWO_U64,
++ GR_THREE_INT,
++ GR_FIVE_INT_TWO_STR,
++ GR_TWO_STR,
++ GR_THREE_STR,
++ GR_FOUR_STR,
++ GR_STR_FILENAME,
++ GR_FILENAME_STR,
++ GR_FILENAME_TWO_INT,
++ GR_FILENAME_TWO_INT_STR,
++ GR_TEXTREL,
++ GR_PTRACE,
++ GR_RESOURCE,
++ GR_CAP,
++ GR_SIG,
++ GR_SIG2,
++ GR_CRASH1,
++ GR_CRASH2,
++ GR_PSACCT,
++ GR_RWXMAP
++};
++
++#define gr_log_hidden_sysctl(audit, msg, str) gr_log_varargs(audit, msg, GR_SYSCTL_HIDDEN, str)
++#define gr_log_ttysniff(audit, msg, task) gr_log_varargs(audit, msg, GR_TTYSNIFF, task)
++#define gr_log_fs_rbac_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_RBAC, dentry, mnt)
++#define gr_log_fs_rbac_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_RBAC_STR, dentry, mnt, str)
++#define gr_log_fs_str_rbac(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_RBAC, str, dentry, mnt)
++#define gr_log_fs_rbac_mode2(audit, msg, dentry, mnt, str1, str2) gr_log_varargs(audit, msg, GR_RBAC_MODE2, dentry, mnt, str1, str2)
++#define gr_log_fs_rbac_mode3(audit, msg, dentry, mnt, str1, str2, str3) gr_log_varargs(audit, msg, GR_RBAC_MODE3, dentry, mnt, str1, str2, str3)
++#define gr_log_fs_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_FILENAME, dentry, mnt)
++#define gr_log_noargs(audit, msg) gr_log_varargs(audit, msg, GR_NOARGS)
++#define gr_log_int(audit, msg, num) gr_log_varargs(audit, msg, GR_ONE_INT, num)
++#define gr_log_int_str2(audit, msg, num, str1, str2) gr_log_varargs(audit, msg, GR_ONE_INT_TWO_STR, num, str1, str2)
++#define gr_log_str(audit, msg, str) gr_log_varargs(audit, msg, GR_ONE_STR, str)
++#define gr_log_str_int(audit, msg, str, num) gr_log_varargs(audit, msg, GR_STR_INT, str, num)
++#define gr_log_int_int(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_INT, num1, num2)
++#define gr_log_two_u64(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_U64, num1, num2)
++#define gr_log_int3(audit, msg, num1, num2, num3) gr_log_varargs(audit, msg, GR_THREE_INT, num1, num2, num3)
++#define gr_log_int5_str2(audit, msg, num1, num2, str1, str2) gr_log_varargs(audit, msg, GR_FIVE_INT_TWO_STR, num1, num2, str1, str2)
++#define gr_log_str_str(audit, msg, str1, str2) gr_log_varargs(audit, msg, GR_TWO_STR, str1, str2)
++#define gr_log_str2_int(audit, msg, str1, str2, num) gr_log_varargs(audit, msg, GR_TWO_STR_INT, str1, str2, num)
++#define gr_log_str3(audit, msg, str1, str2, str3) gr_log_varargs(audit, msg, GR_THREE_STR, str1, str2, str3)
++#define gr_log_str4(audit, msg, str1, str2, str3, str4) gr_log_varargs(audit, msg, GR_FOUR_STR, str1, str2, str3, str4)
++#define gr_log_str_fs(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_FILENAME, str, dentry, mnt)
++#define gr_log_fs_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_FILENAME_STR, dentry, mnt, str)
++#define gr_log_fs_int2(audit, msg, dentry, mnt, num1, num2) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT, dentry, mnt, num1, num2)
++#define gr_log_fs_int2_str(audit, msg, dentry, mnt, num1, num2, str) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT_STR, dentry, mnt, num1, num2, str)
++#define gr_log_textrel_ulong_ulong(audit, msg, file, ulong1, ulong2) gr_log_varargs(audit, msg, GR_TEXTREL, file, ulong1, ulong2)
++#define gr_log_ptrace(audit, msg, task) gr_log_varargs(audit, msg, GR_PTRACE, task)
++#define gr_log_res_ulong2_str(audit, msg, task, ulong1, str, ulong2) gr_log_varargs(audit, msg, GR_RESOURCE, task, ulong1, str, ulong2)
++#define gr_log_cap(audit, msg, task, str) gr_log_varargs(audit, msg, GR_CAP, task, str)
++#define gr_log_sig_addr(audit, msg, str, addr) gr_log_varargs(audit, msg, GR_SIG, str, addr)
++#define gr_log_sig_task(audit, msg, task, num) gr_log_varargs(audit, msg, GR_SIG2, task, num)
++#define gr_log_crash1(audit, msg, task, ulong) gr_log_varargs(audit, msg, GR_CRASH1, task, ulong)
++#define gr_log_crash2(audit, msg, task, ulong1) gr_log_varargs(audit, msg, GR_CRASH2, task, ulong1)
++#define gr_log_procacct(audit, msg, task, num1, num2, num3, num4, num5, num6, num7, num8, num9) gr_log_varargs(audit, msg, GR_PSACCT, task, num1, num2, num3, num4, num5, num6, num7, num8, num9)
++#define gr_log_rwxmap(audit, msg, str) gr_log_varargs(audit, msg, GR_RWXMAP, str)
++
++void gr_log_varargs(int audit, const char *msg, int argtypes, ...);
++
++#endif
++
++#endif
+diff --git a/include/linux/grmsg.h b/include/linux/grmsg.h
+new file mode 100644
+index 0000000..f885406
+--- /dev/null
++++ b/include/linux/grmsg.h
+@@ -0,0 +1,109 @@
++#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
++#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
++#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
++#define GR_STOPMOD_MSG "denied modification of module state by "
++#define GR_ROFS_BLOCKWRITE_MSG "denied write to block device %.950s by "
++#define GR_ROFS_MOUNT_MSG "denied writable mount of %.950s by "
++#define GR_IOPERM_MSG "denied use of ioperm() by "
++#define GR_IOPL_MSG "denied use of iopl() by "
++#define GR_SHMAT_ACL_MSG "denied attach of shared memory of UID %u, PID %d, ID %u by "
++#define GR_UNIX_CHROOT_MSG "denied connect() to abstract AF_UNIX socket outside of chroot by "
++#define GR_SHMAT_CHROOT_MSG "denied attach of shared memory outside of chroot by "
++#define GR_MEM_READWRITE_MSG "denied access of range %Lx -> %Lx in /dev/mem by "
++#define GR_SYMLINK_MSG "not following symlink %.950s owned by %d.%d by "
++#define GR_LEARN_AUDIT_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%lu\t%lu\t%.4095s\t%lu\t%pI4"
++#define GR_ID_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%c\t%d\t%d\t%d\t%pI4"
++#define GR_HIDDEN_ACL_MSG "%s access to hidden file %.950s by "
++#define GR_OPEN_ACL_MSG "%s open of %.950s for%s%s by "
++#define GR_CREATE_ACL_MSG "%s create of %.950s for%s%s by "
++#define GR_FIFO_MSG "denied writing FIFO %.950s of %d.%d by "
++#define GR_MKNOD_CHROOT_MSG "denied mknod of %.950s from chroot by "
++#define GR_MKNOD_ACL_MSG "%s mknod of %.950s by "
++#define GR_UNIXCONNECT_ACL_MSG "%s connect() to the unix domain socket %.950s by "
++#define GR_TTYSNIFF_ACL_MSG "terminal being sniffed by IP:%pI4 %.480s[%.16s:%d], parent %.480s[%.16s:%d] against "
++#define GR_MKDIR_ACL_MSG "%s mkdir of %.950s by "
++#define GR_RMDIR_ACL_MSG "%s rmdir of %.950s by "
++#define GR_UNLINK_ACL_MSG "%s unlink of %.950s by "
++#define GR_SYMLINK_ACL_MSG "%s symlink from %.480s to %.480s by "
++#define GR_HARDLINK_MSG "denied hardlink of %.930s (owned by %d.%d) to %.30s for "
++#define GR_LINK_ACL_MSG "%s link of %.480s to %.480s by "
++#define GR_INHERIT_ACL_MSG "successful inherit of %.480s's ACL for %.480s by "
++#define GR_RENAME_ACL_MSG "%s rename of %.480s to %.480s by "
++#define GR_UNSAFESHARE_EXEC_ACL_MSG "denied exec with cloned fs of %.950s by "
++#define GR_PTRACE_EXEC_ACL_MSG "denied ptrace of %.950s by "
++#define GR_EXEC_ACL_MSG "%s execution of %.950s by "
++#define GR_EXEC_TPE_MSG "denied untrusted exec (due to %.70s) of %.950s by "
++#define GR_SEGVSTART_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning uid %u from login for %lu seconds"
++#define GR_SEGVNOSUID_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning execution for %lu seconds"
++#define GR_MOUNT_CHROOT_MSG "denied mount of %.256s as %.930s from chroot by "
++#define GR_PIVOT_CHROOT_MSG "denied pivot_root from chroot by "
++#define GR_TRUNCATE_ACL_MSG "%s truncate of %.950s by "
++#define GR_ATIME_ACL_MSG "%s access time change of %.950s by "
++#define GR_ACCESS_ACL_MSG "%s access of %.950s for%s%s%s by "
++#define GR_CHROOT_CHROOT_MSG "denied double chroot to %.950s by "
++#define GR_CHMOD_CHROOT_MSG "denied chmod +s of %.950s by "
++#define GR_CHMOD_ACL_MSG "%s chmod of %.950s by "
++#define GR_CHROOT_FCHDIR_MSG "denied fchdir outside of chroot to %.950s by "
++#define GR_CHOWN_ACL_MSG "%s chown of %.950s by "
++#define GR_SETXATTR_ACL_MSG "%s setting extended attributes of %.950s by "
++#define GR_WRITLIB_ACL_MSG "denied load of writable library %.950s by "
++#define GR_INITF_ACL_MSG "init_variables() failed %s by "
++#define GR_DISABLED_ACL_MSG "Error loading %s, trying to run kernel with acls disabled. To disable acls at startup use <kernel image name> gracl=off from your boot loader"
++#define GR_DEV_ACL_MSG "/dev/grsec: %d bytes sent %d required, being fed garbaged by "
++#define GR_SHUTS_ACL_MSG "shutdown auth success for "
++#define GR_SHUTF_ACL_MSG "shutdown auth failure for "
++#define GR_SHUTI_ACL_MSG "ignoring shutdown for disabled RBAC system for "
++#define GR_SEGVMODS_ACL_MSG "segvmod auth success for "
++#define GR_SEGVMODF_ACL_MSG "segvmod auth failure for "
++#define GR_SEGVMODI_ACL_MSG "ignoring segvmod for disabled RBAC system for "
++#define GR_ENABLE_ACL_MSG "%s RBAC system loaded by "
++#define GR_ENABLEF_ACL_MSG "unable to load %s for "
++#define GR_RELOADI_ACL_MSG "ignoring reload request for disabled RBAC system"
++#define GR_RELOAD_ACL_MSG "%s RBAC system reloaded by "
++#define GR_RELOADF_ACL_MSG "failed reload of %s for "
++#define GR_SPROLEI_ACL_MSG "ignoring change to special role for disabled RBAC system for "
++#define GR_SPROLES_ACL_MSG "successful change to special role %s (id %d) by "
++#define GR_SPROLEL_ACL_MSG "special role %s (id %d) exited by "
++#define GR_SPROLEF_ACL_MSG "special role %s failure for "
++#define GR_UNSPROLEI_ACL_MSG "ignoring unauth of special role for disabled RBAC system for "
++#define GR_UNSPROLES_ACL_MSG "successful unauth of special role %s (id %d) by "
++#define GR_INVMODE_ACL_MSG "invalid mode %d by "
++#define GR_PRIORITY_CHROOT_MSG "denied priority change of process (%.16s:%d) by "
++#define GR_FAILFORK_MSG "failed fork with errno %s by "
++#define GR_NICE_CHROOT_MSG "denied priority change by "
++#define GR_UNISIGLOG_MSG "%.32s occurred at %p in "
++#define GR_DUALSIGLOG_MSG "signal %d sent to " DEFAULTSECMSG " by "
++#define GR_SIG_ACL_MSG "denied send of signal %d to protected task " DEFAULTSECMSG " by "
++#define GR_SYSCTL_MSG "denied modification of grsecurity sysctl value : %.32s by "
++#define GR_SYSCTL_ACL_MSG "%s sysctl of %.950s for%s%s by "
++#define GR_TIME_MSG "time set by "
++#define GR_DEFACL_MSG "fatal: unable to find subject for (%.16s:%d), loaded by "
++#define GR_MMAP_ACL_MSG "%s executable mmap of %.950s by "
++#define GR_MPROTECT_ACL_MSG "%s executable mprotect of %.950s by "
++#define GR_SOCK_MSG "denied socket(%.16s,%.16s,%.16s) by "
++#define GR_SOCK_NOINET_MSG "denied socket(%.16s,%.16s,%d) by "
++#define GR_BIND_MSG "denied bind() by "
++#define GR_CONNECT_MSG "denied connect() by "
++#define GR_BIND_ACL_MSG "denied bind() to %pI4 port %u sock type %.16s protocol %.16s by "
++#define GR_CONNECT_ACL_MSG "denied connect() to %pI4 port %u sock type %.16s protocol %.16s by "
++#define GR_IP_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%pI4\t%u\t%u\t%u\t%u\t%pI4"
++#define GR_EXEC_CHROOT_MSG "exec of %.980s within chroot by process "
++#define GR_CAP_ACL_MSG "use of %s denied for "
++#define GR_CAP_CHROOT_MSG "use of %s in chroot denied for "
++#define GR_CAP_ACL_MSG2 "use of %s permitted for "
++#define GR_USRCHANGE_ACL_MSG "change to uid %u denied for "
++#define GR_GRPCHANGE_ACL_MSG "change to gid %u denied for "
++#define GR_REMOUNT_AUDIT_MSG "remount of %.256s by "
++#define GR_UNMOUNT_AUDIT_MSG "unmount of %.256s by "
++#define GR_MOUNT_AUDIT_MSG "mount of %.256s to %.256s by "
++#define GR_CHDIR_AUDIT_MSG "chdir to %.980s by "
++#define GR_EXEC_AUDIT_MSG "exec of %.930s (%.128s) by "
++#define GR_RESOURCE_MSG "denied resource overstep by requesting %lu for %.16s against limit %lu for "
++#define GR_RWXMMAP_MSG "denied RWX mmap of %.950s by "
++#define GR_RWXMPROTECT_MSG "denied RWX mprotect of %.950s by "
++#define GR_TEXTREL_AUDIT_MSG "text relocation in %s, VMA:0x%08lx 0x%08lx by "
++#define GR_VM86_MSG "denied use of vm86 by "
++#define GR_PTRACE_AUDIT_MSG "process %.950s(%.16s:%d) attached to via ptrace by "
++#define GR_PTRACE_READEXEC_MSG "denied ptrace of unreadable binary %.950s by "
++#define GR_INIT_TRANSFER_MSG "persistent special role transferred privilege to init by "
++#define GR_BADPROCPID_MSG "denied read of sensitive /proc/pid/%s entry via fd passed across exec by "
+diff --git a/include/linux/grsecurity.h b/include/linux/grsecurity.h
+new file mode 100644
+index 0000000..c1793ae
+--- /dev/null
++++ b/include/linux/grsecurity.h
+@@ -0,0 +1,219 @@
++#ifndef GR_SECURITY_H
++#define GR_SECURITY_H
++#include <linux/fs.h>
++#include <linux/fs_struct.h>
++#include <linux/binfmts.h>
++#include <linux/gracl.h>
++#include <linux/compat.h>
++
++/* notify of brain-dead configs */
++#if defined(CONFIG_GRKERNSEC_PROC_USER) && defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++#error "CONFIG_GRKERNSEC_PROC_USER and CONFIG_GRKERNSEC_PROC_USERGROUP cannot both be enabled."
++#endif
++#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_PAGEEXEC) && !defined(CONFIG_PAX_SEGMEXEC) && !defined(CONFIG_PAX_KERNEXEC)
++#error "CONFIG_PAX_NOEXEC enabled, but PAGEEXEC, SEGMEXEC, and KERNEXEC are disabled."
++#endif
++#if defined(CONFIG_PAX_ASLR) && !defined(CONFIG_PAX_RANDKSTACK) && !defined(CONFIG_PAX_RANDUSTACK) && !defined(CONFIG_PAX_RANDMMAP)
++#error "CONFIG_PAX_ASLR enabled, but RANDKSTACK, RANDUSTACK, and RANDMMAP are disabled."
++#endif
++#if defined(CONFIG_PAX) && !defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_ASLR)
++#error "CONFIG_PAX enabled, but no PaX options are enabled."
++#endif
++
++void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags);
++void gr_handle_brute_check(void);
++void gr_handle_kernel_exploit(void);
++int gr_process_user_ban(void);
++
++char gr_roletype_to_char(void);
++
++int gr_acl_enable_at_secure(void);
++
++int gr_check_user_change(int real, int effective, int fs);
++int gr_check_group_change(int real, int effective, int fs);
++
++void gr_del_task_from_ip_table(struct task_struct *p);
++
++int gr_pid_is_chrooted(struct task_struct *p);
++int gr_handle_chroot_fowner(struct pid *pid, enum pid_type type);
++int gr_handle_chroot_nice(void);
++int gr_handle_chroot_sysctl(const int op);
++int gr_handle_chroot_setpriority(struct task_struct *p,
++ const int niceval);
++int gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt);
++int gr_handle_chroot_chroot(const struct dentry *dentry,
++ const struct vfsmount *mnt);
++void gr_handle_chroot_chdir(struct path *path);
++int gr_handle_chroot_chmod(const struct dentry *dentry,
++ const struct vfsmount *mnt, const int mode);
++int gr_handle_chroot_mknod(const struct dentry *dentry,
++ const struct vfsmount *mnt, const int mode);
++int gr_handle_chroot_mount(const struct dentry *dentry,
++ const struct vfsmount *mnt,
++ const char *dev_name);
++int gr_handle_chroot_pivot(void);
++int gr_handle_chroot_unix(const pid_t pid);
++
++int gr_handle_rawio(const struct inode *inode);
++
++void gr_handle_ioperm(void);
++void gr_handle_iopl(void);
++
++umode_t gr_acl_umask(void);
++
++int gr_tpe_allow(const struct file *file);
++
++void gr_set_chroot_entries(struct task_struct *task, struct path *path);
++void gr_clear_chroot_entries(struct task_struct *task);
++
++void gr_log_forkfail(const int retval);
++void gr_log_timechange(void);
++void gr_log_signal(const int sig, const void *addr, const struct task_struct *t);
++void gr_log_chdir(const struct dentry *dentry,
++ const struct vfsmount *mnt);
++void gr_log_chroot_exec(const struct dentry *dentry,
++ const struct vfsmount *mnt);
++void gr_handle_exec_args(struct linux_binprm *bprm, const char __user *const __user *argv);
++#ifdef CONFIG_COMPAT
++void gr_handle_exec_args_compat(struct linux_binprm *bprm, compat_uptr_t __user *argv);
++#endif
++void gr_log_remount(const char *devname, const int retval);
++void gr_log_unmount(const char *devname, const int retval);
++void gr_log_mount(const char *from, const char *to, const int retval);
++void gr_log_textrel(struct vm_area_struct *vma);
++void gr_log_rwxmmap(struct file *file);
++void gr_log_rwxmprotect(struct file *file);
++
++int gr_handle_follow_link(const struct inode *parent,
++ const struct inode *inode,
++ const struct dentry *dentry,
++ const struct vfsmount *mnt);
++int gr_handle_fifo(const struct dentry *dentry,
++ const struct vfsmount *mnt,
++ const struct dentry *dir, const int flag,
++ const int acc_mode);
++int gr_handle_hardlink(const struct dentry *dentry,
++ const struct vfsmount *mnt,
++ struct inode *inode,
++ const int mode, const char *to);
++
++int gr_is_capable(const int cap);
++int gr_is_capable_nolog(const int cap);
++void gr_learn_resource(const struct task_struct *task, const int limit,
++ const unsigned long wanted, const int gt);
++void gr_copy_label(struct task_struct *tsk);
++void gr_handle_crash(struct task_struct *task, const int sig);
++int gr_handle_signal(const struct task_struct *p, const int sig);
++int gr_check_crash_uid(const uid_t uid);
++int gr_check_protected_task(const struct task_struct *task);
++int gr_check_protected_task_fowner(struct pid *pid, enum pid_type type);
++int gr_acl_handle_mmap(const struct file *file,
++ const unsigned long prot);
++int gr_acl_handle_mprotect(const struct file *file,
++ const unsigned long prot);
++int gr_check_hidden_task(const struct task_struct *tsk);
++__u32 gr_acl_handle_truncate(const struct dentry *dentry,
++ const struct vfsmount *mnt);
++__u32 gr_acl_handle_utime(const struct dentry *dentry,
++ const struct vfsmount *mnt);
++__u32 gr_acl_handle_access(const struct dentry *dentry,
++ const struct vfsmount *mnt, const int fmode);
++__u32 gr_acl_handle_chmod(const struct dentry *dentry,
++ const struct vfsmount *mnt, umode_t *mode);
++__u32 gr_acl_handle_chown(const struct dentry *dentry,
++ const struct vfsmount *mnt);
++__u32 gr_acl_handle_setxattr(const struct dentry *dentry,
++ const struct vfsmount *mnt);
++int gr_handle_ptrace(struct task_struct *task, const long request);
++int gr_handle_proc_ptrace(struct task_struct *task);
++__u32 gr_acl_handle_execve(const struct dentry *dentry,
++ const struct vfsmount *mnt);
++int gr_check_crash_exec(const struct file *filp);
++int gr_acl_is_enabled(void);
++void gr_set_kernel_label(struct task_struct *task);
++void gr_set_role_label(struct task_struct *task, const uid_t uid,
++ const gid_t gid);
++int gr_set_proc_label(const struct dentry *dentry,
++ const struct vfsmount *mnt,
++ const int unsafe_flags);
++__u32 gr_acl_handle_hidden_file(const struct dentry *dentry,
++ const struct vfsmount *mnt);
++__u32 gr_acl_handle_open(const struct dentry *dentry,
++ const struct vfsmount *mnt, int acc_mode);
++__u32 gr_acl_handle_creat(const struct dentry *dentry,
++ const struct dentry *p_dentry,
++ const struct vfsmount *p_mnt,
++ int open_flags, int acc_mode, const int imode);
++void gr_handle_create(const struct dentry *dentry,
++ const struct vfsmount *mnt);
++void gr_handle_proc_create(const struct dentry *dentry,
++ const struct inode *inode);
++__u32 gr_acl_handle_mknod(const struct dentry *new_dentry,
++ const struct dentry *parent_dentry,
++ const struct vfsmount *parent_mnt,
++ const int mode);
++__u32 gr_acl_handle_mkdir(const struct dentry *new_dentry,
++ const struct dentry *parent_dentry,
++ const struct vfsmount *parent_mnt);
++__u32 gr_acl_handle_rmdir(const struct dentry *dentry,
++ const struct vfsmount *mnt);
++void gr_handle_delete(const ino_t ino, const dev_t dev);
++__u32 gr_acl_handle_unlink(const struct dentry *dentry,
++ const struct vfsmount *mnt);
++__u32 gr_acl_handle_symlink(const struct dentry *new_dentry,
++ const struct dentry *parent_dentry,
++ const struct vfsmount *parent_mnt,
++ const char *from);
++__u32 gr_acl_handle_link(const struct dentry *new_dentry,
++ const struct dentry *parent_dentry,
++ const struct vfsmount *parent_mnt,
++ const struct dentry *old_dentry,
++ const struct vfsmount *old_mnt, const char *to);
++int gr_acl_handle_rename(struct dentry *new_dentry,
++ struct dentry *parent_dentry,
++ const struct vfsmount *parent_mnt,
++ struct dentry *old_dentry,
++ struct inode *old_parent_inode,
++ struct vfsmount *old_mnt, const char *newname);
++void gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
++ struct dentry *old_dentry,
++ struct dentry *new_dentry,
++ struct vfsmount *mnt, const __u8 replace);
++__u32 gr_check_link(const struct dentry *new_dentry,
++ const struct dentry *parent_dentry,
++ const struct vfsmount *parent_mnt,
++ const struct dentry *old_dentry,
++ const struct vfsmount *old_mnt);
++int gr_acl_handle_filldir(const struct file *file, const char *name,
++ const unsigned int namelen, const ino_t ino);
++
++__u32 gr_acl_handle_unix(const struct dentry *dentry,
++ const struct vfsmount *mnt);
++void gr_acl_handle_exit(void);
++void gr_acl_handle_psacct(struct task_struct *task, const long code);
++int gr_acl_handle_procpidmem(const struct task_struct *task);
++int gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags);
++int gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode);
++void gr_audit_ptrace(struct task_struct *task);
++dev_t gr_get_dev_from_dentry(struct dentry *dentry);
++
++int gr_ptrace_readexec(struct file *file, int unsafe_flags);
++
++#ifdef CONFIG_GRKERNSEC
++void task_grsec_rbac(struct seq_file *m, struct task_struct *p);
++void gr_handle_vm86(void);
++void gr_handle_mem_readwrite(u64 from, u64 to);
++
++void gr_log_badprocpid(const char *entry);
++
++extern int grsec_enable_dmesg;
++extern int grsec_disable_privio;
++#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
++extern int grsec_enable_chroot_findtask;
++#endif
++#ifdef CONFIG_GRKERNSEC_SETXID
++extern int grsec_enable_setxid;
++#endif
++#endif
++
++#endif
+diff --git a/include/linux/hdpu_features.h b/include/linux/hdpu_features.h
+index 6a87154..a3ce57b 100644
+--- a/include/linux/hdpu_features.h
++++ b/include/linux/hdpu_features.h
+@@ -3,7 +3,7 @@
+ struct cpustate_t {
+ spinlock_t lock;
+ int excl;
+- int open_count;
++ atomic_t open_count;
+ unsigned char cached_val;
+ int inited;
+ unsigned long *set_addr;
+diff --git a/include/linux/highmem.h b/include/linux/highmem.h
+index 211ff44..00ab6d7 100644
+--- a/include/linux/highmem.h
++++ b/include/linux/highmem.h
+@@ -137,6 +137,18 @@ static inline void clear_highpage(struct page *page)
+ kunmap_atomic(kaddr, KM_USER0);
+ }
+
++static inline void sanitize_highpage(struct page *page)
++{
++ void *kaddr;
++ unsigned long flags;
++
++ local_irq_save(flags);
++ kaddr = kmap_atomic(page, KM_CLEARPAGE);
++ clear_page(kaddr);
++ kunmap_atomic(kaddr, KM_CLEARPAGE);
++ local_irq_restore(flags);
++}
++
+ static inline void zero_user_segments(struct page *page,
+ unsigned start1, unsigned end1,
+ unsigned start2, unsigned end2)
+diff --git a/include/linux/i2c.h b/include/linux/i2c.h
+index 7b40cda..24eb44e 100644
+--- a/include/linux/i2c.h
++++ b/include/linux/i2c.h
+@@ -325,6 +325,7 @@ struct i2c_algorithm {
+ /* To determine what the adapter supports */
+ u32 (*functionality) (struct i2c_adapter *);
+ };
++typedef struct i2c_algorithm __no_const i2c_algorithm_no_const;
+
+ /*
+ * i2c_adapter is the structure used to identify a physical i2c bus along
+diff --git a/include/linux/i2o.h b/include/linux/i2o.h
+index 4c4e57d..f3c5303 100644
+--- a/include/linux/i2o.h
++++ b/include/linux/i2o.h
+@@ -564,7 +564,7 @@ struct i2o_controller {
+ struct i2o_device *exec; /* Executive */
+ #if BITS_PER_LONG == 64
+ spinlock_t context_list_lock; /* lock for context_list */
+- atomic_t context_list_counter; /* needed for unique contexts */
++ atomic_unchecked_t context_list_counter; /* needed for unique contexts */
+ struct list_head context_list; /* list of context id's
+ and pointers */
+ #endif
+diff --git a/include/linux/init_task.h b/include/linux/init_task.h
+index 21a6f5d..dc42eab 100644
+--- a/include/linux/init_task.h
++++ b/include/linux/init_task.h
+@@ -83,6 +83,12 @@ extern struct group_info init_groups;
+ #define INIT_IDS
+ #endif
+
++#ifdef CONFIG_X86
++#define INIT_TASK_THREAD_INFO .tinfo = INIT_THREAD_INFO,
++#else
++#define INIT_TASK_THREAD_INFO
++#endif
++
+ #ifdef CONFIG_SECURITY_FILE_CAPABILITIES
+ /*
+ * Because of the reduced scope of CAP_SETPCAP when filesystem
+@@ -156,6 +162,7 @@ extern struct cred init_cred;
+ __MUTEX_INITIALIZER(tsk.cred_guard_mutex), \
+ .comm = "swapper", \
+ .thread = INIT_THREAD, \
++ INIT_TASK_THREAD_INFO \
+ .fs = &init_fs, \
+ .files = &init_files, \
+ .signal = &init_signals, \
+diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
+index 4f0a72a..a849599 100644
+--- a/include/linux/intel-iommu.h
++++ b/include/linux/intel-iommu.h
+@@ -296,7 +296,7 @@ struct iommu_flush {
+ u8 fm, u64 type);
+ void (*flush_iotlb)(struct intel_iommu *iommu, u16 did, u64 addr,
+ unsigned int size_order, u64 type);
+-};
++} __no_const;
+
+ enum {
+ SR_DMAR_FECTL_REG,
+diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
+index c739150..be577b5 100644
+--- a/include/linux/interrupt.h
++++ b/include/linux/interrupt.h
+@@ -369,7 +369,7 @@ enum
+ /* map softirq index to softirq name. update 'softirq_to_name' in
+ * kernel/softirq.c when adding a new softirq.
+ */
+-extern char *softirq_to_name[NR_SOFTIRQS];
++extern const char * const softirq_to_name[NR_SOFTIRQS];
+
+ /* softirq mask and active fields moved to irq_cpustat_t in
+ * asm/hardirq.h to get better cache usage. KAO
+@@ -377,12 +377,12 @@ extern char *softirq_to_name[NR_SOFTIRQS];
+
+ struct softirq_action
+ {
+- void (*action)(struct softirq_action *);
++ void (*action)(void);
+ };
+
+ asmlinkage void do_softirq(void);
+ asmlinkage void __do_softirq(void);
+-extern void open_softirq(int nr, void (*action)(struct softirq_action *));
++extern void open_softirq(int nr, void (*action)(void));
+ extern void softirq_init(void);
+ #define __raise_softirq_irqoff(nr) do { or_softirq_pending(1UL << (nr)); } while (0)
+ extern void raise_softirq_irqoff(unsigned int nr);
+diff --git a/include/linux/iocontext.h b/include/linux/iocontext.h
+index eb73632..19abfc1 100644
+--- a/include/linux/iocontext.h
++++ b/include/linux/iocontext.h
+@@ -94,14 +94,15 @@ static inline struct io_context *ioc_task_link(struct io_context *ioc)
+ return NULL;
+ }
+
++struct task_struct;
+ #ifdef CONFIG_BLOCK
+ int put_io_context(struct io_context *ioc);
+-void exit_io_context(void);
++void exit_io_context(struct task_struct *task);
+ struct io_context *get_io_context(gfp_t gfp_flags, int node);
+ struct io_context *alloc_io_context(gfp_t gfp_flags, int node);
+ void copy_io_context(struct io_context **pdst, struct io_context **psrc);
+ #else
+-static inline void exit_io_context(void)
++static inline void exit_io_context(struct task_struct *task)
+ {
+ }
+
+diff --git a/include/linux/irq.h b/include/linux/irq.h
+index 9e5f45a..025865b 100644
+--- a/include/linux/irq.h
++++ b/include/linux/irq.h
+@@ -438,12 +438,12 @@ extern int set_irq_msi(unsigned int irq, struct msi_desc *entry);
+ static inline bool alloc_desc_masks(struct irq_desc *desc, int node,
+ bool boot)
+ {
++#ifdef CONFIG_CPUMASK_OFFSTACK
+ gfp_t gfp = GFP_ATOMIC;
+
+ if (boot)
+ gfp = GFP_NOWAIT;
+
+-#ifdef CONFIG_CPUMASK_OFFSTACK
+ if (!alloc_cpumask_var_node(&desc->affinity, gfp, node))
+ return false;
+
+diff --git a/include/linux/kallsyms.h b/include/linux/kallsyms.h
+index 7922742..27306a2 100644
+--- a/include/linux/kallsyms.h
++++ b/include/linux/kallsyms.h
+@@ -15,7 +15,8 @@
+
+ struct module;
+
+-#ifdef CONFIG_KALLSYMS
++#if !defined(__INCLUDED_BY_HIDESYM) || !defined(CONFIG_KALLSYMS)
++#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
+ /* Lookup the address for a symbol. Returns 0 if not found. */
+ unsigned long kallsyms_lookup_name(const char *name);
+
+@@ -92,6 +93,15 @@ static inline int lookup_symbol_attrs(unsigned long addr, unsigned long *size, u
+ /* Stupid that this does nothing, but I didn't create this mess. */
+ #define __print_symbol(fmt, addr)
+ #endif /*CONFIG_KALLSYMS*/
++#else /* when included by kallsyms.c, vsnprintf.c, or
++ arch/x86/kernel/dumpstack.c, with HIDESYM enabled */
++extern void __print_symbol(const char *fmt, unsigned long address);
++extern int sprint_symbol(char *buffer, unsigned long address);
++const char *kallsyms_lookup(unsigned long addr,
++ unsigned long *symbolsize,
++ unsigned long *offset,
++ char **modname, char *namebuf);
++#endif
+
+ /* This macro allows us to keep printk typechecking */
+ static void __check_printsym_format(const char *fmt, ...)
+diff --git a/include/linux/kgdb.h b/include/linux/kgdb.h
+index 6adcc29..13369e8 100644
+--- a/include/linux/kgdb.h
++++ b/include/linux/kgdb.h
+@@ -74,8 +74,8 @@ void kgdb_breakpoint(void);
+
+ extern int kgdb_connected;
+
+-extern atomic_t kgdb_setting_breakpoint;
+-extern atomic_t kgdb_cpu_doing_single_step;
++extern atomic_unchecked_t kgdb_setting_breakpoint;
++extern atomic_unchecked_t kgdb_cpu_doing_single_step;
+
+ extern struct task_struct *kgdb_usethread;
+ extern struct task_struct *kgdb_contthread;
+@@ -235,7 +235,7 @@ struct kgdb_arch {
+ int (*remove_hw_breakpoint)(unsigned long, int, enum kgdb_bptype);
+ void (*remove_all_hw_break)(void);
+ void (*correct_hw_break)(void);
+-};
++} __do_const;
+
+ /**
+ * struct kgdb_io - Describe the interface for an I/O driver to talk with KGDB.
+@@ -257,14 +257,14 @@ struct kgdb_io {
+ int (*init) (void);
+ void (*pre_exception) (void);
+ void (*post_exception) (void);
+-};
++} __do_const;
+
+-extern struct kgdb_arch arch_kgdb_ops;
++extern const struct kgdb_arch arch_kgdb_ops;
+
+ extern unsigned long __weak kgdb_arch_pc(int exception, struct pt_regs *regs);
+
+-extern int kgdb_register_io_module(struct kgdb_io *local_kgdb_io_ops);
+-extern void kgdb_unregister_io_module(struct kgdb_io *local_kgdb_io_ops);
++extern int kgdb_register_io_module(const struct kgdb_io *local_kgdb_io_ops);
++extern void kgdb_unregister_io_module(const struct kgdb_io *local_kgdb_io_ops);
+
+ extern int kgdb_hex2long(char **ptr, unsigned long *long_val);
+ extern int kgdb_mem2hex(char *mem, char *buf, int count);
+diff --git a/include/linux/kmod.h b/include/linux/kmod.h
+index 0546fe7..2a22bc1 100644
+--- a/include/linux/kmod.h
++++ b/include/linux/kmod.h
+@@ -31,6 +31,8 @@
+ * usually useless though. */
+ extern int __request_module(bool wait, const char *name, ...) \
+ __attribute__((format(printf, 2, 3)));
++extern int ___request_module(bool wait, char *param_name, const char *name, ...) \
++ __attribute__((format(printf, 3, 4)));
+ #define request_module(mod...) __request_module(true, mod)
+ #define request_module_nowait(mod...) __request_module(false, mod)
+ #define try_then_request_module(x, mod...) \
+diff --git a/include/linux/kobject.h b/include/linux/kobject.h
+index 58ae8e0..3950d3c 100644
+--- a/include/linux/kobject.h
++++ b/include/linux/kobject.h
+@@ -106,7 +106,7 @@ extern char *kobject_get_path(struct kobject *kobj, gfp_t flag);
+
+ struct kobj_type {
+ void (*release)(struct kobject *kobj);
+- struct sysfs_ops *sysfs_ops;
++ const struct sysfs_ops *sysfs_ops;
+ struct attribute **default_attrs;
+ };
+
+@@ -118,9 +118,9 @@ struct kobj_uevent_env {
+ };
+
+ struct kset_uevent_ops {
+- int (*filter)(struct kset *kset, struct kobject *kobj);
+- const char *(*name)(struct kset *kset, struct kobject *kobj);
+- int (*uevent)(struct kset *kset, struct kobject *kobj,
++ int (* const filter)(struct kset *kset, struct kobject *kobj);
++ const char *(* const name)(struct kset *kset, struct kobject *kobj);
++ int (* const uevent)(struct kset *kset, struct kobject *kobj,
+ struct kobj_uevent_env *env);
+ };
+
+@@ -132,7 +132,7 @@ struct kobj_attribute {
+ const char *buf, size_t count);
+ };
+
+-extern struct sysfs_ops kobj_sysfs_ops;
++extern const struct sysfs_ops kobj_sysfs_ops;
+
+ /**
+ * struct kset - a set of kobjects of a specific type, belonging to a specific subsystem.
+@@ -155,14 +155,14 @@ struct kset {
+ struct list_head list;
+ spinlock_t list_lock;
+ struct kobject kobj;
+- struct kset_uevent_ops *uevent_ops;
++ const struct kset_uevent_ops *uevent_ops;
+ };
+
+ extern void kset_init(struct kset *kset);
+ extern int __must_check kset_register(struct kset *kset);
+ extern void kset_unregister(struct kset *kset);
+ extern struct kset * __must_check kset_create_and_add(const char *name,
+- struct kset_uevent_ops *u,
++ const struct kset_uevent_ops *u,
+ struct kobject *parent_kobj);
+
+ static inline struct kset *to_kset(struct kobject *kobj)
+diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
+index c728a50..752d821 100644
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -210,7 +210,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vcpu);
+ void vcpu_load(struct kvm_vcpu *vcpu);
+ void vcpu_put(struct kvm_vcpu *vcpu);
+
+-int kvm_init(void *opaque, unsigned int vcpu_size,
++int kvm_init(const void *opaque, unsigned int vcpu_size,
+ struct module *module);
+ void kvm_exit(void);
+
+@@ -316,7 +316,7 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(struct kvm_vcpu *vcpu,
+ struct kvm_guest_debug *dbg);
+ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run);
+
+-int kvm_arch_init(void *opaque);
++int kvm_arch_init(const void *opaque);
+ void kvm_arch_exit(void);
+
+ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index a069916..223edde 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -525,11 +525,11 @@ struct ata_ioports {
+
+ struct ata_host {
+ spinlock_t lock;
+- struct device *dev;
++ struct device *dev;
+ void __iomem * const *iomap;
+ unsigned int n_ports;
+ void *private_data;
+- struct ata_port_operations *ops;
++ const struct ata_port_operations *ops;
+ unsigned long flags;
+ #ifdef CONFIG_ATA_ACPI
+ acpi_handle acpi_handle;
+@@ -710,7 +710,7 @@ struct ata_link {
+
+ struct ata_port {
+ struct Scsi_Host *scsi_host; /* our co-allocated scsi host */
+- struct ata_port_operations *ops;
++ const struct ata_port_operations *ops;
+ spinlock_t *lock;
+ /* Flags owned by the EH context. Only EH should touch these once the
+ port is active */
+@@ -884,7 +884,7 @@ struct ata_port_operations {
+ * fields must be pointers.
+ */
+ const struct ata_port_operations *inherits;
+-};
++} __do_const;
+
+ struct ata_port_info {
+ unsigned long flags;
+@@ -892,7 +892,7 @@ struct ata_port_info {
+ unsigned long pio_mask;
+ unsigned long mwdma_mask;
+ unsigned long udma_mask;
+- struct ata_port_operations *port_ops;
++ const struct ata_port_operations *port_ops;
+ void *private_data;
+ };
+
+@@ -916,7 +916,7 @@ extern const unsigned long sata_deb_timing_normal[];
+ extern const unsigned long sata_deb_timing_hotplug[];
+ extern const unsigned long sata_deb_timing_long[];
+
+-extern struct ata_port_operations ata_dummy_port_ops;
++extern const struct ata_port_operations ata_dummy_port_ops;
+ extern const struct ata_port_info ata_dummy_port_info;
+
+ static inline const unsigned long *
+@@ -962,7 +962,7 @@ extern int ata_host_activate(struct ata_host *host, int irq,
+ struct scsi_host_template *sht);
+ extern void ata_host_detach(struct ata_host *host);
+ extern void ata_host_init(struct ata_host *, struct device *,
+- unsigned long, struct ata_port_operations *);
++ unsigned long, const struct ata_port_operations *);
+ extern int ata_scsi_detect(struct scsi_host_template *sht);
+ extern int ata_scsi_ioctl(struct scsi_device *dev, int cmd, void __user *arg);
+ extern int ata_scsi_queuecmd(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *));
+diff --git a/include/linux/lockd/bind.h b/include/linux/lockd/bind.h
+index fbc48f8..0886e57 100644
+--- a/include/linux/lockd/bind.h
++++ b/include/linux/lockd/bind.h
+@@ -23,13 +23,13 @@ struct svc_rqst;
+ * This is the set of functions for lockd->nfsd communication
+ */
+ struct nlmsvc_binding {
+- __be32 (*fopen)(struct svc_rqst *,
++ __be32 (* const fopen)(struct svc_rqst *,
+ struct nfs_fh *,
+ struct file **);
+- void (*fclose)(struct file *);
++ void (* const fclose)(struct file *);
+ };
+
+-extern struct nlmsvc_binding * nlmsvc_ops;
++extern const struct nlmsvc_binding * nlmsvc_ops;
+
+ /*
+ * Similar to nfs_client_initdata, but without the NFS-specific
+diff --git a/include/linux/mca.h b/include/linux/mca.h
+index 3797270..7765ede 100644
+--- a/include/linux/mca.h
++++ b/include/linux/mca.h
+@@ -80,7 +80,7 @@ struct mca_bus_accessor_functions {
+ int region);
+ void * (*mca_transform_memory)(struct mca_device *,
+ void *memory);
+-};
++} __no_const;
+
+ struct mca_bus {
+ u64 default_dma_mask;
+diff --git a/include/linux/memory.h b/include/linux/memory.h
+index 37fa19b..b597c85 100644
+--- a/include/linux/memory.h
++++ b/include/linux/memory.h
+@@ -108,7 +108,7 @@ struct memory_accessor {
+ size_t count);
+ ssize_t (*write)(struct memory_accessor *, const char *buf,
+ off_t offset, size_t count);
+-};
++} __no_const;
+
+ /*
+ * Kernel text modification mutex, used for code patching. Users of this lock
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index 11e5be6..8ff8c91 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -106,7 +106,14 @@ extern unsigned int kobjsize(const void *objp);
+
+ #define VM_CAN_NONLINEAR 0x08000000 /* Has ->fault & does nonlinear pages */
+ #define VM_MIXEDMAP 0x10000000 /* Can contain "struct page" and pure PFN pages */
++
++#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
++#define VM_SAO 0x00000000 /* Strong Access Ordering (powerpc) */
++#define VM_PAGEEXEC 0x20000000 /* vma->vm_page_prot needs special handling */
++#else
+ #define VM_SAO 0x20000000 /* Strong Access Ordering (powerpc) */
++#endif
++
+ #define VM_PFN_AT_MMAP 0x40000000 /* PFNMAP vma that is fully mapped at mmap time */
+ #define VM_MERGEABLE 0x80000000 /* KSM may merge identical pages */
+
+@@ -841,12 +848,6 @@ int set_page_dirty(struct page *page);
+ int set_page_dirty_lock(struct page *page);
+ int clear_page_dirty_for_io(struct page *page);
+
+-/* Is the vma a continuation of the stack vma above it? */
+-static inline int vma_stack_continue(struct vm_area_struct *vma, unsigned long addr)
+-{
+- return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN);
+-}
+-
+ extern unsigned long move_page_tables(struct vm_area_struct *vma,
+ unsigned long old_addr, struct vm_area_struct *new_vma,
+ unsigned long new_addr, unsigned long len);
+@@ -890,6 +891,8 @@ struct shrinker {
+ extern void register_shrinker(struct shrinker *);
+ extern void unregister_shrinker(struct shrinker *);
+
++pgprot_t vm_get_page_prot(unsigned long vm_flags);
++
+ int vma_wants_writenotify(struct vm_area_struct *vma);
+
+ extern pte_t *get_locked_pte(struct mm_struct *mm, unsigned long addr, spinlock_t **ptl);
+@@ -900,8 +903,15 @@ static inline int __pud_alloc(struct mm_struct *mm, pgd_t *pgd,
+ {
+ return 0;
+ }
++
++static inline int __pud_alloc_kernel(struct mm_struct *mm, pgd_t *pgd,
++ unsigned long address)
++{
++ return 0;
++}
+ #else
+ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address);
++int __pud_alloc_kernel(struct mm_struct *mm, pgd_t *pgd, unsigned long address);
+ #endif
+
+ #ifdef __PAGETABLE_PMD_FOLDED
+@@ -910,8 +920,15 @@ static inline int __pmd_alloc(struct mm_struct *mm, pud_t *pud,
+ {
+ return 0;
+ }
++
++static inline int __pmd_alloc_kernel(struct mm_struct *mm, pud_t *pud,
++ unsigned long address)
++{
++ return 0;
++}
+ #else
+ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address);
++int __pmd_alloc_kernel(struct mm_struct *mm, pud_t *pud, unsigned long address);
+ #endif
+
+ int __pte_alloc(struct mm_struct *mm, pmd_t *pmd, unsigned long address);
+@@ -928,11 +945,23 @@ static inline pud_t *pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long a
+ NULL: pud_offset(pgd, address);
+ }
+
++static inline pud_t *pud_alloc_kernel(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
++{
++ return (unlikely(pgd_none(*pgd)) && __pud_alloc_kernel(mm, pgd, address))?
++ NULL: pud_offset(pgd, address);
++}
++
+ static inline pmd_t *pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
+ {
+ return (unlikely(pud_none(*pud)) && __pmd_alloc(mm, pud, address))?
+ NULL: pmd_offset(pud, address);
+ }
++
++static inline pmd_t *pmd_alloc_kernel(struct mm_struct *mm, pud_t *pud, unsigned long address)
++{
++ return (unlikely(pud_none(*pud)) && __pmd_alloc_kernel(mm, pud, address))?
++ NULL: pmd_offset(pud, address);
++}
+ #endif /* CONFIG_MMU && !__ARCH_HAS_4LEVEL_HACK */
+
+ #if USE_SPLIT_PTLOCKS
+@@ -1162,6 +1191,7 @@ out:
+ }
+
+ extern int do_munmap(struct mm_struct *, unsigned long, size_t);
++extern int __do_munmap(struct mm_struct *, unsigned long, size_t);
+
+ extern unsigned long do_brk(unsigned long, unsigned long);
+
+@@ -1218,6 +1248,10 @@ extern struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long add
+ extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
+ struct vm_area_struct **pprev);
+
++extern struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma);
++extern void pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma);
++extern void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl);
++
+ /* Look up the first VMA which intersects the interval start_addr..end_addr-1,
+ NULL if none. Assume start_addr < end_addr. */
+ static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr)
+@@ -1234,7 +1268,6 @@ static inline unsigned long vma_pages(struct vm_area_struct *vma)
+ return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
+ }
+
+-pgprot_t vm_get_page_prot(unsigned long vm_flags);
+ struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr);
+ int remap_pfn_range(struct vm_area_struct *, unsigned long addr,
+ unsigned long pfn, unsigned long size, pgprot_t);
+@@ -1332,7 +1365,13 @@ extern void memory_failure(unsigned long pfn, int trapno);
+ extern int __memory_failure(unsigned long pfn, int trapno, int ref);
+ extern int sysctl_memory_failure_early_kill;
+ extern int sysctl_memory_failure_recovery;
+-extern atomic_long_t mce_bad_pages;
++extern atomic_long_unchecked_t mce_bad_pages;
++
++#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
++extern void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot);
++#else
++static inline void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot) {}
++#endif
+
+ #endif /* __KERNEL__ */
+ #endif /* _LINUX_MM_H */
+diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
+index 9d12ed5..c5e5ab6 100644
+--- a/include/linux/mm_types.h
++++ b/include/linux/mm_types.h
+@@ -186,6 +186,8 @@ struct vm_area_struct {
+ #ifdef CONFIG_NUMA
+ struct mempolicy *vm_policy; /* NUMA policy for the VMA */
+ #endif
++
++ struct vm_area_struct *vm_mirror;/* PaX: mirror vma or NULL */
+ };
+
+ struct core_thread {
+@@ -235,7 +237,7 @@ struct mm_struct {
+ unsigned long total_vm, locked_vm, shared_vm, exec_vm;
+ unsigned long stack_vm, reserved_vm, def_flags, nr_ptes;
+ unsigned long start_code, end_code, start_data, end_data;
+- unsigned long start_brk, brk, start_stack;
++ unsigned long brk_gap, start_brk, brk, start_stack;
+ unsigned long arg_start, arg_end, env_start, env_end;
+
+ unsigned long saved_auxv[AT_VECTOR_SIZE]; /* for /proc/PID/auxv */
+@@ -287,6 +289,24 @@ struct mm_struct {
+ #ifdef CONFIG_MMU_NOTIFIER
+ struct mmu_notifier_mm *mmu_notifier_mm;
+ #endif
++
++#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) || defined(CONFIG_PAX_XATTR_PAX_FLAGS) || defined(CONFIG_PAX_HAVE_ACL_FLAGS) || defined(CONFIG_PAX_HOOK_ACL_FLAGS)
++ unsigned long pax_flags;
++#endif
++
++#ifdef CONFIG_PAX_DLRESOLVE
++ unsigned long call_dl_resolve;
++#endif
++
++#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
++ unsigned long call_syscall;
++#endif
++
++#ifdef CONFIG_PAX_ASLR
++ unsigned long delta_mmap; /* randomized offset */
++ unsigned long delta_stack; /* randomized offset */
++#endif
++
+ };
+
+ /* Future-safe accessor for struct mm_struct's cpu_vm_mask. */
+diff --git a/include/linux/mmu_notifier.h b/include/linux/mmu_notifier.h
+index 4e02ee2..afb159e 100644
+--- a/include/linux/mmu_notifier.h
++++ b/include/linux/mmu_notifier.h
+@@ -235,12 +235,12 @@ static inline void mmu_notifier_mm_destroy(struct mm_struct *mm)
+ */
+ #define ptep_clear_flush_notify(__vma, __address, __ptep) \
+ ({ \
+- pte_t __pte; \
++ pte_t ___pte; \
+ struct vm_area_struct *___vma = __vma; \
+ unsigned long ___address = __address; \
+- __pte = ptep_clear_flush(___vma, ___address, __ptep); \
++ ___pte = ptep_clear_flush(___vma, ___address, __ptep); \
+ mmu_notifier_invalidate_page(___vma->vm_mm, ___address); \
+- __pte; \
++ ___pte; \
+ })
+
+ #define ptep_clear_flush_young_notify(__vma, __address, __ptep) \
+diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
+index 6c31a2a..4b0e930 100644
+--- a/include/linux/mmzone.h
++++ b/include/linux/mmzone.h
+@@ -350,7 +350,7 @@ struct zone {
+ unsigned long flags; /* zone flags, see below */
+
+ /* Zone statistics */
+- atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
++ atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
+
+ /*
+ * prev_priority holds the scanning priority for this zone. It is
+diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
+index f58e9d8..3503935 100644
+--- a/include/linux/mod_devicetable.h
++++ b/include/linux/mod_devicetable.h
+@@ -12,7 +12,7 @@
+ typedef unsigned long kernel_ulong_t;
+ #endif
+
+-#define PCI_ANY_ID (~0)
++#define PCI_ANY_ID ((__u16)~0)
+
+ struct pci_device_id {
+ __u32 vendor, device; /* Vendor and device ID or PCI_ANY_ID*/
+@@ -131,7 +131,7 @@ struct usb_device_id {
+ #define USB_DEVICE_ID_MATCH_INT_SUBCLASS 0x0100
+ #define USB_DEVICE_ID_MATCH_INT_PROTOCOL 0x0200
+
+-#define HID_ANY_ID (~0)
++#define HID_ANY_ID (~0U)
+
+ struct hid_device_id {
+ __u16 bus;
+diff --git a/include/linux/module.h b/include/linux/module.h
+index 482efc8..642032b 100644
+--- a/include/linux/module.h
++++ b/include/linux/module.h
+@@ -16,6 +16,7 @@
+ #include <linux/kobject.h>
+ #include <linux/moduleparam.h>
+ #include <linux/tracepoint.h>
++#include <linux/fs.h>
+
+ #include <asm/local.h>
+ #include <asm/module.h>
+@@ -287,16 +288,16 @@ struct module
+ int (*init)(void);
+
+ /* If this is non-NULL, vfree after init() returns */
+- void *module_init;
++ void *module_init_rx, *module_init_rw;
+
+ /* Here is the actual code + data, vfree'd on unload. */
+- void *module_core;
++ void *module_core_rx, *module_core_rw;
+
+ /* Here are the sizes of the init and core sections */
+- unsigned int init_size, core_size;
++ unsigned int init_size_rw, core_size_rw;
+
+ /* The size of the executable code in each section. */
+- unsigned int init_text_size, core_text_size;
++ unsigned int init_size_rx, core_size_rx;
+
+ /* Arch-specific module values */
+ struct mod_arch_specific arch;
+@@ -345,6 +346,10 @@ struct module
+ #ifdef CONFIG_EVENT_TRACING
+ struct ftrace_event_call *trace_events;
+ unsigned int num_trace_events;
++ struct file_operations trace_id;
++ struct file_operations trace_enable;
++ struct file_operations trace_format;
++ struct file_operations trace_filter;
+ #endif
+ #ifdef CONFIG_FTRACE_MCOUNT_RECORD
+ unsigned long *ftrace_callsites;
+@@ -393,16 +398,46 @@ struct module *__module_address(unsigned long addr);
+ bool is_module_address(unsigned long addr);
+ bool is_module_text_address(unsigned long addr);
+
++static inline int within_module_range(unsigned long addr, void *start, unsigned long size)
++{
++
++#ifdef CONFIG_PAX_KERNEXEC
++ if (ktla_ktva(addr) >= (unsigned long)start &&
++ ktla_ktva(addr) < (unsigned long)start + size)
++ return 1;
++#endif
++
++ return ((void *)addr >= start && (void *)addr < start + size);
++}
++
++static inline int within_module_core_rx(unsigned long addr, struct module *mod)
++{
++ return within_module_range(addr, mod->module_core_rx, mod->core_size_rx);
++}
++
++static inline int within_module_core_rw(unsigned long addr, struct module *mod)
++{
++ return within_module_range(addr, mod->module_core_rw, mod->core_size_rw);
++}
++
++static inline int within_module_init_rx(unsigned long addr, struct module *mod)
++{
++ return within_module_range(addr, mod->module_init_rx, mod->init_size_rx);
++}
++
++static inline int within_module_init_rw(unsigned long addr, struct module *mod)
++{
++ return within_module_range(addr, mod->module_init_rw, mod->init_size_rw);
++}
++
+ static inline int within_module_core(unsigned long addr, struct module *mod)
+ {
+- return (unsigned long)mod->module_core <= addr &&
+- addr < (unsigned long)mod->module_core + mod->core_size;
++ return within_module_core_rx(addr, mod) || within_module_core_rw(addr, mod);
+ }
+
+ static inline int within_module_init(unsigned long addr, struct module *mod)
+ {
+- return (unsigned long)mod->module_init <= addr &&
+- addr < (unsigned long)mod->module_init + mod->init_size;
++ return within_module_init_rx(addr, mod) || within_module_init_rw(addr, mod);
+ }
+
+ /* Search for module by name: must hold module_mutex. */
+diff --git a/include/linux/moduleloader.h b/include/linux/moduleloader.h
+index c1f40c2..f26b93c 100644
+--- a/include/linux/moduleloader.h
++++ b/include/linux/moduleloader.h
+@@ -20,9 +20,21 @@ unsigned int arch_mod_section_prepend(struct module *mod, unsigned int section);
+ sections. Returns NULL on failure. */
+ void *module_alloc(unsigned long size);
+
++#ifdef CONFIG_PAX_KERNEXEC
++void *module_alloc_exec(unsigned long size) __size_overflow(1);
++#else
++#define module_alloc_exec(x) module_alloc(x)
++#endif
++
+ /* Free memory returned from module_alloc. */
+ void module_free(struct module *mod, void *module_region);
+
++#ifdef CONFIG_PAX_KERNEXEC
++void module_free_exec(struct module *mod, void *module_region);
++#else
++#define module_free_exec(x, y) module_free((x), (y))
++#endif
++
+ /* Apply the given relocation to the (simplified) ELF. Return -error
+ or 0. */
+ int apply_relocate(Elf_Shdr *sechdrs,
+diff --git a/include/linux/moduleparam.h b/include/linux/moduleparam.h
+index 82a9124..8a5f622 100644
+--- a/include/linux/moduleparam.h
++++ b/include/linux/moduleparam.h
+@@ -132,7 +132,7 @@ struct kparam_array
+
+ /* Actually copy string: maxlen param is usually sizeof(string). */
+ #define module_param_string(name, string, len, perm) \
+- static const struct kparam_string __param_string_##name \
++ static const struct kparam_string __param_string_##name __used \
+ = { len, string }; \
+ __module_param_call(MODULE_PARAM_PREFIX, name, \
+ param_set_copystring, param_get_string, \
+@@ -211,7 +211,7 @@ extern int param_get_invbool(char *buffer, struct kernel_param *kp);
+
+ /* Comma-separated array: *nump is set to number they actually specified. */
+ #define module_param_array_named(name, array, type, nump, perm) \
+- static const struct kparam_array __param_arr_##name \
++ static const struct kparam_array __param_arr_##name __used \
+ = { ARRAY_SIZE(array), nump, param_set_##type, param_get_##type,\
+ sizeof(array[0]), array }; \
+ __module_param_call(MODULE_PARAM_PREFIX, name, \
+diff --git a/include/linux/mutex.h b/include/linux/mutex.h
+index 878cab4..c92cb3e 100644
+--- a/include/linux/mutex.h
++++ b/include/linux/mutex.h
+@@ -51,7 +51,7 @@ struct mutex {
+ spinlock_t wait_lock;
+ struct list_head wait_list;
+ #if defined(CONFIG_DEBUG_MUTEXES) || defined(CONFIG_SMP)
+- struct thread_info *owner;
++ struct task_struct *owner;
+ #endif
+ #ifdef CONFIG_DEBUG_MUTEXES
+ const char *name;
+diff --git a/include/linux/namei.h b/include/linux/namei.h
+index ec0f607..d19e675 100644
+--- a/include/linux/namei.h
++++ b/include/linux/namei.h
+@@ -22,7 +22,7 @@ struct nameidata {
+ unsigned int flags;
+ int last_type;
+ unsigned depth;
+- char *saved_names[MAX_NESTED_LINKS + 1];
++ const char *saved_names[MAX_NESTED_LINKS + 1];
+
+ /* Intent data */
+ union {
+@@ -84,12 +84,12 @@ extern int follow_up(struct path *);
+ extern struct dentry *lock_rename(struct dentry *, struct dentry *);
+ extern void unlock_rename(struct dentry *, struct dentry *);
+
+-static inline void nd_set_link(struct nameidata *nd, char *path)
++static inline void nd_set_link(struct nameidata *nd, const char *path)
+ {
+ nd->saved_names[nd->depth] = path;
+ }
+
+-static inline char *nd_get_link(struct nameidata *nd)
++static inline const char *nd_get_link(const struct nameidata *nd)
+ {
+ return nd->saved_names[nd->depth];
+ }
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 9d7e8f7..04428c5 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -637,6 +637,7 @@ struct net_device_ops {
+ u16 xid);
+ #endif
+ };
++typedef struct net_device_ops __no_const net_device_ops_no_const;
+
+ /*
+ * The DEVICE structure.
+diff --git a/include/linux/netfilter/xt_gradm.h b/include/linux/netfilter/xt_gradm.h
+new file mode 100644
+index 0000000..33f4af8
+--- /dev/null
++++ b/include/linux/netfilter/xt_gradm.h
+@@ -0,0 +1,9 @@
++#ifndef _LINUX_NETFILTER_XT_GRADM_H
++#define _LINUX_NETFILTER_XT_GRADM_H 1
++
++struct xt_gradm_mtinfo {
++ __u16 flags;
++ __u16 invflags;
++};
++
++#endif
+diff --git a/include/linux/nodemask.h b/include/linux/nodemask.h
+index b359c4a..c08b334 100644
+--- a/include/linux/nodemask.h
++++ b/include/linux/nodemask.h
+@@ -464,11 +464,11 @@ static inline int num_node_state(enum node_states state)
+
+ #define any_online_node(mask) \
+ ({ \
+- int node; \
+- for_each_node_mask(node, (mask)) \
+- if (node_online(node)) \
++ int __node; \
++ for_each_node_mask(__node, (mask)) \
++ if (node_online(__node)) \
+ break; \
+- node; \
++ __node; \
+ })
+
+ #define num_online_nodes() num_node_state(N_ONLINE)
+diff --git a/include/linux/oprofile.h b/include/linux/oprofile.h
+index 5171639..7cf4235 100644
+--- a/include/linux/oprofile.h
++++ b/include/linux/oprofile.h
+@@ -129,9 +129,9 @@ int oprofilefs_create_ulong(struct super_block * sb, struct dentry * root,
+ int oprofilefs_create_ro_ulong(struct super_block * sb, struct dentry * root,
+ char const * name, ulong * val);
+
+-/** Create a file for read-only access to an atomic_t. */
++/** Create a file for read-only access to an atomic_unchecked_t. */
+ int oprofilefs_create_ro_atomic(struct super_block * sb, struct dentry * root,
+- char const * name, atomic_t * val);
++ char const * name, atomic_unchecked_t * val);
+
+ /** create a directory */
+ struct dentry * oprofilefs_mkdir(struct super_block * sb, struct dentry * root,
+diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h
+index 3c62ed4..8924c7c 100644
+--- a/include/linux/pagemap.h
++++ b/include/linux/pagemap.h
+@@ -425,7 +425,9 @@ static inline int fault_in_pages_readable(const char __user *uaddr, int size)
+ if (((unsigned long)uaddr & PAGE_MASK) !=
+ ((unsigned long)end & PAGE_MASK))
+ ret = __get_user(c, end);
++ (void)c;
+ }
++ (void)c;
+ return ret;
+ }
+
+diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
+index 81c9689..a567a55 100644
+--- a/include/linux/perf_event.h
++++ b/include/linux/perf_event.h
+@@ -476,7 +476,7 @@ struct hw_perf_event {
+ struct hrtimer hrtimer;
+ };
+ };
+- atomic64_t prev_count;
++ atomic64_unchecked_t prev_count;
+ u64 sample_period;
+ u64 last_period;
+ atomic64_t period_left;
+@@ -557,7 +557,7 @@ struct perf_event {
+ const struct pmu *pmu;
+
+ enum perf_event_active_state state;
+- atomic64_t count;
++ atomic64_unchecked_t count;
+
+ /*
+ * These are the total time in nanoseconds that the event
+@@ -595,8 +595,8 @@ struct perf_event {
+ * These accumulate total time (in nanoseconds) that children
+ * events have been enabled and running, respectively.
+ */
+- atomic64_t child_total_time_enabled;
+- atomic64_t child_total_time_running;
++ atomic64_unchecked_t child_total_time_enabled;
++ atomic64_unchecked_t child_total_time_running;
+
+ /*
+ * Protect attach/detach and child_list:
+diff --git a/include/linux/personality.h b/include/linux/personality.h
+index 1261208..ddef96fb 100644
+--- a/include/linux/personality.h
++++ b/include/linux/personality.h
+@@ -43,6 +43,7 @@ enum {
+ #define PER_CLEAR_ON_SETID (READ_IMPLIES_EXEC | \
+ ADDR_NO_RANDOMIZE | \
+ ADDR_COMPAT_LAYOUT | \
++ ADDR_LIMIT_3GB | \
+ MMAP_PAGE_ZERO)
+
+ /*
+diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
+index b43a9e0..b77d869 100644
+--- a/include/linux/pipe_fs_i.h
++++ b/include/linux/pipe_fs_i.h
+@@ -46,9 +46,9 @@ struct pipe_inode_info {
+ wait_queue_head_t wait;
+ unsigned int nrbufs, curbuf;
+ struct page *tmp_page;
+- unsigned int readers;
+- unsigned int writers;
+- unsigned int waiting_writers;
++ atomic_t readers;
++ atomic_t writers;
++ atomic_t waiting_writers;
+ unsigned int r_counter;
+ unsigned int w_counter;
+ struct fasync_struct *fasync_readers;
+diff --git a/include/linux/poison.h b/include/linux/poison.h
+index 34066ff..e95d744 100644
+--- a/include/linux/poison.h
++++ b/include/linux/poison.h
+@@ -19,8 +19,8 @@
+ * under normal circumstances, used to verify that nobody uses
+ * non-initialized list entries.
+ */
+-#define LIST_POISON1 ((void *) 0x00100100 + POISON_POINTER_DELTA)
+-#define LIST_POISON2 ((void *) 0x00200200 + POISON_POINTER_DELTA)
++#define LIST_POISON1 ((void *) (long)0xFFFFFF01)
++#define LIST_POISON2 ((void *) (long)0xFFFFFF02)
+
+ /********** include/linux/timer.h **********/
+ /*
+diff --git a/include/linux/posix-timers.h b/include/linux/posix-timers.h
+index 4f71bf4..cd2f68e 100644
+--- a/include/linux/posix-timers.h
++++ b/include/linux/posix-timers.h
+@@ -82,7 +82,8 @@ struct k_clock {
+ #define TIMER_RETRY 1
+ void (*timer_get) (struct k_itimer * timr,
+ struct itimerspec * cur_setting);
+-};
++} __do_const;
++typedef struct k_clock __no_const k_clock_no_const;
+
+ void register_posix_clock(const clockid_t clock_id, struct k_clock *new_clock);
+
+diff --git a/include/linux/preempt.h b/include/linux/preempt.h
+index 72b1a10..13303a9 100644
+--- a/include/linux/preempt.h
++++ b/include/linux/preempt.h
+@@ -110,7 +110,7 @@ struct preempt_ops {
+ void (*sched_in)(struct preempt_notifier *notifier, int cpu);
+ void (*sched_out)(struct preempt_notifier *notifier,
+ struct task_struct *next);
+-};
++} __no_const;
+
+ /**
+ * preempt_notifier - key for installing preemption notifiers
+diff --git a/include/linux/prefetch.h b/include/linux/prefetch.h
+index af7c36a..a93005c 100644
+--- a/include/linux/prefetch.h
++++ b/include/linux/prefetch.h
+@@ -11,6 +11,7 @@
+ #define _LINUX_PREFETCH_H
+
+ #include <linux/types.h>
++#include <linux/const.h>
+ #include <asm/processor.h>
+ #include <asm/cache.h>
+
+diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h
+index 379eaed..1bf73e3 100644
+--- a/include/linux/proc_fs.h
++++ b/include/linux/proc_fs.h
+@@ -155,6 +155,19 @@ static inline struct proc_dir_entry *proc_create(const char *name, mode_t mode,
+ return proc_create_data(name, mode, parent, proc_fops, NULL);
+ }
+
++static inline struct proc_dir_entry *proc_create_grsec(const char *name, mode_t mode,
++ struct proc_dir_entry *parent, const struct file_operations *proc_fops)
++{
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++ return proc_create_data(name, S_IRUSR, parent, proc_fops, NULL);
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++ return proc_create_data(name, S_IRUSR | S_IRGRP, parent, proc_fops, NULL);
++#else
++ return proc_create_data(name, mode, parent, proc_fops, NULL);
++#endif
++}
++
++
+ static inline struct proc_dir_entry *create_proc_read_entry(const char *name,
+ mode_t mode, struct proc_dir_entry *base,
+ read_proc_t *read_proc, void * data)
+@@ -256,7 +269,7 @@ union proc_op {
+ int (*proc_show)(struct seq_file *m,
+ struct pid_namespace *ns, struct pid *pid,
+ struct task_struct *task);
+-};
++} __no_const;
+
+ struct ctl_table_header;
+ struct ctl_table;
+diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h
+index 7456d7d..6c1cfc9 100644
+--- a/include/linux/ptrace.h
++++ b/include/linux/ptrace.h
+@@ -96,10 +96,10 @@ extern void __ptrace_unlink(struct task_struct *child);
+ extern void exit_ptrace(struct task_struct *tracer);
+ #define PTRACE_MODE_READ 1
+ #define PTRACE_MODE_ATTACH 2
+-/* Returns 0 on success, -errno on denial. */
+-extern int __ptrace_may_access(struct task_struct *task, unsigned int mode);
+ /* Returns true on success, false on denial. */
+ extern bool ptrace_may_access(struct task_struct *task, unsigned int mode);
++/* Returns true on success, false on denial. */
++extern bool ptrace_may_access_log(struct task_struct *task, unsigned int mode);
+
+ static inline int ptrace_reparented(struct task_struct *child)
+ {
+diff --git a/include/linux/random.h b/include/linux/random.h
+index 2948046..3262567 100644
+--- a/include/linux/random.h
++++ b/include/linux/random.h
+@@ -63,6 +63,11 @@ unsigned long randomize_range(unsigned long start, unsigned long end, unsigned l
+ u32 random32(void);
+ void srandom32(u32 seed);
+
++static inline unsigned long pax_get_random_long(void)
++{
++ return random32() + (sizeof(long) > 4 ? (unsigned long)random32() << 32 : 0);
++}
++
+ #endif /* __KERNEL___ */
+
+ #endif /* _LINUX_RANDOM_H */
+diff --git a/include/linux/reboot.h b/include/linux/reboot.h
+index 988e55f..17cb4ef 100644
+--- a/include/linux/reboot.h
++++ b/include/linux/reboot.h
+@@ -47,9 +47,9 @@ extern int unregister_reboot_notifier(struct notifier_block *);
+ * Architecture-specific implementations of sys_reboot commands.
+ */
+
+-extern void machine_restart(char *cmd);
+-extern void machine_halt(void);
+-extern void machine_power_off(void);
++extern void machine_restart(char *cmd) __noreturn;
++extern void machine_halt(void) __noreturn;
++extern void machine_power_off(void) __noreturn;
+
+ extern void machine_shutdown(void);
+ struct pt_regs;
+@@ -60,9 +60,9 @@ extern void machine_crash_shutdown(struct pt_regs *);
+ */
+
+ extern void kernel_restart_prepare(char *cmd);
+-extern void kernel_restart(char *cmd);
+-extern void kernel_halt(void);
+-extern void kernel_power_off(void);
++extern void kernel_restart(char *cmd) __noreturn;
++extern void kernel_halt(void) __noreturn;
++extern void kernel_power_off(void) __noreturn;
+
+ void ctrl_alt_del(void);
+
+@@ -75,7 +75,7 @@ extern int orderly_poweroff(bool force);
+ * Emergency restart, callable from an interrupt handler.
+ */
+
+-extern void emergency_restart(void);
++extern void emergency_restart(void) __noreturn;
+ #include <asm/emergency-restart.h>
+
+ #endif
+diff --git a/include/linux/reiserfs_fs.h b/include/linux/reiserfs_fs.h
+index dd31e7b..5b03c5c 100644
+--- a/include/linux/reiserfs_fs.h
++++ b/include/linux/reiserfs_fs.h
+@@ -1326,7 +1326,7 @@ static inline loff_t max_reiserfs_offset(struct inode *inode)
+ #define REISERFS_USER_MEM 1 /* reiserfs user memory mode */
+
+ #define fs_generation(s) (REISERFS_SB(s)->s_generation_counter)
+-#define get_generation(s) atomic_read (&fs_generation(s))
++#define get_generation(s) atomic_read_unchecked (&fs_generation(s))
+ #define FILESYSTEM_CHANGED_TB(tb) (get_generation((tb)->tb_sb) != (tb)->fs_gen)
+ #define __fs_changed(gen,s) (gen != get_generation (s))
+ #define fs_changed(gen,s) ({cond_resched(); __fs_changed(gen, s);})
+@@ -1534,24 +1534,24 @@ static inline struct super_block *sb_from_bi(struct buffer_info *bi)
+ */
+
+ struct item_operations {
+- int (*bytes_number) (struct item_head * ih, int block_size);
+- void (*decrement_key) (struct cpu_key *);
+- int (*is_left_mergeable) (struct reiserfs_key * ih,
++ int (* const bytes_number) (struct item_head * ih, int block_size);
++ void (* const decrement_key) (struct cpu_key *);
++ int (* const is_left_mergeable) (struct reiserfs_key * ih,
+ unsigned long bsize);
+- void (*print_item) (struct item_head *, char *item);
+- void (*check_item) (struct item_head *, char *item);
++ void (* const print_item) (struct item_head *, char *item);
++ void (* const check_item) (struct item_head *, char *item);
+
+- int (*create_vi) (struct virtual_node * vn, struct virtual_item * vi,
++ int (* const create_vi) (struct virtual_node * vn, struct virtual_item * vi,
+ int is_affected, int insert_size);
+- int (*check_left) (struct virtual_item * vi, int free,
++ int (* const check_left) (struct virtual_item * vi, int free,
+ int start_skip, int end_skip);
+- int (*check_right) (struct virtual_item * vi, int free);
+- int (*part_size) (struct virtual_item * vi, int from, int to);
+- int (*unit_num) (struct virtual_item * vi);
+- void (*print_vi) (struct virtual_item * vi);
++ int (* const check_right) (struct virtual_item * vi, int free);
++ int (* const part_size) (struct virtual_item * vi, int from, int to);
++ int (* const unit_num) (struct virtual_item * vi);
++ void (* const print_vi) (struct virtual_item * vi);
+ };
+
+-extern struct item_operations *item_ops[TYPE_ANY + 1];
++extern const struct item_operations * const item_ops[TYPE_ANY + 1];
+
+ #define op_bytes_number(ih,bsize) item_ops[le_ih_k_type (ih)]->bytes_number (ih, bsize)
+ #define op_is_left_mergeable(key,bsize) item_ops[le_key_k_type (le_key_version (key), key)]->is_left_mergeable (key, bsize)
+diff --git a/include/linux/reiserfs_fs_sb.h b/include/linux/reiserfs_fs_sb.h
+index dab68bb..0688727 100644
+--- a/include/linux/reiserfs_fs_sb.h
++++ b/include/linux/reiserfs_fs_sb.h
+@@ -377,7 +377,7 @@ struct reiserfs_sb_info {
+ /* Comment? -Hans */
+ wait_queue_head_t s_wait;
+ /* To be obsoleted soon by per buffer seals.. -Hans */
+- atomic_t s_generation_counter; // increased by one every time the
++ atomic_unchecked_t s_generation_counter; // increased by one every time the
+ // tree gets re-balanced
+ unsigned long s_properties; /* File system properties. Currently holds
+ on-disk FS format */
+diff --git a/include/linux/relay.h b/include/linux/relay.h
+index 14a86bc..17d0700 100644
+--- a/include/linux/relay.h
++++ b/include/linux/relay.h
+@@ -159,7 +159,7 @@ struct rchan_callbacks
+ * The callback should return 0 if successful, negative if not.
+ */
+ int (*remove_buf_file)(struct dentry *dentry);
+-};
++} __no_const;
+
+ /*
+ * CONFIG_RELAY kernel API, kernel/relay.c
+diff --git a/include/linux/rfkill.h b/include/linux/rfkill.h
+index 3392c59..a746428 100644
+--- a/include/linux/rfkill.h
++++ b/include/linux/rfkill.h
+@@ -144,6 +144,7 @@ struct rfkill_ops {
+ void (*query)(struct rfkill *rfkill, void *data);
+ int (*set_block)(void *data, bool blocked);
+ };
++typedef struct rfkill_ops __no_const rfkill_ops_no_const;
+
+ #if defined(CONFIG_RFKILL) || defined(CONFIG_RFKILL_MODULE)
+ /**
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index 71849bf..8cf9dd2 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -101,6 +101,7 @@ struct bio;
+ struct fs_struct;
+ struct bts_context;
+ struct perf_event_context;
++struct linux_binprm;
+
+ /*
+ * List of flags we want to share for kernel threads,
+@@ -350,7 +351,7 @@ extern signed long schedule_timeout_killable(signed long timeout);
+ extern signed long schedule_timeout_uninterruptible(signed long timeout);
+ asmlinkage void __schedule(void);
+ asmlinkage void schedule(void);
+-extern int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner);
++extern int mutex_spin_on_owner(struct mutex *lock, struct task_struct *owner);
+
+ struct nsproxy;
+ struct user_namespace;
+@@ -371,9 +372,12 @@ struct user_namespace;
+ #define DEFAULT_MAX_MAP_COUNT (USHORT_MAX - MAPCOUNT_ELF_CORE_MARGIN)
+
+ extern int sysctl_max_map_count;
++extern unsigned long sysctl_heap_stack_gap;
+
+ #include <linux/aio.h>
+
++extern bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len);
++extern unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len);
+ extern unsigned long
+ arch_get_unmapped_area(struct file *, unsigned long, unsigned long,
+ unsigned long, unsigned long);
+@@ -666,6 +670,16 @@ struct signal_struct {
+ struct tty_audit_buf *tty_audit_buf;
+ #endif
+
++#ifdef CONFIG_GRKERNSEC
++ u32 curr_ip;
++ u32 saved_ip;
++ u32 gr_saddr;
++ u32 gr_daddr;
++ u16 gr_sport;
++ u16 gr_dport;
++ u8 used_accept:1;
++#endif
++
+ int oom_adj; /* OOM kill score adjustment (bit shift) */
+ };
+
+@@ -723,6 +737,11 @@ struct user_struct {
+ struct key *session_keyring; /* UID's default session keyring */
+ #endif
+
++#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
++ unsigned int banned;
++ unsigned long ban_expires;
++#endif
++
+ /* Hash table maintenance information */
+ struct hlist_node uidhash_node;
+ uid_t uid;
+@@ -1328,8 +1347,8 @@ struct task_struct {
+ struct list_head thread_group;
+
+ struct completion *vfork_done; /* for vfork() */
+- int __user *set_child_tid; /* CLONE_CHILD_SETTID */
+- int __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
++ pid_t __user *set_child_tid; /* CLONE_CHILD_SETTID */
++ pid_t __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
+
+ cputime_t utime, stime, utimescaled, stimescaled;
+ cputime_t gtime;
+@@ -1343,16 +1362,6 @@ struct task_struct {
+ struct task_cputime cputime_expires;
+ struct list_head cpu_timers[3];
+
+-/* process credentials */
+- const struct cred *real_cred; /* objective and real subjective task
+- * credentials (COW) */
+- const struct cred *cred; /* effective (overridable) subjective task
+- * credentials (COW) */
+- struct mutex cred_guard_mutex; /* guard against foreign influences on
+- * credential calculations
+- * (notably. ptrace) */
+- struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
+-
+ char comm[TASK_COMM_LEN]; /* executable name excluding path
+ - access with [gs]et_task_comm (which lock
+ it with task_lock())
+@@ -1369,6 +1378,10 @@ struct task_struct {
+ #endif
+ /* CPU-specific state of this task */
+ struct thread_struct thread;
++/* thread_info moved to task_struct */
++#ifdef CONFIG_X86
++ struct thread_info tinfo;
++#endif
+ /* filesystem information */
+ struct fs_struct *fs;
+ /* open file information */
+@@ -1436,6 +1449,15 @@ struct task_struct {
+ int hardirq_context;
+ int softirq_context;
+ #endif
++
++/* process credentials */
++ const struct cred *real_cred; /* objective and real subjective task
++ * credentials (COW) */
++ struct mutex cred_guard_mutex; /* guard against foreign influences on
++ * credential calculations
++ * (notably. ptrace) */
++ struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
++
+ #ifdef CONFIG_LOCKDEP
+ # define MAX_LOCK_DEPTH 48UL
+ u64 curr_chain_key;
+@@ -1456,6 +1478,9 @@ struct task_struct {
+
+ struct backing_dev_info *backing_dev_info;
+
++ const struct cred *cred; /* effective (overridable) subjective task
++ * credentials (COW) */
++
+ struct io_context *io_context;
+
+ unsigned long ptrace_message;
+@@ -1519,6 +1544,27 @@ struct task_struct {
+ unsigned long default_timer_slack_ns;
+
+ struct list_head *scm_work_list;
++
++#ifdef CONFIG_GRKERNSEC
++ /* grsecurity */
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++ u64 exec_id;
++#endif
++#ifdef CONFIG_GRKERNSEC_SETXID
++ const struct cred *delayed_cred;
++#endif
++ struct dentry *gr_chroot_dentry;
++ struct acl_subject_label *acl;
++ struct acl_role_label *role;
++ struct file *exec_file;
++ u16 acl_role_id;
++ /* is this the task that authenticated to the special role */
++ u8 acl_sp_role;
++ u8 is_writable;
++ u8 brute;
++ u8 gr_is_chrooted;
++#endif
++
+ #ifdef CONFIG_FUNCTION_GRAPH_TRACER
+ /* Index of current stored adress in ret_stack */
+ int curr_ret_stack;
+@@ -1542,6 +1588,57 @@ struct task_struct {
+ #endif /* CONFIG_TRACING */
+ };
+
++#define MF_PAX_PAGEEXEC 0x01000000 /* Paging based non-executable pages */
++#define MF_PAX_EMUTRAMP 0x02000000 /* Emulate trampolines */
++#define MF_PAX_MPROTECT 0x04000000 /* Restrict mprotect() */
++#define MF_PAX_RANDMMAP 0x08000000 /* Randomize mmap() base */
++/*#define MF_PAX_RANDEXEC 0x10000000*/ /* Randomize ET_EXEC base */
++#define MF_PAX_SEGMEXEC 0x20000000 /* Segmentation based non-executable pages */
++
++#ifdef CONFIG_PAX_SOFTMODE
++extern int pax_softmode;
++#endif
++
++extern int pax_check_flags(unsigned long *);
++
++/* if tsk != current then task_lock must be held on it */
++#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
++static inline unsigned long pax_get_flags(struct task_struct *tsk)
++{
++ if (likely(tsk->mm))
++ return tsk->mm->pax_flags;
++ else
++ return 0UL;
++}
++
++/* if tsk != current then task_lock must be held on it */
++static inline long pax_set_flags(struct task_struct *tsk, unsigned long flags)
++{
++ if (likely(tsk->mm)) {
++ tsk->mm->pax_flags = flags;
++ return 0;
++ }
++ return -EINVAL;
++}
++#endif
++
++#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
++extern void pax_set_initial_flags(struct linux_binprm *bprm);
++#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
++extern void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
++#endif
++
++extern void pax_report_fault(struct pt_regs *regs, void *pc, void *sp);
++extern void pax_report_insns(struct pt_regs *regs, void *pc, void *sp);
++extern void pax_report_refcount_overflow(struct pt_regs *regs);
++extern __noreturn void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type);
++
++#ifdef CONFIG_PAX_MEMORY_STACKLEAK
++extern void pax_track_stack(void);
++#else
++static inline void pax_track_stack(void) {}
++#endif
++
+ /* Future-safe accessor for struct task_struct's cpus_allowed. */
+ #define tsk_cpumask(tsk) (&(tsk)->cpus_allowed)
+
+@@ -1740,7 +1837,7 @@ extern void thread_group_times(struct task_struct *p, cputime_t *ut, cputime_t *
+ #define PF_DUMPCORE 0x00000200 /* dumped core */
+ #define PF_SIGNALED 0x00000400 /* killed by a signal */
+ #define PF_MEMALLOC 0x00000800 /* Allocating memory */
+-#define PF_FLUSHER 0x00001000 /* responsible for disk writeback */
++#define PF_NPROC_EXCEEDED 0x00001000 /* set_user noticed that RLIMIT_NPROC was exceeded */
+ #define PF_USED_MATH 0x00002000 /* if unset the fpu must be initialized before use */
+ #define PF_FREEZING 0x00004000 /* freeze in progress. do not account to load */
+ #define PF_NOFREEZE 0x00008000 /* this thread should not be frozen */
+@@ -1978,7 +2075,9 @@ void yield(void);
+ extern struct exec_domain default_exec_domain;
+
+ union thread_union {
++#ifndef CONFIG_X86
+ struct thread_info thread_info;
++#endif
+ unsigned long stack[THREAD_SIZE/sizeof(long)];
+ };
+
+@@ -2011,6 +2110,7 @@ extern struct pid_namespace init_pid_ns;
+ */
+
+ extern struct task_struct *find_task_by_vpid(pid_t nr);
++extern struct task_struct *find_task_by_vpid_unrestricted(pid_t nr);
+ extern struct task_struct *find_task_by_pid_ns(pid_t nr,
+ struct pid_namespace *ns);
+
+@@ -2155,7 +2255,7 @@ extern void __cleanup_sighand(struct sighand_struct *);
+ extern void exit_itimers(struct signal_struct *);
+ extern void flush_itimer_signals(void);
+
+-extern NORET_TYPE void do_group_exit(int);
++extern __noreturn void do_group_exit(int);
+
+ extern void daemonize(const char *, ...);
+ extern int allow_signal(int);
+@@ -2284,13 +2384,17 @@ static inline unsigned long *end_of_stack(struct task_struct *p)
+
+ #endif
+
+-static inline int object_is_on_stack(void *obj)
++static inline int object_starts_on_stack(void *obj)
+ {
+- void *stack = task_stack_page(current);
++ const void *stack = task_stack_page(current);
+
+ return (obj >= stack) && (obj < (stack + THREAD_SIZE));
+ }
+
++#ifdef CONFIG_PAX_USERCOPY
++extern int object_is_on_stack(const void *obj, unsigned long len);
++#endif
++
+ extern void thread_info_cache_init(void);
+
+ #ifdef CONFIG_DEBUG_STACK_USAGE
+@@ -2616,6 +2720,23 @@ static inline unsigned long rlimit_max(unsigned int limit)
+ return task_rlimit_max(current, limit);
+ }
+
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++DECLARE_PER_CPU(u64, exec_counter);
++static inline void increment_exec_counter(void)
++{
++ unsigned int cpu;
++ u64 *exec_id_ptr;
++ BUILD_BUG_ON(NR_CPUS > (1 << 16));
++ cpu = get_cpu();
++ exec_id_ptr = &per_cpu(exec_counter, cpu);
++ *exec_id_ptr += 1ULL << 16;
++ current->exec_id = *exec_id_ptr;
++ put_cpu();
++}
++#else
++static inline void increment_exec_counter(void) {}
++#endif
++
+ #endif /* __KERNEL__ */
+
+ #endif
+diff --git a/include/linux/screen_info.h b/include/linux/screen_info.h
+index 1ee2c05..81b7ec4 100644
+--- a/include/linux/screen_info.h
++++ b/include/linux/screen_info.h
+@@ -42,7 +42,8 @@ struct screen_info {
+ __u16 pages; /* 0x32 */
+ __u16 vesa_attributes; /* 0x34 */
+ __u32 capabilities; /* 0x36 */
+- __u8 _reserved[6]; /* 0x3a */
++ __u16 vesapm_size; /* 0x3a */
++ __u8 _reserved[4]; /* 0x3c */
+ } __attribute__((packed));
+
+ #define VIDEO_TYPE_MDA 0x10 /* Monochrome Text Display */
+diff --git a/include/linux/security.h b/include/linux/security.h
+index d40d23f..d739b08 100644
+--- a/include/linux/security.h
++++ b/include/linux/security.h
+@@ -34,6 +34,7 @@
+ #include <linux/key.h>
+ #include <linux/xfrm.h>
+ #include <linux/gfp.h>
++#include <linux/grsecurity.h>
+ #include <net/flow.h>
+
+ /* Maximum number of letters for an LSM name string */
+@@ -76,7 +77,7 @@ extern int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
+ extern int cap_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp);
+ extern int cap_task_setioprio(struct task_struct *p, int ioprio);
+ extern int cap_task_setnice(struct task_struct *p, int nice);
+-extern int cap_syslog(int type);
++extern int cap_syslog(int type, bool from_file);
+ extern int cap_vm_enough_memory(struct mm_struct *mm, long pages);
+
+ struct msghdr;
+@@ -1331,6 +1332,7 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
+ * logging to the console.
+ * See the syslog(2) manual page for an explanation of the @type values.
+ * @type contains the type of action.
++ * @from_file indicates the context of action (if it came from /proc).
+ * Return 0 if permission is granted.
+ * @settime:
+ * Check permission to change the system time.
+@@ -1445,7 +1447,7 @@ struct security_operations {
+ int (*sysctl) (struct ctl_table *table, int op);
+ int (*quotactl) (int cmds, int type, int id, struct super_block *sb);
+ int (*quota_on) (struct dentry *dentry);
+- int (*syslog) (int type);
++ int (*syslog) (int type, bool from_file);
+ int (*settime) (struct timespec *ts, struct timezone *tz);
+ int (*vm_enough_memory) (struct mm_struct *mm, long pages);
+
+@@ -1740,7 +1742,7 @@ int security_acct(struct file *file);
+ int security_sysctl(struct ctl_table *table, int op);
+ int security_quotactl(int cmds, int type, int id, struct super_block *sb);
+ int security_quota_on(struct dentry *dentry);
+-int security_syslog(int type);
++int security_syslog(int type, bool from_file);
+ int security_settime(struct timespec *ts, struct timezone *tz);
+ int security_vm_enough_memory(long pages);
+ int security_vm_enough_memory_mm(struct mm_struct *mm, long pages);
+@@ -1986,9 +1988,9 @@ static inline int security_quota_on(struct dentry *dentry)
+ return 0;
+ }
+
+-static inline int security_syslog(int type)
++static inline int security_syslog(int type, bool from_file)
+ {
+- return cap_syslog(type);
++ return cap_syslog(type, from_file);
+ }
+
+ static inline int security_settime(struct timespec *ts, struct timezone *tz)
+diff --git a/include/linux/seq_file.h b/include/linux/seq_file.h
+index 8366d8f..cc5f9d6 100644
+--- a/include/linux/seq_file.h
++++ b/include/linux/seq_file.h
+@@ -23,6 +23,9 @@ struct seq_file {
+ u64 version;
+ struct mutex lock;
+ const struct seq_operations *op;
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++ u64 exec_id;
++#endif
+ void *private;
+ };
+
+@@ -32,6 +35,7 @@ struct seq_operations {
+ void * (*next) (struct seq_file *m, void *v, loff_t *pos);
+ int (*show) (struct seq_file *m, void *v);
+ };
++typedef struct seq_operations __no_const seq_operations_no_const;
+
+ #define SEQ_SKIP 1
+
+diff --git a/include/linux/shm.h b/include/linux/shm.h
+index eca6235..c7417ed 100644
+--- a/include/linux/shm.h
++++ b/include/linux/shm.h
+@@ -95,6 +95,10 @@ struct shmid_kernel /* private to the kernel */
+ pid_t shm_cprid;
+ pid_t shm_lprid;
+ struct user_struct *mlock_user;
++#ifdef CONFIG_GRKERNSEC
++ time_t shm_createtime;
++ pid_t shm_lapid;
++#endif
+ };
+
+ /* shm_mode upper byte flags */
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index bcdd660..fd2e332 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -14,6 +14,7 @@
+ #ifndef _LINUX_SKBUFF_H
+ #define _LINUX_SKBUFF_H
+
++#include <linux/const.h>
+ #include <linux/kernel.h>
+ #include <linux/kmemcheck.h>
+ #include <linux/compiler.h>
+@@ -544,7 +545,7 @@ static inline union skb_shared_tx *skb_tx(struct sk_buff *skb)
+ */
+ static inline int skb_queue_empty(const struct sk_buff_head *list)
+ {
+- return list->next == (struct sk_buff *)list;
++ return list->next == (const struct sk_buff *)list;
+ }
+
+ /**
+@@ -557,7 +558,7 @@ static inline int skb_queue_empty(const struct sk_buff_head *list)
+ static inline bool skb_queue_is_last(const struct sk_buff_head *list,
+ const struct sk_buff *skb)
+ {
+- return (skb->next == (struct sk_buff *) list);
++ return (skb->next == (const struct sk_buff *) list);
+ }
+
+ /**
+@@ -570,7 +571,7 @@ static inline bool skb_queue_is_last(const struct sk_buff_head *list,
+ static inline bool skb_queue_is_first(const struct sk_buff_head *list,
+ const struct sk_buff *skb)
+ {
+- return (skb->prev == (struct sk_buff *) list);
++ return (skb->prev == (const struct sk_buff *) list);
+ }
+
+ /**
+@@ -1367,7 +1368,7 @@ static inline int skb_network_offset(const struct sk_buff *skb)
+ * headroom, you should not reduce this.
+ */
+ #ifndef NET_SKB_PAD
+-#define NET_SKB_PAD 32
++#define NET_SKB_PAD (_AC(32,UL))
+ #endif
+
+ extern int ___pskb_trim(struct sk_buff *skb, unsigned int len);
+@@ -1489,6 +1490,22 @@ static inline struct sk_buff *netdev_alloc_skb(struct net_device *dev,
+ return __netdev_alloc_skb(dev, length, GFP_ATOMIC);
+ }
+
++static inline struct sk_buff *__netdev_alloc_skb_ip_align(struct net_device *dev,
++ unsigned int length, gfp_t gfp)
++{
++ struct sk_buff *skb = __netdev_alloc_skb(dev, length + NET_IP_ALIGN, gfp);
++
++ if (NET_IP_ALIGN && skb)
++ skb_reserve(skb, NET_IP_ALIGN);
++ return skb;
++}
++
++static inline struct sk_buff *netdev_alloc_skb_ip_align(struct net_device *dev,
++ unsigned int length)
++{
++ return __netdev_alloc_skb_ip_align(dev, length, GFP_ATOMIC);
++}
++
+ extern struct page *__netdev_alloc_page(struct net_device *dev, gfp_t gfp_mask);
+
+ /**
+diff --git a/include/linux/slab.h b/include/linux/slab.h
+index 2da8372..96b37db 100644
+--- a/include/linux/slab.h
++++ b/include/linux/slab.h
+@@ -11,12 +11,20 @@
+
+ #include <linux/gfp.h>
+ #include <linux/types.h>
++#include <linux/err.h>
+
+ /*
+ * Flags to pass to kmem_cache_create().
+ * The ones marked DEBUG are only valid if CONFIG_SLAB_DEBUG is set.
+ */
+ #define SLAB_DEBUG_FREE 0x00000100UL /* DEBUG: Perform (expensive) checks on free */
++
++#ifdef CONFIG_PAX_USERCOPY
++#define SLAB_USERCOPY 0x00000200UL /* PaX: Allow copying objs to/from userland */
++#else
++#define SLAB_USERCOPY 0x00000000UL
++#endif
++
+ #define SLAB_RED_ZONE 0x00000400UL /* DEBUG: Red zone objs in a cache */
+ #define SLAB_POISON 0x00000800UL /* DEBUG: Poison objects */
+ #define SLAB_HWCACHE_ALIGN 0x00002000UL /* Align objs on cache lines */
+@@ -82,10 +90,13 @@
+ * ZERO_SIZE_PTR can be passed to kfree though in the same way that NULL can.
+ * Both make kfree a no-op.
+ */
+-#define ZERO_SIZE_PTR ((void *)16)
++#define ZERO_SIZE_PTR \
++({ \
++ BUILD_BUG_ON(!(MAX_ERRNO & ~PAGE_MASK));\
++ (void *)(-MAX_ERRNO-1L); \
++})
+
+-#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) <= \
+- (unsigned long)ZERO_SIZE_PTR)
++#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) - 1 >= (unsigned long)ZERO_SIZE_PTR - 1)
+
+ /*
+ * struct kmem_cache related prototypes
+@@ -138,6 +149,7 @@ void * __must_check krealloc(const void *, size_t, gfp_t);
+ void kfree(const void *);
+ void kzfree(const void *);
+ size_t ksize(const void *);
++void check_object_size(const void *ptr, unsigned long n, bool to);
+
+ /*
+ * Allocator specific definitions. These are mainly used to establish optimized
+@@ -263,7 +275,7 @@ static inline void *kmem_cache_alloc_node(struct kmem_cache *cachep,
+ * request comes from.
+ */
+ #if defined(CONFIG_DEBUG_SLAB) || defined(CONFIG_SLUB)
+-extern void *__kmalloc_track_caller(size_t, gfp_t, unsigned long);
++extern void *__kmalloc_track_caller(size_t, gfp_t, unsigned long) __size_overflow(1);
+ #define kmalloc_track_caller(size, flags) \
+ __kmalloc_track_caller(size, flags, _RET_IP_)
+ #else
+@@ -281,7 +293,7 @@ extern void *__kmalloc_track_caller(size_t, gfp_t, unsigned long);
+ * allocation request comes from.
+ */
+ #if defined(CONFIG_DEBUG_SLAB) || defined(CONFIG_SLUB)
+-extern void *__kmalloc_node_track_caller(size_t, gfp_t, int, unsigned long);
++extern void *__kmalloc_node_track_caller(size_t, gfp_t, int, unsigned long) __size_overflow(1);
+ #define kmalloc_node_track_caller(size, flags, node) \
+ __kmalloc_node_track_caller(size, flags, node, \
+ _RET_IP_)
+diff --git a/include/linux/slab_def.h b/include/linux/slab_def.h
+index 850d057..6de7888 100644
+--- a/include/linux/slab_def.h
++++ b/include/linux/slab_def.h
+@@ -69,10 +69,10 @@ struct kmem_cache {
+ unsigned long node_allocs;
+ unsigned long node_frees;
+ unsigned long node_overflow;
+- atomic_t allochit;
+- atomic_t allocmiss;
+- atomic_t freehit;
+- atomic_t freemiss;
++ atomic_unchecked_t allochit;
++ atomic_unchecked_t allocmiss;
++ atomic_unchecked_t freehit;
++ atomic_unchecked_t freemiss;
+
+ /*
+ * If debugging is enabled, then the allocator can add additional
+@@ -108,7 +108,7 @@ struct cache_sizes {
+ extern struct cache_sizes malloc_sizes[];
+
+ void *kmem_cache_alloc(struct kmem_cache *, gfp_t);
+-void *__kmalloc(size_t size, gfp_t flags);
++void *__kmalloc(size_t size, gfp_t flags) __size_overflow(1);
+
+ #ifdef CONFIG_KMEMTRACE
+ extern void *kmem_cache_alloc_notrace(struct kmem_cache *cachep, gfp_t flags);
+@@ -163,7 +163,7 @@ found:
+ }
+
+ #ifdef CONFIG_NUMA
+-extern void *__kmalloc_node(size_t size, gfp_t flags, int node);
++extern void *__kmalloc_node(size_t size, gfp_t flags, int node) __size_overflow(1);
+ extern void *kmem_cache_alloc_node(struct kmem_cache *, gfp_t flags, int node);
+
+ #ifdef CONFIG_KMEMTRACE
+diff --git a/include/linux/slob_def.h b/include/linux/slob_def.h
+index 0ec00b3..39cb7fc 100644
+--- a/include/linux/slob_def.h
++++ b/include/linux/slob_def.h
+@@ -9,7 +9,7 @@ static __always_inline void *kmem_cache_alloc(struct kmem_cache *cachep,
+ return kmem_cache_alloc_node(cachep, flags, -1);
+ }
+
+-void *__kmalloc_node(size_t size, gfp_t flags, int node);
++void *__kmalloc_node(size_t size, gfp_t flags, int node) __size_overflow(1);
+
+ static __always_inline void *kmalloc_node(size_t size, gfp_t flags, int node)
+ {
+@@ -29,6 +29,7 @@ static __always_inline void *kmalloc(size_t size, gfp_t flags)
+ return __kmalloc_node(size, flags, -1);
+ }
+
++static __always_inline void *__kmalloc(size_t size, gfp_t flags) __size_overflow(1);
+ static __always_inline void *__kmalloc(size_t size, gfp_t flags)
+ {
+ return kmalloc(size, flags);
+diff --git a/include/linux/slub_def.h b/include/linux/slub_def.h
+index 5ad70a6..08563d8 100644
+--- a/include/linux/slub_def.h
++++ b/include/linux/slub_def.h
+@@ -86,7 +86,7 @@ struct kmem_cache {
+ struct kmem_cache_order_objects max;
+ struct kmem_cache_order_objects min;
+ gfp_t allocflags; /* gfp flags to use on each alloc */
+- int refcount; /* Refcount for slab cache destroy */
++ atomic_t refcount; /* Refcount for slab cache destroy */
+ void (*ctor)(void *);
+ int inuse; /* Offset to metadata */
+ int align; /* Alignment */
+@@ -145,6 +145,7 @@ extern struct kmem_cache kmalloc_caches[SLUB_PAGE_SHIFT];
+ * Sorry that the following has to be that ugly but some versions of GCC
+ * have trouble with constant propagation and loops.
+ */
++static __always_inline int kmalloc_index(size_t size) __size_overflow(1);
+ static __always_inline int kmalloc_index(size_t size)
+ {
+ if (!size)
+@@ -215,7 +216,7 @@ static __always_inline struct kmem_cache *kmalloc_slab(size_t size)
+ #endif
+
+ void *kmem_cache_alloc(struct kmem_cache *, gfp_t);
+-void *__kmalloc(size_t size, gfp_t flags);
++void *__kmalloc(size_t size, gfp_t flags) __alloc_size(1);
+
+ #ifdef CONFIG_KMEMTRACE
+ extern void *kmem_cache_alloc_notrace(struct kmem_cache *s, gfp_t gfpflags);
+@@ -227,6 +228,7 @@ kmem_cache_alloc_notrace(struct kmem_cache *s, gfp_t gfpflags)
+ }
+ #endif
+
++static __always_inline void *kmalloc_large(size_t size, gfp_t flags) __size_overflow(1);
+ static __always_inline void *kmalloc_large(size_t size, gfp_t flags)
+ {
+ unsigned int order = get_order(size);
+@@ -263,7 +265,7 @@ static __always_inline void *kmalloc(size_t size, gfp_t flags)
+ }
+
+ #ifdef CONFIG_NUMA
+-void *__kmalloc_node(size_t size, gfp_t flags, int node);
++void *__kmalloc_node(size_t size, gfp_t flags, int node) __size_overflow(1);
+ void *kmem_cache_alloc_node(struct kmem_cache *, gfp_t flags, int node);
+
+ #ifdef CONFIG_KMEMTRACE
+diff --git a/include/linux/sonet.h b/include/linux/sonet.h
+index 67ad11f..0bbd8af 100644
+--- a/include/linux/sonet.h
++++ b/include/linux/sonet.h
+@@ -61,7 +61,7 @@ struct sonet_stats {
+ #include <asm/atomic.h>
+
+ struct k_sonet_stats {
+-#define __HANDLE_ITEM(i) atomic_t i
++#define __HANDLE_ITEM(i) atomic_unchecked_t i
+ __SONET_ITEMS
+ #undef __HANDLE_ITEM
+ };
+diff --git a/include/linux/stddef.h b/include/linux/stddef.h
+index 6a40c76..1747b67 100644
+--- a/include/linux/stddef.h
++++ b/include/linux/stddef.h
+@@ -3,14 +3,10 @@
+
+ #include <linux/compiler.h>
+
++#ifdef __KERNEL__
++
+ #undef NULL
+-#if defined(__cplusplus)
+-#define NULL 0
+-#else
+ #define NULL ((void *)0)
+-#endif
+-
+-#ifdef __KERNEL__
+
+ enum {
+ false = 0,
+diff --git a/include/linux/sunrpc/cache.h b/include/linux/sunrpc/cache.h
+index 6f52b4d..5500323 100644
+--- a/include/linux/sunrpc/cache.h
++++ b/include/linux/sunrpc/cache.h
+@@ -125,7 +125,7 @@ struct cache_detail {
+ */
+ struct cache_req {
+ struct cache_deferred_req *(*defer)(struct cache_req *req);
+-};
++} __no_const;
+ /* this must be embedded in a deferred_request that is being
+ * delayed awaiting cache-fill
+ */
+diff --git a/include/linux/sunrpc/clnt.h b/include/linux/sunrpc/clnt.h
+index 8ed9642..101ceab 100644
+--- a/include/linux/sunrpc/clnt.h
++++ b/include/linux/sunrpc/clnt.h
+@@ -167,9 +167,9 @@ static inline unsigned short rpc_get_port(const struct sockaddr *sap)
+ {
+ switch (sap->sa_family) {
+ case AF_INET:
+- return ntohs(((struct sockaddr_in *)sap)->sin_port);
++ return ntohs(((const struct sockaddr_in *)sap)->sin_port);
+ case AF_INET6:
+- return ntohs(((struct sockaddr_in6 *)sap)->sin6_port);
++ return ntohs(((const struct sockaddr_in6 *)sap)->sin6_port);
+ }
+ return 0;
+ }
+@@ -202,7 +202,7 @@ static inline bool __rpc_cmp_addr4(const struct sockaddr *sap1,
+ static inline bool __rpc_copy_addr4(struct sockaddr *dst,
+ const struct sockaddr *src)
+ {
+- const struct sockaddr_in *ssin = (struct sockaddr_in *) src;
++ const struct sockaddr_in *ssin = (const struct sockaddr_in *) src;
+ struct sockaddr_in *dsin = (struct sockaddr_in *) dst;
+
+ dsin->sin_family = ssin->sin_family;
+@@ -299,7 +299,7 @@ static inline u32 rpc_get_scope_id(const struct sockaddr *sa)
+ if (sa->sa_family != AF_INET6)
+ return 0;
+
+- return ((struct sockaddr_in6 *) sa)->sin6_scope_id;
++ return ((const struct sockaddr_in6 *) sa)->sin6_scope_id;
+ }
+
+ #endif /* __KERNEL__ */
+diff --git a/include/linux/sunrpc/svc_rdma.h b/include/linux/sunrpc/svc_rdma.h
+index c14fe86..393245e 100644
+--- a/include/linux/sunrpc/svc_rdma.h
++++ b/include/linux/sunrpc/svc_rdma.h
+@@ -53,15 +53,15 @@ extern unsigned int svcrdma_ord;
+ extern unsigned int svcrdma_max_requests;
+ extern unsigned int svcrdma_max_req_size;
+
+-extern atomic_t rdma_stat_recv;
+-extern atomic_t rdma_stat_read;
+-extern atomic_t rdma_stat_write;
+-extern atomic_t rdma_stat_sq_starve;
+-extern atomic_t rdma_stat_rq_starve;
+-extern atomic_t rdma_stat_rq_poll;
+-extern atomic_t rdma_stat_rq_prod;
+-extern atomic_t rdma_stat_sq_poll;
+-extern atomic_t rdma_stat_sq_prod;
++extern atomic_unchecked_t rdma_stat_recv;
++extern atomic_unchecked_t rdma_stat_read;
++extern atomic_unchecked_t rdma_stat_write;
++extern atomic_unchecked_t rdma_stat_sq_starve;
++extern atomic_unchecked_t rdma_stat_rq_starve;
++extern atomic_unchecked_t rdma_stat_rq_poll;
++extern atomic_unchecked_t rdma_stat_rq_prod;
++extern atomic_unchecked_t rdma_stat_sq_poll;
++extern atomic_unchecked_t rdma_stat_sq_prod;
+
+ #define RPCRDMA_VERSION 1
+
+diff --git a/include/linux/suspend.h b/include/linux/suspend.h
+index 5e781d8..1e62818 100644
+--- a/include/linux/suspend.h
++++ b/include/linux/suspend.h
+@@ -104,15 +104,15 @@ typedef int __bitwise suspend_state_t;
+ * which require special recovery actions in that situation.
+ */
+ struct platform_suspend_ops {
+- int (*valid)(suspend_state_t state);
+- int (*begin)(suspend_state_t state);
+- int (*prepare)(void);
+- int (*prepare_late)(void);
+- int (*enter)(suspend_state_t state);
+- void (*wake)(void);
+- void (*finish)(void);
+- void (*end)(void);
+- void (*recover)(void);
++ int (* const valid)(suspend_state_t state);
++ int (* const begin)(suspend_state_t state);
++ int (* const prepare)(void);
++ int (* const prepare_late)(void);
++ int (* const enter)(suspend_state_t state);
++ void (* const wake)(void);
++ void (* const finish)(void);
++ void (* const end)(void);
++ void (* const recover)(void);
+ };
+
+ #ifdef CONFIG_SUSPEND
+@@ -120,7 +120,7 @@ struct platform_suspend_ops {
+ * suspend_set_ops - set platform dependent suspend operations
+ * @ops: The new suspend operations to set.
+ */
+-extern void suspend_set_ops(struct platform_suspend_ops *ops);
++extern void suspend_set_ops(const struct platform_suspend_ops *ops);
+ extern int suspend_valid_only_mem(suspend_state_t state);
+
+ /**
+@@ -145,7 +145,7 @@ extern int pm_suspend(suspend_state_t state);
+ #else /* !CONFIG_SUSPEND */
+ #define suspend_valid_only_mem NULL
+
+-static inline void suspend_set_ops(struct platform_suspend_ops *ops) {}
++static inline void suspend_set_ops(const struct platform_suspend_ops *ops) {}
+ static inline int pm_suspend(suspend_state_t state) { return -ENOSYS; }
+ #endif /* !CONFIG_SUSPEND */
+
+@@ -215,16 +215,16 @@ extern void mark_free_pages(struct zone *zone);
+ * platforms which require special recovery actions in that situation.
+ */
+ struct platform_hibernation_ops {
+- int (*begin)(void);
+- void (*end)(void);
+- int (*pre_snapshot)(void);
+- void (*finish)(void);
+- int (*prepare)(void);
+- int (*enter)(void);
+- void (*leave)(void);
+- int (*pre_restore)(void);
+- void (*restore_cleanup)(void);
+- void (*recover)(void);
++ int (* const begin)(void);
++ void (* const end)(void);
++ int (* const pre_snapshot)(void);
++ void (* const finish)(void);
++ int (* const prepare)(void);
++ int (* const enter)(void);
++ void (* const leave)(void);
++ int (* const pre_restore)(void);
++ void (* const restore_cleanup)(void);
++ void (* const recover)(void);
+ };
+
+ #ifdef CONFIG_HIBERNATION
+@@ -243,7 +243,7 @@ extern void swsusp_set_page_free(struct page *);
+ extern void swsusp_unset_page_free(struct page *);
+ extern unsigned long get_safe_page(gfp_t gfp_mask);
+
+-extern void hibernation_set_ops(struct platform_hibernation_ops *ops);
++extern void hibernation_set_ops(const struct platform_hibernation_ops *ops);
+ extern int hibernate(void);
+ extern bool system_entering_hibernation(void);
+ #else /* CONFIG_HIBERNATION */
+@@ -251,7 +251,7 @@ static inline int swsusp_page_is_forbidden(struct page *p) { return 0; }
+ static inline void swsusp_set_page_free(struct page *p) {}
+ static inline void swsusp_unset_page_free(struct page *p) {}
+
+-static inline void hibernation_set_ops(struct platform_hibernation_ops *ops) {}
++static inline void hibernation_set_ops(const struct platform_hibernation_ops *ops) {}
+ static inline int hibernate(void) { return -ENOSYS; }
+ static inline bool system_entering_hibernation(void) { return false; }
+ #endif /* CONFIG_HIBERNATION */
+diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
+index 0eb6942..a805cb6 100644
+--- a/include/linux/sysctl.h
++++ b/include/linux/sysctl.h
+@@ -164,7 +164,11 @@ enum
+ KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
+ };
+
+-
++#ifdef CONFIG_PAX_SOFTMODE
++enum {
++ PAX_SOFTMODE=1 /* PaX: disable/enable soft mode */
++};
++#endif
+
+ /* CTL_VM names: */
+ enum
+@@ -982,6 +986,8 @@ typedef int proc_handler (struct ctl_table *ctl, int write,
+
+ extern int proc_dostring(struct ctl_table *, int,
+ void __user *, size_t *, loff_t *);
++extern int proc_dostring_modpriv(struct ctl_table *, int,
++ void __user *, size_t *, loff_t *);
+ extern int proc_dointvec(struct ctl_table *, int,
+ void __user *, size_t *, loff_t *);
+ extern int proc_dointvec_minmax(struct ctl_table *, int,
+@@ -1003,6 +1009,7 @@ extern int do_sysctl (int __user *name, int nlen,
+
+ extern ctl_handler sysctl_data;
+ extern ctl_handler sysctl_string;
++extern ctl_handler sysctl_string_modpriv;
+ extern ctl_handler sysctl_intvec;
+ extern ctl_handler sysctl_jiffies;
+ extern ctl_handler sysctl_ms_jiffies;
+diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h
+index 9d68fed..71f02cc 100644
+--- a/include/linux/sysfs.h
++++ b/include/linux/sysfs.h
+@@ -75,8 +75,8 @@ struct bin_attribute {
+ };
+
+ struct sysfs_ops {
+- ssize_t (*show)(struct kobject *, struct attribute *,char *);
+- ssize_t (*store)(struct kobject *,struct attribute *,const char *, size_t);
++ ssize_t (* const show)(struct kobject *, struct attribute *,char *);
++ ssize_t (* const store)(struct kobject *,struct attribute *,const char *, size_t);
+ };
+
+ struct sysfs_dirent;
+diff --git a/include/linux/syslog.h b/include/linux/syslog.h
+new file mode 100644
+index 0000000..3891139
+--- /dev/null
++++ b/include/linux/syslog.h
+@@ -0,0 +1,52 @@
++/* Syslog internals
++ *
++ * Copyright 2010 Canonical, Ltd.
++ * Author: Kees Cook <kees.cook@canonical.com>
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2, or (at your option)
++ * any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; see the file COPYING. If not, write to
++ * the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
++ */
++
++#ifndef _LINUX_SYSLOG_H
++#define _LINUX_SYSLOG_H
++
++/* Close the log. Currently a NOP. */
++#define SYSLOG_ACTION_CLOSE 0
++/* Open the log. Currently a NOP. */
++#define SYSLOG_ACTION_OPEN 1
++/* Read from the log. */
++#define SYSLOG_ACTION_READ 2
++/* Read all messages remaining in the ring buffer. */
++#define SYSLOG_ACTION_READ_ALL 3
++/* Read and clear all messages remaining in the ring buffer */
++#define SYSLOG_ACTION_READ_CLEAR 4
++/* Clear ring buffer. */
++#define SYSLOG_ACTION_CLEAR 5
++/* Disable printk's to console */
++#define SYSLOG_ACTION_CONSOLE_OFF 6
++/* Enable printk's to console */
++#define SYSLOG_ACTION_CONSOLE_ON 7
++/* Set level of messages printed to console */
++#define SYSLOG_ACTION_CONSOLE_LEVEL 8
++/* Return number of unread characters in the log buffer */
++#define SYSLOG_ACTION_SIZE_UNREAD 9
++/* Return size of the log buffer */
++#define SYSLOG_ACTION_SIZE_BUFFER 10
++
++#define SYSLOG_FROM_CALL 0
++#define SYSLOG_FROM_FILE 1
++
++int do_syslog(int type, char __user *buf, int count, bool from_file);
++
++#endif /* _LINUX_SYSLOG_H */
+diff --git a/include/linux/thread_info.h b/include/linux/thread_info.h
+index a8cc4e1..98d3b85 100644
+--- a/include/linux/thread_info.h
++++ b/include/linux/thread_info.h
+@@ -23,7 +23,7 @@ struct restart_block {
+ };
+ /* For futex_wait and futex_wait_requeue_pi */
+ struct {
+- u32 *uaddr;
++ u32 __user *uaddr;
+ u32 val;
+ u32 flags;
+ u32 bitset;
+diff --git a/include/linux/tracehook.h b/include/linux/tracehook.h
+index 1eb44a9..f582df3 100644
+--- a/include/linux/tracehook.h
++++ b/include/linux/tracehook.h
+@@ -69,12 +69,12 @@ static inline int tracehook_expect_breakpoints(struct task_struct *task)
+ /*
+ * ptrace report for syscall entry and exit looks identical.
+ */
+-static inline void ptrace_report_syscall(struct pt_regs *regs)
++static inline int ptrace_report_syscall(struct pt_regs *regs)
+ {
+ int ptrace = task_ptrace(current);
+
+ if (!(ptrace & PT_PTRACED))
+- return;
++ return 0;
+
+ ptrace_notify(SIGTRAP | ((ptrace & PT_TRACESYSGOOD) ? 0x80 : 0));
+
+@@ -87,6 +87,8 @@ static inline void ptrace_report_syscall(struct pt_regs *regs)
+ send_sig(current->exit_code, current, 1);
+ current->exit_code = 0;
+ }
++
++ return fatal_signal_pending(current);
+ }
+
+ /**
+@@ -111,8 +113,7 @@ static inline void ptrace_report_syscall(struct pt_regs *regs)
+ static inline __must_check int tracehook_report_syscall_entry(
+ struct pt_regs *regs)
+ {
+- ptrace_report_syscall(regs);
+- return 0;
++ return ptrace_report_syscall(regs);
+ }
+
+ /**
+diff --git a/include/linux/tty.h b/include/linux/tty.h
+index e9c57e9..ee6d489 100644
+--- a/include/linux/tty.h
++++ b/include/linux/tty.h
+@@ -493,7 +493,6 @@ extern void tty_ldisc_begin(void);
+ /* This last one is just for the tty layer internals and shouldn't be used elsewhere */
+ extern void tty_ldisc_enable(struct tty_struct *tty);
+
+-
+ /* n_tty.c */
+ extern struct tty_ldisc_ops tty_ldisc_N_TTY;
+
+diff --git a/include/linux/tty_ldisc.h b/include/linux/tty_ldisc.h
+index 0c4ee9b..9f7c426 100644
+--- a/include/linux/tty_ldisc.h
++++ b/include/linux/tty_ldisc.h
+@@ -139,7 +139,7 @@ struct tty_ldisc_ops {
+
+ struct module *owner;
+
+- int refcount;
++ atomic_t refcount;
+ };
+
+ struct tty_ldisc {
+diff --git a/include/linux/types.h b/include/linux/types.h
+index c42724f..d190eee 100644
+--- a/include/linux/types.h
++++ b/include/linux/types.h
+@@ -191,10 +191,26 @@ typedef struct {
+ volatile int counter;
+ } atomic_t;
+
++#ifdef CONFIG_PAX_REFCOUNT
++typedef struct {
++ volatile int counter;
++} atomic_unchecked_t;
++#else
++typedef atomic_t atomic_unchecked_t;
++#endif
++
+ #ifdef CONFIG_64BIT
+ typedef struct {
+ volatile long counter;
+ } atomic64_t;
++
++#ifdef CONFIG_PAX_REFCOUNT
++typedef struct {
++ volatile long counter;
++} atomic64_unchecked_t;
++#else
++typedef atomic64_t atomic64_unchecked_t;
++#endif
+ #endif
+
+ struct ustat {
+diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h
+index 6b58367..57b150e 100644
+--- a/include/linux/uaccess.h
++++ b/include/linux/uaccess.h
+@@ -76,11 +76,11 @@ static inline unsigned long __copy_from_user_nocache(void *to,
+ long ret; \
+ mm_segment_t old_fs = get_fs(); \
+ \
+- set_fs(KERNEL_DS); \
+ pagefault_disable(); \
+- ret = __copy_from_user_inatomic(&(retval), (__force typeof(retval) __user *)(addr), sizeof(retval)); \
+- pagefault_enable(); \
++ set_fs(KERNEL_DS); \
++ ret = __copy_from_user_inatomic(&(retval), (typeof(retval) __force_user *)(addr), sizeof(retval)); \
+ set_fs(old_fs); \
++ pagefault_enable(); \
+ ret; \
+ })
+
+@@ -93,7 +93,7 @@ static inline unsigned long __copy_from_user_nocache(void *to,
+ * Safely read from address @src to the buffer at @dst. If a kernel fault
+ * happens, handle that and return -EFAULT.
+ */
+-extern long probe_kernel_read(void *dst, void *src, size_t size);
++extern long probe_kernel_read(void *dst, const void *src, size_t size);
+
+ /*
+ * probe_kernel_write(): safely attempt to write to a location
+@@ -104,6 +104,6 @@ extern long probe_kernel_read(void *dst, void *src, size_t size);
+ * Safely write to address @dst from the buffer at @src. If a kernel fault
+ * happens, handle that and return -EFAULT.
+ */
+-extern long probe_kernel_write(void *dst, void *src, size_t size);
++extern long probe_kernel_write(void *dst, const void *src, size_t size) __size_overflow(3);
+
+ #endif /* __LINUX_UACCESS_H__ */
+diff --git a/include/linux/unaligned/access_ok.h b/include/linux/unaligned/access_ok.h
+index 99c1b4d..bb94261 100644
+--- a/include/linux/unaligned/access_ok.h
++++ b/include/linux/unaligned/access_ok.h
+@@ -6,32 +6,32 @@
+
+ static inline u16 get_unaligned_le16(const void *p)
+ {
+- return le16_to_cpup((__le16 *)p);
++ return le16_to_cpup((const __le16 *)p);
+ }
+
+ static inline u32 get_unaligned_le32(const void *p)
+ {
+- return le32_to_cpup((__le32 *)p);
++ return le32_to_cpup((const __le32 *)p);
+ }
+
+ static inline u64 get_unaligned_le64(const void *p)
+ {
+- return le64_to_cpup((__le64 *)p);
++ return le64_to_cpup((const __le64 *)p);
+ }
+
+ static inline u16 get_unaligned_be16(const void *p)
+ {
+- return be16_to_cpup((__be16 *)p);
++ return be16_to_cpup((const __be16 *)p);
+ }
+
+ static inline u32 get_unaligned_be32(const void *p)
+ {
+- return be32_to_cpup((__be32 *)p);
++ return be32_to_cpup((const __be32 *)p);
+ }
+
+ static inline u64 get_unaligned_be64(const void *p)
+ {
+- return be64_to_cpup((__be64 *)p);
++ return be64_to_cpup((const __be64 *)p);
+ }
+
+ static inline void put_unaligned_le16(u16 val, void *p)
+diff --git a/include/linux/vermagic.h b/include/linux/vermagic.h
+index 79b9837..b5a56f9 100644
+--- a/include/linux/vermagic.h
++++ b/include/linux/vermagic.h
+@@ -26,9 +26,35 @@
+ #define MODULE_ARCH_VERMAGIC ""
+ #endif
+
++#ifdef CONFIG_PAX_REFCOUNT
++#define MODULE_PAX_REFCOUNT "REFCOUNT "
++#else
++#define MODULE_PAX_REFCOUNT ""
++#endif
++
++#ifdef CONSTIFY_PLUGIN
++#define MODULE_CONSTIFY_PLUGIN "CONSTIFY_PLUGIN "
++#else
++#define MODULE_CONSTIFY_PLUGIN ""
++#endif
++
++#ifdef STACKLEAK_PLUGIN
++#define MODULE_STACKLEAK_PLUGIN "STACKLEAK_PLUGIN "
++#else
++#define MODULE_STACKLEAK_PLUGIN ""
++#endif
++
++#ifdef CONFIG_GRKERNSEC
++#define MODULE_GRSEC "GRSEC "
++#else
++#define MODULE_GRSEC ""
++#endif
++
+ #define VERMAGIC_STRING \
+ UTS_RELEASE " " \
+ MODULE_VERMAGIC_SMP MODULE_VERMAGIC_PREEMPT \
+ MODULE_VERMAGIC_MODULE_UNLOAD MODULE_VERMAGIC_MODVERSIONS \
+- MODULE_ARCH_VERMAGIC
++ MODULE_ARCH_VERMAGIC \
++ MODULE_PAX_REFCOUNT MODULE_CONSTIFY_PLUGIN MODULE_STACKLEAK_PLUGIN \
++ MODULE_GRSEC
+
+diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h
+index 819a634..dcc51e98 100644
+--- a/include/linux/vmalloc.h
++++ b/include/linux/vmalloc.h
+@@ -14,6 +14,11 @@ struct vm_area_struct; /* vma defining user mapping in mm_types.h */
+ #define VM_USERMAP 0x00000008 /* suitable for remap_vmalloc_range */
+ #define VM_VPAGES 0x00000010 /* buffer for pages was vmalloc'ed */
+ #define VM_UNLIST 0x00000020 /* vm_struct is not listed in vmlist */
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
++#define VM_KERNEXEC 0x00000040 /* allocate from executable kernel memory range */
++#endif
++
+ /* bits [20..32] reserved for arch specific ioremap internals */
+
+ /*
+@@ -106,8 +111,8 @@ extern struct vm_struct *alloc_vm_area(size_t size);
+ extern void free_vm_area(struct vm_struct *area);
+
+ /* for /dev/kmem */
+-extern long vread(char *buf, char *addr, unsigned long count);
+-extern long vwrite(char *buf, char *addr, unsigned long count);
++extern long vread(char *buf, char *addr, unsigned long count) __size_overflow(3);
++extern long vwrite(char *buf, char *addr, unsigned long count) __size_overflow(3);
+
+ /*
+ * Internals. Dont't use..
+diff --git a/include/linux/vmstat.h b/include/linux/vmstat.h
+index 13070d6..aa4159a 100644
+--- a/include/linux/vmstat.h
++++ b/include/linux/vmstat.h
+@@ -136,18 +136,18 @@ static inline void vm_events_fold_cpu(int cpu)
+ /*
+ * Zone based page accounting with per cpu differentials.
+ */
+-extern atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
++extern atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
+
+ static inline void zone_page_state_add(long x, struct zone *zone,
+ enum zone_stat_item item)
+ {
+- atomic_long_add(x, &zone->vm_stat[item]);
+- atomic_long_add(x, &vm_stat[item]);
++ atomic_long_add_unchecked(x, &zone->vm_stat[item]);
++ atomic_long_add_unchecked(x, &vm_stat[item]);
+ }
+
+ static inline unsigned long global_page_state(enum zone_stat_item item)
+ {
+- long x = atomic_long_read(&vm_stat[item]);
++ long x = atomic_long_read_unchecked(&vm_stat[item]);
+ #ifdef CONFIG_SMP
+ if (x < 0)
+ x = 0;
+@@ -158,7 +158,7 @@ static inline unsigned long global_page_state(enum zone_stat_item item)
+ static inline unsigned long zone_page_state(struct zone *zone,
+ enum zone_stat_item item)
+ {
+- long x = atomic_long_read(&zone->vm_stat[item]);
++ long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
+ #ifdef CONFIG_SMP
+ if (x < 0)
+ x = 0;
+@@ -175,7 +175,7 @@ static inline unsigned long zone_page_state(struct zone *zone,
+ static inline unsigned long zone_page_state_snapshot(struct zone *zone,
+ enum zone_stat_item item)
+ {
+- long x = atomic_long_read(&zone->vm_stat[item]);
++ long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
+
+ #ifdef CONFIG_SMP
+ int cpu;
+@@ -264,8 +264,8 @@ static inline void __mod_zone_page_state(struct zone *zone,
+
+ static inline void __inc_zone_state(struct zone *zone, enum zone_stat_item item)
+ {
+- atomic_long_inc(&zone->vm_stat[item]);
+- atomic_long_inc(&vm_stat[item]);
++ atomic_long_inc_unchecked(&zone->vm_stat[item]);
++ atomic_long_inc_unchecked(&vm_stat[item]);
+ }
+
+ static inline void __inc_zone_page_state(struct page *page,
+@@ -276,8 +276,8 @@ static inline void __inc_zone_page_state(struct page *page,
+
+ static inline void __dec_zone_state(struct zone *zone, enum zone_stat_item item)
+ {
+- atomic_long_dec(&zone->vm_stat[item]);
+- atomic_long_dec(&vm_stat[item]);
++ atomic_long_dec_unchecked(&zone->vm_stat[item]);
++ atomic_long_dec_unchecked(&vm_stat[item]);
+ }
+
+ static inline void __dec_zone_page_state(struct page *page,
+diff --git a/include/linux/xattr.h b/include/linux/xattr.h
+index 5c84af8..1a3b6e2 100644
+--- a/include/linux/xattr.h
++++ b/include/linux/xattr.h
+@@ -33,6 +33,11 @@
+ #define XATTR_USER_PREFIX "user."
+ #define XATTR_USER_PREFIX_LEN (sizeof (XATTR_USER_PREFIX) - 1)
+
++/* User namespace */
++#define XATTR_PAX_PREFIX XATTR_USER_PREFIX "pax."
++#define XATTR_PAX_FLAGS_SUFFIX "flags"
++#define XATTR_NAME_PAX_FLAGS XATTR_PAX_PREFIX XATTR_PAX_FLAGS_SUFFIX
++
+ struct inode;
+ struct dentry;
+
+diff --git a/include/media/saa7146_vv.h b/include/media/saa7146_vv.h
+index eed5fcc..5080d24 100644
+--- a/include/media/saa7146_vv.h
++++ b/include/media/saa7146_vv.h
+@@ -167,7 +167,7 @@ struct saa7146_ext_vv
+ int (*std_callback)(struct saa7146_dev*, struct saa7146_standard *);
+
+ /* the extension can override this */
+- struct v4l2_ioctl_ops ops;
++ v4l2_ioctl_ops_no_const ops;
+ /* pointer to the saa7146 core ops */
+ const struct v4l2_ioctl_ops *core_ops;
+
+diff --git a/include/media/v4l2-dev.h b/include/media/v4l2-dev.h
+index 73c9867..2da8837 100644
+--- a/include/media/v4l2-dev.h
++++ b/include/media/v4l2-dev.h
+@@ -34,7 +34,7 @@ struct v4l2_device;
+ #define V4L2_FL_UNREGISTERED (0)
+
+ struct v4l2_file_operations {
+- struct module *owner;
++ struct module * const owner;
+ ssize_t (*read) (struct file *, char __user *, size_t, loff_t *);
+ ssize_t (*write) (struct file *, const char __user *, size_t, loff_t *);
+ unsigned int (*poll) (struct file *, struct poll_table_struct *);
+@@ -46,6 +46,7 @@ struct v4l2_file_operations {
+ int (*open) (struct file *);
+ int (*release) (struct file *);
+ };
++typedef struct v4l2_file_operations __no_const v4l2_file_operations_no_const;
+
+ /*
+ * Newer version of video_device, handled by videodev2.c
+diff --git a/include/media/v4l2-device.h b/include/media/v4l2-device.h
+index 5d5d550..f559ef1 100644
+--- a/include/media/v4l2-device.h
++++ b/include/media/v4l2-device.h
+@@ -71,7 +71,7 @@ int __must_check v4l2_device_register(struct device *dev, struct v4l2_device *v4
+ this function returns 0. If the name ends with a digit (e.g. cx18),
+ then the name will be set to cx18-0 since cx180 looks really odd. */
+ int v4l2_device_set_name(struct v4l2_device *v4l2_dev, const char *basename,
+- atomic_t *instance);
++ atomic_unchecked_t *instance);
+
+ /* Set v4l2_dev->dev to NULL. Call when the USB parent disconnects.
+ Since the parent disappears this ensures that v4l2_dev doesn't have an
+diff --git a/include/media/v4l2-ioctl.h b/include/media/v4l2-ioctl.h
+index 7a4529d..7244290 100644
+--- a/include/media/v4l2-ioctl.h
++++ b/include/media/v4l2-ioctl.h
+@@ -243,6 +243,7 @@ struct v4l2_ioctl_ops {
+ long (*vidioc_default) (struct file *file, void *fh,
+ int cmd, void *arg);
+ };
++typedef struct v4l2_ioctl_ops __no_const v4l2_ioctl_ops_no_const;
+
+
+ /* v4l debugging and diagnostics */
+diff --git a/include/net/flow.h b/include/net/flow.h
+index 809970b..c3df4f3 100644
+--- a/include/net/flow.h
++++ b/include/net/flow.h
+@@ -92,7 +92,7 @@ typedef int (*flow_resolve_t)(struct net *net, struct flowi *key, u16 family,
+ extern void *flow_cache_lookup(struct net *net, struct flowi *key, u16 family,
+ u8 dir, flow_resolve_t resolver);
+ extern void flow_cache_flush(void);
+-extern atomic_t flow_cache_genid;
++extern atomic_unchecked_t flow_cache_genid;
+
+ static inline int flow_cache_uli_match(struct flowi *fl1, struct flowi *fl2)
+ {
+diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
+index 15e1f8fe..668837c 100644
+--- a/include/net/inetpeer.h
++++ b/include/net/inetpeer.h
+@@ -24,7 +24,7 @@ struct inet_peer
+ __u32 dtime; /* the time of last use of not
+ * referenced entries */
+ atomic_t refcnt;
+- atomic_t rid; /* Frag reception counter */
++ atomic_unchecked_t rid; /* Frag reception counter */
+ __u32 tcp_ts;
+ unsigned long tcp_ts_stamp;
+ };
+diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
+index 98978e7..2243a3d 100644
+--- a/include/net/ip_vs.h
++++ b/include/net/ip_vs.h
+@@ -365,7 +365,7 @@ struct ip_vs_conn {
+ struct ip_vs_conn *control; /* Master control connection */
+ atomic_t n_control; /* Number of controlled ones */
+ struct ip_vs_dest *dest; /* real server */
+- atomic_t in_pkts; /* incoming packet counter */
++ atomic_unchecked_t in_pkts; /* incoming packet counter */
+
+ /* packet transmitter for different forwarding methods. If it
+ mangles the packet, it must return NF_DROP or better NF_STOLEN,
+@@ -466,7 +466,7 @@ struct ip_vs_dest {
+ union nf_inet_addr addr; /* IP address of the server */
+ __be16 port; /* port number of the server */
+ volatile unsigned flags; /* dest status flags */
+- atomic_t conn_flags; /* flags to copy to conn */
++ atomic_unchecked_t conn_flags; /* flags to copy to conn */
+ atomic_t weight; /* server weight */
+
+ atomic_t refcnt; /* reference counter */
+diff --git a/include/net/irda/ircomm_core.h b/include/net/irda/ircomm_core.h
+index 69b610a..fe3962c 100644
+--- a/include/net/irda/ircomm_core.h
++++ b/include/net/irda/ircomm_core.h
+@@ -51,7 +51,7 @@ typedef struct {
+ int (*connect_response)(struct ircomm_cb *, struct sk_buff *);
+ int (*disconnect_request)(struct ircomm_cb *, struct sk_buff *,
+ struct ircomm_info *);
+-} call_t;
++} __no_const call_t;
+
+ struct ircomm_cb {
+ irda_queue_t queue;
+diff --git a/include/net/irda/ircomm_tty.h b/include/net/irda/ircomm_tty.h
+index eea2e61..08c692d 100644
+--- a/include/net/irda/ircomm_tty.h
++++ b/include/net/irda/ircomm_tty.h
+@@ -35,6 +35,7 @@
+ #include <linux/termios.h>
+ #include <linux/timer.h>
+ #include <linux/tty.h> /* struct tty_struct */
++#include <asm/local.h>
+
+ #include <net/irda/irias_object.h>
+ #include <net/irda/ircomm_core.h>
+@@ -105,8 +106,8 @@ struct ircomm_tty_cb {
+ unsigned short close_delay;
+ unsigned short closing_wait; /* time to wait before closing */
+
+- int open_count;
+- int blocked_open; /* # of blocked opens */
++ local_t open_count;
++ local_t blocked_open; /* # of blocked opens */
+
+ /* Protect concurent access to :
+ * o self->open_count
+diff --git a/include/net/iucv/af_iucv.h b/include/net/iucv/af_iucv.h
+index f82a1e8..82d81e8 100644
+--- a/include/net/iucv/af_iucv.h
++++ b/include/net/iucv/af_iucv.h
+@@ -87,7 +87,7 @@ struct iucv_sock {
+ struct iucv_sock_list {
+ struct hlist_head head;
+ rwlock_t lock;
+- atomic_t autobind_name;
++ atomic_unchecked_t autobind_name;
+ };
+
+ unsigned int iucv_sock_poll(struct file *file, struct socket *sock,
+diff --git a/include/net/lapb.h b/include/net/lapb.h
+index 96cb5dd..25e8d4f 100644
+--- a/include/net/lapb.h
++++ b/include/net/lapb.h
+@@ -95,7 +95,7 @@ struct lapb_cb {
+ struct sk_buff_head write_queue;
+ struct sk_buff_head ack_queue;
+ unsigned char window;
+- struct lapb_register_struct callbacks;
++ struct lapb_register_struct *callbacks;
+
+ /* FRMR control information */
+ struct lapb_frame frmr_data;
+diff --git a/include/net/neighbour.h b/include/net/neighbour.h
+index 3817fda..cdb2343 100644
+--- a/include/net/neighbour.h
++++ b/include/net/neighbour.h
+@@ -131,7 +131,7 @@ struct neigh_ops
+ int (*connected_output)(struct sk_buff*);
+ int (*hh_output)(struct sk_buff*);
+ int (*queue_xmit)(struct sk_buff*);
+-};
++} __do_const;
+
+ struct pneigh_entry
+ {
+diff --git a/include/net/netlink.h b/include/net/netlink.h
+index c344646..4778c71 100644
+--- a/include/net/netlink.h
++++ b/include/net/netlink.h
+@@ -335,7 +335,7 @@ static inline int nlmsg_ok(const struct nlmsghdr *nlh, int remaining)
+ {
+ return (remaining >= (int) sizeof(struct nlmsghdr) &&
+ nlh->nlmsg_len >= sizeof(struct nlmsghdr) &&
+- nlh->nlmsg_len <= remaining);
++ nlh->nlmsg_len <= (unsigned int)remaining);
+ }
+
+ /**
+@@ -558,7 +558,7 @@ static inline void *nlmsg_get_pos(struct sk_buff *skb)
+ static inline void nlmsg_trim(struct sk_buff *skb, const void *mark)
+ {
+ if (mark)
+- skb_trim(skb, (unsigned char *) mark - skb->data);
++ skb_trim(skb, (const unsigned char *) mark - skb->data);
+ }
+
+ /**
+diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
+index 9a4b8b7..e49e077 100644
+--- a/include/net/netns/ipv4.h
++++ b/include/net/netns/ipv4.h
+@@ -54,7 +54,7 @@ struct netns_ipv4 {
+ int current_rt_cache_rebuild_count;
+
+ struct timer_list rt_secret_timer;
+- atomic_t rt_genid;
++ atomic_unchecked_t rt_genid;
+
+ #ifdef CONFIG_IP_MROUTE
+ struct sock *mroute_sk;
+diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
+index 8a6d529..171f401 100644
+--- a/include/net/sctp/sctp.h
++++ b/include/net/sctp/sctp.h
+@@ -305,8 +305,8 @@ extern int sctp_debug_flag;
+
+ #else /* SCTP_DEBUG */
+
+-#define SCTP_DEBUG_PRINTK(whatever...)
+-#define SCTP_DEBUG_PRINTK_IPADDR(whatever...)
++#define SCTP_DEBUG_PRINTK(whatever...) do {} while (0)
++#define SCTP_DEBUG_PRINTK_IPADDR(whatever...) do {} while (0)
+ #define SCTP_ENABLE_DEBUG
+ #define SCTP_DISABLE_DEBUG
+ #define SCTP_ASSERT(expr, str, func)
+diff --git a/include/net/secure_seq.h b/include/net/secure_seq.h
+index d97f689..f3b90ab 100644
+--- a/include/net/secure_seq.h
++++ b/include/net/secure_seq.h
+@@ -7,14 +7,14 @@ extern __u32 secure_ip_id(__be32 daddr);
+ extern __u32 secure_ipv6_id(const __be32 daddr[4]);
+ extern u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport);
+ extern u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
+- __be16 dport);
++ __be16 dport);
+ extern __u32 secure_tcp_sequence_number(__be32 saddr, __be32 daddr,
+ __be16 sport, __be16 dport);
+ extern __u32 secure_tcpv6_sequence_number(__be32 *saddr, __be32 *daddr,
+- __be16 sport, __be16 dport);
++ __be16 sport, __be16 dport);
+ extern u64 secure_dccp_sequence_number(__be32 saddr, __be32 daddr,
+- __be16 sport, __be16 dport);
++ __be16 sport, __be16 dport);
+ extern u64 secure_dccpv6_sequence_number(__be32 *saddr, __be32 *daddr,
+- __be16 sport, __be16 dport);
++ __be16 sport, __be16 dport);
+
+ #endif /* _NET_SECURE_SEQ */
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 78adf52..99afd29 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -272,7 +272,7 @@ struct sock {
+ rwlock_t sk_callback_lock;
+ int sk_err,
+ sk_err_soft;
+- atomic_t sk_drops;
++ atomic_unchecked_t sk_drops;
+ unsigned short sk_ack_backlog;
+ unsigned short sk_max_ack_backlog;
+ __u32 sk_priority;
+@@ -737,7 +737,7 @@ static inline void sk_refcnt_debug_release(const struct sock *sk)
+ extern void sock_prot_inuse_add(struct net *net, struct proto *prot, int inc);
+ extern int sock_prot_inuse_get(struct net *net, struct proto *proto);
+ #else
+-static void inline sock_prot_inuse_add(struct net *net, struct proto *prot,
++static inline void sock_prot_inuse_add(struct net *net, struct proto *prot,
+ int inc)
+ {
+ }
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index 6cfe18b..dd21acb 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -1444,8 +1444,8 @@ enum tcp_seq_states {
+ struct tcp_seq_afinfo {
+ char *name;
+ sa_family_t family;
+- struct file_operations seq_fops;
+- struct seq_operations seq_ops;
++ file_operations_no_const seq_fops;
++ seq_operations_no_const seq_ops;
+ };
+
+ struct tcp_iter_state {
+diff --git a/include/net/udp.h b/include/net/udp.h
+index f98abd2..b4b042f 100644
+--- a/include/net/udp.h
++++ b/include/net/udp.h
+@@ -187,8 +187,8 @@ struct udp_seq_afinfo {
+ char *name;
+ sa_family_t family;
+ struct udp_table *udp_table;
+- struct file_operations seq_fops;
+- struct seq_operations seq_ops;
++ file_operations_no_const seq_fops;
++ seq_operations_no_const seq_ops;
+ };
+
+ struct udp_iter_state {
+diff --git a/include/rdma/iw_cm.h b/include/rdma/iw_cm.h
+index cbb822e..e9c1cbe 100644
+--- a/include/rdma/iw_cm.h
++++ b/include/rdma/iw_cm.h
+@@ -129,7 +129,7 @@ struct iw_cm_verbs {
+ int backlog);
+
+ int (*destroy_listen)(struct iw_cm_id *cm_id);
+-};
++} __no_const;
+
+ /**
+ * iw_create_cm_id - Create an IW CM identifier.
+diff --git a/include/scsi/libfc.h b/include/scsi/libfc.h
+index 09a124b..caa8ca8 100644
+--- a/include/scsi/libfc.h
++++ b/include/scsi/libfc.h
+@@ -675,6 +675,7 @@ struct libfc_function_template {
+ */
+ void (*disc_stop_final) (struct fc_lport *);
+ };
++typedef struct libfc_function_template __no_const libfc_function_template_no_const;
+
+ /* information used by the discovery layer */
+ struct fc_disc {
+@@ -707,7 +708,7 @@ struct fc_lport {
+ struct fc_disc disc;
+
+ /* Operational Information */
+- struct libfc_function_template tt;
++ libfc_function_template_no_const tt;
+ u8 link_up;
+ u8 qfull;
+ enum fc_lport_state state;
+diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
+index de8e180..f15e0d7 100644
+--- a/include/scsi/scsi_device.h
++++ b/include/scsi/scsi_device.h
+@@ -156,9 +156,9 @@ struct scsi_device {
+ unsigned int max_device_blocked; /* what device_blocked counts down from */
+ #define SCSI_DEFAULT_DEVICE_BLOCKED 3
+
+- atomic_t iorequest_cnt;
+- atomic_t iodone_cnt;
+- atomic_t ioerr_cnt;
++ atomic_unchecked_t iorequest_cnt;
++ atomic_unchecked_t iodone_cnt;
++ atomic_unchecked_t ioerr_cnt;
+
+ struct device sdev_gendev,
+ sdev_dev;
+diff --git a/include/scsi/scsi_host.h b/include/scsi/scsi_host.h
+index 0b4baba..0106e9e 100644
+--- a/include/scsi/scsi_host.h
++++ b/include/scsi/scsi_host.h
+@@ -43,6 +43,12 @@ struct blk_queue_tags;
+ #define DISABLE_CLUSTERING 0
+ #define ENABLE_CLUSTERING 1
+
++enum {
++ SCSI_QDEPTH_DEFAULT, /* default requested change, e.g. from sysfs */
++ SCSI_QDEPTH_QFULL, /* scsi-ml requested due to queue full */
++ SCSI_QDEPTH_RAMP_UP, /* scsi-ml requested due to threshhold event */
++};
++
+ struct scsi_host_template {
+ struct module *module;
+ const char *name;
+diff --git a/include/scsi/scsi_transport_fc.h b/include/scsi/scsi_transport_fc.h
+index fc50bd6..81ba9cb 100644
+--- a/include/scsi/scsi_transport_fc.h
++++ b/include/scsi/scsi_transport_fc.h
+@@ -708,7 +708,7 @@ struct fc_function_template {
+ unsigned long show_host_system_hostname:1;
+
+ unsigned long disable_target_scan:1;
+-};
++} __do_const;
+
+
+ /**
+diff --git a/include/sound/ac97_codec.h b/include/sound/ac97_codec.h
+index 3dae3f7..8440d6f 100644
+--- a/include/sound/ac97_codec.h
++++ b/include/sound/ac97_codec.h
+@@ -419,15 +419,15 @@
+ struct snd_ac97;
+
+ struct snd_ac97_build_ops {
+- int (*build_3d) (struct snd_ac97 *ac97);
+- int (*build_specific) (struct snd_ac97 *ac97);
+- int (*build_spdif) (struct snd_ac97 *ac97);
+- int (*build_post_spdif) (struct snd_ac97 *ac97);
++ int (* const build_3d) (struct snd_ac97 *ac97);
++ int (* const build_specific) (struct snd_ac97 *ac97);
++ int (* const build_spdif) (struct snd_ac97 *ac97);
++ int (* const build_post_spdif) (struct snd_ac97 *ac97);
+ #ifdef CONFIG_PM
+- void (*suspend) (struct snd_ac97 *ac97);
+- void (*resume) (struct snd_ac97 *ac97);
++ void (* const suspend) (struct snd_ac97 *ac97);
++ void (* const resume) (struct snd_ac97 *ac97);
+ #endif
+- void (*update_jacks) (struct snd_ac97 *ac97); /* for jack-sharing */
++ void (* const update_jacks) (struct snd_ac97 *ac97); /* for jack-sharing */
+ };
+
+ struct snd_ac97_bus_ops {
+@@ -477,7 +477,7 @@ struct snd_ac97_template {
+
+ struct snd_ac97 {
+ /* -- lowlevel (hardware) driver specific -- */
+- struct snd_ac97_build_ops * build_ops;
++ const struct snd_ac97_build_ops * build_ops;
+ void *private_data;
+ void (*private_free) (struct snd_ac97 *ac97);
+ /* --- */
+diff --git a/include/sound/ak4xxx-adda.h b/include/sound/ak4xxx-adda.h
+index 891cf1a..a94ba2b 100644
+--- a/include/sound/ak4xxx-adda.h
++++ b/include/sound/ak4xxx-adda.h
+@@ -35,7 +35,7 @@ struct snd_ak4xxx_ops {
+ void (*write)(struct snd_akm4xxx *ak, int chip, unsigned char reg,
+ unsigned char val);
+ void (*set_rate_val)(struct snd_akm4xxx *ak, unsigned int rate);
+-};
++} __no_const;
+
+ #define AK4XXX_IMAGE_SIZE (AK4XXX_MAX_CHIPS * 16) /* 64 bytes */
+
+diff --git a/include/sound/hwdep.h b/include/sound/hwdep.h
+index 8c05e47..2b5df97 100644
+--- a/include/sound/hwdep.h
++++ b/include/sound/hwdep.h
+@@ -49,7 +49,7 @@ struct snd_hwdep_ops {
+ struct snd_hwdep_dsp_status *status);
+ int (*dsp_load)(struct snd_hwdep *hw,
+ struct snd_hwdep_dsp_image *image);
+-};
++} __no_const;
+
+ struct snd_hwdep {
+ struct snd_card *card;
+diff --git a/include/sound/info.h b/include/sound/info.h
+index 112e894..6fda5b5 100644
+--- a/include/sound/info.h
++++ b/include/sound/info.h
+@@ -44,7 +44,7 @@ struct snd_info_entry_text {
+ struct snd_info_buffer *buffer);
+ void (*write)(struct snd_info_entry *entry,
+ struct snd_info_buffer *buffer);
+-};
++} __no_const;
+
+ struct snd_info_entry_ops {
+ int (*open)(struct snd_info_entry *entry,
+diff --git a/include/sound/pcm.h b/include/sound/pcm.h
+index de6d981..590a550 100644
+--- a/include/sound/pcm.h
++++ b/include/sound/pcm.h
+@@ -80,6 +80,7 @@ struct snd_pcm_ops {
+ int (*mmap)(struct snd_pcm_substream *substream, struct vm_area_struct *vma);
+ int (*ack)(struct snd_pcm_substream *substream);
+ };
++typedef struct snd_pcm_ops __no_const snd_pcm_ops_no_const;
+
+ /*
+ *
+diff --git a/include/sound/sb16_csp.h b/include/sound/sb16_csp.h
+index 736eac7..fe8a80f 100644
+--- a/include/sound/sb16_csp.h
++++ b/include/sound/sb16_csp.h
+@@ -139,7 +139,7 @@ struct snd_sb_csp_ops {
+ int (*csp_start) (struct snd_sb_csp * p, int sample_width, int channels);
+ int (*csp_stop) (struct snd_sb_csp * p);
+ int (*csp_qsound_transfer) (struct snd_sb_csp * p);
+-};
++} __no_const;
+
+ /*
+ * CSP private data
+diff --git a/include/sound/ymfpci.h b/include/sound/ymfpci.h
+index 444cd6b..3327cc5 100644
+--- a/include/sound/ymfpci.h
++++ b/include/sound/ymfpci.h
+@@ -358,7 +358,7 @@ struct snd_ymfpci {
+ spinlock_t reg_lock;
+ spinlock_t voice_lock;
+ wait_queue_head_t interrupt_sleep;
+- atomic_t interrupt_sleep_count;
++ atomic_unchecked_t interrupt_sleep_count;
+ struct snd_info_entry *proc_entry;
+ const struct firmware *dsp_microcode;
+ const struct firmware *controller_microcode;
+diff --git a/include/trace/events/irq.h b/include/trace/events/irq.h
+index b89f9db..f097b38 100644
+--- a/include/trace/events/irq.h
++++ b/include/trace/events/irq.h
+@@ -34,7 +34,7 @@
+ */
+ TRACE_EVENT(irq_handler_entry,
+
+- TP_PROTO(int irq, struct irqaction *action),
++ TP_PROTO(int irq, const struct irqaction *action),
+
+ TP_ARGS(irq, action),
+
+@@ -64,7 +64,7 @@ TRACE_EVENT(irq_handler_entry,
+ */
+ TRACE_EVENT(irq_handler_exit,
+
+- TP_PROTO(int irq, struct irqaction *action, int ret),
++ TP_PROTO(int irq, const struct irqaction *action, int ret),
+
+ TP_ARGS(irq, action, ret),
+
+@@ -95,7 +95,7 @@ TRACE_EVENT(irq_handler_exit,
+ */
+ TRACE_EVENT(softirq_entry,
+
+- TP_PROTO(struct softirq_action *h, struct softirq_action *vec),
++ TP_PROTO(const struct softirq_action *h, const struct softirq_action *vec),
+
+ TP_ARGS(h, vec),
+
+@@ -124,7 +124,7 @@ TRACE_EVENT(softirq_entry,
+ */
+ TRACE_EVENT(softirq_exit,
+
+- TP_PROTO(struct softirq_action *h, struct softirq_action *vec),
++ TP_PROTO(const struct softirq_action *h, const struct softirq_action *vec),
+
+ TP_ARGS(h, vec),
+
+diff --git a/include/video/uvesafb.h b/include/video/uvesafb.h
+index 0993a22..32ba2fe 100644
+--- a/include/video/uvesafb.h
++++ b/include/video/uvesafb.h
+@@ -177,6 +177,7 @@ struct uvesafb_par {
+ u8 ypan; /* 0 - nothing, 1 - ypan, 2 - ywrap */
+ u8 pmi_setpal; /* PMI for palette changes */
+ u16 *pmi_base; /* protected mode interface location */
++ u8 *pmi_code; /* protected mode code location */
+ void *pmi_start;
+ void *pmi_pal;
+ u8 *vbe_state_orig; /*
+diff --git a/init/Kconfig b/init/Kconfig
+index d72691b..3996e54 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -1004,7 +1004,7 @@ config SLUB_DEBUG
+
+ config COMPAT_BRK
+ bool "Disable heap randomization"
+- default y
++ default n
+ help
+ Randomizing heap placement makes heap exploits harder, but it
+ also breaks ancient binaries (including anything libc5 based).
+diff --git a/init/do_mounts.c b/init/do_mounts.c
+index bb008d0..4fa3933 100644
+--- a/init/do_mounts.c
++++ b/init/do_mounts.c
+@@ -216,11 +216,11 @@ static void __init get_fs_names(char *page)
+
+ static int __init do_mount_root(char *name, char *fs, int flags, void *data)
+ {
+- int err = sys_mount(name, "/root", fs, flags, data);
++ int err = sys_mount((__force char __user *)name, (__force char __user *)"/root", (__force char __user *)fs, flags, (__force void __user *)data);
+ if (err)
+ return err;
+
+- sys_chdir("/root");
++ sys_chdir((__force const char __user *)"/root");
+ ROOT_DEV = current->fs->pwd.mnt->mnt_sb->s_dev;
+ printk("VFS: Mounted root (%s filesystem)%s on device %u:%u.\n",
+ current->fs->pwd.mnt->mnt_sb->s_type->name,
+@@ -311,18 +311,18 @@ void __init change_floppy(char *fmt, ...)
+ va_start(args, fmt);
+ vsprintf(buf, fmt, args);
+ va_end(args);
+- fd = sys_open("/dev/root", O_RDWR | O_NDELAY, 0);
++ fd = sys_open((char __user *)"/dev/root", O_RDWR | O_NDELAY, 0);
+ if (fd >= 0) {
+ sys_ioctl(fd, FDEJECT, 0);
+ sys_close(fd);
+ }
+ printk(KERN_NOTICE "VFS: Insert %s and press ENTER\n", buf);
+- fd = sys_open("/dev/console", O_RDWR, 0);
++ fd = sys_open((char __user *)"/dev/console", O_RDWR, 0);
+ if (fd >= 0) {
+ sys_ioctl(fd, TCGETS, (long)&termios);
+ termios.c_lflag &= ~ICANON;
+ sys_ioctl(fd, TCSETSF, (long)&termios);
+- sys_read(fd, &c, 1);
++ sys_read(fd, (char __user *)&c, 1);
+ termios.c_lflag |= ICANON;
+ sys_ioctl(fd, TCSETSF, (long)&termios);
+ sys_close(fd);
+@@ -416,6 +416,6 @@ void __init prepare_namespace(void)
+ mount_root();
+ out:
+ devtmpfs_mount("dev");
+- sys_mount(".", "/", NULL, MS_MOVE, NULL);
+- sys_chroot(".");
++ sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
++ sys_chroot((__force char __user *)".");
+ }
+diff --git a/init/do_mounts.h b/init/do_mounts.h
+index f5b978a..a34abde 100644
+--- a/init/do_mounts.h
++++ b/init/do_mounts.h
+@@ -15,15 +15,15 @@ extern int root_mountflags;
+
+ static inline int create_dev(char *name, dev_t dev)
+ {
+- sys_unlink(name);
+- return sys_mknod(name, S_IFBLK|0600, new_encode_dev(dev));
++ sys_unlink((char __force_user *)name);
++ return sys_mknod((char __force_user *)name, S_IFBLK|0600, new_encode_dev(dev));
+ }
+
+ #if BITS_PER_LONG == 32
+ static inline u32 bstat(char *name)
+ {
+ struct stat64 stat;
+- if (sys_stat64(name, &stat) != 0)
++ if (sys_stat64((char __force_user *)name, (struct stat64 __force_user *)&stat) != 0)
+ return 0;
+ if (!S_ISBLK(stat.st_mode))
+ return 0;
+@@ -35,7 +35,7 @@ static inline u32 bstat(char *name)
+ static inline u32 bstat(char *name)
+ {
+ struct stat stat;
+- if (sys_newstat(name, &stat) != 0)
++ if (sys_newstat((char __force_user *)name, (struct stat __force_user *)&stat) != 0)
+ return 0;
+ if (!S_ISBLK(stat.st_mode))
+ return 0;
+diff --git a/init/do_mounts_initrd.c b/init/do_mounts_initrd.c
+index 614241b..4da046b 100644
+--- a/init/do_mounts_initrd.c
++++ b/init/do_mounts_initrd.c
+@@ -32,7 +32,7 @@ static int __init do_linuxrc(void * shell)
+ sys_close(old_fd);sys_close(root_fd);
+ sys_close(0);sys_close(1);sys_close(2);
+ sys_setsid();
+- (void) sys_open("/dev/console",O_RDWR,0);
++ (void) sys_open((__force const char __user *)"/dev/console",O_RDWR,0);
+ (void) sys_dup(0);
+ (void) sys_dup(0);
+ return kernel_execve(shell, argv, envp_init);
+@@ -47,13 +47,13 @@ static void __init handle_initrd(void)
+ create_dev("/dev/root.old", Root_RAM0);
+ /* mount initrd on rootfs' /root */
+ mount_block_root("/dev/root.old", root_mountflags & ~MS_RDONLY);
+- sys_mkdir("/old", 0700);
+- root_fd = sys_open("/", 0, 0);
+- old_fd = sys_open("/old", 0, 0);
++ sys_mkdir((const char __force_user *)"/old", 0700);
++ root_fd = sys_open((const char __force_user *)"/", 0, 0);
++ old_fd = sys_open((const char __force_user *)"/old", 0, 0);
+ /* move initrd over / and chdir/chroot in initrd root */
+- sys_chdir("/root");
+- sys_mount(".", "/", NULL, MS_MOVE, NULL);
+- sys_chroot(".");
++ sys_chdir((const char __force_user *)"/root");
++ sys_mount((char __force_user *)".", (char __force_user *)"/", NULL, MS_MOVE, NULL);
++ sys_chroot((const char __force_user *)".");
+
+ /*
+ * In case that a resume from disk is carried out by linuxrc or one of
+@@ -70,15 +70,15 @@ static void __init handle_initrd(void)
+
+ /* move initrd to rootfs' /old */
+ sys_fchdir(old_fd);
+- sys_mount("/", ".", NULL, MS_MOVE, NULL);
++ sys_mount((char __force_user *)"/", (char __force_user *)".", NULL, MS_MOVE, NULL);
+ /* switch root and cwd back to / of rootfs */
+ sys_fchdir(root_fd);
+- sys_chroot(".");
++ sys_chroot((const char __force_user *)".");
+ sys_close(old_fd);
+ sys_close(root_fd);
+
+ if (new_decode_dev(real_root_dev) == Root_RAM0) {
+- sys_chdir("/old");
++ sys_chdir((const char __force_user *)"/old");
+ return;
+ }
+
+@@ -86,17 +86,17 @@ static void __init handle_initrd(void)
+ mount_root();
+
+ printk(KERN_NOTICE "Trying to move old root to /initrd ... ");
+- error = sys_mount("/old", "/root/initrd", NULL, MS_MOVE, NULL);
++ error = sys_mount((char __force_user *)"/old", (char __force_user *)"/root/initrd", NULL, MS_MOVE, NULL);
+ if (!error)
+ printk("okay\n");
+ else {
+- int fd = sys_open("/dev/root.old", O_RDWR, 0);
++ int fd = sys_open((const char __force_user *)"/dev/root.old", O_RDWR, 0);
+ if (error == -ENOENT)
+ printk("/initrd does not exist. Ignored.\n");
+ else
+ printk("failed\n");
+ printk(KERN_NOTICE "Unmounting old root\n");
+- sys_umount("/old", MNT_DETACH);
++ sys_umount((char __force_user *)"/old", MNT_DETACH);
+ printk(KERN_NOTICE "Trying to free ramdisk memory ... ");
+ if (fd < 0) {
+ error = fd;
+@@ -119,11 +119,11 @@ int __init initrd_load(void)
+ * mounted in the normal path.
+ */
+ if (rd_load_image("/initrd.image") && ROOT_DEV != Root_RAM0) {
+- sys_unlink("/initrd.image");
++ sys_unlink((const char __force_user *)"/initrd.image");
+ handle_initrd();
+ return 1;
+ }
+ }
+- sys_unlink("/initrd.image");
++ sys_unlink((const char __force_user *)"/initrd.image");
+ return 0;
+ }
+diff --git a/init/do_mounts_md.c b/init/do_mounts_md.c
+index 69aebbf..c0bf6a7 100644
+--- a/init/do_mounts_md.c
++++ b/init/do_mounts_md.c
+@@ -170,7 +170,7 @@ static void __init md_setup_drive(void)
+ partitioned ? "_d" : "", minor,
+ md_setup_args[ent].device_names);
+
+- fd = sys_open(name, 0, 0);
++ fd = sys_open((char __force_user *)name, 0, 0);
+ if (fd < 0) {
+ printk(KERN_ERR "md: open failed - cannot start "
+ "array %s\n", name);
+@@ -233,7 +233,7 @@ static void __init md_setup_drive(void)
+ * array without it
+ */
+ sys_close(fd);
+- fd = sys_open(name, 0, 0);
++ fd = sys_open((char __force_user *)name, 0, 0);
+ sys_ioctl(fd, BLKRRPART, 0);
+ }
+ sys_close(fd);
+@@ -283,7 +283,7 @@ static void __init autodetect_raid(void)
+
+ wait_for_device_probe();
+
+- fd = sys_open("/dev/md0", 0, 0);
++ fd = sys_open((__force char __user *)"/dev/md0", 0, 0);
+ if (fd >= 0) {
+ sys_ioctl(fd, RAID_AUTORUN, raid_autopart);
+ sys_close(fd);
+diff --git a/init/initramfs.c b/init/initramfs.c
+index 1fd59b8..a01b079 100644
+--- a/init/initramfs.c
++++ b/init/initramfs.c
+@@ -74,7 +74,7 @@ static void __init free_hash(void)
+ }
+ }
+
+-static long __init do_utime(char __user *filename, time_t mtime)
++static long __init do_utime(__force char __user *filename, time_t mtime)
+ {
+ struct timespec t[2];
+
+@@ -109,7 +109,7 @@ static void __init dir_utime(void)
+ struct dir_entry *de, *tmp;
+ list_for_each_entry_safe(de, tmp, &dir_list, list) {
+ list_del(&de->list);
+- do_utime(de->name, de->mtime);
++ do_utime((char __force_user *)de->name, de->mtime);
+ kfree(de->name);
+ kfree(de);
+ }
+@@ -271,7 +271,7 @@ static int __init maybe_link(void)
+ if (nlink >= 2) {
+ char *old = find_link(major, minor, ino, mode, collected);
+ if (old)
+- return (sys_link(old, collected) < 0) ? -1 : 1;
++ return (sys_link((char __force_user *)old, (char __force_user *)collected) < 0) ? -1 : 1;
+ }
+ return 0;
+ }
+@@ -280,11 +280,11 @@ static void __init clean_path(char *path, mode_t mode)
+ {
+ struct stat st;
+
+- if (!sys_newlstat(path, &st) && (st.st_mode^mode) & S_IFMT) {
++ if (!sys_newlstat((char __force_user *)path, (struct stat __force_user *)&st) && (st.st_mode^mode) & S_IFMT) {
+ if (S_ISDIR(st.st_mode))
+- sys_rmdir(path);
++ sys_rmdir((char __force_user *)path);
+ else
+- sys_unlink(path);
++ sys_unlink((char __force_user *)path);
+ }
+ }
+
+@@ -305,7 +305,7 @@ static int __init do_name(void)
+ int openflags = O_WRONLY|O_CREAT;
+ if (ml != 1)
+ openflags |= O_TRUNC;
+- wfd = sys_open(collected, openflags, mode);
++ wfd = sys_open((char __force_user *)collected, openflags, mode);
+
+ if (wfd >= 0) {
+ sys_fchown(wfd, uid, gid);
+@@ -317,17 +317,17 @@ static int __init do_name(void)
+ }
+ }
+ } else if (S_ISDIR(mode)) {
+- sys_mkdir(collected, mode);
+- sys_chown(collected, uid, gid);
+- sys_chmod(collected, mode);
++ sys_mkdir((char __force_user *)collected, mode);
++ sys_chown((char __force_user *)collected, uid, gid);
++ sys_chmod((char __force_user *)collected, mode);
+ dir_add(collected, mtime);
+ } else if (S_ISBLK(mode) || S_ISCHR(mode) ||
+ S_ISFIFO(mode) || S_ISSOCK(mode)) {
+ if (maybe_link() == 0) {
+- sys_mknod(collected, mode, rdev);
+- sys_chown(collected, uid, gid);
+- sys_chmod(collected, mode);
+- do_utime(collected, mtime);
++ sys_mknod((char __force_user *)collected, mode, rdev);
++ sys_chown((char __force_user *)collected, uid, gid);
++ sys_chmod((char __force_user *)collected, mode);
++ do_utime((char __force_user *)collected, mtime);
+ }
+ }
+ return 0;
+@@ -336,15 +336,15 @@ static int __init do_name(void)
+ static int __init do_copy(void)
+ {
+ if (count >= body_len) {
+- sys_write(wfd, victim, body_len);
++ sys_write(wfd, (char __force_user *)victim, body_len);
+ sys_close(wfd);
+- do_utime(vcollected, mtime);
++ do_utime((char __force_user *)vcollected, mtime);
+ kfree(vcollected);
+ eat(body_len);
+ state = SkipIt;
+ return 0;
+ } else {
+- sys_write(wfd, victim, count);
++ sys_write(wfd, (char __force_user *)victim, count);
+ body_len -= count;
+ eat(count);
+ return 1;
+@@ -355,9 +355,9 @@ static int __init do_symlink(void)
+ {
+ collected[N_ALIGN(name_len) + body_len] = '\0';
+ clean_path(collected, 0);
+- sys_symlink(collected + N_ALIGN(name_len), collected);
+- sys_lchown(collected, uid, gid);
+- do_utime(collected, mtime);
++ sys_symlink((char __force_user *)collected + N_ALIGN(name_len), (char __force_user *)collected);
++ sys_lchown((char __force_user *)collected, uid, gid);
++ do_utime((char __force_user *)collected, mtime);
+ state = SkipIt;
+ next_state = Reset;
+ return 0;
+diff --git a/init/main.c b/init/main.c
+index 1eb4bd5..fea5bbe 100644
+--- a/init/main.c
++++ b/init/main.c
+@@ -97,6 +97,7 @@ static inline void mark_rodata_ro(void) { }
+ #ifdef CONFIG_TC
+ extern void tc_init(void);
+ #endif
++extern void grsecurity_init(void);
+
+ enum system_states system_state __read_mostly;
+ EXPORT_SYMBOL(system_state);
+@@ -183,6 +184,49 @@ static int __init set_reset_devices(char *str)
+
+ __setup("reset_devices", set_reset_devices);
+
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++extern char pax_enter_kernel_user[];
++extern char pax_exit_kernel_user[];
++extern pgdval_t clone_pgd_mask;
++#endif
++
++#if defined(CONFIG_X86) && defined(CONFIG_PAX_MEMORY_UDEREF)
++static int __init setup_pax_nouderef(char *str)
++{
++#ifdef CONFIG_X86_32
++ unsigned int cpu;
++ struct desc_struct *gdt;
++
++ for (cpu = 0; cpu < nr_cpu_ids; cpu++) {
++ gdt = get_cpu_gdt_table(cpu);
++ gdt[GDT_ENTRY_KERNEL_DS].type = 3;
++ gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
++ gdt[GDT_ENTRY_DEFAULT_USER_CS].limit = 0xf;
++ gdt[GDT_ENTRY_DEFAULT_USER_DS].limit = 0xf;
++ }
++ asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
++#else
++ memcpy(pax_enter_kernel_user, (unsigned char []){0xc3}, 1);
++ memcpy(pax_exit_kernel_user, (unsigned char []){0xc3}, 1);
++ clone_pgd_mask = ~(pgdval_t)0UL;
++#endif
++
++ return 0;
++}
++early_param("pax_nouderef", setup_pax_nouderef);
++#endif
++
++#ifdef CONFIG_PAX_SOFTMODE
++int pax_softmode;
++
++static int __init setup_pax_softmode(char *str)
++{
++ get_option(&str, &pax_softmode);
++ return 1;
++}
++__setup("pax_softmode=", setup_pax_softmode);
++#endif
++
+ static char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
+ char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
+ static const char *panic_later, *panic_param;
+@@ -705,52 +749,53 @@ int initcall_debug;
+ core_param(initcall_debug, initcall_debug, bool, 0644);
+
+ static char msgbuf[64];
+-static struct boot_trace_call call;
+-static struct boot_trace_ret ret;
++static struct boot_trace_call trace_call;
++static struct boot_trace_ret trace_ret;
+
+ int do_one_initcall(initcall_t fn)
+ {
+ int count = preempt_count();
+ ktime_t calltime, delta, rettime;
++ const char *msg1 = "", *msg2 = "";
+
+ if (initcall_debug) {
+- call.caller = task_pid_nr(current);
+- printk("calling %pF @ %i\n", fn, call.caller);
++ trace_call.caller = task_pid_nr(current);
++ printk("calling %pF @ %i\n", fn, trace_call.caller);
+ calltime = ktime_get();
+- trace_boot_call(&call, fn);
++ trace_boot_call(&trace_call, fn);
+ enable_boot_trace();
+ }
+
+- ret.result = fn();
++ trace_ret.result = fn();
+
+ if (initcall_debug) {
+ disable_boot_trace();
+ rettime = ktime_get();
+ delta = ktime_sub(rettime, calltime);
+- ret.duration = (unsigned long long) ktime_to_ns(delta) >> 10;
+- trace_boot_ret(&ret, fn);
++ trace_ret.duration = (unsigned long long) ktime_to_ns(delta) >> 10;
++ trace_boot_ret(&trace_ret, fn);
+ printk("initcall %pF returned %d after %Ld usecs\n", fn,
+- ret.result, ret.duration);
++ trace_ret.result, trace_ret.duration);
+ }
+
+ msgbuf[0] = 0;
+
+- if (ret.result && ret.result != -ENODEV && initcall_debug)
+- sprintf(msgbuf, "error code %d ", ret.result);
++ if (trace_ret.result && trace_ret.result != -ENODEV && initcall_debug)
++ sprintf(msgbuf, "error code %d ", trace_ret.result);
+
+ if (preempt_count() != count) {
+- strlcat(msgbuf, "preemption imbalance ", sizeof(msgbuf));
++ msg1 = " preemption imbalance";
+ preempt_count() = count;
+ }
+ if (irqs_disabled()) {
+- strlcat(msgbuf, "disabled interrupts ", sizeof(msgbuf));
++ msg2 = " disabled interrupts";
+ local_irq_enable();
+ }
+- if (msgbuf[0]) {
+- printk("initcall %pF returned with %s\n", fn, msgbuf);
++ if (msgbuf[0] || *msg1 || *msg2) {
++ printk("initcall %pF returned with %s%s%s\n", fn, msgbuf, msg1, msg2);
+ }
+
+- return ret.result;
++ return trace_ret.result;
+ }
+
+
+@@ -893,11 +938,13 @@ static int __init kernel_init(void * unused)
+ if (!ramdisk_execute_command)
+ ramdisk_execute_command = "/init";
+
+- if (sys_access((const char __user *) ramdisk_execute_command, 0) != 0) {
++ if (sys_access((const char __force_user *) ramdisk_execute_command, 0) != 0) {
+ ramdisk_execute_command = NULL;
+ prepare_namespace();
+ }
+
++ grsecurity_init();
++
+ /*
+ * Ok, we have completed the initial bootup, and
+ * we're essentially up and running. Get rid of the
+diff --git a/init/noinitramfs.c b/init/noinitramfs.c
+index f4c1a3a..96c19bd 100644
+--- a/init/noinitramfs.c
++++ b/init/noinitramfs.c
+@@ -29,7 +29,7 @@ static int __init default_rootfs(void)
+ {
+ int err;
+
+- err = sys_mkdir("/dev", 0755);
++ err = sys_mkdir((const char __user *)"/dev", 0755);
+ if (err < 0)
+ goto out;
+
+@@ -39,7 +39,7 @@ static int __init default_rootfs(void)
+ if (err < 0)
+ goto out;
+
+- err = sys_mkdir("/root", 0700);
++ err = sys_mkdir((const char __user *)"/root", 0700);
+ if (err < 0)
+ goto out;
+
+diff --git a/ipc/mqueue.c b/ipc/mqueue.c
+index d01bc14..8df81db 100644
+--- a/ipc/mqueue.c
++++ b/ipc/mqueue.c
+@@ -150,6 +150,7 @@ static struct inode *mqueue_get_inode(struct super_block *sb,
+ mq_bytes = (mq_msg_tblsz +
+ (info->attr.mq_maxmsg * info->attr.mq_msgsize));
+
++ gr_learn_resource(current, RLIMIT_MSGQUEUE, u->mq_bytes + mq_bytes, 1);
+ spin_lock(&mq_lock);
+ if (u->mq_bytes + mq_bytes < u->mq_bytes ||
+ u->mq_bytes + mq_bytes >
+diff --git a/ipc/msg.c b/ipc/msg.c
+index 779f762..4af9e36 100644
+--- a/ipc/msg.c
++++ b/ipc/msg.c
+@@ -310,18 +310,19 @@ static inline int msg_security(struct kern_ipc_perm *ipcp, int msgflg)
+ return security_msg_queue_associate(msq, msgflg);
+ }
+
++static struct ipc_ops msg_ops = {
++ .getnew = newque,
++ .associate = msg_security,
++ .more_checks = NULL
++};
++
+ SYSCALL_DEFINE2(msgget, key_t, key, int, msgflg)
+ {
+ struct ipc_namespace *ns;
+- struct ipc_ops msg_ops;
+ struct ipc_params msg_params;
+
+ ns = current->nsproxy->ipc_ns;
+
+- msg_ops.getnew = newque;
+- msg_ops.associate = msg_security;
+- msg_ops.more_checks = NULL;
+-
+ msg_params.key = key;
+ msg_params.flg = msgflg;
+
+diff --git a/ipc/sem.c b/ipc/sem.c
+index b781007..f738b04 100644
+--- a/ipc/sem.c
++++ b/ipc/sem.c
+@@ -309,10 +309,15 @@ static inline int sem_more_checks(struct kern_ipc_perm *ipcp,
+ return 0;
+ }
+
++static struct ipc_ops sem_ops = {
++ .getnew = newary,
++ .associate = sem_security,
++ .more_checks = sem_more_checks
++};
++
+ SYSCALL_DEFINE3(semget, key_t, key, int, nsems, int, semflg)
+ {
+ struct ipc_namespace *ns;
+- struct ipc_ops sem_ops;
+ struct ipc_params sem_params;
+
+ ns = current->nsproxy->ipc_ns;
+@@ -320,10 +325,6 @@ SYSCALL_DEFINE3(semget, key_t, key, int, nsems, int, semflg)
+ if (nsems < 0 || nsems > ns->sc_semmsl)
+ return -EINVAL;
+
+- sem_ops.getnew = newary;
+- sem_ops.associate = sem_security;
+- sem_ops.more_checks = sem_more_checks;
+-
+ sem_params.key = key;
+ sem_params.flg = semflg;
+ sem_params.u.nsems = nsems;
+@@ -671,6 +672,8 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
+ ushort* sem_io = fast_sem_io;
+ int nsems;
+
++ pax_track_stack();
++
+ sma = sem_lock_check(ns, semid);
+ if (IS_ERR(sma))
+ return PTR_ERR(sma);
+@@ -1071,6 +1074,8 @@ SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops,
+ unsigned long jiffies_left = 0;
+ struct ipc_namespace *ns;
+
++ pax_track_stack();
++
+ ns = current->nsproxy->ipc_ns;
+
+ if (nsops < 1 || semid < 0)
+diff --git a/ipc/shm.c b/ipc/shm.c
+index d30732c..e4992cd 100644
+--- a/ipc/shm.c
++++ b/ipc/shm.c
+@@ -70,6 +70,14 @@ static void shm_destroy (struct ipc_namespace *ns, struct shmid_kernel *shp);
+ static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
+ #endif
+
++#ifdef CONFIG_GRKERNSEC
++extern int gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
++ const time_t shm_createtime, const uid_t cuid,
++ const int shmid);
++extern int gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
++ const time_t shm_createtime);
++#endif
++
+ void shm_init_ns(struct ipc_namespace *ns)
+ {
+ ns->shm_ctlmax = SHMMAX;
+@@ -396,6 +404,14 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
+ shp->shm_lprid = 0;
+ shp->shm_atim = shp->shm_dtim = 0;
+ shp->shm_ctim = get_seconds();
++#ifdef CONFIG_GRKERNSEC
++ {
++ struct timespec timeval;
++ do_posix_clock_monotonic_gettime(&timeval);
++
++ shp->shm_createtime = timeval.tv_sec;
++ }
++#endif
+ shp->shm_segsz = size;
+ shp->shm_nattch = 0;
+ shp->shm_file = file;
+@@ -446,18 +462,19 @@ static inline int shm_more_checks(struct kern_ipc_perm *ipcp,
+ return 0;
+ }
+
++static struct ipc_ops shm_ops = {
++ .getnew = newseg,
++ .associate = shm_security,
++ .more_checks = shm_more_checks
++};
++
+ SYSCALL_DEFINE3(shmget, key_t, key, size_t, size, int, shmflg)
+ {
+ struct ipc_namespace *ns;
+- struct ipc_ops shm_ops;
+ struct ipc_params shm_params;
+
+ ns = current->nsproxy->ipc_ns;
+
+- shm_ops.getnew = newseg;
+- shm_ops.associate = shm_security;
+- shm_ops.more_checks = shm_more_checks;
+-
+ shm_params.key = key;
+ shm_params.flg = shmflg;
+ shm_params.u.size = size;
+@@ -857,6 +874,12 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr)
+ f_mode = FMODE_READ | FMODE_WRITE;
+ }
+ if (shmflg & SHM_EXEC) {
++
++#ifdef CONFIG_PAX_MPROTECT
++ if (current->mm->pax_flags & MF_PAX_MPROTECT)
++ goto out;
++#endif
++
+ prot |= PROT_EXEC;
+ acc_mode |= S_IXUGO;
+ }
+@@ -880,9 +903,21 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr)
+ if (err)
+ goto out_unlock;
+
++#ifdef CONFIG_GRKERNSEC
++ if (!gr_handle_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime,
++ shp->shm_perm.cuid, shmid) ||
++ !gr_chroot_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime)) {
++ err = -EACCES;
++ goto out_unlock;
++ }
++#endif
++
+ path.dentry = dget(shp->shm_file->f_path.dentry);
+ path.mnt = shp->shm_file->f_path.mnt;
+ shp->shm_nattch++;
++#ifdef CONFIG_GRKERNSEC
++ shp->shm_lapid = current->pid;
++#endif
+ size = i_size_read(path.dentry->d_inode);
+ shm_unlock(shp);
+
+diff --git a/kernel/acct.c b/kernel/acct.c
+index a6605ca..ca91111 100644
+--- a/kernel/acct.c
++++ b/kernel/acct.c
+@@ -579,7 +579,7 @@ static void do_acct_process(struct bsd_acct_struct *acct,
+ */
+ flim = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
+ current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY;
+- file->f_op->write(file, (char *)&ac,
++ file->f_op->write(file, (char __force_user *)&ac,
+ sizeof(acct_t), &file->f_pos);
+ current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
+ set_fs(fs);
+diff --git a/kernel/audit.c b/kernel/audit.c
+index 5feed23..48415fd 100644
+--- a/kernel/audit.c
++++ b/kernel/audit.c
+@@ -110,7 +110,7 @@ u32 audit_sig_sid = 0;
+ 3) suppressed due to audit_rate_limit
+ 4) suppressed due to audit_backlog_limit
+ */
+-static atomic_t audit_lost = ATOMIC_INIT(0);
++static atomic_unchecked_t audit_lost = ATOMIC_INIT(0);
+
+ /* The netlink socket. */
+ static struct sock *audit_sock;
+@@ -232,7 +232,7 @@ void audit_log_lost(const char *message)
+ unsigned long now;
+ int print;
+
+- atomic_inc(&audit_lost);
++ atomic_inc_unchecked(&audit_lost);
+
+ print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit);
+
+@@ -251,7 +251,7 @@ void audit_log_lost(const char *message)
+ printk(KERN_WARNING
+ "audit: audit_lost=%d audit_rate_limit=%d "
+ "audit_backlog_limit=%d\n",
+- atomic_read(&audit_lost),
++ atomic_read_unchecked(&audit_lost),
+ audit_rate_limit,
+ audit_backlog_limit);
+ audit_panic(message);
+@@ -691,7 +691,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+ status_set.pid = audit_pid;
+ status_set.rate_limit = audit_rate_limit;
+ status_set.backlog_limit = audit_backlog_limit;
+- status_set.lost = atomic_read(&audit_lost);
++ status_set.lost = atomic_read_unchecked(&audit_lost);
+ status_set.backlog = skb_queue_len(&audit_skb_queue);
+ audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_GET, 0, 0,
+ &status_set, sizeof(status_set));
+@@ -891,8 +891,10 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+ spin_unlock_irq(&tsk->sighand->siglock);
+ }
+ read_unlock(&tasklist_lock);
+- audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_TTY_GET, 0, 0,
+- &s, sizeof(s));
++
++ if (!err)
++ audit_send_reply(NETLINK_CB(skb).pid, seq,
++ AUDIT_TTY_GET, 0, 0, &s, sizeof(s));
+ break;
+ }
+ case AUDIT_TTY_SET: {
+@@ -1262,12 +1264,13 @@ static void audit_log_vformat(struct audit_buffer *ab, const char *fmt,
+ avail = audit_expand(ab,
+ max_t(unsigned, AUDIT_BUFSIZ, 1+len-avail));
+ if (!avail)
+- goto out;
++ goto out_va_end;
+ len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args2);
+ }
+- va_end(args2);
+ if (len > 0)
+ skb_put(skb, len);
++out_va_end:
++ va_end(args2);
+ out:
+ return;
+ }
+diff --git a/kernel/auditsc.c b/kernel/auditsc.c
+index 267e484..ac41bc3 100644
+--- a/kernel/auditsc.c
++++ b/kernel/auditsc.c
+@@ -1157,8 +1157,8 @@ static void audit_log_execve_info(struct audit_context *context,
+ struct audit_buffer **ab,
+ struct audit_aux_data_execve *axi)
+ {
+- int i;
+- size_t len, len_sent = 0;
++ int i, len;
++ size_t len_sent = 0;
+ const char __user *p;
+ char *buf;
+
+@@ -2113,7 +2113,7 @@ int auditsc_get_stamp(struct audit_context *ctx,
+ }
+
+ /* global counter which is incremented every time something logs in */
+-static atomic_t session_id = ATOMIC_INIT(0);
++static atomic_unchecked_t session_id = ATOMIC_INIT(0);
+
+ /**
+ * audit_set_loginuid - set a task's audit_context loginuid
+@@ -2126,7 +2126,7 @@ static atomic_t session_id = ATOMIC_INIT(0);
+ */
+ int audit_set_loginuid(struct task_struct *task, uid_t loginuid)
+ {
+- unsigned int sessionid = atomic_inc_return(&session_id);
++ unsigned int sessionid = atomic_inc_return_unchecked(&session_id);
+ struct audit_context *context = task->audit_context;
+
+ if (context && context->in_syscall) {
+diff --git a/kernel/capability.c b/kernel/capability.c
+index 8a944f5..db5001e 100644
+--- a/kernel/capability.c
++++ b/kernel/capability.c
+@@ -305,10 +305,26 @@ int capable(int cap)
+ BUG();
+ }
+
+- if (security_capable(cap) == 0) {
++ if (security_capable(cap) == 0 && gr_is_capable(cap)) {
+ current->flags |= PF_SUPERPRIV;
+ return 1;
+ }
+ return 0;
+ }
++
++int capable_nolog(int cap)
++{
++ if (unlikely(!cap_valid(cap))) {
++ printk(KERN_CRIT "capable() called with invalid cap=%u\n", cap);
++ BUG();
++ }
++
++ if (security_capable(cap) == 0 && gr_is_capable_nolog(cap)) {
++ current->flags |= PF_SUPERPRIV;
++ return 1;
++ }
++ return 0;
++}
++
+ EXPORT_SYMBOL(capable);
++EXPORT_SYMBOL(capable_nolog);
+diff --git a/kernel/cgroup.c b/kernel/cgroup.c
+index 1fbcc74..7000012 100644
+--- a/kernel/cgroup.c
++++ b/kernel/cgroup.c
+@@ -536,6 +536,8 @@ static struct css_set *find_css_set(
+ struct hlist_head *hhead;
+ struct cg_cgroup_link *link;
+
++ pax_track_stack();
++
+ /* First see if we already have a cgroup group that matches
+ * the desired set */
+ read_lock(&css_set_lock);
+diff --git a/kernel/compat.c b/kernel/compat.c
+index 8bc5578..186e44a 100644
+--- a/kernel/compat.c
++++ b/kernel/compat.c
+@@ -108,7 +108,7 @@ static long compat_nanosleep_restart(struct restart_block *restart)
+ mm_segment_t oldfs;
+ long ret;
+
+- restart->nanosleep.rmtp = (struct timespec __user *) &rmt;
++ restart->nanosleep.rmtp = (struct timespec __force_user *) &rmt;
+ oldfs = get_fs();
+ set_fs(KERNEL_DS);
+ ret = hrtimer_nanosleep_restart(restart);
+@@ -140,7 +140,7 @@ asmlinkage long compat_sys_nanosleep(struct compat_timespec __user *rqtp,
+ oldfs = get_fs();
+ set_fs(KERNEL_DS);
+ ret = hrtimer_nanosleep(&tu,
+- rmtp ? (struct timespec __user *)&rmt : NULL,
++ rmtp ? (struct timespec __force_user *)&rmt : NULL,
+ HRTIMER_MODE_REL, CLOCK_MONOTONIC);
+ set_fs(oldfs);
+
+@@ -247,7 +247,7 @@ asmlinkage long compat_sys_sigpending(compat_old_sigset_t __user *set)
+ mm_segment_t old_fs = get_fs();
+
+ set_fs(KERNEL_DS);
+- ret = sys_sigpending((old_sigset_t __user *) &s);
++ ret = sys_sigpending((old_sigset_t __force_user *) &s);
+ set_fs(old_fs);
+ if (ret == 0)
+ ret = put_user(s, set);
+@@ -266,8 +266,8 @@ asmlinkage long compat_sys_sigprocmask(int how, compat_old_sigset_t __user *set,
+ old_fs = get_fs();
+ set_fs(KERNEL_DS);
+ ret = sys_sigprocmask(how,
+- set ? (old_sigset_t __user *) &s : NULL,
+- oset ? (old_sigset_t __user *) &s : NULL);
++ set ? (old_sigset_t __force_user *) &s : NULL,
++ oset ? (old_sigset_t __force_user *) &s : NULL);
+ set_fs(old_fs);
+ if (ret == 0)
+ if (oset)
+@@ -310,7 +310,7 @@ asmlinkage long compat_sys_old_getrlimit(unsigned int resource,
+ mm_segment_t old_fs = get_fs();
+
+ set_fs(KERNEL_DS);
+- ret = sys_old_getrlimit(resource, &r);
++ ret = sys_old_getrlimit(resource, (struct rlimit __force_user *)&r);
+ set_fs(old_fs);
+
+ if (!ret) {
+@@ -385,7 +385,7 @@ asmlinkage long compat_sys_getrusage(int who, struct compat_rusage __user *ru)
+ mm_segment_t old_fs = get_fs();
+
+ set_fs(KERNEL_DS);
+- ret = sys_getrusage(who, (struct rusage __user *) &r);
++ ret = sys_getrusage(who, (struct rusage __force_user *) &r);
+ set_fs(old_fs);
+
+ if (ret)
+@@ -412,8 +412,8 @@ compat_sys_wait4(compat_pid_t pid, compat_uint_t __user *stat_addr, int options,
+ set_fs (KERNEL_DS);
+ ret = sys_wait4(pid,
+ (stat_addr ?
+- (unsigned int __user *) &status : NULL),
+- options, (struct rusage __user *) &r);
++ (unsigned int __force_user *) &status : NULL),
++ options, (struct rusage __force_user *) &r);
+ set_fs (old_fs);
+
+ if (ret > 0) {
+@@ -438,8 +438,8 @@ asmlinkage long compat_sys_waitid(int which, compat_pid_t pid,
+ memset(&info, 0, sizeof(info));
+
+ set_fs(KERNEL_DS);
+- ret = sys_waitid(which, pid, (siginfo_t __user *)&info, options,
+- uru ? (struct rusage __user *)&ru : NULL);
++ ret = sys_waitid(which, pid, (siginfo_t __force_user *)&info, options,
++ uru ? (struct rusage __force_user *)&ru : NULL);
+ set_fs(old_fs);
+
+ if ((ret < 0) || (info.si_signo == 0))
+@@ -569,8 +569,8 @@ long compat_sys_timer_settime(timer_t timer_id, int flags,
+ oldfs = get_fs();
+ set_fs(KERNEL_DS);
+ err = sys_timer_settime(timer_id, flags,
+- (struct itimerspec __user *) &newts,
+- (struct itimerspec __user *) &oldts);
++ (struct itimerspec __force_user *) &newts,
++ (struct itimerspec __force_user *) &oldts);
+ set_fs(oldfs);
+ if (!err && old && put_compat_itimerspec(old, &oldts))
+ return -EFAULT;
+@@ -587,7 +587,7 @@ long compat_sys_timer_gettime(timer_t timer_id,
+ oldfs = get_fs();
+ set_fs(KERNEL_DS);
+ err = sys_timer_gettime(timer_id,
+- (struct itimerspec __user *) &ts);
++ (struct itimerspec __force_user *) &ts);
+ set_fs(oldfs);
+ if (!err && put_compat_itimerspec(setting, &ts))
+ return -EFAULT;
+@@ -606,7 +606,7 @@ long compat_sys_clock_settime(clockid_t which_clock,
+ oldfs = get_fs();
+ set_fs(KERNEL_DS);
+ err = sys_clock_settime(which_clock,
+- (struct timespec __user *) &ts);
++ (struct timespec __force_user *) &ts);
+ set_fs(oldfs);
+ return err;
+ }
+@@ -621,7 +621,7 @@ long compat_sys_clock_gettime(clockid_t which_clock,
+ oldfs = get_fs();
+ set_fs(KERNEL_DS);
+ err = sys_clock_gettime(which_clock,
+- (struct timespec __user *) &ts);
++ (struct timespec __force_user *) &ts);
+ set_fs(oldfs);
+ if (!err && put_compat_timespec(&ts, tp))
+ return -EFAULT;
+@@ -638,7 +638,7 @@ long compat_sys_clock_getres(clockid_t which_clock,
+ oldfs = get_fs();
+ set_fs(KERNEL_DS);
+ err = sys_clock_getres(which_clock,
+- (struct timespec __user *) &ts);
++ (struct timespec __force_user *) &ts);
+ set_fs(oldfs);
+ if (!err && tp && put_compat_timespec(&ts, tp))
+ return -EFAULT;
+@@ -650,9 +650,9 @@ static long compat_clock_nanosleep_restart(struct restart_block *restart)
+ long err;
+ mm_segment_t oldfs;
+ struct timespec tu;
+- struct compat_timespec *rmtp = restart->nanosleep.compat_rmtp;
++ struct compat_timespec __user *rmtp = restart->nanosleep.compat_rmtp;
+
+- restart->nanosleep.rmtp = (struct timespec __user *) &tu;
++ restart->nanosleep.rmtp = (struct timespec __force_user *) &tu;
+ oldfs = get_fs();
+ set_fs(KERNEL_DS);
+ err = clock_nanosleep_restart(restart);
+@@ -684,8 +684,8 @@ long compat_sys_clock_nanosleep(clockid_t which_clock, int flags,
+ oldfs = get_fs();
+ set_fs(KERNEL_DS);
+ err = sys_clock_nanosleep(which_clock, flags,
+- (struct timespec __user *) &in,
+- (struct timespec __user *) &out);
++ (struct timespec __force_user *) &in,
++ (struct timespec __force_user *) &out);
+ set_fs(oldfs);
+
+ if ((err == -ERESTART_RESTARTBLOCK) && rmtp &&
+diff --git a/kernel/configs.c b/kernel/configs.c
+index abaee68..047facd 100644
+--- a/kernel/configs.c
++++ b/kernel/configs.c
+@@ -73,8 +73,19 @@ static int __init ikconfig_init(void)
+ struct proc_dir_entry *entry;
+
+ /* create the current config file */
++#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_HIDESYM)
++ entry = proc_create("config.gz", S_IFREG | S_IRUSR, NULL,
++ &ikconfig_file_ops);
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++ entry = proc_create("config.gz", S_IFREG | S_IRUSR | S_IRGRP, NULL,
++ &ikconfig_file_ops);
++#endif
++#else
+ entry = proc_create("config.gz", S_IFREG | S_IRUGO, NULL,
+ &ikconfig_file_ops);
++#endif
++
+ if (!entry)
+ return -ENOMEM;
+
+diff --git a/kernel/cpu.c b/kernel/cpu.c
+index 3f2f04f..4e53ded 100644
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -20,7 +20,7 @@
+ /* Serializes the updates to cpu_online_mask, cpu_present_mask */
+ static DEFINE_MUTEX(cpu_add_remove_lock);
+
+-static __cpuinitdata RAW_NOTIFIER_HEAD(cpu_chain);
++static RAW_NOTIFIER_HEAD(cpu_chain);
+
+ /* If set, cpu_up and cpu_down will return -EBUSY and do nothing.
+ * Should always be manipulated under cpu_add_remove_lock
+diff --git a/kernel/cred.c b/kernel/cred.c
+index 0b5b5fc..f20c6b9 100644
+--- a/kernel/cred.c
++++ b/kernel/cred.c
+@@ -160,6 +160,8 @@ static void put_cred_rcu(struct rcu_head *rcu)
+ */
+ void __put_cred(struct cred *cred)
+ {
++ pax_track_stack();
++
+ kdebug("__put_cred(%p{%d,%d})", cred,
+ atomic_read(&cred->usage),
+ read_cred_subscribers(cred));
+@@ -184,6 +186,8 @@ void exit_creds(struct task_struct *tsk)
+ {
+ struct cred *cred;
+
++ pax_track_stack();
++
+ kdebug("exit_creds(%u,%p,%p,{%d,%d})", tsk->pid, tsk->real_cred, tsk->cred,
+ atomic_read(&tsk->cred->usage),
+ read_cred_subscribers(tsk->cred));
+@@ -206,6 +210,15 @@ void exit_creds(struct task_struct *tsk)
+ validate_creds(cred);
+ put_cred(cred);
+ }
++
++#ifdef CONFIG_GRKERNSEC_SETXID
++ cred = (struct cred *) tsk->delayed_cred;
++ if (cred) {
++ tsk->delayed_cred = NULL;
++ validate_creds(cred);
++ put_cred(cred);
++ }
++#endif
+ }
+
+ /**
+@@ -222,6 +235,8 @@ const struct cred *get_task_cred(struct task_struct *task)
+ {
+ const struct cred *cred;
+
++ pax_track_stack();
++
+ rcu_read_lock();
+
+ do {
+@@ -241,6 +256,8 @@ struct cred *cred_alloc_blank(void)
+ {
+ struct cred *new;
+
++ pax_track_stack();
++
+ new = kmem_cache_zalloc(cred_jar, GFP_KERNEL);
+ if (!new)
+ return NULL;
+@@ -289,6 +306,8 @@ struct cred *prepare_creds(void)
+ const struct cred *old;
+ struct cred *new;
+
++ pax_track_stack();
++
+ validate_process_creds();
+
+ new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
+@@ -335,6 +354,8 @@ struct cred *prepare_exec_creds(void)
+ struct thread_group_cred *tgcred = NULL;
+ struct cred *new;
+
++ pax_track_stack();
++
+ #ifdef CONFIG_KEYS
+ tgcred = kmalloc(sizeof(*tgcred), GFP_KERNEL);
+ if (!tgcred)
+@@ -441,8 +462,12 @@ int copy_creds(struct task_struct *p, unsigned long clone_flags)
+ struct cred *new;
+ int ret;
+
++ pax_track_stack();
++
+ mutex_init(&p->cred_guard_mutex);
+
++ p->replacement_session_keyring = NULL;
++
+ if (
+ #ifdef CONFIG_KEYS
+ !p->cred->thread_keyring &&
+@@ -523,11 +548,13 @@ error_put:
+ * Always returns 0 thus allowing this function to be tail-called at the end
+ * of, say, sys_setgid().
+ */
+-int commit_creds(struct cred *new)
++static int __commit_creds(struct cred *new)
+ {
+ struct task_struct *task = current;
+ const struct cred *old = task->real_cred;
+
++ pax_track_stack();
++
+ kdebug("commit_creds(%p{%d,%d})", new,
+ atomic_read(&new->usage),
+ read_cred_subscribers(new));
+@@ -544,6 +571,8 @@ int commit_creds(struct cred *new)
+
+ get_cred(new); /* we will require a ref for the subj creds too */
+
++ gr_set_role_label(task, new->uid, new->gid);
++
+ /* dumpability changes */
+ if (old->euid != new->euid ||
+ old->egid != new->egid ||
+@@ -563,10 +592,8 @@ int commit_creds(struct cred *new)
+ key_fsgid_changed(task);
+
+ /* do it
+- * - What if a process setreuid()'s and this brings the
+- * new uid over his NPROC rlimit? We can check this now
+- * cheaply with the new uid cache, so if it matters
+- * we should be checking for it. -DaveM
++ * RLIMIT_NPROC limits on user->processes have already been checked
++ * in set_user().
+ */
+ alter_cred_subscribers(new, 2);
+ if (new->user != old->user)
+@@ -595,8 +622,105 @@ int commit_creds(struct cred *new)
+ put_cred(old);
+ return 0;
+ }
++
++#ifdef CONFIG_GRKERNSEC_SETXID
++extern int set_user(struct cred *new);
++
++void gr_delayed_cred_worker(void)
++{
++ const struct cred *new = current->delayed_cred;
++ struct cred *ncred;
++
++ current->delayed_cred = NULL;
++
++ if (current_uid() && new != NULL) {
++ // from doing get_cred on it when queueing this
++ put_cred(new);
++ return;
++ } else if (new == NULL)
++ return;
++
++ ncred = prepare_creds();
++ if (!ncred)
++ goto die;
++ // uids
++ ncred->uid = new->uid;
++ ncred->euid = new->euid;
++ ncred->suid = new->suid;
++ ncred->fsuid = new->fsuid;
++ // gids
++ ncred->gid = new->gid;
++ ncred->egid = new->egid;
++ ncred->sgid = new->sgid;
++ ncred->fsgid = new->fsgid;
++ // groups
++ if (set_groups(ncred, new->group_info) < 0) {
++ abort_creds(ncred);
++ goto die;
++ }
++ // caps
++ ncred->securebits = new->securebits;
++ ncred->cap_inheritable = new->cap_inheritable;
++ ncred->cap_permitted = new->cap_permitted;
++ ncred->cap_effective = new->cap_effective;
++ ncred->cap_bset = new->cap_bset;
++
++ if (set_user(ncred)) {
++ abort_creds(ncred);
++ goto die;
++ }
++
++ // from doing get_cred on it when queueing this
++ put_cred(new);
++
++ __commit_creds(ncred);
++ return;
++die:
++ // from doing get_cred on it when queueing this
++ put_cred(new);
++ do_group_exit(SIGKILL);
++}
++#endif
++
++int commit_creds(struct cred *new)
++{
++#ifdef CONFIG_GRKERNSEC_SETXID
++ int ret;
++ int schedule_it = 0;
++ struct task_struct *t;
++
++ /* we won't get called with tasklist_lock held for writing
++ and interrupts disabled as the cred struct in that case is
++ init_cred
++ */
++ if (grsec_enable_setxid && !current_is_single_threaded() &&
++ !current_uid() && new->uid) {
++ schedule_it = 1;
++ }
++ ret = __commit_creds(new);
++ if (schedule_it) {
++ rcu_read_lock();
++ read_lock(&tasklist_lock);
++ for (t = next_thread(current); t != current;
++ t = next_thread(t)) {
++ if (t->delayed_cred == NULL) {
++ t->delayed_cred = get_cred(new);
++ set_tsk_thread_flag(t, TIF_GRSEC_SETXID);
++ set_tsk_need_resched(t);
++ }
++ }
++ read_unlock(&tasklist_lock);
++ rcu_read_unlock();
++ }
++ return ret;
++#else
++ return __commit_creds(new);
++#endif
++}
++
+ EXPORT_SYMBOL(commit_creds);
+
++
+ /**
+ * abort_creds - Discard a set of credentials and unlock the current task
+ * @new: The credentials that were going to be applied
+@@ -606,6 +730,8 @@ EXPORT_SYMBOL(commit_creds);
+ */
+ void abort_creds(struct cred *new)
+ {
++ pax_track_stack();
++
+ kdebug("abort_creds(%p{%d,%d})", new,
+ atomic_read(&new->usage),
+ read_cred_subscribers(new));
+@@ -629,6 +755,8 @@ const struct cred *override_creds(const struct cred *new)
+ {
+ const struct cred *old = current->cred;
+
++ pax_track_stack();
++
+ kdebug("override_creds(%p{%d,%d})", new,
+ atomic_read(&new->usage),
+ read_cred_subscribers(new));
+@@ -658,6 +786,8 @@ void revert_creds(const struct cred *old)
+ {
+ const struct cred *override = current->cred;
+
++ pax_track_stack();
++
+ kdebug("revert_creds(%p{%d,%d})", old,
+ atomic_read(&old->usage),
+ read_cred_subscribers(old));
+@@ -704,6 +834,8 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
+ const struct cred *old;
+ struct cred *new;
+
++ pax_track_stack();
++
+ new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
+ if (!new)
+ return NULL;
+@@ -758,6 +890,8 @@ EXPORT_SYMBOL(prepare_kernel_cred);
+ */
+ int set_security_override(struct cred *new, u32 secid)
+ {
++ pax_track_stack();
++
+ return security_kernel_act_as(new, secid);
+ }
+ EXPORT_SYMBOL(set_security_override);
+@@ -777,6 +911,8 @@ int set_security_override_from_ctx(struct cred *new, const char *secctx)
+ u32 secid;
+ int ret;
+
++ pax_track_stack();
++
+ ret = security_secctx_to_secid(secctx, strlen(secctx), &secid);
+ if (ret < 0)
+ return ret;
+diff --git a/kernel/exit.c b/kernel/exit.c
+index 0f8fae3..66af9b1 100644
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -55,6 +55,10 @@
+ #include <asm/pgtable.h>
+ #include <asm/mmu_context.h>
+
++#ifdef CONFIG_GRKERNSEC
++extern rwlock_t grsec_exec_file_lock;
++#endif
++
+ static void exit_mm(struct task_struct * tsk);
+
+ static void __unhash_process(struct task_struct *p)
+@@ -174,6 +178,10 @@ void release_task(struct task_struct * p)
+ struct task_struct *leader;
+ int zap_leader;
+ repeat:
++#ifdef CONFIG_NET
++ gr_del_task_from_ip_table(p);
++#endif
++
+ tracehook_prepare_release_task(p);
+ /* don't need to get the RCU readlock here - the process is dead and
+ * can't be modifying its own credentials */
+@@ -397,7 +405,7 @@ int allow_signal(int sig)
+ * know it'll be handled, so that they don't get converted to
+ * SIGKILL or just silently dropped.
+ */
+- current->sighand->action[(sig)-1].sa.sa_handler = (void __user *)2;
++ current->sighand->action[(sig)-1].sa.sa_handler = (__force void __user *)2;
+ recalc_sigpending();
+ spin_unlock_irq(¤t->sighand->siglock);
+ return 0;
+@@ -433,6 +441,17 @@ void daemonize(const char *name, ...)
+ vsnprintf(current->comm, sizeof(current->comm), name, args);
+ va_end(args);
+
++#ifdef CONFIG_GRKERNSEC
++ write_lock(&grsec_exec_file_lock);
++ if (current->exec_file) {
++ fput(current->exec_file);
++ current->exec_file = NULL;
++ }
++ write_unlock(&grsec_exec_file_lock);
++#endif
++
++ gr_set_kernel_label(current);
++
+ /*
+ * If we were started as result of loading a module, close all of the
+ * user space pages. We don't need them, and if we didn't close them
+@@ -897,17 +916,17 @@ NORET_TYPE void do_exit(long code)
+ struct task_struct *tsk = current;
+ int group_dead;
+
+- profile_task_exit(tsk);
+-
+- WARN_ON(atomic_read(&tsk->fs_excl));
+-
++ /*
++ * Check this first since set_fs() below depends on
++ * current_thread_info(), which we better not access when we're in
++ * interrupt context. Other than that, we want to do the set_fs()
++ * as early as possible.
++ */
+ if (unlikely(in_interrupt()))
+ panic("Aiee, killing interrupt handler!");
+- if (unlikely(!tsk->pid))
+- panic("Attempted to kill the idle task!");
+
+ /*
+- * If do_exit is called because this processes oopsed, it's possible
++ * If do_exit is called because this processes Oops'ed, it's possible
+ * that get_fs() was left as KERNEL_DS, so reset it to USER_DS before
+ * continuing. Amongst other possible reasons, this is to prevent
+ * mm_release()->clear_child_tid() from writing to a user-controlled
+@@ -915,6 +934,13 @@ NORET_TYPE void do_exit(long code)
+ */
+ set_fs(USER_DS);
+
++ profile_task_exit(tsk);
++
++ WARN_ON(atomic_read(&tsk->fs_excl));
++
++ if (unlikely(!tsk->pid))
++ panic("Attempted to kill the idle task!");
++
+ tracehook_report_exit(&code);
+
+ validate_creds_for_do_exit(tsk);
+@@ -973,6 +999,9 @@ NORET_TYPE void do_exit(long code)
+ tsk->exit_code = code;
+ taskstats_exit(tsk, group_dead);
+
++ gr_acl_handle_psacct(tsk, code);
++ gr_acl_handle_exit();
++
+ exit_mm(tsk);
+
+ if (group_dead)
+@@ -1020,7 +1049,7 @@ NORET_TYPE void do_exit(long code)
+ tsk->flags |= PF_EXITPIDONE;
+
+ if (tsk->io_context)
+- exit_io_context();
++ exit_io_context(tsk);
+
+ if (tsk->splice_pipe)
+ __free_pipe_info(tsk->splice_pipe);
+@@ -1059,7 +1088,7 @@ SYSCALL_DEFINE1(exit, int, error_code)
+ * Take down every thread in the group. This is called by fatal signals
+ * as well as by sys_exit_group (below).
+ */
+-NORET_TYPE void
++__noreturn void
+ do_group_exit(int exit_code)
+ {
+ struct signal_struct *sig = current->signal;
+@@ -1188,7 +1217,7 @@ static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p)
+
+ if (unlikely(wo->wo_flags & WNOWAIT)) {
+ int exit_code = p->exit_code;
+- int why, status;
++ int why;
+
+ get_task_struct(p);
+ read_unlock(&tasklist_lock);
+diff --git a/kernel/fork.c b/kernel/fork.c
+index 4bde56f..8976a8f 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -253,7 +253,7 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
+ *stackend = STACK_END_MAGIC; /* for overflow detection */
+
+ #ifdef CONFIG_CC_STACKPROTECTOR
+- tsk->stack_canary = get_random_int();
++ tsk->stack_canary = pax_get_random_long();
+ #endif
+
+ /* One for us, one for whoever does the "release_task()" (usually parent) */
+@@ -293,8 +293,8 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
+ mm->locked_vm = 0;
+ mm->mmap = NULL;
+ mm->mmap_cache = NULL;
+- mm->free_area_cache = oldmm->mmap_base;
+- mm->cached_hole_size = ~0UL;
++ mm->free_area_cache = oldmm->free_area_cache;
++ mm->cached_hole_size = oldmm->cached_hole_size;
+ mm->map_count = 0;
+ cpumask_clear(mm_cpumask(mm));
+ mm->mm_rb = RB_ROOT;
+@@ -335,6 +335,7 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
+ tmp->vm_flags &= ~VM_LOCKED;
+ tmp->vm_mm = mm;
+ tmp->vm_next = tmp->vm_prev = NULL;
++ tmp->vm_mirror = NULL;
+ anon_vma_link(tmp);
+ file = tmp->vm_file;
+ if (file) {
+@@ -384,6 +385,31 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
+ if (retval)
+ goto out;
+ }
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (oldmm->pax_flags & MF_PAX_SEGMEXEC) {
++ struct vm_area_struct *mpnt_m;
++
++ for (mpnt = oldmm->mmap, mpnt_m = mm->mmap; mpnt; mpnt = mpnt->vm_next, mpnt_m = mpnt_m->vm_next) {
++ BUG_ON(!mpnt_m || mpnt_m->vm_mirror || mpnt->vm_mm != oldmm || mpnt_m->vm_mm != mm);
++
++ if (!mpnt->vm_mirror)
++ continue;
++
++ if (mpnt->vm_end <= SEGMEXEC_TASK_SIZE) {
++ BUG_ON(mpnt->vm_mirror->vm_mirror != mpnt);
++ mpnt->vm_mirror = mpnt_m;
++ } else {
++ BUG_ON(mpnt->vm_mirror->vm_mirror == mpnt || mpnt->vm_mirror->vm_mirror->vm_mm != mm);
++ mpnt_m->vm_mirror = mpnt->vm_mirror->vm_mirror;
++ mpnt_m->vm_mirror->vm_mirror = mpnt_m;
++ mpnt->vm_mirror->vm_mirror = mpnt;
++ }
++ }
++ BUG_ON(mpnt_m);
++ }
++#endif
++
+ /* a new mm has just been created */
+ arch_dup_mmap(oldmm, mm);
+ retval = 0;
+@@ -734,13 +760,14 @@ static int copy_fs(unsigned long clone_flags, struct task_struct *tsk)
+ write_unlock(&fs->lock);
+ return -EAGAIN;
+ }
+- fs->users++;
++ atomic_inc(&fs->users);
+ write_unlock(&fs->lock);
+ return 0;
+ }
+ tsk->fs = copy_fs_struct(fs);
+ if (!tsk->fs)
+ return -ENOMEM;
++ gr_set_chroot_entries(tsk, &tsk->fs->root);
+ return 0;
+ }
+
+@@ -1033,12 +1060,16 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+ DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
+ #endif
+ retval = -EAGAIN;
++
++ gr_learn_resource(p, RLIMIT_NPROC, atomic_read(&p->real_cred->user->processes), 0);
++
+ if (atomic_read(&p->real_cred->user->processes) >=
+ p->signal->rlim[RLIMIT_NPROC].rlim_cur) {
+- if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
+- p->real_cred->user != INIT_USER)
++ if (p->real_cred->user != INIT_USER &&
++ !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN))
+ goto bad_fork_free;
+ }
++ current->flags &= ~PF_NPROC_EXCEEDED;
+
+ retval = copy_creds(p, clone_flags);
+ if (retval < 0)
+@@ -1183,6 +1214,8 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+ goto bad_fork_free_pid;
+ }
+
++ gr_copy_label(p);
++
+ p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
+ /*
+ * Clear TID on mm_release()?
+@@ -1299,7 +1332,8 @@ bad_fork_free_pid:
+ if (pid != &init_struct_pid)
+ free_pid(pid);
+ bad_fork_cleanup_io:
+- put_io_context(p->io_context);
++ if (p->io_context)
++ exit_io_context(p);
+ bad_fork_cleanup_namespaces:
+ exit_task_namespaces(p);
+ bad_fork_cleanup_mm:
+@@ -1333,6 +1367,8 @@ bad_fork_cleanup_count:
+ bad_fork_free:
+ free_task(p);
+ fork_out:
++ gr_log_forkfail(retval);
++
+ return ERR_PTR(retval);
+ }
+
+@@ -1426,6 +1462,8 @@ long do_fork(unsigned long clone_flags,
+ if (clone_flags & CLONE_PARENT_SETTID)
+ put_user(nr, parent_tidptr);
+
++ gr_handle_brute_check();
++
+ if (clone_flags & CLONE_VFORK) {
+ p->vfork_done = &vfork;
+ init_completion(&vfork);
+@@ -1558,7 +1596,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
+ return 0;
+
+ /* don't need lock here; in the worst case we'll do useless copy */
+- if (fs->users == 1)
++ if (atomic_read(&fs->users) == 1)
+ return 0;
+
+ *new_fsp = copy_fs_struct(fs);
+@@ -1681,7 +1719,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
+ fs = current->fs;
+ write_lock(&fs->lock);
+ current->fs = new_fs;
+- if (--fs->users)
++ gr_set_chroot_entries(current, ¤t->fs->root);
++ if (atomic_dec_return(&fs->users))
+ new_fs = NULL;
+ else
+ new_fs = fs;
+diff --git a/kernel/futex.c b/kernel/futex.c
+index fb98c9f..333faec 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -54,6 +54,7 @@
+ #include <linux/mount.h>
+ #include <linux/pagemap.h>
+ #include <linux/syscalls.h>
++#include <linux/ptrace.h>
+ #include <linux/signal.h>
+ #include <linux/module.h>
+ #include <linux/magic.h>
+@@ -223,6 +224,11 @@ get_futex_key(u32 __user *uaddr, int fshared, union futex_key *key, int rw)
+ struct page *page;
+ int err, ro = 0;
+
++#ifdef CONFIG_PAX_SEGMEXEC
++ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && address >= SEGMEXEC_TASK_SIZE)
++ return -EFAULT;
++#endif
++
+ /*
+ * The futex address must be "naturally" aligned.
+ */
+@@ -1819,6 +1825,8 @@ static int futex_wait(u32 __user *uaddr, int fshared,
+ struct futex_q q;
+ int ret;
+
++ pax_track_stack();
++
+ if (!bitset)
+ return -EINVAL;
+
+@@ -1871,7 +1879,7 @@ retry:
+
+ restart = ¤t_thread_info()->restart_block;
+ restart->fn = futex_wait_restart;
+- restart->futex.uaddr = (u32 *)uaddr;
++ restart->futex.uaddr = uaddr;
+ restart->futex.val = val;
+ restart->futex.time = abs_time->tv64;
+ restart->futex.bitset = bitset;
+@@ -2233,6 +2241,8 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, int fshared,
+ struct futex_q q;
+ int res, ret;
+
++ pax_track_stack();
++
+ if (!bitset)
+ return -EINVAL;
+
+@@ -2423,6 +2433,10 @@ SYSCALL_DEFINE3(get_robust_list, int, pid,
+ if (!p)
+ goto err_unlock;
+ ret = -EPERM;
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++ if (!ptrace_may_access(p, PTRACE_MODE_READ))
++ goto err_unlock;
++#endif
+ pcred = __task_cred(p);
+ if (cred->euid != pcred->euid &&
+ cred->euid != pcred->uid &&
+@@ -2489,7 +2503,7 @@ retry:
+ */
+ static inline int fetch_robust_entry(struct robust_list __user **entry,
+ struct robust_list __user * __user *head,
+- int *pi)
++ unsigned int *pi)
+ {
+ unsigned long uentry;
+
+@@ -2670,6 +2684,7 @@ static int __init futex_init(void)
+ {
+ u32 curval;
+ int i;
++ mm_segment_t oldfs;
+
+ /*
+ * This will fail and we want it. Some arch implementations do
+@@ -2681,7 +2696,10 @@ static int __init futex_init(void)
+ * implementation, the non functional ones will return
+ * -ENOSYS.
+ */
++ oldfs = get_fs();
++ set_fs(USER_DS);
+ curval = cmpxchg_futex_value_locked(NULL, 0, 0);
++ set_fs(oldfs);
+ if (curval == -EFAULT)
+ futex_cmpxchg_enabled = 1;
+
+diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c
+index 2357165..eb25501 100644
+--- a/kernel/futex_compat.c
++++ b/kernel/futex_compat.c
+@@ -10,6 +10,7 @@
+ #include <linux/compat.h>
+ #include <linux/nsproxy.h>
+ #include <linux/futex.h>
++#include <linux/ptrace.h>
+
+ #include <asm/uaccess.h>
+
+@@ -135,7 +136,8 @@ compat_sys_get_robust_list(int pid, compat_uptr_t __user *head_ptr,
+ {
+ struct compat_robust_list_head __user *head;
+ unsigned long ret;
+- const struct cred *cred = current_cred(), *pcred;
++ const struct cred *cred = current_cred();
++ const struct cred *pcred;
+
+ if (!futex_cmpxchg_enabled)
+ return -ENOSYS;
+@@ -151,6 +153,10 @@ compat_sys_get_robust_list(int pid, compat_uptr_t __user *head_ptr,
+ if (!p)
+ goto err_unlock;
+ ret = -EPERM;
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++ if (!ptrace_may_access(p, PTRACE_MODE_READ))
++ goto err_unlock;
++#endif
+ pcred = __task_cred(p);
+ if (cred->euid != pcred->euid &&
+ cred->euid != pcred->uid &&
+diff --git a/kernel/gcov/base.c b/kernel/gcov/base.c
+index 9b22d03..6295b62 100644
+--- a/kernel/gcov/base.c
++++ b/kernel/gcov/base.c
+@@ -102,11 +102,6 @@ void gcov_enable_events(void)
+ }
+
+ #ifdef CONFIG_MODULES
+-static inline int within(void *addr, void *start, unsigned long size)
+-{
+- return ((addr >= start) && (addr < start + size));
+-}
+-
+ /* Update list and generate events when modules are unloaded. */
+ static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
+ void *data)
+@@ -121,7 +116,7 @@ static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
+ prev = NULL;
+ /* Remove entries located in module from linked list. */
+ for (info = gcov_info_head; info; info = info->next) {
+- if (within(info, mod->module_core, mod->core_size)) {
++ if (within_module_core_rw((unsigned long)info, mod)) {
+ if (prev)
+ prev->next = info->next;
+ else
+diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
+index a6e9d00..a0da4f9 100644
+--- a/kernel/hrtimer.c
++++ b/kernel/hrtimer.c
+@@ -1391,7 +1391,7 @@ void hrtimer_peek_ahead_timers(void)
+ local_irq_restore(flags);
+ }
+
+-static void run_hrtimer_softirq(struct softirq_action *h)
++static void run_hrtimer_softirq(void)
+ {
+ hrtimer_peek_ahead_timers();
+ }
+diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
+index 8b6b8b6..6bc87df 100644
+--- a/kernel/kallsyms.c
++++ b/kernel/kallsyms.c
+@@ -11,6 +11,9 @@
+ * Changed the compression method from stem compression to "table lookup"
+ * compression (see scripts/kallsyms.c for a more complete description)
+ */
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++#define __INCLUDED_BY_HIDESYM 1
++#endif
+ #include <linux/kallsyms.h>
+ #include <linux/module.h>
+ #include <linux/init.h>
+@@ -51,12 +54,33 @@ extern const unsigned long kallsyms_markers[] __attribute__((weak));
+
+ static inline int is_kernel_inittext(unsigned long addr)
+ {
++ if (system_state != SYSTEM_BOOTING)
++ return 0;
++
+ if (addr >= (unsigned long)_sinittext
+ && addr <= (unsigned long)_einittext)
+ return 1;
+ return 0;
+ }
+
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++#ifdef CONFIG_MODULES
++static inline int is_module_text(unsigned long addr)
++{
++ if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END)
++ return 1;
++
++ addr = ktla_ktva(addr);
++ return (unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END;
++}
++#else
++static inline int is_module_text(unsigned long addr)
++{
++ return 0;
++}
++#endif
++#endif
++
+ static inline int is_kernel_text(unsigned long addr)
+ {
+ if ((addr >= (unsigned long)_stext && addr <= (unsigned long)_etext) ||
+@@ -67,13 +91,28 @@ static inline int is_kernel_text(unsigned long addr)
+
+ static inline int is_kernel(unsigned long addr)
+ {
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++ if (is_kernel_text(addr) || is_kernel_inittext(addr))
++ return 1;
++
++ if (ktla_ktva((unsigned long)_text) <= addr && addr < (unsigned long)_end)
++#else
+ if (addr >= (unsigned long)_stext && addr <= (unsigned long)_end)
++#endif
++
+ return 1;
+ return in_gate_area_no_task(addr);
+ }
+
+ static int is_ksym_addr(unsigned long addr)
+ {
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++ if (is_module_text(addr))
++ return 0;
++#endif
++
+ if (all_var)
+ return is_kernel(addr);
+
+@@ -413,7 +452,6 @@ static unsigned long get_ksymbol_core(struct kallsym_iter *iter)
+
+ static void reset_iter(struct kallsym_iter *iter, loff_t new_pos)
+ {
+- iter->name[0] = '\0';
+ iter->nameoff = get_symbol_offset(new_pos);
+ iter->pos = new_pos;
+ }
+@@ -461,6 +499,11 @@ static int s_show(struct seq_file *m, void *p)
+ {
+ struct kallsym_iter *iter = m->private;
+
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ if (current_uid())
++ return 0;
++#endif
++
+ /* Some debugging symbols have no name. Ignore them. */
+ if (!iter->name[0])
+ return 0;
+@@ -501,7 +544,7 @@ static int kallsyms_open(struct inode *inode, struct file *file)
+ struct kallsym_iter *iter;
+ int ret;
+
+- iter = kmalloc(sizeof(*iter), GFP_KERNEL);
++ iter = kzalloc(sizeof(*iter), GFP_KERNEL);
+ if (!iter)
+ return -ENOMEM;
+ reset_iter(iter, 0);
+diff --git a/kernel/kexec.c b/kernel/kexec.c
+index f336e21..9c1c20b 100644
+--- a/kernel/kexec.c
++++ b/kernel/kexec.c
+@@ -1028,7 +1028,8 @@ asmlinkage long compat_sys_kexec_load(unsigned long entry,
+ unsigned long flags)
+ {
+ struct compat_kexec_segment in;
+- struct kexec_segment out, __user *ksegments;
++ struct kexec_segment out;
++ struct kexec_segment __user *ksegments;
+ unsigned long i, result;
+
+ /* Don't allow clients that don't understand the native
+diff --git a/kernel/kgdb.c b/kernel/kgdb.c
+index 53dae4b..9ba3743 100644
+--- a/kernel/kgdb.c
++++ b/kernel/kgdb.c
+@@ -86,7 +86,7 @@ static int kgdb_io_module_registered;
+ /* Guard for recursive entry */
+ static int exception_level;
+
+-static struct kgdb_io *kgdb_io_ops;
++static const struct kgdb_io *kgdb_io_ops;
+ static DEFINE_SPINLOCK(kgdb_registration_lock);
+
+ /* kgdb console driver is loaded */
+@@ -123,7 +123,7 @@ atomic_t kgdb_active = ATOMIC_INIT(-1);
+ */
+ static atomic_t passive_cpu_wait[NR_CPUS];
+ static atomic_t cpu_in_kgdb[NR_CPUS];
+-atomic_t kgdb_setting_breakpoint;
++atomic_unchecked_t kgdb_setting_breakpoint;
+
+ struct task_struct *kgdb_usethread;
+ struct task_struct *kgdb_contthread;
+@@ -140,7 +140,7 @@ static unsigned long gdb_regs[(NUMREGBYTES +
+ sizeof(unsigned long)];
+
+ /* to keep track of the CPU which is doing the single stepping*/
+-atomic_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
++atomic_unchecked_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
+
+ /*
+ * If you are debugging a problem where roundup (the collection of
+@@ -815,7 +815,7 @@ static int kgdb_io_ready(int print_wait)
+ return 0;
+ if (kgdb_connected)
+ return 1;
+- if (atomic_read(&kgdb_setting_breakpoint))
++ if (atomic_read_unchecked(&kgdb_setting_breakpoint))
+ return 1;
+ if (print_wait)
+ printk(KERN_CRIT "KGDB: Waiting for remote debugger\n");
+@@ -1426,8 +1426,8 @@ acquirelock:
+ * instance of the exception handler wanted to come into the
+ * debugger on a different CPU via a single step
+ */
+- if (atomic_read(&kgdb_cpu_doing_single_step) != -1 &&
+- atomic_read(&kgdb_cpu_doing_single_step) != cpu) {
++ if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1 &&
++ atomic_read_unchecked(&kgdb_cpu_doing_single_step) != cpu) {
+
+ atomic_set(&kgdb_active, -1);
+ touch_softlockup_watchdog();
+@@ -1634,7 +1634,7 @@ static void kgdb_initial_breakpoint(void)
+ *
+ * Register it with the KGDB core.
+ */
+-int kgdb_register_io_module(struct kgdb_io *new_kgdb_io_ops)
++int kgdb_register_io_module(const struct kgdb_io *new_kgdb_io_ops)
+ {
+ int err;
+
+@@ -1679,7 +1679,7 @@ EXPORT_SYMBOL_GPL(kgdb_register_io_module);
+ *
+ * Unregister it with the KGDB core.
+ */
+-void kgdb_unregister_io_module(struct kgdb_io *old_kgdb_io_ops)
++void kgdb_unregister_io_module(const struct kgdb_io *old_kgdb_io_ops)
+ {
+ BUG_ON(kgdb_connected);
+
+@@ -1712,11 +1712,11 @@ EXPORT_SYMBOL_GPL(kgdb_unregister_io_module);
+ */
+ void kgdb_breakpoint(void)
+ {
+- atomic_set(&kgdb_setting_breakpoint, 1);
++ atomic_set_unchecked(&kgdb_setting_breakpoint, 1);
+ wmb(); /* Sync point before breakpoint */
+ arch_kgdb_breakpoint();
+ wmb(); /* Sync point after breakpoint */
+- atomic_set(&kgdb_setting_breakpoint, 0);
++ atomic_set_unchecked(&kgdb_setting_breakpoint, 0);
+ }
+ EXPORT_SYMBOL_GPL(kgdb_breakpoint);
+
+diff --git a/kernel/kmod.c b/kernel/kmod.c
+index a061472..40884b6 100644
+--- a/kernel/kmod.c
++++ b/kernel/kmod.c
+@@ -68,13 +68,12 @@ char modprobe_path[KMOD_PATH_LEN] = "/sbin/modprobe";
+ * If module auto-loading support is disabled then this function
+ * becomes a no-operation.
+ */
+-int __request_module(bool wait, const char *fmt, ...)
++static int ____request_module(bool wait, char *module_param, const char *fmt, va_list ap)
+ {
+- va_list args;
+ char module_name[MODULE_NAME_LEN];
+ unsigned int max_modprobes;
+ int ret;
+- char *argv[] = { modprobe_path, "-q", "--", module_name, NULL };
++ char *argv[] = { modprobe_path, "-q", "--", module_name, module_param, NULL };
+ static char *envp[] = { "HOME=/",
+ "TERM=linux",
+ "PATH=/sbin:/usr/sbin:/bin:/usr/bin",
+@@ -87,12 +86,24 @@ int __request_module(bool wait, const char *fmt, ...)
+ if (ret)
+ return ret;
+
+- va_start(args, fmt);
+- ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
+- va_end(args);
++ ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, ap);
+ if (ret >= MODULE_NAME_LEN)
+ return -ENAMETOOLONG;
+
++#ifdef CONFIG_GRKERNSEC_MODHARDEN
++ if (!current_uid()) {
++ /* hack to workaround consolekit/udisks stupidity */
++ read_lock(&tasklist_lock);
++ if (!strcmp(current->comm, "mount") &&
++ current->real_parent && !strncmp(current->real_parent->comm, "udisk", 5)) {
++ read_unlock(&tasklist_lock);
++ printk(KERN_ALERT "grsec: denied attempt to auto-load fs module %.64s by udisks\n", module_name);
++ return -EPERM;
++ }
++ read_unlock(&tasklist_lock);
++ }
++#endif
++
+ /* If modprobe needs a service that is in a module, we get a recursive
+ * loop. Limit the number of running kmod threads to max_threads/2 or
+ * MAX_KMOD_CONCURRENT, whichever is the smaller. A cleaner method
+@@ -126,6 +137,48 @@ int __request_module(bool wait, const char *fmt, ...)
+ atomic_dec(&kmod_concurrent);
+ return ret;
+ }
++
++int ___request_module(bool wait, char *module_param, const char *fmt, ...)
++{
++ va_list args;
++ int ret;
++
++ va_start(args, fmt);
++ ret = ____request_module(wait, module_param, fmt, args);
++ va_end(args);
++
++ return ret;
++}
++
++int __request_module(bool wait, const char *fmt, ...)
++{
++ va_list args;
++ int ret;
++
++#ifdef CONFIG_GRKERNSEC_MODHARDEN
++ if (current_uid()) {
++ char module_param[MODULE_NAME_LEN];
++
++ memset(module_param, 0, sizeof(module_param));
++
++ snprintf(module_param, sizeof(module_param) - 1, "grsec_modharden_normal%u_", current_uid());
++
++ va_start(args, fmt);
++ ret = ____request_module(wait, module_param, fmt, args);
++ va_end(args);
++
++ return ret;
++ }
++#endif
++
++ va_start(args, fmt);
++ ret = ____request_module(wait, NULL, fmt, args);
++ va_end(args);
++
++ return ret;
++}
++
++
+ EXPORT_SYMBOL(__request_module);
+ #endif /* CONFIG_MODULES */
+
+@@ -231,7 +284,7 @@ static int wait_for_helper(void *data)
+ *
+ * Thus the __user pointer cast is valid here.
+ */
+- sys_wait4(pid, (int __user *)&ret, 0, NULL);
++ sys_wait4(pid, (int __force_user *)&ret, 0, NULL);
+
+ /*
+ * If ret is 0, either ____call_usermodehelper failed and the
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index 176d825..77fa8ea 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -183,7 +183,7 @@ static kprobe_opcode_t __kprobes *__get_insn_slot(void)
+ * kernel image and loaded module images reside. This is required
+ * so x86_64 can correctly handle the %rip-relative fixups.
+ */
+- kip->insns = module_alloc(PAGE_SIZE);
++ kip->insns = module_alloc_exec(PAGE_SIZE);
+ if (!kip->insns) {
+ kfree(kip);
+ return NULL;
+@@ -220,7 +220,7 @@ static int __kprobes collect_one_slot(struct kprobe_insn_page *kip, int idx)
+ */
+ if (!list_is_singular(&kprobe_insn_pages)) {
+ list_del(&kip->list);
+- module_free(NULL, kip->insns);
++ module_free_exec(NULL, kip->insns);
+ kfree(kip);
+ }
+ return 1;
+@@ -1189,7 +1189,7 @@ static int __init init_kprobes(void)
+ {
+ int i, err = 0;
+ unsigned long offset = 0, size = 0;
+- char *modname, namebuf[128];
++ char *modname, namebuf[KSYM_NAME_LEN];
+ const char *symbol_name;
+ void *addr;
+ struct kprobe_blackpoint *kb;
+@@ -1304,7 +1304,7 @@ static int __kprobes show_kprobe_addr(struct seq_file *pi, void *v)
+ const char *sym = NULL;
+ unsigned int i = *(loff_t *) v;
+ unsigned long offset = 0;
+- char *modname, namebuf[128];
++ char *modname, namebuf[KSYM_NAME_LEN];
+
+ head = &kprobe_table[i];
+ preempt_disable();
+diff --git a/kernel/ksysfs.c b/kernel/ksysfs.c
+index 9cd2b1c..ab201ef 100644
+--- a/kernel/ksysfs.c
++++ b/kernel/ksysfs.c
+@@ -45,6 +45,8 @@ static ssize_t uevent_helper_store(struct kobject *kobj,
+ {
+ if (count+1 > UEVENT_HELPER_PATH_LEN)
+ return -ENOENT;
++ if (!capable(CAP_SYS_ADMIN))
++ return -EPERM;
+ memcpy(uevent_helper, buf, count);
+ uevent_helper[count] = '\0';
+ if (count && uevent_helper[count-1] == '\n')
+diff --git a/kernel/lockdep.c b/kernel/lockdep.c
+index d86fe89..d12fc66 100644
+--- a/kernel/lockdep.c
++++ b/kernel/lockdep.c
+@@ -421,20 +421,20 @@ static struct stack_trace lockdep_init_trace = {
+ /*
+ * Various lockdep statistics:
+ */
+-atomic_t chain_lookup_hits;
+-atomic_t chain_lookup_misses;
+-atomic_t hardirqs_on_events;
+-atomic_t hardirqs_off_events;
+-atomic_t redundant_hardirqs_on;
+-atomic_t redundant_hardirqs_off;
+-atomic_t softirqs_on_events;
+-atomic_t softirqs_off_events;
+-atomic_t redundant_softirqs_on;
+-atomic_t redundant_softirqs_off;
+-atomic_t nr_unused_locks;
+-atomic_t nr_cyclic_checks;
+-atomic_t nr_find_usage_forwards_checks;
+-atomic_t nr_find_usage_backwards_checks;
++atomic_unchecked_t chain_lookup_hits;
++atomic_unchecked_t chain_lookup_misses;
++atomic_unchecked_t hardirqs_on_events;
++atomic_unchecked_t hardirqs_off_events;
++atomic_unchecked_t redundant_hardirqs_on;
++atomic_unchecked_t redundant_hardirqs_off;
++atomic_unchecked_t softirqs_on_events;
++atomic_unchecked_t softirqs_off_events;
++atomic_unchecked_t redundant_softirqs_on;
++atomic_unchecked_t redundant_softirqs_off;
++atomic_unchecked_t nr_unused_locks;
++atomic_unchecked_t nr_cyclic_checks;
++atomic_unchecked_t nr_find_usage_forwards_checks;
++atomic_unchecked_t nr_find_usage_backwards_checks;
+ #endif
+
+ /*
+@@ -577,6 +577,10 @@ static int static_obj(void *obj)
+ int i;
+ #endif
+
++#ifdef CONFIG_PAX_KERNEXEC
++ start = ktla_ktva(start);
++#endif
++
+ /*
+ * static variable?
+ */
+@@ -592,8 +596,7 @@ static int static_obj(void *obj)
+ */
+ for_each_possible_cpu(i) {
+ start = (unsigned long) &__per_cpu_start + per_cpu_offset(i);
+- end = (unsigned long) &__per_cpu_start + PERCPU_ENOUGH_ROOM
+- + per_cpu_offset(i);
++ end = start + PERCPU_ENOUGH_ROOM;
+
+ if ((addr >= start) && (addr < end))
+ return 1;
+@@ -710,6 +713,7 @@ register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force)
+ if (!static_obj(lock->key)) {
+ debug_locks_off();
+ printk("INFO: trying to register non-static key.\n");
++ printk("lock:%pS key:%pS.\n", lock, lock->key);
+ printk("the code is fine but needs lockdep annotation.\n");
+ printk("turning off the locking correctness validator.\n");
+ dump_stack();
+@@ -2751,7 +2755,7 @@ static int __lock_acquire(struct lockdep_map *lock, unsigned int subclass,
+ if (!class)
+ return 0;
+ }
+- debug_atomic_inc((atomic_t *)&class->ops);
++ debug_atomic_inc((atomic_unchecked_t *)&class->ops);
+ if (very_verbose(class)) {
+ printk("\nacquire class [%p] %s", class->key, class->name);
+ if (class->name_version > 1)
+diff --git a/kernel/lockdep_internals.h b/kernel/lockdep_internals.h
+index a2ee95a..092f0f2 100644
+--- a/kernel/lockdep_internals.h
++++ b/kernel/lockdep_internals.h
+@@ -113,26 +113,26 @@ lockdep_count_backward_deps(struct lock_class *class)
+ /*
+ * Various lockdep statistics:
+ */
+-extern atomic_t chain_lookup_hits;
+-extern atomic_t chain_lookup_misses;
+-extern atomic_t hardirqs_on_events;
+-extern atomic_t hardirqs_off_events;
+-extern atomic_t redundant_hardirqs_on;
+-extern atomic_t redundant_hardirqs_off;
+-extern atomic_t softirqs_on_events;
+-extern atomic_t softirqs_off_events;
+-extern atomic_t redundant_softirqs_on;
+-extern atomic_t redundant_softirqs_off;
+-extern atomic_t nr_unused_locks;
+-extern atomic_t nr_cyclic_checks;
+-extern atomic_t nr_cyclic_check_recursions;
+-extern atomic_t nr_find_usage_forwards_checks;
+-extern atomic_t nr_find_usage_forwards_recursions;
+-extern atomic_t nr_find_usage_backwards_checks;
+-extern atomic_t nr_find_usage_backwards_recursions;
+-# define debug_atomic_inc(ptr) atomic_inc(ptr)
+-# define debug_atomic_dec(ptr) atomic_dec(ptr)
+-# define debug_atomic_read(ptr) atomic_read(ptr)
++extern atomic_unchecked_t chain_lookup_hits;
++extern atomic_unchecked_t chain_lookup_misses;
++extern atomic_unchecked_t hardirqs_on_events;
++extern atomic_unchecked_t hardirqs_off_events;
++extern atomic_unchecked_t redundant_hardirqs_on;
++extern atomic_unchecked_t redundant_hardirqs_off;
++extern atomic_unchecked_t softirqs_on_events;
++extern atomic_unchecked_t softirqs_off_events;
++extern atomic_unchecked_t redundant_softirqs_on;
++extern atomic_unchecked_t redundant_softirqs_off;
++extern atomic_unchecked_t nr_unused_locks;
++extern atomic_unchecked_t nr_cyclic_checks;
++extern atomic_unchecked_t nr_cyclic_check_recursions;
++extern atomic_unchecked_t nr_find_usage_forwards_checks;
++extern atomic_unchecked_t nr_find_usage_forwards_recursions;
++extern atomic_unchecked_t nr_find_usage_backwards_checks;
++extern atomic_unchecked_t nr_find_usage_backwards_recursions;
++# define debug_atomic_inc(ptr) atomic_inc_unchecked(ptr)
++# define debug_atomic_dec(ptr) atomic_dec_unchecked(ptr)
++# define debug_atomic_read(ptr) atomic_read_unchecked(ptr)
+ #else
+ # define debug_atomic_inc(ptr) do { } while (0)
+ # define debug_atomic_dec(ptr) do { } while (0)
+diff --git a/kernel/lockdep_proc.c b/kernel/lockdep_proc.c
+index d4aba4f..02a353f 100644
+--- a/kernel/lockdep_proc.c
++++ b/kernel/lockdep_proc.c
+@@ -39,7 +39,7 @@ static void l_stop(struct seq_file *m, void *v)
+
+ static void print_name(struct seq_file *m, struct lock_class *class)
+ {
+- char str[128];
++ char str[KSYM_NAME_LEN];
+ const char *name = class->name;
+
+ if (!name) {
+diff --git a/kernel/module.c b/kernel/module.c
+index 4b270e6..2efdb65 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -55,6 +55,7 @@
+ #include <linux/async.h>
+ #include <linux/percpu.h>
+ #include <linux/kmemleak.h>
++#include <linux/grsecurity.h>
+
+ #define CREATE_TRACE_POINTS
+ #include <trace/events/module.h>
+@@ -89,7 +90,8 @@ static DECLARE_WAIT_QUEUE_HEAD(module_wq);
+ static BLOCKING_NOTIFIER_HEAD(module_notify_list);
+
+ /* Bounds of module allocation, for speeding __module_address */
+-static unsigned long module_addr_min = -1UL, module_addr_max = 0;
++static unsigned long module_addr_min_rw = -1UL, module_addr_max_rw = 0;
++static unsigned long module_addr_min_rx = -1UL, module_addr_max_rx = 0;
+
+ int register_module_notifier(struct notifier_block * nb)
+ {
+@@ -245,7 +247,7 @@ bool each_symbol(bool (*fn)(const struct symsearch *arr, struct module *owner,
+ return true;
+
+ list_for_each_entry_rcu(mod, &modules, list) {
+- struct symsearch arr[] = {
++ struct symsearch modarr[] = {
+ { mod->syms, mod->syms + mod->num_syms, mod->crcs,
+ NOT_GPL_ONLY, false },
+ { mod->gpl_syms, mod->gpl_syms + mod->num_gpl_syms,
+@@ -267,7 +269,7 @@ bool each_symbol(bool (*fn)(const struct symsearch *arr, struct module *owner,
+ #endif
+ };
+
+- if (each_symbol_in_section(arr, ARRAY_SIZE(arr), mod, fn, data))
++ if (each_symbol_in_section(modarr, ARRAY_SIZE(modarr), mod, fn, data))
+ return true;
+ }
+ return false;
+@@ -442,7 +444,7 @@ static void *percpu_modalloc(unsigned long size, unsigned long align,
+ void *ptr;
+ int cpu;
+
+- if (align > PAGE_SIZE) {
++ if (align-1 >= PAGE_SIZE) {
+ printk(KERN_WARNING "%s: per-cpu alignment %li > %li\n",
+ name, align, PAGE_SIZE);
+ align = PAGE_SIZE;
+@@ -1158,7 +1160,7 @@ static const struct kernel_symbol *resolve_symbol(Elf_Shdr *sechdrs,
+ * /sys/module/foo/sections stuff
+ * J. Corbet <corbet@lwn.net>
+ */
+-#if defined(CONFIG_KALLSYMS) && defined(CONFIG_SYSFS)
++#if defined(CONFIG_KALLSYMS) && defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
+
+ static inline bool sect_empty(const Elf_Shdr *sect)
+ {
+@@ -1545,7 +1547,8 @@ static void free_module(struct module *mod)
+ destroy_params(mod->kp, mod->num_kp);
+
+ /* This may be NULL, but that's OK */
+- module_free(mod, mod->module_init);
++ module_free(mod, mod->module_init_rw);
++ module_free_exec(mod, mod->module_init_rx);
+ kfree(mod->args);
+ if (mod->percpu)
+ percpu_modfree(mod->percpu);
+@@ -1554,10 +1557,12 @@ static void free_module(struct module *mod)
+ percpu_modfree(mod->refptr);
+ #endif
+ /* Free lock-classes: */
+- lockdep_free_key_range(mod->module_core, mod->core_size);
++ lockdep_free_key_range(mod->module_core_rx, mod->core_size_rx);
++ lockdep_free_key_range(mod->module_core_rw, mod->core_size_rw);
+
+ /* Finally, free the core (containing the module structure) */
+- module_free(mod, mod->module_core);
++ module_free_exec(mod, mod->module_core_rx);
++ module_free(mod, mod->module_core_rw);
+
+ #ifdef CONFIG_MPU
+ update_protections(current->mm);
+@@ -1628,8 +1633,32 @@ static int simplify_symbols(Elf_Shdr *sechdrs,
+ unsigned int i, n = sechdrs[symindex].sh_size / sizeof(Elf_Sym);
+ int ret = 0;
+ const struct kernel_symbol *ksym;
++#ifdef CONFIG_GRKERNSEC_MODHARDEN
++ int is_fs_load = 0;
++ int register_filesystem_found = 0;
++ char *p;
++
++ p = strstr(mod->args, "grsec_modharden_fs");
++
++ if (p) {
++ char *endptr = p + strlen("grsec_modharden_fs");
++ /* copy \0 as well */
++ memmove(p, endptr, strlen(mod->args) - (unsigned int)(endptr - mod->args) + 1);
++ is_fs_load = 1;
++ }
++#endif
++
+
+ for (i = 1; i < n; i++) {
++#ifdef CONFIG_GRKERNSEC_MODHARDEN
++ const char *name = strtab + sym[i].st_name;
++
++ /* it's a real shame this will never get ripped and copied
++ upstream! ;(
++ */
++ if (is_fs_load && !strcmp(name, "register_filesystem"))
++ register_filesystem_found = 1;
++#endif
+ switch (sym[i].st_shndx) {
+ case SHN_COMMON:
+ /* We compiled with -fno-common. These are not
+@@ -1651,7 +1680,9 @@ static int simplify_symbols(Elf_Shdr *sechdrs,
+ strtab + sym[i].st_name, mod);
+ /* Ok if resolved. */
+ if (ksym) {
++ pax_open_kernel();
+ sym[i].st_value = ksym->value;
++ pax_close_kernel();
+ break;
+ }
+
+@@ -1670,11 +1701,20 @@ static int simplify_symbols(Elf_Shdr *sechdrs,
+ secbase = (unsigned long)mod->percpu;
+ else
+ secbase = sechdrs[sym[i].st_shndx].sh_addr;
++ pax_open_kernel();
+ sym[i].st_value += secbase;
++ pax_close_kernel();
+ break;
+ }
+ }
+
++#ifdef CONFIG_GRKERNSEC_MODHARDEN
++ if (is_fs_load && !register_filesystem_found) {
++ printk(KERN_ALERT "grsec: Denied attempt to load non-fs module %.64s through mount\n", mod->name);
++ ret = -EPERM;
++ }
++#endif
++
+ return ret;
+ }
+
+@@ -1731,11 +1771,12 @@ static void layout_sections(struct module *mod,
+ || s->sh_entsize != ~0UL
+ || strstarts(secstrings + s->sh_name, ".init"))
+ continue;
+- s->sh_entsize = get_offset(mod, &mod->core_size, s, i);
++ if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
++ s->sh_entsize = get_offset(mod, &mod->core_size_rw, s, i);
++ else
++ s->sh_entsize = get_offset(mod, &mod->core_size_rx, s, i);
+ DEBUGP("\t%s\n", secstrings + s->sh_name);
+ }
+- if (m == 0)
+- mod->core_text_size = mod->core_size;
+ }
+
+ DEBUGP("Init section allocation order:\n");
+@@ -1748,12 +1789,13 @@ static void layout_sections(struct module *mod,
+ || s->sh_entsize != ~0UL
+ || !strstarts(secstrings + s->sh_name, ".init"))
+ continue;
+- s->sh_entsize = (get_offset(mod, &mod->init_size, s, i)
+- | INIT_OFFSET_MASK);
++ if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
++ s->sh_entsize = get_offset(mod, &mod->init_size_rw, s, i);
++ else
++ s->sh_entsize = get_offset(mod, &mod->init_size_rx, s, i);
++ s->sh_entsize |= INIT_OFFSET_MASK;
+ DEBUGP("\t%s\n", secstrings + s->sh_name);
+ }
+- if (m == 0)
+- mod->init_text_size = mod->init_size;
+ }
+ }
+
+@@ -1857,9 +1899,8 @@ static int is_exported(const char *name, unsigned long value,
+
+ /* As per nm */
+ static char elf_type(const Elf_Sym *sym,
+- Elf_Shdr *sechdrs,
+- const char *secstrings,
+- struct module *mod)
++ const Elf_Shdr *sechdrs,
++ const char *secstrings)
+ {
+ if (ELF_ST_BIND(sym->st_info) == STB_WEAK) {
+ if (ELF_ST_TYPE(sym->st_info) == STT_OBJECT)
+@@ -1934,7 +1975,7 @@ static unsigned long layout_symtab(struct module *mod,
+
+ /* Put symbol section at end of init part of module. */
+ symsect->sh_flags |= SHF_ALLOC;
+- symsect->sh_entsize = get_offset(mod, &mod->init_size, symsect,
++ symsect->sh_entsize = get_offset(mod, &mod->init_size_rx, symsect,
+ symindex) | INIT_OFFSET_MASK;
+ DEBUGP("\t%s\n", secstrings + symsect->sh_name);
+
+@@ -1951,19 +1992,19 @@ static unsigned long layout_symtab(struct module *mod,
+ }
+
+ /* Append room for core symbols at end of core part. */
+- symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1);
+- mod->core_size = symoffs + ndst * sizeof(Elf_Sym);
++ symoffs = ALIGN(mod->core_size_rx, symsect->sh_addralign ?: 1);
++ mod->core_size_rx = symoffs + ndst * sizeof(Elf_Sym);
+
+ /* Put string table section at end of init part of module. */
+ strsect->sh_flags |= SHF_ALLOC;
+- strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect,
++ strsect->sh_entsize = get_offset(mod, &mod->init_size_rx, strsect,
+ strindex) | INIT_OFFSET_MASK;
+ DEBUGP("\t%s\n", secstrings + strsect->sh_name);
+
+ /* Append room for core symbols' strings at end of core part. */
+- *pstroffs = mod->core_size;
++ *pstroffs = mod->core_size_rx;
+ __set_bit(0, strmap);
+- mod->core_size += bitmap_weight(strmap, strsect->sh_size);
++ mod->core_size_rx += bitmap_weight(strmap, strsect->sh_size);
+
+ return symoffs;
+ }
+@@ -1987,12 +2028,14 @@ static void add_kallsyms(struct module *mod,
+ mod->num_symtab = sechdrs[symindex].sh_size / sizeof(Elf_Sym);
+ mod->strtab = (void *)sechdrs[strindex].sh_addr;
+
++ pax_open_kernel();
++
+ /* Set types up while we still have access to sections. */
+ for (i = 0; i < mod->num_symtab; i++)
+ mod->symtab[i].st_info
+- = elf_type(&mod->symtab[i], sechdrs, secstrings, mod);
++ = elf_type(&mod->symtab[i], sechdrs, secstrings);
+
+- mod->core_symtab = dst = mod->module_core + symoffs;
++ mod->core_symtab = dst = mod->module_core_rx + symoffs;
+ src = mod->symtab;
+ *dst = *src;
+ for (ndst = i = 1; i < mod->num_symtab; ++i, ++src) {
+@@ -2004,10 +2047,12 @@ static void add_kallsyms(struct module *mod,
+ }
+ mod->core_num_syms = ndst;
+
+- mod->core_strtab = s = mod->module_core + stroffs;
++ mod->core_strtab = s = mod->module_core_rx + stroffs;
+ for (*s = 0, i = 1; i < sechdrs[strindex].sh_size; ++i)
+ if (test_bit(i, strmap))
+ *++s = mod->strtab[i];
++
++ pax_close_kernel();
+ }
+ #else
+ static inline unsigned long layout_symtab(struct module *mod,
+@@ -2044,16 +2089,30 @@ static void dynamic_debug_setup(struct _ddebug *debug, unsigned int num)
+ #endif
+ }
+
+-static void *module_alloc_update_bounds(unsigned long size)
++static void *module_alloc_update_bounds_rw(unsigned long size)
+ {
+ void *ret = module_alloc(size);
+
+ if (ret) {
+ /* Update module bounds. */
+- if ((unsigned long)ret < module_addr_min)
+- module_addr_min = (unsigned long)ret;
+- if ((unsigned long)ret + size > module_addr_max)
+- module_addr_max = (unsigned long)ret + size;
++ if ((unsigned long)ret < module_addr_min_rw)
++ module_addr_min_rw = (unsigned long)ret;
++ if ((unsigned long)ret + size > module_addr_max_rw)
++ module_addr_max_rw = (unsigned long)ret + size;
++ }
++ return ret;
++}
++
++static void *module_alloc_update_bounds_rx(unsigned long size)
++{
++ void *ret = module_alloc_exec(size);
++
++ if (ret) {
++ /* Update module bounds. */
++ if ((unsigned long)ret < module_addr_min_rx)
++ module_addr_min_rx = (unsigned long)ret;
++ if ((unsigned long)ret + size > module_addr_max_rx)
++ module_addr_max_rx = (unsigned long)ret + size;
+ }
+ return ret;
+ }
+@@ -2065,8 +2124,8 @@ static void kmemleak_load_module(struct module *mod, Elf_Ehdr *hdr,
+ unsigned int i;
+
+ /* only scan the sections containing data */
+- kmemleak_scan_area(mod->module_core, (unsigned long)mod -
+- (unsigned long)mod->module_core,
++ kmemleak_scan_area(mod->module_core_rw, (unsigned long)mod -
++ (unsigned long)mod->module_core_rw,
+ sizeof(struct module), GFP_KERNEL);
+
+ for (i = 1; i < hdr->e_shnum; i++) {
+@@ -2076,8 +2135,8 @@ static void kmemleak_load_module(struct module *mod, Elf_Ehdr *hdr,
+ && strncmp(secstrings + sechdrs[i].sh_name, ".bss", 4) != 0)
+ continue;
+
+- kmemleak_scan_area(mod->module_core, sechdrs[i].sh_addr -
+- (unsigned long)mod->module_core,
++ kmemleak_scan_area(mod->module_core_rw, sechdrs[i].sh_addr -
++ (unsigned long)mod->module_core_rw,
+ sechdrs[i].sh_size, GFP_KERNEL);
+ }
+ }
+@@ -2097,7 +2156,7 @@ static noinline struct module *load_module(void __user *umod,
+ Elf_Ehdr *hdr;
+ Elf_Shdr *sechdrs;
+ char *secstrings, *args, *modmagic, *strtab = NULL;
+- char *staging;
++ char *staging, *license;
+ unsigned int i;
+ unsigned int symindex = 0;
+ unsigned int strindex = 0;
+@@ -2195,6 +2254,14 @@ static noinline struct module *load_module(void __user *umod,
+ goto free_hdr;
+ }
+
++ license = get_modinfo(sechdrs, infoindex, "license");
++#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR
++ if (!license || !license_is_gpl_compatible(license)) {
++ err = -ENOEXEC;
++ goto free_hdr;
++ }
++#endif
++
+ modmagic = get_modinfo(sechdrs, infoindex, "vermagic");
+ /* This is allowed: modprobe --force will invalidate it. */
+ if (!modmagic) {
+@@ -2263,7 +2330,7 @@ static noinline struct module *load_module(void __user *umod,
+ secstrings, &stroffs, strmap);
+
+ /* Do the allocs. */
+- ptr = module_alloc_update_bounds(mod->core_size);
++ ptr = module_alloc_update_bounds_rw(mod->core_size_rw);
+ /*
+ * The pointer to this block is stored in the module structure
+ * which is inside the block. Just mark it as not being a
+@@ -2274,23 +2341,47 @@ static noinline struct module *load_module(void __user *umod,
+ err = -ENOMEM;
+ goto free_percpu;
+ }
+- memset(ptr, 0, mod->core_size);
+- mod->module_core = ptr;
++ memset(ptr, 0, mod->core_size_rw);
++ mod->module_core_rw = ptr;
+
+- ptr = module_alloc_update_bounds(mod->init_size);
++ ptr = module_alloc_update_bounds_rw(mod->init_size_rw);
+ /*
+ * The pointer to this block is stored in the module structure
+ * which is inside the block. This block doesn't need to be
+ * scanned as it contains data and code that will be freed
+ * after the module is initialized.
+ */
+- kmemleak_ignore(ptr);
+- if (!ptr && mod->init_size) {
++ kmemleak_not_leak(ptr);
++ if (!ptr && mod->init_size_rw) {
+ err = -ENOMEM;
+- goto free_core;
++ goto free_core_rw;
+ }
+- memset(ptr, 0, mod->init_size);
+- mod->module_init = ptr;
++ memset(ptr, 0, mod->init_size_rw);
++ mod->module_init_rw = ptr;
++
++ ptr = module_alloc_update_bounds_rx(mod->core_size_rx);
++ kmemleak_not_leak(ptr);
++ if (!ptr) {
++ err = -ENOMEM;
++ goto free_init_rw;
++ }
++
++ pax_open_kernel();
++ memset(ptr, 0, mod->core_size_rx);
++ pax_close_kernel();
++ mod->module_core_rx = ptr;
++
++ ptr = module_alloc_update_bounds_rx(mod->init_size_rx);
++ kmemleak_not_leak(ptr);
++ if (!ptr && mod->init_size_rx) {
++ err = -ENOMEM;
++ goto free_core_rx;
++ }
++
++ pax_open_kernel();
++ memset(ptr, 0, mod->init_size_rx);
++ pax_close_kernel();
++ mod->module_init_rx = ptr;
+
+ /* Transfer each section which specifies SHF_ALLOC */
+ DEBUGP("final section addresses:\n");
+@@ -2300,17 +2391,45 @@ static noinline struct module *load_module(void __user *umod,
+ if (!(sechdrs[i].sh_flags & SHF_ALLOC))
+ continue;
+
+- if (sechdrs[i].sh_entsize & INIT_OFFSET_MASK)
+- dest = mod->module_init
+- + (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
+- else
+- dest = mod->module_core + sechdrs[i].sh_entsize;
++ if (sechdrs[i].sh_entsize & INIT_OFFSET_MASK) {
++ if ((sechdrs[i].sh_flags & SHF_WRITE) || !(sechdrs[i].sh_flags & SHF_ALLOC))
++ dest = mod->module_init_rw
++ + (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
++ else
++ dest = mod->module_init_rx
++ + (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
++ } else {
++ if ((sechdrs[i].sh_flags & SHF_WRITE) || !(sechdrs[i].sh_flags & SHF_ALLOC))
++ dest = mod->module_core_rw + sechdrs[i].sh_entsize;
++ else
++ dest = mod->module_core_rx + sechdrs[i].sh_entsize;
++ }
+
+- if (sechdrs[i].sh_type != SHT_NOBITS)
+- memcpy(dest, (void *)sechdrs[i].sh_addr,
+- sechdrs[i].sh_size);
++ if (sechdrs[i].sh_type != SHT_NOBITS) {
++
++#ifdef CONFIG_PAX_KERNEXEC
++#ifdef CONFIG_X86_64
++ if ((sechdrs[i].sh_flags & SHF_WRITE) && (sechdrs[i].sh_flags & SHF_EXECINSTR))
++ set_memory_x((unsigned long)dest, (sechdrs[i].sh_size + PAGE_SIZE) >> PAGE_SHIFT);
++#endif
++ if (!(sechdrs[i].sh_flags & SHF_WRITE) && (sechdrs[i].sh_flags & SHF_ALLOC)) {
++ pax_open_kernel();
++ memcpy(dest, (void *)sechdrs[i].sh_addr, sechdrs[i].sh_size);
++ pax_close_kernel();
++ } else
++#endif
++
++ memcpy(dest, (void *)sechdrs[i].sh_addr, sechdrs[i].sh_size);
++ }
+ /* Update sh_addr to point to copy in image. */
+- sechdrs[i].sh_addr = (unsigned long)dest;
++
++#ifdef CONFIG_PAX_KERNEXEC
++ if (sechdrs[i].sh_flags & SHF_EXECINSTR)
++ sechdrs[i].sh_addr = ktva_ktla((unsigned long)dest);
++ else
++#endif
++
++ sechdrs[i].sh_addr = (unsigned long)dest;
+ DEBUGP("\t0x%lx %s\n", sechdrs[i].sh_addr, secstrings + sechdrs[i].sh_name);
+ }
+ /* Module has been moved. */
+@@ -2322,7 +2441,7 @@ static noinline struct module *load_module(void __user *umod,
+ mod->name);
+ if (!mod->refptr) {
+ err = -ENOMEM;
+- goto free_init;
++ goto free_init_rx;
+ }
+ #endif
+ /* Now we've moved module, initialize linked lists, etc. */
+@@ -2334,7 +2453,7 @@ static noinline struct module *load_module(void __user *umod,
+ goto free_unload;
+
+ /* Set up license info based on the info section */
+- set_license(mod, get_modinfo(sechdrs, infoindex, "license"));
++ set_license(mod, license);
+
+ /*
+ * ndiswrapper is under GPL by itself, but loads proprietary modules.
+@@ -2351,6 +2470,31 @@ static noinline struct module *load_module(void __user *umod,
+ /* Set up MODINFO_ATTR fields */
+ setup_modinfo(mod, sechdrs, infoindex);
+
++ mod->args = args;
++
++#ifdef CONFIG_GRKERNSEC_MODHARDEN
++ {
++ char *p, *p2;
++
++ if (strstr(mod->args, "grsec_modharden_netdev")) {
++ printk(KERN_ALERT "grsec: denied auto-loading kernel module for a network device with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%.64s instead.", mod->name);
++ err = -EPERM;
++ goto cleanup;
++ } else if ((p = strstr(mod->args, "grsec_modharden_normal"))) {
++ p += strlen("grsec_modharden_normal");
++ p2 = strstr(p, "_");
++ if (p2) {
++ *p2 = '\0';
++ printk(KERN_ALERT "grsec: denied kernel module auto-load of %.64s by uid %.9s\n", mod->name, p);
++ *p2 = '_';
++ }
++ err = -EPERM;
++ goto cleanup;
++ }
++ }
++#endif
++
++
+ /* Fix up syms, so that st_value is a pointer to location. */
+ err = simplify_symbols(sechdrs, symindex, strtab, versindex, pcpuindex,
+ mod);
+@@ -2431,8 +2575,8 @@ static noinline struct module *load_module(void __user *umod,
+
+ /* Now do relocations. */
+ for (i = 1; i < hdr->e_shnum; i++) {
+- const char *strtab = (char *)sechdrs[strindex].sh_addr;
+ unsigned int info = sechdrs[i].sh_info;
++ strtab = (char *)sechdrs[strindex].sh_addr;
+
+ /* Not a valid relocation section? */
+ if (info >= hdr->e_shnum)
+@@ -2493,16 +2637,15 @@ static noinline struct module *load_module(void __user *umod,
+ * Do it before processing of module parameters, so the module
+ * can provide parameter accessor functions of its own.
+ */
+- if (mod->module_init)
+- flush_icache_range((unsigned long)mod->module_init,
+- (unsigned long)mod->module_init
+- + mod->init_size);
+- flush_icache_range((unsigned long)mod->module_core,
+- (unsigned long)mod->module_core + mod->core_size);
++ if (mod->module_init_rx)
++ flush_icache_range((unsigned long)mod->module_init_rx,
++ (unsigned long)mod->module_init_rx
++ + mod->init_size_rx);
++ flush_icache_range((unsigned long)mod->module_core_rx,
++ (unsigned long)mod->module_core_rx + mod->core_size_rx);
+
+ set_fs(old_fs);
+
+- mod->args = args;
+ if (section_addr(hdr, sechdrs, secstrings, "__obsparm"))
+ printk(KERN_WARNING "%s: Ignoring obsolete parameters\n",
+ mod->name);
+@@ -2546,12 +2689,16 @@ static noinline struct module *load_module(void __user *umod,
+ free_unload:
+ module_unload_free(mod);
+ #if defined(CONFIG_MODULE_UNLOAD) && defined(CONFIG_SMP)
++ free_init_rx:
+ percpu_modfree(mod->refptr);
+- free_init:
+ #endif
+- module_free(mod, mod->module_init);
+- free_core:
+- module_free(mod, mod->module_core);
++ module_free_exec(mod, mod->module_init_rx);
++ free_core_rx:
++ module_free_exec(mod, mod->module_core_rx);
++ free_init_rw:
++ module_free(mod, mod->module_init_rw);
++ free_core_rw:
++ module_free(mod, mod->module_core_rw);
+ /* mod will be freed with core. Don't access it beyond this line! */
+ free_percpu:
+ if (percpu)
+@@ -2653,10 +2800,12 @@ SYSCALL_DEFINE3(init_module, void __user *, umod,
+ mod->symtab = mod->core_symtab;
+ mod->strtab = mod->core_strtab;
+ #endif
+- module_free(mod, mod->module_init);
+- mod->module_init = NULL;
+- mod->init_size = 0;
+- mod->init_text_size = 0;
++ module_free(mod, mod->module_init_rw);
++ module_free_exec(mod, mod->module_init_rx);
++ mod->module_init_rw = NULL;
++ mod->module_init_rx = NULL;
++ mod->init_size_rw = 0;
++ mod->init_size_rx = 0;
+ mutex_unlock(&module_mutex);
+
+ return 0;
+@@ -2687,10 +2836,16 @@ static const char *get_ksymbol(struct module *mod,
+ unsigned long nextval;
+
+ /* At worse, next value is at end of module */
+- if (within_module_init(addr, mod))
+- nextval = (unsigned long)mod->module_init+mod->init_text_size;
++ if (within_module_init_rx(addr, mod))
++ nextval = (unsigned long)mod->module_init_rx+mod->init_size_rx;
++ else if (within_module_init_rw(addr, mod))
++ nextval = (unsigned long)mod->module_init_rw+mod->init_size_rw;
++ else if (within_module_core_rx(addr, mod))
++ nextval = (unsigned long)mod->module_core_rx+mod->core_size_rx;
++ else if (within_module_core_rw(addr, mod))
++ nextval = (unsigned long)mod->module_core_rw+mod->core_size_rw;
+ else
+- nextval = (unsigned long)mod->module_core+mod->core_text_size;
++ return NULL;
+
+ /* Scan for closest preceeding symbol, and next symbol. (ELF
+ starts real symbols at 1). */
+@@ -2936,7 +3091,7 @@ static int m_show(struct seq_file *m, void *p)
+ char buf[8];
+
+ seq_printf(m, "%s %u",
+- mod->name, mod->init_size + mod->core_size);
++ mod->name, mod->init_size_rx + mod->init_size_rw + mod->core_size_rx + mod->core_size_rw);
+ print_unload_info(m, mod);
+
+ /* Informative for users. */
+@@ -2945,7 +3100,7 @@ static int m_show(struct seq_file *m, void *p)
+ mod->state == MODULE_STATE_COMING ? "Loading":
+ "Live");
+ /* Used by oprofile and other similar tools. */
+- seq_printf(m, " 0x%p", mod->module_core);
++ seq_printf(m, " 0x%p 0x%p", mod->module_core_rx, mod->module_core_rw);
+
+ /* Taints info */
+ if (mod->taints)
+@@ -2981,7 +3136,17 @@ static const struct file_operations proc_modules_operations = {
+
+ static int __init proc_modules_init(void)
+ {
++#ifndef CONFIG_GRKERNSEC_HIDESYM
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++ proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++ proc_create("modules", S_IRUSR | S_IRGRP, NULL, &proc_modules_operations);
++#else
+ proc_create("modules", 0, NULL, &proc_modules_operations);
++#endif
++#else
++ proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
++#endif
+ return 0;
+ }
+ module_init(proc_modules_init);
+@@ -3040,12 +3205,12 @@ struct module *__module_address(unsigned long addr)
+ {
+ struct module *mod;
+
+- if (addr < module_addr_min || addr > module_addr_max)
++ if ((addr < module_addr_min_rx || addr > module_addr_max_rx) &&
++ (addr < module_addr_min_rw || addr > module_addr_max_rw))
+ return NULL;
+
+ list_for_each_entry_rcu(mod, &modules, list)
+- if (within_module_core(addr, mod)
+- || within_module_init(addr, mod))
++ if (within_module_init(addr, mod) || within_module_core(addr, mod))
+ return mod;
+ return NULL;
+ }
+@@ -3079,11 +3244,20 @@ bool is_module_text_address(unsigned long addr)
+ */
+ struct module *__module_text_address(unsigned long addr)
+ {
+- struct module *mod = __module_address(addr);
++ struct module *mod;
++
++#ifdef CONFIG_X86_32
++ addr = ktla_ktva(addr);
++#endif
++
++ if (addr < module_addr_min_rx || addr > module_addr_max_rx)
++ return NULL;
++
++ mod = __module_address(addr);
++
+ if (mod) {
+ /* Make sure it's within the text section. */
+- if (!within(addr, mod->module_init, mod->init_text_size)
+- && !within(addr, mod->module_core, mod->core_text_size))
++ if (!within_module_init_rx(addr, mod) && !within_module_core_rx(addr, mod))
+ mod = NULL;
+ }
+ return mod;
+diff --git a/kernel/mutex-debug.c b/kernel/mutex-debug.c
+index ec815a9..fe46e99 100644
+--- a/kernel/mutex-debug.c
++++ b/kernel/mutex-debug.c
+@@ -49,21 +49,21 @@ void debug_mutex_free_waiter(struct mutex_waiter *waiter)
+ }
+
+ void debug_mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter,
+- struct thread_info *ti)
++ struct task_struct *task)
+ {
+ SMP_DEBUG_LOCKS_WARN_ON(!spin_is_locked(&lock->wait_lock));
+
+ /* Mark the current thread as blocked on the lock: */
+- ti->task->blocked_on = waiter;
++ task->blocked_on = waiter;
+ }
+
+ void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
+- struct thread_info *ti)
++ struct task_struct *task)
+ {
+ DEBUG_LOCKS_WARN_ON(list_empty(&waiter->list));
+- DEBUG_LOCKS_WARN_ON(waiter->task != ti->task);
+- DEBUG_LOCKS_WARN_ON(ti->task->blocked_on != waiter);
+- ti->task->blocked_on = NULL;
++ DEBUG_LOCKS_WARN_ON(waiter->task != task);
++ DEBUG_LOCKS_WARN_ON(task->blocked_on != waiter);
++ task->blocked_on = NULL;
+
+ list_del_init(&waiter->list);
+ waiter->task = NULL;
+@@ -75,7 +75,7 @@ void debug_mutex_unlock(struct mutex *lock)
+ return;
+
+ DEBUG_LOCKS_WARN_ON(lock->magic != lock);
+- DEBUG_LOCKS_WARN_ON(lock->owner != current_thread_info());
++ DEBUG_LOCKS_WARN_ON(lock->owner != current);
+ DEBUG_LOCKS_WARN_ON(!lock->wait_list.prev && !lock->wait_list.next);
+ mutex_clear_owner(lock);
+ }
+diff --git a/kernel/mutex-debug.h b/kernel/mutex-debug.h
+index 6b2d735..372d3c4 100644
+--- a/kernel/mutex-debug.h
++++ b/kernel/mutex-debug.h
+@@ -20,16 +20,16 @@ extern void debug_mutex_wake_waiter(struct mutex *lock,
+ extern void debug_mutex_free_waiter(struct mutex_waiter *waiter);
+ extern void debug_mutex_add_waiter(struct mutex *lock,
+ struct mutex_waiter *waiter,
+- struct thread_info *ti);
++ struct task_struct *task);
+ extern void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
+- struct thread_info *ti);
++ struct task_struct *task);
+ extern void debug_mutex_unlock(struct mutex *lock);
+ extern void debug_mutex_init(struct mutex *lock, const char *name,
+ struct lock_class_key *key);
+
+ static inline void mutex_set_owner(struct mutex *lock)
+ {
+- lock->owner = current_thread_info();
++ lock->owner = current;
+ }
+
+ static inline void mutex_clear_owner(struct mutex *lock)
+diff --git a/kernel/mutex.c b/kernel/mutex.c
+index f85644c..5ee9f77 100644
+--- a/kernel/mutex.c
++++ b/kernel/mutex.c
+@@ -169,7 +169,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
+ */
+
+ for (;;) {
+- struct thread_info *owner;
++ struct task_struct *owner;
+
+ /*
+ * If we own the BKL, then don't spin. The owner of
+@@ -214,7 +214,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
+ spin_lock_mutex(&lock->wait_lock, flags);
+
+ debug_mutex_lock_common(lock, &waiter);
+- debug_mutex_add_waiter(lock, &waiter, task_thread_info(task));
++ debug_mutex_add_waiter(lock, &waiter, task);
+
+ /* add waiting tasks to the end of the waitqueue (FIFO): */
+ list_add_tail(&waiter.list, &lock->wait_list);
+@@ -243,8 +243,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
+ * TASK_UNINTERRUPTIBLE case.)
+ */
+ if (unlikely(signal_pending_state(state, task))) {
+- mutex_remove_waiter(lock, &waiter,
+- task_thread_info(task));
++ mutex_remove_waiter(lock, &waiter, task);
+ mutex_release(&lock->dep_map, 1, ip);
+ spin_unlock_mutex(&lock->wait_lock, flags);
+
+@@ -265,7 +264,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
+ done:
+ lock_acquired(&lock->dep_map, ip);
+ /* got the lock - rejoice! */
+- mutex_remove_waiter(lock, &waiter, current_thread_info());
++ mutex_remove_waiter(lock, &waiter, task);
+ mutex_set_owner(lock);
+
+ /* set it to 0 if there are no waiters left: */
+diff --git a/kernel/mutex.h b/kernel/mutex.h
+index 67578ca..4115fbf 100644
+--- a/kernel/mutex.h
++++ b/kernel/mutex.h
+@@ -19,7 +19,7 @@
+ #ifdef CONFIG_SMP
+ static inline void mutex_set_owner(struct mutex *lock)
+ {
+- lock->owner = current_thread_info();
++ lock->owner = current;
+ }
+
+ static inline void mutex_clear_owner(struct mutex *lock)
+diff --git a/kernel/panic.c b/kernel/panic.c
+index 96b45d0..7677a03 100644
+--- a/kernel/panic.c
++++ b/kernel/panic.c
+@@ -71,7 +71,11 @@ NORET_TYPE void panic(const char * fmt, ...)
+ va_end(args);
+ printk(KERN_EMERG "Kernel panic - not syncing: %s\n",buf);
+ #ifdef CONFIG_DEBUG_BUGVERBOSE
+- dump_stack();
++ /*
++ * Avoid nested stack-dumping if a panic occurs during oops processing
++ */
++ if (!test_taint(TAINT_DIE) && oops_in_progress <= 1)
++ dump_stack();
+ #endif
+
+ /*
+@@ -352,7 +356,7 @@ static void warn_slowpath_common(const char *file, int line, void *caller, struc
+ const char *board;
+
+ printk(KERN_WARNING "------------[ cut here ]------------\n");
+- printk(KERN_WARNING "WARNING: at %s:%d %pS()\n", file, line, caller);
++ printk(KERN_WARNING "WARNING: at %s:%d %pA()\n", file, line, caller);
+ board = dmi_get_system_info(DMI_PRODUCT_NAME);
+ if (board)
+ printk(KERN_WARNING "Hardware name: %s\n", board);
+@@ -392,7 +396,8 @@ EXPORT_SYMBOL(warn_slowpath_null);
+ */
+ void __stack_chk_fail(void)
+ {
+- panic("stack-protector: Kernel stack is corrupted in: %p\n",
++ dump_stack();
++ panic("stack-protector: Kernel stack is corrupted in: %pA\n",
+ __builtin_return_address(0));
+ }
+ EXPORT_SYMBOL(__stack_chk_fail);
+diff --git a/kernel/params.c b/kernel/params.c
+index d656c27..21e452c 100644
+--- a/kernel/params.c
++++ b/kernel/params.c
+@@ -725,7 +725,7 @@ static ssize_t module_attr_store(struct kobject *kobj,
+ return ret;
+ }
+
+-static struct sysfs_ops module_sysfs_ops = {
++static const struct sysfs_ops module_sysfs_ops = {
+ .show = module_attr_show,
+ .store = module_attr_store,
+ };
+@@ -739,7 +739,7 @@ static int uevent_filter(struct kset *kset, struct kobject *kobj)
+ return 0;
+ }
+
+-static struct kset_uevent_ops module_uevent_ops = {
++static const struct kset_uevent_ops module_uevent_ops = {
+ .filter = uevent_filter,
+ };
+
+diff --git a/kernel/perf_event.c b/kernel/perf_event.c
+index 37ebc14..9c121d9 100644
+--- a/kernel/perf_event.c
++++ b/kernel/perf_event.c
+@@ -77,7 +77,7 @@ int sysctl_perf_event_mlock __read_mostly = 516; /* 'free' kb per user */
+ */
+ int sysctl_perf_event_sample_rate __read_mostly = 100000;
+
+-static atomic64_t perf_event_id;
++static atomic64_unchecked_t perf_event_id;
+
+ /*
+ * Lock for (sysadmin-configurable) event reservations:
+@@ -1094,9 +1094,9 @@ static void __perf_event_sync_stat(struct perf_event *event,
+ * In order to keep per-task stats reliable we need to flip the event
+ * values when we flip the contexts.
+ */
+- value = atomic64_read(&next_event->count);
+- value = atomic64_xchg(&event->count, value);
+- atomic64_set(&next_event->count, value);
++ value = atomic64_read_unchecked(&next_event->count);
++ value = atomic64_xchg_unchecked(&event->count, value);
++ atomic64_set_unchecked(&next_event->count, value);
+
+ swap(event->total_time_enabled, next_event->total_time_enabled);
+ swap(event->total_time_running, next_event->total_time_running);
+@@ -1552,7 +1552,7 @@ static u64 perf_event_read(struct perf_event *event)
+ update_event_times(event);
+ }
+
+- return atomic64_read(&event->count);
++ return atomic64_read_unchecked(&event->count);
+ }
+
+ /*
+@@ -1790,11 +1790,11 @@ static int perf_event_read_group(struct perf_event *event,
+ values[n++] = 1 + leader->nr_siblings;
+ if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
+ values[n++] = leader->total_time_enabled +
+- atomic64_read(&leader->child_total_time_enabled);
++ atomic64_read_unchecked(&leader->child_total_time_enabled);
+ }
+ if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
+ values[n++] = leader->total_time_running +
+- atomic64_read(&leader->child_total_time_running);
++ atomic64_read_unchecked(&leader->child_total_time_running);
+ }
+
+ size = n * sizeof(u64);
+@@ -1829,11 +1829,11 @@ static int perf_event_read_one(struct perf_event *event,
+ values[n++] = perf_event_read_value(event);
+ if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
+ values[n++] = event->total_time_enabled +
+- atomic64_read(&event->child_total_time_enabled);
++ atomic64_read_unchecked(&event->child_total_time_enabled);
+ }
+ if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
+ values[n++] = event->total_time_running +
+- atomic64_read(&event->child_total_time_running);
++ atomic64_read_unchecked(&event->child_total_time_running);
+ }
+ if (read_format & PERF_FORMAT_ID)
+ values[n++] = primary_event_id(event);
+@@ -1903,7 +1903,7 @@ static unsigned int perf_poll(struct file *file, poll_table *wait)
+ static void perf_event_reset(struct perf_event *event)
+ {
+ (void)perf_event_read(event);
+- atomic64_set(&event->count, 0);
++ atomic64_set_unchecked(&event->count, 0);
+ perf_event_update_userpage(event);
+ }
+
+@@ -2079,15 +2079,15 @@ void perf_event_update_userpage(struct perf_event *event)
+ ++userpg->lock;
+ barrier();
+ userpg->index = perf_event_index(event);
+- userpg->offset = atomic64_read(&event->count);
++ userpg->offset = atomic64_read_unchecked(&event->count);
+ if (event->state == PERF_EVENT_STATE_ACTIVE)
+- userpg->offset -= atomic64_read(&event->hw.prev_count);
++ userpg->offset -= atomic64_read_unchecked(&event->hw.prev_count);
+
+ userpg->time_enabled = event->total_time_enabled +
+- atomic64_read(&event->child_total_time_enabled);
++ atomic64_read_unchecked(&event->child_total_time_enabled);
+
+ userpg->time_running = event->total_time_running +
+- atomic64_read(&event->child_total_time_running);
++ atomic64_read_unchecked(&event->child_total_time_running);
+
+ barrier();
+ ++userpg->lock;
+@@ -2903,14 +2903,14 @@ static void perf_output_read_one(struct perf_output_handle *handle,
+ u64 values[4];
+ int n = 0;
+
+- values[n++] = atomic64_read(&event->count);
++ values[n++] = atomic64_read_unchecked(&event->count);
+ if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
+ values[n++] = event->total_time_enabled +
+- atomic64_read(&event->child_total_time_enabled);
++ atomic64_read_unchecked(&event->child_total_time_enabled);
+ }
+ if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
+ values[n++] = event->total_time_running +
+- atomic64_read(&event->child_total_time_running);
++ atomic64_read_unchecked(&event->child_total_time_running);
+ }
+ if (read_format & PERF_FORMAT_ID)
+ values[n++] = primary_event_id(event);
+@@ -2940,7 +2940,7 @@ static void perf_output_read_group(struct perf_output_handle *handle,
+ if (leader != event)
+ leader->pmu->read(leader);
+
+- values[n++] = atomic64_read(&leader->count);
++ values[n++] = atomic64_read_unchecked(&leader->count);
+ if (read_format & PERF_FORMAT_ID)
+ values[n++] = primary_event_id(leader);
+
+@@ -2952,7 +2952,7 @@ static void perf_output_read_group(struct perf_output_handle *handle,
+ if (sub != event)
+ sub->pmu->read(sub);
+
+- values[n++] = atomic64_read(&sub->count);
++ values[n++] = atomic64_read_unchecked(&sub->count);
+ if (read_format & PERF_FORMAT_ID)
+ values[n++] = primary_event_id(sub);
+
+@@ -3525,12 +3525,12 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event)
+ * need to add enough zero bytes after the string to handle
+ * the 64bit alignment we do later.
+ */
+- buf = kzalloc(PATH_MAX + sizeof(u64), GFP_KERNEL);
++ buf = kzalloc(PATH_MAX, GFP_KERNEL);
+ if (!buf) {
+ name = strncpy(tmp, "//enomem", sizeof(tmp));
+ goto got_name;
+ }
+- name = d_path(&file->f_path, buf, PATH_MAX);
++ name = d_path(&file->f_path, buf, PATH_MAX - sizeof(u64));
+ if (IS_ERR(name)) {
+ name = strncpy(tmp, "//toolong", sizeof(tmp));
+ goto got_name;
+@@ -3783,7 +3783,7 @@ static void perf_swevent_add(struct perf_event *event, u64 nr,
+ {
+ struct hw_perf_event *hwc = &event->hw;
+
+- atomic64_add(nr, &event->count);
++ atomic64_add_unchecked(nr, &event->count);
+
+ if (!hwc->sample_period)
+ return;
+@@ -4040,9 +4040,9 @@ static void cpu_clock_perf_event_update(struct perf_event *event)
+ u64 now;
+
+ now = cpu_clock(cpu);
+- prev = atomic64_read(&event->hw.prev_count);
+- atomic64_set(&event->hw.prev_count, now);
+- atomic64_add(now - prev, &event->count);
++ prev = atomic64_read_unchecked(&event->hw.prev_count);
++ atomic64_set_unchecked(&event->hw.prev_count, now);
++ atomic64_add_unchecked(now - prev, &event->count);
+ }
+
+ static int cpu_clock_perf_event_enable(struct perf_event *event)
+@@ -4050,7 +4050,7 @@ static int cpu_clock_perf_event_enable(struct perf_event *event)
+ struct hw_perf_event *hwc = &event->hw;
+ int cpu = raw_smp_processor_id();
+
+- atomic64_set(&hwc->prev_count, cpu_clock(cpu));
++ atomic64_set_unchecked(&hwc->prev_count, cpu_clock(cpu));
+ perf_swevent_start_hrtimer(event);
+
+ return 0;
+@@ -4082,9 +4082,9 @@ static void task_clock_perf_event_update(struct perf_event *event, u64 now)
+ u64 prev;
+ s64 delta;
+
+- prev = atomic64_xchg(&event->hw.prev_count, now);
++ prev = atomic64_xchg_unchecked(&event->hw.prev_count, now);
+ delta = now - prev;
+- atomic64_add(delta, &event->count);
++ atomic64_add_unchecked(delta, &event->count);
+ }
+
+ static int task_clock_perf_event_enable(struct perf_event *event)
+@@ -4094,7 +4094,7 @@ static int task_clock_perf_event_enable(struct perf_event *event)
+
+ now = event->ctx->time;
+
+- atomic64_set(&hwc->prev_count, now);
++ atomic64_set_unchecked(&hwc->prev_count, now);
+
+ perf_swevent_start_hrtimer(event);
+
+@@ -4289,7 +4289,7 @@ perf_event_alloc(struct perf_event_attr *attr,
+ event->parent = parent_event;
+
+ event->ns = get_pid_ns(current->nsproxy->pid_ns);
+- event->id = atomic64_inc_return(&perf_event_id);
++ event->id = atomic64_inc_return_unchecked(&perf_event_id);
+
+ event->state = PERF_EVENT_STATE_INACTIVE;
+
+@@ -4720,15 +4720,15 @@ static void sync_child_event(struct perf_event *child_event,
+ if (child_event->attr.inherit_stat)
+ perf_event_read_event(child_event, child);
+
+- child_val = atomic64_read(&child_event->count);
++ child_val = atomic64_read_unchecked(&child_event->count);
+
+ /*
+ * Add back the child's count to the parent's count:
+ */
+- atomic64_add(child_val, &parent_event->count);
+- atomic64_add(child_event->total_time_enabled,
++ atomic64_add_unchecked(child_val, &parent_event->count);
++ atomic64_add_unchecked(child_event->total_time_enabled,
+ &parent_event->child_total_time_enabled);
+- atomic64_add(child_event->total_time_running,
++ atomic64_add_unchecked(child_event->total_time_running,
+ &parent_event->child_total_time_running);
+
+ /*
+diff --git a/kernel/pid.c b/kernel/pid.c
+index fce7198..4f23a7e 100644
+--- a/kernel/pid.c
++++ b/kernel/pid.c
+@@ -33,6 +33,7 @@
+ #include <linux/rculist.h>
+ #include <linux/bootmem.h>
+ #include <linux/hash.h>
++#include <linux/security.h>
+ #include <linux/pid_namespace.h>
+ #include <linux/init_task.h>
+ #include <linux/syscalls.h>
+@@ -45,7 +46,7 @@ struct pid init_struct_pid = INIT_STRUCT_PID;
+
+ int pid_max = PID_MAX_DEFAULT;
+
+-#define RESERVED_PIDS 300
++#define RESERVED_PIDS 500
+
+ int pid_max_min = RESERVED_PIDS + 1;
+ int pid_max_max = PID_MAX_LIMIT;
+@@ -383,7 +384,14 @@ EXPORT_SYMBOL(pid_task);
+ */
+ struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
+ {
+- return pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
++ struct task_struct *task;
++
++ task = pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
++
++ if (gr_pid_is_chrooted(task))
++ return NULL;
++
++ return task;
+ }
+
+ struct task_struct *find_task_by_vpid(pid_t vnr)
+@@ -391,6 +399,11 @@ struct task_struct *find_task_by_vpid(pid_t vnr)
+ return find_task_by_pid_ns(vnr, current->nsproxy->pid_ns);
+ }
+
++struct task_struct *find_task_by_vpid_unrestricted(pid_t vnr)
++{
++ return pid_task(find_pid_ns(vnr, current->nsproxy->pid_ns), PIDTYPE_PID);
++}
++
+ struct pid *get_task_pid(struct task_struct *task, enum pid_type type)
+ {
+ struct pid *pid;
+diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c
+index 5c9dc22..d271117 100644
+--- a/kernel/posix-cpu-timers.c
++++ b/kernel/posix-cpu-timers.c
+@@ -6,6 +6,7 @@
+ #include <linux/posix-timers.h>
+ #include <linux/errno.h>
+ #include <linux/math64.h>
++#include <linux/security.h>
+ #include <asm/uaccess.h>
+ #include <linux/kernel_stat.h>
+ #include <trace/events/timer.h>
+@@ -1697,7 +1698,7 @@ static long thread_cpu_nsleep_restart(struct restart_block *restart_block)
+
+ static __init int init_posix_cpu_timers(void)
+ {
+- struct k_clock process = {
++ static struct k_clock process = {
+ .clock_getres = process_cpu_clock_getres,
+ .clock_get = process_cpu_clock_get,
+ .clock_set = do_posix_clock_nosettime,
+@@ -1705,7 +1706,7 @@ static __init int init_posix_cpu_timers(void)
+ .nsleep = process_cpu_nsleep,
+ .nsleep_restart = process_cpu_nsleep_restart,
+ };
+- struct k_clock thread = {
++ static struct k_clock thread = {
+ .clock_getres = thread_cpu_clock_getres,
+ .clock_get = thread_cpu_clock_get,
+ .clock_set = do_posix_clock_nosettime,
+diff --git a/kernel/posix-timers.c b/kernel/posix-timers.c
+index 5e76d22..cf1baeb 100644
+--- a/kernel/posix-timers.c
++++ b/kernel/posix-timers.c
+@@ -42,6 +42,7 @@
+ #include <linux/compiler.h>
+ #include <linux/idr.h>
+ #include <linux/posix-timers.h>
++#include <linux/grsecurity.h>
+ #include <linux/syscalls.h>
+ #include <linux/wait.h>
+ #include <linux/workqueue.h>
+@@ -131,7 +132,7 @@ static DEFINE_SPINLOCK(idr_lock);
+ * which we beg off on and pass to do_sys_settimeofday().
+ */
+
+-static struct k_clock posix_clocks[MAX_CLOCKS];
++static struct k_clock *posix_clocks[MAX_CLOCKS];
+
+ /*
+ * These ones are defined below.
+@@ -157,8 +158,8 @@ static inline void unlock_timer(struct k_itimer *timr, unsigned long flags)
+ */
+ #define CLOCK_DISPATCH(clock, call, arglist) \
+ ((clock) < 0 ? posix_cpu_##call arglist : \
+- (posix_clocks[clock].call != NULL \
+- ? (*posix_clocks[clock].call) arglist : common_##call arglist))
++ (posix_clocks[clock]->call != NULL \
++ ? (*posix_clocks[clock]->call) arglist : common_##call arglist))
+
+ /*
+ * Default clock hook functions when the struct k_clock passed
+@@ -172,7 +173,7 @@ static inline int common_clock_getres(const clockid_t which_clock,
+ struct timespec *tp)
+ {
+ tp->tv_sec = 0;
+- tp->tv_nsec = posix_clocks[which_clock].res;
++ tp->tv_nsec = posix_clocks[which_clock]->res;
+ return 0;
+ }
+
+@@ -217,9 +218,11 @@ static inline int invalid_clockid(const clockid_t which_clock)
+ return 0;
+ if ((unsigned) which_clock >= MAX_CLOCKS)
+ return 1;
+- if (posix_clocks[which_clock].clock_getres != NULL)
++ if (posix_clocks[which_clock] == NULL)
+ return 0;
+- if (posix_clocks[which_clock].res != 0)
++ if (posix_clocks[which_clock]->clock_getres != NULL)
++ return 0;
++ if (posix_clocks[which_clock]->res != 0)
+ return 0;
+ return 1;
+ }
+@@ -266,29 +269,29 @@ int posix_get_coarse_res(const clockid_t which_clock, struct timespec *tp)
+ */
+ static __init int init_posix_timers(void)
+ {
+- struct k_clock clock_realtime = {
++ static struct k_clock clock_realtime = {
+ .clock_getres = hrtimer_get_res,
+ };
+- struct k_clock clock_monotonic = {
++ static struct k_clock clock_monotonic = {
+ .clock_getres = hrtimer_get_res,
+ .clock_get = posix_ktime_get_ts,
+ .clock_set = do_posix_clock_nosettime,
+ };
+- struct k_clock clock_monotonic_raw = {
++ static struct k_clock clock_monotonic_raw = {
+ .clock_getres = hrtimer_get_res,
+ .clock_get = posix_get_monotonic_raw,
+ .clock_set = do_posix_clock_nosettime,
+ .timer_create = no_timer_create,
+ .nsleep = no_nsleep,
+ };
+- struct k_clock clock_realtime_coarse = {
++ static struct k_clock clock_realtime_coarse = {
+ .clock_getres = posix_get_coarse_res,
+ .clock_get = posix_get_realtime_coarse,
+ .clock_set = do_posix_clock_nosettime,
+ .timer_create = no_timer_create,
+ .nsleep = no_nsleep,
+ };
+- struct k_clock clock_monotonic_coarse = {
++ static struct k_clock clock_monotonic_coarse = {
+ .clock_getres = posix_get_coarse_res,
+ .clock_get = posix_get_monotonic_coarse,
+ .clock_set = do_posix_clock_nosettime,
+@@ -296,6 +299,8 @@ static __init int init_posix_timers(void)
+ .nsleep = no_nsleep,
+ };
+
++ pax_track_stack();
++
+ register_posix_clock(CLOCK_REALTIME, &clock_realtime);
+ register_posix_clock(CLOCK_MONOTONIC, &clock_monotonic);
+ register_posix_clock(CLOCK_MONOTONIC_RAW, &clock_monotonic_raw);
+@@ -484,7 +489,7 @@ void register_posix_clock(const clockid_t clock_id, struct k_clock *new_clock)
+ return;
+ }
+
+- posix_clocks[clock_id] = *new_clock;
++ posix_clocks[clock_id] = new_clock;
+ }
+ EXPORT_SYMBOL_GPL(register_posix_clock);
+
+@@ -948,6 +953,13 @@ SYSCALL_DEFINE2(clock_settime, const clockid_t, which_clock,
+ if (copy_from_user(&new_tp, tp, sizeof (*tp)))
+ return -EFAULT;
+
++ /* only the CLOCK_REALTIME clock can be set, all other clocks
++ have their clock_set fptr set to a nosettime dummy function
++ CLOCK_REALTIME has a NULL clock_set fptr which causes it to
++ call common_clock_set, which calls do_sys_settimeofday, which
++ we hook
++ */
++
+ return CLOCK_DISPATCH(which_clock, clock_set, (which_clock, &new_tp));
+ }
+
+diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
+index 04a9e90..bc355aa 100644
+--- a/kernel/power/hibernate.c
++++ b/kernel/power/hibernate.c
+@@ -48,14 +48,14 @@ enum {
+
+ static int hibernation_mode = HIBERNATION_SHUTDOWN;
+
+-static struct platform_hibernation_ops *hibernation_ops;
++static const struct platform_hibernation_ops *hibernation_ops;
+
+ /**
+ * hibernation_set_ops - set the global hibernate operations
+ * @ops: the hibernation operations to use in subsequent hibernation transitions
+ */
+
+-void hibernation_set_ops(struct platform_hibernation_ops *ops)
++void hibernation_set_ops(const struct platform_hibernation_ops *ops)
+ {
+ if (ops && !(ops->begin && ops->end && ops->pre_snapshot
+ && ops->prepare && ops->finish && ops->enter && ops->pre_restore
+diff --git a/kernel/power/poweroff.c b/kernel/power/poweroff.c
+index e8b3370..484c2e4 100644
+--- a/kernel/power/poweroff.c
++++ b/kernel/power/poweroff.c
+@@ -37,7 +37,7 @@ static struct sysrq_key_op sysrq_poweroff_op = {
+ .enable_mask = SYSRQ_ENABLE_BOOT,
+ };
+
+-static int pm_sysrq_init(void)
++static int __init pm_sysrq_init(void)
+ {
+ register_sysrq_key('o', &sysrq_poweroff_op);
+ return 0;
+diff --git a/kernel/power/process.c b/kernel/power/process.c
+index e7cd671..56d5f459 100644
+--- a/kernel/power/process.c
++++ b/kernel/power/process.c
+@@ -37,12 +37,15 @@ static int try_to_freeze_tasks(bool sig_only)
+ struct timeval start, end;
+ u64 elapsed_csecs64;
+ unsigned int elapsed_csecs;
++ bool timedout = false;
+
+ do_gettimeofday(&start);
+
+ end_time = jiffies + TIMEOUT;
+ do {
+ todo = 0;
++ if (time_after(jiffies, end_time))
++ timedout = true;
+ read_lock(&tasklist_lock);
+ do_each_thread(g, p) {
+ if (frozen(p) || !freezeable(p))
+@@ -57,15 +60,17 @@ static int try_to_freeze_tasks(bool sig_only)
+ * It is "frozen enough". If the task does wake
+ * up, it will immediately call try_to_freeze.
+ */
+- if (!task_is_stopped_or_traced(p) &&
+- !freezer_should_skip(p))
++ if (!task_is_stopped_or_traced(p) && !freezer_should_skip(p)) {
+ todo++;
++ if (timedout) {
++ printk(KERN_ERR "Task refusing to freeze:\n");
++ sched_show_task(p);
++ }
++ }
+ } while_each_thread(g, p);
+ read_unlock(&tasklist_lock);
+ yield(); /* Yield is okay here */
+- if (time_after(jiffies, end_time))
+- break;
+- } while (todo);
++ } while (todo && !timedout);
+
+ do_gettimeofday(&end);
+ elapsed_csecs64 = timeval_to_ns(&end) - timeval_to_ns(&start);
+diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c
+index 40dd021..fb30ceb 100644
+--- a/kernel/power/suspend.c
++++ b/kernel/power/suspend.c
+@@ -23,13 +23,13 @@ const char *const pm_states[PM_SUSPEND_MAX] = {
+ [PM_SUSPEND_MEM] = "mem",
+ };
+
+-static struct platform_suspend_ops *suspend_ops;
++static const struct platform_suspend_ops *suspend_ops;
+
+ /**
+ * suspend_set_ops - Set the global suspend method table.
+ * @ops: Pointer to ops structure.
+ */
+-void suspend_set_ops(struct platform_suspend_ops *ops)
++void suspend_set_ops(const struct platform_suspend_ops *ops)
+ {
+ mutex_lock(&pm_mutex);
+ suspend_ops = ops;
+diff --git a/kernel/printk.c b/kernel/printk.c
+index 4cade47..4d17900 100644
+--- a/kernel/printk.c
++++ b/kernel/printk.c
+@@ -33,6 +33,7 @@
+ #include <linux/bootmem.h>
+ #include <linux/syscalls.h>
+ #include <linux/kexec.h>
++#include <linux/syslog.h>
+
+ #include <asm/uaccess.h>
+
+@@ -256,38 +257,30 @@ static inline void boot_delay_msec(void)
+ }
+ #endif
+
+-/*
+- * Commands to do_syslog:
+- *
+- * 0 -- Close the log. Currently a NOP.
+- * 1 -- Open the log. Currently a NOP.
+- * 2 -- Read from the log.
+- * 3 -- Read all messages remaining in the ring buffer.
+- * 4 -- Read and clear all messages remaining in the ring buffer
+- * 5 -- Clear ring buffer.
+- * 6 -- Disable printk's to console
+- * 7 -- Enable printk's to console
+- * 8 -- Set level of messages printed to console
+- * 9 -- Return number of unread characters in the log buffer
+- * 10 -- Return size of the log buffer
+- */
+-int do_syslog(int type, char __user *buf, int len)
++int do_syslog(int type, char __user *buf, int len, bool from_file)
+ {
+ unsigned i, j, limit, count;
+ int do_clear = 0;
+ char c;
+ int error = 0;
+
+- error = security_syslog(type);
++#ifdef CONFIG_GRKERNSEC_DMESG
++ if (grsec_enable_dmesg &&
++ (!from_file || (from_file && type == SYSLOG_ACTION_OPEN)) &&
++ !capable(CAP_SYS_ADMIN))
++ return -EPERM;
++#endif
++
++ error = security_syslog(type, from_file);
+ if (error)
+ return error;
+
+ switch (type) {
+- case 0: /* Close log */
++ case SYSLOG_ACTION_CLOSE: /* Close log */
+ break;
+- case 1: /* Open log */
++ case SYSLOG_ACTION_OPEN: /* Open log */
+ break;
+- case 2: /* Read from log */
++ case SYSLOG_ACTION_READ: /* Read from log */
+ error = -EINVAL;
+ if (!buf || len < 0)
+ goto out;
+@@ -318,10 +311,12 @@ int do_syslog(int type, char __user *buf, int len)
+ if (!error)
+ error = i;
+ break;
+- case 4: /* Read/clear last kernel messages */
++ /* Read/clear last kernel messages */
++ case SYSLOG_ACTION_READ_CLEAR:
+ do_clear = 1;
+ /* FALL THRU */
+- case 3: /* Read last kernel messages */
++ /* Read last kernel messages */
++ case SYSLOG_ACTION_READ_ALL:
+ error = -EINVAL;
+ if (!buf || len < 0)
+ goto out;
+@@ -374,21 +369,25 @@ int do_syslog(int type, char __user *buf, int len)
+ }
+ }
+ break;
+- case 5: /* Clear ring buffer */
++ /* Clear ring buffer */
++ case SYSLOG_ACTION_CLEAR:
+ logged_chars = 0;
+ break;
+- case 6: /* Disable logging to console */
++ /* Disable logging to console */
++ case SYSLOG_ACTION_CONSOLE_OFF:
+ if (saved_console_loglevel == -1)
+ saved_console_loglevel = console_loglevel;
+ console_loglevel = minimum_console_loglevel;
+ break;
+- case 7: /* Enable logging to console */
++ /* Enable logging to console */
++ case SYSLOG_ACTION_CONSOLE_ON:
+ if (saved_console_loglevel != -1) {
+ console_loglevel = saved_console_loglevel;
+ saved_console_loglevel = -1;
+ }
+ break;
+- case 8: /* Set level of messages printed to console */
++ /* Set level of messages printed to console */
++ case SYSLOG_ACTION_CONSOLE_LEVEL:
+ error = -EINVAL;
+ if (len < 1 || len > 8)
+ goto out;
+@@ -399,10 +398,12 @@ int do_syslog(int type, char __user *buf, int len)
+ saved_console_loglevel = -1;
+ error = 0;
+ break;
+- case 9: /* Number of chars in the log buffer */
++ /* Number of chars in the log buffer */
++ case SYSLOG_ACTION_SIZE_UNREAD:
+ error = log_end - log_start;
+ break;
+- case 10: /* Size of the log buffer */
++ /* Size of the log buffer */
++ case SYSLOG_ACTION_SIZE_BUFFER:
+ error = log_buf_len;
+ break;
+ default:
+@@ -415,7 +416,7 @@ out:
+
+ SYSCALL_DEFINE3(syslog, int, type, char __user *, buf, int, len)
+ {
+- return do_syslog(type, buf, len);
++ return do_syslog(type, buf, len, SYSLOG_FROM_CALL);
+ }
+
+ /*
+diff --git a/kernel/profile.c b/kernel/profile.c
+index dfadc5b..7f59404 100644
+--- a/kernel/profile.c
++++ b/kernel/profile.c
+@@ -39,7 +39,7 @@ struct profile_hit {
+ /* Oprofile timer tick hook */
+ static int (*timer_hook)(struct pt_regs *) __read_mostly;
+
+-static atomic_t *prof_buffer;
++static atomic_unchecked_t *prof_buffer;
+ static unsigned long prof_len, prof_shift;
+
+ int prof_on __read_mostly;
+@@ -283,7 +283,7 @@ static void profile_flip_buffers(void)
+ hits[i].pc = 0;
+ continue;
+ }
+- atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
++ atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
+ hits[i].hits = hits[i].pc = 0;
+ }
+ }
+@@ -346,9 +346,9 @@ void profile_hits(int type, void *__pc, unsigned int nr_hits)
+ * Add the current hit(s) and flush the write-queue out
+ * to the global buffer:
+ */
+- atomic_add(nr_hits, &prof_buffer[pc]);
++ atomic_add_unchecked(nr_hits, &prof_buffer[pc]);
+ for (i = 0; i < NR_PROFILE_HIT; ++i) {
+- atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
++ atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
+ hits[i].pc = hits[i].hits = 0;
+ }
+ out:
+@@ -426,7 +426,7 @@ void profile_hits(int type, void *__pc, unsigned int nr_hits)
+ if (prof_on != type || !prof_buffer)
+ return;
+ pc = ((unsigned long)__pc - (unsigned long)_stext) >> prof_shift;
+- atomic_add(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
++ atomic_add_unchecked(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
+ }
+ #endif /* !CONFIG_SMP */
+ EXPORT_SYMBOL_GPL(profile_hits);
+@@ -517,7 +517,7 @@ read_profile(struct file *file, char __user *buf, size_t count, loff_t *ppos)
+ return -EFAULT;
+ buf++; p++; count--; read++;
+ }
+- pnt = (char *)prof_buffer + p - sizeof(atomic_t);
++ pnt = (char *)prof_buffer + p - sizeof(atomic_unchecked_t);
+ if (copy_to_user(buf, (void *)pnt, count))
+ return -EFAULT;
+ read += count;
+@@ -548,7 +548,7 @@ static ssize_t write_profile(struct file *file, const char __user *buf,
+ }
+ #endif
+ profile_discard_flip_buffers();
+- memset(prof_buffer, 0, prof_len * sizeof(atomic_t));
++ memset(prof_buffer, 0, prof_len * sizeof(atomic_unchecked_t));
+ return count;
+ }
+
+diff --git a/kernel/ptrace.c b/kernel/ptrace.c
+index 05625f6..733bf70 100644
+--- a/kernel/ptrace.c
++++ b/kernel/ptrace.c
+@@ -117,7 +117,8 @@ int ptrace_check_attach(struct task_struct *child, int kill)
+ return ret;
+ }
+
+-int __ptrace_may_access(struct task_struct *task, unsigned int mode)
++static int __ptrace_may_access(struct task_struct *task, unsigned int mode,
++ unsigned int log)
+ {
+ const struct cred *cred = current_cred(), *tcred;
+
+@@ -141,7 +142,9 @@ int __ptrace_may_access(struct task_struct *task, unsigned int mode)
+ cred->gid != tcred->egid ||
+ cred->gid != tcred->sgid ||
+ cred->gid != tcred->gid) &&
+- !capable(CAP_SYS_PTRACE)) {
++ ((!log && !capable_nolog(CAP_SYS_PTRACE)) ||
++ (log && !capable(CAP_SYS_PTRACE)))
++ ) {
+ rcu_read_unlock();
+ return -EPERM;
+ }
+@@ -149,7 +152,9 @@ int __ptrace_may_access(struct task_struct *task, unsigned int mode)
+ smp_rmb();
+ if (task->mm)
+ dumpable = get_dumpable(task->mm);
+- if (!dumpable && !capable(CAP_SYS_PTRACE))
++ if (!dumpable &&
++ ((!log && !capable_nolog(CAP_SYS_PTRACE)) ||
++ (log && !capable(CAP_SYS_PTRACE))))
+ return -EPERM;
+
+ return security_ptrace_access_check(task, mode);
+@@ -159,7 +164,16 @@ bool ptrace_may_access(struct task_struct *task, unsigned int mode)
+ {
+ int err;
+ task_lock(task);
+- err = __ptrace_may_access(task, mode);
++ err = __ptrace_may_access(task, mode, 0);
++ task_unlock(task);
++ return !err;
++}
++
++bool ptrace_may_access_log(struct task_struct *task, unsigned int mode)
++{
++ int err;
++ task_lock(task);
++ err = __ptrace_may_access(task, mode, 1);
+ task_unlock(task);
+ return !err;
+ }
+@@ -186,7 +200,7 @@ int ptrace_attach(struct task_struct *task)
+ goto out;
+
+ task_lock(task);
+- retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH);
++ retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH, 1);
+ task_unlock(task);
+ if (retval)
+ goto unlock_creds;
+@@ -199,7 +213,7 @@ int ptrace_attach(struct task_struct *task)
+ goto unlock_tasklist;
+
+ task->ptrace = PT_PTRACED;
+- if (capable(CAP_SYS_PTRACE))
++ if (capable_nolog(CAP_SYS_PTRACE))
+ task->ptrace |= PT_PTRACE_CAP;
+
+ __ptrace_link(task, current);
+@@ -351,6 +365,8 @@ int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __user *dst
+ {
+ int copied = 0;
+
++ pax_track_stack();
++
+ while (len > 0) {
+ char buf[128];
+ int this_len, retval;
+@@ -376,6 +392,8 @@ int ptrace_writedata(struct task_struct *tsk, char __user *src, unsigned long ds
+ {
+ int copied = 0;
+
++ pax_track_stack();
++
+ while (len > 0) {
+ char buf[128];
+ int this_len, retval;
+@@ -517,6 +535,8 @@ int ptrace_request(struct task_struct *child, long request,
+ int ret = -EIO;
+ siginfo_t siginfo;
+
++ pax_track_stack();
++
+ switch (request) {
+ case PTRACE_PEEKTEXT:
+ case PTRACE_PEEKDATA:
+@@ -532,18 +552,18 @@ int ptrace_request(struct task_struct *child, long request,
+ ret = ptrace_setoptions(child, data);
+ break;
+ case PTRACE_GETEVENTMSG:
+- ret = put_user(child->ptrace_message, (unsigned long __user *) data);
++ ret = put_user(child->ptrace_message, (__force unsigned long __user *) data);
+ break;
+
+ case PTRACE_GETSIGINFO:
+ ret = ptrace_getsiginfo(child, &siginfo);
+ if (!ret)
+- ret = copy_siginfo_to_user((siginfo_t __user *) data,
++ ret = copy_siginfo_to_user((__force siginfo_t __user *) data,
+ &siginfo);
+ break;
+
+ case PTRACE_SETSIGINFO:
+- if (copy_from_user(&siginfo, (siginfo_t __user *) data,
++ if (copy_from_user(&siginfo, (__force siginfo_t __user *) data,
+ sizeof siginfo))
+ ret = -EFAULT;
+ else
+@@ -621,14 +641,21 @@ SYSCALL_DEFINE4(ptrace, long, request, long, pid, long, addr, long, data)
+ goto out;
+ }
+
++ if (gr_handle_ptrace(child, request)) {
++ ret = -EPERM;
++ goto out_put_task_struct;
++ }
++
+ if (request == PTRACE_ATTACH) {
+ ret = ptrace_attach(child);
+ /*
+ * Some architectures need to do book-keeping after
+ * a ptrace attach.
+ */
+- if (!ret)
++ if (!ret) {
+ arch_ptrace_attach(child);
++ gr_audit_ptrace(child);
++ }
+ goto out_put_task_struct;
+ }
+
+@@ -653,7 +680,7 @@ int generic_ptrace_peekdata(struct task_struct *tsk, long addr, long data)
+ copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
+ if (copied != sizeof(tmp))
+ return -EIO;
+- return put_user(tmp, (unsigned long __user *)data);
++ return put_user(tmp, (__force unsigned long __user *)data);
+ }
+
+ int generic_ptrace_pokedata(struct task_struct *tsk, long addr, long data)
+@@ -675,6 +702,8 @@ int compat_ptrace_request(struct task_struct *child, compat_long_t request,
+ siginfo_t siginfo;
+ int ret;
+
++ pax_track_stack();
++
+ switch (request) {
+ case PTRACE_PEEKTEXT:
+ case PTRACE_PEEKDATA:
+@@ -740,14 +769,21 @@ asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
+ goto out;
+ }
+
++ if (gr_handle_ptrace(child, request)) {
++ ret = -EPERM;
++ goto out_put_task_struct;
++ }
++
+ if (request == PTRACE_ATTACH) {
+ ret = ptrace_attach(child);
+ /*
+ * Some architectures need to do book-keeping after
+ * a ptrace attach.
+ */
+- if (!ret)
++ if (!ret) {
+ arch_ptrace_attach(child);
++ gr_audit_ptrace(child);
++ }
+ goto out_put_task_struct;
+ }
+
+diff --git a/kernel/rcutorture.c b/kernel/rcutorture.c
+index 697c0a0..2402696 100644
+--- a/kernel/rcutorture.c
++++ b/kernel/rcutorture.c
+@@ -118,12 +118,12 @@ static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_count) =
+ { 0 };
+ static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_batch) =
+ { 0 };
+-static atomic_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
+-static atomic_t n_rcu_torture_alloc;
+-static atomic_t n_rcu_torture_alloc_fail;
+-static atomic_t n_rcu_torture_free;
+-static atomic_t n_rcu_torture_mberror;
+-static atomic_t n_rcu_torture_error;
++static atomic_unchecked_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
++static atomic_unchecked_t n_rcu_torture_alloc;
++static atomic_unchecked_t n_rcu_torture_alloc_fail;
++static atomic_unchecked_t n_rcu_torture_free;
++static atomic_unchecked_t n_rcu_torture_mberror;
++static atomic_unchecked_t n_rcu_torture_error;
+ static long n_rcu_torture_timers;
+ static struct list_head rcu_torture_removed;
+ static cpumask_var_t shuffle_tmp_mask;
+@@ -187,11 +187,11 @@ rcu_torture_alloc(void)
+
+ spin_lock_bh(&rcu_torture_lock);
+ if (list_empty(&rcu_torture_freelist)) {
+- atomic_inc(&n_rcu_torture_alloc_fail);
++ atomic_inc_unchecked(&n_rcu_torture_alloc_fail);
+ spin_unlock_bh(&rcu_torture_lock);
+ return NULL;
+ }
+- atomic_inc(&n_rcu_torture_alloc);
++ atomic_inc_unchecked(&n_rcu_torture_alloc);
+ p = rcu_torture_freelist.next;
+ list_del_init(p);
+ spin_unlock_bh(&rcu_torture_lock);
+@@ -204,7 +204,7 @@ rcu_torture_alloc(void)
+ static void
+ rcu_torture_free(struct rcu_torture *p)
+ {
+- atomic_inc(&n_rcu_torture_free);
++ atomic_inc_unchecked(&n_rcu_torture_free);
+ spin_lock_bh(&rcu_torture_lock);
+ list_add_tail(&p->rtort_free, &rcu_torture_freelist);
+ spin_unlock_bh(&rcu_torture_lock);
+@@ -319,7 +319,7 @@ rcu_torture_cb(struct rcu_head *p)
+ i = rp->rtort_pipe_count;
+ if (i > RCU_TORTURE_PIPE_LEN)
+ i = RCU_TORTURE_PIPE_LEN;
+- atomic_inc(&rcu_torture_wcount[i]);
++ atomic_inc_unchecked(&rcu_torture_wcount[i]);
+ if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
+ rp->rtort_mbtest = 0;
+ rcu_torture_free(rp);
+@@ -359,7 +359,7 @@ static void rcu_sync_torture_deferred_free(struct rcu_torture *p)
+ i = rp->rtort_pipe_count;
+ if (i > RCU_TORTURE_PIPE_LEN)
+ i = RCU_TORTURE_PIPE_LEN;
+- atomic_inc(&rcu_torture_wcount[i]);
++ atomic_inc_unchecked(&rcu_torture_wcount[i]);
+ if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
+ rp->rtort_mbtest = 0;
+ list_del(&rp->rtort_free);
+@@ -653,7 +653,7 @@ rcu_torture_writer(void *arg)
+ i = old_rp->rtort_pipe_count;
+ if (i > RCU_TORTURE_PIPE_LEN)
+ i = RCU_TORTURE_PIPE_LEN;
+- atomic_inc(&rcu_torture_wcount[i]);
++ atomic_inc_unchecked(&rcu_torture_wcount[i]);
+ old_rp->rtort_pipe_count++;
+ cur_ops->deferred_free(old_rp);
+ }
+@@ -718,7 +718,7 @@ static void rcu_torture_timer(unsigned long unused)
+ return;
+ }
+ if (p->rtort_mbtest == 0)
+- atomic_inc(&n_rcu_torture_mberror);
++ atomic_inc_unchecked(&n_rcu_torture_mberror);
+ spin_lock(&rand_lock);
+ cur_ops->read_delay(&rand);
+ n_rcu_torture_timers++;
+@@ -776,7 +776,7 @@ rcu_torture_reader(void *arg)
+ continue;
+ }
+ if (p->rtort_mbtest == 0)
+- atomic_inc(&n_rcu_torture_mberror);
++ atomic_inc_unchecked(&n_rcu_torture_mberror);
+ cur_ops->read_delay(&rand);
+ preempt_disable();
+ pipe_count = p->rtort_pipe_count;
+@@ -834,17 +834,17 @@ rcu_torture_printk(char *page)
+ rcu_torture_current,
+ rcu_torture_current_version,
+ list_empty(&rcu_torture_freelist),
+- atomic_read(&n_rcu_torture_alloc),
+- atomic_read(&n_rcu_torture_alloc_fail),
+- atomic_read(&n_rcu_torture_free),
+- atomic_read(&n_rcu_torture_mberror),
++ atomic_read_unchecked(&n_rcu_torture_alloc),
++ atomic_read_unchecked(&n_rcu_torture_alloc_fail),
++ atomic_read_unchecked(&n_rcu_torture_free),
++ atomic_read_unchecked(&n_rcu_torture_mberror),
+ n_rcu_torture_timers);
+- if (atomic_read(&n_rcu_torture_mberror) != 0)
++ if (atomic_read_unchecked(&n_rcu_torture_mberror) != 0)
+ cnt += sprintf(&page[cnt], " !!!");
+ cnt += sprintf(&page[cnt], "\n%s%s ", torture_type, TORTURE_FLAG);
+ if (i > 1) {
+ cnt += sprintf(&page[cnt], "!!! ");
+- atomic_inc(&n_rcu_torture_error);
++ atomic_inc_unchecked(&n_rcu_torture_error);
+ WARN_ON_ONCE(1);
+ }
+ cnt += sprintf(&page[cnt], "Reader Pipe: ");
+@@ -858,7 +858,7 @@ rcu_torture_printk(char *page)
+ cnt += sprintf(&page[cnt], "Free-Block Circulation: ");
+ for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
+ cnt += sprintf(&page[cnt], " %d",
+- atomic_read(&rcu_torture_wcount[i]));
++ atomic_read_unchecked(&rcu_torture_wcount[i]));
+ }
+ cnt += sprintf(&page[cnt], "\n");
+ if (cur_ops->stats)
+@@ -1084,7 +1084,7 @@ rcu_torture_cleanup(void)
+
+ if (cur_ops->cleanup)
+ cur_ops->cleanup();
+- if (atomic_read(&n_rcu_torture_error))
++ if (atomic_read_unchecked(&n_rcu_torture_error))
+ rcu_torture_print_module_parms("End of test: FAILURE");
+ else
+ rcu_torture_print_module_parms("End of test: SUCCESS");
+@@ -1138,13 +1138,13 @@ rcu_torture_init(void)
+
+ rcu_torture_current = NULL;
+ rcu_torture_current_version = 0;
+- atomic_set(&n_rcu_torture_alloc, 0);
+- atomic_set(&n_rcu_torture_alloc_fail, 0);
+- atomic_set(&n_rcu_torture_free, 0);
+- atomic_set(&n_rcu_torture_mberror, 0);
+- atomic_set(&n_rcu_torture_error, 0);
++ atomic_set_unchecked(&n_rcu_torture_alloc, 0);
++ atomic_set_unchecked(&n_rcu_torture_alloc_fail, 0);
++ atomic_set_unchecked(&n_rcu_torture_free, 0);
++ atomic_set_unchecked(&n_rcu_torture_mberror, 0);
++ atomic_set_unchecked(&n_rcu_torture_error, 0);
+ for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++)
+- atomic_set(&rcu_torture_wcount[i], 0);
++ atomic_set_unchecked(&rcu_torture_wcount[i], 0);
+ for_each_possible_cpu(cpu) {
+ for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
+ per_cpu(rcu_torture_count, cpu)[i] = 0;
+diff --git a/kernel/rcutree.c b/kernel/rcutree.c
+index 683c4f3..97f54c6 100644
+--- a/kernel/rcutree.c
++++ b/kernel/rcutree.c
+@@ -1303,7 +1303,7 @@ __rcu_process_callbacks(struct rcu_state *rsp, struct rcu_data *rdp)
+ /*
+ * Do softirq processing for the current CPU.
+ */
+-static void rcu_process_callbacks(struct softirq_action *unused)
++static void rcu_process_callbacks(void)
+ {
+ /*
+ * Memory references from any prior RCU read-side critical sections
+diff --git a/kernel/rcutree_plugin.h b/kernel/rcutree_plugin.h
+index c03edf7..ac1b341 100644
+--- a/kernel/rcutree_plugin.h
++++ b/kernel/rcutree_plugin.h
+@@ -145,7 +145,7 @@ static void rcu_preempt_note_context_switch(int cpu)
+ */
+ void __rcu_read_lock(void)
+ {
+- ACCESS_ONCE(current->rcu_read_lock_nesting)++;
++ ACCESS_ONCE_RW(current->rcu_read_lock_nesting)++;
+ barrier(); /* needed if we ever invoke rcu_read_lock in rcutree.c */
+ }
+ EXPORT_SYMBOL_GPL(__rcu_read_lock);
+@@ -251,7 +251,7 @@ void __rcu_read_unlock(void)
+ struct task_struct *t = current;
+
+ barrier(); /* needed if we ever invoke rcu_read_unlock in rcutree.c */
+- if (--ACCESS_ONCE(t->rcu_read_lock_nesting) == 0 &&
++ if (--ACCESS_ONCE_RW(t->rcu_read_lock_nesting) == 0 &&
+ unlikely(ACCESS_ONCE(t->rcu_read_unlock_special)))
+ rcu_read_unlock_special(t);
+ }
+diff --git a/kernel/relay.c b/kernel/relay.c
+index bf343f5..908e9ee 100644
+--- a/kernel/relay.c
++++ b/kernel/relay.c
+@@ -1228,7 +1228,7 @@ static int subbuf_splice_actor(struct file *in,
+ unsigned int flags,
+ int *nonpad_ret)
+ {
+- unsigned int pidx, poff, total_len, subbuf_pages, nr_pages, ret;
++ unsigned int pidx, poff, total_len, subbuf_pages, nr_pages;
+ struct rchan_buf *rbuf = in->private_data;
+ unsigned int subbuf_size = rbuf->chan->subbuf_size;
+ uint64_t pos = (uint64_t) *ppos;
+@@ -1247,6 +1247,9 @@ static int subbuf_splice_actor(struct file *in,
+ .ops = &relay_pipe_buf_ops,
+ .spd_release = relay_page_release,
+ };
++ ssize_t ret;
++
++ pax_track_stack();
+
+ if (rbuf->subbufs_produced == rbuf->subbufs_consumed)
+ return 0;
+diff --git a/kernel/resource.c b/kernel/resource.c
+index fb11a58..4e61ae1 100644
+--- a/kernel/resource.c
++++ b/kernel/resource.c
+@@ -132,8 +132,18 @@ static const struct file_operations proc_iomem_operations = {
+
+ static int __init ioresources_init(void)
+ {
++#ifdef CONFIG_GRKERNSEC_PROC_ADD
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++ proc_create("ioports", S_IRUSR, NULL, &proc_ioports_operations);
++ proc_create("iomem", S_IRUSR, NULL, &proc_iomem_operations);
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++ proc_create("ioports", S_IRUSR | S_IRGRP, NULL, &proc_ioports_operations);
++ proc_create("iomem", S_IRUSR | S_IRGRP, NULL, &proc_iomem_operations);
++#endif
++#else
+ proc_create("ioports", 0, NULL, &proc_ioports_operations);
+ proc_create("iomem", 0, NULL, &proc_iomem_operations);
++#endif
+ return 0;
+ }
+ __initcall(ioresources_init);
+diff --git a/kernel/rtmutex-tester.c b/kernel/rtmutex-tester.c
+index a56f629..1fc4989 100644
+--- a/kernel/rtmutex-tester.c
++++ b/kernel/rtmutex-tester.c
+@@ -21,7 +21,7 @@
+ #define MAX_RT_TEST_MUTEXES 8
+
+ static spinlock_t rttest_lock;
+-static atomic_t rttest_event;
++static atomic_unchecked_t rttest_event;
+
+ struct test_thread_data {
+ int opcode;
+@@ -64,7 +64,7 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
+
+ case RTTEST_LOCKCONT:
+ td->mutexes[td->opdata] = 1;
+- td->event = atomic_add_return(1, &rttest_event);
++ td->event = atomic_add_return_unchecked(1, &rttest_event);
+ return 0;
+
+ case RTTEST_RESET:
+@@ -82,7 +82,7 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
+ return 0;
+
+ case RTTEST_RESETEVENT:
+- atomic_set(&rttest_event, 0);
++ atomic_set_unchecked(&rttest_event, 0);
+ return 0;
+
+ default:
+@@ -99,9 +99,9 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
+ return ret;
+
+ td->mutexes[id] = 1;
+- td->event = atomic_add_return(1, &rttest_event);
++ td->event = atomic_add_return_unchecked(1, &rttest_event);
+ rt_mutex_lock(&mutexes[id]);
+- td->event = atomic_add_return(1, &rttest_event);
++ td->event = atomic_add_return_unchecked(1, &rttest_event);
+ td->mutexes[id] = 4;
+ return 0;
+
+@@ -112,9 +112,9 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
+ return ret;
+
+ td->mutexes[id] = 1;
+- td->event = atomic_add_return(1, &rttest_event);
++ td->event = atomic_add_return_unchecked(1, &rttest_event);
+ ret = rt_mutex_lock_interruptible(&mutexes[id], 0);
+- td->event = atomic_add_return(1, &rttest_event);
++ td->event = atomic_add_return_unchecked(1, &rttest_event);
+ td->mutexes[id] = ret ? 0 : 4;
+ return ret ? -EINTR : 0;
+
+@@ -123,9 +123,9 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
+ if (id < 0 || id >= MAX_RT_TEST_MUTEXES || td->mutexes[id] != 4)
+ return ret;
+
+- td->event = atomic_add_return(1, &rttest_event);
++ td->event = atomic_add_return_unchecked(1, &rttest_event);
+ rt_mutex_unlock(&mutexes[id]);
+- td->event = atomic_add_return(1, &rttest_event);
++ td->event = atomic_add_return_unchecked(1, &rttest_event);
+ td->mutexes[id] = 0;
+ return 0;
+
+@@ -187,7 +187,7 @@ void schedule_rt_mutex_test(struct rt_mutex *mutex)
+ break;
+
+ td->mutexes[dat] = 2;
+- td->event = atomic_add_return(1, &rttest_event);
++ td->event = atomic_add_return_unchecked(1, &rttest_event);
+ break;
+
+ case RTTEST_LOCKBKL:
+@@ -208,7 +208,7 @@ void schedule_rt_mutex_test(struct rt_mutex *mutex)
+ return;
+
+ td->mutexes[dat] = 3;
+- td->event = atomic_add_return(1, &rttest_event);
++ td->event = atomic_add_return_unchecked(1, &rttest_event);
+ break;
+
+ case RTTEST_LOCKNOWAIT:
+@@ -220,7 +220,7 @@ void schedule_rt_mutex_test(struct rt_mutex *mutex)
+ return;
+
+ td->mutexes[dat] = 1;
+- td->event = atomic_add_return(1, &rttest_event);
++ td->event = atomic_add_return_unchecked(1, &rttest_event);
+ return;
+
+ case RTTEST_LOCKBKL:
+diff --git a/kernel/rtmutex.c b/kernel/rtmutex.c
+index 29bd4ba..8c5de90 100644
+--- a/kernel/rtmutex.c
++++ b/kernel/rtmutex.c
+@@ -511,7 +511,7 @@ static void wakeup_next_waiter(struct rt_mutex *lock)
+ */
+ spin_lock_irqsave(&pendowner->pi_lock, flags);
+
+- WARN_ON(!pendowner->pi_blocked_on);
++ BUG_ON(!pendowner->pi_blocked_on);
+ WARN_ON(pendowner->pi_blocked_on != waiter);
+ WARN_ON(pendowner->pi_blocked_on->lock != lock);
+
+diff --git a/kernel/sched.c b/kernel/sched.c
+index 0591df8..db35e3d 100644
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -5043,7 +5043,7 @@ out:
+ * In CONFIG_NO_HZ case, the idle load balance owner will do the
+ * rebalancing for all the cpus for whom scheduler ticks are stopped.
+ */
+-static void run_rebalance_domains(struct softirq_action *h)
++static void run_rebalance_domains(void)
+ {
+ int this_cpu = smp_processor_id();
+ struct rq *this_rq = cpu_rq(this_cpu);
+@@ -5700,6 +5700,8 @@ asmlinkage void __sched schedule(void)
+ struct rq *rq;
+ int cpu;
+
++ pax_track_stack();
++
+ need_resched:
+ preempt_disable();
+ cpu = smp_processor_id();
+@@ -5770,7 +5772,7 @@ EXPORT_SYMBOL(schedule);
+ * Look out! "owner" is an entirely speculative pointer
+ * access and not reliable.
+ */
+-int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner)
++int mutex_spin_on_owner(struct mutex *lock, struct task_struct *owner)
+ {
+ unsigned int cpu;
+ struct rq *rq;
+@@ -5784,10 +5786,10 @@ int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner)
+ * DEBUG_PAGEALLOC could have unmapped it if
+ * the mutex owner just released it and exited.
+ */
+- if (probe_kernel_address(&owner->cpu, cpu))
++ if (probe_kernel_address(&task_thread_info(owner)->cpu, cpu))
+ return 0;
+ #else
+- cpu = owner->cpu;
++ cpu = task_thread_info(owner)->cpu;
+ #endif
+
+ /*
+@@ -5816,7 +5818,7 @@ int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner)
+ /*
+ * Is that owner really running on that cpu?
+ */
+- if (task_thread_info(rq->curr) != owner || need_resched())
++ if (rq->curr != owner || need_resched())
+ return 0;
+
+ cpu_relax();
+@@ -6359,6 +6361,8 @@ int can_nice(const struct task_struct *p, const int nice)
+ /* convert nice value [19,-20] to rlimit style value [1,40] */
+ int nice_rlim = 20 - nice;
+
++ gr_learn_resource(p, RLIMIT_NICE, nice_rlim, 1);
++
+ return (nice_rlim <= p->signal->rlim[RLIMIT_NICE].rlim_cur ||
+ capable(CAP_SYS_NICE));
+ }
+@@ -6392,7 +6396,8 @@ SYSCALL_DEFINE1(nice, int, increment)
+ if (nice > 19)
+ nice = 19;
+
+- if (increment < 0 && !can_nice(current, nice))
++ if (increment < 0 && (!can_nice(current, nice) ||
++ gr_handle_chroot_nice()))
+ return -EPERM;
+
+ retval = security_task_setnice(current, nice);
+@@ -8774,7 +8779,7 @@ static void init_sched_groups_power(int cpu, struct sched_domain *sd)
+ long power;
+ int weight;
+
+- WARN_ON(!sd || !sd->groups);
++ BUG_ON(!sd || !sd->groups);
+
+ if (cpu != group_first_cpu(sd->groups))
+ return;
+diff --git a/kernel/signal.c b/kernel/signal.c
+index 2494827..cda80a0 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -41,12 +41,12 @@
+
+ static struct kmem_cache *sigqueue_cachep;
+
+-static void __user *sig_handler(struct task_struct *t, int sig)
++static __sighandler_t sig_handler(struct task_struct *t, int sig)
+ {
+ return t->sighand->action[sig - 1].sa.sa_handler;
+ }
+
+-static int sig_handler_ignored(void __user *handler, int sig)
++static int sig_handler_ignored(__sighandler_t handler, int sig)
+ {
+ /* Is it explicitly or implicitly ignored? */
+ return handler == SIG_IGN ||
+@@ -56,7 +56,7 @@ static int sig_handler_ignored(void __user *handler, int sig)
+ static int sig_task_ignored(struct task_struct *t, int sig,
+ int from_ancestor_ns)
+ {
+- void __user *handler;
++ __sighandler_t handler;
+
+ handler = sig_handler(t, sig);
+
+@@ -207,6 +207,9 @@ static struct sigqueue *__sigqueue_alloc(struct task_struct *t, gfp_t flags,
+ */
+ user = get_uid(__task_cred(t)->user);
+ atomic_inc(&user->sigpending);
++
++ if (!override_rlimit)
++ gr_learn_resource(t, RLIMIT_SIGPENDING, atomic_read(&user->sigpending), 1);
+ if (override_rlimit ||
+ atomic_read(&user->sigpending) <=
+ t->signal->rlim[RLIMIT_SIGPENDING].rlim_cur)
+@@ -327,7 +330,7 @@ flush_signal_handlers(struct task_struct *t, int force_default)
+
+ int unhandled_signal(struct task_struct *tsk, int sig)
+ {
+- void __user *handler = tsk->sighand->action[sig-1].sa.sa_handler;
++ __sighandler_t handler = tsk->sighand->action[sig-1].sa.sa_handler;
+ if (is_global_init(tsk))
+ return 1;
+ if (handler != SIG_IGN && handler != SIG_DFL)
+@@ -627,6 +630,13 @@ static int check_kill_permission(int sig, struct siginfo *info,
+ }
+ }
+
++ /* allow glibc communication via tgkill to other threads in our
++ thread group */
++ if ((info == SEND_SIG_NOINFO || info->si_code != SI_TKILL ||
++ sig != (SIGRTMIN+1) || task_tgid_vnr(t) != info->si_pid)
++ && gr_handle_signal(t, sig))
++ return -EPERM;
++
+ return security_task_kill(t, info, sig, 0);
+ }
+
+@@ -968,7 +978,7 @@ __group_send_sig_info(int sig, struct siginfo *info, struct task_struct *p)
+ return send_signal(sig, info, p, 1);
+ }
+
+-static int
++int
+ specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t)
+ {
+ return send_signal(sig, info, t, 0);
+@@ -1005,6 +1015,7 @@ force_sig_info(int sig, struct siginfo *info, struct task_struct *t)
+ unsigned long int flags;
+ int ret, blocked, ignored;
+ struct k_sigaction *action;
++ int is_unhandled = 0;
+
+ spin_lock_irqsave(&t->sighand->siglock, flags);
+ action = &t->sighand->action[sig-1];
+@@ -1019,9 +1030,18 @@ force_sig_info(int sig, struct siginfo *info, struct task_struct *t)
+ }
+ if (action->sa.sa_handler == SIG_DFL)
+ t->signal->flags &= ~SIGNAL_UNKILLABLE;
++ if (action->sa.sa_handler == SIG_IGN || action->sa.sa_handler == SIG_DFL)
++ is_unhandled = 1;
+ ret = specific_send_sig_info(sig, info, t);
+ spin_unlock_irqrestore(&t->sighand->siglock, flags);
+
++ /* only deal with unhandled signals, java etc trigger SIGSEGV during
++ normal operation */
++ if (is_unhandled) {
++ gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, t);
++ gr_handle_crash(t, sig);
++ }
++
+ return ret;
+ }
+
+@@ -1081,8 +1101,11 @@ int group_send_sig_info(int sig, struct siginfo *info, struct task_struct *p)
+ {
+ int ret = check_kill_permission(sig, info, p);
+
+- if (!ret && sig)
++ if (!ret && sig) {
+ ret = do_send_sig_info(sig, info, p, true);
++ if (!ret)
++ gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, p);
++ }
+
+ return ret;
+ }
+@@ -1644,6 +1667,8 @@ void ptrace_notify(int exit_code)
+ {
+ siginfo_t info;
+
++ pax_track_stack();
++
+ BUG_ON((exit_code & (0x7f | ~0xffff)) != SIGTRAP);
+
+ memset(&info, 0, sizeof info);
+@@ -2275,7 +2300,15 @@ do_send_specific(pid_t tgid, pid_t pid, int sig, struct siginfo *info)
+ int error = -ESRCH;
+
+ rcu_read_lock();
+- p = find_task_by_vpid(pid);
++#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
++ /* allow glibc communication via tgkill to other threads in our
++ thread group */
++ if (grsec_enable_chroot_findtask && info->si_code == SI_TKILL &&
++ sig == (SIGRTMIN+1) && tgid == info->si_pid)
++ p = find_task_by_vpid_unrestricted(pid);
++ else
++#endif
++ p = find_task_by_vpid(pid);
+ if (p && (tgid <= 0 || task_tgid_vnr(p) == tgid)) {
+ error = check_kill_permission(sig, info, p);
+ /*
+diff --git a/kernel/smp.c b/kernel/smp.c
+index aa9cff3..631a0de 100644
+--- a/kernel/smp.c
++++ b/kernel/smp.c
+@@ -522,22 +522,22 @@ int smp_call_function(void (*func)(void *), void *info, int wait)
+ }
+ EXPORT_SYMBOL(smp_call_function);
+
+-void ipi_call_lock(void)
++void ipi_call_lock(void) __acquires(call_function.lock)
+ {
+ spin_lock(&call_function.lock);
+ }
+
+-void ipi_call_unlock(void)
++void ipi_call_unlock(void) __releases(call_function.lock)
+ {
+ spin_unlock(&call_function.lock);
+ }
+
+-void ipi_call_lock_irq(void)
++void ipi_call_lock_irq(void) __acquires(call_function.lock)
+ {
+ spin_lock_irq(&call_function.lock);
+ }
+
+-void ipi_call_unlock_irq(void)
++void ipi_call_unlock_irq(void) __releases(call_function.lock)
+ {
+ spin_unlock_irq(&call_function.lock);
+ }
+diff --git a/kernel/softirq.c b/kernel/softirq.c
+index 04a0252..580c512 100644
+--- a/kernel/softirq.c
++++ b/kernel/softirq.c
+@@ -56,7 +56,7 @@ static struct softirq_action softirq_vec[NR_SOFTIRQS] __cacheline_aligned_in_smp
+
+ static DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
+
+-char *softirq_to_name[NR_SOFTIRQS] = {
++const char * const softirq_to_name[NR_SOFTIRQS] = {
+ "HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL",
+ "TASKLET", "SCHED", "HRTIMER", "RCU"
+ };
+@@ -206,7 +206,7 @@ EXPORT_SYMBOL(local_bh_enable_ip);
+
+ asmlinkage void __do_softirq(void)
+ {
+- struct softirq_action *h;
++ const struct softirq_action *h;
+ __u32 pending;
+ int max_restart = MAX_SOFTIRQ_RESTART;
+ int cpu;
+@@ -233,7 +233,7 @@ restart:
+ kstat_incr_softirqs_this_cpu(h - softirq_vec);
+
+ trace_softirq_entry(h, softirq_vec);
+- h->action(h);
++ h->action();
+ trace_softirq_exit(h, softirq_vec);
+ if (unlikely(prev_count != preempt_count())) {
+ printk(KERN_ERR "huh, entered softirq %td %s %p"
+@@ -363,9 +363,11 @@ void raise_softirq(unsigned int nr)
+ local_irq_restore(flags);
+ }
+
+-void open_softirq(int nr, void (*action)(struct softirq_action *))
++void open_softirq(int nr, void (*action)(void))
+ {
+- softirq_vec[nr].action = action;
++ pax_open_kernel();
++ *(void **)&softirq_vec[nr].action = action;
++ pax_close_kernel();
+ }
+
+ /*
+@@ -419,7 +421,7 @@ void __tasklet_hi_schedule_first(struct tasklet_struct *t)
+
+ EXPORT_SYMBOL(__tasklet_hi_schedule_first);
+
+-static void tasklet_action(struct softirq_action *a)
++static void tasklet_action(void)
+ {
+ struct tasklet_struct *list;
+
+@@ -454,7 +456,7 @@ static void tasklet_action(struct softirq_action *a)
+ }
+ }
+
+-static void tasklet_hi_action(struct softirq_action *a)
++static void tasklet_hi_action(void)
+ {
+ struct tasklet_struct *list;
+
+diff --git a/kernel/sys.c b/kernel/sys.c
+index e9512b1..f07185f 100644
+--- a/kernel/sys.c
++++ b/kernel/sys.c
+@@ -133,6 +133,12 @@ static int set_one_prio(struct task_struct *p, int niceval, int error)
+ error = -EACCES;
+ goto out;
+ }
++
++ if (gr_handle_chroot_setpriority(p, niceval)) {
++ error = -EACCES;
++ goto out;
++ }
++
+ no_nice = security_task_setnice(p, niceval);
+ if (no_nice) {
+ error = no_nice;
+@@ -190,10 +196,10 @@ SYSCALL_DEFINE3(setpriority, int, which, int, who, int, niceval)
+ !(user = find_user(who)))
+ goto out_unlock; /* No processes for this user */
+
+- do_each_thread(g, p)
++ do_each_thread(g, p) {
+ if (__task_cred(p)->uid == who)
+ error = set_one_prio(p, niceval, error);
+- while_each_thread(g, p);
++ } while_each_thread(g, p);
+ if (who != cred->uid)
+ free_uid(user); /* For find_user() */
+ break;
+@@ -253,13 +259,13 @@ SYSCALL_DEFINE2(getpriority, int, which, int, who)
+ !(user = find_user(who)))
+ goto out_unlock; /* No processes for this user */
+
+- do_each_thread(g, p)
++ do_each_thread(g, p) {
+ if (__task_cred(p)->uid == who) {
+ niceval = 20 - task_nice(p);
+ if (niceval > retval)
+ retval = niceval;
+ }
+- while_each_thread(g, p);
++ } while_each_thread(g, p);
+ if (who != cred->uid)
+ free_uid(user); /* for find_user() */
+ break;
+@@ -509,6 +515,9 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, gid_t, egid)
+ goto error;
+ }
+
++ if (gr_check_group_change(new->gid, new->egid, -1))
++ goto error;
++
+ if (rgid != (gid_t) -1 ||
+ (egid != (gid_t) -1 && egid != old->gid))
+ new->sgid = new->egid;
+@@ -542,6 +551,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
+ goto error;
+
+ retval = -EPERM;
++
++ if (gr_check_group_change(gid, gid, gid))
++ goto error;
++
+ if (capable(CAP_SETGID))
+ new->gid = new->egid = new->sgid = new->fsgid = gid;
+ else if (gid == old->gid || gid == old->sgid)
+@@ -559,7 +572,7 @@ error:
+ /*
+ * change the user struct in a credentials set to match the new UID
+ */
+-static int set_user(struct cred *new)
++int set_user(struct cred *new)
+ {
+ struct user_struct *new_user;
+
+@@ -567,12 +580,19 @@ static int set_user(struct cred *new)
+ if (!new_user)
+ return -EAGAIN;
+
++ /*
++ * We don't fail in case of NPROC limit excess here because too many
++ * poorly written programs don't check set*uid() return code, assuming
++ * it never fails if called by root. We may still enforce NPROC limit
++ * for programs doing set*uid()+execve() by harmlessly deferring the
++ * failure to the execve() stage.
++ */
+ if (atomic_read(&new_user->processes) >=
+ current->signal->rlim[RLIMIT_NPROC].rlim_cur &&
+- new_user != INIT_USER) {
+- free_uid(new_user);
+- return -EAGAIN;
+- }
++ new_user != INIT_USER)
++ current->flags |= PF_NPROC_EXCEEDED;
++ else
++ current->flags &= ~PF_NPROC_EXCEEDED;
+
+ free_uid(new->user);
+ new->user = new_user;
+@@ -627,6 +647,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, uid_t, euid)
+ goto error;
+ }
+
++ if (gr_check_user_change(new->uid, new->euid, -1))
++ goto error;
++
+ if (new->uid != old->uid) {
+ retval = set_user(new);
+ if (retval < 0)
+@@ -675,6 +698,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
+ goto error;
+
+ retval = -EPERM;
++
++ if (gr_check_crash_uid(uid))
++ goto error;
++ if (gr_check_user_change(uid, uid, uid))
++ goto error;
++
+ if (capable(CAP_SETUID)) {
+ new->suid = new->uid = uid;
+ if (uid != old->uid) {
+@@ -732,6 +761,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid, uid_t, euid, uid_t, suid)
+ goto error;
+ }
+
++ if (gr_check_user_change(ruid, euid, -1))
++ goto error;
++
+ if (ruid != (uid_t) -1) {
+ new->uid = ruid;
+ if (ruid != old->uid) {
+@@ -800,6 +832,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid, gid_t, egid, gid_t, sgid)
+ goto error;
+ }
+
++ if (gr_check_group_change(rgid, egid, -1))
++ goto error;
++
+ if (rgid != (gid_t) -1)
+ new->gid = rgid;
+ if (egid != (gid_t) -1)
+@@ -849,6 +884,9 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
+ if (security_task_setuid(uid, (uid_t)-1, (uid_t)-1, LSM_SETID_FS) < 0)
+ goto error;
+
++ if (gr_check_user_change(-1, -1, uid))
++ goto error;
++
+ if (uid == old->uid || uid == old->euid ||
+ uid == old->suid || uid == old->fsuid ||
+ capable(CAP_SETUID)) {
+@@ -889,6 +927,9 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
+ if (gid == old->gid || gid == old->egid ||
+ gid == old->sgid || gid == old->fsgid ||
+ capable(CAP_SETGID)) {
++ if (gr_check_group_change(-1, -1, gid))
++ goto error;
++
+ if (gid != old_fsgid) {
+ new->fsgid = gid;
+ goto change_okay;
+@@ -1454,7 +1495,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
+ error = get_dumpable(me->mm);
+ break;
+ case PR_SET_DUMPABLE:
+- if (arg2 < 0 || arg2 > 1) {
++ if (arg2 > 1) {
+ error = -EINVAL;
+ break;
+ }
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index b8bd058..ab6a76be 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -63,6 +63,13 @@
+ static int deprecated_sysctl_warning(struct __sysctl_args *args);
+
+ #if defined(CONFIG_SYSCTL)
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++extern __u32 gr_handle_sysctl(const ctl_table *table, const int op);
++extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
++ const int op);
++extern int gr_handle_chroot_sysctl(const int op);
+
+ /* External variables not in a header file. */
+ extern int C_A_D;
+@@ -168,6 +175,7 @@ static int proc_do_cad_pid(struct ctl_table *table, int write,
+ static int proc_taint(struct ctl_table *table, int write,
+ void __user *buffer, size_t *lenp, loff_t *ppos);
+ #endif
++extern ctl_table grsecurity_table[];
+
+ static struct ctl_table root_table[];
+ static struct ctl_table_root sysctl_table_root;
+@@ -200,6 +208,21 @@ extern struct ctl_table epoll_table[];
+ int sysctl_legacy_va_layout;
+ #endif
+
++#ifdef CONFIG_PAX_SOFTMODE
++static ctl_table pax_table[] = {
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "softmode",
++ .data = &pax_softmode,
++ .maxlen = sizeof(unsigned int),
++ .mode = 0600,
++ .proc_handler = &proc_dointvec,
++ },
++
++ { .ctl_name = 0 }
++};
++#endif
++
+ extern int prove_locking;
+ extern int lock_stat;
+
+@@ -251,6 +274,24 @@ static int max_wakeup_granularity_ns = NSEC_PER_SEC; /* 1 second */
+ #endif
+
+ static struct ctl_table kern_table[] = {
++#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "grsecurity",
++ .mode = 0500,
++ .child = grsecurity_table,
++ },
++#endif
++
++#ifdef CONFIG_PAX_SOFTMODE
++ {
++ .ctl_name = CTL_UNNUMBERED,
++ .procname = "pax",
++ .mode = 0500,
++ .child = pax_table,
++ },
++#endif
++
+ {
+ .ctl_name = CTL_UNNUMBERED,
+ .procname = "sched_child_runs_first",
+@@ -567,8 +608,8 @@ static struct ctl_table kern_table[] = {
+ .data = &modprobe_path,
+ .maxlen = KMOD_PATH_LEN,
+ .mode = 0644,
+- .proc_handler = &proc_dostring,
+- .strategy = &sysctl_string,
++ .proc_handler = &proc_dostring_modpriv,
++ .strategy = &sysctl_string_modpriv,
+ },
+ {
+ .ctl_name = CTL_UNNUMBERED,
+@@ -1247,6 +1288,13 @@ static struct ctl_table vm_table[] = {
+ .mode = 0644,
+ .proc_handler = &proc_dointvec
+ },
++ {
++ .procname = "heap_stack_gap",
++ .data = &sysctl_heap_stack_gap,
++ .maxlen = sizeof(sysctl_heap_stack_gap),
++ .mode = 0644,
++ .proc_handler = proc_doulongvec_minmax,
++ },
+ #else
+ {
+ .ctl_name = CTL_UNNUMBERED,
+@@ -1803,6 +1851,8 @@ static int do_sysctl_strategy(struct ctl_table_root *root,
+ return 0;
+ }
+
++static int sysctl_perm_nochk(struct ctl_table_root *root, struct ctl_table *table, int op);
++
+ static int parse_table(int __user *name, int nlen,
+ void __user *oldval, size_t __user *oldlenp,
+ void __user *newval, size_t newlen,
+@@ -1821,7 +1871,7 @@ repeat:
+ if (n == table->ctl_name) {
+ int error;
+ if (table->child) {
+- if (sysctl_perm(root, table, MAY_EXEC))
++ if (sysctl_perm_nochk(root, table, MAY_EXEC))
+ return -EPERM;
+ name++;
+ nlen--;
+@@ -1906,6 +1956,33 @@ int sysctl_perm(struct ctl_table_root *root, struct ctl_table *table, int op)
+ int error;
+ int mode;
+
++ if (table->parent != NULL && table->parent->procname != NULL &&
++ table->procname != NULL &&
++ gr_handle_sysctl_mod(table->parent->procname, table->procname, op))
++ return -EACCES;
++ if (gr_handle_chroot_sysctl(op))
++ return -EACCES;
++ error = gr_handle_sysctl(table, op);
++ if (error)
++ return error;
++
++ error = security_sysctl(table, op & (MAY_READ | MAY_WRITE | MAY_EXEC));
++ if (error)
++ return error;
++
++ if (root->permissions)
++ mode = root->permissions(root, current->nsproxy, table);
++ else
++ mode = table->mode;
++
++ return test_perm(mode, op);
++}
++
++int sysctl_perm_nochk(struct ctl_table_root *root, struct ctl_table *table, int op)
++{
++ int error;
++ int mode;
++
+ error = security_sysctl(table, op & (MAY_READ | MAY_WRITE | MAY_EXEC));
+ if (error)
+ return error;
+@@ -2335,6 +2412,16 @@ int proc_dostring(struct ctl_table *table, int write,
+ buffer, lenp, ppos);
+ }
+
++int proc_dostring_modpriv(struct ctl_table *table, int write,
++ void __user *buffer, size_t *lenp, loff_t *ppos)
++{
++ if (write && !capable(CAP_SYS_MODULE))
++ return -EPERM;
++
++ return _proc_do_string(table->data, table->maxlen, write,
++ buffer, lenp, ppos);
++}
++
+
+ static int do_proc_dointvec_conv(int *negp, unsigned long *lvalp,
+ int *valp,
+@@ -2609,7 +2696,7 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
+ vleft = table->maxlen / sizeof(unsigned long);
+ left = *lenp;
+
+- for (; left && vleft--; i++, min++, max++, first=0) {
++ for (; left && vleft--; i++, first=0) {
+ if (write) {
+ while (left) {
+ char c;
+@@ -2910,6 +2997,12 @@ int proc_dostring(struct ctl_table *table, int write,
+ return -ENOSYS;
+ }
+
++int proc_dostring_modpriv(struct ctl_table *table, int write,
++ void __user *buffer, size_t *lenp, loff_t *ppos)
++{
++ return -ENOSYS;
++}
++
+ int proc_dointvec(struct ctl_table *table, int write,
+ void __user *buffer, size_t *lenp, loff_t *ppos)
+ {
+@@ -3038,6 +3131,16 @@ int sysctl_string(struct ctl_table *table,
+ return 1;
+ }
+
++int sysctl_string_modpriv(struct ctl_table *table,
++ void __user *oldval, size_t __user *oldlenp,
++ void __user *newval, size_t newlen)
++{
++ if (newval && newlen && !capable(CAP_SYS_MODULE))
++ return -EPERM;
++
++ return sysctl_string(table, oldval, oldlenp, newval, newlen);
++}
++
+ /*
+ * This function makes sure that all of the integers in the vector
+ * are between the minimum and maximum values given in the arrays
+@@ -3182,6 +3285,13 @@ int sysctl_string(struct ctl_table *table,
+ return -ENOSYS;
+ }
+
++int sysctl_string_modpriv(struct ctl_table *table,
++ void __user *oldval, size_t __user *oldlenp,
++ void __user *newval, size_t newlen)
++{
++ return -ENOSYS;
++}
++
+ int sysctl_intvec(struct ctl_table *table,
+ void __user *oldval, size_t __user *oldlenp,
+ void __user *newval, size_t newlen)
+@@ -3246,6 +3356,7 @@ EXPORT_SYMBOL(proc_dointvec_minmax);
+ EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
+ EXPORT_SYMBOL(proc_dointvec_ms_jiffies);
+ EXPORT_SYMBOL(proc_dostring);
++EXPORT_SYMBOL(proc_dostring_modpriv);
+ EXPORT_SYMBOL(proc_doulongvec_minmax);
+ EXPORT_SYMBOL(proc_doulongvec_ms_jiffies_minmax);
+ EXPORT_SYMBOL(register_sysctl_table);
+@@ -3254,5 +3365,6 @@ EXPORT_SYMBOL(sysctl_intvec);
+ EXPORT_SYMBOL(sysctl_jiffies);
+ EXPORT_SYMBOL(sysctl_ms_jiffies);
+ EXPORT_SYMBOL(sysctl_string);
++EXPORT_SYMBOL(sysctl_string_modpriv);
+ EXPORT_SYMBOL(sysctl_data);
+ EXPORT_SYMBOL(unregister_sysctl_table);
+diff --git a/kernel/sysctl_check.c b/kernel/sysctl_check.c
+index 469193c..ea3ecb2 100644
+--- a/kernel/sysctl_check.c
++++ b/kernel/sysctl_check.c
+@@ -1489,10 +1489,12 @@ int sysctl_check_table(struct nsproxy *namespaces, struct ctl_table *table)
+ } else {
+ if ((table->strategy == sysctl_data) ||
+ (table->strategy == sysctl_string) ||
++ (table->strategy == sysctl_string_modpriv) ||
+ (table->strategy == sysctl_intvec) ||
+ (table->strategy == sysctl_jiffies) ||
+ (table->strategy == sysctl_ms_jiffies) ||
+ (table->proc_handler == proc_dostring) ||
++ (table->proc_handler == proc_dostring_modpriv) ||
+ (table->proc_handler == proc_dointvec) ||
+ (table->proc_handler == proc_dointvec_minmax) ||
+ (table->proc_handler == proc_dointvec_jiffies) ||
+diff --git a/kernel/taskstats.c b/kernel/taskstats.c
+index a4ef542..798bcd7 100644
+--- a/kernel/taskstats.c
++++ b/kernel/taskstats.c
+@@ -26,9 +26,12 @@
+ #include <linux/cgroup.h>
+ #include <linux/fs.h>
+ #include <linux/file.h>
++#include <linux/grsecurity.h>
+ #include <net/genetlink.h>
+ #include <asm/atomic.h>
+
++extern int gr_is_taskstats_denied(int pid);
++
+ /*
+ * Maximum length of a cpumask that can be specified in
+ * the TASKSTATS_CMD_ATTR_REGISTER/DEREGISTER_CPUMASK attribute
+@@ -442,6 +445,9 @@ static int taskstats_user_cmd(struct sk_buff *skb, struct genl_info *info)
+ size_t size;
+ cpumask_var_t mask;
+
++ if (gr_is_taskstats_denied(current->pid))
++ return -EACCES;
++
+ if (!alloc_cpumask_var(&mask, GFP_KERNEL))
+ return -ENOMEM;
+
+diff --git a/kernel/time.c b/kernel/time.c
+index 33df60e..ca768bd 100644
+--- a/kernel/time.c
++++ b/kernel/time.c
+@@ -165,6 +165,11 @@ int do_sys_settimeofday(struct timespec *tv, struct timezone *tz)
+ return error;
+
+ if (tz) {
++ /* we log in do_settimeofday called below, so don't log twice
++ */
++ if (!tv)
++ gr_log_timechange();
++
+ /* SMP safe, global irq locking makes it work. */
+ sys_tz = *tz;
+ update_vsyscall_tz();
+@@ -240,7 +245,7 @@ EXPORT_SYMBOL(current_fs_time);
+ * Avoid unnecessary multiplications/divisions in the
+ * two most common HZ cases:
+ */
+-unsigned int inline jiffies_to_msecs(const unsigned long j)
++inline unsigned int jiffies_to_msecs(const unsigned long j)
+ {
+ #if HZ <= MSEC_PER_SEC && !(MSEC_PER_SEC % HZ)
+ return (MSEC_PER_SEC / HZ) * j;
+@@ -256,7 +261,7 @@ unsigned int inline jiffies_to_msecs(const unsigned long j)
+ }
+ EXPORT_SYMBOL(jiffies_to_msecs);
+
+-unsigned int inline jiffies_to_usecs(const unsigned long j)
++inline unsigned int jiffies_to_usecs(const unsigned long j)
+ {
+ #if HZ <= USEC_PER_SEC && !(USEC_PER_SEC % HZ)
+ return (USEC_PER_SEC / HZ) * j;
+diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
+index 57b953f..06f149f 100644
+--- a/kernel/time/tick-broadcast.c
++++ b/kernel/time/tick-broadcast.c
+@@ -116,7 +116,7 @@ int tick_device_uses_broadcast(struct clock_event_device *dev, int cpu)
+ * then clear the broadcast bit.
+ */
+ if (!(dev->features & CLOCK_EVT_FEAT_C3STOP)) {
+- int cpu = smp_processor_id();
++ cpu = smp_processor_id();
+
+ cpumask_clear_cpu(cpu, tick_get_broadcast_mask());
+ tick_broadcast_clear_oneshot(cpu);
+diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
+index 4a71cff..ffb5548 100644
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -14,6 +14,7 @@
+ #include <linux/init.h>
+ #include <linux/mm.h>
+ #include <linux/sched.h>
++#include <linux/grsecurity.h>
+ #include <linux/sysdev.h>
+ #include <linux/clocksource.h>
+ #include <linux/jiffies.h>
+@@ -180,7 +181,7 @@ void update_xtime_cache(u64 nsec)
+ */
+ struct timespec ts = xtime;
+ timespec_add_ns(&ts, nsec);
+- ACCESS_ONCE(xtime_cache) = ts;
++ ACCESS_ONCE_RW(xtime_cache) = ts;
+ }
+
+ /* must hold xtime_lock */
+@@ -337,6 +338,8 @@ int do_settimeofday(struct timespec *tv)
+ if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC)
+ return -EINVAL;
+
++ gr_log_timechange();
++
+ write_seqlock_irqsave(&xtime_lock, flags);
+
+ timekeeping_forward_now();
+diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c
+index 54c0dda..e9095d9 100644
+--- a/kernel/time/timer_list.c
++++ b/kernel/time/timer_list.c
+@@ -38,12 +38,16 @@ DECLARE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases);
+
+ static void print_name_offset(struct seq_file *m, void *sym)
+ {
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ SEQ_printf(m, "<%p>", NULL);
++#else
+ char symname[KSYM_NAME_LEN];
+
+ if (lookup_symbol_name((unsigned long)sym, symname) < 0)
+ SEQ_printf(m, "<%p>", sym);
+ else
+ SEQ_printf(m, "%s", symname);
++#endif
+ }
+
+ static void
+@@ -112,7 +116,11 @@ next_one:
+ static void
+ print_base(struct seq_file *m, struct hrtimer_clock_base *base, u64 now)
+ {
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ SEQ_printf(m, " .base: %p\n", NULL);
++#else
+ SEQ_printf(m, " .base: %p\n", base);
++#endif
+ SEQ_printf(m, " .index: %d\n",
+ base->index);
+ SEQ_printf(m, " .resolution: %Lu nsecs\n",
+@@ -289,7 +297,11 @@ static int __init init_timer_list_procfs(void)
+ {
+ struct proc_dir_entry *pe;
+
++#ifdef CONFIG_GRKERNSEC_PROC_ADD
++ pe = proc_create("timer_list", 0400, NULL, &timer_list_fops);
++#else
+ pe = proc_create("timer_list", 0444, NULL, &timer_list_fops);
++#endif
+ if (!pe)
+ return -ENOMEM;
+ return 0;
+diff --git a/kernel/time/timer_stats.c b/kernel/time/timer_stats.c
+index ee5681f..634089b 100644
+--- a/kernel/time/timer_stats.c
++++ b/kernel/time/timer_stats.c
+@@ -116,7 +116,7 @@ static ktime_t time_start, time_stop;
+ static unsigned long nr_entries;
+ static struct entry entries[MAX_ENTRIES];
+
+-static atomic_t overflow_count;
++static atomic_unchecked_t overflow_count;
+
+ /*
+ * The entries are in a hash-table, for fast lookup:
+@@ -140,7 +140,7 @@ static void reset_entries(void)
+ nr_entries = 0;
+ memset(entries, 0, sizeof(entries));
+ memset(tstat_hash_table, 0, sizeof(tstat_hash_table));
+- atomic_set(&overflow_count, 0);
++ atomic_set_unchecked(&overflow_count, 0);
+ }
+
+ static struct entry *alloc_entry(void)
+@@ -261,7 +261,7 @@ void timer_stats_update_stats(void *timer, pid_t pid, void *startf,
+ if (likely(entry))
+ entry->count++;
+ else
+- atomic_inc(&overflow_count);
++ atomic_inc_unchecked(&overflow_count);
+
+ out_unlock:
+ spin_unlock_irqrestore(lock, flags);
+@@ -269,12 +269,16 @@ void timer_stats_update_stats(void *timer, pid_t pid, void *startf,
+
+ static void print_name_offset(struct seq_file *m, unsigned long addr)
+ {
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ seq_printf(m, "<%p>", NULL);
++#else
+ char symname[KSYM_NAME_LEN];
+
+ if (lookup_symbol_name(addr, symname) < 0)
+ seq_printf(m, "<%p>", (void *)addr);
+ else
+ seq_printf(m, "%s", symname);
++#endif
+ }
+
+ static int tstats_show(struct seq_file *m, void *v)
+@@ -300,9 +304,9 @@ static int tstats_show(struct seq_file *m, void *v)
+
+ seq_puts(m, "Timer Stats Version: v0.2\n");
+ seq_printf(m, "Sample period: %ld.%03ld s\n", period.tv_sec, ms);
+- if (atomic_read(&overflow_count))
++ if (atomic_read_unchecked(&overflow_count))
+ seq_printf(m, "Overflow: %d entries\n",
+- atomic_read(&overflow_count));
++ atomic_read_unchecked(&overflow_count));
+
+ for (i = 0; i < nr_entries; i++) {
+ entry = entries + i;
+@@ -415,7 +419,11 @@ static int __init init_tstats_procfs(void)
+ {
+ struct proc_dir_entry *pe;
+
++#ifdef CONFIG_GRKERNSEC_PROC_ADD
++ pe = proc_create("timer_stats", 0600, NULL, &tstats_fops);
++#else
+ pe = proc_create("timer_stats", 0644, NULL, &tstats_fops);
++#endif
+ if (!pe)
+ return -ENOMEM;
+ return 0;
+diff --git a/kernel/timer.c b/kernel/timer.c
+index cb3c1f1..8bf5526 100644
+--- a/kernel/timer.c
++++ b/kernel/timer.c
+@@ -1213,7 +1213,7 @@ void update_process_times(int user_tick)
+ /*
+ * This function runs timers and the timer-tq in bottom half context.
+ */
+-static void run_timer_softirq(struct softirq_action *h)
++static void run_timer_softirq(void)
+ {
+ struct tvec_base *base = __get_cpu_var(tvec_bases);
+
+diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
+index d9d6206..f19467e 100644
+--- a/kernel/trace/blktrace.c
++++ b/kernel/trace/blktrace.c
+@@ -313,7 +313,7 @@ static ssize_t blk_dropped_read(struct file *filp, char __user *buffer,
+ struct blk_trace *bt = filp->private_data;
+ char buf[16];
+
+- snprintf(buf, sizeof(buf), "%u\n", atomic_read(&bt->dropped));
++ snprintf(buf, sizeof(buf), "%u\n", atomic_read_unchecked(&bt->dropped));
+
+ return simple_read_from_buffer(buffer, count, ppos, buf, strlen(buf));
+ }
+@@ -376,7 +376,7 @@ static int blk_subbuf_start_callback(struct rchan_buf *buf, void *subbuf,
+ return 1;
+
+ bt = buf->chan->private_data;
+- atomic_inc(&bt->dropped);
++ atomic_inc_unchecked(&bt->dropped);
+ return 0;
+ }
+
+@@ -477,7 +477,7 @@ int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
+
+ bt->dir = dir;
+ bt->dev = dev;
+- atomic_set(&bt->dropped, 0);
++ atomic_set_unchecked(&bt->dropped, 0);
+
+ ret = -EIO;
+ bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt,
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 4872937..c794d40 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -1100,13 +1100,18 @@ ftrace_code_disable(struct module *mod, struct dyn_ftrace *rec)
+
+ ip = rec->ip;
+
++ ret = ftrace_arch_code_modify_prepare();
++ FTRACE_WARN_ON(ret);
++ if (ret)
++ return 0;
++
+ ret = ftrace_make_nop(mod, rec, MCOUNT_ADDR);
++ FTRACE_WARN_ON(ftrace_arch_code_modify_post_process());
+ if (ret) {
+ ftrace_bug(ret, ip);
+ rec->flags |= FTRACE_FL_FAILED;
+- return 0;
+ }
+- return 1;
++ return ret ? 0 : 1;
+ }
+
+ /*
+diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
+index e749a05..19c6e94 100644
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -606,7 +606,7 @@ static struct list_head *rb_list_head(struct list_head *list)
+ * the reader page). But if the next page is a header page,
+ * its flags will be non zero.
+ */
+-static int inline
++static inline int
+ rb_is_head_page(struct ring_buffer_per_cpu *cpu_buffer,
+ struct buffer_page *page, struct list_head *list)
+ {
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index a2a2d1f..7f32b09 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -3193,6 +3193,8 @@ static ssize_t tracing_splice_read_pipe(struct file *filp,
+ size_t rem;
+ unsigned int i;
+
++ pax_track_stack();
++
+ /* copy the tracer to avoid using a global lock all around */
+ mutex_lock(&trace_types_lock);
+ if (unlikely(old_tracer != current_trace && current_trace)) {
+@@ -3659,6 +3661,8 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
+ int entries, size, i;
+ size_t ret;
+
++ pax_track_stack();
++
+ if (*ppos & (PAGE_SIZE - 1)) {
+ WARN_ONCE(1, "Ftrace: previous read must page-align\n");
+ return -EINVAL;
+@@ -3816,10 +3820,9 @@ static const struct file_operations tracing_dyn_info_fops = {
+ };
+ #endif
+
+-static struct dentry *d_tracer;
+-
+ struct dentry *tracing_init_dentry(void)
+ {
++ static struct dentry *d_tracer;
+ static int once;
+
+ if (d_tracer)
+@@ -3839,10 +3842,9 @@ struct dentry *tracing_init_dentry(void)
+ return d_tracer;
+ }
+
+-static struct dentry *d_percpu;
+-
+ struct dentry *tracing_dentry_percpu(void)
+ {
++ static struct dentry *d_percpu;
+ static int once;
+ struct dentry *d_tracer;
+
+diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
+index d128f65..f37b4af 100644
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -951,13 +951,10 @@ static LIST_HEAD(ftrace_module_file_list);
+ * Modules must own their file_operations to keep up with
+ * reference counting.
+ */
++
+ struct ftrace_module_file_ops {
+ struct list_head list;
+ struct module *mod;
+- struct file_operations id;
+- struct file_operations enable;
+- struct file_operations format;
+- struct file_operations filter;
+ };
+
+ static void remove_subsystem_dir(const char *name)
+@@ -1004,17 +1001,12 @@ trace_create_file_ops(struct module *mod)
+
+ file_ops->mod = mod;
+
+- file_ops->id = ftrace_event_id_fops;
+- file_ops->id.owner = mod;
+-
+- file_ops->enable = ftrace_enable_fops;
+- file_ops->enable.owner = mod;
+-
+- file_ops->filter = ftrace_event_filter_fops;
+- file_ops->filter.owner = mod;
+-
+- file_ops->format = ftrace_event_format_fops;
+- file_ops->format.owner = mod;
++ pax_open_kernel();
++ *(void **)&mod->trace_id.owner = mod;
++ *(void **)&mod->trace_enable.owner = mod;
++ *(void **)&mod->trace_filter.owner = mod;
++ *(void **)&mod->trace_format.owner = mod;
++ pax_close_kernel();
+
+ list_add(&file_ops->list, &ftrace_module_file_list);
+
+@@ -1063,8 +1055,8 @@ static void trace_module_add_events(struct module *mod)
+ call->mod = mod;
+ list_add(&call->list, &ftrace_events);
+ event_create_dir(call, d_events,
+- &file_ops->id, &file_ops->enable,
+- &file_ops->filter, &file_ops->format);
++ &mod->trace_id, &mod->trace_enable,
++ &mod->trace_filter, &mod->trace_format);
+ }
+ }
+
+diff --git a/kernel/trace/trace_mmiotrace.c b/kernel/trace/trace_mmiotrace.c
+index 0acd834..b800b56 100644
+--- a/kernel/trace/trace_mmiotrace.c
++++ b/kernel/trace/trace_mmiotrace.c
+@@ -23,7 +23,7 @@ struct header_iter {
+ static struct trace_array *mmio_trace_array;
+ static bool overrun_detected;
+ static unsigned long prev_overruns;
+-static atomic_t dropped_count;
++static atomic_unchecked_t dropped_count;
+
+ static void mmio_reset_data(struct trace_array *tr)
+ {
+@@ -126,7 +126,7 @@ static void mmio_close(struct trace_iterator *iter)
+
+ static unsigned long count_overruns(struct trace_iterator *iter)
+ {
+- unsigned long cnt = atomic_xchg(&dropped_count, 0);
++ unsigned long cnt = atomic_xchg_unchecked(&dropped_count, 0);
+ unsigned long over = ring_buffer_overruns(iter->tr->buffer);
+
+ if (over > prev_overruns)
+@@ -316,7 +316,7 @@ static void __trace_mmiotrace_rw(struct trace_array *tr,
+ event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_RW,
+ sizeof(*entry), 0, pc);
+ if (!event) {
+- atomic_inc(&dropped_count);
++ atomic_inc_unchecked(&dropped_count);
+ return;
+ }
+ entry = ring_buffer_event_data(event);
+@@ -346,7 +346,7 @@ static void __trace_mmiotrace_map(struct trace_array *tr,
+ event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_MAP,
+ sizeof(*entry), 0, pc);
+ if (!event) {
+- atomic_inc(&dropped_count);
++ atomic_inc_unchecked(&dropped_count);
+ return;
+ }
+ entry = ring_buffer_event_data(event);
+diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
+index b6c12c6..41fdc53 100644
+--- a/kernel/trace/trace_output.c
++++ b/kernel/trace/trace_output.c
+@@ -237,7 +237,7 @@ int trace_seq_path(struct trace_seq *s, struct path *path)
+ return 0;
+ p = d_path(path, s->buffer + s->len, PAGE_SIZE - s->len);
+ if (!IS_ERR(p)) {
+- p = mangle_path(s->buffer + s->len, p, "\n");
++ p = mangle_path(s->buffer + s->len, p, "\n\\");
+ if (p) {
+ s->len = p - s->buffer;
+ return 1;
+diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
+index 8504ac7..ecf0adb 100644
+--- a/kernel/trace/trace_stack.c
++++ b/kernel/trace/trace_stack.c
+@@ -50,7 +50,7 @@ static inline void check_stack(void)
+ return;
+
+ /* we do not handle interrupt stacks yet */
+- if (!object_is_on_stack(&this_size))
++ if (!object_starts_on_stack(&this_size))
+ return;
+
+ local_irq_save(flags);
+diff --git a/kernel/trace/trace_workqueue.c b/kernel/trace/trace_workqueue.c
+index 40cafb0..d5ead43 100644
+--- a/kernel/trace/trace_workqueue.c
++++ b/kernel/trace/trace_workqueue.c
+@@ -21,7 +21,7 @@ struct cpu_workqueue_stats {
+ int cpu;
+ pid_t pid;
+ /* Can be inserted from interrupt or user context, need to be atomic */
+- atomic_t inserted;
++ atomic_unchecked_t inserted;
+ /*
+ * Don't need to be atomic, works are serialized in a single workqueue thread
+ * on a single CPU.
+@@ -58,7 +58,7 @@ probe_workqueue_insertion(struct task_struct *wq_thread,
+ spin_lock_irqsave(&workqueue_cpu_stat(cpu)->lock, flags);
+ list_for_each_entry(node, &workqueue_cpu_stat(cpu)->list, list) {
+ if (node->pid == wq_thread->pid) {
+- atomic_inc(&node->inserted);
++ atomic_inc_unchecked(&node->inserted);
+ goto found;
+ }
+ }
+@@ -205,7 +205,7 @@ static int workqueue_stat_show(struct seq_file *s, void *p)
+ tsk = get_pid_task(pid, PIDTYPE_PID);
+ if (tsk) {
+ seq_printf(s, "%3d %6d %6u %s\n", cws->cpu,
+- atomic_read(&cws->inserted), cws->executed,
++ atomic_read_unchecked(&cws->inserted), cws->executed,
+ tsk->comm);
+ put_task_struct(tsk);
+ }
+diff --git a/kernel/user.c b/kernel/user.c
+index 1b91701..8795237 100644
+--- a/kernel/user.c
++++ b/kernel/user.c
+@@ -159,6 +159,7 @@ struct user_struct *alloc_uid(struct user_namespace *ns, uid_t uid)
+ spin_lock_irq(&uidhash_lock);
+ up = uid_hash_find(uid, hashent);
+ if (up) {
++ put_user_ns(ns);
+ key_put(new->uid_keyring);
+ key_put(new->session_keyring);
+ kmem_cache_free(uid_cachep, new);
+diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
+index 234ceb1..ad74049 100644
+--- a/lib/Kconfig.debug
++++ b/lib/Kconfig.debug
+@@ -905,7 +905,7 @@ config LATENCYTOP
+ select STACKTRACE
+ select SCHEDSTATS
+ select SCHED_DEBUG
+- depends on HAVE_LATENCYTOP_SUPPORT
++ depends on HAVE_LATENCYTOP_SUPPORT && !GRKERNSEC_HIDESYM
+ help
+ Enable this option if you want to use the LatencyTOP tool
+ to find out which userspace is blocking on what kernel operations.
+diff --git a/lib/bitmap.c b/lib/bitmap.c
+index 7025658..8d14cab 100644
+--- a/lib/bitmap.c
++++ b/lib/bitmap.c
+@@ -341,7 +341,7 @@ int __bitmap_parse(const char *buf, unsigned int buflen,
+ {
+ int c, old_c, totaldigits, ndigits, nchunks, nbits;
+ u32 chunk;
+- const char __user *ubuf = buf;
++ const char __user *ubuf = (const char __force_user *)buf;
+
+ bitmap_zero(maskp, nmaskbits);
+
+@@ -426,7 +426,7 @@ int bitmap_parse_user(const char __user *ubuf,
+ {
+ if (!access_ok(VERIFY_READ, ubuf, ulen))
+ return -EFAULT;
+- return __bitmap_parse((const char *)ubuf, ulen, 1, maskp, nmaskbits);
++ return __bitmap_parse((const char __force_kernel *)ubuf, ulen, 1, maskp, nmaskbits);
+ }
+ EXPORT_SYMBOL(bitmap_parse_user);
+
+diff --git a/lib/bug.c b/lib/bug.c
+index 300e41a..2779eb0 100644
+--- a/lib/bug.c
++++ b/lib/bug.c
+@@ -135,6 +135,8 @@ enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs)
+ return BUG_TRAP_TYPE_NONE;
+
+ bug = find_bug(bugaddr);
++ if (!bug)
++ return BUG_TRAP_TYPE_NONE;
+
+ printk(KERN_EMERG "------------[ cut here ]------------\n");
+
+diff --git a/lib/debugobjects.c b/lib/debugobjects.c
+index 2b413db..e21d207 100644
+--- a/lib/debugobjects.c
++++ b/lib/debugobjects.c
+@@ -277,7 +277,7 @@ static void debug_object_is_on_stack(void *addr, int onstack)
+ if (limit > 4)
+ return;
+
+- is_on_stack = object_is_on_stack(addr);
++ is_on_stack = object_starts_on_stack(addr);
+ if (is_on_stack == onstack)
+ return;
+
+diff --git a/lib/devres.c b/lib/devres.c
+index 72c8909..7543868 100644
+--- a/lib/devres.c
++++ b/lib/devres.c
+@@ -80,7 +80,7 @@ void devm_iounmap(struct device *dev, void __iomem *addr)
+ {
+ iounmap(addr);
+ WARN_ON(devres_destroy(dev, devm_ioremap_release, devm_ioremap_match,
+- (void *)addr));
++ (void __force *)addr));
+ }
+ EXPORT_SYMBOL(devm_iounmap);
+
+@@ -140,7 +140,7 @@ void devm_ioport_unmap(struct device *dev, void __iomem *addr)
+ {
+ ioport_unmap(addr);
+ WARN_ON(devres_destroy(dev, devm_ioport_map_release,
+- devm_ioport_map_match, (void *)addr));
++ devm_ioport_map_match, (void __force *)addr));
+ }
+ EXPORT_SYMBOL(devm_ioport_unmap);
+
+diff --git a/lib/dma-debug.c b/lib/dma-debug.c
+index 084e879..0674448 100644
+--- a/lib/dma-debug.c
++++ b/lib/dma-debug.c
+@@ -861,7 +861,7 @@ out:
+
+ static void check_for_stack(struct device *dev, void *addr)
+ {
+- if (object_is_on_stack(addr))
++ if (object_starts_on_stack(addr))
+ err_printk(dev, NULL, "DMA-API: device driver maps memory from"
+ "stack [addr=%p]\n", addr);
+ }
+diff --git a/lib/idr.c b/lib/idr.c
+index eda7ba3..915dfae 100644
+--- a/lib/idr.c
++++ b/lib/idr.c
+@@ -156,7 +156,7 @@ static int sub_alloc(struct idr *idp, int *starting_id, struct idr_layer **pa)
+ id = (id | ((1 << (IDR_BITS * l)) - 1)) + 1;
+
+ /* if already at the top layer, we need to grow */
+- if (id >= 1 << (idp->layers * IDR_BITS)) {
++ if (id >= (1 << (idp->layers * IDR_BITS))) {
+ *starting_id = id;
+ return IDR_NEED_TO_GROW;
+ }
+diff --git a/lib/inflate.c b/lib/inflate.c
+index d102559..4215f31 100644
+--- a/lib/inflate.c
++++ b/lib/inflate.c
+@@ -266,7 +266,7 @@ static void free(void *where)
+ malloc_ptr = free_mem_ptr;
+ }
+ #else
+-#define malloc(a) kmalloc(a, GFP_KERNEL)
++#define malloc(a) kmalloc((a), GFP_KERNEL)
+ #define free(a) kfree(a)
+ #endif
+
+diff --git a/lib/ioremap.c b/lib/ioremap.c
+index 14c6078..65526a1 100644
+--- a/lib/ioremap.c
++++ b/lib/ioremap.c
+@@ -37,7 +37,7 @@ static inline int ioremap_pmd_range(pud_t *pud, unsigned long addr,
+ unsigned long next;
+
+ phys_addr -= addr;
+- pmd = pmd_alloc(&init_mm, pud, addr);
++ pmd = pmd_alloc_kernel(&init_mm, pud, addr);
+ if (!pmd)
+ return -ENOMEM;
+ do {
+@@ -55,7 +55,7 @@ static inline int ioremap_pud_range(pgd_t *pgd, unsigned long addr,
+ unsigned long next;
+
+ phys_addr -= addr;
+- pud = pud_alloc(&init_mm, pgd, addr);
++ pud = pud_alloc_kernel(&init_mm, pgd, addr);
+ if (!pud)
+ return -ENOMEM;
+ do {
+diff --git a/lib/is_single_threaded.c b/lib/is_single_threaded.c
+index bd2bea9..6b3c95e 100644
+--- a/lib/is_single_threaded.c
++++ b/lib/is_single_threaded.c
+@@ -22,6 +22,9 @@ bool current_is_single_threaded(void)
+ struct task_struct *p, *t;
+ bool ret;
+
++ if (!mm)
++ return true;
++
+ if (atomic_read(&task->signal->live) != 1)
+ return false;
+
+diff --git a/lib/kobject.c b/lib/kobject.c
+index b512b74..8115eb1 100644
+--- a/lib/kobject.c
++++ b/lib/kobject.c
+@@ -700,7 +700,7 @@ static ssize_t kobj_attr_store(struct kobject *kobj, struct attribute *attr,
+ return ret;
+ }
+
+-struct sysfs_ops kobj_sysfs_ops = {
++const struct sysfs_ops kobj_sysfs_ops = {
+ .show = kobj_attr_show,
+ .store = kobj_attr_store,
+ };
+@@ -789,7 +789,7 @@ static struct kobj_type kset_ktype = {
+ * If the kset was not able to be created, NULL will be returned.
+ */
+ static struct kset *kset_create(const char *name,
+- struct kset_uevent_ops *uevent_ops,
++ const struct kset_uevent_ops *uevent_ops,
+ struct kobject *parent_kobj)
+ {
+ struct kset *kset;
+@@ -832,7 +832,7 @@ static struct kset *kset_create(const char *name,
+ * If the kset was not able to be created, NULL will be returned.
+ */
+ struct kset *kset_create_and_add(const char *name,
+- struct kset_uevent_ops *uevent_ops,
++ const struct kset_uevent_ops *uevent_ops,
+ struct kobject *parent_kobj)
+ {
+ struct kset *kset;
+diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
+index 507b821..0bf8ed0 100644
+--- a/lib/kobject_uevent.c
++++ b/lib/kobject_uevent.c
+@@ -95,7 +95,7 @@ int kobject_uevent_env(struct kobject *kobj, enum kobject_action action,
+ const char *subsystem;
+ struct kobject *top_kobj;
+ struct kset *kset;
+- struct kset_uevent_ops *uevent_ops;
++ const struct kset_uevent_ops *uevent_ops;
+ u64 seq;
+ int i = 0;
+ int retval = 0;
+diff --git a/lib/kref.c b/lib/kref.c
+index 9ecd6e8..12c94c1 100644
+--- a/lib/kref.c
++++ b/lib/kref.c
+@@ -61,7 +61,7 @@ void kref_get(struct kref *kref)
+ */
+ int kref_put(struct kref *kref, void (*release)(struct kref *kref))
+ {
+- WARN_ON(release == NULL);
++ BUG_ON(release == NULL);
+ WARN_ON(release == (void (*)(struct kref *))kfree);
+
+ if (atomic_dec_and_test(&kref->refcount)) {
+diff --git a/lib/radix-tree.c b/lib/radix-tree.c
+index 92cdd99..a8149d7 100644
+--- a/lib/radix-tree.c
++++ b/lib/radix-tree.c
+@@ -81,7 +81,7 @@ struct radix_tree_preload {
+ int nr;
+ struct radix_tree_node *nodes[RADIX_TREE_MAX_PATH];
+ };
+-static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads) = { 0, };
++static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads);
+
+ static inline gfp_t root_gfp_mask(struct radix_tree_root *root)
+ {
+diff --git a/lib/random32.c b/lib/random32.c
+index 217d5c4..45aba8a 100644
+--- a/lib/random32.c
++++ b/lib/random32.c
+@@ -61,7 +61,7 @@ static u32 __random32(struct rnd_state *state)
+ */
+ static inline u32 __seed(u32 x, u32 m)
+ {
+- return (x < m) ? x + m : x;
++ return (x <= m) ? x + m + 1 : x;
+ }
+
+ /**
+diff --git a/lib/vsprintf.c b/lib/vsprintf.c
+index 33bed5e..1477e46 100644
+--- a/lib/vsprintf.c
++++ b/lib/vsprintf.c
+@@ -16,6 +16,9 @@
+ * - scnprintf and vscnprintf
+ */
+
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++#define __INCLUDED_BY_HIDESYM 1
++#endif
+ #include <stdarg.h>
+ #include <linux/module.h>
+ #include <linux/types.h>
+@@ -546,12 +549,12 @@ static char *number(char *buf, char *end, unsigned long long num,
+ return buf;
+ }
+
+-static char *string(char *buf, char *end, char *s, struct printf_spec spec)
++static char *string(char *buf, char *end, const char *s, struct printf_spec spec)
+ {
+ int len, i;
+
+ if ((unsigned long)s < PAGE_SIZE)
+- s = "<NULL>";
++ s = "(null)";
+
+ len = strnlen(s, spec.precision);
+
+@@ -581,7 +584,7 @@ static char *symbol_string(char *buf, char *end, void *ptr,
+ unsigned long value = (unsigned long) ptr;
+ #ifdef CONFIG_KALLSYMS
+ char sym[KSYM_SYMBOL_LEN];
+- if (ext != 'f' && ext != 's')
++ if (ext != 'f' && ext != 's' && ext != 'a')
+ sprint_symbol(sym, value);
+ else
+ kallsyms_lookup(value, NULL, NULL, NULL, sym);
+@@ -801,6 +804,8 @@ static char *ip4_addr_string(char *buf, char *end, const u8 *addr,
+ * - 'f' For simple symbolic function names without offset
+ * - 'S' For symbolic direct pointers with offset
+ * - 's' For symbolic direct pointers without offset
++ * - 'A' For symbolic direct pointers with offset approved for use with GRKERNSEC_HIDESYM
++ * - 'a' For symbolic direct pointers without offset approved for use with GRKERNSEC_HIDESYM
+ * - 'R' For a struct resource pointer, it prints the range of
+ * addresses (not the name nor the flags)
+ * - 'M' For a 6-byte MAC address, it prints the address in the
+@@ -822,7 +827,7 @@ static char *pointer(const char *fmt, char *buf, char *end, void *ptr,
+ struct printf_spec spec)
+ {
+ if (!ptr)
+- return string(buf, end, "(null)", spec);
++ return string(buf, end, "(nil)", spec);
+
+ switch (*fmt) {
+ case 'F':
+@@ -831,6 +836,14 @@ static char *pointer(const char *fmt, char *buf, char *end, void *ptr,
+ case 's':
+ /* Fallthrough */
+ case 'S':
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ break;
++#else
++ return symbol_string(buf, end, ptr, spec, *fmt);
++#endif
++ case 'a':
++ /* Fallthrough */
++ case 'A':
+ return symbol_string(buf, end, ptr, spec, *fmt);
+ case 'R':
+ return resource_string(buf, end, ptr, spec);
+@@ -1445,7 +1458,7 @@ do { \
+ size_t len;
+ if ((unsigned long)save_str > (unsigned long)-PAGE_SIZE
+ || (unsigned long)save_str < PAGE_SIZE)
+- save_str = "<NULL>";
++ save_str = "(null)";
+ len = strlen(save_str);
+ if (str + len + 1 < end)
+ memcpy(str, save_str, len + 1);
+@@ -1555,11 +1568,11 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
+ typeof(type) value; \
+ if (sizeof(type) == 8) { \
+ args = PTR_ALIGN(args, sizeof(u32)); \
+- *(u32 *)&value = *(u32 *)args; \
+- *((u32 *)&value + 1) = *(u32 *)(args + 4); \
++ *(u32 *)&value = *(const u32 *)args; \
++ *((u32 *)&value + 1) = *(const u32 *)(args + 4); \
+ } else { \
+ args = PTR_ALIGN(args, sizeof(type)); \
+- value = *(typeof(type) *)args; \
++ value = *(const typeof(type) *)args; \
+ } \
+ args += sizeof(type); \
+ value; \
+@@ -1622,7 +1635,7 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
+ const char *str_arg = args;
+ size_t len = strlen(str_arg);
+ args += len + 1;
+- str = string(str, end, (char *)str_arg, spec);
++ str = string(str, end, str_arg, spec);
+ break;
+ }
+
+diff --git a/localversion-grsec b/localversion-grsec
+new file mode 100644
+index 0000000..7cd6065
+--- /dev/null
++++ b/localversion-grsec
+@@ -0,0 +1 @@
++-grsec
+diff --git a/mm/Kconfig b/mm/Kconfig
+index 2c19c0b..f3c3f83 100644
+--- a/mm/Kconfig
++++ b/mm/Kconfig
+@@ -228,7 +228,7 @@ config KSM
+ config DEFAULT_MMAP_MIN_ADDR
+ int "Low address space to protect from user allocation"
+ depends on MMU
+- default 4096
++ default 65536
+ help
+ This is the portion of low virtual memory which should be protected
+ from userspace allocation. Keeping a user from writing to low pages
+diff --git a/mm/backing-dev.c b/mm/backing-dev.c
+index d824401..9f5244a 100644
+--- a/mm/backing-dev.c
++++ b/mm/backing-dev.c
+@@ -271,7 +271,7 @@ static void bdi_task_init(struct backing_dev_info *bdi,
+ list_add_tail_rcu(&wb->list, &bdi->wb_list);
+ spin_unlock(&bdi->wb_lock);
+
+- tsk->flags |= PF_FLUSHER | PF_SWAPWRITE;
++ tsk->flags |= PF_SWAPWRITE;
+ set_freezable();
+
+ /*
+@@ -489,7 +489,7 @@ static void bdi_add_to_pending(struct rcu_head *head)
+ * Add the default flusher task that gets created for any bdi
+ * that has dirty data pending writeout
+ */
+-void static bdi_add_default_flusher_task(struct backing_dev_info *bdi)
++static void bdi_add_default_flusher_task(struct backing_dev_info *bdi)
+ {
+ if (!bdi_cap_writeback_dirty(bdi))
+ return;
+diff --git a/mm/filemap.c b/mm/filemap.c
+index a1fe378..e26702f 100644
+--- a/mm/filemap.c
++++ b/mm/filemap.c
+@@ -1631,7 +1631,7 @@ int generic_file_mmap(struct file * file, struct vm_area_struct * vma)
+ struct address_space *mapping = file->f_mapping;
+
+ if (!mapping->a_ops->readpage)
+- return -ENOEXEC;
++ return -ENODEV;
+ file_accessed(file);
+ vma->vm_ops = &generic_file_vm_ops;
+ vma->vm_flags |= VM_CAN_NONLINEAR;
+@@ -2024,6 +2024,7 @@ inline int generic_write_checks(struct file *file, loff_t *pos, size_t *count, i
+ *pos = i_size_read(inode);
+
+ if (limit != RLIM_INFINITY) {
++ gr_learn_resource(current, RLIMIT_FSIZE,*pos, 0);
+ if (*pos >= limit) {
+ send_sig(SIGXFSZ, current, 0);
+ return -EFBIG;
+diff --git a/mm/fremap.c b/mm/fremap.c
+index b6ec85a..a24ac22 100644
+--- a/mm/fremap.c
++++ b/mm/fremap.c
+@@ -153,6 +153,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
+ retry:
+ vma = find_vma(mm, start);
+
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (vma && (mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_MAYEXEC))
++ goto out;
++#endif
++
+ /*
+ * Make sure the vma is shared, that it supports prefaulting,
+ * and that the remapped range is valid and fully within
+@@ -221,7 +226,7 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
+ /*
+ * drop PG_Mlocked flag for over-mapped range
+ */
+- unsigned int saved_flags = vma->vm_flags;
++ unsigned long saved_flags = vma->vm_flags;
+ munlock_vma_pages_range(vma, start, start + size);
+ vma->vm_flags = saved_flags;
+ }
+diff --git a/mm/highmem.c b/mm/highmem.c
+index 9c1e627..5ca9447 100644
+--- a/mm/highmem.c
++++ b/mm/highmem.c
+@@ -116,9 +116,10 @@ static void flush_all_zero_pkmaps(void)
+ * So no dangers, even with speculative execution.
+ */
+ page = pte_page(pkmap_page_table[i]);
++ pax_open_kernel();
+ pte_clear(&init_mm, (unsigned long)page_address(page),
+ &pkmap_page_table[i]);
+-
++ pax_close_kernel();
+ set_page_address(page, NULL);
+ need_flush = 1;
+ }
+@@ -177,9 +178,11 @@ start:
+ }
+ }
+ vaddr = PKMAP_ADDR(last_pkmap_nr);
++
++ pax_open_kernel();
+ set_pte_at(&init_mm, vaddr,
+ &(pkmap_page_table[last_pkmap_nr]), mk_pte(page, kmap_prot));
+-
++ pax_close_kernel();
+ pkmap_count[last_pkmap_nr] = 1;
+ set_page_address(page, (void *)vaddr);
+
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 5e1e508..f6cc035 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -1694,6 +1694,15 @@ static void hugetlb_vm_op_open(struct vm_area_struct *vma)
+ kref_get(&reservations->refs);
+ }
+
++static void resv_map_put(struct vm_area_struct *vma)
++{
++ struct resv_map *reservations = vma_resv_map(vma);
++
++ if (!reservations)
++ return;
++ kref_put(&reservations->refs, resv_map_release);
++}
++
+ static void hugetlb_vm_op_close(struct vm_area_struct *vma)
+ {
+ struct hstate *h = hstate_vma(vma);
+@@ -1709,7 +1718,7 @@ static void hugetlb_vm_op_close(struct vm_area_struct *vma)
+ reserve = (end - start) -
+ region_count(&reservations->regions, start, end);
+
+- kref_put(&reservations->refs, resv_map_release);
++ resv_map_put(vma);
+
+ if (reserve) {
+ hugetlb_acct_memory(h, -reserve);
+@@ -1933,6 +1942,26 @@ static int unmap_ref_private(struct mm_struct *mm, struct vm_area_struct *vma,
+ return 1;
+ }
+
++#ifdef CONFIG_PAX_SEGMEXEC
++static void pax_mirror_huge_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m)
++{
++ struct mm_struct *mm = vma->vm_mm;
++ struct vm_area_struct *vma_m;
++ unsigned long address_m;
++ pte_t *ptep_m;
++
++ vma_m = pax_find_mirror_vma(vma);
++ if (!vma_m)
++ return;
++
++ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
++ address_m = address + SEGMEXEC_TASK_SIZE;
++ ptep_m = huge_pte_offset(mm, address_m & HPAGE_MASK);
++ get_page(page_m);
++ set_huge_pte_at(mm, address_m, ptep_m, make_huge_pte(vma_m, page_m, 0));
++}
++#endif
++
+ static int hugetlb_cow(struct mm_struct *mm, struct vm_area_struct *vma,
+ unsigned long address, pte_t *ptep, pte_t pte,
+ struct page *pagecache_page)
+@@ -2004,6 +2033,11 @@ retry_avoidcopy:
+ huge_ptep_clear_flush(vma, address, ptep);
+ set_huge_pte_at(mm, address, ptep,
+ make_huge_pte(vma, new_page, 1));
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ pax_mirror_huge_pte(vma, address, new_page);
++#endif
++
+ /* Make the old page be freed below */
+ new_page = old_page;
+ }
+@@ -2135,6 +2169,10 @@ retry:
+ && (vma->vm_flags & VM_SHARED)));
+ set_huge_pte_at(mm, address, ptep, new_pte);
+
++#ifdef CONFIG_PAX_SEGMEXEC
++ pax_mirror_huge_pte(vma, address, page);
++#endif
++
+ if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) {
+ /* Optimization, do the COW without a second fault */
+ ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page);
+@@ -2163,6 +2201,28 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+ static DEFINE_MUTEX(hugetlb_instantiation_mutex);
+ struct hstate *h = hstate_vma(vma);
+
++#ifdef CONFIG_PAX_SEGMEXEC
++ struct vm_area_struct *vma_m;
++
++ vma_m = pax_find_mirror_vma(vma);
++ if (vma_m) {
++ unsigned long address_m;
++
++ if (vma->vm_start > vma_m->vm_start) {
++ address_m = address;
++ address -= SEGMEXEC_TASK_SIZE;
++ vma = vma_m;
++ h = hstate_vma(vma);
++ } else
++ address_m = address + SEGMEXEC_TASK_SIZE;
++
++ if (!huge_pte_alloc(mm, address_m, huge_page_size(h)))
++ return VM_FAULT_OOM;
++ address_m &= HPAGE_MASK;
++ unmap_hugepage_range(vma, address_m, address_m + HPAGE_SIZE, NULL);
++ }
++#endif
++
+ ptep = huge_pte_alloc(mm, address, huge_page_size(h));
+ if (!ptep)
+ return VM_FAULT_OOM;
+@@ -2392,12 +2452,16 @@ int hugetlb_reserve_pages(struct inode *inode,
+ set_vma_resv_flags(vma, HPAGE_RESV_OWNER);
+ }
+
+- if (chg < 0)
+- return chg;
++ if (chg < 0) {
++ ret = chg;
++ goto out_err;
++ }
+
+ /* There must be enough filesystem quota for the mapping */
+- if (hugetlb_get_quota(inode->i_mapping, chg))
+- return -ENOSPC;
++ if (hugetlb_get_quota(inode->i_mapping, chg)) {
++ ret = -ENOSPC;
++ goto out_err;
++ }
+
+ /*
+ * Check enough hugepages are available for the reservation.
+@@ -2406,7 +2470,7 @@ int hugetlb_reserve_pages(struct inode *inode,
+ ret = hugetlb_acct_memory(h, chg);
+ if (ret < 0) {
+ hugetlb_put_quota(inode->i_mapping, chg);
+- return ret;
++ goto out_err;
+ }
+
+ /*
+@@ -2423,6 +2487,9 @@ int hugetlb_reserve_pages(struct inode *inode,
+ if (!vma || vma->vm_flags & VM_MAYSHARE)
+ region_add(&inode->i_mapping->private_list, from, to);
+ return 0;
++out_err:
++ resv_map_put(vma);
++ return ret;
+ }
+
+ void hugetlb_unreserve_pages(struct inode *inode, long offset, long freed)
+diff --git a/mm/internal.h b/mm/internal.h
+index f03e8e2..7354343 100644
+--- a/mm/internal.h
++++ b/mm/internal.h
+@@ -49,6 +49,7 @@ extern void putback_lru_page(struct page *page);
+ * in mm/page_alloc.c
+ */
+ extern void __free_pages_bootmem(struct page *page, unsigned int order);
++extern void free_compound_page(struct page *page);
+ extern void prep_compound_page(struct page *page, unsigned long order);
+
+
+diff --git a/mm/kmemleak.c b/mm/kmemleak.c
+index c346660..b47382f 100644
+--- a/mm/kmemleak.c
++++ b/mm/kmemleak.c
+@@ -358,7 +358,7 @@ static void print_unreferenced(struct seq_file *seq,
+
+ for (i = 0; i < object->trace_len; i++) {
+ void *ptr = (void *)object->trace[i];
+- seq_printf(seq, " [<%p>] %pS\n", ptr, ptr);
++ seq_printf(seq, " [<%p>] %pA\n", ptr, ptr);
+ }
+ }
+
+diff --git a/mm/maccess.c b/mm/maccess.c
+index 9073695..1127f348 100644
+--- a/mm/maccess.c
++++ b/mm/maccess.c
+@@ -14,7 +14,7 @@
+ * Safely read from address @src to the buffer at @dst. If a kernel fault
+ * happens, handle that and return -EFAULT.
+ */
+-long probe_kernel_read(void *dst, void *src, size_t size)
++long probe_kernel_read(void *dst, const void *src, size_t size)
+ {
+ long ret;
+ mm_segment_t old_fs = get_fs();
+@@ -22,7 +22,7 @@ long probe_kernel_read(void *dst, void *src, size_t size)
+ set_fs(KERNEL_DS);
+ pagefault_disable();
+ ret = __copy_from_user_inatomic(dst,
+- (__force const void __user *)src, size);
++ (const void __force_user *)src, size);
+ pagefault_enable();
+ set_fs(old_fs);
+
+@@ -39,14 +39,14 @@ EXPORT_SYMBOL_GPL(probe_kernel_read);
+ * Safely write to address @dst from the buffer at @src. If a kernel fault
+ * happens, handle that and return -EFAULT.
+ */
+-long notrace __weak probe_kernel_write(void *dst, void *src, size_t size)
++long notrace __weak probe_kernel_write(void *dst, const void *src, size_t size)
+ {
+ long ret;
+ mm_segment_t old_fs = get_fs();
+
+ set_fs(KERNEL_DS);
+ pagefault_disable();
+- ret = __copy_to_user_inatomic((__force void __user *)dst, src, size);
++ ret = __copy_to_user_inatomic((void __force_user *)dst, src, size);
+ pagefault_enable();
+ set_fs(old_fs);
+
+diff --git a/mm/madvise.c b/mm/madvise.c
+index 35b1479..499f7d4 100644
+--- a/mm/madvise.c
++++ b/mm/madvise.c
+@@ -44,6 +44,10 @@ static long madvise_behavior(struct vm_area_struct * vma,
+ pgoff_t pgoff;
+ unsigned long new_flags = vma->vm_flags;
+
++#ifdef CONFIG_PAX_SEGMEXEC
++ struct vm_area_struct *vma_m;
++#endif
++
+ switch (behavior) {
+ case MADV_NORMAL:
+ new_flags = new_flags & ~VM_RAND_READ & ~VM_SEQ_READ;
+@@ -103,6 +107,13 @@ success:
+ /*
+ * vm_flags is protected by the mmap_sem held in write mode.
+ */
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ vma_m = pax_find_mirror_vma(vma);
++ if (vma_m)
++ vma_m->vm_flags = new_flags & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT);
++#endif
++
+ vma->vm_flags = new_flags;
+
+ out:
+@@ -161,6 +172,11 @@ static long madvise_dontneed(struct vm_area_struct * vma,
+ struct vm_area_struct ** prev,
+ unsigned long start, unsigned long end)
+ {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ struct vm_area_struct *vma_m;
++#endif
++
+ *prev = vma;
+ if (vma->vm_flags & (VM_LOCKED|VM_HUGETLB|VM_PFNMAP))
+ return -EINVAL;
+@@ -173,6 +189,21 @@ static long madvise_dontneed(struct vm_area_struct * vma,
+ zap_page_range(vma, start, end - start, &details);
+ } else
+ zap_page_range(vma, start, end - start, NULL);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ vma_m = pax_find_mirror_vma(vma);
++ if (vma_m) {
++ if (unlikely(vma->vm_flags & VM_NONLINEAR)) {
++ struct zap_details details = {
++ .nonlinear_vma = vma_m,
++ .last_index = ULONG_MAX,
++ };
++ zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, &details);
++ } else
++ zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, NULL);
++ }
++#endif
++
+ return 0;
+ }
+
+@@ -359,6 +390,16 @@ SYSCALL_DEFINE3(madvise, unsigned long, start, size_t, len_in, int, behavior)
+ if (end < start)
+ goto out;
+
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
++ if (end > SEGMEXEC_TASK_SIZE)
++ goto out;
++ } else
++#endif
++
++ if (end > TASK_SIZE)
++ goto out;
++
+ error = 0;
+ if (end == start)
+ goto out;
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c
+index 8aeba53..b4a4198 100644
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -46,7 +46,7 @@ int sysctl_memory_failure_early_kill __read_mostly = 0;
+
+ int sysctl_memory_failure_recovery __read_mostly = 1;
+
+-atomic_long_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
++atomic_long_unchecked_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
+
+ /*
+ * Send all the processes who have the page mapped an ``action optional''
+@@ -64,7 +64,7 @@ static int kill_proc_ao(struct task_struct *t, unsigned long addr, int trapno,
+ si.si_signo = SIGBUS;
+ si.si_errno = 0;
+ si.si_code = BUS_MCEERR_AO;
+- si.si_addr = (void *)addr;
++ si.si_addr = (void __user *)addr;
+ #ifdef __ARCH_SI_TRAPNO
+ si.si_trapno = trapno;
+ #endif
+@@ -745,7 +745,7 @@ int __memory_failure(unsigned long pfn, int trapno, int ref)
+ return 0;
+ }
+
+- atomic_long_add(1, &mce_bad_pages);
++ atomic_long_add_unchecked(1, &mce_bad_pages);
+
+ /*
+ * We need/can do nothing about count=0 pages.
+diff --git a/mm/memory.c b/mm/memory.c
+index 6c836d3..b2296e1 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -187,8 +187,12 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
+ return;
+
+ pmd = pmd_offset(pud, start);
++
++#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_PER_CPU_PGD)
+ pud_clear(pud);
+ pmd_free_tlb(tlb, pmd, start);
++#endif
++
+ }
+
+ static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
+@@ -219,9 +223,12 @@ static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
+ if (end - 1 > ceiling - 1)
+ return;
+
++#if !defined(CONFIG_X86_64) || !defined(CONFIG_PAX_PER_CPU_PGD)
+ pud = pud_offset(pgd, start);
+ pgd_clear(pgd);
+ pud_free_tlb(tlb, pud, start);
++#endif
++
+ }
+
+ /*
+@@ -1251,10 +1258,10 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
+ (VM_MAYREAD | VM_MAYWRITE) : (VM_READ | VM_WRITE);
+ i = 0;
+
+- do {
++ while (nr_pages) {
+ struct vm_area_struct *vma;
+
+- vma = find_extend_vma(mm, start);
++ vma = find_vma(mm, start);
+ if (!vma && in_gate_area(tsk, start)) {
+ unsigned long pg = start & PAGE_MASK;
+ struct vm_area_struct *gate_vma = get_gate_vma(tsk);
+@@ -1306,7 +1313,7 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
+ continue;
+ }
+
+- if (!vma ||
++ if (!vma || start < vma->vm_start ||
+ (vma->vm_flags & (VM_IO | VM_PFNMAP)) ||
+ !(vm_flags & vma->vm_flags))
+ return i ? : -EFAULT;
+@@ -1381,7 +1388,7 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
+ start += PAGE_SIZE;
+ nr_pages--;
+ } while (nr_pages && start < vma->vm_end);
+- } while (nr_pages);
++ }
+ return i;
+ }
+
+@@ -1526,6 +1533,10 @@ static int insert_page(struct vm_area_struct *vma, unsigned long addr,
+ page_add_file_rmap(page);
+ set_pte_at(mm, addr, pte, mk_pte(page, prot));
+
++#ifdef CONFIG_PAX_SEGMEXEC
++ pax_mirror_file_pte(vma, addr, page, ptl);
++#endif
++
+ retval = 0;
+ pte_unmap_unlock(pte, ptl);
+ return retval;
+@@ -1560,10 +1571,22 @@ out:
+ int vm_insert_page(struct vm_area_struct *vma, unsigned long addr,
+ struct page *page)
+ {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ struct vm_area_struct *vma_m;
++#endif
++
+ if (addr < vma->vm_start || addr >= vma->vm_end)
+ return -EFAULT;
+ if (!page_count(page))
+ return -EINVAL;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ vma_m = pax_find_mirror_vma(vma);
++ if (vma_m)
++ vma_m->vm_flags |= VM_INSERTPAGE;
++#endif
++
+ vma->vm_flags |= VM_INSERTPAGE;
+ return insert_page(vma, addr, page, vma->vm_page_prot);
+ }
+@@ -1649,6 +1672,7 @@ int vm_insert_mixed(struct vm_area_struct *vma, unsigned long addr,
+ unsigned long pfn)
+ {
+ BUG_ON(!(vma->vm_flags & VM_MIXEDMAP));
++ BUG_ON(vma->vm_mirror);
+
+ if (addr < vma->vm_start || addr >= vma->vm_end)
+ return -EFAULT;
+@@ -1855,7 +1879,9 @@ static int apply_to_pmd_range(struct mm_struct *mm, pud_t *pud,
+
+ BUG_ON(pud_huge(*pud));
+
+- pmd = pmd_alloc(mm, pud, addr);
++ pmd = (mm == &init_mm) ?
++ pmd_alloc_kernel(mm, pud, addr) :
++ pmd_alloc(mm, pud, addr);
+ if (!pmd)
+ return -ENOMEM;
+ do {
+@@ -1875,7 +1901,9 @@ static int apply_to_pud_range(struct mm_struct *mm, pgd_t *pgd,
+ unsigned long next;
+ int err;
+
+- pud = pud_alloc(mm, pgd, addr);
++ pud = (mm == &init_mm) ?
++ pud_alloc_kernel(mm, pgd, addr) :
++ pud_alloc(mm, pgd, addr);
+ if (!pud)
+ return -ENOMEM;
+ do {
+@@ -1977,6 +2005,186 @@ static inline void cow_user_page(struct page *dst, struct page *src, unsigned lo
+ copy_user_highpage(dst, src, va, vma);
+ }
+
++#ifdef CONFIG_PAX_SEGMEXEC
++static void pax_unmap_mirror_pte(struct vm_area_struct *vma, unsigned long address, pmd_t *pmd)
++{
++ struct mm_struct *mm = vma->vm_mm;
++ spinlock_t *ptl;
++ pte_t *pte, entry;
++
++ pte = pte_offset_map_lock(mm, pmd, address, &ptl);
++ entry = *pte;
++ if (!pte_present(entry)) {
++ if (!pte_none(entry)) {
++ BUG_ON(pte_file(entry));
++ free_swap_and_cache(pte_to_swp_entry(entry));
++ pte_clear_not_present_full(mm, address, pte, 0);
++ }
++ } else {
++ struct page *page;
++
++ flush_cache_page(vma, address, pte_pfn(entry));
++ entry = ptep_clear_flush(vma, address, pte);
++ BUG_ON(pte_dirty(entry));
++ page = vm_normal_page(vma, address, entry);
++ if (page) {
++ update_hiwater_rss(mm);
++ if (PageAnon(page))
++ dec_mm_counter(mm, anon_rss);
++ else
++ dec_mm_counter(mm, file_rss);
++ page_remove_rmap(page);
++ page_cache_release(page);
++ }
++ }
++ pte_unmap_unlock(pte, ptl);
++}
++
++/* PaX: if vma is mirrored, synchronize the mirror's PTE
++ *
++ * the ptl of the lower mapped page is held on entry and is not released on exit
++ * or inside to ensure atomic changes to the PTE states (swapout, mremap, munmap, etc)
++ */
++static void pax_mirror_anon_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
++{
++ struct mm_struct *mm = vma->vm_mm;
++ unsigned long address_m;
++ spinlock_t *ptl_m;
++ struct vm_area_struct *vma_m;
++ pmd_t *pmd_m;
++ pte_t *pte_m, entry_m;
++
++ BUG_ON(!page_m || !PageAnon(page_m));
++
++ vma_m = pax_find_mirror_vma(vma);
++ if (!vma_m)
++ return;
++
++ BUG_ON(!PageLocked(page_m));
++ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
++ address_m = address + SEGMEXEC_TASK_SIZE;
++ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
++ pte_m = pte_offset_map_nested(pmd_m, address_m);
++ ptl_m = pte_lockptr(mm, pmd_m);
++ if (ptl != ptl_m) {
++ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
++ if (!pte_none(*pte_m))
++ goto out;
++ }
++
++ entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
++ page_cache_get(page_m);
++ page_add_anon_rmap(page_m, vma_m, address_m);
++ inc_mm_counter(mm, anon_rss);
++ set_pte_at(mm, address_m, pte_m, entry_m);
++ update_mmu_cache(vma_m, address_m, entry_m);
++out:
++ if (ptl != ptl_m)
++ spin_unlock(ptl_m);
++ pte_unmap_nested(pte_m);
++ unlock_page(page_m);
++}
++
++void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
++{
++ struct mm_struct *mm = vma->vm_mm;
++ unsigned long address_m;
++ spinlock_t *ptl_m;
++ struct vm_area_struct *vma_m;
++ pmd_t *pmd_m;
++ pte_t *pte_m, entry_m;
++
++ BUG_ON(!page_m || PageAnon(page_m));
++
++ vma_m = pax_find_mirror_vma(vma);
++ if (!vma_m)
++ return;
++
++ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
++ address_m = address + SEGMEXEC_TASK_SIZE;
++ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
++ pte_m = pte_offset_map_nested(pmd_m, address_m);
++ ptl_m = pte_lockptr(mm, pmd_m);
++ if (ptl != ptl_m) {
++ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
++ if (!pte_none(*pte_m))
++ goto out;
++ }
++
++ entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
++ page_cache_get(page_m);
++ page_add_file_rmap(page_m);
++ inc_mm_counter(mm, file_rss);
++ set_pte_at(mm, address_m, pte_m, entry_m);
++ update_mmu_cache(vma_m, address_m, entry_m);
++out:
++ if (ptl != ptl_m)
++ spin_unlock(ptl_m);
++ pte_unmap_nested(pte_m);
++}
++
++static void pax_mirror_pfn_pte(struct vm_area_struct *vma, unsigned long address, unsigned long pfn_m, spinlock_t *ptl)
++{
++ struct mm_struct *mm = vma->vm_mm;
++ unsigned long address_m;
++ spinlock_t *ptl_m;
++ struct vm_area_struct *vma_m;
++ pmd_t *pmd_m;
++ pte_t *pte_m, entry_m;
++
++ vma_m = pax_find_mirror_vma(vma);
++ if (!vma_m)
++ return;
++
++ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
++ address_m = address + SEGMEXEC_TASK_SIZE;
++ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
++ pte_m = pte_offset_map_nested(pmd_m, address_m);
++ ptl_m = pte_lockptr(mm, pmd_m);
++ if (ptl != ptl_m) {
++ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
++ if (!pte_none(*pte_m))
++ goto out;
++ }
++
++ entry_m = pfn_pte(pfn_m, vma_m->vm_page_prot);
++ set_pte_at(mm, address_m, pte_m, entry_m);
++out:
++ if (ptl != ptl_m)
++ spin_unlock(ptl_m);
++ pte_unmap_nested(pte_m);
++}
++
++static void pax_mirror_pte(struct vm_area_struct *vma, unsigned long address, pte_t *pte, pmd_t *pmd, spinlock_t *ptl)
++{
++ struct page *page_m;
++ pte_t entry;
++
++ if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC))
++ goto out;
++
++ entry = *pte;
++ page_m = vm_normal_page(vma, address, entry);
++ if (!page_m)
++ pax_mirror_pfn_pte(vma, address, pte_pfn(entry), ptl);
++ else if (PageAnon(page_m)) {
++ if (pax_find_mirror_vma(vma)) {
++ pte_unmap_unlock(pte, ptl);
++ lock_page(page_m);
++ pte = pte_offset_map_lock(vma->vm_mm, pmd, address, &ptl);
++ if (pte_same(entry, *pte))
++ pax_mirror_anon_pte(vma, address, page_m, ptl);
++ else
++ unlock_page(page_m);
++ }
++ } else
++ pax_mirror_file_pte(vma, address, page_m, ptl);
++
++out:
++ pte_unmap_unlock(pte, ptl);
++}
++#endif
++
+ /*
+ * This routine handles present pages, when users try to write
+ * to a shared page. It is done by copying the page to a new address
+@@ -2156,6 +2364,12 @@ gotten:
+ */
+ page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
+ if (likely(pte_same(*page_table, orig_pte))) {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (pax_find_mirror_vma(vma))
++ BUG_ON(!trylock_page(new_page));
++#endif
++
+ if (old_page) {
+ if (!PageAnon(old_page)) {
+ dec_mm_counter(mm, file_rss);
+@@ -2207,6 +2421,10 @@ gotten:
+ page_remove_rmap(old_page);
+ }
+
++#ifdef CONFIG_PAX_SEGMEXEC
++ pax_mirror_anon_pte(vma, address, new_page, ptl);
++#endif
++
+ /* Free the old page.. */
+ new_page = old_page;
+ ret |= VM_FAULT_WRITE;
+@@ -2606,6 +2824,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
+ swap_free(entry);
+ if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
+ try_to_free_swap(page);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ if ((flags & FAULT_FLAG_WRITE) || !pax_find_mirror_vma(vma))
++#endif
++
+ unlock_page(page);
+
+ if (flags & FAULT_FLAG_WRITE) {
+@@ -2617,6 +2840,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
+
+ /* No need to invalidate - it was non-present before */
+ update_mmu_cache(vma, address, pte);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ pax_mirror_anon_pte(vma, address, page, ptl);
++#endif
++
+ unlock:
+ pte_unmap_unlock(page_table, ptl);
+ out:
+@@ -2632,40 +2860,6 @@ out_release:
+ }
+
+ /*
+- * This is like a special single-page "expand_{down|up}wards()",
+- * except we must first make sure that 'address{-|+}PAGE_SIZE'
+- * doesn't hit another vma.
+- */
+-static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address)
+-{
+- address &= PAGE_MASK;
+- if ((vma->vm_flags & VM_GROWSDOWN) && address == vma->vm_start) {
+- struct vm_area_struct *prev = vma->vm_prev;
+-
+- /*
+- * Is there a mapping abutting this one below?
+- *
+- * That's only ok if it's the same stack mapping
+- * that has gotten split..
+- */
+- if (prev && prev->vm_end == address)
+- return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
+-
+- expand_stack(vma, address - PAGE_SIZE);
+- }
+- if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
+- struct vm_area_struct *next = vma->vm_next;
+-
+- /* As VM_GROWSDOWN but s/below/above/ */
+- if (next && next->vm_start == address + PAGE_SIZE)
+- return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
+-
+- expand_upwards(vma, address + PAGE_SIZE);
+- }
+- return 0;
+-}
+-
+-/*
+ * We enter with non-exclusive mmap_sem (to exclude vma changes,
+ * but allow concurrent faults), and pte mapped but not yet locked.
+ * We return with mmap_sem still held, but pte unmapped and unlocked.
+@@ -2674,27 +2868,23 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+ unsigned long address, pte_t *page_table, pmd_t *pmd,
+ unsigned int flags)
+ {
+- struct page *page;
++ struct page *page = NULL;
+ spinlock_t *ptl;
+ pte_t entry;
+
+- pte_unmap(page_table);
+-
+- /* Check if we need to add a guard page to the stack */
+- if (check_stack_guard_page(vma, address) < 0)
+- return VM_FAULT_SIGBUS;
+-
+- /* Use the zero-page for reads */
+ if (!(flags & FAULT_FLAG_WRITE)) {
+ entry = pte_mkspecial(pfn_pte(my_zero_pfn(address),
+ vma->vm_page_prot));
+- page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
++ ptl = pte_lockptr(mm, pmd);
++ spin_lock(ptl);
+ if (!pte_none(*page_table))
+ goto unlock;
+ goto setpte;
+ }
+
+ /* Allocate our own private page. */
++ pte_unmap(page_table);
++
+ if (unlikely(anon_vma_prepare(vma)))
+ goto oom;
+ page = alloc_zeroed_user_highpage_movable(vma, address);
+@@ -2713,6 +2903,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+ if (!pte_none(*page_table))
+ goto release;
+
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (pax_find_mirror_vma(vma))
++ BUG_ON(!trylock_page(page));
++#endif
++
+ inc_mm_counter(mm, anon_rss);
+ page_add_new_anon_rmap(page, vma, address);
+ setpte:
+@@ -2720,6 +2915,12 @@ setpte:
+
+ /* No need to invalidate - it was non-present before */
+ update_mmu_cache(vma, address, entry);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (page)
++ pax_mirror_anon_pte(vma, address, page, ptl);
++#endif
++
+ unlock:
+ pte_unmap_unlock(page_table, ptl);
+ return 0;
+@@ -2862,6 +3063,12 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+ */
+ /* Only go through if we didn't race with anybody else... */
+ if (likely(pte_same(*page_table, orig_pte))) {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (anon && pax_find_mirror_vma(vma))
++ BUG_ON(!trylock_page(page));
++#endif
++
+ flush_icache_page(vma, page);
+ entry = mk_pte(page, vma->vm_page_prot);
+ if (flags & FAULT_FLAG_WRITE)
+@@ -2881,6 +3088,14 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+
+ /* no need to invalidate: a not-present page won't be cached */
+ update_mmu_cache(vma, address, entry);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (anon)
++ pax_mirror_anon_pte(vma, address, page, ptl);
++ else
++ pax_mirror_file_pte(vma, address, page, ptl);
++#endif
++
+ } else {
+ if (charged)
+ mem_cgroup_uncharge_page(page);
+@@ -3028,6 +3243,12 @@ static inline int handle_pte_fault(struct mm_struct *mm,
+ if (flags & FAULT_FLAG_WRITE)
+ flush_tlb_page(vma, address);
+ }
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ pax_mirror_pte(vma, address, pte, pmd, ptl);
++ return 0;
++#endif
++
+ unlock:
+ pte_unmap_unlock(pte, ptl);
+ return 0;
+@@ -3044,6 +3265,10 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+ pmd_t *pmd;
+ pte_t *pte;
+
++#ifdef CONFIG_PAX_SEGMEXEC
++ struct vm_area_struct *vma_m;
++#endif
++
+ __set_current_state(TASK_RUNNING);
+
+ count_vm_event(PGFAULT);
+@@ -3051,6 +3276,34 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+ if (unlikely(is_vm_hugetlb_page(vma)))
+ return hugetlb_fault(mm, vma, address, flags);
+
++#ifdef CONFIG_PAX_SEGMEXEC
++ vma_m = pax_find_mirror_vma(vma);
++ if (vma_m) {
++ unsigned long address_m;
++ pgd_t *pgd_m;
++ pud_t *pud_m;
++ pmd_t *pmd_m;
++
++ if (vma->vm_start > vma_m->vm_start) {
++ address_m = address;
++ address -= SEGMEXEC_TASK_SIZE;
++ vma = vma_m;
++ } else
++ address_m = address + SEGMEXEC_TASK_SIZE;
++
++ pgd_m = pgd_offset(mm, address_m);
++ pud_m = pud_alloc(mm, pgd_m, address_m);
++ if (!pud_m)
++ return VM_FAULT_OOM;
++ pmd_m = pmd_alloc(mm, pud_m, address_m);
++ if (!pmd_m)
++ return VM_FAULT_OOM;
++ if (!pmd_present(*pmd_m) && __pte_alloc(mm, pmd_m, address_m))
++ return VM_FAULT_OOM;
++ pax_unmap_mirror_pte(vma_m, address_m, pmd_m);
++ }
++#endif
++
+ pgd = pgd_offset(mm, address);
+ pud = pud_alloc(mm, pgd, address);
+ if (!pud)
+@@ -3086,6 +3339,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
+ spin_unlock(&mm->page_table_lock);
+ return 0;
+ }
++
++int __pud_alloc_kernel(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
++{
++ pud_t *new = pud_alloc_one(mm, address);
++ if (!new)
++ return -ENOMEM;
++
++ smp_wmb(); /* See comment in __pte_alloc */
++
++ spin_lock(&mm->page_table_lock);
++ if (pgd_present(*pgd)) /* Another has populated it */
++ pud_free(mm, new);
++ else
++ pgd_populate_kernel(mm, pgd, new);
++ spin_unlock(&mm->page_table_lock);
++ return 0;
++}
+ #endif /* __PAGETABLE_PUD_FOLDED */
+
+ #ifndef __PAGETABLE_PMD_FOLDED
+@@ -3116,6 +3386,30 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
+ spin_unlock(&mm->page_table_lock);
+ return 0;
+ }
++
++int __pmd_alloc_kernel(struct mm_struct *mm, pud_t *pud, unsigned long address)
++{
++ pmd_t *new = pmd_alloc_one(mm, address);
++ if (!new)
++ return -ENOMEM;
++
++ smp_wmb(); /* See comment in __pte_alloc */
++
++ spin_lock(&mm->page_table_lock);
++#ifndef __ARCH_HAS_4LEVEL_HACK
++ if (pud_present(*pud)) /* Another has populated it */
++ pmd_free(mm, new);
++ else
++ pud_populate_kernel(mm, pud, new);
++#else
++ if (pgd_present(*pud)) /* Another has populated it */
++ pmd_free(mm, new);
++ else
++ pgd_populate_kernel(mm, pud, new);
++#endif /* __ARCH_HAS_4LEVEL_HACK */
++ spin_unlock(&mm->page_table_lock);
++ return 0;
++}
+ #endif /* __PAGETABLE_PMD_FOLDED */
+
+ int make_pages_present(unsigned long addr, unsigned long end)
+@@ -3148,7 +3442,7 @@ static int __init gate_vma_init(void)
+ gate_vma.vm_start = FIXADDR_USER_START;
+ gate_vma.vm_end = FIXADDR_USER_END;
+ gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
+- gate_vma.vm_page_prot = __P101;
++ gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
+ /*
+ * Make sure the vDSO gets into every core dump.
+ * Dumping its contents makes post-mortem fully interpretable later
+diff --git a/mm/mempolicy.c b/mm/mempolicy.c
+index 3c6e3e2..b1ddbb8 100644
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -573,6 +573,10 @@ static int mbind_range(struct vm_area_struct *vma, unsigned long start,
+ struct vm_area_struct *next;
+ int err;
+
++#ifdef CONFIG_PAX_SEGMEXEC
++ struct vm_area_struct *vma_m;
++#endif
++
+ err = 0;
+ for (; vma && vma->vm_start < end; vma = next) {
+ next = vma->vm_next;
+@@ -584,6 +588,16 @@ static int mbind_range(struct vm_area_struct *vma, unsigned long start,
+ err = policy_vma(vma, new);
+ if (err)
+ break;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ vma_m = pax_find_mirror_vma(vma);
++ if (vma_m) {
++ err = policy_vma(vma_m, new);
++ if (err)
++ break;
++ }
++#endif
++
+ }
+ return err;
+ }
+@@ -1002,6 +1016,17 @@ static long do_mbind(unsigned long start, unsigned long len,
+
+ if (end < start)
+ return -EINVAL;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (mm->pax_flags & MF_PAX_SEGMEXEC) {
++ if (end > SEGMEXEC_TASK_SIZE)
++ return -EINVAL;
++ } else
++#endif
++
++ if (end > TASK_SIZE)
++ return -EINVAL;
++
+ if (end == start)
+ return 0;
+
+@@ -1207,6 +1232,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
+ if (!mm)
+ return -EINVAL;
+
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++ if (mm != current->mm &&
++ (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
++ err = -EPERM;
++ goto out;
++ }
++#endif
++
+ /*
+ * Check if this process has the right to modify the specified
+ * process. The right exists if the process has administrative
+@@ -1216,8 +1249,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
+ rcu_read_lock();
+ tcred = __task_cred(task);
+ if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
+- cred->uid != tcred->suid && cred->uid != tcred->uid &&
+- !capable(CAP_SYS_NICE)) {
++ cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
+ rcu_read_unlock();
+ err = -EPERM;
+ goto out;
+@@ -2367,6 +2399,12 @@ static inline void check_huge_range(struct vm_area_struct *vma,
+ }
+ #endif
+
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
++ (_mm->pax_flags & MF_PAX_RANDMMAP || \
++ _mm->pax_flags & MF_PAX_SEGMEXEC))
++#endif
++
+ /*
+ * Display pages allocated per node and memory policy via /proc.
+ */
+@@ -2381,6 +2419,13 @@ int show_numa_map(struct seq_file *m, void *v)
+ int n;
+ char buffer[50];
+
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++ if (current->exec_id != m->exec_id) {
++ gr_log_badprocpid("numa_maps");
++ return 0;
++ }
++#endif
++
+ if (!mm)
+ return 0;
+
+@@ -2392,11 +2437,15 @@ int show_numa_map(struct seq_file *m, void *v)
+ mpol_to_str(buffer, sizeof(buffer), pol, 0);
+ mpol_cond_put(pol);
+
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++ seq_printf(m, "%08lx %s", PAX_RAND_FLAGS(vma->vm_mm) ? 0UL : vma->vm_start, buffer);
++#else
+ seq_printf(m, "%08lx %s", vma->vm_start, buffer);
++#endif
+
+ if (file) {
+ seq_printf(m, " file=");
+- seq_path(m, &file->f_path, "\n\t= ");
++ seq_path(m, &file->f_path, "\n\t\\= ");
+ } else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
+ seq_printf(m, " heap");
+ } else if (vma->vm_start <= mm->start_stack &&
+diff --git a/mm/migrate.c b/mm/migrate.c
+index aaca868..2ebecdc 100644
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -916,6 +916,8 @@ static int do_pages_move(struct mm_struct *mm, struct task_struct *task,
+ unsigned long chunk_start;
+ int err;
+
++ pax_track_stack();
++
+ task_nodes = cpuset_mems_allowed(task);
+
+ err = -ENOMEM;
+@@ -1106,6 +1108,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
+ if (!mm)
+ return -EINVAL;
+
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++ if (mm != current->mm &&
++ (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
++ err = -EPERM;
++ goto out;
++ }
++#endif
++
+ /*
+ * Check if this process has the right to modify the specified
+ * process. The right exists if the process has administrative
+@@ -1115,8 +1125,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
+ rcu_read_lock();
+ tcred = __task_cred(task);
+ if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
+- cred->uid != tcred->suid && cred->uid != tcred->uid &&
+- !capable(CAP_SYS_NICE)) {
++ cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
+ rcu_read_unlock();
+ err = -EPERM;
+ goto out;
+diff --git a/mm/mlock.c b/mm/mlock.c
+index 2d846cf..98134d2 100644
+--- a/mm/mlock.c
++++ b/mm/mlock.c
+@@ -13,6 +13,7 @@
+ #include <linux/pagemap.h>
+ #include <linux/mempolicy.h>
+ #include <linux/syscalls.h>
++#include <linux/security.h>
+ #include <linux/sched.h>
+ #include <linux/module.h>
+ #include <linux/rmap.h>
+@@ -138,13 +139,6 @@ void munlock_vma_page(struct page *page)
+ }
+ }
+
+-static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
+-{
+- return (vma->vm_flags & VM_GROWSDOWN) &&
+- (vma->vm_start == addr) &&
+- !vma_stack_continue(vma->vm_prev, addr);
+-}
+-
+ /**
+ * __mlock_vma_pages_range() - mlock a range of pages in the vma.
+ * @vma: target vma
+@@ -177,12 +171,6 @@ static long __mlock_vma_pages_range(struct vm_area_struct *vma,
+ if (vma->vm_flags & VM_WRITE)
+ gup_flags |= FOLL_WRITE;
+
+- /* We don't try to access the guard page of a stack vma */
+- if (stack_guard_page(vma, start)) {
+- addr += PAGE_SIZE;
+- nr_pages--;
+- }
+-
+ while (nr_pages > 0) {
+ int i;
+
+@@ -440,7 +428,7 @@ static int do_mlock(unsigned long start, size_t len, int on)
+ {
+ unsigned long nstart, end, tmp;
+ struct vm_area_struct * vma, * prev;
+- int error;
++ int error = -EINVAL;
+
+ len = PAGE_ALIGN(len);
+ end = start + len;
+@@ -448,6 +436,9 @@ static int do_mlock(unsigned long start, size_t len, int on)
+ return -EINVAL;
+ if (end == start)
+ return 0;
++ if (end > TASK_SIZE)
++ return -EINVAL;
++
+ vma = find_vma_prev(current->mm, start, &prev);
+ if (!vma || vma->vm_start > start)
+ return -ENOMEM;
+@@ -458,6 +449,11 @@ static int do_mlock(unsigned long start, size_t len, int on)
+ for (nstart = start ; ; ) {
+ unsigned int newflags;
+
++#ifdef CONFIG_PAX_SEGMEXEC
++ if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
++ break;
++#endif
++
+ /* Here we know that vma->vm_start <= nstart < vma->vm_end. */
+
+ newflags = vma->vm_flags | VM_LOCKED;
+@@ -507,6 +503,7 @@ SYSCALL_DEFINE2(mlock, unsigned long, start, size_t, len)
+ lock_limit >>= PAGE_SHIFT;
+
+ /* check against resource limits */
++ gr_learn_resource(current, RLIMIT_MEMLOCK, (current->mm->locked_vm << PAGE_SHIFT) + len, 1);
+ if ((locked <= lock_limit) || capable(CAP_IPC_LOCK))
+ error = do_mlock(start, len, 1);
+ up_write(¤t->mm->mmap_sem);
+@@ -528,17 +525,23 @@ SYSCALL_DEFINE2(munlock, unsigned long, start, size_t, len)
+ static int do_mlockall(int flags)
+ {
+ struct vm_area_struct * vma, * prev = NULL;
+- unsigned int def_flags = 0;
+
+ if (flags & MCL_FUTURE)
+- def_flags = VM_LOCKED;
+- current->mm->def_flags = def_flags;
++ current->mm->def_flags |= VM_LOCKED;
++ else
++ current->mm->def_flags &= ~VM_LOCKED;
+ if (flags == MCL_FUTURE)
+ goto out;
+
+ for (vma = current->mm->mmap; vma ; vma = prev->vm_next) {
+- unsigned int newflags;
++ unsigned long newflags;
+
++#ifdef CONFIG_PAX_SEGMEXEC
++ if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
++ break;
++#endif
++
++ BUG_ON(vma->vm_end > TASK_SIZE);
+ newflags = vma->vm_flags | VM_LOCKED;
+ if (!(flags & MCL_CURRENT))
+ newflags &= ~VM_LOCKED;
+@@ -570,6 +573,7 @@ SYSCALL_DEFINE1(mlockall, int, flags)
+ lock_limit >>= PAGE_SHIFT;
+
+ ret = -ENOMEM;
++ gr_learn_resource(current, RLIMIT_MEMLOCK, current->mm->total_vm << PAGE_SHIFT, 1);
+ if (!(flags & MCL_CURRENT) || (current->mm->total_vm <= lock_limit) ||
+ capable(CAP_IPC_LOCK))
+ ret = do_mlockall(flags);
+diff --git a/mm/mmap.c b/mm/mmap.c
+index 4b80cbf..f1145be 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -45,6 +45,16 @@
+ #define arch_rebalance_pgtables(addr, len) (addr)
+ #endif
+
++static inline void verify_mm_writelocked(struct mm_struct *mm)
++{
++#if defined(CONFIG_DEBUG_VM) || defined(CONFIG_PAX)
++ if (unlikely(down_read_trylock(&mm->mmap_sem))) {
++ up_read(&mm->mmap_sem);
++ BUG();
++ }
++#endif
++}
++
+ static void unmap_region(struct mm_struct *mm,
+ struct vm_area_struct *vma, struct vm_area_struct *prev,
+ unsigned long start, unsigned long end);
+@@ -70,22 +80,32 @@ static void unmap_region(struct mm_struct *mm,
+ * x: (no) no x: (no) yes x: (no) yes x: (yes) yes
+ *
+ */
+-pgprot_t protection_map[16] = {
++pgprot_t protection_map[16] __read_only = {
+ __P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111,
+ __S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111
+ };
+
+ pgprot_t vm_get_page_prot(unsigned long vm_flags)
+ {
+- return __pgprot(pgprot_val(protection_map[vm_flags &
++ pgprot_t prot = __pgprot(pgprot_val(protection_map[vm_flags &
+ (VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |
+ pgprot_val(arch_vm_get_page_prot(vm_flags)));
++
++#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
++ if (!nx_enabled &&
++ (vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC &&
++ (vm_flags & (VM_READ | VM_WRITE)))
++ prot = __pgprot(pte_val(pte_exprotect(__pte(pgprot_val(prot)))));
++#endif
++
++ return prot;
+ }
+ EXPORT_SYMBOL(vm_get_page_prot);
+
+ int sysctl_overcommit_memory = OVERCOMMIT_GUESS; /* heuristic overcommit */
+ int sysctl_overcommit_ratio = 50; /* default is 50% */
+ int sysctl_max_map_count __read_mostly = DEFAULT_MAX_MAP_COUNT;
++unsigned long sysctl_heap_stack_gap __read_mostly = 64*1024;
+ struct percpu_counter vm_committed_as;
+
+ /*
+@@ -231,6 +251,7 @@ static struct vm_area_struct *remove_vma(struct vm_area_struct *vma)
+ struct vm_area_struct *next = vma->vm_next;
+
+ might_sleep();
++ BUG_ON(vma->vm_mirror);
+ if (vma->vm_ops && vma->vm_ops->close)
+ vma->vm_ops->close(vma);
+ if (vma->vm_file) {
+@@ -267,6 +288,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
+ * not page aligned -Ram Gupta
+ */
+ rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
++ gr_learn_resource(current, RLIMIT_DATA, (brk - mm->start_brk) + (mm->end_data - mm->start_data), 1);
+ if (rlim < RLIM_INFINITY && (brk - mm->start_brk) +
+ (mm->end_data - mm->start_data) > rlim)
+ goto out;
+@@ -704,6 +726,12 @@ static int
+ can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
+ struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
+ {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_start == SEGMEXEC_TASK_SIZE)
++ return 0;
++#endif
++
+ if (is_mergeable_vma(vma, file, vm_flags) &&
+ is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
+ if (vma->vm_pgoff == vm_pgoff)
+@@ -723,6 +751,12 @@ static int
+ can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
+ struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
+ {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end == SEGMEXEC_TASK_SIZE)
++ return 0;
++#endif
++
+ if (is_mergeable_vma(vma, file, vm_flags) &&
+ is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
+ pgoff_t vm_pglen;
+@@ -765,12 +799,19 @@ can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
+ struct vm_area_struct *vma_merge(struct mm_struct *mm,
+ struct vm_area_struct *prev, unsigned long addr,
+ unsigned long end, unsigned long vm_flags,
+- struct anon_vma *anon_vma, struct file *file,
++ struct anon_vma *anon_vma, struct file *file,
+ pgoff_t pgoff, struct mempolicy *policy)
+ {
+ pgoff_t pglen = (end - addr) >> PAGE_SHIFT;
+ struct vm_area_struct *area, *next;
+
++#ifdef CONFIG_PAX_SEGMEXEC
++ unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE, end_m = end + SEGMEXEC_TASK_SIZE;
++ struct vm_area_struct *area_m = NULL, *next_m = NULL, *prev_m = NULL;
++
++ BUG_ON((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE < end);
++#endif
++
+ /*
+ * We later require that vma->vm_flags == vm_flags,
+ * so this tests vma->vm_flags & VM_SPECIAL, too.
+@@ -786,6 +827,15 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
+ if (next && next->vm_end == end) /* cases 6, 7, 8 */
+ next = next->vm_next;
+
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (prev)
++ prev_m = pax_find_mirror_vma(prev);
++ if (area)
++ area_m = pax_find_mirror_vma(area);
++ if (next)
++ next_m = pax_find_mirror_vma(next);
++#endif
++
+ /*
+ * Can it merge with the predecessor?
+ */
+@@ -805,9 +855,24 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
+ /* cases 1, 6 */
+ vma_adjust(prev, prev->vm_start,
+ next->vm_end, prev->vm_pgoff, NULL);
+- } else /* cases 2, 5, 7 */
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (prev_m)
++ vma_adjust(prev_m, prev_m->vm_start,
++ next_m->vm_end, prev_m->vm_pgoff, NULL);
++#endif
++
++ } else { /* cases 2, 5, 7 */
+ vma_adjust(prev, prev->vm_start,
+ end, prev->vm_pgoff, NULL);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (prev_m)
++ vma_adjust(prev_m, prev_m->vm_start,
++ end_m, prev_m->vm_pgoff, NULL);
++#endif
++
++ }
+ return prev;
+ }
+
+@@ -818,12 +883,27 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
+ mpol_equal(policy, vma_policy(next)) &&
+ can_vma_merge_before(next, vm_flags,
+ anon_vma, file, pgoff+pglen)) {
+- if (prev && addr < prev->vm_end) /* case 4 */
++ if (prev && addr < prev->vm_end) { /* case 4 */
+ vma_adjust(prev, prev->vm_start,
+ addr, prev->vm_pgoff, NULL);
+- else /* cases 3, 8 */
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (prev_m)
++ vma_adjust(prev_m, prev_m->vm_start,
++ addr_m, prev_m->vm_pgoff, NULL);
++#endif
++
++ } else { /* cases 3, 8 */
+ vma_adjust(area, addr, next->vm_end,
+ next->vm_pgoff - pglen, NULL);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (area_m)
++ vma_adjust(area_m, addr_m, next_m->vm_end,
++ next_m->vm_pgoff - pglen, NULL);
++#endif
++
++ }
+ return area;
+ }
+
+@@ -898,14 +978,11 @@ none:
+ void vm_stat_account(struct mm_struct *mm, unsigned long flags,
+ struct file *file, long pages)
+ {
+- const unsigned long stack_flags
+- = VM_STACK_FLAGS & (VM_GROWSUP|VM_GROWSDOWN);
+-
+ if (file) {
+ mm->shared_vm += pages;
+ if ((flags & (VM_EXEC|VM_WRITE)) == VM_EXEC)
+ mm->exec_vm += pages;
+- } else if (flags & stack_flags)
++ } else if (flags & (VM_GROWSUP|VM_GROWSDOWN))
+ mm->stack_vm += pages;
+ if (flags & (VM_RESERVED|VM_IO))
+ mm->reserved_vm += pages;
+@@ -932,7 +1009,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
+ * (the exception is when the underlying filesystem is noexec
+ * mounted, in which case we dont add PROT_EXEC.)
+ */
+- if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
++ if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
+ if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC)))
+ prot |= PROT_EXEC;
+
+@@ -958,7 +1035,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
+ /* Obtain the address to map to. we verify (or select) it and ensure
+ * that it represents a valid section of the address space.
+ */
+- addr = get_unmapped_area(file, addr, len, pgoff, flags);
++ addr = get_unmapped_area(file, addr, len, pgoff, flags | ((prot & PROT_EXEC) ? MAP_EXECUTABLE : 0));
+ if (addr & ~PAGE_MASK)
+ return addr;
+
+@@ -969,6 +1046,36 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
+ vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |
+ mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
+
++#ifdef CONFIG_PAX_MPROTECT
++ if (mm->pax_flags & MF_PAX_MPROTECT) {
++#ifndef CONFIG_PAX_MPROTECT_COMPAT
++ if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC)) {
++ gr_log_rwxmmap(file);
++
++#ifdef CONFIG_PAX_EMUPLT
++ vm_flags &= ~VM_EXEC;
++#else
++ return -EPERM;
++#endif
++
++ }
++
++ if (!(vm_flags & VM_EXEC))
++ vm_flags &= ~VM_MAYEXEC;
++#else
++ if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
++ vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
++#endif
++ else
++ vm_flags &= ~VM_MAYWRITE;
++ }
++#endif
++
++#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
++ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && file)
++ vm_flags &= ~VM_PAGEEXEC;
++#endif
++
+ if (flags & MAP_LOCKED)
+ if (!can_do_mlock())
+ return -EPERM;
+@@ -980,6 +1087,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
+ locked += mm->locked_vm;
+ lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
+ lock_limit >>= PAGE_SHIFT;
++ gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
+ if (locked > lock_limit && !capable(CAP_IPC_LOCK))
+ return -EAGAIN;
+ }
+@@ -1053,6 +1161,9 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
+ if (error)
+ return error;
+
++ if (!gr_acl_handle_mmap(file, prot))
++ return -EACCES;
++
+ return mmap_region(file, addr, len, flags, vm_flags, pgoff);
+ }
+ EXPORT_SYMBOL(do_mmap_pgoff);
+@@ -1065,10 +1176,10 @@ EXPORT_SYMBOL(do_mmap_pgoff);
+ */
+ int vma_wants_writenotify(struct vm_area_struct *vma)
+ {
+- unsigned int vm_flags = vma->vm_flags;
++ unsigned long vm_flags = vma->vm_flags;
+
+ /* If it was private or non-writable, the write bit is already clear */
+- if ((vm_flags & (VM_WRITE|VM_SHARED)) != ((VM_WRITE|VM_SHARED)))
++ if ((vm_flags & (VM_WRITE|VM_SHARED)) != (VM_WRITE|VM_SHARED))
+ return 0;
+
+ /* The backer wishes to know when pages are first written to? */
+@@ -1117,14 +1228,24 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
+ unsigned long charged = 0;
+ struct inode *inode = file ? file->f_path.dentry->d_inode : NULL;
+
++#ifdef CONFIG_PAX_SEGMEXEC
++ struct vm_area_struct *vma_m = NULL;
++#endif
++
++ /*
++ * mm->mmap_sem is required to protect against another thread
++ * changing the mappings in case we sleep.
++ */
++ verify_mm_writelocked(mm);
++
+ /* Clear old maps */
+ error = -ENOMEM;
+-munmap_back:
+ vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
+ if (vma && vma->vm_start < addr + len) {
+ if (do_munmap(mm, addr, len))
+ return -ENOMEM;
+- goto munmap_back;
++ vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
++ BUG_ON(vma && vma->vm_start < addr + len);
+ }
+
+ /* Check against address space limit. */
+@@ -1173,6 +1294,16 @@ munmap_back:
+ goto unacct_error;
+ }
+
++#ifdef CONFIG_PAX_SEGMEXEC
++ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vm_flags & VM_EXEC)) {
++ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++ if (!vma_m) {
++ error = -ENOMEM;
++ goto free_vma;
++ }
++ }
++#endif
++
+ vma->vm_mm = mm;
+ vma->vm_start = addr;
+ vma->vm_end = addr + len;
+@@ -1180,8 +1311,9 @@ munmap_back:
+ vma->vm_page_prot = vm_get_page_prot(vm_flags);
+ vma->vm_pgoff = pgoff;
+
++ error = -EINVAL; /* when rejecting VM_GROWSDOWN|VM_GROWSUP */
++
+ if (file) {
+- error = -EINVAL;
+ if (vm_flags & (VM_GROWSDOWN|VM_GROWSUP))
+ goto free_vma;
+ if (vm_flags & VM_DENYWRITE) {
+@@ -1195,6 +1327,19 @@ munmap_back:
+ error = file->f_op->mmap(file, vma);
+ if (error)
+ goto unmap_and_free_vma;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (vma_m && (vm_flags & VM_EXECUTABLE))
++ added_exe_file_vma(mm);
++#endif
++
++#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
++ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && !(vma->vm_flags & VM_SPECIAL)) {
++ vma->vm_flags |= VM_PAGEEXEC;
++ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
++ }
++#endif
++
+ if (vm_flags & VM_EXECUTABLE)
+ added_exe_file_vma(mm);
+
+@@ -1207,6 +1352,8 @@ munmap_back:
+ pgoff = vma->vm_pgoff;
+ vm_flags = vma->vm_flags;
+ } else if (vm_flags & VM_SHARED) {
++ if (unlikely(vm_flags & (VM_GROWSDOWN|VM_GROWSUP)))
++ goto free_vma;
+ error = shmem_zero_setup(vma);
+ if (error)
+ goto free_vma;
+@@ -1218,6 +1365,11 @@ munmap_back:
+ vma_link(mm, vma, prev, rb_link, rb_parent);
+ file = vma->vm_file;
+
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (vma_m)
++ pax_mirror_vma(vma_m, vma);
++#endif
++
+ /* Once vma denies write, undo our temporary denial count */
+ if (correct_wcount)
+ atomic_inc(&inode->i_writecount);
+@@ -1226,6 +1378,7 @@ out:
+
+ mm->total_vm += len >> PAGE_SHIFT;
+ vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
++ track_exec_limit(mm, addr, addr + len, vm_flags);
+ if (vm_flags & VM_LOCKED) {
+ /*
+ * makes pages present; downgrades, drops, reacquires mmap_sem
+@@ -1248,6 +1401,12 @@ unmap_and_free_vma:
+ unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
+ charged = 0;
+ free_vma:
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (vma_m)
++ kmem_cache_free(vm_area_cachep, vma_m);
++#endif
++
+ kmem_cache_free(vm_area_cachep, vma);
+ unacct_error:
+ if (charged)
+@@ -1255,6 +1414,44 @@ unacct_error:
+ return error;
+ }
+
++bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len)
++{
++ if (!vma) {
++#ifdef CONFIG_STACK_GROWSUP
++ if (addr > sysctl_heap_stack_gap)
++ vma = find_vma(current->mm, addr - sysctl_heap_stack_gap);
++ else
++ vma = find_vma(current->mm, 0);
++ if (vma && (vma->vm_flags & VM_GROWSUP))
++ return false;
++#endif
++ return true;
++ }
++
++ if (addr + len > vma->vm_start)
++ return false;
++
++ if (vma->vm_flags & VM_GROWSDOWN)
++ return sysctl_heap_stack_gap <= vma->vm_start - addr - len;
++#ifdef CONFIG_STACK_GROWSUP
++ else if (vma->vm_prev && (vma->vm_prev->vm_flags & VM_GROWSUP))
++ return addr - vma->vm_prev->vm_end <= sysctl_heap_stack_gap;
++#endif
++
++ return true;
++}
++
++unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len)
++{
++ if (vma->vm_start < len)
++ return -ENOMEM;
++ if (!(vma->vm_flags & VM_GROWSDOWN))
++ return vma->vm_start - len;
++ if (sysctl_heap_stack_gap <= vma->vm_start - len)
++ return vma->vm_start - len - sysctl_heap_stack_gap;
++ return -ENOMEM;
++}
++
+ /* Get an address range which is currently unmapped.
+ * For shmat() with addr=0.
+ *
+@@ -1281,18 +1478,23 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
+ if (flags & MAP_FIXED)
+ return addr;
+
++#ifdef CONFIG_PAX_RANDMMAP
++ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
++#endif
++
+ if (addr) {
+ addr = PAGE_ALIGN(addr);
+- vma = find_vma(mm, addr);
+- if (TASK_SIZE - len >= addr &&
+- (!vma || addr + len <= vma->vm_start))
+- return addr;
++ if (TASK_SIZE - len >= addr) {
++ vma = find_vma(mm, addr);
++ if (check_heap_stack_gap(vma, addr, len))
++ return addr;
++ }
+ }
+ if (len > mm->cached_hole_size) {
+- start_addr = addr = mm->free_area_cache;
++ start_addr = addr = mm->free_area_cache;
+ } else {
+- start_addr = addr = TASK_UNMAPPED_BASE;
+- mm->cached_hole_size = 0;
++ start_addr = addr = mm->mmap_base;
++ mm->cached_hole_size = 0;
+ }
+
+ full_search:
+@@ -1303,34 +1505,40 @@ full_search:
+ * Start a new search - just in case we missed
+ * some holes.
+ */
+- if (start_addr != TASK_UNMAPPED_BASE) {
+- addr = TASK_UNMAPPED_BASE;
+- start_addr = addr;
++ if (start_addr != mm->mmap_base) {
++ start_addr = addr = mm->mmap_base;
+ mm->cached_hole_size = 0;
+ goto full_search;
+ }
+ return -ENOMEM;
+ }
+- if (!vma || addr + len <= vma->vm_start) {
+- /*
+- * Remember the place where we stopped the search:
+- */
+- mm->free_area_cache = addr + len;
+- return addr;
+- }
++ if (check_heap_stack_gap(vma, addr, len))
++ break;
+ if (addr + mm->cached_hole_size < vma->vm_start)
+ mm->cached_hole_size = vma->vm_start - addr;
+ addr = vma->vm_end;
+ }
++
++ /*
++ * Remember the place where we stopped the search:
++ */
++ mm->free_area_cache = addr + len;
++ return addr;
+ }
+ #endif
+
+ void arch_unmap_area(struct mm_struct *mm, unsigned long addr)
+ {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
++ return;
++#endif
++
+ /*
+ * Is this a new hole at the lowest possible address?
+ */
+- if (addr >= TASK_UNMAPPED_BASE && addr < mm->free_area_cache) {
++ if (addr >= mm->mmap_base && addr < mm->free_area_cache) {
+ mm->free_area_cache = addr;
+ mm->cached_hole_size = ~0UL;
+ }
+@@ -1348,7 +1556,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+ {
+ struct vm_area_struct *vma;
+ struct mm_struct *mm = current->mm;
+- unsigned long addr = addr0;
++ unsigned long base = mm->mmap_base, addr = addr0;
+
+ /* requested length too big for entire address space */
+ if (len > TASK_SIZE)
+@@ -1357,13 +1565,18 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+ if (flags & MAP_FIXED)
+ return addr;
+
++#ifdef CONFIG_PAX_RANDMMAP
++ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
++#endif
++
+ /* requesting a specific address */
+ if (addr) {
+ addr = PAGE_ALIGN(addr);
+- vma = find_vma(mm, addr);
+- if (TASK_SIZE - len >= addr &&
+- (!vma || addr + len <= vma->vm_start))
+- return addr;
++ if (TASK_SIZE - len >= addr) {
++ vma = find_vma(mm, addr);
++ if (check_heap_stack_gap(vma, addr, len))
++ return addr;
++ }
+ }
+
+ /* check if free_area_cache is useful for us */
+@@ -1378,7 +1591,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+ /* make sure it can fit in the remaining address space */
+ if (addr > len) {
+ vma = find_vma(mm, addr-len);
+- if (!vma || addr <= vma->vm_start)
++ if (check_heap_stack_gap(vma, addr - len, len))
+ /* remember the address as a hint for next time */
+ return (mm->free_area_cache = addr-len);
+ }
+@@ -1395,7 +1608,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+ * return with success:
+ */
+ vma = find_vma(mm, addr);
+- if (!vma || addr+len <= vma->vm_start)
++ if (check_heap_stack_gap(vma, addr, len))
+ /* remember the address as a hint for next time */
+ return (mm->free_area_cache = addr);
+
+@@ -1404,8 +1617,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+ mm->cached_hole_size = vma->vm_start - addr;
+
+ /* try just below the current vma->vm_start */
+- addr = vma->vm_start-len;
+- } while (len < vma->vm_start);
++ addr = skip_heap_stack_gap(vma, len);
++ } while (!IS_ERR_VALUE(addr));
+
+ bottomup:
+ /*
+@@ -1414,13 +1627,21 @@ bottomup:
+ * can happen with large stack limits and large mmap()
+ * allocations.
+ */
++ mm->mmap_base = TASK_UNMAPPED_BASE;
++
++#ifdef CONFIG_PAX_RANDMMAP
++ if (mm->pax_flags & MF_PAX_RANDMMAP)
++ mm->mmap_base += mm->delta_mmap;
++#endif
++
++ mm->free_area_cache = mm->mmap_base;
+ mm->cached_hole_size = ~0UL;
+- mm->free_area_cache = TASK_UNMAPPED_BASE;
+ addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
+ /*
+ * Restore the topdown base:
+ */
+- mm->free_area_cache = mm->mmap_base;
++ mm->mmap_base = base;
++ mm->free_area_cache = base;
+ mm->cached_hole_size = ~0UL;
+
+ return addr;
+@@ -1429,6 +1650,12 @@ bottomup:
+
+ void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
+ {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
++ return;
++#endif
++
+ /*
+ * Is this a new hole at the highest possible address?
+ */
+@@ -1436,8 +1663,10 @@ void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
+ mm->free_area_cache = addr;
+
+ /* dont allow allocations above current base */
+- if (mm->free_area_cache > mm->mmap_base)
++ if (mm->free_area_cache > mm->mmap_base) {
+ mm->free_area_cache = mm->mmap_base;
++ mm->cached_hole_size = ~0UL;
++ }
+ }
+
+ unsigned long
+@@ -1510,40 +1739,49 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
+
+ EXPORT_SYMBOL(find_vma);
+
+-/* Same as find_vma, but also return a pointer to the previous VMA in *pprev. */
++/*
++ * Same as find_vma, but also return a pointer to the previous VMA in *pprev.
++ */
+ struct vm_area_struct *
+ find_vma_prev(struct mm_struct *mm, unsigned long addr,
+ struct vm_area_struct **pprev)
+ {
+- struct vm_area_struct *vma = NULL, *prev = NULL;
+- struct rb_node *rb_node;
+- if (!mm)
+- goto out;
+-
+- /* Guard against addr being lower than the first VMA */
+- vma = mm->mmap;
+-
+- /* Go through the RB tree quickly. */
+- rb_node = mm->mm_rb.rb_node;
+-
+- while (rb_node) {
+- struct vm_area_struct *vma_tmp;
+- vma_tmp = rb_entry(rb_node, struct vm_area_struct, vm_rb);
+-
+- if (addr < vma_tmp->vm_end) {
+- rb_node = rb_node->rb_left;
+- } else {
+- prev = vma_tmp;
+- if (!prev->vm_next || (addr < prev->vm_next->vm_end))
+- break;
++ struct vm_area_struct *vma;
++
++ vma = find_vma(mm, addr);
++ if (vma) {
++ *pprev = vma->vm_prev;
++ } else {
++ struct rb_node *rb_node = mm->mm_rb.rb_node;
++ *pprev = NULL;
++ while (rb_node) {
++ *pprev = rb_entry(rb_node, struct vm_area_struct, vm_rb);
+ rb_node = rb_node->rb_right;
+ }
+ }
++ return vma;
++}
++
++#ifdef CONFIG_PAX_SEGMEXEC
++struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma)
++{
++ struct vm_area_struct *vma_m;
+
+-out:
+- *pprev = prev;
+- return prev ? prev->vm_next : vma;
++ BUG_ON(!vma || vma->vm_start >= vma->vm_end);
++ if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC)) {
++ BUG_ON(vma->vm_mirror);
++ return NULL;
++ }
++ BUG_ON(vma->vm_start < SEGMEXEC_TASK_SIZE && SEGMEXEC_TASK_SIZE < vma->vm_end);
++ vma_m = vma->vm_mirror;
++ BUG_ON(!vma_m || vma_m->vm_mirror != vma);
++ BUG_ON(vma->vm_file != vma_m->vm_file);
++ BUG_ON(vma->vm_end - vma->vm_start != vma_m->vm_end - vma_m->vm_start);
++ BUG_ON(vma->vm_pgoff != vma_m->vm_pgoff || vma->anon_vma != vma_m->anon_vma);
++ BUG_ON((vma->vm_flags ^ vma_m->vm_flags) & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED | VM_RESERVED));
++ return vma_m;
+ }
++#endif
+
+ /*
+ * Verify that the stack growth is acceptable and
+@@ -1561,6 +1799,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+ return -ENOMEM;
+
+ /* Stack limit test */
++ gr_learn_resource(current, RLIMIT_STACK, size, 1);
+ if (size > rlim[RLIMIT_STACK].rlim_cur)
+ return -ENOMEM;
+
+@@ -1570,6 +1809,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+ unsigned long limit;
+ locked = mm->locked_vm + grow;
+ limit = rlim[RLIMIT_MEMLOCK].rlim_cur >> PAGE_SHIFT;
++ gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
+ if (locked > limit && !capable(CAP_IPC_LOCK))
+ return -ENOMEM;
+ }
+@@ -1600,37 +1840,48 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+ * PA-RISC uses this for its stack; IA64 for its Register Backing Store.
+ * vma is the last one with address > vma->vm_end. Have to extend vma.
+ */
++#ifndef CONFIG_IA64
++static
++#endif
+ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
+ {
+ int error;
++ bool locknext;
+
+ if (!(vma->vm_flags & VM_GROWSUP))
+ return -EFAULT;
+
++ /* Also guard against wrapping around to address 0. */
++ if (address < PAGE_ALIGN(address+1))
++ address = PAGE_ALIGN(address+1);
++ else
++ return -ENOMEM;
++
+ /*
+ * We must make sure the anon_vma is allocated
+ * so that the anon_vma locking is not a noop.
+ */
+ if (unlikely(anon_vma_prepare(vma)))
+ return -ENOMEM;
++ locknext = vma->vm_next && (vma->vm_next->vm_flags & VM_GROWSDOWN);
++ if (locknext && anon_vma_prepare(vma->vm_next))
++ return -ENOMEM;
+ anon_vma_lock(vma);
++ if (locknext)
++ anon_vma_lock(vma->vm_next);
+
+ /*
+ * vma->vm_start/vm_end cannot change under us because the caller
+ * is required to hold the mmap_sem in read mode. We need the
+- * anon_vma lock to serialize against concurrent expand_stacks.
+- * Also guard against wrapping around to address 0.
++ * anon_vma locks to serialize against concurrent expand_stacks
++ * and expand_upwards.
+ */
+- if (address < PAGE_ALIGN(address+4))
+- address = PAGE_ALIGN(address+4);
+- else {
+- anon_vma_unlock(vma);
+- return -ENOMEM;
+- }
+ error = 0;
+
+ /* Somebody else might have raced and expanded it already */
+- if (address > vma->vm_end) {
++ if (vma->vm_next && (vma->vm_next->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && vma->vm_next->vm_start - address < sysctl_heap_stack_gap)
++ error = -ENOMEM;
++ else if (address > vma->vm_end && (!locknext || vma->vm_next->vm_start >= address)) {
+ unsigned long size, grow;
+
+ size = address - vma->vm_start;
+@@ -1643,6 +1894,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
+ vma->vm_end = address;
+ }
+ }
++ if (locknext)
++ anon_vma_unlock(vma->vm_next);
+ anon_vma_unlock(vma);
+ return error;
+ }
+@@ -1655,6 +1908,8 @@ static int expand_downwards(struct vm_area_struct *vma,
+ unsigned long address)
+ {
+ int error;
++ bool lockprev = false;
++ struct vm_area_struct *prev;
+
+ /*
+ * We must make sure the anon_vma is allocated
+@@ -1668,6 +1923,15 @@ static int expand_downwards(struct vm_area_struct *vma,
+ if (error)
+ return error;
+
++ prev = vma->vm_prev;
++#if defined(CONFIG_STACK_GROWSUP) || defined(CONFIG_IA64)
++ lockprev = prev && (prev->vm_flags & VM_GROWSUP);
++#endif
++ if (lockprev && anon_vma_prepare(prev))
++ return -ENOMEM;
++ if (lockprev)
++ anon_vma_lock(prev);
++
+ anon_vma_lock(vma);
+
+ /*
+@@ -1677,9 +1941,17 @@ static int expand_downwards(struct vm_area_struct *vma,
+ */
+
+ /* Somebody else might have raced and expanded it already */
+- if (address < vma->vm_start) {
++ if (prev && (prev->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && address - prev->vm_end < sysctl_heap_stack_gap)
++ error = -ENOMEM;
++ else if (address < vma->vm_start && (!lockprev || prev->vm_end <= address)) {
+ unsigned long size, grow;
+
++#ifdef CONFIG_PAX_SEGMEXEC
++ struct vm_area_struct *vma_m;
++
++ vma_m = pax_find_mirror_vma(vma);
++#endif
++
+ size = vma->vm_end - address;
+ grow = (vma->vm_start - address) >> PAGE_SHIFT;
+
+@@ -1689,10 +1961,22 @@ static int expand_downwards(struct vm_area_struct *vma,
+ if (!error) {
+ vma->vm_start = address;
+ vma->vm_pgoff -= grow;
++ track_exec_limit(vma->vm_mm, vma->vm_start, vma->vm_end, vma->vm_flags);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (vma_m) {
++ vma_m->vm_start -= grow << PAGE_SHIFT;
++ vma_m->vm_pgoff -= grow;
++ }
++#endif
++
++
+ }
+ }
+ }
+ anon_vma_unlock(vma);
++ if (lockprev)
++ anon_vma_unlock(prev);
+ return error;
+ }
+
+@@ -1768,6 +2052,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
+ do {
+ long nrpages = vma_pages(vma);
+
++#ifdef CONFIG_PAX_SEGMEXEC
++ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE)) {
++ vma = remove_vma(vma);
++ continue;
++ }
++#endif
++
+ mm->total_vm -= nrpages;
+ vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
+ vma = remove_vma(vma);
+@@ -1813,6 +2104,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
+ insertion_point = (prev ? &prev->vm_next : &mm->mmap);
+ vma->vm_prev = NULL;
+ do {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (vma->vm_mirror) {
++ BUG_ON(!vma->vm_mirror->vm_mirror || vma->vm_mirror->vm_mirror != vma);
++ vma->vm_mirror->vm_mirror = NULL;
++ vma->vm_mirror->vm_flags &= ~VM_EXEC;
++ vma->vm_mirror = NULL;
++ }
++#endif
++
+ rb_erase(&vma->vm_rb, &mm->mm_rb);
+ mm->map_count--;
+ tail_vma = vma;
+@@ -1840,10 +2141,25 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+ struct mempolicy *pol;
+ struct vm_area_struct *new;
+
++#ifdef CONFIG_PAX_SEGMEXEC
++ struct vm_area_struct *vma_m, *new_m = NULL;
++ unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE;
++#endif
++
+ if (is_vm_hugetlb_page(vma) && (addr &
+ ~(huge_page_mask(hstate_vma(vma)))))
+ return -EINVAL;
+
++#ifdef CONFIG_PAX_SEGMEXEC
++ vma_m = pax_find_mirror_vma(vma);
++
++ if (mm->pax_flags & MF_PAX_SEGMEXEC) {
++ BUG_ON(vma->vm_end > SEGMEXEC_TASK_SIZE);
++ if (mm->map_count >= sysctl_max_map_count-1)
++ return -ENOMEM;
++ } else
++#endif
++
+ if (mm->map_count >= sysctl_max_map_count)
+ return -ENOMEM;
+
+@@ -1851,6 +2167,16 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+ if (!new)
+ return -ENOMEM;
+
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (vma_m) {
++ new_m = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
++ if (!new_m) {
++ kmem_cache_free(vm_area_cachep, new);
++ return -ENOMEM;
++ }
++ }
++#endif
++
+ /* most fields are the same, copy all, and then fixup */
+ *new = *vma;
+
+@@ -1861,8 +2187,29 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+ new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
+ }
+
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (vma_m) {
++ *new_m = *vma_m;
++ new_m->vm_mirror = new;
++ new->vm_mirror = new_m;
++
++ if (new_below)
++ new_m->vm_end = addr_m;
++ else {
++ new_m->vm_start = addr_m;
++ new_m->vm_pgoff += ((addr_m - vma_m->vm_start) >> PAGE_SHIFT);
++ }
++ }
++#endif
++
+ pol = mpol_dup(vma_policy(vma));
+ if (IS_ERR(pol)) {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (new_m)
++ kmem_cache_free(vm_area_cachep, new_m);
++#endif
++
+ kmem_cache_free(vm_area_cachep, new);
+ return PTR_ERR(pol);
+ }
+@@ -1883,6 +2230,28 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+ else
+ vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
+
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (vma_m) {
++ mpol_get(pol);
++ vma_set_policy(new_m, pol);
++
++ if (new_m->vm_file) {
++ get_file(new_m->vm_file);
++ if (vma_m->vm_flags & VM_EXECUTABLE)
++ added_exe_file_vma(mm);
++ }
++
++ if (new_m->vm_ops && new_m->vm_ops->open)
++ new_m->vm_ops->open(new_m);
++
++ if (new_below)
++ vma_adjust(vma_m, addr_m, vma_m->vm_end, vma_m->vm_pgoff +
++ ((addr_m - new_m->vm_start) >> PAGE_SHIFT), new_m);
++ else
++ vma_adjust(vma_m, vma_m->vm_start, addr_m, vma_m->vm_pgoff, new_m);
++ }
++#endif
++
+ return 0;
+ }
+
+@@ -1891,11 +2260,30 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+ * work. This now handles partial unmappings.
+ * Jeremy Fitzhardinge <jeremy@goop.org>
+ */
++#ifdef CONFIG_PAX_SEGMEXEC
+ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
+ {
++ int ret = __do_munmap(mm, start, len);
++ if (ret || !(mm->pax_flags & MF_PAX_SEGMEXEC))
++ return ret;
++
++ return __do_munmap(mm, start + SEGMEXEC_TASK_SIZE, len);
++}
++
++int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
++#else
++int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
++#endif
++{
+ unsigned long end;
+ struct vm_area_struct *vma, *prev, *last;
+
++ /*
++ * mm->mmap_sem is required to protect against another thread
++ * changing the mappings in case we sleep.
++ */
++ verify_mm_writelocked(mm);
++
+ if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
+ return -EINVAL;
+
+@@ -1959,6 +2347,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
+ /* Fix up all other VM information */
+ remove_vma_list(mm, vma);
+
++ track_exec_limit(mm, start, end, 0UL);
++
+ return 0;
+ }
+
+@@ -1971,22 +2361,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
+
+ profile_munmap(addr);
+
++#ifdef CONFIG_PAX_SEGMEXEC
++ if ((mm->pax_flags & MF_PAX_SEGMEXEC) &&
++ (len > SEGMEXEC_TASK_SIZE || addr > SEGMEXEC_TASK_SIZE-len))
++ return -EINVAL;
++#endif
++
+ down_write(&mm->mmap_sem);
+ ret = do_munmap(mm, addr, len);
+ up_write(&mm->mmap_sem);
+ return ret;
+ }
+
+-static inline void verify_mm_writelocked(struct mm_struct *mm)
+-{
+-#ifdef CONFIG_DEBUG_VM
+- if (unlikely(down_read_trylock(&mm->mmap_sem))) {
+- WARN_ON(1);
+- up_read(&mm->mmap_sem);
+- }
+-#endif
+-}
+-
+ /*
+ * this is really a simplified "do_mmap". it only handles
+ * anonymous maps. eventually we may be able to do some
+@@ -2000,6 +2386,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
+ struct rb_node ** rb_link, * rb_parent;
+ pgoff_t pgoff = addr >> PAGE_SHIFT;
+ int error;
++ unsigned long charged;
+
+ len = PAGE_ALIGN(len);
+ if (!len)
+@@ -2011,16 +2398,30 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
+
+ flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
+
++#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
++ if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
++ flags &= ~VM_EXEC;
++
++#ifdef CONFIG_PAX_MPROTECT
++ if (mm->pax_flags & MF_PAX_MPROTECT)
++ flags &= ~VM_MAYEXEC;
++#endif
++
++ }
++#endif
++
+ error = get_unmapped_area(NULL, addr, len, 0, MAP_FIXED);
+ if (error & ~PAGE_MASK)
+ return error;
+
++ charged = len >> PAGE_SHIFT;
++
+ /*
+ * mlock MCL_FUTURE?
+ */
+ if (mm->def_flags & VM_LOCKED) {
+ unsigned long locked, lock_limit;
+- locked = len >> PAGE_SHIFT;
++ locked = charged;
+ locked += mm->locked_vm;
+ lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
+ lock_limit >>= PAGE_SHIFT;
+@@ -2037,22 +2438,22 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
+ /*
+ * Clear old maps. this also does some error checking for us
+ */
+- munmap_back:
+ vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
+ if (vma && vma->vm_start < addr + len) {
+ if (do_munmap(mm, addr, len))
+ return -ENOMEM;
+- goto munmap_back;
++ vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
++ BUG_ON(vma && vma->vm_start < addr + len);
+ }
+
+ /* Check against address space limits *after* clearing old maps... */
+- if (!may_expand_vm(mm, len >> PAGE_SHIFT))
++ if (!may_expand_vm(mm, charged))
+ return -ENOMEM;
+
+ if (mm->map_count > sysctl_max_map_count)
+ return -ENOMEM;
+
+- if (security_vm_enough_memory(len >> PAGE_SHIFT))
++ if (security_vm_enough_memory(charged))
+ return -ENOMEM;
+
+ /* Can we just expand an old private anonymous mapping? */
+@@ -2066,7 +2467,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
+ */
+ vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
+ if (!vma) {
+- vm_unacct_memory(len >> PAGE_SHIFT);
++ vm_unacct_memory(charged);
+ return -ENOMEM;
+ }
+
+@@ -2078,11 +2479,12 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
+ vma->vm_page_prot = vm_get_page_prot(flags);
+ vma_link(mm, vma, prev, rb_link, rb_parent);
+ out:
+- mm->total_vm += len >> PAGE_SHIFT;
++ mm->total_vm += charged;
+ if (flags & VM_LOCKED) {
+ if (!mlock_vma_pages_range(vma, addr, addr + len))
+- mm->locked_vm += (len >> PAGE_SHIFT);
++ mm->locked_vm += charged;
+ }
++ track_exec_limit(mm, addr, addr + len, flags);
+ return addr;
+ }
+
+@@ -2129,8 +2531,10 @@ void exit_mmap(struct mm_struct *mm)
+ * Walk the list again, actually closing and freeing it,
+ * with preemption enabled, without holding any MM locks.
+ */
+- while (vma)
++ while (vma) {
++ vma->vm_mirror = NULL;
+ vma = remove_vma(vma);
++ }
+
+ BUG_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT);
+ }
+@@ -2144,6 +2548,10 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
+ struct vm_area_struct * __vma, * prev;
+ struct rb_node ** rb_link, * rb_parent;
+
++#ifdef CONFIG_PAX_SEGMEXEC
++ struct vm_area_struct *vma_m = NULL;
++#endif
++
+ /*
+ * The vm_pgoff of a purely anonymous vma should be irrelevant
+ * until its first write fault, when page's anon_vma and index
+@@ -2166,7 +2574,22 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
+ if ((vma->vm_flags & VM_ACCOUNT) &&
+ security_vm_enough_memory_mm(mm, vma_pages(vma)))
+ return -ENOMEM;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_EXEC)) {
++ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++ if (!vma_m)
++ return -ENOMEM;
++ }
++#endif
++
+ vma_link(mm, vma, prev, rb_link, rb_parent);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (vma_m)
++ pax_mirror_vma(vma_m, vma);
++#endif
++
+ return 0;
+ }
+
+@@ -2184,6 +2607,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
+ struct rb_node **rb_link, *rb_parent;
+ struct mempolicy *pol;
+
++ BUG_ON(vma->vm_mirror);
++
+ /*
+ * If anonymous vma has not yet been faulted, update new pgoff
+ * to match new location, to increase its chance of merging.
+@@ -2227,6 +2652,35 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
+ return new_vma;
+ }
+
++#ifdef CONFIG_PAX_SEGMEXEC
++void pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma)
++{
++ struct vm_area_struct *prev_m;
++ struct rb_node **rb_link_m, *rb_parent_m;
++ struct mempolicy *pol_m;
++
++ BUG_ON(!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC));
++ BUG_ON(vma->vm_mirror || vma_m->vm_mirror);
++ BUG_ON(!mpol_equal(vma_policy(vma), vma_policy(vma_m)));
++ *vma_m = *vma;
++ pol_m = vma_policy(vma_m);
++ mpol_get(pol_m);
++ vma_set_policy(vma_m, pol_m);
++ vma_m->vm_start += SEGMEXEC_TASK_SIZE;
++ vma_m->vm_end += SEGMEXEC_TASK_SIZE;
++ vma_m->vm_flags &= ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED);
++ vma_m->vm_page_prot = vm_get_page_prot(vma_m->vm_flags);
++ if (vma_m->vm_file)
++ get_file(vma_m->vm_file);
++ if (vma_m->vm_ops && vma_m->vm_ops->open)
++ vma_m->vm_ops->open(vma_m);
++ find_vma_prepare(vma->vm_mm, vma_m->vm_start, &prev_m, &rb_link_m, &rb_parent_m);
++ vma_link(vma->vm_mm, vma_m, prev_m, rb_link_m, rb_parent_m);
++ vma_m->vm_mirror = vma;
++ vma->vm_mirror = vma_m;
++}
++#endif
++
+ /*
+ * Return true if the calling process may expand its vm space by the passed
+ * number of pages
+@@ -2238,6 +2692,12 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages)
+
+ lim = current->signal->rlim[RLIMIT_AS].rlim_cur >> PAGE_SHIFT;
+
++#ifdef CONFIG_PAX_RANDMMAP
++ if (mm->pax_flags & MF_PAX_RANDMMAP)
++ cur -= mm->brk_gap;
++#endif
++
++ gr_learn_resource(current, RLIMIT_AS, (cur + npages) << PAGE_SHIFT, 1);
+ if (cur + npages > lim)
+ return 0;
+ return 1;
+@@ -2307,6 +2767,22 @@ int install_special_mapping(struct mm_struct *mm,
+ vma->vm_start = addr;
+ vma->vm_end = addr + len;
+
++#ifdef CONFIG_PAX_MPROTECT
++ if (mm->pax_flags & MF_PAX_MPROTECT) {
++#ifndef CONFIG_PAX_MPROTECT_COMPAT
++ if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC))
++ return -EPERM;
++ if (!(vm_flags & VM_EXEC))
++ vm_flags &= ~VM_MAYEXEC;
++#else
++ if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
++ vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
++#endif
++ else
++ vm_flags &= ~VM_MAYWRITE;
++ }
++#endif
++
+ vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND;
+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
+
+diff --git a/mm/mprotect.c b/mm/mprotect.c
+index 1737c7e..c7faeb4 100644
+--- a/mm/mprotect.c
++++ b/mm/mprotect.c
+@@ -24,10 +24,16 @@
+ #include <linux/mmu_notifier.h>
+ #include <linux/migrate.h>
+ #include <linux/perf_event.h>
++
++#ifdef CONFIG_PAX_MPROTECT
++#include <linux/elf.h>
++#endif
++
+ #include <asm/uaccess.h>
+ #include <asm/pgtable.h>
+ #include <asm/cacheflush.h>
+ #include <asm/tlbflush.h>
++#include <asm/mmu_context.h>
+
+ #ifndef pgprot_modify
+ static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
+@@ -132,6 +138,48 @@ static void change_protection(struct vm_area_struct *vma,
+ flush_tlb_range(vma, start, end);
+ }
+
++#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
++/* called while holding the mmap semaphor for writing except stack expansion */
++void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot)
++{
++ unsigned long oldlimit, newlimit = 0UL;
++
++ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || nx_enabled)
++ return;
++
++ spin_lock(&mm->page_table_lock);
++ oldlimit = mm->context.user_cs_limit;
++ if ((prot & VM_EXEC) && oldlimit < end)
++ /* USER_CS limit moved up */
++ newlimit = end;
++ else if (!(prot & VM_EXEC) && start < oldlimit && oldlimit <= end)
++ /* USER_CS limit moved down */
++ newlimit = start;
++
++ if (newlimit) {
++ mm->context.user_cs_limit = newlimit;
++
++#ifdef CONFIG_SMP
++ wmb();
++ cpus_clear(mm->context.cpu_user_cs_mask);
++ cpu_set(smp_processor_id(), mm->context.cpu_user_cs_mask);
++#endif
++
++ set_user_cs(mm->context.user_cs_base, mm->context.user_cs_limit, smp_processor_id());
++ }
++ spin_unlock(&mm->page_table_lock);
++ if (newlimit == end) {
++ struct vm_area_struct *vma = find_vma(mm, oldlimit);
++
++ for (; vma && vma->vm_start < end; vma = vma->vm_next)
++ if (is_vm_hugetlb_page(vma))
++ hugetlb_change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot);
++ else
++ change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot, vma_wants_writenotify(vma));
++ }
++}
++#endif
++
+ int
+ mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
+ unsigned long start, unsigned long end, unsigned long newflags)
+@@ -144,11 +192,29 @@ mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
+ int error;
+ int dirty_accountable = 0;
+
++#ifdef CONFIG_PAX_SEGMEXEC
++ struct vm_area_struct *vma_m = NULL;
++ unsigned long start_m, end_m;
++
++ start_m = start + SEGMEXEC_TASK_SIZE;
++ end_m = end + SEGMEXEC_TASK_SIZE;
++#endif
++
+ if (newflags == oldflags) {
+ *pprev = vma;
+ return 0;
+ }
+
++ if (newflags & (VM_READ | VM_WRITE | VM_EXEC)) {
++ struct vm_area_struct *prev = vma->vm_prev, *next = vma->vm_next;
++
++ if (next && (next->vm_flags & VM_GROWSDOWN) && sysctl_heap_stack_gap > next->vm_start - end)
++ return -ENOMEM;
++
++ if (prev && (prev->vm_flags & VM_GROWSUP) && sysctl_heap_stack_gap > start - prev->vm_end)
++ return -ENOMEM;
++ }
++
+ /*
+ * If we make a private mapping writable we increase our commit;
+ * but (without finer accounting) cannot reduce our commit if we
+@@ -165,6 +231,38 @@ mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
+ }
+ }
+
++#ifdef CONFIG_PAX_SEGMEXEC
++ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && ((oldflags ^ newflags) & VM_EXEC)) {
++ if (start != vma->vm_start) {
++ error = split_vma(mm, vma, start, 1);
++ if (error)
++ goto fail;
++ BUG_ON(!*pprev || (*pprev)->vm_next == vma);
++ *pprev = (*pprev)->vm_next;
++ }
++
++ if (end != vma->vm_end) {
++ error = split_vma(mm, vma, end, 0);
++ if (error)
++ goto fail;
++ }
++
++ if (pax_find_mirror_vma(vma)) {
++ error = __do_munmap(mm, start_m, end_m - start_m);
++ if (error)
++ goto fail;
++ } else {
++ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++ if (!vma_m) {
++ error = -ENOMEM;
++ goto fail;
++ }
++ vma->vm_flags = newflags;
++ pax_mirror_vma(vma_m, vma);
++ }
++ }
++#endif
++
+ /*
+ * First try to merge with previous and/or next vma.
+ */
+@@ -195,9 +293,21 @@ success:
+ * vm_flags and vm_page_prot are protected by the mmap_sem
+ * held in write mode.
+ */
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (newflags & VM_EXEC) && ((vma->vm_flags ^ newflags) & VM_READ))
++ pax_find_mirror_vma(vma)->vm_flags ^= VM_READ;
++#endif
++
+ vma->vm_flags = newflags;
++
++#ifdef CONFIG_PAX_MPROTECT
++ if (mm->binfmt && mm->binfmt->handle_mprotect)
++ mm->binfmt->handle_mprotect(vma, newflags);
++#endif
++
+ vma->vm_page_prot = pgprot_modify(vma->vm_page_prot,
+- vm_get_page_prot(newflags));
++ vm_get_page_prot(vma->vm_flags));
+
+ if (vma_wants_writenotify(vma)) {
+ vma->vm_page_prot = vm_get_page_prot(newflags & ~VM_SHARED);
+@@ -239,6 +349,17 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
+ end = start + len;
+ if (end <= start)
+ return -ENOMEM;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
++ if (end > SEGMEXEC_TASK_SIZE)
++ return -EINVAL;
++ } else
++#endif
++
++ if (end > TASK_SIZE)
++ return -EINVAL;
++
+ if (!arch_validate_prot(prot))
+ return -EINVAL;
+
+@@ -246,7 +367,7 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
+ /*
+ * Does the application expect PROT_READ to imply PROT_EXEC:
+ */
+- if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
++ if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
+ prot |= PROT_EXEC;
+
+ vm_flags = calc_vm_prot_bits(prot);
+@@ -278,6 +399,11 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
+ if (start > vma->vm_start)
+ prev = vma;
+
++#ifdef CONFIG_PAX_MPROTECT
++ if (current->mm->binfmt && current->mm->binfmt->handle_mprotect)
++ current->mm->binfmt->handle_mprotect(vma, vm_flags);
++#endif
++
+ for (nstart = start ; ; ) {
+ unsigned long newflags;
+
+@@ -287,6 +413,14 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
+
+ /* newflags >> 4 shift VM_MAY% in place of VM_% */
+ if ((newflags & ~(newflags >> 4)) & (VM_READ | VM_WRITE | VM_EXEC)) {
++ if (prot & (PROT_WRITE | PROT_EXEC))
++ gr_log_rwxmprotect(vma->vm_file);
++
++ error = -EACCES;
++ goto out;
++ }
++
++ if (!gr_acl_handle_mprotect(vma->vm_file, prot)) {
+ error = -EACCES;
+ goto out;
+ }
+@@ -301,6 +435,9 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
+ error = mprotect_fixup(vma, &prev, nstart, tmp, newflags);
+ if (error)
+ goto out;
++
++ track_exec_limit(current->mm, nstart, tmp, vm_flags);
++
+ nstart = tmp;
+
+ if (nstart < prev->vm_end)
+diff --git a/mm/mremap.c b/mm/mremap.c
+index 3e98d79..1706cec 100644
+--- a/mm/mremap.c
++++ b/mm/mremap.c
+@@ -112,6 +112,12 @@ static void move_ptes(struct vm_area_struct *vma, pmd_t *old_pmd,
+ continue;
+ pte = ptep_clear_flush(vma, old_addr, old_pte);
+ pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
++
++#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
++ if (!nx_enabled && (new_vma->vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC)
++ pte = pte_exprotect(pte);
++#endif
++
+ set_pte_at(mm, new_addr, new_pte, pte);
+ }
+
+@@ -271,6 +277,11 @@ static struct vm_area_struct *vma_to_resize(unsigned long addr,
+ if (is_vm_hugetlb_page(vma))
+ goto Einval;
+
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (pax_find_mirror_vma(vma))
++ goto Einval;
++#endif
++
+ /* We can't remap across vm area boundaries */
+ if (old_len > vma->vm_end - addr)
+ goto Efault;
+@@ -327,20 +338,25 @@ static unsigned long mremap_to(unsigned long addr,
+ unsigned long ret = -EINVAL;
+ unsigned long charged = 0;
+ unsigned long map_flags;
++ unsigned long pax_task_size = TASK_SIZE;
+
+ if (new_addr & ~PAGE_MASK)
+ goto out;
+
+- if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len)
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (mm->pax_flags & MF_PAX_SEGMEXEC)
++ pax_task_size = SEGMEXEC_TASK_SIZE;
++#endif
++
++ pax_task_size -= PAGE_SIZE;
++
++ if (new_len > TASK_SIZE || new_addr > pax_task_size - new_len)
+ goto out;
+
+ /* Check if the location we're moving into overlaps the
+ * old location at all, and fail if it does.
+ */
+- if ((new_addr <= addr) && (new_addr+new_len) > addr)
+- goto out;
+-
+- if ((addr <= new_addr) && (addr+old_len) > new_addr)
++ if (addr + old_len > new_addr && new_addr + new_len > addr)
+ goto out;
+
+ ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
+@@ -412,6 +428,7 @@ unsigned long do_mremap(unsigned long addr,
+ struct vm_area_struct *vma;
+ unsigned long ret = -EINVAL;
+ unsigned long charged = 0;
++ unsigned long pax_task_size = TASK_SIZE;
+
+ if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
+ goto out;
+@@ -430,6 +447,17 @@ unsigned long do_mremap(unsigned long addr,
+ if (!new_len)
+ goto out;
+
++#ifdef CONFIG_PAX_SEGMEXEC
++ if (mm->pax_flags & MF_PAX_SEGMEXEC)
++ pax_task_size = SEGMEXEC_TASK_SIZE;
++#endif
++
++ pax_task_size -= PAGE_SIZE;
++
++ if (new_len > pax_task_size || addr > pax_task_size-new_len ||
++ old_len > pax_task_size || addr > pax_task_size-old_len)
++ goto out;
++
+ if (flags & MREMAP_FIXED) {
+ if (flags & MREMAP_MAYMOVE)
+ ret = mremap_to(addr, old_len, new_addr, new_len);
+@@ -476,6 +504,7 @@ unsigned long do_mremap(unsigned long addr,
+ addr + new_len);
+ }
+ ret = addr;
++ track_exec_limit(vma->vm_mm, vma->vm_start, addr + new_len, vma->vm_flags);
+ goto out;
+ }
+ }
+@@ -502,7 +531,13 @@ unsigned long do_mremap(unsigned long addr,
+ ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
+ if (ret)
+ goto out;
++
++ map_flags = vma->vm_flags;
+ ret = move_vma(vma, addr, old_len, new_len, new_addr);
++ if (!(ret & ~PAGE_MASK)) {
++ track_exec_limit(current->mm, addr, addr + old_len, 0UL);
++ track_exec_limit(current->mm, new_addr, new_addr + new_len, map_flags);
++ }
+ }
+ out:
+ if (ret & ~PAGE_MASK)
+diff --git a/mm/nommu.c b/mm/nommu.c
+index 406e8d4..53970d3 100644
+--- a/mm/nommu.c
++++ b/mm/nommu.c
+@@ -67,7 +67,6 @@ int sysctl_overcommit_memory = OVERCOMMIT_GUESS; /* heuristic overcommit */
+ int sysctl_overcommit_ratio = 50; /* default is 50% */
+ int sysctl_max_map_count = DEFAULT_MAX_MAP_COUNT;
+ int sysctl_nr_trim_pages = CONFIG_NOMMU_INITIAL_TRIM_EXCESS;
+-int heap_stack_gap = 0;
+
+ atomic_long_t mmap_pages_allocated;
+
+@@ -761,15 +760,6 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
+ EXPORT_SYMBOL(find_vma);
+
+ /*
+- * find a VMA
+- * - we don't extend stack VMAs under NOMMU conditions
+- */
+-struct vm_area_struct *find_extend_vma(struct mm_struct *mm, unsigned long addr)
+-{
+- return find_vma(mm, addr);
+-}
+-
+-/*
+ * expand a stack to a given address
+ * - not supported under NOMMU conditions
+ */
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 3ecab7e..594a471 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -289,7 +289,7 @@ out:
+ * This usage means that zero-order pages may not be compound.
+ */
+
+-static void free_compound_page(struct page *page)
++void free_compound_page(struct page *page)
+ {
+ __free_pages_ok(page, compound_order(page));
+ }
+@@ -587,6 +587,10 @@ static void __free_pages_ok(struct page *page, unsigned int order)
+ int bad = 0;
+ int wasMlocked = __TestClearPageMlocked(page);
+
++#ifdef CONFIG_PAX_MEMORY_SANITIZE
++ unsigned long index = 1UL << order;
++#endif
++
+ kmemcheck_free_shadow(page, order);
+
+ for (i = 0 ; i < (1 << order) ; ++i)
+@@ -599,6 +603,12 @@ static void __free_pages_ok(struct page *page, unsigned int order)
+ debug_check_no_obj_freed(page_address(page),
+ PAGE_SIZE << order);
+ }
++
++#ifdef CONFIG_PAX_MEMORY_SANITIZE
++ for (; index; --index)
++ sanitize_highpage(page + index - 1);
++#endif
++
+ arch_free_page(page, order);
+ kernel_map_pages(page, 1 << order, 0);
+
+@@ -702,8 +712,10 @@ static int prep_new_page(struct page *page, int order, gfp_t gfp_flags)
+ arch_alloc_page(page, order);
+ kernel_map_pages(page, 1 << order, 1);
+
++#ifndef CONFIG_PAX_MEMORY_SANITIZE
+ if (gfp_flags & __GFP_ZERO)
+ prep_zero_page(page, order, gfp_flags);
++#endif
+
+ if (order && (gfp_flags & __GFP_COMP))
+ prep_compound_page(page, order);
+@@ -1097,6 +1109,11 @@ static void free_hot_cold_page(struct page *page, int cold)
+ debug_check_no_locks_freed(page_address(page), PAGE_SIZE);
+ debug_check_no_obj_freed(page_address(page), PAGE_SIZE);
+ }
++
++#ifdef CONFIG_PAX_MEMORY_SANITIZE
++ sanitize_highpage(page);
++#endif
++
+ arch_free_page(page, 0);
+ kernel_map_pages(page, 1, 0);
+
+@@ -2179,6 +2196,8 @@ void show_free_areas(void)
+ int cpu;
+ struct zone *zone;
+
++ pax_track_stack();
++
+ for_each_populated_zone(zone) {
+ show_node(zone);
+ printk("%s per-cpu:\n", zone->name);
+@@ -3736,7 +3755,7 @@ static void __init setup_usemap(struct pglist_data *pgdat,
+ zone->pageblock_flags = alloc_bootmem_node(pgdat, usemapsize);
+ }
+ #else
+-static void inline setup_usemap(struct pglist_data *pgdat,
++static inline void setup_usemap(struct pglist_data *pgdat,
+ struct zone *zone, unsigned long zonesize) {}
+ #endif /* CONFIG_SPARSEMEM */
+
+diff --git a/mm/percpu.c b/mm/percpu.c
+index c90614a..5f7b7b8 100644
+--- a/mm/percpu.c
++++ b/mm/percpu.c
+@@ -115,7 +115,7 @@ static unsigned int pcpu_low_unit_cpu __read_mostly;
+ static unsigned int pcpu_high_unit_cpu __read_mostly;
+
+ /* the address of the first chunk which starts with the kernel static area */
+-void *pcpu_base_addr __read_mostly;
++void *pcpu_base_addr __read_only;
+ EXPORT_SYMBOL_GPL(pcpu_base_addr);
+
+ static const int *pcpu_unit_map __read_mostly; /* cpu -> unit */
+diff --git a/mm/rmap.c b/mm/rmap.c
+index dd43373..d848cd7 100644
+--- a/mm/rmap.c
++++ b/mm/rmap.c
+@@ -121,6 +121,17 @@ int anon_vma_prepare(struct vm_area_struct *vma)
+ /* page_table_lock to protect against threads */
+ spin_lock(&mm->page_table_lock);
+ if (likely(!vma->anon_vma)) {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++ struct vm_area_struct *vma_m = pax_find_mirror_vma(vma);
++
++ if (vma_m) {
++ BUG_ON(vma_m->anon_vma);
++ vma_m->anon_vma = anon_vma;
++ list_add_tail(&vma_m->anon_vma_node, &anon_vma->head);
++ }
++#endif
++
+ vma->anon_vma = anon_vma;
+ list_add_tail(&vma->anon_vma_node, &anon_vma->head);
+ allocated = NULL;
+diff --git a/mm/shmem.c b/mm/shmem.c
+index 3e0005b..1d659a8 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -31,7 +31,7 @@
+ #include <linux/swap.h>
+ #include <linux/ima.h>
+
+-static struct vfsmount *shm_mnt;
++struct vfsmount *shm_mnt;
+
+ #ifdef CONFIG_SHMEM
+ /*
+@@ -1061,6 +1061,8 @@ static int shmem_writepage(struct page *page, struct writeback_control *wbc)
+ goto unlock;
+ }
+ entry = shmem_swp_entry(info, index, NULL);
++ if (!entry)
++ goto unlock;
+ if (entry->val) {
+ /*
+ * The more uptodate page coming down from a stacked
+@@ -1144,6 +1146,8 @@ static struct page *shmem_swapin(swp_entry_t entry, gfp_t gfp,
+ struct vm_area_struct pvma;
+ struct page *page;
+
++ pax_track_stack();
++
+ spol = mpol_cond_copy(&mpol,
+ mpol_shared_policy_lookup(&info->policy, idx));
+
+@@ -1962,7 +1966,7 @@ static int shmem_symlink(struct inode *dir, struct dentry *dentry, const char *s
+
+ info = SHMEM_I(inode);
+ inode->i_size = len-1;
+- if (len <= (char *)inode - (char *)info) {
++ if (len <= (char *)inode - (char *)info && len <= 64) {
+ /* do it inline */
+ memcpy(info, symname, len);
+ inode->i_op = &shmem_symlink_inline_operations;
+@@ -2310,8 +2314,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent)
+ int err = -ENOMEM;
+
+ /* Round up to L1_CACHE_BYTES to resist false sharing */
+- sbinfo = kzalloc(max((int)sizeof(struct shmem_sb_info),
+- L1_CACHE_BYTES), GFP_KERNEL);
++ sbinfo = kzalloc(max(sizeof(struct shmem_sb_info), L1_CACHE_BYTES), GFP_KERNEL);
+ if (!sbinfo)
+ return -ENOMEM;
+
+diff --git a/mm/slab.c b/mm/slab.c
+index c8d466a..909e01e 100644
+--- a/mm/slab.c
++++ b/mm/slab.c
+@@ -174,7 +174,7 @@
+
+ /* Legal flag mask for kmem_cache_create(). */
+ #if DEBUG
+-# define CREATE_MASK (SLAB_RED_ZONE | \
++# define CREATE_MASK (SLAB_USERCOPY | SLAB_RED_ZONE | \
+ SLAB_POISON | SLAB_HWCACHE_ALIGN | \
+ SLAB_CACHE_DMA | \
+ SLAB_STORE_USER | \
+@@ -182,7 +182,7 @@
+ SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
+ SLAB_DEBUG_OBJECTS | SLAB_NOLEAKTRACE | SLAB_NOTRACK)
+ #else
+-# define CREATE_MASK (SLAB_HWCACHE_ALIGN | \
++# define CREATE_MASK (SLAB_USERCOPY | SLAB_HWCACHE_ALIGN | \
+ SLAB_CACHE_DMA | \
+ SLAB_RECLAIM_ACCOUNT | SLAB_PANIC | \
+ SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
+@@ -308,7 +308,7 @@ struct kmem_list3 {
+ * Need this for bootstrapping a per node allocator.
+ */
+ #define NUM_INIT_LISTS (3 * MAX_NUMNODES)
+-struct kmem_list3 __initdata initkmem_list3[NUM_INIT_LISTS];
++struct kmem_list3 initkmem_list3[NUM_INIT_LISTS];
+ #define CACHE_CACHE 0
+ #define SIZE_AC MAX_NUMNODES
+ #define SIZE_L3 (2 * MAX_NUMNODES)
+@@ -409,10 +409,10 @@ static void kmem_list3_init(struct kmem_list3 *parent)
+ if ((x)->max_freeable < i) \
+ (x)->max_freeable = i; \
+ } while (0)
+-#define STATS_INC_ALLOCHIT(x) atomic_inc(&(x)->allochit)
+-#define STATS_INC_ALLOCMISS(x) atomic_inc(&(x)->allocmiss)
+-#define STATS_INC_FREEHIT(x) atomic_inc(&(x)->freehit)
+-#define STATS_INC_FREEMISS(x) atomic_inc(&(x)->freemiss)
++#define STATS_INC_ALLOCHIT(x) atomic_inc_unchecked(&(x)->allochit)
++#define STATS_INC_ALLOCMISS(x) atomic_inc_unchecked(&(x)->allocmiss)
++#define STATS_INC_FREEHIT(x) atomic_inc_unchecked(&(x)->freehit)
++#define STATS_INC_FREEMISS(x) atomic_inc_unchecked(&(x)->freemiss)
+ #else
+ #define STATS_INC_ACTIVE(x) do { } while (0)
+ #define STATS_DEC_ACTIVE(x) do { } while (0)
+@@ -558,7 +558,7 @@ static inline void *index_to_obj(struct kmem_cache *cache, struct slab *slab,
+ * reciprocal_divide(offset, cache->reciprocal_buffer_size)
+ */
+ static inline unsigned int obj_to_index(const struct kmem_cache *cache,
+- const struct slab *slab, void *obj)
++ const struct slab *slab, const void *obj)
+ {
+ u32 offset = (obj - slab->s_mem);
+ return reciprocal_divide(offset, cache->reciprocal_buffer_size);
+@@ -1453,7 +1453,7 @@ void __init kmem_cache_init(void)
+ sizes[INDEX_AC].cs_cachep = kmem_cache_create(names[INDEX_AC].name,
+ sizes[INDEX_AC].cs_size,
+ ARCH_KMALLOC_MINALIGN,
+- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
++ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
+ NULL);
+
+ if (INDEX_AC != INDEX_L3) {
+@@ -1461,7 +1461,7 @@ void __init kmem_cache_init(void)
+ kmem_cache_create(names[INDEX_L3].name,
+ sizes[INDEX_L3].cs_size,
+ ARCH_KMALLOC_MINALIGN,
+- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
++ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
+ NULL);
+ }
+
+@@ -1479,7 +1479,7 @@ void __init kmem_cache_init(void)
+ sizes->cs_cachep = kmem_cache_create(names->name,
+ sizes->cs_size,
+ ARCH_KMALLOC_MINALIGN,
+- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
++ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
+ NULL);
+ }
+ #ifdef CONFIG_ZONE_DMA
+@@ -4211,10 +4211,10 @@ static int s_show(struct seq_file *m, void *p)
+ }
+ /* cpu stats */
+ {
+- unsigned long allochit = atomic_read(&cachep->allochit);
+- unsigned long allocmiss = atomic_read(&cachep->allocmiss);
+- unsigned long freehit = atomic_read(&cachep->freehit);
+- unsigned long freemiss = atomic_read(&cachep->freemiss);
++ unsigned long allochit = atomic_read_unchecked(&cachep->allochit);
++ unsigned long allocmiss = atomic_read_unchecked(&cachep->allocmiss);
++ unsigned long freehit = atomic_read_unchecked(&cachep->freehit);
++ unsigned long freemiss = atomic_read_unchecked(&cachep->freemiss);
+
+ seq_printf(m, " : cpustat %6lu %6lu %6lu %6lu",
+ allochit, allocmiss, freehit, freemiss);
+@@ -4471,15 +4471,70 @@ static const struct file_operations proc_slabstats_operations = {
+
+ static int __init slab_proc_init(void)
+ {
+- proc_create("slabinfo",S_IWUSR|S_IRUGO,NULL,&proc_slabinfo_operations);
++ mode_t gr_mode = S_IRUGO;
++
++#ifdef CONFIG_GRKERNSEC_PROC_ADD
++ gr_mode = S_IRUSR;
++#endif
++
++ proc_create("slabinfo",S_IWUSR|gr_mode,NULL,&proc_slabinfo_operations);
+ #ifdef CONFIG_DEBUG_SLAB_LEAK
+- proc_create("slab_allocators", 0, NULL, &proc_slabstats_operations);
++ proc_create("slab_allocators", gr_mode, NULL, &proc_slabstats_operations);
+ #endif
+ return 0;
+ }
+ module_init(slab_proc_init);
+ #endif
+
++void check_object_size(const void *ptr, unsigned long n, bool to)
++{
++
++#ifdef CONFIG_PAX_USERCOPY
++ struct page *page;
++ struct kmem_cache *cachep = NULL;
++ struct slab *slabp;
++ unsigned int objnr;
++ unsigned long offset;
++ const char *type;
++
++ if (!n)
++ return;
++
++ type = "<null>";
++ if (ZERO_OR_NULL_PTR(ptr))
++ goto report;
++
++ if (!virt_addr_valid(ptr))
++ return;
++
++ page = virt_to_head_page(ptr);
++
++ type = "<process stack>";
++ if (!PageSlab(page)) {
++ if (object_is_on_stack(ptr, n) == -1)
++ goto report;
++ return;
++ }
++
++ cachep = page_get_cache(page);
++ type = cachep->name;
++ if (!(cachep->flags & SLAB_USERCOPY))
++ goto report;
++
++ slabp = page_get_slab(page);
++ objnr = obj_to_index(cachep, slabp, ptr);
++ BUG_ON(objnr >= cachep->num);
++ offset = ptr - index_to_obj(cachep, slabp, objnr) - obj_offset(cachep);
++ if (offset <= obj_size(cachep) && n <= obj_size(cachep) - offset)
++ return;
++
++report:
++ pax_report_usercopy(ptr, n, to, type);
++#endif
++
++}
++EXPORT_SYMBOL(check_object_size);
++
+ /**
+ * ksize - get the actual amount of memory allocated for a given object
+ * @objp: Pointer to the object
+diff --git a/mm/slob.c b/mm/slob.c
+index 837ebd6..0bd23bc 100644
+--- a/mm/slob.c
++++ b/mm/slob.c
+@@ -29,7 +29,7 @@
+ * If kmalloc is asked for objects of PAGE_SIZE or larger, it calls
+ * alloc_pages() directly, allocating compound pages so the page order
+ * does not have to be separately tracked, and also stores the exact
+- * allocation size in page->private so that it can be used to accurately
++ * allocation size in slob_page->size so that it can be used to accurately
+ * provide ksize(). These objects are detected in kfree() because slob_page()
+ * is false for them.
+ *
+@@ -58,6 +58,7 @@
+ */
+
+ #include <linux/kernel.h>
++#include <linux/sched.h>
+ #include <linux/slab.h>
+ #include <linux/mm.h>
+ #include <linux/swap.h> /* struct reclaim_state */
+@@ -100,7 +101,8 @@ struct slob_page {
+ unsigned long flags; /* mandatory */
+ atomic_t _count; /* mandatory */
+ slobidx_t units; /* free units left in page */
+- unsigned long pad[2];
++ unsigned long pad[1];
++ unsigned long size; /* size when >=PAGE_SIZE */
+ slob_t *free; /* first free slob_t in page */
+ struct list_head list; /* linked list of free pages */
+ };
+@@ -133,7 +135,7 @@ static LIST_HEAD(free_slob_large);
+ */
+ static inline int is_slob_page(struct slob_page *sp)
+ {
+- return PageSlab((struct page *)sp);
++ return PageSlab((struct page *)sp) && !sp->size;
+ }
+
+ static inline void set_slob_page(struct slob_page *sp)
+@@ -148,7 +150,7 @@ static inline void clear_slob_page(struct slob_page *sp)
+
+ static inline struct slob_page *slob_page(const void *addr)
+ {
+- return (struct slob_page *)virt_to_page(addr);
++ return (struct slob_page *)virt_to_head_page(addr);
+ }
+
+ /*
+@@ -208,7 +210,7 @@ static void set_slob(slob_t *s, slobidx_t size, slob_t *next)
+ /*
+ * Return the size of a slob block.
+ */
+-static slobidx_t slob_units(slob_t *s)
++static slobidx_t slob_units(const slob_t *s)
+ {
+ if (s->units > 0)
+ return s->units;
+@@ -218,7 +220,7 @@ static slobidx_t slob_units(slob_t *s)
+ /*
+ * Return the next free slob block pointer after this one.
+ */
+-static slob_t *slob_next(slob_t *s)
++static slob_t *slob_next(const slob_t *s)
+ {
+ slob_t *base = (slob_t *)((unsigned long)s & PAGE_MASK);
+ slobidx_t next;
+@@ -233,7 +235,7 @@ static slob_t *slob_next(slob_t *s)
+ /*
+ * Returns true if s is the last free block in its page.
+ */
+-static int slob_last(slob_t *s)
++static int slob_last(const slob_t *s)
+ {
+ return !((unsigned long)slob_next(s) & ~PAGE_MASK);
+ }
+@@ -252,6 +254,7 @@ static void *slob_new_pages(gfp_t gfp, int order, int node)
+ if (!page)
+ return NULL;
+
++ set_slob_page(page);
+ return page_address(page);
+ }
+
+@@ -368,11 +371,11 @@ static void *slob_alloc(size_t size, gfp_t gfp, int align, int node)
+ if (!b)
+ return NULL;
+ sp = slob_page(b);
+- set_slob_page(sp);
+
+ spin_lock_irqsave(&slob_lock, flags);
+ sp->units = SLOB_UNITS(PAGE_SIZE);
+ sp->free = b;
++ sp->size = 0;
+ INIT_LIST_HEAD(&sp->list);
+ set_slob(b, SLOB_UNITS(PAGE_SIZE), b + SLOB_UNITS(PAGE_SIZE));
+ set_slob_page_free(sp, slob_list);
+@@ -475,10 +478,9 @@ out:
+ #define ARCH_SLAB_MINALIGN __alignof__(unsigned long)
+ #endif
+
+-void *__kmalloc_node(size_t size, gfp_t gfp, int node)
++static void *__kmalloc_node_align(size_t size, gfp_t gfp, int node, int align)
+ {
+- unsigned int *m;
+- int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
++ slob_t *m;
+ void *ret;
+
+ lockdep_trace_alloc(gfp);
+@@ -491,7 +493,10 @@ void *__kmalloc_node(size_t size, gfp_t gfp, int node)
+
+ if (!m)
+ return NULL;
+- *m = size;
++ BUILD_BUG_ON(ARCH_KMALLOC_MINALIGN < 2 * SLOB_UNIT);
++ BUILD_BUG_ON(ARCH_SLAB_MINALIGN < 2 * SLOB_UNIT);
++ m[0].units = size;
++ m[1].units = align;
+ ret = (void *)m + align;
+
+ trace_kmalloc_node(_RET_IP_, ret,
+@@ -501,16 +506,25 @@ void *__kmalloc_node(size_t size, gfp_t gfp, int node)
+
+ ret = slob_new_pages(gfp | __GFP_COMP, get_order(size), node);
+ if (ret) {
+- struct page *page;
+- page = virt_to_page(ret);
+- page->private = size;
++ struct slob_page *sp;
++ sp = slob_page(ret);
++ sp->size = size;
+ }
+
+ trace_kmalloc_node(_RET_IP_, ret,
+ size, PAGE_SIZE << order, gfp, node);
+ }
+
+- kmemleak_alloc(ret, size, 1, gfp);
++ return ret;
++}
++
++void *__kmalloc_node(size_t size, gfp_t gfp, int node)
++{
++ int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
++ void *ret = __kmalloc_node_align(size, gfp, node, align);
++
++ if (!ZERO_OR_NULL_PTR(ret))
++ kmemleak_alloc(ret, size, 1, gfp);
+ return ret;
+ }
+ EXPORT_SYMBOL(__kmalloc_node);
+@@ -528,13 +542,92 @@ void kfree(const void *block)
+ sp = slob_page(block);
+ if (is_slob_page(sp)) {
+ int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
+- unsigned int *m = (unsigned int *)(block - align);
+- slob_free(m, *m + align);
+- } else
++ slob_t *m = (slob_t *)(block - align);
++ slob_free(m, m[0].units + align);
++ } else {
++ clear_slob_page(sp);
++ free_slob_page(sp);
++ sp->size = 0;
+ put_page(&sp->page);
++ }
+ }
+ EXPORT_SYMBOL(kfree);
+
++void check_object_size(const void *ptr, unsigned long n, bool to)
++{
++
++#ifdef CONFIG_PAX_USERCOPY
++ struct slob_page *sp;
++ const slob_t *free;
++ const void *base;
++ unsigned long flags;
++ const char *type;
++
++ if (!n)
++ return;
++
++ type = "<null>";
++ if (ZERO_OR_NULL_PTR(ptr))
++ goto report;
++
++ if (!virt_addr_valid(ptr))
++ return;
++
++ type = "<process stack>";
++ sp = slob_page(ptr);
++ if (!PageSlab((struct page *)sp)) {
++ if (object_is_on_stack(ptr, n) == -1)
++ goto report;
++ return;
++ }
++
++ type = "<slob>";
++ if (sp->size) {
++ base = page_address(&sp->page);
++ if (base <= ptr && n <= sp->size - (ptr - base))
++ return;
++ goto report;
++ }
++
++ /* some tricky double walking to find the chunk */
++ spin_lock_irqsave(&slob_lock, flags);
++ base = (void *)((unsigned long)ptr & PAGE_MASK);
++ free = sp->free;
++
++ while (!slob_last(free) && (void *)free <= ptr) {
++ base = free + slob_units(free);
++ free = slob_next(free);
++ }
++
++ while (base < (void *)free) {
++ slobidx_t m = ((slob_t *)base)[0].units, align = ((slob_t *)base)[1].units;
++ int size = SLOB_UNIT * SLOB_UNITS(m + align);
++ int offset;
++
++ if (ptr < base + align)
++ break;
++
++ offset = ptr - base - align;
++ if (offset >= m) {
++ base += size;
++ continue;
++ }
++
++ if (n > m - offset)
++ break;
++
++ spin_unlock_irqrestore(&slob_lock, flags);
++ return;
++ }
++
++ spin_unlock_irqrestore(&slob_lock, flags);
++report:
++ pax_report_usercopy(ptr, n, to, type);
++#endif
++
++}
++EXPORT_SYMBOL(check_object_size);
++
+ /* can't use ksize for kmem_cache_alloc memory, only kmalloc */
+ size_t ksize(const void *block)
+ {
+@@ -547,10 +640,10 @@ size_t ksize(const void *block)
+ sp = slob_page(block);
+ if (is_slob_page(sp)) {
+ int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
+- unsigned int *m = (unsigned int *)(block - align);
+- return SLOB_UNITS(*m) * SLOB_UNIT;
++ slob_t *m = (slob_t *)(block - align);
++ return SLOB_UNITS(m[0].units) * SLOB_UNIT;
+ } else
+- return sp->page.private;
++ return sp->size;
+ }
+ EXPORT_SYMBOL(ksize);
+
+@@ -566,8 +659,13 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
+ {
+ struct kmem_cache *c;
+
++#ifdef CONFIG_PAX_USERCOPY
++ c = __kmalloc_node_align(sizeof(struct kmem_cache),
++ GFP_KERNEL, -1, ARCH_KMALLOC_MINALIGN);
++#else
+ c = slob_alloc(sizeof(struct kmem_cache),
+ GFP_KERNEL, ARCH_KMALLOC_MINALIGN, -1);
++#endif
+
+ if (c) {
+ c->name = name;
+@@ -605,17 +703,25 @@ void *kmem_cache_alloc_node(struct kmem_cache *c, gfp_t flags, int node)
+ {
+ void *b;
+
++#ifdef CONFIG_PAX_USERCOPY
++ b = __kmalloc_node_align(c->size, flags, node, c->align);
++#else
+ if (c->size < PAGE_SIZE) {
+ b = slob_alloc(c->size, flags, c->align, node);
+ trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
+ SLOB_UNITS(c->size) * SLOB_UNIT,
+ flags, node);
+ } else {
++ struct slob_page *sp;
++
+ b = slob_new_pages(flags, get_order(c->size), node);
++ sp = slob_page(b);
++ sp->size = c->size;
+ trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
+ PAGE_SIZE << get_order(c->size),
+ flags, node);
+ }
++#endif
+
+ if (c->ctor)
+ c->ctor(b);
+@@ -627,10 +733,16 @@ EXPORT_SYMBOL(kmem_cache_alloc_node);
+
+ static void __kmem_cache_free(void *b, int size)
+ {
+- if (size < PAGE_SIZE)
++ struct slob_page *sp = slob_page(b);
++
++ if (is_slob_page(sp))
+ slob_free(b, size);
+- else
++ else {
++ clear_slob_page(sp);
++ free_slob_page(sp);
++ sp->size = 0;
+ slob_free_pages(b, get_order(size));
++ }
+ }
+
+ static void kmem_rcu_free(struct rcu_head *head)
+@@ -643,18 +755,32 @@ static void kmem_rcu_free(struct rcu_head *head)
+
+ void kmem_cache_free(struct kmem_cache *c, void *b)
+ {
++ int size = c->size;
++
++#ifdef CONFIG_PAX_USERCOPY
++ if (size + c->align < PAGE_SIZE) {
++ size += c->align;
++ b -= c->align;
++ }
++#endif
++
+ kmemleak_free_recursive(b, c->flags);
+ if (unlikely(c->flags & SLAB_DESTROY_BY_RCU)) {
+ struct slob_rcu *slob_rcu;
+- slob_rcu = b + (c->size - sizeof(struct slob_rcu));
++ slob_rcu = b + (size - sizeof(struct slob_rcu));
+ INIT_RCU_HEAD(&slob_rcu->head);
+- slob_rcu->size = c->size;
++ slob_rcu->size = size;
+ call_rcu(&slob_rcu->head, kmem_rcu_free);
+ } else {
+- __kmem_cache_free(b, c->size);
++ __kmem_cache_free(b, size);
+ }
+
++#ifdef CONFIG_PAX_USERCOPY
++ trace_kfree(_RET_IP_, b);
++#else
+ trace_kmem_cache_free(_RET_IP_, b);
++#endif
++
+ }
+ EXPORT_SYMBOL(kmem_cache_free);
+
+diff --git a/mm/slub.c b/mm/slub.c
+index 4996fc7..87e01d0 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -201,7 +201,7 @@ struct track {
+
+ enum track_item { TRACK_ALLOC, TRACK_FREE };
+
+-#ifdef CONFIG_SLUB_DEBUG
++#if defined(CONFIG_SLUB_DEBUG) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
+ static int sysfs_slab_add(struct kmem_cache *);
+ static int sysfs_slab_alias(struct kmem_cache *, const char *);
+ static void sysfs_slab_remove(struct kmem_cache *);
+@@ -410,7 +410,7 @@ static void print_track(const char *s, struct track *t)
+ if (!t->addr)
+ return;
+
+- printk(KERN_ERR "INFO: %s in %pS age=%lu cpu=%u pid=%d\n",
++ printk(KERN_ERR "INFO: %s in %pA age=%lu cpu=%u pid=%d\n",
+ s, (void *)t->addr, jiffies - t->when, t->cpu, t->pid);
+ }
+
+@@ -1893,6 +1893,8 @@ void kmem_cache_free(struct kmem_cache *s, void *x)
+
+ page = virt_to_head_page(x);
+
++ BUG_ON(!PageSlab(page));
++
+ slab_free(s, page, x, _RET_IP_);
+
+ trace_kmem_cache_free(_RET_IP_, x);
+@@ -1937,7 +1939,7 @@ static int slub_min_objects;
+ * Merge control. If this is set then no merging of slab caches will occur.
+ * (Could be removed. This was introduced to pacify the merge skeptics.)
+ */
+-static int slub_nomerge;
++static int slub_nomerge = 1;
+
+ /*
+ * Calculate the order of allocation given an slab object size.
+@@ -2493,7 +2495,7 @@ static int kmem_cache_open(struct kmem_cache *s, gfp_t gfpflags,
+ * list to avoid pounding the page allocator excessively.
+ */
+ set_min_partial(s, ilog2(s->size));
+- s->refcount = 1;
++ atomic_set(&s->refcount, 1);
+ #ifdef CONFIG_NUMA
+ s->remote_node_defrag_ratio = 1000;
+ #endif
+@@ -2630,8 +2632,7 @@ static inline int kmem_cache_close(struct kmem_cache *s)
+ void kmem_cache_destroy(struct kmem_cache *s)
+ {
+ down_write(&slub_lock);
+- s->refcount--;
+- if (!s->refcount) {
++ if (atomic_dec_and_test(&s->refcount)) {
+ list_del(&s->list);
+ up_write(&slub_lock);
+ if (kmem_cache_close(s)) {
+@@ -2691,12 +2692,10 @@ static int __init setup_slub_nomerge(char *str)
+ __setup("slub_nomerge", setup_slub_nomerge);
+
+ static struct kmem_cache *create_kmalloc_cache(struct kmem_cache *s,
+- const char *name, int size, gfp_t gfp_flags)
++ const char *name, int size, gfp_t gfp_flags, unsigned int flags)
+ {
+- unsigned int flags = 0;
+-
+ if (gfp_flags & SLUB_DMA)
+- flags = SLAB_CACHE_DMA;
++ flags |= SLAB_CACHE_DMA;
+
+ /*
+ * This function is called with IRQs disabled during early-boot on
+@@ -2915,6 +2914,50 @@ void *__kmalloc_node(size_t size, gfp_t flags, int node)
+ EXPORT_SYMBOL(__kmalloc_node);
+ #endif
+
++void check_object_size(const void *ptr, unsigned long n, bool to)
++{
++
++#ifdef CONFIG_PAX_USERCOPY
++ struct page *page;
++ struct kmem_cache *s = NULL;
++ unsigned long offset;
++ const char *type;
++
++ if (!n)
++ return;
++
++ type = "<null>";
++ if (ZERO_OR_NULL_PTR(ptr))
++ goto report;
++
++ if (!virt_addr_valid(ptr))
++ return;
++
++ page = get_object_page(ptr);
++
++ type = "<process stack>";
++ if (!page) {
++ if (object_is_on_stack(ptr, n) == -1)
++ goto report;
++ return;
++ }
++
++ s = page->slab;
++ type = s->name;
++ if (!(s->flags & SLAB_USERCOPY))
++ goto report;
++
++ offset = (ptr - page_address(page)) % s->size;
++ if (offset <= s->objsize && n <= s->objsize - offset)
++ return;
++
++report:
++ pax_report_usercopy(ptr, n, to, type);
++#endif
++
++}
++EXPORT_SYMBOL(check_object_size);
++
+ size_t ksize(const void *object)
+ {
+ struct page *page;
+@@ -3185,8 +3228,8 @@ void __init kmem_cache_init(void)
+ * kmem_cache_open for slab_state == DOWN.
+ */
+ create_kmalloc_cache(&kmalloc_caches[0], "kmem_cache_node",
+- sizeof(struct kmem_cache_node), GFP_NOWAIT);
+- kmalloc_caches[0].refcount = -1;
++ sizeof(struct kmem_cache_node), GFP_NOWAIT, 0);
++ atomic_set(&kmalloc_caches[0].refcount, -1);
+ caches++;
+
+ hotplug_memory_notifier(slab_memory_callback, SLAB_CALLBACK_PRI);
+@@ -3198,18 +3241,18 @@ void __init kmem_cache_init(void)
+ /* Caches that are not of the two-to-the-power-of size */
+ if (KMALLOC_MIN_SIZE <= 32) {
+ create_kmalloc_cache(&kmalloc_caches[1],
+- "kmalloc-96", 96, GFP_NOWAIT);
++ "kmalloc-96", 96, GFP_NOWAIT, SLAB_USERCOPY);
+ caches++;
+ }
+ if (KMALLOC_MIN_SIZE <= 64) {
+ create_kmalloc_cache(&kmalloc_caches[2],
+- "kmalloc-192", 192, GFP_NOWAIT);
++ "kmalloc-192", 192, GFP_NOWAIT, SLAB_USERCOPY);
+ caches++;
+ }
+
+ for (i = KMALLOC_SHIFT_LOW; i < SLUB_PAGE_SHIFT; i++) {
+ create_kmalloc_cache(&kmalloc_caches[i],
+- "kmalloc", 1 << i, GFP_NOWAIT);
++ "kmalloc", 1 << i, GFP_NOWAIT, SLAB_USERCOPY);
+ caches++;
+ }
+
+@@ -3293,7 +3336,7 @@ static int slab_unmergeable(struct kmem_cache *s)
+ /*
+ * We may have set a slab to be unmergeable during bootstrap.
+ */
+- if (s->refcount < 0)
++ if (atomic_read(&s->refcount) < 0)
+ return 1;
+
+ return 0;
+@@ -3353,7 +3396,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
+ if (s) {
+ int cpu;
+
+- s->refcount++;
++ atomic_inc(&s->refcount);
+ /*
+ * Adjust the object sizes so that we clear
+ * the complete object on kzalloc.
+@@ -3372,7 +3415,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
+
+ if (sysfs_slab_alias(s, name)) {
+ down_write(&slub_lock);
+- s->refcount--;
++ atomic_dec(&s->refcount);
+ up_write(&slub_lock);
+ goto err;
+ }
+@@ -4101,7 +4144,7 @@ SLAB_ATTR_RO(ctor);
+
+ static ssize_t aliases_show(struct kmem_cache *s, char *buf)
+ {
+- return sprintf(buf, "%d\n", s->refcount - 1);
++ return sprintf(buf, "%d\n", atomic_read(&s->refcount) - 1);
+ }
+ SLAB_ATTR_RO(aliases);
+
+@@ -4503,7 +4546,7 @@ static void kmem_cache_release(struct kobject *kobj)
+ kfree(s);
+ }
+
+-static struct sysfs_ops slab_sysfs_ops = {
++static const struct sysfs_ops slab_sysfs_ops = {
+ .show = slab_attr_show,
+ .store = slab_attr_store,
+ };
+@@ -4522,7 +4565,7 @@ static int uevent_filter(struct kset *kset, struct kobject *kobj)
+ return 0;
+ }
+
+-static struct kset_uevent_ops slab_uevent_ops = {
++static const struct kset_uevent_ops slab_uevent_ops = {
+ .filter = uevent_filter,
+ };
+
+@@ -4564,6 +4607,7 @@ static char *create_unique_id(struct kmem_cache *s)
+ return name;
+ }
+
++#if defined(CONFIG_SLUB_DEBUG) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
+ static int sysfs_slab_add(struct kmem_cache *s)
+ {
+ int err;
+@@ -4619,6 +4663,7 @@ static void sysfs_slab_remove(struct kmem_cache *s)
+ kobject_del(&s->kobj);
+ kobject_put(&s->kobj);
+ }
++#endif
+
+ /*
+ * Need to buffer aliases during bootup until sysfs becomes
+@@ -4632,6 +4677,7 @@ struct saved_alias {
+
+ static struct saved_alias *alias_list;
+
++#if defined(CONFIG_SLUB_DEBUG) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
+ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
+ {
+ struct saved_alias *al;
+@@ -4654,6 +4700,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
+ alias_list = al;
+ return 0;
+ }
++#endif
+
+ static int __init slab_sysfs_init(void)
+ {
+@@ -4785,7 +4832,13 @@ static const struct file_operations proc_slabinfo_operations = {
+
+ static int __init slab_proc_init(void)
+ {
+- proc_create("slabinfo", S_IRUGO, NULL, &proc_slabinfo_operations);
++ mode_t gr_mode = S_IRUGO;
++
++#ifdef CONFIG_GRKERNSEC_PROC_ADD
++ gr_mode = S_IRUSR;
++#endif
++
++ proc_create("slabinfo", gr_mode, NULL, &proc_slabinfo_operations);
+ return 0;
+ }
+ module_init(slab_proc_init);
+diff --git a/mm/sparse-vmemmap.c b/mm/sparse-vmemmap.c
+index d9714bd..ce08e28 100644
+--- a/mm/sparse-vmemmap.c
++++ b/mm/sparse-vmemmap.c
+@@ -108,7 +108,7 @@ pud_t * __meminit vmemmap_pud_populate(pgd_t *pgd, unsigned long addr, int node)
+ void *p = vmemmap_alloc_block(PAGE_SIZE, node);
+ if (!p)
+ return NULL;
+- pud_populate(&init_mm, pud, p);
++ pud_populate_kernel(&init_mm, pud, p);
+ }
+ return pud;
+ }
+@@ -120,7 +120,7 @@ pgd_t * __meminit vmemmap_pgd_populate(unsigned long addr, int node)
+ void *p = vmemmap_alloc_block(PAGE_SIZE, node);
+ if (!p)
+ return NULL;
+- pgd_populate(&init_mm, pgd, p);
++ pgd_populate_kernel(&init_mm, pgd, p);
+ }
+ return pgd;
+ }
+diff --git a/mm/swap.c b/mm/swap.c
+index 308e57d..5de19c0 100644
+--- a/mm/swap.c
++++ b/mm/swap.c
+@@ -30,6 +30,7 @@
+ #include <linux/notifier.h>
+ #include <linux/backing-dev.h>
+ #include <linux/memcontrol.h>
++#include <linux/hugetlb.h>
+
+ #include "internal.h"
+
+@@ -65,6 +66,8 @@ static void put_compound_page(struct page *page)
+ compound_page_dtor *dtor;
+
+ dtor = get_compound_page_dtor(page);
++ if (!PageHuge(page))
++ BUG_ON(dtor != free_compound_page);
+ (*dtor)(page);
+ }
+ }
+diff --git a/mm/util.c b/mm/util.c
+index e48b493..24a601d 100644
+--- a/mm/util.c
++++ b/mm/util.c
+@@ -228,6 +228,12 @@ EXPORT_SYMBOL(strndup_user);
+ void arch_pick_mmap_layout(struct mm_struct *mm)
+ {
+ mm->mmap_base = TASK_UNMAPPED_BASE;
++
++#ifdef CONFIG_PAX_RANDMMAP
++ if (mm->pax_flags & MF_PAX_RANDMMAP)
++ mm->mmap_base += mm->delta_mmap;
++#endif
++
+ mm->get_unmapped_area = arch_get_unmapped_area;
+ mm->unmap_area = arch_unmap_area;
+ }
+diff --git a/mm/vmalloc.c b/mm/vmalloc.c
+index f34ffd0..1a7ff39 100644
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -40,8 +40,19 @@ static void vunmap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end)
+
+ pte = pte_offset_kernel(pmd, addr);
+ do {
+- pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
+- WARN_ON(!pte_none(ptent) && !pte_present(ptent));
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++ if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr < (unsigned long)MODULES_EXEC_END) {
++ BUG_ON(!pte_exec(*pte));
++ set_pte_at(&init_mm, addr, pte, pfn_pte(__pa(addr) >> PAGE_SHIFT, PAGE_KERNEL_EXEC));
++ continue;
++ }
++#endif
++
++ {
++ pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
++ WARN_ON(!pte_none(ptent) && !pte_present(ptent));
++ }
+ } while (pte++, addr += PAGE_SIZE, addr != end);
+ }
+
+@@ -92,6 +103,7 @@ static int vmap_pte_range(pmd_t *pmd, unsigned long addr,
+ unsigned long end, pgprot_t prot, struct page **pages, int *nr)
+ {
+ pte_t *pte;
++ int ret = -ENOMEM;
+
+ /*
+ * nr is a running index into the array which helps higher level
+@@ -101,17 +113,32 @@ static int vmap_pte_range(pmd_t *pmd, unsigned long addr,
+ pte = pte_alloc_kernel(pmd, addr);
+ if (!pte)
+ return -ENOMEM;
++
++ pax_open_kernel();
+ do {
+ struct page *page = pages[*nr];
+
+- if (WARN_ON(!pte_none(*pte)))
+- return -EBUSY;
+- if (WARN_ON(!page))
+- return -ENOMEM;
++#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++ if (!(pgprot_val(prot) & _PAGE_NX))
++ BUG_ON(!pte_exec(*pte) || pte_pfn(*pte) != __pa(addr) >> PAGE_SHIFT);
++ else
++#endif
++
++ if (WARN_ON(!pte_none(*pte))) {
++ ret = -EBUSY;
++ goto out;
++ }
++ if (WARN_ON(!page)) {
++ ret = -ENOMEM;
++ goto out;
++ }
+ set_pte_at(&init_mm, addr, pte, mk_pte(page, prot));
+ (*nr)++;
+ } while (pte++, addr += PAGE_SIZE, addr != end);
+- return 0;
++ ret = 0;
++out:
++ pax_close_kernel();
++ return ret;
+ }
+
+ static int vmap_pmd_range(pud_t *pud, unsigned long addr,
+@@ -120,7 +147,7 @@ static int vmap_pmd_range(pud_t *pud, unsigned long addr,
+ pmd_t *pmd;
+ unsigned long next;
+
+- pmd = pmd_alloc(&init_mm, pud, addr);
++ pmd = pmd_alloc_kernel(&init_mm, pud, addr);
+ if (!pmd)
+ return -ENOMEM;
+ do {
+@@ -137,7 +164,7 @@ static int vmap_pud_range(pgd_t *pgd, unsigned long addr,
+ pud_t *pud;
+ unsigned long next;
+
+- pud = pud_alloc(&init_mm, pgd, addr);
++ pud = pud_alloc_kernel(&init_mm, pgd, addr);
+ if (!pud)
+ return -ENOMEM;
+ do {
+@@ -192,11 +219,20 @@ int is_vmalloc_or_module_addr(const void *x)
+ * and fall back on vmalloc() if that fails. Others
+ * just put it in the vmalloc space.
+ */
+-#if defined(CONFIG_MODULES) && defined(MODULES_VADDR)
++#ifdef CONFIG_MODULES
++#ifdef MODULES_VADDR
+ unsigned long addr = (unsigned long)x;
+ if (addr >= MODULES_VADDR && addr < MODULES_END)
+ return 1;
+ #endif
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++ if (x >= (const void *)MODULES_EXEC_VADDR && x < (const void *)MODULES_EXEC_END)
++ return 1;
++#endif
++
++#endif
++
+ return is_vmalloc_addr(x);
+ }
+
+@@ -217,8 +253,14 @@ struct page *vmalloc_to_page(const void *vmalloc_addr)
+
+ if (!pgd_none(*pgd)) {
+ pud_t *pud = pud_offset(pgd, addr);
++#ifdef CONFIG_X86
++ if (!pud_large(*pud))
++#endif
+ if (!pud_none(*pud)) {
+ pmd_t *pmd = pmd_offset(pud, addr);
++#ifdef CONFIG_X86
++ if (!pmd_large(*pmd))
++#endif
+ if (!pmd_none(*pmd)) {
+ pte_t *ptep, pte;
+
+@@ -292,13 +334,13 @@ static void __insert_vmap_area(struct vmap_area *va)
+ struct rb_node *tmp;
+
+ while (*p) {
+- struct vmap_area *tmp;
++ struct vmap_area *varea;
+
+ parent = *p;
+- tmp = rb_entry(parent, struct vmap_area, rb_node);
+- if (va->va_start < tmp->va_end)
++ varea = rb_entry(parent, struct vmap_area, rb_node);
++ if (va->va_start < varea->va_end)
+ p = &(*p)->rb_left;
+- else if (va->va_end > tmp->va_start)
++ else if (va->va_end > varea->va_start)
+ p = &(*p)->rb_right;
+ else
+ BUG();
+@@ -326,6 +368,10 @@ static void purge_vmap_area_lazy(void);
+ static struct vmap_area *alloc_vmap_area(unsigned long size,
+ unsigned long align,
+ unsigned long vstart, unsigned long vend,
++ int node, gfp_t gfp_mask) __size_overflow(1);
++static struct vmap_area *alloc_vmap_area(unsigned long size,
++ unsigned long align,
++ unsigned long vstart, unsigned long vend,
+ int node, gfp_t gfp_mask)
+ {
+ struct vmap_area *va;
+@@ -1245,6 +1291,16 @@ static struct vm_struct *__get_vm_area_node(unsigned long size,
+ struct vm_struct *area;
+
+ BUG_ON(in_interrupt());
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
++ if (flags & VM_KERNEXEC) {
++ if (start != VMALLOC_START || end != VMALLOC_END)
++ return NULL;
++ start = (unsigned long)MODULES_EXEC_VADDR;
++ end = (unsigned long)MODULES_EXEC_END;
++ }
++#endif
++
+ if (flags & VM_IOREMAP) {
+ int bit = fls(size);
+
+@@ -1484,6 +1540,11 @@ void *vmap(struct page **pages, unsigned int count,
+ if (count > totalram_pages)
+ return NULL;
+
++#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
++ if (!(pgprot_val(prot) & _PAGE_NX))
++ flags |= VM_KERNEXEC;
++#endif
++
+ area = get_vm_area_caller((count << PAGE_SHIFT), flags,
+ __builtin_return_address(0));
+ if (!area)
+@@ -1584,6 +1645,9 @@ void *__vmalloc_area(struct vm_struct *area, gfp_t gfp_mask, pgprot_t prot)
+ */
+ static void *__vmalloc_node(unsigned long size, unsigned long align,
+ gfp_t gfp_mask, pgprot_t prot,
++ int node, void *caller) __size_overflow(1);
++static void *__vmalloc_node(unsigned long size, unsigned long align,
++ gfp_t gfp_mask, pgprot_t prot,
+ int node, void *caller)
+ {
+ struct vm_struct *area;
+@@ -1594,6 +1658,14 @@ static void *__vmalloc_node(unsigned long size, unsigned long align,
+ if (!size || (size >> PAGE_SHIFT) > totalram_pages)
+ return NULL;
+
++#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
++ if (!(pgprot_val(prot) & _PAGE_NX))
++ area = __get_vm_area_node(size, align, VM_ALLOC | VM_UNLIST | VM_KERNEXEC,
++ VMALLOC_START, VMALLOC_END, node,
++ gfp_mask, caller);
++ else
++#endif
++
+ area = __get_vm_area_node(size, align, VM_ALLOC | VM_UNLIST,
+ VMALLOC_START, VMALLOC_END, node,
+ gfp_mask, caller);
+@@ -1698,10 +1770,9 @@ EXPORT_SYMBOL(vmalloc_node);
+ * For tight control over page level allocator and protection flags
+ * use __vmalloc() instead.
+ */
+-
+ void *vmalloc_exec(unsigned long size)
+ {
+- return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
++ return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, PAGE_KERNEL_EXEC,
+ -1, __builtin_return_address(0));
+ }
+
+@@ -1998,6 +2069,8 @@ int remap_vmalloc_range(struct vm_area_struct *vma, void *addr,
+ unsigned long uaddr = vma->vm_start;
+ unsigned long usize = vma->vm_end - vma->vm_start;
+
++ BUG_ON(vma->vm_mirror);
++
+ if ((PAGE_SIZE-1) & (unsigned long)addr)
+ return -EINVAL;
+
+diff --git a/mm/vmstat.c b/mm/vmstat.c
+index 42d76c6..5643dc4 100644
+--- a/mm/vmstat.c
++++ b/mm/vmstat.c
+@@ -74,7 +74,7 @@ void vm_events_fold_cpu(int cpu)
+ *
+ * vm_stat contains the global counters
+ */
+-atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
++atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
+ EXPORT_SYMBOL(vm_stat);
+
+ #ifdef CONFIG_SMP
+@@ -324,7 +324,7 @@ void refresh_cpu_vm_stats(int cpu)
+ v = p->vm_stat_diff[i];
+ p->vm_stat_diff[i] = 0;
+ local_irq_restore(flags);
+- atomic_long_add(v, &zone->vm_stat[i]);
++ atomic_long_add_unchecked(v, &zone->vm_stat[i]);
+ global_diff[i] += v;
+ #ifdef CONFIG_NUMA
+ /* 3 seconds idle till flush */
+@@ -362,7 +362,7 @@ void refresh_cpu_vm_stats(int cpu)
+
+ for (i = 0; i < NR_VM_ZONE_STAT_ITEMS; i++)
+ if (global_diff[i])
+- atomic_long_add(global_diff[i], &vm_stat[i]);
++ atomic_long_add_unchecked(global_diff[i], &vm_stat[i]);
+ }
+
+ #endif
+@@ -953,10 +953,20 @@ static int __init setup_vmstat(void)
+ start_cpu_timer(cpu);
+ #endif
+ #ifdef CONFIG_PROC_FS
+- proc_create("buddyinfo", S_IRUGO, NULL, &fragmentation_file_operations);
+- proc_create("pagetypeinfo", S_IRUGO, NULL, &pagetypeinfo_file_ops);
+- proc_create("vmstat", S_IRUGO, NULL, &proc_vmstat_file_operations);
+- proc_create("zoneinfo", S_IRUGO, NULL, &proc_zoneinfo_file_operations);
++ {
++ mode_t gr_mode = S_IRUGO;
++#ifdef CONFIG_GRKERNSEC_PROC_ADD
++ gr_mode = S_IRUSR;
++#endif
++ proc_create("buddyinfo", gr_mode, NULL, &fragmentation_file_operations);
++ proc_create("pagetypeinfo", gr_mode, NULL, &pagetypeinfo_file_ops);
++#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
++ proc_create("vmstat", gr_mode | S_IRGRP, NULL, &proc_vmstat_file_operations);
++#else
++ proc_create("vmstat", gr_mode, NULL, &proc_vmstat_file_operations);
++#endif
++ proc_create("zoneinfo", gr_mode, NULL, &proc_zoneinfo_file_operations);
++ }
+ #endif
+ return 0;
+ }
+diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
+index a29c5ab..6143f20 100644
+--- a/net/8021q/vlan.c
++++ b/net/8021q/vlan.c
+@@ -622,8 +622,7 @@ static int vlan_ioctl_handler(struct net *net, void __user *arg)
+ err = -EPERM;
+ if (!capable(CAP_NET_ADMIN))
+ break;
+- if ((args.u.name_type >= 0) &&
+- (args.u.name_type < VLAN_NAME_TYPE_HIGHEST)) {
++ if (args.u.name_type < VLAN_NAME_TYPE_HIGHEST) {
+ struct vlan_net *vn;
+
+ vn = net_generic(net, vlan_net_id);
+diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
+index a2d2984..f9eb711 100644
+--- a/net/9p/trans_fd.c
++++ b/net/9p/trans_fd.c
+@@ -419,7 +419,7 @@ static int p9_fd_write(struct p9_client *client, void *v, int len)
+ oldfs = get_fs();
+ set_fs(get_ds());
+ /* The cast to a user pointer is valid due to the set_fs() */
+- ret = vfs_write(ts->wr, (__force void __user *)v, len, &ts->wr->f_pos);
++ ret = vfs_write(ts->wr, (void __force_user *)v, len, &ts->wr->f_pos);
+ set_fs(oldfs);
+
+ if (ret <= 0 && ret != -ERESTARTSYS && ret != -EAGAIN)
+diff --git a/net/atm/atm_misc.c b/net/atm/atm_misc.c
+index 02cc7e7..4514f1b 100644
+--- a/net/atm/atm_misc.c
++++ b/net/atm/atm_misc.c
+@@ -19,7 +19,7 @@ int atm_charge(struct atm_vcc *vcc,int truesize)
+ if (atomic_read(&sk_atm(vcc)->sk_rmem_alloc) <= sk_atm(vcc)->sk_rcvbuf)
+ return 1;
+ atm_return(vcc,truesize);
+- atomic_inc(&vcc->stats->rx_drop);
++ atomic_inc_unchecked(&vcc->stats->rx_drop);
+ return 0;
+ }
+
+@@ -41,7 +41,7 @@ struct sk_buff *atm_alloc_charge(struct atm_vcc *vcc,int pdu_size,
+ }
+ }
+ atm_return(vcc,guess);
+- atomic_inc(&vcc->stats->rx_drop);
++ atomic_inc_unchecked(&vcc->stats->rx_drop);
+ return NULL;
+ }
+
+@@ -88,7 +88,7 @@ int atm_pcr_goal(const struct atm_trafprm *tp)
+
+ void sonet_copy_stats(struct k_sonet_stats *from,struct sonet_stats *to)
+ {
+-#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
++#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
+ __SONET_ITEMS
+ #undef __HANDLE_ITEM
+ }
+@@ -96,7 +96,7 @@ void sonet_copy_stats(struct k_sonet_stats *from,struct sonet_stats *to)
+
+ void sonet_subtract_stats(struct k_sonet_stats *from,struct sonet_stats *to)
+ {
+-#define __HANDLE_ITEM(i) atomic_sub(to->i,&from->i)
++#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i,&from->i)
+ __SONET_ITEMS
+ #undef __HANDLE_ITEM
+ }
+diff --git a/net/atm/lec.h b/net/atm/lec.h
+index 9d14d19..5c145f3 100644
+--- a/net/atm/lec.h
++++ b/net/atm/lec.h
+@@ -48,7 +48,7 @@ struct lane2_ops {
+ const u8 *tlvs, u32 sizeoftlvs);
+ void (*associate_indicator) (struct net_device *dev, const u8 *mac_addr,
+ const u8 *tlvs, u32 sizeoftlvs);
+-};
++} __no_const;
+
+ /*
+ * ATM LAN Emulation supports both LLC & Dix Ethernet EtherType
+diff --git a/net/atm/mpc.h b/net/atm/mpc.h
+index 0919a88..a23d54e 100644
+--- a/net/atm/mpc.h
++++ b/net/atm/mpc.h
+@@ -33,7 +33,7 @@ struct mpoa_client {
+ struct mpc_parameters parameters; /* parameters for this client */
+
+ const struct net_device_ops *old_ops;
+- struct net_device_ops new_ops;
++ net_device_ops_no_const new_ops;
+ };
+
+
+diff --git a/net/atm/mpoa_caches.c b/net/atm/mpoa_caches.c
+index 4504a4b..1733f1e 100644
+--- a/net/atm/mpoa_caches.c
++++ b/net/atm/mpoa_caches.c
+@@ -498,6 +498,8 @@ static void clear_expired(struct mpoa_client *client)
+ struct timeval now;
+ struct k_message msg;
+
++ pax_track_stack();
++
+ do_gettimeofday(&now);
+
+ write_lock_irq(&client->egress_lock);
+diff --git a/net/atm/proc.c b/net/atm/proc.c
+index ab8419a..aa91497 100644
+--- a/net/atm/proc.c
++++ b/net/atm/proc.c
+@@ -43,9 +43,9 @@ static void add_stats(struct seq_file *seq, const char *aal,
+ const struct k_atm_aal_stats *stats)
+ {
+ seq_printf(seq, "%s ( %d %d %d %d %d )", aal,
+- atomic_read(&stats->tx),atomic_read(&stats->tx_err),
+- atomic_read(&stats->rx),atomic_read(&stats->rx_err),
+- atomic_read(&stats->rx_drop));
++ atomic_read_unchecked(&stats->tx),atomic_read_unchecked(&stats->tx_err),
++ atomic_read_unchecked(&stats->rx),atomic_read_unchecked(&stats->rx_err),
++ atomic_read_unchecked(&stats->rx_drop));
+ }
+
+ static void atm_dev_info(struct seq_file *seq, const struct atm_dev *dev)
+@@ -188,7 +188,12 @@ static void vcc_info(struct seq_file *seq, struct atm_vcc *vcc)
+ {
+ struct sock *sk = sk_atm(vcc);
+
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ seq_printf(seq, "%p ", NULL);
++#else
+ seq_printf(seq, "%p ", vcc);
++#endif
++
+ if (!vcc->dev)
+ seq_printf(seq, "Unassigned ");
+ else
+@@ -214,7 +219,11 @@ static void svc_info(struct seq_file *seq, struct atm_vcc *vcc)
+ {
+ if (!vcc->dev)
+ seq_printf(seq, sizeof(void *) == 4 ?
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ "N/A@%p%10s" : "N/A@%p%2s", NULL, "");
++#else
+ "N/A@%p%10s" : "N/A@%p%2s", vcc, "");
++#endif
+ else
+ seq_printf(seq, "%3d %3d %5d ",
+ vcc->dev->number, vcc->vpi, vcc->vci);
+diff --git a/net/atm/resources.c b/net/atm/resources.c
+index 56b7322..c48b84e 100644
+--- a/net/atm/resources.c
++++ b/net/atm/resources.c
+@@ -161,7 +161,7 @@ void atm_dev_deregister(struct atm_dev *dev)
+ static void copy_aal_stats(struct k_atm_aal_stats *from,
+ struct atm_aal_stats *to)
+ {
+-#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
++#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
+ __AAL_STAT_ITEMS
+ #undef __HANDLE_ITEM
+ }
+@@ -170,7 +170,7 @@ static void copy_aal_stats(struct k_atm_aal_stats *from,
+ static void subtract_aal_stats(struct k_atm_aal_stats *from,
+ struct atm_aal_stats *to)
+ {
+-#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
++#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i, &from->i)
+ __AAL_STAT_ITEMS
+ #undef __HANDLE_ITEM
+ }
+diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
+index 8567d47..bba2292 100644
+--- a/net/bridge/br_private.h
++++ b/net/bridge/br_private.h
+@@ -255,7 +255,7 @@ extern void br_ifinfo_notify(int event, struct net_bridge_port *port);
+
+ #ifdef CONFIG_SYSFS
+ /* br_sysfs_if.c */
+-extern struct sysfs_ops brport_sysfs_ops;
++extern const struct sysfs_ops brport_sysfs_ops;
+ extern int br_sysfs_addif(struct net_bridge_port *p);
+
+ /* br_sysfs_br.c */
+diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
+index 9a52ac5..c97538e 100644
+--- a/net/bridge/br_stp_if.c
++++ b/net/bridge/br_stp_if.c
+@@ -146,7 +146,7 @@ static void br_stp_stop(struct net_bridge *br)
+ char *envp[] = { NULL };
+
+ if (br->stp_enabled == BR_USER_STP) {
+- r = call_usermodehelper(BR_STP_PROG, argv, envp, 1);
++ r = call_usermodehelper(BR_STP_PROG, argv, envp, UMH_WAIT_PROC);
+ printk(KERN_INFO "%s: userspace STP stopped, return code %d\n",
+ br->dev->name, r);
+
+diff --git a/net/bridge/br_sysfs_if.c b/net/bridge/br_sysfs_if.c
+index 820643a..ce77fb3 100644
+--- a/net/bridge/br_sysfs_if.c
++++ b/net/bridge/br_sysfs_if.c
+@@ -220,7 +220,7 @@ static ssize_t brport_store(struct kobject * kobj,
+ return ret;
+ }
+
+-struct sysfs_ops brport_sysfs_ops = {
++const struct sysfs_ops brport_sysfs_ops = {
+ .show = brport_show,
+ .store = brport_store,
+ };
+diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
+index d73d47f..72df42a 100644
+--- a/net/bridge/netfilter/ebtables.c
++++ b/net/bridge/netfilter/ebtables.c
+@@ -1337,6 +1337,8 @@ static int copy_everything_to_user(struct ebt_table *t, void __user *user,
+ unsigned int entries_size, nentries;
+ char *entries;
+
++ pax_track_stack();
++
+ if (cmd == EBT_SO_GET_ENTRIES) {
+ entries_size = t->private->entries_size;
+ nentries = t->private->nentries;
+diff --git a/net/can/bcm.c b/net/can/bcm.c
+index 2ffd2e0..72a7486 100644
+--- a/net/can/bcm.c
++++ b/net/can/bcm.c
+@@ -164,9 +164,15 @@ static int bcm_proc_show(struct seq_file *m, void *v)
+ struct bcm_sock *bo = bcm_sk(sk);
+ struct bcm_op *op;
+
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ seq_printf(m, ">>> socket %p", NULL);
++ seq_printf(m, " / sk %p", NULL);
++ seq_printf(m, " / bo %p", NULL);
++#else
+ seq_printf(m, ">>> socket %p", sk->sk_socket);
+ seq_printf(m, " / sk %p", sk);
+ seq_printf(m, " / bo %p", bo);
++#endif
+ seq_printf(m, " / dropped %lu", bo->dropped_usr_msgs);
+ seq_printf(m, " / bound %s", bcm_proc_getifname(ifname, bo->ifindex));
+ seq_printf(m, " <<<\n");
+diff --git a/net/compat.c b/net/compat.c
+index 9559afc..ccd74e1 100644
+--- a/net/compat.c
++++ b/net/compat.c
+@@ -69,9 +69,9 @@ int get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr __user *umsg)
+ __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
+ __get_user(kmsg->msg_flags, &umsg->msg_flags))
+ return -EFAULT;
+- kmsg->msg_name = compat_ptr(tmp1);
+- kmsg->msg_iov = compat_ptr(tmp2);
+- kmsg->msg_control = compat_ptr(tmp3);
++ kmsg->msg_name = (void __force_kernel *)compat_ptr(tmp1);
++ kmsg->msg_iov = (void __force_kernel *)compat_ptr(tmp2);
++ kmsg->msg_control = (void __force_kernel *)compat_ptr(tmp3);
+ return 0;
+ }
+
+@@ -94,7 +94,7 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
+ kern_msg->msg_name = NULL;
+
+ tot_len = iov_from_user_compat_to_kern(kern_iov,
+- (struct compat_iovec __user *)kern_msg->msg_iov,
++ (struct compat_iovec __force_user *)kern_msg->msg_iov,
+ kern_msg->msg_iovlen);
+ if (tot_len >= 0)
+ kern_msg->msg_iov = kern_iov;
+@@ -114,20 +114,20 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
+
+ #define CMSG_COMPAT_FIRSTHDR(msg) \
+ (((msg)->msg_controllen) >= sizeof(struct compat_cmsghdr) ? \
+- (struct compat_cmsghdr __user *)((msg)->msg_control) : \
++ (struct compat_cmsghdr __force_user *)((msg)->msg_control) : \
+ (struct compat_cmsghdr __user *)NULL)
+
+ #define CMSG_COMPAT_OK(ucmlen, ucmsg, mhdr) \
+ ((ucmlen) >= sizeof(struct compat_cmsghdr) && \
+ (ucmlen) <= (unsigned long) \
+ ((mhdr)->msg_controllen - \
+- ((char *)(ucmsg) - (char *)(mhdr)->msg_control)))
++ ((char __force_kernel *)(ucmsg) - (char *)(mhdr)->msg_control)))
+
+ static inline struct compat_cmsghdr __user *cmsg_compat_nxthdr(struct msghdr *msg,
+ struct compat_cmsghdr __user *cmsg, int cmsg_len)
+ {
+ char __user *ptr = (char __user *)cmsg + CMSG_COMPAT_ALIGN(cmsg_len);
+- if ((unsigned long)(ptr + 1 - (char __user *)msg->msg_control) >
++ if ((unsigned long)(ptr + 1 - (char __force_user *)msg->msg_control) >
+ msg->msg_controllen)
+ return NULL;
+ return (struct compat_cmsghdr __user *)ptr;
+@@ -219,7 +219,7 @@ int put_cmsg_compat(struct msghdr *kmsg, int level, int type, int len, void *dat
+ {
+ struct compat_timeval ctv;
+ struct compat_timespec cts[3];
+- struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __user *) kmsg->msg_control;
++ struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __force_user *) kmsg->msg_control;
+ struct compat_cmsghdr cmhdr;
+ int cmlen;
+
+@@ -271,7 +271,7 @@ int put_cmsg_compat(struct msghdr *kmsg, int level, int type, int len, void *dat
+
+ void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm)
+ {
+- struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __user *) kmsg->msg_control;
++ struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __force_user *) kmsg->msg_control;
+ int fdmax = (kmsg->msg_controllen - sizeof(struct compat_cmsghdr)) / sizeof(int);
+ int fdnum = scm->fp->count;
+ struct file **fp = scm->fp->fp;
+@@ -433,7 +433,7 @@ static int do_get_sock_timeout(struct socket *sock, int level, int optname,
+ len = sizeof(ktime);
+ old_fs = get_fs();
+ set_fs(KERNEL_DS);
+- err = sock_getsockopt(sock, level, optname, (char *) &ktime, &len);
++ err = sock_getsockopt(sock, level, optname, (char __force_user *) &ktime, (int __force_user *)&len);
+ set_fs(old_fs);
+
+ if (!err) {
+@@ -570,7 +570,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
+ case MCAST_JOIN_GROUP:
+ case MCAST_LEAVE_GROUP:
+ {
+- struct compat_group_req __user *gr32 = (void *)optval;
++ struct compat_group_req __user *gr32 = (void __user *)optval;
+ struct group_req __user *kgr =
+ compat_alloc_user_space(sizeof(struct group_req));
+ u32 interface;
+@@ -591,7 +591,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
+ case MCAST_BLOCK_SOURCE:
+ case MCAST_UNBLOCK_SOURCE:
+ {
+- struct compat_group_source_req __user *gsr32 = (void *)optval;
++ struct compat_group_source_req __user *gsr32 = (void __user *)optval;
+ struct group_source_req __user *kgsr = compat_alloc_user_space(
+ sizeof(struct group_source_req));
+ u32 interface;
+@@ -612,7 +612,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
+ }
+ case MCAST_MSFILTER:
+ {
+- struct compat_group_filter __user *gf32 = (void *)optval;
++ struct compat_group_filter __user *gf32 = (void __user *)optval;
+ struct group_filter __user *kgf;
+ u32 interface, fmode, numsrc;
+
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 84a0705..575db4c 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -1047,10 +1047,14 @@ void dev_load(struct net *net, const char *name)
+ if (no_module && capable(CAP_NET_ADMIN))
+ no_module = request_module("netdev-%s", name);
+ if (no_module && capable(CAP_SYS_MODULE)) {
++#ifdef CONFIG_GRKERNSEC_MODHARDEN
++ ___request_module(true, "grsec_modharden_netdev", "%s", name);
++#else
+ if (!request_module("%s", name))
+ pr_err("Loading kernel module for a network device "
+ "with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%s "
+ "instead\n", name);
++#endif
+ }
+ }
+ EXPORT_SYMBOL(dev_load);
+@@ -1654,7 +1658,7 @@ static inline int illegal_highdma(struct net_device *dev, struct sk_buff *skb)
+
+ struct dev_gso_cb {
+ void (*destructor)(struct sk_buff *skb);
+-};
++} __no_const;
+
+ #define DEV_GSO_CB(skb) ((struct dev_gso_cb *)(skb)->cb)
+
+@@ -2063,7 +2067,7 @@ int netif_rx_ni(struct sk_buff *skb)
+ }
+ EXPORT_SYMBOL(netif_rx_ni);
+
+-static void net_tx_action(struct softirq_action *h)
++static void net_tx_action(void)
+ {
+ struct softnet_data *sd = &__get_cpu_var(softnet_data);
+
+@@ -2827,7 +2831,7 @@ void netif_napi_del(struct napi_struct *napi)
+ EXPORT_SYMBOL(netif_napi_del);
+
+
+-static void net_rx_action(struct softirq_action *h)
++static void net_rx_action(void)
+ {
+ struct list_head *list = &__get_cpu_var(softnet_data).poll_list;
+ unsigned long time_limit = jiffies + 2;
+diff --git a/net/core/flow.c b/net/core/flow.c
+index 9601587..8c4824e 100644
+--- a/net/core/flow.c
++++ b/net/core/flow.c
+@@ -35,11 +35,11 @@ struct flow_cache_entry {
+ atomic_t *object_ref;
+ };
+
+-atomic_t flow_cache_genid = ATOMIC_INIT(0);
++atomic_unchecked_t flow_cache_genid = ATOMIC_INIT(0);
+
+ static u32 flow_hash_shift;
+ #define flow_hash_size (1 << flow_hash_shift)
+-static DEFINE_PER_CPU(struct flow_cache_entry **, flow_tables) = { NULL };
++static DEFINE_PER_CPU(struct flow_cache_entry **, flow_tables);
+
+ #define flow_table(cpu) (per_cpu(flow_tables, cpu))
+
+@@ -52,7 +52,7 @@ struct flow_percpu_info {
+ u32 hash_rnd;
+ int count;
+ };
+-static DEFINE_PER_CPU(struct flow_percpu_info, flow_hash_info) = { 0 };
++static DEFINE_PER_CPU(struct flow_percpu_info, flow_hash_info);
+
+ #define flow_hash_rnd_recalc(cpu) \
+ (per_cpu(flow_hash_info, cpu).hash_rnd_recalc)
+@@ -69,7 +69,7 @@ struct flow_flush_info {
+ atomic_t cpuleft;
+ struct completion completion;
+ };
+-static DEFINE_PER_CPU(struct tasklet_struct, flow_flush_tasklets) = { NULL };
++static DEFINE_PER_CPU(struct tasklet_struct, flow_flush_tasklets);
+
+ #define flow_flush_tasklet(cpu) (&per_cpu(flow_flush_tasklets, cpu))
+
+@@ -190,7 +190,7 @@ void *flow_cache_lookup(struct net *net, struct flowi *key, u16 family, u8 dir,
+ if (fle->family == family &&
+ fle->dir == dir &&
+ flow_key_compare(key, &fle->key) == 0) {
+- if (fle->genid == atomic_read(&flow_cache_genid)) {
++ if (fle->genid == atomic_read_unchecked(&flow_cache_genid)) {
+ void *ret = fle->object;
+
+ if (ret)
+@@ -228,7 +228,7 @@ nocache:
+ err = resolver(net, key, family, dir, &obj, &obj_ref);
+
+ if (fle && !err) {
+- fle->genid = atomic_read(&flow_cache_genid);
++ fle->genid = atomic_read_unchecked(&flow_cache_genid);
+
+ if (fle->object)
+ atomic_dec(fle->object_ref);
+@@ -258,7 +258,7 @@ static void flow_cache_flush_tasklet(unsigned long data)
+
+ fle = flow_table(cpu)[i];
+ for (; fle; fle = fle->next) {
+- unsigned genid = atomic_read(&flow_cache_genid);
++ unsigned genid = atomic_read_unchecked(&flow_cache_genid);
+
+ if (!fle->object || fle->genid == genid)
+ continue;
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index d4fd895..ac9b1e6 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -57,7 +57,7 @@ struct rtnl_link
+ {
+ rtnl_doit_func doit;
+ rtnl_dumpit_func dumpit;
+-};
++} __no_const;
+
+ static DEFINE_MUTEX(rtnl_mutex);
+
+diff --git a/net/core/scm.c b/net/core/scm.c
+index d98eafc..1a190a9 100644
+--- a/net/core/scm.c
++++ b/net/core/scm.c
+@@ -191,7 +191,7 @@ error:
+ int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
+ {
+ struct cmsghdr __user *cm
+- = (__force struct cmsghdr __user *)msg->msg_control;
++ = (struct cmsghdr __force_user *)msg->msg_control;
+ struct cmsghdr cmhdr;
+ int cmlen = CMSG_LEN(len);
+ int err;
+@@ -214,7 +214,7 @@ int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
+ err = -EFAULT;
+ if (copy_to_user(cm, &cmhdr, sizeof cmhdr))
+ goto out;
+- if (copy_to_user(CMSG_DATA(cm), data, cmlen - sizeof(struct cmsghdr)))
++ if (copy_to_user((void __force_user *)CMSG_DATA((void __force_kernel *)cm), data, cmlen - sizeof(struct cmsghdr)))
+ goto out;
+ cmlen = CMSG_SPACE(len);
+ if (msg->msg_controllen < cmlen)
+@@ -229,7 +229,7 @@ out:
+ void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
+ {
+ struct cmsghdr __user *cm
+- = (__force struct cmsghdr __user*)msg->msg_control;
++ = (struct cmsghdr __force_user *)msg->msg_control;
+
+ int fdmax = 0;
+ int fdnum = scm->fp->count;
+@@ -249,7 +249,7 @@ void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
+ if (fdnum < fdmax)
+ fdmax = fdnum;
+
+- for (i=0, cmfptr=(__force int __user *)CMSG_DATA(cm); i<fdmax;
++ for (i=0, cmfptr=(int __force_user *)CMSG_DATA((void __force_kernel *)cm); i<fdmax;
+ i++, cmfptr++)
+ {
+ int new_fd;
+diff --git a/net/core/secure_seq.c b/net/core/secure_seq.c
+index 45329d7..626aaa6 100644
+--- a/net/core/secure_seq.c
++++ b/net/core/secure_seq.c
+@@ -57,7 +57,7 @@ __u32 secure_tcpv6_sequence_number(__be32 *saddr, __be32 *daddr,
+ EXPORT_SYMBOL(secure_tcpv6_sequence_number);
+
+ u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
+- __be16 dport)
++ __be16 dport)
+ {
+ u32 secret[MD5_MESSAGE_BYTES / 4];
+ u32 hash[MD5_DIGEST_WORDS];
+@@ -71,7 +71,6 @@ u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
+ secret[i] = net_secret[i];
+
+ md5_transform(hash, secret);
+-
+ return hash[0];
+ }
+ #endif
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 025f924..a014894 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -1544,6 +1544,8 @@ int skb_splice_bits(struct sk_buff *skb, unsigned int offset,
+ struct sk_buff *frag_iter;
+ struct sock *sk = skb->sk;
+
++ pax_track_stack();
++
+ /*
+ * __skb_splice_bits() only fails if the output has no room left,
+ * so no point in going over the frag_list for the error case.
+@@ -2989,6 +2991,8 @@ static void sock_rmem_free(struct sk_buff *skb)
+ */
+ int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
+ {
++ int len = skb->len;
++
+ if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
+ (unsigned)sk->sk_rcvbuf)
+ return -ENOMEM;
+@@ -3000,7 +3004,7 @@ int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
+
+ skb_queue_tail(&sk->sk_error_queue, skb);
+ if (!sock_flag(sk, SOCK_DEAD))
+- sk->sk_data_ready(sk, skb->len);
++ sk->sk_data_ready(sk, len);
+ return 0;
+ }
+ EXPORT_SYMBOL(sock_queue_err_skb);
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 6605e75..3acebda 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -864,11 +864,15 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
+ break;
+
+ case SO_PEERCRED:
++ {
++ struct ucred peercred;
+ if (len > sizeof(sk->sk_peercred))
+ len = sizeof(sk->sk_peercred);
+- if (copy_to_user(optval, &sk->sk_peercred, len))
++ peercred = sk->sk_peercred;
++ if (copy_to_user(optval, &peercred, len))
+ return -EFAULT;
+ goto lenout;
++ }
+
+ case SO_PEERNAME:
+ {
+@@ -1892,7 +1896,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
+ */
+ smp_wmb();
+ atomic_set(&sk->sk_refcnt, 1);
+- atomic_set(&sk->sk_drops, 0);
++ atomic_set_unchecked(&sk->sk_drops, 0);
+ }
+ EXPORT_SYMBOL(sock_init_data);
+
+diff --git a/net/decnet/sysctl_net_decnet.c b/net/decnet/sysctl_net_decnet.c
+index 2036568..c55883d 100644
+--- a/net/decnet/sysctl_net_decnet.c
++++ b/net/decnet/sysctl_net_decnet.c
+@@ -206,7 +206,7 @@ static int dn_node_address_handler(ctl_table *table, int write,
+
+ if (len > *lenp) len = *lenp;
+
+- if (copy_to_user(buffer, addr, len))
++ if (len > sizeof addr || copy_to_user(buffer, addr, len))
+ return -EFAULT;
+
+ *lenp = len;
+@@ -327,7 +327,7 @@ static int dn_def_dev_handler(ctl_table *table, int write,
+
+ if (len > *lenp) len = *lenp;
+
+- if (copy_to_user(buffer, devname, len))
++ if (len > sizeof devname || copy_to_user(buffer, devname, len))
+ return -EFAULT;
+
+ *lenp = len;
+diff --git a/net/econet/Kconfig b/net/econet/Kconfig
+index 39a2d29..f39c0fe 100644
+--- a/net/econet/Kconfig
++++ b/net/econet/Kconfig
+@@ -4,7 +4,7 @@
+
+ config ECONET
+ tristate "Acorn Econet/AUN protocols (EXPERIMENTAL)"
+- depends on EXPERIMENTAL && INET
++ depends on EXPERIMENTAL && INET && BROKEN
+ ---help---
+ Econet is a fairly old and slow networking protocol mainly used by
+ Acorn computers to access file and print servers. It uses native
+diff --git a/net/ieee802154/dgram.c b/net/ieee802154/dgram.c
+index a413b1b..380849c 100644
+--- a/net/ieee802154/dgram.c
++++ b/net/ieee802154/dgram.c
+@@ -318,7 +318,7 @@ out:
+ static int dgram_rcv_skb(struct sock *sk, struct sk_buff *skb)
+ {
+ if (sock_queue_rcv_skb(sk, skb) < 0) {
+- atomic_inc(&sk->sk_drops);
++ atomic_inc_unchecked(&sk->sk_drops);
+ kfree_skb(skb);
+ return NET_RX_DROP;
+ }
+diff --git a/net/ieee802154/raw.c b/net/ieee802154/raw.c
+index 30e74ee..bfc6ee0 100644
+--- a/net/ieee802154/raw.c
++++ b/net/ieee802154/raw.c
+@@ -206,7 +206,7 @@ out:
+ static int raw_rcv_skb(struct sock *sk, struct sk_buff *skb)
+ {
+ if (sock_queue_rcv_skb(sk, skb) < 0) {
+- atomic_inc(&sk->sk_drops);
++ atomic_inc_unchecked(&sk->sk_drops);
+ kfree_skb(skb);
+ return NET_RX_DROP;
+ }
+diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
+index dba56d2..acee5d6 100644
+--- a/net/ipv4/inet_diag.c
++++ b/net/ipv4/inet_diag.c
+@@ -113,8 +113,13 @@ static int inet_csk_diag_fill(struct sock *sk,
+ r->idiag_retrans = 0;
+
+ r->id.idiag_if = sk->sk_bound_dev_if;
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ r->id.idiag_cookie[0] = 0;
++ r->id.idiag_cookie[1] = 0;
++#else
+ r->id.idiag_cookie[0] = (u32)(unsigned long)sk;
+ r->id.idiag_cookie[1] = (u32)(((unsigned long)sk >> 31) >> 1);
++#endif
+
+ r->id.idiag_sport = inet->sport;
+ r->id.idiag_dport = inet->dport;
+@@ -200,8 +205,15 @@ static int inet_twsk_diag_fill(struct inet_timewait_sock *tw,
+ r->idiag_family = tw->tw_family;
+ r->idiag_retrans = 0;
+ r->id.idiag_if = tw->tw_bound_dev_if;
++
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ r->id.idiag_cookie[0] = 0;
++ r->id.idiag_cookie[1] = 0;
++#else
+ r->id.idiag_cookie[0] = (u32)(unsigned long)tw;
+ r->id.idiag_cookie[1] = (u32)(((unsigned long)tw >> 31) >> 1);
++#endif
++
+ r->id.idiag_sport = tw->tw_sport;
+ r->id.idiag_dport = tw->tw_dport;
+ r->id.idiag_src[0] = tw->tw_rcv_saddr;
+@@ -284,12 +296,14 @@ static int inet_diag_get_exact(struct sk_buff *in_skb,
+ if (sk == NULL)
+ goto unlock;
+
++#ifndef CONFIG_GRKERNSEC_HIDESYM
+ err = -ESTALE;
+ if ((req->id.idiag_cookie[0] != INET_DIAG_NOCOOKIE ||
+ req->id.idiag_cookie[1] != INET_DIAG_NOCOOKIE) &&
+ ((u32)(unsigned long)sk != req->id.idiag_cookie[0] ||
+ (u32)((((unsigned long)sk) >> 31) >> 1) != req->id.idiag_cookie[1]))
+ goto out;
++#endif
+
+ err = -ENOMEM;
+ rep = alloc_skb(NLMSG_SPACE((sizeof(struct inet_diag_msg) +
+@@ -579,8 +593,14 @@ static int inet_diag_fill_req(struct sk_buff *skb, struct sock *sk,
+ r->idiag_retrans = req->retrans;
+
+ r->id.idiag_if = sk->sk_bound_dev_if;
++
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ r->id.idiag_cookie[0] = 0;
++ r->id.idiag_cookie[1] = 0;
++#else
+ r->id.idiag_cookie[0] = (u32)(unsigned long)req;
+ r->id.idiag_cookie[1] = (u32)(((unsigned long)req >> 31) >> 1);
++#endif
+
+ tmo = req->expires - jiffies;
+ if (tmo < 0)
+diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
+index d717267..56de7e7 100644
+--- a/net/ipv4/inet_hashtables.c
++++ b/net/ipv4/inet_hashtables.c
+@@ -18,12 +18,15 @@
+ #include <linux/sched.h>
+ #include <linux/slab.h>
+ #include <linux/wait.h>
++#include <linux/security.h>
+
+ #include <net/inet_connection_sock.h>
+ #include <net/inet_hashtables.h>
+ #include <net/secure_seq.h>
+ #include <net/ip.h>
+
++extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
++
+ /*
+ * Allocate and initialize a new local port bind bucket.
+ * The bindhash mutex for snum's hash chain must be held here.
+@@ -491,6 +494,8 @@ ok:
+ }
+ spin_unlock(&head->lock);
+
++ gr_update_task_in_ip_table(current, inet_sk(sk));
++
+ if (tw) {
+ inet_twsk_deschedule(tw, death_row);
+ inet_twsk_put(tw);
+diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
+index 13b229f..6956484 100644
+--- a/net/ipv4/inetpeer.c
++++ b/net/ipv4/inetpeer.c
+@@ -367,6 +367,8 @@ struct inet_peer *inet_getpeer(__be32 daddr, int create)
+ struct inet_peer *p, *n;
+ struct inet_peer **stack[PEER_MAXDEPTH], ***stackptr;
+
++ pax_track_stack();
++
+ /* Look up for the address quickly. */
+ read_lock_bh(&peer_pool_lock);
+ p = lookup(daddr, NULL);
+@@ -390,7 +392,7 @@ struct inet_peer *inet_getpeer(__be32 daddr, int create)
+ return NULL;
+ n->v4daddr = daddr;
+ atomic_set(&n->refcnt, 1);
+- atomic_set(&n->rid, 0);
++ atomic_set_unchecked(&n->rid, 0);
+ n->ip_id_count = secure_ip_id(daddr);
+ n->tcp_ts_stamp = 0;
+
+diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
+index d3fe10b..feeafc9 100644
+--- a/net/ipv4/ip_fragment.c
++++ b/net/ipv4/ip_fragment.c
+@@ -255,7 +255,7 @@ static inline int ip_frag_too_far(struct ipq *qp)
+ return 0;
+
+ start = qp->rid;
+- end = atomic_inc_return(&peer->rid);
++ end = atomic_inc_return_unchecked(&peer->rid);
+ qp->rid = end;
+
+ rc = qp->q.fragments && (end - start) > max;
+diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
+index e982b5c..f079d75 100644
+--- a/net/ipv4/ip_sockglue.c
++++ b/net/ipv4/ip_sockglue.c
+@@ -1015,6 +1015,8 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
+ int val;
+ int len;
+
++ pax_track_stack();
++
+ if (level != SOL_IP)
+ return -EOPNOTSUPP;
+
+@@ -1173,7 +1175,7 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
+ if (sk->sk_type != SOCK_STREAM)
+ return -ENOPROTOOPT;
+
+- msg.msg_control = optval;
++ msg.msg_control = (void __force_kernel *)optval;
+ msg.msg_controllen = len;
+ msg.msg_flags = 0;
+
+diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
+index f8d04c2..c1188f2 100644
+--- a/net/ipv4/ipconfig.c
++++ b/net/ipv4/ipconfig.c
+@@ -295,7 +295,7 @@ static int __init ic_devinet_ioctl(unsigned int cmd, struct ifreq *arg)
+
+ mm_segment_t oldfs = get_fs();
+ set_fs(get_ds());
+- res = devinet_ioctl(&init_net, cmd, (struct ifreq __user *) arg);
++ res = devinet_ioctl(&init_net, cmd, (struct ifreq __force_user *) arg);
+ set_fs(oldfs);
+ return res;
+ }
+@@ -306,7 +306,7 @@ static int __init ic_dev_ioctl(unsigned int cmd, struct ifreq *arg)
+
+ mm_segment_t oldfs = get_fs();
+ set_fs(get_ds());
+- res = dev_ioctl(&init_net, cmd, (struct ifreq __user *) arg);
++ res = dev_ioctl(&init_net, cmd, (struct ifreq __force_user *) arg);
+ set_fs(oldfs);
+ return res;
+ }
+@@ -317,7 +317,7 @@ static int __init ic_route_ioctl(unsigned int cmd, struct rtentry *arg)
+
+ mm_segment_t oldfs = get_fs();
+ set_fs(get_ds());
+- res = ip_rt_ioctl(&init_net, cmd, (void __user *) arg);
++ res = ip_rt_ioctl(&init_net, cmd, (void __force_user *) arg);
+ set_fs(oldfs);
+ return res;
+ }
+diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
+index c8b0cc3..4da5ae2 100644
+--- a/net/ipv4/netfilter/arp_tables.c
++++ b/net/ipv4/netfilter/arp_tables.c
+@@ -934,6 +934,7 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
+ private = &tmp;
+ }
+ #endif
++ memset(&info, 0, sizeof(info));
+ info.valid_hooks = t->valid_hooks;
+ memcpy(info.hook_entry, private->hook_entry,
+ sizeof(info.hook_entry));
+diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
+index c156db2..e772975 100644
+--- a/net/ipv4/netfilter/ip_queue.c
++++ b/net/ipv4/netfilter/ip_queue.c
+@@ -286,6 +286,9 @@ ipq_mangle_ipv4(ipq_verdict_msg_t *v, struct nf_queue_entry *e)
+
+ if (v->data_len < sizeof(*user_iph))
+ return 0;
++ if (v->data_len > 65535)
++ return -EMSGSIZE;
++
+ diff = v->data_len - e->skb->len;
+ if (diff < 0) {
+ if (pskb_trim(e->skb, v->data_len))
+@@ -409,7 +412,8 @@ ipq_dev_drop(int ifindex)
+ static inline void
+ __ipq_rcv_skb(struct sk_buff *skb)
+ {
+- int status, type, pid, flags, nlmsglen, skblen;
++ int status, type, pid, flags;
++ unsigned int nlmsglen, skblen;
+ struct nlmsghdr *nlh;
+
+ skblen = skb->len;
+diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
+index 0606db1..02e7e4c 100644
+--- a/net/ipv4/netfilter/ip_tables.c
++++ b/net/ipv4/netfilter/ip_tables.c
+@@ -1141,6 +1141,7 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
+ private = &tmp;
+ }
+ #endif
++ memset(&info, 0, sizeof(info));
+ info.valid_hooks = t->valid_hooks;
+ memcpy(info.hook_entry, private->hook_entry,
+ sizeof(info.hook_entry));
+diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
+index ab996f9..3da5f96 100644
+--- a/net/ipv4/raw.c
++++ b/net/ipv4/raw.c
+@@ -292,7 +292,7 @@ static int raw_rcv_skb(struct sock * sk, struct sk_buff * skb)
+ /* Charge it to the socket. */
+
+ if (sock_queue_rcv_skb(sk, skb) < 0) {
+- atomic_inc(&sk->sk_drops);
++ atomic_inc_unchecked(&sk->sk_drops);
+ kfree_skb(skb);
+ return NET_RX_DROP;
+ }
+@@ -303,7 +303,7 @@ static int raw_rcv_skb(struct sock * sk, struct sk_buff * skb)
+ int raw_rcv(struct sock *sk, struct sk_buff *skb)
+ {
+ if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb)) {
+- atomic_inc(&sk->sk_drops);
++ atomic_inc_unchecked(&sk->sk_drops);
+ kfree_skb(skb);
+ return NET_RX_DROP;
+ }
+@@ -724,16 +724,23 @@ static int raw_init(struct sock *sk)
+
+ static int raw_seticmpfilter(struct sock *sk, char __user *optval, int optlen)
+ {
++ struct icmp_filter filter;
++
++ if (optlen < 0)
++ return -EINVAL;
+ if (optlen > sizeof(struct icmp_filter))
+ optlen = sizeof(struct icmp_filter);
+- if (copy_from_user(&raw_sk(sk)->filter, optval, optlen))
++ if (copy_from_user(&filter, optval, optlen))
+ return -EFAULT;
++ raw_sk(sk)->filter = filter;
++
+ return 0;
+ }
+
+ static int raw_geticmpfilter(struct sock *sk, char __user *optval, int __user *optlen)
+ {
+ int len, ret = -EFAULT;
++ struct icmp_filter filter;
+
+ if (get_user(len, optlen))
+ goto out;
+@@ -743,8 +750,9 @@ static int raw_geticmpfilter(struct sock *sk, char __user *optval, int __user *o
+ if (len > sizeof(struct icmp_filter))
+ len = sizeof(struct icmp_filter);
+ ret = -EFAULT;
+- if (put_user(len, optlen) ||
+- copy_to_user(optval, &raw_sk(sk)->filter, len))
++ filter = raw_sk(sk)->filter;
++ if (put_user(len, optlen) || len > sizeof filter ||
++ copy_to_user(optval, &filter, len))
+ goto out;
+ ret = 0;
+ out: return ret;
+@@ -954,7 +962,13 @@ static void raw_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
+ sk_wmem_alloc_get(sp),
+ sk_rmem_alloc_get(sp),
+ 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
+- atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
++ atomic_read(&sp->sk_refcnt),
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ NULL,
++#else
++ sp,
++#endif
++ atomic_read_unchecked(&sp->sk_drops));
+ }
+
+ static int raw_seq_show(struct seq_file *seq, void *v)
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 58f141b..b759702 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -269,7 +269,7 @@ static inline unsigned int rt_hash(__be32 daddr, __be32 saddr, int idx,
+
+ static inline int rt_genid(struct net *net)
+ {
+- return atomic_read(&net->ipv4.rt_genid);
++ return atomic_read_unchecked(&net->ipv4.rt_genid);
+ }
+
+ #ifdef CONFIG_PROC_FS
+@@ -889,7 +889,7 @@ static void rt_cache_invalidate(struct net *net)
+ unsigned char shuffle;
+
+ get_random_bytes(&shuffle, sizeof(shuffle));
+- atomic_add(shuffle + 1U, &net->ipv4.rt_genid);
++ atomic_add_unchecked(shuffle + 1U, &net->ipv4.rt_genid);
+ }
+
+ /*
+@@ -3357,7 +3357,7 @@ static __net_initdata struct pernet_operations sysctl_route_ops = {
+
+ static __net_init int rt_secret_timer_init(struct net *net)
+ {
+- atomic_set(&net->ipv4.rt_genid,
++ atomic_set_unchecked(&net->ipv4.rt_genid,
+ (int) ((num_physpages ^ (num_physpages>>8)) ^
+ (jiffies ^ (jiffies >> 7))));
+
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index f095659..537313b 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -838,8 +838,7 @@ new_segment:
+ wait_for_sndbuf:
+ set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
+ wait_for_memory:
+- if (copied)
+- tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
++ tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
+
+ if ((err = sk_stream_wait_memory(sk, &timeo)) != 0)
+ goto do_error;
+@@ -2085,6 +2084,8 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
+ int val;
+ int err = 0;
+
++ pax_track_stack();
++
+ /* This is a string value all the others are int's */
+ if (optname == TCP_CONGESTION) {
+ char name[TCP_CA_NAME_MAX];
+@@ -2355,6 +2356,8 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
+ struct tcp_sock *tp = tcp_sk(sk);
+ int val, len;
+
++ pax_track_stack();
++
+ if (get_user(len, optlen))
+ return -EFAULT;
+
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index 6fc7961..33bad4a 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -85,6 +85,9 @@
+ int sysctl_tcp_tw_reuse __read_mostly;
+ int sysctl_tcp_low_latency __read_mostly;
+
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++extern int grsec_enable_blackhole;
++#endif
+
+ #ifdef CONFIG_TCP_MD5SIG
+ static struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk,
+@@ -1543,6 +1546,9 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
+ return 0;
+
+ reset:
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++ if (!grsec_enable_blackhole)
++#endif
+ tcp_v4_send_reset(rsk, skb);
+ discard:
+ kfree_skb(skb);
+@@ -1604,12 +1610,20 @@ int tcp_v4_rcv(struct sk_buff *skb)
+ TCP_SKB_CB(skb)->sacked = 0;
+
+ sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
+- if (!sk)
++ if (!sk) {
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++ ret = 1;
++#endif
+ goto no_tcp_socket;
++ }
+
+ process:
+- if (sk->sk_state == TCP_TIME_WAIT)
++ if (sk->sk_state == TCP_TIME_WAIT) {
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++ ret = 2;
++#endif
+ goto do_time_wait;
++ }
+
+ if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
+ goto discard_and_relse;
+@@ -1651,6 +1665,10 @@ no_tcp_socket:
+ bad_packet:
+ TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
+ } else {
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++ if (!grsec_enable_blackhole || (ret == 1 &&
++ (skb->dev->flags & IFF_LOOPBACK)))
++#endif
+ tcp_v4_send_reset(NULL, skb);
+ }
+
+@@ -2238,7 +2256,11 @@ static void get_openreq4(struct sock *sk, struct request_sock *req,
+ 0, /* non standard timer */
+ 0, /* open_requests have no inode */
+ atomic_read(&sk->sk_refcnt),
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ NULL,
++#else
+ req,
++#endif
+ len);
+ }
+
+@@ -2280,7 +2302,12 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
+ sock_i_uid(sk),
+ icsk->icsk_probes_out,
+ sock_i_ino(sk),
+- atomic_read(&sk->sk_refcnt), sk,
++ atomic_read(&sk->sk_refcnt),
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ NULL,
++#else
++ sk,
++#endif
+ jiffies_to_clock_t(icsk->icsk_rto),
+ jiffies_to_clock_t(icsk->icsk_ack.ato),
+ (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
+@@ -2308,7 +2335,13 @@ static void get_timewait4_sock(struct inet_timewait_sock *tw,
+ " %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p%n",
+ i, src, srcp, dest, destp, tw->tw_substate, 0, 0,
+ 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
+- atomic_read(&tw->tw_refcnt), tw, len);
++ atomic_read(&tw->tw_refcnt),
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ NULL,
++#else
++ tw,
++#endif
++ len);
+ }
+
+ #define TMPSZ 150
+diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
+index 4c03598..e09a8e8 100644
+--- a/net/ipv4/tcp_minisocks.c
++++ b/net/ipv4/tcp_minisocks.c
+@@ -26,6 +26,10 @@
+ #include <net/inet_common.h>
+ #include <net/xfrm.h>
+
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++extern int grsec_enable_blackhole;
++#endif
++
+ #ifdef CONFIG_SYSCTL
+ #define SYNC_INIT 0 /* let the user enable it */
+ #else
+@@ -672,6 +676,10 @@ listen_overflow:
+
+ embryonic_reset:
+ NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
++
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++ if (!grsec_enable_blackhole)
++#endif
+ if (!(flg & TCP_FLAG_RST))
+ req->rsk_ops->send_reset(sk, skb);
+
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index af83bdf..ec91cb2 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2234,6 +2234,8 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
+ __u8 *md5_hash_location;
+ int mss;
+
++ pax_track_stack();
++
+ skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15, 1, GFP_ATOMIC);
+ if (skb == NULL)
+ return NULL;
+diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
+index 59f5b5e..193860f 100644
+--- a/net/ipv4/tcp_probe.c
++++ b/net/ipv4/tcp_probe.c
+@@ -200,7 +200,7 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf,
+ if (cnt + width >= len)
+ break;
+
+- if (copy_to_user(buf + cnt, tbuf, width))
++ if (width > sizeof tbuf || copy_to_user(buf + cnt, tbuf, width))
+ return -EFAULT;
+ cnt += width;
+ }
+diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
+index 57d5501..a9ed13a 100644
+--- a/net/ipv4/tcp_timer.c
++++ b/net/ipv4/tcp_timer.c
+@@ -21,6 +21,10 @@
+ #include <linux/module.h>
+ #include <net/tcp.h>
+
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++extern int grsec_lastack_retries;
++#endif
++
+ int sysctl_tcp_syn_retries __read_mostly = TCP_SYN_RETRIES;
+ int sysctl_tcp_synack_retries __read_mostly = TCP_SYNACK_RETRIES;
+ int sysctl_tcp_keepalive_time __read_mostly = TCP_KEEPALIVE_TIME;
+@@ -164,6 +168,13 @@ static int tcp_write_timeout(struct sock *sk)
+ }
+ }
+
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++ if ((sk->sk_state == TCP_LAST_ACK) &&
++ (grsec_lastack_retries > 0) &&
++ (grsec_lastack_retries < retry_until))
++ retry_until = grsec_lastack_retries;
++#endif
++
+ if (retransmits_timed_out(sk, retry_until)) {
+ /* Has it gone just too far? */
+ tcp_write_err(sk);
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 8e28770..72105c8 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -86,6 +86,7 @@
+ #include <linux/types.h>
+ #include <linux/fcntl.h>
+ #include <linux/module.h>
++#include <linux/security.h>
+ #include <linux/socket.h>
+ #include <linux/sockios.h>
+ #include <linux/igmp.h>
+@@ -106,6 +107,10 @@
+ #include <net/xfrm.h>
+ #include "udp_impl.h"
+
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++extern int grsec_enable_blackhole;
++#endif
++
+ struct udp_table udp_table;
+ EXPORT_SYMBOL(udp_table);
+
+@@ -371,6 +376,9 @@ found:
+ return s;
+ }
+
++extern int gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb);
++extern int gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr);
++
+ /*
+ * This routine is called by the ICMP module when it gets some
+ * sort of error condition. If err < 0 then the socket should
+@@ -639,9 +647,18 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
+ dport = usin->sin_port;
+ if (dport == 0)
+ return -EINVAL;
++
++ err = gr_search_udp_sendmsg(sk, usin);
++ if (err)
++ return err;
+ } else {
+ if (sk->sk_state != TCP_ESTABLISHED)
+ return -EDESTADDRREQ;
++
++ err = gr_search_udp_sendmsg(sk, NULL);
++ if (err)
++ return err;
++
+ daddr = inet->daddr;
+ dport = inet->dport;
+ /* Open fast path for connected socket.
+@@ -945,6 +962,10 @@ try_again:
+ if (!skb)
+ goto out;
+
++ err = gr_search_udp_recvmsg(sk, skb);
++ if (err)
++ goto out_free;
++
+ ulen = skb->len - sizeof(struct udphdr);
+ copied = len;
+ if (copied > ulen)
+@@ -1068,7 +1089,7 @@ static int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
+ if (rc == -ENOMEM) {
+ UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
+ is_udplite);
+- atomic_inc(&sk->sk_drops);
++ atomic_inc_unchecked(&sk->sk_drops);
+ }
+ goto drop;
+ }
+@@ -1338,6 +1359,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+ goto csum_error;
+
+ UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++ if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
++#endif
+ icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
+
+ /*
+@@ -1758,8 +1782,13 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
+ sk_wmem_alloc_get(sp),
+ sk_rmem_alloc_get(sp),
+ 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
+- atomic_read(&sp->sk_refcnt), sp,
+- atomic_read(&sp->sk_drops), len);
++ atomic_read(&sp->sk_refcnt),
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ NULL,
++#else
++ sp,
++#endif
++ atomic_read_unchecked(&sp->sk_drops), len);
+ }
+
+ int udp4_seq_show(struct seq_file *seq, void *v)
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index 8ac3d09..fc58c5f 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -2053,7 +2053,7 @@ int addrconf_set_dstaddr(struct net *net, void __user *arg)
+ p.iph.ihl = 5;
+ p.iph.protocol = IPPROTO_IPV6;
+ p.iph.ttl = 64;
+- ifr.ifr_ifru.ifru_data = (__force void __user *)&p;
++ ifr.ifr_ifru.ifru_data = (void __force_user *)&p;
+
+ if (ops->ndo_do_ioctl) {
+ mm_segment_t oldfs = get_fs();
+diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
+index cc4797d..7cfdfcc 100644
+--- a/net/ipv6/inet6_connection_sock.c
++++ b/net/ipv6/inet6_connection_sock.c
+@@ -152,7 +152,7 @@ void __inet6_csk_dst_store(struct sock *sk, struct dst_entry *dst,
+ #ifdef CONFIG_XFRM
+ {
+ struct rt6_info *rt = (struct rt6_info *)dst;
+- rt->rt6i_flow_cache_genid = atomic_read(&flow_cache_genid);
++ rt->rt6i_flow_cache_genid = atomic_read_unchecked(&flow_cache_genid);
+ }
+ #endif
+ }
+@@ -167,7 +167,7 @@ struct dst_entry *__inet6_csk_dst_check(struct sock *sk, u32 cookie)
+ #ifdef CONFIG_XFRM
+ if (dst) {
+ struct rt6_info *rt = (struct rt6_info *)dst;
+- if (rt->rt6i_flow_cache_genid != atomic_read(&flow_cache_genid)) {
++ if (rt->rt6i_flow_cache_genid != atomic_read_unchecked(&flow_cache_genid)) {
+ sk->sk_dst_cache = NULL;
+ dst_release(dst);
+ dst = NULL;
+diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
+index 093e9b2..f72cddb 100644
+--- a/net/ipv6/inet6_hashtables.c
++++ b/net/ipv6/inet6_hashtables.c
+@@ -119,7 +119,7 @@ out:
+ }
+ EXPORT_SYMBOL(__inet6_lookup_established);
+
+-static int inline compute_score(struct sock *sk, struct net *net,
++static inline int compute_score(struct sock *sk, struct net *net,
+ const unsigned short hnum,
+ const struct in6_addr *daddr,
+ const int dif)
+diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
+index 4f7aaf6..f7acf45 100644
+--- a/net/ipv6/ipv6_sockglue.c
++++ b/net/ipv6/ipv6_sockglue.c
+@@ -130,6 +130,8 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
+ int val, valbool;
+ int retv = -ENOPROTOOPT;
+
++ pax_track_stack();
++
+ if (optval == NULL)
+ val=0;
+ else {
+@@ -881,6 +883,8 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
+ int len;
+ int val;
+
++ pax_track_stack();
++
+ if (ip6_mroute_opt(optname))
+ return ip6_mroute_getsockopt(sk, optname, optval, optlen);
+
+@@ -922,7 +926,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
+ if (sk->sk_type != SOCK_STREAM)
+ return -ENOPROTOOPT;
+
+- msg.msg_control = optval;
++ msg.msg_control = (void __force_kernel *)optval;
+ msg.msg_controllen = len;
+ msg.msg_flags = 0;
+
+diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
+index 1cf3f0c..1d4376f 100644
+--- a/net/ipv6/netfilter/ip6_queue.c
++++ b/net/ipv6/netfilter/ip6_queue.c
+@@ -287,6 +287,9 @@ ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct nf_queue_entry *e)
+
+ if (v->data_len < sizeof(*user_iph))
+ return 0;
++ if (v->data_len > 65535)
++ return -EMSGSIZE;
++
+ diff = v->data_len - e->skb->len;
+ if (diff < 0) {
+ if (pskb_trim(e->skb, v->data_len))
+@@ -411,7 +414,8 @@ ipq_dev_drop(int ifindex)
+ static inline void
+ __ipq_rcv_skb(struct sk_buff *skb)
+ {
+- int status, type, pid, flags, nlmsglen, skblen;
++ int status, type, pid, flags;
++ unsigned int nlmsglen, skblen;
+ struct nlmsghdr *nlh;
+
+ skblen = skb->len;
+diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
+index 78b5a36..7f37433 100644
+--- a/net/ipv6/netfilter/ip6_tables.c
++++ b/net/ipv6/netfilter/ip6_tables.c
+@@ -1173,6 +1173,7 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
+ private = &tmp;
+ }
+ #endif
++ memset(&info, 0, sizeof(info));
+ info.valid_hooks = t->valid_hooks;
+ memcpy(info.hook_entry, private->hook_entry,
+ sizeof(info.hook_entry));
+diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
+index 4f24570..b813b34 100644
+--- a/net/ipv6/raw.c
++++ b/net/ipv6/raw.c
+@@ -375,14 +375,14 @@ static inline int rawv6_rcv_skb(struct sock * sk, struct sk_buff * skb)
+ {
+ if ((raw6_sk(sk)->checksum || sk->sk_filter) &&
+ skb_checksum_complete(skb)) {
+- atomic_inc(&sk->sk_drops);
++ atomic_inc_unchecked(&sk->sk_drops);
+ kfree_skb(skb);
+ return NET_RX_DROP;
+ }
+
+ /* Charge it to the socket. */
+ if (sock_queue_rcv_skb(sk,skb)<0) {
+- atomic_inc(&sk->sk_drops);
++ atomic_inc_unchecked(&sk->sk_drops);
+ kfree_skb(skb);
+ return NET_RX_DROP;
+ }
+@@ -403,7 +403,7 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
+ struct raw6_sock *rp = raw6_sk(sk);
+
+ if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) {
+- atomic_inc(&sk->sk_drops);
++ atomic_inc_unchecked(&sk->sk_drops);
+ kfree_skb(skb);
+ return NET_RX_DROP;
+ }
+@@ -427,7 +427,7 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
+
+ if (inet->hdrincl) {
+ if (skb_checksum_complete(skb)) {
+- atomic_inc(&sk->sk_drops);
++ atomic_inc_unchecked(&sk->sk_drops);
+ kfree_skb(skb);
+ return NET_RX_DROP;
+ }
+@@ -518,7 +518,7 @@ csum_copy_err:
+ as some normal condition.
+ */
+ err = (flags&MSG_DONTWAIT) ? -EAGAIN : -EHOSTUNREACH;
+- atomic_inc(&sk->sk_drops);
++ atomic_inc_unchecked(&sk->sk_drops);
+ goto out;
+ }
+
+@@ -600,7 +600,7 @@ out:
+ return err;
+ }
+
+-static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
++static int rawv6_send_hdrinc(struct sock *sk, void *from, unsigned int length,
+ struct flowi *fl, struct rt6_info *rt,
+ unsigned int flags)
+ {
+@@ -738,6 +738,8 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
+ u16 proto;
+ int err;
+
++ pax_track_stack();
++
+ /* Rough check on arithmetic overflow,
+ better check is made in ip6_append_data().
+ */
+@@ -916,12 +918,17 @@ do_confirm:
+ static int rawv6_seticmpfilter(struct sock *sk, int level, int optname,
+ char __user *optval, int optlen)
+ {
++ struct icmp6_filter filter;
++
+ switch (optname) {
+ case ICMPV6_FILTER:
++ if (optlen < 0)
++ return -EINVAL;
+ if (optlen > sizeof(struct icmp6_filter))
+ optlen = sizeof(struct icmp6_filter);
+- if (copy_from_user(&raw6_sk(sk)->filter, optval, optlen))
++ if (copy_from_user(&filter, optval, optlen))
+ return -EFAULT;
++ raw6_sk(sk)->filter = filter;
+ return 0;
+ default:
+ return -ENOPROTOOPT;
+@@ -934,6 +941,7 @@ static int rawv6_geticmpfilter(struct sock *sk, int level, int optname,
+ char __user *optval, int __user *optlen)
+ {
+ int len;
++ struct icmp6_filter filter;
+
+ switch (optname) {
+ case ICMPV6_FILTER:
+@@ -945,7 +953,8 @@ static int rawv6_geticmpfilter(struct sock *sk, int level, int optname,
+ len = sizeof(struct icmp6_filter);
+ if (put_user(len, optlen))
+ return -EFAULT;
+- if (copy_to_user(optval, &raw6_sk(sk)->filter, len))
++ filter = raw6_sk(sk)->filter;
++ if (len > sizeof filter || copy_to_user(optval, &filter, len))
+ return -EFAULT;
+ return 0;
+ default:
+@@ -1241,7 +1250,13 @@ static void raw6_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
+ 0, 0L, 0,
+ sock_i_uid(sp), 0,
+ sock_i_ino(sp),
+- atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
++ atomic_read(&sp->sk_refcnt),
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ NULL,
++#else
++ sp,
++#endif
++ atomic_read_unchecked(&sp->sk_drops));
+ }
+
+ static int raw6_seq_show(struct seq_file *seq, void *v)
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index faae6df..d4430c1 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -89,6 +89,10 @@ static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
+ }
+ #endif
+
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++extern int grsec_enable_blackhole;
++#endif
++
+ static void tcp_v6_hash(struct sock *sk)
+ {
+ if (sk->sk_state != TCP_CLOSE) {
+@@ -1579,6 +1583,9 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
+ return 0;
+
+ reset:
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++ if (!grsec_enable_blackhole)
++#endif
+ tcp_v6_send_reset(sk, skb);
+ discard:
+ if (opt_skb)
+@@ -1656,12 +1663,20 @@ static int tcp_v6_rcv(struct sk_buff *skb)
+ TCP_SKB_CB(skb)->sacked = 0;
+
+ sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
+- if (!sk)
++ if (!sk) {
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++ ret = 1;
++#endif
+ goto no_tcp_socket;
++ }
+
+ process:
+- if (sk->sk_state == TCP_TIME_WAIT)
++ if (sk->sk_state == TCP_TIME_WAIT) {
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++ ret = 2;
++#endif
+ goto do_time_wait;
++ }
+
+ if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
+ goto discard_and_relse;
+@@ -1701,6 +1716,10 @@ no_tcp_socket:
+ bad_packet:
+ TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
+ } else {
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++ if (!grsec_enable_blackhole || (ret == 1 &&
++ (skb->dev->flags & IFF_LOOPBACK)))
++#endif
+ tcp_v6_send_reset(NULL, skb);
+ }
+
+@@ -1916,7 +1935,13 @@ static void get_openreq6(struct seq_file *seq,
+ uid,
+ 0, /* non standard timer */
+ 0, /* open_requests have no inode */
+- 0, req);
++ 0,
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ NULL
++#else
++ req
++#endif
++ );
+ }
+
+ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
+@@ -1966,7 +1991,12 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
+ sock_i_uid(sp),
+ icsk->icsk_probes_out,
+ sock_i_ino(sp),
+- atomic_read(&sp->sk_refcnt), sp,
++ atomic_read(&sp->sk_refcnt),
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ NULL,
++#else
++ sp,
++#endif
+ jiffies_to_clock_t(icsk->icsk_rto),
+ jiffies_to_clock_t(icsk->icsk_ack.ato),
+ (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
+@@ -2001,7 +2031,13 @@ static void get_timewait6_sock(struct seq_file *seq,
+ dest->s6_addr32[2], dest->s6_addr32[3], destp,
+ tw->tw_substate, 0, 0,
+ 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
+- atomic_read(&tw->tw_refcnt), tw);
++ atomic_read(&tw->tw_refcnt),
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ NULL
++#else
++ tw
++#endif
++ );
+ }
+
+ static int tcp6_seq_show(struct seq_file *seq, void *v)
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index 9cc6289..052c521 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -49,6 +49,10 @@
+ #include <linux/seq_file.h>
+ #include "udp_impl.h"
+
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++extern int grsec_enable_blackhole;
++#endif
++
+ int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
+ {
+ const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr;
+@@ -391,7 +395,7 @@ int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
+ if (rc == -ENOMEM) {
+ UDP6_INC_STATS_BH(sock_net(sk),
+ UDP_MIB_RCVBUFERRORS, is_udplite);
+- atomic_inc(&sk->sk_drops);
++ atomic_inc_unchecked(&sk->sk_drops);
+ }
+ goto drop;
+ }
+@@ -590,6 +594,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+ UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
+ proto == IPPROTO_UDPLITE);
+
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++ if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
++#endif
+ icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0, dev);
+
+ kfree_skb(skb);
+@@ -1209,8 +1216,13 @@ static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket
+ 0, 0L, 0,
+ sock_i_uid(sp), 0,
+ sock_i_ino(sp),
+- atomic_read(&sp->sk_refcnt), sp,
+- atomic_read(&sp->sk_drops));
++ atomic_read(&sp->sk_refcnt),
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ NULL,
++#else
++ sp,
++#endif
++ atomic_read_unchecked(&sp->sk_drops));
+ }
+
+ int udp6_seq_show(struct seq_file *seq, void *v)
+diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
+index 48bb1e3..5980e6e 100644
+--- a/net/ipv6/xfrm6_tunnel.c
++++ b/net/ipv6/xfrm6_tunnel.c
+@@ -258,7 +258,7 @@ static int xfrm6_tunnel_rcv(struct sk_buff *skb)
+ __be32 spi;
+
+ spi = xfrm6_tunnel_spi_lookup((xfrm_address_t *)&iph->saddr);
+- return xfrm6_rcv_spi(skb, IPPROTO_IPV6, spi) > 0 ? : 0;
++ return xfrm6_rcv_spi(skb, IPPROTO_IPV6, spi);
+ }
+
+ static int xfrm6_tunnel_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
+diff --git a/net/irda/ircomm/ircomm_tty.c b/net/irda/ircomm/ircomm_tty.c
+index 811984d..11f59b7 100644
+--- a/net/irda/ircomm/ircomm_tty.c
++++ b/net/irda/ircomm/ircomm_tty.c
+@@ -280,16 +280,16 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
+ add_wait_queue(&self->open_wait, &wait);
+
+ IRDA_DEBUG(2, "%s(%d):block_til_ready before block on %s open_count=%d\n",
+- __FILE__,__LINE__, tty->driver->name, self->open_count );
++ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
+
+ /* As far as I can see, we protect open_count - Jean II */
+ spin_lock_irqsave(&self->spinlock, flags);
+ if (!tty_hung_up_p(filp)) {
+ extra_count = 1;
+- self->open_count--;
++ local_dec(&self->open_count);
+ }
+ spin_unlock_irqrestore(&self->spinlock, flags);
+- self->blocked_open++;
++ local_inc(&self->blocked_open);
+
+ while (1) {
+ if (tty->termios->c_cflag & CBAUD) {
+@@ -329,7 +329,7 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
+ }
+
+ IRDA_DEBUG(1, "%s(%d):block_til_ready blocking on %s open_count=%d\n",
+- __FILE__,__LINE__, tty->driver->name, self->open_count );
++ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
+
+ schedule();
+ }
+@@ -340,13 +340,13 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
+ if (extra_count) {
+ /* ++ is not atomic, so this should be protected - Jean II */
+ spin_lock_irqsave(&self->spinlock, flags);
+- self->open_count++;
++ local_inc(&self->open_count);
+ spin_unlock_irqrestore(&self->spinlock, flags);
+ }
+- self->blocked_open--;
++ local_dec(&self->blocked_open);
+
+ IRDA_DEBUG(1, "%s(%d):block_til_ready after blocking on %s open_count=%d\n",
+- __FILE__,__LINE__, tty->driver->name, self->open_count);
++ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count));
+
+ if (!retval)
+ self->flags |= ASYNC_NORMAL_ACTIVE;
+@@ -415,14 +415,14 @@ static int ircomm_tty_open(struct tty_struct *tty, struct file *filp)
+ }
+ /* ++ is not atomic, so this should be protected - Jean II */
+ spin_lock_irqsave(&self->spinlock, flags);
+- self->open_count++;
++ local_inc(&self->open_count);
+
+ tty->driver_data = self;
+ self->tty = tty;
+ spin_unlock_irqrestore(&self->spinlock, flags);
+
+ IRDA_DEBUG(1, "%s(), %s%d, count = %d\n", __func__ , tty->driver->name,
+- self->line, self->open_count);
++ self->line, local_read(&self->open_count));
+
+ /* Not really used by us, but lets do it anyway */
+ self->tty->low_latency = (self->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
+@@ -511,7 +511,7 @@ static void ircomm_tty_close(struct tty_struct *tty, struct file *filp)
+ return;
+ }
+
+- if ((tty->count == 1) && (self->open_count != 1)) {
++ if ((tty->count == 1) && (local_read(&self->open_count) != 1)) {
+ /*
+ * Uh, oh. tty->count is 1, which means that the tty
+ * structure will be freed. state->count should always
+@@ -521,16 +521,16 @@ static void ircomm_tty_close(struct tty_struct *tty, struct file *filp)
+ */
+ IRDA_DEBUG(0, "%s(), bad serial port count; "
+ "tty->count is 1, state->count is %d\n", __func__ ,
+- self->open_count);
+- self->open_count = 1;
++ local_read(&self->open_count));
++ local_set(&self->open_count, 1);
+ }
+
+- if (--self->open_count < 0) {
++ if (local_dec_return(&self->open_count) < 0) {
+ IRDA_ERROR("%s(), bad serial port count for ttys%d: %d\n",
+- __func__, self->line, self->open_count);
+- self->open_count = 0;
++ __func__, self->line, local_read(&self->open_count));
++ local_set(&self->open_count, 0);
+ }
+- if (self->open_count) {
++ if (local_read(&self->open_count)) {
+ spin_unlock_irqrestore(&self->spinlock, flags);
+
+ IRDA_DEBUG(0, "%s(), open count > 0\n", __func__ );
+@@ -562,7 +562,7 @@ static void ircomm_tty_close(struct tty_struct *tty, struct file *filp)
+ tty->closing = 0;
+ self->tty = NULL;
+
+- if (self->blocked_open) {
++ if (local_read(&self->blocked_open)) {
+ if (self->close_delay)
+ schedule_timeout_interruptible(self->close_delay);
+ wake_up_interruptible(&self->open_wait);
+@@ -1017,7 +1017,7 @@ static void ircomm_tty_hangup(struct tty_struct *tty)
+ spin_lock_irqsave(&self->spinlock, flags);
+ self->flags &= ~ASYNC_NORMAL_ACTIVE;
+ self->tty = NULL;
+- self->open_count = 0;
++ local_set(&self->open_count, 0);
+ spin_unlock_irqrestore(&self->spinlock, flags);
+
+ wake_up_interruptible(&self->open_wait);
+@@ -1369,7 +1369,7 @@ static void ircomm_tty_line_info(struct ircomm_tty_cb *self, struct seq_file *m)
+ seq_putc(m, '\n');
+
+ seq_printf(m, "Role: %s\n", self->client ? "client" : "server");
+- seq_printf(m, "Open count: %d\n", self->open_count);
++ seq_printf(m, "Open count: %d\n", local_read(&self->open_count));
+ seq_printf(m, "Max data size: %d\n", self->max_data_size);
+ seq_printf(m, "Max header size: %d\n", self->max_header_size);
+
+diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
+index bada1b9..f325943 100644
+--- a/net/iucv/af_iucv.c
++++ b/net/iucv/af_iucv.c
+@@ -651,10 +651,10 @@ static int iucv_sock_autobind(struct sock *sk)
+
+ write_lock_bh(&iucv_sk_list.lock);
+
+- sprintf(name, "%08x", atomic_inc_return(&iucv_sk_list.autobind_name));
++ sprintf(name, "%08x", atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
+ while (__iucv_get_sock_by_name(name)) {
+ sprintf(name, "%08x",
+- atomic_inc_return(&iucv_sk_list.autobind_name));
++ atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
+ }
+
+ write_unlock_bh(&iucv_sk_list.lock);
+diff --git a/net/key/af_key.c b/net/key/af_key.c
+index 4e98193..439b449 100644
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -2489,6 +2489,8 @@ static int pfkey_migrate(struct sock *sk, struct sk_buff *skb,
+ struct xfrm_migrate m[XFRM_MAX_DEPTH];
+ struct xfrm_kmaddress k;
+
++ pax_track_stack();
++
+ if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC - 1],
+ ext_hdrs[SADB_EXT_ADDRESS_DST - 1]) ||
+ !ext_hdrs[SADB_X_EXT_POLICY - 1]) {
+@@ -3660,7 +3662,11 @@ static int pfkey_seq_show(struct seq_file *f, void *v)
+ seq_printf(f ,"sk RefCnt Rmem Wmem User Inode\n");
+ else
+ seq_printf(f ,"%p %-6d %-6u %-6u %-6u %-6lu\n",
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ NULL,
++#else
+ s,
++#endif
+ atomic_read(&s->sk_refcnt),
+ sk_rmem_alloc_get(s),
+ sk_wmem_alloc_get(s),
+diff --git a/net/lapb/lapb_iface.c b/net/lapb/lapb_iface.c
+index bda96d1..c038b72 100644
+--- a/net/lapb/lapb_iface.c
++++ b/net/lapb/lapb_iface.c
+@@ -157,7 +157,7 @@ int lapb_register(struct net_device *dev, struct lapb_register_struct *callbacks
+ goto out;
+
+ lapb->dev = dev;
+- lapb->callbacks = *callbacks;
++ lapb->callbacks = callbacks;
+
+ __lapb_insert_cb(lapb);
+
+@@ -379,32 +379,32 @@ int lapb_data_received(struct net_device *dev, struct sk_buff *skb)
+
+ void lapb_connect_confirmation(struct lapb_cb *lapb, int reason)
+ {
+- if (lapb->callbacks.connect_confirmation)
+- lapb->callbacks.connect_confirmation(lapb->dev, reason);
++ if (lapb->callbacks->connect_confirmation)
++ lapb->callbacks->connect_confirmation(lapb->dev, reason);
+ }
+
+ void lapb_connect_indication(struct lapb_cb *lapb, int reason)
+ {
+- if (lapb->callbacks.connect_indication)
+- lapb->callbacks.connect_indication(lapb->dev, reason);
++ if (lapb->callbacks->connect_indication)
++ lapb->callbacks->connect_indication(lapb->dev, reason);
+ }
+
+ void lapb_disconnect_confirmation(struct lapb_cb *lapb, int reason)
+ {
+- if (lapb->callbacks.disconnect_confirmation)
+- lapb->callbacks.disconnect_confirmation(lapb->dev, reason);
++ if (lapb->callbacks->disconnect_confirmation)
++ lapb->callbacks->disconnect_confirmation(lapb->dev, reason);
+ }
+
+ void lapb_disconnect_indication(struct lapb_cb *lapb, int reason)
+ {
+- if (lapb->callbacks.disconnect_indication)
+- lapb->callbacks.disconnect_indication(lapb->dev, reason);
++ if (lapb->callbacks->disconnect_indication)
++ lapb->callbacks->disconnect_indication(lapb->dev, reason);
+ }
+
+ int lapb_data_indication(struct lapb_cb *lapb, struct sk_buff *skb)
+ {
+- if (lapb->callbacks.data_indication)
+- return lapb->callbacks.data_indication(lapb->dev, skb);
++ if (lapb->callbacks->data_indication)
++ return lapb->callbacks->data_indication(lapb->dev, skb);
+
+ kfree_skb(skb);
+ return NET_RX_SUCCESS; /* For now; must be != NET_RX_DROP */
+@@ -414,8 +414,8 @@ int lapb_data_transmit(struct lapb_cb *lapb, struct sk_buff *skb)
+ {
+ int used = 0;
+
+- if (lapb->callbacks.data_transmit) {
+- lapb->callbacks.data_transmit(lapb->dev, skb);
++ if (lapb->callbacks->data_transmit) {
++ lapb->callbacks->data_transmit(lapb->dev, skb);
+ used = 1;
+ }
+
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index fe2d3f8..e57f683 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1369,7 +1369,7 @@ static int ieee80211_set_bitrate_mask(struct wiphy *wiphy,
+ return err;
+ }
+
+-struct cfg80211_ops mac80211_config_ops = {
++const struct cfg80211_ops mac80211_config_ops = {
+ .add_virtual_intf = ieee80211_add_iface,
+ .del_virtual_intf = ieee80211_del_iface,
+ .change_virtual_intf = ieee80211_change_iface,
+diff --git a/net/mac80211/cfg.h b/net/mac80211/cfg.h
+index 7d7879f..2d51f62 100644
+--- a/net/mac80211/cfg.h
++++ b/net/mac80211/cfg.h
+@@ -4,6 +4,6 @@
+ #ifndef __CFG_H
+ #define __CFG_H
+
+-extern struct cfg80211_ops mac80211_config_ops;
++extern const struct cfg80211_ops mac80211_config_ops;
+
+ #endif /* __CFG_H */
+diff --git a/net/mac80211/debugfs_key.c b/net/mac80211/debugfs_key.c
+index 99c7525..9cb4937 100644
+--- a/net/mac80211/debugfs_key.c
++++ b/net/mac80211/debugfs_key.c
+@@ -211,9 +211,13 @@ static ssize_t key_key_read(struct file *file, char __user *userbuf,
+ size_t count, loff_t *ppos)
+ {
+ struct ieee80211_key *key = file->private_data;
+- int i, res, bufsize = 2 * key->conf.keylen + 2;
++ int i, bufsize = 2 * key->conf.keylen + 2;
+ char *buf = kmalloc(bufsize, GFP_KERNEL);
+ char *p = buf;
++ ssize_t res;
++
++ if (buf == NULL)
++ return -ENOMEM;
+
+ for (i = 0; i < key->conf.keylen; i++)
+ p += scnprintf(p, bufsize + buf - p, "%02x", key->conf.key[i]);
+diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
+index 33a2e89..08650c8 100644
+--- a/net/mac80211/debugfs_sta.c
++++ b/net/mac80211/debugfs_sta.c
+@@ -124,6 +124,8 @@ static ssize_t sta_agg_status_read(struct file *file, char __user *userbuf,
+ int i;
+ struct sta_info *sta = file->private_data;
+
++ pax_track_stack();
++
+ spin_lock_bh(&sta->lock);
+ p += scnprintf(p, sizeof(buf)+buf-p, "next dialog_token is %#02x\n",
+ sta->ampdu_mlme.dialog_token_allocator + 1);
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index ca62bfe..6657a03 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -25,6 +25,7 @@
+ #include <linux/etherdevice.h>
+ #include <net/cfg80211.h>
+ #include <net/mac80211.h>
++#include <asm/local.h>
+ #include "key.h"
+ #include "sta_info.h"
+
+@@ -635,7 +636,7 @@ struct ieee80211_local {
+ /* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
+ spinlock_t queue_stop_reason_lock;
+
+- int open_count;
++ local_t open_count;
+ int monitors, cooked_mntrs;
+ /* number of interfaces with corresponding FIF_ flags */
+ int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll;
+diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
+index 079c500..eb3c6d4 100644
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -166,7 +166,7 @@ static int ieee80211_open(struct net_device *dev)
+ break;
+ }
+
+- if (local->open_count == 0) {
++ if (local_read(&local->open_count) == 0) {
+ res = drv_start(local);
+ if (res)
+ goto err_del_bss;
+@@ -196,7 +196,7 @@ static int ieee80211_open(struct net_device *dev)
+ * Validate the MAC address for this device.
+ */
+ if (!is_valid_ether_addr(dev->dev_addr)) {
+- if (!local->open_count)
++ if (!local_read(&local->open_count))
+ drv_stop(local);
+ return -EADDRNOTAVAIL;
+ }
+@@ -292,7 +292,7 @@ static int ieee80211_open(struct net_device *dev)
+
+ hw_reconf_flags |= __ieee80211_recalc_idle(local);
+
+- local->open_count++;
++ local_inc(&local->open_count);
+ if (hw_reconf_flags) {
+ ieee80211_hw_config(local, hw_reconf_flags);
+ /*
+@@ -320,7 +320,7 @@ static int ieee80211_open(struct net_device *dev)
+ err_del_interface:
+ drv_remove_interface(local, &conf);
+ err_stop:
+- if (!local->open_count)
++ if (!local_read(&local->open_count))
+ drv_stop(local);
+ err_del_bss:
+ sdata->bss = NULL;
+@@ -420,7 +420,7 @@ static int ieee80211_stop(struct net_device *dev)
+ WARN_ON(!list_empty(&sdata->u.ap.vlans));
+ }
+
+- local->open_count--;
++ local_dec(&local->open_count);
+
+ switch (sdata->vif.type) {
+ case NL80211_IFTYPE_AP_VLAN:
+@@ -526,7 +526,7 @@ static int ieee80211_stop(struct net_device *dev)
+
+ ieee80211_recalc_ps(local, -1);
+
+- if (local->open_count == 0) {
++ if (local_read(&local->open_count) == 0) {
+ ieee80211_clear_tx_pending(local);
+ ieee80211_stop_device(local);
+
+diff --git a/net/mac80211/main.c b/net/mac80211/main.c
+index 2dfe176..74e4388 100644
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -145,7 +145,7 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
+ local->hw.conf.power_level = power;
+ }
+
+- if (changed && local->open_count) {
++ if (changed && local_read(&local->open_count)) {
+ ret = drv_config(local, changed);
+ /*
+ * Goal:
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index e67eea7..fcc227e 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -1438,6 +1438,8 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
+ bool have_higher_than_11mbit = false, newsta = false;
+ u16 ap_ht_cap_flags;
+
++ pax_track_stack();
++
+ /*
+ * AssocResp and ReassocResp have identical structure, so process both
+ * of them in this function.
+diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
+index e535f1c..4d733d1 100644
+--- a/net/mac80211/pm.c
++++ b/net/mac80211/pm.c
+@@ -107,7 +107,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
+ }
+
+ /* stop hardware - this must stop RX */
+- if (local->open_count)
++ if (local_read(&local->open_count))
+ ieee80211_stop_device(local);
+
+ local->suspended = true;
+diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
+index b33efc4..0a2efb6 100644
+--- a/net/mac80211/rate.c
++++ b/net/mac80211/rate.c
+@@ -287,7 +287,7 @@ int ieee80211_init_rate_ctrl_alg(struct ieee80211_local *local,
+ struct rate_control_ref *ref, *old;
+
+ ASSERT_RTNL();
+- if (local->open_count)
++ if (local_read(&local->open_count))
+ return -EBUSY;
+
+ ref = rate_control_alloc(name, local);
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index b1d7904..57e4da7 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -173,7 +173,7 @@ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr,
+ return cpu_to_le16(dur);
+ }
+
+-static int inline is_ieee80211_device(struct ieee80211_local *local,
++static inline int is_ieee80211_device(struct ieee80211_local *local,
+ struct net_device *dev)
+ {
+ return local == wdev_priv(dev->ieee80211_ptr);
+diff --git a/net/mac80211/util.c b/net/mac80211/util.c
+index 31b1085..48fb26d 100644
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -1042,7 +1042,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
+ local->resuming = true;
+
+ /* restart hardware */
+- if (local->open_count) {
++ if (local_read(&local->open_count)) {
+ /*
+ * Upon resume hardware can sometimes be goofy due to
+ * various platform / driver / bus issues, so restarting
+diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
+index 634d14a..b35a608 100644
+--- a/net/netfilter/Kconfig
++++ b/net/netfilter/Kconfig
+@@ -635,6 +635,16 @@ config NETFILTER_XT_MATCH_ESP
+
+ To compile it as a module, choose M here. If unsure, say N.
+
++config NETFILTER_XT_MATCH_GRADM
++ tristate '"gradm" match support'
++ depends on NETFILTER_XTABLES && NETFILTER_ADVANCED
++ depends on GRKERNSEC && !GRKERNSEC_NO_RBAC
++ ---help---
++ The gradm match allows to match on grsecurity RBAC being enabled.
++ It is useful when iptables rules are applied early on bootup to
++ prevent connections to the machine (except from a trusted host)
++ while the RBAC system is disabled.
++
+ config NETFILTER_XT_MATCH_HASHLIMIT
+ tristate '"hashlimit" match support'
+ depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
+diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
+index 49f62ee..a17b2c6 100644
+--- a/net/netfilter/Makefile
++++ b/net/netfilter/Makefile
+@@ -68,6 +68,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_CONNTRACK) += xt_conntrack.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_DCCP) += xt_dccp.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_DSCP) += xt_dscp.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) += xt_esp.o
++obj-$(CONFIG_NETFILTER_XT_MATCH_GRADM) += xt_gradm.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o
+diff --git a/net/netfilter/ipvs/ip_vs_app.c b/net/netfilter/ipvs/ip_vs_app.c
+index 3c7e427..724043c 100644
+--- a/net/netfilter/ipvs/ip_vs_app.c
++++ b/net/netfilter/ipvs/ip_vs_app.c
+@@ -564,7 +564,7 @@ static const struct file_operations ip_vs_app_fops = {
+ .open = ip_vs_app_open,
+ .read = seq_read,
+ .llseek = seq_lseek,
+- .release = seq_release,
++ .release = seq_release_net,
+ };
+ #endif
+
+diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
+index 95682e5..457dbac 100644
+--- a/net/netfilter/ipvs/ip_vs_conn.c
++++ b/net/netfilter/ipvs/ip_vs_conn.c
+@@ -453,10 +453,10 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, struct ip_vs_dest *dest)
+ /* if the connection is not template and is created
+ * by sync, preserve the activity flag.
+ */
+- cp->flags |= atomic_read(&dest->conn_flags) &
++ cp->flags |= atomic_read_unchecked(&dest->conn_flags) &
+ (~IP_VS_CONN_F_INACTIVE);
+ else
+- cp->flags |= atomic_read(&dest->conn_flags);
++ cp->flags |= atomic_read_unchecked(&dest->conn_flags);
+ cp->dest = dest;
+
+ IP_VS_DBG_BUF(7, "Bind-dest %s c:%s:%d v:%s:%d "
+@@ -723,7 +723,7 @@ ip_vs_conn_new(int af, int proto, const union nf_inet_addr *caddr, __be16 cport,
+ atomic_set(&cp->refcnt, 1);
+
+ atomic_set(&cp->n_control, 0);
+- atomic_set(&cp->in_pkts, 0);
++ atomic_set_unchecked(&cp->in_pkts, 0);
+
+ atomic_inc(&ip_vs_conn_count);
+ if (flags & IP_VS_CONN_F_NO_CPORT)
+@@ -871,7 +871,7 @@ static const struct file_operations ip_vs_conn_fops = {
+ .open = ip_vs_conn_open,
+ .read = seq_read,
+ .llseek = seq_lseek,
+- .release = seq_release,
++ .release = seq_release_net,
+ };
+
+ static const char *ip_vs_origin_name(unsigned flags)
+@@ -934,7 +934,7 @@ static const struct file_operations ip_vs_conn_sync_fops = {
+ .open = ip_vs_conn_sync_open,
+ .read = seq_read,
+ .llseek = seq_lseek,
+- .release = seq_release,
++ .release = seq_release_net,
+ };
+
+ #endif
+@@ -961,7 +961,7 @@ static inline int todrop_entry(struct ip_vs_conn *cp)
+
+ /* Don't drop the entry if its number of incoming packets is not
+ located in [0, 8] */
+- i = atomic_read(&cp->in_pkts);
++ i = atomic_read_unchecked(&cp->in_pkts);
+ if (i > 8 || i < 0) return 0;
+
+ if (!todrop_rate[i]) return 0;
+diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
+index b95699f..5fee919 100644
+--- a/net/netfilter/ipvs/ip_vs_core.c
++++ b/net/netfilter/ipvs/ip_vs_core.c
+@@ -485,7 +485,7 @@ int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,
+ ret = cp->packet_xmit(skb, cp, pp);
+ /* do not touch skb anymore */
+
+- atomic_inc(&cp->in_pkts);
++ atomic_inc_unchecked(&cp->in_pkts);
+ ip_vs_conn_put(cp);
+ return ret;
+ }
+@@ -1357,7 +1357,7 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb,
+ * Sync connection if it is about to close to
+ * encorage the standby servers to update the connections timeout
+ */
+- pkts = atomic_add_return(1, &cp->in_pkts);
++ pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
+ if (af == AF_INET &&
+ (ip_vs_sync_state & IP_VS_STATE_MASTER) &&
+ (((cp->protocol != IPPROTO_TCP ||
+diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
+index 02b2610..2d89424 100644
+--- a/net/netfilter/ipvs/ip_vs_ctl.c
++++ b/net/netfilter/ipvs/ip_vs_ctl.c
+@@ -792,7 +792,7 @@ __ip_vs_update_dest(struct ip_vs_service *svc,
+ ip_vs_rs_hash(dest);
+ write_unlock_bh(&__ip_vs_rs_lock);
+ }
+- atomic_set(&dest->conn_flags, conn_flags);
++ atomic_set_unchecked(&dest->conn_flags, conn_flags);
+
+ /* bind the service */
+ if (!dest->svc) {
+@@ -1888,7 +1888,7 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
+ " %-7s %-6d %-10d %-10d\n",
+ &dest->addr.in6,
+ ntohs(dest->port),
+- ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
++ ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
+ atomic_read(&dest->weight),
+ atomic_read(&dest->activeconns),
+ atomic_read(&dest->inactconns));
+@@ -1899,7 +1899,7 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
+ "%-7s %-6d %-10d %-10d\n",
+ ntohl(dest->addr.ip),
+ ntohs(dest->port),
+- ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
++ ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
+ atomic_read(&dest->weight),
+ atomic_read(&dest->activeconns),
+ atomic_read(&dest->inactconns));
+@@ -1927,7 +1927,7 @@ static const struct file_operations ip_vs_info_fops = {
+ .open = ip_vs_info_open,
+ .read = seq_read,
+ .llseek = seq_lseek,
+- .release = seq_release_private,
++ .release = seq_release_net,
+ };
+
+ #endif
+@@ -1976,7 +1976,7 @@ static const struct file_operations ip_vs_stats_fops = {
+ .open = ip_vs_stats_seq_open,
+ .read = seq_read,
+ .llseek = seq_lseek,
+- .release = single_release,
++ .release = single_release_net,
+ };
+
+ #endif
+@@ -2292,7 +2292,7 @@ __ip_vs_get_dest_entries(const struct ip_vs_get_dests *get,
+
+ entry.addr = dest->addr.ip;
+ entry.port = dest->port;
+- entry.conn_flags = atomic_read(&dest->conn_flags);
++ entry.conn_flags = atomic_read_unchecked(&dest->conn_flags);
+ entry.weight = atomic_read(&dest->weight);
+ entry.u_threshold = dest->u_threshold;
+ entry.l_threshold = dest->l_threshold;
+@@ -2353,6 +2353,8 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
+ unsigned char arg[128];
+ int ret = 0;
+
++ pax_track_stack();
++
+ if (!capable(CAP_NET_ADMIN))
+ return -EPERM;
+
+@@ -2802,7 +2804,7 @@ static int ip_vs_genl_fill_dest(struct sk_buff *skb, struct ip_vs_dest *dest)
+ NLA_PUT_U16(skb, IPVS_DEST_ATTR_PORT, dest->port);
+
+ NLA_PUT_U32(skb, IPVS_DEST_ATTR_FWD_METHOD,
+- atomic_read(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
++ atomic_read_unchecked(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
+ NLA_PUT_U32(skb, IPVS_DEST_ATTR_WEIGHT, atomic_read(&dest->weight));
+ NLA_PUT_U32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold);
+ NLA_PUT_U32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold);
+diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
+index e177f0d..55e8581 100644
+--- a/net/netfilter/ipvs/ip_vs_sync.c
++++ b/net/netfilter/ipvs/ip_vs_sync.c
+@@ -438,7 +438,7 @@ static void ip_vs_process_message(const char *buffer, const size_t buflen)
+
+ if (opt)
+ memcpy(&cp->in_seq, opt, sizeof(*opt));
+- atomic_set(&cp->in_pkts, sysctl_ip_vs_sync_threshold[0]);
++ atomic_set_unchecked(&cp->in_pkts, sysctl_ip_vs_sync_threshold[0]);
+ cp->state = state;
+ cp->old_state = cp->state;
+ /*
+diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
+index 30b3189..e2e4b55 100644
+--- a/net/netfilter/ipvs/ip_vs_xmit.c
++++ b/net/netfilter/ipvs/ip_vs_xmit.c
+@@ -875,7 +875,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
+ else
+ rc = NF_ACCEPT;
+ /* do not touch skb anymore */
+- atomic_inc(&cp->in_pkts);
++ atomic_inc_unchecked(&cp->in_pkts);
+ goto out;
+ }
+
+@@ -949,7 +949,7 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
+ else
+ rc = NF_ACCEPT;
+ /* do not touch skb anymore */
+- atomic_inc(&cp->in_pkts);
++ atomic_inc_unchecked(&cp->in_pkts);
+ goto out;
+ }
+
+diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
+index d521718..d0fd7a1 100644
+--- a/net/netfilter/nf_conntrack_netlink.c
++++ b/net/netfilter/nf_conntrack_netlink.c
+@@ -706,7 +706,7 @@ ctnetlink_parse_tuple_proto(struct nlattr *attr,
+ static int
+ ctnetlink_parse_tuple(const struct nlattr * const cda[],
+ struct nf_conntrack_tuple *tuple,
+- enum ctattr_tuple type, u_int8_t l3num)
++ enum ctattr_type type, u_int8_t l3num)
+ {
+ struct nlattr *tb[CTA_TUPLE_MAX+1];
+ int err;
+diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
+index f900dc3..5e45346 100644
+--- a/net/netfilter/nfnetlink_log.c
++++ b/net/netfilter/nfnetlink_log.c
+@@ -68,7 +68,7 @@ struct nfulnl_instance {
+ };
+
+ static DEFINE_RWLOCK(instances_lock);
+-static atomic_t global_seq;
++static atomic_unchecked_t global_seq;
+
+ #define INSTANCE_BUCKETS 16
+ static struct hlist_head instance_table[INSTANCE_BUCKETS];
+@@ -493,7 +493,7 @@ __build_packet_message(struct nfulnl_instance *inst,
+ /* global sequence number */
+ if (inst->flags & NFULNL_CFG_F_SEQ_GLOBAL)
+ NLA_PUT_BE32(inst->skb, NFULA_SEQ_GLOBAL,
+- htonl(atomic_inc_return(&global_seq)));
++ htonl(atomic_inc_return_unchecked(&global_seq)));
+
+ if (data_len) {
+ struct nlattr *nla;
+diff --git a/net/netfilter/xt_gradm.c b/net/netfilter/xt_gradm.c
+new file mode 100644
+index 0000000..b1bac76
+--- /dev/null
++++ b/net/netfilter/xt_gradm.c
+@@ -0,0 +1,51 @@
++/*
++ * gradm match for netfilter
++ * Copyright © Zbigniew Krzystolik, 2010
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License; either version
++ * 2 or 3 as published by the Free Software Foundation.
++ */
++#include <linux/module.h>
++#include <linux/moduleparam.h>
++#include <linux/skbuff.h>
++#include <linux/netfilter/x_tables.h>
++#include <linux/grsecurity.h>
++#include <linux/netfilter/xt_gradm.h>
++
++static bool
++gradm_mt(const struct sk_buff *skb, const struct xt_match_param *par)
++{
++ const struct xt_gradm_mtinfo *info = par->matchinfo;
++ bool retval = false;
++ if (gr_acl_is_enabled())
++ retval = true;
++ return retval ^ info->invflags;
++}
++
++static struct xt_match gradm_mt_reg __read_mostly = {
++ .name = "gradm",
++ .revision = 0,
++ .family = NFPROTO_UNSPEC,
++ .match = gradm_mt,
++ .matchsize = XT_ALIGN(sizeof(struct xt_gradm_mtinfo)),
++ .me = THIS_MODULE,
++};
++
++static int __init gradm_mt_init(void)
++{
++ return xt_register_match(&gradm_mt_reg);
++}
++
++static void __exit gradm_mt_exit(void)
++{
++ xt_unregister_match(&gradm_mt_reg);
++}
++
++module_init(gradm_mt_init);
++module_exit(gradm_mt_exit);
++MODULE_AUTHOR("Zbigniew Krzystolik <zbyniu@destrukcja.pl>");
++MODULE_DESCRIPTION("Xtables: Grsecurity RBAC match");
++MODULE_LICENSE("GPL");
++MODULE_ALIAS("ipt_gradm");
++MODULE_ALIAS("ip6t_gradm");
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index 5a7dcdf..24a3578 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -733,7 +733,7 @@ static void netlink_overrun(struct sock *sk)
+ sk->sk_error_report(sk);
+ }
+ }
+- atomic_inc(&sk->sk_drops);
++ atomic_inc_unchecked(&sk->sk_drops);
+ }
+
+ static struct sock *netlink_getsockbypid(struct sock *ssk, u32 pid)
+@@ -1964,15 +1964,23 @@ static int netlink_seq_show(struct seq_file *seq, void *v)
+ struct netlink_sock *nlk = nlk_sk(s);
+
+ seq_printf(seq, "%p %-3d %-6d %08x %-8d %-8d %p %-8d %-8d\n",
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ NULL,
++#else
+ s,
++#endif
+ s->sk_protocol,
+ nlk->pid,
+ nlk->groups ? (u32)nlk->groups[0] : 0,
+ sk_rmem_alloc_get(s),
+ sk_wmem_alloc_get(s),
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ NULL,
++#else
+ nlk->cb,
++#endif
+ atomic_read(&s->sk_refcnt),
+- atomic_read(&s->sk_drops)
++ atomic_read_unchecked(&s->sk_drops)
+ );
+
+ }
+diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
+index 7a83495..ab0062f 100644
+--- a/net/netrom/af_netrom.c
++++ b/net/netrom/af_netrom.c
+@@ -838,6 +838,7 @@ static int nr_getname(struct socket *sock, struct sockaddr *uaddr,
+ struct sock *sk = sock->sk;
+ struct nr_sock *nr = nr_sk(sk);
+
++ memset(sax, 0, sizeof(*sax));
+ lock_sock(sk);
+ if (peer != 0) {
+ if (sk->sk_state != TCP_ESTABLISHED) {
+@@ -852,7 +853,6 @@ static int nr_getname(struct socket *sock, struct sockaddr *uaddr,
+ *uaddr_len = sizeof(struct full_sockaddr_ax25);
+ } else {
+ sax->fsa_ax25.sax25_family = AF_NETROM;
+- sax->fsa_ax25.sax25_ndigis = 0;
+ sax->fsa_ax25.sax25_call = nr->source_addr;
+ *uaddr_len = sizeof(struct sockaddr_ax25);
+ }
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 35cfa79..4e78ff7 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2429,7 +2429,11 @@ static int packet_seq_show(struct seq_file *seq, void *v)
+
+ seq_printf(seq,
+ "%p %-6d %-4d %04x %-5d %1d %-6u %-6u %-6lu\n",
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ NULL,
++#else
+ s,
++#endif
+ atomic_read(&s->sk_refcnt),
+ s->sk_type,
+ ntohs(po->num),
+diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
+index 519ff9d..a422a90 100644
+--- a/net/phonet/af_phonet.c
++++ b/net/phonet/af_phonet.c
+@@ -41,7 +41,7 @@ static struct phonet_protocol *phonet_proto_get(int protocol)
+ {
+ struct phonet_protocol *pp;
+
+- if (protocol >= PHONET_NPROTO)
++ if (protocol < 0 || protocol >= PHONET_NPROTO)
+ return NULL;
+
+ spin_lock(&proto_tab_lock);
+@@ -402,7 +402,7 @@ int __init_or_module phonet_proto_register(int protocol,
+ {
+ int err = 0;
+
+- if (protocol >= PHONET_NPROTO)
++ if (protocol < 0 || protocol >= PHONET_NPROTO)
+ return -EINVAL;
+
+ err = proto_register(pp->prot, 1);
+diff --git a/net/phonet/datagram.c b/net/phonet/datagram.c
+index ef5c75c..2b6c2fa 100644
+--- a/net/phonet/datagram.c
++++ b/net/phonet/datagram.c
+@@ -162,7 +162,7 @@ static int pn_backlog_rcv(struct sock *sk, struct sk_buff *skb)
+ if (err < 0) {
+ kfree_skb(skb);
+ if (err == -ENOMEM)
+- atomic_inc(&sk->sk_drops);
++ atomic_inc_unchecked(&sk->sk_drops);
+ }
+ return err ? NET_RX_DROP : NET_RX_SUCCESS;
+ }
+diff --git a/net/phonet/pep.c b/net/phonet/pep.c
+index 9cdd35e..16cd850 100644
+--- a/net/phonet/pep.c
++++ b/net/phonet/pep.c
+@@ -348,7 +348,7 @@ static int pipe_do_rcv(struct sock *sk, struct sk_buff *skb)
+
+ case PNS_PEP_CTRL_REQ:
+ if (skb_queue_len(&pn->ctrlreq_queue) >= PNPIPE_CTRLREQ_MAX) {
+- atomic_inc(&sk->sk_drops);
++ atomic_inc_unchecked(&sk->sk_drops);
+ break;
+ }
+ __skb_pull(skb, 4);
+@@ -362,12 +362,12 @@ static int pipe_do_rcv(struct sock *sk, struct sk_buff *skb)
+ if (!err)
+ return 0;
+ if (err == -ENOMEM)
+- atomic_inc(&sk->sk_drops);
++ atomic_inc_unchecked(&sk->sk_drops);
+ break;
+ }
+
+ if (pn->rx_credits == 0) {
+- atomic_inc(&sk->sk_drops);
++ atomic_inc_unchecked(&sk->sk_drops);
+ err = -ENOBUFS;
+ break;
+ }
+diff --git a/net/phonet/socket.c b/net/phonet/socket.c
+index aa5b5a9..c09b4f8 100644
+--- a/net/phonet/socket.c
++++ b/net/phonet/socket.c
+@@ -482,8 +482,13 @@ static int pn_sock_seq_show(struct seq_file *seq, void *v)
+ sk->sk_state,
+ sk_wmem_alloc_get(sk), sk_rmem_alloc_get(sk),
+ sock_i_uid(sk), sock_i_ino(sk),
+- atomic_read(&sk->sk_refcnt), sk,
+- atomic_read(&sk->sk_drops), &len);
++ atomic_read(&sk->sk_refcnt),
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ NULL,
++#else
++ sk,
++#endif
++ atomic_read_unchecked(&sk->sk_drops), &len);
+ }
+ seq_printf(seq, "%*s\n", 127 - len, "");
+ return 0;
+diff --git a/net/rds/Kconfig b/net/rds/Kconfig
+index ec753b3..821187c 100644
+--- a/net/rds/Kconfig
++++ b/net/rds/Kconfig
+@@ -1,7 +1,7 @@
+
+ config RDS
+ tristate "The RDS Protocol (EXPERIMENTAL)"
+- depends on INET && EXPERIMENTAL
++ depends on INET && EXPERIMENTAL && BROKEN
+ ---help---
+ The RDS (Reliable Datagram Sockets) protocol provides reliable,
+ sequenced delivery of datagrams over Infiniband, iWARP,
+diff --git a/net/rds/cong.c b/net/rds/cong.c
+index dd2711d..1c7ed12 100644
+--- a/net/rds/cong.c
++++ b/net/rds/cong.c
+@@ -77,7 +77,7 @@
+ * finds that the saved generation number is smaller than the global generation
+ * number, it wakes up the process.
+ */
+-static atomic_t rds_cong_generation = ATOMIC_INIT(0);
++static atomic_unchecked_t rds_cong_generation = ATOMIC_INIT(0);
+
+ /*
+ * Congestion monitoring
+@@ -232,7 +232,7 @@ void rds_cong_map_updated(struct rds_cong_map *map, uint64_t portmask)
+ rdsdebug("waking map %p for %pI4\n",
+ map, &map->m_addr);
+ rds_stats_inc(s_cong_update_received);
+- atomic_inc(&rds_cong_generation);
++ atomic_inc_unchecked(&rds_cong_generation);
+ if (waitqueue_active(&map->m_waitq))
+ wake_up(&map->m_waitq);
+ if (waitqueue_active(&rds_poll_waitq))
+@@ -258,7 +258,7 @@ EXPORT_SYMBOL_GPL(rds_cong_map_updated);
+
+ int rds_cong_updated_since(unsigned long *recent)
+ {
+- unsigned long gen = atomic_read(&rds_cong_generation);
++ unsigned long gen = atomic_read_unchecked(&rds_cong_generation);
+
+ if (likely(*recent == gen))
+ return 0;
+diff --git a/net/rds/iw_rdma.c b/net/rds/iw_rdma.c
+index de4a1b1..94ec861 100644
+--- a/net/rds/iw_rdma.c
++++ b/net/rds/iw_rdma.c
+@@ -181,6 +181,8 @@ int rds_iw_update_cm_id(struct rds_iw_device *rds_iwdev, struct rdma_cm_id *cm_i
+ struct rdma_cm_id *pcm_id;
+ int rc;
+
++ pax_track_stack();
++
+ src_addr = (struct sockaddr_in *)&cm_id->route.addr.src_addr;
+ dst_addr = (struct sockaddr_in *)&cm_id->route.addr.dst_addr;
+
+diff --git a/net/rds/tcp.c b/net/rds/tcp.c
+index b5198ae..8b9fb90 100644
+--- a/net/rds/tcp.c
++++ b/net/rds/tcp.c
+@@ -57,7 +57,7 @@ void rds_tcp_nonagle(struct socket *sock)
+ int val = 1;
+
+ set_fs(KERNEL_DS);
+- sock->ops->setsockopt(sock, SOL_TCP, TCP_NODELAY, (char __user *)&val,
++ sock->ops->setsockopt(sock, SOL_TCP, TCP_NODELAY, (char __force_user *)&val,
+ sizeof(val));
+ set_fs(oldfs);
+ }
+diff --git a/net/rds/tcp_send.c b/net/rds/tcp_send.c
+index ab545e0..4079b3b 100644
+--- a/net/rds/tcp_send.c
++++ b/net/rds/tcp_send.c
+@@ -43,7 +43,7 @@ static void rds_tcp_cork(struct socket *sock, int val)
+
+ oldfs = get_fs();
+ set_fs(KERNEL_DS);
+- sock->ops->setsockopt(sock, SOL_TCP, TCP_CORK, (char __user *)&val,
++ sock->ops->setsockopt(sock, SOL_TCP, TCP_CORK, (char __force_user *)&val,
+ sizeof(val));
+ set_fs(oldfs);
+ }
+diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
+index a86afce..8657bce 100644
+--- a/net/rxrpc/af_rxrpc.c
++++ b/net/rxrpc/af_rxrpc.c
+@@ -38,7 +38,7 @@ static const struct proto_ops rxrpc_rpc_ops;
+ __be32 rxrpc_epoch;
+
+ /* current debugging ID */
+-atomic_t rxrpc_debug_id;
++atomic_unchecked_t rxrpc_debug_id;
+
+ /* count of skbs currently in use */
+ atomic_t rxrpc_n_skbs;
+diff --git a/net/rxrpc/ar-ack.c b/net/rxrpc/ar-ack.c
+index b4a2209..539106c 100644
+--- a/net/rxrpc/ar-ack.c
++++ b/net/rxrpc/ar-ack.c
+@@ -174,7 +174,7 @@ static void rxrpc_resend(struct rxrpc_call *call)
+
+ _enter("{%d,%d,%d,%d},",
+ call->acks_hard, call->acks_unacked,
+- atomic_read(&call->sequence),
++ atomic_read_unchecked(&call->sequence),
+ CIRC_CNT(call->acks_head, call->acks_tail, call->acks_winsz));
+
+ stop = 0;
+@@ -198,7 +198,7 @@ static void rxrpc_resend(struct rxrpc_call *call)
+
+ /* each Tx packet has a new serial number */
+ sp->hdr.serial =
+- htonl(atomic_inc_return(&call->conn->serial));
++ htonl(atomic_inc_return_unchecked(&call->conn->serial));
+
+ hdr = (struct rxrpc_header *) txb->head;
+ hdr->serial = sp->hdr.serial;
+@@ -401,7 +401,7 @@ static void rxrpc_rotate_tx_window(struct rxrpc_call *call, u32 hard)
+ */
+ static void rxrpc_clear_tx_window(struct rxrpc_call *call)
+ {
+- rxrpc_rotate_tx_window(call, atomic_read(&call->sequence));
++ rxrpc_rotate_tx_window(call, atomic_read_unchecked(&call->sequence));
+ }
+
+ /*
+@@ -627,7 +627,7 @@ process_further:
+
+ latest = ntohl(sp->hdr.serial);
+ hard = ntohl(ack.firstPacket);
+- tx = atomic_read(&call->sequence);
++ tx = atomic_read_unchecked(&call->sequence);
+
+ _proto("Rx ACK %%%u { m=%hu f=#%u p=#%u s=%%%u r=%s n=%u }",
+ latest,
+@@ -840,6 +840,8 @@ void rxrpc_process_call(struct work_struct *work)
+ u32 abort_code = RX_PROTOCOL_ERROR;
+ u8 *acks = NULL;
+
++ pax_track_stack();
++
+ //printk("\n--------------------\n");
+ _enter("{%d,%s,%lx} [%lu]",
+ call->debug_id, rxrpc_call_states[call->state], call->events,
+@@ -1159,7 +1161,7 @@ void rxrpc_process_call(struct work_struct *work)
+ goto maybe_reschedule;
+
+ send_ACK_with_skew:
+- ack.maxSkew = htons(atomic_read(&call->conn->hi_serial) -
++ ack.maxSkew = htons(atomic_read_unchecked(&call->conn->hi_serial) -
+ ntohl(ack.serial));
+ send_ACK:
+ mtu = call->conn->trans->peer->if_mtu;
+@@ -1171,7 +1173,7 @@ send_ACK:
+ ackinfo.rxMTU = htonl(5692);
+ ackinfo.jumbo_max = htonl(4);
+
+- hdr.serial = htonl(atomic_inc_return(&call->conn->serial));
++ hdr.serial = htonl(atomic_inc_return_unchecked(&call->conn->serial));
+ _proto("Tx ACK %%%u { m=%hu f=#%u p=#%u s=%%%u r=%s n=%u }",
+ ntohl(hdr.serial),
+ ntohs(ack.maxSkew),
+@@ -1189,7 +1191,7 @@ send_ACK:
+ send_message:
+ _debug("send message");
+
+- hdr.serial = htonl(atomic_inc_return(&call->conn->serial));
++ hdr.serial = htonl(atomic_inc_return_unchecked(&call->conn->serial));
+ _proto("Tx %s %%%u", rxrpc_pkts[hdr.type], ntohl(hdr.serial));
+ send_message_2:
+
+diff --git a/net/rxrpc/ar-call.c b/net/rxrpc/ar-call.c
+index bc0019f..e1b4b24 100644
+--- a/net/rxrpc/ar-call.c
++++ b/net/rxrpc/ar-call.c
+@@ -82,7 +82,7 @@ static struct rxrpc_call *rxrpc_alloc_call(gfp_t gfp)
+ spin_lock_init(&call->lock);
+ rwlock_init(&call->state_lock);
+ atomic_set(&call->usage, 1);
+- call->debug_id = atomic_inc_return(&rxrpc_debug_id);
++ call->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
+ call->state = RXRPC_CALL_CLIENT_SEND_REQUEST;
+
+ memset(&call->sock_node, 0xed, sizeof(call->sock_node));
+diff --git a/net/rxrpc/ar-connection.c b/net/rxrpc/ar-connection.c
+index 9f1ce84..ff8d061 100644
+--- a/net/rxrpc/ar-connection.c
++++ b/net/rxrpc/ar-connection.c
+@@ -205,7 +205,7 @@ static struct rxrpc_connection *rxrpc_alloc_connection(gfp_t gfp)
+ rwlock_init(&conn->lock);
+ spin_lock_init(&conn->state_lock);
+ atomic_set(&conn->usage, 1);
+- conn->debug_id = atomic_inc_return(&rxrpc_debug_id);
++ conn->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
+ conn->avail_calls = RXRPC_MAXCALLS;
+ conn->size_align = 4;
+ conn->header_size = sizeof(struct rxrpc_header);
+diff --git a/net/rxrpc/ar-connevent.c b/net/rxrpc/ar-connevent.c
+index 0505cdc..f0748ce 100644
+--- a/net/rxrpc/ar-connevent.c
++++ b/net/rxrpc/ar-connevent.c
+@@ -109,7 +109,7 @@ static int rxrpc_abort_connection(struct rxrpc_connection *conn,
+
+ len = iov[0].iov_len + iov[1].iov_len;
+
+- hdr.serial = htonl(atomic_inc_return(&conn->serial));
++ hdr.serial = htonl(atomic_inc_return_unchecked(&conn->serial));
+ _proto("Tx CONN ABORT %%%u { %d }", ntohl(hdr.serial), abort_code);
+
+ ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 2, len);
+diff --git a/net/rxrpc/ar-input.c b/net/rxrpc/ar-input.c
+index f98c802..9e8488e 100644
+--- a/net/rxrpc/ar-input.c
++++ b/net/rxrpc/ar-input.c
+@@ -339,9 +339,9 @@ void rxrpc_fast_process_packet(struct rxrpc_call *call, struct sk_buff *skb)
+ /* track the latest serial number on this connection for ACK packet
+ * information */
+ serial = ntohl(sp->hdr.serial);
+- hi_serial = atomic_read(&call->conn->hi_serial);
++ hi_serial = atomic_read_unchecked(&call->conn->hi_serial);
+ while (serial > hi_serial)
+- hi_serial = atomic_cmpxchg(&call->conn->hi_serial, hi_serial,
++ hi_serial = atomic_cmpxchg_unchecked(&call->conn->hi_serial, hi_serial,
+ serial);
+
+ /* request ACK generation for any ACK or DATA packet that requests
+diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
+index 7043b29..06edcdf 100644
+--- a/net/rxrpc/ar-internal.h
++++ b/net/rxrpc/ar-internal.h
+@@ -272,8 +272,8 @@ struct rxrpc_connection {
+ int error; /* error code for local abort */
+ int debug_id; /* debug ID for printks */
+ unsigned call_counter; /* call ID counter */
+- atomic_t serial; /* packet serial number counter */
+- atomic_t hi_serial; /* highest serial number received */
++ atomic_unchecked_t serial; /* packet serial number counter */
++ atomic_unchecked_t hi_serial; /* highest serial number received */
+ u8 avail_calls; /* number of calls available */
+ u8 size_align; /* data size alignment (for security) */
+ u8 header_size; /* rxrpc + security header size */
+@@ -346,7 +346,7 @@ struct rxrpc_call {
+ spinlock_t lock;
+ rwlock_t state_lock; /* lock for state transition */
+ atomic_t usage;
+- atomic_t sequence; /* Tx data packet sequence counter */
++ atomic_unchecked_t sequence; /* Tx data packet sequence counter */
+ u32 abort_code; /* local/remote abort code */
+ enum { /* current state of call */
+ RXRPC_CALL_CLIENT_SEND_REQUEST, /* - client sending request phase */
+@@ -420,7 +420,7 @@ static inline void rxrpc_abort_call(struct rxrpc_call *call, u32 abort_code)
+ */
+ extern atomic_t rxrpc_n_skbs;
+ extern __be32 rxrpc_epoch;
+-extern atomic_t rxrpc_debug_id;
++extern atomic_unchecked_t rxrpc_debug_id;
+ extern struct workqueue_struct *rxrpc_workqueue;
+
+ /*
+diff --git a/net/rxrpc/ar-key.c b/net/rxrpc/ar-key.c
+index 74697b2..10f9b77 100644
+--- a/net/rxrpc/ar-key.c
++++ b/net/rxrpc/ar-key.c
+@@ -88,11 +88,11 @@ static int rxrpc_instantiate_xdr_rxkad(struct key *key, const __be32 *xdr,
+ return ret;
+
+ plen -= sizeof(*token);
+- token = kmalloc(sizeof(*token), GFP_KERNEL);
++ token = kzalloc(sizeof(*token), GFP_KERNEL);
+ if (!token)
+ return -ENOMEM;
+
+- token->kad = kmalloc(plen, GFP_KERNEL);
++ token->kad = kzalloc(plen, GFP_KERNEL);
+ if (!token->kad) {
+ kfree(token);
+ return -ENOMEM;
+@@ -730,10 +730,10 @@ static int rxrpc_instantiate(struct key *key, const void *data, size_t datalen)
+ goto error;
+
+ ret = -ENOMEM;
+- token = kmalloc(sizeof(*token), GFP_KERNEL);
++ token = kzalloc(sizeof(*token), GFP_KERNEL);
+ if (!token)
+ goto error;
+- token->kad = kmalloc(plen, GFP_KERNEL);
++ token->kad = kzalloc(plen, GFP_KERNEL);
+ if (!token->kad)
+ goto error_free;
+
+diff --git a/net/rxrpc/ar-local.c b/net/rxrpc/ar-local.c
+index 807535f..5b7f19e 100644
+--- a/net/rxrpc/ar-local.c
++++ b/net/rxrpc/ar-local.c
+@@ -44,7 +44,7 @@ struct rxrpc_local *rxrpc_alloc_local(struct sockaddr_rxrpc *srx)
+ spin_lock_init(&local->lock);
+ rwlock_init(&local->services_lock);
+ atomic_set(&local->usage, 1);
+- local->debug_id = atomic_inc_return(&rxrpc_debug_id);
++ local->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
+ memcpy(&local->srx, srx, sizeof(*srx));
+ }
+
+diff --git a/net/rxrpc/ar-output.c b/net/rxrpc/ar-output.c
+index cc9102c..7d3888e 100644
+--- a/net/rxrpc/ar-output.c
++++ b/net/rxrpc/ar-output.c
+@@ -680,9 +680,9 @@ static int rxrpc_send_data(struct kiocb *iocb,
+ sp->hdr.cid = call->cid;
+ sp->hdr.callNumber = call->call_id;
+ sp->hdr.seq =
+- htonl(atomic_inc_return(&call->sequence));
++ htonl(atomic_inc_return_unchecked(&call->sequence));
+ sp->hdr.serial =
+- htonl(atomic_inc_return(&conn->serial));
++ htonl(atomic_inc_return_unchecked(&conn->serial));
+ sp->hdr.type = RXRPC_PACKET_TYPE_DATA;
+ sp->hdr.userStatus = 0;
+ sp->hdr.securityIndex = conn->security_ix;
+diff --git a/net/rxrpc/ar-peer.c b/net/rxrpc/ar-peer.c
+index edc026c..4bd4e2d 100644
+--- a/net/rxrpc/ar-peer.c
++++ b/net/rxrpc/ar-peer.c
+@@ -86,7 +86,7 @@ static struct rxrpc_peer *rxrpc_alloc_peer(struct sockaddr_rxrpc *srx,
+ INIT_LIST_HEAD(&peer->error_targets);
+ spin_lock_init(&peer->lock);
+ atomic_set(&peer->usage, 1);
+- peer->debug_id = atomic_inc_return(&rxrpc_debug_id);
++ peer->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
+ memcpy(&peer->srx, srx, sizeof(*srx));
+
+ rxrpc_assess_MTU_size(peer);
+diff --git a/net/rxrpc/ar-proc.c b/net/rxrpc/ar-proc.c
+index 38047f7..9f48511 100644
+--- a/net/rxrpc/ar-proc.c
++++ b/net/rxrpc/ar-proc.c
+@@ -164,8 +164,8 @@ static int rxrpc_connection_seq_show(struct seq_file *seq, void *v)
+ atomic_read(&conn->usage),
+ rxrpc_conn_states[conn->state],
+ key_serial(conn->key),
+- atomic_read(&conn->serial),
+- atomic_read(&conn->hi_serial));
++ atomic_read_unchecked(&conn->serial),
++ atomic_read_unchecked(&conn->hi_serial));
+
+ return 0;
+ }
+diff --git a/net/rxrpc/ar-transport.c b/net/rxrpc/ar-transport.c
+index 0936e1a..437c640 100644
+--- a/net/rxrpc/ar-transport.c
++++ b/net/rxrpc/ar-transport.c
+@@ -46,7 +46,7 @@ static struct rxrpc_transport *rxrpc_alloc_transport(struct rxrpc_local *local,
+ spin_lock_init(&trans->client_lock);
+ rwlock_init(&trans->conn_lock);
+ atomic_set(&trans->usage, 1);
+- trans->debug_id = atomic_inc_return(&rxrpc_debug_id);
++ trans->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
+
+ if (peer->srx.transport.family == AF_INET) {
+ switch (peer->srx.transport_type) {
+diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c
+index 713ac59..306f6ae 100644
+--- a/net/rxrpc/rxkad.c
++++ b/net/rxrpc/rxkad.c
+@@ -210,6 +210,8 @@ static int rxkad_secure_packet_encrypt(const struct rxrpc_call *call,
+ u16 check;
+ int nsg;
+
++ pax_track_stack();
++
+ sp = rxrpc_skb(skb);
+
+ _enter("");
+@@ -337,6 +339,8 @@ static int rxkad_verify_packet_auth(const struct rxrpc_call *call,
+ u16 check;
+ int nsg;
+
++ pax_track_stack();
++
+ _enter("");
+
+ sp = rxrpc_skb(skb);
+@@ -609,7 +613,7 @@ static int rxkad_issue_challenge(struct rxrpc_connection *conn)
+
+ len = iov[0].iov_len + iov[1].iov_len;
+
+- hdr.serial = htonl(atomic_inc_return(&conn->serial));
++ hdr.serial = htonl(atomic_inc_return_unchecked(&conn->serial));
+ _proto("Tx CHALLENGE %%%u", ntohl(hdr.serial));
+
+ ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 2, len);
+@@ -659,7 +663,7 @@ static int rxkad_send_response(struct rxrpc_connection *conn,
+
+ len = iov[0].iov_len + iov[1].iov_len + iov[2].iov_len;
+
+- hdr->serial = htonl(atomic_inc_return(&conn->serial));
++ hdr->serial = htonl(atomic_inc_return_unchecked(&conn->serial));
+ _proto("Tx RESPONSE %%%u", ntohl(hdr->serial));
+
+ ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 3, len);
+diff --git a/net/sctp/auth.c b/net/sctp/auth.c
+index 914c419..7a16d2c 100644
+--- a/net/sctp/auth.c
++++ b/net/sctp/auth.c
+@@ -81,7 +81,7 @@ static struct sctp_auth_bytes *sctp_auth_create_key(__u32 key_len, gfp_t gfp)
+ struct sctp_auth_bytes *key;
+
+ /* Verify that we are not going to overflow INT_MAX */
+- if ((INT_MAX - key_len) < sizeof(struct sctp_auth_bytes))
++ if (key_len > (INT_MAX - sizeof(struct sctp_auth_bytes)))
+ return NULL;
+
+ /* Allocate the shared key */
+diff --git a/net/sctp/proc.c b/net/sctp/proc.c
+index d093cbf..9fc36fc 100644
+--- a/net/sctp/proc.c
++++ b/net/sctp/proc.c
+@@ -213,7 +213,12 @@ static int sctp_eps_seq_show(struct seq_file *seq, void *v)
+ sctp_for_each_hentry(epb, node, &head->chain) {
+ ep = sctp_ep(epb);
+ sk = epb->sk;
+- seq_printf(seq, "%8p %8p %-3d %-3d %-4d %-5d %5d %5lu ", ep, sk,
++ seq_printf(seq, "%8p %8p %-3d %-3d %-4d %-5d %5d %5lu ",
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ NULL, NULL,
++#else
++ ep, sk,
++#endif
+ sctp_sk(sk)->type, sk->sk_state, hash,
+ epb->bind_addr.port,
+ sock_i_uid(sk), sock_i_ino(sk));
+@@ -320,7 +325,12 @@ static int sctp_assocs_seq_show(struct seq_file *seq, void *v)
+ seq_printf(seq,
+ "%8p %8p %-3d %-3d %-2d %-4d "
+ "%4d %8d %8d %7d %5lu %-5d %5d ",
+- assoc, sk, sctp_sk(sk)->type, sk->sk_state,
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ NULL, NULL,
++#else
++ assoc, sk,
++#endif
++ sctp_sk(sk)->type, sk->sk_state,
+ assoc->state, hash,
+ assoc->assoc_id,
+ assoc->sndbuf_used,
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 3a95fcb..c40fc1d 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -5802,7 +5802,6 @@ pp_found:
+ */
+ int reuse = sk->sk_reuse;
+ struct sock *sk2;
+- struct hlist_node *node;
+
+ SCTP_DEBUG_PRINTK("sctp_get_port() found a possible match\n");
+ if (pp->fastreuse && sk->sk_reuse &&
+diff --git a/net/socket.c b/net/socket.c
+index d449812..4ac08d3c 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -87,6 +87,7 @@
+ #include <linux/wireless.h>
+ #include <linux/nsproxy.h>
+ #include <linux/magic.h>
++#include <linux/in.h>
+
+ #include <asm/uaccess.h>
+ #include <asm/unistd.h>
+@@ -97,6 +98,21 @@
+ #include <net/sock.h>
+ #include <linux/netfilter.h>
+
++extern void gr_attach_curr_ip(const struct sock *sk);
++extern int gr_handle_sock_all(const int family, const int type,
++ const int protocol);
++extern int gr_handle_sock_server(const struct sockaddr *sck);
++extern int gr_handle_sock_server_other(const struct sock *sck);
++extern int gr_handle_sock_client(const struct sockaddr *sck);
++extern int gr_search_connect(struct socket * sock,
++ struct sockaddr_in * addr);
++extern int gr_search_bind(struct socket * sock,
++ struct sockaddr_in * addr);
++extern int gr_search_listen(struct socket * sock);
++extern int gr_search_accept(struct socket * sock);
++extern int gr_search_socket(const int domain, const int type,
++ const int protocol);
++
+ static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
+ static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
+ unsigned long nr_segs, loff_t pos);
+@@ -298,7 +314,7 @@ static int sockfs_get_sb(struct file_system_type *fs_type,
+ mnt);
+ }
+
+-static struct vfsmount *sock_mnt __read_mostly;
++struct vfsmount *sock_mnt __read_mostly;
+
+ static struct file_system_type sock_fs_type = {
+ .name = "sockfs",
+@@ -1154,6 +1170,8 @@ static int __sock_create(struct net *net, int family, int type, int protocol,
+ return -EAFNOSUPPORT;
+ if (type < 0 || type >= SOCK_MAX)
+ return -EINVAL;
++ if (protocol < 0)
++ return -EINVAL;
+
+ /* Compatibility.
+
+@@ -1283,6 +1301,16 @@ SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
+ if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
+ flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
+
++ if(!gr_search_socket(family, type, protocol)) {
++ retval = -EACCES;
++ goto out;
++ }
++
++ if (gr_handle_sock_all(family, type, protocol)) {
++ retval = -EACCES;
++ goto out;
++ }
++
+ retval = sock_create(family, type, protocol, &sock);
+ if (retval < 0)
+ goto out;
+@@ -1415,6 +1443,14 @@ SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
+ if (sock) {
+ err = move_addr_to_kernel(umyaddr, addrlen, (struct sockaddr *)&address);
+ if (err >= 0) {
++ if (gr_handle_sock_server((struct sockaddr *)&address)) {
++ err = -EACCES;
++ goto error;
++ }
++ err = gr_search_bind(sock, (struct sockaddr_in *)&address);
++ if (err)
++ goto error;
++
+ err = security_socket_bind(sock,
+ (struct sockaddr *)&address,
+ addrlen);
+@@ -1423,6 +1459,7 @@ SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
+ (struct sockaddr *)
+ &address, addrlen);
+ }
++error:
+ fput_light(sock->file, fput_needed);
+ }
+ return err;
+@@ -1446,10 +1483,20 @@ SYSCALL_DEFINE2(listen, int, fd, int, backlog)
+ if ((unsigned)backlog > somaxconn)
+ backlog = somaxconn;
+
++ if (gr_handle_sock_server_other(sock->sk)) {
++ err = -EPERM;
++ goto error;
++ }
++
++ err = gr_search_listen(sock);
++ if (err)
++ goto error;
++
+ err = security_socket_listen(sock, backlog);
+ if (!err)
+ err = sock->ops->listen(sock, backlog);
+
++error:
+ fput_light(sock->file, fput_needed);
+ }
+ return err;
+@@ -1492,6 +1539,18 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
+ newsock->type = sock->type;
+ newsock->ops = sock->ops;
+
++ if (gr_handle_sock_server_other(sock->sk)) {
++ err = -EPERM;
++ sock_release(newsock);
++ goto out_put;
++ }
++
++ err = gr_search_accept(sock);
++ if (err) {
++ sock_release(newsock);
++ goto out_put;
++ }
++
+ /*
+ * We don't need try_module_get here, as the listening socket (sock)
+ * has the protocol module (sock->ops->owner) held.
+@@ -1534,6 +1593,8 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
+ fd_install(newfd, newfile);
+ err = newfd;
+
++ gr_attach_curr_ip(newsock->sk);
++
+ out_put:
+ fput_light(sock->file, fput_needed);
+ out:
+@@ -1571,6 +1632,7 @@ SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
+ int, addrlen)
+ {
+ struct socket *sock;
++ struct sockaddr *sck;
+ struct sockaddr_storage address;
+ int err, fput_needed;
+
+@@ -1581,6 +1643,17 @@ SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
+ if (err < 0)
+ goto out_put;
+
++ sck = (struct sockaddr *)&address;
++
++ if (gr_handle_sock_client(sck)) {
++ err = -EACCES;
++ goto out_put;
++ }
++
++ err = gr_search_connect(sock, (struct sockaddr_in *)sck);
++ if (err)
++ goto out_put;
++
+ err =
+ security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
+ if (err)
+@@ -1882,6 +1955,8 @@ SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned, flags)
+ int err, ctl_len, iov_size, total_len;
+ int fput_needed;
+
++ pax_track_stack();
++
+ err = -EFAULT;
+ if (MSG_CMSG_COMPAT & flags) {
+ if (get_compat_msghdr(&msg_sys, msg_compat))
+@@ -2022,7 +2097,7 @@ SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
+ * kernel msghdr to use the kernel address space)
+ */
+
+- uaddr = (__force void __user *)msg_sys.msg_name;
++ uaddr = (void __force_user *)msg_sys.msg_name;
+ uaddr_len = COMPAT_NAMELEN(msg);
+ if (MSG_CMSG_COMPAT & flags) {
+ err = verify_compat_iovec(&msg_sys, iov,
+diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
+index ac94477..8afe5c3 100644
+--- a/net/sunrpc/sched.c
++++ b/net/sunrpc/sched.c
+@@ -234,10 +234,10 @@ static int rpc_wait_bit_killable(void *word)
+ #ifdef RPC_DEBUG
+ static void rpc_task_set_debuginfo(struct rpc_task *task)
+ {
+- static atomic_t rpc_pid;
++ static atomic_unchecked_t rpc_pid;
+
+ task->tk_magic = RPC_TASK_MAGIC_ID;
+- task->tk_pid = atomic_inc_return(&rpc_pid);
++ task->tk_pid = atomic_inc_return_unchecked(&rpc_pid);
+ }
+ #else
+ static inline void rpc_task_set_debuginfo(struct rpc_task *task)
+diff --git a/net/sunrpc/xprtrdma/svc_rdma.c b/net/sunrpc/xprtrdma/svc_rdma.c
+index 35fb68b..236a8bf 100644
+--- a/net/sunrpc/xprtrdma/svc_rdma.c
++++ b/net/sunrpc/xprtrdma/svc_rdma.c
+@@ -59,15 +59,15 @@ unsigned int svcrdma_max_req_size = RPCRDMA_MAX_REQ_SIZE;
+ static unsigned int min_max_inline = 4096;
+ static unsigned int max_max_inline = 65536;
+
+-atomic_t rdma_stat_recv;
+-atomic_t rdma_stat_read;
+-atomic_t rdma_stat_write;
+-atomic_t rdma_stat_sq_starve;
+-atomic_t rdma_stat_rq_starve;
+-atomic_t rdma_stat_rq_poll;
+-atomic_t rdma_stat_rq_prod;
+-atomic_t rdma_stat_sq_poll;
+-atomic_t rdma_stat_sq_prod;
++atomic_unchecked_t rdma_stat_recv;
++atomic_unchecked_t rdma_stat_read;
++atomic_unchecked_t rdma_stat_write;
++atomic_unchecked_t rdma_stat_sq_starve;
++atomic_unchecked_t rdma_stat_rq_starve;
++atomic_unchecked_t rdma_stat_rq_poll;
++atomic_unchecked_t rdma_stat_rq_prod;
++atomic_unchecked_t rdma_stat_sq_poll;
++atomic_unchecked_t rdma_stat_sq_prod;
+
+ /* Temporary NFS request map and context caches */
+ struct kmem_cache *svc_rdma_map_cachep;
+@@ -105,7 +105,7 @@ static int read_reset_stat(ctl_table *table, int write,
+ len -= *ppos;
+ if (len > *lenp)
+ len = *lenp;
+- if (len && copy_to_user(buffer, str_buf, len))
++ if (len > sizeof str_buf || (len && copy_to_user(buffer, str_buf, len)))
+ return -EFAULT;
+ *lenp = len;
+ *ppos += len;
+@@ -149,63 +149,63 @@ static ctl_table svcrdma_parm_table[] = {
+ {
+ .procname = "rdma_stat_read",
+ .data = &rdma_stat_read,
+- .maxlen = sizeof(atomic_t),
++ .maxlen = sizeof(atomic_unchecked_t),
+ .mode = 0644,
+ .proc_handler = &read_reset_stat,
+ },
+ {
+ .procname = "rdma_stat_recv",
+ .data = &rdma_stat_recv,
+- .maxlen = sizeof(atomic_t),
++ .maxlen = sizeof(atomic_unchecked_t),
+ .mode = 0644,
+ .proc_handler = &read_reset_stat,
+ },
+ {
+ .procname = "rdma_stat_write",
+ .data = &rdma_stat_write,
+- .maxlen = sizeof(atomic_t),
++ .maxlen = sizeof(atomic_unchecked_t),
+ .mode = 0644,
+ .proc_handler = &read_reset_stat,
+ },
+ {
+ .procname = "rdma_stat_sq_starve",
+ .data = &rdma_stat_sq_starve,
+- .maxlen = sizeof(atomic_t),
++ .maxlen = sizeof(atomic_unchecked_t),
+ .mode = 0644,
+ .proc_handler = &read_reset_stat,
+ },
+ {
+ .procname = "rdma_stat_rq_starve",
+ .data = &rdma_stat_rq_starve,
+- .maxlen = sizeof(atomic_t),
++ .maxlen = sizeof(atomic_unchecked_t),
+ .mode = 0644,
+ .proc_handler = &read_reset_stat,
+ },
+ {
+ .procname = "rdma_stat_rq_poll",
+ .data = &rdma_stat_rq_poll,
+- .maxlen = sizeof(atomic_t),
++ .maxlen = sizeof(atomic_unchecked_t),
+ .mode = 0644,
+ .proc_handler = &read_reset_stat,
+ },
+ {
+ .procname = "rdma_stat_rq_prod",
+ .data = &rdma_stat_rq_prod,
+- .maxlen = sizeof(atomic_t),
++ .maxlen = sizeof(atomic_unchecked_t),
+ .mode = 0644,
+ .proc_handler = &read_reset_stat,
+ },
+ {
+ .procname = "rdma_stat_sq_poll",
+ .data = &rdma_stat_sq_poll,
+- .maxlen = sizeof(atomic_t),
++ .maxlen = sizeof(atomic_unchecked_t),
+ .mode = 0644,
+ .proc_handler = &read_reset_stat,
+ },
+ {
+ .procname = "rdma_stat_sq_prod",
+ .data = &rdma_stat_sq_prod,
+- .maxlen = sizeof(atomic_t),
++ .maxlen = sizeof(atomic_unchecked_t),
+ .mode = 0644,
+ .proc_handler = &read_reset_stat,
+ },
+diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+index 9e88438..8ed5cf0 100644
+--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+@@ -495,7 +495,7 @@ next_sge:
+ svc_rdma_put_context(ctxt, 0);
+ goto out;
+ }
+- atomic_inc(&rdma_stat_read);
++ atomic_inc_unchecked(&rdma_stat_read);
+
+ if (read_wr.num_sge < chl_map->ch[ch_no].count) {
+ chl_map->ch[ch_no].count -= read_wr.num_sge;
+@@ -606,7 +606,7 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp)
+ dto_q);
+ list_del_init(&ctxt->dto_q);
+ } else {
+- atomic_inc(&rdma_stat_rq_starve);
++ atomic_inc_unchecked(&rdma_stat_rq_starve);
+ clear_bit(XPT_DATA, &xprt->xpt_flags);
+ ctxt = NULL;
+ }
+@@ -626,7 +626,7 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp)
+ dprintk("svcrdma: processing ctxt=%p on xprt=%p, rqstp=%p, status=%d\n",
+ ctxt, rdma_xprt, rqstp, ctxt->wc_status);
+ BUG_ON(ctxt->wc_status != IB_WC_SUCCESS);
+- atomic_inc(&rdma_stat_recv);
++ atomic_inc_unchecked(&rdma_stat_recv);
+
+ /* Build up the XDR from the receive buffers. */
+ rdma_build_arg_xdr(rqstp, ctxt, ctxt->byte_len);
+diff --git a/net/sunrpc/xprtrdma/svc_rdma_sendto.c b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+index f11be72..7aad4e8 100644
+--- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+@@ -328,7 +328,7 @@ static int send_write(struct svcxprt_rdma *xprt, struct svc_rqst *rqstp,
+ write_wr.wr.rdma.remote_addr = to;
+
+ /* Post It */
+- atomic_inc(&rdma_stat_write);
++ atomic_inc_unchecked(&rdma_stat_write);
+ if (svc_rdma_send(xprt, &write_wr))
+ goto err;
+ return 0;
+diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
+index 3fa5751..030ba89 100644
+--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
+@@ -292,7 +292,7 @@ static void rq_cq_reap(struct svcxprt_rdma *xprt)
+ return;
+
+ ib_req_notify_cq(xprt->sc_rq_cq, IB_CQ_NEXT_COMP);
+- atomic_inc(&rdma_stat_rq_poll);
++ atomic_inc_unchecked(&rdma_stat_rq_poll);
+
+ while ((ret = ib_poll_cq(xprt->sc_rq_cq, 1, &wc)) > 0) {
+ ctxt = (struct svc_rdma_op_ctxt *)(unsigned long)wc.wr_id;
+@@ -314,7 +314,7 @@ static void rq_cq_reap(struct svcxprt_rdma *xprt)
+ }
+
+ if (ctxt)
+- atomic_inc(&rdma_stat_rq_prod);
++ atomic_inc_unchecked(&rdma_stat_rq_prod);
+
+ set_bit(XPT_DATA, &xprt->sc_xprt.xpt_flags);
+ /*
+@@ -386,7 +386,7 @@ static void sq_cq_reap(struct svcxprt_rdma *xprt)
+ return;
+
+ ib_req_notify_cq(xprt->sc_sq_cq, IB_CQ_NEXT_COMP);
+- atomic_inc(&rdma_stat_sq_poll);
++ atomic_inc_unchecked(&rdma_stat_sq_poll);
+ while ((ret = ib_poll_cq(cq, 1, &wc)) > 0) {
+ if (wc.status != IB_WC_SUCCESS)
+ /* Close the transport */
+@@ -404,7 +404,7 @@ static void sq_cq_reap(struct svcxprt_rdma *xprt)
+ }
+
+ if (ctxt)
+- atomic_inc(&rdma_stat_sq_prod);
++ atomic_inc_unchecked(&rdma_stat_sq_prod);
+ }
+
+ static void sq_comp_handler(struct ib_cq *cq, void *cq_context)
+@@ -1260,7 +1260,7 @@ int svc_rdma_send(struct svcxprt_rdma *xprt, struct ib_send_wr *wr)
+ spin_lock_bh(&xprt->sc_lock);
+ if (xprt->sc_sq_depth < atomic_read(&xprt->sc_sq_count) + wr_count) {
+ spin_unlock_bh(&xprt->sc_lock);
+- atomic_inc(&rdma_stat_sq_starve);
++ atomic_inc_unchecked(&rdma_stat_sq_starve);
+
+ /* See if we can opportunistically reap SQ WR to make room */
+ sq_cq_reap(xprt);
+diff --git a/net/sysctl_net.c b/net/sysctl_net.c
+index 0b15d72..7934fbb 100644
+--- a/net/sysctl_net.c
++++ b/net/sysctl_net.c
+@@ -46,7 +46,7 @@ static int net_ctl_permissions(struct ctl_table_root *root,
+ struct ctl_table *table)
+ {
+ /* Allow network administrator to have same access as root. */
+- if (capable(CAP_NET_ADMIN)) {
++ if (capable_nolog(CAP_NET_ADMIN)) {
+ int mode = (table->mode >> 6) & 7;
+ return (mode << 6) | (mode << 3) | mode;
+ }
+diff --git a/net/tipc/link.c b/net/tipc/link.c
+index dd4c18b..f40d38d 100644
+--- a/net/tipc/link.c
++++ b/net/tipc/link.c
+@@ -1418,7 +1418,7 @@ again:
+
+ if (!sect_rest) {
+ sect_rest = msg_sect[++curr_sect].iov_len;
+- sect_crs = (const unchar *)msg_sect[curr_sect].iov_base;
++ sect_crs = (const unchar __user *)msg_sect[curr_sect].iov_base;
+ }
+
+ if (sect_rest < fragm_rest)
+@@ -1437,7 +1437,7 @@ error:
+ }
+ } else
+ skb_copy_to_linear_data_offset(buf, fragm_crs,
+- sect_crs, sz);
++ (const void __force_kernel *)sect_crs, sz);
+ sect_crs += sz;
+ sect_rest -= sz;
+ fragm_crs += sz;
+diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
+index 0747d8a..e8bf3f3 100644
+--- a/net/tipc/subscr.c
++++ b/net/tipc/subscr.c
+@@ -104,7 +104,7 @@ static void subscr_send_event(struct subscription *sub,
+ {
+ struct iovec msg_sect;
+
+- msg_sect.iov_base = (void *)&sub->evt;
++ msg_sect.iov_base = (void __force_user *)&sub->evt;
+ msg_sect.iov_len = sizeof(struct tipc_event);
+
+ sub->evt.event = htohl(event, sub->swap);
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index db8d51a..608692d 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -745,6 +745,12 @@ static struct sock *unix_find_other(struct net *net,
+ err = -ECONNREFUSED;
+ if (!S_ISSOCK(inode->i_mode))
+ goto put_fail;
++
++ if (!gr_acl_handle_unix(path.dentry, path.mnt)) {
++ err = -EACCES;
++ goto put_fail;
++ }
++
+ u = unix_find_socket_byinode(net, inode);
+ if (!u)
+ goto put_fail;
+@@ -765,6 +771,13 @@ static struct sock *unix_find_other(struct net *net,
+ if (u) {
+ struct dentry *dentry;
+ dentry = unix_sk(u)->dentry;
++
++ if (!gr_handle_chroot_unix(u->sk_peercred.pid)) {
++ err = -EPERM;
++ sock_put(u);
++ goto fail;
++ }
++
+ if (dentry)
+ touch_atime(unix_sk(u)->mnt, dentry);
+ } else
+@@ -850,11 +863,18 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ err = security_path_mknod(&nd.path, dentry, mode, 0);
+ if (err)
+ goto out_mknod_drop_write;
++ if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
++ err = -EACCES;
++ goto out_mknod_drop_write;
++ }
+ err = vfs_mknod(nd.path.dentry->d_inode, dentry, mode, 0);
+ out_mknod_drop_write:
+ mnt_drop_write(nd.path.mnt);
+ if (err)
+ goto out_mknod_dput;
++
++ gr_handle_create(dentry, nd.path.mnt);
++
+ mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
+ dput(nd.path.dentry);
+ nd.path.dentry = dentry;
+@@ -2211,7 +2231,11 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+ unix_state_lock(s);
+
+ seq_printf(seq, "%p: %08X %08X %08X %04X %02X %5lu",
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ NULL,
++#else
+ s,
++#endif
+ atomic_read(&s->sk_refcnt),
+ 0,
+ s->sk_state == TCP_LISTEN ? __SO_ACCEPTCON : 0,
+diff --git a/net/wireless/core.h b/net/wireless/core.h
+index 376798f..109a61f 100644
+--- a/net/wireless/core.h
++++ b/net/wireless/core.h
+@@ -27,7 +27,7 @@ struct cfg80211_registered_device {
+ struct mutex mtx;
+
+ /* rfkill support */
+- struct rfkill_ops rfkill_ops;
++ rfkill_ops_no_const rfkill_ops;
+ struct rfkill *rfkill;
+ struct work_struct rfkill_sync;
+
+diff --git a/net/wireless/wext.c b/net/wireless/wext.c
+index a2e4c60..0979cbe 100644
+--- a/net/wireless/wext.c
++++ b/net/wireless/wext.c
+@@ -816,8 +816,7 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
+ */
+
+ /* Support for very large requests */
+- if ((descr->flags & IW_DESCR_FLAG_NOMAX) &&
+- (user_length > descr->max_tokens)) {
++ if (user_length > descr->max_tokens) {
+ /* Allow userspace to GET more than max so
+ * we can support any size GET requests.
+ * There is still a limit : -ENOMEM.
+@@ -854,22 +853,6 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
+ }
+ }
+
+- if (IW_IS_GET(cmd) && !(descr->flags & IW_DESCR_FLAG_NOMAX)) {
+- /*
+- * If this is a GET, but not NOMAX, it means that the extra
+- * data is not bounded by userspace, but by max_tokens. Thus
+- * set the length to max_tokens. This matches the extra data
+- * allocation.
+- * The driver should fill it with the number of tokens it
+- * provided, and it may check iwp->length rather than having
+- * knowledge of max_tokens. If the driver doesn't change the
+- * iwp->length, this ioctl just copies back max_token tokens
+- * filled with zeroes. Hopefully the driver isn't claiming
+- * them to be valid data.
+- */
+- iwp->length = descr->max_tokens;
+- }
+-
+ err = handler(dev, info, (union iwreq_data *) iwp, extra);
+
+ iwp->length += essid_compat;
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index cb81ca3..e15d49a 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -586,7 +586,7 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
+ hlist_add_head(&policy->bydst, chain);
+ xfrm_pol_hold(policy);
+ net->xfrm.policy_count[dir]++;
+- atomic_inc(&flow_cache_genid);
++ atomic_inc_unchecked(&flow_cache_genid);
+ if (delpol)
+ __xfrm_policy_unlink(delpol, dir);
+ policy->index = delpol ? delpol->index : xfrm_gen_index(net, dir);
+@@ -669,7 +669,7 @@ struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u8 type, int dir,
+ write_unlock_bh(&xfrm_policy_lock);
+
+ if (ret && delete) {
+- atomic_inc(&flow_cache_genid);
++ atomic_inc_unchecked(&flow_cache_genid);
+ xfrm_policy_kill(ret);
+ }
+ return ret;
+@@ -710,7 +710,7 @@ struct xfrm_policy *xfrm_policy_byid(struct net *net, u8 type, int dir, u32 id,
+ write_unlock_bh(&xfrm_policy_lock);
+
+ if (ret && delete) {
+- atomic_inc(&flow_cache_genid);
++ atomic_inc_unchecked(&flow_cache_genid);
+ xfrm_policy_kill(ret);
+ }
+ return ret;
+@@ -824,7 +824,7 @@ int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info)
+ }
+
+ }
+- atomic_inc(&flow_cache_genid);
++ atomic_inc_unchecked(&flow_cache_genid);
+ out:
+ write_unlock_bh(&xfrm_policy_lock);
+ return err;
+@@ -1088,7 +1088,7 @@ int xfrm_policy_delete(struct xfrm_policy *pol, int dir)
+ write_unlock_bh(&xfrm_policy_lock);
+ if (pol) {
+ if (dir < XFRM_POLICY_MAX)
+- atomic_inc(&flow_cache_genid);
++ atomic_inc_unchecked(&flow_cache_genid);
+ xfrm_policy_kill(pol);
+ return 0;
+ }
+@@ -1477,7 +1477,7 @@ free_dst:
+ goto out;
+ }
+
+-static int inline
++static inline int
+ xfrm_dst_alloc_copy(void **target, void *src, int size)
+ {
+ if (!*target) {
+@@ -1489,7 +1489,7 @@ xfrm_dst_alloc_copy(void **target, void *src, int size)
+ return 0;
+ }
+
+-static int inline
++static inline int
+ xfrm_dst_update_parent(struct dst_entry *dst, struct xfrm_selector *sel)
+ {
+ #ifdef CONFIG_XFRM_SUB_POLICY
+@@ -1501,7 +1501,7 @@ xfrm_dst_update_parent(struct dst_entry *dst, struct xfrm_selector *sel)
+ #endif
+ }
+
+-static int inline
++static inline int
+ xfrm_dst_update_origin(struct dst_entry *dst, struct flowi *fl)
+ {
+ #ifdef CONFIG_XFRM_SUB_POLICY
+@@ -1537,7 +1537,7 @@ int __xfrm_lookup(struct net *net, struct dst_entry **dst_p, struct flowi *fl,
+ u8 dir = policy_to_flow_dir(XFRM_POLICY_OUT);
+
+ restart:
+- genid = atomic_read(&flow_cache_genid);
++ genid = atomic_read_unchecked(&flow_cache_genid);
+ policy = NULL;
+ for (pi = 0; pi < ARRAY_SIZE(pols); pi++)
+ pols[pi] = NULL;
+@@ -1680,7 +1680,7 @@ restart:
+ goto error;
+ }
+ if (nx == -EAGAIN ||
+- genid != atomic_read(&flow_cache_genid)) {
++ genid != atomic_read_unchecked(&flow_cache_genid)) {
+ xfrm_pols_put(pols, npols);
+ goto restart;
+ }
+diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
+index b95a2d6..85c4d78 100644
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -1169,6 +1169,8 @@ static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb)
+ struct xfrm_user_tmpl vec[XFRM_MAX_DEPTH];
+ int i;
+
++ pax_track_stack();
++
+ if (xp->xfrm_nr == 0)
+ return 0;
+
+@@ -1784,6 +1786,8 @@ static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
+ int err;
+ int n = 0;
+
++ pax_track_stack();
++
+ if (attrs[XFRMA_MIGRATE] == NULL)
+ return -EINVAL;
+
+diff --git a/samples/kobject/kset-example.c b/samples/kobject/kset-example.c
+index 45b7d56..19e828c 100644
+--- a/samples/kobject/kset-example.c
++++ b/samples/kobject/kset-example.c
+@@ -87,7 +87,7 @@ static ssize_t foo_attr_store(struct kobject *kobj,
+ }
+
+ /* Our custom sysfs_ops that we will associate with our ktype later on */
+-static struct sysfs_ops foo_sysfs_ops = {
++static const struct sysfs_ops foo_sysfs_ops = {
+ .show = foo_attr_show,
+ .store = foo_attr_store,
+ };
+diff --git a/scripts/Makefile.build b/scripts/Makefile.build
+index 341b589..405aed3 100644
+--- a/scripts/Makefile.build
++++ b/scripts/Makefile.build
+@@ -59,7 +59,7 @@ endif
+ endif
+
+ # Do not include host rules unless needed
+-ifneq ($(hostprogs-y)$(hostprogs-m),)
++ifneq ($(hostprogs-y)$(hostprogs-m)$(hostlibs-y)$(hostlibs-m),)
+ include scripts/Makefile.host
+ endif
+
+diff --git a/scripts/Makefile.clean b/scripts/Makefile.clean
+index 6f89fbb..53adc9c 100644
+--- a/scripts/Makefile.clean
++++ b/scripts/Makefile.clean
+@@ -43,7 +43,8 @@ subdir-ymn := $(addprefix $(obj)/,$(subdir-ymn))
+ __clean-files := $(extra-y) $(always) \
+ $(targets) $(clean-files) \
+ $(host-progs) \
+- $(hostprogs-y) $(hostprogs-m) $(hostprogs-)
++ $(hostprogs-y) $(hostprogs-m) $(hostprogs-) \
++ $(hostlibs-y) $(hostlibs-m) $(hostlibs-)
+
+ # as clean-files is given relative to the current directory, this adds
+ # a $(obj) prefix, except for absolute paths
+diff --git a/scripts/Makefile.host b/scripts/Makefile.host
+index 1ac414f..a1c1451 100644
+--- a/scripts/Makefile.host
++++ b/scripts/Makefile.host
+@@ -31,6 +31,7 @@
+ # Note: Shared libraries consisting of C++ files are not supported
+
+ __hostprogs := $(sort $(hostprogs-y) $(hostprogs-m))
++__hostlibs := $(sort $(hostlibs-y) $(hostlibs-m))
+
+ # C code
+ # Executables compiled from a single .c file
+@@ -54,6 +55,7 @@ host-cxxobjs := $(sort $(foreach m,$(host-cxxmulti),$($(m)-cxxobjs)))
+ # Shared libaries (only .c supported)
+ # Shared libraries (.so) - all .so files referenced in "xxx-objs"
+ host-cshlib := $(sort $(filter %.so, $(host-cobjs)))
++host-cshlib += $(sort $(filter %.so, $(__hostlibs)))
+ # Remove .so files from "xxx-objs"
+ host-cobjs := $(filter-out %.so,$(host-cobjs))
+
+diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
+index ffdafb2..4a55d60 100644
+--- a/scripts/Makefile.lib
++++ b/scripts/Makefile.lib
+@@ -145,15 +145,15 @@ __a_flags = $(call flags,_a_flags)
+ __cpp_flags = $(call flags,_cpp_flags)
+ endif
+
+-c_flags = -Wp,-MD,$(depfile) $(NOSTDINC_FLAGS) $(LINUXINCLUDE) \
++c_flags = -Wp,-MD,$(depfile) $(LINUXINCLUDE) $(NOSTDINC_FLAGS) \
+ $(__c_flags) $(modkern_cflags) \
+ -D"KBUILD_STR(s)=\#s" $(basename_flags) $(modname_flags) \
+ $(debug_flags)
+
+-a_flags = -Wp,-MD,$(depfile) $(NOSTDINC_FLAGS) $(LINUXINCLUDE) \
++a_flags = -Wp,-MD,$(depfile) $(LINUXINCLUDE) $(NOSTDINC_FLAGS) \
+ $(__a_flags) $(modkern_aflags)
+
+-cpp_flags = -Wp,-MD,$(depfile) $(NOSTDINC_FLAGS) $(LINUXINCLUDE) \
++cpp_flags = -Wp,-MD,$(depfile) $(LINUXINCLUDE) $(NOSTDINC_FLAGS) \
+ $(__cpp_flags)
+
+ ld_flags = $(LDFLAGS) $(ldflags-y)
+diff --git a/scripts/basic/fixdep.c b/scripts/basic/fixdep.c
+index 6bf21f8..c0546b3 100644
+--- a/scripts/basic/fixdep.c
++++ b/scripts/basic/fixdep.c
+@@ -162,7 +162,7 @@ static void grow_config(int len)
+ /*
+ * Lookup a value in the configuration string.
+ */
+-static int is_defined_config(const char * name, int len)
++static int is_defined_config(const char * name, unsigned int len)
+ {
+ const char * pconfig;
+ const char * plast = str_config + len_config - len;
+@@ -199,7 +199,7 @@ static void clear_config(void)
+ /*
+ * Record the use of a CONFIG_* word.
+ */
+-static void use_config(char *m, int slen)
++static void use_config(char *m, unsigned int slen)
+ {
+ char s[PATH_MAX];
+ char *p;
+@@ -222,9 +222,9 @@ static void use_config(char *m, int slen)
+
+ static void parse_config_file(char *map, size_t len)
+ {
+- int *end = (int *) (map + len);
++ unsigned int *end = (unsigned int *) (map + len);
+ /* start at +1, so that p can never be < map */
+- int *m = (int *) map + 1;
++ unsigned int *m = (unsigned int *) map + 1;
+ char *p, *q;
+
+ for (; m < end; m++) {
+@@ -371,7 +371,7 @@ static void print_deps(void)
+ static void traps(void)
+ {
+ static char test[] __attribute__((aligned(sizeof(int)))) = "CONF";
+- int *p = (int *)test;
++ unsigned int *p = (unsigned int *)test;
+
+ if (*p != INT_CONF) {
+ fprintf(stderr, "fixdep: sizeof(int) != 4 or wrong endianess? %#x\n",
+diff --git a/scripts/gcc-plugin.sh b/scripts/gcc-plugin.sh
+new file mode 100644
+index 0000000..8729101
+--- /dev/null
++++ b/scripts/gcc-plugin.sh
+@@ -0,0 +1,2 @@
++#!/bin/sh
++echo -e "#include \"gcc-plugin.h\"\n#include \"tree.h\"\n#include \"tm.h\"\n#include \"rtl.h\"" | $1 -x c -shared - -o /dev/null -I`$2 -print-file-name=plugin`/include >/dev/null 2>&1 && echo "y"
+diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
+index 62a9025..65b82ad 100644
+--- a/scripts/mod/file2alias.c
++++ b/scripts/mod/file2alias.c
+@@ -72,7 +72,7 @@ static void device_id_check(const char *modname, const char *device_id,
+ unsigned long size, unsigned long id_size,
+ void *symval)
+ {
+- int i;
++ unsigned int i;
+
+ if (size % id_size || size < id_size) {
+ if (cross_build != 0)
+@@ -102,7 +102,7 @@ static void device_id_check(const char *modname, const char *device_id,
+ /* USB is special because the bcdDevice can be matched against a numeric range */
+ /* Looks like "usb:vNpNdNdcNdscNdpNicNiscNipN" */
+ static void do_usb_entry(struct usb_device_id *id,
+- unsigned int bcdDevice_initial, int bcdDevice_initial_digits,
++ unsigned int bcdDevice_initial, unsigned int bcdDevice_initial_digits,
+ unsigned char range_lo, unsigned char range_hi,
+ struct module *mod)
+ {
+@@ -151,7 +151,7 @@ static void do_usb_entry_multi(struct usb_device_id *id, struct module *mod)
+ {
+ unsigned int devlo, devhi;
+ unsigned char chi, clo;
+- int ndigits;
++ unsigned int ndigits;
+
+ id->match_flags = TO_NATIVE(id->match_flags);
+ id->idVendor = TO_NATIVE(id->idVendor);
+@@ -368,7 +368,7 @@ static void do_pnp_device_entry(void *symval, unsigned long size,
+ for (i = 0; i < count; i++) {
+ const char *id = (char *)devs[i].id;
+ char acpi_id[sizeof(devs[0].id)];
+- int j;
++ unsigned int j;
+
+ buf_printf(&mod->dev_table_buf,
+ "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
+@@ -398,7 +398,7 @@ static void do_pnp_card_entries(void *symval, unsigned long size,
+
+ for (j = 0; j < PNP_MAX_DEVICES; j++) {
+ const char *id = (char *)card->devs[j].id;
+- int i2, j2;
++ unsigned int i2, j2;
+ int dup = 0;
+
+ if (!id[0])
+@@ -424,7 +424,7 @@ static void do_pnp_card_entries(void *symval, unsigned long size,
+ /* add an individual alias for every device entry */
+ if (!dup) {
+ char acpi_id[sizeof(card->devs[0].id)];
+- int k;
++ unsigned int k;
+
+ buf_printf(&mod->dev_table_buf,
+ "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
+@@ -699,7 +699,7 @@ static void dmi_ascii_filter(char *d, const char *s)
+ static int do_dmi_entry(const char *filename, struct dmi_system_id *id,
+ char *alias)
+ {
+- int i, j;
++ unsigned int i, j;
+
+ sprintf(alias, "dmi*");
+
+diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
+index 03efeab..f65608f 100644
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -764,7 +764,7 @@ static void check_section(const char *modname, struct elf_info *elf,
+
+ #define ALL_INIT_DATA_SECTIONS \
+ ".init.setup$", ".init.rodata$", \
+- ".devinit.rodata$", ".cpuinit.rodata$", ".meminit.rodata$" \
++ ".devinit.rodata$", ".cpuinit.rodata$", ".meminit.rodata$", \
+ ".init.data$", ".devinit.data$", ".cpuinit.data$", ".meminit.data$"
+ #define ALL_EXIT_DATA_SECTIONS \
+ ".exit.data$", ".devexit.data$", ".cpuexit.data$", ".memexit.data$"
+@@ -835,6 +835,7 @@ enum mismatch {
+ INIT_TO_EXIT,
+ EXIT_TO_INIT,
+ EXPORT_TO_INIT_EXIT,
++ DATA_TO_TEXT
+ };
+
+ struct sectioncheck {
+@@ -920,6 +921,12 @@ const struct sectioncheck sectioncheck[] = {
+ .fromsec = { "__ksymtab*", NULL },
+ .tosec = { INIT_SECTIONS, EXIT_SECTIONS, NULL },
+ .mismatch = EXPORT_TO_INIT_EXIT
++},
++/* Do not reference code from writable data */
++{
++ .fromsec = { DATA_SECTIONS, NULL },
++ .tosec = { TEXT_SECTIONS, NULL },
++ .mismatch = DATA_TO_TEXT
+ }
+ };
+
+@@ -1024,10 +1031,10 @@ static Elf_Sym *find_elf_symbol(struct elf_info *elf, Elf64_Sword addr,
+ continue;
+ if (ELF_ST_TYPE(sym->st_info) == STT_SECTION)
+ continue;
+- if (sym->st_value == addr)
+- return sym;
+ /* Find a symbol nearby - addr are maybe negative */
+ d = sym->st_value - addr;
++ if (d == 0)
++ return sym;
+ if (d < 0)
+ d = addr - sym->st_value;
+ if (d < distance) {
+@@ -1268,6 +1275,14 @@ static void report_sec_mismatch(const char *modname, enum mismatch mismatch,
+ "Fix this by removing the %sannotation of %s "
+ "or drop the export.\n",
+ tosym, sec2annotation(tosec), sec2annotation(tosec), tosym);
++ case DATA_TO_TEXT:
++/*
++ fprintf(stderr,
++ "The variable %s references\n"
++ "the %s %s%s%s\n",
++ fromsym, to, sec2annotation(tosec), tosym, to_p);
++*/
++ break;
+ case NO_MISMATCH:
+ /* To get warnings on missing members */
+ break;
+@@ -1495,7 +1510,7 @@ static void section_rel(const char *modname, struct elf_info *elf,
+ static void check_sec_ref(struct module *mod, const char *modname,
+ struct elf_info *elf)
+ {
+- int i;
++ unsigned int i;
+ Elf_Shdr *sechdrs = elf->sechdrs;
+
+ /* Walk through all sections */
+@@ -1651,7 +1666,7 @@ void __attribute__((format(printf, 2, 3))) buf_printf(struct buffer *buf,
+ va_end(ap);
+ }
+
+-void buf_write(struct buffer *buf, const char *s, int len)
++void buf_write(struct buffer *buf, const char *s, unsigned int len)
+ {
+ if (buf->size - buf->pos < len) {
+ buf->size += len + SZ;
+@@ -1863,7 +1878,7 @@ static void write_if_changed(struct buffer *b, const char *fname)
+ if (fstat(fileno(file), &st) < 0)
+ goto close_write;
+
+- if (st.st_size != b->pos)
++ if (st.st_size != (off_t)b->pos)
+ goto close_write;
+
+ tmp = NOFAIL(malloc(b->pos));
+diff --git a/scripts/mod/modpost.h b/scripts/mod/modpost.h
+index 09f58e3..4b66092 100644
+--- a/scripts/mod/modpost.h
++++ b/scripts/mod/modpost.h
+@@ -92,15 +92,15 @@ void *do_nofail(void *ptr, const char *expr);
+
+ struct buffer {
+ char *p;
+- int pos;
+- int size;
++ unsigned int pos;
++ unsigned int size;
+ };
+
+ void __attribute__((format(printf, 2, 3)))
+ buf_printf(struct buffer *buf, const char *fmt, ...);
+
+ void
+-buf_write(struct buffer *buf, const char *s, int len);
++buf_write(struct buffer *buf, const char *s, unsigned int len);
+
+ struct module {
+ struct module *next;
+diff --git a/scripts/mod/sumversion.c b/scripts/mod/sumversion.c
+index ecf9c7d..d52b38e 100644
+--- a/scripts/mod/sumversion.c
++++ b/scripts/mod/sumversion.c
+@@ -455,7 +455,7 @@ static void write_version(const char *filename, const char *sum,
+ goto out;
+ }
+
+- if (write(fd, sum, strlen(sum)+1) != strlen(sum)+1) {
++ if (write(fd, sum, strlen(sum)+1) != (ssize_t)strlen(sum)+1) {
+ warn("writing sum in %s failed: %s\n",
+ filename, strerror(errno));
+ goto out;
+diff --git a/scripts/package/mkspec b/scripts/package/mkspec
+index 47bdd2f..d4d4e93 100755
+--- a/scripts/package/mkspec
++++ b/scripts/package/mkspec
+@@ -70,7 +70,7 @@ echo 'mkdir -p $RPM_BUILD_ROOT/boot $RPM_BUILD_ROOT/lib/modules'
+ echo 'mkdir -p $RPM_BUILD_ROOT/lib/firmware'
+ echo "%endif"
+
+-echo 'INSTALL_MOD_PATH=$RPM_BUILD_ROOT make %{_smp_mflags} KBUILD_SRC= modules_install'
++echo 'INSTALL_MOD_PATH=$RPM_BUILD_ROOT make %{?_smp_mflags} KBUILD_SRC= modules_install'
+ echo "%ifarch ia64"
+ echo 'cp $KBUILD_IMAGE $RPM_BUILD_ROOT'"/boot/efi/vmlinuz-$KERNELRELEASE"
+ echo 'ln -s '"efi/vmlinuz-$KERNELRELEASE" '$RPM_BUILD_ROOT'"/boot/"
+diff --git a/scripts/pnmtologo.c b/scripts/pnmtologo.c
+index 5c11312..72742b5 100644
+--- a/scripts/pnmtologo.c
++++ b/scripts/pnmtologo.c
+@@ -237,14 +237,14 @@ static void write_header(void)
+ fprintf(out, " * Linux logo %s\n", logoname);
+ fputs(" */\n\n", out);
+ fputs("#include <linux/linux_logo.h>\n\n", out);
+- fprintf(out, "static unsigned char %s_data[] __initdata = {\n",
++ fprintf(out, "static unsigned char %s_data[] = {\n",
+ logoname);
+ }
+
+ static void write_footer(void)
+ {
+ fputs("\n};\n\n", out);
+- fprintf(out, "const struct linux_logo %s __initconst = {\n", logoname);
++ fprintf(out, "const struct linux_logo %s = {\n", logoname);
+ fprintf(out, "\t.type\t\t= %s,\n", logo_types[logo_type]);
+ fprintf(out, "\t.width\t\t= %d,\n", logo_width);
+ fprintf(out, "\t.height\t\t= %d,\n", logo_height);
+@@ -374,7 +374,7 @@ static void write_logo_clut224(void)
+ fputs("\n};\n\n", out);
+
+ /* write logo clut */
+- fprintf(out, "static unsigned char %s_clut[] __initdata = {\n",
++ fprintf(out, "static unsigned char %s_clut[] = {\n",
+ logoname);
+ write_hex_cnt = 0;
+ for (i = 0; i < logo_clutsize; i++) {
+diff --git a/scripts/tags.sh b/scripts/tags.sh
+index d52f7a0..b66cdd9 100755
+--- a/scripts/tags.sh
++++ b/scripts/tags.sh
+@@ -93,6 +93,11 @@ docscope()
+ cscope -b -f cscope.out
+ }
+
++dogtags()
++{
++ all_sources | gtags -i -f -
++}
++
+ exuberant()
+ {
+ all_sources | xargs $1 -a \
+@@ -164,6 +169,10 @@ case "$1" in
+ docscope
+ ;;
+
++ "gtags")
++ dogtags
++ ;;
++
+ "tags")
+ rm -f tags
+ xtags ctags
+diff --git a/security/Kconfig b/security/Kconfig
+index fb363cd..c2c0a96 100644
+--- a/security/Kconfig
++++ b/security/Kconfig
+@@ -4,6 +4,634 @@
+
+ menu "Security options"
+
++source grsecurity/Kconfig
++
++menu "PaX"
++
++ config ARCH_TRACK_EXEC_LIMIT
++ bool
++
++ config PAX_KERNEXEC_PLUGIN
++ bool
++
++ config PAX_PER_CPU_PGD
++ bool
++
++ config TASK_SIZE_MAX_SHIFT
++ int
++ depends on X86_64
++ default 47 if !PAX_PER_CPU_PGD
++ default 42 if PAX_PER_CPU_PGD
++
++ config PAX_ENABLE_PAE
++ bool
++ default y if (X86_32 && (MPENTIUM4 || MK8 || MPSC || MCORE2 || MATOM))
++
++config PAX
++ bool "Enable various PaX features"
++ depends on GRKERNSEC && (ALPHA || ARM || AVR32 || IA64 || MIPS || PARISC || PPC || SPARC || X86)
++ help
++ This allows you to enable various PaX features. PaX adds
++ intrusion prevention mechanisms to the kernel that reduce
++ the risks posed by exploitable memory corruption bugs.
++
++menu "PaX Control"
++ depends on PAX
++
++config PAX_SOFTMODE
++ bool 'Support soft mode'
++ help
++ Enabling this option will allow you to run PaX in soft mode, that
++ is, PaX features will not be enforced by default, only on executables
++ marked explicitly. You must also enable PT_PAX_FLAGS or XATTR_PAX_FLAGS
++ support as they are the only way to mark executables for soft mode use.
++
++ Soft mode can be activated by using the "pax_softmode=1" kernel command
++ line option on boot. Furthermore you can control various PaX features
++ at runtime via the entries in /proc/sys/kernel/pax.
++
++config PAX_EI_PAX
++ bool 'Use legacy ELF header marking'
++ help
++ Enabling this option will allow you to control PaX features on
++ a per executable basis via the 'chpax' utility available at
++ http://pax.grsecurity.net/. The control flags will be read from
++ an otherwise reserved part of the ELF header. This marking has
++ numerous drawbacks (no support for soft-mode, toolchain does not
++ know about the non-standard use of the ELF header) therefore it
++ has been deprecated in favour of PT_PAX_FLAGS and XATTR_PAX_FLAGS
++ support.
++
++ If you have applications not marked by the PT_PAX_FLAGS ELF program
++ header and you cannot use XATTR_PAX_FLAGS then you MUST enable this
++ option otherwise they will not get any protection.
++
++ Note that if you enable PT_PAX_FLAGS or XATTR_PAX_FLAGS marking
++ support as well, they will override the legacy EI_PAX marks.
++
++config PAX_PT_PAX_FLAGS
++ bool 'Use ELF program header marking'
++ help
++ Enabling this option will allow you to control PaX features on
++ a per executable basis via the 'paxctl' utility available at
++ http://pax.grsecurity.net/. The control flags will be read from
++ a PaX specific ELF program header (PT_PAX_FLAGS). This marking
++ has the benefits of supporting both soft mode and being fully
++ integrated into the toolchain (the binutils patch is available
++ from http://pax.grsecurity.net).
++
++ If you have applications not marked by the PT_PAX_FLAGS ELF program
++ header then you MUST enable either XATTR_PAX_FLAGS or EI_PAX marking
++ support otherwise they will not get any protection.
++
++ If you enable both PT_PAX_FLAGS and XATTR_PAX_FLAGS support then you
++ must make sure that the marks are the same if a binary has both marks.
++
++ Note that if you enable the legacy EI_PAX marking support as well,
++ the EI_PAX marks will be overridden by the PT_PAX_FLAGS marks.
++
++config PAX_XATTR_PAX_FLAGS
++ bool 'Use filesystem extended attributes marking'
++ select CIFS_XATTR if CIFS
++ select EXT2_FS_XATTR if EXT2_FS
++ select EXT3_FS_XATTR if EXT3_FS
++ select EXT4_FS_XATTR if EXT4_FS
++ select JFFS2_FS_XATTR if JFFS2_FS
++ select REISERFS_FS_XATTR if REISERFS_FS
++ select UBIFS_FS_XATTR if UBIFS_FS
++ help
++ Enabling this option will allow you to control PaX features on
++ a per executable basis via the 'setfattr' utility. The control
++ flags will be read from the user.pax.flags extended attribute of
++ the file. This marking has the benefit of supporting binary-only
++ applications that self-check themselves (e.g., skype) and would
++ not tolerate chpax/paxctl changes. The main drawback is that
++ extended attributes are not supported by some filesystems (e.g.,
++ isofs, squashfs, tmpfs, udf, vfat) so copying files through such
++ filesystems will lose the extended attributes and these PaX markings.
++
++ If you have applications not marked by the PT_PAX_FLAGS ELF program
++ header then you MUST enable either XATTR_PAX_FLAGS or EI_PAX marking
++ support otherwise they will not get any protection.
++
++ If you enable both PT_PAX_FLAGS and XATTR_PAX_FLAGS support then you
++ must make sure that the marks are the same if a binary has both marks.
++
++ Note that if you enable the legacy EI_PAX marking support as well,
++ the EI_PAX marks will be overridden by the XATTR_PAX_FLAGS marks.
++
++choice
++ prompt 'MAC system integration'
++ default PAX_HAVE_ACL_FLAGS
++ help
++ Mandatory Access Control systems have the option of controlling
++ PaX flags on a per executable basis, choose the method supported
++ by your particular system.
++
++ - "none": if your MAC system does not interact with PaX,
++ - "direct": if your MAC system defines pax_set_initial_flags() itself,
++ - "hook": if your MAC system uses the pax_set_initial_flags_func callback.
++
++ NOTE: this option is for developers/integrators only.
++
++ config PAX_NO_ACL_FLAGS
++ bool 'none'
++
++ config PAX_HAVE_ACL_FLAGS
++ bool 'direct'
++
++ config PAX_HOOK_ACL_FLAGS
++ bool 'hook'
++endchoice
++
++endmenu
++
++menu "Non-executable pages"
++ depends on PAX
++
++config PAX_NOEXEC
++ bool "Enforce non-executable pages"
++ depends on ALPHA || (ARM && (CPU_V6 || CPU_V7)) || IA64 || MIPS || PARISC || PPC || S390 || SPARC || X86
++ help
++ By design some architectures do not allow for protecting memory
++ pages against execution or even if they do, Linux does not make
++ use of this feature. In practice this means that if a page is
++ readable (such as the stack or heap) it is also executable.
++
++ There is a well known exploit technique that makes use of this
++ fact and a common programming mistake where an attacker can
++ introduce code of his choice somewhere in the attacked program's
++ memory (typically the stack or the heap) and then execute it.
++
++ If the attacked program was running with different (typically
++ higher) privileges than that of the attacker, then he can elevate
++ his own privilege level (e.g. get a root shell, write to files for
++ which he does not have write access to, etc).
++
++ Enabling this option will let you choose from various features
++ that prevent the injection and execution of 'foreign' code in
++ a program.
++
++ This will also break programs that rely on the old behaviour and
++ expect that dynamically allocated memory via the malloc() family
++ of functions is executable (which it is not). Notable examples
++ are the XFree86 4.x server, the java runtime and wine.
++
++config PAX_PAGEEXEC
++ bool "Paging based non-executable pages"
++ depends on PAX_NOEXEC && (!X86_32 || M586 || M586TSC || M586MMX || M686 || MPENTIUMII || MPENTIUMIII || MPENTIUMM || MCORE2 || MATOM || MPENTIUM4 || MPSC || MK7 || MK8 || MWINCHIPC6 || MWINCHIP2 || MWINCHIP3D || MVIAC3_2 || MVIAC7)
++ select S390_SWITCH_AMODE if S390
++ select S390_EXEC_PROTECT if S390
++ select ARCH_TRACK_EXEC_LIMIT if X86_32
++ help
++ This implementation is based on the paging feature of the CPU.
++ On i386 without hardware non-executable bit support there is a
++ variable but usually low performance impact, however on Intel's
++ P4 core based CPUs it is very high so you should not enable this
++ for kernels meant to be used on such CPUs.
++
++ On alpha, avr32, ia64, parisc, sparc, sparc64, x86_64 and i386
++ with hardware non-executable bit support there is no performance
++ impact, on ppc the impact is negligible.
++
++ Note that several architectures require various emulations due to
++ badly designed userland ABIs, this will cause a performance impact
++ but will disappear as soon as userland is fixed. For example, ppc
++ userland MUST have been built with secure-plt by a recent toolchain.
++
++config PAX_SEGMEXEC
++ bool "Segmentation based non-executable pages"
++ depends on PAX_NOEXEC && X86_32
++ help
++ This implementation is based on the segmentation feature of the
++ CPU and has a very small performance impact, however applications
++ will be limited to a 1.5 GB address space instead of the normal
++ 3 GB.
++
++config PAX_EMUTRAMP
++ bool "Emulate trampolines" if (PAX_PAGEEXEC || PAX_SEGMEXEC) && (PARISC || X86)
++ default y if PARISC
++ help
++ There are some programs and libraries that for one reason or
++ another attempt to execute special small code snippets from
++ non-executable memory pages. Most notable examples are the
++ signal handler return code generated by the kernel itself and
++ the GCC trampolines.
++
++ If you enabled CONFIG_PAX_PAGEEXEC or CONFIG_PAX_SEGMEXEC then
++ such programs will no longer work under your kernel.
++
++ As a remedy you can say Y here and use the 'chpax' or 'paxctl'
++ utilities to enable trampoline emulation for the affected programs
++ yet still have the protection provided by the non-executable pages.
++
++ On parisc you MUST enable this option and EMUSIGRT as well, otherwise
++ your system will not even boot.
++
++ Alternatively you can say N here and use the 'chpax' or 'paxctl'
++ utilities to disable CONFIG_PAX_PAGEEXEC and CONFIG_PAX_SEGMEXEC
++ for the affected files.
++
++ NOTE: enabling this feature *may* open up a loophole in the
++ protection provided by non-executable pages that an attacker
++ could abuse. Therefore the best solution is to not have any
++ files on your system that would require this option. This can
++ be achieved by not using libc5 (which relies on the kernel
++ signal handler return code) and not using or rewriting programs
++ that make use of the nested function implementation of GCC.
++ Skilled users can just fix GCC itself so that it implements
++ nested function calls in a way that does not interfere with PaX.
++
++config PAX_EMUSIGRT
++ bool "Automatically emulate sigreturn trampolines"
++ depends on PAX_EMUTRAMP && PARISC
++ default y
++ help
++ Enabling this option will have the kernel automatically detect
++ and emulate signal return trampolines executing on the stack
++ that would otherwise lead to task termination.
++
++ This solution is intended as a temporary one for users with
++ legacy versions of libc (libc5, glibc 2.0, uClibc before 0.9.17,
++ Modula-3 runtime, etc) or executables linked to such, basically
++ everything that does not specify its own SA_RESTORER function in
++ normal executable memory like glibc 2.1+ does.
++
++ On parisc you MUST enable this option, otherwise your system will
++ not even boot.
++
++ NOTE: this feature cannot be disabled on a per executable basis
++ and since it *does* open up a loophole in the protection provided
++ by non-executable pages, the best solution is to not have any
++ files on your system that would require this option.
++
++config PAX_MPROTECT
++ bool "Restrict mprotect()"
++ depends on (PAX_PAGEEXEC || PAX_SEGMEXEC)
++ help
++ Enabling this option will prevent programs from
++ - changing the executable status of memory pages that were
++ not originally created as executable,
++ - making read-only executable pages writable again,
++ - creating executable pages from anonymous memory,
++ - making read-only-after-relocations (RELRO) data pages writable again.
++
++ You should say Y here to complete the protection provided by
++ the enforcement of non-executable pages.
++
++ NOTE: you can use the 'chpax' or 'paxctl' utilities to control
++ this feature on a per file basis.
++
++config PAX_MPROTECT_COMPAT
++ bool "Use legacy/compat protection demoting (read help)"
++ depends on PAX_MPROTECT
++ default n
++ help
++ The current implementation of PAX_MPROTECT denies RWX allocations/mprotects
++ by sending the proper error code to the application. For some broken
++ userland, this can cause problems with Python or other applications. The
++ current implementation however allows for applications like clamav to
++ detect if JIT compilation/execution is allowed and to fall back gracefully
++ to an interpreter-based mode if it does not. While we encourage everyone
++ to use the current implementation as-is and push upstream to fix broken
++ userland (note that the RWX logging option can assist with this), in some
++ environments this may not be possible. Having to disable MPROTECT
++ completely on certain binaries reduces the security benefit of PaX,
++ so this option is provided for those environments to revert to the old
++ behavior.
++
++config PAX_ELFRELOCS
++ bool "Allow ELF text relocations (read help)"
++ depends on PAX_MPROTECT
++ default n
++ help
++ Non-executable pages and mprotect() restrictions are effective
++ in preventing the introduction of new executable code into an
++ attacked task's address space. There remain only two venues
++ for this kind of attack: if the attacker can execute already
++ existing code in the attacked task then he can either have it
++ create and mmap() a file containing his code or have it mmap()
++ an already existing ELF library that does not have position
++ independent code in it and use mprotect() on it to make it
++ writable and copy his code there. While protecting against
++ the former approach is beyond PaX, the latter can be prevented
++ by having only PIC ELF libraries on one's system (which do not
++ need to relocate their code). If you are sure this is your case,
++ as is the case with all modern Linux distributions, then leave
++ this option disabled. You should say 'n' here.
++
++config PAX_ETEXECRELOCS
++ bool "Allow ELF ET_EXEC text relocations"
++ depends on PAX_MPROTECT && (ALPHA || IA64 || PARISC)
++ select PAX_ELFRELOCS
++ default y
++ help
++ On some architectures there are incorrectly created applications
++ that require text relocations and would not work without enabling
++ this option. If you are an alpha, ia64 or parisc user, you should
++ enable this option and disable it once you have made sure that
++ none of your applications need it.
++
++config PAX_EMUPLT
++ bool "Automatically emulate ELF PLT"
++ depends on PAX_MPROTECT && (ALPHA || PARISC || SPARC)
++ default y
++ help
++ Enabling this option will have the kernel automatically detect
++ and emulate the Procedure Linkage Table entries in ELF files.
++ On some architectures such entries are in writable memory, and
++ become non-executable leading to task termination. Therefore
++ it is mandatory that you enable this option on alpha, parisc,
++ sparc and sparc64, otherwise your system would not even boot.
++
++ NOTE: this feature *does* open up a loophole in the protection
++ provided by the non-executable pages, therefore the proper
++ solution is to modify the toolchain to produce a PLT that does
++ not need to be writable.
++
++config PAX_DLRESOLVE
++ bool 'Emulate old glibc resolver stub'
++ depends on PAX_EMUPLT && SPARC
++ default n
++ help
++ This option is needed if userland has an old glibc (before 2.4)
++ that puts a 'save' instruction into the runtime generated resolver
++ stub that needs special emulation.
++
++config PAX_KERNEXEC
++ bool "Enforce non-executable kernel pages"
++ depends on (PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN
++ select PAX_PER_CPU_PGD if X86_64 || (X86_32 && X86_PAE)
++ select PAX_KERNEXEC_PLUGIN if X86_64
++ help
++ This is the kernel land equivalent of PAGEEXEC and MPROTECT,
++ that is, enabling this option will make it harder to inject
++ and execute 'foreign' code in kernel memory itself.
++
++ Note that on x86_64 kernels there is a known regression when
++ this feature and KVM/VMX are both enabled in the host kernel.
++
++choice
++ prompt "Return Address Instrumentation Method"
++ default PAX_KERNEXEC_PLUGIN_METHOD_BTS
++ depends on PAX_KERNEXEC_PLUGIN
++ help
++ Select the method used to instrument function pointer dereferences.
++ Note that binary modules cannot be instrumented by this approach.
++
++ config PAX_KERNEXEC_PLUGIN_METHOD_BTS
++ bool "bts"
++ help
++ This method is compatible with binary only modules but has
++ a higher runtime overhead.
++
++ config PAX_KERNEXEC_PLUGIN_METHOD_OR
++ bool "or"
++ depends on !PARAVIRT
++ help
++ This method is incompatible with binary only modules but has
++ a lower runtime overhead.
++endchoice
++
++config PAX_KERNEXEC_PLUGIN_METHOD
++ string
++ default "bts" if PAX_KERNEXEC_PLUGIN_METHOD_BTS
++ default "or" if PAX_KERNEXEC_PLUGIN_METHOD_OR
++ default ""
++
++config PAX_KERNEXEC_MODULE_TEXT
++ int "Minimum amount of memory reserved for module code"
++ default "4"
++ depends on PAX_KERNEXEC && X86_32 && MODULES
++ help
++ Due to implementation details the kernel must reserve a fixed
++ amount of memory for module code at compile time that cannot be
++ changed at runtime. Here you can specify the minimum amount
++ in MB that will be reserved. Due to the same implementation
++ details this size will always be rounded up to the next 2/4 MB
++ boundary (depends on PAE) so the actually available memory for
++ module code will usually be more than this minimum.
++
++ The default 4 MB should be enough for most users but if you have
++ an excessive number of modules (e.g., most distribution configs
++ compile many drivers as modules) or use huge modules such as
++ nvidia's kernel driver, you will need to adjust this amount.
++ A good rule of thumb is to look at your currently loaded kernel
++ modules and add up their sizes.
++
++endmenu
++
++menu "Address Space Layout Randomization"
++ depends on PAX
++
++config PAX_ASLR
++ bool "Address Space Layout Randomization"
++ help
++ Many if not most exploit techniques rely on the knowledge of
++ certain addresses in the attacked program. The following options
++ will allow the kernel to apply a certain amount of randomization
++ to specific parts of the program thereby forcing an attacker to
++ guess them in most cases. Any failed guess will most likely crash
++ the attacked program which allows the kernel to detect such attempts
++ and react on them. PaX itself provides no reaction mechanisms,
++ instead it is strongly encouraged that you make use of Nergal's
++ segvguard (ftp://ftp.pl.openwall.com/misc/segvguard/) or grsecurity's
++ (http://www.grsecurity.net/) built-in crash detection features or
++ develop one yourself.
++
++ By saying Y here you can choose to randomize the following areas:
++ - top of the task's kernel stack
++ - top of the task's userland stack
++ - base address for mmap() requests that do not specify one
++ (this includes all libraries)
++ - base address of the main executable
++
++ It is strongly recommended to say Y here as address space layout
++ randomization has negligible impact on performance yet it provides
++ a very effective protection.
++
++ NOTE: you can use the 'chpax' or 'paxctl' utilities to control
++ this feature on a per file basis.
++
++config PAX_RANDKSTACK
++ bool "Randomize kernel stack base"
++ depends on X86_TSC && X86
++ help
++ By saying Y here the kernel will randomize every task's kernel
++ stack on every system call. This will not only force an attacker
++ to guess it but also prevent him from making use of possible
++ leaked information about it.
++
++ Since the kernel stack is a rather scarce resource, randomization
++ may cause unexpected stack overflows, therefore you should very
++ carefully test your system. Note that once enabled in the kernel
++ configuration, this feature cannot be disabled on a per file basis.
++
++config PAX_RANDUSTACK
++ bool "Randomize user stack base"
++ depends on PAX_ASLR
++ help
++ By saying Y here the kernel will randomize every task's userland
++ stack. The randomization is done in two steps where the second
++ one may apply a big amount of shift to the top of the stack and
++ cause problems for programs that want to use lots of memory (more
++ than 2.5 GB if SEGMEXEC is not active, or 1.25 GB when it is).
++ For this reason the second step can be controlled by 'chpax' or
++ 'paxctl' on a per file basis.
++
++config PAX_RANDMMAP
++ bool "Randomize mmap() base"
++ depends on PAX_ASLR
++ help
++ By saying Y here the kernel will use a randomized base address for
++ mmap() requests that do not specify one themselves. As a result
++ all dynamically loaded libraries will appear at random addresses
++ and therefore be harder to exploit by a technique where an attacker
++ attempts to execute library code for his purposes (e.g. spawn a
++ shell from an exploited program that is running at an elevated
++ privilege level).
++
++ Furthermore, if a program is relinked as a dynamic ELF file, its
++ base address will be randomized as well, completing the full
++ randomization of the address space layout. Attacking such programs
++ becomes a guess game. You can find an example of doing this at
++ http://pax.grsecurity.net/et_dyn.tar.gz and practical samples at
++ http://www.grsecurity.net/grsec-gcc-specs.tar.gz .
++
++ NOTE: you can use the 'chpax' or 'paxctl' utilities to control this
++ feature on a per file basis.
++
++endmenu
++
++menu "Miscellaneous hardening features"
++
++config PAX_MEMORY_SANITIZE
++ bool "Sanitize all freed memory"
++ depends on !HIBERNATION
++ help
++ By saying Y here the kernel will erase memory pages as soon as they
++ are freed. This in turn reduces the lifetime of data stored in the
++ pages, making it less likely that sensitive information such as
++ passwords, cryptographic secrets, etc stay in memory for too long.
++
++ This is especially useful for programs whose runtime is short, long
++ lived processes and the kernel itself benefit from this as long as
++ they operate on whole memory pages and ensure timely freeing of pages
++ that may hold sensitive information.
++
++ The tradeoff is performance impact, on a single CPU system kernel
++ compilation sees a 3% slowdown, other systems and workloads may vary
++ and you are advised to test this feature on your expected workload
++ before deploying it.
++
++ Note that this feature does not protect data stored in live pages,
++ e.g., process memory swapped to disk may stay there for a long time.
++
++config PAX_MEMORY_STACKLEAK
++ bool "Sanitize kernel stack"
++ depends on X86
++ help
++ By saying Y here the kernel will erase the kernel stack before it
++ returns from a system call. This in turn reduces the information
++ that a kernel stack leak bug can reveal.
++
++ Note that such a bug can still leak information that was put on
++ the stack by the current system call (the one eventually triggering
++ the bug) but traces of earlier system calls on the kernel stack
++ cannot leak anymore.
++
++ The tradeoff is performance impact, on a single CPU system kernel
++ compilation sees a 1% slowdown, other systems and workloads may vary
++ and you are advised to test this feature on your expected workload
++ before deploying it.
++
++ Note: full support for this feature requires gcc with plugin support
++ so make sure your compiler is at least gcc 4.5.0. Using older gcc
++ versions means that functions with large enough stack frames may
++ leave uninitialized memory behind that may be exposed to a later
++ syscall leaking the stack.
++
++config PAX_MEMORY_UDEREF
++ bool "Prevent invalid userland pointer dereference"
++ depends on X86 && !UML_X86 && !XEN
++ select PAX_PER_CPU_PGD if X86_64
++ help
++ By saying Y here the kernel will be prevented from dereferencing
++ userland pointers in contexts where the kernel expects only kernel
++ pointers. This is both a useful runtime debugging feature and a
++ security measure that prevents exploiting a class of kernel bugs.
++
++ The tradeoff is that some virtualization solutions may experience
++ a huge slowdown and therefore you should not enable this feature
++ for kernels meant to run in such environments. Whether a given VM
++ solution is affected or not is best determined by simply trying it
++ out, the performance impact will be obvious right on boot as this
++ mechanism engages from very early on. A good rule of thumb is that
++ VMs running on CPUs without hardware virtualization support (i.e.,
++ the majority of IA-32 CPUs) will likely experience the slowdown.
++
++config PAX_REFCOUNT
++ bool "Prevent various kernel object reference counter overflows"
++ depends on GRKERNSEC && ((ARM && (CPU_32v6 || CPU_32v6K || CPU_32v7)) || SPARC64 || X86)
++ help
++ By saying Y here the kernel will detect and prevent overflowing
++ various (but not all) kinds of object reference counters. Such
++ overflows can normally occur due to bugs only and are often, if
++ not always, exploitable.
++
++ The tradeoff is that data structures protected by an overflowed
++ refcount will never be freed and therefore will leak memory. Note
++ that this leak also happens even without this protection but in
++ that case the overflow can eventually trigger the freeing of the
++ data structure while it is still being used elsewhere, resulting
++ in the exploitable situation that this feature prevents.
++
++ Since this has a negligible performance impact, you should enable
++ this feature.
++
++config PAX_USERCOPY
++ bool "Harden heap object copies between kernel and userland"
++ depends on X86 || PPC || SPARC || ARM
++ depends on GRKERNSEC && (SLAB || SLUB || SLOB)
++ help
++ By saying Y here the kernel will enforce the size of heap objects
++ when they are copied in either direction between the kernel and
++ userland, even if only a part of the heap object is copied.
++
++ Specifically, this checking prevents information leaking from the
++ kernel heap during kernel to userland copies (if the kernel heap
++ object is otherwise fully initialized) and prevents kernel heap
++ overflows during userland to kernel copies.
++
++ Note that the current implementation provides the strictest bounds
++ checks for the SLUB allocator.
++
++ Enabling this option also enables per-slab cache protection against
++ data in a given cache being copied into/out of via userland
++ accessors. Though the whitelist of regions will be reduced over
++ time, it notably protects important data structures like task structs.
++
++ Since this has a negligible performance impact, you should enable
++ this feature.
++
++config PAX_SIZE_OVERFLOW
++ bool "Prevent various integer overflows in function size parameters"
++ depends on X86
++ help
++ By saying Y here the kernel recomputes expressions of function
++ arguments marked by a size_overflow attribute with double integer
++ precision (DImode/TImode for 32/64 bit integer types).
++
++ The recomputed argument is checked against INT_MAX and an event
++ is logged on overflow and the triggering process is killed.
++
++ Homepage:
++ http://www.grsecurity.net/~ephox/overflow_plugin/
++
++endmenu
++
++endmenu
++
+ config KEYS
+ bool "Enable access key retention support"
+ help
+@@ -146,7 +774,7 @@ config INTEL_TXT
+ config LSM_MMAP_MIN_ADDR
+ int "Low address space for LSM to protect from user allocation"
+ depends on SECURITY && SECURITY_SELINUX
+- default 65536
++ default 32768
+ help
+ This is the portion of low virtual memory which should be protected
+ from userspace allocation. Keeping a user from writing to low pages
+diff --git a/security/capability.c b/security/capability.c
+index fce07a7..5f12858 100644
+--- a/security/capability.c
++++ b/security/capability.c
+@@ -890,7 +890,7 @@ static void cap_audit_rule_free(void *lsmrule)
+ }
+ #endif /* CONFIG_AUDIT */
+
+-struct security_operations default_security_ops = {
++struct security_operations default_security_ops __read_only = {
+ .name = "default",
+ };
+
+diff --git a/security/commoncap.c b/security/commoncap.c
+index fe30751..7702d78 100644
+--- a/security/commoncap.c
++++ b/security/commoncap.c
+@@ -27,6 +27,8 @@
+ #include <linux/sched.h>
+ #include <linux/prctl.h>
+ #include <linux/securebits.h>
++#include <linux/syslog.h>
++#include <net/sock.h>
+
+ /*
+ * If a non-root user executes a setuid-root binary in
+@@ -50,9 +52,18 @@ static void warn_setuid_and_fcaps_mixed(char *fname)
+ }
+ }
+
++#ifdef CONFIG_NET
++extern kernel_cap_t gr_cap_rtnetlink(struct sock *sk);
++#endif
++
+ int cap_netlink_send(struct sock *sk, struct sk_buff *skb)
+ {
++#ifdef CONFIG_NET
++ NETLINK_CB(skb).eff_cap = gr_cap_rtnetlink(sk);
++#else
+ NETLINK_CB(skb).eff_cap = current_cap();
++#endif
++
+ return 0;
+ }
+
+@@ -511,6 +522,11 @@ int cap_bprm_set_creds(struct linux_binprm *bprm)
+ }
+ skip:
+
++ /* if we have fs caps, clear dangerous personality flags */
++ if (!cap_issubset(new->cap_permitted, old->cap_permitted))
++ bprm->per_clear |= PER_CLEAR_ON_SETID;
++
++
+ /* Don't let someone trace a set[ug]id/setpcap binary with the revised
+ * credentials unless they have the appropriate permit
+ */
+@@ -582,6 +598,9 @@ int cap_bprm_secureexec(struct linux_binprm *bprm)
+ {
+ const struct cred *cred = current_cred();
+
++ if (gr_acl_enable_at_secure())
++ return 1;
++
+ if (cred->uid != 0) {
+ if (bprm->cap_effective)
+ return 1;
+@@ -956,13 +975,18 @@ error:
+ /**
+ * cap_syslog - Determine whether syslog function is permitted
+ * @type: Function requested
++ * @from_file: Whether this request came from an open file (i.e. /proc)
+ *
+ * Determine whether the current process is permitted to use a particular
+ * syslog function, returning 0 if permission is granted, -ve if not.
+ */
+-int cap_syslog(int type)
++int cap_syslog(int type, bool from_file)
+ {
+- if ((type != 3 && type != 10) && !capable(CAP_SYS_ADMIN))
++ /* /proc/kmsg can open be opened by CAP_SYS_ADMIN */
++ if (type != SYSLOG_ACTION_OPEN && from_file)
++ return 0;
++ if ((type != SYSLOG_ACTION_READ_ALL &&
++ type != SYSLOG_ACTION_SIZE_BUFFER) && !capable(CAP_SYS_ADMIN))
+ return -EPERM;
+ return 0;
+ }
+diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
+index 165eb53..b1db4eb 100644
+--- a/security/integrity/ima/ima.h
++++ b/security/integrity/ima/ima.h
+@@ -84,8 +84,8 @@ void ima_add_violation(struct inode *inode, const unsigned char *filename,
+ extern spinlock_t ima_queue_lock;
+
+ struct ima_h_table {
+- atomic_long_t len; /* number of stored measurements in the list */
+- atomic_long_t violations;
++ atomic_long_unchecked_t len; /* number of stored measurements in the list */
++ atomic_long_unchecked_t violations;
+ struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE];
+ };
+ extern struct ima_h_table ima_htable;
+diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
+index 852bf85..35d6df3 100644
+--- a/security/integrity/ima/ima_api.c
++++ b/security/integrity/ima/ima_api.c
+@@ -74,7 +74,7 @@ void ima_add_violation(struct inode *inode, const unsigned char *filename,
+ int result;
+
+ /* can overflow, only indicator */
+- atomic_long_inc(&ima_htable.violations);
++ atomic_long_inc_unchecked(&ima_htable.violations);
+
+ entry = kmalloc(sizeof(*entry), GFP_KERNEL);
+ if (!entry) {
+diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
+index 0c72c9c..433e29b 100644
+--- a/security/integrity/ima/ima_fs.c
++++ b/security/integrity/ima/ima_fs.c
+@@ -27,12 +27,12 @@
+ static int valid_policy = 1;
+ #define TMPBUFLEN 12
+ static ssize_t ima_show_htable_value(char __user *buf, size_t count,
+- loff_t *ppos, atomic_long_t *val)
++ loff_t *ppos, atomic_long_unchecked_t *val)
+ {
+ char tmpbuf[TMPBUFLEN];
+ ssize_t len;
+
+- len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read(val));
++ len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read_unchecked(val));
+ return simple_read_from_buffer(buf, count, ppos, tmpbuf, len);
+ }
+
+diff --git a/security/integrity/ima/ima_queue.c b/security/integrity/ima/ima_queue.c
+index e19316d..339f7ae 100644
+--- a/security/integrity/ima/ima_queue.c
++++ b/security/integrity/ima/ima_queue.c
+@@ -78,7 +78,7 @@ static int ima_add_digest_entry(struct ima_template_entry *entry)
+ INIT_LIST_HEAD(&qe->later);
+ list_add_tail_rcu(&qe->later, &ima_measurements);
+
+- atomic_long_inc(&ima_htable.len);
++ atomic_long_inc_unchecked(&ima_htable.len);
+ key = ima_hash_key(entry->digest);
+ hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]);
+ return 0;
+diff --git a/security/keys/keyring.c b/security/keys/keyring.c
+index e031952..c9a535d 100644
+--- a/security/keys/keyring.c
++++ b/security/keys/keyring.c
+@@ -214,15 +214,15 @@ static long keyring_read(const struct key *keyring,
+ ret = -EFAULT;
+
+ for (loop = 0; loop < klist->nkeys; loop++) {
++ key_serial_t serial;
+ key = klist->keys[loop];
++ serial = key->serial;
+
+ tmp = sizeof(key_serial_t);
+ if (tmp > buflen)
+ tmp = buflen;
+
+- if (copy_to_user(buffer,
+- &key->serial,
+- tmp) != 0)
++ if (copy_to_user(buffer, &serial, tmp))
+ goto error;
+
+ buflen -= tmp;
+diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
+index 931cfda..e71808a 100644
+--- a/security/keys/process_keys.c
++++ b/security/keys/process_keys.c
+@@ -208,7 +208,7 @@ static int install_process_keyring(void)
+ ret = install_process_keyring_to_cred(new);
+ if (ret < 0) {
+ abort_creds(new);
+- return ret != -EEXIST ?: 0;
++ return ret != -EEXIST ? ret : 0;
+ }
+
+ return commit_creds(new);
+diff --git a/security/min_addr.c b/security/min_addr.c
+index d9f9425..c28cef4 100644
+--- a/security/min_addr.c
++++ b/security/min_addr.c
+@@ -14,6 +14,7 @@ unsigned long dac_mmap_min_addr = CONFIG_DEFAULT_MMAP_MIN_ADDR;
+ */
+ static void update_mmap_min_addr(void)
+ {
++#ifndef SPARC
+ #ifdef CONFIG_LSM_MMAP_MIN_ADDR
+ if (dac_mmap_min_addr > CONFIG_LSM_MMAP_MIN_ADDR)
+ mmap_min_addr = dac_mmap_min_addr;
+@@ -22,6 +23,7 @@ static void update_mmap_min_addr(void)
+ #else
+ mmap_min_addr = dac_mmap_min_addr;
+ #endif
++#endif
+ }
+
+ /*
+diff --git a/security/root_plug.c b/security/root_plug.c
+index 2f7ffa6..0455400 100644
+--- a/security/root_plug.c
++++ b/security/root_plug.c
+@@ -70,7 +70,7 @@ static int rootplug_bprm_check_security (struct linux_binprm *bprm)
+ return 0;
+ }
+
+-static struct security_operations rootplug_security_ops = {
++static struct security_operations rootplug_security_ops __read_only = {
+ .bprm_check_security = rootplug_bprm_check_security,
+ };
+
+diff --git a/security/security.c b/security/security.c
+index c4c6732..7abf13b 100644
+--- a/security/security.c
++++ b/security/security.c
+@@ -24,7 +24,7 @@ static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1];
+ extern struct security_operations default_security_ops;
+ extern void security_fixup_ops(struct security_operations *ops);
+
+-struct security_operations *security_ops; /* Initialized to NULL */
++struct security_operations *security_ops __read_only; /* Initialized to NULL */
+
+ static inline int verify(struct security_operations *ops)
+ {
+@@ -106,7 +106,7 @@ int __init security_module_enable(struct security_operations *ops)
+ * If there is already a security module registered with the kernel,
+ * an error will be returned. Otherwise %0 is returned on success.
+ */
+-int register_security(struct security_operations *ops)
++int __init register_security(struct security_operations *ops)
+ {
+ if (verify(ops)) {
+ printk(KERN_DEBUG "%s could not verify "
+@@ -199,9 +199,9 @@ int security_quota_on(struct dentry *dentry)
+ return security_ops->quota_on(dentry);
+ }
+
+-int security_syslog(int type)
++int security_syslog(int type, bool from_file)
+ {
+- return security_ops->syslog(type);
++ return security_ops->syslog(type, from_file);
+ }
+
+ int security_settime(struct timespec *ts, struct timezone *tz)
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index a106754..ca3a589 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -76,6 +76,7 @@
+ #include <linux/selinux.h>
+ #include <linux/mutex.h>
+ #include <linux/posix-timers.h>
++#include <linux/syslog.h>
+
+ #include "avc.h"
+ #include "objsec.h"
+@@ -131,7 +132,7 @@ int selinux_enabled = 1;
+ * Minimal support for a secondary security module,
+ * just to allow the use of the capability module.
+ */
+-static struct security_operations *secondary_ops;
++static struct security_operations *secondary_ops __read_only;
+
+ /* Lists of inode and superblock security structures initialized
+ before the policy was loaded. */
+@@ -2050,29 +2051,30 @@ static int selinux_quota_on(struct dentry *dentry)
+ return dentry_has_perm(cred, NULL, dentry, FILE__QUOTAON);
+ }
+
+-static int selinux_syslog(int type)
++static int selinux_syslog(int type, bool from_file)
+ {
+ int rc;
+
+- rc = cap_syslog(type);
++ rc = cap_syslog(type, from_file);
+ if (rc)
+ return rc;
+
+ switch (type) {
+- case 3: /* Read last kernel messages */
+- case 10: /* Return size of the log buffer */
++ case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
++ case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
+ rc = task_has_system(current, SYSTEM__SYSLOG_READ);
+ break;
+- case 6: /* Disable logging to console */
+- case 7: /* Enable logging to console */
+- case 8: /* Set level of messages printed to console */
++ case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
++ case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
++ /* Set level of messages printed to console */
++ case SYSLOG_ACTION_CONSOLE_LEVEL:
+ rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
+ break;
+- case 0: /* Close log */
+- case 1: /* Open log */
+- case 2: /* Read from log */
+- case 4: /* Read/clear last kernel messages */
+- case 5: /* Clear ring buffer */
++ case SYSLOG_ACTION_CLOSE: /* Close log */
++ case SYSLOG_ACTION_OPEN: /* Open log */
++ case SYSLOG_ACTION_READ: /* Read from log */
++ case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
++ case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
+ default:
+ rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
+ break;
+@@ -5457,7 +5459,7 @@ static int selinux_key_getsecurity(struct key *key, char **_buffer)
+
+ #endif
+
+-static struct security_operations selinux_ops = {
++static struct security_operations selinux_ops __read_only = {
+ .name = "selinux",
+
+ .ptrace_access_check = selinux_ptrace_access_check,
+@@ -5841,7 +5843,9 @@ int selinux_disable(void)
+ avc_disable();
+
+ /* Reset security_ops to the secondary module, dummy or capability. */
++ pax_open_kernel();
+ security_ops = secondary_ops;
++ pax_close_kernel();
+
+ /* Unregister netfilter hooks. */
+ selinux_nf_ip_exit();
+diff --git a/security/selinux/include/xfrm.h b/security/selinux/include/xfrm.h
+index 13128f9..c23c736 100644
+--- a/security/selinux/include/xfrm.h
++++ b/security/selinux/include/xfrm.h
+@@ -48,7 +48,7 @@ int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall);
+
+ static inline void selinux_xfrm_notify_policyload(void)
+ {
+- atomic_inc(&flow_cache_genid);
++ atomic_inc_unchecked(&flow_cache_genid);
+ }
+ #else
+ static inline int selinux_xfrm_enabled(void)
+diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
+index ff17820..d68084c 100644
+--- a/security/selinux/ss/services.c
++++ b/security/selinux/ss/services.c
+@@ -1715,6 +1715,8 @@ int security_load_policy(void *data, size_t len)
+ int rc = 0;
+ struct policy_file file = { data, len }, *fp = &file;
+
++ pax_track_stack();
++
+ if (!ss_initialized) {
+ avtab_cache_init();
+ if (policydb_read(&policydb, fp)) {
+diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
+index c33b6bb..b51f19e 100644
+--- a/security/smack/smack_lsm.c
++++ b/security/smack/smack_lsm.c
+@@ -157,12 +157,12 @@ static int smack_ptrace_traceme(struct task_struct *ptp)
+ *
+ * Returns 0 on success, error code otherwise.
+ */
+-static int smack_syslog(int type)
++static int smack_syslog(int type, bool from_file)
+ {
+ int rc;
+ char *sp = current_security();
+
+- rc = cap_syslog(type);
++ rc = cap_syslog(type, from_file);
+ if (rc != 0)
+ return rc;
+
+@@ -3073,7 +3073,7 @@ static int smack_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
+ return 0;
+ }
+
+-struct security_operations smack_ops = {
++struct security_operations smack_ops __read_only = {
+ .name = "smack",
+
+ .ptrace_access_check = smack_ptrace_access_check,
+diff --git a/security/tomoyo/tomoyo.c b/security/tomoyo/tomoyo.c
+index 9548a09..9a5f384 100644
+--- a/security/tomoyo/tomoyo.c
++++ b/security/tomoyo/tomoyo.c
+@@ -275,7 +275,7 @@ static int tomoyo_dentry_open(struct file *f, const struct cred *cred)
+ * tomoyo_security_ops is a "struct security_operations" which is used for
+ * registering TOMOYO.
+ */
+-static struct security_operations tomoyo_security_ops = {
++static struct security_operations tomoyo_security_ops __read_only = {
+ .name = "tomoyo",
+ .cred_alloc_blank = tomoyo_cred_alloc_blank,
+ .cred_prepare = tomoyo_cred_prepare,
+diff --git a/sound/aoa/codecs/onyx.c b/sound/aoa/codecs/onyx.c
+index 84bb07d..c2ab6b6 100644
+--- a/sound/aoa/codecs/onyx.c
++++ b/sound/aoa/codecs/onyx.c
+@@ -53,7 +53,7 @@ struct onyx {
+ spdif_locked:1,
+ analog_locked:1,
+ original_mute:2;
+- int open_count;
++ local_t open_count;
+ struct codec_info *codec_info;
+
+ /* mutex serializes concurrent access to the device
+@@ -752,7 +752,7 @@ static int onyx_open(struct codec_info_item *cii,
+ struct onyx *onyx = cii->codec_data;
+
+ mutex_lock(&onyx->mutex);
+- onyx->open_count++;
++ local_inc(&onyx->open_count);
+ mutex_unlock(&onyx->mutex);
+
+ return 0;
+@@ -764,8 +764,7 @@ static int onyx_close(struct codec_info_item *cii,
+ struct onyx *onyx = cii->codec_data;
+
+ mutex_lock(&onyx->mutex);
+- onyx->open_count--;
+- if (!onyx->open_count)
++ if (local_dec_and_test(&onyx->open_count))
+ onyx->spdif_locked = onyx->analog_locked = 0;
+ mutex_unlock(&onyx->mutex);
+
+diff --git a/sound/aoa/codecs/onyx.h b/sound/aoa/codecs/onyx.h
+index ffd2025..df062c9 100644
+--- a/sound/aoa/codecs/onyx.h
++++ b/sound/aoa/codecs/onyx.h
+@@ -11,6 +11,7 @@
+ #include <linux/i2c.h>
+ #include <asm/pmac_low_i2c.h>
+ #include <asm/prom.h>
++#include <asm/local.h>
+
+ /* PCM3052 register definitions */
+
+diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
+index d9c9635..bc0a5a2 100644
+--- a/sound/core/oss/pcm_oss.c
++++ b/sound/core/oss/pcm_oss.c
+@@ -1395,7 +1395,7 @@ static ssize_t snd_pcm_oss_write1(struct snd_pcm_substream *substream, const cha
+ }
+ } else {
+ tmp = snd_pcm_oss_write2(substream,
+- (const char __force *)buf,
++ (const char __force_kernel *)buf,
+ runtime->oss.period_bytes, 0);
+ if (tmp <= 0)
+ goto err;
+@@ -1483,7 +1483,7 @@ static ssize_t snd_pcm_oss_read1(struct snd_pcm_substream *substream, char __use
+ xfer += tmp;
+ runtime->oss.buffer_used -= tmp;
+ } else {
+- tmp = snd_pcm_oss_read2(substream, (char __force *)buf,
++ tmp = snd_pcm_oss_read2(substream, (char __force_kernel *)buf,
+ runtime->oss.period_bytes, 0);
+ if (tmp <= 0)
+ goto err;
+diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c
+index 038232d..7dd9e5c 100644
+--- a/sound/core/pcm_compat.c
++++ b/sound/core/pcm_compat.c
+@@ -30,7 +30,7 @@ static int snd_pcm_ioctl_delay_compat(struct snd_pcm_substream *substream,
+ int err;
+
+ fs = snd_enter_user();
+- err = snd_pcm_delay(substream, &delay);
++ err = snd_pcm_delay(substream, (snd_pcm_sframes_t __force_user *)&delay);
+ snd_leave_user(fs);
+ if (err < 0)
+ return err;
+diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
+index e6d2d97..4843949 100644
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -2747,11 +2747,11 @@ int snd_pcm_kernel_ioctl(struct snd_pcm_substream *substream,
+ switch (substream->stream) {
+ case SNDRV_PCM_STREAM_PLAYBACK:
+ result = snd_pcm_playback_ioctl1(NULL, substream, cmd,
+- (void __user *)arg);
++ (void __force_user *)arg);
+ break;
+ case SNDRV_PCM_STREAM_CAPTURE:
+ result = snd_pcm_capture_ioctl1(NULL, substream, cmd,
+- (void __user *)arg);
++ (void __force_user *)arg);
+ break;
+ default:
+ result = -EINVAL;
+diff --git a/sound/core/seq/seq_device.c b/sound/core/seq/seq_device.c
+index 1f99767..14636533 100644
+--- a/sound/core/seq/seq_device.c
++++ b/sound/core/seq/seq_device.c
+@@ -63,7 +63,7 @@ struct ops_list {
+ int argsize; /* argument size */
+
+ /* operators */
+- struct snd_seq_dev_ops ops;
++ struct snd_seq_dev_ops *ops;
+
+ /* registred devices */
+ struct list_head dev_list; /* list of devices */
+@@ -332,7 +332,7 @@ int snd_seq_device_register_driver(char *id, struct snd_seq_dev_ops *entry,
+
+ mutex_lock(&ops->reg_mutex);
+ /* copy driver operators */
+- ops->ops = *entry;
++ ops->ops = entry;
+ ops->driver |= DRIVER_LOADED;
+ ops->argsize = argsize;
+
+@@ -462,7 +462,7 @@ static int init_device(struct snd_seq_device *dev, struct ops_list *ops)
+ dev->name, ops->id, ops->argsize, dev->argsize);
+ return -EINVAL;
+ }
+- if (ops->ops.init_device(dev) >= 0) {
++ if (ops->ops->init_device(dev) >= 0) {
+ dev->status = SNDRV_SEQ_DEVICE_REGISTERED;
+ ops->num_init_devices++;
+ } else {
+@@ -489,7 +489,7 @@ static int free_device(struct snd_seq_device *dev, struct ops_list *ops)
+ dev->name, ops->id, ops->argsize, dev->argsize);
+ return -EINVAL;
+ }
+- if ((result = ops->ops.free_device(dev)) >= 0 || result == -ENXIO) {
++ if ((result = ops->ops->free_device(dev)) >= 0 || result == -ENXIO) {
+ dev->status = SNDRV_SEQ_DEVICE_FREE;
+ dev->driver_data = NULL;
+ ops->num_init_devices--;
+diff --git a/sound/drivers/mts64.c b/sound/drivers/mts64.c
+index 9284829..ac8e8b2 100644
+--- a/sound/drivers/mts64.c
++++ b/sound/drivers/mts64.c
+@@ -27,6 +27,7 @@
+ #include <sound/initval.h>
+ #include <sound/rawmidi.h>
+ #include <sound/control.h>
++#include <asm/local.h>
+
+ #define CARD_NAME "Miditerminal 4140"
+ #define DRIVER_NAME "MTS64"
+@@ -65,7 +66,7 @@ struct mts64 {
+ struct pardevice *pardev;
+ int pardev_claimed;
+
+- int open_count;
++ local_t open_count;
+ int current_midi_output_port;
+ int current_midi_input_port;
+ u8 mode[MTS64_NUM_INPUT_PORTS];
+@@ -695,7 +696,7 @@ static int snd_mts64_rawmidi_open(struct snd_rawmidi_substream *substream)
+ {
+ struct mts64 *mts = substream->rmidi->private_data;
+
+- if (mts->open_count == 0) {
++ if (local_read(&mts->open_count) == 0) {
+ /* We don't need a spinlock here, because this is just called
+ if the device has not been opened before.
+ So there aren't any IRQs from the device */
+@@ -703,7 +704,7 @@ static int snd_mts64_rawmidi_open(struct snd_rawmidi_substream *substream)
+
+ msleep(50);
+ }
+- ++(mts->open_count);
++ local_inc(&mts->open_count);
+
+ return 0;
+ }
+@@ -713,8 +714,7 @@ static int snd_mts64_rawmidi_close(struct snd_rawmidi_substream *substream)
+ struct mts64 *mts = substream->rmidi->private_data;
+ unsigned long flags;
+
+- --(mts->open_count);
+- if (mts->open_count == 0) {
++ if (local_dec_return(&mts->open_count) == 0) {
+ /* We need the spinlock_irqsave here because we can still
+ have IRQs at this point */
+ spin_lock_irqsave(&mts->lock, flags);
+@@ -723,8 +723,8 @@ static int snd_mts64_rawmidi_close(struct snd_rawmidi_substream *substream)
+
+ msleep(500);
+
+- } else if (mts->open_count < 0)
+- mts->open_count = 0;
++ } else if (local_read(&mts->open_count) < 0)
++ local_set(&mts->open_count, 0);
+
+ return 0;
+ }
+diff --git a/sound/drivers/opl4/opl4_lib.c b/sound/drivers/opl4/opl4_lib.c
+index 01997f2..cbc1195 100644
+--- a/sound/drivers/opl4/opl4_lib.c
++++ b/sound/drivers/opl4/opl4_lib.c
+@@ -27,7 +27,7 @@ MODULE_AUTHOR("Clemens Ladisch <clemens@ladisch.de>");
+ MODULE_DESCRIPTION("OPL4 driver");
+ MODULE_LICENSE("GPL");
+
+-static void inline snd_opl4_wait(struct snd_opl4 *opl4)
++static inline void snd_opl4_wait(struct snd_opl4 *opl4)
+ {
+ int timeout = 10;
+ while ((inb(opl4->fm_port) & OPL4_STATUS_BUSY) && --timeout > 0)
+diff --git a/sound/drivers/portman2x4.c b/sound/drivers/portman2x4.c
+index 60158e2..0a0cc1a 100644
+--- a/sound/drivers/portman2x4.c
++++ b/sound/drivers/portman2x4.c
+@@ -46,6 +46,7 @@
+ #include <sound/initval.h>
+ #include <sound/rawmidi.h>
+ #include <sound/control.h>
++#include <asm/local.h>
+
+ #define CARD_NAME "Portman 2x4"
+ #define DRIVER_NAME "portman"
+@@ -83,7 +84,7 @@ struct portman {
+ struct pardevice *pardev;
+ int pardev_claimed;
+
+- int open_count;
++ local_t open_count;
+ int mode[PORTMAN_NUM_INPUT_PORTS];
+ struct snd_rawmidi_substream *midi_input[PORTMAN_NUM_INPUT_PORTS];
+ };
+diff --git a/sound/isa/cmi8330.c b/sound/isa/cmi8330.c
+index 02f79d2..8691d43 100644
+--- a/sound/isa/cmi8330.c
++++ b/sound/isa/cmi8330.c
+@@ -173,7 +173,7 @@ struct snd_cmi8330 {
+
+ struct snd_pcm *pcm;
+ struct snd_cmi8330_stream {
+- struct snd_pcm_ops ops;
++ snd_pcm_ops_no_const ops;
+ snd_pcm_open_callback_t open;
+ void *private_data; /* sb or wss */
+ } streams[2];
+diff --git a/sound/oss/sb_audio.c b/sound/oss/sb_audio.c
+index 733b014..56ce96f 100644
+--- a/sound/oss/sb_audio.c
++++ b/sound/oss/sb_audio.c
+@@ -901,7 +901,7 @@ sb16_copy_from_user(int dev,
+ buf16 = (signed short *)(localbuf + localoffs);
+ while (c)
+ {
+- locallen = (c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
++ locallen = ((unsigned)c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
+ if (copy_from_user(lbuf8,
+ userbuf+useroffs + p,
+ locallen))
+diff --git a/sound/oss/swarm_cs4297a.c b/sound/oss/swarm_cs4297a.c
+index 3136c88..28ad950 100644
+--- a/sound/oss/swarm_cs4297a.c
++++ b/sound/oss/swarm_cs4297a.c
+@@ -2577,7 +2577,6 @@ static int __init cs4297a_init(void)
+ {
+ struct cs4297a_state *s;
+ u32 pwr, id;
+- mm_segment_t fs;
+ int rval;
+ #ifndef CONFIG_BCM_CS4297A_CSWARM
+ u64 cfg;
+@@ -2667,22 +2666,23 @@ static int __init cs4297a_init(void)
+ if (!rval) {
+ char *sb1250_duart_present;
+
++#if 0
++ mm_segment_t fs;
+ fs = get_fs();
+ set_fs(KERNEL_DS);
+-#if 0
+ val = SOUND_MASK_LINE;
+ mixer_ioctl(s, SOUND_MIXER_WRITE_RECSRC, (unsigned long) &val);
+ for (i = 0; i < ARRAY_SIZE(initvol); i++) {
+ val = initvol[i].vol;
+ mixer_ioctl(s, initvol[i].mixch, (unsigned long) &val);
+ }
++ set_fs(fs);
+ // cs4297a_write_ac97(s, 0x18, 0x0808);
+ #else
+ // cs4297a_write_ac97(s, 0x5e, 0x180);
+ cs4297a_write_ac97(s, 0x02, 0x0808);
+ cs4297a_write_ac97(s, 0x18, 0x0808);
+ #endif
+- set_fs(fs);
+
+ list_add(&s->list, &cs4297a_devs);
+
+diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c
+index 78288db..0406809 100644
+--- a/sound/pci/ac97/ac97_codec.c
++++ b/sound/pci/ac97/ac97_codec.c
+@@ -1952,7 +1952,7 @@ static int snd_ac97_dev_disconnect(struct snd_device *device)
+ }
+
+ /* build_ops to do nothing */
+-static struct snd_ac97_build_ops null_build_ops;
++static const struct snd_ac97_build_ops null_build_ops;
+
+ #ifdef CONFIG_SND_AC97_POWER_SAVE
+ static void do_update_power(struct work_struct *work)
+diff --git a/sound/pci/ac97/ac97_patch.c b/sound/pci/ac97/ac97_patch.c
+index eeb2e23..82bf625 100644
+--- a/sound/pci/ac97/ac97_patch.c
++++ b/sound/pci/ac97/ac97_patch.c
+@@ -371,7 +371,7 @@ static int patch_yamaha_ymf743_build_spdif(struct snd_ac97 *ac97)
+ return 0;
+ }
+
+-static struct snd_ac97_build_ops patch_yamaha_ymf743_ops = {
++static const struct snd_ac97_build_ops patch_yamaha_ymf743_ops = {
+ .build_spdif = patch_yamaha_ymf743_build_spdif,
+ .build_3d = patch_yamaha_ymf7x3_3d,
+ };
+@@ -455,7 +455,7 @@ static int patch_yamaha_ymf753_post_spdif(struct snd_ac97 * ac97)
+ return 0;
+ }
+
+-static struct snd_ac97_build_ops patch_yamaha_ymf753_ops = {
++static const struct snd_ac97_build_ops patch_yamaha_ymf753_ops = {
+ .build_3d = patch_yamaha_ymf7x3_3d,
+ .build_post_spdif = patch_yamaha_ymf753_post_spdif
+ };
+@@ -502,7 +502,7 @@ static int patch_wolfson_wm9703_specific(struct snd_ac97 * ac97)
+ return 0;
+ }
+
+-static struct snd_ac97_build_ops patch_wolfson_wm9703_ops = {
++static const struct snd_ac97_build_ops patch_wolfson_wm9703_ops = {
+ .build_specific = patch_wolfson_wm9703_specific,
+ };
+
+@@ -533,7 +533,7 @@ static int patch_wolfson_wm9704_specific(struct snd_ac97 * ac97)
+ return 0;
+ }
+
+-static struct snd_ac97_build_ops patch_wolfson_wm9704_ops = {
++static const struct snd_ac97_build_ops patch_wolfson_wm9704_ops = {
+ .build_specific = patch_wolfson_wm9704_specific,
+ };
+
+@@ -555,7 +555,7 @@ static int patch_wolfson_wm9705_specific(struct snd_ac97 * ac97)
+ return 0;
+ }
+
+-static struct snd_ac97_build_ops patch_wolfson_wm9705_ops = {
++static const struct snd_ac97_build_ops patch_wolfson_wm9705_ops = {
+ .build_specific = patch_wolfson_wm9705_specific,
+ };
+
+@@ -692,7 +692,7 @@ static int patch_wolfson_wm9711_specific(struct snd_ac97 * ac97)
+ return 0;
+ }
+
+-static struct snd_ac97_build_ops patch_wolfson_wm9711_ops = {
++static const struct snd_ac97_build_ops patch_wolfson_wm9711_ops = {
+ .build_specific = patch_wolfson_wm9711_specific,
+ };
+
+@@ -886,7 +886,7 @@ static void patch_wolfson_wm9713_resume (struct snd_ac97 * ac97)
+ }
+ #endif
+
+-static struct snd_ac97_build_ops patch_wolfson_wm9713_ops = {
++static const struct snd_ac97_build_ops patch_wolfson_wm9713_ops = {
+ .build_specific = patch_wolfson_wm9713_specific,
+ .build_3d = patch_wolfson_wm9713_3d,
+ #ifdef CONFIG_PM
+@@ -991,7 +991,7 @@ static int patch_sigmatel_stac97xx_specific(struct snd_ac97 * ac97)
+ return 0;
+ }
+
+-static struct snd_ac97_build_ops patch_sigmatel_stac9700_ops = {
++static const struct snd_ac97_build_ops patch_sigmatel_stac9700_ops = {
+ .build_3d = patch_sigmatel_stac9700_3d,
+ .build_specific = patch_sigmatel_stac97xx_specific
+ };
+@@ -1038,7 +1038,7 @@ static int patch_sigmatel_stac9708_specific(struct snd_ac97 *ac97)
+ return patch_sigmatel_stac97xx_specific(ac97);
+ }
+
+-static struct snd_ac97_build_ops patch_sigmatel_stac9708_ops = {
++static const struct snd_ac97_build_ops patch_sigmatel_stac9708_ops = {
+ .build_3d = patch_sigmatel_stac9708_3d,
+ .build_specific = patch_sigmatel_stac9708_specific
+ };
+@@ -1267,7 +1267,7 @@ static int patch_sigmatel_stac9758_specific(struct snd_ac97 *ac97)
+ return 0;
+ }
+
+-static struct snd_ac97_build_ops patch_sigmatel_stac9758_ops = {
++static const struct snd_ac97_build_ops patch_sigmatel_stac9758_ops = {
+ .build_3d = patch_sigmatel_stac9700_3d,
+ .build_specific = patch_sigmatel_stac9758_specific
+ };
+@@ -1342,7 +1342,7 @@ static int patch_cirrus_build_spdif(struct snd_ac97 * ac97)
+ return 0;
+ }
+
+-static struct snd_ac97_build_ops patch_cirrus_ops = {
++static const struct snd_ac97_build_ops patch_cirrus_ops = {
+ .build_spdif = patch_cirrus_build_spdif
+ };
+
+@@ -1399,7 +1399,7 @@ static int patch_conexant_build_spdif(struct snd_ac97 * ac97)
+ return 0;
+ }
+
+-static struct snd_ac97_build_ops patch_conexant_ops = {
++static const struct snd_ac97_build_ops patch_conexant_ops = {
+ .build_spdif = patch_conexant_build_spdif
+ };
+
+@@ -1575,7 +1575,7 @@ static void patch_ad1881_chained(struct snd_ac97 * ac97, int unchained_idx, int
+ }
+ }
+
+-static struct snd_ac97_build_ops patch_ad1881_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1881_build_ops = {
+ #ifdef CONFIG_PM
+ .resume = ad18xx_resume
+ #endif
+@@ -1662,7 +1662,7 @@ static int patch_ad1885_specific(struct snd_ac97 * ac97)
+ return 0;
+ }
+
+-static struct snd_ac97_build_ops patch_ad1885_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1885_build_ops = {
+ .build_specific = &patch_ad1885_specific,
+ #ifdef CONFIG_PM
+ .resume = ad18xx_resume
+@@ -1689,7 +1689,7 @@ static int patch_ad1886_specific(struct snd_ac97 * ac97)
+ return 0;
+ }
+
+-static struct snd_ac97_build_ops patch_ad1886_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1886_build_ops = {
+ .build_specific = &patch_ad1886_specific,
+ #ifdef CONFIG_PM
+ .resume = ad18xx_resume
+@@ -1896,7 +1896,7 @@ static int patch_ad1981a_specific(struct snd_ac97 * ac97)
+ ARRAY_SIZE(snd_ac97_ad1981x_jack_sense));
+ }
+
+-static struct snd_ac97_build_ops patch_ad1981a_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1981a_build_ops = {
+ .build_post_spdif = patch_ad198x_post_spdif,
+ .build_specific = patch_ad1981a_specific,
+ #ifdef CONFIG_PM
+@@ -1952,7 +1952,7 @@ static int patch_ad1981b_specific(struct snd_ac97 *ac97)
+ ARRAY_SIZE(snd_ac97_ad1981x_jack_sense));
+ }
+
+-static struct snd_ac97_build_ops patch_ad1981b_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1981b_build_ops = {
+ .build_post_spdif = patch_ad198x_post_spdif,
+ .build_specific = patch_ad1981b_specific,
+ #ifdef CONFIG_PM
+@@ -2091,7 +2091,7 @@ static int patch_ad1888_specific(struct snd_ac97 *ac97)
+ return patch_build_controls(ac97, snd_ac97_ad1888_controls, ARRAY_SIZE(snd_ac97_ad1888_controls));
+ }
+
+-static struct snd_ac97_build_ops patch_ad1888_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1888_build_ops = {
+ .build_post_spdif = patch_ad198x_post_spdif,
+ .build_specific = patch_ad1888_specific,
+ #ifdef CONFIG_PM
+@@ -2140,7 +2140,7 @@ static int patch_ad1980_specific(struct snd_ac97 *ac97)
+ return patch_build_controls(ac97, &snd_ac97_ad198x_2cmic, 1);
+ }
+
+-static struct snd_ac97_build_ops patch_ad1980_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1980_build_ops = {
+ .build_post_spdif = patch_ad198x_post_spdif,
+ .build_specific = patch_ad1980_specific,
+ #ifdef CONFIG_PM
+@@ -2255,7 +2255,7 @@ static int patch_ad1985_specific(struct snd_ac97 *ac97)
+ ARRAY_SIZE(snd_ac97_ad1985_controls));
+ }
+
+-static struct snd_ac97_build_ops patch_ad1985_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1985_build_ops = {
+ .build_post_spdif = patch_ad198x_post_spdif,
+ .build_specific = patch_ad1985_specific,
+ #ifdef CONFIG_PM
+@@ -2547,7 +2547,7 @@ static int patch_ad1986_specific(struct snd_ac97 *ac97)
+ ARRAY_SIZE(snd_ac97_ad1985_controls));
+ }
+
+-static struct snd_ac97_build_ops patch_ad1986_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1986_build_ops = {
+ .build_post_spdif = patch_ad198x_post_spdif,
+ .build_specific = patch_ad1986_specific,
+ #ifdef CONFIG_PM
+@@ -2652,7 +2652,7 @@ static int patch_alc650_specific(struct snd_ac97 * ac97)
+ return 0;
+ }
+
+-static struct snd_ac97_build_ops patch_alc650_ops = {
++static const struct snd_ac97_build_ops patch_alc650_ops = {
+ .build_specific = patch_alc650_specific,
+ .update_jacks = alc650_update_jacks
+ };
+@@ -2804,7 +2804,7 @@ static int patch_alc655_specific(struct snd_ac97 * ac97)
+ return 0;
+ }
+
+-static struct snd_ac97_build_ops patch_alc655_ops = {
++static const struct snd_ac97_build_ops patch_alc655_ops = {
+ .build_specific = patch_alc655_specific,
+ .update_jacks = alc655_update_jacks
+ };
+@@ -2916,7 +2916,7 @@ static int patch_alc850_specific(struct snd_ac97 *ac97)
+ return 0;
+ }
+
+-static struct snd_ac97_build_ops patch_alc850_ops = {
++static const struct snd_ac97_build_ops patch_alc850_ops = {
+ .build_specific = patch_alc850_specific,
+ .update_jacks = alc850_update_jacks
+ };
+@@ -2978,7 +2978,7 @@ static int patch_cm9738_specific(struct snd_ac97 * ac97)
+ return patch_build_controls(ac97, snd_ac97_cm9738_controls, ARRAY_SIZE(snd_ac97_cm9738_controls));
+ }
+
+-static struct snd_ac97_build_ops patch_cm9738_ops = {
++static const struct snd_ac97_build_ops patch_cm9738_ops = {
+ .build_specific = patch_cm9738_specific,
+ .update_jacks = cm9738_update_jacks
+ };
+@@ -3069,7 +3069,7 @@ static int patch_cm9739_post_spdif(struct snd_ac97 * ac97)
+ return patch_build_controls(ac97, snd_ac97_cm9739_controls_spdif, ARRAY_SIZE(snd_ac97_cm9739_controls_spdif));
+ }
+
+-static struct snd_ac97_build_ops patch_cm9739_ops = {
++static const struct snd_ac97_build_ops patch_cm9739_ops = {
+ .build_specific = patch_cm9739_specific,
+ .build_post_spdif = patch_cm9739_post_spdif,
+ .update_jacks = cm9739_update_jacks
+@@ -3243,7 +3243,7 @@ static int patch_cm9761_specific(struct snd_ac97 * ac97)
+ return patch_build_controls(ac97, snd_ac97_cm9761_controls, ARRAY_SIZE(snd_ac97_cm9761_controls));
+ }
+
+-static struct snd_ac97_build_ops patch_cm9761_ops = {
++static const struct snd_ac97_build_ops patch_cm9761_ops = {
+ .build_specific = patch_cm9761_specific,
+ .build_post_spdif = patch_cm9761_post_spdif,
+ .update_jacks = cm9761_update_jacks
+@@ -3339,7 +3339,7 @@ static int patch_cm9780_specific(struct snd_ac97 *ac97)
+ return patch_build_controls(ac97, cm9780_controls, ARRAY_SIZE(cm9780_controls));
+ }
+
+-static struct snd_ac97_build_ops patch_cm9780_ops = {
++static const struct snd_ac97_build_ops patch_cm9780_ops = {
+ .build_specific = patch_cm9780_specific,
+ .build_post_spdif = patch_cm9761_post_spdif /* identical with CM9761 */
+ };
+@@ -3459,7 +3459,7 @@ static int patch_vt1616_specific(struct snd_ac97 * ac97)
+ return 0;
+ }
+
+-static struct snd_ac97_build_ops patch_vt1616_ops = {
++static const struct snd_ac97_build_ops patch_vt1616_ops = {
+ .build_specific = patch_vt1616_specific
+ };
+
+@@ -3813,7 +3813,7 @@ static int patch_it2646_specific(struct snd_ac97 * ac97)
+ return 0;
+ }
+
+-static struct snd_ac97_build_ops patch_it2646_ops = {
++static const struct snd_ac97_build_ops patch_it2646_ops = {
+ .build_specific = patch_it2646_specific,
+ .update_jacks = it2646_update_jacks
+ };
+@@ -3847,7 +3847,7 @@ static int patch_si3036_specific(struct snd_ac97 * ac97)
+ return 0;
+ }
+
+-static struct snd_ac97_build_ops patch_si3036_ops = {
++static const struct snd_ac97_build_ops patch_si3036_ops = {
+ .build_specific = patch_si3036_specific,
+ };
+
+@@ -3914,7 +3914,7 @@ static int patch_ucb1400_specific(struct snd_ac97 * ac97)
+ return 0;
+ }
+
+-static struct snd_ac97_build_ops patch_ucb1400_ops = {
++static const struct snd_ac97_build_ops patch_ucb1400_ops = {
+ .build_specific = patch_ucb1400_specific,
+ };
+
+diff --git a/sound/pci/hda/hda_codec.h b/sound/pci/hda/hda_codec.h
+index 99552fb..4dcc2c5 100644
+--- a/sound/pci/hda/hda_codec.h
++++ b/sound/pci/hda/hda_codec.h
+@@ -580,7 +580,7 @@ struct hda_bus_ops {
+ /* notify power-up/down from codec to controller */
+ void (*pm_notify)(struct hda_bus *bus);
+ #endif
+-};
++} __no_const;
+
+ /* template to pass to the bus constructor */
+ struct hda_bus_template {
+@@ -675,6 +675,7 @@ struct hda_codec_ops {
+ int (*check_power_status)(struct hda_codec *codec, hda_nid_t nid);
+ #endif
+ };
++typedef struct hda_codec_ops __no_const hda_codec_ops_no_const;
+
+ /* record for amp information cache */
+ struct hda_cache_head {
+@@ -705,7 +706,7 @@ struct hda_pcm_ops {
+ struct snd_pcm_substream *substream);
+ int (*cleanup)(struct hda_pcm_stream *info, struct hda_codec *codec,
+ struct snd_pcm_substream *substream);
+-};
++} __no_const;
+
+ /* PCM information for each substream */
+ struct hda_pcm_stream {
+@@ -760,7 +761,7 @@ struct hda_codec {
+ const char *modelname; /* model name for preset */
+
+ /* set by patch */
+- struct hda_codec_ops patch_ops;
++ hda_codec_ops_no_const patch_ops;
+
+ /* PCM to create, set by patch_ops.build_pcms callback */
+ unsigned int num_pcms;
+diff --git a/sound/pci/hda/patch_atihdmi.c b/sound/pci/hda/patch_atihdmi.c
+index fb684f0..2b11cea 100644
+--- a/sound/pci/hda/patch_atihdmi.c
++++ b/sound/pci/hda/patch_atihdmi.c
+@@ -177,7 +177,7 @@ static int patch_atihdmi(struct hda_codec *codec)
+ */
+ spec->multiout.dig_out_nid = CVT_NID;
+
+- codec->patch_ops = atihdmi_patch_ops;
++ memcpy((void *)&codec->patch_ops, &atihdmi_patch_ops, sizeof(atihdmi_patch_ops));
+
+ return 0;
+ }
+diff --git a/sound/pci/hda/patch_intelhdmi.c b/sound/pci/hda/patch_intelhdmi.c
+index 7c23016..c5bfdd7 100644
+--- a/sound/pci/hda/patch_intelhdmi.c
++++ b/sound/pci/hda/patch_intelhdmi.c
+@@ -511,10 +511,10 @@ static void hdmi_non_intrinsic_event(struct hda_codec *codec, unsigned int res)
+ cp_ready);
+
+ /* TODO */
+- if (cp_state)
+- ;
+- if (cp_ready)
+- ;
++ if (cp_state) {
++ }
++ if (cp_ready) {
++ }
+ }
+
+
+@@ -656,7 +656,7 @@ static int do_patch_intel_hdmi(struct hda_codec *codec)
+ spec->multiout.dig_out_nid = cvt_nid;
+
+ codec->spec = spec;
+- codec->patch_ops = intel_hdmi_patch_ops;
++ memcpy((void *)&codec->patch_ops, &intel_hdmi_patch_ops, sizeof(intel_hdmi_patch_ops));
+
+ snd_hda_eld_proc_new(codec, &spec->sink_eld);
+
+diff --git a/sound/pci/hda/patch_nvhdmi.c b/sound/pci/hda/patch_nvhdmi.c
+index 6afdab0..68ed352 100644
+--- a/sound/pci/hda/patch_nvhdmi.c
++++ b/sound/pci/hda/patch_nvhdmi.c
+@@ -367,7 +367,7 @@ static int patch_nvhdmi_8ch(struct hda_codec *codec)
+ spec->multiout.max_channels = 8;
+ spec->multiout.dig_out_nid = Nv_Master_Convert_nid;
+
+- codec->patch_ops = nvhdmi_patch_ops_8ch;
++ memcpy((void *)&codec->patch_ops, &nvhdmi_patch_ops_8ch, sizeof(nvhdmi_patch_ops_8ch));
+
+ return 0;
+ }
+@@ -386,7 +386,7 @@ static int patch_nvhdmi_2ch(struct hda_codec *codec)
+ spec->multiout.max_channels = 2;
+ spec->multiout.dig_out_nid = Nv_Master_Convert_nid;
+
+- codec->patch_ops = nvhdmi_patch_ops_2ch;
++ memcpy((void *)&codec->patch_ops, &nvhdmi_patch_ops_2ch, sizeof(nvhdmi_patch_ops_2ch));
+
+ return 0;
+ }
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index 2fcd70d..a143eaf 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -5220,7 +5220,7 @@ again:
+ snd_hda_codec_write_cache(codec, nid, 0,
+ AC_VERB_SET_CONNECT_SEL, num_dacs);
+
+- codec->patch_ops = stac92xx_patch_ops;
++ memcpy((void *)&codec->patch_ops, &stac92xx_patch_ops, sizeof(stac92xx_patch_ops));
+
+ codec->proc_widget_hook = stac92hd_proc_hook;
+
+@@ -5294,7 +5294,7 @@ static int patch_stac92hd71bxx(struct hda_codec *codec)
+ return -ENOMEM;
+
+ codec->spec = spec;
+- codec->patch_ops = stac92xx_patch_ops;
++ memcpy((void *)&codec->patch_ops, &stac92xx_patch_ops, sizeof(stac92xx_patch_ops));
+ spec->num_pins = STAC92HD71BXX_NUM_PINS;
+ switch (codec->vendor_id) {
+ case 0x111d76b6:
+diff --git a/sound/pci/ice1712/ice1712.h b/sound/pci/ice1712/ice1712.h
+index d063149..01599a4 100644
+--- a/sound/pci/ice1712/ice1712.h
++++ b/sound/pci/ice1712/ice1712.h
+@@ -269,7 +269,7 @@ struct snd_ak4xxx_private {
+ unsigned int mask_flags; /* total mask bits */
+ struct snd_akm4xxx_ops {
+ void (*set_rate_val)(struct snd_akm4xxx *ak, unsigned int rate);
+- } ops;
++ } __no_const ops;
+ };
+
+ struct snd_ice1712_spdif {
+@@ -285,7 +285,7 @@ struct snd_ice1712_spdif {
+ int (*default_put)(struct snd_ice1712 *, struct snd_ctl_elem_value *ucontrol);
+ void (*stream_get)(struct snd_ice1712 *, struct snd_ctl_elem_value *ucontrol);
+ int (*stream_put)(struct snd_ice1712 *, struct snd_ctl_elem_value *ucontrol);
+- } ops;
++ } __no_const ops;
+ };
+
+
+diff --git a/sound/pci/intel8x0m.c b/sound/pci/intel8x0m.c
+index 9e7d12e..3e3bc64 100644
+--- a/sound/pci/intel8x0m.c
++++ b/sound/pci/intel8x0m.c
+@@ -1264,7 +1264,7 @@ static struct shortname_table {
+ { 0x5455, "ALi M5455" },
+ { 0x746d, "AMD AMD8111" },
+ #endif
+- { 0 },
++ { 0, },
+ };
+
+ static int __devinit snd_intel8x0m_probe(struct pci_dev *pci,
+diff --git a/sound/pci/ymfpci/ymfpci_main.c b/sound/pci/ymfpci/ymfpci_main.c
+index 5518371..45cf7ac 100644
+--- a/sound/pci/ymfpci/ymfpci_main.c
++++ b/sound/pci/ymfpci/ymfpci_main.c
+@@ -202,8 +202,8 @@ static void snd_ymfpci_hw_stop(struct snd_ymfpci *chip)
+ if ((snd_ymfpci_readl(chip, YDSXGR_STATUS) & 2) == 0)
+ break;
+ }
+- if (atomic_read(&chip->interrupt_sleep_count)) {
+- atomic_set(&chip->interrupt_sleep_count, 0);
++ if (atomic_read_unchecked(&chip->interrupt_sleep_count)) {
++ atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
+ wake_up(&chip->interrupt_sleep);
+ }
+ __end:
+@@ -787,7 +787,7 @@ static void snd_ymfpci_irq_wait(struct snd_ymfpci *chip)
+ continue;
+ init_waitqueue_entry(&wait, current);
+ add_wait_queue(&chip->interrupt_sleep, &wait);
+- atomic_inc(&chip->interrupt_sleep_count);
++ atomic_inc_unchecked(&chip->interrupt_sleep_count);
+ schedule_timeout_uninterruptible(msecs_to_jiffies(50));
+ remove_wait_queue(&chip->interrupt_sleep, &wait);
+ }
+@@ -825,8 +825,8 @@ static irqreturn_t snd_ymfpci_interrupt(int irq, void *dev_id)
+ snd_ymfpci_writel(chip, YDSXGR_MODE, mode);
+ spin_unlock(&chip->reg_lock);
+
+- if (atomic_read(&chip->interrupt_sleep_count)) {
+- atomic_set(&chip->interrupt_sleep_count, 0);
++ if (atomic_read_unchecked(&chip->interrupt_sleep_count)) {
++ atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
+ wake_up(&chip->interrupt_sleep);
+ }
+ }
+@@ -2369,7 +2369,7 @@ int __devinit snd_ymfpci_create(struct snd_card *card,
+ spin_lock_init(&chip->reg_lock);
+ spin_lock_init(&chip->voice_lock);
+ init_waitqueue_head(&chip->interrupt_sleep);
+- atomic_set(&chip->interrupt_sleep_count, 0);
++ atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
+ chip->card = card;
+ chip->pci = pci;
+ chip->irq = -1;
+diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
+index 0a1b2f6..776bb19 100644
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -609,7 +609,7 @@ static int soc_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
+ }
+
+ /* ASoC PCM operations */
+-static struct snd_pcm_ops soc_pcm_ops = {
++static snd_pcm_ops_no_const soc_pcm_ops = {
+ .open = soc_pcm_open,
+ .close = soc_codec_close,
+ .hw_params = soc_pcm_hw_params,
+diff --git a/sound/usb/usbaudio.c b/sound/usb/usbaudio.c
+index 79633ea..9732e90 100644
+--- a/sound/usb/usbaudio.c
++++ b/sound/usb/usbaudio.c
+@@ -963,12 +963,12 @@ static int snd_usb_pcm_playback_trigger(struct snd_pcm_substream *substream,
+ switch (cmd) {
+ case SNDRV_PCM_TRIGGER_START:
+ case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+- subs->ops.prepare = prepare_playback_urb;
++ *(void **)&subs->ops.prepare = prepare_playback_urb;
+ return 0;
+ case SNDRV_PCM_TRIGGER_STOP:
+ return deactivate_urbs(subs, 0, 0);
+ case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+- subs->ops.prepare = prepare_nodata_playback_urb;
++ *(void **)&subs->ops.prepare = prepare_nodata_playback_urb;
+ return 0;
+ default:
+ return -EINVAL;
+@@ -985,15 +985,15 @@ static int snd_usb_pcm_capture_trigger(struct snd_pcm_substream *substream,
+
+ switch (cmd) {
+ case SNDRV_PCM_TRIGGER_START:
+- subs->ops.retire = retire_capture_urb;
++ *(void **)&subs->ops.retire = retire_capture_urb;
+ return start_urbs(subs, substream->runtime);
+ case SNDRV_PCM_TRIGGER_STOP:
+ return deactivate_urbs(subs, 0, 0);
+ case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+- subs->ops.retire = retire_paused_capture_urb;
++ *(void **)&subs->ops.retire = retire_paused_capture_urb;
+ return 0;
+ case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+- subs->ops.retire = retire_capture_urb;
++ *(void **)&subs->ops.retire = retire_capture_urb;
+ return 0;
+ default:
+ return -EINVAL;
+@@ -1542,7 +1542,7 @@ static int snd_usb_pcm_prepare(struct snd_pcm_substream *substream)
+ /* for playback, submit the URBs now; otherwise, the first hwptr_done
+ * updates for all URBs would happen at the same time when starting */
+ if (subs->direction == SNDRV_PCM_STREAM_PLAYBACK) {
+- subs->ops.prepare = prepare_nodata_playback_urb;
++ *(void **)&subs->ops.prepare = prepare_nodata_playback_urb;
+ return start_urbs(subs, runtime);
+ } else
+ return 0;
+@@ -2228,14 +2228,14 @@ static void init_substream(struct snd_usb_stream *as, int stream, struct audiofo
+ subs->direction = stream;
+ subs->dev = as->chip->dev;
+ if (snd_usb_get_speed(subs->dev) == USB_SPEED_FULL) {
+- subs->ops = audio_urb_ops[stream];
++ memcpy((void *)&subs->ops, &audio_urb_ops[stream], sizeof(subs->ops));
+ } else {
+- subs->ops = audio_urb_ops_high_speed[stream];
++ memcpy((void *)&subs->ops, &audio_urb_ops_high_speed[stream], sizeof(subs->ops));
+ switch (as->chip->usb_id) {
+ case USB_ID(0x041e, 0x3f02): /* E-Mu 0202 USB */
+ case USB_ID(0x041e, 0x3f04): /* E-Mu 0404 USB */
+ case USB_ID(0x041e, 0x3f0a): /* E-Mu Tracker Pre */
+- subs->ops.retire_sync = retire_playback_sync_urb_hs_emu;
++ *(void **)&subs->ops.retire_sync = retire_playback_sync_urb_hs_emu;
+ break;
+ }
+ }
+diff --git a/tools/gcc/Makefile b/tools/gcc/Makefile
+new file mode 100644
+index 0000000..ca64170
+--- /dev/null
++++ b/tools/gcc/Makefile
+@@ -0,0 +1,26 @@
++#CC := gcc
++#PLUGIN_SOURCE_FILES := pax_plugin.c
++#PLUGIN_OBJECT_FILES := $(patsubst %.c,%.o,$(PLUGIN_SOURCE_FILES))
++GCCPLUGINS_DIR := $(shell $(CC) -print-file-name=plugin)
++#CFLAGS += -I$(GCCPLUGINS_DIR)/include -fPIC -O2 -Wall -W -std=gnu99
++
++HOST_EXTRACFLAGS += -I$(GCCPLUGINS_DIR)/include -I$(GCCPLUGINS_DIR)/include/c-family -std=gnu99 -ggdb
++CFLAGS_size_overflow_plugin.o := -Wno-missing-initializer
++
++hostlibs-y := constify_plugin.so
++hostlibs-$(CONFIG_PAX_MEMORY_STACKLEAK) += stackleak_plugin.so
++hostlibs-$(CONFIG_KALLOCSTAT_PLUGIN) += kallocstat_plugin.so
++hostlibs-$(CONFIG_PAX_KERNEXEC_PLUGIN) += kernexec_plugin.so
++hostlibs-$(CONFIG_CHECKER_PLUGIN) += checker_plugin.so
++hostlibs-y += colorize_plugin.so
++hostlibs-$(CONFIG_PAX_SIZE_OVERFLOW) += size_overflow_plugin.so
++
++always := $(hostlibs-y)
++
++constify_plugin-objs := constify_plugin.o
++stackleak_plugin-objs := stackleak_plugin.o
++kallocstat_plugin-objs := kallocstat_plugin.o
++kernexec_plugin-objs := kernexec_plugin.o
++checker_plugin-objs := checker_plugin.o
++colorize_plugin-objs := colorize_plugin.o
++size_overflow_plugin-objs := size_overflow_plugin.o
+diff --git a/tools/gcc/checker_plugin.c b/tools/gcc/checker_plugin.c
+new file mode 100644
+index 0000000..d41b5af
+--- /dev/null
++++ b/tools/gcc/checker_plugin.c
+@@ -0,0 +1,171 @@
++/*
++ * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
++ * Licensed under the GPL v2
++ *
++ * Note: the choice of the license means that the compilation process is
++ * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
++ * but for the kernel it doesn't matter since it doesn't link against
++ * any of the gcc libraries
++ *
++ * gcc plugin to implement various sparse (source code checker) features
++ *
++ * TODO:
++ * - define separate __iomem, __percpu and __rcu address spaces (lots of code to patch)
++ *
++ * BUGS:
++ * - none known
++ */
++#include "gcc-plugin.h"
++#include "config.h"
++#include "system.h"
++#include "coretypes.h"
++#include "tree.h"
++#include "tree-pass.h"
++#include "flags.h"
++#include "intl.h"
++#include "toplev.h"
++#include "plugin.h"
++//#include "expr.h" where are you...
++#include "diagnostic.h"
++#include "plugin-version.h"
++#include "tm.h"
++#include "function.h"
++#include "basic-block.h"
++#include "gimple.h"
++#include "rtl.h"
++#include "emit-rtl.h"
++#include "tree-flow.h"
++#include "target.h"
++
++extern void c_register_addr_space (const char *str, addr_space_t as);
++extern enum machine_mode default_addr_space_pointer_mode (addr_space_t);
++extern enum machine_mode default_addr_space_address_mode (addr_space_t);
++extern bool default_addr_space_valid_pointer_mode(enum machine_mode mode, addr_space_t as);
++extern bool default_addr_space_legitimate_address_p(enum machine_mode mode, rtx mem, bool strict, addr_space_t as);
++extern rtx default_addr_space_legitimize_address(rtx x, rtx oldx, enum machine_mode mode, addr_space_t as);
++
++extern void print_gimple_stmt(FILE *, gimple, int, int);
++extern rtx emit_move_insn(rtx x, rtx y);
++
++int plugin_is_GPL_compatible;
++
++static struct plugin_info checker_plugin_info = {
++ .version = "201111150100",
++};
++
++#define ADDR_SPACE_KERNEL 0
++#define ADDR_SPACE_FORCE_KERNEL 1
++#define ADDR_SPACE_USER 2
++#define ADDR_SPACE_FORCE_USER 3
++#define ADDR_SPACE_IOMEM 0
++#define ADDR_SPACE_FORCE_IOMEM 0
++#define ADDR_SPACE_PERCPU 0
++#define ADDR_SPACE_FORCE_PERCPU 0
++#define ADDR_SPACE_RCU 0
++#define ADDR_SPACE_FORCE_RCU 0
++
++static enum machine_mode checker_addr_space_pointer_mode(addr_space_t addrspace)
++{
++ return default_addr_space_pointer_mode(ADDR_SPACE_GENERIC);
++}
++
++static enum machine_mode checker_addr_space_address_mode(addr_space_t addrspace)
++{
++ return default_addr_space_address_mode(ADDR_SPACE_GENERIC);
++}
++
++static bool checker_addr_space_valid_pointer_mode(enum machine_mode mode, addr_space_t as)
++{
++ return default_addr_space_valid_pointer_mode(mode, as);
++}
++
++static bool checker_addr_space_legitimate_address_p(enum machine_mode mode, rtx mem, bool strict, addr_space_t as)
++{
++ return default_addr_space_legitimate_address_p(mode, mem, strict, ADDR_SPACE_GENERIC);
++}
++
++static rtx checker_addr_space_legitimize_address(rtx x, rtx oldx, enum machine_mode mode, addr_space_t as)
++{
++ return default_addr_space_legitimize_address(x, oldx, mode, as);
++}
++
++static bool checker_addr_space_subset_p(addr_space_t subset, addr_space_t superset)
++{
++ if (subset == ADDR_SPACE_FORCE_KERNEL && superset == ADDR_SPACE_KERNEL)
++ return true;
++
++ if (subset == ADDR_SPACE_FORCE_USER && superset == ADDR_SPACE_USER)
++ return true;
++
++ if (subset == ADDR_SPACE_FORCE_IOMEM && superset == ADDR_SPACE_IOMEM)
++ return true;
++
++ if (subset == ADDR_SPACE_KERNEL && superset == ADDR_SPACE_FORCE_USER)
++ return true;
++
++ if (subset == ADDR_SPACE_KERNEL && superset == ADDR_SPACE_FORCE_IOMEM)
++ return true;
++
++ if (subset == ADDR_SPACE_USER && superset == ADDR_SPACE_FORCE_KERNEL)
++ return true;
++
++ if (subset == ADDR_SPACE_IOMEM && superset == ADDR_SPACE_FORCE_KERNEL)
++ return true;
++
++ return subset == superset;
++}
++
++static rtx checker_addr_space_convert(rtx op, tree from_type, tree to_type)
++{
++// addr_space_t from_as = TYPE_ADDR_SPACE(TREE_TYPE(from_type));
++// addr_space_t to_as = TYPE_ADDR_SPACE(TREE_TYPE(to_type));
++
++ return op;
++}
++
++static void register_checker_address_spaces(void *event_data, void *data)
++{
++ c_register_addr_space("__kernel", ADDR_SPACE_KERNEL);
++ c_register_addr_space("__force_kernel", ADDR_SPACE_FORCE_KERNEL);
++ c_register_addr_space("__user", ADDR_SPACE_USER);
++ c_register_addr_space("__force_user", ADDR_SPACE_FORCE_USER);
++// c_register_addr_space("__iomem", ADDR_SPACE_IOMEM);
++// c_register_addr_space("__force_iomem", ADDR_SPACE_FORCE_IOMEM);
++// c_register_addr_space("__percpu", ADDR_SPACE_PERCPU);
++// c_register_addr_space("__force_percpu", ADDR_SPACE_FORCE_PERCPU);
++// c_register_addr_space("__rcu", ADDR_SPACE_RCU);
++// c_register_addr_space("__force_rcu", ADDR_SPACE_FORCE_RCU);
++
++ targetm.addr_space.pointer_mode = checker_addr_space_pointer_mode;
++ targetm.addr_space.address_mode = checker_addr_space_address_mode;
++ targetm.addr_space.valid_pointer_mode = checker_addr_space_valid_pointer_mode;
++ targetm.addr_space.legitimate_address_p = checker_addr_space_legitimate_address_p;
++// targetm.addr_space.legitimize_address = checker_addr_space_legitimize_address;
++ targetm.addr_space.subset_p = checker_addr_space_subset_p;
++ targetm.addr_space.convert = checker_addr_space_convert;
++}
++
++int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
++{
++ const char * const plugin_name = plugin_info->base_name;
++ const int argc = plugin_info->argc;
++ const struct plugin_argument * const argv = plugin_info->argv;
++ int i;
++
++ if (!plugin_default_version_check(version, &gcc_version)) {
++ error(G_("incompatible gcc/plugin versions"));
++ return 1;
++ }
++
++ register_callback(plugin_name, PLUGIN_INFO, NULL, &checker_plugin_info);
++
++ for (i = 0; i < argc; ++i)
++ error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
++
++ if (TARGET_64BIT == 0)
++ return 0;
++
++ register_callback(plugin_name, PLUGIN_PRAGMAS, register_checker_address_spaces, NULL);
++
++ return 0;
++}
+diff --git a/tools/gcc/colorize_plugin.c b/tools/gcc/colorize_plugin.c
+new file mode 100644
+index 0000000..ee950d0
+--- /dev/null
++++ b/tools/gcc/colorize_plugin.c
+@@ -0,0 +1,147 @@
++/*
++ * Copyright 2012 by PaX Team <pageexec@freemail.hu>
++ * Licensed under the GPL v2
++ *
++ * Note: the choice of the license means that the compilation process is
++ * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
++ * but for the kernel it doesn't matter since it doesn't link against
++ * any of the gcc libraries
++ *
++ * gcc plugin to colorize diagnostic output
++ *
++ */
++
++#include "gcc-plugin.h"
++#include "config.h"
++#include "system.h"
++#include "coretypes.h"
++#include "tree.h"
++#include "tree-pass.h"
++#include "flags.h"
++#include "intl.h"
++#include "toplev.h"
++#include "plugin.h"
++#include "diagnostic.h"
++#include "plugin-version.h"
++#include "tm.h"
++
++int plugin_is_GPL_compatible;
++
++static struct plugin_info colorize_plugin_info = {
++ .version = "201203092200",
++};
++
++#define GREEN "\033[32m\033[2m"
++#define LIGHTGREEN "\033[32m\033[1m"
++#define YELLOW "\033[33m\033[2m"
++#define LIGHTYELLOW "\033[33m\033[1m"
++#define RED "\033[31m\033[2m"
++#define LIGHTRED "\033[31m\033[1m"
++#define BLUE "\033[34m\033[2m"
++#define LIGHTBLUE "\033[34m\033[1m"
++#define BRIGHT "\033[m\033[1m"
++#define NORMAL "\033[m"
++
++static diagnostic_starter_fn old_starter;
++static diagnostic_finalizer_fn old_finalizer;
++
++static void start_colorize(diagnostic_context *context, diagnostic_info *diagnostic)
++{
++ const char *color;
++ char *newprefix;
++
++ switch (diagnostic->kind) {
++ case DK_NOTE:
++ color = LIGHTBLUE;
++ break;
++
++ case DK_PEDWARN:
++ case DK_WARNING:
++ color = LIGHTYELLOW;
++ break;
++
++ case DK_ERROR:
++ case DK_FATAL:
++ case DK_ICE:
++ case DK_PERMERROR:
++ case DK_SORRY:
++ color = LIGHTRED;
++ break;
++
++ default:
++ color = NORMAL;
++ }
++
++ old_starter(context, diagnostic);
++ if (-1 == asprintf(&newprefix, "%s%s" NORMAL, color, context->printer->prefix))
++ return;
++ pp_destroy_prefix(context->printer);
++ pp_set_prefix(context->printer, newprefix);
++}
++
++static void finalize_colorize(diagnostic_context *context, diagnostic_info *diagnostic)
++{
++ old_finalizer(context, diagnostic);
++}
++
++static void colorize_arm(void)
++{
++ old_starter = diagnostic_starter(global_dc);
++ old_finalizer = diagnostic_finalizer(global_dc);
++
++ diagnostic_starter(global_dc) = start_colorize;
++ diagnostic_finalizer(global_dc) = finalize_colorize;
++}
++
++static unsigned int execute_colorize_rearm(void)
++{
++ if (diagnostic_starter(global_dc) == start_colorize)
++ return 0;
++
++ colorize_arm();
++ return 0;
++}
++
++struct simple_ipa_opt_pass pass_ipa_colorize_rearm = {
++ .pass = {
++ .type = SIMPLE_IPA_PASS,
++ .name = "colorize_rearm",
++ .gate = NULL,
++ .execute = execute_colorize_rearm,
++ .sub = NULL,
++ .next = NULL,
++ .static_pass_number = 0,
++ .tv_id = TV_NONE,
++ .properties_required = 0,
++ .properties_provided = 0,
++ .properties_destroyed = 0,
++ .todo_flags_start = 0,
++ .todo_flags_finish = 0
++ }
++};
++
++static void colorize_start_unit(void *gcc_data, void *user_data)
++{
++ colorize_arm();
++}
++
++int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
++{
++ const char * const plugin_name = plugin_info->base_name;
++ struct register_pass_info colorize_rearm_pass_info = {
++ .pass = &pass_ipa_colorize_rearm.pass,
++ .reference_pass_name = "*free_lang_data",
++ .ref_pass_instance_number = 0,
++ .pos_op = PASS_POS_INSERT_AFTER
++ };
++
++ if (!plugin_default_version_check(version, &gcc_version)) {
++ error(G_("incompatible gcc/plugin versions"));
++ return 1;
++ }
++
++ register_callback(plugin_name, PLUGIN_INFO, NULL, &colorize_plugin_info);
++ register_callback(plugin_name, PLUGIN_START_UNIT, &colorize_start_unit, NULL);
++ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &colorize_rearm_pass_info);
++ return 0;
++}
+diff --git a/tools/gcc/constify_plugin.c b/tools/gcc/constify_plugin.c
+new file mode 100644
+index 0000000..88a7438
+--- /dev/null
++++ b/tools/gcc/constify_plugin.c
+@@ -0,0 +1,303 @@
++/*
++ * Copyright 2011 by Emese Revfy <re.emese@gmail.com>
++ * Copyright 2011 by PaX Team <pageexec@freemail.hu>
++ * Licensed under the GPL v2, or (at your option) v3
++ *
++ * This gcc plugin constifies all structures which contain only function pointers or are explicitly marked for constification.
++ *
++ * Homepage:
++ * http://www.grsecurity.net/~ephox/const_plugin/
++ *
++ * Usage:
++ * $ gcc -I`gcc -print-file-name=plugin`/include -fPIC -shared -O2 -o constify_plugin.so constify_plugin.c
++ * $ gcc -fplugin=constify_plugin.so test.c -O2
++ */
++
++#include "gcc-plugin.h"
++#include "config.h"
++#include "system.h"
++#include "coretypes.h"
++#include "tree.h"
++#include "tree-pass.h"
++#include "flags.h"
++#include "intl.h"
++#include "toplev.h"
++#include "plugin.h"
++#include "diagnostic.h"
++#include "plugin-version.h"
++#include "tm.h"
++#include "function.h"
++#include "basic-block.h"
++#include "gimple.h"
++#include "rtl.h"
++#include "emit-rtl.h"
++#include "tree-flow.h"
++
++#define C_TYPE_FIELDS_READONLY(TYPE) TREE_LANG_FLAG_1(TYPE)
++
++int plugin_is_GPL_compatible;
++
++static struct plugin_info const_plugin_info = {
++ .version = "201111150100",
++ .help = "no-constify\tturn off constification\n",
++};
++
++static void constify_type(tree type);
++static bool walk_struct(tree node);
++
++static tree deconstify_type(tree old_type)
++{
++ tree new_type, field;
++
++ new_type = build_qualified_type(old_type, TYPE_QUALS(old_type) & ~TYPE_QUAL_CONST);
++ TYPE_FIELDS(new_type) = copy_list(TYPE_FIELDS(new_type));
++ for (field = TYPE_FIELDS(new_type); field; field = TREE_CHAIN(field))
++ DECL_FIELD_CONTEXT(field) = new_type;
++ TYPE_READONLY(new_type) = 0;
++ C_TYPE_FIELDS_READONLY(new_type) = 0;
++ return new_type;
++}
++
++static tree handle_no_const_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
++{
++ tree type;
++
++ *no_add_attrs = true;
++ if (TREE_CODE(*node) == FUNCTION_DECL) {
++ error("%qE attribute does not apply to functions", name);
++ return NULL_TREE;
++ }
++
++ if (TREE_CODE(*node) == VAR_DECL) {
++ error("%qE attribute does not apply to variables", name);
++ return NULL_TREE;
++ }
++
++ if (TYPE_P(*node)) {
++ if (TREE_CODE(*node) == RECORD_TYPE || TREE_CODE(*node) == UNION_TYPE)
++ *no_add_attrs = false;
++ else
++ error("%qE attribute applies to struct and union types only", name);
++ return NULL_TREE;
++ }
++
++ type = TREE_TYPE(*node);
++
++ if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE) {
++ error("%qE attribute applies to struct and union types only", name);
++ return NULL_TREE;
++ }
++
++ if (lookup_attribute(IDENTIFIER_POINTER(name), TYPE_ATTRIBUTES(type))) {
++ error("%qE attribute is already applied to the type", name);
++ return NULL_TREE;
++ }
++
++ if (TREE_CODE(*node) == TYPE_DECL && !TYPE_READONLY(type)) {
++ error("%qE attribute used on type that is not constified", name);
++ return NULL_TREE;
++ }
++
++ if (TREE_CODE(*node) == TYPE_DECL) {
++ TREE_TYPE(*node) = deconstify_type(type);
++ TREE_READONLY(*node) = 0;
++ return NULL_TREE;
++ }
++
++ return NULL_TREE;
++}
++
++static tree handle_do_const_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
++{
++ *no_add_attrs = true;
++ if (!TYPE_P(*node)) {
++ error("%qE attribute applies to types only", name);
++ return NULL_TREE;
++ }
++
++ if (TREE_CODE(*node) != RECORD_TYPE && TREE_CODE(*node) != UNION_TYPE) {
++ error("%qE attribute applies to struct and union types only", name);
++ return NULL_TREE;
++ }
++
++ *no_add_attrs = false;
++ constify_type(*node);
++ return NULL_TREE;
++}
++
++static struct attribute_spec no_const_attr = {
++ .name = "no_const",
++ .min_length = 0,
++ .max_length = 0,
++ .decl_required = false,
++ .type_required = false,
++ .function_type_required = false,
++ .handler = handle_no_const_attribute,
++#if BUILDING_GCC_VERSION >= 4007
++ .affects_type_identity = true
++#endif
++};
++
++static struct attribute_spec do_const_attr = {
++ .name = "do_const",
++ .min_length = 0,
++ .max_length = 0,
++ .decl_required = false,
++ .type_required = false,
++ .function_type_required = false,
++ .handler = handle_do_const_attribute,
++#if BUILDING_GCC_VERSION >= 4007
++ .affects_type_identity = true
++#endif
++};
++
++static void register_attributes(void *event_data, void *data)
++{
++ register_attribute(&no_const_attr);
++ register_attribute(&do_const_attr);
++}
++
++static void constify_type(tree type)
++{
++ TYPE_READONLY(type) = 1;
++ C_TYPE_FIELDS_READONLY(type) = 1;
++}
++
++static bool is_fptr(tree field)
++{
++ tree ptr = TREE_TYPE(field);
++
++ if (TREE_CODE(ptr) != POINTER_TYPE)
++ return false;
++
++ return TREE_CODE(TREE_TYPE(ptr)) == FUNCTION_TYPE;
++}
++
++static bool walk_struct(tree node)
++{
++ tree field;
++
++ if (lookup_attribute("no_const", TYPE_ATTRIBUTES(node)))
++ return false;
++
++ if (TYPE_FIELDS(node) == NULL_TREE)
++ return false;
++
++ for (field = TYPE_FIELDS(node); field; field = TREE_CHAIN(field)) {
++ tree type = TREE_TYPE(field);
++ enum tree_code code = TREE_CODE(type);
++ if (code == RECORD_TYPE || code == UNION_TYPE) {
++ if (!(walk_struct(type)))
++ return false;
++ } else if (!is_fptr(field) && !TREE_READONLY(field))
++ return false;
++ }
++ return true;
++}
++
++static void finish_type(void *event_data, void *data)
++{
++ tree type = (tree)event_data;
++
++ if (type == NULL_TREE)
++ return;
++
++ if (TYPE_READONLY(type))
++ return;
++
++ if (walk_struct(type))
++ constify_type(type);
++}
++
++static unsigned int check_local_variables(void);
++
++struct gimple_opt_pass pass_local_variable = {
++ {
++ .type = GIMPLE_PASS,
++ .name = "check_local_variables",
++ .gate = NULL,
++ .execute = check_local_variables,
++ .sub = NULL,
++ .next = NULL,
++ .static_pass_number = 0,
++ .tv_id = TV_NONE,
++ .properties_required = 0,
++ .properties_provided = 0,
++ .properties_destroyed = 0,
++ .todo_flags_start = 0,
++ .todo_flags_finish = 0
++ }
++};
++
++static unsigned int check_local_variables(void)
++{
++ tree var;
++ referenced_var_iterator rvi;
++
++#if BUILDING_GCC_VERSION == 4005
++ FOR_EACH_REFERENCED_VAR(var, rvi) {
++#else
++ FOR_EACH_REFERENCED_VAR(cfun, var, rvi) {
++#endif
++ tree type = TREE_TYPE(var);
++
++ if (!DECL_P(var) || TREE_STATIC(var) || DECL_EXTERNAL(var))
++ continue;
++
++ if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE)
++ continue;
++
++ if (!TYPE_READONLY(type))
++ continue;
++
++// if (lookup_attribute("no_const", DECL_ATTRIBUTES(var)))
++// continue;
++
++// if (lookup_attribute("no_const", TYPE_ATTRIBUTES(type)))
++// continue;
++
++ if (walk_struct(type)) {
++ error_at(DECL_SOURCE_LOCATION(var), "constified variable %qE cannot be local", var);
++ return 1;
++ }
++ }
++ return 0;
++}
++
++int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
++{
++ const char * const plugin_name = plugin_info->base_name;
++ const int argc = plugin_info->argc;
++ const struct plugin_argument * const argv = plugin_info->argv;
++ int i;
++ bool constify = true;
++
++ struct register_pass_info local_variable_pass_info = {
++ .pass = &pass_local_variable.pass,
++ .reference_pass_name = "*referenced_vars",
++ .ref_pass_instance_number = 0,
++ .pos_op = PASS_POS_INSERT_AFTER
++ };
++
++ if (!plugin_default_version_check(version, &gcc_version)) {
++ error(G_("incompatible gcc/plugin versions"));
++ return 1;
++ }
++
++ for (i = 0; i < argc; ++i) {
++ if (!(strcmp(argv[i].key, "no-constify"))) {
++ constify = false;
++ continue;
++ }
++ error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
++ }
++
++ register_callback(plugin_name, PLUGIN_INFO, NULL, &const_plugin_info);
++ if (constify) {
++ register_callback(plugin_name, PLUGIN_FINISH_TYPE, finish_type, NULL);
++ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &local_variable_pass_info);
++ }
++ register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
++
++ return 0;
++}
+diff --git a/tools/gcc/kallocstat_plugin.c b/tools/gcc/kallocstat_plugin.c
+new file mode 100644
+index 0000000..a5eabce
+--- /dev/null
++++ b/tools/gcc/kallocstat_plugin.c
+@@ -0,0 +1,167 @@
++/*
++ * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
++ * Licensed under the GPL v2
++ *
++ * Note: the choice of the license means that the compilation process is
++ * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
++ * but for the kernel it doesn't matter since it doesn't link against
++ * any of the gcc libraries
++ *
++ * gcc plugin to find the distribution of k*alloc sizes
++ *
++ * TODO:
++ *
++ * BUGS:
++ * - none known
++ */
++#include "gcc-plugin.h"
++#include "config.h"
++#include "system.h"
++#include "coretypes.h"
++#include "tree.h"
++#include "tree-pass.h"
++#include "flags.h"
++#include "intl.h"
++#include "toplev.h"
++#include "plugin.h"
++//#include "expr.h" where are you...
++#include "diagnostic.h"
++#include "plugin-version.h"
++#include "tm.h"
++#include "function.h"
++#include "basic-block.h"
++#include "gimple.h"
++#include "rtl.h"
++#include "emit-rtl.h"
++
++extern void print_gimple_stmt(FILE *, gimple, int, int);
++
++int plugin_is_GPL_compatible;
++
++static const char * const kalloc_functions[] = {
++ "__kmalloc",
++ "kmalloc",
++ "kmalloc_large",
++ "kmalloc_node",
++ "kmalloc_order",
++ "kmalloc_order_trace",
++ "kmalloc_slab",
++ "kzalloc",
++ "kzalloc_node",
++};
++
++static struct plugin_info kallocstat_plugin_info = {
++ .version = "201111150100",
++};
++
++static unsigned int execute_kallocstat(void);
++
++static struct gimple_opt_pass kallocstat_pass = {
++ .pass = {
++ .type = GIMPLE_PASS,
++ .name = "kallocstat",
++ .gate = NULL,
++ .execute = execute_kallocstat,
++ .sub = NULL,
++ .next = NULL,
++ .static_pass_number = 0,
++ .tv_id = TV_NONE,
++ .properties_required = 0,
++ .properties_provided = 0,
++ .properties_destroyed = 0,
++ .todo_flags_start = 0,
++ .todo_flags_finish = 0
++ }
++};
++
++static bool is_kalloc(const char *fnname)
++{
++ size_t i;
++
++ for (i = 0; i < ARRAY_SIZE(kalloc_functions); i++)
++ if (!strcmp(fnname, kalloc_functions[i]))
++ return true;
++ return false;
++}
++
++static unsigned int execute_kallocstat(void)
++{
++ basic_block bb;
++
++ // 1. loop through BBs and GIMPLE statements
++ FOR_EACH_BB(bb) {
++ gimple_stmt_iterator gsi;
++ for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
++ // gimple match:
++ tree fndecl, size;
++ gimple call_stmt;
++ const char *fnname;
++
++ // is it a call
++ call_stmt = gsi_stmt(gsi);
++ if (!is_gimple_call(call_stmt))
++ continue;
++ fndecl = gimple_call_fndecl(call_stmt);
++ if (fndecl == NULL_TREE)
++ continue;
++ if (TREE_CODE(fndecl) != FUNCTION_DECL)
++ continue;
++
++ // is it a call to k*alloc
++ fnname = IDENTIFIER_POINTER(DECL_NAME(fndecl));
++ if (!is_kalloc(fnname))
++ continue;
++
++ // is the size arg the result of a simple const assignment
++ size = gimple_call_arg(call_stmt, 0);
++ while (true) {
++ gimple def_stmt;
++ expanded_location xloc;
++ size_t size_val;
++
++ if (TREE_CODE(size) != SSA_NAME)
++ break;
++ def_stmt = SSA_NAME_DEF_STMT(size);
++ if (!def_stmt || !is_gimple_assign(def_stmt))
++ break;
++ if (gimple_num_ops(def_stmt) != 2)
++ break;
++ size = gimple_assign_rhs1(def_stmt);
++ if (!TREE_CONSTANT(size))
++ continue;
++ xloc = expand_location(gimple_location(def_stmt));
++ if (!xloc.file)
++ xloc = expand_location(DECL_SOURCE_LOCATION(current_function_decl));
++ size_val = TREE_INT_CST_LOW(size);
++ fprintf(stderr, "kallocsize: %8zu %8zx %s %s:%u\n", size_val, size_val, fnname, xloc.file, xloc.line);
++ break;
++ }
++//print_gimple_stmt(stderr, call_stmt, 0, TDF_LINENO);
++//debug_tree(gimple_call_fn(call_stmt));
++//print_node(stderr, "pax", fndecl, 4);
++ }
++ }
++
++ return 0;
++}
++
++int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
++{
++ const char * const plugin_name = plugin_info->base_name;
++ struct register_pass_info kallocstat_pass_info = {
++ .pass = &kallocstat_pass.pass,
++ .reference_pass_name = "ssa",
++ .ref_pass_instance_number = 0,
++ .pos_op = PASS_POS_INSERT_AFTER
++ };
++
++ if (!plugin_default_version_check(version, &gcc_version)) {
++ error(G_("incompatible gcc/plugin versions"));
++ return 1;
++ }
++
++ register_callback(plugin_name, PLUGIN_INFO, NULL, &kallocstat_plugin_info);
++ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kallocstat_pass_info);
++
++ return 0;
++}
+diff --git a/tools/gcc/kernexec_plugin.c b/tools/gcc/kernexec_plugin.c
+new file mode 100644
+index 0000000..d8a8da2
+--- /dev/null
++++ b/tools/gcc/kernexec_plugin.c
+@@ -0,0 +1,427 @@
++/*
++ * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
++ * Licensed under the GPL v2
++ *
++ * Note: the choice of the license means that the compilation process is
++ * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
++ * but for the kernel it doesn't matter since it doesn't link against
++ * any of the gcc libraries
++ *
++ * gcc plugin to make KERNEXEC/amd64 almost as good as it is on i386
++ *
++ * TODO:
++ *
++ * BUGS:
++ * - none known
++ */
++#include "gcc-plugin.h"
++#include "config.h"
++#include "system.h"
++#include "coretypes.h"
++#include "tree.h"
++#include "tree-pass.h"
++#include "flags.h"
++#include "intl.h"
++#include "toplev.h"
++#include "plugin.h"
++//#include "expr.h" where are you...
++#include "diagnostic.h"
++#include "plugin-version.h"
++#include "tm.h"
++#include "function.h"
++#include "basic-block.h"
++#include "gimple.h"
++#include "rtl.h"
++#include "emit-rtl.h"
++#include "tree-flow.h"
++
++extern void print_gimple_stmt(FILE *, gimple, int, int);
++extern rtx emit_move_insn(rtx x, rtx y);
++
++int plugin_is_GPL_compatible;
++
++static struct plugin_info kernexec_plugin_info = {
++ .version = "201111291120",
++ .help = "method=[bts|or]\tinstrumentation method\n"
++};
++
++static unsigned int execute_kernexec_reload(void);
++static unsigned int execute_kernexec_fptr(void);
++static unsigned int execute_kernexec_retaddr(void);
++static bool kernexec_cmodel_check(void);
++
++static void (*kernexec_instrument_fptr)(gimple_stmt_iterator *);
++static void (*kernexec_instrument_retaddr)(rtx);
++
++static struct gimple_opt_pass kernexec_reload_pass = {
++ .pass = {
++ .type = GIMPLE_PASS,
++ .name = "kernexec_reload",
++ .gate = kernexec_cmodel_check,
++ .execute = execute_kernexec_reload,
++ .sub = NULL,
++ .next = NULL,
++ .static_pass_number = 0,
++ .tv_id = TV_NONE,
++ .properties_required = 0,
++ .properties_provided = 0,
++ .properties_destroyed = 0,
++ .todo_flags_start = 0,
++ .todo_flags_finish = TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_remove_unused_locals | TODO_update_ssa_no_phi
++ }
++};
++
++static struct gimple_opt_pass kernexec_fptr_pass = {
++ .pass = {
++ .type = GIMPLE_PASS,
++ .name = "kernexec_fptr",
++ .gate = kernexec_cmodel_check,
++ .execute = execute_kernexec_fptr,
++ .sub = NULL,
++ .next = NULL,
++ .static_pass_number = 0,
++ .tv_id = TV_NONE,
++ .properties_required = 0,
++ .properties_provided = 0,
++ .properties_destroyed = 0,
++ .todo_flags_start = 0,
++ .todo_flags_finish = TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_remove_unused_locals | TODO_update_ssa_no_phi
++ }
++};
++
++static struct rtl_opt_pass kernexec_retaddr_pass = {
++ .pass = {
++ .type = RTL_PASS,
++ .name = "kernexec_retaddr",
++ .gate = kernexec_cmodel_check,
++ .execute = execute_kernexec_retaddr,
++ .sub = NULL,
++ .next = NULL,
++ .static_pass_number = 0,
++ .tv_id = TV_NONE,
++ .properties_required = 0,
++ .properties_provided = 0,
++ .properties_destroyed = 0,
++ .todo_flags_start = 0,
++ .todo_flags_finish = TODO_dump_func | TODO_ggc_collect
++ }
++};
++
++static bool kernexec_cmodel_check(void)
++{
++ tree section;
++
++ if (ix86_cmodel != CM_KERNEL)
++ return false;
++
++ section = lookup_attribute("section", DECL_ATTRIBUTES(current_function_decl));
++ if (!section || !TREE_VALUE(section))
++ return true;
++
++ section = TREE_VALUE(TREE_VALUE(section));
++ if (strncmp(TREE_STRING_POINTER(section), ".vsyscall_", 10))
++ return true;
++
++ return false;
++}
++
++/*
++ * add special KERNEXEC instrumentation: reload %r10 after it has been clobbered
++ */
++static void kernexec_reload_fptr_mask(gimple_stmt_iterator *gsi)
++{
++ gimple asm_movabs_stmt;
++
++ // build asm volatile("movabs $0x8000000000000000, %%r10\n\t" : : : );
++ asm_movabs_stmt = gimple_build_asm_vec("movabs $0x8000000000000000, %%r10\n\t", NULL, NULL, NULL, NULL);
++ gimple_asm_set_volatile(asm_movabs_stmt, true);
++ gsi_insert_after(gsi, asm_movabs_stmt, GSI_CONTINUE_LINKING);
++ update_stmt(asm_movabs_stmt);
++}
++
++/*
++ * find all asm() stmts that clobber r10 and add a reload of r10
++ */
++static unsigned int execute_kernexec_reload(void)
++{
++ basic_block bb;
++
++ // 1. loop through BBs and GIMPLE statements
++ FOR_EACH_BB(bb) {
++ gimple_stmt_iterator gsi;
++
++ for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
++ // gimple match: __asm__ ("" : : : "r10");
++ gimple asm_stmt;
++ size_t nclobbers;
++
++ // is it an asm ...
++ asm_stmt = gsi_stmt(gsi);
++ if (gimple_code(asm_stmt) != GIMPLE_ASM)
++ continue;
++
++ // ... clobbering r10
++ nclobbers = gimple_asm_nclobbers(asm_stmt);
++ while (nclobbers--) {
++ tree op = gimple_asm_clobber_op(asm_stmt, nclobbers);
++ if (strcmp(TREE_STRING_POINTER(TREE_VALUE(op)), "r10"))
++ continue;
++ kernexec_reload_fptr_mask(&gsi);
++//print_gimple_stmt(stderr, asm_stmt, 0, TDF_LINENO);
++ break;
++ }
++ }
++ }
++
++ return 0;
++}
++
++/*
++ * add special KERNEXEC instrumentation: force MSB of fptr to 1, which will produce
++ * a non-canonical address from a userland ptr and will just trigger a GPF on dereference
++ */
++static void kernexec_instrument_fptr_bts(gimple_stmt_iterator *gsi)
++{
++ gimple assign_intptr, assign_new_fptr, call_stmt;
++ tree intptr, old_fptr, new_fptr, kernexec_mask;
++
++ call_stmt = gsi_stmt(*gsi);
++ old_fptr = gimple_call_fn(call_stmt);
++
++ // create temporary unsigned long variable used for bitops and cast fptr to it
++ intptr = create_tmp_var(long_unsigned_type_node, "kernexec_bts");
++ add_referenced_var(intptr);
++ mark_sym_for_renaming(intptr);
++ assign_intptr = gimple_build_assign(intptr, fold_convert(long_unsigned_type_node, old_fptr));
++ gsi_insert_before(gsi, assign_intptr, GSI_SAME_STMT);
++ update_stmt(assign_intptr);
++
++ // apply logical or to temporary unsigned long and bitmask
++ kernexec_mask = build_int_cstu(long_long_unsigned_type_node, 0x8000000000000000LL);
++// kernexec_mask = build_int_cstu(long_long_unsigned_type_node, 0xffffffff80000000LL);
++ assign_intptr = gimple_build_assign(intptr, fold_build2(BIT_IOR_EXPR, long_long_unsigned_type_node, intptr, kernexec_mask));
++ gsi_insert_before(gsi, assign_intptr, GSI_SAME_STMT);
++ update_stmt(assign_intptr);
++
++ // cast temporary unsigned long back to a temporary fptr variable
++ new_fptr = create_tmp_var(TREE_TYPE(old_fptr), "kernexec_fptr");
++ add_referenced_var(new_fptr);
++ mark_sym_for_renaming(new_fptr);
++ assign_new_fptr = gimple_build_assign(new_fptr, fold_convert(TREE_TYPE(old_fptr), intptr));
++ gsi_insert_before(gsi, assign_new_fptr, GSI_SAME_STMT);
++ update_stmt(assign_new_fptr);
++
++ // replace call stmt fn with the new fptr
++ gimple_call_set_fn(call_stmt, new_fptr);
++ update_stmt(call_stmt);
++}
++
++static void kernexec_instrument_fptr_or(gimple_stmt_iterator *gsi)
++{
++ gimple asm_or_stmt, call_stmt;
++ tree old_fptr, new_fptr, input, output;
++ VEC(tree, gc) *inputs = NULL;
++ VEC(tree, gc) *outputs = NULL;
++
++ call_stmt = gsi_stmt(*gsi);
++ old_fptr = gimple_call_fn(call_stmt);
++
++ // create temporary fptr variable
++ new_fptr = create_tmp_var(TREE_TYPE(old_fptr), "kernexec_or");
++ add_referenced_var(new_fptr);
++ mark_sym_for_renaming(new_fptr);
++
++ // build asm volatile("orq %%r10, %0\n\t" : "=r"(new_fptr) : "0"(old_fptr));
++ input = build_tree_list(NULL_TREE, build_string(2, "0"));
++ input = chainon(NULL_TREE, build_tree_list(input, old_fptr));
++ output = build_tree_list(NULL_TREE, build_string(3, "=r"));
++ output = chainon(NULL_TREE, build_tree_list(output, new_fptr));
++ VEC_safe_push(tree, gc, inputs, input);
++ VEC_safe_push(tree, gc, outputs, output);
++ asm_or_stmt = gimple_build_asm_vec("orq %%r10, %0\n\t", inputs, outputs, NULL, NULL);
++ gimple_asm_set_volatile(asm_or_stmt, true);
++ gsi_insert_before(gsi, asm_or_stmt, GSI_SAME_STMT);
++ update_stmt(asm_or_stmt);
++
++ // replace call stmt fn with the new fptr
++ gimple_call_set_fn(call_stmt, new_fptr);
++ update_stmt(call_stmt);
++}
++
++/*
++ * find all C level function pointer dereferences and forcibly set the highest bit of the pointer
++ */
++static unsigned int execute_kernexec_fptr(void)
++{
++ basic_block bb;
++
++ // 1. loop through BBs and GIMPLE statements
++ FOR_EACH_BB(bb) {
++ gimple_stmt_iterator gsi;
++
++ for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
++ // gimple match: h_1 = get_fptr (); D.2709_3 = h_1 (x_2(D));
++ tree fn;
++ gimple call_stmt;
++
++ // is it a call ...
++ call_stmt = gsi_stmt(gsi);
++ if (!is_gimple_call(call_stmt))
++ continue;
++ fn = gimple_call_fn(call_stmt);
++ if (TREE_CODE(fn) == ADDR_EXPR)
++ continue;
++ if (TREE_CODE(fn) != SSA_NAME)
++ gcc_unreachable();
++
++ // ... through a function pointer
++ fn = SSA_NAME_VAR(fn);
++ if (TREE_CODE(fn) != VAR_DECL && TREE_CODE(fn) != PARM_DECL)
++ continue;
++ fn = TREE_TYPE(fn);
++ if (TREE_CODE(fn) != POINTER_TYPE)
++ continue;
++ fn = TREE_TYPE(fn);
++ if (TREE_CODE(fn) != FUNCTION_TYPE)
++ continue;
++
++ kernexec_instrument_fptr(&gsi);
++
++//debug_tree(gimple_call_fn(call_stmt));
++//print_gimple_stmt(stderr, call_stmt, 0, TDF_LINENO);
++ }
++ }
++
++ return 0;
++}
++
++// add special KERNEXEC instrumentation: btsq $63,(%rsp) just before retn
++static void kernexec_instrument_retaddr_bts(rtx insn)
++{
++ rtx btsq;
++ rtvec argvec, constraintvec, labelvec;
++ int line;
++
++ // create asm volatile("btsq $63,(%%rsp)":::)
++ argvec = rtvec_alloc(0);
++ constraintvec = rtvec_alloc(0);
++ labelvec = rtvec_alloc(0);
++ line = expand_location(RTL_LOCATION(insn)).line;
++ btsq = gen_rtx_ASM_OPERANDS(VOIDmode, "btsq $63,(%%rsp)", empty_string, 0, argvec, constraintvec, labelvec, line);
++ MEM_VOLATILE_P(btsq) = 1;
++// RTX_FRAME_RELATED_P(btsq) = 1; // not for ASM_OPERANDS
++ emit_insn_before(btsq, insn);
++}
++
++// add special KERNEXEC instrumentation: orq %r10,(%rsp) just before retn
++static void kernexec_instrument_retaddr_or(rtx insn)
++{
++ rtx orq;
++ rtvec argvec, constraintvec, labelvec;
++ int line;
++
++ // create asm volatile("orq %%r10,(%%rsp)":::)
++ argvec = rtvec_alloc(0);
++ constraintvec = rtvec_alloc(0);
++ labelvec = rtvec_alloc(0);
++ line = expand_location(RTL_LOCATION(insn)).line;
++ orq = gen_rtx_ASM_OPERANDS(VOIDmode, "orq %%r10,(%%rsp)", empty_string, 0, argvec, constraintvec, labelvec, line);
++ MEM_VOLATILE_P(orq) = 1;
++// RTX_FRAME_RELATED_P(orq) = 1; // not for ASM_OPERANDS
++ emit_insn_before(orq, insn);
++}
++
++/*
++ * find all asm level function returns and forcibly set the highest bit of the return address
++ */
++static unsigned int execute_kernexec_retaddr(void)
++{
++ rtx insn;
++
++ // 1. find function returns
++ for (insn = get_insns(); insn; insn = NEXT_INSN(insn)) {
++ // rtl match: (jump_insn 41 40 42 2 (return) fptr.c:42 634 {return_internal} (nil))
++ // (jump_insn 12 9 11 2 (parallel [ (return) (unspec [ (0) ] UNSPEC_REP) ]) fptr.c:46 635 {return_internal_long} (nil))
++ rtx body;
++
++ // is it a retn
++ if (!JUMP_P(insn))
++ continue;
++ body = PATTERN(insn);
++ if (GET_CODE(body) == PARALLEL)
++ body = XVECEXP(body, 0, 0);
++ if (GET_CODE(body) != RETURN)
++ continue;
++ kernexec_instrument_retaddr(insn);
++ }
++
++// print_simple_rtl(stderr, get_insns());
++// print_rtl(stderr, get_insns());
++
++ return 0;
++}
++
++int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
++{
++ const char * const plugin_name = plugin_info->base_name;
++ const int argc = plugin_info->argc;
++ const struct plugin_argument * const argv = plugin_info->argv;
++ int i;
++ struct register_pass_info kernexec_reload_pass_info = {
++ .pass = &kernexec_reload_pass.pass,
++ .reference_pass_name = "ssa",
++ .ref_pass_instance_number = 0,
++ .pos_op = PASS_POS_INSERT_AFTER
++ };
++ struct register_pass_info kernexec_fptr_pass_info = {
++ .pass = &kernexec_fptr_pass.pass,
++ .reference_pass_name = "ssa",
++ .ref_pass_instance_number = 0,
++ .pos_op = PASS_POS_INSERT_AFTER
++ };
++ struct register_pass_info kernexec_retaddr_pass_info = {
++ .pass = &kernexec_retaddr_pass.pass,
++ .reference_pass_name = "pro_and_epilogue",
++ .ref_pass_instance_number = 0,
++ .pos_op = PASS_POS_INSERT_AFTER
++ };
++
++ if (!plugin_default_version_check(version, &gcc_version)) {
++ error(G_("incompatible gcc/plugin versions"));
++ return 1;
++ }
++
++ register_callback(plugin_name, PLUGIN_INFO, NULL, &kernexec_plugin_info);
++
++ if (TARGET_64BIT == 0)
++ return 0;
++
++ for (i = 0; i < argc; ++i) {
++ if (!strcmp(argv[i].key, "method")) {
++ if (!argv[i].value) {
++ error(G_("no value supplied for option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
++ continue;
++ }
++ if (!strcmp(argv[i].value, "bts")) {
++ kernexec_instrument_fptr = kernexec_instrument_fptr_bts;
++ kernexec_instrument_retaddr = kernexec_instrument_retaddr_bts;
++ } else if (!strcmp(argv[i].value, "or")) {
++ kernexec_instrument_fptr = kernexec_instrument_fptr_or;
++ kernexec_instrument_retaddr = kernexec_instrument_retaddr_or;
++ fix_register("r10", 1, 1);
++ } else
++ error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
++ continue;
++ }
++ error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
++ }
++ if (!kernexec_instrument_fptr || !kernexec_instrument_retaddr)
++ error(G_("no instrumentation method was selected via '-fplugin-arg-%s-method'"), plugin_name);
++
++ if (kernexec_instrument_fptr == kernexec_instrument_fptr_or)
++ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kernexec_reload_pass_info);
++ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kernexec_fptr_pass_info);
++ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kernexec_retaddr_pass_info);
++
++ return 0;
++}
+diff --git a/tools/gcc/size_overflow_hash.h b/tools/gcc/size_overflow_hash.h
+new file mode 100644
+index 0000000..6e18418
+--- /dev/null
++++ b/tools/gcc/size_overflow_hash.h
+@@ -0,0 +1,10651 @@
++struct size_overflow_hash _000001_hash = {
++ .next = NULL,
++ .name = "__alloc_percpu",
++ .file = "include/linux/percpu.h",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000002_hash = {
++ .next = NULL,
++ .name = "kmalloc_node",
++ .file = "include/linux/slab.h",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000003_hash = {
++ .next = NULL,
++ .name = "alloc_dr",
++ .file = "drivers/base/devres.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000004_hash = {
++ .next = NULL,
++ .name = "__copy_from_user",
++ .file = "arch/x86/include/asm/uaccess_32.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000005_hash = {
++ .next = NULL,
++ .name = "__copy_from_user_inatomic",
++ .file = "arch/x86/include/asm/uaccess_32.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000006_hash = {
++ .next = NULL,
++ .name = "__copy_from_user_nocache",
++ .file = "arch/x86/include/asm/uaccess_32.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000007_hash = {
++ .next = NULL,
++ .name = "__copy_to_user_inatomic",
++ .file = "arch/x86/include/asm/uaccess_32.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000008_hash = {
++ .next = NULL,
++ .name = "do_xip_mapping_read",
++ .file = "mm/filemap_xip.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000009_hash = {
++ .next = NULL,
++ .name = "hugetlbfs_read",
++ .file = "fs/hugetlbfs/inode.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000010_hash = {
++ .next = NULL,
++ .name = "kmalloc",
++ .file = "include/linux/slub_def.h",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000011_hash = {
++ .next = NULL,
++ .name = "__kmalloc",
++ .file = "include/linux/slub_def.h",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000012_hash = {
++ .next = NULL,
++ .name = "kmalloc_slab",
++ .file = "include/linux/slub_def.h",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000013_hash = {
++ .next = NULL,
++ .name = "kmemdup",
++ .file = "include/linux/string.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000014_hash = {
++ .next = NULL,
++ .name = "__krealloc",
++ .file = "include/linux/slab.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000015_hash = {
++ .next = NULL,
++ .name = "memdup_user",
++ .file = "include/linux/string.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000016_hash = {
++ .next = NULL,
++ .name = "read_default_ldt",
++ .file = "arch/x86/kernel/ldt.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000017_hash = {
++ .next = NULL,
++ .name = "read_kcore",
++ .file = "fs/proc/kcore.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000018_hash = {
++ .next = NULL,
++ .name = "read_ldt",
++ .file = "arch/x86/kernel/ldt.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000019_hash = {
++ .next = NULL,
++ .name = "read_zero",
++ .file = "drivers/char/mem.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000020_hash = {
++ .next = NULL,
++ .name = "snmp_mib_init",
++ .file = "include/net/ip.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000021_hash = {
++ .next = NULL,
++ .name = "vmalloc",
++ .file = "include/linux/vmalloc.h",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000022_hash = {
++ .next = NULL,
++ .name = "__vmalloc",
++ .file = "include/linux/vmalloc.h",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000023_hash = {
++ .next = NULL,
++ .name = "vmalloc_32",
++ .file = "include/linux/vmalloc.h",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000024_hash = {
++ .next = NULL,
++ .name = "vmalloc_32_user",
++ .file = "include/linux/vmalloc.h",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000025_hash = {
++ .next = NULL,
++ .name = "vmalloc_exec",
++ .file = "include/linux/vmalloc.h",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000026_hash = {
++ .next = NULL,
++ .name = "vmalloc_node",
++ .file = "include/linux/vmalloc.h",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000027_hash = {
++ .next = NULL,
++ .name = "vmalloc_user",
++ .file = "include/linux/vmalloc.h",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000028_hash = {
++ .next = NULL,
++ .name = "vm_map_ram",
++ .file = "include/linux/vmalloc.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000029_hash = {
++ .next = NULL,
++ .name = "acpi_os_allocate",
++ .file = "include/acpi/platform/aclinux.h",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000030_hash = {
++ .next = NULL,
++ .name = "ahash_setkey_unaligned",
++ .file = "crypto/ahash.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000031_hash = {
++ .next = NULL,
++ .name = "alloc_fdmem",
++ .file = "fs/file.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000032_hash = {
++ .next = NULL,
++ .name = "alloc_large_system_hash",
++ .file = "include/linux/bootmem.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000033_hash = {
++ .next = NULL,
++ .name = "audit_unpack_string",
++ .file = "kernel/auditfilter.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000034_hash = {
++ .next = NULL,
++ .name = "blkcipher_copy_iv",
++ .file = "crypto/blkcipher.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000035_hash = {
++ .next = NULL,
++ .name = "blkcipher_next_slow",
++ .file = "crypto/blkcipher.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000036_hash = {
++ .next = NULL,
++ .name = "cgroup_write_string",
++ .file = "kernel/cgroup.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000037_hash = {
++ .next = NULL,
++ .name = "copy_from_user",
++ .file = "arch/x86/include/asm/uaccess_32.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000038_hash = {
++ .next = NULL,
++ .name = "__copy_to_user",
++ .file = "arch/x86/include/asm/uaccess_32.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000039_hash = {
++ .next = NULL,
++ .name = "devm_kzalloc",
++ .file = "include/linux/device.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000040_hash = {
++ .next = NULL,
++ .name = "devres_alloc",
++ .file = "include/linux/device.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000041_hash = {
++ .next = NULL,
++ .name = "do_ip_setsockopt",
++ .file = "net/ipv4/ip_sockglue.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000042_hash = {
++ .next = NULL,
++ .name = "do_tty_write",
++ .file = "drivers/char/tty_io.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000043_hash = {
++ .next = NULL,
++ .name = "file_read_actor",
++ .file = "include/linux/fs.h",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000044_hash = {
++ .next = NULL,
++ .name = "hashtab_create",
++ .file = "security/selinux/ss/hashtab.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000045_hash = {
++ .next = NULL,
++ .name = "heap_init",
++ .file = "include/linux/prio_heap.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000046_hash = {
++ .next = NULL,
++ .name = "ima_write_policy",
++ .file = "security/integrity/ima/ima_fs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000047_hash = {
++ .next = NULL,
++ .name = "iov_iter_copy_from_user",
++ .file = "include/linux/fs.h",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000048_hash = {
++ .next = NULL,
++ .name = "iov_iter_copy_from_user_atomic",
++ .file = "include/linux/fs.h",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000049_hash = {
++ .next = NULL,
++ .name = "kcalloc",
++ .file = "include/linux/slab.h",
++ .param1 = 1,
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000051_hash = {
++ .next = NULL,
++ .name = "keyctl_instantiate_key",
++ .file = "security/keys/keyctl.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000052_hash = {
++ .next = NULL,
++ .name = "keyctl_update_key",
++ .file = "security/keys/keyctl.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000053_hash = {
++ .next = NULL,
++ .name = "kfifo_alloc",
++ .file = "include/linux/kfifo.h",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000054_hash = {
++ .next = NULL,
++ .name = "kmsg_write",
++ .file = "drivers/char/mem.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000055_hash = {
++ .next = NULL,
++ .name = "kobj_map",
++ .file = "include/linux/kobj_map.h",
++ .param2 = 1,
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000057_hash = {
++ .next = NULL,
++ .name = "krealloc",
++ .file = "include/linux/slab.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000058_hash = {
++ .next = NULL,
++ .name = "kzalloc",
++ .file = "include/linux/slab.h",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000059_hash = {
++ .next = NULL,
++ .name = "listxattr",
++ .file = "fs/xattr.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000060_hash = {
++ .next = NULL,
++ .name = "load_module",
++ .file = "kernel/module.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000061_hash = {
++ .next = NULL,
++ .name = "mempool_kmalloc",
++ .file = "include/linux/mempool.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000062_hash = {
++ .next = NULL,
++ .name = "pipe_iov_copy_from_user",
++ .file = "fs/pipe.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000063_hash = {
++ .next = NULL,
++ .name = "pipe_iov_copy_to_user",
++ .file = "fs/pipe.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000064_hash = {
++ .next = NULL,
++ .name = "platform_device_add_data",
++ .file = "include/linux/platform_device.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000065_hash = {
++ .next = NULL,
++ .name = "platform_device_add_resources",
++ .file = "include/linux/platform_device.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000066_hash = {
++ .next = NULL,
++ .name = "probe_kernel_read",
++ .file = "include/linux/uaccess.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000067_hash = {
++ .next = NULL,
++ .name = "qdisc_class_hash_alloc",
++ .file = "net/sched/sch_api.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000068_hash = {
++ .next = NULL,
++ .name = "read",
++ .file = "fs/sysfs/bin.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000069_hash = {
++ .next = NULL,
++ .name = "regset_tls_set",
++ .file = "arch/x86/kernel/tls.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000070_hash = {
++ .next = NULL,
++ .name = "relay_alloc_page_array",
++ .file = "kernel/relay.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000071_hash = {
++ .next = NULL,
++ .name = "request_key_auth_new",
++ .file = "security/keys/request_key_auth.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000072_hash = {
++ .next = NULL,
++ .name = "restore_i387_fxsave",
++ .file = "arch/x86/kernel/i387.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000073_hash = {
++ .next = NULL,
++ .name = "rngapi_reset",
++ .file = "crypto/rng.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000074_hash = {
++ .next = NULL,
++ .name = "rw_copy_check_uvector",
++ .file = "include/linux/fs.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000075_hash = {
++ .next = NULL,
++ .name = "security_context_to_sid_core",
++ .file = "security/selinux/ss/services.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000076_hash = {
++ .next = NULL,
++ .name = "sel_write_load",
++ .file = "security/selinux/selinuxfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000077_hash = {
++ .next = NULL,
++ .name = "setkey_unaligned",
++ .file = "crypto/ablkcipher.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000078_hash = {
++ .next = NULL,
++ .name = "setkey_unaligned",
++ .file = "crypto/blkcipher.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000079_hash = {
++ .next = NULL,
++ .name = "setkey_unaligned",
++ .file = "crypto/aead.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000080_hash = {
++ .next = NULL,
++ .name = "setkey_unaligned",
++ .file = "crypto/cipher.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000081_hash = {
++ .next = NULL,
++ .name = "setxattr",
++ .file = "fs/xattr.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000082_hash = {
++ .next = NULL,
++ .name = "sg_kmalloc",
++ .file = "lib/scatterlist.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000083_hash = {
++ .next = NULL,
++ .name = "shash_setkey_unaligned",
++ .file = "crypto/shash.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000084_hash = {
++ .next = NULL,
++ .name = "spi_register_board_info",
++ .file = "include/linux/spi/spi.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000085_hash = {
++ .next = NULL,
++ .name = "swap_cgroup_swapon",
++ .file = "include/linux/page_cgroup.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000086_hash = {
++ .next = NULL,
++ .name = "sys_add_key",
++ .file = "include/linux/syscalls.h",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000087_hash = {
++ .next = NULL,
++ .name = "sys_modify_ldt",
++ .file = "arch/x86/include/asm/syscalls.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000088_hash = {
++ .next = NULL,
++ .name = "sys_semtimedop",
++ .file = "include/linux/syscalls.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000089_hash = {
++ .next = NULL,
++ .name = "tty_buffer_alloc",
++ .file = "drivers/char/tty_buffer.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000090_hash = {
++ .next = NULL,
++ .name = "user_instantiate",
++ .file = "include/keys/user-type.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000091_hash = {
++ .next = NULL,
++ .name = "user_update",
++ .file = "include/keys/user-type.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000092_hash = {
++ .next = NULL,
++ .name = "vc_do_resize",
++ .file = "drivers/char/vt.c",
++ .param3 = 1,
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000094_hash = {
++ .next = NULL,
++ .name = "vga_arb_write",
++ .file = "drivers/gpu/vga/vgaarb.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000095_hash = {
++ .next = NULL,
++ .name = "write",
++ .file = "fs/sysfs/bin.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000096_hash = {
++ .next = NULL,
++ .name = "xfrm_hash_alloc",
++ .file = "net/xfrm/xfrm_hash.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000097_hash = {
++ .next = NULL,
++ .name = "__xip_file_write",
++ .file = "mm/filemap_xip.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000098_hash = {
++ .next = NULL,
++ .name = "acpi_ex_allocate_name_string",
++ .file = "drivers/acpi/acpica/exnames.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000099_hash = {
++ .next = NULL,
++ .name = "acpi_os_allocate_zeroed",
++ .file = "include/acpi/platform/aclinux.h",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000100_hash = {
++ .next = NULL,
++ .name = "acpi_system_debug_proc_write",
++ .file = "drivers/acpi/debug.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000101_hash = {
++ .next = NULL,
++ .name = "acpi_system_write_sleep",
++ .file = "drivers/acpi/proc.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000102_hash = {
++ .next = NULL,
++ .name = "acpi_system_write_wakeup_device",
++ .file = "drivers/acpi/proc.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000103_hash = {
++ .next = NULL,
++ .name = "acpi_ut_initialize_buffer",
++ .file = "drivers/acpi/acpica/utalloc.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000104_hash = {
++ .next = NULL,
++ .name = "alloc_arch_preferred_bootmem",
++ .file = "mm/bootmem.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000105_hash = {
++ .next = NULL,
++ .name = "alloc_netdev_mq",
++ .file = "include/linux/netdevice.h",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000106_hash = {
++ .next = NULL,
++ .name = "audit_init_entry",
++ .file = "kernel/auditfilter.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000107_hash = {
++ .next = NULL,
++ .name = "blk_register_region",
++ .file = "include/linux/genhd.h",
++ .param1 = 1,
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000109_hash = {
++ .next = NULL,
++ .name = "cdev_add",
++ .file = "include/linux/cdev.h",
++ .param2 = 1,
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000111_hash = {
++ .next = NULL,
++ .name = "cgroup_write_X64",
++ .file = "kernel/cgroup.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000112_hash = {
++ .next = NULL,
++ .name = "clear_refs_write",
++ .file = "fs/proc/task_mmu.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000113_hash = {
++ .next = NULL,
++ .name = "copy_to_user",
++ .file = "arch/x86/include/asm/uaccess_32.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000114_hash = {
++ .next = NULL,
++ .name = "copy_vm86_regs_from_user",
++ .file = "arch/x86/kernel/vm86_32.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000115_hash = {
++ .next = NULL,
++ .name = "crypto_ahash_setkey",
++ .file = "include/crypto/hash.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000116_hash = {
++ .next = NULL,
++ .name = "crypto_alloc_instance2",
++ .file = "include/crypto/algapi.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000117_hash = {
++ .next = NULL,
++ .name = "crypto_shash_setkey",
++ .file = "include/crypto/hash.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000118_hash = {
++ .next = NULL,
++ .name = "csum_partial_copy_fromiovecend",
++ .file = "include/linux/socket.h",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000119_hash = {
++ .next = NULL,
++ .name = "ddebug_proc_write",
++ .file = "lib/dynamic_debug.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000120_hash = {
++ .next = NULL,
++ .name = "dev_set_alias",
++ .file = "include/linux/netdevice.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000121_hash = {
++ .next = NULL,
++ .name = "do_kimage_alloc",
++ .file = "kernel/kexec.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000122_hash = {
++ .next = NULL,
++ .name = "do_readv_writev",
++ .file = "fs/read_write.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000123_hash = {
++ .next = NULL,
++ .name = "fill_write_buffer",
++ .file = "fs/sysfs/file.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000124_hash = {
++ .next = NULL,
++ .name = "get_user_cpu_mask",
++ .file = "kernel/sched.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000125_hash = {
++ .next = NULL,
++ .name = "getxattr",
++ .file = "fs/xattr.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000126_hash = {
++ .next = NULL,
++ .name = "hugetlbfs_read_actor",
++ .file = "fs/hugetlbfs/inode.c",
++ .param2 = 1,
++ .param5 = 1,
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000129_hash = {
++ .next = NULL,
++ .name = "mtrr_write",
++ .file = "arch/x86/kernel/cpu/mtrr/if.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000130_hash = {
++ .next = NULL,
++ .name = "neigh_hash_alloc",
++ .file = "net/core/neighbour.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000131_hash = {
++ .next = NULL,
++ .name = "nl_pid_hash_zalloc",
++ .file = "net/netlink/af_netlink.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000132_hash = {
++ .next = NULL,
++ .name = "oom_adjust_write",
++ .file = "fs/proc/base.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000133_hash = {
++ .next = NULL,
++ .name = "pci_add_cap_save_buffer",
++ .file = "drivers/pci/pci.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000134_hash = {
++ .next = NULL,
++ .name = "platform_device_register_data",
++ .file = "include/linux/platform_device.h",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000135_hash = {
++ .next = NULL,
++ .name = "platform_device_register_simple",
++ .file = "include/linux/platform_device.h",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000136_hash = {
++ .next = NULL,
++ .name = "proc_coredump_filter_write",
++ .file = "fs/proc/base.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000137_hash = {
++ .next = NULL,
++ .name = "proc_loginuid_write",
++ .file = "fs/proc/base.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000138_hash = {
++ .next = NULL,
++ .name = "proc_pid_attr_write",
++ .file = "fs/proc/base.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000139_hash = {
++ .next = NULL,
++ .name = "proc_write_node",
++ .file = "drivers/pnp/pnpbios/proc.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000140_hash = {
++ .next = NULL,
++ .name = "sched_feat_write",
++ .file = "kernel/sched.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000141_hash = {
++ .next = NULL,
++ .name = "security_context_to_sid",
++ .file = "security/selinux/ss/services.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000142_hash = {
++ .next = NULL,
++ .name = "security_context_to_sid_default",
++ .file = "security/selinux/ss/services.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000143_hash = {
++ .next = NULL,
++ .name = "security_context_to_sid_force",
++ .file = "security/selinux/ss/services.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000144_hash = {
++ .next = NULL,
++ .name = "sel_commit_bools_write",
++ .file = "security/selinux/selinuxfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000145_hash = {
++ .next = NULL,
++ .name = "sel_write_access",
++ .file = "security/selinux/selinuxfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000146_hash = {
++ .next = NULL,
++ .name = "sel_write_avc_cache_threshold",
++ .file = "security/selinux/selinuxfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000147_hash = {
++ .next = NULL,
++ .name = "sel_write_bool",
++ .file = "security/selinux/selinuxfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000148_hash = {
++ .next = NULL,
++ .name = "sel_write_checkreqprot",
++ .file = "security/selinux/selinuxfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000149_hash = {
++ .next = NULL,
++ .name = "sel_write_create",
++ .file = "security/selinux/selinuxfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000150_hash = {
++ .next = NULL,
++ .name = "sel_write_disable",
++ .file = "security/selinux/selinuxfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000151_hash = {
++ .next = NULL,
++ .name = "sel_write_enforce",
++ .file = "security/selinux/selinuxfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000152_hash = {
++ .next = NULL,
++ .name = "sel_write_member",
++ .file = "security/selinux/selinuxfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000153_hash = {
++ .next = NULL,
++ .name = "sel_write_relabel",
++ .file = "security/selinux/selinuxfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000154_hash = {
++ .next = NULL,
++ .name = "sel_write_user",
++ .file = "security/selinux/selinuxfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000155_hash = {
++ .next = NULL,
++ .name = "setkey",
++ .file = "crypto/cipher.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000156_hash = {
++ .next = NULL,
++ .name = "setkey",
++ .file = "crypto/ablkcipher.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000157_hash = {
++ .next = NULL,
++ .name = "setkey",
++ .file = "crypto/aead.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000158_hash = {
++ .next = NULL,
++ .name = "setkey",
++ .file = "crypto/blkcipher.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000159_hash = {
++ .next = NULL,
++ .name = "simple_transaction_get",
++ .file = "include/linux/fs.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000160_hash = {
++ .next = NULL,
++ .name = "smk_write_ambient",
++ .file = "security/smack/smackfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000161_hash = {
++ .next = NULL,
++ .name = "smk_write_cipso",
++ .file = "security/smack/smackfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000162_hash = {
++ .next = NULL,
++ .name = "smk_write_direct",
++ .file = "security/smack/smackfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000163_hash = {
++ .next = NULL,
++ .name = "smk_write_doi",
++ .file = "security/smack/smackfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000164_hash = {
++ .next = NULL,
++ .name = "smk_write_load",
++ .file = "security/smack/smackfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000165_hash = {
++ .next = &_000069_hash,
++ .name = "smk_write_logging",
++ .file = "security/smack/smackfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000166_hash = {
++ .next = NULL,
++ .name = "smk_write_netlbladdr",
++ .file = "security/smack/smackfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000167_hash = {
++ .next = NULL,
++ .name = "smk_write_onlycap",
++ .file = "security/smack/smackfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000168_hash = {
++ .next = NULL,
++ .name = "spi_alloc_master",
++ .file = "include/linux/spi/spi.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000169_hash = {
++ .next = NULL,
++ .name = "sysctl_data",
++ .file = "include/linux/sysctl.h",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000170_hash = {
++ .next = NULL,
++ .name = "sysctl_ipc_data",
++ .file = "ipc/ipc_sysctl.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000171_hash = {
++ .next = NULL,
++ .name = "sysctl_string",
++ .file = "include/linux/sysctl.h",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000172_hash = {
++ .next = NULL,
++ .name = "sys_flistxattr",
++ .file = "include/linux/syscalls.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000173_hash = {
++ .next = NULL,
++ .name = "sys_fsetxattr",
++ .file = "include/linux/syscalls.h",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000174_hash = {
++ .next = NULL,
++ .name = "sys_init_module",
++ .file = "include/linux/syscalls.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000175_hash = {
++ .next = NULL,
++ .name = "sys_keyctl",
++ .file = "include/linux/syscalls.h",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000176_hash = {
++ .next = NULL,
++ .name = "sys_listxattr",
++ .file = "include/linux/syscalls.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000177_hash = {
++ .next = NULL,
++ .name = "sys_llistxattr",
++ .file = "include/linux/syscalls.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000178_hash = {
++ .next = NULL,
++ .name = "sys_lsetxattr",
++ .file = "include/linux/syscalls.h",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000179_hash = {
++ .next = NULL,
++ .name = "sys_semop",
++ .file = "include/linux/syscalls.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000180_hash = {
++ .next = NULL,
++ .name = "sys_setxattr",
++ .file = "include/linux/syscalls.h",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000181_hash = {
++ .next = NULL,
++ .name = "tomoyo_alloc",
++ .file = "security/tomoyo/realpath.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000182_hash = {
++ .next = NULL,
++ .name = "tpm_write",
++ .file = "drivers/char/tpm/tpm.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000183_hash = {
++ .next = NULL,
++ .name = "tty_write",
++ .file = "drivers/char/tty_io.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000184_hash = {
++ .next = NULL,
++ .name = "vc_resize",
++ .file = "include/linux/vt_kern.h",
++ .param2 = 1,
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000186_hash = {
++ .next = NULL,
++ .name = "vcs_write",
++ .file = "drivers/char/vc_screen.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000187_hash = {
++ .next = NULL,
++ .name = "write_mem",
++ .file = "drivers/char/mem.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000188_hash = {
++ .next = NULL,
++ .name = "acpi_ds_build_internal_package_obj",
++ .file = "drivers/acpi/acpica/dsobject.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000189_hash = {
++ .next = NULL,
++ .name = "acpi_system_read_event",
++ .file = "drivers/acpi/event.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000190_hash = {
++ .next = NULL,
++ .name = "acpi_ut_create_buffer_object",
++ .file = "drivers/acpi/acpica/utobject.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000191_hash = {
++ .next = NULL,
++ .name = "acpi_ut_create_package_object",
++ .file = "drivers/acpi/acpica/utobject.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000192_hash = {
++ .next = NULL,
++ .name = "acpi_ut_create_string_object",
++ .file = "drivers/acpi/acpica/utobject.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000193_hash = {
++ .next = NULL,
++ .name = "alloc_etherdev_mq",
++ .file = "include/linux/etherdevice.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000194_hash = {
++ .next = NULL,
++ .name = "async_setkey",
++ .file = "crypto/blkcipher.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000195_hash = {
++ .next = NULL,
++ .name = "copy_oldmem_page",
++ .file = "include/linux/crash_dump.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000196_hash = {
++ .next = NULL,
++ .name = "do_sigpending",
++ .file = "include/linux/signal.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000197_hash = {
++ .next = NULL,
++ .name = "do_sysctl_strategy",
++ .file = "kernel/sysctl.c",
++ .param6 = 1,
++};
++
++struct size_overflow_hash _000199_hash = {
++ .next = NULL,
++ .name = "keyctl_describe_key",
++ .file = "security/keys/keyctl.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000200_hash = {
++ .next = NULL,
++ .name = "keyctl_get_security",
++ .file = "security/keys/keyctl.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000201_hash = {
++ .next = NULL,
++ .name = "keyring_read",
++ .file = "security/keys/keyring.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000202_hash = {
++ .next = NULL,
++ .name = "kimage_crash_alloc",
++ .file = "kernel/kexec.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000203_hash = {
++ .next = NULL,
++ .name = "kimage_normal_alloc",
++ .file = "kernel/kexec.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000204_hash = {
++ .next = NULL,
++ .name = "neigh_hash_grow",
++ .file = "net/core/neighbour.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000205_hash = {
++ .next = NULL,
++ .name = "__proc_file_read",
++ .file = "fs/proc/generic.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000206_hash = {
++ .next = NULL,
++ .name = "read_mem",
++ .file = "drivers/char/mem.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000207_hash = {
++ .next = NULL,
++ .name = "read_profile",
++ .file = "kernel/profile.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000208_hash = {
++ .next = NULL,
++ .name = "read_vmcore",
++ .file = "fs/proc/vmcore.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000209_hash = {
++ .next = NULL,
++ .name = "redirected_tty_write",
++ .file = "drivers/char/tty_io.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000210_hash = {
++ .next = NULL,
++ .name = "__register_chrdev",
++ .file = "include/linux/fs.h",
++ .param2 = 1,
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000212_hash = {
++ .next = NULL,
++ .name = "request_key_auth_read",
++ .file = "security/keys/request_key_auth.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000213_hash = {
++ .next = NULL,
++ .name = "selinux_transaction_write",
++ .file = "security/selinux/selinuxfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000214_hash = {
++ .next = NULL,
++ .name = "shash_async_setkey",
++ .file = "crypto/shash.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000215_hash = {
++ .next = NULL,
++ .name = "shash_compat_setkey",
++ .file = "crypto/shash.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000216_hash = {
++ .next = NULL,
++ .name = "simple_read_from_buffer",
++ .file = "include/linux/fs.h",
++ .param2 = 1,
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000218_hash = {
++ .next = NULL,
++ .name = "store_ifalias",
++ .file = "net/core/net-sysfs.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000219_hash = {
++ .next = NULL,
++ .name = "strategy_allowed_congestion_control",
++ .file = "net/ipv4/sysctl_net_ipv4.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000220_hash = {
++ .next = NULL,
++ .name = "subbuf_read_actor",
++ .file = "kernel/relay.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000221_hash = {
++ .next = NULL,
++ .name = "sysctl_ipc_registered_data",
++ .file = "ipc/ipc_sysctl.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000222_hash = {
++ .next = NULL,
++ .name = "sysctl_tcp_congestion_control",
++ .file = "net/ipv4/sysctl_net_ipv4.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000223_hash = {
++ .next = NULL,
++ .name = "sysctl_uts_string",
++ .file = "kernel/utsname_sysctl.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000224_hash = {
++ .next = NULL,
++ .name = "sys_fgetxattr",
++ .file = "include/linux/syscalls.h",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000225_hash = {
++ .next = NULL,
++ .name = "sysfs_write_file",
++ .file = "fs/sysfs/file.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000226_hash = {
++ .next = NULL,
++ .name = "sys_getxattr",
++ .file = "include/linux/syscalls.h",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000227_hash = {
++ .next = NULL,
++ .name = "sys_lgetxattr",
++ .file = "include/linux/syscalls.h",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000228_hash = {
++ .next = NULL,
++ .name = "sys_sched_getaffinity",
++ .file = "include/linux/syscalls.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000229_hash = {
++ .next = NULL,
++ .name = "sys_sched_setaffinity",
++ .file = "include/linux/syscalls.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000230_hash = {
++ .next = NULL,
++ .name = "tpm_read",
++ .file = "drivers/char/tpm/tpm.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000231_hash = {
++ .next = NULL,
++ .name = "user_read",
++ .file = "include/keys/user-type.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000232_hash = {
++ .next = NULL,
++ .name = "vcs_read",
++ .file = "drivers/char/vc_screen.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000233_hash = {
++ .next = NULL,
++ .name = "vfs_readv",
++ .file = "include/linux/fs.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000234_hash = {
++ .next = NULL,
++ .name = "vfs_writev",
++ .file = "include/linux/fs.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000235_hash = {
++ .next = NULL,
++ .name = "vga_arb_read",
++ .file = "drivers/gpu/vga/vgaarb.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000236_hash = {
++ .next = NULL,
++ .name = "acpi_system_read_dsdt",
++ .file = "drivers/acpi/system.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000237_hash = {
++ .next = NULL,
++ .name = "acpi_system_read_fadt",
++ .file = "drivers/acpi/system.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000238_hash = {
++ .next = NULL,
++ .name = "cgroup_read_s64",
++ .file = "kernel/cgroup.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000239_hash = {
++ .next = NULL,
++ .name = "cgroup_read_u64",
++ .file = "kernel/cgroup.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000240_hash = {
++ .next = NULL,
++ .name = "cpuset_common_file_read",
++ .file = "kernel/cpuset.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000241_hash = {
++ .next = NULL,
++ .name = "filter_read",
++ .file = "lib/dma-debug.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000242_hash = {
++ .next = NULL,
++ .name = "ima_show_htable_value",
++ .file = "security/integrity/ima/ima_fs.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000243_hash = {
++ .next = NULL,
++ .name = "kernel_readv",
++ .file = "fs/splice.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000244_hash = {
++ .next = NULL,
++ .name = "mqueue_read_file",
++ .file = "ipc/mqueue.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000245_hash = {
++ .next = NULL,
++ .name = "oom_adjust_read",
++ .file = "fs/proc/base.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000246_hash = {
++ .next = NULL,
++ .name = "parse_table",
++ .file = "kernel/sysctl.c",
++ .param6 = 1,
++};
++
++struct size_overflow_hash _000247_hash = {
++ .next = NULL,
++ .name = "proc_coredump_filter_read",
++ .file = "fs/proc/base.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000248_hash = {
++ .next = NULL,
++ .name = "proc_fdinfo_read",
++ .file = "fs/proc/base.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000249_hash = {
++ .next = NULL,
++ .name = "proc_file_read",
++ .file = "fs/proc/generic.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000250_hash = {
++ .next = NULL,
++ .name = "proc_info_read",
++ .file = "fs/proc/base.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000251_hash = {
++ .next = NULL,
++ .name = "proc_loginuid_read",
++ .file = "fs/proc/base.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000252_hash = {
++ .next = NULL,
++ .name = "proc_pid_attr_read",
++ .file = "fs/proc/base.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000253_hash = {
++ .next = NULL,
++ .name = "proc_sessionid_read",
++ .file = "fs/proc/base.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000254_hash = {
++ .next = NULL,
++ .name = "read_enabled_file_bool",
++ .file = "kernel/kprobes.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000255_hash = {
++ .next = NULL,
++ .name = "read_file_blob",
++ .file = "fs/debugfs/file.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000256_hash = {
++ .next = NULL,
++ .name = "read_file_bool",
++ .file = "fs/debugfs/file.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000257_hash = {
++ .next = NULL,
++ .name = "read_from_oldmem",
++ .file = "fs/proc/vmcore.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000258_hash = {
++ .next = NULL,
++ .name = "read_oldmem",
++ .file = "drivers/char/mem.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000259_hash = {
++ .next = NULL,
++ .name = "res_counter_read",
++ .file = "include/linux/res_counter.h",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000260_hash = {
++ .next = NULL,
++ .name = "sel_read_avc_cache_threshold",
++ .file = "security/selinux/selinuxfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000261_hash = {
++ .next = NULL,
++ .name = "sel_read_avc_hash_stats",
++ .file = "security/selinux/selinuxfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000262_hash = {
++ .next = NULL,
++ .name = "sel_read_bool",
++ .file = "security/selinux/selinuxfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000263_hash = {
++ .next = NULL,
++ .name = "sel_read_checkreqprot",
++ .file = "security/selinux/selinuxfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000264_hash = {
++ .next = NULL,
++ .name = "sel_read_class",
++ .file = "security/selinux/selinuxfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000265_hash = {
++ .next = NULL,
++ .name = "sel_read_enforce",
++ .file = "security/selinux/selinuxfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000266_hash = {
++ .next = NULL,
++ .name = "sel_read_handle_unknown",
++ .file = "security/selinux/selinuxfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000267_hash = {
++ .next = NULL,
++ .name = "sel_read_initcon",
++ .file = "security/selinux/selinuxfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000268_hash = {
++ .next = NULL,
++ .name = "sel_read_mls",
++ .file = "security/selinux/selinuxfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000269_hash = {
++ .next = NULL,
++ .name = "sel_read_perm",
++ .file = "security/selinux/selinuxfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000270_hash = {
++ .next = NULL,
++ .name = "sel_read_policycap",
++ .file = "security/selinux/selinuxfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000271_hash = {
++ .next = NULL,
++ .name = "sel_read_policyvers",
++ .file = "security/selinux/selinuxfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000272_hash = {
++ .next = NULL,
++ .name = "simple_attr_read",
++ .file = "include/linux/fs.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000273_hash = {
++ .next = NULL,
++ .name = "simple_transaction_read",
++ .file = "include/linux/fs.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000274_hash = {
++ .next = NULL,
++ .name = "smk_read_ambient",
++ .file = "security/smack/smackfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000275_hash = {
++ .next = NULL,
++ .name = "smk_read_direct",
++ .file = "security/smack/smackfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000276_hash = {
++ .next = NULL,
++ .name = "smk_read_doi",
++ .file = "security/smack/smackfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000277_hash = {
++ .next = NULL,
++ .name = "smk_read_logging",
++ .file = "security/smack/smackfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000278_hash = {
++ .next = NULL,
++ .name = "smk_read_onlycap",
++ .file = "security/smack/smackfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000279_hash = {
++ .next = NULL,
++ .name = "sysfs_read_file",
++ .file = "fs/sysfs/file.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000280_hash = {
++ .next = NULL,
++ .name = "sys_kexec_load",
++ .file = "include/linux/syscalls.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000281_hash = {
++ .next = NULL,
++ .name = "sys_preadv",
++ .file = "include/linux/syscalls.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000282_hash = {
++ .next = NULL,
++ .name = "sys_pwritev",
++ .file = "include/linux/syscalls.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000283_hash = {
++ .next = NULL,
++ .name = "sys_readv",
++ .file = "include/linux/syscalls.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000284_hash = {
++ .next = NULL,
++ .name = "sys_rt_sigpending",
++ .file = "include/linux/syscalls.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000285_hash = {
++ .next = NULL,
++ .name = "sys_writev",
++ .file = "include/linux/syscalls.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000286_hash = {
++ .next = NULL,
++ .name = "do_sysctl",
++ .file = "include/linux/sysctl.h",
++ .param6 = 1,
++};
++
++struct size_overflow_hash _000287_hash = {
++ .next = NULL,
++ .name = "ima_show_htable_violations",
++ .file = "security/integrity/ima/ima_fs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000288_hash = {
++ .next = NULL,
++ .name = "ima_show_measurements_count",
++ .file = "security/integrity/ima/ima_fs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000289_hash = {
++ .next = NULL,
++ .name = "compat_do_readv_writev",
++ .file = "fs/compat.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000290_hash = {
++ .next = NULL,
++ .name = "compat_sys_kexec_load",
++ .file = "include/linux/kexec.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000291_hash = {
++ .next = NULL,
++ .name = "compat_sys_semtimedop",
++ .file = "include/linux/compat.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000292_hash = {
++ .next = NULL,
++ .name = "__copy_from_user",
++ .file = "arch/x86/include/asm/uaccess_64.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000293_hash = {
++ .next = NULL,
++ .name = "__copy_from_user_nocache",
++ .file = "arch/x86/include/asm/uaccess_64.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000294_hash = {
++ .next = NULL,
++ .name = "__copy_in_user",
++ .file = "arch/x86/include/asm/uaccess_64.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000295_hash = {
++ .next = NULL,
++ .name = "copy_in_user",
++ .file = "arch/x86/include/asm/uaccess_64.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000296_hash = {
++ .next = NULL,
++ .name = "__copy_to_user",
++ .file = "arch/x86/include/asm/uaccess_64.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000297_hash = {
++ .next = NULL,
++ .name = "__copy_to_user_inatomic",
++ .file = "arch/x86/include/asm/uaccess_64.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000298_hash = {
++ .next = NULL,
++ .name = "sys32_rt_sigpending",
++ .file = "arch/x86/include/asm/sys_ia32.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000299_hash = {
++ .next = NULL,
++ .name = "compat_readv",
++ .file = "fs/compat.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000300_hash = {
++ .next = NULL,
++ .name = "compat_writev",
++ .file = "fs/compat.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000301_hash = {
++ .next = NULL,
++ .name = "compat_sys_preadv",
++ .file = "include/linux/compat.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000302_hash = {
++ .next = NULL,
++ .name = "compat_sys_pwritev",
++ .file = "include/linux/compat.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000303_hash = {
++ .next = NULL,
++ .name = "compat_sys_readv",
++ .file = "include/linux/compat.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000304_hash = {
++ .next = NULL,
++ .name = "compat_sys_writev",
++ .file = "include/linux/compat.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000305_hash = {
++ .next = NULL,
++ .name = "acpi_battery_write_alarm",
++ .file = "drivers/acpi/battery.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000306_hash = {
++ .next = NULL,
++ .name = "acpi_battery_write_alarm",
++ .file = "drivers/acpi/sbs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000307_hash = {
++ .next = NULL,
++ .name = "acpi_fan_write_state",
++ .file = "drivers/acpi/fan.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000308_hash = {
++ .next = NULL,
++ .name = "acpi_processor_write_limit",
++ .file = "drivers/acpi/processor_thermal.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000309_hash = {
++ .next = NULL,
++ .name = "acpi_processor_write_throttling",
++ .file = "drivers/acpi/processor_throttling.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000310_hash = {
++ .next = NULL,
++ .name = "acpi_thermal_write_cooling_mode",
++ .file = "drivers/acpi/thermal.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000311_hash = {
++ .next = NULL,
++ .name = "acpi_thermal_write_polling",
++ .file = "drivers/acpi/thermal.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000312_hash = {
++ .next = NULL,
++ .name = "acpi_video_bus_write_DOS",
++ .file = "drivers/acpi/video.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000313_hash = {
++ .next = NULL,
++ .name = "acpi_video_bus_write_POST",
++ .file = "drivers/acpi/video.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000314_hash = {
++ .next = NULL,
++ .name = "acpi_video_device_write_brightness",
++ .file = "drivers/acpi/video.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000315_hash = {
++ .next = NULL,
++ .name = "acpi_video_device_write_state",
++ .file = "drivers/acpi/video.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000316_hash = {
++ .next = NULL,
++ .name = "addtgt",
++ .file = "drivers/block/aoe/aoecmd.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000317_hash = {
++ .next = NULL,
++ .name = "adu_read",
++ .file = "drivers/usb/misc/adutux.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000318_hash = {
++ .next = NULL,
++ .name = "adu_write",
++ .file = "drivers/usb/misc/adutux.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000319_hash = {
++ .next = NULL,
++ .name = "aem_read_sensor",
++ .file = "drivers/hwmon/ibmaem.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000320_hash = {
++ .next = NULL,
++ .name = "aer_inject_write",
++ .file = "drivers/pci/pcie/aer/aer_inject.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000321_hash = {
++ .next = NULL,
++ .name = "aes_decrypt_fail_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000322_hash = {
++ .next = NULL,
++ .name = "aes_decrypt_fail_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000323_hash = {
++ .next = NULL,
++ .name = "aes_decrypt_interrupt_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000324_hash = {
++ .next = NULL,
++ .name = "aes_decrypt_interrupt_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000325_hash = {
++ .next = NULL,
++ .name = "aes_decrypt_packets_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000326_hash = {
++ .next = NULL,
++ .name = "aes_decrypt_packets_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000327_hash = {
++ .next = NULL,
++ .name = "aes_encrypt_fail_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000328_hash = {
++ .next = NULL,
++ .name = "aes_encrypt_fail_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000329_hash = {
++ .next = NULL,
++ .name = "aes_encrypt_interrupt_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000330_hash = {
++ .next = NULL,
++ .name = "aes_encrypt_interrupt_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000331_hash = {
++ .next = NULL,
++ .name = "aes_encrypt_packets_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000332_hash = {
++ .next = NULL,
++ .name = "aes_encrypt_packets_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000333_hash = {
++ .next = NULL,
++ .name = "afs_alloc_flat_call",
++ .file = "fs/afs/rxrpc.c",
++ .param2 = 1,
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000335_hash = {
++ .next = NULL,
++ .name = "afs_proc_cells_write",
++ .file = "fs/afs/proc.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000336_hash = {
++ .next = NULL,
++ .name = "afs_proc_rootcell_write",
++ .file = "fs/afs/proc.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000337_hash = {
++ .next = NULL,
++ .name = "agp_3_5_isochronous_node_enable",
++ .file = "drivers/char/agp/isoch.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000338_hash = {
++ .next = NULL,
++ .name = "agp_alloc_page_array",
++ .file = "drivers/char/agp/generic.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000339_hash = {
++ .next = NULL,
++ .name = "alloc_context",
++ .file = "drivers/md/dm-raid1.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000340_hash = {
++ .next = NULL,
++ .name = "alloc_context",
++ .file = "drivers/md/dm-stripe.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000341_hash = {
++ .next = NULL,
++ .name = "alloc_ep_req",
++ .file = "drivers/usb/gadget/gmidi.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000342_hash = {
++ .next = NULL,
++ .name = "alloc_ring",
++ .file = "drivers/net/cxgb3/sge.c",
++ .param2 = 1,
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000344_hash = {
++ .next = NULL,
++ .name = "alloc_ringbuf",
++ .file = "drivers/usb/serial/spcp8x5.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000345_hash = {
++ .next = NULL,
++ .name = "alloc_ts_config",
++ .file = "include/linux/textsearch.h",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000346_hash = {
++ .next = NULL,
++ .name = "aoedev_flush",
++ .file = "drivers/block/aoe/aoedev.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000347_hash = {
++ .next = NULL,
++ .name = "arcfb_write",
++ .file = "drivers/video/arcfb.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000348_hash = {
++ .next = NULL,
++ .name = "arm_read",
++ .file = "drivers/ieee1394/raw1394.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000349_hash = {
++ .next = NULL,
++ .name = "arm_write",
++ .file = "drivers/ieee1394/raw1394.c",
++ .param6 = 1,
++};
++
++struct size_overflow_hash _000350_hash = {
++ .next = NULL,
++ .name = "asd_store_update_bios",
++ .file = "drivers/scsi/aic94xx/aic94xx_init.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000351_hash = {
++ .next = NULL,
++ .name = "asix_read_cmd",
++ .file = "drivers/net/usb/asix.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000352_hash = {
++ .next = NULL,
++ .name = "asix_write_cmd",
++ .file = "drivers/net/usb/asix.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000353_hash = {
++ .next = NULL,
++ .name = "asn1_octets_decode",
++ .file = "net/ipv4/netfilter/nf_nat_snmp_basic.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000354_hash = {
++ .next = NULL,
++ .name = "asn1_oid_decode",
++ .file = "net/ipv4/netfilter/nf_nat_snmp_basic.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000355_hash = {
++ .next = NULL,
++ .name = "asn1_oid_decode",
++ .file = "fs/cifs/asn1.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000356_hash = {
++ .next = NULL,
++ .name = "atm_get_addr",
++ .file = "net/atm/addr.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000357_hash = {
++ .next = NULL,
++ .name = "attach_hdlc_protocol",
++ .file = "include/linux/hdlc.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000358_hash = {
++ .next = NULL,
++ .name = "av7110_vbi_write",
++ .file = "drivers/media/dvb/ttpci/av7110_v4l.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000359_hash = {
++ .next = NULL,
++ .name = "ax25_setsockopt",
++ .file = "net/ax25/af_ax25.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000360_hash = {
++ .next = NULL,
++ .name = "b43_debugfs_read",
++ .file = "drivers/net/wireless/b43/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000361_hash = {
++ .next = NULL,
++ .name = "b43_debugfs_write",
++ .file = "drivers/net/wireless/b43/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000362_hash = {
++ .next = NULL,
++ .name = "b43legacy_debugfs_read",
++ .file = "drivers/net/wireless/b43legacy/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000363_hash = {
++ .next = NULL,
++ .name = "b43legacy_debugfs_write",
++ .file = "drivers/net/wireless/b43legacy/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000364_hash = {
++ .next = NULL,
++ .name = "bits_to_user",
++ .file = "drivers/input/evdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000365_hash = {
++ .next = NULL,
++ .name = "bm_entry_read",
++ .file = "fs/binfmt_misc.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000366_hash = {
++ .next = NULL,
++ .name = "bm_status_read",
++ .file = "fs/binfmt_misc.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000367_hash = {
++ .next = NULL,
++ .name = "broadsheetfb_write",
++ .file = "drivers/video/broadsheetfb.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000368_hash = {
++ .next = NULL,
++ .name = "btmrvl_curpsmode_read",
++ .file = "drivers/bluetooth/btmrvl_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000369_hash = {
++ .next = NULL,
++ .name = "btmrvl_gpiogap_read",
++ .file = "drivers/bluetooth/btmrvl_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000370_hash = {
++ .next = NULL,
++ .name = "btmrvl_gpiogap_write",
++ .file = "drivers/bluetooth/btmrvl_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000371_hash = {
++ .next = NULL,
++ .name = "btmrvl_hscfgcmd_read",
++ .file = "drivers/bluetooth/btmrvl_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000372_hash = {
++ .next = NULL,
++ .name = "btmrvl_hscfgcmd_write",
++ .file = "drivers/bluetooth/btmrvl_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000373_hash = {
++ .next = &_000007_hash,
++ .name = "btmrvl_hscmd_read",
++ .file = "drivers/bluetooth/btmrvl_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000374_hash = {
++ .next = NULL,
++ .name = "btmrvl_hscmd_write",
++ .file = "drivers/bluetooth/btmrvl_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000375_hash = {
++ .next = NULL,
++ .name = "btmrvl_hsmode_read",
++ .file = "drivers/bluetooth/btmrvl_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000376_hash = {
++ .next = NULL,
++ .name = "btmrvl_hsmode_write",
++ .file = "drivers/bluetooth/btmrvl_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000377_hash = {
++ .next = NULL,
++ .name = "btmrvl_hsstate_read",
++ .file = "drivers/bluetooth/btmrvl_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000378_hash = {
++ .next = NULL,
++ .name = "btmrvl_pscmd_read",
++ .file = "drivers/bluetooth/btmrvl_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000379_hash = {
++ .next = NULL,
++ .name = "btmrvl_pscmd_write",
++ .file = "drivers/bluetooth/btmrvl_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000380_hash = {
++ .next = NULL,
++ .name = "btmrvl_psmode_read",
++ .file = "drivers/bluetooth/btmrvl_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000381_hash = {
++ .next = NULL,
++ .name = "btmrvl_psmode_write",
++ .file = "drivers/bluetooth/btmrvl_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000382_hash = {
++ .next = NULL,
++ .name = "btmrvl_psstate_read",
++ .file = "drivers/bluetooth/btmrvl_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000383_hash = {
++ .next = NULL,
++ .name = "btmrvl_txdnldready_read",
++ .file = "drivers/bluetooth/btmrvl_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000384_hash = {
++ .next = NULL,
++ .name = "cache_do_downcall",
++ .file = "net/sunrpc/cache.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000385_hash = {
++ .next = NULL,
++ .name = "cachefiles_daemon_write",
++ .file = "fs/cachefiles/daemon.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000386_hash = {
++ .next = NULL,
++ .name = "cache_read",
++ .file = "net/sunrpc/cache.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000387_hash = {
++ .next = NULL,
++ .name = "cafe_deliver_buffer",
++ .file = "drivers/media/video/cafe_ccic.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000388_hash = {
++ .next = NULL,
++ .name = "cciss_proc_write",
++ .file = "drivers/block/cciss.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000389_hash = {
++ .next = NULL,
++ .name = "cfg80211_connect_result",
++ .file = "include/net/cfg80211.h",
++ .param4 = 1,
++ .param6 = 1,
++};
++
++struct size_overflow_hash _000391_hash = {
++ .next = NULL,
++ .name = "cfg80211_disconnected",
++ .file = "include/net/cfg80211.h",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000392_hash = {
++ .next = NULL,
++ .name = "cfg80211_inform_bss",
++ .file = "include/net/cfg80211.h",
++ .param8 = 1,
++};
++
++struct size_overflow_hash _000393_hash = {
++ .next = NULL,
++ .name = "cfg80211_inform_bss_frame",
++ .file = "include/net/cfg80211.h",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000394_hash = {
++ .next = NULL,
++ .name = "cfg80211_roamed",
++ .file = "include/net/cfg80211.h",
++ .param4 = 1,
++ .param6 = 1,
++};
++
++struct size_overflow_hash _000396_hash = {
++ .next = NULL,
++ .name = "cfi_read_pri",
++ .file = "include/linux/mtd/cfi.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000397_hash = {
++ .next = NULL,
++ .name = "cifs_security_flags_proc_write",
++ .file = "fs/cifs/cifs_debug.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000398_hash = {
++ .next = NULL,
++ .name = "CIFSSMBWrite",
++ .file = "fs/cifs/cifssmb.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000399_hash = {
++ .next = NULL,
++ .name = "cifs_spnego_key_instantiate",
++ .file = "fs/cifs/cifs_spnego.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000400_hash = {
++ .next = NULL,
++ .name = "ci_ll_write",
++ .file = "drivers/media/dvb/ttpci/av7110_ca.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000401_hash = {
++ .next = NULL,
++ .name = "clusterip_proc_write",
++ .file = "net/ipv4/netfilter/ipt_CLUSTERIP.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000402_hash = {
++ .next = &_000075_hash,
++ .name = "cm4040_write",
++ .file = "drivers/char/pcmcia/cm4040_cs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000403_hash = {
++ .next = NULL,
++ .name = "cm_copy_private_data",
++ .file = "drivers/infiniband/core/cm.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000404_hash = {
++ .next = NULL,
++ .name = "cmm_write",
++ .file = "drivers/char/pcmcia/cm4000_cs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000405_hash = {
++ .next = NULL,
++ .name = "coda_psdev_read",
++ .file = "fs/coda/psdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000406_hash = {
++ .next = NULL,
++ .name = "coda_psdev_write",
++ .file = "fs/coda/psdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000407_hash = {
++ .next = NULL,
++ .name = "codec_reg_read_file",
++ .file = "sound/soc/soc-core.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000408_hash = {
++ .next = NULL,
++ .name = "command_file_write",
++ .file = "drivers/misc/ibmasm/ibmasmfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000409_hash = {
++ .next = NULL,
++ .name = "command_write",
++ .file = "drivers/uwb/uwb-debug.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000410_hash = {
++ .next = NULL,
++ .name = "concat_writev",
++ .file = "drivers/mtd/mtdconcat.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000411_hash = {
++ .next = NULL,
++ .name = "configfs_read_file",
++ .file = "fs/configfs/file.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000412_hash = {
++ .next = NULL,
++ .name = "copy_entries_to_user",
++ .file = "net/ipv6/netfilter/ip6_tables.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000413_hash = {
++ .next = NULL,
++ .name = "copy_entries_to_user",
++ .file = "net/ipv4/netfilter/arp_tables.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000414_hash = {
++ .next = NULL,
++ .name = "copy_entries_to_user",
++ .file = "net/ipv4/netfilter/ip_tables.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000415_hash = {
++ .next = NULL,
++ .name = "__copy_from_user_inatomic_nocache",
++ .file = "arch/x86/include/asm/uaccess_32.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000416_hash = {
++ .next = NULL,
++ .name = "copy_from_user_toio",
++ .file = "include/sound/core.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000417_hash = {
++ .next = NULL,
++ .name = "copy_macs",
++ .file = "net/atm/mpc.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000418_hash = {
++ .next = NULL,
++ .name = "copy_to_user_fromio",
++ .file = "include/sound/core.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000419_hash = {
++ .next = NULL,
++ .name = "cosa_write",
++ .file = "drivers/net/wan/cosa.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000420_hash = {
++ .next = NULL,
++ .name = "create_attr_set",
++ .file = "drivers/platform/x86/thinkpad_acpi.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000421_hash = {
++ .next = NULL,
++ .name = "create_entry",
++ .file = "fs/binfmt_misc.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000422_hash = {
++ .next = NULL,
++ .name = "create_queues",
++ .file = "drivers/atm/ambassador.c",
++ .param2 = 1,
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000424_hash = {
++ .next = NULL,
++ .name = "cryptd_alloc_instance",
++ .file = "crypto/cryptd.c",
++ .param2 = 1,
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000426_hash = {
++ .next = NULL,
++ .name = "cryptd_hash_setkey",
++ .file = "crypto/cryptd.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000427_hash = {
++ .next = NULL,
++ .name = "crypto_authenc_setkey",
++ .file = "crypto/authenc.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000428_hash = {
++ .next = NULL,
++ .name = "csr1212_new_leaf",
++ .file = "drivers/ieee1394/csr1212.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000429_hash = {
++ .next = NULL,
++ .name = "csr1212_rom_cache_malloc",
++ .file = "drivers/ieee1394/csr1212.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000430_hash = {
++ .next = NULL,
++ .name = "ctrl_out",
++ .file = "drivers/usb/misc/usbtest.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000431_hash = {
++ .next = NULL,
++ .name = "cx18_copy_buf_to_user",
++ .file = "drivers/media/video/cx18/cx18-fileops.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000432_hash = {
++ .next = NULL,
++ .name = "cx24116_writeregN",
++ .file = "drivers/media/dvb/frontends/cx24116.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000433_hash = {
++ .next = NULL,
++ .name = "cxgb3i_alloc_big_mem",
++ .file = "drivers/scsi/cxgb3i/cxgb3i_ddp.h",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000434_hash = {
++ .next = NULL,
++ .name = "cxgb3i_ddp_make_gl",
++ .file = "drivers/scsi/cxgb3i/cxgb3i_ddp.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000435_hash = {
++ .next = &_000140_hash,
++ .name = "cxgb_alloc_mem",
++ .file = "drivers/net/cxgb3/cxgb3_offload.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000436_hash = {
++ .next = NULL,
++ .name = "__cxio_init_resource_fifo",
++ .file = "drivers/infiniband/hw/cxgb3/cxio_resource.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000437_hash = {
++ .next = NULL,
++ .name = "cypress_buf_alloc",
++ .file = "drivers/usb/serial/cypress_m8.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000438_hash = {
++ .next = NULL,
++ .name = "dabusb_read",
++ .file = "drivers/media/video/dabusb.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000439_hash = {
++ .next = NULL,
++ .name = "dac960_user_command_proc_write",
++ .file = "drivers/block/DAC960.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000440_hash = {
++ .next = NULL,
++ .name = "dapm_widget_power_read_file",
++ .file = "sound/soc/soc-dapm.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000441_hash = {
++ .next = NULL,
++ .name = "dccp_feat_clone_sp_val",
++ .file = "net/dccp/feat.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000442_hash = {
++ .next = NULL,
++ .name = "dccp_setsockopt_ccid",
++ .file = "net/dccp/proto.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000443_hash = {
++ .next = NULL,
++ .name = "dccp_setsockopt_service",
++ .file = "net/dccp/proto.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000444_hash = {
++ .next = NULL,
++ .name = "debug_buffer_read",
++ .file = "fs/ocfs2/dlm/dlmdebug.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000445_hash = {
++ .next = NULL,
++ .name = "debug_output",
++ .file = "drivers/usb/host/ohci-dbg.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000446_hash = {
++ .next = NULL,
++ .name = "debug_output",
++ .file = "drivers/usb/host/ehci-dbg.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000447_hash = {
++ .next = NULL,
++ .name = "dev_config",
++ .file = "drivers/usb/gadget/inode.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000448_hash = {
++ .next = NULL,
++ .name = "device_write",
++ .file = "fs/dlm/user.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000449_hash = {
++ .next = NULL,
++ .name = "dev_read",
++ .file = "drivers/media/video/gspca/gspca.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000450_hash = {
++ .next = NULL,
++ .name = "dispatch_proc_write",
++ .file = "drivers/platform/x86/thinkpad_acpi.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000451_hash = {
++ .next = NULL,
++ .name = "dispatch_write",
++ .file = "drivers/platform/x86/toshiba_acpi.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000452_hash = {
++ .next = NULL,
++ .name = "dlmfs_file_read",
++ .file = "fs/ocfs2/dlm/dlmfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000453_hash = {
++ .next = NULL,
++ .name = "dlmfs_file_write",
++ .file = "fs/ocfs2/dlm/dlmfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000454_hash = {
++ .next = NULL,
++ .name = "dma_rx_errors_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000455_hash = {
++ .next = NULL,
++ .name = "dma_rx_errors_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000456_hash = {
++ .next = NULL,
++ .name = "dma_rx_requested_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000457_hash = {
++ .next = NULL,
++ .name = "dma_rx_requested_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000458_hash = {
++ .next = NULL,
++ .name = "dma_tx_errors_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000459_hash = {
++ .next = NULL,
++ .name = "dma_tx_errors_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000460_hash = {
++ .next = NULL,
++ .name = "dma_tx_requested_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000461_hash = {
++ .next = NULL,
++ .name = "dma_tx_requested_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000462_hash = {
++ .next = NULL,
++ .name = "dm_read",
++ .file = "drivers/net/usb/dm9601.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000463_hash = {
++ .next = NULL,
++ .name = "dm_vcalloc",
++ .file = "include/linux/device-mapper.h",
++ .param1 = 1,
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000465_hash = {
++ .next = NULL,
++ .name = "dm_write",
++ .file = "drivers/net/usb/dm9601.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000466_hash = {
++ .next = NULL,
++ .name = "dn_def_dev_strategy",
++ .file = "net/decnet/sysctl_net_decnet.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000467_hash = {
++ .next = NULL,
++ .name = "__dn_setsockopt",
++ .file = "net/decnet/af_decnet.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000468_hash = {
++ .next = NULL,
++ .name = "dns_resolver_instantiate",
++ .file = "fs/cifs/dns_resolve.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000469_hash = {
++ .next = NULL,
++ .name = "dns_resolve_server_name_to_ip",
++ .file = "fs/cifs/dns_resolve.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000470_hash = {
++ .next = NULL,
++ .name = "do_add_counters",
++ .file = "net/ipv6/netfilter/ip6_tables.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000471_hash = {
++ .next = NULL,
++ .name = "do_add_counters",
++ .file = "net/ipv4/netfilter/ip_tables.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000472_hash = {
++ .next = NULL,
++ .name = "do_add_counters",
++ .file = "net/ipv4/netfilter/arp_tables.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000473_hash = {
++ .next = NULL,
++ .name = "do_ipv6_setsockopt",
++ .file = "net/ipv6/ipv6_sockglue.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000474_hash = {
++ .next = NULL,
++ .name = "do_ip_vs_set_ctl",
++ .file = "net/netfilter/ipvs/ip_vs_ctl.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000475_hash = {
++ .next = NULL,
++ .name = "__do_replace",
++ .file = "net/ipv6/netfilter/ip6_tables.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000476_hash = {
++ .next = NULL,
++ .name = "__do_replace",
++ .file = "net/ipv4/netfilter/ip_tables.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000477_hash = {
++ .next = NULL,
++ .name = "__do_replace",
++ .file = "net/ipv4/netfilter/arp_tables.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000478_hash = {
++ .next = NULL,
++ .name = "do_sync",
++ .file = "fs/gfs2/quota.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000479_hash = {
++ .next = NULL,
++ .name = "drm_calloc_large",
++ .file = "include/drm/drmP.h",
++ .param1 = 1,
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000481_hash = {
++ .next = NULL,
++ .name = "drm_sman_init",
++ .file = "drivers/gpu/drm/drm_sman.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000482_hash = {
++ .next = NULL,
++ .name = "drm_vmalloc_dma",
++ .file = "drivers/gpu/drm/drm_scatter.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000483_hash = {
++ .next = NULL,
++ .name = "ds_ioctl",
++ .file = "drivers/pcmcia/pcmcia_ioctl.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000484_hash = {
++ .next = NULL,
++ .name = "dsp_write",
++ .file = "sound/oss/msnd_pinnacle.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000485_hash = {
++ .next = NULL,
++ .name = "dv1394_read",
++ .file = "drivers/ieee1394/dv1394.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000486_hash = {
++ .next = NULL,
++ .name = "dv1394_write",
++ .file = "drivers/ieee1394/dv1394.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000487_hash = {
++ .next = NULL,
++ .name = "dvb_aplay",
++ .file = "drivers/media/dvb/ttpci/av7110_av.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000488_hash = {
++ .next = NULL,
++ .name = "dvb_ca_en50221_io_write",
++ .file = "drivers/media/dvb/dvb-core/dvb_ca_en50221.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000489_hash = {
++ .next = NULL,
++ .name = "dvb_dmxdev_set_buffer_size",
++ .file = "drivers/media/dvb/dvb-core/dmxdev.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000490_hash = {
++ .next = NULL,
++ .name = "dvbdmx_write",
++ .file = "drivers/media/dvb/dvb-core/dvb_demux.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000491_hash = {
++ .next = NULL,
++ .name = "dvb_dvr_set_buffer_size",
++ .file = "drivers/media/dvb/dvb-core/dmxdev.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000492_hash = {
++ .next = NULL,
++ .name = "dvb_play",
++ .file = "drivers/media/dvb/ttpci/av7110_av.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000493_hash = {
++ .next = NULL,
++ .name = "dvb_ringbuffer_pkt_read_user",
++ .file = "drivers/media/dvb/dvb-core/dvb_ringbuffer.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000494_hash = {
++ .next = NULL,
++ .name = "dvb_ringbuffer_read_user",
++ .file = "drivers/media/dvb/dvb-core/dvb_ringbuffer.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000495_hash = {
++ .next = NULL,
++ .name = "econet_sendmsg",
++ .file = "net/econet/af_econet.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000496_hash = {
++ .next = NULL,
++ .name = "ecryptfs_copy_filename",
++ .file = "fs/ecryptfs/crypto.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000497_hash = {
++ .next = NULL,
++ .name = "ecryptfs_miscdev_write",
++ .file = "fs/ecryptfs/miscdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000498_hash = {
++ .next = NULL,
++ .name = "ecryptfs_send_miscdev",
++ .file = "fs/ecryptfs/miscdev.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000499_hash = {
++ .next = NULL,
++ .name = "edac_device_alloc_ctl_info",
++ .file = "drivers/edac/edac_device.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000500_hash = {
++ .next = NULL,
++ .name = "edac_mc_alloc",
++ .file = "drivers/edac/edac_mc.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000501_hash = {
++ .next = NULL,
++ .name = "edac_pci_alloc_ctl_info",
++ .file = "drivers/edac/edac_pci.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000502_hash = {
++ .next = &_000199_hash,
++ .name = "edge_buf_alloc",
++ .file = "drivers/usb/serial/io_ti.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000503_hash = {
++ .next = NULL,
++ .name = "efivar_create_sysfs_entry",
++ .file = "drivers/firmware/efivars.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000504_hash = {
++ .next = NULL,
++ .name = "efx_tsoh_heap_alloc",
++ .file = "drivers/net/sfc/tx.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000505_hash = {
++ .next = NULL,
++ .name = "ep0_write",
++ .file = "drivers/usb/gadget/inode.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000506_hash = {
++ .next = NULL,
++ .name = "ep_read",
++ .file = "drivers/usb/gadget/inode.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000507_hash = {
++ .next = NULL,
++ .name = "ep_write",
++ .file = "drivers/usb/gadget/inode.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000508_hash = {
++ .next = NULL,
++ .name = "et61x251_read",
++ .file = "drivers/media/video/et61x251/et61x251_core.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000509_hash = {
++ .next = NULL,
++ .name = "event_calibration_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000510_hash = {
++ .next = NULL,
++ .name = "event_calibration_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000511_hash = {
++ .next = NULL,
++ .name = "event_heart_beat_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000512_hash = {
++ .next = NULL,
++ .name = "event_heart_beat_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000513_hash = {
++ .next = NULL,
++ .name = "event_oom_late_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000514_hash = {
++ .next = NULL,
++ .name = "event_oom_late_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000515_hash = {
++ .next = NULL,
++ .name = "event_phy_transmit_error_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000516_hash = {
++ .next = NULL,
++ .name = "event_phy_transmit_error_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000517_hash = {
++ .next = NULL,
++ .name = "event_rx_mem_empty_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000518_hash = {
++ .next = NULL,
++ .name = "event_rx_mem_empty_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000519_hash = {
++ .next = NULL,
++ .name = "event_rx_mismatch_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000520_hash = {
++ .next = NULL,
++ .name = "event_rx_mismatch_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000521_hash = {
++ .next = NULL,
++ .name = "event_rx_pool_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000522_hash = {
++ .next = NULL,
++ .name = "event_rx_pool_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000523_hash = {
++ .next = NULL,
++ .name = "event_tx_stuck_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000524_hash = {
++ .next = NULL,
++ .name = "event_tx_stuck_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000525_hash = {
++ .next = NULL,
++ .name = "excessive_retries_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000526_hash = {
++ .next = NULL,
++ .name = "excessive_retries_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000527_hash = {
++ .next = NULL,
++ .name = "fb_read",
++ .file = "drivers/video/fbmem.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000528_hash = {
++ .next = NULL,
++ .name = "fb_sys_read",
++ .file = "include/linux/fb.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000529_hash = {
++ .next = NULL,
++ .name = "fb_sys_write",
++ .file = "include/linux/fb.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000530_hash = {
++ .next = NULL,
++ .name = "fb_write",
++ .file = "drivers/video/fbmem.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000531_hash = {
++ .next = NULL,
++ .name = "fcp_request",
++ .file = "drivers/ieee1394/raw1394.c",
++ .param6 = 1,
++};
++
++struct size_overflow_hash _000532_hash = {
++ .next = NULL,
++ .name = "fd_copyin",
++ .file = "drivers/block/floppy.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000533_hash = {
++ .next = NULL,
++ .name = "fd_copyout",
++ .file = "drivers/block/floppy.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000534_hash = {
++ .next = NULL,
++ .name = "fill_write_buffer",
++ .file = "fs/configfs/file.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000535_hash = {
++ .next = NULL,
++ .name = "flexcop_device_kmalloc",
++ .file = "drivers/media/dvb/b2c2/flexcop.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000536_hash = {
++ .next = NULL,
++ .name = "format_devstat_counter",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000537_hash = {
++ .next = NULL,
++ .name = "fragmentation_threshold_read",
++ .file = "net/wireless/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000538_hash = {
++ .next = NULL,
++ .name = "framebuffer_alloc",
++ .file = "include/linux/fb.h",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000539_hash = {
++ .next = NULL,
++ .name = "frequency_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000540_hash = {
++ .next = NULL,
++ .name = "ftdi_elan_write",
++ .file = "drivers/usb/misc/ftdi-elan.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000541_hash = {
++ .next = NULL,
++ .name = "fuse_conn_limit_read",
++ .file = "fs/fuse/control.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000542_hash = {
++ .next = NULL,
++ .name = "fuse_conn_limit_write",
++ .file = "fs/fuse/control.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000543_hash = {
++ .next = &_000388_hash,
++ .name = "fuse_conn_waiting_read",
++ .file = "fs/fuse/control.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000544_hash = {
++ .next = NULL,
++ .name = "garp_attr_create",
++ .file = "net/802/garp.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000545_hash = {
++ .next = NULL,
++ .name = "getdqbuf",
++ .file = "fs/quota/quota_tree.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000546_hash = {
++ .next = NULL,
++ .name = "get_fdb_entries",
++ .file = "net/bridge/br_ioctl.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000547_hash = {
++ .next = NULL,
++ .name = "get_registers",
++ .file = "drivers/net/usb/pegasus.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000548_hash = {
++ .next = NULL,
++ .name = "get_ucode_user",
++ .file = "arch/x86/kernel/microcode_intel.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000549_hash = {
++ .next = NULL,
++ .name = "gfs2_glock_nq_m",
++ .file = "fs/gfs2/glock.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000550_hash = {
++ .next = NULL,
++ .name = "gigaset_initdriver",
++ .file = "drivers/isdn/gigaset/common.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000551_hash = {
++ .next = NULL,
++ .name = "gs_alloc_req",
++ .file = "drivers/usb/gadget/u_serial.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000552_hash = {
++ .next = NULL,
++ .name = "gs_buf_alloc",
++ .file = "drivers/usb/gadget/u_serial.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000553_hash = {
++ .next = NULL,
++ .name = "gss_pipe_downcall",
++ .file = "net/sunrpc/auth_gss/auth_gss.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000554_hash = {
++ .next = NULL,
++ .name = "hcd_buffer_alloc",
++ .file = "drivers/usb/core/buffer.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000555_hash = {
++ .next = NULL,
++ .name = "hci_sock_setsockopt",
++ .file = "net/bluetooth/hci_sock.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000556_hash = {
++ .next = NULL,
++ .name = "hdpvr_read",
++ .file = "drivers/media/video/hdpvr/hdpvr-video.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000557_hash = {
++ .next = NULL,
++ .name = "hecubafb_write",
++ .file = "drivers/video/hecubafb.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000558_hash = {
++ .next = NULL,
++ .name = "hid_parse_report",
++ .file = "include/linux/hid.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000559_hash = {
++ .next = NULL,
++ .name = "hidraw_read",
++ .file = "drivers/hid/hidraw.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000560_hash = {
++ .next = NULL,
++ .name = "hidraw_write",
++ .file = "drivers/hid/hidraw.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000561_hash = {
++ .next = NULL,
++ .name = "hid_register_field",
++ .file = "drivers/hid/hid-core.c",
++ .param2 = 1,
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000563_hash = {
++ .next = NULL,
++ .name = "hpfs_translate_name",
++ .file = "fs/hpfs/name.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000564_hash = {
++ .next = NULL,
++ .name = "hpsb_alloc_host",
++ .file = "drivers/ieee1394/hosts.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000565_hash = {
++ .next = NULL,
++ .name = "hpsb_create_hostinfo",
++ .file = "drivers/ieee1394/highlevel.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000566_hash = {
++ .next = NULL,
++ .name = "hpsb_iso_common_init",
++ .file = "drivers/ieee1394/iso.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000567_hash = {
++ .next = NULL,
++ .name = "ht40allow_map_read",
++ .file = "net/wireless/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000568_hash = {
++ .next = NULL,
++ .name = "__hwahc_dev_set_key",
++ .file = "drivers/usb/host/hwa-hc.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000569_hash = {
++ .next = NULL,
++ .name = "hysdn_conf_read",
++ .file = "drivers/isdn/hysdn/hysdn_procconf.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000570_hash = {
++ .next = NULL,
++ .name = "hysdn_conf_write",
++ .file = "drivers/isdn/hysdn/hysdn_procconf.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000571_hash = {
++ .next = NULL,
++ .name = "hysdn_log_write",
++ .file = "drivers/isdn/hysdn/hysdn_proclog.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000572_hash = {
++ .next = NULL,
++ .name = "i2400m_queue_work",
++ .file = "drivers/net/wimax/i2400m/driver.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000573_hash = {
++ .next = NULL,
++ .name = "i2400m_rx_stats_read",
++ .file = "drivers/net/wimax/i2400m/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000574_hash = {
++ .next = NULL,
++ .name = "i2400m_tx_stats_read",
++ .file = "drivers/net/wimax/i2400m/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000575_hash = {
++ .next = NULL,
++ .name = "__i2400mu_send_barker",
++ .file = "drivers/net/wimax/i2400m/usb.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000576_hash = {
++ .next = NULL,
++ .name = "i2cdev_read",
++ .file = "drivers/i2c/i2c-dev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000577_hash = {
++ .next = NULL,
++ .name = "i2cdev_write",
++ .file = "drivers/i2c/i2c-dev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000578_hash = {
++ .next = NULL,
++ .name = "ib_alloc_device",
++ .file = "include/rdma/ib_verbs.h",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000579_hash = {
++ .next = NULL,
++ .name = "ib_copy_from_udata",
++ .file = "include/rdma/ib_verbs.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000580_hash = {
++ .next = NULL,
++ .name = "ib_copy_to_udata",
++ .file = "include/rdma/ib_verbs.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000581_hash = {
++ .next = NULL,
++ .name = "ibmasm_new_command",
++ .file = "drivers/misc/ibmasm/command.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000582_hash = {
++ .next = NULL,
++ .name = "ib_ucm_alloc_data",
++ .file = "drivers/infiniband/core/ucm.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000583_hash = {
++ .next = NULL,
++ .name = "ib_umad_write",
++ .file = "drivers/infiniband/core/user_mad.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000584_hash = {
++ .next = NULL,
++ .name = "ib_uverbs_unmarshall_recv",
++ .file = "drivers/infiniband/core/uverbs_cmd.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000585_hash = {
++ .next = NULL,
++ .name = "ide_driver_proc_write",
++ .file = "drivers/ide/ide-proc.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000586_hash = {
++ .next = NULL,
++ .name = "ide_settings_proc_write",
++ .file = "drivers/ide/ide-proc.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000587_hash = {
++ .next = NULL,
++ .name = "idetape_chrdev_read",
++ .file = "drivers/ide/ide-tape.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000588_hash = {
++ .next = NULL,
++ .name = "idetape_chrdev_write",
++ .file = "drivers/ide/ide-tape.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000589_hash = {
++ .next = NULL,
++ .name = "idmap_pipe_downcall",
++ .file = "fs/nfs/idmap.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000590_hash = {
++ .next = NULL,
++ .name = "idmouse_read",
++ .file = "drivers/usb/misc/idmouse.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000591_hash = {
++ .next = NULL,
++ .name = "ieee80211_if_read",
++ .file = "net/mac80211/debugfs_netdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000592_hash = {
++ .next = NULL,
++ .name = "ieee80211_key_alloc",
++ .file = "net/mac80211/key.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000593_hash = {
++ .next = NULL,
++ .name = "ikconfig_read_current",
++ .file = "kernel/configs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000594_hash = {
++ .next = NULL,
++ .name = "ilo_read",
++ .file = "drivers/misc/hpilo.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000595_hash = {
++ .next = NULL,
++ .name = "ilo_write",
++ .file = "drivers/misc/hpilo.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000596_hash = {
++ .next = NULL,
++ .name = "iowarrior_read",
++ .file = "drivers/usb/misc/iowarrior.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000597_hash = {
++ .next = NULL,
++ .name = "iowarrior_write",
++ .file = "drivers/usb/misc/iowarrior.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000598_hash = {
++ .next = NULL,
++ .name = "irda_setsockopt",
++ .file = "net/irda/af_irda.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000599_hash = {
++ .next = NULL,
++ .name = "irnet_ctrl_write",
++ .file = "net/irda/irnet/irnet_ppp.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000600_hash = {
++ .next = NULL,
++ .name = "isdn_read",
++ .file = "drivers/isdn/i4l/isdn_common.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000601_hash = {
++ .next = NULL,
++ .name = "iso_callback",
++ .file = "drivers/firewire/core-cdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000602_hash = {
++ .next = NULL,
++ .name = "iso_sched_alloc",
++ .file = "drivers/usb/host/ehci-sched.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000603_hash = {
++ .next = NULL,
++ .name = "isr_cmd_cmplt_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000604_hash = {
++ .next = NULL,
++ .name = "isr_cmd_cmplt_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000605_hash = {
++ .next = NULL,
++ .name = "isr_commands_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000606_hash = {
++ .next = NULL,
++ .name = "isr_commands_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000607_hash = {
++ .next = NULL,
++ .name = "isr_decrypt_done_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000608_hash = {
++ .next = NULL,
++ .name = "isr_decrypt_done_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000609_hash = {
++ .next = NULL,
++ .name = "isr_dma0_done_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000610_hash = {
++ .next = NULL,
++ .name = "isr_dma0_done_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000611_hash = {
++ .next = NULL,
++ .name = "isr_dma1_done_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000612_hash = {
++ .next = NULL,
++ .name = "isr_dma1_done_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000613_hash = {
++ .next = NULL,
++ .name = "isr_fiqs_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000614_hash = {
++ .next = NULL,
++ .name = "isr_fiqs_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000615_hash = {
++ .next = NULL,
++ .name = "isr_host_acknowledges_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000616_hash = {
++ .next = NULL,
++ .name = "isr_host_acknowledges_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000617_hash = {
++ .next = &_000460_hash,
++ .name = "isr_hw_pm_mode_changes_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000618_hash = {
++ .next = &_000461_hash,
++ .name = "isr_hw_pm_mode_changes_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000619_hash = {
++ .next = NULL,
++ .name = "isr_irqs_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000620_hash = {
++ .next = NULL,
++ .name = "isr_irqs_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000621_hash = {
++ .next = NULL,
++ .name = "isr_low_rssi_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000622_hash = {
++ .next = NULL,
++ .name = "isr_low_rssi_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000623_hash = {
++ .next = NULL,
++ .name = "isr_pci_pm_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000624_hash = {
++ .next = NULL,
++ .name = "isr_pci_pm_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000625_hash = {
++ .next = NULL,
++ .name = "isr_rx_headers_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000626_hash = {
++ .next = NULL,
++ .name = "isr_rx_headers_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000627_hash = {
++ .next = NULL,
++ .name = "isr_rx_mem_overflow_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000628_hash = {
++ .next = NULL,
++ .name = "isr_rx_mem_overflow_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000629_hash = {
++ .next = NULL,
++ .name = "isr_rx_procs_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000630_hash = {
++ .next = NULL,
++ .name = "isr_rx_procs_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000631_hash = {
++ .next = NULL,
++ .name = "isr_rx_rdys_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000632_hash = {
++ .next = NULL,
++ .name = "isr_rx_rdys_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000633_hash = {
++ .next = NULL,
++ .name = "isr_tx_exch_complete_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000634_hash = {
++ .next = NULL,
++ .name = "isr_tx_exch_complete_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000635_hash = {
++ .next = NULL,
++ .name = "isr_tx_procs_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000636_hash = {
++ .next = NULL,
++ .name = "isr_tx_procs_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000637_hash = {
++ .next = NULL,
++ .name = "isr_wakeups_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000638_hash = {
++ .next = NULL,
++ .name = "isr_wakeups_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000639_hash = {
++ .next = NULL,
++ .name = "ivtv_copy_buf_to_user",
++ .file = "drivers/media/video/ivtv/ivtv-fileops.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000640_hash = {
++ .next = NULL,
++ .name = "ivtvfb_write",
++ .file = "drivers/media/video/ivtv/ivtvfb.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000641_hash = {
++ .next = NULL,
++ .name = "iwl3945_sta_dbgfs_stats_table_read",
++ .file = "drivers/net/wireless/iwlwifi/iwl-3945-rs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000642_hash = {
++ .next = NULL,
++ .name = "iwl_dbgfs_chain_noise_read",
++ .file = "drivers/net/wireless/iwlwifi/iwl-debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000643_hash = {
++ .next = NULL,
++ .name = "iwl_dbgfs_channels_read",
++ .file = "drivers/net/wireless/iwlwifi/iwl-debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000644_hash = {
++ .next = NULL,
++ .name = "iwl_dbgfs_current_sleep_command_read",
++ .file = "drivers/net/wireless/iwlwifi/iwl-debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000645_hash = {
++ .next = NULL,
++ .name = "iwl_dbgfs_disable_ht40_read",
++ .file = "drivers/net/wireless/iwlwifi/iwl-debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000646_hash = {
++ .next = NULL,
++ .name = "iwl_dbgfs_interrupt_read",
++ .file = "drivers/net/wireless/iwlwifi/iwl-debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000647_hash = {
++ .next = NULL,
++ .name = "iwl_dbgfs_led_read",
++ .file = "drivers/net/wireless/iwlwifi/iwl-debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000648_hash = {
++ .next = NULL,
++ .name = "iwl_dbgfs_nvm_read",
++ .file = "drivers/net/wireless/iwlwifi/iwl-debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000649_hash = {
++ .next = NULL,
++ .name = "iwl_dbgfs_qos_read",
++ .file = "drivers/net/wireless/iwlwifi/iwl-debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000650_hash = {
++ .next = NULL,
++ .name = "iwl_dbgfs_rx_queue_read",
++ .file = "drivers/net/wireless/iwlwifi/iwl-debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000651_hash = {
++ .next = NULL,
++ .name = "iwl_dbgfs_rx_statistics_read",
++ .file = "drivers/net/wireless/iwlwifi/iwl-debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000652_hash = {
++ .next = NULL,
++ .name = "iwl_dbgfs_sensitivity_read",
++ .file = "drivers/net/wireless/iwlwifi/iwl-debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000653_hash = {
++ .next = NULL,
++ .name = "iwl_dbgfs_sleep_level_override_read",
++ .file = "drivers/net/wireless/iwlwifi/iwl-debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000654_hash = {
++ .next = NULL,
++ .name = "iwl_dbgfs_sram_read",
++ .file = "drivers/net/wireless/iwlwifi/iwl-debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000655_hash = {
++ .next = NULL,
++ .name = "iwl_dbgfs_stations_read",
++ .file = "drivers/net/wireless/iwlwifi/iwl-debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000656_hash = {
++ .next = NULL,
++ .name = "iwl_dbgfs_status_read",
++ .file = "drivers/net/wireless/iwlwifi/iwl-debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000657_hash = {
++ .next = NULL,
++ .name = "iwl_dbgfs_thermal_throttling_read",
++ .file = "drivers/net/wireless/iwlwifi/iwl-debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000658_hash = {
++ .next = NULL,
++ .name = "iwl_dbgfs_traffic_log_read",
++ .file = "drivers/net/wireless/iwlwifi/iwl-debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000659_hash = {
++ .next = NULL,
++ .name = "iwl_dbgfs_tx_power_read",
++ .file = "drivers/net/wireless/iwlwifi/iwl-debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000660_hash = {
++ .next = NULL,
++ .name = "iwl_dbgfs_tx_queue_read",
++ .file = "drivers/net/wireless/iwlwifi/iwl-debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000661_hash = {
++ .next = NULL,
++ .name = "iwl_dbgfs_tx_statistics_read",
++ .file = "drivers/net/wireless/iwlwifi/iwl-debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000662_hash = {
++ .next = NULL,
++ .name = "iwl_dbgfs_ucode_general_stats_read",
++ .file = "drivers/net/wireless/iwlwifi/iwl-debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000663_hash = {
++ .next = NULL,
++ .name = "iwl_dbgfs_ucode_rx_stats_read",
++ .file = "drivers/net/wireless/iwlwifi/iwl-debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000664_hash = {
++ .next = NULL,
++ .name = "iwl_dbgfs_ucode_tx_stats_read",
++ .file = "drivers/net/wireless/iwlwifi/iwl-debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000665_hash = {
++ .next = NULL,
++ .name = "iwm_notif_send",
++ .file = "drivers/net/wireless/iwmc3200wifi/main.c",
++ .param6 = 1,
++};
++
++struct size_overflow_hash _000666_hash = {
++ .next = NULL,
++ .name = "iwm_ntf_calib_res",
++ .file = "drivers/net/wireless/iwmc3200wifi/rx.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000667_hash = {
++ .next = NULL,
++ .name = "iwm_umac_set_config_var",
++ .file = "drivers/net/wireless/iwmc3200wifi/commands.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000668_hash = {
++ .next = NULL,
++ .name = "key_algorithm_read",
++ .file = "net/mac80211/debugfs_key.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000669_hash = {
++ .next = NULL,
++ .name = "key_conf_hw_key_idx_read",
++ .file = "net/mac80211/debugfs_key.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000670_hash = {
++ .next = NULL,
++ .name = "key_conf_keyidx_read",
++ .file = "net/mac80211/debugfs_key.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000671_hash = {
++ .next = NULL,
++ .name = "key_conf_keylen_read",
++ .file = "net/mac80211/debugfs_key.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000672_hash = {
++ .next = NULL,
++ .name = "key_flags_read",
++ .file = "net/mac80211/debugfs_key.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000673_hash = {
++ .next = NULL,
++ .name = "key_icverrors_read",
++ .file = "net/mac80211/debugfs_key.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000674_hash = {
++ .next = NULL,
++ .name = "key_ifindex_read",
++ .file = "net/mac80211/debugfs_key.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000675_hash = {
++ .next = NULL,
++ .name = "key_key_read",
++ .file = "net/mac80211/debugfs_key.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000676_hash = {
++ .next = NULL,
++ .name = "key_replays_read",
++ .file = "net/mac80211/debugfs_key.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000677_hash = {
++ .next = NULL,
++ .name = "key_rx_spec_read",
++ .file = "net/mac80211/debugfs_key.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000678_hash = {
++ .next = NULL,
++ .name = "key_tx_rx_count_read",
++ .file = "net/mac80211/debugfs_key.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000679_hash = {
++ .next = NULL,
++ .name = "key_tx_spec_read",
++ .file = "net/mac80211/debugfs_key.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000680_hash = {
++ .next = NULL,
++ .name = "kmem_alloc",
++ .file = "fs/xfs/linux-2.6/kmem.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000681_hash = {
++ .next = NULL,
++ .name = "kvm_read_guest_atomic",
++ .file = "include/linux/kvm_host.h",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000682_hash = {
++ .next = NULL,
++ .name = "l2cap_sock_setsockopt",
++ .file = "net/bluetooth/l2cap.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000683_hash = {
++ .next = NULL,
++ .name = "l2cap_sock_setsockopt_old",
++ .file = "net/bluetooth/l2cap.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000684_hash = {
++ .next = NULL,
++ .name = "lane2_associate_req",
++ .file = "net/atm/lec.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000685_hash = {
++ .next = NULL,
++ .name = "lbs_debugfs_read",
++ .file = "drivers/net/wireless/libertas/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000686_hash = {
++ .next = NULL,
++ .name = "lbs_debugfs_write",
++ .file = "drivers/net/wireless/libertas/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000687_hash = {
++ .next = NULL,
++ .name = "lbs_dev_info",
++ .file = "drivers/net/wireless/libertas/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000688_hash = {
++ .next = NULL,
++ .name = "lbs_getscantable",
++ .file = "drivers/net/wireless/libertas/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000689_hash = {
++ .next = NULL,
++ .name = "lbs_rdbbp_read",
++ .file = "drivers/net/wireless/libertas/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000690_hash = {
++ .next = NULL,
++ .name = "lbs_rdmac_read",
++ .file = "drivers/net/wireless/libertas/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000691_hash = {
++ .next = NULL,
++ .name = "lbs_rdrf_read",
++ .file = "drivers/net/wireless/libertas/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000692_hash = {
++ .next = NULL,
++ .name = "lbs_sleepparams_read",
++ .file = "drivers/net/wireless/libertas/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000693_hash = {
++ .next = NULL,
++ .name = "lbs_threshold_read",
++ .file = "drivers/net/wireless/libertas/debugfs.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000694_hash = {
++ .next = NULL,
++ .name = "lcd_write",
++ .file = "drivers/usb/misc/usblcd.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000695_hash = {
++ .next = NULL,
++ .name = "leaf_dealloc",
++ .file = "fs/gfs2/dir.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000696_hash = {
++ .next = NULL,
++ .name = "__lgread",
++ .file = "drivers/lguest/core.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000697_hash = {
++ .next = NULL,
++ .name = "__lgwrite",
++ .file = "drivers/lguest/core.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000698_hash = {
++ .next = NULL,
++ .name = "LoadBitmap",
++ .file = "drivers/media/dvb/ttpci/av7110_hw.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000699_hash = {
++ .next = NULL,
++ .name = "long_retry_limit_read",
++ .file = "net/wireless/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000700_hash = {
++ .next = NULL,
++ .name = "lpfc_debugfs_read",
++ .file = "drivers/scsi/lpfc/lpfc_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000701_hash = {
++ .next = NULL,
++ .name = "lpfc_sli4_queue_alloc",
++ .file = "drivers/scsi/lpfc/lpfc_sli.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000702_hash = {
++ .next = NULL,
++ .name = "lp_write",
++ .file = "drivers/char/lp.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000703_hash = {
++ .next = NULL,
++ .name = "mce_write",
++ .file = "arch/x86/kernel/cpu/mcheck/mce-inject.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000704_hash = {
++ .next = NULL,
++ .name = "mcs7830_get_reg",
++ .file = "drivers/net/usb/mcs7830.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000705_hash = {
++ .next = NULL,
++ .name = "mcs7830_set_reg",
++ .file = "drivers/net/usb/mcs7830.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000706_hash = {
++ .next = NULL,
++ .name = "mdc800_device_read",
++ .file = "drivers/usb/image/mdc800.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000707_hash = {
++ .next = NULL,
++ .name = "memstick_alloc_host",
++ .file = "include/linux/memstick.h",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000708_hash = {
++ .next = NULL,
++ .name = "metronomefb_write",
++ .file = "drivers/video/metronomefb.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000709_hash = {
++ .next = NULL,
++ .name = "mic_calc_failure_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000710_hash = {
++ .next = NULL,
++ .name = "mic_calc_failure_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000711_hash = {
++ .next = &_000189_hash,
++ .name = "mic_rx_pkts_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000712_hash = {
++ .next = &_000489_hash,
++ .name = "mic_rx_pkts_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000713_hash = {
++ .next = NULL,
++ .name = "mlx4_en_create_rx_ring",
++ .file = "drivers/net/mlx4/en_rx.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000714_hash = {
++ .next = NULL,
++ .name = "mlx4_en_create_tx_ring",
++ .file = "drivers/net/mlx4/en_tx.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000715_hash = {
++ .next = NULL,
++ .name = "mmc_ext_csd_read",
++ .file = "drivers/mmc/core/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000716_hash = {
++ .next = NULL,
++ .name = "mmc_send_cxd_data",
++ .file = "drivers/mmc/core/mmc_ops.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000717_hash = {
++ .next = NULL,
++ .name = "mon_bin_get_event",
++ .file = "drivers/usb/mon/mon_bin.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000718_hash = {
++ .next = NULL,
++ .name = "mon_stat_read",
++ .file = "drivers/usb/mon/mon_stat.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000719_hash = {
++ .next = NULL,
++ .name = "mousedev_read",
++ .file = "drivers/input/mousedev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000720_hash = {
++ .next = NULL,
++ .name = "mptctl_getiocinfo",
++ .file = "drivers/message/fusion/mptctl.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000721_hash = {
++ .next = NULL,
++ .name = "msnd_fifo_alloc",
++ .file = "sound/oss/msnd.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000722_hash = {
++ .next = NULL,
++ .name = "mtd_do_readoob",
++ .file = "drivers/mtd/mtdchar.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000723_hash = {
++ .next = NULL,
++ .name = "mtd_do_writeoob",
++ .file = "drivers/mtd/mtdchar.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000724_hash = {
++ .next = NULL,
++ .name = "mtd_read",
++ .file = "drivers/mtd/mtdchar.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000725_hash = {
++ .next = NULL,
++ .name = "mtd_write",
++ .file = "drivers/mtd/mtdchar.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000726_hash = {
++ .next = NULL,
++ .name = "ncp_file_write",
++ .file = "fs/ncpfs/file.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000727_hash = {
++ .next = NULL,
++ .name = "ncp__vol2io",
++ .file = "fs/ncpfs/ncplib_kernel.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000728_hash = {
++ .next = NULL,
++ .name = "nfs4_write_cached_acl",
++ .file = "fs/nfs/nfs4proc.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000729_hash = {
++ .next = NULL,
++ .name = "nfsctl_transaction_read",
++ .file = "fs/nfsd/nfsctl.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000730_hash = {
++ .next = NULL,
++ .name = "nfsctl_transaction_write",
++ .file = "fs/nfsd/nfsctl.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000731_hash = {
++ .next = NULL,
++ .name = "nfsd_cache_update",
++ .file = "include/linux/nfsd/cache.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000732_hash = {
++ .next = NULL,
++ .name = "nfs_readdata_alloc",
++ .file = "include/linux/nfs_fs.h",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000733_hash = {
++ .next = NULL,
++ .name = "nfs_writedata_alloc",
++ .file = "include/linux/nfs_fs.h",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000734_hash = {
++ .next = NULL,
++ .name = "noack_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000735_hash = {
++ .next = NULL,
++ .name = "nsm_create_handle",
++ .file = "fs/lockd/mon.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000736_hash = {
++ .next = NULL,
++ .name = "ntfs_copy_from_user",
++ .file = "fs/ntfs/file.c",
++ .param3 = 1,
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000738_hash = {
++ .next = NULL,
++ .name = "__ntfs_copy_from_user_iovec_inatomic",
++ .file = "fs/ntfs/file.c",
++ .param3 = 1,
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000740_hash = {
++ .next = NULL,
++ .name = "__ntfs_malloc",
++ .file = "fs/ntfs/malloc.h",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000741_hash = {
++ .next = NULL,
++ .name = "nvram_write",
++ .file = "drivers/char/nvram.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000742_hash = {
++ .next = NULL,
++ .name = "o2hb_debug_read",
++ .file = "fs/ocfs2/cluster/heartbeat.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000743_hash = {
++ .next = NULL,
++ .name = "o2net_send_message_vec",
++ .file = "fs/ocfs2/cluster/tcp.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000744_hash = {
++ .next = NULL,
++ .name = "ocfs2_control_cfu",
++ .file = "fs/ocfs2/stack_user.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000745_hash = {
++ .next = NULL,
++ .name = "ocfs2_control_read",
++ .file = "fs/ocfs2/stack_user.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000746_hash = {
++ .next = NULL,
++ .name = "ocfs2_debug_read",
++ .file = "fs/ocfs2/super.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000747_hash = {
++ .next = NULL,
++ .name = "oprofilefs_str_to_user",
++ .file = "include/linux/oprofile.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000748_hash = {
++ .next = NULL,
++ .name = "oprofilefs_ulong_from_user",
++ .file = "include/linux/oprofile.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000749_hash = {
++ .next = NULL,
++ .name = "oprofilefs_ulong_to_user",
++ .file = "include/linux/oprofile.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000750_hash = {
++ .next = NULL,
++ .name = "_osd_realloc_seg",
++ .file = "drivers/scsi/osd/osd_initiator.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000751_hash = {
++ .next = NULL,
++ .name = "oti6858_buf_alloc",
++ .file = "drivers/usb/serial/oti6858.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000752_hash = {
++ .next = NULL,
++ .name = "otp_read",
++ .file = "drivers/mtd/devices/mtd_dataflash.c",
++ .param2 = 1,
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000754_hash = {
++ .next = NULL,
++ .name = "packet_setsockopt",
++ .file = "net/packet/af_packet.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000755_hash = {
++ .next = NULL,
++ .name = "parse_arg",
++ .file = "drivers/platform/x86/asus_acpi.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000756_hash = {
++ .next = NULL,
++ .name = "parse_command",
++ .file = "fs/binfmt_misc.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000757_hash = {
++ .next = NULL,
++ .name = "pcmcia_replace_cis",
++ .file = "drivers/pcmcia/cistpl.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000758_hash = {
++ .next = NULL,
++ .name = "pcnet32_realloc_rx_ring",
++ .file = "drivers/net/pcnet32.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000759_hash = {
++ .next = NULL,
++ .name = "pcnet32_realloc_tx_ring",
++ .file = "drivers/net/pcnet32.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000760_hash = {
++ .next = NULL,
++ .name = "pdu_write_u",
++ .file = "net/9p/protocol.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000761_hash = {
++ .next = NULL,
++ .name = "pgctrl_write",
++ .file = "net/core/pktgen.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000762_hash = {
++ .next = NULL,
++ .name = "pg_read",
++ .file = "drivers/block/paride/pg.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000763_hash = {
++ .next = NULL,
++ .name = "pg_write",
++ .file = "drivers/block/paride/pg.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000764_hash = {
++ .next = NULL,
++ .name = "pkt_add",
++ .file = "drivers/usb/serial/garmin_gps.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000765_hash = {
++ .next = NULL,
++ .name = "pktgen_if_write",
++ .file = "net/core/pktgen.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000766_hash = {
++ .next = NULL,
++ .name = "pl2303_buf_alloc",
++ .file = "drivers/usb/serial/pl2303.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000767_hash = {
++ .next = NULL,
++ .name = "ppp_cp_parse_cr",
++ .file = "drivers/net/wan/hdlc_ppp.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000768_hash = {
++ .next = NULL,
++ .name = "ppp_write",
++ .file = "drivers/net/ppp_generic.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000769_hash = {
++ .next = NULL,
++ .name = "pp_read",
++ .file = "drivers/char/ppdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000770_hash = {
++ .next = NULL,
++ .name = "pp_write",
++ .file = "drivers/char/ppdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000771_hash = {
++ .next = NULL,
++ .name = "printer_read",
++ .file = "drivers/usb/gadget/printer.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000772_hash = {
++ .next = NULL,
++ .name = "printer_req_alloc",
++ .file = "drivers/usb/gadget/printer.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000773_hash = {
++ .next = NULL,
++ .name = "printer_write",
++ .file = "drivers/usb/gadget/printer.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000774_hash = {
++ .next = NULL,
++ .name = "prism2_set_genericelement",
++ .file = "drivers/net/wireless/hostap/hostap_ioctl.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000775_hash = {
++ .next = NULL,
++ .name = "proc_read",
++ .file = "drivers/net/wireless/airo.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000776_hash = {
++ .next = NULL,
++ .name = "proc_scsi_devinfo_write",
++ .file = "drivers/scsi/scsi_devinfo.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000777_hash = {
++ .next = NULL,
++ .name = "proc_scsi_write",
++ .file = "drivers/scsi/scsi_proc.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000778_hash = {
++ .next = NULL,
++ .name = "proc_scsi_write_proc",
++ .file = "drivers/scsi/scsi_proc.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000779_hash = {
++ .next = NULL,
++ .name = "proc_write",
++ .file = "drivers/net/wireless/airo.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000780_hash = {
++ .next = NULL,
++ .name = "ps_pspoll_max_apturn_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000781_hash = {
++ .next = NULL,
++ .name = "ps_pspoll_max_apturn_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000782_hash = {
++ .next = NULL,
++ .name = "ps_pspoll_timeouts_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000783_hash = {
++ .next = NULL,
++ .name = "ps_pspoll_timeouts_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000784_hash = {
++ .next = NULL,
++ .name = "ps_pspoll_utilization_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000785_hash = {
++ .next = NULL,
++ .name = "ps_pspoll_utilization_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000786_hash = {
++ .next = NULL,
++ .name = "ps_upsd_max_apturn_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000787_hash = {
++ .next = NULL,
++ .name = "ps_upsd_max_apturn_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000788_hash = {
++ .next = NULL,
++ .name = "ps_upsd_max_sptime_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000789_hash = {
++ .next = NULL,
++ .name = "ps_upsd_max_sptime_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000790_hash = {
++ .next = NULL,
++ .name = "ps_upsd_timeouts_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000791_hash = {
++ .next = NULL,
++ .name = "ps_upsd_timeouts_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000792_hash = {
++ .next = NULL,
++ .name = "ps_upsd_utilization_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000793_hash = {
++ .next = &_000411_hash,
++ .name = "ps_upsd_utilization_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000794_hash = {
++ .next = NULL,
++ .name = "pt_read",
++ .file = "drivers/block/paride/pt.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000795_hash = {
++ .next = NULL,
++ .name = "pt_write",
++ .file = "drivers/block/paride/pt.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000796_hash = {
++ .next = NULL,
++ .name = "pvr2_ioread_read",
++ .file = "drivers/media/video/pvrusb2/pvrusb2-ioread.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000797_hash = {
++ .next = NULL,
++ .name = "pvr2_ioread_set_sync_key",
++ .file = "drivers/media/video/pvrusb2/pvrusb2-ioread.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000798_hash = {
++ .next = NULL,
++ .name = "pvr2_stream_buffer_count",
++ .file = "drivers/media/video/pvrusb2/pvrusb2-io.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000799_hash = {
++ .next = NULL,
++ .name = "pwc_rvmalloc",
++ .file = "drivers/media/video/pwc/pwc-if.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000800_hash = {
++ .next = NULL,
++ .name = "pwc_video_read",
++ .file = "drivers/media/video/pwc/pwc-if.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000801_hash = {
++ .next = NULL,
++ .name = "pwr_disable_ps_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000802_hash = {
++ .next = NULL,
++ .name = "pwr_disable_ps_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000803_hash = {
++ .next = NULL,
++ .name = "pwr_elp_enter_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000804_hash = {
++ .next = NULL,
++ .name = "pwr_elp_enter_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000805_hash = {
++ .next = NULL,
++ .name = "pwr_enable_ps_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000806_hash = {
++ .next = NULL,
++ .name = "pwr_enable_ps_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000807_hash = {
++ .next = NULL,
++ .name = "pwr_fix_tsf_ps_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000808_hash = {
++ .next = NULL,
++ .name = "pwr_fix_tsf_ps_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000809_hash = {
++ .next = NULL,
++ .name = "pwr_missing_bcns_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000810_hash = {
++ .next = NULL,
++ .name = "pwr_missing_bcns_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000811_hash = {
++ .next = NULL,
++ .name = "pwr_power_save_off_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000812_hash = {
++ .next = NULL,
++ .name = "pwr_power_save_off_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000813_hash = {
++ .next = NULL,
++ .name = "pwr_ps_enter_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000814_hash = {
++ .next = NULL,
++ .name = "pwr_ps_enter_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000815_hash = {
++ .next = NULL,
++ .name = "pwr_rcvd_awake_beacons_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000816_hash = {
++ .next = NULL,
++ .name = "pwr_rcvd_awake_beacons_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000817_hash = {
++ .next = NULL,
++ .name = "pwr_rcvd_beacons_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000818_hash = {
++ .next = NULL,
++ .name = "pwr_rcvd_beacons_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000819_hash = {
++ .next = NULL,
++ .name = "pwr_tx_without_ps_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000820_hash = {
++ .next = NULL,
++ .name = "pwr_tx_without_ps_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000821_hash = {
++ .next = NULL,
++ .name = "pwr_tx_with_ps_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000822_hash = {
++ .next = NULL,
++ .name = "pwr_tx_with_ps_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000823_hash = {
++ .next = NULL,
++ .name = "pwr_wake_on_host_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000824_hash = {
++ .next = NULL,
++ .name = "pwr_wake_on_host_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000825_hash = {
++ .next = NULL,
++ .name = "pwr_wake_on_timer_exp_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000826_hash = {
++ .next = NULL,
++ .name = "pwr_wake_on_timer_exp_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000827_hash = {
++ .next = NULL,
++ .name = "qc_capture",
++ .file = "drivers/media/video/c-qcam.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000828_hash = {
++ .next = NULL,
++ .name = "qla2x00_get_ctx_sp",
++ .file = "drivers/scsi/qla2xxx/qla_init.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000829_hash = {
++ .next = NULL,
++ .name = "queues_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000830_hash = {
++ .next = NULL,
++ .name = "r3964_write",
++ .file = "drivers/char/n_r3964.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000831_hash = {
++ .next = NULL,
++ .name = "raw_setsockopt",
++ .file = "net/can/raw.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000832_hash = {
++ .next = NULL,
++ .name = "rcname_read",
++ .file = "net/mac80211/rate.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000833_hash = {
++ .next = NULL,
++ .name = "rds_message_alloc",
++ .file = "net/rds/message.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000834_hash = {
++ .next = NULL,
++ .name = "rds_page_copy_user",
++ .file = "net/rds/page.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000835_hash = {
++ .next = NULL,
++ .name = "read",
++ .file = "drivers/pci/hotplug/cpqphp_sysfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000836_hash = {
++ .next = NULL,
++ .name = "read_buf",
++ .file = "fs/nfsd/nfs4xdr.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000837_hash = {
++ .next = NULL,
++ .name = "read_cis_cache",
++ .file = "drivers/pcmcia/cistpl.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000838_hash = {
++ .next = NULL,
++ .name = "read_file_beacon",
++ .file = "drivers/net/wireless/ath/ath5k/debug.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000839_hash = {
++ .next = NULL,
++ .name = "read_file_debug",
++ .file = "drivers/net/wireless/ath/ath9k/debug.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000840_hash = {
++ .next = &_000557_hash,
++ .name = "read_file_debug",
++ .file = "drivers/net/wireless/ath/ath5k/debug.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000841_hash = {
++ .next = NULL,
++ .name = "read_file_dma",
++ .file = "drivers/net/wireless/ath/ath9k/debug.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000842_hash = {
++ .next = NULL,
++ .name = "read_file_interrupt",
++ .file = "drivers/net/wireless/ath/ath9k/debug.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000843_hash = {
++ .next = NULL,
++ .name = "read_file_rcstat",
++ .file = "drivers/net/wireless/ath/ath9k/debug.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000844_hash = {
++ .next = NULL,
++ .name = "read_file_wiphy",
++ .file = "drivers/net/wireless/ath/ath9k/debug.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000845_hash = {
++ .next = NULL,
++ .name = "read_file_xmit",
++ .file = "drivers/net/wireless/ath/ath9k/debug.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000846_hash = {
++ .next = NULL,
++ .name = "read_flush",
++ .file = "net/sunrpc/cache.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000847_hash = {
++ .next = NULL,
++ .name = "realloc_buffer",
++ .file = "drivers/scsi/device_handler/scsi_dh_alua.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000848_hash = {
++ .next = NULL,
++ .name = "recent_mt_proc_write",
++ .file = "net/netfilter/xt_recent.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000849_hash = {
++ .next = NULL,
++ .name = "recent_old_proc_write",
++ .file = "net/netfilter/xt_recent.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000850_hash = {
++ .next = NULL,
++ .name = "recv_msg",
++ .file = "net/tipc/socket.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000851_hash = {
++ .next = NULL,
++ .name = "recv_stream",
++ .file = "net/tipc/socket.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000852_hash = {
++ .next = NULL,
++ .name = "reg_w_buf",
++ .file = "drivers/media/video/gspca/t613.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000853_hash = {
++ .next = NULL,
++ .name = "reg_w_ixbuf",
++ .file = "drivers/media/video/gspca/t613.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000854_hash = {
++ .next = NULL,
++ .name = "reiserfs_allocate_list_bitmaps",
++ .file = "include/linux/reiserfs_fs.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000855_hash = {
++ .next = NULL,
++ .name = "reiserfs_resize",
++ .file = "include/linux/reiserfs_fs_sb.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000856_hash = {
++ .next = NULL,
++ .name = "remote_settings_file_write",
++ .file = "drivers/misc/ibmasm/ibmasmfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000857_hash = {
++ .next = NULL,
++ .name = "retry_count_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000858_hash = {
++ .next = NULL,
++ .name = "retry_count_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000859_hash = {
++ .next = NULL,
++ .name = "revalidate",
++ .file = "drivers/block/aoe/aoechr.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000860_hash = {
++ .next = NULL,
++ .name = "rfcomm_sock_setsockopt",
++ .file = "net/bluetooth/rfcomm/sock.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000861_hash = {
++ .next = NULL,
++ .name = "rfkill_fop_read",
++ .file = "net/rfkill/core.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000862_hash = {
++ .next = NULL,
++ .name = "rndis_add_response",
++ .file = "drivers/usb/gadget/rndis.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000863_hash = {
++ .next = NULL,
++ .name = "rpc_malloc",
++ .file = "include/linux/sunrpc/sched.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000864_hash = {
++ .next = NULL,
++ .name = "rs_sta_dbgfs_rate_scale_data_read",
++ .file = "drivers/net/wireless/iwlwifi/iwl-agn-rs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000865_hash = {
++ .next = NULL,
++ .name = "rs_sta_dbgfs_scale_table_read",
++ .file = "drivers/net/wireless/iwlwifi/iwl-agn-rs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000866_hash = {
++ .next = NULL,
++ .name = "rs_sta_dbgfs_stats_table_read",
++ .file = "drivers/net/wireless/iwlwifi/iwl-agn-rs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000867_hash = {
++ .next = NULL,
++ .name = "rt2x00debug_write_bbp",
++ .file = "drivers/net/wireless/rt2x00/rt2x00debug.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000868_hash = {
++ .next = NULL,
++ .name = "rt2x00debug_write_csr",
++ .file = "drivers/net/wireless/rt2x00/rt2x00debug.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000869_hash = {
++ .next = &_000596_hash,
++ .name = "rt2x00debug_write_eeprom",
++ .file = "drivers/net/wireless/rt2x00/rt2x00debug.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000870_hash = {
++ .next = NULL,
++ .name = "rt2x00debug_write_rf",
++ .file = "drivers/net/wireless/rt2x00/rt2x00debug.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000871_hash = {
++ .next = NULL,
++ .name = "rts_threshold_read",
++ .file = "net/wireless/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000872_hash = {
++ .next = NULL,
++ .name = "rvmalloc",
++ .file = "drivers/media/video/gspca/gspca.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000873_hash = {
++ .next = NULL,
++ .name = "rx_dropped_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000874_hash = {
++ .next = NULL,
++ .name = "rx_dropped_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000875_hash = {
++ .next = NULL,
++ .name = "rx_fcs_err_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000876_hash = {
++ .next = NULL,
++ .name = "rx_fcs_err_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000877_hash = {
++ .next = NULL,
++ .name = "rx_hdr_overflow_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000878_hash = {
++ .next = NULL,
++ .name = "rx_hdr_overflow_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000879_hash = {
++ .next = NULL,
++ .name = "rx_hw_stuck_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000880_hash = {
++ .next = NULL,
++ .name = "rx_hw_stuck_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000881_hash = {
++ .next = NULL,
++ .name = "rx_out_of_mem_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000882_hash = {
++ .next = NULL,
++ .name = "rx_out_of_mem_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000883_hash = {
++ .next = NULL,
++ .name = "rx_path_reset_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000884_hash = {
++ .next = &_000138_hash,
++ .name = "rx_path_reset_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000885_hash = {
++ .next = NULL,
++ .name = "rxpipe_beacon_buffer_thres_host_int_trig_rx_data_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000886_hash = {
++ .next = NULL,
++ .name = "rxpipe_beacon_buffer_thres_host_int_trig_rx_data_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000887_hash = {
++ .next = NULL,
++ .name = "rxpipe_descr_host_int_trig_rx_data_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000888_hash = {
++ .next = NULL,
++ .name = "rxpipe_descr_host_int_trig_rx_data_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000889_hash = {
++ .next = NULL,
++ .name = "rxpipe_missed_beacon_host_int_trig_rx_data_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000890_hash = {
++ .next = NULL,
++ .name = "rxpipe_missed_beacon_host_int_trig_rx_data_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000891_hash = {
++ .next = NULL,
++ .name = "rxpipe_rx_prep_beacon_drop_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000892_hash = {
++ .next = NULL,
++ .name = "rxpipe_rx_prep_beacon_drop_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000893_hash = {
++ .next = NULL,
++ .name = "rxpipe_tx_xfr_host_int_trig_rx_data_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000894_hash = {
++ .next = NULL,
++ .name = "rxpipe_tx_xfr_host_int_trig_rx_data_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000895_hash = {
++ .next = NULL,
++ .name = "rx_reset_counter_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000896_hash = {
++ .next = NULL,
++ .name = "rx_reset_counter_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000897_hash = {
++ .next = NULL,
++ .name = "rx_xfr_hint_trig_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000898_hash = {
++ .next = NULL,
++ .name = "rx_xfr_hint_trig_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000899_hash = {
++ .next = NULL,
++ .name = "saa_write",
++ .file = "drivers/media/video/stradis.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000900_hash = {
++ .next = NULL,
++ .name = "scsi_tgt_copy_sense",
++ .file = "drivers/scsi/scsi_tgt_lib.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000901_hash = {
++ .next = NULL,
++ .name = "sctp_auth_create_key",
++ .file = "net/sctp/auth.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _000902_hash = {
++ .next = NULL,
++ .name = "sctp_make_abort_user",
++ .file = "include/net/sctp/sm.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000903_hash = {
++ .next = NULL,
++ .name = "sctp_setsockopt_active_key",
++ .file = "net/sctp/socket.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000904_hash = {
++ .next = NULL,
++ .name = "sctp_setsockopt_adaptation_layer",
++ .file = "net/sctp/socket.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000905_hash = {
++ .next = NULL,
++ .name = "sctp_setsockopt_associnfo",
++ .file = "net/sctp/socket.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000906_hash = {
++ .next = NULL,
++ .name = "sctp_setsockopt_auth_chunk",
++ .file = "net/sctp/socket.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000907_hash = {
++ .next = NULL,
++ .name = "sctp_setsockopt_auth_key",
++ .file = "net/sctp/socket.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000908_hash = {
++ .next = NULL,
++ .name = "sctp_setsockopt_autoclose",
++ .file = "net/sctp/socket.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000909_hash = {
++ .next = NULL,
++ .name = "sctp_setsockopt_context",
++ .file = "net/sctp/socket.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000910_hash = {
++ .next = NULL,
++ .name = "sctp_setsockopt_default_send_param",
++ .file = "net/sctp/socket.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000911_hash = {
++ .next = NULL,
++ .name = "sctp_setsockopt_delayed_ack",
++ .file = "net/sctp/socket.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000912_hash = {
++ .next = NULL,
++ .name = "sctp_setsockopt_del_key",
++ .file = "net/sctp/socket.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000913_hash = {
++ .next = NULL,
++ .name = "sctp_setsockopt_events",
++ .file = "net/sctp/socket.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000914_hash = {
++ .next = NULL,
++ .name = "sctp_setsockopt_hmac_ident",
++ .file = "net/sctp/socket.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000915_hash = {
++ .next = NULL,
++ .name = "sctp_setsockopt_initmsg",
++ .file = "net/sctp/socket.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000916_hash = {
++ .next = NULL,
++ .name = "sctp_setsockopt_maxburst",
++ .file = "net/sctp/socket.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000917_hash = {
++ .next = NULL,
++ .name = "sctp_setsockopt_maxseg",
++ .file = "net/sctp/socket.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000918_hash = {
++ .next = NULL,
++ .name = "sctp_setsockopt_peer_addr_params",
++ .file = "net/sctp/socket.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000919_hash = {
++ .next = NULL,
++ .name = "sctp_setsockopt_peer_primary_addr",
++ .file = "net/sctp/socket.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000920_hash = {
++ .next = NULL,
++ .name = "sctp_setsockopt_rtoinfo",
++ .file = "net/sctp/socket.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000921_hash = {
++ .next = NULL,
++ .name = "sctp_tsnmap_init",
++ .file = "include/net/sctp/tsnmap.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000922_hash = {
++ .next = NULL,
++ .name = "se401_read",
++ .file = "drivers/media/video/se401.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000923_hash = {
++ .next = NULL,
++ .name = "send_control_msg",
++ .file = "drivers/media/video/zr364xx.c",
++ .param6 = 1,
++};
++
++struct size_overflow_hash _000924_hash = {
++ .next = NULL,
++ .name = "set_aoe_iflist",
++ .file = "drivers/block/aoe/aoenet.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000925_hash = {
++ .next = NULL,
++ .name = "set_registers",
++ .file = "drivers/net/usb/pegasus.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000926_hash = {
++ .next = NULL,
++ .name = "setup_req",
++ .file = "drivers/usb/gadget/inode.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000927_hash = {
++ .next = NULL,
++ .name = "sgl_map_user_pages",
++ .file = "drivers/scsi/st.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000928_hash = {
++ .next = NULL,
++ .name = "sg_proc_write_adio",
++ .file = "drivers/scsi/sg.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000929_hash = {
++ .next = NULL,
++ .name = "sg_proc_write_dressz",
++ .file = "drivers/scsi/sg.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000930_hash = {
++ .next = NULL,
++ .name = "short_retry_limit_read",
++ .file = "net/wireless/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000931_hash = {
++ .next = NULL,
++ .name = "sm501_create_subdev",
++ .file = "drivers/mfd/sm501.c",
++ .param3 = 1,
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000933_hash = {
++ .next = NULL,
++ .name = "sn9c102_read",
++ .file = "drivers/media/video/sn9c102/sn9c102_core.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000934_hash = {
++ .next = NULL,
++ .name = "snd_ac97_pcm_assign",
++ .file = "include/sound/ac97_codec.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000935_hash = {
++ .next = NULL,
++ .name = "snd_ctl_elem_user_tlv",
++ .file = "sound/core/control.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000936_hash = {
++ .next = NULL,
++ .name = "snd_emu10k1_fx8010_read",
++ .file = "sound/pci/emu10k1/emuproc.c",
++ .param5 = 1,
++ .param6 = 1,
++};
++
++struct size_overflow_hash _000938_hash = {
++ .next = NULL,
++ .name = "snd_es1938_capture_copy",
++ .file = "sound/pci/es1938.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000939_hash = {
++ .next = NULL,
++ .name = "snd_gus_dram_peek",
++ .file = "sound/isa/gus/gus_dram.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000940_hash = {
++ .next = NULL,
++ .name = "snd_gus_dram_poke",
++ .file = "sound/isa/gus/gus_dram.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _000941_hash = {
++ .next = NULL,
++ .name = "snd_hdsp_capture_copy",
++ .file = "sound/pci/rme9652/hdsp.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000942_hash = {
++ .next = NULL,
++ .name = "snd_hdspm_capture_copy",
++ .file = "sound/pci/rme9652/hdspm.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000943_hash = {
++ .next = NULL,
++ .name = "snd_hdspm_playback_copy",
++ .file = "sound/pci/rme9652/hdspm.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000944_hash = {
++ .next = NULL,
++ .name = "snd_hdsp_playback_copy",
++ .file = "sound/pci/rme9652/hdsp.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000945_hash = {
++ .next = NULL,
++ .name = "snd_info_entry_write",
++ .file = "sound/core/info.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000946_hash = {
++ .next = NULL,
++ .name = "snd_mem_proc_write",
++ .file = "sound/core/memalloc.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000947_hash = {
++ .next = NULL,
++ .name = "snd_opl4_mem_proc_read",
++ .file = "sound/drivers/opl4/opl4_proc.c",
++ .param5 = 1,
++ .param6 = 1,
++};
++
++struct size_overflow_hash _000949_hash = {
++ .next = NULL,
++ .name = "snd_opl4_mem_proc_write",
++ .file = "sound/drivers/opl4/opl4_proc.c",
++ .param5 = 1,
++ .param6 = 1,
++};
++
++struct size_overflow_hash _000951_hash = {
++ .next = NULL,
++ .name = "snd_pcm_aio_read",
++ .file = "sound/core/pcm_native.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000952_hash = {
++ .next = NULL,
++ .name = "snd_pcm_aio_write",
++ .file = "sound/core/pcm_native.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000953_hash = {
++ .next = NULL,
++ .name = "snd_pcm_alloc_vmalloc_buffer",
++ .file = "sound/pcmcia/pdaudiocf/pdaudiocf_pcm.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000954_hash = {
++ .next = NULL,
++ .name = "snd_pcm_alloc_vmalloc_buffer",
++ .file = "sound/drivers/vx/vx_pcm.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000955_hash = {
++ .next = NULL,
++ .name = "snd_pcm_alloc_vmalloc_buffer",
++ .file = "drivers/media/video/cx231xx/cx231xx-audio.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000956_hash = {
++ .next = NULL,
++ .name = "snd_pcm_alloc_vmalloc_buffer",
++ .file = "sound/usb/usbaudio.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000957_hash = {
++ .next = NULL,
++ .name = "snd_pcm_alloc_vmalloc_buffer",
++ .file = "drivers/media/video/em28xx/em28xx-audio.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000958_hash = {
++ .next = NULL,
++ .name = "snd_pcm_oss_read1",
++ .file = "sound/core/oss/pcm_oss.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000959_hash = {
++ .next = NULL,
++ .name = "snd_pcm_oss_write1",
++ .file = "sound/core/oss/pcm_oss.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000960_hash = {
++ .next = NULL,
++ .name = "snd_pcm_oss_write2",
++ .file = "sound/core/oss/pcm_oss.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000961_hash = {
++ .next = NULL,
++ .name = "snd_pcm_plugin_build",
++ .file = "sound/core/oss/pcm_plugin.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000962_hash = {
++ .next = NULL,
++ .name = "snd_rme9652_capture_copy",
++ .file = "sound/pci/rme9652/rme9652.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000963_hash = {
++ .next = NULL,
++ .name = "snd_rme9652_playback_copy",
++ .file = "sound/pci/rme9652/rme9652.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _000964_hash = {
++ .next = &_000109_hash,
++ .name = "snd_usb_ctl_msg",
++ .file = "sound/usb/usbaudio.c",
++ .param8 = 1,
++};
++
++struct size_overflow_hash _000965_hash = {
++ .next = NULL,
++ .name = "spidev_message",
++ .file = "drivers/spi/spidev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000966_hash = {
++ .next = NULL,
++ .name = "spidev_write",
++ .file = "drivers/spi/spidev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000967_hash = {
++ .next = NULL,
++ .name = "srp_alloc_iu",
++ .file = "drivers/infiniband/ulp/srp/ib_srp.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000968_hash = {
++ .next = NULL,
++ .name = "srp_iu_pool_alloc",
++ .file = "drivers/scsi/libsrp.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000969_hash = {
++ .next = NULL,
++ .name = "srp_ring_alloc",
++ .file = "drivers/scsi/libsrp.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _000970_hash = {
++ .next = NULL,
++ .name = "sta_agg_status_read",
++ .file = "net/mac80211/debugfs_sta.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000971_hash = {
++ .next = NULL,
++ .name = "sta_dev_read",
++ .file = "net/mac80211/debugfs_sta.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000972_hash = {
++ .next = NULL,
++ .name = "sta_flags_read",
++ .file = "net/mac80211/debugfs_sta.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000973_hash = {
++ .next = NULL,
++ .name = "sta_inactive_ms_read",
++ .file = "net/mac80211/debugfs_sta.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000974_hash = {
++ .next = NULL,
++ .name = "sta_last_noise_read",
++ .file = "net/mac80211/debugfs_sta.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000975_hash = {
++ .next = NULL,
++ .name = "sta_last_qual_read",
++ .file = "net/mac80211/debugfs_sta.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000976_hash = {
++ .next = NULL,
++ .name = "sta_last_seq_ctrl_read",
++ .file = "net/mac80211/debugfs_sta.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000977_hash = {
++ .next = NULL,
++ .name = "sta_last_signal_read",
++ .file = "net/mac80211/debugfs_sta.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000978_hash = {
++ .next = NULL,
++ .name = "sta_num_ps_buf_frames_read",
++ .file = "net/mac80211/debugfs_sta.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000979_hash = {
++ .next = NULL,
++ .name = "sta_rx_bytes_read",
++ .file = "net/mac80211/debugfs_sta.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000980_hash = {
++ .next = NULL,
++ .name = "sta_rx_dropped_read",
++ .file = "net/mac80211/debugfs_sta.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000981_hash = {
++ .next = NULL,
++ .name = "sta_rx_duplicates_read",
++ .file = "net/mac80211/debugfs_sta.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000982_hash = {
++ .next = NULL,
++ .name = "sta_rx_fragments_read",
++ .file = "net/mac80211/debugfs_sta.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000983_hash = {
++ .next = NULL,
++ .name = "sta_rx_packets_read",
++ .file = "net/mac80211/debugfs_sta.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000984_hash = {
++ .next = NULL,
++ .name = "stats_failed_count_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000985_hash = {
++ .next = NULL,
++ .name = "stats_frame_duplicate_count_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000986_hash = {
++ .next = NULL,
++ .name = "stats_multicast_received_frame_count_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000987_hash = {
++ .next = NULL,
++ .name = "stats_multicast_transmitted_frame_count_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000988_hash = {
++ .next = NULL,
++ .name = "stats_multiple_retry_count_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000989_hash = {
++ .next = NULL,
++ .name = "stats_received_fragment_count_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000990_hash = {
++ .next = NULL,
++ .name = "stats_retry_count_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000991_hash = {
++ .next = NULL,
++ .name = "stats_rx_expand_skb_head2_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000992_hash = {
++ .next = NULL,
++ .name = "stats_rx_expand_skb_head_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000993_hash = {
++ .next = NULL,
++ .name = "stats_rx_handlers_drop_defrag_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000994_hash = {
++ .next = NULL,
++ .name = "stats_rx_handlers_drop_nullfunc_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000995_hash = {
++ .next = NULL,
++ .name = "stats_rx_handlers_drop_passive_scan_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000996_hash = {
++ .next = NULL,
++ .name = "stats_rx_handlers_drop_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000997_hash = {
++ .next = NULL,
++ .name = "stats_rx_handlers_drop_short_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000998_hash = {
++ .next = NULL,
++ .name = "stats_rx_handlers_fragments_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _000999_hash = {
++ .next = NULL,
++ .name = "stats_rx_handlers_queued_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001000_hash = {
++ .next = NULL,
++ .name = "stats_transmitted_fragment_count_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001001_hash = {
++ .next = NULL,
++ .name = "stats_transmitted_frame_count_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001002_hash = {
++ .next = NULL,
++ .name = "stats_tx_expand_skb_head_cloned_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001003_hash = {
++ .next = NULL,
++ .name = "stats_tx_expand_skb_head_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001004_hash = {
++ .next = NULL,
++ .name = "stats_tx_handlers_drop_fragment_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001005_hash = {
++ .next = NULL,
++ .name = "stats_tx_handlers_drop_not_assoc_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001006_hash = {
++ .next = NULL,
++ .name = "stats_tx_handlers_drop_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001007_hash = {
++ .next = NULL,
++ .name = "stats_tx_handlers_drop_unauth_port_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001008_hash = {
++ .next = NULL,
++ .name = "stats_tx_handlers_drop_unencrypted_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001009_hash = {
++ .next = NULL,
++ .name = "stats_tx_handlers_drop_wep_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001010_hash = {
++ .next = NULL,
++ .name = "stats_tx_handlers_queued_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001011_hash = {
++ .next = NULL,
++ .name = "stats_tx_status_drop_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001012_hash = {
++ .next = NULL,
++ .name = "sta_tx_bytes_read",
++ .file = "net/mac80211/debugfs_sta.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001013_hash = {
++ .next = NULL,
++ .name = "sta_tx_filtered_read",
++ .file = "net/mac80211/debugfs_sta.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001014_hash = {
++ .next = NULL,
++ .name = "sta_tx_fragments_read",
++ .file = "net/mac80211/debugfs_sta.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001015_hash = {
++ .next = NULL,
++ .name = "sta_tx_packets_read",
++ .file = "net/mac80211/debugfs_sta.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001016_hash = {
++ .next = NULL,
++ .name = "sta_tx_retry_count_read",
++ .file = "net/mac80211/debugfs_sta.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001017_hash = {
++ .next = NULL,
++ .name = "sta_tx_retry_failed_read",
++ .file = "net/mac80211/debugfs_sta.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001018_hash = {
++ .next = NULL,
++ .name = "sta_wep_weak_iv_count_read",
++ .file = "net/mac80211/debugfs_sta.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001019_hash = {
++ .next = NULL,
++ .name = "stk_prepare_sio_buffers",
++ .file = "drivers/media/video/stk-webcam.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001020_hash = {
++ .next = NULL,
++ .name = "str_to_user",
++ .file = "drivers/input/evdev.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001021_hash = {
++ .next = NULL,
++ .name = "stv680_read",
++ .file = "drivers/media/video/stv680.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001022_hash = {
++ .next = NULL,
++ .name = "svc_pool_map_alloc_arrays",
++ .file = "net/sunrpc/svc.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001023_hash = {
++ .next = NULL,
++ .name = "svc_setsockopt",
++ .file = "net/atm/svc.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _001024_hash = {
++ .next = NULL,
++ .name = "tda10048_writeregbulk",
++ .file = "drivers/media/dvb/frontends/tda10048.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _001025_hash = {
++ .next = NULL,
++ .name = "tifm_alloc_adapter",
++ .file = "include/linux/tifm.h",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _001026_hash = {
++ .next = NULL,
++ .name = "tipc_subseq_alloc",
++ .file = "net/tipc/name_table.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _001027_hash = {
++ .next = NULL,
++ .name = "total_ps_buffered_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001028_hash = {
++ .next = NULL,
++ .name = "tower_write",
++ .file = "drivers/usb/misc/legousbtower.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001029_hash = {
++ .next = NULL,
++ .name = "tsf_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001030_hash = {
++ .next = NULL,
++ .name = "ttm_bo_fbdev_io",
++ .file = "drivers/gpu/drm/ttm/ttm_bo_vm.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _001031_hash = {
++ .next = NULL,
++ .name = "ttm_bo_io",
++ .file = "drivers/gpu/drm/ttm/ttm_bo_vm.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _001032_hash = {
++ .next = NULL,
++ .name = "tx_internal_desc_overflow_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001033_hash = {
++ .next = NULL,
++ .name = "tx_internal_desc_overflow_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001034_hash = {
++ .next = &_000323_hash,
++ .name = "tx_queue_len_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001035_hash = {
++ .next = &_000324_hash,
++ .name = "tx_queue_len_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001036_hash = {
++ .next = NULL,
++ .name = "udf_alloc_i_data",
++ .file = "fs/udf/inode.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001037_hash = {
++ .next = NULL,
++ .name = "udf_sb_alloc_partition_maps",
++ .file = "fs/udf/super.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001038_hash = {
++ .next = NULL,
++ .name = "uea_idma_write",
++ .file = "drivers/usb/atm/ueagle-atm.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001039_hash = {
++ .next = NULL,
++ .name = "uea_request",
++ .file = "drivers/usb/atm/ueagle-atm.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _001040_hash = {
++ .next = NULL,
++ .name = "uea_send_modem_cmd",
++ .file = "drivers/usb/atm/ueagle-atm.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001041_hash = {
++ .next = NULL,
++ .name = "uhci_debug_read",
++ .file = "drivers/usb/host/uhci-debug.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001042_hash = {
++ .next = NULL,
++ .name = "uio_read",
++ .file = "drivers/uio/uio.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001043_hash = {
++ .next = NULL,
++ .name = "uio_write",
++ .file = "drivers/uio/uio.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001044_hash = {
++ .next = NULL,
++ .name = "us122l_ctl_msg",
++ .file = "sound/usb/usx2y/us122l.c",
++ .param8 = 1,
++};
++
++struct size_overflow_hash _001045_hash = {
++ .next = NULL,
++ .name = "usbdev_read",
++ .file = "drivers/usb/core/devio.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001046_hash = {
++ .next = NULL,
++ .name = "usblp_read",
++ .file = "drivers/usb/class/usblp.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001047_hash = {
++ .next = NULL,
++ .name = "usblp_write",
++ .file = "drivers/usb/class/usblp.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001048_hash = {
++ .next = NULL,
++ .name = "usbtmc_read",
++ .file = "drivers/usb/class/usbtmc.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001049_hash = {
++ .next = NULL,
++ .name = "usbtmc_write",
++ .file = "drivers/usb/class/usbtmc.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001050_hash = {
++ .next = NULL,
++ .name = "usbvideo_v4l_read",
++ .file = "drivers/media/video/usbvideo/usbvideo.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001051_hash = {
++ .next = NULL,
++ .name = "usbvision_v4l2_read",
++ .file = "drivers/media/video/usbvision/usbvision-video.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001052_hash = {
++ .next = NULL,
++ .name = "uvc_alloc_buffers",
++ .file = "drivers/media/video/uvc/uvc_queue.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001053_hash = {
++ .next = NULL,
++ .name = "uvc_simplify_fraction",
++ .file = "drivers/media/video/uvc/uvc_driver.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001054_hash = {
++ .next = NULL,
++ .name = "uwb_rc_neh_grok_event",
++ .file = "drivers/uwb/neh.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001055_hash = {
++ .next = NULL,
++ .name = "v4l_stk_read",
++ .file = "drivers/media/video/stk-webcam.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001056_hash = {
++ .next = NULL,
++ .name = "vdma_mem_alloc",
++ .file = "arch/x86/include/asm/floppy.h",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _001057_hash = {
++ .next = NULL,
++ .name = "vhci_get_user",
++ .file = "drivers/bluetooth/hci_vhci.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001058_hash = {
++ .next = NULL,
++ .name = "viafb_dfph_proc_write",
++ .file = "drivers/video/via/viafbdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001059_hash = {
++ .next = NULL,
++ .name = "viafb_dfpl_proc_write",
++ .file = "drivers/video/via/viafbdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001060_hash = {
++ .next = NULL,
++ .name = "viafb_dvp0_proc_write",
++ .file = "drivers/video/via/viafbdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001061_hash = {
++ .next = NULL,
++ .name = "viafb_dvp1_proc_write",
++ .file = "drivers/video/via/viafbdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001062_hash = {
++ .next = NULL,
++ .name = "viafb_vt1636_proc_write",
++ .file = "drivers/video/via/viafbdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001063_hash = {
++ .next = NULL,
++ .name = "vicam_read",
++ .file = "drivers/media/video/usbvideo/vicam.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001064_hash = {
++ .next = NULL,
++ .name = "__videobuf_alloc",
++ .file = "drivers/media/video/videobuf-vmalloc.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _001065_hash = {
++ .next = NULL,
++ .name = "__videobuf_alloc",
++ .file = "drivers/media/video/videobuf-dma-sg.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _001066_hash = {
++ .next = NULL,
++ .name = "__videobuf_copy_to_user",
++ .file = "drivers/media/video/videobuf-dma-sg.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001067_hash = {
++ .next = NULL,
++ .name = "__videobuf_copy_to_user",
++ .file = "drivers/media/video/videobuf-vmalloc.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001068_hash = {
++ .next = NULL,
++ .name = "vlsi_alloc_ring",
++ .file = "drivers/net/irda/vlsi_ir.c",
++ .param3 = 1,
++ .param4 = 1,
++};
++
++struct size_overflow_hash _001070_hash = {
++ .next = NULL,
++ .name = "vol_cdev_direct_write",
++ .file = "drivers/mtd/ubi/cdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001071_hash = {
++ .next = NULL,
++ .name = "vol_cdev_read",
++ .file = "drivers/mtd/ubi/cdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001072_hash = {
++ .next = NULL,
++ .name = "vring_add_indirect",
++ .file = "drivers/virtio/virtio_ring.c",
++ .param3 = 1,
++ .param4 = 1,
++};
++
++struct size_overflow_hash _001074_hash = {
++ .next = NULL,
++ .name = "vring_new_virtqueue",
++ .file = "include/linux/virtio_ring.h",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _001075_hash = {
++ .next = NULL,
++ .name = "vstusb_read",
++ .file = "drivers/usb/misc/vstusb.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001076_hash = {
++ .next = NULL,
++ .name = "vstusb_write",
++ .file = "drivers/usb/misc/vstusb.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001077_hash = {
++ .next = NULL,
++ .name = "__vxge_hw_channel_allocate",
++ .file = "drivers/net/vxge/vxge-config.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001078_hash = {
++ .next = NULL,
++ .name = "vxge_os_dma_malloc",
++ .file = "drivers/net/vxge/vxge-config.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001079_hash = {
++ .next = NULL,
++ .name = "vxge_os_dma_malloc_async",
++ .file = "drivers/net/vxge/vxge-config.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001080_hash = {
++ .next = NULL,
++ .name = "w9966_v4l_read",
++ .file = "drivers/media/video/w9966.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001081_hash = {
++ .next = NULL,
++ .name = "w9968cf_read",
++ .file = "drivers/media/video/w9968cf.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001082_hash = {
++ .next = NULL,
++ .name = "waiters_read",
++ .file = "fs/dlm/debug_fs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001083_hash = {
++ .next = NULL,
++ .name = "wa_nep_queue",
++ .file = "drivers/usb/wusbcore/wa-nep.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001084_hash = {
++ .next = NULL,
++ .name = "__wa_xfer_setup_segs",
++ .file = "drivers/usb/wusbcore/wa-xfer.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001085_hash = {
++ .next = NULL,
++ .name = "wdm_read",
++ .file = "drivers/usb/class/cdc-wdm.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001086_hash = {
++ .next = NULL,
++ .name = "wdm_write",
++ .file = "drivers/usb/class/cdc-wdm.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001087_hash = {
++ .next = NULL,
++ .name = "wep_addr_key_count_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001088_hash = {
++ .next = NULL,
++ .name = "wep_addr_key_count_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001089_hash = {
++ .next = NULL,
++ .name = "wep_decrypt_fail_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001090_hash = {
++ .next = NULL,
++ .name = "wep_decrypt_fail_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001091_hash = {
++ .next = NULL,
++ .name = "wep_default_key_count_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001092_hash = {
++ .next = NULL,
++ .name = "wep_default_key_count_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001093_hash = {
++ .next = NULL,
++ .name = "wep_interrupt_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001094_hash = {
++ .next = NULL,
++ .name = "wep_interrupt_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001095_hash = {
++ .next = NULL,
++ .name = "wep_iv_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001096_hash = {
++ .next = NULL,
++ .name = "wep_key_not_found_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001097_hash = {
++ .next = NULL,
++ .name = "wep_key_not_found_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001098_hash = {
++ .next = NULL,
++ .name = "wep_packets_read",
++ .file = "drivers/net/wireless/wl12xx/wl1271_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001099_hash = {
++ .next = NULL,
++ .name = "wep_packets_read",
++ .file = "drivers/net/wireless/wl12xx/wl1251_debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001100_hash = {
++ .next = NULL,
++ .name = "wpan_phy_alloc",
++ .file = "include/net/wpan-phy.h",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _001101_hash = {
++ .next = NULL,
++ .name = "write_essid",
++ .file = "drivers/net/wireless/ray_cs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001102_hash = {
++ .next = NULL,
++ .name = "write_flush",
++ .file = "net/sunrpc/cache.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001103_hash = {
++ .next = NULL,
++ .name = "write_int",
++ .file = "drivers/net/wireless/ray_cs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001104_hash = {
++ .next = NULL,
++ .name = "write_rio",
++ .file = "drivers/usb/misc/rio500.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001105_hash = {
++ .next = NULL,
++ .name = "wusb_ccm_mac",
++ .file = "drivers/usb/wusbcore/crypto.c",
++ .param7 = 1,
++};
++
++struct size_overflow_hash _001106_hash = {
++ .next = NULL,
++ .name = "xfs_attrmulti_attr_set",
++ .file = "fs/xfs/linux-2.6/xfs_ioctl.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _001107_hash = {
++ .next = NULL,
++ .name = "xfs_handle_to_dentry",
++ .file = "fs/xfs/linux-2.6/xfs_ioctl.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001108_hash = {
++ .next = NULL,
++ .name = "xprt_rdma_allocate",
++ .file = "net/sunrpc/xprtrdma/transport.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001109_hash = {
++ .next = NULL,
++ .name = "xt_alloc_table_info",
++ .file = "include/linux/netfilter/x_tables.h",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _001110_hash = {
++ .next = NULL,
++ .name = "zc0301_read",
++ .file = "drivers/media/video/zc0301/zc0301_core.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001111_hash = {
++ .next = NULL,
++ .name = "zd_ioread32v_locked",
++ .file = "drivers/net/wireless/zd1211rw/zd_chip.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _001112_hash = {
++ .next = NULL,
++ .name = "_zd_iowrite32v_locked",
++ .file = "drivers/net/wireless/zd1211rw/zd_chip.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001113_hash = {
++ .next = NULL,
++ .name = "zd_usb_ioread16v",
++ .file = "drivers/net/wireless/zd1211rw/zd_usb.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _001114_hash = {
++ .next = NULL,
++ .name = "zd_usb_iowrite16v",
++ .file = "drivers/net/wireless/zd1211rw/zd_usb.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001115_hash = {
++ .next = NULL,
++ .name = "zd_usb_read_fw",
++ .file = "drivers/net/wireless/zd1211rw/zd_usb.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _001116_hash = {
++ .next = NULL,
++ .name = "zd_usb_rfwrite",
++ .file = "drivers/net/wireless/zd1211rw/zd_usb.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001117_hash = {
++ .next = NULL,
++ .name = "zoran_write",
++ .file = "drivers/media/video/zoran/zoran_procfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001118_hash = {
++ .next = NULL,
++ .name = "agp_create_user_memory",
++ .file = "drivers/char/agp/generic.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _001119_hash = {
++ .next = NULL,
++ .name = "alloc_targets",
++ .file = "drivers/md/dm-table.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001120_hash = {
++ .next = NULL,
++ .name = "aoechr_write",
++ .file = "drivers/block/aoe/aoechr.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001121_hash = {
++ .next = NULL,
++ .name = "atomic_read_file",
++ .file = "arch/x86/oprofile/../../../drivers/oprofile/oprofilefs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001122_hash = {
++ .next = NULL,
++ .name = "bm_entry_write",
++ .file = "fs/binfmt_misc.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001123_hash = {
++ .next = NULL,
++ .name = "bm_init",
++ .file = "lib/ts_bm.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001124_hash = {
++ .next = NULL,
++ .name = "bm_register_write",
++ .file = "fs/binfmt_misc.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001125_hash = {
++ .next = NULL,
++ .name = "bm_status_write",
++ .file = "fs/binfmt_misc.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001126_hash = {
++ .next = NULL,
++ .name = "cache_downcall",
++ .file = "net/sunrpc/cache.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001127_hash = {
++ .next = NULL,
++ .name = "cache_slow_downcall",
++ .file = "net/sunrpc/cache.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001128_hash = {
++ .next = NULL,
++ .name = "cafe_v4l_read",
++ .file = "drivers/media/video/cafe_ccic.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001129_hash = {
++ .next = NULL,
++ .name = "configfs_write_file",
++ .file = "fs/configfs/file.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001130_hash = {
++ .next = NULL,
++ .name = "cpu_type_read",
++ .file = "arch/x86/oprofile/../../../drivers/oprofile/oprofile_files.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001131_hash = {
++ .next = NULL,
++ .name = "csr1212_new_descriptor_leaf",
++ .file = "drivers/ieee1394/csr1212.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _001132_hash = {
++ .next = NULL,
++ .name = "cx18_read",
++ .file = "drivers/media/video/cx18/cx18-fileops.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001133_hash = {
++ .next = NULL,
++ .name = "cxio_init_resource_fifo",
++ .file = "drivers/infiniband/hw/cxgb3/cxio_resource.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001134_hash = {
++ .next = NULL,
++ .name = "cxio_init_resource_fifo_random",
++ .file = "drivers/infiniband/hw/cxgb3/cxio_resource.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001135_hash = {
++ .next = NULL,
++ .name = "dataflash_read_fact_otp",
++ .file = "drivers/mtd/devices/mtd_dataflash.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001136_hash = {
++ .next = NULL,
++ .name = "dataflash_read_user_otp",
++ .file = "drivers/mtd/devices/mtd_dataflash.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001137_hash = {
++ .next = NULL,
++ .name = "depth_read",
++ .file = "arch/x86/oprofile/../../../drivers/oprofile/oprofile_files.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001138_hash = {
++ .next = NULL,
++ .name = "depth_write",
++ .file = "arch/x86/oprofile/../../../drivers/oprofile/oprofile_files.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001139_hash = {
++ .next = NULL,
++ .name = "dev_irnet_write",
++ .file = "net/irda/irnet/irnet_ppp.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001140_hash = {
++ .next = NULL,
++ .name = "dev_write",
++ .file = "sound/oss/msnd_pinnacle.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001141_hash = {
++ .next = NULL,
++ .name = "do_dccp_setsockopt",
++ .file = "net/dccp/proto.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _001142_hash = {
++ .next = NULL,
++ .name = "dvb_audio_write",
++ .file = "drivers/media/dvb/ttpci/av7110_av.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001143_hash = {
++ .next = NULL,
++ .name = "dvb_demux_do_ioctl",
++ .file = "drivers/media/dvb/dvb-core/dmxdev.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _001144_hash = {
++ .next = NULL,
++ .name = "dvb_dvr_do_ioctl",
++ .file = "drivers/media/dvb/dvb-core/dmxdev.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _001145_hash = {
++ .next = NULL,
++ .name = "dvb_video_write",
++ .file = "drivers/media/dvb/ttpci/av7110_av.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001146_hash = {
++ .next = NULL,
++ .name = "ecryptfs_decode_and_decrypt_filename",
++ .file = "fs/ecryptfs/crypto.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _001147_hash = {
++ .next = NULL,
++ .name = "ecryptfs_encrypt_and_encode_filename",
++ .file = "fs/ecryptfs/crypto.c",
++ .param6 = 1,
++};
++
++struct size_overflow_hash _001148_hash = {
++ .next = NULL,
++ .name = "enable_read",
++ .file = "arch/x86/oprofile/../../../drivers/oprofile/oprofile_files.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001149_hash = {
++ .next = NULL,
++ .name = "enable_write",
++ .file = "arch/x86/oprofile/../../../drivers/oprofile/oprofile_files.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001150_hash = {
++ .next = NULL,
++ .name = "fallback_on_nodma_alloc",
++ .file = "drivers/block/floppy.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001151_hash = {
++ .next = NULL,
++ .name = "__feat_register_sp",
++ .file = "net/dccp/feat.c",
++ .param6 = 1,
++};
++
++struct size_overflow_hash _001152_hash = {
++ .next = NULL,
++ .name = "frame_alloc",
++ .file = "drivers/media/video/gspca/gspca.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001153_hash = {
++ .next = NULL,
++ .name = "fsm_init",
++ .file = "lib/ts_fsm.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001154_hash = {
++ .next = NULL,
++ .name = "garmin_read_process",
++ .file = "drivers/usb/serial/garmin_gps.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001155_hash = {
++ .next = NULL,
++ .name = "garp_request_join",
++ .file = "include/net/garp.h",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _001156_hash = {
++ .next = NULL,
++ .name = "hpsb_iso_recv_init",
++ .file = "drivers/ieee1394/iso.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001157_hash = {
++ .next = NULL,
++ .name = "hpsb_iso_xmit_init",
++ .file = "drivers/ieee1394/iso.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001158_hash = {
++ .next = NULL,
++ .name = "__hwahc_op_set_gtk",
++ .file = "drivers/usb/host/hwa-hc.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _001159_hash = {
++ .next = NULL,
++ .name = "__hwahc_op_set_ptk",
++ .file = "drivers/usb/host/hwa-hc.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _001160_hash = {
++ .next = NULL,
++ .name = "ib_send_cm_drep",
++ .file = "include/rdma/ib_cm.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001161_hash = {
++ .next = NULL,
++ .name = "ib_send_cm_mra",
++ .file = "include/rdma/ib_cm.h",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _001162_hash = {
++ .next = NULL,
++ .name = "ib_send_cm_rtu",
++ .file = "include/rdma/ib_cm.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001163_hash = {
++ .next = NULL,
++ .name = "ieee80211_bss_info_update",
++ .file = "net/mac80211/scan.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _001164_hash = {
++ .next = NULL,
++ .name = "ieee80211_if_read_aid",
++ .file = "net/mac80211/debugfs_netdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001165_hash = {
++ .next = NULL,
++ .name = "ieee80211_if_read_auto_open_plinks",
++ .file = "net/mac80211/debugfs_netdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001166_hash = {
++ .next = NULL,
++ .name = "ieee80211_if_read_bssid",
++ .file = "net/mac80211/debugfs_netdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001167_hash = {
++ .next = NULL,
++ .name = "ieee80211_if_read_capab",
++ .file = "net/mac80211/debugfs_netdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001168_hash = {
++ .next = NULL,
++ .name = "ieee80211_if_read_dot11MeshConfirmTimeout",
++ .file = "net/mac80211/debugfs_netdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001169_hash = {
++ .next = NULL,
++ .name = "ieee80211_if_read_dot11MeshHoldingTimeout",
++ .file = "net/mac80211/debugfs_netdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001170_hash = {
++ .next = NULL,
++ .name = "ieee80211_if_read_dot11MeshHWMPactivePathTimeout",
++ .file = "net/mac80211/debugfs_netdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001171_hash = {
++ .next = NULL,
++ .name = "ieee80211_if_read_dot11MeshHWMPmaxPREQretries",
++ .file = "net/mac80211/debugfs_netdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001172_hash = {
++ .next = NULL,
++ .name = "ieee80211_if_read_dot11MeshHWMPnetDiameterTraversalTime",
++ .file = "net/mac80211/debugfs_netdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001173_hash = {
++ .next = NULL,
++ .name = "ieee80211_if_read_dot11MeshHWMPpreqMinInterval",
++ .file = "net/mac80211/debugfs_netdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001174_hash = {
++ .next = NULL,
++ .name = "ieee80211_if_read_dot11MeshMaxPeerLinks",
++ .file = "net/mac80211/debugfs_netdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001175_hash = {
++ .next = NULL,
++ .name = "ieee80211_if_read_dot11MeshMaxRetries",
++ .file = "net/mac80211/debugfs_netdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001176_hash = {
++ .next = NULL,
++ .name = "ieee80211_if_read_dot11MeshRetryTimeout",
++ .file = "net/mac80211/debugfs_netdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001177_hash = {
++ .next = NULL,
++ .name = "ieee80211_if_read_dot11MeshTTL",
++ .file = "net/mac80211/debugfs_netdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001178_hash = {
++ .next = NULL,
++ .name = "ieee80211_if_read_dropped_frames_no_route",
++ .file = "net/mac80211/debugfs_netdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001179_hash = {
++ .next = NULL,
++ .name = "ieee80211_if_read_dropped_frames_ttl",
++ .file = "net/mac80211/debugfs_netdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001180_hash = {
++ .next = NULL,
++ .name = "ieee80211_if_read_drop_unencrypted",
++ .file = "net/mac80211/debugfs_netdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001181_hash = {
++ .next = NULL,
++ .name = "ieee80211_if_read_dtim_count",
++ .file = "net/mac80211/debugfs_netdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001182_hash = {
++ .next = NULL,
++ .name = "ieee80211_if_read_estab_plinks",
++ .file = "net/mac80211/debugfs_netdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001183_hash = {
++ .next = NULL,
++ .name = "ieee80211_if_read_force_unicast_rateidx",
++ .file = "net/mac80211/debugfs_netdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001184_hash = {
++ .next = NULL,
++ .name = "ieee80211_if_read_fwded_frames",
++ .file = "net/mac80211/debugfs_netdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001185_hash = {
++ .next = NULL,
++ .name = "ieee80211_if_read_fwded_mcast",
++ .file = "net/mac80211/debugfs_netdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001186_hash = {
++ .next = NULL,
++ .name = "ieee80211_if_read_fwded_unicast",
++ .file = "net/mac80211/debugfs_netdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001187_hash = {
++ .next = NULL,
++ .name = "ieee80211_if_read_max_ratectrl_rateidx",
++ .file = "net/mac80211/debugfs_netdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001188_hash = {
++ .next = NULL,
++ .name = "ieee80211_if_read_min_discovery_timeout",
++ .file = "net/mac80211/debugfs_netdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001189_hash = {
++ .next = NULL,
++ .name = "ieee80211_if_read_num_buffered_multicast",
++ .file = "net/mac80211/debugfs_netdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001190_hash = {
++ .next = NULL,
++ .name = "ieee80211_if_read_num_sta_ps",
++ .file = "net/mac80211/debugfs_netdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001191_hash = {
++ .next = NULL,
++ .name = "ieee80211_if_read_path_refresh_time",
++ .file = "net/mac80211/debugfs_netdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001192_hash = {
++ .next = NULL,
++ .name = "ieee80211_if_read_peer",
++ .file = "net/mac80211/debugfs_netdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001193_hash = {
++ .next = NULL,
++ .name = "init_exception_table",
++ .file = "drivers/md/dm-snap.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001194_hash = {
++ .next = NULL,
++ .name = "init_tid_tabs",
++ .file = "drivers/net/cxgb3/cxgb3_offload.c",
++ .param2 = 1,
++ .param4 = 1,
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001197_hash = {
++ .next = NULL,
++ .name = "ivtv_read",
++ .file = "drivers/media/video/ivtv/ivtv-fileops.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001198_hash = {
++ .next = NULL,
++ .name = "kmem_realloc",
++ .file = "fs/xfs/linux-2.6/kmem.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001199_hash = {
++ .next = NULL,
++ .name = "kmem_zalloc",
++ .file = "fs/xfs/linux-2.6/kmem.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _001200_hash = {
++ .next = NULL,
++ .name = "kmp_init",
++ .file = "lib/ts_kmp.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001201_hash = {
++ .next = NULL,
++ .name = "lbs_bcnmiss_read",
++ .file = "drivers/net/wireless/libertas/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001202_hash = {
++ .next = NULL,
++ .name = "lbs_failcount_read",
++ .file = "drivers/net/wireless/libertas/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001203_hash = {
++ .next = NULL,
++ .name = "lbs_highrssi_read",
++ .file = "drivers/net/wireless/libertas/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001204_hash = {
++ .next = NULL,
++ .name = "lbs_highsnr_read",
++ .file = "drivers/net/wireless/libertas/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001205_hash = {
++ .next = NULL,
++ .name = "lbs_lowrssi_read",
++ .file = "drivers/net/wireless/libertas/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001206_hash = {
++ .next = NULL,
++ .name = "lbs_lowsnr_read",
++ .file = "drivers/net/wireless/libertas/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001207_hash = {
++ .next = NULL,
++ .name = "nfs_flush_one",
++ .file = "fs/nfs/write.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001208_hash = {
++ .next = &_000671_hash,
++ .name = "nfs_pagein_one",
++ .file = "fs/nfs/read.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001209_hash = {
++ .next = NULL,
++ .name = "nsm_get_handle",
++ .file = "include/linux/lockd/lockd.h",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _001210_hash = {
++ .next = NULL,
++ .name = "ntfs_copy_from_user_iovec",
++ .file = "fs/ntfs/file.c",
++ .param3 = 1,
++ .param6 = 1,
++};
++
++struct size_overflow_hash _001212_hash = {
++ .next = NULL,
++ .name = "ntfs_file_buffered_write",
++ .file = "fs/ntfs/file.c",
++ .param6 = 1,
++};
++
++struct size_overflow_hash _001213_hash = {
++ .next = NULL,
++ .name = "ntfs_malloc_nofs",
++ .file = "fs/ntfs/malloc.h",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _001214_hash = {
++ .next = NULL,
++ .name = "ntfs_malloc_nofs_nofail",
++ .file = "fs/ntfs/malloc.h",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _001215_hash = {
++ .next = NULL,
++ .name = "ocfs2_control_message",
++ .file = "fs/ocfs2/stack_user.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001216_hash = {
++ .next = NULL,
++ .name = "orinoco_add_extscan_result",
++ .file = "drivers/net/wireless/orinoco/scan.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001217_hash = {
++ .next = NULL,
++ .name = "play_iframe",
++ .file = "drivers/media/dvb/ttpci/av7110_av.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001218_hash = {
++ .next = NULL,
++ .name = "pointer_size_read",
++ .file = "arch/x86/oprofile/../../../drivers/oprofile/oprofile_files.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001219_hash = {
++ .next = NULL,
++ .name = "proc_write_brn",
++ .file = "drivers/platform/x86/asus_acpi.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001220_hash = {
++ .next = NULL,
++ .name = "proc_write_disp",
++ .file = "drivers/platform/x86/asus_acpi.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001221_hash = {
++ .next = NULL,
++ .name = "proc_write_lcd",
++ .file = "drivers/platform/x86/asus_acpi.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001222_hash = {
++ .next = NULL,
++ .name = "proc_write_ledd",
++ .file = "drivers/platform/x86/asus_acpi.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001223_hash = {
++ .next = NULL,
++ .name = "qcam_read",
++ .file = "drivers/media/video/c-qcam.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001224_hash = {
++ .next = NULL,
++ .name = "scsi_tgt_kspace_exec",
++ .file = "drivers/scsi/scsi_tgt_lib.c",
++ .param8 = 1,
++};
++
++struct size_overflow_hash _001225_hash = {
++ .next = NULL,
++ .name = "sctp_sendmsg",
++ .file = "net/sctp/socket.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _001226_hash = {
++ .next = NULL,
++ .name = "sctp_setsockopt",
++ .file = "net/sctp/socket.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _001227_hash = {
++ .next = NULL,
++ .name = "snd_cs4281_BA0_read",
++ .file = "sound/pci/cs4281.c",
++ .param5 = 1,
++ .param6 = 1,
++};
++
++struct size_overflow_hash _001229_hash = {
++ .next = NULL,
++ .name = "snd_cs4281_BA1_read",
++ .file = "sound/pci/cs4281.c",
++ .param5 = 1,
++ .param6 = 1,
++};
++
++struct size_overflow_hash _001231_hash = {
++ .next = NULL,
++ .name = "snd_cs46xx_io_read",
++ .file = "sound/pci/cs46xx/cs46xx_lib.c",
++ .param5 = 1,
++ .param6 = 1,
++};
++
++struct size_overflow_hash _001233_hash = {
++ .next = NULL,
++ .name = "snd_gus_dram_read",
++ .file = "include/sound/gus.h",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _001234_hash = {
++ .next = NULL,
++ .name = "snd_gus_dram_write",
++ .file = "include/sound/gus.h",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _001235_hash = {
++ .next = NULL,
++ .name = "snd_pcm_oss_read",
++ .file = "sound/core/oss/pcm_oss.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001236_hash = {
++ .next = NULL,
++ .name = "snd_pcm_oss_sync1",
++ .file = "sound/core/oss/pcm_oss.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001237_hash = {
++ .next = NULL,
++ .name = "snd_pcm_oss_write",
++ .file = "sound/core/oss/pcm_oss.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001238_hash = {
++ .next = NULL,
++ .name = "snd_rme32_capture_copy",
++ .file = "sound/pci/rme32.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _001239_hash = {
++ .next = NULL,
++ .name = "snd_rme32_playback_copy",
++ .file = "sound/pci/rme32.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _001240_hash = {
++ .next = NULL,
++ .name = "snd_rme96_capture_copy",
++ .file = "sound/pci/rme96.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _001241_hash = {
++ .next = NULL,
++ .name = "snd_rme96_playback_copy",
++ .file = "sound/pci/rme96.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _001242_hash = {
++ .next = NULL,
++ .name = "srp_target_alloc",
++ .file = "include/scsi/libsrp.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001243_hash = {
++ .next = NULL,
++ .name = "stats_dot11ACKFailureCount_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001244_hash = {
++ .next = NULL,
++ .name = "stats_dot11FCSErrorCount_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001245_hash = {
++ .next = NULL,
++ .name = "stats_dot11RTSFailureCount_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001246_hash = {
++ .next = NULL,
++ .name = "stats_dot11RTSSuccessCount_read",
++ .file = "net/mac80211/debugfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001247_hash = {
++ .next = NULL,
++ .name = "stk_allocate_buffers",
++ .file = "drivers/media/video/stk-webcam.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001248_hash = {
++ .next = NULL,
++ .name = "timeout_read",
++ .file = "arch/x86/oprofile/../../../drivers/oprofile/oprofile_files.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001249_hash = {
++ .next = NULL,
++ .name = "timeout_write",
++ .file = "arch/x86/oprofile/../../../drivers/oprofile/oprofile_files.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001250_hash = {
++ .next = NULL,
++ .name = "ulong_read_file",
++ .file = "arch/x86/oprofile/../../../drivers/oprofile/oprofilefs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001251_hash = {
++ .next = NULL,
++ .name = "ulong_write_file",
++ .file = "arch/x86/oprofile/../../../drivers/oprofile/oprofilefs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001252_hash = {
++ .next = NULL,
++ .name = "__videobuf_copy_stream",
++ .file = "drivers/media/video/videobuf-dma-sg.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001253_hash = {
++ .next = NULL,
++ .name = "__videobuf_copy_stream",
++ .file = "drivers/media/video/videobuf-vmalloc.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001254_hash = {
++ .next = NULL,
++ .name = "vol_cdev_write",
++ .file = "drivers/mtd/ubi/cdev.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001255_hash = {
++ .next = NULL,
++ .name = "vring_add_buf",
++ .file = "drivers/virtio/virtio_ring.c",
++ .param3 = 1,
++ .param4 = 1,
++};
++
++struct size_overflow_hash _001257_hash = {
++ .next = NULL,
++ .name = "write_led",
++ .file = "drivers/platform/x86/asus_acpi.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001258_hash = {
++ .next = NULL,
++ .name = "wusb_prf",
++ .file = "include/linux/usb/wusb.h",
++ .param7 = 1,
++};
++
++struct size_overflow_hash _001259_hash = {
++ .next = NULL,
++ .name = "zd_ioread32v",
++ .file = "drivers/net/wireless/zd1211rw/zd_chip.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _001260_hash = {
++ .next = NULL,
++ .name = "agp_generic_alloc_user",
++ .file = "drivers/char/agp/generic.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _001261_hash = {
++ .next = NULL,
++ .name = "cache_write",
++ .file = "net/sunrpc/cache.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001262_hash = {
++ .next = NULL,
++ .name = "cx18_read_pos",
++ .file = "drivers/media/video/cx18/cx18-fileops.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001263_hash = {
++ .next = NULL,
++ .name = "cxio_hal_init_resource",
++ .file = "drivers/infiniband/hw/cxgb3/cxio_resource.c",
++ .param2 = 1,
++ .param7 = 1,
++ .param6 = 1,
++};
++
++struct size_overflow_hash _001266_hash = {
++ .next = &_000561_hash,
++ .name = "cxio_hal_init_rhdl_resource",
++ .file = "drivers/infiniband/hw/cxgb3/cxio_resource.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _001267_hash = {
++ .next = NULL,
++ .name = "dccp_feat_register_sp",
++ .file = "net/dccp/feat.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _001269_hash = {
++ .next = NULL,
++ .name = "ivtv_read_pos",
++ .file = "drivers/media/video/ivtv/ivtv-fileops.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001270_hash = {
++ .next = NULL,
++ .name = "kmem_zalloc_greedy",
++ .file = "fs/xfs/linux-2.6/kmem.c",
++ .param2 = 1,
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001272_hash = {
++ .next = NULL,
++ .name = "ocfs2_control_write",
++ .file = "fs/ocfs2/stack_user.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001273_hash = {
++ .next = NULL,
++ .name = "proc_write_bluetooth",
++ .file = "drivers/platform/x86/asus_acpi.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001274_hash = {
++ .next = NULL,
++ .name = "proc_write_mled",
++ .file = "drivers/platform/x86/asus_acpi.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001275_hash = {
++ .next = NULL,
++ .name = "proc_write_tled",
++ .file = "drivers/platform/x86/asus_acpi.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001276_hash = {
++ .next = &_001229_hash,
++ .name = "proc_write_wled",
++ .file = "drivers/platform/x86/asus_acpi.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001277_hash = {
++ .next = NULL,
++ .name = "snd_gf1_mem_proc_dump",
++ .file = "sound/isa/gus/gus_mem_proc.c",
++ .param5 = 1,
++ .param6 = 1,
++};
++
++struct size_overflow_hash _001279_hash = {
++ .next = NULL,
++ .name = "wusb_prf_256",
++ .file = "include/linux/usb/wusb.h",
++ .param7 = 1,
++};
++
++struct size_overflow_hash _001280_hash = {
++ .next = NULL,
++ .name = "wusb_prf_64",
++ .file = "include/linux/usb/wusb.h",
++ .param7 = 1,
++};
++
++struct size_overflow_hash _001281_hash = {
++ .next = NULL,
++ .name = "agp_allocate_memory",
++ .file = "include/linux/agp_backend.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001282_hash = {
++ .next = NULL,
++ .name = "agp_allocate_memory_wrap",
++ .file = "drivers/char/agp/frontend.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _001283_hash = {
++ .next = NULL,
++ .name = "drm_agp_allocate_memory",
++ .file = "drivers/gpu/drm/drm_agpsupport.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001284_hash = {
++ .next = NULL,
++ .name = "ttm_agp_populate",
++ .file = "drivers/gpu/drm/ttm/ttm_agp_backend.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001285_hash = {
++ .next = NULL,
++ .name = "drm_agp_bind_pages",
++ .file = "drivers/gpu/drm/drm_agpsupport.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001286_hash = {
++ .next = NULL,
++ .name = "atomic_counters_read",
++ .file = "drivers/infiniband/hw/ipath/ipath_fs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001287_hash = {
++ .next = NULL,
++ .name = "atomic_stats_read",
++ .file = "drivers/infiniband/hw/ipath/ipath_fs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001288_hash = {
++ .next = NULL,
++ .name = "compat_do_arpt_set_ctl",
++ .file = "net/ipv4/netfilter/arp_tables.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _001289_hash = {
++ .next = NULL,
++ .name = "compat_do_ip6t_set_ctl",
++ .file = "net/ipv6/netfilter/ip6_tables.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _001290_hash = {
++ .next = NULL,
++ .name = "compat_do_ipt_set_ctl",
++ .file = "net/ipv4/netfilter/ip_tables.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _001291_hash = {
++ .next = &_001192_hash,
++ .name = "do_arpt_set_ctl",
++ .file = "net/ipv4/netfilter/arp_tables.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _001292_hash = {
++ .next = NULL,
++ .name = "do_ip6t_set_ctl",
++ .file = "net/ipv6/netfilter/ip6_tables.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _001293_hash = {
++ .next = NULL,
++ .name = "do_ipt_set_ctl",
++ .file = "net/ipv4/netfilter/ip_tables.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _001294_hash = {
++ .next = NULL,
++ .name = "flash_read",
++ .file = "drivers/infiniband/hw/ipath/ipath_fs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001295_hash = {
++ .next = NULL,
++ .name = "flash_write",
++ .file = "drivers/infiniband/hw/ipath/ipath_fs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001296_hash = {
++ .next = &_000200_hash,
++ .name = "stats_read_ul",
++ .file = "drivers/idle/i7300_idle.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001297_hash = {
++ .next = NULL,
++ .name = "add_numbered_child",
++ .file = "drivers/mfd/twl4030-core.c",
++ .param5 = 1,
++};
++
++struct size_overflow_hash _001298_hash = {
++ .next = NULL,
++ .name = "diva_os_malloc",
++ .file = "drivers/isdn/hardware/eicon/platform.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001299_hash = {
++ .next = NULL,
++ .name = "kmalloc_node",
++ .file = "include/linux/slub_def.h",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _001300_hash = {
++ .next = NULL,
++ .name = "pcpu_mem_alloc",
++ .file = "mm/percpu.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _001301_hash = {
++ .next = NULL,
++ .name = "xpc_kmalloc_cacheline_aligned",
++ .file = "drivers/misc/sgi-xp/xpc_partition.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _001302_hash = {
++ .next = NULL,
++ .name = "xpc_kzalloc_cacheline_aligned",
++ .file = "drivers/misc/sgi-xp/xpc_main.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _001303_hash = {
++ .next = NULL,
++ .name = "add_child",
++ .file = "drivers/mfd/twl4030-core.c",
++ .param4 = 1,
++};
++
++struct size_overflow_hash _001304_hash = {
++ .next = NULL,
++ .name = "kzalloc_node",
++ .file = "include/linux/slab.h",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _001305_hash = {
++ .next = NULL,
++ .name = "__alloc_bootmem_low_node",
++ .file = "include/linux/bootmem.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001306_hash = {
++ .next = NULL,
++ .name = "__alloc_bootmem_node",
++ .file = "include/linux/bootmem.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001307_hash = {
++ .next = NULL,
++ .name = "__alloc_bootmem_node_nopanic",
++ .file = "include/linux/bootmem.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001308_hash = {
++ .next = NULL,
++ .name = "__earlyonly_bootmem_alloc",
++ .file = "mm/sparse-vmemmap.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001309_hash = {
++ .next = &_001059_hash,
++ .name = "pcpu_alloc_bootmem",
++ .file = "arch/x86/kernel/setup_percpu.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001310_hash = {
++ .next = NULL,
++ .name = "pcpu_fc_alloc",
++ .file = "arch/x86/kernel/setup_percpu.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001311_hash = {
++ .next = NULL,
++ .name = "vmemmap_alloc_block",
++ .file = "include/linux/mm.h",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _001312_hash = {
++ .next = NULL,
++ .name = "alloc_ebda_hpc",
++ .file = "drivers/pci/hotplug/ibmphp_ebda.c",
++ .param1 = 1,
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001314_hash = {
++ .next = NULL,
++ .name = "do_pages_stat",
++ .file = "mm/migrate.c",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001315_hash = {
++ .next = NULL,
++ .name = "sys_move_pages",
++ .file = "include/linux/syscalls.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001316_hash = {
++ .next = NULL,
++ .name = "copy_from_user",
++ .file = "arch/x86/include/asm/uaccess_64.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001317_hash = {
++ .next = NULL,
++ .name = "__copy_from_user_inatomic",
++ .file = "arch/x86/include/asm/uaccess_64.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001318_hash = {
++ .next = NULL,
++ .name = "copy_to_user",
++ .file = "arch/x86/include/asm/uaccess_64.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001319_hash = {
++ .next = NULL,
++ .name = "event_enable_read",
++ .file = "kernel/trace/trace_events.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001320_hash = {
++ .next = NULL,
++ .name = "event_filter_read",
++ .file = "kernel/trace/trace_events.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001321_hash = {
++ .next = NULL,
++ .name = "event_format_read",
++ .file = "kernel/trace/trace_events.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001322_hash = {
++ .next = NULL,
++ .name = "ftrace_pid_read",
++ .file = "kernel/trace/ftrace.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001323_hash = {
++ .next = NULL,
++ .name = "ftrace_profile_read",
++ .file = "kernel/trace/ftrace.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001324_hash = {
++ .next = NULL,
++ .name = "module_alloc_update_bounds_rx",
++ .file = "kernel/module.c",
++ .param1 = 1,
++};
++
++struct size_overflow_hash _001325_hash = {
++ .next = NULL,
++ .name = "rb_simple_read",
++ .file = "kernel/trace/ring_buffer.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001326_hash = {
++ .next = NULL,
++ .name = "show_header",
++ .file = "kernel/trace/trace_events.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001327_hash = {
++ .next = NULL,
++ .name = "subsystem_filter_read",
++ .file = "kernel/trace/trace_events.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001328_hash = {
++ .next = NULL,
++ .name = "sysprof_sample_read",
++ .file = "kernel/trace/trace_sysprof.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001329_hash = {
++ .next = NULL,
++ .name = "system_enable_read",
++ .file = "kernel/trace/trace_events.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001330_hash = {
++ .next = NULL,
++ .name = "trace_options_core_read",
++ .file = "kernel/trace/trace.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001331_hash = {
++ .next = NULL,
++ .name = "trace_options_read",
++ .file = "kernel/trace/trace.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001332_hash = {
++ .next = NULL,
++ .name = "tracing_clock_read",
++ .file = "kernel/trace/trace.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001333_hash = {
++ .next = NULL,
++ .name = "tracing_cpumask_read",
++ .file = "kernel/trace/trace.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001334_hash = {
++ .next = NULL,
++ .name = "tracing_ctrl_read",
++ .file = "kernel/trace/trace.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001335_hash = {
++ .next = NULL,
++ .name = "tracing_entries_read",
++ .file = "kernel/trace/trace.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001336_hash = {
++ .next = NULL,
++ .name = "tracing_mark_write",
++ .file = "kernel/trace/trace.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001337_hash = {
++ .next = NULL,
++ .name = "tracing_max_lat_read",
++ .file = "kernel/trace/trace.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001338_hash = {
++ .next = NULL,
++ .name = "tracing_read_dyn_info",
++ .file = "kernel/trace/trace.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001339_hash = {
++ .next = NULL,
++ .name = "tracing_readme_read",
++ .file = "kernel/trace/trace.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001340_hash = {
++ .next = NULL,
++ .name = "tracing_saved_cmdlines_read",
++ .file = "kernel/trace/trace.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001341_hash = {
++ .next = NULL,
++ .name = "tracing_set_trace_read",
++ .file = "kernel/trace/trace.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001342_hash = {
++ .next = NULL,
++ .name = "tracing_stats_read",
++ .file = "kernel/trace/trace.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001343_hash = {
++ .next = NULL,
++ .name = "tracing_trace_options_read",
++ .file = "kernel/trace/trace.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001344_hash = {
++ .next = NULL,
++ .name = "event_enable_write",
++ .file = "kernel/trace/trace_events.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001345_hash = {
++ .next = NULL,
++ .name = "event_filter_write",
++ .file = "kernel/trace/trace_events.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001346_hash = {
++ .next = NULL,
++ .name = "event_id_read",
++ .file = "kernel/trace/trace_events.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001347_hash = {
++ .next = NULL,
++ .name = "ftrace_pid_write",
++ .file = "kernel/trace/ftrace.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001348_hash = {
++ .next = NULL,
++ .name = "ftrace_profile_write",
++ .file = "kernel/trace/ftrace.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001349_hash = {
++ .next = NULL,
++ .name = "rb_simple_write",
++ .file = "kernel/trace/ring_buffer.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001350_hash = {
++ .next = NULL,
++ .name = "subsystem_filter_write",
++ .file = "kernel/trace/trace_events.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001351_hash = {
++ .next = NULL,
++ .name = "sysprof_sample_write",
++ .file = "kernel/trace/trace_sysprof.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001352_hash = {
++ .next = NULL,
++ .name = "system_enable_write",
++ .file = "kernel/trace/trace_events.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001353_hash = {
++ .next = NULL,
++ .name = "trace_options_core_write",
++ .file = "kernel/trace/trace.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001354_hash = {
++ .next = NULL,
++ .name = "trace_options_write",
++ .file = "kernel/trace/trace.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001355_hash = {
++ .next = NULL,
++ .name = "trace_seq_to_user",
++ .file = "include/linux/trace_seq.h",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001356_hash = {
++ .next = NULL,
++ .name = "tracing_buffers_read",
++ .file = "kernel/trace/trace.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001357_hash = {
++ .next = NULL,
++ .name = "tracing_clock_write",
++ .file = "kernel/trace/trace.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001358_hash = {
++ .next = NULL,
++ .name = "tracing_ctrl_write",
++ .file = "kernel/trace/trace.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001359_hash = {
++ .next = NULL,
++ .name = "tracing_entries_write",
++ .file = "kernel/trace/trace.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001360_hash = {
++ .next = NULL,
++ .name = "tracing_max_lat_write",
++ .file = "kernel/trace/trace.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001361_hash = {
++ .next = NULL,
++ .name = "tracing_set_trace_write",
++ .file = "kernel/trace/trace.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001362_hash = {
++ .next = NULL,
++ .name = "tracing_trace_options_write",
++ .file = "kernel/trace/trace.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001363_hash = {
++ .next = NULL,
++ .name = "tstats_write",
++ .file = "kernel/time/timer_stats.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001364_hash = {
++ .next = NULL,
++ .name = "tracing_read_pipe",
++ .file = "kernel/trace/trace.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001365_hash = {
++ .next = NULL,
++ .name = "capi_write",
++ .file = "drivers/isdn/capi/capi.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001366_hash = {
++ .next = NULL,
++ .name = "compat_sys_move_pages",
++ .file = "include/linux/compat.h",
++ .param2 = 1,
++};
++
++struct size_overflow_hash _001367_hash = {
++ .next = NULL,
++ .name = "cpia_write_proc",
++ .file = "drivers/media/video/cpia.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001368_hash = {
++ .next = NULL,
++ .name = "ipath_get_base_info",
++ .file = "drivers/infiniband/hw/ipath/ipath_file_ops.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001369_hash = {
++ .next = NULL,
++ .name = "options_write",
++ .file = "drivers/misc/sgi-gru/gruprocfs.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001370_hash = {
++ .next = NULL,
++ .name = "um_idi_write",
++ .file = "drivers/isdn/hardware/eicon/divasi.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash _001371_hash = {
++ .next = NULL,
++ .name = "uv_ptc_proc_write",
++ .file = "arch/x86/kernel/tlb_uv.c",
++ .param3 = 1,
++};
++
++struct size_overflow_hash *size_overflow_hash[65536] = {
++ [51363] = &_000001_hash,
++ [20847] = &_000002_hash,
++ [56878] = &_000003_hash,
++ [11151] = &_000004_hash,
++ [4132] = &_000005_hash,
++ [39070] = &_000006_hash,
++ [35447] = &_000008_hash,
++ [47830] = &_000009_hash,
++ [17521] = &_000010_hash,
++ [62174] = &_000011_hash,
++ [41425] = &_000012_hash,
++ [5785] = &_000013_hash,
++ [19960] = &_000014_hash,
++ [26729] = &_000015_hash,
++ [22403] = &_000016_hash,
++ [23258] = &_000017_hash,
++ [55695] = &_000018_hash,
++ [38964] = &_000019_hash,
++ [42680] = &_000020_hash,
++ [28541] = &_000021_hash,
++ [33165] = &_000022_hash,
++ [22394] = &_000023_hash,
++ [49562] = &_000024_hash,
++ [56881] = &_000025_hash,
++ [13870] = &_000026_hash,
++ [11553] = &_000027_hash,
++ [31825] = &_000028_hash,
++ [53378] = &_000029_hash,
++ [62101] = &_000030_hash,
++ [18152] = &_000031_hash,
++ [43692] = &_000032_hash,
++ [37525] = &_000033_hash,
++ [11925] = &_000034_hash,
++ [20558] = &_000035_hash,
++ [44019] = &_000036_hash,
++ [17854] = &_000037_hash,
++ [17830] = &_000038_hash,
++ [34918] = &_000039_hash,
++ [46839] = &_000040_hash,
++ [57930] = &_000041_hash,
++ [65005] = &_000042_hash,
++ [49567] = &_000043_hash,
++ [61874] = &_000044_hash,
++ [22591] = &_000045_hash,
++ [8743] = &_000046_hash,
++ [47136] = &_000047_hash,
++ [6358] = &_000048_hash,
++ [65254] = &_000049_hash,
++ [34878] = &_000051_hash,
++ [49340] = &_000052_hash,
++ [4863] = &_000053_hash,
++ [46220] = &_000054_hash,
++ [20455] = &_000055_hash,
++ [19917] = &_000057_hash,
++ [25140] = &_000058_hash,
++ [34097] = &_000059_hash,
++ [30319] = &_000060_hash,
++ [58131] = &_000061_hash,
++ [9234] = &_000062_hash,
++ [33309] = &_000063_hash,
++ [56319] = &_000064_hash,
++ [21496] = &_000065_hash,
++ [32154] = &_000066_hash,
++ [38330] = &_000067_hash,
++ [30892] = &_000068_hash,
++ [61067] = &_000070_hash,
++ [16496] = &_000071_hash,
++ [40012] = &_000072_hash,
++ [46014] = &_000073_hash,
++ [39600] = &_000074_hash,
++ [32447] = &_000076_hash,
++ [15439] = &_000077_hash,
++ [17932] = &_000078_hash,
++ [26096] = &_000079_hash,
++ [50814] = &_000080_hash,
++ [22598] = &_000081_hash,
++ [48287] = &_000082_hash,
++ [15611] = &_000083_hash,
++ [20304] = &_000084_hash,
++ [54866] = &_000085_hash,
++ [40395] = &_000086_hash,
++ [24124] = &_000087_hash,
++ [63535] = &_000088_hash,
++ [26678] = &_000089_hash,
++ [64800] = &_000090_hash,
++ [14919] = &_000091_hash,
++ [19929] = &_000092_hash,
++ [65246] = &_000094_hash,
++ [43222] = &_000095_hash,
++ [63488] = &_000096_hash,
++ [17984] = &_000097_hash,
++ [26811] = &_000098_hash,
++ [30848] = &_000099_hash,
++ [59960] = &_000100_hash,
++ [19168] = &_000101_hash,
++ [8885] = &_000102_hash,
++ [15627] = &_000103_hash,
++ [59140] = &_000104_hash,
++ [24633] = &_000105_hash,
++ [21622] = &_000106_hash,
++ [803] = &_000107_hash,
++ [21909] = &_000111_hash,
++ [63679] = &_000112_hash,
++ [57538] = &_000113_hash,
++ [14329] = &_000114_hash,
++ [42442] = &_000115_hash,
++ [23031] = &_000116_hash,
++ [40663] = &_000117_hash,
++ [31235] = &_000118_hash,
++ [48207] = &_000119_hash,
++ [51180] = &_000120_hash,
++ [41364] = &_000121_hash,
++ [24173] = &_000122_hash,
++ [18248] = &_000123_hash,
++ [27992] = &_000124_hash,
++ [9286] = &_000125_hash,
++ [49517] = &_000126_hash,
++ [4732] = &_000129_hash,
++ [36031] = &_000130_hash,
++ [33469] = &_000131_hash,
++ [38783] = &_000132_hash,
++ [19672] = &_000133_hash,
++ [39565] = &_000134_hash,
++ [21877] = &_000135_hash,
++ [21498] = &_000136_hash,
++ [53059] = &_000137_hash,
++ [46645] = &_000139_hash,
++ [37308] = &_000141_hash,
++ [59973] = &_000142_hash,
++ [35895] = &_000143_hash,
++ [13332] = &_000144_hash,
++ [3070] = &_000145_hash,
++ [36665] = &_000146_hash,
++ [12413] = &_000147_hash,
++ [27279] = &_000148_hash,
++ [61023] = &_000149_hash,
++ [44774] = &_000150_hash,
++ [14479] = &_000151_hash,
++ [45702] = &_000152_hash,
++ [5533] = &_000153_hash,
++ [29186] = &_000154_hash,
++ [26311] = &_000155_hash,
++ [40182] = &_000156_hash,
++ [50505] = &_000157_hash,
++ [59061] = &_000158_hash,
++ [40371] = &_000159_hash,
++ [6293] = &_000160_hash,
++ [60587] = &_000161_hash,
++ [8181] = &_000162_hash,
++ [27451] = &_000163_hash,
++ [49699] = &_000164_hash,
++ [41172] = &_000165_hash,
++ [3315] = &_000166_hash,
++ [37550] = &_000167_hash,
++ [6678] = &_000168_hash,
++ [54861] = &_000169_hash,
++ [38306] = &_000170_hash,
++ [14153] = &_000171_hash,
++ [23065] = &_000172_hash,
++ [18156] = &_000173_hash,
++ [18418] = &_000174_hash,
++ [50241] = &_000175_hash,
++ [22498] = &_000176_hash,
++ [10991] = &_000177_hash,
++ [40026] = &_000178_hash,
++ [30445] = &_000179_hash,
++ [57691] = &_000180_hash,
++ [45647] = &_000181_hash,
++ [52008] = &_000182_hash,
++ [58758] = &_000183_hash,
++ [18393] = &_000184_hash,
++ [29375] = &_000186_hash,
++ [37192] = &_000187_hash,
++ [27286] = &_000188_hash,
++ [11860] = &_000190_hash,
++ [52928] = &_000191_hash,
++ [46714] = &_000192_hash,
++ [45873] = &_000193_hash,
++ [22271] = &_000194_hash,
++ [46247] = &_000195_hash,
++ [33246] = &_000196_hash,
++ [58508] = &_000197_hash,
++ [47399] = &_000201_hash,
++ [20494] = &_000202_hash,
++ [9483] = &_000203_hash,
++ [20854] = &_000204_hash,
++ [52341] = &_000205_hash,
++ [44884] = &_000206_hash,
++ [53533] = &_000207_hash,
++ [52267] = &_000208_hash,
++ [4065] = &_000209_hash,
++ [2115] = &_000210_hash,
++ [44017] = &_000212_hash,
++ [24951] = &_000213_hash,
++ [13495] = &_000214_hash,
++ [12988] = &_000215_hash,
++ [55227] = &_000216_hash,
++ [47762] = &_000218_hash,
++ [23349] = &_000219_hash,
++ [17613] = &_000220_hash,
++ [5943] = &_000221_hash,
++ [51344] = &_000222_hash,
++ [39714] = &_000223_hash,
++ [52037] = &_000224_hash,
++ [53757] = &_000225_hash,
++ [5994] = &_000226_hash,
++ [13467] = &_000227_hash,
++ [55732] = &_000228_hash,
++ [19995] = &_000229_hash,
++ [51694] = &_000230_hash,
++ [18402] = &_000231_hash,
++ [25256] = &_000232_hash,
++ [5456] = &_000233_hash,
++ [58261] = &_000234_hash,
++ [24792] = &_000235_hash,
++ [39989] = &_000236_hash,
++ [55340] = &_000237_hash,
++ [52501] = &_000238_hash,
++ [12475] = &_000239_hash,
++ [52921] = &_000240_hash,
++ [19120] = &_000241_hash,
++ [14355] = &_000242_hash,
++ [30563] = &_000243_hash,
++ [57776] = &_000244_hash,
++ [21956] = &_000245_hash,
++ [47450] = &_000246_hash,
++ [44818] = &_000247_hash,
++ [50616] = &_000248_hash,
++ [51238] = &_000249_hash,
++ [49299] = &_000250_hash,
++ [2796] = &_000251_hash,
++ [4190] = &_000252_hash,
++ [11548] = &_000253_hash,
++ [60370] = &_000254_hash,
++ [35863] = &_000255_hash,
++ [31869] = &_000256_hash,
++ [54595] = &_000257_hash,
++ [2808] = &_000258_hash,
++ [24656] = &_000259_hash,
++ [895] = &_000260_hash,
++ [32809] = &_000261_hash,
++ [55621] = &_000262_hash,
++ [1733] = &_000263_hash,
++ [46740] = &_000264_hash,
++ [36069] = &_000265_hash,
++ [26020] = &_000266_hash,
++ [63875] = &_000267_hash,
++ [58608] = &_000268_hash,
++ [8919] = &_000269_hash,
++ [59497] = &_000270_hash,
++ [34782] = &_000271_hash,
++ [40998] = &_000272_hash,
++ [33328] = &_000273_hash,
++ [17866] = &_000274_hash,
++ [38741] = &_000275_hash,
++ [53939] = &_000276_hash,
++ [14658] = &_000277_hash,
++ [42465] = &_000278_hash,
++ [43616] = &_000279_hash,
++ [46818] = &_000280_hash,
++ [16775] = &_000281_hash,
++ [41393] = &_000282_hash,
++ [10532] = &_000283_hash,
++ [50366] = &_000284_hash,
++ [33324] = &_000285_hash,
++ [58154] = &_000286_hash,
++ [38200] = &_000287_hash,
++ [59315] = &_000288_hash,
++ [22017] = &_000289_hash,
++ [34248] = &_000290_hash,
++ [27251] = &_000291_hash,
++ [7461] = &_000292_hash,
++ [44596] = &_000293_hash,
++ [45157] = &_000294_hash,
++ [55069] = &_000295_hash,
++ [29452] = &_000296_hash,
++ [31885] = &_000297_hash,
++ [20325] = &_000298_hash,
++ [18158] = &_000299_hash,
++ [55856] = &_000300_hash,
++ [36032] = &_000301_hash,
++ [52057] = &_000302_hash,
++ [12463] = &_000303_hash,
++ [30616] = &_000304_hash,
++ [12231] = &_000305_hash,
++ [53530] = &_000306_hash,
++ [32388] = &_000307_hash,
++ [16183] = &_000308_hash,
++ [12977] = &_000309_hash,
++ [58677] = &_000310_hash,
++ [11812] = &_000311_hash,
++ [1122] = &_000312_hash,
++ [31013] = &_000313_hash,
++ [42591] = &_000314_hash,
++ [58348] = &_000315_hash,
++ [11595] = &_000316_hash,
++ [15277] = &_000317_hash,
++ [4811] = &_000318_hash,
++ [34231] = &_000319_hash,
++ [42017] = &_000320_hash,
++ [17504] = &_000321_hash,
++ [3089] = &_000322_hash,
++ [46548] = &_000325_hash,
++ [64933] = &_000326_hash,
++ [42300] = &_000327_hash,
++ [60749] = &_000328_hash,
++ [16865] = &_000329_hash,
++ [2448] = &_000330_hash,
++ [11365] = &_000331_hash,
++ [25620] = &_000332_hash,
++ [32935] = &_000333_hash,
++ [60193] = &_000335_hash,
++ [14396] = &_000336_hash,
++ [46395] = &_000337_hash,
++ [24339] = &_000338_hash,
++ [41996] = &_000339_hash,
++ [7371] = &_000340_hash,
++ [59633] = &_000341_hash,
++ [55203] = &_000342_hash,
++ [16534] = &_000344_hash,
++ [21401] = &_000345_hash,
++ [20788] = &_000346_hash,
++ [39232] = &_000347_hash,
++ [60778] = &_000348_hash,
++ [1442] = &_000349_hash,
++ [18162] = &_000350_hash,
++ [65006] = &_000351_hash,
++ [11523] = &_000352_hash,
++ [29207] = &_000353_hash,
++ [18071] = &_000354_hash,
++ [7601] = &_000355_hash,
++ [26260] = &_000356_hash,
++ [63065] = &_000357_hash,
++ [18949] = &_000358_hash,
++ [29070] = &_000359_hash,
++ [29891] = &_000360_hash,
++ [41916] = &_000361_hash,
++ [40474] = &_000362_hash,
++ [63551] = &_000363_hash,
++ [11488] = &_000364_hash,
++ [36934] = &_000365_hash,
++ [63193] = &_000366_hash,
++ [17219] = &_000367_hash,
++ [64306] = &_000368_hash,
++ [24071] = &_000369_hash,
++ [50308] = &_000370_hash,
++ [38790] = &_000371_hash,
++ [9838] = &_000372_hash,
++ [18983] = &_000373_hash,
++ [9656] = &_000374_hash,
++ [18950] = &_000375_hash,
++ [59749] = &_000376_hash,
++ [20465] = &_000377_hash,
++ [4765] = &_000378_hash,
++ [16169] = &_000379_hash,
++ [6930] = &_000380_hash,
++ [16926] = &_000381_hash,
++ [35218] = &_000382_hash,
++ [19956] = &_000383_hash,
++ [2133] = &_000384_hash,
++ [44616] = &_000385_hash,
++ [12840] = &_000386_hash,
++ [39020] = &_000387_hash,
++ [4269] = &_000389_hash,
++ [37627] = &_000391_hash,
++ [33555] = &_000392_hash,
++ [25900] = &_000393_hash,
++ [57927] = &_000394_hash,
++ [44626] = &_000396_hash,
++ [57935] = &_000397_hash,
++ [63266] = &_000398_hash,
++ [36063] = &_000399_hash,
++ [21379] = &_000400_hash,
++ [18507] = &_000401_hash,
++ [55719] = &_000402_hash,
++ [31210] = &_000403_hash,
++ [36207] = &_000404_hash,
++ [41770] = &_000405_hash,
++ [11600] = &_000406_hash,
++ [25576] = &_000407_hash,
++ [7000] = &_000408_hash,
++ [34187] = &_000409_hash,
++ [58533] = &_000410_hash,
++ [1135] = &_000412_hash,
++ [25613] = &_000413_hash,
++ [9541] = &_000414_hash,
++ [49704] = &_000415_hash,
++ [30577] = &_000416_hash,
++ [35722] = &_000417_hash,
++ [60407] = &_000418_hash,
++ [29465] = &_000419_hash,
++ [46891] = &_000420_hash,
++ [43633] = &_000421_hash,
++ [16196] = &_000422_hash,
++ [9646] = &_000424_hash,
++ [59756] = &_000426_hash,
++ [36702] = &_000427_hash,
++ [52476] = &_000428_hash,
++ [57303] = &_000429_hash,
++ [36747] = &_000430_hash,
++ [33643] = &_000431_hash,
++ [29158] = &_000432_hash,
++ [7978] = &_000433_hash,
++ [25178] = &_000434_hash,
++ [54107] = &_000435_hash,
++ [4829] = &_000436_hash,
++ [20972] = &_000437_hash,
++ [51826] = &_000438_hash,
++ [16413] = &_000439_hash,
++ [39712] = &_000440_hash,
++ [35828] = &_000441_hash,
++ [3106] = &_000442_hash,
++ [34039] = &_000443_hash,
++ [61686] = &_000444_hash,
++ [42407] = &_000445_hash,
++ [6253] = &_000446_hash,
++ [32195] = &_000447_hash,
++ [26197] = &_000448_hash,
++ [58003] = &_000449_hash,
++ [41052] = &_000450_hash,
++ [43632] = &_000451_hash,
++ [12029] = &_000452_hash,
++ [23280] = &_000453_hash,
++ [22834] = &_000454_hash,
++ [4419] = &_000455_hash,
++ [27957] = &_000456_hash,
++ [9540] = &_000457_hash,
++ [27106] = &_000458_hash,
++ [8595] = &_000459_hash,
++ [39979] = &_000462_hash,
++ [41540] = &_000463_hash,
++ [43200] = &_000465_hash,
++ [53864] = &_000466_hash,
++ [33494] = &_000467_hash,
++ [25042] = &_000468_hash,
++ [30281] = &_000469_hash,
++ [38112] = &_000470_hash,
++ [46538] = &_000471_hash,
++ [62594] = &_000472_hash,
++ [8339] = &_000473_hash,
++ [45349] = &_000474_hash,
++ [37865] = &_000475_hash,
++ [45763] = &_000476_hash,
++ [62347] = &_000477_hash,
++ [21644] = &_000478_hash,
++ [18719] = &_000479_hash,
++ [43138] = &_000481_hash,
++ [25654] = &_000482_hash,
++ [60014] = &_000483_hash,
++ [11697] = &_000484_hash,
++ [41271] = &_000485_hash,
++ [48356] = &_000486_hash,
++ [27003] = &_000487_hash,
++ [32464] = &_000488_hash,
++ [44248] = &_000490_hash,
++ [16] = &_000491_hash,
++ [29933] = &_000492_hash,
++ [34359] = &_000493_hash,
++ [3154] = &_000494_hash,
++ [23959] = &_000495_hash,
++ [6724] = &_000496_hash,
++ [54587] = &_000497_hash,
++ [28479] = &_000498_hash,
++ [56583] = &_000499_hash,
++ [64644] = &_000500_hash,
++ [23284] = &_000501_hash,
++ [58325] = &_000502_hash,
++ [61655] = &_000503_hash,
++ [32147] = &_000504_hash,
++ [25649] = &_000505_hash,
++ [47428] = &_000506_hash,
++ [47737] = &_000507_hash,
++ [2987] = &_000508_hash,
++ [34901] = &_000509_hash,
++ [49188] = &_000510_hash,
++ [11582] = &_000511_hash,
++ [25935] = &_000512_hash,
++ [13561] = &_000513_hash,
++ [31880] = &_000514_hash,
++ [47768] = &_000515_hash,
++ [62185] = &_000516_hash,
++ [18341] = &_000517_hash,
++ [4052] = &_000518_hash,
++ [1033] = &_000519_hash,
++ [19576] = &_000520_hash,
++ [48846] = &_000521_hash,
++ [63167] = &_000522_hash,
++ [37223] = &_000523_hash,
++ [55574] = &_000524_hash,
++ [13831] = &_000525_hash,
++ [32374] = &_000526_hash,
++ [56078] = &_000527_hash,
++ [65337] = &_000528_hash,
++ [19329] = &_000529_hash,
++ [61088] = &_000530_hash,
++ [34661] = &_000531_hash,
++ [49367] = &_000532_hash,
++ [64731] = &_000533_hash,
++ [23777] = &_000534_hash,
++ [53828] = &_000535_hash,
++ [59115] = &_000536_hash,
++ [4456] = &_000537_hash,
++ [53442] = &_000538_hash,
++ [17500] = &_000539_hash,
++ [47329] = &_000540_hash,
++ [13534] = &_000541_hash,
++ [36955] = &_000542_hash,
++ [9841] = &_000543_hash,
++ [19308] = &_000544_hash,
++ [55652] = &_000545_hash,
++ [7842] = &_000546_hash,
++ [33485] = &_000547_hash,
++ [50750] = &_000548_hash,
++ [44599] = &_000549_hash,
++ [46403] = &_000550_hash,
++ [303] = &_000551_hash,
++ [22960] = &_000552_hash,
++ [10544] = &_000553_hash,
++ [7694] = &_000554_hash,
++ [62082] = &_000555_hash,
++ [57054] = &_000556_hash,
++ [51909] = &_000558_hash,
++ [52239] = &_000559_hash,
++ [24125] = &_000560_hash,
++ [60221] = &_000563_hash,
++ [38542] = &_000564_hash,
++ [45071] = &_000565_hash,
++ [23450] = &_000566_hash,
++ [14295] = &_000567_hash,
++ [25923] = &_000568_hash,
++ [31865] = &_000569_hash,
++ [4764] = &_000570_hash,
++ [10574] = &_000571_hash,
++ [26141] = &_000572_hash,
++ [55766] = &_000573_hash,
++ [22483] = &_000574_hash,
++ [61047] = &_000575_hash,
++ [58978] = &_000576_hash,
++ [47578] = &_000577_hash,
++ [7730] = &_000578_hash,
++ [15904] = &_000579_hash,
++ [25081] = &_000580_hash,
++ [45743] = &_000581_hash,
++ [58830] = &_000582_hash,
++ [59081] = &_000583_hash,
++ [47533] = &_000584_hash,
++ [11305] = &_000585_hash,
++ [56290] = &_000586_hash,
++ [44963] = &_000587_hash,
++ [30026] = &_000588_hash,
++ [56424] = &_000589_hash,
++ [27694] = &_000590_hash,
++ [38583] = &_000591_hash,
++ [20939] = &_000592_hash,
++ [17486] = &_000593_hash,
++ [52548] = &_000594_hash,
++ [18733] = &_000595_hash,
++ [54359] = &_000597_hash,
++ [39434] = &_000598_hash,
++ [3079] = &_000599_hash,
++ [47614] = &_000600_hash,
++ [38186] = &_000601_hash,
++ [10078] = &_000602_hash,
++ [17088] = &_000603_hash,
++ [2737] = &_000604_hash,
++ [13257] = &_000605_hash,
++ [31672] = &_000606_hash,
++ [21293] = &_000607_hash,
++ [7004] = &_000608_hash,
++ [45825] = &_000609_hash,
++ [64368] = &_000610_hash,
++ [11872] = &_000611_hash,
++ [26129] = &_000612_hash,
++ [23921] = &_000613_hash,
++ [5376] = &_000614_hash,
++ [16647] = &_000615_hash,
++ [2422] = &_000616_hash,
++ [44177] = &_000617_hash,
++ [58592] = &_000618_hash,
++ [45474] = &_000619_hash,
++ [63955] = &_000620_hash,
++ [10011] = &_000621_hash,
++ [28522] = &_000622_hash,
++ [44081] = &_000623_hash,
++ [58432] = &_000624_hash,
++ [1994] = &_000625_hash,
++ [20411] = &_000626_hash,
++ [14958] = &_000627_hash,
++ [29215] = &_000628_hash,
++ [42546] = &_000629_hash,
++ [60995] = &_000630_hash,
++ [21469] = &_000631_hash,
++ [7084] = &_000632_hash,
++ [44184] = &_000633_hash,
++ [58601] = &_000634_hash,
++ [32802] = &_000635_hash,
++ [51283] = &_000636_hash,
++ [21432] = &_000637_hash,
++ [7113] = &_000638_hash,
++ [57063] = &_000639_hash,
++ [5800] = &_000640_hash,
++ [45617] = &_000641_hash,
++ [32049] = &_000642_hash,
++ [53922] = &_000643_hash,
++ [49155] = &_000644_hash,
++ [17299] = &_000645_hash,
++ [37940] = &_000646_hash,
++ [31594] = &_000647_hash,
++ [38151] = &_000648_hash,
++ [58827] = &_000649_hash,
++ [34245] = &_000650_hash,
++ [15613] = &_000651_hash,
++ [16046] = &_000652_hash,
++ [50172] = &_000653_hash,
++ [26107] = &_000654_hash,
++ [60543] = &_000655_hash,
++ [56337] = &_000656_hash,
++ [24409] = &_000657_hash,
++ [11732] = &_000658_hash,
++ [65519] = &_000659_hash,
++ [55865] = &_000660_hash,
++ [51480] = &_000661_hash,
++ [2061] = &_000662_hash,
++ [10885] = &_000663_hash,
++ [45913] = &_000664_hash,
++ [8892] = &_000665_hash,
++ [64891] = &_000666_hash,
++ [64537] = &_000667_hash,
++ [55518] = &_000668_hash,
++ [23343] = &_000669_hash,
++ [40783] = &_000670_hash,
++ [24527] = &_000672_hash,
++ [27419] = &_000673_hash,
++ [16439] = &_000674_hash,
++ [13869] = &_000675_hash,
++ [53150] = &_000676_hash,
++ [2884] = &_000677_hash,
++ [37954] = &_000678_hash,
++ [10362] = &_000679_hash,
++ [40083] = &_000680_hash,
++ [60499] = &_000681_hash,
++ [62810] = &_000682_hash,
++ [24682] = &_000683_hash,
++ [61793] = &_000684_hash,
++ [53395] = &_000685_hash,
++ [5519] = &_000686_hash,
++ [28637] = &_000687_hash,
++ [51689] = &_000688_hash,
++ [6783] = &_000689_hash,
++ [43312] = &_000690_hash,
++ [2373] = &_000691_hash,
++ [33482] = &_000692_hash,
++ [24886] = &_000693_hash,
++ [12838] = &_000694_hash,
++ [47012] = &_000695_hash,
++ [23691] = &_000696_hash,
++ [37924] = &_000697_hash,
++ [60399] = &_000698_hash,
++ [2312] = &_000699_hash,
++ [10805] = &_000700_hash,
++ [33996] = &_000701_hash,
++ [40856] = &_000702_hash,
++ [63446] = &_000703_hash,
++ [31205] = &_000704_hash,
++ [33100] = &_000705_hash,
++ [40843] = &_000706_hash,
++ [9845] = &_000707_hash,
++ [42227] = &_000708_hash,
++ [13114] = &_000709_hash,
++ [31563] = &_000710_hash,
++ [46922] = &_000711_hash,
++ [65339] = &_000712_hash,
++ [17658] = &_000713_hash,
++ [56374] = &_000714_hash,
++ [2434] = &_000715_hash,
++ [41487] = &_000716_hash,
++ [56728] = &_000717_hash,
++ [48150] = &_000718_hash,
++ [21221] = &_000719_hash,
++ [13905] = &_000720_hash,
++ [9054] = &_000721_hash,
++ [26108] = &_000722_hash,
++ [56819] = &_000723_hash,
++ [56038] = &_000724_hash,
++ [58328] = &_000725_hash,
++ [18609] = &_000726_hash,
++ [64412] = &_000727_hash,
++ [33020] = &_000728_hash,
++ [22639] = &_000729_hash,
++ [6453] = &_000730_hash,
++ [58692] = &_000731_hash,
++ [56471] = &_000732_hash,
++ [3589] = &_000733_hash,
++ [18936] = &_000734_hash,
++ [12558] = &_000735_hash,
++ [3201] = &_000736_hash,
++ [28175] = &_000738_hash,
++ [43888] = &_000740_hash,
++ [32456] = &_000741_hash,
++ [29036] = &_000742_hash,
++ [25603] = &_000743_hash,
++ [17675] = &_000744_hash,
++ [36271] = &_000745_hash,
++ [49814] = &_000746_hash,
++ [51009] = &_000747_hash,
++ [62835] = &_000748_hash,
++ [27139] = &_000749_hash,
++ [17186] = &_000750_hash,
++ [64437] = &_000751_hash,
++ [46825] = &_000752_hash,
++ [31408] = &_000754_hash,
++ [5396] = &_000755_hash,
++ [62247] = &_000756_hash,
++ [7946] = &_000757_hash,
++ [783] = &_000758_hash,
++ [7141] = &_000759_hash,
++ [7083] = &_000760_hash,
++ [15618] = &_000761_hash,
++ [61225] = &_000762_hash,
++ [13163] = &_000763_hash,
++ [8719] = &_000764_hash,
++ [8539] = &_000765_hash,
++ [23949] = &_000766_hash,
++ [32336] = &_000767_hash,
++ [62829] = &_000768_hash,
++ [1238] = &_000769_hash,
++ [8174] = &_000770_hash,
++ [6368] = &_000771_hash,
++ [29170] = &_000772_hash,
++ [9687] = &_000773_hash,
++ [61116] = &_000774_hash,
++ [31681] = &_000775_hash,
++ [22119] = &_000776_hash,
++ [59885] = &_000777_hash,
++ [47789] = &_000778_hash,
++ [5796] = &_000779_hash,
++ [34900] = &_000780_hash,
++ [49189] = &_000781_hash,
++ [48255] = &_000782_hash,
++ [62478] = &_000783_hash,
++ [34446] = &_000784_hash,
++ [52991] = &_000785_hash,
++ [38848] = &_000786_hash,
++ [57265] = &_000787_hash,
++ [11660] = &_000788_hash,
++ [26109] = &_000789_hash,
++ [43762] = &_000790_hash,
++ [57987] = &_000791_hash,
++ [23466] = &_000792_hash,
++ [5083] = &_000793_hash,
++ [1272] = &_000794_hash,
++ [10199] = &_000795_hash,
++ [34666] = &_000796_hash,
++ [49317] = &_000797_hash,
++ [18604] = &_000798_hash,
++ [61509] = &_000799_hash,
++ [36247] = &_000800_hash,
++ [41223] = &_000801_hash,
++ [59766] = &_000802_hash,
++ [34483] = &_000803_hash,
++ [52930] = &_000804_hash,
++ [40728] = &_000805_hash,
++ [55145] = &_000806_hash,
++ [45581] = &_000807_hash,
++ [64124] = &_000808_hash,
++ [48878] = &_000809_hash,
++ [63135] = &_000810_hash,
++ [40381] = &_000811_hash,
++ [54732] = &_000812_hash,
++ [45881] = &_000813_hash,
++ [64328] = &_000814_hash,
++ [22326] = &_000815_hash,
++ [8007] = &_000816_hash,
++ [23579] = &_000817_hash,
++ [5226] = &_000818_hash,
++ [12120] = &_000819_hash,
++ [26409] = &_000820_hash,
++ [14269] = &_000821_hash,
++ [32716] = &_000822_hash,
++ [48351] = &_000823_hash,
++ [62638] = &_000824_hash,
++ [33406] = &_000825_hash,
++ [51727] = &_000826_hash,
++ [51386] = &_000827_hash,
++ [58061] = &_000828_hash,
++ [57198] = &_000829_hash,
++ [30748] = &_000830_hash,
++ [60403] = &_000831_hash,
++ [24980] = &_000832_hash,
++ [55896] = &_000833_hash,
++ [57055] = &_000834_hash,
++ [46010] = &_000835_hash,
++ [59996] = &_000836_hash,
++ [45219] = &_000837_hash,
++ [14813] = &_000838_hash,
++ [29240] = &_000839_hash,
++ [42270] = &_000840_hash,
++ [46226] = &_000841_hash,
++ [24710] = &_000842_hash,
++ [51438] = &_000843_hash,
++ [22071] = &_000844_hash,
++ [49735] = &_000845_hash,
++ [63925] = &_000846_hash,
++ [30902] = &_000847_hash,
++ [53089] = &_000848_hash,
++ [18110] = &_000849_hash,
++ [34515] = &_000850_hash,
++ [19756] = &_000851_hash,
++ [5116] = &_000852_hash,
++ [50702] = &_000853_hash,
++ [59565] = &_000854_hash,
++ [61042] = &_000855_hash,
++ [14533] = &_000856_hash,
++ [23006] = &_000857_hash,
++ [4527] = &_000858_hash,
++ [8808] = &_000859_hash,
++ [52383] = &_000860_hash,
++ [30487] = &_000861_hash,
++ [30125] = &_000862_hash,
++ [33237] = &_000863_hash,
++ [40673] = &_000864_hash,
++ [48026] = &_000865_hash,
++ [64033] = &_000866_hash,
++ [13879] = &_000867_hash,
++ [60114] = &_000868_hash,
++ [19472] = &_000869_hash,
++ [33552] = &_000870_hash,
++ [19742] = &_000871_hash,
++ [3675] = &_000872_hash,
++ [15488] = &_000873_hash,
++ [29937] = &_000874_hash,
++ [12146] = &_000875_hash,
++ [26371] = &_000876_hash,
++ [27112] = &_000877_hash,
++ [8601] = &_000878_hash,
++ [1365] = &_000879_hash,
++ [19748] = &_000880_hash,
++ [46546] = &_000881_hash,
++ [64931] = &_000882_hash,
++ [34551] = &_000883_hash,
++ [52870] = &_000884_hash,
++ [17725] = &_000885_hash,
++ [3404] = &_000886_hash,
++ [36863] = &_000887_hash,
++ [51086] = &_000888_hash,
++ [11683] = &_000889_hash,
++ [26066] = &_000890_hash,
++ [39708] = &_000891_hash,
++ [54125] = &_000892_hash,
++ [20700] = &_000893_hash,
++ [6317] = &_000894_hash,
++ [14495] = &_000895_hash,
++ [28910] = &_000896_hash,
++ [18261] = &_000897_hash,
++ [3876] = &_000898_hash,
++ [58057] = &_000899_hash,
++ [29208] = &_000900_hash,
++ [18591] = &_000901_hash,
++ [24373] = &_000902_hash,
++ [45487] = &_000903_hash,
++ [29299] = &_000904_hash,
++ [53920] = &_000905_hash,
++ [25407] = &_000906_hash,
++ [5525] = &_000907_hash,
++ [3531] = &_000908_hash,
++ [25143] = &_000909_hash,
++ [56046] = &_000910_hash,
++ [34693] = &_000911_hash,
++ [48644] = &_000912_hash,
++ [21226] = &_000913_hash,
++ [14051] = &_000914_hash,
++ [7715] = &_000915_hash,
++ [30413] = &_000916_hash,
++ [13681] = &_000917_hash,
++ [6554] = &_000918_hash,
++ [12228] = &_000919_hash,
++ [25497] = &_000920_hash,
++ [52228] = &_000921_hash,
++ [51997] = &_000922_hash,
++ [49069] = &_000923_hash,
++ [26961] = &_000924_hash,
++ [13768] = &_000925_hash,
++ [41838] = &_000926_hash,
++ [3112] = &_000927_hash,
++ [48323] = &_000928_hash,
++ [47783] = &_000929_hash,
++ [62001] = &_000930_hash,
++ [35888] = &_000931_hash,
++ [752] = &_000933_hash,
++ [54718] = &_000934_hash,
++ [64177] = &_000935_hash,
++ [57222] = &_000936_hash,
++ [5260] = &_000938_hash,
++ [55517] = &_000939_hash,
++ [18186] = &_000940_hash,
++ [14257] = &_000941_hash,
++ [24596] = &_000942_hash,
++ [5968] = &_000943_hash,
++ [26846] = &_000944_hash,
++ [56097] = &_000945_hash,
++ [6543] = &_000946_hash,
++ [55151] = &_000947_hash,
++ [2999] = &_000949_hash,
++ [3602] = &_000951_hash,
++ [18460] = &_000952_hash,
++ [16521] = &_000953_hash,
++ [16745] = &_000954_hash,
++ [3507] = &_000955_hash,
++ [46802] = &_000956_hash,
++ [58077] = &_000957_hash,
++ [39846] = &_000958_hash,
++ [18629] = &_000959_hash,
++ [2723] = &_000960_hash,
++ [45230] = &_000961_hash,
++ [26941] = &_000962_hash,
++ [4344] = &_000963_hash,
++ [64674] = &_000964_hash,
++ [42551] = &_000965_hash,
++ [63272] = &_000966_hash,
++ [28261] = &_000967_hash,
++ [44694] = &_000968_hash,
++ [8573] = &_000969_hash,
++ [60174] = &_000970_hash,
++ [58458] = &_000971_hash,
++ [98] = &_000972_hash,
++ [47550] = &_000973_hash,
++ [10726] = &_000974_hash,
++ [11965] = &_000975_hash,
++ [38726] = &_000976_hash,
++ [41390] = &_000977_hash,
++ [55348] = &_000978_hash,
++ [28209] = &_000979_hash,
++ [45394] = &_000980_hash,
++ [26613] = &_000981_hash,
++ [29383] = &_000982_hash,
++ [34016] = &_000983_hash,
++ [39519] = &_000984_hash,
++ [27509] = &_000985_hash,
++ [57424] = &_000986_hash,
++ [26695] = &_000987_hash,
++ [21997] = &_000988_hash,
++ [22200] = &_000989_hash,
++ [60666] = &_000990_hash,
++ [22124] = &_000991_hash,
++ [1832] = &_000992_hash,
++ [25283] = &_000993_hash,
++ [10045] = &_000994_hash,
++ [30083] = &_000995_hash,
++ [45719] = &_000996_hash,
++ [3852] = &_000997_hash,
++ [38455] = &_000998_hash,
++ [43361] = &_000999_hash,
++ [52769] = &_001000_hash,
++ [14854] = &_001001_hash,
++ [38176] = &_001002_hash,
++ [29063] = &_001003_hash,
++ [4059] = &_001004_hash,
++ [54060] = &_001005_hash,
++ [4141] = &_001006_hash,
++ [33096] = &_001007_hash,
++ [2417] = &_001008_hash,
++ [1291] = &_001009_hash,
++ [14270] = &_001010_hash,
++ [38500] = &_001011_hash,
++ [2681] = &_001012_hash,
++ [50905] = &_001013_hash,
++ [8021] = &_001014_hash,
++ [6895] = &_001015_hash,
++ [15209] = &_001016_hash,
++ [62825] = &_001017_hash,
++ [10145] = &_001018_hash,
++ [10997] = &_001019_hash,
++ [48159] = &_001020_hash,
++ [2509] = &_001021_hash,
++ [47899] = &_001022_hash,
++ [25367] = &_001023_hash,
++ [44716] = &_001024_hash,
++ [55347] = &_001025_hash,
++ [14518] = &_001026_hash,
++ [33198] = &_001027_hash,
++ [23009] = &_001028_hash,
++ [22607] = &_001029_hash,
++ [13080] = &_001030_hash,
++ [54700] = &_001031_hash,
++ [10939] = &_001032_hash,
++ [25290] = &_001033_hash,
++ [38856] = &_001034_hash,
++ [57273] = &_001035_hash,
++ [2404] = &_001036_hash,
++ [64074] = &_001037_hash,
++ [7538] = &_001038_hash,
++ [19736] = &_001039_hash,
++ [8199] = &_001040_hash,
++ [40711] = &_001041_hash,
++ [47859] = &_001042_hash,
++ [53925] = &_001043_hash,
++ [37305] = &_001044_hash,
++ [18414] = &_001045_hash,
++ [62423] = &_001046_hash,
++ [30371] = &_001047_hash,
++ [14530] = &_001048_hash,
++ [48623] = &_001049_hash,
++ [36302] = &_001050_hash,
++ [12845] = &_001051_hash,
++ [24757] = &_001052_hash,
++ [54706] = &_001053_hash,
++ [27133] = &_001054_hash,
++ [64420] = &_001055_hash,
++ [25414] = &_001056_hash,
++ [64006] = &_001057_hash,
++ [11063] = &_001058_hash,
++ [45648] = &_001060_hash,
++ [21855] = &_001061_hash,
++ [54573] = &_001062_hash,
++ [48239] = &_001063_hash,
++ [18480] = &_001064_hash,
++ [37696] = &_001065_hash,
++ [32206] = &_001066_hash,
++ [42686] = &_001067_hash,
++ [6267] = &_001068_hash,
++ [22247] = &_001070_hash,
++ [9440] = &_001071_hash,
++ [54676] = &_001072_hash,
++ [53982] = &_001074_hash,
++ [41203] = &_001075_hash,
++ [21488] = &_001076_hash,
++ [61887] = &_001077_hash,
++ [7763] = &_001078_hash,
++ [37543] = &_001079_hash,
++ [17561] = &_001080_hash,
++ [63958] = &_001081_hash,
++ [28161] = &_001082_hash,
++ [57262] = &_001083_hash,
++ [61071] = &_001084_hash,
++ [20067] = &_001085_hash,
++ [34321] = &_001086_hash,
++ [38080] = &_001087_hash,
++ [56497] = &_001088_hash,
++ [16073] = &_001089_hash,
++ [30392] = &_001090_hash,
++ [14948] = &_001091_hash,
++ [29205] = &_001092_hash,
++ [12395] = &_001093_hash,
++ [30746] = &_001094_hash,
++ [27547] = &_001095_hash,
++ [42558] = &_001096_hash,
++ [61007] = &_001097_hash,
++ [37681] = &_001098_hash,
++ [56128] = &_001099_hash,
++ [22143] = &_001100_hash,
++ [52132] = &_001101_hash,
++ [38029] = &_001102_hash,
++ [64201] = &_001103_hash,
++ [55343] = &_001104_hash,
++ [40624] = &_001105_hash,
++ [38864] = &_001106_hash,
++ [22724] = &_001107_hash,
++ [43091] = &_001108_hash,
++ [33299] = &_001109_hash,
++ [9837] = &_001110_hash,
++ [26478] = &_001111_hash,
++ [57164] = &_001112_hash,
++ [38152] = &_001113_hash,
++ [18701] = &_001114_hash,
++ [5509] = &_001115_hash,
++ [39623] = &_001116_hash,
++ [53012] = &_001117_hash,
++ [50484] = &_001118_hash,
++ [59832] = &_001119_hash,
++ [17662] = &_001120_hash,
++ [25127] = &_001121_hash,
++ [54292] = &_001122_hash,
++ [30642] = &_001123_hash,
++ [39939] = &_001124_hash,
++ [34818] = &_001125_hash,
++ [11111] = &_001126_hash,
++ [64141] = &_001127_hash,
++ [20649] = &_001128_hash,
++ [58877] = &_001129_hash,
++ [13880] = &_001130_hash,
++ [54133] = &_001131_hash,
++ [21149] = &_001132_hash,
++ [62195] = &_001133_hash,
++ [14976] = &_001134_hash,
++ [52701] = &_001135_hash,
++ [29857] = &_001136_hash,
++ [49420] = &_001137_hash,
++ [45897] = &_001138_hash,
++ [15141] = &_001139_hash,
++ [24177] = &_001140_hash,
++ [35883] = &_001141_hash,
++ [51457] = &_001142_hash,
++ [1787] = &_001143_hash,
++ [10135] = &_001144_hash,
++ [952] = &_001145_hash,
++ [53578] = &_001146_hash,
++ [9923] = &_001147_hash,
++ [45249] = &_001148_hash,
++ [52860] = &_001149_hash,
++ [6681] = &_001150_hash,
++ [42360] = &_001151_hash,
++ [63619] = &_001152_hash,
++ [63988] = &_001153_hash,
++ [26378] = &_001154_hash,
++ [7768] = &_001155_hash,
++ [13738] = &_001156_hash,
++ [1480] = &_001157_hash,
++ [43806] = &_001158_hash,
++ [15976] = &_001159_hash,
++ [2732] = &_001160_hash,
++ [2519] = &_001161_hash,
++ [14340] = &_001162_hash,
++ [34772] = &_001163_hash,
++ [36433] = &_001164_hash,
++ [16068] = &_001165_hash,
++ [8929] = &_001166_hash,
++ [31814] = &_001167_hash,
++ [18246] = &_001168_hash,
++ [4932] = &_001169_hash,
++ [46960] = &_001170_hash,
++ [16909] = &_001171_hash,
++ [44429] = &_001172_hash,
++ [62760] = &_001173_hash,
++ [63230] = &_001174_hash,
++ [39532] = &_001175_hash,
++ [24688] = &_001176_hash,
++ [18555] = &_001177_hash,
++ [10719] = &_001178_hash,
++ [1644] = &_001179_hash,
++ [15109] = &_001180_hash,
++ [15787] = &_001181_hash,
++ [54445] = &_001182_hash,
++ [54827] = &_001183_hash,
++ [9488] = &_001184_hash,
++ [12587] = &_001185_hash,
++ [17124] = &_001186_hash,
++ [20681] = &_001187_hash,
++ [40386] = &_001188_hash,
++ [39444] = &_001189_hash,
++ [11290] = &_001190_hash,
++ [51313] = &_001191_hash,
++ [1703] = &_001193_hash,
++ [10828] = &_001194_hash,
++ [28007] = &_001197_hash,
++ [63410] = &_001198_hash,
++ [52437] = &_001199_hash,
++ [62762] = &_001200_hash,
++ [35188] = &_001201_hash,
++ [53701] = &_001202_hash,
++ [21195] = &_001203_hash,
++ [49081] = &_001204_hash,
++ [54624] = &_001205_hash,
++ [56081] = &_001206_hash,
++ [45494] = &_001207_hash,
++ [63706] = &_001208_hash,
++ [30644] = &_001209_hash,
++ [63391] = &_001210_hash,
++ [11655] = &_001212_hash,
++ [28229] = &_001213_hash,
++ [22382] = &_001214_hash,
++ [22649] = &_001215_hash,
++ [19761] = &_001216_hash,
++ [26212] = &_001217_hash,
++ [29203] = &_001218_hash,
++ [53604] = &_001219_hash,
++ [57936] = &_001220_hash,
++ [43029] = &_001221_hash,
++ [25452] = &_001222_hash,
++ [61614] = &_001223_hash,
++ [56321] = &_001224_hash,
++ [42691] = &_001225_hash,
++ [62052] = &_001226_hash,
++ [35556] = &_001227_hash,
++ [1019] = &_001231_hash,
++ [28818] = &_001233_hash,
++ [52880] = &_001234_hash,
++ [18895] = &_001235_hash,
++ [857] = &_001236_hash,
++ [45966] = &_001237_hash,
++ [11785] = &_001238_hash,
++ [7736] = &_001239_hash,
++ [4308] = &_001240_hash,
++ [51095] = &_001241_hash,
++ [427] = &_001242_hash,
++ [4021] = &_001243_hash,
++ [54201] = &_001244_hash,
++ [5615] = &_001245_hash,
++ [16234] = &_001246_hash,
++ [51718] = &_001247_hash,
++ [943] = &_001248_hash,
++ [32683] = &_001249_hash,
++ [63492] = &_001250_hash,
++ [14897] = &_001251_hash,
++ [23417] = &_001252_hash,
++ [32777] = &_001253_hash,
++ [38971] = &_001254_hash,
++ [33881] = &_001255_hash,
++ [25586] = &_001257_hash,
++ [58757] = &_001258_hash,
++ [19758] = &_001259_hash,
++ [23829] = &_001260_hash,
++ [26603] = &_001261_hash,
++ [50633] = &_001262_hash,
++ [19952] = &_001263_hash,
++ [7271] = &_001266_hash,
++ [36900] = &_001267_hash,
++ [54095] = &_001269_hash,
++ [46781] = &_001270_hash,
++ [33835] = &_001272_hash,
++ [23157] = &_001273_hash,
++ [6793] = &_001274_hash,
++ [53763] = &_001275_hash,
++ [57144] = &_001276_hash,
++ [24747] = &_001277_hash,
++ [2114] = &_001279_hash,
++ [48424] = &_001280_hash,
++ [61522] = &_001281_hash,
++ [31000] = &_001282_hash,
++ [51062] = &_001283_hash,
++ [46412] = &_001284_hash,
++ [23497] = &_001285_hash,
++ [10019] = &_001286_hash,
++ [5148] = &_001287_hash,
++ [62460] = &_001288_hash,
++ [45174] = &_001289_hash,
++ [31054] = &_001290_hash,
++ [6921] = &_001291_hash,
++ [22158] = &_001292_hash,
++ [18050] = &_001293_hash,
++ [30827] = &_001294_hash,
++ [27146] = &_001295_hash,
++ [38786] = &_001296_hash,
++ [7155] = &_001297_hash,
++ [14096] = &_001298_hash,
++ [20206] = &_001299_hash,
++ [23207] = &_001300_hash,
++ [51546] = &_001301_hash,
++ [10121] = &_001302_hash,
++ [27727] = &_001303_hash,
++ [52668] = &_001304_hash,
++ [9890] = &_001305_hash,
++ [17684] = &_001306_hash,
++ [23548] = &_001307_hash,
++ [41742] = &_001308_hash,
++ [59852] = &_001309_hash,
++ [13724] = &_001310_hash,
++ [48440] = &_001311_hash,
++ [17144] = &_001312_hash,
++ [37770] = &_001314_hash,
++ [34762] = &_001315_hash,
++ [29460] = &_001316_hash,
++ [9870] = &_001317_hash,
++ [54888] = &_001318_hash,
++ [52678] = &_001319_hash,
++ [36258] = &_001320_hash,
++ [1014] = &_001321_hash,
++ [64907] = &_001322_hash,
++ [38078] = &_001323_hash,
++ [45486] = &_001324_hash,
++ [57969] = &_001325_hash,
++ [50198] = &_001326_hash,
++ [9474] = &_001327_hash,
++ [48553] = &_001328_hash,
++ [45747] = &_001329_hash,
++ [43151] = &_001330_hash,
++ [15626] = &_001331_hash,
++ [36278] = &_001332_hash,
++ [2803] = &_001333_hash,
++ [42715] = &_001334_hash,
++ [12552] = &_001335_hash,
++ [58158] = &_001336_hash,
++ [13099] = &_001337_hash,
++ [40973] = &_001338_hash,
++ [20988] = &_001339_hash,
++ [16939] = &_001340_hash,
++ [48587] = &_001341_hash,
++ [38776] = &_001342_hash,
++ [55644] = &_001343_hash,
++ [26322] = &_001344_hash,
++ [2885] = &_001345_hash,
++ [11588] = &_001346_hash,
++ [23791] = &_001347_hash,
++ [6078] = &_001348_hash,
++ [127] = &_001349_hash,
++ [58554] = &_001350_hash,
++ [27701] = &_001351_hash,
++ [14768] = &_001352_hash,
++ [57854] = &_001353_hash,
++ [44290] = &_001354_hash,
++ [17364] = &_001355_hash,
++ [15077] = &_001356_hash,
++ [31912] = &_001357_hash,
++ [46277] = &_001358_hash,
++ [64770] = &_001359_hash,
++ [13193] = &_001360_hash,
++ [52889] = &_001361_hash,
++ [4360] = &_001362_hash,
++ [20905] = &_001363_hash,
++ [39009] = &_001364_hash,
++ [30479] = &_001365_hash,
++ [40885] = &_001366_hash,
++ [24139] = &_001367_hash,
++ [64604] = &_001368_hash,
++ [57819] = &_001369_hash,
++ [46888] = &_001370_hash,
++ [58430] = &_001371_hash,
++};
+diff --git a/tools/gcc/size_overflow_plugin.c b/tools/gcc/size_overflow_plugin.c
+new file mode 100644
+index 0000000..b378515
+--- /dev/null
++++ b/tools/gcc/size_overflow_plugin.c
+@@ -0,0 +1,1185 @@
++/*
++ * Copyright 2011, 2012 by Emese Revfy <re.emese@gmail.com>
++ * Licensed under the GPL v2, or (at your option) v3
++ *
++ * Homepage:
++ * http://www.grsecurity.net/~ephox/overflow_plugin/
++ *
++ * This plugin recomputes expressions of function arguments marked by a size_overflow attribute
++ * with double integer precision (DImode/TImode for 32/64 bit integer types).
++ * The recomputed argument is checked against INT_MAX and an event is logged on overflow and the triggering process is killed.
++ *
++ * Usage:
++ * $ gcc -I`gcc -print-file-name=plugin`/include -fPIC -shared -O2 -o size_overflow_plugin.so size_overflow_plugin.c
++ * $ gcc -fplugin=size_overflow_plugin.so test.c -O2
++ */
++
++#include "gcc-plugin.h"
++#include "config.h"
++#include "system.h"
++#include "coretypes.h"
++#include "tree.h"
++#include "tree-pass.h"
++#include "intl.h"
++#include "plugin-version.h"
++#include "tm.h"
++#include "toplev.h"
++#include "function.h"
++#include "tree-flow.h"
++#include "plugin.h"
++#include "gimple.h"
++#include "c-common.h"
++#include "diagnostic.h"
++#include "cfgloop.h"
++
++struct size_overflow_hash {
++ struct size_overflow_hash *next;
++ const char *name;
++ const char *file;
++ unsigned short param1:1;
++ unsigned short param2:1;
++ unsigned short param3:1;
++ unsigned short param4:1;
++ unsigned short param5:1;
++ unsigned short param6:1;
++ unsigned short param7:1;
++ unsigned short param8:1;
++ unsigned short param9:1;
++};
++
++#include "size_overflow_hash.h"
++
++#define __unused __attribute__((__unused__))
++#define NAME(node) IDENTIFIER_POINTER(DECL_NAME(node))
++#define NAME_LEN(node) IDENTIFIER_LENGTH(DECL_NAME(node))
++#define BEFORE_STMT true
++#define AFTER_STMT false
++#define CREATE_NEW_VAR NULL_TREE
++
++int plugin_is_GPL_compatible;
++void debug_gimple_stmt(gimple gs);
++
++static tree expand(struct pointer_set_t *visited, bool *potentionally_overflowed, tree var);
++static tree signed_size_overflow_type;
++static tree unsigned_size_overflow_type;
++static tree report_size_overflow_decl;
++static tree const_char_ptr_type_node;
++static unsigned int handle_function(void);
++static bool file_match = true;
++
++static struct plugin_info size_overflow_plugin_info = {
++ .version = "20120520beta",
++ .help = "no-size_overflow\tturn off size overflow checking\n",
++};
++
++static tree handle_size_overflow_attribute(tree *node, tree __unused name, tree args, int __unused flags, bool *no_add_attrs)
++{
++ unsigned int arg_count = type_num_arguments(*node);
++
++ for (; args; args = TREE_CHAIN(args)) {
++ tree position = TREE_VALUE(args);
++ if (TREE_CODE(position) != INTEGER_CST || TREE_INT_CST_HIGH(position) || TREE_INT_CST_LOW(position) < 1 || TREE_INT_CST_LOW(position) > arg_count ) {
++ error("handle_size_overflow_attribute: overflow parameter outside range.");
++ *no_add_attrs = true;
++ }
++ }
++ return NULL_TREE;
++}
++
++static struct attribute_spec no_size_overflow_attr = {
++ .name = "size_overflow",
++ .min_length = 1,
++ .max_length = -1,
++ .decl_required = false,
++ .type_required = true,
++ .function_type_required = true,
++ .handler = handle_size_overflow_attribute
++};
++
++static void register_attributes(void __unused *event_data, void __unused *data)
++{
++ register_attribute(&no_size_overflow_attr);
++}
++
++// http://www.team5150.com/~andrew/noncryptohashzoo2~/CrapWow.html
++static unsigned int CrapWow(const char *key, unsigned int len, unsigned int seed)
++{
++#define cwfold( a, b, lo, hi ) { p = (unsigned int)(a) * (unsigned long long)(b); lo ^= (unsigned int)p; hi ^= (unsigned int)(p >> 32); }
++#define cwmixa( in ) { cwfold( in, m, k, h ); }
++#define cwmixb( in ) { cwfold( in, n, h, k ); }
++
++ const unsigned int m = 0x57559429;
++ const unsigned int n = 0x5052acdb;
++ const unsigned int *key4 = (const unsigned int *)key;
++ unsigned int h = len;
++ unsigned int k = len + seed + n;
++ unsigned long long p;
++
++ while (len >= 8) {
++ cwmixb(key4[0]) cwmixa(key4[1]) key4 += 2;
++ len -= 8;
++ }
++ if (len >= 4) {
++ cwmixb(key4[0]) key4 += 1;
++ len -= 4;
++ }
++ if (len)
++ cwmixa(key4[0] & ((1 << (len * 8)) - 1 ));
++ cwmixb(h ^ (k + n));
++ return k ^ h;
++
++#undef cwfold
++#undef cwmixa
++#undef cwmixb
++}
++
++static inline unsigned int get_hash_num(const char *fndecl, const char *loc_file, unsigned int seed)
++{
++ unsigned int fn = CrapWow(fndecl, strlen(fndecl), seed) & 0xffff;
++ unsigned int file = CrapWow(loc_file, strlen(loc_file), seed) & 0xffff;
++
++ return fn ^ file;
++}
++
++static inline tree get_original_function_decl(tree fndecl)
++{
++ if (DECL_ABSTRACT_ORIGIN(fndecl))
++ return DECL_ABSTRACT_ORIGIN(fndecl);
++ return fndecl;
++}
++
++static inline gimple get_def_stmt(tree node)
++{
++ gcc_assert(TREE_CODE(node) == SSA_NAME);
++ return SSA_NAME_DEF_STMT(node);
++}
++
++static struct size_overflow_hash *get_function_hash(tree fndecl, const char *loc_file)
++{
++ unsigned int hash;
++ struct size_overflow_hash *entry;
++ const char *func_name = NAME(fndecl);
++
++ hash = get_hash_num(NAME(fndecl), loc_file, 0);
++
++ entry = size_overflow_hash[hash];
++ while (entry) {
++ if (!strcmp(entry->name, func_name) && (!file_match || !strcmp(entry->file, loc_file)))
++ return entry;
++ entry = entry->next;
++ }
++
++ return NULL;
++}
++
++static void check_arg_type(tree var)
++{
++ tree type = TREE_TYPE(var);
++ enum tree_code code = TREE_CODE(type);
++
++ gcc_assert(code == INTEGER_TYPE || code == ENUMERAL_TYPE ||
++ (code == POINTER_TYPE && TREE_CODE(TREE_TYPE(type)) == VOID_TYPE) ||
++ (code == POINTER_TYPE && TREE_CODE(TREE_TYPE(type)) == INTEGER_TYPE));
++}
++
++static int find_arg_number(tree arg, tree func)
++{
++ tree var;
++ bool match = false;
++ unsigned int argnum = 1;
++
++ if (TREE_CODE(arg) == SSA_NAME)
++ arg = SSA_NAME_VAR(arg);
++
++ for (var = DECL_ARGUMENTS(func); var; var = TREE_CHAIN(var)) {
++ if (strcmp(NAME(arg), NAME(var))) {
++ argnum++;
++ continue;
++ }
++ check_arg_type(var);
++
++ match = true;
++ if (!TYPE_UNSIGNED(TREE_TYPE(var)))
++ return 0;
++ break;
++ }
++ if (!match) {
++ warning(0, "find_arg_number: cannot find the %s argument in %s", NAME(arg), NAME(func));
++ return 0;
++ }
++ return argnum;
++}
++
++static void print_missing_msg(tree func, const char *filename, unsigned int argnum)
++{
++ unsigned int new_hash;
++ location_t loc = DECL_SOURCE_LOCATION(func);
++ const char *curfunc = NAME(func);
++
++ new_hash = get_hash_num(curfunc, filename, 0);
++ inform(loc, "Function %s is missing from the size_overflow hash table +%s+%d+%u+%s+", curfunc, curfunc, argnum, new_hash, filename);
++}
++
++static void check_missing_attribute(tree arg)
++{
++ tree type, func = get_original_function_decl(current_function_decl);
++ unsigned int argnum;
++ struct size_overflow_hash *hash;
++ const char *filename;
++
++ gcc_assert(TREE_CODE(arg) != COMPONENT_REF);
++
++ type = TREE_TYPE(arg);
++ // skip function pointers
++ if (TREE_CODE(type) == POINTER_TYPE && TREE_CODE(TREE_TYPE(type)) == FUNCTION_TYPE)
++ return;
++
++ if (lookup_attribute("size_overflow", TYPE_ATTRIBUTES(TREE_TYPE(func))))
++ return;
++
++ argnum = find_arg_number(arg, func);
++ if (argnum == 0)
++ return;
++
++ filename = DECL_SOURCE_FILE(func);
++
++ hash = get_function_hash(func, filename);
++ if (!hash) {
++ print_missing_msg(func, filename, argnum);
++ return;
++ }
++
++#define check_param(num) \
++ if (num == argnum && hash->param##num) \
++ return;
++ check_param(1);
++ check_param(2);
++ check_param(3);
++ check_param(4);
++ check_param(5);
++ check_param(6);
++ check_param(7);
++ check_param(8);
++ check_param(9);
++#undef check_param
++
++ print_missing_msg(func, filename, argnum);
++}
++
++static tree create_new_var(tree type)
++{
++ tree new_var = create_tmp_var(type, "cicus");
++
++ add_referenced_var(new_var);
++ mark_sym_for_renaming(new_var);
++ return new_var;
++}
++
++static bool is_bool(tree node)
++{
++ tree type;
++
++ if (node == NULL_TREE)
++ return false;
++
++ type = TREE_TYPE(node);
++ if (!INTEGRAL_TYPE_P(type))
++ return false;
++ if (TREE_CODE(type) == BOOLEAN_TYPE)
++ return true;
++ if (TYPE_PRECISION(type) == 1)
++ return true;
++ return false;
++}
++
++static tree cast_a_tree(tree type, tree var)
++{
++ gcc_assert(fold_convertible_p(type, var));
++
++ return fold_convert(type, var);
++}
++
++static gimple build_cast_stmt(tree type, tree var, tree new_var, location_t loc)
++{
++ gimple assign;
++
++ if (new_var == CREATE_NEW_VAR)
++ new_var = create_new_var(type);
++
++ assign = gimple_build_assign(new_var, cast_a_tree(type, var));
++ gimple_set_location(assign, loc);
++ gimple_set_lhs(assign, make_ssa_name(new_var, assign));
++
++ return assign;
++}
++
++static tree create_assign(struct pointer_set_t *visited, bool *potentionally_overflowed, gimple oldstmt, tree rhs1, bool before)
++{
++ tree oldstmt_rhs1;
++ enum tree_code code;
++ gimple stmt;
++ gimple_stmt_iterator gsi;
++
++ if (!*potentionally_overflowed)
++ return NULL_TREE;
++
++ if (rhs1 == NULL_TREE) {
++ debug_gimple_stmt(oldstmt);
++ error("create_assign: rhs1 is NULL_TREE");
++ gcc_unreachable();
++ }
++
++ oldstmt_rhs1 = gimple_assign_rhs1(oldstmt);
++ code = TREE_CODE(oldstmt_rhs1);
++ if (code == PARM_DECL || (code == SSA_NAME && gimple_code(get_def_stmt(oldstmt_rhs1)) == GIMPLE_NOP))
++ check_missing_attribute(oldstmt_rhs1);
++
++ stmt = build_cast_stmt(signed_size_overflow_type, rhs1, CREATE_NEW_VAR, gimple_location(oldstmt));
++ gsi = gsi_for_stmt(oldstmt);
++ if (lookup_stmt_eh_lp(oldstmt) != 0) {
++ basic_block next_bb, cur_bb;
++ edge e;
++
++ gcc_assert(before == false);
++ gcc_assert(stmt_can_throw_internal(oldstmt));
++ gcc_assert(gimple_code(oldstmt) == GIMPLE_CALL);
++ gcc_assert(!gsi_end_p(gsi));
++
++ cur_bb = gimple_bb(oldstmt);
++ next_bb = cur_bb->next_bb;
++ e = find_edge(cur_bb, next_bb);
++ gcc_assert(e != NULL);
++ gcc_assert(e->flags & EDGE_FALLTHRU);
++
++ gsi = gsi_after_labels(next_bb);
++ gcc_assert(!gsi_end_p(gsi));
++ before = true;
++ }
++ if (before)
++ gsi_insert_before(&gsi, stmt, GSI_NEW_STMT);
++ else
++ gsi_insert_after(&gsi, stmt, GSI_NEW_STMT);
++ update_stmt(stmt);
++ pointer_set_insert(visited, oldstmt);
++ return gimple_get_lhs(stmt);
++}
++
++static tree dup_assign(struct pointer_set_t *visited, bool *potentionally_overflowed, gimple oldstmt, tree rhs1, tree rhs2, tree __unused rhs3)
++{
++ tree new_var, lhs = gimple_get_lhs(oldstmt);
++ gimple stmt;
++ gimple_stmt_iterator gsi;
++
++ if (!*potentionally_overflowed)
++ return NULL_TREE;
++
++ if (gimple_num_ops(oldstmt) != 4 && rhs1 == NULL_TREE) {
++ rhs1 = gimple_assign_rhs1(oldstmt);
++ rhs1 = create_assign(visited, potentionally_overflowed, oldstmt, rhs1, BEFORE_STMT);
++ }
++ if (gimple_num_ops(oldstmt) == 3 && rhs2 == NULL_TREE) {
++ rhs2 = gimple_assign_rhs2(oldstmt);
++ rhs2 = create_assign(visited, potentionally_overflowed, oldstmt, rhs2, BEFORE_STMT);
++ }
++
++ stmt = gimple_copy(oldstmt);
++ gimple_set_location(stmt, gimple_location(oldstmt));
++
++ if (gimple_assign_rhs_code(oldstmt) == WIDEN_MULT_EXPR)
++ gimple_assign_set_rhs_code(stmt, MULT_EXPR);
++
++ if (is_bool(lhs))
++ new_var = SSA_NAME_VAR(lhs);
++ else
++ new_var = create_new_var(signed_size_overflow_type);
++ new_var = make_ssa_name(new_var, stmt);
++ gimple_set_lhs(stmt, new_var);
++
++ if (rhs1 != NULL_TREE) {
++ if (!gimple_assign_cast_p(oldstmt))
++ rhs1 = cast_a_tree(signed_size_overflow_type, rhs1);
++ gimple_assign_set_rhs1(stmt, rhs1);
++ }
++
++ if (rhs2 != NULL_TREE)
++ gimple_assign_set_rhs2(stmt, rhs2);
++#if BUILDING_GCC_VERSION >= 4007
++ if (rhs3 != NULL_TREE)
++ gimple_assign_set_rhs3(stmt, rhs3);
++#endif
++ gimple_set_vuse(stmt, gimple_vuse(oldstmt));
++ gimple_set_vdef(stmt, gimple_vdef(oldstmt));
++
++ gsi = gsi_for_stmt(oldstmt);
++ gsi_insert_after(&gsi, stmt, GSI_SAME_STMT);
++ update_stmt(stmt);
++ pointer_set_insert(visited, oldstmt);
++ return gimple_get_lhs(stmt);
++}
++
++static gimple overflow_create_phi_node(gimple oldstmt, tree var)
++{
++ basic_block bb;
++ gimple phi;
++ gimple_stmt_iterator gsi = gsi_for_stmt(oldstmt);
++
++ bb = gsi_bb(gsi);
++
++ phi = create_phi_node(var, bb);
++ gsi = gsi_last(phi_nodes(bb));
++ gsi_remove(&gsi, false);
++
++ gsi = gsi_for_stmt(oldstmt);
++ gsi_insert_after(&gsi, phi, GSI_NEW_STMT);
++ gimple_set_bb(phi, bb);
++ return phi;
++}
++
++static tree signed_cast_constant(tree node)
++{
++ gcc_assert(is_gimple_constant(node));
++
++ return cast_a_tree(signed_size_overflow_type, node);
++}
++
++static basic_block create_a_first_bb(void)
++{
++ basic_block first_bb;
++
++ first_bb = split_block_after_labels(ENTRY_BLOCK_PTR)->dest;
++ if (dom_info_available_p(CDI_DOMINATORS))
++ set_immediate_dominator(CDI_DOMINATORS, first_bb, ENTRY_BLOCK_PTR);
++ return first_bb;
++}
++
++static gimple cast_old_phi_arg(gimple oldstmt, tree arg, tree new_var, unsigned int i)
++{
++ basic_block bb;
++ gimple newstmt, def_stmt;
++ gimple_stmt_iterator gsi;
++
++ newstmt = build_cast_stmt(signed_size_overflow_type, arg, new_var, gimple_location(oldstmt));
++ if (TREE_CODE(arg) == SSA_NAME) {
++ def_stmt = get_def_stmt(arg);
++ if (gimple_code(def_stmt) != GIMPLE_NOP) {
++ gsi = gsi_for_stmt(def_stmt);
++ gsi_insert_after(&gsi, newstmt, GSI_NEW_STMT);
++ return newstmt;
++ }
++ }
++
++ bb = gimple_phi_arg_edge(oldstmt, i)->src;
++ if (bb->index == 0)
++ bb = create_a_first_bb();
++ gsi = gsi_after_labels(bb);
++ gsi_insert_before(&gsi, newstmt, GSI_NEW_STMT);
++ return newstmt;
++}
++
++static gimple handle_new_phi_arg(tree arg, tree new_var, tree new_rhs)
++{
++ gimple newstmt;
++ gimple_stmt_iterator gsi;
++ void (*gsi_insert)(gimple_stmt_iterator *, gimple, enum gsi_iterator_update);
++ gimple def_newstmt = get_def_stmt(new_rhs);
++
++ gsi_insert = gsi_insert_after;
++ gsi = gsi_for_stmt(def_newstmt);
++
++ switch (gimple_code(get_def_stmt(arg))) {
++ case GIMPLE_PHI:
++ newstmt = gimple_build_assign(new_var, new_rhs);
++ gsi = gsi_after_labels(gimple_bb(def_newstmt));
++ gsi_insert = gsi_insert_before;
++ break;
++ case GIMPLE_ASM:
++ case GIMPLE_CALL:
++ newstmt = gimple_build_assign(new_var, new_rhs);
++ break;
++ case GIMPLE_ASSIGN:
++ newstmt = gimple_build_assign(new_var, gimple_get_lhs(def_newstmt));
++ break;
++ default:
++ /* unknown gimple_code (handle_build_new_phi_arg) */
++ gcc_unreachable();
++ }
++
++ gimple_set_lhs(newstmt, make_ssa_name(new_var, newstmt));
++ gsi_insert(&gsi, newstmt, GSI_NEW_STMT);
++ update_stmt(newstmt);
++ return newstmt;
++}
++
++static tree build_new_phi_arg(struct pointer_set_t *visited, bool *potentionally_overflowed, tree arg, tree new_var)
++{
++ gimple newstmt;
++ tree new_rhs;
++
++ new_rhs = expand(visited, potentionally_overflowed, arg);
++
++ if (new_rhs == NULL_TREE)
++ return NULL_TREE;
++
++ newstmt = handle_new_phi_arg(arg, new_var, new_rhs);
++ return gimple_get_lhs(newstmt);
++}
++
++static tree build_new_phi(struct pointer_set_t *visited, bool *potentionally_overflowed, gimple oldstmt)
++{
++ gimple phi;
++ tree new_var = create_new_var(signed_size_overflow_type);
++ unsigned int i, n = gimple_phi_num_args(oldstmt);
++
++ pointer_set_insert(visited, oldstmt);
++ phi = overflow_create_phi_node(oldstmt, new_var);
++ for (i = 0; i < n; i++) {
++ tree arg, lhs;
++
++ arg = gimple_phi_arg_def(oldstmt, i);
++ if (is_gimple_constant(arg))
++ arg = signed_cast_constant(arg);
++ lhs = build_new_phi_arg(visited, potentionally_overflowed, arg, new_var);
++ if (lhs == NULL_TREE)
++ lhs = gimple_get_lhs(cast_old_phi_arg(oldstmt, arg, new_var, i));
++ add_phi_arg(phi, lhs, gimple_phi_arg_edge(oldstmt, i), gimple_location(oldstmt));
++ }
++
++ update_stmt(phi);
++ return gimple_phi_result(phi);
++}
++
++static tree handle_unary_rhs(struct pointer_set_t *visited, bool *potentionally_overflowed, tree var)
++{
++ gimple def_stmt = get_def_stmt(var);
++ tree new_rhs1, rhs1 = gimple_assign_rhs1(def_stmt);
++
++ *potentionally_overflowed = true;
++ new_rhs1 = expand(visited, potentionally_overflowed, rhs1);
++ if (new_rhs1 == NULL_TREE) {
++ if (TREE_CODE(TREE_TYPE(rhs1)) == POINTER_TYPE)
++ return create_assign(visited, potentionally_overflowed, def_stmt, var, AFTER_STMT);
++ else
++ return create_assign(visited, potentionally_overflowed, def_stmt, rhs1, AFTER_STMT);
++ }
++ return dup_assign(visited, potentionally_overflowed, def_stmt, new_rhs1, NULL_TREE, NULL_TREE);
++}
++
++static tree handle_unary_ops(struct pointer_set_t *visited, bool *potentionally_overflowed, tree var)
++{
++ gimple def_stmt = get_def_stmt(var);
++ tree rhs1 = gimple_assign_rhs1(def_stmt);
++
++ if (is_gimple_constant(rhs1))
++ return dup_assign(visited, potentionally_overflowed, def_stmt, signed_cast_constant(rhs1), NULL_TREE, NULL_TREE);
++
++ gcc_assert(TREE_CODE(rhs1) != COND_EXPR);
++ switch (TREE_CODE(rhs1)) {
++ case SSA_NAME:
++ return handle_unary_rhs(visited, potentionally_overflowed, var);
++
++ case ARRAY_REF:
++ case BIT_FIELD_REF:
++ case ADDR_EXPR:
++ case COMPONENT_REF:
++ case INDIRECT_REF:
++#if BUILDING_GCC_VERSION >= 4006
++ case MEM_REF:
++#endif
++ case PARM_DECL:
++ case TARGET_MEM_REF:
++ case VAR_DECL:
++ return create_assign(visited, potentionally_overflowed, def_stmt, var, AFTER_STMT);
++
++ default:
++ debug_gimple_stmt(def_stmt);
++ debug_tree(rhs1);
++ gcc_unreachable();
++ }
++}
++
++static void insert_cond(basic_block cond_bb, tree arg, enum tree_code cond_code, tree type_value)
++{
++ gimple cond_stmt;
++ gimple_stmt_iterator gsi = gsi_last_bb(cond_bb);
++
++ cond_stmt = gimple_build_cond(cond_code, arg, type_value, NULL_TREE, NULL_TREE);
++ gsi_insert_after(&gsi, cond_stmt, GSI_CONTINUE_LINKING);
++ update_stmt(cond_stmt);
++}
++
++static tree create_string_param(tree string)
++{
++ tree i_type, a_type;
++ int length = TREE_STRING_LENGTH(string);
++
++ gcc_assert(length > 0);
++
++ i_type = build_index_type(build_int_cst(NULL_TREE, length - 1));
++ a_type = build_array_type(char_type_node, i_type);
++
++ TREE_TYPE(string) = a_type;
++ TREE_CONSTANT(string) = 1;
++ TREE_READONLY(string) = 1;
++
++ return build1(ADDR_EXPR, ptr_type_node, string);
++}
++
++static void insert_cond_result(basic_block bb_true, gimple stmt, tree arg)
++{
++ gimple func_stmt, def_stmt;
++ tree current_func, loc_file, loc_line;
++ expanded_location xloc;
++ gimple_stmt_iterator gsi = gsi_start_bb(bb_true);
++
++ def_stmt = get_def_stmt(arg);
++ xloc = expand_location(gimple_location(def_stmt));
++
++ if (!gimple_has_location(def_stmt)) {
++ xloc = expand_location(gimple_location(stmt));
++ if (!gimple_has_location(stmt))
++ xloc = expand_location(DECL_SOURCE_LOCATION(current_function_decl));
++ }
++
++ loc_line = build_int_cstu(unsigned_type_node, xloc.line);
++
++ loc_file = build_string(strlen(xloc.file) + 1, xloc.file);
++ loc_file = create_string_param(loc_file);
++
++ current_func = build_string(NAME_LEN(current_function_decl) + 1, NAME(current_function_decl));
++ current_func = create_string_param(current_func);
++
++ // void report_size_overflow(const char *file, unsigned int line, const char *func)
++ func_stmt = gimple_build_call(report_size_overflow_decl, 3, loc_file, loc_line, current_func);
++
++ gsi_insert_after(&gsi, func_stmt, GSI_CONTINUE_LINKING);
++}
++
++static void __unused print_the_code_insertions(gimple stmt)
++{
++ location_t loc = gimple_location(stmt);
++
++ inform(loc, "Integer size_overflow check applied here.");
++}
++
++static void insert_check_size_overflow(gimple stmt, enum tree_code cond_code, tree arg, tree type_value)
++{
++ basic_block cond_bb, join_bb, bb_true;
++ edge e;
++ gimple_stmt_iterator gsi = gsi_for_stmt(stmt);
++
++ cond_bb = gimple_bb(stmt);
++ gsi_prev(&gsi);
++ if (gsi_end_p(gsi))
++ e = split_block_after_labels(cond_bb);
++ else
++ e = split_block(cond_bb, gsi_stmt(gsi));
++ cond_bb = e->src;
++ join_bb = e->dest;
++ e->flags = EDGE_FALSE_VALUE;
++ e->probability = REG_BR_PROB_BASE;
++
++ bb_true = create_empty_bb(cond_bb);
++ make_edge(cond_bb, bb_true, EDGE_TRUE_VALUE);
++ make_edge(cond_bb, join_bb, EDGE_FALSE_VALUE);
++ make_edge(bb_true, join_bb, EDGE_FALLTHRU);
++
++ if (dom_info_available_p(CDI_DOMINATORS)) {
++ set_immediate_dominator(CDI_DOMINATORS, bb_true, cond_bb);
++ set_immediate_dominator(CDI_DOMINATORS, join_bb, cond_bb);
++ }
++
++ if (current_loops != NULL) {
++ gcc_assert(cond_bb->loop_father == join_bb->loop_father);
++ add_bb_to_loop(bb_true, cond_bb->loop_father);
++ }
++
++ insert_cond(cond_bb, arg, cond_code, type_value);
++ insert_cond_result(bb_true, stmt, arg);
++
++// print_the_code_insertions(stmt);
++}
++
++static tree get_type_for_check(tree rhs)
++{
++ tree def_rhs;
++ gimple def_stmt = get_def_stmt(rhs);
++
++ if (!gimple_assign_cast_p(def_stmt))
++ return TREE_TYPE(rhs);
++ def_rhs = gimple_assign_rhs1(def_stmt);
++ if (TREE_CODE(TREE_TYPE(def_rhs)) == INTEGER_TYPE)
++ return TREE_TYPE(def_rhs);
++ return TREE_TYPE(rhs);
++}
++
++static gimple cast_to_unsigned_size_overflow_type(gimple stmt, tree cast_rhs)
++{
++ gimple ucast_stmt;
++ gimple_stmt_iterator gsi;
++ location_t loc = gimple_location(stmt);
++
++ ucast_stmt = build_cast_stmt(unsigned_size_overflow_type, cast_rhs, CREATE_NEW_VAR, loc);
++ gsi = gsi_for_stmt(stmt);
++ gsi_insert_before(&gsi, ucast_stmt, GSI_SAME_STMT);
++ return ucast_stmt;
++}
++
++static void check_size_overflow(gimple stmt, tree cast_rhs, tree rhs, bool *potentionally_overflowed)
++{
++ tree type_max, type_min, rhs_type;
++ gimple ucast_stmt;
++
++ if (!*potentionally_overflowed)
++ return;
++
++ rhs_type = get_type_for_check(rhs);
++
++ if (TYPE_UNSIGNED(rhs_type)) {
++ ucast_stmt = cast_to_unsigned_size_overflow_type(stmt, cast_rhs);
++ type_max = cast_a_tree(unsigned_size_overflow_type, TYPE_MAX_VALUE(rhs_type));
++ insert_check_size_overflow(stmt, GT_EXPR, gimple_get_lhs(ucast_stmt), type_max);
++ } else {
++ type_max = cast_a_tree(signed_size_overflow_type, TYPE_MAX_VALUE(rhs_type));
++ insert_check_size_overflow(stmt, GT_EXPR, cast_rhs, type_max);
++
++ type_min = cast_a_tree(signed_size_overflow_type, TYPE_MIN_VALUE(rhs_type));
++ insert_check_size_overflow(stmt, LT_EXPR, cast_rhs, type_min);
++ }
++}
++
++static tree change_assign_rhs(struct pointer_set_t *visited, bool *potentionally_overflowed, gimple stmt, tree orig_rhs)
++{
++ gimple assign;
++ gimple_stmt_iterator gsi = gsi_for_stmt(stmt);
++ tree new_rhs, origtype = TREE_TYPE(orig_rhs);
++
++ gcc_assert(gimple_code(stmt) == GIMPLE_ASSIGN);
++
++ new_rhs = expand(visited, potentionally_overflowed, orig_rhs);
++ if (new_rhs == NULL_TREE)
++ return NULL_TREE;
++
++ assign = build_cast_stmt(origtype, new_rhs, CREATE_NEW_VAR, gimple_location(stmt));
++ gsi_insert_before(&gsi, assign, GSI_SAME_STMT);
++ update_stmt(assign);
++ return gimple_get_lhs(assign);
++}
++
++static tree handle_const_assign(struct pointer_set_t *visited, bool *potentionally_overflowed, gimple def_stmt, tree var, tree rhs, tree new_rhs1, tree new_rhs2, void (*gimple_assign_set_rhs)(gimple, tree))
++{
++ tree new_rhs, cast_rhs;
++
++ if (gimple_assign_rhs_code(def_stmt) == MIN_EXPR)
++ return dup_assign(visited, potentionally_overflowed, def_stmt, new_rhs1, new_rhs2, NULL_TREE);
++
++ new_rhs = change_assign_rhs(visited, potentionally_overflowed, def_stmt, rhs);
++ if (new_rhs != NULL_TREE) {
++ gimple_assign_set_rhs(def_stmt, new_rhs);
++ update_stmt(def_stmt);
++
++ cast_rhs = gimple_assign_rhs1(get_def_stmt(new_rhs));
++
++ check_size_overflow(def_stmt, cast_rhs, rhs, potentionally_overflowed);
++ }
++ return create_assign(visited, potentionally_overflowed, def_stmt, var, AFTER_STMT);
++}
++
++static tree handle_binary_ops(struct pointer_set_t *visited, bool *potentionally_overflowed, tree var)
++{
++ tree rhs1, rhs2;
++ gimple def_stmt = get_def_stmt(var);
++ tree new_rhs1 = NULL_TREE;
++ tree new_rhs2 = NULL_TREE;
++
++ rhs1 = gimple_assign_rhs1(def_stmt);
++ rhs2 = gimple_assign_rhs2(def_stmt);
++
++ /* no DImode/TImode division in the 32/64 bit kernel */
++ switch (gimple_assign_rhs_code(def_stmt)) {
++ case RDIV_EXPR:
++ case TRUNC_DIV_EXPR:
++ case CEIL_DIV_EXPR:
++ case FLOOR_DIV_EXPR:
++ case ROUND_DIV_EXPR:
++ case TRUNC_MOD_EXPR:
++ case CEIL_MOD_EXPR:
++ case FLOOR_MOD_EXPR:
++ case ROUND_MOD_EXPR:
++ case EXACT_DIV_EXPR:
++ case POINTER_PLUS_EXPR:
++ case BIT_AND_EXPR:
++ return create_assign(visited, potentionally_overflowed, def_stmt, var, AFTER_STMT);
++ default:
++ break;
++ }
++
++ *potentionally_overflowed = true;
++
++ if (TREE_CODE(rhs1) == SSA_NAME)
++ new_rhs1 = expand(visited, potentionally_overflowed, rhs1);
++ if (TREE_CODE(rhs2) == SSA_NAME)
++ new_rhs2 = expand(visited, potentionally_overflowed, rhs2);
++
++ if (is_gimple_constant(rhs2))
++ return handle_const_assign(visited, potentionally_overflowed, def_stmt, var, rhs1, new_rhs1, signed_cast_constant(rhs2), &gimple_assign_set_rhs1);
++
++ if (is_gimple_constant(rhs1))
++ return handle_const_assign(visited, potentionally_overflowed, def_stmt, var, rhs2, signed_cast_constant(rhs1), new_rhs2, &gimple_assign_set_rhs2);
++
++ return dup_assign(visited, potentionally_overflowed, def_stmt, new_rhs1, new_rhs2, NULL_TREE);
++}
++
++#if BUILDING_GCC_VERSION >= 4007
++static tree get_new_rhs(struct pointer_set_t *visited, bool *potentionally_overflowed, tree rhs)
++{
++ if (is_gimple_constant(rhs))
++ return signed_cast_constant(rhs);
++ if (TREE_CODE(rhs) != SSA_NAME)
++ return NULL_TREE;
++ return expand(visited, potentionally_overflowed, rhs);
++}
++
++static tree handle_ternary_ops(struct pointer_set_t *visited, bool *potentionally_overflowed, tree var)
++{
++ tree rhs1, rhs2, rhs3, new_rhs1, new_rhs2, new_rhs3;
++ gimple def_stmt = get_def_stmt(var);
++
++ *potentionally_overflowed = true;
++
++ rhs1 = gimple_assign_rhs1(def_stmt);
++ rhs2 = gimple_assign_rhs2(def_stmt);
++ rhs3 = gimple_assign_rhs3(def_stmt);
++ new_rhs1 = get_new_rhs(visited, potentionally_overflowed, rhs1);
++ new_rhs2 = get_new_rhs(visited, potentionally_overflowed, rhs2);
++ new_rhs3 = get_new_rhs(visited, potentionally_overflowed, rhs3);
++
++ if (new_rhs1 == NULL_TREE && new_rhs2 != NULL_TREE && new_rhs3 != NULL_TREE)
++ return dup_assign(visited, potentionally_overflowed, def_stmt, new_rhs1, new_rhs2, new_rhs3);
++ error("handle_ternary_ops: unknown rhs");
++ gcc_unreachable();
++}
++#endif
++
++static void set_size_overflow_type(tree node)
++{
++ switch (TYPE_MODE(TREE_TYPE(node))) {
++ case SImode:
++ signed_size_overflow_type = intDI_type_node;
++ unsigned_size_overflow_type = unsigned_intDI_type_node;
++ break;
++ case DImode:
++ if (LONG_TYPE_SIZE == GET_MODE_BITSIZE(SImode)) {
++ signed_size_overflow_type = intDI_type_node;
++ unsigned_size_overflow_type = unsigned_intDI_type_node;
++ } else {
++ signed_size_overflow_type = intTI_type_node;
++ unsigned_size_overflow_type = unsigned_intTI_type_node;
++ }
++ break;
++ default:
++ error("set_size_overflow_type: unsupported gcc configuration.");
++ gcc_unreachable();
++ }
++}
++
++static tree expand_visited(gimple def_stmt)
++{
++ gimple tmp;
++ gimple_stmt_iterator gsi = gsi_for_stmt(def_stmt);
++
++ gsi_next(&gsi);
++ tmp = gsi_stmt(gsi);
++ switch (gimple_code(tmp)) {
++ case GIMPLE_ASSIGN:
++ return gimple_get_lhs(tmp);
++ case GIMPLE_PHI:
++ return gimple_phi_result(tmp);
++ case GIMPLE_CALL:
++ return gimple_call_lhs(tmp);
++ default:
++ return NULL_TREE;
++ }
++}
++
++static tree expand(struct pointer_set_t *visited, bool *potentionally_overflowed, tree var)
++{
++ gimple def_stmt;
++ enum tree_code code = TREE_CODE(TREE_TYPE(var));
++
++ if (is_gimple_constant(var))
++ return NULL_TREE;
++
++ if (TREE_CODE(var) == ADDR_EXPR)
++ return NULL_TREE;
++
++ gcc_assert(code == INTEGER_TYPE || code == POINTER_TYPE || code == BOOLEAN_TYPE || code == ENUMERAL_TYPE);
++ if (code != INTEGER_TYPE)
++ return NULL_TREE;
++
++ if (SSA_NAME_IS_DEFAULT_DEF(var)) {
++ check_missing_attribute(var);
++ return NULL_TREE;
++ }
++
++ def_stmt = get_def_stmt(var);
++
++ if (!def_stmt)
++ return NULL_TREE;
++
++ if (pointer_set_contains(visited, def_stmt))
++ return expand_visited(def_stmt);
++
++ switch (gimple_code(def_stmt)) {
++ case GIMPLE_NOP:
++ check_missing_attribute(var);
++ return NULL_TREE;
++ case GIMPLE_PHI:
++ return build_new_phi(visited, potentionally_overflowed, def_stmt);
++ case GIMPLE_CALL:
++ case GIMPLE_ASM:
++ return create_assign(visited, potentionally_overflowed, def_stmt, var, AFTER_STMT);
++ case GIMPLE_ASSIGN:
++ switch (gimple_num_ops(def_stmt)) {
++ case 2:
++ return handle_unary_ops(visited, potentionally_overflowed, var);
++ case 3:
++ return handle_binary_ops(visited, potentionally_overflowed, var);
++#if BUILDING_GCC_VERSION >= 4007
++ case 4:
++ return handle_ternary_ops(visited, potentionally_overflowed, var);
++#endif
++ }
++ default:
++ debug_gimple_stmt(def_stmt);
++ error("expand: unknown gimple code");
++ gcc_unreachable();
++ }
++}
++
++static void change_function_arg(gimple stmt, tree origarg, unsigned int argnum, tree newarg)
++{
++ gimple assign;
++ gimple_stmt_iterator gsi = gsi_for_stmt(stmt);
++ tree origtype = TREE_TYPE(origarg);
++
++ gcc_assert(gimple_code(stmt) == GIMPLE_CALL);
++
++ assign = build_cast_stmt(origtype, newarg, CREATE_NEW_VAR, gimple_location(stmt));
++ gsi_insert_before(&gsi, assign, GSI_SAME_STMT);
++ update_stmt(assign);
++
++ gimple_call_set_arg(stmt, argnum, gimple_get_lhs(assign));
++ update_stmt(stmt);
++}
++
++static tree get_function_arg(unsigned int argnum, gimple stmt, tree fndecl)
++{
++ const char *origid;
++ tree arg, origarg;
++
++ if (!DECL_ABSTRACT_ORIGIN(fndecl)) {
++ gcc_assert(gimple_call_num_args(stmt) > argnum);
++ return gimple_call_arg(stmt, argnum);
++ }
++
++ origarg = DECL_ARGUMENTS(DECL_ABSTRACT_ORIGIN(fndecl));
++ while (origarg && argnum) {
++ argnum--;
++ origarg = TREE_CHAIN(origarg);
++ }
++
++ gcc_assert(argnum == 0);
++
++ gcc_assert(origarg != NULL_TREE);
++ origid = NAME(origarg);
++ for (arg = DECL_ARGUMENTS(fndecl); arg; arg = TREE_CHAIN(arg)) {
++ if (!strcmp(origid, NAME(arg)))
++ return arg;
++ }
++ return NULL_TREE;
++}
++
++static void handle_function_arg(gimple stmt, tree fndecl, unsigned int argnum)
++{
++ struct pointer_set_t *visited;
++ tree arg, newarg, type_max;
++ gimple ucast_stmt;
++ bool potentionally_overflowed;
++
++ arg = get_function_arg(argnum, stmt, fndecl);
++ if (arg == NULL_TREE)
++ return;
++
++ if (is_gimple_constant(arg))
++ return;
++ if (TREE_CODE(arg) != SSA_NAME)
++ return;
++
++ check_arg_type(arg);
++
++ set_size_overflow_type(arg);
++
++ visited = pointer_set_create();
++ potentionally_overflowed = false;
++ newarg = expand(visited, &potentionally_overflowed, arg);
++ pointer_set_destroy(visited);
++
++ if (newarg == NULL_TREE || !potentionally_overflowed)
++ return;
++
++ change_function_arg(stmt, arg, argnum, newarg);
++
++ ucast_stmt = cast_to_unsigned_size_overflow_type(stmt, newarg);
++
++ type_max = build_int_cstu(unsigned_size_overflow_type, 0x7fffffff);
++ insert_check_size_overflow(stmt, GT_EXPR, gimple_get_lhs(ucast_stmt), type_max);
++}
++
++static void handle_function_by_attribute(gimple stmt, tree attr, tree fndecl)
++{
++ tree p = TREE_VALUE(attr);
++ do {
++ handle_function_arg(stmt, fndecl, TREE_INT_CST_LOW(TREE_VALUE(p))-1);
++ p = TREE_CHAIN(p);
++ } while (p);
++}
++
++static void handle_function_by_hash(gimple stmt, tree fndecl)
++{
++ tree orig_fndecl;
++ struct size_overflow_hash *hash;
++ const char *filename = DECL_SOURCE_FILE(fndecl);
++
++ orig_fndecl = get_original_function_decl(fndecl);
++ hash = get_function_hash(orig_fndecl, filename);
++ if (!hash)
++ return;
++
++#define search_param(argnum) \
++ if (hash->param##argnum) \
++ handle_function_arg(stmt, fndecl, argnum - 1);
++
++ search_param(1);
++ search_param(2);
++ search_param(3);
++ search_param(4);
++ search_param(5);
++ search_param(6);
++ search_param(7);
++ search_param(8);
++ search_param(9);
++#undef search_param
++}
++
++static unsigned int handle_function(void)
++{
++ basic_block bb = ENTRY_BLOCK_PTR->next_bb;
++ int saved_last_basic_block = last_basic_block;
++
++ do {
++ gimple_stmt_iterator gsi;
++ basic_block next = bb->next_bb;
++
++ for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
++ tree fndecl, attr;
++ gimple stmt = gsi_stmt(gsi);
++
++ if (!(is_gimple_call(stmt)))
++ continue;
++ fndecl = gimple_call_fndecl(stmt);
++ if (fndecl == NULL_TREE)
++ continue;
++ if (gimple_call_num_args(stmt) == 0)
++ continue;
++ attr = lookup_attribute("size_overflow", TYPE_ATTRIBUTES(TREE_TYPE(fndecl)));
++ if (!attr || !TREE_VALUE(attr))
++ handle_function_by_hash(stmt, fndecl);
++ else
++ handle_function_by_attribute(stmt, attr, fndecl);
++ gsi = gsi_for_stmt(stmt);
++ }
++ bb = next;
++ } while (bb && bb->index <= saved_last_basic_block);
++ return 0;
++}
++
++static struct gimple_opt_pass size_overflow_pass = {
++ .pass = {
++ .type = GIMPLE_PASS,
++ .name = "size_overflow",
++ .gate = NULL,
++ .execute = handle_function,
++ .sub = NULL,
++ .next = NULL,
++ .static_pass_number = 0,
++ .tv_id = TV_NONE,
++ .properties_required = PROP_cfg | PROP_referenced_vars,
++ .properties_provided = 0,
++ .properties_destroyed = 0,
++ .todo_flags_start = 0,
++ .todo_flags_finish = TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_remove_unused_locals | TODO_update_ssa_no_phi | TODO_cleanup_cfg | TODO_ggc_collect | TODO_verify_flow
++ }
++};
++
++static void start_unit_callback(void __unused *gcc_data, void __unused *user_data)
++{
++ tree fntype;
++
++ const_char_ptr_type_node = build_pointer_type(build_type_variant(char_type_node, 1, 0));
++
++ // void report_size_overflow(const char *loc_file, unsigned int loc_line, const char *current_func)
++ fntype = build_function_type_list(void_type_node,
++ const_char_ptr_type_node,
++ unsigned_type_node,
++ const_char_ptr_type_node,
++ NULL_TREE);
++ report_size_overflow_decl = build_fn_decl("report_size_overflow", fntype);
++
++ DECL_ASSEMBLER_NAME(report_size_overflow_decl);
++ TREE_PUBLIC(report_size_overflow_decl) = 1;
++ DECL_EXTERNAL(report_size_overflow_decl) = 1;
++ DECL_ARTIFICIAL(report_size_overflow_decl) = 1;
++}
++
++extern struct gimple_opt_pass pass_dce;
++
++int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
++{
++ int i;
++ const char * const plugin_name = plugin_info->base_name;
++ const int argc = plugin_info->argc;
++ const struct plugin_argument * const argv = plugin_info->argv;
++ bool enable = true;
++
++ struct register_pass_info size_overflow_pass_info = {
++ .pass = &size_overflow_pass.pass,
++ .reference_pass_name = "ssa",
++ .ref_pass_instance_number = 1,
++ .pos_op = PASS_POS_INSERT_AFTER
++ };
++
++ if (!plugin_default_version_check(version, &gcc_version)) {
++ error(G_("incompatible gcc/plugin versions"));
++ return 1;
++ }
++
++ for (i = 0; i < argc; ++i) {
++ if (!strcmp(argv[i].key, "no-size-overflow")) {
++ enable = false;
++ continue;
++ } else if (!(strcmp(argv[i].key, "no-file-match"))) {
++ file_match = false;
++ continue;
++ }
++ error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
++ }
++
++ register_callback(plugin_name, PLUGIN_INFO, NULL, &size_overflow_plugin_info);
++ if (enable) {
++ register_callback ("start_unit", PLUGIN_START_UNIT, &start_unit_callback, NULL);
++ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &size_overflow_pass_info);
++ }
++ register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
++
++ return 0;
++}
+diff --git a/tools/gcc/stackleak_plugin.c b/tools/gcc/stackleak_plugin.c
+new file mode 100644
+index 0000000..b87ec9d
+--- /dev/null
++++ b/tools/gcc/stackleak_plugin.c
+@@ -0,0 +1,313 @@
++/*
++ * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
++ * Licensed under the GPL v2
++ *
++ * Note: the choice of the license means that the compilation process is
++ * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
++ * but for the kernel it doesn't matter since it doesn't link against
++ * any of the gcc libraries
++ *
++ * gcc plugin to help implement various PaX features
++ *
++ * - track lowest stack pointer
++ *
++ * TODO:
++ * - initialize all local variables
++ *
++ * BUGS:
++ * - none known
++ */
++#include "gcc-plugin.h"
++#include "config.h"
++#include "system.h"
++#include "coretypes.h"
++#include "tree.h"
++#include "tree-pass.h"
++#include "flags.h"
++#include "intl.h"
++#include "toplev.h"
++#include "plugin.h"
++//#include "expr.h" where are you...
++#include "diagnostic.h"
++#include "plugin-version.h"
++#include "tm.h"
++#include "function.h"
++#include "basic-block.h"
++#include "gimple.h"
++#include "rtl.h"
++#include "emit-rtl.h"
++
++extern void print_gimple_stmt(FILE *, gimple, int, int);
++
++int plugin_is_GPL_compatible;
++
++static int track_frame_size = -1;
++static const char track_function[] = "pax_track_stack";
++static const char check_function[] = "pax_check_alloca";
++static bool init_locals;
++
++static struct plugin_info stackleak_plugin_info = {
++ .version = "201203140940",
++ .help = "track-lowest-sp=nn\ttrack sp in functions whose frame size is at least nn bytes\n"
++// "initialize-locals\t\tforcibly initialize all stack frames\n"
++};
++
++static bool gate_stackleak_track_stack(void);
++static unsigned int execute_stackleak_tree_instrument(void);
++static unsigned int execute_stackleak_final(void);
++
++static struct gimple_opt_pass stackleak_tree_instrument_pass = {
++ .pass = {
++ .type = GIMPLE_PASS,
++ .name = "stackleak_tree_instrument",
++ .gate = gate_stackleak_track_stack,
++ .execute = execute_stackleak_tree_instrument,
++ .sub = NULL,
++ .next = NULL,
++ .static_pass_number = 0,
++ .tv_id = TV_NONE,
++ .properties_required = PROP_gimple_leh | PROP_cfg,
++ .properties_provided = 0,
++ .properties_destroyed = 0,
++ .todo_flags_start = 0, //TODO_verify_ssa | TODO_verify_flow | TODO_verify_stmts,
++ .todo_flags_finish = TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_update_ssa
++ }
++};
++
++static struct rtl_opt_pass stackleak_final_rtl_opt_pass = {
++ .pass = {
++ .type = RTL_PASS,
++ .name = "stackleak_final",
++ .gate = gate_stackleak_track_stack,
++ .execute = execute_stackleak_final,
++ .sub = NULL,
++ .next = NULL,
++ .static_pass_number = 0,
++ .tv_id = TV_NONE,
++ .properties_required = 0,
++ .properties_provided = 0,
++ .properties_destroyed = 0,
++ .todo_flags_start = 0,
++ .todo_flags_finish = TODO_dump_func
++ }
++};
++
++static bool gate_stackleak_track_stack(void)
++{
++ return track_frame_size >= 0;
++}
++
++static void stackleak_check_alloca(gimple_stmt_iterator *gsi)
++{
++ gimple check_alloca;
++ tree fntype, fndecl, alloca_size;
++
++ fntype = build_function_type_list(void_type_node, long_unsigned_type_node, NULL_TREE);
++ fndecl = build_fn_decl(check_function, fntype);
++ DECL_ASSEMBLER_NAME(fndecl); // for LTO
++
++ // insert call to void pax_check_alloca(unsigned long size)
++ alloca_size = gimple_call_arg(gsi_stmt(*gsi), 0);
++ check_alloca = gimple_build_call(fndecl, 1, alloca_size);
++ gsi_insert_before(gsi, check_alloca, GSI_SAME_STMT);
++}
++
++static void stackleak_add_instrumentation(gimple_stmt_iterator *gsi)
++{
++ gimple track_stack;
++ tree fntype, fndecl;
++
++ fntype = build_function_type_list(void_type_node, NULL_TREE);
++ fndecl = build_fn_decl(track_function, fntype);
++ DECL_ASSEMBLER_NAME(fndecl); // for LTO
++
++ // insert call to void pax_track_stack(void)
++ track_stack = gimple_build_call(fndecl, 0);
++ gsi_insert_after(gsi, track_stack, GSI_CONTINUE_LINKING);
++}
++
++#if BUILDING_GCC_VERSION == 4005
++static bool gimple_call_builtin_p(gimple stmt, enum built_in_function code)
++{
++ tree fndecl;
++
++ if (!is_gimple_call(stmt))
++ return false;
++ fndecl = gimple_call_fndecl(stmt);
++ if (!fndecl)
++ return false;
++ if (DECL_BUILT_IN_CLASS(fndecl) != BUILT_IN_NORMAL)
++ return false;
++// print_node(stderr, "pax", fndecl, 4);
++ return DECL_FUNCTION_CODE(fndecl) == code;
++}
++#endif
++
++static bool is_alloca(gimple stmt)
++{
++ if (gimple_call_builtin_p(stmt, BUILT_IN_ALLOCA))
++ return true;
++
++#if BUILDING_GCC_VERSION >= 4007
++ if (gimple_call_builtin_p(stmt, BUILT_IN_ALLOCA_WITH_ALIGN))
++ return true;
++#endif
++
++ return false;
++}
++
++static unsigned int execute_stackleak_tree_instrument(void)
++{
++ basic_block bb, entry_bb;
++ bool prologue_instrumented = false, is_leaf = true;
++
++ entry_bb = ENTRY_BLOCK_PTR_FOR_FUNCTION(cfun)->next_bb;
++
++ // 1. loop through BBs and GIMPLE statements
++ FOR_EACH_BB(bb) {
++ gimple_stmt_iterator gsi;
++
++ for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
++ gimple stmt;
++
++ stmt = gsi_stmt(gsi);
++
++ if (is_gimple_call(stmt))
++ is_leaf = false;
++
++ // gimple match: align 8 built-in BUILT_IN_NORMAL:BUILT_IN_ALLOCA attributes <tree_list 0xb7576450>
++ if (!is_alloca(stmt))
++ continue;
++
++ // 2. insert stack overflow check before each __builtin_alloca call
++ stackleak_check_alloca(&gsi);
++
++ // 3. insert track call after each __builtin_alloca call
++ stackleak_add_instrumentation(&gsi);
++ if (bb == entry_bb)
++ prologue_instrumented = true;
++ }
++ }
++
++ // special cases for some bad linux code: taking the address of static inline functions will materialize them
++ // but we mustn't instrument some of them as the resulting stack alignment required by the function call ABI
++ // will break other assumptions regarding the expected (but not otherwise enforced) register clobbering ABI.
++ // case in point: native_save_fl on amd64 when optimized for size clobbers rdx if it were instrumented here.
++ if (is_leaf && !TREE_PUBLIC(current_function_decl) && DECL_DECLARED_INLINE_P(current_function_decl))
++ return 0;
++ if (is_leaf && !strncmp(IDENTIFIER_POINTER(DECL_NAME(current_function_decl)), "_paravirt_", 10))
++ return 0;
++
++ // 4. insert track call at the beginning
++ if (!prologue_instrumented) {
++ gimple_stmt_iterator gsi;
++
++ bb = split_block_after_labels(ENTRY_BLOCK_PTR)->dest;
++ if (dom_info_available_p(CDI_DOMINATORS))
++ set_immediate_dominator(CDI_DOMINATORS, bb, ENTRY_BLOCK_PTR);
++ gsi = gsi_start_bb(bb);
++ stackleak_add_instrumentation(&gsi);
++ }
++
++ return 0;
++}
++
++static unsigned int execute_stackleak_final(void)
++{
++ rtx insn;
++
++ if (cfun->calls_alloca)
++ return 0;
++
++ // keep calls only if function frame is big enough
++ if (get_frame_size() >= track_frame_size)
++ return 0;
++
++ // 1. find pax_track_stack calls
++ for (insn = get_insns(); insn; insn = NEXT_INSN(insn)) {
++ // rtl match: (call_insn 8 7 9 3 (call (mem (symbol_ref ("pax_track_stack") [flags 0x41] <function_decl 0xb7470e80 pax_track_stack>) [0 S1 A8]) (4)) -1 (nil) (nil))
++ rtx body;
++
++ if (!CALL_P(insn))
++ continue;
++ body = PATTERN(insn);
++ if (GET_CODE(body) != CALL)
++ continue;
++ body = XEXP(body, 0);
++ if (GET_CODE(body) != MEM)
++ continue;
++ body = XEXP(body, 0);
++ if (GET_CODE(body) != SYMBOL_REF)
++ continue;
++ if (strcmp(XSTR(body, 0), track_function))
++ continue;
++// warning(0, "track_frame_size: %d %ld %d", cfun->calls_alloca, get_frame_size(), track_frame_size);
++ // 2. delete call
++ insn = delete_insn_and_edges(insn);
++#if BUILDING_GCC_VERSION >= 4007
++ if (GET_CODE(insn) == NOTE && NOTE_KIND(insn) == NOTE_INSN_CALL_ARG_LOCATION)
++ insn = delete_insn_and_edges(insn);
++#endif
++ }
++
++// print_simple_rtl(stderr, get_insns());
++// print_rtl(stderr, get_insns());
++// warning(0, "track_frame_size: %d %ld %d", cfun->calls_alloca, get_frame_size(), track_frame_size);
++
++ return 0;
++}
++
++int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
++{
++ const char * const plugin_name = plugin_info->base_name;
++ const int argc = plugin_info->argc;
++ const struct plugin_argument * const argv = plugin_info->argv;
++ int i;
++ struct register_pass_info stackleak_tree_instrument_pass_info = {
++ .pass = &stackleak_tree_instrument_pass.pass,
++// .reference_pass_name = "tree_profile",
++ .reference_pass_name = "optimized",
++ .ref_pass_instance_number = 0,
++ .pos_op = PASS_POS_INSERT_BEFORE
++ };
++ struct register_pass_info stackleak_final_pass_info = {
++ .pass = &stackleak_final_rtl_opt_pass.pass,
++ .reference_pass_name = "final",
++ .ref_pass_instance_number = 0,
++ .pos_op = PASS_POS_INSERT_BEFORE
++ };
++
++ if (!plugin_default_version_check(version, &gcc_version)) {
++ error(G_("incompatible gcc/plugin versions"));
++ return 1;
++ }
++
++ register_callback(plugin_name, PLUGIN_INFO, NULL, &stackleak_plugin_info);
++
++ for (i = 0; i < argc; ++i) {
++ if (!strcmp(argv[i].key, "track-lowest-sp")) {
++ if (!argv[i].value) {
++ error(G_("no value supplied for option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
++ continue;
++ }
++ track_frame_size = atoi(argv[i].value);
++ if (argv[i].value[0] < '0' || argv[i].value[0] > '9' || track_frame_size < 0)
++ error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
++ continue;
++ }
++ if (!strcmp(argv[i].key, "initialize-locals")) {
++ if (argv[i].value) {
++ error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
++ continue;
++ }
++ init_locals = true;
++ continue;
++ }
++ error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
++ }
++
++ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &stackleak_tree_instrument_pass_info);
++ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &stackleak_final_pass_info);
++
++ return 0;
++}
+diff --git a/usr/gen_init_cpio.c b/usr/gen_init_cpio.c
+index 83b3dde..835bee7 100644
+--- a/usr/gen_init_cpio.c
++++ b/usr/gen_init_cpio.c
+@@ -299,7 +299,7 @@ static int cpio_mkfile(const char *name, const char *location,
+ int retval;
+ int rc = -1;
+ int namesize;
+- int i;
++ unsigned int i;
+
+ mode |= S_IFREG;
+
+@@ -383,9 +383,10 @@ static char *cpio_replace_env(char *new_location)
+ *env_var = *expanded = '\0';
+ strncat(env_var, start + 2, end - start - 2);
+ strncat(expanded, new_location, start - new_location);
+- strncat(expanded, getenv(env_var), PATH_MAX);
+- strncat(expanded, end + 1, PATH_MAX);
++ strncat(expanded, getenv(env_var), PATH_MAX - strlen(expanded));
++ strncat(expanded, end + 1, PATH_MAX - strlen(expanded));
+ strncpy(new_location, expanded, PATH_MAX);
++ new_location[PATH_MAX] = 0;
+ } else
+ break;
+ }
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index 4f3434f..fc63040 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -43,6 +43,8 @@
+ #include <linux/swap.h>
+ #include <linux/bitops.h>
+ #include <linux/spinlock.h>
++#include <linux/namei.h>
++#include <linux/fs.h>
+
+ #include <asm/processor.h>
+ #include <asm/io.h>
+@@ -575,12 +577,73 @@ out:
+ return r;
+ }
+
++/*
++ * We want to test whether the caller has been granted permissions to
++ * use this device. To be able to configure and control the device,
++ * the user needs access to PCI configuration space and BAR resources.
++ * These are accessed through PCI sysfs. PCI config space is often
++ * passed to the process calling this ioctl via file descriptor, so we
++ * can't rely on access to that file. We can check for permissions
++ * on each of the BAR resource files, which is a pretty clear
++ * indicator that the user has been granted access to the device.
++ */
++static int probe_sysfs_permissions(struct pci_dev *dev)
++{
++#ifdef CONFIG_SYSFS
++ int i;
++ bool bar_found = false;
++
++ for (i = PCI_STD_RESOURCES; i <= PCI_STD_RESOURCE_END; i++) {
++ char *kpath, *syspath;
++ struct path path;
++ struct inode *inode;
++ int r;
++
++ if (!pci_resource_len(dev, i))
++ continue;
++
++ kpath = kobject_get_path(&dev->dev.kobj, GFP_KERNEL);
++ if (!kpath)
++ return -ENOMEM;
++
++ /* Per sysfs-rules, sysfs is always at /sys */
++ syspath = kasprintf(GFP_KERNEL, "/sys%s/resource%d", kpath, i);
++ kfree(kpath);
++ if (!syspath)
++ return -ENOMEM;
++
++ r = kern_path(syspath, LOOKUP_FOLLOW, &path);
++ kfree(syspath);
++ if (r)
++ return r;
++
++ inode = path.dentry->d_inode;
++
++ r = inode_permission(inode, MAY_READ | MAY_WRITE | MAY_ACCESS);
++ path_put(&path);
++ if (r)
++ return r;
++
++ bar_found = true;
++ }
++
++ /* If no resources, probably something special */
++ if (!bar_found)
++ return -EPERM;
++
++ return 0;
++#else
++ return -EINVAL; /* No way to control the device without sysfs */
++#endif
++}
++
+ static int kvm_vm_ioctl_assign_device(struct kvm *kvm,
+ struct kvm_assigned_pci_dev *assigned_dev)
+ {
+ int r = 0;
+ struct kvm_assigned_dev_kernel *match;
+ struct pci_dev *dev;
++ u8 header_type;
+
+ down_read(&kvm->slots_lock);
+ mutex_lock(&kvm->lock);
+@@ -607,6 +670,18 @@ static int kvm_vm_ioctl_assign_device(struct kvm *kvm,
+ r = -EINVAL;
+ goto out_free;
+ }
++
++ /* Don't allow bridges to be assigned */
++ pci_read_config_byte(dev, PCI_HEADER_TYPE, &header_type);
++ if ((header_type & PCI_HEADER_TYPE) != PCI_HEADER_TYPE_NORMAL) {
++ r = -EPERM;
++ goto out_put;
++ }
++
++ r = probe_sysfs_permissions(dev);
++ if (r)
++ goto out_put;
++
+ if (pci_enable_device(dev)) {
+ printk(KERN_INFO "%s: Could not enable PCI device\n", __func__);
+ r = -EBUSY;
+@@ -2494,7 +2569,7 @@ asmlinkage void kvm_handle_fault_on_reboot(void)
+ if (kvm_rebooting)
+ /* spin while reset goes on */
+ while (true)
+- ;
++ cpu_relax();
+ /* Fault while not rebooting. We want the trace. */
+ BUG();
+ }
+@@ -2714,7 +2789,7 @@ static void kvm_sched_out(struct preempt_notifier *pn,
+ kvm_arch_vcpu_put(vcpu);
+ }
+
+-int kvm_init(void *opaque, unsigned int vcpu_size,
++int kvm_init(const void *opaque, unsigned int vcpu_size,
+ struct module *module)
+ {
+ int r;
+@@ -2767,15 +2842,17 @@ int kvm_init(void *opaque, unsigned int vcpu_size,
+ /* A kmem cache lets us meet the alignment requirements of fx_save. */
+ kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size,
+ __alignof__(struct kvm_vcpu),
+- 0, NULL);
++ SLAB_USERCOPY, NULL);
+ if (!kvm_vcpu_cache) {
+ r = -ENOMEM;
+ goto out_free_5;
+ }
+
+- kvm_chardev_ops.owner = module;
+- kvm_vm_fops.owner = module;
+- kvm_vcpu_fops.owner = module;
++ pax_open_kernel();
++ *(void **)&kvm_chardev_ops.owner = module;
++ *(void **)&kvm_vm_fops.owner = module;
++ *(void **)&kvm_vcpu_fops.owner = module;
++ pax_close_kernel();
+
+ r = misc_register(&kvm_dev);
+ if (r) {
^ permalink raw reply related [flat|nested] 13+ messages in thread* [gentoo-commits] proj/hardened-patchset:master commit in: 2.6.32/
@ 2011-12-27 3:02 Anthony G. Basile
0 siblings, 0 replies; 13+ messages in thread
From: Anthony G. Basile @ 2011-12-27 3:02 UTC (permalink / raw
To: gentoo-commits
commit: 545dd9b7a1930767efc4c3a139d216a17a3675c7
Author: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Tue Dec 27 03:02:36 2011 +0000
Commit: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Tue Dec 27 03:02:36 2011 +0000
URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-patchset.git;a=commit;h=545dd9b7
Removed EXTRAVERSION = hunk
---
2.6.32/1050_linux-2.6.32.51.patch | 13 -------------
1 files changed, 0 insertions(+), 13 deletions(-)
diff --git a/2.6.32/1050_linux-2.6.32.51.patch b/2.6.32/1050_linux-2.6.32.51.patch
index e328bd5..196ebde 100644
--- a/2.6.32/1050_linux-2.6.32.51.patch
+++ b/2.6.32/1050_linux-2.6.32.51.patch
@@ -1,16 +1,3 @@
-diff --git a/Makefile b/Makefile
-index f38986c..1c640ea 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,7 +1,7 @@
- VERSION = 2
- PATCHLEVEL = 6
- SUBLEVEL = 32
--EXTRAVERSION = .50
-+EXTRAVERSION = .51
- NAME = Man-Eating Seals of Antiquity
-
- # *DOCUMENTATION*
diff --git a/arch/arm/mach-davinci/board-dm646x-evm.c b/arch/arm/mach-davinci/board-dm646x-evm.c
index 24e0e13..6b25227 100644
--- a/arch/arm/mach-davinci/board-dm646x-evm.c
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [gentoo-commits] proj/hardened-patchset:master commit in: 2.6.32/
@ 2011-08-24 19:00 Anthony G. Basile
0 siblings, 0 replies; 13+ messages in thread
From: Anthony G. Basile @ 2011-08-24 19:00 UTC (permalink / raw
To: gentoo-commits
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=UTF-8, Size: 2793820 bytes --]
commit: 4b9e2497cd6db54eb1e0e2edfda735d9e76bd365
Author: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Wed Aug 24 19:00:06 2011 +0000
Commit: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Wed Aug 24 19:00:06 2011 +0000
URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-patchset.git;a=commit;h=4b9e2497
Grsec/PaX: 2.2.2-2.6.32.45-201108232250 + 2.2.2-3.0.3-201108232250
---
2.6.32/0000_README | 2 +-
...0_grsecurity-2.2.2-2.6.32.45-201108211939.patch |77732 --------------------
..._grsecurity-2.2.2-2.6.32.45-201108232250.patch} | 0
3 files changed, 1 insertions(+), 77733 deletions(-)
diff --git a/2.6.32/0000_README b/2.6.32/0000_README
index e5ee171..cc96783 100644
--- a/2.6.32/0000_README
+++ b/2.6.32/0000_README
@@ -11,7 +11,7 @@ Patch: 1044_linux-2.6.32.45.patch
From: http://www.kernel.org
Desc: Linux 2.6.39.45
-Patch: 4420_grsecurity-2.2.2-2.6.32.45-201108211939.patch
+Patch: 4420_grsecurity-2.2.2-2.6.32.45-201108232250.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/2.6.32/4420_grsecurity-2.2.2-2.6.32.45-201108211939.patch b/2.6.32/4420_grsecurity-2.2.2-2.6.32.45-201108211939.patch
deleted file mode 100644
index 78cefe3..0000000
--- a/2.6.32/4420_grsecurity-2.2.2-2.6.32.45-201108211939.patch
+++ /dev/null
@@ -1,77732 +0,0 @@
-diff -urNp linux-2.6.32.45/arch/alpha/include/asm/elf.h linux-2.6.32.45/arch/alpha/include/asm/elf.h
---- linux-2.6.32.45/arch/alpha/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/alpha/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
-@@ -91,6 +91,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
-
- #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x1000000)
-
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE (current->personality & ADDR_LIMIT_32BIT ? 0x10000 : 0x120000000UL)
-+
-+#define PAX_DELTA_MMAP_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 28)
-+#define PAX_DELTA_STACK_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 19)
-+#endif
-+
- /* $0 is set by ld.so to a pointer to a function which might be
- registered using atexit. This provides a mean for the dynamic
- linker to call DT_FINI functions for shared libraries that have
-diff -urNp linux-2.6.32.45/arch/alpha/include/asm/pgtable.h linux-2.6.32.45/arch/alpha/include/asm/pgtable.h
---- linux-2.6.32.45/arch/alpha/include/asm/pgtable.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/alpha/include/asm/pgtable.h 2011-04-17 15:56:45.000000000 -0400
-@@ -101,6 +101,17 @@ struct vm_area_struct;
- #define PAGE_SHARED __pgprot(_PAGE_VALID | __ACCESS_BITS)
- #define PAGE_COPY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
- #define PAGE_READONLY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOE)
-+# define PAGE_COPY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
-+# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
-+#else
-+# define PAGE_SHARED_NOEXEC PAGE_SHARED
-+# define PAGE_COPY_NOEXEC PAGE_COPY
-+# define PAGE_READONLY_NOEXEC PAGE_READONLY
-+#endif
-+
- #define PAGE_KERNEL __pgprot(_PAGE_VALID | _PAGE_ASM | _PAGE_KRE | _PAGE_KWE)
-
- #define _PAGE_NORMAL(x) __pgprot(_PAGE_VALID | __ACCESS_BITS | (x))
-diff -urNp linux-2.6.32.45/arch/alpha/kernel/module.c linux-2.6.32.45/arch/alpha/kernel/module.c
---- linux-2.6.32.45/arch/alpha/kernel/module.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/alpha/kernel/module.c 2011-04-17 15:56:45.000000000 -0400
-@@ -182,7 +182,7 @@ apply_relocate_add(Elf64_Shdr *sechdrs,
-
- /* The small sections were sorted to the end of the segment.
- The following should definitely cover them. */
-- gp = (u64)me->module_core + me->core_size - 0x8000;
-+ gp = (u64)me->module_core_rw + me->core_size_rw - 0x8000;
- got = sechdrs[me->arch.gotsecindex].sh_addr;
-
- for (i = 0; i < n; i++) {
-diff -urNp linux-2.6.32.45/arch/alpha/kernel/osf_sys.c linux-2.6.32.45/arch/alpha/kernel/osf_sys.c
---- linux-2.6.32.45/arch/alpha/kernel/osf_sys.c 2011-08-09 18:35:28.000000000 -0400
-+++ linux-2.6.32.45/arch/alpha/kernel/osf_sys.c 2011-06-13 17:19:47.000000000 -0400
-@@ -1172,7 +1172,7 @@ arch_get_unmapped_area_1(unsigned long a
- /* At this point: (!vma || addr < vma->vm_end). */
- if (limit - len < addr)
- return -ENOMEM;
-- if (!vma || addr + len <= vma->vm_start)
-+ if (check_heap_stack_gap(vma, addr, len))
- return addr;
- addr = vma->vm_end;
- vma = vma->vm_next;
-@@ -1208,6 +1208,10 @@ arch_get_unmapped_area(struct file *filp
- merely specific addresses, but regions of memory -- perhaps
- this feature should be incorporated into all ports? */
-
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- if (addr) {
- addr = arch_get_unmapped_area_1 (PAGE_ALIGN(addr), len, limit);
- if (addr != (unsigned long) -ENOMEM)
-@@ -1215,8 +1219,8 @@ arch_get_unmapped_area(struct file *filp
- }
-
- /* Next, try allocating at TASK_UNMAPPED_BASE. */
-- addr = arch_get_unmapped_area_1 (PAGE_ALIGN(TASK_UNMAPPED_BASE),
-- len, limit);
-+ addr = arch_get_unmapped_area_1 (PAGE_ALIGN(current->mm->mmap_base), len, limit);
-+
- if (addr != (unsigned long) -ENOMEM)
- return addr;
-
-diff -urNp linux-2.6.32.45/arch/alpha/mm/fault.c linux-2.6.32.45/arch/alpha/mm/fault.c
---- linux-2.6.32.45/arch/alpha/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/alpha/mm/fault.c 2011-04-17 15:56:45.000000000 -0400
-@@ -54,6 +54,124 @@ __load_new_mm_context(struct mm_struct *
- __reload_thread(pcb);
- }
-
-+#ifdef CONFIG_PAX_PAGEEXEC
-+/*
-+ * PaX: decide what to do with offenders (regs->pc = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ * 2 when patched PLT trampoline was detected
-+ * 3 when unpatched PLT trampoline was detected
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+ int err;
-+
-+ do { /* PaX: patched PLT emulation #1 */
-+ unsigned int ldah, ldq, jmp;
-+
-+ err = get_user(ldah, (unsigned int *)regs->pc);
-+ err |= get_user(ldq, (unsigned int *)(regs->pc+4));
-+ err |= get_user(jmp, (unsigned int *)(regs->pc+8));
-+
-+ if (err)
-+ break;
-+
-+ if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
-+ (ldq & 0xFFFF0000U) == 0xA77B0000U &&
-+ jmp == 0x6BFB0000U)
-+ {
-+ unsigned long r27, addr;
-+ unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
-+ unsigned long addrl = ldq | 0xFFFFFFFFFFFF0000UL;
-+
-+ addr = regs->r27 + ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
-+ err = get_user(r27, (unsigned long *)addr);
-+ if (err)
-+ break;
-+
-+ regs->r27 = r27;
-+ regs->pc = r27;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: patched PLT emulation #2 */
-+ unsigned int ldah, lda, br;
-+
-+ err = get_user(ldah, (unsigned int *)regs->pc);
-+ err |= get_user(lda, (unsigned int *)(regs->pc+4));
-+ err |= get_user(br, (unsigned int *)(regs->pc+8));
-+
-+ if (err)
-+ break;
-+
-+ if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
-+ (lda & 0xFFFF0000U) == 0xA77B0000U &&
-+ (br & 0xFFE00000U) == 0xC3E00000U)
-+ {
-+ unsigned long addr = br | 0xFFFFFFFFFFE00000UL;
-+ unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
-+ unsigned long addrl = lda | 0xFFFFFFFFFFFF0000UL;
-+
-+ regs->r27 += ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
-+ regs->pc += 12 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: unpatched PLT emulation */
-+ unsigned int br;
-+
-+ err = get_user(br, (unsigned int *)regs->pc);
-+
-+ if (!err && (br & 0xFFE00000U) == 0xC3800000U) {
-+ unsigned int br2, ldq, nop, jmp;
-+ unsigned long addr = br | 0xFFFFFFFFFFE00000UL, resolver;
-+
-+ addr = regs->pc + 4 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
-+ err = get_user(br2, (unsigned int *)addr);
-+ err |= get_user(ldq, (unsigned int *)(addr+4));
-+ err |= get_user(nop, (unsigned int *)(addr+8));
-+ err |= get_user(jmp, (unsigned int *)(addr+12));
-+ err |= get_user(resolver, (unsigned long *)(addr+16));
-+
-+ if (err)
-+ break;
-+
-+ if (br2 == 0xC3600000U &&
-+ ldq == 0xA77B000CU &&
-+ nop == 0x47FF041FU &&
-+ jmp == 0x6B7B0000U)
-+ {
-+ regs->r28 = regs->pc+4;
-+ regs->r27 = addr+16;
-+ regs->pc = resolver;
-+ return 3;
-+ }
-+ }
-+ } while (0);
-+#endif
-+
-+ return 1;
-+}
-+
-+void pax_report_insns(void *pc, void *sp)
-+{
-+ unsigned long i;
-+
-+ printk(KERN_ERR "PAX: bytes at PC: ");
-+ for (i = 0; i < 5; i++) {
-+ unsigned int c;
-+ if (get_user(c, (unsigned int *)pc+i))
-+ printk(KERN_CONT "???????? ");
-+ else
-+ printk(KERN_CONT "%08x ", c);
-+ }
-+ printk("\n");
-+}
-+#endif
-
- /*
- * This routine handles page faults. It determines the address,
-@@ -131,8 +249,29 @@ do_page_fault(unsigned long address, uns
- good_area:
- si_code = SEGV_ACCERR;
- if (cause < 0) {
-- if (!(vma->vm_flags & VM_EXEC))
-+ if (!(vma->vm_flags & VM_EXEC)) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->pc)
-+ goto bad_area;
-+
-+ up_read(&mm->mmap_sem);
-+ switch (pax_handle_fetch_fault(regs)) {
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+ case 2:
-+ case 3:
-+ return;
-+#endif
-+
-+ }
-+ pax_report_fault(regs, (void *)regs->pc, (void *)rdusp());
-+ do_group_exit(SIGKILL);
-+#else
- goto bad_area;
-+#endif
-+
-+ }
- } else if (!cause) {
- /* Allow reads even for write-only mappings */
- if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
-diff -urNp linux-2.6.32.45/arch/arm/include/asm/elf.h linux-2.6.32.45/arch/arm/include/asm/elf.h
---- linux-2.6.32.45/arch/arm/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/arm/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
-@@ -109,7 +109,14 @@ int dump_task_regs(struct task_struct *t
- the loader. We need to make sure that it is out of the way of the program
- that it will "exec", and that there is sufficient room for the brk. */
-
--#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
-+#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
-+
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE 0x00008000UL
-+
-+#define PAX_DELTA_MMAP_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
-+#define PAX_DELTA_STACK_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
-+#endif
-
- /* When the program starts, a1 contains a pointer to a function to be
- registered with atexit, as per the SVR4 ABI. A value of 0 means we
-diff -urNp linux-2.6.32.45/arch/arm/include/asm/kmap_types.h linux-2.6.32.45/arch/arm/include/asm/kmap_types.h
---- linux-2.6.32.45/arch/arm/include/asm/kmap_types.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/arm/include/asm/kmap_types.h 2011-04-17 15:56:45.000000000 -0400
-@@ -19,6 +19,7 @@ enum km_type {
- KM_SOFTIRQ0,
- KM_SOFTIRQ1,
- KM_L2_CACHE,
-+ KM_CLEARPAGE,
- KM_TYPE_NR
- };
-
-diff -urNp linux-2.6.32.45/arch/arm/include/asm/uaccess.h linux-2.6.32.45/arch/arm/include/asm/uaccess.h
---- linux-2.6.32.45/arch/arm/include/asm/uaccess.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/arm/include/asm/uaccess.h 2011-06-29 21:02:24.000000000 -0400
-@@ -22,6 +22,8 @@
- #define VERIFY_READ 0
- #define VERIFY_WRITE 1
-
-+extern void check_object_size(const void *ptr, unsigned long n, bool to);
-+
- /*
- * The exception table consists of pairs of addresses: the first is the
- * address of an instruction that is allowed to fault, and the second is
-@@ -387,8 +389,23 @@ do { \
-
-
- #ifdef CONFIG_MMU
--extern unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n);
--extern unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n);
-+extern unsigned long __must_check ___copy_from_user(void *to, const void __user *from, unsigned long n);
-+extern unsigned long __must_check ___copy_to_user(void __user *to, const void *from, unsigned long n);
-+
-+static inline unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n)
-+{
-+ if (!__builtin_constant_p(n))
-+ check_object_size(to, n, false);
-+ return ___copy_from_user(to, from, n);
-+}
-+
-+static inline unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n)
-+{
-+ if (!__builtin_constant_p(n))
-+ check_object_size(from, n, true);
-+ return ___copy_to_user(to, from, n);
-+}
-+
- extern unsigned long __must_check __copy_to_user_std(void __user *to, const void *from, unsigned long n);
- extern unsigned long __must_check __clear_user(void __user *addr, unsigned long n);
- extern unsigned long __must_check __clear_user_std(void __user *addr, unsigned long n);
-@@ -403,6 +420,9 @@ extern unsigned long __must_check __strn
-
- static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
- {
-+ if ((long)n < 0)
-+ return n;
-+
- if (access_ok(VERIFY_READ, from, n))
- n = __copy_from_user(to, from, n);
- else /* security hole - plug it */
-@@ -412,6 +432,9 @@ static inline unsigned long __must_check
-
- static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
- {
-+ if ((long)n < 0)
-+ return n;
-+
- if (access_ok(VERIFY_WRITE, to, n))
- n = __copy_to_user(to, from, n);
- return n;
-diff -urNp linux-2.6.32.45/arch/arm/kernel/armksyms.c linux-2.6.32.45/arch/arm/kernel/armksyms.c
---- linux-2.6.32.45/arch/arm/kernel/armksyms.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/arm/kernel/armksyms.c 2011-07-06 19:51:50.000000000 -0400
-@@ -118,8 +118,8 @@ EXPORT_SYMBOL(__strncpy_from_user);
- #ifdef CONFIG_MMU
- EXPORT_SYMBOL(copy_page);
-
--EXPORT_SYMBOL(__copy_from_user);
--EXPORT_SYMBOL(__copy_to_user);
-+EXPORT_SYMBOL(___copy_from_user);
-+EXPORT_SYMBOL(___copy_to_user);
- EXPORT_SYMBOL(__clear_user);
-
- EXPORT_SYMBOL(__get_user_1);
-diff -urNp linux-2.6.32.45/arch/arm/kernel/kgdb.c linux-2.6.32.45/arch/arm/kernel/kgdb.c
---- linux-2.6.32.45/arch/arm/kernel/kgdb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/arm/kernel/kgdb.c 2011-04-17 15:56:45.000000000 -0400
-@@ -190,7 +190,7 @@ void kgdb_arch_exit(void)
- * and we handle the normal undef case within the do_undefinstr
- * handler.
- */
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- #ifndef __ARMEB__
- .gdb_bpt_instr = {0xfe, 0xde, 0xff, 0xe7}
- #else /* ! __ARMEB__ */
-diff -urNp linux-2.6.32.45/arch/arm/kernel/traps.c linux-2.6.32.45/arch/arm/kernel/traps.c
---- linux-2.6.32.45/arch/arm/kernel/traps.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/arm/kernel/traps.c 2011-06-13 21:31:18.000000000 -0400
-@@ -247,6 +247,8 @@ static void __die(const char *str, int e
-
- DEFINE_SPINLOCK(die_lock);
-
-+extern void gr_handle_kernel_exploit(void);
-+
- /*
- * This function is protected against re-entrancy.
- */
-@@ -271,6 +273,8 @@ NORET_TYPE void die(const char *str, str
- if (panic_on_oops)
- panic("Fatal exception");
-
-+ gr_handle_kernel_exploit();
-+
- do_exit(SIGSEGV);
- }
-
-diff -urNp linux-2.6.32.45/arch/arm/lib/copy_from_user.S linux-2.6.32.45/arch/arm/lib/copy_from_user.S
---- linux-2.6.32.45/arch/arm/lib/copy_from_user.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/arm/lib/copy_from_user.S 2011-06-29 20:48:38.000000000 -0400
-@@ -16,7 +16,7 @@
- /*
- * Prototype:
- *
-- * size_t __copy_from_user(void *to, const void *from, size_t n)
-+ * size_t ___copy_from_user(void *to, const void *from, size_t n)
- *
- * Purpose:
- *
-@@ -84,11 +84,11 @@
-
- .text
-
--ENTRY(__copy_from_user)
-+ENTRY(___copy_from_user)
-
- #include "copy_template.S"
-
--ENDPROC(__copy_from_user)
-+ENDPROC(___copy_from_user)
-
- .section .fixup,"ax"
- .align 0
-diff -urNp linux-2.6.32.45/arch/arm/lib/copy_to_user.S linux-2.6.32.45/arch/arm/lib/copy_to_user.S
---- linux-2.6.32.45/arch/arm/lib/copy_to_user.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/arm/lib/copy_to_user.S 2011-06-29 20:46:49.000000000 -0400
-@@ -16,7 +16,7 @@
- /*
- * Prototype:
- *
-- * size_t __copy_to_user(void *to, const void *from, size_t n)
-+ * size_t ___copy_to_user(void *to, const void *from, size_t n)
- *
- * Purpose:
- *
-@@ -88,11 +88,11 @@
- .text
-
- ENTRY(__copy_to_user_std)
--WEAK(__copy_to_user)
-+WEAK(___copy_to_user)
-
- #include "copy_template.S"
-
--ENDPROC(__copy_to_user)
-+ENDPROC(___copy_to_user)
-
- .section .fixup,"ax"
- .align 0
-diff -urNp linux-2.6.32.45/arch/arm/lib/uaccess.S linux-2.6.32.45/arch/arm/lib/uaccess.S
---- linux-2.6.32.45/arch/arm/lib/uaccess.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/arm/lib/uaccess.S 2011-06-29 20:48:53.000000000 -0400
-@@ -19,7 +19,7 @@
-
- #define PAGE_SHIFT 12
-
--/* Prototype: int __copy_to_user(void *to, const char *from, size_t n)
-+/* Prototype: int ___copy_to_user(void *to, const char *from, size_t n)
- * Purpose : copy a block to user memory from kernel memory
- * Params : to - user memory
- * : from - kernel memory
-@@ -39,7 +39,7 @@ USER( strgtbt r3, [r0], #1) @ May fau
- sub r2, r2, ip
- b .Lc2u_dest_aligned
-
--ENTRY(__copy_to_user)
-+ENTRY(___copy_to_user)
- stmfd sp!, {r2, r4 - r7, lr}
- cmp r2, #4
- blt .Lc2u_not_enough
-@@ -277,14 +277,14 @@ USER( strgebt r3, [r0], #1) @ May fau
- ldrgtb r3, [r1], #0
- USER( strgtbt r3, [r0], #1) @ May fault
- b .Lc2u_finished
--ENDPROC(__copy_to_user)
-+ENDPROC(___copy_to_user)
-
- .section .fixup,"ax"
- .align 0
- 9001: ldmfd sp!, {r0, r4 - r7, pc}
- .previous
-
--/* Prototype: unsigned long __copy_from_user(void *to,const void *from,unsigned long n);
-+/* Prototype: unsigned long ___copy_from_user(void *to,const void *from,unsigned long n);
- * Purpose : copy a block from user memory to kernel memory
- * Params : to - kernel memory
- * : from - user memory
-@@ -303,7 +303,7 @@ USER( ldrgtbt r3, [r1], #1) @ May fau
- sub r2, r2, ip
- b .Lcfu_dest_aligned
-
--ENTRY(__copy_from_user)
-+ENTRY(___copy_from_user)
- stmfd sp!, {r0, r2, r4 - r7, lr}
- cmp r2, #4
- blt .Lcfu_not_enough
-@@ -543,7 +543,7 @@ USER( ldrgebt r3, [r1], #1) @ May fau
- USER( ldrgtbt r3, [r1], #1) @ May fault
- strgtb r3, [r0], #1
- b .Lcfu_finished
--ENDPROC(__copy_from_user)
-+ENDPROC(___copy_from_user)
-
- .section .fixup,"ax"
- .align 0
-diff -urNp linux-2.6.32.45/arch/arm/lib/uaccess_with_memcpy.c linux-2.6.32.45/arch/arm/lib/uaccess_with_memcpy.c
---- linux-2.6.32.45/arch/arm/lib/uaccess_with_memcpy.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/arm/lib/uaccess_with_memcpy.c 2011-06-29 20:44:35.000000000 -0400
-@@ -97,7 +97,7 @@ out:
- }
-
- unsigned long
--__copy_to_user(void __user *to, const void *from, unsigned long n)
-+___copy_to_user(void __user *to, const void *from, unsigned long n)
- {
- /*
- * This test is stubbed out of the main function above to keep
-diff -urNp linux-2.6.32.45/arch/arm/mach-at91/pm.c linux-2.6.32.45/arch/arm/mach-at91/pm.c
---- linux-2.6.32.45/arch/arm/mach-at91/pm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/arm/mach-at91/pm.c 2011-04-17 15:56:45.000000000 -0400
-@@ -348,7 +348,7 @@ static void at91_pm_end(void)
- }
-
-
--static struct platform_suspend_ops at91_pm_ops ={
-+static const struct platform_suspend_ops at91_pm_ops ={
- .valid = at91_pm_valid_state,
- .begin = at91_pm_begin,
- .enter = at91_pm_enter,
-diff -urNp linux-2.6.32.45/arch/arm/mach-omap1/pm.c linux-2.6.32.45/arch/arm/mach-omap1/pm.c
---- linux-2.6.32.45/arch/arm/mach-omap1/pm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/arm/mach-omap1/pm.c 2011-04-17 15:56:45.000000000 -0400
-@@ -647,7 +647,7 @@ static struct irqaction omap_wakeup_irq
-
-
-
--static struct platform_suspend_ops omap_pm_ops ={
-+static const struct platform_suspend_ops omap_pm_ops ={
- .prepare = omap_pm_prepare,
- .enter = omap_pm_enter,
- .finish = omap_pm_finish,
-diff -urNp linux-2.6.32.45/arch/arm/mach-omap2/pm24xx.c linux-2.6.32.45/arch/arm/mach-omap2/pm24xx.c
---- linux-2.6.32.45/arch/arm/mach-omap2/pm24xx.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/arm/mach-omap2/pm24xx.c 2011-04-17 15:56:45.000000000 -0400
-@@ -326,7 +326,7 @@ static void omap2_pm_finish(void)
- enable_hlt();
- }
-
--static struct platform_suspend_ops omap_pm_ops = {
-+static const struct platform_suspend_ops omap_pm_ops = {
- .prepare = omap2_pm_prepare,
- .enter = omap2_pm_enter,
- .finish = omap2_pm_finish,
-diff -urNp linux-2.6.32.45/arch/arm/mach-omap2/pm34xx.c linux-2.6.32.45/arch/arm/mach-omap2/pm34xx.c
---- linux-2.6.32.45/arch/arm/mach-omap2/pm34xx.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/arm/mach-omap2/pm34xx.c 2011-04-17 15:56:45.000000000 -0400
-@@ -401,7 +401,7 @@ static void omap3_pm_end(void)
- return;
- }
-
--static struct platform_suspend_ops omap_pm_ops = {
-+static const struct platform_suspend_ops omap_pm_ops = {
- .begin = omap3_pm_begin,
- .end = omap3_pm_end,
- .prepare = omap3_pm_prepare,
-diff -urNp linux-2.6.32.45/arch/arm/mach-pnx4008/pm.c linux-2.6.32.45/arch/arm/mach-pnx4008/pm.c
---- linux-2.6.32.45/arch/arm/mach-pnx4008/pm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/arm/mach-pnx4008/pm.c 2011-04-17 15:56:45.000000000 -0400
-@@ -116,7 +116,7 @@ static int pnx4008_pm_valid(suspend_stat
- (state == PM_SUSPEND_MEM);
- }
-
--static struct platform_suspend_ops pnx4008_pm_ops = {
-+static const struct platform_suspend_ops pnx4008_pm_ops = {
- .enter = pnx4008_pm_enter,
- .valid = pnx4008_pm_valid,
- };
-diff -urNp linux-2.6.32.45/arch/arm/mach-pxa/pm.c linux-2.6.32.45/arch/arm/mach-pxa/pm.c
---- linux-2.6.32.45/arch/arm/mach-pxa/pm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/arm/mach-pxa/pm.c 2011-04-17 15:56:45.000000000 -0400
-@@ -95,7 +95,7 @@ void pxa_pm_finish(void)
- pxa_cpu_pm_fns->finish();
- }
-
--static struct platform_suspend_ops pxa_pm_ops = {
-+static const struct platform_suspend_ops pxa_pm_ops = {
- .valid = pxa_pm_valid,
- .enter = pxa_pm_enter,
- .prepare = pxa_pm_prepare,
-diff -urNp linux-2.6.32.45/arch/arm/mach-pxa/sharpsl_pm.c linux-2.6.32.45/arch/arm/mach-pxa/sharpsl_pm.c
---- linux-2.6.32.45/arch/arm/mach-pxa/sharpsl_pm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/arm/mach-pxa/sharpsl_pm.c 2011-04-17 15:56:45.000000000 -0400
-@@ -891,7 +891,7 @@ static void sharpsl_apm_get_power_status
- }
-
- #ifdef CONFIG_PM
--static struct platform_suspend_ops sharpsl_pm_ops = {
-+static const struct platform_suspend_ops sharpsl_pm_ops = {
- .prepare = pxa_pm_prepare,
- .finish = pxa_pm_finish,
- .enter = corgi_pxa_pm_enter,
-diff -urNp linux-2.6.32.45/arch/arm/mach-sa1100/pm.c linux-2.6.32.45/arch/arm/mach-sa1100/pm.c
---- linux-2.6.32.45/arch/arm/mach-sa1100/pm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/arm/mach-sa1100/pm.c 2011-04-17 15:56:45.000000000 -0400
-@@ -120,7 +120,7 @@ unsigned long sleep_phys_sp(void *sp)
- return virt_to_phys(sp);
- }
-
--static struct platform_suspend_ops sa11x0_pm_ops = {
-+static const struct platform_suspend_ops sa11x0_pm_ops = {
- .enter = sa11x0_pm_enter,
- .valid = suspend_valid_only_mem,
- };
-diff -urNp linux-2.6.32.45/arch/arm/mm/fault.c linux-2.6.32.45/arch/arm/mm/fault.c
---- linux-2.6.32.45/arch/arm/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/arm/mm/fault.c 2011-04-17 15:56:45.000000000 -0400
-@@ -166,6 +166,13 @@ __do_user_fault(struct task_struct *tsk,
- }
- #endif
-
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (fsr & FSR_LNX_PF) {
-+ pax_report_fault(regs, (void *)regs->ARM_pc, (void *)regs->ARM_sp);
-+ do_group_exit(SIGKILL);
-+ }
-+#endif
-+
- tsk->thread.address = addr;
- tsk->thread.error_code = fsr;
- tsk->thread.trap_no = 14;
-@@ -357,6 +364,33 @@ do_page_fault(unsigned long addr, unsign
- }
- #endif /* CONFIG_MMU */
-
-+#ifdef CONFIG_PAX_PAGEEXEC
-+void pax_report_insns(void *pc, void *sp)
-+{
-+ long i;
-+
-+ printk(KERN_ERR "PAX: bytes at PC: ");
-+ for (i = 0; i < 20; i++) {
-+ unsigned char c;
-+ if (get_user(c, (__force unsigned char __user *)pc+i))
-+ printk(KERN_CONT "?? ");
-+ else
-+ printk(KERN_CONT "%02x ", c);
-+ }
-+ printk("\n");
-+
-+ printk(KERN_ERR "PAX: bytes at SP-4: ");
-+ for (i = -1; i < 20; i++) {
-+ unsigned long c;
-+ if (get_user(c, (__force unsigned long __user *)sp+i))
-+ printk(KERN_CONT "???????? ");
-+ else
-+ printk(KERN_CONT "%08lx ", c);
-+ }
-+ printk("\n");
-+}
-+#endif
-+
- /*
- * First Level Translation Fault Handler
- *
-diff -urNp linux-2.6.32.45/arch/arm/mm/mmap.c linux-2.6.32.45/arch/arm/mm/mmap.c
---- linux-2.6.32.45/arch/arm/mm/mmap.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/arm/mm/mmap.c 2011-04-17 15:56:45.000000000 -0400
-@@ -63,6 +63,10 @@ arch_get_unmapped_area(struct file *filp
- if (len > TASK_SIZE)
- return -ENOMEM;
-
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- if (addr) {
- if (do_align)
- addr = COLOUR_ALIGN(addr, pgoff);
-@@ -70,15 +74,14 @@ arch_get_unmapped_area(struct file *filp
- addr = PAGE_ALIGN(addr);
-
- vma = find_vma(mm, addr);
-- if (TASK_SIZE - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
- return addr;
- }
- if (len > mm->cached_hole_size) {
-- start_addr = addr = mm->free_area_cache;
-+ start_addr = addr = mm->free_area_cache;
- } else {
-- start_addr = addr = TASK_UNMAPPED_BASE;
-- mm->cached_hole_size = 0;
-+ start_addr = addr = mm->mmap_base;
-+ mm->cached_hole_size = 0;
- }
-
- full_search:
-@@ -94,14 +97,14 @@ full_search:
- * Start a new search - just in case we missed
- * some holes.
- */
-- if (start_addr != TASK_UNMAPPED_BASE) {
-- start_addr = addr = TASK_UNMAPPED_BASE;
-+ if (start_addr != mm->mmap_base) {
-+ start_addr = addr = mm->mmap_base;
- mm->cached_hole_size = 0;
- goto full_search;
- }
- return -ENOMEM;
- }
-- if (!vma || addr + len <= vma->vm_start) {
-+ if (check_heap_stack_gap(vma, addr, len)) {
- /*
- * Remember the place where we stopped the search:
- */
-diff -urNp linux-2.6.32.45/arch/arm/plat-s3c/pm.c linux-2.6.32.45/arch/arm/plat-s3c/pm.c
---- linux-2.6.32.45/arch/arm/plat-s3c/pm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/arm/plat-s3c/pm.c 2011-04-17 15:56:45.000000000 -0400
-@@ -355,7 +355,7 @@ static void s3c_pm_finish(void)
- s3c_pm_check_cleanup();
- }
-
--static struct platform_suspend_ops s3c_pm_ops = {
-+static const struct platform_suspend_ops s3c_pm_ops = {
- .enter = s3c_pm_enter,
- .prepare = s3c_pm_prepare,
- .finish = s3c_pm_finish,
-diff -urNp linux-2.6.32.45/arch/avr32/include/asm/elf.h linux-2.6.32.45/arch/avr32/include/asm/elf.h
---- linux-2.6.32.45/arch/avr32/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/avr32/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
-@@ -85,8 +85,14 @@ typedef struct user_fpu_struct elf_fpreg
- the loader. We need to make sure that it is out of the way of the program
- that it will "exec", and that there is sufficient room for the brk. */
-
--#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
-+#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
-
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE 0x00001000UL
-+
-+#define PAX_DELTA_MMAP_LEN 15
-+#define PAX_DELTA_STACK_LEN 15
-+#endif
-
- /* This yields a mask that user programs can use to figure out what
- instruction set this CPU supports. This could be done in user space,
-diff -urNp linux-2.6.32.45/arch/avr32/include/asm/kmap_types.h linux-2.6.32.45/arch/avr32/include/asm/kmap_types.h
---- linux-2.6.32.45/arch/avr32/include/asm/kmap_types.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/avr32/include/asm/kmap_types.h 2011-04-17 15:56:45.000000000 -0400
-@@ -22,7 +22,8 @@ D(10) KM_IRQ0,
- D(11) KM_IRQ1,
- D(12) KM_SOFTIRQ0,
- D(13) KM_SOFTIRQ1,
--D(14) KM_TYPE_NR
-+D(14) KM_CLEARPAGE,
-+D(15) KM_TYPE_NR
- };
-
- #undef D
-diff -urNp linux-2.6.32.45/arch/avr32/mach-at32ap/pm.c linux-2.6.32.45/arch/avr32/mach-at32ap/pm.c
---- linux-2.6.32.45/arch/avr32/mach-at32ap/pm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/avr32/mach-at32ap/pm.c 2011-04-17 15:56:45.000000000 -0400
-@@ -176,7 +176,7 @@ out:
- return 0;
- }
-
--static struct platform_suspend_ops avr32_pm_ops = {
-+static const struct platform_suspend_ops avr32_pm_ops = {
- .valid = avr32_pm_valid_state,
- .enter = avr32_pm_enter,
- };
-diff -urNp linux-2.6.32.45/arch/avr32/mm/fault.c linux-2.6.32.45/arch/avr32/mm/fault.c
---- linux-2.6.32.45/arch/avr32/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/avr32/mm/fault.c 2011-04-17 15:56:45.000000000 -0400
-@@ -41,6 +41,23 @@ static inline int notify_page_fault(stru
-
- int exception_trace = 1;
-
-+#ifdef CONFIG_PAX_PAGEEXEC
-+void pax_report_insns(void *pc, void *sp)
-+{
-+ unsigned long i;
-+
-+ printk(KERN_ERR "PAX: bytes at PC: ");
-+ for (i = 0; i < 20; i++) {
-+ unsigned char c;
-+ if (get_user(c, (unsigned char *)pc+i))
-+ printk(KERN_CONT "???????? ");
-+ else
-+ printk(KERN_CONT "%02x ", c);
-+ }
-+ printk("\n");
-+}
-+#endif
-+
- /*
- * This routine handles page faults. It determines the address and the
- * problem, and then passes it off to one of the appropriate routines.
-@@ -157,6 +174,16 @@ bad_area:
- up_read(&mm->mmap_sem);
-
- if (user_mode(regs)) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (mm->pax_flags & MF_PAX_PAGEEXEC) {
-+ if (ecr == ECR_PROTECTION_X || ecr == ECR_TLB_MISS_X) {
-+ pax_report_fault(regs, (void *)regs->pc, (void *)regs->sp);
-+ do_group_exit(SIGKILL);
-+ }
-+ }
-+#endif
-+
- if (exception_trace && printk_ratelimit())
- printk("%s%s[%d]: segfault at %08lx pc %08lx "
- "sp %08lx ecr %lu\n",
-diff -urNp linux-2.6.32.45/arch/blackfin/kernel/kgdb.c linux-2.6.32.45/arch/blackfin/kernel/kgdb.c
---- linux-2.6.32.45/arch/blackfin/kernel/kgdb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/blackfin/kernel/kgdb.c 2011-04-17 15:56:45.000000000 -0400
-@@ -428,7 +428,7 @@ int kgdb_arch_handle_exception(int vecto
- return -1; /* this means that we do not want to exit from the handler */
- }
-
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- .gdb_bpt_instr = {0xa1},
- #ifdef CONFIG_SMP
- .flags = KGDB_HW_BREAKPOINT|KGDB_THR_PROC_SWAP,
-diff -urNp linux-2.6.32.45/arch/blackfin/mach-common/pm.c linux-2.6.32.45/arch/blackfin/mach-common/pm.c
---- linux-2.6.32.45/arch/blackfin/mach-common/pm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/blackfin/mach-common/pm.c 2011-04-17 15:56:45.000000000 -0400
-@@ -255,7 +255,7 @@ static int bfin_pm_enter(suspend_state_t
- return 0;
- }
-
--struct platform_suspend_ops bfin_pm_ops = {
-+const struct platform_suspend_ops bfin_pm_ops = {
- .enter = bfin_pm_enter,
- .valid = bfin_pm_valid,
- };
-diff -urNp linux-2.6.32.45/arch/frv/include/asm/kmap_types.h linux-2.6.32.45/arch/frv/include/asm/kmap_types.h
---- linux-2.6.32.45/arch/frv/include/asm/kmap_types.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/frv/include/asm/kmap_types.h 2011-04-17 15:56:45.000000000 -0400
-@@ -23,6 +23,7 @@ enum km_type {
- KM_IRQ1,
- KM_SOFTIRQ0,
- KM_SOFTIRQ1,
-+ KM_CLEARPAGE,
- KM_TYPE_NR
- };
-
-diff -urNp linux-2.6.32.45/arch/frv/mm/elf-fdpic.c linux-2.6.32.45/arch/frv/mm/elf-fdpic.c
---- linux-2.6.32.45/arch/frv/mm/elf-fdpic.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/frv/mm/elf-fdpic.c 2011-04-17 15:56:45.000000000 -0400
-@@ -73,8 +73,7 @@ unsigned long arch_get_unmapped_area(str
- if (addr) {
- addr = PAGE_ALIGN(addr);
- vma = find_vma(current->mm, addr);
-- if (TASK_SIZE - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
- goto success;
- }
-
-@@ -89,7 +88,7 @@ unsigned long arch_get_unmapped_area(str
- for (; vma; vma = vma->vm_next) {
- if (addr > limit)
- break;
-- if (addr + len <= vma->vm_start)
-+ if (check_heap_stack_gap(vma, addr, len))
- goto success;
- addr = vma->vm_end;
- }
-@@ -104,7 +103,7 @@ unsigned long arch_get_unmapped_area(str
- for (; vma; vma = vma->vm_next) {
- if (addr > limit)
- break;
-- if (addr + len <= vma->vm_start)
-+ if (check_heap_stack_gap(vma, addr, len))
- goto success;
- addr = vma->vm_end;
- }
-diff -urNp linux-2.6.32.45/arch/ia64/hp/common/hwsw_iommu.c linux-2.6.32.45/arch/ia64/hp/common/hwsw_iommu.c
---- linux-2.6.32.45/arch/ia64/hp/common/hwsw_iommu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/ia64/hp/common/hwsw_iommu.c 2011-04-17 15:56:45.000000000 -0400
-@@ -17,7 +17,7 @@
- #include <linux/swiotlb.h>
- #include <asm/machvec.h>
-
--extern struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
-+extern const struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
-
- /* swiotlb declarations & definitions: */
- extern int swiotlb_late_init_with_default_size (size_t size);
-@@ -33,7 +33,7 @@ static inline int use_swiotlb(struct dev
- !sba_dma_ops.dma_supported(dev, *dev->dma_mask);
- }
-
--struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
-+const struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
- {
- if (use_swiotlb(dev))
- return &swiotlb_dma_ops;
-diff -urNp linux-2.6.32.45/arch/ia64/hp/common/sba_iommu.c linux-2.6.32.45/arch/ia64/hp/common/sba_iommu.c
---- linux-2.6.32.45/arch/ia64/hp/common/sba_iommu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/ia64/hp/common/sba_iommu.c 2011-04-17 15:56:45.000000000 -0400
-@@ -2097,7 +2097,7 @@ static struct acpi_driver acpi_sba_ioc_d
- },
- };
-
--extern struct dma_map_ops swiotlb_dma_ops;
-+extern const struct dma_map_ops swiotlb_dma_ops;
-
- static int __init
- sba_init(void)
-@@ -2211,7 +2211,7 @@ sba_page_override(char *str)
-
- __setup("sbapagesize=",sba_page_override);
-
--struct dma_map_ops sba_dma_ops = {
-+const struct dma_map_ops sba_dma_ops = {
- .alloc_coherent = sba_alloc_coherent,
- .free_coherent = sba_free_coherent,
- .map_page = sba_map_page,
-diff -urNp linux-2.6.32.45/arch/ia64/ia32/binfmt_elf32.c linux-2.6.32.45/arch/ia64/ia32/binfmt_elf32.c
---- linux-2.6.32.45/arch/ia64/ia32/binfmt_elf32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/ia64/ia32/binfmt_elf32.c 2011-04-17 15:56:45.000000000 -0400
-@@ -45,6 +45,13 @@ randomize_stack_top(unsigned long stack_
-
- #define elf_read_implies_exec(ex, have_pt_gnu_stack) (!(have_pt_gnu_stack))
-
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE (current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
-+
-+#define PAX_DELTA_MMAP_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
-+#define PAX_DELTA_STACK_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
-+#endif
-+
- /* Ugly but avoids duplication */
- #include "../../../fs/binfmt_elf.c"
-
-diff -urNp linux-2.6.32.45/arch/ia64/ia32/ia32priv.h linux-2.6.32.45/arch/ia64/ia32/ia32priv.h
---- linux-2.6.32.45/arch/ia64/ia32/ia32priv.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/ia64/ia32/ia32priv.h 2011-04-17 15:56:45.000000000 -0400
-@@ -296,7 +296,14 @@ typedef struct compat_siginfo {
- #define ELF_DATA ELFDATA2LSB
- #define ELF_ARCH EM_386
-
--#define IA32_STACK_TOP IA32_PAGE_OFFSET
-+#ifdef CONFIG_PAX_RANDUSTACK
-+#define __IA32_DELTA_STACK (current->mm->delta_stack)
-+#else
-+#define __IA32_DELTA_STACK 0UL
-+#endif
-+
-+#define IA32_STACK_TOP (IA32_PAGE_OFFSET - __IA32_DELTA_STACK)
-+
- #define IA32_GATE_OFFSET IA32_PAGE_OFFSET
- #define IA32_GATE_END IA32_PAGE_OFFSET + PAGE_SIZE
-
-diff -urNp linux-2.6.32.45/arch/ia64/include/asm/dma-mapping.h linux-2.6.32.45/arch/ia64/include/asm/dma-mapping.h
---- linux-2.6.32.45/arch/ia64/include/asm/dma-mapping.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/ia64/include/asm/dma-mapping.h 2011-04-17 15:56:45.000000000 -0400
-@@ -12,7 +12,7 @@
-
- #define ARCH_HAS_DMA_GET_REQUIRED_MASK
-
--extern struct dma_map_ops *dma_ops;
-+extern const struct dma_map_ops *dma_ops;
- extern struct ia64_machine_vector ia64_mv;
- extern void set_iommu_machvec(void);
-
-@@ -24,7 +24,7 @@ extern void machvec_dma_sync_sg(struct d
- static inline void *dma_alloc_coherent(struct device *dev, size_t size,
- dma_addr_t *daddr, gfp_t gfp)
- {
-- struct dma_map_ops *ops = platform_dma_get_ops(dev);
-+ const struct dma_map_ops *ops = platform_dma_get_ops(dev);
- void *caddr;
-
- caddr = ops->alloc_coherent(dev, size, daddr, gfp);
-@@ -35,7 +35,7 @@ static inline void *dma_alloc_coherent(s
- static inline void dma_free_coherent(struct device *dev, size_t size,
- void *caddr, dma_addr_t daddr)
- {
-- struct dma_map_ops *ops = platform_dma_get_ops(dev);
-+ const struct dma_map_ops *ops = platform_dma_get_ops(dev);
- debug_dma_free_coherent(dev, size, caddr, daddr);
- ops->free_coherent(dev, size, caddr, daddr);
- }
-@@ -49,13 +49,13 @@ static inline void dma_free_coherent(str
-
- static inline int dma_mapping_error(struct device *dev, dma_addr_t daddr)
- {
-- struct dma_map_ops *ops = platform_dma_get_ops(dev);
-+ const struct dma_map_ops *ops = platform_dma_get_ops(dev);
- return ops->mapping_error(dev, daddr);
- }
-
- static inline int dma_supported(struct device *dev, u64 mask)
- {
-- struct dma_map_ops *ops = platform_dma_get_ops(dev);
-+ const struct dma_map_ops *ops = platform_dma_get_ops(dev);
- return ops->dma_supported(dev, mask);
- }
-
-diff -urNp linux-2.6.32.45/arch/ia64/include/asm/elf.h linux-2.6.32.45/arch/ia64/include/asm/elf.h
---- linux-2.6.32.45/arch/ia64/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/ia64/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
-@@ -43,6 +43,13 @@
- */
- #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x800000000UL)
-
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE (current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
-+
-+#define PAX_DELTA_MMAP_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
-+#define PAX_DELTA_STACK_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
-+#endif
-+
- #define PT_IA_64_UNWIND 0x70000001
-
- /* IA-64 relocations: */
-diff -urNp linux-2.6.32.45/arch/ia64/include/asm/machvec.h linux-2.6.32.45/arch/ia64/include/asm/machvec.h
---- linux-2.6.32.45/arch/ia64/include/asm/machvec.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/ia64/include/asm/machvec.h 2011-04-17 15:56:45.000000000 -0400
-@@ -45,7 +45,7 @@ typedef void ia64_mv_kernel_launch_event
- /* DMA-mapping interface: */
- typedef void ia64_mv_dma_init (void);
- typedef u64 ia64_mv_dma_get_required_mask (struct device *);
--typedef struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
-+typedef const struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
-
- /*
- * WARNING: The legacy I/O space is _architected_. Platforms are
-@@ -251,7 +251,7 @@ extern void machvec_init_from_cmdline(co
- # endif /* CONFIG_IA64_GENERIC */
-
- extern void swiotlb_dma_init(void);
--extern struct dma_map_ops *dma_get_ops(struct device *);
-+extern const struct dma_map_ops *dma_get_ops(struct device *);
-
- /*
- * Define default versions so we can extend machvec for new platforms without having
-diff -urNp linux-2.6.32.45/arch/ia64/include/asm/pgtable.h linux-2.6.32.45/arch/ia64/include/asm/pgtable.h
---- linux-2.6.32.45/arch/ia64/include/asm/pgtable.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/ia64/include/asm/pgtable.h 2011-04-17 15:56:45.000000000 -0400
-@@ -12,7 +12,7 @@
- * David Mosberger-Tang <davidm@hpl.hp.com>
- */
-
--
-+#include <linux/const.h>
- #include <asm/mman.h>
- #include <asm/page.h>
- #include <asm/processor.h>
-@@ -143,6 +143,17 @@
- #define PAGE_READONLY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
- #define PAGE_COPY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
- #define PAGE_COPY_EXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RX)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+# define PAGE_SHARED_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RW)
-+# define PAGE_READONLY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
-+# define PAGE_COPY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
-+#else
-+# define PAGE_SHARED_NOEXEC PAGE_SHARED
-+# define PAGE_READONLY_NOEXEC PAGE_READONLY
-+# define PAGE_COPY_NOEXEC PAGE_COPY
-+#endif
-+
- #define PAGE_GATE __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_X_RX)
- #define PAGE_KERNEL __pgprot(__DIRTY_BITS | _PAGE_PL_0 | _PAGE_AR_RWX)
- #define PAGE_KERNELRX __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_RX)
-diff -urNp linux-2.6.32.45/arch/ia64/include/asm/spinlock.h linux-2.6.32.45/arch/ia64/include/asm/spinlock.h
---- linux-2.6.32.45/arch/ia64/include/asm/spinlock.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/ia64/include/asm/spinlock.h 2011-04-17 15:56:45.000000000 -0400
-@@ -72,7 +72,7 @@ static __always_inline void __ticket_spi
- unsigned short *p = (unsigned short *)&lock->lock + 1, tmp;
-
- asm volatile ("ld2.bias %0=[%1]" : "=r"(tmp) : "r"(p));
-- ACCESS_ONCE(*p) = (tmp + 2) & ~1;
-+ ACCESS_ONCE_RW(*p) = (tmp + 2) & ~1;
- }
-
- static __always_inline void __ticket_spin_unlock_wait(raw_spinlock_t *lock)
-diff -urNp linux-2.6.32.45/arch/ia64/include/asm/uaccess.h linux-2.6.32.45/arch/ia64/include/asm/uaccess.h
---- linux-2.6.32.45/arch/ia64/include/asm/uaccess.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/ia64/include/asm/uaccess.h 2011-04-17 15:56:45.000000000 -0400
-@@ -257,7 +257,7 @@ __copy_from_user (void *to, const void _
- const void *__cu_from = (from); \
- long __cu_len = (n); \
- \
-- if (__access_ok(__cu_to, __cu_len, get_fs())) \
-+ if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs())) \
- __cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len); \
- __cu_len; \
- })
-@@ -269,7 +269,7 @@ __copy_from_user (void *to, const void _
- long __cu_len = (n); \
- \
- __chk_user_ptr(__cu_from); \
-- if (__access_ok(__cu_from, __cu_len, get_fs())) \
-+ if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_from, __cu_len, get_fs())) \
- __cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len); \
- __cu_len; \
- })
-diff -urNp linux-2.6.32.45/arch/ia64/kernel/dma-mapping.c linux-2.6.32.45/arch/ia64/kernel/dma-mapping.c
---- linux-2.6.32.45/arch/ia64/kernel/dma-mapping.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/ia64/kernel/dma-mapping.c 2011-04-17 15:56:45.000000000 -0400
-@@ -3,7 +3,7 @@
- /* Set this to 1 if there is a HW IOMMU in the system */
- int iommu_detected __read_mostly;
-
--struct dma_map_ops *dma_ops;
-+const struct dma_map_ops *dma_ops;
- EXPORT_SYMBOL(dma_ops);
-
- #define PREALLOC_DMA_DEBUG_ENTRIES (1 << 16)
-@@ -16,7 +16,7 @@ static int __init dma_init(void)
- }
- fs_initcall(dma_init);
-
--struct dma_map_ops *dma_get_ops(struct device *dev)
-+const struct dma_map_ops *dma_get_ops(struct device *dev)
- {
- return dma_ops;
- }
-diff -urNp linux-2.6.32.45/arch/ia64/kernel/module.c linux-2.6.32.45/arch/ia64/kernel/module.c
---- linux-2.6.32.45/arch/ia64/kernel/module.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/ia64/kernel/module.c 2011-04-17 15:56:45.000000000 -0400
-@@ -315,8 +315,7 @@ module_alloc (unsigned long size)
- void
- module_free (struct module *mod, void *module_region)
- {
-- if (mod && mod->arch.init_unw_table &&
-- module_region == mod->module_init) {
-+ if (mod && mod->arch.init_unw_table && module_region == mod->module_init_rx) {
- unw_remove_unwind_table(mod->arch.init_unw_table);
- mod->arch.init_unw_table = NULL;
- }
-@@ -502,15 +501,39 @@ module_frob_arch_sections (Elf_Ehdr *ehd
- }
-
- static inline int
-+in_init_rx (const struct module *mod, uint64_t addr)
-+{
-+ return addr - (uint64_t) mod->module_init_rx < mod->init_size_rx;
-+}
-+
-+static inline int
-+in_init_rw (const struct module *mod, uint64_t addr)
-+{
-+ return addr - (uint64_t) mod->module_init_rw < mod->init_size_rw;
-+}
-+
-+static inline int
- in_init (const struct module *mod, uint64_t addr)
- {
-- return addr - (uint64_t) mod->module_init < mod->init_size;
-+ return in_init_rx(mod, addr) || in_init_rw(mod, addr);
-+}
-+
-+static inline int
-+in_core_rx (const struct module *mod, uint64_t addr)
-+{
-+ return addr - (uint64_t) mod->module_core_rx < mod->core_size_rx;
-+}
-+
-+static inline int
-+in_core_rw (const struct module *mod, uint64_t addr)
-+{
-+ return addr - (uint64_t) mod->module_core_rw < mod->core_size_rw;
- }
-
- static inline int
- in_core (const struct module *mod, uint64_t addr)
- {
-- return addr - (uint64_t) mod->module_core < mod->core_size;
-+ return in_core_rx(mod, addr) || in_core_rw(mod, addr);
- }
-
- static inline int
-@@ -693,7 +716,14 @@ do_reloc (struct module *mod, uint8_t r_
- break;
-
- case RV_BDREL:
-- val -= (uint64_t) (in_init(mod, val) ? mod->module_init : mod->module_core);
-+ if (in_init_rx(mod, val))
-+ val -= (uint64_t) mod->module_init_rx;
-+ else if (in_init_rw(mod, val))
-+ val -= (uint64_t) mod->module_init_rw;
-+ else if (in_core_rx(mod, val))
-+ val -= (uint64_t) mod->module_core_rx;
-+ else if (in_core_rw(mod, val))
-+ val -= (uint64_t) mod->module_core_rw;
- break;
-
- case RV_LTV:
-@@ -828,15 +858,15 @@ apply_relocate_add (Elf64_Shdr *sechdrs,
- * addresses have been selected...
- */
- uint64_t gp;
-- if (mod->core_size > MAX_LTOFF)
-+ if (mod->core_size_rx + mod->core_size_rw > MAX_LTOFF)
- /*
- * This takes advantage of fact that SHF_ARCH_SMALL gets allocated
- * at the end of the module.
- */
-- gp = mod->core_size - MAX_LTOFF / 2;
-+ gp = mod->core_size_rx + mod->core_size_rw - MAX_LTOFF / 2;
- else
-- gp = mod->core_size / 2;
-- gp = (uint64_t) mod->module_core + ((gp + 7) & -8);
-+ gp = (mod->core_size_rx + mod->core_size_rw) / 2;
-+ gp = (uint64_t) mod->module_core_rx + ((gp + 7) & -8);
- mod->arch.gp = gp;
- DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp);
- }
-diff -urNp linux-2.6.32.45/arch/ia64/kernel/pci-dma.c linux-2.6.32.45/arch/ia64/kernel/pci-dma.c
---- linux-2.6.32.45/arch/ia64/kernel/pci-dma.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/ia64/kernel/pci-dma.c 2011-04-17 15:56:45.000000000 -0400
-@@ -43,7 +43,7 @@ struct device fallback_dev = {
- .dma_mask = &fallback_dev.coherent_dma_mask,
- };
-
--extern struct dma_map_ops intel_dma_ops;
-+extern const struct dma_map_ops intel_dma_ops;
-
- static int __init pci_iommu_init(void)
- {
-@@ -96,15 +96,34 @@ int iommu_dma_supported(struct device *d
- }
- EXPORT_SYMBOL(iommu_dma_supported);
-
-+extern void *intel_alloc_coherent(struct device *hwdev, size_t size, dma_addr_t *dma_handle, gfp_t flags);
-+extern void intel_free_coherent(struct device *hwdev, size_t size, void *vaddr, dma_addr_t dma_handle);
-+extern int intel_map_sg(struct device *hwdev, struct scatterlist *sglist, int nelems, enum dma_data_direction dir, struct dma_attrs *attrs);
-+extern void intel_unmap_sg(struct device *hwdev, struct scatterlist *sglist, int nelems, enum dma_data_direction dir, struct dma_attrs *attrs);
-+extern dma_addr_t intel_map_page(struct device *dev, struct page *page, unsigned long offset, size_t size, enum dma_data_direction dir, struct dma_attrs *attrs);
-+extern void intel_unmap_page(struct device *dev, dma_addr_t dev_addr, size_t size, enum dma_data_direction dir, struct dma_attrs *attrs);
-+extern int intel_mapping_error(struct device *dev, dma_addr_t dma_addr);
-+
-+static const struct dma_map_ops intel_iommu_dma_ops = {
-+ /* from drivers/pci/intel-iommu.c:intel_dma_ops */
-+ .alloc_coherent = intel_alloc_coherent,
-+ .free_coherent = intel_free_coherent,
-+ .map_sg = intel_map_sg,
-+ .unmap_sg = intel_unmap_sg,
-+ .map_page = intel_map_page,
-+ .unmap_page = intel_unmap_page,
-+ .mapping_error = intel_mapping_error,
-+
-+ .sync_single_for_cpu = machvec_dma_sync_single,
-+ .sync_sg_for_cpu = machvec_dma_sync_sg,
-+ .sync_single_for_device = machvec_dma_sync_single,
-+ .sync_sg_for_device = machvec_dma_sync_sg,
-+ .dma_supported = iommu_dma_supported,
-+};
-+
- void __init pci_iommu_alloc(void)
- {
-- dma_ops = &intel_dma_ops;
--
-- dma_ops->sync_single_for_cpu = machvec_dma_sync_single;
-- dma_ops->sync_sg_for_cpu = machvec_dma_sync_sg;
-- dma_ops->sync_single_for_device = machvec_dma_sync_single;
-- dma_ops->sync_sg_for_device = machvec_dma_sync_sg;
-- dma_ops->dma_supported = iommu_dma_supported;
-+ dma_ops = &intel_iommu_dma_ops;
-
- /*
- * The order of these functions is important for
-diff -urNp linux-2.6.32.45/arch/ia64/kernel/pci-swiotlb.c linux-2.6.32.45/arch/ia64/kernel/pci-swiotlb.c
---- linux-2.6.32.45/arch/ia64/kernel/pci-swiotlb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/ia64/kernel/pci-swiotlb.c 2011-04-17 15:56:45.000000000 -0400
-@@ -21,7 +21,7 @@ static void *ia64_swiotlb_alloc_coherent
- return swiotlb_alloc_coherent(dev, size, dma_handle, gfp);
- }
-
--struct dma_map_ops swiotlb_dma_ops = {
-+const struct dma_map_ops swiotlb_dma_ops = {
- .alloc_coherent = ia64_swiotlb_alloc_coherent,
- .free_coherent = swiotlb_free_coherent,
- .map_page = swiotlb_map_page,
-diff -urNp linux-2.6.32.45/arch/ia64/kernel/sys_ia64.c linux-2.6.32.45/arch/ia64/kernel/sys_ia64.c
---- linux-2.6.32.45/arch/ia64/kernel/sys_ia64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/ia64/kernel/sys_ia64.c 2011-04-17 15:56:45.000000000 -0400
-@@ -43,6 +43,13 @@ arch_get_unmapped_area (struct file *fil
- if (REGION_NUMBER(addr) == RGN_HPAGE)
- addr = 0;
- #endif
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ addr = mm->free_area_cache;
-+ else
-+#endif
-+
- if (!addr)
- addr = mm->free_area_cache;
-
-@@ -61,14 +68,14 @@ arch_get_unmapped_area (struct file *fil
- for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
- /* At this point: (!vma || addr < vma->vm_end). */
- if (TASK_SIZE - len < addr || RGN_MAP_LIMIT - len < REGION_OFFSET(addr)) {
-- if (start_addr != TASK_UNMAPPED_BASE) {
-+ if (start_addr != mm->mmap_base) {
- /* Start a new search --- just in case we missed some holes. */
-- addr = TASK_UNMAPPED_BASE;
-+ addr = mm->mmap_base;
- goto full_search;
- }
- return -ENOMEM;
- }
-- if (!vma || addr + len <= vma->vm_start) {
-+ if (check_heap_stack_gap(vma, addr, len)) {
- /* Remember the address where we stopped this search: */
- mm->free_area_cache = addr + len;
- return addr;
-diff -urNp linux-2.6.32.45/arch/ia64/kernel/topology.c linux-2.6.32.45/arch/ia64/kernel/topology.c
---- linux-2.6.32.45/arch/ia64/kernel/topology.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/ia64/kernel/topology.c 2011-04-17 15:56:45.000000000 -0400
-@@ -282,7 +282,7 @@ static ssize_t cache_show(struct kobject
- return ret;
- }
-
--static struct sysfs_ops cache_sysfs_ops = {
-+static const struct sysfs_ops cache_sysfs_ops = {
- .show = cache_show
- };
-
-diff -urNp linux-2.6.32.45/arch/ia64/kernel/vmlinux.lds.S linux-2.6.32.45/arch/ia64/kernel/vmlinux.lds.S
---- linux-2.6.32.45/arch/ia64/kernel/vmlinux.lds.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/ia64/kernel/vmlinux.lds.S 2011-04-17 15:56:45.000000000 -0400
-@@ -190,7 +190,7 @@ SECTIONS
- /* Per-cpu data: */
- . = ALIGN(PERCPU_PAGE_SIZE);
- PERCPU_VADDR(PERCPU_ADDR, :percpu)
-- __phys_per_cpu_start = __per_cpu_load;
-+ __phys_per_cpu_start = per_cpu_load;
- . = __phys_per_cpu_start + PERCPU_PAGE_SIZE; /* ensure percpu data fits
- * into percpu page size
- */
-diff -urNp linux-2.6.32.45/arch/ia64/mm/fault.c linux-2.6.32.45/arch/ia64/mm/fault.c
---- linux-2.6.32.45/arch/ia64/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/ia64/mm/fault.c 2011-04-17 15:56:45.000000000 -0400
-@@ -72,6 +72,23 @@ mapped_kernel_page_is_present (unsigned
- return pte_present(pte);
- }
-
-+#ifdef CONFIG_PAX_PAGEEXEC
-+void pax_report_insns(void *pc, void *sp)
-+{
-+ unsigned long i;
-+
-+ printk(KERN_ERR "PAX: bytes at PC: ");
-+ for (i = 0; i < 8; i++) {
-+ unsigned int c;
-+ if (get_user(c, (unsigned int *)pc+i))
-+ printk(KERN_CONT "???????? ");
-+ else
-+ printk(KERN_CONT "%08x ", c);
-+ }
-+ printk("\n");
-+}
-+#endif
-+
- void __kprobes
- ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *regs)
- {
-@@ -145,9 +162,23 @@ ia64_do_page_fault (unsigned long addres
- mask = ( (((isr >> IA64_ISR_X_BIT) & 1UL) << VM_EXEC_BIT)
- | (((isr >> IA64_ISR_W_BIT) & 1UL) << VM_WRITE_BIT));
-
-- if ((vma->vm_flags & mask) != mask)
-+ if ((vma->vm_flags & mask) != mask) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (!(vma->vm_flags & VM_EXEC) && (mask & VM_EXEC)) {
-+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->cr_iip)
-+ goto bad_area;
-+
-+ up_read(&mm->mmap_sem);
-+ pax_report_fault(regs, (void *)regs->cr_iip, (void *)regs->r12);
-+ do_group_exit(SIGKILL);
-+ }
-+#endif
-+
- goto bad_area;
-
-+ }
-+
- survive:
- /*
- * If for any reason at all we couldn't handle the fault, make
-diff -urNp linux-2.6.32.45/arch/ia64/mm/hugetlbpage.c linux-2.6.32.45/arch/ia64/mm/hugetlbpage.c
---- linux-2.6.32.45/arch/ia64/mm/hugetlbpage.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/ia64/mm/hugetlbpage.c 2011-04-17 15:56:45.000000000 -0400
-@@ -172,7 +172,7 @@ unsigned long hugetlb_get_unmapped_area(
- /* At this point: (!vmm || addr < vmm->vm_end). */
- if (REGION_OFFSET(addr) + len > RGN_MAP_LIMIT)
- return -ENOMEM;
-- if (!vmm || (addr + len) <= vmm->vm_start)
-+ if (check_heap_stack_gap(vmm, addr, len))
- return addr;
- addr = ALIGN(vmm->vm_end, HPAGE_SIZE);
- }
-diff -urNp linux-2.6.32.45/arch/ia64/mm/init.c linux-2.6.32.45/arch/ia64/mm/init.c
---- linux-2.6.32.45/arch/ia64/mm/init.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/ia64/mm/init.c 2011-04-17 15:56:45.000000000 -0400
-@@ -122,6 +122,19 @@ ia64_init_addr_space (void)
- vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
- vma->vm_end = vma->vm_start + PAGE_SIZE;
- vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT;
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (current->mm->pax_flags & MF_PAX_PAGEEXEC) {
-+ vma->vm_flags &= ~VM_EXEC;
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (current->mm->pax_flags & MF_PAX_MPROTECT)
-+ vma->vm_flags &= ~VM_MAYEXEC;
-+#endif
-+
-+ }
-+#endif
-+
- vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
- down_write(¤t->mm->mmap_sem);
- if (insert_vm_struct(current->mm, vma)) {
-diff -urNp linux-2.6.32.45/arch/ia64/sn/pci/pci_dma.c linux-2.6.32.45/arch/ia64/sn/pci/pci_dma.c
---- linux-2.6.32.45/arch/ia64/sn/pci/pci_dma.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/ia64/sn/pci/pci_dma.c 2011-04-17 15:56:45.000000000 -0400
-@@ -464,7 +464,7 @@ int sn_pci_legacy_write(struct pci_bus *
- return ret;
- }
-
--static struct dma_map_ops sn_dma_ops = {
-+static const struct dma_map_ops sn_dma_ops = {
- .alloc_coherent = sn_dma_alloc_coherent,
- .free_coherent = sn_dma_free_coherent,
- .map_page = sn_dma_map_page,
-diff -urNp linux-2.6.32.45/arch/m32r/lib/usercopy.c linux-2.6.32.45/arch/m32r/lib/usercopy.c
---- linux-2.6.32.45/arch/m32r/lib/usercopy.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/m32r/lib/usercopy.c 2011-04-17 15:56:45.000000000 -0400
-@@ -14,6 +14,9 @@
- unsigned long
- __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
- {
-+ if ((long)n < 0)
-+ return n;
-+
- prefetch(from);
- if (access_ok(VERIFY_WRITE, to, n))
- __copy_user(to,from,n);
-@@ -23,6 +26,9 @@ __generic_copy_to_user(void __user *to,
- unsigned long
- __generic_copy_from_user(void *to, const void __user *from, unsigned long n)
- {
-+ if ((long)n < 0)
-+ return n;
-+
- prefetchw(to);
- if (access_ok(VERIFY_READ, from, n))
- __copy_user_zeroing(to,from,n);
-diff -urNp linux-2.6.32.45/arch/mips/alchemy/devboards/pm.c linux-2.6.32.45/arch/mips/alchemy/devboards/pm.c
---- linux-2.6.32.45/arch/mips/alchemy/devboards/pm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/mips/alchemy/devboards/pm.c 2011-04-17 15:56:45.000000000 -0400
-@@ -78,7 +78,7 @@ static void db1x_pm_end(void)
-
- }
-
--static struct platform_suspend_ops db1x_pm_ops = {
-+static const struct platform_suspend_ops db1x_pm_ops = {
- .valid = suspend_valid_only_mem,
- .begin = db1x_pm_begin,
- .enter = db1x_pm_enter,
-diff -urNp linux-2.6.32.45/arch/mips/include/asm/elf.h linux-2.6.32.45/arch/mips/include/asm/elf.h
---- linux-2.6.32.45/arch/mips/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/mips/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
-@@ -368,4 +368,11 @@ extern int dump_task_fpu(struct task_str
- #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
- #endif
-
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
-+
-+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#endif
-+
- #endif /* _ASM_ELF_H */
-diff -urNp linux-2.6.32.45/arch/mips/include/asm/page.h linux-2.6.32.45/arch/mips/include/asm/page.h
---- linux-2.6.32.45/arch/mips/include/asm/page.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/mips/include/asm/page.h 2011-04-17 15:56:45.000000000 -0400
-@@ -93,7 +93,7 @@ extern void copy_user_highpage(struct pa
- #ifdef CONFIG_CPU_MIPS32
- typedef struct { unsigned long pte_low, pte_high; } pte_t;
- #define pte_val(x) ((x).pte_low | ((unsigned long long)(x).pte_high << 32))
-- #define __pte(x) ({ pte_t __pte = {(x), ((unsigned long long)(x)) >> 32}; __pte; })
-+ #define __pte(x) ({ pte_t __pte = {(x), (x) >> 32}; __pte; })
- #else
- typedef struct { unsigned long long pte; } pte_t;
- #define pte_val(x) ((x).pte)
-diff -urNp linux-2.6.32.45/arch/mips/include/asm/reboot.h linux-2.6.32.45/arch/mips/include/asm/reboot.h
---- linux-2.6.32.45/arch/mips/include/asm/reboot.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/mips/include/asm/reboot.h 2011-08-21 17:35:02.000000000 -0400
-@@ -9,7 +9,7 @@
- #ifndef _ASM_REBOOT_H
- #define _ASM_REBOOT_H
-
--extern void (*_machine_restart)(char *command);
--extern void (*_machine_halt)(void);
-+extern void (*__noreturn _machine_restart)(char *command);
-+extern void (*__noreturn _machine_halt)(void);
-
- #endif /* _ASM_REBOOT_H */
-diff -urNp linux-2.6.32.45/arch/mips/include/asm/system.h linux-2.6.32.45/arch/mips/include/asm/system.h
---- linux-2.6.32.45/arch/mips/include/asm/system.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/mips/include/asm/system.h 2011-04-17 15:56:45.000000000 -0400
-@@ -230,6 +230,6 @@ extern void per_cpu_trap_init(void);
- */
- #define __ARCH_WANT_UNLOCKED_CTXSW
-
--extern unsigned long arch_align_stack(unsigned long sp);
-+#define arch_align_stack(x) ((x) & ~0xfUL)
-
- #endif /* _ASM_SYSTEM_H */
-diff -urNp linux-2.6.32.45/arch/mips/kernel/binfmt_elfn32.c linux-2.6.32.45/arch/mips/kernel/binfmt_elfn32.c
---- linux-2.6.32.45/arch/mips/kernel/binfmt_elfn32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/mips/kernel/binfmt_elfn32.c 2011-04-17 15:56:45.000000000 -0400
-@@ -50,6 +50,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
- #undef ELF_ET_DYN_BASE
- #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
-
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
-+
-+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#endif
-+
- #include <asm/processor.h>
- #include <linux/module.h>
- #include <linux/elfcore.h>
-diff -urNp linux-2.6.32.45/arch/mips/kernel/binfmt_elfo32.c linux-2.6.32.45/arch/mips/kernel/binfmt_elfo32.c
---- linux-2.6.32.45/arch/mips/kernel/binfmt_elfo32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/mips/kernel/binfmt_elfo32.c 2011-04-17 15:56:45.000000000 -0400
-@@ -52,6 +52,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
- #undef ELF_ET_DYN_BASE
- #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
-
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
-+
-+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#endif
-+
- #include <asm/processor.h>
-
- /*
-diff -urNp linux-2.6.32.45/arch/mips/kernel/kgdb.c linux-2.6.32.45/arch/mips/kernel/kgdb.c
---- linux-2.6.32.45/arch/mips/kernel/kgdb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/mips/kernel/kgdb.c 2011-04-17 15:56:45.000000000 -0400
-@@ -245,6 +245,7 @@ int kgdb_arch_handle_exception(int vecto
- return -1;
- }
-
-+/* cannot be const */
- struct kgdb_arch arch_kgdb_ops;
-
- /*
-diff -urNp linux-2.6.32.45/arch/mips/kernel/process.c linux-2.6.32.45/arch/mips/kernel/process.c
---- linux-2.6.32.45/arch/mips/kernel/process.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/mips/kernel/process.c 2011-04-17 15:56:45.000000000 -0400
-@@ -470,15 +470,3 @@ unsigned long get_wchan(struct task_stru
- out:
- return pc;
- }
--
--/*
-- * Don't forget that the stack pointer must be aligned on a 8 bytes
-- * boundary for 32-bits ABI and 16 bytes for 64-bits ABI.
-- */
--unsigned long arch_align_stack(unsigned long sp)
--{
-- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
-- sp -= get_random_int() & ~PAGE_MASK;
--
-- return sp & ALMASK;
--}
-diff -urNp linux-2.6.32.45/arch/mips/kernel/reset.c linux-2.6.32.45/arch/mips/kernel/reset.c
---- linux-2.6.32.45/arch/mips/kernel/reset.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/mips/kernel/reset.c 2011-08-21 17:35:26.000000000 -0400
-@@ -19,8 +19,8 @@
- * So handle all using function pointers to machine specific
- * functions.
- */
--void (*_machine_restart)(char *command);
--void (*_machine_halt)(void);
-+void (*__noreturn _machine_restart)(char *command);
-+void (*__noreturn _machine_halt)(void);
- void (*pm_power_off)(void);
-
- EXPORT_SYMBOL(pm_power_off);
-@@ -29,16 +29,19 @@ void machine_restart(char *command)
- {
- if (_machine_restart)
- _machine_restart(command);
-+ BUG();
- }
-
- void machine_halt(void)
- {
- if (_machine_halt)
- _machine_halt();
-+ BUG();
- }
-
- void machine_power_off(void)
- {
- if (pm_power_off)
- pm_power_off();
-+ BUG();
- }
-diff -urNp linux-2.6.32.45/arch/mips/kernel/syscall.c linux-2.6.32.45/arch/mips/kernel/syscall.c
---- linux-2.6.32.45/arch/mips/kernel/syscall.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/mips/kernel/syscall.c 2011-04-17 15:56:45.000000000 -0400
-@@ -102,17 +102,21 @@ unsigned long arch_get_unmapped_area(str
- do_color_align = 0;
- if (filp || (flags & MAP_SHARED))
- do_color_align = 1;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- if (addr) {
- if (do_color_align)
- addr = COLOUR_ALIGN(addr, pgoff);
- else
- addr = PAGE_ALIGN(addr);
- vmm = find_vma(current->mm, addr);
-- if (task_size - len >= addr &&
-- (!vmm || addr + len <= vmm->vm_start))
-+ if (task_size - len >= addr && check_heap_stack_gap(vmm, addr, len))
- return addr;
- }
-- addr = TASK_UNMAPPED_BASE;
-+ addr = current->mm->mmap_base;
- if (do_color_align)
- addr = COLOUR_ALIGN(addr, pgoff);
- else
-@@ -122,7 +126,7 @@ unsigned long arch_get_unmapped_area(str
- /* At this point: (!vmm || addr < vmm->vm_end). */
- if (task_size - len < addr)
- return -ENOMEM;
-- if (!vmm || addr + len <= vmm->vm_start)
-+ if (check_heap_stack_gap(vmm, addr, len))
- return addr;
- addr = vmm->vm_end;
- if (do_color_align)
-diff -urNp linux-2.6.32.45/arch/mips/Makefile linux-2.6.32.45/arch/mips/Makefile
---- linux-2.6.32.45/arch/mips/Makefile 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/mips/Makefile 2011-08-21 19:26:52.000000000 -0400
-@@ -51,6 +51,8 @@ endif
- cflags-y := -ffunction-sections
- cflags-y += $(call cc-option, -mno-check-zero-division)
-
-+cflags-y += -Wno-sign-compare -Wno-extra
-+
- ifdef CONFIG_32BIT
- ld-emul = $(32bit-emul)
- vmlinux-32 = vmlinux
-diff -urNp linux-2.6.32.45/arch/mips/mm/fault.c linux-2.6.32.45/arch/mips/mm/fault.c
---- linux-2.6.32.45/arch/mips/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/mips/mm/fault.c 2011-04-17 15:56:45.000000000 -0400
-@@ -26,6 +26,23 @@
- #include <asm/ptrace.h>
- #include <asm/highmem.h> /* For VMALLOC_END */
-
-+#ifdef CONFIG_PAX_PAGEEXEC
-+void pax_report_insns(void *pc, void *sp)
-+{
-+ unsigned long i;
-+
-+ printk(KERN_ERR "PAX: bytes at PC: ");
-+ for (i = 0; i < 5; i++) {
-+ unsigned int c;
-+ if (get_user(c, (unsigned int *)pc+i))
-+ printk(KERN_CONT "???????? ");
-+ else
-+ printk(KERN_CONT "%08x ", c);
-+ }
-+ printk("\n");
-+}
-+#endif
-+
- /*
- * This routine handles page faults. It determines the address,
- * and the problem, and then passes it off to one of the appropriate
-diff -urNp linux-2.6.32.45/arch/parisc/include/asm/elf.h linux-2.6.32.45/arch/parisc/include/asm/elf.h
---- linux-2.6.32.45/arch/parisc/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/parisc/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
-@@ -343,6 +343,13 @@ struct pt_regs; /* forward declaration..
-
- #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x01000000)
-
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE 0x10000UL
-+
-+#define PAX_DELTA_MMAP_LEN 16
-+#define PAX_DELTA_STACK_LEN 16
-+#endif
-+
- /* This yields a mask that user programs can use to figure out what
- instruction set this CPU supports. This could be done in user space,
- but it's not easy, and we've already done it here. */
-diff -urNp linux-2.6.32.45/arch/parisc/include/asm/pgtable.h linux-2.6.32.45/arch/parisc/include/asm/pgtable.h
---- linux-2.6.32.45/arch/parisc/include/asm/pgtable.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/parisc/include/asm/pgtable.h 2011-04-17 15:56:45.000000000 -0400
-@@ -207,6 +207,17 @@
- #define PAGE_EXECREAD __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
- #define PAGE_COPY PAGE_EXECREAD
- #define PAGE_RWX __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_ACCESSED)
-+# define PAGE_COPY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
-+# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
-+#else
-+# define PAGE_SHARED_NOEXEC PAGE_SHARED
-+# define PAGE_COPY_NOEXEC PAGE_COPY
-+# define PAGE_READONLY_NOEXEC PAGE_READONLY
-+#endif
-+
- #define PAGE_KERNEL __pgprot(_PAGE_KERNEL)
- #define PAGE_KERNEL_RO __pgprot(_PAGE_KERNEL & ~_PAGE_WRITE)
- #define PAGE_KERNEL_UNC __pgprot(_PAGE_KERNEL | _PAGE_NO_CACHE)
-diff -urNp linux-2.6.32.45/arch/parisc/kernel/module.c linux-2.6.32.45/arch/parisc/kernel/module.c
---- linux-2.6.32.45/arch/parisc/kernel/module.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/parisc/kernel/module.c 2011-04-17 15:56:45.000000000 -0400
-@@ -95,16 +95,38 @@
-
- /* three functions to determine where in the module core
- * or init pieces the location is */
-+static inline int in_init_rx(struct module *me, void *loc)
-+{
-+ return (loc >= me->module_init_rx &&
-+ loc < (me->module_init_rx + me->init_size_rx));
-+}
-+
-+static inline int in_init_rw(struct module *me, void *loc)
-+{
-+ return (loc >= me->module_init_rw &&
-+ loc < (me->module_init_rw + me->init_size_rw));
-+}
-+
- static inline int in_init(struct module *me, void *loc)
- {
-- return (loc >= me->module_init &&
-- loc <= (me->module_init + me->init_size));
-+ return in_init_rx(me, loc) || in_init_rw(me, loc);
-+}
-+
-+static inline int in_core_rx(struct module *me, void *loc)
-+{
-+ return (loc >= me->module_core_rx &&
-+ loc < (me->module_core_rx + me->core_size_rx));
-+}
-+
-+static inline int in_core_rw(struct module *me, void *loc)
-+{
-+ return (loc >= me->module_core_rw &&
-+ loc < (me->module_core_rw + me->core_size_rw));
- }
-
- static inline int in_core(struct module *me, void *loc)
- {
-- return (loc >= me->module_core &&
-- loc <= (me->module_core + me->core_size));
-+ return in_core_rx(me, loc) || in_core_rw(me, loc);
- }
-
- static inline int in_local(struct module *me, void *loc)
-@@ -364,13 +386,13 @@ int module_frob_arch_sections(CONST Elf_
- }
-
- /* align things a bit */
-- me->core_size = ALIGN(me->core_size, 16);
-- me->arch.got_offset = me->core_size;
-- me->core_size += gots * sizeof(struct got_entry);
--
-- me->core_size = ALIGN(me->core_size, 16);
-- me->arch.fdesc_offset = me->core_size;
-- me->core_size += fdescs * sizeof(Elf_Fdesc);
-+ me->core_size_rw = ALIGN(me->core_size_rw, 16);
-+ me->arch.got_offset = me->core_size_rw;
-+ me->core_size_rw += gots * sizeof(struct got_entry);
-+
-+ me->core_size_rw = ALIGN(me->core_size_rw, 16);
-+ me->arch.fdesc_offset = me->core_size_rw;
-+ me->core_size_rw += fdescs * sizeof(Elf_Fdesc);
-
- me->arch.got_max = gots;
- me->arch.fdesc_max = fdescs;
-@@ -388,7 +410,7 @@ static Elf64_Word get_got(struct module
-
- BUG_ON(value == 0);
-
-- got = me->module_core + me->arch.got_offset;
-+ got = me->module_core_rw + me->arch.got_offset;
- for (i = 0; got[i].addr; i++)
- if (got[i].addr == value)
- goto out;
-@@ -406,7 +428,7 @@ static Elf64_Word get_got(struct module
- #ifdef CONFIG_64BIT
- static Elf_Addr get_fdesc(struct module *me, unsigned long value)
- {
-- Elf_Fdesc *fdesc = me->module_core + me->arch.fdesc_offset;
-+ Elf_Fdesc *fdesc = me->module_core_rw + me->arch.fdesc_offset;
-
- if (!value) {
- printk(KERN_ERR "%s: zero OPD requested!\n", me->name);
-@@ -424,7 +446,7 @@ static Elf_Addr get_fdesc(struct module
-
- /* Create new one */
- fdesc->addr = value;
-- fdesc->gp = (Elf_Addr)me->module_core + me->arch.got_offset;
-+ fdesc->gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
- return (Elf_Addr)fdesc;
- }
- #endif /* CONFIG_64BIT */
-@@ -848,7 +870,7 @@ register_unwind_table(struct module *me,
-
- table = (unsigned char *)sechdrs[me->arch.unwind_section].sh_addr;
- end = table + sechdrs[me->arch.unwind_section].sh_size;
-- gp = (Elf_Addr)me->module_core + me->arch.got_offset;
-+ gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
-
- DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n",
- me->arch.unwind_section, table, end, gp);
-diff -urNp linux-2.6.32.45/arch/parisc/kernel/sys_parisc.c linux-2.6.32.45/arch/parisc/kernel/sys_parisc.c
---- linux-2.6.32.45/arch/parisc/kernel/sys_parisc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/parisc/kernel/sys_parisc.c 2011-04-17 15:56:45.000000000 -0400
-@@ -43,7 +43,7 @@ static unsigned long get_unshared_area(u
- /* At this point: (!vma || addr < vma->vm_end). */
- if (TASK_SIZE - len < addr)
- return -ENOMEM;
-- if (!vma || addr + len <= vma->vm_start)
-+ if (check_heap_stack_gap(vma, addr, len))
- return addr;
- addr = vma->vm_end;
- }
-@@ -79,7 +79,7 @@ static unsigned long get_shared_area(str
- /* At this point: (!vma || addr < vma->vm_end). */
- if (TASK_SIZE - len < addr)
- return -ENOMEM;
-- if (!vma || addr + len <= vma->vm_start)
-+ if (check_heap_stack_gap(vma, addr, len))
- return addr;
- addr = DCACHE_ALIGN(vma->vm_end - offset) + offset;
- if (addr < vma->vm_end) /* handle wraparound */
-@@ -98,7 +98,7 @@ unsigned long arch_get_unmapped_area(str
- if (flags & MAP_FIXED)
- return addr;
- if (!addr)
-- addr = TASK_UNMAPPED_BASE;
-+ addr = current->mm->mmap_base;
-
- if (filp) {
- addr = get_shared_area(filp->f_mapping, addr, len, pgoff);
-diff -urNp linux-2.6.32.45/arch/parisc/kernel/traps.c linux-2.6.32.45/arch/parisc/kernel/traps.c
---- linux-2.6.32.45/arch/parisc/kernel/traps.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/parisc/kernel/traps.c 2011-04-17 15:56:45.000000000 -0400
-@@ -733,9 +733,7 @@ void notrace handle_interruption(int cod
-
- down_read(¤t->mm->mmap_sem);
- vma = find_vma(current->mm,regs->iaoq[0]);
-- if (vma && (regs->iaoq[0] >= vma->vm_start)
-- && (vma->vm_flags & VM_EXEC)) {
--
-+ if (vma && (regs->iaoq[0] >= vma->vm_start)) {
- fault_address = regs->iaoq[0];
- fault_space = regs->iasq[0];
-
-diff -urNp linux-2.6.32.45/arch/parisc/mm/fault.c linux-2.6.32.45/arch/parisc/mm/fault.c
---- linux-2.6.32.45/arch/parisc/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/parisc/mm/fault.c 2011-04-17 15:56:45.000000000 -0400
-@@ -15,6 +15,7 @@
- #include <linux/sched.h>
- #include <linux/interrupt.h>
- #include <linux/module.h>
-+#include <linux/unistd.h>
-
- #include <asm/uaccess.h>
- #include <asm/traps.h>
-@@ -52,7 +53,7 @@ DEFINE_PER_CPU(struct exception_data, ex
- static unsigned long
- parisc_acctyp(unsigned long code, unsigned int inst)
- {
-- if (code == 6 || code == 16)
-+ if (code == 6 || code == 7 || code == 16)
- return VM_EXEC;
-
- switch (inst & 0xf0000000) {
-@@ -138,6 +139,116 @@ parisc_acctyp(unsigned long code, unsign
- }
- #endif
-
-+#ifdef CONFIG_PAX_PAGEEXEC
-+/*
-+ * PaX: decide what to do with offenders (instruction_pointer(regs) = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ * 2 when rt_sigreturn trampoline was detected
-+ * 3 when unpatched PLT trampoline was detected
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+ int err;
-+
-+ do { /* PaX: unpatched PLT emulation */
-+ unsigned int bl, depwi;
-+
-+ err = get_user(bl, (unsigned int *)instruction_pointer(regs));
-+ err |= get_user(depwi, (unsigned int *)(instruction_pointer(regs)+4));
-+
-+ if (err)
-+ break;
-+
-+ if (bl == 0xEA9F1FDDU && depwi == 0xD6801C1EU) {
-+ unsigned int ldw, bv, ldw2, addr = instruction_pointer(regs)-12;
-+
-+ err = get_user(ldw, (unsigned int *)addr);
-+ err |= get_user(bv, (unsigned int *)(addr+4));
-+ err |= get_user(ldw2, (unsigned int *)(addr+8));
-+
-+ if (err)
-+ break;
-+
-+ if (ldw == 0x0E801096U &&
-+ bv == 0xEAC0C000U &&
-+ ldw2 == 0x0E881095U)
-+ {
-+ unsigned int resolver, map;
-+
-+ err = get_user(resolver, (unsigned int *)(instruction_pointer(regs)+8));
-+ err |= get_user(map, (unsigned int *)(instruction_pointer(regs)+12));
-+ if (err)
-+ break;
-+
-+ regs->gr[20] = instruction_pointer(regs)+8;
-+ regs->gr[21] = map;
-+ regs->gr[22] = resolver;
-+ regs->iaoq[0] = resolver | 3UL;
-+ regs->iaoq[1] = regs->iaoq[0] + 4;
-+ return 3;
-+ }
-+ }
-+ } while (0);
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+
-+#ifndef CONFIG_PAX_EMUSIGRT
-+ if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
-+ return 1;
-+#endif
-+
-+ do { /* PaX: rt_sigreturn emulation */
-+ unsigned int ldi1, ldi2, bel, nop;
-+
-+ err = get_user(ldi1, (unsigned int *)instruction_pointer(regs));
-+ err |= get_user(ldi2, (unsigned int *)(instruction_pointer(regs)+4));
-+ err |= get_user(bel, (unsigned int *)(instruction_pointer(regs)+8));
-+ err |= get_user(nop, (unsigned int *)(instruction_pointer(regs)+12));
-+
-+ if (err)
-+ break;
-+
-+ if ((ldi1 == 0x34190000U || ldi1 == 0x34190002U) &&
-+ ldi2 == 0x3414015AU &&
-+ bel == 0xE4008200U &&
-+ nop == 0x08000240U)
-+ {
-+ regs->gr[25] = (ldi1 & 2) >> 1;
-+ regs->gr[20] = __NR_rt_sigreturn;
-+ regs->gr[31] = regs->iaoq[1] + 16;
-+ regs->sr[0] = regs->iasq[1];
-+ regs->iaoq[0] = 0x100UL;
-+ regs->iaoq[1] = regs->iaoq[0] + 4;
-+ regs->iasq[0] = regs->sr[2];
-+ regs->iasq[1] = regs->sr[2];
-+ return 2;
-+ }
-+ } while (0);
-+#endif
-+
-+ return 1;
-+}
-+
-+void pax_report_insns(void *pc, void *sp)
-+{
-+ unsigned long i;
-+
-+ printk(KERN_ERR "PAX: bytes at PC: ");
-+ for (i = 0; i < 5; i++) {
-+ unsigned int c;
-+ if (get_user(c, (unsigned int *)pc+i))
-+ printk(KERN_CONT "???????? ");
-+ else
-+ printk(KERN_CONT "%08x ", c);
-+ }
-+ printk("\n");
-+}
-+#endif
-+
- int fixup_exception(struct pt_regs *regs)
- {
- const struct exception_table_entry *fix;
-@@ -192,8 +303,33 @@ good_area:
-
- acc_type = parisc_acctyp(code,regs->iir);
-
-- if ((vma->vm_flags & acc_type) != acc_type)
-+ if ((vma->vm_flags & acc_type) != acc_type) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && (acc_type & VM_EXEC) &&
-+ (address & ~3UL) == instruction_pointer(regs))
-+ {
-+ up_read(&mm->mmap_sem);
-+ switch (pax_handle_fetch_fault(regs)) {
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+ case 3:
-+ return;
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+ case 2:
-+ return;
-+#endif
-+
-+ }
-+ pax_report_fault(regs, (void *)instruction_pointer(regs), (void *)regs->gr[30]);
-+ do_group_exit(SIGKILL);
-+ }
-+#endif
-+
- goto bad_area;
-+ }
-
- /*
- * If for any reason at all we couldn't handle the fault, make
-diff -urNp linux-2.6.32.45/arch/powerpc/include/asm/device.h linux-2.6.32.45/arch/powerpc/include/asm/device.h
---- linux-2.6.32.45/arch/powerpc/include/asm/device.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/include/asm/device.h 2011-04-17 15:56:45.000000000 -0400
-@@ -14,7 +14,7 @@ struct dev_archdata {
- struct device_node *of_node;
-
- /* DMA operations on that device */
-- struct dma_map_ops *dma_ops;
-+ const struct dma_map_ops *dma_ops;
-
- /*
- * When an iommu is in use, dma_data is used as a ptr to the base of the
-diff -urNp linux-2.6.32.45/arch/powerpc/include/asm/dma-mapping.h linux-2.6.32.45/arch/powerpc/include/asm/dma-mapping.h
---- linux-2.6.32.45/arch/powerpc/include/asm/dma-mapping.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/include/asm/dma-mapping.h 2011-04-17 15:56:45.000000000 -0400
-@@ -69,9 +69,9 @@ static inline unsigned long device_to_ma
- #ifdef CONFIG_PPC64
- extern struct dma_map_ops dma_iommu_ops;
- #endif
--extern struct dma_map_ops dma_direct_ops;
-+extern const struct dma_map_ops dma_direct_ops;
-
--static inline struct dma_map_ops *get_dma_ops(struct device *dev)
-+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
- {
- /* We don't handle the NULL dev case for ISA for now. We could
- * do it via an out of line call but it is not needed for now. The
-@@ -84,7 +84,7 @@ static inline struct dma_map_ops *get_dm
- return dev->archdata.dma_ops;
- }
-
--static inline void set_dma_ops(struct device *dev, struct dma_map_ops *ops)
-+static inline void set_dma_ops(struct device *dev, const struct dma_map_ops *ops)
- {
- dev->archdata.dma_ops = ops;
- }
-@@ -118,7 +118,7 @@ static inline void set_dma_offset(struct
-
- static inline int dma_supported(struct device *dev, u64 mask)
- {
-- struct dma_map_ops *dma_ops = get_dma_ops(dev);
-+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
-
- if (unlikely(dma_ops == NULL))
- return 0;
-@@ -132,7 +132,7 @@ static inline int dma_supported(struct d
-
- static inline int dma_set_mask(struct device *dev, u64 dma_mask)
- {
-- struct dma_map_ops *dma_ops = get_dma_ops(dev);
-+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
-
- if (unlikely(dma_ops == NULL))
- return -EIO;
-@@ -147,7 +147,7 @@ static inline int dma_set_mask(struct de
- static inline void *dma_alloc_coherent(struct device *dev, size_t size,
- dma_addr_t *dma_handle, gfp_t flag)
- {
-- struct dma_map_ops *dma_ops = get_dma_ops(dev);
-+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
- void *cpu_addr;
-
- BUG_ON(!dma_ops);
-@@ -162,7 +162,7 @@ static inline void *dma_alloc_coherent(s
- static inline void dma_free_coherent(struct device *dev, size_t size,
- void *cpu_addr, dma_addr_t dma_handle)
- {
-- struct dma_map_ops *dma_ops = get_dma_ops(dev);
-+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
-
- BUG_ON(!dma_ops);
-
-@@ -173,7 +173,7 @@ static inline void dma_free_coherent(str
-
- static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
- {
-- struct dma_map_ops *dma_ops = get_dma_ops(dev);
-+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
-
- if (dma_ops->mapping_error)
- return dma_ops->mapping_error(dev, dma_addr);
-diff -urNp linux-2.6.32.45/arch/powerpc/include/asm/elf.h linux-2.6.32.45/arch/powerpc/include/asm/elf.h
---- linux-2.6.32.45/arch/powerpc/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
-@@ -179,8 +179,19 @@ typedef elf_fpreg_t elf_vsrreghalf_t32[E
- the loader. We need to make sure that it is out of the way of the program
- that it will "exec", and that there is sufficient room for the brk. */
-
--extern unsigned long randomize_et_dyn(unsigned long base);
--#define ELF_ET_DYN_BASE (randomize_et_dyn(0x20000000))
-+#define ELF_ET_DYN_BASE (0x20000000)
-+
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE (0x10000000UL)
-+
-+#ifdef __powerpc64__
-+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT) ? 16 : 28)
-+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT) ? 16 : 28)
-+#else
-+#define PAX_DELTA_MMAP_LEN 15
-+#define PAX_DELTA_STACK_LEN 15
-+#endif
-+#endif
-
- /*
- * Our registers are always unsigned longs, whether we're a 32 bit
-@@ -275,9 +286,6 @@ extern int arch_setup_additional_pages(s
- (0x7ff >> (PAGE_SHIFT - 12)) : \
- (0x3ffff >> (PAGE_SHIFT - 12)))
-
--extern unsigned long arch_randomize_brk(struct mm_struct *mm);
--#define arch_randomize_brk arch_randomize_brk
--
- #endif /* __KERNEL__ */
-
- /*
-diff -urNp linux-2.6.32.45/arch/powerpc/include/asm/iommu.h linux-2.6.32.45/arch/powerpc/include/asm/iommu.h
---- linux-2.6.32.45/arch/powerpc/include/asm/iommu.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/include/asm/iommu.h 2011-04-17 15:56:45.000000000 -0400
-@@ -116,6 +116,9 @@ extern void iommu_init_early_iSeries(voi
- extern void iommu_init_early_dart(void);
- extern void iommu_init_early_pasemi(void);
-
-+/* dma-iommu.c */
-+extern int dma_iommu_dma_supported(struct device *dev, u64 mask);
-+
- #ifdef CONFIG_PCI
- extern void pci_iommu_init(void);
- extern void pci_direct_iommu_init(void);
-diff -urNp linux-2.6.32.45/arch/powerpc/include/asm/kmap_types.h linux-2.6.32.45/arch/powerpc/include/asm/kmap_types.h
---- linux-2.6.32.45/arch/powerpc/include/asm/kmap_types.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/include/asm/kmap_types.h 2011-04-17 15:56:45.000000000 -0400
-@@ -26,6 +26,7 @@ enum km_type {
- KM_SOFTIRQ1,
- KM_PPC_SYNC_PAGE,
- KM_PPC_SYNC_ICACHE,
-+ KM_CLEARPAGE,
- KM_TYPE_NR
- };
-
-diff -urNp linux-2.6.32.45/arch/powerpc/include/asm/page_64.h linux-2.6.32.45/arch/powerpc/include/asm/page_64.h
---- linux-2.6.32.45/arch/powerpc/include/asm/page_64.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/include/asm/page_64.h 2011-04-17 15:56:45.000000000 -0400
-@@ -180,15 +180,18 @@ do { \
- * stack by default, so in the absense of a PT_GNU_STACK program header
- * we turn execute permission off.
- */
--#define VM_STACK_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
-- VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-+#define VM_STACK_DEFAULT_FLAGS32 \
-+ (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
-+ VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-
- #define VM_STACK_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
- VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-
-+#ifndef CONFIG_PAX_PAGEEXEC
- #define VM_STACK_DEFAULT_FLAGS \
- (test_thread_flag(TIF_32BIT) ? \
- VM_STACK_DEFAULT_FLAGS32 : VM_STACK_DEFAULT_FLAGS64)
-+#endif
-
- #include <asm-generic/getorder.h>
-
-diff -urNp linux-2.6.32.45/arch/powerpc/include/asm/page.h linux-2.6.32.45/arch/powerpc/include/asm/page.h
---- linux-2.6.32.45/arch/powerpc/include/asm/page.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/include/asm/page.h 2011-08-21 16:07:39.000000000 -0400
-@@ -116,8 +116,9 @@ extern phys_addr_t kernstart_addr;
- * and needs to be executable. This means the whole heap ends
- * up being executable.
- */
--#define VM_DATA_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
-- VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-+#define VM_DATA_DEFAULT_FLAGS32 \
-+ (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
-+ VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-
- #define VM_DATA_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
- VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-@@ -145,6 +146,9 @@ extern phys_addr_t kernstart_addr;
- #define is_kernel_addr(x) ((x) >= PAGE_OFFSET)
- #endif
-
-+#define ktla_ktva(addr) (addr)
-+#define ktva_ktla(addr) (addr)
-+
- #ifndef __ASSEMBLY__
-
- #undef STRICT_MM_TYPECHECKS
-diff -urNp linux-2.6.32.45/arch/powerpc/include/asm/pci.h linux-2.6.32.45/arch/powerpc/include/asm/pci.h
---- linux-2.6.32.45/arch/powerpc/include/asm/pci.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/include/asm/pci.h 2011-04-17 15:56:45.000000000 -0400
-@@ -65,8 +65,8 @@ static inline int pci_get_legacy_ide_irq
- }
-
- #ifdef CONFIG_PCI
--extern void set_pci_dma_ops(struct dma_map_ops *dma_ops);
--extern struct dma_map_ops *get_pci_dma_ops(void);
-+extern void set_pci_dma_ops(const struct dma_map_ops *dma_ops);
-+extern const struct dma_map_ops *get_pci_dma_ops(void);
- #else /* CONFIG_PCI */
- #define set_pci_dma_ops(d)
- #define get_pci_dma_ops() NULL
-diff -urNp linux-2.6.32.45/arch/powerpc/include/asm/pgtable.h linux-2.6.32.45/arch/powerpc/include/asm/pgtable.h
---- linux-2.6.32.45/arch/powerpc/include/asm/pgtable.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/include/asm/pgtable.h 2011-04-17 15:56:45.000000000 -0400
-@@ -2,6 +2,7 @@
- #define _ASM_POWERPC_PGTABLE_H
- #ifdef __KERNEL__
-
-+#include <linux/const.h>
- #ifndef __ASSEMBLY__
- #include <asm/processor.h> /* For TASK_SIZE */
- #include <asm/mmu.h>
-diff -urNp linux-2.6.32.45/arch/powerpc/include/asm/pte-hash32.h linux-2.6.32.45/arch/powerpc/include/asm/pte-hash32.h
---- linux-2.6.32.45/arch/powerpc/include/asm/pte-hash32.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/include/asm/pte-hash32.h 2011-04-17 15:56:45.000000000 -0400
-@@ -21,6 +21,7 @@
- #define _PAGE_FILE 0x004 /* when !present: nonlinear file mapping */
- #define _PAGE_USER 0x004 /* usermode access allowed */
- #define _PAGE_GUARDED 0x008 /* G: prohibit speculative access */
-+#define _PAGE_EXEC _PAGE_GUARDED
- #define _PAGE_COHERENT 0x010 /* M: enforce memory coherence (SMP systems) */
- #define _PAGE_NO_CACHE 0x020 /* I: cache inhibit */
- #define _PAGE_WRITETHRU 0x040 /* W: cache write-through */
-diff -urNp linux-2.6.32.45/arch/powerpc/include/asm/ptrace.h linux-2.6.32.45/arch/powerpc/include/asm/ptrace.h
---- linux-2.6.32.45/arch/powerpc/include/asm/ptrace.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/include/asm/ptrace.h 2011-08-21 15:53:58.000000000 -0400
-@@ -103,7 +103,7 @@ extern unsigned long profile_pc(struct p
- } while(0)
-
- struct task_struct;
--extern unsigned long ptrace_get_reg(struct task_struct *task, int regno);
-+extern unsigned long ptrace_get_reg(struct task_struct *task, unsigned int regno);
- extern int ptrace_put_reg(struct task_struct *task, int regno,
- unsigned long data);
-
-diff -urNp linux-2.6.32.45/arch/powerpc/include/asm/reg.h linux-2.6.32.45/arch/powerpc/include/asm/reg.h
---- linux-2.6.32.45/arch/powerpc/include/asm/reg.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/include/asm/reg.h 2011-04-17 15:56:45.000000000 -0400
-@@ -191,6 +191,7 @@
- #define SPRN_DBCR 0x136 /* e300 Data Breakpoint Control Reg */
- #define SPRN_DSISR 0x012 /* Data Storage Interrupt Status Register */
- #define DSISR_NOHPTE 0x40000000 /* no translation found */
-+#define DSISR_GUARDED 0x10000000 /* fetch from guarded storage */
- #define DSISR_PROTFAULT 0x08000000 /* protection fault */
- #define DSISR_ISSTORE 0x02000000 /* access was a store */
- #define DSISR_DABRMATCH 0x00400000 /* hit data breakpoint */
-diff -urNp linux-2.6.32.45/arch/powerpc/include/asm/swiotlb.h linux-2.6.32.45/arch/powerpc/include/asm/swiotlb.h
---- linux-2.6.32.45/arch/powerpc/include/asm/swiotlb.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/include/asm/swiotlb.h 2011-04-17 15:56:45.000000000 -0400
-@@ -13,7 +13,7 @@
-
- #include <linux/swiotlb.h>
-
--extern struct dma_map_ops swiotlb_dma_ops;
-+extern const struct dma_map_ops swiotlb_dma_ops;
-
- static inline void dma_mark_clean(void *addr, size_t size) {}
-
-diff -urNp linux-2.6.32.45/arch/powerpc/include/asm/system.h linux-2.6.32.45/arch/powerpc/include/asm/system.h
---- linux-2.6.32.45/arch/powerpc/include/asm/system.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/include/asm/system.h 2011-04-17 15:56:45.000000000 -0400
-@@ -531,7 +531,7 @@ __cmpxchg_local(volatile void *ptr, unsi
- #define cmpxchg64_local(ptr, o, n) __cmpxchg64_local_generic((ptr), (o), (n))
- #endif
-
--extern unsigned long arch_align_stack(unsigned long sp);
-+#define arch_align_stack(x) ((x) & ~0xfUL)
-
- /* Used in very early kernel initialization. */
- extern unsigned long reloc_offset(void);
-diff -urNp linux-2.6.32.45/arch/powerpc/include/asm/uaccess.h linux-2.6.32.45/arch/powerpc/include/asm/uaccess.h
---- linux-2.6.32.45/arch/powerpc/include/asm/uaccess.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/include/asm/uaccess.h 2011-04-17 15:56:45.000000000 -0400
-@@ -13,6 +13,8 @@
- #define VERIFY_READ 0
- #define VERIFY_WRITE 1
-
-+extern void check_object_size(const void *ptr, unsigned long n, bool to);
-+
- /*
- * The fs value determines whether argument validity checking should be
- * performed or not. If get_fs() == USER_DS, checking is performed, with
-@@ -327,52 +329,6 @@ do { \
- extern unsigned long __copy_tofrom_user(void __user *to,
- const void __user *from, unsigned long size);
-
--#ifndef __powerpc64__
--
--static inline unsigned long copy_from_user(void *to,
-- const void __user *from, unsigned long n)
--{
-- unsigned long over;
--
-- if (access_ok(VERIFY_READ, from, n))
-- return __copy_tofrom_user((__force void __user *)to, from, n);
-- if ((unsigned long)from < TASK_SIZE) {
-- over = (unsigned long)from + n - TASK_SIZE;
-- return __copy_tofrom_user((__force void __user *)to, from,
-- n - over) + over;
-- }
-- return n;
--}
--
--static inline unsigned long copy_to_user(void __user *to,
-- const void *from, unsigned long n)
--{
-- unsigned long over;
--
-- if (access_ok(VERIFY_WRITE, to, n))
-- return __copy_tofrom_user(to, (__force void __user *)from, n);
-- if ((unsigned long)to < TASK_SIZE) {
-- over = (unsigned long)to + n - TASK_SIZE;
-- return __copy_tofrom_user(to, (__force void __user *)from,
-- n - over) + over;
-- }
-- return n;
--}
--
--#else /* __powerpc64__ */
--
--#define __copy_in_user(to, from, size) \
-- __copy_tofrom_user((to), (from), (size))
--
--extern unsigned long copy_from_user(void *to, const void __user *from,
-- unsigned long n);
--extern unsigned long copy_to_user(void __user *to, const void *from,
-- unsigned long n);
--extern unsigned long copy_in_user(void __user *to, const void __user *from,
-- unsigned long n);
--
--#endif /* __powerpc64__ */
--
- static inline unsigned long __copy_from_user_inatomic(void *to,
- const void __user *from, unsigned long n)
- {
-@@ -396,6 +352,10 @@ static inline unsigned long __copy_from_
- if (ret == 0)
- return 0;
- }
-+
-+ if (!__builtin_constant_p(n))
-+ check_object_size(to, n, false);
-+
- return __copy_tofrom_user((__force void __user *)to, from, n);
- }
-
-@@ -422,6 +382,10 @@ static inline unsigned long __copy_to_us
- if (ret == 0)
- return 0;
- }
-+
-+ if (!__builtin_constant_p(n))
-+ check_object_size(from, n, true);
-+
- return __copy_tofrom_user(to, (__force const void __user *)from, n);
- }
-
-@@ -439,6 +403,92 @@ static inline unsigned long __copy_to_us
- return __copy_to_user_inatomic(to, from, size);
- }
-
-+#ifndef __powerpc64__
-+
-+static inline unsigned long __must_check copy_from_user(void *to,
-+ const void __user *from, unsigned long n)
-+{
-+ unsigned long over;
-+
-+ if ((long)n < 0)
-+ return n;
-+
-+ if (access_ok(VERIFY_READ, from, n)) {
-+ if (!__builtin_constant_p(n))
-+ check_object_size(to, n, false);
-+ return __copy_tofrom_user((__force void __user *)to, from, n);
-+ }
-+ if ((unsigned long)from < TASK_SIZE) {
-+ over = (unsigned long)from + n - TASK_SIZE;
-+ if (!__builtin_constant_p(n - over))
-+ check_object_size(to, n - over, false);
-+ return __copy_tofrom_user((__force void __user *)to, from,
-+ n - over) + over;
-+ }
-+ return n;
-+}
-+
-+static inline unsigned long __must_check copy_to_user(void __user *to,
-+ const void *from, unsigned long n)
-+{
-+ unsigned long over;
-+
-+ if ((long)n < 0)
-+ return n;
-+
-+ if (access_ok(VERIFY_WRITE, to, n)) {
-+ if (!__builtin_constant_p(n))
-+ check_object_size(from, n, true);
-+ return __copy_tofrom_user(to, (__force void __user *)from, n);
-+ }
-+ if ((unsigned long)to < TASK_SIZE) {
-+ over = (unsigned long)to + n - TASK_SIZE;
-+ if (!__builtin_constant_p(n))
-+ check_object_size(from, n - over, true);
-+ return __copy_tofrom_user(to, (__force void __user *)from,
-+ n - over) + over;
-+ }
-+ return n;
-+}
-+
-+#else /* __powerpc64__ */
-+
-+#define __copy_in_user(to, from, size) \
-+ __copy_tofrom_user((to), (from), (size))
-+
-+static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
-+{
-+ if ((long)n < 0 || n > INT_MAX)
-+ return n;
-+
-+ if (!__builtin_constant_p(n))
-+ check_object_size(to, n, false);
-+
-+ if (likely(access_ok(VERIFY_READ, from, n)))
-+ n = __copy_from_user(to, from, n);
-+ else
-+ memset(to, 0, n);
-+ return n;
-+}
-+
-+static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
-+{
-+ if ((long)n < 0 || n > INT_MAX)
-+ return n;
-+
-+ if (likely(access_ok(VERIFY_WRITE, to, n))) {
-+ if (!__builtin_constant_p(n))
-+ check_object_size(from, n, true);
-+ n = __copy_to_user(to, from, n);
-+ }
-+ return n;
-+}
-+
-+extern unsigned long copy_in_user(void __user *to, const void __user *from,
-+ unsigned long n);
-+
-+#endif /* __powerpc64__ */
-+
- extern unsigned long __clear_user(void __user *addr, unsigned long size);
-
- static inline unsigned long clear_user(void __user *addr, unsigned long size)
-diff -urNp linux-2.6.32.45/arch/powerpc/kernel/cacheinfo.c linux-2.6.32.45/arch/powerpc/kernel/cacheinfo.c
---- linux-2.6.32.45/arch/powerpc/kernel/cacheinfo.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/kernel/cacheinfo.c 2011-04-17 15:56:45.000000000 -0400
-@@ -642,7 +642,7 @@ static struct kobj_attribute *cache_inde
- &cache_assoc_attr,
- };
-
--static struct sysfs_ops cache_index_ops = {
-+static const struct sysfs_ops cache_index_ops = {
- .show = cache_index_show,
- };
-
-diff -urNp linux-2.6.32.45/arch/powerpc/kernel/dma.c linux-2.6.32.45/arch/powerpc/kernel/dma.c
---- linux-2.6.32.45/arch/powerpc/kernel/dma.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/kernel/dma.c 2011-04-17 15:56:45.000000000 -0400
-@@ -134,7 +134,7 @@ static inline void dma_direct_sync_singl
- }
- #endif
-
--struct dma_map_ops dma_direct_ops = {
-+const struct dma_map_ops dma_direct_ops = {
- .alloc_coherent = dma_direct_alloc_coherent,
- .free_coherent = dma_direct_free_coherent,
- .map_sg = dma_direct_map_sg,
-diff -urNp linux-2.6.32.45/arch/powerpc/kernel/dma-iommu.c linux-2.6.32.45/arch/powerpc/kernel/dma-iommu.c
---- linux-2.6.32.45/arch/powerpc/kernel/dma-iommu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/kernel/dma-iommu.c 2011-04-17 15:56:45.000000000 -0400
-@@ -70,7 +70,7 @@ static void dma_iommu_unmap_sg(struct de
- }
-
- /* We support DMA to/from any memory page via the iommu */
--static int dma_iommu_dma_supported(struct device *dev, u64 mask)
-+int dma_iommu_dma_supported(struct device *dev, u64 mask)
- {
- struct iommu_table *tbl = get_iommu_table_base(dev);
-
-diff -urNp linux-2.6.32.45/arch/powerpc/kernel/dma-swiotlb.c linux-2.6.32.45/arch/powerpc/kernel/dma-swiotlb.c
---- linux-2.6.32.45/arch/powerpc/kernel/dma-swiotlb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/kernel/dma-swiotlb.c 2011-04-17 15:56:45.000000000 -0400
-@@ -31,7 +31,7 @@ unsigned int ppc_swiotlb_enable;
- * map_page, and unmap_page on highmem, use normal dma_ops
- * for everything else.
- */
--struct dma_map_ops swiotlb_dma_ops = {
-+const struct dma_map_ops swiotlb_dma_ops = {
- .alloc_coherent = dma_direct_alloc_coherent,
- .free_coherent = dma_direct_free_coherent,
- .map_sg = swiotlb_map_sg_attrs,
-diff -urNp linux-2.6.32.45/arch/powerpc/kernel/exceptions-64e.S linux-2.6.32.45/arch/powerpc/kernel/exceptions-64e.S
---- linux-2.6.32.45/arch/powerpc/kernel/exceptions-64e.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/kernel/exceptions-64e.S 2011-04-17 15:56:45.000000000 -0400
-@@ -455,6 +455,7 @@ storage_fault_common:
- std r14,_DAR(r1)
- std r15,_DSISR(r1)
- addi r3,r1,STACK_FRAME_OVERHEAD
-+ bl .save_nvgprs
- mr r4,r14
- mr r5,r15
- ld r14,PACA_EXGEN+EX_R14(r13)
-@@ -464,8 +465,7 @@ storage_fault_common:
- cmpdi r3,0
- bne- 1f
- b .ret_from_except_lite
--1: bl .save_nvgprs
-- mr r5,r3
-+1: mr r5,r3
- addi r3,r1,STACK_FRAME_OVERHEAD
- ld r4,_DAR(r1)
- bl .bad_page_fault
-diff -urNp linux-2.6.32.45/arch/powerpc/kernel/exceptions-64s.S linux-2.6.32.45/arch/powerpc/kernel/exceptions-64s.S
---- linux-2.6.32.45/arch/powerpc/kernel/exceptions-64s.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/kernel/exceptions-64s.S 2011-04-17 15:56:45.000000000 -0400
-@@ -818,10 +818,10 @@ handle_page_fault:
- 11: ld r4,_DAR(r1)
- ld r5,_DSISR(r1)
- addi r3,r1,STACK_FRAME_OVERHEAD
-+ bl .save_nvgprs
- bl .do_page_fault
- cmpdi r3,0
- beq+ 13f
-- bl .save_nvgprs
- mr r5,r3
- addi r3,r1,STACK_FRAME_OVERHEAD
- lwz r4,_DAR(r1)
-diff -urNp linux-2.6.32.45/arch/powerpc/kernel/ibmebus.c linux-2.6.32.45/arch/powerpc/kernel/ibmebus.c
---- linux-2.6.32.45/arch/powerpc/kernel/ibmebus.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/kernel/ibmebus.c 2011-04-17 15:56:45.000000000 -0400
-@@ -127,7 +127,7 @@ static int ibmebus_dma_supported(struct
- return 1;
- }
-
--static struct dma_map_ops ibmebus_dma_ops = {
-+static const struct dma_map_ops ibmebus_dma_ops = {
- .alloc_coherent = ibmebus_alloc_coherent,
- .free_coherent = ibmebus_free_coherent,
- .map_sg = ibmebus_map_sg,
-diff -urNp linux-2.6.32.45/arch/powerpc/kernel/kgdb.c linux-2.6.32.45/arch/powerpc/kernel/kgdb.c
---- linux-2.6.32.45/arch/powerpc/kernel/kgdb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/kernel/kgdb.c 2011-04-17 15:56:45.000000000 -0400
-@@ -126,7 +126,7 @@ static int kgdb_handle_breakpoint(struct
- if (kgdb_handle_exception(0, SIGTRAP, 0, regs) != 0)
- return 0;
-
-- if (*(u32 *) (regs->nip) == *(u32 *) (&arch_kgdb_ops.gdb_bpt_instr))
-+ if (*(u32 *) (regs->nip) == *(const u32 *) (&arch_kgdb_ops.gdb_bpt_instr))
- regs->nip += 4;
-
- return 1;
-@@ -353,7 +353,7 @@ int kgdb_arch_handle_exception(int vecto
- /*
- * Global data
- */
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- .gdb_bpt_instr = {0x7d, 0x82, 0x10, 0x08},
- };
-
-diff -urNp linux-2.6.32.45/arch/powerpc/kernel/module_32.c linux-2.6.32.45/arch/powerpc/kernel/module_32.c
---- linux-2.6.32.45/arch/powerpc/kernel/module_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/kernel/module_32.c 2011-04-17 15:56:45.000000000 -0400
-@@ -162,7 +162,7 @@ int module_frob_arch_sections(Elf32_Ehdr
- me->arch.core_plt_section = i;
- }
- if (!me->arch.core_plt_section || !me->arch.init_plt_section) {
-- printk("Module doesn't contain .plt or .init.plt sections.\n");
-+ printk("Module %s doesn't contain .plt or .init.plt sections.\n", me->name);
- return -ENOEXEC;
- }
-
-@@ -203,11 +203,16 @@ static uint32_t do_plt_call(void *locati
-
- DEBUGP("Doing plt for call to 0x%x at 0x%x\n", val, (unsigned int)location);
- /* Init, or core PLT? */
-- if (location >= mod->module_core
-- && location < mod->module_core + mod->core_size)
-+ if ((location >= mod->module_core_rx && location < mod->module_core_rx + mod->core_size_rx) ||
-+ (location >= mod->module_core_rw && location < mod->module_core_rw + mod->core_size_rw))
- entry = (void *)sechdrs[mod->arch.core_plt_section].sh_addr;
-- else
-+ else if ((location >= mod->module_init_rx && location < mod->module_init_rx + mod->init_size_rx) ||
-+ (location >= mod->module_init_rw && location < mod->module_init_rw + mod->init_size_rw))
- entry = (void *)sechdrs[mod->arch.init_plt_section].sh_addr;
-+ else {
-+ printk(KERN_ERR "%s: invalid R_PPC_REL24 entry found\n", mod->name);
-+ return ~0UL;
-+ }
-
- /* Find this entry, or if that fails, the next avail. entry */
- while (entry->jump[0]) {
-diff -urNp linux-2.6.32.45/arch/powerpc/kernel/module.c linux-2.6.32.45/arch/powerpc/kernel/module.c
---- linux-2.6.32.45/arch/powerpc/kernel/module.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/kernel/module.c 2011-04-17 15:56:45.000000000 -0400
-@@ -31,11 +31,24 @@
-
- LIST_HEAD(module_bug_list);
-
-+#ifdef CONFIG_PAX_KERNEXEC
- void *module_alloc(unsigned long size)
- {
- if (size == 0)
- return NULL;
-
-+ return vmalloc(size);
-+}
-+
-+void *module_alloc_exec(unsigned long size)
-+#else
-+void *module_alloc(unsigned long size)
-+#endif
-+
-+{
-+ if (size == 0)
-+ return NULL;
-+
- return vmalloc_exec(size);
- }
-
-@@ -45,6 +58,13 @@ void module_free(struct module *mod, voi
- vfree(module_region);
- }
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+void module_free_exec(struct module *mod, void *module_region)
-+{
-+ module_free(mod, module_region);
-+}
-+#endif
-+
- static const Elf_Shdr *find_section(const Elf_Ehdr *hdr,
- const Elf_Shdr *sechdrs,
- const char *name)
-diff -urNp linux-2.6.32.45/arch/powerpc/kernel/pci-common.c linux-2.6.32.45/arch/powerpc/kernel/pci-common.c
---- linux-2.6.32.45/arch/powerpc/kernel/pci-common.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/kernel/pci-common.c 2011-04-17 15:56:45.000000000 -0400
-@@ -50,14 +50,14 @@ resource_size_t isa_mem_base;
- unsigned int ppc_pci_flags = 0;
-
-
--static struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
-+static const struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
-
--void set_pci_dma_ops(struct dma_map_ops *dma_ops)
-+void set_pci_dma_ops(const struct dma_map_ops *dma_ops)
- {
- pci_dma_ops = dma_ops;
- }
-
--struct dma_map_ops *get_pci_dma_ops(void)
-+const struct dma_map_ops *get_pci_dma_ops(void)
- {
- return pci_dma_ops;
- }
-diff -urNp linux-2.6.32.45/arch/powerpc/kernel/process.c linux-2.6.32.45/arch/powerpc/kernel/process.c
---- linux-2.6.32.45/arch/powerpc/kernel/process.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/kernel/process.c 2011-04-17 15:56:45.000000000 -0400
-@@ -539,8 +539,8 @@ void show_regs(struct pt_regs * regs)
- * Lookup NIP late so we have the best change of getting the
- * above info out without failing
- */
-- printk("NIP ["REG"] %pS\n", regs->nip, (void *)regs->nip);
-- printk("LR ["REG"] %pS\n", regs->link, (void *)regs->link);
-+ printk("NIP ["REG"] %pA\n", regs->nip, (void *)regs->nip);
-+ printk("LR ["REG"] %pA\n", regs->link, (void *)regs->link);
- #endif
- show_stack(current, (unsigned long *) regs->gpr[1]);
- if (!user_mode(regs))
-@@ -1034,10 +1034,10 @@ void show_stack(struct task_struct *tsk,
- newsp = stack[0];
- ip = stack[STACK_FRAME_LR_SAVE];
- if (!firstframe || ip != lr) {
-- printk("["REG"] ["REG"] %pS", sp, ip, (void *)ip);
-+ printk("["REG"] ["REG"] %pA", sp, ip, (void *)ip);
- #ifdef CONFIG_FUNCTION_GRAPH_TRACER
- if ((ip == rth || ip == mrth) && curr_frame >= 0) {
-- printk(" (%pS)",
-+ printk(" (%pA)",
- (void *)current->ret_stack[curr_frame].ret);
- curr_frame--;
- }
-@@ -1057,7 +1057,7 @@ void show_stack(struct task_struct *tsk,
- struct pt_regs *regs = (struct pt_regs *)
- (sp + STACK_FRAME_OVERHEAD);
- lr = regs->link;
-- printk("--- Exception: %lx at %pS\n LR = %pS\n",
-+ printk("--- Exception: %lx at %pA\n LR = %pA\n",
- regs->trap, (void *)regs->nip, (void *)lr);
- firstframe = 1;
- }
-@@ -1134,58 +1134,3 @@ void thread_info_cache_init(void)
- }
-
- #endif /* THREAD_SHIFT < PAGE_SHIFT */
--
--unsigned long arch_align_stack(unsigned long sp)
--{
-- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
-- sp -= get_random_int() & ~PAGE_MASK;
-- return sp & ~0xf;
--}
--
--static inline unsigned long brk_rnd(void)
--{
-- unsigned long rnd = 0;
--
-- /* 8MB for 32bit, 1GB for 64bit */
-- if (is_32bit_task())
-- rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
-- else
-- rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
--
-- return rnd << PAGE_SHIFT;
--}
--
--unsigned long arch_randomize_brk(struct mm_struct *mm)
--{
-- unsigned long base = mm->brk;
-- unsigned long ret;
--
--#ifdef CONFIG_PPC_STD_MMU_64
-- /*
-- * If we are using 1TB segments and we are allowed to randomise
-- * the heap, we can put it above 1TB so it is backed by a 1TB
-- * segment. Otherwise the heap will be in the bottom 1TB
-- * which always uses 256MB segments and this may result in a
-- * performance penalty.
-- */
-- if (!is_32bit_task() && (mmu_highuser_ssize == MMU_SEGSIZE_1T))
-- base = max_t(unsigned long, mm->brk, 1UL << SID_SHIFT_1T);
--#endif
--
-- ret = PAGE_ALIGN(base + brk_rnd());
--
-- if (ret < mm->brk)
-- return mm->brk;
--
-- return ret;
--}
--
--unsigned long randomize_et_dyn(unsigned long base)
--{
-- unsigned long ret = PAGE_ALIGN(base + brk_rnd());
--
-- if (ret < base)
-- return base;
--
-- return ret;
--}
-diff -urNp linux-2.6.32.45/arch/powerpc/kernel/ptrace.c linux-2.6.32.45/arch/powerpc/kernel/ptrace.c
---- linux-2.6.32.45/arch/powerpc/kernel/ptrace.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/kernel/ptrace.c 2011-08-21 15:53:39.000000000 -0400
-@@ -86,7 +86,7 @@ static int set_user_trap(struct task_str
- /*
- * Get contents of register REGNO in task TASK.
- */
--unsigned long ptrace_get_reg(struct task_struct *task, int regno)
-+unsigned long ptrace_get_reg(struct task_struct *task, unsigned int regno)
- {
- if (task->thread.regs == NULL)
- return -EIO;
-@@ -894,7 +894,7 @@ long arch_ptrace(struct task_struct *chi
-
- CHECK_FULL_REGS(child->thread.regs);
- if (index < PT_FPR0) {
-- tmp = ptrace_get_reg(child, (int) index);
-+ tmp = ptrace_get_reg(child, index);
- } else {
- flush_fp_to_thread(child);
- tmp = ((unsigned long *)child->thread.fpr)
-diff -urNp linux-2.6.32.45/arch/powerpc/kernel/signal_32.c linux-2.6.32.45/arch/powerpc/kernel/signal_32.c
---- linux-2.6.32.45/arch/powerpc/kernel/signal_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/kernel/signal_32.c 2011-04-17 15:56:45.000000000 -0400
-@@ -857,7 +857,7 @@ int handle_rt_signal32(unsigned long sig
- /* Save user registers on the stack */
- frame = &rt_sf->uc.uc_mcontext;
- addr = frame;
-- if (vdso32_rt_sigtramp && current->mm->context.vdso_base) {
-+ if (vdso32_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
- if (save_user_regs(regs, frame, 0, 1))
- goto badframe;
- regs->link = current->mm->context.vdso_base + vdso32_rt_sigtramp;
-diff -urNp linux-2.6.32.45/arch/powerpc/kernel/signal_64.c linux-2.6.32.45/arch/powerpc/kernel/signal_64.c
---- linux-2.6.32.45/arch/powerpc/kernel/signal_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/kernel/signal_64.c 2011-04-17 15:56:45.000000000 -0400
-@@ -429,7 +429,7 @@ int handle_rt_signal64(int signr, struct
- current->thread.fpscr.val = 0;
-
- /* Set up to return from userspace. */
-- if (vdso64_rt_sigtramp && current->mm->context.vdso_base) {
-+ if (vdso64_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
- regs->link = current->mm->context.vdso_base + vdso64_rt_sigtramp;
- } else {
- err |= setup_trampoline(__NR_rt_sigreturn, &frame->tramp[0]);
-diff -urNp linux-2.6.32.45/arch/powerpc/kernel/sys_ppc32.c linux-2.6.32.45/arch/powerpc/kernel/sys_ppc32.c
---- linux-2.6.32.45/arch/powerpc/kernel/sys_ppc32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/kernel/sys_ppc32.c 2011-04-17 15:56:45.000000000 -0400
-@@ -563,10 +563,10 @@ asmlinkage long compat_sys_sysctl(struct
- if (oldlenp) {
- if (!error) {
- if (get_user(oldlen, oldlenp) ||
-- put_user(oldlen, (compat_size_t __user *)compat_ptr(tmp.oldlenp)))
-+ put_user(oldlen, (compat_size_t __user *)compat_ptr(tmp.oldlenp)) ||
-+ copy_to_user(args->__unused, tmp.__unused, sizeof(tmp.__unused)))
- error = -EFAULT;
- }
-- copy_to_user(args->__unused, tmp.__unused, sizeof(tmp.__unused));
- }
- return error;
- }
-diff -urNp linux-2.6.32.45/arch/powerpc/kernel/traps.c linux-2.6.32.45/arch/powerpc/kernel/traps.c
---- linux-2.6.32.45/arch/powerpc/kernel/traps.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/kernel/traps.c 2011-06-13 21:33:37.000000000 -0400
-@@ -99,6 +99,8 @@ static void pmac_backlight_unblank(void)
- static inline void pmac_backlight_unblank(void) { }
- #endif
-
-+extern void gr_handle_kernel_exploit(void);
-+
- int die(const char *str, struct pt_regs *regs, long err)
- {
- static struct {
-@@ -168,6 +170,8 @@ int die(const char *str, struct pt_regs
- if (panic_on_oops)
- panic("Fatal exception");
-
-+ gr_handle_kernel_exploit();
-+
- oops_exit();
- do_exit(err);
-
-diff -urNp linux-2.6.32.45/arch/powerpc/kernel/vdso.c linux-2.6.32.45/arch/powerpc/kernel/vdso.c
---- linux-2.6.32.45/arch/powerpc/kernel/vdso.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/kernel/vdso.c 2011-04-17 15:56:45.000000000 -0400
-@@ -36,6 +36,7 @@
- #include <asm/firmware.h>
- #include <asm/vdso.h>
- #include <asm/vdso_datapage.h>
-+#include <asm/mman.h>
-
- #include "setup.h"
-
-@@ -220,7 +221,7 @@ int arch_setup_additional_pages(struct l
- vdso_base = VDSO32_MBASE;
- #endif
-
-- current->mm->context.vdso_base = 0;
-+ current->mm->context.vdso_base = ~0UL;
-
- /* vDSO has a problem and was disabled, just don't "enable" it for the
- * process
-@@ -240,7 +241,7 @@ int arch_setup_additional_pages(struct l
- vdso_base = get_unmapped_area(NULL, vdso_base,
- (vdso_pages << PAGE_SHIFT) +
- ((VDSO_ALIGNMENT - 1) & PAGE_MASK),
-- 0, 0);
-+ 0, MAP_PRIVATE | MAP_EXECUTABLE);
- if (IS_ERR_VALUE(vdso_base)) {
- rc = vdso_base;
- goto fail_mmapsem;
-diff -urNp linux-2.6.32.45/arch/powerpc/kernel/vio.c linux-2.6.32.45/arch/powerpc/kernel/vio.c
---- linux-2.6.32.45/arch/powerpc/kernel/vio.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/kernel/vio.c 2011-04-17 15:56:45.000000000 -0400
-@@ -601,11 +601,12 @@ static void vio_dma_iommu_unmap_sg(struc
- vio_cmo_dealloc(viodev, alloc_size);
- }
-
--struct dma_map_ops vio_dma_mapping_ops = {
-+static const struct dma_map_ops vio_dma_mapping_ops = {
- .alloc_coherent = vio_dma_iommu_alloc_coherent,
- .free_coherent = vio_dma_iommu_free_coherent,
- .map_sg = vio_dma_iommu_map_sg,
- .unmap_sg = vio_dma_iommu_unmap_sg,
-+ .dma_supported = dma_iommu_dma_supported,
- .map_page = vio_dma_iommu_map_page,
- .unmap_page = vio_dma_iommu_unmap_page,
-
-@@ -857,7 +858,6 @@ static void vio_cmo_bus_remove(struct vi
-
- static void vio_cmo_set_dma_ops(struct vio_dev *viodev)
- {
-- vio_dma_mapping_ops.dma_supported = dma_iommu_ops.dma_supported;
- viodev->dev.archdata.dma_ops = &vio_dma_mapping_ops;
- }
-
-diff -urNp linux-2.6.32.45/arch/powerpc/lib/usercopy_64.c linux-2.6.32.45/arch/powerpc/lib/usercopy_64.c
---- linux-2.6.32.45/arch/powerpc/lib/usercopy_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/lib/usercopy_64.c 2011-04-17 15:56:45.000000000 -0400
-@@ -9,22 +9,6 @@
- #include <linux/module.h>
- #include <asm/uaccess.h>
-
--unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
--{
-- if (likely(access_ok(VERIFY_READ, from, n)))
-- n = __copy_from_user(to, from, n);
-- else
-- memset(to, 0, n);
-- return n;
--}
--
--unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
--{
-- if (likely(access_ok(VERIFY_WRITE, to, n)))
-- n = __copy_to_user(to, from, n);
-- return n;
--}
--
- unsigned long copy_in_user(void __user *to, const void __user *from,
- unsigned long n)
- {
-@@ -35,7 +19,5 @@ unsigned long copy_in_user(void __user *
- return n;
- }
-
--EXPORT_SYMBOL(copy_from_user);
--EXPORT_SYMBOL(copy_to_user);
- EXPORT_SYMBOL(copy_in_user);
-
-diff -urNp linux-2.6.32.45/arch/powerpc/Makefile linux-2.6.32.45/arch/powerpc/Makefile
---- linux-2.6.32.45/arch/powerpc/Makefile 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/Makefile 2011-08-21 19:27:08.000000000 -0400
-@@ -74,6 +74,8 @@ KBUILD_AFLAGS += -Iarch/$(ARCH)
- KBUILD_CFLAGS += -msoft-float -pipe -Iarch/$(ARCH) $(CFLAGS-y)
- CPP = $(CC) -E $(KBUILD_CFLAGS)
-
-+cflags-y += -Wno-sign-compare -Wno-extra
-+
- CHECKFLAGS += -m$(CONFIG_WORD_SIZE) -D__powerpc__ -D__powerpc$(CONFIG_WORD_SIZE)__
-
- ifeq ($(CONFIG_PPC64),y)
-diff -urNp linux-2.6.32.45/arch/powerpc/mm/fault.c linux-2.6.32.45/arch/powerpc/mm/fault.c
---- linux-2.6.32.45/arch/powerpc/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/mm/fault.c 2011-04-17 15:56:45.000000000 -0400
-@@ -30,6 +30,10 @@
- #include <linux/kprobes.h>
- #include <linux/kdebug.h>
- #include <linux/perf_event.h>
-+#include <linux/slab.h>
-+#include <linux/pagemap.h>
-+#include <linux/compiler.h>
-+#include <linux/unistd.h>
-
- #include <asm/firmware.h>
- #include <asm/page.h>
-@@ -40,6 +44,7 @@
- #include <asm/uaccess.h>
- #include <asm/tlbflush.h>
- #include <asm/siginfo.h>
-+#include <asm/ptrace.h>
-
-
- #ifdef CONFIG_KPROBES
-@@ -64,6 +69,33 @@ static inline int notify_page_fault(stru
- }
- #endif
-
-+#ifdef CONFIG_PAX_PAGEEXEC
-+/*
-+ * PaX: decide what to do with offenders (regs->nip = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+ return 1;
-+}
-+
-+void pax_report_insns(void *pc, void *sp)
-+{
-+ unsigned long i;
-+
-+ printk(KERN_ERR "PAX: bytes at PC: ");
-+ for (i = 0; i < 5; i++) {
-+ unsigned int c;
-+ if (get_user(c, (unsigned int __user *)pc+i))
-+ printk(KERN_CONT "???????? ");
-+ else
-+ printk(KERN_CONT "%08x ", c);
-+ }
-+ printk("\n");
-+}
-+#endif
-+
- /*
- * Check whether the instruction at regs->nip is a store using
- * an update addressing form which will update r1.
-@@ -134,7 +166,7 @@ int __kprobes do_page_fault(struct pt_re
- * indicate errors in DSISR but can validly be set in SRR1.
- */
- if (trap == 0x400)
-- error_code &= 0x48200000;
-+ error_code &= 0x58200000;
- else
- is_write = error_code & DSISR_ISSTORE;
- #else
-@@ -250,7 +282,7 @@ good_area:
- * "undefined". Of those that can be set, this is the only
- * one which seems bad.
- */
-- if (error_code & 0x10000000)
-+ if (error_code & DSISR_GUARDED)
- /* Guarded storage error. */
- goto bad_area;
- #endif /* CONFIG_8xx */
-@@ -265,7 +297,7 @@ good_area:
- * processors use the same I/D cache coherency mechanism
- * as embedded.
- */
-- if (error_code & DSISR_PROTFAULT)
-+ if (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))
- goto bad_area;
- #endif /* CONFIG_PPC_STD_MMU */
-
-@@ -335,6 +367,23 @@ bad_area:
- bad_area_nosemaphore:
- /* User mode accesses cause a SIGSEGV */
- if (user_mode(regs)) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (mm->pax_flags & MF_PAX_PAGEEXEC) {
-+#ifdef CONFIG_PPC_STD_MMU
-+ if (is_exec && (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))) {
-+#else
-+ if (is_exec && regs->nip == address) {
-+#endif
-+ switch (pax_handle_fetch_fault(regs)) {
-+ }
-+
-+ pax_report_fault(regs, (void *)regs->nip, (void *)regs->gpr[PT_R1]);
-+ do_group_exit(SIGKILL);
-+ }
-+ }
-+#endif
-+
- _exception(SIGSEGV, regs, code, address);
- return 0;
- }
-diff -urNp linux-2.6.32.45/arch/powerpc/mm/mem.c linux-2.6.32.45/arch/powerpc/mm/mem.c
---- linux-2.6.32.45/arch/powerpc/mm/mem.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/mm/mem.c 2011-08-21 15:50:39.000000000 -0400
-@@ -250,7 +250,7 @@ static int __init mark_nonram_nosave(voi
- {
- unsigned long lmb_next_region_start_pfn,
- lmb_region_max_pfn;
-- int i;
-+ unsigned int i;
-
- for (i = 0; i < lmb.memory.cnt - 1; i++) {
- lmb_region_max_pfn =
-diff -urNp linux-2.6.32.45/arch/powerpc/mm/mmap_64.c linux-2.6.32.45/arch/powerpc/mm/mmap_64.c
---- linux-2.6.32.45/arch/powerpc/mm/mmap_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/mm/mmap_64.c 2011-04-17 15:56:45.000000000 -0400
-@@ -99,10 +99,22 @@ void arch_pick_mmap_layout(struct mm_str
- */
- if (mmap_is_legacy()) {
- mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- mm->get_unmapped_area = arch_get_unmapped_area;
- mm->unmap_area = arch_unmap_area;
- } else {
- mm->mmap_base = mmap_base();
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
-+#endif
-+
- mm->get_unmapped_area = arch_get_unmapped_area_topdown;
- mm->unmap_area = arch_unmap_area_topdown;
- }
-diff -urNp linux-2.6.32.45/arch/powerpc/mm/slice.c linux-2.6.32.45/arch/powerpc/mm/slice.c
---- linux-2.6.32.45/arch/powerpc/mm/slice.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/mm/slice.c 2011-04-17 15:56:45.000000000 -0400
-@@ -98,7 +98,7 @@ static int slice_area_is_free(struct mm_
- if ((mm->task_size - len) < addr)
- return 0;
- vma = find_vma(mm, addr);
-- return (!vma || (addr + len) <= vma->vm_start);
-+ return check_heap_stack_gap(vma, addr, len);
- }
-
- static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice)
-@@ -256,7 +256,7 @@ full_search:
- addr = _ALIGN_UP(addr + 1, 1ul << SLICE_HIGH_SHIFT);
- continue;
- }
-- if (!vma || addr + len <= vma->vm_start) {
-+ if (check_heap_stack_gap(vma, addr, len)) {
- /*
- * Remember the place where we stopped the search:
- */
-@@ -313,10 +313,14 @@ static unsigned long slice_find_area_top
- }
- }
-
-- addr = mm->mmap_base;
-- while (addr > len) {
-+ if (mm->mmap_base < len)
-+ addr = -ENOMEM;
-+ else
-+ addr = mm->mmap_base - len;
-+
-+ while (!IS_ERR_VALUE(addr)) {
- /* Go down by chunk size */
-- addr = _ALIGN_DOWN(addr - len, 1ul << pshift);
-+ addr = _ALIGN_DOWN(addr, 1ul << pshift);
-
- /* Check for hit with different page size */
- mask = slice_range_to_mask(addr, len);
-@@ -336,7 +340,7 @@ static unsigned long slice_find_area_top
- * return with success:
- */
- vma = find_vma(mm, addr);
-- if (!vma || (addr + len) <= vma->vm_start) {
-+ if (check_heap_stack_gap(vma, addr, len)) {
- /* remember the address as a hint for next time */
- if (use_cache)
- mm->free_area_cache = addr;
-@@ -348,7 +352,7 @@ static unsigned long slice_find_area_top
- mm->cached_hole_size = vma->vm_start - addr;
-
- /* try just below the current vma->vm_start */
-- addr = vma->vm_start;
-+ addr = skip_heap_stack_gap(vma, len);
- }
-
- /*
-@@ -426,6 +430,11 @@ unsigned long slice_get_unmapped_area(un
- if (fixed && addr > (mm->task_size - len))
- return -EINVAL;
-
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!fixed && (mm->pax_flags & MF_PAX_RANDMMAP))
-+ addr = 0;
-+#endif
-+
- /* If hint, make sure it matches our alignment restrictions */
- if (!fixed && addr) {
- addr = _ALIGN_UP(addr, 1ul << pshift);
-diff -urNp linux-2.6.32.45/arch/powerpc/platforms/52xx/lite5200_pm.c linux-2.6.32.45/arch/powerpc/platforms/52xx/lite5200_pm.c
---- linux-2.6.32.45/arch/powerpc/platforms/52xx/lite5200_pm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/platforms/52xx/lite5200_pm.c 2011-04-17 15:56:45.000000000 -0400
-@@ -235,7 +235,7 @@ static void lite5200_pm_end(void)
- lite5200_pm_target_state = PM_SUSPEND_ON;
- }
-
--static struct platform_suspend_ops lite5200_pm_ops = {
-+static const struct platform_suspend_ops lite5200_pm_ops = {
- .valid = lite5200_pm_valid,
- .begin = lite5200_pm_begin,
- .prepare = lite5200_pm_prepare,
-diff -urNp linux-2.6.32.45/arch/powerpc/platforms/52xx/mpc52xx_pm.c linux-2.6.32.45/arch/powerpc/platforms/52xx/mpc52xx_pm.c
---- linux-2.6.32.45/arch/powerpc/platforms/52xx/mpc52xx_pm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/platforms/52xx/mpc52xx_pm.c 2011-04-17 15:56:45.000000000 -0400
-@@ -180,7 +180,7 @@ void mpc52xx_pm_finish(void)
- iounmap(mbar);
- }
-
--static struct platform_suspend_ops mpc52xx_pm_ops = {
-+static const struct platform_suspend_ops mpc52xx_pm_ops = {
- .valid = mpc52xx_pm_valid,
- .prepare = mpc52xx_pm_prepare,
- .enter = mpc52xx_pm_enter,
-diff -urNp linux-2.6.32.45/arch/powerpc/platforms/83xx/suspend.c linux-2.6.32.45/arch/powerpc/platforms/83xx/suspend.c
---- linux-2.6.32.45/arch/powerpc/platforms/83xx/suspend.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/platforms/83xx/suspend.c 2011-04-17 15:56:45.000000000 -0400
-@@ -273,7 +273,7 @@ static int mpc83xx_is_pci_agent(void)
- return ret;
- }
-
--static struct platform_suspend_ops mpc83xx_suspend_ops = {
-+static const struct platform_suspend_ops mpc83xx_suspend_ops = {
- .valid = mpc83xx_suspend_valid,
- .begin = mpc83xx_suspend_begin,
- .enter = mpc83xx_suspend_enter,
-diff -urNp linux-2.6.32.45/arch/powerpc/platforms/cell/iommu.c linux-2.6.32.45/arch/powerpc/platforms/cell/iommu.c
---- linux-2.6.32.45/arch/powerpc/platforms/cell/iommu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/platforms/cell/iommu.c 2011-04-17 15:56:45.000000000 -0400
-@@ -642,7 +642,7 @@ static int dma_fixed_dma_supported(struc
-
- static int dma_set_mask_and_switch(struct device *dev, u64 dma_mask);
-
--struct dma_map_ops dma_iommu_fixed_ops = {
-+const struct dma_map_ops dma_iommu_fixed_ops = {
- .alloc_coherent = dma_fixed_alloc_coherent,
- .free_coherent = dma_fixed_free_coherent,
- .map_sg = dma_fixed_map_sg,
-diff -urNp linux-2.6.32.45/arch/powerpc/platforms/ps3/system-bus.c linux-2.6.32.45/arch/powerpc/platforms/ps3/system-bus.c
---- linux-2.6.32.45/arch/powerpc/platforms/ps3/system-bus.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/platforms/ps3/system-bus.c 2011-04-17 15:56:45.000000000 -0400
-@@ -694,7 +694,7 @@ static int ps3_dma_supported(struct devi
- return mask >= DMA_BIT_MASK(32);
- }
-
--static struct dma_map_ops ps3_sb_dma_ops = {
-+static const struct dma_map_ops ps3_sb_dma_ops = {
- .alloc_coherent = ps3_alloc_coherent,
- .free_coherent = ps3_free_coherent,
- .map_sg = ps3_sb_map_sg,
-@@ -704,7 +704,7 @@ static struct dma_map_ops ps3_sb_dma_ops
- .unmap_page = ps3_unmap_page,
- };
-
--static struct dma_map_ops ps3_ioc0_dma_ops = {
-+static const struct dma_map_ops ps3_ioc0_dma_ops = {
- .alloc_coherent = ps3_alloc_coherent,
- .free_coherent = ps3_free_coherent,
- .map_sg = ps3_ioc0_map_sg,
-diff -urNp linux-2.6.32.45/arch/powerpc/platforms/pseries/Kconfig linux-2.6.32.45/arch/powerpc/platforms/pseries/Kconfig
---- linux-2.6.32.45/arch/powerpc/platforms/pseries/Kconfig 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/powerpc/platforms/pseries/Kconfig 2011-04-17 15:56:45.000000000 -0400
-@@ -2,6 +2,8 @@ config PPC_PSERIES
- depends on PPC64 && PPC_BOOK3S
- bool "IBM pSeries & new (POWER5-based) iSeries"
- select MPIC
-+ select PCI_MSI
-+ select XICS
- select PPC_I8259
- select PPC_RTAS
- select RTAS_ERROR_LOGGING
-diff -urNp linux-2.6.32.45/arch/s390/include/asm/elf.h linux-2.6.32.45/arch/s390/include/asm/elf.h
---- linux-2.6.32.45/arch/s390/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/s390/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
-@@ -164,6 +164,13 @@ extern unsigned int vdso_enabled;
- that it will "exec", and that there is sufficient room for the brk. */
- #define ELF_ET_DYN_BASE (STACK_TOP / 3 * 2)
-
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_31BIT) ? 0x10000UL : 0x80000000UL)
-+
-+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26 )
-+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26 )
-+#endif
-+
- /* This yields a mask that user programs can use to figure out what
- instruction set this CPU supports. */
-
-diff -urNp linux-2.6.32.45/arch/s390/include/asm/setup.h linux-2.6.32.45/arch/s390/include/asm/setup.h
---- linux-2.6.32.45/arch/s390/include/asm/setup.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/s390/include/asm/setup.h 2011-04-17 15:56:45.000000000 -0400
-@@ -50,13 +50,13 @@ extern unsigned long memory_end;
- void detect_memory_layout(struct mem_chunk chunk[]);
-
- #ifdef CONFIG_S390_SWITCH_AMODE
--extern unsigned int switch_amode;
-+#define switch_amode (1)
- #else
- #define switch_amode (0)
- #endif
-
- #ifdef CONFIG_S390_EXEC_PROTECT
--extern unsigned int s390_noexec;
-+#define s390_noexec (1)
- #else
- #define s390_noexec (0)
- #endif
-diff -urNp linux-2.6.32.45/arch/s390/include/asm/uaccess.h linux-2.6.32.45/arch/s390/include/asm/uaccess.h
---- linux-2.6.32.45/arch/s390/include/asm/uaccess.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/s390/include/asm/uaccess.h 2011-04-17 15:56:45.000000000 -0400
-@@ -232,6 +232,10 @@ static inline unsigned long __must_check
- copy_to_user(void __user *to, const void *from, unsigned long n)
- {
- might_fault();
-+
-+ if ((long)n < 0)
-+ return n;
-+
- if (access_ok(VERIFY_WRITE, to, n))
- n = __copy_to_user(to, from, n);
- return n;
-@@ -257,6 +261,9 @@ copy_to_user(void __user *to, const void
- static inline unsigned long __must_check
- __copy_from_user(void *to, const void __user *from, unsigned long n)
- {
-+ if ((long)n < 0)
-+ return n;
-+
- if (__builtin_constant_p(n) && (n <= 256))
- return uaccess.copy_from_user_small(n, from, to);
- else
-@@ -283,6 +290,10 @@ static inline unsigned long __must_check
- copy_from_user(void *to, const void __user *from, unsigned long n)
- {
- might_fault();
-+
-+ if ((long)n < 0)
-+ return n;
-+
- if (access_ok(VERIFY_READ, from, n))
- n = __copy_from_user(to, from, n);
- else
-diff -urNp linux-2.6.32.45/arch/s390/Kconfig linux-2.6.32.45/arch/s390/Kconfig
---- linux-2.6.32.45/arch/s390/Kconfig 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/s390/Kconfig 2011-04-17 15:56:45.000000000 -0400
-@@ -194,28 +194,26 @@ config AUDIT_ARCH
-
- config S390_SWITCH_AMODE
- bool "Switch kernel/user addressing modes"
-+ default y
- help
- This option allows to switch the addressing modes of kernel and user
-- space. The kernel parameter switch_amode=on will enable this feature,
-- default is disabled. Enabling this (via kernel parameter) on machines
-- earlier than IBM System z9-109 EC/BC will reduce system performance.
-+ space. Enabling this on machines earlier than IBM System z9-109 EC/BC
-+ will reduce system performance.
-
- Note that this option will also be selected by selecting the execute
-- protection option below. Enabling the execute protection via the
-- noexec kernel parameter will also switch the addressing modes,
-- independent of the switch_amode kernel parameter.
-+ protection option below. Enabling the execute protection will also
-+ switch the addressing modes, independent of this option.
-
-
- config S390_EXEC_PROTECT
- bool "Data execute protection"
-+ default y
- select S390_SWITCH_AMODE
- help
- This option allows to enable a buffer overflow protection for user
- space programs and it also selects the addressing mode option above.
-- The kernel parameter noexec=on will enable this feature and also
-- switch the addressing modes, default is disabled. Enabling this (via
-- kernel parameter) on machines earlier than IBM System z9-109 EC/BC
-- will reduce system performance.
-+ Enabling this on machines earlier than IBM System z9-109 EC/BC will
-+ reduce system performance.
-
- comment "Code generation options"
-
-diff -urNp linux-2.6.32.45/arch/s390/kernel/module.c linux-2.6.32.45/arch/s390/kernel/module.c
---- linux-2.6.32.45/arch/s390/kernel/module.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/s390/kernel/module.c 2011-04-17 15:56:45.000000000 -0400
-@@ -166,11 +166,11 @@ module_frob_arch_sections(Elf_Ehdr *hdr,
-
- /* Increase core size by size of got & plt and set start
- offsets for got and plt. */
-- me->core_size = ALIGN(me->core_size, 4);
-- me->arch.got_offset = me->core_size;
-- me->core_size += me->arch.got_size;
-- me->arch.plt_offset = me->core_size;
-- me->core_size += me->arch.plt_size;
-+ me->core_size_rw = ALIGN(me->core_size_rw, 4);
-+ me->arch.got_offset = me->core_size_rw;
-+ me->core_size_rw += me->arch.got_size;
-+ me->arch.plt_offset = me->core_size_rx;
-+ me->core_size_rx += me->arch.plt_size;
- return 0;
- }
-
-@@ -256,7 +256,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
- if (info->got_initialized == 0) {
- Elf_Addr *gotent;
-
-- gotent = me->module_core + me->arch.got_offset +
-+ gotent = me->module_core_rw + me->arch.got_offset +
- info->got_offset;
- *gotent = val;
- info->got_initialized = 1;
-@@ -280,7 +280,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
- else if (r_type == R_390_GOTENT ||
- r_type == R_390_GOTPLTENT)
- *(unsigned int *) loc =
-- (val + (Elf_Addr) me->module_core - loc) >> 1;
-+ (val + (Elf_Addr) me->module_core_rw - loc) >> 1;
- else if (r_type == R_390_GOT64 ||
- r_type == R_390_GOTPLT64)
- *(unsigned long *) loc = val;
-@@ -294,7 +294,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
- case R_390_PLTOFF64: /* 16 bit offset from GOT to PLT. */
- if (info->plt_initialized == 0) {
- unsigned int *ip;
-- ip = me->module_core + me->arch.plt_offset +
-+ ip = me->module_core_rx + me->arch.plt_offset +
- info->plt_offset;
- #ifndef CONFIG_64BIT
- ip[0] = 0x0d105810; /* basr 1,0; l 1,6(1); br 1 */
-@@ -319,7 +319,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
- val - loc + 0xffffUL < 0x1ffffeUL) ||
- (r_type == R_390_PLT32DBL &&
- val - loc + 0xffffffffULL < 0x1fffffffeULL)))
-- val = (Elf_Addr) me->module_core +
-+ val = (Elf_Addr) me->module_core_rx +
- me->arch.plt_offset +
- info->plt_offset;
- val += rela->r_addend - loc;
-@@ -341,7 +341,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
- case R_390_GOTOFF32: /* 32 bit offset to GOT. */
- case R_390_GOTOFF64: /* 64 bit offset to GOT. */
- val = val + rela->r_addend -
-- ((Elf_Addr) me->module_core + me->arch.got_offset);
-+ ((Elf_Addr) me->module_core_rw + me->arch.got_offset);
- if (r_type == R_390_GOTOFF16)
- *(unsigned short *) loc = val;
- else if (r_type == R_390_GOTOFF32)
-@@ -351,7 +351,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
- break;
- case R_390_GOTPC: /* 32 bit PC relative offset to GOT. */
- case R_390_GOTPCDBL: /* 32 bit PC rel. off. to GOT shifted by 1. */
-- val = (Elf_Addr) me->module_core + me->arch.got_offset +
-+ val = (Elf_Addr) me->module_core_rw + me->arch.got_offset +
- rela->r_addend - loc;
- if (r_type == R_390_GOTPC)
- *(unsigned int *) loc = val;
-diff -urNp linux-2.6.32.45/arch/s390/kernel/setup.c linux-2.6.32.45/arch/s390/kernel/setup.c
---- linux-2.6.32.45/arch/s390/kernel/setup.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/s390/kernel/setup.c 2011-04-17 15:56:45.000000000 -0400
-@@ -306,9 +306,6 @@ static int __init early_parse_mem(char *
- early_param("mem", early_parse_mem);
-
- #ifdef CONFIG_S390_SWITCH_AMODE
--unsigned int switch_amode = 0;
--EXPORT_SYMBOL_GPL(switch_amode);
--
- static int set_amode_and_uaccess(unsigned long user_amode,
- unsigned long user32_amode)
- {
-@@ -334,17 +331,6 @@ static int set_amode_and_uaccess(unsigne
- return 0;
- }
- }
--
--/*
-- * Switch kernel/user addressing modes?
-- */
--static int __init early_parse_switch_amode(char *p)
--{
-- switch_amode = 1;
-- return 0;
--}
--early_param("switch_amode", early_parse_switch_amode);
--
- #else /* CONFIG_S390_SWITCH_AMODE */
- static inline int set_amode_and_uaccess(unsigned long user_amode,
- unsigned long user32_amode)
-@@ -353,24 +339,6 @@ static inline int set_amode_and_uaccess(
- }
- #endif /* CONFIG_S390_SWITCH_AMODE */
-
--#ifdef CONFIG_S390_EXEC_PROTECT
--unsigned int s390_noexec = 0;
--EXPORT_SYMBOL_GPL(s390_noexec);
--
--/*
-- * Enable execute protection?
-- */
--static int __init early_parse_noexec(char *p)
--{
-- if (!strncmp(p, "off", 3))
-- return 0;
-- switch_amode = 1;
-- s390_noexec = 1;
-- return 0;
--}
--early_param("noexec", early_parse_noexec);
--#endif /* CONFIG_S390_EXEC_PROTECT */
--
- static void setup_addressing_mode(void)
- {
- if (s390_noexec) {
-diff -urNp linux-2.6.32.45/arch/s390/mm/mmap.c linux-2.6.32.45/arch/s390/mm/mmap.c
---- linux-2.6.32.45/arch/s390/mm/mmap.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/s390/mm/mmap.c 2011-04-17 15:56:45.000000000 -0400
-@@ -78,10 +78,22 @@ void arch_pick_mmap_layout(struct mm_str
- */
- if (mmap_is_legacy()) {
- mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- mm->get_unmapped_area = arch_get_unmapped_area;
- mm->unmap_area = arch_unmap_area;
- } else {
- mm->mmap_base = mmap_base();
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
-+#endif
-+
- mm->get_unmapped_area = arch_get_unmapped_area_topdown;
- mm->unmap_area = arch_unmap_area_topdown;
- }
-@@ -153,10 +165,22 @@ void arch_pick_mmap_layout(struct mm_str
- */
- if (mmap_is_legacy()) {
- mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- mm->get_unmapped_area = s390_get_unmapped_area;
- mm->unmap_area = arch_unmap_area;
- } else {
- mm->mmap_base = mmap_base();
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
-+#endif
-+
- mm->get_unmapped_area = s390_get_unmapped_area_topdown;
- mm->unmap_area = arch_unmap_area_topdown;
- }
-diff -urNp linux-2.6.32.45/arch/score/include/asm/system.h linux-2.6.32.45/arch/score/include/asm/system.h
---- linux-2.6.32.45/arch/score/include/asm/system.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/score/include/asm/system.h 2011-04-17 15:56:45.000000000 -0400
-@@ -17,7 +17,7 @@ do { \
- #define finish_arch_switch(prev) do {} while (0)
-
- typedef void (*vi_handler_t)(void);
--extern unsigned long arch_align_stack(unsigned long sp);
-+#define arch_align_stack(x) (x)
-
- #define mb() barrier()
- #define rmb() barrier()
-diff -urNp linux-2.6.32.45/arch/score/kernel/process.c linux-2.6.32.45/arch/score/kernel/process.c
---- linux-2.6.32.45/arch/score/kernel/process.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/score/kernel/process.c 2011-04-17 15:56:45.000000000 -0400
-@@ -161,8 +161,3 @@ unsigned long get_wchan(struct task_stru
-
- return task_pt_regs(task)->cp0_epc;
- }
--
--unsigned long arch_align_stack(unsigned long sp)
--{
-- return sp;
--}
-diff -urNp linux-2.6.32.45/arch/sh/boards/mach-hp6xx/pm.c linux-2.6.32.45/arch/sh/boards/mach-hp6xx/pm.c
---- linux-2.6.32.45/arch/sh/boards/mach-hp6xx/pm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sh/boards/mach-hp6xx/pm.c 2011-04-17 15:56:45.000000000 -0400
-@@ -143,7 +143,7 @@ static int hp6x0_pm_enter(suspend_state_
- return 0;
- }
-
--static struct platform_suspend_ops hp6x0_pm_ops = {
-+static const struct platform_suspend_ops hp6x0_pm_ops = {
- .enter = hp6x0_pm_enter,
- .valid = suspend_valid_only_mem,
- };
-diff -urNp linux-2.6.32.45/arch/sh/kernel/cpu/sh4/sq.c linux-2.6.32.45/arch/sh/kernel/cpu/sh4/sq.c
---- linux-2.6.32.45/arch/sh/kernel/cpu/sh4/sq.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sh/kernel/cpu/sh4/sq.c 2011-04-17 15:56:46.000000000 -0400
-@@ -327,7 +327,7 @@ static struct attribute *sq_sysfs_attrs[
- NULL,
- };
-
--static struct sysfs_ops sq_sysfs_ops = {
-+static const struct sysfs_ops sq_sysfs_ops = {
- .show = sq_sysfs_show,
- .store = sq_sysfs_store,
- };
-diff -urNp linux-2.6.32.45/arch/sh/kernel/cpu/shmobile/pm.c linux-2.6.32.45/arch/sh/kernel/cpu/shmobile/pm.c
---- linux-2.6.32.45/arch/sh/kernel/cpu/shmobile/pm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sh/kernel/cpu/shmobile/pm.c 2011-04-17 15:56:46.000000000 -0400
-@@ -58,7 +58,7 @@ static int sh_pm_enter(suspend_state_t s
- return 0;
- }
-
--static struct platform_suspend_ops sh_pm_ops = {
-+static const struct platform_suspend_ops sh_pm_ops = {
- .enter = sh_pm_enter,
- .valid = suspend_valid_only_mem,
- };
-diff -urNp linux-2.6.32.45/arch/sh/kernel/kgdb.c linux-2.6.32.45/arch/sh/kernel/kgdb.c
---- linux-2.6.32.45/arch/sh/kernel/kgdb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sh/kernel/kgdb.c 2011-04-17 15:56:46.000000000 -0400
-@@ -271,7 +271,7 @@ void kgdb_arch_exit(void)
- {
- }
-
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- /* Breakpoint instruction: trapa #0x3c */
- #ifdef CONFIG_CPU_LITTLE_ENDIAN
- .gdb_bpt_instr = { 0x3c, 0xc3 },
-diff -urNp linux-2.6.32.45/arch/sh/mm/mmap.c linux-2.6.32.45/arch/sh/mm/mmap.c
---- linux-2.6.32.45/arch/sh/mm/mmap.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sh/mm/mmap.c 2011-04-17 15:56:46.000000000 -0400
-@@ -74,8 +74,7 @@ unsigned long arch_get_unmapped_area(str
- addr = PAGE_ALIGN(addr);
-
- vma = find_vma(mm, addr);
-- if (TASK_SIZE - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
- return addr;
- }
-
-@@ -106,7 +105,7 @@ full_search:
- }
- return -ENOMEM;
- }
-- if (likely(!vma || addr + len <= vma->vm_start)) {
-+ if (likely(check_heap_stack_gap(vma, addr, len))) {
- /*
- * Remember the place where we stopped the search:
- */
-@@ -157,8 +156,7 @@ arch_get_unmapped_area_topdown(struct fi
- addr = PAGE_ALIGN(addr);
-
- vma = find_vma(mm, addr);
-- if (TASK_SIZE - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
- return addr;
- }
-
-@@ -179,7 +177,7 @@ arch_get_unmapped_area_topdown(struct fi
- /* make sure it can fit in the remaining address space */
- if (likely(addr > len)) {
- vma = find_vma(mm, addr-len);
-- if (!vma || addr <= vma->vm_start) {
-+ if (check_heap_stack_gap(vma, addr - len, len)) {
- /* remember the address as a hint for next time */
- return (mm->free_area_cache = addr-len);
- }
-@@ -188,18 +186,18 @@ arch_get_unmapped_area_topdown(struct fi
- if (unlikely(mm->mmap_base < len))
- goto bottomup;
-
-- addr = mm->mmap_base-len;
-- if (do_colour_align)
-- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
-+ addr = mm->mmap_base - len;
-
- do {
-+ if (do_colour_align)
-+ addr = COLOUR_ALIGN_DOWN(addr, pgoff);
- /*
- * Lookup failure means no vma is above this address,
- * else if new region fits below vma->vm_start,
- * return with success:
- */
- vma = find_vma(mm, addr);
-- if (likely(!vma || addr+len <= vma->vm_start)) {
-+ if (likely(check_heap_stack_gap(vma, addr, len))) {
- /* remember the address as a hint for next time */
- return (mm->free_area_cache = addr);
- }
-@@ -209,10 +207,8 @@ arch_get_unmapped_area_topdown(struct fi
- mm->cached_hole_size = vma->vm_start - addr;
-
- /* try just below the current vma->vm_start */
-- addr = vma->vm_start-len;
-- if (do_colour_align)
-- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
-- } while (likely(len < vma->vm_start));
-+ addr = skip_heap_stack_gap(vma, len);
-+ } while (!IS_ERR_VALUE(addr));
-
- bottomup:
- /*
-diff -urNp linux-2.6.32.45/arch/sparc/include/asm/atomic_64.h linux-2.6.32.45/arch/sparc/include/asm/atomic_64.h
---- linux-2.6.32.45/arch/sparc/include/asm/atomic_64.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/include/asm/atomic_64.h 2011-08-18 23:11:34.000000000 -0400
-@@ -14,18 +14,40 @@
- #define ATOMIC64_INIT(i) { (i) }
-
- #define atomic_read(v) ((v)->counter)
-+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
-+{
-+ return v->counter;
-+}
- #define atomic64_read(v) ((v)->counter)
-+static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
-+{
-+ return v->counter;
-+}
-
- #define atomic_set(v, i) (((v)->counter) = i)
-+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
-+{
-+ v->counter = i;
-+}
- #define atomic64_set(v, i) (((v)->counter) = i)
-+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
-+{
-+ v->counter = i;
-+}
-
- extern void atomic_add(int, atomic_t *);
-+extern void atomic_add_unchecked(int, atomic_unchecked_t *);
- extern void atomic64_add(long, atomic64_t *);
-+extern void atomic64_add_unchecked(long, atomic64_unchecked_t *);
- extern void atomic_sub(int, atomic_t *);
-+extern void atomic_sub_unchecked(int, atomic_unchecked_t *);
- extern void atomic64_sub(long, atomic64_t *);
-+extern void atomic64_sub_unchecked(long, atomic64_unchecked_t *);
-
- extern int atomic_add_ret(int, atomic_t *);
-+extern int atomic_add_ret_unchecked(int, atomic_unchecked_t *);
- extern long atomic64_add_ret(long, atomic64_t *);
-+extern long atomic64_add_ret_unchecked(long, atomic64_unchecked_t *);
- extern int atomic_sub_ret(int, atomic_t *);
- extern long atomic64_sub_ret(long, atomic64_t *);
-
-@@ -33,13 +55,29 @@ extern long atomic64_sub_ret(long, atomi
- #define atomic64_dec_return(v) atomic64_sub_ret(1, v)
-
- #define atomic_inc_return(v) atomic_add_ret(1, v)
-+static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
-+{
-+ return atomic_add_ret_unchecked(1, v);
-+}
- #define atomic64_inc_return(v) atomic64_add_ret(1, v)
-+static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
-+{
-+ return atomic64_add_ret_unchecked(1, v);
-+}
-
- #define atomic_sub_return(i, v) atomic_sub_ret(i, v)
- #define atomic64_sub_return(i, v) atomic64_sub_ret(i, v)
-
- #define atomic_add_return(i, v) atomic_add_ret(i, v)
-+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
-+{
-+ return atomic_add_ret_unchecked(i, v);
-+}
- #define atomic64_add_return(i, v) atomic64_add_ret(i, v)
-+static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
-+{
-+ return atomic64_add_ret_unchecked(i, v);
-+}
-
- /*
- * atomic_inc_and_test - increment and test
-@@ -50,6 +88,10 @@ extern long atomic64_sub_ret(long, atomi
- * other cases.
- */
- #define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
-+static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
-+{
-+ return atomic_inc_return_unchecked(v) == 0;
-+}
- #define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
-
- #define atomic_sub_and_test(i, v) (atomic_sub_ret(i, v) == 0)
-@@ -59,30 +101,65 @@ extern long atomic64_sub_ret(long, atomi
- #define atomic64_dec_and_test(v) (atomic64_sub_ret(1, v) == 0)
-
- #define atomic_inc(v) atomic_add(1, v)
-+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
-+{
-+ atomic_add_unchecked(1, v);
-+}
- #define atomic64_inc(v) atomic64_add(1, v)
-+static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
-+{
-+ atomic64_add_unchecked(1, v);
-+}
-
- #define atomic_dec(v) atomic_sub(1, v)
-+static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
-+{
-+ atomic_sub_unchecked(1, v);
-+}
- #define atomic64_dec(v) atomic64_sub(1, v)
-+static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
-+{
-+ atomic64_sub_unchecked(1, v);
-+}
-
- #define atomic_add_negative(i, v) (atomic_add_ret(i, v) < 0)
- #define atomic64_add_negative(i, v) (atomic64_add_ret(i, v) < 0)
-
- #define atomic_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
-+static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
-+{
-+ return cmpxchg(&v->counter, old, new);
-+}
- #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
-+static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
-+{
-+ return xchg(&v->counter, new);
-+}
-
- static inline int atomic_add_unless(atomic_t *v, int a, int u)
- {
-- int c, old;
-+ int c, old, new;
- c = atomic_read(v);
- for (;;) {
-- if (unlikely(c == (u)))
-+ if (unlikely(c == u))
- break;
-- old = atomic_cmpxchg((v), c, c + (a));
-+
-+ asm volatile("addcc %2, %0, %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "tvs %%icc, 6\n"
-+#endif
-+
-+ : "=r" (new)
-+ : "0" (c), "ir" (a)
-+ : "cc");
-+
-+ old = atomic_cmpxchg(v, c, new);
- if (likely(old == c))
- break;
- c = old;
- }
-- return c != (u);
-+ return c != u;
- }
-
- #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
-@@ -90,20 +167,35 @@ static inline int atomic_add_unless(atom
- #define atomic64_cmpxchg(v, o, n) \
- ((__typeof__((v)->counter))cmpxchg(&((v)->counter), (o), (n)))
- #define atomic64_xchg(v, new) (xchg(&((v)->counter), new))
-+static inline long atomic64_xchg_unchecked(atomic64_unchecked_t *v, long new)
-+{
-+ return xchg(&v->counter, new);
-+}
-
- static inline long atomic64_add_unless(atomic64_t *v, long a, long u)
- {
-- long c, old;
-+ long c, old, new;
- c = atomic64_read(v);
- for (;;) {
-- if (unlikely(c == (u)))
-+ if (unlikely(c == u))
- break;
-- old = atomic64_cmpxchg((v), c, c + (a));
-+
-+ asm volatile("addcc %2, %0, %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "tvs %%xcc, 6\n"
-+#endif
-+
-+ : "=r" (new)
-+ : "0" (c), "ir" (a)
-+ : "cc");
-+
-+ old = atomic64_cmpxchg(v, c, new);
- if (likely(old == c))
- break;
- c = old;
- }
-- return c != (u);
-+ return c != u;
- }
-
- #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
-diff -urNp linux-2.6.32.45/arch/sparc/include/asm/cache.h linux-2.6.32.45/arch/sparc/include/asm/cache.h
---- linux-2.6.32.45/arch/sparc/include/asm/cache.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/include/asm/cache.h 2011-07-06 19:53:33.000000000 -0400
-@@ -8,7 +8,7 @@
- #define _SPARC_CACHE_H
-
- #define L1_CACHE_SHIFT 5
--#define L1_CACHE_BYTES 32
-+#define L1_CACHE_BYTES 32UL
- #define L1_CACHE_ALIGN(x) ((((x)+(L1_CACHE_BYTES-1))&~(L1_CACHE_BYTES-1)))
-
- #ifdef CONFIG_SPARC32
-diff -urNp linux-2.6.32.45/arch/sparc/include/asm/dma-mapping.h linux-2.6.32.45/arch/sparc/include/asm/dma-mapping.h
---- linux-2.6.32.45/arch/sparc/include/asm/dma-mapping.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/include/asm/dma-mapping.h 2011-04-17 15:56:46.000000000 -0400
-@@ -14,10 +14,10 @@ extern int dma_set_mask(struct device *d
- #define dma_free_noncoherent(d, s, v, h) dma_free_coherent(d, s, v, h)
- #define dma_is_consistent(d, h) (1)
-
--extern struct dma_map_ops *dma_ops, pci32_dma_ops;
-+extern const struct dma_map_ops *dma_ops, pci32_dma_ops;
- extern struct bus_type pci_bus_type;
-
--static inline struct dma_map_ops *get_dma_ops(struct device *dev)
-+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
- {
- #if defined(CONFIG_SPARC32) && defined(CONFIG_PCI)
- if (dev->bus == &pci_bus_type)
-@@ -31,7 +31,7 @@ static inline struct dma_map_ops *get_dm
- static inline void *dma_alloc_coherent(struct device *dev, size_t size,
- dma_addr_t *dma_handle, gfp_t flag)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
- void *cpu_addr;
-
- cpu_addr = ops->alloc_coherent(dev, size, dma_handle, flag);
-@@ -42,7 +42,7 @@ static inline void *dma_alloc_coherent(s
- static inline void dma_free_coherent(struct device *dev, size_t size,
- void *cpu_addr, dma_addr_t dma_handle)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- debug_dma_free_coherent(dev, size, cpu_addr, dma_handle);
- ops->free_coherent(dev, size, cpu_addr, dma_handle);
-diff -urNp linux-2.6.32.45/arch/sparc/include/asm/elf_32.h linux-2.6.32.45/arch/sparc/include/asm/elf_32.h
---- linux-2.6.32.45/arch/sparc/include/asm/elf_32.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/include/asm/elf_32.h 2011-04-17 15:56:46.000000000 -0400
-@@ -116,6 +116,13 @@ typedef struct {
-
- #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE)
-
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE 0x10000UL
-+
-+#define PAX_DELTA_MMAP_LEN 16
-+#define PAX_DELTA_STACK_LEN 16
-+#endif
-+
- /* This yields a mask that user programs can use to figure out what
- instruction set this cpu supports. This can NOT be done in userspace
- on Sparc. */
-diff -urNp linux-2.6.32.45/arch/sparc/include/asm/elf_64.h linux-2.6.32.45/arch/sparc/include/asm/elf_64.h
---- linux-2.6.32.45/arch/sparc/include/asm/elf_64.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/include/asm/elf_64.h 2011-04-17 15:56:46.000000000 -0400
-@@ -163,6 +163,12 @@ typedef struct {
- #define ELF_ET_DYN_BASE 0x0000010000000000UL
- #define COMPAT_ELF_ET_DYN_BASE 0x0000000070000000UL
-
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT) ? 0x10000UL : 0x100000UL)
-+
-+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT) ? 14 : 28)
-+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT) ? 15 : 29)
-+#endif
-
- /* This yields a mask that user programs can use to figure out what
- instruction set this cpu supports. */
-diff -urNp linux-2.6.32.45/arch/sparc/include/asm/pgtable_32.h linux-2.6.32.45/arch/sparc/include/asm/pgtable_32.h
---- linux-2.6.32.45/arch/sparc/include/asm/pgtable_32.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/include/asm/pgtable_32.h 2011-04-17 15:56:46.000000000 -0400
-@@ -43,6 +43,13 @@ BTFIXUPDEF_SIMM13(user_ptrs_per_pgd)
- BTFIXUPDEF_INT(page_none)
- BTFIXUPDEF_INT(page_copy)
- BTFIXUPDEF_INT(page_readonly)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+BTFIXUPDEF_INT(page_shared_noexec)
-+BTFIXUPDEF_INT(page_copy_noexec)
-+BTFIXUPDEF_INT(page_readonly_noexec)
-+#endif
-+
- BTFIXUPDEF_INT(page_kernel)
-
- #define PMD_SHIFT SUN4C_PMD_SHIFT
-@@ -64,6 +71,16 @@ extern pgprot_t PAGE_SHARED;
- #define PAGE_COPY __pgprot(BTFIXUP_INT(page_copy))
- #define PAGE_READONLY __pgprot(BTFIXUP_INT(page_readonly))
-
-+#ifdef CONFIG_PAX_PAGEEXEC
-+extern pgprot_t PAGE_SHARED_NOEXEC;
-+# define PAGE_COPY_NOEXEC __pgprot(BTFIXUP_INT(page_copy_noexec))
-+# define PAGE_READONLY_NOEXEC __pgprot(BTFIXUP_INT(page_readonly_noexec))
-+#else
-+# define PAGE_SHARED_NOEXEC PAGE_SHARED
-+# define PAGE_COPY_NOEXEC PAGE_COPY
-+# define PAGE_READONLY_NOEXEC PAGE_READONLY
-+#endif
-+
- extern unsigned long page_kernel;
-
- #ifdef MODULE
-diff -urNp linux-2.6.32.45/arch/sparc/include/asm/pgtsrmmu.h linux-2.6.32.45/arch/sparc/include/asm/pgtsrmmu.h
---- linux-2.6.32.45/arch/sparc/include/asm/pgtsrmmu.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/include/asm/pgtsrmmu.h 2011-04-17 15:56:46.000000000 -0400
-@@ -115,6 +115,13 @@
- SRMMU_EXEC | SRMMU_REF)
- #define SRMMU_PAGE_RDONLY __pgprot(SRMMU_VALID | SRMMU_CACHE | \
- SRMMU_EXEC | SRMMU_REF)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+#define SRMMU_PAGE_SHARED_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_WRITE | SRMMU_REF)
-+#define SRMMU_PAGE_COPY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
-+#define SRMMU_PAGE_RDONLY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
-+#endif
-+
- #define SRMMU_PAGE_KERNEL __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_PRIV | \
- SRMMU_DIRTY | SRMMU_REF)
-
-diff -urNp linux-2.6.32.45/arch/sparc/include/asm/spinlock_64.h linux-2.6.32.45/arch/sparc/include/asm/spinlock_64.h
---- linux-2.6.32.45/arch/sparc/include/asm/spinlock_64.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/include/asm/spinlock_64.h 2011-08-18 23:19:30.000000000 -0400
-@@ -92,14 +92,19 @@ static inline void __raw_spin_lock_flags
-
- /* Multi-reader locks, these are much saner than the 32-bit Sparc ones... */
-
--static void inline arch_read_lock(raw_rwlock_t *lock)
-+static inline void arch_read_lock(raw_rwlock_t *lock)
- {
- unsigned long tmp1, tmp2;
-
- __asm__ __volatile__ (
- "1: ldsw [%2], %0\n"
- " brlz,pn %0, 2f\n"
--"4: add %0, 1, %1\n"
-+"4: addcc %0, 1, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+" tvs %%icc, 6\n"
-+#endif
-+
- " cas [%2], %0, %1\n"
- " cmp %0, %1\n"
- " bne,pn %%icc, 1b\n"
-@@ -112,10 +117,10 @@ static void inline arch_read_lock(raw_rw
- " .previous"
- : "=&r" (tmp1), "=&r" (tmp2)
- : "r" (lock)
-- : "memory");
-+ : "memory", "cc");
- }
-
--static int inline arch_read_trylock(raw_rwlock_t *lock)
-+static inline int arch_read_trylock(raw_rwlock_t *lock)
- {
- int tmp1, tmp2;
-
-@@ -123,7 +128,12 @@ static int inline arch_read_trylock(raw_
- "1: ldsw [%2], %0\n"
- " brlz,a,pn %0, 2f\n"
- " mov 0, %0\n"
--" add %0, 1, %1\n"
-+" addcc %0, 1, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+" tvs %%icc, 6\n"
-+#endif
-+
- " cas [%2], %0, %1\n"
- " cmp %0, %1\n"
- " bne,pn %%icc, 1b\n"
-@@ -136,13 +146,18 @@ static int inline arch_read_trylock(raw_
- return tmp1;
- }
-
--static void inline arch_read_unlock(raw_rwlock_t *lock)
-+static inline void arch_read_unlock(raw_rwlock_t *lock)
- {
- unsigned long tmp1, tmp2;
-
- __asm__ __volatile__(
- "1: lduw [%2], %0\n"
--" sub %0, 1, %1\n"
-+" subcc %0, 1, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+" tvs %%icc, 6\n"
-+#endif
-+
- " cas [%2], %0, %1\n"
- " cmp %0, %1\n"
- " bne,pn %%xcc, 1b\n"
-@@ -152,7 +167,7 @@ static void inline arch_read_unlock(raw_
- : "memory");
- }
-
--static void inline arch_write_lock(raw_rwlock_t *lock)
-+static inline void arch_write_lock(raw_rwlock_t *lock)
- {
- unsigned long mask, tmp1, tmp2;
-
-@@ -177,7 +192,7 @@ static void inline arch_write_lock(raw_r
- : "memory");
- }
-
--static void inline arch_write_unlock(raw_rwlock_t *lock)
-+static inline void arch_write_unlock(raw_rwlock_t *lock)
- {
- __asm__ __volatile__(
- " stw %%g0, [%0]"
-@@ -186,7 +201,7 @@ static void inline arch_write_unlock(raw
- : "memory");
- }
-
--static int inline arch_write_trylock(raw_rwlock_t *lock)
-+static inline int arch_write_trylock(raw_rwlock_t *lock)
- {
- unsigned long mask, tmp1, tmp2, result;
-
-diff -urNp linux-2.6.32.45/arch/sparc/include/asm/thread_info_32.h linux-2.6.32.45/arch/sparc/include/asm/thread_info_32.h
---- linux-2.6.32.45/arch/sparc/include/asm/thread_info_32.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/include/asm/thread_info_32.h 2011-06-04 20:46:01.000000000 -0400
-@@ -50,6 +50,8 @@ struct thread_info {
- unsigned long w_saved;
-
- struct restart_block restart_block;
-+
-+ unsigned long lowest_stack;
- };
-
- /*
-diff -urNp linux-2.6.32.45/arch/sparc/include/asm/thread_info_64.h linux-2.6.32.45/arch/sparc/include/asm/thread_info_64.h
---- linux-2.6.32.45/arch/sparc/include/asm/thread_info_64.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/include/asm/thread_info_64.h 2011-06-04 20:46:21.000000000 -0400
-@@ -68,6 +68,8 @@ struct thread_info {
- struct pt_regs *kern_una_regs;
- unsigned int kern_una_insn;
-
-+ unsigned long lowest_stack;
-+
- unsigned long fpregs[0] __attribute__ ((aligned(64)));
- };
-
-diff -urNp linux-2.6.32.45/arch/sparc/include/asm/uaccess_32.h linux-2.6.32.45/arch/sparc/include/asm/uaccess_32.h
---- linux-2.6.32.45/arch/sparc/include/asm/uaccess_32.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/include/asm/uaccess_32.h 2011-04-17 15:56:46.000000000 -0400
-@@ -249,27 +249,46 @@ extern unsigned long __copy_user(void __
-
- static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
- {
-- if (n && __access_ok((unsigned long) to, n))
-+ if ((long)n < 0)
-+ return n;
-+
-+ if (n && __access_ok((unsigned long) to, n)) {
-+ if (!__builtin_constant_p(n))
-+ check_object_size(from, n, true);
- return __copy_user(to, (__force void __user *) from, n);
-- else
-+ } else
- return n;
- }
-
- static inline unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n)
- {
-+ if ((long)n < 0)
-+ return n;
-+
-+ if (!__builtin_constant_p(n))
-+ check_object_size(from, n, true);
-+
- return __copy_user(to, (__force void __user *) from, n);
- }
-
- static inline unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
- {
-- if (n && __access_ok((unsigned long) from, n))
-+ if ((long)n < 0)
-+ return n;
-+
-+ if (n && __access_ok((unsigned long) from, n)) {
-+ if (!__builtin_constant_p(n))
-+ check_object_size(to, n, false);
- return __copy_user((__force void __user *) to, from, n);
-- else
-+ } else
- return n;
- }
-
- static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
- {
-+ if ((long)n < 0)
-+ return n;
-+
- return __copy_user((__force void __user *) to, from, n);
- }
-
-diff -urNp linux-2.6.32.45/arch/sparc/include/asm/uaccess_64.h linux-2.6.32.45/arch/sparc/include/asm/uaccess_64.h
---- linux-2.6.32.45/arch/sparc/include/asm/uaccess_64.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/include/asm/uaccess_64.h 2011-04-17 15:56:46.000000000 -0400
-@@ -9,6 +9,7 @@
- #include <linux/compiler.h>
- #include <linux/string.h>
- #include <linux/thread_info.h>
-+#include <linux/kernel.h>
- #include <asm/asi.h>
- #include <asm/system.h>
- #include <asm/spitfire.h>
-@@ -212,8 +213,15 @@ extern unsigned long copy_from_user_fixu
- static inline unsigned long __must_check
- copy_from_user(void *to, const void __user *from, unsigned long size)
- {
-- unsigned long ret = ___copy_from_user(to, from, size);
-+ unsigned long ret;
-
-+ if ((long)size < 0 || size > INT_MAX)
-+ return size;
-+
-+ if (!__builtin_constant_p(size))
-+ check_object_size(to, size, false);
-+
-+ ret = ___copy_from_user(to, from, size);
- if (unlikely(ret))
- ret = copy_from_user_fixup(to, from, size);
- return ret;
-@@ -228,8 +236,15 @@ extern unsigned long copy_to_user_fixup(
- static inline unsigned long __must_check
- copy_to_user(void __user *to, const void *from, unsigned long size)
- {
-- unsigned long ret = ___copy_to_user(to, from, size);
-+ unsigned long ret;
-+
-+ if ((long)size < 0 || size > INT_MAX)
-+ return size;
-+
-+ if (!__builtin_constant_p(size))
-+ check_object_size(from, size, true);
-
-+ ret = ___copy_to_user(to, from, size);
- if (unlikely(ret))
- ret = copy_to_user_fixup(to, from, size);
- return ret;
-diff -urNp linux-2.6.32.45/arch/sparc/include/asm/uaccess.h linux-2.6.32.45/arch/sparc/include/asm/uaccess.h
---- linux-2.6.32.45/arch/sparc/include/asm/uaccess.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/include/asm/uaccess.h 2011-04-17 15:56:46.000000000 -0400
-@@ -1,5 +1,13 @@
- #ifndef ___ASM_SPARC_UACCESS_H
- #define ___ASM_SPARC_UACCESS_H
-+
-+#ifdef __KERNEL__
-+#ifndef __ASSEMBLY__
-+#include <linux/types.h>
-+extern void check_object_size(const void *ptr, unsigned long n, bool to);
-+#endif
-+#endif
-+
- #if defined(__sparc__) && defined(__arch64__)
- #include <asm/uaccess_64.h>
- #else
-diff -urNp linux-2.6.32.45/arch/sparc/kernel/iommu.c linux-2.6.32.45/arch/sparc/kernel/iommu.c
---- linux-2.6.32.45/arch/sparc/kernel/iommu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/kernel/iommu.c 2011-04-17 15:56:46.000000000 -0400
-@@ -826,7 +826,7 @@ static void dma_4u_sync_sg_for_cpu(struc
- spin_unlock_irqrestore(&iommu->lock, flags);
- }
-
--static struct dma_map_ops sun4u_dma_ops = {
-+static const struct dma_map_ops sun4u_dma_ops = {
- .alloc_coherent = dma_4u_alloc_coherent,
- .free_coherent = dma_4u_free_coherent,
- .map_page = dma_4u_map_page,
-@@ -837,7 +837,7 @@ static struct dma_map_ops sun4u_dma_ops
- .sync_sg_for_cpu = dma_4u_sync_sg_for_cpu,
- };
-
--struct dma_map_ops *dma_ops = &sun4u_dma_ops;
-+const struct dma_map_ops *dma_ops = &sun4u_dma_ops;
- EXPORT_SYMBOL(dma_ops);
-
- extern int pci64_dma_supported(struct pci_dev *pdev, u64 device_mask);
-diff -urNp linux-2.6.32.45/arch/sparc/kernel/ioport.c linux-2.6.32.45/arch/sparc/kernel/ioport.c
---- linux-2.6.32.45/arch/sparc/kernel/ioport.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/kernel/ioport.c 2011-04-17 15:56:46.000000000 -0400
-@@ -392,7 +392,7 @@ static void sbus_sync_sg_for_device(stru
- BUG();
- }
-
--struct dma_map_ops sbus_dma_ops = {
-+const struct dma_map_ops sbus_dma_ops = {
- .alloc_coherent = sbus_alloc_coherent,
- .free_coherent = sbus_free_coherent,
- .map_page = sbus_map_page,
-@@ -403,7 +403,7 @@ struct dma_map_ops sbus_dma_ops = {
- .sync_sg_for_device = sbus_sync_sg_for_device,
- };
-
--struct dma_map_ops *dma_ops = &sbus_dma_ops;
-+const struct dma_map_ops *dma_ops = &sbus_dma_ops;
- EXPORT_SYMBOL(dma_ops);
-
- static int __init sparc_register_ioport(void)
-@@ -640,7 +640,7 @@ static void pci32_sync_sg_for_device(str
- }
- }
-
--struct dma_map_ops pci32_dma_ops = {
-+const struct dma_map_ops pci32_dma_ops = {
- .alloc_coherent = pci32_alloc_coherent,
- .free_coherent = pci32_free_coherent,
- .map_page = pci32_map_page,
-diff -urNp linux-2.6.32.45/arch/sparc/kernel/kgdb_32.c linux-2.6.32.45/arch/sparc/kernel/kgdb_32.c
---- linux-2.6.32.45/arch/sparc/kernel/kgdb_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/kernel/kgdb_32.c 2011-04-17 15:56:46.000000000 -0400
-@@ -158,7 +158,7 @@ void kgdb_arch_exit(void)
- {
- }
-
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- /* Breakpoint instruction: ta 0x7d */
- .gdb_bpt_instr = { 0x91, 0xd0, 0x20, 0x7d },
- };
-diff -urNp linux-2.6.32.45/arch/sparc/kernel/kgdb_64.c linux-2.6.32.45/arch/sparc/kernel/kgdb_64.c
---- linux-2.6.32.45/arch/sparc/kernel/kgdb_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/kernel/kgdb_64.c 2011-04-17 15:56:46.000000000 -0400
-@@ -180,7 +180,7 @@ void kgdb_arch_exit(void)
- {
- }
-
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- /* Breakpoint instruction: ta 0x72 */
- .gdb_bpt_instr = { 0x91, 0xd0, 0x20, 0x72 },
- };
-diff -urNp linux-2.6.32.45/arch/sparc/kernel/Makefile linux-2.6.32.45/arch/sparc/kernel/Makefile
---- linux-2.6.32.45/arch/sparc/kernel/Makefile 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/kernel/Makefile 2011-04-17 15:56:46.000000000 -0400
-@@ -3,7 +3,7 @@
- #
-
- asflags-y := -ansi
--ccflags-y := -Werror
-+#ccflags-y := -Werror
-
- extra-y := head_$(BITS).o
- extra-y += init_task.o
-diff -urNp linux-2.6.32.45/arch/sparc/kernel/pci_sun4v.c linux-2.6.32.45/arch/sparc/kernel/pci_sun4v.c
---- linux-2.6.32.45/arch/sparc/kernel/pci_sun4v.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/kernel/pci_sun4v.c 2011-04-17 15:56:46.000000000 -0400
-@@ -525,7 +525,7 @@ static void dma_4v_unmap_sg(struct devic
- spin_unlock_irqrestore(&iommu->lock, flags);
- }
-
--static struct dma_map_ops sun4v_dma_ops = {
-+static const struct dma_map_ops sun4v_dma_ops = {
- .alloc_coherent = dma_4v_alloc_coherent,
- .free_coherent = dma_4v_free_coherent,
- .map_page = dma_4v_map_page,
-diff -urNp linux-2.6.32.45/arch/sparc/kernel/process_32.c linux-2.6.32.45/arch/sparc/kernel/process_32.c
---- linux-2.6.32.45/arch/sparc/kernel/process_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/kernel/process_32.c 2011-04-17 15:56:46.000000000 -0400
-@@ -196,7 +196,7 @@ void __show_backtrace(unsigned long fp)
- rw->ins[4], rw->ins[5],
- rw->ins[6],
- rw->ins[7]);
-- printk("%pS\n", (void *) rw->ins[7]);
-+ printk("%pA\n", (void *) rw->ins[7]);
- rw = (struct reg_window32 *) rw->ins[6];
- }
- spin_unlock_irqrestore(&sparc_backtrace_lock, flags);
-@@ -263,14 +263,14 @@ void show_regs(struct pt_regs *r)
-
- printk("PSR: %08lx PC: %08lx NPC: %08lx Y: %08lx %s\n",
- r->psr, r->pc, r->npc, r->y, print_tainted());
-- printk("PC: <%pS>\n", (void *) r->pc);
-+ printk("PC: <%pA>\n", (void *) r->pc);
- printk("%%G: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
- r->u_regs[0], r->u_regs[1], r->u_regs[2], r->u_regs[3],
- r->u_regs[4], r->u_regs[5], r->u_regs[6], r->u_regs[7]);
- printk("%%O: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
- r->u_regs[8], r->u_regs[9], r->u_regs[10], r->u_regs[11],
- r->u_regs[12], r->u_regs[13], r->u_regs[14], r->u_regs[15]);
-- printk("RPC: <%pS>\n", (void *) r->u_regs[15]);
-+ printk("RPC: <%pA>\n", (void *) r->u_regs[15]);
-
- printk("%%L: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
- rw->locals[0], rw->locals[1], rw->locals[2], rw->locals[3],
-@@ -305,7 +305,7 @@ void show_stack(struct task_struct *tsk,
- rw = (struct reg_window32 *) fp;
- pc = rw->ins[7];
- printk("[%08lx : ", pc);
-- printk("%pS ] ", (void *) pc);
-+ printk("%pA ] ", (void *) pc);
- fp = rw->ins[6];
- } while (++count < 16);
- printk("\n");
-diff -urNp linux-2.6.32.45/arch/sparc/kernel/process_64.c linux-2.6.32.45/arch/sparc/kernel/process_64.c
---- linux-2.6.32.45/arch/sparc/kernel/process_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/kernel/process_64.c 2011-04-17 15:56:46.000000000 -0400
-@@ -180,14 +180,14 @@ static void show_regwindow(struct pt_reg
- printk("i4: %016lx i5: %016lx i6: %016lx i7: %016lx\n",
- rwk->ins[4], rwk->ins[5], rwk->ins[6], rwk->ins[7]);
- if (regs->tstate & TSTATE_PRIV)
-- printk("I7: <%pS>\n", (void *) rwk->ins[7]);
-+ printk("I7: <%pA>\n", (void *) rwk->ins[7]);
- }
-
- void show_regs(struct pt_regs *regs)
- {
- printk("TSTATE: %016lx TPC: %016lx TNPC: %016lx Y: %08x %s\n", regs->tstate,
- regs->tpc, regs->tnpc, regs->y, print_tainted());
-- printk("TPC: <%pS>\n", (void *) regs->tpc);
-+ printk("TPC: <%pA>\n", (void *) regs->tpc);
- printk("g0: %016lx g1: %016lx g2: %016lx g3: %016lx\n",
- regs->u_regs[0], regs->u_regs[1], regs->u_regs[2],
- regs->u_regs[3]);
-@@ -200,7 +200,7 @@ void show_regs(struct pt_regs *regs)
- printk("o4: %016lx o5: %016lx sp: %016lx ret_pc: %016lx\n",
- regs->u_regs[12], regs->u_regs[13], regs->u_regs[14],
- regs->u_regs[15]);
-- printk("RPC: <%pS>\n", (void *) regs->u_regs[15]);
-+ printk("RPC: <%pA>\n", (void *) regs->u_regs[15]);
- show_regwindow(regs);
- }
-
-@@ -284,7 +284,7 @@ void arch_trigger_all_cpu_backtrace(void
- ((tp && tp->task) ? tp->task->pid : -1));
-
- if (gp->tstate & TSTATE_PRIV) {
-- printk(" TPC[%pS] O7[%pS] I7[%pS] RPC[%pS]\n",
-+ printk(" TPC[%pA] O7[%pA] I7[%pA] RPC[%pA]\n",
- (void *) gp->tpc,
- (void *) gp->o7,
- (void *) gp->i7,
-diff -urNp linux-2.6.32.45/arch/sparc/kernel/sys_sparc_32.c linux-2.6.32.45/arch/sparc/kernel/sys_sparc_32.c
---- linux-2.6.32.45/arch/sparc/kernel/sys_sparc_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/kernel/sys_sparc_32.c 2011-04-17 15:56:46.000000000 -0400
-@@ -57,7 +57,7 @@ unsigned long arch_get_unmapped_area(str
- if (ARCH_SUN4C && len > 0x20000000)
- return -ENOMEM;
- if (!addr)
-- addr = TASK_UNMAPPED_BASE;
-+ addr = current->mm->mmap_base;
-
- if (flags & MAP_SHARED)
- addr = COLOUR_ALIGN(addr);
-@@ -72,7 +72,7 @@ unsigned long arch_get_unmapped_area(str
- }
- if (TASK_SIZE - PAGE_SIZE - len < addr)
- return -ENOMEM;
-- if (!vmm || addr + len <= vmm->vm_start)
-+ if (check_heap_stack_gap(vmm, addr, len))
- return addr;
- addr = vmm->vm_end;
- if (flags & MAP_SHARED)
-diff -urNp linux-2.6.32.45/arch/sparc/kernel/sys_sparc_64.c linux-2.6.32.45/arch/sparc/kernel/sys_sparc_64.c
---- linux-2.6.32.45/arch/sparc/kernel/sys_sparc_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/kernel/sys_sparc_64.c 2011-04-17 15:56:46.000000000 -0400
-@@ -125,7 +125,7 @@ unsigned long arch_get_unmapped_area(str
- /* We do not accept a shared mapping if it would violate
- * cache aliasing constraints.
- */
-- if ((flags & MAP_SHARED) &&
-+ if ((filp || (flags & MAP_SHARED)) &&
- ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
- return -EINVAL;
- return addr;
-@@ -140,6 +140,10 @@ unsigned long arch_get_unmapped_area(str
- if (filp || (flags & MAP_SHARED))
- do_color_align = 1;
-
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- if (addr) {
- if (do_color_align)
- addr = COLOUR_ALIGN(addr, pgoff);
-@@ -147,15 +151,14 @@ unsigned long arch_get_unmapped_area(str
- addr = PAGE_ALIGN(addr);
-
- vma = find_vma(mm, addr);
-- if (task_size - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-+ if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
- return addr;
- }
-
- if (len > mm->cached_hole_size) {
-- start_addr = addr = mm->free_area_cache;
-+ start_addr = addr = mm->free_area_cache;
- } else {
-- start_addr = addr = TASK_UNMAPPED_BASE;
-+ start_addr = addr = mm->mmap_base;
- mm->cached_hole_size = 0;
- }
-
-@@ -175,14 +178,14 @@ full_search:
- vma = find_vma(mm, VA_EXCLUDE_END);
- }
- if (unlikely(task_size < addr)) {
-- if (start_addr != TASK_UNMAPPED_BASE) {
-- start_addr = addr = TASK_UNMAPPED_BASE;
-+ if (start_addr != mm->mmap_base) {
-+ start_addr = addr = mm->mmap_base;
- mm->cached_hole_size = 0;
- goto full_search;
- }
- return -ENOMEM;
- }
-- if (likely(!vma || addr + len <= vma->vm_start)) {
-+ if (likely(check_heap_stack_gap(vma, addr, len))) {
- /*
- * Remember the place where we stopped the search:
- */
-@@ -216,7 +219,7 @@ arch_get_unmapped_area_topdown(struct fi
- /* We do not accept a shared mapping if it would violate
- * cache aliasing constraints.
- */
-- if ((flags & MAP_SHARED) &&
-+ if ((filp || (flags & MAP_SHARED)) &&
- ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
- return -EINVAL;
- return addr;
-@@ -237,8 +240,7 @@ arch_get_unmapped_area_topdown(struct fi
- addr = PAGE_ALIGN(addr);
-
- vma = find_vma(mm, addr);
-- if (task_size - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-+ if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
- return addr;
- }
-
-@@ -259,7 +261,7 @@ arch_get_unmapped_area_topdown(struct fi
- /* make sure it can fit in the remaining address space */
- if (likely(addr > len)) {
- vma = find_vma(mm, addr-len);
-- if (!vma || addr <= vma->vm_start) {
-+ if (check_heap_stack_gap(vma, addr - len, len)) {
- /* remember the address as a hint for next time */
- return (mm->free_area_cache = addr-len);
- }
-@@ -268,18 +270,18 @@ arch_get_unmapped_area_topdown(struct fi
- if (unlikely(mm->mmap_base < len))
- goto bottomup;
-
-- addr = mm->mmap_base-len;
-- if (do_color_align)
-- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
-+ addr = mm->mmap_base - len;
-
- do {
-+ if (do_color_align)
-+ addr = COLOUR_ALIGN_DOWN(addr, pgoff);
- /*
- * Lookup failure means no vma is above this address,
- * else if new region fits below vma->vm_start,
- * return with success:
- */
- vma = find_vma(mm, addr);
-- if (likely(!vma || addr+len <= vma->vm_start)) {
-+ if (likely(check_heap_stack_gap(vma, addr, len))) {
- /* remember the address as a hint for next time */
- return (mm->free_area_cache = addr);
- }
-@@ -289,10 +291,8 @@ arch_get_unmapped_area_topdown(struct fi
- mm->cached_hole_size = vma->vm_start - addr;
-
- /* try just below the current vma->vm_start */
-- addr = vma->vm_start-len;
-- if (do_color_align)
-- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
-- } while (likely(len < vma->vm_start));
-+ addr = skip_heap_stack_gap(vma, len);
-+ } while (!IS_ERR_VALUE(addr));
-
- bottomup:
- /*
-@@ -384,6 +384,12 @@ void arch_pick_mmap_layout(struct mm_str
- current->signal->rlim[RLIMIT_STACK].rlim_cur == RLIM_INFINITY ||
- sysctl_legacy_va_layout) {
- mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- mm->get_unmapped_area = arch_get_unmapped_area;
- mm->unmap_area = arch_unmap_area;
- } else {
-@@ -398,6 +404,12 @@ void arch_pick_mmap_layout(struct mm_str
- gap = (task_size / 6 * 5);
-
- mm->mmap_base = PAGE_ALIGN(task_size - gap - random_factor);
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
-+#endif
-+
- mm->get_unmapped_area = arch_get_unmapped_area_topdown;
- mm->unmap_area = arch_unmap_area_topdown;
- }
-diff -urNp linux-2.6.32.45/arch/sparc/kernel/traps_32.c linux-2.6.32.45/arch/sparc/kernel/traps_32.c
---- linux-2.6.32.45/arch/sparc/kernel/traps_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/kernel/traps_32.c 2011-06-13 21:25:39.000000000 -0400
-@@ -44,6 +44,8 @@ static void instruction_dump(unsigned lo
- #define __SAVE __asm__ __volatile__("save %sp, -0x40, %sp\n\t")
- #define __RESTORE __asm__ __volatile__("restore %g0, %g0, %g0\n\t")
-
-+extern void gr_handle_kernel_exploit(void);
-+
- void die_if_kernel(char *str, struct pt_regs *regs)
- {
- static int die_counter;
-@@ -76,15 +78,17 @@ void die_if_kernel(char *str, struct pt_
- count++ < 30 &&
- (((unsigned long) rw) >= PAGE_OFFSET) &&
- !(((unsigned long) rw) & 0x7)) {
-- printk("Caller[%08lx]: %pS\n", rw->ins[7],
-+ printk("Caller[%08lx]: %pA\n", rw->ins[7],
- (void *) rw->ins[7]);
- rw = (struct reg_window32 *)rw->ins[6];
- }
- }
- printk("Instruction DUMP:");
- instruction_dump ((unsigned long *) regs->pc);
-- if(regs->psr & PSR_PS)
-+ if(regs->psr & PSR_PS) {
-+ gr_handle_kernel_exploit();
- do_exit(SIGKILL);
-+ }
- do_exit(SIGSEGV);
- }
-
-diff -urNp linux-2.6.32.45/arch/sparc/kernel/traps_64.c linux-2.6.32.45/arch/sparc/kernel/traps_64.c
---- linux-2.6.32.45/arch/sparc/kernel/traps_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/kernel/traps_64.c 2011-06-13 21:24:11.000000000 -0400
-@@ -73,7 +73,7 @@ static void dump_tl1_traplog(struct tl1_
- i + 1,
- p->trapstack[i].tstate, p->trapstack[i].tpc,
- p->trapstack[i].tnpc, p->trapstack[i].tt);
-- printk("TRAPLOG: TPC<%pS>\n", (void *) p->trapstack[i].tpc);
-+ printk("TRAPLOG: TPC<%pA>\n", (void *) p->trapstack[i].tpc);
- }
- }
-
-@@ -93,6 +93,12 @@ void bad_trap(struct pt_regs *regs, long
-
- lvl -= 0x100;
- if (regs->tstate & TSTATE_PRIV) {
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ if (lvl == 6)
-+ pax_report_refcount_overflow(regs);
-+#endif
-+
- sprintf(buffer, "Kernel bad sw trap %lx", lvl);
- die_if_kernel(buffer, regs);
- }
-@@ -111,11 +117,16 @@ void bad_trap(struct pt_regs *regs, long
- void bad_trap_tl1(struct pt_regs *regs, long lvl)
- {
- char buffer[32];
--
-+
- if (notify_die(DIE_TRAP_TL1, "bad trap tl1", regs,
- 0, lvl, SIGTRAP) == NOTIFY_STOP)
- return;
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+ if (lvl == 6)
-+ pax_report_refcount_overflow(regs);
-+#endif
-+
- dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
-
- sprintf (buffer, "Bad trap %lx at tl>0", lvl);
-@@ -1139,7 +1150,7 @@ static void cheetah_log_errors(struct pt
- regs->tpc, regs->tnpc, regs->u_regs[UREG_I7], regs->tstate);
- printk("%s" "ERROR(%d): ",
- (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id());
-- printk("TPC<%pS>\n", (void *) regs->tpc);
-+ printk("TPC<%pA>\n", (void *) regs->tpc);
- printk("%s" "ERROR(%d): M_SYND(%lx), E_SYND(%lx)%s%s\n",
- (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id(),
- (afsr & CHAFSR_M_SYNDROME) >> CHAFSR_M_SYNDROME_SHIFT,
-@@ -1746,7 +1757,7 @@ void cheetah_plus_parity_error(int type,
- smp_processor_id(),
- (type & 0x1) ? 'I' : 'D',
- regs->tpc);
-- printk(KERN_EMERG "TPC<%pS>\n", (void *) regs->tpc);
-+ printk(KERN_EMERG "TPC<%pA>\n", (void *) regs->tpc);
- panic("Irrecoverable Cheetah+ parity error.");
- }
-
-@@ -1754,7 +1765,7 @@ void cheetah_plus_parity_error(int type,
- smp_processor_id(),
- (type & 0x1) ? 'I' : 'D',
- regs->tpc);
-- printk(KERN_WARNING "TPC<%pS>\n", (void *) regs->tpc);
-+ printk(KERN_WARNING "TPC<%pA>\n", (void *) regs->tpc);
- }
-
- struct sun4v_error_entry {
-@@ -1961,9 +1972,9 @@ void sun4v_itlb_error_report(struct pt_r
-
- printk(KERN_EMERG "SUN4V-ITLB: Error at TPC[%lx], tl %d\n",
- regs->tpc, tl);
-- printk(KERN_EMERG "SUN4V-ITLB: TPC<%pS>\n", (void *) regs->tpc);
-+ printk(KERN_EMERG "SUN4V-ITLB: TPC<%pA>\n", (void *) regs->tpc);
- printk(KERN_EMERG "SUN4V-ITLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
-- printk(KERN_EMERG "SUN4V-ITLB: O7<%pS>\n",
-+ printk(KERN_EMERG "SUN4V-ITLB: O7<%pA>\n",
- (void *) regs->u_regs[UREG_I7]);
- printk(KERN_EMERG "SUN4V-ITLB: vaddr[%lx] ctx[%lx] "
- "pte[%lx] error[%lx]\n",
-@@ -1985,9 +1996,9 @@ void sun4v_dtlb_error_report(struct pt_r
-
- printk(KERN_EMERG "SUN4V-DTLB: Error at TPC[%lx], tl %d\n",
- regs->tpc, tl);
-- printk(KERN_EMERG "SUN4V-DTLB: TPC<%pS>\n", (void *) regs->tpc);
-+ printk(KERN_EMERG "SUN4V-DTLB: TPC<%pA>\n", (void *) regs->tpc);
- printk(KERN_EMERG "SUN4V-DTLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
-- printk(KERN_EMERG "SUN4V-DTLB: O7<%pS>\n",
-+ printk(KERN_EMERG "SUN4V-DTLB: O7<%pA>\n",
- (void *) regs->u_regs[UREG_I7]);
- printk(KERN_EMERG "SUN4V-DTLB: vaddr[%lx] ctx[%lx] "
- "pte[%lx] error[%lx]\n",
-@@ -2191,7 +2202,7 @@ void show_stack(struct task_struct *tsk,
- fp = (unsigned long)sf->fp + STACK_BIAS;
- }
-
-- printk(" [%016lx] %pS\n", pc, (void *) pc);
-+ printk(" [%016lx] %pA\n", pc, (void *) pc);
- } while (++count < 16);
- }
-
-@@ -2233,6 +2244,8 @@ static inline struct reg_window *kernel_
- return (struct reg_window *) (fp + STACK_BIAS);
- }
-
-+extern void gr_handle_kernel_exploit(void);
-+
- void die_if_kernel(char *str, struct pt_regs *regs)
- {
- static int die_counter;
-@@ -2260,7 +2273,7 @@ void die_if_kernel(char *str, struct pt_
- while (rw &&
- count++ < 30&&
- is_kernel_stack(current, rw)) {
-- printk("Caller[%016lx]: %pS\n", rw->ins[7],
-+ printk("Caller[%016lx]: %pA\n", rw->ins[7],
- (void *) rw->ins[7]);
-
- rw = kernel_stack_up(rw);
-@@ -2273,8 +2286,11 @@ void die_if_kernel(char *str, struct pt_
- }
- user_instruction_dump ((unsigned int __user *) regs->tpc);
- }
-- if (regs->tstate & TSTATE_PRIV)
-+ if (regs->tstate & TSTATE_PRIV) {
-+ gr_handle_kernel_exploit();
- do_exit(SIGKILL);
-+ }
-+
- do_exit(SIGSEGV);
- }
- EXPORT_SYMBOL(die_if_kernel);
-diff -urNp linux-2.6.32.45/arch/sparc/kernel/una_asm_64.S linux-2.6.32.45/arch/sparc/kernel/una_asm_64.S
---- linux-2.6.32.45/arch/sparc/kernel/una_asm_64.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/kernel/una_asm_64.S 2011-07-13 22:20:05.000000000 -0400
-@@ -127,7 +127,7 @@ do_int_load:
- wr %o5, 0x0, %asi
- retl
- mov 0, %o0
-- .size __do_int_load, .-__do_int_load
-+ .size do_int_load, .-do_int_load
-
- .section __ex_table,"a"
- .word 4b, __retl_efault
-diff -urNp linux-2.6.32.45/arch/sparc/kernel/unaligned_64.c linux-2.6.32.45/arch/sparc/kernel/unaligned_64.c
---- linux-2.6.32.45/arch/sparc/kernel/unaligned_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/kernel/unaligned_64.c 2011-04-17 15:56:46.000000000 -0400
-@@ -288,7 +288,7 @@ static void log_unaligned(struct pt_regs
- if (count < 5) {
- last_time = jiffies;
- count++;
-- printk("Kernel unaligned access at TPC[%lx] %pS\n",
-+ printk("Kernel unaligned access at TPC[%lx] %pA\n",
- regs->tpc, (void *) regs->tpc);
- }
- }
-diff -urNp linux-2.6.32.45/arch/sparc/lib/atomic_64.S linux-2.6.32.45/arch/sparc/lib/atomic_64.S
---- linux-2.6.32.45/arch/sparc/lib/atomic_64.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/lib/atomic_64.S 2011-04-17 15:56:46.000000000 -0400
-@@ -18,7 +18,12 @@
- atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
- BACKOFF_SETUP(%o2)
- 1: lduw [%o1], %g1
-- add %g1, %o0, %g7
-+ addcc %g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %icc, 6
-+#endif
-+
- cas [%o1], %g1, %g7
- cmp %g1, %g7
- bne,pn %icc, 2f
-@@ -28,12 +33,32 @@ atomic_add: /* %o0 = increment, %o1 = at
- 2: BACKOFF_SPIN(%o2, %o3, 1b)
- .size atomic_add, .-atomic_add
-
-+ .globl atomic_add_unchecked
-+ .type atomic_add_unchecked,#function
-+atomic_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
-+ BACKOFF_SETUP(%o2)
-+1: lduw [%o1], %g1
-+ add %g1, %o0, %g7
-+ cas [%o1], %g1, %g7
-+ cmp %g1, %g7
-+ bne,pn %icc, 2f
-+ nop
-+ retl
-+ nop
-+2: BACKOFF_SPIN(%o2, %o3, 1b)
-+ .size atomic_add_unchecked, .-atomic_add_unchecked
-+
- .globl atomic_sub
- .type atomic_sub,#function
- atomic_sub: /* %o0 = decrement, %o1 = atomic_ptr */
- BACKOFF_SETUP(%o2)
- 1: lduw [%o1], %g1
-- sub %g1, %o0, %g7
-+ subcc %g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %icc, 6
-+#endif
-+
- cas [%o1], %g1, %g7
- cmp %g1, %g7
- bne,pn %icc, 2f
-@@ -43,12 +68,32 @@ atomic_sub: /* %o0 = decrement, %o1 = at
- 2: BACKOFF_SPIN(%o2, %o3, 1b)
- .size atomic_sub, .-atomic_sub
-
-+ .globl atomic_sub_unchecked
-+ .type atomic_sub_unchecked,#function
-+atomic_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
-+ BACKOFF_SETUP(%o2)
-+1: lduw [%o1], %g1
-+ sub %g1, %o0, %g7
-+ cas [%o1], %g1, %g7
-+ cmp %g1, %g7
-+ bne,pn %icc, 2f
-+ nop
-+ retl
-+ nop
-+2: BACKOFF_SPIN(%o2, %o3, 1b)
-+ .size atomic_sub_unchecked, .-atomic_sub_unchecked
-+
- .globl atomic_add_ret
- .type atomic_add_ret,#function
- atomic_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
- BACKOFF_SETUP(%o2)
- 1: lduw [%o1], %g1
-- add %g1, %o0, %g7
-+ addcc %g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %icc, 6
-+#endif
-+
- cas [%o1], %g1, %g7
- cmp %g1, %g7
- bne,pn %icc, 2f
-@@ -59,12 +104,33 @@ atomic_add_ret: /* %o0 = increment, %o1
- 2: BACKOFF_SPIN(%o2, %o3, 1b)
- .size atomic_add_ret, .-atomic_add_ret
-
-+ .globl atomic_add_ret_unchecked
-+ .type atomic_add_ret_unchecked,#function
-+atomic_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
-+ BACKOFF_SETUP(%o2)
-+1: lduw [%o1], %g1
-+ addcc %g1, %o0, %g7
-+ cas [%o1], %g1, %g7
-+ cmp %g1, %g7
-+ bne,pn %icc, 2f
-+ add %g7, %o0, %g7
-+ sra %g7, 0, %o0
-+ retl
-+ nop
-+2: BACKOFF_SPIN(%o2, %o3, 1b)
-+ .size atomic_add_ret_unchecked, .-atomic_add_ret_unchecked
-+
- .globl atomic_sub_ret
- .type atomic_sub_ret,#function
- atomic_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
- BACKOFF_SETUP(%o2)
- 1: lduw [%o1], %g1
-- sub %g1, %o0, %g7
-+ subcc %g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %icc, 6
-+#endif
-+
- cas [%o1], %g1, %g7
- cmp %g1, %g7
- bne,pn %icc, 2f
-@@ -80,7 +146,12 @@ atomic_sub_ret: /* %o0 = decrement, %o1
- atomic64_add: /* %o0 = increment, %o1 = atomic_ptr */
- BACKOFF_SETUP(%o2)
- 1: ldx [%o1], %g1
-- add %g1, %o0, %g7
-+ addcc %g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %xcc, 6
-+#endif
-+
- casx [%o1], %g1, %g7
- cmp %g1, %g7
- bne,pn %xcc, 2f
-@@ -90,12 +161,32 @@ atomic64_add: /* %o0 = increment, %o1 =
- 2: BACKOFF_SPIN(%o2, %o3, 1b)
- .size atomic64_add, .-atomic64_add
-
-+ .globl atomic64_add_unchecked
-+ .type atomic64_add_unchecked,#function
-+atomic64_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
-+ BACKOFF_SETUP(%o2)
-+1: ldx [%o1], %g1
-+ addcc %g1, %o0, %g7
-+ casx [%o1], %g1, %g7
-+ cmp %g1, %g7
-+ bne,pn %xcc, 2f
-+ nop
-+ retl
-+ nop
-+2: BACKOFF_SPIN(%o2, %o3, 1b)
-+ .size atomic64_add_unchecked, .-atomic64_add_unchecked
-+
- .globl atomic64_sub
- .type atomic64_sub,#function
- atomic64_sub: /* %o0 = decrement, %o1 = atomic_ptr */
- BACKOFF_SETUP(%o2)
- 1: ldx [%o1], %g1
-- sub %g1, %o0, %g7
-+ subcc %g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %xcc, 6
-+#endif
-+
- casx [%o1], %g1, %g7
- cmp %g1, %g7
- bne,pn %xcc, 2f
-@@ -105,12 +196,32 @@ atomic64_sub: /* %o0 = decrement, %o1 =
- 2: BACKOFF_SPIN(%o2, %o3, 1b)
- .size atomic64_sub, .-atomic64_sub
-
-+ .globl atomic64_sub_unchecked
-+ .type atomic64_sub_unchecked,#function
-+atomic64_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
-+ BACKOFF_SETUP(%o2)
-+1: ldx [%o1], %g1
-+ subcc %g1, %o0, %g7
-+ casx [%o1], %g1, %g7
-+ cmp %g1, %g7
-+ bne,pn %xcc, 2f
-+ nop
-+ retl
-+ nop
-+2: BACKOFF_SPIN(%o2, %o3, 1b)
-+ .size atomic64_sub_unchecked, .-atomic64_sub_unchecked
-+
- .globl atomic64_add_ret
- .type atomic64_add_ret,#function
- atomic64_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
- BACKOFF_SETUP(%o2)
- 1: ldx [%o1], %g1
-- add %g1, %o0, %g7
-+ addcc %g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %xcc, 6
-+#endif
-+
- casx [%o1], %g1, %g7
- cmp %g1, %g7
- bne,pn %xcc, 2f
-@@ -121,12 +232,33 @@ atomic64_add_ret: /* %o0 = increment, %o
- 2: BACKOFF_SPIN(%o2, %o3, 1b)
- .size atomic64_add_ret, .-atomic64_add_ret
-
-+ .globl atomic64_add_ret_unchecked
-+ .type atomic64_add_ret_unchecked,#function
-+atomic64_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
-+ BACKOFF_SETUP(%o2)
-+1: ldx [%o1], %g1
-+ addcc %g1, %o0, %g7
-+ casx [%o1], %g1, %g7
-+ cmp %g1, %g7
-+ bne,pn %xcc, 2f
-+ add %g7, %o0, %g7
-+ mov %g7, %o0
-+ retl
-+ nop
-+2: BACKOFF_SPIN(%o2, %o3, 1b)
-+ .size atomic64_add_ret_unchecked, .-atomic64_add_ret_unchecked
-+
- .globl atomic64_sub_ret
- .type atomic64_sub_ret,#function
- atomic64_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
- BACKOFF_SETUP(%o2)
- 1: ldx [%o1], %g1
-- sub %g1, %o0, %g7
-+ subcc %g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %xcc, 6
-+#endif
-+
- casx [%o1], %g1, %g7
- cmp %g1, %g7
- bne,pn %xcc, 2f
-diff -urNp linux-2.6.32.45/arch/sparc/lib/ksyms.c linux-2.6.32.45/arch/sparc/lib/ksyms.c
---- linux-2.6.32.45/arch/sparc/lib/ksyms.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/lib/ksyms.c 2011-08-19 23:05:14.000000000 -0400
-@@ -144,12 +144,18 @@ EXPORT_SYMBOL(__downgrade_write);
-
- /* Atomic counter implementation. */
- EXPORT_SYMBOL(atomic_add);
-+EXPORT_SYMBOL(atomic_add_unchecked);
- EXPORT_SYMBOL(atomic_add_ret);
-+EXPORT_SYMBOL(atomic_add_ret_unchecked);
- EXPORT_SYMBOL(atomic_sub);
-+EXPORT_SYMBOL(atomic_sub_unchecked);
- EXPORT_SYMBOL(atomic_sub_ret);
- EXPORT_SYMBOL(atomic64_add);
-+EXPORT_SYMBOL(atomic64_add_unchecked);
- EXPORT_SYMBOL(atomic64_add_ret);
-+EXPORT_SYMBOL(atomic64_add_ret_unchecked);
- EXPORT_SYMBOL(atomic64_sub);
-+EXPORT_SYMBOL(atomic64_sub_unchecked);
- EXPORT_SYMBOL(atomic64_sub_ret);
-
- /* Atomic bit operations. */
-diff -urNp linux-2.6.32.45/arch/sparc/lib/Makefile linux-2.6.32.45/arch/sparc/lib/Makefile
---- linux-2.6.32.45/arch/sparc/lib/Makefile 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/lib/Makefile 2011-05-17 19:26:34.000000000 -0400
-@@ -2,7 +2,7 @@
- #
-
- asflags-y := -ansi -DST_DIV0=0x02
--ccflags-y := -Werror
-+#ccflags-y := -Werror
-
- lib-$(CONFIG_SPARC32) += mul.o rem.o sdiv.o udiv.o umul.o urem.o ashrdi3.o
- lib-$(CONFIG_SPARC32) += memcpy.o memset.o
-diff -urNp linux-2.6.32.45/arch/sparc/lib/rwsem_64.S linux-2.6.32.45/arch/sparc/lib/rwsem_64.S
---- linux-2.6.32.45/arch/sparc/lib/rwsem_64.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/lib/rwsem_64.S 2011-04-17 15:56:46.000000000 -0400
-@@ -11,7 +11,12 @@
- .globl __down_read
- __down_read:
- 1: lduw [%o0], %g1
-- add %g1, 1, %g7
-+ addcc %g1, 1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %icc, 6
-+#endif
-+
- cas [%o0], %g1, %g7
- cmp %g1, %g7
- bne,pn %icc, 1b
-@@ -33,7 +38,12 @@ __down_read:
- .globl __down_read_trylock
- __down_read_trylock:
- 1: lduw [%o0], %g1
-- add %g1, 1, %g7
-+ addcc %g1, 1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %icc, 6
-+#endif
-+
- cmp %g7, 0
- bl,pn %icc, 2f
- mov 0, %o1
-@@ -51,7 +61,12 @@ __down_write:
- or %g1, %lo(RWSEM_ACTIVE_WRITE_BIAS), %g1
- 1:
- lduw [%o0], %g3
-- add %g3, %g1, %g7
-+ addcc %g3, %g1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %icc, 6
-+#endif
-+
- cas [%o0], %g3, %g7
- cmp %g3, %g7
- bne,pn %icc, 1b
-@@ -77,7 +92,12 @@ __down_write_trylock:
- cmp %g3, 0
- bne,pn %icc, 2f
- mov 0, %o1
-- add %g3, %g1, %g7
-+ addcc %g3, %g1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %icc, 6
-+#endif
-+
- cas [%o0], %g3, %g7
- cmp %g3, %g7
- bne,pn %icc, 1b
-@@ -90,7 +110,12 @@ __down_write_trylock:
- __up_read:
- 1:
- lduw [%o0], %g1
-- sub %g1, 1, %g7
-+ subcc %g1, 1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %icc, 6
-+#endif
-+
- cas [%o0], %g1, %g7
- cmp %g1, %g7
- bne,pn %icc, 1b
-@@ -118,7 +143,12 @@ __up_write:
- or %g1, %lo(RWSEM_ACTIVE_WRITE_BIAS), %g1
- 1:
- lduw [%o0], %g3
-- sub %g3, %g1, %g7
-+ subcc %g3, %g1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %icc, 6
-+#endif
-+
- cas [%o0], %g3, %g7
- cmp %g3, %g7
- bne,pn %icc, 1b
-@@ -143,7 +173,12 @@ __downgrade_write:
- or %g1, %lo(RWSEM_WAITING_BIAS), %g1
- 1:
- lduw [%o0], %g3
-- sub %g3, %g1, %g7
-+ subcc %g3, %g1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ tvs %icc, 6
-+#endif
-+
- cas [%o0], %g3, %g7
- cmp %g3, %g7
- bne,pn %icc, 1b
-diff -urNp linux-2.6.32.45/arch/sparc/Makefile linux-2.6.32.45/arch/sparc/Makefile
---- linux-2.6.32.45/arch/sparc/Makefile 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/Makefile 2011-04-17 15:56:46.000000000 -0400
-@@ -75,7 +75,7 @@ drivers-$(CONFIG_OPROFILE) += arch/sparc
- # Export what is needed by arch/sparc/boot/Makefile
- export VMLINUX_INIT VMLINUX_MAIN
- VMLINUX_INIT := $(head-y) $(init-y)
--VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/
-+VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
- VMLINUX_MAIN += $(patsubst %/, %/lib.a, $(libs-y)) $(libs-y)
- VMLINUX_MAIN += $(drivers-y) $(net-y)
-
-diff -urNp linux-2.6.32.45/arch/sparc/mm/fault_32.c linux-2.6.32.45/arch/sparc/mm/fault_32.c
---- linux-2.6.32.45/arch/sparc/mm/fault_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/mm/fault_32.c 2011-04-17 15:56:46.000000000 -0400
-@@ -21,6 +21,9 @@
- #include <linux/interrupt.h>
- #include <linux/module.h>
- #include <linux/kdebug.h>
-+#include <linux/slab.h>
-+#include <linux/pagemap.h>
-+#include <linux/compiler.h>
-
- #include <asm/system.h>
- #include <asm/page.h>
-@@ -167,6 +170,267 @@ static unsigned long compute_si_addr(str
- return safe_compute_effective_address(regs, insn);
- }
-
-+#ifdef CONFIG_PAX_PAGEEXEC
-+#ifdef CONFIG_PAX_DLRESOLVE
-+static void pax_emuplt_close(struct vm_area_struct *vma)
-+{
-+ vma->vm_mm->call_dl_resolve = 0UL;
-+}
-+
-+static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
-+{
-+ unsigned int *kaddr;
-+
-+ vmf->page = alloc_page(GFP_HIGHUSER);
-+ if (!vmf->page)
-+ return VM_FAULT_OOM;
-+
-+ kaddr = kmap(vmf->page);
-+ memset(kaddr, 0, PAGE_SIZE);
-+ kaddr[0] = 0x9DE3BFA8U; /* save */
-+ flush_dcache_page(vmf->page);
-+ kunmap(vmf->page);
-+ return VM_FAULT_MAJOR;
-+}
-+
-+static const struct vm_operations_struct pax_vm_ops = {
-+ .close = pax_emuplt_close,
-+ .fault = pax_emuplt_fault
-+};
-+
-+static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
-+{
-+ int ret;
-+
-+ vma->vm_mm = current->mm;
-+ vma->vm_start = addr;
-+ vma->vm_end = addr + PAGE_SIZE;
-+ vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
-+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
-+ vma->vm_ops = &pax_vm_ops;
-+
-+ ret = insert_vm_struct(current->mm, vma);
-+ if (ret)
-+ return ret;
-+
-+ ++current->mm->total_vm;
-+ return 0;
-+}
-+#endif
-+
-+/*
-+ * PaX: decide what to do with offenders (regs->pc = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ * 2 when patched PLT trampoline was detected
-+ * 3 when unpatched PLT trampoline was detected
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+ int err;
-+
-+ do { /* PaX: patched PLT emulation #1 */
-+ unsigned int sethi1, sethi2, jmpl;
-+
-+ err = get_user(sethi1, (unsigned int *)regs->pc);
-+ err |= get_user(sethi2, (unsigned int *)(regs->pc+4));
-+ err |= get_user(jmpl, (unsigned int *)(regs->pc+8));
-+
-+ if (err)
-+ break;
-+
-+ if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
-+ (sethi2 & 0xFFC00000U) == 0x03000000U &&
-+ (jmpl & 0xFFFFE000U) == 0x81C06000U)
-+ {
-+ unsigned int addr;
-+
-+ regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
-+ addr = regs->u_regs[UREG_G1];
-+ addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
-+ regs->pc = addr;
-+ regs->npc = addr+4;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ { /* PaX: patched PLT emulation #2 */
-+ unsigned int ba;
-+
-+ err = get_user(ba, (unsigned int *)regs->pc);
-+
-+ if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
-+ unsigned int addr;
-+
-+ addr = regs->pc + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
-+ regs->pc = addr;
-+ regs->npc = addr+4;
-+ return 2;
-+ }
-+ }
-+
-+ do { /* PaX: patched PLT emulation #3 */
-+ unsigned int sethi, jmpl, nop;
-+
-+ err = get_user(sethi, (unsigned int *)regs->pc);
-+ err |= get_user(jmpl, (unsigned int *)(regs->pc+4));
-+ err |= get_user(nop, (unsigned int *)(regs->pc+8));
-+
-+ if (err)
-+ break;
-+
-+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+ (jmpl & 0xFFFFE000U) == 0x81C06000U &&
-+ nop == 0x01000000U)
-+ {
-+ unsigned int addr;
-+
-+ addr = (sethi & 0x003FFFFFU) << 10;
-+ regs->u_regs[UREG_G1] = addr;
-+ addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
-+ regs->pc = addr;
-+ regs->npc = addr+4;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: unpatched PLT emulation step 1 */
-+ unsigned int sethi, ba, nop;
-+
-+ err = get_user(sethi, (unsigned int *)regs->pc);
-+ err |= get_user(ba, (unsigned int *)(regs->pc+4));
-+ err |= get_user(nop, (unsigned int *)(regs->pc+8));
-+
-+ if (err)
-+ break;
-+
-+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+ ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
-+ nop == 0x01000000U)
-+ {
-+ unsigned int addr, save, call;
-+
-+ if ((ba & 0xFFC00000U) == 0x30800000U)
-+ addr = regs->pc + 4 + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
-+ else
-+ addr = regs->pc + 4 + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
-+
-+ err = get_user(save, (unsigned int *)addr);
-+ err |= get_user(call, (unsigned int *)(addr+4));
-+ err |= get_user(nop, (unsigned int *)(addr+8));
-+ if (err)
-+ break;
-+
-+#ifdef CONFIG_PAX_DLRESOLVE
-+ if (save == 0x9DE3BFA8U &&
-+ (call & 0xC0000000U) == 0x40000000U &&
-+ nop == 0x01000000U)
-+ {
-+ struct vm_area_struct *vma;
-+ unsigned long call_dl_resolve;
-+
-+ down_read(¤t->mm->mmap_sem);
-+ call_dl_resolve = current->mm->call_dl_resolve;
-+ up_read(¤t->mm->mmap_sem);
-+ if (likely(call_dl_resolve))
-+ goto emulate;
-+
-+ vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
-+
-+ down_write(¤t->mm->mmap_sem);
-+ if (current->mm->call_dl_resolve) {
-+ call_dl_resolve = current->mm->call_dl_resolve;
-+ up_write(¤t->mm->mmap_sem);
-+ if (vma)
-+ kmem_cache_free(vm_area_cachep, vma);
-+ goto emulate;
-+ }
-+
-+ call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
-+ if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
-+ up_write(¤t->mm->mmap_sem);
-+ if (vma)
-+ kmem_cache_free(vm_area_cachep, vma);
-+ return 1;
-+ }
-+
-+ if (pax_insert_vma(vma, call_dl_resolve)) {
-+ up_write(¤t->mm->mmap_sem);
-+ kmem_cache_free(vm_area_cachep, vma);
-+ return 1;
-+ }
-+
-+ current->mm->call_dl_resolve = call_dl_resolve;
-+ up_write(¤t->mm->mmap_sem);
-+
-+emulate:
-+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
-+ regs->pc = call_dl_resolve;
-+ regs->npc = addr+4;
-+ return 3;
-+ }
-+#endif
-+
-+ /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
-+ if ((save & 0xFFC00000U) == 0x05000000U &&
-+ (call & 0xFFFFE000U) == 0x85C0A000U &&
-+ nop == 0x01000000U)
-+ {
-+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
-+ regs->u_regs[UREG_G2] = addr + 4;
-+ addr = (save & 0x003FFFFFU) << 10;
-+ addr += (((call | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
-+ regs->pc = addr;
-+ regs->npc = addr+4;
-+ return 3;
-+ }
-+ }
-+ } while (0);
-+
-+ do { /* PaX: unpatched PLT emulation step 2 */
-+ unsigned int save, call, nop;
-+
-+ err = get_user(save, (unsigned int *)(regs->pc-4));
-+ err |= get_user(call, (unsigned int *)regs->pc);
-+ err |= get_user(nop, (unsigned int *)(regs->pc+4));
-+ if (err)
-+ break;
-+
-+ if (save == 0x9DE3BFA8U &&
-+ (call & 0xC0000000U) == 0x40000000U &&
-+ nop == 0x01000000U)
-+ {
-+ unsigned int dl_resolve = regs->pc + ((((call | 0xC0000000U) ^ 0x20000000U) + 0x20000000U) << 2);
-+
-+ regs->u_regs[UREG_RETPC] = regs->pc;
-+ regs->pc = dl_resolve;
-+ regs->npc = dl_resolve+4;
-+ return 3;
-+ }
-+ } while (0);
-+#endif
-+
-+ return 1;
-+}
-+
-+void pax_report_insns(void *pc, void *sp)
-+{
-+ unsigned long i;
-+
-+ printk(KERN_ERR "PAX: bytes at PC: ");
-+ for (i = 0; i < 8; i++) {
-+ unsigned int c;
-+ if (get_user(c, (unsigned int *)pc+i))
-+ printk(KERN_CONT "???????? ");
-+ else
-+ printk(KERN_CONT "%08x ", c);
-+ }
-+ printk("\n");
-+}
-+#endif
-+
- asmlinkage void do_sparc_fault(struct pt_regs *regs, int text_fault, int write,
- unsigned long address)
- {
-@@ -231,6 +495,24 @@ good_area:
- if(!(vma->vm_flags & VM_WRITE))
- goto bad_area;
- } else {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && text_fault && !(vma->vm_flags & VM_EXEC)) {
-+ up_read(&mm->mmap_sem);
-+ switch (pax_handle_fetch_fault(regs)) {
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+ case 2:
-+ case 3:
-+ return;
-+#endif
-+
-+ }
-+ pax_report_fault(regs, (void *)regs->pc, (void *)regs->u_regs[UREG_FP]);
-+ do_group_exit(SIGKILL);
-+ }
-+#endif
-+
- /* Allow reads even for write-only mappings */
- if(!(vma->vm_flags & (VM_READ | VM_EXEC)))
- goto bad_area;
-diff -urNp linux-2.6.32.45/arch/sparc/mm/fault_64.c linux-2.6.32.45/arch/sparc/mm/fault_64.c
---- linux-2.6.32.45/arch/sparc/mm/fault_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/mm/fault_64.c 2011-04-17 15:56:46.000000000 -0400
-@@ -20,6 +20,9 @@
- #include <linux/kprobes.h>
- #include <linux/kdebug.h>
- #include <linux/percpu.h>
-+#include <linux/slab.h>
-+#include <linux/pagemap.h>
-+#include <linux/compiler.h>
-
- #include <asm/page.h>
- #include <asm/pgtable.h>
-@@ -78,7 +81,7 @@ static void bad_kernel_pc(struct pt_regs
- printk(KERN_CRIT "OOPS: Bogus kernel PC [%016lx] in fault handler\n",
- regs->tpc);
- printk(KERN_CRIT "OOPS: RPC [%016lx]\n", regs->u_regs[15]);
-- printk("OOPS: RPC <%pS>\n", (void *) regs->u_regs[15]);
-+ printk("OOPS: RPC <%pA>\n", (void *) regs->u_regs[15]);
- printk(KERN_CRIT "OOPS: Fault was to vaddr[%lx]\n", vaddr);
- dump_stack();
- unhandled_fault(regs->tpc, current, regs);
-@@ -249,6 +252,456 @@ static void noinline bogus_32bit_fault_a
- show_regs(regs);
- }
-
-+#ifdef CONFIG_PAX_PAGEEXEC
-+#ifdef CONFIG_PAX_DLRESOLVE
-+static void pax_emuplt_close(struct vm_area_struct *vma)
-+{
-+ vma->vm_mm->call_dl_resolve = 0UL;
-+}
-+
-+static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
-+{
-+ unsigned int *kaddr;
-+
-+ vmf->page = alloc_page(GFP_HIGHUSER);
-+ if (!vmf->page)
-+ return VM_FAULT_OOM;
-+
-+ kaddr = kmap(vmf->page);
-+ memset(kaddr, 0, PAGE_SIZE);
-+ kaddr[0] = 0x9DE3BFA8U; /* save */
-+ flush_dcache_page(vmf->page);
-+ kunmap(vmf->page);
-+ return VM_FAULT_MAJOR;
-+}
-+
-+static const struct vm_operations_struct pax_vm_ops = {
-+ .close = pax_emuplt_close,
-+ .fault = pax_emuplt_fault
-+};
-+
-+static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
-+{
-+ int ret;
-+
-+ vma->vm_mm = current->mm;
-+ vma->vm_start = addr;
-+ vma->vm_end = addr + PAGE_SIZE;
-+ vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
-+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
-+ vma->vm_ops = &pax_vm_ops;
-+
-+ ret = insert_vm_struct(current->mm, vma);
-+ if (ret)
-+ return ret;
-+
-+ ++current->mm->total_vm;
-+ return 0;
-+}
-+#endif
-+
-+/*
-+ * PaX: decide what to do with offenders (regs->tpc = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ * 2 when patched PLT trampoline was detected
-+ * 3 when unpatched PLT trampoline was detected
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+ int err;
-+
-+ do { /* PaX: patched PLT emulation #1 */
-+ unsigned int sethi1, sethi2, jmpl;
-+
-+ err = get_user(sethi1, (unsigned int *)regs->tpc);
-+ err |= get_user(sethi2, (unsigned int *)(regs->tpc+4));
-+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+8));
-+
-+ if (err)
-+ break;
-+
-+ if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
-+ (sethi2 & 0xFFC00000U) == 0x03000000U &&
-+ (jmpl & 0xFFFFE000U) == 0x81C06000U)
-+ {
-+ unsigned long addr;
-+
-+ regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
-+ addr = regs->u_regs[UREG_G1];
-+ addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
-+
-+ if (test_thread_flag(TIF_32BIT))
-+ addr &= 0xFFFFFFFFUL;
-+
-+ regs->tpc = addr;
-+ regs->tnpc = addr+4;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ { /* PaX: patched PLT emulation #2 */
-+ unsigned int ba;
-+
-+ err = get_user(ba, (unsigned int *)regs->tpc);
-+
-+ if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
-+ unsigned long addr;
-+
-+ addr = regs->tpc + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
-+
-+ if (test_thread_flag(TIF_32BIT))
-+ addr &= 0xFFFFFFFFUL;
-+
-+ regs->tpc = addr;
-+ regs->tnpc = addr+4;
-+ return 2;
-+ }
-+ }
-+
-+ do { /* PaX: patched PLT emulation #3 */
-+ unsigned int sethi, jmpl, nop;
-+
-+ err = get_user(sethi, (unsigned int *)regs->tpc);
-+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+4));
-+ err |= get_user(nop, (unsigned int *)(regs->tpc+8));
-+
-+ if (err)
-+ break;
-+
-+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+ (jmpl & 0xFFFFE000U) == 0x81C06000U &&
-+ nop == 0x01000000U)
-+ {
-+ unsigned long addr;
-+
-+ addr = (sethi & 0x003FFFFFU) << 10;
-+ regs->u_regs[UREG_G1] = addr;
-+ addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
-+
-+ if (test_thread_flag(TIF_32BIT))
-+ addr &= 0xFFFFFFFFUL;
-+
-+ regs->tpc = addr;
-+ regs->tnpc = addr+4;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: patched PLT emulation #4 */
-+ unsigned int sethi, mov1, call, mov2;
-+
-+ err = get_user(sethi, (unsigned int *)regs->tpc);
-+ err |= get_user(mov1, (unsigned int *)(regs->tpc+4));
-+ err |= get_user(call, (unsigned int *)(regs->tpc+8));
-+ err |= get_user(mov2, (unsigned int *)(regs->tpc+12));
-+
-+ if (err)
-+ break;
-+
-+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+ mov1 == 0x8210000FU &&
-+ (call & 0xC0000000U) == 0x40000000U &&
-+ mov2 == 0x9E100001U)
-+ {
-+ unsigned long addr;
-+
-+ regs->u_regs[UREG_G1] = regs->u_regs[UREG_RETPC];
-+ addr = regs->tpc + 4 + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
-+
-+ if (test_thread_flag(TIF_32BIT))
-+ addr &= 0xFFFFFFFFUL;
-+
-+ regs->tpc = addr;
-+ regs->tnpc = addr+4;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: patched PLT emulation #5 */
-+ unsigned int sethi, sethi1, sethi2, or1, or2, sllx, jmpl, nop;
-+
-+ err = get_user(sethi, (unsigned int *)regs->tpc);
-+ err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
-+ err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
-+ err |= get_user(or1, (unsigned int *)(regs->tpc+12));
-+ err |= get_user(or2, (unsigned int *)(regs->tpc+16));
-+ err |= get_user(sllx, (unsigned int *)(regs->tpc+20));
-+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+24));
-+ err |= get_user(nop, (unsigned int *)(regs->tpc+28));
-+
-+ if (err)
-+ break;
-+
-+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+ (sethi1 & 0xFFC00000U) == 0x03000000U &&
-+ (sethi2 & 0xFFC00000U) == 0x0B000000U &&
-+ (or1 & 0xFFFFE000U) == 0x82106000U &&
-+ (or2 & 0xFFFFE000U) == 0x8A116000U &&
-+ sllx == 0x83287020U &&
-+ jmpl == 0x81C04005U &&
-+ nop == 0x01000000U)
-+ {
-+ unsigned long addr;
-+
-+ regs->u_regs[UREG_G1] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
-+ regs->u_regs[UREG_G1] <<= 32;
-+ regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
-+ addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
-+ regs->tpc = addr;
-+ regs->tnpc = addr+4;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: patched PLT emulation #6 */
-+ unsigned int sethi, sethi1, sethi2, sllx, or, jmpl, nop;
-+
-+ err = get_user(sethi, (unsigned int *)regs->tpc);
-+ err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
-+ err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
-+ err |= get_user(sllx, (unsigned int *)(regs->tpc+12));
-+ err |= get_user(or, (unsigned int *)(regs->tpc+16));
-+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+20));
-+ err |= get_user(nop, (unsigned int *)(regs->tpc+24));
-+
-+ if (err)
-+ break;
-+
-+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+ (sethi1 & 0xFFC00000U) == 0x03000000U &&
-+ (sethi2 & 0xFFC00000U) == 0x0B000000U &&
-+ sllx == 0x83287020U &&
-+ (or & 0xFFFFE000U) == 0x8A116000U &&
-+ jmpl == 0x81C04005U &&
-+ nop == 0x01000000U)
-+ {
-+ unsigned long addr;
-+
-+ regs->u_regs[UREG_G1] = (sethi1 & 0x003FFFFFU) << 10;
-+ regs->u_regs[UREG_G1] <<= 32;
-+ regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or & 0x3FFU);
-+ addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
-+ regs->tpc = addr;
-+ regs->tnpc = addr+4;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: unpatched PLT emulation step 1 */
-+ unsigned int sethi, ba, nop;
-+
-+ err = get_user(sethi, (unsigned int *)regs->tpc);
-+ err |= get_user(ba, (unsigned int *)(regs->tpc+4));
-+ err |= get_user(nop, (unsigned int *)(regs->tpc+8));
-+
-+ if (err)
-+ break;
-+
-+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+ ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
-+ nop == 0x01000000U)
-+ {
-+ unsigned long addr;
-+ unsigned int save, call;
-+ unsigned int sethi1, sethi2, or1, or2, sllx, add, jmpl;
-+
-+ if ((ba & 0xFFC00000U) == 0x30800000U)
-+ addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
-+ else
-+ addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
-+
-+ if (test_thread_flag(TIF_32BIT))
-+ addr &= 0xFFFFFFFFUL;
-+
-+ err = get_user(save, (unsigned int *)addr);
-+ err |= get_user(call, (unsigned int *)(addr+4));
-+ err |= get_user(nop, (unsigned int *)(addr+8));
-+ if (err)
-+ break;
-+
-+#ifdef CONFIG_PAX_DLRESOLVE
-+ if (save == 0x9DE3BFA8U &&
-+ (call & 0xC0000000U) == 0x40000000U &&
-+ nop == 0x01000000U)
-+ {
-+ struct vm_area_struct *vma;
-+ unsigned long call_dl_resolve;
-+
-+ down_read(¤t->mm->mmap_sem);
-+ call_dl_resolve = current->mm->call_dl_resolve;
-+ up_read(¤t->mm->mmap_sem);
-+ if (likely(call_dl_resolve))
-+ goto emulate;
-+
-+ vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
-+
-+ down_write(¤t->mm->mmap_sem);
-+ if (current->mm->call_dl_resolve) {
-+ call_dl_resolve = current->mm->call_dl_resolve;
-+ up_write(¤t->mm->mmap_sem);
-+ if (vma)
-+ kmem_cache_free(vm_area_cachep, vma);
-+ goto emulate;
-+ }
-+
-+ call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
-+ if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
-+ up_write(¤t->mm->mmap_sem);
-+ if (vma)
-+ kmem_cache_free(vm_area_cachep, vma);
-+ return 1;
-+ }
-+
-+ if (pax_insert_vma(vma, call_dl_resolve)) {
-+ up_write(¤t->mm->mmap_sem);
-+ kmem_cache_free(vm_area_cachep, vma);
-+ return 1;
-+ }
-+
-+ current->mm->call_dl_resolve = call_dl_resolve;
-+ up_write(¤t->mm->mmap_sem);
-+
-+emulate:
-+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
-+ regs->tpc = call_dl_resolve;
-+ regs->tnpc = addr+4;
-+ return 3;
-+ }
-+#endif
-+
-+ /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
-+ if ((save & 0xFFC00000U) == 0x05000000U &&
-+ (call & 0xFFFFE000U) == 0x85C0A000U &&
-+ nop == 0x01000000U)
-+ {
-+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
-+ regs->u_regs[UREG_G2] = addr + 4;
-+ addr = (save & 0x003FFFFFU) << 10;
-+ addr += (((call | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
-+
-+ if (test_thread_flag(TIF_32BIT))
-+ addr &= 0xFFFFFFFFUL;
-+
-+ regs->tpc = addr;
-+ regs->tnpc = addr+4;
-+ return 3;
-+ }
-+
-+ /* PaX: 64-bit PLT stub */
-+ err = get_user(sethi1, (unsigned int *)addr);
-+ err |= get_user(sethi2, (unsigned int *)(addr+4));
-+ err |= get_user(or1, (unsigned int *)(addr+8));
-+ err |= get_user(or2, (unsigned int *)(addr+12));
-+ err |= get_user(sllx, (unsigned int *)(addr+16));
-+ err |= get_user(add, (unsigned int *)(addr+20));
-+ err |= get_user(jmpl, (unsigned int *)(addr+24));
-+ err |= get_user(nop, (unsigned int *)(addr+28));
-+ if (err)
-+ break;
-+
-+ if ((sethi1 & 0xFFC00000U) == 0x09000000U &&
-+ (sethi2 & 0xFFC00000U) == 0x0B000000U &&
-+ (or1 & 0xFFFFE000U) == 0x88112000U &&
-+ (or2 & 0xFFFFE000U) == 0x8A116000U &&
-+ sllx == 0x89293020U &&
-+ add == 0x8A010005U &&
-+ jmpl == 0x89C14000U &&
-+ nop == 0x01000000U)
-+ {
-+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
-+ regs->u_regs[UREG_G4] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
-+ regs->u_regs[UREG_G4] <<= 32;
-+ regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
-+ regs->u_regs[UREG_G5] += regs->u_regs[UREG_G4];
-+ regs->u_regs[UREG_G4] = addr + 24;
-+ addr = regs->u_regs[UREG_G5];
-+ regs->tpc = addr;
-+ regs->tnpc = addr+4;
-+ return 3;
-+ }
-+ }
-+ } while (0);
-+
-+#ifdef CONFIG_PAX_DLRESOLVE
-+ do { /* PaX: unpatched PLT emulation step 2 */
-+ unsigned int save, call, nop;
-+
-+ err = get_user(save, (unsigned int *)(regs->tpc-4));
-+ err |= get_user(call, (unsigned int *)regs->tpc);
-+ err |= get_user(nop, (unsigned int *)(regs->tpc+4));
-+ if (err)
-+ break;
-+
-+ if (save == 0x9DE3BFA8U &&
-+ (call & 0xC0000000U) == 0x40000000U &&
-+ nop == 0x01000000U)
-+ {
-+ unsigned long dl_resolve = regs->tpc + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
-+
-+ if (test_thread_flag(TIF_32BIT))
-+ dl_resolve &= 0xFFFFFFFFUL;
-+
-+ regs->u_regs[UREG_RETPC] = regs->tpc;
-+ regs->tpc = dl_resolve;
-+ regs->tnpc = dl_resolve+4;
-+ return 3;
-+ }
-+ } while (0);
-+#endif
-+
-+ do { /* PaX: patched PLT emulation #7, must be AFTER the unpatched PLT emulation */
-+ unsigned int sethi, ba, nop;
-+
-+ err = get_user(sethi, (unsigned int *)regs->tpc);
-+ err |= get_user(ba, (unsigned int *)(regs->tpc+4));
-+ err |= get_user(nop, (unsigned int *)(regs->tpc+8));
-+
-+ if (err)
-+ break;
-+
-+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+ (ba & 0xFFF00000U) == 0x30600000U &&
-+ nop == 0x01000000U)
-+ {
-+ unsigned long addr;
-+
-+ addr = (sethi & 0x003FFFFFU) << 10;
-+ regs->u_regs[UREG_G1] = addr;
-+ addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
-+
-+ if (test_thread_flag(TIF_32BIT))
-+ addr &= 0xFFFFFFFFUL;
-+
-+ regs->tpc = addr;
-+ regs->tnpc = addr+4;
-+ return 2;
-+ }
-+ } while (0);
-+
-+#endif
-+
-+ return 1;
-+}
-+
-+void pax_report_insns(void *pc, void *sp)
-+{
-+ unsigned long i;
-+
-+ printk(KERN_ERR "PAX: bytes at PC: ");
-+ for (i = 0; i < 8; i++) {
-+ unsigned int c;
-+ if (get_user(c, (unsigned int *)pc+i))
-+ printk(KERN_CONT "???????? ");
-+ else
-+ printk(KERN_CONT "%08x ", c);
-+ }
-+ printk("\n");
-+}
-+#endif
-+
- asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
- {
- struct mm_struct *mm = current->mm;
-@@ -315,6 +768,29 @@ asmlinkage void __kprobes do_sparc64_fau
- if (!vma)
- goto bad_area;
-
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ /* PaX: detect ITLB misses on non-exec pages */
-+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && vma->vm_start <= address &&
-+ !(vma->vm_flags & VM_EXEC) && (fault_code & FAULT_CODE_ITLB))
-+ {
-+ if (address != regs->tpc)
-+ goto good_area;
-+
-+ up_read(&mm->mmap_sem);
-+ switch (pax_handle_fetch_fault(regs)) {
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+ case 2:
-+ case 3:
-+ return;
-+#endif
-+
-+ }
-+ pax_report_fault(regs, (void *)regs->tpc, (void *)(regs->u_regs[UREG_FP] + STACK_BIAS));
-+ do_group_exit(SIGKILL);
-+ }
-+#endif
-+
- /* Pure DTLB misses do not tell us whether the fault causing
- * load/store/atomic was a write or not, it only says that there
- * was no match. So in such a case we (carefully) read the
-diff -urNp linux-2.6.32.45/arch/sparc/mm/hugetlbpage.c linux-2.6.32.45/arch/sparc/mm/hugetlbpage.c
---- linux-2.6.32.45/arch/sparc/mm/hugetlbpage.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/mm/hugetlbpage.c 2011-04-17 15:56:46.000000000 -0400
-@@ -69,7 +69,7 @@ full_search:
- }
- return -ENOMEM;
- }
-- if (likely(!vma || addr + len <= vma->vm_start)) {
-+ if (likely(check_heap_stack_gap(vma, addr, len))) {
- /*
- * Remember the place where we stopped the search:
- */
-@@ -108,7 +108,7 @@ hugetlb_get_unmapped_area_topdown(struct
- /* make sure it can fit in the remaining address space */
- if (likely(addr > len)) {
- vma = find_vma(mm, addr-len);
-- if (!vma || addr <= vma->vm_start) {
-+ if (check_heap_stack_gap(vma, addr - len, len)) {
- /* remember the address as a hint for next time */
- return (mm->free_area_cache = addr-len);
- }
-@@ -117,16 +117,17 @@ hugetlb_get_unmapped_area_topdown(struct
- if (unlikely(mm->mmap_base < len))
- goto bottomup;
-
-- addr = (mm->mmap_base-len) & HPAGE_MASK;
-+ addr = mm->mmap_base - len;
-
- do {
-+ addr &= HPAGE_MASK;
- /*
- * Lookup failure means no vma is above this address,
- * else if new region fits below vma->vm_start,
- * return with success:
- */
- vma = find_vma(mm, addr);
-- if (likely(!vma || addr+len <= vma->vm_start)) {
-+ if (likely(check_heap_stack_gap(vma, addr, len))) {
- /* remember the address as a hint for next time */
- return (mm->free_area_cache = addr);
- }
-@@ -136,8 +137,8 @@ hugetlb_get_unmapped_area_topdown(struct
- mm->cached_hole_size = vma->vm_start - addr;
-
- /* try just below the current vma->vm_start */
-- addr = (vma->vm_start-len) & HPAGE_MASK;
-- } while (likely(len < vma->vm_start));
-+ addr = skip_heap_stack_gap(vma, len);
-+ } while (!IS_ERR_VALUE(addr));
-
- bottomup:
- /*
-@@ -183,8 +184,7 @@ hugetlb_get_unmapped_area(struct file *f
- if (addr) {
- addr = ALIGN(addr, HPAGE_SIZE);
- vma = find_vma(mm, addr);
-- if (task_size - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-+ if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
- return addr;
- }
- if (mm->get_unmapped_area == arch_get_unmapped_area)
-diff -urNp linux-2.6.32.45/arch/sparc/mm/init_32.c linux-2.6.32.45/arch/sparc/mm/init_32.c
---- linux-2.6.32.45/arch/sparc/mm/init_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/mm/init_32.c 2011-04-17 15:56:46.000000000 -0400
-@@ -317,6 +317,9 @@ extern void device_scan(void);
- pgprot_t PAGE_SHARED __read_mostly;
- EXPORT_SYMBOL(PAGE_SHARED);
-
-+pgprot_t PAGE_SHARED_NOEXEC __read_mostly;
-+EXPORT_SYMBOL(PAGE_SHARED_NOEXEC);
-+
- void __init paging_init(void)
- {
- switch(sparc_cpu_model) {
-@@ -345,17 +348,17 @@ void __init paging_init(void)
-
- /* Initialize the protection map with non-constant, MMU dependent values. */
- protection_map[0] = PAGE_NONE;
-- protection_map[1] = PAGE_READONLY;
-- protection_map[2] = PAGE_COPY;
-- protection_map[3] = PAGE_COPY;
-+ protection_map[1] = PAGE_READONLY_NOEXEC;
-+ protection_map[2] = PAGE_COPY_NOEXEC;
-+ protection_map[3] = PAGE_COPY_NOEXEC;
- protection_map[4] = PAGE_READONLY;
- protection_map[5] = PAGE_READONLY;
- protection_map[6] = PAGE_COPY;
- protection_map[7] = PAGE_COPY;
- protection_map[8] = PAGE_NONE;
-- protection_map[9] = PAGE_READONLY;
-- protection_map[10] = PAGE_SHARED;
-- protection_map[11] = PAGE_SHARED;
-+ protection_map[9] = PAGE_READONLY_NOEXEC;
-+ protection_map[10] = PAGE_SHARED_NOEXEC;
-+ protection_map[11] = PAGE_SHARED_NOEXEC;
- protection_map[12] = PAGE_READONLY;
- protection_map[13] = PAGE_READONLY;
- protection_map[14] = PAGE_SHARED;
-diff -urNp linux-2.6.32.45/arch/sparc/mm/Makefile linux-2.6.32.45/arch/sparc/mm/Makefile
---- linux-2.6.32.45/arch/sparc/mm/Makefile 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/mm/Makefile 2011-04-17 15:56:46.000000000 -0400
-@@ -2,7 +2,7 @@
- #
-
- asflags-y := -ansi
--ccflags-y := -Werror
-+#ccflags-y := -Werror
-
- obj-$(CONFIG_SPARC64) += ultra.o tlb.o tsb.o
- obj-y += fault_$(BITS).o
-diff -urNp linux-2.6.32.45/arch/sparc/mm/srmmu.c linux-2.6.32.45/arch/sparc/mm/srmmu.c
---- linux-2.6.32.45/arch/sparc/mm/srmmu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/sparc/mm/srmmu.c 2011-04-17 15:56:46.000000000 -0400
-@@ -2200,6 +2200,13 @@ void __init ld_mmu_srmmu(void)
- PAGE_SHARED = pgprot_val(SRMMU_PAGE_SHARED);
- BTFIXUPSET_INT(page_copy, pgprot_val(SRMMU_PAGE_COPY));
- BTFIXUPSET_INT(page_readonly, pgprot_val(SRMMU_PAGE_RDONLY));
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ PAGE_SHARED_NOEXEC = pgprot_val(SRMMU_PAGE_SHARED_NOEXEC);
-+ BTFIXUPSET_INT(page_copy_noexec, pgprot_val(SRMMU_PAGE_COPY_NOEXEC));
-+ BTFIXUPSET_INT(page_readonly_noexec, pgprot_val(SRMMU_PAGE_RDONLY_NOEXEC));
-+#endif
-+
- BTFIXUPSET_INT(page_kernel, pgprot_val(SRMMU_PAGE_KERNEL));
- page_kernel = pgprot_val(SRMMU_PAGE_KERNEL);
-
-diff -urNp linux-2.6.32.45/arch/um/include/asm/kmap_types.h linux-2.6.32.45/arch/um/include/asm/kmap_types.h
---- linux-2.6.32.45/arch/um/include/asm/kmap_types.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/um/include/asm/kmap_types.h 2011-04-17 15:56:46.000000000 -0400
-@@ -23,6 +23,7 @@ enum km_type {
- KM_IRQ1,
- KM_SOFTIRQ0,
- KM_SOFTIRQ1,
-+ KM_CLEARPAGE,
- KM_TYPE_NR
- };
-
-diff -urNp linux-2.6.32.45/arch/um/include/asm/page.h linux-2.6.32.45/arch/um/include/asm/page.h
---- linux-2.6.32.45/arch/um/include/asm/page.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/um/include/asm/page.h 2011-04-17 15:56:46.000000000 -0400
-@@ -14,6 +14,9 @@
- #define PAGE_SIZE (_AC(1, UL) << PAGE_SHIFT)
- #define PAGE_MASK (~(PAGE_SIZE-1))
-
-+#define ktla_ktva(addr) (addr)
-+#define ktva_ktla(addr) (addr)
-+
- #ifndef __ASSEMBLY__
-
- struct page;
-diff -urNp linux-2.6.32.45/arch/um/kernel/process.c linux-2.6.32.45/arch/um/kernel/process.c
---- linux-2.6.32.45/arch/um/kernel/process.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/um/kernel/process.c 2011-04-17 15:56:46.000000000 -0400
-@@ -393,22 +393,6 @@ int singlestepping(void * t)
- return 2;
- }
-
--/*
-- * Only x86 and x86_64 have an arch_align_stack().
-- * All other arches have "#define arch_align_stack(x) (x)"
-- * in their asm/system.h
-- * As this is included in UML from asm-um/system-generic.h,
-- * we can use it to behave as the subarch does.
-- */
--#ifndef arch_align_stack
--unsigned long arch_align_stack(unsigned long sp)
--{
-- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
-- sp -= get_random_int() % 8192;
-- return sp & ~0xf;
--}
--#endif
--
- unsigned long get_wchan(struct task_struct *p)
- {
- unsigned long stack_page, sp, ip;
-diff -urNp linux-2.6.32.45/arch/um/sys-i386/syscalls.c linux-2.6.32.45/arch/um/sys-i386/syscalls.c
---- linux-2.6.32.45/arch/um/sys-i386/syscalls.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/um/sys-i386/syscalls.c 2011-04-17 15:56:46.000000000 -0400
-@@ -11,6 +11,21 @@
- #include "asm/uaccess.h"
- #include "asm/unistd.h"
-
-+int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
-+{
-+ unsigned long pax_task_size = TASK_SIZE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
-+ pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+ if (len > pax_task_size || addr > pax_task_size - len)
-+ return -EINVAL;
-+
-+ return 0;
-+}
-+
- /*
- * Perform the select(nd, in, out, ex, tv) and mmap() system
- * calls. Linux/i386 didn't use to be able to handle more than
-diff -urNp linux-2.6.32.45/arch/x86/boot/bitops.h linux-2.6.32.45/arch/x86/boot/bitops.h
---- linux-2.6.32.45/arch/x86/boot/bitops.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/boot/bitops.h 2011-04-17 15:56:46.000000000 -0400
-@@ -26,7 +26,7 @@ static inline int variable_test_bit(int
- u8 v;
- const u32 *p = (const u32 *)addr;
-
-- asm("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
-+ asm volatile("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
- return v;
- }
-
-@@ -37,7 +37,7 @@ static inline int variable_test_bit(int
-
- static inline void set_bit(int nr, void *addr)
- {
-- asm("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
-+ asm volatile("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
- }
-
- #endif /* BOOT_BITOPS_H */
-diff -urNp linux-2.6.32.45/arch/x86/boot/boot.h linux-2.6.32.45/arch/x86/boot/boot.h
---- linux-2.6.32.45/arch/x86/boot/boot.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/boot/boot.h 2011-04-17 15:56:46.000000000 -0400
-@@ -82,7 +82,7 @@ static inline void io_delay(void)
- static inline u16 ds(void)
- {
- u16 seg;
-- asm("movw %%ds,%0" : "=rm" (seg));
-+ asm volatile("movw %%ds,%0" : "=rm" (seg));
- return seg;
- }
-
-@@ -178,7 +178,7 @@ static inline void wrgs32(u32 v, addr_t
- static inline int memcmp(const void *s1, const void *s2, size_t len)
- {
- u8 diff;
-- asm("repe; cmpsb; setnz %0"
-+ asm volatile("repe; cmpsb; setnz %0"
- : "=qm" (diff), "+D" (s1), "+S" (s2), "+c" (len));
- return diff;
- }
-diff -urNp linux-2.6.32.45/arch/x86/boot/compressed/head_32.S linux-2.6.32.45/arch/x86/boot/compressed/head_32.S
---- linux-2.6.32.45/arch/x86/boot/compressed/head_32.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/boot/compressed/head_32.S 2011-04-17 15:56:46.000000000 -0400
-@@ -76,7 +76,7 @@ ENTRY(startup_32)
- notl %eax
- andl %eax, %ebx
- #else
-- movl $LOAD_PHYSICAL_ADDR, %ebx
-+ movl $____LOAD_PHYSICAL_ADDR, %ebx
- #endif
-
- /* Target address to relocate to for decompression */
-@@ -149,7 +149,7 @@ relocated:
- * and where it was actually loaded.
- */
- movl %ebp, %ebx
-- subl $LOAD_PHYSICAL_ADDR, %ebx
-+ subl $____LOAD_PHYSICAL_ADDR, %ebx
- jz 2f /* Nothing to be done if loaded at compiled addr. */
- /*
- * Process relocations.
-@@ -157,8 +157,7 @@ relocated:
-
- 1: subl $4, %edi
- movl (%edi), %ecx
-- testl %ecx, %ecx
-- jz 2f
-+ jecxz 2f
- addl %ebx, -__PAGE_OFFSET(%ebx, %ecx)
- jmp 1b
- 2:
-diff -urNp linux-2.6.32.45/arch/x86/boot/compressed/head_64.S linux-2.6.32.45/arch/x86/boot/compressed/head_64.S
---- linux-2.6.32.45/arch/x86/boot/compressed/head_64.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/boot/compressed/head_64.S 2011-07-01 18:53:00.000000000 -0400
-@@ -91,7 +91,7 @@ ENTRY(startup_32)
- notl %eax
- andl %eax, %ebx
- #else
-- movl $LOAD_PHYSICAL_ADDR, %ebx
-+ movl $____LOAD_PHYSICAL_ADDR, %ebx
- #endif
-
- /* Target address to relocate to for decompression */
-@@ -183,7 +183,7 @@ no_longmode:
- hlt
- jmp 1b
-
--#include "../../kernel/verify_cpu_64.S"
-+#include "../../kernel/verify_cpu.S"
-
- /*
- * Be careful here startup_64 needs to be at a predictable
-@@ -234,7 +234,7 @@ ENTRY(startup_64)
- notq %rax
- andq %rax, %rbp
- #else
-- movq $LOAD_PHYSICAL_ADDR, %rbp
-+ movq $____LOAD_PHYSICAL_ADDR, %rbp
- #endif
-
- /* Target address to relocate to for decompression */
-diff -urNp linux-2.6.32.45/arch/x86/boot/compressed/Makefile linux-2.6.32.45/arch/x86/boot/compressed/Makefile
---- linux-2.6.32.45/arch/x86/boot/compressed/Makefile 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/boot/compressed/Makefile 2011-08-07 14:38:34.000000000 -0400
-@@ -13,6 +13,9 @@ cflags-$(CONFIG_X86_64) := -mcmodel=smal
- KBUILD_CFLAGS += $(cflags-y)
- KBUILD_CFLAGS += $(call cc-option,-ffreestanding)
- KBUILD_CFLAGS += $(call cc-option,-fno-stack-protector)
-+ifdef CONSTIFY_PLUGIN
-+KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
-+endif
-
- KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
- GCOV_PROFILE := n
-diff -urNp linux-2.6.32.45/arch/x86/boot/compressed/misc.c linux-2.6.32.45/arch/x86/boot/compressed/misc.c
---- linux-2.6.32.45/arch/x86/boot/compressed/misc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/boot/compressed/misc.c 2011-04-17 15:56:46.000000000 -0400
-@@ -288,7 +288,7 @@ static void parse_elf(void *output)
- case PT_LOAD:
- #ifdef CONFIG_RELOCATABLE
- dest = output;
-- dest += (phdr->p_paddr - LOAD_PHYSICAL_ADDR);
-+ dest += (phdr->p_paddr - ____LOAD_PHYSICAL_ADDR);
- #else
- dest = (void *)(phdr->p_paddr);
- #endif
-@@ -335,7 +335,7 @@ asmlinkage void decompress_kernel(void *
- error("Destination address too large");
- #endif
- #ifndef CONFIG_RELOCATABLE
-- if ((unsigned long)output != LOAD_PHYSICAL_ADDR)
-+ if ((unsigned long)output != ____LOAD_PHYSICAL_ADDR)
- error("Wrong destination address");
- #endif
-
-diff -urNp linux-2.6.32.45/arch/x86/boot/compressed/mkpiggy.c linux-2.6.32.45/arch/x86/boot/compressed/mkpiggy.c
---- linux-2.6.32.45/arch/x86/boot/compressed/mkpiggy.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/boot/compressed/mkpiggy.c 2011-04-17 15:56:46.000000000 -0400
-@@ -74,7 +74,7 @@ int main(int argc, char *argv[])
-
- offs = (olen > ilen) ? olen - ilen : 0;
- offs += olen >> 12; /* Add 8 bytes for each 32K block */
-- offs += 32*1024 + 18; /* Add 32K + 18 bytes slack */
-+ offs += 64*1024; /* Add 64K bytes slack */
- offs = (offs+4095) & ~4095; /* Round to a 4K boundary */
-
- printf(".section \".rodata.compressed\",\"a\",@progbits\n");
-diff -urNp linux-2.6.32.45/arch/x86/boot/compressed/relocs.c linux-2.6.32.45/arch/x86/boot/compressed/relocs.c
---- linux-2.6.32.45/arch/x86/boot/compressed/relocs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/boot/compressed/relocs.c 2011-04-17 15:56:46.000000000 -0400
-@@ -10,8 +10,11 @@
- #define USE_BSD
- #include <endian.h>
-
-+#include "../../../../include/linux/autoconf.h"
-+
- #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
- static Elf32_Ehdr ehdr;
-+static Elf32_Phdr *phdr;
- static unsigned long reloc_count, reloc_idx;
- static unsigned long *relocs;
-
-@@ -37,7 +40,7 @@ static const char* safe_abs_relocs[] = {
-
- static int is_safe_abs_reloc(const char* sym_name)
- {
-- int i;
-+ unsigned int i;
-
- for (i = 0; i < ARRAY_SIZE(safe_abs_relocs); i++) {
- if (!strcmp(sym_name, safe_abs_relocs[i]))
-@@ -245,9 +248,39 @@ static void read_ehdr(FILE *fp)
- }
- }
-
-+static void read_phdrs(FILE *fp)
-+{
-+ unsigned int i;
-+
-+ phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr));
-+ if (!phdr) {
-+ die("Unable to allocate %d program headers\n",
-+ ehdr.e_phnum);
-+ }
-+ if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) {
-+ die("Seek to %d failed: %s\n",
-+ ehdr.e_phoff, strerror(errno));
-+ }
-+ if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) {
-+ die("Cannot read ELF program headers: %s\n",
-+ strerror(errno));
-+ }
-+ for(i = 0; i < ehdr.e_phnum; i++) {
-+ phdr[i].p_type = elf32_to_cpu(phdr[i].p_type);
-+ phdr[i].p_offset = elf32_to_cpu(phdr[i].p_offset);
-+ phdr[i].p_vaddr = elf32_to_cpu(phdr[i].p_vaddr);
-+ phdr[i].p_paddr = elf32_to_cpu(phdr[i].p_paddr);
-+ phdr[i].p_filesz = elf32_to_cpu(phdr[i].p_filesz);
-+ phdr[i].p_memsz = elf32_to_cpu(phdr[i].p_memsz);
-+ phdr[i].p_flags = elf32_to_cpu(phdr[i].p_flags);
-+ phdr[i].p_align = elf32_to_cpu(phdr[i].p_align);
-+ }
-+
-+}
-+
- static void read_shdrs(FILE *fp)
- {
-- int i;
-+ unsigned int i;
- Elf32_Shdr shdr;
-
- secs = calloc(ehdr.e_shnum, sizeof(struct section));
-@@ -282,7 +315,7 @@ static void read_shdrs(FILE *fp)
-
- static void read_strtabs(FILE *fp)
- {
-- int i;
-+ unsigned int i;
- for (i = 0; i < ehdr.e_shnum; i++) {
- struct section *sec = &secs[i];
- if (sec->shdr.sh_type != SHT_STRTAB) {
-@@ -307,7 +340,7 @@ static void read_strtabs(FILE *fp)
-
- static void read_symtabs(FILE *fp)
- {
-- int i,j;
-+ unsigned int i,j;
- for (i = 0; i < ehdr.e_shnum; i++) {
- struct section *sec = &secs[i];
- if (sec->shdr.sh_type != SHT_SYMTAB) {
-@@ -340,7 +373,9 @@ static void read_symtabs(FILE *fp)
-
- static void read_relocs(FILE *fp)
- {
-- int i,j;
-+ unsigned int i,j;
-+ uint32_t base;
-+
- for (i = 0; i < ehdr.e_shnum; i++) {
- struct section *sec = &secs[i];
- if (sec->shdr.sh_type != SHT_REL) {
-@@ -360,9 +395,18 @@ static void read_relocs(FILE *fp)
- die("Cannot read symbol table: %s\n",
- strerror(errno));
- }
-+ base = 0;
-+ for (j = 0; j < ehdr.e_phnum; j++) {
-+ if (phdr[j].p_type != PT_LOAD )
-+ continue;
-+ if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz)
-+ continue;
-+ base = CONFIG_PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr;
-+ break;
-+ }
- for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
- Elf32_Rel *rel = &sec->reltab[j];
-- rel->r_offset = elf32_to_cpu(rel->r_offset);
-+ rel->r_offset = elf32_to_cpu(rel->r_offset) + base;
- rel->r_info = elf32_to_cpu(rel->r_info);
- }
- }
-@@ -371,14 +415,14 @@ static void read_relocs(FILE *fp)
-
- static void print_absolute_symbols(void)
- {
-- int i;
-+ unsigned int i;
- printf("Absolute symbols\n");
- printf(" Num: Value Size Type Bind Visibility Name\n");
- for (i = 0; i < ehdr.e_shnum; i++) {
- struct section *sec = &secs[i];
- char *sym_strtab;
- Elf32_Sym *sh_symtab;
-- int j;
-+ unsigned int j;
-
- if (sec->shdr.sh_type != SHT_SYMTAB) {
- continue;
-@@ -406,14 +450,14 @@ static void print_absolute_symbols(void)
-
- static void print_absolute_relocs(void)
- {
-- int i, printed = 0;
-+ unsigned int i, printed = 0;
-
- for (i = 0; i < ehdr.e_shnum; i++) {
- struct section *sec = &secs[i];
- struct section *sec_applies, *sec_symtab;
- char *sym_strtab;
- Elf32_Sym *sh_symtab;
-- int j;
-+ unsigned int j;
- if (sec->shdr.sh_type != SHT_REL) {
- continue;
- }
-@@ -474,13 +518,13 @@ static void print_absolute_relocs(void)
-
- static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
- {
-- int i;
-+ unsigned int i;
- /* Walk through the relocations */
- for (i = 0; i < ehdr.e_shnum; i++) {
- char *sym_strtab;
- Elf32_Sym *sh_symtab;
- struct section *sec_applies, *sec_symtab;
-- int j;
-+ unsigned int j;
- struct section *sec = &secs[i];
-
- if (sec->shdr.sh_type != SHT_REL) {
-@@ -504,6 +548,21 @@ static void walk_relocs(void (*visit)(El
- if (sym->st_shndx == SHN_ABS) {
- continue;
- }
-+ /* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */
-+ if (!strcmp(sec_name(sym->st_shndx), ".data.percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load"))
-+ continue;
-+
-+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32)
-+ /* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
-+ if (!strcmp(sec_name(sym->st_shndx), ".module.text") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
-+ continue;
-+ if (!strcmp(sec_name(sym->st_shndx), ".init.text"))
-+ continue;
-+ if (!strcmp(sec_name(sym->st_shndx), ".exit.text"))
-+ continue;
-+ if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR"))
-+ continue;
-+#endif
- if (r_type == R_386_NONE || r_type == R_386_PC32) {
- /*
- * NONE can be ignored and and PC relative
-@@ -541,7 +600,7 @@ static int cmp_relocs(const void *va, co
-
- static void emit_relocs(int as_text)
- {
-- int i;
-+ unsigned int i;
- /* Count how many relocations I have and allocate space for them. */
- reloc_count = 0;
- walk_relocs(count_reloc);
-@@ -634,6 +693,7 @@ int main(int argc, char **argv)
- fname, strerror(errno));
- }
- read_ehdr(fp);
-+ read_phdrs(fp);
- read_shdrs(fp);
- read_strtabs(fp);
- read_symtabs(fp);
-diff -urNp linux-2.6.32.45/arch/x86/boot/cpucheck.c linux-2.6.32.45/arch/x86/boot/cpucheck.c
---- linux-2.6.32.45/arch/x86/boot/cpucheck.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/boot/cpucheck.c 2011-04-17 15:56:46.000000000 -0400
-@@ -74,7 +74,7 @@ static int has_fpu(void)
- u16 fcw = -1, fsw = -1;
- u32 cr0;
-
-- asm("movl %%cr0,%0" : "=r" (cr0));
-+ asm volatile("movl %%cr0,%0" : "=r" (cr0));
- if (cr0 & (X86_CR0_EM|X86_CR0_TS)) {
- cr0 &= ~(X86_CR0_EM|X86_CR0_TS);
- asm volatile("movl %0,%%cr0" : : "r" (cr0));
-@@ -90,7 +90,7 @@ static int has_eflag(u32 mask)
- {
- u32 f0, f1;
-
-- asm("pushfl ; "
-+ asm volatile("pushfl ; "
- "pushfl ; "
- "popl %0 ; "
- "movl %0,%1 ; "
-@@ -115,7 +115,7 @@ static void get_flags(void)
- set_bit(X86_FEATURE_FPU, cpu.flags);
-
- if (has_eflag(X86_EFLAGS_ID)) {
-- asm("cpuid"
-+ asm volatile("cpuid"
- : "=a" (max_intel_level),
- "=b" (cpu_vendor[0]),
- "=d" (cpu_vendor[1]),
-@@ -124,7 +124,7 @@ static void get_flags(void)
-
- if (max_intel_level >= 0x00000001 &&
- max_intel_level <= 0x0000ffff) {
-- asm("cpuid"
-+ asm volatile("cpuid"
- : "=a" (tfms),
- "=c" (cpu.flags[4]),
- "=d" (cpu.flags[0])
-@@ -136,7 +136,7 @@ static void get_flags(void)
- cpu.model += ((tfms >> 16) & 0xf) << 4;
- }
-
-- asm("cpuid"
-+ asm volatile("cpuid"
- : "=a" (max_amd_level)
- : "a" (0x80000000)
- : "ebx", "ecx", "edx");
-@@ -144,7 +144,7 @@ static void get_flags(void)
- if (max_amd_level >= 0x80000001 &&
- max_amd_level <= 0x8000ffff) {
- u32 eax = 0x80000001;
-- asm("cpuid"
-+ asm volatile("cpuid"
- : "+a" (eax),
- "=c" (cpu.flags[6]),
- "=d" (cpu.flags[1])
-@@ -203,9 +203,9 @@ int check_cpu(int *cpu_level_ptr, int *r
- u32 ecx = MSR_K7_HWCR;
- u32 eax, edx;
-
-- asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
-+ asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
- eax &= ~(1 << 15);
-- asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
-+ asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
-
- get_flags(); /* Make sure it really did something */
- err = check_flags();
-@@ -218,9 +218,9 @@ int check_cpu(int *cpu_level_ptr, int *r
- u32 ecx = MSR_VIA_FCR;
- u32 eax, edx;
-
-- asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
-+ asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
- eax |= (1<<1)|(1<<7);
-- asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
-+ asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
-
- set_bit(X86_FEATURE_CX8, cpu.flags);
- err = check_flags();
-@@ -231,12 +231,12 @@ int check_cpu(int *cpu_level_ptr, int *r
- u32 eax, edx;
- u32 level = 1;
-
-- asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
-- asm("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
-- asm("cpuid"
-+ asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
-+ asm volatile("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
-+ asm volatile("cpuid"
- : "+a" (level), "=d" (cpu.flags[0])
- : : "ecx", "ebx");
-- asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
-+ asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
-
- err = check_flags();
- }
-diff -urNp linux-2.6.32.45/arch/x86/boot/header.S linux-2.6.32.45/arch/x86/boot/header.S
---- linux-2.6.32.45/arch/x86/boot/header.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/boot/header.S 2011-04-17 15:56:46.000000000 -0400
-@@ -224,7 +224,7 @@ setup_data: .quad 0 # 64-bit physical
- # single linked list of
- # struct setup_data
-
--pref_address: .quad LOAD_PHYSICAL_ADDR # preferred load addr
-+pref_address: .quad ____LOAD_PHYSICAL_ADDR # preferred load addr
-
- #define ZO_INIT_SIZE (ZO__end - ZO_startup_32 + ZO_z_extract_offset)
- #define VO_INIT_SIZE (VO__end - VO__text)
-diff -urNp linux-2.6.32.45/arch/x86/boot/Makefile linux-2.6.32.45/arch/x86/boot/Makefile
---- linux-2.6.32.45/arch/x86/boot/Makefile 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/boot/Makefile 2011-08-07 14:38:13.000000000 -0400
-@@ -69,6 +69,9 @@ KBUILD_CFLAGS := $(LINUXINCLUDE) -g -Os
- $(call cc-option, -fno-stack-protector) \
- $(call cc-option, -mpreferred-stack-boundary=2)
- KBUILD_CFLAGS += $(call cc-option, -m32)
-+ifdef CONSTIFY_PLUGIN
-+KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
-+endif
- KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
- GCOV_PROFILE := n
-
-diff -urNp linux-2.6.32.45/arch/x86/boot/memory.c linux-2.6.32.45/arch/x86/boot/memory.c
---- linux-2.6.32.45/arch/x86/boot/memory.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/boot/memory.c 2011-04-17 15:56:46.000000000 -0400
-@@ -19,7 +19,7 @@
-
- static int detect_memory_e820(void)
- {
-- int count = 0;
-+ unsigned int count = 0;
- struct biosregs ireg, oreg;
- struct e820entry *desc = boot_params.e820_map;
- static struct e820entry buf; /* static so it is zeroed */
-diff -urNp linux-2.6.32.45/arch/x86/boot/video.c linux-2.6.32.45/arch/x86/boot/video.c
---- linux-2.6.32.45/arch/x86/boot/video.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/boot/video.c 2011-04-17 15:56:46.000000000 -0400
-@@ -90,7 +90,7 @@ static void store_mode_params(void)
- static unsigned int get_entry(void)
- {
- char entry_buf[4];
-- int i, len = 0;
-+ unsigned int i, len = 0;
- int key;
- unsigned int v;
-
-diff -urNp linux-2.6.32.45/arch/x86/boot/video-vesa.c linux-2.6.32.45/arch/x86/boot/video-vesa.c
---- linux-2.6.32.45/arch/x86/boot/video-vesa.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/boot/video-vesa.c 2011-04-17 15:56:46.000000000 -0400
-@@ -200,6 +200,7 @@ static void vesa_store_pm_info(void)
-
- boot_params.screen_info.vesapm_seg = oreg.es;
- boot_params.screen_info.vesapm_off = oreg.di;
-+ boot_params.screen_info.vesapm_size = oreg.cx;
- }
-
- /*
-diff -urNp linux-2.6.32.45/arch/x86/ia32/ia32_aout.c linux-2.6.32.45/arch/x86/ia32/ia32_aout.c
---- linux-2.6.32.45/arch/x86/ia32/ia32_aout.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/ia32/ia32_aout.c 2011-04-17 15:56:46.000000000 -0400
-@@ -169,6 +169,8 @@ static int aout_core_dump(long signr, st
- unsigned long dump_start, dump_size;
- struct user32 dump;
-
-+ memset(&dump, 0, sizeof(dump));
-+
- fs = get_fs();
- set_fs(KERNEL_DS);
- has_dumped = 1;
-@@ -218,12 +220,6 @@ static int aout_core_dump(long signr, st
- dump_size = dump.u_ssize << PAGE_SHIFT;
- DUMP_WRITE(dump_start, dump_size);
- }
-- /*
-- * Finally dump the task struct. Not be used by gdb, but
-- * could be useful
-- */
-- set_fs(KERNEL_DS);
-- DUMP_WRITE(current, sizeof(*current));
- end_coredump:
- set_fs(fs);
- return has_dumped;
-diff -urNp linux-2.6.32.45/arch/x86/ia32/ia32entry.S linux-2.6.32.45/arch/x86/ia32/ia32entry.S
---- linux-2.6.32.45/arch/x86/ia32/ia32entry.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/ia32/ia32entry.S 2011-06-04 20:29:52.000000000 -0400
-@@ -13,6 +13,7 @@
- #include <asm/thread_info.h>
- #include <asm/segment.h>
- #include <asm/irqflags.h>
-+#include <asm/pgtable.h>
- #include <linux/linkage.h>
-
- /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
-@@ -93,6 +94,30 @@ ENTRY(native_irq_enable_sysexit)
- ENDPROC(native_irq_enable_sysexit)
- #endif
-
-+ .macro pax_enter_kernel_user
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ call pax_enter_kernel_user
-+#endif
-+ .endm
-+
-+ .macro pax_exit_kernel_user
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ call pax_exit_kernel_user
-+#endif
-+#ifdef CONFIG_PAX_RANDKSTACK
-+ pushq %rax
-+ call pax_randomize_kstack
-+ popq %rax
-+#endif
-+ pax_erase_kstack
-+ .endm
-+
-+.macro pax_erase_kstack
-+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
-+ call pax_erase_kstack
-+#endif
-+.endm
-+
- /*
- * 32bit SYSENTER instruction entry.
- *
-@@ -119,7 +144,7 @@ ENTRY(ia32_sysenter_target)
- CFI_REGISTER rsp,rbp
- SWAPGS_UNSAFE_STACK
- movq PER_CPU_VAR(kernel_stack), %rsp
-- addq $(KERNEL_STACK_OFFSET),%rsp
-+ pax_enter_kernel_user
- /*
- * No need to follow this irqs on/off section: the syscall
- * disabled irqs, here we enable it straight after entry:
-@@ -135,7 +160,8 @@ ENTRY(ia32_sysenter_target)
- pushfq
- CFI_ADJUST_CFA_OFFSET 8
- /*CFI_REL_OFFSET rflags,0*/
-- movl 8*3-THREAD_SIZE+TI_sysenter_return(%rsp), %r10d
-+ GET_THREAD_INFO(%r10)
-+ movl TI_sysenter_return(%r10), %r10d
- CFI_REGISTER rip,r10
- pushq $__USER32_CS
- CFI_ADJUST_CFA_OFFSET 8
-@@ -150,6 +176,12 @@ ENTRY(ia32_sysenter_target)
- SAVE_ARGS 0,0,1
- /* no need to do an access_ok check here because rbp has been
- 32bit zero extended */
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ mov $PAX_USER_SHADOW_BASE,%r10
-+ add %r10,%rbp
-+#endif
-+
- 1: movl (%rbp),%ebp
- .section __ex_table,"a"
- .quad 1b,ia32_badarg
-@@ -172,6 +204,7 @@ sysenter_dispatch:
- testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
- jnz sysexit_audit
- sysexit_from_sys_call:
-+ pax_exit_kernel_user
- andl $~TS_COMPAT,TI_status(%r10)
- /* clear IF, that popfq doesn't enable interrupts early */
- andl $~0x200,EFLAGS-R11(%rsp)
-@@ -200,6 +233,9 @@ sysexit_from_sys_call:
- movl %eax,%esi /* 2nd arg: syscall number */
- movl $AUDIT_ARCH_I386,%edi /* 1st arg: audit arch */
- call audit_syscall_entry
-+
-+ pax_erase_kstack
-+
- movl RAX-ARGOFFSET(%rsp),%eax /* reload syscall number */
- cmpq $(IA32_NR_syscalls-1),%rax
- ja ia32_badsys
-@@ -252,6 +288,9 @@ sysenter_tracesys:
- movq $-ENOSYS,RAX(%rsp)/* ptrace can change this for a bad syscall */
- movq %rsp,%rdi /* &pt_regs -> arg1 */
- call syscall_trace_enter
-+
-+ pax_erase_kstack
-+
- LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
- RESTORE_REST
- cmpq $(IA32_NR_syscalls-1),%rax
-@@ -283,19 +322,24 @@ ENDPROC(ia32_sysenter_target)
- ENTRY(ia32_cstar_target)
- CFI_STARTPROC32 simple
- CFI_SIGNAL_FRAME
-- CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
-+ CFI_DEF_CFA rsp,0
- CFI_REGISTER rip,rcx
- /*CFI_REGISTER rflags,r11*/
- SWAPGS_UNSAFE_STACK
- movl %esp,%r8d
- CFI_REGISTER rsp,r8
- movq PER_CPU_VAR(kernel_stack),%rsp
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ pax_enter_kernel_user
-+#endif
-+
- /*
- * No need to follow this irqs on/off section: the syscall
- * disabled irqs and here we enable it straight after entry:
- */
- ENABLE_INTERRUPTS(CLBR_NONE)
-- SAVE_ARGS 8,1,1
-+ SAVE_ARGS 8*6,1,1
- movl %eax,%eax /* zero extension */
- movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
- movq %rcx,RIP-ARGOFFSET(%rsp)
-@@ -311,6 +355,12 @@ ENTRY(ia32_cstar_target)
- /* no need to do an access_ok check here because r8 has been
- 32bit zero extended */
- /* hardware stack frame is complete now */
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ mov $PAX_USER_SHADOW_BASE,%r10
-+ add %r10,%r8
-+#endif
-+
- 1: movl (%r8),%r9d
- .section __ex_table,"a"
- .quad 1b,ia32_badarg
-@@ -333,6 +383,7 @@ cstar_dispatch:
- testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
- jnz sysretl_audit
- sysretl_from_sys_call:
-+ pax_exit_kernel_user
- andl $~TS_COMPAT,TI_status(%r10)
- RESTORE_ARGS 1,-ARG_SKIP,1,1,1
- movl RIP-ARGOFFSET(%rsp),%ecx
-@@ -370,6 +421,9 @@ cstar_tracesys:
- movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */
- movq %rsp,%rdi /* &pt_regs -> arg1 */
- call syscall_trace_enter
-+
-+ pax_erase_kstack
-+
- LOAD_ARGS32 ARGOFFSET, 1 /* reload args from stack in case ptrace changed it */
- RESTORE_REST
- xchgl %ebp,%r9d
-@@ -415,6 +469,7 @@ ENTRY(ia32_syscall)
- CFI_REL_OFFSET rip,RIP-RIP
- PARAVIRT_ADJUST_EXCEPTION_FRAME
- SWAPGS
-+ pax_enter_kernel_user
- /*
- * No need to follow this irqs on/off section: the syscall
- * disabled irqs and here we enable it straight after entry:
-@@ -448,6 +503,9 @@ ia32_tracesys:
- movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */
- movq %rsp,%rdi /* &pt_regs -> arg1 */
- call syscall_trace_enter
-+
-+ pax_erase_kstack
-+
- LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
- RESTORE_REST
- cmpq $(IA32_NR_syscalls-1),%rax
-diff -urNp linux-2.6.32.45/arch/x86/ia32/ia32_signal.c linux-2.6.32.45/arch/x86/ia32/ia32_signal.c
---- linux-2.6.32.45/arch/x86/ia32/ia32_signal.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/ia32/ia32_signal.c 2011-04-17 15:56:46.000000000 -0400
-@@ -403,7 +403,7 @@ static void __user *get_sigframe(struct
- sp -= frame_size;
- /* Align the stack pointer according to the i386 ABI,
- * i.e. so that on function entry ((sp + 4) & 15) == 0. */
-- sp = ((sp + 4) & -16ul) - 4;
-+ sp = ((sp - 12) & -16ul) - 4;
- return (void __user *) sp;
- }
-
-@@ -461,7 +461,7 @@ int ia32_setup_frame(int sig, struct k_s
- * These are actually not used anymore, but left because some
- * gdb versions depend on them as a marker.
- */
-- put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
-+ put_user_ex(*((const u64 *)&code), (u64 *)frame->retcode);
- } put_user_catch(err);
-
- if (err)
-@@ -503,7 +503,7 @@ int ia32_setup_rt_frame(int sig, struct
- 0xb8,
- __NR_ia32_rt_sigreturn,
- 0x80cd,
-- 0,
-+ 0
- };
-
- frame = get_sigframe(ka, regs, sizeof(*frame), &fpstate);
-@@ -533,16 +533,18 @@ int ia32_setup_rt_frame(int sig, struct
-
- if (ka->sa.sa_flags & SA_RESTORER)
- restorer = ka->sa.sa_restorer;
-+ else if (current->mm->context.vdso)
-+ /* Return stub is in 32bit vsyscall page */
-+ restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
- else
-- restorer = VDSO32_SYMBOL(current->mm->context.vdso,
-- rt_sigreturn);
-+ restorer = &frame->retcode;
- put_user_ex(ptr_to_compat(restorer), &frame->pretcode);
-
- /*
- * Not actually used anymore, but left because some gdb
- * versions need it.
- */
-- put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
-+ put_user_ex(*((const u64 *)&code), (u64 *)frame->retcode);
- } put_user_catch(err);
-
- if (err)
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/alternative.h linux-2.6.32.45/arch/x86/include/asm/alternative.h
---- linux-2.6.32.45/arch/x86/include/asm/alternative.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/alternative.h 2011-04-17 15:56:46.000000000 -0400
-@@ -85,7 +85,7 @@ static inline void alternatives_smp_swit
- " .byte 662b-661b\n" /* sourcelen */ \
- " .byte 664f-663f\n" /* replacementlen */ \
- ".previous\n" \
-- ".section .altinstr_replacement, \"ax\"\n" \
-+ ".section .altinstr_replacement, \"a\"\n" \
- "663:\n\t" newinstr "\n664:\n" /* replacement */ \
- ".previous"
-
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/apic.h linux-2.6.32.45/arch/x86/include/asm/apic.h
---- linux-2.6.32.45/arch/x86/include/asm/apic.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/apic.h 2011-08-17 20:01:15.000000000 -0400
-@@ -46,7 +46,7 @@ static inline void generic_apic_probe(vo
-
- #ifdef CONFIG_X86_LOCAL_APIC
-
--extern unsigned int apic_verbosity;
-+extern int apic_verbosity;
- extern int local_apic_timer_c2_ok;
-
- extern int disable_apic;
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/apm.h linux-2.6.32.45/arch/x86/include/asm/apm.h
---- linux-2.6.32.45/arch/x86/include/asm/apm.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/apm.h 2011-04-17 15:56:46.000000000 -0400
-@@ -34,7 +34,7 @@ static inline void apm_bios_call_asm(u32
- __asm__ __volatile__(APM_DO_ZERO_SEGS
- "pushl %%edi\n\t"
- "pushl %%ebp\n\t"
-- "lcall *%%cs:apm_bios_entry\n\t"
-+ "lcall *%%ss:apm_bios_entry\n\t"
- "setc %%al\n\t"
- "popl %%ebp\n\t"
- "popl %%edi\n\t"
-@@ -58,7 +58,7 @@ static inline u8 apm_bios_call_simple_as
- __asm__ __volatile__(APM_DO_ZERO_SEGS
- "pushl %%edi\n\t"
- "pushl %%ebp\n\t"
-- "lcall *%%cs:apm_bios_entry\n\t"
-+ "lcall *%%ss:apm_bios_entry\n\t"
- "setc %%bl\n\t"
- "popl %%ebp\n\t"
- "popl %%edi\n\t"
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/atomic_32.h linux-2.6.32.45/arch/x86/include/asm/atomic_32.h
---- linux-2.6.32.45/arch/x86/include/asm/atomic_32.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/atomic_32.h 2011-05-04 17:56:20.000000000 -0400
-@@ -25,6 +25,17 @@ static inline int atomic_read(const atom
- }
-
- /**
-+ * atomic_read_unchecked - read atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically reads the value of @v.
-+ */
-+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
-+{
-+ return v->counter;
-+}
-+
-+/**
- * atomic_set - set atomic variable
- * @v: pointer of type atomic_t
- * @i: required value
-@@ -37,6 +48,18 @@ static inline void atomic_set(atomic_t *
- }
-
- /**
-+ * atomic_set_unchecked - set atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ * @i: required value
-+ *
-+ * Atomically sets the value of @v to @i.
-+ */
-+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
-+{
-+ v->counter = i;
-+}
-+
-+/**
- * atomic_add - add integer to atomic variable
- * @i: integer value to add
- * @v: pointer of type atomic_t
-@@ -45,7 +68,29 @@ static inline void atomic_set(atomic_t *
- */
- static inline void atomic_add(int i, atomic_t *v)
- {
-- asm volatile(LOCK_PREFIX "addl %1,%0"
-+ asm volatile(LOCK_PREFIX "addl %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "subl %1,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "+m" (v->counter)
-+ : "ir" (i));
-+}
-+
-+/**
-+ * atomic_add_unchecked - add integer to atomic variable
-+ * @i: integer value to add
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically adds @i to @v.
-+ */
-+static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "addl %1,%0\n"
- : "+m" (v->counter)
- : "ir" (i));
- }
-@@ -59,7 +104,29 @@ static inline void atomic_add(int i, ato
- */
- static inline void atomic_sub(int i, atomic_t *v)
- {
-- asm volatile(LOCK_PREFIX "subl %1,%0"
-+ asm volatile(LOCK_PREFIX "subl %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "addl %1,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "+m" (v->counter)
-+ : "ir" (i));
-+}
-+
-+/**
-+ * atomic_sub_unchecked - subtract integer from atomic variable
-+ * @i: integer value to subtract
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically subtracts @i from @v.
-+ */
-+static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "subl %1,%0\n"
- : "+m" (v->counter)
- : "ir" (i));
- }
-@@ -77,7 +144,16 @@ static inline int atomic_sub_and_test(in
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
-+ asm volatile(LOCK_PREFIX "subl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "addl %2,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
- : "+m" (v->counter), "=qm" (c)
- : "ir" (i) : "memory");
- return c;
-@@ -91,7 +167,27 @@ static inline int atomic_sub_and_test(in
- */
- static inline void atomic_inc(atomic_t *v)
- {
-- asm volatile(LOCK_PREFIX "incl %0"
-+ asm volatile(LOCK_PREFIX "incl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "decl %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "+m" (v->counter));
-+}
-+
-+/**
-+ * atomic_inc_unchecked - increment atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically increments @v by 1.
-+ */
-+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "incl %0\n"
- : "+m" (v->counter));
- }
-
-@@ -103,7 +199,27 @@ static inline void atomic_inc(atomic_t *
- */
- static inline void atomic_dec(atomic_t *v)
- {
-- asm volatile(LOCK_PREFIX "decl %0"
-+ asm volatile(LOCK_PREFIX "decl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "incl %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "+m" (v->counter));
-+}
-+
-+/**
-+ * atomic_dec_unchecked - decrement atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically decrements @v by 1.
-+ */
-+static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "decl %0\n"
- : "+m" (v->counter));
- }
-
-@@ -119,7 +235,16 @@ static inline int atomic_dec_and_test(at
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "decl %0; sete %1"
-+ asm volatile(LOCK_PREFIX "decl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "incl %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
- : "+m" (v->counter), "=qm" (c)
- : : "memory");
- return c != 0;
-@@ -137,7 +262,35 @@ static inline int atomic_inc_and_test(at
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "incl %0; sete %1"
-+ asm volatile(LOCK_PREFIX "incl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "decl %0\n"
-+ "into\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
-+ : "+m" (v->counter), "=qm" (c)
-+ : : "memory");
-+ return c != 0;
-+}
-+
-+/**
-+ * atomic_inc_and_test_unchecked - increment and test
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically increments @v by 1
-+ * and returns true if the result is zero, or false for all
-+ * other cases.
-+ */
-+static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
-+{
-+ unsigned char c;
-+
-+ asm volatile(LOCK_PREFIX "incl %0\n"
-+ "sete %1\n"
- : "+m" (v->counter), "=qm" (c)
- : : "memory");
- return c != 0;
-@@ -156,7 +309,16 @@ static inline int atomic_add_negative(in
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
-+ asm volatile(LOCK_PREFIX "addl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "subl %2,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sets %1\n"
- : "+m" (v->counter), "=qm" (c)
- : "ir" (i) : "memory");
- return c;
-@@ -179,6 +341,46 @@ static inline int atomic_add_return(int
- #endif
- /* Modern 486+ processor */
- __i = i;
-+ asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ "movl %0, %1\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "+r" (i), "+m" (v->counter)
-+ : : "memory");
-+ return i + __i;
-+
-+#ifdef CONFIG_M386
-+no_xadd: /* Legacy 386 processor */
-+ local_irq_save(flags);
-+ __i = atomic_read(v);
-+ atomic_set(v, i + __i);
-+ local_irq_restore(flags);
-+ return i + __i;
-+#endif
-+}
-+
-+/**
-+ * atomic_add_return_unchecked - add integer and return
-+ * @v: pointer of type atomic_unchecked_t
-+ * @i: integer value to add
-+ *
-+ * Atomically adds @i to @v and returns @i + @v
-+ */
-+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
-+{
-+ int __i;
-+#ifdef CONFIG_M386
-+ unsigned long flags;
-+ if (unlikely(boot_cpu_data.x86 <= 3))
-+ goto no_xadd;
-+#endif
-+ /* Modern 486+ processor */
-+ __i = i;
- asm volatile(LOCK_PREFIX "xaddl %0, %1"
- : "+r" (i), "+m" (v->counter)
- : : "memory");
-@@ -211,11 +413,21 @@ static inline int atomic_cmpxchg(atomic_
- return cmpxchg(&v->counter, old, new);
- }
-
-+static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
-+{
-+ return cmpxchg(&v->counter, old, new);
-+}
-+
- static inline int atomic_xchg(atomic_t *v, int new)
- {
- return xchg(&v->counter, new);
- }
-
-+static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
-+{
-+ return xchg(&v->counter, new);
-+}
-+
- /**
- * atomic_add_unless - add unless the number is already a given value
- * @v: pointer of type atomic_t
-@@ -227,22 +439,39 @@ static inline int atomic_xchg(atomic_t *
- */
- static inline int atomic_add_unless(atomic_t *v, int a, int u)
- {
-- int c, old;
-+ int c, old, new;
- c = atomic_read(v);
- for (;;) {
-- if (unlikely(c == (u)))
-+ if (unlikely(c == u))
- break;
-- old = atomic_cmpxchg((v), c, c + (a));
-+
-+ asm volatile("addl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ "subl %2,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "=r" (new)
-+ : "0" (c), "ir" (a));
-+
-+ old = atomic_cmpxchg(v, c, new);
- if (likely(old == c))
- break;
- c = old;
- }
-- return c != (u);
-+ return c != u;
- }
-
- #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
-
- #define atomic_inc_return(v) (atomic_add_return(1, v))
-+static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
-+{
-+ return atomic_add_return_unchecked(1, v);
-+}
- #define atomic_dec_return(v) (atomic_sub_return(1, v))
-
- /* These are x86-specific, used by some header files */
-@@ -266,9 +495,18 @@ typedef struct {
- u64 __aligned(8) counter;
- } atomic64_t;
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+typedef struct {
-+ u64 __aligned(8) counter;
-+} atomic64_unchecked_t;
-+#else
-+typedef atomic64_t atomic64_unchecked_t;
-+#endif
-+
- #define ATOMIC64_INIT(val) { (val) }
-
- extern u64 atomic64_cmpxchg(atomic64_t *ptr, u64 old_val, u64 new_val);
-+extern u64 atomic64_cmpxchg_unchecked(atomic64_unchecked_t *ptr, u64 old_val, u64 new_val);
-
- /**
- * atomic64_xchg - xchg atomic64 variable
-@@ -279,6 +517,7 @@ extern u64 atomic64_cmpxchg(atomic64_t *
- * the old value.
- */
- extern u64 atomic64_xchg(atomic64_t *ptr, u64 new_val);
-+extern u64 atomic64_xchg_unchecked(atomic64_unchecked_t *ptr, u64 new_val);
-
- /**
- * atomic64_set - set atomic64 variable
-@@ -290,6 +529,15 @@ extern u64 atomic64_xchg(atomic64_t *ptr
- extern void atomic64_set(atomic64_t *ptr, u64 new_val);
-
- /**
-+ * atomic64_unchecked_set - set atomic64 variable
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ * @new_val: value to assign
-+ *
-+ * Atomically sets the value of @ptr to @new_val.
-+ */
-+extern void atomic64_set_unchecked(atomic64_unchecked_t *ptr, u64 new_val);
-+
-+/**
- * atomic64_read - read atomic64 variable
- * @ptr: pointer to type atomic64_t
- *
-@@ -317,7 +565,33 @@ static inline u64 atomic64_read(atomic64
- return res;
- }
-
--extern u64 atomic64_read(atomic64_t *ptr);
-+/**
-+ * atomic64_read_unchecked - read atomic64 variable
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically reads the value of @ptr and returns it.
-+ */
-+static inline u64 atomic64_read_unchecked(atomic64_unchecked_t *ptr)
-+{
-+ u64 res;
-+
-+ /*
-+ * Note, we inline this atomic64_unchecked_t primitive because
-+ * it only clobbers EAX/EDX and leaves the others
-+ * untouched. We also (somewhat subtly) rely on the
-+ * fact that cmpxchg8b returns the current 64-bit value
-+ * of the memory location we are touching:
-+ */
-+ asm volatile(
-+ "mov %%ebx, %%eax\n\t"
-+ "mov %%ecx, %%edx\n\t"
-+ LOCK_PREFIX "cmpxchg8b %1\n"
-+ : "=&A" (res)
-+ : "m" (*ptr)
-+ );
-+
-+ return res;
-+}
-
- /**
- * atomic64_add_return - add and return
-@@ -332,8 +606,11 @@ extern u64 atomic64_add_return(u64 delta
- * Other variants with different arithmetic operators:
- */
- extern u64 atomic64_sub_return(u64 delta, atomic64_t *ptr);
-+extern u64 atomic64_sub_return_unchecked(u64 delta, atomic64_unchecked_t *ptr);
- extern u64 atomic64_inc_return(atomic64_t *ptr);
-+extern u64 atomic64_inc_return_unchecked(atomic64_unchecked_t *ptr);
- extern u64 atomic64_dec_return(atomic64_t *ptr);
-+extern u64 atomic64_dec_return_unchecked(atomic64_unchecked_t *ptr);
-
- /**
- * atomic64_add - add integer to atomic64 variable
-@@ -345,6 +622,15 @@ extern u64 atomic64_dec_return(atomic64_
- extern void atomic64_add(u64 delta, atomic64_t *ptr);
-
- /**
-+ * atomic64_add_unchecked - add integer to atomic64 variable
-+ * @delta: integer value to add
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically adds @delta to @ptr.
-+ */
-+extern void atomic64_add_unchecked(u64 delta, atomic64_unchecked_t *ptr);
-+
-+/**
- * atomic64_sub - subtract the atomic64 variable
- * @delta: integer value to subtract
- * @ptr: pointer to type atomic64_t
-@@ -354,6 +640,15 @@ extern void atomic64_add(u64 delta, atom
- extern void atomic64_sub(u64 delta, atomic64_t *ptr);
-
- /**
-+ * atomic64_sub_unchecked - subtract the atomic64 variable
-+ * @delta: integer value to subtract
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically subtracts @delta from @ptr.
-+ */
-+extern void atomic64_sub_unchecked(u64 delta, atomic64_unchecked_t *ptr);
-+
-+/**
- * atomic64_sub_and_test - subtract value from variable and test result
- * @delta: integer value to subtract
- * @ptr: pointer to type atomic64_t
-@@ -373,6 +668,14 @@ extern int atomic64_sub_and_test(u64 del
- extern void atomic64_inc(atomic64_t *ptr);
-
- /**
-+ * atomic64_inc_unchecked - increment atomic64 variable
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically increments @ptr by 1.
-+ */
-+extern void atomic64_inc_unchecked(atomic64_unchecked_t *ptr);
-+
-+/**
- * atomic64_dec - decrement atomic64 variable
- * @ptr: pointer to type atomic64_t
- *
-@@ -381,6 +684,14 @@ extern void atomic64_inc(atomic64_t *ptr
- extern void atomic64_dec(atomic64_t *ptr);
-
- /**
-+ * atomic64_dec_unchecked - decrement atomic64 variable
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically decrements @ptr by 1.
-+ */
-+extern void atomic64_dec_unchecked(atomic64_unchecked_t *ptr);
-+
-+/**
- * atomic64_dec_and_test - decrement and test
- * @ptr: pointer to type atomic64_t
- *
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/atomic_64.h linux-2.6.32.45/arch/x86/include/asm/atomic_64.h
---- linux-2.6.32.45/arch/x86/include/asm/atomic_64.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/atomic_64.h 2011-05-04 18:35:31.000000000 -0400
-@@ -24,6 +24,17 @@ static inline int atomic_read(const atom
- }
-
- /**
-+ * atomic_read_unchecked - read atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically reads the value of @v.
-+ */
-+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
-+{
-+ return v->counter;
-+}
-+
-+/**
- * atomic_set - set atomic variable
- * @v: pointer of type atomic_t
- * @i: required value
-@@ -36,6 +47,18 @@ static inline void atomic_set(atomic_t *
- }
-
- /**
-+ * atomic_set_unchecked - set atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ * @i: required value
-+ *
-+ * Atomically sets the value of @v to @i.
-+ */
-+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
-+{
-+ v->counter = i;
-+}
-+
-+/**
- * atomic_add - add integer to atomic variable
- * @i: integer value to add
- * @v: pointer of type atomic_t
-@@ -44,7 +67,29 @@ static inline void atomic_set(atomic_t *
- */
- static inline void atomic_add(int i, atomic_t *v)
- {
-- asm volatile(LOCK_PREFIX "addl %1,%0"
-+ asm volatile(LOCK_PREFIX "addl %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "subl %1,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "=m" (v->counter)
-+ : "ir" (i), "m" (v->counter));
-+}
-+
-+/**
-+ * atomic_add_unchecked - add integer to atomic variable
-+ * @i: integer value to add
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically adds @i to @v.
-+ */
-+static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "addl %1,%0\n"
- : "=m" (v->counter)
- : "ir" (i), "m" (v->counter));
- }
-@@ -58,7 +103,29 @@ static inline void atomic_add(int i, ato
- */
- static inline void atomic_sub(int i, atomic_t *v)
- {
-- asm volatile(LOCK_PREFIX "subl %1,%0"
-+ asm volatile(LOCK_PREFIX "subl %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "addl %1,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "=m" (v->counter)
-+ : "ir" (i), "m" (v->counter));
-+}
-+
-+/**
-+ * atomic_sub_unchecked - subtract the atomic variable
-+ * @i: integer value to subtract
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically subtracts @i from @v.
-+ */
-+static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "subl %1,%0\n"
- : "=m" (v->counter)
- : "ir" (i), "m" (v->counter));
- }
-@@ -76,7 +143,16 @@ static inline int atomic_sub_and_test(in
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
-+ asm volatile(LOCK_PREFIX "subl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "addl %2,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
- : "=m" (v->counter), "=qm" (c)
- : "ir" (i), "m" (v->counter) : "memory");
- return c;
-@@ -90,7 +166,28 @@ static inline int atomic_sub_and_test(in
- */
- static inline void atomic_inc(atomic_t *v)
- {
-- asm volatile(LOCK_PREFIX "incl %0"
-+ asm volatile(LOCK_PREFIX "incl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "decl %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "=m" (v->counter)
-+ : "m" (v->counter));
-+}
-+
-+/**
-+ * atomic_inc_unchecked - increment atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically increments @v by 1.
-+ */
-+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "incl %0\n"
- : "=m" (v->counter)
- : "m" (v->counter));
- }
-@@ -103,7 +200,28 @@ static inline void atomic_inc(atomic_t *
- */
- static inline void atomic_dec(atomic_t *v)
- {
-- asm volatile(LOCK_PREFIX "decl %0"
-+ asm volatile(LOCK_PREFIX "decl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "incl %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "=m" (v->counter)
-+ : "m" (v->counter));
-+}
-+
-+/**
-+ * atomic_dec_unchecked - decrement atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically decrements @v by 1.
-+ */
-+static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "decl %0\n"
- : "=m" (v->counter)
- : "m" (v->counter));
- }
-@@ -120,7 +238,16 @@ static inline int atomic_dec_and_test(at
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "decl %0; sete %1"
-+ asm volatile(LOCK_PREFIX "decl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "incl %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
- : "=m" (v->counter), "=qm" (c)
- : "m" (v->counter) : "memory");
- return c != 0;
-@@ -138,7 +265,35 @@ static inline int atomic_inc_and_test(at
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "incl %0; sete %1"
-+ asm volatile(LOCK_PREFIX "incl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "decl %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
-+ : "=m" (v->counter), "=qm" (c)
-+ : "m" (v->counter) : "memory");
-+ return c != 0;
-+}
-+
-+/**
-+ * atomic_inc_and_test_unchecked - increment and test
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically increments @v by 1
-+ * and returns true if the result is zero, or false for all
-+ * other cases.
-+ */
-+static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
-+{
-+ unsigned char c;
-+
-+ asm volatile(LOCK_PREFIX "incl %0\n"
-+ "sete %1\n"
- : "=m" (v->counter), "=qm" (c)
- : "m" (v->counter) : "memory");
- return c != 0;
-@@ -157,7 +312,16 @@ static inline int atomic_add_negative(in
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
-+ asm volatile(LOCK_PREFIX "addl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "subl %2,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sets %1\n"
- : "=m" (v->counter), "=qm" (c)
- : "ir" (i), "m" (v->counter) : "memory");
- return c;
-@@ -173,7 +337,31 @@ static inline int atomic_add_negative(in
- static inline int atomic_add_return(int i, atomic_t *v)
- {
- int __i = i;
-- asm volatile(LOCK_PREFIX "xaddl %0, %1"
-+ asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ "movl %0, %1\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "+r" (i), "+m" (v->counter)
-+ : : "memory");
-+ return i + __i;
-+}
-+
-+/**
-+ * atomic_add_return_unchecked - add and return
-+ * @i: integer value to add
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically adds @i to @v and returns @i + @v
-+ */
-+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
-+{
-+ int __i = i;
-+ asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
- : "+r" (i), "+m" (v->counter)
- : : "memory");
- return i + __i;
-@@ -185,6 +373,10 @@ static inline int atomic_sub_return(int
- }
-
- #define atomic_inc_return(v) (atomic_add_return(1, v))
-+static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
-+{
-+ return atomic_add_return_unchecked(1, v);
-+}
- #define atomic_dec_return(v) (atomic_sub_return(1, v))
-
- /* The 64-bit atomic type */
-@@ -204,6 +396,18 @@ static inline long atomic64_read(const a
- }
-
- /**
-+ * atomic64_read_unchecked - read atomic64 variable
-+ * @v: pointer of type atomic64_unchecked_t
-+ *
-+ * Atomically reads the value of @v.
-+ * Doesn't imply a read memory barrier.
-+ */
-+static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
-+{
-+ return v->counter;
-+}
-+
-+/**
- * atomic64_set - set atomic64 variable
- * @v: pointer to type atomic64_t
- * @i: required value
-@@ -216,6 +420,18 @@ static inline void atomic64_set(atomic64
- }
-
- /**
-+ * atomic64_set_unchecked - set atomic64 variable
-+ * @v: pointer to type atomic64_unchecked_t
-+ * @i: required value
-+ *
-+ * Atomically sets the value of @v to @i.
-+ */
-+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
-+{
-+ v->counter = i;
-+}
-+
-+/**
- * atomic64_add - add integer to atomic64 variable
- * @i: integer value to add
- * @v: pointer to type atomic64_t
-@@ -224,6 +440,28 @@ static inline void atomic64_set(atomic64
- */
- static inline void atomic64_add(long i, atomic64_t *v)
- {
-+ asm volatile(LOCK_PREFIX "addq %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "subq %1,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "=m" (v->counter)
-+ : "er" (i), "m" (v->counter));
-+}
-+
-+/**
-+ * atomic64_add_unchecked - add integer to atomic64 variable
-+ * @i: integer value to add
-+ * @v: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically adds @i to @v.
-+ */
-+static inline void atomic64_add_unchecked(long i, atomic64_unchecked_t *v)
-+{
- asm volatile(LOCK_PREFIX "addq %1,%0"
- : "=m" (v->counter)
- : "er" (i), "m" (v->counter));
-@@ -238,7 +476,15 @@ static inline void atomic64_add(long i,
- */
- static inline void atomic64_sub(long i, atomic64_t *v)
- {
-- asm volatile(LOCK_PREFIX "subq %1,%0"
-+ asm volatile(LOCK_PREFIX "subq %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "addq %1,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- : "=m" (v->counter)
- : "er" (i), "m" (v->counter));
- }
-@@ -256,7 +502,16 @@ static inline int atomic64_sub_and_test(
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "subq %2,%0; sete %1"
-+ asm volatile(LOCK_PREFIX "subq %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "addq %2,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
- : "=m" (v->counter), "=qm" (c)
- : "er" (i), "m" (v->counter) : "memory");
- return c;
-@@ -270,6 +525,27 @@ static inline int atomic64_sub_and_test(
- */
- static inline void atomic64_inc(atomic64_t *v)
- {
-+ asm volatile(LOCK_PREFIX "incq %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "decq %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "=m" (v->counter)
-+ : "m" (v->counter));
-+}
-+
-+/**
-+ * atomic64_inc_unchecked - increment atomic64 variable
-+ * @v: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically increments @v by 1.
-+ */
-+static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
-+{
- asm volatile(LOCK_PREFIX "incq %0"
- : "=m" (v->counter)
- : "m" (v->counter));
-@@ -283,7 +559,28 @@ static inline void atomic64_inc(atomic64
- */
- static inline void atomic64_dec(atomic64_t *v)
- {
-- asm volatile(LOCK_PREFIX "decq %0"
-+ asm volatile(LOCK_PREFIX "decq %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "incq %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "=m" (v->counter)
-+ : "m" (v->counter));
-+}
-+
-+/**
-+ * atomic64_dec_unchecked - decrement atomic64 variable
-+ * @v: pointer to type atomic64_t
-+ *
-+ * Atomically decrements @v by 1.
-+ */
-+static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
-+{
-+ asm volatile(LOCK_PREFIX "decq %0\n"
- : "=m" (v->counter)
- : "m" (v->counter));
- }
-@@ -300,7 +597,16 @@ static inline int atomic64_dec_and_test(
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "decq %0; sete %1"
-+ asm volatile(LOCK_PREFIX "decq %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "incq %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
- : "=m" (v->counter), "=qm" (c)
- : "m" (v->counter) : "memory");
- return c != 0;
-@@ -318,7 +624,16 @@ static inline int atomic64_inc_and_test(
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "incq %0; sete %1"
-+ asm volatile(LOCK_PREFIX "incq %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "decq %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
- : "=m" (v->counter), "=qm" (c)
- : "m" (v->counter) : "memory");
- return c != 0;
-@@ -337,7 +652,16 @@ static inline int atomic64_add_negative(
- {
- unsigned char c;
-
-- asm volatile(LOCK_PREFIX "addq %2,%0; sets %1"
-+ asm volatile(LOCK_PREFIX "addq %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "subq %2,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sets %1\n"
- : "=m" (v->counter), "=qm" (c)
- : "er" (i), "m" (v->counter) : "memory");
- return c;
-@@ -353,7 +677,31 @@ static inline int atomic64_add_negative(
- static inline long atomic64_add_return(long i, atomic64_t *v)
- {
- long __i = i;
-- asm volatile(LOCK_PREFIX "xaddq %0, %1;"
-+ asm volatile(LOCK_PREFIX "xaddq %0, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ "movq %0, %1\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "+r" (i), "+m" (v->counter)
-+ : : "memory");
-+ return i + __i;
-+}
-+
-+/**
-+ * atomic64_add_return_unchecked - add and return
-+ * @i: integer value to add
-+ * @v: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically adds @i to @v and returns @i + @v
-+ */
-+static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
-+{
-+ long __i = i;
-+ asm volatile(LOCK_PREFIX "xaddq %0, %1"
- : "+r" (i), "+m" (v->counter)
- : : "memory");
- return i + __i;
-@@ -365,6 +713,10 @@ static inline long atomic64_sub_return(l
- }
-
- #define atomic64_inc_return(v) (atomic64_add_return(1, (v)))
-+static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
-+{
-+ return atomic64_add_return_unchecked(1, v);
-+}
- #define atomic64_dec_return(v) (atomic64_sub_return(1, (v)))
-
- static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
-@@ -372,21 +724,41 @@ static inline long atomic64_cmpxchg(atom
- return cmpxchg(&v->counter, old, new);
- }
-
-+static inline long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long old, long new)
-+{
-+ return cmpxchg(&v->counter, old, new);
-+}
-+
- static inline long atomic64_xchg(atomic64_t *v, long new)
- {
- return xchg(&v->counter, new);
- }
-
-+static inline long atomic64_xchg_unchecked(atomic64_unchecked_t *v, long new)
-+{
-+ return xchg(&v->counter, new);
-+}
-+
- static inline long atomic_cmpxchg(atomic_t *v, int old, int new)
- {
- return cmpxchg(&v->counter, old, new);
- }
-
-+static inline long atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
-+{
-+ return cmpxchg(&v->counter, old, new);
-+}
-+
- static inline long atomic_xchg(atomic_t *v, int new)
- {
- return xchg(&v->counter, new);
- }
-
-+static inline long atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
-+{
-+ return xchg(&v->counter, new);
-+}
-+
- /**
- * atomic_add_unless - add unless the number is a given value
- * @v: pointer of type atomic_t
-@@ -398,17 +770,30 @@ static inline long atomic_xchg(atomic_t
- */
- static inline int atomic_add_unless(atomic_t *v, int a, int u)
- {
-- int c, old;
-+ int c, old, new;
- c = atomic_read(v);
- for (;;) {
-- if (unlikely(c == (u)))
-+ if (unlikely(c == u))
- break;
-- old = atomic_cmpxchg((v), c, c + (a));
-+
-+ asm volatile("addl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ "subl %2,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "=r" (new)
-+ : "0" (c), "ir" (a));
-+
-+ old = atomic_cmpxchg(v, c, new);
- if (likely(old == c))
- break;
- c = old;
- }
-- return c != (u);
-+ return c != u;
- }
-
- #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
-@@ -424,17 +809,30 @@ static inline int atomic_add_unless(atom
- */
- static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
- {
-- long c, old;
-+ long c, old, new;
- c = atomic64_read(v);
- for (;;) {
-- if (unlikely(c == (u)))
-+ if (unlikely(c == u))
- break;
-- old = atomic64_cmpxchg((v), c, c + (a));
-+
-+ asm volatile("addq %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ "subq %2,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ : "=r" (new)
-+ : "0" (c), "er" (a));
-+
-+ old = atomic64_cmpxchg(v, c, new);
- if (likely(old == c))
- break;
- c = old;
- }
-- return c != (u);
-+ return c != u;
- }
-
- /**
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/bitops.h linux-2.6.32.45/arch/x86/include/asm/bitops.h
---- linux-2.6.32.45/arch/x86/include/asm/bitops.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/bitops.h 2011-04-17 15:56:46.000000000 -0400
-@@ -38,7 +38,7 @@
- * a mask operation on a byte.
- */
- #define IS_IMMEDIATE(nr) (__builtin_constant_p(nr))
--#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((void *)(addr) + ((nr)>>3))
-+#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((volatile void *)(addr) + ((nr)>>3))
- #define CONST_MASK(nr) (1 << ((nr) & 7))
-
- /**
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/boot.h linux-2.6.32.45/arch/x86/include/asm/boot.h
---- linux-2.6.32.45/arch/x86/include/asm/boot.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/boot.h 2011-04-17 15:56:46.000000000 -0400
-@@ -11,10 +11,15 @@
- #include <asm/pgtable_types.h>
-
- /* Physical address where kernel should be loaded. */
--#define LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
-+#define ____LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
- + (CONFIG_PHYSICAL_ALIGN - 1)) \
- & ~(CONFIG_PHYSICAL_ALIGN - 1))
-
-+#ifndef __ASSEMBLY__
-+extern unsigned char __LOAD_PHYSICAL_ADDR[];
-+#define LOAD_PHYSICAL_ADDR ((unsigned long)__LOAD_PHYSICAL_ADDR)
-+#endif
-+
- /* Minimum kernel alignment, as a power of two */
- #ifdef CONFIG_X86_64
- #define MIN_KERNEL_ALIGN_LG2 PMD_SHIFT
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/cacheflush.h linux-2.6.32.45/arch/x86/include/asm/cacheflush.h
---- linux-2.6.32.45/arch/x86/include/asm/cacheflush.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/cacheflush.h 2011-04-17 15:56:46.000000000 -0400
-@@ -60,7 +60,7 @@ PAGEFLAG(WC, WC)
- static inline unsigned long get_page_memtype(struct page *pg)
- {
- if (!PageUncached(pg) && !PageWC(pg))
-- return -1;
-+ return ~0UL;
- else if (!PageUncached(pg) && PageWC(pg))
- return _PAGE_CACHE_WC;
- else if (PageUncached(pg) && !PageWC(pg))
-@@ -85,7 +85,7 @@ static inline void set_page_memtype(stru
- SetPageWC(pg);
- break;
- default:
-- case -1:
-+ case ~0UL:
- ClearPageUncached(pg);
- ClearPageWC(pg);
- break;
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/cache.h linux-2.6.32.45/arch/x86/include/asm/cache.h
---- linux-2.6.32.45/arch/x86/include/asm/cache.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/cache.h 2011-07-06 19:53:33.000000000 -0400
-@@ -5,9 +5,10 @@
-
- /* L1 cache line size */
- #define L1_CACHE_SHIFT (CONFIG_X86_L1_CACHE_SHIFT)
--#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
-
- #define __read_mostly __attribute__((__section__(".data.read_mostly")))
-+#define __read_only __attribute__((__section__(".data.read_only")))
-
- #ifdef CONFIG_X86_VSMP
- /* vSMP Internode cacheline shift */
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/checksum_32.h linux-2.6.32.45/arch/x86/include/asm/checksum_32.h
---- linux-2.6.32.45/arch/x86/include/asm/checksum_32.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/checksum_32.h 2011-04-17 15:56:46.000000000 -0400
-@@ -31,6 +31,14 @@ asmlinkage __wsum csum_partial_copy_gene
- int len, __wsum sum,
- int *src_err_ptr, int *dst_err_ptr);
-
-+asmlinkage __wsum csum_partial_copy_generic_to_user(const void *src, void *dst,
-+ int len, __wsum sum,
-+ int *src_err_ptr, int *dst_err_ptr);
-+
-+asmlinkage __wsum csum_partial_copy_generic_from_user(const void *src, void *dst,
-+ int len, __wsum sum,
-+ int *src_err_ptr, int *dst_err_ptr);
-+
- /*
- * Note: when you get a NULL pointer exception here this means someone
- * passed in an incorrect kernel address to one of these functions.
-@@ -50,7 +58,7 @@ static inline __wsum csum_partial_copy_f
- int *err_ptr)
- {
- might_sleep();
-- return csum_partial_copy_generic((__force void *)src, dst,
-+ return csum_partial_copy_generic_from_user((__force void *)src, dst,
- len, sum, err_ptr, NULL);
- }
-
-@@ -178,7 +186,7 @@ static inline __wsum csum_and_copy_to_us
- {
- might_sleep();
- if (access_ok(VERIFY_WRITE, dst, len))
-- return csum_partial_copy_generic(src, (__force void *)dst,
-+ return csum_partial_copy_generic_to_user(src, (__force void *)dst,
- len, sum, NULL, err_ptr);
-
- if (len)
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/desc_defs.h linux-2.6.32.45/arch/x86/include/asm/desc_defs.h
---- linux-2.6.32.45/arch/x86/include/asm/desc_defs.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/desc_defs.h 2011-04-17 15:56:46.000000000 -0400
-@@ -31,6 +31,12 @@ struct desc_struct {
- unsigned base1: 8, type: 4, s: 1, dpl: 2, p: 1;
- unsigned limit: 4, avl: 1, l: 1, d: 1, g: 1, base2: 8;
- };
-+ struct {
-+ u16 offset_low;
-+ u16 seg;
-+ unsigned reserved: 8, type: 4, s: 1, dpl: 2, p: 1;
-+ unsigned offset_high: 16;
-+ } gate;
- };
- } __attribute__((packed));
-
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/desc.h linux-2.6.32.45/arch/x86/include/asm/desc.h
---- linux-2.6.32.45/arch/x86/include/asm/desc.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/desc.h 2011-04-23 12:56:10.000000000 -0400
-@@ -4,6 +4,7 @@
- #include <asm/desc_defs.h>
- #include <asm/ldt.h>
- #include <asm/mmu.h>
-+#include <asm/pgtable.h>
- #include <linux/smp.h>
-
- static inline void fill_ldt(struct desc_struct *desc,
-@@ -15,6 +16,7 @@ static inline void fill_ldt(struct desc_
- desc->base1 = (info->base_addr & 0x00ff0000) >> 16;
- desc->type = (info->read_exec_only ^ 1) << 1;
- desc->type |= info->contents << 2;
-+ desc->type |= info->seg_not_present ^ 1;
- desc->s = 1;
- desc->dpl = 0x3;
- desc->p = info->seg_not_present ^ 1;
-@@ -31,16 +33,12 @@ static inline void fill_ldt(struct desc_
- }
-
- extern struct desc_ptr idt_descr;
--extern gate_desc idt_table[];
--
--struct gdt_page {
-- struct desc_struct gdt[GDT_ENTRIES];
--} __attribute__((aligned(PAGE_SIZE)));
--DECLARE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page);
-+extern gate_desc idt_table[256];
-
-+extern struct desc_struct cpu_gdt_table[NR_CPUS][PAGE_SIZE / sizeof(struct desc_struct)];
- static inline struct desc_struct *get_cpu_gdt_table(unsigned int cpu)
- {
-- return per_cpu(gdt_page, cpu).gdt;
-+ return cpu_gdt_table[cpu];
- }
-
- #ifdef CONFIG_X86_64
-@@ -65,9 +63,14 @@ static inline void pack_gate(gate_desc *
- unsigned long base, unsigned dpl, unsigned flags,
- unsigned short seg)
- {
-- gate->a = (seg << 16) | (base & 0xffff);
-- gate->b = (base & 0xffff0000) |
-- (((0x80 | type | (dpl << 5)) & 0xff) << 8);
-+ gate->gate.offset_low = base;
-+ gate->gate.seg = seg;
-+ gate->gate.reserved = 0;
-+ gate->gate.type = type;
-+ gate->gate.s = 0;
-+ gate->gate.dpl = dpl;
-+ gate->gate.p = 1;
-+ gate->gate.offset_high = base >> 16;
- }
-
- #endif
-@@ -115,13 +118,17 @@ static inline void paravirt_free_ldt(str
- static inline void native_write_idt_entry(gate_desc *idt, int entry,
- const gate_desc *gate)
- {
-+ pax_open_kernel();
- memcpy(&idt[entry], gate, sizeof(*gate));
-+ pax_close_kernel();
- }
-
- static inline void native_write_ldt_entry(struct desc_struct *ldt, int entry,
- const void *desc)
- {
-+ pax_open_kernel();
- memcpy(&ldt[entry], desc, 8);
-+ pax_close_kernel();
- }
-
- static inline void native_write_gdt_entry(struct desc_struct *gdt, int entry,
-@@ -139,7 +146,10 @@ static inline void native_write_gdt_entr
- size = sizeof(struct desc_struct);
- break;
- }
-+
-+ pax_open_kernel();
- memcpy(&gdt[entry], desc, size);
-+ pax_close_kernel();
- }
-
- static inline void pack_descriptor(struct desc_struct *desc, unsigned long base,
-@@ -211,7 +221,9 @@ static inline void native_set_ldt(const
-
- static inline void native_load_tr_desc(void)
- {
-+ pax_open_kernel();
- asm volatile("ltr %w0"::"q" (GDT_ENTRY_TSS*8));
-+ pax_close_kernel();
- }
-
- static inline void native_load_gdt(const struct desc_ptr *dtr)
-@@ -246,8 +258,10 @@ static inline void native_load_tls(struc
- unsigned int i;
- struct desc_struct *gdt = get_cpu_gdt_table(cpu);
-
-+ pax_open_kernel();
- for (i = 0; i < GDT_ENTRY_TLS_ENTRIES; i++)
- gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i];
-+ pax_close_kernel();
- }
-
- #define _LDT_empty(info) \
-@@ -309,7 +323,7 @@ static inline void set_desc_limit(struct
- desc->limit = (limit >> 16) & 0xf;
- }
-
--static inline void _set_gate(int gate, unsigned type, void *addr,
-+static inline void _set_gate(int gate, unsigned type, const void *addr,
- unsigned dpl, unsigned ist, unsigned seg)
- {
- gate_desc s;
-@@ -327,7 +341,7 @@ static inline void _set_gate(int gate, u
- * Pentium F0 0F bugfix can have resulted in the mapped
- * IDT being write-protected.
- */
--static inline void set_intr_gate(unsigned int n, void *addr)
-+static inline void set_intr_gate(unsigned int n, const void *addr)
- {
- BUG_ON((unsigned)n > 0xFF);
- _set_gate(n, GATE_INTERRUPT, addr, 0, 0, __KERNEL_CS);
-@@ -356,19 +370,19 @@ static inline void alloc_intr_gate(unsig
- /*
- * This routine sets up an interrupt gate at directory privilege level 3.
- */
--static inline void set_system_intr_gate(unsigned int n, void *addr)
-+static inline void set_system_intr_gate(unsigned int n, const void *addr)
- {
- BUG_ON((unsigned)n > 0xFF);
- _set_gate(n, GATE_INTERRUPT, addr, 0x3, 0, __KERNEL_CS);
- }
-
--static inline void set_system_trap_gate(unsigned int n, void *addr)
-+static inline void set_system_trap_gate(unsigned int n, const void *addr)
- {
- BUG_ON((unsigned)n > 0xFF);
- _set_gate(n, GATE_TRAP, addr, 0x3, 0, __KERNEL_CS);
- }
-
--static inline void set_trap_gate(unsigned int n, void *addr)
-+static inline void set_trap_gate(unsigned int n, const void *addr)
- {
- BUG_ON((unsigned)n > 0xFF);
- _set_gate(n, GATE_TRAP, addr, 0, 0, __KERNEL_CS);
-@@ -377,19 +391,31 @@ static inline void set_trap_gate(unsigne
- static inline void set_task_gate(unsigned int n, unsigned int gdt_entry)
- {
- BUG_ON((unsigned)n > 0xFF);
-- _set_gate(n, GATE_TASK, (void *)0, 0, 0, (gdt_entry<<3));
-+ _set_gate(n, GATE_TASK, (const void *)0, 0, 0, (gdt_entry<<3));
- }
-
--static inline void set_intr_gate_ist(int n, void *addr, unsigned ist)
-+static inline void set_intr_gate_ist(int n, const void *addr, unsigned ist)
- {
- BUG_ON((unsigned)n > 0xFF);
- _set_gate(n, GATE_INTERRUPT, addr, 0, ist, __KERNEL_CS);
- }
-
--static inline void set_system_intr_gate_ist(int n, void *addr, unsigned ist)
-+static inline void set_system_intr_gate_ist(int n, const void *addr, unsigned ist)
- {
- BUG_ON((unsigned)n > 0xFF);
- _set_gate(n, GATE_INTERRUPT, addr, 0x3, ist, __KERNEL_CS);
- }
-
-+#ifdef CONFIG_X86_32
-+static inline void set_user_cs(unsigned long base, unsigned long limit, int cpu)
-+{
-+ struct desc_struct d;
-+
-+ if (likely(limit))
-+ limit = (limit - 1UL) >> PAGE_SHIFT;
-+ pack_descriptor(&d, base, limit, 0xFB, 0xC);
-+ write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_CS, &d, DESCTYPE_S);
-+}
-+#endif
-+
- #endif /* _ASM_X86_DESC_H */
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/device.h linux-2.6.32.45/arch/x86/include/asm/device.h
---- linux-2.6.32.45/arch/x86/include/asm/device.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/device.h 2011-04-17 15:56:46.000000000 -0400
-@@ -6,7 +6,7 @@ struct dev_archdata {
- void *acpi_handle;
- #endif
- #ifdef CONFIG_X86_64
--struct dma_map_ops *dma_ops;
-+ const struct dma_map_ops *dma_ops;
- #endif
- #ifdef CONFIG_DMAR
- void *iommu; /* hook for IOMMU specific extension */
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/dma-mapping.h linux-2.6.32.45/arch/x86/include/asm/dma-mapping.h
---- linux-2.6.32.45/arch/x86/include/asm/dma-mapping.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/dma-mapping.h 2011-04-17 15:56:46.000000000 -0400
-@@ -25,9 +25,9 @@ extern int iommu_merge;
- extern struct device x86_dma_fallback_dev;
- extern int panic_on_overflow;
-
--extern struct dma_map_ops *dma_ops;
-+extern const struct dma_map_ops *dma_ops;
-
--static inline struct dma_map_ops *get_dma_ops(struct device *dev)
-+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
- {
- #ifdef CONFIG_X86_32
- return dma_ops;
-@@ -44,7 +44,7 @@ static inline struct dma_map_ops *get_dm
- /* Make sure we keep the same behaviour */
- static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
- if (ops->mapping_error)
- return ops->mapping_error(dev, dma_addr);
-
-@@ -122,7 +122,7 @@ static inline void *
- dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
- gfp_t gfp)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
- void *memory;
-
- gfp &= ~(__GFP_DMA | __GFP_HIGHMEM | __GFP_DMA32);
-@@ -149,7 +149,7 @@ dma_alloc_coherent(struct device *dev, s
- static inline void dma_free_coherent(struct device *dev, size_t size,
- void *vaddr, dma_addr_t bus)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- WARN_ON(irqs_disabled()); /* for portability */
-
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/e820.h linux-2.6.32.45/arch/x86/include/asm/e820.h
---- linux-2.6.32.45/arch/x86/include/asm/e820.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/e820.h 2011-04-17 15:56:46.000000000 -0400
-@@ -133,7 +133,7 @@ extern char *default_machine_specific_me
- #define ISA_END_ADDRESS 0x100000
- #define is_ISA_range(s, e) ((s) >= ISA_START_ADDRESS && (e) < ISA_END_ADDRESS)
-
--#define BIOS_BEGIN 0x000a0000
-+#define BIOS_BEGIN 0x000c0000
- #define BIOS_END 0x00100000
-
- #ifdef __KERNEL__
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/elf.h linux-2.6.32.45/arch/x86/include/asm/elf.h
---- linux-2.6.32.45/arch/x86/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/elf.h 2011-04-17 15:56:46.000000000 -0400
-@@ -257,7 +257,25 @@ extern int force_personality32;
- the loader. We need to make sure that it is out of the way of the program
- that it will "exec", and that there is sufficient room for the brk. */
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+#define ELF_ET_DYN_BASE ((current->mm->pax_flags & MF_PAX_SEGMEXEC) ? SEGMEXEC_TASK_SIZE/3*2 : TASK_SIZE/3*2)
-+#else
- #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
-+#endif
-+
-+#ifdef CONFIG_PAX_ASLR
-+#ifdef CONFIG_X86_32
-+#define PAX_ELF_ET_DYN_BASE 0x10000000UL
-+
-+#define PAX_DELTA_MMAP_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
-+#define PAX_DELTA_STACK_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
-+#else
-+#define PAX_ELF_ET_DYN_BASE 0x400000UL
-+
-+#define PAX_DELTA_MMAP_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
-+#define PAX_DELTA_STACK_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
-+#endif
-+#endif
-
- /* This yields a mask that user programs can use to figure out what
- instruction set this CPU supports. This could be done in user space,
-@@ -311,8 +329,7 @@ do { \
- #define ARCH_DLINFO \
- do { \
- if (vdso_enabled) \
-- NEW_AUX_ENT(AT_SYSINFO_EHDR, \
-- (unsigned long)current->mm->context.vdso); \
-+ NEW_AUX_ENT(AT_SYSINFO_EHDR, current->mm->context.vdso);\
- } while (0)
-
- #define AT_SYSINFO 32
-@@ -323,7 +340,7 @@ do { \
-
- #endif /* !CONFIG_X86_32 */
-
--#define VDSO_CURRENT_BASE ((unsigned long)current->mm->context.vdso)
-+#define VDSO_CURRENT_BASE (current->mm->context.vdso)
-
- #define VDSO_ENTRY \
- ((unsigned long)VDSO32_SYMBOL(VDSO_CURRENT_BASE, vsyscall))
-@@ -337,7 +354,4 @@ extern int arch_setup_additional_pages(s
- extern int syscall32_setup_pages(struct linux_binprm *, int exstack);
- #define compat_arch_setup_additional_pages syscall32_setup_pages
-
--extern unsigned long arch_randomize_brk(struct mm_struct *mm);
--#define arch_randomize_brk arch_randomize_brk
--
- #endif /* _ASM_X86_ELF_H */
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/emergency-restart.h linux-2.6.32.45/arch/x86/include/asm/emergency-restart.h
---- linux-2.6.32.45/arch/x86/include/asm/emergency-restart.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/emergency-restart.h 2011-05-22 23:02:06.000000000 -0400
-@@ -15,6 +15,6 @@ enum reboot_type {
-
- extern enum reboot_type reboot_type;
-
--extern void machine_emergency_restart(void);
-+extern void machine_emergency_restart(void) __noreturn;
-
- #endif /* _ASM_X86_EMERGENCY_RESTART_H */
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/futex.h linux-2.6.32.45/arch/x86/include/asm/futex.h
---- linux-2.6.32.45/arch/x86/include/asm/futex.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/futex.h 2011-04-17 15:56:46.000000000 -0400
-@@ -12,16 +12,18 @@
- #include <asm/system.h>
-
- #define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg) \
-+ typecheck(u32 *, uaddr); \
- asm volatile("1:\t" insn "\n" \
- "2:\t.section .fixup,\"ax\"\n" \
- "3:\tmov\t%3, %1\n" \
- "\tjmp\t2b\n" \
- "\t.previous\n" \
- _ASM_EXTABLE(1b, 3b) \
-- : "=r" (oldval), "=r" (ret), "+m" (*uaddr) \
-+ : "=r" (oldval), "=r" (ret), "+m" (*(u32 *)____m(uaddr))\
- : "i" (-EFAULT), "0" (oparg), "1" (0))
-
- #define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg) \
-+ typecheck(u32 *, uaddr); \
- asm volatile("1:\tmovl %2, %0\n" \
- "\tmovl\t%0, %3\n" \
- "\t" insn "\n" \
-@@ -34,10 +36,10 @@
- _ASM_EXTABLE(1b, 4b) \
- _ASM_EXTABLE(2b, 4b) \
- : "=&a" (oldval), "=&r" (ret), \
-- "+m" (*uaddr), "=&r" (tem) \
-+ "+m" (*(u32 *)____m(uaddr)), "=&r" (tem) \
- : "r" (oparg), "i" (-EFAULT), "1" (0))
-
--static inline int futex_atomic_op_inuser(int encoded_op, int __user *uaddr)
-+static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
- {
- int op = (encoded_op >> 28) & 7;
- int cmp = (encoded_op >> 24) & 15;
-@@ -61,10 +63,10 @@ static inline int futex_atomic_op_inuser
-
- switch (op) {
- case FUTEX_OP_SET:
-- __futex_atomic_op1("xchgl %0, %2", ret, oldval, uaddr, oparg);
-+ __futex_atomic_op1(__copyuser_seg"xchgl %0, %2", ret, oldval, uaddr, oparg);
- break;
- case FUTEX_OP_ADD:
-- __futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret, oldval,
-+ __futex_atomic_op1(LOCK_PREFIX __copyuser_seg"xaddl %0, %2", ret, oldval,
- uaddr, oparg);
- break;
- case FUTEX_OP_OR:
-@@ -109,7 +111,7 @@ static inline int futex_atomic_op_inuser
- return ret;
- }
-
--static inline int futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval,
-+static inline int futex_atomic_cmpxchg_inatomic(u32 __user *uaddr, int oldval,
- int newval)
- {
-
-@@ -119,16 +121,16 @@ static inline int futex_atomic_cmpxchg_i
- return -ENOSYS;
- #endif
-
-- if (!access_ok(VERIFY_WRITE, uaddr, sizeof(int)))
-+ if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
- return -EFAULT;
-
-- asm volatile("1:\t" LOCK_PREFIX "cmpxchgl %3, %1\n"
-+ asm volatile("1:\t" LOCK_PREFIX __copyuser_seg"cmpxchgl %3, %1\n"
- "2:\t.section .fixup, \"ax\"\n"
- "3:\tmov %2, %0\n"
- "\tjmp 2b\n"
- "\t.previous\n"
- _ASM_EXTABLE(1b, 3b)
-- : "=a" (oldval), "+m" (*uaddr)
-+ : "=a" (oldval), "+m" (*(u32 *)____m(uaddr))
- : "i" (-EFAULT), "r" (newval), "0" (oldval)
- : "memory"
- );
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/hw_irq.h linux-2.6.32.45/arch/x86/include/asm/hw_irq.h
---- linux-2.6.32.45/arch/x86/include/asm/hw_irq.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/hw_irq.h 2011-05-04 17:56:28.000000000 -0400
-@@ -92,8 +92,8 @@ extern void setup_ioapic_dest(void);
- extern void enable_IO_APIC(void);
-
- /* Statistics */
--extern atomic_t irq_err_count;
--extern atomic_t irq_mis_count;
-+extern atomic_unchecked_t irq_err_count;
-+extern atomic_unchecked_t irq_mis_count;
-
- /* EISA */
- extern void eisa_set_level_irq(unsigned int irq);
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/i387.h linux-2.6.32.45/arch/x86/include/asm/i387.h
---- linux-2.6.32.45/arch/x86/include/asm/i387.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/i387.h 2011-04-17 15:56:46.000000000 -0400
-@@ -60,6 +60,11 @@ static inline int fxrstor_checking(struc
- {
- int err;
-
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
-+ fx = (struct i387_fxsave_struct *)((void *)fx + PAX_USER_SHADOW_BASE);
-+#endif
-+
- asm volatile("1: rex64/fxrstor (%[fx])\n\t"
- "2:\n"
- ".section .fixup,\"ax\"\n"
-@@ -105,6 +110,11 @@ static inline int fxsave_user(struct i38
- {
- int err;
-
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
-+ fx = (struct i387_fxsave_struct __user *)((void __user *)fx + PAX_USER_SHADOW_BASE);
-+#endif
-+
- asm volatile("1: rex64/fxsave (%[fx])\n\t"
- "2:\n"
- ".section .fixup,\"ax\"\n"
-@@ -195,13 +205,8 @@ static inline int fxrstor_checking(struc
- }
-
- /* We need a safe address that is cheap to find and that is already
-- in L1 during context switch. The best choices are unfortunately
-- different for UP and SMP */
--#ifdef CONFIG_SMP
--#define safe_address (__per_cpu_offset[0])
--#else
--#define safe_address (kstat_cpu(0).cpustat.user)
--#endif
-+ in L1 during context switch. */
-+#define safe_address (init_tss[smp_processor_id()].x86_tss.sp0)
-
- /*
- * These must be called with preempt disabled
-@@ -291,7 +296,7 @@ static inline void kernel_fpu_begin(void
- struct thread_info *me = current_thread_info();
- preempt_disable();
- if (me->status & TS_USEDFPU)
-- __save_init_fpu(me->task);
-+ __save_init_fpu(current);
- else
- clts();
- }
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/io_32.h linux-2.6.32.45/arch/x86/include/asm/io_32.h
---- linux-2.6.32.45/arch/x86/include/asm/io_32.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/io_32.h 2011-04-17 15:56:46.000000000 -0400
-@@ -3,6 +3,7 @@
-
- #include <linux/string.h>
- #include <linux/compiler.h>
-+#include <asm/processor.h>
-
- /*
- * This file contains the definitions for the x86 IO instructions
-@@ -42,6 +43,17 @@
-
- #ifdef __KERNEL__
-
-+#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
-+static inline int valid_phys_addr_range(unsigned long addr, size_t count)
-+{
-+ return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
-+}
-+
-+static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
-+{
-+ return (pfn + (count >> PAGE_SHIFT)) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
-+}
-+
- #include <asm-generic/iomap.h>
-
- #include <linux/vmalloc.h>
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/io_64.h linux-2.6.32.45/arch/x86/include/asm/io_64.h
---- linux-2.6.32.45/arch/x86/include/asm/io_64.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/io_64.h 2011-04-17 15:56:46.000000000 -0400
-@@ -140,6 +140,17 @@ __OUTS(l)
-
- #include <linux/vmalloc.h>
-
-+#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
-+static inline int valid_phys_addr_range(unsigned long addr, size_t count)
-+{
-+ return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
-+}
-+
-+static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
-+{
-+ return (pfn + (count >> PAGE_SHIFT)) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
-+}
-+
- #include <asm-generic/iomap.h>
-
- void __memcpy_fromio(void *, unsigned long, unsigned);
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/iommu.h linux-2.6.32.45/arch/x86/include/asm/iommu.h
---- linux-2.6.32.45/arch/x86/include/asm/iommu.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/iommu.h 2011-04-17 15:56:46.000000000 -0400
-@@ -3,7 +3,7 @@
-
- extern void pci_iommu_shutdown(void);
- extern void no_iommu_init(void);
--extern struct dma_map_ops nommu_dma_ops;
-+extern const struct dma_map_ops nommu_dma_ops;
- extern int force_iommu, no_iommu;
- extern int iommu_detected;
- extern int iommu_pass_through;
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/irqflags.h linux-2.6.32.45/arch/x86/include/asm/irqflags.h
---- linux-2.6.32.45/arch/x86/include/asm/irqflags.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/irqflags.h 2011-04-17 15:56:46.000000000 -0400
-@@ -142,6 +142,11 @@ static inline unsigned long __raw_local_
- sti; \
- sysexit
-
-+#define GET_CR0_INTO_RDI mov %cr0, %rdi
-+#define SET_RDI_INTO_CR0 mov %rdi, %cr0
-+#define GET_CR3_INTO_RDI mov %cr3, %rdi
-+#define SET_RDI_INTO_CR3 mov %rdi, %cr3
-+
- #else
- #define INTERRUPT_RETURN iret
- #define ENABLE_INTERRUPTS_SYSEXIT sti; sysexit
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/kprobes.h linux-2.6.32.45/arch/x86/include/asm/kprobes.h
---- linux-2.6.32.45/arch/x86/include/asm/kprobes.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/kprobes.h 2011-04-23 12:56:12.000000000 -0400
-@@ -34,13 +34,8 @@ typedef u8 kprobe_opcode_t;
- #define BREAKPOINT_INSTRUCTION 0xcc
- #define RELATIVEJUMP_INSTRUCTION 0xe9
- #define MAX_INSN_SIZE 16
--#define MAX_STACK_SIZE 64
--#define MIN_STACK_SIZE(ADDR) \
-- (((MAX_STACK_SIZE) < (((unsigned long)current_thread_info()) + \
-- THREAD_SIZE - (unsigned long)(ADDR))) \
-- ? (MAX_STACK_SIZE) \
-- : (((unsigned long)current_thread_info()) + \
-- THREAD_SIZE - (unsigned long)(ADDR)))
-+#define MAX_STACK_SIZE 64UL
-+#define MIN_STACK_SIZE(ADDR) min(MAX_STACK_SIZE, current->thread.sp0 - (unsigned long)(ADDR))
-
- #define flush_insn_slot(p) do { } while (0)
-
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/kvm_host.h linux-2.6.32.45/arch/x86/include/asm/kvm_host.h
---- linux-2.6.32.45/arch/x86/include/asm/kvm_host.h 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/kvm_host.h 2011-05-10 22:12:26.000000000 -0400
-@@ -536,7 +536,7 @@ struct kvm_x86_ops {
- const struct trace_print_flags *exit_reasons_str;
- };
-
--extern struct kvm_x86_ops *kvm_x86_ops;
-+extern const struct kvm_x86_ops *kvm_x86_ops;
-
- int kvm_mmu_module_init(void);
- void kvm_mmu_module_exit(void);
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/local.h linux-2.6.32.45/arch/x86/include/asm/local.h
---- linux-2.6.32.45/arch/x86/include/asm/local.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/local.h 2011-04-17 15:56:46.000000000 -0400
-@@ -18,26 +18,58 @@ typedef struct {
-
- static inline void local_inc(local_t *l)
- {
-- asm volatile(_ASM_INC "%0"
-+ asm volatile(_ASM_INC "%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ _ASM_DEC "%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- : "+m" (l->a.counter));
- }
-
- static inline void local_dec(local_t *l)
- {
-- asm volatile(_ASM_DEC "%0"
-+ asm volatile(_ASM_DEC "%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ _ASM_INC "%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- : "+m" (l->a.counter));
- }
-
- static inline void local_add(long i, local_t *l)
- {
-- asm volatile(_ASM_ADD "%1,%0"
-+ asm volatile(_ASM_ADD "%1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ _ASM_SUB "%1,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- : "+m" (l->a.counter)
- : "ir" (i));
- }
-
- static inline void local_sub(long i, local_t *l)
- {
-- asm volatile(_ASM_SUB "%1,%0"
-+ asm volatile(_ASM_SUB "%1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ _ASM_ADD "%1,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- : "+m" (l->a.counter)
- : "ir" (i));
- }
-@@ -55,7 +87,16 @@ static inline int local_sub_and_test(lon
- {
- unsigned char c;
-
-- asm volatile(_ASM_SUB "%2,%0; sete %1"
-+ asm volatile(_ASM_SUB "%2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ _ASM_ADD "%2,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
- : "+m" (l->a.counter), "=qm" (c)
- : "ir" (i) : "memory");
- return c;
-@@ -73,7 +114,16 @@ static inline int local_dec_and_test(loc
- {
- unsigned char c;
-
-- asm volatile(_ASM_DEC "%0; sete %1"
-+ asm volatile(_ASM_DEC "%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ _ASM_INC "%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
- : "+m" (l->a.counter), "=qm" (c)
- : : "memory");
- return c != 0;
-@@ -91,7 +141,16 @@ static inline int local_inc_and_test(loc
- {
- unsigned char c;
-
-- asm volatile(_ASM_INC "%0; sete %1"
-+ asm volatile(_ASM_INC "%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ _ASM_DEC "%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sete %1\n"
- : "+m" (l->a.counter), "=qm" (c)
- : : "memory");
- return c != 0;
-@@ -110,7 +169,16 @@ static inline int local_add_negative(lon
- {
- unsigned char c;
-
-- asm volatile(_ASM_ADD "%2,%0; sets %1"
-+ asm volatile(_ASM_ADD "%2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ _ASM_SUB "%2,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ "sets %1\n"
- : "+m" (l->a.counter), "=qm" (c)
- : "ir" (i) : "memory");
- return c;
-@@ -133,7 +201,15 @@ static inline long local_add_return(long
- #endif
- /* Modern 486+ processor */
- __i = i;
-- asm volatile(_ASM_XADD "%0, %1;"
-+ asm volatile(_ASM_XADD "%0, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ _ASM_MOV "%0,%1\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- : "+r" (i), "+m" (l->a.counter)
- : : "memory");
- return i + __i;
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/microcode.h linux-2.6.32.45/arch/x86/include/asm/microcode.h
---- linux-2.6.32.45/arch/x86/include/asm/microcode.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/microcode.h 2011-04-17 15:56:46.000000000 -0400
-@@ -12,13 +12,13 @@ struct device;
- enum ucode_state { UCODE_ERROR, UCODE_OK, UCODE_NFOUND };
-
- struct microcode_ops {
-- enum ucode_state (*request_microcode_user) (int cpu,
-+ enum ucode_state (* const request_microcode_user) (int cpu,
- const void __user *buf, size_t size);
-
-- enum ucode_state (*request_microcode_fw) (int cpu,
-+ enum ucode_state (* const request_microcode_fw) (int cpu,
- struct device *device);
-
-- void (*microcode_fini_cpu) (int cpu);
-+ void (* const microcode_fini_cpu) (int cpu);
-
- /*
- * The generic 'microcode_core' part guarantees that
-@@ -38,18 +38,18 @@ struct ucode_cpu_info {
- extern struct ucode_cpu_info ucode_cpu_info[];
-
- #ifdef CONFIG_MICROCODE_INTEL
--extern struct microcode_ops * __init init_intel_microcode(void);
-+extern const struct microcode_ops * __init init_intel_microcode(void);
- #else
--static inline struct microcode_ops * __init init_intel_microcode(void)
-+static inline const struct microcode_ops * __init init_intel_microcode(void)
- {
- return NULL;
- }
- #endif /* CONFIG_MICROCODE_INTEL */
-
- #ifdef CONFIG_MICROCODE_AMD
--extern struct microcode_ops * __init init_amd_microcode(void);
-+extern const struct microcode_ops * __init init_amd_microcode(void);
- #else
--static inline struct microcode_ops * __init init_amd_microcode(void)
-+static inline const struct microcode_ops * __init init_amd_microcode(void)
- {
- return NULL;
- }
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/mman.h linux-2.6.32.45/arch/x86/include/asm/mman.h
---- linux-2.6.32.45/arch/x86/include/asm/mman.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/mman.h 2011-04-17 15:56:46.000000000 -0400
-@@ -5,4 +5,14 @@
-
- #include <asm-generic/mman.h>
-
-+#ifdef __KERNEL__
-+#ifndef __ASSEMBLY__
-+#ifdef CONFIG_X86_32
-+#define arch_mmap_check i386_mmap_check
-+int i386_mmap_check(unsigned long addr, unsigned long len,
-+ unsigned long flags);
-+#endif
-+#endif
-+#endif
-+
- #endif /* _ASM_X86_MMAN_H */
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/mmu_context.h linux-2.6.32.45/arch/x86/include/asm/mmu_context.h
---- linux-2.6.32.45/arch/x86/include/asm/mmu_context.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/mmu_context.h 2011-08-17 19:46:53.000000000 -0400
-@@ -24,6 +24,21 @@ void destroy_context(struct mm_struct *m
-
- static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
- {
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ unsigned int i;
-+ pgd_t *pgd;
-+
-+ pax_open_kernel();
-+ pgd = get_cpu_pgd(smp_processor_id());
-+ for (i = USER_PGD_PTRS; i < 2 * USER_PGD_PTRS; ++i)
-+ if (paravirt_enabled())
-+ set_pgd(pgd+i, native_make_pgd(0));
-+ else
-+ pgd[i] = native_make_pgd(0);
-+ pax_close_kernel();
-+#endif
-+
- #ifdef CONFIG_SMP
- if (percpu_read(cpu_tlbstate.state) == TLBSTATE_OK)
- percpu_write(cpu_tlbstate.state, TLBSTATE_LAZY);
-@@ -34,16 +49,30 @@ static inline void switch_mm(struct mm_s
- struct task_struct *tsk)
- {
- unsigned cpu = smp_processor_id();
-+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)) && defined(CONFIG_SMP)
-+ int tlbstate = TLBSTATE_OK;
-+#endif
-
- if (likely(prev != next)) {
- #ifdef CONFIG_SMP
-+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
-+ tlbstate = percpu_read(cpu_tlbstate.state);
-+#endif
- percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
- percpu_write(cpu_tlbstate.active_mm, next);
- #endif
- cpumask_set_cpu(cpu, mm_cpumask(next));
-
- /* Re-load page tables */
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ pax_open_kernel();
-+ __clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
-+ __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
-+ pax_close_kernel();
-+ load_cr3(get_cpu_pgd(cpu));
-+#else
- load_cr3(next->pgd);
-+#endif
-
- /* stop flush ipis for the previous mm */
- cpumask_clear_cpu(cpu, mm_cpumask(prev));
-@@ -53,9 +82,38 @@ static inline void switch_mm(struct mm_s
- */
- if (unlikely(prev->context.ldt != next->context.ldt))
- load_LDT_nolock(&next->context);
-- }
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
-+ if (!nx_enabled) {
-+ smp_mb__before_clear_bit();
-+ cpu_clear(cpu, prev->context.cpu_user_cs_mask);
-+ smp_mb__after_clear_bit();
-+ cpu_set(cpu, next->context.cpu_user_cs_mask);
-+ }
-+#endif
-+
-+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
-+ if (unlikely(prev->context.user_cs_base != next->context.user_cs_base ||
-+ prev->context.user_cs_limit != next->context.user_cs_limit))
-+ set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
- #ifdef CONFIG_SMP
-+ else if (unlikely(tlbstate != TLBSTATE_OK))
-+ set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
-+#endif
-+#endif
-+
-+ }
- else {
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ pax_open_kernel();
-+ __clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
-+ __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
-+ pax_close_kernel();
-+ load_cr3(get_cpu_pgd(cpu));
-+#endif
-+
-+#ifdef CONFIG_SMP
- percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
- BUG_ON(percpu_read(cpu_tlbstate.active_mm) != next);
-
-@@ -64,11 +122,28 @@ static inline void switch_mm(struct mm_s
- * tlb flush IPI delivery. We must reload CR3
- * to make sure to use no freed page tables.
- */
-+
-+#ifndef CONFIG_PAX_PER_CPU_PGD
- load_cr3(next->pgd);
-+#endif
-+
- load_LDT_nolock(&next->context);
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
-+ if (!nx_enabled)
-+ cpu_set(cpu, next->context.cpu_user_cs_mask);
-+#endif
-+
-+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (!((next->pax_flags & MF_PAX_PAGEEXEC) && nx_enabled))
-+#endif
-+ set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
-+#endif
-+
- }
-- }
- #endif
-+ }
- }
-
- #define activate_mm(prev, next) \
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/mmu.h linux-2.6.32.45/arch/x86/include/asm/mmu.h
---- linux-2.6.32.45/arch/x86/include/asm/mmu.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/mmu.h 2011-04-17 15:56:46.000000000 -0400
-@@ -9,10 +9,23 @@
- * we put the segment information here.
- */
- typedef struct {
-- void *ldt;
-+ struct desc_struct *ldt;
- int size;
- struct mutex lock;
-- void *vdso;
-+ unsigned long vdso;
-+
-+#ifdef CONFIG_X86_32
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+ unsigned long user_cs_base;
-+ unsigned long user_cs_limit;
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
-+ cpumask_t cpu_user_cs_mask;
-+#endif
-+
-+#endif
-+#endif
-+
- } mm_context_t;
-
- #ifdef CONFIG_SMP
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/module.h linux-2.6.32.45/arch/x86/include/asm/module.h
---- linux-2.6.32.45/arch/x86/include/asm/module.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/module.h 2011-04-23 13:18:57.000000000 -0400
-@@ -5,6 +5,7 @@
-
- #ifdef CONFIG_X86_64
- /* X86_64 does not define MODULE_PROC_FAMILY */
-+#define MODULE_PROC_FAMILY ""
- #elif defined CONFIG_M386
- #define MODULE_PROC_FAMILY "386 "
- #elif defined CONFIG_M486
-@@ -59,13 +60,36 @@
- #error unknown processor family
- #endif
-
--#ifdef CONFIG_X86_32
--# ifdef CONFIG_4KSTACKS
--# define MODULE_STACKSIZE "4KSTACKS "
--# else
--# define MODULE_STACKSIZE ""
--# endif
--# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_STACKSIZE
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+#define MODULE_PAX_UDEREF "UDEREF "
-+#else
-+#define MODULE_PAX_UDEREF ""
-+#endif
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+#define MODULE_PAX_KERNEXEC "KERNEXEC "
-+#else
-+#define MODULE_PAX_KERNEXEC ""
-+#endif
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#define MODULE_PAX_REFCOUNT "REFCOUNT "
-+#else
-+#define MODULE_PAX_REFCOUNT ""
- #endif
-
-+#if defined(CONFIG_X86_32) && defined(CONFIG_4KSTACKS)
-+#define MODULE_STACKSIZE "4KSTACKS "
-+#else
-+#define MODULE_STACKSIZE ""
-+#endif
-+
-+#ifdef CONFIG_GRKERNSEC
-+#define MODULE_GRSEC "GRSECURITY "
-+#else
-+#define MODULE_GRSEC ""
-+#endif
-+
-+#define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_STACKSIZE MODULE_GRSEC MODULE_PAX_KERNEXEC MODULE_PAX_UDEREF MODULE_PAX_REFCOUNT
-+
- #endif /* _ASM_X86_MODULE_H */
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/page_64_types.h linux-2.6.32.45/arch/x86/include/asm/page_64_types.h
---- linux-2.6.32.45/arch/x86/include/asm/page_64_types.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/page_64_types.h 2011-04-17 15:56:46.000000000 -0400
-@@ -56,7 +56,7 @@ void copy_page(void *to, void *from);
-
- /* duplicated to the one in bootmem.h */
- extern unsigned long max_pfn;
--extern unsigned long phys_base;
-+extern const unsigned long phys_base;
-
- extern unsigned long __phys_addr(unsigned long);
- #define __phys_reloc_hide(x) (x)
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/paravirt.h linux-2.6.32.45/arch/x86/include/asm/paravirt.h
---- linux-2.6.32.45/arch/x86/include/asm/paravirt.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/paravirt.h 2011-04-17 15:56:46.000000000 -0400
-@@ -729,6 +729,21 @@ static inline void __set_fixmap(unsigned
- pv_mmu_ops.set_fixmap(idx, phys, flags);
- }
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+static inline unsigned long pax_open_kernel(void)
-+{
-+ return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_open_kernel);
-+}
-+
-+static inline unsigned long pax_close_kernel(void)
-+{
-+ return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_close_kernel);
-+}
-+#else
-+static inline unsigned long pax_open_kernel(void) { return 0; }
-+static inline unsigned long pax_close_kernel(void) { return 0; }
-+#endif
-+
- #if defined(CONFIG_SMP) && defined(CONFIG_PARAVIRT_SPINLOCKS)
-
- static inline int __raw_spin_is_locked(struct raw_spinlock *lock)
-@@ -945,7 +960,7 @@ extern void default_banner(void);
-
- #define PARA_PATCH(struct, off) ((PARAVIRT_PATCH_##struct + (off)) / 4)
- #define PARA_SITE(ptype, clobbers, ops) _PVSITE(ptype, clobbers, ops, .long, 4)
--#define PARA_INDIRECT(addr) *%cs:addr
-+#define PARA_INDIRECT(addr) *%ss:addr
- #endif
-
- #define INTERRUPT_RETURN \
-@@ -1022,6 +1037,21 @@ extern void default_banner(void);
- PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_irq_enable_sysexit), \
- CLBR_NONE, \
- jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_irq_enable_sysexit))
-+
-+#define GET_CR0_INTO_RDI \
-+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0); \
-+ mov %rax,%rdi
-+
-+#define SET_RDI_INTO_CR0 \
-+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
-+
-+#define GET_CR3_INTO_RDI \
-+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_read_cr3); \
-+ mov %rax,%rdi
-+
-+#define SET_RDI_INTO_CR3 \
-+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_write_cr3)
-+
- #endif /* CONFIG_X86_32 */
-
- #endif /* __ASSEMBLY__ */
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/paravirt_types.h linux-2.6.32.45/arch/x86/include/asm/paravirt_types.h
---- linux-2.6.32.45/arch/x86/include/asm/paravirt_types.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/paravirt_types.h 2011-08-05 20:33:55.000000000 -0400
-@@ -78,19 +78,19 @@ struct pv_init_ops {
- */
- unsigned (*patch)(u8 type, u16 clobber, void *insnbuf,
- unsigned long addr, unsigned len);
--};
-+} __no_const;
-
-
- struct pv_lazy_ops {
- /* Set deferred update mode, used for batching operations. */
- void (*enter)(void);
- void (*leave)(void);
--};
-+} __no_const;
-
- struct pv_time_ops {
- unsigned long long (*sched_clock)(void);
- unsigned long (*get_tsc_khz)(void);
--};
-+} __no_const;
-
- struct pv_cpu_ops {
- /* hooks for various privileged instructions */
-@@ -186,7 +186,7 @@ struct pv_cpu_ops {
-
- void (*start_context_switch)(struct task_struct *prev);
- void (*end_context_switch)(struct task_struct *next);
--};
-+} __no_const;
-
- struct pv_irq_ops {
- /*
-@@ -217,7 +217,7 @@ struct pv_apic_ops {
- unsigned long start_eip,
- unsigned long start_esp);
- #endif
--};
-+} __no_const;
-
- struct pv_mmu_ops {
- unsigned long (*read_cr2)(void);
-@@ -316,6 +316,12 @@ struct pv_mmu_ops {
- an mfn. We can tell which is which from the index. */
- void (*set_fixmap)(unsigned /* enum fixed_addresses */ idx,
- phys_addr_t phys, pgprot_t flags);
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ unsigned long (*pax_open_kernel)(void);
-+ unsigned long (*pax_close_kernel)(void);
-+#endif
-+
- };
-
- struct raw_spinlock;
-@@ -326,7 +332,7 @@ struct pv_lock_ops {
- void (*spin_lock_flags)(struct raw_spinlock *lock, unsigned long flags);
- int (*spin_trylock)(struct raw_spinlock *lock);
- void (*spin_unlock)(struct raw_spinlock *lock);
--};
-+} __no_const;
-
- /* This contains all the paravirt structures: we get a convenient
- * number for each function using the offset which we use to indicate
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/pci_x86.h linux-2.6.32.45/arch/x86/include/asm/pci_x86.h
---- linux-2.6.32.45/arch/x86/include/asm/pci_x86.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/pci_x86.h 2011-04-17 15:56:46.000000000 -0400
-@@ -89,16 +89,16 @@ extern int (*pcibios_enable_irq)(struct
- extern void (*pcibios_disable_irq)(struct pci_dev *dev);
-
- struct pci_raw_ops {
-- int (*read)(unsigned int domain, unsigned int bus, unsigned int devfn,
-+ int (* const read)(unsigned int domain, unsigned int bus, unsigned int devfn,
- int reg, int len, u32 *val);
-- int (*write)(unsigned int domain, unsigned int bus, unsigned int devfn,
-+ int (* const write)(unsigned int domain, unsigned int bus, unsigned int devfn,
- int reg, int len, u32 val);
- };
-
--extern struct pci_raw_ops *raw_pci_ops;
--extern struct pci_raw_ops *raw_pci_ext_ops;
-+extern const struct pci_raw_ops *raw_pci_ops;
-+extern const struct pci_raw_ops *raw_pci_ext_ops;
-
--extern struct pci_raw_ops pci_direct_conf1;
-+extern const struct pci_raw_ops pci_direct_conf1;
- extern bool port_cf9_safe;
-
- /* arch_initcall level */
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/percpu.h linux-2.6.32.45/arch/x86/include/asm/percpu.h
---- linux-2.6.32.45/arch/x86/include/asm/percpu.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/percpu.h 2011-08-17 19:33:59.000000000 -0400
-@@ -78,6 +78,7 @@ do { \
- if (0) { \
- T__ tmp__; \
- tmp__ = (val); \
-+ (void)tmp__; \
- } \
- switch (sizeof(var)) { \
- case 1: \
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/pgalloc.h linux-2.6.32.45/arch/x86/include/asm/pgalloc.h
---- linux-2.6.32.45/arch/x86/include/asm/pgalloc.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/pgalloc.h 2011-04-17 15:56:46.000000000 -0400
-@@ -63,6 +63,13 @@ static inline void pmd_populate_kernel(s
- pmd_t *pmd, pte_t *pte)
- {
- paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
-+ set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE));
-+}
-+
-+static inline void pmd_populate_user(struct mm_struct *mm,
-+ pmd_t *pmd, pte_t *pte)
-+{
-+ paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
- set_pmd(pmd, __pmd(__pa(pte) | _PAGE_TABLE));
- }
-
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/pgtable-2level.h linux-2.6.32.45/arch/x86/include/asm/pgtable-2level.h
---- linux-2.6.32.45/arch/x86/include/asm/pgtable-2level.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/pgtable-2level.h 2011-04-17 15:56:46.000000000 -0400
-@@ -18,7 +18,9 @@ static inline void native_set_pte(pte_t
-
- static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
- {
-+ pax_open_kernel();
- *pmdp = pmd;
-+ pax_close_kernel();
- }
-
- static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/pgtable_32.h linux-2.6.32.45/arch/x86/include/asm/pgtable_32.h
---- linux-2.6.32.45/arch/x86/include/asm/pgtable_32.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/pgtable_32.h 2011-04-17 15:56:46.000000000 -0400
-@@ -26,9 +26,6 @@
- struct mm_struct;
- struct vm_area_struct;
-
--extern pgd_t swapper_pg_dir[1024];
--extern pgd_t trampoline_pg_dir[1024];
--
- static inline void pgtable_cache_init(void) { }
- static inline void check_pgt_cache(void) { }
- void paging_init(void);
-@@ -49,6 +46,12 @@ extern void set_pmd_pfn(unsigned long, u
- # include <asm/pgtable-2level.h>
- #endif
-
-+extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
-+extern pgd_t trampoline_pg_dir[PTRS_PER_PGD];
-+#ifdef CONFIG_X86_PAE
-+extern pmd_t swapper_pm_dir[PTRS_PER_PGD][PTRS_PER_PMD];
-+#endif
-+
- #if defined(CONFIG_HIGHPTE)
- #define __KM_PTE \
- (in_nmi() ? KM_NMI_PTE : \
-@@ -73,7 +76,9 @@ extern void set_pmd_pfn(unsigned long, u
- /* Clear a kernel PTE and flush it from the TLB */
- #define kpte_clear_flush(ptep, vaddr) \
- do { \
-+ pax_open_kernel(); \
- pte_clear(&init_mm, (vaddr), (ptep)); \
-+ pax_close_kernel(); \
- __flush_tlb_one((vaddr)); \
- } while (0)
-
-@@ -85,6 +90,9 @@ do { \
-
- #endif /* !__ASSEMBLY__ */
-
-+#define HAVE_ARCH_UNMAPPED_AREA
-+#define HAVE_ARCH_UNMAPPED_AREA_TOPDOWN
-+
- /*
- * kern_addr_valid() is (1) for FLATMEM and (0) for
- * SPARSEMEM and DISCONTIGMEM
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/pgtable_32_types.h linux-2.6.32.45/arch/x86/include/asm/pgtable_32_types.h
---- linux-2.6.32.45/arch/x86/include/asm/pgtable_32_types.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/pgtable_32_types.h 2011-04-17 15:56:46.000000000 -0400
-@@ -8,7 +8,7 @@
- */
- #ifdef CONFIG_X86_PAE
- # include <asm/pgtable-3level_types.h>
--# define PMD_SIZE (1UL << PMD_SHIFT)
-+# define PMD_SIZE (_AC(1, UL) << PMD_SHIFT)
- # define PMD_MASK (~(PMD_SIZE - 1))
- #else
- # include <asm/pgtable-2level_types.h>
-@@ -46,6 +46,19 @@ extern bool __vmalloc_start_set; /* set
- # define VMALLOC_END (FIXADDR_START - 2 * PAGE_SIZE)
- #endif
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+#ifndef __ASSEMBLY__
-+extern unsigned char MODULES_EXEC_VADDR[];
-+extern unsigned char MODULES_EXEC_END[];
-+#endif
-+#include <asm/boot.h>
-+#define ktla_ktva(addr) (addr + LOAD_PHYSICAL_ADDR + PAGE_OFFSET)
-+#define ktva_ktla(addr) (addr - LOAD_PHYSICAL_ADDR - PAGE_OFFSET)
-+#else
-+#define ktla_ktva(addr) (addr)
-+#define ktva_ktla(addr) (addr)
-+#endif
-+
- #define MODULES_VADDR VMALLOC_START
- #define MODULES_END VMALLOC_END
- #define MODULES_LEN (MODULES_VADDR - MODULES_END)
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/pgtable-3level.h linux-2.6.32.45/arch/x86/include/asm/pgtable-3level.h
---- linux-2.6.32.45/arch/x86/include/asm/pgtable-3level.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/pgtable-3level.h 2011-04-17 15:56:46.000000000 -0400
-@@ -38,12 +38,16 @@ static inline void native_set_pte_atomic
-
- static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
- {
-+ pax_open_kernel();
- set_64bit((unsigned long long *)(pmdp), native_pmd_val(pmd));
-+ pax_close_kernel();
- }
-
- static inline void native_set_pud(pud_t *pudp, pud_t pud)
- {
-+ pax_open_kernel();
- set_64bit((unsigned long long *)(pudp), native_pud_val(pud));
-+ pax_close_kernel();
- }
-
- /*
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/pgtable_64.h linux-2.6.32.45/arch/x86/include/asm/pgtable_64.h
---- linux-2.6.32.45/arch/x86/include/asm/pgtable_64.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/pgtable_64.h 2011-04-17 15:56:46.000000000 -0400
-@@ -16,10 +16,13 @@
-
- extern pud_t level3_kernel_pgt[512];
- extern pud_t level3_ident_pgt[512];
-+extern pud_t level3_vmalloc_pgt[512];
-+extern pud_t level3_vmemmap_pgt[512];
-+extern pud_t level2_vmemmap_pgt[512];
- extern pmd_t level2_kernel_pgt[512];
- extern pmd_t level2_fixmap_pgt[512];
--extern pmd_t level2_ident_pgt[512];
--extern pgd_t init_level4_pgt[];
-+extern pmd_t level2_ident_pgt[512*2];
-+extern pgd_t init_level4_pgt[512];
-
- #define swapper_pg_dir init_level4_pgt
-
-@@ -74,7 +77,9 @@ static inline pte_t native_ptep_get_and_
-
- static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
- {
-+ pax_open_kernel();
- *pmdp = pmd;
-+ pax_close_kernel();
- }
-
- static inline void native_pmd_clear(pmd_t *pmd)
-@@ -94,7 +99,9 @@ static inline void native_pud_clear(pud_
-
- static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)
- {
-+ pax_open_kernel();
- *pgdp = pgd;
-+ pax_close_kernel();
- }
-
- static inline void native_pgd_clear(pgd_t *pgd)
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/pgtable_64_types.h linux-2.6.32.45/arch/x86/include/asm/pgtable_64_types.h
---- linux-2.6.32.45/arch/x86/include/asm/pgtable_64_types.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/pgtable_64_types.h 2011-04-17 15:56:46.000000000 -0400
-@@ -59,5 +59,10 @@ typedef struct { pteval_t pte; } pte_t;
- #define MODULES_VADDR _AC(0xffffffffa0000000, UL)
- #define MODULES_END _AC(0xffffffffff000000, UL)
- #define MODULES_LEN (MODULES_END - MODULES_VADDR)
-+#define MODULES_EXEC_VADDR MODULES_VADDR
-+#define MODULES_EXEC_END MODULES_END
-+
-+#define ktla_ktva(addr) (addr)
-+#define ktva_ktla(addr) (addr)
-
- #endif /* _ASM_X86_PGTABLE_64_DEFS_H */
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/pgtable.h linux-2.6.32.45/arch/x86/include/asm/pgtable.h
---- linux-2.6.32.45/arch/x86/include/asm/pgtable.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/pgtable.h 2011-04-17 15:56:46.000000000 -0400
-@@ -74,12 +74,51 @@ extern struct list_head pgd_list;
-
- #define arch_end_context_switch(prev) do {} while(0)
-
-+#define pax_open_kernel() native_pax_open_kernel()
-+#define pax_close_kernel() native_pax_close_kernel()
- #endif /* CONFIG_PARAVIRT */
-
-+#define __HAVE_ARCH_PAX_OPEN_KERNEL
-+#define __HAVE_ARCH_PAX_CLOSE_KERNEL
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+static inline unsigned long native_pax_open_kernel(void)
-+{
-+ unsigned long cr0;
-+
-+ preempt_disable();
-+ barrier();
-+ cr0 = read_cr0() ^ X86_CR0_WP;
-+ BUG_ON(unlikely(cr0 & X86_CR0_WP));
-+ write_cr0(cr0);
-+ return cr0 ^ X86_CR0_WP;
-+}
-+
-+static inline unsigned long native_pax_close_kernel(void)
-+{
-+ unsigned long cr0;
-+
-+ cr0 = read_cr0() ^ X86_CR0_WP;
-+ BUG_ON(unlikely(!(cr0 & X86_CR0_WP)));
-+ write_cr0(cr0);
-+ barrier();
-+ preempt_enable_no_resched();
-+ return cr0 ^ X86_CR0_WP;
-+}
-+#else
-+static inline unsigned long native_pax_open_kernel(void) { return 0; }
-+static inline unsigned long native_pax_close_kernel(void) { return 0; }
-+#endif
-+
- /*
- * The following only work if pte_present() is true.
- * Undefined behaviour if not..
- */
-+static inline int pte_user(pte_t pte)
-+{
-+ return pte_val(pte) & _PAGE_USER;
-+}
-+
- static inline int pte_dirty(pte_t pte)
- {
- return pte_flags(pte) & _PAGE_DIRTY;
-@@ -167,9 +206,29 @@ static inline pte_t pte_wrprotect(pte_t
- return pte_clear_flags(pte, _PAGE_RW);
- }
-
-+static inline pte_t pte_mkread(pte_t pte)
-+{
-+ return __pte(pte_val(pte) | _PAGE_USER);
-+}
-+
- static inline pte_t pte_mkexec(pte_t pte)
- {
-- return pte_clear_flags(pte, _PAGE_NX);
-+#ifdef CONFIG_X86_PAE
-+ if (__supported_pte_mask & _PAGE_NX)
-+ return pte_clear_flags(pte, _PAGE_NX);
-+ else
-+#endif
-+ return pte_set_flags(pte, _PAGE_USER);
-+}
-+
-+static inline pte_t pte_exprotect(pte_t pte)
-+{
-+#ifdef CONFIG_X86_PAE
-+ if (__supported_pte_mask & _PAGE_NX)
-+ return pte_set_flags(pte, _PAGE_NX);
-+ else
-+#endif
-+ return pte_clear_flags(pte, _PAGE_USER);
- }
-
- static inline pte_t pte_mkdirty(pte_t pte)
-@@ -302,6 +361,15 @@ pte_t *populate_extra_pte(unsigned long
- #endif
-
- #ifndef __ASSEMBLY__
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+extern pgd_t cpu_pgd[NR_CPUS][PTRS_PER_PGD];
-+static inline pgd_t *get_cpu_pgd(unsigned int cpu)
-+{
-+ return cpu_pgd[cpu];
-+}
-+#endif
-+
- #include <linux/mm_types.h>
-
- static inline int pte_none(pte_t pte)
-@@ -472,7 +540,7 @@ static inline pud_t *pud_offset(pgd_t *p
-
- static inline int pgd_bad(pgd_t pgd)
- {
-- return (pgd_flags(pgd) & ~_PAGE_USER) != _KERNPG_TABLE;
-+ return (pgd_flags(pgd) & ~(_PAGE_USER | _PAGE_NX)) != _KERNPG_TABLE;
- }
-
- static inline int pgd_none(pgd_t pgd)
-@@ -495,7 +563,12 @@ static inline int pgd_none(pgd_t pgd)
- * pgd_offset() returns a (pgd_t *)
- * pgd_index() is used get the offset into the pgd page's array of pgd_t's;
- */
--#define pgd_offset(mm, address) ((mm)->pgd + pgd_index((address)))
-+#define pgd_offset(mm, address) ((mm)->pgd + pgd_index(address))
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+#define pgd_offset_cpu(cpu, address) (get_cpu_pgd(cpu) + pgd_index(address))
-+#endif
-+
- /*
- * a shortcut which implies the use of the kernel's pgd, instead
- * of a process's
-@@ -506,6 +579,20 @@ static inline int pgd_none(pgd_t pgd)
- #define KERNEL_PGD_BOUNDARY pgd_index(PAGE_OFFSET)
- #define KERNEL_PGD_PTRS (PTRS_PER_PGD - KERNEL_PGD_BOUNDARY)
-
-+#ifdef CONFIG_X86_32
-+#define USER_PGD_PTRS KERNEL_PGD_BOUNDARY
-+#else
-+#define TASK_SIZE_MAX_SHIFT CONFIG_TASK_SIZE_MAX_SHIFT
-+#define USER_PGD_PTRS (_AC(1,UL) << (TASK_SIZE_MAX_SHIFT - PGDIR_SHIFT))
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+#define PAX_USER_SHADOW_BASE (_AC(1,UL) << TASK_SIZE_MAX_SHIFT)
-+#else
-+#define PAX_USER_SHADOW_BASE (_AC(0,UL))
-+#endif
-+
-+#endif
-+
- #ifndef __ASSEMBLY__
-
- extern int direct_gbpages;
-@@ -611,11 +698,23 @@ static inline void ptep_set_wrprotect(st
- * dst and src can be on the same page, but the range must not overlap,
- * and must not cross a page boundary.
- */
--static inline void clone_pgd_range(pgd_t *dst, pgd_t *src, int count)
-+static inline void clone_pgd_range(pgd_t *dst, const pgd_t *src, int count)
- {
-- memcpy(dst, src, count * sizeof(pgd_t));
-+ pax_open_kernel();
-+ while (count--)
-+ *dst++ = *src++;
-+ pax_close_kernel();
- }
-
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+extern void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count);
-+#endif
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+extern void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count);
-+#else
-+static inline void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count) {}
-+#endif
-
- #include <asm-generic/pgtable.h>
- #endif /* __ASSEMBLY__ */
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/pgtable_types.h linux-2.6.32.45/arch/x86/include/asm/pgtable_types.h
---- linux-2.6.32.45/arch/x86/include/asm/pgtable_types.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/pgtable_types.h 2011-04-17 15:56:46.000000000 -0400
-@@ -16,12 +16,11 @@
- #define _PAGE_BIT_PSE 7 /* 4 MB (or 2MB) page */
- #define _PAGE_BIT_PAT 7 /* on 4KB pages */
- #define _PAGE_BIT_GLOBAL 8 /* Global TLB entry PPro+ */
--#define _PAGE_BIT_UNUSED1 9 /* available for programmer */
-+#define _PAGE_BIT_SPECIAL 9 /* special mappings, no associated struct page */
- #define _PAGE_BIT_IOMAP 10 /* flag used to indicate IO mapping */
- #define _PAGE_BIT_HIDDEN 11 /* hidden by kmemcheck */
- #define _PAGE_BIT_PAT_LARGE 12 /* On 2MB or 1GB pages */
--#define _PAGE_BIT_SPECIAL _PAGE_BIT_UNUSED1
--#define _PAGE_BIT_CPA_TEST _PAGE_BIT_UNUSED1
-+#define _PAGE_BIT_CPA_TEST _PAGE_BIT_SPECIAL
- #define _PAGE_BIT_NX 63 /* No execute: only valid after cpuid check */
-
- /* If _PAGE_BIT_PRESENT is clear, we use these: */
-@@ -39,7 +38,6 @@
- #define _PAGE_DIRTY (_AT(pteval_t, 1) << _PAGE_BIT_DIRTY)
- #define _PAGE_PSE (_AT(pteval_t, 1) << _PAGE_BIT_PSE)
- #define _PAGE_GLOBAL (_AT(pteval_t, 1) << _PAGE_BIT_GLOBAL)
--#define _PAGE_UNUSED1 (_AT(pteval_t, 1) << _PAGE_BIT_UNUSED1)
- #define _PAGE_IOMAP (_AT(pteval_t, 1) << _PAGE_BIT_IOMAP)
- #define _PAGE_PAT (_AT(pteval_t, 1) << _PAGE_BIT_PAT)
- #define _PAGE_PAT_LARGE (_AT(pteval_t, 1) << _PAGE_BIT_PAT_LARGE)
-@@ -55,8 +53,10 @@
-
- #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
- #define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_NX)
--#else
-+#elif defined(CONFIG_KMEMCHECK)
- #define _PAGE_NX (_AT(pteval_t, 0))
-+#else
-+#define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_HIDDEN)
- #endif
-
- #define _PAGE_FILE (_AT(pteval_t, 1) << _PAGE_BIT_FILE)
-@@ -93,6 +93,9 @@
- #define PAGE_READONLY_EXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | \
- _PAGE_ACCESSED)
-
-+#define PAGE_READONLY_NOEXEC PAGE_READONLY
-+#define PAGE_SHARED_NOEXEC PAGE_SHARED
-+
- #define __PAGE_KERNEL_EXEC \
- (_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_GLOBAL)
- #define __PAGE_KERNEL (__PAGE_KERNEL_EXEC | _PAGE_NX)
-@@ -103,8 +106,8 @@
- #define __PAGE_KERNEL_WC (__PAGE_KERNEL | _PAGE_CACHE_WC)
- #define __PAGE_KERNEL_NOCACHE (__PAGE_KERNEL | _PAGE_PCD | _PAGE_PWT)
- #define __PAGE_KERNEL_UC_MINUS (__PAGE_KERNEL | _PAGE_PCD)
--#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RX | _PAGE_USER)
--#define __PAGE_KERNEL_VSYSCALL_NOCACHE (__PAGE_KERNEL_VSYSCALL | _PAGE_PCD | _PAGE_PWT)
-+#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RO | _PAGE_USER)
-+#define __PAGE_KERNEL_VSYSCALL_NOCACHE (__PAGE_KERNEL_RO | _PAGE_PCD | _PAGE_PWT | _PAGE_USER)
- #define __PAGE_KERNEL_LARGE (__PAGE_KERNEL | _PAGE_PSE)
- #define __PAGE_KERNEL_LARGE_NOCACHE (__PAGE_KERNEL | _PAGE_CACHE_UC | _PAGE_PSE)
- #define __PAGE_KERNEL_LARGE_EXEC (__PAGE_KERNEL_EXEC | _PAGE_PSE)
-@@ -163,8 +166,8 @@
- * bits are combined, this will alow user to access the high address mapped
- * VDSO in the presence of CONFIG_COMPAT_VDSO
- */
--#define PTE_IDENT_ATTR 0x003 /* PRESENT+RW */
--#define PDE_IDENT_ATTR 0x067 /* PRESENT+RW+USER+DIRTY+ACCESSED */
-+#define PTE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
-+#define PDE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
- #define PGD_IDENT_ATTR 0x001 /* PRESENT (no other attributes) */
- #endif
-
-@@ -202,7 +205,17 @@ static inline pgdval_t pgd_flags(pgd_t p
- {
- return native_pgd_val(pgd) & PTE_FLAGS_MASK;
- }
-+#endif
-
-+#if PAGETABLE_LEVELS == 3
-+#include <asm-generic/pgtable-nopud.h>
-+#endif
-+
-+#if PAGETABLE_LEVELS == 2
-+#include <asm-generic/pgtable-nopmd.h>
-+#endif
-+
-+#ifndef __ASSEMBLY__
- #if PAGETABLE_LEVELS > 3
- typedef struct { pudval_t pud; } pud_t;
-
-@@ -216,8 +229,6 @@ static inline pudval_t native_pud_val(pu
- return pud.pud;
- }
- #else
--#include <asm-generic/pgtable-nopud.h>
--
- static inline pudval_t native_pud_val(pud_t pud)
- {
- return native_pgd_val(pud.pgd);
-@@ -237,8 +248,6 @@ static inline pmdval_t native_pmd_val(pm
- return pmd.pmd;
- }
- #else
--#include <asm-generic/pgtable-nopmd.h>
--
- static inline pmdval_t native_pmd_val(pmd_t pmd)
- {
- return native_pgd_val(pmd.pud.pgd);
-@@ -278,7 +287,16 @@ typedef struct page *pgtable_t;
-
- extern pteval_t __supported_pte_mask;
- extern void set_nx(void);
-+
-+#ifdef CONFIG_X86_32
-+#ifdef CONFIG_X86_PAE
- extern int nx_enabled;
-+#else
-+#define nx_enabled (0)
-+#endif
-+#else
-+#define nx_enabled (1)
-+#endif
-
- #define pgprot_writecombine pgprot_writecombine
- extern pgprot_t pgprot_writecombine(pgprot_t prot);
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/processor.h linux-2.6.32.45/arch/x86/include/asm/processor.h
---- linux-2.6.32.45/arch/x86/include/asm/processor.h 2011-04-22 19:16:29.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/processor.h 2011-05-11 18:25:15.000000000 -0400
-@@ -272,7 +272,7 @@ struct tss_struct {
-
- } ____cacheline_aligned;
-
--DECLARE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss);
-+extern struct tss_struct init_tss[NR_CPUS];
-
- /*
- * Save the original ist values for checking stack pointers during debugging
-@@ -888,11 +888,18 @@ static inline void spin_lock_prefetch(co
- */
- #define TASK_SIZE PAGE_OFFSET
- #define TASK_SIZE_MAX TASK_SIZE
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+#define SEGMEXEC_TASK_SIZE (TASK_SIZE / 2)
-+#define STACK_TOP ((current->mm->pax_flags & MF_PAX_SEGMEXEC)?SEGMEXEC_TASK_SIZE:TASK_SIZE)
-+#else
- #define STACK_TOP TASK_SIZE
--#define STACK_TOP_MAX STACK_TOP
-+#endif
-+
-+#define STACK_TOP_MAX TASK_SIZE
-
- #define INIT_THREAD { \
-- .sp0 = sizeof(init_stack) + (long)&init_stack, \
-+ .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
- .vm86_info = NULL, \
- .sysenter_cs = __KERNEL_CS, \
- .io_bitmap_ptr = NULL, \
-@@ -906,7 +913,7 @@ static inline void spin_lock_prefetch(co
- */
- #define INIT_TSS { \
- .x86_tss = { \
-- .sp0 = sizeof(init_stack) + (long)&init_stack, \
-+ .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
- .ss0 = __KERNEL_DS, \
- .ss1 = __KERNEL_CS, \
- .io_bitmap_base = INVALID_IO_BITMAP_OFFSET, \
-@@ -917,11 +924,7 @@ static inline void spin_lock_prefetch(co
- extern unsigned long thread_saved_pc(struct task_struct *tsk);
-
- #define THREAD_SIZE_LONGS (THREAD_SIZE/sizeof(unsigned long))
--#define KSTK_TOP(info) \
--({ \
-- unsigned long *__ptr = (unsigned long *)(info); \
-- (unsigned long)(&__ptr[THREAD_SIZE_LONGS]); \
--})
-+#define KSTK_TOP(info) ((container_of(info, struct task_struct, tinfo))->thread.sp0)
-
- /*
- * The below -8 is to reserve 8 bytes on top of the ring0 stack.
-@@ -936,7 +939,7 @@ extern unsigned long thread_saved_pc(str
- #define task_pt_regs(task) \
- ({ \
- struct pt_regs *__regs__; \
-- __regs__ = (struct pt_regs *)(KSTK_TOP(task_stack_page(task))-8); \
-+ __regs__ = (struct pt_regs *)((task)->thread.sp0); \
- __regs__ - 1; \
- })
-
-@@ -946,13 +949,13 @@ extern unsigned long thread_saved_pc(str
- /*
- * User space process size. 47bits minus one guard page.
- */
--#define TASK_SIZE_MAX ((1UL << 47) - PAGE_SIZE)
-+#define TASK_SIZE_MAX ((1UL << TASK_SIZE_MAX_SHIFT) - PAGE_SIZE)
-
- /* This decides where the kernel will search for a free chunk of vm
- * space during mmap's.
- */
- #define IA32_PAGE_OFFSET ((current->personality & ADDR_LIMIT_3GB) ? \
-- 0xc0000000 : 0xFFFFe000)
-+ 0xc0000000 : 0xFFFFf000)
-
- #define TASK_SIZE (test_thread_flag(TIF_IA32) ? \
- IA32_PAGE_OFFSET : TASK_SIZE_MAX)
-@@ -963,11 +966,11 @@ extern unsigned long thread_saved_pc(str
- #define STACK_TOP_MAX TASK_SIZE_MAX
-
- #define INIT_THREAD { \
-- .sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
-+ .sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
- }
-
- #define INIT_TSS { \
-- .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
-+ .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
- }
-
- /*
-@@ -989,6 +992,10 @@ extern void start_thread(struct pt_regs
- */
- #define TASK_UNMAPPED_BASE (PAGE_ALIGN(TASK_SIZE / 3))
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+#define SEGMEXEC_TASK_UNMAPPED_BASE (PAGE_ALIGN(SEGMEXEC_TASK_SIZE / 3))
-+#endif
-+
- #define KSTK_EIP(task) (task_pt_regs(task)->ip)
-
- /* Get/set a process' ability to use the timestamp counter instruction */
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/ptrace.h linux-2.6.32.45/arch/x86/include/asm/ptrace.h
---- linux-2.6.32.45/arch/x86/include/asm/ptrace.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/ptrace.h 2011-04-17 15:56:46.000000000 -0400
-@@ -151,28 +151,29 @@ static inline unsigned long regs_return_
- }
-
- /*
-- * user_mode_vm(regs) determines whether a register set came from user mode.
-+ * user_mode(regs) determines whether a register set came from user mode.
- * This is true if V8086 mode was enabled OR if the register set was from
- * protected mode with RPL-3 CS value. This tricky test checks that with
- * one comparison. Many places in the kernel can bypass this full check
-- * if they have already ruled out V8086 mode, so user_mode(regs) can be used.
-+ * if they have already ruled out V8086 mode, so user_mode_novm(regs) can
-+ * be used.
- */
--static inline int user_mode(struct pt_regs *regs)
-+static inline int user_mode_novm(struct pt_regs *regs)
- {
- #ifdef CONFIG_X86_32
- return (regs->cs & SEGMENT_RPL_MASK) == USER_RPL;
- #else
-- return !!(regs->cs & 3);
-+ return !!(regs->cs & SEGMENT_RPL_MASK);
- #endif
- }
-
--static inline int user_mode_vm(struct pt_regs *regs)
-+static inline int user_mode(struct pt_regs *regs)
- {
- #ifdef CONFIG_X86_32
- return ((regs->cs & SEGMENT_RPL_MASK) | (regs->flags & X86_VM_MASK)) >=
- USER_RPL;
- #else
-- return user_mode(regs);
-+ return user_mode_novm(regs);
- #endif
- }
-
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/reboot.h linux-2.6.32.45/arch/x86/include/asm/reboot.h
---- linux-2.6.32.45/arch/x86/include/asm/reboot.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/reboot.h 2011-08-05 20:33:55.000000000 -0400
-@@ -6,19 +6,19 @@
- struct pt_regs;
-
- struct machine_ops {
-- void (*restart)(char *cmd);
-- void (*halt)(void);
-- void (*power_off)(void);
-+ void (* __noreturn restart)(char *cmd);
-+ void (* __noreturn halt)(void);
-+ void (* __noreturn power_off)(void);
- void (*shutdown)(void);
- void (*crash_shutdown)(struct pt_regs *);
-- void (*emergency_restart)(void);
--};
-+ void (* __noreturn emergency_restart)(void);
-+} __no_const;
-
- extern struct machine_ops machine_ops;
-
- void native_machine_crash_shutdown(struct pt_regs *regs);
- void native_machine_shutdown(void);
--void machine_real_restart(const unsigned char *code, int length);
-+void machine_real_restart(const unsigned char *code, unsigned int length) __noreturn;
-
- typedef void (*nmi_shootdown_cb)(int, struct die_args*);
- void nmi_shootdown_cpus(nmi_shootdown_cb callback);
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/rwsem.h linux-2.6.32.45/arch/x86/include/asm/rwsem.h
---- linux-2.6.32.45/arch/x86/include/asm/rwsem.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/rwsem.h 2011-04-17 15:56:46.000000000 -0400
-@@ -118,6 +118,14 @@ static inline void __down_read(struct rw
- {
- asm volatile("# beginning down_read\n\t"
- LOCK_PREFIX _ASM_INC "(%1)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX _ASM_DEC "(%1)\n\t"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- /* adds 0x00000001, returns the old value */
- " jns 1f\n"
- " call call_rwsem_down_read_failed\n"
-@@ -139,6 +147,14 @@ static inline int __down_read_trylock(st
- "1:\n\t"
- " mov %1,%2\n\t"
- " add %3,%2\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ "sub %3,%2\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- " jle 2f\n\t"
- LOCK_PREFIX " cmpxchg %2,%0\n\t"
- " jnz 1b\n\t"
-@@ -160,6 +176,14 @@ static inline void __down_write_nested(s
- tmp = RWSEM_ACTIVE_WRITE_BIAS;
- asm volatile("# beginning down_write\n\t"
- LOCK_PREFIX " xadd %1,(%2)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ "mov %1,(%2)\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- /* subtract 0x0000ffff, returns the old value */
- " test %1,%1\n\t"
- /* was the count 0 before? */
-@@ -198,6 +222,14 @@ static inline void __up_read(struct rw_s
- rwsem_count_t tmp = -RWSEM_ACTIVE_READ_BIAS;
- asm volatile("# beginning __up_read\n\t"
- LOCK_PREFIX " xadd %1,(%2)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ "mov %1,(%2)\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- /* subtracts 1, returns the old value */
- " jns 1f\n\t"
- " call call_rwsem_wake\n"
-@@ -216,6 +248,14 @@ static inline void __up_write(struct rw_
- rwsem_count_t tmp;
- asm volatile("# beginning __up_write\n\t"
- LOCK_PREFIX " xadd %1,(%2)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ "mov %1,(%2)\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- /* tries to transition
- 0xffff0001 -> 0x00000000 */
- " jz 1f\n"
-@@ -234,6 +274,14 @@ static inline void __downgrade_write(str
- {
- asm volatile("# beginning __downgrade_write\n\t"
- LOCK_PREFIX _ASM_ADD "%2,(%1)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX _ASM_SUB "%2,(%1)\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- /*
- * transitions 0xZZZZ0001 -> 0xYYYY0001 (i386)
- * 0xZZZZZZZZ00000001 -> 0xYYYYYYYY00000001 (x86_64)
-@@ -253,7 +301,15 @@ static inline void __downgrade_write(str
- static inline void rwsem_atomic_add(rwsem_count_t delta,
- struct rw_semaphore *sem)
- {
-- asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0"
-+ asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX _ASM_SUB "%1,%0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- : "+m" (sem->count)
- : "er" (delta));
- }
-@@ -266,7 +322,15 @@ static inline rwsem_count_t rwsem_atomic
- {
- rwsem_count_t tmp = delta;
-
-- asm volatile(LOCK_PREFIX "xadd %0,%1"
-+ asm volatile(LOCK_PREFIX "xadd %0,%1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ "mov %0,%1\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- : "+r" (tmp), "+m" (sem->count)
- : : "memory");
-
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/segment.h linux-2.6.32.45/arch/x86/include/asm/segment.h
---- linux-2.6.32.45/arch/x86/include/asm/segment.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/segment.h 2011-04-17 15:56:46.000000000 -0400
-@@ -62,8 +62,8 @@
- * 26 - ESPFIX small SS
- * 27 - per-cpu [ offset to per-cpu data area ]
- * 28 - stack_canary-20 [ for stack protector ]
-- * 29 - unused
-- * 30 - unused
-+ * 29 - PCI BIOS CS
-+ * 30 - PCI BIOS DS
- * 31 - TSS for double fault handler
- */
- #define GDT_ENTRY_TLS_MIN 6
-@@ -77,6 +77,8 @@
-
- #define GDT_ENTRY_KERNEL_CS (GDT_ENTRY_KERNEL_BASE + 0)
-
-+#define GDT_ENTRY_KERNEXEC_KERNEL_CS (4)
-+
- #define GDT_ENTRY_KERNEL_DS (GDT_ENTRY_KERNEL_BASE + 1)
-
- #define GDT_ENTRY_TSS (GDT_ENTRY_KERNEL_BASE + 4)
-@@ -88,7 +90,7 @@
- #define GDT_ENTRY_ESPFIX_SS (GDT_ENTRY_KERNEL_BASE + 14)
- #define __ESPFIX_SS (GDT_ENTRY_ESPFIX_SS * 8)
-
--#define GDT_ENTRY_PERCPU (GDT_ENTRY_KERNEL_BASE + 15)
-+#define GDT_ENTRY_PERCPU (GDT_ENTRY_KERNEL_BASE + 15)
- #ifdef CONFIG_SMP
- #define __KERNEL_PERCPU (GDT_ENTRY_PERCPU * 8)
- #else
-@@ -102,6 +104,12 @@
- #define __KERNEL_STACK_CANARY 0
- #endif
-
-+#define GDT_ENTRY_PCIBIOS_CS (GDT_ENTRY_KERNEL_BASE + 17)
-+#define __PCIBIOS_CS (GDT_ENTRY_PCIBIOS_CS * 8)
-+
-+#define GDT_ENTRY_PCIBIOS_DS (GDT_ENTRY_KERNEL_BASE + 18)
-+#define __PCIBIOS_DS (GDT_ENTRY_PCIBIOS_DS * 8)
-+
- #define GDT_ENTRY_DOUBLEFAULT_TSS 31
-
- /*
-@@ -139,7 +147,7 @@
- */
-
- /* Matches PNP_CS32 and PNP_CS16 (they must be consecutive) */
--#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xf4) == GDT_ENTRY_PNPBIOS_BASE * 8)
-+#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xFFFCU) == PNP_CS32 || ((x) & 0xFFFCU) == PNP_CS16)
-
-
- #else
-@@ -163,6 +171,8 @@
- #define __USER32_CS (GDT_ENTRY_DEFAULT_USER32_CS * 8 + 3)
- #define __USER32_DS __USER_DS
-
-+#define GDT_ENTRY_KERNEXEC_KERNEL_CS 7
-+
- #define GDT_ENTRY_TSS 8 /* needs two entries */
- #define GDT_ENTRY_LDT 10 /* needs two entries */
- #define GDT_ENTRY_TLS_MIN 12
-@@ -183,6 +193,7 @@
- #endif
-
- #define __KERNEL_CS (GDT_ENTRY_KERNEL_CS * 8)
-+#define __KERNEXEC_KERNEL_CS (GDT_ENTRY_KERNEXEC_KERNEL_CS * 8)
- #define __KERNEL_DS (GDT_ENTRY_KERNEL_DS * 8)
- #define __USER_DS (GDT_ENTRY_DEFAULT_USER_DS* 8 + 3)
- #define __USER_CS (GDT_ENTRY_DEFAULT_USER_CS* 8 + 3)
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/smp.h linux-2.6.32.45/arch/x86/include/asm/smp.h
---- linux-2.6.32.45/arch/x86/include/asm/smp.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/smp.h 2011-08-05 20:33:55.000000000 -0400
-@@ -24,7 +24,7 @@ extern unsigned int num_processors;
- DECLARE_PER_CPU(cpumask_var_t, cpu_sibling_map);
- DECLARE_PER_CPU(cpumask_var_t, cpu_core_map);
- DECLARE_PER_CPU(u16, cpu_llc_id);
--DECLARE_PER_CPU(int, cpu_number);
-+DECLARE_PER_CPU(unsigned int, cpu_number);
-
- static inline struct cpumask *cpu_sibling_mask(int cpu)
- {
-@@ -40,10 +40,7 @@ DECLARE_EARLY_PER_CPU(u16, x86_cpu_to_ap
- DECLARE_EARLY_PER_CPU(u16, x86_bios_cpu_apicid);
-
- /* Static state in head.S used to set up a CPU */
--extern struct {
-- void *sp;
-- unsigned short ss;
--} stack_start;
-+extern unsigned long stack_start; /* Initial stack pointer address */
-
- struct smp_ops {
- void (*smp_prepare_boot_cpu)(void);
-@@ -60,7 +57,7 @@ struct smp_ops {
-
- void (*send_call_func_ipi)(const struct cpumask *mask);
- void (*send_call_func_single_ipi)(int cpu);
--};
-+} __no_const;
-
- /* Globals due to paravirt */
- extern void set_cpu_sibling_map(int cpu);
-@@ -175,14 +172,8 @@ extern unsigned disabled_cpus __cpuinitd
- extern int safe_smp_processor_id(void);
-
- #elif defined(CONFIG_X86_64_SMP)
--#define raw_smp_processor_id() (percpu_read(cpu_number))
--
--#define stack_smp_processor_id() \
--({ \
-- struct thread_info *ti; \
-- __asm__("andq %%rsp,%0; ":"=r" (ti) : "0" (CURRENT_MASK)); \
-- ti->cpu; \
--})
-+#define raw_smp_processor_id() (percpu_read(cpu_number))
-+#define stack_smp_processor_id() raw_smp_processor_id()
- #define safe_smp_processor_id() smp_processor_id()
-
- #endif
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/spinlock.h linux-2.6.32.45/arch/x86/include/asm/spinlock.h
---- linux-2.6.32.45/arch/x86/include/asm/spinlock.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/spinlock.h 2011-04-17 15:56:46.000000000 -0400
-@@ -249,6 +249,14 @@ static inline int __raw_write_can_lock(r
- static inline void __raw_read_lock(raw_rwlock_t *rw)
- {
- asm volatile(LOCK_PREFIX " subl $1,(%0)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX " addl $1,(%0)\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- "jns 1f\n"
- "call __read_lock_failed\n\t"
- "1:\n"
-@@ -258,6 +266,14 @@ static inline void __raw_read_lock(raw_r
- static inline void __raw_write_lock(raw_rwlock_t *rw)
- {
- asm volatile(LOCK_PREFIX " subl %1,(%0)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX " addl %1,(%0)\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- "jz 1f\n"
- "call __write_lock_failed\n\t"
- "1:\n"
-@@ -286,12 +302,29 @@ static inline int __raw_write_trylock(ra
-
- static inline void __raw_read_unlock(raw_rwlock_t *rw)
- {
-- asm volatile(LOCK_PREFIX "incl %0" :"+m" (rw->lock) : : "memory");
-+ asm volatile(LOCK_PREFIX "incl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "decl %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+ :"+m" (rw->lock) : : "memory");
- }
-
- static inline void __raw_write_unlock(raw_rwlock_t *rw)
- {
-- asm volatile(LOCK_PREFIX "addl %1, %0"
-+ asm volatile(LOCK_PREFIX "addl %1, %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ "jno 0f\n"
-+ LOCK_PREFIX "subl %1, %0\n"
-+ "int $4\n0:\n"
-+ _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- : "+m" (rw->lock) : "i" (RW_LOCK_BIAS) : "memory");
- }
-
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/stackprotector.h linux-2.6.32.45/arch/x86/include/asm/stackprotector.h
---- linux-2.6.32.45/arch/x86/include/asm/stackprotector.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/stackprotector.h 2011-07-06 19:53:33.000000000 -0400
-@@ -48,7 +48,7 @@
- * head_32 for boot CPU and setup_per_cpu_areas() for others.
- */
- #define GDT_STACK_CANARY_INIT \
-- [GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x18),
-+ [GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x17),
-
- /*
- * Initialize the stackprotector canary value.
-@@ -113,7 +113,7 @@ static inline void setup_stack_canary_se
-
- static inline void load_stack_canary_segment(void)
- {
--#ifdef CONFIG_X86_32
-+#if defined(CONFIG_X86_32) && !defined(CONFIG_PAX_MEMORY_UDEREF)
- asm volatile ("mov %0, %%gs" : : "r" (0));
- #endif
- }
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/system.h linux-2.6.32.45/arch/x86/include/asm/system.h
---- linux-2.6.32.45/arch/x86/include/asm/system.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/system.h 2011-05-22 23:02:03.000000000 -0400
-@@ -132,7 +132,7 @@ do { \
- "thread_return:\n\t" \
- "movq "__percpu_arg([current_task])",%%rsi\n\t" \
- __switch_canary \
-- "movq %P[thread_info](%%rsi),%%r8\n\t" \
-+ "movq "__percpu_arg([thread_info])",%%r8\n\t" \
- "movq %%rax,%%rdi\n\t" \
- "testl %[_tif_fork],%P[ti_flags](%%r8)\n\t" \
- "jnz ret_from_fork\n\t" \
-@@ -143,7 +143,7 @@ do { \
- [threadrsp] "i" (offsetof(struct task_struct, thread.sp)), \
- [ti_flags] "i" (offsetof(struct thread_info, flags)), \
- [_tif_fork] "i" (_TIF_FORK), \
-- [thread_info] "i" (offsetof(struct task_struct, stack)), \
-+ [thread_info] "m" (per_cpu_var(current_tinfo)), \
- [current_task] "m" (per_cpu_var(current_task)) \
- __switch_canary_iparam \
- : "memory", "cc" __EXTRA_CLOBBER)
-@@ -200,7 +200,7 @@ static inline unsigned long get_limit(un
- {
- unsigned long __limit;
- asm("lsll %1,%0" : "=r" (__limit) : "r" (segment));
-- return __limit + 1;
-+ return __limit;
- }
-
- static inline void native_clts(void)
-@@ -340,12 +340,12 @@ void enable_hlt(void);
-
- void cpu_idle_wait(void);
-
--extern unsigned long arch_align_stack(unsigned long sp);
-+#define arch_align_stack(x) ((x) & ~0xfUL)
- extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
-
- void default_idle(void);
-
--void stop_this_cpu(void *dummy);
-+void stop_this_cpu(void *dummy) __noreturn;
-
- /*
- * Force strict CPU ordering.
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/thread_info.h linux-2.6.32.45/arch/x86/include/asm/thread_info.h
---- linux-2.6.32.45/arch/x86/include/asm/thread_info.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/thread_info.h 2011-05-17 19:26:34.000000000 -0400
-@@ -10,6 +10,7 @@
- #include <linux/compiler.h>
- #include <asm/page.h>
- #include <asm/types.h>
-+#include <asm/percpu.h>
-
- /*
- * low level task data that entry.S needs immediate access to
-@@ -24,7 +25,6 @@ struct exec_domain;
- #include <asm/atomic.h>
-
- struct thread_info {
-- struct task_struct *task; /* main task structure */
- struct exec_domain *exec_domain; /* execution domain */
- __u32 flags; /* low level flags */
- __u32 status; /* thread synchronous flags */
-@@ -34,18 +34,12 @@ struct thread_info {
- mm_segment_t addr_limit;
- struct restart_block restart_block;
- void __user *sysenter_return;
--#ifdef CONFIG_X86_32
-- unsigned long previous_esp; /* ESP of the previous stack in
-- case of nested (IRQ) stacks
-- */
-- __u8 supervisor_stack[0];
--#endif
-+ unsigned long lowest_stack;
- int uaccess_err;
- };
-
--#define INIT_THREAD_INFO(tsk) \
-+#define INIT_THREAD_INFO \
- { \
-- .task = &tsk, \
- .exec_domain = &default_exec_domain, \
- .flags = 0, \
- .cpu = 0, \
-@@ -56,7 +50,7 @@ struct thread_info {
- }, \
- }
-
--#define init_thread_info (init_thread_union.thread_info)
-+#define init_thread_info (init_thread_union.stack)
- #define init_stack (init_thread_union.stack)
-
- #else /* !__ASSEMBLY__ */
-@@ -163,6 +157,23 @@ struct thread_info {
- #define alloc_thread_info(tsk) \
- ((struct thread_info *)__get_free_pages(THREAD_FLAGS, THREAD_ORDER))
-
-+#ifdef __ASSEMBLY__
-+/* how to get the thread information struct from ASM */
-+#define GET_THREAD_INFO(reg) \
-+ mov PER_CPU_VAR(current_tinfo), reg
-+
-+/* use this one if reg already contains %esp */
-+#define GET_THREAD_INFO_WITH_ESP(reg) GET_THREAD_INFO(reg)
-+#else
-+/* how to get the thread information struct from C */
-+DECLARE_PER_CPU(struct thread_info *, current_tinfo);
-+
-+static __always_inline struct thread_info *current_thread_info(void)
-+{
-+ return percpu_read_stable(current_tinfo);
-+}
-+#endif
-+
- #ifdef CONFIG_X86_32
-
- #define STACK_WARN (THREAD_SIZE/8)
-@@ -173,35 +184,13 @@ struct thread_info {
- */
- #ifndef __ASSEMBLY__
-
--
- /* how to get the current stack pointer from C */
- register unsigned long current_stack_pointer asm("esp") __used;
-
--/* how to get the thread information struct from C */
--static inline struct thread_info *current_thread_info(void)
--{
-- return (struct thread_info *)
-- (current_stack_pointer & ~(THREAD_SIZE - 1));
--}
--
--#else /* !__ASSEMBLY__ */
--
--/* how to get the thread information struct from ASM */
--#define GET_THREAD_INFO(reg) \
-- movl $-THREAD_SIZE, reg; \
-- andl %esp, reg
--
--/* use this one if reg already contains %esp */
--#define GET_THREAD_INFO_WITH_ESP(reg) \
-- andl $-THREAD_SIZE, reg
--
- #endif
-
- #else /* X86_32 */
-
--#include <asm/percpu.h>
--#define KERNEL_STACK_OFFSET (5*8)
--
- /*
- * macros/functions for gaining access to the thread information structure
- * preempt_count needs to be 1 initially, until the scheduler is functional.
-@@ -209,21 +198,8 @@ static inline struct thread_info *curren
- #ifndef __ASSEMBLY__
- DECLARE_PER_CPU(unsigned long, kernel_stack);
-
--static inline struct thread_info *current_thread_info(void)
--{
-- struct thread_info *ti;
-- ti = (void *)(percpu_read_stable(kernel_stack) +
-- KERNEL_STACK_OFFSET - THREAD_SIZE);
-- return ti;
--}
--
--#else /* !__ASSEMBLY__ */
--
--/* how to get the thread information struct from ASM */
--#define GET_THREAD_INFO(reg) \
-- movq PER_CPU_VAR(kernel_stack),reg ; \
-- subq $(THREAD_SIZE-KERNEL_STACK_OFFSET),reg
--
-+/* how to get the current stack pointer from C */
-+register unsigned long current_stack_pointer asm("rsp") __used;
- #endif
-
- #endif /* !X86_32 */
-@@ -260,5 +236,16 @@ extern void arch_task_cache_init(void);
- extern void free_thread_info(struct thread_info *ti);
- extern int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src);
- #define arch_task_cache_init arch_task_cache_init
-+
-+#define __HAVE_THREAD_FUNCTIONS
-+#define task_thread_info(task) (&(task)->tinfo)
-+#define task_stack_page(task) ((task)->stack)
-+#define setup_thread_stack(p, org) do {} while (0)
-+#define end_of_stack(p) ((unsigned long *)task_stack_page(p) + 1)
-+
-+#define __HAVE_ARCH_TASK_STRUCT_ALLOCATOR
-+extern struct task_struct *alloc_task_struct(void);
-+extern void free_task_struct(struct task_struct *);
-+
- #endif
- #endif /* _ASM_X86_THREAD_INFO_H */
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/uaccess_32.h linux-2.6.32.45/arch/x86/include/asm/uaccess_32.h
---- linux-2.6.32.45/arch/x86/include/asm/uaccess_32.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/uaccess_32.h 2011-05-16 21:46:57.000000000 -0400
-@@ -44,6 +44,11 @@ unsigned long __must_check __copy_from_u
- static __always_inline unsigned long __must_check
- __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
- {
-+ pax_track_stack();
-+
-+ if ((long)n < 0)
-+ return n;
-+
- if (__builtin_constant_p(n)) {
- unsigned long ret;
-
-@@ -62,6 +67,8 @@ __copy_to_user_inatomic(void __user *to,
- return ret;
- }
- }
-+ if (!__builtin_constant_p(n))
-+ check_object_size(from, n, true);
- return __copy_to_user_ll(to, from, n);
- }
-
-@@ -83,12 +90,16 @@ static __always_inline unsigned long __m
- __copy_to_user(void __user *to, const void *from, unsigned long n)
- {
- might_fault();
-+
- return __copy_to_user_inatomic(to, from, n);
- }
-
- static __always_inline unsigned long
- __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
- {
-+ if ((long)n < 0)
-+ return n;
-+
- /* Avoid zeroing the tail if the copy fails..
- * If 'n' is constant and 1, 2, or 4, we do still zero on a failure,
- * but as the zeroing behaviour is only significant when n is not
-@@ -138,6 +149,12 @@ static __always_inline unsigned long
- __copy_from_user(void *to, const void __user *from, unsigned long n)
- {
- might_fault();
-+
-+ pax_track_stack();
-+
-+ if ((long)n < 0)
-+ return n;
-+
- if (__builtin_constant_p(n)) {
- unsigned long ret;
-
-@@ -153,6 +170,8 @@ __copy_from_user(void *to, const void __
- return ret;
- }
- }
-+ if (!__builtin_constant_p(n))
-+ check_object_size(to, n, false);
- return __copy_from_user_ll(to, from, n);
- }
-
-@@ -160,6 +179,10 @@ static __always_inline unsigned long __c
- const void __user *from, unsigned long n)
- {
- might_fault();
-+
-+ if ((long)n < 0)
-+ return n;
-+
- if (__builtin_constant_p(n)) {
- unsigned long ret;
-
-@@ -182,14 +205,62 @@ static __always_inline unsigned long
- __copy_from_user_inatomic_nocache(void *to, const void __user *from,
- unsigned long n)
- {
-- return __copy_from_user_ll_nocache_nozero(to, from, n);
-+ if ((long)n < 0)
-+ return n;
-+
-+ return __copy_from_user_ll_nocache_nozero(to, from, n);
-+}
-+
-+/**
-+ * copy_to_user: - Copy a block of data into user space.
-+ * @to: Destination address, in user space.
-+ * @from: Source address, in kernel space.
-+ * @n: Number of bytes to copy.
-+ *
-+ * Context: User context only. This function may sleep.
-+ *
-+ * Copy data from kernel space to user space.
-+ *
-+ * Returns number of bytes that could not be copied.
-+ * On success, this will be zero.
-+ */
-+static __always_inline unsigned long __must_check
-+copy_to_user(void __user *to, const void *from, unsigned long n)
-+{
-+ if (access_ok(VERIFY_WRITE, to, n))
-+ n = __copy_to_user(to, from, n);
-+ return n;
-+}
-+
-+/**
-+ * copy_from_user: - Copy a block of data from user space.
-+ * @to: Destination address, in kernel space.
-+ * @from: Source address, in user space.
-+ * @n: Number of bytes to copy.
-+ *
-+ * Context: User context only. This function may sleep.
-+ *
-+ * Copy data from user space to kernel space.
-+ *
-+ * Returns number of bytes that could not be copied.
-+ * On success, this will be zero.
-+ *
-+ * If some data could not be copied, this function will pad the copied
-+ * data to the requested size using zero bytes.
-+ */
-+static __always_inline unsigned long __must_check
-+copy_from_user(void *to, const void __user *from, unsigned long n)
-+{
-+ if (access_ok(VERIFY_READ, from, n))
-+ n = __copy_from_user(to, from, n);
-+ else if ((long)n > 0) {
-+ if (!__builtin_constant_p(n))
-+ check_object_size(to, n, false);
-+ memset(to, 0, n);
-+ }
-+ return n;
- }
-
--unsigned long __must_check copy_to_user(void __user *to,
-- const void *from, unsigned long n);
--unsigned long __must_check copy_from_user(void *to,
-- const void __user *from,
-- unsigned long n);
- long __must_check strncpy_from_user(char *dst, const char __user *src,
- long count);
- long __must_check __strncpy_from_user(char *dst,
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/uaccess_64.h linux-2.6.32.45/arch/x86/include/asm/uaccess_64.h
---- linux-2.6.32.45/arch/x86/include/asm/uaccess_64.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/uaccess_64.h 2011-05-16 21:46:57.000000000 -0400
-@@ -9,6 +9,9 @@
- #include <linux/prefetch.h>
- #include <linux/lockdep.h>
- #include <asm/page.h>
-+#include <asm/pgtable.h>
-+
-+#define set_fs(x) (current_thread_info()->addr_limit = (x))
-
- /*
- * Copy To/From Userspace
-@@ -19,113 +22,203 @@ __must_check unsigned long
- copy_user_generic(void *to, const void *from, unsigned len);
-
- __must_check unsigned long
--copy_to_user(void __user *to, const void *from, unsigned len);
--__must_check unsigned long
--copy_from_user(void *to, const void __user *from, unsigned len);
--__must_check unsigned long
- copy_in_user(void __user *to, const void __user *from, unsigned len);
-
- static __always_inline __must_check
--int __copy_from_user(void *dst, const void __user *src, unsigned size)
-+unsigned long __copy_from_user(void *dst, const void __user *src, unsigned size)
- {
-- int ret = 0;
-+ unsigned ret = 0;
-
- might_fault();
-- if (!__builtin_constant_p(size))
-- return copy_user_generic(dst, (__force void *)src, size);
-+
-+ if ((int)size < 0)
-+ return size;
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ if (!__access_ok(VERIFY_READ, src, size))
-+ return size;
-+#endif
-+
-+ if (!__builtin_constant_p(size)) {
-+ check_object_size(dst, size, false);
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
-+ src += PAX_USER_SHADOW_BASE;
-+#endif
-+
-+ return copy_user_generic(dst, (__force const void *)src, size);
-+ }
- switch (size) {
-- case 1:__get_user_asm(*(u8 *)dst, (u8 __user *)src,
-+ case 1:__get_user_asm(*(u8 *)dst, (const u8 __user *)src,
- ret, "b", "b", "=q", 1);
- return ret;
-- case 2:__get_user_asm(*(u16 *)dst, (u16 __user *)src,
-+ case 2:__get_user_asm(*(u16 *)dst, (const u16 __user *)src,
- ret, "w", "w", "=r", 2);
- return ret;
-- case 4:__get_user_asm(*(u32 *)dst, (u32 __user *)src,
-+ case 4:__get_user_asm(*(u32 *)dst, (const u32 __user *)src,
- ret, "l", "k", "=r", 4);
- return ret;
-- case 8:__get_user_asm(*(u64 *)dst, (u64 __user *)src,
-+ case 8:__get_user_asm(*(u64 *)dst, (const u64 __user *)src,
- ret, "q", "", "=r", 8);
- return ret;
- case 10:
-- __get_user_asm(*(u64 *)dst, (u64 __user *)src,
-+ __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
- ret, "q", "", "=r", 10);
- if (unlikely(ret))
- return ret;
- __get_user_asm(*(u16 *)(8 + (char *)dst),
-- (u16 __user *)(8 + (char __user *)src),
-+ (const u16 __user *)(8 + (const char __user *)src),
- ret, "w", "w", "=r", 2);
- return ret;
- case 16:
-- __get_user_asm(*(u64 *)dst, (u64 __user *)src,
-+ __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
- ret, "q", "", "=r", 16);
- if (unlikely(ret))
- return ret;
- __get_user_asm(*(u64 *)(8 + (char *)dst),
-- (u64 __user *)(8 + (char __user *)src),
-+ (const u64 __user *)(8 + (const char __user *)src),
- ret, "q", "", "=r", 8);
- return ret;
- default:
-- return copy_user_generic(dst, (__force void *)src, size);
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
-+ src += PAX_USER_SHADOW_BASE;
-+#endif
-+
-+ return copy_user_generic(dst, (__force const void *)src, size);
- }
- }
-
- static __always_inline __must_check
--int __copy_to_user(void __user *dst, const void *src, unsigned size)
-+unsigned long __copy_to_user(void __user *dst, const void *src, unsigned size)
- {
-- int ret = 0;
-+ unsigned ret = 0;
-
- might_fault();
-- if (!__builtin_constant_p(size))
-+
-+ pax_track_stack();
-+
-+ if ((int)size < 0)
-+ return size;
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ if (!__access_ok(VERIFY_WRITE, dst, size))
-+ return size;
-+#endif
-+
-+ if (!__builtin_constant_p(size)) {
-+ check_object_size(src, size, true);
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
-+ dst += PAX_USER_SHADOW_BASE;
-+#endif
-+
- return copy_user_generic((__force void *)dst, src, size);
-+ }
- switch (size) {
-- case 1:__put_user_asm(*(u8 *)src, (u8 __user *)dst,
-+ case 1:__put_user_asm(*(const u8 *)src, (u8 __user *)dst,
- ret, "b", "b", "iq", 1);
- return ret;
-- case 2:__put_user_asm(*(u16 *)src, (u16 __user *)dst,
-+ case 2:__put_user_asm(*(const u16 *)src, (u16 __user *)dst,
- ret, "w", "w", "ir", 2);
- return ret;
-- case 4:__put_user_asm(*(u32 *)src, (u32 __user *)dst,
-+ case 4:__put_user_asm(*(const u32 *)src, (u32 __user *)dst,
- ret, "l", "k", "ir", 4);
- return ret;
-- case 8:__put_user_asm(*(u64 *)src, (u64 __user *)dst,
-+ case 8:__put_user_asm(*(const u64 *)src, (u64 __user *)dst,
- ret, "q", "", "er", 8);
- return ret;
- case 10:
-- __put_user_asm(*(u64 *)src, (u64 __user *)dst,
-+ __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
- ret, "q", "", "er", 10);
- if (unlikely(ret))
- return ret;
- asm("":::"memory");
-- __put_user_asm(4[(u16 *)src], 4 + (u16 __user *)dst,
-+ __put_user_asm(4[(const u16 *)src], 4 + (u16 __user *)dst,
- ret, "w", "w", "ir", 2);
- return ret;
- case 16:
-- __put_user_asm(*(u64 *)src, (u64 __user *)dst,
-+ __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
- ret, "q", "", "er", 16);
- if (unlikely(ret))
- return ret;
- asm("":::"memory");
-- __put_user_asm(1[(u64 *)src], 1 + (u64 __user *)dst,
-+ __put_user_asm(1[(const u64 *)src], 1 + (u64 __user *)dst,
- ret, "q", "", "er", 8);
- return ret;
- default:
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
-+ dst += PAX_USER_SHADOW_BASE;
-+#endif
-+
- return copy_user_generic((__force void *)dst, src, size);
- }
- }
-
- static __always_inline __must_check
--int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
-+unsigned long copy_to_user(void __user *to, const void *from, unsigned len)
-+{
-+ if (access_ok(VERIFY_WRITE, to, len))
-+ len = __copy_to_user(to, from, len);
-+ return len;
-+}
-+
-+static __always_inline __must_check
-+unsigned long copy_from_user(void *to, const void __user *from, unsigned len)
-+{
-+ if ((int)len < 0)
-+ return len;
-+
-+ if (access_ok(VERIFY_READ, from, len))
-+ len = __copy_from_user(to, from, len);
-+ else if ((int)len > 0) {
-+ if (!__builtin_constant_p(len))
-+ check_object_size(to, len, false);
-+ memset(to, 0, len);
-+ }
-+ return len;
-+}
-+
-+static __always_inline __must_check
-+unsigned long __copy_in_user(void __user *dst, const void __user *src, unsigned size)
- {
-- int ret = 0;
-+ unsigned ret = 0;
-
- might_fault();
-- if (!__builtin_constant_p(size))
-+
-+ pax_track_stack();
-+
-+ if ((int)size < 0)
-+ return size;
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ if (!__access_ok(VERIFY_READ, src, size))
-+ return size;
-+ if (!__access_ok(VERIFY_WRITE, dst, size))
-+ return size;
-+#endif
-+
-+ if (!__builtin_constant_p(size)) {
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
-+ src += PAX_USER_SHADOW_BASE;
-+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
-+ dst += PAX_USER_SHADOW_BASE;
-+#endif
-+
- return copy_user_generic((__force void *)dst,
-- (__force void *)src, size);
-+ (__force const void *)src, size);
-+ }
- switch (size) {
- case 1: {
- u8 tmp;
-- __get_user_asm(tmp, (u8 __user *)src,
-+ __get_user_asm(tmp, (const u8 __user *)src,
- ret, "b", "b", "=q", 1);
- if (likely(!ret))
- __put_user_asm(tmp, (u8 __user *)dst,
-@@ -134,7 +227,7 @@ int __copy_in_user(void __user *dst, con
- }
- case 2: {
- u16 tmp;
-- __get_user_asm(tmp, (u16 __user *)src,
-+ __get_user_asm(tmp, (const u16 __user *)src,
- ret, "w", "w", "=r", 2);
- if (likely(!ret))
- __put_user_asm(tmp, (u16 __user *)dst,
-@@ -144,7 +237,7 @@ int __copy_in_user(void __user *dst, con
-
- case 4: {
- u32 tmp;
-- __get_user_asm(tmp, (u32 __user *)src,
-+ __get_user_asm(tmp, (const u32 __user *)src,
- ret, "l", "k", "=r", 4);
- if (likely(!ret))
- __put_user_asm(tmp, (u32 __user *)dst,
-@@ -153,7 +246,7 @@ int __copy_in_user(void __user *dst, con
- }
- case 8: {
- u64 tmp;
-- __get_user_asm(tmp, (u64 __user *)src,
-+ __get_user_asm(tmp, (const u64 __user *)src,
- ret, "q", "", "=r", 8);
- if (likely(!ret))
- __put_user_asm(tmp, (u64 __user *)dst,
-@@ -161,8 +254,16 @@ int __copy_in_user(void __user *dst, con
- return ret;
- }
- default:
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
-+ src += PAX_USER_SHADOW_BASE;
-+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
-+ dst += PAX_USER_SHADOW_BASE;
-+#endif
-+
- return copy_user_generic((__force void *)dst,
-- (__force void *)src, size);
-+ (__force const void *)src, size);
- }
- }
-
-@@ -176,33 +277,75 @@ __must_check long strlen_user(const char
- __must_check unsigned long clear_user(void __user *mem, unsigned long len);
- __must_check unsigned long __clear_user(void __user *mem, unsigned long len);
-
--__must_check long __copy_from_user_inatomic(void *dst, const void __user *src,
-- unsigned size);
-+static __must_check __always_inline unsigned long
-+__copy_from_user_inatomic(void *dst, const void __user *src, unsigned size)
-+{
-+ pax_track_stack();
-+
-+ if ((int)size < 0)
-+ return size;
-
--static __must_check __always_inline int
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ if (!__access_ok(VERIFY_READ, src, size))
-+ return size;
-+
-+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
-+ src += PAX_USER_SHADOW_BASE;
-+#endif
-+
-+ return copy_user_generic(dst, (__force const void *)src, size);
-+}
-+
-+static __must_check __always_inline unsigned long
- __copy_to_user_inatomic(void __user *dst, const void *src, unsigned size)
- {
-+ if ((int)size < 0)
-+ return size;
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ if (!__access_ok(VERIFY_WRITE, dst, size))
-+ return size;
-+
-+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
-+ dst += PAX_USER_SHADOW_BASE;
-+#endif
-+
- return copy_user_generic((__force void *)dst, src, size);
- }
-
--extern long __copy_user_nocache(void *dst, const void __user *src,
-+extern unsigned long __copy_user_nocache(void *dst, const void __user *src,
- unsigned size, int zerorest);
-
--static inline int
--__copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
-+static inline unsigned long __copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
- {
- might_sleep();
-+
-+ if ((int)size < 0)
-+ return size;
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ if (!__access_ok(VERIFY_READ, src, size))
-+ return size;
-+#endif
-+
- return __copy_user_nocache(dst, src, size, 1);
- }
-
--static inline int
--__copy_from_user_inatomic_nocache(void *dst, const void __user *src,
-+static inline unsigned long __copy_from_user_inatomic_nocache(void *dst, const void __user *src,
- unsigned size)
- {
-+ if ((int)size < 0)
-+ return size;
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ if (!__access_ok(VERIFY_READ, src, size))
-+ return size;
-+#endif
-+
- return __copy_user_nocache(dst, src, size, 0);
- }
-
--unsigned long
-+extern unsigned long
- copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest);
-
- #endif /* _ASM_X86_UACCESS_64_H */
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/uaccess.h linux-2.6.32.45/arch/x86/include/asm/uaccess.h
---- linux-2.6.32.45/arch/x86/include/asm/uaccess.h 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/uaccess.h 2011-06-25 12:56:37.000000000 -0400
-@@ -8,12 +8,15 @@
- #include <linux/thread_info.h>
- #include <linux/prefetch.h>
- #include <linux/string.h>
-+#include <linux/sched.h>
- #include <asm/asm.h>
- #include <asm/page.h>
-
- #define VERIFY_READ 0
- #define VERIFY_WRITE 1
-
-+extern void check_object_size(const void *ptr, unsigned long n, bool to);
-+
- /*
- * The fs value determines whether argument validity checking should be
- * performed or not. If get_fs() == USER_DS, checking is performed, with
-@@ -29,7 +32,12 @@
-
- #define get_ds() (KERNEL_DS)
- #define get_fs() (current_thread_info()->addr_limit)
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+void __set_fs(mm_segment_t x);
-+void set_fs(mm_segment_t x);
-+#else
- #define set_fs(x) (current_thread_info()->addr_limit = (x))
-+#endif
-
- #define segment_eq(a, b) ((a).seg == (b).seg)
-
-@@ -77,7 +85,33 @@
- * checks that the pointer is in the user space range - after calling
- * this function, memory access functions may still return -EFAULT.
- */
--#define access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
-+#define __access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
-+#define access_ok(type, addr, size) \
-+({ \
-+ long __size = size; \
-+ unsigned long __addr = (unsigned long)addr; \
-+ unsigned long __addr_ao = __addr & PAGE_MASK; \
-+ unsigned long __end_ao = __addr + __size - 1; \
-+ bool __ret_ao = __range_not_ok(__addr, __size) == 0; \
-+ if (__ret_ao && unlikely((__end_ao ^ __addr_ao) & PAGE_MASK)) { \
-+ while(__addr_ao <= __end_ao) { \
-+ char __c_ao; \
-+ __addr_ao += PAGE_SIZE; \
-+ if (__size > PAGE_SIZE) \
-+ cond_resched(); \
-+ if (__get_user(__c_ao, (char __user *)__addr)) \
-+ break; \
-+ if (type != VERIFY_WRITE) { \
-+ __addr = __addr_ao; \
-+ continue; \
-+ } \
-+ if (__put_user(__c_ao, (char __user *)__addr)) \
-+ break; \
-+ __addr = __addr_ao; \
-+ } \
-+ } \
-+ __ret_ao; \
-+})
-
- /*
- * The exception table consists of pairs of addresses: the first is the
-@@ -183,12 +217,20 @@ extern int __get_user_bad(void);
- asm volatile("call __put_user_" #size : "=a" (__ret_pu) \
- : "0" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
-
--
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+#define __copyuser_seg "gs;"
-+#define __COPYUSER_SET_ES "pushl %%gs; popl %%es\n"
-+#define __COPYUSER_RESTORE_ES "pushl %%ss; popl %%es\n"
-+#else
-+#define __copyuser_seg
-+#define __COPYUSER_SET_ES
-+#define __COPYUSER_RESTORE_ES
-+#endif
-
- #ifdef CONFIG_X86_32
- #define __put_user_asm_u64(x, addr, err, errret) \
-- asm volatile("1: movl %%eax,0(%2)\n" \
-- "2: movl %%edx,4(%2)\n" \
-+ asm volatile("1: "__copyuser_seg"movl %%eax,0(%2)\n" \
-+ "2: "__copyuser_seg"movl %%edx,4(%2)\n" \
- "3:\n" \
- ".section .fixup,\"ax\"\n" \
- "4: movl %3,%0\n" \
-@@ -200,8 +242,8 @@ extern int __get_user_bad(void);
- : "A" (x), "r" (addr), "i" (errret), "0" (err))
-
- #define __put_user_asm_ex_u64(x, addr) \
-- asm volatile("1: movl %%eax,0(%1)\n" \
-- "2: movl %%edx,4(%1)\n" \
-+ asm volatile("1: "__copyuser_seg"movl %%eax,0(%1)\n" \
-+ "2: "__copyuser_seg"movl %%edx,4(%1)\n" \
- "3:\n" \
- _ASM_EXTABLE(1b, 2b - 1b) \
- _ASM_EXTABLE(2b, 3b - 2b) \
-@@ -374,7 +416,7 @@ do { \
- } while (0)
-
- #define __get_user_asm(x, addr, err, itype, rtype, ltype, errret) \
-- asm volatile("1: mov"itype" %2,%"rtype"1\n" \
-+ asm volatile("1: "__copyuser_seg"mov"itype" %2,%"rtype"1\n"\
- "2:\n" \
- ".section .fixup,\"ax\"\n" \
- "3: mov %3,%0\n" \
-@@ -382,7 +424,7 @@ do { \
- " jmp 2b\n" \
- ".previous\n" \
- _ASM_EXTABLE(1b, 3b) \
-- : "=r" (err), ltype(x) \
-+ : "=r" (err), ltype (x) \
- : "m" (__m(addr)), "i" (errret), "0" (err))
-
- #define __get_user_size_ex(x, ptr, size) \
-@@ -407,7 +449,7 @@ do { \
- } while (0)
-
- #define __get_user_asm_ex(x, addr, itype, rtype, ltype) \
-- asm volatile("1: mov"itype" %1,%"rtype"0\n" \
-+ asm volatile("1: "__copyuser_seg"mov"itype" %1,%"rtype"0\n"\
- "2:\n" \
- _ASM_EXTABLE(1b, 2b - 1b) \
- : ltype(x) : "m" (__m(addr)))
-@@ -424,13 +466,24 @@ do { \
- int __gu_err; \
- unsigned long __gu_val; \
- __get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT); \
-- (x) = (__force __typeof__(*(ptr)))__gu_val; \
-+ (x) = (__typeof__(*(ptr)))__gu_val; \
- __gu_err; \
- })
-
- /* FIXME: this hack is definitely wrong -AK */
- struct __large_struct { unsigned long buf[100]; };
--#define __m(x) (*(struct __large_struct __user *)(x))
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+#define ____m(x) \
-+({ \
-+ unsigned long ____x = (unsigned long)(x); \
-+ if (____x < PAX_USER_SHADOW_BASE) \
-+ ____x += PAX_USER_SHADOW_BASE; \
-+ (void __user *)____x; \
-+})
-+#else
-+#define ____m(x) (x)
-+#endif
-+#define __m(x) (*(struct __large_struct __user *)____m(x))
-
- /*
- * Tell gcc we read from memory instead of writing: this is because
-@@ -438,7 +491,7 @@ struct __large_struct { unsigned long bu
- * aliasing issues.
- */
- #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret) \
-- asm volatile("1: mov"itype" %"rtype"1,%2\n" \
-+ asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"1,%2\n"\
- "2:\n" \
- ".section .fixup,\"ax\"\n" \
- "3: mov %3,%0\n" \
-@@ -446,10 +499,10 @@ struct __large_struct { unsigned long bu
- ".previous\n" \
- _ASM_EXTABLE(1b, 3b) \
- : "=r"(err) \
-- : ltype(x), "m" (__m(addr)), "i" (errret), "0" (err))
-+ : ltype (x), "m" (__m(addr)), "i" (errret), "0" (err))
-
- #define __put_user_asm_ex(x, addr, itype, rtype, ltype) \
-- asm volatile("1: mov"itype" %"rtype"0,%1\n" \
-+ asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"0,%1\n"\
- "2:\n" \
- _ASM_EXTABLE(1b, 2b - 1b) \
- : : ltype(x), "m" (__m(addr)))
-@@ -488,8 +541,12 @@ struct __large_struct { unsigned long bu
- * On error, the variable @x is set to zero.
- */
-
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+#define __get_user(x, ptr) get_user((x), (ptr))
-+#else
- #define __get_user(x, ptr) \
- __get_user_nocheck((x), (ptr), sizeof(*(ptr)))
-+#endif
-
- /**
- * __put_user: - Write a simple value into user space, with less checking.
-@@ -511,8 +568,12 @@ struct __large_struct { unsigned long bu
- * Returns zero on success, or -EFAULT on error.
- */
-
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+#define __put_user(x, ptr) put_user((x), (ptr))
-+#else
- #define __put_user(x, ptr) \
- __put_user_nocheck((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr)))
-+#endif
-
- #define __get_user_unaligned __get_user
- #define __put_user_unaligned __put_user
-@@ -530,7 +591,7 @@ struct __large_struct { unsigned long bu
- #define get_user_ex(x, ptr) do { \
- unsigned long __gue_val; \
- __get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr)))); \
-- (x) = (__force __typeof__(*(ptr)))__gue_val; \
-+ (x) = (__typeof__(*(ptr)))__gue_val; \
- } while (0)
-
- #ifdef CONFIG_X86_WP_WORKS_OK
-@@ -567,6 +628,7 @@ extern struct movsl_mask {
-
- #define ARCH_HAS_NOCACHE_UACCESS 1
-
-+#define ARCH_HAS_SORT_EXTABLE
- #ifdef CONFIG_X86_32
- # include "uaccess_32.h"
- #else
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/vgtod.h linux-2.6.32.45/arch/x86/include/asm/vgtod.h
---- linux-2.6.32.45/arch/x86/include/asm/vgtod.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/vgtod.h 2011-04-17 15:56:46.000000000 -0400
-@@ -14,6 +14,7 @@ struct vsyscall_gtod_data {
- int sysctl_enabled;
- struct timezone sys_tz;
- struct { /* extract of a clocksource struct */
-+ char name[8];
- cycle_t (*vread)(void);
- cycle_t cycle_last;
- cycle_t mask;
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/vmi.h linux-2.6.32.45/arch/x86/include/asm/vmi.h
---- linux-2.6.32.45/arch/x86/include/asm/vmi.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/vmi.h 2011-04-17 15:56:46.000000000 -0400
-@@ -191,6 +191,7 @@ struct vrom_header {
- u8 reserved[96]; /* Reserved for headers */
- char vmi_init[8]; /* VMI_Init jump point */
- char get_reloc[8]; /* VMI_GetRelocationInfo jump point */
-+ char rom_data[8048]; /* rest of the option ROM */
- } __attribute__((packed));
-
- struct pnp_header {
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/vmi_time.h linux-2.6.32.45/arch/x86/include/asm/vmi_time.h
---- linux-2.6.32.45/arch/x86/include/asm/vmi_time.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/vmi_time.h 2011-08-05 20:33:55.000000000 -0400
-@@ -43,7 +43,7 @@ extern struct vmi_timer_ops {
- int (*wallclock_updated)(void);
- void (*set_alarm)(u32 flags, u64 expiry, u64 period);
- void (*cancel_alarm)(u32 flags);
--} vmi_timer_ops;
-+} __no_const vmi_timer_ops;
-
- /* Prototypes */
- extern void __init vmi_time_init(void);
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/vsyscall.h linux-2.6.32.45/arch/x86/include/asm/vsyscall.h
---- linux-2.6.32.45/arch/x86/include/asm/vsyscall.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/vsyscall.h 2011-04-17 15:56:46.000000000 -0400
-@@ -15,9 +15,10 @@ enum vsyscall_num {
-
- #ifdef __KERNEL__
- #include <linux/seqlock.h>
-+#include <linux/getcpu.h>
-+#include <linux/time.h>
-
- #define __section_vgetcpu_mode __attribute__ ((unused, __section__ (".vgetcpu_mode"), aligned(16)))
--#define __section_jiffies __attribute__ ((unused, __section__ (".jiffies"), aligned(16)))
-
- /* Definitions for CONFIG_GENERIC_TIME definitions */
- #define __section_vsyscall_gtod_data __attribute__ \
-@@ -31,7 +32,6 @@ enum vsyscall_num {
- #define VGETCPU_LSL 2
-
- extern int __vgetcpu_mode;
--extern volatile unsigned long __jiffies;
-
- /* kernel space (writeable) */
- extern int vgetcpu_mode;
-@@ -39,6 +39,9 @@ extern struct timezone sys_tz;
-
- extern void map_vsyscall(void);
-
-+extern int vgettimeofday(struct timeval * tv, struct timezone * tz);
-+extern time_t vtime(time_t *t);
-+extern long vgetcpu(unsigned *cpu, unsigned *node, struct getcpu_cache *tcache);
- #endif /* __KERNEL__ */
-
- #endif /* _ASM_X86_VSYSCALL_H */
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/x86_init.h linux-2.6.32.45/arch/x86/include/asm/x86_init.h
---- linux-2.6.32.45/arch/x86/include/asm/x86_init.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/x86_init.h 2011-08-05 20:33:55.000000000 -0400
-@@ -28,7 +28,7 @@ struct x86_init_mpparse {
- void (*mpc_oem_bus_info)(struct mpc_bus *m, char *name);
- void (*find_smp_config)(unsigned int reserve);
- void (*get_smp_config)(unsigned int early);
--};
-+} __no_const;
-
- /**
- * struct x86_init_resources - platform specific resource related ops
-@@ -42,7 +42,7 @@ struct x86_init_resources {
- void (*probe_roms)(void);
- void (*reserve_resources)(void);
- char *(*memory_setup)(void);
--};
-+} __no_const;
-
- /**
- * struct x86_init_irqs - platform specific interrupt setup
-@@ -55,7 +55,7 @@ struct x86_init_irqs {
- void (*pre_vector_init)(void);
- void (*intr_init)(void);
- void (*trap_init)(void);
--};
-+} __no_const;
-
- /**
- * struct x86_init_oem - oem platform specific customizing functions
-@@ -65,7 +65,7 @@ struct x86_init_irqs {
- struct x86_init_oem {
- void (*arch_setup)(void);
- void (*banner)(void);
--};
-+} __no_const;
-
- /**
- * struct x86_init_paging - platform specific paging functions
-@@ -75,7 +75,7 @@ struct x86_init_oem {
- struct x86_init_paging {
- void (*pagetable_setup_start)(pgd_t *base);
- void (*pagetable_setup_done)(pgd_t *base);
--};
-+} __no_const;
-
- /**
- * struct x86_init_timers - platform specific timer setup
-@@ -88,7 +88,7 @@ struct x86_init_timers {
- void (*setup_percpu_clockev)(void);
- void (*tsc_pre_init)(void);
- void (*timer_init)(void);
--};
-+} __no_const;
-
- /**
- * struct x86_init_ops - functions for platform specific setup
-@@ -101,7 +101,7 @@ struct x86_init_ops {
- struct x86_init_oem oem;
- struct x86_init_paging paging;
- struct x86_init_timers timers;
--};
-+} __no_const;
-
- /**
- * struct x86_cpuinit_ops - platform specific cpu hotplug setups
-@@ -109,7 +109,7 @@ struct x86_init_ops {
- */
- struct x86_cpuinit_ops {
- void (*setup_percpu_clockev)(void);
--};
-+} __no_const;
-
- /**
- * struct x86_platform_ops - platform specific runtime functions
-@@ -121,7 +121,7 @@ struct x86_platform_ops {
- unsigned long (*calibrate_tsc)(void);
- unsigned long (*get_wallclock)(void);
- int (*set_wallclock)(unsigned long nowtime);
--};
-+} __no_const;
-
- extern struct x86_init_ops x86_init;
- extern struct x86_cpuinit_ops x86_cpuinit;
-diff -urNp linux-2.6.32.45/arch/x86/include/asm/xsave.h linux-2.6.32.45/arch/x86/include/asm/xsave.h
---- linux-2.6.32.45/arch/x86/include/asm/xsave.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/include/asm/xsave.h 2011-04-17 15:56:46.000000000 -0400
-@@ -56,6 +56,12 @@ static inline int xrstor_checking(struct
- static inline int xsave_user(struct xsave_struct __user *buf)
- {
- int err;
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ if ((unsigned long)buf < PAX_USER_SHADOW_BASE)
-+ buf = (struct xsave_struct __user *)((void __user*)buf + PAX_USER_SHADOW_BASE);
-+#endif
-+
- __asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x27\n"
- "2:\n"
- ".section .fixup,\"ax\"\n"
-@@ -82,6 +88,11 @@ static inline int xrestore_user(struct x
- u32 lmask = mask;
- u32 hmask = mask >> 32;
-
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ if ((unsigned long)xstate < PAX_USER_SHADOW_BASE)
-+ xstate = (struct xsave_struct *)((void *)xstate + PAX_USER_SHADOW_BASE);
-+#endif
-+
- __asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x2f\n"
- "2:\n"
- ".section .fixup,\"ax\"\n"
-diff -urNp linux-2.6.32.45/arch/x86/Kconfig linux-2.6.32.45/arch/x86/Kconfig
---- linux-2.6.32.45/arch/x86/Kconfig 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/Kconfig 2011-04-17 15:56:46.000000000 -0400
-@@ -223,7 +223,7 @@ config X86_TRAMPOLINE
-
- config X86_32_LAZY_GS
- def_bool y
-- depends on X86_32 && !CC_STACKPROTECTOR
-+ depends on X86_32 && !CC_STACKPROTECTOR && !PAX_MEMORY_UDEREF
-
- config KTIME_SCALAR
- def_bool X86_32
-@@ -1008,7 +1008,7 @@ choice
-
- config NOHIGHMEM
- bool "off"
-- depends on !X86_NUMAQ
-+ depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
- ---help---
- Linux can use up to 64 Gigabytes of physical memory on x86 systems.
- However, the address space of 32-bit x86 processors is only 4
-@@ -1045,7 +1045,7 @@ config NOHIGHMEM
-
- config HIGHMEM4G
- bool "4GB"
-- depends on !X86_NUMAQ
-+ depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
- ---help---
- Select this if you have a 32-bit processor and between 1 and 4
- gigabytes of physical RAM.
-@@ -1099,7 +1099,7 @@ config PAGE_OFFSET
- hex
- default 0xB0000000 if VMSPLIT_3G_OPT
- default 0x80000000 if VMSPLIT_2G
-- default 0x78000000 if VMSPLIT_2G_OPT
-+ default 0x70000000 if VMSPLIT_2G_OPT
- default 0x40000000 if VMSPLIT_1G
- default 0xC0000000
- depends on X86_32
-@@ -1430,7 +1430,7 @@ config ARCH_USES_PG_UNCACHED
-
- config EFI
- bool "EFI runtime service support"
-- depends on ACPI
-+ depends on ACPI && !PAX_KERNEXEC
- ---help---
- This enables the kernel to use EFI runtime services that are
- available (such as the EFI variable services).
-@@ -1460,6 +1460,7 @@ config SECCOMP
-
- config CC_STACKPROTECTOR
- bool "Enable -fstack-protector buffer overflow detection (EXPERIMENTAL)"
-+ depends on X86_64 || !PAX_MEMORY_UDEREF
- ---help---
- This option turns on the -fstack-protector GCC feature. This
- feature puts, at the beginning of functions, a canary value on
-@@ -1517,6 +1518,7 @@ config KEXEC_JUMP
- config PHYSICAL_START
- hex "Physical address where the kernel is loaded" if (EMBEDDED || CRASH_DUMP)
- default "0x1000000"
-+ range 0x400000 0x40000000
- ---help---
- This gives the physical address where the kernel is loaded.
-
-@@ -1581,6 +1583,7 @@ config PHYSICAL_ALIGN
- hex
- prompt "Alignment value to which kernel should be aligned" if X86_32
- default "0x1000000"
-+ range 0x400000 0x1000000 if PAX_KERNEXEC
- range 0x2000 0x1000000
- ---help---
- This value puts the alignment restrictions on physical address
-@@ -1612,9 +1615,10 @@ config HOTPLUG_CPU
- Say N if you want to disable CPU hotplug.
-
- config COMPAT_VDSO
-- def_bool y
-+ def_bool n
- prompt "Compat VDSO support"
- depends on X86_32 || IA32_EMULATION
-+ depends on !PAX_NOEXEC && !PAX_MEMORY_UDEREF
- ---help---
- Map the 32-bit VDSO to the predictable old-style address too.
- ---help---
-diff -urNp linux-2.6.32.45/arch/x86/Kconfig.cpu linux-2.6.32.45/arch/x86/Kconfig.cpu
---- linux-2.6.32.45/arch/x86/Kconfig.cpu 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/Kconfig.cpu 2011-04-17 15:56:46.000000000 -0400
-@@ -340,7 +340,7 @@ config X86_PPRO_FENCE
-
- config X86_F00F_BUG
- def_bool y
-- depends on M586MMX || M586TSC || M586 || M486 || M386
-+ depends on (M586MMX || M586TSC || M586 || M486 || M386) && !PAX_KERNEXEC
-
- config X86_WP_WORKS_OK
- def_bool y
-@@ -360,7 +360,7 @@ config X86_POPAD_OK
-
- config X86_ALIGNMENT_16
- def_bool y
-- depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK6 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
-+ depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK8 || MK7 || MK6 || MCORE2 || MPENTIUM4 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
-
- config X86_INTEL_USERCOPY
- def_bool y
-@@ -406,7 +406,7 @@ config X86_CMPXCHG64
- # generates cmov.
- config X86_CMOV
- def_bool y
-- depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM)
-+ depends on (MK8 || MK7 || MCORE2 || MPSC || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM)
-
- config X86_MINIMUM_CPU_FAMILY
- int
-diff -urNp linux-2.6.32.45/arch/x86/Kconfig.debug linux-2.6.32.45/arch/x86/Kconfig.debug
---- linux-2.6.32.45/arch/x86/Kconfig.debug 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/Kconfig.debug 2011-04-17 15:56:46.000000000 -0400
-@@ -99,7 +99,7 @@ config X86_PTDUMP
- config DEBUG_RODATA
- bool "Write protect kernel read-only data structures"
- default y
-- depends on DEBUG_KERNEL
-+ depends on DEBUG_KERNEL && BROKEN
- ---help---
- Mark the kernel read-only data as write-protected in the pagetables,
- in order to catch accidental (and incorrect) writes to such const
-diff -urNp linux-2.6.32.45/arch/x86/kernel/acpi/realmode/Makefile linux-2.6.32.45/arch/x86/kernel/acpi/realmode/Makefile
---- linux-2.6.32.45/arch/x86/kernel/acpi/realmode/Makefile 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/acpi/realmode/Makefile 2011-08-07 14:38:58.000000000 -0400
-@@ -41,6 +41,9 @@ KBUILD_CFLAGS := $(LINUXINCLUDE) -g -Os
- $(call cc-option, -fno-stack-protector) \
- $(call cc-option, -mpreferred-stack-boundary=2)
- KBUILD_CFLAGS += $(call cc-option, -m32)
-+ifdef CONSTIFY_PLUGIN
-+KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
-+endif
- KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
- GCOV_PROFILE := n
-
-diff -urNp linux-2.6.32.45/arch/x86/kernel/acpi/realmode/wakeup.S linux-2.6.32.45/arch/x86/kernel/acpi/realmode/wakeup.S
---- linux-2.6.32.45/arch/x86/kernel/acpi/realmode/wakeup.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/acpi/realmode/wakeup.S 2011-07-01 18:53:40.000000000 -0400
-@@ -91,6 +91,9 @@ _start:
- /* Do any other stuff... */
-
- #ifndef CONFIG_64BIT
-+ /* Recheck NX bit overrides (64bit path does this in trampoline) */
-+ call verify_cpu
-+
- /* This could also be done in C code... */
- movl pmode_cr3, %eax
- movl %eax, %cr3
-@@ -104,7 +107,7 @@ _start:
- movl %eax, %ecx
- orl %edx, %ecx
- jz 1f
-- movl $0xc0000080, %ecx
-+ mov $MSR_EFER, %ecx
- wrmsr
- 1:
-
-@@ -114,6 +117,7 @@ _start:
- movl pmode_cr0, %eax
- movl %eax, %cr0
- jmp pmode_return
-+# include "../../verify_cpu.S"
- #else
- pushw $0
- pushw trampoline_segment
-diff -urNp linux-2.6.32.45/arch/x86/kernel/acpi/sleep.c linux-2.6.32.45/arch/x86/kernel/acpi/sleep.c
---- linux-2.6.32.45/arch/x86/kernel/acpi/sleep.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/acpi/sleep.c 2011-07-01 19:01:34.000000000 -0400
-@@ -11,11 +11,12 @@
- #include <linux/cpumask.h>
- #include <asm/segment.h>
- #include <asm/desc.h>
-+#include <asm/e820.h>
-
- #include "realmode/wakeup.h"
- #include "sleep.h"
-
--unsigned long acpi_wakeup_address;
-+unsigned long acpi_wakeup_address = 0x2000;
- unsigned long acpi_realmode_flags;
-
- /* address in low memory of the wakeup routine. */
-@@ -98,9 +99,13 @@ int acpi_save_state_mem(void)
- #else /* CONFIG_64BIT */
- header->trampoline_segment = setup_trampoline() >> 4;
- #ifdef CONFIG_SMP
-- stack_start.sp = temp_stack + sizeof(temp_stack);
-+ stack_start = (unsigned long)temp_stack + sizeof(temp_stack);
-+
-+ pax_open_kernel();
- early_gdt_descr.address =
- (unsigned long)get_cpu_gdt_table(smp_processor_id());
-+ pax_close_kernel();
-+
- initial_gs = per_cpu_offset(smp_processor_id());
- #endif
- initial_code = (unsigned long)wakeup_long64;
-@@ -134,14 +139,8 @@ void __init acpi_reserve_bootmem(void)
- return;
- }
-
-- acpi_realmode = (unsigned long)alloc_bootmem_low(WAKEUP_SIZE);
--
-- if (!acpi_realmode) {
-- printk(KERN_ERR "ACPI: Cannot allocate lowmem, S3 disabled.\n");
-- return;
-- }
--
-- acpi_wakeup_address = virt_to_phys((void *)acpi_realmode);
-+ reserve_early(acpi_wakeup_address, acpi_wakeup_address + WAKEUP_SIZE, "ACPI Wakeup Code");
-+ acpi_realmode = (unsigned long)__va(acpi_wakeup_address);;
- }
-
-
-diff -urNp linux-2.6.32.45/arch/x86/kernel/acpi/wakeup_32.S linux-2.6.32.45/arch/x86/kernel/acpi/wakeup_32.S
---- linux-2.6.32.45/arch/x86/kernel/acpi/wakeup_32.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/acpi/wakeup_32.S 2011-04-17 15:56:46.000000000 -0400
-@@ -30,13 +30,11 @@ wakeup_pmode_return:
- # and restore the stack ... but you need gdt for this to work
- movl saved_context_esp, %esp
-
-- movl %cs:saved_magic, %eax
-- cmpl $0x12345678, %eax
-+ cmpl $0x12345678, saved_magic
- jne bogus_magic
-
- # jump to place where we left off
-- movl saved_eip, %eax
-- jmp *%eax
-+ jmp *(saved_eip)
-
- bogus_magic:
- jmp bogus_magic
-diff -urNp linux-2.6.32.45/arch/x86/kernel/alternative.c linux-2.6.32.45/arch/x86/kernel/alternative.c
---- linux-2.6.32.45/arch/x86/kernel/alternative.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/alternative.c 2011-04-17 15:56:46.000000000 -0400
-@@ -407,7 +407,7 @@ void __init_or_module apply_paravirt(str
-
- BUG_ON(p->len > MAX_PATCH_LEN);
- /* prep the buffer with the original instructions */
-- memcpy(insnbuf, p->instr, p->len);
-+ memcpy(insnbuf, ktla_ktva(p->instr), p->len);
- used = pv_init_ops.patch(p->instrtype, p->clobbers, insnbuf,
- (unsigned long)p->instr, p->len);
-
-@@ -475,7 +475,7 @@ void __init alternative_instructions(voi
- if (smp_alt_once)
- free_init_pages("SMP alternatives",
- (unsigned long)__smp_locks,
-- (unsigned long)__smp_locks_end);
-+ PAGE_ALIGN((unsigned long)__smp_locks_end));
-
- restart_nmi();
- }
-@@ -492,13 +492,17 @@ void __init alternative_instructions(voi
- * instructions. And on the local CPU you need to be protected again NMI or MCE
- * handlers seeing an inconsistent instruction while you patch.
- */
--static void *__init_or_module text_poke_early(void *addr, const void *opcode,
-+static void *__kprobes text_poke_early(void *addr, const void *opcode,
- size_t len)
- {
- unsigned long flags;
- local_irq_save(flags);
-- memcpy(addr, opcode, len);
-+
-+ pax_open_kernel();
-+ memcpy(ktla_ktva(addr), opcode, len);
- sync_core();
-+ pax_close_kernel();
-+
- local_irq_restore(flags);
- /* Could also do a CLFLUSH here to speed up CPU recovery; but
- that causes hangs on some VIA CPUs. */
-@@ -520,35 +524,21 @@ static void *__init_or_module text_poke_
- */
- void *__kprobes text_poke(void *addr, const void *opcode, size_t len)
- {
-- unsigned long flags;
-- char *vaddr;
-+ unsigned char *vaddr = ktla_ktva(addr);
- struct page *pages[2];
-- int i;
-+ size_t i;
-
- if (!core_kernel_text((unsigned long)addr)) {
-- pages[0] = vmalloc_to_page(addr);
-- pages[1] = vmalloc_to_page(addr + PAGE_SIZE);
-+ pages[0] = vmalloc_to_page(vaddr);
-+ pages[1] = vmalloc_to_page(vaddr + PAGE_SIZE);
- } else {
-- pages[0] = virt_to_page(addr);
-+ pages[0] = virt_to_page(vaddr);
- WARN_ON(!PageReserved(pages[0]));
-- pages[1] = virt_to_page(addr + PAGE_SIZE);
-+ pages[1] = virt_to_page(vaddr + PAGE_SIZE);
- }
- BUG_ON(!pages[0]);
-- local_irq_save(flags);
-- set_fixmap(FIX_TEXT_POKE0, page_to_phys(pages[0]));
-- if (pages[1])
-- set_fixmap(FIX_TEXT_POKE1, page_to_phys(pages[1]));
-- vaddr = (char *)fix_to_virt(FIX_TEXT_POKE0);
-- memcpy(&vaddr[(unsigned long)addr & ~PAGE_MASK], opcode, len);
-- clear_fixmap(FIX_TEXT_POKE0);
-- if (pages[1])
-- clear_fixmap(FIX_TEXT_POKE1);
-- local_flush_tlb();
-- sync_core();
-- /* Could also do a CLFLUSH here to speed up CPU recovery; but
-- that causes hangs on some VIA CPUs. */
-+ text_poke_early(addr, opcode, len);
- for (i = 0; i < len; i++)
-- BUG_ON(((char *)addr)[i] != ((char *)opcode)[i]);
-- local_irq_restore(flags);
-+ BUG_ON((vaddr)[i] != ((const unsigned char *)opcode)[i]);
- return addr;
- }
-diff -urNp linux-2.6.32.45/arch/x86/kernel/amd_iommu.c linux-2.6.32.45/arch/x86/kernel/amd_iommu.c
---- linux-2.6.32.45/arch/x86/kernel/amd_iommu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/amd_iommu.c 2011-04-17 15:56:46.000000000 -0400
-@@ -2076,7 +2076,7 @@ static void prealloc_protection_domains(
- }
- }
-
--static struct dma_map_ops amd_iommu_dma_ops = {
-+static const struct dma_map_ops amd_iommu_dma_ops = {
- .alloc_coherent = alloc_coherent,
- .free_coherent = free_coherent,
- .map_page = map_page,
-diff -urNp linux-2.6.32.45/arch/x86/kernel/apic/apic.c linux-2.6.32.45/arch/x86/kernel/apic/apic.c
---- linux-2.6.32.45/arch/x86/kernel/apic/apic.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/apic/apic.c 2011-08-17 20:00:16.000000000 -0400
-@@ -170,7 +170,7 @@ int first_system_vector = 0xfe;
- /*
- * Debug level, exported for io_apic.c
- */
--unsigned int apic_verbosity;
-+int apic_verbosity;
-
- int pic_mode;
-
-@@ -1794,7 +1794,7 @@ void smp_error_interrupt(struct pt_regs
- apic_write(APIC_ESR, 0);
- v1 = apic_read(APIC_ESR);
- ack_APIC_irq();
-- atomic_inc(&irq_err_count);
-+ atomic_inc_unchecked(&irq_err_count);
-
- /*
- * Here is what the APIC error bits mean:
-@@ -2184,6 +2184,8 @@ static int __cpuinit apic_cluster_num(vo
- u16 *bios_cpu_apicid;
- DECLARE_BITMAP(clustermap, NUM_APIC_CLUSTERS);
-
-+ pax_track_stack();
-+
- bios_cpu_apicid = early_per_cpu_ptr(x86_bios_cpu_apicid);
- bitmap_zero(clustermap, NUM_APIC_CLUSTERS);
-
-diff -urNp linux-2.6.32.45/arch/x86/kernel/apic/io_apic.c linux-2.6.32.45/arch/x86/kernel/apic/io_apic.c
---- linux-2.6.32.45/arch/x86/kernel/apic/io_apic.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/apic/io_apic.c 2011-05-04 17:56:20.000000000 -0400
-@@ -716,7 +716,7 @@ struct IO_APIC_route_entry **alloc_ioapi
- ioapic_entries = kzalloc(sizeof(*ioapic_entries) * nr_ioapics,
- GFP_ATOMIC);
- if (!ioapic_entries)
-- return 0;
-+ return NULL;
-
- for (apic = 0; apic < nr_ioapics; apic++) {
- ioapic_entries[apic] =
-@@ -733,7 +733,7 @@ nomem:
- kfree(ioapic_entries[apic]);
- kfree(ioapic_entries);
-
-- return 0;
-+ return NULL;
- }
-
- /*
-@@ -1150,7 +1150,7 @@ int IO_APIC_get_PCI_irq_vector(int bus,
- }
- EXPORT_SYMBOL(IO_APIC_get_PCI_irq_vector);
-
--void lock_vector_lock(void)
-+void lock_vector_lock(void) __acquires(vector_lock)
- {
- /* Used to the online set of cpus does not change
- * during assign_irq_vector.
-@@ -1158,7 +1158,7 @@ void lock_vector_lock(void)
- spin_lock(&vector_lock);
- }
-
--void unlock_vector_lock(void)
-+void unlock_vector_lock(void) __releases(vector_lock)
- {
- spin_unlock(&vector_lock);
- }
-@@ -2542,7 +2542,7 @@ static void ack_apic_edge(unsigned int i
- ack_APIC_irq();
- }
-
--atomic_t irq_mis_count;
-+atomic_unchecked_t irq_mis_count;
-
- static void ack_apic_level(unsigned int irq)
- {
-@@ -2626,7 +2626,7 @@ static void ack_apic_level(unsigned int
-
- /* Tail end of version 0x11 I/O APIC bug workaround */
- if (!(v & (1 << (i & 0x1f)))) {
-- atomic_inc(&irq_mis_count);
-+ atomic_inc_unchecked(&irq_mis_count);
- spin_lock(&ioapic_lock);
- __mask_and_edge_IO_APIC_irq(cfg);
- __unmask_and_level_IO_APIC_irq(cfg);
-diff -urNp linux-2.6.32.45/arch/x86/kernel/apm_32.c linux-2.6.32.45/arch/x86/kernel/apm_32.c
---- linux-2.6.32.45/arch/x86/kernel/apm_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/apm_32.c 2011-04-23 12:56:10.000000000 -0400
-@@ -410,7 +410,7 @@ static DEFINE_SPINLOCK(user_list_lock);
- * This is for buggy BIOS's that refer to (real mode) segment 0x40
- * even though they are called in protected mode.
- */
--static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
-+static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
- (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
-
- static const char driver_version[] = "1.16ac"; /* no spaces */
-@@ -588,7 +588,10 @@ static long __apm_bios_call(void *_call)
- BUG_ON(cpu != 0);
- gdt = get_cpu_gdt_table(cpu);
- save_desc_40 = gdt[0x40 / 8];
-+
-+ pax_open_kernel();
- gdt[0x40 / 8] = bad_bios_desc;
-+ pax_close_kernel();
-
- apm_irq_save(flags);
- APM_DO_SAVE_SEGS;
-@@ -597,7 +600,11 @@ static long __apm_bios_call(void *_call)
- &call->esi);
- APM_DO_RESTORE_SEGS;
- apm_irq_restore(flags);
-+
-+ pax_open_kernel();
- gdt[0x40 / 8] = save_desc_40;
-+ pax_close_kernel();
-+
- put_cpu();
-
- return call->eax & 0xff;
-@@ -664,7 +671,10 @@ static long __apm_bios_call_simple(void
- BUG_ON(cpu != 0);
- gdt = get_cpu_gdt_table(cpu);
- save_desc_40 = gdt[0x40 / 8];
-+
-+ pax_open_kernel();
- gdt[0x40 / 8] = bad_bios_desc;
-+ pax_close_kernel();
-
- apm_irq_save(flags);
- APM_DO_SAVE_SEGS;
-@@ -672,7 +682,11 @@ static long __apm_bios_call_simple(void
- &call->eax);
- APM_DO_RESTORE_SEGS;
- apm_irq_restore(flags);
-+
-+ pax_open_kernel();
- gdt[0x40 / 8] = save_desc_40;
-+ pax_close_kernel();
-+
- put_cpu();
- return error;
- }
-@@ -975,7 +989,7 @@ recalc:
-
- static void apm_power_off(void)
- {
-- unsigned char po_bios_call[] = {
-+ const unsigned char po_bios_call[] = {
- 0xb8, 0x00, 0x10, /* movw $0x1000,ax */
- 0x8e, 0xd0, /* movw ax,ss */
- 0xbc, 0x00, 0xf0, /* movw $0xf000,sp */
-@@ -2357,12 +2371,15 @@ static int __init apm_init(void)
- * code to that CPU.
- */
- gdt = get_cpu_gdt_table(0);
-+
-+ pax_open_kernel();
- set_desc_base(&gdt[APM_CS >> 3],
- (unsigned long)__va((unsigned long)apm_info.bios.cseg << 4));
- set_desc_base(&gdt[APM_CS_16 >> 3],
- (unsigned long)__va((unsigned long)apm_info.bios.cseg_16 << 4));
- set_desc_base(&gdt[APM_DS >> 3],
- (unsigned long)__va((unsigned long)apm_info.bios.dseg << 4));
-+ pax_close_kernel();
-
- proc_create("apm", 0, NULL, &apm_file_ops);
-
-diff -urNp linux-2.6.32.45/arch/x86/kernel/asm-offsets_32.c linux-2.6.32.45/arch/x86/kernel/asm-offsets_32.c
---- linux-2.6.32.45/arch/x86/kernel/asm-offsets_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/asm-offsets_32.c 2011-05-16 21:46:57.000000000 -0400
-@@ -51,7 +51,6 @@ void foo(void)
- OFFSET(CPUINFO_x86_vendor_id, cpuinfo_x86, x86_vendor_id);
- BLANK();
-
-- OFFSET(TI_task, thread_info, task);
- OFFSET(TI_exec_domain, thread_info, exec_domain);
- OFFSET(TI_flags, thread_info, flags);
- OFFSET(TI_status, thread_info, status);
-@@ -60,6 +59,8 @@ void foo(void)
- OFFSET(TI_restart_block, thread_info, restart_block);
- OFFSET(TI_sysenter_return, thread_info, sysenter_return);
- OFFSET(TI_cpu, thread_info, cpu);
-+ OFFSET(TI_lowest_stack, thread_info, lowest_stack);
-+ DEFINE(TI_task_thread_sp0, offsetof(struct task_struct, thread.sp0) - offsetof(struct task_struct, tinfo));
- BLANK();
-
- OFFSET(GDS_size, desc_ptr, size);
-@@ -99,6 +100,7 @@ void foo(void)
-
- DEFINE(PAGE_SIZE_asm, PAGE_SIZE);
- DEFINE(PAGE_SHIFT_asm, PAGE_SHIFT);
-+ DEFINE(THREAD_SIZE_asm, THREAD_SIZE);
- DEFINE(PTRS_PER_PTE, PTRS_PER_PTE);
- DEFINE(PTRS_PER_PMD, PTRS_PER_PMD);
- DEFINE(PTRS_PER_PGD, PTRS_PER_PGD);
-@@ -115,6 +117,11 @@ void foo(void)
- OFFSET(PV_CPU_iret, pv_cpu_ops, iret);
- OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
- OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
-+#endif
-+
- #endif
-
- #ifdef CONFIG_XEN
-diff -urNp linux-2.6.32.45/arch/x86/kernel/asm-offsets_64.c linux-2.6.32.45/arch/x86/kernel/asm-offsets_64.c
---- linux-2.6.32.45/arch/x86/kernel/asm-offsets_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/asm-offsets_64.c 2011-05-16 21:46:57.000000000 -0400
-@@ -44,6 +44,8 @@ int main(void)
- ENTRY(addr_limit);
- ENTRY(preempt_count);
- ENTRY(status);
-+ ENTRY(lowest_stack);
-+ DEFINE(TI_task_thread_sp0, offsetof(struct task_struct, thread.sp0) - offsetof(struct task_struct, tinfo));
- #ifdef CONFIG_IA32_EMULATION
- ENTRY(sysenter_return);
- #endif
-@@ -63,6 +65,18 @@ int main(void)
- OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
- OFFSET(PV_CPU_swapgs, pv_cpu_ops, swapgs);
- OFFSET(PV_MMU_read_cr2, pv_mmu_ops, read_cr2);
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
-+ OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
-+#endif
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ OFFSET(PV_MMU_read_cr3, pv_mmu_ops, read_cr3);
-+ OFFSET(PV_MMU_write_cr3, pv_mmu_ops, write_cr3);
-+ OFFSET(PV_MMU_set_pgd, pv_mmu_ops, set_pgd);
-+#endif
-+
- #endif
-
-
-@@ -115,6 +129,7 @@ int main(void)
- ENTRY(cr8);
- BLANK();
- #undef ENTRY
-+ DEFINE(TSS_size, sizeof(struct tss_struct));
- DEFINE(TSS_ist, offsetof(struct tss_struct, x86_tss.ist));
- BLANK();
- DEFINE(crypto_tfm_ctx_offset, offsetof(struct crypto_tfm, __crt_ctx));
-@@ -130,6 +145,7 @@ int main(void)
-
- BLANK();
- DEFINE(PAGE_SIZE_asm, PAGE_SIZE);
-+ DEFINE(THREAD_SIZE_asm, THREAD_SIZE);
- #ifdef CONFIG_XEN
- BLANK();
- OFFSET(XEN_vcpu_info_mask, vcpu_info, evtchn_upcall_mask);
-diff -urNp linux-2.6.32.45/arch/x86/kernel/cpu/amd.c linux-2.6.32.45/arch/x86/kernel/cpu/amd.c
---- linux-2.6.32.45/arch/x86/kernel/cpu/amd.c 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/cpu/amd.c 2011-06-25 12:56:37.000000000 -0400
-@@ -602,7 +602,7 @@ static unsigned int __cpuinit amd_size_c
- unsigned int size)
- {
- /* AMD errata T13 (order #21922) */
-- if ((c->x86 == 6)) {
-+ if (c->x86 == 6) {
- /* Duron Rev A0 */
- if (c->x86_model == 3 && c->x86_mask == 0)
- size = 64;
-diff -urNp linux-2.6.32.45/arch/x86/kernel/cpu/common.c linux-2.6.32.45/arch/x86/kernel/cpu/common.c
---- linux-2.6.32.45/arch/x86/kernel/cpu/common.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/cpu/common.c 2011-05-11 18:25:15.000000000 -0400
-@@ -83,60 +83,6 @@ static const struct cpu_dev __cpuinitcon
-
- static const struct cpu_dev *this_cpu __cpuinitdata = &default_cpu;
-
--DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = {
--#ifdef CONFIG_X86_64
-- /*
-- * We need valid kernel segments for data and code in long mode too
-- * IRET will check the segment types kkeil 2000/10/28
-- * Also sysret mandates a special GDT layout
-- *
-- * TLS descriptors are currently at a different place compared to i386.
-- * Hopefully nobody expects them at a fixed place (Wine?)
-- */
-- [GDT_ENTRY_KERNEL32_CS] = GDT_ENTRY_INIT(0xc09b, 0, 0xfffff),
-- [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xa09b, 0, 0xfffff),
-- [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc093, 0, 0xfffff),
-- [GDT_ENTRY_DEFAULT_USER32_CS] = GDT_ENTRY_INIT(0xc0fb, 0, 0xfffff),
-- [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f3, 0, 0xfffff),
-- [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xa0fb, 0, 0xfffff),
--#else
-- [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xc09a, 0, 0xfffff),
-- [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
-- [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xc0fa, 0, 0xfffff),
-- [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f2, 0, 0xfffff),
-- /*
-- * Segments used for calling PnP BIOS have byte granularity.
-- * They code segments and data segments have fixed 64k limits,
-- * the transfer segment sizes are set at run time.
-- */
-- /* 32-bit code */
-- [GDT_ENTRY_PNPBIOS_CS32] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
-- /* 16-bit code */
-- [GDT_ENTRY_PNPBIOS_CS16] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
-- /* 16-bit data */
-- [GDT_ENTRY_PNPBIOS_DS] = GDT_ENTRY_INIT(0x0092, 0, 0xffff),
-- /* 16-bit data */
-- [GDT_ENTRY_PNPBIOS_TS1] = GDT_ENTRY_INIT(0x0092, 0, 0),
-- /* 16-bit data */
-- [GDT_ENTRY_PNPBIOS_TS2] = GDT_ENTRY_INIT(0x0092, 0, 0),
-- /*
-- * The APM segments have byte granularity and their bases
-- * are set at run time. All have 64k limits.
-- */
-- /* 32-bit code */
-- [GDT_ENTRY_APMBIOS_BASE] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
-- /* 16-bit code */
-- [GDT_ENTRY_APMBIOS_BASE+1] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
-- /* data */
-- [GDT_ENTRY_APMBIOS_BASE+2] = GDT_ENTRY_INIT(0x4092, 0, 0xffff),
--
-- [GDT_ENTRY_ESPFIX_SS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
-- [GDT_ENTRY_PERCPU] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
-- GDT_STACK_CANARY_INIT
--#endif
--} };
--EXPORT_PER_CPU_SYMBOL_GPL(gdt_page);
--
- static int __init x86_xsave_setup(char *s)
- {
- setup_clear_cpu_cap(X86_FEATURE_XSAVE);
-@@ -344,7 +290,7 @@ void switch_to_new_gdt(int cpu)
- {
- struct desc_ptr gdt_descr;
-
-- gdt_descr.address = (long)get_cpu_gdt_table(cpu);
-+ gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
- gdt_descr.size = GDT_SIZE - 1;
- load_gdt(&gdt_descr);
- /* Reload the per-cpu base */
-@@ -798,6 +744,10 @@ static void __cpuinit identify_cpu(struc
- /* Filter out anything that depends on CPUID levels we don't have */
- filter_cpuid_features(c, true);
-
-+#if defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_KERNEXEC) || (defined(CONFIG_PAX_MEMORY_UDEREF) && defined(CONFIG_X86_32))
-+ setup_clear_cpu_cap(X86_FEATURE_SEP);
-+#endif
-+
- /* If the model name is still unset, do table lookup. */
- if (!c->x86_model_id[0]) {
- const char *p;
-@@ -980,6 +930,9 @@ static __init int setup_disablecpuid(cha
- }
- __setup("clearcpuid=", setup_disablecpuid);
-
-+DEFINE_PER_CPU(struct thread_info *, current_tinfo) = &init_task.tinfo;
-+EXPORT_PER_CPU_SYMBOL(current_tinfo);
-+
- #ifdef CONFIG_X86_64
- struct desc_ptr idt_descr = { NR_VECTORS * 16 - 1, (unsigned long) idt_table };
-
-@@ -995,7 +948,7 @@ DEFINE_PER_CPU(struct task_struct *, cur
- EXPORT_PER_CPU_SYMBOL(current_task);
-
- DEFINE_PER_CPU(unsigned long, kernel_stack) =
-- (unsigned long)&init_thread_union - KERNEL_STACK_OFFSET + THREAD_SIZE;
-+ (unsigned long)&init_thread_union - 16 + THREAD_SIZE;
- EXPORT_PER_CPU_SYMBOL(kernel_stack);
-
- DEFINE_PER_CPU(char *, irq_stack_ptr) =
-@@ -1060,7 +1013,7 @@ struct pt_regs * __cpuinit idle_regs(str
- {
- memset(regs, 0, sizeof(struct pt_regs));
- regs->fs = __KERNEL_PERCPU;
-- regs->gs = __KERNEL_STACK_CANARY;
-+ savesegment(gs, regs->gs);
-
- return regs;
- }
-@@ -1101,7 +1054,7 @@ void __cpuinit cpu_init(void)
- int i;
-
- cpu = stack_smp_processor_id();
-- t = &per_cpu(init_tss, cpu);
-+ t = init_tss + cpu;
- orig_ist = &per_cpu(orig_ist, cpu);
-
- #ifdef CONFIG_NUMA
-@@ -1127,7 +1080,7 @@ void __cpuinit cpu_init(void)
- switch_to_new_gdt(cpu);
- loadsegment(fs, 0);
-
-- load_idt((const struct desc_ptr *)&idt_descr);
-+ load_idt(&idt_descr);
-
- memset(me->thread.tls_array, 0, GDT_ENTRY_TLS_ENTRIES * 8);
- syscall_init();
-@@ -1136,7 +1089,6 @@ void __cpuinit cpu_init(void)
- wrmsrl(MSR_KERNEL_GS_BASE, 0);
- barrier();
-
-- check_efer();
- if (cpu != 0)
- enable_x2apic();
-
-@@ -1199,7 +1151,7 @@ void __cpuinit cpu_init(void)
- {
- int cpu = smp_processor_id();
- struct task_struct *curr = current;
-- struct tss_struct *t = &per_cpu(init_tss, cpu);
-+ struct tss_struct *t = init_tss + cpu;
- struct thread_struct *thread = &curr->thread;
-
- if (cpumask_test_and_set_cpu(cpu, cpu_initialized_mask)) {
-diff -urNp linux-2.6.32.45/arch/x86/kernel/cpu/intel.c linux-2.6.32.45/arch/x86/kernel/cpu/intel.c
---- linux-2.6.32.45/arch/x86/kernel/cpu/intel.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/cpu/intel.c 2011-04-17 15:56:46.000000000 -0400
-@@ -162,7 +162,7 @@ static void __cpuinit trap_init_f00f_bug
- * Update the IDT descriptor and reload the IDT so that
- * it uses the read-only mapped virtual address.
- */
-- idt_descr.address = fix_to_virt(FIX_F00F_IDT);
-+ idt_descr.address = (struct desc_struct *)fix_to_virt(FIX_F00F_IDT);
- load_idt(&idt_descr);
- }
- #endif
-diff -urNp linux-2.6.32.45/arch/x86/kernel/cpu/intel_cacheinfo.c linux-2.6.32.45/arch/x86/kernel/cpu/intel_cacheinfo.c
---- linux-2.6.32.45/arch/x86/kernel/cpu/intel_cacheinfo.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/cpu/intel_cacheinfo.c 2011-04-17 15:56:46.000000000 -0400
-@@ -921,7 +921,7 @@ static ssize_t store(struct kobject *kob
- return ret;
- }
-
--static struct sysfs_ops sysfs_ops = {
-+static const struct sysfs_ops sysfs_ops = {
- .show = show,
- .store = store,
- };
-diff -urNp linux-2.6.32.45/arch/x86/kernel/cpu/Makefile linux-2.6.32.45/arch/x86/kernel/cpu/Makefile
---- linux-2.6.32.45/arch/x86/kernel/cpu/Makefile 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/cpu/Makefile 2011-04-17 15:56:46.000000000 -0400
-@@ -7,10 +7,6 @@ ifdef CONFIG_FUNCTION_TRACER
- CFLAGS_REMOVE_common.o = -pg
- endif
-
--# Make sure load_percpu_segment has no stackprotector
--nostackp := $(call cc-option, -fno-stack-protector)
--CFLAGS_common.o := $(nostackp)
--
- obj-y := intel_cacheinfo.o addon_cpuid_features.o
- obj-y += proc.o capflags.o powerflags.o common.o
- obj-y += vmware.o hypervisor.o sched.o
-diff -urNp linux-2.6.32.45/arch/x86/kernel/cpu/mcheck/mce_amd.c linux-2.6.32.45/arch/x86/kernel/cpu/mcheck/mce_amd.c
---- linux-2.6.32.45/arch/x86/kernel/cpu/mcheck/mce_amd.c 2011-05-23 16:56:59.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/cpu/mcheck/mce_amd.c 2011-05-23 16:57:13.000000000 -0400
-@@ -385,7 +385,7 @@ static ssize_t store(struct kobject *kob
- return ret;
- }
-
--static struct sysfs_ops threshold_ops = {
-+static const struct sysfs_ops threshold_ops = {
- .show = show,
- .store = store,
- };
-diff -urNp linux-2.6.32.45/arch/x86/kernel/cpu/mcheck/mce.c linux-2.6.32.45/arch/x86/kernel/cpu/mcheck/mce.c
---- linux-2.6.32.45/arch/x86/kernel/cpu/mcheck/mce.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/cpu/mcheck/mce.c 2011-05-04 17:56:20.000000000 -0400
-@@ -43,6 +43,7 @@
- #include <asm/ipi.h>
- #include <asm/mce.h>
- #include <asm/msr.h>
-+#include <asm/local.h>
-
- #include "mce-internal.h"
-
-@@ -187,7 +188,7 @@ static void print_mce(struct mce *m)
- !(m->mcgstatus & MCG_STATUS_EIPV) ? " !INEXACT!" : "",
- m->cs, m->ip);
-
-- if (m->cs == __KERNEL_CS)
-+ if (m->cs == __KERNEL_CS || m->cs == __KERNEXEC_KERNEL_CS)
- print_symbol("{%s}", m->ip);
- pr_cont("\n");
- }
-@@ -221,10 +222,10 @@ static void print_mce_tail(void)
-
- #define PANIC_TIMEOUT 5 /* 5 seconds */
-
--static atomic_t mce_paniced;
-+static atomic_unchecked_t mce_paniced;
-
- static int fake_panic;
--static atomic_t mce_fake_paniced;
-+static atomic_unchecked_t mce_fake_paniced;
-
- /* Panic in progress. Enable interrupts and wait for final IPI */
- static void wait_for_panic(void)
-@@ -248,7 +249,7 @@ static void mce_panic(char *msg, struct
- /*
- * Make sure only one CPU runs in machine check panic
- */
-- if (atomic_inc_return(&mce_paniced) > 1)
-+ if (atomic_inc_return_unchecked(&mce_paniced) > 1)
- wait_for_panic();
- barrier();
-
-@@ -256,7 +257,7 @@ static void mce_panic(char *msg, struct
- console_verbose();
- } else {
- /* Don't log too much for fake panic */
-- if (atomic_inc_return(&mce_fake_paniced) > 1)
-+ if (atomic_inc_return_unchecked(&mce_fake_paniced) > 1)
- return;
- }
- print_mce_head();
-@@ -616,7 +617,7 @@ static int mce_timed_out(u64 *t)
- * might have been modified by someone else.
- */
- rmb();
-- if (atomic_read(&mce_paniced))
-+ if (atomic_read_unchecked(&mce_paniced))
- wait_for_panic();
- if (!monarch_timeout)
- goto out;
-@@ -1429,14 +1430,14 @@ void __cpuinit mcheck_init(struct cpuinf
- */
-
- static DEFINE_SPINLOCK(mce_state_lock);
--static int open_count; /* #times opened */
-+static local_t open_count; /* #times opened */
- static int open_exclu; /* already open exclusive? */
-
- static int mce_open(struct inode *inode, struct file *file)
- {
- spin_lock(&mce_state_lock);
-
-- if (open_exclu || (open_count && (file->f_flags & O_EXCL))) {
-+ if (open_exclu || (local_read(&open_count) && (file->f_flags & O_EXCL))) {
- spin_unlock(&mce_state_lock);
-
- return -EBUSY;
-@@ -1444,7 +1445,7 @@ static int mce_open(struct inode *inode,
-
- if (file->f_flags & O_EXCL)
- open_exclu = 1;
-- open_count++;
-+ local_inc(&open_count);
-
- spin_unlock(&mce_state_lock);
-
-@@ -1455,7 +1456,7 @@ static int mce_release(struct inode *ino
- {
- spin_lock(&mce_state_lock);
-
-- open_count--;
-+ local_dec(&open_count);
- open_exclu = 0;
-
- spin_unlock(&mce_state_lock);
-@@ -2082,7 +2083,7 @@ struct dentry *mce_get_debugfs_dir(void)
- static void mce_reset(void)
- {
- cpu_missing = 0;
-- atomic_set(&mce_fake_paniced, 0);
-+ atomic_set_unchecked(&mce_fake_paniced, 0);
- atomic_set(&mce_executing, 0);
- atomic_set(&mce_callin, 0);
- atomic_set(&global_nwo, 0);
-diff -urNp linux-2.6.32.45/arch/x86/kernel/cpu/mcheck/mce-inject.c linux-2.6.32.45/arch/x86/kernel/cpu/mcheck/mce-inject.c
---- linux-2.6.32.45/arch/x86/kernel/cpu/mcheck/mce-inject.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/cpu/mcheck/mce-inject.c 2011-08-05 20:33:55.000000000 -0400
-@@ -211,7 +211,9 @@ static ssize_t mce_write(struct file *fi
- static int inject_init(void)
- {
- printk(KERN_INFO "Machine check injector initialized\n");
-- mce_chrdev_ops.write = mce_write;
-+ pax_open_kernel();
-+ *(void **)&mce_chrdev_ops.write = mce_write;
-+ pax_close_kernel();
- register_die_notifier(&mce_raise_nb);
- return 0;
- }
-diff -urNp linux-2.6.32.45/arch/x86/kernel/cpu/mtrr/amd.c linux-2.6.32.45/arch/x86/kernel/cpu/mtrr/amd.c
---- linux-2.6.32.45/arch/x86/kernel/cpu/mtrr/amd.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/cpu/mtrr/amd.c 2011-04-17 15:56:46.000000000 -0400
-@@ -108,7 +108,7 @@ amd_validate_add_page(unsigned long base
- return 0;
- }
-
--static struct mtrr_ops amd_mtrr_ops = {
-+static const struct mtrr_ops amd_mtrr_ops = {
- .vendor = X86_VENDOR_AMD,
- .set = amd_set_mtrr,
- .get = amd_get_mtrr,
-diff -urNp linux-2.6.32.45/arch/x86/kernel/cpu/mtrr/centaur.c linux-2.6.32.45/arch/x86/kernel/cpu/mtrr/centaur.c
---- linux-2.6.32.45/arch/x86/kernel/cpu/mtrr/centaur.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/cpu/mtrr/centaur.c 2011-04-17 15:56:46.000000000 -0400
-@@ -110,7 +110,7 @@ centaur_validate_add_page(unsigned long
- return 0;
- }
-
--static struct mtrr_ops centaur_mtrr_ops = {
-+static const struct mtrr_ops centaur_mtrr_ops = {
- .vendor = X86_VENDOR_CENTAUR,
- .set = centaur_set_mcr,
- .get = centaur_get_mcr,
-diff -urNp linux-2.6.32.45/arch/x86/kernel/cpu/mtrr/cyrix.c linux-2.6.32.45/arch/x86/kernel/cpu/mtrr/cyrix.c
---- linux-2.6.32.45/arch/x86/kernel/cpu/mtrr/cyrix.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/cpu/mtrr/cyrix.c 2011-04-17 15:56:46.000000000 -0400
-@@ -265,7 +265,7 @@ static void cyrix_set_all(void)
- post_set();
- }
-
--static struct mtrr_ops cyrix_mtrr_ops = {
-+static const struct mtrr_ops cyrix_mtrr_ops = {
- .vendor = X86_VENDOR_CYRIX,
- .set_all = cyrix_set_all,
- .set = cyrix_set_arr,
-diff -urNp linux-2.6.32.45/arch/x86/kernel/cpu/mtrr/generic.c linux-2.6.32.45/arch/x86/kernel/cpu/mtrr/generic.c
---- linux-2.6.32.45/arch/x86/kernel/cpu/mtrr/generic.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/cpu/mtrr/generic.c 2011-04-23 12:56:10.000000000 -0400
-@@ -752,7 +752,7 @@ int positive_have_wrcomb(void)
- /*
- * Generic structure...
- */
--struct mtrr_ops generic_mtrr_ops = {
-+const struct mtrr_ops generic_mtrr_ops = {
- .use_intel_if = 1,
- .set_all = generic_set_all,
- .get = generic_get_mtrr,
-diff -urNp linux-2.6.32.45/arch/x86/kernel/cpu/mtrr/main.c linux-2.6.32.45/arch/x86/kernel/cpu/mtrr/main.c
---- linux-2.6.32.45/arch/x86/kernel/cpu/mtrr/main.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/cpu/mtrr/main.c 2011-04-17 17:03:05.000000000 -0400
-@@ -60,14 +60,14 @@ static DEFINE_MUTEX(mtrr_mutex);
- u64 size_or_mask, size_and_mask;
- static bool mtrr_aps_delayed_init;
-
--static struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM];
-+static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM] __read_only;
-
--struct mtrr_ops *mtrr_if;
-+const struct mtrr_ops *mtrr_if;
-
- static void set_mtrr(unsigned int reg, unsigned long base,
- unsigned long size, mtrr_type type);
-
--void set_mtrr_ops(struct mtrr_ops *ops)
-+void set_mtrr_ops(const struct mtrr_ops *ops)
- {
- if (ops->vendor && ops->vendor < X86_VENDOR_NUM)
- mtrr_ops[ops->vendor] = ops;
-diff -urNp linux-2.6.32.45/arch/x86/kernel/cpu/mtrr/mtrr.h linux-2.6.32.45/arch/x86/kernel/cpu/mtrr/mtrr.h
---- linux-2.6.32.45/arch/x86/kernel/cpu/mtrr/mtrr.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/cpu/mtrr/mtrr.h 2011-04-17 15:56:46.000000000 -0400
-@@ -12,19 +12,19 @@
- extern unsigned int mtrr_usage_table[MTRR_MAX_VAR_RANGES];
-
- struct mtrr_ops {
-- u32 vendor;
-- u32 use_intel_if;
-- void (*set)(unsigned int reg, unsigned long base,
-+ const u32 vendor;
-+ const u32 use_intel_if;
-+ void (* const set)(unsigned int reg, unsigned long base,
- unsigned long size, mtrr_type type);
-- void (*set_all)(void);
-+ void (* const set_all)(void);
-
-- void (*get)(unsigned int reg, unsigned long *base,
-+ void (* const get)(unsigned int reg, unsigned long *base,
- unsigned long *size, mtrr_type *type);
-- int (*get_free_region)(unsigned long base, unsigned long size,
-+ int (* const get_free_region)(unsigned long base, unsigned long size,
- int replace_reg);
-- int (*validate_add_page)(unsigned long base, unsigned long size,
-+ int (* const validate_add_page)(unsigned long base, unsigned long size,
- unsigned int type);
-- int (*have_wrcomb)(void);
-+ int (* const have_wrcomb)(void);
- };
-
- extern int generic_get_free_region(unsigned long base, unsigned long size,
-@@ -32,7 +32,7 @@ extern int generic_get_free_region(unsig
- extern int generic_validate_add_page(unsigned long base, unsigned long size,
- unsigned int type);
-
--extern struct mtrr_ops generic_mtrr_ops;
-+extern const struct mtrr_ops generic_mtrr_ops;
-
- extern int positive_have_wrcomb(void);
-
-@@ -53,10 +53,10 @@ void fill_mtrr_var_range(unsigned int in
- u32 base_lo, u32 base_hi, u32 mask_lo, u32 mask_hi);
- void get_mtrr_state(void);
-
--extern void set_mtrr_ops(struct mtrr_ops *ops);
-+extern void set_mtrr_ops(const struct mtrr_ops *ops);
-
- extern u64 size_or_mask, size_and_mask;
--extern struct mtrr_ops *mtrr_if;
-+extern const struct mtrr_ops *mtrr_if;
-
- #define is_cpu(vnd) (mtrr_if && mtrr_if->vendor == X86_VENDOR_##vnd)
- #define use_intel() (mtrr_if && mtrr_if->use_intel_if == 1)
-diff -urNp linux-2.6.32.45/arch/x86/kernel/cpu/perfctr-watchdog.c linux-2.6.32.45/arch/x86/kernel/cpu/perfctr-watchdog.c
---- linux-2.6.32.45/arch/x86/kernel/cpu/perfctr-watchdog.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/cpu/perfctr-watchdog.c 2011-04-17 15:56:46.000000000 -0400
-@@ -30,11 +30,11 @@ struct nmi_watchdog_ctlblk {
-
- /* Interface defining a CPU specific perfctr watchdog */
- struct wd_ops {
-- int (*reserve)(void);
-- void (*unreserve)(void);
-- int (*setup)(unsigned nmi_hz);
-- void (*rearm)(struct nmi_watchdog_ctlblk *wd, unsigned nmi_hz);
-- void (*stop)(void);
-+ int (* const reserve)(void);
-+ void (* const unreserve)(void);
-+ int (* const setup)(unsigned nmi_hz);
-+ void (* const rearm)(struct nmi_watchdog_ctlblk *wd, unsigned nmi_hz);
-+ void (* const stop)(void);
- unsigned perfctr;
- unsigned evntsel;
- u64 checkbit;
-@@ -645,6 +645,7 @@ static const struct wd_ops p4_wd_ops = {
- #define ARCH_PERFMON_NMI_EVENT_SEL ARCH_PERFMON_UNHALTED_CORE_CYCLES_SEL
- #define ARCH_PERFMON_NMI_EVENT_UMASK ARCH_PERFMON_UNHALTED_CORE_CYCLES_UMASK
-
-+/* cannot be const */
- static struct wd_ops intel_arch_wd_ops;
-
- static int setup_intel_arch_watchdog(unsigned nmi_hz)
-@@ -697,6 +698,7 @@ static int setup_intel_arch_watchdog(uns
- return 1;
- }
-
-+/* cannot be const */
- static struct wd_ops intel_arch_wd_ops __read_mostly = {
- .reserve = single_msr_reserve,
- .unreserve = single_msr_unreserve,
-diff -urNp linux-2.6.32.45/arch/x86/kernel/cpu/perf_event.c linux-2.6.32.45/arch/x86/kernel/cpu/perf_event.c
---- linux-2.6.32.45/arch/x86/kernel/cpu/perf_event.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/cpu/perf_event.c 2011-05-04 17:56:20.000000000 -0400
-@@ -723,10 +723,10 @@ x86_perf_event_update(struct perf_event
- * count to the generic event atomically:
- */
- again:
-- prev_raw_count = atomic64_read(&hwc->prev_count);
-+ prev_raw_count = atomic64_read_unchecked(&hwc->prev_count);
- rdmsrl(hwc->event_base + idx, new_raw_count);
-
-- if (atomic64_cmpxchg(&hwc->prev_count, prev_raw_count,
-+ if (atomic64_cmpxchg_unchecked(&hwc->prev_count, prev_raw_count,
- new_raw_count) != prev_raw_count)
- goto again;
-
-@@ -741,7 +741,7 @@ again:
- delta = (new_raw_count << shift) - (prev_raw_count << shift);
- delta >>= shift;
-
-- atomic64_add(delta, &event->count);
-+ atomic64_add_unchecked(delta, &event->count);
- atomic64_sub(delta, &hwc->period_left);
-
- return new_raw_count;
-@@ -1353,7 +1353,7 @@ x86_perf_event_set_period(struct perf_ev
- * The hw event starts counting from this event offset,
- * mark it to be able to extra future deltas:
- */
-- atomic64_set(&hwc->prev_count, (u64)-left);
-+ atomic64_set_unchecked(&hwc->prev_count, (u64)-left);
-
- err = checking_wrmsrl(hwc->event_base + idx,
- (u64)(-left) & x86_pmu.event_mask);
-@@ -2357,7 +2357,7 @@ perf_callchain_user(struct pt_regs *regs
- break;
-
- callchain_store(entry, frame.return_address);
-- fp = frame.next_frame;
-+ fp = (__force const void __user *)frame.next_frame;
- }
- }
-
-diff -urNp linux-2.6.32.45/arch/x86/kernel/crash.c linux-2.6.32.45/arch/x86/kernel/crash.c
---- linux-2.6.32.45/arch/x86/kernel/crash.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/crash.c 2011-04-17 15:56:46.000000000 -0400
-@@ -41,7 +41,7 @@ static void kdump_nmi_callback(int cpu,
- regs = args->regs;
-
- #ifdef CONFIG_X86_32
-- if (!user_mode_vm(regs)) {
-+ if (!user_mode(regs)) {
- crash_fixup_ss_esp(&fixed_regs, regs);
- regs = &fixed_regs;
- }
-diff -urNp linux-2.6.32.45/arch/x86/kernel/doublefault_32.c linux-2.6.32.45/arch/x86/kernel/doublefault_32.c
---- linux-2.6.32.45/arch/x86/kernel/doublefault_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/doublefault_32.c 2011-04-17 15:56:46.000000000 -0400
-@@ -11,7 +11,7 @@
-
- #define DOUBLEFAULT_STACKSIZE (1024)
- static unsigned long doublefault_stack[DOUBLEFAULT_STACKSIZE];
--#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE)
-+#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE-2)
-
- #define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + MAXMEM)
-
-@@ -21,7 +21,7 @@ static void doublefault_fn(void)
- unsigned long gdt, tss;
-
- store_gdt(&gdt_desc);
-- gdt = gdt_desc.address;
-+ gdt = (unsigned long)gdt_desc.address;
-
- printk(KERN_EMERG "PANIC: double fault, gdt at %08lx [%d bytes]\n", gdt, gdt_desc.size);
-
-@@ -58,10 +58,10 @@ struct tss_struct doublefault_tss __cach
- /* 0x2 bit is always set */
- .flags = X86_EFLAGS_SF | 0x2,
- .sp = STACK_START,
-- .es = __USER_DS,
-+ .es = __KERNEL_DS,
- .cs = __KERNEL_CS,
- .ss = __KERNEL_DS,
-- .ds = __USER_DS,
-+ .ds = __KERNEL_DS,
- .fs = __KERNEL_PERCPU,
-
- .__cr3 = __pa_nodebug(swapper_pg_dir),
-diff -urNp linux-2.6.32.45/arch/x86/kernel/dumpstack_32.c linux-2.6.32.45/arch/x86/kernel/dumpstack_32.c
---- linux-2.6.32.45/arch/x86/kernel/dumpstack_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/dumpstack_32.c 2011-04-17 15:56:46.000000000 -0400
-@@ -53,16 +53,12 @@ void dump_trace(struct task_struct *task
- #endif
-
- for (;;) {
-- struct thread_info *context;
-+ void *stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
-+ bp = print_context_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
-
-- context = (struct thread_info *)
-- ((unsigned long)stack & (~(THREAD_SIZE - 1)));
-- bp = print_context_stack(context, stack, bp, ops,
-- data, NULL, &graph);
--
-- stack = (unsigned long *)context->previous_esp;
-- if (!stack)
-+ if (stack_start == task_stack_page(task))
- break;
-+ stack = *(unsigned long **)stack_start;
- if (ops->stack(data, "IRQ") < 0)
- break;
- touch_nmi_watchdog();
-@@ -112,11 +108,12 @@ void show_registers(struct pt_regs *regs
- * When in-kernel, we also print out the stack and code at the
- * time of the fault..
- */
-- if (!user_mode_vm(regs)) {
-+ if (!user_mode(regs)) {
- unsigned int code_prologue = code_bytes * 43 / 64;
- unsigned int code_len = code_bytes;
- unsigned char c;
- u8 *ip;
-+ unsigned long cs_base = get_desc_base(&get_cpu_gdt_table(smp_processor_id())[(0xffff & regs->cs) >> 3]);
-
- printk(KERN_EMERG "Stack:\n");
- show_stack_log_lvl(NULL, regs, ®s->sp,
-@@ -124,10 +121,10 @@ void show_registers(struct pt_regs *regs
-
- printk(KERN_EMERG "Code: ");
-
-- ip = (u8 *)regs->ip - code_prologue;
-+ ip = (u8 *)regs->ip - code_prologue + cs_base;
- if (ip < (u8 *)PAGE_OFFSET || probe_kernel_address(ip, c)) {
- /* try starting at IP */
-- ip = (u8 *)regs->ip;
-+ ip = (u8 *)regs->ip + cs_base;
- code_len = code_len - code_prologue + 1;
- }
- for (i = 0; i < code_len; i++, ip++) {
-@@ -136,7 +133,7 @@ void show_registers(struct pt_regs *regs
- printk(" Bad EIP value.");
- break;
- }
-- if (ip == (u8 *)regs->ip)
-+ if (ip == (u8 *)regs->ip + cs_base)
- printk("<%02x> ", c);
- else
- printk("%02x ", c);
-@@ -149,6 +146,7 @@ int is_valid_bugaddr(unsigned long ip)
- {
- unsigned short ud2;
-
-+ ip = ktla_ktva(ip);
- if (ip < PAGE_OFFSET)
- return 0;
- if (probe_kernel_address((unsigned short *)ip, ud2))
-diff -urNp linux-2.6.32.45/arch/x86/kernel/dumpstack_64.c linux-2.6.32.45/arch/x86/kernel/dumpstack_64.c
---- linux-2.6.32.45/arch/x86/kernel/dumpstack_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/dumpstack_64.c 2011-04-17 15:56:46.000000000 -0400
-@@ -116,8 +116,8 @@ void dump_trace(struct task_struct *task
- unsigned long *irq_stack_end =
- (unsigned long *)per_cpu(irq_stack_ptr, cpu);
- unsigned used = 0;
-- struct thread_info *tinfo;
- int graph = 0;
-+ void *stack_start;
-
- if (!task)
- task = current;
-@@ -146,10 +146,10 @@ void dump_trace(struct task_struct *task
- * current stack address. If the stacks consist of nested
- * exceptions
- */
-- tinfo = task_thread_info(task);
- for (;;) {
- char *id;
- unsigned long *estack_end;
-+
- estack_end = in_exception_stack(cpu, (unsigned long)stack,
- &used, &id);
-
-@@ -157,7 +157,7 @@ void dump_trace(struct task_struct *task
- if (ops->stack(data, id) < 0)
- break;
-
-- bp = print_context_stack(tinfo, stack, bp, ops,
-+ bp = print_context_stack(task, estack_end - EXCEPTION_STKSZ, stack, bp, ops,
- data, estack_end, &graph);
- ops->stack(data, "<EOE>");
- /*
-@@ -176,7 +176,7 @@ void dump_trace(struct task_struct *task
- if (stack >= irq_stack && stack < irq_stack_end) {
- if (ops->stack(data, "IRQ") < 0)
- break;
-- bp = print_context_stack(tinfo, stack, bp,
-+ bp = print_context_stack(task, irq_stack, stack, bp,
- ops, data, irq_stack_end, &graph);
- /*
- * We link to the next stack (which would be
-@@ -195,7 +195,8 @@ void dump_trace(struct task_struct *task
- /*
- * This handles the process stack:
- */
-- bp = print_context_stack(tinfo, stack, bp, ops, data, NULL, &graph);
-+ stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
-+ bp = print_context_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
- put_cpu();
- }
- EXPORT_SYMBOL(dump_trace);
-diff -urNp linux-2.6.32.45/arch/x86/kernel/dumpstack.c linux-2.6.32.45/arch/x86/kernel/dumpstack.c
---- linux-2.6.32.45/arch/x86/kernel/dumpstack.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/dumpstack.c 2011-04-17 15:56:46.000000000 -0400
-@@ -2,6 +2,9 @@
- * Copyright (C) 1991, 1992 Linus Torvalds
- * Copyright (C) 2000, 2001, 2002 Andi Kleen, SuSE Labs
- */
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+#define __INCLUDED_BY_HIDESYM 1
-+#endif
- #include <linux/kallsyms.h>
- #include <linux/kprobes.h>
- #include <linux/uaccess.h>
-@@ -28,7 +31,7 @@ static int die_counter;
-
- void printk_address(unsigned long address, int reliable)
- {
-- printk(" [<%p>] %s%pS\n", (void *) address,
-+ printk(" [<%p>] %s%pA\n", (void *) address,
- reliable ? "" : "? ", (void *) address);
- }
-
-@@ -36,9 +39,8 @@ void printk_address(unsigned long addres
- static void
- print_ftrace_graph_addr(unsigned long addr, void *data,
- const struct stacktrace_ops *ops,
-- struct thread_info *tinfo, int *graph)
-+ struct task_struct *task, int *graph)
- {
-- struct task_struct *task = tinfo->task;
- unsigned long ret_addr;
- int index = task->curr_ret_stack;
-
-@@ -59,7 +61,7 @@ print_ftrace_graph_addr(unsigned long ad
- static inline void
- print_ftrace_graph_addr(unsigned long addr, void *data,
- const struct stacktrace_ops *ops,
-- struct thread_info *tinfo, int *graph)
-+ struct task_struct *task, int *graph)
- { }
- #endif
-
-@@ -70,10 +72,8 @@ print_ftrace_graph_addr(unsigned long ad
- * severe exception (double fault, nmi, stack fault, debug, mce) hardware stack
- */
-
--static inline int valid_stack_ptr(struct thread_info *tinfo,
-- void *p, unsigned int size, void *end)
-+static inline int valid_stack_ptr(void *t, void *p, unsigned int size, void *end)
- {
-- void *t = tinfo;
- if (end) {
- if (p < end && p >= (end-THREAD_SIZE))
- return 1;
-@@ -84,14 +84,14 @@ static inline int valid_stack_ptr(struct
- }
-
- unsigned long
--print_context_stack(struct thread_info *tinfo,
-+print_context_stack(struct task_struct *task, void *stack_start,
- unsigned long *stack, unsigned long bp,
- const struct stacktrace_ops *ops, void *data,
- unsigned long *end, int *graph)
- {
- struct stack_frame *frame = (struct stack_frame *)bp;
-
-- while (valid_stack_ptr(tinfo, stack, sizeof(*stack), end)) {
-+ while (valid_stack_ptr(stack_start, stack, sizeof(*stack), end)) {
- unsigned long addr;
-
- addr = *stack;
-@@ -103,7 +103,7 @@ print_context_stack(struct thread_info *
- } else {
- ops->address(data, addr, 0);
- }
-- print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
-+ print_ftrace_graph_addr(addr, data, ops, task, graph);
- }
- stack++;
- }
-@@ -180,7 +180,7 @@ void dump_stack(void)
- #endif
-
- printk("Pid: %d, comm: %.20s %s %s %.*s\n",
-- current->pid, current->comm, print_tainted(),
-+ task_pid_nr(current), current->comm, print_tainted(),
- init_utsname()->release,
- (int)strcspn(init_utsname()->version, " "),
- init_utsname()->version);
-@@ -220,6 +220,8 @@ unsigned __kprobes long oops_begin(void)
- return flags;
- }
-
-+extern void gr_handle_kernel_exploit(void);
-+
- void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr)
- {
- if (regs && kexec_should_crash(current))
-@@ -241,7 +243,10 @@ void __kprobes oops_end(unsigned long fl
- panic("Fatal exception in interrupt");
- if (panic_on_oops)
- panic("Fatal exception");
-- do_exit(signr);
-+
-+ gr_handle_kernel_exploit();
-+
-+ do_group_exit(signr);
- }
-
- int __kprobes __die(const char *str, struct pt_regs *regs, long err)
-@@ -295,7 +300,7 @@ void die(const char *str, struct pt_regs
- unsigned long flags = oops_begin();
- int sig = SIGSEGV;
-
-- if (!user_mode_vm(regs))
-+ if (!user_mode(regs))
- report_bug(regs->ip, regs);
-
- if (__die(str, regs, err))
-diff -urNp linux-2.6.32.45/arch/x86/kernel/dumpstack.h linux-2.6.32.45/arch/x86/kernel/dumpstack.h
---- linux-2.6.32.45/arch/x86/kernel/dumpstack.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/dumpstack.h 2011-04-23 13:25:26.000000000 -0400
-@@ -15,7 +15,7 @@
- #endif
-
- extern unsigned long
--print_context_stack(struct thread_info *tinfo,
-+print_context_stack(struct task_struct *task, void *stack_start,
- unsigned long *stack, unsigned long bp,
- const struct stacktrace_ops *ops, void *data,
- unsigned long *end, int *graph);
-diff -urNp linux-2.6.32.45/arch/x86/kernel/e820.c linux-2.6.32.45/arch/x86/kernel/e820.c
---- linux-2.6.32.45/arch/x86/kernel/e820.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/e820.c 2011-04-17 15:56:46.000000000 -0400
-@@ -733,7 +733,7 @@ struct early_res {
- };
- static struct early_res early_res[MAX_EARLY_RES] __initdata = {
- { 0, PAGE_SIZE, "BIOS data page" }, /* BIOS data page */
-- {}
-+ { 0, 0, {0}, 0 }
- };
-
- static int __init find_overlapped_early(u64 start, u64 end)
-diff -urNp linux-2.6.32.45/arch/x86/kernel/early_printk.c linux-2.6.32.45/arch/x86/kernel/early_printk.c
---- linux-2.6.32.45/arch/x86/kernel/early_printk.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/early_printk.c 2011-05-16 21:46:57.000000000 -0400
-@@ -7,6 +7,7 @@
- #include <linux/pci_regs.h>
- #include <linux/pci_ids.h>
- #include <linux/errno.h>
-+#include <linux/sched.h>
- #include <asm/io.h>
- #include <asm/processor.h>
- #include <asm/fcntl.h>
-@@ -170,6 +171,8 @@ asmlinkage void early_printk(const char
- int n;
- va_list ap;
-
-+ pax_track_stack();
-+
- va_start(ap, fmt);
- n = vscnprintf(buf, sizeof(buf), fmt, ap);
- early_console->write(early_console, buf, n);
-diff -urNp linux-2.6.32.45/arch/x86/kernel/efi_32.c linux-2.6.32.45/arch/x86/kernel/efi_32.c
---- linux-2.6.32.45/arch/x86/kernel/efi_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/efi_32.c 2011-04-17 15:56:46.000000000 -0400
-@@ -38,70 +38,38 @@
- */
-
- static unsigned long efi_rt_eflags;
--static pgd_t efi_bak_pg_dir_pointer[2];
-+static pgd_t __initdata efi_bak_pg_dir_pointer[KERNEL_PGD_PTRS];
-
--void efi_call_phys_prelog(void)
-+void __init efi_call_phys_prelog(void)
- {
-- unsigned long cr4;
-- unsigned long temp;
- struct desc_ptr gdt_descr;
-
- local_irq_save(efi_rt_eflags);
-
-- /*
-- * If I don't have PAE, I should just duplicate two entries in page
-- * directory. If I have PAE, I just need to duplicate one entry in
-- * page directory.
-- */
-- cr4 = read_cr4_safe();
-
-- if (cr4 & X86_CR4_PAE) {
-- efi_bak_pg_dir_pointer[0].pgd =
-- swapper_pg_dir[pgd_index(0)].pgd;
-- swapper_pg_dir[0].pgd =
-- swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
-- } else {
-- efi_bak_pg_dir_pointer[0].pgd =
-- swapper_pg_dir[pgd_index(0)].pgd;
-- efi_bak_pg_dir_pointer[1].pgd =
-- swapper_pg_dir[pgd_index(0x400000)].pgd;
-- swapper_pg_dir[pgd_index(0)].pgd =
-- swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
-- temp = PAGE_OFFSET + 0x400000;
-- swapper_pg_dir[pgd_index(0x400000)].pgd =
-- swapper_pg_dir[pgd_index(temp)].pgd;
-- }
-+ clone_pgd_range(efi_bak_pg_dir_pointer, swapper_pg_dir, KERNEL_PGD_PTRS);
-+ clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-+ min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
-
- /*
- * After the lock is released, the original page table is restored.
- */
- __flush_tlb_all();
-
-- gdt_descr.address = __pa(get_cpu_gdt_table(0));
-+ gdt_descr.address = (struct desc_struct *)__pa(get_cpu_gdt_table(0));
- gdt_descr.size = GDT_SIZE - 1;
- load_gdt(&gdt_descr);
- }
-
--void efi_call_phys_epilog(void)
-+void __init efi_call_phys_epilog(void)
- {
-- unsigned long cr4;
- struct desc_ptr gdt_descr;
-
-- gdt_descr.address = (unsigned long)get_cpu_gdt_table(0);
-+ gdt_descr.address = get_cpu_gdt_table(0);
- gdt_descr.size = GDT_SIZE - 1;
- load_gdt(&gdt_descr);
-
-- cr4 = read_cr4_safe();
--
-- if (cr4 & X86_CR4_PAE) {
-- swapper_pg_dir[pgd_index(0)].pgd =
-- efi_bak_pg_dir_pointer[0].pgd;
-- } else {
-- swapper_pg_dir[pgd_index(0)].pgd =
-- efi_bak_pg_dir_pointer[0].pgd;
-- swapper_pg_dir[pgd_index(0x400000)].pgd =
-- efi_bak_pg_dir_pointer[1].pgd;
-- }
-+ clone_pgd_range(swapper_pg_dir, efi_bak_pg_dir_pointer, KERNEL_PGD_PTRS);
-
- /*
- * After the lock is released, the original page table is restored.
-diff -urNp linux-2.6.32.45/arch/x86/kernel/efi_stub_32.S linux-2.6.32.45/arch/x86/kernel/efi_stub_32.S
---- linux-2.6.32.45/arch/x86/kernel/efi_stub_32.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/efi_stub_32.S 2011-04-17 15:56:46.000000000 -0400
-@@ -6,6 +6,7 @@
- */
-
- #include <linux/linkage.h>
-+#include <linux/init.h>
- #include <asm/page_types.h>
-
- /*
-@@ -20,7 +21,7 @@
- * service functions will comply with gcc calling convention, too.
- */
-
--.text
-+__INIT
- ENTRY(efi_call_phys)
- /*
- * 0. The function can only be called in Linux kernel. So CS has been
-@@ -36,9 +37,7 @@ ENTRY(efi_call_phys)
- * The mapping of lower virtual memory has been created in prelog and
- * epilog.
- */
-- movl $1f, %edx
-- subl $__PAGE_OFFSET, %edx
-- jmp *%edx
-+ jmp 1f-__PAGE_OFFSET
- 1:
-
- /*
-@@ -47,14 +46,8 @@ ENTRY(efi_call_phys)
- * parameter 2, ..., param n. To make things easy, we save the return
- * address of efi_call_phys in a global variable.
- */
-- popl %edx
-- movl %edx, saved_return_addr
-- /* get the function pointer into ECX*/
-- popl %ecx
-- movl %ecx, efi_rt_function_ptr
-- movl $2f, %edx
-- subl $__PAGE_OFFSET, %edx
-- pushl %edx
-+ popl (saved_return_addr)
-+ popl (efi_rt_function_ptr)
-
- /*
- * 3. Clear PG bit in %CR0.
-@@ -73,9 +66,8 @@ ENTRY(efi_call_phys)
- /*
- * 5. Call the physical function.
- */
-- jmp *%ecx
-+ call *(efi_rt_function_ptr-__PAGE_OFFSET)
-
--2:
- /*
- * 6. After EFI runtime service returns, control will return to
- * following instruction. We'd better readjust stack pointer first.
-@@ -88,35 +80,28 @@ ENTRY(efi_call_phys)
- movl %cr0, %edx
- orl $0x80000000, %edx
- movl %edx, %cr0
-- jmp 1f
--1:
-+
- /*
- * 8. Now restore the virtual mode from flat mode by
- * adding EIP with PAGE_OFFSET.
- */
-- movl $1f, %edx
-- jmp *%edx
-+ jmp 1f+__PAGE_OFFSET
- 1:
-
- /*
- * 9. Balance the stack. And because EAX contain the return value,
- * we'd better not clobber it.
- */
-- leal efi_rt_function_ptr, %edx
-- movl (%edx), %ecx
-- pushl %ecx
-+ pushl (efi_rt_function_ptr)
-
- /*
-- * 10. Push the saved return address onto the stack and return.
-+ * 10. Return to the saved return address.
- */
-- leal saved_return_addr, %edx
-- movl (%edx), %ecx
-- pushl %ecx
-- ret
-+ jmpl *(saved_return_addr)
- ENDPROC(efi_call_phys)
- .previous
-
--.data
-+__INITDATA
- saved_return_addr:
- .long 0
- efi_rt_function_ptr:
-diff -urNp linux-2.6.32.45/arch/x86/kernel/entry_32.S linux-2.6.32.45/arch/x86/kernel/entry_32.S
---- linux-2.6.32.45/arch/x86/kernel/entry_32.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/entry_32.S 2011-05-22 23:02:03.000000000 -0400
-@@ -185,13 +185,146 @@
- /*CFI_REL_OFFSET gs, PT_GS*/
- .endm
- .macro SET_KERNEL_GS reg
-+
-+#ifdef CONFIG_CC_STACKPROTECTOR
- movl $(__KERNEL_STACK_CANARY), \reg
-+#elif defined(CONFIG_PAX_MEMORY_UDEREF)
-+ movl $(__USER_DS), \reg
-+#else
-+ xorl \reg, \reg
-+#endif
-+
- movl \reg, %gs
- .endm
-
- #endif /* CONFIG_X86_32_LAZY_GS */
-
--.macro SAVE_ALL
-+.macro pax_enter_kernel
-+#ifdef CONFIG_PAX_KERNEXEC
-+ call pax_enter_kernel
-+#endif
-+.endm
-+
-+.macro pax_exit_kernel
-+#ifdef CONFIG_PAX_KERNEXEC
-+ call pax_exit_kernel
-+#endif
-+.endm
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ENTRY(pax_enter_kernel)
-+#ifdef CONFIG_PARAVIRT
-+ pushl %eax
-+ pushl %ecx
-+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0)
-+ mov %eax, %esi
-+#else
-+ mov %cr0, %esi
-+#endif
-+ bts $16, %esi
-+ jnc 1f
-+ mov %cs, %esi
-+ cmp $__KERNEL_CS, %esi
-+ jz 3f
-+ ljmp $__KERNEL_CS, $3f
-+1: ljmp $__KERNEXEC_KERNEL_CS, $2f
-+2:
-+#ifdef CONFIG_PARAVIRT
-+ mov %esi, %eax
-+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
-+#else
-+ mov %esi, %cr0
-+#endif
-+3:
-+#ifdef CONFIG_PARAVIRT
-+ popl %ecx
-+ popl %eax
-+#endif
-+ ret
-+ENDPROC(pax_enter_kernel)
-+
-+ENTRY(pax_exit_kernel)
-+#ifdef CONFIG_PARAVIRT
-+ pushl %eax
-+ pushl %ecx
-+#endif
-+ mov %cs, %esi
-+ cmp $__KERNEXEC_KERNEL_CS, %esi
-+ jnz 2f
-+#ifdef CONFIG_PARAVIRT
-+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);
-+ mov %eax, %esi
-+#else
-+ mov %cr0, %esi
-+#endif
-+ btr $16, %esi
-+ ljmp $__KERNEL_CS, $1f
-+1:
-+#ifdef CONFIG_PARAVIRT
-+ mov %esi, %eax
-+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0);
-+#else
-+ mov %esi, %cr0
-+#endif
-+2:
-+#ifdef CONFIG_PARAVIRT
-+ popl %ecx
-+ popl %eax
-+#endif
-+ ret
-+ENDPROC(pax_exit_kernel)
-+#endif
-+
-+.macro pax_erase_kstack
-+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
-+ call pax_erase_kstack
-+#endif
-+.endm
-+
-+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
-+/*
-+ * ebp: thread_info
-+ * ecx, edx: can be clobbered
-+ */
-+ENTRY(pax_erase_kstack)
-+ pushl %edi
-+ pushl %eax
-+
-+ mov TI_lowest_stack(%ebp), %edi
-+ mov $-0xBEEF, %eax
-+ std
-+
-+1: mov %edi, %ecx
-+ and $THREAD_SIZE_asm - 1, %ecx
-+ shr $2, %ecx
-+ repne scasl
-+ jecxz 2f
-+
-+ cmp $2*16, %ecx
-+ jc 2f
-+
-+ mov $2*16, %ecx
-+ repe scasl
-+ jecxz 2f
-+ jne 1b
-+
-+2: cld
-+ mov %esp, %ecx
-+ sub %edi, %ecx
-+ shr $2, %ecx
-+ rep stosl
-+
-+ mov TI_task_thread_sp0(%ebp), %edi
-+ sub $128, %edi
-+ mov %edi, TI_lowest_stack(%ebp)
-+
-+ popl %eax
-+ popl %edi
-+ ret
-+ENDPROC(pax_erase_kstack)
-+#endif
-+
-+.macro __SAVE_ALL _DS
- cld
- PUSH_GS
- pushl %fs
-@@ -224,7 +357,7 @@
- pushl %ebx
- CFI_ADJUST_CFA_OFFSET 4
- CFI_REL_OFFSET ebx, 0
-- movl $(__USER_DS), %edx
-+ movl $\_DS, %edx
- movl %edx, %ds
- movl %edx, %es
- movl $(__KERNEL_PERCPU), %edx
-@@ -232,6 +365,15 @@
- SET_KERNEL_GS %edx
- .endm
-
-+.macro SAVE_ALL
-+#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
-+ __SAVE_ALL __KERNEL_DS
-+ pax_enter_kernel
-+#else
-+ __SAVE_ALL __USER_DS
-+#endif
-+.endm
-+
- .macro RESTORE_INT_REGS
- popl %ebx
- CFI_ADJUST_CFA_OFFSET -4
-@@ -352,7 +494,15 @@ check_userspace:
- movb PT_CS(%esp), %al
- andl $(X86_EFLAGS_VM | SEGMENT_RPL_MASK), %eax
- cmpl $USER_RPL, %eax
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ jae resume_userspace
-+
-+ PAX_EXIT_KERNEL
-+ jmp resume_kernel
-+#else
- jb resume_kernel # not returning to v8086 or userspace
-+#endif
-
- ENTRY(resume_userspace)
- LOCKDEP_SYS_EXIT
-@@ -364,7 +514,7 @@ ENTRY(resume_userspace)
- andl $_TIF_WORK_MASK, %ecx # is there any work to be done on
- # int/exception return?
- jne work_pending
-- jmp restore_all
-+ jmp restore_all_pax
- END(ret_from_exception)
-
- #ifdef CONFIG_PREEMPT
-@@ -414,25 +564,36 @@ sysenter_past_esp:
- /*CFI_REL_OFFSET cs, 0*/
- /*
- * Push current_thread_info()->sysenter_return to the stack.
-- * A tiny bit of offset fixup is necessary - 4*4 means the 4 words
-- * pushed above; +8 corresponds to copy_thread's esp0 setting.
- */
-- pushl (TI_sysenter_return-THREAD_SIZE+8+4*4)(%esp)
-+ pushl $0
- CFI_ADJUST_CFA_OFFSET 4
- CFI_REL_OFFSET eip, 0
-
- pushl %eax
- CFI_ADJUST_CFA_OFFSET 4
- SAVE_ALL
-+ GET_THREAD_INFO(%ebp)
-+ movl TI_sysenter_return(%ebp),%ebp
-+ movl %ebp,PT_EIP(%esp)
- ENABLE_INTERRUPTS(CLBR_NONE)
-
- /*
- * Load the potential sixth argument from user stack.
- * Careful about security.
- */
-+ movl PT_OLDESP(%esp),%ebp
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ mov PT_OLDSS(%esp),%ds
-+1: movl %ds:(%ebp),%ebp
-+ push %ss
-+ pop %ds
-+#else
- cmpl $__PAGE_OFFSET-3,%ebp
- jae syscall_fault
- 1: movl (%ebp),%ebp
-+#endif
-+
- movl %ebp,PT_EBP(%esp)
- .section __ex_table,"a"
- .align 4
-@@ -455,12 +616,23 @@ sysenter_do_call:
- testl $_TIF_ALLWORK_MASK, %ecx
- jne sysexit_audit
- sysenter_exit:
-+
-+#ifdef CONFIG_PAX_RANDKSTACK
-+ pushl_cfi %eax
-+ call pax_randomize_kstack
-+ popl_cfi %eax
-+#endif
-+
-+ pax_erase_kstack
-+
- /* if something modifies registers it must also disable sysexit */
- movl PT_EIP(%esp), %edx
- movl PT_OLDESP(%esp), %ecx
- xorl %ebp,%ebp
- TRACE_IRQS_ON
- 1: mov PT_FS(%esp), %fs
-+2: mov PT_DS(%esp), %ds
-+3: mov PT_ES(%esp), %es
- PTGS_TO_GS
- ENABLE_INTERRUPTS_SYSEXIT
-
-@@ -477,6 +649,9 @@ sysenter_audit:
- movl %eax,%edx /* 2nd arg: syscall number */
- movl $AUDIT_ARCH_I386,%eax /* 1st arg: audit arch */
- call audit_syscall_entry
-+
-+ pax_erase_kstack
-+
- pushl %ebx
- CFI_ADJUST_CFA_OFFSET 4
- movl PT_EAX(%esp),%eax /* reload syscall number */
-@@ -504,11 +679,17 @@ sysexit_audit:
-
- CFI_ENDPROC
- .pushsection .fixup,"ax"
--2: movl $0,PT_FS(%esp)
-+4: movl $0,PT_FS(%esp)
-+ jmp 1b
-+5: movl $0,PT_DS(%esp)
-+ jmp 1b
-+6: movl $0,PT_ES(%esp)
- jmp 1b
- .section __ex_table,"a"
- .align 4
-- .long 1b,2b
-+ .long 1b,4b
-+ .long 2b,5b
-+ .long 3b,6b
- .popsection
- PTGS_TO_GS_EX
- ENDPROC(ia32_sysenter_target)
-@@ -538,6 +719,14 @@ syscall_exit:
- testl $_TIF_ALLWORK_MASK, %ecx # current->work
- jne syscall_exit_work
-
-+restore_all_pax:
-+
-+#ifdef CONFIG_PAX_RANDKSTACK
-+ call pax_randomize_kstack
-+#endif
-+
-+ pax_erase_kstack
-+
- restore_all:
- TRACE_IRQS_IRET
- restore_all_notrace:
-@@ -602,7 +791,13 @@ ldt_ss:
- mov PT_OLDESP(%esp), %eax /* load userspace esp */
- mov %dx, %ax /* eax: new kernel esp */
- sub %eax, %edx /* offset (low word is 0) */
-- PER_CPU(gdt_page, %ebx)
-+#ifdef CONFIG_SMP
-+ movl PER_CPU_VAR(cpu_number), %ebx
-+ shll $PAGE_SHIFT_asm, %ebx
-+ addl $cpu_gdt_table, %ebx
-+#else
-+ movl $cpu_gdt_table, %ebx
-+#endif
- shr $16, %edx
- mov %dl, GDT_ENTRY_ESPFIX_SS * 8 + 4(%ebx) /* bits 16..23 */
- mov %dh, GDT_ENTRY_ESPFIX_SS * 8 + 7(%ebx) /* bits 24..31 */
-@@ -636,31 +831,25 @@ work_resched:
- movl TI_flags(%ebp), %ecx
- andl $_TIF_WORK_MASK, %ecx # is there any work to be done other
- # than syscall tracing?
-- jz restore_all
-+ jz restore_all_pax
- testb $_TIF_NEED_RESCHED, %cl
- jnz work_resched
-
- work_notifysig: # deal with pending signals and
- # notify-resume requests
-+ movl %esp, %eax
- #ifdef CONFIG_VM86
- testl $X86_EFLAGS_VM, PT_EFLAGS(%esp)
-- movl %esp, %eax
-- jne work_notifysig_v86 # returning to kernel-space or
-+ jz 1f # returning to kernel-space or
- # vm86-space
-- xorl %edx, %edx
-- call do_notify_resume
-- jmp resume_userspace_sig
-
-- ALIGN
--work_notifysig_v86:
- pushl %ecx # save ti_flags for do_notify_resume
- CFI_ADJUST_CFA_OFFSET 4
- call save_v86_state # %eax contains pt_regs pointer
- popl %ecx
- CFI_ADJUST_CFA_OFFSET -4
- movl %eax, %esp
--#else
-- movl %esp, %eax
-+1:
- #endif
- xorl %edx, %edx
- call do_notify_resume
-@@ -673,6 +862,9 @@ syscall_trace_entry:
- movl $-ENOSYS,PT_EAX(%esp)
- movl %esp, %eax
- call syscall_trace_enter
-+
-+ pax_erase_kstack
-+
- /* What it returned is what we'll actually use. */
- cmpl $(nr_syscalls), %eax
- jnae syscall_call
-@@ -695,6 +887,10 @@ END(syscall_exit_work)
-
- RING0_INT_FRAME # can't unwind into user space anyway
- syscall_fault:
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ push %ss
-+ pop %ds
-+#endif
- GET_THREAD_INFO(%ebp)
- movl $-EFAULT,PT_EAX(%esp)
- jmp resume_userspace
-@@ -726,6 +922,33 @@ PTREGSCALL(rt_sigreturn)
- PTREGSCALL(vm86)
- PTREGSCALL(vm86old)
-
-+ ALIGN;
-+ENTRY(kernel_execve)
-+ push %ebp
-+ sub $PT_OLDSS+4,%esp
-+ push %edi
-+ push %ecx
-+ push %eax
-+ lea 3*4(%esp),%edi
-+ mov $PT_OLDSS/4+1,%ecx
-+ xorl %eax,%eax
-+ rep stosl
-+ pop %eax
-+ pop %ecx
-+ pop %edi
-+ movl $X86_EFLAGS_IF,PT_EFLAGS(%esp)
-+ mov %eax,PT_EBX(%esp)
-+ mov %edx,PT_ECX(%esp)
-+ mov %ecx,PT_EDX(%esp)
-+ mov %esp,%eax
-+ call sys_execve
-+ GET_THREAD_INFO(%ebp)
-+ test %eax,%eax
-+ jz syscall_exit
-+ add $PT_OLDSS+4,%esp
-+ pop %ebp
-+ ret
-+
- .macro FIXUP_ESPFIX_STACK
- /*
- * Switch back for ESPFIX stack to the normal zerobased stack
-@@ -735,7 +958,13 @@ PTREGSCALL(vm86old)
- * normal stack and adjusts ESP with the matching offset.
- */
- /* fixup the stack */
-- PER_CPU(gdt_page, %ebx)
-+#ifdef CONFIG_SMP
-+ movl PER_CPU_VAR(cpu_number), %ebx
-+ shll $PAGE_SHIFT_asm, %ebx
-+ addl $cpu_gdt_table, %ebx
-+#else
-+ movl $cpu_gdt_table, %ebx
-+#endif
- mov GDT_ENTRY_ESPFIX_SS * 8 + 4(%ebx), %al /* bits 16..23 */
- mov GDT_ENTRY_ESPFIX_SS * 8 + 7(%ebx), %ah /* bits 24..31 */
- shl $16, %eax
-@@ -1198,7 +1427,6 @@ return_to_handler:
- ret
- #endif
-
--.section .rodata,"a"
- #include "syscall_table_32.S"
-
- syscall_table_size=(.-sys_call_table)
-@@ -1255,9 +1483,12 @@ error_code:
- movl $-1, PT_ORIG_EAX(%esp) # no syscall to restart
- REG_TO_PTGS %ecx
- SET_KERNEL_GS %ecx
-- movl $(__USER_DS), %ecx
-+ movl $(__KERNEL_DS), %ecx
- movl %ecx, %ds
- movl %ecx, %es
-+
-+ pax_enter_kernel
-+
- TRACE_IRQS_OFF
- movl %esp,%eax # pt_regs pointer
- call *%edi
-@@ -1351,6 +1582,9 @@ nmi_stack_correct:
- xorl %edx,%edx # zero error code
- movl %esp,%eax # pt_regs pointer
- call do_nmi
-+
-+ pax_exit_kernel
-+
- jmp restore_all_notrace
- CFI_ENDPROC
-
-@@ -1391,6 +1625,9 @@ nmi_espfix_stack:
- FIXUP_ESPFIX_STACK # %eax == %esp
- xorl %edx,%edx # zero error code
- call do_nmi
-+
-+ pax_exit_kernel
-+
- RESTORE_REGS
- lss 12+4(%esp), %esp # back to espfix stack
- CFI_ADJUST_CFA_OFFSET -24
-diff -urNp linux-2.6.32.45/arch/x86/kernel/entry_64.S linux-2.6.32.45/arch/x86/kernel/entry_64.S
---- linux-2.6.32.45/arch/x86/kernel/entry_64.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/entry_64.S 2011-06-04 20:30:53.000000000 -0400
-@@ -53,6 +53,7 @@
- #include <asm/paravirt.h>
- #include <asm/ftrace.h>
- #include <asm/percpu.h>
-+#include <asm/pgtable.h>
-
- /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
- #include <linux/elf-em.h>
-@@ -174,6 +175,257 @@ ENTRY(native_usergs_sysret64)
- ENDPROC(native_usergs_sysret64)
- #endif /* CONFIG_PARAVIRT */
-
-+ .macro ljmpq sel, off
-+#if defined(CONFIG_MPSC) || defined(CONFIG_MCORE2) || defined (CONFIG_MATOM)
-+ .byte 0x48; ljmp *1234f(%rip)
-+ .pushsection .rodata
-+ .align 16
-+ 1234: .quad \off; .word \sel
-+ .popsection
-+#else
-+ pushq $\sel
-+ pushq $\off
-+ lretq
-+#endif
-+ .endm
-+
-+ .macro pax_enter_kernel
-+#ifdef CONFIG_PAX_KERNEXEC
-+ call pax_enter_kernel
-+#endif
-+ .endm
-+
-+ .macro pax_exit_kernel
-+#ifdef CONFIG_PAX_KERNEXEC
-+ call pax_exit_kernel
-+#endif
-+ .endm
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ENTRY(pax_enter_kernel)
-+ pushq %rdi
-+
-+#ifdef CONFIG_PARAVIRT
-+ PV_SAVE_REGS(CLBR_RDI)
-+#endif
-+
-+ GET_CR0_INTO_RDI
-+ bts $16,%rdi
-+ jnc 1f
-+ mov %cs,%edi
-+ cmp $__KERNEL_CS,%edi
-+ jz 3f
-+ ljmpq __KERNEL_CS,3f
-+1: ljmpq __KERNEXEC_KERNEL_CS,2f
-+2: SET_RDI_INTO_CR0
-+3:
-+
-+#ifdef CONFIG_PARAVIRT
-+ PV_RESTORE_REGS(CLBR_RDI)
-+#endif
-+
-+ popq %rdi
-+ retq
-+ENDPROC(pax_enter_kernel)
-+
-+ENTRY(pax_exit_kernel)
-+ pushq %rdi
-+
-+#ifdef CONFIG_PARAVIRT
-+ PV_SAVE_REGS(CLBR_RDI)
-+#endif
-+
-+ mov %cs,%rdi
-+ cmp $__KERNEXEC_KERNEL_CS,%edi
-+ jnz 2f
-+ GET_CR0_INTO_RDI
-+ btr $16,%rdi
-+ ljmpq __KERNEL_CS,1f
-+1: SET_RDI_INTO_CR0
-+2:
-+
-+#ifdef CONFIG_PARAVIRT
-+ PV_RESTORE_REGS(CLBR_RDI);
-+#endif
-+
-+ popq %rdi
-+ retq
-+ENDPROC(pax_exit_kernel)
-+#endif
-+
-+ .macro pax_enter_kernel_user
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ call pax_enter_kernel_user
-+#endif
-+ .endm
-+
-+ .macro pax_exit_kernel_user
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ call pax_exit_kernel_user
-+#endif
-+#ifdef CONFIG_PAX_RANDKSTACK
-+ push %rax
-+ call pax_randomize_kstack
-+ pop %rax
-+#endif
-+ pax_erase_kstack
-+ .endm
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ENTRY(pax_enter_kernel_user)
-+ pushq %rdi
-+ pushq %rbx
-+
-+#ifdef CONFIG_PARAVIRT
-+ PV_SAVE_REGS(CLBR_RDI)
-+#endif
-+
-+ GET_CR3_INTO_RDI
-+ mov %rdi,%rbx
-+ add $__START_KERNEL_map,%rbx
-+ sub phys_base(%rip),%rbx
-+
-+#ifdef CONFIG_PARAVIRT
-+ pushq %rdi
-+ cmpl $0, pv_info+PARAVIRT_enabled
-+ jz 1f
-+ i = 0
-+ .rept USER_PGD_PTRS
-+ mov i*8(%rbx),%rsi
-+ mov $0,%sil
-+ lea i*8(%rbx),%rdi
-+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd)
-+ i = i + 1
-+ .endr
-+ jmp 2f
-+1:
-+#endif
-+
-+ i = 0
-+ .rept USER_PGD_PTRS
-+ movb $0,i*8(%rbx)
-+ i = i + 1
-+ .endr
-+
-+#ifdef CONFIG_PARAVIRT
-+2: popq %rdi
-+#endif
-+ SET_RDI_INTO_CR3
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ GET_CR0_INTO_RDI
-+ bts $16,%rdi
-+ SET_RDI_INTO_CR0
-+#endif
-+
-+#ifdef CONFIG_PARAVIRT
-+ PV_RESTORE_REGS(CLBR_RDI)
-+#endif
-+
-+ popq %rbx
-+ popq %rdi
-+ retq
-+ENDPROC(pax_enter_kernel_user)
-+
-+ENTRY(pax_exit_kernel_user)
-+ push %rdi
-+
-+#ifdef CONFIG_PARAVIRT
-+ pushq %rbx
-+ PV_SAVE_REGS(CLBR_RDI)
-+#endif
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ GET_CR0_INTO_RDI
-+ btr $16,%rdi
-+ SET_RDI_INTO_CR0
-+#endif
-+
-+ GET_CR3_INTO_RDI
-+ add $__START_KERNEL_map,%rdi
-+ sub phys_base(%rip),%rdi
-+
-+#ifdef CONFIG_PARAVIRT
-+ cmpl $0, pv_info+PARAVIRT_enabled
-+ jz 1f
-+ mov %rdi,%rbx
-+ i = 0
-+ .rept USER_PGD_PTRS
-+ mov i*8(%rbx),%rsi
-+ mov $0x67,%sil
-+ lea i*8(%rbx),%rdi
-+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd)
-+ i = i + 1
-+ .endr
-+ jmp 2f
-+1:
-+#endif
-+
-+ i = 0
-+ .rept USER_PGD_PTRS
-+ movb $0x67,i*8(%rdi)
-+ i = i + 1
-+ .endr
-+
-+#ifdef CONFIG_PARAVIRT
-+2: PV_RESTORE_REGS(CLBR_RDI)
-+ popq %rbx
-+#endif
-+
-+ popq %rdi
-+ retq
-+ENDPROC(pax_exit_kernel_user)
-+#endif
-+
-+.macro pax_erase_kstack
-+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
-+ call pax_erase_kstack
-+#endif
-+.endm
-+
-+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
-+/*
-+ * r10: thread_info
-+ * rcx, rdx: can be clobbered
-+ */
-+ENTRY(pax_erase_kstack)
-+ pushq %rdi
-+ pushq %rax
-+
-+ GET_THREAD_INFO(%r10)
-+ mov TI_lowest_stack(%r10), %rdi
-+ mov $-0xBEEF, %rax
-+ std
-+
-+1: mov %edi, %ecx
-+ and $THREAD_SIZE_asm - 1, %ecx
-+ shr $3, %ecx
-+ repne scasq
-+ jecxz 2f
-+
-+ cmp $2*8, %ecx
-+ jc 2f
-+
-+ mov $2*8, %ecx
-+ repe scasq
-+ jecxz 2f
-+ jne 1b
-+
-+2: cld
-+ mov %esp, %ecx
-+ sub %edi, %ecx
-+ shr $3, %ecx
-+ rep stosq
-+
-+ mov TI_task_thread_sp0(%r10), %rdi
-+ sub $256, %rdi
-+ mov %rdi, TI_lowest_stack(%r10)
-+
-+ popq %rax
-+ popq %rdi
-+ ret
-+ENDPROC(pax_erase_kstack)
-+#endif
-
- .macro TRACE_IRQS_IRETQ offset=ARGOFFSET
- #ifdef CONFIG_TRACE_IRQFLAGS
-@@ -317,7 +569,7 @@ ENTRY(save_args)
- leaq -ARGOFFSET+16(%rsp),%rdi /* arg1 for handler */
- movq_cfi rbp, 8 /* push %rbp */
- leaq 8(%rsp), %rbp /* mov %rsp, %ebp */
-- testl $3, CS(%rdi)
-+ testb $3, CS(%rdi)
- je 1f
- SWAPGS
- /*
-@@ -409,7 +661,7 @@ ENTRY(ret_from_fork)
-
- RESTORE_REST
-
-- testl $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
-+ testb $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
- je int_ret_from_sys_call
-
- testl $_TIF_IA32, TI_flags(%rcx) # 32-bit compat task needs IRET
-@@ -455,7 +707,7 @@ END(ret_from_fork)
- ENTRY(system_call)
- CFI_STARTPROC simple
- CFI_SIGNAL_FRAME
-- CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
-+ CFI_DEF_CFA rsp,0
- CFI_REGISTER rip,rcx
- /*CFI_REGISTER rflags,r11*/
- SWAPGS_UNSAFE_STACK
-@@ -468,12 +720,13 @@ ENTRY(system_call_after_swapgs)
-
- movq %rsp,PER_CPU_VAR(old_rsp)
- movq PER_CPU_VAR(kernel_stack),%rsp
-+ pax_enter_kernel_user
- /*
- * No need to follow this irqs off/on section - it's straight
- * and short:
- */
- ENABLE_INTERRUPTS(CLBR_NONE)
-- SAVE_ARGS 8,1
-+ SAVE_ARGS 8*6,1
- movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
- movq %rcx,RIP-ARGOFFSET(%rsp)
- CFI_REL_OFFSET rip,RIP-ARGOFFSET
-@@ -502,6 +755,7 @@ sysret_check:
- andl %edi,%edx
- jnz sysret_careful
- CFI_REMEMBER_STATE
-+ pax_exit_kernel_user
- /*
- * sysretq will re-enable interrupts:
- */
-@@ -562,6 +816,9 @@ auditsys:
- movq %rax,%rsi /* 2nd arg: syscall number */
- movl $AUDIT_ARCH_X86_64,%edi /* 1st arg: audit arch */
- call audit_syscall_entry
-+
-+ pax_erase_kstack
-+
- LOAD_ARGS 0 /* reload call-clobbered registers */
- jmp system_call_fastpath
-
-@@ -592,6 +849,9 @@ tracesys:
- FIXUP_TOP_OF_STACK %rdi
- movq %rsp,%rdi
- call syscall_trace_enter
-+
-+ pax_erase_kstack
-+
- /*
- * Reload arg registers from stack in case ptrace changed them.
- * We don't reload %rax because syscall_trace_enter() returned
-@@ -613,7 +873,7 @@ tracesys:
- GLOBAL(int_ret_from_sys_call)
- DISABLE_INTERRUPTS(CLBR_NONE)
- TRACE_IRQS_OFF
-- testl $3,CS-ARGOFFSET(%rsp)
-+ testb $3,CS-ARGOFFSET(%rsp)
- je retint_restore_args
- movl $_TIF_ALLWORK_MASK,%edi
- /* edi: mask to check */
-@@ -800,6 +1060,16 @@ END(interrupt)
- CFI_ADJUST_CFA_OFFSET 10*8
- call save_args
- PARTIAL_FRAME 0
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ testb $3, CS(%rdi)
-+ jnz 1f
-+ pax_enter_kernel
-+ jmp 2f
-+1: pax_enter_kernel_user
-+2:
-+#else
-+ pax_enter_kernel
-+#endif
- call \func
- .endm
-
-@@ -822,7 +1092,7 @@ ret_from_intr:
- CFI_ADJUST_CFA_OFFSET -8
- exit_intr:
- GET_THREAD_INFO(%rcx)
-- testl $3,CS-ARGOFFSET(%rsp)
-+ testb $3,CS-ARGOFFSET(%rsp)
- je retint_kernel
-
- /* Interrupt came from user space */
-@@ -844,12 +1114,14 @@ retint_swapgs: /* return to user-space
- * The iretq could re-enable interrupts:
- */
- DISABLE_INTERRUPTS(CLBR_ANY)
-+ pax_exit_kernel_user
- TRACE_IRQS_IRETQ
- SWAPGS
- jmp restore_args
-
- retint_restore_args: /* return to kernel space */
- DISABLE_INTERRUPTS(CLBR_ANY)
-+ pax_exit_kernel
- /*
- * The iretq could re-enable interrupts:
- */
-@@ -1032,6 +1304,16 @@ ENTRY(\sym)
- CFI_ADJUST_CFA_OFFSET 15*8
- call error_entry
- DEFAULT_FRAME 0
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ testb $3, CS(%rsp)
-+ jnz 1f
-+ pax_enter_kernel
-+ jmp 2f
-+1: pax_enter_kernel_user
-+2:
-+#else
-+ pax_enter_kernel
-+#endif
- movq %rsp,%rdi /* pt_regs pointer */
- xorl %esi,%esi /* no error code */
- call \do_sym
-@@ -1049,6 +1331,16 @@ ENTRY(\sym)
- subq $15*8, %rsp
- call save_paranoid
- TRACE_IRQS_OFF
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ testb $3, CS(%rsp)
-+ jnz 1f
-+ pax_enter_kernel
-+ jmp 2f
-+1: pax_enter_kernel_user
-+2:
-+#else
-+ pax_enter_kernel
-+#endif
- movq %rsp,%rdi /* pt_regs pointer */
- xorl %esi,%esi /* no error code */
- call \do_sym
-@@ -1066,9 +1358,24 @@ ENTRY(\sym)
- subq $15*8, %rsp
- call save_paranoid
- TRACE_IRQS_OFF
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ testb $3, CS(%rsp)
-+ jnz 1f
-+ pax_enter_kernel
-+ jmp 2f
-+1: pax_enter_kernel_user
-+2:
-+#else
-+ pax_enter_kernel
-+#endif
- movq %rsp,%rdi /* pt_regs pointer */
- xorl %esi,%esi /* no error code */
-- PER_CPU(init_tss, %rbp)
-+#ifdef CONFIG_SMP
-+ imul $TSS_size, PER_CPU_VAR(cpu_number), %ebp
-+ lea init_tss(%rbp), %rbp
-+#else
-+ lea init_tss(%rip), %rbp
-+#endif
- subq $EXCEPTION_STKSZ, TSS_ist + (\ist - 1) * 8(%rbp)
- call \do_sym
- addq $EXCEPTION_STKSZ, TSS_ist + (\ist - 1) * 8(%rbp)
-@@ -1085,6 +1392,16 @@ ENTRY(\sym)
- CFI_ADJUST_CFA_OFFSET 15*8
- call error_entry
- DEFAULT_FRAME 0
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ testb $3, CS(%rsp)
-+ jnz 1f
-+ pax_enter_kernel
-+ jmp 2f
-+1: pax_enter_kernel_user
-+2:
-+#else
-+ pax_enter_kernel
-+#endif
- movq %rsp,%rdi /* pt_regs pointer */
- movq ORIG_RAX(%rsp),%rsi /* get error code */
- movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
-@@ -1104,6 +1421,16 @@ ENTRY(\sym)
- call save_paranoid
- DEFAULT_FRAME 0
- TRACE_IRQS_OFF
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ testb $3, CS(%rsp)
-+ jnz 1f
-+ pax_enter_kernel
-+ jmp 2f
-+1: pax_enter_kernel_user
-+2:
-+#else
-+ pax_enter_kernel
-+#endif
- movq %rsp,%rdi /* pt_regs pointer */
- movq ORIG_RAX(%rsp),%rsi /* get error code */
- movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
-@@ -1405,14 +1732,27 @@ ENTRY(paranoid_exit)
- TRACE_IRQS_OFF
- testl %ebx,%ebx /* swapgs needed? */
- jnz paranoid_restore
-- testl $3,CS(%rsp)
-+ testb $3,CS(%rsp)
- jnz paranoid_userspace
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ pax_exit_kernel
-+ TRACE_IRQS_IRETQ 0
-+ SWAPGS_UNSAFE_STACK
-+ RESTORE_ALL 8
-+ jmp irq_return
-+#endif
- paranoid_swapgs:
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ pax_exit_kernel_user
-+#else
-+ pax_exit_kernel
-+#endif
- TRACE_IRQS_IRETQ 0
- SWAPGS_UNSAFE_STACK
- RESTORE_ALL 8
- jmp irq_return
- paranoid_restore:
-+ pax_exit_kernel
- TRACE_IRQS_IRETQ 0
- RESTORE_ALL 8
- jmp irq_return
-@@ -1470,7 +1810,7 @@ ENTRY(error_entry)
- movq_cfi r14, R14+8
- movq_cfi r15, R15+8
- xorl %ebx,%ebx
-- testl $3,CS+8(%rsp)
-+ testb $3,CS+8(%rsp)
- je error_kernelspace
- error_swapgs:
- SWAPGS
-@@ -1529,6 +1869,16 @@ ENTRY(nmi)
- CFI_ADJUST_CFA_OFFSET 15*8
- call save_paranoid
- DEFAULT_FRAME 0
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ testb $3, CS(%rsp)
-+ jnz 1f
-+ pax_enter_kernel
-+ jmp 2f
-+1: pax_enter_kernel_user
-+2:
-+#else
-+ pax_enter_kernel
-+#endif
- /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
- movq %rsp,%rdi
- movq $-1,%rsi
-@@ -1539,11 +1889,25 @@ ENTRY(nmi)
- DISABLE_INTERRUPTS(CLBR_NONE)
- testl %ebx,%ebx /* swapgs needed? */
- jnz nmi_restore
-- testl $3,CS(%rsp)
-+ testb $3,CS(%rsp)
- jnz nmi_userspace
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ pax_exit_kernel
-+ SWAPGS_UNSAFE_STACK
-+ RESTORE_ALL 8
-+ jmp irq_return
-+#endif
- nmi_swapgs:
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ pax_exit_kernel_user
-+#else
-+ pax_exit_kernel
-+#endif
- SWAPGS_UNSAFE_STACK
-+ RESTORE_ALL 8
-+ jmp irq_return
- nmi_restore:
-+ pax_exit_kernel
- RESTORE_ALL 8
- jmp irq_return
- nmi_userspace:
-diff -urNp linux-2.6.32.45/arch/x86/kernel/ftrace.c linux-2.6.32.45/arch/x86/kernel/ftrace.c
---- linux-2.6.32.45/arch/x86/kernel/ftrace.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/ftrace.c 2011-05-04 17:56:20.000000000 -0400
-@@ -103,7 +103,7 @@ static void *mod_code_ip; /* holds the
- static void *mod_code_newcode; /* holds the text to write to the IP */
-
- static unsigned nmi_wait_count;
--static atomic_t nmi_update_count = ATOMIC_INIT(0);
-+static atomic_unchecked_t nmi_update_count = ATOMIC_INIT(0);
-
- int ftrace_arch_read_dyn_info(char *buf, int size)
- {
-@@ -111,7 +111,7 @@ int ftrace_arch_read_dyn_info(char *buf,
-
- r = snprintf(buf, size, "%u %u",
- nmi_wait_count,
-- atomic_read(&nmi_update_count));
-+ atomic_read_unchecked(&nmi_update_count));
- return r;
- }
-
-@@ -149,8 +149,10 @@ void ftrace_nmi_enter(void)
- {
- if (atomic_inc_return(&nmi_running) & MOD_CODE_WRITE_FLAG) {
- smp_rmb();
-+ pax_open_kernel();
- ftrace_mod_code();
-- atomic_inc(&nmi_update_count);
-+ pax_close_kernel();
-+ atomic_inc_unchecked(&nmi_update_count);
- }
- /* Must have previous changes seen before executions */
- smp_mb();
-@@ -215,7 +217,7 @@ do_ftrace_mod_code(unsigned long ip, voi
-
-
-
--static unsigned char ftrace_nop[MCOUNT_INSN_SIZE];
-+static unsigned char ftrace_nop[MCOUNT_INSN_SIZE] __read_only;
-
- static unsigned char *ftrace_nop_replace(void)
- {
-@@ -228,6 +230,8 @@ ftrace_modify_code(unsigned long ip, uns
- {
- unsigned char replaced[MCOUNT_INSN_SIZE];
-
-+ ip = ktla_ktva(ip);
-+
- /*
- * Note: Due to modules and __init, code can
- * disappear and change, we need to protect against faulting
-@@ -284,7 +288,7 @@ int ftrace_update_ftrace_func(ftrace_fun
- unsigned char old[MCOUNT_INSN_SIZE], *new;
- int ret;
-
-- memcpy(old, &ftrace_call, MCOUNT_INSN_SIZE);
-+ memcpy(old, (void *)ktla_ktva((unsigned long)ftrace_call), MCOUNT_INSN_SIZE);
- new = ftrace_call_replace(ip, (unsigned long)func);
- ret = ftrace_modify_code(ip, old, new);
-
-@@ -337,15 +341,15 @@ int __init ftrace_dyn_arch_init(void *da
- switch (faulted) {
- case 0:
- pr_info("ftrace: converting mcount calls to 0f 1f 44 00 00\n");
-- memcpy(ftrace_nop, ftrace_test_p6nop, MCOUNT_INSN_SIZE);
-+ memcpy(ftrace_nop, ktla_ktva(ftrace_test_p6nop), MCOUNT_INSN_SIZE);
- break;
- case 1:
- pr_info("ftrace: converting mcount calls to 66 66 66 66 90\n");
-- memcpy(ftrace_nop, ftrace_test_nop5, MCOUNT_INSN_SIZE);
-+ memcpy(ftrace_nop, ktla_ktva(ftrace_test_nop5), MCOUNT_INSN_SIZE);
- break;
- case 2:
- pr_info("ftrace: converting mcount calls to jmp . + 5\n");
-- memcpy(ftrace_nop, ftrace_test_jmp, MCOUNT_INSN_SIZE);
-+ memcpy(ftrace_nop, ktla_ktva(ftrace_test_jmp), MCOUNT_INSN_SIZE);
- break;
- }
-
-@@ -366,6 +370,8 @@ static int ftrace_mod_jmp(unsigned long
- {
- unsigned char code[MCOUNT_INSN_SIZE];
-
-+ ip = ktla_ktva(ip);
-+
- if (probe_kernel_read(code, (void *)ip, MCOUNT_INSN_SIZE))
- return -EFAULT;
-
-diff -urNp linux-2.6.32.45/arch/x86/kernel/head32.c linux-2.6.32.45/arch/x86/kernel/head32.c
---- linux-2.6.32.45/arch/x86/kernel/head32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/head32.c 2011-04-17 15:56:46.000000000 -0400
-@@ -16,6 +16,7 @@
- #include <asm/apic.h>
- #include <asm/io_apic.h>
- #include <asm/bios_ebda.h>
-+#include <asm/boot.h>
-
- static void __init i386_default_early_setup(void)
- {
-@@ -31,7 +32,7 @@ void __init i386_start_kernel(void)
- {
- reserve_trampoline_memory();
-
-- reserve_early(__pa_symbol(&_text), __pa_symbol(&__bss_stop), "TEXT DATA BSS");
-+ reserve_early(LOAD_PHYSICAL_ADDR, __pa_symbol(&__bss_stop), "TEXT DATA BSS");
-
- #ifdef CONFIG_BLK_DEV_INITRD
- /* Reserve INITRD */
-diff -urNp linux-2.6.32.45/arch/x86/kernel/head_32.S linux-2.6.32.45/arch/x86/kernel/head_32.S
---- linux-2.6.32.45/arch/x86/kernel/head_32.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/head_32.S 2011-07-06 19:53:33.000000000 -0400
-@@ -19,10 +19,17 @@
- #include <asm/setup.h>
- #include <asm/processor-flags.h>
- #include <asm/percpu.h>
-+#include <asm/msr-index.h>
-
- /* Physical address */
- #define pa(X) ((X) - __PAGE_OFFSET)
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+#define ta(X) (X)
-+#else
-+#define ta(X) ((X) - __PAGE_OFFSET)
-+#endif
-+
- /*
- * References to members of the new_cpu_data structure.
- */
-@@ -52,11 +59,7 @@
- * and small than max_low_pfn, otherwise will waste some page table entries
- */
-
--#if PTRS_PER_PMD > 1
--#define PAGE_TABLE_SIZE(pages) (((pages) / PTRS_PER_PMD) + PTRS_PER_PGD)
--#else
--#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PGD)
--#endif
-+#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PTE)
-
- /* Enough space to fit pagetables for the low memory linear map */
- MAPPING_BEYOND_END = \
-@@ -73,6 +76,12 @@ INIT_MAP_SIZE = PAGE_TABLE_SIZE(KERNEL_P
- RESERVE_BRK(pagetables, INIT_MAP_SIZE)
-
- /*
-+ * Real beginning of normal "text" segment
-+ */
-+ENTRY(stext)
-+ENTRY(_stext)
-+
-+/*
- * 32-bit kernel entrypoint; only used by the boot CPU. On entry,
- * %esi points to the real-mode code as a 32-bit pointer.
- * CS and DS must be 4 GB flat segments, but we don't depend on
-@@ -80,7 +89,16 @@ RESERVE_BRK(pagetables, INIT_MAP_SIZE)
- * can.
- */
- __HEAD
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ jmp startup_32
-+/* PaX: fill first page in .text with int3 to catch NULL derefs in kernel mode */
-+.fill PAGE_SIZE-5,1,0xcc
-+#endif
-+
- ENTRY(startup_32)
-+ movl pa(stack_start),%ecx
-+
- /* test KEEP_SEGMENTS flag to see if the bootloader is asking
- us to not reload segments */
- testb $(1<<6), BP_loadflags(%esi)
-@@ -95,7 +113,60 @@ ENTRY(startup_32)
- movl %eax,%es
- movl %eax,%fs
- movl %eax,%gs
-+ movl %eax,%ss
- 2:
-+ leal -__PAGE_OFFSET(%ecx),%esp
-+
-+#ifdef CONFIG_SMP
-+ movl $pa(cpu_gdt_table),%edi
-+ movl $__per_cpu_load,%eax
-+ movw %ax,__KERNEL_PERCPU + 2(%edi)
-+ rorl $16,%eax
-+ movb %al,__KERNEL_PERCPU + 4(%edi)
-+ movb %ah,__KERNEL_PERCPU + 7(%edi)
-+ movl $__per_cpu_end - 1,%eax
-+ subl $__per_cpu_start,%eax
-+ movw %ax,__KERNEL_PERCPU + 0(%edi)
-+#endif
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ movl $NR_CPUS,%ecx
-+ movl $pa(cpu_gdt_table),%edi
-+1:
-+ movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c09700),GDT_ENTRY_KERNEL_DS * 8 + 4(%edi)
-+ movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0fb00),GDT_ENTRY_DEFAULT_USER_CS * 8 + 4(%edi)
-+ movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0f300),GDT_ENTRY_DEFAULT_USER_DS * 8 + 4(%edi)
-+ addl $PAGE_SIZE_asm,%edi
-+ loop 1b
-+#endif
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ movl $pa(boot_gdt),%edi
-+ movl $__LOAD_PHYSICAL_ADDR,%eax
-+ movw %ax,__BOOT_CS + 2(%edi)
-+ rorl $16,%eax
-+ movb %al,__BOOT_CS + 4(%edi)
-+ movb %ah,__BOOT_CS + 7(%edi)
-+ rorl $16,%eax
-+
-+ ljmp $(__BOOT_CS),$1f
-+1:
-+
-+ movl $NR_CPUS,%ecx
-+ movl $pa(cpu_gdt_table),%edi
-+ addl $__PAGE_OFFSET,%eax
-+1:
-+ movw %ax,__KERNEL_CS + 2(%edi)
-+ movw %ax,__KERNEXEC_KERNEL_CS + 2(%edi)
-+ rorl $16,%eax
-+ movb %al,__KERNEL_CS + 4(%edi)
-+ movb %al,__KERNEXEC_KERNEL_CS + 4(%edi)
-+ movb %ah,__KERNEL_CS + 7(%edi)
-+ movb %ah,__KERNEXEC_KERNEL_CS + 7(%edi)
-+ rorl $16,%eax
-+ addl $PAGE_SIZE_asm,%edi
-+ loop 1b
-+#endif
-
- /*
- * Clear BSS first so that there are no surprises...
-@@ -140,9 +211,7 @@ ENTRY(startup_32)
- cmpl $num_subarch_entries, %eax
- jae bad_subarch
-
-- movl pa(subarch_entries)(,%eax,4), %eax
-- subl $__PAGE_OFFSET, %eax
-- jmp *%eax
-+ jmp *pa(subarch_entries)(,%eax,4)
-
- bad_subarch:
- WEAK(lguest_entry)
-@@ -154,10 +223,10 @@ WEAK(xen_entry)
- __INITDATA
-
- subarch_entries:
-- .long default_entry /* normal x86/PC */
-- .long lguest_entry /* lguest hypervisor */
-- .long xen_entry /* Xen hypervisor */
-- .long default_entry /* Moorestown MID */
-+ .long ta(default_entry) /* normal x86/PC */
-+ .long ta(lguest_entry) /* lguest hypervisor */
-+ .long ta(xen_entry) /* Xen hypervisor */
-+ .long ta(default_entry) /* Moorestown MID */
- num_subarch_entries = (. - subarch_entries) / 4
- .previous
- #endif /* CONFIG_PARAVIRT */
-@@ -218,8 +287,11 @@ default_entry:
- movl %eax, pa(max_pfn_mapped)
-
- /* Do early initialization of the fixmap area */
-- movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,%eax
-- movl %eax,pa(swapper_pg_pmd+0x1000*KPMDS-8)
-+#ifdef CONFIG_COMPAT_VDSO
-+ movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(swapper_pg_pmd+0x1000*KPMDS-8)
-+#else
-+ movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,pa(swapper_pg_pmd+0x1000*KPMDS-8)
-+#endif
- #else /* Not PAE */
-
- page_pde_offset = (__PAGE_OFFSET >> 20);
-@@ -249,8 +321,11 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
- movl %eax, pa(max_pfn_mapped)
-
- /* Do early initialization of the fixmap area */
-- movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,%eax
-- movl %eax,pa(swapper_pg_dir+0xffc)
-+#ifdef CONFIG_COMPAT_VDSO
-+ movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(swapper_pg_dir+0xffc)
-+#else
-+ movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,pa(swapper_pg_dir+0xffc)
-+#endif
- #endif
- jmp 3f
- /*
-@@ -272,6 +347,9 @@ ENTRY(startup_32_smp)
- movl %eax,%es
- movl %eax,%fs
- movl %eax,%gs
-+ movl pa(stack_start),%ecx
-+ movl %eax,%ss
-+ leal -__PAGE_OFFSET(%ecx),%esp
- #endif /* CONFIG_SMP */
- 3:
-
-@@ -297,6 +375,7 @@ ENTRY(startup_32_smp)
- orl %edx,%eax
- movl %eax,%cr4
-
-+#ifdef CONFIG_X86_PAE
- btl $5, %eax # check if PAE is enabled
- jnc 6f
-
-@@ -305,6 +384,10 @@ ENTRY(startup_32_smp)
- cpuid
- cmpl $0x80000000, %eax
- jbe 6f
-+
-+ /* Clear bogus XD_DISABLE bits */
-+ call verify_cpu
-+
- mov $0x80000001, %eax
- cpuid
- /* Execute Disable bit supported? */
-@@ -312,13 +395,17 @@ ENTRY(startup_32_smp)
- jnc 6f
-
- /* Setup EFER (Extended Feature Enable Register) */
-- movl $0xc0000080, %ecx
-+ movl $MSR_EFER, %ecx
- rdmsr
-
- btsl $11, %eax
- /* Make changes effective */
- wrmsr
-
-+ btsl $_PAGE_BIT_NX-32,pa(__supported_pte_mask+4)
-+ movl $1,pa(nx_enabled)
-+#endif
-+
- 6:
-
- /*
-@@ -331,8 +418,8 @@ ENTRY(startup_32_smp)
- movl %eax,%cr0 /* ..and set paging (PG) bit */
- ljmp $__BOOT_CS,$1f /* Clear prefetch and normalize %eip */
- 1:
-- /* Set up the stack pointer */
-- lss stack_start,%esp
-+ /* Shift the stack pointer to a virtual address */
-+ addl $__PAGE_OFFSET, %esp
-
- /*
- * Initialize eflags. Some BIOS's leave bits like NT set. This would
-@@ -344,9 +431,7 @@ ENTRY(startup_32_smp)
-
- #ifdef CONFIG_SMP
- cmpb $0, ready
-- jz 1f /* Initial CPU cleans BSS */
-- jmp checkCPUtype
--1:
-+ jnz checkCPUtype
- #endif /* CONFIG_SMP */
-
- /*
-@@ -424,7 +509,7 @@ is386: movl $2,%ecx # set MP
- 1: movl $(__KERNEL_DS),%eax # reload all the segment registers
- movl %eax,%ss # after changing gdt.
-
-- movl $(__USER_DS),%eax # DS/ES contains default USER segment
-+# movl $(__KERNEL_DS),%eax # DS/ES contains default KERNEL segment
- movl %eax,%ds
- movl %eax,%es
-
-@@ -438,15 +523,22 @@ is386: movl $2,%ecx # set MP
- */
- cmpb $0,ready
- jne 1f
-- movl $per_cpu__gdt_page,%eax
-+ movl $cpu_gdt_table,%eax
- movl $per_cpu__stack_canary,%ecx
-+#ifdef CONFIG_SMP
-+ addl $__per_cpu_load,%ecx
-+#endif
- movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
- shrl $16, %ecx
- movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
- movb %ch, 8 * GDT_ENTRY_STACK_CANARY + 7(%eax)
- 1:
--#endif
- movl $(__KERNEL_STACK_CANARY),%eax
-+#elif defined(CONFIG_PAX_MEMORY_UDEREF)
-+ movl $(__USER_DS),%eax
-+#else
-+ xorl %eax,%eax
-+#endif
- movl %eax,%gs
-
- xorl %eax,%eax # Clear LDT
-@@ -454,14 +546,7 @@ is386: movl $2,%ecx # set MP
-
- cld # gcc2 wants the direction flag cleared at all times
- pushl $0 # fake return address for unwinder
--#ifdef CONFIG_SMP
-- movb ready, %cl
- movb $1, ready
-- cmpb $0,%cl # the first CPU calls start_kernel
-- je 1f
-- movl (stack_start), %esp
--1:
--#endif /* CONFIG_SMP */
- jmp *(initial_code)
-
- /*
-@@ -546,22 +631,22 @@ early_page_fault:
- jmp early_fault
-
- early_fault:
-- cld
- #ifdef CONFIG_PRINTK
-+ cmpl $1,%ss:early_recursion_flag
-+ je hlt_loop
-+ incl %ss:early_recursion_flag
-+ cld
- pusha
- movl $(__KERNEL_DS),%eax
- movl %eax,%ds
- movl %eax,%es
-- cmpl $2,early_recursion_flag
-- je hlt_loop
-- incl early_recursion_flag
- movl %cr2,%eax
- pushl %eax
- pushl %edx /* trapno */
- pushl $fault_msg
- call printk
-+; call dump_stack
- #endif
-- call dump_stack
- hlt_loop:
- hlt
- jmp hlt_loop
-@@ -569,8 +654,11 @@ hlt_loop:
- /* This is the default interrupt "handler" :-) */
- ALIGN
- ignore_int:
-- cld
- #ifdef CONFIG_PRINTK
-+ cmpl $2,%ss:early_recursion_flag
-+ je hlt_loop
-+ incl %ss:early_recursion_flag
-+ cld
- pushl %eax
- pushl %ecx
- pushl %edx
-@@ -579,9 +667,6 @@ ignore_int:
- movl $(__KERNEL_DS),%eax
- movl %eax,%ds
- movl %eax,%es
-- cmpl $2,early_recursion_flag
-- je hlt_loop
-- incl early_recursion_flag
- pushl 16(%esp)
- pushl 24(%esp)
- pushl 32(%esp)
-@@ -600,6 +685,8 @@ ignore_int:
- #endif
- iret
-
-+#include "verify_cpu.S"
-+
- __REFDATA
- .align 4
- ENTRY(initial_code)
-@@ -610,31 +697,47 @@ ENTRY(initial_page_table)
- /*
- * BSS section
- */
--__PAGE_ALIGNED_BSS
-- .align PAGE_SIZE_asm
- #ifdef CONFIG_X86_PAE
-+.section .swapper_pg_pmd,"a",@progbits
- swapper_pg_pmd:
- .fill 1024*KPMDS,4,0
- #else
-+.section .swapper_pg_dir,"a",@progbits
- ENTRY(swapper_pg_dir)
- .fill 1024,4,0
- #endif
-+.section .swapper_pg_fixmap,"a",@progbits
- swapper_pg_fixmap:
- .fill 1024,4,0
- #ifdef CONFIG_X86_TRAMPOLINE
-+.section .trampoline_pg_dir,"a",@progbits
- ENTRY(trampoline_pg_dir)
-+#ifdef CONFIG_X86_PAE
-+ .fill 4,8,0
-+#else
- .fill 1024,4,0
- #endif
-+#endif
-+
-+.section .empty_zero_page,"a",@progbits
- ENTRY(empty_zero_page)
- .fill 4096,1,0
-
- /*
-+ * The IDT has to be page-aligned to simplify the Pentium
-+ * F0 0F bug workaround.. We have a special link segment
-+ * for this.
-+ */
-+.section .idt,"a",@progbits
-+ENTRY(idt_table)
-+ .fill 256,8,0
-+
-+/*
- * This starts the data section.
- */
- #ifdef CONFIG_X86_PAE
--__PAGE_ALIGNED_DATA
-- /* Page-aligned for the benefit of paravirt? */
-- .align PAGE_SIZE_asm
-+.section .swapper_pg_dir,"a",@progbits
-+
- ENTRY(swapper_pg_dir)
- .long pa(swapper_pg_pmd+PGD_IDENT_ATTR),0 /* low identity map */
- # if KPMDS == 3
-@@ -653,15 +756,24 @@ ENTRY(swapper_pg_dir)
- # error "Kernel PMDs should be 1, 2 or 3"
- # endif
- .align PAGE_SIZE_asm /* needs to be page-sized too */
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ENTRY(cpu_pgd)
-+ .rept NR_CPUS
-+ .fill 4,8,0
-+ .endr
-+#endif
-+
- #endif
-
- .data
-+.balign 4
- ENTRY(stack_start)
-- .long init_thread_union+THREAD_SIZE
-- .long __BOOT_DS
-+ .long init_thread_union+THREAD_SIZE-8
-
- ready: .byte 0
-
-+.section .rodata,"a",@progbits
- early_recursion_flag:
- .long 0
-
-@@ -697,7 +809,7 @@ fault_msg:
- .word 0 # 32 bit align gdt_desc.address
- boot_gdt_descr:
- .word __BOOT_DS+7
-- .long boot_gdt - __PAGE_OFFSET
-+ .long pa(boot_gdt)
-
- .word 0 # 32-bit align idt_desc.address
- idt_descr:
-@@ -708,7 +820,7 @@ idt_descr:
- .word 0 # 32 bit align gdt_desc.address
- ENTRY(early_gdt_descr)
- .word GDT_ENTRIES*8-1
-- .long per_cpu__gdt_page /* Overwritten for secondary CPUs */
-+ .long cpu_gdt_table /* Overwritten for secondary CPUs */
-
- /*
- * The boot_gdt must mirror the equivalent in setup.S and is
-@@ -717,5 +829,65 @@ ENTRY(early_gdt_descr)
- .align L1_CACHE_BYTES
- ENTRY(boot_gdt)
- .fill GDT_ENTRY_BOOT_CS,8,0
-- .quad 0x00cf9a000000ffff /* kernel 4GB code at 0x00000000 */
-- .quad 0x00cf92000000ffff /* kernel 4GB data at 0x00000000 */
-+ .quad 0x00cf9b000000ffff /* kernel 4GB code at 0x00000000 */
-+ .quad 0x00cf93000000ffff /* kernel 4GB data at 0x00000000 */
-+
-+ .align PAGE_SIZE_asm
-+ENTRY(cpu_gdt_table)
-+ .rept NR_CPUS
-+ .quad 0x0000000000000000 /* NULL descriptor */
-+ .quad 0x0000000000000000 /* 0x0b reserved */
-+ .quad 0x0000000000000000 /* 0x13 reserved */
-+ .quad 0x0000000000000000 /* 0x1b reserved */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ .quad 0x00cf9b000000ffff /* 0x20 alternate kernel 4GB code at 0x00000000 */
-+#else
-+ .quad 0x0000000000000000 /* 0x20 unused */
-+#endif
-+
-+ .quad 0x0000000000000000 /* 0x28 unused */
-+ .quad 0x0000000000000000 /* 0x33 TLS entry 1 */
-+ .quad 0x0000000000000000 /* 0x3b TLS entry 2 */
-+ .quad 0x0000000000000000 /* 0x43 TLS entry 3 */
-+ .quad 0x0000000000000000 /* 0x4b reserved */
-+ .quad 0x0000000000000000 /* 0x53 reserved */
-+ .quad 0x0000000000000000 /* 0x5b reserved */
-+
-+ .quad 0x00cf9b000000ffff /* 0x60 kernel 4GB code at 0x00000000 */
-+ .quad 0x00cf93000000ffff /* 0x68 kernel 4GB data at 0x00000000 */
-+ .quad 0x00cffb000000ffff /* 0x73 user 4GB code at 0x00000000 */
-+ .quad 0x00cff3000000ffff /* 0x7b user 4GB data at 0x00000000 */
-+
-+ .quad 0x0000000000000000 /* 0x80 TSS descriptor */
-+ .quad 0x0000000000000000 /* 0x88 LDT descriptor */
-+
-+ /*
-+ * Segments used for calling PnP BIOS have byte granularity.
-+ * The code segments and data segments have fixed 64k limits,
-+ * the transfer segment sizes are set at run time.
-+ */
-+ .quad 0x00409b000000ffff /* 0x90 32-bit code */
-+ .quad 0x00009b000000ffff /* 0x98 16-bit code */
-+ .quad 0x000093000000ffff /* 0xa0 16-bit data */
-+ .quad 0x0000930000000000 /* 0xa8 16-bit data */
-+ .quad 0x0000930000000000 /* 0xb0 16-bit data */
-+
-+ /*
-+ * The APM segments have byte granularity and their bases
-+ * are set at run time. All have 64k limits.
-+ */
-+ .quad 0x00409b000000ffff /* 0xb8 APM CS code */
-+ .quad 0x00009b000000ffff /* 0xc0 APM CS 16 code (16 bit) */
-+ .quad 0x004093000000ffff /* 0xc8 APM DS data */
-+
-+ .quad 0x00c0930000000000 /* 0xd0 - ESPFIX SS */
-+ .quad 0x0040930000000000 /* 0xd8 - PERCPU */
-+ .quad 0x0040910000000017 /* 0xe0 - STACK_CANARY */
-+ .quad 0x0000000000000000 /* 0xe8 - PCIBIOS_CS */
-+ .quad 0x0000000000000000 /* 0xf0 - PCIBIOS_DS */
-+ .quad 0x0000000000000000 /* 0xf8 - GDT entry 31: double-fault TSS */
-+
-+ /* Be sure this is zeroed to avoid false validations in Xen */
-+ .fill PAGE_SIZE_asm - GDT_SIZE,1,0
-+ .endr
-diff -urNp linux-2.6.32.45/arch/x86/kernel/head_64.S linux-2.6.32.45/arch/x86/kernel/head_64.S
---- linux-2.6.32.45/arch/x86/kernel/head_64.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/head_64.S 2011-04-17 15:56:46.000000000 -0400
-@@ -19,6 +19,7 @@
- #include <asm/cache.h>
- #include <asm/processor-flags.h>
- #include <asm/percpu.h>
-+#include <asm/cpufeature.h>
-
- #ifdef CONFIG_PARAVIRT
- #include <asm/asm-offsets.h>
-@@ -38,6 +39,10 @@ L4_PAGE_OFFSET = pgd_index(__PAGE_OFFSET
- L3_PAGE_OFFSET = pud_index(__PAGE_OFFSET)
- L4_START_KERNEL = pgd_index(__START_KERNEL_map)
- L3_START_KERNEL = pud_index(__START_KERNEL_map)
-+L4_VMALLOC_START = pgd_index(VMALLOC_START)
-+L3_VMALLOC_START = pud_index(VMALLOC_START)
-+L4_VMEMMAP_START = pgd_index(VMEMMAP_START)
-+L3_VMEMMAP_START = pud_index(VMEMMAP_START)
-
- .text
- __HEAD
-@@ -85,35 +90,22 @@ startup_64:
- */
- addq %rbp, init_level4_pgt + 0(%rip)
- addq %rbp, init_level4_pgt + (L4_PAGE_OFFSET*8)(%rip)
-+ addq %rbp, init_level4_pgt + (L4_VMALLOC_START*8)(%rip)
-+ addq %rbp, init_level4_pgt + (L4_VMEMMAP_START*8)(%rip)
- addq %rbp, init_level4_pgt + (L4_START_KERNEL*8)(%rip)
-
- addq %rbp, level3_ident_pgt + 0(%rip)
-+#ifndef CONFIG_XEN
-+ addq %rbp, level3_ident_pgt + 8(%rip)
-+#endif
-
-- addq %rbp, level3_kernel_pgt + (510*8)(%rip)
-- addq %rbp, level3_kernel_pgt + (511*8)(%rip)
-+ addq %rbp, level3_vmemmap_pgt + (L3_VMEMMAP_START*8)(%rip)
-
-- addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
-+ addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8)(%rip)
-+ addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8+8)(%rip)
-
-- /* Add an Identity mapping if I am above 1G */
-- leaq _text(%rip), %rdi
-- andq $PMD_PAGE_MASK, %rdi
--
-- movq %rdi, %rax
-- shrq $PUD_SHIFT, %rax
-- andq $(PTRS_PER_PUD - 1), %rax
-- jz ident_complete
--
-- leaq (level2_spare_pgt - __START_KERNEL_map + _KERNPG_TABLE)(%rbp), %rdx
-- leaq level3_ident_pgt(%rip), %rbx
-- movq %rdx, 0(%rbx, %rax, 8)
--
-- movq %rdi, %rax
-- shrq $PMD_SHIFT, %rax
-- andq $(PTRS_PER_PMD - 1), %rax
-- leaq __PAGE_KERNEL_IDENT_LARGE_EXEC(%rdi), %rdx
-- leaq level2_spare_pgt(%rip), %rbx
-- movq %rdx, 0(%rbx, %rax, 8)
--ident_complete:
-+ addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
-+ addq %rbp, level2_fixmap_pgt + (507*8)(%rip)
-
- /*
- * Fixup the kernel text+data virtual addresses. Note that
-@@ -161,8 +153,8 @@ ENTRY(secondary_startup_64)
- * after the boot processor executes this code.
- */
-
-- /* Enable PAE mode and PGE */
-- movl $(X86_CR4_PAE | X86_CR4_PGE), %eax
-+ /* Enable PAE mode and PSE/PGE */
-+ movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
- movq %rax, %cr4
-
- /* Setup early boot stage 4 level pagetables. */
-@@ -184,9 +176,13 @@ ENTRY(secondary_startup_64)
- movl $MSR_EFER, %ecx
- rdmsr
- btsl $_EFER_SCE, %eax /* Enable System Call */
-- btl $20,%edi /* No Execute supported? */
-+ btl $(X86_FEATURE_NX & 31),%edi /* No Execute supported? */
- jnc 1f
- btsl $_EFER_NX, %eax
-+ leaq init_level4_pgt(%rip), %rdi
-+ btsq $_PAGE_BIT_NX, 8*L4_PAGE_OFFSET(%rdi)
-+ btsq $_PAGE_BIT_NX, 8*L4_VMALLOC_START(%rdi)
-+ btsq $_PAGE_BIT_NX, 8*L4_VMEMMAP_START(%rdi)
- 1: wrmsr /* Make changes effective */
-
- /* Setup cr0 */
-@@ -262,16 +258,16 @@ ENTRY(secondary_startup_64)
- .quad x86_64_start_kernel
- ENTRY(initial_gs)
- .quad INIT_PER_CPU_VAR(irq_stack_union)
-- __FINITDATA
-
- ENTRY(stack_start)
- .quad init_thread_union+THREAD_SIZE-8
- .word 0
-+ __FINITDATA
-
- bad_address:
- jmp bad_address
-
-- .section ".init.text","ax"
-+ __INIT
- #ifdef CONFIG_EARLY_PRINTK
- .globl early_idt_handlers
- early_idt_handlers:
-@@ -316,18 +312,23 @@ ENTRY(early_idt_handler)
- #endif /* EARLY_PRINTK */
- 1: hlt
- jmp 1b
-+ .previous
-
- #ifdef CONFIG_EARLY_PRINTK
-+ __INITDATA
- early_recursion_flag:
- .long 0
-+ .previous
-
-+ .section .rodata,"a",@progbits
- early_idt_msg:
- .asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n"
- early_idt_ripmsg:
- .asciz "RIP %s\n"
--#endif /* CONFIG_EARLY_PRINTK */
- .previous
-+#endif /* CONFIG_EARLY_PRINTK */
-
-+ .section .rodata,"a",@progbits
- #define NEXT_PAGE(name) \
- .balign PAGE_SIZE; \
- ENTRY(name)
-@@ -350,13 +351,36 @@ NEXT_PAGE(init_level4_pgt)
- .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
- .org init_level4_pgt + L4_PAGE_OFFSET*8, 0
- .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
-+ .org init_level4_pgt + L4_VMALLOC_START*8, 0
-+ .quad level3_vmalloc_pgt - __START_KERNEL_map + _KERNPG_TABLE
-+ .org init_level4_pgt + L4_VMEMMAP_START*8, 0
-+ .quad level3_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
- .org init_level4_pgt + L4_START_KERNEL*8, 0
- /* (2^48-(2*1024*1024*1024))/(2^39) = 511 */
- .quad level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE
-
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+NEXT_PAGE(cpu_pgd)
-+ .rept NR_CPUS
-+ .fill 512,8,0
-+ .endr
-+#endif
-+
- NEXT_PAGE(level3_ident_pgt)
- .quad level2_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
-+#ifdef CONFIG_XEN
- .fill 511,8,0
-+#else
-+ .quad level2_ident_pgt + PAGE_SIZE - __START_KERNEL_map + _KERNPG_TABLE
-+ .fill 510,8,0
-+#endif
-+
-+NEXT_PAGE(level3_vmalloc_pgt)
-+ .fill 512,8,0
-+
-+NEXT_PAGE(level3_vmemmap_pgt)
-+ .fill L3_VMEMMAP_START,8,0
-+ .quad level2_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
-
- NEXT_PAGE(level3_kernel_pgt)
- .fill L3_START_KERNEL,8,0
-@@ -364,20 +388,23 @@ NEXT_PAGE(level3_kernel_pgt)
- .quad level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE
- .quad level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
-
-+NEXT_PAGE(level2_vmemmap_pgt)
-+ .fill 512,8,0
-+
- NEXT_PAGE(level2_fixmap_pgt)
-- .fill 506,8,0
-- .quad level1_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
-- /* 8MB reserved for vsyscalls + a 2MB hole = 4 + 1 entries */
-- .fill 5,8,0
-+ .fill 507,8,0
-+ .quad level1_vsyscall_pgt - __START_KERNEL_map + _PAGE_TABLE
-+ /* 6MB reserved for vsyscalls + a 2MB hole = 3 + 1 entries */
-+ .fill 4,8,0
-
--NEXT_PAGE(level1_fixmap_pgt)
-+NEXT_PAGE(level1_vsyscall_pgt)
- .fill 512,8,0
-
--NEXT_PAGE(level2_ident_pgt)
-- /* Since I easily can, map the first 1G.
-+ /* Since I easily can, map the first 2G.
- * Don't set NX because code runs from these pages.
- */
-- PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, PTRS_PER_PMD)
-+NEXT_PAGE(level2_ident_pgt)
-+ PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, 2*PTRS_PER_PMD)
-
- NEXT_PAGE(level2_kernel_pgt)
- /*
-@@ -390,33 +417,55 @@ NEXT_PAGE(level2_kernel_pgt)
- * If you want to increase this then increase MODULES_VADDR
- * too.)
- */
-- PMDS(0, __PAGE_KERNEL_LARGE_EXEC,
-- KERNEL_IMAGE_SIZE/PMD_SIZE)
--
--NEXT_PAGE(level2_spare_pgt)
-- .fill 512, 8, 0
-+ PMDS(0, __PAGE_KERNEL_LARGE_EXEC, KERNEL_IMAGE_SIZE/PMD_SIZE)
-
- #undef PMDS
- #undef NEXT_PAGE
-
-- .data
-+ .align PAGE_SIZE
-+ENTRY(cpu_gdt_table)
-+ .rept NR_CPUS
-+ .quad 0x0000000000000000 /* NULL descriptor */
-+ .quad 0x00cf9b000000ffff /* __KERNEL32_CS */
-+ .quad 0x00af9b000000ffff /* __KERNEL_CS */
-+ .quad 0x00cf93000000ffff /* __KERNEL_DS */
-+ .quad 0x00cffb000000ffff /* __USER32_CS */
-+ .quad 0x00cff3000000ffff /* __USER_DS, __USER32_DS */
-+ .quad 0x00affb000000ffff /* __USER_CS */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ .quad 0x00af9b000000ffff /* __KERNEXEC_KERNEL_CS */
-+#else
-+ .quad 0x0 /* unused */
-+#endif
-+
-+ .quad 0,0 /* TSS */
-+ .quad 0,0 /* LDT */
-+ .quad 0,0,0 /* three TLS descriptors */
-+ .quad 0x0000f40000000000 /* node/CPU stored in limit */
-+ /* asm/segment.h:GDT_ENTRIES must match this */
-+
-+ /* zero the remaining page */
-+ .fill PAGE_SIZE / 8 - GDT_ENTRIES,8,0
-+ .endr
-+
- .align 16
- .globl early_gdt_descr
- early_gdt_descr:
- .word GDT_ENTRIES*8-1
- early_gdt_descr_base:
-- .quad INIT_PER_CPU_VAR(gdt_page)
-+ .quad cpu_gdt_table
-
- ENTRY(phys_base)
- /* This must match the first entry in level2_kernel_pgt */
- .quad 0x0000000000000000
-
- #include "../../x86/xen/xen-head.S"
--
-- .section .bss, "aw", @nobits
-+
-+ .section .rodata,"a",@progbits
- .align L1_CACHE_BYTES
- ENTRY(idt_table)
-- .skip IDT_ENTRIES * 16
-+ .fill 512,8,0
-
- __PAGE_ALIGNED_BSS
- .align PAGE_SIZE
-diff -urNp linux-2.6.32.45/arch/x86/kernel/i386_ksyms_32.c linux-2.6.32.45/arch/x86/kernel/i386_ksyms_32.c
---- linux-2.6.32.45/arch/x86/kernel/i386_ksyms_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/i386_ksyms_32.c 2011-04-17 15:56:46.000000000 -0400
-@@ -20,8 +20,12 @@ extern void cmpxchg8b_emu(void);
- EXPORT_SYMBOL(cmpxchg8b_emu);
- #endif
-
-+EXPORT_SYMBOL_GPL(cpu_gdt_table);
-+
- /* Networking helper routines. */
- EXPORT_SYMBOL(csum_partial_copy_generic);
-+EXPORT_SYMBOL(csum_partial_copy_generic_to_user);
-+EXPORT_SYMBOL(csum_partial_copy_generic_from_user);
-
- EXPORT_SYMBOL(__get_user_1);
- EXPORT_SYMBOL(__get_user_2);
-@@ -36,3 +40,7 @@ EXPORT_SYMBOL(strstr);
-
- EXPORT_SYMBOL(csum_partial);
- EXPORT_SYMBOL(empty_zero_page);
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+EXPORT_SYMBOL(__LOAD_PHYSICAL_ADDR);
-+#endif
-diff -urNp linux-2.6.32.45/arch/x86/kernel/i8259.c linux-2.6.32.45/arch/x86/kernel/i8259.c
---- linux-2.6.32.45/arch/x86/kernel/i8259.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/i8259.c 2011-05-04 17:56:28.000000000 -0400
-@@ -208,7 +208,7 @@ spurious_8259A_irq:
- "spurious 8259A interrupt: IRQ%d.\n", irq);
- spurious_irq_mask |= irqmask;
- }
-- atomic_inc(&irq_err_count);
-+ atomic_inc_unchecked(&irq_err_count);
- /*
- * Theoretically we do not have to handle this IRQ,
- * but in Linux this does not cause problems and is
-diff -urNp linux-2.6.32.45/arch/x86/kernel/init_task.c linux-2.6.32.45/arch/x86/kernel/init_task.c
---- linux-2.6.32.45/arch/x86/kernel/init_task.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/init_task.c 2011-04-17 15:56:46.000000000 -0400
-@@ -20,8 +20,7 @@ static struct sighand_struct init_sighan
- * way process stacks are handled. This is done by having a special
- * "init_task" linker map entry..
- */
--union thread_union init_thread_union __init_task_data =
-- { INIT_THREAD_INFO(init_task) };
-+union thread_union init_thread_union __init_task_data;
-
- /*
- * Initial task structure.
-@@ -38,5 +37,5 @@ EXPORT_SYMBOL(init_task);
- * section. Since TSS's are completely CPU-local, we want them
- * on exact cacheline boundaries, to eliminate cacheline ping-pong.
- */
--DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss) = INIT_TSS;
--
-+struct tss_struct init_tss[NR_CPUS] ____cacheline_internodealigned_in_smp = { [0 ... NR_CPUS-1] = INIT_TSS };
-+EXPORT_SYMBOL(init_tss);
-diff -urNp linux-2.6.32.45/arch/x86/kernel/ioport.c linux-2.6.32.45/arch/x86/kernel/ioport.c
---- linux-2.6.32.45/arch/x86/kernel/ioport.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/ioport.c 2011-04-17 15:56:46.000000000 -0400
-@@ -6,6 +6,7 @@
- #include <linux/sched.h>
- #include <linux/kernel.h>
- #include <linux/capability.h>
-+#include <linux/security.h>
- #include <linux/errno.h>
- #include <linux/types.h>
- #include <linux/ioport.h>
-@@ -41,6 +42,12 @@ asmlinkage long sys_ioperm(unsigned long
-
- if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
- return -EINVAL;
-+#ifdef CONFIG_GRKERNSEC_IO
-+ if (turn_on && grsec_disable_privio) {
-+ gr_handle_ioperm();
-+ return -EPERM;
-+ }
-+#endif
- if (turn_on && !capable(CAP_SYS_RAWIO))
- return -EPERM;
-
-@@ -67,7 +74,7 @@ asmlinkage long sys_ioperm(unsigned long
- * because the ->io_bitmap_max value must match the bitmap
- * contents:
- */
-- tss = &per_cpu(init_tss, get_cpu());
-+ tss = init_tss + get_cpu();
-
- set_bitmap(t->io_bitmap_ptr, from, num, !turn_on);
-
-@@ -111,6 +118,12 @@ static int do_iopl(unsigned int level, s
- return -EINVAL;
- /* Trying to gain more privileges? */
- if (level > old) {
-+#ifdef CONFIG_GRKERNSEC_IO
-+ if (grsec_disable_privio) {
-+ gr_handle_iopl();
-+ return -EPERM;
-+ }
-+#endif
- if (!capable(CAP_SYS_RAWIO))
- return -EPERM;
- }
-diff -urNp linux-2.6.32.45/arch/x86/kernel/irq_32.c linux-2.6.32.45/arch/x86/kernel/irq_32.c
---- linux-2.6.32.45/arch/x86/kernel/irq_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/irq_32.c 2011-07-06 19:53:33.000000000 -0400
-@@ -35,7 +35,7 @@ static int check_stack_overflow(void)
- __asm__ __volatile__("andl %%esp,%0" :
- "=r" (sp) : "0" (THREAD_SIZE - 1));
-
-- return sp < (sizeof(struct thread_info) + STACK_WARN);
-+ return sp < STACK_WARN;
- }
-
- static void print_stack_overflow(void)
-@@ -54,9 +54,9 @@ static inline void print_stack_overflow(
- * per-CPU IRQ handling contexts (thread information and stack)
- */
- union irq_ctx {
-- struct thread_info tinfo;
-- u32 stack[THREAD_SIZE/sizeof(u32)];
--} __attribute__((aligned(PAGE_SIZE)));
-+ unsigned long previous_esp;
-+ u32 stack[THREAD_SIZE/sizeof(u32)];
-+} __attribute__((aligned(THREAD_SIZE)));
-
- static DEFINE_PER_CPU(union irq_ctx *, hardirq_ctx);
- static DEFINE_PER_CPU(union irq_ctx *, softirq_ctx);
-@@ -78,10 +78,9 @@ static void call_on_stack(void *func, vo
- static inline int
- execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
- {
-- union irq_ctx *curctx, *irqctx;
-+ union irq_ctx *irqctx;
- u32 *isp, arg1, arg2;
-
-- curctx = (union irq_ctx *) current_thread_info();
- irqctx = __get_cpu_var(hardirq_ctx);
-
- /*
-@@ -90,21 +89,16 @@ execute_on_irq_stack(int overflow, struc
- * handler) we can't do that and just have to keep using the
- * current stack (which is the irq stack already after all)
- */
-- if (unlikely(curctx == irqctx))
-+ if (unlikely((void *)current_stack_pointer - (void *)irqctx < THREAD_SIZE))
- return 0;
-
- /* build the stack frame on the IRQ stack */
-- isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
-- irqctx->tinfo.task = curctx->tinfo.task;
-- irqctx->tinfo.previous_esp = current_stack_pointer;
-+ isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
-+ irqctx->previous_esp = current_stack_pointer;
-
-- /*
-- * Copy the softirq bits in preempt_count so that the
-- * softirq checks work in the hardirq context.
-- */
-- irqctx->tinfo.preempt_count =
-- (irqctx->tinfo.preempt_count & ~SOFTIRQ_MASK) |
-- (curctx->tinfo.preempt_count & SOFTIRQ_MASK);
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ __set_fs(MAKE_MM_SEG(0));
-+#endif
-
- if (unlikely(overflow))
- call_on_stack(print_stack_overflow, isp);
-@@ -116,6 +110,11 @@ execute_on_irq_stack(int overflow, struc
- : "0" (irq), "1" (desc), "2" (isp),
- "D" (desc->handle_irq)
- : "memory", "cc", "ecx");
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ __set_fs(current_thread_info()->addr_limit);
-+#endif
-+
- return 1;
- }
-
-@@ -124,28 +123,11 @@ execute_on_irq_stack(int overflow, struc
- */
- void __cpuinit irq_ctx_init(int cpu)
- {
-- union irq_ctx *irqctx;
--
- if (per_cpu(hardirq_ctx, cpu))
- return;
-
-- irqctx = &per_cpu(hardirq_stack, cpu);
-- irqctx->tinfo.task = NULL;
-- irqctx->tinfo.exec_domain = NULL;
-- irqctx->tinfo.cpu = cpu;
-- irqctx->tinfo.preempt_count = HARDIRQ_OFFSET;
-- irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
--
-- per_cpu(hardirq_ctx, cpu) = irqctx;
--
-- irqctx = &per_cpu(softirq_stack, cpu);
-- irqctx->tinfo.task = NULL;
-- irqctx->tinfo.exec_domain = NULL;
-- irqctx->tinfo.cpu = cpu;
-- irqctx->tinfo.preempt_count = 0;
-- irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
--
-- per_cpu(softirq_ctx, cpu) = irqctx;
-+ per_cpu(hardirq_ctx, cpu) = &per_cpu(hardirq_stack, cpu);
-+ per_cpu(softirq_ctx, cpu) = &per_cpu(softirq_stack, cpu);
-
- printk(KERN_DEBUG "CPU %u irqstacks, hard=%p soft=%p\n",
- cpu, per_cpu(hardirq_ctx, cpu), per_cpu(softirq_ctx, cpu));
-@@ -159,7 +141,6 @@ void irq_ctx_exit(int cpu)
- asmlinkage void do_softirq(void)
- {
- unsigned long flags;
-- struct thread_info *curctx;
- union irq_ctx *irqctx;
- u32 *isp;
-
-@@ -169,15 +150,22 @@ asmlinkage void do_softirq(void)
- local_irq_save(flags);
-
- if (local_softirq_pending()) {
-- curctx = current_thread_info();
- irqctx = __get_cpu_var(softirq_ctx);
-- irqctx->tinfo.task = curctx->task;
-- irqctx->tinfo.previous_esp = current_stack_pointer;
-+ irqctx->previous_esp = current_stack_pointer;
-
- /* build the stack frame on the softirq stack */
-- isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
-+ isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ __set_fs(MAKE_MM_SEG(0));
-+#endif
-
- call_on_stack(__do_softirq, isp);
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ __set_fs(current_thread_info()->addr_limit);
-+#endif
-+
- /*
- * Shouldnt happen, we returned above if in_interrupt():
- */
-diff -urNp linux-2.6.32.45/arch/x86/kernel/irq.c linux-2.6.32.45/arch/x86/kernel/irq.c
---- linux-2.6.32.45/arch/x86/kernel/irq.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/irq.c 2011-05-04 17:56:28.000000000 -0400
-@@ -15,7 +15,7 @@
- #include <asm/mce.h>
- #include <asm/hw_irq.h>
-
--atomic_t irq_err_count;
-+atomic_unchecked_t irq_err_count;
-
- /* Function pointer for generic interrupt vector handling */
- void (*generic_interrupt_extension)(void) = NULL;
-@@ -114,9 +114,9 @@ static int show_other_interrupts(struct
- seq_printf(p, "%10u ", per_cpu(mce_poll_count, j));
- seq_printf(p, " Machine check polls\n");
- #endif
-- seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read(&irq_err_count));
-+ seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read_unchecked(&irq_err_count));
- #if defined(CONFIG_X86_IO_APIC)
-- seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read(&irq_mis_count));
-+ seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read_unchecked(&irq_mis_count));
- #endif
- return 0;
- }
-@@ -209,10 +209,10 @@ u64 arch_irq_stat_cpu(unsigned int cpu)
-
- u64 arch_irq_stat(void)
- {
-- u64 sum = atomic_read(&irq_err_count);
-+ u64 sum = atomic_read_unchecked(&irq_err_count);
-
- #ifdef CONFIG_X86_IO_APIC
-- sum += atomic_read(&irq_mis_count);
-+ sum += atomic_read_unchecked(&irq_mis_count);
- #endif
- return sum;
- }
-diff -urNp linux-2.6.32.45/arch/x86/kernel/kgdb.c linux-2.6.32.45/arch/x86/kernel/kgdb.c
---- linux-2.6.32.45/arch/x86/kernel/kgdb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/kgdb.c 2011-05-04 17:56:20.000000000 -0400
-@@ -390,13 +390,13 @@ int kgdb_arch_handle_exception(int e_vec
-
- /* clear the trace bit */
- linux_regs->flags &= ~X86_EFLAGS_TF;
-- atomic_set(&kgdb_cpu_doing_single_step, -1);
-+ atomic_set_unchecked(&kgdb_cpu_doing_single_step, -1);
-
- /* set the trace bit if we're stepping */
- if (remcomInBuffer[0] == 's') {
- linux_regs->flags |= X86_EFLAGS_TF;
- kgdb_single_step = 1;
-- atomic_set(&kgdb_cpu_doing_single_step,
-+ atomic_set_unchecked(&kgdb_cpu_doing_single_step,
- raw_smp_processor_id());
- }
-
-@@ -476,7 +476,7 @@ static int __kgdb_notify(struct die_args
- break;
-
- case DIE_DEBUG:
-- if (atomic_read(&kgdb_cpu_doing_single_step) ==
-+ if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) ==
- raw_smp_processor_id()) {
- if (user_mode(regs))
- return single_step_cont(regs, args);
-@@ -573,7 +573,7 @@ unsigned long kgdb_arch_pc(int exception
- return instruction_pointer(regs);
- }
-
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- /* Breakpoint instruction: */
- .gdb_bpt_instr = { 0xcc },
- .flags = KGDB_HW_BREAKPOINT,
-diff -urNp linux-2.6.32.45/arch/x86/kernel/kprobes.c linux-2.6.32.45/arch/x86/kernel/kprobes.c
---- linux-2.6.32.45/arch/x86/kernel/kprobes.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/kprobes.c 2011-04-17 15:56:46.000000000 -0400
-@@ -166,9 +166,13 @@ static void __kprobes set_jmp_op(void *f
- char op;
- s32 raddr;
- } __attribute__((packed)) * jop;
-- jop = (struct __arch_jmp_op *)from;
-+
-+ jop = (struct __arch_jmp_op *)(ktla_ktva(from));
-+
-+ pax_open_kernel();
- jop->raddr = (s32)((long)(to) - ((long)(from) + 5));
- jop->op = RELATIVEJUMP_INSTRUCTION;
-+ pax_close_kernel();
- }
-
- /*
-@@ -193,7 +197,7 @@ static int __kprobes can_boost(kprobe_op
- kprobe_opcode_t opcode;
- kprobe_opcode_t *orig_opcodes = opcodes;
-
-- if (search_exception_tables((unsigned long)opcodes))
-+ if (search_exception_tables(ktva_ktla((unsigned long)opcodes)))
- return 0; /* Page fault may occur on this address. */
-
- retry:
-@@ -337,7 +341,9 @@ static void __kprobes fix_riprel(struct
- disp = (u8 *) p->addr + *((s32 *) insn) -
- (u8 *) p->ainsn.insn;
- BUG_ON((s64) (s32) disp != disp); /* Sanity check. */
-+ pax_open_kernel();
- *(s32 *)insn = (s32) disp;
-+ pax_close_kernel();
- }
- }
- #endif
-@@ -345,16 +351,18 @@ static void __kprobes fix_riprel(struct
-
- static void __kprobes arch_copy_kprobe(struct kprobe *p)
- {
-- memcpy(p->ainsn.insn, p->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
-+ pax_open_kernel();
-+ memcpy(p->ainsn.insn, ktla_ktva(p->addr), MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
-+ pax_close_kernel();
-
- fix_riprel(p);
-
-- if (can_boost(p->addr))
-+ if (can_boost(ktla_ktva(p->addr)))
- p->ainsn.boostable = 0;
- else
- p->ainsn.boostable = -1;
-
-- p->opcode = *p->addr;
-+ p->opcode = *(ktla_ktva(p->addr));
- }
-
- int __kprobes arch_prepare_kprobe(struct kprobe *p)
-@@ -432,7 +440,7 @@ static void __kprobes prepare_singlestep
- if (p->opcode == BREAKPOINT_INSTRUCTION)
- regs->ip = (unsigned long)p->addr;
- else
-- regs->ip = (unsigned long)p->ainsn.insn;
-+ regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
- }
-
- void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri,
-@@ -453,7 +461,7 @@ static void __kprobes setup_singlestep(s
- if (p->ainsn.boostable == 1 && !p->post_handler) {
- /* Boost up -- we can execute copied instructions directly */
- reset_current_kprobe();
-- regs->ip = (unsigned long)p->ainsn.insn;
-+ regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
- preempt_enable_no_resched();
- return;
- }
-@@ -523,7 +531,7 @@ static int __kprobes kprobe_handler(stru
- struct kprobe_ctlblk *kcb;
-
- addr = (kprobe_opcode_t *)(regs->ip - sizeof(kprobe_opcode_t));
-- if (*addr != BREAKPOINT_INSTRUCTION) {
-+ if (*(kprobe_opcode_t *)ktla_ktva((unsigned long)addr) != BREAKPOINT_INSTRUCTION) {
- /*
- * The breakpoint instruction was removed right
- * after we hit it. Another cpu has removed
-@@ -775,7 +783,7 @@ static void __kprobes resume_execution(s
- struct pt_regs *regs, struct kprobe_ctlblk *kcb)
- {
- unsigned long *tos = stack_addr(regs);
-- unsigned long copy_ip = (unsigned long)p->ainsn.insn;
-+ unsigned long copy_ip = ktva_ktla((unsigned long)p->ainsn.insn);
- unsigned long orig_ip = (unsigned long)p->addr;
- kprobe_opcode_t *insn = p->ainsn.insn;
-
-@@ -958,7 +966,7 @@ int __kprobes kprobe_exceptions_notify(s
- struct die_args *args = data;
- int ret = NOTIFY_DONE;
-
-- if (args->regs && user_mode_vm(args->regs))
-+ if (args->regs && user_mode(args->regs))
- return ret;
-
- switch (val) {
-diff -urNp linux-2.6.32.45/arch/x86/kernel/ldt.c linux-2.6.32.45/arch/x86/kernel/ldt.c
---- linux-2.6.32.45/arch/x86/kernel/ldt.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/ldt.c 2011-04-17 15:56:46.000000000 -0400
-@@ -66,13 +66,13 @@ static int alloc_ldt(mm_context_t *pc, i
- if (reload) {
- #ifdef CONFIG_SMP
- preempt_disable();
-- load_LDT(pc);
-+ load_LDT_nolock(pc);
- if (!cpumask_equal(mm_cpumask(current->mm),
- cpumask_of(smp_processor_id())))
- smp_call_function(flush_ldt, current->mm, 1);
- preempt_enable();
- #else
-- load_LDT(pc);
-+ load_LDT_nolock(pc);
- #endif
- }
- if (oldsize) {
-@@ -94,7 +94,7 @@ static inline int copy_ldt(mm_context_t
- return err;
-
- for (i = 0; i < old->size; i++)
-- write_ldt_entry(new->ldt, i, old->ldt + i * LDT_ENTRY_SIZE);
-+ write_ldt_entry(new->ldt, i, old->ldt + i);
- return 0;
- }
-
-@@ -115,6 +115,24 @@ int init_new_context(struct task_struct
- retval = copy_ldt(&mm->context, &old_mm->context);
- mutex_unlock(&old_mm->context.lock);
- }
-+
-+ if (tsk == current) {
-+ mm->context.vdso = 0;
-+
-+#ifdef CONFIG_X86_32
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+ mm->context.user_cs_base = 0UL;
-+ mm->context.user_cs_limit = ~0UL;
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
-+ cpus_clear(mm->context.cpu_user_cs_mask);
-+#endif
-+
-+#endif
-+#endif
-+
-+ }
-+
- return retval;
- }
-
-@@ -229,6 +247,13 @@ static int write_ldt(void __user *ptr, u
- }
- }
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (ldt_info.contents & MODIFY_LDT_CONTENTS_CODE)) {
-+ error = -EINVAL;
-+ goto out_unlock;
-+ }
-+#endif
-+
- fill_ldt(&ldt, &ldt_info);
- if (oldmode)
- ldt.avl = 0;
-diff -urNp linux-2.6.32.45/arch/x86/kernel/machine_kexec_32.c linux-2.6.32.45/arch/x86/kernel/machine_kexec_32.c
---- linux-2.6.32.45/arch/x86/kernel/machine_kexec_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/machine_kexec_32.c 2011-04-17 15:56:46.000000000 -0400
-@@ -26,7 +26,7 @@
- #include <asm/system.h>
- #include <asm/cacheflush.h>
-
--static void set_idt(void *newidt, __u16 limit)
-+static void set_idt(struct desc_struct *newidt, __u16 limit)
- {
- struct desc_ptr curidt;
-
-@@ -38,7 +38,7 @@ static void set_idt(void *newidt, __u16
- }
-
-
--static void set_gdt(void *newgdt, __u16 limit)
-+static void set_gdt(struct desc_struct *newgdt, __u16 limit)
- {
- struct desc_ptr curgdt;
-
-@@ -217,7 +217,7 @@ void machine_kexec(struct kimage *image)
- }
-
- control_page = page_address(image->control_code_page);
-- memcpy(control_page, relocate_kernel, KEXEC_CONTROL_CODE_MAX_SIZE);
-+ memcpy(control_page, (void *)ktla_ktva((unsigned long)relocate_kernel), KEXEC_CONTROL_CODE_MAX_SIZE);
-
- relocate_kernel_ptr = control_page;
- page_list[PA_CONTROL_PAGE] = __pa(control_page);
-diff -urNp linux-2.6.32.45/arch/x86/kernel/microcode_amd.c linux-2.6.32.45/arch/x86/kernel/microcode_amd.c
---- linux-2.6.32.45/arch/x86/kernel/microcode_amd.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/microcode_amd.c 2011-04-17 17:03:05.000000000 -0400
-@@ -364,7 +364,7 @@ static void microcode_fini_cpu_amd(int c
- uci->mc = NULL;
- }
-
--static struct microcode_ops microcode_amd_ops = {
-+static const struct microcode_ops microcode_amd_ops = {
- .request_microcode_user = request_microcode_user,
- .request_microcode_fw = request_microcode_fw,
- .collect_cpu_info = collect_cpu_info_amd,
-@@ -372,7 +372,7 @@ static struct microcode_ops microcode_am
- .microcode_fini_cpu = microcode_fini_cpu_amd,
- };
-
--struct microcode_ops * __init init_amd_microcode(void)
-+const struct microcode_ops * __init init_amd_microcode(void)
- {
- return µcode_amd_ops;
- }
-diff -urNp linux-2.6.32.45/arch/x86/kernel/microcode_core.c linux-2.6.32.45/arch/x86/kernel/microcode_core.c
---- linux-2.6.32.45/arch/x86/kernel/microcode_core.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/microcode_core.c 2011-04-17 15:56:46.000000000 -0400
-@@ -90,7 +90,7 @@ MODULE_LICENSE("GPL");
-
- #define MICROCODE_VERSION "2.00"
-
--static struct microcode_ops *microcode_ops;
-+static const struct microcode_ops *microcode_ops;
-
- /*
- * Synchronization.
-diff -urNp linux-2.6.32.45/arch/x86/kernel/microcode_intel.c linux-2.6.32.45/arch/x86/kernel/microcode_intel.c
---- linux-2.6.32.45/arch/x86/kernel/microcode_intel.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/microcode_intel.c 2011-04-17 15:56:46.000000000 -0400
-@@ -443,13 +443,13 @@ static enum ucode_state request_microcod
-
- static int get_ucode_user(void *to, const void *from, size_t n)
- {
-- return copy_from_user(to, from, n);
-+ return copy_from_user(to, (__force const void __user *)from, n);
- }
-
- static enum ucode_state
- request_microcode_user(int cpu, const void __user *buf, size_t size)
- {
-- return generic_load_microcode(cpu, (void *)buf, size, &get_ucode_user);
-+ return generic_load_microcode(cpu, (__force void *)buf, size, &get_ucode_user);
- }
-
- static void microcode_fini_cpu(int cpu)
-@@ -460,7 +460,7 @@ static void microcode_fini_cpu(int cpu)
- uci->mc = NULL;
- }
-
--static struct microcode_ops microcode_intel_ops = {
-+static const struct microcode_ops microcode_intel_ops = {
- .request_microcode_user = request_microcode_user,
- .request_microcode_fw = request_microcode_fw,
- .collect_cpu_info = collect_cpu_info,
-@@ -468,7 +468,7 @@ static struct microcode_ops microcode_in
- .microcode_fini_cpu = microcode_fini_cpu,
- };
-
--struct microcode_ops * __init init_intel_microcode(void)
-+const struct microcode_ops * __init init_intel_microcode(void)
- {
- return µcode_intel_ops;
- }
-diff -urNp linux-2.6.32.45/arch/x86/kernel/module.c linux-2.6.32.45/arch/x86/kernel/module.c
---- linux-2.6.32.45/arch/x86/kernel/module.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/module.c 2011-04-17 15:56:46.000000000 -0400
-@@ -34,7 +34,7 @@
- #define DEBUGP(fmt...)
- #endif
-
--void *module_alloc(unsigned long size)
-+static void *__module_alloc(unsigned long size, pgprot_t prot)
- {
- struct vm_struct *area;
-
-@@ -48,8 +48,18 @@ void *module_alloc(unsigned long size)
- if (!area)
- return NULL;
-
-- return __vmalloc_area(area, GFP_KERNEL | __GFP_HIGHMEM,
-- PAGE_KERNEL_EXEC);
-+ return __vmalloc_area(area, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, prot);
-+}
-+
-+void *module_alloc(unsigned long size)
-+{
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ return __module_alloc(size, PAGE_KERNEL);
-+#else
-+ return __module_alloc(size, PAGE_KERNEL_EXEC);
-+#endif
-+
- }
-
- /* Free memory returned from module_alloc */
-@@ -58,6 +68,40 @@ void module_free(struct module *mod, voi
- vfree(module_region);
- }
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+#ifdef CONFIG_X86_32
-+void *module_alloc_exec(unsigned long size)
-+{
-+ struct vm_struct *area;
-+
-+ if (size == 0)
-+ return NULL;
-+
-+ area = __get_vm_area(size, VM_ALLOC, (unsigned long)&MODULES_EXEC_VADDR, (unsigned long)&MODULES_EXEC_END);
-+ return area ? area->addr : NULL;
-+}
-+EXPORT_SYMBOL(module_alloc_exec);
-+
-+void module_free_exec(struct module *mod, void *module_region)
-+{
-+ vunmap(module_region);
-+}
-+EXPORT_SYMBOL(module_free_exec);
-+#else
-+void module_free_exec(struct module *mod, void *module_region)
-+{
-+ module_free(mod, module_region);
-+}
-+EXPORT_SYMBOL(module_free_exec);
-+
-+void *module_alloc_exec(unsigned long size)
-+{
-+ return __module_alloc(size, PAGE_KERNEL_RX);
-+}
-+EXPORT_SYMBOL(module_alloc_exec);
-+#endif
-+#endif
-+
- /* We don't need anything special. */
- int module_frob_arch_sections(Elf_Ehdr *hdr,
- Elf_Shdr *sechdrs,
-@@ -77,14 +121,16 @@ int apply_relocate(Elf32_Shdr *sechdrs,
- unsigned int i;
- Elf32_Rel *rel = (void *)sechdrs[relsec].sh_addr;
- Elf32_Sym *sym;
-- uint32_t *location;
-+ uint32_t *plocation, location;
-
- DEBUGP("Applying relocate section %u to %u\n", relsec,
- sechdrs[relsec].sh_info);
- for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) {
- /* This is where to make the change */
-- location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr
-- + rel[i].r_offset;
-+ plocation = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr + rel[i].r_offset;
-+ location = (uint32_t)plocation;
-+ if (sechdrs[sechdrs[relsec].sh_info].sh_flags & SHF_EXECINSTR)
-+ plocation = ktla_ktva((void *)plocation);
- /* This is the symbol it is referring to. Note that all
- undefined symbols have been resolved. */
- sym = (Elf32_Sym *)sechdrs[symindex].sh_addr
-@@ -93,11 +139,15 @@ int apply_relocate(Elf32_Shdr *sechdrs,
- switch (ELF32_R_TYPE(rel[i].r_info)) {
- case R_386_32:
- /* We add the value into the location given */
-- *location += sym->st_value;
-+ pax_open_kernel();
-+ *plocation += sym->st_value;
-+ pax_close_kernel();
- break;
- case R_386_PC32:
- /* Add the value, subtract its postition */
-- *location += sym->st_value - (uint32_t)location;
-+ pax_open_kernel();
-+ *plocation += sym->st_value - location;
-+ pax_close_kernel();
- break;
- default:
- printk(KERN_ERR "module %s: Unknown relocation: %u\n",
-@@ -153,21 +203,30 @@ int apply_relocate_add(Elf64_Shdr *sechd
- case R_X86_64_NONE:
- break;
- case R_X86_64_64:
-+ pax_open_kernel();
- *(u64 *)loc = val;
-+ pax_close_kernel();
- break;
- case R_X86_64_32:
-+ pax_open_kernel();
- *(u32 *)loc = val;
-+ pax_close_kernel();
- if (val != *(u32 *)loc)
- goto overflow;
- break;
- case R_X86_64_32S:
-+ pax_open_kernel();
- *(s32 *)loc = val;
-+ pax_close_kernel();
- if ((s64)val != *(s32 *)loc)
- goto overflow;
- break;
- case R_X86_64_PC32:
- val -= (u64)loc;
-+ pax_open_kernel();
- *(u32 *)loc = val;
-+ pax_close_kernel();
-+
- #if 0
- if ((s64)val != *(s32 *)loc)
- goto overflow;
-diff -urNp linux-2.6.32.45/arch/x86/kernel/paravirt.c linux-2.6.32.45/arch/x86/kernel/paravirt.c
---- linux-2.6.32.45/arch/x86/kernel/paravirt.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/paravirt.c 2011-08-05 20:33:55.000000000 -0400
-@@ -53,6 +53,9 @@ u64 _paravirt_ident_64(u64 x)
- {
- return x;
- }
-+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
-+PV_CALLEE_SAVE_REGS_THUNK(_paravirt_ident_64);
-+#endif
-
- void __init default_banner(void)
- {
-@@ -122,7 +125,7 @@ unsigned paravirt_patch_jmp(void *insnbu
- * corresponding structure. */
- static void *get_call_destination(u8 type)
- {
-- struct paravirt_patch_template tmpl = {
-+ const struct paravirt_patch_template tmpl = {
- .pv_init_ops = pv_init_ops,
- .pv_time_ops = pv_time_ops,
- .pv_cpu_ops = pv_cpu_ops,
-@@ -133,6 +136,8 @@ static void *get_call_destination(u8 typ
- .pv_lock_ops = pv_lock_ops,
- #endif
- };
-+
-+ pax_track_stack();
- return *((void **)&tmpl + type);
- }
-
-@@ -145,15 +150,19 @@ unsigned paravirt_patch_default(u8 type,
- if (opfunc == NULL)
- /* If there's no function, patch it with a ud2a (BUG) */
- ret = paravirt_patch_insns(insnbuf, len, ud2a, ud2a+sizeof(ud2a));
-- else if (opfunc == _paravirt_nop)
-+ else if (opfunc == (void *)_paravirt_nop)
- /* If the operation is a nop, then nop the callsite */
- ret = paravirt_patch_nop();
-
- /* identity functions just return their single argument */
-- else if (opfunc == _paravirt_ident_32)
-+ else if (opfunc == (void *)_paravirt_ident_32)
- ret = paravirt_patch_ident_32(insnbuf, len);
-- else if (opfunc == _paravirt_ident_64)
-+ else if (opfunc == (void *)_paravirt_ident_64)
-+ ret = paravirt_patch_ident_64(insnbuf, len);
-+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
-+ else if (opfunc == (void *)__raw_callee_save__paravirt_ident_64)
- ret = paravirt_patch_ident_64(insnbuf, len);
-+#endif
-
- else if (type == PARAVIRT_PATCH(pv_cpu_ops.iret) ||
- type == PARAVIRT_PATCH(pv_cpu_ops.irq_enable_sysexit) ||
-@@ -178,7 +187,7 @@ unsigned paravirt_patch_insns(void *insn
- if (insn_len > len || start == NULL)
- insn_len = len;
- else
-- memcpy(insnbuf, start, insn_len);
-+ memcpy(insnbuf, ktla_ktva(start), insn_len);
-
- return insn_len;
- }
-@@ -294,22 +303,22 @@ void arch_flush_lazy_mmu_mode(void)
- preempt_enable();
- }
-
--struct pv_info pv_info = {
-+struct pv_info pv_info __read_only = {
- .name = "bare hardware",
- .paravirt_enabled = 0,
- .kernel_rpl = 0,
- .shared_kernel_pmd = 1, /* Only used when CONFIG_X86_PAE is set */
- };
-
--struct pv_init_ops pv_init_ops = {
-+struct pv_init_ops pv_init_ops __read_only = {
- .patch = native_patch,
- };
-
--struct pv_time_ops pv_time_ops = {
-+struct pv_time_ops pv_time_ops __read_only = {
- .sched_clock = native_sched_clock,
- };
-
--struct pv_irq_ops pv_irq_ops = {
-+struct pv_irq_ops pv_irq_ops __read_only = {
- .save_fl = __PV_IS_CALLEE_SAVE(native_save_fl),
- .restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl),
- .irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable),
-@@ -321,7 +330,7 @@ struct pv_irq_ops pv_irq_ops = {
- #endif
- };
-
--struct pv_cpu_ops pv_cpu_ops = {
-+struct pv_cpu_ops pv_cpu_ops __read_only = {
- .cpuid = native_cpuid,
- .get_debugreg = native_get_debugreg,
- .set_debugreg = native_set_debugreg,
-@@ -382,21 +391,26 @@ struct pv_cpu_ops pv_cpu_ops = {
- .end_context_switch = paravirt_nop,
- };
-
--struct pv_apic_ops pv_apic_ops = {
-+struct pv_apic_ops pv_apic_ops __read_only = {
- #ifdef CONFIG_X86_LOCAL_APIC
- .startup_ipi_hook = paravirt_nop,
- #endif
- };
-
--#if defined(CONFIG_X86_32) && !defined(CONFIG_X86_PAE)
-+#ifdef CONFIG_X86_32
-+#ifdef CONFIG_X86_PAE
-+/* 64-bit pagetable entries */
-+#define PTE_IDENT PV_CALLEE_SAVE(_paravirt_ident_64)
-+#else
- /* 32-bit pagetable entries */
- #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_32)
-+#endif
- #else
- /* 64-bit pagetable entries */
- #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_64)
- #endif
-
--struct pv_mmu_ops pv_mmu_ops = {
-+struct pv_mmu_ops pv_mmu_ops __read_only = {
-
- .read_cr2 = native_read_cr2,
- .write_cr2 = native_write_cr2,
-@@ -467,6 +481,12 @@ struct pv_mmu_ops pv_mmu_ops = {
- },
-
- .set_fixmap = native_set_fixmap,
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ .pax_open_kernel = native_pax_open_kernel,
-+ .pax_close_kernel = native_pax_close_kernel,
-+#endif
-+
- };
-
- EXPORT_SYMBOL_GPL(pv_time_ops);
-diff -urNp linux-2.6.32.45/arch/x86/kernel/paravirt-spinlocks.c linux-2.6.32.45/arch/x86/kernel/paravirt-spinlocks.c
---- linux-2.6.32.45/arch/x86/kernel/paravirt-spinlocks.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/paravirt-spinlocks.c 2011-04-17 15:56:46.000000000 -0400
-@@ -13,7 +13,7 @@ default_spin_lock_flags(raw_spinlock_t *
- __raw_spin_lock(lock);
- }
-
--struct pv_lock_ops pv_lock_ops = {
-+struct pv_lock_ops pv_lock_ops __read_only = {
- #ifdef CONFIG_SMP
- .spin_is_locked = __ticket_spin_is_locked,
- .spin_is_contended = __ticket_spin_is_contended,
-diff -urNp linux-2.6.32.45/arch/x86/kernel/pci-calgary_64.c linux-2.6.32.45/arch/x86/kernel/pci-calgary_64.c
---- linux-2.6.32.45/arch/x86/kernel/pci-calgary_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/pci-calgary_64.c 2011-04-17 15:56:46.000000000 -0400
-@@ -477,7 +477,7 @@ static void calgary_free_coherent(struct
- free_pages((unsigned long)vaddr, get_order(size));
- }
-
--static struct dma_map_ops calgary_dma_ops = {
-+static const struct dma_map_ops calgary_dma_ops = {
- .alloc_coherent = calgary_alloc_coherent,
- .free_coherent = calgary_free_coherent,
- .map_sg = calgary_map_sg,
-diff -urNp linux-2.6.32.45/arch/x86/kernel/pci-dma.c linux-2.6.32.45/arch/x86/kernel/pci-dma.c
---- linux-2.6.32.45/arch/x86/kernel/pci-dma.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/pci-dma.c 2011-04-17 15:56:46.000000000 -0400
-@@ -14,7 +14,7 @@
-
- static int forbid_dac __read_mostly;
-
--struct dma_map_ops *dma_ops;
-+const struct dma_map_ops *dma_ops;
- EXPORT_SYMBOL(dma_ops);
-
- static int iommu_sac_force __read_mostly;
-@@ -243,7 +243,7 @@ early_param("iommu", iommu_setup);
-
- int dma_supported(struct device *dev, u64 mask)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- #ifdef CONFIG_PCI
- if (mask > 0xffffffff && forbid_dac > 0) {
-diff -urNp linux-2.6.32.45/arch/x86/kernel/pci-gart_64.c linux-2.6.32.45/arch/x86/kernel/pci-gart_64.c
---- linux-2.6.32.45/arch/x86/kernel/pci-gart_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/pci-gart_64.c 2011-04-17 15:56:46.000000000 -0400
-@@ -682,7 +682,7 @@ static __init int init_k8_gatt(struct ag
- return -1;
- }
-
--static struct dma_map_ops gart_dma_ops = {
-+static const struct dma_map_ops gart_dma_ops = {
- .map_sg = gart_map_sg,
- .unmap_sg = gart_unmap_sg,
- .map_page = gart_map_page,
-diff -urNp linux-2.6.32.45/arch/x86/kernel/pci-nommu.c linux-2.6.32.45/arch/x86/kernel/pci-nommu.c
---- linux-2.6.32.45/arch/x86/kernel/pci-nommu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/pci-nommu.c 2011-04-17 15:56:46.000000000 -0400
-@@ -94,7 +94,7 @@ static void nommu_sync_sg_for_device(str
- flush_write_buffers();
- }
-
--struct dma_map_ops nommu_dma_ops = {
-+const struct dma_map_ops nommu_dma_ops = {
- .alloc_coherent = dma_generic_alloc_coherent,
- .free_coherent = nommu_free_coherent,
- .map_sg = nommu_map_sg,
-diff -urNp linux-2.6.32.45/arch/x86/kernel/pci-swiotlb.c linux-2.6.32.45/arch/x86/kernel/pci-swiotlb.c
---- linux-2.6.32.45/arch/x86/kernel/pci-swiotlb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/pci-swiotlb.c 2011-04-17 15:56:46.000000000 -0400
-@@ -25,7 +25,7 @@ static void *x86_swiotlb_alloc_coherent(
- return swiotlb_alloc_coherent(hwdev, size, dma_handle, flags);
- }
-
--static struct dma_map_ops swiotlb_dma_ops = {
-+static const struct dma_map_ops swiotlb_dma_ops = {
- .mapping_error = swiotlb_dma_mapping_error,
- .alloc_coherent = x86_swiotlb_alloc_coherent,
- .free_coherent = swiotlb_free_coherent,
-diff -urNp linux-2.6.32.45/arch/x86/kernel/process_32.c linux-2.6.32.45/arch/x86/kernel/process_32.c
---- linux-2.6.32.45/arch/x86/kernel/process_32.c 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/process_32.c 2011-06-25 12:56:37.000000000 -0400
-@@ -67,6 +67,7 @@ asmlinkage void ret_from_fork(void) __as
- unsigned long thread_saved_pc(struct task_struct *tsk)
- {
- return ((unsigned long *)tsk->thread.sp)[3];
-+//XXX return tsk->thread.eip;
- }
-
- #ifndef CONFIG_SMP
-@@ -129,15 +130,14 @@ void __show_regs(struct pt_regs *regs, i
- unsigned short ss, gs;
- const char *board;
-
-- if (user_mode_vm(regs)) {
-+ if (user_mode(regs)) {
- sp = regs->sp;
- ss = regs->ss & 0xffff;
-- gs = get_user_gs(regs);
- } else {
- sp = (unsigned long) (®s->sp);
- savesegment(ss, ss);
-- savesegment(gs, gs);
- }
-+ gs = get_user_gs(regs);
-
- printk("\n");
-
-@@ -210,10 +210,10 @@ int kernel_thread(int (*fn)(void *), voi
- regs.bx = (unsigned long) fn;
- regs.dx = (unsigned long) arg;
-
-- regs.ds = __USER_DS;
-- regs.es = __USER_DS;
-+ regs.ds = __KERNEL_DS;
-+ regs.es = __KERNEL_DS;
- regs.fs = __KERNEL_PERCPU;
-- regs.gs = __KERNEL_STACK_CANARY;
-+ savesegment(gs, regs.gs);
- regs.orig_ax = -1;
- regs.ip = (unsigned long) kernel_thread_helper;
- regs.cs = __KERNEL_CS | get_kernel_rpl();
-@@ -247,13 +247,14 @@ int copy_thread(unsigned long clone_flag
- struct task_struct *tsk;
- int err;
-
-- childregs = task_pt_regs(p);
-+ childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 8;
- *childregs = *regs;
- childregs->ax = 0;
- childregs->sp = sp;
-
- p->thread.sp = (unsigned long) childregs;
- p->thread.sp0 = (unsigned long) (childregs+1);
-+ p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
-
- p->thread.ip = (unsigned long) ret_from_fork;
-
-@@ -345,7 +346,7 @@ __switch_to(struct task_struct *prev_p,
- struct thread_struct *prev = &prev_p->thread,
- *next = &next_p->thread;
- int cpu = smp_processor_id();
-- struct tss_struct *tss = &per_cpu(init_tss, cpu);
-+ struct tss_struct *tss = init_tss + cpu;
- bool preload_fpu;
-
- /* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
-@@ -380,6 +381,10 @@ __switch_to(struct task_struct *prev_p,
- */
- lazy_save_gs(prev->gs);
-
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ __set_fs(task_thread_info(next_p)->addr_limit);
-+#endif
-+
- /*
- * Load the per-thread Thread-Local Storage descriptor.
- */
-@@ -415,6 +420,9 @@ __switch_to(struct task_struct *prev_p,
- */
- arch_end_context_switch(next_p);
-
-+ percpu_write(current_task, next_p);
-+ percpu_write(current_tinfo, &next_p->tinfo);
-+
- if (preload_fpu)
- __math_state_restore();
-
-@@ -424,8 +432,6 @@ __switch_to(struct task_struct *prev_p,
- if (prev->gs | next->gs)
- lazy_load_gs(next->gs);
-
-- percpu_write(current_task, next_p);
--
- return prev_p;
- }
-
-@@ -495,4 +501,3 @@ unsigned long get_wchan(struct task_stru
- } while (count++ < 16);
- return 0;
- }
--
-diff -urNp linux-2.6.32.45/arch/x86/kernel/process_64.c linux-2.6.32.45/arch/x86/kernel/process_64.c
---- linux-2.6.32.45/arch/x86/kernel/process_64.c 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/process_64.c 2011-06-25 12:56:37.000000000 -0400
-@@ -91,7 +91,7 @@ static void __exit_idle(void)
- void exit_idle(void)
- {
- /* idle loop has pid 0 */
-- if (current->pid)
-+ if (task_pid_nr(current))
- return;
- __exit_idle();
- }
-@@ -170,7 +170,7 @@ void __show_regs(struct pt_regs *regs, i
- if (!board)
- board = "";
- printk(KERN_INFO "Pid: %d, comm: %.20s %s %s %.*s %s\n",
-- current->pid, current->comm, print_tainted(),
-+ task_pid_nr(current), current->comm, print_tainted(),
- init_utsname()->release,
- (int)strcspn(init_utsname()->version, " "),
- init_utsname()->version, board);
-@@ -280,8 +280,7 @@ int copy_thread(unsigned long clone_flag
- struct pt_regs *childregs;
- struct task_struct *me = current;
-
-- childregs = ((struct pt_regs *)
-- (THREAD_SIZE + task_stack_page(p))) - 1;
-+ childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 16;
- *childregs = *regs;
-
- childregs->ax = 0;
-@@ -292,6 +291,7 @@ int copy_thread(unsigned long clone_flag
- p->thread.sp = (unsigned long) childregs;
- p->thread.sp0 = (unsigned long) (childregs+1);
- p->thread.usersp = me->thread.usersp;
-+ p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
-
- set_tsk_thread_flag(p, TIF_FORK);
-
-@@ -379,7 +379,7 @@ __switch_to(struct task_struct *prev_p,
- struct thread_struct *prev = &prev_p->thread;
- struct thread_struct *next = &next_p->thread;
- int cpu = smp_processor_id();
-- struct tss_struct *tss = &per_cpu(init_tss, cpu);
-+ struct tss_struct *tss = init_tss + cpu;
- unsigned fsindex, gsindex;
- bool preload_fpu;
-
-@@ -475,10 +475,9 @@ __switch_to(struct task_struct *prev_p,
- prev->usersp = percpu_read(old_rsp);
- percpu_write(old_rsp, next->usersp);
- percpu_write(current_task, next_p);
-+ percpu_write(current_tinfo, &next_p->tinfo);
-
-- percpu_write(kernel_stack,
-- (unsigned long)task_stack_page(next_p) +
-- THREAD_SIZE - KERNEL_STACK_OFFSET);
-+ percpu_write(kernel_stack, next->sp0);
-
- /*
- * Now maybe reload the debug registers and handle I/O bitmaps
-@@ -559,12 +558,11 @@ unsigned long get_wchan(struct task_stru
- if (!p || p == current || p->state == TASK_RUNNING)
- return 0;
- stack = (unsigned long)task_stack_page(p);
-- if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
-+ if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE-16-sizeof(u64))
- return 0;
- fp = *(u64 *)(p->thread.sp);
- do {
-- if (fp < (unsigned long)stack ||
-- fp >= (unsigned long)stack+THREAD_SIZE)
-+ if (fp < stack || fp > stack+THREAD_SIZE-16-sizeof(u64))
- return 0;
- ip = *(u64 *)(fp+8);
- if (!in_sched_functions(ip))
-diff -urNp linux-2.6.32.45/arch/x86/kernel/process.c linux-2.6.32.45/arch/x86/kernel/process.c
---- linux-2.6.32.45/arch/x86/kernel/process.c 2011-04-22 19:16:29.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/process.c 2011-05-22 23:02:03.000000000 -0400
-@@ -51,16 +51,33 @@ void free_thread_xstate(struct task_stru
-
- void free_thread_info(struct thread_info *ti)
- {
-- free_thread_xstate(ti->task);
- free_pages((unsigned long)ti, get_order(THREAD_SIZE));
- }
-
-+static struct kmem_cache *task_struct_cachep;
-+
- void arch_task_cache_init(void)
- {
-- task_xstate_cachep =
-- kmem_cache_create("task_xstate", xstate_size,
-+ /* create a slab on which task_structs can be allocated */
-+ task_struct_cachep =
-+ kmem_cache_create("task_struct", sizeof(struct task_struct),
-+ ARCH_MIN_TASKALIGN, SLAB_PANIC | SLAB_NOTRACK, NULL);
-+
-+ task_xstate_cachep =
-+ kmem_cache_create("task_xstate", xstate_size,
- __alignof__(union thread_xstate),
-- SLAB_PANIC | SLAB_NOTRACK, NULL);
-+ SLAB_PANIC | SLAB_NOTRACK | SLAB_USERCOPY, NULL);
-+}
-+
-+struct task_struct *alloc_task_struct(void)
-+{
-+ return kmem_cache_alloc(task_struct_cachep, GFP_KERNEL);
-+}
-+
-+void free_task_struct(struct task_struct *task)
-+{
-+ free_thread_xstate(task);
-+ kmem_cache_free(task_struct_cachep, task);
- }
-
- /*
-@@ -73,7 +90,7 @@ void exit_thread(void)
- unsigned long *bp = t->io_bitmap_ptr;
-
- if (bp) {
-- struct tss_struct *tss = &per_cpu(init_tss, get_cpu());
-+ struct tss_struct *tss = init_tss + get_cpu();
-
- t->io_bitmap_ptr = NULL;
- clear_thread_flag(TIF_IO_BITMAP);
-@@ -93,6 +110,9 @@ void flush_thread(void)
-
- clear_tsk_thread_flag(tsk, TIF_DEBUG);
-
-+#if defined(CONFIG_X86_32) && !defined(CONFIG_CC_STACKPROTECTOR) && !defined(CONFIG_PAX_MEMORY_UDEREF)
-+ loadsegment(gs, 0);
-+#endif
- tsk->thread.debugreg0 = 0;
- tsk->thread.debugreg1 = 0;
- tsk->thread.debugreg2 = 0;
-@@ -307,7 +327,7 @@ void default_idle(void)
- EXPORT_SYMBOL(default_idle);
- #endif
-
--void stop_this_cpu(void *dummy)
-+__noreturn void stop_this_cpu(void *dummy)
- {
- local_irq_disable();
- /*
-@@ -568,16 +588,35 @@ static int __init idle_setup(char *str)
- }
- early_param("idle", idle_setup);
-
--unsigned long arch_align_stack(unsigned long sp)
-+#ifdef CONFIG_PAX_RANDKSTACK
-+asmlinkage void pax_randomize_kstack(void)
- {
-- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
-- sp -= get_random_int() % 8192;
-- return sp & ~0xf;
--}
-+ struct thread_struct *thread = ¤t->thread;
-+ unsigned long time;
-
--unsigned long arch_randomize_brk(struct mm_struct *mm)
--{
-- unsigned long range_end = mm->brk + 0x02000000;
-- return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
-+ if (!randomize_va_space)
-+ return;
-+
-+ rdtscl(time);
-+
-+ /* P4 seems to return a 0 LSB, ignore it */
-+#ifdef CONFIG_MPENTIUM4
-+ time &= 0x3EUL;
-+ time <<= 2;
-+#elif defined(CONFIG_X86_64)
-+ time &= 0xFUL;
-+ time <<= 4;
-+#else
-+ time &= 0x1FUL;
-+ time <<= 3;
-+#endif
-+
-+ thread->sp0 ^= time;
-+ load_sp0(init_tss + smp_processor_id(), thread);
-+
-+#ifdef CONFIG_X86_64
-+ percpu_write(kernel_stack, thread->sp0);
-+#endif
- }
-+#endif
-
-diff -urNp linux-2.6.32.45/arch/x86/kernel/ptrace.c linux-2.6.32.45/arch/x86/kernel/ptrace.c
---- linux-2.6.32.45/arch/x86/kernel/ptrace.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/ptrace.c 2011-04-17 15:56:46.000000000 -0400
-@@ -925,7 +925,7 @@ static const struct user_regset_view use
- long arch_ptrace(struct task_struct *child, long request, long addr, long data)
- {
- int ret;
-- unsigned long __user *datap = (unsigned long __user *)data;
-+ unsigned long __user *datap = (__force unsigned long __user *)data;
-
- switch (request) {
- /* read the word at location addr in the USER area. */
-@@ -1012,14 +1012,14 @@ long arch_ptrace(struct task_struct *chi
- if (addr < 0)
- return -EIO;
- ret = do_get_thread_area(child, addr,
-- (struct user_desc __user *) data);
-+ (__force struct user_desc __user *) data);
- break;
-
- case PTRACE_SET_THREAD_AREA:
- if (addr < 0)
- return -EIO;
- ret = do_set_thread_area(child, addr,
-- (struct user_desc __user *) data, 0);
-+ (__force struct user_desc __user *) data, 0);
- break;
- #endif
-
-@@ -1038,12 +1038,12 @@ long arch_ptrace(struct task_struct *chi
- #ifdef CONFIG_X86_PTRACE_BTS
- case PTRACE_BTS_CONFIG:
- ret = ptrace_bts_config
-- (child, data, (struct ptrace_bts_config __user *)addr);
-+ (child, data, (__force struct ptrace_bts_config __user *)addr);
- break;
-
- case PTRACE_BTS_STATUS:
- ret = ptrace_bts_status
-- (child, data, (struct ptrace_bts_config __user *)addr);
-+ (child, data, (__force struct ptrace_bts_config __user *)addr);
- break;
-
- case PTRACE_BTS_SIZE:
-@@ -1052,7 +1052,7 @@ long arch_ptrace(struct task_struct *chi
-
- case PTRACE_BTS_GET:
- ret = ptrace_bts_read_record
-- (child, data, (struct bts_struct __user *) addr);
-+ (child, data, (__force struct bts_struct __user *) addr);
- break;
-
- case PTRACE_BTS_CLEAR:
-@@ -1061,7 +1061,7 @@ long arch_ptrace(struct task_struct *chi
-
- case PTRACE_BTS_DRAIN:
- ret = ptrace_bts_drain
-- (child, data, (struct bts_struct __user *) addr);
-+ (child, data, (__force struct bts_struct __user *) addr);
- break;
- #endif /* CONFIG_X86_PTRACE_BTS */
-
-@@ -1450,7 +1450,7 @@ void send_sigtrap(struct task_struct *ts
- info.si_code = si_code;
-
- /* User-mode ip? */
-- info.si_addr = user_mode_vm(regs) ? (void __user *) regs->ip : NULL;
-+ info.si_addr = user_mode(regs) ? (__force void __user *) regs->ip : NULL;
-
- /* Send us the fake SIGTRAP */
- force_sig_info(SIGTRAP, &info, tsk);
-@@ -1469,7 +1469,7 @@ void send_sigtrap(struct task_struct *ts
- * We must return the syscall number to actually look up in the table.
- * This can be -1L to skip running any syscall at all.
- */
--asmregparm long syscall_trace_enter(struct pt_regs *regs)
-+long syscall_trace_enter(struct pt_regs *regs)
- {
- long ret = 0;
-
-@@ -1514,7 +1514,7 @@ asmregparm long syscall_trace_enter(stru
- return ret ?: regs->orig_ax;
- }
-
--asmregparm void syscall_trace_leave(struct pt_regs *regs)
-+void syscall_trace_leave(struct pt_regs *regs)
- {
- if (unlikely(current->audit_context))
- audit_syscall_exit(AUDITSC_RESULT(regs->ax), regs->ax);
-diff -urNp linux-2.6.32.45/arch/x86/kernel/reboot.c linux-2.6.32.45/arch/x86/kernel/reboot.c
---- linux-2.6.32.45/arch/x86/kernel/reboot.c 2011-08-09 18:35:28.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/reboot.c 2011-08-09 18:33:59.000000000 -0400
-@@ -33,7 +33,7 @@ void (*pm_power_off)(void);
- EXPORT_SYMBOL(pm_power_off);
-
- static const struct desc_ptr no_idt = {};
--static int reboot_mode;
-+static unsigned short reboot_mode;
- enum reboot_type reboot_type = BOOT_KBD;
- int reboot_force;
-
-@@ -292,12 +292,12 @@ core_initcall(reboot_init);
- controller to pulse the CPU reset line, which is more thorough, but
- doesn't work with at least one type of 486 motherboard. It is easy
- to stop this code working; hence the copious comments. */
--static const unsigned long long
--real_mode_gdt_entries [3] =
-+static struct desc_struct
-+real_mode_gdt_entries [3] __read_only =
- {
-- 0x0000000000000000ULL, /* Null descriptor */
-- 0x00009b000000ffffULL, /* 16-bit real-mode 64k code at 0x00000000 */
-- 0x000093000100ffffULL /* 16-bit real-mode 64k data at 0x00000100 */
-+ GDT_ENTRY_INIT(0, 0, 0), /* Null descriptor */
-+ GDT_ENTRY_INIT(0x9b, 0, 0xffff), /* 16-bit real-mode 64k code at 0x00000000 */
-+ GDT_ENTRY_INIT(0x93, 0x100, 0xffff) /* 16-bit real-mode 64k data at 0x00000100 */
- };
-
- static const struct desc_ptr
-@@ -346,7 +346,7 @@ static const unsigned char jump_to_bios
- * specified by the code and length parameters.
- * We assume that length will aways be less that 100!
- */
--void machine_real_restart(const unsigned char *code, int length)
-+__noreturn void machine_real_restart(const unsigned char *code, unsigned int length)
- {
- local_irq_disable();
-
-@@ -366,8 +366,8 @@ void machine_real_restart(const unsigned
- /* Remap the kernel at virtual address zero, as well as offset zero
- from the kernel segment. This assumes the kernel segment starts at
- virtual address PAGE_OFFSET. */
-- memcpy(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-- sizeof(swapper_pg_dir [0]) * KERNEL_PGD_PTRS);
-+ clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-+ min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
-
- /*
- * Use `swapper_pg_dir' as our page directory.
-@@ -379,16 +379,15 @@ void machine_real_restart(const unsigned
- boot)". This seems like a fairly standard thing that gets set by
- REBOOT.COM programs, and the previous reset routine did this
- too. */
-- *((unsigned short *)0x472) = reboot_mode;
-+ *(unsigned short *)(__va(0x472)) = reboot_mode;
-
- /* For the switch to real mode, copy some code to low memory. It has
- to be in the first 64k because it is running in 16-bit mode, and it
- has to have the same physical and virtual address, because it turns
- off paging. Copy it near the end of the first page, out of the way
- of BIOS variables. */
-- memcpy((void *)(0x1000 - sizeof(real_mode_switch) - 100),
-- real_mode_switch, sizeof (real_mode_switch));
-- memcpy((void *)(0x1000 - 100), code, length);
-+ memcpy(__va(0x1000 - sizeof (real_mode_switch) - 100), real_mode_switch, sizeof (real_mode_switch));
-+ memcpy(__va(0x1000 - 100), code, length);
-
- /* Set up the IDT for real mode. */
- load_idt(&real_mode_idt);
-@@ -416,6 +415,7 @@ void machine_real_restart(const unsigned
- __asm__ __volatile__ ("ljmp $0x0008,%0"
- :
- : "i" ((void *)(0x1000 - sizeof (real_mode_switch) - 100)));
-+ do { } while (1);
- }
- #ifdef CONFIG_APM_MODULE
- EXPORT_SYMBOL(machine_real_restart);
-@@ -544,7 +544,7 @@ void __attribute__((weak)) mach_reboot_f
- {
- }
-
--static void native_machine_emergency_restart(void)
-+__noreturn static void native_machine_emergency_restart(void)
- {
- int i;
-
-@@ -659,13 +659,13 @@ void native_machine_shutdown(void)
- #endif
- }
-
--static void __machine_emergency_restart(int emergency)
-+static __noreturn void __machine_emergency_restart(int emergency)
- {
- reboot_emergency = emergency;
- machine_ops.emergency_restart();
- }
-
--static void native_machine_restart(char *__unused)
-+static __noreturn void native_machine_restart(char *__unused)
- {
- printk("machine restart\n");
-
-@@ -674,7 +674,7 @@ static void native_machine_restart(char
- __machine_emergency_restart(0);
- }
-
--static void native_machine_halt(void)
-+static __noreturn void native_machine_halt(void)
- {
- /* stop other cpus and apics */
- machine_shutdown();
-@@ -685,7 +685,7 @@ static void native_machine_halt(void)
- stop_this_cpu(NULL);
- }
-
--static void native_machine_power_off(void)
-+__noreturn static void native_machine_power_off(void)
- {
- if (pm_power_off) {
- if (!reboot_force)
-@@ -694,6 +694,7 @@ static void native_machine_power_off(voi
- }
- /* a fallback in case there is no PM info available */
- tboot_shutdown(TB_SHUTDOWN_HALT);
-+ do { } while (1);
- }
-
- struct machine_ops machine_ops = {
-diff -urNp linux-2.6.32.45/arch/x86/kernel/setup.c linux-2.6.32.45/arch/x86/kernel/setup.c
---- linux-2.6.32.45/arch/x86/kernel/setup.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/setup.c 2011-04-17 17:03:05.000000000 -0400
-@@ -783,14 +783,14 @@ void __init setup_arch(char **cmdline_p)
-
- if (!boot_params.hdr.root_flags)
- root_mountflags &= ~MS_RDONLY;
-- init_mm.start_code = (unsigned long) _text;
-- init_mm.end_code = (unsigned long) _etext;
-+ init_mm.start_code = ktla_ktva((unsigned long) _text);
-+ init_mm.end_code = ktla_ktva((unsigned long) _etext);
- init_mm.end_data = (unsigned long) _edata;
- init_mm.brk = _brk_end;
-
-- code_resource.start = virt_to_phys(_text);
-- code_resource.end = virt_to_phys(_etext)-1;
-- data_resource.start = virt_to_phys(_etext);
-+ code_resource.start = virt_to_phys(ktla_ktva(_text));
-+ code_resource.end = virt_to_phys(ktla_ktva(_etext))-1;
-+ data_resource.start = virt_to_phys(_sdata);
- data_resource.end = virt_to_phys(_edata)-1;
- bss_resource.start = virt_to_phys(&__bss_start);
- bss_resource.end = virt_to_phys(&__bss_stop)-1;
-diff -urNp linux-2.6.32.45/arch/x86/kernel/setup_percpu.c linux-2.6.32.45/arch/x86/kernel/setup_percpu.c
---- linux-2.6.32.45/arch/x86/kernel/setup_percpu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/setup_percpu.c 2011-06-04 20:36:29.000000000 -0400
-@@ -25,19 +25,17 @@
- # define DBG(x...)
- #endif
-
--DEFINE_PER_CPU(int, cpu_number);
-+#ifdef CONFIG_SMP
-+DEFINE_PER_CPU(unsigned int, cpu_number);
- EXPORT_PER_CPU_SYMBOL(cpu_number);
-+#endif
-
--#ifdef CONFIG_X86_64
- #define BOOT_PERCPU_OFFSET ((unsigned long)__per_cpu_load)
--#else
--#define BOOT_PERCPU_OFFSET 0
--#endif
-
- DEFINE_PER_CPU(unsigned long, this_cpu_off) = BOOT_PERCPU_OFFSET;
- EXPORT_PER_CPU_SYMBOL(this_cpu_off);
-
--unsigned long __per_cpu_offset[NR_CPUS] __read_mostly = {
-+unsigned long __per_cpu_offset[NR_CPUS] __read_only = {
- [0 ... NR_CPUS-1] = BOOT_PERCPU_OFFSET,
- };
- EXPORT_SYMBOL(__per_cpu_offset);
-@@ -159,10 +157,10 @@ static inline void setup_percpu_segment(
- {
- #ifdef CONFIG_X86_32
- struct desc_struct gdt;
-+ unsigned long base = per_cpu_offset(cpu);
-
-- pack_descriptor(&gdt, per_cpu_offset(cpu), 0xFFFFF,
-- 0x2 | DESCTYPE_S, 0x8);
-- gdt.s = 1;
-+ pack_descriptor(&gdt, base, (VMALLOC_END - base - 1) >> PAGE_SHIFT,
-+ 0x83 | DESCTYPE_S, 0xC);
- write_gdt_entry(get_cpu_gdt_table(cpu),
- GDT_ENTRY_PERCPU, &gdt, DESCTYPE_S);
- #endif
-@@ -212,6 +210,11 @@ void __init setup_per_cpu_areas(void)
- /* alrighty, percpu areas up and running */
- delta = (unsigned long)pcpu_base_addr - (unsigned long)__per_cpu_start;
- for_each_possible_cpu(cpu) {
-+#ifdef CONFIG_CC_STACKPROTECTOR
-+#ifdef CONFIG_X86_32
-+ unsigned long canary = per_cpu(stack_canary.canary, cpu);
-+#endif
-+#endif
- per_cpu_offset(cpu) = delta + pcpu_unit_offsets[cpu];
- per_cpu(this_cpu_off, cpu) = per_cpu_offset(cpu);
- per_cpu(cpu_number, cpu) = cpu;
-@@ -239,6 +242,12 @@ void __init setup_per_cpu_areas(void)
- early_per_cpu_map(x86_cpu_to_node_map, cpu);
- #endif
- #endif
-+#ifdef CONFIG_CC_STACKPROTECTOR
-+#ifdef CONFIG_X86_32
-+ if (!cpu)
-+ per_cpu(stack_canary.canary, cpu) = canary;
-+#endif
-+#endif
- /*
- * Up to this point, the boot CPU has been using .data.init
- * area. Reload any changed state for the boot CPU.
-diff -urNp linux-2.6.32.45/arch/x86/kernel/signal.c linux-2.6.32.45/arch/x86/kernel/signal.c
---- linux-2.6.32.45/arch/x86/kernel/signal.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/signal.c 2011-05-22 23:02:03.000000000 -0400
-@@ -197,7 +197,7 @@ static unsigned long align_sigframe(unsi
- * Align the stack pointer according to the i386 ABI,
- * i.e. so that on function entry ((sp + 4) & 15) == 0.
- */
-- sp = ((sp + 4) & -16ul) - 4;
-+ sp = ((sp - 12) & -16ul) - 4;
- #else /* !CONFIG_X86_32 */
- sp = round_down(sp, 16) - 8;
- #endif
-@@ -248,11 +248,11 @@ get_sigframe(struct k_sigaction *ka, str
- * Return an always-bogus address instead so we will die with SIGSEGV.
- */
- if (onsigstack && !likely(on_sig_stack(sp)))
-- return (void __user *)-1L;
-+ return (__force void __user *)-1L;
-
- /* save i387 state */
- if (used_math() && save_i387_xstate(*fpstate) < 0)
-- return (void __user *)-1L;
-+ return (__force void __user *)-1L;
-
- return (void __user *)sp;
- }
-@@ -307,9 +307,9 @@ __setup_frame(int sig, struct k_sigactio
- }
-
- if (current->mm->context.vdso)
-- restorer = VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
-+ restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
- else
-- restorer = &frame->retcode;
-+ restorer = (void __user *)&frame->retcode;
- if (ka->sa.sa_flags & SA_RESTORER)
- restorer = ka->sa.sa_restorer;
-
-@@ -323,7 +323,7 @@ __setup_frame(int sig, struct k_sigactio
- * reasons and because gdb uses it as a signature to notice
- * signal handler stack frames.
- */
-- err |= __put_user(*((u64 *)&retcode), (u64 *)frame->retcode);
-+ err |= __put_user(*((u64 *)&retcode), (u64 __user *)frame->retcode);
-
- if (err)
- return -EFAULT;
-@@ -377,7 +377,10 @@ static int __setup_rt_frame(int sig, str
- err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
-
- /* Set up to return from userspace. */
-- restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
-+ if (current->mm->context.vdso)
-+ restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
-+ else
-+ restorer = (void __user *)&frame->retcode;
- if (ka->sa.sa_flags & SA_RESTORER)
- restorer = ka->sa.sa_restorer;
- put_user_ex(restorer, &frame->pretcode);
-@@ -389,7 +392,7 @@ static int __setup_rt_frame(int sig, str
- * reasons and because gdb uses it as a signature to notice
- * signal handler stack frames.
- */
-- put_user_ex(*((u64 *)&rt_retcode), (u64 *)frame->retcode);
-+ put_user_ex(*((u64 *)&rt_retcode), (u64 __user *)frame->retcode);
- } put_user_catch(err);
-
- if (err)
-@@ -782,6 +785,8 @@ static void do_signal(struct pt_regs *re
- int signr;
- sigset_t *oldset;
-
-+ pax_track_stack();
-+
- /*
- * We want the common case to go fast, which is why we may in certain
- * cases get here from kernel mode. Just return without doing anything
-@@ -789,7 +794,7 @@ static void do_signal(struct pt_regs *re
- * X86_32: vm86 regs switched out by assembly code before reaching
- * here, so testing against kernel CS suffices.
- */
-- if (!user_mode(regs))
-+ if (!user_mode_novm(regs))
- return;
-
- if (current_thread_info()->status & TS_RESTORE_SIGMASK)
-diff -urNp linux-2.6.32.45/arch/x86/kernel/smpboot.c linux-2.6.32.45/arch/x86/kernel/smpboot.c
---- linux-2.6.32.45/arch/x86/kernel/smpboot.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/smpboot.c 2011-07-01 19:10:03.000000000 -0400
-@@ -94,14 +94,14 @@ static DEFINE_PER_CPU(struct task_struct
- */
- static DEFINE_MUTEX(x86_cpu_hotplug_driver_mutex);
-
--void cpu_hotplug_driver_lock()
-+void cpu_hotplug_driver_lock(void)
- {
-- mutex_lock(&x86_cpu_hotplug_driver_mutex);
-+ mutex_lock(&x86_cpu_hotplug_driver_mutex);
- }
-
--void cpu_hotplug_driver_unlock()
-+void cpu_hotplug_driver_unlock(void)
- {
-- mutex_unlock(&x86_cpu_hotplug_driver_mutex);
-+ mutex_unlock(&x86_cpu_hotplug_driver_mutex);
- }
-
- ssize_t arch_cpu_probe(const char *buf, size_t count) { return -1; }
-@@ -625,7 +625,7 @@ wakeup_secondary_cpu_via_init(int phys_a
- * target processor state.
- */
- startup_ipi_hook(phys_apicid, (unsigned long) start_secondary,
-- (unsigned long)stack_start.sp);
-+ stack_start);
-
- /*
- * Run STARTUP IPI loop.
-@@ -743,6 +743,7 @@ static int __cpuinit do_boot_cpu(int api
- set_idle_for_cpu(cpu, c_idle.idle);
- do_rest:
- per_cpu(current_task, cpu) = c_idle.idle;
-+ per_cpu(current_tinfo, cpu) = &c_idle.idle->tinfo;
- #ifdef CONFIG_X86_32
- /* Stack for startup_32 can be just as for start_secondary onwards */
- irq_ctx_init(cpu);
-@@ -750,13 +751,15 @@ do_rest:
- #else
- clear_tsk_thread_flag(c_idle.idle, TIF_FORK);
- initial_gs = per_cpu_offset(cpu);
-- per_cpu(kernel_stack, cpu) =
-- (unsigned long)task_stack_page(c_idle.idle) -
-- KERNEL_STACK_OFFSET + THREAD_SIZE;
-+ per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(c_idle.idle) - 16 + THREAD_SIZE;
- #endif
-+
-+ pax_open_kernel();
- early_gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
-+ pax_close_kernel();
-+
- initial_code = (unsigned long)start_secondary;
-- stack_start.sp = (void *) c_idle.idle->thread.sp;
-+ stack_start = c_idle.idle->thread.sp;
-
- /* start_ip had better be page-aligned! */
- start_ip = setup_trampoline();
-@@ -891,6 +894,12 @@ int __cpuinit native_cpu_up(unsigned int
-
- per_cpu(cpu_state, cpu) = CPU_UP_PREPARE;
-
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ clone_pgd_range(get_cpu_pgd(cpu) + KERNEL_PGD_BOUNDARY,
-+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-+ KERNEL_PGD_PTRS);
-+#endif
-+
- err = do_boot_cpu(apicid, cpu);
-
- if (err) {
-diff -urNp linux-2.6.32.45/arch/x86/kernel/step.c linux-2.6.32.45/arch/x86/kernel/step.c
---- linux-2.6.32.45/arch/x86/kernel/step.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/step.c 2011-04-17 15:56:46.000000000 -0400
-@@ -27,10 +27,10 @@ unsigned long convert_ip_to_linear(struc
- struct desc_struct *desc;
- unsigned long base;
-
-- seg &= ~7UL;
-+ seg >>= 3;
-
- mutex_lock(&child->mm->context.lock);
-- if (unlikely((seg >> 3) >= child->mm->context.size))
-+ if (unlikely(seg >= child->mm->context.size))
- addr = -1L; /* bogus selector, access would fault */
- else {
- desc = child->mm->context.ldt + seg;
-@@ -42,7 +42,8 @@ unsigned long convert_ip_to_linear(struc
- addr += base;
- }
- mutex_unlock(&child->mm->context.lock);
-- }
-+ } else if (seg == __KERNEL_CS || seg == __KERNEXEC_KERNEL_CS)
-+ addr = ktla_ktva(addr);
-
- return addr;
- }
-@@ -53,6 +54,9 @@ static int is_setting_trap_flag(struct t
- unsigned char opcode[15];
- unsigned long addr = convert_ip_to_linear(child, regs);
-
-+ if (addr == -EINVAL)
-+ return 0;
-+
- copied = access_process_vm(child, addr, opcode, sizeof(opcode), 0);
- for (i = 0; i < copied; i++) {
- switch (opcode[i]) {
-@@ -74,7 +78,7 @@ static int is_setting_trap_flag(struct t
-
- #ifdef CONFIG_X86_64
- case 0x40 ... 0x4f:
-- if (regs->cs != __USER_CS)
-+ if ((regs->cs & 0xffff) != __USER_CS)
- /* 32-bit mode: register increment */
- return 0;
- /* 64-bit mode: REX prefix */
-diff -urNp linux-2.6.32.45/arch/x86/kernel/syscall_table_32.S linux-2.6.32.45/arch/x86/kernel/syscall_table_32.S
---- linux-2.6.32.45/arch/x86/kernel/syscall_table_32.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/syscall_table_32.S 2011-04-17 15:56:46.000000000 -0400
-@@ -1,3 +1,4 @@
-+.section .rodata,"a",@progbits
- ENTRY(sys_call_table)
- .long sys_restart_syscall /* 0 - old "setup()" system call, used for restarting */
- .long sys_exit
-diff -urNp linux-2.6.32.45/arch/x86/kernel/sys_i386_32.c linux-2.6.32.45/arch/x86/kernel/sys_i386_32.c
---- linux-2.6.32.45/arch/x86/kernel/sys_i386_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/sys_i386_32.c 2011-04-17 15:56:46.000000000 -0400
-@@ -24,6 +24,21 @@
-
- #include <asm/syscalls.h>
-
-+int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
-+{
-+ unsigned long pax_task_size = TASK_SIZE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
-+ pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+ if (len > pax_task_size || addr > pax_task_size - len)
-+ return -EINVAL;
-+
-+ return 0;
-+}
-+
- /*
- * Perform the select(nd, in, out, ex, tv) and mmap() system
- * calls. Linux/i386 didn't use to be able to handle more than
-@@ -58,6 +73,212 @@ out:
- return err;
- }
-
-+unsigned long
-+arch_get_unmapped_area(struct file *filp, unsigned long addr,
-+ unsigned long len, unsigned long pgoff, unsigned long flags)
-+{
-+ struct mm_struct *mm = current->mm;
-+ struct vm_area_struct *vma;
-+ unsigned long start_addr, pax_task_size = TASK_SIZE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+ pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+ pax_task_size -= PAGE_SIZE;
-+
-+ if (len > pax_task_size)
-+ return -ENOMEM;
-+
-+ if (flags & MAP_FIXED)
-+ return addr;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
-+ if (addr) {
-+ addr = PAGE_ALIGN(addr);
-+ if (pax_task_size - len >= addr) {
-+ vma = find_vma(mm, addr);
-+ if (check_heap_stack_gap(vma, addr, len))
-+ return addr;
-+ }
-+ }
-+ if (len > mm->cached_hole_size) {
-+ start_addr = addr = mm->free_area_cache;
-+ } else {
-+ start_addr = addr = mm->mmap_base;
-+ mm->cached_hole_size = 0;
-+ }
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (!nx_enabled && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE) && start_addr >= mm->mmap_base) {
-+ start_addr = 0x00110000UL;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ start_addr += mm->delta_mmap & 0x03FFF000UL;
-+#endif
-+
-+ if (mm->start_brk <= start_addr && start_addr < mm->mmap_base)
-+ start_addr = addr = mm->mmap_base;
-+ else
-+ addr = start_addr;
-+ }
-+#endif
-+
-+full_search:
-+ for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
-+ /* At this point: (!vma || addr < vma->vm_end). */
-+ if (pax_task_size - len < addr) {
-+ /*
-+ * Start a new search - just in case we missed
-+ * some holes.
-+ */
-+ if (start_addr != mm->mmap_base) {
-+ start_addr = addr = mm->mmap_base;
-+ mm->cached_hole_size = 0;
-+ goto full_search;
-+ }
-+ return -ENOMEM;
-+ }
-+ if (check_heap_stack_gap(vma, addr, len))
-+ break;
-+ if (addr + mm->cached_hole_size < vma->vm_start)
-+ mm->cached_hole_size = vma->vm_start - addr;
-+ addr = vma->vm_end;
-+ if (mm->start_brk <= addr && addr < mm->mmap_base) {
-+ start_addr = addr = mm->mmap_base;
-+ mm->cached_hole_size = 0;
-+ goto full_search;
-+ }
-+ }
-+
-+ /*
-+ * Remember the place where we stopped the search:
-+ */
-+ mm->free_area_cache = addr + len;
-+ return addr;
-+}
-+
-+unsigned long
-+arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
-+ const unsigned long len, const unsigned long pgoff,
-+ const unsigned long flags)
-+{
-+ struct vm_area_struct *vma;
-+ struct mm_struct *mm = current->mm;
-+ unsigned long base = mm->mmap_base, addr = addr0, pax_task_size = TASK_SIZE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+ pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+ pax_task_size -= PAGE_SIZE;
-+
-+ /* requested length too big for entire address space */
-+ if (len > pax_task_size)
-+ return -ENOMEM;
-+
-+ if (flags & MAP_FIXED)
-+ return addr;
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (!nx_enabled && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE))
-+ goto bottomup;
-+#endif
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
-+ /* requesting a specific address */
-+ if (addr) {
-+ addr = PAGE_ALIGN(addr);
-+ if (pax_task_size - len >= addr) {
-+ vma = find_vma(mm, addr);
-+ if (check_heap_stack_gap(vma, addr, len))
-+ return addr;
-+ }
-+ }
-+
-+ /* check if free_area_cache is useful for us */
-+ if (len <= mm->cached_hole_size) {
-+ mm->cached_hole_size = 0;
-+ mm->free_area_cache = mm->mmap_base;
-+ }
-+
-+ /* either no address requested or can't fit in requested address hole */
-+ addr = mm->free_area_cache;
-+
-+ /* make sure it can fit in the remaining address space */
-+ if (addr > len) {
-+ vma = find_vma(mm, addr-len);
-+ if (check_heap_stack_gap(vma, addr - len, len))
-+ /* remember the address as a hint for next time */
-+ return (mm->free_area_cache = addr-len);
-+ }
-+
-+ if (mm->mmap_base < len)
-+ goto bottomup;
-+
-+ addr = mm->mmap_base-len;
-+
-+ do {
-+ /*
-+ * Lookup failure means no vma is above this address,
-+ * else if new region fits below vma->vm_start,
-+ * return with success:
-+ */
-+ vma = find_vma(mm, addr);
-+ if (check_heap_stack_gap(vma, addr, len))
-+ /* remember the address as a hint for next time */
-+ return (mm->free_area_cache = addr);
-+
-+ /* remember the largest hole we saw so far */
-+ if (addr + mm->cached_hole_size < vma->vm_start)
-+ mm->cached_hole_size = vma->vm_start - addr;
-+
-+ /* try just below the current vma->vm_start */
-+ addr = skip_heap_stack_gap(vma, len);
-+ } while (!IS_ERR_VALUE(addr));
-+
-+bottomup:
-+ /*
-+ * A failed mmap() very likely causes application failure,
-+ * so fall back to the bottom-up function here. This scenario
-+ * can happen with large stack limits and large mmap()
-+ * allocations.
-+ */
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+ mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
-+ else
-+#endif
-+
-+ mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base += mm->delta_mmap;
-+#endif
-+
-+ mm->free_area_cache = mm->mmap_base;
-+ mm->cached_hole_size = ~0UL;
-+ addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
-+ /*
-+ * Restore the topdown base:
-+ */
-+ mm->mmap_base = base;
-+ mm->free_area_cache = base;
-+ mm->cached_hole_size = ~0UL;
-+
-+ return addr;
-+}
-
- struct sel_arg_struct {
- unsigned long n;
-@@ -93,7 +314,7 @@ asmlinkage int sys_ipc(uint call, int fi
- return sys_semtimedop(first, (struct sembuf __user *)ptr, second, NULL);
- case SEMTIMEDOP:
- return sys_semtimedop(first, (struct sembuf __user *)ptr, second,
-- (const struct timespec __user *)fifth);
-+ (__force const struct timespec __user *)fifth);
-
- case SEMGET:
- return sys_semget(first, second, third);
-@@ -140,7 +361,7 @@ asmlinkage int sys_ipc(uint call, int fi
- ret = do_shmat(first, (char __user *) ptr, second, &raddr);
- if (ret)
- return ret;
-- return put_user(raddr, (ulong __user *) third);
-+ return put_user(raddr, (__force ulong __user *) third);
- }
- case 1: /* iBCS2 emulator entry point */
- if (!segment_eq(get_fs(), get_ds()))
-@@ -207,17 +428,3 @@ asmlinkage int sys_olduname(struct oldol
-
- return error;
- }
--
--
--/*
-- * Do a system call from kernel instead of calling sys_execve so we
-- * end up with proper pt_regs.
-- */
--int kernel_execve(const char *filename, char *const argv[], char *const envp[])
--{
-- long __res;
-- asm volatile ("push %%ebx ; movl %2,%%ebx ; int $0x80 ; pop %%ebx"
-- : "=a" (__res)
-- : "0" (__NR_execve), "ri" (filename), "c" (argv), "d" (envp) : "memory");
-- return __res;
--}
-diff -urNp linux-2.6.32.45/arch/x86/kernel/sys_x86_64.c linux-2.6.32.45/arch/x86/kernel/sys_x86_64.c
---- linux-2.6.32.45/arch/x86/kernel/sys_x86_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/sys_x86_64.c 2011-04-17 15:56:46.000000000 -0400
-@@ -32,8 +32,8 @@ out:
- return error;
- }
-
--static void find_start_end(unsigned long flags, unsigned long *begin,
-- unsigned long *end)
-+static void find_start_end(struct mm_struct *mm, unsigned long flags,
-+ unsigned long *begin, unsigned long *end)
- {
- if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT)) {
- unsigned long new_begin;
-@@ -52,7 +52,7 @@ static void find_start_end(unsigned long
- *begin = new_begin;
- }
- } else {
-- *begin = TASK_UNMAPPED_BASE;
-+ *begin = mm->mmap_base;
- *end = TASK_SIZE;
- }
- }
-@@ -69,16 +69,19 @@ arch_get_unmapped_area(struct file *filp
- if (flags & MAP_FIXED)
- return addr;
-
-- find_start_end(flags, &begin, &end);
-+ find_start_end(mm, flags, &begin, &end);
-
- if (len > end)
- return -ENOMEM;
-
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- if (addr) {
- addr = PAGE_ALIGN(addr);
- vma = find_vma(mm, addr);
-- if (end - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-+ if (end - len >= addr && check_heap_stack_gap(vma, addr, len))
- return addr;
- }
- if (((flags & MAP_32BIT) || test_thread_flag(TIF_IA32))
-@@ -106,7 +109,7 @@ full_search:
- }
- return -ENOMEM;
- }
-- if (!vma || addr + len <= vma->vm_start) {
-+ if (check_heap_stack_gap(vma, addr, len)) {
- /*
- * Remember the place where we stopped the search:
- */
-@@ -128,7 +131,7 @@ arch_get_unmapped_area_topdown(struct fi
- {
- struct vm_area_struct *vma;
- struct mm_struct *mm = current->mm;
-- unsigned long addr = addr0;
-+ unsigned long base = mm->mmap_base, addr = addr0;
-
- /* requested length too big for entire address space */
- if (len > TASK_SIZE)
-@@ -141,13 +144,18 @@ arch_get_unmapped_area_topdown(struct fi
- if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT))
- goto bottomup;
-
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- /* requesting a specific address */
- if (addr) {
- addr = PAGE_ALIGN(addr);
-- vma = find_vma(mm, addr);
-- if (TASK_SIZE - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-- return addr;
-+ if (TASK_SIZE - len >= addr) {
-+ vma = find_vma(mm, addr);
-+ if (check_heap_stack_gap(vma, addr, len))
-+ return addr;
-+ }
- }
-
- /* check if free_area_cache is useful for us */
-@@ -162,7 +170,7 @@ arch_get_unmapped_area_topdown(struct fi
- /* make sure it can fit in the remaining address space */
- if (addr > len) {
- vma = find_vma(mm, addr-len);
-- if (!vma || addr <= vma->vm_start)
-+ if (check_heap_stack_gap(vma, addr - len, len))
- /* remember the address as a hint for next time */
- return mm->free_area_cache = addr-len;
- }
-@@ -179,7 +187,7 @@ arch_get_unmapped_area_topdown(struct fi
- * return with success:
- */
- vma = find_vma(mm, addr);
-- if (!vma || addr+len <= vma->vm_start)
-+ if (check_heap_stack_gap(vma, addr, len))
- /* remember the address as a hint for next time */
- return mm->free_area_cache = addr;
-
-@@ -188,8 +196,8 @@ arch_get_unmapped_area_topdown(struct fi
- mm->cached_hole_size = vma->vm_start - addr;
-
- /* try just below the current vma->vm_start */
-- addr = vma->vm_start-len;
-- } while (len < vma->vm_start);
-+ addr = skip_heap_stack_gap(vma, len);
-+ } while (!IS_ERR_VALUE(addr));
-
- bottomup:
- /*
-@@ -198,13 +206,21 @@ bottomup:
- * can happen with large stack limits and large mmap()
- * allocations.
- */
-+ mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base += mm->delta_mmap;
-+#endif
-+
-+ mm->free_area_cache = mm->mmap_base;
- mm->cached_hole_size = ~0UL;
-- mm->free_area_cache = TASK_UNMAPPED_BASE;
- addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
- /*
- * Restore the topdown base:
- */
-- mm->free_area_cache = mm->mmap_base;
-+ mm->mmap_base = base;
-+ mm->free_area_cache = base;
- mm->cached_hole_size = ~0UL;
-
- return addr;
-diff -urNp linux-2.6.32.45/arch/x86/kernel/tboot.c linux-2.6.32.45/arch/x86/kernel/tboot.c
---- linux-2.6.32.45/arch/x86/kernel/tboot.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/tboot.c 2011-05-22 23:02:03.000000000 -0400
-@@ -216,7 +216,7 @@ static int tboot_setup_sleep(void)
-
- void tboot_shutdown(u32 shutdown_type)
- {
-- void (*shutdown)(void);
-+ void (* __noreturn shutdown)(void);
-
- if (!tboot_enabled())
- return;
-@@ -238,7 +238,7 @@ void tboot_shutdown(u32 shutdown_type)
-
- switch_to_tboot_pt();
-
-- shutdown = (void(*)(void))(unsigned long)tboot->shutdown_entry;
-+ shutdown = (void *)tboot->shutdown_entry;
- shutdown();
-
- /* should not reach here */
-@@ -295,7 +295,7 @@ void tboot_sleep(u8 sleep_state, u32 pm1
- tboot_shutdown(acpi_shutdown_map[sleep_state]);
- }
-
--static atomic_t ap_wfs_count;
-+static atomic_unchecked_t ap_wfs_count;
-
- static int tboot_wait_for_aps(int num_aps)
- {
-@@ -319,9 +319,9 @@ static int __cpuinit tboot_cpu_callback(
- {
- switch (action) {
- case CPU_DYING:
-- atomic_inc(&ap_wfs_count);
-+ atomic_inc_unchecked(&ap_wfs_count);
- if (num_online_cpus() == 1)
-- if (tboot_wait_for_aps(atomic_read(&ap_wfs_count)))
-+ if (tboot_wait_for_aps(atomic_read_unchecked(&ap_wfs_count)))
- return NOTIFY_BAD;
- break;
- }
-@@ -340,7 +340,7 @@ static __init int tboot_late_init(void)
-
- tboot_create_trampoline();
-
-- atomic_set(&ap_wfs_count, 0);
-+ atomic_set_unchecked(&ap_wfs_count, 0);
- register_hotcpu_notifier(&tboot_cpu_notifier);
- return 0;
- }
-diff -urNp linux-2.6.32.45/arch/x86/kernel/time.c linux-2.6.32.45/arch/x86/kernel/time.c
---- linux-2.6.32.45/arch/x86/kernel/time.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/time.c 2011-04-17 15:56:46.000000000 -0400
-@@ -26,17 +26,13 @@
- int timer_ack;
- #endif
-
--#ifdef CONFIG_X86_64
--volatile unsigned long __jiffies __section_jiffies = INITIAL_JIFFIES;
--#endif
--
- unsigned long profile_pc(struct pt_regs *regs)
- {
- unsigned long pc = instruction_pointer(regs);
-
-- if (!user_mode_vm(regs) && in_lock_functions(pc)) {
-+ if (!user_mode(regs) && in_lock_functions(pc)) {
- #ifdef CONFIG_FRAME_POINTER
-- return *(unsigned long *)(regs->bp + sizeof(long));
-+ return ktla_ktva(*(unsigned long *)(regs->bp + sizeof(long)));
- #else
- unsigned long *sp =
- (unsigned long *)kernel_stack_pointer(regs);
-@@ -45,11 +41,17 @@ unsigned long profile_pc(struct pt_regs
- * or above a saved flags. Eflags has bits 22-31 zero,
- * kernel addresses don't.
- */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ return ktla_ktva(sp[0]);
-+#else
- if (sp[0] >> 22)
- return sp[0];
- if (sp[1] >> 22)
- return sp[1];
- #endif
-+
-+#endif
- }
- return pc;
- }
-diff -urNp linux-2.6.32.45/arch/x86/kernel/tls.c linux-2.6.32.45/arch/x86/kernel/tls.c
---- linux-2.6.32.45/arch/x86/kernel/tls.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/tls.c 2011-04-17 15:56:46.000000000 -0400
-@@ -85,6 +85,11 @@ int do_set_thread_area(struct task_struc
- if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
- return -EINVAL;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((p->mm->pax_flags & MF_PAX_SEGMEXEC) && (info.contents & MODIFY_LDT_CONTENTS_CODE))
-+ return -EINVAL;
-+#endif
-+
- set_tls_desc(p, idx, &info, 1);
-
- return 0;
-diff -urNp linux-2.6.32.45/arch/x86/kernel/trampoline_32.S linux-2.6.32.45/arch/x86/kernel/trampoline_32.S
---- linux-2.6.32.45/arch/x86/kernel/trampoline_32.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/trampoline_32.S 2011-04-17 15:56:46.000000000 -0400
-@@ -32,6 +32,12 @@
- #include <asm/segment.h>
- #include <asm/page_types.h>
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+#define ta(X) (X)
-+#else
-+#define ta(X) ((X) - __PAGE_OFFSET)
-+#endif
-+
- /* We can free up trampoline after bootup if cpu hotplug is not supported. */
- __CPUINITRODATA
- .code16
-@@ -60,7 +66,7 @@ r_base = .
- inc %ax # protected mode (PE) bit
- lmsw %ax # into protected mode
- # flush prefetch and jump to startup_32_smp in arch/i386/kernel/head.S
-- ljmpl $__BOOT_CS, $(startup_32_smp-__PAGE_OFFSET)
-+ ljmpl $__BOOT_CS, $ta(startup_32_smp)
-
- # These need to be in the same 64K segment as the above;
- # hence we don't use the boot_gdt_descr defined in head.S
-diff -urNp linux-2.6.32.45/arch/x86/kernel/trampoline_64.S linux-2.6.32.45/arch/x86/kernel/trampoline_64.S
---- linux-2.6.32.45/arch/x86/kernel/trampoline_64.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/trampoline_64.S 2011-07-01 18:53:26.000000000 -0400
-@@ -91,7 +91,7 @@ startup_32:
- movl $__KERNEL_DS, %eax # Initialize the %ds segment register
- movl %eax, %ds
-
-- movl $X86_CR4_PAE, %eax
-+ movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
- movl %eax, %cr4 # Enable PAE mode
-
- # Setup trampoline 4 level pagetables
-@@ -127,7 +127,7 @@ startup_64:
- no_longmode:
- hlt
- jmp no_longmode
--#include "verify_cpu_64.S"
-+#include "verify_cpu.S"
-
- # Careful these need to be in the same 64K segment as the above;
- tidt:
-@@ -138,7 +138,7 @@ tidt:
- # so the kernel can live anywhere
- .balign 4
- tgdt:
-- .short tgdt_end - tgdt # gdt limit
-+ .short tgdt_end - tgdt - 1 # gdt limit
- .long tgdt - r_base
- .short 0
- .quad 0x00cf9b000000ffff # __KERNEL32_CS
-diff -urNp linux-2.6.32.45/arch/x86/kernel/traps.c linux-2.6.32.45/arch/x86/kernel/traps.c
---- linux-2.6.32.45/arch/x86/kernel/traps.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/traps.c 2011-07-06 19:53:33.000000000 -0400
-@@ -69,12 +69,6 @@ asmlinkage int system_call(void);
-
- /* Do we ignore FPU interrupts ? */
- char ignore_fpu_irq;
--
--/*
-- * The IDT has to be page-aligned to simplify the Pentium
-- * F0 0F bug workaround.
-- */
--gate_desc idt_table[NR_VECTORS] __page_aligned_data = { { { { 0, 0 } } }, };
- #endif
-
- DECLARE_BITMAP(used_vectors, NR_VECTORS);
-@@ -112,19 +106,19 @@ static inline void preempt_conditional_c
- static inline void
- die_if_kernel(const char *str, struct pt_regs *regs, long err)
- {
-- if (!user_mode_vm(regs))
-+ if (!user_mode(regs))
- die(str, regs, err);
- }
- #endif
-
- static void __kprobes
--do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
-+do_trap(int trapnr, int signr, const char *str, struct pt_regs *regs,
- long error_code, siginfo_t *info)
- {
- struct task_struct *tsk = current;
-
- #ifdef CONFIG_X86_32
-- if (regs->flags & X86_VM_MASK) {
-+ if (v8086_mode(regs)) {
- /*
- * traps 0, 1, 3, 4, and 5 should be forwarded to vm86.
- * On nmi (interrupt 2), do_trap should not be called.
-@@ -135,7 +129,7 @@ do_trap(int trapnr, int signr, char *str
- }
- #endif
-
-- if (!user_mode(regs))
-+ if (!user_mode_novm(regs))
- goto kernel_trap;
-
- #ifdef CONFIG_X86_32
-@@ -158,7 +152,7 @@ trap_signal:
- printk_ratelimit()) {
- printk(KERN_INFO
- "%s[%d] trap %s ip:%lx sp:%lx error:%lx",
-- tsk->comm, tsk->pid, str,
-+ tsk->comm, task_pid_nr(tsk), str,
- regs->ip, regs->sp, error_code);
- print_vma_addr(" in ", regs->ip);
- printk("\n");
-@@ -175,8 +169,20 @@ kernel_trap:
- if (!fixup_exception(regs)) {
- tsk->thread.error_code = error_code;
- tsk->thread.trap_no = trapnr;
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ if (trapnr == 12 && ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS))
-+ str = "PAX: suspicious stack segment fault";
-+#endif
-+
- die(str, regs, error_code);
- }
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+ if (trapnr == 4)
-+ pax_report_refcount_overflow(regs);
-+#endif
-+
- return;
-
- #ifdef CONFIG_X86_32
-@@ -265,14 +271,30 @@ do_general_protection(struct pt_regs *re
- conditional_sti(regs);
-
- #ifdef CONFIG_X86_32
-- if (regs->flags & X86_VM_MASK)
-+ if (v8086_mode(regs))
- goto gp_in_vm86;
- #endif
-
- tsk = current;
-- if (!user_mode(regs))
-+ if (!user_mode_novm(regs))
- goto gp_in_kernel;
-
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
-+ if (!nx_enabled && tsk->mm && (tsk->mm->pax_flags & MF_PAX_PAGEEXEC)) {
-+ struct mm_struct *mm = tsk->mm;
-+ unsigned long limit;
-+
-+ down_write(&mm->mmap_sem);
-+ limit = mm->context.user_cs_limit;
-+ if (limit < TASK_SIZE) {
-+ track_exec_limit(mm, limit, TASK_SIZE, VM_EXEC);
-+ up_write(&mm->mmap_sem);
-+ return;
-+ }
-+ up_write(&mm->mmap_sem);
-+ }
-+#endif
-+
- tsk->thread.error_code = error_code;
- tsk->thread.trap_no = 13;
-
-@@ -305,6 +327,13 @@ gp_in_kernel:
- if (notify_die(DIE_GPF, "general protection fault", regs,
- error_code, 13, SIGSEGV) == NOTIFY_STOP)
- return;
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ if ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS)
-+ die("PAX: suspicious general protection fault", regs, error_code);
-+ else
-+#endif
-+
- die("general protection fault", regs, error_code);
- }
-
-@@ -435,6 +464,17 @@ static notrace __kprobes void default_do
- dotraplinkage notrace __kprobes void
- do_nmi(struct pt_regs *regs, long error_code)
- {
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ if (!user_mode(regs)) {
-+ unsigned long cs = regs->cs & 0xFFFF;
-+ unsigned long ip = ktva_ktla(regs->ip);
-+
-+ if ((cs == __KERNEL_CS || cs == __KERNEXEC_KERNEL_CS) && ip <= (unsigned long)_etext)
-+ regs->ip = ip;
-+ }
-+#endif
-+
- nmi_enter();
-
- inc_irq_stat(__nmi_count);
-@@ -558,7 +598,7 @@ dotraplinkage void __kprobes do_debug(st
- }
-
- #ifdef CONFIG_X86_32
-- if (regs->flags & X86_VM_MASK)
-+ if (v8086_mode(regs))
- goto debug_vm86;
- #endif
-
-@@ -570,7 +610,7 @@ dotraplinkage void __kprobes do_debug(st
- * kernel space (but re-enable TF when returning to user mode).
- */
- if (condition & DR_STEP) {
-- if (!user_mode(regs))
-+ if (!user_mode_novm(regs))
- goto clear_TF_reenable;
- }
-
-@@ -757,7 +797,7 @@ do_simd_coprocessor_error(struct pt_regs
- * Handle strange cache flush from user space exception
- * in all other cases. This is undocumented behaviour.
- */
-- if (regs->flags & X86_VM_MASK) {
-+ if (v8086_mode(regs)) {
- handle_vm86_fault((struct kernel_vm86_regs *)regs, error_code);
- return;
- }
-@@ -798,7 +838,7 @@ asmlinkage void __attribute__((weak)) sm
- void __math_state_restore(void)
- {
- struct thread_info *thread = current_thread_info();
-- struct task_struct *tsk = thread->task;
-+ struct task_struct *tsk = current;
-
- /*
- * Paranoid restore. send a SIGSEGV if we fail to restore the state.
-@@ -825,8 +865,7 @@ void __math_state_restore(void)
- */
- asmlinkage void math_state_restore(void)
- {
-- struct thread_info *thread = current_thread_info();
-- struct task_struct *tsk = thread->task;
-+ struct task_struct *tsk = current;
-
- if (!tsk_used_math(tsk)) {
- local_irq_enable();
-diff -urNp linux-2.6.32.45/arch/x86/kernel/verify_cpu_64.S linux-2.6.32.45/arch/x86/kernel/verify_cpu_64.S
---- linux-2.6.32.45/arch/x86/kernel/verify_cpu_64.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/verify_cpu_64.S 1969-12-31 19:00:00.000000000 -0500
-@@ -1,105 +0,0 @@
--/*
-- *
-- * verify_cpu.S - Code for cpu long mode and SSE verification. This
-- * code has been borrowed from boot/setup.S and was introduced by
-- * Andi Kleen.
-- *
-- * Copyright (c) 2007 Andi Kleen (ak@suse.de)
-- * Copyright (c) 2007 Eric Biederman (ebiederm@xmission.com)
-- * Copyright (c) 2007 Vivek Goyal (vgoyal@in.ibm.com)
-- *
-- * This source code is licensed under the GNU General Public License,
-- * Version 2. See the file COPYING for more details.
-- *
-- * This is a common code for verification whether CPU supports
-- * long mode and SSE or not. It is not called directly instead this
-- * file is included at various places and compiled in that context.
-- * Following are the current usage.
-- *
-- * This file is included by both 16bit and 32bit code.
-- *
-- * arch/x86_64/boot/setup.S : Boot cpu verification (16bit)
-- * arch/x86_64/boot/compressed/head.S: Boot cpu verification (32bit)
-- * arch/x86_64/kernel/trampoline.S: secondary processor verfication (16bit)
-- * arch/x86_64/kernel/acpi/wakeup.S:Verfication at resume (16bit)
-- *
-- * verify_cpu, returns the status of cpu check in register %eax.
-- * 0: Success 1: Failure
-- *
-- * The caller needs to check for the error code and take the action
-- * appropriately. Either display a message or halt.
-- */
--
--#include <asm/cpufeature.h>
--
--verify_cpu:
-- pushfl # Save caller passed flags
-- pushl $0 # Kill any dangerous flags
-- popfl
--
-- pushfl # standard way to check for cpuid
-- popl %eax
-- movl %eax,%ebx
-- xorl $0x200000,%eax
-- pushl %eax
-- popfl
-- pushfl
-- popl %eax
-- cmpl %eax,%ebx
-- jz verify_cpu_no_longmode # cpu has no cpuid
--
-- movl $0x0,%eax # See if cpuid 1 is implemented
-- cpuid
-- cmpl $0x1,%eax
-- jb verify_cpu_no_longmode # no cpuid 1
--
-- xor %di,%di
-- cmpl $0x68747541,%ebx # AuthenticAMD
-- jnz verify_cpu_noamd
-- cmpl $0x69746e65,%edx
-- jnz verify_cpu_noamd
-- cmpl $0x444d4163,%ecx
-- jnz verify_cpu_noamd
-- mov $1,%di # cpu is from AMD
--
--verify_cpu_noamd:
-- movl $0x1,%eax # Does the cpu have what it takes
-- cpuid
-- andl $REQUIRED_MASK0,%edx
-- xorl $REQUIRED_MASK0,%edx
-- jnz verify_cpu_no_longmode
--
-- movl $0x80000000,%eax # See if extended cpuid is implemented
-- cpuid
-- cmpl $0x80000001,%eax
-- jb verify_cpu_no_longmode # no extended cpuid
--
-- movl $0x80000001,%eax # Does the cpu have what it takes
-- cpuid
-- andl $REQUIRED_MASK1,%edx
-- xorl $REQUIRED_MASK1,%edx
-- jnz verify_cpu_no_longmode
--
--verify_cpu_sse_test:
-- movl $1,%eax
-- cpuid
-- andl $SSE_MASK,%edx
-- cmpl $SSE_MASK,%edx
-- je verify_cpu_sse_ok
-- test %di,%di
-- jz verify_cpu_no_longmode # only try to force SSE on AMD
-- movl $0xc0010015,%ecx # HWCR
-- rdmsr
-- btr $15,%eax # enable SSE
-- wrmsr
-- xor %di,%di # don't loop
-- jmp verify_cpu_sse_test # try again
--
--verify_cpu_no_longmode:
-- popfl # Restore caller passed flags
-- movl $1,%eax
-- ret
--verify_cpu_sse_ok:
-- popfl # Restore caller passed flags
-- xorl %eax, %eax
-- ret
-diff -urNp linux-2.6.32.45/arch/x86/kernel/verify_cpu.S linux-2.6.32.45/arch/x86/kernel/verify_cpu.S
---- linux-2.6.32.45/arch/x86/kernel/verify_cpu.S 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/arch/x86/kernel/verify_cpu.S 2011-07-01 18:28:42.000000000 -0400
-@@ -0,0 +1,140 @@
-+/*
-+ *
-+ * verify_cpu.S - Code for cpu long mode and SSE verification. This
-+ * code has been borrowed from boot/setup.S and was introduced by
-+ * Andi Kleen.
-+ *
-+ * Copyright (c) 2007 Andi Kleen (ak@suse.de)
-+ * Copyright (c) 2007 Eric Biederman (ebiederm@xmission.com)
-+ * Copyright (c) 2007 Vivek Goyal (vgoyal@in.ibm.com)
-+ * Copyright (c) 2010 Kees Cook (kees.cook@canonical.com)
-+ *
-+ * This source code is licensed under the GNU General Public License,
-+ * Version 2. See the file COPYING for more details.
-+ *
-+ * This is a common code for verification whether CPU supports
-+ * long mode and SSE or not. It is not called directly instead this
-+ * file is included at various places and compiled in that context.
-+ * This file is expected to run in 32bit code. Currently:
-+ *
-+ * arch/x86/boot/compressed/head_64.S: Boot cpu verification
-+ * arch/x86/kernel/trampoline_64.S: secondary processor verification
-+ * arch/x86/kernel/head_32.S: processor startup
-+ * arch/x86/kernel/acpi/realmode/wakeup.S: 32bit processor resume
-+ *
-+ * verify_cpu, returns the status of longmode and SSE in register %eax.
-+ * 0: Success 1: Failure
-+ *
-+ * On Intel, the XD_DISABLE flag will be cleared as a side-effect.
-+ *
-+ * The caller needs to check for the error code and take the action
-+ * appropriately. Either display a message or halt.
-+ */
-+
-+#include <asm/cpufeature.h>
-+#include <asm/msr-index.h>
-+
-+verify_cpu:
-+ pushfl # Save caller passed flags
-+ pushl $0 # Kill any dangerous flags
-+ popfl
-+
-+ pushfl # standard way to check for cpuid
-+ popl %eax
-+ movl %eax,%ebx
-+ xorl $0x200000,%eax
-+ pushl %eax
-+ popfl
-+ pushfl
-+ popl %eax
-+ cmpl %eax,%ebx
-+ jz verify_cpu_no_longmode # cpu has no cpuid
-+
-+ movl $0x0,%eax # See if cpuid 1 is implemented
-+ cpuid
-+ cmpl $0x1,%eax
-+ jb verify_cpu_no_longmode # no cpuid 1
-+
-+ xor %di,%di
-+ cmpl $0x68747541,%ebx # AuthenticAMD
-+ jnz verify_cpu_noamd
-+ cmpl $0x69746e65,%edx
-+ jnz verify_cpu_noamd
-+ cmpl $0x444d4163,%ecx
-+ jnz verify_cpu_noamd
-+ mov $1,%di # cpu is from AMD
-+ jmp verify_cpu_check
-+
-+verify_cpu_noamd:
-+ cmpl $0x756e6547,%ebx # GenuineIntel?
-+ jnz verify_cpu_check
-+ cmpl $0x49656e69,%edx
-+ jnz verify_cpu_check
-+ cmpl $0x6c65746e,%ecx
-+ jnz verify_cpu_check
-+
-+ # only call IA32_MISC_ENABLE when:
-+ # family > 6 || (family == 6 && model >= 0xd)
-+ movl $0x1, %eax # check CPU family and model
-+ cpuid
-+ movl %eax, %ecx
-+
-+ andl $0x0ff00f00, %eax # mask family and extended family
-+ shrl $8, %eax
-+ cmpl $6, %eax
-+ ja verify_cpu_clear_xd # family > 6, ok
-+ jb verify_cpu_check # family < 6, skip
-+
-+ andl $0x000f00f0, %ecx # mask model and extended model
-+ shrl $4, %ecx
-+ cmpl $0xd, %ecx
-+ jb verify_cpu_check # family == 6, model < 0xd, skip
-+
-+verify_cpu_clear_xd:
-+ movl $MSR_IA32_MISC_ENABLE, %ecx
-+ rdmsr
-+ btrl $2, %edx # clear MSR_IA32_MISC_ENABLE_XD_DISABLE
-+ jnc verify_cpu_check # only write MSR if bit was changed
-+ wrmsr
-+
-+verify_cpu_check:
-+ movl $0x1,%eax # Does the cpu have what it takes
-+ cpuid
-+ andl $REQUIRED_MASK0,%edx
-+ xorl $REQUIRED_MASK0,%edx
-+ jnz verify_cpu_no_longmode
-+
-+ movl $0x80000000,%eax # See if extended cpuid is implemented
-+ cpuid
-+ cmpl $0x80000001,%eax
-+ jb verify_cpu_no_longmode # no extended cpuid
-+
-+ movl $0x80000001,%eax # Does the cpu have what it takes
-+ cpuid
-+ andl $REQUIRED_MASK1,%edx
-+ xorl $REQUIRED_MASK1,%edx
-+ jnz verify_cpu_no_longmode
-+
-+verify_cpu_sse_test:
-+ movl $1,%eax
-+ cpuid
-+ andl $SSE_MASK,%edx
-+ cmpl $SSE_MASK,%edx
-+ je verify_cpu_sse_ok
-+ test %di,%di
-+ jz verify_cpu_no_longmode # only try to force SSE on AMD
-+ movl $MSR_K7_HWCR,%ecx
-+ rdmsr
-+ btr $15,%eax # enable SSE
-+ wrmsr
-+ xor %di,%di # don't loop
-+ jmp verify_cpu_sse_test # try again
-+
-+verify_cpu_no_longmode:
-+ popfl # Restore caller passed flags
-+ movl $1,%eax
-+ ret
-+verify_cpu_sse_ok:
-+ popfl # Restore caller passed flags
-+ xorl %eax, %eax
-+ ret
-diff -urNp linux-2.6.32.45/arch/x86/kernel/vm86_32.c linux-2.6.32.45/arch/x86/kernel/vm86_32.c
---- linux-2.6.32.45/arch/x86/kernel/vm86_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/vm86_32.c 2011-04-17 15:56:46.000000000 -0400
-@@ -41,6 +41,7 @@
- #include <linux/ptrace.h>
- #include <linux/audit.h>
- #include <linux/stddef.h>
-+#include <linux/grsecurity.h>
-
- #include <asm/uaccess.h>
- #include <asm/io.h>
-@@ -148,7 +149,7 @@ struct pt_regs *save_v86_state(struct ke
- do_exit(SIGSEGV);
- }
-
-- tss = &per_cpu(init_tss, get_cpu());
-+ tss = init_tss + get_cpu();
- current->thread.sp0 = current->thread.saved_sp0;
- current->thread.sysenter_cs = __KERNEL_CS;
- load_sp0(tss, ¤t->thread);
-@@ -208,6 +209,13 @@ int sys_vm86old(struct pt_regs *regs)
- struct task_struct *tsk;
- int tmp, ret = -EPERM;
-
-+#ifdef CONFIG_GRKERNSEC_VM86
-+ if (!capable(CAP_SYS_RAWIO)) {
-+ gr_handle_vm86();
-+ goto out;
-+ }
-+#endif
-+
- tsk = current;
- if (tsk->thread.saved_sp0)
- goto out;
-@@ -238,6 +246,14 @@ int sys_vm86(struct pt_regs *regs)
- int tmp, ret;
- struct vm86plus_struct __user *v86;
-
-+#ifdef CONFIG_GRKERNSEC_VM86
-+ if (!capable(CAP_SYS_RAWIO)) {
-+ gr_handle_vm86();
-+ ret = -EPERM;
-+ goto out;
-+ }
-+#endif
-+
- tsk = current;
- switch (regs->bx) {
- case VM86_REQUEST_IRQ:
-@@ -324,7 +340,7 @@ static void do_sys_vm86(struct kernel_vm
- tsk->thread.saved_fs = info->regs32->fs;
- tsk->thread.saved_gs = get_user_gs(info->regs32);
-
-- tss = &per_cpu(init_tss, get_cpu());
-+ tss = init_tss + get_cpu();
- tsk->thread.sp0 = (unsigned long) &info->VM86_TSS_ESP0;
- if (cpu_has_sep)
- tsk->thread.sysenter_cs = 0;
-@@ -529,7 +545,7 @@ static void do_int(struct kernel_vm86_re
- goto cannot_handle;
- if (i == 0x21 && is_revectored(AH(regs), &KVM86->int21_revectored))
- goto cannot_handle;
-- intr_ptr = (unsigned long __user *) (i << 2);
-+ intr_ptr = (__force unsigned long __user *) (i << 2);
- if (get_user(segoffs, intr_ptr))
- goto cannot_handle;
- if ((segoffs >> 16) == BIOSSEG)
-diff -urNp linux-2.6.32.45/arch/x86/kernel/vmi_32.c linux-2.6.32.45/arch/x86/kernel/vmi_32.c
---- linux-2.6.32.45/arch/x86/kernel/vmi_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/vmi_32.c 2011-08-05 20:33:55.000000000 -0400
-@@ -44,12 +44,17 @@ typedef u32 __attribute__((regparm(1)))
- typedef u64 __attribute__((regparm(2))) (VROMLONGFUNC)(int);
-
- #define call_vrom_func(rom,func) \
-- (((VROMFUNC *)(rom->func))())
-+ (((VROMFUNC *)(ktva_ktla(rom.func)))())
-
- #define call_vrom_long_func(rom,func,arg) \
-- (((VROMLONGFUNC *)(rom->func)) (arg))
-+({\
-+ u64 __reloc = ((VROMLONGFUNC *)(ktva_ktla(rom.func))) (arg);\
-+ struct vmi_relocation_info *const __rel = (struct vmi_relocation_info *)&__reloc;\
-+ __rel->eip = (unsigned char *)ktva_ktla((unsigned long)__rel->eip);\
-+ __reloc;\
-+})
-
--static struct vrom_header *vmi_rom;
-+static struct vrom_header vmi_rom __attribute((__section__(".vmi.rom"), __aligned__(PAGE_SIZE)));
- static int disable_pge;
- static int disable_pse;
- static int disable_sep;
-@@ -76,10 +81,10 @@ static struct {
- void (*set_initial_ap_state)(int, int);
- void (*halt)(void);
- void (*set_lazy_mode)(int mode);
--} vmi_ops;
-+} __no_const vmi_ops __read_only;
-
- /* Cached VMI operations */
--struct vmi_timer_ops vmi_timer_ops;
-+struct vmi_timer_ops vmi_timer_ops __read_only;
-
- /*
- * VMI patching routines.
-@@ -94,7 +99,7 @@ struct vmi_timer_ops vmi_timer_ops;
- static inline void patch_offset(void *insnbuf,
- unsigned long ip, unsigned long dest)
- {
-- *(unsigned long *)(insnbuf+1) = dest-ip-5;
-+ *(unsigned long *)(insnbuf+1) = dest-ip-5;
- }
-
- static unsigned patch_internal(int call, unsigned len, void *insnbuf,
-@@ -102,6 +107,7 @@ static unsigned patch_internal(int call,
- {
- u64 reloc;
- struct vmi_relocation_info *const rel = (struct vmi_relocation_info *)&reloc;
-+
- reloc = call_vrom_long_func(vmi_rom, get_reloc, call);
- switch(rel->type) {
- case VMI_RELOCATION_CALL_REL:
-@@ -404,13 +410,13 @@ static void vmi_set_pud(pud_t *pudp, pud
-
- static void vmi_pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
- {
-- const pte_t pte = { .pte = 0 };
-+ const pte_t pte = __pte(0ULL);
- vmi_ops.set_pte(pte, ptep, vmi_flags_addr(mm, addr, VMI_PAGE_PT, 0));
- }
-
- static void vmi_pmd_clear(pmd_t *pmd)
- {
-- const pte_t pte = { .pte = 0 };
-+ const pte_t pte = __pte(0ULL);
- vmi_ops.set_pte(pte, (pte_t *)pmd, VMI_PAGE_PD);
- }
- #endif
-@@ -438,10 +444,10 @@ vmi_startup_ipi_hook(int phys_apicid, un
- ap.ss = __KERNEL_DS;
- ap.esp = (unsigned long) start_esp;
-
-- ap.ds = __USER_DS;
-- ap.es = __USER_DS;
-+ ap.ds = __KERNEL_DS;
-+ ap.es = __KERNEL_DS;
- ap.fs = __KERNEL_PERCPU;
-- ap.gs = __KERNEL_STACK_CANARY;
-+ savesegment(gs, ap.gs);
-
- ap.eflags = 0;
-
-@@ -486,6 +492,18 @@ static void vmi_leave_lazy_mmu(void)
- paravirt_leave_lazy_mmu();
- }
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+static unsigned long vmi_pax_open_kernel(void)
-+{
-+ return 0;
-+}
-+
-+static unsigned long vmi_pax_close_kernel(void)
-+{
-+ return 0;
-+}
-+#endif
-+
- static inline int __init check_vmi_rom(struct vrom_header *rom)
- {
- struct pci_header *pci;
-@@ -498,6 +516,10 @@ static inline int __init check_vmi_rom(s
- return 0;
- if (rom->vrom_signature != VMI_SIGNATURE)
- return 0;
-+ if (rom->rom_length * 512 > sizeof(*rom)) {
-+ printk(KERN_WARNING "PAX: VMI: ROM size too big: %x\n", rom->rom_length * 512);
-+ return 0;
-+ }
- if (rom->api_version_maj != VMI_API_REV_MAJOR ||
- rom->api_version_min+1 < VMI_API_REV_MINOR+1) {
- printk(KERN_WARNING "VMI: Found mismatched rom version %d.%d\n",
-@@ -562,7 +584,7 @@ static inline int __init probe_vmi_rom(v
- struct vrom_header *romstart;
- romstart = (struct vrom_header *)isa_bus_to_virt(base);
- if (check_vmi_rom(romstart)) {
-- vmi_rom = romstart;
-+ vmi_rom = *romstart;
- return 1;
- }
- }
-@@ -836,6 +858,11 @@ static inline int __init activate_vmi(vo
-
- para_fill(pv_irq_ops.safe_halt, Halt);
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+ pv_mmu_ops.pax_open_kernel = vmi_pax_open_kernel;
-+ pv_mmu_ops.pax_close_kernel = vmi_pax_close_kernel;
-+#endif
-+
- /*
- * Alternative instruction rewriting doesn't happen soon enough
- * to convert VMI_IRET to a call instead of a jump; so we have
-@@ -853,16 +880,16 @@ static inline int __init activate_vmi(vo
-
- void __init vmi_init(void)
- {
-- if (!vmi_rom)
-+ if (!vmi_rom.rom_signature)
- probe_vmi_rom();
- else
-- check_vmi_rom(vmi_rom);
-+ check_vmi_rom(&vmi_rom);
-
- /* In case probing for or validating the ROM failed, basil */
-- if (!vmi_rom)
-+ if (!vmi_rom.rom_signature)
- return;
-
-- reserve_top_address(-vmi_rom->virtual_top);
-+ reserve_top_address(-vmi_rom.virtual_top);
-
- #ifdef CONFIG_X86_IO_APIC
- /* This is virtual hardware; timer routing is wired correctly */
-@@ -874,7 +901,7 @@ void __init vmi_activate(void)
- {
- unsigned long flags;
-
-- if (!vmi_rom)
-+ if (!vmi_rom.rom_signature)
- return;
-
- local_irq_save(flags);
-diff -urNp linux-2.6.32.45/arch/x86/kernel/vmlinux.lds.S linux-2.6.32.45/arch/x86/kernel/vmlinux.lds.S
---- linux-2.6.32.45/arch/x86/kernel/vmlinux.lds.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/vmlinux.lds.S 2011-04-17 15:56:46.000000000 -0400
-@@ -26,6 +26,13 @@
- #include <asm/page_types.h>
- #include <asm/cache.h>
- #include <asm/boot.h>
-+#include <asm/segment.h>
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+#define __KERNEL_TEXT_OFFSET (LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR)
-+#else
-+#define __KERNEL_TEXT_OFFSET 0
-+#endif
-
- #undef i386 /* in case the preprocessor is a 32bit one */
-
-@@ -34,40 +41,53 @@ OUTPUT_FORMAT(CONFIG_OUTPUT_FORMAT, CONF
- #ifdef CONFIG_X86_32
- OUTPUT_ARCH(i386)
- ENTRY(phys_startup_32)
--jiffies = jiffies_64;
- #else
- OUTPUT_ARCH(i386:x86-64)
- ENTRY(phys_startup_64)
--jiffies_64 = jiffies;
- #endif
-
- PHDRS {
- text PT_LOAD FLAGS(5); /* R_E */
-- data PT_LOAD FLAGS(7); /* RWE */
-+#ifdef CONFIG_X86_32
-+ module PT_LOAD FLAGS(5); /* R_E */
-+#endif
-+#ifdef CONFIG_XEN
-+ rodata PT_LOAD FLAGS(5); /* R_E */
-+#else
-+ rodata PT_LOAD FLAGS(4); /* R__ */
-+#endif
-+ data PT_LOAD FLAGS(6); /* RW_ */
- #ifdef CONFIG_X86_64
- user PT_LOAD FLAGS(5); /* R_E */
-+#endif
-+ init.begin PT_LOAD FLAGS(6); /* RW_ */
- #ifdef CONFIG_SMP
- percpu PT_LOAD FLAGS(6); /* RW_ */
- #endif
-+ text.init PT_LOAD FLAGS(5); /* R_E */
-+ text.exit PT_LOAD FLAGS(5); /* R_E */
- init PT_LOAD FLAGS(7); /* RWE */
--#endif
- note PT_NOTE FLAGS(0); /* ___ */
- }
-
- SECTIONS
- {
- #ifdef CONFIG_X86_32
-- . = LOAD_OFFSET + LOAD_PHYSICAL_ADDR;
-- phys_startup_32 = startup_32 - LOAD_OFFSET;
-+ . = LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR;
- #else
-- . = __START_KERNEL;
-- phys_startup_64 = startup_64 - LOAD_OFFSET;
-+ . = __START_KERNEL;
- #endif
-
- /* Text and read-only data */
-- .text : AT(ADDR(.text) - LOAD_OFFSET) {
-- _text = .;
-+ .text (. - __KERNEL_TEXT_OFFSET): AT(ADDR(.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
- /* bootstrapping code */
-+#ifdef CONFIG_X86_32
-+ phys_startup_32 = startup_32 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
-+#else
-+ phys_startup_64 = startup_64 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
-+#endif
-+ __LOAD_PHYSICAL_ADDR = . - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
-+ _text = .;
- HEAD_TEXT
- #ifdef CONFIG_X86_32
- . = ALIGN(PAGE_SIZE);
-@@ -82,28 +102,71 @@ SECTIONS
- IRQENTRY_TEXT
- *(.fixup)
- *(.gnu.warning)
-- /* End of text section */
-- _etext = .;
- } :text = 0x9090
-
-- NOTES :text :note
-+ . += __KERNEL_TEXT_OFFSET;
-+
-+#ifdef CONFIG_X86_32
-+ . = ALIGN(PAGE_SIZE);
-+ .vmi.rom : AT(ADDR(.vmi.rom) - LOAD_OFFSET) {
-+ *(.vmi.rom)
-+ } :module
-+
-+ . = ALIGN(PAGE_SIZE);
-+ .module.text : AT(ADDR(.module.text) - LOAD_OFFSET) {
-+
-+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_MODULES)
-+ MODULES_EXEC_VADDR = .;
-+ BYTE(0)
-+ . += (CONFIG_PAX_KERNEXEC_MODULE_TEXT * 1024 * 1024);
-+ . = ALIGN(HPAGE_SIZE);
-+ MODULES_EXEC_END = . - 1;
-+#endif
-+
-+ } :module
-+#endif
-
-- EXCEPTION_TABLE(16) :text = 0x9090
-+ .text.end : AT(ADDR(.text.end) - LOAD_OFFSET) {
-+ /* End of text section */
-+ _etext = . - __KERNEL_TEXT_OFFSET;
-+ }
-+
-+#ifdef CONFIG_X86_32
-+ . = ALIGN(PAGE_SIZE);
-+ .rodata.page_aligned : AT(ADDR(.rodata.page_aligned) - LOAD_OFFSET) {
-+ *(.idt)
-+ . = ALIGN(PAGE_SIZE);
-+ *(.empty_zero_page)
-+ *(.swapper_pg_fixmap)
-+ *(.swapper_pg_pmd)
-+ *(.swapper_pg_dir)
-+ *(.trampoline_pg_dir)
-+ } :rodata
-+#endif
-+
-+ . = ALIGN(PAGE_SIZE);
-+ NOTES :rodata :note
-+
-+ EXCEPTION_TABLE(16) :rodata
-
- RO_DATA(PAGE_SIZE)
-
- /* Data */
- .data : AT(ADDR(.data) - LOAD_OFFSET) {
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ . = ALIGN(HPAGE_SIZE);
-+#else
-+ . = ALIGN(PAGE_SIZE);
-+#endif
-+
- /* Start of data section */
- _sdata = .;
-
- /* init_task */
- INIT_TASK_DATA(THREAD_SIZE)
-
--#ifdef CONFIG_X86_32
-- /* 32 bit has nosave before _edata */
- NOSAVE_DATA
--#endif
-
- PAGE_ALIGNED_DATA(PAGE_SIZE)
-
-@@ -112,6 +175,8 @@ SECTIONS
- DATA_DATA
- CONSTRUCTORS
-
-+ jiffies = jiffies_64;
-+
- /* rarely changed data like cpu maps */
- READ_MOSTLY_DATA(CONFIG_X86_INTERNODE_CACHE_BYTES)
-
-@@ -166,12 +231,6 @@ SECTIONS
- }
- vgetcpu_mode = VVIRT(.vgetcpu_mode);
-
-- . = ALIGN(CONFIG_X86_L1_CACHE_BYTES);
-- .jiffies : AT(VLOAD(.jiffies)) {
-- *(.jiffies)
-- }
-- jiffies = VVIRT(.jiffies);
--
- .vsyscall_3 ADDR(.vsyscall_0) + 3072: AT(VLOAD(.vsyscall_3)) {
- *(.vsyscall_3)
- }
-@@ -187,12 +246,19 @@ SECTIONS
- #endif /* CONFIG_X86_64 */
-
- /* Init code and data - will be freed after init */
-- . = ALIGN(PAGE_SIZE);
- .init.begin : AT(ADDR(.init.begin) - LOAD_OFFSET) {
-+ BYTE(0)
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ . = ALIGN(HPAGE_SIZE);
-+#else
-+ . = ALIGN(PAGE_SIZE);
-+#endif
-+
- __init_begin = .; /* paired with __init_end */
-- }
-+ } :init.begin
-
--#if defined(CONFIG_X86_64) && defined(CONFIG_SMP)
-+#ifdef CONFIG_SMP
- /*
- * percpu offsets are zero-based on SMP. PERCPU_VADDR() changes the
- * output PHDR, so the next output section - .init.text - should
-@@ -201,12 +267,27 @@ SECTIONS
- PERCPU_VADDR(0, :percpu)
- #endif
-
-- INIT_TEXT_SECTION(PAGE_SIZE)
--#ifdef CONFIG_X86_64
-- :init
--#endif
-+ . = ALIGN(PAGE_SIZE);
-+ init_begin = .;
-+ .init.text (. - __KERNEL_TEXT_OFFSET): AT(init_begin - LOAD_OFFSET) {
-+ VMLINUX_SYMBOL(_sinittext) = .;
-+ INIT_TEXT
-+ VMLINUX_SYMBOL(_einittext) = .;
-+ . = ALIGN(PAGE_SIZE);
-+ } :text.init
-
-- INIT_DATA_SECTION(16)
-+ /*
-+ * .exit.text is discard at runtime, not link time, to deal with
-+ * references from .altinstructions and .eh_frame
-+ */
-+ .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
-+ EXIT_TEXT
-+ . = ALIGN(16);
-+ } :text.exit
-+ . = init_begin + SIZEOF(.init.text) + SIZEOF(.exit.text);
-+
-+ . = ALIGN(PAGE_SIZE);
-+ INIT_DATA_SECTION(16) :init
-
- .x86_cpu_dev.init : AT(ADDR(.x86_cpu_dev.init) - LOAD_OFFSET) {
- __x86_cpu_dev_start = .;
-@@ -232,19 +313,11 @@ SECTIONS
- *(.altinstr_replacement)
- }
-
-- /*
-- * .exit.text is discard at runtime, not link time, to deal with
-- * references from .altinstructions and .eh_frame
-- */
-- .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
-- EXIT_TEXT
-- }
--
- .exit.data : AT(ADDR(.exit.data) - LOAD_OFFSET) {
- EXIT_DATA
- }
-
--#if !defined(CONFIG_X86_64) || !defined(CONFIG_SMP)
-+#ifndef CONFIG_SMP
- PERCPU(PAGE_SIZE)
- #endif
-
-@@ -267,12 +340,6 @@ SECTIONS
- . = ALIGN(PAGE_SIZE);
- }
-
--#ifdef CONFIG_X86_64
-- .data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) {
-- NOSAVE_DATA
-- }
--#endif
--
- /* BSS */
- . = ALIGN(PAGE_SIZE);
- .bss : AT(ADDR(.bss) - LOAD_OFFSET) {
-@@ -288,6 +355,7 @@ SECTIONS
- __brk_base = .;
- . += 64 * 1024; /* 64k alignment slop space */
- *(.brk_reservation) /* areas brk users have reserved */
-+ . = ALIGN(HPAGE_SIZE);
- __brk_limit = .;
- }
-
-@@ -316,13 +384,12 @@ SECTIONS
- * for the boot processor.
- */
- #define INIT_PER_CPU(x) init_per_cpu__##x = per_cpu__##x + __per_cpu_load
--INIT_PER_CPU(gdt_page);
- INIT_PER_CPU(irq_stack_union);
-
- /*
- * Build-time check on the image size:
- */
--. = ASSERT((_end - _text <= KERNEL_IMAGE_SIZE),
-+. = ASSERT((_end - _text - __KERNEL_TEXT_OFFSET <= KERNEL_IMAGE_SIZE),
- "kernel image bigger than KERNEL_IMAGE_SIZE");
-
- #ifdef CONFIG_SMP
-diff -urNp linux-2.6.32.45/arch/x86/kernel/vsyscall_64.c linux-2.6.32.45/arch/x86/kernel/vsyscall_64.c
---- linux-2.6.32.45/arch/x86/kernel/vsyscall_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/vsyscall_64.c 2011-04-23 12:56:10.000000000 -0400
-@@ -80,6 +80,7 @@ void update_vsyscall(struct timespec *wa
-
- write_seqlock_irqsave(&vsyscall_gtod_data.lock, flags);
- /* copy vsyscall data */
-+ strlcpy(vsyscall_gtod_data.clock.name, clock->name, sizeof vsyscall_gtod_data.clock.name);
- vsyscall_gtod_data.clock.vread = clock->vread;
- vsyscall_gtod_data.clock.cycle_last = clock->cycle_last;
- vsyscall_gtod_data.clock.mask = clock->mask;
-@@ -203,7 +204,7 @@ vgetcpu(unsigned *cpu, unsigned *node, s
- We do this here because otherwise user space would do it on
- its own in a likely inferior way (no access to jiffies).
- If you don't like it pass NULL. */
-- if (tcache && tcache->blob[0] == (j = __jiffies)) {
-+ if (tcache && tcache->blob[0] == (j = jiffies)) {
- p = tcache->blob[1];
- } else if (__vgetcpu_mode == VGETCPU_RDTSCP) {
- /* Load per CPU data from RDTSCP */
-diff -urNp linux-2.6.32.45/arch/x86/kernel/x8664_ksyms_64.c linux-2.6.32.45/arch/x86/kernel/x8664_ksyms_64.c
---- linux-2.6.32.45/arch/x86/kernel/x8664_ksyms_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/x8664_ksyms_64.c 2011-04-17 15:56:46.000000000 -0400
-@@ -30,8 +30,6 @@ EXPORT_SYMBOL(__put_user_8);
-
- EXPORT_SYMBOL(copy_user_generic);
- EXPORT_SYMBOL(__copy_user_nocache);
--EXPORT_SYMBOL(copy_from_user);
--EXPORT_SYMBOL(copy_to_user);
- EXPORT_SYMBOL(__copy_from_user_inatomic);
-
- EXPORT_SYMBOL(copy_page);
-diff -urNp linux-2.6.32.45/arch/x86/kernel/xsave.c linux-2.6.32.45/arch/x86/kernel/xsave.c
---- linux-2.6.32.45/arch/x86/kernel/xsave.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kernel/xsave.c 2011-04-17 15:56:46.000000000 -0400
-@@ -54,7 +54,7 @@ int check_for_xstate(struct i387_fxsave_
- fx_sw_user->xstate_size > fx_sw_user->extended_size)
- return -1;
-
-- err = __get_user(magic2, (__u32 *) (((void *)fpstate) +
-+ err = __get_user(magic2, (__u32 __user *) (((void __user *)fpstate) +
- fx_sw_user->extended_size -
- FP_XSTATE_MAGIC2_SIZE));
- /*
-@@ -196,7 +196,7 @@ fx_only:
- * the other extended state.
- */
- xrstor_state(init_xstate_buf, pcntxt_mask & ~XSTATE_FPSSE);
-- return fxrstor_checking((__force struct i387_fxsave_struct *)buf);
-+ return fxrstor_checking((struct i387_fxsave_struct __user *)buf);
- }
-
- /*
-@@ -228,7 +228,7 @@ int restore_i387_xstate(void __user *buf
- if (task_thread_info(tsk)->status & TS_XSAVE)
- err = restore_user_xstate(buf);
- else
-- err = fxrstor_checking((__force struct i387_fxsave_struct *)
-+ err = fxrstor_checking((struct i387_fxsave_struct __user *)
- buf);
- if (unlikely(err)) {
- /*
-diff -urNp linux-2.6.32.45/arch/x86/kvm/emulate.c linux-2.6.32.45/arch/x86/kvm/emulate.c
---- linux-2.6.32.45/arch/x86/kvm/emulate.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kvm/emulate.c 2011-04-17 15:56:46.000000000 -0400
-@@ -81,8 +81,8 @@
- #define Src2CL (1<<29)
- #define Src2ImmByte (2<<29)
- #define Src2One (3<<29)
--#define Src2Imm16 (4<<29)
--#define Src2Mask (7<<29)
-+#define Src2Imm16 (4U<<29)
-+#define Src2Mask (7U<<29)
-
- enum {
- Group1_80, Group1_81, Group1_82, Group1_83,
-@@ -411,6 +411,7 @@ static u32 group2_table[] = {
-
- #define ____emulate_2op(_op, _src, _dst, _eflags, _x, _y, _suffix) \
- do { \
-+ unsigned long _tmp; \
- __asm__ __volatile__ ( \
- _PRE_EFLAGS("0", "4", "2") \
- _op _suffix " %"_x"3,%1; " \
-@@ -424,8 +425,6 @@ static u32 group2_table[] = {
- /* Raw emulation: instruction has two explicit operands. */
- #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
- do { \
-- unsigned long _tmp; \
-- \
- switch ((_dst).bytes) { \
- case 2: \
- ____emulate_2op(_op,_src,_dst,_eflags,_wx,_wy,"w"); \
-@@ -441,7 +440,6 @@ static u32 group2_table[] = {
-
- #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
- do { \
-- unsigned long _tmp; \
- switch ((_dst).bytes) { \
- case 1: \
- ____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b"); \
-diff -urNp linux-2.6.32.45/arch/x86/kvm/lapic.c linux-2.6.32.45/arch/x86/kvm/lapic.c
---- linux-2.6.32.45/arch/x86/kvm/lapic.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kvm/lapic.c 2011-04-17 15:56:46.000000000 -0400
-@@ -52,7 +52,7 @@
- #define APIC_BUS_CYCLE_NS 1
-
- /* #define apic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg) */
--#define apic_debug(fmt, arg...)
-+#define apic_debug(fmt, arg...) do {} while (0)
-
- #define APIC_LVT_NUM 6
- /* 14 is the version for Xeon and Pentium 8.4.8*/
-diff -urNp linux-2.6.32.45/arch/x86/kvm/paging_tmpl.h linux-2.6.32.45/arch/x86/kvm/paging_tmpl.h
---- linux-2.6.32.45/arch/x86/kvm/paging_tmpl.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kvm/paging_tmpl.h 2011-05-16 21:46:57.000000000 -0400
-@@ -416,6 +416,8 @@ static int FNAME(page_fault)(struct kvm_
- int level = PT_PAGE_TABLE_LEVEL;
- unsigned long mmu_seq;
-
-+ pax_track_stack();
-+
- pgprintk("%s: addr %lx err %x\n", __func__, addr, error_code);
- kvm_mmu_audit(vcpu, "pre page fault");
-
-diff -urNp linux-2.6.32.45/arch/x86/kvm/svm.c linux-2.6.32.45/arch/x86/kvm/svm.c
---- linux-2.6.32.45/arch/x86/kvm/svm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kvm/svm.c 2011-08-05 20:33:55.000000000 -0400
-@@ -2485,7 +2485,11 @@ static void reload_tss(struct kvm_vcpu *
- int cpu = raw_smp_processor_id();
-
- struct svm_cpu_data *svm_data = per_cpu(svm_data, cpu);
-+
-+ pax_open_kernel();
- svm_data->tss_desc->type = 9; /* available 32/64-bit TSS */
-+ pax_close_kernel();
-+
- load_TR_desc();
- }
-
-@@ -2946,7 +2950,7 @@ static bool svm_gb_page_enable(void)
- return true;
- }
-
--static struct kvm_x86_ops svm_x86_ops = {
-+static const struct kvm_x86_ops svm_x86_ops = {
- .cpu_has_kvm_support = has_svm,
- .disabled_by_bios = is_disabled,
- .hardware_setup = svm_hardware_setup,
-diff -urNp linux-2.6.32.45/arch/x86/kvm/vmx.c linux-2.6.32.45/arch/x86/kvm/vmx.c
---- linux-2.6.32.45/arch/x86/kvm/vmx.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kvm/vmx.c 2011-05-04 17:56:20.000000000 -0400
-@@ -570,7 +570,11 @@ static void reload_tss(void)
-
- kvm_get_gdt(&gdt);
- descs = (void *)gdt.base;
-+
-+ pax_open_kernel();
- descs[GDT_ENTRY_TSS].type = 9; /* available TSS */
-+ pax_close_kernel();
-+
- load_TR_desc();
- }
-
-@@ -1409,8 +1413,11 @@ static __init int hardware_setup(void)
- if (!cpu_has_vmx_flexpriority())
- flexpriority_enabled = 0;
-
-- if (!cpu_has_vmx_tpr_shadow())
-- kvm_x86_ops->update_cr8_intercept = NULL;
-+ if (!cpu_has_vmx_tpr_shadow()) {
-+ pax_open_kernel();
-+ *(void **)&kvm_x86_ops->update_cr8_intercept = NULL;
-+ pax_close_kernel();
-+ }
-
- if (enable_ept && !cpu_has_vmx_ept_2m_page())
- kvm_disable_largepages();
-@@ -2361,7 +2368,7 @@ static int vmx_vcpu_setup(struct vcpu_vm
- vmcs_writel(HOST_IDTR_BASE, dt.base); /* 22.2.4 */
-
- asm("mov $.Lkvm_vmx_return, %0" : "=r"(kvm_vmx_return));
-- vmcs_writel(HOST_RIP, kvm_vmx_return); /* 22.2.5 */
-+ vmcs_writel(HOST_RIP, ktla_ktva(kvm_vmx_return)); /* 22.2.5 */
- vmcs_write32(VM_EXIT_MSR_STORE_COUNT, 0);
- vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, 0);
- vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, 0);
-@@ -3717,6 +3724,12 @@ static void vmx_vcpu_run(struct kvm_vcpu
- "jmp .Lkvm_vmx_return \n\t"
- ".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t"
- ".Lkvm_vmx_return: "
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ "ljmp %[cs],$.Lkvm_vmx_return2\n\t"
-+ ".Lkvm_vmx_return2: "
-+#endif
-+
- /* Save guest registers, load host registers, keep flags */
- "xchg %0, (%%"R"sp) \n\t"
- "mov %%"R"ax, %c[rax](%0) \n\t"
-@@ -3763,8 +3776,13 @@ static void vmx_vcpu_run(struct kvm_vcpu
- [r15]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R15])),
- #endif
- [cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2))
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ ,[cs]"i"(__KERNEL_CS)
-+#endif
-+
- : "cc", "memory"
-- , R"bx", R"di", R"si"
-+ , R"ax", R"bx", R"di", R"si"
- #ifdef CONFIG_X86_64
- , "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15"
- #endif
-@@ -3781,7 +3799,16 @@ static void vmx_vcpu_run(struct kvm_vcpu
- if (vmx->rmode.irq.pending)
- fixup_rmode_irq(vmx);
-
-- asm("mov %0, %%ds; mov %0, %%es" : : "r"(__USER_DS));
-+ asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r"(__KERNEL_DS));
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ loadsegment(fs, __KERNEL_PERCPU);
-+#endif
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ __set_fs(current_thread_info()->addr_limit);
-+#endif
-+
- vmx->launched = 1;
-
- vmx_complete_interrupts(vmx);
-@@ -3956,7 +3983,7 @@ static bool vmx_gb_page_enable(void)
- return false;
- }
-
--static struct kvm_x86_ops vmx_x86_ops = {
-+static const struct kvm_x86_ops vmx_x86_ops = {
- .cpu_has_kvm_support = cpu_has_kvm_support,
- .disabled_by_bios = vmx_disabled_by_bios,
- .hardware_setup = hardware_setup,
-diff -urNp linux-2.6.32.45/arch/x86/kvm/x86.c linux-2.6.32.45/arch/x86/kvm/x86.c
---- linux-2.6.32.45/arch/x86/kvm/x86.c 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/kvm/x86.c 2011-05-10 22:12:26.000000000 -0400
-@@ -82,7 +82,7 @@ static void update_cr8_intercept(struct
- static int kvm_dev_ioctl_get_supported_cpuid(struct kvm_cpuid2 *cpuid,
- struct kvm_cpuid_entry2 __user *entries);
-
--struct kvm_x86_ops *kvm_x86_ops;
-+const struct kvm_x86_ops *kvm_x86_ops;
- EXPORT_SYMBOL_GPL(kvm_x86_ops);
-
- int ignore_msrs = 0;
-@@ -1430,15 +1430,20 @@ static int kvm_vcpu_ioctl_set_cpuid2(str
- struct kvm_cpuid2 *cpuid,
- struct kvm_cpuid_entry2 __user *entries)
- {
-- int r;
-+ int r, i;
-
- r = -E2BIG;
- if (cpuid->nent > KVM_MAX_CPUID_ENTRIES)
- goto out;
- r = -EFAULT;
-- if (copy_from_user(&vcpu->arch.cpuid_entries, entries,
-- cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
-+ if (!access_ok(VERIFY_READ, entries, cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
- goto out;
-+ for (i = 0; i < cpuid->nent; ++i) {
-+ struct kvm_cpuid_entry2 cpuid_entry;
-+ if (__copy_from_user(&cpuid_entry, entries + i, sizeof(cpuid_entry)))
-+ goto out;
-+ vcpu->arch.cpuid_entries[i] = cpuid_entry;
-+ }
- vcpu->arch.cpuid_nent = cpuid->nent;
- kvm_apic_set_version(vcpu);
- return 0;
-@@ -1451,16 +1456,20 @@ static int kvm_vcpu_ioctl_get_cpuid2(str
- struct kvm_cpuid2 *cpuid,
- struct kvm_cpuid_entry2 __user *entries)
- {
-- int r;
-+ int r, i;
-
- vcpu_load(vcpu);
- r = -E2BIG;
- if (cpuid->nent < vcpu->arch.cpuid_nent)
- goto out;
- r = -EFAULT;
-- if (copy_to_user(entries, &vcpu->arch.cpuid_entries,
-- vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
-+ if (!access_ok(VERIFY_WRITE, entries, vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
- goto out;
-+ for (i = 0; i < vcpu->arch.cpuid_nent; ++i) {
-+ struct kvm_cpuid_entry2 cpuid_entry = vcpu->arch.cpuid_entries[i];
-+ if (__copy_to_user(entries + i, &cpuid_entry, sizeof(cpuid_entry)))
-+ goto out;
-+ }
- return 0;
-
- out:
-@@ -1678,7 +1687,7 @@ static int kvm_vcpu_ioctl_set_lapic(stru
- static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
- struct kvm_interrupt *irq)
- {
-- if (irq->irq < 0 || irq->irq >= 256)
-+ if (irq->irq >= 256)
- return -EINVAL;
- if (irqchip_in_kernel(vcpu->kvm))
- return -ENXIO;
-@@ -3260,10 +3269,10 @@ static struct notifier_block kvmclock_cp
- .notifier_call = kvmclock_cpufreq_notifier
- };
-
--int kvm_arch_init(void *opaque)
-+int kvm_arch_init(const void *opaque)
- {
- int r, cpu;
-- struct kvm_x86_ops *ops = (struct kvm_x86_ops *)opaque;
-+ const struct kvm_x86_ops *ops = (const struct kvm_x86_ops *)opaque;
-
- if (kvm_x86_ops) {
- printk(KERN_ERR "kvm: already loaded the other module\n");
-diff -urNp linux-2.6.32.45/arch/x86/lguest/boot.c linux-2.6.32.45/arch/x86/lguest/boot.c
---- linux-2.6.32.45/arch/x86/lguest/boot.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/lguest/boot.c 2011-08-05 20:33:55.000000000 -0400
-@@ -1172,9 +1172,10 @@ static __init int early_put_chars(u32 vt
- * Rebooting also tells the Host we're finished, but the RESTART flag tells the
- * Launcher to reboot us.
- */
--static void lguest_restart(char *reason)
-+static __noreturn void lguest_restart(char *reason)
- {
- kvm_hypercall2(LHCALL_SHUTDOWN, __pa(reason), LGUEST_SHUTDOWN_RESTART);
-+ BUG();
- }
-
- /*G:050
-diff -urNp linux-2.6.32.45/arch/x86/lib/atomic64_32.c linux-2.6.32.45/arch/x86/lib/atomic64_32.c
---- linux-2.6.32.45/arch/x86/lib/atomic64_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/lib/atomic64_32.c 2011-05-04 17:56:28.000000000 -0400
-@@ -25,6 +25,12 @@ u64 atomic64_cmpxchg(atomic64_t *ptr, u6
- }
- EXPORT_SYMBOL(atomic64_cmpxchg);
-
-+u64 atomic64_cmpxchg_unchecked(atomic64_unchecked_t *ptr, u64 old_val, u64 new_val)
-+{
-+ return cmpxchg8b(&ptr->counter, old_val, new_val);
-+}
-+EXPORT_SYMBOL(atomic64_cmpxchg_unchecked);
-+
- /**
- * atomic64_xchg - xchg atomic64 variable
- * @ptr: pointer to type atomic64_t
-@@ -56,6 +62,36 @@ u64 atomic64_xchg(atomic64_t *ptr, u64 n
- EXPORT_SYMBOL(atomic64_xchg);
-
- /**
-+ * atomic64_xchg_unchecked - xchg atomic64 variable
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ * @new_val: value to assign
-+ *
-+ * Atomically xchgs the value of @ptr to @new_val and returns
-+ * the old value.
-+ */
-+u64 atomic64_xchg_unchecked(atomic64_unchecked_t *ptr, u64 new_val)
-+{
-+ /*
-+ * Try first with a (possibly incorrect) assumption about
-+ * what we have there. We'll do two loops most likely,
-+ * but we'll get an ownership MESI transaction straight away
-+ * instead of a read transaction followed by a
-+ * flush-for-ownership transaction:
-+ */
-+ u64 old_val, real_val = 0;
-+
-+ do {
-+ old_val = real_val;
-+
-+ real_val = atomic64_cmpxchg_unchecked(ptr, old_val, new_val);
-+
-+ } while (real_val != old_val);
-+
-+ return old_val;
-+}
-+EXPORT_SYMBOL(atomic64_xchg_unchecked);
-+
-+/**
- * atomic64_set - set atomic64 variable
- * @ptr: pointer to type atomic64_t
- * @new_val: value to assign
-@@ -69,7 +105,19 @@ void atomic64_set(atomic64_t *ptr, u64 n
- EXPORT_SYMBOL(atomic64_set);
-
- /**
--EXPORT_SYMBOL(atomic64_read);
-+ * atomic64_unchecked_set - set atomic64 variable
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ * @new_val: value to assign
-+ *
-+ * Atomically sets the value of @ptr to @new_val.
-+ */
-+void atomic64_set_unchecked(atomic64_unchecked_t *ptr, u64 new_val)
-+{
-+ atomic64_xchg_unchecked(ptr, new_val);
-+}
-+EXPORT_SYMBOL(atomic64_set_unchecked);
-+
-+/**
- * atomic64_add_return - add and return
- * @delta: integer value to add
- * @ptr: pointer to type atomic64_t
-@@ -99,24 +147,72 @@ noinline u64 atomic64_add_return(u64 del
- }
- EXPORT_SYMBOL(atomic64_add_return);
-
-+/**
-+ * atomic64_add_return_unchecked - add and return
-+ * @delta: integer value to add
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically adds @delta to @ptr and returns @delta + *@ptr
-+ */
-+noinline u64 atomic64_add_return_unchecked(u64 delta, atomic64_unchecked_t *ptr)
-+{
-+ /*
-+ * Try first with a (possibly incorrect) assumption about
-+ * what we have there. We'll do two loops most likely,
-+ * but we'll get an ownership MESI transaction straight away
-+ * instead of a read transaction followed by a
-+ * flush-for-ownership transaction:
-+ */
-+ u64 old_val, new_val, real_val = 0;
-+
-+ do {
-+ old_val = real_val;
-+ new_val = old_val + delta;
-+
-+ real_val = atomic64_cmpxchg_unchecked(ptr, old_val, new_val);
-+
-+ } while (real_val != old_val);
-+
-+ return new_val;
-+}
-+EXPORT_SYMBOL(atomic64_add_return_unchecked);
-+
- u64 atomic64_sub_return(u64 delta, atomic64_t *ptr)
- {
- return atomic64_add_return(-delta, ptr);
- }
- EXPORT_SYMBOL(atomic64_sub_return);
-
-+u64 atomic64_sub_return_unchecked(u64 delta, atomic64_unchecked_t *ptr)
-+{
-+ return atomic64_add_return_unchecked(-delta, ptr);
-+}
-+EXPORT_SYMBOL(atomic64_sub_return_unchecked);
-+
- u64 atomic64_inc_return(atomic64_t *ptr)
- {
- return atomic64_add_return(1, ptr);
- }
- EXPORT_SYMBOL(atomic64_inc_return);
-
-+u64 atomic64_inc_return_unchecked(atomic64_unchecked_t *ptr)
-+{
-+ return atomic64_add_return_unchecked(1, ptr);
-+}
-+EXPORT_SYMBOL(atomic64_inc_return_unchecked);
-+
- u64 atomic64_dec_return(atomic64_t *ptr)
- {
- return atomic64_sub_return(1, ptr);
- }
- EXPORT_SYMBOL(atomic64_dec_return);
-
-+u64 atomic64_dec_return_unchecked(atomic64_unchecked_t *ptr)
-+{
-+ return atomic64_sub_return_unchecked(1, ptr);
-+}
-+EXPORT_SYMBOL(atomic64_dec_return_unchecked);
-+
- /**
- * atomic64_add - add integer to atomic64 variable
- * @delta: integer value to add
-@@ -131,6 +227,19 @@ void atomic64_add(u64 delta, atomic64_t
- EXPORT_SYMBOL(atomic64_add);
-
- /**
-+ * atomic64_add_unchecked - add integer to atomic64 variable
-+ * @delta: integer value to add
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically adds @delta to @ptr.
-+ */
-+void atomic64_add_unchecked(u64 delta, atomic64_unchecked_t *ptr)
-+{
-+ atomic64_add_return_unchecked(delta, ptr);
-+}
-+EXPORT_SYMBOL(atomic64_add_unchecked);
-+
-+/**
- * atomic64_sub - subtract the atomic64 variable
- * @delta: integer value to subtract
- * @ptr: pointer to type atomic64_t
-@@ -144,6 +253,19 @@ void atomic64_sub(u64 delta, atomic64_t
- EXPORT_SYMBOL(atomic64_sub);
-
- /**
-+ * atomic64_sub_unchecked - subtract the atomic64 variable
-+ * @delta: integer value to subtract
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically subtracts @delta from @ptr.
-+ */
-+void atomic64_sub_unchecked(u64 delta, atomic64_unchecked_t *ptr)
-+{
-+ atomic64_add_unchecked(-delta, ptr);
-+}
-+EXPORT_SYMBOL(atomic64_sub_unchecked);
-+
-+/**
- * atomic64_sub_and_test - subtract value from variable and test result
- * @delta: integer value to subtract
- * @ptr: pointer to type atomic64_t
-@@ -173,6 +295,18 @@ void atomic64_inc(atomic64_t *ptr)
- EXPORT_SYMBOL(atomic64_inc);
-
- /**
-+ * atomic64_inc_unchecked - increment atomic64 variable
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically increments @ptr by 1.
-+ */
-+void atomic64_inc_unchecked(atomic64_unchecked_t *ptr)
-+{
-+ atomic64_add_unchecked(1, ptr);
-+}
-+EXPORT_SYMBOL(atomic64_inc_unchecked);
-+
-+/**
- * atomic64_dec - decrement atomic64 variable
- * @ptr: pointer to type atomic64_t
- *
-@@ -185,6 +319,18 @@ void atomic64_dec(atomic64_t *ptr)
- EXPORT_SYMBOL(atomic64_dec);
-
- /**
-+ * atomic64_dec_unchecked - decrement atomic64 variable
-+ * @ptr: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically decrements @ptr by 1.
-+ */
-+void atomic64_dec_unchecked(atomic64_unchecked_t *ptr)
-+{
-+ atomic64_sub_unchecked(1, ptr);
-+}
-+EXPORT_SYMBOL(atomic64_dec_unchecked);
-+
-+/**
- * atomic64_dec_and_test - decrement and test
- * @ptr: pointer to type atomic64_t
- *
-diff -urNp linux-2.6.32.45/arch/x86/lib/checksum_32.S linux-2.6.32.45/arch/x86/lib/checksum_32.S
---- linux-2.6.32.45/arch/x86/lib/checksum_32.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/lib/checksum_32.S 2011-04-17 15:56:46.000000000 -0400
-@@ -28,7 +28,8 @@
- #include <linux/linkage.h>
- #include <asm/dwarf2.h>
- #include <asm/errno.h>
--
-+#include <asm/segment.h>
-+
- /*
- * computes a partial checksum, e.g. for TCP/UDP fragments
- */
-@@ -304,9 +305,28 @@ unsigned int csum_partial_copy_generic (
-
- #define ARGBASE 16
- #define FP 12
--
--ENTRY(csum_partial_copy_generic)
-+
-+ENTRY(csum_partial_copy_generic_to_user)
- CFI_STARTPROC
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ pushl %gs
-+ CFI_ADJUST_CFA_OFFSET 4
-+ popl %es
-+ CFI_ADJUST_CFA_OFFSET -4
-+ jmp csum_partial_copy_generic
-+#endif
-+
-+ENTRY(csum_partial_copy_generic_from_user)
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ pushl %gs
-+ CFI_ADJUST_CFA_OFFSET 4
-+ popl %ds
-+ CFI_ADJUST_CFA_OFFSET -4
-+#endif
-+
-+ENTRY(csum_partial_copy_generic)
- subl $4,%esp
- CFI_ADJUST_CFA_OFFSET 4
- pushl %edi
-@@ -331,7 +351,7 @@ ENTRY(csum_partial_copy_generic)
- jmp 4f
- SRC(1: movw (%esi), %bx )
- addl $2, %esi
--DST( movw %bx, (%edi) )
-+DST( movw %bx, %es:(%edi) )
- addl $2, %edi
- addw %bx, %ax
- adcl $0, %eax
-@@ -343,30 +363,30 @@ DST( movw %bx, (%edi) )
- SRC(1: movl (%esi), %ebx )
- SRC( movl 4(%esi), %edx )
- adcl %ebx, %eax
--DST( movl %ebx, (%edi) )
-+DST( movl %ebx, %es:(%edi) )
- adcl %edx, %eax
--DST( movl %edx, 4(%edi) )
-+DST( movl %edx, %es:4(%edi) )
-
- SRC( movl 8(%esi), %ebx )
- SRC( movl 12(%esi), %edx )
- adcl %ebx, %eax
--DST( movl %ebx, 8(%edi) )
-+DST( movl %ebx, %es:8(%edi) )
- adcl %edx, %eax
--DST( movl %edx, 12(%edi) )
-+DST( movl %edx, %es:12(%edi) )
-
- SRC( movl 16(%esi), %ebx )
- SRC( movl 20(%esi), %edx )
- adcl %ebx, %eax
--DST( movl %ebx, 16(%edi) )
-+DST( movl %ebx, %es:16(%edi) )
- adcl %edx, %eax
--DST( movl %edx, 20(%edi) )
-+DST( movl %edx, %es:20(%edi) )
-
- SRC( movl 24(%esi), %ebx )
- SRC( movl 28(%esi), %edx )
- adcl %ebx, %eax
--DST( movl %ebx, 24(%edi) )
-+DST( movl %ebx, %es:24(%edi) )
- adcl %edx, %eax
--DST( movl %edx, 28(%edi) )
-+DST( movl %edx, %es:28(%edi) )
-
- lea 32(%esi), %esi
- lea 32(%edi), %edi
-@@ -380,7 +400,7 @@ DST( movl %edx, 28(%edi) )
- shrl $2, %edx # This clears CF
- SRC(3: movl (%esi), %ebx )
- adcl %ebx, %eax
--DST( movl %ebx, (%edi) )
-+DST( movl %ebx, %es:(%edi) )
- lea 4(%esi), %esi
- lea 4(%edi), %edi
- dec %edx
-@@ -392,12 +412,12 @@ DST( movl %ebx, (%edi) )
- jb 5f
- SRC( movw (%esi), %cx )
- leal 2(%esi), %esi
--DST( movw %cx, (%edi) )
-+DST( movw %cx, %es:(%edi) )
- leal 2(%edi), %edi
- je 6f
- shll $16,%ecx
- SRC(5: movb (%esi), %cl )
--DST( movb %cl, (%edi) )
-+DST( movb %cl, %es:(%edi) )
- 6: addl %ecx, %eax
- adcl $0, %eax
- 7:
-@@ -408,7 +428,7 @@ DST( movb %cl, (%edi) )
-
- 6001:
- movl ARGBASE+20(%esp), %ebx # src_err_ptr
-- movl $-EFAULT, (%ebx)
-+ movl $-EFAULT, %ss:(%ebx)
-
- # zero the complete destination - computing the rest
- # is too much work
-@@ -421,11 +441,19 @@ DST( movb %cl, (%edi) )
-
- 6002:
- movl ARGBASE+24(%esp), %ebx # dst_err_ptr
-- movl $-EFAULT,(%ebx)
-+ movl $-EFAULT,%ss:(%ebx)
- jmp 5000b
-
- .previous
-
-+ pushl %ss
-+ CFI_ADJUST_CFA_OFFSET 4
-+ popl %ds
-+ CFI_ADJUST_CFA_OFFSET -4
-+ pushl %ss
-+ CFI_ADJUST_CFA_OFFSET 4
-+ popl %es
-+ CFI_ADJUST_CFA_OFFSET -4
- popl %ebx
- CFI_ADJUST_CFA_OFFSET -4
- CFI_RESTORE ebx
-@@ -439,26 +467,47 @@ DST( movb %cl, (%edi) )
- CFI_ADJUST_CFA_OFFSET -4
- ret
- CFI_ENDPROC
--ENDPROC(csum_partial_copy_generic)
-+ENDPROC(csum_partial_copy_generic_to_user)
-
- #else
-
- /* Version for PentiumII/PPro */
-
- #define ROUND1(x) \
-+ nop; nop; nop; \
- SRC(movl x(%esi), %ebx ) ; \
- addl %ebx, %eax ; \
-- DST(movl %ebx, x(%edi) ) ;
-+ DST(movl %ebx, %es:x(%edi)) ;
-
- #define ROUND(x) \
-+ nop; nop; nop; \
- SRC(movl x(%esi), %ebx ) ; \
- adcl %ebx, %eax ; \
-- DST(movl %ebx, x(%edi) ) ;
-+ DST(movl %ebx, %es:x(%edi)) ;
-
- #define ARGBASE 12
--
--ENTRY(csum_partial_copy_generic)
-+
-+ENTRY(csum_partial_copy_generic_to_user)
- CFI_STARTPROC
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ pushl %gs
-+ CFI_ADJUST_CFA_OFFSET 4
-+ popl %es
-+ CFI_ADJUST_CFA_OFFSET -4
-+ jmp csum_partial_copy_generic
-+#endif
-+
-+ENTRY(csum_partial_copy_generic_from_user)
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ pushl %gs
-+ CFI_ADJUST_CFA_OFFSET 4
-+ popl %ds
-+ CFI_ADJUST_CFA_OFFSET -4
-+#endif
-+
-+ENTRY(csum_partial_copy_generic)
- pushl %ebx
- CFI_ADJUST_CFA_OFFSET 4
- CFI_REL_OFFSET ebx, 0
-@@ -482,7 +531,7 @@ ENTRY(csum_partial_copy_generic)
- subl %ebx, %edi
- lea -1(%esi),%edx
- andl $-32,%edx
-- lea 3f(%ebx,%ebx), %ebx
-+ lea 3f(%ebx,%ebx,2), %ebx
- testl %esi, %esi
- jmp *%ebx
- 1: addl $64,%esi
-@@ -503,19 +552,19 @@ ENTRY(csum_partial_copy_generic)
- jb 5f
- SRC( movw (%esi), %dx )
- leal 2(%esi), %esi
--DST( movw %dx, (%edi) )
-+DST( movw %dx, %es:(%edi) )
- leal 2(%edi), %edi
- je 6f
- shll $16,%edx
- 5:
- SRC( movb (%esi), %dl )
--DST( movb %dl, (%edi) )
-+DST( movb %dl, %es:(%edi) )
- 6: addl %edx, %eax
- adcl $0, %eax
- 7:
- .section .fixup, "ax"
- 6001: movl ARGBASE+20(%esp), %ebx # src_err_ptr
-- movl $-EFAULT, (%ebx)
-+ movl $-EFAULT, %ss:(%ebx)
- # zero the complete destination (computing the rest is too much work)
- movl ARGBASE+8(%esp),%edi # dst
- movl ARGBASE+12(%esp),%ecx # len
-@@ -523,10 +572,21 @@ DST( movb %dl, (%edi) )
- rep; stosb
- jmp 7b
- 6002: movl ARGBASE+24(%esp), %ebx # dst_err_ptr
-- movl $-EFAULT, (%ebx)
-+ movl $-EFAULT, %ss:(%ebx)
- jmp 7b
- .previous
-
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ pushl %ss
-+ CFI_ADJUST_CFA_OFFSET 4
-+ popl %ds
-+ CFI_ADJUST_CFA_OFFSET -4
-+ pushl %ss
-+ CFI_ADJUST_CFA_OFFSET 4
-+ popl %es
-+ CFI_ADJUST_CFA_OFFSET -4
-+#endif
-+
- popl %esi
- CFI_ADJUST_CFA_OFFSET -4
- CFI_RESTORE esi
-@@ -538,7 +598,7 @@ DST( movb %dl, (%edi) )
- CFI_RESTORE ebx
- ret
- CFI_ENDPROC
--ENDPROC(csum_partial_copy_generic)
-+ENDPROC(csum_partial_copy_generic_to_user)
-
- #undef ROUND
- #undef ROUND1
-diff -urNp linux-2.6.32.45/arch/x86/lib/clear_page_64.S linux-2.6.32.45/arch/x86/lib/clear_page_64.S
---- linux-2.6.32.45/arch/x86/lib/clear_page_64.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/lib/clear_page_64.S 2011-04-17 15:56:46.000000000 -0400
-@@ -43,7 +43,7 @@ ENDPROC(clear_page)
-
- #include <asm/cpufeature.h>
-
-- .section .altinstr_replacement,"ax"
-+ .section .altinstr_replacement,"a"
- 1: .byte 0xeb /* jmp <disp8> */
- .byte (clear_page_c - clear_page) - (2f - 1b) /* offset */
- 2:
-diff -urNp linux-2.6.32.45/arch/x86/lib/copy_page_64.S linux-2.6.32.45/arch/x86/lib/copy_page_64.S
---- linux-2.6.32.45/arch/x86/lib/copy_page_64.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/lib/copy_page_64.S 2011-04-17 15:56:46.000000000 -0400
-@@ -104,7 +104,7 @@ ENDPROC(copy_page)
-
- #include <asm/cpufeature.h>
-
-- .section .altinstr_replacement,"ax"
-+ .section .altinstr_replacement,"a"
- 1: .byte 0xeb /* jmp <disp8> */
- .byte (copy_page_c - copy_page) - (2f - 1b) /* offset */
- 2:
-diff -urNp linux-2.6.32.45/arch/x86/lib/copy_user_64.S linux-2.6.32.45/arch/x86/lib/copy_user_64.S
---- linux-2.6.32.45/arch/x86/lib/copy_user_64.S 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/lib/copy_user_64.S 2011-06-25 12:56:37.000000000 -0400
-@@ -15,13 +15,14 @@
- #include <asm/asm-offsets.h>
- #include <asm/thread_info.h>
- #include <asm/cpufeature.h>
-+#include <asm/pgtable.h>
-
- .macro ALTERNATIVE_JUMP feature,orig,alt
- 0:
- .byte 0xe9 /* 32bit jump */
- .long \orig-1f /* by default jump to orig */
- 1:
-- .section .altinstr_replacement,"ax"
-+ .section .altinstr_replacement,"a"
- 2: .byte 0xe9 /* near jump with 32bit immediate */
- .long \alt-1b /* offset */ /* or alternatively to alt */
- .previous
-@@ -64,49 +65,19 @@
- #endif
- .endm
-
--/* Standard copy_to_user with segment limit checking */
--ENTRY(copy_to_user)
-- CFI_STARTPROC
-- GET_THREAD_INFO(%rax)
-- movq %rdi,%rcx
-- addq %rdx,%rcx
-- jc bad_to_user
-- cmpq TI_addr_limit(%rax),%rcx
-- ja bad_to_user
-- ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
-- CFI_ENDPROC
--ENDPROC(copy_to_user)
--
--/* Standard copy_from_user with segment limit checking */
--ENTRY(copy_from_user)
-- CFI_STARTPROC
-- GET_THREAD_INFO(%rax)
-- movq %rsi,%rcx
-- addq %rdx,%rcx
-- jc bad_from_user
-- cmpq TI_addr_limit(%rax),%rcx
-- ja bad_from_user
-- ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
-- CFI_ENDPROC
--ENDPROC(copy_from_user)
--
- ENTRY(copy_user_generic)
- CFI_STARTPROC
- ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
- CFI_ENDPROC
- ENDPROC(copy_user_generic)
-
--ENTRY(__copy_from_user_inatomic)
-- CFI_STARTPROC
-- ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
-- CFI_ENDPROC
--ENDPROC(__copy_from_user_inatomic)
--
- .section .fixup,"ax"
- /* must zero dest */
- ENTRY(bad_from_user)
- bad_from_user:
- CFI_STARTPROC
-+ testl %edx,%edx
-+ js bad_to_user
- movl %edx,%ecx
- xorl %eax,%eax
- rep
-diff -urNp linux-2.6.32.45/arch/x86/lib/copy_user_nocache_64.S linux-2.6.32.45/arch/x86/lib/copy_user_nocache_64.S
---- linux-2.6.32.45/arch/x86/lib/copy_user_nocache_64.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/lib/copy_user_nocache_64.S 2011-04-17 15:56:46.000000000 -0400
-@@ -14,6 +14,7 @@
- #include <asm/current.h>
- #include <asm/asm-offsets.h>
- #include <asm/thread_info.h>
-+#include <asm/pgtable.h>
-
- .macro ALIGN_DESTINATION
- #ifdef FIX_ALIGNMENT
-@@ -50,6 +51,15 @@
- */
- ENTRY(__copy_user_nocache)
- CFI_STARTPROC
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ mov $PAX_USER_SHADOW_BASE,%rcx
-+ cmp %rcx,%rsi
-+ jae 1f
-+ add %rcx,%rsi
-+1:
-+#endif
-+
- cmpl $8,%edx
- jb 20f /* less then 8 bytes, go to byte copy loop */
- ALIGN_DESTINATION
-diff -urNp linux-2.6.32.45/arch/x86/lib/csum-wrappers_64.c linux-2.6.32.45/arch/x86/lib/csum-wrappers_64.c
---- linux-2.6.32.45/arch/x86/lib/csum-wrappers_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/lib/csum-wrappers_64.c 2011-05-04 17:56:20.000000000 -0400
-@@ -52,6 +52,12 @@ csum_partial_copy_from_user(const void _
- len -= 2;
- }
- }
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
-+ src += PAX_USER_SHADOW_BASE;
-+#endif
-+
- isum = csum_partial_copy_generic((__force const void *)src,
- dst, len, isum, errp, NULL);
- if (unlikely(*errp))
-@@ -105,6 +111,12 @@ csum_partial_copy_to_user(const void *sr
- }
-
- *errp = 0;
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
-+ dst += PAX_USER_SHADOW_BASE;
-+#endif
-+
- return csum_partial_copy_generic(src, (void __force *)dst,
- len, isum, NULL, errp);
- }
-diff -urNp linux-2.6.32.45/arch/x86/lib/getuser.S linux-2.6.32.45/arch/x86/lib/getuser.S
---- linux-2.6.32.45/arch/x86/lib/getuser.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/lib/getuser.S 2011-04-17 15:56:46.000000000 -0400
-@@ -33,14 +33,35 @@
- #include <asm/asm-offsets.h>
- #include <asm/thread_info.h>
- #include <asm/asm.h>
-+#include <asm/segment.h>
-+#include <asm/pgtable.h>
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+#define __copyuser_seg gs;
-+#else
-+#define __copyuser_seg
-+#endif
-
- .text
- ENTRY(__get_user_1)
- CFI_STARTPROC
-+
-+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
- GET_THREAD_INFO(%_ASM_DX)
- cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
- jae bad_get_user
--1: movzb (%_ASM_AX),%edx
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
-+ cmp %_ASM_DX,%_ASM_AX
-+ jae 1234f
-+ add %_ASM_DX,%_ASM_AX
-+1234:
-+#endif
-+
-+#endif
-+
-+1: __copyuser_seg movzb (%_ASM_AX),%edx
- xor %eax,%eax
- ret
- CFI_ENDPROC
-@@ -49,11 +70,24 @@ ENDPROC(__get_user_1)
- ENTRY(__get_user_2)
- CFI_STARTPROC
- add $1,%_ASM_AX
-+
-+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
- jc bad_get_user
- GET_THREAD_INFO(%_ASM_DX)
- cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
- jae bad_get_user
--2: movzwl -1(%_ASM_AX),%edx
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
-+ cmp %_ASM_DX,%_ASM_AX
-+ jae 1234f
-+ add %_ASM_DX,%_ASM_AX
-+1234:
-+#endif
-+
-+#endif
-+
-+2: __copyuser_seg movzwl -1(%_ASM_AX),%edx
- xor %eax,%eax
- ret
- CFI_ENDPROC
-@@ -62,11 +96,24 @@ ENDPROC(__get_user_2)
- ENTRY(__get_user_4)
- CFI_STARTPROC
- add $3,%_ASM_AX
-+
-+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
- jc bad_get_user
- GET_THREAD_INFO(%_ASM_DX)
- cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
- jae bad_get_user
--3: mov -3(%_ASM_AX),%edx
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
-+ cmp %_ASM_DX,%_ASM_AX
-+ jae 1234f
-+ add %_ASM_DX,%_ASM_AX
-+1234:
-+#endif
-+
-+#endif
-+
-+3: __copyuser_seg mov -3(%_ASM_AX),%edx
- xor %eax,%eax
- ret
- CFI_ENDPROC
-@@ -80,6 +127,15 @@ ENTRY(__get_user_8)
- GET_THREAD_INFO(%_ASM_DX)
- cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
- jae bad_get_user
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
-+ cmp %_ASM_DX,%_ASM_AX
-+ jae 1234f
-+ add %_ASM_DX,%_ASM_AX
-+1234:
-+#endif
-+
- 4: movq -7(%_ASM_AX),%_ASM_DX
- xor %eax,%eax
- ret
-diff -urNp linux-2.6.32.45/arch/x86/lib/memcpy_64.S linux-2.6.32.45/arch/x86/lib/memcpy_64.S
---- linux-2.6.32.45/arch/x86/lib/memcpy_64.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/lib/memcpy_64.S 2011-04-17 15:56:46.000000000 -0400
-@@ -128,7 +128,7 @@ ENDPROC(__memcpy)
- * It is also a lot simpler. Use this when possible:
- */
-
-- .section .altinstr_replacement, "ax"
-+ .section .altinstr_replacement, "a"
- 1: .byte 0xeb /* jmp <disp8> */
- .byte (memcpy_c - memcpy) - (2f - 1b) /* offset */
- 2:
-diff -urNp linux-2.6.32.45/arch/x86/lib/memset_64.S linux-2.6.32.45/arch/x86/lib/memset_64.S
---- linux-2.6.32.45/arch/x86/lib/memset_64.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/lib/memset_64.S 2011-04-17 15:56:46.000000000 -0400
-@@ -118,7 +118,7 @@ ENDPROC(__memset)
-
- #include <asm/cpufeature.h>
-
-- .section .altinstr_replacement,"ax"
-+ .section .altinstr_replacement,"a"
- 1: .byte 0xeb /* jmp <disp8> */
- .byte (memset_c - memset) - (2f - 1b) /* offset */
- 2:
-diff -urNp linux-2.6.32.45/arch/x86/lib/mmx_32.c linux-2.6.32.45/arch/x86/lib/mmx_32.c
---- linux-2.6.32.45/arch/x86/lib/mmx_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/lib/mmx_32.c 2011-04-17 15:56:46.000000000 -0400
-@@ -29,6 +29,7 @@ void *_mmx_memcpy(void *to, const void *
- {
- void *p;
- int i;
-+ unsigned long cr0;
-
- if (unlikely(in_interrupt()))
- return __memcpy(to, from, len);
-@@ -39,44 +40,72 @@ void *_mmx_memcpy(void *to, const void *
- kernel_fpu_begin();
-
- __asm__ __volatile__ (
-- "1: prefetch (%0)\n" /* This set is 28 bytes */
-- " prefetch 64(%0)\n"
-- " prefetch 128(%0)\n"
-- " prefetch 192(%0)\n"
-- " prefetch 256(%0)\n"
-+ "1: prefetch (%1)\n" /* This set is 28 bytes */
-+ " prefetch 64(%1)\n"
-+ " prefetch 128(%1)\n"
-+ " prefetch 192(%1)\n"
-+ " prefetch 256(%1)\n"
- "2: \n"
- ".section .fixup, \"ax\"\n"
-- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
-+ "3: \n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %%cr0, %0\n"
-+ " movl %0, %%eax\n"
-+ " andl $0xFFFEFFFF, %%eax\n"
-+ " movl %%eax, %%cr0\n"
-+#endif
-+
-+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %0, %%cr0\n"
-+#endif
-+
- " jmp 2b\n"
- ".previous\n"
- _ASM_EXTABLE(1b, 3b)
-- : : "r" (from));
-+ : "=&r" (cr0) : "r" (from) : "ax");
-
- for ( ; i > 5; i--) {
- __asm__ __volatile__ (
-- "1: prefetch 320(%0)\n"
-- "2: movq (%0), %%mm0\n"
-- " movq 8(%0), %%mm1\n"
-- " movq 16(%0), %%mm2\n"
-- " movq 24(%0), %%mm3\n"
-- " movq %%mm0, (%1)\n"
-- " movq %%mm1, 8(%1)\n"
-- " movq %%mm2, 16(%1)\n"
-- " movq %%mm3, 24(%1)\n"
-- " movq 32(%0), %%mm0\n"
-- " movq 40(%0), %%mm1\n"
-- " movq 48(%0), %%mm2\n"
-- " movq 56(%0), %%mm3\n"
-- " movq %%mm0, 32(%1)\n"
-- " movq %%mm1, 40(%1)\n"
-- " movq %%mm2, 48(%1)\n"
-- " movq %%mm3, 56(%1)\n"
-+ "1: prefetch 320(%1)\n"
-+ "2: movq (%1), %%mm0\n"
-+ " movq 8(%1), %%mm1\n"
-+ " movq 16(%1), %%mm2\n"
-+ " movq 24(%1), %%mm3\n"
-+ " movq %%mm0, (%2)\n"
-+ " movq %%mm1, 8(%2)\n"
-+ " movq %%mm2, 16(%2)\n"
-+ " movq %%mm3, 24(%2)\n"
-+ " movq 32(%1), %%mm0\n"
-+ " movq 40(%1), %%mm1\n"
-+ " movq 48(%1), %%mm2\n"
-+ " movq 56(%1), %%mm3\n"
-+ " movq %%mm0, 32(%2)\n"
-+ " movq %%mm1, 40(%2)\n"
-+ " movq %%mm2, 48(%2)\n"
-+ " movq %%mm3, 56(%2)\n"
- ".section .fixup, \"ax\"\n"
-- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
-+ "3:\n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %%cr0, %0\n"
-+ " movl %0, %%eax\n"
-+ " andl $0xFFFEFFFF, %%eax\n"
-+ " movl %%eax, %%cr0\n"
-+#endif
-+
-+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %0, %%cr0\n"
-+#endif
-+
- " jmp 2b\n"
- ".previous\n"
- _ASM_EXTABLE(1b, 3b)
-- : : "r" (from), "r" (to) : "memory");
-+ : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
-
- from += 64;
- to += 64;
-@@ -158,6 +187,7 @@ static void fast_clear_page(void *page)
- static void fast_copy_page(void *to, void *from)
- {
- int i;
-+ unsigned long cr0;
-
- kernel_fpu_begin();
-
-@@ -166,42 +196,70 @@ static void fast_copy_page(void *to, voi
- * but that is for later. -AV
- */
- __asm__ __volatile__(
-- "1: prefetch (%0)\n"
-- " prefetch 64(%0)\n"
-- " prefetch 128(%0)\n"
-- " prefetch 192(%0)\n"
-- " prefetch 256(%0)\n"
-+ "1: prefetch (%1)\n"
-+ " prefetch 64(%1)\n"
-+ " prefetch 128(%1)\n"
-+ " prefetch 192(%1)\n"
-+ " prefetch 256(%1)\n"
- "2: \n"
- ".section .fixup, \"ax\"\n"
-- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
-+ "3: \n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %%cr0, %0\n"
-+ " movl %0, %%eax\n"
-+ " andl $0xFFFEFFFF, %%eax\n"
-+ " movl %%eax, %%cr0\n"
-+#endif
-+
-+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %0, %%cr0\n"
-+#endif
-+
- " jmp 2b\n"
- ".previous\n"
-- _ASM_EXTABLE(1b, 3b) : : "r" (from));
-+ _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
-
- for (i = 0; i < (4096-320)/64; i++) {
- __asm__ __volatile__ (
-- "1: prefetch 320(%0)\n"
-- "2: movq (%0), %%mm0\n"
-- " movntq %%mm0, (%1)\n"
-- " movq 8(%0), %%mm1\n"
-- " movntq %%mm1, 8(%1)\n"
-- " movq 16(%0), %%mm2\n"
-- " movntq %%mm2, 16(%1)\n"
-- " movq 24(%0), %%mm3\n"
-- " movntq %%mm3, 24(%1)\n"
-- " movq 32(%0), %%mm4\n"
-- " movntq %%mm4, 32(%1)\n"
-- " movq 40(%0), %%mm5\n"
-- " movntq %%mm5, 40(%1)\n"
-- " movq 48(%0), %%mm6\n"
-- " movntq %%mm6, 48(%1)\n"
-- " movq 56(%0), %%mm7\n"
-- " movntq %%mm7, 56(%1)\n"
-+ "1: prefetch 320(%1)\n"
-+ "2: movq (%1), %%mm0\n"
-+ " movntq %%mm0, (%2)\n"
-+ " movq 8(%1), %%mm1\n"
-+ " movntq %%mm1, 8(%2)\n"
-+ " movq 16(%1), %%mm2\n"
-+ " movntq %%mm2, 16(%2)\n"
-+ " movq 24(%1), %%mm3\n"
-+ " movntq %%mm3, 24(%2)\n"
-+ " movq 32(%1), %%mm4\n"
-+ " movntq %%mm4, 32(%2)\n"
-+ " movq 40(%1), %%mm5\n"
-+ " movntq %%mm5, 40(%2)\n"
-+ " movq 48(%1), %%mm6\n"
-+ " movntq %%mm6, 48(%2)\n"
-+ " movq 56(%1), %%mm7\n"
-+ " movntq %%mm7, 56(%2)\n"
- ".section .fixup, \"ax\"\n"
-- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
-+ "3:\n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %%cr0, %0\n"
-+ " movl %0, %%eax\n"
-+ " andl $0xFFFEFFFF, %%eax\n"
-+ " movl %%eax, %%cr0\n"
-+#endif
-+
-+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %0, %%cr0\n"
-+#endif
-+
- " jmp 2b\n"
- ".previous\n"
-- _ASM_EXTABLE(1b, 3b) : : "r" (from), "r" (to) : "memory");
-+ _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
-
- from += 64;
- to += 64;
-@@ -280,47 +338,76 @@ static void fast_clear_page(void *page)
- static void fast_copy_page(void *to, void *from)
- {
- int i;
-+ unsigned long cr0;
-
- kernel_fpu_begin();
-
- __asm__ __volatile__ (
-- "1: prefetch (%0)\n"
-- " prefetch 64(%0)\n"
-- " prefetch 128(%0)\n"
-- " prefetch 192(%0)\n"
-- " prefetch 256(%0)\n"
-+ "1: prefetch (%1)\n"
-+ " prefetch 64(%1)\n"
-+ " prefetch 128(%1)\n"
-+ " prefetch 192(%1)\n"
-+ " prefetch 256(%1)\n"
- "2: \n"
- ".section .fixup, \"ax\"\n"
-- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
-+ "3: \n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %%cr0, %0\n"
-+ " movl %0, %%eax\n"
-+ " andl $0xFFFEFFFF, %%eax\n"
-+ " movl %%eax, %%cr0\n"
-+#endif
-+
-+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %0, %%cr0\n"
-+#endif
-+
- " jmp 2b\n"
- ".previous\n"
-- _ASM_EXTABLE(1b, 3b) : : "r" (from));
-+ _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
-
- for (i = 0; i < 4096/64; i++) {
- __asm__ __volatile__ (
-- "1: prefetch 320(%0)\n"
-- "2: movq (%0), %%mm0\n"
-- " movq 8(%0), %%mm1\n"
-- " movq 16(%0), %%mm2\n"
-- " movq 24(%0), %%mm3\n"
-- " movq %%mm0, (%1)\n"
-- " movq %%mm1, 8(%1)\n"
-- " movq %%mm2, 16(%1)\n"
-- " movq %%mm3, 24(%1)\n"
-- " movq 32(%0), %%mm0\n"
-- " movq 40(%0), %%mm1\n"
-- " movq 48(%0), %%mm2\n"
-- " movq 56(%0), %%mm3\n"
-- " movq %%mm0, 32(%1)\n"
-- " movq %%mm1, 40(%1)\n"
-- " movq %%mm2, 48(%1)\n"
-- " movq %%mm3, 56(%1)\n"
-+ "1: prefetch 320(%1)\n"
-+ "2: movq (%1), %%mm0\n"
-+ " movq 8(%1), %%mm1\n"
-+ " movq 16(%1), %%mm2\n"
-+ " movq 24(%1), %%mm3\n"
-+ " movq %%mm0, (%2)\n"
-+ " movq %%mm1, 8(%2)\n"
-+ " movq %%mm2, 16(%2)\n"
-+ " movq %%mm3, 24(%2)\n"
-+ " movq 32(%1), %%mm0\n"
-+ " movq 40(%1), %%mm1\n"
-+ " movq 48(%1), %%mm2\n"
-+ " movq 56(%1), %%mm3\n"
-+ " movq %%mm0, 32(%2)\n"
-+ " movq %%mm1, 40(%2)\n"
-+ " movq %%mm2, 48(%2)\n"
-+ " movq %%mm3, 56(%2)\n"
- ".section .fixup, \"ax\"\n"
-- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
-+ "3:\n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %%cr0, %0\n"
-+ " movl %0, %%eax\n"
-+ " andl $0xFFFEFFFF, %%eax\n"
-+ " movl %%eax, %%cr0\n"
-+#endif
-+
-+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ " movl %0, %%cr0\n"
-+#endif
-+
- " jmp 2b\n"
- ".previous\n"
- _ASM_EXTABLE(1b, 3b)
-- : : "r" (from), "r" (to) : "memory");
-+ : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
-
- from += 64;
- to += 64;
-diff -urNp linux-2.6.32.45/arch/x86/lib/putuser.S linux-2.6.32.45/arch/x86/lib/putuser.S
---- linux-2.6.32.45/arch/x86/lib/putuser.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/lib/putuser.S 2011-04-17 15:56:46.000000000 -0400
-@@ -15,7 +15,8 @@
- #include <asm/thread_info.h>
- #include <asm/errno.h>
- #include <asm/asm.h>
--
-+#include <asm/segment.h>
-+#include <asm/pgtable.h>
-
- /*
- * __put_user_X
-@@ -29,52 +30,119 @@
- * as they get called from within inline assembly.
- */
-
--#define ENTER CFI_STARTPROC ; \
-- GET_THREAD_INFO(%_ASM_BX)
-+#define ENTER CFI_STARTPROC
- #define EXIT ret ; \
- CFI_ENDPROC
-
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+#define _DEST %_ASM_CX,%_ASM_BX
-+#else
-+#define _DEST %_ASM_CX
-+#endif
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+#define __copyuser_seg gs;
-+#else
-+#define __copyuser_seg
-+#endif
-+
- .text
- ENTRY(__put_user_1)
- ENTER
-+
-+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
-+ GET_THREAD_INFO(%_ASM_BX)
- cmp TI_addr_limit(%_ASM_BX),%_ASM_CX
- jae bad_put_user
--1: movb %al,(%_ASM_CX)
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
-+ cmp %_ASM_BX,%_ASM_CX
-+ jb 1234f
-+ xor %ebx,%ebx
-+1234:
-+#endif
-+
-+#endif
-+
-+1: __copyuser_seg movb %al,(_DEST)
- xor %eax,%eax
- EXIT
- ENDPROC(__put_user_1)
-
- ENTRY(__put_user_2)
- ENTER
-+
-+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
-+ GET_THREAD_INFO(%_ASM_BX)
- mov TI_addr_limit(%_ASM_BX),%_ASM_BX
- sub $1,%_ASM_BX
- cmp %_ASM_BX,%_ASM_CX
- jae bad_put_user
--2: movw %ax,(%_ASM_CX)
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
-+ cmp %_ASM_BX,%_ASM_CX
-+ jb 1234f
-+ xor %ebx,%ebx
-+1234:
-+#endif
-+
-+#endif
-+
-+2: __copyuser_seg movw %ax,(_DEST)
- xor %eax,%eax
- EXIT
- ENDPROC(__put_user_2)
-
- ENTRY(__put_user_4)
- ENTER
-+
-+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
-+ GET_THREAD_INFO(%_ASM_BX)
- mov TI_addr_limit(%_ASM_BX),%_ASM_BX
- sub $3,%_ASM_BX
- cmp %_ASM_BX,%_ASM_CX
- jae bad_put_user
--3: movl %eax,(%_ASM_CX)
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
-+ cmp %_ASM_BX,%_ASM_CX
-+ jb 1234f
-+ xor %ebx,%ebx
-+1234:
-+#endif
-+
-+#endif
-+
-+3: __copyuser_seg movl %eax,(_DEST)
- xor %eax,%eax
- EXIT
- ENDPROC(__put_user_4)
-
- ENTRY(__put_user_8)
- ENTER
-+
-+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
-+ GET_THREAD_INFO(%_ASM_BX)
- mov TI_addr_limit(%_ASM_BX),%_ASM_BX
- sub $7,%_ASM_BX
- cmp %_ASM_BX,%_ASM_CX
- jae bad_put_user
--4: mov %_ASM_AX,(%_ASM_CX)
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
-+ cmp %_ASM_BX,%_ASM_CX
-+ jb 1234f
-+ xor %ebx,%ebx
-+1234:
-+#endif
-+
-+#endif
-+
-+4: __copyuser_seg mov %_ASM_AX,(_DEST)
- #ifdef CONFIG_X86_32
--5: movl %edx,4(%_ASM_CX)
-+5: __copyuser_seg movl %edx,4(_DEST)
- #endif
- xor %eax,%eax
- EXIT
-diff -urNp linux-2.6.32.45/arch/x86/lib/usercopy_32.c linux-2.6.32.45/arch/x86/lib/usercopy_32.c
---- linux-2.6.32.45/arch/x86/lib/usercopy_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/lib/usercopy_32.c 2011-04-23 21:12:28.000000000 -0400
-@@ -43,7 +43,7 @@ do { \
- __asm__ __volatile__( \
- " testl %1,%1\n" \
- " jz 2f\n" \
-- "0: lodsb\n" \
-+ "0: "__copyuser_seg"lodsb\n" \
- " stosb\n" \
- " testb %%al,%%al\n" \
- " jz 1f\n" \
-@@ -128,10 +128,12 @@ do { \
- int __d0; \
- might_fault(); \
- __asm__ __volatile__( \
-+ __COPYUSER_SET_ES \
- "0: rep; stosl\n" \
- " movl %2,%0\n" \
- "1: rep; stosb\n" \
- "2:\n" \
-+ __COPYUSER_RESTORE_ES \
- ".section .fixup,\"ax\"\n" \
- "3: lea 0(%2,%0,4),%0\n" \
- " jmp 2b\n" \
-@@ -200,6 +202,7 @@ long strnlen_user(const char __user *s,
- might_fault();
-
- __asm__ __volatile__(
-+ __COPYUSER_SET_ES
- " testl %0, %0\n"
- " jz 3f\n"
- " andl %0,%%ecx\n"
-@@ -208,6 +211,7 @@ long strnlen_user(const char __user *s,
- " subl %%ecx,%0\n"
- " addl %0,%%eax\n"
- "1:\n"
-+ __COPYUSER_RESTORE_ES
- ".section .fixup,\"ax\"\n"
- "2: xorl %%eax,%%eax\n"
- " jmp 1b\n"
-@@ -227,7 +231,7 @@ EXPORT_SYMBOL(strnlen_user);
-
- #ifdef CONFIG_X86_INTEL_USERCOPY
- static unsigned long
--__copy_user_intel(void __user *to, const void *from, unsigned long size)
-+__generic_copy_to_user_intel(void __user *to, const void *from, unsigned long size)
- {
- int d0, d1;
- __asm__ __volatile__(
-@@ -239,36 +243,36 @@ __copy_user_intel(void __user *to, const
- " .align 2,0x90\n"
- "3: movl 0(%4), %%eax\n"
- "4: movl 4(%4), %%edx\n"
-- "5: movl %%eax, 0(%3)\n"
-- "6: movl %%edx, 4(%3)\n"
-+ "5: "__copyuser_seg" movl %%eax, 0(%3)\n"
-+ "6: "__copyuser_seg" movl %%edx, 4(%3)\n"
- "7: movl 8(%4), %%eax\n"
- "8: movl 12(%4),%%edx\n"
-- "9: movl %%eax, 8(%3)\n"
-- "10: movl %%edx, 12(%3)\n"
-+ "9: "__copyuser_seg" movl %%eax, 8(%3)\n"
-+ "10: "__copyuser_seg" movl %%edx, 12(%3)\n"
- "11: movl 16(%4), %%eax\n"
- "12: movl 20(%4), %%edx\n"
-- "13: movl %%eax, 16(%3)\n"
-- "14: movl %%edx, 20(%3)\n"
-+ "13: "__copyuser_seg" movl %%eax, 16(%3)\n"
-+ "14: "__copyuser_seg" movl %%edx, 20(%3)\n"
- "15: movl 24(%4), %%eax\n"
- "16: movl 28(%4), %%edx\n"
-- "17: movl %%eax, 24(%3)\n"
-- "18: movl %%edx, 28(%3)\n"
-+ "17: "__copyuser_seg" movl %%eax, 24(%3)\n"
-+ "18: "__copyuser_seg" movl %%edx, 28(%3)\n"
- "19: movl 32(%4), %%eax\n"
- "20: movl 36(%4), %%edx\n"
-- "21: movl %%eax, 32(%3)\n"
-- "22: movl %%edx, 36(%3)\n"
-+ "21: "__copyuser_seg" movl %%eax, 32(%3)\n"
-+ "22: "__copyuser_seg" movl %%edx, 36(%3)\n"
- "23: movl 40(%4), %%eax\n"
- "24: movl 44(%4), %%edx\n"
-- "25: movl %%eax, 40(%3)\n"
-- "26: movl %%edx, 44(%3)\n"
-+ "25: "__copyuser_seg" movl %%eax, 40(%3)\n"
-+ "26: "__copyuser_seg" movl %%edx, 44(%3)\n"
- "27: movl 48(%4), %%eax\n"
- "28: movl 52(%4), %%edx\n"
-- "29: movl %%eax, 48(%3)\n"
-- "30: movl %%edx, 52(%3)\n"
-+ "29: "__copyuser_seg" movl %%eax, 48(%3)\n"
-+ "30: "__copyuser_seg" movl %%edx, 52(%3)\n"
- "31: movl 56(%4), %%eax\n"
- "32: movl 60(%4), %%edx\n"
-- "33: movl %%eax, 56(%3)\n"
-- "34: movl %%edx, 60(%3)\n"
-+ "33: "__copyuser_seg" movl %%eax, 56(%3)\n"
-+ "34: "__copyuser_seg" movl %%edx, 60(%3)\n"
- " addl $-64, %0\n"
- " addl $64, %4\n"
- " addl $64, %3\n"
-@@ -278,10 +282,119 @@ __copy_user_intel(void __user *to, const
- " shrl $2, %0\n"
- " andl $3, %%eax\n"
- " cld\n"
-+ __COPYUSER_SET_ES
- "99: rep; movsl\n"
- "36: movl %%eax, %0\n"
- "37: rep; movsb\n"
- "100:\n"
-+ __COPYUSER_RESTORE_ES
-+ ".section .fixup,\"ax\"\n"
-+ "101: lea 0(%%eax,%0,4),%0\n"
-+ " jmp 100b\n"
-+ ".previous\n"
-+ ".section __ex_table,\"a\"\n"
-+ " .align 4\n"
-+ " .long 1b,100b\n"
-+ " .long 2b,100b\n"
-+ " .long 3b,100b\n"
-+ " .long 4b,100b\n"
-+ " .long 5b,100b\n"
-+ " .long 6b,100b\n"
-+ " .long 7b,100b\n"
-+ " .long 8b,100b\n"
-+ " .long 9b,100b\n"
-+ " .long 10b,100b\n"
-+ " .long 11b,100b\n"
-+ " .long 12b,100b\n"
-+ " .long 13b,100b\n"
-+ " .long 14b,100b\n"
-+ " .long 15b,100b\n"
-+ " .long 16b,100b\n"
-+ " .long 17b,100b\n"
-+ " .long 18b,100b\n"
-+ " .long 19b,100b\n"
-+ " .long 20b,100b\n"
-+ " .long 21b,100b\n"
-+ " .long 22b,100b\n"
-+ " .long 23b,100b\n"
-+ " .long 24b,100b\n"
-+ " .long 25b,100b\n"
-+ " .long 26b,100b\n"
-+ " .long 27b,100b\n"
-+ " .long 28b,100b\n"
-+ " .long 29b,100b\n"
-+ " .long 30b,100b\n"
-+ " .long 31b,100b\n"
-+ " .long 32b,100b\n"
-+ " .long 33b,100b\n"
-+ " .long 34b,100b\n"
-+ " .long 35b,100b\n"
-+ " .long 36b,100b\n"
-+ " .long 37b,100b\n"
-+ " .long 99b,101b\n"
-+ ".previous"
-+ : "=&c"(size), "=&D" (d0), "=&S" (d1)
-+ : "1"(to), "2"(from), "0"(size)
-+ : "eax", "edx", "memory");
-+ return size;
-+}
-+
-+static unsigned long
-+__generic_copy_from_user_intel(void *to, const void __user *from, unsigned long size)
-+{
-+ int d0, d1;
-+ __asm__ __volatile__(
-+ " .align 2,0x90\n"
-+ "1: "__copyuser_seg" movl 32(%4), %%eax\n"
-+ " cmpl $67, %0\n"
-+ " jbe 3f\n"
-+ "2: "__copyuser_seg" movl 64(%4), %%eax\n"
-+ " .align 2,0x90\n"
-+ "3: "__copyuser_seg" movl 0(%4), %%eax\n"
-+ "4: "__copyuser_seg" movl 4(%4), %%edx\n"
-+ "5: movl %%eax, 0(%3)\n"
-+ "6: movl %%edx, 4(%3)\n"
-+ "7: "__copyuser_seg" movl 8(%4), %%eax\n"
-+ "8: "__copyuser_seg" movl 12(%4),%%edx\n"
-+ "9: movl %%eax, 8(%3)\n"
-+ "10: movl %%edx, 12(%3)\n"
-+ "11: "__copyuser_seg" movl 16(%4), %%eax\n"
-+ "12: "__copyuser_seg" movl 20(%4), %%edx\n"
-+ "13: movl %%eax, 16(%3)\n"
-+ "14: movl %%edx, 20(%3)\n"
-+ "15: "__copyuser_seg" movl 24(%4), %%eax\n"
-+ "16: "__copyuser_seg" movl 28(%4), %%edx\n"
-+ "17: movl %%eax, 24(%3)\n"
-+ "18: movl %%edx, 28(%3)\n"
-+ "19: "__copyuser_seg" movl 32(%4), %%eax\n"
-+ "20: "__copyuser_seg" movl 36(%4), %%edx\n"
-+ "21: movl %%eax, 32(%3)\n"
-+ "22: movl %%edx, 36(%3)\n"
-+ "23: "__copyuser_seg" movl 40(%4), %%eax\n"
-+ "24: "__copyuser_seg" movl 44(%4), %%edx\n"
-+ "25: movl %%eax, 40(%3)\n"
-+ "26: movl %%edx, 44(%3)\n"
-+ "27: "__copyuser_seg" movl 48(%4), %%eax\n"
-+ "28: "__copyuser_seg" movl 52(%4), %%edx\n"
-+ "29: movl %%eax, 48(%3)\n"
-+ "30: movl %%edx, 52(%3)\n"
-+ "31: "__copyuser_seg" movl 56(%4), %%eax\n"
-+ "32: "__copyuser_seg" movl 60(%4), %%edx\n"
-+ "33: movl %%eax, 56(%3)\n"
-+ "34: movl %%edx, 60(%3)\n"
-+ " addl $-64, %0\n"
-+ " addl $64, %4\n"
-+ " addl $64, %3\n"
-+ " cmpl $63, %0\n"
-+ " ja 1b\n"
-+ "35: movl %0, %%eax\n"
-+ " shrl $2, %0\n"
-+ " andl $3, %%eax\n"
-+ " cld\n"
-+ "99: rep; "__copyuser_seg" movsl\n"
-+ "36: movl %%eax, %0\n"
-+ "37: rep; "__copyuser_seg" movsb\n"
-+ "100:\n"
- ".section .fixup,\"ax\"\n"
- "101: lea 0(%%eax,%0,4),%0\n"
- " jmp 100b\n"
-@@ -339,41 +452,41 @@ __copy_user_zeroing_intel(void *to, cons
- int d0, d1;
- __asm__ __volatile__(
- " .align 2,0x90\n"
-- "0: movl 32(%4), %%eax\n"
-+ "0: "__copyuser_seg" movl 32(%4), %%eax\n"
- " cmpl $67, %0\n"
- " jbe 2f\n"
-- "1: movl 64(%4), %%eax\n"
-+ "1: "__copyuser_seg" movl 64(%4), %%eax\n"
- " .align 2,0x90\n"
-- "2: movl 0(%4), %%eax\n"
-- "21: movl 4(%4), %%edx\n"
-+ "2: "__copyuser_seg" movl 0(%4), %%eax\n"
-+ "21: "__copyuser_seg" movl 4(%4), %%edx\n"
- " movl %%eax, 0(%3)\n"
- " movl %%edx, 4(%3)\n"
-- "3: movl 8(%4), %%eax\n"
-- "31: movl 12(%4),%%edx\n"
-+ "3: "__copyuser_seg" movl 8(%4), %%eax\n"
-+ "31: "__copyuser_seg" movl 12(%4),%%edx\n"
- " movl %%eax, 8(%3)\n"
- " movl %%edx, 12(%3)\n"
-- "4: movl 16(%4), %%eax\n"
-- "41: movl 20(%4), %%edx\n"
-+ "4: "__copyuser_seg" movl 16(%4), %%eax\n"
-+ "41: "__copyuser_seg" movl 20(%4), %%edx\n"
- " movl %%eax, 16(%3)\n"
- " movl %%edx, 20(%3)\n"
-- "10: movl 24(%4), %%eax\n"
-- "51: movl 28(%4), %%edx\n"
-+ "10: "__copyuser_seg" movl 24(%4), %%eax\n"
-+ "51: "__copyuser_seg" movl 28(%4), %%edx\n"
- " movl %%eax, 24(%3)\n"
- " movl %%edx, 28(%3)\n"
-- "11: movl 32(%4), %%eax\n"
-- "61: movl 36(%4), %%edx\n"
-+ "11: "__copyuser_seg" movl 32(%4), %%eax\n"
-+ "61: "__copyuser_seg" movl 36(%4), %%edx\n"
- " movl %%eax, 32(%3)\n"
- " movl %%edx, 36(%3)\n"
-- "12: movl 40(%4), %%eax\n"
-- "71: movl 44(%4), %%edx\n"
-+ "12: "__copyuser_seg" movl 40(%4), %%eax\n"
-+ "71: "__copyuser_seg" movl 44(%4), %%edx\n"
- " movl %%eax, 40(%3)\n"
- " movl %%edx, 44(%3)\n"
-- "13: movl 48(%4), %%eax\n"
-- "81: movl 52(%4), %%edx\n"
-+ "13: "__copyuser_seg" movl 48(%4), %%eax\n"
-+ "81: "__copyuser_seg" movl 52(%4), %%edx\n"
- " movl %%eax, 48(%3)\n"
- " movl %%edx, 52(%3)\n"
-- "14: movl 56(%4), %%eax\n"
-- "91: movl 60(%4), %%edx\n"
-+ "14: "__copyuser_seg" movl 56(%4), %%eax\n"
-+ "91: "__copyuser_seg" movl 60(%4), %%edx\n"
- " movl %%eax, 56(%3)\n"
- " movl %%edx, 60(%3)\n"
- " addl $-64, %0\n"
-@@ -385,9 +498,9 @@ __copy_user_zeroing_intel(void *to, cons
- " shrl $2, %0\n"
- " andl $3, %%eax\n"
- " cld\n"
-- "6: rep; movsl\n"
-+ "6: rep; "__copyuser_seg" movsl\n"
- " movl %%eax,%0\n"
-- "7: rep; movsb\n"
-+ "7: rep; "__copyuser_seg" movsb\n"
- "8:\n"
- ".section .fixup,\"ax\"\n"
- "9: lea 0(%%eax,%0,4),%0\n"
-@@ -440,41 +553,41 @@ static unsigned long __copy_user_zeroing
-
- __asm__ __volatile__(
- " .align 2,0x90\n"
-- "0: movl 32(%4), %%eax\n"
-+ "0: "__copyuser_seg" movl 32(%4), %%eax\n"
- " cmpl $67, %0\n"
- " jbe 2f\n"
-- "1: movl 64(%4), %%eax\n"
-+ "1: "__copyuser_seg" movl 64(%4), %%eax\n"
- " .align 2,0x90\n"
-- "2: movl 0(%4), %%eax\n"
-- "21: movl 4(%4), %%edx\n"
-+ "2: "__copyuser_seg" movl 0(%4), %%eax\n"
-+ "21: "__copyuser_seg" movl 4(%4), %%edx\n"
- " movnti %%eax, 0(%3)\n"
- " movnti %%edx, 4(%3)\n"
-- "3: movl 8(%4), %%eax\n"
-- "31: movl 12(%4),%%edx\n"
-+ "3: "__copyuser_seg" movl 8(%4), %%eax\n"
-+ "31: "__copyuser_seg" movl 12(%4),%%edx\n"
- " movnti %%eax, 8(%3)\n"
- " movnti %%edx, 12(%3)\n"
-- "4: movl 16(%4), %%eax\n"
-- "41: movl 20(%4), %%edx\n"
-+ "4: "__copyuser_seg" movl 16(%4), %%eax\n"
-+ "41: "__copyuser_seg" movl 20(%4), %%edx\n"
- " movnti %%eax, 16(%3)\n"
- " movnti %%edx, 20(%3)\n"
-- "10: movl 24(%4), %%eax\n"
-- "51: movl 28(%4), %%edx\n"
-+ "10: "__copyuser_seg" movl 24(%4), %%eax\n"
-+ "51: "__copyuser_seg" movl 28(%4), %%edx\n"
- " movnti %%eax, 24(%3)\n"
- " movnti %%edx, 28(%3)\n"
-- "11: movl 32(%4), %%eax\n"
-- "61: movl 36(%4), %%edx\n"
-+ "11: "__copyuser_seg" movl 32(%4), %%eax\n"
-+ "61: "__copyuser_seg" movl 36(%4), %%edx\n"
- " movnti %%eax, 32(%3)\n"
- " movnti %%edx, 36(%3)\n"
-- "12: movl 40(%4), %%eax\n"
-- "71: movl 44(%4), %%edx\n"
-+ "12: "__copyuser_seg" movl 40(%4), %%eax\n"
-+ "71: "__copyuser_seg" movl 44(%4), %%edx\n"
- " movnti %%eax, 40(%3)\n"
- " movnti %%edx, 44(%3)\n"
-- "13: movl 48(%4), %%eax\n"
-- "81: movl 52(%4), %%edx\n"
-+ "13: "__copyuser_seg" movl 48(%4), %%eax\n"
-+ "81: "__copyuser_seg" movl 52(%4), %%edx\n"
- " movnti %%eax, 48(%3)\n"
- " movnti %%edx, 52(%3)\n"
-- "14: movl 56(%4), %%eax\n"
-- "91: movl 60(%4), %%edx\n"
-+ "14: "__copyuser_seg" movl 56(%4), %%eax\n"
-+ "91: "__copyuser_seg" movl 60(%4), %%edx\n"
- " movnti %%eax, 56(%3)\n"
- " movnti %%edx, 60(%3)\n"
- " addl $-64, %0\n"
-@@ -487,9 +600,9 @@ static unsigned long __copy_user_zeroing
- " shrl $2, %0\n"
- " andl $3, %%eax\n"
- " cld\n"
-- "6: rep; movsl\n"
-+ "6: rep; "__copyuser_seg" movsl\n"
- " movl %%eax,%0\n"
-- "7: rep; movsb\n"
-+ "7: rep; "__copyuser_seg" movsb\n"
- "8:\n"
- ".section .fixup,\"ax\"\n"
- "9: lea 0(%%eax,%0,4),%0\n"
-@@ -537,41 +650,41 @@ static unsigned long __copy_user_intel_n
-
- __asm__ __volatile__(
- " .align 2,0x90\n"
-- "0: movl 32(%4), %%eax\n"
-+ "0: "__copyuser_seg" movl 32(%4), %%eax\n"
- " cmpl $67, %0\n"
- " jbe 2f\n"
-- "1: movl 64(%4), %%eax\n"
-+ "1: "__copyuser_seg" movl 64(%4), %%eax\n"
- " .align 2,0x90\n"
-- "2: movl 0(%4), %%eax\n"
-- "21: movl 4(%4), %%edx\n"
-+ "2: "__copyuser_seg" movl 0(%4), %%eax\n"
-+ "21: "__copyuser_seg" movl 4(%4), %%edx\n"
- " movnti %%eax, 0(%3)\n"
- " movnti %%edx, 4(%3)\n"
-- "3: movl 8(%4), %%eax\n"
-- "31: movl 12(%4),%%edx\n"
-+ "3: "__copyuser_seg" movl 8(%4), %%eax\n"
-+ "31: "__copyuser_seg" movl 12(%4),%%edx\n"
- " movnti %%eax, 8(%3)\n"
- " movnti %%edx, 12(%3)\n"
-- "4: movl 16(%4), %%eax\n"
-- "41: movl 20(%4), %%edx\n"
-+ "4: "__copyuser_seg" movl 16(%4), %%eax\n"
-+ "41: "__copyuser_seg" movl 20(%4), %%edx\n"
- " movnti %%eax, 16(%3)\n"
- " movnti %%edx, 20(%3)\n"
-- "10: movl 24(%4), %%eax\n"
-- "51: movl 28(%4), %%edx\n"
-+ "10: "__copyuser_seg" movl 24(%4), %%eax\n"
-+ "51: "__copyuser_seg" movl 28(%4), %%edx\n"
- " movnti %%eax, 24(%3)\n"
- " movnti %%edx, 28(%3)\n"
-- "11: movl 32(%4), %%eax\n"
-- "61: movl 36(%4), %%edx\n"
-+ "11: "__copyuser_seg" movl 32(%4), %%eax\n"
-+ "61: "__copyuser_seg" movl 36(%4), %%edx\n"
- " movnti %%eax, 32(%3)\n"
- " movnti %%edx, 36(%3)\n"
-- "12: movl 40(%4), %%eax\n"
-- "71: movl 44(%4), %%edx\n"
-+ "12: "__copyuser_seg" movl 40(%4), %%eax\n"
-+ "71: "__copyuser_seg" movl 44(%4), %%edx\n"
- " movnti %%eax, 40(%3)\n"
- " movnti %%edx, 44(%3)\n"
-- "13: movl 48(%4), %%eax\n"
-- "81: movl 52(%4), %%edx\n"
-+ "13: "__copyuser_seg" movl 48(%4), %%eax\n"
-+ "81: "__copyuser_seg" movl 52(%4), %%edx\n"
- " movnti %%eax, 48(%3)\n"
- " movnti %%edx, 52(%3)\n"
-- "14: movl 56(%4), %%eax\n"
-- "91: movl 60(%4), %%edx\n"
-+ "14: "__copyuser_seg" movl 56(%4), %%eax\n"
-+ "91: "__copyuser_seg" movl 60(%4), %%edx\n"
- " movnti %%eax, 56(%3)\n"
- " movnti %%edx, 60(%3)\n"
- " addl $-64, %0\n"
-@@ -584,9 +697,9 @@ static unsigned long __copy_user_intel_n
- " shrl $2, %0\n"
- " andl $3, %%eax\n"
- " cld\n"
-- "6: rep; movsl\n"
-+ "6: rep; "__copyuser_seg" movsl\n"
- " movl %%eax,%0\n"
-- "7: rep; movsb\n"
-+ "7: rep; "__copyuser_seg" movsb\n"
- "8:\n"
- ".section .fixup,\"ax\"\n"
- "9: lea 0(%%eax,%0,4),%0\n"
-@@ -629,32 +742,36 @@ static unsigned long __copy_user_intel_n
- */
- unsigned long __copy_user_zeroing_intel(void *to, const void __user *from,
- unsigned long size);
--unsigned long __copy_user_intel(void __user *to, const void *from,
-+unsigned long __generic_copy_to_user_intel(void __user *to, const void *from,
-+ unsigned long size);
-+unsigned long __generic_copy_from_user_intel(void *to, const void __user *from,
- unsigned long size);
- unsigned long __copy_user_zeroing_intel_nocache(void *to,
- const void __user *from, unsigned long size);
- #endif /* CONFIG_X86_INTEL_USERCOPY */
-
- /* Generic arbitrary sized copy. */
--#define __copy_user(to, from, size) \
-+#define __copy_user(to, from, size, prefix, set, restore) \
- do { \
- int __d0, __d1, __d2; \
- __asm__ __volatile__( \
-+ set \
- " cmp $7,%0\n" \
- " jbe 1f\n" \
- " movl %1,%0\n" \
- " negl %0\n" \
- " andl $7,%0\n" \
- " subl %0,%3\n" \
-- "4: rep; movsb\n" \
-+ "4: rep; "prefix"movsb\n" \
- " movl %3,%0\n" \
- " shrl $2,%0\n" \
- " andl $3,%3\n" \
- " .align 2,0x90\n" \
-- "0: rep; movsl\n" \
-+ "0: rep; "prefix"movsl\n" \
- " movl %3,%0\n" \
-- "1: rep; movsb\n" \
-+ "1: rep; "prefix"movsb\n" \
- "2:\n" \
-+ restore \
- ".section .fixup,\"ax\"\n" \
- "5: addl %3,%0\n" \
- " jmp 2b\n" \
-@@ -682,14 +799,14 @@ do { \
- " negl %0\n" \
- " andl $7,%0\n" \
- " subl %0,%3\n" \
-- "4: rep; movsb\n" \
-+ "4: rep; "__copyuser_seg"movsb\n" \
- " movl %3,%0\n" \
- " shrl $2,%0\n" \
- " andl $3,%3\n" \
- " .align 2,0x90\n" \
-- "0: rep; movsl\n" \
-+ "0: rep; "__copyuser_seg"movsl\n" \
- " movl %3,%0\n" \
-- "1: rep; movsb\n" \
-+ "1: rep; "__copyuser_seg"movsb\n" \
- "2:\n" \
- ".section .fixup,\"ax\"\n" \
- "5: addl %3,%0\n" \
-@@ -775,9 +892,9 @@ survive:
- }
- #endif
- if (movsl_is_ok(to, from, n))
-- __copy_user(to, from, n);
-+ __copy_user(to, from, n, "", __COPYUSER_SET_ES, __COPYUSER_RESTORE_ES);
- else
-- n = __copy_user_intel(to, from, n);
-+ n = __generic_copy_to_user_intel(to, from, n);
- return n;
- }
- EXPORT_SYMBOL(__copy_to_user_ll);
-@@ -797,10 +914,9 @@ unsigned long __copy_from_user_ll_nozero
- unsigned long n)
- {
- if (movsl_is_ok(to, from, n))
-- __copy_user(to, from, n);
-+ __copy_user(to, from, n, __copyuser_seg, "", "");
- else
-- n = __copy_user_intel((void __user *)to,
-- (const void *)from, n);
-+ n = __generic_copy_from_user_intel(to, from, n);
- return n;
- }
- EXPORT_SYMBOL(__copy_from_user_ll_nozero);
-@@ -827,59 +943,38 @@ unsigned long __copy_from_user_ll_nocach
- if (n > 64 && cpu_has_xmm2)
- n = __copy_user_intel_nocache(to, from, n);
- else
-- __copy_user(to, from, n);
-+ __copy_user(to, from, n, __copyuser_seg, "", "");
- #else
-- __copy_user(to, from, n);
-+ __copy_user(to, from, n, __copyuser_seg, "", "");
- #endif
- return n;
- }
- EXPORT_SYMBOL(__copy_from_user_ll_nocache_nozero);
-
--/**
-- * copy_to_user: - Copy a block of data into user space.
-- * @to: Destination address, in user space.
-- * @from: Source address, in kernel space.
-- * @n: Number of bytes to copy.
-- *
-- * Context: User context only. This function may sleep.
-- *
-- * Copy data from kernel space to user space.
-- *
-- * Returns number of bytes that could not be copied.
-- * On success, this will be zero.
-- */
--unsigned long
--copy_to_user(void __user *to, const void *from, unsigned long n)
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+void __set_fs(mm_segment_t x)
- {
-- if (access_ok(VERIFY_WRITE, to, n))
-- n = __copy_to_user(to, from, n);
-- return n;
-+ switch (x.seg) {
-+ case 0:
-+ loadsegment(gs, 0);
-+ break;
-+ case TASK_SIZE_MAX:
-+ loadsegment(gs, __USER_DS);
-+ break;
-+ case -1UL:
-+ loadsegment(gs, __KERNEL_DS);
-+ break;
-+ default:
-+ BUG();
-+ }
-+ return;
- }
--EXPORT_SYMBOL(copy_to_user);
-+EXPORT_SYMBOL(__set_fs);
-
--/**
-- * copy_from_user: - Copy a block of data from user space.
-- * @to: Destination address, in kernel space.
-- * @from: Source address, in user space.
-- * @n: Number of bytes to copy.
-- *
-- * Context: User context only. This function may sleep.
-- *
-- * Copy data from user space to kernel space.
-- *
-- * Returns number of bytes that could not be copied.
-- * On success, this will be zero.
-- *
-- * If some data could not be copied, this function will pad the copied
-- * data to the requested size using zero bytes.
-- */
--unsigned long
--copy_from_user(void *to, const void __user *from, unsigned long n)
-+void set_fs(mm_segment_t x)
- {
-- if (access_ok(VERIFY_READ, from, n))
-- n = __copy_from_user(to, from, n);
-- else
-- memset(to, 0, n);
-- return n;
-+ current_thread_info()->addr_limit = x;
-+ __set_fs(x);
- }
--EXPORT_SYMBOL(copy_from_user);
-+EXPORT_SYMBOL(set_fs);
-+#endif
-diff -urNp linux-2.6.32.45/arch/x86/lib/usercopy_64.c linux-2.6.32.45/arch/x86/lib/usercopy_64.c
---- linux-2.6.32.45/arch/x86/lib/usercopy_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/lib/usercopy_64.c 2011-05-04 17:56:20.000000000 -0400
-@@ -42,6 +42,12 @@ long
- __strncpy_from_user(char *dst, const char __user *src, long count)
- {
- long res;
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
-+ src += PAX_USER_SHADOW_BASE;
-+#endif
-+
- __do_strncpy_from_user(dst, src, count, res);
- return res;
- }
-@@ -65,6 +71,12 @@ unsigned long __clear_user(void __user *
- {
- long __d0;
- might_fault();
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ if ((unsigned long)addr < PAX_USER_SHADOW_BASE)
-+ addr += PAX_USER_SHADOW_BASE;
-+#endif
-+
- /* no memory constraint because it doesn't change any memory gcc knows
- about */
- asm volatile(
-@@ -151,10 +163,18 @@ EXPORT_SYMBOL(strlen_user);
-
- unsigned long copy_in_user(void __user *to, const void __user *from, unsigned len)
- {
-- if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
-+ if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ if ((unsigned long)to < PAX_USER_SHADOW_BASE)
-+ to += PAX_USER_SHADOW_BASE;
-+ if ((unsigned long)from < PAX_USER_SHADOW_BASE)
-+ from += PAX_USER_SHADOW_BASE;
-+#endif
-+
- return copy_user_generic((__force void *)to, (__force void *)from, len);
-- }
-- return len;
-+ }
-+ return len;
- }
- EXPORT_SYMBOL(copy_in_user);
-
-diff -urNp linux-2.6.32.45/arch/x86/Makefile linux-2.6.32.45/arch/x86/Makefile
---- linux-2.6.32.45/arch/x86/Makefile 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/Makefile 2011-07-19 18:16:02.000000000 -0400
-@@ -44,6 +44,7 @@ ifeq ($(CONFIG_X86_32),y)
- else
- BITS := 64
- UTS_MACHINE := x86_64
-+ biarch := $(call cc-option,-m64)
- CHECKFLAGS += -D__x86_64__ -m64
-
- KBUILD_AFLAGS += -m64
-@@ -189,3 +190,12 @@ define archhelp
- echo ' FDARGS="..." arguments for the booted kernel'
- echo ' FDINITRD=file initrd for the booted kernel'
- endef
-+
-+define OLD_LD
-+
-+*** ${VERSION}.${PATCHLEVEL} PaX kernels no longer build correctly with old versions of binutils.
-+*** Please upgrade your binutils to 2.18 or newer
-+endef
-+
-+archprepare:
-+ $(if $(LDFLAGS_BUILD_ID),,$(error $(OLD_LD)))
-diff -urNp linux-2.6.32.45/arch/x86/mm/extable.c linux-2.6.32.45/arch/x86/mm/extable.c
---- linux-2.6.32.45/arch/x86/mm/extable.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/mm/extable.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1,14 +1,71 @@
- #include <linux/module.h>
- #include <linux/spinlock.h>
-+#include <linux/sort.h>
- #include <asm/uaccess.h>
-+#include <asm/pgtable.h>
-
-+/*
-+ * The exception table needs to be sorted so that the binary
-+ * search that we use to find entries in it works properly.
-+ * This is used both for the kernel exception table and for
-+ * the exception tables of modules that get loaded.
-+ */
-+static int cmp_ex(const void *a, const void *b)
-+{
-+ const struct exception_table_entry *x = a, *y = b;
-+
-+ /* avoid overflow */
-+ if (x->insn > y->insn)
-+ return 1;
-+ if (x->insn < y->insn)
-+ return -1;
-+ return 0;
-+}
-+
-+static void swap_ex(void *a, void *b, int size)
-+{
-+ struct exception_table_entry t, *x = a, *y = b;
-+
-+ t = *x;
-+
-+ pax_open_kernel();
-+ *x = *y;
-+ *y = t;
-+ pax_close_kernel();
-+}
-+
-+void sort_extable(struct exception_table_entry *start,
-+ struct exception_table_entry *finish)
-+{
-+ sort(start, finish - start, sizeof(struct exception_table_entry),
-+ cmp_ex, swap_ex);
-+}
-+
-+#ifdef CONFIG_MODULES
-+/*
-+ * If the exception table is sorted, any referring to the module init
-+ * will be at the beginning or the end.
-+ */
-+void trim_init_extable(struct module *m)
-+{
-+ /*trim the beginning*/
-+ while (m->num_exentries && within_module_init(m->extable[0].insn, m)) {
-+ m->extable++;
-+ m->num_exentries--;
-+ }
-+ /*trim the end*/
-+ while (m->num_exentries &&
-+ within_module_init(m->extable[m->num_exentries-1].insn, m))
-+ m->num_exentries--;
-+}
-+#endif /* CONFIG_MODULES */
-
- int fixup_exception(struct pt_regs *regs)
- {
- const struct exception_table_entry *fixup;
-
- #ifdef CONFIG_PNPBIOS
-- if (unlikely(SEGMENT_IS_PNP_CODE(regs->cs))) {
-+ if (unlikely(!v8086_mode(regs) && SEGMENT_IS_PNP_CODE(regs->cs))) {
- extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp;
- extern u32 pnp_bios_is_utter_crap;
- pnp_bios_is_utter_crap = 1;
-diff -urNp linux-2.6.32.45/arch/x86/mm/fault.c linux-2.6.32.45/arch/x86/mm/fault.c
---- linux-2.6.32.45/arch/x86/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/mm/fault.c 2011-08-17 20:06:44.000000000 -0400
-@@ -11,10 +11,19 @@
- #include <linux/kprobes.h> /* __kprobes, ... */
- #include <linux/mmiotrace.h> /* kmmio_handler, ... */
- #include <linux/perf_event.h> /* perf_sw_event */
-+#include <linux/unistd.h>
-+#include <linux/compiler.h>
-
- #include <asm/traps.h> /* dotraplinkage, ... */
- #include <asm/pgalloc.h> /* pgd_*(), ... */
- #include <asm/kmemcheck.h> /* kmemcheck_*(), ... */
-+#include <asm/vsyscall.h>
-+#include <asm/tlbflush.h>
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+#include <asm/stacktrace.h>
-+#include "../kernel/dumpstack.h"
-+#endif
-
- /*
- * Page fault error code bits:
-@@ -51,7 +60,7 @@ static inline int notify_page_fault(stru
- int ret = 0;
-
- /* kprobe_running() needs smp_processor_id() */
-- if (kprobes_built_in() && !user_mode_vm(regs)) {
-+ if (kprobes_built_in() && !user_mode(regs)) {
- preempt_disable();
- if (kprobe_running() && kprobe_fault_handler(regs, 14))
- ret = 1;
-@@ -112,7 +121,10 @@ check_prefetch_opcode(struct pt_regs *re
- return !instr_lo || (instr_lo>>1) == 1;
- case 0x00:
- /* Prefetch instruction is 0x0F0D or 0x0F18 */
-- if (probe_kernel_address(instr, opcode))
-+ if (user_mode(regs)) {
-+ if (__copy_from_user_inatomic(&opcode, (__force unsigned char __user *)(instr), 1))
-+ return 0;
-+ } else if (probe_kernel_address(instr, opcode))
- return 0;
-
- *prefetch = (instr_lo == 0xF) &&
-@@ -146,7 +158,10 @@ is_prefetch(struct pt_regs *regs, unsign
- while (instr < max_instr) {
- unsigned char opcode;
-
-- if (probe_kernel_address(instr, opcode))
-+ if (user_mode(regs)) {
-+ if (__copy_from_user_inatomic(&opcode, (__force unsigned char __user *)(instr), 1))
-+ break;
-+ } else if (probe_kernel_address(instr, opcode))
- break;
-
- instr++;
-@@ -172,6 +187,30 @@ force_sig_info_fault(int si_signo, int s
- force_sig_info(si_signo, &info, tsk);
- }
-
-+#ifdef CONFIG_PAX_EMUTRAMP
-+static int pax_handle_fetch_fault(struct pt_regs *regs);
-+#endif
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+static inline pmd_t * pax_get_pmd(struct mm_struct *mm, unsigned long address)
-+{
-+ pgd_t *pgd;
-+ pud_t *pud;
-+ pmd_t *pmd;
-+
-+ pgd = pgd_offset(mm, address);
-+ if (!pgd_present(*pgd))
-+ return NULL;
-+ pud = pud_offset(pgd, address);
-+ if (!pud_present(*pud))
-+ return NULL;
-+ pmd = pmd_offset(pud, address);
-+ if (!pmd_present(*pmd))
-+ return NULL;
-+ return pmd;
-+}
-+#endif
-+
- DEFINE_SPINLOCK(pgd_lock);
- LIST_HEAD(pgd_list);
-
-@@ -224,11 +263,24 @@ void vmalloc_sync_all(void)
- address += PMD_SIZE) {
-
- unsigned long flags;
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ unsigned long cpu;
-+#else
- struct page *page;
-+#endif
-
- spin_lock_irqsave(&pgd_lock, flags);
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ for (cpu = 0; cpu < NR_CPUS; ++cpu) {
-+ pgd_t *pgd = get_cpu_pgd(cpu);
-+#else
- list_for_each_entry(page, &pgd_list, lru) {
-- if (!vmalloc_sync_one(page_address(page), address))
-+ pgd_t *pgd = page_address(page);
-+#endif
-+
-+ if (!vmalloc_sync_one(pgd, address))
- break;
- }
- spin_unlock_irqrestore(&pgd_lock, flags);
-@@ -258,6 +310,11 @@ static noinline int vmalloc_fault(unsign
- * an interrupt in the middle of a task switch..
- */
- pgd_paddr = read_cr3();
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (pgd_paddr & PHYSICAL_PAGE_MASK));
-+#endif
-+
- pmd_k = vmalloc_sync_one(__va(pgd_paddr), address);
- if (!pmd_k)
- return -1;
-@@ -332,15 +389,27 @@ void vmalloc_sync_all(void)
-
- const pgd_t *pgd_ref = pgd_offset_k(address);
- unsigned long flags;
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ unsigned long cpu;
-+#else
- struct page *page;
-+#endif
-
- if (pgd_none(*pgd_ref))
- continue;
-
- spin_lock_irqsave(&pgd_lock, flags);
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ for (cpu = 0; cpu < NR_CPUS; ++cpu) {
-+ pgd_t *pgd = pgd_offset_cpu(cpu, address);
-+#else
- list_for_each_entry(page, &pgd_list, lru) {
- pgd_t *pgd;
- pgd = (pgd_t *)page_address(page) + pgd_index(address);
-+#endif
-+
- if (pgd_none(*pgd))
- set_pgd(pgd, *pgd_ref);
- else
-@@ -373,7 +442,14 @@ static noinline int vmalloc_fault(unsign
- * happen within a race in page table update. In the later
- * case just flush:
- */
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (read_cr3() & PHYSICAL_PAGE_MASK));
-+ pgd = pgd_offset_cpu(smp_processor_id(), address);
-+#else
- pgd = pgd_offset(current->active_mm, address);
-+#endif
-+
- pgd_ref = pgd_offset_k(address);
- if (pgd_none(*pgd_ref))
- return -1;
-@@ -535,7 +611,7 @@ static int is_errata93(struct pt_regs *r
- static int is_errata100(struct pt_regs *regs, unsigned long address)
- {
- #ifdef CONFIG_X86_64
-- if ((regs->cs == __USER32_CS || (regs->cs & (1<<2))) && (address >> 32))
-+ if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)) && (address >> 32))
- return 1;
- #endif
- return 0;
-@@ -562,7 +638,7 @@ static int is_f00f_bug(struct pt_regs *r
- }
-
- static const char nx_warning[] = KERN_CRIT
--"kernel tried to execute NX-protected page - exploit attempt? (uid: %d)\n";
-+"kernel tried to execute NX-protected page - exploit attempt? (uid: %d, task: %s, pid: %d)\n";
-
- static void
- show_fault_oops(struct pt_regs *regs, unsigned long error_code,
-@@ -571,15 +647,26 @@ show_fault_oops(struct pt_regs *regs, un
- if (!oops_may_print())
- return;
-
-- if (error_code & PF_INSTR) {
-+ if (nx_enabled && (error_code & PF_INSTR)) {
- unsigned int level;
-
- pte_t *pte = lookup_address(address, &level);
-
- if (pte && pte_present(*pte) && !pte_exec(*pte))
-- printk(nx_warning, current_uid());
-+ printk(nx_warning, current_uid(), current->comm, task_pid_nr(current));
- }
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+ if (init_mm.start_code <= address && address < init_mm.end_code) {
-+ if (current->signal->curr_ip)
-+ printk(KERN_ERR "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
-+ ¤t->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
-+ else
-+ printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
-+ current->comm, task_pid_nr(current), current_uid(), current_euid());
-+ }
-+#endif
-+
- printk(KERN_ALERT "BUG: unable to handle kernel ");
- if (address < PAGE_SIZE)
- printk(KERN_CONT "NULL pointer dereference");
-@@ -704,6 +791,70 @@ __bad_area_nosemaphore(struct pt_regs *r
- unsigned long address, int si_code)
- {
- struct task_struct *tsk = current;
-+#if defined(CONFIG_X86_64) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+ struct mm_struct *mm = tsk->mm;
-+#endif
-+
-+#ifdef CONFIG_X86_64
-+ if (mm && (error_code & PF_INSTR) && mm->context.vdso) {
-+ if (regs->ip == (unsigned long)vgettimeofday) {
-+ regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_gettimeofday);
-+ return;
-+ } else if (regs->ip == (unsigned long)vtime) {
-+ regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_time);
-+ return;
-+ } else if (regs->ip == (unsigned long)vgetcpu) {
-+ regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, getcpu);
-+ return;
-+ }
-+ }
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+ if (mm && (error_code & PF_USER)) {
-+ unsigned long ip = regs->ip;
-+
-+ if (v8086_mode(regs))
-+ ip = ((regs->cs & 0xffff) << 4) + (ip & 0xffff);
-+
-+ /*
-+ * It's possible to have interrupts off here:
-+ */
-+ local_irq_enable();
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) &&
-+ ((nx_enabled && (error_code & PF_INSTR)) || (!(error_code & (PF_PROT | PF_WRITE)) && ip == address))) {
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+ switch (pax_handle_fetch_fault(regs)) {
-+ case 2:
-+ return;
-+ }
-+#endif
-+
-+ pax_report_fault(regs, (void *)ip, (void *)regs->sp);
-+ do_group_exit(SIGKILL);
-+ }
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && !(error_code & (PF_PROT | PF_WRITE)) && (ip + SEGMEXEC_TASK_SIZE == address)) {
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+ switch (pax_handle_fetch_fault(regs)) {
-+ case 2:
-+ return;
-+ }
-+#endif
-+
-+ pax_report_fault(regs, (void *)ip, (void *)regs->sp);
-+ do_group_exit(SIGKILL);
-+ }
-+#endif
-+
-+ }
-+#endif
-
- /* User mode accesses just cause a SIGSEGV */
- if (error_code & PF_USER) {
-@@ -857,6 +1008,99 @@ static int spurious_fault_check(unsigned
- return 1;
- }
-
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
-+static int pax_handle_pageexec_fault(struct pt_regs *regs, struct mm_struct *mm, unsigned long address, unsigned long error_code)
-+{
-+ pte_t *pte;
-+ pmd_t *pmd;
-+ spinlock_t *ptl;
-+ unsigned char pte_mask;
-+
-+ if (nx_enabled || (error_code & (PF_PROT|PF_USER)) != (PF_PROT|PF_USER) || v8086_mode(regs) ||
-+ !(mm->pax_flags & MF_PAX_PAGEEXEC))
-+ return 0;
-+
-+ /* PaX: it's our fault, let's handle it if we can */
-+
-+ /* PaX: take a look at read faults before acquiring any locks */
-+ if (unlikely(!(error_code & PF_WRITE) && (regs->ip == address))) {
-+ /* instruction fetch attempt from a protected page in user mode */
-+ up_read(&mm->mmap_sem);
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+ switch (pax_handle_fetch_fault(regs)) {
-+ case 2:
-+ return 1;
-+ }
-+#endif
-+
-+ pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
-+ do_group_exit(SIGKILL);
-+ }
-+
-+ pmd = pax_get_pmd(mm, address);
-+ if (unlikely(!pmd))
-+ return 0;
-+
-+ pte = pte_offset_map_lock(mm, pmd, address, &ptl);
-+ if (unlikely(!(pte_val(*pte) & _PAGE_PRESENT) || pte_user(*pte))) {
-+ pte_unmap_unlock(pte, ptl);
-+ return 0;
-+ }
-+
-+ if (unlikely((error_code & PF_WRITE) && !pte_write(*pte))) {
-+ /* write attempt to a protected page in user mode */
-+ pte_unmap_unlock(pte, ptl);
-+ return 0;
-+ }
-+
-+#ifdef CONFIG_SMP
-+ if (likely(address > get_limit(regs->cs) && cpu_isset(smp_processor_id(), mm->context.cpu_user_cs_mask)))
-+#else
-+ if (likely(address > get_limit(regs->cs)))
-+#endif
-+ {
-+ set_pte(pte, pte_mkread(*pte));
-+ __flush_tlb_one(address);
-+ pte_unmap_unlock(pte, ptl);
-+ up_read(&mm->mmap_sem);
-+ return 1;
-+ }
-+
-+ pte_mask = _PAGE_ACCESSED | _PAGE_USER | ((error_code & PF_WRITE) << (_PAGE_BIT_DIRTY-1));
-+
-+ /*
-+ * PaX: fill DTLB with user rights and retry
-+ */
-+ __asm__ __volatile__ (
-+ "orb %2,(%1)\n"
-+#if defined(CONFIG_M586) || defined(CONFIG_M586TSC)
-+/*
-+ * PaX: let this uncommented 'invlpg' remind us on the behaviour of Intel's
-+ * (and AMD's) TLBs. namely, they do not cache PTEs that would raise *any*
-+ * page fault when examined during a TLB load attempt. this is true not only
-+ * for PTEs holding a non-present entry but also present entries that will
-+ * raise a page fault (such as those set up by PaX, or the copy-on-write
-+ * mechanism). in effect it means that we do *not* need to flush the TLBs
-+ * for our target pages since their PTEs are simply not in the TLBs at all.
-+
-+ * the best thing in omitting it is that we gain around 15-20% speed in the
-+ * fast path of the page fault handler and can get rid of tracing since we
-+ * can no longer flush unintended entries.
-+ */
-+ "invlpg (%0)\n"
-+#endif
-+ __copyuser_seg"testb $0,(%0)\n"
-+ "xorb %3,(%1)\n"
-+ :
-+ : "r" (address), "r" (pte), "q" (pte_mask), "i" (_PAGE_USER)
-+ : "memory", "cc");
-+ pte_unmap_unlock(pte, ptl);
-+ up_read(&mm->mmap_sem);
-+ return 1;
-+}
-+#endif
-+
- /*
- * Handle a spurious fault caused by a stale TLB entry.
- *
-@@ -923,6 +1167,9 @@ int show_unhandled_signals = 1;
- static inline int
- access_error(unsigned long error_code, int write, struct vm_area_struct *vma)
- {
-+ if (nx_enabled && (error_code & PF_INSTR) && !(vma->vm_flags & VM_EXEC))
-+ return 1;
-+
- if (write) {
- /* write, present and write, not present: */
- if (unlikely(!(vma->vm_flags & VM_WRITE)))
-@@ -956,17 +1203,31 @@ do_page_fault(struct pt_regs *regs, unsi
- {
- struct vm_area_struct *vma;
- struct task_struct *tsk;
-- unsigned long address;
- struct mm_struct *mm;
- int write;
- int fault;
-
-+ /* Get the faulting address: */
-+ unsigned long address = read_cr2();
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ if (!user_mode(regs) && address < 2 * PAX_USER_SHADOW_BASE) {
-+ if (!search_exception_tables(regs->ip)) {
-+ bad_area_nosemaphore(regs, error_code, address);
-+ return;
-+ }
-+ if (address < PAX_USER_SHADOW_BASE) {
-+ printk(KERN_ERR "PAX: please report this to pageexec@freemail.hu\n");
-+ printk(KERN_ERR "PAX: faulting IP: %pA\n", (void *)regs->ip);
-+ show_trace_log_lvl(NULL, NULL, (void *)regs->sp, regs->bp, KERN_ERR);
-+ } else
-+ address -= PAX_USER_SHADOW_BASE;
-+ }
-+#endif
-+
- tsk = current;
- mm = tsk->mm;
-
-- /* Get the faulting address: */
-- address = read_cr2();
--
- /*
- * Detect and handle instructions that would cause a page fault for
- * both a tracked kernel page and a userspace page.
-@@ -1026,7 +1287,7 @@ do_page_fault(struct pt_regs *regs, unsi
- * User-mode registers count as a user access even for any
- * potential system fault or CPU buglet:
- */
-- if (user_mode_vm(regs)) {
-+ if (user_mode(regs)) {
- local_irq_enable();
- error_code |= PF_USER;
- } else {
-@@ -1080,6 +1341,11 @@ do_page_fault(struct pt_regs *regs, unsi
- might_sleep();
- }
-
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
-+ if (pax_handle_pageexec_fault(regs, mm, address, error_code))
-+ return;
-+#endif
-+
- vma = find_vma(mm, address);
- if (unlikely(!vma)) {
- bad_area(regs, error_code, address);
-@@ -1091,18 +1357,24 @@ do_page_fault(struct pt_regs *regs, unsi
- bad_area(regs, error_code, address);
- return;
- }
-- if (error_code & PF_USER) {
-- /*
-- * Accessing the stack below %sp is always a bug.
-- * The large cushion allows instructions like enter
-- * and pusha to work. ("enter $65535, $31" pushes
-- * 32 pointers and then decrements %sp by 65535.)
-- */
-- if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < regs->sp)) {
-- bad_area(regs, error_code, address);
-- return;
-- }
-+ /*
-+ * Accessing the stack below %sp is always a bug.
-+ * The large cushion allows instructions like enter
-+ * and pusha to work. ("enter $65535, $31" pushes
-+ * 32 pointers and then decrements %sp by 65535.)
-+ */
-+ if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < task_pt_regs(tsk)->sp)) {
-+ bad_area(regs, error_code, address);
-+ return;
- }
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (unlikely((mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end - SEGMEXEC_TASK_SIZE - 1 < address - SEGMEXEC_TASK_SIZE - 1)) {
-+ bad_area(regs, error_code, address);
-+ return;
-+ }
-+#endif
-+
- if (unlikely(expand_stack(vma, address))) {
- bad_area(regs, error_code, address);
- return;
-@@ -1146,3 +1418,199 @@ good_area:
-
- up_read(&mm->mmap_sem);
- }
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+static int pax_handle_fetch_fault_32(struct pt_regs *regs)
-+{
-+ int err;
-+
-+ do { /* PaX: gcc trampoline emulation #1 */
-+ unsigned char mov1, mov2;
-+ unsigned short jmp;
-+ unsigned int addr1, addr2;
-+
-+#ifdef CONFIG_X86_64
-+ if ((regs->ip + 11) >> 32)
-+ break;
-+#endif
-+
-+ err = get_user(mov1, (unsigned char __user *)regs->ip);
-+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
-+ err |= get_user(mov2, (unsigned char __user *)(regs->ip + 5));
-+ err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
-+ err |= get_user(jmp, (unsigned short __user *)(regs->ip + 10));
-+
-+ if (err)
-+ break;
-+
-+ if (mov1 == 0xB9 && mov2 == 0xB8 && jmp == 0xE0FF) {
-+ regs->cx = addr1;
-+ regs->ax = addr2;
-+ regs->ip = addr2;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: gcc trampoline emulation #2 */
-+ unsigned char mov, jmp;
-+ unsigned int addr1, addr2;
-+
-+#ifdef CONFIG_X86_64
-+ if ((regs->ip + 9) >> 32)
-+ break;
-+#endif
-+
-+ err = get_user(mov, (unsigned char __user *)regs->ip);
-+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
-+ err |= get_user(jmp, (unsigned char __user *)(regs->ip + 5));
-+ err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
-+
-+ if (err)
-+ break;
-+
-+ if (mov == 0xB9 && jmp == 0xE9) {
-+ regs->cx = addr1;
-+ regs->ip = (unsigned int)(regs->ip + addr2 + 10);
-+ return 2;
-+ }
-+ } while (0);
-+
-+ return 1; /* PaX in action */
-+}
-+
-+#ifdef CONFIG_X86_64
-+static int pax_handle_fetch_fault_64(struct pt_regs *regs)
-+{
-+ int err;
-+
-+ do { /* PaX: gcc trampoline emulation #1 */
-+ unsigned short mov1, mov2, jmp1;
-+ unsigned char jmp2;
-+ unsigned int addr1;
-+ unsigned long addr2;
-+
-+ err = get_user(mov1, (unsigned short __user *)regs->ip);
-+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 2));
-+ err |= get_user(mov2, (unsigned short __user *)(regs->ip + 6));
-+ err |= get_user(addr2, (unsigned long __user *)(regs->ip + 8));
-+ err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 16));
-+ err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 18));
-+
-+ if (err)
-+ break;
-+
-+ if (mov1 == 0xBB41 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
-+ regs->r11 = addr1;
-+ regs->r10 = addr2;
-+ regs->ip = addr1;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ do { /* PaX: gcc trampoline emulation #2 */
-+ unsigned short mov1, mov2, jmp1;
-+ unsigned char jmp2;
-+ unsigned long addr1, addr2;
-+
-+ err = get_user(mov1, (unsigned short __user *)regs->ip);
-+ err |= get_user(addr1, (unsigned long __user *)(regs->ip + 2));
-+ err |= get_user(mov2, (unsigned short __user *)(regs->ip + 10));
-+ err |= get_user(addr2, (unsigned long __user *)(regs->ip + 12));
-+ err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 20));
-+ err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 22));
-+
-+ if (err)
-+ break;
-+
-+ if (mov1 == 0xBB49 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
-+ regs->r11 = addr1;
-+ regs->r10 = addr2;
-+ regs->ip = addr1;
-+ return 2;
-+ }
-+ } while (0);
-+
-+ return 1; /* PaX in action */
-+}
-+#endif
-+
-+/*
-+ * PaX: decide what to do with offenders (regs->ip = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ * 2 when gcc trampoline was detected
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+ if (v8086_mode(regs))
-+ return 1;
-+
-+ if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
-+ return 1;
-+
-+#ifdef CONFIG_X86_32
-+ return pax_handle_fetch_fault_32(regs);
-+#else
-+ if (regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))
-+ return pax_handle_fetch_fault_32(regs);
-+ else
-+ return pax_handle_fetch_fault_64(regs);
-+#endif
-+}
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+void pax_report_insns(void *pc, void *sp)
-+{
-+ long i;
-+
-+ printk(KERN_ERR "PAX: bytes at PC: ");
-+ for (i = 0; i < 20; i++) {
-+ unsigned char c;
-+ if (get_user(c, (__force unsigned char __user *)pc+i))
-+ printk(KERN_CONT "?? ");
-+ else
-+ printk(KERN_CONT "%02x ", c);
-+ }
-+ printk("\n");
-+
-+ printk(KERN_ERR "PAX: bytes at SP-%lu: ", (unsigned long)sizeof(long));
-+ for (i = -1; i < 80 / (long)sizeof(long); i++) {
-+ unsigned long c;
-+ if (get_user(c, (__force unsigned long __user *)sp+i))
-+#ifdef CONFIG_X86_32
-+ printk(KERN_CONT "???????? ");
-+#else
-+ printk(KERN_CONT "???????????????? ");
-+#endif
-+ else
-+ printk(KERN_CONT "%0*lx ", 2 * (int)sizeof(long), c);
-+ }
-+ printk("\n");
-+}
-+#endif
-+
-+/**
-+ * probe_kernel_write(): safely attempt to write to a location
-+ * @dst: address to write to
-+ * @src: pointer to the data that shall be written
-+ * @size: size of the data chunk
-+ *
-+ * Safely write to address @dst from the buffer at @src. If a kernel fault
-+ * happens, handle that and return -EFAULT.
-+ */
-+long notrace probe_kernel_write(void *dst, const void *src, size_t size)
-+{
-+ long ret;
-+ mm_segment_t old_fs = get_fs();
-+
-+ set_fs(KERNEL_DS);
-+ pagefault_disable();
-+ pax_open_kernel();
-+ ret = __copy_to_user_inatomic((__force void __user *)dst, src, size);
-+ pax_close_kernel();
-+ pagefault_enable();
-+ set_fs(old_fs);
-+
-+ return ret ? -EFAULT : 0;
-+}
-diff -urNp linux-2.6.32.45/arch/x86/mm/gup.c linux-2.6.32.45/arch/x86/mm/gup.c
---- linux-2.6.32.45/arch/x86/mm/gup.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/mm/gup.c 2011-04-17 15:56:46.000000000 -0400
-@@ -237,7 +237,7 @@ int __get_user_pages_fast(unsigned long
- addr = start;
- len = (unsigned long) nr_pages << PAGE_SHIFT;
- end = start + len;
-- if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
-+ if (unlikely(!__access_ok(write ? VERIFY_WRITE : VERIFY_READ,
- (void __user *)start, len)))
- return 0;
-
-diff -urNp linux-2.6.32.45/arch/x86/mm/highmem_32.c linux-2.6.32.45/arch/x86/mm/highmem_32.c
---- linux-2.6.32.45/arch/x86/mm/highmem_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/mm/highmem_32.c 2011-04-17 15:56:46.000000000 -0400
-@@ -43,7 +43,10 @@ void *kmap_atomic_prot(struct page *page
- idx = type + KM_TYPE_NR*smp_processor_id();
- vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
- BUG_ON(!pte_none(*(kmap_pte-idx)));
-+
-+ pax_open_kernel();
- set_pte(kmap_pte-idx, mk_pte(page, prot));
-+ pax_close_kernel();
-
- return (void *)vaddr;
- }
-diff -urNp linux-2.6.32.45/arch/x86/mm/hugetlbpage.c linux-2.6.32.45/arch/x86/mm/hugetlbpage.c
---- linux-2.6.32.45/arch/x86/mm/hugetlbpage.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/mm/hugetlbpage.c 2011-04-17 15:56:46.000000000 -0400
-@@ -267,13 +267,20 @@ static unsigned long hugetlb_get_unmappe
- struct hstate *h = hstate_file(file);
- struct mm_struct *mm = current->mm;
- struct vm_area_struct *vma;
-- unsigned long start_addr;
-+ unsigned long start_addr, pax_task_size = TASK_SIZE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+ pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+ pax_task_size -= PAGE_SIZE;
-
- if (len > mm->cached_hole_size) {
-- start_addr = mm->free_area_cache;
-+ start_addr = mm->free_area_cache;
- } else {
-- start_addr = TASK_UNMAPPED_BASE;
-- mm->cached_hole_size = 0;
-+ start_addr = mm->mmap_base;
-+ mm->cached_hole_size = 0;
- }
-
- full_search:
-@@ -281,26 +288,27 @@ full_search:
-
- for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
- /* At this point: (!vma || addr < vma->vm_end). */
-- if (TASK_SIZE - len < addr) {
-+ if (pax_task_size - len < addr) {
- /*
- * Start a new search - just in case we missed
- * some holes.
- */
-- if (start_addr != TASK_UNMAPPED_BASE) {
-- start_addr = TASK_UNMAPPED_BASE;
-+ if (start_addr != mm->mmap_base) {
-+ start_addr = mm->mmap_base;
- mm->cached_hole_size = 0;
- goto full_search;
- }
- return -ENOMEM;
- }
-- if (!vma || addr + len <= vma->vm_start) {
-- mm->free_area_cache = addr + len;
-- return addr;
-- }
-+ if (check_heap_stack_gap(vma, addr, len))
-+ break;
- if (addr + mm->cached_hole_size < vma->vm_start)
- mm->cached_hole_size = vma->vm_start - addr;
- addr = ALIGN(vma->vm_end, huge_page_size(h));
- }
-+
-+ mm->free_area_cache = addr + len;
-+ return addr;
- }
-
- static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
-@@ -309,10 +317,9 @@ static unsigned long hugetlb_get_unmappe
- {
- struct hstate *h = hstate_file(file);
- struct mm_struct *mm = current->mm;
-- struct vm_area_struct *vma, *prev_vma;
-- unsigned long base = mm->mmap_base, addr = addr0;
-+ struct vm_area_struct *vma;
-+ unsigned long base = mm->mmap_base, addr;
- unsigned long largest_hole = mm->cached_hole_size;
-- int first_time = 1;
-
- /* don't allow allocations above current base */
- if (mm->free_area_cache > base)
-@@ -322,64 +329,63 @@ static unsigned long hugetlb_get_unmappe
- largest_hole = 0;
- mm->free_area_cache = base;
- }
--try_again:
-+
- /* make sure it can fit in the remaining address space */
- if (mm->free_area_cache < len)
- goto fail;
-
- /* either no address requested or cant fit in requested address hole */
-- addr = (mm->free_area_cache - len) & huge_page_mask(h);
-+ addr = (mm->free_area_cache - len);
- do {
-+ addr &= huge_page_mask(h);
-+ vma = find_vma(mm, addr);
- /*
- * Lookup failure means no vma is above this address,
- * i.e. return with success:
-- */
-- if (!(vma = find_vma_prev(mm, addr, &prev_vma)))
-- return addr;
--
-- /*
- * new region fits between prev_vma->vm_end and
- * vma->vm_start, use it:
- */
-- if (addr + len <= vma->vm_start &&
-- (!prev_vma || (addr >= prev_vma->vm_end))) {
-+ if (check_heap_stack_gap(vma, addr, len)) {
- /* remember the address as a hint for next time */
-- mm->cached_hole_size = largest_hole;
-- return (mm->free_area_cache = addr);
-- } else {
-- /* pull free_area_cache down to the first hole */
-- if (mm->free_area_cache == vma->vm_end) {
-- mm->free_area_cache = vma->vm_start;
-- mm->cached_hole_size = largest_hole;
-- }
-+ mm->cached_hole_size = largest_hole;
-+ return (mm->free_area_cache = addr);
-+ }
-+ /* pull free_area_cache down to the first hole */
-+ if (mm->free_area_cache == vma->vm_end) {
-+ mm->free_area_cache = vma->vm_start;
-+ mm->cached_hole_size = largest_hole;
- }
-
- /* remember the largest hole we saw so far */
- if (addr + largest_hole < vma->vm_start)
-- largest_hole = vma->vm_start - addr;
-+ largest_hole = vma->vm_start - addr;
-
- /* try just below the current vma->vm_start */
-- addr = (vma->vm_start - len) & huge_page_mask(h);
-- } while (len <= vma->vm_start);
-+ addr = skip_heap_stack_gap(vma, len);
-+ } while (!IS_ERR_VALUE(addr));
-
- fail:
- /*
-- * if hint left us with no space for the requested
-- * mapping then try again:
-- */
-- if (first_time) {
-- mm->free_area_cache = base;
-- largest_hole = 0;
-- first_time = 0;
-- goto try_again;
-- }
-- /*
- * A failed mmap() very likely causes application failure,
- * so fall back to the bottom-up function here. This scenario
- * can happen with large stack limits and large mmap()
- * allocations.
- */
-- mm->free_area_cache = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+ mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
-+ else
-+#endif
-+
-+ mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base += mm->delta_mmap;
-+#endif
-+
-+ mm->free_area_cache = mm->mmap_base;
- mm->cached_hole_size = ~0UL;
- addr = hugetlb_get_unmapped_area_bottomup(file, addr0,
- len, pgoff, flags);
-@@ -387,6 +393,7 @@ fail:
- /*
- * Restore the topdown base:
- */
-+ mm->mmap_base = base;
- mm->free_area_cache = base;
- mm->cached_hole_size = ~0UL;
-
-@@ -400,10 +407,19 @@ hugetlb_get_unmapped_area(struct file *f
- struct hstate *h = hstate_file(file);
- struct mm_struct *mm = current->mm;
- struct vm_area_struct *vma;
-+ unsigned long pax_task_size = TASK_SIZE;
-
- if (len & ~huge_page_mask(h))
- return -EINVAL;
-- if (len > TASK_SIZE)
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+ pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+ pax_task_size -= PAGE_SIZE;
-+
-+ if (len > pax_task_size)
- return -ENOMEM;
-
- if (flags & MAP_FIXED) {
-@@ -415,8 +431,7 @@ hugetlb_get_unmapped_area(struct file *f
- if (addr) {
- addr = ALIGN(addr, huge_page_size(h));
- vma = find_vma(mm, addr);
-- if (TASK_SIZE - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-+ if (pax_task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
- return addr;
- }
- if (mm->get_unmapped_area == arch_get_unmapped_area)
-diff -urNp linux-2.6.32.45/arch/x86/mm/init_32.c linux-2.6.32.45/arch/x86/mm/init_32.c
---- linux-2.6.32.45/arch/x86/mm/init_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/mm/init_32.c 2011-04-17 15:56:46.000000000 -0400
-@@ -72,36 +72,6 @@ static __init void *alloc_low_page(void)
- }
-
- /*
-- * Creates a middle page table and puts a pointer to it in the
-- * given global directory entry. This only returns the gd entry
-- * in non-PAE compilation mode, since the middle layer is folded.
-- */
--static pmd_t * __init one_md_table_init(pgd_t *pgd)
--{
-- pud_t *pud;
-- pmd_t *pmd_table;
--
--#ifdef CONFIG_X86_PAE
-- if (!(pgd_val(*pgd) & _PAGE_PRESENT)) {
-- if (after_bootmem)
-- pmd_table = (pmd_t *)alloc_bootmem_pages(PAGE_SIZE);
-- else
-- pmd_table = (pmd_t *)alloc_low_page();
-- paravirt_alloc_pmd(&init_mm, __pa(pmd_table) >> PAGE_SHIFT);
-- set_pgd(pgd, __pgd(__pa(pmd_table) | _PAGE_PRESENT));
-- pud = pud_offset(pgd, 0);
-- BUG_ON(pmd_table != pmd_offset(pud, 0));
--
-- return pmd_table;
-- }
--#endif
-- pud = pud_offset(pgd, 0);
-- pmd_table = pmd_offset(pud, 0);
--
-- return pmd_table;
--}
--
--/*
- * Create a page table and place a pointer to it in a middle page
- * directory entry:
- */
-@@ -121,13 +91,28 @@ static pte_t * __init one_page_table_ini
- page_table = (pte_t *)alloc_low_page();
-
- paravirt_alloc_pte(&init_mm, __pa(page_table) >> PAGE_SHIFT);
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+ set_pmd(pmd, __pmd(__pa(page_table) | _KERNPG_TABLE));
-+#else
- set_pmd(pmd, __pmd(__pa(page_table) | _PAGE_TABLE));
-+#endif
- BUG_ON(page_table != pte_offset_kernel(pmd, 0));
- }
-
- return pte_offset_kernel(pmd, 0);
- }
-
-+static pmd_t * __init one_md_table_init(pgd_t *pgd)
-+{
-+ pud_t *pud;
-+ pmd_t *pmd_table;
-+
-+ pud = pud_offset(pgd, 0);
-+ pmd_table = pmd_offset(pud, 0);
-+
-+ return pmd_table;
-+}
-+
- pmd_t * __init populate_extra_pmd(unsigned long vaddr)
- {
- int pgd_idx = pgd_index(vaddr);
-@@ -201,6 +186,7 @@ page_table_range_init(unsigned long star
- int pgd_idx, pmd_idx;
- unsigned long vaddr;
- pgd_t *pgd;
-+ pud_t *pud;
- pmd_t *pmd;
- pte_t *pte = NULL;
-
-@@ -210,8 +196,13 @@ page_table_range_init(unsigned long star
- pgd = pgd_base + pgd_idx;
-
- for ( ; (pgd_idx < PTRS_PER_PGD) && (vaddr != end); pgd++, pgd_idx++) {
-- pmd = one_md_table_init(pgd);
-- pmd = pmd + pmd_index(vaddr);
-+ pud = pud_offset(pgd, vaddr);
-+ pmd = pmd_offset(pud, vaddr);
-+
-+#ifdef CONFIG_X86_PAE
-+ paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
-+#endif
-+
- for (; (pmd_idx < PTRS_PER_PMD) && (vaddr != end);
- pmd++, pmd_idx++) {
- pte = page_table_kmap_check(one_page_table_init(pmd),
-@@ -223,11 +214,20 @@ page_table_range_init(unsigned long star
- }
- }
-
--static inline int is_kernel_text(unsigned long addr)
-+static inline int is_kernel_text(unsigned long start, unsigned long end)
- {
-- if (addr >= PAGE_OFFSET && addr <= (unsigned long)__init_end)
-- return 1;
-- return 0;
-+ if ((start > ktla_ktva((unsigned long)_etext) ||
-+ end <= ktla_ktva((unsigned long)_stext)) &&
-+ (start > ktla_ktva((unsigned long)_einittext) ||
-+ end <= ktla_ktva((unsigned long)_sinittext)) &&
-+
-+#ifdef CONFIG_ACPI_SLEEP
-+ (start > (unsigned long)__va(acpi_wakeup_address) + 0x4000 || end <= (unsigned long)__va(acpi_wakeup_address)) &&
-+#endif
-+
-+ (start > (unsigned long)__va(0xfffff) || end <= (unsigned long)__va(0xc0000)))
-+ return 0;
-+ return 1;
- }
-
- /*
-@@ -243,9 +243,10 @@ kernel_physical_mapping_init(unsigned lo
- int use_pse = page_size_mask == (1<<PG_LEVEL_2M);
- unsigned long start_pfn, end_pfn;
- pgd_t *pgd_base = swapper_pg_dir;
-- int pgd_idx, pmd_idx, pte_ofs;
-+ unsigned int pgd_idx, pmd_idx, pte_ofs;
- unsigned long pfn;
- pgd_t *pgd;
-+ pud_t *pud;
- pmd_t *pmd;
- pte_t *pte;
- unsigned pages_2m, pages_4k;
-@@ -278,8 +279,13 @@ repeat:
- pfn = start_pfn;
- pgd_idx = pgd_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
- pgd = pgd_base + pgd_idx;
-- for (; pgd_idx < PTRS_PER_PGD; pgd++, pgd_idx++) {
-- pmd = one_md_table_init(pgd);
-+ for (; pgd_idx < PTRS_PER_PGD && pfn < max_low_pfn; pgd++, pgd_idx++) {
-+ pud = pud_offset(pgd, 0);
-+ pmd = pmd_offset(pud, 0);
-+
-+#ifdef CONFIG_X86_PAE
-+ paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
-+#endif
-
- if (pfn >= end_pfn)
- continue;
-@@ -291,14 +297,13 @@ repeat:
- #endif
- for (; pmd_idx < PTRS_PER_PMD && pfn < end_pfn;
- pmd++, pmd_idx++) {
-- unsigned int addr = pfn * PAGE_SIZE + PAGE_OFFSET;
-+ unsigned long address = pfn * PAGE_SIZE + PAGE_OFFSET;
-
- /*
- * Map with big pages if possible, otherwise
- * create normal page tables:
- */
- if (use_pse) {
-- unsigned int addr2;
- pgprot_t prot = PAGE_KERNEL_LARGE;
- /*
- * first pass will use the same initial
-@@ -308,11 +313,7 @@ repeat:
- __pgprot(PTE_IDENT_ATTR |
- _PAGE_PSE);
-
-- addr2 = (pfn + PTRS_PER_PTE-1) * PAGE_SIZE +
-- PAGE_OFFSET + PAGE_SIZE-1;
--
-- if (is_kernel_text(addr) ||
-- is_kernel_text(addr2))
-+ if (is_kernel_text(address, address + PMD_SIZE))
- prot = PAGE_KERNEL_LARGE_EXEC;
-
- pages_2m++;
-@@ -329,7 +330,7 @@ repeat:
- pte_ofs = pte_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
- pte += pte_ofs;
- for (; pte_ofs < PTRS_PER_PTE && pfn < end_pfn;
-- pte++, pfn++, pte_ofs++, addr += PAGE_SIZE) {
-+ pte++, pfn++, pte_ofs++, address += PAGE_SIZE) {
- pgprot_t prot = PAGE_KERNEL;
- /*
- * first pass will use the same initial
-@@ -337,7 +338,7 @@ repeat:
- */
- pgprot_t init_prot = __pgprot(PTE_IDENT_ATTR);
-
-- if (is_kernel_text(addr))
-+ if (is_kernel_text(address, address + PAGE_SIZE))
- prot = PAGE_KERNEL_EXEC;
-
- pages_4k++;
-@@ -489,7 +490,7 @@ void __init native_pagetable_setup_start
-
- pud = pud_offset(pgd, va);
- pmd = pmd_offset(pud, va);
-- if (!pmd_present(*pmd))
-+ if (!pmd_present(*pmd) || pmd_huge(*pmd))
- break;
-
- pte = pte_offset_kernel(pmd, va);
-@@ -541,9 +542,7 @@ void __init early_ioremap_page_table_ran
-
- static void __init pagetable_init(void)
- {
-- pgd_t *pgd_base = swapper_pg_dir;
--
-- permanent_kmaps_init(pgd_base);
-+ permanent_kmaps_init(swapper_pg_dir);
- }
-
- #ifdef CONFIG_ACPI_SLEEP
-@@ -551,12 +550,12 @@ static void __init pagetable_init(void)
- * ACPI suspend needs this for resume, because things like the intel-agp
- * driver might have split up a kernel 4MB mapping.
- */
--char swsusp_pg_dir[PAGE_SIZE]
-+pgd_t swsusp_pg_dir[PTRS_PER_PGD]
- __attribute__ ((aligned(PAGE_SIZE)));
-
- static inline void save_pg_dir(void)
- {
-- memcpy(swsusp_pg_dir, swapper_pg_dir, PAGE_SIZE);
-+ clone_pgd_range(swsusp_pg_dir, swapper_pg_dir, PTRS_PER_PGD);
- }
- #else /* !CONFIG_ACPI_SLEEP */
- static inline void save_pg_dir(void)
-@@ -588,7 +587,7 @@ void zap_low_mappings(bool early)
- flush_tlb_all();
- }
-
--pteval_t __supported_pte_mask __read_mostly = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
-+pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
- EXPORT_SYMBOL_GPL(__supported_pte_mask);
-
- /* user-defined highmem size */
-@@ -777,7 +776,7 @@ void __init setup_bootmem_allocator(void
- * Initialize the boot-time allocator (with low memory only):
- */
- bootmap_size = bootmem_bootmap_pages(max_low_pfn)<<PAGE_SHIFT;
-- bootmap = find_e820_area(0, max_pfn_mapped<<PAGE_SHIFT, bootmap_size,
-+ bootmap = find_e820_area(0x100000, max_pfn_mapped<<PAGE_SHIFT, bootmap_size,
- PAGE_SIZE);
- if (bootmap == -1L)
- panic("Cannot find bootmem map of size %ld\n", bootmap_size);
-@@ -864,6 +863,12 @@ void __init mem_init(void)
-
- pci_iommu_alloc();
-
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
-+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-+ KERNEL_PGD_PTRS);
-+#endif
-+
- #ifdef CONFIG_FLATMEM
- BUG_ON(!mem_map);
- #endif
-@@ -881,7 +886,7 @@ void __init mem_init(void)
- set_highmem_pages_init();
-
- codesize = (unsigned long) &_etext - (unsigned long) &_text;
-- datasize = (unsigned long) &_edata - (unsigned long) &_etext;
-+ datasize = (unsigned long) &_edata - (unsigned long) &_sdata;
- initsize = (unsigned long) &__init_end - (unsigned long) &__init_begin;
-
- printk(KERN_INFO "Memory: %luk/%luk available (%dk kernel code, "
-@@ -923,10 +928,10 @@ void __init mem_init(void)
- ((unsigned long)&__init_end -
- (unsigned long)&__init_begin) >> 10,
-
-- (unsigned long)&_etext, (unsigned long)&_edata,
-- ((unsigned long)&_edata - (unsigned long)&_etext) >> 10,
-+ (unsigned long)&_sdata, (unsigned long)&_edata,
-+ ((unsigned long)&_edata - (unsigned long)&_sdata) >> 10,
-
-- (unsigned long)&_text, (unsigned long)&_etext,
-+ ktla_ktva((unsigned long)&_text), ktla_ktva((unsigned long)&_etext),
- ((unsigned long)&_etext - (unsigned long)&_text) >> 10);
-
- /*
-@@ -1007,6 +1012,7 @@ void set_kernel_text_rw(void)
- if (!kernel_set_to_readonly)
- return;
-
-+ start = ktla_ktva(start);
- pr_debug("Set kernel text: %lx - %lx for read write\n",
- start, start+size);
-
-@@ -1021,6 +1027,7 @@ void set_kernel_text_ro(void)
- if (!kernel_set_to_readonly)
- return;
-
-+ start = ktla_ktva(start);
- pr_debug("Set kernel text: %lx - %lx for read only\n",
- start, start+size);
-
-@@ -1032,6 +1039,7 @@ void mark_rodata_ro(void)
- unsigned long start = PFN_ALIGN(_text);
- unsigned long size = PFN_ALIGN(_etext) - start;
-
-+ start = ktla_ktva(start);
- set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT);
- printk(KERN_INFO "Write protecting the kernel text: %luk\n",
- size >> 10);
-diff -urNp linux-2.6.32.45/arch/x86/mm/init_64.c linux-2.6.32.45/arch/x86/mm/init_64.c
---- linux-2.6.32.45/arch/x86/mm/init_64.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/mm/init_64.c 2011-04-17 17:03:05.000000000 -0400
-@@ -164,7 +164,9 @@ void set_pte_vaddr_pud(pud_t *pud_page,
- pmd = fill_pmd(pud, vaddr);
- pte = fill_pte(pmd, vaddr);
-
-+ pax_open_kernel();
- set_pte(pte, new_pte);
-+ pax_close_kernel();
-
- /*
- * It's enough to flush this one mapping.
-@@ -223,14 +225,12 @@ static void __init __init_extra_mapping(
- pgd = pgd_offset_k((unsigned long)__va(phys));
- if (pgd_none(*pgd)) {
- pud = (pud_t *) spp_getpage();
-- set_pgd(pgd, __pgd(__pa(pud) | _KERNPG_TABLE |
-- _PAGE_USER));
-+ set_pgd(pgd, __pgd(__pa(pud) | _PAGE_TABLE));
- }
- pud = pud_offset(pgd, (unsigned long)__va(phys));
- if (pud_none(*pud)) {
- pmd = (pmd_t *) spp_getpage();
-- set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE |
-- _PAGE_USER));
-+ set_pud(pud, __pud(__pa(pmd) | _PAGE_TABLE));
- }
- pmd = pmd_offset(pud, phys);
- BUG_ON(!pmd_none(*pmd));
-@@ -675,6 +675,12 @@ void __init mem_init(void)
-
- pci_iommu_alloc();
-
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
-+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-+ KERNEL_PGD_PTRS);
-+#endif
-+
- /* clear_bss() already clear the empty_zero_page */
-
- reservedpages = 0;
-@@ -861,8 +867,8 @@ int kern_addr_valid(unsigned long addr)
- static struct vm_area_struct gate_vma = {
- .vm_start = VSYSCALL_START,
- .vm_end = VSYSCALL_START + (VSYSCALL_MAPPED_PAGES * PAGE_SIZE),
-- .vm_page_prot = PAGE_READONLY_EXEC,
-- .vm_flags = VM_READ | VM_EXEC
-+ .vm_page_prot = PAGE_READONLY,
-+ .vm_flags = VM_READ
- };
-
- struct vm_area_struct *get_gate_vma(struct task_struct *tsk)
-@@ -896,7 +902,7 @@ int in_gate_area_no_task(unsigned long a
-
- const char *arch_vma_name(struct vm_area_struct *vma)
- {
-- if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
-+ if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
- return "[vdso]";
- if (vma == &gate_vma)
- return "[vsyscall]";
-diff -urNp linux-2.6.32.45/arch/x86/mm/init.c linux-2.6.32.45/arch/x86/mm/init.c
---- linux-2.6.32.45/arch/x86/mm/init.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/mm/init.c 2011-06-07 19:06:09.000000000 -0400
-@@ -69,11 +69,7 @@ static void __init find_early_table_spac
- * cause a hotspot and fill up ZONE_DMA. The page tables
- * need roughly 0.5KB per GB.
- */
--#ifdef CONFIG_X86_32
-- start = 0x7000;
--#else
-- start = 0x8000;
--#endif
-+ start = 0x100000;
- e820_table_start = find_e820_area(start, max_pfn_mapped<<PAGE_SHIFT,
- tables, PAGE_SIZE);
- if (e820_table_start == -1UL)
-@@ -147,7 +143,7 @@ unsigned long __init_refok init_memory_m
- #endif
-
- set_nx();
-- if (nx_enabled)
-+ if (nx_enabled && cpu_has_nx)
- printk(KERN_INFO "NX (Execute Disable) protection: active\n");
-
- /* Enable PSE if available */
-@@ -329,10 +325,27 @@ unsigned long __init_refok init_memory_m
- * Access has to be given to non-kernel-ram areas as well, these contain the PCI
- * mmio resources as well as potential bios/acpi data regions.
- */
-+
- int devmem_is_allowed(unsigned long pagenr)
- {
-+#ifdef CONFIG_GRKERNSEC_KMEM
-+ /* allow BDA */
-+ if (!pagenr)
-+ return 1;
-+ /* allow EBDA */
-+ if ((0x9f000 >> PAGE_SHIFT) == pagenr)
-+ return 1;
-+ /* allow ISA/video mem */
-+ if ((ISA_START_ADDRESS >> PAGE_SHIFT) <= pagenr && pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
-+ return 1;
-+ /* throw out everything else below 1MB */
-+ if (pagenr <= 256)
-+ return 0;
-+#else
- if (pagenr <= 256)
- return 1;
-+#endif
-+
- if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
- return 0;
- if (!page_is_ram(pagenr))
-@@ -379,6 +392,86 @@ void free_init_pages(char *what, unsigne
-
- void free_initmem(void)
- {
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+#ifdef CONFIG_X86_32
-+ /* PaX: limit KERNEL_CS to actual size */
-+ unsigned long addr, limit;
-+ struct desc_struct d;
-+ int cpu;
-+
-+ limit = paravirt_enabled() ? ktva_ktla(0xffffffff) : (unsigned long)&_etext;
-+ limit = (limit - 1UL) >> PAGE_SHIFT;
-+
-+ memset(__LOAD_PHYSICAL_ADDR + PAGE_OFFSET, POISON_FREE_INITMEM, PAGE_SIZE);
-+ for (cpu = 0; cpu < NR_CPUS; cpu++) {
-+ pack_descriptor(&d, get_desc_base(&get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_CS]), limit, 0x9B, 0xC);
-+ write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_KERNEL_CS, &d, DESCTYPE_S);
-+ }
-+
-+ /* PaX: make KERNEL_CS read-only */
-+ addr = PFN_ALIGN(ktla_ktva((unsigned long)&_text));
-+ if (!paravirt_enabled())
-+ set_memory_ro(addr, (PFN_ALIGN(_sdata) - addr) >> PAGE_SHIFT);
-+/*
-+ for (addr = ktla_ktva((unsigned long)&_text); addr < (unsigned long)&_sdata; addr += PMD_SIZE) {
-+ pgd = pgd_offset_k(addr);
-+ pud = pud_offset(pgd, addr);
-+ pmd = pmd_offset(pud, addr);
-+ set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
-+ }
-+*/
-+#ifdef CONFIG_X86_PAE
-+ set_memory_nx(PFN_ALIGN(__init_begin), (PFN_ALIGN(__init_end) - PFN_ALIGN(__init_begin)) >> PAGE_SHIFT);
-+/*
-+ for (addr = (unsigned long)&__init_begin; addr < (unsigned long)&__init_end; addr += PMD_SIZE) {
-+ pgd = pgd_offset_k(addr);
-+ pud = pud_offset(pgd, addr);
-+ pmd = pmd_offset(pud, addr);
-+ set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
-+ }
-+*/
-+#endif
-+
-+#ifdef CONFIG_MODULES
-+ set_memory_4k((unsigned long)MODULES_EXEC_VADDR, (MODULES_EXEC_END - MODULES_EXEC_VADDR) >> PAGE_SHIFT);
-+#endif
-+
-+#else
-+ pgd_t *pgd;
-+ pud_t *pud;
-+ pmd_t *pmd;
-+ unsigned long addr, end;
-+
-+ /* PaX: make kernel code/rodata read-only, rest non-executable */
-+ for (addr = __START_KERNEL_map; addr < __START_KERNEL_map + KERNEL_IMAGE_SIZE; addr += PMD_SIZE) {
-+ pgd = pgd_offset_k(addr);
-+ pud = pud_offset(pgd, addr);
-+ pmd = pmd_offset(pud, addr);
-+ if (!pmd_present(*pmd))
-+ continue;
-+ if ((unsigned long)_text <= addr && addr < (unsigned long)_sdata)
-+ set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
-+ else
-+ set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
-+ }
-+
-+ addr = (unsigned long)__va(__pa(__START_KERNEL_map));
-+ end = addr + KERNEL_IMAGE_SIZE;
-+ for (; addr < end; addr += PMD_SIZE) {
-+ pgd = pgd_offset_k(addr);
-+ pud = pud_offset(pgd, addr);
-+ pmd = pmd_offset(pud, addr);
-+ if (!pmd_present(*pmd))
-+ continue;
-+ if ((unsigned long)__va(__pa(_text)) <= addr && addr < (unsigned long)__va(__pa(_sdata)))
-+ set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
-+ }
-+#endif
-+
-+ flush_tlb_all();
-+#endif
-+
- free_init_pages("unused kernel memory",
- (unsigned long)(&__init_begin),
- (unsigned long)(&__init_end));
-diff -urNp linux-2.6.32.45/arch/x86/mm/iomap_32.c linux-2.6.32.45/arch/x86/mm/iomap_32.c
---- linux-2.6.32.45/arch/x86/mm/iomap_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/mm/iomap_32.c 2011-04-17 15:56:46.000000000 -0400
-@@ -65,7 +65,11 @@ void *kmap_atomic_prot_pfn(unsigned long
- debug_kmap_atomic(type);
- idx = type + KM_TYPE_NR * smp_processor_id();
- vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
-+
-+ pax_open_kernel();
- set_pte(kmap_pte - idx, pfn_pte(pfn, prot));
-+ pax_close_kernel();
-+
- arch_flush_lazy_mmu_mode();
-
- return (void *)vaddr;
-diff -urNp linux-2.6.32.45/arch/x86/mm/ioremap.c linux-2.6.32.45/arch/x86/mm/ioremap.c
---- linux-2.6.32.45/arch/x86/mm/ioremap.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/mm/ioremap.c 2011-04-17 15:56:46.000000000 -0400
-@@ -41,8 +41,8 @@ int page_is_ram(unsigned long pagenr)
- * Second special case: Some BIOSen report the PC BIOS
- * area (640->1Mb) as ram even though it is not.
- */
-- if (pagenr >= (BIOS_BEGIN >> PAGE_SHIFT) &&
-- pagenr < (BIOS_END >> PAGE_SHIFT))
-+ if (pagenr >= (ISA_START_ADDRESS >> PAGE_SHIFT) &&
-+ pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
- return 0;
-
- for (i = 0; i < e820.nr_map; i++) {
-@@ -137,13 +137,10 @@ static void __iomem *__ioremap_caller(re
- /*
- * Don't allow anybody to remap normal RAM that we're using..
- */
-- for (pfn = phys_addr >> PAGE_SHIFT;
-- (pfn << PAGE_SHIFT) < (last_addr & PAGE_MASK);
-- pfn++) {
--
-+ for (pfn = phys_addr >> PAGE_SHIFT; ((resource_size_t)pfn << PAGE_SHIFT) < (last_addr & PAGE_MASK); pfn++) {
- int is_ram = page_is_ram(pfn);
-
-- if (is_ram && pfn_valid(pfn) && !PageReserved(pfn_to_page(pfn)))
-+ if (is_ram && pfn_valid(pfn) && (pfn >= 0x100 || !PageReserved(pfn_to_page(pfn))))
- return NULL;
- WARN_ON_ONCE(is_ram);
- }
-@@ -407,7 +404,7 @@ static int __init early_ioremap_debug_se
- early_param("early_ioremap_debug", early_ioremap_debug_setup);
-
- static __initdata int after_paging_init;
--static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __page_aligned_bss;
-+static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __read_only __aligned(PAGE_SIZE);
-
- static inline pmd_t * __init early_ioremap_pmd(unsigned long addr)
- {
-@@ -439,8 +436,7 @@ void __init early_ioremap_init(void)
- slot_virt[i] = __fix_to_virt(FIX_BTMAP_BEGIN - NR_FIX_BTMAPS*i);
-
- pmd = early_ioremap_pmd(fix_to_virt(FIX_BTMAP_BEGIN));
-- memset(bm_pte, 0, sizeof(bm_pte));
-- pmd_populate_kernel(&init_mm, pmd, bm_pte);
-+ pmd_populate_user(&init_mm, pmd, bm_pte);
-
- /*
- * The boot-ioremap range spans multiple pmds, for which
-diff -urNp linux-2.6.32.45/arch/x86/mm/kmemcheck/kmemcheck.c linux-2.6.32.45/arch/x86/mm/kmemcheck/kmemcheck.c
---- linux-2.6.32.45/arch/x86/mm/kmemcheck/kmemcheck.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/mm/kmemcheck/kmemcheck.c 2011-04-17 15:56:46.000000000 -0400
-@@ -622,9 +622,9 @@ bool kmemcheck_fault(struct pt_regs *reg
- * memory (e.g. tracked pages)? For now, we need this to avoid
- * invoking kmemcheck for PnP BIOS calls.
- */
-- if (regs->flags & X86_VM_MASK)
-+ if (v8086_mode(regs))
- return false;
-- if (regs->cs != __KERNEL_CS)
-+ if (regs->cs != __KERNEL_CS && regs->cs != __KERNEXEC_KERNEL_CS)
- return false;
-
- pte = kmemcheck_pte_lookup(address);
-diff -urNp linux-2.6.32.45/arch/x86/mm/mmap.c linux-2.6.32.45/arch/x86/mm/mmap.c
---- linux-2.6.32.45/arch/x86/mm/mmap.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/mm/mmap.c 2011-04-17 15:56:46.000000000 -0400
-@@ -49,7 +49,7 @@ static unsigned int stack_maxrandom_size
- * Leave an at least ~128 MB hole with possible stack randomization.
- */
- #define MIN_GAP (128*1024*1024UL + stack_maxrandom_size())
--#define MAX_GAP (TASK_SIZE/6*5)
-+#define MAX_GAP (pax_task_size/6*5)
-
- /*
- * True on X86_32 or when emulating IA32 on X86_64
-@@ -94,27 +94,40 @@ static unsigned long mmap_rnd(void)
- return rnd << PAGE_SHIFT;
- }
-
--static unsigned long mmap_base(void)
-+static unsigned long mmap_base(struct mm_struct *mm)
- {
- unsigned long gap = current->signal->rlim[RLIMIT_STACK].rlim_cur;
-+ unsigned long pax_task_size = TASK_SIZE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+ pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-
- if (gap < MIN_GAP)
- gap = MIN_GAP;
- else if (gap > MAX_GAP)
- gap = MAX_GAP;
-
-- return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
-+ return PAGE_ALIGN(pax_task_size - gap - mmap_rnd());
- }
-
- /*
- * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
- * does, but not when emulating X86_32
- */
--static unsigned long mmap_legacy_base(void)
-+static unsigned long mmap_legacy_base(struct mm_struct *mm)
- {
-- if (mmap_is_ia32())
-+ if (mmap_is_ia32()) {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+ return SEGMEXEC_TASK_UNMAPPED_BASE;
-+ else
-+#endif
-+
- return TASK_UNMAPPED_BASE;
-- else
-+ } else
- return TASK_UNMAPPED_BASE + mmap_rnd();
- }
-
-@@ -125,11 +138,23 @@ static unsigned long mmap_legacy_base(vo
- void arch_pick_mmap_layout(struct mm_struct *mm)
- {
- if (mmap_is_legacy()) {
-- mm->mmap_base = mmap_legacy_base();
-+ mm->mmap_base = mmap_legacy_base(mm);
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- mm->get_unmapped_area = arch_get_unmapped_area;
- mm->unmap_area = arch_unmap_area;
- } else {
-- mm->mmap_base = mmap_base();
-+ mm->mmap_base = mmap_base(mm);
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
-+#endif
-+
- mm->get_unmapped_area = arch_get_unmapped_area_topdown;
- mm->unmap_area = arch_unmap_area_topdown;
- }
-diff -urNp linux-2.6.32.45/arch/x86/mm/mmio-mod.c linux-2.6.32.45/arch/x86/mm/mmio-mod.c
---- linux-2.6.32.45/arch/x86/mm/mmio-mod.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/mm/mmio-mod.c 2011-07-06 19:53:33.000000000 -0400
-@@ -193,7 +193,7 @@ static void pre(struct kmmio_probe *p, s
- break;
- default:
- {
-- unsigned char *ip = (unsigned char *)instptr;
-+ unsigned char *ip = (unsigned char *)ktla_ktva(instptr);
- my_trace->opcode = MMIO_UNKNOWN_OP;
- my_trace->width = 0;
- my_trace->value = (*ip) << 16 | *(ip + 1) << 8 |
-@@ -233,7 +233,7 @@ static void post(struct kmmio_probe *p,
- static void ioremap_trace_core(resource_size_t offset, unsigned long size,
- void __iomem *addr)
- {
-- static atomic_t next_id;
-+ static atomic_unchecked_t next_id;
- struct remap_trace *trace = kmalloc(sizeof(*trace), GFP_KERNEL);
- /* These are page-unaligned. */
- struct mmiotrace_map map = {
-@@ -257,7 +257,7 @@ static void ioremap_trace_core(resource_
- .private = trace
- },
- .phys = offset,
-- .id = atomic_inc_return(&next_id)
-+ .id = atomic_inc_return_unchecked(&next_id)
- };
- map.map_id = trace->id;
-
-diff -urNp linux-2.6.32.45/arch/x86/mm/numa_32.c linux-2.6.32.45/arch/x86/mm/numa_32.c
---- linux-2.6.32.45/arch/x86/mm/numa_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/mm/numa_32.c 2011-04-17 15:56:46.000000000 -0400
-@@ -98,7 +98,6 @@ unsigned long node_memmap_size_bytes(int
- }
- #endif
-
--extern unsigned long find_max_low_pfn(void);
- extern unsigned long highend_pfn, highstart_pfn;
-
- #define LARGE_PAGE_BYTES (PTRS_PER_PTE * PAGE_SIZE)
-diff -urNp linux-2.6.32.45/arch/x86/mm/pageattr.c linux-2.6.32.45/arch/x86/mm/pageattr.c
---- linux-2.6.32.45/arch/x86/mm/pageattr.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/mm/pageattr.c 2011-04-17 15:56:46.000000000 -0400
-@@ -261,16 +261,17 @@ static inline pgprot_t static_protection
- * PCI BIOS based config access (CONFIG_PCI_GOBIOS) support.
- */
- if (within(pfn, BIOS_BEGIN >> PAGE_SHIFT, BIOS_END >> PAGE_SHIFT))
-- pgprot_val(forbidden) |= _PAGE_NX;
-+ pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
-
- /*
- * The kernel text needs to be executable for obvious reasons
- * Does not cover __inittext since that is gone later on. On
- * 64bit we do not enforce !NX on the low mapping
- */
-- if (within(address, (unsigned long)_text, (unsigned long)_etext))
-- pgprot_val(forbidden) |= _PAGE_NX;
-+ if (within(address, ktla_ktva((unsigned long)_text), ktla_ktva((unsigned long)_etext)))
-+ pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
-
-+#ifdef CONFIG_DEBUG_RODATA
- /*
- * The .rodata section needs to be read-only. Using the pfn
- * catches all aliases.
-@@ -278,6 +279,14 @@ static inline pgprot_t static_protection
- if (within(pfn, __pa((unsigned long)__start_rodata) >> PAGE_SHIFT,
- __pa((unsigned long)__end_rodata) >> PAGE_SHIFT))
- pgprot_val(forbidden) |= _PAGE_RW;
-+#endif
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ if (within(pfn, __pa((unsigned long)&_text), __pa((unsigned long)&_sdata))) {
-+ pgprot_val(forbidden) |= _PAGE_RW;
-+ pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
-+ }
-+#endif
-
- prot = __pgprot(pgprot_val(prot) & ~pgprot_val(forbidden));
-
-@@ -331,23 +340,37 @@ EXPORT_SYMBOL_GPL(lookup_address);
- static void __set_pmd_pte(pte_t *kpte, unsigned long address, pte_t pte)
- {
- /* change init_mm */
-+ pax_open_kernel();
- set_pte_atomic(kpte, pte);
-+
- #ifdef CONFIG_X86_32
- if (!SHARED_KERNEL_PMD) {
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ unsigned long cpu;
-+#else
- struct page *page;
-+#endif
-
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ for (cpu = 0; cpu < NR_CPUS; ++cpu) {
-+ pgd_t *pgd = get_cpu_pgd(cpu);
-+#else
- list_for_each_entry(page, &pgd_list, lru) {
-- pgd_t *pgd;
-+ pgd_t *pgd = (pgd_t *)page_address(page);
-+#endif
-+
- pud_t *pud;
- pmd_t *pmd;
-
-- pgd = (pgd_t *)page_address(page) + pgd_index(address);
-+ pgd += pgd_index(address);
- pud = pud_offset(pgd, address);
- pmd = pmd_offset(pud, address);
- set_pte_atomic((pte_t *)pmd, pte);
- }
- }
- #endif
-+ pax_close_kernel();
- }
-
- static int
-diff -urNp linux-2.6.32.45/arch/x86/mm/pageattr-test.c linux-2.6.32.45/arch/x86/mm/pageattr-test.c
---- linux-2.6.32.45/arch/x86/mm/pageattr-test.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/mm/pageattr-test.c 2011-04-17 15:56:46.000000000 -0400
-@@ -36,7 +36,7 @@ enum {
-
- static int pte_testbit(pte_t pte)
- {
-- return pte_flags(pte) & _PAGE_UNUSED1;
-+ return pte_flags(pte) & _PAGE_CPA_TEST;
- }
-
- struct split_state {
-diff -urNp linux-2.6.32.45/arch/x86/mm/pat.c linux-2.6.32.45/arch/x86/mm/pat.c
---- linux-2.6.32.45/arch/x86/mm/pat.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/mm/pat.c 2011-04-17 15:56:46.000000000 -0400
-@@ -258,7 +258,7 @@ chk_conflict(struct memtype *new, struct
-
- conflict:
- printk(KERN_INFO "%s:%d conflicting memory types "
-- "%Lx-%Lx %s<->%s\n", current->comm, current->pid, new->start,
-+ "%Lx-%Lx %s<->%s\n", current->comm, task_pid_nr(current), new->start,
- new->end, cattr_name(new->type), cattr_name(entry->type));
- return -EBUSY;
- }
-@@ -559,7 +559,7 @@ unlock_ret:
-
- if (err) {
- printk(KERN_INFO "%s:%d freeing invalid memtype %Lx-%Lx\n",
-- current->comm, current->pid, start, end);
-+ current->comm, task_pid_nr(current), start, end);
- }
-
- dprintk("free_memtype request 0x%Lx-0x%Lx\n", start, end);
-@@ -689,8 +689,8 @@ static inline int range_is_allowed(unsig
- while (cursor < to) {
- if (!devmem_is_allowed(pfn)) {
- printk(KERN_INFO
-- "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
-- current->comm, from, to);
-+ "Program %s tried to access /dev/mem between %Lx->%Lx (%Lx).\n",
-+ current->comm, from, to, cursor);
- return 0;
- }
- cursor += PAGE_SIZE;
-@@ -755,7 +755,7 @@ int kernel_map_sync_memtype(u64 base, un
- printk(KERN_INFO
- "%s:%d ioremap_change_attr failed %s "
- "for %Lx-%Lx\n",
-- current->comm, current->pid,
-+ current->comm, task_pid_nr(current),
- cattr_name(flags),
- base, (unsigned long long)(base + size));
- return -EINVAL;
-@@ -813,7 +813,7 @@ static int reserve_pfn_range(u64 paddr,
- free_memtype(paddr, paddr + size);
- printk(KERN_ERR "%s:%d map pfn expected mapping type %s"
- " for %Lx-%Lx, got %s\n",
-- current->comm, current->pid,
-+ current->comm, task_pid_nr(current),
- cattr_name(want_flags),
- (unsigned long long)paddr,
- (unsigned long long)(paddr + size),
-diff -urNp linux-2.6.32.45/arch/x86/mm/pf_in.c linux-2.6.32.45/arch/x86/mm/pf_in.c
---- linux-2.6.32.45/arch/x86/mm/pf_in.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/mm/pf_in.c 2011-07-06 19:53:33.000000000 -0400
-@@ -148,7 +148,7 @@ enum reason_type get_ins_type(unsigned l
- int i;
- enum reason_type rv = OTHERS;
-
-- p = (unsigned char *)ins_addr;
-+ p = (unsigned char *)ktla_ktva(ins_addr);
- p += skip_prefix(p, &prf);
- p += get_opcode(p, &opcode);
-
-@@ -168,7 +168,7 @@ static unsigned int get_ins_reg_width(un
- struct prefix_bits prf;
- int i;
-
-- p = (unsigned char *)ins_addr;
-+ p = (unsigned char *)ktla_ktva(ins_addr);
- p += skip_prefix(p, &prf);
- p += get_opcode(p, &opcode);
-
-@@ -191,7 +191,7 @@ unsigned int get_ins_mem_width(unsigned
- struct prefix_bits prf;
- int i;
-
-- p = (unsigned char *)ins_addr;
-+ p = (unsigned char *)ktla_ktva(ins_addr);
- p += skip_prefix(p, &prf);
- p += get_opcode(p, &opcode);
-
-@@ -417,7 +417,7 @@ unsigned long get_ins_reg_val(unsigned l
- int i;
- unsigned long rv;
-
-- p = (unsigned char *)ins_addr;
-+ p = (unsigned char *)ktla_ktva(ins_addr);
- p += skip_prefix(p, &prf);
- p += get_opcode(p, &opcode);
- for (i = 0; i < ARRAY_SIZE(reg_rop); i++)
-@@ -472,7 +472,7 @@ unsigned long get_ins_imm_val(unsigned l
- int i;
- unsigned long rv;
-
-- p = (unsigned char *)ins_addr;
-+ p = (unsigned char *)ktla_ktva(ins_addr);
- p += skip_prefix(p, &prf);
- p += get_opcode(p, &opcode);
- for (i = 0; i < ARRAY_SIZE(imm_wop); i++)
-diff -urNp linux-2.6.32.45/arch/x86/mm/pgtable_32.c linux-2.6.32.45/arch/x86/mm/pgtable_32.c
---- linux-2.6.32.45/arch/x86/mm/pgtable_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/mm/pgtable_32.c 2011-04-17 15:56:46.000000000 -0400
-@@ -49,10 +49,13 @@ void set_pte_vaddr(unsigned long vaddr,
- return;
- }
- pte = pte_offset_kernel(pmd, vaddr);
-+
-+ pax_open_kernel();
- if (pte_val(pteval))
- set_pte_at(&init_mm, vaddr, pte, pteval);
- else
- pte_clear(&init_mm, vaddr, pte);
-+ pax_close_kernel();
-
- /*
- * It's enough to flush this one mapping.
-diff -urNp linux-2.6.32.45/arch/x86/mm/pgtable.c linux-2.6.32.45/arch/x86/mm/pgtable.c
---- linux-2.6.32.45/arch/x86/mm/pgtable.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/mm/pgtable.c 2011-05-11 18:25:15.000000000 -0400
-@@ -83,9 +83,52 @@ static inline void pgd_list_del(pgd_t *p
- list_del(&page->lru);
- }
-
--#define UNSHARED_PTRS_PER_PGD \
-- (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+pgdval_t clone_pgd_mask __read_only = ~_PAGE_PRESENT;
-
-+void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count)
-+{
-+ while (count--)
-+ *dst++ = __pgd((pgd_val(*src++) | (_PAGE_NX & __supported_pte_mask)) & ~_PAGE_USER);
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count)
-+{
-+ while (count--)
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ *dst++ = __pgd(pgd_val(*src++) & clone_pgd_mask);
-+#else
-+ *dst++ = *src++;
-+#endif
-+
-+}
-+#endif
-+
-+#ifdef CONFIG_X86_64
-+#define pxd_t pud_t
-+#define pyd_t pgd_t
-+#define paravirt_release_pxd(pfn) paravirt_release_pud(pfn)
-+#define pxd_free(mm, pud) pud_free((mm), (pud))
-+#define pyd_populate(mm, pgd, pud) pgd_populate((mm), (pgd), (pud))
-+#define pyd_offset(mm ,address) pgd_offset((mm), (address))
-+#define PYD_SIZE PGDIR_SIZE
-+#else
-+#define pxd_t pmd_t
-+#define pyd_t pud_t
-+#define paravirt_release_pxd(pfn) paravirt_release_pmd(pfn)
-+#define pxd_free(mm, pud) pmd_free((mm), (pud))
-+#define pyd_populate(mm, pgd, pud) pud_populate((mm), (pgd), (pud))
-+#define pyd_offset(mm ,address) pud_offset((mm), (address))
-+#define PYD_SIZE PUD_SIZE
-+#endif
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+static inline void pgd_ctor(pgd_t *pgd) {}
-+static inline void pgd_dtor(pgd_t *pgd) {}
-+#else
- static void pgd_ctor(pgd_t *pgd)
- {
- /* If the pgd points to a shared pagetable level (either the
-@@ -119,6 +162,7 @@ static void pgd_dtor(pgd_t *pgd)
- pgd_list_del(pgd);
- spin_unlock_irqrestore(&pgd_lock, flags);
- }
-+#endif
-
- /*
- * List of all pgd's needed for non-PAE so it can invalidate entries
-@@ -131,7 +175,7 @@ static void pgd_dtor(pgd_t *pgd)
- * -- wli
- */
-
--#ifdef CONFIG_X86_PAE
-+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
- /*
- * In PAE mode, we need to do a cr3 reload (=tlb flush) when
- * updating the top-level pagetable entries to guarantee the
-@@ -143,7 +187,7 @@ static void pgd_dtor(pgd_t *pgd)
- * not shared between pagetables (!SHARED_KERNEL_PMDS), we allocate
- * and initialize the kernel pmds here.
- */
--#define PREALLOCATED_PMDS UNSHARED_PTRS_PER_PGD
-+#define PREALLOCATED_PXDS (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
-
- void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
- {
-@@ -161,36 +205,38 @@ void pud_populate(struct mm_struct *mm,
- */
- flush_tlb_mm(mm);
- }
-+#elif defined(CONFIG_X86_64) && defined(CONFIG_PAX_PER_CPU_PGD)
-+#define PREALLOCATED_PXDS USER_PGD_PTRS
- #else /* !CONFIG_X86_PAE */
-
- /* No need to prepopulate any pagetable entries in non-PAE modes. */
--#define PREALLOCATED_PMDS 0
-+#define PREALLOCATED_PXDS 0
-
- #endif /* CONFIG_X86_PAE */
-
--static void free_pmds(pmd_t *pmds[])
-+static void free_pxds(pxd_t *pxds[])
- {
- int i;
-
-- for(i = 0; i < PREALLOCATED_PMDS; i++)
-- if (pmds[i])
-- free_page((unsigned long)pmds[i]);
-+ for(i = 0; i < PREALLOCATED_PXDS; i++)
-+ if (pxds[i])
-+ free_page((unsigned long)pxds[i]);
- }
-
--static int preallocate_pmds(pmd_t *pmds[])
-+static int preallocate_pxds(pxd_t *pxds[])
- {
- int i;
- bool failed = false;
-
-- for(i = 0; i < PREALLOCATED_PMDS; i++) {
-- pmd_t *pmd = (pmd_t *)__get_free_page(PGALLOC_GFP);
-- if (pmd == NULL)
-+ for(i = 0; i < PREALLOCATED_PXDS; i++) {
-+ pxd_t *pxd = (pxd_t *)__get_free_page(PGALLOC_GFP);
-+ if (pxd == NULL)
- failed = true;
-- pmds[i] = pmd;
-+ pxds[i] = pxd;
- }
-
- if (failed) {
-- free_pmds(pmds);
-+ free_pxds(pxds);
- return -ENOMEM;
- }
-
-@@ -203,51 +249,56 @@ static int preallocate_pmds(pmd_t *pmds[
- * preallocate which never got a corresponding vma will need to be
- * freed manually.
- */
--static void pgd_mop_up_pmds(struct mm_struct *mm, pgd_t *pgdp)
-+static void pgd_mop_up_pxds(struct mm_struct *mm, pgd_t *pgdp)
- {
- int i;
-
-- for(i = 0; i < PREALLOCATED_PMDS; i++) {
-+ for(i = 0; i < PREALLOCATED_PXDS; i++) {
- pgd_t pgd = pgdp[i];
-
- if (pgd_val(pgd) != 0) {
-- pmd_t *pmd = (pmd_t *)pgd_page_vaddr(pgd);
-+ pxd_t *pxd = (pxd_t *)pgd_page_vaddr(pgd);
-
-- pgdp[i] = native_make_pgd(0);
-+ set_pgd(pgdp + i, native_make_pgd(0));
-
-- paravirt_release_pmd(pgd_val(pgd) >> PAGE_SHIFT);
-- pmd_free(mm, pmd);
-+ paravirt_release_pxd(pgd_val(pgd) >> PAGE_SHIFT);
-+ pxd_free(mm, pxd);
- }
- }
- }
-
--static void pgd_prepopulate_pmd(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmds[])
-+static void pgd_prepopulate_pxd(struct mm_struct *mm, pgd_t *pgd, pxd_t *pxds[])
- {
-- pud_t *pud;
-+ pyd_t *pyd;
- unsigned long addr;
- int i;
-
-- if (PREALLOCATED_PMDS == 0) /* Work around gcc-3.4.x bug */
-+ if (PREALLOCATED_PXDS == 0) /* Work around gcc-3.4.x bug */
- return;
-
-- pud = pud_offset(pgd, 0);
-+#ifdef CONFIG_X86_64
-+ pyd = pyd_offset(mm, 0L);
-+#else
-+ pyd = pyd_offset(pgd, 0L);
-+#endif
-
-- for (addr = i = 0; i < PREALLOCATED_PMDS;
-- i++, pud++, addr += PUD_SIZE) {
-- pmd_t *pmd = pmds[i];
-+ for (addr = i = 0; i < PREALLOCATED_PXDS;
-+ i++, pyd++, addr += PYD_SIZE) {
-+ pxd_t *pxd = pxds[i];
-
- if (i >= KERNEL_PGD_BOUNDARY)
-- memcpy(pmd, (pmd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
-- sizeof(pmd_t) * PTRS_PER_PMD);
-+ memcpy(pxd, (pxd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
-+ sizeof(pxd_t) * PTRS_PER_PMD);
-
-- pud_populate(mm, pud, pmd);
-+ pyd_populate(mm, pyd, pxd);
- }
- }
-
- pgd_t *pgd_alloc(struct mm_struct *mm)
- {
- pgd_t *pgd;
-- pmd_t *pmds[PREALLOCATED_PMDS];
-+ pxd_t *pxds[PREALLOCATED_PXDS];
-+
- unsigned long flags;
-
- pgd = (pgd_t *)__get_free_page(PGALLOC_GFP);
-@@ -257,11 +308,11 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
-
- mm->pgd = pgd;
-
-- if (preallocate_pmds(pmds) != 0)
-+ if (preallocate_pxds(pxds) != 0)
- goto out_free_pgd;
-
- if (paravirt_pgd_alloc(mm) != 0)
-- goto out_free_pmds;
-+ goto out_free_pxds;
-
- /*
- * Make sure that pre-populating the pmds is atomic with
-@@ -271,14 +322,14 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
- spin_lock_irqsave(&pgd_lock, flags);
-
- pgd_ctor(pgd);
-- pgd_prepopulate_pmd(mm, pgd, pmds);
-+ pgd_prepopulate_pxd(mm, pgd, pxds);
-
- spin_unlock_irqrestore(&pgd_lock, flags);
-
- return pgd;
-
--out_free_pmds:
-- free_pmds(pmds);
-+out_free_pxds:
-+ free_pxds(pxds);
- out_free_pgd:
- free_page((unsigned long)pgd);
- out:
-@@ -287,7 +338,7 @@ out:
-
- void pgd_free(struct mm_struct *mm, pgd_t *pgd)
- {
-- pgd_mop_up_pmds(mm, pgd);
-+ pgd_mop_up_pxds(mm, pgd);
- pgd_dtor(pgd);
- paravirt_pgd_free(mm, pgd);
- free_page((unsigned long)pgd);
-diff -urNp linux-2.6.32.45/arch/x86/mm/setup_nx.c linux-2.6.32.45/arch/x86/mm/setup_nx.c
---- linux-2.6.32.45/arch/x86/mm/setup_nx.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/mm/setup_nx.c 2011-04-17 15:56:46.000000000 -0400
-@@ -4,11 +4,10 @@
-
- #include <asm/pgtable.h>
-
-+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
- int nx_enabled;
-
--#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
--static int disable_nx __cpuinitdata;
--
-+#ifndef CONFIG_PAX_PAGEEXEC
- /*
- * noexec = on|off
- *
-@@ -22,32 +21,26 @@ static int __init noexec_setup(char *str
- if (!str)
- return -EINVAL;
- if (!strncmp(str, "on", 2)) {
-- __supported_pte_mask |= _PAGE_NX;
-- disable_nx = 0;
-+ nx_enabled = 1;
- } else if (!strncmp(str, "off", 3)) {
-- disable_nx = 1;
-- __supported_pte_mask &= ~_PAGE_NX;
-+ nx_enabled = 0;
- }
- return 0;
- }
- early_param("noexec", noexec_setup);
- #endif
-+#endif
-
- #ifdef CONFIG_X86_PAE
- void __init set_nx(void)
- {
-- unsigned int v[4], l, h;
-+ if (!nx_enabled && cpu_has_nx) {
-+ unsigned l, h;
-
-- if (cpu_has_pae && (cpuid_eax(0x80000000) > 0x80000001)) {
-- cpuid(0x80000001, &v[0], &v[1], &v[2], &v[3]);
--
-- if ((v[3] & (1 << 20)) && !disable_nx) {
-- rdmsr(MSR_EFER, l, h);
-- l |= EFER_NX;
-- wrmsr(MSR_EFER, l, h);
-- nx_enabled = 1;
-- __supported_pte_mask |= _PAGE_NX;
-- }
-+ __supported_pte_mask &= ~_PAGE_NX;
-+ rdmsr(MSR_EFER, l, h);
-+ l &= ~EFER_NX;
-+ wrmsr(MSR_EFER, l, h);
- }
- }
- #else
-@@ -62,7 +55,7 @@ void __cpuinit check_efer(void)
- unsigned long efer;
-
- rdmsrl(MSR_EFER, efer);
-- if (!(efer & EFER_NX) || disable_nx)
-+ if (!(efer & EFER_NX) || !nx_enabled)
- __supported_pte_mask &= ~_PAGE_NX;
- }
- #endif
-diff -urNp linux-2.6.32.45/arch/x86/mm/tlb.c linux-2.6.32.45/arch/x86/mm/tlb.c
---- linux-2.6.32.45/arch/x86/mm/tlb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/mm/tlb.c 2011-04-23 12:56:10.000000000 -0400
-@@ -61,7 +61,11 @@ void leave_mm(int cpu)
- BUG();
- cpumask_clear_cpu(cpu,
- mm_cpumask(percpu_read(cpu_tlbstate.active_mm)));
-+
-+#ifndef CONFIG_PAX_PER_CPU_PGD
- load_cr3(swapper_pg_dir);
-+#endif
-+
- }
- EXPORT_SYMBOL_GPL(leave_mm);
-
-diff -urNp linux-2.6.32.45/arch/x86/oprofile/backtrace.c linux-2.6.32.45/arch/x86/oprofile/backtrace.c
---- linux-2.6.32.45/arch/x86/oprofile/backtrace.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/oprofile/backtrace.c 2011-04-17 15:56:46.000000000 -0400
-@@ -57,7 +57,7 @@ static struct frame_head *dump_user_back
- struct frame_head bufhead[2];
-
- /* Also check accessibility of one struct frame_head beyond */
-- if (!access_ok(VERIFY_READ, head, sizeof(bufhead)))
-+ if (!__access_ok(VERIFY_READ, head, sizeof(bufhead)))
- return NULL;
- if (__copy_from_user_inatomic(bufhead, head, sizeof(bufhead)))
- return NULL;
-@@ -77,7 +77,7 @@ x86_backtrace(struct pt_regs * const reg
- {
- struct frame_head *head = (struct frame_head *)frame_pointer(regs);
-
-- if (!user_mode_vm(regs)) {
-+ if (!user_mode(regs)) {
- unsigned long stack = kernel_stack_pointer(regs);
- if (depth)
- dump_trace(NULL, regs, (unsigned long *)stack, 0,
-diff -urNp linux-2.6.32.45/arch/x86/oprofile/op_model_p4.c linux-2.6.32.45/arch/x86/oprofile/op_model_p4.c
---- linux-2.6.32.45/arch/x86/oprofile/op_model_p4.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/oprofile/op_model_p4.c 2011-04-17 15:56:46.000000000 -0400
-@@ -50,7 +50,7 @@ static inline void setup_num_counters(vo
- #endif
- }
-
--static int inline addr_increment(void)
-+static inline int addr_increment(void)
- {
- #ifdef CONFIG_SMP
- return smp_num_siblings == 2 ? 2 : 1;
-diff -urNp linux-2.6.32.45/arch/x86/pci/common.c linux-2.6.32.45/arch/x86/pci/common.c
---- linux-2.6.32.45/arch/x86/pci/common.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/pci/common.c 2011-04-23 12:56:10.000000000 -0400
-@@ -31,8 +31,8 @@ int noioapicreroute = 1;
- int pcibios_last_bus = -1;
- unsigned long pirq_table_addr;
- struct pci_bus *pci_root_bus;
--struct pci_raw_ops *raw_pci_ops;
--struct pci_raw_ops *raw_pci_ext_ops;
-+const struct pci_raw_ops *raw_pci_ops;
-+const struct pci_raw_ops *raw_pci_ext_ops;
-
- int raw_pci_read(unsigned int domain, unsigned int bus, unsigned int devfn,
- int reg, int len, u32 *val)
-diff -urNp linux-2.6.32.45/arch/x86/pci/direct.c linux-2.6.32.45/arch/x86/pci/direct.c
---- linux-2.6.32.45/arch/x86/pci/direct.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/pci/direct.c 2011-04-17 15:56:46.000000000 -0400
-@@ -79,7 +79,7 @@ static int pci_conf1_write(unsigned int
-
- #undef PCI_CONF1_ADDRESS
-
--struct pci_raw_ops pci_direct_conf1 = {
-+const struct pci_raw_ops pci_direct_conf1 = {
- .read = pci_conf1_read,
- .write = pci_conf1_write,
- };
-@@ -173,7 +173,7 @@ static int pci_conf2_write(unsigned int
-
- #undef PCI_CONF2_ADDRESS
-
--struct pci_raw_ops pci_direct_conf2 = {
-+const struct pci_raw_ops pci_direct_conf2 = {
- .read = pci_conf2_read,
- .write = pci_conf2_write,
- };
-@@ -189,7 +189,7 @@ struct pci_raw_ops pci_direct_conf2 = {
- * This should be close to trivial, but it isn't, because there are buggy
- * chipsets (yes, you guessed it, by Intel and Compaq) that have no class ID.
- */
--static int __init pci_sanity_check(struct pci_raw_ops *o)
-+static int __init pci_sanity_check(const struct pci_raw_ops *o)
- {
- u32 x = 0;
- int year, devfn;
-diff -urNp linux-2.6.32.45/arch/x86/pci/mmconfig_32.c linux-2.6.32.45/arch/x86/pci/mmconfig_32.c
---- linux-2.6.32.45/arch/x86/pci/mmconfig_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/pci/mmconfig_32.c 2011-04-17 15:56:46.000000000 -0400
-@@ -125,7 +125,7 @@ static int pci_mmcfg_write(unsigned int
- return 0;
- }
-
--static struct pci_raw_ops pci_mmcfg = {
-+static const struct pci_raw_ops pci_mmcfg = {
- .read = pci_mmcfg_read,
- .write = pci_mmcfg_write,
- };
-diff -urNp linux-2.6.32.45/arch/x86/pci/mmconfig_64.c linux-2.6.32.45/arch/x86/pci/mmconfig_64.c
---- linux-2.6.32.45/arch/x86/pci/mmconfig_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/pci/mmconfig_64.c 2011-04-17 15:56:46.000000000 -0400
-@@ -104,7 +104,7 @@ static int pci_mmcfg_write(unsigned int
- return 0;
- }
-
--static struct pci_raw_ops pci_mmcfg = {
-+static const struct pci_raw_ops pci_mmcfg = {
- .read = pci_mmcfg_read,
- .write = pci_mmcfg_write,
- };
-diff -urNp linux-2.6.32.45/arch/x86/pci/numaq_32.c linux-2.6.32.45/arch/x86/pci/numaq_32.c
---- linux-2.6.32.45/arch/x86/pci/numaq_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/pci/numaq_32.c 2011-04-17 15:56:46.000000000 -0400
-@@ -112,7 +112,7 @@ static int pci_conf1_mq_write(unsigned i
-
- #undef PCI_CONF1_MQ_ADDRESS
-
--static struct pci_raw_ops pci_direct_conf1_mq = {
-+static const struct pci_raw_ops pci_direct_conf1_mq = {
- .read = pci_conf1_mq_read,
- .write = pci_conf1_mq_write
- };
-diff -urNp linux-2.6.32.45/arch/x86/pci/olpc.c linux-2.6.32.45/arch/x86/pci/olpc.c
---- linux-2.6.32.45/arch/x86/pci/olpc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/pci/olpc.c 2011-04-17 15:56:46.000000000 -0400
-@@ -297,7 +297,7 @@ static int pci_olpc_write(unsigned int s
- return 0;
- }
-
--static struct pci_raw_ops pci_olpc_conf = {
-+static const struct pci_raw_ops pci_olpc_conf = {
- .read = pci_olpc_read,
- .write = pci_olpc_write,
- };
-diff -urNp linux-2.6.32.45/arch/x86/pci/pcbios.c linux-2.6.32.45/arch/x86/pci/pcbios.c
---- linux-2.6.32.45/arch/x86/pci/pcbios.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/pci/pcbios.c 2011-04-17 15:56:46.000000000 -0400
-@@ -56,50 +56,93 @@ union bios32 {
- static struct {
- unsigned long address;
- unsigned short segment;
--} bios32_indirect = { 0, __KERNEL_CS };
-+} bios32_indirect __read_only = { 0, __PCIBIOS_CS };
-
- /*
- * Returns the entry point for the given service, NULL on error
- */
-
--static unsigned long bios32_service(unsigned long service)
-+static unsigned long __devinit bios32_service(unsigned long service)
- {
- unsigned char return_code; /* %al */
- unsigned long address; /* %ebx */
- unsigned long length; /* %ecx */
- unsigned long entry; /* %edx */
- unsigned long flags;
-+ struct desc_struct d, *gdt;
-
- local_irq_save(flags);
-- __asm__("lcall *(%%edi); cld"
-+
-+ gdt = get_cpu_gdt_table(smp_processor_id());
-+
-+ pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x9B, 0xC);
-+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
-+ pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x93, 0xC);
-+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
-+
-+ __asm__("movw %w7, %%ds; lcall *(%%edi); push %%ss; pop %%ds; cld"
- : "=a" (return_code),
- "=b" (address),
- "=c" (length),
- "=d" (entry)
- : "0" (service),
- "1" (0),
-- "D" (&bios32_indirect));
-+ "D" (&bios32_indirect),
-+ "r"(__PCIBIOS_DS)
-+ : "memory");
-+
-+ pax_open_kernel();
-+ gdt[GDT_ENTRY_PCIBIOS_CS].a = 0;
-+ gdt[GDT_ENTRY_PCIBIOS_CS].b = 0;
-+ gdt[GDT_ENTRY_PCIBIOS_DS].a = 0;
-+ gdt[GDT_ENTRY_PCIBIOS_DS].b = 0;
-+ pax_close_kernel();
-+
- local_irq_restore(flags);
-
- switch (return_code) {
-- case 0:
-- return address + entry;
-- case 0x80: /* Not present */
-- printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
-- return 0;
-- default: /* Shouldn't happen */
-- printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
-- service, return_code);
-+ case 0: {
-+ int cpu;
-+ unsigned char flags;
-+
-+ printk(KERN_INFO "bios32_service: base:%08lx length:%08lx entry:%08lx\n", address, length, entry);
-+ if (address >= 0xFFFF0 || length > 0x100000 - address || length <= entry) {
-+ printk(KERN_WARNING "bios32_service: not valid\n");
- return 0;
-+ }
-+ address = address + PAGE_OFFSET;
-+ length += 16UL; /* some BIOSs underreport this... */
-+ flags = 4;
-+ if (length >= 64*1024*1024) {
-+ length >>= PAGE_SHIFT;
-+ flags |= 8;
-+ }
-+
-+ for (cpu = 0; cpu < NR_CPUS; cpu++) {
-+ gdt = get_cpu_gdt_table(cpu);
-+ pack_descriptor(&d, address, length, 0x9b, flags);
-+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
-+ pack_descriptor(&d, address, length, 0x93, flags);
-+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
-+ }
-+ return entry;
-+ }
-+ case 0x80: /* Not present */
-+ printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
-+ return 0;
-+ default: /* Shouldn't happen */
-+ printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
-+ service, return_code);
-+ return 0;
- }
- }
-
- static struct {
- unsigned long address;
- unsigned short segment;
--} pci_indirect = { 0, __KERNEL_CS };
-+} pci_indirect __read_only = { 0, __PCIBIOS_CS };
-
--static int pci_bios_present;
-+static int pci_bios_present __read_only;
-
- static int __devinit check_pcibios(void)
- {
-@@ -108,11 +151,13 @@ static int __devinit check_pcibios(void)
- unsigned long flags, pcibios_entry;
-
- if ((pcibios_entry = bios32_service(PCI_SERVICE))) {
-- pci_indirect.address = pcibios_entry + PAGE_OFFSET;
-+ pci_indirect.address = pcibios_entry;
-
- local_irq_save(flags);
-- __asm__(
-- "lcall *(%%edi); cld\n\t"
-+ __asm__("movw %w6, %%ds\n\t"
-+ "lcall *%%ss:(%%edi); cld\n\t"
-+ "push %%ss\n\t"
-+ "pop %%ds\n\t"
- "jc 1f\n\t"
- "xor %%ah, %%ah\n"
- "1:"
-@@ -121,7 +166,8 @@ static int __devinit check_pcibios(void)
- "=b" (ebx),
- "=c" (ecx)
- : "1" (PCIBIOS_PCI_BIOS_PRESENT),
-- "D" (&pci_indirect)
-+ "D" (&pci_indirect),
-+ "r" (__PCIBIOS_DS)
- : "memory");
- local_irq_restore(flags);
-
-@@ -165,7 +211,10 @@ static int pci_bios_read(unsigned int se
-
- switch (len) {
- case 1:
-- __asm__("lcall *(%%esi); cld\n\t"
-+ __asm__("movw %w6, %%ds\n\t"
-+ "lcall *%%ss:(%%esi); cld\n\t"
-+ "push %%ss\n\t"
-+ "pop %%ds\n\t"
- "jc 1f\n\t"
- "xor %%ah, %%ah\n"
- "1:"
-@@ -174,7 +223,8 @@ static int pci_bios_read(unsigned int se
- : "1" (PCIBIOS_READ_CONFIG_BYTE),
- "b" (bx),
- "D" ((long)reg),
-- "S" (&pci_indirect));
-+ "S" (&pci_indirect),
-+ "r" (__PCIBIOS_DS));
- /*
- * Zero-extend the result beyond 8 bits, do not trust the
- * BIOS having done it:
-@@ -182,7 +232,10 @@ static int pci_bios_read(unsigned int se
- *value &= 0xff;
- break;
- case 2:
-- __asm__("lcall *(%%esi); cld\n\t"
-+ __asm__("movw %w6, %%ds\n\t"
-+ "lcall *%%ss:(%%esi); cld\n\t"
-+ "push %%ss\n\t"
-+ "pop %%ds\n\t"
- "jc 1f\n\t"
- "xor %%ah, %%ah\n"
- "1:"
-@@ -191,7 +244,8 @@ static int pci_bios_read(unsigned int se
- : "1" (PCIBIOS_READ_CONFIG_WORD),
- "b" (bx),
- "D" ((long)reg),
-- "S" (&pci_indirect));
-+ "S" (&pci_indirect),
-+ "r" (__PCIBIOS_DS));
- /*
- * Zero-extend the result beyond 16 bits, do not trust the
- * BIOS having done it:
-@@ -199,7 +253,10 @@ static int pci_bios_read(unsigned int se
- *value &= 0xffff;
- break;
- case 4:
-- __asm__("lcall *(%%esi); cld\n\t"
-+ __asm__("movw %w6, %%ds\n\t"
-+ "lcall *%%ss:(%%esi); cld\n\t"
-+ "push %%ss\n\t"
-+ "pop %%ds\n\t"
- "jc 1f\n\t"
- "xor %%ah, %%ah\n"
- "1:"
-@@ -208,7 +265,8 @@ static int pci_bios_read(unsigned int se
- : "1" (PCIBIOS_READ_CONFIG_DWORD),
- "b" (bx),
- "D" ((long)reg),
-- "S" (&pci_indirect));
-+ "S" (&pci_indirect),
-+ "r" (__PCIBIOS_DS));
- break;
- }
-
-@@ -231,7 +289,10 @@ static int pci_bios_write(unsigned int s
-
- switch (len) {
- case 1:
-- __asm__("lcall *(%%esi); cld\n\t"
-+ __asm__("movw %w6, %%ds\n\t"
-+ "lcall *%%ss:(%%esi); cld\n\t"
-+ "push %%ss\n\t"
-+ "pop %%ds\n\t"
- "jc 1f\n\t"
- "xor %%ah, %%ah\n"
- "1:"
-@@ -240,10 +301,14 @@ static int pci_bios_write(unsigned int s
- "c" (value),
- "b" (bx),
- "D" ((long)reg),
-- "S" (&pci_indirect));
-+ "S" (&pci_indirect),
-+ "r" (__PCIBIOS_DS));
- break;
- case 2:
-- __asm__("lcall *(%%esi); cld\n\t"
-+ __asm__("movw %w6, %%ds\n\t"
-+ "lcall *%%ss:(%%esi); cld\n\t"
-+ "push %%ss\n\t"
-+ "pop %%ds\n\t"
- "jc 1f\n\t"
- "xor %%ah, %%ah\n"
- "1:"
-@@ -252,10 +317,14 @@ static int pci_bios_write(unsigned int s
- "c" (value),
- "b" (bx),
- "D" ((long)reg),
-- "S" (&pci_indirect));
-+ "S" (&pci_indirect),
-+ "r" (__PCIBIOS_DS));
- break;
- case 4:
-- __asm__("lcall *(%%esi); cld\n\t"
-+ __asm__("movw %w6, %%ds\n\t"
-+ "lcall *%%ss:(%%esi); cld\n\t"
-+ "push %%ss\n\t"
-+ "pop %%ds\n\t"
- "jc 1f\n\t"
- "xor %%ah, %%ah\n"
- "1:"
-@@ -264,7 +333,8 @@ static int pci_bios_write(unsigned int s
- "c" (value),
- "b" (bx),
- "D" ((long)reg),
-- "S" (&pci_indirect));
-+ "S" (&pci_indirect),
-+ "r" (__PCIBIOS_DS));
- break;
- }
-
-@@ -278,7 +348,7 @@ static int pci_bios_write(unsigned int s
- * Function table for BIOS32 access
- */
-
--static struct pci_raw_ops pci_bios_access = {
-+static const struct pci_raw_ops pci_bios_access = {
- .read = pci_bios_read,
- .write = pci_bios_write
- };
-@@ -287,7 +357,7 @@ static struct pci_raw_ops pci_bios_acces
- * Try to find PCI BIOS.
- */
-
--static struct pci_raw_ops * __devinit pci_find_bios(void)
-+static const struct pci_raw_ops * __devinit pci_find_bios(void)
- {
- union bios32 *check;
- unsigned char sum;
-@@ -368,10 +438,13 @@ struct irq_routing_table * pcibios_get_i
-
- DBG("PCI: Fetching IRQ routing table... ");
- __asm__("push %%es\n\t"
-+ "movw %w8, %%ds\n\t"
- "push %%ds\n\t"
- "pop %%es\n\t"
-- "lcall *(%%esi); cld\n\t"
-+ "lcall *%%ss:(%%esi); cld\n\t"
- "pop %%es\n\t"
-+ "push %%ss\n\t"
-+ "pop %%ds\n"
- "jc 1f\n\t"
- "xor %%ah, %%ah\n"
- "1:"
-@@ -382,7 +455,8 @@ struct irq_routing_table * pcibios_get_i
- "1" (0),
- "D" ((long) &opt),
- "S" (&pci_indirect),
-- "m" (opt)
-+ "m" (opt),
-+ "r" (__PCIBIOS_DS)
- : "memory");
- DBG("OK ret=%d, size=%d, map=%x\n", ret, opt.size, map);
- if (ret & 0xff00)
-@@ -406,7 +480,10 @@ int pcibios_set_irq_routing(struct pci_d
- {
- int ret;
-
-- __asm__("lcall *(%%esi); cld\n\t"
-+ __asm__("movw %w5, %%ds\n\t"
-+ "lcall *%%ss:(%%esi); cld\n\t"
-+ "push %%ss\n\t"
-+ "pop %%ds\n"
- "jc 1f\n\t"
- "xor %%ah, %%ah\n"
- "1:"
-@@ -414,7 +491,8 @@ int pcibios_set_irq_routing(struct pci_d
- : "0" (PCIBIOS_SET_PCI_HW_INT),
- "b" ((dev->bus->number << 8) | dev->devfn),
- "c" ((irq << 8) | (pin + 10)),
-- "S" (&pci_indirect));
-+ "S" (&pci_indirect),
-+ "r" (__PCIBIOS_DS));
- return !(ret & 0xff00);
- }
- EXPORT_SYMBOL(pcibios_set_irq_routing);
-diff -urNp linux-2.6.32.45/arch/x86/power/cpu.c linux-2.6.32.45/arch/x86/power/cpu.c
---- linux-2.6.32.45/arch/x86/power/cpu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/power/cpu.c 2011-04-17 15:56:46.000000000 -0400
-@@ -129,7 +129,7 @@ static void do_fpu_end(void)
- static void fix_processor_context(void)
- {
- int cpu = smp_processor_id();
-- struct tss_struct *t = &per_cpu(init_tss, cpu);
-+ struct tss_struct *t = init_tss + cpu;
-
- set_tss_desc(cpu, t); /*
- * This just modifies memory; should not be
-@@ -139,7 +139,9 @@ static void fix_processor_context(void)
- */
-
- #ifdef CONFIG_X86_64
-+ pax_open_kernel();
- get_cpu_gdt_table(cpu)[GDT_ENTRY_TSS].type = 9;
-+ pax_close_kernel();
-
- syscall_init(); /* This sets MSR_*STAR and related */
- #endif
-diff -urNp linux-2.6.32.45/arch/x86/vdso/Makefile linux-2.6.32.45/arch/x86/vdso/Makefile
---- linux-2.6.32.45/arch/x86/vdso/Makefile 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/vdso/Makefile 2011-04-17 15:56:46.000000000 -0400
-@@ -122,7 +122,7 @@ quiet_cmd_vdso = VDSO $@
- $(VDSO_LDFLAGS) $(VDSO_LDFLAGS_$(filter %.lds,$(^F))) \
- -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^)
-
--VDSO_LDFLAGS = -fPIC -shared $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
-+VDSO_LDFLAGS = -fPIC -shared -Wl,--no-undefined $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
- GCOV_PROFILE := n
-
- #
-diff -urNp linux-2.6.32.45/arch/x86/vdso/vclock_gettime.c linux-2.6.32.45/arch/x86/vdso/vclock_gettime.c
---- linux-2.6.32.45/arch/x86/vdso/vclock_gettime.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/vdso/vclock_gettime.c 2011-04-17 15:56:46.000000000 -0400
-@@ -22,24 +22,48 @@
- #include <asm/hpet.h>
- #include <asm/unistd.h>
- #include <asm/io.h>
-+#include <asm/fixmap.h>
- #include "vextern.h"
-
- #define gtod vdso_vsyscall_gtod_data
-
-+notrace noinline long __vdso_fallback_time(long *t)
-+{
-+ long secs;
-+ asm volatile("syscall"
-+ : "=a" (secs)
-+ : "0" (__NR_time),"D" (t) : "r11", "cx", "memory");
-+ return secs;
-+}
-+
- notrace static long vdso_fallback_gettime(long clock, struct timespec *ts)
- {
- long ret;
- asm("syscall" : "=a" (ret) :
-- "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "memory");
-+ "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "r11", "cx", "memory");
- return ret;
- }
-
-+notrace static inline cycle_t __vdso_vread_hpet(void)
-+{
-+ return readl((const void __iomem *)fix_to_virt(VSYSCALL_HPET) + 0xf0);
-+}
-+
-+notrace static inline cycle_t __vdso_vread_tsc(void)
-+{
-+ cycle_t ret = (cycle_t)vget_cycles();
-+
-+ return ret >= gtod->clock.cycle_last ? ret : gtod->clock.cycle_last;
-+}
-+
- notrace static inline long vgetns(void)
- {
- long v;
-- cycles_t (*vread)(void);
-- vread = gtod->clock.vread;
-- v = (vread() - gtod->clock.cycle_last) & gtod->clock.mask;
-+ if (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3])
-+ v = __vdso_vread_tsc();
-+ else
-+ v = __vdso_vread_hpet();
-+ v = (v - gtod->clock.cycle_last) & gtod->clock.mask;
- return (v * gtod->clock.mult) >> gtod->clock.shift;
- }
-
-@@ -113,7 +137,9 @@ notrace static noinline int do_monotonic
-
- notrace int __vdso_clock_gettime(clockid_t clock, struct timespec *ts)
- {
-- if (likely(gtod->sysctl_enabled))
-+ if (likely(gtod->sysctl_enabled &&
-+ ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
-+ (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
- switch (clock) {
- case CLOCK_REALTIME:
- if (likely(gtod->clock.vread))
-@@ -133,10 +159,20 @@ notrace int __vdso_clock_gettime(clockid
- int clock_gettime(clockid_t, struct timespec *)
- __attribute__((weak, alias("__vdso_clock_gettime")));
-
--notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
-+notrace noinline int __vdso_fallback_gettimeofday(struct timeval *tv, struct timezone *tz)
- {
- long ret;
-- if (likely(gtod->sysctl_enabled && gtod->clock.vread)) {
-+ asm("syscall" : "=a" (ret) :
-+ "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "r11", "cx", "memory");
-+ return ret;
-+}
-+
-+notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
-+{
-+ if (likely(gtod->sysctl_enabled &&
-+ ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
-+ (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
-+ {
- if (likely(tv != NULL)) {
- BUILD_BUG_ON(offsetof(struct timeval, tv_usec) !=
- offsetof(struct timespec, tv_nsec) ||
-@@ -151,9 +187,7 @@ notrace int __vdso_gettimeofday(struct t
- }
- return 0;
- }
-- asm("syscall" : "=a" (ret) :
-- "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "memory");
-- return ret;
-+ return __vdso_fallback_gettimeofday(tv, tz);
- }
- int gettimeofday(struct timeval *, struct timezone *)
- __attribute__((weak, alias("__vdso_gettimeofday")));
-diff -urNp linux-2.6.32.45/arch/x86/vdso/vdso32-setup.c linux-2.6.32.45/arch/x86/vdso/vdso32-setup.c
---- linux-2.6.32.45/arch/x86/vdso/vdso32-setup.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/vdso/vdso32-setup.c 2011-04-23 12:56:10.000000000 -0400
-@@ -25,6 +25,7 @@
- #include <asm/tlbflush.h>
- #include <asm/vdso.h>
- #include <asm/proto.h>
-+#include <asm/mman.h>
-
- enum {
- VDSO_DISABLED = 0,
-@@ -226,7 +227,7 @@ static inline void map_compat_vdso(int m
- void enable_sep_cpu(void)
- {
- int cpu = get_cpu();
-- struct tss_struct *tss = &per_cpu(init_tss, cpu);
-+ struct tss_struct *tss = init_tss + cpu;
-
- if (!boot_cpu_has(X86_FEATURE_SEP)) {
- put_cpu();
-@@ -249,7 +250,7 @@ static int __init gate_vma_init(void)
- gate_vma.vm_start = FIXADDR_USER_START;
- gate_vma.vm_end = FIXADDR_USER_END;
- gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
-- gate_vma.vm_page_prot = __P101;
-+ gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
- /*
- * Make sure the vDSO gets into every core dump.
- * Dumping its contents makes post-mortem fully interpretable later
-@@ -331,14 +332,14 @@ int arch_setup_additional_pages(struct l
- if (compat)
- addr = VDSO_HIGH_BASE;
- else {
-- addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
-+ addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, MAP_EXECUTABLE);
- if (IS_ERR_VALUE(addr)) {
- ret = addr;
- goto up_fail;
- }
- }
-
-- current->mm->context.vdso = (void *)addr;
-+ current->mm->context.vdso = addr;
-
- if (compat_uses_vma || !compat) {
- /*
-@@ -361,11 +362,11 @@ int arch_setup_additional_pages(struct l
- }
-
- current_thread_info()->sysenter_return =
-- VDSO32_SYMBOL(addr, SYSENTER_RETURN);
-+ (__force void __user *)VDSO32_SYMBOL(addr, SYSENTER_RETURN);
-
- up_fail:
- if (ret)
-- current->mm->context.vdso = NULL;
-+ current->mm->context.vdso = 0;
-
- up_write(&mm->mmap_sem);
-
-@@ -413,8 +414,14 @@ __initcall(ia32_binfmt_init);
-
- const char *arch_vma_name(struct vm_area_struct *vma)
- {
-- if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
-+ if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
- return "[vdso]";
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (vma->vm_mm && vma->vm_mirror && vma->vm_mirror->vm_start == vma->vm_mm->context.vdso)
-+ return "[vdso]";
-+#endif
-+
- return NULL;
- }
-
-@@ -423,7 +430,7 @@ struct vm_area_struct *get_gate_vma(stru
- struct mm_struct *mm = tsk->mm;
-
- /* Check to see if this task was created in compat vdso mode */
-- if (mm && mm->context.vdso == (void *)VDSO_HIGH_BASE)
-+ if (mm && mm->context.vdso == VDSO_HIGH_BASE)
- return &gate_vma;
- return NULL;
- }
-diff -urNp linux-2.6.32.45/arch/x86/vdso/vdso.lds.S linux-2.6.32.45/arch/x86/vdso/vdso.lds.S
---- linux-2.6.32.45/arch/x86/vdso/vdso.lds.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/vdso/vdso.lds.S 2011-06-06 17:35:35.000000000 -0400
-@@ -35,3 +35,9 @@ VDSO64_PRELINK = VDSO_PRELINK;
- #define VEXTERN(x) VDSO64_ ## x = vdso_ ## x;
- #include "vextern.h"
- #undef VEXTERN
-+
-+#define VEXTERN(x) VDSO64_ ## x = __vdso_ ## x;
-+VEXTERN(fallback_gettimeofday)
-+VEXTERN(fallback_time)
-+VEXTERN(getcpu)
-+#undef VEXTERN
-diff -urNp linux-2.6.32.45/arch/x86/vdso/vextern.h linux-2.6.32.45/arch/x86/vdso/vextern.h
---- linux-2.6.32.45/arch/x86/vdso/vextern.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/vdso/vextern.h 2011-04-17 15:56:46.000000000 -0400
-@@ -11,6 +11,5 @@
- put into vextern.h and be referenced as a pointer with vdso prefix.
- The main kernel later fills in the values. */
-
--VEXTERN(jiffies)
- VEXTERN(vgetcpu_mode)
- VEXTERN(vsyscall_gtod_data)
-diff -urNp linux-2.6.32.45/arch/x86/vdso/vma.c linux-2.6.32.45/arch/x86/vdso/vma.c
---- linux-2.6.32.45/arch/x86/vdso/vma.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/vdso/vma.c 2011-04-17 15:56:46.000000000 -0400
-@@ -57,7 +57,7 @@ static int __init init_vdso_vars(void)
- if (!vbase)
- goto oom;
-
-- if (memcmp(vbase, "\177ELF", 4)) {
-+ if (memcmp(vbase, ELFMAG, SELFMAG)) {
- printk("VDSO: I'm broken; not ELF\n");
- vdso_enabled = 0;
- }
-@@ -66,6 +66,7 @@ static int __init init_vdso_vars(void)
- *(typeof(__ ## x) **) var_ref(VDSO64_SYMBOL(vbase, x), #x) = &__ ## x;
- #include "vextern.h"
- #undef VEXTERN
-+ vunmap(vbase);
- return 0;
-
- oom:
-@@ -116,7 +117,7 @@ int arch_setup_additional_pages(struct l
- goto up_fail;
- }
-
-- current->mm->context.vdso = (void *)addr;
-+ current->mm->context.vdso = addr;
-
- ret = install_special_mapping(mm, addr, vdso_size,
- VM_READ|VM_EXEC|
-@@ -124,7 +125,7 @@ int arch_setup_additional_pages(struct l
- VM_ALWAYSDUMP,
- vdso_pages);
- if (ret) {
-- current->mm->context.vdso = NULL;
-+ current->mm->context.vdso = 0;
- goto up_fail;
- }
-
-@@ -132,10 +133,3 @@ up_fail:
- up_write(&mm->mmap_sem);
- return ret;
- }
--
--static __init int vdso_setup(char *s)
--{
-- vdso_enabled = simple_strtoul(s, NULL, 0);
-- return 0;
--}
--__setup("vdso=", vdso_setup);
-diff -urNp linux-2.6.32.45/arch/x86/xen/enlighten.c linux-2.6.32.45/arch/x86/xen/enlighten.c
---- linux-2.6.32.45/arch/x86/xen/enlighten.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/xen/enlighten.c 2011-05-22 23:02:03.000000000 -0400
-@@ -71,8 +71,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
-
- struct shared_info xen_dummy_shared_info;
-
--void *xen_initial_gdt;
--
- /*
- * Point at some empty memory to start with. We map the real shared_info
- * page as soon as fixmap is up and running.
-@@ -548,7 +546,7 @@ static void xen_write_idt_entry(gate_des
-
- preempt_disable();
-
-- start = __get_cpu_var(idt_desc).address;
-+ start = (unsigned long)__get_cpu_var(idt_desc).address;
- end = start + __get_cpu_var(idt_desc).size + 1;
-
- xen_mc_flush();
-@@ -993,7 +991,7 @@ static const struct pv_apic_ops xen_apic
- #endif
- };
-
--static void xen_reboot(int reason)
-+static __noreturn void xen_reboot(int reason)
- {
- struct sched_shutdown r = { .reason = reason };
-
-@@ -1001,17 +999,17 @@ static void xen_reboot(int reason)
- BUG();
- }
-
--static void xen_restart(char *msg)
-+static __noreturn void xen_restart(char *msg)
- {
- xen_reboot(SHUTDOWN_reboot);
- }
-
--static void xen_emergency_restart(void)
-+static __noreturn void xen_emergency_restart(void)
- {
- xen_reboot(SHUTDOWN_reboot);
- }
-
--static void xen_machine_halt(void)
-+static __noreturn void xen_machine_halt(void)
- {
- xen_reboot(SHUTDOWN_poweroff);
- }
-@@ -1095,9 +1093,20 @@ asmlinkage void __init xen_start_kernel(
- */
- __userpte_alloc_gfp &= ~__GFP_HIGHMEM;
-
--#ifdef CONFIG_X86_64
- /* Work out if we support NX */
-- check_efer();
-+#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
-+ if ((cpuid_eax(0x80000000) & 0xffff0000) == 0x80000000 &&
-+ (cpuid_edx(0x80000001) & (1U << (X86_FEATURE_NX & 31)))) {
-+ unsigned l, h;
-+
-+#ifdef CONFIG_X86_PAE
-+ nx_enabled = 1;
-+#endif
-+ __supported_pte_mask |= _PAGE_NX;
-+ rdmsr(MSR_EFER, l, h);
-+ l |= EFER_NX;
-+ wrmsr(MSR_EFER, l, h);
-+ }
- #endif
-
- xen_setup_features();
-@@ -1129,13 +1138,6 @@ asmlinkage void __init xen_start_kernel(
-
- machine_ops = xen_machine_ops;
-
-- /*
-- * The only reliable way to retain the initial address of the
-- * percpu gdt_page is to remember it here, so we can go and
-- * mark it RW later, when the initial percpu area is freed.
-- */
-- xen_initial_gdt = &per_cpu(gdt_page, 0);
--
- xen_smp_init();
-
- pgd = (pgd_t *)xen_start_info->pt_base;
-diff -urNp linux-2.6.32.45/arch/x86/xen/mmu.c linux-2.6.32.45/arch/x86/xen/mmu.c
---- linux-2.6.32.45/arch/x86/xen/mmu.c 2011-07-13 17:23:04.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/xen/mmu.c 2011-07-13 17:23:18.000000000 -0400
-@@ -1719,6 +1719,8 @@ __init pgd_t *xen_setup_kernel_pagetable
- convert_pfn_mfn(init_level4_pgt);
- convert_pfn_mfn(level3_ident_pgt);
- convert_pfn_mfn(level3_kernel_pgt);
-+ convert_pfn_mfn(level3_vmalloc_pgt);
-+ convert_pfn_mfn(level3_vmemmap_pgt);
-
- l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd);
- l2 = m2v(l3[pud_index(__START_KERNEL_map)].pud);
-@@ -1737,7 +1739,10 @@ __init pgd_t *xen_setup_kernel_pagetable
- set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
- set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
- set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
-+ set_page_prot(level3_vmalloc_pgt, PAGE_KERNEL_RO);
-+ set_page_prot(level3_vmemmap_pgt, PAGE_KERNEL_RO);
- set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
-+ set_page_prot(level2_vmemmap_pgt, PAGE_KERNEL_RO);
- set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
- set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
-
-diff -urNp linux-2.6.32.45/arch/x86/xen/smp.c linux-2.6.32.45/arch/x86/xen/smp.c
---- linux-2.6.32.45/arch/x86/xen/smp.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/xen/smp.c 2011-05-11 18:25:15.000000000 -0400
-@@ -167,11 +167,6 @@ static void __init xen_smp_prepare_boot_
- {
- BUG_ON(smp_processor_id() != 0);
- native_smp_prepare_boot_cpu();
--
-- /* We've switched to the "real" per-cpu gdt, so make sure the
-- old memory can be recycled */
-- make_lowmem_page_readwrite(xen_initial_gdt);
--
- xen_setup_vcpu_info_placement();
- }
-
-@@ -231,12 +226,12 @@ cpu_initialize_context(unsigned int cpu,
- gdt = get_cpu_gdt_table(cpu);
-
- ctxt->flags = VGCF_IN_KERNEL;
-- ctxt->user_regs.ds = __USER_DS;
-- ctxt->user_regs.es = __USER_DS;
-+ ctxt->user_regs.ds = __KERNEL_DS;
-+ ctxt->user_regs.es = __KERNEL_DS;
- ctxt->user_regs.ss = __KERNEL_DS;
- #ifdef CONFIG_X86_32
- ctxt->user_regs.fs = __KERNEL_PERCPU;
-- ctxt->user_regs.gs = __KERNEL_STACK_CANARY;
-+ savesegment(gs, ctxt->user_regs.gs);
- #else
- ctxt->gs_base_kernel = per_cpu_offset(cpu);
- #endif
-@@ -287,13 +282,12 @@ static int __cpuinit xen_cpu_up(unsigned
- int rc;
-
- per_cpu(current_task, cpu) = idle;
-+ per_cpu(current_tinfo, cpu) = &idle->tinfo;
- #ifdef CONFIG_X86_32
- irq_ctx_init(cpu);
- #else
- clear_tsk_thread_flag(idle, TIF_FORK);
-- per_cpu(kernel_stack, cpu) =
-- (unsigned long)task_stack_page(idle) -
-- KERNEL_STACK_OFFSET + THREAD_SIZE;
-+ per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(idle) - 16 + THREAD_SIZE;
- #endif
- xen_setup_runstate_info(cpu);
- xen_setup_timer(cpu);
-diff -urNp linux-2.6.32.45/arch/x86/xen/xen-asm_32.S linux-2.6.32.45/arch/x86/xen/xen-asm_32.S
---- linux-2.6.32.45/arch/x86/xen/xen-asm_32.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/xen/xen-asm_32.S 2011-04-22 19:13:13.000000000 -0400
-@@ -83,14 +83,14 @@ ENTRY(xen_iret)
- ESP_OFFSET=4 # bytes pushed onto stack
-
- /*
-- * Store vcpu_info pointer for easy access. Do it this way to
-- * avoid having to reload %fs
-+ * Store vcpu_info pointer for easy access.
- */
- #ifdef CONFIG_SMP
-- GET_THREAD_INFO(%eax)
-- movl TI_cpu(%eax), %eax
-- movl __per_cpu_offset(,%eax,4), %eax
-- mov per_cpu__xen_vcpu(%eax), %eax
-+ push %fs
-+ mov $(__KERNEL_PERCPU), %eax
-+ mov %eax, %fs
-+ mov PER_CPU_VAR(xen_vcpu), %eax
-+ pop %fs
- #else
- movl per_cpu__xen_vcpu, %eax
- #endif
-diff -urNp linux-2.6.32.45/arch/x86/xen/xen-head.S linux-2.6.32.45/arch/x86/xen/xen-head.S
---- linux-2.6.32.45/arch/x86/xen/xen-head.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/xen/xen-head.S 2011-04-17 15:56:46.000000000 -0400
-@@ -19,6 +19,17 @@ ENTRY(startup_xen)
- #ifdef CONFIG_X86_32
- mov %esi,xen_start_info
- mov $init_thread_union+THREAD_SIZE,%esp
-+#ifdef CONFIG_SMP
-+ movl $cpu_gdt_table,%edi
-+ movl $__per_cpu_load,%eax
-+ movw %ax,__KERNEL_PERCPU + 2(%edi)
-+ rorl $16,%eax
-+ movb %al,__KERNEL_PERCPU + 4(%edi)
-+ movb %ah,__KERNEL_PERCPU + 7(%edi)
-+ movl $__per_cpu_end - 1,%eax
-+ subl $__per_cpu_start,%eax
-+ movw %ax,__KERNEL_PERCPU + 0(%edi)
-+#endif
- #else
- mov %rsi,xen_start_info
- mov $init_thread_union+THREAD_SIZE,%rsp
-diff -urNp linux-2.6.32.45/arch/x86/xen/xen-ops.h linux-2.6.32.45/arch/x86/xen/xen-ops.h
---- linux-2.6.32.45/arch/x86/xen/xen-ops.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/arch/x86/xen/xen-ops.h 2011-04-17 15:56:46.000000000 -0400
-@@ -10,8 +10,6 @@
- extern const char xen_hypervisor_callback[];
- extern const char xen_failsafe_callback[];
-
--extern void *xen_initial_gdt;
--
- struct trap_info;
- void xen_copy_trap_info(struct trap_info *traps);
-
-diff -urNp linux-2.6.32.45/block/blk-integrity.c linux-2.6.32.45/block/blk-integrity.c
---- linux-2.6.32.45/block/blk-integrity.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/block/blk-integrity.c 2011-04-17 15:56:46.000000000 -0400
-@@ -278,7 +278,7 @@ static struct attribute *integrity_attrs
- NULL,
- };
-
--static struct sysfs_ops integrity_ops = {
-+static const struct sysfs_ops integrity_ops = {
- .show = &integrity_attr_show,
- .store = &integrity_attr_store,
- };
-diff -urNp linux-2.6.32.45/block/blk-iopoll.c linux-2.6.32.45/block/blk-iopoll.c
---- linux-2.6.32.45/block/blk-iopoll.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/block/blk-iopoll.c 2011-04-17 15:56:46.000000000 -0400
-@@ -77,7 +77,7 @@ void blk_iopoll_complete(struct blk_iopo
- }
- EXPORT_SYMBOL(blk_iopoll_complete);
-
--static void blk_iopoll_softirq(struct softirq_action *h)
-+static void blk_iopoll_softirq(void)
- {
- struct list_head *list = &__get_cpu_var(blk_cpu_iopoll);
- int rearm = 0, budget = blk_iopoll_budget;
-diff -urNp linux-2.6.32.45/block/blk-map.c linux-2.6.32.45/block/blk-map.c
---- linux-2.6.32.45/block/blk-map.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/block/blk-map.c 2011-04-18 16:57:33.000000000 -0400
-@@ -54,7 +54,7 @@ static int __blk_rq_map_user(struct requ
- * direct dma. else, set up kernel bounce buffers
- */
- uaddr = (unsigned long) ubuf;
-- if (blk_rq_aligned(q, ubuf, len) && !map_data)
-+ if (blk_rq_aligned(q, (__force void *)ubuf, len) && !map_data)
- bio = bio_map_user(q, NULL, uaddr, len, reading, gfp_mask);
- else
- bio = bio_copy_user(q, map_data, uaddr, len, reading, gfp_mask);
-@@ -201,12 +201,13 @@ int blk_rq_map_user_iov(struct request_q
- for (i = 0; i < iov_count; i++) {
- unsigned long uaddr = (unsigned long)iov[i].iov_base;
-
-+ if (!iov[i].iov_len)
-+ return -EINVAL;
-+
- if (uaddr & queue_dma_alignment(q)) {
- unaligned = 1;
- break;
- }
-- if (!iov[i].iov_len)
-- return -EINVAL;
- }
-
- if (unaligned || (q->dma_pad_mask & len) || map_data)
-@@ -299,7 +300,7 @@ int blk_rq_map_kern(struct request_queue
- if (!len || !kbuf)
- return -EINVAL;
-
-- do_copy = !blk_rq_aligned(q, kbuf, len) || object_is_on_stack(kbuf);
-+ do_copy = !blk_rq_aligned(q, kbuf, len) || object_starts_on_stack(kbuf);
- if (do_copy)
- bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
- else
-diff -urNp linux-2.6.32.45/block/blk-softirq.c linux-2.6.32.45/block/blk-softirq.c
---- linux-2.6.32.45/block/blk-softirq.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/block/blk-softirq.c 2011-04-17 15:56:46.000000000 -0400
-@@ -17,7 +17,7 @@ static DEFINE_PER_CPU(struct list_head,
- * Softirq action handler - move entries to local list and loop over them
- * while passing them to the queue registered handler.
- */
--static void blk_done_softirq(struct softirq_action *h)
-+static void blk_done_softirq(void)
- {
- struct list_head *cpu_list, local_list;
-
-diff -urNp linux-2.6.32.45/block/blk-sysfs.c linux-2.6.32.45/block/blk-sysfs.c
---- linux-2.6.32.45/block/blk-sysfs.c 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.45/block/blk-sysfs.c 2011-05-10 22:12:26.000000000 -0400
-@@ -414,7 +414,7 @@ static void blk_release_queue(struct kob
- kmem_cache_free(blk_requestq_cachep, q);
- }
-
--static struct sysfs_ops queue_sysfs_ops = {
-+static const struct sysfs_ops queue_sysfs_ops = {
- .show = queue_attr_show,
- .store = queue_attr_store,
- };
-diff -urNp linux-2.6.32.45/block/bsg.c linux-2.6.32.45/block/bsg.c
---- linux-2.6.32.45/block/bsg.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/block/bsg.c 2011-04-17 15:56:46.000000000 -0400
-@@ -175,16 +175,24 @@ static int blk_fill_sgv4_hdr_rq(struct r
- struct sg_io_v4 *hdr, struct bsg_device *bd,
- fmode_t has_write_perm)
- {
-+ unsigned char tmpcmd[sizeof(rq->__cmd)];
-+ unsigned char *cmdptr;
-+
- if (hdr->request_len > BLK_MAX_CDB) {
- rq->cmd = kzalloc(hdr->request_len, GFP_KERNEL);
- if (!rq->cmd)
- return -ENOMEM;
-- }
-+ cmdptr = rq->cmd;
-+ } else
-+ cmdptr = tmpcmd;
-
-- if (copy_from_user(rq->cmd, (void *)(unsigned long)hdr->request,
-+ if (copy_from_user(cmdptr, (void *)(unsigned long)hdr->request,
- hdr->request_len))
- return -EFAULT;
-
-+ if (cmdptr != rq->cmd)
-+ memcpy(rq->cmd, cmdptr, hdr->request_len);
-+
- if (hdr->subprotocol == BSG_SUB_PROTOCOL_SCSI_CMD) {
- if (blk_verify_command(rq->cmd, has_write_perm))
- return -EPERM;
-diff -urNp linux-2.6.32.45/block/elevator.c linux-2.6.32.45/block/elevator.c
---- linux-2.6.32.45/block/elevator.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/block/elevator.c 2011-04-17 15:56:46.000000000 -0400
-@@ -889,7 +889,7 @@ elv_attr_store(struct kobject *kobj, str
- return error;
- }
-
--static struct sysfs_ops elv_sysfs_ops = {
-+static const struct sysfs_ops elv_sysfs_ops = {
- .show = elv_attr_show,
- .store = elv_attr_store,
- };
-diff -urNp linux-2.6.32.45/block/scsi_ioctl.c linux-2.6.32.45/block/scsi_ioctl.c
---- linux-2.6.32.45/block/scsi_ioctl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/block/scsi_ioctl.c 2011-04-23 13:28:22.000000000 -0400
-@@ -220,8 +220,20 @@ EXPORT_SYMBOL(blk_verify_command);
- static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
- struct sg_io_hdr *hdr, fmode_t mode)
- {
-- if (copy_from_user(rq->cmd, hdr->cmdp, hdr->cmd_len))
-+ unsigned char tmpcmd[sizeof(rq->__cmd)];
-+ unsigned char *cmdptr;
-+
-+ if (rq->cmd != rq->__cmd)
-+ cmdptr = rq->cmd;
-+ else
-+ cmdptr = tmpcmd;
-+
-+ if (copy_from_user(cmdptr, hdr->cmdp, hdr->cmd_len))
- return -EFAULT;
-+
-+ if (cmdptr != rq->cmd)
-+ memcpy(rq->cmd, cmdptr, hdr->cmd_len);
-+
- if (blk_verify_command(rq->cmd, mode & FMODE_WRITE))
- return -EPERM;
-
-@@ -430,6 +442,8 @@ int sg_scsi_ioctl(struct request_queue *
- int err;
- unsigned int in_len, out_len, bytes, opcode, cmdlen;
- char *buffer = NULL, sense[SCSI_SENSE_BUFFERSIZE];
-+ unsigned char tmpcmd[sizeof(rq->__cmd)];
-+ unsigned char *cmdptr;
-
- if (!sic)
- return -EINVAL;
-@@ -463,9 +477,18 @@ int sg_scsi_ioctl(struct request_queue *
- */
- err = -EFAULT;
- rq->cmd_len = cmdlen;
-- if (copy_from_user(rq->cmd, sic->data, cmdlen))
-+
-+ if (rq->cmd != rq->__cmd)
-+ cmdptr = rq->cmd;
-+ else
-+ cmdptr = tmpcmd;
-+
-+ if (copy_from_user(cmdptr, sic->data, cmdlen))
- goto error;
-
-+ if (rq->cmd != cmdptr)
-+ memcpy(rq->cmd, cmdptr, cmdlen);
-+
- if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len))
- goto error;
-
-diff -urNp linux-2.6.32.45/crypto/cryptd.c linux-2.6.32.45/crypto/cryptd.c
---- linux-2.6.32.45/crypto/cryptd.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/crypto/cryptd.c 2011-08-05 20:33:55.000000000 -0400
-@@ -214,7 +214,7 @@ static int cryptd_blkcipher_enqueue(stru
- struct cryptd_queue *queue;
-
- queue = cryptd_get_queue(crypto_ablkcipher_tfm(tfm));
-- rctx->complete = req->base.complete;
-+ *(void **)&rctx->complete = req->base.complete;
- req->base.complete = complete;
-
- return cryptd_enqueue_request(queue, &req->base);
-diff -urNp linux-2.6.32.45/crypto/gf128mul.c linux-2.6.32.45/crypto/gf128mul.c
---- linux-2.6.32.45/crypto/gf128mul.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/crypto/gf128mul.c 2011-07-06 19:53:33.000000000 -0400
-@@ -182,7 +182,7 @@ void gf128mul_lle(be128 *r, const be128
- for (i = 0; i < 7; ++i)
- gf128mul_x_lle(&p[i + 1], &p[i]);
-
-- memset(r, 0, sizeof(r));
-+ memset(r, 0, sizeof(*r));
- for (i = 0;;) {
- u8 ch = ((u8 *)b)[15 - i];
-
-@@ -220,7 +220,7 @@ void gf128mul_bbe(be128 *r, const be128
- for (i = 0; i < 7; ++i)
- gf128mul_x_bbe(&p[i + 1], &p[i]);
-
-- memset(r, 0, sizeof(r));
-+ memset(r, 0, sizeof(*r));
- for (i = 0;;) {
- u8 ch = ((u8 *)b)[i];
-
-diff -urNp linux-2.6.32.45/crypto/serpent.c linux-2.6.32.45/crypto/serpent.c
---- linux-2.6.32.45/crypto/serpent.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/crypto/serpent.c 2011-08-18 23:59:56.000000000 -0400
-@@ -21,6 +21,7 @@
- #include <asm/byteorder.h>
- #include <linux/crypto.h>
- #include <linux/types.h>
-+#include <linux/sched.h>
-
- /* Key is padded to the maximum of 256 bits before round key generation.
- * Any key length <= 256 bits (32 bytes) is allowed by the algorithm.
-@@ -224,6 +225,8 @@ static int serpent_setkey(struct crypto_
- u32 r0,r1,r2,r3,r4;
- int i;
-
-+ pax_track_stack();
-+
- /* Copy key, add padding */
-
- for (i = 0; i < keylen; ++i)
-diff -urNp linux-2.6.32.45/Documentation/dontdiff linux-2.6.32.45/Documentation/dontdiff
---- linux-2.6.32.45/Documentation/dontdiff 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/Documentation/dontdiff 2011-08-21 18:59:02.000000000 -0400
-@@ -1,13 +1,16 @@
- *.a
- *.aux
- *.bin
-+*.cis
- *.cpio
- *.csp
-+*.dbg
- *.dsp
- *.dvi
- *.elf
- *.eps
- *.fw
-+*.gcno
- *.gen.S
- *.gif
- *.grep
-@@ -38,8 +41,10 @@
- *.tab.h
- *.tex
- *.ver
-+*.vim
- *.xml
- *_MODULES
-+*_reg_safe.h
- *_vga16.c
- *~
- *.9
-@@ -49,11 +54,16 @@
- 53c700_d.h
- CVS
- ChangeSet
-+GPATH
-+GRTAGS
-+GSYMS
-+GTAGS
- Image
- Kerntypes
- Module.markers
- Module.symvers
- PENDING
-+PERF*
- SCCS
- System.map*
- TAGS
-@@ -76,7 +86,11 @@ btfixupprep
- build
- bvmlinux
- bzImage*
-+capability_names.h
-+capflags.c
- classlist.h*
-+clut_vga16.c
-+common-cmds.h
- comp*.log
- compile.h*
- conf
-@@ -97,19 +111,21 @@ elfconfig.h*
- fixdep
- fore200e_mkfirm
- fore200e_pca_fw.c*
-+gate.lds
- gconf
- gen-devlist
- gen_crc32table
- gen_init_cpio
- genksyms
- *_gray256.c
-+hash
- ihex2fw
- ikconfig.h*
- initramfs_data.cpio
-+initramfs_data.cpio.bz2
- initramfs_data.cpio.gz
- initramfs_list
- kallsyms
--kconfig
- keywords.c
- ksym.c*
- ksym.h*
-@@ -133,7 +149,9 @@ mkboot
- mkbugboot
- mkcpustr
- mkdep
-+mkpiggy
- mkprep
-+mkregtable
- mktables
- mktree
- modpost
-@@ -149,6 +167,7 @@ patches*
- pca200e.bin
- pca200e_ecd.bin2
- piggy.gz
-+piggy.S
- piggyback
- pnmtologo
- ppc_defs.h*
-@@ -157,12 +176,15 @@ qconf
- raid6altivec*.c
- raid6int*.c
- raid6tables.c
-+regdb.c
- relocs
-+rlim_names.h
- series
- setup
- setup.bin
- setup.elf
- sImage
-+slabinfo
- sm_tbl*
- split-include
- syscalltab.h
-@@ -186,14 +208,20 @@ version.h*
- vmlinux
- vmlinux-*
- vmlinux.aout
-+vmlinux.bin.all
-+vmlinux.bin.bz2
- vmlinux.lds
-+vmlinux.relocs
-+voffset.h
- vsyscall.lds
- vsyscall_32.lds
- wanxlfw.inc
- uImage
- unifdef
-+utsrelease.h
- wakeup.bin
- wakeup.elf
- wakeup.lds
- zImage*
- zconf.hash.c
-+zoffset.h
-diff -urNp linux-2.6.32.45/Documentation/kernel-parameters.txt linux-2.6.32.45/Documentation/kernel-parameters.txt
---- linux-2.6.32.45/Documentation/kernel-parameters.txt 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/Documentation/kernel-parameters.txt 2011-04-17 15:56:45.000000000 -0400
-@@ -1837,6 +1837,13 @@ and is between 256 and 4096 characters.
- the specified number of seconds. This is to be used if
- your oopses keep scrolling off the screen.
-
-+ pax_nouderef [X86] disables UDEREF. Most likely needed under certain
-+ virtualization environments that don't cope well with the
-+ expand down segment used by UDEREF on X86-32 or the frequent
-+ page table updates on X86-64.
-+
-+ pax_softmode= 0/1 to disable/enable PaX softmode on boot already.
-+
- pcbit= [HW,ISDN]
-
- pcd. [PARIDE]
-diff -urNp linux-2.6.32.45/drivers/acpi/acpi_pad.c linux-2.6.32.45/drivers/acpi/acpi_pad.c
---- linux-2.6.32.45/drivers/acpi/acpi_pad.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/acpi/acpi_pad.c 2011-04-17 15:56:46.000000000 -0400
-@@ -30,7 +30,7 @@
- #include <acpi/acpi_bus.h>
- #include <acpi/acpi_drivers.h>
-
--#define ACPI_PROCESSOR_AGGREGATOR_CLASS "processor_aggregator"
-+#define ACPI_PROCESSOR_AGGREGATOR_CLASS "acpi_pad"
- #define ACPI_PROCESSOR_AGGREGATOR_DEVICE_NAME "Processor Aggregator"
- #define ACPI_PROCESSOR_AGGREGATOR_NOTIFY 0x80
- static DEFINE_MUTEX(isolated_cpus_lock);
-diff -urNp linux-2.6.32.45/drivers/acpi/battery.c linux-2.6.32.45/drivers/acpi/battery.c
---- linux-2.6.32.45/drivers/acpi/battery.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/acpi/battery.c 2011-04-17 15:56:46.000000000 -0400
-@@ -763,7 +763,7 @@ DECLARE_FILE_FUNCTIONS(alarm);
- }
-
- static struct battery_file {
-- struct file_operations ops;
-+ const struct file_operations ops;
- mode_t mode;
- const char *name;
- } acpi_battery_file[] = {
-diff -urNp linux-2.6.32.45/drivers/acpi/dock.c linux-2.6.32.45/drivers/acpi/dock.c
---- linux-2.6.32.45/drivers/acpi/dock.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/acpi/dock.c 2011-04-17 15:56:46.000000000 -0400
-@@ -77,7 +77,7 @@ struct dock_dependent_device {
- struct list_head list;
- struct list_head hotplug_list;
- acpi_handle handle;
-- struct acpi_dock_ops *ops;
-+ const struct acpi_dock_ops *ops;
- void *context;
- };
-
-@@ -605,7 +605,7 @@ EXPORT_SYMBOL_GPL(unregister_dock_notifi
- * the dock driver after _DCK is executed.
- */
- int
--register_hotplug_dock_device(acpi_handle handle, struct acpi_dock_ops *ops,
-+register_hotplug_dock_device(acpi_handle handle, const struct acpi_dock_ops *ops,
- void *context)
- {
- struct dock_dependent_device *dd;
-diff -urNp linux-2.6.32.45/drivers/acpi/osl.c linux-2.6.32.45/drivers/acpi/osl.c
---- linux-2.6.32.45/drivers/acpi/osl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/acpi/osl.c 2011-04-17 15:56:46.000000000 -0400
-@@ -523,6 +523,8 @@ acpi_os_read_memory(acpi_physical_addres
- void __iomem *virt_addr;
-
- virt_addr = ioremap(phys_addr, width);
-+ if (!virt_addr)
-+ return AE_NO_MEMORY;
- if (!value)
- value = &dummy;
-
-@@ -551,6 +553,8 @@ acpi_os_write_memory(acpi_physical_addre
- void __iomem *virt_addr;
-
- virt_addr = ioremap(phys_addr, width);
-+ if (!virt_addr)
-+ return AE_NO_MEMORY;
-
- switch (width) {
- case 8:
-diff -urNp linux-2.6.32.45/drivers/acpi/power_meter.c linux-2.6.32.45/drivers/acpi/power_meter.c
---- linux-2.6.32.45/drivers/acpi/power_meter.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/acpi/power_meter.c 2011-04-17 15:56:46.000000000 -0400
-@@ -315,8 +315,6 @@ static ssize_t set_trip(struct device *d
- return res;
-
- temp /= 1000;
-- if (temp < 0)
-- return -EINVAL;
-
- mutex_lock(&resource->lock);
- resource->trip[attr->index - 7] = temp;
-diff -urNp linux-2.6.32.45/drivers/acpi/proc.c linux-2.6.32.45/drivers/acpi/proc.c
---- linux-2.6.32.45/drivers/acpi/proc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/acpi/proc.c 2011-04-17 15:56:46.000000000 -0400
-@@ -391,20 +391,15 @@ acpi_system_write_wakeup_device(struct f
- size_t count, loff_t * ppos)
- {
- struct list_head *node, *next;
-- char strbuf[5];
-- char str[5] = "";
-- unsigned int len = count;
-+ char strbuf[5] = {0};
- struct acpi_device *found_dev = NULL;
-
-- if (len > 4)
-- len = 4;
-- if (len < 0)
-- return -EFAULT;
-+ if (count > 4)
-+ count = 4;
-
-- if (copy_from_user(strbuf, buffer, len))
-+ if (copy_from_user(strbuf, buffer, count))
- return -EFAULT;
-- strbuf[len] = '\0';
-- sscanf(strbuf, "%s", str);
-+ strbuf[count] = '\0';
-
- mutex_lock(&acpi_device_lock);
- list_for_each_safe(node, next, &acpi_wakeup_device_list) {
-@@ -413,7 +408,7 @@ acpi_system_write_wakeup_device(struct f
- if (!dev->wakeup.flags.valid)
- continue;
-
-- if (!strncmp(dev->pnp.bus_id, str, 4)) {
-+ if (!strncmp(dev->pnp.bus_id, strbuf, 4)) {
- dev->wakeup.state.enabled =
- dev->wakeup.state.enabled ? 0 : 1;
- found_dev = dev;
-diff -urNp linux-2.6.32.45/drivers/acpi/processor_core.c linux-2.6.32.45/drivers/acpi/processor_core.c
---- linux-2.6.32.45/drivers/acpi/processor_core.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/acpi/processor_core.c 2011-04-17 15:56:46.000000000 -0400
-@@ -790,7 +790,7 @@ static int __cpuinit acpi_processor_add(
- return 0;
- }
-
-- BUG_ON((pr->id >= nr_cpu_ids) || (pr->id < 0));
-+ BUG_ON(pr->id >= nr_cpu_ids);
-
- /*
- * Buggy BIOS check
-diff -urNp linux-2.6.32.45/drivers/acpi/sbshc.c linux-2.6.32.45/drivers/acpi/sbshc.c
---- linux-2.6.32.45/drivers/acpi/sbshc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/acpi/sbshc.c 2011-04-17 15:56:46.000000000 -0400
-@@ -17,7 +17,7 @@
-
- #define PREFIX "ACPI: "
-
--#define ACPI_SMB_HC_CLASS "smbus_host_controller"
-+#define ACPI_SMB_HC_CLASS "smbus_host_ctl"
- #define ACPI_SMB_HC_DEVICE_NAME "ACPI SMBus HC"
-
- struct acpi_smb_hc {
-diff -urNp linux-2.6.32.45/drivers/acpi/sleep.c linux-2.6.32.45/drivers/acpi/sleep.c
---- linux-2.6.32.45/drivers/acpi/sleep.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/acpi/sleep.c 2011-04-17 15:56:46.000000000 -0400
-@@ -283,7 +283,7 @@ static int acpi_suspend_state_valid(susp
- }
- }
-
--static struct platform_suspend_ops acpi_suspend_ops = {
-+static const struct platform_suspend_ops acpi_suspend_ops = {
- .valid = acpi_suspend_state_valid,
- .begin = acpi_suspend_begin,
- .prepare_late = acpi_pm_prepare,
-@@ -311,7 +311,7 @@ static int acpi_suspend_begin_old(suspen
- * The following callbacks are used if the pre-ACPI 2.0 suspend ordering has
- * been requested.
- */
--static struct platform_suspend_ops acpi_suspend_ops_old = {
-+static const struct platform_suspend_ops acpi_suspend_ops_old = {
- .valid = acpi_suspend_state_valid,
- .begin = acpi_suspend_begin_old,
- .prepare_late = acpi_pm_disable_gpes,
-@@ -460,7 +460,7 @@ static void acpi_pm_enable_gpes(void)
- acpi_enable_all_runtime_gpes();
- }
-
--static struct platform_hibernation_ops acpi_hibernation_ops = {
-+static const struct platform_hibernation_ops acpi_hibernation_ops = {
- .begin = acpi_hibernation_begin,
- .end = acpi_pm_end,
- .pre_snapshot = acpi_hibernation_pre_snapshot,
-@@ -513,7 +513,7 @@ static int acpi_hibernation_pre_snapshot
- * The following callbacks are used if the pre-ACPI 2.0 suspend ordering has
- * been requested.
- */
--static struct platform_hibernation_ops acpi_hibernation_ops_old = {
-+static const struct platform_hibernation_ops acpi_hibernation_ops_old = {
- .begin = acpi_hibernation_begin_old,
- .end = acpi_pm_end,
- .pre_snapshot = acpi_hibernation_pre_snapshot_old,
-diff -urNp linux-2.6.32.45/drivers/acpi/video.c linux-2.6.32.45/drivers/acpi/video.c
---- linux-2.6.32.45/drivers/acpi/video.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/acpi/video.c 2011-04-17 15:56:46.000000000 -0400
-@@ -359,7 +359,7 @@ static int acpi_video_set_brightness(str
- vd->brightness->levels[request_level]);
- }
-
--static struct backlight_ops acpi_backlight_ops = {
-+static const struct backlight_ops acpi_backlight_ops = {
- .get_brightness = acpi_video_get_brightness,
- .update_status = acpi_video_set_brightness,
- };
-diff -urNp linux-2.6.32.45/drivers/ata/ahci.c linux-2.6.32.45/drivers/ata/ahci.c
---- linux-2.6.32.45/drivers/ata/ahci.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/ahci.c 2011-04-23 12:56:10.000000000 -0400
-@@ -387,7 +387,7 @@ static struct scsi_host_template ahci_sh
- .sdev_attrs = ahci_sdev_attrs,
- };
-
--static struct ata_port_operations ahci_ops = {
-+static const struct ata_port_operations ahci_ops = {
- .inherits = &sata_pmp_port_ops,
-
- .qc_defer = sata_pmp_qc_defer_cmd_switch,
-@@ -424,17 +424,17 @@ static struct ata_port_operations ahci_o
- .port_stop = ahci_port_stop,
- };
-
--static struct ata_port_operations ahci_vt8251_ops = {
-+static const struct ata_port_operations ahci_vt8251_ops = {
- .inherits = &ahci_ops,
- .hardreset = ahci_vt8251_hardreset,
- };
-
--static struct ata_port_operations ahci_p5wdh_ops = {
-+static const struct ata_port_operations ahci_p5wdh_ops = {
- .inherits = &ahci_ops,
- .hardreset = ahci_p5wdh_hardreset,
- };
-
--static struct ata_port_operations ahci_sb600_ops = {
-+static const struct ata_port_operations ahci_sb600_ops = {
- .inherits = &ahci_ops,
- .softreset = ahci_sb600_softreset,
- .pmp_softreset = ahci_sb600_softreset,
-diff -urNp linux-2.6.32.45/drivers/ata/ata_generic.c linux-2.6.32.45/drivers/ata/ata_generic.c
---- linux-2.6.32.45/drivers/ata/ata_generic.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/ata_generic.c 2011-04-17 15:56:46.000000000 -0400
-@@ -104,7 +104,7 @@ static struct scsi_host_template generic
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations generic_port_ops = {
-+static const struct ata_port_operations generic_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = ata_cable_unknown,
- .set_mode = generic_set_mode,
-diff -urNp linux-2.6.32.45/drivers/ata/ata_piix.c linux-2.6.32.45/drivers/ata/ata_piix.c
---- linux-2.6.32.45/drivers/ata/ata_piix.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/ata_piix.c 2011-04-23 12:56:10.000000000 -0400
-@@ -318,7 +318,7 @@ static struct scsi_host_template piix_sh
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations piix_pata_ops = {
-+static const struct ata_port_operations piix_pata_ops = {
- .inherits = &ata_bmdma32_port_ops,
- .cable_detect = ata_cable_40wire,
- .set_piomode = piix_set_piomode,
-@@ -326,22 +326,22 @@ static struct ata_port_operations piix_p
- .prereset = piix_pata_prereset,
- };
-
--static struct ata_port_operations piix_vmw_ops = {
-+static const struct ata_port_operations piix_vmw_ops = {
- .inherits = &piix_pata_ops,
- .bmdma_status = piix_vmw_bmdma_status,
- };
-
--static struct ata_port_operations ich_pata_ops = {
-+static const struct ata_port_operations ich_pata_ops = {
- .inherits = &piix_pata_ops,
- .cable_detect = ich_pata_cable_detect,
- .set_dmamode = ich_set_dmamode,
- };
-
--static struct ata_port_operations piix_sata_ops = {
-+static const struct ata_port_operations piix_sata_ops = {
- .inherits = &ata_bmdma_port_ops,
- };
-
--static struct ata_port_operations piix_sidpr_sata_ops = {
-+static const struct ata_port_operations piix_sidpr_sata_ops = {
- .inherits = &piix_sata_ops,
- .hardreset = sata_std_hardreset,
- .scr_read = piix_sidpr_scr_read,
-diff -urNp linux-2.6.32.45/drivers/ata/libata-acpi.c linux-2.6.32.45/drivers/ata/libata-acpi.c
---- linux-2.6.32.45/drivers/ata/libata-acpi.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/libata-acpi.c 2011-04-17 15:56:46.000000000 -0400
-@@ -223,12 +223,12 @@ static void ata_acpi_dev_uevent(acpi_han
- ata_acpi_uevent(dev->link->ap, dev, event);
- }
-
--static struct acpi_dock_ops ata_acpi_dev_dock_ops = {
-+static const struct acpi_dock_ops ata_acpi_dev_dock_ops = {
- .handler = ata_acpi_dev_notify_dock,
- .uevent = ata_acpi_dev_uevent,
- };
-
--static struct acpi_dock_ops ata_acpi_ap_dock_ops = {
-+static const struct acpi_dock_ops ata_acpi_ap_dock_ops = {
- .handler = ata_acpi_ap_notify_dock,
- .uevent = ata_acpi_ap_uevent,
- };
-diff -urNp linux-2.6.32.45/drivers/ata/libata-core.c linux-2.6.32.45/drivers/ata/libata-core.c
---- linux-2.6.32.45/drivers/ata/libata-core.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/libata-core.c 2011-08-05 20:33:55.000000000 -0400
-@@ -4954,7 +4954,7 @@ void ata_qc_free(struct ata_queued_cmd *
- struct ata_port *ap;
- unsigned int tag;
-
-- WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
-+ BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
- ap = qc->ap;
-
- qc->flags = 0;
-@@ -4970,7 +4970,7 @@ void __ata_qc_complete(struct ata_queued
- struct ata_port *ap;
- struct ata_link *link;
-
-- WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
-+ BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
- WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE));
- ap = qc->ap;
- link = qc->dev->link;
-@@ -5987,7 +5987,7 @@ static void ata_host_stop(struct device
- * LOCKING:
- * None.
- */
--static void ata_finalize_port_ops(struct ata_port_operations *ops)
-+static void ata_finalize_port_ops(const struct ata_port_operations *ops)
- {
- static DEFINE_SPINLOCK(lock);
- const struct ata_port_operations *cur;
-@@ -5999,6 +5999,7 @@ static void ata_finalize_port_ops(struct
- return;
-
- spin_lock(&lock);
-+ pax_open_kernel();
-
- for (cur = ops->inherits; cur; cur = cur->inherits) {
- void **inherit = (void **)cur;
-@@ -6012,8 +6013,9 @@ static void ata_finalize_port_ops(struct
- if (IS_ERR(*pp))
- *pp = NULL;
-
-- ops->inherits = NULL;
-+ *(struct ata_port_operations **)&ops->inherits = NULL;
-
-+ pax_close_kernel();
- spin_unlock(&lock);
- }
-
-@@ -6110,7 +6112,7 @@ int ata_host_start(struct ata_host *host
- */
- /* KILLME - the only user left is ipr */
- void ata_host_init(struct ata_host *host, struct device *dev,
-- unsigned long flags, struct ata_port_operations *ops)
-+ unsigned long flags, const struct ata_port_operations *ops)
- {
- spin_lock_init(&host->lock);
- host->dev = dev;
-@@ -6773,7 +6775,7 @@ static void ata_dummy_error_handler(stru
- /* truly dummy */
- }
-
--struct ata_port_operations ata_dummy_port_ops = {
-+const struct ata_port_operations ata_dummy_port_ops = {
- .qc_prep = ata_noop_qc_prep,
- .qc_issue = ata_dummy_qc_issue,
- .error_handler = ata_dummy_error_handler,
-diff -urNp linux-2.6.32.45/drivers/ata/libata-eh.c linux-2.6.32.45/drivers/ata/libata-eh.c
---- linux-2.6.32.45/drivers/ata/libata-eh.c 2011-08-09 18:35:28.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/libata-eh.c 2011-08-09 18:33:59.000000000 -0400
-@@ -2423,6 +2423,8 @@ void ata_eh_report(struct ata_port *ap)
- {
- struct ata_link *link;
-
-+ pax_track_stack();
-+
- ata_for_each_link(link, ap, HOST_FIRST)
- ata_eh_link_report(link);
- }
-@@ -3594,7 +3596,7 @@ void ata_do_eh(struct ata_port *ap, ata_
- */
- void ata_std_error_handler(struct ata_port *ap)
- {
-- struct ata_port_operations *ops = ap->ops;
-+ const struct ata_port_operations *ops = ap->ops;
- ata_reset_fn_t hardreset = ops->hardreset;
-
- /* ignore built-in hardreset if SCR access is not available */
-diff -urNp linux-2.6.32.45/drivers/ata/libata-pmp.c linux-2.6.32.45/drivers/ata/libata-pmp.c
---- linux-2.6.32.45/drivers/ata/libata-pmp.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/libata-pmp.c 2011-04-17 15:56:46.000000000 -0400
-@@ -841,7 +841,7 @@ static int sata_pmp_handle_link_fail(str
- */
- static int sata_pmp_eh_recover(struct ata_port *ap)
- {
-- struct ata_port_operations *ops = ap->ops;
-+ const struct ata_port_operations *ops = ap->ops;
- int pmp_tries, link_tries[SATA_PMP_MAX_PORTS];
- struct ata_link *pmp_link = &ap->link;
- struct ata_device *pmp_dev = pmp_link->device;
-diff -urNp linux-2.6.32.45/drivers/ata/pata_acpi.c linux-2.6.32.45/drivers/ata/pata_acpi.c
---- linux-2.6.32.45/drivers/ata/pata_acpi.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_acpi.c 2011-04-17 15:56:46.000000000 -0400
-@@ -215,7 +215,7 @@ static struct scsi_host_template pacpi_s
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations pacpi_ops = {
-+static const struct ata_port_operations pacpi_ops = {
- .inherits = &ata_bmdma_port_ops,
- .qc_issue = pacpi_qc_issue,
- .cable_detect = pacpi_cable_detect,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_ali.c linux-2.6.32.45/drivers/ata/pata_ali.c
---- linux-2.6.32.45/drivers/ata/pata_ali.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_ali.c 2011-04-17 15:56:46.000000000 -0400
-@@ -365,7 +365,7 @@ static struct scsi_host_template ali_sht
- * Port operations for PIO only ALi
- */
-
--static struct ata_port_operations ali_early_port_ops = {
-+static const struct ata_port_operations ali_early_port_ops = {
- .inherits = &ata_sff_port_ops,
- .cable_detect = ata_cable_40wire,
- .set_piomode = ali_set_piomode,
-@@ -382,7 +382,7 @@ static const struct ata_port_operations
- * Port operations for DMA capable ALi without cable
- * detect
- */
--static struct ata_port_operations ali_20_port_ops = {
-+static const struct ata_port_operations ali_20_port_ops = {
- .inherits = &ali_dma_base_ops,
- .cable_detect = ata_cable_40wire,
- .mode_filter = ali_20_filter,
-@@ -393,7 +393,7 @@ static struct ata_port_operations ali_20
- /*
- * Port operations for DMA capable ALi with cable detect
- */
--static struct ata_port_operations ali_c2_port_ops = {
-+static const struct ata_port_operations ali_c2_port_ops = {
- .inherits = &ali_dma_base_ops,
- .check_atapi_dma = ali_check_atapi_dma,
- .cable_detect = ali_c2_cable_detect,
-@@ -404,7 +404,7 @@ static struct ata_port_operations ali_c2
- /*
- * Port operations for DMA capable ALi with cable detect
- */
--static struct ata_port_operations ali_c4_port_ops = {
-+static const struct ata_port_operations ali_c4_port_ops = {
- .inherits = &ali_dma_base_ops,
- .check_atapi_dma = ali_check_atapi_dma,
- .cable_detect = ali_c2_cable_detect,
-@@ -414,7 +414,7 @@ static struct ata_port_operations ali_c4
- /*
- * Port operations for DMA capable ALi with cable detect and LBA48
- */
--static struct ata_port_operations ali_c5_port_ops = {
-+static const struct ata_port_operations ali_c5_port_ops = {
- .inherits = &ali_dma_base_ops,
- .check_atapi_dma = ali_check_atapi_dma,
- .dev_config = ali_warn_atapi_dma,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_amd.c linux-2.6.32.45/drivers/ata/pata_amd.c
---- linux-2.6.32.45/drivers/ata/pata_amd.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_amd.c 2011-04-17 15:56:46.000000000 -0400
-@@ -397,28 +397,28 @@ static const struct ata_port_operations
- .prereset = amd_pre_reset,
- };
-
--static struct ata_port_operations amd33_port_ops = {
-+static const struct ata_port_operations amd33_port_ops = {
- .inherits = &amd_base_port_ops,
- .cable_detect = ata_cable_40wire,
- .set_piomode = amd33_set_piomode,
- .set_dmamode = amd33_set_dmamode,
- };
-
--static struct ata_port_operations amd66_port_ops = {
-+static const struct ata_port_operations amd66_port_ops = {
- .inherits = &amd_base_port_ops,
- .cable_detect = ata_cable_unknown,
- .set_piomode = amd66_set_piomode,
- .set_dmamode = amd66_set_dmamode,
- };
-
--static struct ata_port_operations amd100_port_ops = {
-+static const struct ata_port_operations amd100_port_ops = {
- .inherits = &amd_base_port_ops,
- .cable_detect = ata_cable_unknown,
- .set_piomode = amd100_set_piomode,
- .set_dmamode = amd100_set_dmamode,
- };
-
--static struct ata_port_operations amd133_port_ops = {
-+static const struct ata_port_operations amd133_port_ops = {
- .inherits = &amd_base_port_ops,
- .cable_detect = amd_cable_detect,
- .set_piomode = amd133_set_piomode,
-@@ -433,13 +433,13 @@ static const struct ata_port_operations
- .host_stop = nv_host_stop,
- };
-
--static struct ata_port_operations nv100_port_ops = {
-+static const struct ata_port_operations nv100_port_ops = {
- .inherits = &nv_base_port_ops,
- .set_piomode = nv100_set_piomode,
- .set_dmamode = nv100_set_dmamode,
- };
-
--static struct ata_port_operations nv133_port_ops = {
-+static const struct ata_port_operations nv133_port_ops = {
- .inherits = &nv_base_port_ops,
- .set_piomode = nv133_set_piomode,
- .set_dmamode = nv133_set_dmamode,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_artop.c linux-2.6.32.45/drivers/ata/pata_artop.c
---- linux-2.6.32.45/drivers/ata/pata_artop.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_artop.c 2011-04-17 15:56:46.000000000 -0400
-@@ -311,7 +311,7 @@ static struct scsi_host_template artop_s
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations artop6210_ops = {
-+static const struct ata_port_operations artop6210_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = ata_cable_40wire,
- .set_piomode = artop6210_set_piomode,
-@@ -320,7 +320,7 @@ static struct ata_port_operations artop6
- .qc_defer = artop6210_qc_defer,
- };
-
--static struct ata_port_operations artop6260_ops = {
-+static const struct ata_port_operations artop6260_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = artop6260_cable_detect,
- .set_piomode = artop6260_set_piomode,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_at32.c linux-2.6.32.45/drivers/ata/pata_at32.c
---- linux-2.6.32.45/drivers/ata/pata_at32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_at32.c 2011-04-17 15:56:46.000000000 -0400
-@@ -172,7 +172,7 @@ static struct scsi_host_template at32_sh
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations at32_port_ops = {
-+static const struct ata_port_operations at32_port_ops = {
- .inherits = &ata_sff_port_ops,
- .cable_detect = ata_cable_40wire,
- .set_piomode = pata_at32_set_piomode,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_at91.c linux-2.6.32.45/drivers/ata/pata_at91.c
---- linux-2.6.32.45/drivers/ata/pata_at91.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_at91.c 2011-04-17 15:56:46.000000000 -0400
-@@ -195,7 +195,7 @@ static struct scsi_host_template pata_at
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations pata_at91_port_ops = {
-+static const struct ata_port_operations pata_at91_port_ops = {
- .inherits = &ata_sff_port_ops,
-
- .sff_data_xfer = pata_at91_data_xfer_noirq,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_atiixp.c linux-2.6.32.45/drivers/ata/pata_atiixp.c
---- linux-2.6.32.45/drivers/ata/pata_atiixp.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_atiixp.c 2011-04-17 15:56:46.000000000 -0400
-@@ -205,7 +205,7 @@ static struct scsi_host_template atiixp_
- .sg_tablesize = LIBATA_DUMB_MAX_PRD,
- };
-
--static struct ata_port_operations atiixp_port_ops = {
-+static const struct ata_port_operations atiixp_port_ops = {
- .inherits = &ata_bmdma_port_ops,
-
- .qc_prep = ata_sff_dumb_qc_prep,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_atp867x.c linux-2.6.32.45/drivers/ata/pata_atp867x.c
---- linux-2.6.32.45/drivers/ata/pata_atp867x.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_atp867x.c 2011-04-17 15:56:46.000000000 -0400
-@@ -274,7 +274,7 @@ static struct scsi_host_template atp867x
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations atp867x_ops = {
-+static const struct ata_port_operations atp867x_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = atp867x_cable_detect,
- .set_piomode = atp867x_set_piomode,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_bf54x.c linux-2.6.32.45/drivers/ata/pata_bf54x.c
---- linux-2.6.32.45/drivers/ata/pata_bf54x.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_bf54x.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1464,7 +1464,7 @@ static struct scsi_host_template bfin_sh
- .dma_boundary = ATA_DMA_BOUNDARY,
- };
-
--static struct ata_port_operations bfin_pata_ops = {
-+static const struct ata_port_operations bfin_pata_ops = {
- .inherits = &ata_sff_port_ops,
-
- .set_piomode = bfin_set_piomode,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_cmd640.c linux-2.6.32.45/drivers/ata/pata_cmd640.c
---- linux-2.6.32.45/drivers/ata/pata_cmd640.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_cmd640.c 2011-04-17 15:56:46.000000000 -0400
-@@ -168,7 +168,7 @@ static struct scsi_host_template cmd640_
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations cmd640_port_ops = {
-+static const struct ata_port_operations cmd640_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- /* In theory xfer_noirq is not needed once we kill the prefetcher */
- .sff_data_xfer = ata_sff_data_xfer_noirq,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_cmd64x.c linux-2.6.32.45/drivers/ata/pata_cmd64x.c
---- linux-2.6.32.45/drivers/ata/pata_cmd64x.c 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_cmd64x.c 2011-06-25 12:56:37.000000000 -0400
-@@ -271,18 +271,18 @@ static const struct ata_port_operations
- .set_dmamode = cmd64x_set_dmamode,
- };
-
--static struct ata_port_operations cmd64x_port_ops = {
-+static const struct ata_port_operations cmd64x_port_ops = {
- .inherits = &cmd64x_base_ops,
- .cable_detect = ata_cable_40wire,
- };
-
--static struct ata_port_operations cmd646r1_port_ops = {
-+static const struct ata_port_operations cmd646r1_port_ops = {
- .inherits = &cmd64x_base_ops,
- .bmdma_stop = cmd646r1_bmdma_stop,
- .cable_detect = ata_cable_40wire,
- };
-
--static struct ata_port_operations cmd648_port_ops = {
-+static const struct ata_port_operations cmd648_port_ops = {
- .inherits = &cmd64x_base_ops,
- .bmdma_stop = cmd648_bmdma_stop,
- .cable_detect = cmd648_cable_detect,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_cs5520.c linux-2.6.32.45/drivers/ata/pata_cs5520.c
---- linux-2.6.32.45/drivers/ata/pata_cs5520.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_cs5520.c 2011-04-17 15:56:46.000000000 -0400
-@@ -144,7 +144,7 @@ static struct scsi_host_template cs5520_
- .sg_tablesize = LIBATA_DUMB_MAX_PRD,
- };
-
--static struct ata_port_operations cs5520_port_ops = {
-+static const struct ata_port_operations cs5520_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .qc_prep = ata_sff_dumb_qc_prep,
- .cable_detect = ata_cable_40wire,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_cs5530.c linux-2.6.32.45/drivers/ata/pata_cs5530.c
---- linux-2.6.32.45/drivers/ata/pata_cs5530.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_cs5530.c 2011-04-17 15:56:46.000000000 -0400
-@@ -164,7 +164,7 @@ static struct scsi_host_template cs5530_
- .sg_tablesize = LIBATA_DUMB_MAX_PRD,
- };
-
--static struct ata_port_operations cs5530_port_ops = {
-+static const struct ata_port_operations cs5530_port_ops = {
- .inherits = &ata_bmdma_port_ops,
-
- .qc_prep = ata_sff_dumb_qc_prep,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_cs5535.c linux-2.6.32.45/drivers/ata/pata_cs5535.c
---- linux-2.6.32.45/drivers/ata/pata_cs5535.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_cs5535.c 2011-04-17 15:56:46.000000000 -0400
-@@ -160,7 +160,7 @@ static struct scsi_host_template cs5535_
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations cs5535_port_ops = {
-+static const struct ata_port_operations cs5535_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = cs5535_cable_detect,
- .set_piomode = cs5535_set_piomode,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_cs5536.c linux-2.6.32.45/drivers/ata/pata_cs5536.c
---- linux-2.6.32.45/drivers/ata/pata_cs5536.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_cs5536.c 2011-04-17 15:56:46.000000000 -0400
-@@ -223,7 +223,7 @@ static struct scsi_host_template cs5536_
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations cs5536_port_ops = {
-+static const struct ata_port_operations cs5536_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = cs5536_cable_detect,
- .set_piomode = cs5536_set_piomode,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_cypress.c linux-2.6.32.45/drivers/ata/pata_cypress.c
---- linux-2.6.32.45/drivers/ata/pata_cypress.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_cypress.c 2011-04-17 15:56:46.000000000 -0400
-@@ -113,7 +113,7 @@ static struct scsi_host_template cy82c69
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations cy82c693_port_ops = {
-+static const struct ata_port_operations cy82c693_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = ata_cable_40wire,
- .set_piomode = cy82c693_set_piomode,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_efar.c linux-2.6.32.45/drivers/ata/pata_efar.c
---- linux-2.6.32.45/drivers/ata/pata_efar.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_efar.c 2011-04-17 15:56:46.000000000 -0400
-@@ -222,7 +222,7 @@ static struct scsi_host_template efar_sh
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations efar_ops = {
-+static const struct ata_port_operations efar_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = efar_cable_detect,
- .set_piomode = efar_set_piomode,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_hpt366.c linux-2.6.32.45/drivers/ata/pata_hpt366.c
---- linux-2.6.32.45/drivers/ata/pata_hpt366.c 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_hpt366.c 2011-06-25 12:56:37.000000000 -0400
-@@ -282,7 +282,7 @@ static struct scsi_host_template hpt36x_
- * Configuration for HPT366/68
- */
-
--static struct ata_port_operations hpt366_port_ops = {
-+static const struct ata_port_operations hpt366_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = hpt36x_cable_detect,
- .mode_filter = hpt366_filter,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_hpt37x.c linux-2.6.32.45/drivers/ata/pata_hpt37x.c
---- linux-2.6.32.45/drivers/ata/pata_hpt37x.c 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_hpt37x.c 2011-06-25 12:56:37.000000000 -0400
-@@ -576,7 +576,7 @@ static struct scsi_host_template hpt37x_
- * Configuration for HPT370
- */
-
--static struct ata_port_operations hpt370_port_ops = {
-+static const struct ata_port_operations hpt370_port_ops = {
- .inherits = &ata_bmdma_port_ops,
-
- .bmdma_stop = hpt370_bmdma_stop,
-@@ -591,7 +591,7 @@ static struct ata_port_operations hpt370
- * Configuration for HPT370A. Close to 370 but less filters
- */
-
--static struct ata_port_operations hpt370a_port_ops = {
-+static const struct ata_port_operations hpt370a_port_ops = {
- .inherits = &hpt370_port_ops,
- .mode_filter = hpt370a_filter,
- };
-@@ -601,7 +601,7 @@ static struct ata_port_operations hpt370
- * and DMA mode setting functionality.
- */
-
--static struct ata_port_operations hpt372_port_ops = {
-+static const struct ata_port_operations hpt372_port_ops = {
- .inherits = &ata_bmdma_port_ops,
-
- .bmdma_stop = hpt37x_bmdma_stop,
-@@ -616,7 +616,7 @@ static struct ata_port_operations hpt372
- * but we have a different cable detection procedure for function 1.
- */
-
--static struct ata_port_operations hpt374_fn1_port_ops = {
-+static const struct ata_port_operations hpt374_fn1_port_ops = {
- .inherits = &hpt372_port_ops,
- .prereset = hpt374_fn1_pre_reset,
- };
-diff -urNp linux-2.6.32.45/drivers/ata/pata_hpt3x2n.c linux-2.6.32.45/drivers/ata/pata_hpt3x2n.c
---- linux-2.6.32.45/drivers/ata/pata_hpt3x2n.c 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_hpt3x2n.c 2011-06-25 12:56:37.000000000 -0400
-@@ -337,7 +337,7 @@ static struct scsi_host_template hpt3x2n
- * Configuration for HPT3x2n.
- */
-
--static struct ata_port_operations hpt3x2n_port_ops = {
-+static const struct ata_port_operations hpt3x2n_port_ops = {
- .inherits = &ata_bmdma_port_ops,
-
- .bmdma_stop = hpt3x2n_bmdma_stop,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_hpt3x3.c linux-2.6.32.45/drivers/ata/pata_hpt3x3.c
---- linux-2.6.32.45/drivers/ata/pata_hpt3x3.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_hpt3x3.c 2011-04-17 15:56:46.000000000 -0400
-@@ -141,7 +141,7 @@ static struct scsi_host_template hpt3x3_
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations hpt3x3_port_ops = {
-+static const struct ata_port_operations hpt3x3_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = ata_cable_40wire,
- .set_piomode = hpt3x3_set_piomode,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_icside.c linux-2.6.32.45/drivers/ata/pata_icside.c
---- linux-2.6.32.45/drivers/ata/pata_icside.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_icside.c 2011-04-17 15:56:46.000000000 -0400
-@@ -319,7 +319,7 @@ static void pata_icside_postreset(struct
- }
- }
-
--static struct ata_port_operations pata_icside_port_ops = {
-+static const struct ata_port_operations pata_icside_port_ops = {
- .inherits = &ata_sff_port_ops,
- /* no need to build any PRD tables for DMA */
- .qc_prep = ata_noop_qc_prep,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_isapnp.c linux-2.6.32.45/drivers/ata/pata_isapnp.c
---- linux-2.6.32.45/drivers/ata/pata_isapnp.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_isapnp.c 2011-04-17 15:56:46.000000000 -0400
-@@ -23,12 +23,12 @@ static struct scsi_host_template isapnp_
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations isapnp_port_ops = {
-+static const struct ata_port_operations isapnp_port_ops = {
- .inherits = &ata_sff_port_ops,
- .cable_detect = ata_cable_40wire,
- };
-
--static struct ata_port_operations isapnp_noalt_port_ops = {
-+static const struct ata_port_operations isapnp_noalt_port_ops = {
- .inherits = &ata_sff_port_ops,
- .cable_detect = ata_cable_40wire,
- /* No altstatus so we don't want to use the lost interrupt poll */
-diff -urNp linux-2.6.32.45/drivers/ata/pata_it8213.c linux-2.6.32.45/drivers/ata/pata_it8213.c
---- linux-2.6.32.45/drivers/ata/pata_it8213.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_it8213.c 2011-04-17 15:56:46.000000000 -0400
-@@ -234,7 +234,7 @@ static struct scsi_host_template it8213_
- };
-
-
--static struct ata_port_operations it8213_ops = {
-+static const struct ata_port_operations it8213_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = it8213_cable_detect,
- .set_piomode = it8213_set_piomode,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_it821x.c linux-2.6.32.45/drivers/ata/pata_it821x.c
---- linux-2.6.32.45/drivers/ata/pata_it821x.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_it821x.c 2011-04-17 15:56:46.000000000 -0400
-@@ -800,7 +800,7 @@ static struct scsi_host_template it821x_
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations it821x_smart_port_ops = {
-+static const struct ata_port_operations it821x_smart_port_ops = {
- .inherits = &ata_bmdma_port_ops,
-
- .check_atapi_dma= it821x_check_atapi_dma,
-@@ -814,7 +814,7 @@ static struct ata_port_operations it821x
- .port_start = it821x_port_start,
- };
-
--static struct ata_port_operations it821x_passthru_port_ops = {
-+static const struct ata_port_operations it821x_passthru_port_ops = {
- .inherits = &ata_bmdma_port_ops,
-
- .check_atapi_dma= it821x_check_atapi_dma,
-@@ -830,7 +830,7 @@ static struct ata_port_operations it821x
- .port_start = it821x_port_start,
- };
-
--static struct ata_port_operations it821x_rdc_port_ops = {
-+static const struct ata_port_operations it821x_rdc_port_ops = {
- .inherits = &ata_bmdma_port_ops,
-
- .check_atapi_dma= it821x_check_atapi_dma,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_ixp4xx_cf.c linux-2.6.32.45/drivers/ata/pata_ixp4xx_cf.c
---- linux-2.6.32.45/drivers/ata/pata_ixp4xx_cf.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_ixp4xx_cf.c 2011-04-17 15:56:46.000000000 -0400
-@@ -89,7 +89,7 @@ static struct scsi_host_template ixp4xx_
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations ixp4xx_port_ops = {
-+static const struct ata_port_operations ixp4xx_port_ops = {
- .inherits = &ata_sff_port_ops,
- .sff_data_xfer = ixp4xx_mmio_data_xfer,
- .cable_detect = ata_cable_40wire,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_jmicron.c linux-2.6.32.45/drivers/ata/pata_jmicron.c
---- linux-2.6.32.45/drivers/ata/pata_jmicron.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_jmicron.c 2011-04-17 15:56:46.000000000 -0400
-@@ -111,7 +111,7 @@ static struct scsi_host_template jmicron
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations jmicron_ops = {
-+static const struct ata_port_operations jmicron_ops = {
- .inherits = &ata_bmdma_port_ops,
- .prereset = jmicron_pre_reset,
- };
-diff -urNp linux-2.6.32.45/drivers/ata/pata_legacy.c linux-2.6.32.45/drivers/ata/pata_legacy.c
---- linux-2.6.32.45/drivers/ata/pata_legacy.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_legacy.c 2011-04-17 15:56:46.000000000 -0400
-@@ -106,7 +106,7 @@ struct legacy_probe {
-
- struct legacy_controller {
- const char *name;
-- struct ata_port_operations *ops;
-+ const struct ata_port_operations *ops;
- unsigned int pio_mask;
- unsigned int flags;
- unsigned int pflags;
-@@ -223,12 +223,12 @@ static const struct ata_port_operations
- * pio_mask as well.
- */
-
--static struct ata_port_operations simple_port_ops = {
-+static const struct ata_port_operations simple_port_ops = {
- .inherits = &legacy_base_port_ops,
- .sff_data_xfer = ata_sff_data_xfer_noirq,
- };
-
--static struct ata_port_operations legacy_port_ops = {
-+static const struct ata_port_operations legacy_port_ops = {
- .inherits = &legacy_base_port_ops,
- .sff_data_xfer = ata_sff_data_xfer_noirq,
- .set_mode = legacy_set_mode,
-@@ -324,7 +324,7 @@ static unsigned int pdc_data_xfer_vlb(st
- return buflen;
- }
-
--static struct ata_port_operations pdc20230_port_ops = {
-+static const struct ata_port_operations pdc20230_port_ops = {
- .inherits = &legacy_base_port_ops,
- .set_piomode = pdc20230_set_piomode,
- .sff_data_xfer = pdc_data_xfer_vlb,
-@@ -357,7 +357,7 @@ static void ht6560a_set_piomode(struct a
- ioread8(ap->ioaddr.status_addr);
- }
-
--static struct ata_port_operations ht6560a_port_ops = {
-+static const struct ata_port_operations ht6560a_port_ops = {
- .inherits = &legacy_base_port_ops,
- .set_piomode = ht6560a_set_piomode,
- };
-@@ -400,7 +400,7 @@ static void ht6560b_set_piomode(struct a
- ioread8(ap->ioaddr.status_addr);
- }
-
--static struct ata_port_operations ht6560b_port_ops = {
-+static const struct ata_port_operations ht6560b_port_ops = {
- .inherits = &legacy_base_port_ops,
- .set_piomode = ht6560b_set_piomode,
- };
-@@ -499,7 +499,7 @@ static void opti82c611a_set_piomode(stru
- }
-
-
--static struct ata_port_operations opti82c611a_port_ops = {
-+static const struct ata_port_operations opti82c611a_port_ops = {
- .inherits = &legacy_base_port_ops,
- .set_piomode = opti82c611a_set_piomode,
- };
-@@ -609,7 +609,7 @@ static unsigned int opti82c46x_qc_issue(
- return ata_sff_qc_issue(qc);
- }
-
--static struct ata_port_operations opti82c46x_port_ops = {
-+static const struct ata_port_operations opti82c46x_port_ops = {
- .inherits = &legacy_base_port_ops,
- .set_piomode = opti82c46x_set_piomode,
- .qc_issue = opti82c46x_qc_issue,
-@@ -771,20 +771,20 @@ static int qdi_port(struct platform_devi
- return 0;
- }
-
--static struct ata_port_operations qdi6500_port_ops = {
-+static const struct ata_port_operations qdi6500_port_ops = {
- .inherits = &legacy_base_port_ops,
- .set_piomode = qdi6500_set_piomode,
- .qc_issue = qdi_qc_issue,
- .sff_data_xfer = vlb32_data_xfer,
- };
-
--static struct ata_port_operations qdi6580_port_ops = {
-+static const struct ata_port_operations qdi6580_port_ops = {
- .inherits = &legacy_base_port_ops,
- .set_piomode = qdi6580_set_piomode,
- .sff_data_xfer = vlb32_data_xfer,
- };
-
--static struct ata_port_operations qdi6580dp_port_ops = {
-+static const struct ata_port_operations qdi6580dp_port_ops = {
- .inherits = &legacy_base_port_ops,
- .set_piomode = qdi6580dp_set_piomode,
- .sff_data_xfer = vlb32_data_xfer,
-@@ -855,7 +855,7 @@ static int winbond_port(struct platform_
- return 0;
- }
-
--static struct ata_port_operations winbond_port_ops = {
-+static const struct ata_port_operations winbond_port_ops = {
- .inherits = &legacy_base_port_ops,
- .set_piomode = winbond_set_piomode,
- .sff_data_xfer = vlb32_data_xfer,
-@@ -978,7 +978,7 @@ static __init int legacy_init_one(struct
- int pio_modes = controller->pio_mask;
- unsigned long io = probe->port;
- u32 mask = (1 << probe->slot);
-- struct ata_port_operations *ops = controller->ops;
-+ const struct ata_port_operations *ops = controller->ops;
- struct legacy_data *ld = &legacy_data[probe->slot];
- struct ata_host *host = NULL;
- struct ata_port *ap;
-diff -urNp linux-2.6.32.45/drivers/ata/pata_marvell.c linux-2.6.32.45/drivers/ata/pata_marvell.c
---- linux-2.6.32.45/drivers/ata/pata_marvell.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_marvell.c 2011-04-17 15:56:46.000000000 -0400
-@@ -100,7 +100,7 @@ static struct scsi_host_template marvell
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations marvell_ops = {
-+static const struct ata_port_operations marvell_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = marvell_cable_detect,
- .prereset = marvell_pre_reset,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_mpc52xx.c linux-2.6.32.45/drivers/ata/pata_mpc52xx.c
---- linux-2.6.32.45/drivers/ata/pata_mpc52xx.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_mpc52xx.c 2011-04-17 15:56:46.000000000 -0400
-@@ -609,7 +609,7 @@ static struct scsi_host_template mpc52xx
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations mpc52xx_ata_port_ops = {
-+static const struct ata_port_operations mpc52xx_ata_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .sff_dev_select = mpc52xx_ata_dev_select,
- .set_piomode = mpc52xx_ata_set_piomode,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_mpiix.c linux-2.6.32.45/drivers/ata/pata_mpiix.c
---- linux-2.6.32.45/drivers/ata/pata_mpiix.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_mpiix.c 2011-04-17 15:56:46.000000000 -0400
-@@ -140,7 +140,7 @@ static struct scsi_host_template mpiix_s
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations mpiix_port_ops = {
-+static const struct ata_port_operations mpiix_port_ops = {
- .inherits = &ata_sff_port_ops,
- .qc_issue = mpiix_qc_issue,
- .cable_detect = ata_cable_40wire,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_netcell.c linux-2.6.32.45/drivers/ata/pata_netcell.c
---- linux-2.6.32.45/drivers/ata/pata_netcell.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_netcell.c 2011-04-17 15:56:46.000000000 -0400
-@@ -34,7 +34,7 @@ static struct scsi_host_template netcell
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations netcell_ops = {
-+static const struct ata_port_operations netcell_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = ata_cable_80wire,
- .read_id = netcell_read_id,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_ninja32.c linux-2.6.32.45/drivers/ata/pata_ninja32.c
---- linux-2.6.32.45/drivers/ata/pata_ninja32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_ninja32.c 2011-04-17 15:56:46.000000000 -0400
-@@ -81,7 +81,7 @@ static struct scsi_host_template ninja32
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations ninja32_port_ops = {
-+static const struct ata_port_operations ninja32_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .sff_dev_select = ninja32_dev_select,
- .cable_detect = ata_cable_40wire,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_ns87410.c linux-2.6.32.45/drivers/ata/pata_ns87410.c
---- linux-2.6.32.45/drivers/ata/pata_ns87410.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_ns87410.c 2011-04-17 15:56:46.000000000 -0400
-@@ -132,7 +132,7 @@ static struct scsi_host_template ns87410
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations ns87410_port_ops = {
-+static const struct ata_port_operations ns87410_port_ops = {
- .inherits = &ata_sff_port_ops,
- .qc_issue = ns87410_qc_issue,
- .cable_detect = ata_cable_40wire,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_ns87415.c linux-2.6.32.45/drivers/ata/pata_ns87415.c
---- linux-2.6.32.45/drivers/ata/pata_ns87415.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_ns87415.c 2011-04-17 15:56:46.000000000 -0400
-@@ -299,7 +299,7 @@ static u8 ns87560_bmdma_status(struct at
- }
- #endif /* 87560 SuperIO Support */
-
--static struct ata_port_operations ns87415_pata_ops = {
-+static const struct ata_port_operations ns87415_pata_ops = {
- .inherits = &ata_bmdma_port_ops,
-
- .check_atapi_dma = ns87415_check_atapi_dma,
-@@ -313,7 +313,7 @@ static struct ata_port_operations ns8741
- };
-
- #if defined(CONFIG_SUPERIO)
--static struct ata_port_operations ns87560_pata_ops = {
-+static const struct ata_port_operations ns87560_pata_ops = {
- .inherits = &ns87415_pata_ops,
- .sff_tf_read = ns87560_tf_read,
- .sff_check_status = ns87560_check_status,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_octeon_cf.c linux-2.6.32.45/drivers/ata/pata_octeon_cf.c
---- linux-2.6.32.45/drivers/ata/pata_octeon_cf.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_octeon_cf.c 2011-04-17 15:56:46.000000000 -0400
-@@ -801,6 +801,7 @@ static unsigned int octeon_cf_qc_issue(s
- return 0;
- }
-
-+/* cannot be const */
- static struct ata_port_operations octeon_cf_ops = {
- .inherits = &ata_sff_port_ops,
- .check_atapi_dma = octeon_cf_check_atapi_dma,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_oldpiix.c linux-2.6.32.45/drivers/ata/pata_oldpiix.c
---- linux-2.6.32.45/drivers/ata/pata_oldpiix.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_oldpiix.c 2011-04-17 15:56:46.000000000 -0400
-@@ -208,7 +208,7 @@ static struct scsi_host_template oldpiix
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations oldpiix_pata_ops = {
-+static const struct ata_port_operations oldpiix_pata_ops = {
- .inherits = &ata_bmdma_port_ops,
- .qc_issue = oldpiix_qc_issue,
- .cable_detect = ata_cable_40wire,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_opti.c linux-2.6.32.45/drivers/ata/pata_opti.c
---- linux-2.6.32.45/drivers/ata/pata_opti.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_opti.c 2011-04-17 15:56:46.000000000 -0400
-@@ -152,7 +152,7 @@ static struct scsi_host_template opti_sh
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations opti_port_ops = {
-+static const struct ata_port_operations opti_port_ops = {
- .inherits = &ata_sff_port_ops,
- .cable_detect = ata_cable_40wire,
- .set_piomode = opti_set_piomode,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_optidma.c linux-2.6.32.45/drivers/ata/pata_optidma.c
---- linux-2.6.32.45/drivers/ata/pata_optidma.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_optidma.c 2011-04-17 15:56:46.000000000 -0400
-@@ -337,7 +337,7 @@ static struct scsi_host_template optidma
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations optidma_port_ops = {
-+static const struct ata_port_operations optidma_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = ata_cable_40wire,
- .set_piomode = optidma_set_pio_mode,
-@@ -346,7 +346,7 @@ static struct ata_port_operations optidm
- .prereset = optidma_pre_reset,
- };
-
--static struct ata_port_operations optiplus_port_ops = {
-+static const struct ata_port_operations optiplus_port_ops = {
- .inherits = &optidma_port_ops,
- .set_piomode = optiplus_set_pio_mode,
- .set_dmamode = optiplus_set_dma_mode,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_palmld.c linux-2.6.32.45/drivers/ata/pata_palmld.c
---- linux-2.6.32.45/drivers/ata/pata_palmld.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_palmld.c 2011-04-17 15:56:46.000000000 -0400
-@@ -37,7 +37,7 @@ static struct scsi_host_template palmld_
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations palmld_port_ops = {
-+static const struct ata_port_operations palmld_port_ops = {
- .inherits = &ata_sff_port_ops,
- .sff_data_xfer = ata_sff_data_xfer_noirq,
- .cable_detect = ata_cable_40wire,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_pcmcia.c linux-2.6.32.45/drivers/ata/pata_pcmcia.c
---- linux-2.6.32.45/drivers/ata/pata_pcmcia.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_pcmcia.c 2011-04-17 15:56:46.000000000 -0400
-@@ -162,14 +162,14 @@ static struct scsi_host_template pcmcia_
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations pcmcia_port_ops = {
-+static const struct ata_port_operations pcmcia_port_ops = {
- .inherits = &ata_sff_port_ops,
- .sff_data_xfer = ata_sff_data_xfer_noirq,
- .cable_detect = ata_cable_40wire,
- .set_mode = pcmcia_set_mode,
- };
-
--static struct ata_port_operations pcmcia_8bit_port_ops = {
-+static const struct ata_port_operations pcmcia_8bit_port_ops = {
- .inherits = &ata_sff_port_ops,
- .sff_data_xfer = ata_data_xfer_8bit,
- .cable_detect = ata_cable_40wire,
-@@ -256,7 +256,7 @@ static int pcmcia_init_one(struct pcmcia
- unsigned long io_base, ctl_base;
- void __iomem *io_addr, *ctl_addr;
- int n_ports = 1;
-- struct ata_port_operations *ops = &pcmcia_port_ops;
-+ const struct ata_port_operations *ops = &pcmcia_port_ops;
-
- info = kzalloc(sizeof(*info), GFP_KERNEL);
- if (info == NULL)
-diff -urNp linux-2.6.32.45/drivers/ata/pata_pdc2027x.c linux-2.6.32.45/drivers/ata/pata_pdc2027x.c
---- linux-2.6.32.45/drivers/ata/pata_pdc2027x.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_pdc2027x.c 2011-04-17 15:56:46.000000000 -0400
-@@ -132,14 +132,14 @@ static struct scsi_host_template pdc2027
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations pdc2027x_pata100_ops = {
-+static const struct ata_port_operations pdc2027x_pata100_ops = {
- .inherits = &ata_bmdma_port_ops,
- .check_atapi_dma = pdc2027x_check_atapi_dma,
- .cable_detect = pdc2027x_cable_detect,
- .prereset = pdc2027x_prereset,
- };
-
--static struct ata_port_operations pdc2027x_pata133_ops = {
-+static const struct ata_port_operations pdc2027x_pata133_ops = {
- .inherits = &pdc2027x_pata100_ops,
- .mode_filter = pdc2027x_mode_filter,
- .set_piomode = pdc2027x_set_piomode,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_pdc202xx_old.c linux-2.6.32.45/drivers/ata/pata_pdc202xx_old.c
---- linux-2.6.32.45/drivers/ata/pata_pdc202xx_old.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_pdc202xx_old.c 2011-04-17 15:56:46.000000000 -0400
-@@ -274,7 +274,7 @@ static struct scsi_host_template pdc202x
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations pdc2024x_port_ops = {
-+static const struct ata_port_operations pdc2024x_port_ops = {
- .inherits = &ata_bmdma_port_ops,
-
- .cable_detect = ata_cable_40wire,
-@@ -284,7 +284,7 @@ static struct ata_port_operations pdc202
- .sff_exec_command = pdc202xx_exec_command,
- };
-
--static struct ata_port_operations pdc2026x_port_ops = {
-+static const struct ata_port_operations pdc2026x_port_ops = {
- .inherits = &pdc2024x_port_ops,
-
- .check_atapi_dma = pdc2026x_check_atapi_dma,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_platform.c linux-2.6.32.45/drivers/ata/pata_platform.c
---- linux-2.6.32.45/drivers/ata/pata_platform.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_platform.c 2011-04-17 15:56:46.000000000 -0400
-@@ -48,7 +48,7 @@ static struct scsi_host_template pata_pl
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations pata_platform_port_ops = {
-+static const struct ata_port_operations pata_platform_port_ops = {
- .inherits = &ata_sff_port_ops,
- .sff_data_xfer = ata_sff_data_xfer_noirq,
- .cable_detect = ata_cable_unknown,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_qdi.c linux-2.6.32.45/drivers/ata/pata_qdi.c
---- linux-2.6.32.45/drivers/ata/pata_qdi.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_qdi.c 2011-04-17 15:56:46.000000000 -0400
-@@ -157,7 +157,7 @@ static struct scsi_host_template qdi_sht
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations qdi6500_port_ops = {
-+static const struct ata_port_operations qdi6500_port_ops = {
- .inherits = &ata_sff_port_ops,
- .qc_issue = qdi_qc_issue,
- .sff_data_xfer = qdi_data_xfer,
-@@ -165,7 +165,7 @@ static struct ata_port_operations qdi650
- .set_piomode = qdi6500_set_piomode,
- };
-
--static struct ata_port_operations qdi6580_port_ops = {
-+static const struct ata_port_operations qdi6580_port_ops = {
- .inherits = &qdi6500_port_ops,
- .set_piomode = qdi6580_set_piomode,
- };
-diff -urNp linux-2.6.32.45/drivers/ata/pata_radisys.c linux-2.6.32.45/drivers/ata/pata_radisys.c
---- linux-2.6.32.45/drivers/ata/pata_radisys.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_radisys.c 2011-04-17 15:56:46.000000000 -0400
-@@ -187,7 +187,7 @@ static struct scsi_host_template radisys
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations radisys_pata_ops = {
-+static const struct ata_port_operations radisys_pata_ops = {
- .inherits = &ata_bmdma_port_ops,
- .qc_issue = radisys_qc_issue,
- .cable_detect = ata_cable_unknown,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_rb532_cf.c linux-2.6.32.45/drivers/ata/pata_rb532_cf.c
---- linux-2.6.32.45/drivers/ata/pata_rb532_cf.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_rb532_cf.c 2011-04-17 15:56:46.000000000 -0400
-@@ -68,7 +68,7 @@ static irqreturn_t rb532_pata_irq_handle
- return IRQ_HANDLED;
- }
-
--static struct ata_port_operations rb532_pata_port_ops = {
-+static const struct ata_port_operations rb532_pata_port_ops = {
- .inherits = &ata_sff_port_ops,
- .sff_data_xfer = ata_sff_data_xfer32,
- };
-diff -urNp linux-2.6.32.45/drivers/ata/pata_rdc.c linux-2.6.32.45/drivers/ata/pata_rdc.c
---- linux-2.6.32.45/drivers/ata/pata_rdc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_rdc.c 2011-04-17 15:56:46.000000000 -0400
-@@ -272,7 +272,7 @@ static void rdc_set_dmamode(struct ata_p
- pci_write_config_byte(dev, 0x48, udma_enable);
- }
-
--static struct ata_port_operations rdc_pata_ops = {
-+static const struct ata_port_operations rdc_pata_ops = {
- .inherits = &ata_bmdma32_port_ops,
- .cable_detect = rdc_pata_cable_detect,
- .set_piomode = rdc_set_piomode,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_rz1000.c linux-2.6.32.45/drivers/ata/pata_rz1000.c
---- linux-2.6.32.45/drivers/ata/pata_rz1000.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_rz1000.c 2011-04-17 15:56:46.000000000 -0400
-@@ -54,7 +54,7 @@ static struct scsi_host_template rz1000_
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations rz1000_port_ops = {
-+static const struct ata_port_operations rz1000_port_ops = {
- .inherits = &ata_sff_port_ops,
- .cable_detect = ata_cable_40wire,
- .set_mode = rz1000_set_mode,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_sc1200.c linux-2.6.32.45/drivers/ata/pata_sc1200.c
---- linux-2.6.32.45/drivers/ata/pata_sc1200.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_sc1200.c 2011-04-17 15:56:46.000000000 -0400
-@@ -207,7 +207,7 @@ static struct scsi_host_template sc1200_
- .sg_tablesize = LIBATA_DUMB_MAX_PRD,
- };
-
--static struct ata_port_operations sc1200_port_ops = {
-+static const struct ata_port_operations sc1200_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .qc_prep = ata_sff_dumb_qc_prep,
- .qc_issue = sc1200_qc_issue,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_scc.c linux-2.6.32.45/drivers/ata/pata_scc.c
---- linux-2.6.32.45/drivers/ata/pata_scc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_scc.c 2011-04-17 15:56:46.000000000 -0400
-@@ -965,7 +965,7 @@ static struct scsi_host_template scc_sht
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations scc_pata_ops = {
-+static const struct ata_port_operations scc_pata_ops = {
- .inherits = &ata_bmdma_port_ops,
-
- .set_piomode = scc_set_piomode,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_sch.c linux-2.6.32.45/drivers/ata/pata_sch.c
---- linux-2.6.32.45/drivers/ata/pata_sch.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_sch.c 2011-04-17 15:56:46.000000000 -0400
-@@ -75,7 +75,7 @@ static struct scsi_host_template sch_sht
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations sch_pata_ops = {
-+static const struct ata_port_operations sch_pata_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = ata_cable_unknown,
- .set_piomode = sch_set_piomode,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_serverworks.c linux-2.6.32.45/drivers/ata/pata_serverworks.c
---- linux-2.6.32.45/drivers/ata/pata_serverworks.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_serverworks.c 2011-04-17 15:56:46.000000000 -0400
-@@ -299,7 +299,7 @@ static struct scsi_host_template serverw
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations serverworks_osb4_port_ops = {
-+static const struct ata_port_operations serverworks_osb4_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = serverworks_cable_detect,
- .mode_filter = serverworks_osb4_filter,
-@@ -307,7 +307,7 @@ static struct ata_port_operations server
- .set_dmamode = serverworks_set_dmamode,
- };
-
--static struct ata_port_operations serverworks_csb_port_ops = {
-+static const struct ata_port_operations serverworks_csb_port_ops = {
- .inherits = &serverworks_osb4_port_ops,
- .mode_filter = serverworks_csb_filter,
- };
-diff -urNp linux-2.6.32.45/drivers/ata/pata_sil680.c linux-2.6.32.45/drivers/ata/pata_sil680.c
---- linux-2.6.32.45/drivers/ata/pata_sil680.c 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_sil680.c 2011-06-25 12:56:37.000000000 -0400
-@@ -194,7 +194,7 @@ static struct scsi_host_template sil680_
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations sil680_port_ops = {
-+static const struct ata_port_operations sil680_port_ops = {
- .inherits = &ata_bmdma32_port_ops,
- .cable_detect = sil680_cable_detect,
- .set_piomode = sil680_set_piomode,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_sis.c linux-2.6.32.45/drivers/ata/pata_sis.c
---- linux-2.6.32.45/drivers/ata/pata_sis.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_sis.c 2011-04-17 15:56:46.000000000 -0400
-@@ -503,47 +503,47 @@ static struct scsi_host_template sis_sht
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations sis_133_for_sata_ops = {
-+static const struct ata_port_operations sis_133_for_sata_ops = {
- .inherits = &ata_bmdma_port_ops,
- .set_piomode = sis_133_set_piomode,
- .set_dmamode = sis_133_set_dmamode,
- .cable_detect = sis_133_cable_detect,
- };
-
--static struct ata_port_operations sis_base_ops = {
-+static const struct ata_port_operations sis_base_ops = {
- .inherits = &ata_bmdma_port_ops,
- .prereset = sis_pre_reset,
- };
-
--static struct ata_port_operations sis_133_ops = {
-+static const struct ata_port_operations sis_133_ops = {
- .inherits = &sis_base_ops,
- .set_piomode = sis_133_set_piomode,
- .set_dmamode = sis_133_set_dmamode,
- .cable_detect = sis_133_cable_detect,
- };
-
--static struct ata_port_operations sis_133_early_ops = {
-+static const struct ata_port_operations sis_133_early_ops = {
- .inherits = &sis_base_ops,
- .set_piomode = sis_100_set_piomode,
- .set_dmamode = sis_133_early_set_dmamode,
- .cable_detect = sis_66_cable_detect,
- };
-
--static struct ata_port_operations sis_100_ops = {
-+static const struct ata_port_operations sis_100_ops = {
- .inherits = &sis_base_ops,
- .set_piomode = sis_100_set_piomode,
- .set_dmamode = sis_100_set_dmamode,
- .cable_detect = sis_66_cable_detect,
- };
-
--static struct ata_port_operations sis_66_ops = {
-+static const struct ata_port_operations sis_66_ops = {
- .inherits = &sis_base_ops,
- .set_piomode = sis_old_set_piomode,
- .set_dmamode = sis_66_set_dmamode,
- .cable_detect = sis_66_cable_detect,
- };
-
--static struct ata_port_operations sis_old_ops = {
-+static const struct ata_port_operations sis_old_ops = {
- .inherits = &sis_base_ops,
- .set_piomode = sis_old_set_piomode,
- .set_dmamode = sis_old_set_dmamode,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_sl82c105.c linux-2.6.32.45/drivers/ata/pata_sl82c105.c
---- linux-2.6.32.45/drivers/ata/pata_sl82c105.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_sl82c105.c 2011-04-17 15:56:46.000000000 -0400
-@@ -231,7 +231,7 @@ static struct scsi_host_template sl82c10
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations sl82c105_port_ops = {
-+static const struct ata_port_operations sl82c105_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .qc_defer = sl82c105_qc_defer,
- .bmdma_start = sl82c105_bmdma_start,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_triflex.c linux-2.6.32.45/drivers/ata/pata_triflex.c
---- linux-2.6.32.45/drivers/ata/pata_triflex.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_triflex.c 2011-04-17 15:56:46.000000000 -0400
-@@ -178,7 +178,7 @@ static struct scsi_host_template triflex
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations triflex_port_ops = {
-+static const struct ata_port_operations triflex_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .bmdma_start = triflex_bmdma_start,
- .bmdma_stop = triflex_bmdma_stop,
-diff -urNp linux-2.6.32.45/drivers/ata/pata_via.c linux-2.6.32.45/drivers/ata/pata_via.c
---- linux-2.6.32.45/drivers/ata/pata_via.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_via.c 2011-04-17 15:56:46.000000000 -0400
-@@ -419,7 +419,7 @@ static struct scsi_host_template via_sht
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations via_port_ops = {
-+static const struct ata_port_operations via_port_ops = {
- .inherits = &ata_bmdma_port_ops,
- .cable_detect = via_cable_detect,
- .set_piomode = via_set_piomode,
-@@ -429,7 +429,7 @@ static struct ata_port_operations via_po
- .port_start = via_port_start,
- };
-
--static struct ata_port_operations via_port_ops_noirq = {
-+static const struct ata_port_operations via_port_ops_noirq = {
- .inherits = &via_port_ops,
- .sff_data_xfer = ata_sff_data_xfer_noirq,
- };
-diff -urNp linux-2.6.32.45/drivers/ata/pata_winbond.c linux-2.6.32.45/drivers/ata/pata_winbond.c
---- linux-2.6.32.45/drivers/ata/pata_winbond.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pata_winbond.c 2011-04-17 15:56:46.000000000 -0400
-@@ -125,7 +125,7 @@ static struct scsi_host_template winbond
- ATA_PIO_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations winbond_port_ops = {
-+static const struct ata_port_operations winbond_port_ops = {
- .inherits = &ata_sff_port_ops,
- .sff_data_xfer = winbond_data_xfer,
- .cable_detect = ata_cable_40wire,
-diff -urNp linux-2.6.32.45/drivers/ata/pdc_adma.c linux-2.6.32.45/drivers/ata/pdc_adma.c
---- linux-2.6.32.45/drivers/ata/pdc_adma.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/pdc_adma.c 2011-04-17 15:56:46.000000000 -0400
-@@ -145,7 +145,7 @@ static struct scsi_host_template adma_at
- .dma_boundary = ADMA_DMA_BOUNDARY,
- };
-
--static struct ata_port_operations adma_ata_ops = {
-+static const struct ata_port_operations adma_ata_ops = {
- .inherits = &ata_sff_port_ops,
-
- .lost_interrupt = ATA_OP_NULL,
-diff -urNp linux-2.6.32.45/drivers/ata/sata_fsl.c linux-2.6.32.45/drivers/ata/sata_fsl.c
---- linux-2.6.32.45/drivers/ata/sata_fsl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/sata_fsl.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1258,7 +1258,7 @@ static struct scsi_host_template sata_fs
- .dma_boundary = ATA_DMA_BOUNDARY,
- };
-
--static struct ata_port_operations sata_fsl_ops = {
-+static const struct ata_port_operations sata_fsl_ops = {
- .inherits = &sata_pmp_port_ops,
-
- .qc_defer = ata_std_qc_defer,
-diff -urNp linux-2.6.32.45/drivers/ata/sata_inic162x.c linux-2.6.32.45/drivers/ata/sata_inic162x.c
---- linux-2.6.32.45/drivers/ata/sata_inic162x.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/sata_inic162x.c 2011-04-17 15:56:46.000000000 -0400
-@@ -721,7 +721,7 @@ static int inic_port_start(struct ata_po
- return 0;
- }
-
--static struct ata_port_operations inic_port_ops = {
-+static const struct ata_port_operations inic_port_ops = {
- .inherits = &sata_port_ops,
-
- .check_atapi_dma = inic_check_atapi_dma,
-diff -urNp linux-2.6.32.45/drivers/ata/sata_mv.c linux-2.6.32.45/drivers/ata/sata_mv.c
---- linux-2.6.32.45/drivers/ata/sata_mv.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/sata_mv.c 2011-04-17 15:56:46.000000000 -0400
-@@ -656,7 +656,7 @@ static struct scsi_host_template mv6_sht
- .dma_boundary = MV_DMA_BOUNDARY,
- };
-
--static struct ata_port_operations mv5_ops = {
-+static const struct ata_port_operations mv5_ops = {
- .inherits = &ata_sff_port_ops,
-
- .lost_interrupt = ATA_OP_NULL,
-@@ -678,7 +678,7 @@ static struct ata_port_operations mv5_op
- .port_stop = mv_port_stop,
- };
-
--static struct ata_port_operations mv6_ops = {
-+static const struct ata_port_operations mv6_ops = {
- .inherits = &mv5_ops,
- .dev_config = mv6_dev_config,
- .scr_read = mv_scr_read,
-@@ -698,7 +698,7 @@ static struct ata_port_operations mv6_op
- .bmdma_status = mv_bmdma_status,
- };
-
--static struct ata_port_operations mv_iie_ops = {
-+static const struct ata_port_operations mv_iie_ops = {
- .inherits = &mv6_ops,
- .dev_config = ATA_OP_NULL,
- .qc_prep = mv_qc_prep_iie,
-diff -urNp linux-2.6.32.45/drivers/ata/sata_nv.c linux-2.6.32.45/drivers/ata/sata_nv.c
---- linux-2.6.32.45/drivers/ata/sata_nv.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/sata_nv.c 2011-04-17 15:56:46.000000000 -0400
-@@ -464,7 +464,7 @@ static struct scsi_host_template nv_swnc
- * cases. Define nv_hardreset() which only kicks in for post-boot
- * probing and use it for all variants.
- */
--static struct ata_port_operations nv_generic_ops = {
-+static const struct ata_port_operations nv_generic_ops = {
- .inherits = &ata_bmdma_port_ops,
- .lost_interrupt = ATA_OP_NULL,
- .scr_read = nv_scr_read,
-@@ -472,20 +472,20 @@ static struct ata_port_operations nv_gen
- .hardreset = nv_hardreset,
- };
-
--static struct ata_port_operations nv_nf2_ops = {
-+static const struct ata_port_operations nv_nf2_ops = {
- .inherits = &nv_generic_ops,
- .freeze = nv_nf2_freeze,
- .thaw = nv_nf2_thaw,
- };
-
--static struct ata_port_operations nv_ck804_ops = {
-+static const struct ata_port_operations nv_ck804_ops = {
- .inherits = &nv_generic_ops,
- .freeze = nv_ck804_freeze,
- .thaw = nv_ck804_thaw,
- .host_stop = nv_ck804_host_stop,
- };
-
--static struct ata_port_operations nv_adma_ops = {
-+static const struct ata_port_operations nv_adma_ops = {
- .inherits = &nv_ck804_ops,
-
- .check_atapi_dma = nv_adma_check_atapi_dma,
-@@ -509,7 +509,7 @@ static struct ata_port_operations nv_adm
- .host_stop = nv_adma_host_stop,
- };
-
--static struct ata_port_operations nv_swncq_ops = {
-+static const struct ata_port_operations nv_swncq_ops = {
- .inherits = &nv_generic_ops,
-
- .qc_defer = ata_std_qc_defer,
-diff -urNp linux-2.6.32.45/drivers/ata/sata_promise.c linux-2.6.32.45/drivers/ata/sata_promise.c
---- linux-2.6.32.45/drivers/ata/sata_promise.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/sata_promise.c 2011-04-17 15:56:46.000000000 -0400
-@@ -195,7 +195,7 @@ static const struct ata_port_operations
- .error_handler = pdc_error_handler,
- };
-
--static struct ata_port_operations pdc_sata_ops = {
-+static const struct ata_port_operations pdc_sata_ops = {
- .inherits = &pdc_common_ops,
- .cable_detect = pdc_sata_cable_detect,
- .freeze = pdc_sata_freeze,
-@@ -208,14 +208,14 @@ static struct ata_port_operations pdc_sa
-
- /* First-generation chips need a more restrictive ->check_atapi_dma op,
- and ->freeze/thaw that ignore the hotplug controls. */
--static struct ata_port_operations pdc_old_sata_ops = {
-+static const struct ata_port_operations pdc_old_sata_ops = {
- .inherits = &pdc_sata_ops,
- .freeze = pdc_freeze,
- .thaw = pdc_thaw,
- .check_atapi_dma = pdc_old_sata_check_atapi_dma,
- };
-
--static struct ata_port_operations pdc_pata_ops = {
-+static const struct ata_port_operations pdc_pata_ops = {
- .inherits = &pdc_common_ops,
- .cable_detect = pdc_pata_cable_detect,
- .freeze = pdc_freeze,
-diff -urNp linux-2.6.32.45/drivers/ata/sata_qstor.c linux-2.6.32.45/drivers/ata/sata_qstor.c
---- linux-2.6.32.45/drivers/ata/sata_qstor.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/sata_qstor.c 2011-04-17 15:56:46.000000000 -0400
-@@ -132,7 +132,7 @@ static struct scsi_host_template qs_ata_
- .dma_boundary = QS_DMA_BOUNDARY,
- };
-
--static struct ata_port_operations qs_ata_ops = {
-+static const struct ata_port_operations qs_ata_ops = {
- .inherits = &ata_sff_port_ops,
-
- .check_atapi_dma = qs_check_atapi_dma,
-diff -urNp linux-2.6.32.45/drivers/ata/sata_sil24.c linux-2.6.32.45/drivers/ata/sata_sil24.c
---- linux-2.6.32.45/drivers/ata/sata_sil24.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/sata_sil24.c 2011-04-17 15:56:46.000000000 -0400
-@@ -388,7 +388,7 @@ static struct scsi_host_template sil24_s
- .dma_boundary = ATA_DMA_BOUNDARY,
- };
-
--static struct ata_port_operations sil24_ops = {
-+static const struct ata_port_operations sil24_ops = {
- .inherits = &sata_pmp_port_ops,
-
- .qc_defer = sil24_qc_defer,
-diff -urNp linux-2.6.32.45/drivers/ata/sata_sil.c linux-2.6.32.45/drivers/ata/sata_sil.c
---- linux-2.6.32.45/drivers/ata/sata_sil.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/sata_sil.c 2011-04-17 15:56:46.000000000 -0400
-@@ -182,7 +182,7 @@ static struct scsi_host_template sil_sht
- .sg_tablesize = ATA_MAX_PRD
- };
-
--static struct ata_port_operations sil_ops = {
-+static const struct ata_port_operations sil_ops = {
- .inherits = &ata_bmdma32_port_ops,
- .dev_config = sil_dev_config,
- .set_mode = sil_set_mode,
-diff -urNp linux-2.6.32.45/drivers/ata/sata_sis.c linux-2.6.32.45/drivers/ata/sata_sis.c
---- linux-2.6.32.45/drivers/ata/sata_sis.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/sata_sis.c 2011-04-17 15:56:46.000000000 -0400
-@@ -89,7 +89,7 @@ static struct scsi_host_template sis_sht
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations sis_ops = {
-+static const struct ata_port_operations sis_ops = {
- .inherits = &ata_bmdma_port_ops,
- .scr_read = sis_scr_read,
- .scr_write = sis_scr_write,
-diff -urNp linux-2.6.32.45/drivers/ata/sata_svw.c linux-2.6.32.45/drivers/ata/sata_svw.c
---- linux-2.6.32.45/drivers/ata/sata_svw.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/sata_svw.c 2011-04-17 15:56:46.000000000 -0400
-@@ -344,7 +344,7 @@ static struct scsi_host_template k2_sata
- };
-
-
--static struct ata_port_operations k2_sata_ops = {
-+static const struct ata_port_operations k2_sata_ops = {
- .inherits = &ata_bmdma_port_ops,
- .sff_tf_load = k2_sata_tf_load,
- .sff_tf_read = k2_sata_tf_read,
-diff -urNp linux-2.6.32.45/drivers/ata/sata_sx4.c linux-2.6.32.45/drivers/ata/sata_sx4.c
---- linux-2.6.32.45/drivers/ata/sata_sx4.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/sata_sx4.c 2011-04-17 15:56:46.000000000 -0400
-@@ -248,7 +248,7 @@ static struct scsi_host_template pdc_sat
- };
-
- /* TODO: inherit from base port_ops after converting to new EH */
--static struct ata_port_operations pdc_20621_ops = {
-+static const struct ata_port_operations pdc_20621_ops = {
- .inherits = &ata_sff_port_ops,
-
- .check_atapi_dma = pdc_check_atapi_dma,
-diff -urNp linux-2.6.32.45/drivers/ata/sata_uli.c linux-2.6.32.45/drivers/ata/sata_uli.c
---- linux-2.6.32.45/drivers/ata/sata_uli.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/sata_uli.c 2011-04-17 15:56:46.000000000 -0400
-@@ -79,7 +79,7 @@ static struct scsi_host_template uli_sht
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations uli_ops = {
-+static const struct ata_port_operations uli_ops = {
- .inherits = &ata_bmdma_port_ops,
- .scr_read = uli_scr_read,
- .scr_write = uli_scr_write,
-diff -urNp linux-2.6.32.45/drivers/ata/sata_via.c linux-2.6.32.45/drivers/ata/sata_via.c
---- linux-2.6.32.45/drivers/ata/sata_via.c 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/sata_via.c 2011-05-10 22:15:08.000000000 -0400
-@@ -115,32 +115,32 @@ static struct scsi_host_template svia_sh
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations svia_base_ops = {
-+static const struct ata_port_operations svia_base_ops = {
- .inherits = &ata_bmdma_port_ops,
- .sff_tf_load = svia_tf_load,
- };
-
--static struct ata_port_operations vt6420_sata_ops = {
-+static const struct ata_port_operations vt6420_sata_ops = {
- .inherits = &svia_base_ops,
- .freeze = svia_noop_freeze,
- .prereset = vt6420_prereset,
- .bmdma_start = vt6420_bmdma_start,
- };
-
--static struct ata_port_operations vt6421_pata_ops = {
-+static const struct ata_port_operations vt6421_pata_ops = {
- .inherits = &svia_base_ops,
- .cable_detect = vt6421_pata_cable_detect,
- .set_piomode = vt6421_set_pio_mode,
- .set_dmamode = vt6421_set_dma_mode,
- };
-
--static struct ata_port_operations vt6421_sata_ops = {
-+static const struct ata_port_operations vt6421_sata_ops = {
- .inherits = &svia_base_ops,
- .scr_read = svia_scr_read,
- .scr_write = svia_scr_write,
- };
-
--static struct ata_port_operations vt8251_ops = {
-+static const struct ata_port_operations vt8251_ops = {
- .inherits = &svia_base_ops,
- .hardreset = sata_std_hardreset,
- .scr_read = vt8251_scr_read,
-diff -urNp linux-2.6.32.45/drivers/ata/sata_vsc.c linux-2.6.32.45/drivers/ata/sata_vsc.c
---- linux-2.6.32.45/drivers/ata/sata_vsc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ata/sata_vsc.c 2011-04-17 15:56:46.000000000 -0400
-@@ -306,7 +306,7 @@ static struct scsi_host_template vsc_sat
- };
-
-
--static struct ata_port_operations vsc_sata_ops = {
-+static const struct ata_port_operations vsc_sata_ops = {
- .inherits = &ata_bmdma_port_ops,
- /* The IRQ handling is not quite standard SFF behaviour so we
- cannot use the default lost interrupt handler */
-diff -urNp linux-2.6.32.45/drivers/atm/adummy.c linux-2.6.32.45/drivers/atm/adummy.c
---- linux-2.6.32.45/drivers/atm/adummy.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/atm/adummy.c 2011-04-17 15:56:46.000000000 -0400
-@@ -77,7 +77,7 @@ adummy_send(struct atm_vcc *vcc, struct
- vcc->pop(vcc, skb);
- else
- dev_kfree_skb_any(skb);
-- atomic_inc(&vcc->stats->tx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
-
- return 0;
- }
-diff -urNp linux-2.6.32.45/drivers/atm/ambassador.c linux-2.6.32.45/drivers/atm/ambassador.c
---- linux-2.6.32.45/drivers/atm/ambassador.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/atm/ambassador.c 2011-04-17 15:56:46.000000000 -0400
-@@ -453,7 +453,7 @@ static void tx_complete (amb_dev * dev,
- PRINTD (DBG_FLOW|DBG_TX, "tx_complete %p %p", dev, tx);
-
- // VC layer stats
-- atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
-+ atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
-
- // free the descriptor
- kfree (tx_descr);
-@@ -494,7 +494,7 @@ static void rx_complete (amb_dev * dev,
- dump_skb ("<<<", vc, skb);
-
- // VC layer stats
-- atomic_inc(&atm_vcc->stats->rx);
-+ atomic_inc_unchecked(&atm_vcc->stats->rx);
- __net_timestamp(skb);
- // end of our responsability
- atm_vcc->push (atm_vcc, skb);
-@@ -509,7 +509,7 @@ static void rx_complete (amb_dev * dev,
- } else {
- PRINTK (KERN_INFO, "dropped over-size frame");
- // should we count this?
-- atomic_inc(&atm_vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
- }
-
- } else {
-@@ -1341,7 +1341,7 @@ static int amb_send (struct atm_vcc * at
- }
-
- if (check_area (skb->data, skb->len)) {
-- atomic_inc(&atm_vcc->stats->tx_err);
-+ atomic_inc_unchecked(&atm_vcc->stats->tx_err);
- return -ENOMEM; // ?
- }
-
-diff -urNp linux-2.6.32.45/drivers/atm/atmtcp.c linux-2.6.32.45/drivers/atm/atmtcp.c
---- linux-2.6.32.45/drivers/atm/atmtcp.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/atm/atmtcp.c 2011-04-17 15:56:46.000000000 -0400
-@@ -206,7 +206,7 @@ static int atmtcp_v_send(struct atm_vcc
- if (vcc->pop) vcc->pop(vcc,skb);
- else dev_kfree_skb(skb);
- if (dev_data) return 0;
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- return -ENOLINK;
- }
- size = skb->len+sizeof(struct atmtcp_hdr);
-@@ -214,7 +214,7 @@ static int atmtcp_v_send(struct atm_vcc
- if (!new_skb) {
- if (vcc->pop) vcc->pop(vcc,skb);
- else dev_kfree_skb(skb);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- return -ENOBUFS;
- }
- hdr = (void *) skb_put(new_skb,sizeof(struct atmtcp_hdr));
-@@ -225,8 +225,8 @@ static int atmtcp_v_send(struct atm_vcc
- if (vcc->pop) vcc->pop(vcc,skb);
- else dev_kfree_skb(skb);
- out_vcc->push(out_vcc,new_skb);
-- atomic_inc(&vcc->stats->tx);
-- atomic_inc(&out_vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
-+ atomic_inc_unchecked(&out_vcc->stats->rx);
- return 0;
- }
-
-@@ -300,7 +300,7 @@ static int atmtcp_c_send(struct atm_vcc
- out_vcc = find_vcc(dev, ntohs(hdr->vpi), ntohs(hdr->vci));
- read_unlock(&vcc_sklist_lock);
- if (!out_vcc) {
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- goto done;
- }
- skb_pull(skb,sizeof(struct atmtcp_hdr));
-@@ -312,8 +312,8 @@ static int atmtcp_c_send(struct atm_vcc
- __net_timestamp(new_skb);
- skb_copy_from_linear_data(skb, skb_put(new_skb, skb->len), skb->len);
- out_vcc->push(out_vcc,new_skb);
-- atomic_inc(&vcc->stats->tx);
-- atomic_inc(&out_vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
-+ atomic_inc_unchecked(&out_vcc->stats->rx);
- done:
- if (vcc->pop) vcc->pop(vcc,skb);
- else dev_kfree_skb(skb);
-diff -urNp linux-2.6.32.45/drivers/atm/eni.c linux-2.6.32.45/drivers/atm/eni.c
---- linux-2.6.32.45/drivers/atm/eni.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/atm/eni.c 2011-04-17 15:56:46.000000000 -0400
-@@ -525,7 +525,7 @@ static int rx_aal0(struct atm_vcc *vcc)
- DPRINTK(DEV_LABEL "(itf %d): trashing empty cell\n",
- vcc->dev->number);
- length = 0;
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- }
- else {
- length = ATM_CELL_SIZE-1; /* no HEC */
-@@ -580,7 +580,7 @@ static int rx_aal5(struct atm_vcc *vcc)
- size);
- }
- eff = length = 0;
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- }
- else {
- size = (descr & MID_RED_COUNT)*(ATM_CELL_PAYLOAD >> 2);
-@@ -597,7 +597,7 @@ static int rx_aal5(struct atm_vcc *vcc)
- "(VCI=%d,length=%ld,size=%ld (descr 0x%lx))\n",
- vcc->dev->number,vcc->vci,length,size << 2,descr);
- length = eff = 0;
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- }
- }
- skb = eff ? atm_alloc_charge(vcc,eff << 2,GFP_ATOMIC) : NULL;
-@@ -770,7 +770,7 @@ rx_dequeued++;
- vcc->push(vcc,skb);
- pushed++;
- }
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
- }
- wake_up(&eni_dev->rx_wait);
- }
-@@ -1227,7 +1227,7 @@ static void dequeue_tx(struct atm_dev *d
- PCI_DMA_TODEVICE);
- if (vcc->pop) vcc->pop(vcc,skb);
- else dev_kfree_skb_irq(skb);
-- atomic_inc(&vcc->stats->tx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
- wake_up(&eni_dev->tx_wait);
- dma_complete++;
- }
-diff -urNp linux-2.6.32.45/drivers/atm/firestream.c linux-2.6.32.45/drivers/atm/firestream.c
---- linux-2.6.32.45/drivers/atm/firestream.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/atm/firestream.c 2011-04-17 15:56:46.000000000 -0400
-@@ -748,7 +748,7 @@ static void process_txdone_queue (struct
- }
- }
-
-- atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
-+ atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
-
- fs_dprintk (FS_DEBUG_TXMEM, "i");
- fs_dprintk (FS_DEBUG_ALLOC, "Free t-skb: %p\n", skb);
-@@ -815,7 +815,7 @@ static void process_incoming (struct fs_
- #endif
- skb_put (skb, qe->p1 & 0xffff);
- ATM_SKB(skb)->vcc = atm_vcc;
-- atomic_inc(&atm_vcc->stats->rx);
-+ atomic_inc_unchecked(&atm_vcc->stats->rx);
- __net_timestamp(skb);
- fs_dprintk (FS_DEBUG_ALLOC, "Free rec-skb: %p (pushed)\n", skb);
- atm_vcc->push (atm_vcc, skb);
-@@ -836,12 +836,12 @@ static void process_incoming (struct fs_
- kfree (pe);
- }
- if (atm_vcc)
-- atomic_inc(&atm_vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
- break;
- case 0x1f: /* Reassembly abort: no buffers. */
- /* Silently increment error counter. */
- if (atm_vcc)
-- atomic_inc(&atm_vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
- break;
- default: /* Hmm. Haven't written the code to handle the others yet... -- REW */
- printk (KERN_WARNING "Don't know what to do with RX status %x: %s.\n",
-diff -urNp linux-2.6.32.45/drivers/atm/fore200e.c linux-2.6.32.45/drivers/atm/fore200e.c
---- linux-2.6.32.45/drivers/atm/fore200e.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/atm/fore200e.c 2011-04-17 15:56:46.000000000 -0400
-@@ -931,9 +931,9 @@ fore200e_tx_irq(struct fore200e* fore200
- #endif
- /* check error condition */
- if (*entry->status & STATUS_ERROR)
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- else
-- atomic_inc(&vcc->stats->tx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
- }
- }
-
-@@ -1082,7 +1082,7 @@ fore200e_push_rpd(struct fore200e* fore2
- if (skb == NULL) {
- DPRINTK(2, "unable to alloc new skb, rx PDU length = %d\n", pdu_len);
-
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- return -ENOMEM;
- }
-
-@@ -1125,14 +1125,14 @@ fore200e_push_rpd(struct fore200e* fore2
-
- dev_kfree_skb_any(skb);
-
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- return -ENOMEM;
- }
-
- ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
-
- vcc->push(vcc, skb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
-
- ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
-
-@@ -1210,7 +1210,7 @@ fore200e_rx_irq(struct fore200e* fore200
- DPRINTK(2, "damaged PDU on %d.%d.%d\n",
- fore200e->atm_dev->number,
- entry->rpd->atm_header.vpi, entry->rpd->atm_header.vci);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- }
- }
-
-@@ -1655,7 +1655,7 @@ fore200e_send(struct atm_vcc *vcc, struc
- goto retry_here;
- }
-
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
-
- fore200e->tx_sat++;
- DPRINTK(2, "tx queue of device %s is saturated, PDU dropped - heartbeat is %08x\n",
-diff -urNp linux-2.6.32.45/drivers/atm/he.c linux-2.6.32.45/drivers/atm/he.c
---- linux-2.6.32.45/drivers/atm/he.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/atm/he.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1769,7 +1769,7 @@ he_service_rbrq(struct he_dev *he_dev, i
-
- if (RBRQ_HBUF_ERR(he_dev->rbrq_head)) {
- hprintk("HBUF_ERR! (cid 0x%x)\n", cid);
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- goto return_host_buffers;
- }
-
-@@ -1802,7 +1802,7 @@ he_service_rbrq(struct he_dev *he_dev, i
- RBRQ_LEN_ERR(he_dev->rbrq_head)
- ? "LEN_ERR" : "",
- vcc->vpi, vcc->vci);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- goto return_host_buffers;
- }
-
-@@ -1861,7 +1861,7 @@ he_service_rbrq(struct he_dev *he_dev, i
- vcc->push(vcc, skb);
- spin_lock(&he_dev->global_lock);
-
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
-
- return_host_buffers:
- ++pdus_assembled;
-@@ -2206,7 +2206,7 @@ __enqueue_tpd(struct he_dev *he_dev, str
- tpd->vcc->pop(tpd->vcc, tpd->skb);
- else
- dev_kfree_skb_any(tpd->skb);
-- atomic_inc(&tpd->vcc->stats->tx_err);
-+ atomic_inc_unchecked(&tpd->vcc->stats->tx_err);
- }
- pci_pool_free(he_dev->tpd_pool, tpd, TPD_ADDR(tpd->status));
- return;
-@@ -2618,7 +2618,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
- vcc->pop(vcc, skb);
- else
- dev_kfree_skb_any(skb);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- return -EINVAL;
- }
-
-@@ -2629,7 +2629,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
- vcc->pop(vcc, skb);
- else
- dev_kfree_skb_any(skb);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- return -EINVAL;
- }
- #endif
-@@ -2641,7 +2641,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
- vcc->pop(vcc, skb);
- else
- dev_kfree_skb_any(skb);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- spin_unlock_irqrestore(&he_dev->global_lock, flags);
- return -ENOMEM;
- }
-@@ -2683,7 +2683,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
- vcc->pop(vcc, skb);
- else
- dev_kfree_skb_any(skb);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- spin_unlock_irqrestore(&he_dev->global_lock, flags);
- return -ENOMEM;
- }
-@@ -2714,7 +2714,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
- __enqueue_tpd(he_dev, tpd, cid);
- spin_unlock_irqrestore(&he_dev->global_lock, flags);
-
-- atomic_inc(&vcc->stats->tx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
-
- return 0;
- }
-diff -urNp linux-2.6.32.45/drivers/atm/horizon.c linux-2.6.32.45/drivers/atm/horizon.c
---- linux-2.6.32.45/drivers/atm/horizon.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/atm/horizon.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1033,7 +1033,7 @@ static void rx_schedule (hrz_dev * dev,
- {
- struct atm_vcc * vcc = ATM_SKB(skb)->vcc;
- // VC layer stats
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
- __net_timestamp(skb);
- // end of our responsability
- vcc->push (vcc, skb);
-@@ -1185,7 +1185,7 @@ static void tx_schedule (hrz_dev * const
- dev->tx_iovec = NULL;
-
- // VC layer stats
-- atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
-+ atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
-
- // free the skb
- hrz_kfree_skb (skb);
-diff -urNp linux-2.6.32.45/drivers/atm/idt77252.c linux-2.6.32.45/drivers/atm/idt77252.c
---- linux-2.6.32.45/drivers/atm/idt77252.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/atm/idt77252.c 2011-04-17 15:56:46.000000000 -0400
-@@ -810,7 +810,7 @@ drain_scq(struct idt77252_dev *card, str
- else
- dev_kfree_skb(skb);
-
-- atomic_inc(&vcc->stats->tx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
- }
-
- atomic_dec(&scq->used);
-@@ -1073,13 +1073,13 @@ dequeue_rx(struct idt77252_dev *card, st
- if ((sb = dev_alloc_skb(64)) == NULL) {
- printk("%s: Can't allocate buffers for aal0.\n",
- card->name);
-- atomic_add(i, &vcc->stats->rx_drop);
-+ atomic_add_unchecked(i, &vcc->stats->rx_drop);
- break;
- }
- if (!atm_charge(vcc, sb->truesize)) {
- RXPRINTK("%s: atm_charge() dropped aal0 packets.\n",
- card->name);
-- atomic_add(i - 1, &vcc->stats->rx_drop);
-+ atomic_add_unchecked(i - 1, &vcc->stats->rx_drop);
- dev_kfree_skb(sb);
- break;
- }
-@@ -1096,7 +1096,7 @@ dequeue_rx(struct idt77252_dev *card, st
- ATM_SKB(sb)->vcc = vcc;
- __net_timestamp(sb);
- vcc->push(vcc, sb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
-
- cell += ATM_CELL_PAYLOAD;
- }
-@@ -1133,13 +1133,13 @@ dequeue_rx(struct idt77252_dev *card, st
- "(CDC: %08x)\n",
- card->name, len, rpp->len, readl(SAR_REG_CDC));
- recycle_rx_pool_skb(card, rpp);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- return;
- }
- if (stat & SAR_RSQE_CRC) {
- RXPRINTK("%s: AAL5 CRC error.\n", card->name);
- recycle_rx_pool_skb(card, rpp);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- return;
- }
- if (skb_queue_len(&rpp->queue) > 1) {
-@@ -1150,7 +1150,7 @@ dequeue_rx(struct idt77252_dev *card, st
- RXPRINTK("%s: Can't alloc RX skb.\n",
- card->name);
- recycle_rx_pool_skb(card, rpp);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- return;
- }
- if (!atm_charge(vcc, skb->truesize)) {
-@@ -1169,7 +1169,7 @@ dequeue_rx(struct idt77252_dev *card, st
- __net_timestamp(skb);
-
- vcc->push(vcc, skb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
-
- return;
- }
-@@ -1191,7 +1191,7 @@ dequeue_rx(struct idt77252_dev *card, st
- __net_timestamp(skb);
-
- vcc->push(vcc, skb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
-
- if (skb->truesize > SAR_FB_SIZE_3)
- add_rx_skb(card, 3, SAR_FB_SIZE_3, 1);
-@@ -1303,14 +1303,14 @@ idt77252_rx_raw(struct idt77252_dev *car
- if (vcc->qos.aal != ATM_AAL0) {
- RPRINTK("%s: raw cell for non AAL0 vc %u.%u\n",
- card->name, vpi, vci);
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- goto drop;
- }
-
- if ((sb = dev_alloc_skb(64)) == NULL) {
- printk("%s: Can't allocate buffers for AAL0.\n",
- card->name);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- goto drop;
- }
-
-@@ -1329,7 +1329,7 @@ idt77252_rx_raw(struct idt77252_dev *car
- ATM_SKB(sb)->vcc = vcc;
- __net_timestamp(sb);
- vcc->push(vcc, sb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
-
- drop:
- skb_pull(queue, 64);
-@@ -1954,13 +1954,13 @@ idt77252_send_skb(struct atm_vcc *vcc, s
-
- if (vc == NULL) {
- printk("%s: NULL connection in send().\n", card->name);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- dev_kfree_skb(skb);
- return -EINVAL;
- }
- if (!test_bit(VCF_TX, &vc->flags)) {
- printk("%s: Trying to transmit on a non-tx VC.\n", card->name);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- dev_kfree_skb(skb);
- return -EINVAL;
- }
-@@ -1972,14 +1972,14 @@ idt77252_send_skb(struct atm_vcc *vcc, s
- break;
- default:
- printk("%s: Unsupported AAL: %d\n", card->name, vcc->qos.aal);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- dev_kfree_skb(skb);
- return -EINVAL;
- }
-
- if (skb_shinfo(skb)->nr_frags != 0) {
- printk("%s: No scatter-gather yet.\n", card->name);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- dev_kfree_skb(skb);
- return -EINVAL;
- }
-@@ -1987,7 +1987,7 @@ idt77252_send_skb(struct atm_vcc *vcc, s
-
- err = queue_skb(card, vc, skb, oam);
- if (err) {
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- dev_kfree_skb(skb);
- return err;
- }
-@@ -2010,7 +2010,7 @@ idt77252_send_oam(struct atm_vcc *vcc, v
- skb = dev_alloc_skb(64);
- if (!skb) {
- printk("%s: Out of memory in send_oam().\n", card->name);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- return -ENOMEM;
- }
- atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
-diff -urNp linux-2.6.32.45/drivers/atm/iphase.c linux-2.6.32.45/drivers/atm/iphase.c
---- linux-2.6.32.45/drivers/atm/iphase.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/atm/iphase.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1123,7 +1123,7 @@ static int rx_pkt(struct atm_dev *dev)
- status = (u_short) (buf_desc_ptr->desc_mode);
- if (status & (RX_CER | RX_PTE | RX_OFL))
- {
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- IF_ERR(printk("IA: bad packet, dropping it");)
- if (status & RX_CER) {
- IF_ERR(printk(" cause: packet CRC error\n");)
-@@ -1146,7 +1146,7 @@ static int rx_pkt(struct atm_dev *dev)
- len = dma_addr - buf_addr;
- if (len > iadev->rx_buf_sz) {
- printk("Over %d bytes sdu received, dropped!!!\n", iadev->rx_buf_sz);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- goto out_free_desc;
- }
-
-@@ -1296,7 +1296,7 @@ static void rx_dle_intr(struct atm_dev *
- ia_vcc = INPH_IA_VCC(vcc);
- if (ia_vcc == NULL)
- {
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- dev_kfree_skb_any(skb);
- atm_return(vcc, atm_guess_pdu2truesize(len));
- goto INCR_DLE;
-@@ -1308,7 +1308,7 @@ static void rx_dle_intr(struct atm_dev *
- if ((length > iadev->rx_buf_sz) || (length >
- (skb->len - sizeof(struct cpcs_trailer))))
- {
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- IF_ERR(printk("rx_dle_intr: Bad AAL5 trailer %d (skb len %d)",
- length, skb->len);)
- dev_kfree_skb_any(skb);
-@@ -1324,7 +1324,7 @@ static void rx_dle_intr(struct atm_dev *
-
- IF_RX(printk("rx_dle_intr: skb push");)
- vcc->push(vcc,skb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
- iadev->rx_pkt_cnt++;
- }
- INCR_DLE:
-@@ -2806,15 +2806,15 @@ static int ia_ioctl(struct atm_dev *dev,
- {
- struct k_sonet_stats *stats;
- stats = &PRIV(_ia_dev[board])->sonet_stats;
-- printk("section_bip: %d\n", atomic_read(&stats->section_bip));
-- printk("line_bip : %d\n", atomic_read(&stats->line_bip));
-- printk("path_bip : %d\n", atomic_read(&stats->path_bip));
-- printk("line_febe : %d\n", atomic_read(&stats->line_febe));
-- printk("path_febe : %d\n", atomic_read(&stats->path_febe));
-- printk("corr_hcs : %d\n", atomic_read(&stats->corr_hcs));
-- printk("uncorr_hcs : %d\n", atomic_read(&stats->uncorr_hcs));
-- printk("tx_cells : %d\n", atomic_read(&stats->tx_cells));
-- printk("rx_cells : %d\n", atomic_read(&stats->rx_cells));
-+ printk("section_bip: %d\n", atomic_read_unchecked(&stats->section_bip));
-+ printk("line_bip : %d\n", atomic_read_unchecked(&stats->line_bip));
-+ printk("path_bip : %d\n", atomic_read_unchecked(&stats->path_bip));
-+ printk("line_febe : %d\n", atomic_read_unchecked(&stats->line_febe));
-+ printk("path_febe : %d\n", atomic_read_unchecked(&stats->path_febe));
-+ printk("corr_hcs : %d\n", atomic_read_unchecked(&stats->corr_hcs));
-+ printk("uncorr_hcs : %d\n", atomic_read_unchecked(&stats->uncorr_hcs));
-+ printk("tx_cells : %d\n", atomic_read_unchecked(&stats->tx_cells));
-+ printk("rx_cells : %d\n", atomic_read_unchecked(&stats->rx_cells));
- }
- ia_cmds.status = 0;
- break;
-@@ -2919,7 +2919,7 @@ static int ia_pkt_tx (struct atm_vcc *vc
- if ((desc == 0) || (desc > iadev->num_tx_desc))
- {
- IF_ERR(printk(DEV_LABEL "invalid desc for send: %d\n", desc);)
-- atomic_inc(&vcc->stats->tx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
- if (vcc->pop)
- vcc->pop(vcc, skb);
- else
-@@ -3024,14 +3024,14 @@ static int ia_pkt_tx (struct atm_vcc *vc
- ATM_DESC(skb) = vcc->vci;
- skb_queue_tail(&iadev->tx_dma_q, skb);
-
-- atomic_inc(&vcc->stats->tx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
- iadev->tx_pkt_cnt++;
- /* Increment transaction counter */
- writel(2, iadev->dma+IPHASE5575_TX_COUNTER);
-
- #if 0
- /* add flow control logic */
-- if (atomic_read(&vcc->stats->tx) % 20 == 0) {
-+ if (atomic_read_unchecked(&vcc->stats->tx) % 20 == 0) {
- if (iavcc->vc_desc_cnt > 10) {
- vcc->tx_quota = vcc->tx_quota * 3 / 4;
- printk("Tx1: vcc->tx_quota = %d \n", (u32)vcc->tx_quota );
-diff -urNp linux-2.6.32.45/drivers/atm/lanai.c linux-2.6.32.45/drivers/atm/lanai.c
---- linux-2.6.32.45/drivers/atm/lanai.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/atm/lanai.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1305,7 +1305,7 @@ static void lanai_send_one_aal5(struct l
- vcc_tx_add_aal5_trailer(lvcc, skb->len, 0, 0);
- lanai_endtx(lanai, lvcc);
- lanai_free_skb(lvcc->tx.atmvcc, skb);
-- atomic_inc(&lvcc->tx.atmvcc->stats->tx);
-+ atomic_inc_unchecked(&lvcc->tx.atmvcc->stats->tx);
- }
-
- /* Try to fill the buffer - don't call unless there is backlog */
-@@ -1428,7 +1428,7 @@ static void vcc_rx_aal5(struct lanai_vcc
- ATM_SKB(skb)->vcc = lvcc->rx.atmvcc;
- __net_timestamp(skb);
- lvcc->rx.atmvcc->push(lvcc->rx.atmvcc, skb);
-- atomic_inc(&lvcc->rx.atmvcc->stats->rx);
-+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx);
- out:
- lvcc->rx.buf.ptr = end;
- cardvcc_write(lvcc, endptr, vcc_rxreadptr);
-@@ -1670,7 +1670,7 @@ static int handle_service(struct lanai_d
- DPRINTK("(itf %d) got RX service entry 0x%X for non-AAL5 "
- "vcc %d\n", lanai->number, (unsigned int) s, vci);
- lanai->stats.service_rxnotaal5++;
-- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
-+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
- return 0;
- }
- if (likely(!(s & (SERVICE_TRASH | SERVICE_STREAM | SERVICE_CRCERR)))) {
-@@ -1682,7 +1682,7 @@ static int handle_service(struct lanai_d
- int bytes;
- read_unlock(&vcc_sklist_lock);
- DPRINTK("got trashed rx pdu on vci %d\n", vci);
-- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
-+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
- lvcc->stats.x.aal5.service_trash++;
- bytes = (SERVICE_GET_END(s) * 16) -
- (((unsigned long) lvcc->rx.buf.ptr) -
-@@ -1694,7 +1694,7 @@ static int handle_service(struct lanai_d
- }
- if (s & SERVICE_STREAM) {
- read_unlock(&vcc_sklist_lock);
-- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
-+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
- lvcc->stats.x.aal5.service_stream++;
- printk(KERN_ERR DEV_LABEL "(itf %d): Got AAL5 stream "
- "PDU on VCI %d!\n", lanai->number, vci);
-@@ -1702,7 +1702,7 @@ static int handle_service(struct lanai_d
- return 0;
- }
- DPRINTK("got rx crc error on vci %d\n", vci);
-- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
-+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
- lvcc->stats.x.aal5.service_rxcrc++;
- lvcc->rx.buf.ptr = &lvcc->rx.buf.start[SERVICE_GET_END(s) * 4];
- cardvcc_write(lvcc, SERVICE_GET_END(s), vcc_rxreadptr);
-diff -urNp linux-2.6.32.45/drivers/atm/nicstar.c linux-2.6.32.45/drivers/atm/nicstar.c
---- linux-2.6.32.45/drivers/atm/nicstar.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/atm/nicstar.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1723,7 +1723,7 @@ static int ns_send(struct atm_vcc *vcc,
- if ((vc = (vc_map *) vcc->dev_data) == NULL)
- {
- printk("nicstar%d: vcc->dev_data == NULL on ns_send().\n", card->index);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- dev_kfree_skb_any(skb);
- return -EINVAL;
- }
-@@ -1731,7 +1731,7 @@ static int ns_send(struct atm_vcc *vcc,
- if (!vc->tx)
- {
- printk("nicstar%d: Trying to transmit on a non-tx VC.\n", card->index);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- dev_kfree_skb_any(skb);
- return -EINVAL;
- }
-@@ -1739,7 +1739,7 @@ static int ns_send(struct atm_vcc *vcc,
- if (vcc->qos.aal != ATM_AAL5 && vcc->qos.aal != ATM_AAL0)
- {
- printk("nicstar%d: Only AAL0 and AAL5 are supported.\n", card->index);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- dev_kfree_skb_any(skb);
- return -EINVAL;
- }
-@@ -1747,7 +1747,7 @@ static int ns_send(struct atm_vcc *vcc,
- if (skb_shinfo(skb)->nr_frags != 0)
- {
- printk("nicstar%d: No scatter-gather yet.\n", card->index);
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- dev_kfree_skb_any(skb);
- return -EINVAL;
- }
-@@ -1792,11 +1792,11 @@ static int ns_send(struct atm_vcc *vcc,
-
- if (push_scqe(card, vc, scq, &scqe, skb) != 0)
- {
-- atomic_inc(&vcc->stats->tx_err);
-+ atomic_inc_unchecked(&vcc->stats->tx_err);
- dev_kfree_skb_any(skb);
- return -EIO;
- }
-- atomic_inc(&vcc->stats->tx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
-
- return 0;
- }
-@@ -2111,14 +2111,14 @@ static void dequeue_rx(ns_dev *card, ns_
- {
- printk("nicstar%d: Can't allocate buffers for aal0.\n",
- card->index);
-- atomic_add(i,&vcc->stats->rx_drop);
-+ atomic_add_unchecked(i,&vcc->stats->rx_drop);
- break;
- }
- if (!atm_charge(vcc, sb->truesize))
- {
- RXPRINTK("nicstar%d: atm_charge() dropped aal0 packets.\n",
- card->index);
-- atomic_add(i-1,&vcc->stats->rx_drop); /* already increased by 1 */
-+ atomic_add_unchecked(i-1,&vcc->stats->rx_drop); /* already increased by 1 */
- dev_kfree_skb_any(sb);
- break;
- }
-@@ -2133,7 +2133,7 @@ static void dequeue_rx(ns_dev *card, ns_
- ATM_SKB(sb)->vcc = vcc;
- __net_timestamp(sb);
- vcc->push(vcc, sb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
- cell += ATM_CELL_PAYLOAD;
- }
-
-@@ -2152,7 +2152,7 @@ static void dequeue_rx(ns_dev *card, ns_
- if (iovb == NULL)
- {
- printk("nicstar%d: Out of iovec buffers.\n", card->index);
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- recycle_rx_buf(card, skb);
- return;
- }
-@@ -2182,7 +2182,7 @@ static void dequeue_rx(ns_dev *card, ns_
- else if (NS_SKB(iovb)->iovcnt >= NS_MAX_IOVECS)
- {
- printk("nicstar%d: received too big AAL5 SDU.\n", card->index);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data, NS_MAX_IOVECS);
- NS_SKB(iovb)->iovcnt = 0;
- iovb->len = 0;
-@@ -2202,7 +2202,7 @@ static void dequeue_rx(ns_dev *card, ns_
- printk("nicstar%d: Expected a small buffer, and this is not one.\n",
- card->index);
- which_list(card, skb);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- recycle_rx_buf(card, skb);
- vc->rx_iov = NULL;
- recycle_iov_buf(card, iovb);
-@@ -2216,7 +2216,7 @@ static void dequeue_rx(ns_dev *card, ns_
- printk("nicstar%d: Expected a large buffer, and this is not one.\n",
- card->index);
- which_list(card, skb);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
- NS_SKB(iovb)->iovcnt);
- vc->rx_iov = NULL;
-@@ -2240,7 +2240,7 @@ static void dequeue_rx(ns_dev *card, ns_
- printk(" - PDU size mismatch.\n");
- else
- printk(".\n");
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
- NS_SKB(iovb)->iovcnt);
- vc->rx_iov = NULL;
-@@ -2256,7 +2256,7 @@ static void dequeue_rx(ns_dev *card, ns_
- if (!atm_charge(vcc, skb->truesize))
- {
- push_rxbufs(card, skb);
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- }
- else
- {
-@@ -2268,7 +2268,7 @@ static void dequeue_rx(ns_dev *card, ns_
- ATM_SKB(skb)->vcc = vcc;
- __net_timestamp(skb);
- vcc->push(vcc, skb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
- }
- }
- else if (NS_SKB(iovb)->iovcnt == 2) /* One small plus one large buffer */
-@@ -2283,7 +2283,7 @@ static void dequeue_rx(ns_dev *card, ns_
- if (!atm_charge(vcc, sb->truesize))
- {
- push_rxbufs(card, sb);
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- }
- else
- {
-@@ -2295,7 +2295,7 @@ static void dequeue_rx(ns_dev *card, ns_
- ATM_SKB(sb)->vcc = vcc;
- __net_timestamp(sb);
- vcc->push(vcc, sb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
- }
-
- push_rxbufs(card, skb);
-@@ -2306,7 +2306,7 @@ static void dequeue_rx(ns_dev *card, ns_
- if (!atm_charge(vcc, skb->truesize))
- {
- push_rxbufs(card, skb);
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- }
- else
- {
-@@ -2320,7 +2320,7 @@ static void dequeue_rx(ns_dev *card, ns_
- ATM_SKB(skb)->vcc = vcc;
- __net_timestamp(skb);
- vcc->push(vcc, skb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
- }
-
- push_rxbufs(card, sb);
-@@ -2342,7 +2342,7 @@ static void dequeue_rx(ns_dev *card, ns_
- if (hb == NULL)
- {
- printk("nicstar%d: Out of huge buffers.\n", card->index);
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
- NS_SKB(iovb)->iovcnt);
- vc->rx_iov = NULL;
-@@ -2393,7 +2393,7 @@ static void dequeue_rx(ns_dev *card, ns_
- }
- else
- dev_kfree_skb_any(hb);
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- }
- else
- {
-@@ -2427,7 +2427,7 @@ static void dequeue_rx(ns_dev *card, ns_
- #endif /* NS_USE_DESTRUCTORS */
- __net_timestamp(hb);
- vcc->push(vcc, hb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
- }
- }
-
-diff -urNp linux-2.6.32.45/drivers/atm/solos-pci.c linux-2.6.32.45/drivers/atm/solos-pci.c
---- linux-2.6.32.45/drivers/atm/solos-pci.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.45/drivers/atm/solos-pci.c 2011-05-16 21:46:57.000000000 -0400
-@@ -708,7 +708,7 @@ void solos_bh(unsigned long card_arg)
- }
- atm_charge(vcc, skb->truesize);
- vcc->push(vcc, skb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
- break;
-
- case PKT_STATUS:
-@@ -914,6 +914,8 @@ static int print_buffer(struct sk_buff *
- char msg[500];
- char item[10];
-
-+ pax_track_stack();
-+
- len = buf->len;
- for (i = 0; i < len; i++){
- if(i % 8 == 0)
-@@ -1023,7 +1025,7 @@ static uint32_t fpga_tx(struct solos_car
- vcc = SKB_CB(oldskb)->vcc;
-
- if (vcc) {
-- atomic_inc(&vcc->stats->tx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
- solos_pop(vcc, oldskb);
- } else
- dev_kfree_skb_irq(oldskb);
-diff -urNp linux-2.6.32.45/drivers/atm/suni.c linux-2.6.32.45/drivers/atm/suni.c
---- linux-2.6.32.45/drivers/atm/suni.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/atm/suni.c 2011-04-17 15:56:46.000000000 -0400
-@@ -49,8 +49,8 @@ static DEFINE_SPINLOCK(sunis_lock);
-
-
- #define ADD_LIMITED(s,v) \
-- atomic_add((v),&stats->s); \
-- if (atomic_read(&stats->s) < 0) atomic_set(&stats->s,INT_MAX);
-+ atomic_add_unchecked((v),&stats->s); \
-+ if (atomic_read_unchecked(&stats->s) < 0) atomic_set_unchecked(&stats->s,INT_MAX);
-
-
- static void suni_hz(unsigned long from_timer)
-diff -urNp linux-2.6.32.45/drivers/atm/uPD98402.c linux-2.6.32.45/drivers/atm/uPD98402.c
---- linux-2.6.32.45/drivers/atm/uPD98402.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/atm/uPD98402.c 2011-04-17 15:56:46.000000000 -0400
-@@ -41,7 +41,7 @@ static int fetch_stats(struct atm_dev *d
- struct sonet_stats tmp;
- int error = 0;
-
-- atomic_add(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
-+ atomic_add_unchecked(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
- sonet_copy_stats(&PRIV(dev)->sonet_stats,&tmp);
- if (arg) error = copy_to_user(arg,&tmp,sizeof(tmp));
- if (zero && !error) {
-@@ -160,9 +160,9 @@ static int uPD98402_ioctl(struct atm_dev
-
-
- #define ADD_LIMITED(s,v) \
-- { atomic_add(GET(v),&PRIV(dev)->sonet_stats.s); \
-- if (atomic_read(&PRIV(dev)->sonet_stats.s) < 0) \
-- atomic_set(&PRIV(dev)->sonet_stats.s,INT_MAX); }
-+ { atomic_add_unchecked(GET(v),&PRIV(dev)->sonet_stats.s); \
-+ if (atomic_read_unchecked(&PRIV(dev)->sonet_stats.s) < 0) \
-+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.s,INT_MAX); }
-
-
- static void stat_event(struct atm_dev *dev)
-@@ -193,7 +193,7 @@ static void uPD98402_int(struct atm_dev
- if (reason & uPD98402_INT_PFM) stat_event(dev);
- if (reason & uPD98402_INT_PCO) {
- (void) GET(PCOCR); /* clear interrupt cause */
-- atomic_add(GET(HECCT),
-+ atomic_add_unchecked(GET(HECCT),
- &PRIV(dev)->sonet_stats.uncorr_hcs);
- }
- if ((reason & uPD98402_INT_RFO) &&
-@@ -221,9 +221,9 @@ static int uPD98402_start(struct atm_dev
- PUT(~(uPD98402_INT_PFM | uPD98402_INT_ALM | uPD98402_INT_RFO |
- uPD98402_INT_LOS),PIMR); /* enable them */
- (void) fetch_stats(dev,NULL,1); /* clear kernel counters */
-- atomic_set(&PRIV(dev)->sonet_stats.corr_hcs,-1);
-- atomic_set(&PRIV(dev)->sonet_stats.tx_cells,-1);
-- atomic_set(&PRIV(dev)->sonet_stats.rx_cells,-1);
-+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.corr_hcs,-1);
-+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.tx_cells,-1);
-+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.rx_cells,-1);
- return 0;
- }
-
-diff -urNp linux-2.6.32.45/drivers/atm/zatm.c linux-2.6.32.45/drivers/atm/zatm.c
---- linux-2.6.32.45/drivers/atm/zatm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/atm/zatm.c 2011-04-17 15:56:46.000000000 -0400
-@@ -458,7 +458,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
- }
- if (!size) {
- dev_kfree_skb_irq(skb);
-- if (vcc) atomic_inc(&vcc->stats->rx_err);
-+ if (vcc) atomic_inc_unchecked(&vcc->stats->rx_err);
- continue;
- }
- if (!atm_charge(vcc,skb->truesize)) {
-@@ -468,7 +468,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
- skb->len = size;
- ATM_SKB(skb)->vcc = vcc;
- vcc->push(vcc,skb);
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
- }
- zout(pos & 0xffff,MTA(mbx));
- #if 0 /* probably a stupid idea */
-@@ -732,7 +732,7 @@ if (*ZATM_PRV_DSC(skb) != (uPD98401_TXPD
- skb_queue_head(&zatm_vcc->backlog,skb);
- break;
- }
-- atomic_inc(&vcc->stats->tx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
- wake_up(&zatm_vcc->tx_wait);
- }
-
-diff -urNp linux-2.6.32.45/drivers/base/bus.c linux-2.6.32.45/drivers/base/bus.c
---- linux-2.6.32.45/drivers/base/bus.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/base/bus.c 2011-04-17 15:56:46.000000000 -0400
-@@ -70,7 +70,7 @@ static ssize_t drv_attr_store(struct kob
- return ret;
- }
-
--static struct sysfs_ops driver_sysfs_ops = {
-+static const struct sysfs_ops driver_sysfs_ops = {
- .show = drv_attr_show,
- .store = drv_attr_store,
- };
-@@ -115,7 +115,7 @@ static ssize_t bus_attr_store(struct kob
- return ret;
- }
-
--static struct sysfs_ops bus_sysfs_ops = {
-+static const struct sysfs_ops bus_sysfs_ops = {
- .show = bus_attr_show,
- .store = bus_attr_store,
- };
-@@ -154,7 +154,7 @@ static int bus_uevent_filter(struct kset
- return 0;
- }
-
--static struct kset_uevent_ops bus_uevent_ops = {
-+static const struct kset_uevent_ops bus_uevent_ops = {
- .filter = bus_uevent_filter,
- };
-
-diff -urNp linux-2.6.32.45/drivers/base/class.c linux-2.6.32.45/drivers/base/class.c
---- linux-2.6.32.45/drivers/base/class.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/base/class.c 2011-04-17 15:56:46.000000000 -0400
-@@ -63,7 +63,7 @@ static void class_release(struct kobject
- kfree(cp);
- }
-
--static struct sysfs_ops class_sysfs_ops = {
-+static const struct sysfs_ops class_sysfs_ops = {
- .show = class_attr_show,
- .store = class_attr_store,
- };
-diff -urNp linux-2.6.32.45/drivers/base/core.c linux-2.6.32.45/drivers/base/core.c
---- linux-2.6.32.45/drivers/base/core.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/base/core.c 2011-04-17 15:56:46.000000000 -0400
-@@ -100,7 +100,7 @@ static ssize_t dev_attr_store(struct kob
- return ret;
- }
-
--static struct sysfs_ops dev_sysfs_ops = {
-+static const struct sysfs_ops dev_sysfs_ops = {
- .show = dev_attr_show,
- .store = dev_attr_store,
- };
-@@ -252,7 +252,7 @@ static int dev_uevent(struct kset *kset,
- return retval;
- }
-
--static struct kset_uevent_ops device_uevent_ops = {
-+static const struct kset_uevent_ops device_uevent_ops = {
- .filter = dev_uevent_filter,
- .name = dev_uevent_name,
- .uevent = dev_uevent,
-diff -urNp linux-2.6.32.45/drivers/base/memory.c linux-2.6.32.45/drivers/base/memory.c
---- linux-2.6.32.45/drivers/base/memory.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/base/memory.c 2011-04-17 15:56:46.000000000 -0400
-@@ -44,7 +44,7 @@ static int memory_uevent(struct kset *ks
- return retval;
- }
-
--static struct kset_uevent_ops memory_uevent_ops = {
-+static const struct kset_uevent_ops memory_uevent_ops = {
- .name = memory_uevent_name,
- .uevent = memory_uevent,
- };
-diff -urNp linux-2.6.32.45/drivers/base/sys.c linux-2.6.32.45/drivers/base/sys.c
---- linux-2.6.32.45/drivers/base/sys.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/base/sys.c 2011-04-17 15:56:46.000000000 -0400
-@@ -54,7 +54,7 @@ sysdev_store(struct kobject *kobj, struc
- return -EIO;
- }
-
--static struct sysfs_ops sysfs_ops = {
-+static const struct sysfs_ops sysfs_ops = {
- .show = sysdev_show,
- .store = sysdev_store,
- };
-@@ -104,7 +104,7 @@ static ssize_t sysdev_class_store(struct
- return -EIO;
- }
-
--static struct sysfs_ops sysfs_class_ops = {
-+static const struct sysfs_ops sysfs_class_ops = {
- .show = sysdev_class_show,
- .store = sysdev_class_store,
- };
-diff -urNp linux-2.6.32.45/drivers/block/cciss.c linux-2.6.32.45/drivers/block/cciss.c
---- linux-2.6.32.45/drivers/block/cciss.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/block/cciss.c 2011-08-05 20:33:55.000000000 -0400
-@@ -1011,6 +1011,8 @@ static int cciss_ioctl32_passthru(struct
- int err;
- u32 cp;
-
-+ memset(&arg64, 0, sizeof(arg64));
-+
- err = 0;
- err |=
- copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
-@@ -2852,7 +2854,7 @@ static unsigned long pollcomplete(int ct
- /* Wait (up to 20 seconds) for a command to complete */
-
- for (i = 20 * HZ; i > 0; i--) {
-- done = hba[ctlr]->access.command_completed(hba[ctlr]);
-+ done = hba[ctlr]->access->command_completed(hba[ctlr]);
- if (done == FIFO_EMPTY)
- schedule_timeout_uninterruptible(1);
- else
-@@ -2876,7 +2878,7 @@ static int sendcmd_core(ctlr_info_t *h,
- resend_cmd1:
-
- /* Disable interrupt on the board. */
-- h->access.set_intr_mask(h, CCISS_INTR_OFF);
-+ h->access->set_intr_mask(h, CCISS_INTR_OFF);
-
- /* Make sure there is room in the command FIFO */
- /* Actually it should be completely empty at this time */
-@@ -2884,13 +2886,13 @@ resend_cmd1:
- /* tape side of the driver. */
- for (i = 200000; i > 0; i--) {
- /* if fifo isn't full go */
-- if (!(h->access.fifo_full(h)))
-+ if (!(h->access->fifo_full(h)))
- break;
- udelay(10);
- printk(KERN_WARNING "cciss cciss%d: SendCmd FIFO full,"
- " waiting!\n", h->ctlr);
- }
-- h->access.submit_command(h, c); /* Send the cmd */
-+ h->access->submit_command(h, c); /* Send the cmd */
- do {
- complete = pollcomplete(h->ctlr);
-
-@@ -3023,7 +3025,7 @@ static void start_io(ctlr_info_t *h)
- while (!hlist_empty(&h->reqQ)) {
- c = hlist_entry(h->reqQ.first, CommandList_struct, list);
- /* can't do anything if fifo is full */
-- if ((h->access.fifo_full(h))) {
-+ if ((h->access->fifo_full(h))) {
- printk(KERN_WARNING "cciss: fifo full\n");
- break;
- }
-@@ -3033,7 +3035,7 @@ static void start_io(ctlr_info_t *h)
- h->Qdepth--;
-
- /* Tell the controller execute command */
-- h->access.submit_command(h, c);
-+ h->access->submit_command(h, c);
-
- /* Put job onto the completed Q */
- addQ(&h->cmpQ, c);
-@@ -3393,17 +3395,17 @@ startio:
-
- static inline unsigned long get_next_completion(ctlr_info_t *h)
- {
-- return h->access.command_completed(h);
-+ return h->access->command_completed(h);
- }
-
- static inline int interrupt_pending(ctlr_info_t *h)
- {
-- return h->access.intr_pending(h);
-+ return h->access->intr_pending(h);
- }
-
- static inline long interrupt_not_for_us(ctlr_info_t *h)
- {
-- return (((h->access.intr_pending(h) == 0) ||
-+ return (((h->access->intr_pending(h) == 0) ||
- (h->interrupts_enabled == 0)));
- }
-
-@@ -3892,7 +3894,7 @@ static int __devinit cciss_pci_init(ctlr
- */
- c->max_commands = readl(&(c->cfgtable->CmdsOutMax));
- c->product_name = products[prod_index].product_name;
-- c->access = *(products[prod_index].access);
-+ c->access = products[prod_index].access;
- c->nr_cmds = c->max_commands - 4;
- if ((readb(&c->cfgtable->Signature[0]) != 'C') ||
- (readb(&c->cfgtable->Signature[1]) != 'I') ||
-@@ -4291,7 +4293,7 @@ static int __devinit cciss_init_one(stru
- }
-
- /* make sure the board interrupts are off */
-- hba[i]->access.set_intr_mask(hba[i], CCISS_INTR_OFF);
-+ hba[i]->access->set_intr_mask(hba[i], CCISS_INTR_OFF);
- if (request_irq(hba[i]->intr[SIMPLE_MODE_INT], do_cciss_intr,
- IRQF_DISABLED | IRQF_SHARED, hba[i]->devname, hba[i])) {
- printk(KERN_ERR "cciss: Unable to get irq %d for %s\n",
-@@ -4341,7 +4343,7 @@ static int __devinit cciss_init_one(stru
- cciss_scsi_setup(i);
-
- /* Turn the interrupts on so we can service requests */
-- hba[i]->access.set_intr_mask(hba[i], CCISS_INTR_ON);
-+ hba[i]->access->set_intr_mask(hba[i], CCISS_INTR_ON);
-
- /* Get the firmware version */
- inq_buff = kzalloc(sizeof(InquiryData_struct), GFP_KERNEL);
-diff -urNp linux-2.6.32.45/drivers/block/cciss.h linux-2.6.32.45/drivers/block/cciss.h
---- linux-2.6.32.45/drivers/block/cciss.h 2011-08-09 18:35:28.000000000 -0400
-+++ linux-2.6.32.45/drivers/block/cciss.h 2011-08-09 18:33:59.000000000 -0400
-@@ -90,7 +90,7 @@ struct ctlr_info
- // information about each logical volume
- drive_info_struct *drv[CISS_MAX_LUN];
-
-- struct access_method access;
-+ struct access_method *access;
-
- /* queue and queue Info */
- struct hlist_head reqQ;
-diff -urNp linux-2.6.32.45/drivers/block/cpqarray.c linux-2.6.32.45/drivers/block/cpqarray.c
---- linux-2.6.32.45/drivers/block/cpqarray.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/block/cpqarray.c 2011-08-05 20:33:55.000000000 -0400
-@@ -402,7 +402,7 @@ static int __init cpqarray_register_ctlr
- if (register_blkdev(COMPAQ_SMART2_MAJOR+i, hba[i]->devname)) {
- goto Enomem4;
- }
-- hba[i]->access.set_intr_mask(hba[i], 0);
-+ hba[i]->access->set_intr_mask(hba[i], 0);
- if (request_irq(hba[i]->intr, do_ida_intr,
- IRQF_DISABLED|IRQF_SHARED, hba[i]->devname, hba[i]))
- {
-@@ -460,7 +460,7 @@ static int __init cpqarray_register_ctlr
- add_timer(&hba[i]->timer);
-
- /* Enable IRQ now that spinlock and rate limit timer are set up */
-- hba[i]->access.set_intr_mask(hba[i], FIFO_NOT_EMPTY);
-+ hba[i]->access->set_intr_mask(hba[i], FIFO_NOT_EMPTY);
-
- for(j=0; j<NWD; j++) {
- struct gendisk *disk = ida_gendisk[i][j];
-@@ -695,7 +695,7 @@ DBGINFO(
- for(i=0; i<NR_PRODUCTS; i++) {
- if (board_id == products[i].board_id) {
- c->product_name = products[i].product_name;
-- c->access = *(products[i].access);
-+ c->access = products[i].access;
- break;
- }
- }
-@@ -793,7 +793,7 @@ static int __init cpqarray_eisa_detect(v
- hba[ctlr]->intr = intr;
- sprintf(hba[ctlr]->devname, "ida%d", nr_ctlr);
- hba[ctlr]->product_name = products[j].product_name;
-- hba[ctlr]->access = *(products[j].access);
-+ hba[ctlr]->access = products[j].access;
- hba[ctlr]->ctlr = ctlr;
- hba[ctlr]->board_id = board_id;
- hba[ctlr]->pci_dev = NULL; /* not PCI */
-@@ -896,6 +896,8 @@ static void do_ida_request(struct reques
- struct scatterlist tmp_sg[SG_MAX];
- int i, dir, seg;
-
-+ pax_track_stack();
-+
- if (blk_queue_plugged(q))
- goto startio;
-
-@@ -968,7 +970,7 @@ static void start_io(ctlr_info_t *h)
-
- while((c = h->reqQ) != NULL) {
- /* Can't do anything if we're busy */
-- if (h->access.fifo_full(h) == 0)
-+ if (h->access->fifo_full(h) == 0)
- return;
-
- /* Get the first entry from the request Q */
-@@ -976,7 +978,7 @@ static void start_io(ctlr_info_t *h)
- h->Qdepth--;
-
- /* Tell the controller to do our bidding */
-- h->access.submit_command(h, c);
-+ h->access->submit_command(h, c);
-
- /* Get onto the completion Q */
- addQ(&h->cmpQ, c);
-@@ -1038,7 +1040,7 @@ static irqreturn_t do_ida_intr(int irq,
- unsigned long flags;
- __u32 a,a1;
-
-- istat = h->access.intr_pending(h);
-+ istat = h->access->intr_pending(h);
- /* Is this interrupt for us? */
- if (istat == 0)
- return IRQ_NONE;
-@@ -1049,7 +1051,7 @@ static irqreturn_t do_ida_intr(int irq,
- */
- spin_lock_irqsave(IDA_LOCK(h->ctlr), flags);
- if (istat & FIFO_NOT_EMPTY) {
-- while((a = h->access.command_completed(h))) {
-+ while((a = h->access->command_completed(h))) {
- a1 = a; a &= ~3;
- if ((c = h->cmpQ) == NULL)
- {
-@@ -1434,11 +1436,11 @@ static int sendcmd(
- /*
- * Disable interrupt
- */
-- info_p->access.set_intr_mask(info_p, 0);
-+ info_p->access->set_intr_mask(info_p, 0);
- /* Make sure there is room in the command FIFO */
- /* Actually it should be completely empty at this time. */
- for (i = 200000; i > 0; i--) {
-- temp = info_p->access.fifo_full(info_p);
-+ temp = info_p->access->fifo_full(info_p);
- if (temp != 0) {
- break;
- }
-@@ -1451,7 +1453,7 @@ DBG(
- /*
- * Send the cmd
- */
-- info_p->access.submit_command(info_p, c);
-+ info_p->access->submit_command(info_p, c);
- complete = pollcomplete(ctlr);
-
- pci_unmap_single(info_p->pci_dev, (dma_addr_t) c->req.sg[0].addr,
-@@ -1534,9 +1536,9 @@ static int revalidate_allvol(ctlr_info_t
- * we check the new geometry. Then turn interrupts back on when
- * we're done.
- */
-- host->access.set_intr_mask(host, 0);
-+ host->access->set_intr_mask(host, 0);
- getgeometry(ctlr);
-- host->access.set_intr_mask(host, FIFO_NOT_EMPTY);
-+ host->access->set_intr_mask(host, FIFO_NOT_EMPTY);
-
- for(i=0; i<NWD; i++) {
- struct gendisk *disk = ida_gendisk[ctlr][i];
-@@ -1576,7 +1578,7 @@ static int pollcomplete(int ctlr)
- /* Wait (up to 2 seconds) for a command to complete */
-
- for (i = 200000; i > 0; i--) {
-- done = hba[ctlr]->access.command_completed(hba[ctlr]);
-+ done = hba[ctlr]->access->command_completed(hba[ctlr]);
- if (done == 0) {
- udelay(10); /* a short fixed delay */
- } else
-diff -urNp linux-2.6.32.45/drivers/block/cpqarray.h linux-2.6.32.45/drivers/block/cpqarray.h
---- linux-2.6.32.45/drivers/block/cpqarray.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/block/cpqarray.h 2011-08-05 20:33:55.000000000 -0400
-@@ -99,7 +99,7 @@ struct ctlr_info {
- drv_info_t drv[NWD];
- struct proc_dir_entry *proc;
-
-- struct access_method access;
-+ struct access_method *access;
-
- cmdlist_t *reqQ;
- cmdlist_t *cmpQ;
-diff -urNp linux-2.6.32.45/drivers/block/DAC960.c linux-2.6.32.45/drivers/block/DAC960.c
---- linux-2.6.32.45/drivers/block/DAC960.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/block/DAC960.c 2011-05-16 21:46:57.000000000 -0400
-@@ -1973,6 +1973,8 @@ static bool DAC960_V1_ReadDeviceConfigur
- unsigned long flags;
- int Channel, TargetID;
-
-+ pax_track_stack();
-+
- if (!init_dma_loaf(Controller->PCIDevice, &local_dma,
- DAC960_V1_MaxChannels*(sizeof(DAC960_V1_DCDB_T) +
- sizeof(DAC960_SCSI_Inquiry_T) +
-diff -urNp linux-2.6.32.45/drivers/block/nbd.c linux-2.6.32.45/drivers/block/nbd.c
---- linux-2.6.32.45/drivers/block/nbd.c 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.45/drivers/block/nbd.c 2011-06-25 12:56:37.000000000 -0400
-@@ -155,6 +155,8 @@ static int sock_xmit(struct nbd_device *
- struct kvec iov;
- sigset_t blocked, oldset;
-
-+ pax_track_stack();
-+
- if (unlikely(!sock)) {
- printk(KERN_ERR "%s: Attempted %s on closed socket in sock_xmit\n",
- lo->disk->disk_name, (send ? "send" : "recv"));
-@@ -569,6 +571,8 @@ static void do_nbd_request(struct reques
- static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *lo,
- unsigned int cmd, unsigned long arg)
- {
-+ pax_track_stack();
-+
- switch (cmd) {
- case NBD_DISCONNECT: {
- struct request sreq;
-diff -urNp linux-2.6.32.45/drivers/block/pktcdvd.c linux-2.6.32.45/drivers/block/pktcdvd.c
---- linux-2.6.32.45/drivers/block/pktcdvd.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/block/pktcdvd.c 2011-04-17 15:56:46.000000000 -0400
-@@ -284,7 +284,7 @@ static ssize_t kobj_pkt_store(struct kob
- return len;
- }
-
--static struct sysfs_ops kobj_pkt_ops = {
-+static const struct sysfs_ops kobj_pkt_ops = {
- .show = kobj_pkt_show,
- .store = kobj_pkt_store
- };
-diff -urNp linux-2.6.32.45/drivers/char/agp/frontend.c linux-2.6.32.45/drivers/char/agp/frontend.c
---- linux-2.6.32.45/drivers/char/agp/frontend.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/char/agp/frontend.c 2011-04-17 15:56:46.000000000 -0400
-@@ -824,7 +824,7 @@ static int agpioc_reserve_wrap(struct ag
- if (copy_from_user(&reserve, arg, sizeof(struct agp_region)))
- return -EFAULT;
-
-- if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment))
-+ if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment_priv))
- return -EFAULT;
-
- client = agp_find_client_by_pid(reserve.pid);
-diff -urNp linux-2.6.32.45/drivers/char/briq_panel.c linux-2.6.32.45/drivers/char/briq_panel.c
---- linux-2.6.32.45/drivers/char/briq_panel.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/char/briq_panel.c 2011-04-18 19:48:57.000000000 -0400
-@@ -10,6 +10,7 @@
- #include <linux/types.h>
- #include <linux/errno.h>
- #include <linux/tty.h>
-+#include <linux/mutex.h>
- #include <linux/timer.h>
- #include <linux/kernel.h>
- #include <linux/wait.h>
-@@ -36,6 +37,7 @@ static int vfd_is_open;
- static unsigned char vfd[40];
- static int vfd_cursor;
- static unsigned char ledpb, led;
-+static DEFINE_MUTEX(vfd_mutex);
-
- static void update_vfd(void)
- {
-@@ -142,12 +144,15 @@ static ssize_t briq_panel_write(struct f
- if (!vfd_is_open)
- return -EBUSY;
-
-+ mutex_lock(&vfd_mutex);
- for (;;) {
- char c;
- if (!indx)
- break;
-- if (get_user(c, buf))
-+ if (get_user(c, buf)) {
-+ mutex_unlock(&vfd_mutex);
- return -EFAULT;
-+ }
- if (esc) {
- set_led(c);
- esc = 0;
-@@ -177,6 +182,7 @@ static ssize_t briq_panel_write(struct f
- buf++;
- }
- update_vfd();
-+ mutex_unlock(&vfd_mutex);
-
- return len;
- }
-diff -urNp linux-2.6.32.45/drivers/char/genrtc.c linux-2.6.32.45/drivers/char/genrtc.c
---- linux-2.6.32.45/drivers/char/genrtc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/char/genrtc.c 2011-04-18 19:45:42.000000000 -0400
-@@ -272,6 +272,7 @@ static int gen_rtc_ioctl(struct inode *i
- switch (cmd) {
-
- case RTC_PLL_GET:
-+ memset(&pll, 0, sizeof(pll));
- if (get_rtc_pll(&pll))
- return -EINVAL;
- else
-diff -urNp linux-2.6.32.45/drivers/char/hpet.c linux-2.6.32.45/drivers/char/hpet.c
---- linux-2.6.32.45/drivers/char/hpet.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/char/hpet.c 2011-04-23 12:56:11.000000000 -0400
-@@ -430,7 +430,7 @@ static int hpet_release(struct inode *in
- return 0;
- }
-
--static int hpet_ioctl_common(struct hpet_dev *, int, unsigned long, int);
-+static int hpet_ioctl_common(struct hpet_dev *, unsigned int, unsigned long, int);
-
- static int
- hpet_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
-@@ -565,7 +565,7 @@ static inline unsigned long hpet_time_di
- }
-
- static int
--hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg, int kernel)
-+hpet_ioctl_common(struct hpet_dev *devp, unsigned int cmd, unsigned long arg, int kernel)
- {
- struct hpet_timer __iomem *timer;
- struct hpet __iomem *hpet;
-@@ -608,11 +608,11 @@ hpet_ioctl_common(struct hpet_dev *devp,
- {
- struct hpet_info info;
-
-+ memset(&info, 0, sizeof(info));
-+
- if (devp->hd_ireqfreq)
- info.hi_ireqfreq =
- hpet_time_div(hpetp, devp->hd_ireqfreq);
-- else
-- info.hi_ireqfreq = 0;
- info.hi_flags =
- readq(&timer->hpet_config) & Tn_PER_INT_CAP_MASK;
- info.hi_hpet = hpetp->hp_which;
-diff -urNp linux-2.6.32.45/drivers/char/hvc_beat.c linux-2.6.32.45/drivers/char/hvc_beat.c
---- linux-2.6.32.45/drivers/char/hvc_beat.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/char/hvc_beat.c 2011-04-17 15:56:46.000000000 -0400
-@@ -84,7 +84,7 @@ static int hvc_beat_put_chars(uint32_t v
- return cnt;
- }
-
--static struct hv_ops hvc_beat_get_put_ops = {
-+static const struct hv_ops hvc_beat_get_put_ops = {
- .get_chars = hvc_beat_get_chars,
- .put_chars = hvc_beat_put_chars,
- };
-diff -urNp linux-2.6.32.45/drivers/char/hvc_console.c linux-2.6.32.45/drivers/char/hvc_console.c
---- linux-2.6.32.45/drivers/char/hvc_console.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/char/hvc_console.c 2011-04-17 15:56:46.000000000 -0400
-@@ -125,7 +125,7 @@ static struct hvc_struct *hvc_get_by_ind
- * console interfaces but can still be used as a tty device. This has to be
- * static because kmalloc will not work during early console init.
- */
--static struct hv_ops *cons_ops[MAX_NR_HVC_CONSOLES];
-+static const struct hv_ops *cons_ops[MAX_NR_HVC_CONSOLES];
- static uint32_t vtermnos[MAX_NR_HVC_CONSOLES] =
- {[0 ... MAX_NR_HVC_CONSOLES - 1] = -1};
-
-@@ -247,7 +247,7 @@ static void destroy_hvc_struct(struct kr
- * vty adapters do NOT get an hvc_instantiate() callback since they
- * appear after early console init.
- */
--int hvc_instantiate(uint32_t vtermno, int index, struct hv_ops *ops)
-+int hvc_instantiate(uint32_t vtermno, int index, const struct hv_ops *ops)
- {
- struct hvc_struct *hp;
-
-@@ -756,7 +756,7 @@ static const struct tty_operations hvc_o
- };
-
- struct hvc_struct __devinit *hvc_alloc(uint32_t vtermno, int data,
-- struct hv_ops *ops, int outbuf_size)
-+ const struct hv_ops *ops, int outbuf_size)
- {
- struct hvc_struct *hp;
- int i;
-diff -urNp linux-2.6.32.45/drivers/char/hvc_console.h linux-2.6.32.45/drivers/char/hvc_console.h
---- linux-2.6.32.45/drivers/char/hvc_console.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/char/hvc_console.h 2011-04-17 15:56:46.000000000 -0400
-@@ -55,7 +55,7 @@ struct hvc_struct {
- int outbuf_size;
- int n_outbuf;
- uint32_t vtermno;
-- struct hv_ops *ops;
-+ const struct hv_ops *ops;
- int irq_requested;
- int data;
- struct winsize ws;
-@@ -76,11 +76,11 @@ struct hv_ops {
- };
-
- /* Register a vterm and a slot index for use as a console (console_init) */
--extern int hvc_instantiate(uint32_t vtermno, int index, struct hv_ops *ops);
-+extern int hvc_instantiate(uint32_t vtermno, int index, const struct hv_ops *ops);
-
- /* register a vterm for hvc tty operation (module_init or hotplug add) */
- extern struct hvc_struct * __devinit hvc_alloc(uint32_t vtermno, int data,
-- struct hv_ops *ops, int outbuf_size);
-+ const struct hv_ops *ops, int outbuf_size);
- /* remove a vterm from hvc tty operation (module_exit or hotplug remove) */
- extern int hvc_remove(struct hvc_struct *hp);
-
-diff -urNp linux-2.6.32.45/drivers/char/hvc_iseries.c linux-2.6.32.45/drivers/char/hvc_iseries.c
---- linux-2.6.32.45/drivers/char/hvc_iseries.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/char/hvc_iseries.c 2011-04-17 15:56:46.000000000 -0400
-@@ -197,7 +197,7 @@ done:
- return sent;
- }
-
--static struct hv_ops hvc_get_put_ops = {
-+static const struct hv_ops hvc_get_put_ops = {
- .get_chars = get_chars,
- .put_chars = put_chars,
- .notifier_add = notifier_add_irq,
-diff -urNp linux-2.6.32.45/drivers/char/hvc_iucv.c linux-2.6.32.45/drivers/char/hvc_iucv.c
---- linux-2.6.32.45/drivers/char/hvc_iucv.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/char/hvc_iucv.c 2011-04-17 15:56:46.000000000 -0400
-@@ -924,7 +924,7 @@ static int hvc_iucv_pm_restore_thaw(stru
-
-
- /* HVC operations */
--static struct hv_ops hvc_iucv_ops = {
-+static const struct hv_ops hvc_iucv_ops = {
- .get_chars = hvc_iucv_get_chars,
- .put_chars = hvc_iucv_put_chars,
- .notifier_add = hvc_iucv_notifier_add,
-diff -urNp linux-2.6.32.45/drivers/char/hvc_rtas.c linux-2.6.32.45/drivers/char/hvc_rtas.c
---- linux-2.6.32.45/drivers/char/hvc_rtas.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/char/hvc_rtas.c 2011-04-17 15:56:46.000000000 -0400
-@@ -71,7 +71,7 @@ static int hvc_rtas_read_console(uint32_
- return i;
- }
-
--static struct hv_ops hvc_rtas_get_put_ops = {
-+static const struct hv_ops hvc_rtas_get_put_ops = {
- .get_chars = hvc_rtas_read_console,
- .put_chars = hvc_rtas_write_console,
- };
-diff -urNp linux-2.6.32.45/drivers/char/hvcs.c linux-2.6.32.45/drivers/char/hvcs.c
---- linux-2.6.32.45/drivers/char/hvcs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/char/hvcs.c 2011-04-17 15:56:46.000000000 -0400
-@@ -82,6 +82,7 @@
- #include <asm/hvcserver.h>
- #include <asm/uaccess.h>
- #include <asm/vio.h>
-+#include <asm/local.h>
-
- /*
- * 1.3.0 -> 1.3.1 In hvcs_open memset(..,0x00,..) instead of memset(..,0x3F,00).
-@@ -269,7 +270,7 @@ struct hvcs_struct {
- unsigned int index;
-
- struct tty_struct *tty;
-- int open_count;
-+ local_t open_count;
-
- /*
- * Used to tell the driver kernel_thread what operations need to take
-@@ -419,7 +420,7 @@ static ssize_t hvcs_vterm_state_store(st
-
- spin_lock_irqsave(&hvcsd->lock, flags);
-
-- if (hvcsd->open_count > 0) {
-+ if (local_read(&hvcsd->open_count) > 0) {
- spin_unlock_irqrestore(&hvcsd->lock, flags);
- printk(KERN_INFO "HVCS: vterm state unchanged. "
- "The hvcs device node is still in use.\n");
-@@ -1135,7 +1136,7 @@ static int hvcs_open(struct tty_struct *
- if ((retval = hvcs_partner_connect(hvcsd)))
- goto error_release;
-
-- hvcsd->open_count = 1;
-+ local_set(&hvcsd->open_count, 1);
- hvcsd->tty = tty;
- tty->driver_data = hvcsd;
-
-@@ -1169,7 +1170,7 @@ fast_open:
-
- spin_lock_irqsave(&hvcsd->lock, flags);
- kref_get(&hvcsd->kref);
-- hvcsd->open_count++;
-+ local_inc(&hvcsd->open_count);
- hvcsd->todo_mask |= HVCS_SCHED_READ;
- spin_unlock_irqrestore(&hvcsd->lock, flags);
-
-@@ -1213,7 +1214,7 @@ static void hvcs_close(struct tty_struct
- hvcsd = tty->driver_data;
-
- spin_lock_irqsave(&hvcsd->lock, flags);
-- if (--hvcsd->open_count == 0) {
-+ if (local_dec_and_test(&hvcsd->open_count)) {
-
- vio_disable_interrupts(hvcsd->vdev);
-
-@@ -1239,10 +1240,10 @@ static void hvcs_close(struct tty_struct
- free_irq(irq, hvcsd);
- kref_put(&hvcsd->kref, destroy_hvcs_struct);
- return;
-- } else if (hvcsd->open_count < 0) {
-+ } else if (local_read(&hvcsd->open_count) < 0) {
- printk(KERN_ERR "HVCS: vty-server@%X open_count: %d"
- " is missmanaged.\n",
-- hvcsd->vdev->unit_address, hvcsd->open_count);
-+ hvcsd->vdev->unit_address, local_read(&hvcsd->open_count));
- }
-
- spin_unlock_irqrestore(&hvcsd->lock, flags);
-@@ -1258,7 +1259,7 @@ static void hvcs_hangup(struct tty_struc
-
- spin_lock_irqsave(&hvcsd->lock, flags);
- /* Preserve this so that we know how many kref refs to put */
-- temp_open_count = hvcsd->open_count;
-+ temp_open_count = local_read(&hvcsd->open_count);
-
- /*
- * Don't kref put inside the spinlock because the destruction
-@@ -1273,7 +1274,7 @@ static void hvcs_hangup(struct tty_struc
- hvcsd->tty->driver_data = NULL;
- hvcsd->tty = NULL;
-
-- hvcsd->open_count = 0;
-+ local_set(&hvcsd->open_count, 0);
-
- /* This will drop any buffered data on the floor which is OK in a hangup
- * scenario. */
-@@ -1344,7 +1345,7 @@ static int hvcs_write(struct tty_struct
- * the middle of a write operation? This is a crummy place to do this
- * but we want to keep it all in the spinlock.
- */
-- if (hvcsd->open_count <= 0) {
-+ if (local_read(&hvcsd->open_count) <= 0) {
- spin_unlock_irqrestore(&hvcsd->lock, flags);
- return -ENODEV;
- }
-@@ -1418,7 +1419,7 @@ static int hvcs_write_room(struct tty_st
- {
- struct hvcs_struct *hvcsd = tty->driver_data;
-
-- if (!hvcsd || hvcsd->open_count <= 0)
-+ if (!hvcsd || local_read(&hvcsd->open_count) <= 0)
- return 0;
-
- return HVCS_BUFF_LEN - hvcsd->chars_in_buffer;
-diff -urNp linux-2.6.32.45/drivers/char/hvc_udbg.c linux-2.6.32.45/drivers/char/hvc_udbg.c
---- linux-2.6.32.45/drivers/char/hvc_udbg.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/char/hvc_udbg.c 2011-04-17 15:56:46.000000000 -0400
-@@ -58,7 +58,7 @@ static int hvc_udbg_get(uint32_t vtermno
- return i;
- }
-
--static struct hv_ops hvc_udbg_ops = {
-+static const struct hv_ops hvc_udbg_ops = {
- .get_chars = hvc_udbg_get,
- .put_chars = hvc_udbg_put,
- };
-diff -urNp linux-2.6.32.45/drivers/char/hvc_vio.c linux-2.6.32.45/drivers/char/hvc_vio.c
---- linux-2.6.32.45/drivers/char/hvc_vio.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/char/hvc_vio.c 2011-04-17 15:56:46.000000000 -0400
-@@ -77,7 +77,7 @@ static int filtered_get_chars(uint32_t v
- return got;
- }
-
--static struct hv_ops hvc_get_put_ops = {
-+static const struct hv_ops hvc_get_put_ops = {
- .get_chars = filtered_get_chars,
- .put_chars = hvc_put_chars,
- .notifier_add = notifier_add_irq,
-diff -urNp linux-2.6.32.45/drivers/char/hvc_xen.c linux-2.6.32.45/drivers/char/hvc_xen.c
---- linux-2.6.32.45/drivers/char/hvc_xen.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/char/hvc_xen.c 2011-04-17 15:56:46.000000000 -0400
-@@ -120,7 +120,7 @@ static int read_console(uint32_t vtermno
- return recv;
- }
-
--static struct hv_ops hvc_ops = {
-+static const struct hv_ops hvc_ops = {
- .get_chars = read_console,
- .put_chars = write_console,
- .notifier_add = notifier_add_irq,
-diff -urNp linux-2.6.32.45/drivers/char/ipmi/ipmi_msghandler.c linux-2.6.32.45/drivers/char/ipmi/ipmi_msghandler.c
---- linux-2.6.32.45/drivers/char/ipmi/ipmi_msghandler.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/char/ipmi/ipmi_msghandler.c 2011-05-16 21:46:57.000000000 -0400
-@@ -414,7 +414,7 @@ struct ipmi_smi {
- struct proc_dir_entry *proc_dir;
- char proc_dir_name[10];
-
-- atomic_t stats[IPMI_NUM_STATS];
-+ atomic_unchecked_t stats[IPMI_NUM_STATS];
-
- /*
- * run_to_completion duplicate of smb_info, smi_info
-@@ -447,9 +447,9 @@ static DEFINE_MUTEX(smi_watchers_mutex);
-
-
- #define ipmi_inc_stat(intf, stat) \
-- atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
-+ atomic_inc_unchecked(&(intf)->stats[IPMI_STAT_ ## stat])
- #define ipmi_get_stat(intf, stat) \
-- ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
-+ ((unsigned int) atomic_read_unchecked(&(intf)->stats[IPMI_STAT_ ## stat]))
-
- static int is_lan_addr(struct ipmi_addr *addr)
- {
-@@ -2808,7 +2808,7 @@ int ipmi_register_smi(struct ipmi_smi_ha
- INIT_LIST_HEAD(&intf->cmd_rcvrs);
- init_waitqueue_head(&intf->waitq);
- for (i = 0; i < IPMI_NUM_STATS; i++)
-- atomic_set(&intf->stats[i], 0);
-+ atomic_set_unchecked(&intf->stats[i], 0);
-
- intf->proc_dir = NULL;
-
-@@ -4160,6 +4160,8 @@ static void send_panic_events(char *str)
- struct ipmi_smi_msg smi_msg;
- struct ipmi_recv_msg recv_msg;
-
-+ pax_track_stack();
-+
- si = (struct ipmi_system_interface_addr *) &addr;
- si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
- si->channel = IPMI_BMC_CHANNEL;
-diff -urNp linux-2.6.32.45/drivers/char/ipmi/ipmi_si_intf.c linux-2.6.32.45/drivers/char/ipmi/ipmi_si_intf.c
---- linux-2.6.32.45/drivers/char/ipmi/ipmi_si_intf.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/char/ipmi/ipmi_si_intf.c 2011-04-17 15:56:46.000000000 -0400
-@@ -277,7 +277,7 @@ struct smi_info {
- unsigned char slave_addr;
-
- /* Counters and things for the proc filesystem. */
-- atomic_t stats[SI_NUM_STATS];
-+ atomic_unchecked_t stats[SI_NUM_STATS];
-
- struct task_struct *thread;
-
-@@ -285,9 +285,9 @@ struct smi_info {
- };
-
- #define smi_inc_stat(smi, stat) \
-- atomic_inc(&(smi)->stats[SI_STAT_ ## stat])
-+ atomic_inc_unchecked(&(smi)->stats[SI_STAT_ ## stat])
- #define smi_get_stat(smi, stat) \
-- ((unsigned int) atomic_read(&(smi)->stats[SI_STAT_ ## stat]))
-+ ((unsigned int) atomic_read_unchecked(&(smi)->stats[SI_STAT_ ## stat]))
-
- #define SI_MAX_PARMS 4
-
-@@ -2931,7 +2931,7 @@ static int try_smi_init(struct smi_info
- atomic_set(&new_smi->req_events, 0);
- new_smi->run_to_completion = 0;
- for (i = 0; i < SI_NUM_STATS; i++)
-- atomic_set(&new_smi->stats[i], 0);
-+ atomic_set_unchecked(&new_smi->stats[i], 0);
-
- new_smi->interrupt_disabled = 0;
- atomic_set(&new_smi->stop_operation, 0);
-diff -urNp linux-2.6.32.45/drivers/char/istallion.c linux-2.6.32.45/drivers/char/istallion.c
---- linux-2.6.32.45/drivers/char/istallion.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/char/istallion.c 2011-05-16 21:46:57.000000000 -0400
-@@ -187,7 +187,6 @@ static struct ktermios stli_deftermios
- * re-used for each stats call.
- */
- static comstats_t stli_comstats;
--static combrd_t stli_brdstats;
- static struct asystats stli_cdkstats;
-
- /*****************************************************************************/
-@@ -4058,6 +4057,7 @@ static int stli_getbrdstats(combrd_t __u
- {
- struct stlibrd *brdp;
- unsigned int i;
-+ combrd_t stli_brdstats;
-
- if (copy_from_user(&stli_brdstats, bp, sizeof(combrd_t)))
- return -EFAULT;
-@@ -4269,6 +4269,8 @@ static int stli_getportstruct(struct stl
- struct stliport stli_dummyport;
- struct stliport *portp;
-
-+ pax_track_stack();
-+
- if (copy_from_user(&stli_dummyport, arg, sizeof(struct stliport)))
- return -EFAULT;
- portp = stli_getport(stli_dummyport.brdnr, stli_dummyport.panelnr,
-@@ -4291,6 +4293,8 @@ static int stli_getbrdstruct(struct stli
- struct stlibrd stli_dummybrd;
- struct stlibrd *brdp;
-
-+ pax_track_stack();
-+
- if (copy_from_user(&stli_dummybrd, arg, sizeof(struct stlibrd)))
- return -EFAULT;
- if (stli_dummybrd.brdnr >= STL_MAXBRDS)
-diff -urNp linux-2.6.32.45/drivers/char/Kconfig linux-2.6.32.45/drivers/char/Kconfig
---- linux-2.6.32.45/drivers/char/Kconfig 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/char/Kconfig 2011-04-18 19:20:15.000000000 -0400
-@@ -90,7 +90,8 @@ config VT_HW_CONSOLE_BINDING
-
- config DEVKMEM
- bool "/dev/kmem virtual device support"
-- default y
-+ default n
-+ depends on !GRKERNSEC_KMEM
- help
- Say Y here if you want to support the /dev/kmem device. The
- /dev/kmem device is rarely used, but can be used for certain
-@@ -1114,6 +1115,7 @@ config DEVPORT
- bool
- depends on !M68K
- depends on ISA || PCI
-+ depends on !GRKERNSEC_KMEM
- default y
-
- source "drivers/s390/char/Kconfig"
-diff -urNp linux-2.6.32.45/drivers/char/keyboard.c linux-2.6.32.45/drivers/char/keyboard.c
---- linux-2.6.32.45/drivers/char/keyboard.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/char/keyboard.c 2011-04-17 15:56:46.000000000 -0400
-@@ -635,6 +635,16 @@ static void k_spec(struct vc_data *vc, u
- kbd->kbdmode == VC_MEDIUMRAW) &&
- value != KVAL(K_SAK))
- return; /* SAK is allowed even in raw mode */
-+
-+#if defined(CONFIG_GRKERNSEC_PROC) || defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
-+ {
-+ void *func = fn_handler[value];
-+ if (func == fn_show_state || func == fn_show_ptregs ||
-+ func == fn_show_mem)
-+ return;
-+ }
-+#endif
-+
- fn_handler[value](vc);
- }
-
-@@ -1386,7 +1396,7 @@ static const struct input_device_id kbd_
- .evbit = { BIT_MASK(EV_SND) },
- },
-
-- { }, /* Terminating entry */
-+ { 0 }, /* Terminating entry */
- };
-
- MODULE_DEVICE_TABLE(input, kbd_ids);
-diff -urNp linux-2.6.32.45/drivers/char/mem.c linux-2.6.32.45/drivers/char/mem.c
---- linux-2.6.32.45/drivers/char/mem.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/char/mem.c 2011-04-17 15:56:46.000000000 -0400
-@@ -18,6 +18,7 @@
- #include <linux/raw.h>
- #include <linux/tty.h>
- #include <linux/capability.h>
-+#include <linux/security.h>
- #include <linux/ptrace.h>
- #include <linux/device.h>
- #include <linux/highmem.h>
-@@ -35,6 +36,10 @@
- # include <linux/efi.h>
- #endif
-
-+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
-+extern struct file_operations grsec_fops;
-+#endif
-+
- static inline unsigned long size_inside_page(unsigned long start,
- unsigned long size)
- {
-@@ -102,9 +107,13 @@ static inline int range_is_allowed(unsig
-
- while (cursor < to) {
- if (!devmem_is_allowed(pfn)) {
-+#ifdef CONFIG_GRKERNSEC_KMEM
-+ gr_handle_mem_readwrite(from, to);
-+#else
- printk(KERN_INFO
- "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
- current->comm, from, to);
-+#endif
- return 0;
- }
- cursor += PAGE_SIZE;
-@@ -112,6 +121,11 @@ static inline int range_is_allowed(unsig
- }
- return 1;
- }
-+#elif defined(CONFIG_GRKERNSEC_KMEM)
-+static inline int range_is_allowed(unsigned long pfn, unsigned long size)
-+{
-+ return 0;
-+}
- #else
- static inline int range_is_allowed(unsigned long pfn, unsigned long size)
- {
-@@ -155,6 +169,8 @@ static ssize_t read_mem(struct file * fi
- #endif
-
- while (count > 0) {
-+ char *temp;
-+
- /*
- * Handle first page in case it's not aligned
- */
-@@ -177,11 +193,31 @@ static ssize_t read_mem(struct file * fi
- if (!ptr)
- return -EFAULT;
-
-- if (copy_to_user(buf, ptr, sz)) {
-+#ifdef CONFIG_PAX_USERCOPY
-+ temp = kmalloc(sz, GFP_KERNEL);
-+ if (!temp) {
-+ unxlate_dev_mem_ptr(p, ptr);
-+ return -ENOMEM;
-+ }
-+ memcpy(temp, ptr, sz);
-+#else
-+ temp = ptr;
-+#endif
-+
-+ if (copy_to_user(buf, temp, sz)) {
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+ kfree(temp);
-+#endif
-+
- unxlate_dev_mem_ptr(p, ptr);
- return -EFAULT;
- }
-
-+#ifdef CONFIG_PAX_USERCOPY
-+ kfree(temp);
-+#endif
-+
- unxlate_dev_mem_ptr(p, ptr);
-
- buf += sz;
-@@ -419,9 +455,8 @@ static ssize_t read_kmem(struct file *fi
- size_t count, loff_t *ppos)
- {
- unsigned long p = *ppos;
-- ssize_t low_count, read, sz;
-+ ssize_t low_count, read, sz, err = 0;
- char * kbuf; /* k-addr because vread() takes vmlist_lock rwlock */
-- int err = 0;
-
- read = 0;
- if (p < (unsigned long) high_memory) {
-@@ -444,6 +479,8 @@ static ssize_t read_kmem(struct file *fi
- }
- #endif
- while (low_count > 0) {
-+ char *temp;
-+
- sz = size_inside_page(p, low_count);
-
- /*
-@@ -453,7 +490,22 @@ static ssize_t read_kmem(struct file *fi
- */
- kbuf = xlate_dev_kmem_ptr((char *)p);
-
-- if (copy_to_user(buf, kbuf, sz))
-+#ifdef CONFIG_PAX_USERCOPY
-+ temp = kmalloc(sz, GFP_KERNEL);
-+ if (!temp)
-+ return -ENOMEM;
-+ memcpy(temp, kbuf, sz);
-+#else
-+ temp = kbuf;
-+#endif
-+
-+ err = copy_to_user(buf, temp, sz);
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+ kfree(temp);
-+#endif
-+
-+ if (err)
- return -EFAULT;
- buf += sz;
- p += sz;
-@@ -889,6 +941,9 @@ static const struct memdev {
- #ifdef CONFIG_CRASH_DUMP
- [12] = { "oldmem", 0, &oldmem_fops, NULL },
- #endif
-+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
-+ [13] = { "grsec",S_IRUSR | S_IWUGO, &grsec_fops, NULL },
-+#endif
- };
-
- static int memory_open(struct inode *inode, struct file *filp)
-diff -urNp linux-2.6.32.45/drivers/char/pcmcia/ipwireless/tty.c linux-2.6.32.45/drivers/char/pcmcia/ipwireless/tty.c
---- linux-2.6.32.45/drivers/char/pcmcia/ipwireless/tty.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/char/pcmcia/ipwireless/tty.c 2011-04-17 15:56:46.000000000 -0400
-@@ -29,6 +29,7 @@
- #include <linux/tty_driver.h>
- #include <linux/tty_flip.h>
- #include <linux/uaccess.h>
-+#include <asm/local.h>
-
- #include "tty.h"
- #include "network.h"
-@@ -51,7 +52,7 @@ struct ipw_tty {
- int tty_type;
- struct ipw_network *network;
- struct tty_struct *linux_tty;
-- int open_count;
-+ local_t open_count;
- unsigned int control_lines;
- struct mutex ipw_tty_mutex;
- int tx_bytes_queued;
-@@ -127,10 +128,10 @@ static int ipw_open(struct tty_struct *l
- mutex_unlock(&tty->ipw_tty_mutex);
- return -ENODEV;
- }
-- if (tty->open_count == 0)
-+ if (local_read(&tty->open_count) == 0)
- tty->tx_bytes_queued = 0;
-
-- tty->open_count++;
-+ local_inc(&tty->open_count);
-
- tty->linux_tty = linux_tty;
- linux_tty->driver_data = tty;
-@@ -146,9 +147,7 @@ static int ipw_open(struct tty_struct *l
-
- static void do_ipw_close(struct ipw_tty *tty)
- {
-- tty->open_count--;
--
-- if (tty->open_count == 0) {
-+ if (local_dec_return(&tty->open_count) == 0) {
- struct tty_struct *linux_tty = tty->linux_tty;
-
- if (linux_tty != NULL) {
-@@ -169,7 +168,7 @@ static void ipw_hangup(struct tty_struct
- return;
-
- mutex_lock(&tty->ipw_tty_mutex);
-- if (tty->open_count == 0) {
-+ if (local_read(&tty->open_count) == 0) {
- mutex_unlock(&tty->ipw_tty_mutex);
- return;
- }
-@@ -198,7 +197,7 @@ void ipwireless_tty_received(struct ipw_
- return;
- }
-
-- if (!tty->open_count) {
-+ if (!local_read(&tty->open_count)) {
- mutex_unlock(&tty->ipw_tty_mutex);
- return;
- }
-@@ -240,7 +239,7 @@ static int ipw_write(struct tty_struct *
- return -ENODEV;
-
- mutex_lock(&tty->ipw_tty_mutex);
-- if (!tty->open_count) {
-+ if (!local_read(&tty->open_count)) {
- mutex_unlock(&tty->ipw_tty_mutex);
- return -EINVAL;
- }
-@@ -280,7 +279,7 @@ static int ipw_write_room(struct tty_str
- if (!tty)
- return -ENODEV;
-
-- if (!tty->open_count)
-+ if (!local_read(&tty->open_count))
- return -EINVAL;
-
- room = IPWIRELESS_TX_QUEUE_SIZE - tty->tx_bytes_queued;
-@@ -322,7 +321,7 @@ static int ipw_chars_in_buffer(struct tt
- if (!tty)
- return 0;
-
-- if (!tty->open_count)
-+ if (!local_read(&tty->open_count))
- return 0;
-
- return tty->tx_bytes_queued;
-@@ -403,7 +402,7 @@ static int ipw_tiocmget(struct tty_struc
- if (!tty)
- return -ENODEV;
-
-- if (!tty->open_count)
-+ if (!local_read(&tty->open_count))
- return -EINVAL;
-
- return get_control_lines(tty);
-@@ -419,7 +418,7 @@ ipw_tiocmset(struct tty_struct *linux_tt
- if (!tty)
- return -ENODEV;
-
-- if (!tty->open_count)
-+ if (!local_read(&tty->open_count))
- return -EINVAL;
-
- return set_control_lines(tty, set, clear);
-@@ -433,7 +432,7 @@ static int ipw_ioctl(struct tty_struct *
- if (!tty)
- return -ENODEV;
-
-- if (!tty->open_count)
-+ if (!local_read(&tty->open_count))
- return -EINVAL;
-
- /* FIXME: Exactly how is the tty object locked here .. */
-@@ -591,7 +590,7 @@ void ipwireless_tty_free(struct ipw_tty
- against a parallel ioctl etc */
- mutex_lock(&ttyj->ipw_tty_mutex);
- }
-- while (ttyj->open_count)
-+ while (local_read(&ttyj->open_count))
- do_ipw_close(ttyj);
- ipwireless_disassociate_network_ttys(network,
- ttyj->channel_idx);
-diff -urNp linux-2.6.32.45/drivers/char/pty.c linux-2.6.32.45/drivers/char/pty.c
---- linux-2.6.32.45/drivers/char/pty.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/char/pty.c 2011-08-05 20:33:55.000000000 -0400
-@@ -736,8 +736,10 @@ static void __init unix98_pty_init(void)
- register_sysctl_table(pty_root_table);
-
- /* Now create the /dev/ptmx special device */
-+ pax_open_kernel();
- tty_default_fops(&ptmx_fops);
-- ptmx_fops.open = ptmx_open;
-+ *(void **)&ptmx_fops.open = ptmx_open;
-+ pax_close_kernel();
-
- cdev_init(&ptmx_cdev, &ptmx_fops);
- if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
-diff -urNp linux-2.6.32.45/drivers/char/random.c linux-2.6.32.45/drivers/char/random.c
---- linux-2.6.32.45/drivers/char/random.c 2011-08-16 20:37:25.000000000 -0400
-+++ linux-2.6.32.45/drivers/char/random.c 2011-08-16 20:43:23.000000000 -0400
-@@ -254,8 +254,13 @@
- /*
- * Configuration information
- */
-+#ifdef CONFIG_GRKERNSEC_RANDNET
-+#define INPUT_POOL_WORDS 512
-+#define OUTPUT_POOL_WORDS 128
-+#else
- #define INPUT_POOL_WORDS 128
- #define OUTPUT_POOL_WORDS 32
-+#endif
- #define SEC_XFER_SIZE 512
-
- /*
-@@ -292,10 +297,17 @@ static struct poolinfo {
- int poolwords;
- int tap1, tap2, tap3, tap4, tap5;
- } poolinfo_table[] = {
-+#ifdef CONFIG_GRKERNSEC_RANDNET
-+ /* x^512 + x^411 + x^308 + x^208 +x^104 + x + 1 -- 225 */
-+ { 512, 411, 308, 208, 104, 1 },
-+ /* x^128 + x^103 + x^76 + x^51 + x^25 + x + 1 -- 105 */
-+ { 128, 103, 76, 51, 25, 1 },
-+#else
- /* x^128 + x^103 + x^76 + x^51 +x^25 + x + 1 -- 105 */
- { 128, 103, 76, 51, 25, 1 },
- /* x^32 + x^26 + x^20 + x^14 + x^7 + x + 1 -- 15 */
- { 32, 26, 20, 14, 7, 1 },
-+#endif
- #if 0
- /* x^2048 + x^1638 + x^1231 + x^819 + x^411 + x + 1 -- 115 */
- { 2048, 1638, 1231, 819, 411, 1 },
-@@ -1209,7 +1221,7 @@ EXPORT_SYMBOL(generate_random_uuid);
- #include <linux/sysctl.h>
-
- static int min_read_thresh = 8, min_write_thresh;
--static int max_read_thresh = INPUT_POOL_WORDS * 32;
-+static int max_read_thresh = OUTPUT_POOL_WORDS * 32;
- static int max_write_thresh = INPUT_POOL_WORDS * 32;
- static char sysctl_bootid[16];
-
-diff -urNp linux-2.6.32.45/drivers/char/rocket.c linux-2.6.32.45/drivers/char/rocket.c
---- linux-2.6.32.45/drivers/char/rocket.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/char/rocket.c 2011-05-16 21:46:57.000000000 -0400
-@@ -1266,6 +1266,8 @@ static int get_ports(struct r_port *info
- struct rocket_ports tmp;
- int board;
-
-+ pax_track_stack();
-+
- if (!retports)
- return -EFAULT;
- memset(&tmp, 0, sizeof (tmp));
-diff -urNp linux-2.6.32.45/drivers/char/sonypi.c linux-2.6.32.45/drivers/char/sonypi.c
---- linux-2.6.32.45/drivers/char/sonypi.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/char/sonypi.c 2011-04-17 15:56:46.000000000 -0400
-@@ -55,6 +55,7 @@
- #include <asm/uaccess.h>
- #include <asm/io.h>
- #include <asm/system.h>
-+#include <asm/local.h>
-
- #include <linux/sonypi.h>
-
-@@ -491,7 +492,7 @@ static struct sonypi_device {
- spinlock_t fifo_lock;
- wait_queue_head_t fifo_proc_list;
- struct fasync_struct *fifo_async;
-- int open_count;
-+ local_t open_count;
- int model;
- struct input_dev *input_jog_dev;
- struct input_dev *input_key_dev;
-@@ -895,7 +896,7 @@ static int sonypi_misc_fasync(int fd, st
- static int sonypi_misc_release(struct inode *inode, struct file *file)
- {
- mutex_lock(&sonypi_device.lock);
-- sonypi_device.open_count--;
-+ local_dec(&sonypi_device.open_count);
- mutex_unlock(&sonypi_device.lock);
- return 0;
- }
-@@ -905,9 +906,9 @@ static int sonypi_misc_open(struct inode
- lock_kernel();
- mutex_lock(&sonypi_device.lock);
- /* Flush input queue on first open */
-- if (!sonypi_device.open_count)
-+ if (!local_read(&sonypi_device.open_count))
- kfifo_reset(sonypi_device.fifo);
-- sonypi_device.open_count++;
-+ local_inc(&sonypi_device.open_count);
- mutex_unlock(&sonypi_device.lock);
- unlock_kernel();
- return 0;
-diff -urNp linux-2.6.32.45/drivers/char/stallion.c linux-2.6.32.45/drivers/char/stallion.c
---- linux-2.6.32.45/drivers/char/stallion.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/char/stallion.c 2011-05-16 21:46:57.000000000 -0400
-@@ -2448,6 +2448,8 @@ static int stl_getportstruct(struct stlp
- struct stlport stl_dummyport;
- struct stlport *portp;
-
-+ pax_track_stack();
-+
- if (copy_from_user(&stl_dummyport, arg, sizeof(struct stlport)))
- return -EFAULT;
- portp = stl_getport(stl_dummyport.brdnr, stl_dummyport.panelnr,
-diff -urNp linux-2.6.32.45/drivers/char/tpm/tpm_bios.c linux-2.6.32.45/drivers/char/tpm/tpm_bios.c
---- linux-2.6.32.45/drivers/char/tpm/tpm_bios.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/char/tpm/tpm_bios.c 2011-04-17 15:56:46.000000000 -0400
-@@ -172,7 +172,7 @@ static void *tpm_bios_measurements_start
- event = addr;
-
- if ((event->event_type == 0 && event->event_size == 0) ||
-- ((addr + sizeof(struct tcpa_event) + event->event_size) >= limit))
-+ (event->event_size >= limit - addr - sizeof(struct tcpa_event)))
- return NULL;
-
- return addr;
-@@ -197,7 +197,7 @@ static void *tpm_bios_measurements_next(
- return NULL;
-
- if ((event->event_type == 0 && event->event_size == 0) ||
-- ((v + sizeof(struct tcpa_event) + event->event_size) >= limit))
-+ (event->event_size >= limit - v - sizeof(struct tcpa_event)))
- return NULL;
-
- (*pos)++;
-@@ -290,7 +290,8 @@ static int tpm_binary_bios_measurements_
- int i;
-
- for (i = 0; i < sizeof(struct tcpa_event) + event->event_size; i++)
-- seq_putc(m, data[i]);
-+ if (!seq_putc(m, data[i]))
-+ return -EFAULT;
-
- return 0;
- }
-@@ -409,6 +410,11 @@ static int read_log(struct tpm_bios_log
- log->bios_event_log_end = log->bios_event_log + len;
-
- virt = acpi_os_map_memory(start, len);
-+ if (!virt) {
-+ kfree(log->bios_event_log);
-+ log->bios_event_log = NULL;
-+ return -EFAULT;
-+ }
-
- memcpy(log->bios_event_log, virt, len);
-
-diff -urNp linux-2.6.32.45/drivers/char/tpm/tpm.c linux-2.6.32.45/drivers/char/tpm/tpm.c
---- linux-2.6.32.45/drivers/char/tpm/tpm.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.45/drivers/char/tpm/tpm.c 2011-05-16 21:46:57.000000000 -0400
-@@ -402,7 +402,7 @@ static ssize_t tpm_transmit(struct tpm_c
- chip->vendor.req_complete_val)
- goto out_recv;
-
-- if ((status == chip->vendor.req_canceled)) {
-+ if (status == chip->vendor.req_canceled) {
- dev_err(chip->dev, "Operation Canceled\n");
- rc = -ECANCELED;
- goto out;
-@@ -821,6 +821,8 @@ ssize_t tpm_show_pubek(struct device *de
-
- struct tpm_chip *chip = dev_get_drvdata(dev);
-
-+ pax_track_stack();
-+
- tpm_cmd.header.in = tpm_readpubek_header;
- err = transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE,
- "attempting to read the PUBEK");
-diff -urNp linux-2.6.32.45/drivers/char/tty_io.c linux-2.6.32.45/drivers/char/tty_io.c
---- linux-2.6.32.45/drivers/char/tty_io.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/char/tty_io.c 2011-08-05 20:33:55.000000000 -0400
-@@ -2582,8 +2582,10 @@ long tty_ioctl(struct file *file, unsign
- return retval;
- }
-
-+EXPORT_SYMBOL(tty_ioctl);
-+
- #ifdef CONFIG_COMPAT
--static long tty_compat_ioctl(struct file *file, unsigned int cmd,
-+long tty_compat_ioctl(struct file *file, unsigned int cmd,
- unsigned long arg)
- {
- struct inode *inode = file->f_dentry->d_inode;
-@@ -2607,6 +2609,8 @@ static long tty_compat_ioctl(struct file
-
- return retval;
- }
-+
-+EXPORT_SYMBOL(tty_compat_ioctl);
- #endif
-
- /*
-@@ -3052,7 +3056,7 @@ EXPORT_SYMBOL_GPL(get_current_tty);
-
- void tty_default_fops(struct file_operations *fops)
- {
-- *fops = tty_fops;
-+ memcpy((void *)fops, &tty_fops, sizeof(tty_fops));
- }
-
- /*
-diff -urNp linux-2.6.32.45/drivers/char/tty_ldisc.c linux-2.6.32.45/drivers/char/tty_ldisc.c
---- linux-2.6.32.45/drivers/char/tty_ldisc.c 2011-07-13 17:23:04.000000000 -0400
-+++ linux-2.6.32.45/drivers/char/tty_ldisc.c 2011-07-13 17:23:18.000000000 -0400
-@@ -74,7 +74,7 @@ static void put_ldisc(struct tty_ldisc *
- if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) {
- struct tty_ldisc_ops *ldo = ld->ops;
-
-- ldo->refcount--;
-+ atomic_dec(&ldo->refcount);
- module_put(ldo->owner);
- spin_unlock_irqrestore(&tty_ldisc_lock, flags);
-
-@@ -109,7 +109,7 @@ int tty_register_ldisc(int disc, struct
- spin_lock_irqsave(&tty_ldisc_lock, flags);
- tty_ldiscs[disc] = new_ldisc;
- new_ldisc->num = disc;
-- new_ldisc->refcount = 0;
-+ atomic_set(&new_ldisc->refcount, 0);
- spin_unlock_irqrestore(&tty_ldisc_lock, flags);
-
- return ret;
-@@ -137,7 +137,7 @@ int tty_unregister_ldisc(int disc)
- return -EINVAL;
-
- spin_lock_irqsave(&tty_ldisc_lock, flags);
-- if (tty_ldiscs[disc]->refcount)
-+ if (atomic_read(&tty_ldiscs[disc]->refcount))
- ret = -EBUSY;
- else
- tty_ldiscs[disc] = NULL;
-@@ -158,7 +158,7 @@ static struct tty_ldisc_ops *get_ldops(i
- if (ldops) {
- ret = ERR_PTR(-EAGAIN);
- if (try_module_get(ldops->owner)) {
-- ldops->refcount++;
-+ atomic_inc(&ldops->refcount);
- ret = ldops;
- }
- }
-@@ -171,7 +171,7 @@ static void put_ldops(struct tty_ldisc_o
- unsigned long flags;
-
- spin_lock_irqsave(&tty_ldisc_lock, flags);
-- ldops->refcount--;
-+ atomic_dec(&ldops->refcount);
- module_put(ldops->owner);
- spin_unlock_irqrestore(&tty_ldisc_lock, flags);
- }
-diff -urNp linux-2.6.32.45/drivers/char/virtio_console.c linux-2.6.32.45/drivers/char/virtio_console.c
---- linux-2.6.32.45/drivers/char/virtio_console.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/char/virtio_console.c 2011-08-05 20:33:55.000000000 -0400
-@@ -133,7 +133,9 @@ static int get_chars(u32 vtermno, char *
- * virtqueue, so we let the drivers do some boutique early-output thing. */
- int __init virtio_cons_early_init(int (*put_chars)(u32, const char *, int))
- {
-- virtio_cons.put_chars = put_chars;
-+ pax_open_kernel();
-+ *(void **)&virtio_cons.put_chars = put_chars;
-+ pax_close_kernel();
- return hvc_instantiate(0, 0, &virtio_cons);
- }
-
-@@ -213,11 +215,13 @@ static int __devinit virtcons_probe(stru
- out_vq = vqs[1];
-
- /* Start using the new console output. */
-- virtio_cons.get_chars = get_chars;
-- virtio_cons.put_chars = put_chars;
-- virtio_cons.notifier_add = notifier_add_vio;
-- virtio_cons.notifier_del = notifier_del_vio;
-- virtio_cons.notifier_hangup = notifier_del_vio;
-+ pax_open_kernel();
-+ *(void **)&virtio_cons.get_chars = get_chars;
-+ *(void **)&virtio_cons.put_chars = put_chars;
-+ *(void **)&virtio_cons.notifier_add = notifier_add_vio;
-+ *(void **)&virtio_cons.notifier_del = notifier_del_vio;
-+ *(void **)&virtio_cons.notifier_hangup = notifier_del_vio;
-+ pax_close_kernel();
-
- /* The first argument of hvc_alloc() is the virtual console number, so
- * we use zero. The second argument is the parameter for the
-diff -urNp linux-2.6.32.45/drivers/char/vt.c linux-2.6.32.45/drivers/char/vt.c
---- linux-2.6.32.45/drivers/char/vt.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/char/vt.c 2011-04-17 15:56:46.000000000 -0400
-@@ -243,7 +243,7 @@ EXPORT_SYMBOL_GPL(unregister_vt_notifier
-
- static void notify_write(struct vc_data *vc, unsigned int unicode)
- {
-- struct vt_notifier_param param = { .vc = vc, unicode = unicode };
-+ struct vt_notifier_param param = { .vc = vc, .c = unicode };
- atomic_notifier_call_chain(&vt_notifier_list, VT_WRITE, ¶m);
- }
-
-diff -urNp linux-2.6.32.45/drivers/char/vt_ioctl.c linux-2.6.32.45/drivers/char/vt_ioctl.c
---- linux-2.6.32.45/drivers/char/vt_ioctl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/char/vt_ioctl.c 2011-04-17 15:56:46.000000000 -0400
-@@ -210,9 +210,6 @@ do_kdsk_ioctl(int cmd, struct kbentry __
- if (copy_from_user(&tmp, user_kbe, sizeof(struct kbentry)))
- return -EFAULT;
-
-- if (!capable(CAP_SYS_TTY_CONFIG))
-- perm = 0;
--
- switch (cmd) {
- case KDGKBENT:
- key_map = key_maps[s];
-@@ -224,8 +221,12 @@ do_kdsk_ioctl(int cmd, struct kbentry __
- val = (i ? K_HOLE : K_NOSUCHMAP);
- return put_user(val, &user_kbe->kb_value);
- case KDSKBENT:
-+ if (!capable(CAP_SYS_TTY_CONFIG))
-+ perm = 0;
-+
- if (!perm)
- return -EPERM;
-+
- if (!i && v == K_NOSUCHMAP) {
- /* deallocate map */
- key_map = key_maps[s];
-@@ -325,9 +326,6 @@ do_kdgkb_ioctl(int cmd, struct kbsentry
- int i, j, k;
- int ret;
-
-- if (!capable(CAP_SYS_TTY_CONFIG))
-- perm = 0;
--
- kbs = kmalloc(sizeof(*kbs), GFP_KERNEL);
- if (!kbs) {
- ret = -ENOMEM;
-@@ -361,6 +359,9 @@ do_kdgkb_ioctl(int cmd, struct kbsentry
- kfree(kbs);
- return ((p && *p) ? -EOVERFLOW : 0);
- case KDSKBSENT:
-+ if (!capable(CAP_SYS_TTY_CONFIG))
-+ perm = 0;
-+
- if (!perm) {
- ret = -EPERM;
- goto reterr;
-diff -urNp linux-2.6.32.45/drivers/cpufreq/cpufreq.c linux-2.6.32.45/drivers/cpufreq/cpufreq.c
---- linux-2.6.32.45/drivers/cpufreq/cpufreq.c 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.45/drivers/cpufreq/cpufreq.c 2011-06-25 12:56:37.000000000 -0400
-@@ -750,7 +750,7 @@ static void cpufreq_sysfs_release(struct
- complete(&policy->kobj_unregister);
- }
-
--static struct sysfs_ops sysfs_ops = {
-+static const struct sysfs_ops sysfs_ops = {
- .show = show,
- .store = store,
- };
-diff -urNp linux-2.6.32.45/drivers/cpuidle/sysfs.c linux-2.6.32.45/drivers/cpuidle/sysfs.c
---- linux-2.6.32.45/drivers/cpuidle/sysfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/cpuidle/sysfs.c 2011-04-17 15:56:46.000000000 -0400
-@@ -191,7 +191,7 @@ static ssize_t cpuidle_store(struct kobj
- return ret;
- }
-
--static struct sysfs_ops cpuidle_sysfs_ops = {
-+static const struct sysfs_ops cpuidle_sysfs_ops = {
- .show = cpuidle_show,
- .store = cpuidle_store,
- };
-@@ -277,7 +277,7 @@ static ssize_t cpuidle_state_show(struct
- return ret;
- }
-
--static struct sysfs_ops cpuidle_state_sysfs_ops = {
-+static const struct sysfs_ops cpuidle_state_sysfs_ops = {
- .show = cpuidle_state_show,
- };
-
-@@ -294,7 +294,7 @@ static struct kobj_type ktype_state_cpui
- .release = cpuidle_state_sysfs_release,
- };
-
--static void inline cpuidle_free_state_kobj(struct cpuidle_device *device, int i)
-+static inline void cpuidle_free_state_kobj(struct cpuidle_device *device, int i)
- {
- kobject_put(&device->kobjs[i]->kobj);
- wait_for_completion(&device->kobjs[i]->kobj_unregister);
-diff -urNp linux-2.6.32.45/drivers/crypto/hifn_795x.c linux-2.6.32.45/drivers/crypto/hifn_795x.c
---- linux-2.6.32.45/drivers/crypto/hifn_795x.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/crypto/hifn_795x.c 2011-05-16 21:46:57.000000000 -0400
-@@ -1655,6 +1655,8 @@ static int hifn_test(struct hifn_device
- 0xCA, 0x34, 0x2B, 0x2E};
- struct scatterlist sg;
-
-+ pax_track_stack();
-+
- memset(src, 0, sizeof(src));
- memset(ctx.key, 0, sizeof(ctx.key));
-
-diff -urNp linux-2.6.32.45/drivers/crypto/padlock-aes.c linux-2.6.32.45/drivers/crypto/padlock-aes.c
---- linux-2.6.32.45/drivers/crypto/padlock-aes.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/crypto/padlock-aes.c 2011-05-16 21:46:57.000000000 -0400
-@@ -108,6 +108,8 @@ static int aes_set_key(struct crypto_tfm
- struct crypto_aes_ctx gen_aes;
- int cpu;
-
-+ pax_track_stack();
-+
- if (key_len % 8) {
- *flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
- return -EINVAL;
-diff -urNp linux-2.6.32.45/drivers/dma/ioat/dma.c linux-2.6.32.45/drivers/dma/ioat/dma.c
---- linux-2.6.32.45/drivers/dma/ioat/dma.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/dma/ioat/dma.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1146,7 +1146,7 @@ ioat_attr_show(struct kobject *kobj, str
- return entry->show(&chan->common, page);
- }
-
--struct sysfs_ops ioat_sysfs_ops = {
-+const struct sysfs_ops ioat_sysfs_ops = {
- .show = ioat_attr_show,
- };
-
-diff -urNp linux-2.6.32.45/drivers/dma/ioat/dma.h linux-2.6.32.45/drivers/dma/ioat/dma.h
---- linux-2.6.32.45/drivers/dma/ioat/dma.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/dma/ioat/dma.h 2011-04-17 15:56:46.000000000 -0400
-@@ -347,7 +347,7 @@ bool ioat_cleanup_preamble(struct ioat_c
- unsigned long *phys_complete);
- void ioat_kobject_add(struct ioatdma_device *device, struct kobj_type *type);
- void ioat_kobject_del(struct ioatdma_device *device);
--extern struct sysfs_ops ioat_sysfs_ops;
-+extern const struct sysfs_ops ioat_sysfs_ops;
- extern struct ioat_sysfs_entry ioat_version_attr;
- extern struct ioat_sysfs_entry ioat_cap_attr;
- #endif /* IOATDMA_H */
-diff -urNp linux-2.6.32.45/drivers/edac/edac_device_sysfs.c linux-2.6.32.45/drivers/edac/edac_device_sysfs.c
---- linux-2.6.32.45/drivers/edac/edac_device_sysfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/edac/edac_device_sysfs.c 2011-04-17 15:56:46.000000000 -0400
-@@ -137,7 +137,7 @@ static ssize_t edac_dev_ctl_info_store(s
- }
-
- /* edac_dev file operations for an 'ctl_info' */
--static struct sysfs_ops device_ctl_info_ops = {
-+static const struct sysfs_ops device_ctl_info_ops = {
- .show = edac_dev_ctl_info_show,
- .store = edac_dev_ctl_info_store
- };
-@@ -373,7 +373,7 @@ static ssize_t edac_dev_instance_store(s
- }
-
- /* edac_dev file operations for an 'instance' */
--static struct sysfs_ops device_instance_ops = {
-+static const struct sysfs_ops device_instance_ops = {
- .show = edac_dev_instance_show,
- .store = edac_dev_instance_store
- };
-@@ -476,7 +476,7 @@ static ssize_t edac_dev_block_store(stru
- }
-
- /* edac_dev file operations for a 'block' */
--static struct sysfs_ops device_block_ops = {
-+static const struct sysfs_ops device_block_ops = {
- .show = edac_dev_block_show,
- .store = edac_dev_block_store
- };
-diff -urNp linux-2.6.32.45/drivers/edac/edac_mc_sysfs.c linux-2.6.32.45/drivers/edac/edac_mc_sysfs.c
---- linux-2.6.32.45/drivers/edac/edac_mc_sysfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/edac/edac_mc_sysfs.c 2011-04-17 15:56:46.000000000 -0400
-@@ -245,7 +245,7 @@ static ssize_t csrowdev_store(struct kob
- return -EIO;
- }
-
--static struct sysfs_ops csrowfs_ops = {
-+static const struct sysfs_ops csrowfs_ops = {
- .show = csrowdev_show,
- .store = csrowdev_store
- };
-@@ -575,7 +575,7 @@ static ssize_t mcidev_store(struct kobje
- }
-
- /* Intermediate show/store table */
--static struct sysfs_ops mci_ops = {
-+static const struct sysfs_ops mci_ops = {
- .show = mcidev_show,
- .store = mcidev_store
- };
-diff -urNp linux-2.6.32.45/drivers/edac/edac_pci_sysfs.c linux-2.6.32.45/drivers/edac/edac_pci_sysfs.c
---- linux-2.6.32.45/drivers/edac/edac_pci_sysfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/edac/edac_pci_sysfs.c 2011-05-04 17:56:20.000000000 -0400
-@@ -25,8 +25,8 @@ static int edac_pci_log_pe = 1; /* log
- static int edac_pci_log_npe = 1; /* log PCI non-parity error errors */
- static int edac_pci_poll_msec = 1000; /* one second workq period */
-
--static atomic_t pci_parity_count = ATOMIC_INIT(0);
--static atomic_t pci_nonparity_count = ATOMIC_INIT(0);
-+static atomic_unchecked_t pci_parity_count = ATOMIC_INIT(0);
-+static atomic_unchecked_t pci_nonparity_count = ATOMIC_INIT(0);
-
- static struct kobject *edac_pci_top_main_kobj;
- static atomic_t edac_pci_sysfs_refcount = ATOMIC_INIT(0);
-@@ -121,7 +121,7 @@ static ssize_t edac_pci_instance_store(s
- }
-
- /* fs_ops table */
--static struct sysfs_ops pci_instance_ops = {
-+static const struct sysfs_ops pci_instance_ops = {
- .show = edac_pci_instance_show,
- .store = edac_pci_instance_store
- };
-@@ -261,7 +261,7 @@ static ssize_t edac_pci_dev_store(struct
- return -EIO;
- }
-
--static struct sysfs_ops edac_pci_sysfs_ops = {
-+static const struct sysfs_ops edac_pci_sysfs_ops = {
- .show = edac_pci_dev_show,
- .store = edac_pci_dev_store
- };
-@@ -579,7 +579,7 @@ static void edac_pci_dev_parity_test(str
- edac_printk(KERN_CRIT, EDAC_PCI,
- "Signaled System Error on %s\n",
- pci_name(dev));
-- atomic_inc(&pci_nonparity_count);
-+ atomic_inc_unchecked(&pci_nonparity_count);
- }
-
- if (status & (PCI_STATUS_PARITY)) {
-@@ -587,7 +587,7 @@ static void edac_pci_dev_parity_test(str
- "Master Data Parity Error on %s\n",
- pci_name(dev));
-
-- atomic_inc(&pci_parity_count);
-+ atomic_inc_unchecked(&pci_parity_count);
- }
-
- if (status & (PCI_STATUS_DETECTED_PARITY)) {
-@@ -595,7 +595,7 @@ static void edac_pci_dev_parity_test(str
- "Detected Parity Error on %s\n",
- pci_name(dev));
-
-- atomic_inc(&pci_parity_count);
-+ atomic_inc_unchecked(&pci_parity_count);
- }
- }
-
-@@ -616,7 +616,7 @@ static void edac_pci_dev_parity_test(str
- edac_printk(KERN_CRIT, EDAC_PCI, "Bridge "
- "Signaled System Error on %s\n",
- pci_name(dev));
-- atomic_inc(&pci_nonparity_count);
-+ atomic_inc_unchecked(&pci_nonparity_count);
- }
-
- if (status & (PCI_STATUS_PARITY)) {
-@@ -624,7 +624,7 @@ static void edac_pci_dev_parity_test(str
- "Master Data Parity Error on "
- "%s\n", pci_name(dev));
-
-- atomic_inc(&pci_parity_count);
-+ atomic_inc_unchecked(&pci_parity_count);
- }
-
- if (status & (PCI_STATUS_DETECTED_PARITY)) {
-@@ -632,7 +632,7 @@ static void edac_pci_dev_parity_test(str
- "Detected Parity Error on %s\n",
- pci_name(dev));
-
-- atomic_inc(&pci_parity_count);
-+ atomic_inc_unchecked(&pci_parity_count);
- }
- }
- }
-@@ -674,7 +674,7 @@ void edac_pci_do_parity_check(void)
- if (!check_pci_errors)
- return;
-
-- before_count = atomic_read(&pci_parity_count);
-+ before_count = atomic_read_unchecked(&pci_parity_count);
-
- /* scan all PCI devices looking for a Parity Error on devices and
- * bridges.
-@@ -686,7 +686,7 @@ void edac_pci_do_parity_check(void)
- /* Only if operator has selected panic on PCI Error */
- if (edac_pci_get_panic_on_pe()) {
- /* If the count is different 'after' from 'before' */
-- if (before_count != atomic_read(&pci_parity_count))
-+ if (before_count != atomic_read_unchecked(&pci_parity_count))
- panic("EDAC: PCI Parity Error");
- }
- }
-diff -urNp linux-2.6.32.45/drivers/firewire/core-card.c linux-2.6.32.45/drivers/firewire/core-card.c
---- linux-2.6.32.45/drivers/firewire/core-card.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/firewire/core-card.c 2011-08-05 20:33:55.000000000 -0400
-@@ -569,8 +569,10 @@ void fw_core_remove_card(struct fw_card
- mutex_unlock(&card_mutex);
-
- /* Switch off most of the card driver interface. */
-- dummy_driver.free_iso_context = card->driver->free_iso_context;
-- dummy_driver.stop_iso = card->driver->stop_iso;
-+ pax_open_kernel();
-+ *(void **)&dummy_driver.free_iso_context = card->driver->free_iso_context;
-+ *(void **)&dummy_driver.stop_iso = card->driver->stop_iso;
-+ pax_close_kernel();
- card->driver = &dummy_driver;
-
- fw_destroy_nodes(card);
-diff -urNp linux-2.6.32.45/drivers/firewire/core-cdev.c linux-2.6.32.45/drivers/firewire/core-cdev.c
---- linux-2.6.32.45/drivers/firewire/core-cdev.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/firewire/core-cdev.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1141,8 +1141,7 @@ static int init_iso_resource(struct clie
- int ret;
-
- if ((request->channels == 0 && request->bandwidth == 0) ||
-- request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL ||
-- request->bandwidth < 0)
-+ request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL)
- return -EINVAL;
-
- r = kmalloc(sizeof(*r), GFP_KERNEL);
-diff -urNp linux-2.6.32.45/drivers/firewire/core-transaction.c linux-2.6.32.45/drivers/firewire/core-transaction.c
---- linux-2.6.32.45/drivers/firewire/core-transaction.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/firewire/core-transaction.c 2011-05-16 21:46:57.000000000 -0400
-@@ -36,6 +36,7 @@
- #include <linux/string.h>
- #include <linux/timer.h>
- #include <linux/types.h>
-+#include <linux/sched.h>
-
- #include <asm/byteorder.h>
-
-@@ -344,6 +345,8 @@ int fw_run_transaction(struct fw_card *c
- struct transaction_callback_data d;
- struct fw_transaction t;
-
-+ pax_track_stack();
-+
- init_completion(&d.done);
- d.payload = payload;
- fw_send_request(card, &t, tcode, destination_id, generation, speed,
-diff -urNp linux-2.6.32.45/drivers/firmware/dmi_scan.c linux-2.6.32.45/drivers/firmware/dmi_scan.c
---- linux-2.6.32.45/drivers/firmware/dmi_scan.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/firmware/dmi_scan.c 2011-04-17 15:56:46.000000000 -0400
-@@ -391,11 +391,6 @@ void __init dmi_scan_machine(void)
- }
- }
- else {
-- /*
-- * no iounmap() for that ioremap(); it would be a no-op, but
-- * it's so early in setup that sucker gets confused into doing
-- * what it shouldn't if we actually call it.
-- */
- p = dmi_ioremap(0xF0000, 0x10000);
- if (p == NULL)
- goto error;
-diff -urNp linux-2.6.32.45/drivers/firmware/edd.c linux-2.6.32.45/drivers/firmware/edd.c
---- linux-2.6.32.45/drivers/firmware/edd.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/firmware/edd.c 2011-04-17 15:56:46.000000000 -0400
-@@ -122,7 +122,7 @@ edd_attr_show(struct kobject * kobj, str
- return ret;
- }
-
--static struct sysfs_ops edd_attr_ops = {
-+static const struct sysfs_ops edd_attr_ops = {
- .show = edd_attr_show,
- };
-
-diff -urNp linux-2.6.32.45/drivers/firmware/efivars.c linux-2.6.32.45/drivers/firmware/efivars.c
---- linux-2.6.32.45/drivers/firmware/efivars.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/firmware/efivars.c 2011-04-17 15:56:46.000000000 -0400
-@@ -362,7 +362,7 @@ static ssize_t efivar_attr_store(struct
- return ret;
- }
-
--static struct sysfs_ops efivar_attr_ops = {
-+static const struct sysfs_ops efivar_attr_ops = {
- .show = efivar_attr_show,
- .store = efivar_attr_store,
- };
-diff -urNp linux-2.6.32.45/drivers/firmware/iscsi_ibft.c linux-2.6.32.45/drivers/firmware/iscsi_ibft.c
---- linux-2.6.32.45/drivers/firmware/iscsi_ibft.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/firmware/iscsi_ibft.c 2011-04-17 15:56:46.000000000 -0400
-@@ -525,7 +525,7 @@ static ssize_t ibft_show_attribute(struc
- return ret;
- }
-
--static struct sysfs_ops ibft_attr_ops = {
-+static const struct sysfs_ops ibft_attr_ops = {
- .show = ibft_show_attribute,
- };
-
-diff -urNp linux-2.6.32.45/drivers/firmware/memmap.c linux-2.6.32.45/drivers/firmware/memmap.c
---- linux-2.6.32.45/drivers/firmware/memmap.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/firmware/memmap.c 2011-04-17 15:56:46.000000000 -0400
-@@ -74,7 +74,7 @@ static struct attribute *def_attrs[] = {
- NULL
- };
-
--static struct sysfs_ops memmap_attr_ops = {
-+static const struct sysfs_ops memmap_attr_ops = {
- .show = memmap_attr_show,
- };
-
-diff -urNp linux-2.6.32.45/drivers/gpio/vr41xx_giu.c linux-2.6.32.45/drivers/gpio/vr41xx_giu.c
---- linux-2.6.32.45/drivers/gpio/vr41xx_giu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpio/vr41xx_giu.c 2011-05-04 17:56:28.000000000 -0400
-@@ -204,7 +204,7 @@ static int giu_get_irq(unsigned int irq)
- printk(KERN_ERR "spurious GIU interrupt: %04x(%04x),%04x(%04x)\n",
- maskl, pendl, maskh, pendh);
-
-- atomic_inc(&irq_err_count);
-+ atomic_inc_unchecked(&irq_err_count);
-
- return -EINVAL;
- }
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/drm_crtc_helper.c linux-2.6.32.45/drivers/gpu/drm/drm_crtc_helper.c
---- linux-2.6.32.45/drivers/gpu/drm/drm_crtc_helper.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/drm_crtc_helper.c 2011-05-16 21:46:57.000000000 -0400
-@@ -573,7 +573,7 @@ static bool drm_encoder_crtc_ok(struct d
- struct drm_crtc *tmp;
- int crtc_mask = 1;
-
-- WARN(!crtc, "checking null crtc?");
-+ BUG_ON(!crtc);
-
- dev = crtc->dev;
-
-@@ -642,6 +642,8 @@ bool drm_crtc_helper_set_mode(struct drm
-
- adjusted_mode = drm_mode_duplicate(dev, mode);
-
-+ pax_track_stack();
-+
- crtc->enabled = drm_helper_crtc_in_use(crtc);
-
- if (!crtc->enabled)
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/drm_drv.c linux-2.6.32.45/drivers/gpu/drm/drm_drv.c
---- linux-2.6.32.45/drivers/gpu/drm/drm_drv.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/drm_drv.c 2011-04-17 15:56:46.000000000 -0400
-@@ -417,7 +417,7 @@ int drm_ioctl(struct inode *inode, struc
- char *kdata = NULL;
-
- atomic_inc(&dev->ioctl_count);
-- atomic_inc(&dev->counts[_DRM_STAT_IOCTLS]);
-+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_IOCTLS]);
- ++file_priv->ioctl_count;
-
- DRM_DEBUG("pid=%d, cmd=0x%02x, nr=0x%02x, dev 0x%lx, auth=%d\n",
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/drm_fops.c linux-2.6.32.45/drivers/gpu/drm/drm_fops.c
---- linux-2.6.32.45/drivers/gpu/drm/drm_fops.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/drm_fops.c 2011-04-17 15:56:46.000000000 -0400
-@@ -66,7 +66,7 @@ static int drm_setup(struct drm_device *
- }
-
- for (i = 0; i < ARRAY_SIZE(dev->counts); i++)
-- atomic_set(&dev->counts[i], 0);
-+ atomic_set_unchecked(&dev->counts[i], 0);
-
- dev->sigdata.lock = NULL;
-
-@@ -130,9 +130,9 @@ int drm_open(struct inode *inode, struct
-
- retcode = drm_open_helper(inode, filp, dev);
- if (!retcode) {
-- atomic_inc(&dev->counts[_DRM_STAT_OPENS]);
-+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_OPENS]);
- spin_lock(&dev->count_lock);
-- if (!dev->open_count++) {
-+ if (local_inc_return(&dev->open_count) == 1) {
- spin_unlock(&dev->count_lock);
- retcode = drm_setup(dev);
- goto out;
-@@ -435,7 +435,7 @@ int drm_release(struct inode *inode, str
-
- lock_kernel();
-
-- DRM_DEBUG("open_count = %d\n", dev->open_count);
-+ DRM_DEBUG("open_count = %d\n", local_read(&dev->open_count));
-
- if (dev->driver->preclose)
- dev->driver->preclose(dev, file_priv);
-@@ -447,7 +447,7 @@ int drm_release(struct inode *inode, str
- DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %d\n",
- task_pid_nr(current),
- (long)old_encode_dev(file_priv->minor->device),
-- dev->open_count);
-+ local_read(&dev->open_count));
-
- /* if the master has gone away we can't do anything with the lock */
- if (file_priv->minor->master)
-@@ -524,9 +524,9 @@ int drm_release(struct inode *inode, str
- * End inline drm_release
- */
-
-- atomic_inc(&dev->counts[_DRM_STAT_CLOSES]);
-+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_CLOSES]);
- spin_lock(&dev->count_lock);
-- if (!--dev->open_count) {
-+ if (local_dec_and_test(&dev->open_count)) {
- if (atomic_read(&dev->ioctl_count)) {
- DRM_ERROR("Device busy: %d\n",
- atomic_read(&dev->ioctl_count));
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/drm_gem.c linux-2.6.32.45/drivers/gpu/drm/drm_gem.c
---- linux-2.6.32.45/drivers/gpu/drm/drm_gem.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/drm_gem.c 2011-04-17 15:56:46.000000000 -0400
-@@ -83,11 +83,11 @@ drm_gem_init(struct drm_device *dev)
- spin_lock_init(&dev->object_name_lock);
- idr_init(&dev->object_name_idr);
- atomic_set(&dev->object_count, 0);
-- atomic_set(&dev->object_memory, 0);
-+ atomic_set_unchecked(&dev->object_memory, 0);
- atomic_set(&dev->pin_count, 0);
-- atomic_set(&dev->pin_memory, 0);
-+ atomic_set_unchecked(&dev->pin_memory, 0);
- atomic_set(&dev->gtt_count, 0);
-- atomic_set(&dev->gtt_memory, 0);
-+ atomic_set_unchecked(&dev->gtt_memory, 0);
-
- mm = kzalloc(sizeof(struct drm_gem_mm), GFP_KERNEL);
- if (!mm) {
-@@ -150,7 +150,7 @@ drm_gem_object_alloc(struct drm_device *
- goto fput;
- }
- atomic_inc(&dev->object_count);
-- atomic_add(obj->size, &dev->object_memory);
-+ atomic_add_unchecked(obj->size, &dev->object_memory);
- return obj;
- fput:
- fput(obj->filp);
-@@ -429,7 +429,7 @@ drm_gem_object_free(struct kref *kref)
-
- fput(obj->filp);
- atomic_dec(&dev->object_count);
-- atomic_sub(obj->size, &dev->object_memory);
-+ atomic_sub_unchecked(obj->size, &dev->object_memory);
- kfree(obj);
- }
- EXPORT_SYMBOL(drm_gem_object_free);
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/drm_info.c linux-2.6.32.45/drivers/gpu/drm/drm_info.c
---- linux-2.6.32.45/drivers/gpu/drm/drm_info.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/drm_info.c 2011-04-17 15:56:46.000000000 -0400
-@@ -75,10 +75,14 @@ int drm_vm_info(struct seq_file *m, void
- struct drm_local_map *map;
- struct drm_map_list *r_list;
-
-- /* Hardcoded from _DRM_FRAME_BUFFER,
-- _DRM_REGISTERS, _DRM_SHM, _DRM_AGP, and
-- _DRM_SCATTER_GATHER and _DRM_CONSISTENT */
-- const char *types[] = { "FB", "REG", "SHM", "AGP", "SG", "PCI" };
-+ static const char * const types[] = {
-+ [_DRM_FRAME_BUFFER] = "FB",
-+ [_DRM_REGISTERS] = "REG",
-+ [_DRM_SHM] = "SHM",
-+ [_DRM_AGP] = "AGP",
-+ [_DRM_SCATTER_GATHER] = "SG",
-+ [_DRM_CONSISTENT] = "PCI",
-+ [_DRM_GEM] = "GEM" };
- const char *type;
- int i;
-
-@@ -89,7 +93,7 @@ int drm_vm_info(struct seq_file *m, void
- map = r_list->map;
- if (!map)
- continue;
-- if (map->type < 0 || map->type > 5)
-+ if (map->type >= ARRAY_SIZE(types))
- type = "??";
- else
- type = types[map->type];
-@@ -265,10 +269,10 @@ int drm_gem_object_info(struct seq_file
- struct drm_device *dev = node->minor->dev;
-
- seq_printf(m, "%d objects\n", atomic_read(&dev->object_count));
-- seq_printf(m, "%d object bytes\n", atomic_read(&dev->object_memory));
-+ seq_printf(m, "%d object bytes\n", atomic_read_unchecked(&dev->object_memory));
- seq_printf(m, "%d pinned\n", atomic_read(&dev->pin_count));
-- seq_printf(m, "%d pin bytes\n", atomic_read(&dev->pin_memory));
-- seq_printf(m, "%d gtt bytes\n", atomic_read(&dev->gtt_memory));
-+ seq_printf(m, "%d pin bytes\n", atomic_read_unchecked(&dev->pin_memory));
-+ seq_printf(m, "%d gtt bytes\n", atomic_read_unchecked(&dev->gtt_memory));
- seq_printf(m, "%d gtt total\n", dev->gtt_total);
- return 0;
- }
-@@ -288,7 +292,11 @@ int drm_vma_info(struct seq_file *m, voi
- mutex_lock(&dev->struct_mutex);
- seq_printf(m, "vma use count: %d, high_memory = %p, 0x%08llx\n",
- atomic_read(&dev->vma_count),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL, 0);
-+#else
- high_memory, (u64)virt_to_phys(high_memory));
-+#endif
-
- list_for_each_entry(pt, &dev->vmalist, head) {
- vma = pt->vma;
-@@ -296,14 +304,23 @@ int drm_vma_info(struct seq_file *m, voi
- continue;
- seq_printf(m,
- "\n%5d 0x%08lx-0x%08lx %c%c%c%c%c%c 0x%08lx000",
-- pt->pid, vma->vm_start, vma->vm_end,
-+ pt->pid,
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ 0, 0,
-+#else
-+ vma->vm_start, vma->vm_end,
-+#endif
- vma->vm_flags & VM_READ ? 'r' : '-',
- vma->vm_flags & VM_WRITE ? 'w' : '-',
- vma->vm_flags & VM_EXEC ? 'x' : '-',
- vma->vm_flags & VM_MAYSHARE ? 's' : 'p',
- vma->vm_flags & VM_LOCKED ? 'l' : '-',
- vma->vm_flags & VM_IO ? 'i' : '-',
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ 0);
-+#else
- vma->vm_pgoff);
-+#endif
-
- #if defined(__i386__)
- pgprot = pgprot_val(vma->vm_page_prot);
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/drm_ioctl.c linux-2.6.32.45/drivers/gpu/drm/drm_ioctl.c
---- linux-2.6.32.45/drivers/gpu/drm/drm_ioctl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/drm_ioctl.c 2011-04-17 15:56:46.000000000 -0400
-@@ -283,7 +283,7 @@ int drm_getstats(struct drm_device *dev,
- stats->data[i].value =
- (file_priv->master->lock.hw_lock ? file_priv->master->lock.hw_lock->lock : 0);
- else
-- stats->data[i].value = atomic_read(&dev->counts[i]);
-+ stats->data[i].value = atomic_read_unchecked(&dev->counts[i]);
- stats->data[i].type = dev->types[i];
- }
-
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/drm_lock.c linux-2.6.32.45/drivers/gpu/drm/drm_lock.c
---- linux-2.6.32.45/drivers/gpu/drm/drm_lock.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/drm_lock.c 2011-04-17 15:56:46.000000000 -0400
-@@ -87,7 +87,7 @@ int drm_lock(struct drm_device *dev, voi
- if (drm_lock_take(&master->lock, lock->context)) {
- master->lock.file_priv = file_priv;
- master->lock.lock_time = jiffies;
-- atomic_inc(&dev->counts[_DRM_STAT_LOCKS]);
-+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_LOCKS]);
- break; /* Got lock */
- }
-
-@@ -165,7 +165,7 @@ int drm_unlock(struct drm_device *dev, v
- return -EINVAL;
- }
-
-- atomic_inc(&dev->counts[_DRM_STAT_UNLOCKS]);
-+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_UNLOCKS]);
-
- /* kernel_context_switch isn't used by any of the x86 drm
- * modules but is required by the Sparc driver.
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/i810/i810_dma.c linux-2.6.32.45/drivers/gpu/drm/i810/i810_dma.c
---- linux-2.6.32.45/drivers/gpu/drm/i810/i810_dma.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/i810/i810_dma.c 2011-04-17 15:56:46.000000000 -0400
-@@ -952,8 +952,8 @@ static int i810_dma_vertex(struct drm_de
- dma->buflist[vertex->idx],
- vertex->discard, vertex->used);
-
-- atomic_add(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
-- atomic_inc(&dev->counts[_DRM_STAT_DMA]);
-+ atomic_add_unchecked(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
-+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
- sarea_priv->last_enqueue = dev_priv->counter - 1;
- sarea_priv->last_dispatch = (int)hw_status[5];
-
-@@ -1115,8 +1115,8 @@ static int i810_dma_mc(struct drm_device
- i810_dma_dispatch_mc(dev, dma->buflist[mc->idx], mc->used,
- mc->last_render);
-
-- atomic_add(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
-- atomic_inc(&dev->counts[_DRM_STAT_DMA]);
-+ atomic_add_unchecked(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
-+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
- sarea_priv->last_enqueue = dev_priv->counter - 1;
- sarea_priv->last_dispatch = (int)hw_status[5];
-
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/i810/i810_drv.h linux-2.6.32.45/drivers/gpu/drm/i810/i810_drv.h
---- linux-2.6.32.45/drivers/gpu/drm/i810/i810_drv.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/i810/i810_drv.h 2011-05-04 17:56:28.000000000 -0400
-@@ -108,8 +108,8 @@ typedef struct drm_i810_private {
- int page_flipping;
-
- wait_queue_head_t irq_queue;
-- atomic_t irq_received;
-- atomic_t irq_emitted;
-+ atomic_unchecked_t irq_received;
-+ atomic_unchecked_t irq_emitted;
-
- int front_offset;
- } drm_i810_private_t;
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/i830/i830_drv.h linux-2.6.32.45/drivers/gpu/drm/i830/i830_drv.h
---- linux-2.6.32.45/drivers/gpu/drm/i830/i830_drv.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/i830/i830_drv.h 2011-05-04 17:56:28.000000000 -0400
-@@ -115,8 +115,8 @@ typedef struct drm_i830_private {
- int page_flipping;
-
- wait_queue_head_t irq_queue;
-- atomic_t irq_received;
-- atomic_t irq_emitted;
-+ atomic_unchecked_t irq_received;
-+ atomic_unchecked_t irq_emitted;
-
- int use_mi_batchbuffer_start;
-
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/i830/i830_irq.c linux-2.6.32.45/drivers/gpu/drm/i830/i830_irq.c
---- linux-2.6.32.45/drivers/gpu/drm/i830/i830_irq.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/i830/i830_irq.c 2011-05-04 17:56:28.000000000 -0400
-@@ -47,7 +47,7 @@ irqreturn_t i830_driver_irq_handler(DRM_
-
- I830_WRITE16(I830REG_INT_IDENTITY_R, temp);
-
-- atomic_inc(&dev_priv->irq_received);
-+ atomic_inc_unchecked(&dev_priv->irq_received);
- wake_up_interruptible(&dev_priv->irq_queue);
-
- return IRQ_HANDLED;
-@@ -60,14 +60,14 @@ static int i830_emit_irq(struct drm_devi
-
- DRM_DEBUG("%s\n", __func__);
-
-- atomic_inc(&dev_priv->irq_emitted);
-+ atomic_inc_unchecked(&dev_priv->irq_emitted);
-
- BEGIN_LP_RING(2);
- OUT_RING(0);
- OUT_RING(GFX_OP_USER_INTERRUPT);
- ADVANCE_LP_RING();
-
-- return atomic_read(&dev_priv->irq_emitted);
-+ return atomic_read_unchecked(&dev_priv->irq_emitted);
- }
-
- static int i830_wait_irq(struct drm_device * dev, int irq_nr)
-@@ -79,7 +79,7 @@ static int i830_wait_irq(struct drm_devi
-
- DRM_DEBUG("%s\n", __func__);
-
-- if (atomic_read(&dev_priv->irq_received) >= irq_nr)
-+ if (atomic_read_unchecked(&dev_priv->irq_received) >= irq_nr)
- return 0;
-
- dev_priv->sarea_priv->perf_boxes |= I830_BOX_WAIT;
-@@ -88,7 +88,7 @@ static int i830_wait_irq(struct drm_devi
-
- for (;;) {
- __set_current_state(TASK_INTERRUPTIBLE);
-- if (atomic_read(&dev_priv->irq_received) >= irq_nr)
-+ if (atomic_read_unchecked(&dev_priv->irq_received) >= irq_nr)
- break;
- if ((signed)(end - jiffies) <= 0) {
- DRM_ERROR("timeout iir %x imr %x ier %x hwstam %x\n",
-@@ -163,8 +163,8 @@ void i830_driver_irq_preinstall(struct d
- I830_WRITE16(I830REG_HWSTAM, 0xffff);
- I830_WRITE16(I830REG_INT_MASK_R, 0x0);
- I830_WRITE16(I830REG_INT_ENABLE_R, 0x0);
-- atomic_set(&dev_priv->irq_received, 0);
-- atomic_set(&dev_priv->irq_emitted, 0);
-+ atomic_set_unchecked(&dev_priv->irq_received, 0);
-+ atomic_set_unchecked(&dev_priv->irq_emitted, 0);
- init_waitqueue_head(&dev_priv->irq_queue);
- }
-
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/i915/dvo_ch7017.c linux-2.6.32.45/drivers/gpu/drm/i915/dvo_ch7017.c
---- linux-2.6.32.45/drivers/gpu/drm/i915/dvo_ch7017.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/i915/dvo_ch7017.c 2011-04-17 15:56:46.000000000 -0400
-@@ -443,7 +443,7 @@ static void ch7017_destroy(struct intel_
- }
- }
-
--struct intel_dvo_dev_ops ch7017_ops = {
-+const struct intel_dvo_dev_ops ch7017_ops = {
- .init = ch7017_init,
- .detect = ch7017_detect,
- .mode_valid = ch7017_mode_valid,
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/i915/dvo_ch7xxx.c linux-2.6.32.45/drivers/gpu/drm/i915/dvo_ch7xxx.c
---- linux-2.6.32.45/drivers/gpu/drm/i915/dvo_ch7xxx.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/i915/dvo_ch7xxx.c 2011-04-17 15:56:46.000000000 -0400
-@@ -356,7 +356,7 @@ static void ch7xxx_destroy(struct intel_
- }
- }
-
--struct intel_dvo_dev_ops ch7xxx_ops = {
-+const struct intel_dvo_dev_ops ch7xxx_ops = {
- .init = ch7xxx_init,
- .detect = ch7xxx_detect,
- .mode_valid = ch7xxx_mode_valid,
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/i915/dvo.h linux-2.6.32.45/drivers/gpu/drm/i915/dvo.h
---- linux-2.6.32.45/drivers/gpu/drm/i915/dvo.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/i915/dvo.h 2011-04-17 15:56:46.000000000 -0400
-@@ -135,23 +135,23 @@ struct intel_dvo_dev_ops {
- *
- * \return singly-linked list of modes or NULL if no modes found.
- */
-- struct drm_display_mode *(*get_modes)(struct intel_dvo_device *dvo);
-+ struct drm_display_mode *(* const get_modes)(struct intel_dvo_device *dvo);
-
- /**
- * Clean up driver-specific bits of the output
- */
-- void (*destroy) (struct intel_dvo_device *dvo);
-+ void (* const destroy) (struct intel_dvo_device *dvo);
-
- /**
- * Debugging hook to dump device registers to log file
- */
-- void (*dump_regs)(struct intel_dvo_device *dvo);
-+ void (* const dump_regs)(struct intel_dvo_device *dvo);
- };
-
--extern struct intel_dvo_dev_ops sil164_ops;
--extern struct intel_dvo_dev_ops ch7xxx_ops;
--extern struct intel_dvo_dev_ops ivch_ops;
--extern struct intel_dvo_dev_ops tfp410_ops;
--extern struct intel_dvo_dev_ops ch7017_ops;
-+extern const struct intel_dvo_dev_ops sil164_ops;
-+extern const struct intel_dvo_dev_ops ch7xxx_ops;
-+extern const struct intel_dvo_dev_ops ivch_ops;
-+extern const struct intel_dvo_dev_ops tfp410_ops;
-+extern const struct intel_dvo_dev_ops ch7017_ops;
-
- #endif /* _INTEL_DVO_H */
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/i915/dvo_ivch.c linux-2.6.32.45/drivers/gpu/drm/i915/dvo_ivch.c
---- linux-2.6.32.45/drivers/gpu/drm/i915/dvo_ivch.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/i915/dvo_ivch.c 2011-04-17 15:56:46.000000000 -0400
-@@ -430,7 +430,7 @@ static void ivch_destroy(struct intel_dv
- }
- }
-
--struct intel_dvo_dev_ops ivch_ops= {
-+const struct intel_dvo_dev_ops ivch_ops= {
- .init = ivch_init,
- .dpms = ivch_dpms,
- .save = ivch_save,
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/i915/dvo_sil164.c linux-2.6.32.45/drivers/gpu/drm/i915/dvo_sil164.c
---- linux-2.6.32.45/drivers/gpu/drm/i915/dvo_sil164.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/i915/dvo_sil164.c 2011-04-17 15:56:46.000000000 -0400
-@@ -290,7 +290,7 @@ static void sil164_destroy(struct intel_
- }
- }
-
--struct intel_dvo_dev_ops sil164_ops = {
-+const struct intel_dvo_dev_ops sil164_ops = {
- .init = sil164_init,
- .detect = sil164_detect,
- .mode_valid = sil164_mode_valid,
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/i915/dvo_tfp410.c linux-2.6.32.45/drivers/gpu/drm/i915/dvo_tfp410.c
---- linux-2.6.32.45/drivers/gpu/drm/i915/dvo_tfp410.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/i915/dvo_tfp410.c 2011-04-17 15:56:46.000000000 -0400
-@@ -323,7 +323,7 @@ static void tfp410_destroy(struct intel_
- }
- }
-
--struct intel_dvo_dev_ops tfp410_ops = {
-+const struct intel_dvo_dev_ops tfp410_ops = {
- .init = tfp410_init,
- .detect = tfp410_detect,
- .mode_valid = tfp410_mode_valid,
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/i915/i915_debugfs.c linux-2.6.32.45/drivers/gpu/drm/i915/i915_debugfs.c
---- linux-2.6.32.45/drivers/gpu/drm/i915/i915_debugfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/i915/i915_debugfs.c 2011-05-04 17:56:28.000000000 -0400
-@@ -192,7 +192,7 @@ static int i915_interrupt_info(struct se
- I915_READ(GTIMR));
- }
- seq_printf(m, "Interrupts received: %d\n",
-- atomic_read(&dev_priv->irq_received));
-+ atomic_read_unchecked(&dev_priv->irq_received));
- if (dev_priv->hw_status_page != NULL) {
- seq_printf(m, "Current sequence: %d\n",
- i915_get_gem_seqno(dev));
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/i915/i915_drv.c linux-2.6.32.45/drivers/gpu/drm/i915/i915_drv.c
---- linux-2.6.32.45/drivers/gpu/drm/i915/i915_drv.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/i915/i915_drv.c 2011-04-17 15:56:46.000000000 -0400
-@@ -285,7 +285,7 @@ i915_pci_resume(struct pci_dev *pdev)
- return i915_resume(dev);
- }
-
--static struct vm_operations_struct i915_gem_vm_ops = {
-+static const struct vm_operations_struct i915_gem_vm_ops = {
- .fault = i915_gem_fault,
- .open = drm_gem_vm_open,
- .close = drm_gem_vm_close,
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/i915/i915_drv.h linux-2.6.32.45/drivers/gpu/drm/i915/i915_drv.h
---- linux-2.6.32.45/drivers/gpu/drm/i915/i915_drv.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/i915/i915_drv.h 2011-08-05 20:33:55.000000000 -0400
-@@ -168,7 +168,7 @@ struct drm_i915_display_funcs {
- /* display clock increase/decrease */
- /* pll clock increase/decrease */
- /* clock gating init */
--};
-+} __no_const;
-
- typedef struct drm_i915_private {
- struct drm_device *dev;
-@@ -197,7 +197,7 @@ typedef struct drm_i915_private {
- int page_flipping;
-
- wait_queue_head_t irq_queue;
-- atomic_t irq_received;
-+ atomic_unchecked_t irq_received;
- /** Protects user_irq_refcount and irq_mask_reg */
- spinlock_t user_irq_lock;
- /** Refcount for i915_user_irq_get() versus i915_user_irq_put(). */
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/i915/i915_gem.c linux-2.6.32.45/drivers/gpu/drm/i915/i915_gem.c
---- linux-2.6.32.45/drivers/gpu/drm/i915/i915_gem.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/i915/i915_gem.c 2011-04-17 15:56:46.000000000 -0400
-@@ -102,7 +102,7 @@ i915_gem_get_aperture_ioctl(struct drm_d
-
- args->aper_size = dev->gtt_total;
- args->aper_available_size = (args->aper_size -
-- atomic_read(&dev->pin_memory));
-+ atomic_read_unchecked(&dev->pin_memory));
-
- return 0;
- }
-@@ -492,6 +492,11 @@ i915_gem_pread_ioctl(struct drm_device *
- return -EINVAL;
- }
-
-+ if (!access_ok(VERIFY_WRITE, (char __user *) (uintptr_t)args->data_ptr, args->size)) {
-+ drm_gem_object_unreference(obj);
-+ return -EFAULT;
-+ }
-+
- if (i915_gem_object_needs_bit17_swizzle(obj)) {
- ret = i915_gem_shmem_pread_slow(dev, obj, args, file_priv);
- } else {
-@@ -965,6 +970,11 @@ i915_gem_pwrite_ioctl(struct drm_device
- return -EINVAL;
- }
-
-+ if (!access_ok(VERIFY_READ, (char __user *) (uintptr_t)args->data_ptr, args->size)) {
-+ drm_gem_object_unreference(obj);
-+ return -EFAULT;
-+ }
-+
- /* We can only do the GTT pwrite on untiled buffers, as otherwise
- * it would end up going through the fenced access, and we'll get
- * different detiling behavior between reading and writing.
-@@ -2054,7 +2064,7 @@ i915_gem_object_unbind(struct drm_gem_ob
-
- if (obj_priv->gtt_space) {
- atomic_dec(&dev->gtt_count);
-- atomic_sub(obj->size, &dev->gtt_memory);
-+ atomic_sub_unchecked(obj->size, &dev->gtt_memory);
-
- drm_mm_put_block(obj_priv->gtt_space);
- obj_priv->gtt_space = NULL;
-@@ -2697,7 +2707,7 @@ i915_gem_object_bind_to_gtt(struct drm_g
- goto search_free;
- }
- atomic_inc(&dev->gtt_count);
-- atomic_add(obj->size, &dev->gtt_memory);
-+ atomic_add_unchecked(obj->size, &dev->gtt_memory);
-
- /* Assert that the object is not currently in any GPU domain. As it
- * wasn't in the GTT, there shouldn't be any way it could have been in
-@@ -3751,9 +3761,9 @@ i915_gem_execbuffer(struct drm_device *d
- "%d/%d gtt bytes\n",
- atomic_read(&dev->object_count),
- atomic_read(&dev->pin_count),
-- atomic_read(&dev->object_memory),
-- atomic_read(&dev->pin_memory),
-- atomic_read(&dev->gtt_memory),
-+ atomic_read_unchecked(&dev->object_memory),
-+ atomic_read_unchecked(&dev->pin_memory),
-+ atomic_read_unchecked(&dev->gtt_memory),
- dev->gtt_total);
- }
- goto err;
-@@ -3985,7 +3995,7 @@ i915_gem_object_pin(struct drm_gem_objec
- */
- if (obj_priv->pin_count == 1) {
- atomic_inc(&dev->pin_count);
-- atomic_add(obj->size, &dev->pin_memory);
-+ atomic_add_unchecked(obj->size, &dev->pin_memory);
- if (!obj_priv->active &&
- (obj->write_domain & I915_GEM_GPU_DOMAINS) == 0 &&
- !list_empty(&obj_priv->list))
-@@ -4018,7 +4028,7 @@ i915_gem_object_unpin(struct drm_gem_obj
- list_move_tail(&obj_priv->list,
- &dev_priv->mm.inactive_list);
- atomic_dec(&dev->pin_count);
-- atomic_sub(obj->size, &dev->pin_memory);
-+ atomic_sub_unchecked(obj->size, &dev->pin_memory);
- }
- i915_verify_inactive(dev, __FILE__, __LINE__);
- }
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/i915/i915_irq.c linux-2.6.32.45/drivers/gpu/drm/i915/i915_irq.c
---- linux-2.6.32.45/drivers/gpu/drm/i915/i915_irq.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/i915/i915_irq.c 2011-05-04 17:56:28.000000000 -0400
-@@ -528,7 +528,7 @@ irqreturn_t i915_driver_irq_handler(DRM_
- int irq_received;
- int ret = IRQ_NONE;
-
-- atomic_inc(&dev_priv->irq_received);
-+ atomic_inc_unchecked(&dev_priv->irq_received);
-
- if (IS_IGDNG(dev))
- return igdng_irq_handler(dev);
-@@ -1021,7 +1021,7 @@ void i915_driver_irq_preinstall(struct d
- {
- drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
-
-- atomic_set(&dev_priv->irq_received, 0);
-+ atomic_set_unchecked(&dev_priv->irq_received, 0);
-
- INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
- INIT_WORK(&dev_priv->error_work, i915_error_work_func);
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/i915/intel_sdvo.c linux-2.6.32.45/drivers/gpu/drm/i915/intel_sdvo.c
---- linux-2.6.32.45/drivers/gpu/drm/i915/intel_sdvo.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/i915/intel_sdvo.c 2011-08-05 20:33:55.000000000 -0400
-@@ -2795,7 +2795,9 @@ bool intel_sdvo_init(struct drm_device *
- sdvo_priv->slave_addr = intel_sdvo_get_slave_addr(dev, output_device);
-
- /* Save the bit-banging i2c functionality for use by the DDC wrapper */
-- intel_sdvo_i2c_bit_algo.functionality = intel_output->i2c_bus->algo->functionality;
-+ pax_open_kernel();
-+ *(void **)&intel_sdvo_i2c_bit_algo.functionality = intel_output->i2c_bus->algo->functionality;
-+ pax_close_kernel();
-
- /* Read the regs to test if we can talk to the device */
- for (i = 0; i < 0x40; i++) {
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/mga/mga_drv.h linux-2.6.32.45/drivers/gpu/drm/mga/mga_drv.h
---- linux-2.6.32.45/drivers/gpu/drm/mga/mga_drv.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/mga/mga_drv.h 2011-05-04 17:56:28.000000000 -0400
-@@ -120,9 +120,9 @@ typedef struct drm_mga_private {
- u32 clear_cmd;
- u32 maccess;
-
-- atomic_t vbl_received; /**< Number of vblanks received. */
-+ atomic_unchecked_t vbl_received; /**< Number of vblanks received. */
- wait_queue_head_t fence_queue;
-- atomic_t last_fence_retired;
-+ atomic_unchecked_t last_fence_retired;
- u32 next_fence_to_post;
-
- unsigned int fb_cpp;
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/mga/mga_irq.c linux-2.6.32.45/drivers/gpu/drm/mga/mga_irq.c
---- linux-2.6.32.45/drivers/gpu/drm/mga/mga_irq.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/mga/mga_irq.c 2011-05-04 17:56:28.000000000 -0400
-@@ -44,7 +44,7 @@ u32 mga_get_vblank_counter(struct drm_de
- if (crtc != 0)
- return 0;
-
-- return atomic_read(&dev_priv->vbl_received);
-+ return atomic_read_unchecked(&dev_priv->vbl_received);
- }
-
-
-@@ -60,7 +60,7 @@ irqreturn_t mga_driver_irq_handler(DRM_I
- /* VBLANK interrupt */
- if (status & MGA_VLINEPEN) {
- MGA_WRITE(MGA_ICLEAR, MGA_VLINEICLR);
-- atomic_inc(&dev_priv->vbl_received);
-+ atomic_inc_unchecked(&dev_priv->vbl_received);
- drm_handle_vblank(dev, 0);
- handled = 1;
- }
-@@ -80,7 +80,7 @@ irqreturn_t mga_driver_irq_handler(DRM_I
- MGA_WRITE(MGA_PRIMEND, prim_end);
- }
-
-- atomic_inc(&dev_priv->last_fence_retired);
-+ atomic_inc_unchecked(&dev_priv->last_fence_retired);
- DRM_WAKEUP(&dev_priv->fence_queue);
- handled = 1;
- }
-@@ -131,7 +131,7 @@ int mga_driver_fence_wait(struct drm_dev
- * using fences.
- */
- DRM_WAIT_ON(ret, dev_priv->fence_queue, 3 * DRM_HZ,
-- (((cur_fence = atomic_read(&dev_priv->last_fence_retired))
-+ (((cur_fence = atomic_read_unchecked(&dev_priv->last_fence_retired))
- - *sequence) <= (1 << 23)));
-
- *sequence = cur_fence;
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/r128/r128_cce.c linux-2.6.32.45/drivers/gpu/drm/r128/r128_cce.c
---- linux-2.6.32.45/drivers/gpu/drm/r128/r128_cce.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/r128/r128_cce.c 2011-05-04 17:56:28.000000000 -0400
-@@ -377,7 +377,7 @@ static int r128_do_init_cce(struct drm_d
-
- /* GH: Simple idle check.
- */
-- atomic_set(&dev_priv->idle_count, 0);
-+ atomic_set_unchecked(&dev_priv->idle_count, 0);
-
- /* We don't support anything other than bus-mastering ring mode,
- * but the ring can be in either AGP or PCI space for the ring
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/r128/r128_drv.h linux-2.6.32.45/drivers/gpu/drm/r128/r128_drv.h
---- linux-2.6.32.45/drivers/gpu/drm/r128/r128_drv.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/r128/r128_drv.h 2011-05-04 17:56:28.000000000 -0400
-@@ -90,14 +90,14 @@ typedef struct drm_r128_private {
- int is_pci;
- unsigned long cce_buffers_offset;
-
-- atomic_t idle_count;
-+ atomic_unchecked_t idle_count;
-
- int page_flipping;
- int current_page;
- u32 crtc_offset;
- u32 crtc_offset_cntl;
-
-- atomic_t vbl_received;
-+ atomic_unchecked_t vbl_received;
-
- u32 color_fmt;
- unsigned int front_offset;
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/r128/r128_irq.c linux-2.6.32.45/drivers/gpu/drm/r128/r128_irq.c
---- linux-2.6.32.45/drivers/gpu/drm/r128/r128_irq.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/r128/r128_irq.c 2011-05-04 17:56:28.000000000 -0400
-@@ -42,7 +42,7 @@ u32 r128_get_vblank_counter(struct drm_d
- if (crtc != 0)
- return 0;
-
-- return atomic_read(&dev_priv->vbl_received);
-+ return atomic_read_unchecked(&dev_priv->vbl_received);
- }
-
- irqreturn_t r128_driver_irq_handler(DRM_IRQ_ARGS)
-@@ -56,7 +56,7 @@ irqreturn_t r128_driver_irq_handler(DRM_
- /* VBLANK interrupt */
- if (status & R128_CRTC_VBLANK_INT) {
- R128_WRITE(R128_GEN_INT_STATUS, R128_CRTC_VBLANK_INT_AK);
-- atomic_inc(&dev_priv->vbl_received);
-+ atomic_inc_unchecked(&dev_priv->vbl_received);
- drm_handle_vblank(dev, 0);
- return IRQ_HANDLED;
- }
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/r128/r128_state.c linux-2.6.32.45/drivers/gpu/drm/r128/r128_state.c
---- linux-2.6.32.45/drivers/gpu/drm/r128/r128_state.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/r128/r128_state.c 2011-05-04 17:56:28.000000000 -0400
-@@ -323,10 +323,10 @@ static void r128_clear_box(drm_r128_priv
-
- static void r128_cce_performance_boxes(drm_r128_private_t * dev_priv)
- {
-- if (atomic_read(&dev_priv->idle_count) == 0) {
-+ if (atomic_read_unchecked(&dev_priv->idle_count) == 0) {
- r128_clear_box(dev_priv, 64, 4, 8, 8, 0, 255, 0);
- } else {
-- atomic_set(&dev_priv->idle_count, 0);
-+ atomic_set_unchecked(&dev_priv->idle_count, 0);
- }
- }
-
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/radeon/atom.c linux-2.6.32.45/drivers/gpu/drm/radeon/atom.c
---- linux-2.6.32.45/drivers/gpu/drm/radeon/atom.c 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/radeon/atom.c 2011-05-16 21:46:57.000000000 -0400
-@@ -1115,6 +1115,8 @@ struct atom_context *atom_parse(struct c
- char name[512];
- int i;
-
-+ pax_track_stack();
-+
- ctx->card = card;
- ctx->bios = bios;
-
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/radeon/mkregtable.c linux-2.6.32.45/drivers/gpu/drm/radeon/mkregtable.c
---- linux-2.6.32.45/drivers/gpu/drm/radeon/mkregtable.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/radeon/mkregtable.c 2011-04-17 15:56:46.000000000 -0400
-@@ -637,14 +637,14 @@ static int parser_auth(struct table *t,
- regex_t mask_rex;
- regmatch_t match[4];
- char buf[1024];
-- size_t end;
-+ long end;
- int len;
- int done = 0;
- int r;
- unsigned o;
- struct offset *offset;
- char last_reg_s[10];
-- int last_reg;
-+ unsigned long last_reg;
-
- if (regcomp
- (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/radeon/radeon_atombios.c linux-2.6.32.45/drivers/gpu/drm/radeon/radeon_atombios.c
---- linux-2.6.32.45/drivers/gpu/drm/radeon/radeon_atombios.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/radeon/radeon_atombios.c 2011-05-16 21:46:57.000000000 -0400
-@@ -275,6 +275,8 @@ bool radeon_get_atom_connector_info_from
- bool linkb;
- struct radeon_i2c_bus_rec ddc_bus;
-
-+ pax_track_stack();
-+
- atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset);
-
- if (data_offset == 0)
-@@ -520,13 +522,13 @@ static uint16_t atombios_get_connector_o
- }
- }
-
--struct bios_connector {
-+static struct bios_connector {
- bool valid;
- uint16_t line_mux;
- uint16_t devices;
- int connector_type;
- struct radeon_i2c_bus_rec ddc_bus;
--};
-+} bios_connectors[ATOM_MAX_SUPPORTED_DEVICE];
-
- bool radeon_get_atom_connector_info_from_supported_devices_table(struct
- drm_device
-@@ -542,7 +544,6 @@ bool radeon_get_atom_connector_info_from
- uint8_t dac;
- union atom_supported_devices *supported_devices;
- int i, j;
-- struct bios_connector bios_connectors[ATOM_MAX_SUPPORTED_DEVICE];
-
- atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset);
-
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/radeon/radeon_display.c linux-2.6.32.45/drivers/gpu/drm/radeon/radeon_display.c
---- linux-2.6.32.45/drivers/gpu/drm/radeon/radeon_display.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/radeon/radeon_display.c 2011-04-17 15:56:46.000000000 -0400
-@@ -482,7 +482,7 @@ void radeon_compute_pll(struct radeon_pl
-
- if (flags & RADEON_PLL_PREFER_CLOSEST_LOWER) {
- error = freq - current_freq;
-- error = error < 0 ? 0xffffffff : error;
-+ error = (int32_t)error < 0 ? 0xffffffff : error;
- } else
- error = abs(current_freq - freq);
- vco_diff = abs(vco - best_vco);
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/radeon/radeon_drv.h linux-2.6.32.45/drivers/gpu/drm/radeon/radeon_drv.h
---- linux-2.6.32.45/drivers/gpu/drm/radeon/radeon_drv.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/radeon/radeon_drv.h 2011-05-04 17:56:28.000000000 -0400
-@@ -253,7 +253,7 @@ typedef struct drm_radeon_private {
-
- /* SW interrupt */
- wait_queue_head_t swi_queue;
-- atomic_t swi_emitted;
-+ atomic_unchecked_t swi_emitted;
- int vblank_crtc;
- uint32_t irq_enable_reg;
- uint32_t r500_disp_irq_reg;
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/radeon/radeon_fence.c linux-2.6.32.45/drivers/gpu/drm/radeon/radeon_fence.c
---- linux-2.6.32.45/drivers/gpu/drm/radeon/radeon_fence.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/radeon/radeon_fence.c 2011-05-04 17:56:28.000000000 -0400
-@@ -47,7 +47,7 @@ int radeon_fence_emit(struct radeon_devi
- write_unlock_irqrestore(&rdev->fence_drv.lock, irq_flags);
- return 0;
- }
-- fence->seq = atomic_add_return(1, &rdev->fence_drv.seq);
-+ fence->seq = atomic_add_return_unchecked(1, &rdev->fence_drv.seq);
- if (!rdev->cp.ready) {
- /* FIXME: cp is not running assume everythings is done right
- * away
-@@ -364,7 +364,7 @@ int radeon_fence_driver_init(struct rade
- return r;
- }
- WREG32(rdev->fence_drv.scratch_reg, 0);
-- atomic_set(&rdev->fence_drv.seq, 0);
-+ atomic_set_unchecked(&rdev->fence_drv.seq, 0);
- INIT_LIST_HEAD(&rdev->fence_drv.created);
- INIT_LIST_HEAD(&rdev->fence_drv.emited);
- INIT_LIST_HEAD(&rdev->fence_drv.signaled);
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/radeon/radeon.h linux-2.6.32.45/drivers/gpu/drm/radeon/radeon.h
---- linux-2.6.32.45/drivers/gpu/drm/radeon/radeon.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/radeon/radeon.h 2011-08-05 20:33:55.000000000 -0400
-@@ -149,7 +149,7 @@ int radeon_pm_init(struct radeon_device
- */
- struct radeon_fence_driver {
- uint32_t scratch_reg;
-- atomic_t seq;
-+ atomic_unchecked_t seq;
- uint32_t last_seq;
- unsigned long count_timeout;
- wait_queue_head_t queue;
-@@ -640,7 +640,7 @@ struct radeon_asic {
- uint32_t offset, uint32_t obj_size);
- int (*clear_surface_reg)(struct radeon_device *rdev, int reg);
- void (*bandwidth_update)(struct radeon_device *rdev);
--};
-+} __no_const;
-
- /*
- * Asic structures
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/radeon/radeon_ioc32.c linux-2.6.32.45/drivers/gpu/drm/radeon/radeon_ioc32.c
---- linux-2.6.32.45/drivers/gpu/drm/radeon/radeon_ioc32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/radeon/radeon_ioc32.c 2011-04-23 13:57:24.000000000 -0400
-@@ -368,7 +368,7 @@ static int compat_radeon_cp_setparam(str
- request = compat_alloc_user_space(sizeof(*request));
- if (!access_ok(VERIFY_WRITE, request, sizeof(*request))
- || __put_user(req32.param, &request->param)
-- || __put_user((void __user *)(unsigned long)req32.value,
-+ || __put_user((unsigned long)req32.value,
- &request->value))
- return -EFAULT;
-
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/radeon/radeon_irq.c linux-2.6.32.45/drivers/gpu/drm/radeon/radeon_irq.c
---- linux-2.6.32.45/drivers/gpu/drm/radeon/radeon_irq.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/radeon/radeon_irq.c 2011-05-04 17:56:28.000000000 -0400
-@@ -225,8 +225,8 @@ static int radeon_emit_irq(struct drm_de
- unsigned int ret;
- RING_LOCALS;
-
-- atomic_inc(&dev_priv->swi_emitted);
-- ret = atomic_read(&dev_priv->swi_emitted);
-+ atomic_inc_unchecked(&dev_priv->swi_emitted);
-+ ret = atomic_read_unchecked(&dev_priv->swi_emitted);
-
- BEGIN_RING(4);
- OUT_RING_REG(RADEON_LAST_SWI_REG, ret);
-@@ -352,7 +352,7 @@ int radeon_driver_irq_postinstall(struct
- drm_radeon_private_t *dev_priv =
- (drm_radeon_private_t *) dev->dev_private;
-
-- atomic_set(&dev_priv->swi_emitted, 0);
-+ atomic_set_unchecked(&dev_priv->swi_emitted, 0);
- DRM_INIT_WAITQUEUE(&dev_priv->swi_queue);
-
- dev->max_vblank_count = 0x001fffff;
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/radeon/radeon_state.c linux-2.6.32.45/drivers/gpu/drm/radeon/radeon_state.c
---- linux-2.6.32.45/drivers/gpu/drm/radeon/radeon_state.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/radeon/radeon_state.c 2011-04-17 15:56:46.000000000 -0400
-@@ -3021,7 +3021,7 @@ static int radeon_cp_getparam(struct drm
- {
- drm_radeon_private_t *dev_priv = dev->dev_private;
- drm_radeon_getparam_t *param = data;
-- int value;
-+ int value = 0;
-
- DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
-
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/radeon/radeon_ttm.c linux-2.6.32.45/drivers/gpu/drm/radeon/radeon_ttm.c
---- linux-2.6.32.45/drivers/gpu/drm/radeon/radeon_ttm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/radeon/radeon_ttm.c 2011-04-17 15:56:46.000000000 -0400
-@@ -535,27 +535,10 @@ void radeon_ttm_fini(struct radeon_devic
- DRM_INFO("radeon: ttm finalized\n");
- }
-
--static struct vm_operations_struct radeon_ttm_vm_ops;
--static const struct vm_operations_struct *ttm_vm_ops = NULL;
--
--static int radeon_ttm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
--{
-- struct ttm_buffer_object *bo;
-- int r;
--
-- bo = (struct ttm_buffer_object *)vma->vm_private_data;
-- if (bo == NULL) {
-- return VM_FAULT_NOPAGE;
-- }
-- r = ttm_vm_ops->fault(vma, vmf);
-- return r;
--}
--
- int radeon_mmap(struct file *filp, struct vm_area_struct *vma)
- {
- struct drm_file *file_priv;
- struct radeon_device *rdev;
-- int r;
-
- if (unlikely(vma->vm_pgoff < DRM_FILE_PAGE_OFFSET)) {
- return drm_mmap(filp, vma);
-@@ -563,20 +546,9 @@ int radeon_mmap(struct file *filp, struc
-
- file_priv = (struct drm_file *)filp->private_data;
- rdev = file_priv->minor->dev->dev_private;
-- if (rdev == NULL) {
-+ if (!rdev)
- return -EINVAL;
-- }
-- r = ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
-- if (unlikely(r != 0)) {
-- return r;
-- }
-- if (unlikely(ttm_vm_ops == NULL)) {
-- ttm_vm_ops = vma->vm_ops;
-- radeon_ttm_vm_ops = *ttm_vm_ops;
-- radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
-- }
-- vma->vm_ops = &radeon_ttm_vm_ops;
-- return 0;
-+ return ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
- }
-
-
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/radeon/rs690.c linux-2.6.32.45/drivers/gpu/drm/radeon/rs690.c
---- linux-2.6.32.45/drivers/gpu/drm/radeon/rs690.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/radeon/rs690.c 2011-04-17 15:56:46.000000000 -0400
-@@ -302,9 +302,11 @@ void rs690_crtc_bandwidth_compute(struct
- if (rdev->pm.max_bandwidth.full > rdev->pm.sideport_bandwidth.full &&
- rdev->pm.sideport_bandwidth.full)
- rdev->pm.max_bandwidth = rdev->pm.sideport_bandwidth;
-- read_delay_latency.full = rfixed_const(370 * 800 * 1000);
-+ read_delay_latency.full = rfixed_const(800 * 1000);
- read_delay_latency.full = rfixed_div(read_delay_latency,
- rdev->pm.igp_sideport_mclk);
-+ a.full = rfixed_const(370);
-+ read_delay_latency.full = rfixed_mul(read_delay_latency, a);
- } else {
- if (rdev->pm.max_bandwidth.full > rdev->pm.k8_bandwidth.full &&
- rdev->pm.k8_bandwidth.full)
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/ttm/ttm_bo.c linux-2.6.32.45/drivers/gpu/drm/ttm/ttm_bo.c
---- linux-2.6.32.45/drivers/gpu/drm/ttm/ttm_bo.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/ttm/ttm_bo.c 2011-04-23 12:56:11.000000000 -0400
-@@ -67,7 +67,7 @@ static struct attribute *ttm_bo_global_a
- NULL
- };
-
--static struct sysfs_ops ttm_bo_global_ops = {
-+static const struct sysfs_ops ttm_bo_global_ops = {
- .show = &ttm_bo_global_show
- };
-
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/ttm/ttm_bo_vm.c linux-2.6.32.45/drivers/gpu/drm/ttm/ttm_bo_vm.c
---- linux-2.6.32.45/drivers/gpu/drm/ttm/ttm_bo_vm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/ttm/ttm_bo_vm.c 2011-04-17 15:56:46.000000000 -0400
-@@ -73,7 +73,7 @@ static int ttm_bo_vm_fault(struct vm_are
- {
- struct ttm_buffer_object *bo = (struct ttm_buffer_object *)
- vma->vm_private_data;
-- struct ttm_bo_device *bdev = bo->bdev;
-+ struct ttm_bo_device *bdev;
- unsigned long bus_base;
- unsigned long bus_offset;
- unsigned long bus_size;
-@@ -88,6 +88,10 @@ static int ttm_bo_vm_fault(struct vm_are
- unsigned long address = (unsigned long)vmf->virtual_address;
- int retval = VM_FAULT_NOPAGE;
-
-+ if (!bo)
-+ return VM_FAULT_NOPAGE;
-+ bdev = bo->bdev;
-+
- /*
- * Work around locking order reversal in fault / nopfn
- * between mmap_sem and bo_reserve: Perform a trylock operation
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/ttm/ttm_global.c linux-2.6.32.45/drivers/gpu/drm/ttm/ttm_global.c
---- linux-2.6.32.45/drivers/gpu/drm/ttm/ttm_global.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/ttm/ttm_global.c 2011-04-17 15:56:46.000000000 -0400
-@@ -36,7 +36,7 @@
- struct ttm_global_item {
- struct mutex mutex;
- void *object;
-- int refcount;
-+ atomic_t refcount;
- };
-
- static struct ttm_global_item glob[TTM_GLOBAL_NUM];
-@@ -49,7 +49,7 @@ void ttm_global_init(void)
- struct ttm_global_item *item = &glob[i];
- mutex_init(&item->mutex);
- item->object = NULL;
-- item->refcount = 0;
-+ atomic_set(&item->refcount, 0);
- }
- }
-
-@@ -59,7 +59,7 @@ void ttm_global_release(void)
- for (i = 0; i < TTM_GLOBAL_NUM; ++i) {
- struct ttm_global_item *item = &glob[i];
- BUG_ON(item->object != NULL);
-- BUG_ON(item->refcount != 0);
-+ BUG_ON(atomic_read(&item->refcount) != 0);
- }
- }
-
-@@ -70,7 +70,7 @@ int ttm_global_item_ref(struct ttm_globa
- void *object;
-
- mutex_lock(&item->mutex);
-- if (item->refcount == 0) {
-+ if (atomic_read(&item->refcount) == 0) {
- item->object = kzalloc(ref->size, GFP_KERNEL);
- if (unlikely(item->object == NULL)) {
- ret = -ENOMEM;
-@@ -83,7 +83,7 @@ int ttm_global_item_ref(struct ttm_globa
- goto out_err;
-
- }
-- ++item->refcount;
-+ atomic_inc(&item->refcount);
- ref->object = item->object;
- object = item->object;
- mutex_unlock(&item->mutex);
-@@ -100,9 +100,9 @@ void ttm_global_item_unref(struct ttm_gl
- struct ttm_global_item *item = &glob[ref->global_type];
-
- mutex_lock(&item->mutex);
-- BUG_ON(item->refcount == 0);
-+ BUG_ON(atomic_read(&item->refcount) == 0);
- BUG_ON(ref->object != item->object);
-- if (--item->refcount == 0) {
-+ if (atomic_dec_and_test(&item->refcount)) {
- ref->release(ref);
- item->object = NULL;
- }
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/ttm/ttm_memory.c linux-2.6.32.45/drivers/gpu/drm/ttm/ttm_memory.c
---- linux-2.6.32.45/drivers/gpu/drm/ttm/ttm_memory.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/ttm/ttm_memory.c 2011-04-17 15:56:46.000000000 -0400
-@@ -152,7 +152,7 @@ static struct attribute *ttm_mem_zone_at
- NULL
- };
-
--static struct sysfs_ops ttm_mem_zone_ops = {
-+static const struct sysfs_ops ttm_mem_zone_ops = {
- .show = &ttm_mem_zone_show,
- .store = &ttm_mem_zone_store
- };
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/via/via_drv.h linux-2.6.32.45/drivers/gpu/drm/via/via_drv.h
---- linux-2.6.32.45/drivers/gpu/drm/via/via_drv.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/via/via_drv.h 2011-05-04 17:56:28.000000000 -0400
-@@ -51,7 +51,7 @@ typedef struct drm_via_ring_buffer {
- typedef uint32_t maskarray_t[5];
-
- typedef struct drm_via_irq {
-- atomic_t irq_received;
-+ atomic_unchecked_t irq_received;
- uint32_t pending_mask;
- uint32_t enable_mask;
- wait_queue_head_t irq_queue;
-@@ -75,7 +75,7 @@ typedef struct drm_via_private {
- struct timeval last_vblank;
- int last_vblank_valid;
- unsigned usec_per_vblank;
-- atomic_t vbl_received;
-+ atomic_unchecked_t vbl_received;
- drm_via_state_t hc_state;
- char pci_buf[VIA_PCI_BUF_SIZE];
- const uint32_t *fire_offsets[VIA_FIRE_BUF_SIZE];
-diff -urNp linux-2.6.32.45/drivers/gpu/drm/via/via_irq.c linux-2.6.32.45/drivers/gpu/drm/via/via_irq.c
---- linux-2.6.32.45/drivers/gpu/drm/via/via_irq.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/gpu/drm/via/via_irq.c 2011-05-04 17:56:28.000000000 -0400
-@@ -102,7 +102,7 @@ u32 via_get_vblank_counter(struct drm_de
- if (crtc != 0)
- return 0;
-
-- return atomic_read(&dev_priv->vbl_received);
-+ return atomic_read_unchecked(&dev_priv->vbl_received);
- }
-
- irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
-@@ -117,8 +117,8 @@ irqreturn_t via_driver_irq_handler(DRM_I
-
- status = VIA_READ(VIA_REG_INTERRUPT);
- if (status & VIA_IRQ_VBLANK_PENDING) {
-- atomic_inc(&dev_priv->vbl_received);
-- if (!(atomic_read(&dev_priv->vbl_received) & 0x0F)) {
-+ atomic_inc_unchecked(&dev_priv->vbl_received);
-+ if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0x0F)) {
- do_gettimeofday(&cur_vblank);
- if (dev_priv->last_vblank_valid) {
- dev_priv->usec_per_vblank =
-@@ -128,7 +128,7 @@ irqreturn_t via_driver_irq_handler(DRM_I
- dev_priv->last_vblank = cur_vblank;
- dev_priv->last_vblank_valid = 1;
- }
-- if (!(atomic_read(&dev_priv->vbl_received) & 0xFF)) {
-+ if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0xFF)) {
- DRM_DEBUG("US per vblank is: %u\n",
- dev_priv->usec_per_vblank);
- }
-@@ -138,7 +138,7 @@ irqreturn_t via_driver_irq_handler(DRM_I
-
- for (i = 0; i < dev_priv->num_irqs; ++i) {
- if (status & cur_irq->pending_mask) {
-- atomic_inc(&cur_irq->irq_received);
-+ atomic_inc_unchecked(&cur_irq->irq_received);
- DRM_WAKEUP(&cur_irq->irq_queue);
- handled = 1;
- if (dev_priv->irq_map[drm_via_irq_dma0_td] == i) {
-@@ -244,11 +244,11 @@ via_driver_irq_wait(struct drm_device *
- DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
- ((VIA_READ(masks[irq][2]) & masks[irq][3]) ==
- masks[irq][4]));
-- cur_irq_sequence = atomic_read(&cur_irq->irq_received);
-+ cur_irq_sequence = atomic_read_unchecked(&cur_irq->irq_received);
- } else {
- DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
- (((cur_irq_sequence =
-- atomic_read(&cur_irq->irq_received)) -
-+ atomic_read_unchecked(&cur_irq->irq_received)) -
- *sequence) <= (1 << 23)));
- }
- *sequence = cur_irq_sequence;
-@@ -286,7 +286,7 @@ void via_driver_irq_preinstall(struct dr
- }
-
- for (i = 0; i < dev_priv->num_irqs; ++i) {
-- atomic_set(&cur_irq->irq_received, 0);
-+ atomic_set_unchecked(&cur_irq->irq_received, 0);
- cur_irq->enable_mask = dev_priv->irq_masks[i][0];
- cur_irq->pending_mask = dev_priv->irq_masks[i][1];
- DRM_INIT_WAITQUEUE(&cur_irq->irq_queue);
-@@ -368,7 +368,7 @@ int via_wait_irq(struct drm_device *dev,
- switch (irqwait->request.type & ~VIA_IRQ_FLAGS_MASK) {
- case VIA_IRQ_RELATIVE:
- irqwait->request.sequence +=
-- atomic_read(&cur_irq->irq_received);
-+ atomic_read_unchecked(&cur_irq->irq_received);
- irqwait->request.type &= ~_DRM_VBLANK_RELATIVE;
- case VIA_IRQ_ABSOLUTE:
- break;
-diff -urNp linux-2.6.32.45/drivers/hid/hid-core.c linux-2.6.32.45/drivers/hid/hid-core.c
---- linux-2.6.32.45/drivers/hid/hid-core.c 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.45/drivers/hid/hid-core.c 2011-05-10 22:12:32.000000000 -0400
-@@ -1752,7 +1752,7 @@ static bool hid_ignore(struct hid_device
-
- int hid_add_device(struct hid_device *hdev)
- {
-- static atomic_t id = ATOMIC_INIT(0);
-+ static atomic_unchecked_t id = ATOMIC_INIT(0);
- int ret;
-
- if (WARN_ON(hdev->status & HID_STAT_ADDED))
-@@ -1766,7 +1766,7 @@ int hid_add_device(struct hid_device *hd
- /* XXX hack, any other cleaner solution after the driver core
- * is converted to allow more than 20 bytes as the device name? */
- dev_set_name(&hdev->dev, "%04X:%04X:%04X.%04X", hdev->bus,
-- hdev->vendor, hdev->product, atomic_inc_return(&id));
-+ hdev->vendor, hdev->product, atomic_inc_return_unchecked(&id));
-
- ret = device_add(&hdev->dev);
- if (!ret)
-diff -urNp linux-2.6.32.45/drivers/hid/usbhid/hiddev.c linux-2.6.32.45/drivers/hid/usbhid/hiddev.c
---- linux-2.6.32.45/drivers/hid/usbhid/hiddev.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/hid/usbhid/hiddev.c 2011-04-17 15:56:46.000000000 -0400
-@@ -617,7 +617,7 @@ static long hiddev_ioctl(struct file *fi
- return put_user(HID_VERSION, (int __user *)arg);
-
- case HIDIOCAPPLICATION:
-- if (arg < 0 || arg >= hid->maxapplication)
-+ if (arg >= hid->maxapplication)
- return -EINVAL;
-
- for (i = 0; i < hid->maxcollection; i++)
-diff -urNp linux-2.6.32.45/drivers/hwmon/lis3lv02d.c linux-2.6.32.45/drivers/hwmon/lis3lv02d.c
---- linux-2.6.32.45/drivers/hwmon/lis3lv02d.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/hwmon/lis3lv02d.c 2011-05-04 17:56:28.000000000 -0400
-@@ -146,7 +146,7 @@ static irqreturn_t lis302dl_interrupt(in
- * the lid is closed. This leads to interrupts as soon as a little move
- * is done.
- */
-- atomic_inc(&lis3_dev.count);
-+ atomic_inc_unchecked(&lis3_dev.count);
-
- wake_up_interruptible(&lis3_dev.misc_wait);
- kill_fasync(&lis3_dev.async_queue, SIGIO, POLL_IN);
-@@ -160,7 +160,7 @@ static int lis3lv02d_misc_open(struct in
- if (test_and_set_bit(0, &lis3_dev.misc_opened))
- return -EBUSY; /* already open */
-
-- atomic_set(&lis3_dev.count, 0);
-+ atomic_set_unchecked(&lis3_dev.count, 0);
-
- /*
- * The sensor can generate interrupts for free-fall and direction
-@@ -206,7 +206,7 @@ static ssize_t lis3lv02d_misc_read(struc
- add_wait_queue(&lis3_dev.misc_wait, &wait);
- while (true) {
- set_current_state(TASK_INTERRUPTIBLE);
-- data = atomic_xchg(&lis3_dev.count, 0);
-+ data = atomic_xchg_unchecked(&lis3_dev.count, 0);
- if (data)
- break;
-
-@@ -244,7 +244,7 @@ out:
- static unsigned int lis3lv02d_misc_poll(struct file *file, poll_table *wait)
- {
- poll_wait(file, &lis3_dev.misc_wait, wait);
-- if (atomic_read(&lis3_dev.count))
-+ if (atomic_read_unchecked(&lis3_dev.count))
- return POLLIN | POLLRDNORM;
- return 0;
- }
-diff -urNp linux-2.6.32.45/drivers/hwmon/lis3lv02d.h linux-2.6.32.45/drivers/hwmon/lis3lv02d.h
---- linux-2.6.32.45/drivers/hwmon/lis3lv02d.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/hwmon/lis3lv02d.h 2011-05-04 17:56:28.000000000 -0400
-@@ -201,7 +201,7 @@ struct lis3lv02d {
-
- struct input_polled_dev *idev; /* input device */
- struct platform_device *pdev; /* platform device */
-- atomic_t count; /* interrupt count after last read */
-+ atomic_unchecked_t count; /* interrupt count after last read */
- int xcalib; /* calibrated null value for x */
- int ycalib; /* calibrated null value for y */
- int zcalib; /* calibrated null value for z */
-diff -urNp linux-2.6.32.45/drivers/hwmon/sht15.c linux-2.6.32.45/drivers/hwmon/sht15.c
---- linux-2.6.32.45/drivers/hwmon/sht15.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/hwmon/sht15.c 2011-05-04 17:56:28.000000000 -0400
-@@ -112,7 +112,7 @@ struct sht15_data {
- int supply_uV;
- int supply_uV_valid;
- struct work_struct update_supply_work;
-- atomic_t interrupt_handled;
-+ atomic_unchecked_t interrupt_handled;
- };
-
- /**
-@@ -245,13 +245,13 @@ static inline int sht15_update_single_va
- return ret;
-
- gpio_direction_input(data->pdata->gpio_data);
-- atomic_set(&data->interrupt_handled, 0);
-+ atomic_set_unchecked(&data->interrupt_handled, 0);
-
- enable_irq(gpio_to_irq(data->pdata->gpio_data));
- if (gpio_get_value(data->pdata->gpio_data) == 0) {
- disable_irq_nosync(gpio_to_irq(data->pdata->gpio_data));
- /* Only relevant if the interrupt hasn't occured. */
-- if (!atomic_read(&data->interrupt_handled))
-+ if (!atomic_read_unchecked(&data->interrupt_handled))
- schedule_work(&data->read_work);
- }
- ret = wait_event_timeout(data->wait_queue,
-@@ -398,7 +398,7 @@ static irqreturn_t sht15_interrupt_fired
- struct sht15_data *data = d;
- /* First disable the interrupt */
- disable_irq_nosync(irq);
-- atomic_inc(&data->interrupt_handled);
-+ atomic_inc_unchecked(&data->interrupt_handled);
- /* Then schedule a reading work struct */
- if (data->flag != SHT15_READING_NOTHING)
- schedule_work(&data->read_work);
-@@ -449,11 +449,11 @@ static void sht15_bh_read_data(struct wo
- here as could have gone low in meantime so verify
- it hasn't!
- */
-- atomic_set(&data->interrupt_handled, 0);
-+ atomic_set_unchecked(&data->interrupt_handled, 0);
- enable_irq(gpio_to_irq(data->pdata->gpio_data));
- /* If still not occured or another handler has been scheduled */
- if (gpio_get_value(data->pdata->gpio_data)
-- || atomic_read(&data->interrupt_handled))
-+ || atomic_read_unchecked(&data->interrupt_handled))
- return;
- }
- /* Read the data back from the device */
-diff -urNp linux-2.6.32.45/drivers/hwmon/w83791d.c linux-2.6.32.45/drivers/hwmon/w83791d.c
---- linux-2.6.32.45/drivers/hwmon/w83791d.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/hwmon/w83791d.c 2011-04-17 15:56:46.000000000 -0400
-@@ -330,8 +330,8 @@ static int w83791d_detect(struct i2c_cli
- struct i2c_board_info *info);
- static int w83791d_remove(struct i2c_client *client);
-
--static int w83791d_read(struct i2c_client *client, u8 register);
--static int w83791d_write(struct i2c_client *client, u8 register, u8 value);
-+static int w83791d_read(struct i2c_client *client, u8 reg);
-+static int w83791d_write(struct i2c_client *client, u8 reg, u8 value);
- static struct w83791d_data *w83791d_update_device(struct device *dev);
-
- #ifdef DEBUG
-diff -urNp linux-2.6.32.45/drivers/i2c/busses/i2c-amd756-s4882.c linux-2.6.32.45/drivers/i2c/busses/i2c-amd756-s4882.c
---- linux-2.6.32.45/drivers/i2c/busses/i2c-amd756-s4882.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/i2c/busses/i2c-amd756-s4882.c 2011-08-05 20:33:55.000000000 -0400
-@@ -189,23 +189,23 @@ static int __init amd756_s4882_init(void
- }
-
- /* Fill in the new structures */
-- s4882_algo[0] = *(amd756_smbus.algo);
-- s4882_algo[0].smbus_xfer = amd756_access_virt0;
-+ memcpy((void *)&s4882_algo[0], amd756_smbus.algo, sizeof(s4882_algo[0]));
-+ *(void **)&s4882_algo[0].smbus_xfer = amd756_access_virt0;
- s4882_adapter[0] = amd756_smbus;
- s4882_adapter[0].algo = s4882_algo;
-- s4882_adapter[0].dev.parent = amd756_smbus.dev.parent;
-+ *(void **)&s4882_adapter[0].dev.parent = amd756_smbus.dev.parent;
- for (i = 1; i < 5; i++) {
-- s4882_algo[i] = *(amd756_smbus.algo);
-+ memcpy((void *)&s4882_algo[i], amd756_smbus.algo, sizeof(s4882_algo[i]));
- s4882_adapter[i] = amd756_smbus;
- snprintf(s4882_adapter[i].name, sizeof(s4882_adapter[i].name),
- "SMBus 8111 adapter (CPU%d)", i-1);
- s4882_adapter[i].algo = s4882_algo+i;
- s4882_adapter[i].dev.parent = amd756_smbus.dev.parent;
- }
-- s4882_algo[1].smbus_xfer = amd756_access_virt1;
-- s4882_algo[2].smbus_xfer = amd756_access_virt2;
-- s4882_algo[3].smbus_xfer = amd756_access_virt3;
-- s4882_algo[4].smbus_xfer = amd756_access_virt4;
-+ *(void **)&s4882_algo[1].smbus_xfer = amd756_access_virt1;
-+ *(void **)&s4882_algo[2].smbus_xfer = amd756_access_virt2;
-+ *(void **)&s4882_algo[3].smbus_xfer = amd756_access_virt3;
-+ *(void **)&s4882_algo[4].smbus_xfer = amd756_access_virt4;
-
- /* Register virtual adapters */
- for (i = 0; i < 5; i++) {
-diff -urNp linux-2.6.32.45/drivers/i2c/busses/i2c-nforce2-s4985.c linux-2.6.32.45/drivers/i2c/busses/i2c-nforce2-s4985.c
---- linux-2.6.32.45/drivers/i2c/busses/i2c-nforce2-s4985.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/i2c/busses/i2c-nforce2-s4985.c 2011-08-05 20:33:55.000000000 -0400
-@@ -184,23 +184,23 @@ static int __init nforce2_s4985_init(voi
- }
-
- /* Fill in the new structures */
-- s4985_algo[0] = *(nforce2_smbus->algo);
-- s4985_algo[0].smbus_xfer = nforce2_access_virt0;
-+ memcpy((void *)&s4985_algo[0], nforce2_smbus->algo, sizeof(s4985_algo[0]));
-+ *(void **)&s4985_algo[0].smbus_xfer = nforce2_access_virt0;
- s4985_adapter[0] = *nforce2_smbus;
- s4985_adapter[0].algo = s4985_algo;
- s4985_adapter[0].dev.parent = nforce2_smbus->dev.parent;
- for (i = 1; i < 5; i++) {
-- s4985_algo[i] = *(nforce2_smbus->algo);
-+ memcpy((void *)&s4985_algo[i], nforce2_smbus->algo, sizeof(s4985_algo[i]));
- s4985_adapter[i] = *nforce2_smbus;
- snprintf(s4985_adapter[i].name, sizeof(s4985_adapter[i].name),
- "SMBus nForce2 adapter (CPU%d)", i - 1);
- s4985_adapter[i].algo = s4985_algo + i;
- s4985_adapter[i].dev.parent = nforce2_smbus->dev.parent;
- }
-- s4985_algo[1].smbus_xfer = nforce2_access_virt1;
-- s4985_algo[2].smbus_xfer = nforce2_access_virt2;
-- s4985_algo[3].smbus_xfer = nforce2_access_virt3;
-- s4985_algo[4].smbus_xfer = nforce2_access_virt4;
-+ *(void **)&s4985_algo[1].smbus_xfer = nforce2_access_virt1;
-+ *(void **)&s4985_algo[2].smbus_xfer = nforce2_access_virt2;
-+ *(void **)&s4985_algo[3].smbus_xfer = nforce2_access_virt3;
-+ *(void **)&s4985_algo[4].smbus_xfer = nforce2_access_virt4;
-
- /* Register virtual adapters */
- for (i = 0; i < 5; i++) {
-diff -urNp linux-2.6.32.45/drivers/ide/ide-cd.c linux-2.6.32.45/drivers/ide/ide-cd.c
---- linux-2.6.32.45/drivers/ide/ide-cd.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ide/ide-cd.c 2011-04-17 15:56:46.000000000 -0400
-@@ -774,7 +774,7 @@ static void cdrom_do_block_pc(ide_drive_
- alignment = queue_dma_alignment(q) | q->dma_pad_mask;
- if ((unsigned long)buf & alignment
- || blk_rq_bytes(rq) & q->dma_pad_mask
-- || object_is_on_stack(buf))
-+ || object_starts_on_stack(buf))
- drive->dma = 0;
- }
- }
-diff -urNp linux-2.6.32.45/drivers/ide/ide-floppy.c linux-2.6.32.45/drivers/ide/ide-floppy.c
---- linux-2.6.32.45/drivers/ide/ide-floppy.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ide/ide-floppy.c 2011-05-16 21:46:57.000000000 -0400
-@@ -373,6 +373,8 @@ static int ide_floppy_get_capacity(ide_d
- u8 pc_buf[256], header_len, desc_cnt;
- int i, rc = 1, blocks, length;
-
-+ pax_track_stack();
-+
- ide_debug_log(IDE_DBG_FUNC, "enter");
-
- drive->bios_cyl = 0;
-diff -urNp linux-2.6.32.45/drivers/ide/setup-pci.c linux-2.6.32.45/drivers/ide/setup-pci.c
---- linux-2.6.32.45/drivers/ide/setup-pci.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ide/setup-pci.c 2011-05-16 21:46:57.000000000 -0400
-@@ -542,6 +542,8 @@ int ide_pci_init_two(struct pci_dev *dev
- int ret, i, n_ports = dev2 ? 4 : 2;
- struct ide_hw hw[4], *hws[] = { NULL, NULL, NULL, NULL };
-
-+ pax_track_stack();
-+
- for (i = 0; i < n_ports / 2; i++) {
- ret = ide_setup_pci_controller(pdev[i], d, !i);
- if (ret < 0)
-diff -urNp linux-2.6.32.45/drivers/ieee1394/dv1394.c linux-2.6.32.45/drivers/ieee1394/dv1394.c
---- linux-2.6.32.45/drivers/ieee1394/dv1394.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ieee1394/dv1394.c 2011-04-23 12:56:11.000000000 -0400
-@@ -739,7 +739,7 @@ static void frame_prepare(struct video_c
- based upon DIF section and sequence
- */
-
--static void inline
-+static inline void
- frame_put_packet (struct frame *f, struct packet *p)
- {
- int section_type = p->data[0] >> 5; /* section type is in bits 5 - 7 */
-diff -urNp linux-2.6.32.45/drivers/ieee1394/hosts.c linux-2.6.32.45/drivers/ieee1394/hosts.c
---- linux-2.6.32.45/drivers/ieee1394/hosts.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ieee1394/hosts.c 2011-04-17 15:56:46.000000000 -0400
-@@ -78,6 +78,7 @@ static int dummy_isoctl(struct hpsb_iso
- }
-
- static struct hpsb_host_driver dummy_driver = {
-+ .name = "dummy",
- .transmit_packet = dummy_transmit_packet,
- .devctl = dummy_devctl,
- .isoctl = dummy_isoctl
-diff -urNp linux-2.6.32.45/drivers/ieee1394/init_ohci1394_dma.c linux-2.6.32.45/drivers/ieee1394/init_ohci1394_dma.c
---- linux-2.6.32.45/drivers/ieee1394/init_ohci1394_dma.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ieee1394/init_ohci1394_dma.c 2011-04-17 15:56:46.000000000 -0400
-@@ -257,7 +257,7 @@ void __init init_ohci1394_dma_on_all_con
- for (func = 0; func < 8; func++) {
- u32 class = read_pci_config(num,slot,func,
- PCI_CLASS_REVISION);
-- if ((class == 0xffffffff))
-+ if (class == 0xffffffff)
- continue; /* No device at this func */
-
- if (class>>8 != PCI_CLASS_SERIAL_FIREWIRE_OHCI)
-diff -urNp linux-2.6.32.45/drivers/ieee1394/ohci1394.c linux-2.6.32.45/drivers/ieee1394/ohci1394.c
---- linux-2.6.32.45/drivers/ieee1394/ohci1394.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ieee1394/ohci1394.c 2011-04-23 12:56:11.000000000 -0400
-@@ -147,9 +147,9 @@ printk(level "%s: " fmt "\n" , OHCI1394_
- printk(level "%s: fw-host%d: " fmt "\n" , OHCI1394_DRIVER_NAME, ohci->host->id , ## args)
-
- /* Module Parameters */
--static int phys_dma = 1;
-+static int phys_dma;
- module_param(phys_dma, int, 0444);
--MODULE_PARM_DESC(phys_dma, "Enable physical DMA (default = 1).");
-+MODULE_PARM_DESC(phys_dma, "Enable physical DMA (default = 0).");
-
- static void dma_trm_tasklet(unsigned long data);
- static void dma_trm_reset(struct dma_trm_ctx *d);
-diff -urNp linux-2.6.32.45/drivers/ieee1394/sbp2.c linux-2.6.32.45/drivers/ieee1394/sbp2.c
---- linux-2.6.32.45/drivers/ieee1394/sbp2.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ieee1394/sbp2.c 2011-04-23 12:56:11.000000000 -0400
-@@ -2111,7 +2111,7 @@ MODULE_DESCRIPTION("IEEE-1394 SBP-2 prot
- MODULE_SUPPORTED_DEVICE(SBP2_DEVICE_NAME);
- MODULE_LICENSE("GPL");
-
--static int sbp2_module_init(void)
-+static int __init sbp2_module_init(void)
- {
- int ret;
-
-diff -urNp linux-2.6.32.45/drivers/infiniband/core/cm.c linux-2.6.32.45/drivers/infiniband/core/cm.c
---- linux-2.6.32.45/drivers/infiniband/core/cm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/infiniband/core/cm.c 2011-04-17 15:56:46.000000000 -0400
-@@ -112,7 +112,7 @@ static char const counter_group_names[CM
-
- struct cm_counter_group {
- struct kobject obj;
-- atomic_long_t counter[CM_ATTR_COUNT];
-+ atomic_long_unchecked_t counter[CM_ATTR_COUNT];
- };
-
- struct cm_counter_attribute {
-@@ -1386,7 +1386,7 @@ static void cm_dup_req_handler(struct cm
- struct ib_mad_send_buf *msg = NULL;
- int ret;
-
-- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- counter[CM_REQ_COUNTER]);
-
- /* Quick state check to discard duplicate REQs. */
-@@ -1764,7 +1764,7 @@ static void cm_dup_rep_handler(struct cm
- if (!cm_id_priv)
- return;
-
-- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- counter[CM_REP_COUNTER]);
- ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
- if (ret)
-@@ -1931,7 +1931,7 @@ static int cm_rtu_handler(struct cm_work
- if (cm_id_priv->id.state != IB_CM_REP_SENT &&
- cm_id_priv->id.state != IB_CM_MRA_REP_RCVD) {
- spin_unlock_irq(&cm_id_priv->lock);
-- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- counter[CM_RTU_COUNTER]);
- goto out;
- }
-@@ -2110,7 +2110,7 @@ static int cm_dreq_handler(struct cm_wor
- cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id,
- dreq_msg->local_comm_id);
- if (!cm_id_priv) {
-- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- counter[CM_DREQ_COUNTER]);
- cm_issue_drep(work->port, work->mad_recv_wc);
- return -EINVAL;
-@@ -2131,7 +2131,7 @@ static int cm_dreq_handler(struct cm_wor
- case IB_CM_MRA_REP_RCVD:
- break;
- case IB_CM_TIMEWAIT:
-- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- counter[CM_DREQ_COUNTER]);
- if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
- goto unlock;
-@@ -2145,7 +2145,7 @@ static int cm_dreq_handler(struct cm_wor
- cm_free_msg(msg);
- goto deref;
- case IB_CM_DREQ_RCVD:
-- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- counter[CM_DREQ_COUNTER]);
- goto unlock;
- default:
-@@ -2501,7 +2501,7 @@ static int cm_mra_handler(struct cm_work
- ib_modify_mad(cm_id_priv->av.port->mad_agent,
- cm_id_priv->msg, timeout)) {
- if (cm_id_priv->id.lap_state == IB_CM_MRA_LAP_RCVD)
-- atomic_long_inc(&work->port->
-+ atomic_long_inc_unchecked(&work->port->
- counter_group[CM_RECV_DUPLICATES].
- counter[CM_MRA_COUNTER]);
- goto out;
-@@ -2510,7 +2510,7 @@ static int cm_mra_handler(struct cm_work
- break;
- case IB_CM_MRA_REQ_RCVD:
- case IB_CM_MRA_REP_RCVD:
-- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- counter[CM_MRA_COUNTER]);
- /* fall through */
- default:
-@@ -2672,7 +2672,7 @@ static int cm_lap_handler(struct cm_work
- case IB_CM_LAP_IDLE:
- break;
- case IB_CM_MRA_LAP_SENT:
-- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- counter[CM_LAP_COUNTER]);
- if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
- goto unlock;
-@@ -2688,7 +2688,7 @@ static int cm_lap_handler(struct cm_work
- cm_free_msg(msg);
- goto deref;
- case IB_CM_LAP_RCVD:
-- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- counter[CM_LAP_COUNTER]);
- goto unlock;
- default:
-@@ -2972,7 +2972,7 @@ static int cm_sidr_req_handler(struct cm
- cur_cm_id_priv = cm_insert_remote_sidr(cm_id_priv);
- if (cur_cm_id_priv) {
- spin_unlock_irq(&cm.lock);
-- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- counter[CM_SIDR_REQ_COUNTER]);
- goto out; /* Duplicate message. */
- }
-@@ -3184,10 +3184,10 @@ static void cm_send_handler(struct ib_ma
- if (!msg->context[0] && (attr_index != CM_REJ_COUNTER))
- msg->retries = 1;
-
-- atomic_long_add(1 + msg->retries,
-+ atomic_long_add_unchecked(1 + msg->retries,
- &port->counter_group[CM_XMIT].counter[attr_index]);
- if (msg->retries)
-- atomic_long_add(msg->retries,
-+ atomic_long_add_unchecked(msg->retries,
- &port->counter_group[CM_XMIT_RETRIES].
- counter[attr_index]);
-
-@@ -3397,7 +3397,7 @@ static void cm_recv_handler(struct ib_ma
- }
-
- attr_id = be16_to_cpu(mad_recv_wc->recv_buf.mad->mad_hdr.attr_id);
-- atomic_long_inc(&port->counter_group[CM_RECV].
-+ atomic_long_inc_unchecked(&port->counter_group[CM_RECV].
- counter[attr_id - CM_ATTR_ID_OFFSET]);
-
- work = kmalloc(sizeof *work + sizeof(struct ib_sa_path_rec) * paths,
-@@ -3595,10 +3595,10 @@ static ssize_t cm_show_counter(struct ko
- cm_attr = container_of(attr, struct cm_counter_attribute, attr);
-
- return sprintf(buf, "%ld\n",
-- atomic_long_read(&group->counter[cm_attr->index]));
-+ atomic_long_read_unchecked(&group->counter[cm_attr->index]));
- }
-
--static struct sysfs_ops cm_counter_ops = {
-+static const struct sysfs_ops cm_counter_ops = {
- .show = cm_show_counter
- };
-
-diff -urNp linux-2.6.32.45/drivers/infiniband/core/fmr_pool.c linux-2.6.32.45/drivers/infiniband/core/fmr_pool.c
---- linux-2.6.32.45/drivers/infiniband/core/fmr_pool.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/infiniband/core/fmr_pool.c 2011-05-04 17:56:28.000000000 -0400
-@@ -97,8 +97,8 @@ struct ib_fmr_pool {
-
- struct task_struct *thread;
-
-- atomic_t req_ser;
-- atomic_t flush_ser;
-+ atomic_unchecked_t req_ser;
-+ atomic_unchecked_t flush_ser;
-
- wait_queue_head_t force_wait;
- };
-@@ -179,10 +179,10 @@ static int ib_fmr_cleanup_thread(void *p
- struct ib_fmr_pool *pool = pool_ptr;
-
- do {
-- if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) < 0) {
-+ if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) < 0) {
- ib_fmr_batch_release(pool);
-
-- atomic_inc(&pool->flush_ser);
-+ atomic_inc_unchecked(&pool->flush_ser);
- wake_up_interruptible(&pool->force_wait);
-
- if (pool->flush_function)
-@@ -190,7 +190,7 @@ static int ib_fmr_cleanup_thread(void *p
- }
-
- set_current_state(TASK_INTERRUPTIBLE);
-- if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) >= 0 &&
-+ if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) >= 0 &&
- !kthread_should_stop())
- schedule();
- __set_current_state(TASK_RUNNING);
-@@ -282,8 +282,8 @@ struct ib_fmr_pool *ib_create_fmr_pool(s
- pool->dirty_watermark = params->dirty_watermark;
- pool->dirty_len = 0;
- spin_lock_init(&pool->pool_lock);
-- atomic_set(&pool->req_ser, 0);
-- atomic_set(&pool->flush_ser, 0);
-+ atomic_set_unchecked(&pool->req_ser, 0);
-+ atomic_set_unchecked(&pool->flush_ser, 0);
- init_waitqueue_head(&pool->force_wait);
-
- pool->thread = kthread_run(ib_fmr_cleanup_thread,
-@@ -411,11 +411,11 @@ int ib_flush_fmr_pool(struct ib_fmr_pool
- }
- spin_unlock_irq(&pool->pool_lock);
-
-- serial = atomic_inc_return(&pool->req_ser);
-+ serial = atomic_inc_return_unchecked(&pool->req_ser);
- wake_up_process(pool->thread);
-
- if (wait_event_interruptible(pool->force_wait,
-- atomic_read(&pool->flush_ser) - serial >= 0))
-+ atomic_read_unchecked(&pool->flush_ser) - serial >= 0))
- return -EINTR;
-
- return 0;
-@@ -525,7 +525,7 @@ int ib_fmr_pool_unmap(struct ib_pool_fmr
- } else {
- list_add_tail(&fmr->list, &pool->dirty_list);
- if (++pool->dirty_len >= pool->dirty_watermark) {
-- atomic_inc(&pool->req_ser);
-+ atomic_inc_unchecked(&pool->req_ser);
- wake_up_process(pool->thread);
- }
- }
-diff -urNp linux-2.6.32.45/drivers/infiniband/core/sysfs.c linux-2.6.32.45/drivers/infiniband/core/sysfs.c
---- linux-2.6.32.45/drivers/infiniband/core/sysfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/infiniband/core/sysfs.c 2011-04-17 15:56:46.000000000 -0400
-@@ -79,7 +79,7 @@ static ssize_t port_attr_show(struct kob
- return port_attr->show(p, port_attr, buf);
- }
-
--static struct sysfs_ops port_sysfs_ops = {
-+static const struct sysfs_ops port_sysfs_ops = {
- .show = port_attr_show
- };
-
-diff -urNp linux-2.6.32.45/drivers/infiniband/core/uverbs_marshall.c linux-2.6.32.45/drivers/infiniband/core/uverbs_marshall.c
---- linux-2.6.32.45/drivers/infiniband/core/uverbs_marshall.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/infiniband/core/uverbs_marshall.c 2011-04-17 15:56:46.000000000 -0400
-@@ -40,18 +40,21 @@ void ib_copy_ah_attr_to_user(struct ib_u
- dst->grh.sgid_index = src->grh.sgid_index;
- dst->grh.hop_limit = src->grh.hop_limit;
- dst->grh.traffic_class = src->grh.traffic_class;
-+ memset(&dst->grh.reserved, 0, sizeof(dst->grh.reserved));
- dst->dlid = src->dlid;
- dst->sl = src->sl;
- dst->src_path_bits = src->src_path_bits;
- dst->static_rate = src->static_rate;
- dst->is_global = src->ah_flags & IB_AH_GRH ? 1 : 0;
- dst->port_num = src->port_num;
-+ dst->reserved = 0;
- }
- EXPORT_SYMBOL(ib_copy_ah_attr_to_user);
-
- void ib_copy_qp_attr_to_user(struct ib_uverbs_qp_attr *dst,
- struct ib_qp_attr *src)
- {
-+ dst->qp_state = src->qp_state;
- dst->cur_qp_state = src->cur_qp_state;
- dst->path_mtu = src->path_mtu;
- dst->path_mig_state = src->path_mig_state;
-@@ -83,6 +86,7 @@ void ib_copy_qp_attr_to_user(struct ib_u
- dst->rnr_retry = src->rnr_retry;
- dst->alt_port_num = src->alt_port_num;
- dst->alt_timeout = src->alt_timeout;
-+ memset(dst->reserved, 0, sizeof(dst->reserved));
- }
- EXPORT_SYMBOL(ib_copy_qp_attr_to_user);
-
-diff -urNp linux-2.6.32.45/drivers/infiniband/hw/ipath/ipath_fs.c linux-2.6.32.45/drivers/infiniband/hw/ipath/ipath_fs.c
---- linux-2.6.32.45/drivers/infiniband/hw/ipath/ipath_fs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/infiniband/hw/ipath/ipath_fs.c 2011-05-16 21:46:57.000000000 -0400
-@@ -110,6 +110,8 @@ static ssize_t atomic_counters_read(stru
- struct infinipath_counters counters;
- struct ipath_devdata *dd;
-
-+ pax_track_stack();
-+
- dd = file->f_path.dentry->d_inode->i_private;
- dd->ipath_f_read_counters(dd, &counters);
-
-diff -urNp linux-2.6.32.45/drivers/infiniband/hw/nes/nes.c linux-2.6.32.45/drivers/infiniband/hw/nes/nes.c
---- linux-2.6.32.45/drivers/infiniband/hw/nes/nes.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/infiniband/hw/nes/nes.c 2011-05-04 17:56:28.000000000 -0400
-@@ -102,7 +102,7 @@ MODULE_PARM_DESC(limit_maxrdreqsz, "Limi
- LIST_HEAD(nes_adapter_list);
- static LIST_HEAD(nes_dev_list);
-
--atomic_t qps_destroyed;
-+atomic_unchecked_t qps_destroyed;
-
- static unsigned int ee_flsh_adapter;
- static unsigned int sysfs_nonidx_addr;
-@@ -259,7 +259,7 @@ static void nes_cqp_rem_ref_callback(str
- struct nes_adapter *nesadapter = nesdev->nesadapter;
- u32 qp_id;
-
-- atomic_inc(&qps_destroyed);
-+ atomic_inc_unchecked(&qps_destroyed);
-
- /* Free the control structures */
-
-diff -urNp linux-2.6.32.45/drivers/infiniband/hw/nes/nes_cm.c linux-2.6.32.45/drivers/infiniband/hw/nes/nes_cm.c
---- linux-2.6.32.45/drivers/infiniband/hw/nes/nes_cm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/infiniband/hw/nes/nes_cm.c 2011-05-04 17:56:28.000000000 -0400
-@@ -69,11 +69,11 @@ u32 cm_packets_received;
- u32 cm_listens_created;
- u32 cm_listens_destroyed;
- u32 cm_backlog_drops;
--atomic_t cm_loopbacks;
--atomic_t cm_nodes_created;
--atomic_t cm_nodes_destroyed;
--atomic_t cm_accel_dropped_pkts;
--atomic_t cm_resets_recvd;
-+atomic_unchecked_t cm_loopbacks;
-+atomic_unchecked_t cm_nodes_created;
-+atomic_unchecked_t cm_nodes_destroyed;
-+atomic_unchecked_t cm_accel_dropped_pkts;
-+atomic_unchecked_t cm_resets_recvd;
-
- static inline int mini_cm_accelerated(struct nes_cm_core *,
- struct nes_cm_node *);
-@@ -149,13 +149,13 @@ static struct nes_cm_ops nes_cm_api = {
-
- static struct nes_cm_core *g_cm_core;
-
--atomic_t cm_connects;
--atomic_t cm_accepts;
--atomic_t cm_disconnects;
--atomic_t cm_closes;
--atomic_t cm_connecteds;
--atomic_t cm_connect_reqs;
--atomic_t cm_rejects;
-+atomic_unchecked_t cm_connects;
-+atomic_unchecked_t cm_accepts;
-+atomic_unchecked_t cm_disconnects;
-+atomic_unchecked_t cm_closes;
-+atomic_unchecked_t cm_connecteds;
-+atomic_unchecked_t cm_connect_reqs;
-+atomic_unchecked_t cm_rejects;
-
-
- /**
-@@ -1195,7 +1195,7 @@ static struct nes_cm_node *make_cm_node(
- cm_node->rem_mac);
-
- add_hte_node(cm_core, cm_node);
-- atomic_inc(&cm_nodes_created);
-+ atomic_inc_unchecked(&cm_nodes_created);
-
- return cm_node;
- }
-@@ -1253,7 +1253,7 @@ static int rem_ref_cm_node(struct nes_cm
- }
-
- atomic_dec(&cm_core->node_cnt);
-- atomic_inc(&cm_nodes_destroyed);
-+ atomic_inc_unchecked(&cm_nodes_destroyed);
- nesqp = cm_node->nesqp;
- if (nesqp) {
- nesqp->cm_node = NULL;
-@@ -1320,7 +1320,7 @@ static int process_options(struct nes_cm
-
- static void drop_packet(struct sk_buff *skb)
- {
-- atomic_inc(&cm_accel_dropped_pkts);
-+ atomic_inc_unchecked(&cm_accel_dropped_pkts);
- dev_kfree_skb_any(skb);
- }
-
-@@ -1377,7 +1377,7 @@ static void handle_rst_pkt(struct nes_cm
-
- int reset = 0; /* whether to send reset in case of err.. */
- int passive_state;
-- atomic_inc(&cm_resets_recvd);
-+ atomic_inc_unchecked(&cm_resets_recvd);
- nes_debug(NES_DBG_CM, "Received Reset, cm_node = %p, state = %u."
- " refcnt=%d\n", cm_node, cm_node->state,
- atomic_read(&cm_node->ref_count));
-@@ -2000,7 +2000,7 @@ static struct nes_cm_node *mini_cm_conne
- rem_ref_cm_node(cm_node->cm_core, cm_node);
- return NULL;
- }
-- atomic_inc(&cm_loopbacks);
-+ atomic_inc_unchecked(&cm_loopbacks);
- loopbackremotenode->loopbackpartner = cm_node;
- loopbackremotenode->tcp_cntxt.rcv_wscale =
- NES_CM_DEFAULT_RCV_WND_SCALE;
-@@ -2262,7 +2262,7 @@ static int mini_cm_recv_pkt(struct nes_c
- add_ref_cm_node(cm_node);
- } else if (cm_node->state == NES_CM_STATE_TSA) {
- rem_ref_cm_node(cm_core, cm_node);
-- atomic_inc(&cm_accel_dropped_pkts);
-+ atomic_inc_unchecked(&cm_accel_dropped_pkts);
- dev_kfree_skb_any(skb);
- break;
- }
-@@ -2568,7 +2568,7 @@ static int nes_cm_disconn_true(struct ne
-
- if ((cm_id) && (cm_id->event_handler)) {
- if (issue_disconn) {
-- atomic_inc(&cm_disconnects);
-+ atomic_inc_unchecked(&cm_disconnects);
- cm_event.event = IW_CM_EVENT_DISCONNECT;
- cm_event.status = disconn_status;
- cm_event.local_addr = cm_id->local_addr;
-@@ -2590,7 +2590,7 @@ static int nes_cm_disconn_true(struct ne
- }
-
- if (issue_close) {
-- atomic_inc(&cm_closes);
-+ atomic_inc_unchecked(&cm_closes);
- nes_disconnect(nesqp, 1);
-
- cm_id->provider_data = nesqp;
-@@ -2710,7 +2710,7 @@ int nes_accept(struct iw_cm_id *cm_id, s
-
- nes_debug(NES_DBG_CM, "QP%u, cm_node=%p, jiffies = %lu listener = %p\n",
- nesqp->hwqp.qp_id, cm_node, jiffies, cm_node->listener);
-- atomic_inc(&cm_accepts);
-+ atomic_inc_unchecked(&cm_accepts);
-
- nes_debug(NES_DBG_CM, "netdev refcnt = %u.\n",
- atomic_read(&nesvnic->netdev->refcnt));
-@@ -2919,7 +2919,7 @@ int nes_reject(struct iw_cm_id *cm_id, c
-
- struct nes_cm_core *cm_core;
-
-- atomic_inc(&cm_rejects);
-+ atomic_inc_unchecked(&cm_rejects);
- cm_node = (struct nes_cm_node *) cm_id->provider_data;
- loopback = cm_node->loopbackpartner;
- cm_core = cm_node->cm_core;
-@@ -2982,7 +2982,7 @@ int nes_connect(struct iw_cm_id *cm_id,
- ntohl(cm_id->local_addr.sin_addr.s_addr),
- ntohs(cm_id->local_addr.sin_port));
-
-- atomic_inc(&cm_connects);
-+ atomic_inc_unchecked(&cm_connects);
- nesqp->active_conn = 1;
-
- /* cache the cm_id in the qp */
-@@ -3195,7 +3195,7 @@ static void cm_event_connected(struct ne
- if (nesqp->destroyed) {
- return;
- }
-- atomic_inc(&cm_connecteds);
-+ atomic_inc_unchecked(&cm_connecteds);
- nes_debug(NES_DBG_CM, "QP%u attempting to connect to 0x%08X:0x%04X on"
- " local port 0x%04X. jiffies = %lu.\n",
- nesqp->hwqp.qp_id,
-@@ -3403,7 +3403,7 @@ static void cm_event_reset(struct nes_cm
-
- ret = cm_id->event_handler(cm_id, &cm_event);
- cm_id->add_ref(cm_id);
-- atomic_inc(&cm_closes);
-+ atomic_inc_unchecked(&cm_closes);
- cm_event.event = IW_CM_EVENT_CLOSE;
- cm_event.status = IW_CM_EVENT_STATUS_OK;
- cm_event.provider_data = cm_id->provider_data;
-@@ -3439,7 +3439,7 @@ static void cm_event_mpa_req(struct nes_
- return;
- cm_id = cm_node->cm_id;
-
-- atomic_inc(&cm_connect_reqs);
-+ atomic_inc_unchecked(&cm_connect_reqs);
- nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
- cm_node, cm_id, jiffies);
-
-@@ -3477,7 +3477,7 @@ static void cm_event_mpa_reject(struct n
- return;
- cm_id = cm_node->cm_id;
-
-- atomic_inc(&cm_connect_reqs);
-+ atomic_inc_unchecked(&cm_connect_reqs);
- nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
- cm_node, cm_id, jiffies);
-
-diff -urNp linux-2.6.32.45/drivers/infiniband/hw/nes/nes.h linux-2.6.32.45/drivers/infiniband/hw/nes/nes.h
---- linux-2.6.32.45/drivers/infiniband/hw/nes/nes.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/infiniband/hw/nes/nes.h 2011-05-04 17:56:28.000000000 -0400
-@@ -174,17 +174,17 @@ extern unsigned int nes_debug_level;
- extern unsigned int wqm_quanta;
- extern struct list_head nes_adapter_list;
-
--extern atomic_t cm_connects;
--extern atomic_t cm_accepts;
--extern atomic_t cm_disconnects;
--extern atomic_t cm_closes;
--extern atomic_t cm_connecteds;
--extern atomic_t cm_connect_reqs;
--extern atomic_t cm_rejects;
--extern atomic_t mod_qp_timouts;
--extern atomic_t qps_created;
--extern atomic_t qps_destroyed;
--extern atomic_t sw_qps_destroyed;
-+extern atomic_unchecked_t cm_connects;
-+extern atomic_unchecked_t cm_accepts;
-+extern atomic_unchecked_t cm_disconnects;
-+extern atomic_unchecked_t cm_closes;
-+extern atomic_unchecked_t cm_connecteds;
-+extern atomic_unchecked_t cm_connect_reqs;
-+extern atomic_unchecked_t cm_rejects;
-+extern atomic_unchecked_t mod_qp_timouts;
-+extern atomic_unchecked_t qps_created;
-+extern atomic_unchecked_t qps_destroyed;
-+extern atomic_unchecked_t sw_qps_destroyed;
- extern u32 mh_detected;
- extern u32 mh_pauses_sent;
- extern u32 cm_packets_sent;
-@@ -196,11 +196,11 @@ extern u32 cm_packets_retrans;
- extern u32 cm_listens_created;
- extern u32 cm_listens_destroyed;
- extern u32 cm_backlog_drops;
--extern atomic_t cm_loopbacks;
--extern atomic_t cm_nodes_created;
--extern atomic_t cm_nodes_destroyed;
--extern atomic_t cm_accel_dropped_pkts;
--extern atomic_t cm_resets_recvd;
-+extern atomic_unchecked_t cm_loopbacks;
-+extern atomic_unchecked_t cm_nodes_created;
-+extern atomic_unchecked_t cm_nodes_destroyed;
-+extern atomic_unchecked_t cm_accel_dropped_pkts;
-+extern atomic_unchecked_t cm_resets_recvd;
-
- extern u32 int_mod_timer_init;
- extern u32 int_mod_cq_depth_256;
-diff -urNp linux-2.6.32.45/drivers/infiniband/hw/nes/nes_nic.c linux-2.6.32.45/drivers/infiniband/hw/nes/nes_nic.c
---- linux-2.6.32.45/drivers/infiniband/hw/nes/nes_nic.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/infiniband/hw/nes/nes_nic.c 2011-05-04 17:56:28.000000000 -0400
-@@ -1210,17 +1210,17 @@ static void nes_netdev_get_ethtool_stats
- target_stat_values[++index] = mh_detected;
- target_stat_values[++index] = mh_pauses_sent;
- target_stat_values[++index] = nesvnic->endnode_ipv4_tcp_retransmits;
-- target_stat_values[++index] = atomic_read(&cm_connects);
-- target_stat_values[++index] = atomic_read(&cm_accepts);
-- target_stat_values[++index] = atomic_read(&cm_disconnects);
-- target_stat_values[++index] = atomic_read(&cm_connecteds);
-- target_stat_values[++index] = atomic_read(&cm_connect_reqs);
-- target_stat_values[++index] = atomic_read(&cm_rejects);
-- target_stat_values[++index] = atomic_read(&mod_qp_timouts);
-- target_stat_values[++index] = atomic_read(&qps_created);
-- target_stat_values[++index] = atomic_read(&sw_qps_destroyed);
-- target_stat_values[++index] = atomic_read(&qps_destroyed);
-- target_stat_values[++index] = atomic_read(&cm_closes);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_connects);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_accepts);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_disconnects);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_connecteds);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_connect_reqs);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_rejects);
-+ target_stat_values[++index] = atomic_read_unchecked(&mod_qp_timouts);
-+ target_stat_values[++index] = atomic_read_unchecked(&qps_created);
-+ target_stat_values[++index] = atomic_read_unchecked(&sw_qps_destroyed);
-+ target_stat_values[++index] = atomic_read_unchecked(&qps_destroyed);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_closes);
- target_stat_values[++index] = cm_packets_sent;
- target_stat_values[++index] = cm_packets_bounced;
- target_stat_values[++index] = cm_packets_created;
-@@ -1230,11 +1230,11 @@ static void nes_netdev_get_ethtool_stats
- target_stat_values[++index] = cm_listens_created;
- target_stat_values[++index] = cm_listens_destroyed;
- target_stat_values[++index] = cm_backlog_drops;
-- target_stat_values[++index] = atomic_read(&cm_loopbacks);
-- target_stat_values[++index] = atomic_read(&cm_nodes_created);
-- target_stat_values[++index] = atomic_read(&cm_nodes_destroyed);
-- target_stat_values[++index] = atomic_read(&cm_accel_dropped_pkts);
-- target_stat_values[++index] = atomic_read(&cm_resets_recvd);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_loopbacks);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_created);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_destroyed);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_accel_dropped_pkts);
-+ target_stat_values[++index] = atomic_read_unchecked(&cm_resets_recvd);
- target_stat_values[++index] = int_mod_timer_init;
- target_stat_values[++index] = int_mod_cq_depth_1;
- target_stat_values[++index] = int_mod_cq_depth_4;
-diff -urNp linux-2.6.32.45/drivers/infiniband/hw/nes/nes_verbs.c linux-2.6.32.45/drivers/infiniband/hw/nes/nes_verbs.c
---- linux-2.6.32.45/drivers/infiniband/hw/nes/nes_verbs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/infiniband/hw/nes/nes_verbs.c 2011-05-04 17:56:28.000000000 -0400
-@@ -45,9 +45,9 @@
-
- #include <rdma/ib_umem.h>
-
--atomic_t mod_qp_timouts;
--atomic_t qps_created;
--atomic_t sw_qps_destroyed;
-+atomic_unchecked_t mod_qp_timouts;
-+atomic_unchecked_t qps_created;
-+atomic_unchecked_t sw_qps_destroyed;
-
- static void nes_unregister_ofa_device(struct nes_ib_device *nesibdev);
-
-@@ -1240,7 +1240,7 @@ static struct ib_qp *nes_create_qp(struc
- if (init_attr->create_flags)
- return ERR_PTR(-EINVAL);
-
-- atomic_inc(&qps_created);
-+ atomic_inc_unchecked(&qps_created);
- switch (init_attr->qp_type) {
- case IB_QPT_RC:
- if (nes_drv_opt & NES_DRV_OPT_NO_INLINE_DATA) {
-@@ -1568,7 +1568,7 @@ static int nes_destroy_qp(struct ib_qp *
- struct iw_cm_event cm_event;
- int ret;
-
-- atomic_inc(&sw_qps_destroyed);
-+ atomic_inc_unchecked(&sw_qps_destroyed);
- nesqp->destroyed = 1;
-
- /* Blow away the connection if it exists. */
-diff -urNp linux-2.6.32.45/drivers/input/gameport/gameport.c linux-2.6.32.45/drivers/input/gameport/gameport.c
---- linux-2.6.32.45/drivers/input/gameport/gameport.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/input/gameport/gameport.c 2011-05-04 17:56:28.000000000 -0400
-@@ -515,13 +515,13 @@ EXPORT_SYMBOL(gameport_set_phys);
- */
- static void gameport_init_port(struct gameport *gameport)
- {
-- static atomic_t gameport_no = ATOMIC_INIT(0);
-+ static atomic_unchecked_t gameport_no = ATOMIC_INIT(0);
-
- __module_get(THIS_MODULE);
-
- mutex_init(&gameport->drv_mutex);
- device_initialize(&gameport->dev);
-- dev_set_name(&gameport->dev, "gameport%lu", (unsigned long)atomic_inc_return(&gameport_no) - 1);
-+ dev_set_name(&gameport->dev, "gameport%lu", (unsigned long)atomic_inc_return_unchecked(&gameport_no) - 1);
- gameport->dev.bus = &gameport_bus;
- gameport->dev.release = gameport_release_port;
- if (gameport->parent)
-diff -urNp linux-2.6.32.45/drivers/input/input.c linux-2.6.32.45/drivers/input/input.c
---- linux-2.6.32.45/drivers/input/input.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/input/input.c 2011-05-04 17:56:28.000000000 -0400
-@@ -1558,7 +1558,7 @@ EXPORT_SYMBOL(input_set_capability);
- */
- int input_register_device(struct input_dev *dev)
- {
-- static atomic_t input_no = ATOMIC_INIT(0);
-+ static atomic_unchecked_t input_no = ATOMIC_INIT(0);
- struct input_handler *handler;
- const char *path;
- int error;
-@@ -1585,7 +1585,7 @@ int input_register_device(struct input_d
- dev->setkeycode = input_default_setkeycode;
-
- dev_set_name(&dev->dev, "input%ld",
-- (unsigned long) atomic_inc_return(&input_no) - 1);
-+ (unsigned long) atomic_inc_return_unchecked(&input_no) - 1);
-
- error = device_add(&dev->dev);
- if (error)
-diff -urNp linux-2.6.32.45/drivers/input/joystick/sidewinder.c linux-2.6.32.45/drivers/input/joystick/sidewinder.c
---- linux-2.6.32.45/drivers/input/joystick/sidewinder.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/input/joystick/sidewinder.c 2011-05-18 20:09:36.000000000 -0400
-@@ -30,6 +30,7 @@
- #include <linux/kernel.h>
- #include <linux/module.h>
- #include <linux/slab.h>
-+#include <linux/sched.h>
- #include <linux/init.h>
- #include <linux/input.h>
- #include <linux/gameport.h>
-@@ -428,6 +429,8 @@ static int sw_read(struct sw *sw)
- unsigned char buf[SW_LENGTH];
- int i;
-
-+ pax_track_stack();
-+
- i = sw_read_packet(sw->gameport, buf, sw->length, 0);
-
- if (sw->type == SW_ID_3DP && sw->length == 66 && i != 66) { /* Broken packet, try to fix */
-diff -urNp linux-2.6.32.45/drivers/input/joystick/xpad.c linux-2.6.32.45/drivers/input/joystick/xpad.c
---- linux-2.6.32.45/drivers/input/joystick/xpad.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/input/joystick/xpad.c 2011-05-04 17:56:28.000000000 -0400
-@@ -621,7 +621,7 @@ static void xpad_led_set(struct led_clas
-
- static int xpad_led_probe(struct usb_xpad *xpad)
- {
-- static atomic_t led_seq = ATOMIC_INIT(0);
-+ static atomic_unchecked_t led_seq = ATOMIC_INIT(0);
- long led_no;
- struct xpad_led *led;
- struct led_classdev *led_cdev;
-@@ -634,7 +634,7 @@ static int xpad_led_probe(struct usb_xpa
- if (!led)
- return -ENOMEM;
-
-- led_no = (long)atomic_inc_return(&led_seq) - 1;
-+ led_no = (long)atomic_inc_return_unchecked(&led_seq) - 1;
-
- snprintf(led->name, sizeof(led->name), "xpad%ld", led_no);
- led->xpad = xpad;
-diff -urNp linux-2.6.32.45/drivers/input/serio/serio.c linux-2.6.32.45/drivers/input/serio/serio.c
---- linux-2.6.32.45/drivers/input/serio/serio.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/input/serio/serio.c 2011-05-04 17:56:28.000000000 -0400
-@@ -527,7 +527,7 @@ static void serio_release_port(struct de
- */
- static void serio_init_port(struct serio *serio)
- {
-- static atomic_t serio_no = ATOMIC_INIT(0);
-+ static atomic_unchecked_t serio_no = ATOMIC_INIT(0);
-
- __module_get(THIS_MODULE);
-
-@@ -536,7 +536,7 @@ static void serio_init_port(struct serio
- mutex_init(&serio->drv_mutex);
- device_initialize(&serio->dev);
- dev_set_name(&serio->dev, "serio%ld",
-- (long)atomic_inc_return(&serio_no) - 1);
-+ (long)atomic_inc_return_unchecked(&serio_no) - 1);
- serio->dev.bus = &serio_bus;
- serio->dev.release = serio_release_port;
- if (serio->parent) {
-diff -urNp linux-2.6.32.45/drivers/isdn/gigaset/common.c linux-2.6.32.45/drivers/isdn/gigaset/common.c
---- linux-2.6.32.45/drivers/isdn/gigaset/common.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/isdn/gigaset/common.c 2011-04-17 15:56:46.000000000 -0400
-@@ -712,7 +712,7 @@ struct cardstate *gigaset_initcs(struct
- cs->commands_pending = 0;
- cs->cur_at_seq = 0;
- cs->gotfwver = -1;
-- cs->open_count = 0;
-+ local_set(&cs->open_count, 0);
- cs->dev = NULL;
- cs->tty = NULL;
- cs->tty_dev = NULL;
-diff -urNp linux-2.6.32.45/drivers/isdn/gigaset/gigaset.h linux-2.6.32.45/drivers/isdn/gigaset/gigaset.h
---- linux-2.6.32.45/drivers/isdn/gigaset/gigaset.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/isdn/gigaset/gigaset.h 2011-04-17 15:56:46.000000000 -0400
-@@ -34,6 +34,7 @@
- #include <linux/tty_driver.h>
- #include <linux/list.h>
- #include <asm/atomic.h>
-+#include <asm/local.h>
-
- #define GIG_VERSION {0,5,0,0}
- #define GIG_COMPAT {0,4,0,0}
-@@ -446,7 +447,7 @@ struct cardstate {
- spinlock_t cmdlock;
- unsigned curlen, cmdbytes;
-
-- unsigned open_count;
-+ local_t open_count;
- struct tty_struct *tty;
- struct tasklet_struct if_wake_tasklet;
- unsigned control_state;
-diff -urNp linux-2.6.32.45/drivers/isdn/gigaset/interface.c linux-2.6.32.45/drivers/isdn/gigaset/interface.c
---- linux-2.6.32.45/drivers/isdn/gigaset/interface.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/isdn/gigaset/interface.c 2011-04-17 15:56:46.000000000 -0400
-@@ -165,9 +165,7 @@ static int if_open(struct tty_struct *tt
- return -ERESTARTSYS; // FIXME -EINTR?
- tty->driver_data = cs;
-
-- ++cs->open_count;
--
-- if (cs->open_count == 1) {
-+ if (local_inc_return(&cs->open_count) == 1) {
- spin_lock_irqsave(&cs->lock, flags);
- cs->tty = tty;
- spin_unlock_irqrestore(&cs->lock, flags);
-@@ -195,10 +193,10 @@ static void if_close(struct tty_struct *
-
- if (!cs->connected)
- gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
-- else if (!cs->open_count)
-+ else if (!local_read(&cs->open_count))
- dev_warn(cs->dev, "%s: device not opened\n", __func__);
- else {
-- if (!--cs->open_count) {
-+ if (!local_dec_return(&cs->open_count)) {
- spin_lock_irqsave(&cs->lock, flags);
- cs->tty = NULL;
- spin_unlock_irqrestore(&cs->lock, flags);
-@@ -233,7 +231,7 @@ static int if_ioctl(struct tty_struct *t
- if (!cs->connected) {
- gig_dbg(DEBUG_IF, "not connected");
- retval = -ENODEV;
-- } else if (!cs->open_count)
-+ } else if (!local_read(&cs->open_count))
- dev_warn(cs->dev, "%s: device not opened\n", __func__);
- else {
- retval = 0;
-@@ -361,7 +359,7 @@ static int if_write(struct tty_struct *t
- if (!cs->connected) {
- gig_dbg(DEBUG_IF, "not connected");
- retval = -ENODEV;
-- } else if (!cs->open_count)
-+ } else if (!local_read(&cs->open_count))
- dev_warn(cs->dev, "%s: device not opened\n", __func__);
- else if (cs->mstate != MS_LOCKED) {
- dev_warn(cs->dev, "can't write to unlocked device\n");
-@@ -395,7 +393,7 @@ static int if_write_room(struct tty_stru
- if (!cs->connected) {
- gig_dbg(DEBUG_IF, "not connected");
- retval = -ENODEV;
-- } else if (!cs->open_count)
-+ } else if (!local_read(&cs->open_count))
- dev_warn(cs->dev, "%s: device not opened\n", __func__);
- else if (cs->mstate != MS_LOCKED) {
- dev_warn(cs->dev, "can't write to unlocked device\n");
-@@ -425,7 +423,7 @@ static int if_chars_in_buffer(struct tty
-
- if (!cs->connected)
- gig_dbg(DEBUG_IF, "not connected");
-- else if (!cs->open_count)
-+ else if (!local_read(&cs->open_count))
- dev_warn(cs->dev, "%s: device not opened\n", __func__);
- else if (cs->mstate != MS_LOCKED)
- dev_warn(cs->dev, "can't write to unlocked device\n");
-@@ -453,7 +451,7 @@ static void if_throttle(struct tty_struc
-
- if (!cs->connected)
- gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
-- else if (!cs->open_count)
-+ else if (!local_read(&cs->open_count))
- dev_warn(cs->dev, "%s: device not opened\n", __func__);
- else {
- //FIXME
-@@ -478,7 +476,7 @@ static void if_unthrottle(struct tty_str
-
- if (!cs->connected)
- gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
-- else if (!cs->open_count)
-+ else if (!local_read(&cs->open_count))
- dev_warn(cs->dev, "%s: device not opened\n", __func__);
- else {
- //FIXME
-@@ -510,7 +508,7 @@ static void if_set_termios(struct tty_st
- goto out;
- }
-
-- if (!cs->open_count) {
-+ if (!local_read(&cs->open_count)) {
- dev_warn(cs->dev, "%s: device not opened\n", __func__);
- goto out;
- }
-diff -urNp linux-2.6.32.45/drivers/isdn/hardware/avm/b1.c linux-2.6.32.45/drivers/isdn/hardware/avm/b1.c
---- linux-2.6.32.45/drivers/isdn/hardware/avm/b1.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/isdn/hardware/avm/b1.c 2011-04-17 15:56:46.000000000 -0400
-@@ -173,7 +173,7 @@ int b1_load_t4file(avmcard *card, capilo
- }
- if (left) {
- if (t4file->user) {
-- if (copy_from_user(buf, dp, left))
-+ if (left > sizeof buf || copy_from_user(buf, dp, left))
- return -EFAULT;
- } else {
- memcpy(buf, dp, left);
-@@ -221,7 +221,7 @@ int b1_load_config(avmcard *card, capilo
- }
- if (left) {
- if (config->user) {
-- if (copy_from_user(buf, dp, left))
-+ if (left > sizeof buf || copy_from_user(buf, dp, left))
- return -EFAULT;
- } else {
- memcpy(buf, dp, left);
-diff -urNp linux-2.6.32.45/drivers/isdn/hardware/eicon/capidtmf.c linux-2.6.32.45/drivers/isdn/hardware/eicon/capidtmf.c
---- linux-2.6.32.45/drivers/isdn/hardware/eicon/capidtmf.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/isdn/hardware/eicon/capidtmf.c 2011-05-16 21:46:57.000000000 -0400
-@@ -498,6 +498,7 @@ void capidtmf_recv_block (t_capidtmf_sta
- byte goertzel_result_buffer[CAPIDTMF_RECV_TOTAL_FREQUENCY_COUNT];
- short windowed_sample_buffer[CAPIDTMF_RECV_WINDOWED_SAMPLES];
-
-+ pax_track_stack();
-
- if (p_state->recv.state & CAPIDTMF_RECV_STATE_DTMF_ACTIVE)
- {
-diff -urNp linux-2.6.32.45/drivers/isdn/hardware/eicon/capifunc.c linux-2.6.32.45/drivers/isdn/hardware/eicon/capifunc.c
---- linux-2.6.32.45/drivers/isdn/hardware/eicon/capifunc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/isdn/hardware/eicon/capifunc.c 2011-05-16 21:46:57.000000000 -0400
-@@ -1055,6 +1055,8 @@ static int divacapi_connect_didd(void)
- IDI_SYNC_REQ req;
- DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
-
-+ pax_track_stack();
-+
- DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
-
- for (x = 0; x < MAX_DESCRIPTORS; x++) {
-diff -urNp linux-2.6.32.45/drivers/isdn/hardware/eicon/diddfunc.c linux-2.6.32.45/drivers/isdn/hardware/eicon/diddfunc.c
---- linux-2.6.32.45/drivers/isdn/hardware/eicon/diddfunc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/isdn/hardware/eicon/diddfunc.c 2011-05-16 21:46:57.000000000 -0400
-@@ -54,6 +54,8 @@ static int DIVA_INIT_FUNCTION connect_di
- IDI_SYNC_REQ req;
- DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
-
-+ pax_track_stack();
-+
- DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
-
- for (x = 0; x < MAX_DESCRIPTORS; x++) {
-diff -urNp linux-2.6.32.45/drivers/isdn/hardware/eicon/divasfunc.c linux-2.6.32.45/drivers/isdn/hardware/eicon/divasfunc.c
---- linux-2.6.32.45/drivers/isdn/hardware/eicon/divasfunc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/isdn/hardware/eicon/divasfunc.c 2011-05-16 21:46:57.000000000 -0400
-@@ -161,6 +161,8 @@ static int DIVA_INIT_FUNCTION connect_di
- IDI_SYNC_REQ req;
- DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
-
-+ pax_track_stack();
-+
- DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
-
- for (x = 0; x < MAX_DESCRIPTORS; x++) {
-diff -urNp linux-2.6.32.45/drivers/isdn/hardware/eicon/divasync.h linux-2.6.32.45/drivers/isdn/hardware/eicon/divasync.h
---- linux-2.6.32.45/drivers/isdn/hardware/eicon/divasync.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/isdn/hardware/eicon/divasync.h 2011-08-05 20:33:55.000000000 -0400
-@@ -146,7 +146,7 @@ typedef struct _diva_didd_add_adapter {
- } diva_didd_add_adapter_t;
- typedef struct _diva_didd_remove_adapter {
- IDI_CALL p_request;
--} diva_didd_remove_adapter_t;
-+} __no_const diva_didd_remove_adapter_t;
- typedef struct _diva_didd_read_adapter_array {
- void * buffer;
- dword length;
-diff -urNp linux-2.6.32.45/drivers/isdn/hardware/eicon/idifunc.c linux-2.6.32.45/drivers/isdn/hardware/eicon/idifunc.c
---- linux-2.6.32.45/drivers/isdn/hardware/eicon/idifunc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/isdn/hardware/eicon/idifunc.c 2011-05-16 21:46:57.000000000 -0400
-@@ -188,6 +188,8 @@ static int DIVA_INIT_FUNCTION connect_di
- IDI_SYNC_REQ req;
- DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
-
-+ pax_track_stack();
-+
- DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
-
- for (x = 0; x < MAX_DESCRIPTORS; x++) {
-diff -urNp linux-2.6.32.45/drivers/isdn/hardware/eicon/message.c linux-2.6.32.45/drivers/isdn/hardware/eicon/message.c
---- linux-2.6.32.45/drivers/isdn/hardware/eicon/message.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/isdn/hardware/eicon/message.c 2011-05-16 21:46:57.000000000 -0400
-@@ -4889,6 +4889,8 @@ static void sig_ind(PLCI *plci)
- dword d;
- word w;
-
-+ pax_track_stack();
-+
- a = plci->adapter;
- Id = ((word)plci->Id<<8)|a->Id;
- PUT_WORD(&SS_Ind[4],0x0000);
-@@ -7484,6 +7486,8 @@ static word add_b1(PLCI *plci, API_PARSE
- word j, n, w;
- dword d;
-
-+ pax_track_stack();
-+
-
- for(i=0;i<8;i++) bp_parms[i].length = 0;
- for(i=0;i<2;i++) global_config[i].length = 0;
-@@ -7958,6 +7962,8 @@ static word add_b23(PLCI *plci, API_PARS
- const byte llc3[] = {4,3,2,2,6,6,0};
- const byte header[] = {0,2,3,3,0,0,0};
-
-+ pax_track_stack();
-+
- for(i=0;i<8;i++) bp_parms[i].length = 0;
- for(i=0;i<6;i++) b2_config_parms[i].length = 0;
- for(i=0;i<5;i++) b3_config_parms[i].length = 0;
-@@ -14761,6 +14767,8 @@ static void group_optimization(DIVA_CAPI
- word appl_number_group_type[MAX_APPL];
- PLCI *auxplci;
-
-+ pax_track_stack();
-+
- set_group_ind_mask (plci); /* all APPLs within this inc. call are allowed to dial in */
-
- if(!a->group_optimization_enabled)
-diff -urNp linux-2.6.32.45/drivers/isdn/hardware/eicon/mntfunc.c linux-2.6.32.45/drivers/isdn/hardware/eicon/mntfunc.c
---- linux-2.6.32.45/drivers/isdn/hardware/eicon/mntfunc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/isdn/hardware/eicon/mntfunc.c 2011-05-16 21:46:57.000000000 -0400
-@@ -79,6 +79,8 @@ static int DIVA_INIT_FUNCTION connect_di
- IDI_SYNC_REQ req;
- DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
-
-+ pax_track_stack();
-+
- DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
-
- for (x = 0; x < MAX_DESCRIPTORS; x++) {
-diff -urNp linux-2.6.32.45/drivers/isdn/hardware/eicon/xdi_adapter.h linux-2.6.32.45/drivers/isdn/hardware/eicon/xdi_adapter.h
---- linux-2.6.32.45/drivers/isdn/hardware/eicon/xdi_adapter.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/isdn/hardware/eicon/xdi_adapter.h 2011-08-05 20:33:55.000000000 -0400
-@@ -44,7 +44,7 @@ typedef struct _xdi_mbox_t {
- typedef struct _diva_os_idi_adapter_interface {
- diva_init_card_proc_t cleanup_adapter_proc;
- diva_cmd_card_proc_t cmd_proc;
--} diva_os_idi_adapter_interface_t;
-+} __no_const diva_os_idi_adapter_interface_t;
-
- typedef struct _diva_os_xdi_adapter {
- struct list_head link;
-diff -urNp linux-2.6.32.45/drivers/isdn/i4l/isdn_common.c linux-2.6.32.45/drivers/isdn/i4l/isdn_common.c
---- linux-2.6.32.45/drivers/isdn/i4l/isdn_common.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/isdn/i4l/isdn_common.c 2011-05-16 21:46:57.000000000 -0400
-@@ -1290,6 +1290,8 @@ isdn_ioctl(struct inode *inode, struct f
- } iocpar;
- void __user *argp = (void __user *)arg;
-
-+ pax_track_stack();
-+
- #define name iocpar.name
- #define bname iocpar.bname
- #define iocts iocpar.iocts
-diff -urNp linux-2.6.32.45/drivers/isdn/icn/icn.c linux-2.6.32.45/drivers/isdn/icn/icn.c
---- linux-2.6.32.45/drivers/isdn/icn/icn.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/isdn/icn/icn.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1044,7 +1044,7 @@ icn_writecmd(const u_char * buf, int len
- if (count > len)
- count = len;
- if (user) {
-- if (copy_from_user(msg, buf, count))
-+ if (count > sizeof msg || copy_from_user(msg, buf, count))
- return -EFAULT;
- } else
- memcpy(msg, buf, count);
-diff -urNp linux-2.6.32.45/drivers/isdn/mISDN/socket.c linux-2.6.32.45/drivers/isdn/mISDN/socket.c
---- linux-2.6.32.45/drivers/isdn/mISDN/socket.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/isdn/mISDN/socket.c 2011-04-17 15:56:46.000000000 -0400
-@@ -391,6 +391,7 @@ data_sock_ioctl(struct socket *sock, uns
- if (dev) {
- struct mISDN_devinfo di;
-
-+ memset(&di, 0, sizeof(di));
- di.id = dev->id;
- di.Dprotocols = dev->Dprotocols;
- di.Bprotocols = dev->Bprotocols | get_all_Bprotocols();
-@@ -671,6 +672,7 @@ base_sock_ioctl(struct socket *sock, uns
- if (dev) {
- struct mISDN_devinfo di;
-
-+ memset(&di, 0, sizeof(di));
- di.id = dev->id;
- di.Dprotocols = dev->Dprotocols;
- di.Bprotocols = dev->Bprotocols | get_all_Bprotocols();
-diff -urNp linux-2.6.32.45/drivers/isdn/sc/interrupt.c linux-2.6.32.45/drivers/isdn/sc/interrupt.c
---- linux-2.6.32.45/drivers/isdn/sc/interrupt.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/isdn/sc/interrupt.c 2011-04-17 15:56:46.000000000 -0400
-@@ -112,11 +112,19 @@ irqreturn_t interrupt_handler(int dummy,
- }
- else if(callid>=0x0000 && callid<=0x7FFF)
- {
-+ int len;
-+
- pr_debug("%s: Got Incoming Call\n",
- sc_adapter[card]->devicename);
-- strcpy(setup.phone,&(rcvmsg.msg_data.byte_array[4]));
-- strcpy(setup.eazmsn,
-- sc_adapter[card]->channel[rcvmsg.phy_link_no-1].dn);
-+ len = strlcpy(setup.phone, &(rcvmsg.msg_data.byte_array[4]),
-+ sizeof(setup.phone));
-+ if (len >= sizeof(setup.phone))
-+ continue;
-+ len = strlcpy(setup.eazmsn,
-+ sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn,
-+ sizeof(setup.eazmsn));
-+ if (len >= sizeof(setup.eazmsn))
-+ continue;
- setup.si1 = 7;
- setup.si2 = 0;
- setup.plan = 0;
-@@ -176,7 +184,9 @@ irqreturn_t interrupt_handler(int dummy,
- * Handle a GetMyNumber Rsp
- */
- if (IS_CE_MESSAGE(rcvmsg,Call,0,GetMyNumber)){
-- strcpy(sc_adapter[card]->channel[rcvmsg.phy_link_no-1].dn,rcvmsg.msg_data.byte_array);
-+ strlcpy(sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn,
-+ rcvmsg.msg_data.byte_array,
-+ sizeof(rcvmsg.msg_data.byte_array));
- continue;
- }
-
-diff -urNp linux-2.6.32.45/drivers/lguest/core.c linux-2.6.32.45/drivers/lguest/core.c
---- linux-2.6.32.45/drivers/lguest/core.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/lguest/core.c 2011-04-17 15:56:46.000000000 -0400
-@@ -91,9 +91,17 @@ static __init int map_switcher(void)
- * it's worked so far. The end address needs +1 because __get_vm_area
- * allocates an extra guard page, so we need space for that.
- */
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
-+ VM_ALLOC | VM_KERNEXEC, SWITCHER_ADDR, SWITCHER_ADDR
-+ + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
-+#else
- switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
- VM_ALLOC, SWITCHER_ADDR, SWITCHER_ADDR
- + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
-+#endif
-+
- if (!switcher_vma) {
- err = -ENOMEM;
- printk("lguest: could not map switcher pages high\n");
-@@ -118,7 +126,7 @@ static __init int map_switcher(void)
- * Now the Switcher is mapped at the right address, we can't fail!
- * Copy in the compiled-in Switcher code (from <arch>_switcher.S).
- */
-- memcpy(switcher_vma->addr, start_switcher_text,
-+ memcpy(switcher_vma->addr, ktla_ktva(start_switcher_text),
- end_switcher_text - start_switcher_text);
-
- printk(KERN_INFO "lguest: mapped switcher at %p\n",
-diff -urNp linux-2.6.32.45/drivers/lguest/x86/core.c linux-2.6.32.45/drivers/lguest/x86/core.c
---- linux-2.6.32.45/drivers/lguest/x86/core.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/lguest/x86/core.c 2011-04-17 15:56:46.000000000 -0400
-@@ -59,7 +59,7 @@ static struct {
- /* Offset from where switcher.S was compiled to where we've copied it */
- static unsigned long switcher_offset(void)
- {
-- return SWITCHER_ADDR - (unsigned long)start_switcher_text;
-+ return SWITCHER_ADDR - (unsigned long)ktla_ktva(start_switcher_text);
- }
-
- /* This cpu's struct lguest_pages. */
-@@ -100,7 +100,13 @@ static void copy_in_guest_info(struct lg
- * These copies are pretty cheap, so we do them unconditionally: */
- /* Save the current Host top-level page directory.
- */
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ pages->state.host_cr3 = read_cr3();
-+#else
- pages->state.host_cr3 = __pa(current->mm->pgd);
-+#endif
-+
- /*
- * Set up the Guest's page tables to see this CPU's pages (and no
- * other CPU's pages).
-@@ -535,7 +541,7 @@ void __init lguest_arch_host_init(void)
- * compiled-in switcher code and the high-mapped copy we just made.
- */
- for (i = 0; i < IDT_ENTRIES; i++)
-- default_idt_entries[i] += switcher_offset();
-+ default_idt_entries[i] = ktla_ktva(default_idt_entries[i]) + switcher_offset();
-
- /*
- * Set up the Switcher's per-cpu areas.
-@@ -618,7 +624,7 @@ void __init lguest_arch_host_init(void)
- * it will be undisturbed when we switch. To change %cs and jump we
- * need this structure to feed to Intel's "lcall" instruction.
- */
-- lguest_entry.offset = (long)switch_to_guest + switcher_offset();
-+ lguest_entry.offset = (long)ktla_ktva(switch_to_guest) + switcher_offset();
- lguest_entry.segment = LGUEST_CS;
-
- /*
-diff -urNp linux-2.6.32.45/drivers/lguest/x86/switcher_32.S linux-2.6.32.45/drivers/lguest/x86/switcher_32.S
---- linux-2.6.32.45/drivers/lguest/x86/switcher_32.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/lguest/x86/switcher_32.S 2011-04-17 15:56:46.000000000 -0400
-@@ -87,6 +87,7 @@
- #include <asm/page.h>
- #include <asm/segment.h>
- #include <asm/lguest.h>
-+#include <asm/processor-flags.h>
-
- // We mark the start of the code to copy
- // It's placed in .text tho it's never run here
-@@ -149,6 +150,13 @@ ENTRY(switch_to_guest)
- // Changes type when we load it: damn Intel!
- // For after we switch over our page tables
- // That entry will be read-only: we'd crash.
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ mov %cr0, %edx
-+ xor $X86_CR0_WP, %edx
-+ mov %edx, %cr0
-+#endif
-+
- movl $(GDT_ENTRY_TSS*8), %edx
- ltr %dx
-
-@@ -157,9 +165,15 @@ ENTRY(switch_to_guest)
- // Let's clear it again for our return.
- // The GDT descriptor of the Host
- // Points to the table after two "size" bytes
-- movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %edx
-+ movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %eax
- // Clear "used" from type field (byte 5, bit 2)
-- andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%edx)
-+ andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%eax)
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ mov %cr0, %eax
-+ xor $X86_CR0_WP, %eax
-+ mov %eax, %cr0
-+#endif
-
- // Once our page table's switched, the Guest is live!
- // The Host fades as we run this final step.
-@@ -295,13 +309,12 @@ deliver_to_host:
- // I consulted gcc, and it gave
- // These instructions, which I gladly credit:
- leal (%edx,%ebx,8), %eax
-- movzwl (%eax),%edx
-- movl 4(%eax), %eax
-- xorw %ax, %ax
-- orl %eax, %edx
-+ movl 4(%eax), %edx
-+ movw (%eax), %dx
- // Now the address of the handler's in %edx
- // We call it now: its "iret" drops us home.
-- jmp *%edx
-+ ljmp $__KERNEL_CS, $1f
-+1: jmp *%edx
-
- // Every interrupt can come to us here
- // But we must truly tell each apart.
-diff -urNp linux-2.6.32.45/drivers/macintosh/via-pmu-backlight.c linux-2.6.32.45/drivers/macintosh/via-pmu-backlight.c
---- linux-2.6.32.45/drivers/macintosh/via-pmu-backlight.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/macintosh/via-pmu-backlight.c 2011-04-17 15:56:46.000000000 -0400
-@@ -15,7 +15,7 @@
-
- #define MAX_PMU_LEVEL 0xFF
-
--static struct backlight_ops pmu_backlight_data;
-+static const struct backlight_ops pmu_backlight_data;
- static DEFINE_SPINLOCK(pmu_backlight_lock);
- static int sleeping, uses_pmu_bl;
- static u8 bl_curve[FB_BACKLIGHT_LEVELS];
-@@ -115,7 +115,7 @@ static int pmu_backlight_get_brightness(
- return bd->props.brightness;
- }
-
--static struct backlight_ops pmu_backlight_data = {
-+static const struct backlight_ops pmu_backlight_data = {
- .get_brightness = pmu_backlight_get_brightness,
- .update_status = pmu_backlight_update_status,
-
-diff -urNp linux-2.6.32.45/drivers/macintosh/via-pmu.c linux-2.6.32.45/drivers/macintosh/via-pmu.c
---- linux-2.6.32.45/drivers/macintosh/via-pmu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/macintosh/via-pmu.c 2011-04-17 15:56:46.000000000 -0400
-@@ -2232,7 +2232,7 @@ static int pmu_sleep_valid(suspend_state
- && (pmac_call_feature(PMAC_FTR_SLEEP_STATE, NULL, 0, -1) >= 0);
- }
-
--static struct platform_suspend_ops pmu_pm_ops = {
-+static const struct platform_suspend_ops pmu_pm_ops = {
- .enter = powerbook_sleep,
- .valid = pmu_sleep_valid,
- };
-diff -urNp linux-2.6.32.45/drivers/md/dm.c linux-2.6.32.45/drivers/md/dm.c
---- linux-2.6.32.45/drivers/md/dm.c 2011-08-09 18:35:29.000000000 -0400
-+++ linux-2.6.32.45/drivers/md/dm.c 2011-08-09 18:33:59.000000000 -0400
-@@ -165,9 +165,9 @@ struct mapped_device {
- /*
- * Event handling.
- */
-- atomic_t event_nr;
-+ atomic_unchecked_t event_nr;
- wait_queue_head_t eventq;
-- atomic_t uevent_seq;
-+ atomic_unchecked_t uevent_seq;
- struct list_head uevent_list;
- spinlock_t uevent_lock; /* Protect access to uevent_list */
-
-@@ -1776,8 +1776,8 @@ static struct mapped_device *alloc_dev(i
- rwlock_init(&md->map_lock);
- atomic_set(&md->holders, 1);
- atomic_set(&md->open_count, 0);
-- atomic_set(&md->event_nr, 0);
-- atomic_set(&md->uevent_seq, 0);
-+ atomic_set_unchecked(&md->event_nr, 0);
-+ atomic_set_unchecked(&md->uevent_seq, 0);
- INIT_LIST_HEAD(&md->uevent_list);
- spin_lock_init(&md->uevent_lock);
-
-@@ -1927,7 +1927,7 @@ static void event_callback(void *context
-
- dm_send_uevents(&uevents, &disk_to_dev(md->disk)->kobj);
-
-- atomic_inc(&md->event_nr);
-+ atomic_inc_unchecked(&md->event_nr);
- wake_up(&md->eventq);
- }
-
-@@ -2562,18 +2562,18 @@ void dm_kobject_uevent(struct mapped_dev
-
- uint32_t dm_next_uevent_seq(struct mapped_device *md)
- {
-- return atomic_add_return(1, &md->uevent_seq);
-+ return atomic_add_return_unchecked(1, &md->uevent_seq);
- }
-
- uint32_t dm_get_event_nr(struct mapped_device *md)
- {
-- return atomic_read(&md->event_nr);
-+ return atomic_read_unchecked(&md->event_nr);
- }
-
- int dm_wait_event(struct mapped_device *md, int event_nr)
- {
- return wait_event_interruptible(md->eventq,
-- (event_nr != atomic_read(&md->event_nr)));
-+ (event_nr != atomic_read_unchecked(&md->event_nr)));
- }
-
- void dm_uevent_add(struct mapped_device *md, struct list_head *elist)
-diff -urNp linux-2.6.32.45/drivers/md/dm-ioctl.c linux-2.6.32.45/drivers/md/dm-ioctl.c
---- linux-2.6.32.45/drivers/md/dm-ioctl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/md/dm-ioctl.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1437,7 +1437,7 @@ static int validate_params(uint cmd, str
- cmd == DM_LIST_VERSIONS_CMD)
- return 0;
-
-- if ((cmd == DM_DEV_CREATE_CMD)) {
-+ if (cmd == DM_DEV_CREATE_CMD) {
- if (!*param->name) {
- DMWARN("name not supplied when creating device");
- return -EINVAL;
-diff -urNp linux-2.6.32.45/drivers/md/dm-raid1.c linux-2.6.32.45/drivers/md/dm-raid1.c
---- linux-2.6.32.45/drivers/md/dm-raid1.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/md/dm-raid1.c 2011-05-04 17:56:28.000000000 -0400
-@@ -41,7 +41,7 @@ enum dm_raid1_error {
-
- struct mirror {
- struct mirror_set *ms;
-- atomic_t error_count;
-+ atomic_unchecked_t error_count;
- unsigned long error_type;
- struct dm_dev *dev;
- sector_t offset;
-@@ -203,7 +203,7 @@ static void fail_mirror(struct mirror *m
- * simple way to tell if a device has encountered
- * errors.
- */
-- atomic_inc(&m->error_count);
-+ atomic_inc_unchecked(&m->error_count);
-
- if (test_and_set_bit(error_type, &m->error_type))
- return;
-@@ -225,7 +225,7 @@ static void fail_mirror(struct mirror *m
- }
-
- for (new = ms->mirror; new < ms->mirror + ms->nr_mirrors; new++)
-- if (!atomic_read(&new->error_count)) {
-+ if (!atomic_read_unchecked(&new->error_count)) {
- set_default_mirror(new);
- break;
- }
-@@ -363,7 +363,7 @@ static struct mirror *choose_mirror(stru
- struct mirror *m = get_default_mirror(ms);
-
- do {
-- if (likely(!atomic_read(&m->error_count)))
-+ if (likely(!atomic_read_unchecked(&m->error_count)))
- return m;
-
- if (m-- == ms->mirror)
-@@ -377,7 +377,7 @@ static int default_ok(struct mirror *m)
- {
- struct mirror *default_mirror = get_default_mirror(m->ms);
-
-- return !atomic_read(&default_mirror->error_count);
-+ return !atomic_read_unchecked(&default_mirror->error_count);
- }
-
- static int mirror_available(struct mirror_set *ms, struct bio *bio)
-@@ -484,7 +484,7 @@ static void do_reads(struct mirror_set *
- */
- if (likely(region_in_sync(ms, region, 1)))
- m = choose_mirror(ms, bio->bi_sector);
-- else if (m && atomic_read(&m->error_count))
-+ else if (m && atomic_read_unchecked(&m->error_count))
- m = NULL;
-
- if (likely(m))
-@@ -855,7 +855,7 @@ static int get_mirror(struct mirror_set
- }
-
- ms->mirror[mirror].ms = ms;
-- atomic_set(&(ms->mirror[mirror].error_count), 0);
-+ atomic_set_unchecked(&(ms->mirror[mirror].error_count), 0);
- ms->mirror[mirror].error_type = 0;
- ms->mirror[mirror].offset = offset;
-
-@@ -1241,7 +1241,7 @@ static void mirror_resume(struct dm_targ
- */
- static char device_status_char(struct mirror *m)
- {
-- if (!atomic_read(&(m->error_count)))
-+ if (!atomic_read_unchecked(&(m->error_count)))
- return 'A';
-
- return (test_bit(DM_RAID1_WRITE_ERROR, &(m->error_type))) ? 'D' :
-diff -urNp linux-2.6.32.45/drivers/md/dm-stripe.c linux-2.6.32.45/drivers/md/dm-stripe.c
---- linux-2.6.32.45/drivers/md/dm-stripe.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/md/dm-stripe.c 2011-05-04 17:56:28.000000000 -0400
-@@ -20,7 +20,7 @@ struct stripe {
- struct dm_dev *dev;
- sector_t physical_start;
-
-- atomic_t error_count;
-+ atomic_unchecked_t error_count;
- };
-
- struct stripe_c {
-@@ -188,7 +188,7 @@ static int stripe_ctr(struct dm_target *
- kfree(sc);
- return r;
- }
-- atomic_set(&(sc->stripe[i].error_count), 0);
-+ atomic_set_unchecked(&(sc->stripe[i].error_count), 0);
- }
-
- ti->private = sc;
-@@ -257,7 +257,7 @@ static int stripe_status(struct dm_targe
- DMEMIT("%d ", sc->stripes);
- for (i = 0; i < sc->stripes; i++) {
- DMEMIT("%s ", sc->stripe[i].dev->name);
-- buffer[i] = atomic_read(&(sc->stripe[i].error_count)) ?
-+ buffer[i] = atomic_read_unchecked(&(sc->stripe[i].error_count)) ?
- 'D' : 'A';
- }
- buffer[i] = '\0';
-@@ -304,8 +304,8 @@ static int stripe_end_io(struct dm_targe
- */
- for (i = 0; i < sc->stripes; i++)
- if (!strcmp(sc->stripe[i].dev->name, major_minor)) {
-- atomic_inc(&(sc->stripe[i].error_count));
-- if (atomic_read(&(sc->stripe[i].error_count)) <
-+ atomic_inc_unchecked(&(sc->stripe[i].error_count));
-+ if (atomic_read_unchecked(&(sc->stripe[i].error_count)) <
- DM_IO_ERROR_THRESHOLD)
- queue_work(kstriped, &sc->kstriped_ws);
- }
-diff -urNp linux-2.6.32.45/drivers/md/dm-sysfs.c linux-2.6.32.45/drivers/md/dm-sysfs.c
---- linux-2.6.32.45/drivers/md/dm-sysfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/md/dm-sysfs.c 2011-04-17 15:56:46.000000000 -0400
-@@ -75,7 +75,7 @@ static struct attribute *dm_attrs[] = {
- NULL,
- };
-
--static struct sysfs_ops dm_sysfs_ops = {
-+static const struct sysfs_ops dm_sysfs_ops = {
- .show = dm_attr_show,
- };
-
-diff -urNp linux-2.6.32.45/drivers/md/dm-table.c linux-2.6.32.45/drivers/md/dm-table.c
---- linux-2.6.32.45/drivers/md/dm-table.c 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.45/drivers/md/dm-table.c 2011-06-25 12:56:37.000000000 -0400
-@@ -376,7 +376,7 @@ static int device_area_is_invalid(struct
- if (!dev_size)
- return 0;
-
-- if ((start >= dev_size) || (start + len > dev_size)) {
-+ if ((start >= dev_size) || (len > dev_size - start)) {
- DMWARN("%s: %s too small for target: "
- "start=%llu, len=%llu, dev_size=%llu",
- dm_device_name(ti->table->md), bdevname(bdev, b),
-diff -urNp linux-2.6.32.45/drivers/md/md.c linux-2.6.32.45/drivers/md/md.c
---- linux-2.6.32.45/drivers/md/md.c 2011-07-13 17:23:04.000000000 -0400
-+++ linux-2.6.32.45/drivers/md/md.c 2011-07-13 17:23:18.000000000 -0400
-@@ -153,10 +153,10 @@ static int start_readonly;
- * start build, activate spare
- */
- static DECLARE_WAIT_QUEUE_HEAD(md_event_waiters);
--static atomic_t md_event_count;
-+static atomic_unchecked_t md_event_count;
- void md_new_event(mddev_t *mddev)
- {
-- atomic_inc(&md_event_count);
-+ atomic_inc_unchecked(&md_event_count);
- wake_up(&md_event_waiters);
- }
- EXPORT_SYMBOL_GPL(md_new_event);
-@@ -166,7 +166,7 @@ EXPORT_SYMBOL_GPL(md_new_event);
- */
- static void md_new_event_inintr(mddev_t *mddev)
- {
-- atomic_inc(&md_event_count);
-+ atomic_inc_unchecked(&md_event_count);
- wake_up(&md_event_waiters);
- }
-
-@@ -1218,7 +1218,7 @@ static int super_1_load(mdk_rdev_t *rdev
-
- rdev->preferred_minor = 0xffff;
- rdev->data_offset = le64_to_cpu(sb->data_offset);
-- atomic_set(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
-+ atomic_set_unchecked(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
-
- rdev->sb_size = le32_to_cpu(sb->max_dev) * 2 + 256;
- bmask = queue_logical_block_size(rdev->bdev->bd_disk->queue)-1;
-@@ -1392,7 +1392,7 @@ static void super_1_sync(mddev_t *mddev,
- else
- sb->resync_offset = cpu_to_le64(0);
-
-- sb->cnt_corrected_read = cpu_to_le32(atomic_read(&rdev->corrected_errors));
-+ sb->cnt_corrected_read = cpu_to_le32(atomic_read_unchecked(&rdev->corrected_errors));
-
- sb->raid_disks = cpu_to_le32(mddev->raid_disks);
- sb->size = cpu_to_le64(mddev->dev_sectors);
-@@ -2214,7 +2214,7 @@ __ATTR(state, S_IRUGO|S_IWUSR, state_sho
- static ssize_t
- errors_show(mdk_rdev_t *rdev, char *page)
- {
-- return sprintf(page, "%d\n", atomic_read(&rdev->corrected_errors));
-+ return sprintf(page, "%d\n", atomic_read_unchecked(&rdev->corrected_errors));
- }
-
- static ssize_t
-@@ -2223,7 +2223,7 @@ errors_store(mdk_rdev_t *rdev, const cha
- char *e;
- unsigned long n = simple_strtoul(buf, &e, 10);
- if (*buf && (*e == 0 || *e == '\n')) {
-- atomic_set(&rdev->corrected_errors, n);
-+ atomic_set_unchecked(&rdev->corrected_errors, n);
- return len;
- }
- return -EINVAL;
-@@ -2517,7 +2517,7 @@ static void rdev_free(struct kobject *ko
- mdk_rdev_t *rdev = container_of(ko, mdk_rdev_t, kobj);
- kfree(rdev);
- }
--static struct sysfs_ops rdev_sysfs_ops = {
-+static const struct sysfs_ops rdev_sysfs_ops = {
- .show = rdev_attr_show,
- .store = rdev_attr_store,
- };
-@@ -2566,8 +2566,8 @@ static mdk_rdev_t *md_import_device(dev_
- rdev->data_offset = 0;
- rdev->sb_events = 0;
- atomic_set(&rdev->nr_pending, 0);
-- atomic_set(&rdev->read_errors, 0);
-- atomic_set(&rdev->corrected_errors, 0);
-+ atomic_set_unchecked(&rdev->read_errors, 0);
-+ atomic_set_unchecked(&rdev->corrected_errors, 0);
-
- size = rdev->bdev->bd_inode->i_size >> BLOCK_SIZE_BITS;
- if (!size) {
-@@ -3887,7 +3887,7 @@ static void md_free(struct kobject *ko)
- kfree(mddev);
- }
-
--static struct sysfs_ops md_sysfs_ops = {
-+static const struct sysfs_ops md_sysfs_ops = {
- .show = md_attr_show,
- .store = md_attr_store,
- };
-@@ -4474,7 +4474,8 @@ out:
- err = 0;
- blk_integrity_unregister(disk);
- md_new_event(mddev);
-- sysfs_notify_dirent(mddev->sysfs_state);
-+ if (mddev->sysfs_state)
-+ sysfs_notify_dirent(mddev->sysfs_state);
- return err;
- }
-
-@@ -5954,7 +5955,7 @@ static int md_seq_show(struct seq_file *
-
- spin_unlock(&pers_lock);
- seq_printf(seq, "\n");
-- mi->event = atomic_read(&md_event_count);
-+ mi->event = atomic_read_unchecked(&md_event_count);
- return 0;
- }
- if (v == (void*)2) {
-@@ -6043,7 +6044,7 @@ static int md_seq_show(struct seq_file *
- chunk_kb ? "KB" : "B");
- if (bitmap->file) {
- seq_printf(seq, ", file: ");
-- seq_path(seq, &bitmap->file->f_path, " \t\n");
-+ seq_path(seq, &bitmap->file->f_path, " \t\n\\");
- }
-
- seq_printf(seq, "\n");
-@@ -6077,7 +6078,7 @@ static int md_seq_open(struct inode *ino
- else {
- struct seq_file *p = file->private_data;
- p->private = mi;
-- mi->event = atomic_read(&md_event_count);
-+ mi->event = atomic_read_unchecked(&md_event_count);
- }
- return error;
- }
-@@ -6093,7 +6094,7 @@ static unsigned int mdstat_poll(struct f
- /* always allow read */
- mask = POLLIN | POLLRDNORM;
-
-- if (mi->event != atomic_read(&md_event_count))
-+ if (mi->event != atomic_read_unchecked(&md_event_count))
- mask |= POLLERR | POLLPRI;
- return mask;
- }
-@@ -6137,7 +6138,7 @@ static int is_mddev_idle(mddev_t *mddev,
- struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
- curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
- (int)part_stat_read(&disk->part0, sectors[1]) -
-- atomic_read(&disk->sync_io);
-+ atomic_read_unchecked(&disk->sync_io);
- /* sync IO will cause sync_io to increase before the disk_stats
- * as sync_io is counted when a request starts, and
- * disk_stats is counted when it completes.
-diff -urNp linux-2.6.32.45/drivers/md/md.h linux-2.6.32.45/drivers/md/md.h
---- linux-2.6.32.45/drivers/md/md.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/md/md.h 2011-05-04 17:56:20.000000000 -0400
-@@ -94,10 +94,10 @@ struct mdk_rdev_s
- * only maintained for arrays that
- * support hot removal
- */
-- atomic_t read_errors; /* number of consecutive read errors that
-+ atomic_unchecked_t read_errors; /* number of consecutive read errors that
- * we have tried to ignore.
- */
-- atomic_t corrected_errors; /* number of corrected read errors,
-+ atomic_unchecked_t corrected_errors; /* number of corrected read errors,
- * for reporting to userspace and storing
- * in superblock.
- */
-@@ -304,7 +304,7 @@ static inline void rdev_dec_pending(mdk_
-
- static inline void md_sync_acct(struct block_device *bdev, unsigned long nr_sectors)
- {
-- atomic_add(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
-+ atomic_add_unchecked(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
- }
-
- struct mdk_personality
-diff -urNp linux-2.6.32.45/drivers/md/raid10.c linux-2.6.32.45/drivers/md/raid10.c
---- linux-2.6.32.45/drivers/md/raid10.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/md/raid10.c 2011-05-04 17:56:28.000000000 -0400
-@@ -1255,7 +1255,7 @@ static void end_sync_read(struct bio *bi
- if (test_bit(BIO_UPTODATE, &bio->bi_flags))
- set_bit(R10BIO_Uptodate, &r10_bio->state);
- else {
-- atomic_add(r10_bio->sectors,
-+ atomic_add_unchecked(r10_bio->sectors,
- &conf->mirrors[d].rdev->corrected_errors);
- if (!test_bit(MD_RECOVERY_SYNC, &conf->mddev->recovery))
- md_error(r10_bio->mddev,
-@@ -1520,7 +1520,7 @@ static void fix_read_error(conf_t *conf,
- test_bit(In_sync, &rdev->flags)) {
- atomic_inc(&rdev->nr_pending);
- rcu_read_unlock();
-- atomic_add(s, &rdev->corrected_errors);
-+ atomic_add_unchecked(s, &rdev->corrected_errors);
- if (sync_page_io(rdev->bdev,
- r10_bio->devs[sl].addr +
- sect + rdev->data_offset,
-diff -urNp linux-2.6.32.45/drivers/md/raid1.c linux-2.6.32.45/drivers/md/raid1.c
---- linux-2.6.32.45/drivers/md/raid1.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/md/raid1.c 2011-05-04 17:56:28.000000000 -0400
-@@ -1415,7 +1415,7 @@ static void sync_request_write(mddev_t *
- if (r1_bio->bios[d]->bi_end_io != end_sync_read)
- continue;
- rdev = conf->mirrors[d].rdev;
-- atomic_add(s, &rdev->corrected_errors);
-+ atomic_add_unchecked(s, &rdev->corrected_errors);
- if (sync_page_io(rdev->bdev,
- sect + rdev->data_offset,
- s<<9,
-@@ -1564,7 +1564,7 @@ static void fix_read_error(conf_t *conf,
- /* Well, this device is dead */
- md_error(mddev, rdev);
- else {
-- atomic_add(s, &rdev->corrected_errors);
-+ atomic_add_unchecked(s, &rdev->corrected_errors);
- printk(KERN_INFO
- "raid1:%s: read error corrected "
- "(%d sectors at %llu on %s)\n",
-diff -urNp linux-2.6.32.45/drivers/md/raid5.c linux-2.6.32.45/drivers/md/raid5.c
---- linux-2.6.32.45/drivers/md/raid5.c 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.45/drivers/md/raid5.c 2011-06-25 12:58:39.000000000 -0400
-@@ -482,7 +482,7 @@ static void ops_run_io(struct stripe_hea
- bi->bi_next = NULL;
- if ((rw & WRITE) &&
- test_bit(R5_ReWrite, &sh->dev[i].flags))
-- atomic_add(STRIPE_SECTORS,
-+ atomic_add_unchecked(STRIPE_SECTORS,
- &rdev->corrected_errors);
- generic_make_request(bi);
- } else {
-@@ -1517,15 +1517,15 @@ static void raid5_end_read_request(struc
- clear_bit(R5_ReadError, &sh->dev[i].flags);
- clear_bit(R5_ReWrite, &sh->dev[i].flags);
- }
-- if (atomic_read(&conf->disks[i].rdev->read_errors))
-- atomic_set(&conf->disks[i].rdev->read_errors, 0);
-+ if (atomic_read_unchecked(&conf->disks[i].rdev->read_errors))
-+ atomic_set_unchecked(&conf->disks[i].rdev->read_errors, 0);
- } else {
- const char *bdn = bdevname(conf->disks[i].rdev->bdev, b);
- int retry = 0;
- rdev = conf->disks[i].rdev;
-
- clear_bit(R5_UPTODATE, &sh->dev[i].flags);
-- atomic_inc(&rdev->read_errors);
-+ atomic_inc_unchecked(&rdev->read_errors);
- if (conf->mddev->degraded >= conf->max_degraded)
- printk_rl(KERN_WARNING
- "raid5:%s: read error not correctable "
-@@ -1543,7 +1543,7 @@ static void raid5_end_read_request(struc
- (unsigned long long)(sh->sector
- + rdev->data_offset),
- bdn);
-- else if (atomic_read(&rdev->read_errors)
-+ else if (atomic_read_unchecked(&rdev->read_errors)
- > conf->max_nr_stripes)
- printk(KERN_WARNING
- "raid5:%s: Too many read errors, failing device %s.\n",
-@@ -1870,6 +1870,7 @@ static sector_t compute_blocknr(struct s
- sector_t r_sector;
- struct stripe_head sh2;
-
-+ pax_track_stack();
-
- chunk_offset = sector_div(new_sector, sectors_per_chunk);
- stripe = new_sector;
-diff -urNp linux-2.6.32.45/drivers/media/common/saa7146_fops.c linux-2.6.32.45/drivers/media/common/saa7146_fops.c
---- linux-2.6.32.45/drivers/media/common/saa7146_fops.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/media/common/saa7146_fops.c 2011-08-05 20:33:55.000000000 -0400
-@@ -458,7 +458,7 @@ int saa7146_vv_init(struct saa7146_dev*
- ERR(("out of memory. aborting.\n"));
- return -ENOMEM;
- }
-- ext_vv->ops = saa7146_video_ioctl_ops;
-+ memcpy((void *)&ext_vv->ops, &saa7146_video_ioctl_ops, sizeof(saa7146_video_ioctl_ops));
- ext_vv->core_ops = &saa7146_video_ioctl_ops;
-
- DEB_EE(("dev:%p\n",dev));
-diff -urNp linux-2.6.32.45/drivers/media/common/saa7146_hlp.c linux-2.6.32.45/drivers/media/common/saa7146_hlp.c
---- linux-2.6.32.45/drivers/media/common/saa7146_hlp.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/media/common/saa7146_hlp.c 2011-05-16 21:46:57.000000000 -0400
-@@ -353,6 +353,8 @@ static void calculate_clipping_registers
-
- int x[32], y[32], w[32], h[32];
-
-+ pax_track_stack();
-+
- /* clear out memory */
- memset(&line_list[0], 0x00, sizeof(u32)*32);
- memset(&pixel_list[0], 0x00, sizeof(u32)*32);
-diff -urNp linux-2.6.32.45/drivers/media/dvb/dvb-core/dvb_ca_en50221.c linux-2.6.32.45/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
---- linux-2.6.32.45/drivers/media/dvb/dvb-core/dvb_ca_en50221.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/media/dvb/dvb-core/dvb_ca_en50221.c 2011-05-16 21:46:57.000000000 -0400
-@@ -590,6 +590,8 @@ static int dvb_ca_en50221_read_data(stru
- u8 buf[HOST_LINK_BUF_SIZE];
- int i;
-
-+ pax_track_stack();
-+
- dprintk("%s\n", __func__);
-
- /* check if we have space for a link buf in the rx_buffer */
-@@ -1285,6 +1287,8 @@ static ssize_t dvb_ca_en50221_io_write(s
- unsigned long timeout;
- int written;
-
-+ pax_track_stack();
-+
- dprintk("%s\n", __func__);
-
- /* Incoming packet has a 2 byte header. hdr[0] = slot_id, hdr[1] = connection_id */
-diff -urNp linux-2.6.32.45/drivers/media/dvb/dvb-core/dvb_demux.h linux-2.6.32.45/drivers/media/dvb/dvb-core/dvb_demux.h
---- linux-2.6.32.45/drivers/media/dvb/dvb-core/dvb_demux.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/media/dvb/dvb-core/dvb_demux.h 2011-08-05 20:33:55.000000000 -0400
-@@ -71,7 +71,7 @@ struct dvb_demux_feed {
- union {
- dmx_ts_cb ts;
- dmx_section_cb sec;
-- } cb;
-+ } __no_const cb;
-
- struct dvb_demux *demux;
- void *priv;
-diff -urNp linux-2.6.32.45/drivers/media/dvb/dvb-core/dvbdev.c linux-2.6.32.45/drivers/media/dvb/dvb-core/dvbdev.c
---- linux-2.6.32.45/drivers/media/dvb/dvb-core/dvbdev.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/media/dvb/dvb-core/dvbdev.c 2011-08-05 20:33:55.000000000 -0400
-@@ -228,8 +228,8 @@ int dvb_register_device(struct dvb_adapt
- dvbdev->fops = dvbdevfops;
- init_waitqueue_head (&dvbdev->wait_queue);
-
-- memcpy(dvbdevfops, template->fops, sizeof(struct file_operations));
-- dvbdevfops->owner = adap->module;
-+ memcpy((void *)dvbdevfops, template->fops, sizeof(struct file_operations));
-+ *(void **)&dvbdevfops->owner = adap->module;
-
- list_add_tail (&dvbdev->list_head, &adap->device_list);
-
-diff -urNp linux-2.6.32.45/drivers/media/dvb/dvb-usb/cxusb.c linux-2.6.32.45/drivers/media/dvb/dvb-usb/cxusb.c
---- linux-2.6.32.45/drivers/media/dvb/dvb-usb/cxusb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/media/dvb/dvb-usb/cxusb.c 2011-08-05 20:33:55.000000000 -0400
-@@ -1040,7 +1040,7 @@ static struct dib0070_config dib7070p_di
- struct dib0700_adapter_state {
- int (*set_param_save) (struct dvb_frontend *,
- struct dvb_frontend_parameters *);
--};
-+} __no_const;
-
- static int dib7070_set_param_override(struct dvb_frontend *fe,
- struct dvb_frontend_parameters *fep)
-diff -urNp linux-2.6.32.45/drivers/media/dvb/dvb-usb/dib0700_core.c linux-2.6.32.45/drivers/media/dvb/dvb-usb/dib0700_core.c
---- linux-2.6.32.45/drivers/media/dvb/dvb-usb/dib0700_core.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/media/dvb/dvb-usb/dib0700_core.c 2011-05-16 21:46:57.000000000 -0400
-@@ -332,6 +332,8 @@ int dib0700_download_firmware(struct usb
-
- u8 buf[260];
-
-+ pax_track_stack();
-+
- while ((ret = dvb_usb_get_hexline(fw, &hx, &pos)) > 0) {
- deb_fwdata("writing to address 0x%08x (buffer: 0x%02x %02x)\n",hx.addr, hx.len, hx.chk);
-
-diff -urNp linux-2.6.32.45/drivers/media/dvb/dvb-usb/dib0700_devices.c linux-2.6.32.45/drivers/media/dvb/dvb-usb/dib0700_devices.c
---- linux-2.6.32.45/drivers/media/dvb/dvb-usb/dib0700_devices.c 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.45/drivers/media/dvb/dvb-usb/dib0700_devices.c 2011-08-05 20:33:55.000000000 -0400
-@@ -28,7 +28,7 @@ MODULE_PARM_DESC(force_lna_activation, "
-
- struct dib0700_adapter_state {
- int (*set_param_save) (struct dvb_frontend *, struct dvb_frontend_parameters *);
--};
-+} __no_const;
-
- /* Hauppauge Nova-T 500 (aka Bristol)
- * has a LNA on GPIO0 which is enabled by setting 1 */
-diff -urNp linux-2.6.32.45/drivers/media/dvb/frontends/dib3000.h linux-2.6.32.45/drivers/media/dvb/frontends/dib3000.h
---- linux-2.6.32.45/drivers/media/dvb/frontends/dib3000.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/media/dvb/frontends/dib3000.h 2011-08-05 20:33:55.000000000 -0400
-@@ -39,7 +39,7 @@ struct dib_fe_xfer_ops
- int (*fifo_ctrl)(struct dvb_frontend *fe, int onoff);
- int (*pid_ctrl)(struct dvb_frontend *fe, int index, int pid, int onoff);
- int (*tuner_pass_ctrl)(struct dvb_frontend *fe, int onoff, u8 pll_ctrl);
--};
-+} __no_const;
-
- #if defined(CONFIG_DVB_DIB3000MB) || (defined(CONFIG_DVB_DIB3000MB_MODULE) && defined(MODULE))
- extern struct dvb_frontend* dib3000mb_attach(const struct dib3000_config* config,
-diff -urNp linux-2.6.32.45/drivers/media/dvb/frontends/or51211.c linux-2.6.32.45/drivers/media/dvb/frontends/or51211.c
---- linux-2.6.32.45/drivers/media/dvb/frontends/or51211.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/media/dvb/frontends/or51211.c 2011-05-16 21:46:57.000000000 -0400
-@@ -113,6 +113,8 @@ static int or51211_load_firmware (struct
- u8 tudata[585];
- int i;
-
-+ pax_track_stack();
-+
- dprintk("Firmware is %zd bytes\n",fw->size);
-
- /* Get eprom data */
-diff -urNp linux-2.6.32.45/drivers/media/dvb/ttpci/av7110_v4l.c linux-2.6.32.45/drivers/media/dvb/ttpci/av7110_v4l.c
---- linux-2.6.32.45/drivers/media/dvb/ttpci/av7110_v4l.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/media/dvb/ttpci/av7110_v4l.c 2011-08-05 20:33:55.000000000 -0400
-@@ -796,18 +796,18 @@ int av7110_init_v4l(struct av7110 *av711
- ERR(("cannot init capture device. skipping.\n"));
- return -ENODEV;
- }
-- vv_data->ops.vidioc_enum_input = vidioc_enum_input;
-- vv_data->ops.vidioc_g_input = vidioc_g_input;
-- vv_data->ops.vidioc_s_input = vidioc_s_input;
-- vv_data->ops.vidioc_g_tuner = vidioc_g_tuner;
-- vv_data->ops.vidioc_s_tuner = vidioc_s_tuner;
-- vv_data->ops.vidioc_g_frequency = vidioc_g_frequency;
-- vv_data->ops.vidioc_s_frequency = vidioc_s_frequency;
-- vv_data->ops.vidioc_g_audio = vidioc_g_audio;
-- vv_data->ops.vidioc_s_audio = vidioc_s_audio;
-- vv_data->ops.vidioc_g_sliced_vbi_cap = vidioc_g_sliced_vbi_cap;
-- vv_data->ops.vidioc_g_fmt_sliced_vbi_out = vidioc_g_fmt_sliced_vbi_out;
-- vv_data->ops.vidioc_s_fmt_sliced_vbi_out = vidioc_s_fmt_sliced_vbi_out;
-+ *(void **)&vv_data->ops.vidioc_enum_input = vidioc_enum_input;
-+ *(void **)&vv_data->ops.vidioc_g_input = vidioc_g_input;
-+ *(void **)&vv_data->ops.vidioc_s_input = vidioc_s_input;
-+ *(void **)&vv_data->ops.vidioc_g_tuner = vidioc_g_tuner;
-+ *(void **)&vv_data->ops.vidioc_s_tuner = vidioc_s_tuner;
-+ *(void **)&vv_data->ops.vidioc_g_frequency = vidioc_g_frequency;
-+ *(void **)&vv_data->ops.vidioc_s_frequency = vidioc_s_frequency;
-+ *(void **)&vv_data->ops.vidioc_g_audio = vidioc_g_audio;
-+ *(void **)&vv_data->ops.vidioc_s_audio = vidioc_s_audio;
-+ *(void **)&vv_data->ops.vidioc_g_sliced_vbi_cap = vidioc_g_sliced_vbi_cap;
-+ *(void **)&vv_data->ops.vidioc_g_fmt_sliced_vbi_out = vidioc_g_fmt_sliced_vbi_out;
-+ *(void **)&vv_data->ops.vidioc_s_fmt_sliced_vbi_out = vidioc_s_fmt_sliced_vbi_out;
-
- if (saa7146_register_device(&av7110->v4l_dev, dev, "av7110", VFL_TYPE_GRABBER)) {
- ERR(("cannot register capture device. skipping.\n"));
-diff -urNp linux-2.6.32.45/drivers/media/dvb/ttpci/budget-av.c linux-2.6.32.45/drivers/media/dvb/ttpci/budget-av.c
---- linux-2.6.32.45/drivers/media/dvb/ttpci/budget-av.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/media/dvb/ttpci/budget-av.c 2011-08-05 20:33:55.000000000 -0400
-@@ -1477,9 +1477,9 @@ static int budget_av_attach(struct saa71
- ERR(("cannot init vv subsystem.\n"));
- return err;
- }
-- vv_data.ops.vidioc_enum_input = vidioc_enum_input;
-- vv_data.ops.vidioc_g_input = vidioc_g_input;
-- vv_data.ops.vidioc_s_input = vidioc_s_input;
-+ *(void **)&vv_data.ops.vidioc_enum_input = vidioc_enum_input;
-+ *(void **)&vv_data.ops.vidioc_g_input = vidioc_g_input;
-+ *(void **)&vv_data.ops.vidioc_s_input = vidioc_s_input;
-
- if ((err = saa7146_register_device(&budget_av->vd, dev, "knc1", VFL_TYPE_GRABBER))) {
- /* fixme: proper cleanup here */
-diff -urNp linux-2.6.32.45/drivers/media/radio/radio-cadet.c linux-2.6.32.45/drivers/media/radio/radio-cadet.c
---- linux-2.6.32.45/drivers/media/radio/radio-cadet.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/media/radio/radio-cadet.c 2011-04-17 15:56:46.000000000 -0400
-@@ -347,7 +347,7 @@ static ssize_t cadet_read(struct file *f
- while (i < count && dev->rdsin != dev->rdsout)
- readbuf[i++] = dev->rdsbuf[dev->rdsout++];
-
-- if (copy_to_user(data, readbuf, i))
-+ if (i > sizeof readbuf || copy_to_user(data, readbuf, i))
- return -EFAULT;
- return i;
- }
-diff -urNp linux-2.6.32.45/drivers/media/video/cx18/cx18-driver.c linux-2.6.32.45/drivers/media/video/cx18/cx18-driver.c
---- linux-2.6.32.45/drivers/media/video/cx18/cx18-driver.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/media/video/cx18/cx18-driver.c 2011-05-16 21:46:57.000000000 -0400
-@@ -56,7 +56,7 @@ static struct pci_device_id cx18_pci_tbl
-
- MODULE_DEVICE_TABLE(pci, cx18_pci_tbl);
-
--static atomic_t cx18_instance = ATOMIC_INIT(0);
-+static atomic_unchecked_t cx18_instance = ATOMIC_INIT(0);
-
- /* Parameter declarations */
- static int cardtype[CX18_MAX_CARDS];
-@@ -288,6 +288,8 @@ void cx18_read_eeprom(struct cx18 *cx, s
- struct i2c_client c;
- u8 eedata[256];
-
-+ pax_track_stack();
-+
- memset(&c, 0, sizeof(c));
- strlcpy(c.name, "cx18 tveeprom tmp", sizeof(c.name));
- c.adapter = &cx->i2c_adap[0];
-@@ -800,7 +802,7 @@ static int __devinit cx18_probe(struct p
- struct cx18 *cx;
-
- /* FIXME - module parameter arrays constrain max instances */
-- i = atomic_inc_return(&cx18_instance) - 1;
-+ i = atomic_inc_return_unchecked(&cx18_instance) - 1;
- if (i >= CX18_MAX_CARDS) {
- printk(KERN_ERR "cx18: cannot manage card %d, driver has a "
- "limit of 0 - %d\n", i, CX18_MAX_CARDS - 1);
-diff -urNp linux-2.6.32.45/drivers/media/video/hexium_gemini.c linux-2.6.32.45/drivers/media/video/hexium_gemini.c
---- linux-2.6.32.45/drivers/media/video/hexium_gemini.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/media/video/hexium_gemini.c 2011-08-05 20:33:55.000000000 -0400
-@@ -394,12 +394,12 @@ static int hexium_attach(struct saa7146_
- hexium->cur_input = 0;
-
- saa7146_vv_init(dev, &vv_data);
-- vv_data.ops.vidioc_queryctrl = vidioc_queryctrl;
-- vv_data.ops.vidioc_g_ctrl = vidioc_g_ctrl;
-- vv_data.ops.vidioc_s_ctrl = vidioc_s_ctrl;
-- vv_data.ops.vidioc_enum_input = vidioc_enum_input;
-- vv_data.ops.vidioc_g_input = vidioc_g_input;
-- vv_data.ops.vidioc_s_input = vidioc_s_input;
-+ *(void **)&vv_data.ops.vidioc_queryctrl = vidioc_queryctrl;
-+ *(void **)&vv_data.ops.vidioc_g_ctrl = vidioc_g_ctrl;
-+ *(void **)&vv_data.ops.vidioc_s_ctrl = vidioc_s_ctrl;
-+ *(void **)&vv_data.ops.vidioc_enum_input = vidioc_enum_input;
-+ *(void **)&vv_data.ops.vidioc_g_input = vidioc_g_input;
-+ *(void **)&vv_data.ops.vidioc_s_input = vidioc_s_input;
- if (0 != saa7146_register_device(&hexium->video_dev, dev, "hexium gemini", VFL_TYPE_GRABBER)) {
- printk("hexium_gemini: cannot register capture v4l2 device. skipping.\n");
- return -1;
-diff -urNp linux-2.6.32.45/drivers/media/video/hexium_orion.c linux-2.6.32.45/drivers/media/video/hexium_orion.c
---- linux-2.6.32.45/drivers/media/video/hexium_orion.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/media/video/hexium_orion.c 2011-08-05 20:33:55.000000000 -0400
-@@ -369,9 +369,9 @@ static int hexium_attach(struct saa7146_
- DEB_EE((".\n"));
-
- saa7146_vv_init(dev, &vv_data);
-- vv_data.ops.vidioc_enum_input = vidioc_enum_input;
-- vv_data.ops.vidioc_g_input = vidioc_g_input;
-- vv_data.ops.vidioc_s_input = vidioc_s_input;
-+ *(void **)&vv_data.ops.vidioc_enum_input = vidioc_enum_input;
-+ *(void **)&vv_data.ops.vidioc_g_input = vidioc_g_input;
-+ *(void **)&vv_data.ops.vidioc_s_input = vidioc_s_input;
- if (0 != saa7146_register_device(&hexium->video_dev, dev, "hexium orion", VFL_TYPE_GRABBER)) {
- printk("hexium_orion: cannot register capture v4l2 device. skipping.\n");
- return -1;
-diff -urNp linux-2.6.32.45/drivers/media/video/ivtv/ivtv-driver.c linux-2.6.32.45/drivers/media/video/ivtv/ivtv-driver.c
---- linux-2.6.32.45/drivers/media/video/ivtv/ivtv-driver.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/media/video/ivtv/ivtv-driver.c 2011-05-04 17:56:28.000000000 -0400
-@@ -79,7 +79,7 @@ static struct pci_device_id ivtv_pci_tbl
- MODULE_DEVICE_TABLE(pci,ivtv_pci_tbl);
-
- /* ivtv instance counter */
--static atomic_t ivtv_instance = ATOMIC_INIT(0);
-+static atomic_unchecked_t ivtv_instance = ATOMIC_INIT(0);
-
- /* Parameter declarations */
- static int cardtype[IVTV_MAX_CARDS];
-diff -urNp linux-2.6.32.45/drivers/media/video/mxb.c linux-2.6.32.45/drivers/media/video/mxb.c
---- linux-2.6.32.45/drivers/media/video/mxb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/media/video/mxb.c 2011-08-05 20:33:55.000000000 -0400
-@@ -703,23 +703,23 @@ static int mxb_attach(struct saa7146_dev
- already did this in "mxb_vl42_probe" */
-
- saa7146_vv_init(dev, &vv_data);
-- vv_data.ops.vidioc_queryctrl = vidioc_queryctrl;
-- vv_data.ops.vidioc_g_ctrl = vidioc_g_ctrl;
-- vv_data.ops.vidioc_s_ctrl = vidioc_s_ctrl;
-- vv_data.ops.vidioc_enum_input = vidioc_enum_input;
-- vv_data.ops.vidioc_g_input = vidioc_g_input;
-- vv_data.ops.vidioc_s_input = vidioc_s_input;
-- vv_data.ops.vidioc_g_tuner = vidioc_g_tuner;
-- vv_data.ops.vidioc_s_tuner = vidioc_s_tuner;
-- vv_data.ops.vidioc_g_frequency = vidioc_g_frequency;
-- vv_data.ops.vidioc_s_frequency = vidioc_s_frequency;
-- vv_data.ops.vidioc_g_audio = vidioc_g_audio;
-- vv_data.ops.vidioc_s_audio = vidioc_s_audio;
-+ *(void **)&vv_data.ops.vidioc_queryctrl = vidioc_queryctrl;
-+ *(void **)&vv_data.ops.vidioc_g_ctrl = vidioc_g_ctrl;
-+ *(void **)&vv_data.ops.vidioc_s_ctrl = vidioc_s_ctrl;
-+ *(void **)&vv_data.ops.vidioc_enum_input = vidioc_enum_input;
-+ *(void **)&vv_data.ops.vidioc_g_input = vidioc_g_input;
-+ *(void **)&vv_data.ops.vidioc_s_input = vidioc_s_input;
-+ *(void **)&vv_data.ops.vidioc_g_tuner = vidioc_g_tuner;
-+ *(void **)&vv_data.ops.vidioc_s_tuner = vidioc_s_tuner;
-+ *(void **)&vv_data.ops.vidioc_g_frequency = vidioc_g_frequency;
-+ *(void **)&vv_data.ops.vidioc_s_frequency = vidioc_s_frequency;
-+ *(void **)&vv_data.ops.vidioc_g_audio = vidioc_g_audio;
-+ *(void **)&vv_data.ops.vidioc_s_audio = vidioc_s_audio;
- #ifdef CONFIG_VIDEO_ADV_DEBUG
-- vv_data.ops.vidioc_g_register = vidioc_g_register;
-- vv_data.ops.vidioc_s_register = vidioc_s_register;
-+ *(void **)&vv_data.ops.vidioc_g_register = vidioc_g_register;
-+ *(void **)&vv_data.ops.vidioc_s_register = vidioc_s_register;
- #endif
-- vv_data.ops.vidioc_default = vidioc_default;
-+ *(void **)&vv_data.ops.vidioc_default = vidioc_default;
- if (saa7146_register_device(&mxb->video_dev, dev, "mxb", VFL_TYPE_GRABBER)) {
- ERR(("cannot register capture v4l2 device. skipping.\n"));
- return -1;
-diff -urNp linux-2.6.32.45/drivers/media/video/omap24xxcam.c linux-2.6.32.45/drivers/media/video/omap24xxcam.c
---- linux-2.6.32.45/drivers/media/video/omap24xxcam.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/media/video/omap24xxcam.c 2011-05-04 17:56:28.000000000 -0400
-@@ -401,7 +401,7 @@ static void omap24xxcam_vbq_complete(str
- spin_unlock_irqrestore(&cam->core_enable_disable_lock, flags);
-
- do_gettimeofday(&vb->ts);
-- vb->field_count = atomic_add_return(2, &fh->field_count);
-+ vb->field_count = atomic_add_return_unchecked(2, &fh->field_count);
- if (csr & csr_error) {
- vb->state = VIDEOBUF_ERROR;
- if (!atomic_read(&fh->cam->in_reset)) {
-diff -urNp linux-2.6.32.45/drivers/media/video/omap24xxcam.h linux-2.6.32.45/drivers/media/video/omap24xxcam.h
---- linux-2.6.32.45/drivers/media/video/omap24xxcam.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/media/video/omap24xxcam.h 2011-05-04 17:56:28.000000000 -0400
-@@ -533,7 +533,7 @@ struct omap24xxcam_fh {
- spinlock_t vbq_lock; /* spinlock for the videobuf queue */
- struct videobuf_queue vbq;
- struct v4l2_pix_format pix; /* serialise pix by vbq->lock */
-- atomic_t field_count; /* field counter for videobuf_buffer */
-+ atomic_unchecked_t field_count; /* field counter for videobuf_buffer */
- /* accessing cam here doesn't need serialisation: it's constant */
- struct omap24xxcam_device *cam;
- };
-diff -urNp linux-2.6.32.45/drivers/media/video/pvrusb2/pvrusb2-eeprom.c linux-2.6.32.45/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
---- linux-2.6.32.45/drivers/media/video/pvrusb2/pvrusb2-eeprom.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/media/video/pvrusb2/pvrusb2-eeprom.c 2011-05-16 21:46:57.000000000 -0400
-@@ -119,6 +119,8 @@ int pvr2_eeprom_analyze(struct pvr2_hdw
- u8 *eeprom;
- struct tveeprom tvdata;
-
-+ pax_track_stack();
-+
- memset(&tvdata,0,sizeof(tvdata));
-
- eeprom = pvr2_eeprom_fetch(hdw);
-diff -urNp linux-2.6.32.45/drivers/media/video/saa7134/saa6752hs.c linux-2.6.32.45/drivers/media/video/saa7134/saa6752hs.c
---- linux-2.6.32.45/drivers/media/video/saa7134/saa6752hs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/media/video/saa7134/saa6752hs.c 2011-05-16 21:46:57.000000000 -0400
-@@ -683,6 +683,8 @@ static int saa6752hs_init(struct v4l2_su
- unsigned char localPAT[256];
- unsigned char localPMT[256];
-
-+ pax_track_stack();
-+
- /* Set video format - must be done first as it resets other settings */
- set_reg8(client, 0x41, h->video_format);
-
-diff -urNp linux-2.6.32.45/drivers/media/video/saa7164/saa7164-cmd.c linux-2.6.32.45/drivers/media/video/saa7164/saa7164-cmd.c
---- linux-2.6.32.45/drivers/media/video/saa7164/saa7164-cmd.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/media/video/saa7164/saa7164-cmd.c 2011-05-16 21:46:57.000000000 -0400
-@@ -87,6 +87,8 @@ int saa7164_irq_dequeue(struct saa7164_d
- wait_queue_head_t *q = 0;
- dprintk(DBGLVL_CMD, "%s()\n", __func__);
-
-+ pax_track_stack();
-+
- /* While any outstand message on the bus exists... */
- do {
-
-@@ -126,6 +128,8 @@ int saa7164_cmd_dequeue(struct saa7164_d
- u8 tmp[512];
- dprintk(DBGLVL_CMD, "%s()\n", __func__);
-
-+ pax_track_stack();
-+
- while (loop) {
-
- tmComResInfo_t tRsp = { 0, 0, 0, 0, 0, 0 };
-diff -urNp linux-2.6.32.45/drivers/media/video/usbvideo/ibmcam.c linux-2.6.32.45/drivers/media/video/usbvideo/ibmcam.c
---- linux-2.6.32.45/drivers/media/video/usbvideo/ibmcam.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/media/video/usbvideo/ibmcam.c 2011-08-05 20:33:55.000000000 -0400
-@@ -3947,15 +3947,15 @@ static struct usb_device_id id_table[] =
- static int __init ibmcam_init(void)
- {
- struct usbvideo_cb cbTbl;
-- memset(&cbTbl, 0, sizeof(cbTbl));
-- cbTbl.probe = ibmcam_probe;
-- cbTbl.setupOnOpen = ibmcam_setup_on_open;
-- cbTbl.videoStart = ibmcam_video_start;
-- cbTbl.videoStop = ibmcam_video_stop;
-- cbTbl.processData = ibmcam_ProcessIsocData;
-- cbTbl.postProcess = usbvideo_DeinterlaceFrame;
-- cbTbl.adjustPicture = ibmcam_adjust_picture;
-- cbTbl.getFPS = ibmcam_calculate_fps;
-+ memset((void *)&cbTbl, 0, sizeof(cbTbl));
-+ *(void **)&cbTbl.probe = ibmcam_probe;
-+ *(void **)&cbTbl.setupOnOpen = ibmcam_setup_on_open;
-+ *(void **)&cbTbl.videoStart = ibmcam_video_start;
-+ *(void **)&cbTbl.videoStop = ibmcam_video_stop;
-+ *(void **)&cbTbl.processData = ibmcam_ProcessIsocData;
-+ *(void **)&cbTbl.postProcess = usbvideo_DeinterlaceFrame;
-+ *(void **)&cbTbl.adjustPicture = ibmcam_adjust_picture;
-+ *(void **)&cbTbl.getFPS = ibmcam_calculate_fps;
- return usbvideo_register(
- &cams,
- MAX_IBMCAM,
-diff -urNp linux-2.6.32.45/drivers/media/video/usbvideo/konicawc.c linux-2.6.32.45/drivers/media/video/usbvideo/konicawc.c
---- linux-2.6.32.45/drivers/media/video/usbvideo/konicawc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/media/video/usbvideo/konicawc.c 2011-08-05 20:33:55.000000000 -0400
-@@ -225,7 +225,7 @@ static void konicawc_register_input(stru
- int error;
-
- usb_make_path(dev, cam->input_physname, sizeof(cam->input_physname));
-- strncat(cam->input_physname, "/input0", sizeof(cam->input_physname));
-+ strlcat(cam->input_physname, "/input0", sizeof(cam->input_physname));
-
- cam->input = input_dev = input_allocate_device();
- if (!input_dev) {
-@@ -935,16 +935,16 @@ static int __init konicawc_init(void)
- struct usbvideo_cb cbTbl;
- printk(KERN_INFO KBUILD_MODNAME ": " DRIVER_VERSION ":"
- DRIVER_DESC "\n");
-- memset(&cbTbl, 0, sizeof(cbTbl));
-- cbTbl.probe = konicawc_probe;
-- cbTbl.setupOnOpen = konicawc_setup_on_open;
-- cbTbl.processData = konicawc_process_isoc;
-- cbTbl.getFPS = konicawc_calculate_fps;
-- cbTbl.setVideoMode = konicawc_set_video_mode;
-- cbTbl.startDataPump = konicawc_start_data;
-- cbTbl.stopDataPump = konicawc_stop_data;
-- cbTbl.adjustPicture = konicawc_adjust_picture;
-- cbTbl.userFree = konicawc_free_uvd;
-+ memset((void * )&cbTbl, 0, sizeof(cbTbl));
-+ *(void **)&cbTbl.probe = konicawc_probe;
-+ *(void **)&cbTbl.setupOnOpen = konicawc_setup_on_open;
-+ *(void **)&cbTbl.processData = konicawc_process_isoc;
-+ *(void **)&cbTbl.getFPS = konicawc_calculate_fps;
-+ *(void **)&cbTbl.setVideoMode = konicawc_set_video_mode;
-+ *(void **)&cbTbl.startDataPump = konicawc_start_data;
-+ *(void **)&cbTbl.stopDataPump = konicawc_stop_data;
-+ *(void **)&cbTbl.adjustPicture = konicawc_adjust_picture;
-+ *(void **)&cbTbl.userFree = konicawc_free_uvd;
- return usbvideo_register(
- &cams,
- MAX_CAMERAS,
-diff -urNp linux-2.6.32.45/drivers/media/video/usbvideo/quickcam_messenger.c linux-2.6.32.45/drivers/media/video/usbvideo/quickcam_messenger.c
---- linux-2.6.32.45/drivers/media/video/usbvideo/quickcam_messenger.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/media/video/usbvideo/quickcam_messenger.c 2011-04-17 15:56:46.000000000 -0400
-@@ -89,7 +89,7 @@ static void qcm_register_input(struct qc
- int error;
-
- usb_make_path(dev, cam->input_physname, sizeof(cam->input_physname));
-- strncat(cam->input_physname, "/input0", sizeof(cam->input_physname));
-+ strlcat(cam->input_physname, "/input0", sizeof(cam->input_physname));
-
- cam->input = input_dev = input_allocate_device();
- if (!input_dev) {
-diff -urNp linux-2.6.32.45/drivers/media/video/usbvideo/ultracam.c linux-2.6.32.45/drivers/media/video/usbvideo/ultracam.c
---- linux-2.6.32.45/drivers/media/video/usbvideo/ultracam.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/media/video/usbvideo/ultracam.c 2011-08-05 20:33:55.000000000 -0400
-@@ -655,14 +655,14 @@ static int __init ultracam_init(void)
- {
- struct usbvideo_cb cbTbl;
- memset(&cbTbl, 0, sizeof(cbTbl));
-- cbTbl.probe = ultracam_probe;
-- cbTbl.setupOnOpen = ultracam_setup_on_open;
-- cbTbl.videoStart = ultracam_video_start;
-- cbTbl.videoStop = ultracam_video_stop;
-- cbTbl.processData = ultracam_ProcessIsocData;
-- cbTbl.postProcess = usbvideo_DeinterlaceFrame;
-- cbTbl.adjustPicture = ultracam_adjust_picture;
-- cbTbl.getFPS = ultracam_calculate_fps;
-+ *(void **)&cbTbl.probe = ultracam_probe;
-+ *(void **)&cbTbl.setupOnOpen = ultracam_setup_on_open;
-+ *(void **)&cbTbl.videoStart = ultracam_video_start;
-+ *(void **)&cbTbl.videoStop = ultracam_video_stop;
-+ *(void **)&cbTbl.processData = ultracam_ProcessIsocData;
-+ *(void **)&cbTbl.postProcess = usbvideo_DeinterlaceFrame;
-+ *(void **)&cbTbl.adjustPicture = ultracam_adjust_picture;
-+ *(void **)&cbTbl.getFPS = ultracam_calculate_fps;
- return usbvideo_register(
- &cams,
- MAX_CAMERAS,
-diff -urNp linux-2.6.32.45/drivers/media/video/usbvideo/usbvideo.c linux-2.6.32.45/drivers/media/video/usbvideo/usbvideo.c
---- linux-2.6.32.45/drivers/media/video/usbvideo/usbvideo.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/media/video/usbvideo/usbvideo.c 2011-08-05 20:33:55.000000000 -0400
-@@ -697,15 +697,15 @@ int usbvideo_register(
- __func__, cams, base_size, num_cams);
-
- /* Copy callbacks, apply defaults for those that are not set */
-- memmove(&cams->cb, cbTbl, sizeof(cams->cb));
-+ memmove((void *)&cams->cb, cbTbl, sizeof(cams->cb));
- if (cams->cb.getFrame == NULL)
-- cams->cb.getFrame = usbvideo_GetFrame;
-+ *(void **)&cams->cb.getFrame = usbvideo_GetFrame;
- if (cams->cb.disconnect == NULL)
-- cams->cb.disconnect = usbvideo_Disconnect;
-+ *(void **)&cams->cb.disconnect = usbvideo_Disconnect;
- if (cams->cb.startDataPump == NULL)
-- cams->cb.startDataPump = usbvideo_StartDataPump;
-+ *(void **)&cams->cb.startDataPump = usbvideo_StartDataPump;
- if (cams->cb.stopDataPump == NULL)
-- cams->cb.stopDataPump = usbvideo_StopDataPump;
-+ *(void **)&cams->cb.stopDataPump = usbvideo_StopDataPump;
-
- cams->num_cameras = num_cams;
- cams->cam = (struct uvd *) &cams[1];
-diff -urNp linux-2.6.32.45/drivers/media/video/usbvision/usbvision-core.c linux-2.6.32.45/drivers/media/video/usbvision/usbvision-core.c
---- linux-2.6.32.45/drivers/media/video/usbvision/usbvision-core.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/media/video/usbvision/usbvision-core.c 2011-05-16 21:46:57.000000000 -0400
-@@ -820,6 +820,8 @@ static enum ParseState usbvision_parse_c
- unsigned char rv, gv, bv;
- static unsigned char *Y, *U, *V;
-
-+ pax_track_stack();
-+
- frame = usbvision->curFrame;
- imageSize = frame->frmwidth * frame->frmheight;
- if ( (frame->v4l2_format.format == V4L2_PIX_FMT_YUV422P) ||
-diff -urNp linux-2.6.32.45/drivers/media/video/v4l2-device.c linux-2.6.32.45/drivers/media/video/v4l2-device.c
---- linux-2.6.32.45/drivers/media/video/v4l2-device.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/media/video/v4l2-device.c 2011-05-04 17:56:28.000000000 -0400
-@@ -50,9 +50,9 @@ int v4l2_device_register(struct device *
- EXPORT_SYMBOL_GPL(v4l2_device_register);
-
- int v4l2_device_set_name(struct v4l2_device *v4l2_dev, const char *basename,
-- atomic_t *instance)
-+ atomic_unchecked_t *instance)
- {
-- int num = atomic_inc_return(instance) - 1;
-+ int num = atomic_inc_return_unchecked(instance) - 1;
- int len = strlen(basename);
-
- if (basename[len - 1] >= '0' && basename[len - 1] <= '9')
-diff -urNp linux-2.6.32.45/drivers/media/video/videobuf-dma-sg.c linux-2.6.32.45/drivers/media/video/videobuf-dma-sg.c
---- linux-2.6.32.45/drivers/media/video/videobuf-dma-sg.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/media/video/videobuf-dma-sg.c 2011-05-16 21:46:57.000000000 -0400
-@@ -693,6 +693,8 @@ void *videobuf_sg_alloc(size_t size)
- {
- struct videobuf_queue q;
-
-+ pax_track_stack();
-+
- /* Required to make generic handler to call __videobuf_alloc */
- q.int_ops = &sg_ops;
-
-diff -urNp linux-2.6.32.45/drivers/message/fusion/mptbase.c linux-2.6.32.45/drivers/message/fusion/mptbase.c
---- linux-2.6.32.45/drivers/message/fusion/mptbase.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/message/fusion/mptbase.c 2011-04-17 15:56:46.000000000 -0400
-@@ -6709,8 +6709,14 @@ procmpt_iocinfo_read(char *buf, char **s
- len += sprintf(buf+len, " MaxChainDepth = 0x%02x frames\n", ioc->facts.MaxChainDepth);
- len += sprintf(buf+len, " MinBlockSize = 0x%02x bytes\n", 4*ioc->facts.BlockSize);
-
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ len += sprintf(buf+len, " RequestFrames @ 0x%p (Dma @ 0x%p)\n",
-+ NULL, NULL);
-+#else
- len += sprintf(buf+len, " RequestFrames @ 0x%p (Dma @ 0x%p)\n",
- (void *)ioc->req_frames, (void *)(ulong)ioc->req_frames_dma);
-+#endif
-+
- /*
- * Rounding UP to nearest 4-kB boundary here...
- */
-diff -urNp linux-2.6.32.45/drivers/message/fusion/mptsas.c linux-2.6.32.45/drivers/message/fusion/mptsas.c
---- linux-2.6.32.45/drivers/message/fusion/mptsas.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/message/fusion/mptsas.c 2011-04-17 15:56:46.000000000 -0400
-@@ -436,6 +436,23 @@ mptsas_is_end_device(struct mptsas_devin
- return 0;
- }
-
-+static inline void
-+mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
-+{
-+ if (phy_info->port_details) {
-+ phy_info->port_details->rphy = rphy;
-+ dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
-+ ioc->name, rphy));
-+ }
-+
-+ if (rphy) {
-+ dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
-+ &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
-+ dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
-+ ioc->name, rphy, rphy->dev.release));
-+ }
-+}
-+
- /* no mutex */
- static void
- mptsas_port_delete(MPT_ADAPTER *ioc, struct mptsas_portinfo_details * port_details)
-@@ -474,23 +491,6 @@ mptsas_get_rphy(struct mptsas_phyinfo *p
- return NULL;
- }
-
--static inline void
--mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
--{
-- if (phy_info->port_details) {
-- phy_info->port_details->rphy = rphy;
-- dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
-- ioc->name, rphy));
-- }
--
-- if (rphy) {
-- dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
-- &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
-- dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
-- ioc->name, rphy, rphy->dev.release));
-- }
--}
--
- static inline struct sas_port *
- mptsas_get_port(struct mptsas_phyinfo *phy_info)
- {
-diff -urNp linux-2.6.32.45/drivers/message/fusion/mptscsih.c linux-2.6.32.45/drivers/message/fusion/mptscsih.c
---- linux-2.6.32.45/drivers/message/fusion/mptscsih.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/message/fusion/mptscsih.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1248,15 +1248,16 @@ mptscsih_info(struct Scsi_Host *SChost)
-
- h = shost_priv(SChost);
-
-- if (h) {
-- if (h->info_kbuf == NULL)
-- if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
-- return h->info_kbuf;
-- h->info_kbuf[0] = '\0';
-+ if (!h)
-+ return NULL;
-
-- mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
-- h->info_kbuf[size-1] = '\0';
-- }
-+ if (h->info_kbuf == NULL)
-+ if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
-+ return h->info_kbuf;
-+ h->info_kbuf[0] = '\0';
-+
-+ mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
-+ h->info_kbuf[size-1] = '\0';
-
- return h->info_kbuf;
- }
-diff -urNp linux-2.6.32.45/drivers/message/i2o/i2o_config.c linux-2.6.32.45/drivers/message/i2o/i2o_config.c
---- linux-2.6.32.45/drivers/message/i2o/i2o_config.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/message/i2o/i2o_config.c 2011-05-16 21:46:57.000000000 -0400
-@@ -787,6 +787,8 @@ static int i2o_cfg_passthru(unsigned lon
- struct i2o_message *msg;
- unsigned int iop;
-
-+ pax_track_stack();
-+
- if (get_user(iop, &cmd->iop) || get_user(user_msg, &cmd->msg))
- return -EFAULT;
-
-diff -urNp linux-2.6.32.45/drivers/message/i2o/i2o_proc.c linux-2.6.32.45/drivers/message/i2o/i2o_proc.c
---- linux-2.6.32.45/drivers/message/i2o/i2o_proc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/message/i2o/i2o_proc.c 2011-04-17 15:56:46.000000000 -0400
-@@ -259,13 +259,6 @@ static char *scsi_devices[] = {
- "Array Controller Device"
- };
-
--static char *chtostr(u8 * chars, int n)
--{
-- char tmp[256];
-- tmp[0] = 0;
-- return strncat(tmp, (char *)chars, n);
--}
--
- static int i2o_report_query_status(struct seq_file *seq, int block_status,
- char *group)
- {
-@@ -842,8 +835,7 @@ static int i2o_seq_show_ddm_table(struct
-
- seq_printf(seq, "%-#7x", ddm_table.i2o_vendor_id);
- seq_printf(seq, "%-#8x", ddm_table.module_id);
-- seq_printf(seq, "%-29s",
-- chtostr(ddm_table.module_name_version, 28));
-+ seq_printf(seq, "%-.28s", ddm_table.module_name_version);
- seq_printf(seq, "%9d ", ddm_table.data_size);
- seq_printf(seq, "%8d", ddm_table.code_size);
-
-@@ -944,8 +936,8 @@ static int i2o_seq_show_drivers_stored(s
-
- seq_printf(seq, "%-#7x", dst->i2o_vendor_id);
- seq_printf(seq, "%-#8x", dst->module_id);
-- seq_printf(seq, "%-29s", chtostr(dst->module_name_version, 28));
-- seq_printf(seq, "%-9s", chtostr(dst->date, 8));
-+ seq_printf(seq, "%-.28s", dst->module_name_version);
-+ seq_printf(seq, "%-.8s", dst->date);
- seq_printf(seq, "%8d ", dst->module_size);
- seq_printf(seq, "%8d ", dst->mpb_size);
- seq_printf(seq, "0x%04x", dst->module_flags);
-@@ -1276,14 +1268,10 @@ static int i2o_seq_show_dev_identity(str
- seq_printf(seq, "Device Class : %s\n", i2o_get_class_name(work16[0]));
- seq_printf(seq, "Owner TID : %0#5x\n", work16[2]);
- seq_printf(seq, "Parent TID : %0#5x\n", work16[3]);
-- seq_printf(seq, "Vendor info : %s\n",
-- chtostr((u8 *) (work32 + 2), 16));
-- seq_printf(seq, "Product info : %s\n",
-- chtostr((u8 *) (work32 + 6), 16));
-- seq_printf(seq, "Description : %s\n",
-- chtostr((u8 *) (work32 + 10), 16));
-- seq_printf(seq, "Product rev. : %s\n",
-- chtostr((u8 *) (work32 + 14), 8));
-+ seq_printf(seq, "Vendor info : %.16s\n", (u8 *) (work32 + 2));
-+ seq_printf(seq, "Product info : %.16s\n", (u8 *) (work32 + 6));
-+ seq_printf(seq, "Description : %.16s\n", (u8 *) (work32 + 10));
-+ seq_printf(seq, "Product rev. : %.8s\n", (u8 *) (work32 + 14));
-
- seq_printf(seq, "Serial number : ");
- print_serial_number(seq, (u8 *) (work32 + 16),
-@@ -1328,10 +1316,8 @@ static int i2o_seq_show_ddm_identity(str
- }
-
- seq_printf(seq, "Registering DDM TID : 0x%03x\n", result.ddm_tid);
-- seq_printf(seq, "Module name : %s\n",
-- chtostr(result.module_name, 24));
-- seq_printf(seq, "Module revision : %s\n",
-- chtostr(result.module_rev, 8));
-+ seq_printf(seq, "Module name : %.24s\n", result.module_name);
-+ seq_printf(seq, "Module revision : %.8s\n", result.module_rev);
-
- seq_printf(seq, "Serial number : ");
- print_serial_number(seq, result.serial_number, sizeof(result) - 36);
-@@ -1362,14 +1348,10 @@ static int i2o_seq_show_uinfo(struct seq
- return 0;
- }
-
-- seq_printf(seq, "Device name : %s\n",
-- chtostr(result.device_name, 64));
-- seq_printf(seq, "Service name : %s\n",
-- chtostr(result.service_name, 64));
-- seq_printf(seq, "Physical name : %s\n",
-- chtostr(result.physical_location, 64));
-- seq_printf(seq, "Instance number : %s\n",
-- chtostr(result.instance_number, 4));
-+ seq_printf(seq, "Device name : %.64s\n", result.device_name);
-+ seq_printf(seq, "Service name : %.64s\n", result.service_name);
-+ seq_printf(seq, "Physical name : %.64s\n", result.physical_location);
-+ seq_printf(seq, "Instance number : %.4s\n", result.instance_number);
-
- return 0;
- }
-diff -urNp linux-2.6.32.45/drivers/message/i2o/iop.c linux-2.6.32.45/drivers/message/i2o/iop.c
---- linux-2.6.32.45/drivers/message/i2o/iop.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/message/i2o/iop.c 2011-05-04 17:56:28.000000000 -0400
-@@ -110,10 +110,10 @@ u32 i2o_cntxt_list_add(struct i2o_contro
-
- spin_lock_irqsave(&c->context_list_lock, flags);
-
-- if (unlikely(atomic_inc_and_test(&c->context_list_counter)))
-- atomic_inc(&c->context_list_counter);
-+ if (unlikely(atomic_inc_and_test_unchecked(&c->context_list_counter)))
-+ atomic_inc_unchecked(&c->context_list_counter);
-
-- entry->context = atomic_read(&c->context_list_counter);
-+ entry->context = atomic_read_unchecked(&c->context_list_counter);
-
- list_add(&entry->list, &c->context_list);
-
-@@ -1076,7 +1076,7 @@ struct i2o_controller *i2o_iop_alloc(voi
-
- #if BITS_PER_LONG == 64
- spin_lock_init(&c->context_list_lock);
-- atomic_set(&c->context_list_counter, 0);
-+ atomic_set_unchecked(&c->context_list_counter, 0);
- INIT_LIST_HEAD(&c->context_list);
- #endif
-
-diff -urNp linux-2.6.32.45/drivers/mfd/wm8350-i2c.c linux-2.6.32.45/drivers/mfd/wm8350-i2c.c
---- linux-2.6.32.45/drivers/mfd/wm8350-i2c.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/mfd/wm8350-i2c.c 2011-05-16 21:46:57.000000000 -0400
-@@ -43,6 +43,8 @@ static int wm8350_i2c_write_device(struc
- u8 msg[(WM8350_MAX_REGISTER << 1) + 1];
- int ret;
-
-+ pax_track_stack();
-+
- if (bytes > ((WM8350_MAX_REGISTER << 1) + 1))
- return -EINVAL;
-
-diff -urNp linux-2.6.32.45/drivers/misc/kgdbts.c linux-2.6.32.45/drivers/misc/kgdbts.c
---- linux-2.6.32.45/drivers/misc/kgdbts.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/misc/kgdbts.c 2011-04-17 15:56:46.000000000 -0400
-@@ -118,7 +118,7 @@
- } while (0)
- #define MAX_CONFIG_LEN 40
-
--static struct kgdb_io kgdbts_io_ops;
-+static const struct kgdb_io kgdbts_io_ops;
- static char get_buf[BUFMAX];
- static int get_buf_cnt;
- static char put_buf[BUFMAX];
-@@ -1102,7 +1102,7 @@ static void kgdbts_post_exp_handler(void
- module_put(THIS_MODULE);
- }
-
--static struct kgdb_io kgdbts_io_ops = {
-+static const struct kgdb_io kgdbts_io_ops = {
- .name = "kgdbts",
- .read_char = kgdbts_get_char,
- .write_char = kgdbts_put_char,
-diff -urNp linux-2.6.32.45/drivers/misc/sgi-gru/gruhandles.c linux-2.6.32.45/drivers/misc/sgi-gru/gruhandles.c
---- linux-2.6.32.45/drivers/misc/sgi-gru/gruhandles.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/misc/sgi-gru/gruhandles.c 2011-04-17 15:56:46.000000000 -0400
-@@ -39,8 +39,8 @@ struct mcs_op_statistic mcs_op_statistic
-
- static void update_mcs_stats(enum mcs_op op, unsigned long clks)
- {
-- atomic_long_inc(&mcs_op_statistics[op].count);
-- atomic_long_add(clks, &mcs_op_statistics[op].total);
-+ atomic_long_inc_unchecked(&mcs_op_statistics[op].count);
-+ atomic_long_add_unchecked(clks, &mcs_op_statistics[op].total);
- if (mcs_op_statistics[op].max < clks)
- mcs_op_statistics[op].max = clks;
- }
-diff -urNp linux-2.6.32.45/drivers/misc/sgi-gru/gruprocfs.c linux-2.6.32.45/drivers/misc/sgi-gru/gruprocfs.c
---- linux-2.6.32.45/drivers/misc/sgi-gru/gruprocfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/misc/sgi-gru/gruprocfs.c 2011-04-17 15:56:46.000000000 -0400
-@@ -32,9 +32,9 @@
-
- #define printstat(s, f) printstat_val(s, &gru_stats.f, #f)
-
--static void printstat_val(struct seq_file *s, atomic_long_t *v, char *id)
-+static void printstat_val(struct seq_file *s, atomic_long_unchecked_t *v, char *id)
- {
-- unsigned long val = atomic_long_read(v);
-+ unsigned long val = atomic_long_read_unchecked(v);
-
- if (val)
- seq_printf(s, "%16lu %s\n", val, id);
-@@ -136,8 +136,8 @@ static int mcs_statistics_show(struct se
- "cch_interrupt_sync", "cch_deallocate", "tgh_invalidate"};
-
- for (op = 0; op < mcsop_last; op++) {
-- count = atomic_long_read(&mcs_op_statistics[op].count);
-- total = atomic_long_read(&mcs_op_statistics[op].total);
-+ count = atomic_long_read_unchecked(&mcs_op_statistics[op].count);
-+ total = atomic_long_read_unchecked(&mcs_op_statistics[op].total);
- max = mcs_op_statistics[op].max;
- seq_printf(s, "%-20s%12ld%12ld%12ld\n", id[op], count,
- count ? total / count : 0, max);
-diff -urNp linux-2.6.32.45/drivers/misc/sgi-gru/grutables.h linux-2.6.32.45/drivers/misc/sgi-gru/grutables.h
---- linux-2.6.32.45/drivers/misc/sgi-gru/grutables.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/misc/sgi-gru/grutables.h 2011-04-17 15:56:46.000000000 -0400
-@@ -167,84 +167,84 @@ extern unsigned int gru_max_gids;
- * GRU statistics.
- */
- struct gru_stats_s {
-- atomic_long_t vdata_alloc;
-- atomic_long_t vdata_free;
-- atomic_long_t gts_alloc;
-- atomic_long_t gts_free;
-- atomic_long_t vdata_double_alloc;
-- atomic_long_t gts_double_allocate;
-- atomic_long_t assign_context;
-- atomic_long_t assign_context_failed;
-- atomic_long_t free_context;
-- atomic_long_t load_user_context;
-- atomic_long_t load_kernel_context;
-- atomic_long_t lock_kernel_context;
-- atomic_long_t unlock_kernel_context;
-- atomic_long_t steal_user_context;
-- atomic_long_t steal_kernel_context;
-- atomic_long_t steal_context_failed;
-- atomic_long_t nopfn;
-- atomic_long_t break_cow;
-- atomic_long_t asid_new;
-- atomic_long_t asid_next;
-- atomic_long_t asid_wrap;
-- atomic_long_t asid_reuse;
-- atomic_long_t intr;
-- atomic_long_t intr_mm_lock_failed;
-- atomic_long_t call_os;
-- atomic_long_t call_os_offnode_reference;
-- atomic_long_t call_os_check_for_bug;
-- atomic_long_t call_os_wait_queue;
-- atomic_long_t user_flush_tlb;
-- atomic_long_t user_unload_context;
-- atomic_long_t user_exception;
-- atomic_long_t set_context_option;
-- atomic_long_t migrate_check;
-- atomic_long_t migrated_retarget;
-- atomic_long_t migrated_unload;
-- atomic_long_t migrated_unload_delay;
-- atomic_long_t migrated_nopfn_retarget;
-- atomic_long_t migrated_nopfn_unload;
-- atomic_long_t tlb_dropin;
-- atomic_long_t tlb_dropin_fail_no_asid;
-- atomic_long_t tlb_dropin_fail_upm;
-- atomic_long_t tlb_dropin_fail_invalid;
-- atomic_long_t tlb_dropin_fail_range_active;
-- atomic_long_t tlb_dropin_fail_idle;
-- atomic_long_t tlb_dropin_fail_fmm;
-- atomic_long_t tlb_dropin_fail_no_exception;
-- atomic_long_t tlb_dropin_fail_no_exception_war;
-- atomic_long_t tfh_stale_on_fault;
-- atomic_long_t mmu_invalidate_range;
-- atomic_long_t mmu_invalidate_page;
-- atomic_long_t mmu_clear_flush_young;
-- atomic_long_t flush_tlb;
-- atomic_long_t flush_tlb_gru;
-- atomic_long_t flush_tlb_gru_tgh;
-- atomic_long_t flush_tlb_gru_zero_asid;
--
-- atomic_long_t copy_gpa;
--
-- atomic_long_t mesq_receive;
-- atomic_long_t mesq_receive_none;
-- atomic_long_t mesq_send;
-- atomic_long_t mesq_send_failed;
-- atomic_long_t mesq_noop;
-- atomic_long_t mesq_send_unexpected_error;
-- atomic_long_t mesq_send_lb_overflow;
-- atomic_long_t mesq_send_qlimit_reached;
-- atomic_long_t mesq_send_amo_nacked;
-- atomic_long_t mesq_send_put_nacked;
-- atomic_long_t mesq_qf_not_full;
-- atomic_long_t mesq_qf_locked;
-- atomic_long_t mesq_qf_noop_not_full;
-- atomic_long_t mesq_qf_switch_head_failed;
-- atomic_long_t mesq_qf_unexpected_error;
-- atomic_long_t mesq_noop_unexpected_error;
-- atomic_long_t mesq_noop_lb_overflow;
-- atomic_long_t mesq_noop_qlimit_reached;
-- atomic_long_t mesq_noop_amo_nacked;
-- atomic_long_t mesq_noop_put_nacked;
-+ atomic_long_unchecked_t vdata_alloc;
-+ atomic_long_unchecked_t vdata_free;
-+ atomic_long_unchecked_t gts_alloc;
-+ atomic_long_unchecked_t gts_free;
-+ atomic_long_unchecked_t vdata_double_alloc;
-+ atomic_long_unchecked_t gts_double_allocate;
-+ atomic_long_unchecked_t assign_context;
-+ atomic_long_unchecked_t assign_context_failed;
-+ atomic_long_unchecked_t free_context;
-+ atomic_long_unchecked_t load_user_context;
-+ atomic_long_unchecked_t load_kernel_context;
-+ atomic_long_unchecked_t lock_kernel_context;
-+ atomic_long_unchecked_t unlock_kernel_context;
-+ atomic_long_unchecked_t steal_user_context;
-+ atomic_long_unchecked_t steal_kernel_context;
-+ atomic_long_unchecked_t steal_context_failed;
-+ atomic_long_unchecked_t nopfn;
-+ atomic_long_unchecked_t break_cow;
-+ atomic_long_unchecked_t asid_new;
-+ atomic_long_unchecked_t asid_next;
-+ atomic_long_unchecked_t asid_wrap;
-+ atomic_long_unchecked_t asid_reuse;
-+ atomic_long_unchecked_t intr;
-+ atomic_long_unchecked_t intr_mm_lock_failed;
-+ atomic_long_unchecked_t call_os;
-+ atomic_long_unchecked_t call_os_offnode_reference;
-+ atomic_long_unchecked_t call_os_check_for_bug;
-+ atomic_long_unchecked_t call_os_wait_queue;
-+ atomic_long_unchecked_t user_flush_tlb;
-+ atomic_long_unchecked_t user_unload_context;
-+ atomic_long_unchecked_t user_exception;
-+ atomic_long_unchecked_t set_context_option;
-+ atomic_long_unchecked_t migrate_check;
-+ atomic_long_unchecked_t migrated_retarget;
-+ atomic_long_unchecked_t migrated_unload;
-+ atomic_long_unchecked_t migrated_unload_delay;
-+ atomic_long_unchecked_t migrated_nopfn_retarget;
-+ atomic_long_unchecked_t migrated_nopfn_unload;
-+ atomic_long_unchecked_t tlb_dropin;
-+ atomic_long_unchecked_t tlb_dropin_fail_no_asid;
-+ atomic_long_unchecked_t tlb_dropin_fail_upm;
-+ atomic_long_unchecked_t tlb_dropin_fail_invalid;
-+ atomic_long_unchecked_t tlb_dropin_fail_range_active;
-+ atomic_long_unchecked_t tlb_dropin_fail_idle;
-+ atomic_long_unchecked_t tlb_dropin_fail_fmm;
-+ atomic_long_unchecked_t tlb_dropin_fail_no_exception;
-+ atomic_long_unchecked_t tlb_dropin_fail_no_exception_war;
-+ atomic_long_unchecked_t tfh_stale_on_fault;
-+ atomic_long_unchecked_t mmu_invalidate_range;
-+ atomic_long_unchecked_t mmu_invalidate_page;
-+ atomic_long_unchecked_t mmu_clear_flush_young;
-+ atomic_long_unchecked_t flush_tlb;
-+ atomic_long_unchecked_t flush_tlb_gru;
-+ atomic_long_unchecked_t flush_tlb_gru_tgh;
-+ atomic_long_unchecked_t flush_tlb_gru_zero_asid;
-+
-+ atomic_long_unchecked_t copy_gpa;
-+
-+ atomic_long_unchecked_t mesq_receive;
-+ atomic_long_unchecked_t mesq_receive_none;
-+ atomic_long_unchecked_t mesq_send;
-+ atomic_long_unchecked_t mesq_send_failed;
-+ atomic_long_unchecked_t mesq_noop;
-+ atomic_long_unchecked_t mesq_send_unexpected_error;
-+ atomic_long_unchecked_t mesq_send_lb_overflow;
-+ atomic_long_unchecked_t mesq_send_qlimit_reached;
-+ atomic_long_unchecked_t mesq_send_amo_nacked;
-+ atomic_long_unchecked_t mesq_send_put_nacked;
-+ atomic_long_unchecked_t mesq_qf_not_full;
-+ atomic_long_unchecked_t mesq_qf_locked;
-+ atomic_long_unchecked_t mesq_qf_noop_not_full;
-+ atomic_long_unchecked_t mesq_qf_switch_head_failed;
-+ atomic_long_unchecked_t mesq_qf_unexpected_error;
-+ atomic_long_unchecked_t mesq_noop_unexpected_error;
-+ atomic_long_unchecked_t mesq_noop_lb_overflow;
-+ atomic_long_unchecked_t mesq_noop_qlimit_reached;
-+ atomic_long_unchecked_t mesq_noop_amo_nacked;
-+ atomic_long_unchecked_t mesq_noop_put_nacked;
-
- };
-
-@@ -252,8 +252,8 @@ enum mcs_op {cchop_allocate, cchop_start
- cchop_deallocate, tghop_invalidate, mcsop_last};
-
- struct mcs_op_statistic {
-- atomic_long_t count;
-- atomic_long_t total;
-+ atomic_long_unchecked_t count;
-+ atomic_long_unchecked_t total;
- unsigned long max;
- };
-
-@@ -276,7 +276,7 @@ extern struct mcs_op_statistic mcs_op_st
-
- #define STAT(id) do { \
- if (gru_options & OPT_STATS) \
-- atomic_long_inc(&gru_stats.id); \
-+ atomic_long_inc_unchecked(&gru_stats.id); \
- } while (0)
-
- #ifdef CONFIG_SGI_GRU_DEBUG
-diff -urNp linux-2.6.32.45/drivers/misc/sgi-xp/xpc.h linux-2.6.32.45/drivers/misc/sgi-xp/xpc.h
---- linux-2.6.32.45/drivers/misc/sgi-xp/xpc.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/misc/sgi-xp/xpc.h 2011-08-05 20:33:55.000000000 -0400
-@@ -876,7 +876,7 @@ extern struct xpc_registration xpc_regis
- /* found in xpc_main.c */
- extern struct device *xpc_part;
- extern struct device *xpc_chan;
--extern struct xpc_arch_operations xpc_arch_ops;
-+extern const struct xpc_arch_operations xpc_arch_ops;
- extern int xpc_disengage_timelimit;
- extern int xpc_disengage_timedout;
- extern int xpc_activate_IRQ_rcvd;
-diff -urNp linux-2.6.32.45/drivers/misc/sgi-xp/xpc_main.c linux-2.6.32.45/drivers/misc/sgi-xp/xpc_main.c
---- linux-2.6.32.45/drivers/misc/sgi-xp/xpc_main.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/misc/sgi-xp/xpc_main.c 2011-08-05 20:33:55.000000000 -0400
-@@ -169,7 +169,7 @@ static struct notifier_block xpc_die_not
- .notifier_call = xpc_system_die,
- };
-
--struct xpc_arch_operations xpc_arch_ops;
-+const struct xpc_arch_operations xpc_arch_ops;
-
- /*
- * Timer function to enforce the timelimit on the partition disengage.
-diff -urNp linux-2.6.32.45/drivers/misc/sgi-xp/xpc_sn2.c linux-2.6.32.45/drivers/misc/sgi-xp/xpc_sn2.c
---- linux-2.6.32.45/drivers/misc/sgi-xp/xpc_sn2.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/misc/sgi-xp/xpc_sn2.c 2011-08-05 20:33:55.000000000 -0400
-@@ -2350,7 +2350,7 @@ xpc_received_payload_sn2(struct xpc_chan
- xpc_acknowledge_msgs_sn2(ch, get, msg->flags);
- }
-
--static struct xpc_arch_operations xpc_arch_ops_sn2 = {
-+static const struct xpc_arch_operations xpc_arch_ops_sn2 = {
- .setup_partitions = xpc_setup_partitions_sn2,
- .teardown_partitions = xpc_teardown_partitions_sn2,
- .process_activate_IRQ_rcvd = xpc_process_activate_IRQ_rcvd_sn2,
-@@ -2413,7 +2413,9 @@ xpc_init_sn2(void)
- int ret;
- size_t buf_size;
-
-- xpc_arch_ops = xpc_arch_ops_sn2;
-+ pax_open_kernel();
-+ memcpy((void *)&xpc_arch_ops, &xpc_arch_ops_sn2, sizeof(xpc_arch_ops_sn2));
-+ pax_close_kernel();
-
- if (offsetof(struct xpc_msg_sn2, payload) > XPC_MSG_HDR_MAX_SIZE) {
- dev_err(xpc_part, "header portion of struct xpc_msg_sn2 is "
-diff -urNp linux-2.6.32.45/drivers/misc/sgi-xp/xpc_uv.c linux-2.6.32.45/drivers/misc/sgi-xp/xpc_uv.c
---- linux-2.6.32.45/drivers/misc/sgi-xp/xpc_uv.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/misc/sgi-xp/xpc_uv.c 2011-08-05 20:33:55.000000000 -0400
-@@ -1669,7 +1669,7 @@ xpc_received_payload_uv(struct xpc_chann
- XPC_DEACTIVATE_PARTITION(&xpc_partitions[ch->partid], ret);
- }
-
--static struct xpc_arch_operations xpc_arch_ops_uv = {
-+static const struct xpc_arch_operations xpc_arch_ops_uv = {
- .setup_partitions = xpc_setup_partitions_uv,
- .teardown_partitions = xpc_teardown_partitions_uv,
- .process_activate_IRQ_rcvd = xpc_process_activate_IRQ_rcvd_uv,
-@@ -1729,7 +1729,9 @@ static struct xpc_arch_operations xpc_ar
- int
- xpc_init_uv(void)
- {
-- xpc_arch_ops = xpc_arch_ops_uv;
-+ pax_open_kernel();
-+ memcpy((void *)&xpc_arch_ops, &xpc_arch_ops_uv, sizeof(xpc_arch_ops_uv));
-+ pax_close_kernel();
-
- if (sizeof(struct xpc_notify_mq_msghdr_uv) > XPC_MSG_HDR_MAX_SIZE) {
- dev_err(xpc_part, "xpc_notify_mq_msghdr_uv is larger than %d\n",
-diff -urNp linux-2.6.32.45/drivers/misc/sgi-xp/xp.h linux-2.6.32.45/drivers/misc/sgi-xp/xp.h
---- linux-2.6.32.45/drivers/misc/sgi-xp/xp.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/misc/sgi-xp/xp.h 2011-08-05 20:33:55.000000000 -0400
-@@ -289,7 +289,7 @@ struct xpc_interface {
- xpc_notify_func, void *);
- void (*received) (short, int, void *);
- enum xp_retval (*partid_to_nasids) (short, void *);
--};
-+} __no_const;
-
- extern struct xpc_interface xpc_interface;
-
-diff -urNp linux-2.6.32.45/drivers/mtd/chips/cfi_cmdset_0001.c linux-2.6.32.45/drivers/mtd/chips/cfi_cmdset_0001.c
---- linux-2.6.32.45/drivers/mtd/chips/cfi_cmdset_0001.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/mtd/chips/cfi_cmdset_0001.c 2011-05-16 21:46:57.000000000 -0400
-@@ -743,6 +743,8 @@ static int chip_ready (struct map_info *
- struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
- unsigned long timeo = jiffies + HZ;
-
-+ pax_track_stack();
-+
- /* Prevent setting state FL_SYNCING for chip in suspended state. */
- if (mode == FL_SYNCING && chip->oldstate != FL_READY)
- goto sleep;
-@@ -1642,6 +1644,8 @@ static int __xipram do_write_buffer(stru
- unsigned long initial_adr;
- int initial_len = len;
-
-+ pax_track_stack();
-+
- wbufsize = cfi_interleave(cfi) << cfi->cfiq->MaxBufWriteSize;
- adr += chip->start;
- initial_adr = adr;
-@@ -1860,6 +1864,8 @@ static int __xipram do_erase_oneblock(st
- int retries = 3;
- int ret;
-
-+ pax_track_stack();
-+
- adr += chip->start;
-
- retry:
-diff -urNp linux-2.6.32.45/drivers/mtd/chips/cfi_cmdset_0020.c linux-2.6.32.45/drivers/mtd/chips/cfi_cmdset_0020.c
---- linux-2.6.32.45/drivers/mtd/chips/cfi_cmdset_0020.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/mtd/chips/cfi_cmdset_0020.c 2011-05-16 21:46:57.000000000 -0400
-@@ -255,6 +255,8 @@ static inline int do_read_onechip(struct
- unsigned long cmd_addr;
- struct cfi_private *cfi = map->fldrv_priv;
-
-+ pax_track_stack();
-+
- adr += chip->start;
-
- /* Ensure cmd read/writes are aligned. */
-@@ -428,6 +430,8 @@ static inline int do_write_buffer(struct
- DECLARE_WAITQUEUE(wait, current);
- int wbufsize, z;
-
-+ pax_track_stack();
-+
- /* M58LW064A requires bus alignment for buffer wriets -- saw */
- if (adr & (map_bankwidth(map)-1))
- return -EINVAL;
-@@ -742,6 +746,8 @@ static inline int do_erase_oneblock(stru
- DECLARE_WAITQUEUE(wait, current);
- int ret = 0;
-
-+ pax_track_stack();
-+
- adr += chip->start;
-
- /* Let's determine this according to the interleave only once */
-@@ -1047,6 +1053,8 @@ static inline int do_lock_oneblock(struc
- unsigned long timeo = jiffies + HZ;
- DECLARE_WAITQUEUE(wait, current);
-
-+ pax_track_stack();
-+
- adr += chip->start;
-
- /* Let's determine this according to the interleave only once */
-@@ -1196,6 +1204,8 @@ static inline int do_unlock_oneblock(str
- unsigned long timeo = jiffies + HZ;
- DECLARE_WAITQUEUE(wait, current);
-
-+ pax_track_stack();
-+
- adr += chip->start;
-
- /* Let's determine this according to the interleave only once */
-diff -urNp linux-2.6.32.45/drivers/mtd/devices/doc2000.c linux-2.6.32.45/drivers/mtd/devices/doc2000.c
---- linux-2.6.32.45/drivers/mtd/devices/doc2000.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/mtd/devices/doc2000.c 2011-04-17 15:56:46.000000000 -0400
-@@ -776,7 +776,7 @@ static int doc_write(struct mtd_info *mt
-
- /* The ECC will not be calculated correctly if less than 512 is written */
- /* DBB-
-- if (len != 0x200 && eccbuf)
-+ if (len != 0x200)
- printk(KERN_WARNING
- "ECC needs a full sector write (adr: %lx size %lx)\n",
- (long) to, (long) len);
-diff -urNp linux-2.6.32.45/drivers/mtd/devices/doc2001.c linux-2.6.32.45/drivers/mtd/devices/doc2001.c
---- linux-2.6.32.45/drivers/mtd/devices/doc2001.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/mtd/devices/doc2001.c 2011-04-17 15:56:46.000000000 -0400
-@@ -393,7 +393,7 @@ static int doc_read (struct mtd_info *mt
- struct Nand *mychip = &this->chips[from >> (this->chipshift)];
-
- /* Don't allow read past end of device */
-- if (from >= this->totlen)
-+ if (from >= this->totlen || !len)
- return -EINVAL;
-
- /* Don't allow a single read to cross a 512-byte block boundary */
-diff -urNp linux-2.6.32.45/drivers/mtd/ftl.c linux-2.6.32.45/drivers/mtd/ftl.c
---- linux-2.6.32.45/drivers/mtd/ftl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/mtd/ftl.c 2011-05-16 21:46:57.000000000 -0400
-@@ -474,6 +474,8 @@ static int copy_erase_unit(partition_t *
- loff_t offset;
- uint16_t srcunitswap = cpu_to_le16(srcunit);
-
-+ pax_track_stack();
-+
- eun = &part->EUNInfo[srcunit];
- xfer = &part->XferInfo[xferunit];
- DEBUG(2, "ftl_cs: copying block 0x%x to 0x%x\n",
-diff -urNp linux-2.6.32.45/drivers/mtd/inftlcore.c linux-2.6.32.45/drivers/mtd/inftlcore.c
---- linux-2.6.32.45/drivers/mtd/inftlcore.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/mtd/inftlcore.c 2011-05-16 21:46:57.000000000 -0400
-@@ -260,6 +260,8 @@ static u16 INFTL_foldchain(struct INFTLr
- struct inftl_oob oob;
- size_t retlen;
-
-+ pax_track_stack();
-+
- DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_foldchain(inftl=%p,thisVUC=%d,"
- "pending=%d)\n", inftl, thisVUC, pendingblock);
-
-diff -urNp linux-2.6.32.45/drivers/mtd/inftlmount.c linux-2.6.32.45/drivers/mtd/inftlmount.c
---- linux-2.6.32.45/drivers/mtd/inftlmount.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/mtd/inftlmount.c 2011-05-16 21:46:57.000000000 -0400
-@@ -54,6 +54,8 @@ static int find_boot_record(struct INFTL
- struct INFTLPartition *ip;
- size_t retlen;
-
-+ pax_track_stack();
-+
- DEBUG(MTD_DEBUG_LEVEL3, "INFTL: find_boot_record(inftl=%p)\n", inftl);
-
- /*
-diff -urNp linux-2.6.32.45/drivers/mtd/lpddr/qinfo_probe.c linux-2.6.32.45/drivers/mtd/lpddr/qinfo_probe.c
---- linux-2.6.32.45/drivers/mtd/lpddr/qinfo_probe.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/mtd/lpddr/qinfo_probe.c 2011-05-16 21:46:57.000000000 -0400
-@@ -106,6 +106,8 @@ static int lpddr_pfow_present(struct map
- {
- map_word pfow_val[4];
-
-+ pax_track_stack();
-+
- /* Check identification string */
- pfow_val[0] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_P);
- pfow_val[1] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_F);
-diff -urNp linux-2.6.32.45/drivers/mtd/mtdchar.c linux-2.6.32.45/drivers/mtd/mtdchar.c
---- linux-2.6.32.45/drivers/mtd/mtdchar.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/mtd/mtdchar.c 2011-05-16 21:46:57.000000000 -0400
-@@ -460,6 +460,8 @@ static int mtd_ioctl(struct inode *inode
- u_long size;
- struct mtd_info_user info;
-
-+ pax_track_stack();
-+
- DEBUG(MTD_DEBUG_LEVEL0, "MTD_ioctl\n");
-
- size = (cmd & IOCSIZE_MASK) >> IOCSIZE_SHIFT;
-diff -urNp linux-2.6.32.45/drivers/mtd/nftlcore.c linux-2.6.32.45/drivers/mtd/nftlcore.c
---- linux-2.6.32.45/drivers/mtd/nftlcore.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/mtd/nftlcore.c 2011-05-16 21:46:57.000000000 -0400
-@@ -254,6 +254,8 @@ static u16 NFTL_foldchain (struct NFTLre
- int inplace = 1;
- size_t retlen;
-
-+ pax_track_stack();
-+
- memset(BlockMap, 0xff, sizeof(BlockMap));
- memset(BlockFreeFound, 0, sizeof(BlockFreeFound));
-
-diff -urNp linux-2.6.32.45/drivers/mtd/nftlmount.c linux-2.6.32.45/drivers/mtd/nftlmount.c
---- linux-2.6.32.45/drivers/mtd/nftlmount.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/mtd/nftlmount.c 2011-05-18 20:09:37.000000000 -0400
-@@ -23,6 +23,7 @@
- #include <asm/errno.h>
- #include <linux/delay.h>
- #include <linux/slab.h>
-+#include <linux/sched.h>
- #include <linux/mtd/mtd.h>
- #include <linux/mtd/nand.h>
- #include <linux/mtd/nftl.h>
-@@ -44,6 +45,8 @@ static int find_boot_record(struct NFTLr
- struct mtd_info *mtd = nftl->mbd.mtd;
- unsigned int i;
-
-+ pax_track_stack();
-+
- /* Assume logical EraseSize == physical erasesize for starting the scan.
- We'll sort it out later if we find a MediaHeader which says otherwise */
- /* Actually, we won't. The new DiskOnChip driver has already scanned
-diff -urNp linux-2.6.32.45/drivers/mtd/ubi/build.c linux-2.6.32.45/drivers/mtd/ubi/build.c
---- linux-2.6.32.45/drivers/mtd/ubi/build.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/mtd/ubi/build.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1255,7 +1255,7 @@ module_exit(ubi_exit);
- static int __init bytes_str_to_int(const char *str)
- {
- char *endp;
-- unsigned long result;
-+ unsigned long result, scale = 1;
-
- result = simple_strtoul(str, &endp, 0);
- if (str == endp || result >= INT_MAX) {
-@@ -1266,11 +1266,11 @@ static int __init bytes_str_to_int(const
-
- switch (*endp) {
- case 'G':
-- result *= 1024;
-+ scale *= 1024;
- case 'M':
-- result *= 1024;
-+ scale *= 1024;
- case 'K':
-- result *= 1024;
-+ scale *= 1024;
- if (endp[1] == 'i' && endp[2] == 'B')
- endp += 2;
- case '\0':
-@@ -1281,7 +1281,13 @@ static int __init bytes_str_to_int(const
- return -EINVAL;
- }
-
-- return result;
-+ if ((intoverflow_t)result*scale >= INT_MAX) {
-+ printk(KERN_ERR "UBI error: incorrect bytes count: \"%s\"\n",
-+ str);
-+ return -EINVAL;
-+ }
-+
-+ return result*scale;
- }
-
- /**
-diff -urNp linux-2.6.32.45/drivers/net/bnx2.c linux-2.6.32.45/drivers/net/bnx2.c
---- linux-2.6.32.45/drivers/net/bnx2.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/bnx2.c 2011-05-16 21:46:57.000000000 -0400
-@@ -5809,6 +5809,8 @@ bnx2_test_nvram(struct bnx2 *bp)
- int rc = 0;
- u32 magic, csum;
-
-+ pax_track_stack();
-+
- if ((rc = bnx2_nvram_read(bp, 0, data, 4)) != 0)
- goto test_nvram_done;
-
-diff -urNp linux-2.6.32.45/drivers/net/cxgb3/l2t.h linux-2.6.32.45/drivers/net/cxgb3/l2t.h
---- linux-2.6.32.45/drivers/net/cxgb3/l2t.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/cxgb3/l2t.h 2011-08-05 20:33:55.000000000 -0400
-@@ -86,7 +86,7 @@ typedef void (*arp_failure_handler_func)
- */
- struct l2t_skb_cb {
- arp_failure_handler_func arp_failure_handler;
--};
-+} __no_const;
-
- #define L2T_SKB_CB(skb) ((struct l2t_skb_cb *)(skb)->cb)
-
-diff -urNp linux-2.6.32.45/drivers/net/cxgb3/t3_hw.c linux-2.6.32.45/drivers/net/cxgb3/t3_hw.c
---- linux-2.6.32.45/drivers/net/cxgb3/t3_hw.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/cxgb3/t3_hw.c 2011-05-16 21:46:57.000000000 -0400
-@@ -699,6 +699,8 @@ static int get_vpd_params(struct adapter
- int i, addr, ret;
- struct t3_vpd vpd;
-
-+ pax_track_stack();
-+
- /*
- * Card information is normally at VPD_BASE but some early cards had
- * it at 0.
-diff -urNp linux-2.6.32.45/drivers/net/e1000e/82571.c linux-2.6.32.45/drivers/net/e1000e/82571.c
---- linux-2.6.32.45/drivers/net/e1000e/82571.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/e1000e/82571.c 2011-08-05 20:33:55.000000000 -0400
-@@ -245,22 +245,22 @@ static s32 e1000_init_mac_params_82571(s
- /* check for link */
- switch (hw->phy.media_type) {
- case e1000_media_type_copper:
-- func->setup_physical_interface = e1000_setup_copper_link_82571;
-- func->check_for_link = e1000e_check_for_copper_link;
-- func->get_link_up_info = e1000e_get_speed_and_duplex_copper;
-+ *(void **)&func->setup_physical_interface = e1000_setup_copper_link_82571;
-+ *(void **)&func->check_for_link = e1000e_check_for_copper_link;
-+ *(void **)&func->get_link_up_info = e1000e_get_speed_and_duplex_copper;
- break;
- case e1000_media_type_fiber:
-- func->setup_physical_interface =
-+ *(void **)&func->setup_physical_interface =
- e1000_setup_fiber_serdes_link_82571;
-- func->check_for_link = e1000e_check_for_fiber_link;
-- func->get_link_up_info =
-+ *(void **)&func->check_for_link = e1000e_check_for_fiber_link;
-+ *(void **)&func->get_link_up_info =
- e1000e_get_speed_and_duplex_fiber_serdes;
- break;
- case e1000_media_type_internal_serdes:
-- func->setup_physical_interface =
-+ *(void **)&func->setup_physical_interface =
- e1000_setup_fiber_serdes_link_82571;
-- func->check_for_link = e1000_check_for_serdes_link_82571;
-- func->get_link_up_info =
-+ *(void **)&func->check_for_link = e1000_check_for_serdes_link_82571;
-+ *(void **)&func->get_link_up_info =
- e1000e_get_speed_and_duplex_fiber_serdes;
- break;
- default:
-@@ -271,12 +271,12 @@ static s32 e1000_init_mac_params_82571(s
- switch (hw->mac.type) {
- case e1000_82574:
- case e1000_82583:
-- func->check_mng_mode = e1000_check_mng_mode_82574;
-- func->led_on = e1000_led_on_82574;
-+ *(void **)&func->check_mng_mode = e1000_check_mng_mode_82574;
-+ *(void **)&func->led_on = e1000_led_on_82574;
- break;
- default:
-- func->check_mng_mode = e1000e_check_mng_mode_generic;
-- func->led_on = e1000e_led_on_generic;
-+ *(void **)&func->check_mng_mode = e1000e_check_mng_mode_generic;
-+ *(void **)&func->led_on = e1000e_led_on_generic;
- break;
- }
-
-@@ -1656,7 +1656,7 @@ static void e1000_clear_hw_cntrs_82571(s
- temp = er32(ICRXDMTC);
- }
-
--static struct e1000_mac_operations e82571_mac_ops = {
-+static const struct e1000_mac_operations e82571_mac_ops = {
- /* .check_mng_mode: mac type dependent */
- /* .check_for_link: media type dependent */
- .id_led_init = e1000e_id_led_init,
-@@ -1674,7 +1674,7 @@ static struct e1000_mac_operations e8257
- .setup_led = e1000e_setup_led_generic,
- };
-
--static struct e1000_phy_operations e82_phy_ops_igp = {
-+static const struct e1000_phy_operations e82_phy_ops_igp = {
- .acquire_phy = e1000_get_hw_semaphore_82571,
- .check_reset_block = e1000e_check_reset_block_generic,
- .commit_phy = NULL,
-@@ -1691,7 +1691,7 @@ static struct e1000_phy_operations e82_p
- .cfg_on_link_up = NULL,
- };
-
--static struct e1000_phy_operations e82_phy_ops_m88 = {
-+static const struct e1000_phy_operations e82_phy_ops_m88 = {
- .acquire_phy = e1000_get_hw_semaphore_82571,
- .check_reset_block = e1000e_check_reset_block_generic,
- .commit_phy = e1000e_phy_sw_reset,
-@@ -1708,7 +1708,7 @@ static struct e1000_phy_operations e82_p
- .cfg_on_link_up = NULL,
- };
-
--static struct e1000_phy_operations e82_phy_ops_bm = {
-+static const struct e1000_phy_operations e82_phy_ops_bm = {
- .acquire_phy = e1000_get_hw_semaphore_82571,
- .check_reset_block = e1000e_check_reset_block_generic,
- .commit_phy = e1000e_phy_sw_reset,
-@@ -1725,7 +1725,7 @@ static struct e1000_phy_operations e82_p
- .cfg_on_link_up = NULL,
- };
-
--static struct e1000_nvm_operations e82571_nvm_ops = {
-+static const struct e1000_nvm_operations e82571_nvm_ops = {
- .acquire_nvm = e1000_acquire_nvm_82571,
- .read_nvm = e1000e_read_nvm_eerd,
- .release_nvm = e1000_release_nvm_82571,
-diff -urNp linux-2.6.32.45/drivers/net/e1000e/e1000.h linux-2.6.32.45/drivers/net/e1000e/e1000.h
---- linux-2.6.32.45/drivers/net/e1000e/e1000.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/e1000e/e1000.h 2011-04-17 15:56:46.000000000 -0400
-@@ -375,9 +375,9 @@ struct e1000_info {
- u32 pba;
- u32 max_hw_frame_size;
- s32 (*get_variants)(struct e1000_adapter *);
-- struct e1000_mac_operations *mac_ops;
-- struct e1000_phy_operations *phy_ops;
-- struct e1000_nvm_operations *nvm_ops;
-+ const struct e1000_mac_operations *mac_ops;
-+ const struct e1000_phy_operations *phy_ops;
-+ const struct e1000_nvm_operations *nvm_ops;
- };
-
- /* hardware capability, feature, and workaround flags */
-diff -urNp linux-2.6.32.45/drivers/net/e1000e/es2lan.c linux-2.6.32.45/drivers/net/e1000e/es2lan.c
---- linux-2.6.32.45/drivers/net/e1000e/es2lan.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/e1000e/es2lan.c 2011-08-05 20:33:55.000000000 -0400
-@@ -229,16 +229,16 @@ static s32 e1000_init_mac_params_80003es
- /* check for link */
- switch (hw->phy.media_type) {
- case e1000_media_type_copper:
-- func->setup_physical_interface = e1000_setup_copper_link_80003es2lan;
-- func->check_for_link = e1000e_check_for_copper_link;
-+ *(void **)&func->setup_physical_interface = e1000_setup_copper_link_80003es2lan;
-+ *(void **)&func->check_for_link = e1000e_check_for_copper_link;
- break;
- case e1000_media_type_fiber:
-- func->setup_physical_interface = e1000e_setup_fiber_serdes_link;
-- func->check_for_link = e1000e_check_for_fiber_link;
-+ *(void **)&func->setup_physical_interface = e1000e_setup_fiber_serdes_link;
-+ *(void **)&func->check_for_link = e1000e_check_for_fiber_link;
- break;
- case e1000_media_type_internal_serdes:
-- func->setup_physical_interface = e1000e_setup_fiber_serdes_link;
-- func->check_for_link = e1000e_check_for_serdes_link;
-+ *(void **)&func->setup_physical_interface = e1000e_setup_fiber_serdes_link;
-+ *(void **)&func->check_for_link = e1000e_check_for_serdes_link;
- break;
- default:
- return -E1000_ERR_CONFIG;
-@@ -1365,7 +1365,7 @@ static void e1000_clear_hw_cntrs_80003es
- temp = er32(ICRXDMTC);
- }
-
--static struct e1000_mac_operations es2_mac_ops = {
-+static const struct e1000_mac_operations es2_mac_ops = {
- .id_led_init = e1000e_id_led_init,
- .check_mng_mode = e1000e_check_mng_mode_generic,
- /* check_for_link dependent on media type */
-@@ -1383,7 +1383,7 @@ static struct e1000_mac_operations es2_m
- .setup_led = e1000e_setup_led_generic,
- };
-
--static struct e1000_phy_operations es2_phy_ops = {
-+static const struct e1000_phy_operations es2_phy_ops = {
- .acquire_phy = e1000_acquire_phy_80003es2lan,
- .check_reset_block = e1000e_check_reset_block_generic,
- .commit_phy = e1000e_phy_sw_reset,
-@@ -1400,7 +1400,7 @@ static struct e1000_phy_operations es2_p
- .cfg_on_link_up = e1000_cfg_on_link_up_80003es2lan,
- };
-
--static struct e1000_nvm_operations es2_nvm_ops = {
-+static const struct e1000_nvm_operations es2_nvm_ops = {
- .acquire_nvm = e1000_acquire_nvm_80003es2lan,
- .read_nvm = e1000e_read_nvm_eerd,
- .release_nvm = e1000_release_nvm_80003es2lan,
-diff -urNp linux-2.6.32.45/drivers/net/e1000e/hw.h linux-2.6.32.45/drivers/net/e1000e/hw.h
---- linux-2.6.32.45/drivers/net/e1000e/hw.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/e1000e/hw.h 2011-04-17 15:56:46.000000000 -0400
-@@ -756,34 +756,34 @@ struct e1000_mac_operations {
-
- /* Function pointers for the PHY. */
- struct e1000_phy_operations {
-- s32 (*acquire_phy)(struct e1000_hw *);
-- s32 (*check_polarity)(struct e1000_hw *);
-- s32 (*check_reset_block)(struct e1000_hw *);
-- s32 (*commit_phy)(struct e1000_hw *);
-- s32 (*force_speed_duplex)(struct e1000_hw *);
-- s32 (*get_cfg_done)(struct e1000_hw *hw);
-- s32 (*get_cable_length)(struct e1000_hw *);
-- s32 (*get_phy_info)(struct e1000_hw *);
-- s32 (*read_phy_reg)(struct e1000_hw *, u32, u16 *);
-- s32 (*read_phy_reg_locked)(struct e1000_hw *, u32, u16 *);
-- void (*release_phy)(struct e1000_hw *);
-- s32 (*reset_phy)(struct e1000_hw *);
-- s32 (*set_d0_lplu_state)(struct e1000_hw *, bool);
-- s32 (*set_d3_lplu_state)(struct e1000_hw *, bool);
-- s32 (*write_phy_reg)(struct e1000_hw *, u32, u16);
-- s32 (*write_phy_reg_locked)(struct e1000_hw *, u32, u16);
-- s32 (*cfg_on_link_up)(struct e1000_hw *);
-+ s32 (* acquire_phy)(struct e1000_hw *);
-+ s32 (* check_polarity)(struct e1000_hw *);
-+ s32 (* check_reset_block)(struct e1000_hw *);
-+ s32 (* commit_phy)(struct e1000_hw *);
-+ s32 (* force_speed_duplex)(struct e1000_hw *);
-+ s32 (* get_cfg_done)(struct e1000_hw *hw);
-+ s32 (* get_cable_length)(struct e1000_hw *);
-+ s32 (* get_phy_info)(struct e1000_hw *);
-+ s32 (* read_phy_reg)(struct e1000_hw *, u32, u16 *);
-+ s32 (* read_phy_reg_locked)(struct e1000_hw *, u32, u16 *);
-+ void (* release_phy)(struct e1000_hw *);
-+ s32 (* reset_phy)(struct e1000_hw *);
-+ s32 (* set_d0_lplu_state)(struct e1000_hw *, bool);
-+ s32 (* set_d3_lplu_state)(struct e1000_hw *, bool);
-+ s32 (* write_phy_reg)(struct e1000_hw *, u32, u16);
-+ s32 (* write_phy_reg_locked)(struct e1000_hw *, u32, u16);
-+ s32 (* cfg_on_link_up)(struct e1000_hw *);
- };
-
- /* Function pointers for the NVM. */
- struct e1000_nvm_operations {
-- s32 (*acquire_nvm)(struct e1000_hw *);
-- s32 (*read_nvm)(struct e1000_hw *, u16, u16, u16 *);
-- void (*release_nvm)(struct e1000_hw *);
-- s32 (*update_nvm)(struct e1000_hw *);
-- s32 (*valid_led_default)(struct e1000_hw *, u16 *);
-- s32 (*validate_nvm)(struct e1000_hw *);
-- s32 (*write_nvm)(struct e1000_hw *, u16, u16, u16 *);
-+ s32 (* const acquire_nvm)(struct e1000_hw *);
-+ s32 (* const read_nvm)(struct e1000_hw *, u16, u16, u16 *);
-+ void (* const release_nvm)(struct e1000_hw *);
-+ s32 (* const update_nvm)(struct e1000_hw *);
-+ s32 (* const valid_led_default)(struct e1000_hw *, u16 *);
-+ s32 (* const validate_nvm)(struct e1000_hw *);
-+ s32 (* const write_nvm)(struct e1000_hw *, u16, u16, u16 *);
- };
-
- struct e1000_mac_info {
-diff -urNp linux-2.6.32.45/drivers/net/e1000e/ich8lan.c linux-2.6.32.45/drivers/net/e1000e/ich8lan.c
---- linux-2.6.32.45/drivers/net/e1000e/ich8lan.c 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/e1000e/ich8lan.c 2011-08-05 20:33:55.000000000 -0400
-@@ -265,13 +265,13 @@ static s32 e1000_init_phy_params_pchlan(
- phy->addr = 1;
- phy->reset_delay_us = 100;
-
-- phy->ops.check_polarity = e1000_check_polarity_ife_ich8lan;
-- phy->ops.read_phy_reg = e1000_read_phy_reg_hv;
-- phy->ops.read_phy_reg_locked = e1000_read_phy_reg_hv_locked;
-- phy->ops.set_d0_lplu_state = e1000_set_lplu_state_pchlan;
-- phy->ops.set_d3_lplu_state = e1000_set_lplu_state_pchlan;
-- phy->ops.write_phy_reg = e1000_write_phy_reg_hv;
-- phy->ops.write_phy_reg_locked = e1000_write_phy_reg_hv_locked;
-+ *(void **)&phy->ops.check_polarity = e1000_check_polarity_ife_ich8lan;
-+ *(void **)&phy->ops.read_phy_reg = e1000_read_phy_reg_hv;
-+ *(void **)&phy->ops.read_phy_reg_locked = e1000_read_phy_reg_hv_locked;
-+ *(void **)&phy->ops.set_d0_lplu_state = e1000_set_lplu_state_pchlan;
-+ *(void **)&phy->ops.set_d3_lplu_state = e1000_set_lplu_state_pchlan;
-+ *(void **)&phy->ops.write_phy_reg = e1000_write_phy_reg_hv;
-+ *(void **)&phy->ops.write_phy_reg_locked = e1000_write_phy_reg_hv_locked;
- phy->autoneg_mask = AUTONEG_ADVERTISE_SPEED_DEFAULT;
-
- /*
-@@ -289,12 +289,12 @@ static s32 e1000_init_phy_params_pchlan(
- phy->type = e1000e_get_phy_type_from_id(phy->id);
-
- if (phy->type == e1000_phy_82577) {
-- phy->ops.check_polarity = e1000_check_polarity_82577;
-- phy->ops.force_speed_duplex =
-+ *(void **)&phy->ops.check_polarity = e1000_check_polarity_82577;
-+ *(void **)&phy->ops.force_speed_duplex =
- e1000_phy_force_speed_duplex_82577;
-- phy->ops.get_cable_length = e1000_get_cable_length_82577;
-- phy->ops.get_phy_info = e1000_get_phy_info_82577;
-- phy->ops.commit_phy = e1000e_phy_sw_reset;
-+ *(void **)&phy->ops.get_cable_length = e1000_get_cable_length_82577;
-+ *(void **)&phy->ops.get_phy_info = e1000_get_phy_info_82577;
-+ *(void **)&phy->ops.commit_phy = e1000e_phy_sw_reset;
- }
-
- out:
-@@ -322,8 +322,8 @@ static s32 e1000_init_phy_params_ich8lan
- */
- ret_val = e1000e_determine_phy_address(hw);
- if (ret_val) {
-- hw->phy.ops.write_phy_reg = e1000e_write_phy_reg_bm;
-- hw->phy.ops.read_phy_reg = e1000e_read_phy_reg_bm;
-+ *(void **)&hw->phy.ops.write_phy_reg = e1000e_write_phy_reg_bm;
-+ *(void **)&hw->phy.ops.read_phy_reg = e1000e_read_phy_reg_bm;
- ret_val = e1000e_determine_phy_address(hw);
- if (ret_val)
- return ret_val;
-@@ -343,8 +343,8 @@ static s32 e1000_init_phy_params_ich8lan
- case IGP03E1000_E_PHY_ID:
- phy->type = e1000_phy_igp_3;
- phy->autoneg_mask = AUTONEG_ADVERTISE_SPEED_DEFAULT;
-- phy->ops.read_phy_reg_locked = e1000e_read_phy_reg_igp_locked;
-- phy->ops.write_phy_reg_locked = e1000e_write_phy_reg_igp_locked;
-+ *(void **)&phy->ops.read_phy_reg_locked = e1000e_read_phy_reg_igp_locked;
-+ *(void **)&phy->ops.write_phy_reg_locked = e1000e_write_phy_reg_igp_locked;
- break;
- case IFE_E_PHY_ID:
- case IFE_PLUS_E_PHY_ID:
-@@ -355,16 +355,16 @@ static s32 e1000_init_phy_params_ich8lan
- case BME1000_E_PHY_ID:
- phy->type = e1000_phy_bm;
- phy->autoneg_mask = AUTONEG_ADVERTISE_SPEED_DEFAULT;
-- hw->phy.ops.read_phy_reg = e1000e_read_phy_reg_bm;
-- hw->phy.ops.write_phy_reg = e1000e_write_phy_reg_bm;
-- hw->phy.ops.commit_phy = e1000e_phy_sw_reset;
-+ *(void **)&hw->phy.ops.read_phy_reg = e1000e_read_phy_reg_bm;
-+ *(void **)&hw->phy.ops.write_phy_reg = e1000e_write_phy_reg_bm;
-+ *(void **)&hw->phy.ops.commit_phy = e1000e_phy_sw_reset;
- break;
- default:
- return -E1000_ERR_PHY;
- break;
- }
-
-- phy->ops.check_polarity = e1000_check_polarity_ife_ich8lan;
-+ *(void **)&phy->ops.check_polarity = e1000_check_polarity_ife_ich8lan;
-
- return 0;
- }
-@@ -455,25 +455,25 @@ static s32 e1000_init_mac_params_ich8lan
- case e1000_ich9lan:
- case e1000_ich10lan:
- /* ID LED init */
-- mac->ops.id_led_init = e1000e_id_led_init;
-+ *(void **)&mac->ops.id_led_init = e1000e_id_led_init;
- /* setup LED */
-- mac->ops.setup_led = e1000e_setup_led_generic;
-+ *(void **)&mac->ops.setup_led = e1000e_setup_led_generic;
- /* cleanup LED */
-- mac->ops.cleanup_led = e1000_cleanup_led_ich8lan;
-+ *(void **)&mac->ops.cleanup_led = e1000_cleanup_led_ich8lan;
- /* turn on/off LED */
-- mac->ops.led_on = e1000_led_on_ich8lan;
-- mac->ops.led_off = e1000_led_off_ich8lan;
-+ *(void **)&mac->ops.led_on = e1000_led_on_ich8lan;
-+ *(void **)&mac->ops.led_off = e1000_led_off_ich8lan;
- break;
- case e1000_pchlan:
- /* ID LED init */
-- mac->ops.id_led_init = e1000_id_led_init_pchlan;
-+ *(void **)&mac->ops.id_led_init = e1000_id_led_init_pchlan;
- /* setup LED */
-- mac->ops.setup_led = e1000_setup_led_pchlan;
-+ *(void **)&mac->ops.setup_led = e1000_setup_led_pchlan;
- /* cleanup LED */
-- mac->ops.cleanup_led = e1000_cleanup_led_pchlan;
-+ *(void **)&mac->ops.cleanup_led = e1000_cleanup_led_pchlan;
- /* turn on/off LED */
-- mac->ops.led_on = e1000_led_on_pchlan;
-- mac->ops.led_off = e1000_led_off_pchlan;
-+ *(void **)&mac->ops.led_on = e1000_led_on_pchlan;
-+ *(void **)&mac->ops.led_off = e1000_led_off_pchlan;
- break;
- default:
- break;
-@@ -3463,7 +3463,7 @@ static void e1000_clear_hw_cntrs_ich8lan
- }
- }
-
--static struct e1000_mac_operations ich8_mac_ops = {
-+static const struct e1000_mac_operations ich8_mac_ops = {
- .id_led_init = e1000e_id_led_init,
- .check_mng_mode = e1000_check_mng_mode_ich8lan,
- .check_for_link = e1000_check_for_copper_link_ich8lan,
-@@ -3481,7 +3481,7 @@ static struct e1000_mac_operations ich8_
- /* id_led_init dependent on mac type */
- };
-
--static struct e1000_phy_operations ich8_phy_ops = {
-+static const struct e1000_phy_operations ich8_phy_ops = {
- .acquire_phy = e1000_acquire_swflag_ich8lan,
- .check_reset_block = e1000_check_reset_block_ich8lan,
- .commit_phy = NULL,
-@@ -3497,7 +3497,7 @@ static struct e1000_phy_operations ich8_
- .write_phy_reg = e1000e_write_phy_reg_igp,
- };
-
--static struct e1000_nvm_operations ich8_nvm_ops = {
-+static const struct e1000_nvm_operations ich8_nvm_ops = {
- .acquire_nvm = e1000_acquire_nvm_ich8lan,
- .read_nvm = e1000_read_nvm_ich8lan,
- .release_nvm = e1000_release_nvm_ich8lan,
-diff -urNp linux-2.6.32.45/drivers/net/e1000e/netdev.c linux-2.6.32.45/drivers/net/e1000e/netdev.c
---- linux-2.6.32.45/drivers/net/e1000e/netdev.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/e1000e/netdev.c 2011-08-05 20:33:55.000000000 -0400
-@@ -5071,9 +5071,9 @@ static int __devinit e1000_probe(struct
-
- err = -EIO;
-
-- memcpy(&hw->mac.ops, ei->mac_ops, sizeof(hw->mac.ops));
-- memcpy(&hw->nvm.ops, ei->nvm_ops, sizeof(hw->nvm.ops));
-- memcpy(&hw->phy.ops, ei->phy_ops, sizeof(hw->phy.ops));
-+ memcpy((void *)&hw->mac.ops, ei->mac_ops, sizeof(hw->mac.ops));
-+ memcpy((void *)&hw->nvm.ops, ei->nvm_ops, sizeof(hw->nvm.ops));
-+ memcpy((void *)&hw->phy.ops, ei->phy_ops, sizeof(hw->phy.ops));
-
- err = ei->get_variants(adapter);
- if (err)
-diff -urNp linux-2.6.32.45/drivers/net/hamradio/6pack.c linux-2.6.32.45/drivers/net/hamradio/6pack.c
---- linux-2.6.32.45/drivers/net/hamradio/6pack.c 2011-07-13 17:23:04.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/hamradio/6pack.c 2011-07-13 17:23:18.000000000 -0400
-@@ -461,6 +461,8 @@ static void sixpack_receive_buf(struct t
- unsigned char buf[512];
- int count1;
-
-+ pax_track_stack();
-+
- if (!count)
- return;
-
-diff -urNp linux-2.6.32.45/drivers/net/ibmveth.c linux-2.6.32.45/drivers/net/ibmveth.c
---- linux-2.6.32.45/drivers/net/ibmveth.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/ibmveth.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1577,7 +1577,7 @@ static struct attribute * veth_pool_attr
- NULL,
- };
-
--static struct sysfs_ops veth_pool_ops = {
-+static const struct sysfs_ops veth_pool_ops = {
- .show = veth_pool_show,
- .store = veth_pool_store,
- };
-diff -urNp linux-2.6.32.45/drivers/net/igb/e1000_82575.c linux-2.6.32.45/drivers/net/igb/e1000_82575.c
---- linux-2.6.32.45/drivers/net/igb/e1000_82575.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/igb/e1000_82575.c 2011-08-05 20:33:55.000000000 -0400
-@@ -135,7 +135,7 @@ static s32 igb_get_invariants_82575(stru
- ? true : false;
-
- /* physical interface link setup */
-- mac->ops.setup_physical_interface =
-+ *(void **)&mac->ops.setup_physical_interface =
- (hw->phy.media_type == e1000_media_type_copper)
- ? igb_setup_copper_link_82575
- : igb_setup_serdes_link_82575;
-@@ -191,13 +191,13 @@ static s32 igb_get_invariants_82575(stru
-
- /* PHY function pointers */
- if (igb_sgmii_active_82575(hw)) {
-- phy->ops.reset = igb_phy_hw_reset_sgmii_82575;
-- phy->ops.read_reg = igb_read_phy_reg_sgmii_82575;
-- phy->ops.write_reg = igb_write_phy_reg_sgmii_82575;
-+ *(void **)&phy->ops.reset = igb_phy_hw_reset_sgmii_82575;
-+ *(void **)&phy->ops.read_reg = igb_read_phy_reg_sgmii_82575;
-+ *(void **)&phy->ops.write_reg = igb_write_phy_reg_sgmii_82575;
- } else {
-- phy->ops.reset = igb_phy_hw_reset;
-- phy->ops.read_reg = igb_read_phy_reg_igp;
-- phy->ops.write_reg = igb_write_phy_reg_igp;
-+ *(void **)&phy->ops.reset = igb_phy_hw_reset;
-+ *(void **)&phy->ops.read_reg = igb_read_phy_reg_igp;
-+ *(void **)&phy->ops.write_reg = igb_write_phy_reg_igp;
- }
-
- /* set lan id */
-@@ -213,17 +213,17 @@ static s32 igb_get_invariants_82575(stru
- switch (phy->id) {
- case M88E1111_I_PHY_ID:
- phy->type = e1000_phy_m88;
-- phy->ops.get_phy_info = igb_get_phy_info_m88;
-- phy->ops.get_cable_length = igb_get_cable_length_m88;
-- phy->ops.force_speed_duplex = igb_phy_force_speed_duplex_m88;
-+ *(void **)&phy->ops.get_phy_info = igb_get_phy_info_m88;
-+ *(void **)&phy->ops.get_cable_length = igb_get_cable_length_m88;
-+ *(void **)&phy->ops.force_speed_duplex = igb_phy_force_speed_duplex_m88;
- break;
- case IGP03E1000_E_PHY_ID:
- phy->type = e1000_phy_igp_3;
-- phy->ops.get_phy_info = igb_get_phy_info_igp;
-- phy->ops.get_cable_length = igb_get_cable_length_igp_2;
-- phy->ops.force_speed_duplex = igb_phy_force_speed_duplex_igp;
-- phy->ops.set_d0_lplu_state = igb_set_d0_lplu_state_82575;
-- phy->ops.set_d3_lplu_state = igb_set_d3_lplu_state;
-+ *(void **)&phy->ops.get_phy_info = igb_get_phy_info_igp;
-+ *(void **)&phy->ops.get_cable_length = igb_get_cable_length_igp_2;
-+ *(void **)&phy->ops.force_speed_duplex = igb_phy_force_speed_duplex_igp;
-+ *(void **)&phy->ops.set_d0_lplu_state = igb_set_d0_lplu_state_82575;
-+ *(void **)&phy->ops.set_d3_lplu_state = igb_set_d3_lplu_state;
- break;
- default:
- return -E1000_ERR_PHY;
-@@ -1410,7 +1410,7 @@ void igb_vmdq_set_replication_pf(struct
- wr32(E1000_VT_CTL, vt_ctl);
- }
-
--static struct e1000_mac_operations e1000_mac_ops_82575 = {
-+static const struct e1000_mac_operations e1000_mac_ops_82575 = {
- .reset_hw = igb_reset_hw_82575,
- .init_hw = igb_init_hw_82575,
- .check_for_link = igb_check_for_link_82575,
-@@ -1419,13 +1419,13 @@ static struct e1000_mac_operations e1000
- .get_speed_and_duplex = igb_get_speed_and_duplex_copper,
- };
-
--static struct e1000_phy_operations e1000_phy_ops_82575 = {
-+static const struct e1000_phy_operations e1000_phy_ops_82575 = {
- .acquire = igb_acquire_phy_82575,
- .get_cfg_done = igb_get_cfg_done_82575,
- .release = igb_release_phy_82575,
- };
-
--static struct e1000_nvm_operations e1000_nvm_ops_82575 = {
-+static const struct e1000_nvm_operations e1000_nvm_ops_82575 = {
- .acquire = igb_acquire_nvm_82575,
- .read = igb_read_nvm_eerd,
- .release = igb_release_nvm_82575,
-diff -urNp linux-2.6.32.45/drivers/net/igb/e1000_hw.h linux-2.6.32.45/drivers/net/igb/e1000_hw.h
---- linux-2.6.32.45/drivers/net/igb/e1000_hw.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/igb/e1000_hw.h 2011-04-17 15:56:46.000000000 -0400
-@@ -305,17 +305,17 @@ struct e1000_phy_operations {
- };
-
- struct e1000_nvm_operations {
-- s32 (*acquire)(struct e1000_hw *);
-- s32 (*read)(struct e1000_hw *, u16, u16, u16 *);
-- void (*release)(struct e1000_hw *);
-- s32 (*write)(struct e1000_hw *, u16, u16, u16 *);
-+ s32 (* const acquire)(struct e1000_hw *);
-+ s32 (* const read)(struct e1000_hw *, u16, u16, u16 *);
-+ void (* const release)(struct e1000_hw *);
-+ s32 (* const write)(struct e1000_hw *, u16, u16, u16 *);
- };
-
- struct e1000_info {
- s32 (*get_invariants)(struct e1000_hw *);
-- struct e1000_mac_operations *mac_ops;
-- struct e1000_phy_operations *phy_ops;
-- struct e1000_nvm_operations *nvm_ops;
-+ const struct e1000_mac_operations *mac_ops;
-+ const struct e1000_phy_operations *phy_ops;
-+ const struct e1000_nvm_operations *nvm_ops;
- };
-
- extern const struct e1000_info e1000_82575_info;
-diff -urNp linux-2.6.32.45/drivers/net/igb/e1000_mbx.c linux-2.6.32.45/drivers/net/igb/e1000_mbx.c
---- linux-2.6.32.45/drivers/net/igb/e1000_mbx.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/igb/e1000_mbx.c 2011-08-05 20:33:55.000000000 -0400
-@@ -414,13 +414,13 @@ s32 igb_init_mbx_params_pf(struct e1000_
-
- mbx->size = E1000_VFMAILBOX_SIZE;
-
-- mbx->ops.read = igb_read_mbx_pf;
-- mbx->ops.write = igb_write_mbx_pf;
-- mbx->ops.read_posted = igb_read_posted_mbx;
-- mbx->ops.write_posted = igb_write_posted_mbx;
-- mbx->ops.check_for_msg = igb_check_for_msg_pf;
-- mbx->ops.check_for_ack = igb_check_for_ack_pf;
-- mbx->ops.check_for_rst = igb_check_for_rst_pf;
-+ *(void **)&mbx->ops.read = igb_read_mbx_pf;
-+ *(void **)&mbx->ops.write = igb_write_mbx_pf;
-+ *(void **)&mbx->ops.read_posted = igb_read_posted_mbx;
-+ *(void **)&mbx->ops.write_posted = igb_write_posted_mbx;
-+ *(void **)&mbx->ops.check_for_msg = igb_check_for_msg_pf;
-+ *(void **)&mbx->ops.check_for_ack = igb_check_for_ack_pf;
-+ *(void **)&mbx->ops.check_for_rst = igb_check_for_rst_pf;
-
- mbx->stats.msgs_tx = 0;
- mbx->stats.msgs_rx = 0;
-diff -urNp linux-2.6.32.45/drivers/net/igb/igb_main.c linux-2.6.32.45/drivers/net/igb/igb_main.c
---- linux-2.6.32.45/drivers/net/igb/igb_main.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/igb/igb_main.c 2011-08-05 20:33:55.000000000 -0400
-@@ -1295,9 +1295,9 @@ static int __devinit igb_probe(struct pc
- /* setup the private structure */
- hw->back = adapter;
- /* Copy the default MAC, PHY and NVM function pointers */
-- memcpy(&hw->mac.ops, ei->mac_ops, sizeof(hw->mac.ops));
-- memcpy(&hw->phy.ops, ei->phy_ops, sizeof(hw->phy.ops));
-- memcpy(&hw->nvm.ops, ei->nvm_ops, sizeof(hw->nvm.ops));
-+ memcpy((void *)&hw->mac.ops, ei->mac_ops, sizeof(hw->mac.ops));
-+ memcpy((void *)&hw->phy.ops, ei->phy_ops, sizeof(hw->phy.ops));
-+ memcpy((void *)&hw->nvm.ops, ei->nvm_ops, sizeof(hw->nvm.ops));
- /* Initialize skew-specific constants */
- err = ei->get_invariants(hw);
- if (err)
-diff -urNp linux-2.6.32.45/drivers/net/igbvf/mbx.c linux-2.6.32.45/drivers/net/igbvf/mbx.c
---- linux-2.6.32.45/drivers/net/igbvf/mbx.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/igbvf/mbx.c 2011-08-05 20:33:55.000000000 -0400
-@@ -331,13 +331,13 @@ s32 e1000_init_mbx_params_vf(struct e100
-
- mbx->size = E1000_VFMAILBOX_SIZE;
-
-- mbx->ops.read = e1000_read_mbx_vf;
-- mbx->ops.write = e1000_write_mbx_vf;
-- mbx->ops.read_posted = e1000_read_posted_mbx;
-- mbx->ops.write_posted = e1000_write_posted_mbx;
-- mbx->ops.check_for_msg = e1000_check_for_msg_vf;
-- mbx->ops.check_for_ack = e1000_check_for_ack_vf;
-- mbx->ops.check_for_rst = e1000_check_for_rst_vf;
-+ *(void **)&mbx->ops.read = e1000_read_mbx_vf;
-+ *(void **)&mbx->ops.write = e1000_write_mbx_vf;
-+ *(void **)&mbx->ops.read_posted = e1000_read_posted_mbx;
-+ *(void **)&mbx->ops.write_posted = e1000_write_posted_mbx;
-+ *(void **)&mbx->ops.check_for_msg = e1000_check_for_msg_vf;
-+ *(void **)&mbx->ops.check_for_ack = e1000_check_for_ack_vf;
-+ *(void **)&mbx->ops.check_for_rst = e1000_check_for_rst_vf;
-
- mbx->stats.msgs_tx = 0;
- mbx->stats.msgs_rx = 0;
-diff -urNp linux-2.6.32.45/drivers/net/igbvf/vf.c linux-2.6.32.45/drivers/net/igbvf/vf.c
---- linux-2.6.32.45/drivers/net/igbvf/vf.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/igbvf/vf.c 2011-08-05 20:33:55.000000000 -0400
-@@ -55,21 +55,21 @@ static s32 e1000_init_mac_params_vf(stru
-
- /* Function pointers */
- /* reset */
-- mac->ops.reset_hw = e1000_reset_hw_vf;
-+ *(void **)&mac->ops.reset_hw = e1000_reset_hw_vf;
- /* hw initialization */
-- mac->ops.init_hw = e1000_init_hw_vf;
-+ *(void **)&mac->ops.init_hw = e1000_init_hw_vf;
- /* check for link */
-- mac->ops.check_for_link = e1000_check_for_link_vf;
-+ *(void **)&mac->ops.check_for_link = e1000_check_for_link_vf;
- /* link info */
-- mac->ops.get_link_up_info = e1000_get_link_up_info_vf;
-+ *(void **)&mac->ops.get_link_up_info = e1000_get_link_up_info_vf;
- /* multicast address update */
-- mac->ops.update_mc_addr_list = e1000_update_mc_addr_list_vf;
-+ *(void **)&mac->ops.update_mc_addr_list = e1000_update_mc_addr_list_vf;
- /* set mac address */
-- mac->ops.rar_set = e1000_rar_set_vf;
-+ *(void **)&mac->ops.rar_set = e1000_rar_set_vf;
- /* read mac address */
-- mac->ops.read_mac_addr = e1000_read_mac_addr_vf;
-+ *(void **)&mac->ops.read_mac_addr = e1000_read_mac_addr_vf;
- /* set vlan filter table array */
-- mac->ops.set_vfta = e1000_set_vfta_vf;
-+ *(void **)&mac->ops.set_vfta = e1000_set_vfta_vf;
-
- return E1000_SUCCESS;
- }
-@@ -80,8 +80,8 @@ static s32 e1000_init_mac_params_vf(stru
- **/
- void e1000_init_function_pointers_vf(struct e1000_hw *hw)
- {
-- hw->mac.ops.init_params = e1000_init_mac_params_vf;
-- hw->mbx.ops.init_params = e1000_init_mbx_params_vf;
-+ *(void **)&hw->mac.ops.init_params = e1000_init_mac_params_vf;
-+ *(void **)&hw->mbx.ops.init_params = e1000_init_mbx_params_vf;
- }
-
- /**
-diff -urNp linux-2.6.32.45/drivers/net/iseries_veth.c linux-2.6.32.45/drivers/net/iseries_veth.c
---- linux-2.6.32.45/drivers/net/iseries_veth.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/iseries_veth.c 2011-04-17 15:56:46.000000000 -0400
-@@ -384,7 +384,7 @@ static struct attribute *veth_cnx_defaul
- NULL
- };
-
--static struct sysfs_ops veth_cnx_sysfs_ops = {
-+static const struct sysfs_ops veth_cnx_sysfs_ops = {
- .show = veth_cnx_attribute_show
- };
-
-@@ -441,7 +441,7 @@ static struct attribute *veth_port_defau
- NULL
- };
-
--static struct sysfs_ops veth_port_sysfs_ops = {
-+static const struct sysfs_ops veth_port_sysfs_ops = {
- .show = veth_port_attribute_show
- };
-
-diff -urNp linux-2.6.32.45/drivers/net/ixgb/ixgb_main.c linux-2.6.32.45/drivers/net/ixgb/ixgb_main.c
---- linux-2.6.32.45/drivers/net/ixgb/ixgb_main.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/ixgb/ixgb_main.c 2011-05-16 21:46:57.000000000 -0400
-@@ -1052,6 +1052,8 @@ ixgb_set_multi(struct net_device *netdev
- u32 rctl;
- int i;
-
-+ pax_track_stack();
-+
- /* Check for Promiscuous and All Multicast modes */
-
- rctl = IXGB_READ_REG(hw, RCTL);
-diff -urNp linux-2.6.32.45/drivers/net/ixgb/ixgb_param.c linux-2.6.32.45/drivers/net/ixgb/ixgb_param.c
---- linux-2.6.32.45/drivers/net/ixgb/ixgb_param.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/ixgb/ixgb_param.c 2011-05-16 21:46:57.000000000 -0400
-@@ -260,6 +260,9 @@ void __devinit
- ixgb_check_options(struct ixgb_adapter *adapter)
- {
- int bd = adapter->bd_number;
-+
-+ pax_track_stack();
-+
- if (bd >= IXGB_MAX_NIC) {
- printk(KERN_NOTICE
- "Warning: no configuration for board #%i\n", bd);
-diff -urNp linux-2.6.32.45/drivers/net/ixgbe/ixgbe_82598.c linux-2.6.32.45/drivers/net/ixgbe/ixgbe_82598.c
---- linux-2.6.32.45/drivers/net/ixgbe/ixgbe_82598.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/ixgbe/ixgbe_82598.c 2011-08-05 20:33:55.000000000 -0400
-@@ -154,19 +154,19 @@ static s32 ixgbe_init_phy_ops_82598(stru
-
- /* Overwrite the link function pointers if copper PHY */
- if (mac->ops.get_media_type(hw) == ixgbe_media_type_copper) {
-- mac->ops.setup_link = &ixgbe_setup_copper_link_82598;
-- mac->ops.get_link_capabilities =
-+ *(void **)&mac->ops.setup_link = &ixgbe_setup_copper_link_82598;
-+ *(void **)&mac->ops.get_link_capabilities =
- &ixgbe_get_copper_link_capabilities_82598;
- }
-
- switch (hw->phy.type) {
- case ixgbe_phy_tn:
-- phy->ops.check_link = &ixgbe_check_phy_link_tnx;
-- phy->ops.get_firmware_version =
-+ *(void **)&phy->ops.check_link = &ixgbe_check_phy_link_tnx;
-+ *(void **)&phy->ops.get_firmware_version =
- &ixgbe_get_phy_firmware_version_tnx;
- break;
- case ixgbe_phy_nl:
-- phy->ops.reset = &ixgbe_reset_phy_nl;
-+ *(void **)&phy->ops.reset = &ixgbe_reset_phy_nl;
-
- /* Call SFP+ identify routine to get the SFP+ module type */
- ret_val = phy->ops.identify_sfp(hw);
-diff -urNp linux-2.6.32.45/drivers/net/ixgbe/ixgbe_82599.c linux-2.6.32.45/drivers/net/ixgbe/ixgbe_82599.c
---- linux-2.6.32.45/drivers/net/ixgbe/ixgbe_82599.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/ixgbe/ixgbe_82599.c 2011-08-05 20:33:55.000000000 -0400
-@@ -62,9 +62,9 @@ static void ixgbe_init_mac_link_ops_8259
- struct ixgbe_mac_info *mac = &hw->mac;
- if (hw->phy.multispeed_fiber) {
- /* Set up dual speed SFP+ support */
-- mac->ops.setup_link = &ixgbe_setup_mac_link_multispeed_fiber;
-+ *(void **)&mac->ops.setup_link = &ixgbe_setup_mac_link_multispeed_fiber;
- } else {
-- mac->ops.setup_link = &ixgbe_setup_mac_link_82599;
-+ *(void **)&mac->ops.setup_link = &ixgbe_setup_mac_link_82599;
- }
- }
-
-@@ -76,7 +76,7 @@ static s32 ixgbe_setup_sfp_modules_82599
- if (hw->phy.sfp_type != ixgbe_sfp_type_unknown) {
- ixgbe_init_mac_link_ops_82599(hw);
-
-- hw->phy.ops.reset = NULL;
-+ *(void **)&hw->phy.ops.reset = NULL;
-
- ret_val = ixgbe_get_sfp_init_sequence_offsets(hw, &list_offset,
- &data_offset);
-@@ -171,16 +171,16 @@ static s32 ixgbe_init_phy_ops_82599(stru
-
- /* If copper media, overwrite with copper function pointers */
- if (mac->ops.get_media_type(hw) == ixgbe_media_type_copper) {
-- mac->ops.setup_link = &ixgbe_setup_copper_link_82599;
-- mac->ops.get_link_capabilities =
-+ *(void **)&mac->ops.setup_link = &ixgbe_setup_copper_link_82599;
-+ *(void **)&mac->ops.get_link_capabilities =
- &ixgbe_get_copper_link_capabilities_82599;
- }
-
- /* Set necessary function pointers based on phy type */
- switch (hw->phy.type) {
- case ixgbe_phy_tn:
-- phy->ops.check_link = &ixgbe_check_phy_link_tnx;
-- phy->ops.get_firmware_version =
-+ *(void **)&phy->ops.check_link = &ixgbe_check_phy_link_tnx;
-+ *(void **)&phy->ops.get_firmware_version =
- &ixgbe_get_phy_firmware_version_tnx;
- break;
- default:
-diff -urNp linux-2.6.32.45/drivers/net/ixgbe/ixgbe_main.c linux-2.6.32.45/drivers/net/ixgbe/ixgbe_main.c
---- linux-2.6.32.45/drivers/net/ixgbe/ixgbe_main.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/ixgbe/ixgbe_main.c 2011-08-05 20:33:55.000000000 -0400
-@@ -5638,18 +5638,18 @@ static int __devinit ixgbe_probe(struct
- adapter->bd_number = cards_found;
-
- /* Setup hw api */
-- memcpy(&hw->mac.ops, ii->mac_ops, sizeof(hw->mac.ops));
-+ memcpy((void *)&hw->mac.ops, ii->mac_ops, sizeof(hw->mac.ops));
- hw->mac.type = ii->mac;
-
- /* EEPROM */
-- memcpy(&hw->eeprom.ops, ii->eeprom_ops, sizeof(hw->eeprom.ops));
-+ memcpy((void *)&hw->eeprom.ops, ii->eeprom_ops, sizeof(hw->eeprom.ops));
- eec = IXGBE_READ_REG(hw, IXGBE_EEC);
- /* If EEPROM is valid (bit 8 = 1), use default otherwise use bit bang */
- if (!(eec & (1 << 8)))
-- hw->eeprom.ops.read = &ixgbe_read_eeprom_bit_bang_generic;
-+ *(void **)&hw->eeprom.ops.read = &ixgbe_read_eeprom_bit_bang_generic;
-
- /* PHY */
-- memcpy(&hw->phy.ops, ii->phy_ops, sizeof(hw->phy.ops));
-+ memcpy((void *)&hw->phy.ops, ii->phy_ops, sizeof(hw->phy.ops));
- hw->phy.sfp_type = ixgbe_sfp_type_unknown;
- /* ixgbe_identify_phy_generic will set prtad and mmds properly */
- hw->phy.mdio.prtad = MDIO_PRTAD_NONE;
-diff -urNp linux-2.6.32.45/drivers/net/mlx4/main.c linux-2.6.32.45/drivers/net/mlx4/main.c
---- linux-2.6.32.45/drivers/net/mlx4/main.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/mlx4/main.c 2011-05-18 20:09:37.000000000 -0400
-@@ -38,6 +38,7 @@
- #include <linux/errno.h>
- #include <linux/pci.h>
- #include <linux/dma-mapping.h>
-+#include <linux/sched.h>
-
- #include <linux/mlx4/device.h>
- #include <linux/mlx4/doorbell.h>
-@@ -730,6 +731,8 @@ static int mlx4_init_hca(struct mlx4_dev
- u64 icm_size;
- int err;
-
-+ pax_track_stack();
-+
- err = mlx4_QUERY_FW(dev);
- if (err) {
- if (err == -EACCES)
-diff -urNp linux-2.6.32.45/drivers/net/niu.c linux-2.6.32.45/drivers/net/niu.c
---- linux-2.6.32.45/drivers/net/niu.c 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/niu.c 2011-05-16 21:46:57.000000000 -0400
-@@ -9128,6 +9128,8 @@ static void __devinit niu_try_msix(struc
- int i, num_irqs, err;
- u8 first_ldg;
-
-+ pax_track_stack();
-+
- first_ldg = (NIU_NUM_LDG / parent->num_ports) * np->port;
- for (i = 0; i < (NIU_NUM_LDG / parent->num_ports); i++)
- ldg_num_map[i] = first_ldg + i;
-diff -urNp linux-2.6.32.45/drivers/net/pcnet32.c linux-2.6.32.45/drivers/net/pcnet32.c
---- linux-2.6.32.45/drivers/net/pcnet32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/pcnet32.c 2011-08-05 20:33:55.000000000 -0400
-@@ -79,7 +79,7 @@ static int cards_found;
- /*
- * VLB I/O addresses
- */
--static unsigned int pcnet32_portlist[] __initdata =
-+static unsigned int pcnet32_portlist[] __devinitdata =
- { 0x300, 0x320, 0x340, 0x360, 0 };
-
- static int pcnet32_debug = 0;
-@@ -267,7 +267,7 @@ struct pcnet32_private {
- struct sk_buff **rx_skbuff;
- dma_addr_t *tx_dma_addr;
- dma_addr_t *rx_dma_addr;
-- struct pcnet32_access a;
-+ struct pcnet32_access *a;
- spinlock_t lock; /* Guard lock */
- unsigned int cur_rx, cur_tx; /* The next free ring entry */
- unsigned int rx_ring_size; /* current rx ring size */
-@@ -457,9 +457,9 @@ static void pcnet32_netif_start(struct n
- u16 val;
-
- netif_wake_queue(dev);
-- val = lp->a.read_csr(ioaddr, CSR3);
-+ val = lp->a->read_csr(ioaddr, CSR3);
- val &= 0x00ff;
-- lp->a.write_csr(ioaddr, CSR3, val);
-+ lp->a->write_csr(ioaddr, CSR3, val);
- napi_enable(&lp->napi);
- }
-
-@@ -744,7 +744,7 @@ static u32 pcnet32_get_link(struct net_d
- r = mii_link_ok(&lp->mii_if);
- } else if (lp->chip_version >= PCNET32_79C970A) {
- ulong ioaddr = dev->base_addr; /* card base I/O address */
-- r = (lp->a.read_bcr(ioaddr, 4) != 0xc0);
-+ r = (lp->a->read_bcr(ioaddr, 4) != 0xc0);
- } else { /* can not detect link on really old chips */
- r = 1;
- }
-@@ -806,7 +806,7 @@ static int pcnet32_set_ringparam(struct
- pcnet32_netif_stop(dev);
-
- spin_lock_irqsave(&lp->lock, flags);
-- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
-
- size = min(ering->tx_pending, (unsigned int)TX_MAX_RING_SIZE);
-
-@@ -886,7 +886,7 @@ static void pcnet32_ethtool_test(struct
- static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
- {
- struct pcnet32_private *lp = netdev_priv(dev);
-- struct pcnet32_access *a = &lp->a; /* access to registers */
-+ struct pcnet32_access *a = lp->a; /* access to registers */
- ulong ioaddr = dev->base_addr; /* card base I/O address */
- struct sk_buff *skb; /* sk buff */
- int x, i; /* counters */
-@@ -906,21 +906,21 @@ static int pcnet32_loopback_test(struct
- pcnet32_netif_stop(dev);
-
- spin_lock_irqsave(&lp->lock, flags);
-- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
-
- numbuffs = min(numbuffs, (int)min(lp->rx_ring_size, lp->tx_ring_size));
-
- /* Reset the PCNET32 */
-- lp->a.reset(ioaddr);
-- lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
-+ lp->a->reset(ioaddr);
-+ lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
-
- /* switch pcnet32 to 32bit mode */
-- lp->a.write_bcr(ioaddr, 20, 2);
-+ lp->a->write_bcr(ioaddr, 20, 2);
-
- /* purge & init rings but don't actually restart */
- pcnet32_restart(dev, 0x0000);
-
-- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
-
- /* Initialize Transmit buffers. */
- size = data_len + 15;
-@@ -966,10 +966,10 @@ static int pcnet32_loopback_test(struct
-
- /* set int loopback in CSR15 */
- x = a->read_csr(ioaddr, CSR15) & 0xfffc;
-- lp->a.write_csr(ioaddr, CSR15, x | 0x0044);
-+ lp->a->write_csr(ioaddr, CSR15, x | 0x0044);
-
- teststatus = cpu_to_le16(0x8000);
-- lp->a.write_csr(ioaddr, CSR0, CSR0_START); /* Set STRT bit */
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_START); /* Set STRT bit */
-
- /* Check status of descriptors */
- for (x = 0; x < numbuffs; x++) {
-@@ -990,7 +990,7 @@ static int pcnet32_loopback_test(struct
- }
- }
-
-- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
- wmb();
- if (netif_msg_hw(lp) && netif_msg_pktdata(lp)) {
- printk(KERN_DEBUG "%s: RX loopback packets:\n", dev->name);
-@@ -1039,7 +1039,7 @@ static int pcnet32_loopback_test(struct
- pcnet32_restart(dev, CSR0_NORMAL);
- } else {
- pcnet32_purge_rx_ring(dev);
-- lp->a.write_bcr(ioaddr, 20, 4); /* return to 16bit mode */
-+ lp->a->write_bcr(ioaddr, 20, 4); /* return to 16bit mode */
- }
- spin_unlock_irqrestore(&lp->lock, flags);
-
-@@ -1049,7 +1049,7 @@ static int pcnet32_loopback_test(struct
- static void pcnet32_led_blink_callback(struct net_device *dev)
- {
- struct pcnet32_private *lp = netdev_priv(dev);
-- struct pcnet32_access *a = &lp->a;
-+ struct pcnet32_access *a = lp->a;
- ulong ioaddr = dev->base_addr;
- unsigned long flags;
- int i;
-@@ -1066,7 +1066,7 @@ static void pcnet32_led_blink_callback(s
- static int pcnet32_phys_id(struct net_device *dev, u32 data)
- {
- struct pcnet32_private *lp = netdev_priv(dev);
-- struct pcnet32_access *a = &lp->a;
-+ struct pcnet32_access *a = lp->a;
- ulong ioaddr = dev->base_addr;
- unsigned long flags;
- int i, regs[4];
-@@ -1112,7 +1112,7 @@ static int pcnet32_suspend(struct net_de
- {
- int csr5;
- struct pcnet32_private *lp = netdev_priv(dev);
-- struct pcnet32_access *a = &lp->a;
-+ struct pcnet32_access *a = lp->a;
- ulong ioaddr = dev->base_addr;
- int ticks;
-
-@@ -1388,8 +1388,8 @@ static int pcnet32_poll(struct napi_stru
- spin_lock_irqsave(&lp->lock, flags);
- if (pcnet32_tx(dev)) {
- /* reset the chip to clear the error condition, then restart */
-- lp->a.reset(ioaddr);
-- lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
-+ lp->a->reset(ioaddr);
-+ lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
- pcnet32_restart(dev, CSR0_START);
- netif_wake_queue(dev);
- }
-@@ -1401,12 +1401,12 @@ static int pcnet32_poll(struct napi_stru
- __napi_complete(napi);
-
- /* clear interrupt masks */
-- val = lp->a.read_csr(ioaddr, CSR3);
-+ val = lp->a->read_csr(ioaddr, CSR3);
- val &= 0x00ff;
-- lp->a.write_csr(ioaddr, CSR3, val);
-+ lp->a->write_csr(ioaddr, CSR3, val);
-
- /* Set interrupt enable. */
-- lp->a.write_csr(ioaddr, CSR0, CSR0_INTEN);
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_INTEN);
-
- spin_unlock_irqrestore(&lp->lock, flags);
- }
-@@ -1429,7 +1429,7 @@ static void pcnet32_get_regs(struct net_
- int i, csr0;
- u16 *buff = ptr;
- struct pcnet32_private *lp = netdev_priv(dev);
-- struct pcnet32_access *a = &lp->a;
-+ struct pcnet32_access *a = lp->a;
- ulong ioaddr = dev->base_addr;
- unsigned long flags;
-
-@@ -1466,9 +1466,9 @@ static void pcnet32_get_regs(struct net_
- for (j = 0; j < PCNET32_MAX_PHYS; j++) {
- if (lp->phymask & (1 << j)) {
- for (i = 0; i < PCNET32_REGS_PER_PHY; i++) {
-- lp->a.write_bcr(ioaddr, 33,
-+ lp->a->write_bcr(ioaddr, 33,
- (j << 5) | i);
-- *buff++ = lp->a.read_bcr(ioaddr, 34);
-+ *buff++ = lp->a->read_bcr(ioaddr, 34);
- }
- }
- }
-@@ -1858,7 +1858,7 @@ pcnet32_probe1(unsigned long ioaddr, int
- ((cards_found >= MAX_UNITS) || full_duplex[cards_found]))
- lp->options |= PCNET32_PORT_FD;
-
-- lp->a = *a;
-+ lp->a = a;
-
- /* prior to register_netdev, dev->name is not yet correct */
- if (pcnet32_alloc_ring(dev, pci_name(lp->pci_dev))) {
-@@ -1917,7 +1917,7 @@ pcnet32_probe1(unsigned long ioaddr, int
- if (lp->mii) {
- /* lp->phycount and lp->phymask are set to 0 by memset above */
-
-- lp->mii_if.phy_id = ((lp->a.read_bcr(ioaddr, 33)) >> 5) & 0x1f;
-+ lp->mii_if.phy_id = ((lp->a->read_bcr(ioaddr, 33)) >> 5) & 0x1f;
- /* scan for PHYs */
- for (i = 0; i < PCNET32_MAX_PHYS; i++) {
- unsigned short id1, id2;
-@@ -1938,7 +1938,7 @@ pcnet32_probe1(unsigned long ioaddr, int
- "Found PHY %04x:%04x at address %d.\n",
- id1, id2, i);
- }
-- lp->a.write_bcr(ioaddr, 33, (lp->mii_if.phy_id) << 5);
-+ lp->a->write_bcr(ioaddr, 33, (lp->mii_if.phy_id) << 5);
- if (lp->phycount > 1) {
- lp->options |= PCNET32_PORT_MII;
- }
-@@ -2109,10 +2109,10 @@ static int pcnet32_open(struct net_devic
- }
-
- /* Reset the PCNET32 */
-- lp->a.reset(ioaddr);
-+ lp->a->reset(ioaddr);
-
- /* switch pcnet32 to 32bit mode */
-- lp->a.write_bcr(ioaddr, 20, 2);
-+ lp->a->write_bcr(ioaddr, 20, 2);
-
- if (netif_msg_ifup(lp))
- printk(KERN_DEBUG
-@@ -2122,14 +2122,14 @@ static int pcnet32_open(struct net_devic
- (u32) (lp->init_dma_addr));
-
- /* set/reset autoselect bit */
-- val = lp->a.read_bcr(ioaddr, 2) & ~2;
-+ val = lp->a->read_bcr(ioaddr, 2) & ~2;
- if (lp->options & PCNET32_PORT_ASEL)
- val |= 2;
-- lp->a.write_bcr(ioaddr, 2, val);
-+ lp->a->write_bcr(ioaddr, 2, val);
-
- /* handle full duplex setting */
- if (lp->mii_if.full_duplex) {
-- val = lp->a.read_bcr(ioaddr, 9) & ~3;
-+ val = lp->a->read_bcr(ioaddr, 9) & ~3;
- if (lp->options & PCNET32_PORT_FD) {
- val |= 1;
- if (lp->options == (PCNET32_PORT_FD | PCNET32_PORT_AUI))
-@@ -2139,14 +2139,14 @@ static int pcnet32_open(struct net_devic
- if (lp->chip_version == 0x2627)
- val |= 3;
- }
-- lp->a.write_bcr(ioaddr, 9, val);
-+ lp->a->write_bcr(ioaddr, 9, val);
- }
-
- /* set/reset GPSI bit in test register */
-- val = lp->a.read_csr(ioaddr, 124) & ~0x10;
-+ val = lp->a->read_csr(ioaddr, 124) & ~0x10;
- if ((lp->options & PCNET32_PORT_PORTSEL) == PCNET32_PORT_GPSI)
- val |= 0x10;
-- lp->a.write_csr(ioaddr, 124, val);
-+ lp->a->write_csr(ioaddr, 124, val);
-
- /* Allied Telesyn AT 2700/2701 FX are 100Mbit only and do not negotiate */
- if (pdev && pdev->subsystem_vendor == PCI_VENDOR_ID_AT &&
-@@ -2167,24 +2167,24 @@ static int pcnet32_open(struct net_devic
- * duplex, and/or enable auto negotiation, and clear DANAS
- */
- if (lp->mii && !(lp->options & PCNET32_PORT_ASEL)) {
-- lp->a.write_bcr(ioaddr, 32,
-- lp->a.read_bcr(ioaddr, 32) | 0x0080);
-+ lp->a->write_bcr(ioaddr, 32,
-+ lp->a->read_bcr(ioaddr, 32) | 0x0080);
- /* disable Auto Negotiation, set 10Mpbs, HD */
-- val = lp->a.read_bcr(ioaddr, 32) & ~0xb8;
-+ val = lp->a->read_bcr(ioaddr, 32) & ~0xb8;
- if (lp->options & PCNET32_PORT_FD)
- val |= 0x10;
- if (lp->options & PCNET32_PORT_100)
- val |= 0x08;
-- lp->a.write_bcr(ioaddr, 32, val);
-+ lp->a->write_bcr(ioaddr, 32, val);
- } else {
- if (lp->options & PCNET32_PORT_ASEL) {
-- lp->a.write_bcr(ioaddr, 32,
-- lp->a.read_bcr(ioaddr,
-+ lp->a->write_bcr(ioaddr, 32,
-+ lp->a->read_bcr(ioaddr,
- 32) | 0x0080);
- /* enable auto negotiate, setup, disable fd */
-- val = lp->a.read_bcr(ioaddr, 32) & ~0x98;
-+ val = lp->a->read_bcr(ioaddr, 32) & ~0x98;
- val |= 0x20;
-- lp->a.write_bcr(ioaddr, 32, val);
-+ lp->a->write_bcr(ioaddr, 32, val);
- }
- }
- } else {
-@@ -2197,10 +2197,10 @@ static int pcnet32_open(struct net_devic
- * There is really no good other way to handle multiple PHYs
- * other than turning off all automatics
- */
-- val = lp->a.read_bcr(ioaddr, 2);
-- lp->a.write_bcr(ioaddr, 2, val & ~2);
-- val = lp->a.read_bcr(ioaddr, 32);
-- lp->a.write_bcr(ioaddr, 32, val & ~(1 << 7)); /* stop MII manager */
-+ val = lp->a->read_bcr(ioaddr, 2);
-+ lp->a->write_bcr(ioaddr, 2, val & ~2);
-+ val = lp->a->read_bcr(ioaddr, 32);
-+ lp->a->write_bcr(ioaddr, 32, val & ~(1 << 7)); /* stop MII manager */
-
- if (!(lp->options & PCNET32_PORT_ASEL)) {
- /* setup ecmd */
-@@ -2210,7 +2210,7 @@ static int pcnet32_open(struct net_devic
- ecmd.speed =
- lp->
- options & PCNET32_PORT_100 ? SPEED_100 : SPEED_10;
-- bcr9 = lp->a.read_bcr(ioaddr, 9);
-+ bcr9 = lp->a->read_bcr(ioaddr, 9);
-
- if (lp->options & PCNET32_PORT_FD) {
- ecmd.duplex = DUPLEX_FULL;
-@@ -2219,7 +2219,7 @@ static int pcnet32_open(struct net_devic
- ecmd.duplex = DUPLEX_HALF;
- bcr9 |= ~(1 << 0);
- }
-- lp->a.write_bcr(ioaddr, 9, bcr9);
-+ lp->a->write_bcr(ioaddr, 9, bcr9);
- }
-
- for (i = 0; i < PCNET32_MAX_PHYS; i++) {
-@@ -2252,9 +2252,9 @@ static int pcnet32_open(struct net_devic
-
- #ifdef DO_DXSUFLO
- if (lp->dxsuflo) { /* Disable transmit stop on underflow */
-- val = lp->a.read_csr(ioaddr, CSR3);
-+ val = lp->a->read_csr(ioaddr, CSR3);
- val |= 0x40;
-- lp->a.write_csr(ioaddr, CSR3, val);
-+ lp->a->write_csr(ioaddr, CSR3, val);
- }
- #endif
-
-@@ -2270,11 +2270,11 @@ static int pcnet32_open(struct net_devic
- napi_enable(&lp->napi);
-
- /* Re-initialize the PCNET32, and start it when done. */
-- lp->a.write_csr(ioaddr, 1, (lp->init_dma_addr & 0xffff));
-- lp->a.write_csr(ioaddr, 2, (lp->init_dma_addr >> 16));
-+ lp->a->write_csr(ioaddr, 1, (lp->init_dma_addr & 0xffff));
-+ lp->a->write_csr(ioaddr, 2, (lp->init_dma_addr >> 16));
-
-- lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
-- lp->a.write_csr(ioaddr, CSR0, CSR0_INIT);
-+ lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_INIT);
-
- netif_start_queue(dev);
-
-@@ -2286,20 +2286,20 @@ static int pcnet32_open(struct net_devic
-
- i = 0;
- while (i++ < 100)
-- if (lp->a.read_csr(ioaddr, CSR0) & CSR0_IDON)
-+ if (lp->a->read_csr(ioaddr, CSR0) & CSR0_IDON)
- break;
- /*
- * We used to clear the InitDone bit, 0x0100, here but Mark Stockton
- * reports that doing so triggers a bug in the '974.
- */
-- lp->a.write_csr(ioaddr, CSR0, CSR0_NORMAL);
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_NORMAL);
-
- if (netif_msg_ifup(lp))
- printk(KERN_DEBUG
- "%s: pcnet32 open after %d ticks, init block %#x csr0 %4.4x.\n",
- dev->name, i,
- (u32) (lp->init_dma_addr),
-- lp->a.read_csr(ioaddr, CSR0));
-+ lp->a->read_csr(ioaddr, CSR0));
-
- spin_unlock_irqrestore(&lp->lock, flags);
-
-@@ -2313,7 +2313,7 @@ static int pcnet32_open(struct net_devic
- * Switch back to 16bit mode to avoid problems with dumb
- * DOS packet driver after a warm reboot
- */
-- lp->a.write_bcr(ioaddr, 20, 4);
-+ lp->a->write_bcr(ioaddr, 20, 4);
-
- err_free_irq:
- spin_unlock_irqrestore(&lp->lock, flags);
-@@ -2420,7 +2420,7 @@ static void pcnet32_restart(struct net_d
-
- /* wait for stop */
- for (i = 0; i < 100; i++)
-- if (lp->a.read_csr(ioaddr, CSR0) & CSR0_STOP)
-+ if (lp->a->read_csr(ioaddr, CSR0) & CSR0_STOP)
- break;
-
- if (i >= 100 && netif_msg_drv(lp))
-@@ -2433,13 +2433,13 @@ static void pcnet32_restart(struct net_d
- return;
-
- /* ReInit Ring */
-- lp->a.write_csr(ioaddr, CSR0, CSR0_INIT);
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_INIT);
- i = 0;
- while (i++ < 1000)
-- if (lp->a.read_csr(ioaddr, CSR0) & CSR0_IDON)
-+ if (lp->a->read_csr(ioaddr, CSR0) & CSR0_IDON)
- break;
-
-- lp->a.write_csr(ioaddr, CSR0, csr0_bits);
-+ lp->a->write_csr(ioaddr, CSR0, csr0_bits);
- }
-
- static void pcnet32_tx_timeout(struct net_device *dev)
-@@ -2452,8 +2452,8 @@ static void pcnet32_tx_timeout(struct ne
- if (pcnet32_debug & NETIF_MSG_DRV)
- printk(KERN_ERR
- "%s: transmit timed out, status %4.4x, resetting.\n",
-- dev->name, lp->a.read_csr(ioaddr, CSR0));
-- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
-+ dev->name, lp->a->read_csr(ioaddr, CSR0));
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
- dev->stats.tx_errors++;
- if (netif_msg_tx_err(lp)) {
- int i;
-@@ -2497,7 +2497,7 @@ static netdev_tx_t pcnet32_start_xmit(st
- if (netif_msg_tx_queued(lp)) {
- printk(KERN_DEBUG
- "%s: pcnet32_start_xmit() called, csr0 %4.4x.\n",
-- dev->name, lp->a.read_csr(ioaddr, CSR0));
-+ dev->name, lp->a->read_csr(ioaddr, CSR0));
- }
-
- /* Default status -- will not enable Successful-TxDone
-@@ -2528,7 +2528,7 @@ static netdev_tx_t pcnet32_start_xmit(st
- dev->stats.tx_bytes += skb->len;
-
- /* Trigger an immediate send poll. */
-- lp->a.write_csr(ioaddr, CSR0, CSR0_INTEN | CSR0_TXPOLL);
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_INTEN | CSR0_TXPOLL);
-
- dev->trans_start = jiffies;
-
-@@ -2555,18 +2555,18 @@ pcnet32_interrupt(int irq, void *dev_id)
-
- spin_lock(&lp->lock);
-
-- csr0 = lp->a.read_csr(ioaddr, CSR0);
-+ csr0 = lp->a->read_csr(ioaddr, CSR0);
- while ((csr0 & 0x8f00) && --boguscnt >= 0) {
- if (csr0 == 0xffff) {
- break; /* PCMCIA remove happened */
- }
- /* Acknowledge all of the current interrupt sources ASAP. */
-- lp->a.write_csr(ioaddr, CSR0, csr0 & ~0x004f);
-+ lp->a->write_csr(ioaddr, CSR0, csr0 & ~0x004f);
-
- if (netif_msg_intr(lp))
- printk(KERN_DEBUG
- "%s: interrupt csr0=%#2.2x new csr=%#2.2x.\n",
-- dev->name, csr0, lp->a.read_csr(ioaddr, CSR0));
-+ dev->name, csr0, lp->a->read_csr(ioaddr, CSR0));
-
- /* Log misc errors. */
- if (csr0 & 0x4000)
-@@ -2595,19 +2595,19 @@ pcnet32_interrupt(int irq, void *dev_id)
- if (napi_schedule_prep(&lp->napi)) {
- u16 val;
- /* set interrupt masks */
-- val = lp->a.read_csr(ioaddr, CSR3);
-+ val = lp->a->read_csr(ioaddr, CSR3);
- val |= 0x5f00;
-- lp->a.write_csr(ioaddr, CSR3, val);
-+ lp->a->write_csr(ioaddr, CSR3, val);
-
- __napi_schedule(&lp->napi);
- break;
- }
-- csr0 = lp->a.read_csr(ioaddr, CSR0);
-+ csr0 = lp->a->read_csr(ioaddr, CSR0);
- }
-
- if (netif_msg_intr(lp))
- printk(KERN_DEBUG "%s: exiting interrupt, csr0=%#4.4x.\n",
-- dev->name, lp->a.read_csr(ioaddr, CSR0));
-+ dev->name, lp->a->read_csr(ioaddr, CSR0));
-
- spin_unlock(&lp->lock);
-
-@@ -2627,21 +2627,21 @@ static int pcnet32_close(struct net_devi
-
- spin_lock_irqsave(&lp->lock, flags);
-
-- dev->stats.rx_missed_errors = lp->a.read_csr(ioaddr, 112);
-+ dev->stats.rx_missed_errors = lp->a->read_csr(ioaddr, 112);
-
- if (netif_msg_ifdown(lp))
- printk(KERN_DEBUG
- "%s: Shutting down ethercard, status was %2.2x.\n",
-- dev->name, lp->a.read_csr(ioaddr, CSR0));
-+ dev->name, lp->a->read_csr(ioaddr, CSR0));
-
- /* We stop the PCNET32 here -- it occasionally polls memory if we don't. */
-- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
-
- /*
- * Switch back to 16bit mode to avoid problems with dumb
- * DOS packet driver after a warm reboot
- */
-- lp->a.write_bcr(ioaddr, 20, 4);
-+ lp->a->write_bcr(ioaddr, 20, 4);
-
- spin_unlock_irqrestore(&lp->lock, flags);
-
-@@ -2664,7 +2664,7 @@ static struct net_device_stats *pcnet32_
- unsigned long flags;
-
- spin_lock_irqsave(&lp->lock, flags);
-- dev->stats.rx_missed_errors = lp->a.read_csr(ioaddr, 112);
-+ dev->stats.rx_missed_errors = lp->a->read_csr(ioaddr, 112);
- spin_unlock_irqrestore(&lp->lock, flags);
-
- return &dev->stats;
-@@ -2686,10 +2686,10 @@ static void pcnet32_load_multicast(struc
- if (dev->flags & IFF_ALLMULTI) {
- ib->filter[0] = cpu_to_le32(~0U);
- ib->filter[1] = cpu_to_le32(~0U);
-- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER, 0xffff);
-- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+1, 0xffff);
-- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+2, 0xffff);
-- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+3, 0xffff);
-+ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER, 0xffff);
-+ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+1, 0xffff);
-+ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+2, 0xffff);
-+ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+3, 0xffff);
- return;
- }
- /* clear the multicast filter */
-@@ -2710,7 +2710,7 @@ static void pcnet32_load_multicast(struc
- mcast_table[crc >> 4] |= cpu_to_le16(1 << (crc & 0xf));
- }
- for (i = 0; i < 4; i++)
-- lp->a.write_csr(ioaddr, PCNET32_MC_FILTER + i,
-+ lp->a->write_csr(ioaddr, PCNET32_MC_FILTER + i,
- le16_to_cpu(mcast_table[i]));
- return;
- }
-@@ -2726,7 +2726,7 @@ static void pcnet32_set_multicast_list(s
-
- spin_lock_irqsave(&lp->lock, flags);
- suspended = pcnet32_suspend(dev, &flags, 0);
-- csr15 = lp->a.read_csr(ioaddr, CSR15);
-+ csr15 = lp->a->read_csr(ioaddr, CSR15);
- if (dev->flags & IFF_PROMISC) {
- /* Log any net taps. */
- if (netif_msg_hw(lp))
-@@ -2735,21 +2735,21 @@ static void pcnet32_set_multicast_list(s
- lp->init_block->mode =
- cpu_to_le16(0x8000 | (lp->options & PCNET32_PORT_PORTSEL) <<
- 7);
-- lp->a.write_csr(ioaddr, CSR15, csr15 | 0x8000);
-+ lp->a->write_csr(ioaddr, CSR15, csr15 | 0x8000);
- } else {
- lp->init_block->mode =
- cpu_to_le16((lp->options & PCNET32_PORT_PORTSEL) << 7);
-- lp->a.write_csr(ioaddr, CSR15, csr15 & 0x7fff);
-+ lp->a->write_csr(ioaddr, CSR15, csr15 & 0x7fff);
- pcnet32_load_multicast(dev);
- }
-
- if (suspended) {
- int csr5;
- /* clear SUSPEND (SPND) - CSR5 bit 0 */
-- csr5 = lp->a.read_csr(ioaddr, CSR5);
-- lp->a.write_csr(ioaddr, CSR5, csr5 & (~CSR5_SUSPEND));
-+ csr5 = lp->a->read_csr(ioaddr, CSR5);
-+ lp->a->write_csr(ioaddr, CSR5, csr5 & (~CSR5_SUSPEND));
- } else {
-- lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
-+ lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
- pcnet32_restart(dev, CSR0_NORMAL);
- netif_wake_queue(dev);
- }
-@@ -2767,8 +2767,8 @@ static int mdio_read(struct net_device *
- if (!lp->mii)
- return 0;
-
-- lp->a.write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
-- val_out = lp->a.read_bcr(ioaddr, 34);
-+ lp->a->write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
-+ val_out = lp->a->read_bcr(ioaddr, 34);
-
- return val_out;
- }
-@@ -2782,8 +2782,8 @@ static void mdio_write(struct net_device
- if (!lp->mii)
- return;
-
-- lp->a.write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
-- lp->a.write_bcr(ioaddr, 34, val);
-+ lp->a->write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
-+ lp->a->write_bcr(ioaddr, 34, val);
- }
-
- static int pcnet32_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
-@@ -2862,7 +2862,7 @@ static void pcnet32_check_media(struct n
- curr_link = mii_link_ok(&lp->mii_if);
- } else {
- ulong ioaddr = dev->base_addr; /* card base I/O address */
-- curr_link = (lp->a.read_bcr(ioaddr, 4) != 0xc0);
-+ curr_link = (lp->a->read_bcr(ioaddr, 4) != 0xc0);
- }
- if (!curr_link) {
- if (prev_link || verbose) {
-@@ -2887,13 +2887,13 @@ static void pcnet32_check_media(struct n
- (ecmd.duplex ==
- DUPLEX_FULL) ? "full" : "half");
- }
-- bcr9 = lp->a.read_bcr(dev->base_addr, 9);
-+ bcr9 = lp->a->read_bcr(dev->base_addr, 9);
- if ((bcr9 & (1 << 0)) != lp->mii_if.full_duplex) {
- if (lp->mii_if.full_duplex)
- bcr9 |= (1 << 0);
- else
- bcr9 &= ~(1 << 0);
-- lp->a.write_bcr(dev->base_addr, 9, bcr9);
-+ lp->a->write_bcr(dev->base_addr, 9, bcr9);
- }
- } else {
- if (netif_msg_link(lp))
-diff -urNp linux-2.6.32.45/drivers/net/tg3.h linux-2.6.32.45/drivers/net/tg3.h
---- linux-2.6.32.45/drivers/net/tg3.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/tg3.h 2011-04-17 15:56:46.000000000 -0400
-@@ -95,6 +95,7 @@
- #define CHIPREV_ID_5750_A0 0x4000
- #define CHIPREV_ID_5750_A1 0x4001
- #define CHIPREV_ID_5750_A3 0x4003
-+#define CHIPREV_ID_5750_C1 0x4201
- #define CHIPREV_ID_5750_C2 0x4202
- #define CHIPREV_ID_5752_A0_HW 0x5000
- #define CHIPREV_ID_5752_A0 0x6000
-diff -urNp linux-2.6.32.45/drivers/net/tokenring/abyss.c linux-2.6.32.45/drivers/net/tokenring/abyss.c
---- linux-2.6.32.45/drivers/net/tokenring/abyss.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/tokenring/abyss.c 2011-08-05 20:33:55.000000000 -0400
-@@ -451,10 +451,12 @@ static struct pci_driver abyss_driver =
-
- static int __init abyss_init (void)
- {
-- abyss_netdev_ops = tms380tr_netdev_ops;
-+ pax_open_kernel();
-+ memcpy((void *)&abyss_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
-
-- abyss_netdev_ops.ndo_open = abyss_open;
-- abyss_netdev_ops.ndo_stop = abyss_close;
-+ *(void **)&abyss_netdev_ops.ndo_open = abyss_open;
-+ *(void **)&abyss_netdev_ops.ndo_stop = abyss_close;
-+ pax_close_kernel();
-
- return pci_register_driver(&abyss_driver);
- }
-diff -urNp linux-2.6.32.45/drivers/net/tokenring/madgemc.c linux-2.6.32.45/drivers/net/tokenring/madgemc.c
---- linux-2.6.32.45/drivers/net/tokenring/madgemc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/tokenring/madgemc.c 2011-08-05 20:33:55.000000000 -0400
-@@ -755,9 +755,11 @@ static struct mca_driver madgemc_driver
-
- static int __init madgemc_init (void)
- {
-- madgemc_netdev_ops = tms380tr_netdev_ops;
-- madgemc_netdev_ops.ndo_open = madgemc_open;
-- madgemc_netdev_ops.ndo_stop = madgemc_close;
-+ pax_open_kernel();
-+ memcpy((void *)&madgemc_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
-+ *(void **)&madgemc_netdev_ops.ndo_open = madgemc_open;
-+ *(void **)&madgemc_netdev_ops.ndo_stop = madgemc_close;
-+ pax_close_kernel();
-
- return mca_register_driver (&madgemc_driver);
- }
-diff -urNp linux-2.6.32.45/drivers/net/tokenring/proteon.c linux-2.6.32.45/drivers/net/tokenring/proteon.c
---- linux-2.6.32.45/drivers/net/tokenring/proteon.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/tokenring/proteon.c 2011-08-05 20:33:55.000000000 -0400
-@@ -353,9 +353,11 @@ static int __init proteon_init(void)
- struct platform_device *pdev;
- int i, num = 0, err = 0;
-
-- proteon_netdev_ops = tms380tr_netdev_ops;
-- proteon_netdev_ops.ndo_open = proteon_open;
-- proteon_netdev_ops.ndo_stop = tms380tr_close;
-+ pax_open_kernel();
-+ memcpy((void *)&proteon_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
-+ *(void **)&proteon_netdev_ops.ndo_open = proteon_open;
-+ *(void **)&proteon_netdev_ops.ndo_stop = tms380tr_close;
-+ pax_close_kernel();
-
- err = platform_driver_register(&proteon_driver);
- if (err)
-diff -urNp linux-2.6.32.45/drivers/net/tokenring/skisa.c linux-2.6.32.45/drivers/net/tokenring/skisa.c
---- linux-2.6.32.45/drivers/net/tokenring/skisa.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/tokenring/skisa.c 2011-08-05 20:33:55.000000000 -0400
-@@ -363,9 +363,11 @@ static int __init sk_isa_init(void)
- struct platform_device *pdev;
- int i, num = 0, err = 0;
-
-- sk_isa_netdev_ops = tms380tr_netdev_ops;
-- sk_isa_netdev_ops.ndo_open = sk_isa_open;
-- sk_isa_netdev_ops.ndo_stop = tms380tr_close;
-+ pax_open_kernel();
-+ memcpy((void *)&sk_isa_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
-+ *(void **)&sk_isa_netdev_ops.ndo_open = sk_isa_open;
-+ *(void **)&sk_isa_netdev_ops.ndo_stop = tms380tr_close;
-+ pax_close_kernel();
-
- err = platform_driver_register(&sk_isa_driver);
- if (err)
-diff -urNp linux-2.6.32.45/drivers/net/tulip/de2104x.c linux-2.6.32.45/drivers/net/tulip/de2104x.c
---- linux-2.6.32.45/drivers/net/tulip/de2104x.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/tulip/de2104x.c 2011-05-16 21:46:57.000000000 -0400
-@@ -1785,6 +1785,8 @@ static void __devinit de21041_get_srom_i
- struct de_srom_info_leaf *il;
- void *bufp;
-
-+ pax_track_stack();
-+
- /* download entire eeprom */
- for (i = 0; i < DE_EEPROM_WORDS; i++)
- ((__le16 *)ee_data)[i] =
-diff -urNp linux-2.6.32.45/drivers/net/tulip/de4x5.c linux-2.6.32.45/drivers/net/tulip/de4x5.c
---- linux-2.6.32.45/drivers/net/tulip/de4x5.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/tulip/de4x5.c 2011-04-17 15:56:46.000000000 -0400
-@@ -5472,7 +5472,7 @@ de4x5_ioctl(struct net_device *dev, stru
- for (i=0; i<ETH_ALEN; i++) {
- tmp.addr[i] = dev->dev_addr[i];
- }
-- if (copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
-+ if (ioc->len > sizeof tmp.addr || copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
- break;
-
- case DE4X5_SET_HWADDR: /* Set the hardware address */
-@@ -5512,7 +5512,7 @@ de4x5_ioctl(struct net_device *dev, stru
- spin_lock_irqsave(&lp->lock, flags);
- memcpy(&statbuf, &lp->pktStats, ioc->len);
- spin_unlock_irqrestore(&lp->lock, flags);
-- if (copy_to_user(ioc->data, &statbuf, ioc->len))
-+ if (ioc->len > sizeof statbuf || copy_to_user(ioc->data, &statbuf, ioc->len))
- return -EFAULT;
- break;
- }
-diff -urNp linux-2.6.32.45/drivers/net/usb/hso.c linux-2.6.32.45/drivers/net/usb/hso.c
---- linux-2.6.32.45/drivers/net/usb/hso.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/usb/hso.c 2011-04-17 15:56:46.000000000 -0400
-@@ -71,7 +71,7 @@
- #include <asm/byteorder.h>
- #include <linux/serial_core.h>
- #include <linux/serial.h>
--
-+#include <asm/local.h>
-
- #define DRIVER_VERSION "1.2"
- #define MOD_AUTHOR "Option Wireless"
-@@ -258,7 +258,7 @@ struct hso_serial {
-
- /* from usb_serial_port */
- struct tty_struct *tty;
-- int open_count;
-+ local_t open_count;
- spinlock_t serial_lock;
-
- int (*write_data) (struct hso_serial *serial);
-@@ -1180,7 +1180,7 @@ static void put_rxbuf_data_and_resubmit_
- struct urb *urb;
-
- urb = serial->rx_urb[0];
-- if (serial->open_count > 0) {
-+ if (local_read(&serial->open_count) > 0) {
- count = put_rxbuf_data(urb, serial);
- if (count == -1)
- return;
-@@ -1216,7 +1216,7 @@ static void hso_std_serial_read_bulk_cal
- DUMP1(urb->transfer_buffer, urb->actual_length);
-
- /* Anyone listening? */
-- if (serial->open_count == 0)
-+ if (local_read(&serial->open_count) == 0)
- return;
-
- if (status == 0) {
-@@ -1311,8 +1311,7 @@ static int hso_serial_open(struct tty_st
- spin_unlock_irq(&serial->serial_lock);
-
- /* check for port already opened, if not set the termios */
-- serial->open_count++;
-- if (serial->open_count == 1) {
-+ if (local_inc_return(&serial->open_count) == 1) {
- tty->low_latency = 1;
- serial->rx_state = RX_IDLE;
- /* Force default termio settings */
-@@ -1325,7 +1324,7 @@ static int hso_serial_open(struct tty_st
- result = hso_start_serial_device(serial->parent, GFP_KERNEL);
- if (result) {
- hso_stop_serial_device(serial->parent);
-- serial->open_count--;
-+ local_dec(&serial->open_count);
- kref_put(&serial->parent->ref, hso_serial_ref_free);
- }
- } else {
-@@ -1362,10 +1361,10 @@ static void hso_serial_close(struct tty_
-
- /* reset the rts and dtr */
- /* do the actual close */
-- serial->open_count--;
-+ local_dec(&serial->open_count);
-
-- if (serial->open_count <= 0) {
-- serial->open_count = 0;
-+ if (local_read(&serial->open_count) <= 0) {
-+ local_set(&serial->open_count, 0);
- spin_lock_irq(&serial->serial_lock);
- if (serial->tty == tty) {
- serial->tty->driver_data = NULL;
-@@ -1447,7 +1446,7 @@ static void hso_serial_set_termios(struc
-
- /* the actual setup */
- spin_lock_irqsave(&serial->serial_lock, flags);
-- if (serial->open_count)
-+ if (local_read(&serial->open_count))
- _hso_serial_set_termios(tty, old);
- else
- tty->termios = old;
-@@ -3097,7 +3096,7 @@ static int hso_resume(struct usb_interfa
- /* Start all serial ports */
- for (i = 0; i < HSO_SERIAL_TTY_MINORS; i++) {
- if (serial_table[i] && (serial_table[i]->interface == iface)) {
-- if (dev2ser(serial_table[i])->open_count) {
-+ if (local_read(&dev2ser(serial_table[i])->open_count)) {
- result =
- hso_start_serial_device(serial_table[i], GFP_NOIO);
- hso_kick_transmit(dev2ser(serial_table[i]));
-diff -urNp linux-2.6.32.45/drivers/net/vxge/vxge-config.h linux-2.6.32.45/drivers/net/vxge/vxge-config.h
---- linux-2.6.32.45/drivers/net/vxge/vxge-config.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/vxge/vxge-config.h 2011-08-05 20:33:55.000000000 -0400
-@@ -474,7 +474,7 @@ struct vxge_hw_uld_cbs {
- void (*link_down)(struct __vxge_hw_device *devh);
- void (*crit_err)(struct __vxge_hw_device *devh,
- enum vxge_hw_event type, u64 ext_data);
--};
-+} __no_const;
-
- /*
- * struct __vxge_hw_blockpool_entry - Block private data structure
-diff -urNp linux-2.6.32.45/drivers/net/vxge/vxge-main.c linux-2.6.32.45/drivers/net/vxge/vxge-main.c
---- linux-2.6.32.45/drivers/net/vxge/vxge-main.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/vxge/vxge-main.c 2011-05-16 21:46:57.000000000 -0400
-@@ -93,6 +93,8 @@ static inline void VXGE_COMPLETE_VPATH_T
- struct sk_buff *completed[NR_SKB_COMPLETED];
- int more;
-
-+ pax_track_stack();
-+
- do {
- more = 0;
- skb_ptr = completed;
-@@ -1779,6 +1781,8 @@ static enum vxge_hw_status vxge_rth_conf
- u8 mtable[256] = {0}; /* CPU to vpath mapping */
- int index;
-
-+ pax_track_stack();
-+
- /*
- * Filling
- * - itable with bucket numbers
-diff -urNp linux-2.6.32.45/drivers/net/vxge/vxge-traffic.h linux-2.6.32.45/drivers/net/vxge/vxge-traffic.h
---- linux-2.6.32.45/drivers/net/vxge/vxge-traffic.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/vxge/vxge-traffic.h 2011-08-05 20:33:55.000000000 -0400
-@@ -2123,7 +2123,7 @@ struct vxge_hw_mempool_cbs {
- struct vxge_hw_mempool_dma *dma_object,
- u32 index,
- u32 is_last);
--};
-+} __no_const;
-
- void
- __vxge_hw_mempool_destroy(
-diff -urNp linux-2.6.32.45/drivers/net/wan/cycx_x25.c linux-2.6.32.45/drivers/net/wan/cycx_x25.c
---- linux-2.6.32.45/drivers/net/wan/cycx_x25.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/wan/cycx_x25.c 2011-05-16 21:46:57.000000000 -0400
-@@ -1017,6 +1017,8 @@ static void hex_dump(char *msg, unsigned
- unsigned char hex[1024],
- * phex = hex;
-
-+ pax_track_stack();
-+
- if (len >= (sizeof(hex) / 2))
- len = (sizeof(hex) / 2) - 1;
-
-diff -urNp linux-2.6.32.45/drivers/net/wan/hdlc_x25.c linux-2.6.32.45/drivers/net/wan/hdlc_x25.c
---- linux-2.6.32.45/drivers/net/wan/hdlc_x25.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/wan/hdlc_x25.c 2011-08-05 20:33:55.000000000 -0400
-@@ -136,16 +136,16 @@ static netdev_tx_t x25_xmit(struct sk_bu
-
- static int x25_open(struct net_device *dev)
- {
-- struct lapb_register_struct cb;
-+ static struct lapb_register_struct cb = {
-+ .connect_confirmation = x25_connected,
-+ .connect_indication = x25_connected,
-+ .disconnect_confirmation = x25_disconnected,
-+ .disconnect_indication = x25_disconnected,
-+ .data_indication = x25_data_indication,
-+ .data_transmit = x25_data_transmit
-+ };
- int result;
-
-- cb.connect_confirmation = x25_connected;
-- cb.connect_indication = x25_connected;
-- cb.disconnect_confirmation = x25_disconnected;
-- cb.disconnect_indication = x25_disconnected;
-- cb.data_indication = x25_data_indication;
-- cb.data_transmit = x25_data_transmit;
--
- result = lapb_register(dev, &cb);
- if (result != LAPB_OK)
- return result;
-diff -urNp linux-2.6.32.45/drivers/net/wimax/i2400m/usb-fw.c linux-2.6.32.45/drivers/net/wimax/i2400m/usb-fw.c
---- linux-2.6.32.45/drivers/net/wimax/i2400m/usb-fw.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/wimax/i2400m/usb-fw.c 2011-05-16 21:46:57.000000000 -0400
-@@ -263,6 +263,8 @@ ssize_t i2400mu_bus_bm_wait_for_ack(stru
- int do_autopm = 1;
- DECLARE_COMPLETION_ONSTACK(notif_completion);
-
-+ pax_track_stack();
-+
- d_fnstart(8, dev, "(i2400m %p ack %p size %zu)\n",
- i2400m, ack, ack_size);
- BUG_ON(_ack == i2400m->bm_ack_buf);
-diff -urNp linux-2.6.32.45/drivers/net/wireless/airo.c linux-2.6.32.45/drivers/net/wireless/airo.c
---- linux-2.6.32.45/drivers/net/wireless/airo.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/wireless/airo.c 2011-05-16 21:46:57.000000000 -0400
-@@ -3003,6 +3003,8 @@ static void airo_process_scan_results (s
- BSSListElement * loop_net;
- BSSListElement * tmp_net;
-
-+ pax_track_stack();
-+
- /* Blow away current list of scan results */
- list_for_each_entry_safe (loop_net, tmp_net, &ai->network_list, list) {
- list_move_tail (&loop_net->list, &ai->network_free_list);
-@@ -3783,6 +3785,8 @@ static u16 setup_card(struct airo_info *
- WepKeyRid wkr;
- int rc;
-
-+ pax_track_stack();
-+
- memset( &mySsid, 0, sizeof( mySsid ) );
- kfree (ai->flash);
- ai->flash = NULL;
-@@ -4758,6 +4762,8 @@ static int proc_stats_rid_open( struct i
- __le32 *vals = stats.vals;
- int len;
-
-+ pax_track_stack();
-+
- if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
- return -ENOMEM;
- data = (struct proc_data *)file->private_data;
-@@ -5487,6 +5493,8 @@ static int proc_BSSList_open( struct ino
- /* If doLoseSync is not 1, we won't do a Lose Sync */
- int doLoseSync = -1;
-
-+ pax_track_stack();
-+
- if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
- return -ENOMEM;
- data = (struct proc_data *)file->private_data;
-@@ -7193,6 +7201,8 @@ static int airo_get_aplist(struct net_de
- int i;
- int loseSync = capable(CAP_NET_ADMIN) ? 1: -1;
-
-+ pax_track_stack();
-+
- qual = kmalloc(IW_MAX_AP * sizeof(*qual), GFP_KERNEL);
- if (!qual)
- return -ENOMEM;
-@@ -7753,6 +7763,8 @@ static void airo_read_wireless_stats(str
- CapabilityRid cap_rid;
- __le32 *vals = stats_rid.vals;
-
-+ pax_track_stack();
-+
- /* Get stats out of the card */
- clear_bit(JOB_WSTATS, &local->jobs);
- if (local->power.event) {
-diff -urNp linux-2.6.32.45/drivers/net/wireless/ath/ath5k/debug.c linux-2.6.32.45/drivers/net/wireless/ath/ath5k/debug.c
---- linux-2.6.32.45/drivers/net/wireless/ath/ath5k/debug.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/wireless/ath/ath5k/debug.c 2011-05-16 21:46:57.000000000 -0400
-@@ -205,6 +205,8 @@ static ssize_t read_file_beacon(struct f
- unsigned int v;
- u64 tsf;
-
-+ pax_track_stack();
-+
- v = ath5k_hw_reg_read(sc->ah, AR5K_BEACON);
- len += snprintf(buf+len, sizeof(buf)-len,
- "%-24s0x%08x\tintval: %d\tTIM: 0x%x\n",
-@@ -318,6 +320,8 @@ static ssize_t read_file_debug(struct fi
- unsigned int len = 0;
- unsigned int i;
-
-+ pax_track_stack();
-+
- len += snprintf(buf+len, sizeof(buf)-len,
- "DEBUG LEVEL: 0x%08x\n\n", sc->debug.level);
-
-diff -urNp linux-2.6.32.45/drivers/net/wireless/ath/ath9k/debug.c linux-2.6.32.45/drivers/net/wireless/ath/ath9k/debug.c
---- linux-2.6.32.45/drivers/net/wireless/ath/ath9k/debug.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/wireless/ath/ath9k/debug.c 2011-05-16 21:46:57.000000000 -0400
-@@ -220,6 +220,8 @@ static ssize_t read_file_interrupt(struc
- char buf[512];
- unsigned int len = 0;
-
-+ pax_track_stack();
-+
- len += snprintf(buf + len, sizeof(buf) - len,
- "%8s: %10u\n", "RX", sc->debug.stats.istats.rxok);
- len += snprintf(buf + len, sizeof(buf) - len,
-@@ -360,6 +362,8 @@ static ssize_t read_file_wiphy(struct fi
- int i;
- u8 addr[ETH_ALEN];
-
-+ pax_track_stack();
-+
- len += snprintf(buf + len, sizeof(buf) - len,
- "primary: %s (%s chan=%d ht=%d)\n",
- wiphy_name(sc->pri_wiphy->hw->wiphy),
-diff -urNp linux-2.6.32.45/drivers/net/wireless/b43/debugfs.c linux-2.6.32.45/drivers/net/wireless/b43/debugfs.c
---- linux-2.6.32.45/drivers/net/wireless/b43/debugfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/wireless/b43/debugfs.c 2011-04-17 15:56:46.000000000 -0400
-@@ -43,7 +43,7 @@ static struct dentry *rootdir;
- struct b43_debugfs_fops {
- ssize_t (*read)(struct b43_wldev *dev, char *buf, size_t bufsize);
- int (*write)(struct b43_wldev *dev, const char *buf, size_t count);
-- struct file_operations fops;
-+ const struct file_operations fops;
- /* Offset of struct b43_dfs_file in struct b43_dfsentry */
- size_t file_struct_offset;
- };
-diff -urNp linux-2.6.32.45/drivers/net/wireless/b43legacy/debugfs.c linux-2.6.32.45/drivers/net/wireless/b43legacy/debugfs.c
---- linux-2.6.32.45/drivers/net/wireless/b43legacy/debugfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/wireless/b43legacy/debugfs.c 2011-04-17 15:56:46.000000000 -0400
-@@ -44,7 +44,7 @@ static struct dentry *rootdir;
- struct b43legacy_debugfs_fops {
- ssize_t (*read)(struct b43legacy_wldev *dev, char *buf, size_t bufsize);
- int (*write)(struct b43legacy_wldev *dev, const char *buf, size_t count);
-- struct file_operations fops;
-+ const struct file_operations fops;
- /* Offset of struct b43legacy_dfs_file in struct b43legacy_dfsentry */
- size_t file_struct_offset;
- /* Take wl->irq_lock before calling read/write? */
-diff -urNp linux-2.6.32.45/drivers/net/wireless/ipw2x00/ipw2100.c linux-2.6.32.45/drivers/net/wireless/ipw2x00/ipw2100.c
---- linux-2.6.32.45/drivers/net/wireless/ipw2x00/ipw2100.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/wireless/ipw2x00/ipw2100.c 2011-05-16 21:46:57.000000000 -0400
-@@ -2014,6 +2014,8 @@ static int ipw2100_set_essid(struct ipw2
- int err;
- DECLARE_SSID_BUF(ssid);
-
-+ pax_track_stack();
-+
- IPW_DEBUG_HC("SSID: '%s'\n", print_ssid(ssid, essid, ssid_len));
-
- if (ssid_len)
-@@ -5380,6 +5382,8 @@ static int ipw2100_set_key(struct ipw210
- struct ipw2100_wep_key *wep_key = (void *)cmd.host_command_parameters;
- int err;
-
-+ pax_track_stack();
-+
- IPW_DEBUG_HC("WEP_KEY_INFO: index = %d, len = %d/%d\n",
- idx, keylen, len);
-
-diff -urNp linux-2.6.32.45/drivers/net/wireless/ipw2x00/libipw_rx.c linux-2.6.32.45/drivers/net/wireless/ipw2x00/libipw_rx.c
---- linux-2.6.32.45/drivers/net/wireless/ipw2x00/libipw_rx.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/wireless/ipw2x00/libipw_rx.c 2011-05-16 21:46:57.000000000 -0400
-@@ -1566,6 +1566,8 @@ static void libipw_process_probe_respons
- unsigned long flags;
- DECLARE_SSID_BUF(ssid);
-
-+ pax_track_stack();
-+
- LIBIPW_DEBUG_SCAN("'%s' (%pM"
- "): %c%c%c%c %c%c%c%c-%c%c%c%c %c%c%c%c\n",
- print_ssid(ssid, info_element->data, info_element->len),
-diff -urNp linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-1000.c linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-1000.c
---- linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-1000.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-1000.c 2011-04-17 15:56:46.000000000 -0400
-@@ -137,7 +137,7 @@ static struct iwl_lib_ops iwl1000_lib =
- },
- };
-
--static struct iwl_ops iwl1000_ops = {
-+static const struct iwl_ops iwl1000_ops = {
- .ucode = &iwl5000_ucode,
- .lib = &iwl1000_lib,
- .hcmd = &iwl5000_hcmd,
-diff -urNp linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl3945-base.c linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl3945-base.c
---- linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl3945-base.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl3945-base.c 2011-08-05 20:33:55.000000000 -0400
-@@ -3927,7 +3927,9 @@ static int iwl3945_pci_probe(struct pci_
- */
- if (iwl3945_mod_params.disable_hw_scan) {
- IWL_DEBUG_INFO(priv, "Disabling hw_scan\n");
-- iwl3945_hw_ops.hw_scan = NULL;
-+ pax_open_kernel();
-+ *(void **)&iwl3945_hw_ops.hw_scan = NULL;
-+ pax_close_kernel();
- }
-
-
-diff -urNp linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-3945.c linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-3945.c
---- linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-3945.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-3945.c 2011-04-17 15:56:46.000000000 -0400
-@@ -2874,7 +2874,7 @@ static struct iwl_hcmd_utils_ops iwl3945
- .build_addsta_hcmd = iwl3945_build_addsta_hcmd,
- };
-
--static struct iwl_ops iwl3945_ops = {
-+static const struct iwl_ops iwl3945_ops = {
- .ucode = &iwl3945_ucode,
- .lib = &iwl3945_lib,
- .hcmd = &iwl3945_hcmd,
-diff -urNp linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-4965.c linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-4965.c
---- linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-4965.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-4965.c 2011-04-17 15:56:46.000000000 -0400
-@@ -2345,7 +2345,7 @@ static struct iwl_lib_ops iwl4965_lib =
- },
- };
-
--static struct iwl_ops iwl4965_ops = {
-+static const struct iwl_ops iwl4965_ops = {
- .ucode = &iwl4965_ucode,
- .lib = &iwl4965_lib,
- .hcmd = &iwl4965_hcmd,
-diff -urNp linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-5000.c linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-5000.c
---- linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-5000.c 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-5000.c 2011-06-25 12:56:37.000000000 -0400
-@@ -1633,14 +1633,14 @@ static struct iwl_lib_ops iwl5150_lib =
- },
- };
-
--struct iwl_ops iwl5000_ops = {
-+const struct iwl_ops iwl5000_ops = {
- .ucode = &iwl5000_ucode,
- .lib = &iwl5000_lib,
- .hcmd = &iwl5000_hcmd,
- .utils = &iwl5000_hcmd_utils,
- };
-
--static struct iwl_ops iwl5150_ops = {
-+static const struct iwl_ops iwl5150_ops = {
- .ucode = &iwl5000_ucode,
- .lib = &iwl5150_lib,
- .hcmd = &iwl5000_hcmd,
-diff -urNp linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-6000.c linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-6000.c
---- linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-6000.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-6000.c 2011-04-17 15:56:46.000000000 -0400
-@@ -146,7 +146,7 @@ static struct iwl_hcmd_utils_ops iwl6000
- .calc_rssi = iwl5000_calc_rssi,
- };
-
--static struct iwl_ops iwl6000_ops = {
-+static const struct iwl_ops iwl6000_ops = {
- .ucode = &iwl5000_ucode,
- .lib = &iwl6000_lib,
- .hcmd = &iwl5000_hcmd,
-diff -urNp linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-agn.c linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-agn.c
---- linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-agn.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-agn.c 2011-08-05 20:33:55.000000000 -0400
-@@ -2911,7 +2911,9 @@ static int iwl_pci_probe(struct pci_dev
- if (iwl_debug_level & IWL_DL_INFO)
- dev_printk(KERN_DEBUG, &(pdev->dev),
- "Disabling hw_scan\n");
-- iwl_hw_ops.hw_scan = NULL;
-+ pax_open_kernel();
-+ *(void **)&iwl_hw_ops.hw_scan = NULL;
-+ pax_close_kernel();
- }
-
- hw = iwl_alloc_all(cfg, &iwl_hw_ops);
-diff -urNp linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-agn-rs.c linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
---- linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-agn-rs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-agn-rs.c 2011-05-16 21:46:57.000000000 -0400
-@@ -857,6 +857,8 @@ static void rs_tx_status(void *priv_r, s
- u8 active_index = 0;
- s32 tpt = 0;
-
-+ pax_track_stack();
-+
- IWL_DEBUG_RATE_LIMIT(priv, "get frame ack response, update rate scale window\n");
-
- if (!ieee80211_is_data(hdr->frame_control) ||
-@@ -2722,6 +2724,8 @@ static void rs_fill_link_cmd(struct iwl_
- u8 valid_tx_ant = 0;
- struct iwl_link_quality_cmd *lq_cmd = &lq_sta->lq;
-
-+ pax_track_stack();
-+
- /* Override starting rate (index 0) if needed for debug purposes */
- rs_dbgfs_set_mcs(lq_sta, &new_rate, index);
-
-diff -urNp linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-debugfs.c linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-debugfs.c
---- linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-debugfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-debugfs.c 2011-05-16 21:46:57.000000000 -0400
-@@ -524,6 +524,8 @@ static ssize_t iwl_dbgfs_status_read(str
- int pos = 0;
- const size_t bufsz = sizeof(buf);
-
-+ pax_track_stack();
-+
- pos += scnprintf(buf + pos, bufsz - pos, "STATUS_HCMD_ACTIVE:\t %d\n",
- test_bit(STATUS_HCMD_ACTIVE, &priv->status));
- pos += scnprintf(buf + pos, bufsz - pos, "STATUS_HCMD_SYNC_ACTIVE: %d\n",
-@@ -658,6 +660,8 @@ static ssize_t iwl_dbgfs_qos_read(struct
- const size_t bufsz = sizeof(buf);
- ssize_t ret;
-
-+ pax_track_stack();
-+
- for (i = 0; i < AC_NUM; i++) {
- pos += scnprintf(buf + pos, bufsz - pos,
- "\tcw_min\tcw_max\taifsn\ttxop\n");
-diff -urNp linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-debug.h linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-debug.h
---- linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-debug.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-debug.h 2011-04-17 15:56:46.000000000 -0400
-@@ -118,8 +118,8 @@ void iwl_dbgfs_unregister(struct iwl_pri
- #endif
-
- #else
--#define IWL_DEBUG(__priv, level, fmt, args...)
--#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...)
-+#define IWL_DEBUG(__priv, level, fmt, args...) do {} while (0)
-+#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...) do {} while (0)
- static inline void iwl_print_hex_dump(struct iwl_priv *priv, int level,
- void *p, u32 len)
- {}
-diff -urNp linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-dev.h linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-dev.h
---- linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-dev.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/wireless/iwlwifi/iwl-dev.h 2011-04-17 15:56:46.000000000 -0400
-@@ -68,7 +68,7 @@ struct iwl_tx_queue;
-
- /* shared structures from iwl-5000.c */
- extern struct iwl_mod_params iwl50_mod_params;
--extern struct iwl_ops iwl5000_ops;
-+extern const struct iwl_ops iwl5000_ops;
- extern struct iwl_ucode_ops iwl5000_ucode;
- extern struct iwl_lib_ops iwl5000_lib;
- extern struct iwl_hcmd_ops iwl5000_hcmd;
-diff -urNp linux-2.6.32.45/drivers/net/wireless/iwmc3200wifi/debugfs.c linux-2.6.32.45/drivers/net/wireless/iwmc3200wifi/debugfs.c
---- linux-2.6.32.45/drivers/net/wireless/iwmc3200wifi/debugfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/wireless/iwmc3200wifi/debugfs.c 2011-05-16 21:46:57.000000000 -0400
-@@ -299,6 +299,8 @@ static ssize_t iwm_debugfs_fw_err_read(s
- int buf_len = 512;
- size_t len = 0;
-
-+ pax_track_stack();
-+
- if (*ppos != 0)
- return 0;
- if (count < sizeof(buf))
-diff -urNp linux-2.6.32.45/drivers/net/wireless/libertas/debugfs.c linux-2.6.32.45/drivers/net/wireless/libertas/debugfs.c
---- linux-2.6.32.45/drivers/net/wireless/libertas/debugfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/wireless/libertas/debugfs.c 2011-04-17 15:56:46.000000000 -0400
-@@ -708,7 +708,7 @@ out_unlock:
- struct lbs_debugfs_files {
- const char *name;
- int perm;
-- struct file_operations fops;
-+ const struct file_operations fops;
- };
-
- static const struct lbs_debugfs_files debugfs_files[] = {
-diff -urNp linux-2.6.32.45/drivers/net/wireless/rndis_wlan.c linux-2.6.32.45/drivers/net/wireless/rndis_wlan.c
---- linux-2.6.32.45/drivers/net/wireless/rndis_wlan.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/net/wireless/rndis_wlan.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1176,7 +1176,7 @@ static int set_rts_threshold(struct usbn
-
- devdbg(usbdev, "set_rts_threshold %i", rts_threshold);
-
-- if (rts_threshold < 0 || rts_threshold > 2347)
-+ if (rts_threshold > 2347)
- rts_threshold = 2347;
-
- tmp = cpu_to_le32(rts_threshold);
-diff -urNp linux-2.6.32.45/drivers/oprofile/buffer_sync.c linux-2.6.32.45/drivers/oprofile/buffer_sync.c
---- linux-2.6.32.45/drivers/oprofile/buffer_sync.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/oprofile/buffer_sync.c 2011-04-17 15:56:46.000000000 -0400
-@@ -341,7 +341,7 @@ static void add_data(struct op_entry *en
- if (cookie == NO_COOKIE)
- offset = pc;
- if (cookie == INVALID_COOKIE) {
-- atomic_inc(&oprofile_stats.sample_lost_no_mapping);
-+ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
- offset = pc;
- }
- if (cookie != last_cookie) {
-@@ -385,14 +385,14 @@ add_sample(struct mm_struct *mm, struct
- /* add userspace sample */
-
- if (!mm) {
-- atomic_inc(&oprofile_stats.sample_lost_no_mm);
-+ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mm);
- return 0;
- }
-
- cookie = lookup_dcookie(mm, s->eip, &offset);
-
- if (cookie == INVALID_COOKIE) {
-- atomic_inc(&oprofile_stats.sample_lost_no_mapping);
-+ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
- return 0;
- }
-
-@@ -561,7 +561,7 @@ void sync_buffer(int cpu)
- /* ignore backtraces if failed to add a sample */
- if (state == sb_bt_start) {
- state = sb_bt_ignore;
-- atomic_inc(&oprofile_stats.bt_lost_no_mapping);
-+ atomic_inc_unchecked(&oprofile_stats.bt_lost_no_mapping);
- }
- }
- release_mm(mm);
-diff -urNp linux-2.6.32.45/drivers/oprofile/event_buffer.c linux-2.6.32.45/drivers/oprofile/event_buffer.c
---- linux-2.6.32.45/drivers/oprofile/event_buffer.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/oprofile/event_buffer.c 2011-04-17 15:56:46.000000000 -0400
-@@ -53,7 +53,7 @@ void add_event_entry(unsigned long value
- }
-
- if (buffer_pos == buffer_size) {
-- atomic_inc(&oprofile_stats.event_lost_overflow);
-+ atomic_inc_unchecked(&oprofile_stats.event_lost_overflow);
- return;
- }
-
-diff -urNp linux-2.6.32.45/drivers/oprofile/oprof.c linux-2.6.32.45/drivers/oprofile/oprof.c
---- linux-2.6.32.45/drivers/oprofile/oprof.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/oprofile/oprof.c 2011-04-17 15:56:46.000000000 -0400
-@@ -110,7 +110,7 @@ static void switch_worker(struct work_st
- if (oprofile_ops.switch_events())
- return;
-
-- atomic_inc(&oprofile_stats.multiplex_counter);
-+ atomic_inc_unchecked(&oprofile_stats.multiplex_counter);
- start_switch_worker();
- }
-
-diff -urNp linux-2.6.32.45/drivers/oprofile/oprofilefs.c linux-2.6.32.45/drivers/oprofile/oprofilefs.c
---- linux-2.6.32.45/drivers/oprofile/oprofilefs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/oprofile/oprofilefs.c 2011-04-17 15:56:46.000000000 -0400
-@@ -187,7 +187,7 @@ static const struct file_operations atom
-
-
- int oprofilefs_create_ro_atomic(struct super_block *sb, struct dentry *root,
-- char const *name, atomic_t *val)
-+ char const *name, atomic_unchecked_t *val)
- {
- struct dentry *d = __oprofilefs_create_file(sb, root, name,
- &atomic_ro_fops, 0444);
-diff -urNp linux-2.6.32.45/drivers/oprofile/oprofile_stats.c linux-2.6.32.45/drivers/oprofile/oprofile_stats.c
---- linux-2.6.32.45/drivers/oprofile/oprofile_stats.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/oprofile/oprofile_stats.c 2011-04-17 15:56:46.000000000 -0400
-@@ -30,11 +30,11 @@ void oprofile_reset_stats(void)
- cpu_buf->sample_invalid_eip = 0;
- }
-
-- atomic_set(&oprofile_stats.sample_lost_no_mm, 0);
-- atomic_set(&oprofile_stats.sample_lost_no_mapping, 0);
-- atomic_set(&oprofile_stats.event_lost_overflow, 0);
-- atomic_set(&oprofile_stats.bt_lost_no_mapping, 0);
-- atomic_set(&oprofile_stats.multiplex_counter, 0);
-+ atomic_set_unchecked(&oprofile_stats.sample_lost_no_mm, 0);
-+ atomic_set_unchecked(&oprofile_stats.sample_lost_no_mapping, 0);
-+ atomic_set_unchecked(&oprofile_stats.event_lost_overflow, 0);
-+ atomic_set_unchecked(&oprofile_stats.bt_lost_no_mapping, 0);
-+ atomic_set_unchecked(&oprofile_stats.multiplex_counter, 0);
- }
-
-
-diff -urNp linux-2.6.32.45/drivers/oprofile/oprofile_stats.h linux-2.6.32.45/drivers/oprofile/oprofile_stats.h
---- linux-2.6.32.45/drivers/oprofile/oprofile_stats.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/oprofile/oprofile_stats.h 2011-04-17 15:56:46.000000000 -0400
-@@ -13,11 +13,11 @@
- #include <asm/atomic.h>
-
- struct oprofile_stat_struct {
-- atomic_t sample_lost_no_mm;
-- atomic_t sample_lost_no_mapping;
-- atomic_t bt_lost_no_mapping;
-- atomic_t event_lost_overflow;
-- atomic_t multiplex_counter;
-+ atomic_unchecked_t sample_lost_no_mm;
-+ atomic_unchecked_t sample_lost_no_mapping;
-+ atomic_unchecked_t bt_lost_no_mapping;
-+ atomic_unchecked_t event_lost_overflow;
-+ atomic_unchecked_t multiplex_counter;
- };
-
- extern struct oprofile_stat_struct oprofile_stats;
-diff -urNp linux-2.6.32.45/drivers/parisc/pdc_stable.c linux-2.6.32.45/drivers/parisc/pdc_stable.c
---- linux-2.6.32.45/drivers/parisc/pdc_stable.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/parisc/pdc_stable.c 2011-04-17 15:56:46.000000000 -0400
-@@ -481,7 +481,7 @@ pdcspath_attr_store(struct kobject *kobj
- return ret;
- }
-
--static struct sysfs_ops pdcspath_attr_ops = {
-+static const struct sysfs_ops pdcspath_attr_ops = {
- .show = pdcspath_attr_show,
- .store = pdcspath_attr_store,
- };
-diff -urNp linux-2.6.32.45/drivers/parport/procfs.c linux-2.6.32.45/drivers/parport/procfs.c
---- linux-2.6.32.45/drivers/parport/procfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/parport/procfs.c 2011-04-17 15:56:46.000000000 -0400
-@@ -64,7 +64,7 @@ static int do_active_device(ctl_table *t
-
- *ppos += len;
-
-- return copy_to_user(result, buffer, len) ? -EFAULT : 0;
-+ return (len > sizeof buffer || copy_to_user(result, buffer, len)) ? -EFAULT : 0;
- }
-
- #ifdef CONFIG_PARPORT_1284
-@@ -106,7 +106,7 @@ static int do_autoprobe(ctl_table *table
-
- *ppos += len;
-
-- return copy_to_user (result, buffer, len) ? -EFAULT : 0;
-+ return (len > sizeof buffer || copy_to_user (result, buffer, len)) ? -EFAULT : 0;
- }
- #endif /* IEEE1284.3 support. */
-
-diff -urNp linux-2.6.32.45/drivers/pci/hotplug/acpiphp_glue.c linux-2.6.32.45/drivers/pci/hotplug/acpiphp_glue.c
---- linux-2.6.32.45/drivers/pci/hotplug/acpiphp_glue.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/pci/hotplug/acpiphp_glue.c 2011-04-17 15:56:46.000000000 -0400
-@@ -111,7 +111,7 @@ static int post_dock_fixups(struct notif
- }
-
-
--static struct acpi_dock_ops acpiphp_dock_ops = {
-+static const struct acpi_dock_ops acpiphp_dock_ops = {
- .handler = handle_hotplug_event_func,
- };
-
-diff -urNp linux-2.6.32.45/drivers/pci/hotplug/cpci_hotplug.h linux-2.6.32.45/drivers/pci/hotplug/cpci_hotplug.h
---- linux-2.6.32.45/drivers/pci/hotplug/cpci_hotplug.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/pci/hotplug/cpci_hotplug.h 2011-08-05 20:33:55.000000000 -0400
-@@ -59,7 +59,7 @@ struct cpci_hp_controller_ops {
- int (*hardware_test) (struct slot* slot, u32 value);
- u8 (*get_power) (struct slot* slot);
- int (*set_power) (struct slot* slot, int value);
--};
-+} __no_const;
-
- struct cpci_hp_controller {
- unsigned int irq;
-diff -urNp linux-2.6.32.45/drivers/pci/hotplug/cpqphp_nvram.c linux-2.6.32.45/drivers/pci/hotplug/cpqphp_nvram.c
---- linux-2.6.32.45/drivers/pci/hotplug/cpqphp_nvram.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/pci/hotplug/cpqphp_nvram.c 2011-04-17 15:56:46.000000000 -0400
-@@ -428,9 +428,13 @@ static u32 store_HRT (void __iomem *rom_
-
- void compaq_nvram_init (void __iomem *rom_start)
- {
-+
-+#ifndef CONFIG_PAX_KERNEXEC
- if (rom_start) {
- compaq_int15_entry_point = (rom_start + ROM_INT15_PHY_ADDR - ROM_PHY_ADDR);
- }
-+#endif
-+
- dbg("int15 entry = %p\n", compaq_int15_entry_point);
-
- /* initialize our int15 lock */
-diff -urNp linux-2.6.32.45/drivers/pci/hotplug/fakephp.c linux-2.6.32.45/drivers/pci/hotplug/fakephp.c
---- linux-2.6.32.45/drivers/pci/hotplug/fakephp.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/pci/hotplug/fakephp.c 2011-04-17 15:56:46.000000000 -0400
-@@ -73,7 +73,7 @@ static void legacy_release(struct kobjec
- }
-
- static struct kobj_type legacy_ktype = {
-- .sysfs_ops = &(struct sysfs_ops){
-+ .sysfs_ops = &(const struct sysfs_ops){
- .store = legacy_store, .show = legacy_show
- },
- .release = &legacy_release,
-diff -urNp linux-2.6.32.45/drivers/pci/intel-iommu.c linux-2.6.32.45/drivers/pci/intel-iommu.c
---- linux-2.6.32.45/drivers/pci/intel-iommu.c 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.45/drivers/pci/intel-iommu.c 2011-05-10 22:12:33.000000000 -0400
-@@ -2643,7 +2643,7 @@ error:
- return 0;
- }
-
--static dma_addr_t intel_map_page(struct device *dev, struct page *page,
-+dma_addr_t intel_map_page(struct device *dev, struct page *page,
- unsigned long offset, size_t size,
- enum dma_data_direction dir,
- struct dma_attrs *attrs)
-@@ -2719,7 +2719,7 @@ static void add_unmap(struct dmar_domain
- spin_unlock_irqrestore(&async_umap_flush_lock, flags);
- }
-
--static void intel_unmap_page(struct device *dev, dma_addr_t dev_addr,
-+void intel_unmap_page(struct device *dev, dma_addr_t dev_addr,
- size_t size, enum dma_data_direction dir,
- struct dma_attrs *attrs)
- {
-@@ -2768,7 +2768,7 @@ static void intel_unmap_page(struct devi
- }
- }
-
--static void *intel_alloc_coherent(struct device *hwdev, size_t size,
-+void *intel_alloc_coherent(struct device *hwdev, size_t size,
- dma_addr_t *dma_handle, gfp_t flags)
- {
- void *vaddr;
-@@ -2800,7 +2800,7 @@ static void *intel_alloc_coherent(struct
- return NULL;
- }
-
--static void intel_free_coherent(struct device *hwdev, size_t size, void *vaddr,
-+void intel_free_coherent(struct device *hwdev, size_t size, void *vaddr,
- dma_addr_t dma_handle)
- {
- int order;
-@@ -2812,7 +2812,7 @@ static void intel_free_coherent(struct d
- free_pages((unsigned long)vaddr, order);
- }
-
--static void intel_unmap_sg(struct device *hwdev, struct scatterlist *sglist,
-+void intel_unmap_sg(struct device *hwdev, struct scatterlist *sglist,
- int nelems, enum dma_data_direction dir,
- struct dma_attrs *attrs)
- {
-@@ -2872,7 +2872,7 @@ static int intel_nontranslate_map_sg(str
- return nelems;
- }
-
--static int intel_map_sg(struct device *hwdev, struct scatterlist *sglist, int nelems,
-+int intel_map_sg(struct device *hwdev, struct scatterlist *sglist, int nelems,
- enum dma_data_direction dir, struct dma_attrs *attrs)
- {
- int i;
-@@ -2941,12 +2941,12 @@ static int intel_map_sg(struct device *h
- return nelems;
- }
-
--static int intel_mapping_error(struct device *dev, dma_addr_t dma_addr)
-+int intel_mapping_error(struct device *dev, dma_addr_t dma_addr)
- {
- return !dma_addr;
- }
-
--struct dma_map_ops intel_dma_ops = {
-+const struct dma_map_ops intel_dma_ops = {
- .alloc_coherent = intel_alloc_coherent,
- .free_coherent = intel_free_coherent,
- .map_sg = intel_map_sg,
-diff -urNp linux-2.6.32.45/drivers/pci/pcie/aspm.c linux-2.6.32.45/drivers/pci/pcie/aspm.c
---- linux-2.6.32.45/drivers/pci/pcie/aspm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/pci/pcie/aspm.c 2011-04-17 15:56:46.000000000 -0400
-@@ -27,9 +27,9 @@
- #define MODULE_PARAM_PREFIX "pcie_aspm."
-
- /* Note: those are not register definitions */
--#define ASPM_STATE_L0S_UP (1) /* Upstream direction L0s state */
--#define ASPM_STATE_L0S_DW (2) /* Downstream direction L0s state */
--#define ASPM_STATE_L1 (4) /* L1 state */
-+#define ASPM_STATE_L0S_UP (1U) /* Upstream direction L0s state */
-+#define ASPM_STATE_L0S_DW (2U) /* Downstream direction L0s state */
-+#define ASPM_STATE_L1 (4U) /* L1 state */
- #define ASPM_STATE_L0S (ASPM_STATE_L0S_UP | ASPM_STATE_L0S_DW)
- #define ASPM_STATE_ALL (ASPM_STATE_L0S | ASPM_STATE_L1)
-
-diff -urNp linux-2.6.32.45/drivers/pci/probe.c linux-2.6.32.45/drivers/pci/probe.c
---- linux-2.6.32.45/drivers/pci/probe.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/pci/probe.c 2011-04-17 15:56:46.000000000 -0400
-@@ -62,14 +62,14 @@ static ssize_t pci_bus_show_cpuaffinity(
- return ret;
- }
-
--static ssize_t inline pci_bus_show_cpumaskaffinity(struct device *dev,
-+static inline ssize_t pci_bus_show_cpumaskaffinity(struct device *dev,
- struct device_attribute *attr,
- char *buf)
- {
- return pci_bus_show_cpuaffinity(dev, 0, attr, buf);
- }
-
--static ssize_t inline pci_bus_show_cpulistaffinity(struct device *dev,
-+static inline ssize_t pci_bus_show_cpulistaffinity(struct device *dev,
- struct device_attribute *attr,
- char *buf)
- {
-diff -urNp linux-2.6.32.45/drivers/pci/proc.c linux-2.6.32.45/drivers/pci/proc.c
---- linux-2.6.32.45/drivers/pci/proc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/pci/proc.c 2011-04-17 15:56:46.000000000 -0400
-@@ -480,7 +480,16 @@ static const struct file_operations proc
- static int __init pci_proc_init(void)
- {
- struct pci_dev *dev = NULL;
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+ proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR, NULL);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
-+#endif
-+#else
- proc_bus_pci_dir = proc_mkdir("bus/pci", NULL);
-+#endif
- proc_create("devices", 0, proc_bus_pci_dir,
- &proc_bus_pci_dev_operations);
- proc_initialized = 1;
-diff -urNp linux-2.6.32.45/drivers/pci/slot.c linux-2.6.32.45/drivers/pci/slot.c
---- linux-2.6.32.45/drivers/pci/slot.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/pci/slot.c 2011-04-17 15:56:46.000000000 -0400
-@@ -29,7 +29,7 @@ static ssize_t pci_slot_attr_store(struc
- return attribute->store ? attribute->store(slot, buf, len) : -EIO;
- }
-
--static struct sysfs_ops pci_slot_sysfs_ops = {
-+static const struct sysfs_ops pci_slot_sysfs_ops = {
- .show = pci_slot_attr_show,
- .store = pci_slot_attr_store,
- };
-diff -urNp linux-2.6.32.45/drivers/pcmcia/pcmcia_ioctl.c linux-2.6.32.45/drivers/pcmcia/pcmcia_ioctl.c
---- linux-2.6.32.45/drivers/pcmcia/pcmcia_ioctl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/pcmcia/pcmcia_ioctl.c 2011-04-17 15:56:46.000000000 -0400
-@@ -819,7 +819,7 @@ static int ds_ioctl(struct inode * inode
- return -EFAULT;
- }
- }
-- buf = kmalloc(sizeof(ds_ioctl_arg_t), GFP_KERNEL);
-+ buf = kzalloc(sizeof(ds_ioctl_arg_t), GFP_KERNEL);
- if (!buf)
- return -ENOMEM;
-
-diff -urNp linux-2.6.32.45/drivers/platform/x86/acer-wmi.c linux-2.6.32.45/drivers/platform/x86/acer-wmi.c
---- linux-2.6.32.45/drivers/platform/x86/acer-wmi.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/platform/x86/acer-wmi.c 2011-04-17 15:56:46.000000000 -0400
-@@ -918,7 +918,7 @@ static int update_bl_status(struct backl
- return 0;
- }
-
--static struct backlight_ops acer_bl_ops = {
-+static const struct backlight_ops acer_bl_ops = {
- .get_brightness = read_brightness,
- .update_status = update_bl_status,
- };
-diff -urNp linux-2.6.32.45/drivers/platform/x86/asus_acpi.c linux-2.6.32.45/drivers/platform/x86/asus_acpi.c
---- linux-2.6.32.45/drivers/platform/x86/asus_acpi.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/platform/x86/asus_acpi.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1396,7 +1396,7 @@ static int asus_hotk_remove(struct acpi_
- return 0;
- }
-
--static struct backlight_ops asus_backlight_data = {
-+static const struct backlight_ops asus_backlight_data = {
- .get_brightness = read_brightness,
- .update_status = set_brightness_status,
- };
-diff -urNp linux-2.6.32.45/drivers/platform/x86/asus-laptop.c linux-2.6.32.45/drivers/platform/x86/asus-laptop.c
---- linux-2.6.32.45/drivers/platform/x86/asus-laptop.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/platform/x86/asus-laptop.c 2011-04-17 15:56:46.000000000 -0400
-@@ -250,7 +250,7 @@ static struct backlight_device *asus_bac
- */
- static int read_brightness(struct backlight_device *bd);
- static int update_bl_status(struct backlight_device *bd);
--static struct backlight_ops asusbl_ops = {
-+static const struct backlight_ops asusbl_ops = {
- .get_brightness = read_brightness,
- .update_status = update_bl_status,
- };
-diff -urNp linux-2.6.32.45/drivers/platform/x86/compal-laptop.c linux-2.6.32.45/drivers/platform/x86/compal-laptop.c
---- linux-2.6.32.45/drivers/platform/x86/compal-laptop.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/platform/x86/compal-laptop.c 2011-04-17 15:56:46.000000000 -0400
-@@ -163,7 +163,7 @@ static int bl_update_status(struct backl
- return set_lcd_level(b->props.brightness);
- }
-
--static struct backlight_ops compalbl_ops = {
-+static const struct backlight_ops compalbl_ops = {
- .get_brightness = bl_get_brightness,
- .update_status = bl_update_status,
- };
-diff -urNp linux-2.6.32.45/drivers/platform/x86/dell-laptop.c linux-2.6.32.45/drivers/platform/x86/dell-laptop.c
---- linux-2.6.32.45/drivers/platform/x86/dell-laptop.c 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.45/drivers/platform/x86/dell-laptop.c 2011-05-10 22:12:33.000000000 -0400
-@@ -318,7 +318,7 @@ static int dell_get_intensity(struct bac
- return buffer.output[1];
- }
-
--static struct backlight_ops dell_ops = {
-+static const struct backlight_ops dell_ops = {
- .get_brightness = dell_get_intensity,
- .update_status = dell_send_intensity,
- };
-diff -urNp linux-2.6.32.45/drivers/platform/x86/eeepc-laptop.c linux-2.6.32.45/drivers/platform/x86/eeepc-laptop.c
---- linux-2.6.32.45/drivers/platform/x86/eeepc-laptop.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/platform/x86/eeepc-laptop.c 2011-04-17 15:56:46.000000000 -0400
-@@ -245,7 +245,7 @@ static struct device *eeepc_hwmon_device
- */
- static int read_brightness(struct backlight_device *bd);
- static int update_bl_status(struct backlight_device *bd);
--static struct backlight_ops eeepcbl_ops = {
-+static const struct backlight_ops eeepcbl_ops = {
- .get_brightness = read_brightness,
- .update_status = update_bl_status,
- };
-diff -urNp linux-2.6.32.45/drivers/platform/x86/fujitsu-laptop.c linux-2.6.32.45/drivers/platform/x86/fujitsu-laptop.c
---- linux-2.6.32.45/drivers/platform/x86/fujitsu-laptop.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/platform/x86/fujitsu-laptop.c 2011-04-17 15:56:46.000000000 -0400
-@@ -436,7 +436,7 @@ static int bl_update_status(struct backl
- return ret;
- }
-
--static struct backlight_ops fujitsubl_ops = {
-+static const struct backlight_ops fujitsubl_ops = {
- .get_brightness = bl_get_brightness,
- .update_status = bl_update_status,
- };
-diff -urNp linux-2.6.32.45/drivers/platform/x86/msi-laptop.c linux-2.6.32.45/drivers/platform/x86/msi-laptop.c
---- linux-2.6.32.45/drivers/platform/x86/msi-laptop.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/platform/x86/msi-laptop.c 2011-04-17 15:56:46.000000000 -0400
-@@ -161,7 +161,7 @@ static int bl_update_status(struct backl
- return set_lcd_level(b->props.brightness);
- }
-
--static struct backlight_ops msibl_ops = {
-+static const struct backlight_ops msibl_ops = {
- .get_brightness = bl_get_brightness,
- .update_status = bl_update_status,
- };
-diff -urNp linux-2.6.32.45/drivers/platform/x86/panasonic-laptop.c linux-2.6.32.45/drivers/platform/x86/panasonic-laptop.c
---- linux-2.6.32.45/drivers/platform/x86/panasonic-laptop.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/platform/x86/panasonic-laptop.c 2011-04-17 15:56:46.000000000 -0400
-@@ -352,7 +352,7 @@ static int bl_set_status(struct backligh
- return acpi_pcc_write_sset(pcc, SINF_DC_CUR_BRIGHT, bright);
- }
-
--static struct backlight_ops pcc_backlight_ops = {
-+static const struct backlight_ops pcc_backlight_ops = {
- .get_brightness = bl_get,
- .update_status = bl_set_status,
- };
-diff -urNp linux-2.6.32.45/drivers/platform/x86/sony-laptop.c linux-2.6.32.45/drivers/platform/x86/sony-laptop.c
---- linux-2.6.32.45/drivers/platform/x86/sony-laptop.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/platform/x86/sony-laptop.c 2011-04-17 15:56:46.000000000 -0400
-@@ -850,7 +850,7 @@ static int sony_backlight_get_brightness
- }
-
- static struct backlight_device *sony_backlight_device;
--static struct backlight_ops sony_backlight_ops = {
-+static const struct backlight_ops sony_backlight_ops = {
- .update_status = sony_backlight_update_status,
- .get_brightness = sony_backlight_get_brightness,
- };
-diff -urNp linux-2.6.32.45/drivers/platform/x86/thinkpad_acpi.c linux-2.6.32.45/drivers/platform/x86/thinkpad_acpi.c
---- linux-2.6.32.45/drivers/platform/x86/thinkpad_acpi.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/platform/x86/thinkpad_acpi.c 2011-08-05 20:33:55.000000000 -0400
-@@ -2137,7 +2137,7 @@ static int hotkey_mask_get(void)
- return 0;
- }
-
--void static hotkey_mask_warn_incomplete_mask(void)
-+static void hotkey_mask_warn_incomplete_mask(void)
- {
- /* log only what the user can fix... */
- const u32 wantedmask = hotkey_driver_mask &
-@@ -6122,7 +6122,7 @@ static void tpacpi_brightness_notify_cha
- BACKLIGHT_UPDATE_HOTKEY);
- }
-
--static struct backlight_ops ibm_backlight_data = {
-+static const struct backlight_ops ibm_backlight_data = {
- .get_brightness = brightness_get,
- .update_status = brightness_update_status,
- };
-diff -urNp linux-2.6.32.45/drivers/platform/x86/toshiba_acpi.c linux-2.6.32.45/drivers/platform/x86/toshiba_acpi.c
---- linux-2.6.32.45/drivers/platform/x86/toshiba_acpi.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/platform/x86/toshiba_acpi.c 2011-04-17 15:56:46.000000000 -0400
-@@ -671,7 +671,7 @@ static acpi_status remove_device(void)
- return AE_OK;
- }
-
--static struct backlight_ops toshiba_backlight_data = {
-+static const struct backlight_ops toshiba_backlight_data = {
- .get_brightness = get_lcd,
- .update_status = set_lcd_status,
- };
-diff -urNp linux-2.6.32.45/drivers/pnp/pnpbios/bioscalls.c linux-2.6.32.45/drivers/pnp/pnpbios/bioscalls.c
---- linux-2.6.32.45/drivers/pnp/pnpbios/bioscalls.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/pnp/pnpbios/bioscalls.c 2011-04-17 15:56:46.000000000 -0400
-@@ -60,7 +60,7 @@ do { \
- set_desc_limit(&gdt[(selname) >> 3], (size) - 1); \
- } while(0)
-
--static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
-+static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
- (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
-
- /*
-@@ -97,7 +97,10 @@ static inline u16 call_pnp_bios(u16 func
-
- cpu = get_cpu();
- save_desc_40 = get_cpu_gdt_table(cpu)[0x40 / 8];
-+
-+ pax_open_kernel();
- get_cpu_gdt_table(cpu)[0x40 / 8] = bad_bios_desc;
-+ pax_close_kernel();
-
- /* On some boxes IRQ's during PnP BIOS calls are deadly. */
- spin_lock_irqsave(&pnp_bios_lock, flags);
-@@ -135,7 +138,10 @@ static inline u16 call_pnp_bios(u16 func
- :"memory");
- spin_unlock_irqrestore(&pnp_bios_lock, flags);
-
-+ pax_open_kernel();
- get_cpu_gdt_table(cpu)[0x40 / 8] = save_desc_40;
-+ pax_close_kernel();
-+
- put_cpu();
-
- /* If we get here and this is set then the PnP BIOS faulted on us. */
-@@ -469,7 +475,7 @@ int pnp_bios_read_escd(char *data, u32 n
- return status;
- }
-
--void pnpbios_calls_init(union pnp_bios_install_struct *header)
-+void __init pnpbios_calls_init(union pnp_bios_install_struct *header)
- {
- int i;
-
-@@ -477,6 +483,8 @@ void pnpbios_calls_init(union pnp_bios_i
- pnp_bios_callpoint.offset = header->fields.pm16offset;
- pnp_bios_callpoint.segment = PNP_CS16;
-
-+ pax_open_kernel();
-+
- for_each_possible_cpu(i) {
- struct desc_struct *gdt = get_cpu_gdt_table(i);
- if (!gdt)
-@@ -488,4 +496,6 @@ void pnpbios_calls_init(union pnp_bios_i
- set_desc_base(&gdt[GDT_ENTRY_PNPBIOS_DS],
- (unsigned long)__va(header->fields.pm16dseg));
- }
-+
-+ pax_close_kernel();
- }
-diff -urNp linux-2.6.32.45/drivers/pnp/resource.c linux-2.6.32.45/drivers/pnp/resource.c
---- linux-2.6.32.45/drivers/pnp/resource.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/pnp/resource.c 2011-04-17 15:56:46.000000000 -0400
-@@ -355,7 +355,7 @@ int pnp_check_irq(struct pnp_dev *dev, s
- return 1;
-
- /* check if the resource is valid */
-- if (*irq < 0 || *irq > 15)
-+ if (*irq > 15)
- return 0;
-
- /* check if the resource is reserved */
-@@ -419,7 +419,7 @@ int pnp_check_dma(struct pnp_dev *dev, s
- return 1;
-
- /* check if the resource is valid */
-- if (*dma < 0 || *dma == 4 || *dma > 7)
-+ if (*dma == 4 || *dma > 7)
- return 0;
-
- /* check if the resource is reserved */
-diff -urNp linux-2.6.32.45/drivers/power/bq27x00_battery.c linux-2.6.32.45/drivers/power/bq27x00_battery.c
---- linux-2.6.32.45/drivers/power/bq27x00_battery.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/power/bq27x00_battery.c 2011-08-05 20:33:55.000000000 -0400
-@@ -44,7 +44,7 @@ struct bq27x00_device_info;
- struct bq27x00_access_methods {
- int (*read)(u8 reg, int *rt_value, int b_single,
- struct bq27x00_device_info *di);
--};
-+} __no_const;
-
- struct bq27x00_device_info {
- struct device *dev;
-diff -urNp linux-2.6.32.45/drivers/rtc/rtc-dev.c linux-2.6.32.45/drivers/rtc/rtc-dev.c
---- linux-2.6.32.45/drivers/rtc/rtc-dev.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/rtc/rtc-dev.c 2011-04-17 15:56:46.000000000 -0400
-@@ -14,6 +14,7 @@
- #include <linux/module.h>
- #include <linux/rtc.h>
- #include <linux/sched.h>
-+#include <linux/grsecurity.h>
- #include "rtc-core.h"
-
- static dev_t rtc_devt;
-@@ -357,6 +358,8 @@ static long rtc_dev_ioctl(struct file *f
- if (copy_from_user(&tm, uarg, sizeof(tm)))
- return -EFAULT;
-
-+ gr_log_timechange();
-+
- return rtc_set_time(rtc, &tm);
-
- case RTC_PIE_ON:
-diff -urNp linux-2.6.32.45/drivers/s390/cio/qdio_perf.c linux-2.6.32.45/drivers/s390/cio/qdio_perf.c
---- linux-2.6.32.45/drivers/s390/cio/qdio_perf.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/s390/cio/qdio_perf.c 2011-04-17 15:56:46.000000000 -0400
-@@ -31,51 +31,51 @@ static struct proc_dir_entry *qdio_perf_
- static int qdio_perf_proc_show(struct seq_file *m, void *v)
- {
- seq_printf(m, "Number of qdio interrupts\t\t\t: %li\n",
-- (long)atomic_long_read(&perf_stats.qdio_int));
-+ (long)atomic_long_read_unchecked(&perf_stats.qdio_int));
- seq_printf(m, "Number of PCI interrupts\t\t\t: %li\n",
-- (long)atomic_long_read(&perf_stats.pci_int));
-+ (long)atomic_long_read_unchecked(&perf_stats.pci_int));
- seq_printf(m, "Number of adapter interrupts\t\t\t: %li\n",
-- (long)atomic_long_read(&perf_stats.thin_int));
-+ (long)atomic_long_read_unchecked(&perf_stats.thin_int));
- seq_printf(m, "\n");
- seq_printf(m, "Inbound tasklet runs\t\t\t\t: %li\n",
-- (long)atomic_long_read(&perf_stats.tasklet_inbound));
-+ (long)atomic_long_read_unchecked(&perf_stats.tasklet_inbound));
- seq_printf(m, "Outbound tasklet runs\t\t\t\t: %li\n",
-- (long)atomic_long_read(&perf_stats.tasklet_outbound));
-+ (long)atomic_long_read_unchecked(&perf_stats.tasklet_outbound));
- seq_printf(m, "Adapter interrupt tasklet runs/loops\t\t: %li/%li\n",
-- (long)atomic_long_read(&perf_stats.tasklet_thinint),
-- (long)atomic_long_read(&perf_stats.tasklet_thinint_loop));
-+ (long)atomic_long_read_unchecked(&perf_stats.tasklet_thinint),
-+ (long)atomic_long_read_unchecked(&perf_stats.tasklet_thinint_loop));
- seq_printf(m, "Adapter interrupt inbound tasklet runs/loops\t: %li/%li\n",
-- (long)atomic_long_read(&perf_stats.thinint_inbound),
-- (long)atomic_long_read(&perf_stats.thinint_inbound_loop));
-+ (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound),
-+ (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound_loop));
- seq_printf(m, "\n");
- seq_printf(m, "Number of SIGA In issued\t\t\t: %li\n",
-- (long)atomic_long_read(&perf_stats.siga_in));
-+ (long)atomic_long_read_unchecked(&perf_stats.siga_in));
- seq_printf(m, "Number of SIGA Out issued\t\t\t: %li\n",
-- (long)atomic_long_read(&perf_stats.siga_out));
-+ (long)atomic_long_read_unchecked(&perf_stats.siga_out));
- seq_printf(m, "Number of SIGA Sync issued\t\t\t: %li\n",
-- (long)atomic_long_read(&perf_stats.siga_sync));
-+ (long)atomic_long_read_unchecked(&perf_stats.siga_sync));
- seq_printf(m, "\n");
- seq_printf(m, "Number of inbound transfers\t\t\t: %li\n",
-- (long)atomic_long_read(&perf_stats.inbound_handler));
-+ (long)atomic_long_read_unchecked(&perf_stats.inbound_handler));
- seq_printf(m, "Number of outbound transfers\t\t\t: %li\n",
-- (long)atomic_long_read(&perf_stats.outbound_handler));
-+ (long)atomic_long_read_unchecked(&perf_stats.outbound_handler));
- seq_printf(m, "\n");
- seq_printf(m, "Number of fast requeues (outg. SBAL w/o SIGA)\t: %li\n",
-- (long)atomic_long_read(&perf_stats.fast_requeue));
-+ (long)atomic_long_read_unchecked(&perf_stats.fast_requeue));
- seq_printf(m, "Number of outbound target full condition\t: %li\n",
-- (long)atomic_long_read(&perf_stats.outbound_target_full));
-+ (long)atomic_long_read_unchecked(&perf_stats.outbound_target_full));
- seq_printf(m, "Number of outbound tasklet mod_timer calls\t: %li\n",
-- (long)atomic_long_read(&perf_stats.debug_tl_out_timer));
-+ (long)atomic_long_read_unchecked(&perf_stats.debug_tl_out_timer));
- seq_printf(m, "Number of stop polling calls\t\t\t: %li\n",
-- (long)atomic_long_read(&perf_stats.debug_stop_polling));
-+ (long)atomic_long_read_unchecked(&perf_stats.debug_stop_polling));
- seq_printf(m, "AI inbound tasklet loops after stop polling\t: %li\n",
-- (long)atomic_long_read(&perf_stats.thinint_inbound_loop2));
-+ (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound_loop2));
- seq_printf(m, "QEBSM EQBS total/incomplete\t\t\t: %li/%li\n",
-- (long)atomic_long_read(&perf_stats.debug_eqbs_all),
-- (long)atomic_long_read(&perf_stats.debug_eqbs_incomplete));
-+ (long)atomic_long_read_unchecked(&perf_stats.debug_eqbs_all),
-+ (long)atomic_long_read_unchecked(&perf_stats.debug_eqbs_incomplete));
- seq_printf(m, "QEBSM SQBS total/incomplete\t\t\t: %li/%li\n",
-- (long)atomic_long_read(&perf_stats.debug_sqbs_all),
-- (long)atomic_long_read(&perf_stats.debug_sqbs_incomplete));
-+ (long)atomic_long_read_unchecked(&perf_stats.debug_sqbs_all),
-+ (long)atomic_long_read_unchecked(&perf_stats.debug_sqbs_incomplete));
- seq_printf(m, "\n");
- return 0;
- }
-diff -urNp linux-2.6.32.45/drivers/s390/cio/qdio_perf.h linux-2.6.32.45/drivers/s390/cio/qdio_perf.h
---- linux-2.6.32.45/drivers/s390/cio/qdio_perf.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/s390/cio/qdio_perf.h 2011-04-17 15:56:46.000000000 -0400
-@@ -13,46 +13,46 @@
-
- struct qdio_perf_stats {
- /* interrupt handler calls */
-- atomic_long_t qdio_int;
-- atomic_long_t pci_int;
-- atomic_long_t thin_int;
-+ atomic_long_unchecked_t qdio_int;
-+ atomic_long_unchecked_t pci_int;
-+ atomic_long_unchecked_t thin_int;
-
- /* tasklet runs */
-- atomic_long_t tasklet_inbound;
-- atomic_long_t tasklet_outbound;
-- atomic_long_t tasklet_thinint;
-- atomic_long_t tasklet_thinint_loop;
-- atomic_long_t thinint_inbound;
-- atomic_long_t thinint_inbound_loop;
-- atomic_long_t thinint_inbound_loop2;
-+ atomic_long_unchecked_t tasklet_inbound;
-+ atomic_long_unchecked_t tasklet_outbound;
-+ atomic_long_unchecked_t tasklet_thinint;
-+ atomic_long_unchecked_t tasklet_thinint_loop;
-+ atomic_long_unchecked_t thinint_inbound;
-+ atomic_long_unchecked_t thinint_inbound_loop;
-+ atomic_long_unchecked_t thinint_inbound_loop2;
-
- /* signal adapter calls */
-- atomic_long_t siga_out;
-- atomic_long_t siga_in;
-- atomic_long_t siga_sync;
-+ atomic_long_unchecked_t siga_out;
-+ atomic_long_unchecked_t siga_in;
-+ atomic_long_unchecked_t siga_sync;
-
- /* misc */
-- atomic_long_t inbound_handler;
-- atomic_long_t outbound_handler;
-- atomic_long_t fast_requeue;
-- atomic_long_t outbound_target_full;
-+ atomic_long_unchecked_t inbound_handler;
-+ atomic_long_unchecked_t outbound_handler;
-+ atomic_long_unchecked_t fast_requeue;
-+ atomic_long_unchecked_t outbound_target_full;
-
- /* for debugging */
-- atomic_long_t debug_tl_out_timer;
-- atomic_long_t debug_stop_polling;
-- atomic_long_t debug_eqbs_all;
-- atomic_long_t debug_eqbs_incomplete;
-- atomic_long_t debug_sqbs_all;
-- atomic_long_t debug_sqbs_incomplete;
-+ atomic_long_unchecked_t debug_tl_out_timer;
-+ atomic_long_unchecked_t debug_stop_polling;
-+ atomic_long_unchecked_t debug_eqbs_all;
-+ atomic_long_unchecked_t debug_eqbs_incomplete;
-+ atomic_long_unchecked_t debug_sqbs_all;
-+ atomic_long_unchecked_t debug_sqbs_incomplete;
- };
-
- extern struct qdio_perf_stats perf_stats;
- extern int qdio_performance_stats;
-
--static inline void qdio_perf_stat_inc(atomic_long_t *count)
-+static inline void qdio_perf_stat_inc(atomic_long_unchecked_t *count)
- {
- if (qdio_performance_stats)
-- atomic_long_inc(count);
-+ atomic_long_inc_unchecked(count);
- }
-
- int qdio_setup_perf_stats(void);
-diff -urNp linux-2.6.32.45/drivers/scsi/aacraid/aacraid.h linux-2.6.32.45/drivers/scsi/aacraid/aacraid.h
---- linux-2.6.32.45/drivers/scsi/aacraid/aacraid.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/aacraid/aacraid.h 2011-08-05 20:33:55.000000000 -0400
-@@ -471,7 +471,7 @@ struct adapter_ops
- int (*adapter_scsi)(struct fib * fib, struct scsi_cmnd * cmd);
- /* Administrative operations */
- int (*adapter_comm)(struct aac_dev * dev, int comm);
--};
-+} __no_const;
-
- /*
- * Define which interrupt handler needs to be installed
-diff -urNp linux-2.6.32.45/drivers/scsi/aacraid/commctrl.c linux-2.6.32.45/drivers/scsi/aacraid/commctrl.c
---- linux-2.6.32.45/drivers/scsi/aacraid/commctrl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/aacraid/commctrl.c 2011-05-16 21:46:57.000000000 -0400
-@@ -481,6 +481,7 @@ static int aac_send_raw_srb(struct aac_d
- u32 actual_fibsize64, actual_fibsize = 0;
- int i;
-
-+ pax_track_stack();
-
- if (dev->in_reset) {
- dprintk((KERN_DEBUG"aacraid: send raw srb -EBUSY\n"));
-diff -urNp linux-2.6.32.45/drivers/scsi/aic94xx/aic94xx_init.c linux-2.6.32.45/drivers/scsi/aic94xx/aic94xx_init.c
---- linux-2.6.32.45/drivers/scsi/aic94xx/aic94xx_init.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/aic94xx/aic94xx_init.c 2011-04-17 15:56:46.000000000 -0400
-@@ -485,7 +485,7 @@ static ssize_t asd_show_update_bios(stru
- flash_error_table[i].reason);
- }
-
--static DEVICE_ATTR(update_bios, S_IRUGO|S_IWUGO,
-+static DEVICE_ATTR(update_bios, S_IRUGO|S_IWUSR,
- asd_show_update_bios, asd_store_update_bios);
-
- static int asd_create_dev_attrs(struct asd_ha_struct *asd_ha)
-diff -urNp linux-2.6.32.45/drivers/scsi/bfa/bfa_iocfc.h linux-2.6.32.45/drivers/scsi/bfa/bfa_iocfc.h
---- linux-2.6.32.45/drivers/scsi/bfa/bfa_iocfc.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/bfa/bfa_iocfc.h 2011-08-05 20:33:55.000000000 -0400
-@@ -61,7 +61,7 @@ struct bfa_hwif_s {
- void (*hw_isr_mode_set)(struct bfa_s *bfa, bfa_boolean_t msix);
- void (*hw_msix_getvecs)(struct bfa_s *bfa, u32 *vecmap,
- u32 *nvecs, u32 *maxvec);
--};
-+} __no_const;
- typedef void (*bfa_cb_iocfc_t) (void *cbarg, enum bfa_status status);
-
- struct bfa_iocfc_s {
-diff -urNp linux-2.6.32.45/drivers/scsi/bfa/bfa_ioc.h linux-2.6.32.45/drivers/scsi/bfa/bfa_ioc.h
---- linux-2.6.32.45/drivers/scsi/bfa/bfa_ioc.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/bfa/bfa_ioc.h 2011-08-05 20:33:55.000000000 -0400
-@@ -127,7 +127,7 @@ struct bfa_ioc_cbfn_s {
- bfa_ioc_disable_cbfn_t disable_cbfn;
- bfa_ioc_hbfail_cbfn_t hbfail_cbfn;
- bfa_ioc_reset_cbfn_t reset_cbfn;
--};
-+} __no_const;
-
- /**
- * Heartbeat failure notification queue element.
-diff -urNp linux-2.6.32.45/drivers/scsi/BusLogic.c linux-2.6.32.45/drivers/scsi/BusLogic.c
---- linux-2.6.32.45/drivers/scsi/BusLogic.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/BusLogic.c 2011-05-16 21:46:57.000000000 -0400
-@@ -961,6 +961,8 @@ static int __init BusLogic_InitializeFla
- static void __init BusLogic_InitializeProbeInfoList(struct BusLogic_HostAdapter
- *PrototypeHostAdapter)
- {
-+ pax_track_stack();
-+
- /*
- If a PCI BIOS is present, interrogate it for MultiMaster and FlashPoint
- Host Adapters; otherwise, default to the standard ISA MultiMaster probe.
-diff -urNp linux-2.6.32.45/drivers/scsi/dpt_i2o.c linux-2.6.32.45/drivers/scsi/dpt_i2o.c
---- linux-2.6.32.45/drivers/scsi/dpt_i2o.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/dpt_i2o.c 2011-05-16 21:46:57.000000000 -0400
-@@ -1804,6 +1804,8 @@ static int adpt_i2o_passthru(adpt_hba* p
- dma_addr_t addr;
- ulong flags = 0;
-
-+ pax_track_stack();
-+
- memset(&msg, 0, MAX_MESSAGE_SIZE*4);
- // get user msg size in u32s
- if(get_user(size, &user_msg[0])){
-@@ -2297,6 +2299,8 @@ static s32 adpt_scsi_to_i2o(adpt_hba* pH
- s32 rcode;
- dma_addr_t addr;
-
-+ pax_track_stack();
-+
- memset(msg, 0 , sizeof(msg));
- len = scsi_bufflen(cmd);
- direction = 0x00000000;
-diff -urNp linux-2.6.32.45/drivers/scsi/eata.c linux-2.6.32.45/drivers/scsi/eata.c
---- linux-2.6.32.45/drivers/scsi/eata.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/eata.c 2011-05-16 21:46:57.000000000 -0400
-@@ -1087,6 +1087,8 @@ static int port_detect(unsigned long por
- struct hostdata *ha;
- char name[16];
-
-+ pax_track_stack();
-+
- sprintf(name, "%s%d", driver_name, j);
-
- if (!request_region(port_base, REGION_SIZE, driver_name)) {
-diff -urNp linux-2.6.32.45/drivers/scsi/fcoe/libfcoe.c linux-2.6.32.45/drivers/scsi/fcoe/libfcoe.c
---- linux-2.6.32.45/drivers/scsi/fcoe/libfcoe.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/fcoe/libfcoe.c 2011-05-16 21:46:57.000000000 -0400
-@@ -809,6 +809,8 @@ static void fcoe_ctlr_recv_els(struct fc
- size_t rlen;
- size_t dlen;
-
-+ pax_track_stack();
-+
- fiph = (struct fip_header *)skb->data;
- sub = fiph->fip_subcode;
- if (sub != FIP_SC_REQ && sub != FIP_SC_REP)
-diff -urNp linux-2.6.32.45/drivers/scsi/fnic/fnic_main.c linux-2.6.32.45/drivers/scsi/fnic/fnic_main.c
---- linux-2.6.32.45/drivers/scsi/fnic/fnic_main.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/fnic/fnic_main.c 2011-08-05 20:33:55.000000000 -0400
-@@ -669,7 +669,7 @@ static int __devinit fnic_probe(struct p
- /* Start local port initiatialization */
-
- lp->link_up = 0;
-- lp->tt = fnic_transport_template;
-+ memcpy((void *)&lp->tt, &fnic_transport_template, sizeof(fnic_transport_template));
-
- lp->max_retry_count = fnic->config.flogi_retries;
- lp->max_rport_retry_count = fnic->config.plogi_retries;
-diff -urNp linux-2.6.32.45/drivers/scsi/gdth.c linux-2.6.32.45/drivers/scsi/gdth.c
---- linux-2.6.32.45/drivers/scsi/gdth.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/gdth.c 2011-05-16 21:46:57.000000000 -0400
-@@ -4102,6 +4102,8 @@ static int ioc_lockdrv(void __user *arg)
- ulong flags;
- gdth_ha_str *ha;
-
-+ pax_track_stack();
-+
- if (copy_from_user(&ldrv, arg, sizeof(gdth_ioctl_lockdrv)))
- return -EFAULT;
- ha = gdth_find_ha(ldrv.ionode);
-@@ -4134,6 +4136,8 @@ static int ioc_resetdrv(void __user *arg
- gdth_ha_str *ha;
- int rval;
-
-+ pax_track_stack();
-+
- if (copy_from_user(&res, arg, sizeof(gdth_ioctl_reset)) ||
- res.number >= MAX_HDRIVES)
- return -EFAULT;
-@@ -4169,6 +4173,8 @@ static int ioc_general(void __user *arg,
- gdth_ha_str *ha;
- int rval;
-
-+ pax_track_stack();
-+
- if (copy_from_user(&gen, arg, sizeof(gdth_ioctl_general)))
- return -EFAULT;
- ha = gdth_find_ha(gen.ionode);
-@@ -4625,6 +4631,9 @@ static void gdth_flush(gdth_ha_str *ha)
- int i;
- gdth_cmd_str gdtcmd;
- char cmnd[MAX_COMMAND_SIZE];
-+
-+ pax_track_stack();
-+
- memset(cmnd, 0xff, MAX_COMMAND_SIZE);
-
- TRACE2(("gdth_flush() hanum %d\n", ha->hanum));
-diff -urNp linux-2.6.32.45/drivers/scsi/gdth_proc.c linux-2.6.32.45/drivers/scsi/gdth_proc.c
---- linux-2.6.32.45/drivers/scsi/gdth_proc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/gdth_proc.c 2011-05-16 21:46:57.000000000 -0400
-@@ -46,6 +46,9 @@ static int gdth_set_asc_info(struct Scsi
- ulong64 paddr;
-
- char cmnd[MAX_COMMAND_SIZE];
-+
-+ pax_track_stack();
-+
- memset(cmnd, 0xff, 12);
- memset(&gdtcmd, 0, sizeof(gdth_cmd_str));
-
-@@ -174,6 +177,8 @@ static int gdth_get_info(char *buffer,ch
- gdth_hget_str *phg;
- char cmnd[MAX_COMMAND_SIZE];
-
-+ pax_track_stack();
-+
- gdtcmd = kmalloc(sizeof(*gdtcmd), GFP_KERNEL);
- estr = kmalloc(sizeof(*estr), GFP_KERNEL);
- if (!gdtcmd || !estr)
-diff -urNp linux-2.6.32.45/drivers/scsi/hosts.c linux-2.6.32.45/drivers/scsi/hosts.c
---- linux-2.6.32.45/drivers/scsi/hosts.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/hosts.c 2011-05-04 17:56:28.000000000 -0400
-@@ -40,7 +40,7 @@
- #include "scsi_logging.h"
-
-
--static atomic_t scsi_host_next_hn; /* host_no for next new host */
-+static atomic_unchecked_t scsi_host_next_hn; /* host_no for next new host */
-
-
- static void scsi_host_cls_release(struct device *dev)
-@@ -344,7 +344,7 @@ struct Scsi_Host *scsi_host_alloc(struct
- * subtract one because we increment first then return, but we need to
- * know what the next host number was before increment
- */
-- shost->host_no = atomic_inc_return(&scsi_host_next_hn) - 1;
-+ shost->host_no = atomic_inc_return_unchecked(&scsi_host_next_hn) - 1;
- shost->dma_channel = 0xff;
-
- /* These three are default values which can be overridden */
-diff -urNp linux-2.6.32.45/drivers/scsi/ipr.c linux-2.6.32.45/drivers/scsi/ipr.c
---- linux-2.6.32.45/drivers/scsi/ipr.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/ipr.c 2011-04-17 15:56:46.000000000 -0400
-@@ -5286,7 +5286,7 @@ static bool ipr_qc_fill_rtf(struct ata_q
- return true;
- }
-
--static struct ata_port_operations ipr_sata_ops = {
-+static const struct ata_port_operations ipr_sata_ops = {
- .phy_reset = ipr_ata_phy_reset,
- .hardreset = ipr_sata_reset,
- .post_internal_cmd = ipr_ata_post_internal,
-diff -urNp linux-2.6.32.45/drivers/scsi/ips.h linux-2.6.32.45/drivers/scsi/ips.h
---- linux-2.6.32.45/drivers/scsi/ips.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/ips.h 2011-08-05 20:33:55.000000000 -0400
-@@ -1027,7 +1027,7 @@ typedef struct {
- int (*intr)(struct ips_ha *);
- void (*enableint)(struct ips_ha *);
- uint32_t (*statupd)(struct ips_ha *);
--} ips_hw_func_t;
-+} __no_const ips_hw_func_t;
-
- typedef struct ips_ha {
- uint8_t ha_id[IPS_MAX_CHANNELS+1];
-diff -urNp linux-2.6.32.45/drivers/scsi/libfc/fc_disc.c linux-2.6.32.45/drivers/scsi/libfc/fc_disc.c
---- linux-2.6.32.45/drivers/scsi/libfc/fc_disc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/libfc/fc_disc.c 2011-08-05 20:33:55.000000000 -0400
-@@ -715,16 +715,16 @@ int fc_disc_init(struct fc_lport *lport)
- struct fc_disc *disc;
-
- if (!lport->tt.disc_start)
-- lport->tt.disc_start = fc_disc_start;
-+ *(void **)&lport->tt.disc_start = fc_disc_start;
-
- if (!lport->tt.disc_stop)
-- lport->tt.disc_stop = fc_disc_stop;
-+ *(void **)&lport->tt.disc_stop = fc_disc_stop;
-
- if (!lport->tt.disc_stop_final)
-- lport->tt.disc_stop_final = fc_disc_stop_final;
-+ *(void **)&lport->tt.disc_stop_final = fc_disc_stop_final;
-
- if (!lport->tt.disc_recv_req)
-- lport->tt.disc_recv_req = fc_disc_recv_req;
-+ *(void **)&lport->tt.disc_recv_req = fc_disc_recv_req;
-
- disc = &lport->disc;
- INIT_DELAYED_WORK(&disc->disc_work, fc_disc_timeout);
-diff -urNp linux-2.6.32.45/drivers/scsi/libfc/fc_elsct.c linux-2.6.32.45/drivers/scsi/libfc/fc_elsct.c
---- linux-2.6.32.45/drivers/scsi/libfc/fc_elsct.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/libfc/fc_elsct.c 2011-08-05 20:33:55.000000000 -0400
-@@ -67,7 +67,7 @@ static struct fc_seq *fc_elsct_send(stru
- int fc_elsct_init(struct fc_lport *lport)
- {
- if (!lport->tt.elsct_send)
-- lport->tt.elsct_send = fc_elsct_send;
-+ *(void **)&lport->tt.elsct_send = fc_elsct_send;
-
- return 0;
- }
-diff -urNp linux-2.6.32.45/drivers/scsi/libfc/fc_exch.c linux-2.6.32.45/drivers/scsi/libfc/fc_exch.c
---- linux-2.6.32.45/drivers/scsi/libfc/fc_exch.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/libfc/fc_exch.c 2011-08-05 20:33:55.000000000 -0400
-@@ -86,12 +86,12 @@ struct fc_exch_mgr {
- * all together if not used XXX
- */
- struct {
-- atomic_t no_free_exch;
-- atomic_t no_free_exch_xid;
-- atomic_t xid_not_found;
-- atomic_t xid_busy;
-- atomic_t seq_not_found;
-- atomic_t non_bls_resp;
-+ atomic_unchecked_t no_free_exch;
-+ atomic_unchecked_t no_free_exch_xid;
-+ atomic_unchecked_t xid_not_found;
-+ atomic_unchecked_t xid_busy;
-+ atomic_unchecked_t seq_not_found;
-+ atomic_unchecked_t non_bls_resp;
- } stats;
- };
- #define fc_seq_exch(sp) container_of(sp, struct fc_exch, seq)
-@@ -510,7 +510,7 @@ static struct fc_exch *fc_exch_em_alloc(
- /* allocate memory for exchange */
- ep = mempool_alloc(mp->ep_pool, GFP_ATOMIC);
- if (!ep) {
-- atomic_inc(&mp->stats.no_free_exch);
-+ atomic_inc_unchecked(&mp->stats.no_free_exch);
- goto out;
- }
- memset(ep, 0, sizeof(*ep));
-@@ -557,7 +557,7 @@ out:
- return ep;
- err:
- spin_unlock_bh(&pool->lock);
-- atomic_inc(&mp->stats.no_free_exch_xid);
-+ atomic_inc_unchecked(&mp->stats.no_free_exch_xid);
- mempool_free(ep, mp->ep_pool);
- return NULL;
- }
-@@ -690,7 +690,7 @@ static enum fc_pf_rjt_reason fc_seq_look
- xid = ntohs(fh->fh_ox_id); /* we originated exch */
- ep = fc_exch_find(mp, xid);
- if (!ep) {
-- atomic_inc(&mp->stats.xid_not_found);
-+ atomic_inc_unchecked(&mp->stats.xid_not_found);
- reject = FC_RJT_OX_ID;
- goto out;
- }
-@@ -720,7 +720,7 @@ static enum fc_pf_rjt_reason fc_seq_look
- ep = fc_exch_find(mp, xid);
- if ((f_ctl & FC_FC_FIRST_SEQ) && fc_sof_is_init(fr_sof(fp))) {
- if (ep) {
-- atomic_inc(&mp->stats.xid_busy);
-+ atomic_inc_unchecked(&mp->stats.xid_busy);
- reject = FC_RJT_RX_ID;
- goto rel;
- }
-@@ -731,7 +731,7 @@ static enum fc_pf_rjt_reason fc_seq_look
- }
- xid = ep->xid; /* get our XID */
- } else if (!ep) {
-- atomic_inc(&mp->stats.xid_not_found);
-+ atomic_inc_unchecked(&mp->stats.xid_not_found);
- reject = FC_RJT_RX_ID; /* XID not found */
- goto out;
- }
-@@ -752,7 +752,7 @@ static enum fc_pf_rjt_reason fc_seq_look
- } else {
- sp = &ep->seq;
- if (sp->id != fh->fh_seq_id) {
-- atomic_inc(&mp->stats.seq_not_found);
-+ atomic_inc_unchecked(&mp->stats.seq_not_found);
- reject = FC_RJT_SEQ_ID; /* sequence/exch should exist */
- goto rel;
- }
-@@ -1163,22 +1163,22 @@ static void fc_exch_recv_seq_resp(struct
-
- ep = fc_exch_find(mp, ntohs(fh->fh_ox_id));
- if (!ep) {
-- atomic_inc(&mp->stats.xid_not_found);
-+ atomic_inc_unchecked(&mp->stats.xid_not_found);
- goto out;
- }
- if (ep->esb_stat & ESB_ST_COMPLETE) {
-- atomic_inc(&mp->stats.xid_not_found);
-+ atomic_inc_unchecked(&mp->stats.xid_not_found);
- goto out;
- }
- if (ep->rxid == FC_XID_UNKNOWN)
- ep->rxid = ntohs(fh->fh_rx_id);
- if (ep->sid != 0 && ep->sid != ntoh24(fh->fh_d_id)) {
-- atomic_inc(&mp->stats.xid_not_found);
-+ atomic_inc_unchecked(&mp->stats.xid_not_found);
- goto rel;
- }
- if (ep->did != ntoh24(fh->fh_s_id) &&
- ep->did != FC_FID_FLOGI) {
-- atomic_inc(&mp->stats.xid_not_found);
-+ atomic_inc_unchecked(&mp->stats.xid_not_found);
- goto rel;
- }
- sof = fr_sof(fp);
-@@ -1189,7 +1189,7 @@ static void fc_exch_recv_seq_resp(struct
- } else {
- sp = &ep->seq;
- if (sp->id != fh->fh_seq_id) {
-- atomic_inc(&mp->stats.seq_not_found);
-+ atomic_inc_unchecked(&mp->stats.seq_not_found);
- goto rel;
- }
- }
-@@ -1249,9 +1249,9 @@ static void fc_exch_recv_resp(struct fc_
- sp = fc_seq_lookup_orig(mp, fp); /* doesn't hold sequence */
-
- if (!sp)
-- atomic_inc(&mp->stats.xid_not_found);
-+ atomic_inc_unchecked(&mp->stats.xid_not_found);
- else
-- atomic_inc(&mp->stats.non_bls_resp);
-+ atomic_inc_unchecked(&mp->stats.non_bls_resp);
-
- fc_frame_free(fp);
- }
-@@ -2027,25 +2027,25 @@ EXPORT_SYMBOL(fc_exch_recv);
- int fc_exch_init(struct fc_lport *lp)
- {
- if (!lp->tt.seq_start_next)
-- lp->tt.seq_start_next = fc_seq_start_next;
-+ *(void **)&lp->tt.seq_start_next = fc_seq_start_next;
-
- if (!lp->tt.exch_seq_send)
-- lp->tt.exch_seq_send = fc_exch_seq_send;
-+ *(void **)&lp->tt.exch_seq_send = fc_exch_seq_send;
-
- if (!lp->tt.seq_send)
-- lp->tt.seq_send = fc_seq_send;
-+ *(void **)&lp->tt.seq_send = fc_seq_send;
-
- if (!lp->tt.seq_els_rsp_send)
-- lp->tt.seq_els_rsp_send = fc_seq_els_rsp_send;
-+ *(void **)&lp->tt.seq_els_rsp_send = fc_seq_els_rsp_send;
-
- if (!lp->tt.exch_done)
-- lp->tt.exch_done = fc_exch_done;
-+ *(void **)&lp->tt.exch_done = fc_exch_done;
-
- if (!lp->tt.exch_mgr_reset)
-- lp->tt.exch_mgr_reset = fc_exch_mgr_reset;
-+ *(void **)&lp->tt.exch_mgr_reset = fc_exch_mgr_reset;
-
- if (!lp->tt.seq_exch_abort)
-- lp->tt.seq_exch_abort = fc_seq_exch_abort;
-+ *(void **)&lp->tt.seq_exch_abort = fc_seq_exch_abort;
-
- /*
- * Initialize fc_cpu_mask and fc_cpu_order. The
-diff -urNp linux-2.6.32.45/drivers/scsi/libfc/fc_fcp.c linux-2.6.32.45/drivers/scsi/libfc/fc_fcp.c
---- linux-2.6.32.45/drivers/scsi/libfc/fc_fcp.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/libfc/fc_fcp.c 2011-08-05 20:33:55.000000000 -0400
-@@ -2105,13 +2105,13 @@ int fc_fcp_init(struct fc_lport *lp)
- struct fc_fcp_internal *si;
-
- if (!lp->tt.fcp_cmd_send)
-- lp->tt.fcp_cmd_send = fc_fcp_cmd_send;
-+ *(void **)&lp->tt.fcp_cmd_send = fc_fcp_cmd_send;
-
- if (!lp->tt.fcp_cleanup)
-- lp->tt.fcp_cleanup = fc_fcp_cleanup;
-+ *(void **)&lp->tt.fcp_cleanup = fc_fcp_cleanup;
-
- if (!lp->tt.fcp_abort_io)
-- lp->tt.fcp_abort_io = fc_fcp_abort_io;
-+ *(void **)&lp->tt.fcp_abort_io = fc_fcp_abort_io;
-
- si = kzalloc(sizeof(struct fc_fcp_internal), GFP_KERNEL);
- if (!si)
-diff -urNp linux-2.6.32.45/drivers/scsi/libfc/fc_lport.c linux-2.6.32.45/drivers/scsi/libfc/fc_lport.c
---- linux-2.6.32.45/drivers/scsi/libfc/fc_lport.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/libfc/fc_lport.c 2011-08-05 20:33:55.000000000 -0400
-@@ -569,7 +569,7 @@ int fc_lport_destroy(struct fc_lport *lp
- mutex_lock(&lport->lp_mutex);
- lport->state = LPORT_ST_DISABLED;
- lport->link_up = 0;
-- lport->tt.frame_send = fc_frame_drop;
-+ *(void **)&lport->tt.frame_send = fc_frame_drop;
- mutex_unlock(&lport->lp_mutex);
-
- lport->tt.fcp_abort_io(lport);
-@@ -1477,10 +1477,10 @@ EXPORT_SYMBOL(fc_lport_config);
- int fc_lport_init(struct fc_lport *lport)
- {
- if (!lport->tt.lport_recv)
-- lport->tt.lport_recv = fc_lport_recv_req;
-+ *(void **)&lport->tt.lport_recv = fc_lport_recv_req;
-
- if (!lport->tt.lport_reset)
-- lport->tt.lport_reset = fc_lport_reset;
-+ *(void **)&lport->tt.lport_reset = fc_lport_reset;
-
- fc_host_port_type(lport->host) = FC_PORTTYPE_NPORT;
- fc_host_node_name(lport->host) = lport->wwnn;
-diff -urNp linux-2.6.32.45/drivers/scsi/libfc/fc_rport.c linux-2.6.32.45/drivers/scsi/libfc/fc_rport.c
---- linux-2.6.32.45/drivers/scsi/libfc/fc_rport.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/libfc/fc_rport.c 2011-08-05 20:33:55.000000000 -0400
-@@ -1566,25 +1566,25 @@ static void fc_rport_flush_queue(void)
- int fc_rport_init(struct fc_lport *lport)
- {
- if (!lport->tt.rport_lookup)
-- lport->tt.rport_lookup = fc_rport_lookup;
-+ *(void **)&lport->tt.rport_lookup = fc_rport_lookup;
-
- if (!lport->tt.rport_create)
-- lport->tt.rport_create = fc_rport_create;
-+ *(void **)&lport->tt.rport_create = fc_rport_create;
-
- if (!lport->tt.rport_login)
-- lport->tt.rport_login = fc_rport_login;
-+ *(void **)&lport->tt.rport_login = fc_rport_login;
-
- if (!lport->tt.rport_logoff)
-- lport->tt.rport_logoff = fc_rport_logoff;
-+ *(void **)&lport->tt.rport_logoff = fc_rport_logoff;
-
- if (!lport->tt.rport_recv_req)
-- lport->tt.rport_recv_req = fc_rport_recv_req;
-+ *(void **)&lport->tt.rport_recv_req = fc_rport_recv_req;
-
- if (!lport->tt.rport_flush_queue)
-- lport->tt.rport_flush_queue = fc_rport_flush_queue;
-+ *(void **)&lport->tt.rport_flush_queue = fc_rport_flush_queue;
-
- if (!lport->tt.rport_destroy)
-- lport->tt.rport_destroy = fc_rport_destroy;
-+ *(void **)&lport->tt.rport_destroy = fc_rport_destroy;
-
- return 0;
- }
-diff -urNp linux-2.6.32.45/drivers/scsi/libsas/sas_ata.c linux-2.6.32.45/drivers/scsi/libsas/sas_ata.c
---- linux-2.6.32.45/drivers/scsi/libsas/sas_ata.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/libsas/sas_ata.c 2011-04-23 12:56:11.000000000 -0400
-@@ -343,7 +343,7 @@ static int sas_ata_scr_read(struct ata_l
- }
- }
-
--static struct ata_port_operations sas_sata_ops = {
-+static const struct ata_port_operations sas_sata_ops = {
- .phy_reset = sas_ata_phy_reset,
- .post_internal_cmd = sas_ata_post_internal,
- .qc_defer = ata_std_qc_defer,
-diff -urNp linux-2.6.32.45/drivers/scsi/lpfc/lpfc_debugfs.c linux-2.6.32.45/drivers/scsi/lpfc/lpfc_debugfs.c
---- linux-2.6.32.45/drivers/scsi/lpfc/lpfc_debugfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/lpfc/lpfc_debugfs.c 2011-05-16 21:46:57.000000000 -0400
-@@ -124,7 +124,7 @@ struct lpfc_debug {
- int len;
- };
-
--static atomic_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
-+static atomic_unchecked_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
- static unsigned long lpfc_debugfs_start_time = 0L;
-
- /**
-@@ -158,7 +158,7 @@ lpfc_debugfs_disc_trc_data(struct lpfc_v
- lpfc_debugfs_enable = 0;
-
- len = 0;
-- index = (atomic_read(&vport->disc_trc_cnt) + 1) &
-+ index = (atomic_read_unchecked(&vport->disc_trc_cnt) + 1) &
- (lpfc_debugfs_max_disc_trc - 1);
- for (i = index; i < lpfc_debugfs_max_disc_trc; i++) {
- dtp = vport->disc_trc + i;
-@@ -219,7 +219,7 @@ lpfc_debugfs_slow_ring_trc_data(struct l
- lpfc_debugfs_enable = 0;
-
- len = 0;
-- index = (atomic_read(&phba->slow_ring_trc_cnt) + 1) &
-+ index = (atomic_read_unchecked(&phba->slow_ring_trc_cnt) + 1) &
- (lpfc_debugfs_max_slow_ring_trc - 1);
- for (i = index; i < lpfc_debugfs_max_slow_ring_trc; i++) {
- dtp = phba->slow_ring_trc + i;
-@@ -397,6 +397,8 @@ lpfc_debugfs_dumpHBASlim_data(struct lpf
- uint32_t *ptr;
- char buffer[1024];
-
-+ pax_track_stack();
-+
- off = 0;
- spin_lock_irq(&phba->hbalock);
-
-@@ -634,14 +636,14 @@ lpfc_debugfs_disc_trc(struct lpfc_vport
- !vport || !vport->disc_trc)
- return;
-
-- index = atomic_inc_return(&vport->disc_trc_cnt) &
-+ index = atomic_inc_return_unchecked(&vport->disc_trc_cnt) &
- (lpfc_debugfs_max_disc_trc - 1);
- dtp = vport->disc_trc + index;
- dtp->fmt = fmt;
- dtp->data1 = data1;
- dtp->data2 = data2;
- dtp->data3 = data3;
-- dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
-+ dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
- dtp->jif = jiffies;
- #endif
- return;
-@@ -672,14 +674,14 @@ lpfc_debugfs_slow_ring_trc(struct lpfc_h
- !phba || !phba->slow_ring_trc)
- return;
-
-- index = atomic_inc_return(&phba->slow_ring_trc_cnt) &
-+ index = atomic_inc_return_unchecked(&phba->slow_ring_trc_cnt) &
- (lpfc_debugfs_max_slow_ring_trc - 1);
- dtp = phba->slow_ring_trc + index;
- dtp->fmt = fmt;
- dtp->data1 = data1;
- dtp->data2 = data2;
- dtp->data3 = data3;
-- dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
-+ dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
- dtp->jif = jiffies;
- #endif
- return;
-@@ -1364,7 +1366,7 @@ lpfc_debugfs_initialize(struct lpfc_vpor
- "slow_ring buffer\n");
- goto debug_failed;
- }
-- atomic_set(&phba->slow_ring_trc_cnt, 0);
-+ atomic_set_unchecked(&phba->slow_ring_trc_cnt, 0);
- memset(phba->slow_ring_trc, 0,
- (sizeof(struct lpfc_debugfs_trc) *
- lpfc_debugfs_max_slow_ring_trc));
-@@ -1410,7 +1412,7 @@ lpfc_debugfs_initialize(struct lpfc_vpor
- "buffer\n");
- goto debug_failed;
- }
-- atomic_set(&vport->disc_trc_cnt, 0);
-+ atomic_set_unchecked(&vport->disc_trc_cnt, 0);
-
- snprintf(name, sizeof(name), "discovery_trace");
- vport->debug_disc_trc =
-diff -urNp linux-2.6.32.45/drivers/scsi/lpfc/lpfc.h linux-2.6.32.45/drivers/scsi/lpfc/lpfc.h
---- linux-2.6.32.45/drivers/scsi/lpfc/lpfc.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/lpfc/lpfc.h 2011-05-04 17:56:28.000000000 -0400
-@@ -400,7 +400,7 @@ struct lpfc_vport {
- struct dentry *debug_nodelist;
- struct dentry *vport_debugfs_root;
- struct lpfc_debugfs_trc *disc_trc;
-- atomic_t disc_trc_cnt;
-+ atomic_unchecked_t disc_trc_cnt;
- #endif
- uint8_t stat_data_enabled;
- uint8_t stat_data_blocked;
-@@ -725,8 +725,8 @@ struct lpfc_hba {
- struct timer_list fabric_block_timer;
- unsigned long bit_flags;
- #define FABRIC_COMANDS_BLOCKED 0
-- atomic_t num_rsrc_err;
-- atomic_t num_cmd_success;
-+ atomic_unchecked_t num_rsrc_err;
-+ atomic_unchecked_t num_cmd_success;
- unsigned long last_rsrc_error_time;
- unsigned long last_ramp_down_time;
- unsigned long last_ramp_up_time;
-@@ -740,7 +740,7 @@ struct lpfc_hba {
- struct dentry *debug_dumpDif; /* BlockGuard BPL*/
- struct dentry *debug_slow_ring_trc;
- struct lpfc_debugfs_trc *slow_ring_trc;
-- atomic_t slow_ring_trc_cnt;
-+ atomic_unchecked_t slow_ring_trc_cnt;
- #endif
-
- /* Used for deferred freeing of ELS data buffers */
-diff -urNp linux-2.6.32.45/drivers/scsi/lpfc/lpfc_init.c linux-2.6.32.45/drivers/scsi/lpfc/lpfc_init.c
---- linux-2.6.32.45/drivers/scsi/lpfc/lpfc_init.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/lpfc/lpfc_init.c 2011-08-05 20:33:55.000000000 -0400
-@@ -8021,8 +8021,10 @@ lpfc_init(void)
- printk(LPFC_COPYRIGHT "\n");
-
- if (lpfc_enable_npiv) {
-- lpfc_transport_functions.vport_create = lpfc_vport_create;
-- lpfc_transport_functions.vport_delete = lpfc_vport_delete;
-+ pax_open_kernel();
-+ *(void **)&lpfc_transport_functions.vport_create = lpfc_vport_create;
-+ *(void **)&lpfc_transport_functions.vport_delete = lpfc_vport_delete;
-+ pax_close_kernel();
- }
- lpfc_transport_template =
- fc_attach_transport(&lpfc_transport_functions);
-diff -urNp linux-2.6.32.45/drivers/scsi/lpfc/lpfc_scsi.c linux-2.6.32.45/drivers/scsi/lpfc/lpfc_scsi.c
---- linux-2.6.32.45/drivers/scsi/lpfc/lpfc_scsi.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/lpfc/lpfc_scsi.c 2011-05-04 17:56:28.000000000 -0400
-@@ -259,7 +259,7 @@ lpfc_rampdown_queue_depth(struct lpfc_hb
- uint32_t evt_posted;
-
- spin_lock_irqsave(&phba->hbalock, flags);
-- atomic_inc(&phba->num_rsrc_err);
-+ atomic_inc_unchecked(&phba->num_rsrc_err);
- phba->last_rsrc_error_time = jiffies;
-
- if ((phba->last_ramp_down_time + QUEUE_RAMP_DOWN_INTERVAL) > jiffies) {
-@@ -300,7 +300,7 @@ lpfc_rampup_queue_depth(struct lpfc_vpor
- unsigned long flags;
- struct lpfc_hba *phba = vport->phba;
- uint32_t evt_posted;
-- atomic_inc(&phba->num_cmd_success);
-+ atomic_inc_unchecked(&phba->num_cmd_success);
-
- if (vport->cfg_lun_queue_depth <= queue_depth)
- return;
-@@ -343,8 +343,8 @@ lpfc_ramp_down_queue_handler(struct lpfc
- int i;
- struct lpfc_rport_data *rdata;
-
-- num_rsrc_err = atomic_read(&phba->num_rsrc_err);
-- num_cmd_success = atomic_read(&phba->num_cmd_success);
-+ num_rsrc_err = atomic_read_unchecked(&phba->num_rsrc_err);
-+ num_cmd_success = atomic_read_unchecked(&phba->num_cmd_success);
-
- vports = lpfc_create_vport_work_array(phba);
- if (vports != NULL)
-@@ -378,8 +378,8 @@ lpfc_ramp_down_queue_handler(struct lpfc
- }
- }
- lpfc_destroy_vport_work_array(phba, vports);
-- atomic_set(&phba->num_rsrc_err, 0);
-- atomic_set(&phba->num_cmd_success, 0);
-+ atomic_set_unchecked(&phba->num_rsrc_err, 0);
-+ atomic_set_unchecked(&phba->num_cmd_success, 0);
- }
-
- /**
-@@ -427,8 +427,8 @@ lpfc_ramp_up_queue_handler(struct lpfc_h
- }
- }
- lpfc_destroy_vport_work_array(phba, vports);
-- atomic_set(&phba->num_rsrc_err, 0);
-- atomic_set(&phba->num_cmd_success, 0);
-+ atomic_set_unchecked(&phba->num_rsrc_err, 0);
-+ atomic_set_unchecked(&phba->num_cmd_success, 0);
- }
-
- /**
-diff -urNp linux-2.6.32.45/drivers/scsi/megaraid/megaraid_mbox.c linux-2.6.32.45/drivers/scsi/megaraid/megaraid_mbox.c
---- linux-2.6.32.45/drivers/scsi/megaraid/megaraid_mbox.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/megaraid/megaraid_mbox.c 2011-05-16 21:46:57.000000000 -0400
-@@ -3503,6 +3503,8 @@ megaraid_cmm_register(adapter_t *adapter
- int rval;
- int i;
-
-+ pax_track_stack();
-+
- // Allocate memory for the base list of scb for management module.
- adapter->uscb_list = kcalloc(MBOX_MAX_USER_CMDS, sizeof(scb_t), GFP_KERNEL);
-
-diff -urNp linux-2.6.32.45/drivers/scsi/osd/osd_initiator.c linux-2.6.32.45/drivers/scsi/osd/osd_initiator.c
---- linux-2.6.32.45/drivers/scsi/osd/osd_initiator.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/osd/osd_initiator.c 2011-05-16 21:46:57.000000000 -0400
-@@ -94,6 +94,8 @@ static int _osd_print_system_info(struct
- int nelem = ARRAY_SIZE(get_attrs), a = 0;
- int ret;
-
-+ pax_track_stack();
-+
- or = osd_start_request(od, GFP_KERNEL);
- if (!or)
- return -ENOMEM;
-diff -urNp linux-2.6.32.45/drivers/scsi/pmcraid.c linux-2.6.32.45/drivers/scsi/pmcraid.c
---- linux-2.6.32.45/drivers/scsi/pmcraid.c 2011-08-09 18:35:29.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/pmcraid.c 2011-08-09 18:33:59.000000000 -0400
-@@ -189,8 +189,8 @@ static int pmcraid_slave_alloc(struct sc
- res->scsi_dev = scsi_dev;
- scsi_dev->hostdata = res;
- res->change_detected = 0;
-- atomic_set(&res->read_failures, 0);
-- atomic_set(&res->write_failures, 0);
-+ atomic_set_unchecked(&res->read_failures, 0);
-+ atomic_set_unchecked(&res->write_failures, 0);
- rc = 0;
- }
- spin_unlock_irqrestore(&pinstance->resource_lock, lock_flags);
-@@ -2396,9 +2396,9 @@ static int pmcraid_error_handler(struct
-
- /* If this was a SCSI read/write command keep count of errors */
- if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_READ_CMD)
-- atomic_inc(&res->read_failures);
-+ atomic_inc_unchecked(&res->read_failures);
- else if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_WRITE_CMD)
-- atomic_inc(&res->write_failures);
-+ atomic_inc_unchecked(&res->write_failures);
-
- if (!RES_IS_GSCSI(res->cfg_entry) &&
- masked_ioasc != PMCRAID_IOASC_HW_DEVICE_BUS_STATUS_ERROR) {
-@@ -4116,7 +4116,7 @@ static void pmcraid_worker_function(stru
-
- pinstance = container_of(workp, struct pmcraid_instance, worker_q);
- /* add resources only after host is added into system */
-- if (!atomic_read(&pinstance->expose_resources))
-+ if (!atomic_read_unchecked(&pinstance->expose_resources))
- return;
-
- spin_lock_irqsave(&pinstance->resource_lock, lock_flags);
-@@ -4850,7 +4850,7 @@ static int __devinit pmcraid_init_instan
- init_waitqueue_head(&pinstance->reset_wait_q);
-
- atomic_set(&pinstance->outstanding_cmds, 0);
-- atomic_set(&pinstance->expose_resources, 0);
-+ atomic_set_unchecked(&pinstance->expose_resources, 0);
-
- INIT_LIST_HEAD(&pinstance->free_res_q);
- INIT_LIST_HEAD(&pinstance->used_res_q);
-@@ -5502,7 +5502,7 @@ static int __devinit pmcraid_probe(
- /* Schedule worker thread to handle CCN and take care of adding and
- * removing devices to OS
- */
-- atomic_set(&pinstance->expose_resources, 1);
-+ atomic_set_unchecked(&pinstance->expose_resources, 1);
- schedule_work(&pinstance->worker_q);
- return rc;
-
-diff -urNp linux-2.6.32.45/drivers/scsi/pmcraid.h linux-2.6.32.45/drivers/scsi/pmcraid.h
---- linux-2.6.32.45/drivers/scsi/pmcraid.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/pmcraid.h 2011-05-04 17:56:28.000000000 -0400
-@@ -690,7 +690,7 @@ struct pmcraid_instance {
- atomic_t outstanding_cmds;
-
- /* should add/delete resources to mid-layer now ?*/
-- atomic_t expose_resources;
-+ atomic_unchecked_t expose_resources;
-
- /* Tasklet to handle deferred processing */
- struct tasklet_struct isr_tasklet[PMCRAID_NUM_MSIX_VECTORS];
-@@ -727,8 +727,8 @@ struct pmcraid_resource_entry {
- struct list_head queue; /* link to "to be exposed" resources */
- struct pmcraid_config_table_entry cfg_entry;
- struct scsi_device *scsi_dev; /* Link scsi_device structure */
-- atomic_t read_failures; /* count of failed READ commands */
-- atomic_t write_failures; /* count of failed WRITE commands */
-+ atomic_unchecked_t read_failures; /* count of failed READ commands */
-+ atomic_unchecked_t write_failures; /* count of failed WRITE commands */
-
- /* To indicate add/delete/modify during CCN */
- u8 change_detected;
-diff -urNp linux-2.6.32.45/drivers/scsi/qla2xxx/qla_def.h linux-2.6.32.45/drivers/scsi/qla2xxx/qla_def.h
---- linux-2.6.32.45/drivers/scsi/qla2xxx/qla_def.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/qla2xxx/qla_def.h 2011-08-05 20:33:55.000000000 -0400
-@@ -2089,7 +2089,7 @@ struct isp_operations {
-
- int (*get_flash_version) (struct scsi_qla_host *, void *);
- int (*start_scsi) (srb_t *);
--};
-+} __no_const;
-
- /* MSI-X Support *************************************************************/
-
-diff -urNp linux-2.6.32.45/drivers/scsi/qla4xxx/ql4_def.h linux-2.6.32.45/drivers/scsi/qla4xxx/ql4_def.h
---- linux-2.6.32.45/drivers/scsi/qla4xxx/ql4_def.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/qla4xxx/ql4_def.h 2011-05-04 17:56:28.000000000 -0400
-@@ -240,7 +240,7 @@ struct ddb_entry {
- atomic_t retry_relogin_timer; /* Min Time between relogins
- * (4000 only) */
- atomic_t relogin_timer; /* Max Time to wait for relogin to complete */
-- atomic_t relogin_retry_count; /* Num of times relogin has been
-+ atomic_unchecked_t relogin_retry_count; /* Num of times relogin has been
- * retried */
-
- uint16_t port;
-diff -urNp linux-2.6.32.45/drivers/scsi/qla4xxx/ql4_init.c linux-2.6.32.45/drivers/scsi/qla4xxx/ql4_init.c
---- linux-2.6.32.45/drivers/scsi/qla4xxx/ql4_init.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/qla4xxx/ql4_init.c 2011-05-04 17:56:28.000000000 -0400
-@@ -482,7 +482,7 @@ static struct ddb_entry * qla4xxx_alloc_
- atomic_set(&ddb_entry->port_down_timer, ha->port_down_retry_count);
- atomic_set(&ddb_entry->retry_relogin_timer, INVALID_ENTRY);
- atomic_set(&ddb_entry->relogin_timer, 0);
-- atomic_set(&ddb_entry->relogin_retry_count, 0);
-+ atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
- atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
- list_add_tail(&ddb_entry->list, &ha->ddb_list);
- ha->fw_ddb_index_map[fw_ddb_index] = ddb_entry;
-@@ -1308,7 +1308,7 @@ int qla4xxx_process_ddb_changed(struct s
- atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
- atomic_set(&ddb_entry->port_down_timer,
- ha->port_down_retry_count);
-- atomic_set(&ddb_entry->relogin_retry_count, 0);
-+ atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
- atomic_set(&ddb_entry->relogin_timer, 0);
- clear_bit(DF_RELOGIN, &ddb_entry->flags);
- clear_bit(DF_NO_RELOGIN, &ddb_entry->flags);
-diff -urNp linux-2.6.32.45/drivers/scsi/qla4xxx/ql4_os.c linux-2.6.32.45/drivers/scsi/qla4xxx/ql4_os.c
---- linux-2.6.32.45/drivers/scsi/qla4xxx/ql4_os.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/qla4xxx/ql4_os.c 2011-05-04 17:56:28.000000000 -0400
-@@ -641,13 +641,13 @@ static void qla4xxx_timer(struct scsi_ql
- ddb_entry->fw_ddb_device_state ==
- DDB_DS_SESSION_FAILED) {
- /* Reset retry relogin timer */
-- atomic_inc(&ddb_entry->relogin_retry_count);
-+ atomic_inc_unchecked(&ddb_entry->relogin_retry_count);
- DEBUG2(printk("scsi%ld: index[%d] relogin"
- " timed out-retrying"
- " relogin (%d)\n",
- ha->host_no,
- ddb_entry->fw_ddb_index,
-- atomic_read(&ddb_entry->
-+ atomic_read_unchecked(&ddb_entry->
- relogin_retry_count))
- );
- start_dpc++;
-diff -urNp linux-2.6.32.45/drivers/scsi/scsi.c linux-2.6.32.45/drivers/scsi/scsi.c
---- linux-2.6.32.45/drivers/scsi/scsi.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/scsi.c 2011-05-04 17:56:28.000000000 -0400
-@@ -652,7 +652,7 @@ int scsi_dispatch_cmd(struct scsi_cmnd *
- unsigned long timeout;
- int rtn = 0;
-
-- atomic_inc(&cmd->device->iorequest_cnt);
-+ atomic_inc_unchecked(&cmd->device->iorequest_cnt);
-
- /* check if the device is still usable */
- if (unlikely(cmd->device->sdev_state == SDEV_DEL)) {
-diff -urNp linux-2.6.32.45/drivers/scsi/scsi_debug.c linux-2.6.32.45/drivers/scsi/scsi_debug.c
---- linux-2.6.32.45/drivers/scsi/scsi_debug.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/scsi_debug.c 2011-05-16 21:46:57.000000000 -0400
-@@ -1395,6 +1395,8 @@ static int resp_mode_select(struct scsi_
- unsigned char arr[SDEBUG_MAX_MSELECT_SZ];
- unsigned char *cmd = (unsigned char *)scp->cmnd;
-
-+ pax_track_stack();
-+
- if ((errsts = check_readiness(scp, 1, devip)))
- return errsts;
- memset(arr, 0, sizeof(arr));
-@@ -1492,6 +1494,8 @@ static int resp_log_sense(struct scsi_cm
- unsigned char arr[SDEBUG_MAX_LSENSE_SZ];
- unsigned char *cmd = (unsigned char *)scp->cmnd;
-
-+ pax_track_stack();
-+
- if ((errsts = check_readiness(scp, 1, devip)))
- return errsts;
- memset(arr, 0, sizeof(arr));
-diff -urNp linux-2.6.32.45/drivers/scsi/scsi_lib.c linux-2.6.32.45/drivers/scsi/scsi_lib.c
---- linux-2.6.32.45/drivers/scsi/scsi_lib.c 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/scsi_lib.c 2011-05-10 22:12:33.000000000 -0400
-@@ -1384,7 +1384,7 @@ static void scsi_kill_request(struct req
-
- scsi_init_cmd_errh(cmd);
- cmd->result = DID_NO_CONNECT << 16;
-- atomic_inc(&cmd->device->iorequest_cnt);
-+ atomic_inc_unchecked(&cmd->device->iorequest_cnt);
-
- /*
- * SCSI request completion path will do scsi_device_unbusy(),
-@@ -1415,9 +1415,9 @@ static void scsi_softirq_done(struct req
- */
- cmd->serial_number = 0;
-
-- atomic_inc(&cmd->device->iodone_cnt);
-+ atomic_inc_unchecked(&cmd->device->iodone_cnt);
- if (cmd->result)
-- atomic_inc(&cmd->device->ioerr_cnt);
-+ atomic_inc_unchecked(&cmd->device->ioerr_cnt);
-
- disposition = scsi_decide_disposition(cmd);
- if (disposition != SUCCESS &&
-diff -urNp linux-2.6.32.45/drivers/scsi/scsi_sysfs.c linux-2.6.32.45/drivers/scsi/scsi_sysfs.c
---- linux-2.6.32.45/drivers/scsi/scsi_sysfs.c 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/scsi_sysfs.c 2011-06-25 12:56:37.000000000 -0400
-@@ -662,7 +662,7 @@ show_iostat_##field(struct device *dev,
- char *buf) \
- { \
- struct scsi_device *sdev = to_scsi_device(dev); \
-- unsigned long long count = atomic_read(&sdev->field); \
-+ unsigned long long count = atomic_read_unchecked(&sdev->field); \
- return snprintf(buf, 20, "0x%llx\n", count); \
- } \
- static DEVICE_ATTR(field, S_IRUGO, show_iostat_##field, NULL)
-diff -urNp linux-2.6.32.45/drivers/scsi/scsi_transport_fc.c linux-2.6.32.45/drivers/scsi/scsi_transport_fc.c
---- linux-2.6.32.45/drivers/scsi/scsi_transport_fc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/scsi_transport_fc.c 2011-05-04 17:56:28.000000000 -0400
-@@ -480,7 +480,7 @@ MODULE_PARM_DESC(dev_loss_tmo,
- * Netlink Infrastructure
- */
-
--static atomic_t fc_event_seq;
-+static atomic_unchecked_t fc_event_seq;
-
- /**
- * fc_get_event_number - Obtain the next sequential FC event number
-@@ -493,7 +493,7 @@ static atomic_t fc_event_seq;
- u32
- fc_get_event_number(void)
- {
-- return atomic_add_return(1, &fc_event_seq);
-+ return atomic_add_return_unchecked(1, &fc_event_seq);
- }
- EXPORT_SYMBOL(fc_get_event_number);
-
-@@ -641,7 +641,7 @@ static __init int fc_transport_init(void
- {
- int error;
-
-- atomic_set(&fc_event_seq, 0);
-+ atomic_set_unchecked(&fc_event_seq, 0);
-
- error = transport_class_register(&fc_host_class);
- if (error)
-diff -urNp linux-2.6.32.45/drivers/scsi/scsi_transport_iscsi.c linux-2.6.32.45/drivers/scsi/scsi_transport_iscsi.c
---- linux-2.6.32.45/drivers/scsi/scsi_transport_iscsi.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/scsi_transport_iscsi.c 2011-05-04 17:56:28.000000000 -0400
-@@ -81,7 +81,7 @@ struct iscsi_internal {
- struct device_attribute *session_attrs[ISCSI_SESSION_ATTRS + 1];
- };
-
--static atomic_t iscsi_session_nr; /* sysfs session id for next new session */
-+static atomic_unchecked_t iscsi_session_nr; /* sysfs session id for next new session */
- static struct workqueue_struct *iscsi_eh_timer_workq;
-
- /*
-@@ -728,7 +728,7 @@ int iscsi_add_session(struct iscsi_cls_s
- int err;
-
- ihost = shost->shost_data;
-- session->sid = atomic_add_return(1, &iscsi_session_nr);
-+ session->sid = atomic_add_return_unchecked(1, &iscsi_session_nr);
-
- if (id == ISCSI_MAX_TARGET) {
- for (id = 0; id < ISCSI_MAX_TARGET; id++) {
-@@ -2060,7 +2060,7 @@ static __init int iscsi_transport_init(v
- printk(KERN_INFO "Loading iSCSI transport class v%s.\n",
- ISCSI_TRANSPORT_VERSION);
-
-- atomic_set(&iscsi_session_nr, 0);
-+ atomic_set_unchecked(&iscsi_session_nr, 0);
-
- err = class_register(&iscsi_transport_class);
- if (err)
-diff -urNp linux-2.6.32.45/drivers/scsi/scsi_transport_srp.c linux-2.6.32.45/drivers/scsi/scsi_transport_srp.c
---- linux-2.6.32.45/drivers/scsi/scsi_transport_srp.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/scsi_transport_srp.c 2011-05-04 17:56:28.000000000 -0400
-@@ -33,7 +33,7 @@
- #include "scsi_transport_srp_internal.h"
-
- struct srp_host_attrs {
-- atomic_t next_port_id;
-+ atomic_unchecked_t next_port_id;
- };
- #define to_srp_host_attrs(host) ((struct srp_host_attrs *)(host)->shost_data)
-
-@@ -62,7 +62,7 @@ static int srp_host_setup(struct transpo
- struct Scsi_Host *shost = dev_to_shost(dev);
- struct srp_host_attrs *srp_host = to_srp_host_attrs(shost);
-
-- atomic_set(&srp_host->next_port_id, 0);
-+ atomic_set_unchecked(&srp_host->next_port_id, 0);
- return 0;
- }
-
-@@ -211,7 +211,7 @@ struct srp_rport *srp_rport_add(struct S
- memcpy(rport->port_id, ids->port_id, sizeof(rport->port_id));
- rport->roles = ids->roles;
-
-- id = atomic_inc_return(&to_srp_host_attrs(shost)->next_port_id);
-+ id = atomic_inc_return_unchecked(&to_srp_host_attrs(shost)->next_port_id);
- dev_set_name(&rport->dev, "port-%d:%d", shost->host_no, id);
-
- transport_setup_device(&rport->dev);
-diff -urNp linux-2.6.32.45/drivers/scsi/sg.c linux-2.6.32.45/drivers/scsi/sg.c
---- linux-2.6.32.45/drivers/scsi/sg.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/sg.c 2011-04-17 15:56:46.000000000 -0400
-@@ -2292,7 +2292,7 @@ struct sg_proc_leaf {
- const struct file_operations * fops;
- };
-
--static struct sg_proc_leaf sg_proc_leaf_arr[] = {
-+static const struct sg_proc_leaf sg_proc_leaf_arr[] = {
- {"allow_dio", &adio_fops},
- {"debug", &debug_fops},
- {"def_reserved_size", &dressz_fops},
-@@ -2307,7 +2307,7 @@ sg_proc_init(void)
- {
- int k, mask;
- int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
-- struct sg_proc_leaf * leaf;
-+ const struct sg_proc_leaf * leaf;
-
- sg_proc_sgp = proc_mkdir(sg_proc_sg_dirname, NULL);
- if (!sg_proc_sgp)
-diff -urNp linux-2.6.32.45/drivers/scsi/sym53c8xx_2/sym_glue.c linux-2.6.32.45/drivers/scsi/sym53c8xx_2/sym_glue.c
---- linux-2.6.32.45/drivers/scsi/sym53c8xx_2/sym_glue.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/scsi/sym53c8xx_2/sym_glue.c 2011-05-16 21:46:57.000000000 -0400
-@@ -1754,6 +1754,8 @@ static int __devinit sym2_probe(struct p
- int do_iounmap = 0;
- int do_disable_device = 1;
-
-+ pax_track_stack();
-+
- memset(&sym_dev, 0, sizeof(sym_dev));
- memset(&nvram, 0, sizeof(nvram));
- sym_dev.pdev = pdev;
-diff -urNp linux-2.6.32.45/drivers/serial/kgdboc.c linux-2.6.32.45/drivers/serial/kgdboc.c
---- linux-2.6.32.45/drivers/serial/kgdboc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/serial/kgdboc.c 2011-04-17 15:56:46.000000000 -0400
-@@ -18,7 +18,7 @@
-
- #define MAX_CONFIG_LEN 40
-
--static struct kgdb_io kgdboc_io_ops;
-+static const struct kgdb_io kgdboc_io_ops;
-
- /* -1 = init not run yet, 0 = unconfigured, 1 = configured. */
- static int configured = -1;
-@@ -154,7 +154,7 @@ static void kgdboc_post_exp_handler(void
- module_put(THIS_MODULE);
- }
-
--static struct kgdb_io kgdboc_io_ops = {
-+static const struct kgdb_io kgdboc_io_ops = {
- .name = "kgdboc",
- .read_char = kgdboc_get_char,
- .write_char = kgdboc_put_char,
-diff -urNp linux-2.6.32.45/drivers/spi/spi.c linux-2.6.32.45/drivers/spi/spi.c
---- linux-2.6.32.45/drivers/spi/spi.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/spi/spi.c 2011-05-04 17:56:28.000000000 -0400
-@@ -774,7 +774,7 @@ int spi_sync(struct spi_device *spi, str
- EXPORT_SYMBOL_GPL(spi_sync);
-
- /* portable code must never pass more than 32 bytes */
--#define SPI_BUFSIZ max(32,SMP_CACHE_BYTES)
-+#define SPI_BUFSIZ max(32U,SMP_CACHE_BYTES)
-
- static u8 *buf;
-
-diff -urNp linux-2.6.32.45/drivers/ssb/driver_gige.c linux-2.6.32.45/drivers/ssb/driver_gige.c
---- linux-2.6.32.45/drivers/ssb/driver_gige.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/ssb/driver_gige.c 2011-08-05 20:33:55.000000000 -0400
-@@ -180,8 +180,8 @@ static int ssb_gige_probe(struct ssb_dev
- dev->pci_controller.io_resource = &dev->io_resource;
- dev->pci_controller.mem_resource = &dev->mem_resource;
- dev->pci_controller.io_map_base = 0x800;
-- dev->pci_ops.read = ssb_gige_pci_read_config;
-- dev->pci_ops.write = ssb_gige_pci_write_config;
-+ *(void **)&dev->pci_ops.read = ssb_gige_pci_read_config;
-+ *(void **)&dev->pci_ops.write = ssb_gige_pci_write_config;
-
- dev->io_resource.name = SSB_GIGE_IO_RES_NAME;
- dev->io_resource.start = 0x800;
-diff -urNp linux-2.6.32.45/drivers/staging/android/binder.c linux-2.6.32.45/drivers/staging/android/binder.c
---- linux-2.6.32.45/drivers/staging/android/binder.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/android/binder.c 2011-04-17 15:56:46.000000000 -0400
-@@ -2756,7 +2756,7 @@ static void binder_vma_close(struct vm_a
- binder_defer_work(proc, BINDER_DEFERRED_PUT_FILES);
- }
-
--static struct vm_operations_struct binder_vm_ops = {
-+static const struct vm_operations_struct binder_vm_ops = {
- .open = binder_vma_open,
- .close = binder_vma_close,
- };
-diff -urNp linux-2.6.32.45/drivers/staging/b3dfg/b3dfg.c linux-2.6.32.45/drivers/staging/b3dfg/b3dfg.c
---- linux-2.6.32.45/drivers/staging/b3dfg/b3dfg.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/b3dfg/b3dfg.c 2011-04-17 15:56:46.000000000 -0400
-@@ -455,7 +455,7 @@ static int b3dfg_vma_fault(struct vm_are
- return VM_FAULT_NOPAGE;
- }
-
--static struct vm_operations_struct b3dfg_vm_ops = {
-+static const struct vm_operations_struct b3dfg_vm_ops = {
- .fault = b3dfg_vma_fault,
- };
-
-@@ -848,7 +848,7 @@ static int b3dfg_mmap(struct file *filp,
- return r;
- }
-
--static struct file_operations b3dfg_fops = {
-+static const struct file_operations b3dfg_fops = {
- .owner = THIS_MODULE,
- .open = b3dfg_open,
- .release = b3dfg_release,
-diff -urNp linux-2.6.32.45/drivers/staging/comedi/comedi_fops.c linux-2.6.32.45/drivers/staging/comedi/comedi_fops.c
---- linux-2.6.32.45/drivers/staging/comedi/comedi_fops.c 2011-08-09 18:35:29.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/comedi/comedi_fops.c 2011-08-09 18:34:00.000000000 -0400
-@@ -1389,7 +1389,7 @@ void comedi_unmap(struct vm_area_struct
- mutex_unlock(&dev->mutex);
- }
-
--static struct vm_operations_struct comedi_vm_ops = {
-+static const struct vm_operations_struct comedi_vm_ops = {
- .close = comedi_unmap,
- };
-
-diff -urNp linux-2.6.32.45/drivers/staging/dream/qdsp5/adsp_driver.c linux-2.6.32.45/drivers/staging/dream/qdsp5/adsp_driver.c
---- linux-2.6.32.45/drivers/staging/dream/qdsp5/adsp_driver.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/dream/qdsp5/adsp_driver.c 2011-04-17 15:56:46.000000000 -0400
-@@ -576,7 +576,7 @@ static struct adsp_device *inode_to_devi
- static dev_t adsp_devno;
- static struct class *adsp_class;
-
--static struct file_operations adsp_fops = {
-+static const struct file_operations adsp_fops = {
- .owner = THIS_MODULE,
- .open = adsp_open,
- .unlocked_ioctl = adsp_ioctl,
-diff -urNp linux-2.6.32.45/drivers/staging/dream/qdsp5/audio_aac.c linux-2.6.32.45/drivers/staging/dream/qdsp5/audio_aac.c
---- linux-2.6.32.45/drivers/staging/dream/qdsp5/audio_aac.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/dream/qdsp5/audio_aac.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1022,7 +1022,7 @@ done:
- return rc;
- }
-
--static struct file_operations audio_aac_fops = {
-+static const struct file_operations audio_aac_fops = {
- .owner = THIS_MODULE,
- .open = audio_open,
- .release = audio_release,
-diff -urNp linux-2.6.32.45/drivers/staging/dream/qdsp5/audio_amrnb.c linux-2.6.32.45/drivers/staging/dream/qdsp5/audio_amrnb.c
---- linux-2.6.32.45/drivers/staging/dream/qdsp5/audio_amrnb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/dream/qdsp5/audio_amrnb.c 2011-04-17 15:56:46.000000000 -0400
-@@ -833,7 +833,7 @@ done:
- return rc;
- }
-
--static struct file_operations audio_amrnb_fops = {
-+static const struct file_operations audio_amrnb_fops = {
- .owner = THIS_MODULE,
- .open = audamrnb_open,
- .release = audamrnb_release,
-diff -urNp linux-2.6.32.45/drivers/staging/dream/qdsp5/audio_evrc.c linux-2.6.32.45/drivers/staging/dream/qdsp5/audio_evrc.c
---- linux-2.6.32.45/drivers/staging/dream/qdsp5/audio_evrc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/dream/qdsp5/audio_evrc.c 2011-04-17 15:56:46.000000000 -0400
-@@ -805,7 +805,7 @@ dma_fail:
- return rc;
- }
-
--static struct file_operations audio_evrc_fops = {
-+static const struct file_operations audio_evrc_fops = {
- .owner = THIS_MODULE,
- .open = audevrc_open,
- .release = audevrc_release,
-diff -urNp linux-2.6.32.45/drivers/staging/dream/qdsp5/audio_in.c linux-2.6.32.45/drivers/staging/dream/qdsp5/audio_in.c
---- linux-2.6.32.45/drivers/staging/dream/qdsp5/audio_in.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/dream/qdsp5/audio_in.c 2011-04-17 15:56:46.000000000 -0400
-@@ -913,7 +913,7 @@ static int audpre_open(struct inode *ino
- return 0;
- }
-
--static struct file_operations audio_fops = {
-+static const struct file_operations audio_fops = {
- .owner = THIS_MODULE,
- .open = audio_in_open,
- .release = audio_in_release,
-@@ -922,7 +922,7 @@ static struct file_operations audio_fops
- .unlocked_ioctl = audio_in_ioctl,
- };
-
--static struct file_operations audpre_fops = {
-+static const struct file_operations audpre_fops = {
- .owner = THIS_MODULE,
- .open = audpre_open,
- .unlocked_ioctl = audpre_ioctl,
-diff -urNp linux-2.6.32.45/drivers/staging/dream/qdsp5/audio_mp3.c linux-2.6.32.45/drivers/staging/dream/qdsp5/audio_mp3.c
---- linux-2.6.32.45/drivers/staging/dream/qdsp5/audio_mp3.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/dream/qdsp5/audio_mp3.c 2011-04-17 15:56:46.000000000 -0400
-@@ -941,7 +941,7 @@ done:
- return rc;
- }
-
--static struct file_operations audio_mp3_fops = {
-+static const struct file_operations audio_mp3_fops = {
- .owner = THIS_MODULE,
- .open = audio_open,
- .release = audio_release,
-diff -urNp linux-2.6.32.45/drivers/staging/dream/qdsp5/audio_out.c linux-2.6.32.45/drivers/staging/dream/qdsp5/audio_out.c
---- linux-2.6.32.45/drivers/staging/dream/qdsp5/audio_out.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/dream/qdsp5/audio_out.c 2011-04-17 15:56:46.000000000 -0400
-@@ -810,7 +810,7 @@ static int audpp_open(struct inode *inod
- return 0;
- }
-
--static struct file_operations audio_fops = {
-+static const struct file_operations audio_fops = {
- .owner = THIS_MODULE,
- .open = audio_open,
- .release = audio_release,
-@@ -819,7 +819,7 @@ static struct file_operations audio_fops
- .unlocked_ioctl = audio_ioctl,
- };
-
--static struct file_operations audpp_fops = {
-+static const struct file_operations audpp_fops = {
- .owner = THIS_MODULE,
- .open = audpp_open,
- .unlocked_ioctl = audpp_ioctl,
-diff -urNp linux-2.6.32.45/drivers/staging/dream/qdsp5/audio_qcelp.c linux-2.6.32.45/drivers/staging/dream/qdsp5/audio_qcelp.c
---- linux-2.6.32.45/drivers/staging/dream/qdsp5/audio_qcelp.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/dream/qdsp5/audio_qcelp.c 2011-04-17 15:56:46.000000000 -0400
-@@ -816,7 +816,7 @@ err:
- return rc;
- }
-
--static struct file_operations audio_qcelp_fops = {
-+static const struct file_operations audio_qcelp_fops = {
- .owner = THIS_MODULE,
- .open = audqcelp_open,
- .release = audqcelp_release,
-diff -urNp linux-2.6.32.45/drivers/staging/dream/qdsp5/snd.c linux-2.6.32.45/drivers/staging/dream/qdsp5/snd.c
---- linux-2.6.32.45/drivers/staging/dream/qdsp5/snd.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/dream/qdsp5/snd.c 2011-04-17 15:56:46.000000000 -0400
-@@ -242,7 +242,7 @@ err:
- return rc;
- }
-
--static struct file_operations snd_fops = {
-+static const struct file_operations snd_fops = {
- .owner = THIS_MODULE,
- .open = snd_open,
- .release = snd_release,
-diff -urNp linux-2.6.32.45/drivers/staging/dream/smd/smd_qmi.c linux-2.6.32.45/drivers/staging/dream/smd/smd_qmi.c
---- linux-2.6.32.45/drivers/staging/dream/smd/smd_qmi.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/dream/smd/smd_qmi.c 2011-04-17 15:56:46.000000000 -0400
-@@ -793,7 +793,7 @@ static int qmi_release(struct inode *ip,
- return 0;
- }
-
--static struct file_operations qmi_fops = {
-+static const struct file_operations qmi_fops = {
- .owner = THIS_MODULE,
- .read = qmi_read,
- .write = qmi_write,
-diff -urNp linux-2.6.32.45/drivers/staging/dream/smd/smd_rpcrouter_device.c linux-2.6.32.45/drivers/staging/dream/smd/smd_rpcrouter_device.c
---- linux-2.6.32.45/drivers/staging/dream/smd/smd_rpcrouter_device.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/dream/smd/smd_rpcrouter_device.c 2011-04-17 15:56:46.000000000 -0400
-@@ -214,7 +214,7 @@ static long rpcrouter_ioctl(struct file
- return rc;
- }
-
--static struct file_operations rpcrouter_server_fops = {
-+static const struct file_operations rpcrouter_server_fops = {
- .owner = THIS_MODULE,
- .open = rpcrouter_open,
- .release = rpcrouter_release,
-@@ -224,7 +224,7 @@ static struct file_operations rpcrouter_
- .unlocked_ioctl = rpcrouter_ioctl,
- };
-
--static struct file_operations rpcrouter_router_fops = {
-+static const struct file_operations rpcrouter_router_fops = {
- .owner = THIS_MODULE,
- .open = rpcrouter_open,
- .release = rpcrouter_release,
-diff -urNp linux-2.6.32.45/drivers/staging/dst/dcore.c linux-2.6.32.45/drivers/staging/dst/dcore.c
---- linux-2.6.32.45/drivers/staging/dst/dcore.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/dst/dcore.c 2011-04-17 15:56:46.000000000 -0400
-@@ -149,7 +149,7 @@ static int dst_bdev_release(struct gendi
- return 0;
- }
-
--static struct block_device_operations dst_blk_ops = {
-+static const struct block_device_operations dst_blk_ops = {
- .open = dst_bdev_open,
- .release = dst_bdev_release,
- .owner = THIS_MODULE,
-@@ -588,7 +588,7 @@ static struct dst_node *dst_alloc_node(s
- n->size = ctl->size;
-
- atomic_set(&n->refcnt, 1);
-- atomic_long_set(&n->gen, 0);
-+ atomic_long_set_unchecked(&n->gen, 0);
- snprintf(n->name, sizeof(n->name), "%s", ctl->name);
-
- err = dst_node_sysfs_init(n);
-diff -urNp linux-2.6.32.45/drivers/staging/dst/trans.c linux-2.6.32.45/drivers/staging/dst/trans.c
---- linux-2.6.32.45/drivers/staging/dst/trans.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/dst/trans.c 2011-04-17 15:56:46.000000000 -0400
-@@ -169,7 +169,7 @@ int dst_process_bio(struct dst_node *n,
- t->error = 0;
- t->retries = 0;
- atomic_set(&t->refcnt, 1);
-- t->gen = atomic_long_inc_return(&n->gen);
-+ t->gen = atomic_long_inc_return_unchecked(&n->gen);
-
- t->enc = bio_data_dir(bio);
- dst_bio_to_cmd(bio, &t->cmd, DST_IO, t->gen);
-diff -urNp linux-2.6.32.45/drivers/staging/et131x/et1310_tx.c linux-2.6.32.45/drivers/staging/et131x/et1310_tx.c
---- linux-2.6.32.45/drivers/staging/et131x/et1310_tx.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/et131x/et1310_tx.c 2011-05-04 17:56:28.000000000 -0400
-@@ -710,11 +710,11 @@ inline void et131x_free_send_packet(stru
- struct net_device_stats *stats = &etdev->net_stats;
-
- if (pMpTcb->Flags & fMP_DEST_BROAD)
-- atomic_inc(&etdev->Stats.brdcstxmt);
-+ atomic_inc_unchecked(&etdev->Stats.brdcstxmt);
- else if (pMpTcb->Flags & fMP_DEST_MULTI)
-- atomic_inc(&etdev->Stats.multixmt);
-+ atomic_inc_unchecked(&etdev->Stats.multixmt);
- else
-- atomic_inc(&etdev->Stats.unixmt);
-+ atomic_inc_unchecked(&etdev->Stats.unixmt);
-
- if (pMpTcb->Packet) {
- stats->tx_bytes += pMpTcb->Packet->len;
-diff -urNp linux-2.6.32.45/drivers/staging/et131x/et131x_adapter.h linux-2.6.32.45/drivers/staging/et131x/et131x_adapter.h
---- linux-2.6.32.45/drivers/staging/et131x/et131x_adapter.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/et131x/et131x_adapter.h 2011-05-04 17:56:28.000000000 -0400
-@@ -145,11 +145,11 @@ typedef struct _ce_stats_t {
- * operations
- */
- u32 unircv; /* # multicast packets received */
-- atomic_t unixmt; /* # multicast packets for Tx */
-+ atomic_unchecked_t unixmt; /* # multicast packets for Tx */
- u32 multircv; /* # multicast packets received */
-- atomic_t multixmt; /* # multicast packets for Tx */
-+ atomic_unchecked_t multixmt; /* # multicast packets for Tx */
- u32 brdcstrcv; /* # broadcast packets received */
-- atomic_t brdcstxmt; /* # broadcast packets for Tx */
-+ atomic_unchecked_t brdcstxmt; /* # broadcast packets for Tx */
- u32 norcvbuf; /* # Rx packets discarded */
- u32 noxmtbuf; /* # Tx packets discarded */
-
-diff -urNp linux-2.6.32.45/drivers/staging/go7007/go7007-v4l2.c linux-2.6.32.45/drivers/staging/go7007/go7007-v4l2.c
---- linux-2.6.32.45/drivers/staging/go7007/go7007-v4l2.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/go7007/go7007-v4l2.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1700,7 +1700,7 @@ static int go7007_vm_fault(struct vm_are
- return 0;
- }
-
--static struct vm_operations_struct go7007_vm_ops = {
-+static const struct vm_operations_struct go7007_vm_ops = {
- .open = go7007_vm_open,
- .close = go7007_vm_close,
- .fault = go7007_vm_fault,
-diff -urNp linux-2.6.32.45/drivers/staging/hv/blkvsc_drv.c linux-2.6.32.45/drivers/staging/hv/blkvsc_drv.c
---- linux-2.6.32.45/drivers/staging/hv/blkvsc_drv.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/hv/blkvsc_drv.c 2011-04-17 15:56:46.000000000 -0400
-@@ -153,7 +153,7 @@ static int blkvsc_ringbuffer_size = BLKV
- /* The one and only one */
- static struct blkvsc_driver_context g_blkvsc_drv;
-
--static struct block_device_operations block_ops = {
-+static const struct block_device_operations block_ops = {
- .owner = THIS_MODULE,
- .open = blkvsc_open,
- .release = blkvsc_release,
-diff -urNp linux-2.6.32.45/drivers/staging/hv/Channel.c linux-2.6.32.45/drivers/staging/hv/Channel.c
---- linux-2.6.32.45/drivers/staging/hv/Channel.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/hv/Channel.c 2011-05-04 17:56:28.000000000 -0400
-@@ -464,8 +464,8 @@ int VmbusChannelEstablishGpadl(struct vm
-
- DPRINT_ENTER(VMBUS);
-
-- nextGpadlHandle = atomic_read(&gVmbusConnection.NextGpadlHandle);
-- atomic_inc(&gVmbusConnection.NextGpadlHandle);
-+ nextGpadlHandle = atomic_read_unchecked(&gVmbusConnection.NextGpadlHandle);
-+ atomic_inc_unchecked(&gVmbusConnection.NextGpadlHandle);
-
- VmbusChannelCreateGpadlHeader(Kbuffer, Size, &msgInfo, &msgCount);
- ASSERT(msgInfo != NULL);
-diff -urNp linux-2.6.32.45/drivers/staging/hv/Hv.c linux-2.6.32.45/drivers/staging/hv/Hv.c
---- linux-2.6.32.45/drivers/staging/hv/Hv.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/hv/Hv.c 2011-04-17 15:56:46.000000000 -0400
-@@ -161,7 +161,7 @@ static u64 HvDoHypercall(u64 Control, vo
- u64 outputAddress = (Output) ? virt_to_phys(Output) : 0;
- u32 outputAddressHi = outputAddress >> 32;
- u32 outputAddressLo = outputAddress & 0xFFFFFFFF;
-- volatile void *hypercallPage = gHvContext.HypercallPage;
-+ volatile void *hypercallPage = ktva_ktla(gHvContext.HypercallPage);
-
- DPRINT_DBG(VMBUS, "Hypercall <control %llx input %p output %p>",
- Control, Input, Output);
-diff -urNp linux-2.6.32.45/drivers/staging/hv/vmbus_drv.c linux-2.6.32.45/drivers/staging/hv/vmbus_drv.c
---- linux-2.6.32.45/drivers/staging/hv/vmbus_drv.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/hv/vmbus_drv.c 2011-05-04 17:56:28.000000000 -0400
-@@ -532,7 +532,7 @@ static int vmbus_child_device_register(s
- to_device_context(root_device_obj);
- struct device_context *child_device_ctx =
- to_device_context(child_device_obj);
-- static atomic_t device_num = ATOMIC_INIT(0);
-+ static atomic_unchecked_t device_num = ATOMIC_INIT(0);
-
- DPRINT_ENTER(VMBUS_DRV);
-
-@@ -541,7 +541,7 @@ static int vmbus_child_device_register(s
-
- /* Set the device name. Otherwise, device_register() will fail. */
- dev_set_name(&child_device_ctx->device, "vmbus_0_%d",
-- atomic_inc_return(&device_num));
-+ atomic_inc_return_unchecked(&device_num));
-
- /* The new device belongs to this bus */
- child_device_ctx->device.bus = &g_vmbus_drv.bus; /* device->dev.bus; */
-diff -urNp linux-2.6.32.45/drivers/staging/hv/VmbusPrivate.h linux-2.6.32.45/drivers/staging/hv/VmbusPrivate.h
---- linux-2.6.32.45/drivers/staging/hv/VmbusPrivate.h 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/hv/VmbusPrivate.h 2011-05-04 17:56:28.000000000 -0400
-@@ -59,7 +59,7 @@ enum VMBUS_CONNECT_STATE {
- struct VMBUS_CONNECTION {
- enum VMBUS_CONNECT_STATE ConnectState;
-
-- atomic_t NextGpadlHandle;
-+ atomic_unchecked_t NextGpadlHandle;
-
- /*
- * Represents channel interrupts. Each bit position represents a
-diff -urNp linux-2.6.32.45/drivers/staging/octeon/ethernet.c linux-2.6.32.45/drivers/staging/octeon/ethernet.c
---- linux-2.6.32.45/drivers/staging/octeon/ethernet.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/octeon/ethernet.c 2011-05-04 17:56:28.000000000 -0400
-@@ -294,11 +294,11 @@ static struct net_device_stats *cvm_oct_
- * since the RX tasklet also increments it.
- */
- #ifdef CONFIG_64BIT
-- atomic64_add(rx_status.dropped_packets,
-- (atomic64_t *)&priv->stats.rx_dropped);
-+ atomic64_add_unchecked(rx_status.dropped_packets,
-+ (atomic64_unchecked_t *)&priv->stats.rx_dropped);
- #else
-- atomic_add(rx_status.dropped_packets,
-- (atomic_t *)&priv->stats.rx_dropped);
-+ atomic_add_unchecked(rx_status.dropped_packets,
-+ (atomic_unchecked_t *)&priv->stats.rx_dropped);
- #endif
- }
-
-diff -urNp linux-2.6.32.45/drivers/staging/octeon/ethernet-rx.c linux-2.6.32.45/drivers/staging/octeon/ethernet-rx.c
---- linux-2.6.32.45/drivers/staging/octeon/ethernet-rx.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/octeon/ethernet-rx.c 2011-05-04 17:56:28.000000000 -0400
-@@ -406,11 +406,11 @@ void cvm_oct_tasklet_rx(unsigned long un
- /* Increment RX stats for virtual ports */
- if (work->ipprt >= CVMX_PIP_NUM_INPUT_PORTS) {
- #ifdef CONFIG_64BIT
-- atomic64_add(1, (atomic64_t *)&priv->stats.rx_packets);
-- atomic64_add(skb->len, (atomic64_t *)&priv->stats.rx_bytes);
-+ atomic64_add_unchecked(1, (atomic64_unchecked_t *)&priv->stats.rx_packets);
-+ atomic64_add_unchecked(skb->len, (atomic64_unchecked_t *)&priv->stats.rx_bytes);
- #else
-- atomic_add(1, (atomic_t *)&priv->stats.rx_packets);
-- atomic_add(skb->len, (atomic_t *)&priv->stats.rx_bytes);
-+ atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_packets);
-+ atomic_add_unchecked(skb->len, (atomic_unchecked_t *)&priv->stats.rx_bytes);
- #endif
- }
- netif_receive_skb(skb);
-@@ -424,9 +424,9 @@ void cvm_oct_tasklet_rx(unsigned long un
- dev->name);
- */
- #ifdef CONFIG_64BIT
-- atomic64_add(1, (atomic64_t *)&priv->stats.rx_dropped);
-+ atomic64_add_unchecked(1, (atomic64_t *)&priv->stats.rx_dropped);
- #else
-- atomic_add(1, (atomic_t *)&priv->stats.rx_dropped);
-+ atomic_add_unchecked(1, (atomic_t *)&priv->stats.rx_dropped);
- #endif
- dev_kfree_skb_irq(skb);
- }
-diff -urNp linux-2.6.32.45/drivers/staging/panel/panel.c linux-2.6.32.45/drivers/staging/panel/panel.c
---- linux-2.6.32.45/drivers/staging/panel/panel.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/panel/panel.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1305,7 +1305,7 @@ static int lcd_release(struct inode *ino
- return 0;
- }
-
--static struct file_operations lcd_fops = {
-+static const struct file_operations lcd_fops = {
- .write = lcd_write,
- .open = lcd_open,
- .release = lcd_release,
-@@ -1565,7 +1565,7 @@ static int keypad_release(struct inode *
- return 0;
- }
-
--static struct file_operations keypad_fops = {
-+static const struct file_operations keypad_fops = {
- .read = keypad_read, /* read */
- .open = keypad_open, /* open */
- .release = keypad_release, /* close */
-diff -urNp linux-2.6.32.45/drivers/staging/phison/phison.c linux-2.6.32.45/drivers/staging/phison/phison.c
---- linux-2.6.32.45/drivers/staging/phison/phison.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/phison/phison.c 2011-04-17 15:56:46.000000000 -0400
-@@ -43,7 +43,7 @@ static struct scsi_host_template phison_
- ATA_BMDMA_SHT(DRV_NAME),
- };
-
--static struct ata_port_operations phison_ops = {
-+static const struct ata_port_operations phison_ops = {
- .inherits = &ata_bmdma_port_ops,
- .prereset = phison_pre_reset,
- };
-diff -urNp linux-2.6.32.45/drivers/staging/poch/poch.c linux-2.6.32.45/drivers/staging/poch/poch.c
---- linux-2.6.32.45/drivers/staging/poch/poch.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/poch/poch.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1057,7 +1057,7 @@ static int poch_ioctl(struct inode *inod
- return 0;
- }
-
--static struct file_operations poch_fops = {
-+static const struct file_operations poch_fops = {
- .owner = THIS_MODULE,
- .open = poch_open,
- .release = poch_release,
-diff -urNp linux-2.6.32.45/drivers/staging/pohmelfs/inode.c linux-2.6.32.45/drivers/staging/pohmelfs/inode.c
---- linux-2.6.32.45/drivers/staging/pohmelfs/inode.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/pohmelfs/inode.c 2011-05-04 17:56:20.000000000 -0400
-@@ -1850,7 +1850,7 @@ static int pohmelfs_fill_super(struct su
- mutex_init(&psb->mcache_lock);
- psb->mcache_root = RB_ROOT;
- psb->mcache_timeout = msecs_to_jiffies(5000);
-- atomic_long_set(&psb->mcache_gen, 0);
-+ atomic_long_set_unchecked(&psb->mcache_gen, 0);
-
- psb->trans_max_pages = 100;
-
-@@ -1865,7 +1865,7 @@ static int pohmelfs_fill_super(struct su
- INIT_LIST_HEAD(&psb->crypto_ready_list);
- INIT_LIST_HEAD(&psb->crypto_active_list);
-
-- atomic_set(&psb->trans_gen, 1);
-+ atomic_set_unchecked(&psb->trans_gen, 1);
- atomic_long_set(&psb->total_inodes, 0);
-
- mutex_init(&psb->state_lock);
-diff -urNp linux-2.6.32.45/drivers/staging/pohmelfs/mcache.c linux-2.6.32.45/drivers/staging/pohmelfs/mcache.c
---- linux-2.6.32.45/drivers/staging/pohmelfs/mcache.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/pohmelfs/mcache.c 2011-04-17 15:56:46.000000000 -0400
-@@ -121,7 +121,7 @@ struct pohmelfs_mcache *pohmelfs_mcache_
- m->data = data;
- m->start = start;
- m->size = size;
-- m->gen = atomic_long_inc_return(&psb->mcache_gen);
-+ m->gen = atomic_long_inc_return_unchecked(&psb->mcache_gen);
-
- mutex_lock(&psb->mcache_lock);
- err = pohmelfs_mcache_insert(psb, m);
-diff -urNp linux-2.6.32.45/drivers/staging/pohmelfs/netfs.h linux-2.6.32.45/drivers/staging/pohmelfs/netfs.h
---- linux-2.6.32.45/drivers/staging/pohmelfs/netfs.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/pohmelfs/netfs.h 2011-05-04 17:56:20.000000000 -0400
-@@ -570,14 +570,14 @@ struct pohmelfs_config;
- struct pohmelfs_sb {
- struct rb_root mcache_root;
- struct mutex mcache_lock;
-- atomic_long_t mcache_gen;
-+ atomic_long_unchecked_t mcache_gen;
- unsigned long mcache_timeout;
-
- unsigned int idx;
-
- unsigned int trans_retries;
-
-- atomic_t trans_gen;
-+ atomic_unchecked_t trans_gen;
-
- unsigned int crypto_attached_size;
- unsigned int crypto_align_size;
-diff -urNp linux-2.6.32.45/drivers/staging/pohmelfs/trans.c linux-2.6.32.45/drivers/staging/pohmelfs/trans.c
---- linux-2.6.32.45/drivers/staging/pohmelfs/trans.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/pohmelfs/trans.c 2011-05-04 17:56:28.000000000 -0400
-@@ -492,7 +492,7 @@ int netfs_trans_finish(struct netfs_tran
- int err;
- struct netfs_cmd *cmd = t->iovec.iov_base;
-
-- t->gen = atomic_inc_return(&psb->trans_gen);
-+ t->gen = atomic_inc_return_unchecked(&psb->trans_gen);
-
- cmd->size = t->iovec.iov_len - sizeof(struct netfs_cmd) +
- t->attached_size + t->attached_pages * sizeof(struct netfs_cmd);
-diff -urNp linux-2.6.32.45/drivers/staging/sep/sep_driver.c linux-2.6.32.45/drivers/staging/sep/sep_driver.c
---- linux-2.6.32.45/drivers/staging/sep/sep_driver.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/sep/sep_driver.c 2011-04-17 15:56:46.000000000 -0400
-@@ -2603,7 +2603,7 @@ static struct pci_driver sep_pci_driver
- static dev_t sep_devno;
-
- /* the files operations structure of the driver */
--static struct file_operations sep_file_operations = {
-+static const struct file_operations sep_file_operations = {
- .owner = THIS_MODULE,
- .ioctl = sep_ioctl,
- .poll = sep_poll,
-diff -urNp linux-2.6.32.45/drivers/staging/usbip/vhci.h linux-2.6.32.45/drivers/staging/usbip/vhci.h
---- linux-2.6.32.45/drivers/staging/usbip/vhci.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/usbip/vhci.h 2011-05-04 17:56:28.000000000 -0400
-@@ -92,7 +92,7 @@ struct vhci_hcd {
- unsigned resuming:1;
- unsigned long re_timeout;
-
-- atomic_t seqnum;
-+ atomic_unchecked_t seqnum;
-
- /*
- * NOTE:
-diff -urNp linux-2.6.32.45/drivers/staging/usbip/vhci_hcd.c linux-2.6.32.45/drivers/staging/usbip/vhci_hcd.c
---- linux-2.6.32.45/drivers/staging/usbip/vhci_hcd.c 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/usbip/vhci_hcd.c 2011-05-10 22:12:33.000000000 -0400
-@@ -534,7 +534,7 @@ static void vhci_tx_urb(struct urb *urb)
- return;
- }
-
-- priv->seqnum = atomic_inc_return(&the_controller->seqnum);
-+ priv->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
- if (priv->seqnum == 0xffff)
- usbip_uinfo("seqnum max\n");
-
-@@ -793,7 +793,7 @@ static int vhci_urb_dequeue(struct usb_h
- return -ENOMEM;
- }
-
-- unlink->seqnum = atomic_inc_return(&the_controller->seqnum);
-+ unlink->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
- if (unlink->seqnum == 0xffff)
- usbip_uinfo("seqnum max\n");
-
-@@ -988,7 +988,7 @@ static int vhci_start(struct usb_hcd *hc
- vdev->rhport = rhport;
- }
-
-- atomic_set(&vhci->seqnum, 0);
-+ atomic_set_unchecked(&vhci->seqnum, 0);
- spin_lock_init(&vhci->lock);
-
-
-diff -urNp linux-2.6.32.45/drivers/staging/usbip/vhci_rx.c linux-2.6.32.45/drivers/staging/usbip/vhci_rx.c
---- linux-2.6.32.45/drivers/staging/usbip/vhci_rx.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/usbip/vhci_rx.c 2011-05-04 17:56:28.000000000 -0400
-@@ -78,7 +78,7 @@ static void vhci_recv_ret_submit(struct
- usbip_uerr("cannot find a urb of seqnum %u\n",
- pdu->base.seqnum);
- usbip_uinfo("max seqnum %d\n",
-- atomic_read(&the_controller->seqnum));
-+ atomic_read_unchecked(&the_controller->seqnum));
- usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
- return;
- }
-diff -urNp linux-2.6.32.45/drivers/staging/vme/devices/vme_user.c linux-2.6.32.45/drivers/staging/vme/devices/vme_user.c
---- linux-2.6.32.45/drivers/staging/vme/devices/vme_user.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/staging/vme/devices/vme_user.c 2011-04-17 15:56:46.000000000 -0400
-@@ -136,7 +136,7 @@ static int vme_user_ioctl(struct inode *
- static int __init vme_user_probe(struct device *, int, int);
- static int __exit vme_user_remove(struct device *, int, int);
-
--static struct file_operations vme_user_fops = {
-+static const struct file_operations vme_user_fops = {
- .open = vme_user_open,
- .release = vme_user_release,
- .read = vme_user_read,
-diff -urNp linux-2.6.32.45/drivers/telephony/ixj.c linux-2.6.32.45/drivers/telephony/ixj.c
---- linux-2.6.32.45/drivers/telephony/ixj.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/telephony/ixj.c 2011-05-16 21:46:57.000000000 -0400
-@@ -4976,6 +4976,8 @@ static int ixj_daa_cid_read(IXJ *j)
- bool mContinue;
- char *pIn, *pOut;
-
-+ pax_track_stack();
-+
- if (!SCI_Prepare(j))
- return 0;
-
-diff -urNp linux-2.6.32.45/drivers/uio/uio.c linux-2.6.32.45/drivers/uio/uio.c
---- linux-2.6.32.45/drivers/uio/uio.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/uio/uio.c 2011-05-04 17:56:20.000000000 -0400
-@@ -23,6 +23,7 @@
- #include <linux/string.h>
- #include <linux/kobject.h>
- #include <linux/uio_driver.h>
-+#include <asm/local.h>
-
- #define UIO_MAX_DEVICES 255
-
-@@ -30,10 +31,10 @@ struct uio_device {
- struct module *owner;
- struct device *dev;
- int minor;
-- atomic_t event;
-+ atomic_unchecked_t event;
- struct fasync_struct *async_queue;
- wait_queue_head_t wait;
-- int vma_count;
-+ local_t vma_count;
- struct uio_info *info;
- struct kobject *map_dir;
- struct kobject *portio_dir;
-@@ -129,7 +130,7 @@ static ssize_t map_type_show(struct kobj
- return entry->show(mem, buf);
- }
-
--static struct sysfs_ops map_sysfs_ops = {
-+static const struct sysfs_ops map_sysfs_ops = {
- .show = map_type_show,
- };
-
-@@ -217,7 +218,7 @@ static ssize_t portio_type_show(struct k
- return entry->show(port, buf);
- }
-
--static struct sysfs_ops portio_sysfs_ops = {
-+static const struct sysfs_ops portio_sysfs_ops = {
- .show = portio_type_show,
- };
-
-@@ -255,7 +256,7 @@ static ssize_t show_event(struct device
- struct uio_device *idev = dev_get_drvdata(dev);
- if (idev)
- return sprintf(buf, "%u\n",
-- (unsigned int)atomic_read(&idev->event));
-+ (unsigned int)atomic_read_unchecked(&idev->event));
- else
- return -ENODEV;
- }
-@@ -424,7 +425,7 @@ void uio_event_notify(struct uio_info *i
- {
- struct uio_device *idev = info->uio_dev;
-
-- atomic_inc(&idev->event);
-+ atomic_inc_unchecked(&idev->event);
- wake_up_interruptible(&idev->wait);
- kill_fasync(&idev->async_queue, SIGIO, POLL_IN);
- }
-@@ -477,7 +478,7 @@ static int uio_open(struct inode *inode,
- }
-
- listener->dev = idev;
-- listener->event_count = atomic_read(&idev->event);
-+ listener->event_count = atomic_read_unchecked(&idev->event);
- filep->private_data = listener;
-
- if (idev->info->open) {
-@@ -528,7 +529,7 @@ static unsigned int uio_poll(struct file
- return -EIO;
-
- poll_wait(filep, &idev->wait, wait);
-- if (listener->event_count != atomic_read(&idev->event))
-+ if (listener->event_count != atomic_read_unchecked(&idev->event))
- return POLLIN | POLLRDNORM;
- return 0;
- }
-@@ -553,7 +554,7 @@ static ssize_t uio_read(struct file *fil
- do {
- set_current_state(TASK_INTERRUPTIBLE);
-
-- event_count = atomic_read(&idev->event);
-+ event_count = atomic_read_unchecked(&idev->event);
- if (event_count != listener->event_count) {
- if (copy_to_user(buf, &event_count, count))
- retval = -EFAULT;
-@@ -624,13 +625,13 @@ static int uio_find_mem_index(struct vm_
- static void uio_vma_open(struct vm_area_struct *vma)
- {
- struct uio_device *idev = vma->vm_private_data;
-- idev->vma_count++;
-+ local_inc(&idev->vma_count);
- }
-
- static void uio_vma_close(struct vm_area_struct *vma)
- {
- struct uio_device *idev = vma->vm_private_data;
-- idev->vma_count--;
-+ local_dec(&idev->vma_count);
- }
-
- static int uio_vma_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
-@@ -840,7 +841,7 @@ int __uio_register_device(struct module
- idev->owner = owner;
- idev->info = info;
- init_waitqueue_head(&idev->wait);
-- atomic_set(&idev->event, 0);
-+ atomic_set_unchecked(&idev->event, 0);
-
- ret = uio_get_minor(idev);
- if (ret)
-diff -urNp linux-2.6.32.45/drivers/usb/atm/usbatm.c linux-2.6.32.45/drivers/usb/atm/usbatm.c
---- linux-2.6.32.45/drivers/usb/atm/usbatm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/usb/atm/usbatm.c 2011-04-17 15:56:46.000000000 -0400
-@@ -333,7 +333,7 @@ static void usbatm_extract_one_cell(stru
- if (printk_ratelimit())
- atm_warn(instance, "%s: OAM not supported (vpi %d, vci %d)!\n",
- __func__, vpi, vci);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- return;
- }
-
-@@ -361,7 +361,7 @@ static void usbatm_extract_one_cell(stru
- if (length > ATM_MAX_AAL5_PDU) {
- atm_rldbg(instance, "%s: bogus length %u (vcc: 0x%p)!\n",
- __func__, length, vcc);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- goto out;
- }
-
-@@ -370,14 +370,14 @@ static void usbatm_extract_one_cell(stru
- if (sarb->len < pdu_length) {
- atm_rldbg(instance, "%s: bogus pdu_length %u (sarb->len: %u, vcc: 0x%p)!\n",
- __func__, pdu_length, sarb->len, vcc);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- goto out;
- }
-
- if (crc32_be(~0, skb_tail_pointer(sarb) - pdu_length, pdu_length) != 0xc704dd7b) {
- atm_rldbg(instance, "%s: packet failed crc check (vcc: 0x%p)!\n",
- __func__, vcc);
-- atomic_inc(&vcc->stats->rx_err);
-+ atomic_inc_unchecked(&vcc->stats->rx_err);
- goto out;
- }
-
-@@ -387,7 +387,7 @@ static void usbatm_extract_one_cell(stru
- if (printk_ratelimit())
- atm_err(instance, "%s: no memory for skb (length: %u)!\n",
- __func__, length);
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- goto out;
- }
-
-@@ -412,7 +412,7 @@ static void usbatm_extract_one_cell(stru
-
- vcc->push(vcc, skb);
-
-- atomic_inc(&vcc->stats->rx);
-+ atomic_inc_unchecked(&vcc->stats->rx);
- out:
- skb_trim(sarb, 0);
- }
-@@ -616,7 +616,7 @@ static void usbatm_tx_process(unsigned l
- struct atm_vcc *vcc = UDSL_SKB(skb)->atm.vcc;
-
- usbatm_pop(vcc, skb);
-- atomic_inc(&vcc->stats->tx);
-+ atomic_inc_unchecked(&vcc->stats->tx);
-
- skb = skb_dequeue(&instance->sndqueue);
- }
-@@ -775,11 +775,11 @@ static int usbatm_atm_proc_read(struct a
- if (!left--)
- return sprintf(page,
- "AAL5: tx %d ( %d err ), rx %d ( %d err, %d drop )\n",
-- atomic_read(&atm_dev->stats.aal5.tx),
-- atomic_read(&atm_dev->stats.aal5.tx_err),
-- atomic_read(&atm_dev->stats.aal5.rx),
-- atomic_read(&atm_dev->stats.aal5.rx_err),
-- atomic_read(&atm_dev->stats.aal5.rx_drop));
-+ atomic_read_unchecked(&atm_dev->stats.aal5.tx),
-+ atomic_read_unchecked(&atm_dev->stats.aal5.tx_err),
-+ atomic_read_unchecked(&atm_dev->stats.aal5.rx),
-+ atomic_read_unchecked(&atm_dev->stats.aal5.rx_err),
-+ atomic_read_unchecked(&atm_dev->stats.aal5.rx_drop));
-
- if (!left--) {
- if (instance->disconnected)
-diff -urNp linux-2.6.32.45/drivers/usb/class/cdc-wdm.c linux-2.6.32.45/drivers/usb/class/cdc-wdm.c
---- linux-2.6.32.45/drivers/usb/class/cdc-wdm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/usb/class/cdc-wdm.c 2011-04-17 15:56:46.000000000 -0400
-@@ -314,7 +314,7 @@ static ssize_t wdm_write
- if (r < 0)
- goto outnp;
-
-- if (!file->f_flags && O_NONBLOCK)
-+ if (!(file->f_flags & O_NONBLOCK))
- r = wait_event_interruptible(desc->wait, !test_bit(WDM_IN_USE,
- &desc->flags));
- else
-diff -urNp linux-2.6.32.45/drivers/usb/core/hcd.c linux-2.6.32.45/drivers/usb/core/hcd.c
---- linux-2.6.32.45/drivers/usb/core/hcd.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/usb/core/hcd.c 2011-04-17 15:56:46.000000000 -0400
-@@ -2216,7 +2216,7 @@ EXPORT_SYMBOL_GPL(usb_hcd_platform_shutd
-
- #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
-
--struct usb_mon_operations *mon_ops;
-+const struct usb_mon_operations *mon_ops;
-
- /*
- * The registration is unlocked.
-@@ -2226,7 +2226,7 @@ struct usb_mon_operations *mon_ops;
- * symbols from usbcore, usbcore gets referenced and cannot be unloaded first.
- */
-
--int usb_mon_register (struct usb_mon_operations *ops)
-+int usb_mon_register (const struct usb_mon_operations *ops)
- {
-
- if (mon_ops)
-diff -urNp linux-2.6.32.45/drivers/usb/core/hcd.h linux-2.6.32.45/drivers/usb/core/hcd.h
---- linux-2.6.32.45/drivers/usb/core/hcd.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/usb/core/hcd.h 2011-04-17 15:56:46.000000000 -0400
-@@ -486,13 +486,13 @@ static inline void usbfs_cleanup(void) {
- #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
-
- struct usb_mon_operations {
-- void (*urb_submit)(struct usb_bus *bus, struct urb *urb);
-- void (*urb_submit_error)(struct usb_bus *bus, struct urb *urb, int err);
-- void (*urb_complete)(struct usb_bus *bus, struct urb *urb, int status);
-+ void (* const urb_submit)(struct usb_bus *bus, struct urb *urb);
-+ void (* const urb_submit_error)(struct usb_bus *bus, struct urb *urb, int err);
-+ void (* const urb_complete)(struct usb_bus *bus, struct urb *urb, int status);
- /* void (*urb_unlink)(struct usb_bus *bus, struct urb *urb); */
- };
-
--extern struct usb_mon_operations *mon_ops;
-+extern const struct usb_mon_operations *mon_ops;
-
- static inline void usbmon_urb_submit(struct usb_bus *bus, struct urb *urb)
- {
-@@ -514,7 +514,7 @@ static inline void usbmon_urb_complete(s
- (*mon_ops->urb_complete)(bus, urb, status);
- }
-
--int usb_mon_register(struct usb_mon_operations *ops);
-+int usb_mon_register(const struct usb_mon_operations *ops);
- void usb_mon_deregister(void);
-
- #else
-diff -urNp linux-2.6.32.45/drivers/usb/core/message.c linux-2.6.32.45/drivers/usb/core/message.c
---- linux-2.6.32.45/drivers/usb/core/message.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/usb/core/message.c 2011-04-17 15:56:46.000000000 -0400
-@@ -914,8 +914,8 @@ char *usb_cache_string(struct usb_device
- buf = kmalloc(MAX_USB_STRING_SIZE, GFP_NOIO);
- if (buf) {
- len = usb_string(udev, index, buf, MAX_USB_STRING_SIZE);
-- if (len > 0) {
-- smallbuf = kmalloc(++len, GFP_NOIO);
-+ if (len++ > 0) {
-+ smallbuf = kmalloc(len, GFP_NOIO);
- if (!smallbuf)
- return buf;
- memcpy(smallbuf, buf, len);
-diff -urNp linux-2.6.32.45/drivers/usb/misc/appledisplay.c linux-2.6.32.45/drivers/usb/misc/appledisplay.c
---- linux-2.6.32.45/drivers/usb/misc/appledisplay.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/usb/misc/appledisplay.c 2011-04-17 15:56:46.000000000 -0400
-@@ -178,7 +178,7 @@ static int appledisplay_bl_get_brightnes
- return pdata->msgdata[1];
- }
-
--static struct backlight_ops appledisplay_bl_data = {
-+static const struct backlight_ops appledisplay_bl_data = {
- .get_brightness = appledisplay_bl_get_brightness,
- .update_status = appledisplay_bl_update_status,
- };
-diff -urNp linux-2.6.32.45/drivers/usb/mon/mon_main.c linux-2.6.32.45/drivers/usb/mon/mon_main.c
---- linux-2.6.32.45/drivers/usb/mon/mon_main.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/usb/mon/mon_main.c 2011-04-17 15:56:46.000000000 -0400
-@@ -238,7 +238,7 @@ static struct notifier_block mon_nb = {
- /*
- * Ops
- */
--static struct usb_mon_operations mon_ops_0 = {
-+static const struct usb_mon_operations mon_ops_0 = {
- .urb_submit = mon_submit,
- .urb_submit_error = mon_submit_error,
- .urb_complete = mon_complete,
-diff -urNp linux-2.6.32.45/drivers/usb/wusbcore/wa-hc.h linux-2.6.32.45/drivers/usb/wusbcore/wa-hc.h
---- linux-2.6.32.45/drivers/usb/wusbcore/wa-hc.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/usb/wusbcore/wa-hc.h 2011-05-04 17:56:28.000000000 -0400
-@@ -192,7 +192,7 @@ struct wahc {
- struct list_head xfer_delayed_list;
- spinlock_t xfer_list_lock;
- struct work_struct xfer_work;
-- atomic_t xfer_id_count;
-+ atomic_unchecked_t xfer_id_count;
- };
-
-
-@@ -246,7 +246,7 @@ static inline void wa_init(struct wahc *
- INIT_LIST_HEAD(&wa->xfer_delayed_list);
- spin_lock_init(&wa->xfer_list_lock);
- INIT_WORK(&wa->xfer_work, wa_urb_enqueue_run);
-- atomic_set(&wa->xfer_id_count, 1);
-+ atomic_set_unchecked(&wa->xfer_id_count, 1);
- }
-
- /**
-diff -urNp linux-2.6.32.45/drivers/usb/wusbcore/wa-xfer.c linux-2.6.32.45/drivers/usb/wusbcore/wa-xfer.c
---- linux-2.6.32.45/drivers/usb/wusbcore/wa-xfer.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/usb/wusbcore/wa-xfer.c 2011-05-04 17:56:28.000000000 -0400
-@@ -293,7 +293,7 @@ out:
- */
- static void wa_xfer_id_init(struct wa_xfer *xfer)
- {
-- xfer->id = atomic_add_return(1, &xfer->wa->xfer_id_count);
-+ xfer->id = atomic_add_return_unchecked(1, &xfer->wa->xfer_id_count);
- }
-
- /*
-diff -urNp linux-2.6.32.45/drivers/uwb/wlp/messages.c linux-2.6.32.45/drivers/uwb/wlp/messages.c
---- linux-2.6.32.45/drivers/uwb/wlp/messages.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/uwb/wlp/messages.c 2011-04-17 15:56:46.000000000 -0400
-@@ -903,7 +903,7 @@ int wlp_parse_f0(struct wlp *wlp, struct
- size_t len = skb->len;
- size_t used;
- ssize_t result;
-- struct wlp_nonce enonce, rnonce;
-+ struct wlp_nonce enonce = {{0}}, rnonce = {{0}};
- enum wlp_assc_error assc_err;
- char enonce_buf[WLP_WSS_NONCE_STRSIZE];
- char rnonce_buf[WLP_WSS_NONCE_STRSIZE];
-diff -urNp linux-2.6.32.45/drivers/uwb/wlp/sysfs.c linux-2.6.32.45/drivers/uwb/wlp/sysfs.c
---- linux-2.6.32.45/drivers/uwb/wlp/sysfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/uwb/wlp/sysfs.c 2011-04-17 15:56:46.000000000 -0400
-@@ -615,8 +615,7 @@ ssize_t wlp_wss_attr_store(struct kobjec
- return ret;
- }
-
--static
--struct sysfs_ops wss_sysfs_ops = {
-+static const struct sysfs_ops wss_sysfs_ops = {
- .show = wlp_wss_attr_show,
- .store = wlp_wss_attr_store,
- };
-diff -urNp linux-2.6.32.45/drivers/video/atmel_lcdfb.c linux-2.6.32.45/drivers/video/atmel_lcdfb.c
---- linux-2.6.32.45/drivers/video/atmel_lcdfb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/video/atmel_lcdfb.c 2011-04-17 15:56:46.000000000 -0400
-@@ -110,7 +110,7 @@ static int atmel_bl_get_brightness(struc
- return lcdc_readl(sinfo, ATMEL_LCDC_CONTRAST_VAL);
- }
-
--static struct backlight_ops atmel_lcdc_bl_ops = {
-+static const struct backlight_ops atmel_lcdc_bl_ops = {
- .update_status = atmel_bl_update_status,
- .get_brightness = atmel_bl_get_brightness,
- };
-diff -urNp linux-2.6.32.45/drivers/video/aty/aty128fb.c linux-2.6.32.45/drivers/video/aty/aty128fb.c
---- linux-2.6.32.45/drivers/video/aty/aty128fb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/video/aty/aty128fb.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1787,7 +1787,7 @@ static int aty128_bl_get_brightness(stru
- return bd->props.brightness;
- }
-
--static struct backlight_ops aty128_bl_data = {
-+static const struct backlight_ops aty128_bl_data = {
- .get_brightness = aty128_bl_get_brightness,
- .update_status = aty128_bl_update_status,
- };
-diff -urNp linux-2.6.32.45/drivers/video/aty/atyfb_base.c linux-2.6.32.45/drivers/video/aty/atyfb_base.c
---- linux-2.6.32.45/drivers/video/aty/atyfb_base.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/video/aty/atyfb_base.c 2011-04-17 15:56:46.000000000 -0400
-@@ -2225,7 +2225,7 @@ static int aty_bl_get_brightness(struct
- return bd->props.brightness;
- }
-
--static struct backlight_ops aty_bl_data = {
-+static const struct backlight_ops aty_bl_data = {
- .get_brightness = aty_bl_get_brightness,
- .update_status = aty_bl_update_status,
- };
-diff -urNp linux-2.6.32.45/drivers/video/aty/radeon_backlight.c linux-2.6.32.45/drivers/video/aty/radeon_backlight.c
---- linux-2.6.32.45/drivers/video/aty/radeon_backlight.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/video/aty/radeon_backlight.c 2011-04-17 15:56:46.000000000 -0400
-@@ -127,7 +127,7 @@ static int radeon_bl_get_brightness(stru
- return bd->props.brightness;
- }
-
--static struct backlight_ops radeon_bl_data = {
-+static const struct backlight_ops radeon_bl_data = {
- .get_brightness = radeon_bl_get_brightness,
- .update_status = radeon_bl_update_status,
- };
-diff -urNp linux-2.6.32.45/drivers/video/backlight/adp5520_bl.c linux-2.6.32.45/drivers/video/backlight/adp5520_bl.c
---- linux-2.6.32.45/drivers/video/backlight/adp5520_bl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/video/backlight/adp5520_bl.c 2011-04-17 15:56:46.000000000 -0400
-@@ -84,7 +84,7 @@ static int adp5520_bl_get_brightness(str
- return error ? data->current_brightness : reg_val;
- }
-
--static struct backlight_ops adp5520_bl_ops = {
-+static const struct backlight_ops adp5520_bl_ops = {
- .update_status = adp5520_bl_update_status,
- .get_brightness = adp5520_bl_get_brightness,
- };
-diff -urNp linux-2.6.32.45/drivers/video/backlight/adx_bl.c linux-2.6.32.45/drivers/video/backlight/adx_bl.c
---- linux-2.6.32.45/drivers/video/backlight/adx_bl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/video/backlight/adx_bl.c 2011-04-17 15:56:46.000000000 -0400
-@@ -61,7 +61,7 @@ static int adx_backlight_check_fb(struct
- return 1;
- }
-
--static struct backlight_ops adx_backlight_ops = {
-+static const struct backlight_ops adx_backlight_ops = {
- .options = 0,
- .update_status = adx_backlight_update_status,
- .get_brightness = adx_backlight_get_brightness,
-diff -urNp linux-2.6.32.45/drivers/video/backlight/atmel-pwm-bl.c linux-2.6.32.45/drivers/video/backlight/atmel-pwm-bl.c
---- linux-2.6.32.45/drivers/video/backlight/atmel-pwm-bl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/video/backlight/atmel-pwm-bl.c 2011-04-17 15:56:46.000000000 -0400
-@@ -113,7 +113,7 @@ static int atmel_pwm_bl_init_pwm(struct
- return pwm_channel_enable(&pwmbl->pwmc);
- }
-
--static struct backlight_ops atmel_pwm_bl_ops = {
-+static const struct backlight_ops atmel_pwm_bl_ops = {
- .get_brightness = atmel_pwm_bl_get_intensity,
- .update_status = atmel_pwm_bl_set_intensity,
- };
-diff -urNp linux-2.6.32.45/drivers/video/backlight/backlight.c linux-2.6.32.45/drivers/video/backlight/backlight.c
---- linux-2.6.32.45/drivers/video/backlight/backlight.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/video/backlight/backlight.c 2011-04-17 15:56:46.000000000 -0400
-@@ -269,7 +269,7 @@ EXPORT_SYMBOL(backlight_force_update);
- * ERR_PTR() or a pointer to the newly allocated device.
- */
- struct backlight_device *backlight_device_register(const char *name,
-- struct device *parent, void *devdata, struct backlight_ops *ops)
-+ struct device *parent, void *devdata, const struct backlight_ops *ops)
- {
- struct backlight_device *new_bd;
- int rc;
-diff -urNp linux-2.6.32.45/drivers/video/backlight/corgi_lcd.c linux-2.6.32.45/drivers/video/backlight/corgi_lcd.c
---- linux-2.6.32.45/drivers/video/backlight/corgi_lcd.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/video/backlight/corgi_lcd.c 2011-04-17 15:56:46.000000000 -0400
-@@ -451,7 +451,7 @@ void corgi_lcd_limit_intensity(int limit
- }
- EXPORT_SYMBOL(corgi_lcd_limit_intensity);
-
--static struct backlight_ops corgi_bl_ops = {
-+static const struct backlight_ops corgi_bl_ops = {
- .get_brightness = corgi_bl_get_intensity,
- .update_status = corgi_bl_update_status,
- };
-diff -urNp linux-2.6.32.45/drivers/video/backlight/cr_bllcd.c linux-2.6.32.45/drivers/video/backlight/cr_bllcd.c
---- linux-2.6.32.45/drivers/video/backlight/cr_bllcd.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/video/backlight/cr_bllcd.c 2011-04-17 15:56:46.000000000 -0400
-@@ -108,7 +108,7 @@ static int cr_backlight_get_intensity(st
- return intensity;
- }
-
--static struct backlight_ops cr_backlight_ops = {
-+static const struct backlight_ops cr_backlight_ops = {
- .get_brightness = cr_backlight_get_intensity,
- .update_status = cr_backlight_set_intensity,
- };
-diff -urNp linux-2.6.32.45/drivers/video/backlight/da903x_bl.c linux-2.6.32.45/drivers/video/backlight/da903x_bl.c
---- linux-2.6.32.45/drivers/video/backlight/da903x_bl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/video/backlight/da903x_bl.c 2011-04-17 15:56:46.000000000 -0400
-@@ -94,7 +94,7 @@ static int da903x_backlight_get_brightne
- return data->current_brightness;
- }
-
--static struct backlight_ops da903x_backlight_ops = {
-+static const struct backlight_ops da903x_backlight_ops = {
- .update_status = da903x_backlight_update_status,
- .get_brightness = da903x_backlight_get_brightness,
- };
-diff -urNp linux-2.6.32.45/drivers/video/backlight/generic_bl.c linux-2.6.32.45/drivers/video/backlight/generic_bl.c
---- linux-2.6.32.45/drivers/video/backlight/generic_bl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/video/backlight/generic_bl.c 2011-04-17 15:56:46.000000000 -0400
-@@ -70,7 +70,7 @@ void corgibl_limit_intensity(int limit)
- }
- EXPORT_SYMBOL(corgibl_limit_intensity);
-
--static struct backlight_ops genericbl_ops = {
-+static const struct backlight_ops genericbl_ops = {
- .options = BL_CORE_SUSPENDRESUME,
- .get_brightness = genericbl_get_intensity,
- .update_status = genericbl_send_intensity,
-diff -urNp linux-2.6.32.45/drivers/video/backlight/hp680_bl.c linux-2.6.32.45/drivers/video/backlight/hp680_bl.c
---- linux-2.6.32.45/drivers/video/backlight/hp680_bl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/video/backlight/hp680_bl.c 2011-04-17 15:56:46.000000000 -0400
-@@ -98,7 +98,7 @@ static int hp680bl_get_intensity(struct
- return current_intensity;
- }
-
--static struct backlight_ops hp680bl_ops = {
-+static const struct backlight_ops hp680bl_ops = {
- .get_brightness = hp680bl_get_intensity,
- .update_status = hp680bl_set_intensity,
- };
-diff -urNp linux-2.6.32.45/drivers/video/backlight/jornada720_bl.c linux-2.6.32.45/drivers/video/backlight/jornada720_bl.c
---- linux-2.6.32.45/drivers/video/backlight/jornada720_bl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/video/backlight/jornada720_bl.c 2011-04-17 15:56:46.000000000 -0400
-@@ -93,7 +93,7 @@ out:
- return ret;
- }
-
--static struct backlight_ops jornada_bl_ops = {
-+static const struct backlight_ops jornada_bl_ops = {
- .get_brightness = jornada_bl_get_brightness,
- .update_status = jornada_bl_update_status,
- .options = BL_CORE_SUSPENDRESUME,
-diff -urNp linux-2.6.32.45/drivers/video/backlight/kb3886_bl.c linux-2.6.32.45/drivers/video/backlight/kb3886_bl.c
---- linux-2.6.32.45/drivers/video/backlight/kb3886_bl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/video/backlight/kb3886_bl.c 2011-04-17 15:56:46.000000000 -0400
-@@ -134,7 +134,7 @@ static int kb3886bl_get_intensity(struct
- return kb3886bl_intensity;
- }
-
--static struct backlight_ops kb3886bl_ops = {
-+static const struct backlight_ops kb3886bl_ops = {
- .get_brightness = kb3886bl_get_intensity,
- .update_status = kb3886bl_send_intensity,
- };
-diff -urNp linux-2.6.32.45/drivers/video/backlight/locomolcd.c linux-2.6.32.45/drivers/video/backlight/locomolcd.c
---- linux-2.6.32.45/drivers/video/backlight/locomolcd.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/video/backlight/locomolcd.c 2011-04-17 15:56:46.000000000 -0400
-@@ -141,7 +141,7 @@ static int locomolcd_get_intensity(struc
- return current_intensity;
- }
-
--static struct backlight_ops locomobl_data = {
-+static const struct backlight_ops locomobl_data = {
- .get_brightness = locomolcd_get_intensity,
- .update_status = locomolcd_set_intensity,
- };
-diff -urNp linux-2.6.32.45/drivers/video/backlight/mbp_nvidia_bl.c linux-2.6.32.45/drivers/video/backlight/mbp_nvidia_bl.c
---- linux-2.6.32.45/drivers/video/backlight/mbp_nvidia_bl.c 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.45/drivers/video/backlight/mbp_nvidia_bl.c 2011-05-10 22:12:33.000000000 -0400
-@@ -33,7 +33,7 @@ struct dmi_match_data {
- unsigned long iostart;
- unsigned long iolen;
- /* Backlight operations structure. */
-- struct backlight_ops backlight_ops;
-+ const struct backlight_ops backlight_ops;
- };
-
- /* Module parameters. */
-diff -urNp linux-2.6.32.45/drivers/video/backlight/omap1_bl.c linux-2.6.32.45/drivers/video/backlight/omap1_bl.c
---- linux-2.6.32.45/drivers/video/backlight/omap1_bl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/video/backlight/omap1_bl.c 2011-04-17 15:56:46.000000000 -0400
-@@ -125,7 +125,7 @@ static int omapbl_get_intensity(struct b
- return bl->current_intensity;
- }
-
--static struct backlight_ops omapbl_ops = {
-+static const struct backlight_ops omapbl_ops = {
- .get_brightness = omapbl_get_intensity,
- .update_status = omapbl_update_status,
- };
-diff -urNp linux-2.6.32.45/drivers/video/backlight/progear_bl.c linux-2.6.32.45/drivers/video/backlight/progear_bl.c
---- linux-2.6.32.45/drivers/video/backlight/progear_bl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/video/backlight/progear_bl.c 2011-04-17 15:56:46.000000000 -0400
-@@ -54,7 +54,7 @@ static int progearbl_get_intensity(struc
- return intensity - HW_LEVEL_MIN;
- }
-
--static struct backlight_ops progearbl_ops = {
-+static const struct backlight_ops progearbl_ops = {
- .get_brightness = progearbl_get_intensity,
- .update_status = progearbl_set_intensity,
- };
-diff -urNp linux-2.6.32.45/drivers/video/backlight/pwm_bl.c linux-2.6.32.45/drivers/video/backlight/pwm_bl.c
---- linux-2.6.32.45/drivers/video/backlight/pwm_bl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/video/backlight/pwm_bl.c 2011-04-17 15:56:46.000000000 -0400
-@@ -56,7 +56,7 @@ static int pwm_backlight_get_brightness(
- return bl->props.brightness;
- }
-
--static struct backlight_ops pwm_backlight_ops = {
-+static const struct backlight_ops pwm_backlight_ops = {
- .update_status = pwm_backlight_update_status,
- .get_brightness = pwm_backlight_get_brightness,
- };
-diff -urNp linux-2.6.32.45/drivers/video/backlight/tosa_bl.c linux-2.6.32.45/drivers/video/backlight/tosa_bl.c
---- linux-2.6.32.45/drivers/video/backlight/tosa_bl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/video/backlight/tosa_bl.c 2011-04-17 15:56:46.000000000 -0400
-@@ -72,7 +72,7 @@ static int tosa_bl_get_brightness(struct
- return props->brightness;
- }
-
--static struct backlight_ops bl_ops = {
-+static const struct backlight_ops bl_ops = {
- .get_brightness = tosa_bl_get_brightness,
- .update_status = tosa_bl_update_status,
- };
-diff -urNp linux-2.6.32.45/drivers/video/backlight/wm831x_bl.c linux-2.6.32.45/drivers/video/backlight/wm831x_bl.c
---- linux-2.6.32.45/drivers/video/backlight/wm831x_bl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/video/backlight/wm831x_bl.c 2011-04-17 15:56:46.000000000 -0400
-@@ -112,7 +112,7 @@ static int wm831x_backlight_get_brightne
- return data->current_brightness;
- }
-
--static struct backlight_ops wm831x_backlight_ops = {
-+static const struct backlight_ops wm831x_backlight_ops = {
- .options = BL_CORE_SUSPENDRESUME,
- .update_status = wm831x_backlight_update_status,
- .get_brightness = wm831x_backlight_get_brightness,
-diff -urNp linux-2.6.32.45/drivers/video/bf54x-lq043fb.c linux-2.6.32.45/drivers/video/bf54x-lq043fb.c
---- linux-2.6.32.45/drivers/video/bf54x-lq043fb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/video/bf54x-lq043fb.c 2011-04-17 15:56:46.000000000 -0400
-@@ -463,7 +463,7 @@ static int bl_get_brightness(struct back
- return 0;
- }
-
--static struct backlight_ops bfin_lq043fb_bl_ops = {
-+static const struct backlight_ops bfin_lq043fb_bl_ops = {
- .get_brightness = bl_get_brightness,
- };
-
-diff -urNp linux-2.6.32.45/drivers/video/bfin-t350mcqb-fb.c linux-2.6.32.45/drivers/video/bfin-t350mcqb-fb.c
---- linux-2.6.32.45/drivers/video/bfin-t350mcqb-fb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/video/bfin-t350mcqb-fb.c 2011-04-17 15:56:46.000000000 -0400
-@@ -381,7 +381,7 @@ static int bl_get_brightness(struct back
- return 0;
- }
-
--static struct backlight_ops bfin_lq043fb_bl_ops = {
-+static const struct backlight_ops bfin_lq043fb_bl_ops = {
- .get_brightness = bl_get_brightness,
- };
-
-diff -urNp linux-2.6.32.45/drivers/video/fbcmap.c linux-2.6.32.45/drivers/video/fbcmap.c
---- linux-2.6.32.45/drivers/video/fbcmap.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/video/fbcmap.c 2011-04-17 15:56:46.000000000 -0400
-@@ -266,8 +266,7 @@ int fb_set_user_cmap(struct fb_cmap_user
- rc = -ENODEV;
- goto out;
- }
-- if (cmap->start < 0 || (!info->fbops->fb_setcolreg &&
-- !info->fbops->fb_setcmap)) {
-+ if (!info->fbops->fb_setcolreg && !info->fbops->fb_setcmap) {
- rc = -EINVAL;
- goto out1;
- }
-diff -urNp linux-2.6.32.45/drivers/video/fbmem.c linux-2.6.32.45/drivers/video/fbmem.c
---- linux-2.6.32.45/drivers/video/fbmem.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/video/fbmem.c 2011-05-16 21:46:57.000000000 -0400
-@@ -403,7 +403,7 @@ static void fb_do_show_logo(struct fb_in
- image->dx += image->width + 8;
- }
- } else if (rotate == FB_ROTATE_UD) {
-- for (x = 0; x < num && image->dx >= 0; x++) {
-+ for (x = 0; x < num && (__s32)image->dx >= 0; x++) {
- info->fbops->fb_imageblit(info, image);
- image->dx -= image->width + 8;
- }
-@@ -415,7 +415,7 @@ static void fb_do_show_logo(struct fb_in
- image->dy += image->height + 8;
- }
- } else if (rotate == FB_ROTATE_CCW) {
-- for (x = 0; x < num && image->dy >= 0; x++) {
-+ for (x = 0; x < num && (__s32)image->dy >= 0; x++) {
- info->fbops->fb_imageblit(info, image);
- image->dy -= image->height + 8;
- }
-@@ -915,6 +915,8 @@ fb_set_var(struct fb_info *info, struct
- int flags = info->flags;
- int ret = 0;
-
-+ pax_track_stack();
-+
- if (var->activate & FB_ACTIVATE_INV_MODE) {
- struct fb_videomode mode1, mode2;
-
-@@ -1040,6 +1042,8 @@ static long do_fb_ioctl(struct fb_info *
- void __user *argp = (void __user *)arg;
- long ret = 0;
-
-+ pax_track_stack();
-+
- switch (cmd) {
- case FBIOGET_VSCREENINFO:
- if (!lock_fb_info(info))
-@@ -1119,7 +1123,7 @@ static long do_fb_ioctl(struct fb_info *
- return -EFAULT;
- if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
- return -EINVAL;
-- if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX)
-+ if (con2fb.framebuffer >= FB_MAX)
- return -EINVAL;
- if (!registered_fb[con2fb.framebuffer])
- request_module("fb%d", con2fb.framebuffer);
-diff -urNp linux-2.6.32.45/drivers/video/i810/i810_accel.c linux-2.6.32.45/drivers/video/i810/i810_accel.c
---- linux-2.6.32.45/drivers/video/i810/i810_accel.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/video/i810/i810_accel.c 2011-04-17 15:56:46.000000000 -0400
-@@ -73,6 +73,7 @@ static inline int wait_for_space(struct
- }
- }
- printk("ringbuffer lockup!!!\n");
-+ printk("head:%u tail:%u iring.size:%u space:%u\n", head, tail, par->iring.size, space);
- i810_report_error(mmio);
- par->dev_flags |= LOCKUP;
- info->pixmap.scan_align = 1;
-diff -urNp linux-2.6.32.45/drivers/video/nvidia/nv_backlight.c linux-2.6.32.45/drivers/video/nvidia/nv_backlight.c
---- linux-2.6.32.45/drivers/video/nvidia/nv_backlight.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/video/nvidia/nv_backlight.c 2011-04-17 15:56:46.000000000 -0400
-@@ -87,7 +87,7 @@ static int nvidia_bl_get_brightness(stru
- return bd->props.brightness;
- }
-
--static struct backlight_ops nvidia_bl_ops = {
-+static const struct backlight_ops nvidia_bl_ops = {
- .get_brightness = nvidia_bl_get_brightness,
- .update_status = nvidia_bl_update_status,
- };
-diff -urNp linux-2.6.32.45/drivers/video/riva/fbdev.c linux-2.6.32.45/drivers/video/riva/fbdev.c
---- linux-2.6.32.45/drivers/video/riva/fbdev.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/video/riva/fbdev.c 2011-04-17 15:56:46.000000000 -0400
-@@ -331,7 +331,7 @@ static int riva_bl_get_brightness(struct
- return bd->props.brightness;
- }
-
--static struct backlight_ops riva_bl_ops = {
-+static const struct backlight_ops riva_bl_ops = {
- .get_brightness = riva_bl_get_brightness,
- .update_status = riva_bl_update_status,
- };
-diff -urNp linux-2.6.32.45/drivers/video/uvesafb.c linux-2.6.32.45/drivers/video/uvesafb.c
---- linux-2.6.32.45/drivers/video/uvesafb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/video/uvesafb.c 2011-04-17 15:56:46.000000000 -0400
-@@ -18,6 +18,7 @@
- #include <linux/fb.h>
- #include <linux/io.h>
- #include <linux/mutex.h>
-+#include <linux/moduleloader.h>
- #include <video/edid.h>
- #include <video/uvesafb.h>
- #ifdef CONFIG_X86
-@@ -120,7 +121,7 @@ static int uvesafb_helper_start(void)
- NULL,
- };
-
-- return call_usermodehelper(v86d_path, argv, envp, 1);
-+ return call_usermodehelper(v86d_path, argv, envp, UMH_WAIT_PROC);
- }
-
- /*
-@@ -568,10 +569,32 @@ static int __devinit uvesafb_vbe_getpmi(
- if ((task->t.regs.eax & 0xffff) != 0x4f || task->t.regs.es < 0xc000) {
- par->pmi_setpal = par->ypan = 0;
- } else {
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+#ifdef CONFIG_MODULES
-+ par->pmi_code = module_alloc_exec((u16)task->t.regs.ecx);
-+#endif
-+ if (!par->pmi_code) {
-+ par->pmi_setpal = par->ypan = 0;
-+ return 0;
-+ }
-+#endif
-+
- par->pmi_base = (u16 *)phys_to_virt(((u32)task->t.regs.es << 4)
- + task->t.regs.edi);
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+ pax_open_kernel();
-+ memcpy(par->pmi_code, par->pmi_base, (u16)task->t.regs.ecx);
-+ pax_close_kernel();
-+
-+ par->pmi_start = ktva_ktla(par->pmi_code + par->pmi_base[1]);
-+ par->pmi_pal = ktva_ktla(par->pmi_code + par->pmi_base[2]);
-+#else
- par->pmi_start = (u8 *)par->pmi_base + par->pmi_base[1];
- par->pmi_pal = (u8 *)par->pmi_base + par->pmi_base[2];
-+#endif
-+
- printk(KERN_INFO "uvesafb: protected mode interface info at "
- "%04x:%04x\n",
- (u16)task->t.regs.es, (u16)task->t.regs.edi);
-@@ -1799,6 +1822,11 @@ out:
- if (par->vbe_modes)
- kfree(par->vbe_modes);
-
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+ if (par->pmi_code)
-+ module_free_exec(NULL, par->pmi_code);
-+#endif
-+
- framebuffer_release(info);
- return err;
- }
-@@ -1825,6 +1853,12 @@ static int uvesafb_remove(struct platfor
- kfree(par->vbe_state_orig);
- if (par->vbe_state_saved)
- kfree(par->vbe_state_saved);
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+ if (par->pmi_code)
-+ module_free_exec(NULL, par->pmi_code);
-+#endif
-+
- }
-
- framebuffer_release(info);
-diff -urNp linux-2.6.32.45/drivers/video/vesafb.c linux-2.6.32.45/drivers/video/vesafb.c
---- linux-2.6.32.45/drivers/video/vesafb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/video/vesafb.c 2011-08-05 20:33:55.000000000 -0400
-@@ -9,6 +9,7 @@
- */
-
- #include <linux/module.h>
-+#include <linux/moduleloader.h>
- #include <linux/kernel.h>
- #include <linux/errno.h>
- #include <linux/string.h>
-@@ -53,8 +54,8 @@ static int vram_remap __initdata; /*
- static int vram_total __initdata; /* Set total amount of memory */
- static int pmi_setpal __read_mostly = 1; /* pmi for palette changes ??? */
- static int ypan __read_mostly; /* 0..nothing, 1..ypan, 2..ywrap */
--static void (*pmi_start)(void) __read_mostly;
--static void (*pmi_pal) (void) __read_mostly;
-+static void (*pmi_start)(void) __read_only;
-+static void (*pmi_pal) (void) __read_only;
- static int depth __read_mostly;
- static int vga_compat __read_mostly;
- /* --------------------------------------------------------------------- */
-@@ -233,6 +234,7 @@ static int __init vesafb_probe(struct pl
- unsigned int size_vmode;
- unsigned int size_remap;
- unsigned int size_total;
-+ void *pmi_code = NULL;
-
- if (screen_info.orig_video_isVGA != VIDEO_TYPE_VLFB)
- return -ENODEV;
-@@ -275,10 +277,6 @@ static int __init vesafb_probe(struct pl
- size_remap = size_total;
- vesafb_fix.smem_len = size_remap;
-
--#ifndef __i386__
-- screen_info.vesapm_seg = 0;
--#endif
--
- if (!request_mem_region(vesafb_fix.smem_start, size_total, "vesafb")) {
- printk(KERN_WARNING
- "vesafb: cannot reserve video memory at 0x%lx\n",
-@@ -315,9 +313,21 @@ static int __init vesafb_probe(struct pl
- printk(KERN_INFO "vesafb: mode is %dx%dx%d, linelength=%d, pages=%d\n",
- vesafb_defined.xres, vesafb_defined.yres, vesafb_defined.bits_per_pixel, vesafb_fix.line_length, screen_info.pages);
-
-+#ifdef __i386__
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+ pmi_code = module_alloc_exec(screen_info.vesapm_size);
-+ if (!pmi_code)
-+#elif !defined(CONFIG_PAX_KERNEXEC)
-+ if (0)
-+#endif
-+
-+#endif
-+ screen_info.vesapm_seg = 0;
-+
- if (screen_info.vesapm_seg) {
-- printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x\n",
-- screen_info.vesapm_seg,screen_info.vesapm_off);
-+ printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x %04x bytes\n",
-+ screen_info.vesapm_seg,screen_info.vesapm_off,screen_info.vesapm_size);
- }
-
- if (screen_info.vesapm_seg < 0xc000)
-@@ -325,9 +335,25 @@ static int __init vesafb_probe(struct pl
-
- if (ypan || pmi_setpal) {
- unsigned short *pmi_base;
-+
- pmi_base = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
-- pmi_start = (void*)((char*)pmi_base + pmi_base[1]);
-- pmi_pal = (void*)((char*)pmi_base + pmi_base[2]);
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+ pax_open_kernel();
-+ memcpy(pmi_code, pmi_base, screen_info.vesapm_size);
-+#else
-+ pmi_code = pmi_base;
-+#endif
-+
-+ pmi_start = (void*)((char*)pmi_code + pmi_base[1]);
-+ pmi_pal = (void*)((char*)pmi_code + pmi_base[2]);
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+ pmi_start = ktva_ktla(pmi_start);
-+ pmi_pal = ktva_ktla(pmi_pal);
-+ pax_close_kernel();
-+#endif
-+
- printk(KERN_INFO "vesafb: pmi: set display start = %p, set palette = %p\n",pmi_start,pmi_pal);
- if (pmi_base[3]) {
- printk(KERN_INFO "vesafb: pmi: ports = ");
-@@ -469,6 +495,11 @@ static int __init vesafb_probe(struct pl
- info->node, info->fix.id);
- return 0;
- err:
-+
-+#if defined(__i386__) && defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+ module_free_exec(NULL, pmi_code);
-+#endif
-+
- if (info->screen_base)
- iounmap(info->screen_base);
- framebuffer_release(info);
-diff -urNp linux-2.6.32.45/drivers/xen/sys-hypervisor.c linux-2.6.32.45/drivers/xen/sys-hypervisor.c
---- linux-2.6.32.45/drivers/xen/sys-hypervisor.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/drivers/xen/sys-hypervisor.c 2011-04-17 15:56:46.000000000 -0400
-@@ -425,7 +425,7 @@ static ssize_t hyp_sysfs_store(struct ko
- return 0;
- }
-
--static struct sysfs_ops hyp_sysfs_ops = {
-+static const struct sysfs_ops hyp_sysfs_ops = {
- .show = hyp_sysfs_show,
- .store = hyp_sysfs_store,
- };
-diff -urNp linux-2.6.32.45/fs/9p/vfs_inode.c linux-2.6.32.45/fs/9p/vfs_inode.c
---- linux-2.6.32.45/fs/9p/vfs_inode.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/9p/vfs_inode.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1079,7 +1079,7 @@ static void *v9fs_vfs_follow_link(struct
- static void
- v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
- {
-- char *s = nd_get_link(nd);
-+ const char *s = nd_get_link(nd);
-
- P9_DPRINTK(P9_DEBUG_VFS, " %s %s\n", dentry->d_name.name,
- IS_ERR(s) ? "<error>" : s);
-diff -urNp linux-2.6.32.45/fs/aio.c linux-2.6.32.45/fs/aio.c
---- linux-2.6.32.45/fs/aio.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/aio.c 2011-06-04 20:40:21.000000000 -0400
-@@ -115,7 +115,7 @@ static int aio_setup_ring(struct kioctx
- size += sizeof(struct io_event) * nr_events;
- nr_pages = (size + PAGE_SIZE-1) >> PAGE_SHIFT;
-
-- if (nr_pages < 0)
-+ if (nr_pages <= 0)
- return -EINVAL;
-
- nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
-@@ -1089,6 +1089,8 @@ static int read_events(struct kioctx *ct
- struct aio_timeout to;
- int retry = 0;
-
-+ pax_track_stack();
-+
- /* needed to zero any padding within an entry (there shouldn't be
- * any, but C is fun!
- */
-@@ -1382,13 +1384,18 @@ static ssize_t aio_fsync(struct kiocb *i
- static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb)
- {
- ssize_t ret;
-+ struct iovec iovstack;
-
- ret = rw_copy_check_uvector(type, (struct iovec __user *)kiocb->ki_buf,
- kiocb->ki_nbytes, 1,
-- &kiocb->ki_inline_vec, &kiocb->ki_iovec);
-+ &iovstack, &kiocb->ki_iovec);
- if (ret < 0)
- goto out;
-
-+ if (kiocb->ki_iovec == &iovstack) {
-+ kiocb->ki_inline_vec = iovstack;
-+ kiocb->ki_iovec = &kiocb->ki_inline_vec;
-+ }
- kiocb->ki_nr_segs = kiocb->ki_nbytes;
- kiocb->ki_cur_seg = 0;
- /* ki_nbytes/left now reflect bytes instead of segs */
-diff -urNp linux-2.6.32.45/fs/attr.c linux-2.6.32.45/fs/attr.c
---- linux-2.6.32.45/fs/attr.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/attr.c 2011-04-17 15:56:46.000000000 -0400
-@@ -83,6 +83,7 @@ int inode_newsize_ok(const struct inode
- unsigned long limit;
-
- limit = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
-+ gr_learn_resource(current, RLIMIT_FSIZE, (unsigned long)offset, 1);
- if (limit != RLIM_INFINITY && offset > limit)
- goto out_sig;
- if (offset > inode->i_sb->s_maxbytes)
-diff -urNp linux-2.6.32.45/fs/autofs/root.c linux-2.6.32.45/fs/autofs/root.c
---- linux-2.6.32.45/fs/autofs/root.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/autofs/root.c 2011-04-17 15:56:46.000000000 -0400
-@@ -299,7 +299,8 @@ static int autofs_root_symlink(struct in
- set_bit(n,sbi->symlink_bitmap);
- sl = &sbi->symlink[n];
- sl->len = strlen(symname);
-- sl->data = kmalloc(slsize = sl->len+1, GFP_KERNEL);
-+ slsize = sl->len+1;
-+ sl->data = kmalloc(slsize, GFP_KERNEL);
- if (!sl->data) {
- clear_bit(n,sbi->symlink_bitmap);
- unlock_kernel();
-diff -urNp linux-2.6.32.45/fs/autofs4/symlink.c linux-2.6.32.45/fs/autofs4/symlink.c
---- linux-2.6.32.45/fs/autofs4/symlink.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/autofs4/symlink.c 2011-04-17 15:56:46.000000000 -0400
-@@ -15,7 +15,7 @@
- static void *autofs4_follow_link(struct dentry *dentry, struct nameidata *nd)
- {
- struct autofs_info *ino = autofs4_dentry_ino(dentry);
-- nd_set_link(nd, (char *)ino->u.symlink);
-+ nd_set_link(nd, ino->u.symlink);
- return NULL;
- }
-
-diff -urNp linux-2.6.32.45/fs/befs/linuxvfs.c linux-2.6.32.45/fs/befs/linuxvfs.c
---- linux-2.6.32.45/fs/befs/linuxvfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/befs/linuxvfs.c 2011-04-17 15:56:46.000000000 -0400
-@@ -493,7 +493,7 @@ static void befs_put_link(struct dentry
- {
- befs_inode_info *befs_ino = BEFS_I(dentry->d_inode);
- if (befs_ino->i_flags & BEFS_LONG_SYMLINK) {
-- char *link = nd_get_link(nd);
-+ const char *link = nd_get_link(nd);
- if (!IS_ERR(link))
- kfree(link);
- }
-diff -urNp linux-2.6.32.45/fs/binfmt_aout.c linux-2.6.32.45/fs/binfmt_aout.c
---- linux-2.6.32.45/fs/binfmt_aout.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/binfmt_aout.c 2011-04-17 15:56:46.000000000 -0400
-@@ -16,6 +16,7 @@
- #include <linux/string.h>
- #include <linux/fs.h>
- #include <linux/file.h>
-+#include <linux/security.h>
- #include <linux/stat.h>
- #include <linux/fcntl.h>
- #include <linux/ptrace.h>
-@@ -102,6 +103,8 @@ static int aout_core_dump(long signr, st
- #endif
- # define START_STACK(u) (u.start_stack)
-
-+ memset(&dump, 0, sizeof(dump));
-+
- fs = get_fs();
- set_fs(KERNEL_DS);
- has_dumped = 1;
-@@ -113,10 +116,12 @@ static int aout_core_dump(long signr, st
-
- /* If the size of the dump file exceeds the rlimit, then see what would happen
- if we wrote the stack, but not the data area. */
-+ gr_learn_resource(current, RLIMIT_CORE, (dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE, 1);
- if ((dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE > limit)
- dump.u_dsize = 0;
-
- /* Make sure we have enough room to write the stack and data areas. */
-+ gr_learn_resource(current, RLIMIT_CORE, (dump.u_ssize + 1) * PAGE_SIZE, 1);
- if ((dump.u_ssize + 1) * PAGE_SIZE > limit)
- dump.u_ssize = 0;
-
-@@ -146,9 +151,7 @@ static int aout_core_dump(long signr, st
- dump_size = dump.u_ssize << PAGE_SHIFT;
- DUMP_WRITE(dump_start,dump_size);
- }
--/* Finally dump the task struct. Not be used by gdb, but could be useful */
-- set_fs(KERNEL_DS);
-- DUMP_WRITE(current,sizeof(*current));
-+/* Finally, let's not dump the task struct. Not be used by gdb, but could be useful to an attacker */
- end_coredump:
- set_fs(fs);
- return has_dumped;
-@@ -249,6 +252,8 @@ static int load_aout_binary(struct linux
- rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
- if (rlim >= RLIM_INFINITY)
- rlim = ~0;
-+
-+ gr_learn_resource(current, RLIMIT_DATA, ex.a_data + ex.a_bss, 1);
- if (ex.a_data + ex.a_bss > rlim)
- return -ENOMEM;
-
-@@ -277,6 +282,27 @@ static int load_aout_binary(struct linux
- install_exec_creds(bprm);
- current->flags &= ~PF_FORKNOEXEC;
-
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+ current->mm->pax_flags = 0UL;
-+#endif
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (!(N_FLAGS(ex) & F_PAX_PAGEEXEC)) {
-+ current->mm->pax_flags |= MF_PAX_PAGEEXEC;
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+ if (N_FLAGS(ex) & F_PAX_EMUTRAMP)
-+ current->mm->pax_flags |= MF_PAX_EMUTRAMP;
-+#endif
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (!(N_FLAGS(ex) & F_PAX_MPROTECT))
-+ current->mm->pax_flags |= MF_PAX_MPROTECT;
-+#endif
-+
-+ }
-+#endif
-+
- if (N_MAGIC(ex) == OMAGIC) {
- unsigned long text_addr, map_size;
- loff_t pos;
-@@ -349,7 +375,7 @@ static int load_aout_binary(struct linux
-
- down_write(¤t->mm->mmap_sem);
- error = do_mmap(bprm->file, N_DATADDR(ex), ex.a_data,
-- PROT_READ | PROT_WRITE | PROT_EXEC,
-+ PROT_READ | PROT_WRITE,
- MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE,
- fd_offset + ex.a_text);
- up_write(¤t->mm->mmap_sem);
-diff -urNp linux-2.6.32.45/fs/binfmt_elf.c linux-2.6.32.45/fs/binfmt_elf.c
---- linux-2.6.32.45/fs/binfmt_elf.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/binfmt_elf.c 2011-05-16 21:46:57.000000000 -0400
-@@ -50,6 +50,10 @@ static int elf_core_dump(long signr, str
- #define elf_core_dump NULL
- #endif
-
-+#ifdef CONFIG_PAX_MPROTECT
-+static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags);
-+#endif
-+
- #if ELF_EXEC_PAGESIZE > PAGE_SIZE
- #define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE
- #else
-@@ -69,6 +73,11 @@ static struct linux_binfmt elf_format =
- .load_binary = load_elf_binary,
- .load_shlib = load_elf_library,
- .core_dump = elf_core_dump,
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ .handle_mprotect= elf_handle_mprotect,
-+#endif
-+
- .min_coredump = ELF_EXEC_PAGESIZE,
- .hasvdso = 1
- };
-@@ -77,6 +86,8 @@ static struct linux_binfmt elf_format =
-
- static int set_brk(unsigned long start, unsigned long end)
- {
-+ unsigned long e = end;
-+
- start = ELF_PAGEALIGN(start);
- end = ELF_PAGEALIGN(end);
- if (end > start) {
-@@ -87,7 +98,7 @@ static int set_brk(unsigned long start,
- if (BAD_ADDR(addr))
- return addr;
- }
-- current->mm->start_brk = current->mm->brk = end;
-+ current->mm->start_brk = current->mm->brk = e;
- return 0;
- }
-
-@@ -148,12 +159,15 @@ create_elf_tables(struct linux_binprm *b
- elf_addr_t __user *u_rand_bytes;
- const char *k_platform = ELF_PLATFORM;
- const char *k_base_platform = ELF_BASE_PLATFORM;
-- unsigned char k_rand_bytes[16];
-+ u32 k_rand_bytes[4];
- int items;
- elf_addr_t *elf_info;
- int ei_index = 0;
- const struct cred *cred = current_cred();
- struct vm_area_struct *vma;
-+ unsigned long saved_auxv[AT_VECTOR_SIZE];
-+
-+ pax_track_stack();
-
- /*
- * In some cases (e.g. Hyper-Threading), we want to avoid L1
-@@ -195,8 +209,12 @@ create_elf_tables(struct linux_binprm *b
- * Generate 16 random bytes for userspace PRNG seeding.
- */
- get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
-- u_rand_bytes = (elf_addr_t __user *)
-- STACK_ALLOC(p, sizeof(k_rand_bytes));
-+ srandom32(k_rand_bytes[0] ^ random32());
-+ srandom32(k_rand_bytes[1] ^ random32());
-+ srandom32(k_rand_bytes[2] ^ random32());
-+ srandom32(k_rand_bytes[3] ^ random32());
-+ p = STACK_ROUND(p, sizeof(k_rand_bytes));
-+ u_rand_bytes = (elf_addr_t __user *) p;
- if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
- return -EFAULT;
-
-@@ -308,9 +326,11 @@ create_elf_tables(struct linux_binprm *b
- return -EFAULT;
- current->mm->env_end = p;
-
-+ memcpy(saved_auxv, elf_info, ei_index * sizeof(elf_addr_t));
-+
- /* Put the elf_info on the stack in the right place. */
- sp = (elf_addr_t __user *)envp + 1;
-- if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
-+ if (copy_to_user(sp, saved_auxv, ei_index * sizeof(elf_addr_t)))
- return -EFAULT;
- return 0;
- }
-@@ -385,10 +405,10 @@ static unsigned long load_elf_interp(str
- {
- struct elf_phdr *elf_phdata;
- struct elf_phdr *eppnt;
-- unsigned long load_addr = 0;
-+ unsigned long load_addr = 0, pax_task_size = TASK_SIZE;
- int load_addr_set = 0;
- unsigned long last_bss = 0, elf_bss = 0;
-- unsigned long error = ~0UL;
-+ unsigned long error = -EINVAL;
- unsigned long total_size;
- int retval, i, size;
-
-@@ -434,6 +454,11 @@ static unsigned long load_elf_interp(str
- goto out_close;
- }
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
-+ pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
- eppnt = elf_phdata;
- for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
- if (eppnt->p_type == PT_LOAD) {
-@@ -477,8 +502,8 @@ static unsigned long load_elf_interp(str
- k = load_addr + eppnt->p_vaddr;
- if (BAD_ADDR(k) ||
- eppnt->p_filesz > eppnt->p_memsz ||
-- eppnt->p_memsz > TASK_SIZE ||
-- TASK_SIZE - eppnt->p_memsz < k) {
-+ eppnt->p_memsz > pax_task_size ||
-+ pax_task_size - eppnt->p_memsz < k) {
- error = -ENOMEM;
- goto out_close;
- }
-@@ -532,6 +557,194 @@ out:
- return error;
- }
-
-+#if (defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)) && defined(CONFIG_PAX_SOFTMODE)
-+static unsigned long pax_parse_softmode(const struct elf_phdr * const elf_phdata)
-+{
-+ unsigned long pax_flags = 0UL;
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (elf_phdata->p_flags & PF_PAGEEXEC)
-+ pax_flags |= MF_PAX_PAGEEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (elf_phdata->p_flags & PF_SEGMEXEC)
-+ pax_flags |= MF_PAX_SEGMEXEC;
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
-+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+ if (nx_enabled)
-+ pax_flags &= ~MF_PAX_SEGMEXEC;
-+ else
-+ pax_flags &= ~MF_PAX_PAGEEXEC;
-+ }
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+ if (elf_phdata->p_flags & PF_EMUTRAMP)
-+ pax_flags |= MF_PAX_EMUTRAMP;
-+#endif
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (elf_phdata->p_flags & PF_MPROTECT)
-+ pax_flags |= MF_PAX_MPROTECT;
-+#endif
-+
-+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
-+ if (randomize_va_space && (elf_phdata->p_flags & PF_RANDMMAP))
-+ pax_flags |= MF_PAX_RANDMMAP;
-+#endif
-+
-+ return pax_flags;
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_PT_PAX_FLAGS
-+static unsigned long pax_parse_hardmode(const struct elf_phdr * const elf_phdata)
-+{
-+ unsigned long pax_flags = 0UL;
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (!(elf_phdata->p_flags & PF_NOPAGEEXEC))
-+ pax_flags |= MF_PAX_PAGEEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (!(elf_phdata->p_flags & PF_NOSEGMEXEC))
-+ pax_flags |= MF_PAX_SEGMEXEC;
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
-+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+ if (nx_enabled)
-+ pax_flags &= ~MF_PAX_SEGMEXEC;
-+ else
-+ pax_flags &= ~MF_PAX_PAGEEXEC;
-+ }
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+ if (!(elf_phdata->p_flags & PF_NOEMUTRAMP))
-+ pax_flags |= MF_PAX_EMUTRAMP;
-+#endif
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (!(elf_phdata->p_flags & PF_NOMPROTECT))
-+ pax_flags |= MF_PAX_MPROTECT;
-+#endif
-+
-+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
-+ if (randomize_va_space && !(elf_phdata->p_flags & PF_NORANDMMAP))
-+ pax_flags |= MF_PAX_RANDMMAP;
-+#endif
-+
-+ return pax_flags;
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_EI_PAX
-+static unsigned long pax_parse_ei_pax(const struct elfhdr * const elf_ex)
-+{
-+ unsigned long pax_flags = 0UL;
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_PAGEEXEC))
-+ pax_flags |= MF_PAX_PAGEEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_SEGMEXEC))
-+ pax_flags |= MF_PAX_SEGMEXEC;
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
-+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+ if (nx_enabled)
-+ pax_flags &= ~MF_PAX_SEGMEXEC;
-+ else
-+ pax_flags &= ~MF_PAX_PAGEEXEC;
-+ }
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && (elf_ex->e_ident[EI_PAX] & EF_PAX_EMUTRAMP))
-+ pax_flags |= MF_PAX_EMUTRAMP;
-+#endif
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && !(elf_ex->e_ident[EI_PAX] & EF_PAX_MPROTECT))
-+ pax_flags |= MF_PAX_MPROTECT;
-+#endif
-+
-+#ifdef CONFIG_PAX_ASLR
-+ if (randomize_va_space && !(elf_ex->e_ident[EI_PAX] & EF_PAX_RANDMMAP))
-+ pax_flags |= MF_PAX_RANDMMAP;
-+#endif
-+
-+ return pax_flags;
-+}
-+#endif
-+
-+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
-+static long pax_parse_elf_flags(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata)
-+{
-+ unsigned long pax_flags = 0UL;
-+
-+#ifdef CONFIG_PAX_PT_PAX_FLAGS
-+ unsigned long i;
-+ int found_flags = 0;
-+#endif
-+
-+#ifdef CONFIG_PAX_EI_PAX
-+ pax_flags = pax_parse_ei_pax(elf_ex);
-+#endif
-+
-+#ifdef CONFIG_PAX_PT_PAX_FLAGS
-+ for (i = 0UL; i < elf_ex->e_phnum; i++)
-+ if (elf_phdata[i].p_type == PT_PAX_FLAGS) {
-+ if (((elf_phdata[i].p_flags & PF_PAGEEXEC) && (elf_phdata[i].p_flags & PF_NOPAGEEXEC)) ||
-+ ((elf_phdata[i].p_flags & PF_SEGMEXEC) && (elf_phdata[i].p_flags & PF_NOSEGMEXEC)) ||
-+ ((elf_phdata[i].p_flags & PF_EMUTRAMP) && (elf_phdata[i].p_flags & PF_NOEMUTRAMP)) ||
-+ ((elf_phdata[i].p_flags & PF_MPROTECT) && (elf_phdata[i].p_flags & PF_NOMPROTECT)) ||
-+ ((elf_phdata[i].p_flags & PF_RANDMMAP) && (elf_phdata[i].p_flags & PF_NORANDMMAP)))
-+ return -EINVAL;
-+
-+#ifdef CONFIG_PAX_SOFTMODE
-+ if (pax_softmode)
-+ pax_flags = pax_parse_softmode(&elf_phdata[i]);
-+ else
-+#endif
-+
-+ pax_flags = pax_parse_hardmode(&elf_phdata[i]);
-+ found_flags = 1;
-+ break;
-+ }
-+#endif
-+
-+#if !defined(CONFIG_PAX_EI_PAX) && defined(CONFIG_PAX_PT_PAX_FLAGS)
-+ if (found_flags == 0) {
-+ struct elf_phdr phdr;
-+ memset(&phdr, 0, sizeof(phdr));
-+ phdr.p_flags = PF_NOEMUTRAMP;
-+#ifdef CONFIG_PAX_SOFTMODE
-+ if (pax_softmode)
-+ pax_flags = pax_parse_softmode(&phdr);
-+ else
-+#endif
-+ pax_flags = pax_parse_hardmode(&phdr);
-+ }
-+#endif
-+
-+
-+ if (0 > pax_check_flags(&pax_flags))
-+ return -EINVAL;
-+
-+ current->mm->pax_flags = pax_flags;
-+ return 0;
-+}
-+#endif
-+
- /*
- * These are the functions used to load ELF style executables and shared
- * libraries. There is no binary dependent code anywhere else.
-@@ -548,6 +761,11 @@ static unsigned long randomize_stack_top
- {
- unsigned int random_variable = 0;
-
-+#ifdef CONFIG_PAX_RANDUSTACK
-+ if (randomize_va_space)
-+ return stack_top - current->mm->delta_stack;
-+#endif
-+
- if ((current->flags & PF_RANDOMIZE) &&
- !(current->personality & ADDR_NO_RANDOMIZE)) {
- random_variable = get_random_int() & STACK_RND_MASK;
-@@ -566,7 +784,7 @@ static int load_elf_binary(struct linux_
- unsigned long load_addr = 0, load_bias = 0;
- int load_addr_set = 0;
- char * elf_interpreter = NULL;
-- unsigned long error;
-+ unsigned long error = 0;
- struct elf_phdr *elf_ppnt, *elf_phdata;
- unsigned long elf_bss, elf_brk;
- int retval, i;
-@@ -576,11 +794,11 @@ static int load_elf_binary(struct linux_
- unsigned long start_code, end_code, start_data, end_data;
- unsigned long reloc_func_desc = 0;
- int executable_stack = EXSTACK_DEFAULT;
-- unsigned long def_flags = 0;
- struct {
- struct elfhdr elf_ex;
- struct elfhdr interp_elf_ex;
- } *loc;
-+ unsigned long pax_task_size = TASK_SIZE;
-
- loc = kmalloc(sizeof(*loc), GFP_KERNEL);
- if (!loc) {
-@@ -718,11 +936,80 @@ static int load_elf_binary(struct linux_
-
- /* OK, This is the point of no return */
- current->flags &= ~PF_FORKNOEXEC;
-- current->mm->def_flags = def_flags;
-+
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+ current->mm->pax_flags = 0UL;
-+#endif
-+
-+#ifdef CONFIG_PAX_DLRESOLVE
-+ current->mm->call_dl_resolve = 0UL;
-+#endif
-+
-+#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
-+ current->mm->call_syscall = 0UL;
-+#endif
-+
-+#ifdef CONFIG_PAX_ASLR
-+ current->mm->delta_mmap = 0UL;
-+ current->mm->delta_stack = 0UL;
-+#endif
-+
-+ current->mm->def_flags = 0;
-+
-+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
-+ if (0 > pax_parse_elf_flags(&loc->elf_ex, elf_phdata)) {
-+ send_sig(SIGKILL, current, 0);
-+ goto out_free_dentry;
-+ }
-+#endif
-+
-+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
-+ pax_set_initial_flags(bprm);
-+#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
-+ if (pax_set_initial_flags_func)
-+ (pax_set_initial_flags_func)(bprm);
-+#endif
-+
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+ if ((current->mm->pax_flags & MF_PAX_PAGEEXEC) && !nx_enabled) {
-+ current->mm->context.user_cs_limit = PAGE_SIZE;
-+ current->mm->def_flags |= VM_PAGEEXEC;
-+ }
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
-+ current->mm->context.user_cs_base = SEGMEXEC_TASK_SIZE;
-+ current->mm->context.user_cs_limit = TASK_SIZE-SEGMEXEC_TASK_SIZE;
-+ pax_task_size = SEGMEXEC_TASK_SIZE;
-+ }
-+#endif
-+
-+#if defined(CONFIG_ARCH_TRACK_EXEC_LIMIT) || defined(CONFIG_PAX_SEGMEXEC)
-+ if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+ set_user_cs(current->mm->context.user_cs_base, current->mm->context.user_cs_limit, get_cpu());
-+ put_cpu();
-+ }
-+#endif
-
- /* Do this immediately, since STACK_TOP as used in setup_arg_pages
- may depend on the personality. */
- SET_PERSONALITY(loc->elf_ex);
-+
-+#ifdef CONFIG_PAX_ASLR
-+ if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
-+ current->mm->delta_mmap = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN)-1)) << PAGE_SHIFT;
-+ current->mm->delta_stack = (pax_get_random_long() & ((1UL << PAX_DELTA_STACK_LEN)-1)) << PAGE_SHIFT;
-+ }
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+ if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+ executable_stack = EXSTACK_DISABLE_X;
-+ current->personality &= ~READ_IMPLIES_EXEC;
-+ } else
-+#endif
-+
- if (elf_read_implies_exec(loc->elf_ex, executable_stack))
- current->personality |= READ_IMPLIES_EXEC;
-
-@@ -804,6 +1091,20 @@ static int load_elf_binary(struct linux_
- #else
- load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
- #endif
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ /* PaX: randomize base address at the default exe base if requested */
-+ if ((current->mm->pax_flags & MF_PAX_RANDMMAP) && elf_interpreter) {
-+#ifdef CONFIG_SPARC64
-+ load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << (PAGE_SHIFT+1);
-+#else
-+ load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << PAGE_SHIFT;
-+#endif
-+ load_bias = ELF_PAGESTART(PAX_ELF_ET_DYN_BASE - vaddr + load_bias);
-+ elf_flags |= MAP_FIXED;
-+ }
-+#endif
-+
- }
-
- error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
-@@ -836,9 +1137,9 @@ static int load_elf_binary(struct linux_
- * allowed task size. Note that p_filesz must always be
- * <= p_memsz so it is only necessary to check p_memsz.
- */
-- if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
-- elf_ppnt->p_memsz > TASK_SIZE ||
-- TASK_SIZE - elf_ppnt->p_memsz < k) {
-+ if (k >= pax_task_size || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
-+ elf_ppnt->p_memsz > pax_task_size ||
-+ pax_task_size - elf_ppnt->p_memsz < k) {
- /* set_brk can never work. Avoid overflows. */
- send_sig(SIGKILL, current, 0);
- retval = -EINVAL;
-@@ -866,6 +1167,11 @@ static int load_elf_binary(struct linux_
- start_data += load_bias;
- end_data += load_bias;
-
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (current->mm->pax_flags & MF_PAX_RANDMMAP)
-+ elf_brk += PAGE_SIZE + ((pax_get_random_long() & ~PAGE_MASK) << 4);
-+#endif
-+
- /* Calling set_brk effectively mmaps the pages that we need
- * for the bss and break sections. We must do this before
- * mapping in the interpreter, to make sure it doesn't wind
-@@ -877,9 +1183,11 @@ static int load_elf_binary(struct linux_
- goto out_free_dentry;
- }
- if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
-- send_sig(SIGSEGV, current, 0);
-- retval = -EFAULT; /* Nobody gets to see this, but.. */
-- goto out_free_dentry;
-+ /*
-+ * This bss-zeroing can fail if the ELF
-+ * file specifies odd protections. So
-+ * we don't check the return value
-+ */
- }
-
- if (elf_interpreter) {
-@@ -1112,8 +1420,10 @@ static int dump_seek(struct file *file,
- unsigned long n = off;
- if (n > PAGE_SIZE)
- n = PAGE_SIZE;
-- if (!dump_write(file, buf, n))
-+ if (!dump_write(file, buf, n)) {
-+ free_page((unsigned long)buf);
- return 0;
-+ }
- off -= n;
- }
- free_page((unsigned long)buf);
-@@ -1125,7 +1435,7 @@ static int dump_seek(struct file *file,
- * Decide what to dump of a segment, part, all or none.
- */
- static unsigned long vma_dump_size(struct vm_area_struct *vma,
-- unsigned long mm_flags)
-+ unsigned long mm_flags, long signr)
- {
- #define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type))
-
-@@ -1159,7 +1469,7 @@ static unsigned long vma_dump_size(struc
- if (vma->vm_file == NULL)
- return 0;
-
-- if (FILTER(MAPPED_PRIVATE))
-+ if (signr == SIGKILL || FILTER(MAPPED_PRIVATE))
- goto whole;
-
- /*
-@@ -1255,8 +1565,11 @@ static int writenote(struct memelfnote *
- #undef DUMP_WRITE
-
- #define DUMP_WRITE(addr, nr) \
-+ do { \
-+ gr_learn_resource(current, RLIMIT_CORE, size + (nr), 1); \
- if ((size += (nr)) > limit || !dump_write(file, (addr), (nr))) \
-- goto end_coredump;
-+ goto end_coredump; \
-+ } while (0);
-
- static void fill_elf_header(struct elfhdr *elf, int segs,
- u16 machine, u32 flags, u8 osabi)
-@@ -1385,9 +1698,9 @@ static void fill_auxv_note(struct memelf
- {
- elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
- int i = 0;
-- do
-+ do {
- i += 2;
-- while (auxv[i - 2] != AT_NULL);
-+ } while (auxv[i - 2] != AT_NULL);
- fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
- }
-
-@@ -1973,7 +2286,7 @@ static int elf_core_dump(long signr, str
- phdr.p_offset = offset;
- phdr.p_vaddr = vma->vm_start;
- phdr.p_paddr = 0;
-- phdr.p_filesz = vma_dump_size(vma, mm_flags);
-+ phdr.p_filesz = vma_dump_size(vma, mm_flags, signr);
- phdr.p_memsz = vma->vm_end - vma->vm_start;
- offset += phdr.p_filesz;
- phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
-@@ -2006,7 +2319,7 @@ static int elf_core_dump(long signr, str
- unsigned long addr;
- unsigned long end;
-
-- end = vma->vm_start + vma_dump_size(vma, mm_flags);
-+ end = vma->vm_start + vma_dump_size(vma, mm_flags, signr);
-
- for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
- struct page *page;
-@@ -2015,6 +2328,7 @@ static int elf_core_dump(long signr, str
- page = get_dump_page(addr);
- if (page) {
- void *kaddr = kmap(page);
-+ gr_learn_resource(current, RLIMIT_CORE, size + PAGE_SIZE, 1);
- stop = ((size += PAGE_SIZE) > limit) ||
- !dump_write(file, kaddr, PAGE_SIZE);
- kunmap(page);
-@@ -2042,6 +2356,97 @@ out:
-
- #endif /* USE_ELF_CORE_DUMP */
-
-+#ifdef CONFIG_PAX_MPROTECT
-+/* PaX: non-PIC ELF libraries need relocations on their executable segments
-+ * therefore we'll grant them VM_MAYWRITE once during their life. Similarly
-+ * we'll remove VM_MAYWRITE for good on RELRO segments.
-+ *
-+ * The checks favour ld-linux.so behaviour which operates on a per ELF segment
-+ * basis because we want to allow the common case and not the special ones.
-+ */
-+static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags)
-+{
-+ struct elfhdr elf_h;
-+ struct elf_phdr elf_p;
-+ unsigned long i;
-+ unsigned long oldflags;
-+ bool is_textrel_rw, is_textrel_rx, is_relro;
-+
-+ if (!(vma->vm_mm->pax_flags & MF_PAX_MPROTECT))
-+ return;
-+
-+ oldflags = vma->vm_flags & (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ);
-+ newflags &= VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ;
-+
-+#ifdef CONFIG_PAX_ELFRELOCS
-+ /* possible TEXTREL */
-+ is_textrel_rw = vma->vm_file && !vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYREAD | VM_EXEC | VM_READ) && newflags == (VM_WRITE | VM_READ);
-+ is_textrel_rx = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_WRITE | VM_READ) && newflags == (VM_EXEC | VM_READ);
-+#else
-+ is_textrel_rw = false;
-+ is_textrel_rx = false;
-+#endif
-+
-+ /* possible RELRO */
-+ is_relro = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ) && newflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ);
-+
-+ if (!is_textrel_rw && !is_textrel_rx && !is_relro)
-+ return;
-+
-+ if (sizeof(elf_h) != kernel_read(vma->vm_file, 0UL, (char *)&elf_h, sizeof(elf_h)) ||
-+ memcmp(elf_h.e_ident, ELFMAG, SELFMAG) ||
-+
-+#ifdef CONFIG_PAX_ETEXECRELOCS
-+ ((is_textrel_rw || is_textrel_rx) && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
-+#else
-+ ((is_textrel_rw || is_textrel_rx) && elf_h.e_type != ET_DYN) ||
-+#endif
-+
-+ (is_relro && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
-+ !elf_check_arch(&elf_h) ||
-+ elf_h.e_phentsize != sizeof(struct elf_phdr) ||
-+ elf_h.e_phnum > 65536UL / sizeof(struct elf_phdr))
-+ return;
-+
-+ for (i = 0UL; i < elf_h.e_phnum; i++) {
-+ if (sizeof(elf_p) != kernel_read(vma->vm_file, elf_h.e_phoff + i*sizeof(elf_p), (char *)&elf_p, sizeof(elf_p)))
-+ return;
-+ switch (elf_p.p_type) {
-+ case PT_DYNAMIC:
-+ if (!is_textrel_rw && !is_textrel_rx)
-+ continue;
-+ i = 0UL;
-+ while ((i+1) * sizeof(elf_dyn) <= elf_p.p_filesz) {
-+ elf_dyn dyn;
-+
-+ if (sizeof(dyn) != kernel_read(vma->vm_file, elf_p.p_offset + i*sizeof(dyn), (char *)&dyn, sizeof(dyn)))
-+ return;
-+ if (dyn.d_tag == DT_NULL)
-+ return;
-+ if (dyn.d_tag == DT_TEXTREL || (dyn.d_tag == DT_FLAGS && (dyn.d_un.d_val & DF_TEXTREL))) {
-+ gr_log_textrel(vma);
-+ if (is_textrel_rw)
-+ vma->vm_flags |= VM_MAYWRITE;
-+ else
-+ /* PaX: disallow write access after relocs are done, hopefully noone else needs it... */
-+ vma->vm_flags &= ~VM_MAYWRITE;
-+ return;
-+ }
-+ i++;
-+ }
-+ return;
-+
-+ case PT_GNU_RELRO:
-+ if (!is_relro)
-+ continue;
-+ if ((elf_p.p_offset >> PAGE_SHIFT) == vma->vm_pgoff && ELF_PAGEALIGN(elf_p.p_memsz) == vma->vm_end - vma->vm_start)
-+ vma->vm_flags &= ~VM_MAYWRITE;
-+ return;
-+ }
-+ }
-+}
-+#endif
-+
- static int __init init_elf_binfmt(void)
- {
- return register_binfmt(&elf_format);
-diff -urNp linux-2.6.32.45/fs/binfmt_flat.c linux-2.6.32.45/fs/binfmt_flat.c
---- linux-2.6.32.45/fs/binfmt_flat.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/binfmt_flat.c 2011-04-17 15:56:46.000000000 -0400
-@@ -564,7 +564,9 @@ static int load_flat_file(struct linux_b
- realdatastart = (unsigned long) -ENOMEM;
- printk("Unable to allocate RAM for process data, errno %d\n",
- (int)-realdatastart);
-+ down_write(¤t->mm->mmap_sem);
- do_munmap(current->mm, textpos, text_len);
-+ up_write(¤t->mm->mmap_sem);
- ret = realdatastart;
- goto err;
- }
-@@ -588,8 +590,10 @@ static int load_flat_file(struct linux_b
- }
- if (IS_ERR_VALUE(result)) {
- printk("Unable to read data+bss, errno %d\n", (int)-result);
-+ down_write(¤t->mm->mmap_sem);
- do_munmap(current->mm, textpos, text_len);
- do_munmap(current->mm, realdatastart, data_len + extra);
-+ up_write(¤t->mm->mmap_sem);
- ret = result;
- goto err;
- }
-@@ -658,8 +662,10 @@ static int load_flat_file(struct linux_b
- }
- if (IS_ERR_VALUE(result)) {
- printk("Unable to read code+data+bss, errno %d\n",(int)-result);
-+ down_write(¤t->mm->mmap_sem);
- do_munmap(current->mm, textpos, text_len + data_len + extra +
- MAX_SHARED_LIBS * sizeof(unsigned long));
-+ up_write(¤t->mm->mmap_sem);
- ret = result;
- goto err;
- }
-diff -urNp linux-2.6.32.45/fs/bio.c linux-2.6.32.45/fs/bio.c
---- linux-2.6.32.45/fs/bio.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/bio.c 2011-04-17 15:56:46.000000000 -0400
-@@ -78,7 +78,7 @@ static struct kmem_cache *bio_find_or_cr
-
- i = 0;
- while (i < bio_slab_nr) {
-- struct bio_slab *bslab = &bio_slabs[i];
-+ bslab = &bio_slabs[i];
-
- if (!bslab->slab && entry == -1)
- entry = i;
-@@ -1236,7 +1236,7 @@ static void bio_copy_kern_endio(struct b
- const int read = bio_data_dir(bio) == READ;
- struct bio_map_data *bmd = bio->bi_private;
- int i;
-- char *p = bmd->sgvecs[0].iov_base;
-+ char *p = (__force char *)bmd->sgvecs[0].iov_base;
-
- __bio_for_each_segment(bvec, bio, i, 0) {
- char *addr = page_address(bvec->bv_page);
-diff -urNp linux-2.6.32.45/fs/block_dev.c linux-2.6.32.45/fs/block_dev.c
---- linux-2.6.32.45/fs/block_dev.c 2011-08-09 18:35:29.000000000 -0400
-+++ linux-2.6.32.45/fs/block_dev.c 2011-08-09 18:34:00.000000000 -0400
-@@ -664,7 +664,7 @@ int bd_claim(struct block_device *bdev,
- else if (bdev->bd_contains == bdev)
- res = 0; /* is a whole device which isn't held */
-
-- else if (bdev->bd_contains->bd_holder == bd_claim)
-+ else if (bdev->bd_contains->bd_holder == (void *)bd_claim)
- res = 0; /* is a partition of a device that is being partitioned */
- else if (bdev->bd_contains->bd_holder != NULL)
- res = -EBUSY; /* is a partition of a held device */
-diff -urNp linux-2.6.32.45/fs/btrfs/ctree.c linux-2.6.32.45/fs/btrfs/ctree.c
---- linux-2.6.32.45/fs/btrfs/ctree.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/btrfs/ctree.c 2011-04-17 15:56:46.000000000 -0400
-@@ -461,9 +461,12 @@ static noinline int __btrfs_cow_block(st
- free_extent_buffer(buf);
- add_root_to_dirty_list(root);
- } else {
-- if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID)
-- parent_start = parent->start;
-- else
-+ if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) {
-+ if (parent)
-+ parent_start = parent->start;
-+ else
-+ parent_start = 0;
-+ } else
- parent_start = 0;
-
- WARN_ON(trans->transid != btrfs_header_generation(parent));
-@@ -3645,7 +3648,6 @@ setup_items_for_insert(struct btrfs_tran
-
- ret = 0;
- if (slot == 0) {
-- struct btrfs_disk_key disk_key;
- btrfs_cpu_key_to_disk(&disk_key, cpu_key);
- ret = fixup_low_keys(trans, root, path, &disk_key, 1);
- }
-diff -urNp linux-2.6.32.45/fs/btrfs/disk-io.c linux-2.6.32.45/fs/btrfs/disk-io.c
---- linux-2.6.32.45/fs/btrfs/disk-io.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.45/fs/btrfs/disk-io.c 2011-04-17 17:03:11.000000000 -0400
-@@ -39,7 +39,7 @@
- #include "tree-log.h"
- #include "free-space-cache.h"
-
--static struct extent_io_ops btree_extent_io_ops;
-+static const struct extent_io_ops btree_extent_io_ops;
- static void end_workqueue_fn(struct btrfs_work *work);
- static void free_fs_root(struct btrfs_root *root);
-
-@@ -2607,7 +2607,7 @@ out:
- return 0;
- }
-
--static struct extent_io_ops btree_extent_io_ops = {
-+static const struct extent_io_ops btree_extent_io_ops = {
- .write_cache_pages_lock_hook = btree_lock_page_hook,
- .readpage_end_io_hook = btree_readpage_end_io_hook,
- .submit_bio_hook = btree_submit_bio_hook,
-diff -urNp linux-2.6.32.45/fs/btrfs/extent_io.h linux-2.6.32.45/fs/btrfs/extent_io.h
---- linux-2.6.32.45/fs/btrfs/extent_io.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/btrfs/extent_io.h 2011-04-17 15:56:46.000000000 -0400
-@@ -49,36 +49,36 @@ typedef int (extent_submit_bio_hook_t)(s
- struct bio *bio, int mirror_num,
- unsigned long bio_flags);
- struct extent_io_ops {
-- int (*fill_delalloc)(struct inode *inode, struct page *locked_page,
-+ int (* const fill_delalloc)(struct inode *inode, struct page *locked_page,
- u64 start, u64 end, int *page_started,
- unsigned long *nr_written);
-- int (*writepage_start_hook)(struct page *page, u64 start, u64 end);
-- int (*writepage_io_hook)(struct page *page, u64 start, u64 end);
-+ int (* const writepage_start_hook)(struct page *page, u64 start, u64 end);
-+ int (* const writepage_io_hook)(struct page *page, u64 start, u64 end);
- extent_submit_bio_hook_t *submit_bio_hook;
-- int (*merge_bio_hook)(struct page *page, unsigned long offset,
-+ int (* const merge_bio_hook)(struct page *page, unsigned long offset,
- size_t size, struct bio *bio,
- unsigned long bio_flags);
-- int (*readpage_io_hook)(struct page *page, u64 start, u64 end);
-- int (*readpage_io_failed_hook)(struct bio *bio, struct page *page,
-+ int (* const readpage_io_hook)(struct page *page, u64 start, u64 end);
-+ int (* const readpage_io_failed_hook)(struct bio *bio, struct page *page,
- u64 start, u64 end,
- struct extent_state *state);
-- int (*writepage_io_failed_hook)(struct bio *bio, struct page *page,
-+ int (* const writepage_io_failed_hook)(struct bio *bio, struct page *page,
- u64 start, u64 end,
- struct extent_state *state);
-- int (*readpage_end_io_hook)(struct page *page, u64 start, u64 end,
-+ int (* const readpage_end_io_hook)(struct page *page, u64 start, u64 end,
- struct extent_state *state);
-- int (*writepage_end_io_hook)(struct page *page, u64 start, u64 end,
-+ int (* const writepage_end_io_hook)(struct page *page, u64 start, u64 end,
- struct extent_state *state, int uptodate);
-- int (*set_bit_hook)(struct inode *inode, u64 start, u64 end,
-+ int (* const set_bit_hook)(struct inode *inode, u64 start, u64 end,
- unsigned long old, unsigned long bits);
-- int (*clear_bit_hook)(struct inode *inode, struct extent_state *state,
-+ int (* const clear_bit_hook)(struct inode *inode, struct extent_state *state,
- unsigned long bits);
-- int (*merge_extent_hook)(struct inode *inode,
-+ int (* const merge_extent_hook)(struct inode *inode,
- struct extent_state *new,
- struct extent_state *other);
-- int (*split_extent_hook)(struct inode *inode,
-+ int (* const split_extent_hook)(struct inode *inode,
- struct extent_state *orig, u64 split);
-- int (*write_cache_pages_lock_hook)(struct page *page);
-+ int (* const write_cache_pages_lock_hook)(struct page *page);
- };
-
- struct extent_io_tree {
-@@ -88,7 +88,7 @@ struct extent_io_tree {
- u64 dirty_bytes;
- spinlock_t lock;
- spinlock_t buffer_lock;
-- struct extent_io_ops *ops;
-+ const struct extent_io_ops *ops;
- };
-
- struct extent_state {
-diff -urNp linux-2.6.32.45/fs/btrfs/extent-tree.c linux-2.6.32.45/fs/btrfs/extent-tree.c
---- linux-2.6.32.45/fs/btrfs/extent-tree.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/btrfs/extent-tree.c 2011-06-12 06:39:08.000000000 -0400
-@@ -7141,6 +7141,10 @@ static noinline int relocate_one_extent(
- u64 group_start = group->key.objectid;
- new_extents = kmalloc(sizeof(*new_extents),
- GFP_NOFS);
-+ if (!new_extents) {
-+ ret = -ENOMEM;
-+ goto out;
-+ }
- nr_extents = 1;
- ret = get_new_locations(reloc_inode,
- extent_key,
-diff -urNp linux-2.6.32.45/fs/btrfs/free-space-cache.c linux-2.6.32.45/fs/btrfs/free-space-cache.c
---- linux-2.6.32.45/fs/btrfs/free-space-cache.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/btrfs/free-space-cache.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1074,8 +1074,6 @@ u64 btrfs_alloc_from_cluster(struct btrf
-
- while(1) {
- if (entry->bytes < bytes || entry->offset < min_start) {
-- struct rb_node *node;
--
- node = rb_next(&entry->offset_index);
- if (!node)
- break;
-@@ -1226,7 +1224,7 @@ again:
- */
- while (entry->bitmap || found_bitmap ||
- (!entry->bitmap && entry->bytes < min_bytes)) {
-- struct rb_node *node = rb_next(&entry->offset_index);
-+ node = rb_next(&entry->offset_index);
-
- if (entry->bitmap && entry->bytes > bytes + empty_size) {
- ret = btrfs_bitmap_cluster(block_group, entry, cluster,
-diff -urNp linux-2.6.32.45/fs/btrfs/inode.c linux-2.6.32.45/fs/btrfs/inode.c
---- linux-2.6.32.45/fs/btrfs/inode.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/btrfs/inode.c 2011-06-12 06:39:58.000000000 -0400
-@@ -63,7 +63,7 @@ static const struct inode_operations btr
- static const struct address_space_operations btrfs_aops;
- static const struct address_space_operations btrfs_symlink_aops;
- static const struct file_operations btrfs_dir_file_operations;
--static struct extent_io_ops btrfs_extent_io_ops;
-+static const struct extent_io_ops btrfs_extent_io_ops;
-
- static struct kmem_cache *btrfs_inode_cachep;
- struct kmem_cache *btrfs_trans_handle_cachep;
-@@ -925,6 +925,7 @@ static int cow_file_range_async(struct i
- 1, 0, NULL, GFP_NOFS);
- while (start < end) {
- async_cow = kmalloc(sizeof(*async_cow), GFP_NOFS);
-+ BUG_ON(!async_cow);
- async_cow->inode = inode;
- async_cow->root = root;
- async_cow->locked_page = locked_page;
-@@ -4591,6 +4592,8 @@ static noinline int uncompress_inline(st
- inline_size = btrfs_file_extent_inline_item_len(leaf,
- btrfs_item_nr(leaf, path->slots[0]));
- tmp = kmalloc(inline_size, GFP_NOFS);
-+ if (!tmp)
-+ return -ENOMEM;
- ptr = btrfs_file_extent_inline_start(item);
-
- read_extent_buffer(leaf, tmp, ptr, inline_size);
-@@ -5410,7 +5413,7 @@ fail:
- return -ENOMEM;
- }
-
--static int btrfs_getattr(struct vfsmount *mnt,
-+int btrfs_getattr(struct vfsmount *mnt,
- struct dentry *dentry, struct kstat *stat)
- {
- struct inode *inode = dentry->d_inode;
-@@ -5422,6 +5425,14 @@ static int btrfs_getattr(struct vfsmount
- return 0;
- }
-
-+EXPORT_SYMBOL(btrfs_getattr);
-+
-+dev_t get_btrfs_dev_from_inode(struct inode *inode)
-+{
-+ return BTRFS_I(inode)->root->anon_super.s_dev;
-+}
-+EXPORT_SYMBOL(get_btrfs_dev_from_inode);
-+
- static int btrfs_rename(struct inode *old_dir, struct dentry *old_dentry,
- struct inode *new_dir, struct dentry *new_dentry)
- {
-@@ -5972,7 +5983,7 @@ static const struct file_operations btrf
- .fsync = btrfs_sync_file,
- };
-
--static struct extent_io_ops btrfs_extent_io_ops = {
-+static const struct extent_io_ops btrfs_extent_io_ops = {
- .fill_delalloc = run_delalloc_range,
- .submit_bio_hook = btrfs_submit_bio_hook,
- .merge_bio_hook = btrfs_merge_bio_hook,
-diff -urNp linux-2.6.32.45/fs/btrfs/relocation.c linux-2.6.32.45/fs/btrfs/relocation.c
---- linux-2.6.32.45/fs/btrfs/relocation.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/btrfs/relocation.c 2011-04-17 15:56:46.000000000 -0400
-@@ -884,7 +884,7 @@ static int __update_reloc_root(struct bt
- }
- spin_unlock(&rc->reloc_root_tree.lock);
-
-- BUG_ON((struct btrfs_root *)node->data != root);
-+ BUG_ON(!node || (struct btrfs_root *)node->data != root);
-
- if (!del) {
- spin_lock(&rc->reloc_root_tree.lock);
-diff -urNp linux-2.6.32.45/fs/btrfs/sysfs.c linux-2.6.32.45/fs/btrfs/sysfs.c
---- linux-2.6.32.45/fs/btrfs/sysfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/btrfs/sysfs.c 2011-04-17 15:56:46.000000000 -0400
-@@ -164,12 +164,12 @@ static void btrfs_root_release(struct ko
- complete(&root->kobj_unregister);
- }
-
--static struct sysfs_ops btrfs_super_attr_ops = {
-+static const struct sysfs_ops btrfs_super_attr_ops = {
- .show = btrfs_super_attr_show,
- .store = btrfs_super_attr_store,
- };
-
--static struct sysfs_ops btrfs_root_attr_ops = {
-+static const struct sysfs_ops btrfs_root_attr_ops = {
- .show = btrfs_root_attr_show,
- .store = btrfs_root_attr_store,
- };
-diff -urNp linux-2.6.32.45/fs/buffer.c linux-2.6.32.45/fs/buffer.c
---- linux-2.6.32.45/fs/buffer.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/buffer.c 2011-04-17 15:56:46.000000000 -0400
-@@ -25,6 +25,7 @@
- #include <linux/percpu.h>
- #include <linux/slab.h>
- #include <linux/capability.h>
-+#include <linux/security.h>
- #include <linux/blkdev.h>
- #include <linux/file.h>
- #include <linux/quotaops.h>
-diff -urNp linux-2.6.32.45/fs/cachefiles/bind.c linux-2.6.32.45/fs/cachefiles/bind.c
---- linux-2.6.32.45/fs/cachefiles/bind.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/cachefiles/bind.c 2011-04-17 15:56:46.000000000 -0400
-@@ -39,13 +39,11 @@ int cachefiles_daemon_bind(struct cachef
- args);
-
- /* start by checking things over */
-- ASSERT(cache->fstop_percent >= 0 &&
-- cache->fstop_percent < cache->fcull_percent &&
-+ ASSERT(cache->fstop_percent < cache->fcull_percent &&
- cache->fcull_percent < cache->frun_percent &&
- cache->frun_percent < 100);
-
-- ASSERT(cache->bstop_percent >= 0 &&
-- cache->bstop_percent < cache->bcull_percent &&
-+ ASSERT(cache->bstop_percent < cache->bcull_percent &&
- cache->bcull_percent < cache->brun_percent &&
- cache->brun_percent < 100);
-
-diff -urNp linux-2.6.32.45/fs/cachefiles/daemon.c linux-2.6.32.45/fs/cachefiles/daemon.c
---- linux-2.6.32.45/fs/cachefiles/daemon.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/cachefiles/daemon.c 2011-04-17 15:56:46.000000000 -0400
-@@ -220,7 +220,7 @@ static ssize_t cachefiles_daemon_write(s
- if (test_bit(CACHEFILES_DEAD, &cache->flags))
- return -EIO;
-
-- if (datalen < 0 || datalen > PAGE_SIZE - 1)
-+ if (datalen > PAGE_SIZE - 1)
- return -EOPNOTSUPP;
-
- /* drag the command string into the kernel so we can parse it */
-@@ -385,7 +385,7 @@ static int cachefiles_daemon_fstop(struc
- if (args[0] != '%' || args[1] != '\0')
- return -EINVAL;
-
-- if (fstop < 0 || fstop >= cache->fcull_percent)
-+ if (fstop >= cache->fcull_percent)
- return cachefiles_daemon_range_error(cache, args);
-
- cache->fstop_percent = fstop;
-@@ -457,7 +457,7 @@ static int cachefiles_daemon_bstop(struc
- if (args[0] != '%' || args[1] != '\0')
- return -EINVAL;
-
-- if (bstop < 0 || bstop >= cache->bcull_percent)
-+ if (bstop >= cache->bcull_percent)
- return cachefiles_daemon_range_error(cache, args);
-
- cache->bstop_percent = bstop;
-diff -urNp linux-2.6.32.45/fs/cachefiles/internal.h linux-2.6.32.45/fs/cachefiles/internal.h
---- linux-2.6.32.45/fs/cachefiles/internal.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/cachefiles/internal.h 2011-05-04 17:56:28.000000000 -0400
-@@ -56,7 +56,7 @@ struct cachefiles_cache {
- wait_queue_head_t daemon_pollwq; /* poll waitqueue for daemon */
- struct rb_root active_nodes; /* active nodes (can't be culled) */
- rwlock_t active_lock; /* lock for active_nodes */
-- atomic_t gravecounter; /* graveyard uniquifier */
-+ atomic_unchecked_t gravecounter; /* graveyard uniquifier */
- unsigned frun_percent; /* when to stop culling (% files) */
- unsigned fcull_percent; /* when to start culling (% files) */
- unsigned fstop_percent; /* when to stop allocating (% files) */
-@@ -168,19 +168,19 @@ extern int cachefiles_check_in_use(struc
- * proc.c
- */
- #ifdef CONFIG_CACHEFILES_HISTOGRAM
--extern atomic_t cachefiles_lookup_histogram[HZ];
--extern atomic_t cachefiles_mkdir_histogram[HZ];
--extern atomic_t cachefiles_create_histogram[HZ];
-+extern atomic_unchecked_t cachefiles_lookup_histogram[HZ];
-+extern atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
-+extern atomic_unchecked_t cachefiles_create_histogram[HZ];
-
- extern int __init cachefiles_proc_init(void);
- extern void cachefiles_proc_cleanup(void);
- static inline
--void cachefiles_hist(atomic_t histogram[], unsigned long start_jif)
-+void cachefiles_hist(atomic_unchecked_t histogram[], unsigned long start_jif)
- {
- unsigned long jif = jiffies - start_jif;
- if (jif >= HZ)
- jif = HZ - 1;
-- atomic_inc(&histogram[jif]);
-+ atomic_inc_unchecked(&histogram[jif]);
- }
-
- #else
-diff -urNp linux-2.6.32.45/fs/cachefiles/namei.c linux-2.6.32.45/fs/cachefiles/namei.c
---- linux-2.6.32.45/fs/cachefiles/namei.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/cachefiles/namei.c 2011-05-04 17:56:28.000000000 -0400
-@@ -250,7 +250,7 @@ try_again:
- /* first step is to make up a grave dentry in the graveyard */
- sprintf(nbuffer, "%08x%08x",
- (uint32_t) get_seconds(),
-- (uint32_t) atomic_inc_return(&cache->gravecounter));
-+ (uint32_t) atomic_inc_return_unchecked(&cache->gravecounter));
-
- /* do the multiway lock magic */
- trap = lock_rename(cache->graveyard, dir);
-diff -urNp linux-2.6.32.45/fs/cachefiles/proc.c linux-2.6.32.45/fs/cachefiles/proc.c
---- linux-2.6.32.45/fs/cachefiles/proc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/cachefiles/proc.c 2011-05-04 17:56:28.000000000 -0400
-@@ -14,9 +14,9 @@
- #include <linux/seq_file.h>
- #include "internal.h"
-
--atomic_t cachefiles_lookup_histogram[HZ];
--atomic_t cachefiles_mkdir_histogram[HZ];
--atomic_t cachefiles_create_histogram[HZ];
-+atomic_unchecked_t cachefiles_lookup_histogram[HZ];
-+atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
-+atomic_unchecked_t cachefiles_create_histogram[HZ];
-
- /*
- * display the latency histogram
-@@ -35,9 +35,9 @@ static int cachefiles_histogram_show(str
- return 0;
- default:
- index = (unsigned long) v - 3;
-- x = atomic_read(&cachefiles_lookup_histogram[index]);
-- y = atomic_read(&cachefiles_mkdir_histogram[index]);
-- z = atomic_read(&cachefiles_create_histogram[index]);
-+ x = atomic_read_unchecked(&cachefiles_lookup_histogram[index]);
-+ y = atomic_read_unchecked(&cachefiles_mkdir_histogram[index]);
-+ z = atomic_read_unchecked(&cachefiles_create_histogram[index]);
- if (x == 0 && y == 0 && z == 0)
- return 0;
-
-diff -urNp linux-2.6.32.45/fs/cachefiles/rdwr.c linux-2.6.32.45/fs/cachefiles/rdwr.c
---- linux-2.6.32.45/fs/cachefiles/rdwr.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/cachefiles/rdwr.c 2011-04-17 15:56:46.000000000 -0400
-@@ -946,7 +946,7 @@ int cachefiles_write_page(struct fscache
- old_fs = get_fs();
- set_fs(KERNEL_DS);
- ret = file->f_op->write(
-- file, (const void __user *) data, len, &pos);
-+ file, (__force const void __user *) data, len, &pos);
- set_fs(old_fs);
- kunmap(page);
- if (ret != len)
-diff -urNp linux-2.6.32.45/fs/cifs/cifs_debug.c linux-2.6.32.45/fs/cifs/cifs_debug.c
---- linux-2.6.32.45/fs/cifs/cifs_debug.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/cifs/cifs_debug.c 2011-05-04 17:56:28.000000000 -0400
-@@ -256,25 +256,25 @@ static ssize_t cifs_stats_proc_write(str
- tcon = list_entry(tmp3,
- struct cifsTconInfo,
- tcon_list);
-- atomic_set(&tcon->num_smbs_sent, 0);
-- atomic_set(&tcon->num_writes, 0);
-- atomic_set(&tcon->num_reads, 0);
-- atomic_set(&tcon->num_oplock_brks, 0);
-- atomic_set(&tcon->num_opens, 0);
-- atomic_set(&tcon->num_posixopens, 0);
-- atomic_set(&tcon->num_posixmkdirs, 0);
-- atomic_set(&tcon->num_closes, 0);
-- atomic_set(&tcon->num_deletes, 0);
-- atomic_set(&tcon->num_mkdirs, 0);
-- atomic_set(&tcon->num_rmdirs, 0);
-- atomic_set(&tcon->num_renames, 0);
-- atomic_set(&tcon->num_t2renames, 0);
-- atomic_set(&tcon->num_ffirst, 0);
-- atomic_set(&tcon->num_fnext, 0);
-- atomic_set(&tcon->num_fclose, 0);
-- atomic_set(&tcon->num_hardlinks, 0);
-- atomic_set(&tcon->num_symlinks, 0);
-- atomic_set(&tcon->num_locks, 0);
-+ atomic_set_unchecked(&tcon->num_smbs_sent, 0);
-+ atomic_set_unchecked(&tcon->num_writes, 0);
-+ atomic_set_unchecked(&tcon->num_reads, 0);
-+ atomic_set_unchecked(&tcon->num_oplock_brks, 0);
-+ atomic_set_unchecked(&tcon->num_opens, 0);
-+ atomic_set_unchecked(&tcon->num_posixopens, 0);
-+ atomic_set_unchecked(&tcon->num_posixmkdirs, 0);
-+ atomic_set_unchecked(&tcon->num_closes, 0);
-+ atomic_set_unchecked(&tcon->num_deletes, 0);
-+ atomic_set_unchecked(&tcon->num_mkdirs, 0);
-+ atomic_set_unchecked(&tcon->num_rmdirs, 0);
-+ atomic_set_unchecked(&tcon->num_renames, 0);
-+ atomic_set_unchecked(&tcon->num_t2renames, 0);
-+ atomic_set_unchecked(&tcon->num_ffirst, 0);
-+ atomic_set_unchecked(&tcon->num_fnext, 0);
-+ atomic_set_unchecked(&tcon->num_fclose, 0);
-+ atomic_set_unchecked(&tcon->num_hardlinks, 0);
-+ atomic_set_unchecked(&tcon->num_symlinks, 0);
-+ atomic_set_unchecked(&tcon->num_locks, 0);
- }
- }
- }
-@@ -334,41 +334,41 @@ static int cifs_stats_proc_show(struct s
- if (tcon->need_reconnect)
- seq_puts(m, "\tDISCONNECTED ");
- seq_printf(m, "\nSMBs: %d Oplock Breaks: %d",
-- atomic_read(&tcon->num_smbs_sent),
-- atomic_read(&tcon->num_oplock_brks));
-+ atomic_read_unchecked(&tcon->num_smbs_sent),
-+ atomic_read_unchecked(&tcon->num_oplock_brks));
- seq_printf(m, "\nReads: %d Bytes: %lld",
-- atomic_read(&tcon->num_reads),
-+ atomic_read_unchecked(&tcon->num_reads),
- (long long)(tcon->bytes_read));
- seq_printf(m, "\nWrites: %d Bytes: %lld",
-- atomic_read(&tcon->num_writes),
-+ atomic_read_unchecked(&tcon->num_writes),
- (long long)(tcon->bytes_written));
- seq_printf(m, "\nFlushes: %d",
-- atomic_read(&tcon->num_flushes));
-+ atomic_read_unchecked(&tcon->num_flushes));
- seq_printf(m, "\nLocks: %d HardLinks: %d "
- "Symlinks: %d",
-- atomic_read(&tcon->num_locks),
-- atomic_read(&tcon->num_hardlinks),
-- atomic_read(&tcon->num_symlinks));
-+ atomic_read_unchecked(&tcon->num_locks),
-+ atomic_read_unchecked(&tcon->num_hardlinks),
-+ atomic_read_unchecked(&tcon->num_symlinks));
- seq_printf(m, "\nOpens: %d Closes: %d "
- "Deletes: %d",
-- atomic_read(&tcon->num_opens),
-- atomic_read(&tcon->num_closes),
-- atomic_read(&tcon->num_deletes));
-+ atomic_read_unchecked(&tcon->num_opens),
-+ atomic_read_unchecked(&tcon->num_closes),
-+ atomic_read_unchecked(&tcon->num_deletes));
- seq_printf(m, "\nPosix Opens: %d "
- "Posix Mkdirs: %d",
-- atomic_read(&tcon->num_posixopens),
-- atomic_read(&tcon->num_posixmkdirs));
-+ atomic_read_unchecked(&tcon->num_posixopens),
-+ atomic_read_unchecked(&tcon->num_posixmkdirs));
- seq_printf(m, "\nMkdirs: %d Rmdirs: %d",
-- atomic_read(&tcon->num_mkdirs),
-- atomic_read(&tcon->num_rmdirs));
-+ atomic_read_unchecked(&tcon->num_mkdirs),
-+ atomic_read_unchecked(&tcon->num_rmdirs));
- seq_printf(m, "\nRenames: %d T2 Renames %d",
-- atomic_read(&tcon->num_renames),
-- atomic_read(&tcon->num_t2renames));
-+ atomic_read_unchecked(&tcon->num_renames),
-+ atomic_read_unchecked(&tcon->num_t2renames));
- seq_printf(m, "\nFindFirst: %d FNext %d "
- "FClose %d",
-- atomic_read(&tcon->num_ffirst),
-- atomic_read(&tcon->num_fnext),
-- atomic_read(&tcon->num_fclose));
-+ atomic_read_unchecked(&tcon->num_ffirst),
-+ atomic_read_unchecked(&tcon->num_fnext),
-+ atomic_read_unchecked(&tcon->num_fclose));
- }
- }
- }
-diff -urNp linux-2.6.32.45/fs/cifs/cifsglob.h linux-2.6.32.45/fs/cifs/cifsglob.h
---- linux-2.6.32.45/fs/cifs/cifsglob.h 2011-08-09 18:35:29.000000000 -0400
-+++ linux-2.6.32.45/fs/cifs/cifsglob.h 2011-08-09 18:34:00.000000000 -0400
-@@ -252,28 +252,28 @@ struct cifsTconInfo {
- __u16 Flags; /* optional support bits */
- enum statusEnum tidStatus;
- #ifdef CONFIG_CIFS_STATS
-- atomic_t num_smbs_sent;
-- atomic_t num_writes;
-- atomic_t num_reads;
-- atomic_t num_flushes;
-- atomic_t num_oplock_brks;
-- atomic_t num_opens;
-- atomic_t num_closes;
-- atomic_t num_deletes;
-- atomic_t num_mkdirs;
-- atomic_t num_posixopens;
-- atomic_t num_posixmkdirs;
-- atomic_t num_rmdirs;
-- atomic_t num_renames;
-- atomic_t num_t2renames;
-- atomic_t num_ffirst;
-- atomic_t num_fnext;
-- atomic_t num_fclose;
-- atomic_t num_hardlinks;
-- atomic_t num_symlinks;
-- atomic_t num_locks;
-- atomic_t num_acl_get;
-- atomic_t num_acl_set;
-+ atomic_unchecked_t num_smbs_sent;
-+ atomic_unchecked_t num_writes;
-+ atomic_unchecked_t num_reads;
-+ atomic_unchecked_t num_flushes;
-+ atomic_unchecked_t num_oplock_brks;
-+ atomic_unchecked_t num_opens;
-+ atomic_unchecked_t num_closes;
-+ atomic_unchecked_t num_deletes;
-+ atomic_unchecked_t num_mkdirs;
-+ atomic_unchecked_t num_posixopens;
-+ atomic_unchecked_t num_posixmkdirs;
-+ atomic_unchecked_t num_rmdirs;
-+ atomic_unchecked_t num_renames;
-+ atomic_unchecked_t num_t2renames;
-+ atomic_unchecked_t num_ffirst;
-+ atomic_unchecked_t num_fnext;
-+ atomic_unchecked_t num_fclose;
-+ atomic_unchecked_t num_hardlinks;
-+ atomic_unchecked_t num_symlinks;
-+ atomic_unchecked_t num_locks;
-+ atomic_unchecked_t num_acl_get;
-+ atomic_unchecked_t num_acl_set;
- #ifdef CONFIG_CIFS_STATS2
- unsigned long long time_writes;
- unsigned long long time_reads;
-@@ -414,7 +414,7 @@ static inline char CIFS_DIR_SEP(const st
- }
-
- #ifdef CONFIG_CIFS_STATS
--#define cifs_stats_inc atomic_inc
-+#define cifs_stats_inc atomic_inc_unchecked
-
- static inline void cifs_stats_bytes_written(struct cifsTconInfo *tcon,
- unsigned int bytes)
-diff -urNp linux-2.6.32.45/fs/cifs/link.c linux-2.6.32.45/fs/cifs/link.c
---- linux-2.6.32.45/fs/cifs/link.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/cifs/link.c 2011-04-17 15:56:46.000000000 -0400
-@@ -215,7 +215,7 @@ cifs_symlink(struct inode *inode, struct
-
- void cifs_put_link(struct dentry *direntry, struct nameidata *nd, void *cookie)
- {
-- char *p = nd_get_link(nd);
-+ const char *p = nd_get_link(nd);
- if (!IS_ERR(p))
- kfree(p);
- }
-diff -urNp linux-2.6.32.45/fs/coda/cache.c linux-2.6.32.45/fs/coda/cache.c
---- linux-2.6.32.45/fs/coda/cache.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/coda/cache.c 2011-05-04 17:56:28.000000000 -0400
-@@ -24,14 +24,14 @@
- #include <linux/coda_fs_i.h>
- #include <linux/coda_cache.h>
-
--static atomic_t permission_epoch = ATOMIC_INIT(0);
-+static atomic_unchecked_t permission_epoch = ATOMIC_INIT(0);
-
- /* replace or extend an acl cache hit */
- void coda_cache_enter(struct inode *inode, int mask)
- {
- struct coda_inode_info *cii = ITOC(inode);
-
-- cii->c_cached_epoch = atomic_read(&permission_epoch);
-+ cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch);
- if (cii->c_uid != current_fsuid()) {
- cii->c_uid = current_fsuid();
- cii->c_cached_perm = mask;
-@@ -43,13 +43,13 @@ void coda_cache_enter(struct inode *inod
- void coda_cache_clear_inode(struct inode *inode)
- {
- struct coda_inode_info *cii = ITOC(inode);
-- cii->c_cached_epoch = atomic_read(&permission_epoch) - 1;
-+ cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch) - 1;
- }
-
- /* remove all acl caches */
- void coda_cache_clear_all(struct super_block *sb)
- {
-- atomic_inc(&permission_epoch);
-+ atomic_inc_unchecked(&permission_epoch);
- }
-
-
-@@ -61,7 +61,7 @@ int coda_cache_check(struct inode *inode
-
- hit = (mask & cii->c_cached_perm) == mask &&
- cii->c_uid == current_fsuid() &&
-- cii->c_cached_epoch == atomic_read(&permission_epoch);
-+ cii->c_cached_epoch == atomic_read_unchecked(&permission_epoch);
-
- return hit;
- }
-diff -urNp linux-2.6.32.45/fs/compat_binfmt_elf.c linux-2.6.32.45/fs/compat_binfmt_elf.c
---- linux-2.6.32.45/fs/compat_binfmt_elf.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/compat_binfmt_elf.c 2011-04-17 15:56:46.000000000 -0400
-@@ -29,10 +29,12 @@
- #undef elfhdr
- #undef elf_phdr
- #undef elf_note
-+#undef elf_dyn
- #undef elf_addr_t
- #define elfhdr elf32_hdr
- #define elf_phdr elf32_phdr
- #define elf_note elf32_note
-+#define elf_dyn Elf32_Dyn
- #define elf_addr_t Elf32_Addr
-
- /*
-diff -urNp linux-2.6.32.45/fs/compat.c linux-2.6.32.45/fs/compat.c
---- linux-2.6.32.45/fs/compat.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.45/fs/compat.c 2011-08-11 19:56:56.000000000 -0400
-@@ -830,6 +830,7 @@ struct compat_old_linux_dirent {
-
- struct compat_readdir_callback {
- struct compat_old_linux_dirent __user *dirent;
-+ struct file * file;
- int result;
- };
-
-@@ -847,6 +848,10 @@ static int compat_fillonedir(void *__buf
- buf->result = -EOVERFLOW;
- return -EOVERFLOW;
- }
-+
-+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
-+ return 0;
-+
- buf->result++;
- dirent = buf->dirent;
- if (!access_ok(VERIFY_WRITE, dirent,
-@@ -879,6 +884,7 @@ asmlinkage long compat_sys_old_readdir(u
-
- buf.result = 0;
- buf.dirent = dirent;
-+ buf.file = file;
-
- error = vfs_readdir(file, compat_fillonedir, &buf);
- if (buf.result)
-@@ -899,6 +905,7 @@ struct compat_linux_dirent {
- struct compat_getdents_callback {
- struct compat_linux_dirent __user *current_dir;
- struct compat_linux_dirent __user *previous;
-+ struct file * file;
- int count;
- int error;
- };
-@@ -919,6 +926,10 @@ static int compat_filldir(void *__buf, c
- buf->error = -EOVERFLOW;
- return -EOVERFLOW;
- }
-+
-+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
-+ return 0;
-+
- dirent = buf->previous;
- if (dirent) {
- if (__put_user(offset, &dirent->d_off))
-@@ -966,6 +977,7 @@ asmlinkage long compat_sys_getdents(unsi
- buf.previous = NULL;
- buf.count = count;
- buf.error = 0;
-+ buf.file = file;
-
- error = vfs_readdir(file, compat_filldir, &buf);
- if (error >= 0)
-@@ -987,6 +999,7 @@ out:
- struct compat_getdents_callback64 {
- struct linux_dirent64 __user *current_dir;
- struct linux_dirent64 __user *previous;
-+ struct file * file;
- int count;
- int error;
- };
-@@ -1003,6 +1016,10 @@ static int compat_filldir64(void * __buf
- buf->error = -EINVAL; /* only used if we fail.. */
- if (reclen > buf->count)
- return -EINVAL;
-+
-+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
-+ return 0;
-+
- dirent = buf->previous;
-
- if (dirent) {
-@@ -1054,6 +1071,7 @@ asmlinkage long compat_sys_getdents64(un
- buf.previous = NULL;
- buf.count = count;
- buf.error = 0;
-+ buf.file = file;
-
- error = vfs_readdir(file, compat_filldir64, &buf);
- if (error >= 0)
-@@ -1098,7 +1116,7 @@ static ssize_t compat_do_readv_writev(in
- * verify all the pointers
- */
- ret = -EINVAL;
-- if ((nr_segs > UIO_MAXIOV) || (nr_segs <= 0))
-+ if (nr_segs > UIO_MAXIOV)
- goto out;
- if (!file->f_op)
- goto out;
-@@ -1463,11 +1481,35 @@ int compat_do_execve(char * filename,
- compat_uptr_t __user *envp,
- struct pt_regs * regs)
- {
-+#ifdef CONFIG_GRKERNSEC
-+ struct file *old_exec_file;
-+ struct acl_subject_label *old_acl;
-+ struct rlimit old_rlim[RLIM_NLIMITS];
-+#endif
- struct linux_binprm *bprm;
- struct file *file;
- struct files_struct *displaced;
- bool clear_in_exec;
- int retval;
-+ const struct cred *cred = current_cred();
-+
-+ /*
-+ * We move the actual failure in case of RLIMIT_NPROC excess from
-+ * set*uid() to execve() because too many poorly written programs
-+ * don't check setuid() return code. Here we additionally recheck
-+ * whether NPROC limit is still exceeded.
-+ */
-+ gr_learn_resource(current, RLIMIT_NPROC, atomic_read(¤t->cred->user->processes), 1);
-+
-+ if ((current->flags & PF_NPROC_EXCEEDED) &&
-+ atomic_read(&cred->user->processes) > current->signal->rlim[RLIMIT_NPROC].rlim_cur) {
-+ retval = -EAGAIN;
-+ goto out_ret;
-+ }
-+
-+ /* We're below the limit (still or again), so we don't want to make
-+ * further execve() calls fail. */
-+ current->flags &= ~PF_NPROC_EXCEEDED;
-
- retval = unshare_files(&displaced);
- if (retval)
-@@ -1499,6 +1541,15 @@ int compat_do_execve(char * filename,
- bprm->filename = filename;
- bprm->interp = filename;
-
-+ if (gr_process_user_ban()) {
-+ retval = -EPERM;
-+ goto out_file;
-+ }
-+
-+ retval = -EACCES;
-+ if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt))
-+ goto out_file;
-+
- retval = bprm_mm_init(bprm);
- if (retval)
- goto out_file;
-@@ -1528,9 +1579,40 @@ int compat_do_execve(char * filename,
- if (retval < 0)
- goto out;
-
-+ if (!gr_tpe_allow(file)) {
-+ retval = -EACCES;
-+ goto out;
-+ }
-+
-+ if (gr_check_crash_exec(file)) {
-+ retval = -EACCES;
-+ goto out;
-+ }
-+
-+ gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
-+
-+ gr_handle_exec_args_compat(bprm, argv);
-+
-+#ifdef CONFIG_GRKERNSEC
-+ old_acl = current->acl;
-+ memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
-+ old_exec_file = current->exec_file;
-+ get_file(file);
-+ current->exec_file = file;
-+#endif
-+
-+ retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
-+ bprm->unsafe & LSM_UNSAFE_SHARE);
-+ if (retval < 0)
-+ goto out_fail;
-+
- retval = search_binary_handler(bprm, regs);
- if (retval < 0)
-- goto out;
-+ goto out_fail;
-+#ifdef CONFIG_GRKERNSEC
-+ if (old_exec_file)
-+ fput(old_exec_file);
-+#endif
-
- /* execve succeeded */
- current->fs->in_exec = 0;
-@@ -1541,6 +1623,14 @@ int compat_do_execve(char * filename,
- put_files_struct(displaced);
- return retval;
-
-+out_fail:
-+#ifdef CONFIG_GRKERNSEC
-+ current->acl = old_acl;
-+ memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
-+ fput(current->exec_file);
-+ current->exec_file = old_exec_file;
-+#endif
-+
- out:
- if (bprm->mm) {
- acct_arg_size(bprm, 0);
-@@ -1711,6 +1801,8 @@ int compat_core_sys_select(int n, compat
- struct fdtable *fdt;
- long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
-
-+ pax_track_stack();
-+
- if (n < 0)
- goto out_nofds;
-
-diff -urNp linux-2.6.32.45/fs/compat_ioctl.c linux-2.6.32.45/fs/compat_ioctl.c
---- linux-2.6.32.45/fs/compat_ioctl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/compat_ioctl.c 2011-04-23 12:56:11.000000000 -0400
-@@ -234,6 +234,8 @@ static int do_video_set_spu_palette(unsi
- up = (struct compat_video_spu_palette __user *) arg;
- err = get_user(palp, &up->palette);
- err |= get_user(length, &up->length);
-+ if (err)
-+ return -EFAULT;
-
- up_native = compat_alloc_user_space(sizeof(struct video_spu_palette));
- err = put_user(compat_ptr(palp), &up_native->palette);
-diff -urNp linux-2.6.32.45/fs/configfs/dir.c linux-2.6.32.45/fs/configfs/dir.c
---- linux-2.6.32.45/fs/configfs/dir.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/configfs/dir.c 2011-05-11 18:25:15.000000000 -0400
-@@ -1572,7 +1572,8 @@ static int configfs_readdir(struct file
- }
- for (p=q->next; p!= &parent_sd->s_children; p=p->next) {
- struct configfs_dirent *next;
-- const char * name;
-+ const unsigned char * name;
-+ char d_name[sizeof(next->s_dentry->d_iname)];
- int len;
-
- next = list_entry(p, struct configfs_dirent,
-@@ -1581,7 +1582,12 @@ static int configfs_readdir(struct file
- continue;
-
- name = configfs_get_name(next);
-- len = strlen(name);
-+ if (next->s_dentry && name == next->s_dentry->d_iname) {
-+ len = next->s_dentry->d_name.len;
-+ memcpy(d_name, name, len);
-+ name = d_name;
-+ } else
-+ len = strlen(name);
- if (next->s_dentry)
- ino = next->s_dentry->d_inode->i_ino;
- else
-diff -urNp linux-2.6.32.45/fs/dcache.c linux-2.6.32.45/fs/dcache.c
---- linux-2.6.32.45/fs/dcache.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/dcache.c 2011-04-23 13:32:21.000000000 -0400
-@@ -45,8 +45,6 @@ EXPORT_SYMBOL(dcache_lock);
-
- static struct kmem_cache *dentry_cache __read_mostly;
-
--#define DNAME_INLINE_LEN (sizeof(struct dentry)-offsetof(struct dentry,d_iname))
--
- /*
- * This is the single most critical data structure when it comes
- * to the dcache: the hashtable for lookups. Somebody should try
-@@ -2319,7 +2317,7 @@ void __init vfs_caches_init(unsigned lon
- mempages -= reserve;
-
- names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
-- SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
-+ SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_USERCOPY, NULL);
-
- dcache_init();
- inode_init();
-diff -urNp linux-2.6.32.45/fs/dlm/lockspace.c linux-2.6.32.45/fs/dlm/lockspace.c
---- linux-2.6.32.45/fs/dlm/lockspace.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/dlm/lockspace.c 2011-04-17 15:56:46.000000000 -0400
-@@ -148,7 +148,7 @@ static void lockspace_kobj_release(struc
- kfree(ls);
- }
-
--static struct sysfs_ops dlm_attr_ops = {
-+static const struct sysfs_ops dlm_attr_ops = {
- .show = dlm_attr_show,
- .store = dlm_attr_store,
- };
-diff -urNp linux-2.6.32.45/fs/ecryptfs/inode.c linux-2.6.32.45/fs/ecryptfs/inode.c
---- linux-2.6.32.45/fs/ecryptfs/inode.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/ecryptfs/inode.c 2011-04-17 15:56:46.000000000 -0400
-@@ -660,7 +660,7 @@ static int ecryptfs_readlink_lower(struc
- old_fs = get_fs();
- set_fs(get_ds());
- rc = lower_dentry->d_inode->i_op->readlink(lower_dentry,
-- (char __user *)lower_buf,
-+ (__force char __user *)lower_buf,
- lower_bufsiz);
- set_fs(old_fs);
- if (rc < 0)
-@@ -706,7 +706,7 @@ static void *ecryptfs_follow_link(struct
- }
- old_fs = get_fs();
- set_fs(get_ds());
-- rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
-+ rc = dentry->d_inode->i_op->readlink(dentry, (__force char __user *)buf, len);
- set_fs(old_fs);
- if (rc < 0)
- goto out_free;
-diff -urNp linux-2.6.32.45/fs/exec.c linux-2.6.32.45/fs/exec.c
---- linux-2.6.32.45/fs/exec.c 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.45/fs/exec.c 2011-08-11 19:56:19.000000000 -0400
-@@ -56,12 +56,24 @@
- #include <linux/fsnotify.h>
- #include <linux/fs_struct.h>
- #include <linux/pipe_fs_i.h>
-+#include <linux/random.h>
-+#include <linux/seq_file.h>
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#include <linux/kallsyms.h>
-+#include <linux/kdebug.h>
-+#endif
-
- #include <asm/uaccess.h>
- #include <asm/mmu_context.h>
- #include <asm/tlb.h>
- #include "internal.h"
-
-+#ifdef CONFIG_PAX_HOOK_ACL_FLAGS
-+void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
-+EXPORT_SYMBOL(pax_set_initial_flags_func);
-+#endif
-+
- int core_uses_pid;
- char core_pattern[CORENAME_MAX_SIZE] = "core";
- unsigned int core_pipe_limit;
-@@ -115,7 +127,7 @@ SYSCALL_DEFINE1(uselib, const char __use
- goto out;
-
- file = do_filp_open(AT_FDCWD, tmp,
-- O_LARGEFILE | O_RDONLY | FMODE_EXEC, 0,
-+ O_LARGEFILE | O_RDONLY | FMODE_EXEC | FMODE_GREXEC, 0,
- MAY_READ | MAY_EXEC | MAY_OPEN);
- putname(tmp);
- error = PTR_ERR(file);
-@@ -178,18 +190,10 @@ struct page *get_arg_page(struct linux_b
- int write)
- {
- struct page *page;
-- int ret;
-
--#ifdef CONFIG_STACK_GROWSUP
-- if (write) {
-- ret = expand_stack_downwards(bprm->vma, pos);
-- if (ret < 0)
-- return NULL;
-- }
--#endif
-- ret = get_user_pages(current, bprm->mm, pos,
-- 1, write, 1, &page, NULL);
-- if (ret <= 0)
-+ if (0 > expand_stack_downwards(bprm->vma, pos))
-+ return NULL;
-+ if (0 >= get_user_pages(current, bprm->mm, pos, 1, write, 1, &page, NULL))
- return NULL;
-
- if (write) {
-@@ -263,6 +267,11 @@ static int __bprm_mm_init(struct linux_b
- vma->vm_end = STACK_TOP_MAX;
- vma->vm_start = vma->vm_end - PAGE_SIZE;
- vma->vm_flags = VM_STACK_FLAGS;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ vma->vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
-+#endif
-+
- vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
-
- err = security_file_mmap(NULL, 0, 0, 0, vma->vm_start, 1);
-@@ -276,6 +285,12 @@ static int __bprm_mm_init(struct linux_b
- mm->stack_vm = mm->total_vm = 1;
- up_write(&mm->mmap_sem);
- bprm->p = vma->vm_end - sizeof(void *);
-+
-+#ifdef CONFIG_PAX_RANDUSTACK
-+ if (randomize_va_space)
-+ bprm->p ^= (pax_get_random_long() & ~15) & ~PAGE_MASK;
-+#endif
-+
- return 0;
- err:
- up_write(&mm->mmap_sem);
-@@ -510,7 +525,7 @@ int copy_strings_kernel(int argc,char **
- int r;
- mm_segment_t oldfs = get_fs();
- set_fs(KERNEL_DS);
-- r = copy_strings(argc, (char __user * __user *)argv, bprm);
-+ r = copy_strings(argc, (__force char __user * __user *)argv, bprm);
- set_fs(oldfs);
- return r;
- }
-@@ -540,7 +555,8 @@ static int shift_arg_pages(struct vm_are
- unsigned long new_end = old_end - shift;
- struct mmu_gather *tlb;
-
-- BUG_ON(new_start > new_end);
-+ if (new_start >= new_end || new_start < mmap_min_addr)
-+ return -ENOMEM;
-
- /*
- * ensure there are no vmas between where we want to go
-@@ -549,6 +565,10 @@ static int shift_arg_pages(struct vm_are
- if (vma != find_vma(mm, new_start))
- return -EFAULT;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ BUG_ON(pax_find_mirror_vma(vma));
-+#endif
-+
- /*
- * cover the whole range: [new_start, old_end)
- */
-@@ -630,10 +650,6 @@ int setup_arg_pages(struct linux_binprm
- stack_top = arch_align_stack(stack_top);
- stack_top = PAGE_ALIGN(stack_top);
-
-- if (unlikely(stack_top < mmap_min_addr) ||
-- unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr))
-- return -ENOMEM;
--
- stack_shift = vma->vm_end - stack_top;
-
- bprm->p -= stack_shift;
-@@ -645,6 +661,14 @@ int setup_arg_pages(struct linux_binprm
- bprm->exec -= stack_shift;
-
- down_write(&mm->mmap_sem);
-+
-+ /* Move stack pages down in memory. */
-+ if (stack_shift) {
-+ ret = shift_arg_pages(vma, stack_shift);
-+ if (ret)
-+ goto out_unlock;
-+ }
-+
- vm_flags = VM_STACK_FLAGS;
-
- /*
-@@ -658,19 +682,24 @@ int setup_arg_pages(struct linux_binprm
- vm_flags &= ~VM_EXEC;
- vm_flags |= mm->def_flags;
-
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+ if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+ vm_flags &= ~VM_EXEC;
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (mm->pax_flags & MF_PAX_MPROTECT)
-+ vm_flags &= ~VM_MAYEXEC;
-+#endif
-+
-+ }
-+#endif
-+
- ret = mprotect_fixup(vma, &prev, vma->vm_start, vma->vm_end,
- vm_flags);
- if (ret)
- goto out_unlock;
- BUG_ON(prev != vma);
-
-- /* Move stack pages down in memory. */
-- if (stack_shift) {
-- ret = shift_arg_pages(vma, stack_shift);
-- if (ret)
-- goto out_unlock;
-- }
--
- stack_expand = EXTRA_STACK_VM_PAGES * PAGE_SIZE;
- stack_size = vma->vm_end - vma->vm_start;
- /*
-@@ -707,7 +736,7 @@ struct file *open_exec(const char *name)
- int err;
-
- file = do_filp_open(AT_FDCWD, name,
-- O_LARGEFILE | O_RDONLY | FMODE_EXEC, 0,
-+ O_LARGEFILE | O_RDONLY | FMODE_EXEC | FMODE_GREXEC, 0,
- MAY_EXEC | MAY_OPEN);
- if (IS_ERR(file))
- goto out;
-@@ -744,7 +773,7 @@ int kernel_read(struct file *file, loff_
- old_fs = get_fs();
- set_fs(get_ds());
- /* The cast to a user pointer is valid due to the set_fs() */
-- result = vfs_read(file, (void __user *)addr, count, &pos);
-+ result = vfs_read(file, (__force void __user *)addr, count, &pos);
- set_fs(old_fs);
- return result;
- }
-@@ -1152,7 +1181,7 @@ int check_unsafe_exec(struct linux_binpr
- }
- rcu_read_unlock();
-
-- if (p->fs->users > n_fs) {
-+ if (atomic_read(&p->fs->users) > n_fs) {
- bprm->unsafe |= LSM_UNSAFE_SHARE;
- } else {
- res = -EAGAIN;
-@@ -1347,11 +1376,35 @@ int do_execve(char * filename,
- char __user *__user *envp,
- struct pt_regs * regs)
- {
-+#ifdef CONFIG_GRKERNSEC
-+ struct file *old_exec_file;
-+ struct acl_subject_label *old_acl;
-+ struct rlimit old_rlim[RLIM_NLIMITS];
-+#endif
- struct linux_binprm *bprm;
- struct file *file;
- struct files_struct *displaced;
- bool clear_in_exec;
- int retval;
-+ const struct cred *cred = current_cred();
-+
-+ /*
-+ * We move the actual failure in case of RLIMIT_NPROC excess from
-+ * set*uid() to execve() because too many poorly written programs
-+ * don't check setuid() return code. Here we additionally recheck
-+ * whether NPROC limit is still exceeded.
-+ */
-+ gr_learn_resource(current, RLIMIT_NPROC, atomic_read(¤t->cred->user->processes), 1);
-+
-+ if ((current->flags & PF_NPROC_EXCEEDED) &&
-+ atomic_read(&cred->user->processes) > current->signal->rlim[RLIMIT_NPROC].rlim_cur) {
-+ retval = -EAGAIN;
-+ goto out_ret;
-+ }
-+
-+ /* We're below the limit (still or again), so we don't want to make
-+ * further execve() calls fail. */
-+ current->flags &= ~PF_NPROC_EXCEEDED;
-
- retval = unshare_files(&displaced);
- if (retval)
-@@ -1383,6 +1436,16 @@ int do_execve(char * filename,
- bprm->filename = filename;
- bprm->interp = filename;
-
-+ if (gr_process_user_ban()) {
-+ retval = -EPERM;
-+ goto out_file;
-+ }
-+
-+ if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt)) {
-+ retval = -EACCES;
-+ goto out_file;
-+ }
-+
- retval = bprm_mm_init(bprm);
- if (retval)
- goto out_file;
-@@ -1412,10 +1475,41 @@ int do_execve(char * filename,
- if (retval < 0)
- goto out;
-
-+ if (!gr_tpe_allow(file)) {
-+ retval = -EACCES;
-+ goto out;
-+ }
-+
-+ if (gr_check_crash_exec(file)) {
-+ retval = -EACCES;
-+ goto out;
-+ }
-+
-+ gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
-+
-+ gr_handle_exec_args(bprm, (const char __user *const __user *)argv);
-+
-+#ifdef CONFIG_GRKERNSEC
-+ old_acl = current->acl;
-+ memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
-+ old_exec_file = current->exec_file;
-+ get_file(file);
-+ current->exec_file = file;
-+#endif
-+
-+ retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
-+ bprm->unsafe & LSM_UNSAFE_SHARE);
-+ if (retval < 0)
-+ goto out_fail;
-+
- current->flags &= ~PF_KTHREAD;
- retval = search_binary_handler(bprm,regs);
- if (retval < 0)
-- goto out;
-+ goto out_fail;
-+#ifdef CONFIG_GRKERNSEC
-+ if (old_exec_file)
-+ fput(old_exec_file);
-+#endif
-
- /* execve succeeded */
- current->fs->in_exec = 0;
-@@ -1426,6 +1520,14 @@ int do_execve(char * filename,
- put_files_struct(displaced);
- return retval;
-
-+out_fail:
-+#ifdef CONFIG_GRKERNSEC
-+ current->acl = old_acl;
-+ memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
-+ fput(current->exec_file);
-+ current->exec_file = old_exec_file;
-+#endif
-+
- out:
- if (bprm->mm) {
- acct_arg_size(bprm, 0);
-@@ -1591,6 +1693,220 @@ out:
- return ispipe;
- }
-
-+int pax_check_flags(unsigned long *flags)
-+{
-+ int retval = 0;
-+
-+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_SEGMEXEC)
-+ if (*flags & MF_PAX_SEGMEXEC)
-+ {
-+ *flags &= ~MF_PAX_SEGMEXEC;
-+ retval = -EINVAL;
-+ }
-+#endif
-+
-+ if ((*flags & MF_PAX_PAGEEXEC)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+ && (*flags & MF_PAX_SEGMEXEC)
-+#endif
-+
-+ )
-+ {
-+ *flags &= ~MF_PAX_PAGEEXEC;
-+ retval = -EINVAL;
-+ }
-+
-+ if ((*flags & MF_PAX_MPROTECT)
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
-+#endif
-+
-+ )
-+ {
-+ *flags &= ~MF_PAX_MPROTECT;
-+ retval = -EINVAL;
-+ }
-+
-+ if ((*flags & MF_PAX_EMUTRAMP)
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+ && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
-+#endif
-+
-+ )
-+ {
-+ *flags &= ~MF_PAX_EMUTRAMP;
-+ retval = -EINVAL;
-+ }
-+
-+ return retval;
-+}
-+
-+EXPORT_SYMBOL(pax_check_flags);
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+void pax_report_fault(struct pt_regs *regs, void *pc, void *sp)
-+{
-+ struct task_struct *tsk = current;
-+ struct mm_struct *mm = current->mm;
-+ char *buffer_exec = (char *)__get_free_page(GFP_KERNEL);
-+ char *buffer_fault = (char *)__get_free_page(GFP_KERNEL);
-+ char *path_exec = NULL;
-+ char *path_fault = NULL;
-+ unsigned long start = 0UL, end = 0UL, offset = 0UL;
-+
-+ if (buffer_exec && buffer_fault) {
-+ struct vm_area_struct *vma, *vma_exec = NULL, *vma_fault = NULL;
-+
-+ down_read(&mm->mmap_sem);
-+ vma = mm->mmap;
-+ while (vma && (!vma_exec || !vma_fault)) {
-+ if ((vma->vm_flags & VM_EXECUTABLE) && vma->vm_file)
-+ vma_exec = vma;
-+ if (vma->vm_start <= (unsigned long)pc && (unsigned long)pc < vma->vm_end)
-+ vma_fault = vma;
-+ vma = vma->vm_next;
-+ }
-+ if (vma_exec) {
-+ path_exec = d_path(&vma_exec->vm_file->f_path, buffer_exec, PAGE_SIZE);
-+ if (IS_ERR(path_exec))
-+ path_exec = "<path too long>";
-+ else {
-+ path_exec = mangle_path(buffer_exec, path_exec, "\t\n\\");
-+ if (path_exec) {
-+ *path_exec = 0;
-+ path_exec = buffer_exec;
-+ } else
-+ path_exec = "<path too long>";
-+ }
-+ }
-+ if (vma_fault) {
-+ start = vma_fault->vm_start;
-+ end = vma_fault->vm_end;
-+ offset = vma_fault->vm_pgoff << PAGE_SHIFT;
-+ if (vma_fault->vm_file) {
-+ path_fault = d_path(&vma_fault->vm_file->f_path, buffer_fault, PAGE_SIZE);
-+ if (IS_ERR(path_fault))
-+ path_fault = "<path too long>";
-+ else {
-+ path_fault = mangle_path(buffer_fault, path_fault, "\t\n\\");
-+ if (path_fault) {
-+ *path_fault = 0;
-+ path_fault = buffer_fault;
-+ } else
-+ path_fault = "<path too long>";
-+ }
-+ } else
-+ path_fault = "<anonymous mapping>";
-+ }
-+ up_read(&mm->mmap_sem);
-+ }
-+ if (tsk->signal->curr_ip)
-+ printk(KERN_ERR "PAX: From %pI4: execution attempt in: %s, %08lx-%08lx %08lx\n", &tsk->signal->curr_ip, path_fault, start, end, offset);
-+ else
-+ printk(KERN_ERR "PAX: execution attempt in: %s, %08lx-%08lx %08lx\n", path_fault, start, end, offset);
-+ printk(KERN_ERR "PAX: terminating task: %s(%s):%d, uid/euid: %u/%u, "
-+ "PC: %p, SP: %p\n", path_exec, tsk->comm, task_pid_nr(tsk),
-+ task_uid(tsk), task_euid(tsk), pc, sp);
-+ free_page((unsigned long)buffer_exec);
-+ free_page((unsigned long)buffer_fault);
-+ pax_report_insns(pc, sp);
-+ do_coredump(SIGKILL, SIGKILL, regs);
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+void pax_report_refcount_overflow(struct pt_regs *regs)
-+{
-+ if (current->signal->curr_ip)
-+ printk(KERN_ERR "PAX: From %pI4: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
-+ ¤t->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
-+ else
-+ printk(KERN_ERR "PAX: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
-+ current->comm, task_pid_nr(current), current_uid(), current_euid());
-+ print_symbol(KERN_ERR "PAX: refcount overflow occured at: %s\n", instruction_pointer(regs));
-+ show_regs(regs);
-+ force_sig_specific(SIGKILL, current);
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+/* 0: not at all, 1: fully, 2: fully inside frame, -1: partially (implies an error) */
-+int object_is_on_stack(const void *obj, unsigned long len)
-+{
-+ const void * const stack = task_stack_page(current);
-+ const void * const stackend = stack + THREAD_SIZE;
-+
-+#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
-+ const void *frame = NULL;
-+ const void *oldframe;
-+#endif
-+
-+ if (obj + len < obj)
-+ return -1;
-+
-+ if (obj + len <= stack || stackend <= obj)
-+ return 0;
-+
-+ if (obj < stack || stackend < obj + len)
-+ return -1;
-+
-+#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
-+ oldframe = __builtin_frame_address(1);
-+ if (oldframe)
-+ frame = __builtin_frame_address(2);
-+ /*
-+ low ----------------------------------------------> high
-+ [saved bp][saved ip][args][local vars][saved bp][saved ip]
-+ ^----------------^
-+ allow copies only within here
-+ */
-+ while (stack <= frame && frame < stackend) {
-+ /* if obj + len extends past the last frame, this
-+ check won't pass and the next frame will be 0,
-+ causing us to bail out and correctly report
-+ the copy as invalid
-+ */
-+ if (obj + len <= frame)
-+ return obj >= oldframe + 2 * sizeof(void *) ? 2 : -1;
-+ oldframe = frame;
-+ frame = *(const void * const *)frame;
-+ }
-+ return -1;
-+#else
-+ return 1;
-+#endif
-+}
-+
-+
-+NORET_TYPE void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type)
-+{
-+ if (current->signal->curr_ip)
-+ printk(KERN_ERR "PAX: From %pI4: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
-+ ¤t->signal->curr_ip, to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
-+ else
-+ printk(KERN_ERR "PAX: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
-+ to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
-+
-+ dump_stack();
-+ gr_handle_kernel_exploit();
-+ do_group_exit(SIGKILL);
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
-+void pax_track_stack(void)
-+{
-+ unsigned long sp = (unsigned long)&sp;
-+ if (sp < current_thread_info()->lowest_stack &&
-+ sp > (unsigned long)task_stack_page(current))
-+ current_thread_info()->lowest_stack = sp;
-+}
-+EXPORT_SYMBOL(pax_track_stack);
-+#endif
-+
- static int zap_process(struct task_struct *start)
- {
- struct task_struct *t;
-@@ -1793,17 +2109,17 @@ static void wait_for_dump_helpers(struct
- pipe = file->f_path.dentry->d_inode->i_pipe;
-
- pipe_lock(pipe);
-- pipe->readers++;
-- pipe->writers--;
-+ atomic_inc(&pipe->readers);
-+ atomic_dec(&pipe->writers);
-
-- while ((pipe->readers > 1) && (!signal_pending(current))) {
-+ while ((atomic_read(&pipe->readers) > 1) && (!signal_pending(current))) {
- wake_up_interruptible_sync(&pipe->wait);
- kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
- pipe_wait(pipe);
- }
-
-- pipe->readers--;
-- pipe->writers++;
-+ atomic_dec(&pipe->readers);
-+ atomic_inc(&pipe->writers);
- pipe_unlock(pipe);
-
- }
-@@ -1826,10 +2142,13 @@ void do_coredump(long signr, int exit_co
- char **helper_argv = NULL;
- int helper_argc = 0;
- int dump_count = 0;
-- static atomic_t core_dump_count = ATOMIC_INIT(0);
-+ static atomic_unchecked_t core_dump_count = ATOMIC_INIT(0);
-
- audit_core_dumps(signr);
-
-+ if (signr == SIGSEGV || signr == SIGBUS || signr == SIGKILL || signr == SIGILL)
-+ gr_handle_brute_attach(current, mm->flags);
-+
- binfmt = mm->binfmt;
- if (!binfmt || !binfmt->core_dump)
- goto fail;
-@@ -1874,6 +2193,8 @@ void do_coredump(long signr, int exit_co
- */
- clear_thread_flag(TIF_SIGPENDING);
-
-+ gr_learn_resource(current, RLIMIT_CORE, binfmt->min_coredump, 1);
-+
- /*
- * lock_kernel() because format_corename() is controlled by sysctl, which
- * uses lock_kernel()
-@@ -1908,7 +2229,7 @@ void do_coredump(long signr, int exit_co
- goto fail_unlock;
- }
-
-- dump_count = atomic_inc_return(&core_dump_count);
-+ dump_count = atomic_inc_return_unchecked(&core_dump_count);
- if (core_pipe_limit && (core_pipe_limit < dump_count)) {
- printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
- task_tgid_vnr(current), current->comm);
-@@ -1972,7 +2293,7 @@ close_fail:
- filp_close(file, NULL);
- fail_dropcount:
- if (dump_count)
-- atomic_dec(&core_dump_count);
-+ atomic_dec_unchecked(&core_dump_count);
- fail_unlock:
- if (helper_argv)
- argv_free(helper_argv);
-diff -urNp linux-2.6.32.45/fs/ext2/balloc.c linux-2.6.32.45/fs/ext2/balloc.c
---- linux-2.6.32.45/fs/ext2/balloc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/ext2/balloc.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1192,7 +1192,7 @@ static int ext2_has_free_blocks(struct e
-
- free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
- root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
-- if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
-+ if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
- sbi->s_resuid != current_fsuid() &&
- (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
- return 0;
-diff -urNp linux-2.6.32.45/fs/ext3/balloc.c linux-2.6.32.45/fs/ext3/balloc.c
---- linux-2.6.32.45/fs/ext3/balloc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/ext3/balloc.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1421,7 +1421,7 @@ static int ext3_has_free_blocks(struct e
-
- free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
- root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
-- if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
-+ if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
- sbi->s_resuid != current_fsuid() &&
- (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
- return 0;
-diff -urNp linux-2.6.32.45/fs/ext4/balloc.c linux-2.6.32.45/fs/ext4/balloc.c
---- linux-2.6.32.45/fs/ext4/balloc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/ext4/balloc.c 2011-04-17 15:56:46.000000000 -0400
-@@ -570,7 +570,7 @@ int ext4_has_free_blocks(struct ext4_sb_
- /* Hm, nope. Are (enough) root reserved blocks available? */
- if (sbi->s_resuid == current_fsuid() ||
- ((sbi->s_resgid != 0) && in_group_p(sbi->s_resgid)) ||
-- capable(CAP_SYS_RESOURCE)) {
-+ capable_nolog(CAP_SYS_RESOURCE)) {
- if (free_blocks >= (nblocks + dirty_blocks))
- return 1;
- }
-diff -urNp linux-2.6.32.45/fs/ext4/ext4.h linux-2.6.32.45/fs/ext4/ext4.h
---- linux-2.6.32.45/fs/ext4/ext4.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/ext4/ext4.h 2011-04-17 15:56:46.000000000 -0400
-@@ -1078,19 +1078,19 @@ struct ext4_sb_info {
-
- /* stats for buddy allocator */
- spinlock_t s_mb_pa_lock;
-- atomic_t s_bal_reqs; /* number of reqs with len > 1 */
-- atomic_t s_bal_success; /* we found long enough chunks */
-- atomic_t s_bal_allocated; /* in blocks */
-- atomic_t s_bal_ex_scanned; /* total extents scanned */
-- atomic_t s_bal_goals; /* goal hits */
-- atomic_t s_bal_breaks; /* too long searches */
-- atomic_t s_bal_2orders; /* 2^order hits */
-+ atomic_unchecked_t s_bal_reqs; /* number of reqs with len > 1 */
-+ atomic_unchecked_t s_bal_success; /* we found long enough chunks */
-+ atomic_unchecked_t s_bal_allocated; /* in blocks */
-+ atomic_unchecked_t s_bal_ex_scanned; /* total extents scanned */
-+ atomic_unchecked_t s_bal_goals; /* goal hits */
-+ atomic_unchecked_t s_bal_breaks; /* too long searches */
-+ atomic_unchecked_t s_bal_2orders; /* 2^order hits */
- spinlock_t s_bal_lock;
- unsigned long s_mb_buddies_generated;
- unsigned long long s_mb_generation_time;
-- atomic_t s_mb_lost_chunks;
-- atomic_t s_mb_preallocated;
-- atomic_t s_mb_discarded;
-+ atomic_unchecked_t s_mb_lost_chunks;
-+ atomic_unchecked_t s_mb_preallocated;
-+ atomic_unchecked_t s_mb_discarded;
- atomic_t s_lock_busy;
-
- /* locality groups */
-diff -urNp linux-2.6.32.45/fs/ext4/mballoc.c linux-2.6.32.45/fs/ext4/mballoc.c
---- linux-2.6.32.45/fs/ext4/mballoc.c 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.45/fs/ext4/mballoc.c 2011-06-25 12:56:37.000000000 -0400
-@@ -1755,7 +1755,7 @@ void ext4_mb_simple_scan_group(struct ex
- BUG_ON(ac->ac_b_ex.fe_len != ac->ac_g_ex.fe_len);
-
- if (EXT4_SB(sb)->s_mb_stats)
-- atomic_inc(&EXT4_SB(sb)->s_bal_2orders);
-+ atomic_inc_unchecked(&EXT4_SB(sb)->s_bal_2orders);
-
- break;
- }
-@@ -2131,7 +2131,7 @@ repeat:
- ac->ac_status = AC_STATUS_CONTINUE;
- ac->ac_flags |= EXT4_MB_HINT_FIRST;
- cr = 3;
-- atomic_inc(&sbi->s_mb_lost_chunks);
-+ atomic_inc_unchecked(&sbi->s_mb_lost_chunks);
- goto repeat;
- }
- }
-@@ -2174,6 +2174,8 @@ static int ext4_mb_seq_groups_show(struc
- ext4_grpblk_t counters[16];
- } sg;
-
-+ pax_track_stack();
-+
- group--;
- if (group == 0)
- seq_printf(seq, "#%-5s: %-5s %-5s %-5s "
-@@ -2534,25 +2536,25 @@ int ext4_mb_release(struct super_block *
- if (sbi->s_mb_stats) {
- printk(KERN_INFO
- "EXT4-fs: mballoc: %u blocks %u reqs (%u success)\n",
-- atomic_read(&sbi->s_bal_allocated),
-- atomic_read(&sbi->s_bal_reqs),
-- atomic_read(&sbi->s_bal_success));
-+ atomic_read_unchecked(&sbi->s_bal_allocated),
-+ atomic_read_unchecked(&sbi->s_bal_reqs),
-+ atomic_read_unchecked(&sbi->s_bal_success));
- printk(KERN_INFO
- "EXT4-fs: mballoc: %u extents scanned, %u goal hits, "
- "%u 2^N hits, %u breaks, %u lost\n",
-- atomic_read(&sbi->s_bal_ex_scanned),
-- atomic_read(&sbi->s_bal_goals),
-- atomic_read(&sbi->s_bal_2orders),
-- atomic_read(&sbi->s_bal_breaks),
-- atomic_read(&sbi->s_mb_lost_chunks));
-+ atomic_read_unchecked(&sbi->s_bal_ex_scanned),
-+ atomic_read_unchecked(&sbi->s_bal_goals),
-+ atomic_read_unchecked(&sbi->s_bal_2orders),
-+ atomic_read_unchecked(&sbi->s_bal_breaks),
-+ atomic_read_unchecked(&sbi->s_mb_lost_chunks));
- printk(KERN_INFO
- "EXT4-fs: mballoc: %lu generated and it took %Lu\n",
- sbi->s_mb_buddies_generated++,
- sbi->s_mb_generation_time);
- printk(KERN_INFO
- "EXT4-fs: mballoc: %u preallocated, %u discarded\n",
-- atomic_read(&sbi->s_mb_preallocated),
-- atomic_read(&sbi->s_mb_discarded));
-+ atomic_read_unchecked(&sbi->s_mb_preallocated),
-+ atomic_read_unchecked(&sbi->s_mb_discarded));
- }
-
- free_percpu(sbi->s_locality_groups);
-@@ -3034,16 +3036,16 @@ static void ext4_mb_collect_stats(struct
- struct ext4_sb_info *sbi = EXT4_SB(ac->ac_sb);
-
- if (sbi->s_mb_stats && ac->ac_g_ex.fe_len > 1) {
-- atomic_inc(&sbi->s_bal_reqs);
-- atomic_add(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
-+ atomic_inc_unchecked(&sbi->s_bal_reqs);
-+ atomic_add_unchecked(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
- if (ac->ac_o_ex.fe_len >= ac->ac_g_ex.fe_len)
-- atomic_inc(&sbi->s_bal_success);
-- atomic_add(ac->ac_found, &sbi->s_bal_ex_scanned);
-+ atomic_inc_unchecked(&sbi->s_bal_success);
-+ atomic_add_unchecked(ac->ac_found, &sbi->s_bal_ex_scanned);
- if (ac->ac_g_ex.fe_start == ac->ac_b_ex.fe_start &&
- ac->ac_g_ex.fe_group == ac->ac_b_ex.fe_group)
-- atomic_inc(&sbi->s_bal_goals);
-+ atomic_inc_unchecked(&sbi->s_bal_goals);
- if (ac->ac_found > sbi->s_mb_max_to_scan)
-- atomic_inc(&sbi->s_bal_breaks);
-+ atomic_inc_unchecked(&sbi->s_bal_breaks);
- }
-
- if (ac->ac_op == EXT4_MB_HISTORY_ALLOC)
-@@ -3443,7 +3445,7 @@ ext4_mb_new_inode_pa(struct ext4_allocat
- trace_ext4_mb_new_inode_pa(ac, pa);
-
- ext4_mb_use_inode_pa(ac, pa);
-- atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
-+ atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
-
- ei = EXT4_I(ac->ac_inode);
- grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
-@@ -3503,7 +3505,7 @@ ext4_mb_new_group_pa(struct ext4_allocat
- trace_ext4_mb_new_group_pa(ac, pa);
-
- ext4_mb_use_group_pa(ac, pa);
-- atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
-+ atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
-
- grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
- lg = ac->ac_lg;
-@@ -3607,7 +3609,7 @@ ext4_mb_release_inode_pa(struct ext4_bud
- * from the bitmap and continue.
- */
- }
-- atomic_add(free, &sbi->s_mb_discarded);
-+ atomic_add_unchecked(free, &sbi->s_mb_discarded);
-
- return err;
- }
-@@ -3626,7 +3628,7 @@ ext4_mb_release_group_pa(struct ext4_bud
- ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit);
- BUG_ON(group != e4b->bd_group && pa->pa_len != 0);
- mb_free_blocks(pa->pa_inode, e4b, bit, pa->pa_len);
-- atomic_add(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
-+ atomic_add_unchecked(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
-
- if (ac) {
- ac->ac_sb = sb;
-diff -urNp linux-2.6.32.45/fs/ext4/super.c linux-2.6.32.45/fs/ext4/super.c
---- linux-2.6.32.45/fs/ext4/super.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/ext4/super.c 2011-04-17 15:56:46.000000000 -0400
-@@ -2287,7 +2287,7 @@ static void ext4_sb_release(struct kobje
- }
-
-
--static struct sysfs_ops ext4_attr_ops = {
-+static const struct sysfs_ops ext4_attr_ops = {
- .show = ext4_attr_show,
- .store = ext4_attr_store,
- };
-diff -urNp linux-2.6.32.45/fs/fcntl.c linux-2.6.32.45/fs/fcntl.c
---- linux-2.6.32.45/fs/fcntl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/fcntl.c 2011-04-17 15:56:46.000000000 -0400
-@@ -223,6 +223,11 @@ int __f_setown(struct file *filp, struct
- if (err)
- return err;
-
-+ if (gr_handle_chroot_fowner(pid, type))
-+ return -ENOENT;
-+ if (gr_check_protected_task_fowner(pid, type))
-+ return -EACCES;
-+
- f_modown(filp, pid, type, force);
- return 0;
- }
-@@ -344,6 +349,7 @@ static long do_fcntl(int fd, unsigned in
- switch (cmd) {
- case F_DUPFD:
- case F_DUPFD_CLOEXEC:
-+ gr_learn_resource(current, RLIMIT_NOFILE, arg, 0);
- if (arg >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
- break;
- err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
-diff -urNp linux-2.6.32.45/fs/fifo.c linux-2.6.32.45/fs/fifo.c
---- linux-2.6.32.45/fs/fifo.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/fifo.c 2011-04-17 15:56:46.000000000 -0400
-@@ -59,10 +59,10 @@ static int fifo_open(struct inode *inode
- */
- filp->f_op = &read_pipefifo_fops;
- pipe->r_counter++;
-- if (pipe->readers++ == 0)
-+ if (atomic_inc_return(&pipe->readers) == 1)
- wake_up_partner(inode);
-
-- if (!pipe->writers) {
-+ if (!atomic_read(&pipe->writers)) {
- if ((filp->f_flags & O_NONBLOCK)) {
- /* suppress POLLHUP until we have
- * seen a writer */
-@@ -83,15 +83,15 @@ static int fifo_open(struct inode *inode
- * errno=ENXIO when there is no process reading the FIFO.
- */
- ret = -ENXIO;
-- if ((filp->f_flags & O_NONBLOCK) && !pipe->readers)
-+ if ((filp->f_flags & O_NONBLOCK) && !atomic_read(&pipe->readers))
- goto err;
-
- filp->f_op = &write_pipefifo_fops;
- pipe->w_counter++;
-- if (!pipe->writers++)
-+ if (atomic_inc_return(&pipe->writers) == 1)
- wake_up_partner(inode);
-
-- if (!pipe->readers) {
-+ if (!atomic_read(&pipe->readers)) {
- wait_for_partner(inode, &pipe->r_counter);
- if (signal_pending(current))
- goto err_wr;
-@@ -107,11 +107,11 @@ static int fifo_open(struct inode *inode
- */
- filp->f_op = &rdwr_pipefifo_fops;
-
-- pipe->readers++;
-- pipe->writers++;
-+ atomic_inc(&pipe->readers);
-+ atomic_inc(&pipe->writers);
- pipe->r_counter++;
- pipe->w_counter++;
-- if (pipe->readers == 1 || pipe->writers == 1)
-+ if (atomic_read(&pipe->readers) == 1 || atomic_read(&pipe->writers) == 1)
- wake_up_partner(inode);
- break;
-
-@@ -125,19 +125,19 @@ static int fifo_open(struct inode *inode
- return 0;
-
- err_rd:
-- if (!--pipe->readers)
-+ if (atomic_dec_and_test(&pipe->readers))
- wake_up_interruptible(&pipe->wait);
- ret = -ERESTARTSYS;
- goto err;
-
- err_wr:
-- if (!--pipe->writers)
-+ if (atomic_dec_and_test(&pipe->writers))
- wake_up_interruptible(&pipe->wait);
- ret = -ERESTARTSYS;
- goto err;
-
- err:
-- if (!pipe->readers && !pipe->writers)
-+ if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers))
- free_pipe_info(inode);
-
- err_nocleanup:
-diff -urNp linux-2.6.32.45/fs/file.c linux-2.6.32.45/fs/file.c
---- linux-2.6.32.45/fs/file.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/file.c 2011-04-17 15:56:46.000000000 -0400
-@@ -14,6 +14,7 @@
- #include <linux/slab.h>
- #include <linux/vmalloc.h>
- #include <linux/file.h>
-+#include <linux/security.h>
- #include <linux/fdtable.h>
- #include <linux/bitops.h>
- #include <linux/interrupt.h>
-@@ -257,6 +258,8 @@ int expand_files(struct files_struct *fi
- * N.B. For clone tasks sharing a files structure, this test
- * will limit the total number of files that can be opened.
- */
-+
-+ gr_learn_resource(current, RLIMIT_NOFILE, nr, 0);
- if (nr >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
- return -EMFILE;
-
-diff -urNp linux-2.6.32.45/fs/filesystems.c linux-2.6.32.45/fs/filesystems.c
---- linux-2.6.32.45/fs/filesystems.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/filesystems.c 2011-04-17 15:56:46.000000000 -0400
-@@ -272,7 +272,12 @@ struct file_system_type *get_fs_type(con
- int len = dot ? dot - name : strlen(name);
-
- fs = __get_fs_type(name, len);
-+
-+#ifdef CONFIG_GRKERNSEC_MODHARDEN
-+ if (!fs && (___request_module(true, "grsec_modharden_fs", "%.*s", len, name) == 0))
-+#else
- if (!fs && (request_module("%.*s", len, name) == 0))
-+#endif
- fs = __get_fs_type(name, len);
-
- if (dot && fs && !(fs->fs_flags & FS_HAS_SUBTYPE)) {
-diff -urNp linux-2.6.32.45/fs/fscache/cookie.c linux-2.6.32.45/fs/fscache/cookie.c
---- linux-2.6.32.45/fs/fscache/cookie.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/fscache/cookie.c 2011-05-04 17:56:28.000000000 -0400
-@@ -68,11 +68,11 @@ struct fscache_cookie *__fscache_acquire
- parent ? (char *) parent->def->name : "<no-parent>",
- def->name, netfs_data);
-
-- fscache_stat(&fscache_n_acquires);
-+ fscache_stat_unchecked(&fscache_n_acquires);
-
- /* if there's no parent cookie, then we don't create one here either */
- if (!parent) {
-- fscache_stat(&fscache_n_acquires_null);
-+ fscache_stat_unchecked(&fscache_n_acquires_null);
- _leave(" [no parent]");
- return NULL;
- }
-@@ -87,7 +87,7 @@ struct fscache_cookie *__fscache_acquire
- /* allocate and initialise a cookie */
- cookie = kmem_cache_alloc(fscache_cookie_jar, GFP_KERNEL);
- if (!cookie) {
-- fscache_stat(&fscache_n_acquires_oom);
-+ fscache_stat_unchecked(&fscache_n_acquires_oom);
- _leave(" [ENOMEM]");
- return NULL;
- }
-@@ -109,13 +109,13 @@ struct fscache_cookie *__fscache_acquire
-
- switch (cookie->def->type) {
- case FSCACHE_COOKIE_TYPE_INDEX:
-- fscache_stat(&fscache_n_cookie_index);
-+ fscache_stat_unchecked(&fscache_n_cookie_index);
- break;
- case FSCACHE_COOKIE_TYPE_DATAFILE:
-- fscache_stat(&fscache_n_cookie_data);
-+ fscache_stat_unchecked(&fscache_n_cookie_data);
- break;
- default:
-- fscache_stat(&fscache_n_cookie_special);
-+ fscache_stat_unchecked(&fscache_n_cookie_special);
- break;
- }
-
-@@ -126,13 +126,13 @@ struct fscache_cookie *__fscache_acquire
- if (fscache_acquire_non_index_cookie(cookie) < 0) {
- atomic_dec(&parent->n_children);
- __fscache_cookie_put(cookie);
-- fscache_stat(&fscache_n_acquires_nobufs);
-+ fscache_stat_unchecked(&fscache_n_acquires_nobufs);
- _leave(" = NULL");
- return NULL;
- }
- }
-
-- fscache_stat(&fscache_n_acquires_ok);
-+ fscache_stat_unchecked(&fscache_n_acquires_ok);
- _leave(" = %p", cookie);
- return cookie;
- }
-@@ -168,7 +168,7 @@ static int fscache_acquire_non_index_coo
- cache = fscache_select_cache_for_object(cookie->parent);
- if (!cache) {
- up_read(&fscache_addremove_sem);
-- fscache_stat(&fscache_n_acquires_no_cache);
-+ fscache_stat_unchecked(&fscache_n_acquires_no_cache);
- _leave(" = -ENOMEDIUM [no cache]");
- return -ENOMEDIUM;
- }
-@@ -256,12 +256,12 @@ static int fscache_alloc_object(struct f
- object = cache->ops->alloc_object(cache, cookie);
- fscache_stat_d(&fscache_n_cop_alloc_object);
- if (IS_ERR(object)) {
-- fscache_stat(&fscache_n_object_no_alloc);
-+ fscache_stat_unchecked(&fscache_n_object_no_alloc);
- ret = PTR_ERR(object);
- goto error;
- }
-
-- fscache_stat(&fscache_n_object_alloc);
-+ fscache_stat_unchecked(&fscache_n_object_alloc);
-
- object->debug_id = atomic_inc_return(&fscache_object_debug_id);
-
-@@ -377,10 +377,10 @@ void __fscache_update_cookie(struct fsca
- struct fscache_object *object;
- struct hlist_node *_p;
-
-- fscache_stat(&fscache_n_updates);
-+ fscache_stat_unchecked(&fscache_n_updates);
-
- if (!cookie) {
-- fscache_stat(&fscache_n_updates_null);
-+ fscache_stat_unchecked(&fscache_n_updates_null);
- _leave(" [no cookie]");
- return;
- }
-@@ -414,12 +414,12 @@ void __fscache_relinquish_cookie(struct
- struct fscache_object *object;
- unsigned long event;
-
-- fscache_stat(&fscache_n_relinquishes);
-+ fscache_stat_unchecked(&fscache_n_relinquishes);
- if (retire)
-- fscache_stat(&fscache_n_relinquishes_retire);
-+ fscache_stat_unchecked(&fscache_n_relinquishes_retire);
-
- if (!cookie) {
-- fscache_stat(&fscache_n_relinquishes_null);
-+ fscache_stat_unchecked(&fscache_n_relinquishes_null);
- _leave(" [no cookie]");
- return;
- }
-@@ -435,7 +435,7 @@ void __fscache_relinquish_cookie(struct
-
- /* wait for the cookie to finish being instantiated (or to fail) */
- if (test_bit(FSCACHE_COOKIE_CREATING, &cookie->flags)) {
-- fscache_stat(&fscache_n_relinquishes_waitcrt);
-+ fscache_stat_unchecked(&fscache_n_relinquishes_waitcrt);
- wait_on_bit(&cookie->flags, FSCACHE_COOKIE_CREATING,
- fscache_wait_bit, TASK_UNINTERRUPTIBLE);
- }
-diff -urNp linux-2.6.32.45/fs/fscache/internal.h linux-2.6.32.45/fs/fscache/internal.h
---- linux-2.6.32.45/fs/fscache/internal.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/fscache/internal.h 2011-05-04 17:56:28.000000000 -0400
-@@ -136,94 +136,94 @@ extern void fscache_proc_cleanup(void);
- extern atomic_t fscache_n_ops_processed[FSCACHE_MAX_THREADS];
- extern atomic_t fscache_n_objs_processed[FSCACHE_MAX_THREADS];
-
--extern atomic_t fscache_n_op_pend;
--extern atomic_t fscache_n_op_run;
--extern atomic_t fscache_n_op_enqueue;
--extern atomic_t fscache_n_op_deferred_release;
--extern atomic_t fscache_n_op_release;
--extern atomic_t fscache_n_op_gc;
--extern atomic_t fscache_n_op_cancelled;
--extern atomic_t fscache_n_op_rejected;
--
--extern atomic_t fscache_n_attr_changed;
--extern atomic_t fscache_n_attr_changed_ok;
--extern atomic_t fscache_n_attr_changed_nobufs;
--extern atomic_t fscache_n_attr_changed_nomem;
--extern atomic_t fscache_n_attr_changed_calls;
--
--extern atomic_t fscache_n_allocs;
--extern atomic_t fscache_n_allocs_ok;
--extern atomic_t fscache_n_allocs_wait;
--extern atomic_t fscache_n_allocs_nobufs;
--extern atomic_t fscache_n_allocs_intr;
--extern atomic_t fscache_n_allocs_object_dead;
--extern atomic_t fscache_n_alloc_ops;
--extern atomic_t fscache_n_alloc_op_waits;
--
--extern atomic_t fscache_n_retrievals;
--extern atomic_t fscache_n_retrievals_ok;
--extern atomic_t fscache_n_retrievals_wait;
--extern atomic_t fscache_n_retrievals_nodata;
--extern atomic_t fscache_n_retrievals_nobufs;
--extern atomic_t fscache_n_retrievals_intr;
--extern atomic_t fscache_n_retrievals_nomem;
--extern atomic_t fscache_n_retrievals_object_dead;
--extern atomic_t fscache_n_retrieval_ops;
--extern atomic_t fscache_n_retrieval_op_waits;
--
--extern atomic_t fscache_n_stores;
--extern atomic_t fscache_n_stores_ok;
--extern atomic_t fscache_n_stores_again;
--extern atomic_t fscache_n_stores_nobufs;
--extern atomic_t fscache_n_stores_oom;
--extern atomic_t fscache_n_store_ops;
--extern atomic_t fscache_n_store_calls;
--extern atomic_t fscache_n_store_pages;
--extern atomic_t fscache_n_store_radix_deletes;
--extern atomic_t fscache_n_store_pages_over_limit;
--
--extern atomic_t fscache_n_store_vmscan_not_storing;
--extern atomic_t fscache_n_store_vmscan_gone;
--extern atomic_t fscache_n_store_vmscan_busy;
--extern atomic_t fscache_n_store_vmscan_cancelled;
--
--extern atomic_t fscache_n_marks;
--extern atomic_t fscache_n_uncaches;
--
--extern atomic_t fscache_n_acquires;
--extern atomic_t fscache_n_acquires_null;
--extern atomic_t fscache_n_acquires_no_cache;
--extern atomic_t fscache_n_acquires_ok;
--extern atomic_t fscache_n_acquires_nobufs;
--extern atomic_t fscache_n_acquires_oom;
--
--extern atomic_t fscache_n_updates;
--extern atomic_t fscache_n_updates_null;
--extern atomic_t fscache_n_updates_run;
--
--extern atomic_t fscache_n_relinquishes;
--extern atomic_t fscache_n_relinquishes_null;
--extern atomic_t fscache_n_relinquishes_waitcrt;
--extern atomic_t fscache_n_relinquishes_retire;
--
--extern atomic_t fscache_n_cookie_index;
--extern atomic_t fscache_n_cookie_data;
--extern atomic_t fscache_n_cookie_special;
--
--extern atomic_t fscache_n_object_alloc;
--extern atomic_t fscache_n_object_no_alloc;
--extern atomic_t fscache_n_object_lookups;
--extern atomic_t fscache_n_object_lookups_negative;
--extern atomic_t fscache_n_object_lookups_positive;
--extern atomic_t fscache_n_object_lookups_timed_out;
--extern atomic_t fscache_n_object_created;
--extern atomic_t fscache_n_object_avail;
--extern atomic_t fscache_n_object_dead;
--
--extern atomic_t fscache_n_checkaux_none;
--extern atomic_t fscache_n_checkaux_okay;
--extern atomic_t fscache_n_checkaux_update;
--extern atomic_t fscache_n_checkaux_obsolete;
-+extern atomic_unchecked_t fscache_n_op_pend;
-+extern atomic_unchecked_t fscache_n_op_run;
-+extern atomic_unchecked_t fscache_n_op_enqueue;
-+extern atomic_unchecked_t fscache_n_op_deferred_release;
-+extern atomic_unchecked_t fscache_n_op_release;
-+extern atomic_unchecked_t fscache_n_op_gc;
-+extern atomic_unchecked_t fscache_n_op_cancelled;
-+extern atomic_unchecked_t fscache_n_op_rejected;
-+
-+extern atomic_unchecked_t fscache_n_attr_changed;
-+extern atomic_unchecked_t fscache_n_attr_changed_ok;
-+extern atomic_unchecked_t fscache_n_attr_changed_nobufs;
-+extern atomic_unchecked_t fscache_n_attr_changed_nomem;
-+extern atomic_unchecked_t fscache_n_attr_changed_calls;
-+
-+extern atomic_unchecked_t fscache_n_allocs;
-+extern atomic_unchecked_t fscache_n_allocs_ok;
-+extern atomic_unchecked_t fscache_n_allocs_wait;
-+extern atomic_unchecked_t fscache_n_allocs_nobufs;
-+extern atomic_unchecked_t fscache_n_allocs_intr;
-+extern atomic_unchecked_t fscache_n_allocs_object_dead;
-+extern atomic_unchecked_t fscache_n_alloc_ops;
-+extern atomic_unchecked_t fscache_n_alloc_op_waits;
-+
-+extern atomic_unchecked_t fscache_n_retrievals;
-+extern atomic_unchecked_t fscache_n_retrievals_ok;
-+extern atomic_unchecked_t fscache_n_retrievals_wait;
-+extern atomic_unchecked_t fscache_n_retrievals_nodata;
-+extern atomic_unchecked_t fscache_n_retrievals_nobufs;
-+extern atomic_unchecked_t fscache_n_retrievals_intr;
-+extern atomic_unchecked_t fscache_n_retrievals_nomem;
-+extern atomic_unchecked_t fscache_n_retrievals_object_dead;
-+extern atomic_unchecked_t fscache_n_retrieval_ops;
-+extern atomic_unchecked_t fscache_n_retrieval_op_waits;
-+
-+extern atomic_unchecked_t fscache_n_stores;
-+extern atomic_unchecked_t fscache_n_stores_ok;
-+extern atomic_unchecked_t fscache_n_stores_again;
-+extern atomic_unchecked_t fscache_n_stores_nobufs;
-+extern atomic_unchecked_t fscache_n_stores_oom;
-+extern atomic_unchecked_t fscache_n_store_ops;
-+extern atomic_unchecked_t fscache_n_store_calls;
-+extern atomic_unchecked_t fscache_n_store_pages;
-+extern atomic_unchecked_t fscache_n_store_radix_deletes;
-+extern atomic_unchecked_t fscache_n_store_pages_over_limit;
-+
-+extern atomic_unchecked_t fscache_n_store_vmscan_not_storing;
-+extern atomic_unchecked_t fscache_n_store_vmscan_gone;
-+extern atomic_unchecked_t fscache_n_store_vmscan_busy;
-+extern atomic_unchecked_t fscache_n_store_vmscan_cancelled;
-+
-+extern atomic_unchecked_t fscache_n_marks;
-+extern atomic_unchecked_t fscache_n_uncaches;
-+
-+extern atomic_unchecked_t fscache_n_acquires;
-+extern atomic_unchecked_t fscache_n_acquires_null;
-+extern atomic_unchecked_t fscache_n_acquires_no_cache;
-+extern atomic_unchecked_t fscache_n_acquires_ok;
-+extern atomic_unchecked_t fscache_n_acquires_nobufs;
-+extern atomic_unchecked_t fscache_n_acquires_oom;
-+
-+extern atomic_unchecked_t fscache_n_updates;
-+extern atomic_unchecked_t fscache_n_updates_null;
-+extern atomic_unchecked_t fscache_n_updates_run;
-+
-+extern atomic_unchecked_t fscache_n_relinquishes;
-+extern atomic_unchecked_t fscache_n_relinquishes_null;
-+extern atomic_unchecked_t fscache_n_relinquishes_waitcrt;
-+extern atomic_unchecked_t fscache_n_relinquishes_retire;
-+
-+extern atomic_unchecked_t fscache_n_cookie_index;
-+extern atomic_unchecked_t fscache_n_cookie_data;
-+extern atomic_unchecked_t fscache_n_cookie_special;
-+
-+extern atomic_unchecked_t fscache_n_object_alloc;
-+extern atomic_unchecked_t fscache_n_object_no_alloc;
-+extern atomic_unchecked_t fscache_n_object_lookups;
-+extern atomic_unchecked_t fscache_n_object_lookups_negative;
-+extern atomic_unchecked_t fscache_n_object_lookups_positive;
-+extern atomic_unchecked_t fscache_n_object_lookups_timed_out;
-+extern atomic_unchecked_t fscache_n_object_created;
-+extern atomic_unchecked_t fscache_n_object_avail;
-+extern atomic_unchecked_t fscache_n_object_dead;
-+
-+extern atomic_unchecked_t fscache_n_checkaux_none;
-+extern atomic_unchecked_t fscache_n_checkaux_okay;
-+extern atomic_unchecked_t fscache_n_checkaux_update;
-+extern atomic_unchecked_t fscache_n_checkaux_obsolete;
-
- extern atomic_t fscache_n_cop_alloc_object;
- extern atomic_t fscache_n_cop_lookup_object;
-@@ -247,6 +247,11 @@ static inline void fscache_stat(atomic_t
- atomic_inc(stat);
- }
-
-+static inline void fscache_stat_unchecked(atomic_unchecked_t *stat)
-+{
-+ atomic_inc_unchecked(stat);
-+}
-+
- static inline void fscache_stat_d(atomic_t *stat)
- {
- atomic_dec(stat);
-@@ -259,6 +264,7 @@ extern const struct file_operations fsca
-
- #define __fscache_stat(stat) (NULL)
- #define fscache_stat(stat) do {} while (0)
-+#define fscache_stat_unchecked(stat) do {} while (0)
- #define fscache_stat_d(stat) do {} while (0)
- #endif
-
-diff -urNp linux-2.6.32.45/fs/fscache/object.c linux-2.6.32.45/fs/fscache/object.c
---- linux-2.6.32.45/fs/fscache/object.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/fscache/object.c 2011-05-04 17:56:28.000000000 -0400
-@@ -144,7 +144,7 @@ static void fscache_object_state_machine
- /* update the object metadata on disk */
- case FSCACHE_OBJECT_UPDATING:
- clear_bit(FSCACHE_OBJECT_EV_UPDATE, &object->events);
-- fscache_stat(&fscache_n_updates_run);
-+ fscache_stat_unchecked(&fscache_n_updates_run);
- fscache_stat(&fscache_n_cop_update_object);
- object->cache->ops->update_object(object);
- fscache_stat_d(&fscache_n_cop_update_object);
-@@ -233,7 +233,7 @@ static void fscache_object_state_machine
- spin_lock(&object->lock);
- object->state = FSCACHE_OBJECT_DEAD;
- spin_unlock(&object->lock);
-- fscache_stat(&fscache_n_object_dead);
-+ fscache_stat_unchecked(&fscache_n_object_dead);
- goto terminal_transit;
-
- /* handle the parent cache of this object being withdrawn from
-@@ -248,7 +248,7 @@ static void fscache_object_state_machine
- spin_lock(&object->lock);
- object->state = FSCACHE_OBJECT_DEAD;
- spin_unlock(&object->lock);
-- fscache_stat(&fscache_n_object_dead);
-+ fscache_stat_unchecked(&fscache_n_object_dead);
- goto terminal_transit;
-
- /* complain about the object being woken up once it is
-@@ -492,7 +492,7 @@ static void fscache_lookup_object(struct
- parent->cookie->def->name, cookie->def->name,
- object->cache->tag->name);
-
-- fscache_stat(&fscache_n_object_lookups);
-+ fscache_stat_unchecked(&fscache_n_object_lookups);
- fscache_stat(&fscache_n_cop_lookup_object);
- ret = object->cache->ops->lookup_object(object);
- fscache_stat_d(&fscache_n_cop_lookup_object);
-@@ -503,7 +503,7 @@ static void fscache_lookup_object(struct
- if (ret == -ETIMEDOUT) {
- /* probably stuck behind another object, so move this one to
- * the back of the queue */
-- fscache_stat(&fscache_n_object_lookups_timed_out);
-+ fscache_stat_unchecked(&fscache_n_object_lookups_timed_out);
- set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
- }
-
-@@ -526,7 +526,7 @@ void fscache_object_lookup_negative(stru
-
- spin_lock(&object->lock);
- if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
-- fscache_stat(&fscache_n_object_lookups_negative);
-+ fscache_stat_unchecked(&fscache_n_object_lookups_negative);
-
- /* transit here to allow write requests to begin stacking up
- * and read requests to begin returning ENODATA */
-@@ -572,7 +572,7 @@ void fscache_obtained_object(struct fsca
- * result, in which case there may be data available */
- spin_lock(&object->lock);
- if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
-- fscache_stat(&fscache_n_object_lookups_positive);
-+ fscache_stat_unchecked(&fscache_n_object_lookups_positive);
-
- clear_bit(FSCACHE_COOKIE_NO_DATA_YET, &cookie->flags);
-
-@@ -586,7 +586,7 @@ void fscache_obtained_object(struct fsca
- set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
- } else {
- ASSERTCMP(object->state, ==, FSCACHE_OBJECT_CREATING);
-- fscache_stat(&fscache_n_object_created);
-+ fscache_stat_unchecked(&fscache_n_object_created);
-
- object->state = FSCACHE_OBJECT_AVAILABLE;
- spin_unlock(&object->lock);
-@@ -633,7 +633,7 @@ static void fscache_object_available(str
- fscache_enqueue_dependents(object);
-
- fscache_hist(fscache_obj_instantiate_histogram, object->lookup_jif);
-- fscache_stat(&fscache_n_object_avail);
-+ fscache_stat_unchecked(&fscache_n_object_avail);
-
- _leave("");
- }
-@@ -861,7 +861,7 @@ enum fscache_checkaux fscache_check_aux(
- enum fscache_checkaux result;
-
- if (!object->cookie->def->check_aux) {
-- fscache_stat(&fscache_n_checkaux_none);
-+ fscache_stat_unchecked(&fscache_n_checkaux_none);
- return FSCACHE_CHECKAUX_OKAY;
- }
-
-@@ -870,17 +870,17 @@ enum fscache_checkaux fscache_check_aux(
- switch (result) {
- /* entry okay as is */
- case FSCACHE_CHECKAUX_OKAY:
-- fscache_stat(&fscache_n_checkaux_okay);
-+ fscache_stat_unchecked(&fscache_n_checkaux_okay);
- break;
-
- /* entry requires update */
- case FSCACHE_CHECKAUX_NEEDS_UPDATE:
-- fscache_stat(&fscache_n_checkaux_update);
-+ fscache_stat_unchecked(&fscache_n_checkaux_update);
- break;
-
- /* entry requires deletion */
- case FSCACHE_CHECKAUX_OBSOLETE:
-- fscache_stat(&fscache_n_checkaux_obsolete);
-+ fscache_stat_unchecked(&fscache_n_checkaux_obsolete);
- break;
-
- default:
-diff -urNp linux-2.6.32.45/fs/fscache/operation.c linux-2.6.32.45/fs/fscache/operation.c
---- linux-2.6.32.45/fs/fscache/operation.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/fscache/operation.c 2011-05-04 17:56:28.000000000 -0400
-@@ -16,7 +16,7 @@
- #include <linux/seq_file.h>
- #include "internal.h"
-
--atomic_t fscache_op_debug_id;
-+atomic_unchecked_t fscache_op_debug_id;
- EXPORT_SYMBOL(fscache_op_debug_id);
-
- /**
-@@ -39,7 +39,7 @@ void fscache_enqueue_operation(struct fs
- ASSERTCMP(op->object->state, >=, FSCACHE_OBJECT_AVAILABLE);
- ASSERTCMP(atomic_read(&op->usage), >, 0);
-
-- fscache_stat(&fscache_n_op_enqueue);
-+ fscache_stat_unchecked(&fscache_n_op_enqueue);
- switch (op->flags & FSCACHE_OP_TYPE) {
- case FSCACHE_OP_FAST:
- _debug("queue fast");
-@@ -76,7 +76,7 @@ static void fscache_run_op(struct fscach
- wake_up_bit(&op->flags, FSCACHE_OP_WAITING);
- if (op->processor)
- fscache_enqueue_operation(op);
-- fscache_stat(&fscache_n_op_run);
-+ fscache_stat_unchecked(&fscache_n_op_run);
- }
-
- /*
-@@ -107,11 +107,11 @@ int fscache_submit_exclusive_op(struct f
- if (object->n_ops > 0) {
- atomic_inc(&op->usage);
- list_add_tail(&op->pend_link, &object->pending_ops);
-- fscache_stat(&fscache_n_op_pend);
-+ fscache_stat_unchecked(&fscache_n_op_pend);
- } else if (!list_empty(&object->pending_ops)) {
- atomic_inc(&op->usage);
- list_add_tail(&op->pend_link, &object->pending_ops);
-- fscache_stat(&fscache_n_op_pend);
-+ fscache_stat_unchecked(&fscache_n_op_pend);
- fscache_start_operations(object);
- } else {
- ASSERTCMP(object->n_in_progress, ==, 0);
-@@ -127,7 +127,7 @@ int fscache_submit_exclusive_op(struct f
- object->n_exclusive++; /* reads and writes must wait */
- atomic_inc(&op->usage);
- list_add_tail(&op->pend_link, &object->pending_ops);
-- fscache_stat(&fscache_n_op_pend);
-+ fscache_stat_unchecked(&fscache_n_op_pend);
- ret = 0;
- } else {
- /* not allowed to submit ops in any other state */
-@@ -214,11 +214,11 @@ int fscache_submit_op(struct fscache_obj
- if (object->n_exclusive > 0) {
- atomic_inc(&op->usage);
- list_add_tail(&op->pend_link, &object->pending_ops);
-- fscache_stat(&fscache_n_op_pend);
-+ fscache_stat_unchecked(&fscache_n_op_pend);
- } else if (!list_empty(&object->pending_ops)) {
- atomic_inc(&op->usage);
- list_add_tail(&op->pend_link, &object->pending_ops);
-- fscache_stat(&fscache_n_op_pend);
-+ fscache_stat_unchecked(&fscache_n_op_pend);
- fscache_start_operations(object);
- } else {
- ASSERTCMP(object->n_exclusive, ==, 0);
-@@ -230,12 +230,12 @@ int fscache_submit_op(struct fscache_obj
- object->n_ops++;
- atomic_inc(&op->usage);
- list_add_tail(&op->pend_link, &object->pending_ops);
-- fscache_stat(&fscache_n_op_pend);
-+ fscache_stat_unchecked(&fscache_n_op_pend);
- ret = 0;
- } else if (object->state == FSCACHE_OBJECT_DYING ||
- object->state == FSCACHE_OBJECT_LC_DYING ||
- object->state == FSCACHE_OBJECT_WITHDRAWING) {
-- fscache_stat(&fscache_n_op_rejected);
-+ fscache_stat_unchecked(&fscache_n_op_rejected);
- ret = -ENOBUFS;
- } else if (!test_bit(FSCACHE_IOERROR, &object->cache->flags)) {
- fscache_report_unexpected_submission(object, op, ostate);
-@@ -305,7 +305,7 @@ int fscache_cancel_op(struct fscache_ope
-
- ret = -EBUSY;
- if (!list_empty(&op->pend_link)) {
-- fscache_stat(&fscache_n_op_cancelled);
-+ fscache_stat_unchecked(&fscache_n_op_cancelled);
- list_del_init(&op->pend_link);
- object->n_ops--;
- if (test_bit(FSCACHE_OP_EXCLUSIVE, &op->flags))
-@@ -344,7 +344,7 @@ void fscache_put_operation(struct fscach
- if (test_and_set_bit(FSCACHE_OP_DEAD, &op->flags))
- BUG();
-
-- fscache_stat(&fscache_n_op_release);
-+ fscache_stat_unchecked(&fscache_n_op_release);
-
- if (op->release) {
- op->release(op);
-@@ -361,7 +361,7 @@ void fscache_put_operation(struct fscach
- * lock, and defer it otherwise */
- if (!spin_trylock(&object->lock)) {
- _debug("defer put");
-- fscache_stat(&fscache_n_op_deferred_release);
-+ fscache_stat_unchecked(&fscache_n_op_deferred_release);
-
- cache = object->cache;
- spin_lock(&cache->op_gc_list_lock);
-@@ -423,7 +423,7 @@ void fscache_operation_gc(struct work_st
-
- _debug("GC DEFERRED REL OBJ%x OP%x",
- object->debug_id, op->debug_id);
-- fscache_stat(&fscache_n_op_gc);
-+ fscache_stat_unchecked(&fscache_n_op_gc);
-
- ASSERTCMP(atomic_read(&op->usage), ==, 0);
-
-diff -urNp linux-2.6.32.45/fs/fscache/page.c linux-2.6.32.45/fs/fscache/page.c
---- linux-2.6.32.45/fs/fscache/page.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/fscache/page.c 2011-05-04 17:56:28.000000000 -0400
-@@ -59,7 +59,7 @@ bool __fscache_maybe_release_page(struct
- val = radix_tree_lookup(&cookie->stores, page->index);
- if (!val) {
- rcu_read_unlock();
-- fscache_stat(&fscache_n_store_vmscan_not_storing);
-+ fscache_stat_unchecked(&fscache_n_store_vmscan_not_storing);
- __fscache_uncache_page(cookie, page);
- return true;
- }
-@@ -89,11 +89,11 @@ bool __fscache_maybe_release_page(struct
- spin_unlock(&cookie->stores_lock);
-
- if (xpage) {
-- fscache_stat(&fscache_n_store_vmscan_cancelled);
-- fscache_stat(&fscache_n_store_radix_deletes);
-+ fscache_stat_unchecked(&fscache_n_store_vmscan_cancelled);
-+ fscache_stat_unchecked(&fscache_n_store_radix_deletes);
- ASSERTCMP(xpage, ==, page);
- } else {
-- fscache_stat(&fscache_n_store_vmscan_gone);
-+ fscache_stat_unchecked(&fscache_n_store_vmscan_gone);
- }
-
- wake_up_bit(&cookie->flags, 0);
-@@ -106,7 +106,7 @@ page_busy:
- /* we might want to wait here, but that could deadlock the allocator as
- * the slow-work threads writing to the cache may all end up sleeping
- * on memory allocation */
-- fscache_stat(&fscache_n_store_vmscan_busy);
-+ fscache_stat_unchecked(&fscache_n_store_vmscan_busy);
- return false;
- }
- EXPORT_SYMBOL(__fscache_maybe_release_page);
-@@ -130,7 +130,7 @@ static void fscache_end_page_write(struc
- FSCACHE_COOKIE_STORING_TAG);
- if (!radix_tree_tag_get(&cookie->stores, page->index,
- FSCACHE_COOKIE_PENDING_TAG)) {
-- fscache_stat(&fscache_n_store_radix_deletes);
-+ fscache_stat_unchecked(&fscache_n_store_radix_deletes);
- xpage = radix_tree_delete(&cookie->stores, page->index);
- }
- spin_unlock(&cookie->stores_lock);
-@@ -151,7 +151,7 @@ static void fscache_attr_changed_op(stru
-
- _enter("{OBJ%x OP%x}", object->debug_id, op->debug_id);
-
-- fscache_stat(&fscache_n_attr_changed_calls);
-+ fscache_stat_unchecked(&fscache_n_attr_changed_calls);
-
- if (fscache_object_is_active(object)) {
- fscache_set_op_state(op, "CallFS");
-@@ -178,11 +178,11 @@ int __fscache_attr_changed(struct fscach
-
- ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
-
-- fscache_stat(&fscache_n_attr_changed);
-+ fscache_stat_unchecked(&fscache_n_attr_changed);
-
- op = kzalloc(sizeof(*op), GFP_KERNEL);
- if (!op) {
-- fscache_stat(&fscache_n_attr_changed_nomem);
-+ fscache_stat_unchecked(&fscache_n_attr_changed_nomem);
- _leave(" = -ENOMEM");
- return -ENOMEM;
- }
-@@ -202,7 +202,7 @@ int __fscache_attr_changed(struct fscach
- if (fscache_submit_exclusive_op(object, op) < 0)
- goto nobufs;
- spin_unlock(&cookie->lock);
-- fscache_stat(&fscache_n_attr_changed_ok);
-+ fscache_stat_unchecked(&fscache_n_attr_changed_ok);
- fscache_put_operation(op);
- _leave(" = 0");
- return 0;
-@@ -210,7 +210,7 @@ int __fscache_attr_changed(struct fscach
- nobufs:
- spin_unlock(&cookie->lock);
- kfree(op);
-- fscache_stat(&fscache_n_attr_changed_nobufs);
-+ fscache_stat_unchecked(&fscache_n_attr_changed_nobufs);
- _leave(" = %d", -ENOBUFS);
- return -ENOBUFS;
- }
-@@ -264,7 +264,7 @@ static struct fscache_retrieval *fscache
- /* allocate a retrieval operation and attempt to submit it */
- op = kzalloc(sizeof(*op), GFP_NOIO);
- if (!op) {
-- fscache_stat(&fscache_n_retrievals_nomem);
-+ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
- return NULL;
- }
-
-@@ -294,13 +294,13 @@ static int fscache_wait_for_deferred_loo
- return 0;
- }
-
-- fscache_stat(&fscache_n_retrievals_wait);
-+ fscache_stat_unchecked(&fscache_n_retrievals_wait);
-
- jif = jiffies;
- if (wait_on_bit(&cookie->flags, FSCACHE_COOKIE_LOOKING_UP,
- fscache_wait_bit_interruptible,
- TASK_INTERRUPTIBLE) != 0) {
-- fscache_stat(&fscache_n_retrievals_intr);
-+ fscache_stat_unchecked(&fscache_n_retrievals_intr);
- _leave(" = -ERESTARTSYS");
- return -ERESTARTSYS;
- }
-@@ -318,8 +318,8 @@ static int fscache_wait_for_deferred_loo
- */
- static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
- struct fscache_retrieval *op,
-- atomic_t *stat_op_waits,
-- atomic_t *stat_object_dead)
-+ atomic_unchecked_t *stat_op_waits,
-+ atomic_unchecked_t *stat_object_dead)
- {
- int ret;
-
-@@ -327,7 +327,7 @@ static int fscache_wait_for_retrieval_ac
- goto check_if_dead;
-
- _debug(">>> WT");
-- fscache_stat(stat_op_waits);
-+ fscache_stat_unchecked(stat_op_waits);
- if (wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
- fscache_wait_bit_interruptible,
- TASK_INTERRUPTIBLE) < 0) {
-@@ -344,7 +344,7 @@ static int fscache_wait_for_retrieval_ac
-
- check_if_dead:
- if (unlikely(fscache_object_is_dead(object))) {
-- fscache_stat(stat_object_dead);
-+ fscache_stat_unchecked(stat_object_dead);
- return -ENOBUFS;
- }
- return 0;
-@@ -371,7 +371,7 @@ int __fscache_read_or_alloc_page(struct
-
- _enter("%p,%p,,,", cookie, page);
-
-- fscache_stat(&fscache_n_retrievals);
-+ fscache_stat_unchecked(&fscache_n_retrievals);
-
- if (hlist_empty(&cookie->backing_objects))
- goto nobufs;
-@@ -405,7 +405,7 @@ int __fscache_read_or_alloc_page(struct
- goto nobufs_unlock;
- spin_unlock(&cookie->lock);
-
-- fscache_stat(&fscache_n_retrieval_ops);
-+ fscache_stat_unchecked(&fscache_n_retrieval_ops);
-
- /* pin the netfs read context in case we need to do the actual netfs
- * read because we've encountered a cache read failure */
-@@ -435,15 +435,15 @@ int __fscache_read_or_alloc_page(struct
-
- error:
- if (ret == -ENOMEM)
-- fscache_stat(&fscache_n_retrievals_nomem);
-+ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
- else if (ret == -ERESTARTSYS)
-- fscache_stat(&fscache_n_retrievals_intr);
-+ fscache_stat_unchecked(&fscache_n_retrievals_intr);
- else if (ret == -ENODATA)
-- fscache_stat(&fscache_n_retrievals_nodata);
-+ fscache_stat_unchecked(&fscache_n_retrievals_nodata);
- else if (ret < 0)
-- fscache_stat(&fscache_n_retrievals_nobufs);
-+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
- else
-- fscache_stat(&fscache_n_retrievals_ok);
-+ fscache_stat_unchecked(&fscache_n_retrievals_ok);
-
- fscache_put_retrieval(op);
- _leave(" = %d", ret);
-@@ -453,7 +453,7 @@ nobufs_unlock:
- spin_unlock(&cookie->lock);
- kfree(op);
- nobufs:
-- fscache_stat(&fscache_n_retrievals_nobufs);
-+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
- _leave(" = -ENOBUFS");
- return -ENOBUFS;
- }
-@@ -491,7 +491,7 @@ int __fscache_read_or_alloc_pages(struct
-
- _enter("%p,,%d,,,", cookie, *nr_pages);
-
-- fscache_stat(&fscache_n_retrievals);
-+ fscache_stat_unchecked(&fscache_n_retrievals);
-
- if (hlist_empty(&cookie->backing_objects))
- goto nobufs;
-@@ -522,7 +522,7 @@ int __fscache_read_or_alloc_pages(struct
- goto nobufs_unlock;
- spin_unlock(&cookie->lock);
-
-- fscache_stat(&fscache_n_retrieval_ops);
-+ fscache_stat_unchecked(&fscache_n_retrieval_ops);
-
- /* pin the netfs read context in case we need to do the actual netfs
- * read because we've encountered a cache read failure */
-@@ -552,15 +552,15 @@ int __fscache_read_or_alloc_pages(struct
-
- error:
- if (ret == -ENOMEM)
-- fscache_stat(&fscache_n_retrievals_nomem);
-+ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
- else if (ret == -ERESTARTSYS)
-- fscache_stat(&fscache_n_retrievals_intr);
-+ fscache_stat_unchecked(&fscache_n_retrievals_intr);
- else if (ret == -ENODATA)
-- fscache_stat(&fscache_n_retrievals_nodata);
-+ fscache_stat_unchecked(&fscache_n_retrievals_nodata);
- else if (ret < 0)
-- fscache_stat(&fscache_n_retrievals_nobufs);
-+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
- else
-- fscache_stat(&fscache_n_retrievals_ok);
-+ fscache_stat_unchecked(&fscache_n_retrievals_ok);
-
- fscache_put_retrieval(op);
- _leave(" = %d", ret);
-@@ -570,7 +570,7 @@ nobufs_unlock:
- spin_unlock(&cookie->lock);
- kfree(op);
- nobufs:
-- fscache_stat(&fscache_n_retrievals_nobufs);
-+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
- _leave(" = -ENOBUFS");
- return -ENOBUFS;
- }
-@@ -594,7 +594,7 @@ int __fscache_alloc_page(struct fscache_
-
- _enter("%p,%p,,,", cookie, page);
-
-- fscache_stat(&fscache_n_allocs);
-+ fscache_stat_unchecked(&fscache_n_allocs);
-
- if (hlist_empty(&cookie->backing_objects))
- goto nobufs;
-@@ -621,7 +621,7 @@ int __fscache_alloc_page(struct fscache_
- goto nobufs_unlock;
- spin_unlock(&cookie->lock);
-
-- fscache_stat(&fscache_n_alloc_ops);
-+ fscache_stat_unchecked(&fscache_n_alloc_ops);
-
- ret = fscache_wait_for_retrieval_activation(
- object, op,
-@@ -637,11 +637,11 @@ int __fscache_alloc_page(struct fscache_
-
- error:
- if (ret == -ERESTARTSYS)
-- fscache_stat(&fscache_n_allocs_intr);
-+ fscache_stat_unchecked(&fscache_n_allocs_intr);
- else if (ret < 0)
-- fscache_stat(&fscache_n_allocs_nobufs);
-+ fscache_stat_unchecked(&fscache_n_allocs_nobufs);
- else
-- fscache_stat(&fscache_n_allocs_ok);
-+ fscache_stat_unchecked(&fscache_n_allocs_ok);
-
- fscache_put_retrieval(op);
- _leave(" = %d", ret);
-@@ -651,7 +651,7 @@ nobufs_unlock:
- spin_unlock(&cookie->lock);
- kfree(op);
- nobufs:
-- fscache_stat(&fscache_n_allocs_nobufs);
-+ fscache_stat_unchecked(&fscache_n_allocs_nobufs);
- _leave(" = -ENOBUFS");
- return -ENOBUFS;
- }
-@@ -694,7 +694,7 @@ static void fscache_write_op(struct fsca
-
- spin_lock(&cookie->stores_lock);
-
-- fscache_stat(&fscache_n_store_calls);
-+ fscache_stat_unchecked(&fscache_n_store_calls);
-
- /* find a page to store */
- page = NULL;
-@@ -705,7 +705,7 @@ static void fscache_write_op(struct fsca
- page = results[0];
- _debug("gang %d [%lx]", n, page->index);
- if (page->index > op->store_limit) {
-- fscache_stat(&fscache_n_store_pages_over_limit);
-+ fscache_stat_unchecked(&fscache_n_store_pages_over_limit);
- goto superseded;
- }
-
-@@ -721,7 +721,7 @@ static void fscache_write_op(struct fsca
-
- if (page) {
- fscache_set_op_state(&op->op, "Store");
-- fscache_stat(&fscache_n_store_pages);
-+ fscache_stat_unchecked(&fscache_n_store_pages);
- fscache_stat(&fscache_n_cop_write_page);
- ret = object->cache->ops->write_page(op, page);
- fscache_stat_d(&fscache_n_cop_write_page);
-@@ -792,7 +792,7 @@ int __fscache_write_page(struct fscache_
- ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
- ASSERT(PageFsCache(page));
-
-- fscache_stat(&fscache_n_stores);
-+ fscache_stat_unchecked(&fscache_n_stores);
-
- op = kzalloc(sizeof(*op), GFP_NOIO);
- if (!op)
-@@ -844,7 +844,7 @@ int __fscache_write_page(struct fscache_
- spin_unlock(&cookie->stores_lock);
- spin_unlock(&object->lock);
-
-- op->op.debug_id = atomic_inc_return(&fscache_op_debug_id);
-+ op->op.debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
- op->store_limit = object->store_limit;
-
- if (fscache_submit_op(object, &op->op) < 0)
-@@ -852,8 +852,8 @@ int __fscache_write_page(struct fscache_
-
- spin_unlock(&cookie->lock);
- radix_tree_preload_end();
-- fscache_stat(&fscache_n_store_ops);
-- fscache_stat(&fscache_n_stores_ok);
-+ fscache_stat_unchecked(&fscache_n_store_ops);
-+ fscache_stat_unchecked(&fscache_n_stores_ok);
-
- /* the slow work queue now carries its own ref on the object */
- fscache_put_operation(&op->op);
-@@ -861,14 +861,14 @@ int __fscache_write_page(struct fscache_
- return 0;
-
- already_queued:
-- fscache_stat(&fscache_n_stores_again);
-+ fscache_stat_unchecked(&fscache_n_stores_again);
- already_pending:
- spin_unlock(&cookie->stores_lock);
- spin_unlock(&object->lock);
- spin_unlock(&cookie->lock);
- radix_tree_preload_end();
- kfree(op);
-- fscache_stat(&fscache_n_stores_ok);
-+ fscache_stat_unchecked(&fscache_n_stores_ok);
- _leave(" = 0");
- return 0;
-
-@@ -886,14 +886,14 @@ nobufs:
- spin_unlock(&cookie->lock);
- radix_tree_preload_end();
- kfree(op);
-- fscache_stat(&fscache_n_stores_nobufs);
-+ fscache_stat_unchecked(&fscache_n_stores_nobufs);
- _leave(" = -ENOBUFS");
- return -ENOBUFS;
-
- nomem_free:
- kfree(op);
- nomem:
-- fscache_stat(&fscache_n_stores_oom);
-+ fscache_stat_unchecked(&fscache_n_stores_oom);
- _leave(" = -ENOMEM");
- return -ENOMEM;
- }
-@@ -911,7 +911,7 @@ void __fscache_uncache_page(struct fscac
- ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
- ASSERTCMP(page, !=, NULL);
-
-- fscache_stat(&fscache_n_uncaches);
-+ fscache_stat_unchecked(&fscache_n_uncaches);
-
- /* cache withdrawal may beat us to it */
- if (!PageFsCache(page))
-@@ -964,7 +964,7 @@ void fscache_mark_pages_cached(struct fs
- unsigned long loop;
-
- #ifdef CONFIG_FSCACHE_STATS
-- atomic_add(pagevec->nr, &fscache_n_marks);
-+ atomic_add_unchecked(pagevec->nr, &fscache_n_marks);
- #endif
-
- for (loop = 0; loop < pagevec->nr; loop++) {
-diff -urNp linux-2.6.32.45/fs/fscache/stats.c linux-2.6.32.45/fs/fscache/stats.c
---- linux-2.6.32.45/fs/fscache/stats.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/fscache/stats.c 2011-05-04 17:56:28.000000000 -0400
-@@ -18,95 +18,95 @@
- /*
- * operation counters
- */
--atomic_t fscache_n_op_pend;
--atomic_t fscache_n_op_run;
--atomic_t fscache_n_op_enqueue;
--atomic_t fscache_n_op_requeue;
--atomic_t fscache_n_op_deferred_release;
--atomic_t fscache_n_op_release;
--atomic_t fscache_n_op_gc;
--atomic_t fscache_n_op_cancelled;
--atomic_t fscache_n_op_rejected;
--
--atomic_t fscache_n_attr_changed;
--atomic_t fscache_n_attr_changed_ok;
--atomic_t fscache_n_attr_changed_nobufs;
--atomic_t fscache_n_attr_changed_nomem;
--atomic_t fscache_n_attr_changed_calls;
--
--atomic_t fscache_n_allocs;
--atomic_t fscache_n_allocs_ok;
--atomic_t fscache_n_allocs_wait;
--atomic_t fscache_n_allocs_nobufs;
--atomic_t fscache_n_allocs_intr;
--atomic_t fscache_n_allocs_object_dead;
--atomic_t fscache_n_alloc_ops;
--atomic_t fscache_n_alloc_op_waits;
--
--atomic_t fscache_n_retrievals;
--atomic_t fscache_n_retrievals_ok;
--atomic_t fscache_n_retrievals_wait;
--atomic_t fscache_n_retrievals_nodata;
--atomic_t fscache_n_retrievals_nobufs;
--atomic_t fscache_n_retrievals_intr;
--atomic_t fscache_n_retrievals_nomem;
--atomic_t fscache_n_retrievals_object_dead;
--atomic_t fscache_n_retrieval_ops;
--atomic_t fscache_n_retrieval_op_waits;
--
--atomic_t fscache_n_stores;
--atomic_t fscache_n_stores_ok;
--atomic_t fscache_n_stores_again;
--atomic_t fscache_n_stores_nobufs;
--atomic_t fscache_n_stores_oom;
--atomic_t fscache_n_store_ops;
--atomic_t fscache_n_store_calls;
--atomic_t fscache_n_store_pages;
--atomic_t fscache_n_store_radix_deletes;
--atomic_t fscache_n_store_pages_over_limit;
--
--atomic_t fscache_n_store_vmscan_not_storing;
--atomic_t fscache_n_store_vmscan_gone;
--atomic_t fscache_n_store_vmscan_busy;
--atomic_t fscache_n_store_vmscan_cancelled;
--
--atomic_t fscache_n_marks;
--atomic_t fscache_n_uncaches;
--
--atomic_t fscache_n_acquires;
--atomic_t fscache_n_acquires_null;
--atomic_t fscache_n_acquires_no_cache;
--atomic_t fscache_n_acquires_ok;
--atomic_t fscache_n_acquires_nobufs;
--atomic_t fscache_n_acquires_oom;
--
--atomic_t fscache_n_updates;
--atomic_t fscache_n_updates_null;
--atomic_t fscache_n_updates_run;
--
--atomic_t fscache_n_relinquishes;
--atomic_t fscache_n_relinquishes_null;
--atomic_t fscache_n_relinquishes_waitcrt;
--atomic_t fscache_n_relinquishes_retire;
--
--atomic_t fscache_n_cookie_index;
--atomic_t fscache_n_cookie_data;
--atomic_t fscache_n_cookie_special;
--
--atomic_t fscache_n_object_alloc;
--atomic_t fscache_n_object_no_alloc;
--atomic_t fscache_n_object_lookups;
--atomic_t fscache_n_object_lookups_negative;
--atomic_t fscache_n_object_lookups_positive;
--atomic_t fscache_n_object_lookups_timed_out;
--atomic_t fscache_n_object_created;
--atomic_t fscache_n_object_avail;
--atomic_t fscache_n_object_dead;
--
--atomic_t fscache_n_checkaux_none;
--atomic_t fscache_n_checkaux_okay;
--atomic_t fscache_n_checkaux_update;
--atomic_t fscache_n_checkaux_obsolete;
-+atomic_unchecked_t fscache_n_op_pend;
-+atomic_unchecked_t fscache_n_op_run;
-+atomic_unchecked_t fscache_n_op_enqueue;
-+atomic_unchecked_t fscache_n_op_requeue;
-+atomic_unchecked_t fscache_n_op_deferred_release;
-+atomic_unchecked_t fscache_n_op_release;
-+atomic_unchecked_t fscache_n_op_gc;
-+atomic_unchecked_t fscache_n_op_cancelled;
-+atomic_unchecked_t fscache_n_op_rejected;
-+
-+atomic_unchecked_t fscache_n_attr_changed;
-+atomic_unchecked_t fscache_n_attr_changed_ok;
-+atomic_unchecked_t fscache_n_attr_changed_nobufs;
-+atomic_unchecked_t fscache_n_attr_changed_nomem;
-+atomic_unchecked_t fscache_n_attr_changed_calls;
-+
-+atomic_unchecked_t fscache_n_allocs;
-+atomic_unchecked_t fscache_n_allocs_ok;
-+atomic_unchecked_t fscache_n_allocs_wait;
-+atomic_unchecked_t fscache_n_allocs_nobufs;
-+atomic_unchecked_t fscache_n_allocs_intr;
-+atomic_unchecked_t fscache_n_allocs_object_dead;
-+atomic_unchecked_t fscache_n_alloc_ops;
-+atomic_unchecked_t fscache_n_alloc_op_waits;
-+
-+atomic_unchecked_t fscache_n_retrievals;
-+atomic_unchecked_t fscache_n_retrievals_ok;
-+atomic_unchecked_t fscache_n_retrievals_wait;
-+atomic_unchecked_t fscache_n_retrievals_nodata;
-+atomic_unchecked_t fscache_n_retrievals_nobufs;
-+atomic_unchecked_t fscache_n_retrievals_intr;
-+atomic_unchecked_t fscache_n_retrievals_nomem;
-+atomic_unchecked_t fscache_n_retrievals_object_dead;
-+atomic_unchecked_t fscache_n_retrieval_ops;
-+atomic_unchecked_t fscache_n_retrieval_op_waits;
-+
-+atomic_unchecked_t fscache_n_stores;
-+atomic_unchecked_t fscache_n_stores_ok;
-+atomic_unchecked_t fscache_n_stores_again;
-+atomic_unchecked_t fscache_n_stores_nobufs;
-+atomic_unchecked_t fscache_n_stores_oom;
-+atomic_unchecked_t fscache_n_store_ops;
-+atomic_unchecked_t fscache_n_store_calls;
-+atomic_unchecked_t fscache_n_store_pages;
-+atomic_unchecked_t fscache_n_store_radix_deletes;
-+atomic_unchecked_t fscache_n_store_pages_over_limit;
-+
-+atomic_unchecked_t fscache_n_store_vmscan_not_storing;
-+atomic_unchecked_t fscache_n_store_vmscan_gone;
-+atomic_unchecked_t fscache_n_store_vmscan_busy;
-+atomic_unchecked_t fscache_n_store_vmscan_cancelled;
-+
-+atomic_unchecked_t fscache_n_marks;
-+atomic_unchecked_t fscache_n_uncaches;
-+
-+atomic_unchecked_t fscache_n_acquires;
-+atomic_unchecked_t fscache_n_acquires_null;
-+atomic_unchecked_t fscache_n_acquires_no_cache;
-+atomic_unchecked_t fscache_n_acquires_ok;
-+atomic_unchecked_t fscache_n_acquires_nobufs;
-+atomic_unchecked_t fscache_n_acquires_oom;
-+
-+atomic_unchecked_t fscache_n_updates;
-+atomic_unchecked_t fscache_n_updates_null;
-+atomic_unchecked_t fscache_n_updates_run;
-+
-+atomic_unchecked_t fscache_n_relinquishes;
-+atomic_unchecked_t fscache_n_relinquishes_null;
-+atomic_unchecked_t fscache_n_relinquishes_waitcrt;
-+atomic_unchecked_t fscache_n_relinquishes_retire;
-+
-+atomic_unchecked_t fscache_n_cookie_index;
-+atomic_unchecked_t fscache_n_cookie_data;
-+atomic_unchecked_t fscache_n_cookie_special;
-+
-+atomic_unchecked_t fscache_n_object_alloc;
-+atomic_unchecked_t fscache_n_object_no_alloc;
-+atomic_unchecked_t fscache_n_object_lookups;
-+atomic_unchecked_t fscache_n_object_lookups_negative;
-+atomic_unchecked_t fscache_n_object_lookups_positive;
-+atomic_unchecked_t fscache_n_object_lookups_timed_out;
-+atomic_unchecked_t fscache_n_object_created;
-+atomic_unchecked_t fscache_n_object_avail;
-+atomic_unchecked_t fscache_n_object_dead;
-+
-+atomic_unchecked_t fscache_n_checkaux_none;
-+atomic_unchecked_t fscache_n_checkaux_okay;
-+atomic_unchecked_t fscache_n_checkaux_update;
-+atomic_unchecked_t fscache_n_checkaux_obsolete;
-
- atomic_t fscache_n_cop_alloc_object;
- atomic_t fscache_n_cop_lookup_object;
-@@ -133,113 +133,113 @@ static int fscache_stats_show(struct seq
- seq_puts(m, "FS-Cache statistics\n");
-
- seq_printf(m, "Cookies: idx=%u dat=%u spc=%u\n",
-- atomic_read(&fscache_n_cookie_index),
-- atomic_read(&fscache_n_cookie_data),
-- atomic_read(&fscache_n_cookie_special));
-+ atomic_read_unchecked(&fscache_n_cookie_index),
-+ atomic_read_unchecked(&fscache_n_cookie_data),
-+ atomic_read_unchecked(&fscache_n_cookie_special));
-
- seq_printf(m, "Objects: alc=%u nal=%u avl=%u ded=%u\n",
-- atomic_read(&fscache_n_object_alloc),
-- atomic_read(&fscache_n_object_no_alloc),
-- atomic_read(&fscache_n_object_avail),
-- atomic_read(&fscache_n_object_dead));
-+ atomic_read_unchecked(&fscache_n_object_alloc),
-+ atomic_read_unchecked(&fscache_n_object_no_alloc),
-+ atomic_read_unchecked(&fscache_n_object_avail),
-+ atomic_read_unchecked(&fscache_n_object_dead));
- seq_printf(m, "ChkAux : non=%u ok=%u upd=%u obs=%u\n",
-- atomic_read(&fscache_n_checkaux_none),
-- atomic_read(&fscache_n_checkaux_okay),
-- atomic_read(&fscache_n_checkaux_update),
-- atomic_read(&fscache_n_checkaux_obsolete));
-+ atomic_read_unchecked(&fscache_n_checkaux_none),
-+ atomic_read_unchecked(&fscache_n_checkaux_okay),
-+ atomic_read_unchecked(&fscache_n_checkaux_update),
-+ atomic_read_unchecked(&fscache_n_checkaux_obsolete));
-
- seq_printf(m, "Pages : mrk=%u unc=%u\n",
-- atomic_read(&fscache_n_marks),
-- atomic_read(&fscache_n_uncaches));
-+ atomic_read_unchecked(&fscache_n_marks),
-+ atomic_read_unchecked(&fscache_n_uncaches));
-
- seq_printf(m, "Acquire: n=%u nul=%u noc=%u ok=%u nbf=%u"
- " oom=%u\n",
-- atomic_read(&fscache_n_acquires),
-- atomic_read(&fscache_n_acquires_null),
-- atomic_read(&fscache_n_acquires_no_cache),
-- atomic_read(&fscache_n_acquires_ok),
-- atomic_read(&fscache_n_acquires_nobufs),
-- atomic_read(&fscache_n_acquires_oom));
-+ atomic_read_unchecked(&fscache_n_acquires),
-+ atomic_read_unchecked(&fscache_n_acquires_null),
-+ atomic_read_unchecked(&fscache_n_acquires_no_cache),
-+ atomic_read_unchecked(&fscache_n_acquires_ok),
-+ atomic_read_unchecked(&fscache_n_acquires_nobufs),
-+ atomic_read_unchecked(&fscache_n_acquires_oom));
-
- seq_printf(m, "Lookups: n=%u neg=%u pos=%u crt=%u tmo=%u\n",
-- atomic_read(&fscache_n_object_lookups),
-- atomic_read(&fscache_n_object_lookups_negative),
-- atomic_read(&fscache_n_object_lookups_positive),
-- atomic_read(&fscache_n_object_lookups_timed_out),
-- atomic_read(&fscache_n_object_created));
-+ atomic_read_unchecked(&fscache_n_object_lookups),
-+ atomic_read_unchecked(&fscache_n_object_lookups_negative),
-+ atomic_read_unchecked(&fscache_n_object_lookups_positive),
-+ atomic_read_unchecked(&fscache_n_object_lookups_timed_out),
-+ atomic_read_unchecked(&fscache_n_object_created));
-
- seq_printf(m, "Updates: n=%u nul=%u run=%u\n",
-- atomic_read(&fscache_n_updates),
-- atomic_read(&fscache_n_updates_null),
-- atomic_read(&fscache_n_updates_run));
-+ atomic_read_unchecked(&fscache_n_updates),
-+ atomic_read_unchecked(&fscache_n_updates_null),
-+ atomic_read_unchecked(&fscache_n_updates_run));
-
- seq_printf(m, "Relinqs: n=%u nul=%u wcr=%u rtr=%u\n",
-- atomic_read(&fscache_n_relinquishes),
-- atomic_read(&fscache_n_relinquishes_null),
-- atomic_read(&fscache_n_relinquishes_waitcrt),
-- atomic_read(&fscache_n_relinquishes_retire));
-+ atomic_read_unchecked(&fscache_n_relinquishes),
-+ atomic_read_unchecked(&fscache_n_relinquishes_null),
-+ atomic_read_unchecked(&fscache_n_relinquishes_waitcrt),
-+ atomic_read_unchecked(&fscache_n_relinquishes_retire));
-
- seq_printf(m, "AttrChg: n=%u ok=%u nbf=%u oom=%u run=%u\n",
-- atomic_read(&fscache_n_attr_changed),
-- atomic_read(&fscache_n_attr_changed_ok),
-- atomic_read(&fscache_n_attr_changed_nobufs),
-- atomic_read(&fscache_n_attr_changed_nomem),
-- atomic_read(&fscache_n_attr_changed_calls));
-+ atomic_read_unchecked(&fscache_n_attr_changed),
-+ atomic_read_unchecked(&fscache_n_attr_changed_ok),
-+ atomic_read_unchecked(&fscache_n_attr_changed_nobufs),
-+ atomic_read_unchecked(&fscache_n_attr_changed_nomem),
-+ atomic_read_unchecked(&fscache_n_attr_changed_calls));
-
- seq_printf(m, "Allocs : n=%u ok=%u wt=%u nbf=%u int=%u\n",
-- atomic_read(&fscache_n_allocs),
-- atomic_read(&fscache_n_allocs_ok),
-- atomic_read(&fscache_n_allocs_wait),
-- atomic_read(&fscache_n_allocs_nobufs),
-- atomic_read(&fscache_n_allocs_intr));
-+ atomic_read_unchecked(&fscache_n_allocs),
-+ atomic_read_unchecked(&fscache_n_allocs_ok),
-+ atomic_read_unchecked(&fscache_n_allocs_wait),
-+ atomic_read_unchecked(&fscache_n_allocs_nobufs),
-+ atomic_read_unchecked(&fscache_n_allocs_intr));
- seq_printf(m, "Allocs : ops=%u owt=%u abt=%u\n",
-- atomic_read(&fscache_n_alloc_ops),
-- atomic_read(&fscache_n_alloc_op_waits),
-- atomic_read(&fscache_n_allocs_object_dead));
-+ atomic_read_unchecked(&fscache_n_alloc_ops),
-+ atomic_read_unchecked(&fscache_n_alloc_op_waits),
-+ atomic_read_unchecked(&fscache_n_allocs_object_dead));
-
- seq_printf(m, "Retrvls: n=%u ok=%u wt=%u nod=%u nbf=%u"
- " int=%u oom=%u\n",
-- atomic_read(&fscache_n_retrievals),
-- atomic_read(&fscache_n_retrievals_ok),
-- atomic_read(&fscache_n_retrievals_wait),
-- atomic_read(&fscache_n_retrievals_nodata),
-- atomic_read(&fscache_n_retrievals_nobufs),
-- atomic_read(&fscache_n_retrievals_intr),
-- atomic_read(&fscache_n_retrievals_nomem));
-+ atomic_read_unchecked(&fscache_n_retrievals),
-+ atomic_read_unchecked(&fscache_n_retrievals_ok),
-+ atomic_read_unchecked(&fscache_n_retrievals_wait),
-+ atomic_read_unchecked(&fscache_n_retrievals_nodata),
-+ atomic_read_unchecked(&fscache_n_retrievals_nobufs),
-+ atomic_read_unchecked(&fscache_n_retrievals_intr),
-+ atomic_read_unchecked(&fscache_n_retrievals_nomem));
- seq_printf(m, "Retrvls: ops=%u owt=%u abt=%u\n",
-- atomic_read(&fscache_n_retrieval_ops),
-- atomic_read(&fscache_n_retrieval_op_waits),
-- atomic_read(&fscache_n_retrievals_object_dead));
-+ atomic_read_unchecked(&fscache_n_retrieval_ops),
-+ atomic_read_unchecked(&fscache_n_retrieval_op_waits),
-+ atomic_read_unchecked(&fscache_n_retrievals_object_dead));
-
- seq_printf(m, "Stores : n=%u ok=%u agn=%u nbf=%u oom=%u\n",
-- atomic_read(&fscache_n_stores),
-- atomic_read(&fscache_n_stores_ok),
-- atomic_read(&fscache_n_stores_again),
-- atomic_read(&fscache_n_stores_nobufs),
-- atomic_read(&fscache_n_stores_oom));
-+ atomic_read_unchecked(&fscache_n_stores),
-+ atomic_read_unchecked(&fscache_n_stores_ok),
-+ atomic_read_unchecked(&fscache_n_stores_again),
-+ atomic_read_unchecked(&fscache_n_stores_nobufs),
-+ atomic_read_unchecked(&fscache_n_stores_oom));
- seq_printf(m, "Stores : ops=%u run=%u pgs=%u rxd=%u olm=%u\n",
-- atomic_read(&fscache_n_store_ops),
-- atomic_read(&fscache_n_store_calls),
-- atomic_read(&fscache_n_store_pages),
-- atomic_read(&fscache_n_store_radix_deletes),
-- atomic_read(&fscache_n_store_pages_over_limit));
-+ atomic_read_unchecked(&fscache_n_store_ops),
-+ atomic_read_unchecked(&fscache_n_store_calls),
-+ atomic_read_unchecked(&fscache_n_store_pages),
-+ atomic_read_unchecked(&fscache_n_store_radix_deletes),
-+ atomic_read_unchecked(&fscache_n_store_pages_over_limit));
-
- seq_printf(m, "VmScan : nos=%u gon=%u bsy=%u can=%u\n",
-- atomic_read(&fscache_n_store_vmscan_not_storing),
-- atomic_read(&fscache_n_store_vmscan_gone),
-- atomic_read(&fscache_n_store_vmscan_busy),
-- atomic_read(&fscache_n_store_vmscan_cancelled));
-+ atomic_read_unchecked(&fscache_n_store_vmscan_not_storing),
-+ atomic_read_unchecked(&fscache_n_store_vmscan_gone),
-+ atomic_read_unchecked(&fscache_n_store_vmscan_busy),
-+ atomic_read_unchecked(&fscache_n_store_vmscan_cancelled));
-
- seq_printf(m, "Ops : pend=%u run=%u enq=%u can=%u rej=%u\n",
-- atomic_read(&fscache_n_op_pend),
-- atomic_read(&fscache_n_op_run),
-- atomic_read(&fscache_n_op_enqueue),
-- atomic_read(&fscache_n_op_cancelled),
-- atomic_read(&fscache_n_op_rejected));
-+ atomic_read_unchecked(&fscache_n_op_pend),
-+ atomic_read_unchecked(&fscache_n_op_run),
-+ atomic_read_unchecked(&fscache_n_op_enqueue),
-+ atomic_read_unchecked(&fscache_n_op_cancelled),
-+ atomic_read_unchecked(&fscache_n_op_rejected));
- seq_printf(m, "Ops : dfr=%u rel=%u gc=%u\n",
-- atomic_read(&fscache_n_op_deferred_release),
-- atomic_read(&fscache_n_op_release),
-- atomic_read(&fscache_n_op_gc));
-+ atomic_read_unchecked(&fscache_n_op_deferred_release),
-+ atomic_read_unchecked(&fscache_n_op_release),
-+ atomic_read_unchecked(&fscache_n_op_gc));
-
- seq_printf(m, "CacheOp: alo=%d luo=%d luc=%d gro=%d\n",
- atomic_read(&fscache_n_cop_alloc_object),
-diff -urNp linux-2.6.32.45/fs/fs_struct.c linux-2.6.32.45/fs/fs_struct.c
---- linux-2.6.32.45/fs/fs_struct.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/fs_struct.c 2011-04-17 15:56:46.000000000 -0400
-@@ -4,6 +4,7 @@
- #include <linux/path.h>
- #include <linux/slab.h>
- #include <linux/fs_struct.h>
-+#include <linux/grsecurity.h>
-
- /*
- * Replace the fs->{rootmnt,root} with {mnt,dentry}. Put the old values.
-@@ -17,6 +18,7 @@ void set_fs_root(struct fs_struct *fs, s
- old_root = fs->root;
- fs->root = *path;
- path_get(path);
-+ gr_set_chroot_entries(current, path);
- write_unlock(&fs->lock);
- if (old_root.dentry)
- path_put(&old_root);
-@@ -56,6 +58,7 @@ void chroot_fs_refs(struct path *old_roo
- && fs->root.mnt == old_root->mnt) {
- path_get(new_root);
- fs->root = *new_root;
-+ gr_set_chroot_entries(p, new_root);
- count++;
- }
- if (fs->pwd.dentry == old_root->dentry
-@@ -89,7 +92,8 @@ void exit_fs(struct task_struct *tsk)
- task_lock(tsk);
- write_lock(&fs->lock);
- tsk->fs = NULL;
-- kill = !--fs->users;
-+ gr_clear_chroot_entries(tsk);
-+ kill = !atomic_dec_return(&fs->users);
- write_unlock(&fs->lock);
- task_unlock(tsk);
- if (kill)
-@@ -102,7 +106,7 @@ struct fs_struct *copy_fs_struct(struct
- struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL);
- /* We don't need to lock fs - think why ;-) */
- if (fs) {
-- fs->users = 1;
-+ atomic_set(&fs->users, 1);
- fs->in_exec = 0;
- rwlock_init(&fs->lock);
- fs->umask = old->umask;
-@@ -127,8 +131,9 @@ int unshare_fs_struct(void)
-
- task_lock(current);
- write_lock(&fs->lock);
-- kill = !--fs->users;
-+ kill = !atomic_dec_return(&fs->users);
- current->fs = new_fs;
-+ gr_set_chroot_entries(current, &new_fs->root);
- write_unlock(&fs->lock);
- task_unlock(current);
-
-@@ -147,7 +152,7 @@ EXPORT_SYMBOL(current_umask);
-
- /* to be mentioned only in INIT_TASK */
- struct fs_struct init_fs = {
-- .users = 1,
-+ .users = ATOMIC_INIT(1),
- .lock = __RW_LOCK_UNLOCKED(init_fs.lock),
- .umask = 0022,
- };
-@@ -162,12 +167,13 @@ void daemonize_fs_struct(void)
- task_lock(current);
-
- write_lock(&init_fs.lock);
-- init_fs.users++;
-+ atomic_inc(&init_fs.users);
- write_unlock(&init_fs.lock);
-
- write_lock(&fs->lock);
- current->fs = &init_fs;
-- kill = !--fs->users;
-+ gr_set_chroot_entries(current, ¤t->fs->root);
-+ kill = !atomic_dec_return(&fs->users);
- write_unlock(&fs->lock);
-
- task_unlock(current);
-diff -urNp linux-2.6.32.45/fs/fuse/cuse.c linux-2.6.32.45/fs/fuse/cuse.c
---- linux-2.6.32.45/fs/fuse/cuse.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/fuse/cuse.c 2011-08-05 20:33:55.000000000 -0400
-@@ -576,10 +576,12 @@ static int __init cuse_init(void)
- INIT_LIST_HEAD(&cuse_conntbl[i]);
-
- /* inherit and extend fuse_dev_operations */
-- cuse_channel_fops = fuse_dev_operations;
-- cuse_channel_fops.owner = THIS_MODULE;
-- cuse_channel_fops.open = cuse_channel_open;
-- cuse_channel_fops.release = cuse_channel_release;
-+ pax_open_kernel();
-+ memcpy((void *)&cuse_channel_fops, &fuse_dev_operations, sizeof(fuse_dev_operations));
-+ *(void **)&cuse_channel_fops.owner = THIS_MODULE;
-+ *(void **)&cuse_channel_fops.open = cuse_channel_open;
-+ *(void **)&cuse_channel_fops.release = cuse_channel_release;
-+ pax_close_kernel();
-
- cuse_class = class_create(THIS_MODULE, "cuse");
- if (IS_ERR(cuse_class))
-diff -urNp linux-2.6.32.45/fs/fuse/dev.c linux-2.6.32.45/fs/fuse/dev.c
---- linux-2.6.32.45/fs/fuse/dev.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/fuse/dev.c 2011-08-05 20:33:55.000000000 -0400
-@@ -885,7 +885,7 @@ static int fuse_notify_inval_entry(struc
- {
- struct fuse_notify_inval_entry_out outarg;
- int err = -EINVAL;
-- char buf[FUSE_NAME_MAX+1];
-+ char *buf = NULL;
- struct qstr name;
-
- if (size < sizeof(outarg))
-@@ -899,6 +899,11 @@ static int fuse_notify_inval_entry(struc
- if (outarg.namelen > FUSE_NAME_MAX)
- goto err;
-
-+ err = -ENOMEM;
-+ buf = kmalloc(FUSE_NAME_MAX+1, GFP_KERNEL);
-+ if (!buf)
-+ goto err;
-+
- name.name = buf;
- name.len = outarg.namelen;
- err = fuse_copy_one(cs, buf, outarg.namelen + 1);
-@@ -910,17 +915,15 @@ static int fuse_notify_inval_entry(struc
-
- down_read(&fc->killsb);
- err = -ENOENT;
-- if (!fc->sb)
-- goto err_unlock;
--
-- err = fuse_reverse_inval_entry(fc->sb, outarg.parent, &name);
--
--err_unlock:
-+ if (fc->sb)
-+ err = fuse_reverse_inval_entry(fc->sb, outarg.parent, &name);
- up_read(&fc->killsb);
-+ kfree(buf);
- return err;
-
- err:
- fuse_copy_finish(cs);
-+ kfree(buf);
- return err;
- }
-
-diff -urNp linux-2.6.32.45/fs/fuse/dir.c linux-2.6.32.45/fs/fuse/dir.c
---- linux-2.6.32.45/fs/fuse/dir.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/fuse/dir.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1127,7 +1127,7 @@ static char *read_link(struct dentry *de
- return link;
- }
-
--static void free_link(char *link)
-+static void free_link(const char *link)
- {
- if (!IS_ERR(link))
- free_page((unsigned long) link);
-diff -urNp linux-2.6.32.45/fs/gfs2/ops_inode.c linux-2.6.32.45/fs/gfs2/ops_inode.c
---- linux-2.6.32.45/fs/gfs2/ops_inode.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/gfs2/ops_inode.c 2011-05-16 21:46:57.000000000 -0400
-@@ -752,6 +752,8 @@ static int gfs2_rename(struct inode *odi
- unsigned int x;
- int error;
-
-+ pax_track_stack();
-+
- if (ndentry->d_inode) {
- nip = GFS2_I(ndentry->d_inode);
- if (ip == nip)
-diff -urNp linux-2.6.32.45/fs/gfs2/sys.c linux-2.6.32.45/fs/gfs2/sys.c
---- linux-2.6.32.45/fs/gfs2/sys.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/gfs2/sys.c 2011-04-17 15:56:46.000000000 -0400
-@@ -49,7 +49,7 @@ static ssize_t gfs2_attr_store(struct ko
- return a->store ? a->store(sdp, buf, len) : len;
- }
-
--static struct sysfs_ops gfs2_attr_ops = {
-+static const struct sysfs_ops gfs2_attr_ops = {
- .show = gfs2_attr_show,
- .store = gfs2_attr_store,
- };
-@@ -584,7 +584,7 @@ static int gfs2_uevent(struct kset *kset
- return 0;
- }
-
--static struct kset_uevent_ops gfs2_uevent_ops = {
-+static const struct kset_uevent_ops gfs2_uevent_ops = {
- .uevent = gfs2_uevent,
- };
-
-diff -urNp linux-2.6.32.45/fs/hfsplus/catalog.c linux-2.6.32.45/fs/hfsplus/catalog.c
---- linux-2.6.32.45/fs/hfsplus/catalog.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/hfsplus/catalog.c 2011-05-16 21:46:57.000000000 -0400
-@@ -157,6 +157,8 @@ int hfsplus_find_cat(struct super_block
- int err;
- u16 type;
-
-+ pax_track_stack();
-+
- hfsplus_cat_build_key(sb, fd->search_key, cnid, NULL);
- err = hfs_brec_read(fd, &tmp, sizeof(hfsplus_cat_entry));
- if (err)
-@@ -186,6 +188,8 @@ int hfsplus_create_cat(u32 cnid, struct
- int entry_size;
- int err;
-
-+ pax_track_stack();
-+
- dprint(DBG_CAT_MOD, "create_cat: %s,%u(%d)\n", str->name, cnid, inode->i_nlink);
- sb = dir->i_sb;
- hfs_find_init(HFSPLUS_SB(sb).cat_tree, &fd);
-@@ -318,6 +322,8 @@ int hfsplus_rename_cat(u32 cnid,
- int entry_size, type;
- int err = 0;
-
-+ pax_track_stack();
-+
- dprint(DBG_CAT_MOD, "rename_cat: %u - %lu,%s - %lu,%s\n", cnid, src_dir->i_ino, src_name->name,
- dst_dir->i_ino, dst_name->name);
- sb = src_dir->i_sb;
-diff -urNp linux-2.6.32.45/fs/hfsplus/dir.c linux-2.6.32.45/fs/hfsplus/dir.c
---- linux-2.6.32.45/fs/hfsplus/dir.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/hfsplus/dir.c 2011-05-16 21:46:57.000000000 -0400
-@@ -121,6 +121,8 @@ static int hfsplus_readdir(struct file *
- struct hfsplus_readdir_data *rd;
- u16 type;
-
-+ pax_track_stack();
-+
- if (filp->f_pos >= inode->i_size)
- return 0;
-
-diff -urNp linux-2.6.32.45/fs/hfsplus/inode.c linux-2.6.32.45/fs/hfsplus/inode.c
---- linux-2.6.32.45/fs/hfsplus/inode.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/hfsplus/inode.c 2011-05-16 21:46:57.000000000 -0400
-@@ -399,6 +399,8 @@ int hfsplus_cat_read_inode(struct inode
- int res = 0;
- u16 type;
-
-+ pax_track_stack();
-+
- type = hfs_bnode_read_u16(fd->bnode, fd->entryoffset);
-
- HFSPLUS_I(inode).dev = 0;
-@@ -461,6 +463,8 @@ int hfsplus_cat_write_inode(struct inode
- struct hfs_find_data fd;
- hfsplus_cat_entry entry;
-
-+ pax_track_stack();
-+
- if (HFSPLUS_IS_RSRC(inode))
- main_inode = HFSPLUS_I(inode).rsrc_inode;
-
-diff -urNp linux-2.6.32.45/fs/hfsplus/ioctl.c linux-2.6.32.45/fs/hfsplus/ioctl.c
---- linux-2.6.32.45/fs/hfsplus/ioctl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/hfsplus/ioctl.c 2011-05-16 21:46:57.000000000 -0400
-@@ -101,6 +101,8 @@ int hfsplus_setxattr(struct dentry *dent
- struct hfsplus_cat_file *file;
- int res;
-
-+ pax_track_stack();
-+
- if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
- return -EOPNOTSUPP;
-
-@@ -143,6 +145,8 @@ ssize_t hfsplus_getxattr(struct dentry *
- struct hfsplus_cat_file *file;
- ssize_t res = 0;
-
-+ pax_track_stack();
-+
- if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
- return -EOPNOTSUPP;
-
-diff -urNp linux-2.6.32.45/fs/hfsplus/super.c linux-2.6.32.45/fs/hfsplus/super.c
---- linux-2.6.32.45/fs/hfsplus/super.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/hfsplus/super.c 2011-05-16 21:46:57.000000000 -0400
-@@ -312,6 +312,8 @@ static int hfsplus_fill_super(struct sup
- struct nls_table *nls = NULL;
- int err = -EINVAL;
-
-+ pax_track_stack();
-+
- sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
- if (!sbi)
- return -ENOMEM;
-diff -urNp linux-2.6.32.45/fs/hugetlbfs/inode.c linux-2.6.32.45/fs/hugetlbfs/inode.c
---- linux-2.6.32.45/fs/hugetlbfs/inode.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/hugetlbfs/inode.c 2011-04-17 15:56:46.000000000 -0400
-@@ -909,7 +909,7 @@ static struct file_system_type hugetlbfs
- .kill_sb = kill_litter_super,
- };
-
--static struct vfsmount *hugetlbfs_vfsmount;
-+struct vfsmount *hugetlbfs_vfsmount;
-
- static int can_do_hugetlb_shm(void)
- {
-diff -urNp linux-2.6.32.45/fs/ioctl.c linux-2.6.32.45/fs/ioctl.c
---- linux-2.6.32.45/fs/ioctl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/ioctl.c 2011-04-17 15:56:46.000000000 -0400
-@@ -97,7 +97,7 @@ int fiemap_fill_next_extent(struct fiema
- u64 phys, u64 len, u32 flags)
- {
- struct fiemap_extent extent;
-- struct fiemap_extent *dest = fieinfo->fi_extents_start;
-+ struct fiemap_extent __user *dest = fieinfo->fi_extents_start;
-
- /* only count the extents */
- if (fieinfo->fi_extents_max == 0) {
-@@ -207,7 +207,7 @@ static int ioctl_fiemap(struct file *fil
-
- fieinfo.fi_flags = fiemap.fm_flags;
- fieinfo.fi_extents_max = fiemap.fm_extent_count;
-- fieinfo.fi_extents_start = (struct fiemap_extent *)(arg + sizeof(fiemap));
-+ fieinfo.fi_extents_start = (struct fiemap_extent __user *)(arg + sizeof(fiemap));
-
- if (fiemap.fm_extent_count != 0 &&
- !access_ok(VERIFY_WRITE, fieinfo.fi_extents_start,
-@@ -220,7 +220,7 @@ static int ioctl_fiemap(struct file *fil
- error = inode->i_op->fiemap(inode, &fieinfo, fiemap.fm_start, len);
- fiemap.fm_flags = fieinfo.fi_flags;
- fiemap.fm_mapped_extents = fieinfo.fi_extents_mapped;
-- if (copy_to_user((char *)arg, &fiemap, sizeof(fiemap)))
-+ if (copy_to_user((__force char __user *)arg, &fiemap, sizeof(fiemap)))
- error = -EFAULT;
-
- return error;
-diff -urNp linux-2.6.32.45/fs/jbd/checkpoint.c linux-2.6.32.45/fs/jbd/checkpoint.c
---- linux-2.6.32.45/fs/jbd/checkpoint.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/jbd/checkpoint.c 2011-05-16 21:46:57.000000000 -0400
-@@ -348,6 +348,8 @@ int log_do_checkpoint(journal_t *journal
- tid_t this_tid;
- int result;
-
-+ pax_track_stack();
-+
- jbd_debug(1, "Start checkpoint\n");
-
- /*
-diff -urNp linux-2.6.32.45/fs/jffs2/compr_rtime.c linux-2.6.32.45/fs/jffs2/compr_rtime.c
---- linux-2.6.32.45/fs/jffs2/compr_rtime.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/jffs2/compr_rtime.c 2011-05-16 21:46:57.000000000 -0400
-@@ -37,6 +37,8 @@ static int jffs2_rtime_compress(unsigned
- int outpos = 0;
- int pos=0;
-
-+ pax_track_stack();
-+
- memset(positions,0,sizeof(positions));
-
- while (pos < (*sourcelen) && outpos <= (*dstlen)-2) {
-@@ -79,6 +81,8 @@ static int jffs2_rtime_decompress(unsign
- int outpos = 0;
- int pos=0;
-
-+ pax_track_stack();
-+
- memset(positions,0,sizeof(positions));
-
- while (outpos<destlen) {
-diff -urNp linux-2.6.32.45/fs/jffs2/compr_rubin.c linux-2.6.32.45/fs/jffs2/compr_rubin.c
---- linux-2.6.32.45/fs/jffs2/compr_rubin.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/jffs2/compr_rubin.c 2011-05-16 21:46:57.000000000 -0400
-@@ -314,6 +314,8 @@ static int jffs2_dynrubin_compress(unsig
- int ret;
- uint32_t mysrclen, mydstlen;
-
-+ pax_track_stack();
-+
- mysrclen = *sourcelen;
- mydstlen = *dstlen - 8;
-
-diff -urNp linux-2.6.32.45/fs/jffs2/erase.c linux-2.6.32.45/fs/jffs2/erase.c
---- linux-2.6.32.45/fs/jffs2/erase.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/jffs2/erase.c 2011-04-17 15:56:46.000000000 -0400
-@@ -434,7 +434,8 @@ static void jffs2_mark_erased_block(stru
- struct jffs2_unknown_node marker = {
- .magic = cpu_to_je16(JFFS2_MAGIC_BITMASK),
- .nodetype = cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
-- .totlen = cpu_to_je32(c->cleanmarker_size)
-+ .totlen = cpu_to_je32(c->cleanmarker_size),
-+ .hdr_crc = cpu_to_je32(0)
- };
-
- jffs2_prealloc_raw_node_refs(c, jeb, 1);
-diff -urNp linux-2.6.32.45/fs/jffs2/wbuf.c linux-2.6.32.45/fs/jffs2/wbuf.c
---- linux-2.6.32.45/fs/jffs2/wbuf.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/jffs2/wbuf.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1012,7 +1012,8 @@ static const struct jffs2_unknown_node o
- {
- .magic = constant_cpu_to_je16(JFFS2_MAGIC_BITMASK),
- .nodetype = constant_cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
-- .totlen = constant_cpu_to_je32(8)
-+ .totlen = constant_cpu_to_je32(8),
-+ .hdr_crc = constant_cpu_to_je32(0)
- };
-
- /*
-diff -urNp linux-2.6.32.45/fs/jffs2/xattr.c linux-2.6.32.45/fs/jffs2/xattr.c
---- linux-2.6.32.45/fs/jffs2/xattr.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/jffs2/xattr.c 2011-05-16 21:46:57.000000000 -0400
-@@ -773,6 +773,8 @@ void jffs2_build_xattr_subsystem(struct
-
- BUG_ON(!(c->flags & JFFS2_SB_FLAG_BUILDING));
-
-+ pax_track_stack();
-+
- /* Phase.1 : Merge same xref */
- for (i=0; i < XREF_TMPHASH_SIZE; i++)
- xref_tmphash[i] = NULL;
-diff -urNp linux-2.6.32.45/fs/jfs/super.c linux-2.6.32.45/fs/jfs/super.c
---- linux-2.6.32.45/fs/jfs/super.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/jfs/super.c 2011-06-07 18:06:04.000000000 -0400
-@@ -793,7 +793,7 @@ static int __init init_jfs_fs(void)
-
- jfs_inode_cachep =
- kmem_cache_create("jfs_ip", sizeof(struct jfs_inode_info), 0,
-- SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD,
-+ SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|SLAB_USERCOPY,
- init_once);
- if (jfs_inode_cachep == NULL)
- return -ENOMEM;
-diff -urNp linux-2.6.32.45/fs/Kconfig.binfmt linux-2.6.32.45/fs/Kconfig.binfmt
---- linux-2.6.32.45/fs/Kconfig.binfmt 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/Kconfig.binfmt 2011-04-17 15:56:46.000000000 -0400
-@@ -86,7 +86,7 @@ config HAVE_AOUT
-
- config BINFMT_AOUT
- tristate "Kernel support for a.out and ECOFF binaries"
-- depends on HAVE_AOUT
-+ depends on HAVE_AOUT && BROKEN
- ---help---
- A.out (Assembler.OUTput) is a set of formats for libraries and
- executables used in the earliest versions of UNIX. Linux used
-diff -urNp linux-2.6.32.45/fs/libfs.c linux-2.6.32.45/fs/libfs.c
---- linux-2.6.32.45/fs/libfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/libfs.c 2011-05-11 18:25:15.000000000 -0400
-@@ -157,12 +157,20 @@ int dcache_readdir(struct file * filp, v
-
- for (p=q->next; p != &dentry->d_subdirs; p=p->next) {
- struct dentry *next;
-+ char d_name[sizeof(next->d_iname)];
-+ const unsigned char *name;
-+
- next = list_entry(p, struct dentry, d_u.d_child);
- if (d_unhashed(next) || !next->d_inode)
- continue;
-
- spin_unlock(&dcache_lock);
-- if (filldir(dirent, next->d_name.name,
-+ name = next->d_name.name;
-+ if (name == next->d_iname) {
-+ memcpy(d_name, name, next->d_name.len);
-+ name = d_name;
-+ }
-+ if (filldir(dirent, name,
- next->d_name.len, filp->f_pos,
- next->d_inode->i_ino,
- dt_type(next->d_inode)) < 0)
-diff -urNp linux-2.6.32.45/fs/lockd/clntproc.c linux-2.6.32.45/fs/lockd/clntproc.c
---- linux-2.6.32.45/fs/lockd/clntproc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/lockd/clntproc.c 2011-05-16 21:46:57.000000000 -0400
-@@ -36,11 +36,11 @@ static const struct rpc_call_ops nlmclnt
- /*
- * Cookie counter for NLM requests
- */
--static atomic_t nlm_cookie = ATOMIC_INIT(0x1234);
-+static atomic_unchecked_t nlm_cookie = ATOMIC_INIT(0x1234);
-
- void nlmclnt_next_cookie(struct nlm_cookie *c)
- {
-- u32 cookie = atomic_inc_return(&nlm_cookie);
-+ u32 cookie = atomic_inc_return_unchecked(&nlm_cookie);
-
- memcpy(c->data, &cookie, 4);
- c->len=4;
-@@ -621,6 +621,8 @@ nlmclnt_reclaim(struct nlm_host *host, s
- struct nlm_rqst reqst, *req;
- int status;
-
-+ pax_track_stack();
-+
- req = &reqst;
- memset(req, 0, sizeof(*req));
- locks_init_lock(&req->a_args.lock.fl);
-diff -urNp linux-2.6.32.45/fs/lockd/svc.c linux-2.6.32.45/fs/lockd/svc.c
---- linux-2.6.32.45/fs/lockd/svc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/lockd/svc.c 2011-04-17 15:56:46.000000000 -0400
-@@ -43,7 +43,7 @@
-
- static struct svc_program nlmsvc_program;
-
--struct nlmsvc_binding * nlmsvc_ops;
-+const struct nlmsvc_binding * nlmsvc_ops;
- EXPORT_SYMBOL_GPL(nlmsvc_ops);
-
- static DEFINE_MUTEX(nlmsvc_mutex);
-diff -urNp linux-2.6.32.45/fs/locks.c linux-2.6.32.45/fs/locks.c
---- linux-2.6.32.45/fs/locks.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/locks.c 2011-07-06 19:47:11.000000000 -0400
-@@ -145,10 +145,28 @@ static LIST_HEAD(blocked_list);
-
- static struct kmem_cache *filelock_cache __read_mostly;
-
-+static void locks_init_lock_always(struct file_lock *fl)
-+{
-+ fl->fl_next = NULL;
-+ fl->fl_fasync = NULL;
-+ fl->fl_owner = NULL;
-+ fl->fl_pid = 0;
-+ fl->fl_nspid = NULL;
-+ fl->fl_file = NULL;
-+ fl->fl_flags = 0;
-+ fl->fl_type = 0;
-+ fl->fl_start = fl->fl_end = 0;
-+}
-+
- /* Allocate an empty lock structure. */
- static struct file_lock *locks_alloc_lock(void)
- {
-- return kmem_cache_alloc(filelock_cache, GFP_KERNEL);
-+ struct file_lock *fl = kmem_cache_alloc(filelock_cache, GFP_KERNEL);
-+
-+ if (fl)
-+ locks_init_lock_always(fl);
-+
-+ return fl;
- }
-
- void locks_release_private(struct file_lock *fl)
-@@ -183,17 +201,9 @@ void locks_init_lock(struct file_lock *f
- INIT_LIST_HEAD(&fl->fl_link);
- INIT_LIST_HEAD(&fl->fl_block);
- init_waitqueue_head(&fl->fl_wait);
-- fl->fl_next = NULL;
-- fl->fl_fasync = NULL;
-- fl->fl_owner = NULL;
-- fl->fl_pid = 0;
-- fl->fl_nspid = NULL;
-- fl->fl_file = NULL;
-- fl->fl_flags = 0;
-- fl->fl_type = 0;
-- fl->fl_start = fl->fl_end = 0;
- fl->fl_ops = NULL;
- fl->fl_lmops = NULL;
-+ locks_init_lock_always(fl);
- }
-
- EXPORT_SYMBOL(locks_init_lock);
-@@ -2007,16 +2017,16 @@ void locks_remove_flock(struct file *fil
- return;
-
- if (filp->f_op && filp->f_op->flock) {
-- struct file_lock fl = {
-+ struct file_lock flock = {
- .fl_pid = current->tgid,
- .fl_file = filp,
- .fl_flags = FL_FLOCK,
- .fl_type = F_UNLCK,
- .fl_end = OFFSET_MAX,
- };
-- filp->f_op->flock(filp, F_SETLKW, &fl);
-- if (fl.fl_ops && fl.fl_ops->fl_release_private)
-- fl.fl_ops->fl_release_private(&fl);
-+ filp->f_op->flock(filp, F_SETLKW, &flock);
-+ if (flock.fl_ops && flock.fl_ops->fl_release_private)
-+ flock.fl_ops->fl_release_private(&flock);
- }
-
- lock_kernel();
-diff -urNp linux-2.6.32.45/fs/mbcache.c linux-2.6.32.45/fs/mbcache.c
---- linux-2.6.32.45/fs/mbcache.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/mbcache.c 2011-08-05 20:33:55.000000000 -0400
-@@ -266,9 +266,9 @@ mb_cache_create(const char *name, struct
- if (!cache)
- goto fail;
- cache->c_name = name;
-- cache->c_op.free = NULL;
-+ *(void **)&cache->c_op.free = NULL;
- if (cache_op)
-- cache->c_op.free = cache_op->free;
-+ *(void **)&cache->c_op.free = cache_op->free;
- atomic_set(&cache->c_entry_count, 0);
- cache->c_bucket_bits = bucket_bits;
- #ifdef MB_CACHE_INDEXES_COUNT
-diff -urNp linux-2.6.32.45/fs/namei.c linux-2.6.32.45/fs/namei.c
---- linux-2.6.32.45/fs/namei.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/namei.c 2011-05-16 21:46:57.000000000 -0400
-@@ -224,14 +224,6 @@ int generic_permission(struct inode *ino
- return ret;
-
- /*
-- * Read/write DACs are always overridable.
-- * Executable DACs are overridable if at least one exec bit is set.
-- */
-- if (!(mask & MAY_EXEC) || execute_ok(inode))
-- if (capable(CAP_DAC_OVERRIDE))
-- return 0;
--
-- /*
- * Searching includes executable on directories, else just read.
- */
- mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
-@@ -239,6 +231,14 @@ int generic_permission(struct inode *ino
- if (capable(CAP_DAC_READ_SEARCH))
- return 0;
-
-+ /*
-+ * Read/write DACs are always overridable.
-+ * Executable DACs are overridable if at least one exec bit is set.
-+ */
-+ if (!(mask & MAY_EXEC) || execute_ok(inode))
-+ if (capable(CAP_DAC_OVERRIDE))
-+ return 0;
-+
- return -EACCES;
- }
-
-@@ -458,7 +458,8 @@ static int exec_permission_lite(struct i
- if (!ret)
- goto ok;
-
-- if (capable(CAP_DAC_OVERRIDE) || capable(CAP_DAC_READ_SEARCH))
-+ if (capable_nolog(CAP_DAC_OVERRIDE) || capable(CAP_DAC_READ_SEARCH) ||
-+ capable(CAP_DAC_OVERRIDE))
- goto ok;
-
- return ret;
-@@ -638,7 +639,7 @@ static __always_inline int __do_follow_l
- cookie = dentry->d_inode->i_op->follow_link(dentry, nd);
- error = PTR_ERR(cookie);
- if (!IS_ERR(cookie)) {
-- char *s = nd_get_link(nd);
-+ const char *s = nd_get_link(nd);
- error = 0;
- if (s)
- error = __vfs_follow_link(nd, s);
-@@ -669,6 +670,13 @@ static inline int do_follow_link(struct
- err = security_inode_follow_link(path->dentry, nd);
- if (err)
- goto loop;
-+
-+ if (gr_handle_follow_link(path->dentry->d_parent->d_inode,
-+ path->dentry->d_inode, path->dentry, nd->path.mnt)) {
-+ err = -EACCES;
-+ goto loop;
-+ }
-+
- current->link_count++;
- current->total_link_count++;
- nd->depth++;
-@@ -1016,11 +1024,18 @@ return_reval:
- break;
- }
- return_base:
-+ if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
-+ path_put(&nd->path);
-+ return -ENOENT;
-+ }
- return 0;
- out_dput:
- path_put_conditional(&next, nd);
- break;
- }
-+ if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt))
-+ err = -ENOENT;
-+
- path_put(&nd->path);
- return_err:
- return err;
-@@ -1091,13 +1106,20 @@ static int do_path_lookup(int dfd, const
- int retval = path_init(dfd, name, flags, nd);
- if (!retval)
- retval = path_walk(name, nd);
-- if (unlikely(!retval && !audit_dummy_context() && nd->path.dentry &&
-- nd->path.dentry->d_inode))
-- audit_inode(name, nd->path.dentry);
-+
-+ if (likely(!retval)) {
-+ if (nd->path.dentry && nd->path.dentry->d_inode) {
-+ if (*name != '/' && !gr_chroot_fchdir(nd->path.dentry, nd->path.mnt))
-+ retval = -ENOENT;
-+ if (!audit_dummy_context())
-+ audit_inode(name, nd->path.dentry);
-+ }
-+ }
- if (nd->root.mnt) {
- path_put(&nd->root);
- nd->root.mnt = NULL;
- }
-+
- return retval;
- }
-
-@@ -1576,6 +1598,20 @@ int may_open(struct path *path, int acc_
- if (error)
- goto err_out;
-
-+
-+ if (gr_handle_rofs_blockwrite(dentry, path->mnt, acc_mode)) {
-+ error = -EPERM;
-+ goto err_out;
-+ }
-+ if (gr_handle_rawio(inode)) {
-+ error = -EPERM;
-+ goto err_out;
-+ }
-+ if (!gr_acl_handle_open(dentry, path->mnt, flag)) {
-+ error = -EACCES;
-+ goto err_out;
-+ }
-+
- if (flag & O_TRUNC) {
- error = get_write_access(inode);
- if (error)
-@@ -1621,12 +1657,19 @@ static int __open_namei_create(struct na
- int error;
- struct dentry *dir = nd->path.dentry;
-
-+ if (!gr_acl_handle_creat(path->dentry, nd->path.dentry, nd->path.mnt, flag, mode)) {
-+ error = -EACCES;
-+ goto out_unlock;
-+ }
-+
- if (!IS_POSIXACL(dir->d_inode))
- mode &= ~current_umask();
- error = security_path_mknod(&nd->path, path->dentry, mode, 0);
- if (error)
- goto out_unlock;
- error = vfs_create(dir->d_inode, path->dentry, mode, nd);
-+ if (!error)
-+ gr_handle_create(path->dentry, nd->path.mnt);
- out_unlock:
- mutex_unlock(&dir->d_inode->i_mutex);
- dput(nd->path.dentry);
-@@ -1709,6 +1752,22 @@ struct file *do_filp_open(int dfd, const
- &nd, flag);
- if (error)
- return ERR_PTR(error);
-+
-+ if (gr_handle_rofs_blockwrite(nd.path.dentry, nd.path.mnt, acc_mode)) {
-+ error = -EPERM;
-+ goto exit;
-+ }
-+
-+ if (gr_handle_rawio(nd.path.dentry->d_inode)) {
-+ error = -EPERM;
-+ goto exit;
-+ }
-+
-+ if (!gr_acl_handle_open(nd.path.dentry, nd.path.mnt, flag)) {
-+ error = -EACCES;
-+ goto exit;
-+ }
-+
- goto ok;
- }
-
-@@ -1795,6 +1854,14 @@ do_last:
- /*
- * It already exists.
- */
-+
-+ /* only check if O_CREAT is specified, all other checks need
-+ to go into may_open */
-+ if (gr_handle_fifo(path.dentry, path.mnt, dir, flag, acc_mode)) {
-+ error = -EACCES;
-+ goto exit_mutex_unlock;
-+ }
-+
- mutex_unlock(&dir->d_inode->i_mutex);
- audit_inode(pathname, path.dentry);
-
-@@ -1887,6 +1954,13 @@ do_link:
- error = security_inode_follow_link(path.dentry, &nd);
- if (error)
- goto exit_dput;
-+
-+ if (gr_handle_follow_link(path.dentry->d_parent->d_inode, path.dentry->d_inode,
-+ path.dentry, nd.path.mnt)) {
-+ error = -EACCES;
-+ goto exit_dput;
-+ }
-+
- error = __do_follow_link(&path, &nd);
- if (error) {
- /* Does someone understand code flow here? Or it is only
-@@ -2061,6 +2135,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
- error = may_mknod(mode);
- if (error)
- goto out_dput;
-+
-+ if (gr_handle_chroot_mknod(dentry, nd.path.mnt, mode)) {
-+ error = -EPERM;
-+ goto out_dput;
-+ }
-+
-+ if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
-+ error = -EACCES;
-+ goto out_dput;
-+ }
-+
- error = mnt_want_write(nd.path.mnt);
- if (error)
- goto out_dput;
-@@ -2081,6 +2166,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
- }
- out_drop_write:
- mnt_drop_write(nd.path.mnt);
-+
-+ if (!error)
-+ gr_handle_create(dentry, nd.path.mnt);
- out_dput:
- dput(dentry);
- out_unlock:
-@@ -2134,6 +2222,11 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
- if (IS_ERR(dentry))
- goto out_unlock;
-
-+ if (!gr_acl_handle_mkdir(dentry, nd.path.dentry, nd.path.mnt)) {
-+ error = -EACCES;
-+ goto out_dput;
-+ }
-+
- if (!IS_POSIXACL(nd.path.dentry->d_inode))
- mode &= ~current_umask();
- error = mnt_want_write(nd.path.mnt);
-@@ -2145,6 +2238,10 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
- error = vfs_mkdir(nd.path.dentry->d_inode, dentry, mode);
- out_drop_write:
- mnt_drop_write(nd.path.mnt);
-+
-+ if (!error)
-+ gr_handle_create(dentry, nd.path.mnt);
-+
- out_dput:
- dput(dentry);
- out_unlock:
-@@ -2226,6 +2323,8 @@ static long do_rmdir(int dfd, const char
- char * name;
- struct dentry *dentry;
- struct nameidata nd;
-+ ino_t saved_ino = 0;
-+ dev_t saved_dev = 0;
-
- error = user_path_parent(dfd, pathname, &nd, &name);
- if (error)
-@@ -2250,6 +2349,19 @@ static long do_rmdir(int dfd, const char
- error = PTR_ERR(dentry);
- if (IS_ERR(dentry))
- goto exit2;
-+
-+ if (dentry->d_inode != NULL) {
-+ if (dentry->d_inode->i_nlink <= 1) {
-+ saved_ino = dentry->d_inode->i_ino;
-+ saved_dev = gr_get_dev_from_dentry(dentry);
-+ }
-+
-+ if (!gr_acl_handle_rmdir(dentry, nd.path.mnt)) {
-+ error = -EACCES;
-+ goto exit3;
-+ }
-+ }
-+
- error = mnt_want_write(nd.path.mnt);
- if (error)
- goto exit3;
-@@ -2257,6 +2369,8 @@ static long do_rmdir(int dfd, const char
- if (error)
- goto exit4;
- error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
-+ if (!error && (saved_dev || saved_ino))
-+ gr_handle_delete(saved_ino, saved_dev);
- exit4:
- mnt_drop_write(nd.path.mnt);
- exit3:
-@@ -2318,6 +2432,8 @@ static long do_unlinkat(int dfd, const c
- struct dentry *dentry;
- struct nameidata nd;
- struct inode *inode = NULL;
-+ ino_t saved_ino = 0;
-+ dev_t saved_dev = 0;
-
- error = user_path_parent(dfd, pathname, &nd, &name);
- if (error)
-@@ -2337,8 +2453,19 @@ static long do_unlinkat(int dfd, const c
- if (nd.last.name[nd.last.len])
- goto slashes;
- inode = dentry->d_inode;
-- if (inode)
-+ if (inode) {
-+ if (inode->i_nlink <= 1) {
-+ saved_ino = inode->i_ino;
-+ saved_dev = gr_get_dev_from_dentry(dentry);
-+ }
-+
- atomic_inc(&inode->i_count);
-+
-+ if (!gr_acl_handle_unlink(dentry, nd.path.mnt)) {
-+ error = -EACCES;
-+ goto exit2;
-+ }
-+ }
- error = mnt_want_write(nd.path.mnt);
- if (error)
- goto exit2;
-@@ -2346,6 +2473,8 @@ static long do_unlinkat(int dfd, const c
- if (error)
- goto exit3;
- error = vfs_unlink(nd.path.dentry->d_inode, dentry);
-+ if (!error && (saved_ino || saved_dev))
-+ gr_handle_delete(saved_ino, saved_dev);
- exit3:
- mnt_drop_write(nd.path.mnt);
- exit2:
-@@ -2424,6 +2553,11 @@ SYSCALL_DEFINE3(symlinkat, const char __
- if (IS_ERR(dentry))
- goto out_unlock;
-
-+ if (!gr_acl_handle_symlink(dentry, nd.path.dentry, nd.path.mnt, from)) {
-+ error = -EACCES;
-+ goto out_dput;
-+ }
-+
- error = mnt_want_write(nd.path.mnt);
- if (error)
- goto out_dput;
-@@ -2431,6 +2565,8 @@ SYSCALL_DEFINE3(symlinkat, const char __
- if (error)
- goto out_drop_write;
- error = vfs_symlink(nd.path.dentry->d_inode, dentry, from);
-+ if (!error)
-+ gr_handle_create(dentry, nd.path.mnt);
- out_drop_write:
- mnt_drop_write(nd.path.mnt);
- out_dput:
-@@ -2524,6 +2660,20 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
- error = PTR_ERR(new_dentry);
- if (IS_ERR(new_dentry))
- goto out_unlock;
-+
-+ if (gr_handle_hardlink(old_path.dentry, old_path.mnt,
-+ old_path.dentry->d_inode,
-+ old_path.dentry->d_inode->i_mode, to)) {
-+ error = -EACCES;
-+ goto out_dput;
-+ }
-+
-+ if (!gr_acl_handle_link(new_dentry, nd.path.dentry, nd.path.mnt,
-+ old_path.dentry, old_path.mnt, to)) {
-+ error = -EACCES;
-+ goto out_dput;
-+ }
-+
- error = mnt_want_write(nd.path.mnt);
- if (error)
- goto out_dput;
-@@ -2531,6 +2681,8 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
- if (error)
- goto out_drop_write;
- error = vfs_link(old_path.dentry, nd.path.dentry->d_inode, new_dentry);
-+ if (!error)
-+ gr_handle_create(new_dentry, nd.path.mnt);
- out_drop_write:
- mnt_drop_write(nd.path.mnt);
- out_dput:
-@@ -2708,6 +2860,8 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
- char *to;
- int error;
-
-+ pax_track_stack();
-+
- error = user_path_parent(olddfd, oldname, &oldnd, &from);
- if (error)
- goto exit;
-@@ -2764,6 +2918,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
- if (new_dentry == trap)
- goto exit5;
-
-+ error = gr_acl_handle_rename(new_dentry, new_dir, newnd.path.mnt,
-+ old_dentry, old_dir->d_inode, oldnd.path.mnt,
-+ to);
-+ if (error)
-+ goto exit5;
-+
- error = mnt_want_write(oldnd.path.mnt);
- if (error)
- goto exit5;
-@@ -2773,6 +2933,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
- goto exit6;
- error = vfs_rename(old_dir->d_inode, old_dentry,
- new_dir->d_inode, new_dentry);
-+ if (!error)
-+ gr_handle_rename(old_dir->d_inode, new_dir->d_inode, old_dentry,
-+ new_dentry, oldnd.path.mnt, new_dentry->d_inode ? 1 : 0);
- exit6:
- mnt_drop_write(oldnd.path.mnt);
- exit5:
-@@ -2798,6 +2961,8 @@ SYSCALL_DEFINE2(rename, const char __use
-
- int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
- {
-+ char tmpbuf[64];
-+ const char *newlink;
- int len;
-
- len = PTR_ERR(link);
-@@ -2807,7 +2972,14 @@ int vfs_readlink(struct dentry *dentry,
- len = strlen(link);
- if (len > (unsigned) buflen)
- len = buflen;
-- if (copy_to_user(buffer, link, len))
-+
-+ if (len < sizeof(tmpbuf)) {
-+ memcpy(tmpbuf, link, len);
-+ newlink = tmpbuf;
-+ } else
-+ newlink = link;
-+
-+ if (copy_to_user(buffer, newlink, len))
- len = -EFAULT;
- out:
- return len;
-diff -urNp linux-2.6.32.45/fs/namespace.c linux-2.6.32.45/fs/namespace.c
---- linux-2.6.32.45/fs/namespace.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/namespace.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1083,6 +1083,9 @@ static int do_umount(struct vfsmount *mn
- if (!(sb->s_flags & MS_RDONLY))
- retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
- up_write(&sb->s_umount);
-+
-+ gr_log_remount(mnt->mnt_devname, retval);
-+
- return retval;
- }
-
-@@ -1104,6 +1107,9 @@ static int do_umount(struct vfsmount *mn
- security_sb_umount_busy(mnt);
- up_write(&namespace_sem);
- release_mounts(&umount_list);
-+
-+ gr_log_unmount(mnt->mnt_devname, retval);
-+
- return retval;
- }
-
-@@ -1962,6 +1968,16 @@ long do_mount(char *dev_name, char *dir_
- if (retval)
- goto dput_out;
-
-+ if (gr_handle_rofs_mount(path.dentry, path.mnt, mnt_flags)) {
-+ retval = -EPERM;
-+ goto dput_out;
-+ }
-+
-+ if (gr_handle_chroot_mount(path.dentry, path.mnt, dev_name)) {
-+ retval = -EPERM;
-+ goto dput_out;
-+ }
-+
- if (flags & MS_REMOUNT)
- retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
- data_page);
-@@ -1976,6 +1992,9 @@ long do_mount(char *dev_name, char *dir_
- dev_name, data_page);
- dput_out:
- path_put(&path);
-+
-+ gr_log_mount(dev_name, dir_name, retval);
-+
- return retval;
- }
-
-@@ -2182,6 +2201,12 @@ SYSCALL_DEFINE2(pivot_root, const char _
- goto out1;
- }
-
-+ if (gr_handle_chroot_pivot()) {
-+ error = -EPERM;
-+ path_put(&old);
-+ goto out1;
-+ }
-+
- read_lock(¤t->fs->lock);
- root = current->fs->root;
- path_get(¤t->fs->root);
-diff -urNp linux-2.6.32.45/fs/ncpfs/dir.c linux-2.6.32.45/fs/ncpfs/dir.c
---- linux-2.6.32.45/fs/ncpfs/dir.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/ncpfs/dir.c 2011-05-16 21:46:57.000000000 -0400
-@@ -275,6 +275,8 @@ __ncp_lookup_validate(struct dentry *den
- int res, val = 0, len;
- __u8 __name[NCP_MAXPATHLEN + 1];
-
-+ pax_track_stack();
-+
- parent = dget_parent(dentry);
- dir = parent->d_inode;
-
-@@ -799,6 +801,8 @@ static struct dentry *ncp_lookup(struct
- int error, res, len;
- __u8 __name[NCP_MAXPATHLEN + 1];
-
-+ pax_track_stack();
-+
- lock_kernel();
- error = -EIO;
- if (!ncp_conn_valid(server))
-@@ -883,10 +887,12 @@ int ncp_create_new(struct inode *dir, st
- int error, result, len;
- int opmode;
- __u8 __name[NCP_MAXPATHLEN + 1];
--
-+
- PPRINTK("ncp_create_new: creating %s/%s, mode=%x\n",
- dentry->d_parent->d_name.name, dentry->d_name.name, mode);
-
-+ pax_track_stack();
-+
- error = -EIO;
- lock_kernel();
- if (!ncp_conn_valid(server))
-@@ -952,6 +958,8 @@ static int ncp_mkdir(struct inode *dir,
- int error, len;
- __u8 __name[NCP_MAXPATHLEN + 1];
-
-+ pax_track_stack();
-+
- DPRINTK("ncp_mkdir: making %s/%s\n",
- dentry->d_parent->d_name.name, dentry->d_name.name);
-
-@@ -960,6 +968,8 @@ static int ncp_mkdir(struct inode *dir,
- if (!ncp_conn_valid(server))
- goto out;
-
-+ pax_track_stack();
-+
- ncp_age_dentry(server, dentry);
- len = sizeof(__name);
- error = ncp_io2vol(server, __name, &len, dentry->d_name.name,
-@@ -1114,6 +1124,8 @@ static int ncp_rename(struct inode *old_
- int old_len, new_len;
- __u8 __old_name[NCP_MAXPATHLEN + 1], __new_name[NCP_MAXPATHLEN + 1];
-
-+ pax_track_stack();
-+
- DPRINTK("ncp_rename: %s/%s to %s/%s\n",
- old_dentry->d_parent->d_name.name, old_dentry->d_name.name,
- new_dentry->d_parent->d_name.name, new_dentry->d_name.name);
-diff -urNp linux-2.6.32.45/fs/ncpfs/inode.c linux-2.6.32.45/fs/ncpfs/inode.c
---- linux-2.6.32.45/fs/ncpfs/inode.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/ncpfs/inode.c 2011-05-16 21:46:57.000000000 -0400
-@@ -445,6 +445,8 @@ static int ncp_fill_super(struct super_b
- #endif
- struct ncp_entry_info finfo;
-
-+ pax_track_stack();
-+
- data.wdog_pid = NULL;
- server = kzalloc(sizeof(struct ncp_server), GFP_KERNEL);
- if (!server)
-diff -urNp linux-2.6.32.45/fs/nfs/inode.c linux-2.6.32.45/fs/nfs/inode.c
---- linux-2.6.32.45/fs/nfs/inode.c 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.45/fs/nfs/inode.c 2011-07-06 19:53:33.000000000 -0400
-@@ -156,7 +156,7 @@ static void nfs_zap_caches_locked(struct
- nfsi->attrtimeo = NFS_MINATTRTIMEO(inode);
- nfsi->attrtimeo_timestamp = jiffies;
-
-- memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_COOKIEVERF(inode)));
-+ memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_I(inode)->cookieverf));
- if (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))
- nfsi->cache_validity |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL|NFS_INO_REVAL_PAGECACHE;
- else
-@@ -973,16 +973,16 @@ static int nfs_size_need_update(const st
- return nfs_size_to_loff_t(fattr->size) > i_size_read(inode);
- }
-
--static atomic_long_t nfs_attr_generation_counter;
-+static atomic_long_unchecked_t nfs_attr_generation_counter;
-
- static unsigned long nfs_read_attr_generation_counter(void)
- {
-- return atomic_long_read(&nfs_attr_generation_counter);
-+ return atomic_long_read_unchecked(&nfs_attr_generation_counter);
- }
-
- unsigned long nfs_inc_attr_generation_counter(void)
- {
-- return atomic_long_inc_return(&nfs_attr_generation_counter);
-+ return atomic_long_inc_return_unchecked(&nfs_attr_generation_counter);
- }
-
- void nfs_fattr_init(struct nfs_fattr *fattr)
-diff -urNp linux-2.6.32.45/fs/nfsd/lockd.c linux-2.6.32.45/fs/nfsd/lockd.c
---- linux-2.6.32.45/fs/nfsd/lockd.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.45/fs/nfsd/lockd.c 2011-04-17 17:03:15.000000000 -0400
-@@ -66,7 +66,7 @@ nlm_fclose(struct file *filp)
- fput(filp);
- }
-
--static struct nlmsvc_binding nfsd_nlm_ops = {
-+static const struct nlmsvc_binding nfsd_nlm_ops = {
- .fopen = nlm_fopen, /* open file for locking */
- .fclose = nlm_fclose, /* close file */
- };
-diff -urNp linux-2.6.32.45/fs/nfsd/nfs4state.c linux-2.6.32.45/fs/nfsd/nfs4state.c
---- linux-2.6.32.45/fs/nfsd/nfs4state.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/nfsd/nfs4state.c 2011-05-16 21:46:57.000000000 -0400
-@@ -3457,6 +3457,8 @@ nfsd4_lock(struct svc_rqst *rqstp, struc
- unsigned int cmd;
- int err;
-
-+ pax_track_stack();
-+
- dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n",
- (long long) lock->lk_offset,
- (long long) lock->lk_length);
-diff -urNp linux-2.6.32.45/fs/nfsd/nfs4xdr.c linux-2.6.32.45/fs/nfsd/nfs4xdr.c
---- linux-2.6.32.45/fs/nfsd/nfs4xdr.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/nfsd/nfs4xdr.c 2011-05-16 21:46:57.000000000 -0400
-@@ -1751,6 +1751,8 @@ nfsd4_encode_fattr(struct svc_fh *fhp, s
- struct nfsd4_compoundres *resp = rqstp->rq_resp;
- u32 minorversion = resp->cstate.minorversion;
-
-+ pax_track_stack();
-+
- BUG_ON(bmval1 & NFSD_WRITEONLY_ATTRS_WORD1);
- BUG_ON(bmval0 & ~nfsd_suppattrs0(minorversion));
- BUG_ON(bmval1 & ~nfsd_suppattrs1(minorversion));
-diff -urNp linux-2.6.32.45/fs/nfsd/vfs.c linux-2.6.32.45/fs/nfsd/vfs.c
---- linux-2.6.32.45/fs/nfsd/vfs.c 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.45/fs/nfsd/vfs.c 2011-05-10 22:12:33.000000000 -0400
-@@ -937,7 +937,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, st
- } else {
- oldfs = get_fs();
- set_fs(KERNEL_DS);
-- host_err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset);
-+ host_err = vfs_readv(file, (__force struct iovec __user *)vec, vlen, &offset);
- set_fs(oldfs);
- }
-
-@@ -1060,7 +1060,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s
-
- /* Write the data. */
- oldfs = get_fs(); set_fs(KERNEL_DS);
-- host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
-+ host_err = vfs_writev(file, (__force struct iovec __user *)vec, vlen, &offset);
- set_fs(oldfs);
- if (host_err < 0)
- goto out_nfserr;
-@@ -1542,7 +1542,7 @@ nfsd_readlink(struct svc_rqst *rqstp, st
- */
-
- oldfs = get_fs(); set_fs(KERNEL_DS);
-- host_err = inode->i_op->readlink(dentry, buf, *lenp);
-+ host_err = inode->i_op->readlink(dentry, (__force char __user *)buf, *lenp);
- set_fs(oldfs);
-
- if (host_err < 0)
-diff -urNp linux-2.6.32.45/fs/nilfs2/ioctl.c linux-2.6.32.45/fs/nilfs2/ioctl.c
---- linux-2.6.32.45/fs/nilfs2/ioctl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/nilfs2/ioctl.c 2011-05-04 17:56:28.000000000 -0400
-@@ -480,7 +480,7 @@ static int nilfs_ioctl_clean_segments(st
- unsigned int cmd, void __user *argp)
- {
- struct nilfs_argv argv[5];
-- const static size_t argsz[5] = {
-+ static const size_t argsz[5] = {
- sizeof(struct nilfs_vdesc),
- sizeof(struct nilfs_period),
- sizeof(__u64),
-diff -urNp linux-2.6.32.45/fs/notify/dnotify/dnotify.c linux-2.6.32.45/fs/notify/dnotify/dnotify.c
---- linux-2.6.32.45/fs/notify/dnotify/dnotify.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/notify/dnotify/dnotify.c 2011-04-17 15:56:46.000000000 -0400
-@@ -173,7 +173,7 @@ static void dnotify_free_mark(struct fsn
- kmem_cache_free(dnotify_mark_entry_cache, dnentry);
- }
-
--static struct fsnotify_ops dnotify_fsnotify_ops = {
-+static const struct fsnotify_ops dnotify_fsnotify_ops = {
- .handle_event = dnotify_handle_event,
- .should_send_event = dnotify_should_send_event,
- .free_group_priv = NULL,
-diff -urNp linux-2.6.32.45/fs/notify/notification.c linux-2.6.32.45/fs/notify/notification.c
---- linux-2.6.32.45/fs/notify/notification.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/notify/notification.c 2011-05-04 17:56:28.000000000 -0400
-@@ -57,7 +57,7 @@ static struct kmem_cache *fsnotify_event
- * get set to 0 so it will never get 'freed'
- */
- static struct fsnotify_event q_overflow_event;
--static atomic_t fsnotify_sync_cookie = ATOMIC_INIT(0);
-+static atomic_unchecked_t fsnotify_sync_cookie = ATOMIC_INIT(0);
-
- /**
- * fsnotify_get_cookie - return a unique cookie for use in synchronizing events.
-@@ -65,7 +65,7 @@ static atomic_t fsnotify_sync_cookie = A
- */
- u32 fsnotify_get_cookie(void)
- {
-- return atomic_inc_return(&fsnotify_sync_cookie);
-+ return atomic_inc_return_unchecked(&fsnotify_sync_cookie);
- }
- EXPORT_SYMBOL_GPL(fsnotify_get_cookie);
-
-diff -urNp linux-2.6.32.45/fs/ntfs/dir.c linux-2.6.32.45/fs/ntfs/dir.c
---- linux-2.6.32.45/fs/ntfs/dir.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/ntfs/dir.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1328,7 +1328,7 @@ find_next_index_buffer:
- ia = (INDEX_ALLOCATION*)(kaddr + (ia_pos & ~PAGE_CACHE_MASK &
- ~(s64)(ndir->itype.index.block_size - 1)));
- /* Bounds checks. */
-- if (unlikely((u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
-+ if (unlikely(!kaddr || (u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
- ntfs_error(sb, "Out of bounds check failed. Corrupt directory "
- "inode 0x%lx or driver bug.", vdir->i_ino);
- goto err_out;
-diff -urNp linux-2.6.32.45/fs/ntfs/file.c linux-2.6.32.45/fs/ntfs/file.c
---- linux-2.6.32.45/fs/ntfs/file.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/ntfs/file.c 2011-04-17 15:56:46.000000000 -0400
-@@ -2243,6 +2243,6 @@ const struct inode_operations ntfs_file_
- #endif /* NTFS_RW */
- };
-
--const struct file_operations ntfs_empty_file_ops = {};
-+const struct file_operations ntfs_empty_file_ops __read_only;
-
--const struct inode_operations ntfs_empty_inode_ops = {};
-+const struct inode_operations ntfs_empty_inode_ops __read_only;
-diff -urNp linux-2.6.32.45/fs/ocfs2/cluster/masklog.c linux-2.6.32.45/fs/ocfs2/cluster/masklog.c
---- linux-2.6.32.45/fs/ocfs2/cluster/masklog.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/ocfs2/cluster/masklog.c 2011-04-17 15:56:46.000000000 -0400
-@@ -135,7 +135,7 @@ static ssize_t mlog_store(struct kobject
- return mlog_mask_store(mlog_attr->mask, buf, count);
- }
-
--static struct sysfs_ops mlog_attr_ops = {
-+static const struct sysfs_ops mlog_attr_ops = {
- .show = mlog_show,
- .store = mlog_store,
- };
-diff -urNp linux-2.6.32.45/fs/ocfs2/localalloc.c linux-2.6.32.45/fs/ocfs2/localalloc.c
---- linux-2.6.32.45/fs/ocfs2/localalloc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/ocfs2/localalloc.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1188,7 +1188,7 @@ static int ocfs2_local_alloc_slide_windo
- goto bail;
- }
-
-- atomic_inc(&osb->alloc_stats.moves);
-+ atomic_inc_unchecked(&osb->alloc_stats.moves);
-
- status = 0;
- bail:
-diff -urNp linux-2.6.32.45/fs/ocfs2/namei.c linux-2.6.32.45/fs/ocfs2/namei.c
---- linux-2.6.32.45/fs/ocfs2/namei.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/ocfs2/namei.c 2011-05-16 21:46:57.000000000 -0400
-@@ -1043,6 +1043,8 @@ static int ocfs2_rename(struct inode *ol
- struct ocfs2_dir_lookup_result orphan_insert = { NULL, };
- struct ocfs2_dir_lookup_result target_insert = { NULL, };
-
-+ pax_track_stack();
-+
- /* At some point it might be nice to break this function up a
- * bit. */
-
-diff -urNp linux-2.6.32.45/fs/ocfs2/ocfs2.h linux-2.6.32.45/fs/ocfs2/ocfs2.h
---- linux-2.6.32.45/fs/ocfs2/ocfs2.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/ocfs2/ocfs2.h 2011-04-17 15:56:46.000000000 -0400
-@@ -217,11 +217,11 @@ enum ocfs2_vol_state
-
- struct ocfs2_alloc_stats
- {
-- atomic_t moves;
-- atomic_t local_data;
-- atomic_t bitmap_data;
-- atomic_t bg_allocs;
-- atomic_t bg_extends;
-+ atomic_unchecked_t moves;
-+ atomic_unchecked_t local_data;
-+ atomic_unchecked_t bitmap_data;
-+ atomic_unchecked_t bg_allocs;
-+ atomic_unchecked_t bg_extends;
- };
-
- enum ocfs2_local_alloc_state
-diff -urNp linux-2.6.32.45/fs/ocfs2/suballoc.c linux-2.6.32.45/fs/ocfs2/suballoc.c
---- linux-2.6.32.45/fs/ocfs2/suballoc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/ocfs2/suballoc.c 2011-04-17 15:56:46.000000000 -0400
-@@ -623,7 +623,7 @@ static int ocfs2_reserve_suballoc_bits(s
- mlog_errno(status);
- goto bail;
- }
-- atomic_inc(&osb->alloc_stats.bg_extends);
-+ atomic_inc_unchecked(&osb->alloc_stats.bg_extends);
-
- /* You should never ask for this much metadata */
- BUG_ON(bits_wanted >
-@@ -1654,7 +1654,7 @@ int ocfs2_claim_metadata(struct ocfs2_su
- mlog_errno(status);
- goto bail;
- }
-- atomic_inc(&osb->alloc_stats.bg_allocs);
-+ atomic_inc_unchecked(&osb->alloc_stats.bg_allocs);
-
- *blkno_start = bg_blkno + (u64) *suballoc_bit_start;
- ac->ac_bits_given += (*num_bits);
-@@ -1728,7 +1728,7 @@ int ocfs2_claim_new_inode(struct ocfs2_s
- mlog_errno(status);
- goto bail;
- }
-- atomic_inc(&osb->alloc_stats.bg_allocs);
-+ atomic_inc_unchecked(&osb->alloc_stats.bg_allocs);
-
- BUG_ON(num_bits != 1);
-
-@@ -1830,7 +1830,7 @@ int __ocfs2_claim_clusters(struct ocfs2_
- cluster_start,
- num_clusters);
- if (!status)
-- atomic_inc(&osb->alloc_stats.local_data);
-+ atomic_inc_unchecked(&osb->alloc_stats.local_data);
- } else {
- if (min_clusters > (osb->bitmap_cpg - 1)) {
- /* The only paths asking for contiguousness
-@@ -1858,7 +1858,7 @@ int __ocfs2_claim_clusters(struct ocfs2_
- ocfs2_desc_bitmap_to_cluster_off(ac->ac_inode,
- bg_blkno,
- bg_bit_off);
-- atomic_inc(&osb->alloc_stats.bitmap_data);
-+ atomic_inc_unchecked(&osb->alloc_stats.bitmap_data);
- }
- }
- if (status < 0) {
-diff -urNp linux-2.6.32.45/fs/ocfs2/super.c linux-2.6.32.45/fs/ocfs2/super.c
---- linux-2.6.32.45/fs/ocfs2/super.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/ocfs2/super.c 2011-04-17 15:56:46.000000000 -0400
-@@ -284,11 +284,11 @@ static int ocfs2_osb_dump(struct ocfs2_s
- "%10s => GlobalAllocs: %d LocalAllocs: %d "
- "SubAllocs: %d LAWinMoves: %d SAExtends: %d\n",
- "Stats",
-- atomic_read(&osb->alloc_stats.bitmap_data),
-- atomic_read(&osb->alloc_stats.local_data),
-- atomic_read(&osb->alloc_stats.bg_allocs),
-- atomic_read(&osb->alloc_stats.moves),
-- atomic_read(&osb->alloc_stats.bg_extends));
-+ atomic_read_unchecked(&osb->alloc_stats.bitmap_data),
-+ atomic_read_unchecked(&osb->alloc_stats.local_data),
-+ atomic_read_unchecked(&osb->alloc_stats.bg_allocs),
-+ atomic_read_unchecked(&osb->alloc_stats.moves),
-+ atomic_read_unchecked(&osb->alloc_stats.bg_extends));
-
- out += snprintf(buf + out, len - out,
- "%10s => State: %u Descriptor: %llu Size: %u bits "
-@@ -2002,11 +2002,11 @@ static int ocfs2_initialize_super(struct
- spin_lock_init(&osb->osb_xattr_lock);
- ocfs2_init_inode_steal_slot(osb);
-
-- atomic_set(&osb->alloc_stats.moves, 0);
-- atomic_set(&osb->alloc_stats.local_data, 0);
-- atomic_set(&osb->alloc_stats.bitmap_data, 0);
-- atomic_set(&osb->alloc_stats.bg_allocs, 0);
-- atomic_set(&osb->alloc_stats.bg_extends, 0);
-+ atomic_set_unchecked(&osb->alloc_stats.moves, 0);
-+ atomic_set_unchecked(&osb->alloc_stats.local_data, 0);
-+ atomic_set_unchecked(&osb->alloc_stats.bitmap_data, 0);
-+ atomic_set_unchecked(&osb->alloc_stats.bg_allocs, 0);
-+ atomic_set_unchecked(&osb->alloc_stats.bg_extends, 0);
-
- /* Copy the blockcheck stats from the superblock probe */
- osb->osb_ecc_stats = *stats;
-diff -urNp linux-2.6.32.45/fs/open.c linux-2.6.32.45/fs/open.c
---- linux-2.6.32.45/fs/open.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/open.c 2011-04-17 15:56:46.000000000 -0400
-@@ -275,6 +275,10 @@ static long do_sys_truncate(const char _
- error = locks_verify_truncate(inode, NULL, length);
- if (!error)
- error = security_path_truncate(&path, length, 0);
-+
-+ if (!error && !gr_acl_handle_truncate(path.dentry, path.mnt))
-+ error = -EACCES;
-+
- if (!error) {
- vfs_dq_init(inode);
- error = do_truncate(path.dentry, length, 0, NULL);
-@@ -511,6 +515,9 @@ SYSCALL_DEFINE3(faccessat, int, dfd, con
- if (__mnt_is_readonly(path.mnt))
- res = -EROFS;
-
-+ if (!res && !gr_acl_handle_access(path.dentry, path.mnt, mode))
-+ res = -EACCES;
-+
- out_path_release:
- path_put(&path);
- out:
-@@ -537,6 +544,8 @@ SYSCALL_DEFINE1(chdir, const char __user
- if (error)
- goto dput_and_out;
-
-+ gr_log_chdir(path.dentry, path.mnt);
-+
- set_fs_pwd(current->fs, &path);
-
- dput_and_out:
-@@ -563,6 +572,13 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd
- goto out_putf;
-
- error = inode_permission(inode, MAY_EXEC | MAY_ACCESS);
-+
-+ if (!error && !gr_chroot_fchdir(file->f_path.dentry, file->f_path.mnt))
-+ error = -EPERM;
-+
-+ if (!error)
-+ gr_log_chdir(file->f_path.dentry, file->f_path.mnt);
-+
- if (!error)
- set_fs_pwd(current->fs, &file->f_path);
- out_putf:
-@@ -588,7 +604,18 @@ SYSCALL_DEFINE1(chroot, const char __use
- if (!capable(CAP_SYS_CHROOT))
- goto dput_and_out;
-
-+ if (gr_handle_chroot_chroot(path.dentry, path.mnt))
-+ goto dput_and_out;
-+
-+ if (gr_handle_chroot_caps(&path)) {
-+ error = -ENOMEM;
-+ goto dput_and_out;
-+ }
-+
- set_fs_root(current->fs, &path);
-+
-+ gr_handle_chroot_chdir(&path);
-+
- error = 0;
- dput_and_out:
- path_put(&path);
-@@ -616,12 +643,27 @@ SYSCALL_DEFINE2(fchmod, unsigned int, fd
- err = mnt_want_write_file(file);
- if (err)
- goto out_putf;
-+
- mutex_lock(&inode->i_mutex);
-+
-+ if (!gr_acl_handle_fchmod(dentry, file->f_path.mnt, mode)) {
-+ err = -EACCES;
-+ goto out_unlock;
-+ }
-+
- if (mode == (mode_t) -1)
- mode = inode->i_mode;
-+
-+ if (gr_handle_chroot_chmod(dentry, file->f_path.mnt, mode)) {
-+ err = -EPERM;
-+ goto out_unlock;
-+ }
-+
- newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
- newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
- err = notify_change(dentry, &newattrs);
-+
-+out_unlock:
- mutex_unlock(&inode->i_mutex);
- mnt_drop_write(file->f_path.mnt);
- out_putf:
-@@ -645,12 +687,27 @@ SYSCALL_DEFINE3(fchmodat, int, dfd, cons
- error = mnt_want_write(path.mnt);
- if (error)
- goto dput_and_out;
-+
- mutex_lock(&inode->i_mutex);
-+
-+ if (!gr_acl_handle_chmod(path.dentry, path.mnt, mode)) {
-+ error = -EACCES;
-+ goto out_unlock;
-+ }
-+
- if (mode == (mode_t) -1)
- mode = inode->i_mode;
-+
-+ if (gr_handle_chroot_chmod(path.dentry, path.mnt, mode)) {
-+ error = -EACCES;
-+ goto out_unlock;
-+ }
-+
- newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
- newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
- error = notify_change(path.dentry, &newattrs);
-+
-+out_unlock:
- mutex_unlock(&inode->i_mutex);
- mnt_drop_write(path.mnt);
- dput_and_out:
-@@ -664,12 +721,15 @@ SYSCALL_DEFINE2(chmod, const char __user
- return sys_fchmodat(AT_FDCWD, filename, mode);
- }
-
--static int chown_common(struct dentry * dentry, uid_t user, gid_t group)
-+static int chown_common(struct dentry * dentry, uid_t user, gid_t group, struct vfsmount *mnt)
- {
- struct inode *inode = dentry->d_inode;
- int error;
- struct iattr newattrs;
-
-+ if (!gr_acl_handle_chown(dentry, mnt))
-+ return -EACCES;
-+
- newattrs.ia_valid = ATTR_CTIME;
- if (user != (uid_t) -1) {
- newattrs.ia_valid |= ATTR_UID;
-@@ -700,7 +760,7 @@ SYSCALL_DEFINE3(chown, const char __user
- error = mnt_want_write(path.mnt);
- if (error)
- goto out_release;
-- error = chown_common(path.dentry, user, group);
-+ error = chown_common(path.dentry, user, group, path.mnt);
- mnt_drop_write(path.mnt);
- out_release:
- path_put(&path);
-@@ -725,7 +785,7 @@ SYSCALL_DEFINE5(fchownat, int, dfd, cons
- error = mnt_want_write(path.mnt);
- if (error)
- goto out_release;
-- error = chown_common(path.dentry, user, group);
-+ error = chown_common(path.dentry, user, group, path.mnt);
- mnt_drop_write(path.mnt);
- out_release:
- path_put(&path);
-@@ -744,7 +804,7 @@ SYSCALL_DEFINE3(lchown, const char __use
- error = mnt_want_write(path.mnt);
- if (error)
- goto out_release;
-- error = chown_common(path.dentry, user, group);
-+ error = chown_common(path.dentry, user, group, path.mnt);
- mnt_drop_write(path.mnt);
- out_release:
- path_put(&path);
-@@ -767,7 +827,7 @@ SYSCALL_DEFINE3(fchown, unsigned int, fd
- goto out_fput;
- dentry = file->f_path.dentry;
- audit_inode(NULL, dentry);
-- error = chown_common(dentry, user, group);
-+ error = chown_common(dentry, user, group, file->f_path.mnt);
- mnt_drop_write(file->f_path.mnt);
- out_fput:
- fput(file);
-@@ -1036,7 +1096,10 @@ long do_sys_open(int dfd, const char __u
- if (!IS_ERR(tmp)) {
- fd = get_unused_fd_flags(flags);
- if (fd >= 0) {
-- struct file *f = do_filp_open(dfd, tmp, flags, mode, 0);
-+ struct file *f;
-+ /* don't allow to be set by userland */
-+ flags &= ~FMODE_GREXEC;
-+ f = do_filp_open(dfd, tmp, flags, mode, 0);
- if (IS_ERR(f)) {
- put_unused_fd(fd);
- fd = PTR_ERR(f);
-diff -urNp linux-2.6.32.45/fs/partitions/ldm.c linux-2.6.32.45/fs/partitions/ldm.c
---- linux-2.6.32.45/fs/partitions/ldm.c 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.45/fs/partitions/ldm.c 2011-06-25 12:56:37.000000000 -0400
-@@ -1311,6 +1311,7 @@ static bool ldm_frag_add (const u8 *data
- ldm_error ("A VBLK claims to have %d parts.", num);
- return false;
- }
-+
- if (rec >= num) {
- ldm_error("REC value (%d) exceeds NUM value (%d)", rec, num);
- return false;
-@@ -1322,7 +1323,7 @@ static bool ldm_frag_add (const u8 *data
- goto found;
- }
-
-- f = kmalloc (sizeof (*f) + size*num, GFP_KERNEL);
-+ f = kmalloc (size*num + sizeof (*f), GFP_KERNEL);
- if (!f) {
- ldm_crit ("Out of memory.");
- return false;
-diff -urNp linux-2.6.32.45/fs/partitions/mac.c linux-2.6.32.45/fs/partitions/mac.c
---- linux-2.6.32.45/fs/partitions/mac.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/partitions/mac.c 2011-04-17 15:56:46.000000000 -0400
-@@ -59,11 +59,11 @@ int mac_partition(struct parsed_partitio
- return 0; /* not a MacOS disk */
- }
- blocks_in_map = be32_to_cpu(part->map_count);
-+ printk(" [mac]");
- if (blocks_in_map < 0 || blocks_in_map >= DISK_MAX_PARTS) {
- put_dev_sector(sect);
- return 0;
- }
-- printk(" [mac]");
- for (slot = 1; slot <= blocks_in_map; ++slot) {
- int pos = slot * secsize;
- put_dev_sector(sect);
-diff -urNp linux-2.6.32.45/fs/pipe.c linux-2.6.32.45/fs/pipe.c
---- linux-2.6.32.45/fs/pipe.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/pipe.c 2011-04-23 13:37:17.000000000 -0400
-@@ -401,9 +401,9 @@ redo:
- }
- if (bufs) /* More to do? */
- continue;
-- if (!pipe->writers)
-+ if (!atomic_read(&pipe->writers))
- break;
-- if (!pipe->waiting_writers) {
-+ if (!atomic_read(&pipe->waiting_writers)) {
- /* syscall merging: Usually we must not sleep
- * if O_NONBLOCK is set, or if we got some data.
- * But if a writer sleeps in kernel space, then
-@@ -462,7 +462,7 @@ pipe_write(struct kiocb *iocb, const str
- mutex_lock(&inode->i_mutex);
- pipe = inode->i_pipe;
-
-- if (!pipe->readers) {
-+ if (!atomic_read(&pipe->readers)) {
- send_sig(SIGPIPE, current, 0);
- ret = -EPIPE;
- goto out;
-@@ -511,7 +511,7 @@ redo1:
- for (;;) {
- int bufs;
-
-- if (!pipe->readers) {
-+ if (!atomic_read(&pipe->readers)) {
- send_sig(SIGPIPE, current, 0);
- if (!ret)
- ret = -EPIPE;
-@@ -597,9 +597,9 @@ redo2:
- kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
- do_wakeup = 0;
- }
-- pipe->waiting_writers++;
-+ atomic_inc(&pipe->waiting_writers);
- pipe_wait(pipe);
-- pipe->waiting_writers--;
-+ atomic_dec(&pipe->waiting_writers);
- }
- out:
- mutex_unlock(&inode->i_mutex);
-@@ -666,7 +666,7 @@ pipe_poll(struct file *filp, poll_table
- mask = 0;
- if (filp->f_mode & FMODE_READ) {
- mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0;
-- if (!pipe->writers && filp->f_version != pipe->w_counter)
-+ if (!atomic_read(&pipe->writers) && filp->f_version != pipe->w_counter)
- mask |= POLLHUP;
- }
-
-@@ -676,7 +676,7 @@ pipe_poll(struct file *filp, poll_table
- * Most Unices do not set POLLERR for FIFOs but on Linux they
- * behave exactly like pipes for poll().
- */
-- if (!pipe->readers)
-+ if (!atomic_read(&pipe->readers))
- mask |= POLLERR;
- }
-
-@@ -690,10 +690,10 @@ pipe_release(struct inode *inode, int de
-
- mutex_lock(&inode->i_mutex);
- pipe = inode->i_pipe;
-- pipe->readers -= decr;
-- pipe->writers -= decw;
-+ atomic_sub(decr, &pipe->readers);
-+ atomic_sub(decw, &pipe->writers);
-
-- if (!pipe->readers && !pipe->writers) {
-+ if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers)) {
- free_pipe_info(inode);
- } else {
- wake_up_interruptible_sync(&pipe->wait);
-@@ -783,7 +783,7 @@ pipe_read_open(struct inode *inode, stru
-
- if (inode->i_pipe) {
- ret = 0;
-- inode->i_pipe->readers++;
-+ atomic_inc(&inode->i_pipe->readers);
- }
-
- mutex_unlock(&inode->i_mutex);
-@@ -800,7 +800,7 @@ pipe_write_open(struct inode *inode, str
-
- if (inode->i_pipe) {
- ret = 0;
-- inode->i_pipe->writers++;
-+ atomic_inc(&inode->i_pipe->writers);
- }
-
- mutex_unlock(&inode->i_mutex);
-@@ -818,9 +818,9 @@ pipe_rdwr_open(struct inode *inode, stru
- if (inode->i_pipe) {
- ret = 0;
- if (filp->f_mode & FMODE_READ)
-- inode->i_pipe->readers++;
-+ atomic_inc(&inode->i_pipe->readers);
- if (filp->f_mode & FMODE_WRITE)
-- inode->i_pipe->writers++;
-+ atomic_inc(&inode->i_pipe->writers);
- }
-
- mutex_unlock(&inode->i_mutex);
-@@ -905,7 +905,7 @@ void free_pipe_info(struct inode *inode)
- inode->i_pipe = NULL;
- }
-
--static struct vfsmount *pipe_mnt __read_mostly;
-+struct vfsmount *pipe_mnt __read_mostly;
- static int pipefs_delete_dentry(struct dentry *dentry)
- {
- /*
-@@ -945,7 +945,8 @@ static struct inode * get_pipe_inode(voi
- goto fail_iput;
- inode->i_pipe = pipe;
-
-- pipe->readers = pipe->writers = 1;
-+ atomic_set(&pipe->readers, 1);
-+ atomic_set(&pipe->writers, 1);
- inode->i_fop = &rdwr_pipefifo_fops;
-
- /*
-diff -urNp linux-2.6.32.45/fs/proc/array.c linux-2.6.32.45/fs/proc/array.c
---- linux-2.6.32.45/fs/proc/array.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/proc/array.c 2011-05-16 21:46:57.000000000 -0400
-@@ -60,6 +60,7 @@
- #include <linux/tty.h>
- #include <linux/string.h>
- #include <linux/mman.h>
-+#include <linux/grsecurity.h>
- #include <linux/proc_fs.h>
- #include <linux/ioport.h>
- #include <linux/uaccess.h>
-@@ -321,6 +322,21 @@ static inline void task_context_switch_c
- p->nivcsw);
- }
-
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+static inline void task_pax(struct seq_file *m, struct task_struct *p)
-+{
-+ if (p->mm)
-+ seq_printf(m, "PaX:\t%c%c%c%c%c\n",
-+ p->mm->pax_flags & MF_PAX_PAGEEXEC ? 'P' : 'p',
-+ p->mm->pax_flags & MF_PAX_EMUTRAMP ? 'E' : 'e',
-+ p->mm->pax_flags & MF_PAX_MPROTECT ? 'M' : 'm',
-+ p->mm->pax_flags & MF_PAX_RANDMMAP ? 'R' : 'r',
-+ p->mm->pax_flags & MF_PAX_SEGMEXEC ? 'S' : 's');
-+ else
-+ seq_printf(m, "PaX:\t-----\n");
-+}
-+#endif
-+
- int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
- struct pid *pid, struct task_struct *task)
- {
-@@ -337,9 +353,24 @@ int proc_pid_status(struct seq_file *m,
- task_cap(m, task);
- cpuset_task_status_allowed(m, task);
- task_context_switch_counts(m, task);
-+
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+ task_pax(m, task);
-+#endif
-+
-+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
-+ task_grsec_rbac(m, task);
-+#endif
-+
- return 0;
- }
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
-+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
-+ _mm->pax_flags & MF_PAX_SEGMEXEC))
-+#endif
-+
- static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
- struct pid *pid, struct task_struct *task, int whole)
- {
-@@ -358,9 +389,11 @@ static int do_task_stat(struct seq_file
- cputime_t cutime, cstime, utime, stime;
- cputime_t cgtime, gtime;
- unsigned long rsslim = 0;
-- char tcomm[sizeof(task->comm)];
-+ char tcomm[sizeof(task->comm)] = { 0 };
- unsigned long flags;
-
-+ pax_track_stack();
-+
- state = *get_task_state(task);
- vsize = eip = esp = 0;
- permitted = ptrace_may_access(task, PTRACE_MODE_READ);
-@@ -433,6 +466,19 @@ static int do_task_stat(struct seq_file
- gtime = task_gtime(task);
- }
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ if (PAX_RAND_FLAGS(mm)) {
-+ eip = 0;
-+ esp = 0;
-+ wchan = 0;
-+ }
-+#endif
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ wchan = 0;
-+ eip =0;
-+ esp =0;
-+#endif
-+
- /* scale priority and nice values from timeslices to -20..20 */
- /* to make it look like a "normal" Unix priority/nice value */
- priority = task_prio(task);
-@@ -473,9 +519,15 @@ static int do_task_stat(struct seq_file
- vsize,
- mm ? get_mm_rss(mm) : 0,
- rsslim,
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->start_code : 1) : 0),
-+ PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->end_code : 1) : 0),
-+ PAX_RAND_FLAGS(mm) ? 0 : ((permitted && mm) ? mm->start_stack : 0),
-+#else
- mm ? (permitted ? mm->start_code : 1) : 0,
- mm ? (permitted ? mm->end_code : 1) : 0,
- (permitted && mm) ? mm->start_stack : 0,
-+#endif
- esp,
- eip,
- /* The signal information here is obsolete.
-@@ -528,3 +580,18 @@ int proc_pid_statm(struct seq_file *m, s
-
- return 0;
- }
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
-+int proc_pid_ipaddr(struct task_struct *task, char *buffer)
-+{
-+ u32 curr_ip = 0;
-+ unsigned long flags;
-+
-+ if (lock_task_sighand(task, &flags)) {
-+ curr_ip = task->signal->curr_ip;
-+ unlock_task_sighand(task, &flags);
-+ }
-+
-+ return sprintf(buffer, "%pI4\n", &curr_ip);
-+}
-+#endif
-diff -urNp linux-2.6.32.45/fs/proc/base.c linux-2.6.32.45/fs/proc/base.c
---- linux-2.6.32.45/fs/proc/base.c 2011-08-09 18:35:30.000000000 -0400
-+++ linux-2.6.32.45/fs/proc/base.c 2011-08-09 18:34:33.000000000 -0400
-@@ -102,6 +102,22 @@ struct pid_entry {
- union proc_op op;
- };
-
-+struct getdents_callback {
-+ struct linux_dirent __user * current_dir;
-+ struct linux_dirent __user * previous;
-+ struct file * file;
-+ int count;
-+ int error;
-+};
-+
-+static int gr_fake_filldir(void * __buf, const char *name, int namlen,
-+ loff_t offset, u64 ino, unsigned int d_type)
-+{
-+ struct getdents_callback * buf = (struct getdents_callback *) __buf;
-+ buf->error = -EINVAL;
-+ return 0;
-+}
-+
- #define NOD(NAME, MODE, IOP, FOP, OP) { \
- .name = (NAME), \
- .len = sizeof(NAME) - 1, \
-@@ -213,6 +229,9 @@ static int check_mem_permission(struct t
- if (task == current)
- return 0;
-
-+ if (gr_handle_proc_ptrace(task) || gr_acl_handle_procpidmem(task))
-+ return -EPERM;
-+
- /*
- * If current is actively ptrace'ing, and would also be
- * permitted to freshly attach with ptrace now, permit it.
-@@ -260,6 +279,9 @@ static int proc_pid_cmdline(struct task_
- if (!mm->arg_end)
- goto out_mm; /* Shh! No looking before we're done */
-
-+ if (gr_acl_handle_procpidmem(task))
-+ goto out_mm;
-+
- len = mm->arg_end - mm->arg_start;
-
- if (len > PAGE_SIZE)
-@@ -287,12 +309,28 @@ out:
- return res;
- }
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
-+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
-+ _mm->pax_flags & MF_PAX_SEGMEXEC))
-+#endif
-+
- static int proc_pid_auxv(struct task_struct *task, char *buffer)
- {
- int res = 0;
- struct mm_struct *mm = get_task_mm(task);
- if (mm) {
- unsigned int nwords = 0;
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ /* allow if we're currently ptracing this task */
-+ if (PAX_RAND_FLAGS(mm) &&
-+ (!(task->ptrace & PT_PTRACED) || (task->parent != current))) {
-+ mmput(mm);
-+ return res;
-+ }
-+#endif
-+
- do {
- nwords += 2;
- } while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
-@@ -306,7 +344,7 @@ static int proc_pid_auxv(struct task_str
- }
-
-
--#ifdef CONFIG_KALLSYMS
-+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
- /*
- * Provides a wchan file via kallsyms in a proper one-value-per-file format.
- * Returns the resolved symbol. If that fails, simply return the address.
-@@ -328,7 +366,7 @@ static int proc_pid_wchan(struct task_st
- }
- #endif /* CONFIG_KALLSYMS */
-
--#ifdef CONFIG_STACKTRACE
-+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
-
- #define MAX_STACK_TRACE_DEPTH 64
-
-@@ -522,7 +560,7 @@ static int proc_pid_limits(struct task_s
- return count;
- }
-
--#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
-+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
- static int proc_pid_syscall(struct task_struct *task, char *buffer)
- {
- long nr;
-@@ -547,7 +585,7 @@ static int proc_pid_syscall(struct task_
- /************************************************************************/
-
- /* permission checks */
--static int proc_fd_access_allowed(struct inode *inode)
-+static int proc_fd_access_allowed(struct inode *inode, unsigned int log)
- {
- struct task_struct *task;
- int allowed = 0;
-@@ -557,7 +595,10 @@ static int proc_fd_access_allowed(struct
- */
- task = get_proc_task(inode);
- if (task) {
-- allowed = ptrace_may_access(task, PTRACE_MODE_READ);
-+ if (log)
-+ allowed = ptrace_may_access_log(task, PTRACE_MODE_READ);
-+ else
-+ allowed = ptrace_may_access(task, PTRACE_MODE_READ);
- put_task_struct(task);
- }
- return allowed;
-@@ -936,6 +977,9 @@ static ssize_t environ_read(struct file
- if (!task)
- goto out_no_task;
-
-+ if (gr_acl_handle_procpidmem(task))
-+ goto out;
-+
- if (!ptrace_may_access(task, PTRACE_MODE_READ))
- goto out;
-
-@@ -1350,7 +1394,7 @@ static void *proc_pid_follow_link(struct
- path_put(&nd->path);
-
- /* Are we allowed to snoop on the tasks file descriptors? */
-- if (!proc_fd_access_allowed(inode))
-+ if (!proc_fd_access_allowed(inode,0))
- goto out;
-
- error = PROC_I(inode)->op.proc_get_link(inode, &nd->path);
-@@ -1390,8 +1434,18 @@ static int proc_pid_readlink(struct dent
- struct path path;
-
- /* Are we allowed to snoop on the tasks file descriptors? */
-- if (!proc_fd_access_allowed(inode))
-- goto out;
-+ /* logging this is needed for learning on chromium to work properly,
-+ but we don't want to flood the logs from 'ps' which does a readlink
-+ on /proc/fd/2 of tasks in the listing, nor do we want 'ps' to learn
-+ CAP_SYS_PTRACE as it's not necessary for its basic functionality
-+ */
-+ if (dentry->d_name.name[0] == '2' && dentry->d_name.name[1] == '\0') {
-+ if (!proc_fd_access_allowed(inode,0))
-+ goto out;
-+ } else {
-+ if (!proc_fd_access_allowed(inode,1))
-+ goto out;
-+ }
-
- error = PROC_I(inode)->op.proc_get_link(inode, &path);
- if (error)
-@@ -1456,7 +1510,11 @@ static struct inode *proc_pid_make_inode
- rcu_read_lock();
- cred = __task_cred(task);
- inode->i_uid = cred->euid;
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
-+#else
- inode->i_gid = cred->egid;
-+#endif
- rcu_read_unlock();
- }
- security_task_to_inode(task, inode);
-@@ -1474,6 +1532,9 @@ static int pid_getattr(struct vfsmount *
- struct inode *inode = dentry->d_inode;
- struct task_struct *task;
- const struct cred *cred;
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ const struct cred *tmpcred = current_cred();
-+#endif
-
- generic_fillattr(inode, stat);
-
-@@ -1481,13 +1542,41 @@ static int pid_getattr(struct vfsmount *
- stat->uid = 0;
- stat->gid = 0;
- task = pid_task(proc_pid(inode), PIDTYPE_PID);
-+
-+ if (task && (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))) {
-+ rcu_read_unlock();
-+ return -ENOENT;
-+ }
-+
- if (task) {
-+ cred = __task_cred(task);
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ if (!tmpcred->uid || (tmpcred->uid == cred->uid)
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+ || in_group_p(CONFIG_GRKERNSEC_PROC_GID)
-+#endif
-+ ) {
-+#endif
- if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
-+#endif
- task_dumpable(task)) {
-- cred = __task_cred(task);
- stat->uid = cred->euid;
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+ stat->gid = CONFIG_GRKERNSEC_PROC_GID;
-+#else
- stat->gid = cred->egid;
-+#endif
- }
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ } else {
-+ rcu_read_unlock();
-+ return -ENOENT;
-+ }
-+#endif
- }
- rcu_read_unlock();
- return 0;
-@@ -1518,11 +1607,20 @@ static int pid_revalidate(struct dentry
-
- if (task) {
- if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
-+#endif
- task_dumpable(task)) {
- rcu_read_lock();
- cred = __task_cred(task);
- inode->i_uid = cred->euid;
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
-+#else
- inode->i_gid = cred->egid;
-+#endif
- rcu_read_unlock();
- } else {
- inode->i_uid = 0;
-@@ -1643,7 +1741,8 @@ static int proc_fd_info(struct inode *in
- int fd = proc_fd(inode);
-
- if (task) {
-- files = get_files_struct(task);
-+ if (!gr_acl_handle_procpidmem(task))
-+ files = get_files_struct(task);
- put_task_struct(task);
- }
- if (files) {
-@@ -1895,12 +1994,22 @@ static const struct file_operations proc
- static int proc_fd_permission(struct inode *inode, int mask)
- {
- int rv;
-+ struct task_struct *task;
-
- rv = generic_permission(inode, mask, NULL);
-- if (rv == 0)
-- return 0;
-+
- if (task_pid(current) == proc_pid(inode))
- rv = 0;
-+
-+ task = get_proc_task(inode);
-+ if (task == NULL)
-+ return rv;
-+
-+ if (gr_acl_handle_procpidmem(task))
-+ rv = -EACCES;
-+
-+ put_task_struct(task);
-+
- return rv;
- }
-
-@@ -2009,6 +2118,9 @@ static struct dentry *proc_pident_lookup
- if (!task)
- goto out_no_task;
-
-+ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
-+ goto out;
-+
- /*
- * Yes, it does not scale. And it should not. Don't add
- * new entries into /proc/<tgid>/ without very good reasons.
-@@ -2053,6 +2165,9 @@ static int proc_pident_readdir(struct fi
- if (!task)
- goto out_no_task;
-
-+ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
-+ goto out;
-+
- ret = 0;
- i = filp->f_pos;
- switch (i) {
-@@ -2320,7 +2435,7 @@ static void *proc_self_follow_link(struc
- static void proc_self_put_link(struct dentry *dentry, struct nameidata *nd,
- void *cookie)
- {
-- char *s = nd_get_link(nd);
-+ const char *s = nd_get_link(nd);
- if (!IS_ERR(s))
- __putname(s);
- }
-@@ -2522,7 +2637,7 @@ static const struct pid_entry tgid_base_
- #ifdef CONFIG_SCHED_DEBUG
- REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations),
- #endif
--#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
-+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
- INF("syscall", S_IRUSR, proc_pid_syscall),
- #endif
- INF("cmdline", S_IRUGO, proc_pid_cmdline),
-@@ -2547,10 +2662,10 @@ static const struct pid_entry tgid_base_
- #ifdef CONFIG_SECURITY
- DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
- #endif
--#ifdef CONFIG_KALLSYMS
-+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
- INF("wchan", S_IRUGO, proc_pid_wchan),
- #endif
--#ifdef CONFIG_STACKTRACE
-+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
- ONE("stack", S_IRUSR, proc_pid_stack),
- #endif
- #ifdef CONFIG_SCHEDSTATS
-@@ -2580,6 +2695,9 @@ static const struct pid_entry tgid_base_
- #ifdef CONFIG_TASK_IO_ACCOUNTING
- INF("io", S_IRUSR, proc_tgid_io_accounting),
- #endif
-+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
-+ INF("ipaddr", S_IRUSR, proc_pid_ipaddr),
-+#endif
- };
-
- static int proc_tgid_base_readdir(struct file * filp,
-@@ -2704,7 +2822,14 @@ static struct dentry *proc_pid_instantia
- if (!inode)
- goto out;
-
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+ inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
-+ inode->i_mode = S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP;
-+#else
- inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
-+#endif
- inode->i_op = &proc_tgid_base_inode_operations;
- inode->i_fop = &proc_tgid_base_operations;
- inode->i_flags|=S_IMMUTABLE;
-@@ -2746,7 +2871,11 @@ struct dentry *proc_pid_lookup(struct in
- if (!task)
- goto out;
-
-+ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
-+ goto out_put_task;
-+
- result = proc_pid_instantiate(dir, dentry, task, NULL);
-+out_put_task:
- put_task_struct(task);
- out:
- return result;
-@@ -2811,6 +2940,11 @@ int proc_pid_readdir(struct file * filp,
- {
- unsigned int nr;
- struct task_struct *reaper;
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ const struct cred *tmpcred = current_cred();
-+ const struct cred *itercred;
-+#endif
-+ filldir_t __filldir = filldir;
- struct tgid_iter iter;
- struct pid_namespace *ns;
-
-@@ -2834,8 +2968,27 @@ int proc_pid_readdir(struct file * filp,
- for (iter = next_tgid(ns, iter);
- iter.task;
- iter.tgid += 1, iter = next_tgid(ns, iter)) {
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ rcu_read_lock();
-+ itercred = __task_cred(iter.task);
-+#endif
-+ if (gr_pid_is_chrooted(iter.task) || gr_check_hidden_task(iter.task)
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ || (tmpcred->uid && (itercred->uid != tmpcred->uid)
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+ && !in_group_p(CONFIG_GRKERNSEC_PROC_GID)
-+#endif
-+ )
-+#endif
-+ )
-+ __filldir = &gr_fake_filldir;
-+ else
-+ __filldir = filldir;
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ rcu_read_unlock();
-+#endif
- filp->f_pos = iter.tgid + TGID_OFFSET;
-- if (proc_pid_fill_cache(filp, dirent, filldir, iter) < 0) {
-+ if (proc_pid_fill_cache(filp, dirent, __filldir, iter) < 0) {
- put_task_struct(iter.task);
- goto out;
- }
-@@ -2861,7 +3014,7 @@ static const struct pid_entry tid_base_s
- #ifdef CONFIG_SCHED_DEBUG
- REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations),
- #endif
--#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
-+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
- INF("syscall", S_IRUSR, proc_pid_syscall),
- #endif
- INF("cmdline", S_IRUGO, proc_pid_cmdline),
-@@ -2885,10 +3038,10 @@ static const struct pid_entry tid_base_s
- #ifdef CONFIG_SECURITY
- DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
- #endif
--#ifdef CONFIG_KALLSYMS
-+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
- INF("wchan", S_IRUGO, proc_pid_wchan),
- #endif
--#ifdef CONFIG_STACKTRACE
-+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
- ONE("stack", S_IRUSR, proc_pid_stack),
- #endif
- #ifdef CONFIG_SCHEDSTATS
-diff -urNp linux-2.6.32.45/fs/proc/cmdline.c linux-2.6.32.45/fs/proc/cmdline.c
---- linux-2.6.32.45/fs/proc/cmdline.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/proc/cmdline.c 2011-04-17 15:56:46.000000000 -0400
-@@ -23,7 +23,11 @@ static const struct file_operations cmdl
-
- static int __init proc_cmdline_init(void)
- {
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+ proc_create_grsec("cmdline", 0, NULL, &cmdline_proc_fops);
-+#else
- proc_create("cmdline", 0, NULL, &cmdline_proc_fops);
-+#endif
- return 0;
- }
- module_init(proc_cmdline_init);
-diff -urNp linux-2.6.32.45/fs/proc/devices.c linux-2.6.32.45/fs/proc/devices.c
---- linux-2.6.32.45/fs/proc/devices.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/proc/devices.c 2011-04-17 15:56:46.000000000 -0400
-@@ -64,7 +64,11 @@ static const struct file_operations proc
-
- static int __init proc_devices_init(void)
- {
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+ proc_create_grsec("devices", 0, NULL, &proc_devinfo_operations);
-+#else
- proc_create("devices", 0, NULL, &proc_devinfo_operations);
-+#endif
- return 0;
- }
- module_init(proc_devices_init);
-diff -urNp linux-2.6.32.45/fs/proc/inode.c linux-2.6.32.45/fs/proc/inode.c
---- linux-2.6.32.45/fs/proc/inode.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/proc/inode.c 2011-04-17 15:56:46.000000000 -0400
-@@ -457,7 +457,11 @@ struct inode *proc_get_inode(struct supe
- if (de->mode) {
- inode->i_mode = de->mode;
- inode->i_uid = de->uid;
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
-+#else
- inode->i_gid = de->gid;
-+#endif
- }
- if (de->size)
- inode->i_size = de->size;
-diff -urNp linux-2.6.32.45/fs/proc/internal.h linux-2.6.32.45/fs/proc/internal.h
---- linux-2.6.32.45/fs/proc/internal.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/proc/internal.h 2011-04-17 15:56:46.000000000 -0400
-@@ -51,6 +51,9 @@ extern int proc_pid_status(struct seq_fi
- struct pid *pid, struct task_struct *task);
- extern int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
- struct pid *pid, struct task_struct *task);
-+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
-+extern int proc_pid_ipaddr(struct task_struct *task, char *buffer);
-+#endif
- extern loff_t mem_lseek(struct file *file, loff_t offset, int orig);
-
- extern const struct file_operations proc_maps_operations;
-diff -urNp linux-2.6.32.45/fs/proc/Kconfig linux-2.6.32.45/fs/proc/Kconfig
---- linux-2.6.32.45/fs/proc/Kconfig 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/proc/Kconfig 2011-04-17 15:56:46.000000000 -0400
-@@ -30,12 +30,12 @@ config PROC_FS
-
- config PROC_KCORE
- bool "/proc/kcore support" if !ARM
-- depends on PROC_FS && MMU
-+ depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
-
- config PROC_VMCORE
- bool "/proc/vmcore support (EXPERIMENTAL)"
-- depends on PROC_FS && CRASH_DUMP
-- default y
-+ depends on PROC_FS && CRASH_DUMP && !GRKERNSEC
-+ default n
- help
- Exports the dump image of crashed kernel in ELF format.
-
-@@ -59,8 +59,8 @@ config PROC_SYSCTL
- limited in memory.
-
- config PROC_PAGE_MONITOR
-- default y
-- depends on PROC_FS && MMU
-+ default n
-+ depends on PROC_FS && MMU && !GRKERNSEC
- bool "Enable /proc page monitoring" if EMBEDDED
- help
- Various /proc files exist to monitor process memory utilization:
-diff -urNp linux-2.6.32.45/fs/proc/kcore.c linux-2.6.32.45/fs/proc/kcore.c
---- linux-2.6.32.45/fs/proc/kcore.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/proc/kcore.c 2011-05-16 21:46:57.000000000 -0400
-@@ -320,6 +320,8 @@ static void elf_kcore_store_hdr(char *bu
- off_t offset = 0;
- struct kcore_list *m;
-
-+ pax_track_stack();
-+
- /* setup ELF header */
- elf = (struct elfhdr *) bufp;
- bufp += sizeof(struct elfhdr);
-@@ -477,9 +479,10 @@ read_kcore(struct file *file, char __use
- * the addresses in the elf_phdr on our list.
- */
- start = kc_offset_to_vaddr(*fpos - elf_buflen);
-- if ((tsz = (PAGE_SIZE - (start & ~PAGE_MASK))) > buflen)
-+ tsz = PAGE_SIZE - (start & ~PAGE_MASK);
-+ if (tsz > buflen)
- tsz = buflen;
--
-+
- while (buflen) {
- struct kcore_list *m;
-
-@@ -508,20 +511,23 @@ read_kcore(struct file *file, char __use
- kfree(elf_buf);
- } else {
- if (kern_addr_valid(start)) {
-- unsigned long n;
-+ char *elf_buf;
-+ mm_segment_t oldfs;
-
-- n = copy_to_user(buffer, (char *)start, tsz);
-- /*
-- * We cannot distingush between fault on source
-- * and fault on destination. When this happens
-- * we clear too and hope it will trigger the
-- * EFAULT again.
-- */
-- if (n) {
-- if (clear_user(buffer + tsz - n,
-- n))
-+ elf_buf = kmalloc(tsz, GFP_KERNEL);
-+ if (!elf_buf)
-+ return -ENOMEM;
-+ oldfs = get_fs();
-+ set_fs(KERNEL_DS);
-+ if (!__copy_from_user(elf_buf, (const void __user *)start, tsz)) {
-+ set_fs(oldfs);
-+ if (copy_to_user(buffer, elf_buf, tsz)) {
-+ kfree(elf_buf);
- return -EFAULT;
-+ }
- }
-+ set_fs(oldfs);
-+ kfree(elf_buf);
- } else {
- if (clear_user(buffer, tsz))
- return -EFAULT;
-@@ -541,6 +547,9 @@ read_kcore(struct file *file, char __use
-
- static int open_kcore(struct inode *inode, struct file *filp)
- {
-+#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
-+ return -EPERM;
-+#endif
- if (!capable(CAP_SYS_RAWIO))
- return -EPERM;
- if (kcore_need_update)
-diff -urNp linux-2.6.32.45/fs/proc/meminfo.c linux-2.6.32.45/fs/proc/meminfo.c
---- linux-2.6.32.45/fs/proc/meminfo.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/proc/meminfo.c 2011-05-16 21:46:57.000000000 -0400
-@@ -29,6 +29,8 @@ static int meminfo_proc_show(struct seq_
- unsigned long pages[NR_LRU_LISTS];
- int lru;
-
-+ pax_track_stack();
-+
- /*
- * display in kilobytes.
- */
-@@ -149,7 +151,7 @@ static int meminfo_proc_show(struct seq_
- vmi.used >> 10,
- vmi.largest_chunk >> 10
- #ifdef CONFIG_MEMORY_FAILURE
-- ,atomic_long_read(&mce_bad_pages) << (PAGE_SHIFT - 10)
-+ ,atomic_long_read_unchecked(&mce_bad_pages) << (PAGE_SHIFT - 10)
- #endif
- );
-
-diff -urNp linux-2.6.32.45/fs/proc/nommu.c linux-2.6.32.45/fs/proc/nommu.c
---- linux-2.6.32.45/fs/proc/nommu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/proc/nommu.c 2011-04-17 15:56:46.000000000 -0400
-@@ -67,7 +67,7 @@ static int nommu_region_show(struct seq_
- if (len < 1)
- len = 1;
- seq_printf(m, "%*c", len, ' ');
-- seq_path(m, &file->f_path, "");
-+ seq_path(m, &file->f_path, "\n\\");
- }
-
- seq_putc(m, '\n');
-diff -urNp linux-2.6.32.45/fs/proc/proc_net.c linux-2.6.32.45/fs/proc/proc_net.c
---- linux-2.6.32.45/fs/proc/proc_net.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/proc/proc_net.c 2011-04-17 15:56:46.000000000 -0400
-@@ -104,6 +104,17 @@ static struct net *get_proc_task_net(str
- struct task_struct *task;
- struct nsproxy *ns;
- struct net *net = NULL;
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ const struct cred *cred = current_cred();
-+#endif
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+ if (cred->fsuid)
-+ return net;
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ if (cred->fsuid && !in_group_p(CONFIG_GRKERNSEC_PROC_GID))
-+ return net;
-+#endif
-
- rcu_read_lock();
- task = pid_task(proc_pid(dir), PIDTYPE_PID);
-diff -urNp linux-2.6.32.45/fs/proc/proc_sysctl.c linux-2.6.32.45/fs/proc/proc_sysctl.c
---- linux-2.6.32.45/fs/proc/proc_sysctl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/proc/proc_sysctl.c 2011-04-17 15:56:46.000000000 -0400
-@@ -7,6 +7,8 @@
- #include <linux/security.h>
- #include "internal.h"
-
-+extern __u32 gr_handle_sysctl(const struct ctl_table *table, const int op);
-+
- static const struct dentry_operations proc_sys_dentry_operations;
- static const struct file_operations proc_sys_file_operations;
- static const struct inode_operations proc_sys_inode_operations;
-@@ -109,6 +111,9 @@ static struct dentry *proc_sys_lookup(st
- if (!p)
- goto out;
-
-+ if (gr_handle_sysctl(p, MAY_EXEC))
-+ goto out;
-+
- err = ERR_PTR(-ENOMEM);
- inode = proc_sys_make_inode(dir->i_sb, h ? h : head, p);
- if (h)
-@@ -228,6 +233,9 @@ static int scan(struct ctl_table_header
- if (*pos < file->f_pos)
- continue;
-
-+ if (gr_handle_sysctl(table, 0))
-+ continue;
-+
- res = proc_sys_fill_cache(file, dirent, filldir, head, table);
- if (res)
- return res;
-@@ -344,6 +352,9 @@ static int proc_sys_getattr(struct vfsmo
- if (IS_ERR(head))
- return PTR_ERR(head);
-
-+ if (table && gr_handle_sysctl(table, MAY_EXEC))
-+ return -ENOENT;
-+
- generic_fillattr(inode, stat);
- if (table)
- stat->mode = (stat->mode & S_IFMT) | table->mode;
-diff -urNp linux-2.6.32.45/fs/proc/root.c linux-2.6.32.45/fs/proc/root.c
---- linux-2.6.32.45/fs/proc/root.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/proc/root.c 2011-04-17 15:56:46.000000000 -0400
-@@ -134,7 +134,15 @@ void __init proc_root_init(void)
- #ifdef CONFIG_PROC_DEVICETREE
- proc_device_tree_init();
- #endif
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+ proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
-+#endif
-+#else
- proc_mkdir("bus", NULL);
-+#endif
- proc_sys_init();
- }
-
-diff -urNp linux-2.6.32.45/fs/proc/task_mmu.c linux-2.6.32.45/fs/proc/task_mmu.c
---- linux-2.6.32.45/fs/proc/task_mmu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/proc/task_mmu.c 2011-04-23 13:38:09.000000000 -0400
-@@ -46,15 +46,26 @@ void task_mem(struct seq_file *m, struct
- "VmStk:\t%8lu kB\n"
- "VmExe:\t%8lu kB\n"
- "VmLib:\t%8lu kB\n"
-- "VmPTE:\t%8lu kB\n",
-- hiwater_vm << (PAGE_SHIFT-10),
-+ "VmPTE:\t%8lu kB\n"
-+
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+ "CsBase:\t%8lx\nCsLim:\t%8lx\n"
-+#endif
-+
-+ ,hiwater_vm << (PAGE_SHIFT-10),
- (total_vm - mm->reserved_vm) << (PAGE_SHIFT-10),
- mm->locked_vm << (PAGE_SHIFT-10),
- hiwater_rss << (PAGE_SHIFT-10),
- total_rss << (PAGE_SHIFT-10),
- data << (PAGE_SHIFT-10),
- mm->stack_vm << (PAGE_SHIFT-10), text, lib,
-- (PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10);
-+ (PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10
-+
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+ , mm->context.user_cs_base, mm->context.user_cs_limit
-+#endif
-+
-+ );
- }
-
- unsigned long task_vsize(struct mm_struct *mm)
-@@ -175,7 +186,8 @@ static void m_stop(struct seq_file *m, v
- struct proc_maps_private *priv = m->private;
- struct vm_area_struct *vma = v;
-
-- vma_stop(priv, vma);
-+ if (!IS_ERR(vma))
-+ vma_stop(priv, vma);
- if (priv->task)
- put_task_struct(priv->task);
- }
-@@ -199,6 +211,12 @@ static int do_maps_open(struct inode *in
- return ret;
- }
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
-+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
-+ _mm->pax_flags & MF_PAX_SEGMEXEC))
-+#endif
-+
- static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
- {
- struct mm_struct *mm = vma->vm_mm;
-@@ -206,7 +224,6 @@ static void show_map_vma(struct seq_file
- int flags = vma->vm_flags;
- unsigned long ino = 0;
- unsigned long long pgoff = 0;
-- unsigned long start;
- dev_t dev = 0;
- int len;
-
-@@ -217,20 +234,23 @@ static void show_map_vma(struct seq_file
- pgoff = ((loff_t)vma->vm_pgoff) << PAGE_SHIFT;
- }
-
-- /* We don't show the stack guard page in /proc/maps */
-- start = vma->vm_start;
-- if (vma->vm_flags & VM_GROWSDOWN)
-- if (!vma_stack_continue(vma->vm_prev, vma->vm_start))
-- start += PAGE_SIZE;
--
- seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
-- start,
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_start,
-+ PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_end,
-+#else
-+ vma->vm_start,
- vma->vm_end,
-+#endif
- flags & VM_READ ? 'r' : '-',
- flags & VM_WRITE ? 'w' : '-',
- flags & VM_EXEC ? 'x' : '-',
- flags & VM_MAYSHARE ? 's' : 'p',
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ PAX_RAND_FLAGS(mm) ? 0UL : pgoff,
-+#else
- pgoff,
-+#endif
- MAJOR(dev), MINOR(dev), ino, &len);
-
- /*
-@@ -239,7 +259,7 @@ static void show_map_vma(struct seq_file
- */
- if (file) {
- pad_len_spaces(m, len);
-- seq_path(m, &file->f_path, "\n");
-+ seq_path(m, &file->f_path, "\n\\");
- } else {
- const char *name = arch_vma_name(vma);
- if (!name) {
-@@ -247,8 +267,9 @@ static void show_map_vma(struct seq_file
- if (vma->vm_start <= mm->brk &&
- vma->vm_end >= mm->start_brk) {
- name = "[heap]";
-- } else if (vma->vm_start <= mm->start_stack &&
-- vma->vm_end >= mm->start_stack) {
-+ } else if ((vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP)) ||
-+ (vma->vm_start <= mm->start_stack &&
-+ vma->vm_end >= mm->start_stack)) {
- name = "[stack]";
- }
- } else {
-@@ -391,9 +412,16 @@ static int show_smap(struct seq_file *m,
- };
-
- memset(&mss, 0, sizeof mss);
-- mss.vma = vma;
-- if (vma->vm_mm && !is_vm_hugetlb_page(vma))
-- walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ if (!PAX_RAND_FLAGS(vma->vm_mm)) {
-+#endif
-+ mss.vma = vma;
-+ if (vma->vm_mm && !is_vm_hugetlb_page(vma))
-+ walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ }
-+#endif
-
- show_map_vma(m, vma);
-
-@@ -409,7 +437,11 @@ static int show_smap(struct seq_file *m,
- "Swap: %8lu kB\n"
- "KernelPageSize: %8lu kB\n"
- "MMUPageSize: %8lu kB\n",
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ PAX_RAND_FLAGS(vma->vm_mm) ? 0UL : (vma->vm_end - vma->vm_start) >> 10,
-+#else
- (vma->vm_end - vma->vm_start) >> 10,
-+#endif
- mss.resident >> 10,
- (unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
- mss.shared_clean >> 10,
-diff -urNp linux-2.6.32.45/fs/proc/task_nommu.c linux-2.6.32.45/fs/proc/task_nommu.c
---- linux-2.6.32.45/fs/proc/task_nommu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/proc/task_nommu.c 2011-04-17 15:56:46.000000000 -0400
-@@ -50,7 +50,7 @@ void task_mem(struct seq_file *m, struct
- else
- bytes += kobjsize(mm);
-
-- if (current->fs && current->fs->users > 1)
-+ if (current->fs && atomic_read(¤t->fs->users) > 1)
- sbytes += kobjsize(current->fs);
- else
- bytes += kobjsize(current->fs);
-@@ -154,7 +154,7 @@ static int nommu_vma_show(struct seq_fil
- if (len < 1)
- len = 1;
- seq_printf(m, "%*c", len, ' ');
-- seq_path(m, &file->f_path, "");
-+ seq_path(m, &file->f_path, "\n\\");
- }
-
- seq_putc(m, '\n');
-diff -urNp linux-2.6.32.45/fs/readdir.c linux-2.6.32.45/fs/readdir.c
---- linux-2.6.32.45/fs/readdir.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/readdir.c 2011-04-17 15:56:46.000000000 -0400
-@@ -16,6 +16,7 @@
- #include <linux/security.h>
- #include <linux/syscalls.h>
- #include <linux/unistd.h>
-+#include <linux/namei.h>
-
- #include <asm/uaccess.h>
-
-@@ -67,6 +68,7 @@ struct old_linux_dirent {
-
- struct readdir_callback {
- struct old_linux_dirent __user * dirent;
-+ struct file * file;
- int result;
- };
-
-@@ -84,6 +86,10 @@ static int fillonedir(void * __buf, cons
- buf->result = -EOVERFLOW;
- return -EOVERFLOW;
- }
-+
-+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
-+ return 0;
-+
- buf->result++;
- dirent = buf->dirent;
- if (!access_ok(VERIFY_WRITE, dirent,
-@@ -116,6 +122,7 @@ SYSCALL_DEFINE3(old_readdir, unsigned in
-
- buf.result = 0;
- buf.dirent = dirent;
-+ buf.file = file;
-
- error = vfs_readdir(file, fillonedir, &buf);
- if (buf.result)
-@@ -142,6 +149,7 @@ struct linux_dirent {
- struct getdents_callback {
- struct linux_dirent __user * current_dir;
- struct linux_dirent __user * previous;
-+ struct file * file;
- int count;
- int error;
- };
-@@ -162,6 +170,10 @@ static int filldir(void * __buf, const c
- buf->error = -EOVERFLOW;
- return -EOVERFLOW;
- }
-+
-+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
-+ return 0;
-+
- dirent = buf->previous;
- if (dirent) {
- if (__put_user(offset, &dirent->d_off))
-@@ -209,6 +221,7 @@ SYSCALL_DEFINE3(getdents, unsigned int,
- buf.previous = NULL;
- buf.count = count;
- buf.error = 0;
-+ buf.file = file;
-
- error = vfs_readdir(file, filldir, &buf);
- if (error >= 0)
-@@ -228,6 +241,7 @@ out:
- struct getdents_callback64 {
- struct linux_dirent64 __user * current_dir;
- struct linux_dirent64 __user * previous;
-+ struct file *file;
- int count;
- int error;
- };
-@@ -242,6 +256,10 @@ static int filldir64(void * __buf, const
- buf->error = -EINVAL; /* only used if we fail.. */
- if (reclen > buf->count)
- return -EINVAL;
-+
-+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
-+ return 0;
-+
- dirent = buf->previous;
- if (dirent) {
- if (__put_user(offset, &dirent->d_off))
-@@ -289,6 +307,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int
-
- buf.current_dir = dirent;
- buf.previous = NULL;
-+ buf.file = file;
- buf.count = count;
- buf.error = 0;
-
-diff -urNp linux-2.6.32.45/fs/reiserfs/dir.c linux-2.6.32.45/fs/reiserfs/dir.c
---- linux-2.6.32.45/fs/reiserfs/dir.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/reiserfs/dir.c 2011-05-16 21:46:57.000000000 -0400
-@@ -66,6 +66,8 @@ int reiserfs_readdir_dentry(struct dentr
- struct reiserfs_dir_entry de;
- int ret = 0;
-
-+ pax_track_stack();
-+
- reiserfs_write_lock(inode->i_sb);
-
- reiserfs_check_lock_depth(inode->i_sb, "readdir");
-diff -urNp linux-2.6.32.45/fs/reiserfs/do_balan.c linux-2.6.32.45/fs/reiserfs/do_balan.c
---- linux-2.6.32.45/fs/reiserfs/do_balan.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/reiserfs/do_balan.c 2011-04-17 15:56:46.000000000 -0400
-@@ -2058,7 +2058,7 @@ void do_balance(struct tree_balance *tb,
- return;
- }
-
-- atomic_inc(&(fs_generation(tb->tb_sb)));
-+ atomic_inc_unchecked(&(fs_generation(tb->tb_sb)));
- do_balance_starts(tb);
-
- /* balance leaf returns 0 except if combining L R and S into
-diff -urNp linux-2.6.32.45/fs/reiserfs/item_ops.c linux-2.6.32.45/fs/reiserfs/item_ops.c
---- linux-2.6.32.45/fs/reiserfs/item_ops.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/reiserfs/item_ops.c 2011-04-17 15:56:46.000000000 -0400
-@@ -102,7 +102,7 @@ static void sd_print_vi(struct virtual_i
- vi->vi_index, vi->vi_type, vi->vi_ih);
- }
-
--static struct item_operations stat_data_ops = {
-+static const struct item_operations stat_data_ops = {
- .bytes_number = sd_bytes_number,
- .decrement_key = sd_decrement_key,
- .is_left_mergeable = sd_is_left_mergeable,
-@@ -196,7 +196,7 @@ static void direct_print_vi(struct virtu
- vi->vi_index, vi->vi_type, vi->vi_ih);
- }
-
--static struct item_operations direct_ops = {
-+static const struct item_operations direct_ops = {
- .bytes_number = direct_bytes_number,
- .decrement_key = direct_decrement_key,
- .is_left_mergeable = direct_is_left_mergeable,
-@@ -341,7 +341,7 @@ static void indirect_print_vi(struct vir
- vi->vi_index, vi->vi_type, vi->vi_ih);
- }
-
--static struct item_operations indirect_ops = {
-+static const struct item_operations indirect_ops = {
- .bytes_number = indirect_bytes_number,
- .decrement_key = indirect_decrement_key,
- .is_left_mergeable = indirect_is_left_mergeable,
-@@ -628,7 +628,7 @@ static void direntry_print_vi(struct vir
- printk("\n");
- }
-
--static struct item_operations direntry_ops = {
-+static const struct item_operations direntry_ops = {
- .bytes_number = direntry_bytes_number,
- .decrement_key = direntry_decrement_key,
- .is_left_mergeable = direntry_is_left_mergeable,
-@@ -724,7 +724,7 @@ static void errcatch_print_vi(struct vir
- "Invalid item type observed, run fsck ASAP");
- }
-
--static struct item_operations errcatch_ops = {
-+static const struct item_operations errcatch_ops = {
- errcatch_bytes_number,
- errcatch_decrement_key,
- errcatch_is_left_mergeable,
-@@ -746,7 +746,7 @@ static struct item_operations errcatch_o
- #error Item types must use disk-format assigned values.
- #endif
-
--struct item_operations *item_ops[TYPE_ANY + 1] = {
-+const struct item_operations * const item_ops[TYPE_ANY + 1] = {
- &stat_data_ops,
- &indirect_ops,
- &direct_ops,
-diff -urNp linux-2.6.32.45/fs/reiserfs/journal.c linux-2.6.32.45/fs/reiserfs/journal.c
---- linux-2.6.32.45/fs/reiserfs/journal.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/reiserfs/journal.c 2011-05-16 21:46:57.000000000 -0400
-@@ -2329,6 +2329,8 @@ static struct buffer_head *reiserfs_brea
- struct buffer_head *bh;
- int i, j;
-
-+ pax_track_stack();
-+
- bh = __getblk(dev, block, bufsize);
- if (buffer_uptodate(bh))
- return (bh);
-diff -urNp linux-2.6.32.45/fs/reiserfs/namei.c linux-2.6.32.45/fs/reiserfs/namei.c
---- linux-2.6.32.45/fs/reiserfs/namei.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/reiserfs/namei.c 2011-05-16 21:46:57.000000000 -0400
-@@ -1214,6 +1214,8 @@ static int reiserfs_rename(struct inode
- unsigned long savelink = 1;
- struct timespec ctime;
-
-+ pax_track_stack();
-+
- /* three balancings: (1) old name removal, (2) new name insertion
- and (3) maybe "save" link insertion
- stat data updates: (1) old directory,
-diff -urNp linux-2.6.32.45/fs/reiserfs/procfs.c linux-2.6.32.45/fs/reiserfs/procfs.c
---- linux-2.6.32.45/fs/reiserfs/procfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/reiserfs/procfs.c 2011-05-16 21:46:57.000000000 -0400
-@@ -123,7 +123,7 @@ static int show_super(struct seq_file *m
- "SMALL_TAILS " : "NO_TAILS ",
- replay_only(sb) ? "REPLAY_ONLY " : "",
- convert_reiserfs(sb) ? "CONV " : "",
-- atomic_read(&r->s_generation_counter),
-+ atomic_read_unchecked(&r->s_generation_counter),
- SF(s_disk_reads), SF(s_disk_writes), SF(s_fix_nodes),
- SF(s_do_balance), SF(s_unneeded_left_neighbor),
- SF(s_good_search_by_key_reada), SF(s_bmaps),
-@@ -309,6 +309,8 @@ static int show_journal(struct seq_file
- struct journal_params *jp = &rs->s_v1.s_journal;
- char b[BDEVNAME_SIZE];
-
-+ pax_track_stack();
-+
- seq_printf(m, /* on-disk fields */
- "jp_journal_1st_block: \t%i\n"
- "jp_journal_dev: \t%s[%x]\n"
-diff -urNp linux-2.6.32.45/fs/reiserfs/stree.c linux-2.6.32.45/fs/reiserfs/stree.c
---- linux-2.6.32.45/fs/reiserfs/stree.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/reiserfs/stree.c 2011-05-16 21:46:57.000000000 -0400
-@@ -1159,6 +1159,8 @@ int reiserfs_delete_item(struct reiserfs
- int iter = 0;
- #endif
-
-+ pax_track_stack();
-+
- BUG_ON(!th->t_trans_id);
-
- init_tb_struct(th, &s_del_balance, sb, path,
-@@ -1296,6 +1298,8 @@ void reiserfs_delete_solid_item(struct r
- int retval;
- int quota_cut_bytes = 0;
-
-+ pax_track_stack();
-+
- BUG_ON(!th->t_trans_id);
-
- le_key2cpu_key(&cpu_key, key);
-@@ -1525,6 +1529,8 @@ int reiserfs_cut_from_item(struct reiser
- int quota_cut_bytes;
- loff_t tail_pos = 0;
-
-+ pax_track_stack();
-+
- BUG_ON(!th->t_trans_id);
-
- init_tb_struct(th, &s_cut_balance, inode->i_sb, path,
-@@ -1920,6 +1926,8 @@ int reiserfs_paste_into_item(struct reis
- int retval;
- int fs_gen;
-
-+ pax_track_stack();
-+
- BUG_ON(!th->t_trans_id);
-
- fs_gen = get_generation(inode->i_sb);
-@@ -2007,6 +2015,8 @@ int reiserfs_insert_item(struct reiserfs
- int fs_gen = 0;
- int quota_bytes = 0;
-
-+ pax_track_stack();
-+
- BUG_ON(!th->t_trans_id);
-
- if (inode) { /* Do we count quotas for item? */
-diff -urNp linux-2.6.32.45/fs/reiserfs/super.c linux-2.6.32.45/fs/reiserfs/super.c
---- linux-2.6.32.45/fs/reiserfs/super.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/reiserfs/super.c 2011-05-16 21:46:57.000000000 -0400
-@@ -912,6 +912,8 @@ static int reiserfs_parse_options(struct
- {.option_name = NULL}
- };
-
-+ pax_track_stack();
-+
- *blocks = 0;
- if (!options || !*options)
- /* use default configuration: create tails, journaling on, no
-diff -urNp linux-2.6.32.45/fs/select.c linux-2.6.32.45/fs/select.c
---- linux-2.6.32.45/fs/select.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/select.c 2011-05-16 21:46:57.000000000 -0400
-@@ -20,6 +20,7 @@
- #include <linux/module.h>
- #include <linux/slab.h>
- #include <linux/poll.h>
-+#include <linux/security.h>
- #include <linux/personality.h> /* for STICKY_TIMEOUTS */
- #include <linux/file.h>
- #include <linux/fdtable.h>
-@@ -401,6 +402,8 @@ int do_select(int n, fd_set_bits *fds, s
- int retval, i, timed_out = 0;
- unsigned long slack = 0;
-
-+ pax_track_stack();
-+
- rcu_read_lock();
- retval = max_select_fd(n, fds);
- rcu_read_unlock();
-@@ -529,6 +532,8 @@ int core_sys_select(int n, fd_set __user
- /* Allocate small arguments on the stack to save memory and be faster */
- long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
-
-+ pax_track_stack();
-+
- ret = -EINVAL;
- if (n < 0)
- goto out_nofds;
-@@ -821,6 +826,9 @@ int do_sys_poll(struct pollfd __user *uf
- struct poll_list *walk = head;
- unsigned long todo = nfds;
-
-+ pax_track_stack();
-+
-+ gr_learn_resource(current, RLIMIT_NOFILE, nfds, 1);
- if (nfds > current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
- return -EINVAL;
-
-diff -urNp linux-2.6.32.45/fs/seq_file.c linux-2.6.32.45/fs/seq_file.c
---- linux-2.6.32.45/fs/seq_file.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/seq_file.c 2011-08-05 20:33:55.000000000 -0400
-@@ -76,7 +76,8 @@ static int traverse(struct seq_file *m,
- return 0;
- }
- if (!m->buf) {
-- m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
-+ m->size = PAGE_SIZE;
-+ m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
- if (!m->buf)
- return -ENOMEM;
- }
-@@ -116,7 +117,8 @@ static int traverse(struct seq_file *m,
- Eoverflow:
- m->op->stop(m, p);
- kfree(m->buf);
-- m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
-+ m->size <<= 1;
-+ m->buf = kmalloc(m->size, GFP_KERNEL);
- return !m->buf ? -ENOMEM : -EAGAIN;
- }
-
-@@ -169,7 +171,8 @@ ssize_t seq_read(struct file *file, char
- m->version = file->f_version;
- /* grab buffer if we didn't have one */
- if (!m->buf) {
-- m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
-+ m->size = PAGE_SIZE;
-+ m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
- if (!m->buf)
- goto Enomem;
- }
-@@ -210,7 +213,8 @@ ssize_t seq_read(struct file *file, char
- goto Fill;
- m->op->stop(m, p);
- kfree(m->buf);
-- m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
-+ m->size <<= 1;
-+ m->buf = kmalloc(m->size, GFP_KERNEL);
- if (!m->buf)
- goto Enomem;
- m->count = 0;
-@@ -555,10 +559,10 @@ int single_open(struct file *file, int (
- int res = -ENOMEM;
-
- if (op) {
-- op->start = single_start;
-- op->next = single_next;
-- op->stop = single_stop;
-- op->show = show;
-+ *(void **)&op->start = single_start;
-+ *(void **)&op->next = single_next;
-+ *(void **)&op->stop = single_stop;
-+ *(void **)&op->show = show;
- res = seq_open(file, op);
- if (!res)
- ((struct seq_file *)file->private_data)->private = data;
-diff -urNp linux-2.6.32.45/fs/smbfs/proc.c linux-2.6.32.45/fs/smbfs/proc.c
---- linux-2.6.32.45/fs/smbfs/proc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/smbfs/proc.c 2011-08-05 20:33:55.000000000 -0400
-@@ -266,9 +266,9 @@ int smb_setcodepage(struct smb_sb_info *
-
- out:
- if (server->local_nls != NULL && server->remote_nls != NULL)
-- server->ops->convert = convert_cp;
-+ *(void **)&server->ops->convert = convert_cp;
- else
-- server->ops->convert = convert_memcpy;
-+ *(void **)&server->ops->convert = convert_memcpy;
-
- smb_unlock_server(server);
- return n;
-@@ -933,9 +933,9 @@ smb_newconn(struct smb_sb_info *server,
-
- /* FIXME: the win9x code wants to modify these ... (seek/trunc bug) */
- if (server->mnt->flags & SMB_MOUNT_OLDATTR) {
-- server->ops->getattr = smb_proc_getattr_core;
-+ *(void **)&server->ops->getattr = smb_proc_getattr_core;
- } else if (server->mnt->flags & SMB_MOUNT_DIRATTR) {
-- server->ops->getattr = smb_proc_getattr_ff;
-+ *(void **)&server->ops->getattr = smb_proc_getattr_ff;
- }
-
- /* Decode server capabilities */
-@@ -3439,7 +3439,7 @@ out:
- static void
- install_ops(struct smb_ops *dst, struct smb_ops *src)
- {
-- memcpy(dst, src, sizeof(void *) * SMB_OPS_NUM_STATIC);
-+ memcpy((void *)dst, src, sizeof(void *) * SMB_OPS_NUM_STATIC);
- }
-
- /* < LANMAN2 */
-diff -urNp linux-2.6.32.45/fs/smbfs/symlink.c linux-2.6.32.45/fs/smbfs/symlink.c
---- linux-2.6.32.45/fs/smbfs/symlink.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/smbfs/symlink.c 2011-04-17 15:56:46.000000000 -0400
-@@ -55,7 +55,7 @@ static void *smb_follow_link(struct dent
-
- static void smb_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
- {
-- char *s = nd_get_link(nd);
-+ const char *s = nd_get_link(nd);
- if (!IS_ERR(s))
- __putname(s);
- }
-diff -urNp linux-2.6.32.45/fs/splice.c linux-2.6.32.45/fs/splice.c
---- linux-2.6.32.45/fs/splice.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/splice.c 2011-05-16 21:46:57.000000000 -0400
-@@ -185,7 +185,7 @@ ssize_t splice_to_pipe(struct pipe_inode
- pipe_lock(pipe);
-
- for (;;) {
-- if (!pipe->readers) {
-+ if (!atomic_read(&pipe->readers)) {
- send_sig(SIGPIPE, current, 0);
- if (!ret)
- ret = -EPIPE;
-@@ -239,9 +239,9 @@ ssize_t splice_to_pipe(struct pipe_inode
- do_wakeup = 0;
- }
-
-- pipe->waiting_writers++;
-+ atomic_inc(&pipe->waiting_writers);
- pipe_wait(pipe);
-- pipe->waiting_writers--;
-+ atomic_dec(&pipe->waiting_writers);
- }
-
- pipe_unlock(pipe);
-@@ -285,6 +285,8 @@ __generic_file_splice_read(struct file *
- .spd_release = spd_release_page,
- };
-
-+ pax_track_stack();
-+
- index = *ppos >> PAGE_CACHE_SHIFT;
- loff = *ppos & ~PAGE_CACHE_MASK;
- req_pages = (len + loff + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
-@@ -521,7 +523,7 @@ static ssize_t kernel_readv(struct file
- old_fs = get_fs();
- set_fs(get_ds());
- /* The cast to a user pointer is valid due to the set_fs() */
-- res = vfs_readv(file, (const struct iovec __user *)vec, vlen, &pos);
-+ res = vfs_readv(file, (__force const struct iovec __user *)vec, vlen, &pos);
- set_fs(old_fs);
-
- return res;
-@@ -536,7 +538,7 @@ static ssize_t kernel_write(struct file
- old_fs = get_fs();
- set_fs(get_ds());
- /* The cast to a user pointer is valid due to the set_fs() */
-- res = vfs_write(file, (const char __user *)buf, count, &pos);
-+ res = vfs_write(file, (__force const char __user *)buf, count, &pos);
- set_fs(old_fs);
-
- return res;
-@@ -565,6 +567,8 @@ ssize_t default_file_splice_read(struct
- .spd_release = spd_release_page,
- };
-
-+ pax_track_stack();
-+
- index = *ppos >> PAGE_CACHE_SHIFT;
- offset = *ppos & ~PAGE_CACHE_MASK;
- nr_pages = (len + offset + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
-@@ -578,7 +582,7 @@ ssize_t default_file_splice_read(struct
- goto err;
-
- this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset);
-- vec[i].iov_base = (void __user *) page_address(page);
-+ vec[i].iov_base = (__force void __user *) page_address(page);
- vec[i].iov_len = this_len;
- pages[i] = page;
- spd.nr_pages++;
-@@ -800,10 +804,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
- int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
- {
- while (!pipe->nrbufs) {
-- if (!pipe->writers)
-+ if (!atomic_read(&pipe->writers))
- return 0;
-
-- if (!pipe->waiting_writers && sd->num_spliced)
-+ if (!atomic_read(&pipe->waiting_writers) && sd->num_spliced)
- return 0;
-
- if (sd->flags & SPLICE_F_NONBLOCK)
-@@ -1140,7 +1144,7 @@ ssize_t splice_direct_to_actor(struct fi
- * out of the pipe right after the splice_to_pipe(). So set
- * PIPE_READERS appropriately.
- */
-- pipe->readers = 1;
-+ atomic_set(&pipe->readers, 1);
-
- current->splice_pipe = pipe;
- }
-@@ -1592,6 +1596,8 @@ static long vmsplice_to_pipe(struct file
- .spd_release = spd_release_page,
- };
-
-+ pax_track_stack();
-+
- pipe = pipe_info(file->f_path.dentry->d_inode);
- if (!pipe)
- return -EBADF;
-@@ -1700,9 +1706,9 @@ static int ipipe_prep(struct pipe_inode_
- ret = -ERESTARTSYS;
- break;
- }
-- if (!pipe->writers)
-+ if (!atomic_read(&pipe->writers))
- break;
-- if (!pipe->waiting_writers) {
-+ if (!atomic_read(&pipe->waiting_writers)) {
- if (flags & SPLICE_F_NONBLOCK) {
- ret = -EAGAIN;
- break;
-@@ -1734,7 +1740,7 @@ static int opipe_prep(struct pipe_inode_
- pipe_lock(pipe);
-
- while (pipe->nrbufs >= PIPE_BUFFERS) {
-- if (!pipe->readers) {
-+ if (!atomic_read(&pipe->readers)) {
- send_sig(SIGPIPE, current, 0);
- ret = -EPIPE;
- break;
-@@ -1747,9 +1753,9 @@ static int opipe_prep(struct pipe_inode_
- ret = -ERESTARTSYS;
- break;
- }
-- pipe->waiting_writers++;
-+ atomic_inc(&pipe->waiting_writers);
- pipe_wait(pipe);
-- pipe->waiting_writers--;
-+ atomic_dec(&pipe->waiting_writers);
- }
-
- pipe_unlock(pipe);
-@@ -1785,14 +1791,14 @@ retry:
- pipe_double_lock(ipipe, opipe);
-
- do {
-- if (!opipe->readers) {
-+ if (!atomic_read(&opipe->readers)) {
- send_sig(SIGPIPE, current, 0);
- if (!ret)
- ret = -EPIPE;
- break;
- }
-
-- if (!ipipe->nrbufs && !ipipe->writers)
-+ if (!ipipe->nrbufs && !atomic_read(&ipipe->writers))
- break;
-
- /*
-@@ -1892,7 +1898,7 @@ static int link_pipe(struct pipe_inode_i
- pipe_double_lock(ipipe, opipe);
-
- do {
-- if (!opipe->readers) {
-+ if (!atomic_read(&opipe->readers)) {
- send_sig(SIGPIPE, current, 0);
- if (!ret)
- ret = -EPIPE;
-@@ -1937,7 +1943,7 @@ static int link_pipe(struct pipe_inode_i
- * return EAGAIN if we have the potential of some data in the
- * future, otherwise just return 0
- */
-- if (!ret && ipipe->waiting_writers && (flags & SPLICE_F_NONBLOCK))
-+ if (!ret && atomic_read(&ipipe->waiting_writers) && (flags & SPLICE_F_NONBLOCK))
- ret = -EAGAIN;
-
- pipe_unlock(ipipe);
-diff -urNp linux-2.6.32.45/fs/sysfs/file.c linux-2.6.32.45/fs/sysfs/file.c
---- linux-2.6.32.45/fs/sysfs/file.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/sysfs/file.c 2011-05-04 17:56:20.000000000 -0400
-@@ -44,7 +44,7 @@ static DEFINE_SPINLOCK(sysfs_open_dirent
-
- struct sysfs_open_dirent {
- atomic_t refcnt;
-- atomic_t event;
-+ atomic_unchecked_t event;
- wait_queue_head_t poll;
- struct list_head buffers; /* goes through sysfs_buffer.list */
- };
-@@ -53,7 +53,7 @@ struct sysfs_buffer {
- size_t count;
- loff_t pos;
- char * page;
-- struct sysfs_ops * ops;
-+ const struct sysfs_ops * ops;
- struct mutex mutex;
- int needs_read_fill;
- int event;
-@@ -75,7 +75,7 @@ static int fill_read_buffer(struct dentr
- {
- struct sysfs_dirent *attr_sd = dentry->d_fsdata;
- struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
-- struct sysfs_ops * ops = buffer->ops;
-+ const struct sysfs_ops * ops = buffer->ops;
- int ret = 0;
- ssize_t count;
-
-@@ -88,7 +88,7 @@ static int fill_read_buffer(struct dentr
- if (!sysfs_get_active_two(attr_sd))
- return -ENODEV;
-
-- buffer->event = atomic_read(&attr_sd->s_attr.open->event);
-+ buffer->event = atomic_read_unchecked(&attr_sd->s_attr.open->event);
- count = ops->show(kobj, attr_sd->s_attr.attr, buffer->page);
-
- sysfs_put_active_two(attr_sd);
-@@ -199,7 +199,7 @@ flush_write_buffer(struct dentry * dentr
- {
- struct sysfs_dirent *attr_sd = dentry->d_fsdata;
- struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
-- struct sysfs_ops * ops = buffer->ops;
-+ const struct sysfs_ops * ops = buffer->ops;
- int rc;
-
- /* need attr_sd for attr and ops, its parent for kobj */
-@@ -294,7 +294,7 @@ static int sysfs_get_open_dirent(struct
- return -ENOMEM;
-
- atomic_set(&new_od->refcnt, 0);
-- atomic_set(&new_od->event, 1);
-+ atomic_set_unchecked(&new_od->event, 1);
- init_waitqueue_head(&new_od->poll);
- INIT_LIST_HEAD(&new_od->buffers);
- goto retry;
-@@ -335,7 +335,7 @@ static int sysfs_open_file(struct inode
- struct sysfs_dirent *attr_sd = file->f_path.dentry->d_fsdata;
- struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
- struct sysfs_buffer *buffer;
-- struct sysfs_ops *ops;
-+ const struct sysfs_ops *ops;
- int error = -EACCES;
- char *p;
-
-@@ -444,7 +444,7 @@ static unsigned int sysfs_poll(struct fi
-
- sysfs_put_active_two(attr_sd);
-
-- if (buffer->event != atomic_read(&od->event))
-+ if (buffer->event != atomic_read_unchecked(&od->event))
- goto trigger;
-
- return DEFAULT_POLLMASK;
-@@ -463,7 +463,7 @@ void sysfs_notify_dirent(struct sysfs_di
-
- od = sd->s_attr.open;
- if (od) {
-- atomic_inc(&od->event);
-+ atomic_inc_unchecked(&od->event);
- wake_up_interruptible(&od->poll);
- }
-
-diff -urNp linux-2.6.32.45/fs/sysfs/mount.c linux-2.6.32.45/fs/sysfs/mount.c
---- linux-2.6.32.45/fs/sysfs/mount.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/sysfs/mount.c 2011-04-17 15:56:46.000000000 -0400
-@@ -36,7 +36,11 @@ struct sysfs_dirent sysfs_root = {
- .s_name = "",
- .s_count = ATOMIC_INIT(1),
- .s_flags = SYSFS_DIR,
-+#ifdef CONFIG_GRKERNSEC_SYSFS_RESTRICT
-+ .s_mode = S_IFDIR | S_IRWXU,
-+#else
- .s_mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO,
-+#endif
- .s_ino = 1,
- };
-
-diff -urNp linux-2.6.32.45/fs/sysfs/symlink.c linux-2.6.32.45/fs/sysfs/symlink.c
---- linux-2.6.32.45/fs/sysfs/symlink.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/sysfs/symlink.c 2011-04-17 15:56:46.000000000 -0400
-@@ -204,7 +204,7 @@ static void *sysfs_follow_link(struct de
-
- static void sysfs_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
- {
-- char *page = nd_get_link(nd);
-+ const char *page = nd_get_link(nd);
- if (!IS_ERR(page))
- free_page((unsigned long)page);
- }
-diff -urNp linux-2.6.32.45/fs/udf/balloc.c linux-2.6.32.45/fs/udf/balloc.c
---- linux-2.6.32.45/fs/udf/balloc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/udf/balloc.c 2011-04-17 15:56:46.000000000 -0400
-@@ -172,9 +172,7 @@ static void udf_bitmap_free_blocks(struc
-
- mutex_lock(&sbi->s_alloc_mutex);
- partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
-- if (bloc->logicalBlockNum < 0 ||
-- (bloc->logicalBlockNum + count) >
-- partmap->s_partition_len) {
-+ if ((bloc->logicalBlockNum + count) > partmap->s_partition_len) {
- udf_debug("%d < %d || %d + %d > %d\n",
- bloc->logicalBlockNum, 0, bloc->logicalBlockNum,
- count, partmap->s_partition_len);
-@@ -436,9 +434,7 @@ static void udf_table_free_blocks(struct
-
- mutex_lock(&sbi->s_alloc_mutex);
- partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
-- if (bloc->logicalBlockNum < 0 ||
-- (bloc->logicalBlockNum + count) >
-- partmap->s_partition_len) {
-+ if ((bloc->logicalBlockNum + count) > partmap->s_partition_len) {
- udf_debug("%d < %d || %d + %d > %d\n",
- bloc.logicalBlockNum, 0, bloc.logicalBlockNum, count,
- partmap->s_partition_len);
-diff -urNp linux-2.6.32.45/fs/udf/inode.c linux-2.6.32.45/fs/udf/inode.c
---- linux-2.6.32.45/fs/udf/inode.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/udf/inode.c 2011-05-16 21:46:57.000000000 -0400
-@@ -484,6 +484,8 @@ static struct buffer_head *inode_getblk(
- int goal = 0, pgoal = iinfo->i_location.logicalBlockNum;
- int lastblock = 0;
-
-+ pax_track_stack();
-+
- prev_epos.offset = udf_file_entry_alloc_offset(inode);
- prev_epos.block = iinfo->i_location;
- prev_epos.bh = NULL;
-diff -urNp linux-2.6.32.45/fs/udf/misc.c linux-2.6.32.45/fs/udf/misc.c
---- linux-2.6.32.45/fs/udf/misc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/udf/misc.c 2011-04-23 12:56:11.000000000 -0400
-@@ -286,7 +286,7 @@ void udf_new_tag(char *data, uint16_t id
-
- u8 udf_tag_checksum(const struct tag *t)
- {
-- u8 *data = (u8 *)t;
-+ const u8 *data = (const u8 *)t;
- u8 checksum = 0;
- int i;
- for (i = 0; i < sizeof(struct tag); ++i)
-diff -urNp linux-2.6.32.45/fs/utimes.c linux-2.6.32.45/fs/utimes.c
---- linux-2.6.32.45/fs/utimes.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/utimes.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1,6 +1,7 @@
- #include <linux/compiler.h>
- #include <linux/file.h>
- #include <linux/fs.h>
-+#include <linux/security.h>
- #include <linux/linkage.h>
- #include <linux/mount.h>
- #include <linux/namei.h>
-@@ -101,6 +102,12 @@ static int utimes_common(struct path *pa
- goto mnt_drop_write_and_out;
- }
- }
-+
-+ if (!gr_acl_handle_utime(path->dentry, path->mnt)) {
-+ error = -EACCES;
-+ goto mnt_drop_write_and_out;
-+ }
-+
- mutex_lock(&inode->i_mutex);
- error = notify_change(path->dentry, &newattrs);
- mutex_unlock(&inode->i_mutex);
-diff -urNp linux-2.6.32.45/fs/xattr_acl.c linux-2.6.32.45/fs/xattr_acl.c
---- linux-2.6.32.45/fs/xattr_acl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/xattr_acl.c 2011-04-17 15:56:46.000000000 -0400
-@@ -17,8 +17,8 @@
- struct posix_acl *
- posix_acl_from_xattr(const void *value, size_t size)
- {
-- posix_acl_xattr_header *header = (posix_acl_xattr_header *)value;
-- posix_acl_xattr_entry *entry = (posix_acl_xattr_entry *)(header+1), *end;
-+ const posix_acl_xattr_header *header = (const posix_acl_xattr_header *)value;
-+ const posix_acl_xattr_entry *entry = (const posix_acl_xattr_entry *)(header+1), *end;
- int count;
- struct posix_acl *acl;
- struct posix_acl_entry *acl_e;
-diff -urNp linux-2.6.32.45/fs/xattr.c linux-2.6.32.45/fs/xattr.c
---- linux-2.6.32.45/fs/xattr.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/xattr.c 2011-04-17 15:56:46.000000000 -0400
-@@ -247,7 +247,7 @@ EXPORT_SYMBOL_GPL(vfs_removexattr);
- * Extended attribute SET operations
- */
- static long
--setxattr(struct dentry *d, const char __user *name, const void __user *value,
-+setxattr(struct path *path, const char __user *name, const void __user *value,
- size_t size, int flags)
- {
- int error;
-@@ -271,7 +271,13 @@ setxattr(struct dentry *d, const char __
- return PTR_ERR(kvalue);
- }
-
-- error = vfs_setxattr(d, kname, kvalue, size, flags);
-+ if (!gr_acl_handle_setxattr(path->dentry, path->mnt)) {
-+ error = -EACCES;
-+ goto out;
-+ }
-+
-+ error = vfs_setxattr(path->dentry, kname, kvalue, size, flags);
-+out:
- kfree(kvalue);
- return error;
- }
-@@ -288,7 +294,7 @@ SYSCALL_DEFINE5(setxattr, const char __u
- return error;
- error = mnt_want_write(path.mnt);
- if (!error) {
-- error = setxattr(path.dentry, name, value, size, flags);
-+ error = setxattr(&path, name, value, size, flags);
- mnt_drop_write(path.mnt);
- }
- path_put(&path);
-@@ -307,7 +313,7 @@ SYSCALL_DEFINE5(lsetxattr, const char __
- return error;
- error = mnt_want_write(path.mnt);
- if (!error) {
-- error = setxattr(path.dentry, name, value, size, flags);
-+ error = setxattr(&path, name, value, size, flags);
- mnt_drop_write(path.mnt);
- }
- path_put(&path);
-@@ -318,17 +324,15 @@ SYSCALL_DEFINE5(fsetxattr, int, fd, cons
- const void __user *,value, size_t, size, int, flags)
- {
- struct file *f;
-- struct dentry *dentry;
- int error = -EBADF;
-
- f = fget(fd);
- if (!f)
- return error;
-- dentry = f->f_path.dentry;
-- audit_inode(NULL, dentry);
-+ audit_inode(NULL, f->f_path.dentry);
- error = mnt_want_write_file(f);
- if (!error) {
-- error = setxattr(dentry, name, value, size, flags);
-+ error = setxattr(&f->f_path, name, value, size, flags);
- mnt_drop_write(f->f_path.mnt);
- }
- fput(f);
-diff -urNp linux-2.6.32.45/fs/xfs/linux-2.6/xfs_ioctl32.c linux-2.6.32.45/fs/xfs/linux-2.6/xfs_ioctl32.c
---- linux-2.6.32.45/fs/xfs/linux-2.6/xfs_ioctl32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/xfs/linux-2.6/xfs_ioctl32.c 2011-04-17 15:56:46.000000000 -0400
-@@ -75,6 +75,7 @@ xfs_compat_ioc_fsgeometry_v1(
- xfs_fsop_geom_t fsgeo;
- int error;
-
-+ memset(&fsgeo, 0, sizeof(fsgeo));
- error = xfs_fs_geometry(mp, &fsgeo, 3);
- if (error)
- return -error;
-diff -urNp linux-2.6.32.45/fs/xfs/linux-2.6/xfs_ioctl.c linux-2.6.32.45/fs/xfs/linux-2.6/xfs_ioctl.c
---- linux-2.6.32.45/fs/xfs/linux-2.6/xfs_ioctl.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.45/fs/xfs/linux-2.6/xfs_ioctl.c 2011-04-17 20:07:09.000000000 -0400
-@@ -134,7 +134,7 @@ xfs_find_handle(
- }
-
- error = -EFAULT;
-- if (copy_to_user(hreq->ohandle, &handle, hsize) ||
-+ if (hsize > sizeof handle || copy_to_user(hreq->ohandle, &handle, hsize) ||
- copy_to_user(hreq->ohandlen, &hsize, sizeof(__s32)))
- goto out_put;
-
-@@ -423,7 +423,7 @@ xfs_attrlist_by_handle(
- if (IS_ERR(dentry))
- return PTR_ERR(dentry);
-
-- kbuf = kmalloc(al_hreq.buflen, GFP_KERNEL);
-+ kbuf = kzalloc(al_hreq.buflen, GFP_KERNEL);
- if (!kbuf)
- goto out_dput;
-
-@@ -697,7 +697,7 @@ xfs_ioc_fsgeometry_v1(
- xfs_mount_t *mp,
- void __user *arg)
- {
-- xfs_fsop_geom_t fsgeo;
-+ xfs_fsop_geom_t fsgeo;
- int error;
-
- error = xfs_fs_geometry(mp, &fsgeo, 3);
-diff -urNp linux-2.6.32.45/fs/xfs/linux-2.6/xfs_iops.c linux-2.6.32.45/fs/xfs/linux-2.6/xfs_iops.c
---- linux-2.6.32.45/fs/xfs/linux-2.6/xfs_iops.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/xfs/linux-2.6/xfs_iops.c 2011-04-17 15:56:46.000000000 -0400
-@@ -468,7 +468,7 @@ xfs_vn_put_link(
- struct nameidata *nd,
- void *p)
- {
-- char *s = nd_get_link(nd);
-+ const char *s = nd_get_link(nd);
-
- if (!IS_ERR(s))
- kfree(s);
-diff -urNp linux-2.6.32.45/fs/xfs/xfs_bmap.c linux-2.6.32.45/fs/xfs/xfs_bmap.c
---- linux-2.6.32.45/fs/xfs/xfs_bmap.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/xfs/xfs_bmap.c 2011-04-17 15:56:46.000000000 -0400
-@@ -360,7 +360,7 @@ xfs_bmap_validate_ret(
- int nmap,
- int ret_nmap);
- #else
--#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap)
-+#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap) do {} while (0)
- #endif /* DEBUG */
-
- #if defined(XFS_RW_TRACE)
-diff -urNp linux-2.6.32.45/fs/xfs/xfs_dir2_sf.c linux-2.6.32.45/fs/xfs/xfs_dir2_sf.c
---- linux-2.6.32.45/fs/xfs/xfs_dir2_sf.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/fs/xfs/xfs_dir2_sf.c 2011-04-18 22:07:30.000000000 -0400
-@@ -779,7 +779,15 @@ xfs_dir2_sf_getdents(
- }
-
- ino = xfs_dir2_sf_get_inumber(sfp, xfs_dir2_sf_inumberp(sfep));
-- if (filldir(dirent, sfep->name, sfep->namelen,
-+ if (dp->i_df.if_u1.if_data == dp->i_df.if_u2.if_inline_data) {
-+ char name[sfep->namelen];
-+ memcpy(name, sfep->name, sfep->namelen);
-+ if (filldir(dirent, name, sfep->namelen,
-+ off & 0x7fffffff, ino, DT_UNKNOWN)) {
-+ *offset = off & 0x7fffffff;
-+ return 0;
-+ }
-+ } else if (filldir(dirent, sfep->name, sfep->namelen,
- off & 0x7fffffff, ino, DT_UNKNOWN)) {
- *offset = off & 0x7fffffff;
- return 0;
-diff -urNp linux-2.6.32.45/grsecurity/gracl_alloc.c linux-2.6.32.45/grsecurity/gracl_alloc.c
---- linux-2.6.32.45/grsecurity/gracl_alloc.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/grsecurity/gracl_alloc.c 2011-04-17 15:56:46.000000000 -0400
-@@ -0,0 +1,105 @@
-+#include <linux/kernel.h>
-+#include <linux/mm.h>
-+#include <linux/slab.h>
-+#include <linux/vmalloc.h>
-+#include <linux/gracl.h>
-+#include <linux/grsecurity.h>
-+
-+static unsigned long alloc_stack_next = 1;
-+static unsigned long alloc_stack_size = 1;
-+static void **alloc_stack;
-+
-+static __inline__ int
-+alloc_pop(void)
-+{
-+ if (alloc_stack_next == 1)
-+ return 0;
-+
-+ kfree(alloc_stack[alloc_stack_next - 2]);
-+
-+ alloc_stack_next--;
-+
-+ return 1;
-+}
-+
-+static __inline__ int
-+alloc_push(void *buf)
-+{
-+ if (alloc_stack_next >= alloc_stack_size)
-+ return 1;
-+
-+ alloc_stack[alloc_stack_next - 1] = buf;
-+
-+ alloc_stack_next++;
-+
-+ return 0;
-+}
-+
-+void *
-+acl_alloc(unsigned long len)
-+{
-+ void *ret = NULL;
-+
-+ if (!len || len > PAGE_SIZE)
-+ goto out;
-+
-+ ret = kmalloc(len, GFP_KERNEL);
-+
-+ if (ret) {
-+ if (alloc_push(ret)) {
-+ kfree(ret);
-+ ret = NULL;
-+ }
-+ }
-+
-+out:
-+ return ret;
-+}
-+
-+void *
-+acl_alloc_num(unsigned long num, unsigned long len)
-+{
-+ if (!len || (num > (PAGE_SIZE / len)))
-+ return NULL;
-+
-+ return acl_alloc(num * len);
-+}
-+
-+void
-+acl_free_all(void)
-+{
-+ if (gr_acl_is_enabled() || !alloc_stack)
-+ return;
-+
-+ while (alloc_pop()) ;
-+
-+ if (alloc_stack) {
-+ if ((alloc_stack_size * sizeof (void *)) <= PAGE_SIZE)
-+ kfree(alloc_stack);
-+ else
-+ vfree(alloc_stack);
-+ }
-+
-+ alloc_stack = NULL;
-+ alloc_stack_size = 1;
-+ alloc_stack_next = 1;
-+
-+ return;
-+}
-+
-+int
-+acl_alloc_stack_init(unsigned long size)
-+{
-+ if ((size * sizeof (void *)) <= PAGE_SIZE)
-+ alloc_stack =
-+ (void **) kmalloc(size * sizeof (void *), GFP_KERNEL);
-+ else
-+ alloc_stack = (void **) vmalloc(size * sizeof (void *));
-+
-+ alloc_stack_size = size;
-+
-+ if (!alloc_stack)
-+ return 0;
-+ else
-+ return 1;
-+}
-diff -urNp linux-2.6.32.45/grsecurity/gracl.c linux-2.6.32.45/grsecurity/gracl.c
---- linux-2.6.32.45/grsecurity/gracl.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/grsecurity/gracl.c 2011-07-14 20:02:48.000000000 -0400
-@@ -0,0 +1,4082 @@
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/sched.h>
-+#include <linux/mm.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/namei.h>
-+#include <linux/mount.h>
-+#include <linux/tty.h>
-+#include <linux/proc_fs.h>
-+#include <linux/smp_lock.h>
-+#include <linux/slab.h>
-+#include <linux/vmalloc.h>
-+#include <linux/types.h>
-+#include <linux/sysctl.h>
-+#include <linux/netdevice.h>
-+#include <linux/ptrace.h>
-+#include <linux/gracl.h>
-+#include <linux/gralloc.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+#include <linux/pid_namespace.h>
-+#include <linux/fdtable.h>
-+#include <linux/percpu.h>
-+
-+#include <asm/uaccess.h>
-+#include <asm/errno.h>
-+#include <asm/mman.h>
-+
-+static struct acl_role_db acl_role_set;
-+static struct name_db name_set;
-+static struct inodev_db inodev_set;
-+
-+/* for keeping track of userspace pointers used for subjects, so we
-+ can share references in the kernel as well
-+*/
-+
-+static struct dentry *real_root;
-+static struct vfsmount *real_root_mnt;
-+
-+static struct acl_subj_map_db subj_map_set;
-+
-+static struct acl_role_label *default_role;
-+
-+static struct acl_role_label *role_list;
-+
-+static u16 acl_sp_role_value;
-+
-+extern char *gr_shared_page[4];
-+static DEFINE_MUTEX(gr_dev_mutex);
-+DEFINE_RWLOCK(gr_inode_lock);
-+
-+struct gr_arg *gr_usermode;
-+
-+static unsigned int gr_status __read_only = GR_STATUS_INIT;
-+
-+extern int chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum);
-+extern void gr_clear_learn_entries(void);
-+
-+#ifdef CONFIG_GRKERNSEC_RESLOG
-+extern void gr_log_resource(const struct task_struct *task,
-+ const int res, const unsigned long wanted, const int gt);
-+#endif
-+
-+unsigned char *gr_system_salt;
-+unsigned char *gr_system_sum;
-+
-+static struct sprole_pw **acl_special_roles = NULL;
-+static __u16 num_sprole_pws = 0;
-+
-+static struct acl_role_label *kernel_role = NULL;
-+
-+static unsigned int gr_auth_attempts = 0;
-+static unsigned long gr_auth_expires = 0UL;
-+
-+#ifdef CONFIG_NET
-+extern struct vfsmount *sock_mnt;
-+#endif
-+extern struct vfsmount *pipe_mnt;
-+extern struct vfsmount *shm_mnt;
-+#ifdef CONFIG_HUGETLBFS
-+extern struct vfsmount *hugetlbfs_vfsmount;
-+#endif
-+
-+static struct acl_object_label *fakefs_obj_rw;
-+static struct acl_object_label *fakefs_obj_rwx;
-+
-+extern int gr_init_uidset(void);
-+extern void gr_free_uidset(void);
-+extern void gr_remove_uid(uid_t uid);
-+extern int gr_find_uid(uid_t uid);
-+
-+__inline__ int
-+gr_acl_is_enabled(void)
-+{
-+ return (gr_status & GR_READY);
-+}
-+
-+#ifdef CONFIG_BTRFS_FS
-+extern dev_t get_btrfs_dev_from_inode(struct inode *inode);
-+extern int btrfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat);
-+#endif
-+
-+static inline dev_t __get_dev(const struct dentry *dentry)
-+{
-+#ifdef CONFIG_BTRFS_FS
-+ if (dentry->d_inode->i_op && dentry->d_inode->i_op->getattr == &btrfs_getattr)
-+ return get_btrfs_dev_from_inode(dentry->d_inode);
-+ else
-+#endif
-+ return dentry->d_inode->i_sb->s_dev;
-+}
-+
-+dev_t gr_get_dev_from_dentry(struct dentry *dentry)
-+{
-+ return __get_dev(dentry);
-+}
-+
-+static char gr_task_roletype_to_char(struct task_struct *task)
-+{
-+ switch (task->role->roletype &
-+ (GR_ROLE_DEFAULT | GR_ROLE_USER | GR_ROLE_GROUP |
-+ GR_ROLE_SPECIAL)) {
-+ case GR_ROLE_DEFAULT:
-+ return 'D';
-+ case GR_ROLE_USER:
-+ return 'U';
-+ case GR_ROLE_GROUP:
-+ return 'G';
-+ case GR_ROLE_SPECIAL:
-+ return 'S';
-+ }
-+
-+ return 'X';
-+}
-+
-+char gr_roletype_to_char(void)
-+{
-+ return gr_task_roletype_to_char(current);
-+}
-+
-+__inline__ int
-+gr_acl_tpe_check(void)
-+{
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return 0;
-+ if (current->role->roletype & GR_ROLE_TPE)
-+ return 1;
-+ else
-+ return 0;
-+}
-+
-+int
-+gr_handle_rawio(const struct inode *inode)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
-+ if (inode && S_ISBLK(inode->i_mode) &&
-+ grsec_enable_chroot_caps && proc_is_chrooted(current) &&
-+ !capable(CAP_SYS_RAWIO))
-+ return 1;
-+#endif
-+ return 0;
-+}
-+
-+static int
-+gr_streq(const char *a, const char *b, const unsigned int lena, const unsigned int lenb)
-+{
-+ if (likely(lena != lenb))
-+ return 0;
-+
-+ return !memcmp(a, b, lena);
-+}
-+
-+/* this must be called with vfsmount_lock and dcache_lock held */
-+
-+static char * __our_d_path(struct dentry *dentry, struct vfsmount *vfsmnt,
-+ struct dentry *root, struct vfsmount *rootmnt,
-+ char *buffer, int buflen)
-+{
-+ char * end = buffer+buflen;
-+ char * retval;
-+ int namelen;
-+
-+ *--end = '\0';
-+ buflen--;
-+
-+ if (buflen < 1)
-+ goto Elong;
-+ /* Get '/' right */
-+ retval = end-1;
-+ *retval = '/';
-+
-+ for (;;) {
-+ struct dentry * parent;
-+
-+ if (dentry == root && vfsmnt == rootmnt)
-+ break;
-+ if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
-+ /* Global root? */
-+ if (vfsmnt->mnt_parent == vfsmnt)
-+ goto global_root;
-+ dentry = vfsmnt->mnt_mountpoint;
-+ vfsmnt = vfsmnt->mnt_parent;
-+ continue;
-+ }
-+ parent = dentry->d_parent;
-+ prefetch(parent);
-+ namelen = dentry->d_name.len;
-+ buflen -= namelen + 1;
-+ if (buflen < 0)
-+ goto Elong;
-+ end -= namelen;
-+ memcpy(end, dentry->d_name.name, namelen);
-+ *--end = '/';
-+ retval = end;
-+ dentry = parent;
-+ }
-+
-+out:
-+ return retval;
-+
-+global_root:
-+ namelen = dentry->d_name.len;
-+ buflen -= namelen;
-+ if (buflen < 0)
-+ goto Elong;
-+ retval -= namelen-1; /* hit the slash */
-+ memcpy(retval, dentry->d_name.name, namelen);
-+ goto out;
-+Elong:
-+ retval = ERR_PTR(-ENAMETOOLONG);
-+ goto out;
-+}
-+
-+static char *
-+gen_full_path(struct dentry *dentry, struct vfsmount *vfsmnt,
-+ struct dentry *root, struct vfsmount *rootmnt, char *buf, int buflen)
-+{
-+ char *retval;
-+
-+ retval = __our_d_path(dentry, vfsmnt, root, rootmnt, buf, buflen);
-+ if (unlikely(IS_ERR(retval)))
-+ retval = strcpy(buf, "<path too long>");
-+ else if (unlikely(retval[1] == '/' && retval[2] == '\0'))
-+ retval[1] = '\0';
-+
-+ return retval;
-+}
-+
-+static char *
-+__d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
-+ char *buf, int buflen)
-+{
-+ char *res;
-+
-+ /* we can use real_root, real_root_mnt, because this is only called
-+ by the RBAC system */
-+ res = gen_full_path((struct dentry *)dentry, (struct vfsmount *)vfsmnt, real_root, real_root_mnt, buf, buflen);
-+
-+ return res;
-+}
-+
-+static char *
-+d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
-+ char *buf, int buflen)
-+{
-+ char *res;
-+ struct dentry *root;
-+ struct vfsmount *rootmnt;
-+ struct task_struct *reaper = &init_task;
-+
-+ /* we can't use real_root, real_root_mnt, because they belong only to the RBAC system */
-+ read_lock(&reaper->fs->lock);
-+ root = dget(reaper->fs->root.dentry);
-+ rootmnt = mntget(reaper->fs->root.mnt);
-+ read_unlock(&reaper->fs->lock);
-+
-+ spin_lock(&dcache_lock);
-+ spin_lock(&vfsmount_lock);
-+ res = gen_full_path((struct dentry *)dentry, (struct vfsmount *)vfsmnt, root, rootmnt, buf, buflen);
-+ spin_unlock(&vfsmount_lock);
-+ spin_unlock(&dcache_lock);
-+
-+ dput(root);
-+ mntput(rootmnt);
-+ return res;
-+}
-+
-+static char *
-+gr_to_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ char *ret;
-+ spin_lock(&dcache_lock);
-+ spin_lock(&vfsmount_lock);
-+ ret = __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
-+ PAGE_SIZE);
-+ spin_unlock(&vfsmount_lock);
-+ spin_unlock(&dcache_lock);
-+ return ret;
-+}
-+
-+char *
-+gr_to_filename_nolock(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
-+ PAGE_SIZE);
-+}
-+
-+char *
-+gr_to_filename(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
-+ PAGE_SIZE);
-+}
-+
-+char *
-+gr_to_filename1(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[1], smp_processor_id()),
-+ PAGE_SIZE);
-+}
-+
-+char *
-+gr_to_filename2(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[2], smp_processor_id()),
-+ PAGE_SIZE);
-+}
-+
-+char *
-+gr_to_filename3(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[3], smp_processor_id()),
-+ PAGE_SIZE);
-+}
-+
-+__inline__ __u32
-+to_gr_audit(const __u32 reqmode)
-+{
-+ /* masks off auditable permission flags, then shifts them to create
-+ auditing flags, and adds the special case of append auditing if
-+ we're requesting write */
-+ return (((reqmode & ~GR_AUDITS) << 10) | ((reqmode & GR_WRITE) ? GR_AUDIT_APPEND : 0));
-+}
-+
-+struct acl_subject_label *
-+lookup_subject_map(const struct acl_subject_label *userp)
-+{
-+ unsigned int index = shash(userp, subj_map_set.s_size);
-+ struct subject_map *match;
-+
-+ match = subj_map_set.s_hash[index];
-+
-+ while (match && match->user != userp)
-+ match = match->next;
-+
-+ if (match != NULL)
-+ return match->kernel;
-+ else
-+ return NULL;
-+}
-+
-+static void
-+insert_subj_map_entry(struct subject_map *subjmap)
-+{
-+ unsigned int index = shash(subjmap->user, subj_map_set.s_size);
-+ struct subject_map **curr;
-+
-+ subjmap->prev = NULL;
-+
-+ curr = &subj_map_set.s_hash[index];
-+ if (*curr != NULL)
-+ (*curr)->prev = subjmap;
-+
-+ subjmap->next = *curr;
-+ *curr = subjmap;
-+
-+ return;
-+}
-+
-+static struct acl_role_label *
-+lookup_acl_role_label(const struct task_struct *task, const uid_t uid,
-+ const gid_t gid)
-+{
-+ unsigned int index = rhash(uid, GR_ROLE_USER, acl_role_set.r_size);
-+ struct acl_role_label *match;
-+ struct role_allowed_ip *ipp;
-+ unsigned int x;
-+ u32 curr_ip = task->signal->curr_ip;
-+
-+ task->signal->saved_ip = curr_ip;
-+
-+ match = acl_role_set.r_hash[index];
-+
-+ while (match) {
-+ if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_USER)) == (GR_ROLE_DOMAIN | GR_ROLE_USER)) {
-+ for (x = 0; x < match->domain_child_num; x++) {
-+ if (match->domain_children[x] == uid)
-+ goto found;
-+ }
-+ } else if (match->uidgid == uid && match->roletype & GR_ROLE_USER)
-+ break;
-+ match = match->next;
-+ }
-+found:
-+ if (match == NULL) {
-+ try_group:
-+ index = rhash(gid, GR_ROLE_GROUP, acl_role_set.r_size);
-+ match = acl_role_set.r_hash[index];
-+
-+ while (match) {
-+ if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) == (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) {
-+ for (x = 0; x < match->domain_child_num; x++) {
-+ if (match->domain_children[x] == gid)
-+ goto found2;
-+ }
-+ } else if (match->uidgid == gid && match->roletype & GR_ROLE_GROUP)
-+ break;
-+ match = match->next;
-+ }
-+found2:
-+ if (match == NULL)
-+ match = default_role;
-+ if (match->allowed_ips == NULL)
-+ return match;
-+ else {
-+ for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
-+ if (likely
-+ ((ntohl(curr_ip) & ipp->netmask) ==
-+ (ntohl(ipp->addr) & ipp->netmask)))
-+ return match;
-+ }
-+ match = default_role;
-+ }
-+ } else if (match->allowed_ips == NULL) {
-+ return match;
-+ } else {
-+ for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
-+ if (likely
-+ ((ntohl(curr_ip) & ipp->netmask) ==
-+ (ntohl(ipp->addr) & ipp->netmask)))
-+ return match;
-+ }
-+ goto try_group;
-+ }
-+
-+ return match;
-+}
-+
-+struct acl_subject_label *
-+lookup_acl_subj_label(const ino_t ino, const dev_t dev,
-+ const struct acl_role_label *role)
-+{
-+ unsigned int index = fhash(ino, dev, role->subj_hash_size);
-+ struct acl_subject_label *match;
-+
-+ match = role->subj_hash[index];
-+
-+ while (match && (match->inode != ino || match->device != dev ||
-+ (match->mode & GR_DELETED))) {
-+ match = match->next;
-+ }
-+
-+ if (match && !(match->mode & GR_DELETED))
-+ return match;
-+ else
-+ return NULL;
-+}
-+
-+struct acl_subject_label *
-+lookup_acl_subj_label_deleted(const ino_t ino, const dev_t dev,
-+ const struct acl_role_label *role)
-+{
-+ unsigned int index = fhash(ino, dev, role->subj_hash_size);
-+ struct acl_subject_label *match;
-+
-+ match = role->subj_hash[index];
-+
-+ while (match && (match->inode != ino || match->device != dev ||
-+ !(match->mode & GR_DELETED))) {
-+ match = match->next;
-+ }
-+
-+ if (match && (match->mode & GR_DELETED))
-+ return match;
-+ else
-+ return NULL;
-+}
-+
-+static struct acl_object_label *
-+lookup_acl_obj_label(const ino_t ino, const dev_t dev,
-+ const struct acl_subject_label *subj)
-+{
-+ unsigned int index = fhash(ino, dev, subj->obj_hash_size);
-+ struct acl_object_label *match;
-+
-+ match = subj->obj_hash[index];
-+
-+ while (match && (match->inode != ino || match->device != dev ||
-+ (match->mode & GR_DELETED))) {
-+ match = match->next;
-+ }
-+
-+ if (match && !(match->mode & GR_DELETED))
-+ return match;
-+ else
-+ return NULL;
-+}
-+
-+static struct acl_object_label *
-+lookup_acl_obj_label_create(const ino_t ino, const dev_t dev,
-+ const struct acl_subject_label *subj)
-+{
-+ unsigned int index = fhash(ino, dev, subj->obj_hash_size);
-+ struct acl_object_label *match;
-+
-+ match = subj->obj_hash[index];
-+
-+ while (match && (match->inode != ino || match->device != dev ||
-+ !(match->mode & GR_DELETED))) {
-+ match = match->next;
-+ }
-+
-+ if (match && (match->mode & GR_DELETED))
-+ return match;
-+
-+ match = subj->obj_hash[index];
-+
-+ while (match && (match->inode != ino || match->device != dev ||
-+ (match->mode & GR_DELETED))) {
-+ match = match->next;
-+ }
-+
-+ if (match && !(match->mode & GR_DELETED))
-+ return match;
-+ else
-+ return NULL;
-+}
-+
-+static struct name_entry *
-+lookup_name_entry(const char *name)
-+{
-+ unsigned int len = strlen(name);
-+ unsigned int key = full_name_hash(name, len);
-+ unsigned int index = key % name_set.n_size;
-+ struct name_entry *match;
-+
-+ match = name_set.n_hash[index];
-+
-+ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len)))
-+ match = match->next;
-+
-+ return match;
-+}
-+
-+static struct name_entry *
-+lookup_name_entry_create(const char *name)
-+{
-+ unsigned int len = strlen(name);
-+ unsigned int key = full_name_hash(name, len);
-+ unsigned int index = key % name_set.n_size;
-+ struct name_entry *match;
-+
-+ match = name_set.n_hash[index];
-+
-+ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
-+ !match->deleted))
-+ match = match->next;
-+
-+ if (match && match->deleted)
-+ return match;
-+
-+ match = name_set.n_hash[index];
-+
-+ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
-+ match->deleted))
-+ match = match->next;
-+
-+ if (match && !match->deleted)
-+ return match;
-+ else
-+ return NULL;
-+}
-+
-+static struct inodev_entry *
-+lookup_inodev_entry(const ino_t ino, const dev_t dev)
-+{
-+ unsigned int index = fhash(ino, dev, inodev_set.i_size);
-+ struct inodev_entry *match;
-+
-+ match = inodev_set.i_hash[index];
-+
-+ while (match && (match->nentry->inode != ino || match->nentry->device != dev))
-+ match = match->next;
-+
-+ return match;
-+}
-+
-+static void
-+insert_inodev_entry(struct inodev_entry *entry)
-+{
-+ unsigned int index = fhash(entry->nentry->inode, entry->nentry->device,
-+ inodev_set.i_size);
-+ struct inodev_entry **curr;
-+
-+ entry->prev = NULL;
-+
-+ curr = &inodev_set.i_hash[index];
-+ if (*curr != NULL)
-+ (*curr)->prev = entry;
-+
-+ entry->next = *curr;
-+ *curr = entry;
-+
-+ return;
-+}
-+
-+static void
-+__insert_acl_role_label(struct acl_role_label *role, uid_t uidgid)
-+{
-+ unsigned int index =
-+ rhash(uidgid, role->roletype & (GR_ROLE_USER | GR_ROLE_GROUP), acl_role_set.r_size);
-+ struct acl_role_label **curr;
-+ struct acl_role_label *tmp;
-+
-+ curr = &acl_role_set.r_hash[index];
-+
-+ /* if role was already inserted due to domains and already has
-+ a role in the same bucket as it attached, then we need to
-+ combine these two buckets
-+ */
-+ if (role->next) {
-+ tmp = role->next;
-+ while (tmp->next)
-+ tmp = tmp->next;
-+ tmp->next = *curr;
-+ } else
-+ role->next = *curr;
-+ *curr = role;
-+
-+ return;
-+}
-+
-+static void
-+insert_acl_role_label(struct acl_role_label *role)
-+{
-+ int i;
-+
-+ if (role_list == NULL) {
-+ role_list = role;
-+ role->prev = NULL;
-+ } else {
-+ role->prev = role_list;
-+ role_list = role;
-+ }
-+
-+ /* used for hash chains */
-+ role->next = NULL;
-+
-+ if (role->roletype & GR_ROLE_DOMAIN) {
-+ for (i = 0; i < role->domain_child_num; i++)
-+ __insert_acl_role_label(role, role->domain_children[i]);
-+ } else
-+ __insert_acl_role_label(role, role->uidgid);
-+}
-+
-+static int
-+insert_name_entry(char *name, const ino_t inode, const dev_t device, __u8 deleted)
-+{
-+ struct name_entry **curr, *nentry;
-+ struct inodev_entry *ientry;
-+ unsigned int len = strlen(name);
-+ unsigned int key = full_name_hash(name, len);
-+ unsigned int index = key % name_set.n_size;
-+
-+ curr = &name_set.n_hash[index];
-+
-+ while (*curr && ((*curr)->key != key || !gr_streq((*curr)->name, name, (*curr)->len, len)))
-+ curr = &((*curr)->next);
-+
-+ if (*curr != NULL)
-+ return 1;
-+
-+ nentry = acl_alloc(sizeof (struct name_entry));
-+ if (nentry == NULL)
-+ return 0;
-+ ientry = acl_alloc(sizeof (struct inodev_entry));
-+ if (ientry == NULL)
-+ return 0;
-+ ientry->nentry = nentry;
-+
-+ nentry->key = key;
-+ nentry->name = name;
-+ nentry->inode = inode;
-+ nentry->device = device;
-+ nentry->len = len;
-+ nentry->deleted = deleted;
-+
-+ nentry->prev = NULL;
-+ curr = &name_set.n_hash[index];
-+ if (*curr != NULL)
-+ (*curr)->prev = nentry;
-+ nentry->next = *curr;
-+ *curr = nentry;
-+
-+ /* insert us into the table searchable by inode/dev */
-+ insert_inodev_entry(ientry);
-+
-+ return 1;
-+}
-+
-+static void
-+insert_acl_obj_label(struct acl_object_label *obj,
-+ struct acl_subject_label *subj)
-+{
-+ unsigned int index =
-+ fhash(obj->inode, obj->device, subj->obj_hash_size);
-+ struct acl_object_label **curr;
-+
-+
-+ obj->prev = NULL;
-+
-+ curr = &subj->obj_hash[index];
-+ if (*curr != NULL)
-+ (*curr)->prev = obj;
-+
-+ obj->next = *curr;
-+ *curr = obj;
-+
-+ return;
-+}
-+
-+static void
-+insert_acl_subj_label(struct acl_subject_label *obj,
-+ struct acl_role_label *role)
-+{
-+ unsigned int index = fhash(obj->inode, obj->device, role->subj_hash_size);
-+ struct acl_subject_label **curr;
-+
-+ obj->prev = NULL;
-+
-+ curr = &role->subj_hash[index];
-+ if (*curr != NULL)
-+ (*curr)->prev = obj;
-+
-+ obj->next = *curr;
-+ *curr = obj;
-+
-+ return;
-+}
-+
-+/* allocating chained hash tables, so optimal size is where lambda ~ 1 */
-+
-+static void *
-+create_table(__u32 * len, int elementsize)
-+{
-+ unsigned int table_sizes[] = {
-+ 7, 13, 31, 61, 127, 251, 509, 1021, 2039, 4093, 8191, 16381,
-+ 32749, 65521, 131071, 262139, 524287, 1048573, 2097143,
-+ 4194301, 8388593, 16777213, 33554393, 67108859
-+ };
-+ void *newtable = NULL;
-+ unsigned int pwr = 0;
-+
-+ while ((pwr < ((sizeof (table_sizes) / sizeof (table_sizes[0])) - 1)) &&
-+ table_sizes[pwr] <= *len)
-+ pwr++;
-+
-+ if (table_sizes[pwr] <= *len || (table_sizes[pwr] > ULONG_MAX / elementsize))
-+ return newtable;
-+
-+ if ((table_sizes[pwr] * elementsize) <= PAGE_SIZE)
-+ newtable =
-+ kmalloc(table_sizes[pwr] * elementsize, GFP_KERNEL);
-+ else
-+ newtable = vmalloc(table_sizes[pwr] * elementsize);
-+
-+ *len = table_sizes[pwr];
-+
-+ return newtable;
-+}
-+
-+static int
-+init_variables(const struct gr_arg *arg)
-+{
-+ struct task_struct *reaper = &init_task;
-+ unsigned int stacksize;
-+
-+ subj_map_set.s_size = arg->role_db.num_subjects;
-+ acl_role_set.r_size = arg->role_db.num_roles + arg->role_db.num_domain_children;
-+ name_set.n_size = arg->role_db.num_objects;
-+ inodev_set.i_size = arg->role_db.num_objects;
-+
-+ if (!subj_map_set.s_size || !acl_role_set.r_size ||
-+ !name_set.n_size || !inodev_set.i_size)
-+ return 1;
-+
-+ if (!gr_init_uidset())
-+ return 1;
-+
-+ /* set up the stack that holds allocation info */
-+
-+ stacksize = arg->role_db.num_pointers + 5;
-+
-+ if (!acl_alloc_stack_init(stacksize))
-+ return 1;
-+
-+ /* grab reference for the real root dentry and vfsmount */
-+ read_lock(&reaper->fs->lock);
-+ real_root = dget(reaper->fs->root.dentry);
-+ real_root_mnt = mntget(reaper->fs->root.mnt);
-+ read_unlock(&reaper->fs->lock);
-+
-+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
-+ printk(KERN_ALERT "Obtained real root device=%d, inode=%lu\n", __get_dev(real_root), real_root->d_inode->i_ino);
-+#endif
-+
-+ fakefs_obj_rw = acl_alloc(sizeof(struct acl_object_label));
-+ if (fakefs_obj_rw == NULL)
-+ return 1;
-+ fakefs_obj_rw->mode = GR_FIND | GR_READ | GR_WRITE;
-+
-+ fakefs_obj_rwx = acl_alloc(sizeof(struct acl_object_label));
-+ if (fakefs_obj_rwx == NULL)
-+ return 1;
-+ fakefs_obj_rwx->mode = GR_FIND | GR_READ | GR_WRITE | GR_EXEC;
-+
-+ subj_map_set.s_hash =
-+ (struct subject_map **) create_table(&subj_map_set.s_size, sizeof(void *));
-+ acl_role_set.r_hash =
-+ (struct acl_role_label **) create_table(&acl_role_set.r_size, sizeof(void *));
-+ name_set.n_hash = (struct name_entry **) create_table(&name_set.n_size, sizeof(void *));
-+ inodev_set.i_hash =
-+ (struct inodev_entry **) create_table(&inodev_set.i_size, sizeof(void *));
-+
-+ if (!subj_map_set.s_hash || !acl_role_set.r_hash ||
-+ !name_set.n_hash || !inodev_set.i_hash)
-+ return 1;
-+
-+ memset(subj_map_set.s_hash, 0,
-+ sizeof(struct subject_map *) * subj_map_set.s_size);
-+ memset(acl_role_set.r_hash, 0,
-+ sizeof (struct acl_role_label *) * acl_role_set.r_size);
-+ memset(name_set.n_hash, 0,
-+ sizeof (struct name_entry *) * name_set.n_size);
-+ memset(inodev_set.i_hash, 0,
-+ sizeof (struct inodev_entry *) * inodev_set.i_size);
-+
-+ return 0;
-+}
-+
-+/* free information not needed after startup
-+ currently contains user->kernel pointer mappings for subjects
-+*/
-+
-+static void
-+free_init_variables(void)
-+{
-+ __u32 i;
-+
-+ if (subj_map_set.s_hash) {
-+ for (i = 0; i < subj_map_set.s_size; i++) {
-+ if (subj_map_set.s_hash[i]) {
-+ kfree(subj_map_set.s_hash[i]);
-+ subj_map_set.s_hash[i] = NULL;
-+ }
-+ }
-+
-+ if ((subj_map_set.s_size * sizeof (struct subject_map *)) <=
-+ PAGE_SIZE)
-+ kfree(subj_map_set.s_hash);
-+ else
-+ vfree(subj_map_set.s_hash);
-+ }
-+
-+ return;
-+}
-+
-+static void
-+free_variables(void)
-+{
-+ struct acl_subject_label *s;
-+ struct acl_role_label *r;
-+ struct task_struct *task, *task2;
-+ unsigned int x;
-+
-+ gr_clear_learn_entries();
-+
-+ read_lock(&tasklist_lock);
-+ do_each_thread(task2, task) {
-+ task->acl_sp_role = 0;
-+ task->acl_role_id = 0;
-+ task->acl = NULL;
-+ task->role = NULL;
-+ } while_each_thread(task2, task);
-+ read_unlock(&tasklist_lock);
-+
-+ /* release the reference to the real root dentry and vfsmount */
-+ if (real_root)
-+ dput(real_root);
-+ real_root = NULL;
-+ if (real_root_mnt)
-+ mntput(real_root_mnt);
-+ real_root_mnt = NULL;
-+
-+ /* free all object hash tables */
-+
-+ FOR_EACH_ROLE_START(r)
-+ if (r->subj_hash == NULL)
-+ goto next_role;
-+ FOR_EACH_SUBJECT_START(r, s, x)
-+ if (s->obj_hash == NULL)
-+ break;
-+ if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
-+ kfree(s->obj_hash);
-+ else
-+ vfree(s->obj_hash);
-+ FOR_EACH_SUBJECT_END(s, x)
-+ FOR_EACH_NESTED_SUBJECT_START(r, s)
-+ if (s->obj_hash == NULL)
-+ break;
-+ if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
-+ kfree(s->obj_hash);
-+ else
-+ vfree(s->obj_hash);
-+ FOR_EACH_NESTED_SUBJECT_END(s)
-+ if ((r->subj_hash_size * sizeof (struct acl_subject_label *)) <= PAGE_SIZE)
-+ kfree(r->subj_hash);
-+ else
-+ vfree(r->subj_hash);
-+ r->subj_hash = NULL;
-+next_role:
-+ FOR_EACH_ROLE_END(r)
-+
-+ acl_free_all();
-+
-+ if (acl_role_set.r_hash) {
-+ if ((acl_role_set.r_size * sizeof (struct acl_role_label *)) <=
-+ PAGE_SIZE)
-+ kfree(acl_role_set.r_hash);
-+ else
-+ vfree(acl_role_set.r_hash);
-+ }
-+ if (name_set.n_hash) {
-+ if ((name_set.n_size * sizeof (struct name_entry *)) <=
-+ PAGE_SIZE)
-+ kfree(name_set.n_hash);
-+ else
-+ vfree(name_set.n_hash);
-+ }
-+
-+ if (inodev_set.i_hash) {
-+ if ((inodev_set.i_size * sizeof (struct inodev_entry *)) <=
-+ PAGE_SIZE)
-+ kfree(inodev_set.i_hash);
-+ else
-+ vfree(inodev_set.i_hash);
-+ }
-+
-+ gr_free_uidset();
-+
-+ memset(&name_set, 0, sizeof (struct name_db));
-+ memset(&inodev_set, 0, sizeof (struct inodev_db));
-+ memset(&acl_role_set, 0, sizeof (struct acl_role_db));
-+ memset(&subj_map_set, 0, sizeof (struct acl_subj_map_db));
-+
-+ default_role = NULL;
-+ role_list = NULL;
-+
-+ return;
-+}
-+
-+static __u32
-+count_user_objs(struct acl_object_label *userp)
-+{
-+ struct acl_object_label o_tmp;
-+ __u32 num = 0;
-+
-+ while (userp) {
-+ if (copy_from_user(&o_tmp, userp,
-+ sizeof (struct acl_object_label)))
-+ break;
-+
-+ userp = o_tmp.prev;
-+ num++;
-+ }
-+
-+ return num;
-+}
-+
-+static struct acl_subject_label *
-+do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role);
-+
-+static int
-+copy_user_glob(struct acl_object_label *obj)
-+{
-+ struct acl_object_label *g_tmp, **guser;
-+ unsigned int len;
-+ char *tmp;
-+
-+ if (obj->globbed == NULL)
-+ return 0;
-+
-+ guser = &obj->globbed;
-+ while (*guser) {
-+ g_tmp = (struct acl_object_label *)
-+ acl_alloc(sizeof (struct acl_object_label));
-+ if (g_tmp == NULL)
-+ return -ENOMEM;
-+
-+ if (copy_from_user(g_tmp, *guser,
-+ sizeof (struct acl_object_label)))
-+ return -EFAULT;
-+
-+ len = strnlen_user(g_tmp->filename, PATH_MAX);
-+
-+ if (!len || len >= PATH_MAX)
-+ return -EINVAL;
-+
-+ if ((tmp = (char *) acl_alloc(len)) == NULL)
-+ return -ENOMEM;
-+
-+ if (copy_from_user(tmp, g_tmp->filename, len))
-+ return -EFAULT;
-+ tmp[len-1] = '\0';
-+ g_tmp->filename = tmp;
-+
-+ *guser = g_tmp;
-+ guser = &(g_tmp->next);
-+ }
-+
-+ return 0;
-+}
-+
-+static int
-+copy_user_objs(struct acl_object_label *userp, struct acl_subject_label *subj,
-+ struct acl_role_label *role)
-+{
-+ struct acl_object_label *o_tmp;
-+ unsigned int len;
-+ int ret;
-+ char *tmp;
-+
-+ while (userp) {
-+ if ((o_tmp = (struct acl_object_label *)
-+ acl_alloc(sizeof (struct acl_object_label))) == NULL)
-+ return -ENOMEM;
-+
-+ if (copy_from_user(o_tmp, userp,
-+ sizeof (struct acl_object_label)))
-+ return -EFAULT;
-+
-+ userp = o_tmp->prev;
-+
-+ len = strnlen_user(o_tmp->filename, PATH_MAX);
-+
-+ if (!len || len >= PATH_MAX)
-+ return -EINVAL;
-+
-+ if ((tmp = (char *) acl_alloc(len)) == NULL)
-+ return -ENOMEM;
-+
-+ if (copy_from_user(tmp, o_tmp->filename, len))
-+ return -EFAULT;
-+ tmp[len-1] = '\0';
-+ o_tmp->filename = tmp;
-+
-+ insert_acl_obj_label(o_tmp, subj);
-+ if (!insert_name_entry(o_tmp->filename, o_tmp->inode,
-+ o_tmp->device, (o_tmp->mode & GR_DELETED) ? 1 : 0))
-+ return -ENOMEM;
-+
-+ ret = copy_user_glob(o_tmp);
-+ if (ret)
-+ return ret;
-+
-+ if (o_tmp->nested) {
-+ o_tmp->nested = do_copy_user_subj(o_tmp->nested, role);
-+ if (IS_ERR(o_tmp->nested))
-+ return PTR_ERR(o_tmp->nested);
-+
-+ /* insert into nested subject list */
-+ o_tmp->nested->next = role->hash->first;
-+ role->hash->first = o_tmp->nested;
-+ }
-+ }
-+
-+ return 0;
-+}
-+
-+static __u32
-+count_user_subjs(struct acl_subject_label *userp)
-+{
-+ struct acl_subject_label s_tmp;
-+ __u32 num = 0;
-+
-+ while (userp) {
-+ if (copy_from_user(&s_tmp, userp,
-+ sizeof (struct acl_subject_label)))
-+ break;
-+
-+ userp = s_tmp.prev;
-+ /* do not count nested subjects against this count, since
-+ they are not included in the hash table, but are
-+ attached to objects. We have already counted
-+ the subjects in userspace for the allocation
-+ stack
-+ */
-+ if (!(s_tmp.mode & GR_NESTED))
-+ num++;
-+ }
-+
-+ return num;
-+}
-+
-+static int
-+copy_user_allowedips(struct acl_role_label *rolep)
-+{
-+ struct role_allowed_ip *ruserip, *rtmp = NULL, *rlast;
-+
-+ ruserip = rolep->allowed_ips;
-+
-+ while (ruserip) {
-+ rlast = rtmp;
-+
-+ if ((rtmp = (struct role_allowed_ip *)
-+ acl_alloc(sizeof (struct role_allowed_ip))) == NULL)
-+ return -ENOMEM;
-+
-+ if (copy_from_user(rtmp, ruserip,
-+ sizeof (struct role_allowed_ip)))
-+ return -EFAULT;
-+
-+ ruserip = rtmp->prev;
-+
-+ if (!rlast) {
-+ rtmp->prev = NULL;
-+ rolep->allowed_ips = rtmp;
-+ } else {
-+ rlast->next = rtmp;
-+ rtmp->prev = rlast;
-+ }
-+
-+ if (!ruserip)
-+ rtmp->next = NULL;
-+ }
-+
-+ return 0;
-+}
-+
-+static int
-+copy_user_transitions(struct acl_role_label *rolep)
-+{
-+ struct role_transition *rusertp, *rtmp = NULL, *rlast;
-+
-+ unsigned int len;
-+ char *tmp;
-+
-+ rusertp = rolep->transitions;
-+
-+ while (rusertp) {
-+ rlast = rtmp;
-+
-+ if ((rtmp = (struct role_transition *)
-+ acl_alloc(sizeof (struct role_transition))) == NULL)
-+ return -ENOMEM;
-+
-+ if (copy_from_user(rtmp, rusertp,
-+ sizeof (struct role_transition)))
-+ return -EFAULT;
-+
-+ rusertp = rtmp->prev;
-+
-+ len = strnlen_user(rtmp->rolename, GR_SPROLE_LEN);
-+
-+ if (!len || len >= GR_SPROLE_LEN)
-+ return -EINVAL;
-+
-+ if ((tmp = (char *) acl_alloc(len)) == NULL)
-+ return -ENOMEM;
-+
-+ if (copy_from_user(tmp, rtmp->rolename, len))
-+ return -EFAULT;
-+ tmp[len-1] = '\0';
-+ rtmp->rolename = tmp;
-+
-+ if (!rlast) {
-+ rtmp->prev = NULL;
-+ rolep->transitions = rtmp;
-+ } else {
-+ rlast->next = rtmp;
-+ rtmp->prev = rlast;
-+ }
-+
-+ if (!rusertp)
-+ rtmp->next = NULL;
-+ }
-+
-+ return 0;
-+}
-+
-+static struct acl_subject_label *
-+do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role)
-+{
-+ struct acl_subject_label *s_tmp = NULL, *s_tmp2;
-+ unsigned int len;
-+ char *tmp;
-+ __u32 num_objs;
-+ struct acl_ip_label **i_tmp, *i_utmp2;
-+ struct gr_hash_struct ghash;
-+ struct subject_map *subjmap;
-+ unsigned int i_num;
-+ int err;
-+
-+ s_tmp = lookup_subject_map(userp);
-+
-+ /* we've already copied this subject into the kernel, just return
-+ the reference to it, and don't copy it over again
-+ */
-+ if (s_tmp)
-+ return(s_tmp);
-+
-+ if ((s_tmp = (struct acl_subject_label *)
-+ acl_alloc(sizeof (struct acl_subject_label))) == NULL)
-+ return ERR_PTR(-ENOMEM);
-+
-+ subjmap = (struct subject_map *)kmalloc(sizeof (struct subject_map), GFP_KERNEL);
-+ if (subjmap == NULL)
-+ return ERR_PTR(-ENOMEM);
-+
-+ subjmap->user = userp;
-+ subjmap->kernel = s_tmp;
-+ insert_subj_map_entry(subjmap);
-+
-+ if (copy_from_user(s_tmp, userp,
-+ sizeof (struct acl_subject_label)))
-+ return ERR_PTR(-EFAULT);
-+
-+ len = strnlen_user(s_tmp->filename, PATH_MAX);
-+
-+ if (!len || len >= PATH_MAX)
-+ return ERR_PTR(-EINVAL);
-+
-+ if ((tmp = (char *) acl_alloc(len)) == NULL)
-+ return ERR_PTR(-ENOMEM);
-+
-+ if (copy_from_user(tmp, s_tmp->filename, len))
-+ return ERR_PTR(-EFAULT);
-+ tmp[len-1] = '\0';
-+ s_tmp->filename = tmp;
-+
-+ if (!strcmp(s_tmp->filename, "/"))
-+ role->root_label = s_tmp;
-+
-+ if (copy_from_user(&ghash, s_tmp->hash, sizeof(struct gr_hash_struct)))
-+ return ERR_PTR(-EFAULT);
-+
-+ /* copy user and group transition tables */
-+
-+ if (s_tmp->user_trans_num) {
-+ uid_t *uidlist;
-+
-+ uidlist = (uid_t *)acl_alloc_num(s_tmp->user_trans_num, sizeof(uid_t));
-+ if (uidlist == NULL)
-+ return ERR_PTR(-ENOMEM);
-+ if (copy_from_user(uidlist, s_tmp->user_transitions, s_tmp->user_trans_num * sizeof(uid_t)))
-+ return ERR_PTR(-EFAULT);
-+
-+ s_tmp->user_transitions = uidlist;
-+ }
-+
-+ if (s_tmp->group_trans_num) {
-+ gid_t *gidlist;
-+
-+ gidlist = (gid_t *)acl_alloc_num(s_tmp->group_trans_num, sizeof(gid_t));
-+ if (gidlist == NULL)
-+ return ERR_PTR(-ENOMEM);
-+ if (copy_from_user(gidlist, s_tmp->group_transitions, s_tmp->group_trans_num * sizeof(gid_t)))
-+ return ERR_PTR(-EFAULT);
-+
-+ s_tmp->group_transitions = gidlist;
-+ }
-+
-+ /* set up object hash table */
-+ num_objs = count_user_objs(ghash.first);
-+
-+ s_tmp->obj_hash_size = num_objs;
-+ s_tmp->obj_hash =
-+ (struct acl_object_label **)
-+ create_table(&(s_tmp->obj_hash_size), sizeof(void *));
-+
-+ if (!s_tmp->obj_hash)
-+ return ERR_PTR(-ENOMEM);
-+
-+ memset(s_tmp->obj_hash, 0,
-+ s_tmp->obj_hash_size *
-+ sizeof (struct acl_object_label *));
-+
-+ /* add in objects */
-+ err = copy_user_objs(ghash.first, s_tmp, role);
-+
-+ if (err)
-+ return ERR_PTR(err);
-+
-+ /* set pointer for parent subject */
-+ if (s_tmp->parent_subject) {
-+ s_tmp2 = do_copy_user_subj(s_tmp->parent_subject, role);
-+
-+ if (IS_ERR(s_tmp2))
-+ return s_tmp2;
-+
-+ s_tmp->parent_subject = s_tmp2;
-+ }
-+
-+ /* add in ip acls */
-+
-+ if (!s_tmp->ip_num) {
-+ s_tmp->ips = NULL;
-+ goto insert;
-+ }
-+
-+ i_tmp =
-+ (struct acl_ip_label **) acl_alloc_num(s_tmp->ip_num,
-+ sizeof (struct acl_ip_label *));
-+
-+ if (!i_tmp)
-+ return ERR_PTR(-ENOMEM);
-+
-+ for (i_num = 0; i_num < s_tmp->ip_num; i_num++) {
-+ *(i_tmp + i_num) =
-+ (struct acl_ip_label *)
-+ acl_alloc(sizeof (struct acl_ip_label));
-+ if (!*(i_tmp + i_num))
-+ return ERR_PTR(-ENOMEM);
-+
-+ if (copy_from_user
-+ (&i_utmp2, s_tmp->ips + i_num,
-+ sizeof (struct acl_ip_label *)))
-+ return ERR_PTR(-EFAULT);
-+
-+ if (copy_from_user
-+ (*(i_tmp + i_num), i_utmp2,
-+ sizeof (struct acl_ip_label)))
-+ return ERR_PTR(-EFAULT);
-+
-+ if ((*(i_tmp + i_num))->iface == NULL)
-+ continue;
-+
-+ len = strnlen_user((*(i_tmp + i_num))->iface, IFNAMSIZ);
-+ if (!len || len >= IFNAMSIZ)
-+ return ERR_PTR(-EINVAL);
-+ tmp = acl_alloc(len);
-+ if (tmp == NULL)
-+ return ERR_PTR(-ENOMEM);
-+ if (copy_from_user(tmp, (*(i_tmp + i_num))->iface, len))
-+ return ERR_PTR(-EFAULT);
-+ (*(i_tmp + i_num))->iface = tmp;
-+ }
-+
-+ s_tmp->ips = i_tmp;
-+
-+insert:
-+ if (!insert_name_entry(s_tmp->filename, s_tmp->inode,
-+ s_tmp->device, (s_tmp->mode & GR_DELETED) ? 1 : 0))
-+ return ERR_PTR(-ENOMEM);
-+
-+ return s_tmp;
-+}
-+
-+static int
-+copy_user_subjs(struct acl_subject_label *userp, struct acl_role_label *role)
-+{
-+ struct acl_subject_label s_pre;
-+ struct acl_subject_label * ret;
-+ int err;
-+
-+ while (userp) {
-+ if (copy_from_user(&s_pre, userp,
-+ sizeof (struct acl_subject_label)))
-+ return -EFAULT;
-+
-+ /* do not add nested subjects here, add
-+ while parsing objects
-+ */
-+
-+ if (s_pre.mode & GR_NESTED) {
-+ userp = s_pre.prev;
-+ continue;
-+ }
-+
-+ ret = do_copy_user_subj(userp, role);
-+
-+ err = PTR_ERR(ret);
-+ if (IS_ERR(ret))
-+ return err;
-+
-+ insert_acl_subj_label(ret, role);
-+
-+ userp = s_pre.prev;
-+ }
-+
-+ return 0;
-+}
-+
-+static int
-+copy_user_acl(struct gr_arg *arg)
-+{
-+ struct acl_role_label *r_tmp = NULL, **r_utmp, *r_utmp2;
-+ struct sprole_pw *sptmp;
-+ struct gr_hash_struct *ghash;
-+ uid_t *domainlist;
-+ unsigned int r_num;
-+ unsigned int len;
-+ char *tmp;
-+ int err = 0;
-+ __u16 i;
-+ __u32 num_subjs;
-+
-+ /* we need a default and kernel role */
-+ if (arg->role_db.num_roles < 2)
-+ return -EINVAL;
-+
-+ /* copy special role authentication info from userspace */
-+
-+ num_sprole_pws = arg->num_sprole_pws;
-+ acl_special_roles = (struct sprole_pw **) acl_alloc_num(num_sprole_pws, sizeof(struct sprole_pw *));
-+
-+ if (!acl_special_roles) {
-+ err = -ENOMEM;
-+ goto cleanup;
-+ }
-+
-+ for (i = 0; i < num_sprole_pws; i++) {
-+ sptmp = (struct sprole_pw *) acl_alloc(sizeof(struct sprole_pw));
-+ if (!sptmp) {
-+ err = -ENOMEM;
-+ goto cleanup;
-+ }
-+ if (copy_from_user(sptmp, arg->sprole_pws + i,
-+ sizeof (struct sprole_pw))) {
-+ err = -EFAULT;
-+ goto cleanup;
-+ }
-+
-+ len =
-+ strnlen_user(sptmp->rolename, GR_SPROLE_LEN);
-+
-+ if (!len || len >= GR_SPROLE_LEN) {
-+ err = -EINVAL;
-+ goto cleanup;
-+ }
-+
-+ if ((tmp = (char *) acl_alloc(len)) == NULL) {
-+ err = -ENOMEM;
-+ goto cleanup;
-+ }
-+
-+ if (copy_from_user(tmp, sptmp->rolename, len)) {
-+ err = -EFAULT;
-+ goto cleanup;
-+ }
-+ tmp[len-1] = '\0';
-+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
-+ printk(KERN_ALERT "Copying special role %s\n", tmp);
-+#endif
-+ sptmp->rolename = tmp;
-+ acl_special_roles[i] = sptmp;
-+ }
-+
-+ r_utmp = (struct acl_role_label **) arg->role_db.r_table;
-+
-+ for (r_num = 0; r_num < arg->role_db.num_roles; r_num++) {
-+ r_tmp = acl_alloc(sizeof (struct acl_role_label));
-+
-+ if (!r_tmp) {
-+ err = -ENOMEM;
-+ goto cleanup;
-+ }
-+
-+ if (copy_from_user(&r_utmp2, r_utmp + r_num,
-+ sizeof (struct acl_role_label *))) {
-+ err = -EFAULT;
-+ goto cleanup;
-+ }
-+
-+ if (copy_from_user(r_tmp, r_utmp2,
-+ sizeof (struct acl_role_label))) {
-+ err = -EFAULT;
-+ goto cleanup;
-+ }
-+
-+ len = strnlen_user(r_tmp->rolename, GR_SPROLE_LEN);
-+
-+ if (!len || len >= PATH_MAX) {
-+ err = -EINVAL;
-+ goto cleanup;
-+ }
-+
-+ if ((tmp = (char *) acl_alloc(len)) == NULL) {
-+ err = -ENOMEM;
-+ goto cleanup;
-+ }
-+ if (copy_from_user(tmp, r_tmp->rolename, len)) {
-+ err = -EFAULT;
-+ goto cleanup;
-+ }
-+ tmp[len-1] = '\0';
-+ r_tmp->rolename = tmp;
-+
-+ if (!strcmp(r_tmp->rolename, "default")
-+ && (r_tmp->roletype & GR_ROLE_DEFAULT)) {
-+ default_role = r_tmp;
-+ } else if (!strcmp(r_tmp->rolename, ":::kernel:::")) {
-+ kernel_role = r_tmp;
-+ }
-+
-+ if ((ghash = (struct gr_hash_struct *) acl_alloc(sizeof(struct gr_hash_struct))) == NULL) {
-+ err = -ENOMEM;
-+ goto cleanup;
-+ }
-+ if (copy_from_user(ghash, r_tmp->hash, sizeof(struct gr_hash_struct))) {
-+ err = -EFAULT;
-+ goto cleanup;
-+ }
-+
-+ r_tmp->hash = ghash;
-+
-+ num_subjs = count_user_subjs(r_tmp->hash->first);
-+
-+ r_tmp->subj_hash_size = num_subjs;
-+ r_tmp->subj_hash =
-+ (struct acl_subject_label **)
-+ create_table(&(r_tmp->subj_hash_size), sizeof(void *));
-+
-+ if (!r_tmp->subj_hash) {
-+ err = -ENOMEM;
-+ goto cleanup;
-+ }
-+
-+ err = copy_user_allowedips(r_tmp);
-+ if (err)
-+ goto cleanup;
-+
-+ /* copy domain info */
-+ if (r_tmp->domain_children != NULL) {
-+ domainlist = acl_alloc_num(r_tmp->domain_child_num, sizeof(uid_t));
-+ if (domainlist == NULL) {
-+ err = -ENOMEM;
-+ goto cleanup;
-+ }
-+ if (copy_from_user(domainlist, r_tmp->domain_children, r_tmp->domain_child_num * sizeof(uid_t))) {
-+ err = -EFAULT;
-+ goto cleanup;
-+ }
-+ r_tmp->domain_children = domainlist;
-+ }
-+
-+ err = copy_user_transitions(r_tmp);
-+ if (err)
-+ goto cleanup;
-+
-+ memset(r_tmp->subj_hash, 0,
-+ r_tmp->subj_hash_size *
-+ sizeof (struct acl_subject_label *));
-+
-+ err = copy_user_subjs(r_tmp->hash->first, r_tmp);
-+
-+ if (err)
-+ goto cleanup;
-+
-+ /* set nested subject list to null */
-+ r_tmp->hash->first = NULL;
-+
-+ insert_acl_role_label(r_tmp);
-+ }
-+
-+ goto return_err;
-+ cleanup:
-+ free_variables();
-+ return_err:
-+ return err;
-+
-+}
-+
-+static int
-+gracl_init(struct gr_arg *args)
-+{
-+ int error = 0;
-+
-+ memcpy(gr_system_salt, args->salt, GR_SALT_LEN);
-+ memcpy(gr_system_sum, args->sum, GR_SHA_LEN);
-+
-+ if (init_variables(args)) {
-+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_INITF_ACL_MSG, GR_VERSION);
-+ error = -ENOMEM;
-+ free_variables();
-+ goto out;
-+ }
-+
-+ error = copy_user_acl(args);
-+ free_init_variables();
-+ if (error) {
-+ free_variables();
-+ goto out;
-+ }
-+
-+ if ((error = gr_set_acls(0))) {
-+ free_variables();
-+ goto out;
-+ }
-+
-+ pax_open_kernel();
-+ gr_status |= GR_READY;
-+ pax_close_kernel();
-+
-+ out:
-+ return error;
-+}
-+
-+/* derived from glibc fnmatch() 0: match, 1: no match*/
-+
-+static int
-+glob_match(const char *p, const char *n)
-+{
-+ char c;
-+
-+ while ((c = *p++) != '\0') {
-+ switch (c) {
-+ case '?':
-+ if (*n == '\0')
-+ return 1;
-+ else if (*n == '/')
-+ return 1;
-+ break;
-+ case '\\':
-+ if (*n != c)
-+ return 1;
-+ break;
-+ case '*':
-+ for (c = *p++; c == '?' || c == '*'; c = *p++) {
-+ if (*n == '/')
-+ return 1;
-+ else if (c == '?') {
-+ if (*n == '\0')
-+ return 1;
-+ else
-+ ++n;
-+ }
-+ }
-+ if (c == '\0') {
-+ return 0;
-+ } else {
-+ const char *endp;
-+
-+ if ((endp = strchr(n, '/')) == NULL)
-+ endp = n + strlen(n);
-+
-+ if (c == '[') {
-+ for (--p; n < endp; ++n)
-+ if (!glob_match(p, n))
-+ return 0;
-+ } else if (c == '/') {
-+ while (*n != '\0' && *n != '/')
-+ ++n;
-+ if (*n == '/' && !glob_match(p, n + 1))
-+ return 0;
-+ } else {
-+ for (--p; n < endp; ++n)
-+ if (*n == c && !glob_match(p, n))
-+ return 0;
-+ }
-+
-+ return 1;
-+ }
-+ case '[':
-+ {
-+ int not;
-+ char cold;
-+
-+ if (*n == '\0' || *n == '/')
-+ return 1;
-+
-+ not = (*p == '!' || *p == '^');
-+ if (not)
-+ ++p;
-+
-+ c = *p++;
-+ for (;;) {
-+ unsigned char fn = (unsigned char)*n;
-+
-+ if (c == '\0')
-+ return 1;
-+ else {
-+ if (c == fn)
-+ goto matched;
-+ cold = c;
-+ c = *p++;
-+
-+ if (c == '-' && *p != ']') {
-+ unsigned char cend = *p++;
-+
-+ if (cend == '\0')
-+ return 1;
-+
-+ if (cold <= fn && fn <= cend)
-+ goto matched;
-+
-+ c = *p++;
-+ }
-+ }
-+
-+ if (c == ']')
-+ break;
-+ }
-+ if (!not)
-+ return 1;
-+ break;
-+ matched:
-+ while (c != ']') {
-+ if (c == '\0')
-+ return 1;
-+
-+ c = *p++;
-+ }
-+ if (not)
-+ return 1;
-+ }
-+ break;
-+ default:
-+ if (c != *n)
-+ return 1;
-+ }
-+
-+ ++n;
-+ }
-+
-+ if (*n == '\0')
-+ return 0;
-+
-+ if (*n == '/')
-+ return 0;
-+
-+ return 1;
-+}
-+
-+static struct acl_object_label *
-+chk_glob_label(struct acl_object_label *globbed,
-+ struct dentry *dentry, struct vfsmount *mnt, char **path)
-+{
-+ struct acl_object_label *tmp;
-+
-+ if (*path == NULL)
-+ *path = gr_to_filename_nolock(dentry, mnt);
-+
-+ tmp = globbed;
-+
-+ while (tmp) {
-+ if (!glob_match(tmp->filename, *path))
-+ return tmp;
-+ tmp = tmp->next;
-+ }
-+
-+ return NULL;
-+}
-+
-+static struct acl_object_label *
-+__full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
-+ const ino_t curr_ino, const dev_t curr_dev,
-+ const struct acl_subject_label *subj, char **path, const int checkglob)
-+{
-+ struct acl_subject_label *tmpsubj;
-+ struct acl_object_label *retval;
-+ struct acl_object_label *retval2;
-+
-+ tmpsubj = (struct acl_subject_label *) subj;
-+ read_lock(&gr_inode_lock);
-+ do {
-+ retval = lookup_acl_obj_label(curr_ino, curr_dev, tmpsubj);
-+ if (retval) {
-+ if (checkglob && retval->globbed) {
-+ retval2 = chk_glob_label(retval->globbed, (struct dentry *)orig_dentry,
-+ (struct vfsmount *)orig_mnt, path);
-+ if (retval2)
-+ retval = retval2;
-+ }
-+ break;
-+ }
-+ } while ((tmpsubj = tmpsubj->parent_subject));
-+ read_unlock(&gr_inode_lock);
-+
-+ return retval;
-+}
-+
-+static __inline__ struct acl_object_label *
-+full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
-+ const struct dentry *curr_dentry,
-+ const struct acl_subject_label *subj, char **path, const int checkglob)
-+{
-+ int newglob = checkglob;
-+
-+ /* if we aren't checking a subdirectory of the original path yet, don't do glob checking
-+ as we don't want a / * rule to match instead of the / object
-+ don't do this for create lookups that call this function though, since they're looking up
-+ on the parent and thus need globbing checks on all paths
-+ */
-+ if (orig_dentry == curr_dentry && newglob != GR_CREATE_GLOB)
-+ newglob = GR_NO_GLOB;
-+
-+ return __full_lookup(orig_dentry, orig_mnt,
-+ curr_dentry->d_inode->i_ino,
-+ __get_dev(curr_dentry), subj, path, newglob);
-+}
-+
-+static struct acl_object_label *
-+__chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
-+ const struct acl_subject_label *subj, char *path, const int checkglob)
-+{
-+ struct dentry *dentry = (struct dentry *) l_dentry;
-+ struct vfsmount *mnt = (struct vfsmount *) l_mnt;
-+ struct acl_object_label *retval;
-+
-+ spin_lock(&dcache_lock);
-+ spin_lock(&vfsmount_lock);
-+
-+ if (unlikely((mnt == shm_mnt && dentry->d_inode->i_nlink == 0) || mnt == pipe_mnt ||
-+#ifdef CONFIG_NET
-+ mnt == sock_mnt ||
-+#endif
-+#ifdef CONFIG_HUGETLBFS
-+ (mnt == hugetlbfs_vfsmount && dentry->d_inode->i_nlink == 0) ||
-+#endif
-+ /* ignore Eric Biederman */
-+ IS_PRIVATE(l_dentry->d_inode))) {
-+ retval = (subj->mode & GR_SHMEXEC) ? fakefs_obj_rwx : fakefs_obj_rw;
-+ goto out;
-+ }
-+
-+ for (;;) {
-+ if (dentry == real_root && mnt == real_root_mnt)
-+ break;
-+
-+ if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
-+ if (mnt->mnt_parent == mnt)
-+ break;
-+
-+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
-+ if (retval != NULL)
-+ goto out;
-+
-+ dentry = mnt->mnt_mountpoint;
-+ mnt = mnt->mnt_parent;
-+ continue;
-+ }
-+
-+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
-+ if (retval != NULL)
-+ goto out;
-+
-+ dentry = dentry->d_parent;
-+ }
-+
-+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
-+
-+ if (retval == NULL)
-+ retval = full_lookup(l_dentry, l_mnt, real_root, subj, &path, checkglob);
-+out:
-+ spin_unlock(&vfsmount_lock);
-+ spin_unlock(&dcache_lock);
-+
-+ BUG_ON(retval == NULL);
-+
-+ return retval;
-+}
-+
-+static __inline__ struct acl_object_label *
-+chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
-+ const struct acl_subject_label *subj)
-+{
-+ char *path = NULL;
-+ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_REG_GLOB);
-+}
-+
-+static __inline__ struct acl_object_label *
-+chk_obj_label_noglob(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
-+ const struct acl_subject_label *subj)
-+{
-+ char *path = NULL;
-+ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_NO_GLOB);
-+}
-+
-+static __inline__ struct acl_object_label *
-+chk_obj_create_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
-+ const struct acl_subject_label *subj, char *path)
-+{
-+ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_CREATE_GLOB);
-+}
-+
-+static struct acl_subject_label *
-+chk_subj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
-+ const struct acl_role_label *role)
-+{
-+ struct dentry *dentry = (struct dentry *) l_dentry;
-+ struct vfsmount *mnt = (struct vfsmount *) l_mnt;
-+ struct acl_subject_label *retval;
-+
-+ spin_lock(&dcache_lock);
-+ spin_lock(&vfsmount_lock);
-+
-+ for (;;) {
-+ if (dentry == real_root && mnt == real_root_mnt)
-+ break;
-+ if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
-+ if (mnt->mnt_parent == mnt)
-+ break;
-+
-+ read_lock(&gr_inode_lock);
-+ retval =
-+ lookup_acl_subj_label(dentry->d_inode->i_ino,
-+ __get_dev(dentry), role);
-+ read_unlock(&gr_inode_lock);
-+ if (retval != NULL)
-+ goto out;
-+
-+ dentry = mnt->mnt_mountpoint;
-+ mnt = mnt->mnt_parent;
-+ continue;
-+ }
-+
-+ read_lock(&gr_inode_lock);
-+ retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
-+ __get_dev(dentry), role);
-+ read_unlock(&gr_inode_lock);
-+ if (retval != NULL)
-+ goto out;
-+
-+ dentry = dentry->d_parent;
-+ }
-+
-+ read_lock(&gr_inode_lock);
-+ retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
-+ __get_dev(dentry), role);
-+ read_unlock(&gr_inode_lock);
-+
-+ if (unlikely(retval == NULL)) {
-+ read_lock(&gr_inode_lock);
-+ retval = lookup_acl_subj_label(real_root->d_inode->i_ino,
-+ __get_dev(real_root), role);
-+ read_unlock(&gr_inode_lock);
-+ }
-+out:
-+ spin_unlock(&vfsmount_lock);
-+ spin_unlock(&dcache_lock);
-+
-+ BUG_ON(retval == NULL);
-+
-+ return retval;
-+}
-+
-+static void
-+gr_log_learn(const struct dentry *dentry, const struct vfsmount *mnt, const __u32 mode)
-+{
-+ struct task_struct *task = current;
-+ const struct cred *cred = current_cred();
-+
-+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
-+ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
-+ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
-+ 1UL, 1UL, gr_to_filename(dentry, mnt), (unsigned long) mode, &task->signal->saved_ip);
-+
-+ return;
-+}
-+
-+static void
-+gr_log_learn_sysctl(const char *path, const __u32 mode)
-+{
-+ struct task_struct *task = current;
-+ const struct cred *cred = current_cred();
-+
-+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
-+ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
-+ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
-+ 1UL, 1UL, path, (unsigned long) mode, &task->signal->saved_ip);
-+
-+ return;
-+}
-+
-+static void
-+gr_log_learn_id_change(const char type, const unsigned int real,
-+ const unsigned int effective, const unsigned int fs)
-+{
-+ struct task_struct *task = current;
-+ const struct cred *cred = current_cred();
-+
-+ security_learn(GR_ID_LEARN_MSG, task->role->rolename, task->role->roletype,
-+ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
-+ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
-+ type, real, effective, fs, &task->signal->saved_ip);
-+
-+ return;
-+}
-+
-+__u32
-+gr_check_link(const struct dentry * new_dentry,
-+ const struct dentry * parent_dentry,
-+ const struct vfsmount * parent_mnt,
-+ const struct dentry * old_dentry, const struct vfsmount * old_mnt)
-+{
-+ struct acl_object_label *obj;
-+ __u32 oldmode, newmode;
-+ __u32 needmode;
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return (GR_CREATE | GR_LINK);
-+
-+ obj = chk_obj_label(old_dentry, old_mnt, current->acl);
-+ oldmode = obj->mode;
-+
-+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
-+ oldmode |= (GR_CREATE | GR_LINK);
-+
-+ needmode = GR_CREATE | GR_AUDIT_CREATE | GR_SUPPRESS;
-+ if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
-+ needmode |= GR_SETID | GR_AUDIT_SETID;
-+
-+ newmode =
-+ gr_check_create(new_dentry, parent_dentry, parent_mnt,
-+ oldmode | needmode);
-+
-+ needmode = newmode & (GR_FIND | GR_APPEND | GR_WRITE | GR_EXEC |
-+ GR_SETID | GR_READ | GR_FIND | GR_DELETE |
-+ GR_INHERIT | GR_AUDIT_INHERIT);
-+
-+ if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID) && !(newmode & GR_SETID))
-+ goto bad;
-+
-+ if ((oldmode & needmode) != needmode)
-+ goto bad;
-+
-+ needmode = oldmode & (GR_NOPTRACE | GR_PTRACERD | GR_INHERIT | GR_AUDITS);
-+ if ((newmode & needmode) != needmode)
-+ goto bad;
-+
-+ if ((newmode & (GR_CREATE | GR_LINK)) == (GR_CREATE | GR_LINK))
-+ return newmode;
-+bad:
-+ needmode = oldmode;
-+ if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
-+ needmode |= GR_SETID;
-+
-+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) {
-+ gr_log_learn(old_dentry, old_mnt, needmode);
-+ return (GR_CREATE | GR_LINK);
-+ } else if (newmode & GR_SUPPRESS)
-+ return GR_SUPPRESS;
-+ else
-+ return 0;
-+}
-+
-+__u32
-+gr_search_file(const struct dentry * dentry, const __u32 mode,
-+ const struct vfsmount * mnt)
-+{
-+ __u32 retval = mode;
-+ struct acl_subject_label *curracl;
-+ struct acl_object_label *currobj;
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return (mode & ~GR_AUDITS);
-+
-+ curracl = current->acl;
-+
-+ currobj = chk_obj_label(dentry, mnt, curracl);
-+ retval = currobj->mode & mode;
-+
-+ /* if we're opening a specified transfer file for writing
-+ (e.g. /dev/initctl), then transfer our role to init
-+ */
-+ if (unlikely(currobj->mode & GR_INIT_TRANSFER && retval & GR_WRITE &&
-+ current->role->roletype & GR_ROLE_PERSIST)) {
-+ struct task_struct *task = init_pid_ns.child_reaper;
-+
-+ if (task->role != current->role) {
-+ task->acl_sp_role = 0;
-+ task->acl_role_id = current->acl_role_id;
-+ task->role = current->role;
-+ rcu_read_lock();
-+ read_lock(&grsec_exec_file_lock);
-+ gr_apply_subject_to_task(task);
-+ read_unlock(&grsec_exec_file_lock);
-+ rcu_read_unlock();
-+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_INIT_TRANSFER_MSG);
-+ }
-+ }
-+
-+ if (unlikely
-+ ((curracl->mode & (GR_LEARN | GR_INHERITLEARN)) && !(mode & GR_NOPTRACE)
-+ && (retval != (mode & ~(GR_AUDITS | GR_SUPPRESS))))) {
-+ __u32 new_mode = mode;
-+
-+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
-+
-+ retval = new_mode;
-+
-+ if (new_mode & GR_EXEC && curracl->mode & GR_INHERITLEARN)
-+ new_mode |= GR_INHERIT;
-+
-+ if (!(mode & GR_NOLEARN))
-+ gr_log_learn(dentry, mnt, new_mode);
-+ }
-+
-+ return retval;
-+}
-+
-+__u32
-+gr_check_create(const struct dentry * new_dentry, const struct dentry * parent,
-+ const struct vfsmount * mnt, const __u32 mode)
-+{
-+ struct name_entry *match;
-+ struct acl_object_label *matchpo;
-+ struct acl_subject_label *curracl;
-+ char *path;
-+ __u32 retval;
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return (mode & ~GR_AUDITS);
-+
-+ preempt_disable();
-+ path = gr_to_filename_rbac(new_dentry, mnt);
-+ match = lookup_name_entry_create(path);
-+
-+ if (!match)
-+ goto check_parent;
-+
-+ curracl = current->acl;
-+
-+ read_lock(&gr_inode_lock);
-+ matchpo = lookup_acl_obj_label_create(match->inode, match->device, curracl);
-+ read_unlock(&gr_inode_lock);
-+
-+ if (matchpo) {
-+ if ((matchpo->mode & mode) !=
-+ (mode & ~(GR_AUDITS | GR_SUPPRESS))
-+ && curracl->mode & (GR_LEARN | GR_INHERITLEARN)) {
-+ __u32 new_mode = mode;
-+
-+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
-+
-+ gr_log_learn(new_dentry, mnt, new_mode);
-+
-+ preempt_enable();
-+ return new_mode;
-+ }
-+ preempt_enable();
-+ return (matchpo->mode & mode);
-+ }
-+
-+ check_parent:
-+ curracl = current->acl;
-+
-+ matchpo = chk_obj_create_label(parent, mnt, curracl, path);
-+ retval = matchpo->mode & mode;
-+
-+ if ((retval != (mode & ~(GR_AUDITS | GR_SUPPRESS)))
-+ && (curracl->mode & (GR_LEARN | GR_INHERITLEARN))) {
-+ __u32 new_mode = mode;
-+
-+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
-+
-+ gr_log_learn(new_dentry, mnt, new_mode);
-+ preempt_enable();
-+ return new_mode;
-+ }
-+
-+ preempt_enable();
-+ return retval;
-+}
-+
-+int
-+gr_check_hidden_task(const struct task_struct *task)
-+{
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return 0;
-+
-+ if (!(task->acl->mode & GR_PROCFIND) && !(current->acl->mode & GR_VIEW))
-+ return 1;
-+
-+ return 0;
-+}
-+
-+int
-+gr_check_protected_task(const struct task_struct *task)
-+{
-+ if (unlikely(!(gr_status & GR_READY) || !task))
-+ return 0;
-+
-+ if ((task->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
-+ task->acl != current->acl)
-+ return 1;
-+
-+ return 0;
-+}
-+
-+int
-+gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
-+{
-+ struct task_struct *p;
-+ int ret = 0;
-+
-+ if (unlikely(!(gr_status & GR_READY) || !pid))
-+ return ret;
-+
-+ read_lock(&tasklist_lock);
-+ do_each_pid_task(pid, type, p) {
-+ if ((p->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
-+ p->acl != current->acl) {
-+ ret = 1;
-+ goto out;
-+ }
-+ } while_each_pid_task(pid, type, p);
-+out:
-+ read_unlock(&tasklist_lock);
-+
-+ return ret;
-+}
-+
-+void
-+gr_copy_label(struct task_struct *tsk)
-+{
-+ tsk->signal->used_accept = 0;
-+ tsk->acl_sp_role = 0;
-+ tsk->acl_role_id = current->acl_role_id;
-+ tsk->acl = current->acl;
-+ tsk->role = current->role;
-+ tsk->signal->curr_ip = current->signal->curr_ip;
-+ tsk->signal->saved_ip = current->signal->saved_ip;
-+ if (current->exec_file)
-+ get_file(current->exec_file);
-+ tsk->exec_file = current->exec_file;
-+ tsk->is_writable = current->is_writable;
-+ if (unlikely(current->signal->used_accept)) {
-+ current->signal->curr_ip = 0;
-+ current->signal->saved_ip = 0;
-+ }
-+
-+ return;
-+}
-+
-+static void
-+gr_set_proc_res(struct task_struct *task)
-+{
-+ struct acl_subject_label *proc;
-+ unsigned short i;
-+
-+ proc = task->acl;
-+
-+ if (proc->mode & (GR_LEARN | GR_INHERITLEARN))
-+ return;
-+
-+ for (i = 0; i < RLIM_NLIMITS; i++) {
-+ if (!(proc->resmask & (1 << i)))
-+ continue;
-+
-+ task->signal->rlim[i].rlim_cur = proc->res[i].rlim_cur;
-+ task->signal->rlim[i].rlim_max = proc->res[i].rlim_max;
-+ }
-+
-+ return;
-+}
-+
-+extern int __gr_process_user_ban(struct user_struct *user);
-+
-+int
-+gr_check_user_change(int real, int effective, int fs)
-+{
-+ unsigned int i;
-+ __u16 num;
-+ uid_t *uidlist;
-+ int curuid;
-+ int realok = 0;
-+ int effectiveok = 0;
-+ int fsok = 0;
-+
-+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
-+ struct user_struct *user;
-+
-+ if (real == -1)
-+ goto skipit;
-+
-+ user = find_user(real);
-+ if (user == NULL)
-+ goto skipit;
-+
-+ if (__gr_process_user_ban(user)) {
-+ /* for find_user */
-+ free_uid(user);
-+ return 1;
-+ }
-+
-+ /* for find_user */
-+ free_uid(user);
-+
-+skipit:
-+#endif
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return 0;
-+
-+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
-+ gr_log_learn_id_change('u', real, effective, fs);
-+
-+ num = current->acl->user_trans_num;
-+ uidlist = current->acl->user_transitions;
-+
-+ if (uidlist == NULL)
-+ return 0;
-+
-+ if (real == -1)
-+ realok = 1;
-+ if (effective == -1)
-+ effectiveok = 1;
-+ if (fs == -1)
-+ fsok = 1;
-+
-+ if (current->acl->user_trans_type & GR_ID_ALLOW) {
-+ for (i = 0; i < num; i++) {
-+ curuid = (int)uidlist[i];
-+ if (real == curuid)
-+ realok = 1;
-+ if (effective == curuid)
-+ effectiveok = 1;
-+ if (fs == curuid)
-+ fsok = 1;
-+ }
-+ } else if (current->acl->user_trans_type & GR_ID_DENY) {
-+ for (i = 0; i < num; i++) {
-+ curuid = (int)uidlist[i];
-+ if (real == curuid)
-+ break;
-+ if (effective == curuid)
-+ break;
-+ if (fs == curuid)
-+ break;
-+ }
-+ /* not in deny list */
-+ if (i == num) {
-+ realok = 1;
-+ effectiveok = 1;
-+ fsok = 1;
-+ }
-+ }
-+
-+ if (realok && effectiveok && fsok)
-+ return 0;
-+ else {
-+ gr_log_int(GR_DONT_AUDIT, GR_USRCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
-+ return 1;
-+ }
-+}
-+
-+int
-+gr_check_group_change(int real, int effective, int fs)
-+{
-+ unsigned int i;
-+ __u16 num;
-+ gid_t *gidlist;
-+ int curgid;
-+ int realok = 0;
-+ int effectiveok = 0;
-+ int fsok = 0;
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return 0;
-+
-+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
-+ gr_log_learn_id_change('g', real, effective, fs);
-+
-+ num = current->acl->group_trans_num;
-+ gidlist = current->acl->group_transitions;
-+
-+ if (gidlist == NULL)
-+ return 0;
-+
-+ if (real == -1)
-+ realok = 1;
-+ if (effective == -1)
-+ effectiveok = 1;
-+ if (fs == -1)
-+ fsok = 1;
-+
-+ if (current->acl->group_trans_type & GR_ID_ALLOW) {
-+ for (i = 0; i < num; i++) {
-+ curgid = (int)gidlist[i];
-+ if (real == curgid)
-+ realok = 1;
-+ if (effective == curgid)
-+ effectiveok = 1;
-+ if (fs == curgid)
-+ fsok = 1;
-+ }
-+ } else if (current->acl->group_trans_type & GR_ID_DENY) {
-+ for (i = 0; i < num; i++) {
-+ curgid = (int)gidlist[i];
-+ if (real == curgid)
-+ break;
-+ if (effective == curgid)
-+ break;
-+ if (fs == curgid)
-+ break;
-+ }
-+ /* not in deny list */
-+ if (i == num) {
-+ realok = 1;
-+ effectiveok = 1;
-+ fsok = 1;
-+ }
-+ }
-+
-+ if (realok && effectiveok && fsok)
-+ return 0;
-+ else {
-+ gr_log_int(GR_DONT_AUDIT, GR_GRPCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
-+ return 1;
-+ }
-+}
-+
-+void
-+gr_set_role_label(struct task_struct *task, const uid_t uid, const uid_t gid)
-+{
-+ struct acl_role_label *role = task->role;
-+ struct acl_subject_label *subj = NULL;
-+ struct acl_object_label *obj;
-+ struct file *filp;
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return;
-+
-+ filp = task->exec_file;
-+
-+ /* kernel process, we'll give them the kernel role */
-+ if (unlikely(!filp)) {
-+ task->role = kernel_role;
-+ task->acl = kernel_role->root_label;
-+ return;
-+ } else if (!task->role || !(task->role->roletype & GR_ROLE_SPECIAL))
-+ role = lookup_acl_role_label(task, uid, gid);
-+
-+ /* perform subject lookup in possibly new role
-+ we can use this result below in the case where role == task->role
-+ */
-+ subj = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, role);
-+
-+ /* if we changed uid/gid, but result in the same role
-+ and are using inheritance, don't lose the inherited subject
-+ if current subject is other than what normal lookup
-+ would result in, we arrived via inheritance, don't
-+ lose subject
-+ */
-+ if (role != task->role || (!(task->acl->mode & GR_INHERITLEARN) &&
-+ (subj == task->acl)))
-+ task->acl = subj;
-+
-+ task->role = role;
-+
-+ task->is_writable = 0;
-+
-+ /* ignore additional mmap checks for processes that are writable
-+ by the default ACL */
-+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
-+ if (unlikely(obj->mode & GR_WRITE))
-+ task->is_writable = 1;
-+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
-+ if (unlikely(obj->mode & GR_WRITE))
-+ task->is_writable = 1;
-+
-+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
-+ printk(KERN_ALERT "Set role label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
-+#endif
-+
-+ gr_set_proc_res(task);
-+
-+ return;
-+}
-+
-+int
-+gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
-+ const int unsafe_share)
-+{
-+ struct task_struct *task = current;
-+ struct acl_subject_label *newacl;
-+ struct acl_object_label *obj;
-+ __u32 retmode;
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return 0;
-+
-+ newacl = chk_subj_label(dentry, mnt, task->role);
-+
-+ task_lock(task);
-+ if ((((task->ptrace & PT_PTRACED) || unsafe_share) &&
-+ !(task->acl->mode & GR_POVERRIDE) && (task->acl != newacl) &&
-+ !(task->role->roletype & GR_ROLE_GOD) &&
-+ !gr_search_file(dentry, GR_PTRACERD, mnt) &&
-+ !(task->acl->mode & (GR_LEARN | GR_INHERITLEARN)))) {
-+ task_unlock(task);
-+ if (unsafe_share)
-+ gr_log_fs_generic(GR_DONT_AUDIT, GR_UNSAFESHARE_EXEC_ACL_MSG, dentry, mnt);
-+ else
-+ gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_EXEC_ACL_MSG, dentry, mnt);
-+ return -EACCES;
-+ }
-+ task_unlock(task);
-+
-+ obj = chk_obj_label(dentry, mnt, task->acl);
-+ retmode = obj->mode & (GR_INHERIT | GR_AUDIT_INHERIT);
-+
-+ if (!(task->acl->mode & GR_INHERITLEARN) &&
-+ ((newacl->mode & GR_LEARN) || !(retmode & GR_INHERIT))) {
-+ if (obj->nested)
-+ task->acl = obj->nested;
-+ else
-+ task->acl = newacl;
-+ } else if (retmode & GR_INHERIT && retmode & GR_AUDIT_INHERIT)
-+ gr_log_str_fs(GR_DO_AUDIT, GR_INHERIT_ACL_MSG, task->acl->filename, dentry, mnt);
-+
-+ task->is_writable = 0;
-+
-+ /* ignore additional mmap checks for processes that are writable
-+ by the default ACL */
-+ obj = chk_obj_label(dentry, mnt, default_role->root_label);
-+ if (unlikely(obj->mode & GR_WRITE))
-+ task->is_writable = 1;
-+ obj = chk_obj_label(dentry, mnt, task->role->root_label);
-+ if (unlikely(obj->mode & GR_WRITE))
-+ task->is_writable = 1;
-+
-+ gr_set_proc_res(task);
-+
-+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
-+ printk(KERN_ALERT "Set subject label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
-+#endif
-+ return 0;
-+}
-+
-+/* always called with valid inodev ptr */
-+static void
-+do_handle_delete(struct inodev_entry *inodev, const ino_t ino, const dev_t dev)
-+{
-+ struct acl_object_label *matchpo;
-+ struct acl_subject_label *matchps;
-+ struct acl_subject_label *subj;
-+ struct acl_role_label *role;
-+ unsigned int x;
-+
-+ FOR_EACH_ROLE_START(role)
-+ FOR_EACH_SUBJECT_START(role, subj, x)
-+ if ((matchpo = lookup_acl_obj_label(ino, dev, subj)) != NULL)
-+ matchpo->mode |= GR_DELETED;
-+ FOR_EACH_SUBJECT_END(subj,x)
-+ FOR_EACH_NESTED_SUBJECT_START(role, subj)
-+ if (subj->inode == ino && subj->device == dev)
-+ subj->mode |= GR_DELETED;
-+ FOR_EACH_NESTED_SUBJECT_END(subj)
-+ if ((matchps = lookup_acl_subj_label(ino, dev, role)) != NULL)
-+ matchps->mode |= GR_DELETED;
-+ FOR_EACH_ROLE_END(role)
-+
-+ inodev->nentry->deleted = 1;
-+
-+ return;
-+}
-+
-+void
-+gr_handle_delete(const ino_t ino, const dev_t dev)
-+{
-+ struct inodev_entry *inodev;
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return;
-+
-+ write_lock(&gr_inode_lock);
-+ inodev = lookup_inodev_entry(ino, dev);
-+ if (inodev != NULL)
-+ do_handle_delete(inodev, ino, dev);
-+ write_unlock(&gr_inode_lock);
-+
-+ return;
-+}
-+
-+static void
-+update_acl_obj_label(const ino_t oldinode, const dev_t olddevice,
-+ const ino_t newinode, const dev_t newdevice,
-+ struct acl_subject_label *subj)
-+{
-+ unsigned int index = fhash(oldinode, olddevice, subj->obj_hash_size);
-+ struct acl_object_label *match;
-+
-+ match = subj->obj_hash[index];
-+
-+ while (match && (match->inode != oldinode ||
-+ match->device != olddevice ||
-+ !(match->mode & GR_DELETED)))
-+ match = match->next;
-+
-+ if (match && (match->inode == oldinode)
-+ && (match->device == olddevice)
-+ && (match->mode & GR_DELETED)) {
-+ if (match->prev == NULL) {
-+ subj->obj_hash[index] = match->next;
-+ if (match->next != NULL)
-+ match->next->prev = NULL;
-+ } else {
-+ match->prev->next = match->next;
-+ if (match->next != NULL)
-+ match->next->prev = match->prev;
-+ }
-+ match->prev = NULL;
-+ match->next = NULL;
-+ match->inode = newinode;
-+ match->device = newdevice;
-+ match->mode &= ~GR_DELETED;
-+
-+ insert_acl_obj_label(match, subj);
-+ }
-+
-+ return;
-+}
-+
-+static void
-+update_acl_subj_label(const ino_t oldinode, const dev_t olddevice,
-+ const ino_t newinode, const dev_t newdevice,
-+ struct acl_role_label *role)
-+{
-+ unsigned int index = fhash(oldinode, olddevice, role->subj_hash_size);
-+ struct acl_subject_label *match;
-+
-+ match = role->subj_hash[index];
-+
-+ while (match && (match->inode != oldinode ||
-+ match->device != olddevice ||
-+ !(match->mode & GR_DELETED)))
-+ match = match->next;
-+
-+ if (match && (match->inode == oldinode)
-+ && (match->device == olddevice)
-+ && (match->mode & GR_DELETED)) {
-+ if (match->prev == NULL) {
-+ role->subj_hash[index] = match->next;
-+ if (match->next != NULL)
-+ match->next->prev = NULL;
-+ } else {
-+ match->prev->next = match->next;
-+ if (match->next != NULL)
-+ match->next->prev = match->prev;
-+ }
-+ match->prev = NULL;
-+ match->next = NULL;
-+ match->inode = newinode;
-+ match->device = newdevice;
-+ match->mode &= ~GR_DELETED;
-+
-+ insert_acl_subj_label(match, role);
-+ }
-+
-+ return;
-+}
-+
-+static void
-+update_inodev_entry(const ino_t oldinode, const dev_t olddevice,
-+ const ino_t newinode, const dev_t newdevice)
-+{
-+ unsigned int index = fhash(oldinode, olddevice, inodev_set.i_size);
-+ struct inodev_entry *match;
-+
-+ match = inodev_set.i_hash[index];
-+
-+ while (match && (match->nentry->inode != oldinode ||
-+ match->nentry->device != olddevice || !match->nentry->deleted))
-+ match = match->next;
-+
-+ if (match && (match->nentry->inode == oldinode)
-+ && (match->nentry->device == olddevice) &&
-+ match->nentry->deleted) {
-+ if (match->prev == NULL) {
-+ inodev_set.i_hash[index] = match->next;
-+ if (match->next != NULL)
-+ match->next->prev = NULL;
-+ } else {
-+ match->prev->next = match->next;
-+ if (match->next != NULL)
-+ match->next->prev = match->prev;
-+ }
-+ match->prev = NULL;
-+ match->next = NULL;
-+ match->nentry->inode = newinode;
-+ match->nentry->device = newdevice;
-+ match->nentry->deleted = 0;
-+
-+ insert_inodev_entry(match);
-+ }
-+
-+ return;
-+}
-+
-+static void
-+do_handle_create(const struct name_entry *matchn, const struct dentry *dentry,
-+ const struct vfsmount *mnt)
-+{
-+ struct acl_subject_label *subj;
-+ struct acl_role_label *role;
-+ unsigned int x;
-+ ino_t inode = dentry->d_inode->i_ino;
-+ dev_t dev = __get_dev(dentry);
-+
-+ FOR_EACH_ROLE_START(role)
-+ update_acl_subj_label(matchn->inode, matchn->device,
-+ inode, dev, role);
-+
-+ FOR_EACH_NESTED_SUBJECT_START(role, subj)
-+ if ((subj->inode == inode) && (subj->device == dev)) {
-+ subj->inode = inode;
-+ subj->device = dev;
-+ }
-+ FOR_EACH_NESTED_SUBJECT_END(subj)
-+ FOR_EACH_SUBJECT_START(role, subj, x)
-+ update_acl_obj_label(matchn->inode, matchn->device,
-+ inode, dev, subj);
-+ FOR_EACH_SUBJECT_END(subj,x)
-+ FOR_EACH_ROLE_END(role)
-+
-+ update_inodev_entry(matchn->inode, matchn->device, inode, dev);
-+
-+ return;
-+}
-+
-+void
-+gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ struct name_entry *matchn;
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return;
-+
-+ preempt_disable();
-+ matchn = lookup_name_entry(gr_to_filename_rbac(dentry, mnt));
-+
-+ if (unlikely((unsigned long)matchn)) {
-+ write_lock(&gr_inode_lock);
-+ do_handle_create(matchn, dentry, mnt);
-+ write_unlock(&gr_inode_lock);
-+ }
-+ preempt_enable();
-+
-+ return;
-+}
-+
-+void
-+gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
-+ struct dentry *old_dentry,
-+ struct dentry *new_dentry,
-+ struct vfsmount *mnt, const __u8 replace)
-+{
-+ struct name_entry *matchn;
-+ struct inodev_entry *inodev;
-+ ino_t oldinode = old_dentry->d_inode->i_ino;
-+ dev_t olddev = __get_dev(old_dentry);
-+
-+ /* vfs_rename swaps the name and parent link for old_dentry and
-+ new_dentry
-+ at this point, old_dentry has the new name, parent link, and inode
-+ for the renamed file
-+ if a file is being replaced by a rename, new_dentry has the inode
-+ and name for the replaced file
-+ */
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return;
-+
-+ preempt_disable();
-+ matchn = lookup_name_entry(gr_to_filename_rbac(old_dentry, mnt));
-+
-+ /* we wouldn't have to check d_inode if it weren't for
-+ NFS silly-renaming
-+ */
-+
-+ write_lock(&gr_inode_lock);
-+ if (unlikely(replace && new_dentry->d_inode)) {
-+ ino_t newinode = new_dentry->d_inode->i_ino;
-+ dev_t newdev = __get_dev(new_dentry);
-+ inodev = lookup_inodev_entry(newinode, newdev);
-+ if (inodev != NULL && (new_dentry->d_inode->i_nlink <= 1))
-+ do_handle_delete(inodev, newinode, newdev);
-+ }
-+
-+ inodev = lookup_inodev_entry(oldinode, olddev);
-+ if (inodev != NULL && (old_dentry->d_inode->i_nlink <= 1))
-+ do_handle_delete(inodev, oldinode, olddev);
-+
-+ if (unlikely((unsigned long)matchn))
-+ do_handle_create(matchn, old_dentry, mnt);
-+
-+ write_unlock(&gr_inode_lock);
-+ preempt_enable();
-+
-+ return;
-+}
-+
-+static int
-+lookup_special_role_auth(__u16 mode, const char *rolename, unsigned char **salt,
-+ unsigned char **sum)
-+{
-+ struct acl_role_label *r;
-+ struct role_allowed_ip *ipp;
-+ struct role_transition *trans;
-+ unsigned int i;
-+ int found = 0;
-+ u32 curr_ip = current->signal->curr_ip;
-+
-+ current->signal->saved_ip = curr_ip;
-+
-+ /* check transition table */
-+
-+ for (trans = current->role->transitions; trans; trans = trans->next) {
-+ if (!strcmp(rolename, trans->rolename)) {
-+ found = 1;
-+ break;
-+ }
-+ }
-+
-+ if (!found)
-+ return 0;
-+
-+ /* handle special roles that do not require authentication
-+ and check ip */
-+
-+ FOR_EACH_ROLE_START(r)
-+ if (!strcmp(rolename, r->rolename) &&
-+ (r->roletype & GR_ROLE_SPECIAL)) {
-+ found = 0;
-+ if (r->allowed_ips != NULL) {
-+ for (ipp = r->allowed_ips; ipp; ipp = ipp->next) {
-+ if ((ntohl(curr_ip) & ipp->netmask) ==
-+ (ntohl(ipp->addr) & ipp->netmask))
-+ found = 1;
-+ }
-+ } else
-+ found = 2;
-+ if (!found)
-+ return 0;
-+
-+ if (((mode == GR_SPROLE) && (r->roletype & GR_ROLE_NOPW)) ||
-+ ((mode == GR_SPROLEPAM) && (r->roletype & GR_ROLE_PAM))) {
-+ *salt = NULL;
-+ *sum = NULL;
-+ return 1;
-+ }
-+ }
-+ FOR_EACH_ROLE_END(r)
-+
-+ for (i = 0; i < num_sprole_pws; i++) {
-+ if (!strcmp(rolename, acl_special_roles[i]->rolename)) {
-+ *salt = acl_special_roles[i]->salt;
-+ *sum = acl_special_roles[i]->sum;
-+ return 1;
-+ }
-+ }
-+
-+ return 0;
-+}
-+
-+static void
-+assign_special_role(char *rolename)
-+{
-+ struct acl_object_label *obj;
-+ struct acl_role_label *r;
-+ struct acl_role_label *assigned = NULL;
-+ struct task_struct *tsk;
-+ struct file *filp;
-+
-+ FOR_EACH_ROLE_START(r)
-+ if (!strcmp(rolename, r->rolename) &&
-+ (r->roletype & GR_ROLE_SPECIAL)) {
-+ assigned = r;
-+ break;
-+ }
-+ FOR_EACH_ROLE_END(r)
-+
-+ if (!assigned)
-+ return;
-+
-+ read_lock(&tasklist_lock);
-+ read_lock(&grsec_exec_file_lock);
-+
-+ tsk = current->real_parent;
-+ if (tsk == NULL)
-+ goto out_unlock;
-+
-+ filp = tsk->exec_file;
-+ if (filp == NULL)
-+ goto out_unlock;
-+
-+ tsk->is_writable = 0;
-+
-+ tsk->acl_sp_role = 1;
-+ tsk->acl_role_id = ++acl_sp_role_value;
-+ tsk->role = assigned;
-+ tsk->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role);
-+
-+ /* ignore additional mmap checks for processes that are writable
-+ by the default ACL */
-+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
-+ if (unlikely(obj->mode & GR_WRITE))
-+ tsk->is_writable = 1;
-+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role->root_label);
-+ if (unlikely(obj->mode & GR_WRITE))
-+ tsk->is_writable = 1;
-+
-+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
-+ printk(KERN_ALERT "Assigning special role:%s subject:%s to process (%s:%d)\n", tsk->role->rolename, tsk->acl->filename, tsk->comm, tsk->pid);
-+#endif
-+
-+out_unlock:
-+ read_unlock(&grsec_exec_file_lock);
-+ read_unlock(&tasklist_lock);
-+ return;
-+}
-+
-+int gr_check_secure_terminal(struct task_struct *task)
-+{
-+ struct task_struct *p, *p2, *p3;
-+ struct files_struct *files;
-+ struct fdtable *fdt;
-+ struct file *our_file = NULL, *file;
-+ int i;
-+
-+ if (task->signal->tty == NULL)
-+ return 1;
-+
-+ files = get_files_struct(task);
-+ if (files != NULL) {
-+ rcu_read_lock();
-+ fdt = files_fdtable(files);
-+ for (i=0; i < fdt->max_fds; i++) {
-+ file = fcheck_files(files, i);
-+ if (file && (our_file == NULL) && (file->private_data == task->signal->tty)) {
-+ get_file(file);
-+ our_file = file;
-+ }
-+ }
-+ rcu_read_unlock();
-+ put_files_struct(files);
-+ }
-+
-+ if (our_file == NULL)
-+ return 1;
-+
-+ read_lock(&tasklist_lock);
-+ do_each_thread(p2, p) {
-+ files = get_files_struct(p);
-+ if (files == NULL ||
-+ (p->signal && p->signal->tty == task->signal->tty)) {
-+ if (files != NULL)
-+ put_files_struct(files);
-+ continue;
-+ }
-+ rcu_read_lock();
-+ fdt = files_fdtable(files);
-+ for (i=0; i < fdt->max_fds; i++) {
-+ file = fcheck_files(files, i);
-+ if (file && S_ISCHR(file->f_path.dentry->d_inode->i_mode) &&
-+ file->f_path.dentry->d_inode->i_rdev == our_file->f_path.dentry->d_inode->i_rdev) {
-+ p3 = task;
-+ while (p3->pid > 0) {
-+ if (p3 == p)
-+ break;
-+ p3 = p3->real_parent;
-+ }
-+ if (p3 == p)
-+ break;
-+ gr_log_ttysniff(GR_DONT_AUDIT_GOOD, GR_TTYSNIFF_ACL_MSG, p);
-+ gr_handle_alertkill(p);
-+ rcu_read_unlock();
-+ put_files_struct(files);
-+ read_unlock(&tasklist_lock);
-+ fput(our_file);
-+ return 0;
-+ }
-+ }
-+ rcu_read_unlock();
-+ put_files_struct(files);
-+ } while_each_thread(p2, p);
-+ read_unlock(&tasklist_lock);
-+
-+ fput(our_file);
-+ return 1;
-+}
-+
-+ssize_t
-+write_grsec_handler(struct file *file, const char * buf, size_t count, loff_t *ppos)
-+{
-+ struct gr_arg_wrapper uwrap;
-+ unsigned char *sprole_salt = NULL;
-+ unsigned char *sprole_sum = NULL;
-+ int error = sizeof (struct gr_arg_wrapper);
-+ int error2 = 0;
-+
-+ mutex_lock(&gr_dev_mutex);
-+
-+ if ((gr_status & GR_READY) && !(current->acl->mode & GR_KERNELAUTH)) {
-+ error = -EPERM;
-+ goto out;
-+ }
-+
-+ if (count != sizeof (struct gr_arg_wrapper)) {
-+ gr_log_int_int(GR_DONT_AUDIT_GOOD, GR_DEV_ACL_MSG, (int)count, (int)sizeof(struct gr_arg_wrapper));
-+ error = -EINVAL;
-+ goto out;
-+ }
-+
-+
-+ if (gr_auth_expires && time_after_eq(get_seconds(), gr_auth_expires)) {
-+ gr_auth_expires = 0;
-+ gr_auth_attempts = 0;
-+ }
-+
-+ if (copy_from_user(&uwrap, buf, sizeof (struct gr_arg_wrapper))) {
-+ error = -EFAULT;
-+ goto out;
-+ }
-+
-+ if ((uwrap.version != GRSECURITY_VERSION) || (uwrap.size != sizeof(struct gr_arg))) {
-+ error = -EINVAL;
-+ goto out;
-+ }
-+
-+ if (copy_from_user(gr_usermode, uwrap.arg, sizeof (struct gr_arg))) {
-+ error = -EFAULT;
-+ goto out;
-+ }
-+
-+ if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_SPROLEPAM &&
-+ gr_auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
-+ time_after(gr_auth_expires, get_seconds())) {
-+ error = -EBUSY;
-+ goto out;
-+ }
-+
-+ /* if non-root trying to do anything other than use a special role,
-+ do not attempt authentication, do not count towards authentication
-+ locking
-+ */
-+
-+ if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_STATUS &&
-+ gr_usermode->mode != GR_UNSPROLE && gr_usermode->mode != GR_SPROLEPAM &&
-+ current_uid()) {
-+ error = -EPERM;
-+ goto out;
-+ }
-+
-+ /* ensure pw and special role name are null terminated */
-+
-+ gr_usermode->pw[GR_PW_LEN - 1] = '\0';
-+ gr_usermode->sp_role[GR_SPROLE_LEN - 1] = '\0';
-+
-+ /* Okay.
-+ * We have our enough of the argument structure..(we have yet
-+ * to copy_from_user the tables themselves) . Copy the tables
-+ * only if we need them, i.e. for loading operations. */
-+
-+ switch (gr_usermode->mode) {
-+ case GR_STATUS:
-+ if (gr_status & GR_READY) {
-+ error = 1;
-+ if (!gr_check_secure_terminal(current))
-+ error = 3;
-+ } else
-+ error = 2;
-+ goto out;
-+ case GR_SHUTDOWN:
-+ if ((gr_status & GR_READY)
-+ && !(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
-+ pax_open_kernel();
-+ gr_status &= ~GR_READY;
-+ pax_close_kernel();
-+
-+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG);
-+ free_variables();
-+ memset(gr_usermode, 0, sizeof (struct gr_arg));
-+ memset(gr_system_salt, 0, GR_SALT_LEN);
-+ memset(gr_system_sum, 0, GR_SHA_LEN);
-+ } else if (gr_status & GR_READY) {
-+ gr_log_noargs(GR_DONT_AUDIT, GR_SHUTF_ACL_MSG);
-+ error = -EPERM;
-+ } else {
-+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTI_ACL_MSG);
-+ error = -EAGAIN;
-+ }
-+ break;
-+ case GR_ENABLE:
-+ if (!(gr_status & GR_READY) && !(error2 = gracl_init(gr_usermode)))
-+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_ENABLE_ACL_MSG, GR_VERSION);
-+ else {
-+ if (gr_status & GR_READY)
-+ error = -EAGAIN;
-+ else
-+ error = error2;
-+ gr_log_str(GR_DONT_AUDIT, GR_ENABLEF_ACL_MSG, GR_VERSION);
-+ }
-+ break;
-+ case GR_RELOAD:
-+ if (!(gr_status & GR_READY)) {
-+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOADI_ACL_MSG, GR_VERSION);
-+ error = -EAGAIN;
-+ } else if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
-+ lock_kernel();
-+
-+ pax_open_kernel();
-+ gr_status &= ~GR_READY;
-+ pax_close_kernel();
-+
-+ free_variables();
-+ if (!(error2 = gracl_init(gr_usermode))) {
-+ unlock_kernel();
-+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOAD_ACL_MSG, GR_VERSION);
-+ } else {
-+ unlock_kernel();
-+ error = error2;
-+ gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
-+ }
-+ } else {
-+ gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
-+ error = -EPERM;
-+ }
-+ break;
-+ case GR_SEGVMOD:
-+ if (unlikely(!(gr_status & GR_READY))) {
-+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODI_ACL_MSG);
-+ error = -EAGAIN;
-+ break;
-+ }
-+
-+ if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
-+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODS_ACL_MSG);
-+ if (gr_usermode->segv_device && gr_usermode->segv_inode) {
-+ struct acl_subject_label *segvacl;
-+ segvacl =
-+ lookup_acl_subj_label(gr_usermode->segv_inode,
-+ gr_usermode->segv_device,
-+ current->role);
-+ if (segvacl) {
-+ segvacl->crashes = 0;
-+ segvacl->expires = 0;
-+ }
-+ } else if (gr_find_uid(gr_usermode->segv_uid) >= 0) {
-+ gr_remove_uid(gr_usermode->segv_uid);
-+ }
-+ } else {
-+ gr_log_noargs(GR_DONT_AUDIT, GR_SEGVMODF_ACL_MSG);
-+ error = -EPERM;
-+ }
-+ break;
-+ case GR_SPROLE:
-+ case GR_SPROLEPAM:
-+ if (unlikely(!(gr_status & GR_READY))) {
-+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SPROLEI_ACL_MSG);
-+ error = -EAGAIN;
-+ break;
-+ }
-+
-+ if (current->role->expires && time_after_eq(get_seconds(), current->role->expires)) {
-+ current->role->expires = 0;
-+ current->role->auth_attempts = 0;
-+ }
-+
-+ if (current->role->auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
-+ time_after(current->role->expires, get_seconds())) {
-+ error = -EBUSY;
-+ goto out;
-+ }
-+
-+ if (lookup_special_role_auth
-+ (gr_usermode->mode, gr_usermode->sp_role, &sprole_salt, &sprole_sum)
-+ && ((!sprole_salt && !sprole_sum)
-+ || !(chkpw(gr_usermode, sprole_salt, sprole_sum)))) {
-+ char *p = "";
-+ assign_special_role(gr_usermode->sp_role);
-+ read_lock(&tasklist_lock);
-+ if (current->real_parent)
-+ p = current->real_parent->role->rolename;
-+ read_unlock(&tasklist_lock);
-+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLES_ACL_MSG,
-+ p, acl_sp_role_value);
-+ } else {
-+ gr_log_str(GR_DONT_AUDIT, GR_SPROLEF_ACL_MSG, gr_usermode->sp_role);
-+ error = -EPERM;
-+ if(!(current->role->auth_attempts++))
-+ current->role->expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
-+
-+ goto out;
-+ }
-+ break;
-+ case GR_UNSPROLE:
-+ if (unlikely(!(gr_status & GR_READY))) {
-+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_UNSPROLEI_ACL_MSG);
-+ error = -EAGAIN;
-+ break;
-+ }
-+
-+ if (current->role->roletype & GR_ROLE_SPECIAL) {
-+ char *p = "";
-+ int i = 0;
-+
-+ read_lock(&tasklist_lock);
-+ if (current->real_parent) {
-+ p = current->real_parent->role->rolename;
-+ i = current->real_parent->acl_role_id;
-+ }
-+ read_unlock(&tasklist_lock);
-+
-+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_UNSPROLES_ACL_MSG, p, i);
-+ gr_set_acls(1);
-+ } else {
-+ error = -EPERM;
-+ goto out;
-+ }
-+ break;
-+ default:
-+ gr_log_int(GR_DONT_AUDIT, GR_INVMODE_ACL_MSG, gr_usermode->mode);
-+ error = -EINVAL;
-+ break;
-+ }
-+
-+ if (error != -EPERM)
-+ goto out;
-+
-+ if(!(gr_auth_attempts++))
-+ gr_auth_expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
-+
-+ out:
-+ mutex_unlock(&gr_dev_mutex);
-+ return error;
-+}
-+
-+/* must be called with
-+ rcu_read_lock();
-+ read_lock(&tasklist_lock);
-+ read_lock(&grsec_exec_file_lock);
-+*/
-+int gr_apply_subject_to_task(struct task_struct *task)
-+{
-+ struct acl_object_label *obj;
-+ char *tmpname;
-+ struct acl_subject_label *tmpsubj;
-+ struct file *filp;
-+ struct name_entry *nmatch;
-+
-+ filp = task->exec_file;
-+ if (filp == NULL)
-+ return 0;
-+
-+ /* the following is to apply the correct subject
-+ on binaries running when the RBAC system
-+ is enabled, when the binaries have been
-+ replaced or deleted since their execution
-+ -----
-+ when the RBAC system starts, the inode/dev
-+ from exec_file will be one the RBAC system
-+ is unaware of. It only knows the inode/dev
-+ of the present file on disk, or the absence
-+ of it.
-+ */
-+ preempt_disable();
-+ tmpname = gr_to_filename_rbac(filp->f_path.dentry, filp->f_path.mnt);
-+
-+ nmatch = lookup_name_entry(tmpname);
-+ preempt_enable();
-+ tmpsubj = NULL;
-+ if (nmatch) {
-+ if (nmatch->deleted)
-+ tmpsubj = lookup_acl_subj_label_deleted(nmatch->inode, nmatch->device, task->role);
-+ else
-+ tmpsubj = lookup_acl_subj_label(nmatch->inode, nmatch->device, task->role);
-+ if (tmpsubj != NULL)
-+ task->acl = tmpsubj;
-+ }
-+ if (tmpsubj == NULL)
-+ task->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt,
-+ task->role);
-+ if (task->acl) {
-+ task->is_writable = 0;
-+ /* ignore additional mmap checks for processes that are writable
-+ by the default ACL */
-+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
-+ if (unlikely(obj->mode & GR_WRITE))
-+ task->is_writable = 1;
-+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
-+ if (unlikely(obj->mode & GR_WRITE))
-+ task->is_writable = 1;
-+
-+ gr_set_proc_res(task);
-+
-+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
-+ printk(KERN_ALERT "gr_set_acls for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
-+#endif
-+ } else {
-+ return 1;
-+ }
-+
-+ return 0;
-+}
-+
-+int
-+gr_set_acls(const int type)
-+{
-+ struct task_struct *task, *task2;
-+ struct acl_role_label *role = current->role;
-+ __u16 acl_role_id = current->acl_role_id;
-+ const struct cred *cred;
-+ int ret;
-+
-+ rcu_read_lock();
-+ read_lock(&tasklist_lock);
-+ read_lock(&grsec_exec_file_lock);
-+ do_each_thread(task2, task) {
-+ /* check to see if we're called from the exit handler,
-+ if so, only replace ACLs that have inherited the admin
-+ ACL */
-+
-+ if (type && (task->role != role ||
-+ task->acl_role_id != acl_role_id))
-+ continue;
-+
-+ task->acl_role_id = 0;
-+ task->acl_sp_role = 0;
-+
-+ if (task->exec_file) {
-+ cred = __task_cred(task);
-+ task->role = lookup_acl_role_label(task, cred->uid, cred->gid);
-+
-+ ret = gr_apply_subject_to_task(task);
-+ if (ret) {
-+ read_unlock(&grsec_exec_file_lock);
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_DEFACL_MSG, task->comm, task->pid);
-+ return ret;
-+ }
-+ } else {
-+ // it's a kernel process
-+ task->role = kernel_role;
-+ task->acl = kernel_role->root_label;
-+#ifdef CONFIG_GRKERNSEC_ACL_HIDEKERN
-+ task->acl->mode &= ~GR_PROCFIND;
-+#endif
-+ }
-+ } while_each_thread(task2, task);
-+ read_unlock(&grsec_exec_file_lock);
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+
-+ return 0;
-+}
-+
-+void
-+gr_learn_resource(const struct task_struct *task,
-+ const int res, const unsigned long wanted, const int gt)
-+{
-+ struct acl_subject_label *acl;
-+ const struct cred *cred;
-+
-+ if (unlikely((gr_status & GR_READY) &&
-+ task->acl && (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))))
-+ goto skip_reslog;
-+
-+#ifdef CONFIG_GRKERNSEC_RESLOG
-+ gr_log_resource(task, res, wanted, gt);
-+#endif
-+ skip_reslog:
-+
-+ if (unlikely(!(gr_status & GR_READY) || !wanted || res >= GR_NLIMITS))
-+ return;
-+
-+ acl = task->acl;
-+
-+ if (likely(!acl || !(acl->mode & (GR_LEARN | GR_INHERITLEARN)) ||
-+ !(acl->resmask & (1 << (unsigned short) res))))
-+ return;
-+
-+ if (wanted >= acl->res[res].rlim_cur) {
-+ unsigned long res_add;
-+
-+ res_add = wanted;
-+ switch (res) {
-+ case RLIMIT_CPU:
-+ res_add += GR_RLIM_CPU_BUMP;
-+ break;
-+ case RLIMIT_FSIZE:
-+ res_add += GR_RLIM_FSIZE_BUMP;
-+ break;
-+ case RLIMIT_DATA:
-+ res_add += GR_RLIM_DATA_BUMP;
-+ break;
-+ case RLIMIT_STACK:
-+ res_add += GR_RLIM_STACK_BUMP;
-+ break;
-+ case RLIMIT_CORE:
-+ res_add += GR_RLIM_CORE_BUMP;
-+ break;
-+ case RLIMIT_RSS:
-+ res_add += GR_RLIM_RSS_BUMP;
-+ break;
-+ case RLIMIT_NPROC:
-+ res_add += GR_RLIM_NPROC_BUMP;
-+ break;
-+ case RLIMIT_NOFILE:
-+ res_add += GR_RLIM_NOFILE_BUMP;
-+ break;
-+ case RLIMIT_MEMLOCK:
-+ res_add += GR_RLIM_MEMLOCK_BUMP;
-+ break;
-+ case RLIMIT_AS:
-+ res_add += GR_RLIM_AS_BUMP;
-+ break;
-+ case RLIMIT_LOCKS:
-+ res_add += GR_RLIM_LOCKS_BUMP;
-+ break;
-+ case RLIMIT_SIGPENDING:
-+ res_add += GR_RLIM_SIGPENDING_BUMP;
-+ break;
-+ case RLIMIT_MSGQUEUE:
-+ res_add += GR_RLIM_MSGQUEUE_BUMP;
-+ break;
-+ case RLIMIT_NICE:
-+ res_add += GR_RLIM_NICE_BUMP;
-+ break;
-+ case RLIMIT_RTPRIO:
-+ res_add += GR_RLIM_RTPRIO_BUMP;
-+ break;
-+ case RLIMIT_RTTIME:
-+ res_add += GR_RLIM_RTTIME_BUMP;
-+ break;
-+ }
-+
-+ acl->res[res].rlim_cur = res_add;
-+
-+ if (wanted > acl->res[res].rlim_max)
-+ acl->res[res].rlim_max = res_add;
-+
-+ /* only log the subject filename, since resource logging is supported for
-+ single-subject learning only */
-+ rcu_read_lock();
-+ cred = __task_cred(task);
-+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
-+ task->role->roletype, cred->uid, cred->gid, acl->filename,
-+ acl->filename, acl->res[res].rlim_cur, acl->res[res].rlim_max,
-+ "", (unsigned long) res, &task->signal->saved_ip);
-+ rcu_read_unlock();
-+ }
-+
-+ return;
-+}
-+
-+#if defined(CONFIG_PAX_HAVE_ACL_FLAGS) && (defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR))
-+void
-+pax_set_initial_flags(struct linux_binprm *bprm)
-+{
-+ struct task_struct *task = current;
-+ struct acl_subject_label *proc;
-+ unsigned long flags;
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return;
-+
-+ flags = pax_get_flags(task);
-+
-+ proc = task->acl;
-+
-+ if (proc->pax_flags & GR_PAX_DISABLE_PAGEEXEC)
-+ flags &= ~MF_PAX_PAGEEXEC;
-+ if (proc->pax_flags & GR_PAX_DISABLE_SEGMEXEC)
-+ flags &= ~MF_PAX_SEGMEXEC;
-+ if (proc->pax_flags & GR_PAX_DISABLE_RANDMMAP)
-+ flags &= ~MF_PAX_RANDMMAP;
-+ if (proc->pax_flags & GR_PAX_DISABLE_EMUTRAMP)
-+ flags &= ~MF_PAX_EMUTRAMP;
-+ if (proc->pax_flags & GR_PAX_DISABLE_MPROTECT)
-+ flags &= ~MF_PAX_MPROTECT;
-+
-+ if (proc->pax_flags & GR_PAX_ENABLE_PAGEEXEC)
-+ flags |= MF_PAX_PAGEEXEC;
-+ if (proc->pax_flags & GR_PAX_ENABLE_SEGMEXEC)
-+ flags |= MF_PAX_SEGMEXEC;
-+ if (proc->pax_flags & GR_PAX_ENABLE_RANDMMAP)
-+ flags |= MF_PAX_RANDMMAP;
-+ if (proc->pax_flags & GR_PAX_ENABLE_EMUTRAMP)
-+ flags |= MF_PAX_EMUTRAMP;
-+ if (proc->pax_flags & GR_PAX_ENABLE_MPROTECT)
-+ flags |= MF_PAX_MPROTECT;
-+
-+ pax_set_flags(task, flags);
-+
-+ return;
-+}
-+#endif
-+
-+#ifdef CONFIG_SYSCTL
-+/* Eric Biederman likes breaking userland ABI and every inode-based security
-+ system to save 35kb of memory */
-+
-+/* we modify the passed in filename, but adjust it back before returning */
-+static struct acl_object_label *gr_lookup_by_name(char *name, unsigned int len)
-+{
-+ struct name_entry *nmatch;
-+ char *p, *lastp = NULL;
-+ struct acl_object_label *obj = NULL, *tmp;
-+ struct acl_subject_label *tmpsubj;
-+ char c = '\0';
-+
-+ read_lock(&gr_inode_lock);
-+
-+ p = name + len - 1;
-+ do {
-+ nmatch = lookup_name_entry(name);
-+ if (lastp != NULL)
-+ *lastp = c;
-+
-+ if (nmatch == NULL)
-+ goto next_component;
-+ tmpsubj = current->acl;
-+ do {
-+ obj = lookup_acl_obj_label(nmatch->inode, nmatch->device, tmpsubj);
-+ if (obj != NULL) {
-+ tmp = obj->globbed;
-+ while (tmp) {
-+ if (!glob_match(tmp->filename, name)) {
-+ obj = tmp;
-+ goto found_obj;
-+ }
-+ tmp = tmp->next;
-+ }
-+ goto found_obj;
-+ }
-+ } while ((tmpsubj = tmpsubj->parent_subject));
-+next_component:
-+ /* end case */
-+ if (p == name)
-+ break;
-+
-+ while (*p != '/')
-+ p--;
-+ if (p == name)
-+ lastp = p + 1;
-+ else {
-+ lastp = p;
-+ p--;
-+ }
-+ c = *lastp;
-+ *lastp = '\0';
-+ } while (1);
-+found_obj:
-+ read_unlock(&gr_inode_lock);
-+ /* obj returned will always be non-null */
-+ return obj;
-+}
-+
-+/* returns 0 when allowing, non-zero on error
-+ op of 0 is used for readdir, so we don't log the names of hidden files
-+*/
-+__u32
-+gr_handle_sysctl(const struct ctl_table *table, const int op)
-+{
-+ ctl_table *tmp;
-+ const char *proc_sys = "/proc/sys";
-+ char *path;
-+ struct acl_object_label *obj;
-+ unsigned short len = 0, pos = 0, depth = 0, i;
-+ __u32 err = 0;
-+ __u32 mode = 0;
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return 0;
-+
-+ /* for now, ignore operations on non-sysctl entries if it's not a
-+ readdir*/
-+ if (table->child != NULL && op != 0)
-+ return 0;
-+
-+ mode |= GR_FIND;
-+ /* it's only a read if it's an entry, read on dirs is for readdir */
-+ if (op & MAY_READ)
-+ mode |= GR_READ;
-+ if (op & MAY_WRITE)
-+ mode |= GR_WRITE;
-+
-+ preempt_disable();
-+
-+ path = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
-+
-+ /* it's only a read/write if it's an actual entry, not a dir
-+ (which are opened for readdir)
-+ */
-+
-+ /* convert the requested sysctl entry into a pathname */
-+
-+ for (tmp = (ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
-+ len += strlen(tmp->procname);
-+ len++;
-+ depth++;
-+ }
-+
-+ if ((len + depth + strlen(proc_sys) + 1) > PAGE_SIZE) {
-+ /* deny */
-+ goto out;
-+ }
-+
-+ memset(path, 0, PAGE_SIZE);
-+
-+ memcpy(path, proc_sys, strlen(proc_sys));
-+
-+ pos += strlen(proc_sys);
-+
-+ for (; depth > 0; depth--) {
-+ path[pos] = '/';
-+ pos++;
-+ for (i = 1, tmp = (ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
-+ if (depth == i) {
-+ memcpy(path + pos, tmp->procname,
-+ strlen(tmp->procname));
-+ pos += strlen(tmp->procname);
-+ }
-+ i++;
-+ }
-+ }
-+
-+ obj = gr_lookup_by_name(path, pos);
-+ err = obj->mode & (mode | to_gr_audit(mode) | GR_SUPPRESS);
-+
-+ if (unlikely((current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) &&
-+ ((err & mode) != mode))) {
-+ __u32 new_mode = mode;
-+
-+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
-+
-+ err = 0;
-+ gr_log_learn_sysctl(path, new_mode);
-+ } else if (!(err & GR_FIND) && !(err & GR_SUPPRESS) && op != 0) {
-+ gr_log_hidden_sysctl(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, path);
-+ err = -ENOENT;
-+ } else if (!(err & GR_FIND)) {
-+ err = -ENOENT;
-+ } else if (((err & mode) & ~GR_FIND) != (mode & ~GR_FIND) && !(err & GR_SUPPRESS)) {
-+ gr_log_str4(GR_DONT_AUDIT, GR_SYSCTL_ACL_MSG, "denied",
-+ path, (mode & GR_READ) ? " reading" : "",
-+ (mode & GR_WRITE) ? " writing" : "");
-+ err = -EACCES;
-+ } else if ((err & mode) != mode) {
-+ err = -EACCES;
-+ } else if ((((err & mode) & ~GR_FIND) == (mode & ~GR_FIND)) && (err & GR_AUDITS)) {
-+ gr_log_str4(GR_DO_AUDIT, GR_SYSCTL_ACL_MSG, "successful",
-+ path, (mode & GR_READ) ? " reading" : "",
-+ (mode & GR_WRITE) ? " writing" : "");
-+ err = 0;
-+ } else
-+ err = 0;
-+
-+ out:
-+ preempt_enable();
-+
-+ return err;
-+}
-+#endif
-+
-+int
-+gr_handle_proc_ptrace(struct task_struct *task)
-+{
-+ struct file *filp;
-+ struct task_struct *tmp = task;
-+ struct task_struct *curtemp = current;
-+ __u32 retmode;
-+
-+#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return 0;
-+#endif
-+
-+ read_lock(&tasklist_lock);
-+ read_lock(&grsec_exec_file_lock);
-+ filp = task->exec_file;
-+
-+ while (tmp->pid > 0) {
-+ if (tmp == curtemp)
-+ break;
-+ tmp = tmp->real_parent;
-+ }
-+
-+ if (!filp || (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
-+ ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE))))) {
-+ read_unlock(&grsec_exec_file_lock);
-+ read_unlock(&tasklist_lock);
-+ return 1;
-+ }
-+
-+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+ if (!(gr_status & GR_READY)) {
-+ read_unlock(&grsec_exec_file_lock);
-+ read_unlock(&tasklist_lock);
-+ return 0;
-+ }
-+#endif
-+
-+ retmode = gr_search_file(filp->f_path.dentry, GR_NOPTRACE, filp->f_path.mnt);
-+ read_unlock(&grsec_exec_file_lock);
-+ read_unlock(&tasklist_lock);
-+
-+ if (retmode & GR_NOPTRACE)
-+ return 1;
-+
-+ if (!(current->acl->mode & GR_POVERRIDE) && !(current->role->roletype & GR_ROLE_GOD)
-+ && (current->acl != task->acl || (current->acl != current->role->root_label
-+ && current->pid != task->pid)))
-+ return 1;
-+
-+ return 0;
-+}
-+
-+void task_grsec_rbac(struct seq_file *m, struct task_struct *p)
-+{
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return;
-+
-+ if (!(current->role->roletype & GR_ROLE_GOD))
-+ return;
-+
-+ seq_printf(m, "RBAC:\t%.64s:%c:%.950s\n",
-+ p->role->rolename, gr_task_roletype_to_char(p),
-+ p->acl->filename);
-+}
-+
-+int
-+gr_handle_ptrace(struct task_struct *task, const long request)
-+{
-+ struct task_struct *tmp = task;
-+ struct task_struct *curtemp = current;
-+ __u32 retmode;
-+
-+#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return 0;
-+#endif
-+
-+ read_lock(&tasklist_lock);
-+ while (tmp->pid > 0) {
-+ if (tmp == curtemp)
-+ break;
-+ tmp = tmp->real_parent;
-+ }
-+
-+ if (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
-+ ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE)))) {
-+ read_unlock(&tasklist_lock);
-+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
-+ return 1;
-+ }
-+ read_unlock(&tasklist_lock);
-+
-+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+ if (!(gr_status & GR_READY))
-+ return 0;
-+#endif
-+
-+ read_lock(&grsec_exec_file_lock);
-+ if (unlikely(!task->exec_file)) {
-+ read_unlock(&grsec_exec_file_lock);
-+ return 0;
-+ }
-+
-+ retmode = gr_search_file(task->exec_file->f_path.dentry, GR_PTRACERD | GR_NOPTRACE, task->exec_file->f_path.mnt);
-+ read_unlock(&grsec_exec_file_lock);
-+
-+ if (retmode & GR_NOPTRACE) {
-+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
-+ return 1;
-+ }
-+
-+ if (retmode & GR_PTRACERD) {
-+ switch (request) {
-+ case PTRACE_POKETEXT:
-+ case PTRACE_POKEDATA:
-+ case PTRACE_POKEUSR:
-+#if !defined(CONFIG_PPC32) && !defined(CONFIG_PPC64) && !defined(CONFIG_PARISC) && !defined(CONFIG_ALPHA) && !defined(CONFIG_IA64)
-+ case PTRACE_SETREGS:
-+ case PTRACE_SETFPREGS:
-+#endif
-+#ifdef CONFIG_X86
-+ case PTRACE_SETFPXREGS:
-+#endif
-+#ifdef CONFIG_ALTIVEC
-+ case PTRACE_SETVRREGS:
-+#endif
-+ return 1;
-+ default:
-+ return 0;
-+ }
-+ } else if (!(current->acl->mode & GR_POVERRIDE) &&
-+ !(current->role->roletype & GR_ROLE_GOD) &&
-+ (current->acl != task->acl)) {
-+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
-+ return 1;
-+ }
-+
-+ return 0;
-+}
-+
-+static int is_writable_mmap(const struct file *filp)
-+{
-+ struct task_struct *task = current;
-+ struct acl_object_label *obj, *obj2;
-+
-+ if (gr_status & GR_READY && !(task->acl->mode & GR_OVERRIDE) &&
-+ !task->is_writable && S_ISREG(filp->f_path.dentry->d_inode->i_mode) && (filp->f_path.mnt != shm_mnt || (filp->f_path.dentry->d_inode->i_nlink > 0))) {
-+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
-+ obj2 = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt,
-+ task->role->root_label);
-+ if (unlikely((obj->mode & GR_WRITE) || (obj2->mode & GR_WRITE))) {
-+ gr_log_fs_generic(GR_DONT_AUDIT, GR_WRITLIB_ACL_MSG, filp->f_path.dentry, filp->f_path.mnt);
-+ return 1;
-+ }
-+ }
-+ return 0;
-+}
-+
-+int
-+gr_acl_handle_mmap(const struct file *file, const unsigned long prot)
-+{
-+ __u32 mode;
-+
-+ if (unlikely(!file || !(prot & PROT_EXEC)))
-+ return 1;
-+
-+ if (is_writable_mmap(file))
-+ return 0;
-+
-+ mode =
-+ gr_search_file(file->f_path.dentry,
-+ GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
-+ file->f_path.mnt);
-+
-+ if (!gr_tpe_allow(file))
-+ return 0;
-+
-+ if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
-+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
-+ return 0;
-+ } else if (unlikely(!(mode & GR_EXEC))) {
-+ return 0;
-+ } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
-+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
-+ return 1;
-+ }
-+
-+ return 1;
-+}
-+
-+int
-+gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
-+{
-+ __u32 mode;
-+
-+ if (unlikely(!file || !(prot & PROT_EXEC)))
-+ return 1;
-+
-+ if (is_writable_mmap(file))
-+ return 0;
-+
-+ mode =
-+ gr_search_file(file->f_path.dentry,
-+ GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
-+ file->f_path.mnt);
-+
-+ if (!gr_tpe_allow(file))
-+ return 0;
-+
-+ if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
-+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
-+ return 0;
-+ } else if (unlikely(!(mode & GR_EXEC))) {
-+ return 0;
-+ } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
-+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
-+ return 1;
-+ }
-+
-+ return 1;
-+}
-+
-+void
-+gr_acl_handle_psacct(struct task_struct *task, const long code)
-+{
-+ unsigned long runtime;
-+ unsigned long cputime;
-+ unsigned int wday, cday;
-+ __u8 whr, chr;
-+ __u8 wmin, cmin;
-+ __u8 wsec, csec;
-+ struct timespec timeval;
-+
-+ if (unlikely(!(gr_status & GR_READY) || !task->acl ||
-+ !(task->acl->mode & GR_PROCACCT)))
-+ return;
-+
-+ do_posix_clock_monotonic_gettime(&timeval);
-+ runtime = timeval.tv_sec - task->start_time.tv_sec;
-+ wday = runtime / (3600 * 24);
-+ runtime -= wday * (3600 * 24);
-+ whr = runtime / 3600;
-+ runtime -= whr * 3600;
-+ wmin = runtime / 60;
-+ runtime -= wmin * 60;
-+ wsec = runtime;
-+
-+ cputime = (task->utime + task->stime) / HZ;
-+ cday = cputime / (3600 * 24);
-+ cputime -= cday * (3600 * 24);
-+ chr = cputime / 3600;
-+ cputime -= chr * 3600;
-+ cmin = cputime / 60;
-+ cputime -= cmin * 60;
-+ csec = cputime;
-+
-+ gr_log_procacct(GR_DO_AUDIT, GR_ACL_PROCACCT_MSG, task, wday, whr, wmin, wsec, cday, chr, cmin, csec, code);
-+
-+ return;
-+}
-+
-+void gr_set_kernel_label(struct task_struct *task)
-+{
-+ if (gr_status & GR_READY) {
-+ task->role = kernel_role;
-+ task->acl = kernel_role->root_label;
-+ }
-+ return;
-+}
-+
-+#ifdef CONFIG_TASKSTATS
-+int gr_is_taskstats_denied(int pid)
-+{
-+ struct task_struct *task;
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ const struct cred *cred;
-+#endif
-+ int ret = 0;
-+
-+ /* restrict taskstats viewing to un-chrooted root users
-+ who have the 'view' subject flag if the RBAC system is enabled
-+ */
-+
-+ rcu_read_lock();
-+ read_lock(&tasklist_lock);
-+ task = find_task_by_vpid(pid);
-+ if (task) {
-+#ifdef CONFIG_GRKERNSEC_CHROOT
-+ if (proc_is_chrooted(task))
-+ ret = -EACCES;
-+#endif
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ cred = __task_cred(task);
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+ if (cred->uid != 0)
-+ ret = -EACCES;
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ if (cred->uid != 0 && !groups_search(cred->group_info, CONFIG_GRKERNSEC_PROC_GID))
-+ ret = -EACCES;
-+#endif
-+#endif
-+ if (gr_status & GR_READY) {
-+ if (!(task->acl->mode & GR_VIEW))
-+ ret = -EACCES;
-+ }
-+ } else
-+ ret = -ENOENT;
-+
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+
-+ return ret;
-+}
-+#endif
-+
-+/* AUXV entries are filled via a descendant of search_binary_handler
-+ after we've already applied the subject for the target
-+*/
-+int gr_acl_enable_at_secure(void)
-+{
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return 0;
-+
-+ if (current->acl->mode & GR_ATSECURE)
-+ return 1;
-+
-+ return 0;
-+}
-+
-+int gr_acl_handle_filldir(const struct file *file, const char *name, const unsigned int namelen, const ino_t ino)
-+{
-+ struct task_struct *task = current;
-+ struct dentry *dentry = file->f_path.dentry;
-+ struct vfsmount *mnt = file->f_path.mnt;
-+ struct acl_object_label *obj, *tmp;
-+ struct acl_subject_label *subj;
-+ unsigned int bufsize;
-+ int is_not_root;
-+ char *path;
-+ dev_t dev = __get_dev(dentry);
-+
-+ if (unlikely(!(gr_status & GR_READY)))
-+ return 1;
-+
-+ if (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))
-+ return 1;
-+
-+ /* ignore Eric Biederman */
-+ if (IS_PRIVATE(dentry->d_inode))
-+ return 1;
-+
-+ subj = task->acl;
-+ do {
-+ obj = lookup_acl_obj_label(ino, dev, subj);
-+ if (obj != NULL)
-+ return (obj->mode & GR_FIND) ? 1 : 0;
-+ } while ((subj = subj->parent_subject));
-+
-+ /* this is purely an optimization since we're looking for an object
-+ for the directory we're doing a readdir on
-+ if it's possible for any globbed object to match the entry we're
-+ filling into the directory, then the object we find here will be
-+ an anchor point with attached globbed objects
-+ */
-+ obj = chk_obj_label_noglob(dentry, mnt, task->acl);
-+ if (obj->globbed == NULL)
-+ return (obj->mode & GR_FIND) ? 1 : 0;
-+
-+ is_not_root = ((obj->filename[0] == '/') &&
-+ (obj->filename[1] == '\0')) ? 0 : 1;
-+ bufsize = PAGE_SIZE - namelen - is_not_root;
-+
-+ /* check bufsize > PAGE_SIZE || bufsize == 0 */
-+ if (unlikely((bufsize - 1) > (PAGE_SIZE - 1)))
-+ return 1;
-+
-+ preempt_disable();
-+ path = d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
-+ bufsize);
-+
-+ bufsize = strlen(path);
-+
-+ /* if base is "/", don't append an additional slash */
-+ if (is_not_root)
-+ *(path + bufsize) = '/';
-+ memcpy(path + bufsize + is_not_root, name, namelen);
-+ *(path + bufsize + namelen + is_not_root) = '\0';
-+
-+ tmp = obj->globbed;
-+ while (tmp) {
-+ if (!glob_match(tmp->filename, path)) {
-+ preempt_enable();
-+ return (tmp->mode & GR_FIND) ? 1 : 0;
-+ }
-+ tmp = tmp->next;
-+ }
-+ preempt_enable();
-+ return (obj->mode & GR_FIND) ? 1 : 0;
-+}
-+
-+#ifdef CONFIG_NETFILTER_XT_MATCH_GRADM_MODULE
-+EXPORT_SYMBOL(gr_acl_is_enabled);
-+#endif
-+EXPORT_SYMBOL(gr_learn_resource);
-+EXPORT_SYMBOL(gr_set_kernel_label);
-+#ifdef CONFIG_SECURITY
-+EXPORT_SYMBOL(gr_check_user_change);
-+EXPORT_SYMBOL(gr_check_group_change);
-+#endif
-+
-diff -urNp linux-2.6.32.45/grsecurity/gracl_cap.c linux-2.6.32.45/grsecurity/gracl_cap.c
---- linux-2.6.32.45/grsecurity/gracl_cap.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/grsecurity/gracl_cap.c 2011-04-17 15:56:46.000000000 -0400
-@@ -0,0 +1,138 @@
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/sched.h>
-+#include <linux/gracl.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+static const char *captab_log[] = {
-+ "CAP_CHOWN",
-+ "CAP_DAC_OVERRIDE",
-+ "CAP_DAC_READ_SEARCH",
-+ "CAP_FOWNER",
-+ "CAP_FSETID",
-+ "CAP_KILL",
-+ "CAP_SETGID",
-+ "CAP_SETUID",
-+ "CAP_SETPCAP",
-+ "CAP_LINUX_IMMUTABLE",
-+ "CAP_NET_BIND_SERVICE",
-+ "CAP_NET_BROADCAST",
-+ "CAP_NET_ADMIN",
-+ "CAP_NET_RAW",
-+ "CAP_IPC_LOCK",
-+ "CAP_IPC_OWNER",
-+ "CAP_SYS_MODULE",
-+ "CAP_SYS_RAWIO",
-+ "CAP_SYS_CHROOT",
-+ "CAP_SYS_PTRACE",
-+ "CAP_SYS_PACCT",
-+ "CAP_SYS_ADMIN",
-+ "CAP_SYS_BOOT",
-+ "CAP_SYS_NICE",
-+ "CAP_SYS_RESOURCE",
-+ "CAP_SYS_TIME",
-+ "CAP_SYS_TTY_CONFIG",
-+ "CAP_MKNOD",
-+ "CAP_LEASE",
-+ "CAP_AUDIT_WRITE",
-+ "CAP_AUDIT_CONTROL",
-+ "CAP_SETFCAP",
-+ "CAP_MAC_OVERRIDE",
-+ "CAP_MAC_ADMIN"
-+};
-+
-+EXPORT_SYMBOL(gr_is_capable);
-+EXPORT_SYMBOL(gr_is_capable_nolog);
-+
-+int
-+gr_is_capable(const int cap)
-+{
-+ struct task_struct *task = current;
-+ const struct cred *cred = current_cred();
-+ struct acl_subject_label *curracl;
-+ kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
-+ kernel_cap_t cap_audit = __cap_empty_set;
-+
-+ if (!gr_acl_is_enabled())
-+ return 1;
-+
-+ curracl = task->acl;
-+
-+ cap_drop = curracl->cap_lower;
-+ cap_mask = curracl->cap_mask;
-+ cap_audit = curracl->cap_invert_audit;
-+
-+ while ((curracl = curracl->parent_subject)) {
-+ /* if the cap isn't specified in the current computed mask but is specified in the
-+ current level subject, and is lowered in the current level subject, then add
-+ it to the set of dropped capabilities
-+ otherwise, add the current level subject's mask to the current computed mask
-+ */
-+ if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
-+ cap_raise(cap_mask, cap);
-+ if (cap_raised(curracl->cap_lower, cap))
-+ cap_raise(cap_drop, cap);
-+ if (cap_raised(curracl->cap_invert_audit, cap))
-+ cap_raise(cap_audit, cap);
-+ }
-+ }
-+
-+ if (!cap_raised(cap_drop, cap)) {
-+ if (cap_raised(cap_audit, cap))
-+ gr_log_cap(GR_DO_AUDIT, GR_CAP_ACL_MSG2, task, captab_log[cap]);
-+ return 1;
-+ }
-+
-+ curracl = task->acl;
-+
-+ if ((curracl->mode & (GR_LEARN | GR_INHERITLEARN))
-+ && cap_raised(cred->cap_effective, cap)) {
-+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
-+ task->role->roletype, cred->uid,
-+ cred->gid, task->exec_file ?
-+ gr_to_filename(task->exec_file->f_path.dentry,
-+ task->exec_file->f_path.mnt) : curracl->filename,
-+ curracl->filename, 0UL,
-+ 0UL, "", (unsigned long) cap, &task->signal->saved_ip);
-+ return 1;
-+ }
-+
-+ if ((cap >= 0) && (cap < (sizeof(captab_log)/sizeof(captab_log[0]))) && cap_raised(cred->cap_effective, cap) && !cap_raised(cap_audit, cap))
-+ gr_log_cap(GR_DONT_AUDIT, GR_CAP_ACL_MSG, task, captab_log[cap]);
-+ return 0;
-+}
-+
-+int
-+gr_is_capable_nolog(const int cap)
-+{
-+ struct acl_subject_label *curracl;
-+ kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
-+
-+ if (!gr_acl_is_enabled())
-+ return 1;
-+
-+ curracl = current->acl;
-+
-+ cap_drop = curracl->cap_lower;
-+ cap_mask = curracl->cap_mask;
-+
-+ while ((curracl = curracl->parent_subject)) {
-+ /* if the cap isn't specified in the current computed mask but is specified in the
-+ current level subject, and is lowered in the current level subject, then add
-+ it to the set of dropped capabilities
-+ otherwise, add the current level subject's mask to the current computed mask
-+ */
-+ if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
-+ cap_raise(cap_mask, cap);
-+ if (cap_raised(curracl->cap_lower, cap))
-+ cap_raise(cap_drop, cap);
-+ }
-+ }
-+
-+ if (!cap_raised(cap_drop, cap))
-+ return 1;
-+
-+ return 0;
-+}
-+
-diff -urNp linux-2.6.32.45/grsecurity/gracl_fs.c linux-2.6.32.45/grsecurity/gracl_fs.c
---- linux-2.6.32.45/grsecurity/gracl_fs.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/grsecurity/gracl_fs.c 2011-04-17 15:56:46.000000000 -0400
-@@ -0,0 +1,431 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/types.h>
-+#include <linux/fs.h>
-+#include <linux/file.h>
-+#include <linux/stat.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+#include <linux/gracl.h>
-+
-+__u32
-+gr_acl_handle_hidden_file(const struct dentry * dentry,
-+ const struct vfsmount * mnt)
-+{
-+ __u32 mode;
-+
-+ if (unlikely(!dentry->d_inode))
-+ return GR_FIND;
-+
-+ mode =
-+ gr_search_file(dentry, GR_FIND | GR_AUDIT_FIND | GR_SUPPRESS, mnt);
-+
-+ if (unlikely(mode & GR_FIND && mode & GR_AUDIT_FIND)) {
-+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
-+ return mode;
-+ } else if (unlikely(!(mode & GR_FIND) && !(mode & GR_SUPPRESS))) {
-+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
-+ return 0;
-+ } else if (unlikely(!(mode & GR_FIND)))
-+ return 0;
-+
-+ return GR_FIND;
-+}
-+
-+__u32
-+gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
-+ const int fmode)
-+{
-+ __u32 reqmode = GR_FIND;
-+ __u32 mode;
-+
-+ if (unlikely(!dentry->d_inode))
-+ return reqmode;
-+
-+ if (unlikely(fmode & O_APPEND))
-+ reqmode |= GR_APPEND;
-+ else if (unlikely(fmode & FMODE_WRITE))
-+ reqmode |= GR_WRITE;
-+ if (likely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
-+ reqmode |= GR_READ;
-+ if ((fmode & FMODE_GREXEC) && (fmode & FMODE_EXEC))
-+ reqmode &= ~GR_READ;
-+ mode =
-+ gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
-+ mnt);
-+
-+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
-+ gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
-+ reqmode & GR_READ ? " reading" : "",
-+ reqmode & GR_WRITE ? " writing" : reqmode &
-+ GR_APPEND ? " appending" : "");
-+ return reqmode;
-+ } else
-+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
-+ {
-+ gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
-+ reqmode & GR_READ ? " reading" : "",
-+ reqmode & GR_WRITE ? " writing" : reqmode &
-+ GR_APPEND ? " appending" : "");
-+ return 0;
-+ } else if (unlikely((mode & reqmode) != reqmode))
-+ return 0;
-+
-+ return reqmode;
-+}
-+
-+__u32
-+gr_acl_handle_creat(const struct dentry * dentry,
-+ const struct dentry * p_dentry,
-+ const struct vfsmount * p_mnt, const int fmode,
-+ const int imode)
-+{
-+ __u32 reqmode = GR_WRITE | GR_CREATE;
-+ __u32 mode;
-+
-+ if (unlikely(fmode & O_APPEND))
-+ reqmode |= GR_APPEND;
-+ if (unlikely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
-+ reqmode |= GR_READ;
-+ if (unlikely((fmode & O_CREAT) && (imode & (S_ISUID | S_ISGID))))
-+ reqmode |= GR_SETID;
-+
-+ mode =
-+ gr_check_create(dentry, p_dentry, p_mnt,
-+ reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
-+
-+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
-+ gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
-+ reqmode & GR_READ ? " reading" : "",
-+ reqmode & GR_WRITE ? " writing" : reqmode &
-+ GR_APPEND ? " appending" : "");
-+ return reqmode;
-+ } else
-+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
-+ {
-+ gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
-+ reqmode & GR_READ ? " reading" : "",
-+ reqmode & GR_WRITE ? " writing" : reqmode &
-+ GR_APPEND ? " appending" : "");
-+ return 0;
-+ } else if (unlikely((mode & reqmode) != reqmode))
-+ return 0;
-+
-+ return reqmode;
-+}
-+
-+__u32
-+gr_acl_handle_access(const struct dentry * dentry, const struct vfsmount * mnt,
-+ const int fmode)
-+{
-+ __u32 mode, reqmode = GR_FIND;
-+
-+ if ((fmode & S_IXOTH) && !S_ISDIR(dentry->d_inode->i_mode))
-+ reqmode |= GR_EXEC;
-+ if (fmode & S_IWOTH)
-+ reqmode |= GR_WRITE;
-+ if (fmode & S_IROTH)
-+ reqmode |= GR_READ;
-+
-+ mode =
-+ gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
-+ mnt);
-+
-+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
-+ gr_log_fs_rbac_mode3(GR_DO_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
-+ reqmode & GR_READ ? " reading" : "",
-+ reqmode & GR_WRITE ? " writing" : "",
-+ reqmode & GR_EXEC ? " executing" : "");
-+ return reqmode;
-+ } else
-+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
-+ {
-+ gr_log_fs_rbac_mode3(GR_DONT_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
-+ reqmode & GR_READ ? " reading" : "",
-+ reqmode & GR_WRITE ? " writing" : "",
-+ reqmode & GR_EXEC ? " executing" : "");
-+ return 0;
-+ } else if (unlikely((mode & reqmode) != reqmode))
-+ return 0;
-+
-+ return reqmode;
-+}
-+
-+static __u32 generic_fs_handler(const struct dentry *dentry, const struct vfsmount *mnt, __u32 reqmode, const char *fmt)
-+{
-+ __u32 mode;
-+
-+ mode = gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS, mnt);
-+
-+ if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
-+ gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, dentry, mnt);
-+ return mode;
-+ } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
-+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, dentry, mnt);
-+ return 0;
-+ } else if (unlikely((mode & (reqmode)) != (reqmode)))
-+ return 0;
-+
-+ return (reqmode);
-+}
-+
-+__u32
-+gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_RMDIR_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_unlink(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_UNLINK_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_truncate(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_TRUNCATE_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_utime(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_ATIME_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_fchmod(const struct dentry *dentry, const struct vfsmount *mnt,
-+ mode_t mode)
-+{
-+ if (unlikely(dentry->d_inode && S_ISSOCK(dentry->d_inode->i_mode)))
-+ return 1;
-+
-+ if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
-+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
-+ GR_FCHMOD_ACL_MSG);
-+ } else {
-+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_FCHMOD_ACL_MSG);
-+ }
-+}
-+
-+__u32
-+gr_acl_handle_chmod(const struct dentry *dentry, const struct vfsmount *mnt,
-+ mode_t mode)
-+{
-+ if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
-+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
-+ GR_CHMOD_ACL_MSG);
-+ } else {
-+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHMOD_ACL_MSG);
-+ }
-+}
-+
-+__u32
-+gr_acl_handle_chown(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHOWN_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_setxattr(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_SETXATTR_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_execve(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return generic_fs_handler(dentry, mnt, GR_EXEC, GR_EXEC_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_unix(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return generic_fs_handler(dentry, mnt, GR_READ | GR_WRITE,
-+ GR_UNIXCONNECT_ACL_MSG);
-+}
-+
-+/* hardlinks require at minimum create permission,
-+ any additional privilege required is based on the
-+ privilege of the file being linked to
-+*/
-+__u32
-+gr_acl_handle_link(const struct dentry * new_dentry,
-+ const struct dentry * parent_dentry,
-+ const struct vfsmount * parent_mnt,
-+ const struct dentry * old_dentry,
-+ const struct vfsmount * old_mnt, const char *to)
-+{
-+ __u32 mode;
-+ __u32 needmode = GR_CREATE | GR_LINK;
-+ __u32 needaudit = GR_AUDIT_CREATE | GR_AUDIT_LINK;
-+
-+ mode =
-+ gr_check_link(new_dentry, parent_dentry, parent_mnt, old_dentry,
-+ old_mnt);
-+
-+ if (unlikely(((mode & needmode) == needmode) && (mode & needaudit))) {
-+ gr_log_fs_rbac_str(GR_DO_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
-+ return mode;
-+ } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
-+ gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
-+ return 0;
-+ } else if (unlikely((mode & needmode) != needmode))
-+ return 0;
-+
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_symlink(const struct dentry * new_dentry,
-+ const struct dentry * parent_dentry,
-+ const struct vfsmount * parent_mnt, const char *from)
-+{
-+ __u32 needmode = GR_WRITE | GR_CREATE;
-+ __u32 mode;
-+
-+ mode =
-+ gr_check_create(new_dentry, parent_dentry, parent_mnt,
-+ GR_CREATE | GR_AUDIT_CREATE |
-+ GR_WRITE | GR_AUDIT_WRITE | GR_SUPPRESS);
-+
-+ if (unlikely(mode & GR_WRITE && mode & GR_AUDITS)) {
-+ gr_log_fs_str_rbac(GR_DO_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
-+ return mode;
-+ } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
-+ gr_log_fs_str_rbac(GR_DONT_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
-+ return 0;
-+ } else if (unlikely((mode & needmode) != needmode))
-+ return 0;
-+
-+ return (GR_WRITE | GR_CREATE);
-+}
-+
-+static __u32 generic_fs_create_handler(const struct dentry *new_dentry, const struct dentry *parent_dentry, const struct vfsmount *parent_mnt, __u32 reqmode, const char *fmt)
-+{
-+ __u32 mode;
-+
-+ mode = gr_check_create(new_dentry, parent_dentry, parent_mnt, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
-+
-+ if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
-+ gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, new_dentry, parent_mnt);
-+ return mode;
-+ } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
-+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, new_dentry, parent_mnt);
-+ return 0;
-+ } else if (unlikely((mode & (reqmode)) != (reqmode)))
-+ return 0;
-+
-+ return (reqmode);
-+}
-+
-+__u32
-+gr_acl_handle_mknod(const struct dentry * new_dentry,
-+ const struct dentry * parent_dentry,
-+ const struct vfsmount * parent_mnt,
-+ const int mode)
-+{
-+ __u32 reqmode = GR_WRITE | GR_CREATE;
-+ if (unlikely(mode & (S_ISUID | S_ISGID)))
-+ reqmode |= GR_SETID;
-+
-+ return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
-+ reqmode, GR_MKNOD_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_mkdir(const struct dentry *new_dentry,
-+ const struct dentry *parent_dentry,
-+ const struct vfsmount *parent_mnt)
-+{
-+ return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
-+ GR_WRITE | GR_CREATE, GR_MKDIR_ACL_MSG);
-+}
-+
-+#define RENAME_CHECK_SUCCESS(old, new) \
-+ (((old & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)) && \
-+ ((new & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)))
-+
-+int
-+gr_acl_handle_rename(struct dentry *new_dentry,
-+ struct dentry *parent_dentry,
-+ const struct vfsmount *parent_mnt,
-+ struct dentry *old_dentry,
-+ struct inode *old_parent_inode,
-+ struct vfsmount *old_mnt, const char *newname)
-+{
-+ __u32 comp1, comp2;
-+ int error = 0;
-+
-+ if (unlikely(!gr_acl_is_enabled()))
-+ return 0;
-+
-+ if (!new_dentry->d_inode) {
-+ comp1 = gr_check_create(new_dentry, parent_dentry, parent_mnt,
-+ GR_READ | GR_WRITE | GR_CREATE | GR_AUDIT_READ |
-+ GR_AUDIT_WRITE | GR_AUDIT_CREATE | GR_SUPPRESS);
-+ comp2 = gr_search_file(old_dentry, GR_READ | GR_WRITE |
-+ GR_DELETE | GR_AUDIT_DELETE |
-+ GR_AUDIT_READ | GR_AUDIT_WRITE |
-+ GR_SUPPRESS, old_mnt);
-+ } else {
-+ comp1 = gr_search_file(new_dentry, GR_READ | GR_WRITE |
-+ GR_CREATE | GR_DELETE |
-+ GR_AUDIT_CREATE | GR_AUDIT_DELETE |
-+ GR_AUDIT_READ | GR_AUDIT_WRITE |
-+ GR_SUPPRESS, parent_mnt);
-+ comp2 =
-+ gr_search_file(old_dentry,
-+ GR_READ | GR_WRITE | GR_AUDIT_READ |
-+ GR_DELETE | GR_AUDIT_DELETE |
-+ GR_AUDIT_WRITE | GR_SUPPRESS, old_mnt);
-+ }
-+
-+ if (RENAME_CHECK_SUCCESS(comp1, comp2) &&
-+ ((comp1 & GR_AUDITS) || (comp2 & GR_AUDITS)))
-+ gr_log_fs_rbac_str(GR_DO_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
-+ else if (!RENAME_CHECK_SUCCESS(comp1, comp2) && !(comp1 & GR_SUPPRESS)
-+ && !(comp2 & GR_SUPPRESS)) {
-+ gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
-+ error = -EACCES;
-+ } else if (unlikely(!RENAME_CHECK_SUCCESS(comp1, comp2)))
-+ error = -EACCES;
-+
-+ return error;
-+}
-+
-+void
-+gr_acl_handle_exit(void)
-+{
-+ u16 id;
-+ char *rolename;
-+ struct file *exec_file;
-+
-+ if (unlikely(current->acl_sp_role && gr_acl_is_enabled() &&
-+ !(current->role->roletype & GR_ROLE_PERSIST))) {
-+ id = current->acl_role_id;
-+ rolename = current->role->rolename;
-+ gr_set_acls(1);
-+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLEL_ACL_MSG, rolename, id);
-+ }
-+
-+ write_lock(&grsec_exec_file_lock);
-+ exec_file = current->exec_file;
-+ current->exec_file = NULL;
-+ write_unlock(&grsec_exec_file_lock);
-+
-+ if (exec_file)
-+ fput(exec_file);
-+}
-+
-+int
-+gr_acl_handle_procpidmem(const struct task_struct *task)
-+{
-+ if (unlikely(!gr_acl_is_enabled()))
-+ return 0;
-+
-+ if (task != current && task->acl->mode & GR_PROTPROCFD)
-+ return -EACCES;
-+
-+ return 0;
-+}
-diff -urNp linux-2.6.32.45/grsecurity/gracl_ip.c linux-2.6.32.45/grsecurity/gracl_ip.c
---- linux-2.6.32.45/grsecurity/gracl_ip.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/grsecurity/gracl_ip.c 2011-04-17 15:56:46.000000000 -0400
-@@ -0,0 +1,382 @@
-+#include <linux/kernel.h>
-+#include <asm/uaccess.h>
-+#include <asm/errno.h>
-+#include <net/sock.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/net.h>
-+#include <linux/in.h>
-+#include <linux/skbuff.h>
-+#include <linux/ip.h>
-+#include <linux/udp.h>
-+#include <linux/smp_lock.h>
-+#include <linux/types.h>
-+#include <linux/sched.h>
-+#include <linux/netdevice.h>
-+#include <linux/inetdevice.h>
-+#include <linux/gracl.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+#define GR_BIND 0x01
-+#define GR_CONNECT 0x02
-+#define GR_INVERT 0x04
-+#define GR_BINDOVERRIDE 0x08
-+#define GR_CONNECTOVERRIDE 0x10
-+#define GR_SOCK_FAMILY 0x20
-+
-+static const char * gr_protocols[IPPROTO_MAX] = {
-+ "ip", "icmp", "igmp", "ggp", "ipencap", "st", "tcp", "cbt",
-+ "egp", "igp", "bbn-rcc", "nvp", "pup", "argus", "emcon", "xnet",
-+ "chaos", "udp", "mux", "dcn", "hmp", "prm", "xns-idp", "trunk-1",
-+ "trunk-2", "leaf-1", "leaf-2", "rdp", "irtp", "iso-tp4", "netblt", "mfe-nsp",
-+ "merit-inp", "sep", "3pc", "idpr", "xtp", "ddp", "idpr-cmtp", "tp++",
-+ "il", "ipv6", "sdrp", "ipv6-route", "ipv6-frag", "idrp", "rsvp", "gre",
-+ "mhrp", "bna", "ipv6-crypt", "ipv6-auth", "i-nlsp", "swipe", "narp", "mobile",
-+ "tlsp", "skip", "ipv6-icmp", "ipv6-nonxt", "ipv6-opts", "unknown:61", "cftp", "unknown:63",
-+ "sat-expak", "kryptolan", "rvd", "ippc", "unknown:68", "sat-mon", "visa", "ipcv",
-+ "cpnx", "cphb", "wsn", "pvp", "br-sat-mon", "sun-nd", "wb-mon", "wb-expak",
-+ "iso-ip", "vmtp", "secure-vmtp", "vines", "ttp", "nfsnet-igp", "dgp", "tcf",
-+ "eigrp", "ospf", "sprite-rpc", "larp", "mtp", "ax.25", "ipip", "micp",
-+ "scc-sp", "etherip", "encap", "unknown:99", "gmtp", "ifmp", "pnni", "pim",
-+ "aris", "scps", "qnx", "a/n", "ipcomp", "snp", "compaq-peer", "ipx-in-ip",
-+ "vrrp", "pgm", "unknown:114", "l2tp", "ddx", "iatp", "stp", "srp",
-+ "uti", "smp", "sm", "ptp", "isis", "fire", "crtp", "crdup",
-+ "sscopmce", "iplt", "sps", "pipe", "sctp", "fc", "unkown:134", "unknown:135",
-+ "unknown:136", "unknown:137", "unknown:138", "unknown:139", "unknown:140", "unknown:141", "unknown:142", "unknown:143",
-+ "unknown:144", "unknown:145", "unknown:146", "unknown:147", "unknown:148", "unknown:149", "unknown:150", "unknown:151",
-+ "unknown:152", "unknown:153", "unknown:154", "unknown:155", "unknown:156", "unknown:157", "unknown:158", "unknown:159",
-+ "unknown:160", "unknown:161", "unknown:162", "unknown:163", "unknown:164", "unknown:165", "unknown:166", "unknown:167",
-+ "unknown:168", "unknown:169", "unknown:170", "unknown:171", "unknown:172", "unknown:173", "unknown:174", "unknown:175",
-+ "unknown:176", "unknown:177", "unknown:178", "unknown:179", "unknown:180", "unknown:181", "unknown:182", "unknown:183",
-+ "unknown:184", "unknown:185", "unknown:186", "unknown:187", "unknown:188", "unknown:189", "unknown:190", "unknown:191",
-+ "unknown:192", "unknown:193", "unknown:194", "unknown:195", "unknown:196", "unknown:197", "unknown:198", "unknown:199",
-+ "unknown:200", "unknown:201", "unknown:202", "unknown:203", "unknown:204", "unknown:205", "unknown:206", "unknown:207",
-+ "unknown:208", "unknown:209", "unknown:210", "unknown:211", "unknown:212", "unknown:213", "unknown:214", "unknown:215",
-+ "unknown:216", "unknown:217", "unknown:218", "unknown:219", "unknown:220", "unknown:221", "unknown:222", "unknown:223",
-+ "unknown:224", "unknown:225", "unknown:226", "unknown:227", "unknown:228", "unknown:229", "unknown:230", "unknown:231",
-+ "unknown:232", "unknown:233", "unknown:234", "unknown:235", "unknown:236", "unknown:237", "unknown:238", "unknown:239",
-+ "unknown:240", "unknown:241", "unknown:242", "unknown:243", "unknown:244", "unknown:245", "unknown:246", "unknown:247",
-+ "unknown:248", "unknown:249", "unknown:250", "unknown:251", "unknown:252", "unknown:253", "unknown:254", "unknown:255",
-+ };
-+
-+static const char * gr_socktypes[SOCK_MAX] = {
-+ "unknown:0", "stream", "dgram", "raw", "rdm", "seqpacket", "unknown:6",
-+ "unknown:7", "unknown:8", "unknown:9", "packet"
-+ };
-+
-+static const char * gr_sockfamilies[AF_MAX+1] = {
-+ "unspec", "unix", "inet", "ax25", "ipx", "appletalk", "netrom", "bridge", "atmpvc", "x25",
-+ "inet6", "rose", "decnet", "netbeui", "security", "key", "netlink", "packet", "ash",
-+ "econet", "atmsvc", "rds", "sna", "irda", "ppox", "wanpipe", "llc", "fam_27", "fam_28",
-+ "tipc", "bluetooth", "iucv", "rxrpc", "isdn", "phonet", "ieee802154"
-+ };
-+
-+const char *
-+gr_proto_to_name(unsigned char proto)
-+{
-+ return gr_protocols[proto];
-+}
-+
-+const char *
-+gr_socktype_to_name(unsigned char type)
-+{
-+ return gr_socktypes[type];
-+}
-+
-+const char *
-+gr_sockfamily_to_name(unsigned char family)
-+{
-+ return gr_sockfamilies[family];
-+}
-+
-+int
-+gr_search_socket(const int domain, const int type, const int protocol)
-+{
-+ struct acl_subject_label *curr;
-+ const struct cred *cred = current_cred();
-+
-+ if (unlikely(!gr_acl_is_enabled()))
-+ goto exit;
-+
-+ if ((domain < 0) || (type < 0) || (protocol < 0) ||
-+ (domain >= AF_MAX) || (type >= SOCK_MAX) || (protocol >= IPPROTO_MAX))
-+ goto exit; // let the kernel handle it
-+
-+ curr = current->acl;
-+
-+ if (curr->sock_families[domain / 32] & (1 << (domain % 32))) {
-+ /* the family is allowed, if this is PF_INET allow it only if
-+ the extra sock type/protocol checks pass */
-+ if (domain == PF_INET)
-+ goto inet_check;
-+ goto exit;
-+ } else {
-+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
-+ __u32 fakeip = 0;
-+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
-+ current->role->roletype, cred->uid,
-+ cred->gid, current->exec_file ?
-+ gr_to_filename(current->exec_file->f_path.dentry,
-+ current->exec_file->f_path.mnt) :
-+ curr->filename, curr->filename,
-+ &fakeip, domain, 0, 0, GR_SOCK_FAMILY,
-+ ¤t->signal->saved_ip);
-+ goto exit;
-+ }
-+ goto exit_fail;
-+ }
-+
-+inet_check:
-+ /* the rest of this checking is for IPv4 only */
-+ if (!curr->ips)
-+ goto exit;
-+
-+ if ((curr->ip_type & (1 << type)) &&
-+ (curr->ip_proto[protocol / 32] & (1 << (protocol % 32))))
-+ goto exit;
-+
-+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
-+ /* we don't place acls on raw sockets , and sometimes
-+ dgram/ip sockets are opened for ioctl and not
-+ bind/connect, so we'll fake a bind learn log */
-+ if (type == SOCK_RAW || type == SOCK_PACKET) {
-+ __u32 fakeip = 0;
-+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
-+ current->role->roletype, cred->uid,
-+ cred->gid, current->exec_file ?
-+ gr_to_filename(current->exec_file->f_path.dentry,
-+ current->exec_file->f_path.mnt) :
-+ curr->filename, curr->filename,
-+ &fakeip, 0, type,
-+ protocol, GR_CONNECT, ¤t->signal->saved_ip);
-+ } else if ((type == SOCK_DGRAM) && (protocol == IPPROTO_IP)) {
-+ __u32 fakeip = 0;
-+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
-+ current->role->roletype, cred->uid,
-+ cred->gid, current->exec_file ?
-+ gr_to_filename(current->exec_file->f_path.dentry,
-+ current->exec_file->f_path.mnt) :
-+ curr->filename, curr->filename,
-+ &fakeip, 0, type,
-+ protocol, GR_BIND, ¤t->signal->saved_ip);
-+ }
-+ /* we'll log when they use connect or bind */
-+ goto exit;
-+ }
-+
-+exit_fail:
-+ if (domain == PF_INET)
-+ gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(domain),
-+ gr_socktype_to_name(type), gr_proto_to_name(protocol));
-+ else
-+ gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(domain),
-+ gr_socktype_to_name(type), protocol);
-+
-+ return 0;
-+exit:
-+ return 1;
-+}
-+
-+int check_ip_policy(struct acl_ip_label *ip, __u32 ip_addr, __u16 ip_port, __u8 protocol, const int mode, const int type, __u32 our_addr, __u32 our_netmask)
-+{
-+ if ((ip->mode & mode) &&
-+ (ip_port >= ip->low) &&
-+ (ip_port <= ip->high) &&
-+ ((ntohl(ip_addr) & our_netmask) ==
-+ (ntohl(our_addr) & our_netmask))
-+ && (ip->proto[protocol / 32] & (1 << (protocol % 32)))
-+ && (ip->type & (1 << type))) {
-+ if (ip->mode & GR_INVERT)
-+ return 2; // specifically denied
-+ else
-+ return 1; // allowed
-+ }
-+
-+ return 0; // not specifically allowed, may continue parsing
-+}
-+
-+static int
-+gr_search_connectbind(const int full_mode, struct sock *sk,
-+ struct sockaddr_in *addr, const int type)
-+{
-+ char iface[IFNAMSIZ] = {0};
-+ struct acl_subject_label *curr;
-+ struct acl_ip_label *ip;
-+ struct inet_sock *isk;
-+ struct net_device *dev;
-+ struct in_device *idev;
-+ unsigned long i;
-+ int ret;
-+ int mode = full_mode & (GR_BIND | GR_CONNECT);
-+ __u32 ip_addr = 0;
-+ __u32 our_addr;
-+ __u32 our_netmask;
-+ char *p;
-+ __u16 ip_port = 0;
-+ const struct cred *cred = current_cred();
-+
-+ if (unlikely(!gr_acl_is_enabled() || sk->sk_family != PF_INET))
-+ return 0;
-+
-+ curr = current->acl;
-+ isk = inet_sk(sk);
-+
-+ /* INADDR_ANY overriding for binds, inaddr_any_override is already in network order */
-+ if ((full_mode & GR_BINDOVERRIDE) && addr->sin_addr.s_addr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0)
-+ addr->sin_addr.s_addr = curr->inaddr_any_override;
-+ if ((full_mode & GR_CONNECT) && isk->saddr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0) {
-+ struct sockaddr_in saddr;
-+ int err;
-+
-+ saddr.sin_family = AF_INET;
-+ saddr.sin_addr.s_addr = curr->inaddr_any_override;
-+ saddr.sin_port = isk->sport;
-+
-+ err = security_socket_bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
-+ if (err)
-+ return err;
-+
-+ err = sk->sk_socket->ops->bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
-+ if (err)
-+ return err;
-+ }
-+
-+ if (!curr->ips)
-+ return 0;
-+
-+ ip_addr = addr->sin_addr.s_addr;
-+ ip_port = ntohs(addr->sin_port);
-+
-+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
-+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
-+ current->role->roletype, cred->uid,
-+ cred->gid, current->exec_file ?
-+ gr_to_filename(current->exec_file->f_path.dentry,
-+ current->exec_file->f_path.mnt) :
-+ curr->filename, curr->filename,
-+ &ip_addr, ip_port, type,
-+ sk->sk_protocol, mode, ¤t->signal->saved_ip);
-+ return 0;
-+ }
-+
-+ for (i = 0; i < curr->ip_num; i++) {
-+ ip = *(curr->ips + i);
-+ if (ip->iface != NULL) {
-+ strncpy(iface, ip->iface, IFNAMSIZ - 1);
-+ p = strchr(iface, ':');
-+ if (p != NULL)
-+ *p = '\0';
-+ dev = dev_get_by_name(sock_net(sk), iface);
-+ if (dev == NULL)
-+ continue;
-+ idev = in_dev_get(dev);
-+ if (idev == NULL) {
-+ dev_put(dev);
-+ continue;
-+ }
-+ rcu_read_lock();
-+ for_ifa(idev) {
-+ if (!strcmp(ip->iface, ifa->ifa_label)) {
-+ our_addr = ifa->ifa_address;
-+ our_netmask = 0xffffffff;
-+ ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
-+ if (ret == 1) {
-+ rcu_read_unlock();
-+ in_dev_put(idev);
-+ dev_put(dev);
-+ return 0;
-+ } else if (ret == 2) {
-+ rcu_read_unlock();
-+ in_dev_put(idev);
-+ dev_put(dev);
-+ goto denied;
-+ }
-+ }
-+ } endfor_ifa(idev);
-+ rcu_read_unlock();
-+ in_dev_put(idev);
-+ dev_put(dev);
-+ } else {
-+ our_addr = ip->addr;
-+ our_netmask = ip->netmask;
-+ ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
-+ if (ret == 1)
-+ return 0;
-+ else if (ret == 2)
-+ goto denied;
-+ }
-+ }
-+
-+denied:
-+ if (mode == GR_BIND)
-+ gr_log_int5_str2(GR_DONT_AUDIT, GR_BIND_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
-+ else if (mode == GR_CONNECT)
-+ gr_log_int5_str2(GR_DONT_AUDIT, GR_CONNECT_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
-+
-+ return -EACCES;
-+}
-+
-+int
-+gr_search_connect(struct socket *sock, struct sockaddr_in *addr)
-+{
-+ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sock->sk, addr, sock->type);
-+}
-+
-+int
-+gr_search_bind(struct socket *sock, struct sockaddr_in *addr)
-+{
-+ return gr_search_connectbind(GR_BIND | GR_BINDOVERRIDE, sock->sk, addr, sock->type);
-+}
-+
-+int gr_search_listen(struct socket *sock)
-+{
-+ struct sock *sk = sock->sk;
-+ struct sockaddr_in addr;
-+
-+ addr.sin_addr.s_addr = inet_sk(sk)->saddr;
-+ addr.sin_port = inet_sk(sk)->sport;
-+
-+ return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
-+}
-+
-+int gr_search_accept(struct socket *sock)
-+{
-+ struct sock *sk = sock->sk;
-+ struct sockaddr_in addr;
-+
-+ addr.sin_addr.s_addr = inet_sk(sk)->saddr;
-+ addr.sin_port = inet_sk(sk)->sport;
-+
-+ return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
-+}
-+
-+int
-+gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr)
-+{
-+ if (addr)
-+ return gr_search_connectbind(GR_CONNECT, sk, addr, SOCK_DGRAM);
-+ else {
-+ struct sockaddr_in sin;
-+ const struct inet_sock *inet = inet_sk(sk);
-+
-+ sin.sin_addr.s_addr = inet->daddr;
-+ sin.sin_port = inet->dport;
-+
-+ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
-+ }
-+}
-+
-+int
-+gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb)
-+{
-+ struct sockaddr_in sin;
-+
-+ if (unlikely(skb->len < sizeof (struct udphdr)))
-+ return 0; // skip this packet
-+
-+ sin.sin_addr.s_addr = ip_hdr(skb)->saddr;
-+ sin.sin_port = udp_hdr(skb)->source;
-+
-+ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
-+}
-diff -urNp linux-2.6.32.45/grsecurity/gracl_learn.c linux-2.6.32.45/grsecurity/gracl_learn.c
---- linux-2.6.32.45/grsecurity/gracl_learn.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/grsecurity/gracl_learn.c 2011-07-14 21:02:03.000000000 -0400
-@@ -0,0 +1,208 @@
-+#include <linux/kernel.h>
-+#include <linux/mm.h>
-+#include <linux/sched.h>
-+#include <linux/poll.h>
-+#include <linux/smp_lock.h>
-+#include <linux/string.h>
-+#include <linux/file.h>
-+#include <linux/types.h>
-+#include <linux/vmalloc.h>
-+#include <linux/grinternal.h>
-+
-+extern ssize_t write_grsec_handler(struct file * file, const char __user * buf,
-+ size_t count, loff_t *ppos);
-+extern int gr_acl_is_enabled(void);
-+
-+static DECLARE_WAIT_QUEUE_HEAD(learn_wait);
-+static int gr_learn_attached;
-+
-+/* use a 512k buffer */
-+#define LEARN_BUFFER_SIZE (512 * 1024)
-+
-+static DEFINE_SPINLOCK(gr_learn_lock);
-+static DEFINE_MUTEX(gr_learn_user_mutex);
-+
-+/* we need to maintain two buffers, so that the kernel context of grlearn
-+ uses a semaphore around the userspace copying, and the other kernel contexts
-+ use a spinlock when copying into the buffer, since they cannot sleep
-+*/
-+static char *learn_buffer;
-+static char *learn_buffer_user;
-+static int learn_buffer_len;
-+static int learn_buffer_user_len;
-+
-+static ssize_t
-+read_learn(struct file *file, char __user * buf, size_t count, loff_t * ppos)
-+{
-+ DECLARE_WAITQUEUE(wait, current);
-+ ssize_t retval = 0;
-+
-+ add_wait_queue(&learn_wait, &wait);
-+ set_current_state(TASK_INTERRUPTIBLE);
-+ do {
-+ mutex_lock(&gr_learn_user_mutex);
-+ spin_lock(&gr_learn_lock);
-+ if (learn_buffer_len)
-+ break;
-+ spin_unlock(&gr_learn_lock);
-+ mutex_unlock(&gr_learn_user_mutex);
-+ if (file->f_flags & O_NONBLOCK) {
-+ retval = -EAGAIN;
-+ goto out;
-+ }
-+ if (signal_pending(current)) {
-+ retval = -ERESTARTSYS;
-+ goto out;
-+ }
-+
-+ schedule();
-+ } while (1);
-+
-+ memcpy(learn_buffer_user, learn_buffer, learn_buffer_len);
-+ learn_buffer_user_len = learn_buffer_len;
-+ retval = learn_buffer_len;
-+ learn_buffer_len = 0;
-+
-+ spin_unlock(&gr_learn_lock);
-+
-+ if (copy_to_user(buf, learn_buffer_user, learn_buffer_user_len))
-+ retval = -EFAULT;
-+
-+ mutex_unlock(&gr_learn_user_mutex);
-+out:
-+ set_current_state(TASK_RUNNING);
-+ remove_wait_queue(&learn_wait, &wait);
-+ return retval;
-+}
-+
-+static unsigned int
-+poll_learn(struct file * file, poll_table * wait)
-+{
-+ poll_wait(file, &learn_wait, wait);
-+
-+ if (learn_buffer_len)
-+ return (POLLIN | POLLRDNORM);
-+
-+ return 0;
-+}
-+
-+void
-+gr_clear_learn_entries(void)
-+{
-+ char *tmp;
-+
-+ mutex_lock(&gr_learn_user_mutex);
-+ spin_lock(&gr_learn_lock);
-+ tmp = learn_buffer;
-+ learn_buffer = NULL;
-+ spin_unlock(&gr_learn_lock);
-+ if (tmp)
-+ vfree(tmp);
-+ if (learn_buffer_user != NULL) {
-+ vfree(learn_buffer_user);
-+ learn_buffer_user = NULL;
-+ }
-+ learn_buffer_len = 0;
-+ mutex_unlock(&gr_learn_user_mutex);
-+
-+ return;
-+}
-+
-+void
-+gr_add_learn_entry(const char *fmt, ...)
-+{
-+ va_list args;
-+ unsigned int len;
-+
-+ if (!gr_learn_attached)
-+ return;
-+
-+ spin_lock(&gr_learn_lock);
-+
-+ /* leave a gap at the end so we know when it's "full" but don't have to
-+ compute the exact length of the string we're trying to append
-+ */
-+ if (learn_buffer_len > LEARN_BUFFER_SIZE - 16384) {
-+ spin_unlock(&gr_learn_lock);
-+ wake_up_interruptible(&learn_wait);
-+ return;
-+ }
-+ if (learn_buffer == NULL) {
-+ spin_unlock(&gr_learn_lock);
-+ return;
-+ }
-+
-+ va_start(args, fmt);
-+ len = vsnprintf(learn_buffer + learn_buffer_len, LEARN_BUFFER_SIZE - learn_buffer_len, fmt, args);
-+ va_end(args);
-+
-+ learn_buffer_len += len + 1;
-+
-+ spin_unlock(&gr_learn_lock);
-+ wake_up_interruptible(&learn_wait);
-+
-+ return;
-+}
-+
-+static int
-+open_learn(struct inode *inode, struct file *file)
-+{
-+ if (file->f_mode & FMODE_READ && gr_learn_attached)
-+ return -EBUSY;
-+ if (file->f_mode & FMODE_READ) {
-+ int retval = 0;
-+ mutex_lock(&gr_learn_user_mutex);
-+ if (learn_buffer == NULL)
-+ learn_buffer = vmalloc(LEARN_BUFFER_SIZE);
-+ if (learn_buffer_user == NULL)
-+ learn_buffer_user = vmalloc(LEARN_BUFFER_SIZE);
-+ if (learn_buffer == NULL) {
-+ retval = -ENOMEM;
-+ goto out_error;
-+ }
-+ if (learn_buffer_user == NULL) {
-+ retval = -ENOMEM;
-+ goto out_error;
-+ }
-+ learn_buffer_len = 0;
-+ learn_buffer_user_len = 0;
-+ gr_learn_attached = 1;
-+out_error:
-+ mutex_unlock(&gr_learn_user_mutex);
-+ return retval;
-+ }
-+ return 0;
-+}
-+
-+static int
-+close_learn(struct inode *inode, struct file *file)
-+{
-+ if (file->f_mode & FMODE_READ) {
-+ char *tmp = NULL;
-+ mutex_lock(&gr_learn_user_mutex);
-+ spin_lock(&gr_learn_lock);
-+ tmp = learn_buffer;
-+ learn_buffer = NULL;
-+ spin_unlock(&gr_learn_lock);
-+ if (tmp)
-+ vfree(tmp);
-+ if (learn_buffer_user != NULL) {
-+ vfree(learn_buffer_user);
-+ learn_buffer_user = NULL;
-+ }
-+ learn_buffer_len = 0;
-+ learn_buffer_user_len = 0;
-+ gr_learn_attached = 0;
-+ mutex_unlock(&gr_learn_user_mutex);
-+ }
-+
-+ return 0;
-+}
-+
-+const struct file_operations grsec_fops = {
-+ .read = read_learn,
-+ .write = write_grsec_handler,
-+ .open = open_learn,
-+ .release = close_learn,
-+ .poll = poll_learn,
-+};
-diff -urNp linux-2.6.32.45/grsecurity/gracl_res.c linux-2.6.32.45/grsecurity/gracl_res.c
---- linux-2.6.32.45/grsecurity/gracl_res.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/grsecurity/gracl_res.c 2011-04-17 15:56:46.000000000 -0400
-@@ -0,0 +1,67 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/gracl.h>
-+#include <linux/grinternal.h>
-+
-+static const char *restab_log[] = {
-+ [RLIMIT_CPU] = "RLIMIT_CPU",
-+ [RLIMIT_FSIZE] = "RLIMIT_FSIZE",
-+ [RLIMIT_DATA] = "RLIMIT_DATA",
-+ [RLIMIT_STACK] = "RLIMIT_STACK",
-+ [RLIMIT_CORE] = "RLIMIT_CORE",
-+ [RLIMIT_RSS] = "RLIMIT_RSS",
-+ [RLIMIT_NPROC] = "RLIMIT_NPROC",
-+ [RLIMIT_NOFILE] = "RLIMIT_NOFILE",
-+ [RLIMIT_MEMLOCK] = "RLIMIT_MEMLOCK",
-+ [RLIMIT_AS] = "RLIMIT_AS",
-+ [RLIMIT_LOCKS] = "RLIMIT_LOCKS",
-+ [RLIMIT_SIGPENDING] = "RLIMIT_SIGPENDING",
-+ [RLIMIT_MSGQUEUE] = "RLIMIT_MSGQUEUE",
-+ [RLIMIT_NICE] = "RLIMIT_NICE",
-+ [RLIMIT_RTPRIO] = "RLIMIT_RTPRIO",
-+ [RLIMIT_RTTIME] = "RLIMIT_RTTIME",
-+ [GR_CRASH_RES] = "RLIMIT_CRASH"
-+};
-+
-+void
-+gr_log_resource(const struct task_struct *task,
-+ const int res, const unsigned long wanted, const int gt)
-+{
-+ const struct cred *cred;
-+ unsigned long rlim;
-+
-+ if (!gr_acl_is_enabled() && !grsec_resource_logging)
-+ return;
-+
-+ // not yet supported resource
-+ if (unlikely(!restab_log[res]))
-+ return;
-+
-+ if (res == RLIMIT_CPU || res == RLIMIT_RTTIME)
-+ rlim = task->signal->rlim[res].rlim_max;
-+ else
-+ rlim = task->signal->rlim[res].rlim_cur;
-+ if (likely((rlim == RLIM_INFINITY) || (gt && wanted <= rlim) || (!gt && wanted < rlim)))
-+ return;
-+
-+ rcu_read_lock();
-+ cred = __task_cred(task);
-+
-+ if (res == RLIMIT_NPROC &&
-+ (cap_raised(cred->cap_effective, CAP_SYS_ADMIN) ||
-+ cap_raised(cred->cap_effective, CAP_SYS_RESOURCE)))
-+ goto out_rcu_unlock;
-+ else if (res == RLIMIT_MEMLOCK &&
-+ cap_raised(cred->cap_effective, CAP_IPC_LOCK))
-+ goto out_rcu_unlock;
-+ else if (res == RLIMIT_NICE && cap_raised(cred->cap_effective, CAP_SYS_NICE))
-+ goto out_rcu_unlock;
-+ rcu_read_unlock();
-+
-+ gr_log_res_ulong2_str(GR_DONT_AUDIT, GR_RESOURCE_MSG, task, wanted, restab_log[res], rlim);
-+
-+ return;
-+out_rcu_unlock:
-+ rcu_read_unlock();
-+ return;
-+}
-diff -urNp linux-2.6.32.45/grsecurity/gracl_segv.c linux-2.6.32.45/grsecurity/gracl_segv.c
---- linux-2.6.32.45/grsecurity/gracl_segv.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/grsecurity/gracl_segv.c 2011-04-17 15:56:46.000000000 -0400
-@@ -0,0 +1,284 @@
-+#include <linux/kernel.h>
-+#include <linux/mm.h>
-+#include <asm/uaccess.h>
-+#include <asm/errno.h>
-+#include <asm/mman.h>
-+#include <net/sock.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/net.h>
-+#include <linux/in.h>
-+#include <linux/smp_lock.h>
-+#include <linux/slab.h>
-+#include <linux/types.h>
-+#include <linux/sched.h>
-+#include <linux/timer.h>
-+#include <linux/gracl.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+static struct crash_uid *uid_set;
-+static unsigned short uid_used;
-+static DEFINE_SPINLOCK(gr_uid_lock);
-+extern rwlock_t gr_inode_lock;
-+extern struct acl_subject_label *
-+ lookup_acl_subj_label(const ino_t inode, const dev_t dev,
-+ struct acl_role_label *role);
-+extern int gr_fake_force_sig(int sig, struct task_struct *t);
-+
-+int
-+gr_init_uidset(void)
-+{
-+ uid_set =
-+ kmalloc(GR_UIDTABLE_MAX * sizeof (struct crash_uid), GFP_KERNEL);
-+ uid_used = 0;
-+
-+ return uid_set ? 1 : 0;
-+}
-+
-+void
-+gr_free_uidset(void)
-+{
-+ if (uid_set)
-+ kfree(uid_set);
-+
-+ return;
-+}
-+
-+int
-+gr_find_uid(const uid_t uid)
-+{
-+ struct crash_uid *tmp = uid_set;
-+ uid_t buid;
-+ int low = 0, high = uid_used - 1, mid;
-+
-+ while (high >= low) {
-+ mid = (low + high) >> 1;
-+ buid = tmp[mid].uid;
-+ if (buid == uid)
-+ return mid;
-+ if (buid > uid)
-+ high = mid - 1;
-+ if (buid < uid)
-+ low = mid + 1;
-+ }
-+
-+ return -1;
-+}
-+
-+static __inline__ void
-+gr_insertsort(void)
-+{
-+ unsigned short i, j;
-+ struct crash_uid index;
-+
-+ for (i = 1; i < uid_used; i++) {
-+ index = uid_set[i];
-+ j = i;
-+ while ((j > 0) && uid_set[j - 1].uid > index.uid) {
-+ uid_set[j] = uid_set[j - 1];
-+ j--;
-+ }
-+ uid_set[j] = index;
-+ }
-+
-+ return;
-+}
-+
-+static __inline__ void
-+gr_insert_uid(const uid_t uid, const unsigned long expires)
-+{
-+ int loc;
-+
-+ if (uid_used == GR_UIDTABLE_MAX)
-+ return;
-+
-+ loc = gr_find_uid(uid);
-+
-+ if (loc >= 0) {
-+ uid_set[loc].expires = expires;
-+ return;
-+ }
-+
-+ uid_set[uid_used].uid = uid;
-+ uid_set[uid_used].expires = expires;
-+ uid_used++;
-+
-+ gr_insertsort();
-+
-+ return;
-+}
-+
-+void
-+gr_remove_uid(const unsigned short loc)
-+{
-+ unsigned short i;
-+
-+ for (i = loc + 1; i < uid_used; i++)
-+ uid_set[i - 1] = uid_set[i];
-+
-+ uid_used--;
-+
-+ return;
-+}
-+
-+int
-+gr_check_crash_uid(const uid_t uid)
-+{
-+ int loc;
-+ int ret = 0;
-+
-+ if (unlikely(!gr_acl_is_enabled()))
-+ return 0;
-+
-+ spin_lock(&gr_uid_lock);
-+ loc = gr_find_uid(uid);
-+
-+ if (loc < 0)
-+ goto out_unlock;
-+
-+ if (time_before_eq(uid_set[loc].expires, get_seconds()))
-+ gr_remove_uid(loc);
-+ else
-+ ret = 1;
-+
-+out_unlock:
-+ spin_unlock(&gr_uid_lock);
-+ return ret;
-+}
-+
-+static __inline__ int
-+proc_is_setxid(const struct cred *cred)
-+{
-+ if (cred->uid != cred->euid || cred->uid != cred->suid ||
-+ cred->uid != cred->fsuid)
-+ return 1;
-+ if (cred->gid != cred->egid || cred->gid != cred->sgid ||
-+ cred->gid != cred->fsgid)
-+ return 1;
-+
-+ return 0;
-+}
-+
-+void
-+gr_handle_crash(struct task_struct *task, const int sig)
-+{
-+ struct acl_subject_label *curr;
-+ struct acl_subject_label *curr2;
-+ struct task_struct *tsk, *tsk2;
-+ const struct cred *cred;
-+ const struct cred *cred2;
-+
-+ if (sig != SIGSEGV && sig != SIGKILL && sig != SIGBUS && sig != SIGILL)
-+ return;
-+
-+ if (unlikely(!gr_acl_is_enabled()))
-+ return;
-+
-+ curr = task->acl;
-+
-+ if (!(curr->resmask & (1 << GR_CRASH_RES)))
-+ return;
-+
-+ if (time_before_eq(curr->expires, get_seconds())) {
-+ curr->expires = 0;
-+ curr->crashes = 0;
-+ }
-+
-+ curr->crashes++;
-+
-+ if (!curr->expires)
-+ curr->expires = get_seconds() + curr->res[GR_CRASH_RES].rlim_max;
-+
-+ if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
-+ time_after(curr->expires, get_seconds())) {
-+ rcu_read_lock();
-+ cred = __task_cred(task);
-+ if (cred->uid && proc_is_setxid(cred)) {
-+ gr_log_crash1(GR_DONT_AUDIT, GR_SEGVSTART_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
-+ spin_lock(&gr_uid_lock);
-+ gr_insert_uid(cred->uid, curr->expires);
-+ spin_unlock(&gr_uid_lock);
-+ curr->expires = 0;
-+ curr->crashes = 0;
-+ read_lock(&tasklist_lock);
-+ do_each_thread(tsk2, tsk) {
-+ cred2 = __task_cred(tsk);
-+ if (tsk != task && cred2->uid == cred->uid)
-+ gr_fake_force_sig(SIGKILL, tsk);
-+ } while_each_thread(tsk2, tsk);
-+ read_unlock(&tasklist_lock);
-+ } else {
-+ gr_log_crash2(GR_DONT_AUDIT, GR_SEGVNOSUID_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
-+ read_lock(&tasklist_lock);
-+ do_each_thread(tsk2, tsk) {
-+ if (likely(tsk != task)) {
-+ curr2 = tsk->acl;
-+
-+ if (curr2->device == curr->device &&
-+ curr2->inode == curr->inode)
-+ gr_fake_force_sig(SIGKILL, tsk);
-+ }
-+ } while_each_thread(tsk2, tsk);
-+ read_unlock(&tasklist_lock);
-+ }
-+ rcu_read_unlock();
-+ }
-+
-+ return;
-+}
-+
-+int
-+gr_check_crash_exec(const struct file *filp)
-+{
-+ struct acl_subject_label *curr;
-+
-+ if (unlikely(!gr_acl_is_enabled()))
-+ return 0;
-+
-+ read_lock(&gr_inode_lock);
-+ curr = lookup_acl_subj_label(filp->f_path.dentry->d_inode->i_ino,
-+ filp->f_path.dentry->d_inode->i_sb->s_dev,
-+ current->role);
-+ read_unlock(&gr_inode_lock);
-+
-+ if (!curr || !(curr->resmask & (1 << GR_CRASH_RES)) ||
-+ (!curr->crashes && !curr->expires))
-+ return 0;
-+
-+ if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
-+ time_after(curr->expires, get_seconds()))
-+ return 1;
-+ else if (time_before_eq(curr->expires, get_seconds())) {
-+ curr->crashes = 0;
-+ curr->expires = 0;
-+ }
-+
-+ return 0;
-+}
-+
-+void
-+gr_handle_alertkill(struct task_struct *task)
-+{
-+ struct acl_subject_label *curracl;
-+ __u32 curr_ip;
-+ struct task_struct *p, *p2;
-+
-+ if (unlikely(!gr_acl_is_enabled()))
-+ return;
-+
-+ curracl = task->acl;
-+ curr_ip = task->signal->curr_ip;
-+
-+ if ((curracl->mode & GR_KILLIPPROC) && curr_ip) {
-+ read_lock(&tasklist_lock);
-+ do_each_thread(p2, p) {
-+ if (p->signal->curr_ip == curr_ip)
-+ gr_fake_force_sig(SIGKILL, p);
-+ } while_each_thread(p2, p);
-+ read_unlock(&tasklist_lock);
-+ } else if (curracl->mode & GR_KILLPROC)
-+ gr_fake_force_sig(SIGKILL, task);
-+
-+ return;
-+}
-diff -urNp linux-2.6.32.45/grsecurity/gracl_shm.c linux-2.6.32.45/grsecurity/gracl_shm.c
---- linux-2.6.32.45/grsecurity/gracl_shm.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/grsecurity/gracl_shm.c 2011-04-17 15:56:46.000000000 -0400
-@@ -0,0 +1,40 @@
-+#include <linux/kernel.h>
-+#include <linux/mm.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/ipc.h>
-+#include <linux/gracl.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+int
-+gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
-+ const time_t shm_createtime, const uid_t cuid, const int shmid)
-+{
-+ struct task_struct *task;
-+
-+ if (!gr_acl_is_enabled())
-+ return 1;
-+
-+ rcu_read_lock();
-+ read_lock(&tasklist_lock);
-+
-+ task = find_task_by_vpid(shm_cprid);
-+
-+ if (unlikely(!task))
-+ task = find_task_by_vpid(shm_lapid);
-+
-+ if (unlikely(task && (time_before_eq((unsigned long)task->start_time.tv_sec, (unsigned long)shm_createtime) ||
-+ (task->pid == shm_lapid)) &&
-+ (task->acl->mode & GR_PROTSHM) &&
-+ (task->acl != current->acl))) {
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+ gr_log_int3(GR_DONT_AUDIT, GR_SHMAT_ACL_MSG, cuid, shm_cprid, shmid);
-+ return 0;
-+ }
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+
-+ return 1;
-+}
-diff -urNp linux-2.6.32.45/grsecurity/grsec_chdir.c linux-2.6.32.45/grsecurity/grsec_chdir.c
---- linux-2.6.32.45/grsecurity/grsec_chdir.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/grsecurity/grsec_chdir.c 2011-04-17 15:56:46.000000000 -0400
-@@ -0,0 +1,19 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/fs.h>
-+#include <linux/file.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+void
-+gr_log_chdir(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
-+ if ((grsec_enable_chdir && grsec_enable_group &&
-+ in_group_p(grsec_audit_gid)) || (grsec_enable_chdir &&
-+ !grsec_enable_group)) {
-+ gr_log_fs_generic(GR_DO_AUDIT, GR_CHDIR_AUDIT_MSG, dentry, mnt);
-+ }
-+#endif
-+ return;
-+}
-diff -urNp linux-2.6.32.45/grsecurity/grsec_chroot.c linux-2.6.32.45/grsecurity/grsec_chroot.c
---- linux-2.6.32.45/grsecurity/grsec_chroot.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/grsecurity/grsec_chroot.c 2011-07-18 17:14:10.000000000 -0400
-@@ -0,0 +1,384 @@
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/mount.h>
-+#include <linux/types.h>
-+#include <linux/pid_namespace.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+void gr_set_chroot_entries(struct task_struct *task, struct path *path)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+ if (task->pid > 1 && path->dentry != init_task.fs->root.dentry &&
-+ path->dentry != task->nsproxy->mnt_ns->root->mnt_root)
-+ task->gr_is_chrooted = 1;
-+ else
-+ task->gr_is_chrooted = 0;
-+
-+ task->gr_chroot_dentry = path->dentry;
-+#endif
-+ return;
-+}
-+
-+void gr_clear_chroot_entries(struct task_struct *task)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+ task->gr_is_chrooted = 0;
-+ task->gr_chroot_dentry = NULL;
-+#endif
-+ return;
-+}
-+
-+int
-+gr_handle_chroot_unix(const pid_t pid)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
-+ struct task_struct *p;
-+
-+ if (unlikely(!grsec_enable_chroot_unix))
-+ return 1;
-+
-+ if (likely(!proc_is_chrooted(current)))
-+ return 1;
-+
-+ rcu_read_lock();
-+ read_lock(&tasklist_lock);
-+
-+ p = find_task_by_vpid_unrestricted(pid);
-+ if (unlikely(p && !have_same_root(current, p))) {
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+ gr_log_noargs(GR_DONT_AUDIT, GR_UNIX_CHROOT_MSG);
-+ return 0;
-+ }
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+#endif
-+ return 1;
-+}
-+
-+int
-+gr_handle_chroot_nice(void)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
-+ if (grsec_enable_chroot_nice && proc_is_chrooted(current)) {
-+ gr_log_noargs(GR_DONT_AUDIT, GR_NICE_CHROOT_MSG);
-+ return -EPERM;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_handle_chroot_setpriority(struct task_struct *p, const int niceval)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
-+ if (grsec_enable_chroot_nice && (niceval < task_nice(p))
-+ && proc_is_chrooted(current)) {
-+ gr_log_str_int(GR_DONT_AUDIT, GR_PRIORITY_CHROOT_MSG, p->comm, p->pid);
-+ return -EACCES;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_handle_chroot_rawio(const struct inode *inode)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
-+ if (grsec_enable_chroot_caps && proc_is_chrooted(current) &&
-+ inode && S_ISBLK(inode->i_mode) && !capable(CAP_SYS_RAWIO))
-+ return 1;
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_handle_chroot_fowner(struct pid *pid, enum pid_type type)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
-+ struct task_struct *p;
-+ int ret = 0;
-+ if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || !pid)
-+ return ret;
-+
-+ read_lock(&tasklist_lock);
-+ do_each_pid_task(pid, type, p) {
-+ if (!have_same_root(current, p)) {
-+ ret = 1;
-+ goto out;
-+ }
-+ } while_each_pid_task(pid, type, p);
-+out:
-+ read_unlock(&tasklist_lock);
-+ return ret;
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_pid_is_chrooted(struct task_struct *p)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
-+ if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || p == NULL)
-+ return 0;
-+
-+ if ((p->exit_state & (EXIT_ZOMBIE | EXIT_DEAD)) ||
-+ !have_same_root(current, p)) {
-+ return 1;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+EXPORT_SYMBOL(gr_pid_is_chrooted);
-+
-+#if defined(CONFIG_GRKERNSEC_CHROOT_DOUBLE) || defined(CONFIG_GRKERNSEC_CHROOT_FCHDIR)
-+int gr_is_outside_chroot(const struct dentry *u_dentry, const struct vfsmount *u_mnt)
-+{
-+ struct dentry *dentry = (struct dentry *)u_dentry;
-+ struct vfsmount *mnt = (struct vfsmount *)u_mnt;
-+ struct dentry *realroot;
-+ struct vfsmount *realrootmnt;
-+ struct dentry *currentroot;
-+ struct vfsmount *currentmnt;
-+ struct task_struct *reaper = &init_task;
-+ int ret = 1;
-+
-+ read_lock(&reaper->fs->lock);
-+ realrootmnt = mntget(reaper->fs->root.mnt);
-+ realroot = dget(reaper->fs->root.dentry);
-+ read_unlock(&reaper->fs->lock);
-+
-+ read_lock(¤t->fs->lock);
-+ currentmnt = mntget(current->fs->root.mnt);
-+ currentroot = dget(current->fs->root.dentry);
-+ read_unlock(¤t->fs->lock);
-+
-+ spin_lock(&dcache_lock);
-+ for (;;) {
-+ if (unlikely((dentry == realroot && mnt == realrootmnt)
-+ || (dentry == currentroot && mnt == currentmnt)))
-+ break;
-+ if (unlikely(dentry == mnt->mnt_root || IS_ROOT(dentry))) {
-+ if (mnt->mnt_parent == mnt)
-+ break;
-+ dentry = mnt->mnt_mountpoint;
-+ mnt = mnt->mnt_parent;
-+ continue;
-+ }
-+ dentry = dentry->d_parent;
-+ }
-+ spin_unlock(&dcache_lock);
-+
-+ dput(currentroot);
-+ mntput(currentmnt);
-+
-+ /* access is outside of chroot */
-+ if (dentry == realroot && mnt == realrootmnt)
-+ ret = 0;
-+
-+ dput(realroot);
-+ mntput(realrootmnt);
-+ return ret;
-+}
-+#endif
-+
-+int
-+gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
-+ if (!grsec_enable_chroot_fchdir)
-+ return 1;
-+
-+ if (!proc_is_chrooted(current))
-+ return 1;
-+ else if (!gr_is_outside_chroot(u_dentry, u_mnt)) {
-+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_FCHDIR_MSG, u_dentry, u_mnt);
-+ return 0;
-+ }
-+#endif
-+ return 1;
-+}
-+
-+int
-+gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
-+ const time_t shm_createtime)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
-+ struct task_struct *p;
-+ time_t starttime;
-+
-+ if (unlikely(!grsec_enable_chroot_shmat))
-+ return 1;
-+
-+ if (likely(!proc_is_chrooted(current)))
-+ return 1;
-+
-+ rcu_read_lock();
-+ read_lock(&tasklist_lock);
-+
-+ if ((p = find_task_by_vpid_unrestricted(shm_cprid))) {
-+ starttime = p->start_time.tv_sec;
-+ if (time_before_eq((unsigned long)starttime, (unsigned long)shm_createtime)) {
-+ if (have_same_root(current, p)) {
-+ goto allow;
-+ } else {
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+ gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
-+ return 0;
-+ }
-+ }
-+ /* creator exited, pid reuse, fall through to next check */
-+ }
-+ if ((p = find_task_by_vpid_unrestricted(shm_lapid))) {
-+ if (unlikely(!have_same_root(current, p))) {
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+ gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
-+ return 0;
-+ }
-+ }
-+
-+allow:
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+#endif
-+ return 1;
-+}
-+
-+void
-+gr_log_chroot_exec(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
-+ if (grsec_enable_chroot_execlog && proc_is_chrooted(current))
-+ gr_log_fs_generic(GR_DO_AUDIT, GR_EXEC_CHROOT_MSG, dentry, mnt);
-+#endif
-+ return;
-+}
-+
-+int
-+gr_handle_chroot_mknod(const struct dentry *dentry,
-+ const struct vfsmount *mnt, const int mode)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
-+ if (grsec_enable_chroot_mknod && !S_ISFIFO(mode) && !S_ISREG(mode) &&
-+ proc_is_chrooted(current)) {
-+ gr_log_fs_generic(GR_DONT_AUDIT, GR_MKNOD_CHROOT_MSG, dentry, mnt);
-+ return -EPERM;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_handle_chroot_mount(const struct dentry *dentry,
-+ const struct vfsmount *mnt, const char *dev_name)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
-+ if (grsec_enable_chroot_mount && proc_is_chrooted(current)) {
-+ gr_log_str_fs(GR_DONT_AUDIT, GR_MOUNT_CHROOT_MSG, dev_name ? dev_name : "none" , dentry, mnt);
-+ return -EPERM;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_handle_chroot_pivot(void)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
-+ if (grsec_enable_chroot_pivot && proc_is_chrooted(current)) {
-+ gr_log_noargs(GR_DONT_AUDIT, GR_PIVOT_CHROOT_MSG);
-+ return -EPERM;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_handle_chroot_chroot(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
-+ if (grsec_enable_chroot_double && proc_is_chrooted(current) &&
-+ !gr_is_outside_chroot(dentry, mnt)) {
-+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_CHROOT_MSG, dentry, mnt);
-+ return -EPERM;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_handle_chroot_caps(struct path *path)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
-+ if (grsec_enable_chroot_caps && current->pid > 1 && current->fs != NULL &&
-+ (init_task.fs->root.dentry != path->dentry) &&
-+ (current->nsproxy->mnt_ns->root->mnt_root != path->dentry)) {
-+
-+ kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
-+ const struct cred *old = current_cred();
-+ struct cred *new = prepare_creds();
-+ if (new == NULL)
-+ return 1;
-+
-+ new->cap_permitted = cap_drop(old->cap_permitted,
-+ chroot_caps);
-+ new->cap_inheritable = cap_drop(old->cap_inheritable,
-+ chroot_caps);
-+ new->cap_effective = cap_drop(old->cap_effective,
-+ chroot_caps);
-+
-+ commit_creds(new);
-+
-+ return 0;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_handle_chroot_sysctl(const int op)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
-+ if (grsec_enable_chroot_sysctl && proc_is_chrooted(current)
-+ && (op & MAY_WRITE))
-+ return -EACCES;
-+#endif
-+ return 0;
-+}
-+
-+void
-+gr_handle_chroot_chdir(struct path *path)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
-+ if (grsec_enable_chroot_chdir)
-+ set_fs_pwd(current->fs, path);
-+#endif
-+ return;
-+}
-+
-+int
-+gr_handle_chroot_chmod(const struct dentry *dentry,
-+ const struct vfsmount *mnt, const int mode)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
-+ /* allow chmod +s on directories, but not on files */
-+ if (grsec_enable_chroot_chmod && !S_ISDIR(dentry->d_inode->i_mode) &&
-+ ((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))) &&
-+ proc_is_chrooted(current)) {
-+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHMOD_CHROOT_MSG, dentry, mnt);
-+ return -EPERM;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+#ifdef CONFIG_SECURITY
-+EXPORT_SYMBOL(gr_handle_chroot_caps);
-+#endif
-diff -urNp linux-2.6.32.45/grsecurity/grsec_disabled.c linux-2.6.32.45/grsecurity/grsec_disabled.c
---- linux-2.6.32.45/grsecurity/grsec_disabled.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/grsecurity/grsec_disabled.c 2011-04-17 15:56:46.000000000 -0400
-@@ -0,0 +1,447 @@
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/kdev_t.h>
-+#include <linux/net.h>
-+#include <linux/in.h>
-+#include <linux/ip.h>
-+#include <linux/skbuff.h>
-+#include <linux/sysctl.h>
-+
-+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
-+void
-+pax_set_initial_flags(struct linux_binprm *bprm)
-+{
-+ return;
-+}
-+#endif
-+
-+#ifdef CONFIG_SYSCTL
-+__u32
-+gr_handle_sysctl(const struct ctl_table * table, const int op)
-+{
-+ return 0;
-+}
-+#endif
-+
-+#ifdef CONFIG_TASKSTATS
-+int gr_is_taskstats_denied(int pid)
-+{
-+ return 0;
-+}
-+#endif
-+
-+int
-+gr_acl_is_enabled(void)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_handle_rawio(const struct inode *inode)
-+{
-+ return 0;
-+}
-+
-+void
-+gr_acl_handle_psacct(struct task_struct *task, const long code)
-+{
-+ return;
-+}
-+
-+int
-+gr_handle_ptrace(struct task_struct *task, const long request)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_handle_proc_ptrace(struct task_struct *task)
-+{
-+ return 0;
-+}
-+
-+void
-+gr_learn_resource(const struct task_struct *task,
-+ const int res, const unsigned long wanted, const int gt)
-+{
-+ return;
-+}
-+
-+int
-+gr_set_acls(const int type)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_check_hidden_task(const struct task_struct *tsk)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_check_protected_task(const struct task_struct *task)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
-+{
-+ return 0;
-+}
-+
-+void
-+gr_copy_label(struct task_struct *tsk)
-+{
-+ return;
-+}
-+
-+void
-+gr_set_pax_flags(struct task_struct *task)
-+{
-+ return;
-+}
-+
-+int
-+gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
-+ const int unsafe_share)
-+{
-+ return 0;
-+}
-+
-+void
-+gr_handle_delete(const ino_t ino, const dev_t dev)
-+{
-+ return;
-+}
-+
-+void
-+gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+ return;
-+}
-+
-+void
-+gr_handle_crash(struct task_struct *task, const int sig)
-+{
-+ return;
-+}
-+
-+int
-+gr_check_crash_exec(const struct file *filp)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_check_crash_uid(const uid_t uid)
-+{
-+ return 0;
-+}
-+
-+void
-+gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
-+ struct dentry *old_dentry,
-+ struct dentry *new_dentry,
-+ struct vfsmount *mnt, const __u8 replace)
-+{
-+ return;
-+}
-+
-+int
-+gr_search_socket(const int family, const int type, const int protocol)
-+{
-+ return 1;
-+}
-+
-+int
-+gr_search_connectbind(const int mode, const struct socket *sock,
-+ const struct sockaddr_in *addr)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_is_capable(const int cap)
-+{
-+ return 1;
-+}
-+
-+int
-+gr_is_capable_nolog(const int cap)
-+{
-+ return 1;
-+}
-+
-+void
-+gr_handle_alertkill(struct task_struct *task)
-+{
-+ return;
-+}
-+
-+__u32
-+gr_acl_handle_execve(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_hidden_file(const struct dentry * dentry,
-+ const struct vfsmount * mnt)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
-+ const int fmode)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_unlink(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+ return 1;
-+}
-+
-+int
-+gr_acl_handle_mmap(const struct file *file, const unsigned long prot,
-+ unsigned int *vm_flags)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_truncate(const struct dentry * dentry,
-+ const struct vfsmount * mnt)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_utime(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_access(const struct dentry * dentry,
-+ const struct vfsmount * mnt, const int fmode)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_fchmod(const struct dentry * dentry, const struct vfsmount * mnt,
-+ mode_t mode)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_chmod(const struct dentry * dentry, const struct vfsmount * mnt,
-+ mode_t mode)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_chown(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_setxattr(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+ return 1;
-+}
-+
-+void
-+grsecurity_init(void)
-+{
-+ return;
-+}
-+
-+__u32
-+gr_acl_handle_mknod(const struct dentry * new_dentry,
-+ const struct dentry * parent_dentry,
-+ const struct vfsmount * parent_mnt,
-+ const int mode)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_mkdir(const struct dentry * new_dentry,
-+ const struct dentry * parent_dentry,
-+ const struct vfsmount * parent_mnt)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_symlink(const struct dentry * new_dentry,
-+ const struct dentry * parent_dentry,
-+ const struct vfsmount * parent_mnt, const char *from)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_link(const struct dentry * new_dentry,
-+ const struct dentry * parent_dentry,
-+ const struct vfsmount * parent_mnt,
-+ const struct dentry * old_dentry,
-+ const struct vfsmount * old_mnt, const char *to)
-+{
-+ return 1;
-+}
-+
-+int
-+gr_acl_handle_rename(const struct dentry *new_dentry,
-+ const struct dentry *parent_dentry,
-+ const struct vfsmount *parent_mnt,
-+ const struct dentry *old_dentry,
-+ const struct inode *old_parent_inode,
-+ const struct vfsmount *old_mnt, const char *newname)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_acl_handle_filldir(const struct file *file, const char *name,
-+ const int namelen, const ino_t ino)
-+{
-+ return 1;
-+}
-+
-+int
-+gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
-+ const time_t shm_createtime, const uid_t cuid, const int shmid)
-+{
-+ return 1;
-+}
-+
-+int
-+gr_search_bind(const struct socket *sock, const struct sockaddr_in *addr)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_search_accept(const struct socket *sock)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_search_listen(const struct socket *sock)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_search_connect(const struct socket *sock, const struct sockaddr_in *addr)
-+{
-+ return 0;
-+}
-+
-+__u32
-+gr_acl_handle_unix(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+ return 1;
-+}
-+
-+__u32
-+gr_acl_handle_creat(const struct dentry * dentry,
-+ const struct dentry * p_dentry,
-+ const struct vfsmount * p_mnt, const int fmode,
-+ const int imode)
-+{
-+ return 1;
-+}
-+
-+void
-+gr_acl_handle_exit(void)
-+{
-+ return;
-+}
-+
-+int
-+gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
-+{
-+ return 1;
-+}
-+
-+void
-+gr_set_role_label(const uid_t uid, const gid_t gid)
-+{
-+ return;
-+}
-+
-+int
-+gr_acl_handle_procpidmem(const struct task_struct *task)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr)
-+{
-+ return 0;
-+}
-+
-+void
-+gr_set_kernel_label(struct task_struct *task)
-+{
-+ return;
-+}
-+
-+int
-+gr_check_user_change(int real, int effective, int fs)
-+{
-+ return 0;
-+}
-+
-+int
-+gr_check_group_change(int real, int effective, int fs)
-+{
-+ return 0;
-+}
-+
-+int gr_acl_enable_at_secure(void)
-+{
-+ return 0;
-+}
-+
-+dev_t gr_get_dev_from_dentry(struct dentry *dentry)
-+{
-+ return dentry->d_inode->i_sb->s_dev;
-+}
-+
-+EXPORT_SYMBOL(gr_is_capable);
-+EXPORT_SYMBOL(gr_is_capable_nolog);
-+EXPORT_SYMBOL(gr_learn_resource);
-+EXPORT_SYMBOL(gr_set_kernel_label);
-+#ifdef CONFIG_SECURITY
-+EXPORT_SYMBOL(gr_check_user_change);
-+EXPORT_SYMBOL(gr_check_group_change);
-+#endif
-diff -urNp linux-2.6.32.45/grsecurity/grsec_exec.c linux-2.6.32.45/grsecurity/grsec_exec.c
---- linux-2.6.32.45/grsecurity/grsec_exec.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/grsecurity/grsec_exec.c 2011-08-11 19:57:19.000000000 -0400
-@@ -0,0 +1,132 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/binfmts.h>
-+#include <linux/smp_lock.h>
-+#include <linux/fs.h>
-+#include <linux/types.h>
-+#include <linux/grdefs.h>
-+#include <linux/grinternal.h>
-+#include <linux/capability.h>
-+#include <linux/compat.h>
-+
-+#include <asm/uaccess.h>
-+
-+#ifdef CONFIG_GRKERNSEC_EXECLOG
-+static char gr_exec_arg_buf[132];
-+static DEFINE_MUTEX(gr_exec_arg_mutex);
-+#endif
-+
-+void
-+gr_handle_exec_args(struct linux_binprm *bprm, const char __user *const __user *argv)
-+{
-+#ifdef CONFIG_GRKERNSEC_EXECLOG
-+ char *grarg = gr_exec_arg_buf;
-+ unsigned int i, x, execlen = 0;
-+ char c;
-+
-+ if (!((grsec_enable_execlog && grsec_enable_group &&
-+ in_group_p(grsec_audit_gid))
-+ || (grsec_enable_execlog && !grsec_enable_group)))
-+ return;
-+
-+ mutex_lock(&gr_exec_arg_mutex);
-+ memset(grarg, 0, sizeof(gr_exec_arg_buf));
-+
-+ if (unlikely(argv == NULL))
-+ goto log;
-+
-+ for (i = 0; i < bprm->argc && execlen < 128; i++) {
-+ const char __user *p;
-+ unsigned int len;
-+
-+ if (copy_from_user(&p, argv + i, sizeof(p)))
-+ goto log;
-+ if (!p)
-+ goto log;
-+ len = strnlen_user(p, 128 - execlen);
-+ if (len > 128 - execlen)
-+ len = 128 - execlen;
-+ else if (len > 0)
-+ len--;
-+ if (copy_from_user(grarg + execlen, p, len))
-+ goto log;
-+
-+ /* rewrite unprintable characters */
-+ for (x = 0; x < len; x++) {
-+ c = *(grarg + execlen + x);
-+ if (c < 32 || c > 126)
-+ *(grarg + execlen + x) = ' ';
-+ }
-+
-+ execlen += len;
-+ *(grarg + execlen) = ' ';
-+ *(grarg + execlen + 1) = '\0';
-+ execlen++;
-+ }
-+
-+ log:
-+ gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
-+ bprm->file->f_path.mnt, grarg);
-+ mutex_unlock(&gr_exec_arg_mutex);
-+#endif
-+ return;
-+}
-+
-+#ifdef CONFIG_COMPAT
-+void
-+gr_handle_exec_args_compat(struct linux_binprm *bprm, compat_uptr_t __user *argv)
-+{
-+#ifdef CONFIG_GRKERNSEC_EXECLOG
-+ char *grarg = gr_exec_arg_buf;
-+ unsigned int i, x, execlen = 0;
-+ char c;
-+
-+ if (!((grsec_enable_execlog && grsec_enable_group &&
-+ in_group_p(grsec_audit_gid))
-+ || (grsec_enable_execlog && !grsec_enable_group)))
-+ return;
-+
-+ mutex_lock(&gr_exec_arg_mutex);
-+ memset(grarg, 0, sizeof(gr_exec_arg_buf));
-+
-+ if (unlikely(argv == NULL))
-+ goto log;
-+
-+ for (i = 0; i < bprm->argc && execlen < 128; i++) {
-+ compat_uptr_t p;
-+ unsigned int len;
-+
-+ if (get_user(p, argv + i))
-+ goto log;
-+ len = strnlen_user(compat_ptr(p), 128 - execlen);
-+ if (len > 128 - execlen)
-+ len = 128 - execlen;
-+ else if (len > 0)
-+ len--;
-+ else
-+ goto log;
-+ if (copy_from_user(grarg + execlen, compat_ptr(p), len))
-+ goto log;
-+
-+ /* rewrite unprintable characters */
-+ for (x = 0; x < len; x++) {
-+ c = *(grarg + execlen + x);
-+ if (c < 32 || c > 126)
-+ *(grarg + execlen + x) = ' ';
-+ }
-+
-+ execlen += len;
-+ *(grarg + execlen) = ' ';
-+ *(grarg + execlen + 1) = '\0';
-+ execlen++;
-+ }
-+
-+ log:
-+ gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
-+ bprm->file->f_path.mnt, grarg);
-+ mutex_unlock(&gr_exec_arg_mutex);
-+#endif
-+ return;
-+}
-+#endif
-diff -urNp linux-2.6.32.45/grsecurity/grsec_fifo.c linux-2.6.32.45/grsecurity/grsec_fifo.c
---- linux-2.6.32.45/grsecurity/grsec_fifo.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/grsecurity/grsec_fifo.c 2011-04-17 15:56:46.000000000 -0400
-@@ -0,0 +1,24 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/fs.h>
-+#include <linux/file.h>
-+#include <linux/grinternal.h>
-+
-+int
-+gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
-+ const struct dentry *dir, const int flag, const int acc_mode)
-+{
-+#ifdef CONFIG_GRKERNSEC_FIFO
-+ const struct cred *cred = current_cred();
-+
-+ if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
-+ !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
-+ (dentry->d_inode->i_uid != dir->d_inode->i_uid) &&
-+ (cred->fsuid != dentry->d_inode->i_uid)) {
-+ if (!inode_permission(dentry->d_inode, acc_mode))
-+ gr_log_fs_int2(GR_DONT_AUDIT, GR_FIFO_MSG, dentry, mnt, dentry->d_inode->i_uid, dentry->d_inode->i_gid);
-+ return -EACCES;
-+ }
-+#endif
-+ return 0;
-+}
-diff -urNp linux-2.6.32.45/grsecurity/grsec_fork.c linux-2.6.32.45/grsecurity/grsec_fork.c
---- linux-2.6.32.45/grsecurity/grsec_fork.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/grsecurity/grsec_fork.c 2011-04-17 15:56:46.000000000 -0400
-@@ -0,0 +1,23 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+#include <linux/errno.h>
-+
-+void
-+gr_log_forkfail(const int retval)
-+{
-+#ifdef CONFIG_GRKERNSEC_FORKFAIL
-+ if (grsec_enable_forkfail && (retval == -EAGAIN || retval == -ENOMEM)) {
-+ switch (retval) {
-+ case -EAGAIN:
-+ gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "EAGAIN");
-+ break;
-+ case -ENOMEM:
-+ gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "ENOMEM");
-+ break;
-+ }
-+ }
-+#endif
-+ return;
-+}
-diff -urNp linux-2.6.32.45/grsecurity/grsec_init.c linux-2.6.32.45/grsecurity/grsec_init.c
---- linux-2.6.32.45/grsecurity/grsec_init.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/grsecurity/grsec_init.c 2011-08-11 19:57:42.000000000 -0400
-@@ -0,0 +1,270 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/mm.h>
-+#include <linux/smp_lock.h>
-+#include <linux/gracl.h>
-+#include <linux/slab.h>
-+#include <linux/vmalloc.h>
-+#include <linux/percpu.h>
-+#include <linux/module.h>
-+
-+int grsec_enable_brute;
-+int grsec_enable_link;
-+int grsec_enable_dmesg;
-+int grsec_enable_harden_ptrace;
-+int grsec_enable_fifo;
-+int grsec_enable_execlog;
-+int grsec_enable_signal;
-+int grsec_enable_forkfail;
-+int grsec_enable_audit_ptrace;
-+int grsec_enable_time;
-+int grsec_enable_audit_textrel;
-+int grsec_enable_group;
-+int grsec_audit_gid;
-+int grsec_enable_chdir;
-+int grsec_enable_mount;
-+int grsec_enable_rofs;
-+int grsec_enable_chroot_findtask;
-+int grsec_enable_chroot_mount;
-+int grsec_enable_chroot_shmat;
-+int grsec_enable_chroot_fchdir;
-+int grsec_enable_chroot_double;
-+int grsec_enable_chroot_pivot;
-+int grsec_enable_chroot_chdir;
-+int grsec_enable_chroot_chmod;
-+int grsec_enable_chroot_mknod;
-+int grsec_enable_chroot_nice;
-+int grsec_enable_chroot_execlog;
-+int grsec_enable_chroot_caps;
-+int grsec_enable_chroot_sysctl;
-+int grsec_enable_chroot_unix;
-+int grsec_enable_tpe;
-+int grsec_tpe_gid;
-+int grsec_enable_blackhole;
-+#ifdef CONFIG_IPV6_MODULE
-+EXPORT_SYMBOL(grsec_enable_blackhole);
-+#endif
-+int grsec_lastack_retries;
-+int grsec_enable_tpe_all;
-+int grsec_enable_tpe_invert;
-+int grsec_enable_socket_all;
-+int grsec_socket_all_gid;
-+int grsec_enable_socket_client;
-+int grsec_socket_client_gid;
-+int grsec_enable_socket_server;
-+int grsec_socket_server_gid;
-+int grsec_resource_logging;
-+int grsec_disable_privio;
-+int grsec_enable_log_rwxmaps;
-+int grsec_lock;
-+
-+DEFINE_SPINLOCK(grsec_alert_lock);
-+unsigned long grsec_alert_wtime = 0;
-+unsigned long grsec_alert_fyet = 0;
-+
-+DEFINE_SPINLOCK(grsec_audit_lock);
-+
-+DEFINE_RWLOCK(grsec_exec_file_lock);
-+
-+char *gr_shared_page[4];
-+
-+char *gr_alert_log_fmt;
-+char *gr_audit_log_fmt;
-+char *gr_alert_log_buf;
-+char *gr_audit_log_buf;
-+
-+extern struct gr_arg *gr_usermode;
-+extern unsigned char *gr_system_salt;
-+extern unsigned char *gr_system_sum;
-+
-+void __init
-+grsecurity_init(void)
-+{
-+ int j;
-+ /* create the per-cpu shared pages */
-+
-+#ifdef CONFIG_X86
-+ memset((char *)(0x41a + PAGE_OFFSET), 0, 36);
-+#endif
-+
-+ for (j = 0; j < 4; j++) {
-+ gr_shared_page[j] = (char *)__alloc_percpu(PAGE_SIZE, __alignof__(unsigned long long));
-+ if (gr_shared_page[j] == NULL) {
-+ panic("Unable to allocate grsecurity shared page");
-+ return;
-+ }
-+ }
-+
-+ /* allocate log buffers */
-+ gr_alert_log_fmt = kmalloc(512, GFP_KERNEL);
-+ if (!gr_alert_log_fmt) {
-+ panic("Unable to allocate grsecurity alert log format buffer");
-+ return;
-+ }
-+ gr_audit_log_fmt = kmalloc(512, GFP_KERNEL);
-+ if (!gr_audit_log_fmt) {
-+ panic("Unable to allocate grsecurity audit log format buffer");
-+ return;
-+ }
-+ gr_alert_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
-+ if (!gr_alert_log_buf) {
-+ panic("Unable to allocate grsecurity alert log buffer");
-+ return;
-+ }
-+ gr_audit_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
-+ if (!gr_audit_log_buf) {
-+ panic("Unable to allocate grsecurity audit log buffer");
-+ return;
-+ }
-+
-+ /* allocate memory for authentication structure */
-+ gr_usermode = kmalloc(sizeof(struct gr_arg), GFP_KERNEL);
-+ gr_system_salt = kmalloc(GR_SALT_LEN, GFP_KERNEL);
-+ gr_system_sum = kmalloc(GR_SHA_LEN, GFP_KERNEL);
-+
-+ if (!gr_usermode || !gr_system_salt || !gr_system_sum) {
-+ panic("Unable to allocate grsecurity authentication structure");
-+ return;
-+ }
-+
-+
-+#ifdef CONFIG_GRKERNSEC_IO
-+#if !defined(CONFIG_GRKERNSEC_SYSCTL_DISTRO)
-+ grsec_disable_privio = 1;
-+#elif defined(CONFIG_GRKERNSEC_SYSCTL_ON)
-+ grsec_disable_privio = 1;
-+#else
-+ grsec_disable_privio = 0;
-+#endif
-+#endif
-+
-+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
-+ /* for backward compatibility, tpe_invert always defaults to on if
-+ enabled in the kernel
-+ */
-+ grsec_enable_tpe_invert = 1;
-+#endif
-+
-+#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
-+#ifndef CONFIG_GRKERNSEC_SYSCTL
-+ grsec_lock = 1;
-+#endif
-+
-+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
-+ grsec_enable_audit_textrel = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
-+ grsec_enable_log_rwxmaps = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
-+ grsec_enable_group = 1;
-+ grsec_audit_gid = CONFIG_GRKERNSEC_AUDIT_GID;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
-+ grsec_enable_chdir = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+ grsec_enable_harden_ptrace = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
-+ grsec_enable_mount = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_LINK
-+ grsec_enable_link = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_BRUTE
-+ grsec_enable_brute = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_DMESG
-+ grsec_enable_dmesg = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ grsec_enable_blackhole = 1;
-+ grsec_lastack_retries = 4;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_FIFO
-+ grsec_enable_fifo = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_EXECLOG
-+ grsec_enable_execlog = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SIGNAL
-+ grsec_enable_signal = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_FORKFAIL
-+ grsec_enable_forkfail = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_TIME
-+ grsec_enable_time = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_RESLOG
-+ grsec_resource_logging = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
-+ grsec_enable_chroot_findtask = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
-+ grsec_enable_chroot_unix = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
-+ grsec_enable_chroot_mount = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
-+ grsec_enable_chroot_fchdir = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
-+ grsec_enable_chroot_shmat = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
-+ grsec_enable_audit_ptrace = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
-+ grsec_enable_chroot_double = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
-+ grsec_enable_chroot_pivot = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
-+ grsec_enable_chroot_chdir = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
-+ grsec_enable_chroot_chmod = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
-+ grsec_enable_chroot_mknod = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
-+ grsec_enable_chroot_nice = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
-+ grsec_enable_chroot_execlog = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
-+ grsec_enable_chroot_caps = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
-+ grsec_enable_chroot_sysctl = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_TPE
-+ grsec_enable_tpe = 1;
-+ grsec_tpe_gid = CONFIG_GRKERNSEC_TPE_GID;
-+#ifdef CONFIG_GRKERNSEC_TPE_ALL
-+ grsec_enable_tpe_all = 1;
-+#endif
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
-+ grsec_enable_socket_all = 1;
-+ grsec_socket_all_gid = CONFIG_GRKERNSEC_SOCKET_ALL_GID;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
-+ grsec_enable_socket_client = 1;
-+ grsec_socket_client_gid = CONFIG_GRKERNSEC_SOCKET_CLIENT_GID;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
-+ grsec_enable_socket_server = 1;
-+ grsec_socket_server_gid = CONFIG_GRKERNSEC_SOCKET_SERVER_GID;
-+#endif
-+#endif
-+
-+ return;
-+}
-diff -urNp linux-2.6.32.45/grsecurity/grsec_link.c linux-2.6.32.45/grsecurity/grsec_link.c
---- linux-2.6.32.45/grsecurity/grsec_link.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/grsecurity/grsec_link.c 2011-04-17 15:56:46.000000000 -0400
-@@ -0,0 +1,43 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/fs.h>
-+#include <linux/file.h>
-+#include <linux/grinternal.h>
-+
-+int
-+gr_handle_follow_link(const struct inode *parent,
-+ const struct inode *inode,
-+ const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+#ifdef CONFIG_GRKERNSEC_LINK
-+ const struct cred *cred = current_cred();
-+
-+ if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
-+ (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) &&
-+ (parent->i_mode & S_IWOTH) && (cred->fsuid != inode->i_uid)) {
-+ gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid);
-+ return -EACCES;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_handle_hardlink(const struct dentry *dentry,
-+ const struct vfsmount *mnt,
-+ struct inode *inode, const int mode, const char *to)
-+{
-+#ifdef CONFIG_GRKERNSEC_LINK
-+ const struct cred *cred = current_cred();
-+
-+ if (grsec_enable_link && cred->fsuid != inode->i_uid &&
-+ (!S_ISREG(mode) || (mode & S_ISUID) ||
-+ ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) ||
-+ (inode_permission(inode, MAY_READ | MAY_WRITE))) &&
-+ !capable(CAP_FOWNER) && cred->uid) {
-+ gr_log_fs_int2_str(GR_DONT_AUDIT, GR_HARDLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid, to);
-+ return -EPERM;
-+ }
-+#endif
-+ return 0;
-+}
-diff -urNp linux-2.6.32.45/grsecurity/grsec_log.c linux-2.6.32.45/grsecurity/grsec_log.c
---- linux-2.6.32.45/grsecurity/grsec_log.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/grsecurity/grsec_log.c 2011-05-10 21:58:49.000000000 -0400
-@@ -0,0 +1,310 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/tty.h>
-+#include <linux/fs.h>
-+#include <linux/grinternal.h>
-+
-+#ifdef CONFIG_TREE_PREEMPT_RCU
-+#define DISABLE_PREEMPT() preempt_disable()
-+#define ENABLE_PREEMPT() preempt_enable()
-+#else
-+#define DISABLE_PREEMPT()
-+#define ENABLE_PREEMPT()
-+#endif
-+
-+#define BEGIN_LOCKS(x) \
-+ DISABLE_PREEMPT(); \
-+ rcu_read_lock(); \
-+ read_lock(&tasklist_lock); \
-+ read_lock(&grsec_exec_file_lock); \
-+ if (x != GR_DO_AUDIT) \
-+ spin_lock(&grsec_alert_lock); \
-+ else \
-+ spin_lock(&grsec_audit_lock)
-+
-+#define END_LOCKS(x) \
-+ if (x != GR_DO_AUDIT) \
-+ spin_unlock(&grsec_alert_lock); \
-+ else \
-+ spin_unlock(&grsec_audit_lock); \
-+ read_unlock(&grsec_exec_file_lock); \
-+ read_unlock(&tasklist_lock); \
-+ rcu_read_unlock(); \
-+ ENABLE_PREEMPT(); \
-+ if (x == GR_DONT_AUDIT) \
-+ gr_handle_alertkill(current)
-+
-+enum {
-+ FLOODING,
-+ NO_FLOODING
-+};
-+
-+extern char *gr_alert_log_fmt;
-+extern char *gr_audit_log_fmt;
-+extern char *gr_alert_log_buf;
-+extern char *gr_audit_log_buf;
-+
-+static int gr_log_start(int audit)
-+{
-+ char *loglevel = (audit == GR_DO_AUDIT) ? KERN_INFO : KERN_ALERT;
-+ char *fmt = (audit == GR_DO_AUDIT) ? gr_audit_log_fmt : gr_alert_log_fmt;
-+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
-+
-+ if (audit == GR_DO_AUDIT)
-+ goto set_fmt;
-+
-+ if (!grsec_alert_wtime || jiffies - grsec_alert_wtime > CONFIG_GRKERNSEC_FLOODTIME * HZ) {
-+ grsec_alert_wtime = jiffies;
-+ grsec_alert_fyet = 0;
-+ } else if ((jiffies - grsec_alert_wtime < CONFIG_GRKERNSEC_FLOODTIME * HZ) && (grsec_alert_fyet < CONFIG_GRKERNSEC_FLOODBURST)) {
-+ grsec_alert_fyet++;
-+ } else if (grsec_alert_fyet == CONFIG_GRKERNSEC_FLOODBURST) {
-+ grsec_alert_wtime = jiffies;
-+ grsec_alert_fyet++;
-+ printk(KERN_ALERT "grsec: more alerts, logging disabled for %d seconds\n", CONFIG_GRKERNSEC_FLOODTIME);
-+ return FLOODING;
-+ } else return FLOODING;
-+
-+set_fmt:
-+ memset(buf, 0, PAGE_SIZE);
-+ if (current->signal->curr_ip && gr_acl_is_enabled()) {
-+ sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: (%.64s:%c:%.950s) ");
-+ snprintf(buf, PAGE_SIZE - 1, fmt, ¤t->signal->curr_ip, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
-+ } else if (current->signal->curr_ip) {
-+ sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: ");
-+ snprintf(buf, PAGE_SIZE - 1, fmt, ¤t->signal->curr_ip);
-+ } else if (gr_acl_is_enabled()) {
-+ sprintf(fmt, "%s%s", loglevel, "grsec: (%.64s:%c:%.950s) ");
-+ snprintf(buf, PAGE_SIZE - 1, fmt, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
-+ } else {
-+ sprintf(fmt, "%s%s", loglevel, "grsec: ");
-+ strcpy(buf, fmt);
-+ }
-+
-+ return NO_FLOODING;
-+}
-+
-+static void gr_log_middle(int audit, const char *msg, va_list ap)
-+ __attribute__ ((format (printf, 2, 0)));
-+
-+static void gr_log_middle(int audit, const char *msg, va_list ap)
-+{
-+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
-+ unsigned int len = strlen(buf);
-+
-+ vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
-+
-+ return;
-+}
-+
-+static void gr_log_middle_varargs(int audit, const char *msg, ...)
-+ __attribute__ ((format (printf, 2, 3)));
-+
-+static void gr_log_middle_varargs(int audit, const char *msg, ...)
-+{
-+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
-+ unsigned int len = strlen(buf);
-+ va_list ap;
-+
-+ va_start(ap, msg);
-+ vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
-+ va_end(ap);
-+
-+ return;
-+}
-+
-+static void gr_log_end(int audit)
-+{
-+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
-+ unsigned int len = strlen(buf);
-+
-+ snprintf(buf + len, PAGE_SIZE - len - 1, DEFAULTSECMSG, DEFAULTSECARGS(current, current_cred(), __task_cred(current->real_parent)));
-+ printk("%s\n", buf);
-+
-+ return;
-+}
-+
-+void gr_log_varargs(int audit, const char *msg, int argtypes, ...)
-+{
-+ int logtype;
-+ char *result = (audit == GR_DO_AUDIT) ? "successful" : "denied";
-+ char *str1 = NULL, *str2 = NULL, *str3 = NULL;
-+ void *voidptr = NULL;
-+ int num1 = 0, num2 = 0;
-+ unsigned long ulong1 = 0, ulong2 = 0;
-+ struct dentry *dentry = NULL;
-+ struct vfsmount *mnt = NULL;
-+ struct file *file = NULL;
-+ struct task_struct *task = NULL;
-+ const struct cred *cred, *pcred;
-+ va_list ap;
-+
-+ BEGIN_LOCKS(audit);
-+ logtype = gr_log_start(audit);
-+ if (logtype == FLOODING) {
-+ END_LOCKS(audit);
-+ return;
-+ }
-+ va_start(ap, argtypes);
-+ switch (argtypes) {
-+ case GR_TTYSNIFF:
-+ task = va_arg(ap, struct task_struct *);
-+ gr_log_middle_varargs(audit, msg, &task->signal->curr_ip, gr_task_fullpath0(task), task->comm, task->pid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid);
-+ break;
-+ case GR_SYSCTL_HIDDEN:
-+ str1 = va_arg(ap, char *);
-+ gr_log_middle_varargs(audit, msg, result, str1);
-+ break;
-+ case GR_RBAC:
-+ dentry = va_arg(ap, struct dentry *);
-+ mnt = va_arg(ap, struct vfsmount *);
-+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt));
-+ break;
-+ case GR_RBAC_STR:
-+ dentry = va_arg(ap, struct dentry *);
-+ mnt = va_arg(ap, struct vfsmount *);
-+ str1 = va_arg(ap, char *);
-+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1);
-+ break;
-+ case GR_STR_RBAC:
-+ str1 = va_arg(ap, char *);
-+ dentry = va_arg(ap, struct dentry *);
-+ mnt = va_arg(ap, struct vfsmount *);
-+ gr_log_middle_varargs(audit, msg, result, str1, gr_to_filename(dentry, mnt));
-+ break;
-+ case GR_RBAC_MODE2:
-+ dentry = va_arg(ap, struct dentry *);
-+ mnt = va_arg(ap, struct vfsmount *);
-+ str1 = va_arg(ap, char *);
-+ str2 = va_arg(ap, char *);
-+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2);
-+ break;
-+ case GR_RBAC_MODE3:
-+ dentry = va_arg(ap, struct dentry *);
-+ mnt = va_arg(ap, struct vfsmount *);
-+ str1 = va_arg(ap, char *);
-+ str2 = va_arg(ap, char *);
-+ str3 = va_arg(ap, char *);
-+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2, str3);
-+ break;
-+ case GR_FILENAME:
-+ dentry = va_arg(ap, struct dentry *);
-+ mnt = va_arg(ap, struct vfsmount *);
-+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt));
-+ break;
-+ case GR_STR_FILENAME:
-+ str1 = va_arg(ap, char *);
-+ dentry = va_arg(ap, struct dentry *);
-+ mnt = va_arg(ap, struct vfsmount *);
-+ gr_log_middle_varargs(audit, msg, str1, gr_to_filename(dentry, mnt));
-+ break;
-+ case GR_FILENAME_STR:
-+ dentry = va_arg(ap, struct dentry *);
-+ mnt = va_arg(ap, struct vfsmount *);
-+ str1 = va_arg(ap, char *);
-+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), str1);
-+ break;
-+ case GR_FILENAME_TWO_INT:
-+ dentry = va_arg(ap, struct dentry *);
-+ mnt = va_arg(ap, struct vfsmount *);
-+ num1 = va_arg(ap, int);
-+ num2 = va_arg(ap, int);
-+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2);
-+ break;
-+ case GR_FILENAME_TWO_INT_STR:
-+ dentry = va_arg(ap, struct dentry *);
-+ mnt = va_arg(ap, struct vfsmount *);
-+ num1 = va_arg(ap, int);
-+ num2 = va_arg(ap, int);
-+ str1 = va_arg(ap, char *);
-+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2, str1);
-+ break;
-+ case GR_TEXTREL:
-+ file = va_arg(ap, struct file *);
-+ ulong1 = va_arg(ap, unsigned long);
-+ ulong2 = va_arg(ap, unsigned long);
-+ gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>", ulong1, ulong2);
-+ break;
-+ case GR_PTRACE:
-+ task = va_arg(ap, struct task_struct *);
-+ gr_log_middle_varargs(audit, msg, task->exec_file ? gr_to_filename(task->exec_file->f_path.dentry, task->exec_file->f_path.mnt) : "(none)", task->comm, task->pid);
-+ break;
-+ case GR_RESOURCE:
-+ task = va_arg(ap, struct task_struct *);
-+ cred = __task_cred(task);
-+ pcred = __task_cred(task->real_parent);
-+ ulong1 = va_arg(ap, unsigned long);
-+ str1 = va_arg(ap, char *);
-+ ulong2 = va_arg(ap, unsigned long);
-+ gr_log_middle_varargs(audit, msg, ulong1, str1, ulong2, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
-+ break;
-+ case GR_CAP:
-+ task = va_arg(ap, struct task_struct *);
-+ cred = __task_cred(task);
-+ pcred = __task_cred(task->real_parent);
-+ str1 = va_arg(ap, char *);
-+ gr_log_middle_varargs(audit, msg, str1, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
-+ break;
-+ case GR_SIG:
-+ str1 = va_arg(ap, char *);
-+ voidptr = va_arg(ap, void *);
-+ gr_log_middle_varargs(audit, msg, str1, voidptr);
-+ break;
-+ case GR_SIG2:
-+ task = va_arg(ap, struct task_struct *);
-+ cred = __task_cred(task);
-+ pcred = __task_cred(task->real_parent);
-+ num1 = va_arg(ap, int);
-+ gr_log_middle_varargs(audit, msg, num1, gr_task_fullpath0(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
-+ break;
-+ case GR_CRASH1:
-+ task = va_arg(ap, struct task_struct *);
-+ cred = __task_cred(task);
-+ pcred = __task_cred(task->real_parent);
-+ ulong1 = va_arg(ap, unsigned long);
-+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, cred->uid, ulong1);
-+ break;
-+ case GR_CRASH2:
-+ task = va_arg(ap, struct task_struct *);
-+ cred = __task_cred(task);
-+ pcred = __task_cred(task->real_parent);
-+ ulong1 = va_arg(ap, unsigned long);
-+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, ulong1);
-+ break;
-+ case GR_RWXMAP:
-+ file = va_arg(ap, struct file *);
-+ gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>");
-+ break;
-+ case GR_PSACCT:
-+ {
-+ unsigned int wday, cday;
-+ __u8 whr, chr;
-+ __u8 wmin, cmin;
-+ __u8 wsec, csec;
-+ char cur_tty[64] = { 0 };
-+ char parent_tty[64] = { 0 };
-+
-+ task = va_arg(ap, struct task_struct *);
-+ wday = va_arg(ap, unsigned int);
-+ cday = va_arg(ap, unsigned int);
-+ whr = va_arg(ap, int);
-+ chr = va_arg(ap, int);
-+ wmin = va_arg(ap, int);
-+ cmin = va_arg(ap, int);
-+ wsec = va_arg(ap, int);
-+ csec = va_arg(ap, int);
-+ ulong1 = va_arg(ap, unsigned long);
-+ cred = __task_cred(task);
-+ pcred = __task_cred(task->real_parent);
-+
-+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, &task->signal->curr_ip, tty_name(task->signal->tty, cur_tty), cred->uid, cred->euid, cred->gid, cred->egid, wday, whr, wmin, wsec, cday, chr, cmin, csec, (task->flags & PF_SIGNALED) ? "killed by signal" : "exited", ulong1, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, &task->real_parent->signal->curr_ip, tty_name(task->real_parent->signal->tty, parent_tty), pcred->uid, pcred->euid, pcred->gid, pcred->egid);
-+ }
-+ break;
-+ default:
-+ gr_log_middle(audit, msg, ap);
-+ }
-+ va_end(ap);
-+ gr_log_end(audit);
-+ END_LOCKS(audit);
-+}
-diff -urNp linux-2.6.32.45/grsecurity/grsec_mem.c linux-2.6.32.45/grsecurity/grsec_mem.c
---- linux-2.6.32.45/grsecurity/grsec_mem.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/grsecurity/grsec_mem.c 2011-04-17 15:56:46.000000000 -0400
-@@ -0,0 +1,33 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/mm.h>
-+#include <linux/mman.h>
-+#include <linux/grinternal.h>
-+
-+void
-+gr_handle_ioperm(void)
-+{
-+ gr_log_noargs(GR_DONT_AUDIT, GR_IOPERM_MSG);
-+ return;
-+}
-+
-+void
-+gr_handle_iopl(void)
-+{
-+ gr_log_noargs(GR_DONT_AUDIT, GR_IOPL_MSG);
-+ return;
-+}
-+
-+void
-+gr_handle_mem_readwrite(u64 from, u64 to)
-+{
-+ gr_log_two_u64(GR_DONT_AUDIT, GR_MEM_READWRITE_MSG, from, to);
-+ return;
-+}
-+
-+void
-+gr_handle_vm86(void)
-+{
-+ gr_log_noargs(GR_DONT_AUDIT, GR_VM86_MSG);
-+ return;
-+}
-diff -urNp linux-2.6.32.45/grsecurity/grsec_mount.c linux-2.6.32.45/grsecurity/grsec_mount.c
---- linux-2.6.32.45/grsecurity/grsec_mount.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/grsecurity/grsec_mount.c 2011-06-20 19:47:03.000000000 -0400
-@@ -0,0 +1,62 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/mount.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+void
-+gr_log_remount(const char *devname, const int retval)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
-+ if (grsec_enable_mount && (retval >= 0))
-+ gr_log_str(GR_DO_AUDIT, GR_REMOUNT_AUDIT_MSG, devname ? devname : "none");
-+#endif
-+ return;
-+}
-+
-+void
-+gr_log_unmount(const char *devname, const int retval)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
-+ if (grsec_enable_mount && (retval >= 0))
-+ gr_log_str(GR_DO_AUDIT, GR_UNMOUNT_AUDIT_MSG, devname ? devname : "none");
-+#endif
-+ return;
-+}
-+
-+void
-+gr_log_mount(const char *from, const char *to, const int retval)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
-+ if (grsec_enable_mount && (retval >= 0))
-+ gr_log_str_str(GR_DO_AUDIT, GR_MOUNT_AUDIT_MSG, from ? from : "none", to);
-+#endif
-+ return;
-+}
-+
-+int
-+gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags)
-+{
-+#ifdef CONFIG_GRKERNSEC_ROFS
-+ if (grsec_enable_rofs && !(mnt_flags & MNT_READONLY)) {
-+ gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_MOUNT_MSG, dentry, mnt);
-+ return -EPERM;
-+ } else
-+ return 0;
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode)
-+{
-+#ifdef CONFIG_GRKERNSEC_ROFS
-+ if (grsec_enable_rofs && (acc_mode & MAY_WRITE) &&
-+ dentry->d_inode && S_ISBLK(dentry->d_inode->i_mode)) {
-+ gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_BLOCKWRITE_MSG, dentry, mnt);
-+ return -EPERM;
-+ } else
-+ return 0;
-+#endif
-+ return 0;
-+}
-diff -urNp linux-2.6.32.45/grsecurity/grsec_pax.c linux-2.6.32.45/grsecurity/grsec_pax.c
---- linux-2.6.32.45/grsecurity/grsec_pax.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/grsecurity/grsec_pax.c 2011-04-17 15:56:46.000000000 -0400
-@@ -0,0 +1,36 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/mm.h>
-+#include <linux/file.h>
-+#include <linux/grinternal.h>
-+#include <linux/grsecurity.h>
-+
-+void
-+gr_log_textrel(struct vm_area_struct * vma)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
-+ if (grsec_enable_audit_textrel)
-+ gr_log_textrel_ulong_ulong(GR_DO_AUDIT, GR_TEXTREL_AUDIT_MSG, vma->vm_file, vma->vm_start, vma->vm_pgoff);
-+#endif
-+ return;
-+}
-+
-+void
-+gr_log_rwxmmap(struct file *file)
-+{
-+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
-+ if (grsec_enable_log_rwxmaps)
-+ gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMMAP_MSG, file);
-+#endif
-+ return;
-+}
-+
-+void
-+gr_log_rwxmprotect(struct file *file)
-+{
-+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
-+ if (grsec_enable_log_rwxmaps)
-+ gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMPROTECT_MSG, file);
-+#endif
-+ return;
-+}
-diff -urNp linux-2.6.32.45/grsecurity/grsec_ptrace.c linux-2.6.32.45/grsecurity/grsec_ptrace.c
---- linux-2.6.32.45/grsecurity/grsec_ptrace.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/grsecurity/grsec_ptrace.c 2011-04-17 15:56:46.000000000 -0400
-@@ -0,0 +1,14 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/grinternal.h>
-+#include <linux/grsecurity.h>
-+
-+void
-+gr_audit_ptrace(struct task_struct *task)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
-+ if (grsec_enable_audit_ptrace)
-+ gr_log_ptrace(GR_DO_AUDIT, GR_PTRACE_AUDIT_MSG, task);
-+#endif
-+ return;
-+}
-diff -urNp linux-2.6.32.45/grsecurity/grsec_sig.c linux-2.6.32.45/grsecurity/grsec_sig.c
---- linux-2.6.32.45/grsecurity/grsec_sig.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/grsecurity/grsec_sig.c 2011-06-29 19:40:31.000000000 -0400
-@@ -0,0 +1,205 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/delay.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+#include <linux/hardirq.h>
-+
-+char *signames[] = {
-+ [SIGSEGV] = "Segmentation fault",
-+ [SIGILL] = "Illegal instruction",
-+ [SIGABRT] = "Abort",
-+ [SIGBUS] = "Invalid alignment/Bus error"
-+};
-+
-+void
-+gr_log_signal(const int sig, const void *addr, const struct task_struct *t)
-+{
-+#ifdef CONFIG_GRKERNSEC_SIGNAL
-+ if (grsec_enable_signal && ((sig == SIGSEGV) || (sig == SIGILL) ||
-+ (sig == SIGABRT) || (sig == SIGBUS))) {
-+ if (t->pid == current->pid) {
-+ gr_log_sig_addr(GR_DONT_AUDIT_GOOD, GR_UNISIGLOG_MSG, signames[sig], addr);
-+ } else {
-+ gr_log_sig_task(GR_DONT_AUDIT_GOOD, GR_DUALSIGLOG_MSG, t, sig);
-+ }
-+ }
-+#endif
-+ return;
-+}
-+
-+int
-+gr_handle_signal(const struct task_struct *p, const int sig)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+ if (current->pid > 1 && gr_check_protected_task(p)) {
-+ gr_log_sig_task(GR_DONT_AUDIT, GR_SIG_ACL_MSG, p, sig);
-+ return -EPERM;
-+ } else if (gr_pid_is_chrooted((struct task_struct *)p)) {
-+ return -EPERM;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+#ifdef CONFIG_GRKERNSEC
-+extern int specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t);
-+
-+int gr_fake_force_sig(int sig, struct task_struct *t)
-+{
-+ unsigned long int flags;
-+ int ret, blocked, ignored;
-+ struct k_sigaction *action;
-+
-+ spin_lock_irqsave(&t->sighand->siglock, flags);
-+ action = &t->sighand->action[sig-1];
-+ ignored = action->sa.sa_handler == SIG_IGN;
-+ blocked = sigismember(&t->blocked, sig);
-+ if (blocked || ignored) {
-+ action->sa.sa_handler = SIG_DFL;
-+ if (blocked) {
-+ sigdelset(&t->blocked, sig);
-+ recalc_sigpending_and_wake(t);
-+ }
-+ }
-+ if (action->sa.sa_handler == SIG_DFL)
-+ t->signal->flags &= ~SIGNAL_UNKILLABLE;
-+ ret = specific_send_sig_info(sig, SEND_SIG_PRIV, t);
-+
-+ spin_unlock_irqrestore(&t->sighand->siglock, flags);
-+
-+ return ret;
-+}
-+#endif
-+
-+#ifdef CONFIG_GRKERNSEC_BRUTE
-+#define GR_USER_BAN_TIME (15 * 60)
-+
-+static int __get_dumpable(unsigned long mm_flags)
-+{
-+ int ret;
-+
-+ ret = mm_flags & MMF_DUMPABLE_MASK;
-+ return (ret >= 2) ? 2 : ret;
-+}
-+#endif
-+
-+void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags)
-+{
-+#ifdef CONFIG_GRKERNSEC_BRUTE
-+ uid_t uid = 0;
-+
-+ if (!grsec_enable_brute)
-+ return;
-+
-+ rcu_read_lock();
-+ read_lock(&tasklist_lock);
-+ read_lock(&grsec_exec_file_lock);
-+ if (p->real_parent && p->real_parent->exec_file == p->exec_file)
-+ p->real_parent->brute = 1;
-+ else {
-+ const struct cred *cred = __task_cred(p), *cred2;
-+ struct task_struct *tsk, *tsk2;
-+
-+ if (!__get_dumpable(mm_flags) && cred->uid) {
-+ struct user_struct *user;
-+
-+ uid = cred->uid;
-+
-+ /* this is put upon execution past expiration */
-+ user = find_user(uid);
-+ if (user == NULL)
-+ goto unlock;
-+ user->banned = 1;
-+ user->ban_expires = get_seconds() + GR_USER_BAN_TIME;
-+ if (user->ban_expires == ~0UL)
-+ user->ban_expires--;
-+
-+ do_each_thread(tsk2, tsk) {
-+ cred2 = __task_cred(tsk);
-+ if (tsk != p && cred2->uid == uid)
-+ gr_fake_force_sig(SIGKILL, tsk);
-+ } while_each_thread(tsk2, tsk);
-+ }
-+ }
-+unlock:
-+ read_unlock(&grsec_exec_file_lock);
-+ read_unlock(&tasklist_lock);
-+ rcu_read_unlock();
-+
-+ if (uid)
-+ printk(KERN_ALERT "grsec: bruteforce prevention initiated against uid %u, banning for %d minutes\n", uid, GR_USER_BAN_TIME / 60);
-+#endif
-+ return;
-+}
-+
-+void gr_handle_brute_check(void)
-+{
-+#ifdef CONFIG_GRKERNSEC_BRUTE
-+ if (current->brute)
-+ msleep(30 * 1000);
-+#endif
-+ return;
-+}
-+
-+void gr_handle_kernel_exploit(void)
-+{
-+#ifdef CONFIG_GRKERNSEC_KERN_LOCKOUT
-+ const struct cred *cred;
-+ struct task_struct *tsk, *tsk2;
-+ struct user_struct *user;
-+ uid_t uid;
-+
-+ if (in_irq() || in_serving_softirq() || in_nmi())
-+ panic("grsec: halting the system due to suspicious kernel crash caused in interrupt context");
-+
-+ uid = current_uid();
-+
-+ if (uid == 0)
-+ panic("grsec: halting the system due to suspicious kernel crash caused by root");
-+ else {
-+ /* kill all the processes of this user, hold a reference
-+ to their creds struct, and prevent them from creating
-+ another process until system reset
-+ */
-+ printk(KERN_ALERT "grsec: banning user with uid %u until system restart for suspicious kernel crash\n", uid);
-+ /* we intentionally leak this ref */
-+ user = get_uid(current->cred->user);
-+ if (user) {
-+ user->banned = 1;
-+ user->ban_expires = ~0UL;
-+ }
-+
-+ read_lock(&tasklist_lock);
-+ do_each_thread(tsk2, tsk) {
-+ cred = __task_cred(tsk);
-+ if (cred->uid == uid)
-+ gr_fake_force_sig(SIGKILL, tsk);
-+ } while_each_thread(tsk2, tsk);
-+ read_unlock(&tasklist_lock);
-+ }
-+#endif
-+}
-+
-+int __gr_process_user_ban(struct user_struct *user)
-+{
-+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
-+ if (unlikely(user->banned)) {
-+ if (user->ban_expires != ~0UL && time_after_eq(get_seconds(), user->ban_expires)) {
-+ user->banned = 0;
-+ user->ban_expires = 0;
-+ free_uid(user);
-+ } else
-+ return -EPERM;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+int gr_process_user_ban(void)
-+{
-+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
-+ return __gr_process_user_ban(current->cred->user);
-+#endif
-+ return 0;
-+}
-diff -urNp linux-2.6.32.45/grsecurity/grsec_sock.c linux-2.6.32.45/grsecurity/grsec_sock.c
---- linux-2.6.32.45/grsecurity/grsec_sock.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/grsecurity/grsec_sock.c 2011-04-17 15:56:46.000000000 -0400
-@@ -0,0 +1,275 @@
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/net.h>
-+#include <linux/in.h>
-+#include <linux/ip.h>
-+#include <net/sock.h>
-+#include <net/inet_sock.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+#include <linux/gracl.h>
-+
-+kernel_cap_t gr_cap_rtnetlink(struct sock *sock);
-+EXPORT_SYMBOL(gr_cap_rtnetlink);
-+
-+extern int gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb);
-+extern int gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr);
-+
-+EXPORT_SYMBOL(gr_search_udp_recvmsg);
-+EXPORT_SYMBOL(gr_search_udp_sendmsg);
-+
-+#ifdef CONFIG_UNIX_MODULE
-+EXPORT_SYMBOL(gr_acl_handle_unix);
-+EXPORT_SYMBOL(gr_acl_handle_mknod);
-+EXPORT_SYMBOL(gr_handle_chroot_unix);
-+EXPORT_SYMBOL(gr_handle_create);
-+#endif
-+
-+#ifdef CONFIG_GRKERNSEC
-+#define gr_conn_table_size 32749
-+struct conn_table_entry {
-+ struct conn_table_entry *next;
-+ struct signal_struct *sig;
-+};
-+
-+struct conn_table_entry *gr_conn_table[gr_conn_table_size];
-+DEFINE_SPINLOCK(gr_conn_table_lock);
-+
-+extern const char * gr_socktype_to_name(unsigned char type);
-+extern const char * gr_proto_to_name(unsigned char proto);
-+extern const char * gr_sockfamily_to_name(unsigned char family);
-+
-+static __inline__ int
-+conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
-+{
-+ return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
-+}
-+
-+static __inline__ int
-+conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr,
-+ __u16 sport, __u16 dport)
-+{
-+ if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
-+ sig->gr_sport == sport && sig->gr_dport == dport))
-+ return 1;
-+ else
-+ return 0;
-+}
-+
-+static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
-+{
-+ struct conn_table_entry **match;
-+ unsigned int index;
-+
-+ index = conn_hash(sig->gr_saddr, sig->gr_daddr,
-+ sig->gr_sport, sig->gr_dport,
-+ gr_conn_table_size);
-+
-+ newent->sig = sig;
-+
-+ match = &gr_conn_table[index];
-+ newent->next = *match;
-+ *match = newent;
-+
-+ return;
-+}
-+
-+static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
-+{
-+ struct conn_table_entry *match, *last = NULL;
-+ unsigned int index;
-+
-+ index = conn_hash(sig->gr_saddr, sig->gr_daddr,
-+ sig->gr_sport, sig->gr_dport,
-+ gr_conn_table_size);
-+
-+ match = gr_conn_table[index];
-+ while (match && !conn_match(match->sig,
-+ sig->gr_saddr, sig->gr_daddr, sig->gr_sport,
-+ sig->gr_dport)) {
-+ last = match;
-+ match = match->next;
-+ }
-+
-+ if (match) {
-+ if (last)
-+ last->next = match->next;
-+ else
-+ gr_conn_table[index] = NULL;
-+ kfree(match);
-+ }
-+
-+ return;
-+}
-+
-+static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
-+ __u16 sport, __u16 dport)
-+{
-+ struct conn_table_entry *match;
-+ unsigned int index;
-+
-+ index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
-+
-+ match = gr_conn_table[index];
-+ while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
-+ match = match->next;
-+
-+ if (match)
-+ return match->sig;
-+ else
-+ return NULL;
-+}
-+
-+#endif
-+
-+void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+ struct signal_struct *sig = task->signal;
-+ struct conn_table_entry *newent;
-+
-+ newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
-+ if (newent == NULL)
-+ return;
-+ /* no bh lock needed since we are called with bh disabled */
-+ spin_lock(&gr_conn_table_lock);
-+ gr_del_task_from_ip_table_nolock(sig);
-+ sig->gr_saddr = inet->rcv_saddr;
-+ sig->gr_daddr = inet->daddr;
-+ sig->gr_sport = inet->sport;
-+ sig->gr_dport = inet->dport;
-+ gr_add_to_task_ip_table_nolock(sig, newent);
-+ spin_unlock(&gr_conn_table_lock);
-+#endif
-+ return;
-+}
-+
-+void gr_del_task_from_ip_table(struct task_struct *task)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+ spin_lock_bh(&gr_conn_table_lock);
-+ gr_del_task_from_ip_table_nolock(task->signal);
-+ spin_unlock_bh(&gr_conn_table_lock);
-+#endif
-+ return;
-+}
-+
-+void
-+gr_attach_curr_ip(const struct sock *sk)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+ struct signal_struct *p, *set;
-+ const struct inet_sock *inet = inet_sk(sk);
-+
-+ if (unlikely(sk->sk_protocol != IPPROTO_TCP))
-+ return;
-+
-+ set = current->signal;
-+
-+ spin_lock_bh(&gr_conn_table_lock);
-+ p = gr_lookup_task_ip_table(inet->daddr, inet->rcv_saddr,
-+ inet->dport, inet->sport);
-+ if (unlikely(p != NULL)) {
-+ set->curr_ip = p->curr_ip;
-+ set->used_accept = 1;
-+ gr_del_task_from_ip_table_nolock(p);
-+ spin_unlock_bh(&gr_conn_table_lock);
-+ return;
-+ }
-+ spin_unlock_bh(&gr_conn_table_lock);
-+
-+ set->curr_ip = inet->daddr;
-+ set->used_accept = 1;
-+#endif
-+ return;
-+}
-+
-+int
-+gr_handle_sock_all(const int family, const int type, const int protocol)
-+{
-+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
-+ if (grsec_enable_socket_all && in_group_p(grsec_socket_all_gid) &&
-+ (family != AF_UNIX)) {
-+ if (family == AF_INET)
-+ gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), gr_proto_to_name(protocol));
-+ else
-+ gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), protocol);
-+ return -EACCES;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_handle_sock_server(const struct sockaddr *sck)
-+{
-+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
-+ if (grsec_enable_socket_server &&
-+ in_group_p(grsec_socket_server_gid) &&
-+ sck && (sck->sa_family != AF_UNIX) &&
-+ (sck->sa_family != AF_LOCAL)) {
-+ gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
-+ return -EACCES;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_handle_sock_server_other(const struct sock *sck)
-+{
-+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
-+ if (grsec_enable_socket_server &&
-+ in_group_p(grsec_socket_server_gid) &&
-+ sck && (sck->sk_family != AF_UNIX) &&
-+ (sck->sk_family != AF_LOCAL)) {
-+ gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
-+ return -EACCES;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+int
-+gr_handle_sock_client(const struct sockaddr *sck)
-+{
-+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
-+ if (grsec_enable_socket_client && in_group_p(grsec_socket_client_gid) &&
-+ sck && (sck->sa_family != AF_UNIX) &&
-+ (sck->sa_family != AF_LOCAL)) {
-+ gr_log_noargs(GR_DONT_AUDIT, GR_CONNECT_MSG);
-+ return -EACCES;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+kernel_cap_t
-+gr_cap_rtnetlink(struct sock *sock)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+ if (!gr_acl_is_enabled())
-+ return current_cap();
-+ else if (sock->sk_protocol == NETLINK_ISCSI &&
-+ cap_raised(current_cap(), CAP_SYS_ADMIN) &&
-+ gr_is_capable(CAP_SYS_ADMIN))
-+ return current_cap();
-+ else if (sock->sk_protocol == NETLINK_AUDIT &&
-+ cap_raised(current_cap(), CAP_AUDIT_WRITE) &&
-+ gr_is_capable(CAP_AUDIT_WRITE) &&
-+ cap_raised(current_cap(), CAP_AUDIT_CONTROL) &&
-+ gr_is_capable(CAP_AUDIT_CONTROL))
-+ return current_cap();
-+ else if (cap_raised(current_cap(), CAP_NET_ADMIN) &&
-+ ((sock->sk_protocol == NETLINK_ROUTE) ?
-+ gr_is_capable_nolog(CAP_NET_ADMIN) :
-+ gr_is_capable(CAP_NET_ADMIN)))
-+ return current_cap();
-+ else
-+ return __cap_empty_set;
-+#else
-+ return current_cap();
-+#endif
-+}
-diff -urNp linux-2.6.32.45/grsecurity/grsec_sysctl.c linux-2.6.32.45/grsecurity/grsec_sysctl.c
---- linux-2.6.32.45/grsecurity/grsec_sysctl.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/grsecurity/grsec_sysctl.c 2011-08-11 19:57:54.000000000 -0400
-@@ -0,0 +1,479 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/sysctl.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+int
-+gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
-+{
-+#ifdef CONFIG_GRKERNSEC_SYSCTL
-+ if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & MAY_WRITE)) {
-+ gr_log_str(GR_DONT_AUDIT, GR_SYSCTL_MSG, name);
-+ return -EACCES;
-+ }
-+#endif
-+ return 0;
-+}
-+
-+#ifdef CONFIG_GRKERNSEC_ROFS
-+static int __maybe_unused one = 1;
-+#endif
-+
-+#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
-+ctl_table grsecurity_table[] = {
-+#ifdef CONFIG_GRKERNSEC_SYSCTL
-+#ifdef CONFIG_GRKERNSEC_SYSCTL_DISTRO
-+#ifdef CONFIG_GRKERNSEC_IO
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "disable_priv_io",
-+ .data = &grsec_disable_privio,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#endif
-+#ifdef CONFIG_GRKERNSEC_LINK
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "linking_restrictions",
-+ .data = &grsec_enable_link,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_BRUTE
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "deter_bruteforce",
-+ .data = &grsec_enable_brute,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_FIFO
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "fifo_restrictions",
-+ .data = &grsec_enable_fifo,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "ip_blackhole",
-+ .data = &grsec_enable_blackhole,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "lastack_retries",
-+ .data = &grsec_lastack_retries,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_EXECLOG
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "exec_logging",
-+ .data = &grsec_enable_execlog,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "rwxmap_logging",
-+ .data = &grsec_enable_log_rwxmaps,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SIGNAL
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "signal_logging",
-+ .data = &grsec_enable_signal,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_FORKFAIL
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "forkfail_logging",
-+ .data = &grsec_enable_forkfail,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_TIME
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "timechange_logging",
-+ .data = &grsec_enable_time,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_deny_shmat",
-+ .data = &grsec_enable_chroot_shmat,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_deny_unix",
-+ .data = &grsec_enable_chroot_unix,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_deny_mount",
-+ .data = &grsec_enable_chroot_mount,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_deny_fchdir",
-+ .data = &grsec_enable_chroot_fchdir,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_deny_chroot",
-+ .data = &grsec_enable_chroot_double,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_deny_pivot",
-+ .data = &grsec_enable_chroot_pivot,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_enforce_chdir",
-+ .data = &grsec_enable_chroot_chdir,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_deny_chmod",
-+ .data = &grsec_enable_chroot_chmod,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_deny_mknod",
-+ .data = &grsec_enable_chroot_mknod,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_restrict_nice",
-+ .data = &grsec_enable_chroot_nice,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_execlog",
-+ .data = &grsec_enable_chroot_execlog,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_caps",
-+ .data = &grsec_enable_chroot_caps,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_deny_sysctl",
-+ .data = &grsec_enable_chroot_sysctl,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_TPE
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "tpe",
-+ .data = &grsec_enable_tpe,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "tpe_gid",
-+ .data = &grsec_tpe_gid,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "tpe_invert",
-+ .data = &grsec_enable_tpe_invert,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_TPE_ALL
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "tpe_restrict_all",
-+ .data = &grsec_enable_tpe_all,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "socket_all",
-+ .data = &grsec_enable_socket_all,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "socket_all_gid",
-+ .data = &grsec_socket_all_gid,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "socket_client",
-+ .data = &grsec_enable_socket_client,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "socket_client_gid",
-+ .data = &grsec_socket_client_gid,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "socket_server",
-+ .data = &grsec_enable_socket_server,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "socket_server_gid",
-+ .data = &grsec_socket_server_gid,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "audit_group",
-+ .data = &grsec_enable_group,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "audit_gid",
-+ .data = &grsec_audit_gid,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "audit_chdir",
-+ .data = &grsec_enable_chdir,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "audit_mount",
-+ .data = &grsec_enable_mount,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "audit_textrel",
-+ .data = &grsec_enable_audit_textrel,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_DMESG
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "dmesg",
-+ .data = &grsec_enable_dmesg,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "chroot_findtask",
-+ .data = &grsec_enable_chroot_findtask,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_RESLOG
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "resource_logging",
-+ .data = &grsec_resource_logging,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "audit_ptrace",
-+ .data = &grsec_enable_audit_ptrace,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "harden_ptrace",
-+ .data = &grsec_enable_harden_ptrace,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "grsec_lock",
-+ .data = &grsec_lock,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
-+#ifdef CONFIG_GRKERNSEC_ROFS
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "romount_protect",
-+ .data = &grsec_enable_rofs,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec_minmax,
-+ .extra1 = &one,
-+ .extra2 = &one,
-+ },
-+#endif
-+ { .ctl_name = 0 }
-+};
-+#endif
-diff -urNp linux-2.6.32.45/grsecurity/grsec_time.c linux-2.6.32.45/grsecurity/grsec_time.c
---- linux-2.6.32.45/grsecurity/grsec_time.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/grsecurity/grsec_time.c 2011-04-17 15:56:46.000000000 -0400
-@@ -0,0 +1,16 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/grinternal.h>
-+#include <linux/module.h>
-+
-+void
-+gr_log_timechange(void)
-+{
-+#ifdef CONFIG_GRKERNSEC_TIME
-+ if (grsec_enable_time)
-+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_TIME_MSG);
-+#endif
-+ return;
-+}
-+
-+EXPORT_SYMBOL(gr_log_timechange);
-diff -urNp linux-2.6.32.45/grsecurity/grsec_tpe.c linux-2.6.32.45/grsecurity/grsec_tpe.c
---- linux-2.6.32.45/grsecurity/grsec_tpe.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/grsecurity/grsec_tpe.c 2011-04-17 15:56:46.000000000 -0400
-@@ -0,0 +1,39 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/grinternal.h>
-+
-+extern int gr_acl_tpe_check(void);
-+
-+int
-+gr_tpe_allow(const struct file *file)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+ struct inode *inode = file->f_path.dentry->d_parent->d_inode;
-+ const struct cred *cred = current_cred();
-+
-+ if (cred->uid && ((grsec_enable_tpe &&
-+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
-+ ((grsec_enable_tpe_invert && !in_group_p(grsec_tpe_gid)) ||
-+ (!grsec_enable_tpe_invert && in_group_p(grsec_tpe_gid)))
-+#else
-+ in_group_p(grsec_tpe_gid)
-+#endif
-+ ) || gr_acl_tpe_check()) &&
-+ (inode->i_uid || (!inode->i_uid && ((inode->i_mode & S_IWGRP) ||
-+ (inode->i_mode & S_IWOTH))))) {
-+ gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
-+ return 0;
-+ }
-+#ifdef CONFIG_GRKERNSEC_TPE_ALL
-+ if (cred->uid && grsec_enable_tpe && grsec_enable_tpe_all &&
-+ ((inode->i_uid && (inode->i_uid != cred->uid)) ||
-+ (inode->i_mode & S_IWGRP) || (inode->i_mode & S_IWOTH))) {
-+ gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
-+ return 0;
-+ }
-+#endif
-+#endif
-+ return 1;
-+}
-diff -urNp linux-2.6.32.45/grsecurity/grsum.c linux-2.6.32.45/grsecurity/grsum.c
---- linux-2.6.32.45/grsecurity/grsum.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/grsecurity/grsum.c 2011-04-17 15:56:46.000000000 -0400
-@@ -0,0 +1,61 @@
-+#include <linux/err.h>
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/mm.h>
-+#include <linux/scatterlist.h>
-+#include <linux/crypto.h>
-+#include <linux/gracl.h>
-+
-+
-+#if !defined(CONFIG_CRYPTO) || defined(CONFIG_CRYPTO_MODULE) || !defined(CONFIG_CRYPTO_SHA256) || defined(CONFIG_CRYPTO_SHA256_MODULE)
-+#error "crypto and sha256 must be built into the kernel"
-+#endif
-+
-+int
-+chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum)
-+{
-+ char *p;
-+ struct crypto_hash *tfm;
-+ struct hash_desc desc;
-+ struct scatterlist sg;
-+ unsigned char temp_sum[GR_SHA_LEN];
-+ volatile int retval = 0;
-+ volatile int dummy = 0;
-+ unsigned int i;
-+
-+ sg_init_table(&sg, 1);
-+
-+ tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
-+ if (IS_ERR(tfm)) {
-+ /* should never happen, since sha256 should be built in */
-+ return 1;
-+ }
-+
-+ desc.tfm = tfm;
-+ desc.flags = 0;
-+
-+ crypto_hash_init(&desc);
-+
-+ p = salt;
-+ sg_set_buf(&sg, p, GR_SALT_LEN);
-+ crypto_hash_update(&desc, &sg, sg.length);
-+
-+ p = entry->pw;
-+ sg_set_buf(&sg, p, strlen(p));
-+
-+ crypto_hash_update(&desc, &sg, sg.length);
-+
-+ crypto_hash_final(&desc, temp_sum);
-+
-+ memset(entry->pw, 0, GR_PW_LEN);
-+
-+ for (i = 0; i < GR_SHA_LEN; i++)
-+ if (sum[i] != temp_sum[i])
-+ retval = 1;
-+ else
-+ dummy = 1; // waste a cycle
-+
-+ crypto_free_hash(tfm);
-+
-+ return retval;
-+}
-diff -urNp linux-2.6.32.45/grsecurity/Kconfig linux-2.6.32.45/grsecurity/Kconfig
---- linux-2.6.32.45/grsecurity/Kconfig 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/grsecurity/Kconfig 2011-08-17 19:04:25.000000000 -0400
-@@ -0,0 +1,1037 @@
-+#
-+# grecurity configuration
-+#
-+
-+menu "Grsecurity"
-+
-+config GRKERNSEC
-+ bool "Grsecurity"
-+ select CRYPTO
-+ select CRYPTO_SHA256
-+ help
-+ If you say Y here, you will be able to configure many features
-+ that will enhance the security of your system. It is highly
-+ recommended that you say Y here and read through the help
-+ for each option so that you fully understand the features and
-+ can evaluate their usefulness for your machine.
-+
-+choice
-+ prompt "Security Level"
-+ depends on GRKERNSEC
-+ default GRKERNSEC_CUSTOM
-+
-+config GRKERNSEC_LOW
-+ bool "Low"
-+ select GRKERNSEC_LINK
-+ select GRKERNSEC_FIFO
-+ select GRKERNSEC_RANDNET
-+ select GRKERNSEC_DMESG
-+ select GRKERNSEC_CHROOT
-+ select GRKERNSEC_CHROOT_CHDIR
-+
-+ help
-+ If you choose this option, several of the grsecurity options will
-+ be enabled that will give you greater protection against a number
-+ of attacks, while assuring that none of your software will have any
-+ conflicts with the additional security measures. If you run a lot
-+ of unusual software, or you are having problems with the higher
-+ security levels, you should say Y here. With this option, the
-+ following features are enabled:
-+
-+ - Linking restrictions
-+ - FIFO restrictions
-+ - Restricted dmesg
-+ - Enforced chdir("/") on chroot
-+ - Runtime module disabling
-+
-+config GRKERNSEC_MEDIUM
-+ bool "Medium"
-+ select PAX
-+ select PAX_EI_PAX
-+ select PAX_PT_PAX_FLAGS
-+ select PAX_HAVE_ACL_FLAGS
-+ select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
-+ select GRKERNSEC_CHROOT
-+ select GRKERNSEC_CHROOT_SYSCTL
-+ select GRKERNSEC_LINK
-+ select GRKERNSEC_FIFO
-+ select GRKERNSEC_DMESG
-+ select GRKERNSEC_RANDNET
-+ select GRKERNSEC_FORKFAIL
-+ select GRKERNSEC_TIME
-+ select GRKERNSEC_SIGNAL
-+ select GRKERNSEC_CHROOT
-+ select GRKERNSEC_CHROOT_UNIX
-+ select GRKERNSEC_CHROOT_MOUNT
-+ select GRKERNSEC_CHROOT_PIVOT
-+ select GRKERNSEC_CHROOT_DOUBLE
-+ select GRKERNSEC_CHROOT_CHDIR
-+ select GRKERNSEC_CHROOT_MKNOD
-+ select GRKERNSEC_PROC
-+ select GRKERNSEC_PROC_USERGROUP
-+ select PAX_RANDUSTACK
-+ select PAX_ASLR
-+ select PAX_RANDMMAP
-+ select PAX_REFCOUNT if (X86 || SPARC64)
-+ select PAX_USERCOPY if ((X86 || SPARC || PPC || ARM) && (SLAB || SLUB || SLOB))
-+
-+ help
-+ If you say Y here, several features in addition to those included
-+ in the low additional security level will be enabled. These
-+ features provide even more security to your system, though in rare
-+ cases they may be incompatible with very old or poorly written
-+ software. If you enable this option, make sure that your auth
-+ service (identd) is running as gid 1001. With this option,
-+ the following features (in addition to those provided in the
-+ low additional security level) will be enabled:
-+
-+ - Failed fork logging
-+ - Time change logging
-+ - Signal logging
-+ - Deny mounts in chroot
-+ - Deny double chrooting
-+ - Deny sysctl writes in chroot
-+ - Deny mknod in chroot
-+ - Deny access to abstract AF_UNIX sockets out of chroot
-+ - Deny pivot_root in chroot
-+ - Denied writes of /dev/kmem, /dev/mem, and /dev/port
-+ - /proc restrictions with special GID set to 10 (usually wheel)
-+ - Address Space Layout Randomization (ASLR)
-+ - Prevent exploitation of most refcount overflows
-+ - Bounds checking of copying between the kernel and userland
-+
-+config GRKERNSEC_HIGH
-+ bool "High"
-+ select GRKERNSEC_LINK
-+ select GRKERNSEC_FIFO
-+ select GRKERNSEC_DMESG
-+ select GRKERNSEC_FORKFAIL
-+ select GRKERNSEC_TIME
-+ select GRKERNSEC_SIGNAL
-+ select GRKERNSEC_CHROOT
-+ select GRKERNSEC_CHROOT_SHMAT
-+ select GRKERNSEC_CHROOT_UNIX
-+ select GRKERNSEC_CHROOT_MOUNT
-+ select GRKERNSEC_CHROOT_FCHDIR
-+ select GRKERNSEC_CHROOT_PIVOT
-+ select GRKERNSEC_CHROOT_DOUBLE
-+ select GRKERNSEC_CHROOT_CHDIR
-+ select GRKERNSEC_CHROOT_MKNOD
-+ select GRKERNSEC_CHROOT_CAPS
-+ select GRKERNSEC_CHROOT_SYSCTL
-+ select GRKERNSEC_CHROOT_FINDTASK
-+ select GRKERNSEC_SYSFS_RESTRICT
-+ select GRKERNSEC_PROC
-+ select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
-+ select GRKERNSEC_HIDESYM
-+ select GRKERNSEC_BRUTE
-+ select GRKERNSEC_PROC_USERGROUP
-+ select GRKERNSEC_KMEM
-+ select GRKERNSEC_RESLOG
-+ select GRKERNSEC_RANDNET
-+ select GRKERNSEC_PROC_ADD
-+ select GRKERNSEC_CHROOT_CHMOD
-+ select GRKERNSEC_CHROOT_NICE
-+ select GRKERNSEC_AUDIT_MOUNT
-+ select GRKERNSEC_MODHARDEN if (MODULES)
-+ select GRKERNSEC_HARDEN_PTRACE
-+ select GRKERNSEC_VM86 if (X86_32)
-+ select GRKERNSEC_KERN_LOCKOUT if (X86 || ARM || PPC || SPARC)
-+ select PAX
-+ select PAX_RANDUSTACK
-+ select PAX_ASLR
-+ select PAX_RANDMMAP
-+ select PAX_NOEXEC
-+ select PAX_MPROTECT
-+ select PAX_EI_PAX
-+ select PAX_PT_PAX_FLAGS
-+ select PAX_HAVE_ACL_FLAGS
-+ select PAX_KERNEXEC if ((PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN)
-+ select PAX_MEMORY_UDEREF if (X86 && !XEN)
-+ select PAX_RANDKSTACK if (X86_TSC && X86)
-+ select PAX_SEGMEXEC if (X86_32)
-+ select PAX_PAGEEXEC
-+ select PAX_EMUPLT if (ALPHA || PARISC || SPARC)
-+ select PAX_EMUTRAMP if (PARISC)
-+ select PAX_EMUSIGRT if (PARISC)
-+ select PAX_ETEXECRELOCS if (ALPHA || IA64 || PARISC)
-+ select PAX_ELFRELOCS if (PAX_ETEXECRELOCS || (IA64 || PPC || X86))
-+ select PAX_REFCOUNT if (X86 || SPARC64)
-+ select PAX_USERCOPY if ((X86 || SPARC || PPC || ARM) && (SLAB || SLUB || SLOB))
-+ help
-+ If you say Y here, many of the features of grsecurity will be
-+ enabled, which will protect you against many kinds of attacks
-+ against your system. The heightened security comes at a cost
-+ of an increased chance of incompatibilities with rare software
-+ on your machine. Since this security level enables PaX, you should
-+ view <http://pax.grsecurity.net> and read about the PaX
-+ project. While you are there, download chpax and run it on
-+ binaries that cause problems with PaX. Also remember that
-+ since the /proc restrictions are enabled, you must run your
-+ identd as gid 1001. This security level enables the following
-+ features in addition to those listed in the low and medium
-+ security levels:
-+
-+ - Additional /proc restrictions
-+ - Chmod restrictions in chroot
-+ - No signals, ptrace, or viewing of processes outside of chroot
-+ - Capability restrictions in chroot
-+ - Deny fchdir out of chroot
-+ - Priority restrictions in chroot
-+ - Segmentation-based implementation of PaX
-+ - Mprotect restrictions
-+ - Removal of addresses from /proc/<pid>/[smaps|maps|stat]
-+ - Kernel stack randomization
-+ - Mount/unmount/remount logging
-+ - Kernel symbol hiding
-+ - Prevention of memory exhaustion-based exploits
-+ - Hardening of module auto-loading
-+ - Ptrace restrictions
-+ - Restricted vm86 mode
-+ - Restricted sysfs/debugfs
-+ - Active kernel exploit response
-+
-+config GRKERNSEC_CUSTOM
-+ bool "Custom"
-+ help
-+ If you say Y here, you will be able to configure every grsecurity
-+ option, which allows you to enable many more features that aren't
-+ covered in the basic security levels. These additional features
-+ include TPE, socket restrictions, and the sysctl system for
-+ grsecurity. It is advised that you read through the help for
-+ each option to determine its usefulness in your situation.
-+
-+endchoice
-+
-+menu "Address Space Protection"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_KMEM
-+ bool "Deny writing to /dev/kmem, /dev/mem, and /dev/port"
-+ select STRICT_DEVMEM if (X86 || ARM || TILE || S390)
-+ help
-+ If you say Y here, /dev/kmem and /dev/mem won't be allowed to
-+ be written to via mmap or otherwise to modify the running kernel.
-+ /dev/port will also not be allowed to be opened. If you have module
-+ support disabled, enabling this will close up four ways that are
-+ currently used to insert malicious code into the running kernel.
-+ Even with all these features enabled, we still highly recommend that
-+ you use the RBAC system, as it is still possible for an attacker to
-+ modify the running kernel through privileged I/O granted by ioperm/iopl.
-+ If you are not using XFree86, you may be able to stop this additional
-+ case by enabling the 'Disable privileged I/O' option. Though nothing
-+ legitimately writes to /dev/kmem, XFree86 does need to write to /dev/mem,
-+ but only to video memory, which is the only writing we allow in this
-+ case. If /dev/kmem or /dev/mem are mmaped without PROT_WRITE, they will
-+ not be allowed to mprotect it with PROT_WRITE later.
-+ It is highly recommended that you say Y here if you meet all the
-+ conditions above.
-+
-+config GRKERNSEC_VM86
-+ bool "Restrict VM86 mode"
-+ depends on X86_32
-+
-+ help
-+ If you say Y here, only processes with CAP_SYS_RAWIO will be able to
-+ make use of a special execution mode on 32bit x86 processors called
-+ Virtual 8086 (VM86) mode. XFree86 may need vm86 mode for certain
-+ video cards and will still work with this option enabled. The purpose
-+ of the option is to prevent exploitation of emulation errors in
-+ virtualization of vm86 mode like the one discovered in VMWare in 2009.
-+ Nearly all users should be able to enable this option.
-+
-+config GRKERNSEC_IO
-+ bool "Disable privileged I/O"
-+ depends on X86
-+ select RTC_CLASS
-+ select RTC_INTF_DEV
-+ select RTC_DRV_CMOS
-+
-+ help
-+ If you say Y here, all ioperm and iopl calls will return an error.
-+ Ioperm and iopl can be used to modify the running kernel.
-+ Unfortunately, some programs need this access to operate properly,
-+ the most notable of which are XFree86 and hwclock. hwclock can be
-+ remedied by having RTC support in the kernel, so real-time
-+ clock support is enabled if this option is enabled, to ensure
-+ that hwclock operates correctly. XFree86 still will not
-+ operate correctly with this option enabled, so DO NOT CHOOSE Y
-+ IF YOU USE XFree86. If you use XFree86 and you still want to
-+ protect your kernel against modification, use the RBAC system.
-+
-+config GRKERNSEC_PROC_MEMMAP
-+ bool "Remove addresses from /proc/<pid>/[smaps|maps|stat]"
-+ default y if (PAX_NOEXEC || PAX_ASLR)
-+ depends on PAX_NOEXEC || PAX_ASLR
-+ help
-+ If you say Y here, the /proc/<pid>/maps and /proc/<pid>/stat files will
-+ give no information about the addresses of its mappings if
-+ PaX features that rely on random addresses are enabled on the task.
-+ If you use PaX it is greatly recommended that you say Y here as it
-+ closes up a hole that makes the full ASLR useless for suid
-+ binaries.
-+
-+config GRKERNSEC_BRUTE
-+ bool "Deter exploit bruteforcing"
-+ help
-+ If you say Y here, attempts to bruteforce exploits against forking
-+ daemons such as apache or sshd, as well as against suid/sgid binaries
-+ will be deterred. When a child of a forking daemon is killed by PaX
-+ or crashes due to an illegal instruction or other suspicious signal,
-+ the parent process will be delayed 30 seconds upon every subsequent
-+ fork until the administrator is able to assess the situation and
-+ restart the daemon.
-+ In the suid/sgid case, the attempt is logged, the user has all their
-+ processes terminated, and they are prevented from executing any further
-+ processes for 15 minutes.
-+ It is recommended that you also enable signal logging in the auditing
-+ section so that logs are generated when a process triggers a suspicious
-+ signal.
-+ If the sysctl option is enabled, a sysctl option with name
-+ "deter_bruteforce" is created.
-+
-+config GRKERNSEC_MODHARDEN
-+ bool "Harden module auto-loading"
-+ depends on MODULES
-+ help
-+ If you say Y here, module auto-loading in response to use of some
-+ feature implemented by an unloaded module will be restricted to
-+ root users. Enabling this option helps defend against attacks
-+ by unprivileged users who abuse the auto-loading behavior to
-+ cause a vulnerable module to load that is then exploited.
-+
-+ If this option prevents a legitimate use of auto-loading for a
-+ non-root user, the administrator can execute modprobe manually
-+ with the exact name of the module mentioned in the alert log.
-+ Alternatively, the administrator can add the module to the list
-+ of modules loaded at boot by modifying init scripts.
-+
-+ Modification of init scripts will most likely be needed on
-+ Ubuntu servers with encrypted home directory support enabled,
-+ as the first non-root user logging in will cause the ecb(aes),
-+ ecb(aes)-all, cbc(aes), and cbc(aes)-all modules to be loaded.
-+
-+config GRKERNSEC_HIDESYM
-+ bool "Hide kernel symbols"
-+ help
-+ If you say Y here, getting information on loaded modules, and
-+ displaying all kernel symbols through a syscall will be restricted
-+ to users with CAP_SYS_MODULE. For software compatibility reasons,
-+ /proc/kallsyms will be restricted to the root user. The RBAC
-+ system can hide that entry even from root.
-+
-+ This option also prevents leaking of kernel addresses through
-+ several /proc entries.
-+
-+ Note that this option is only effective provided the following
-+ conditions are met:
-+ 1) The kernel using grsecurity is not precompiled by some distribution
-+ 2) You have also enabled GRKERNSEC_DMESG
-+ 3) You are using the RBAC system and hiding other files such as your
-+ kernel image and System.map. Alternatively, enabling this option
-+ causes the permissions on /boot, /lib/modules, and the kernel
-+ source directory to change at compile time to prevent
-+ reading by non-root users.
-+ If the above conditions are met, this option will aid in providing a
-+ useful protection against local kernel exploitation of overflows
-+ and arbitrary read/write vulnerabilities.
-+
-+config GRKERNSEC_KERN_LOCKOUT
-+ bool "Active kernel exploit response"
-+ depends on X86 || ARM || PPC || SPARC
-+ help
-+ If you say Y here, when a PaX alert is triggered due to suspicious
-+ activity in the kernel (from KERNEXEC/UDEREF/USERCOPY)
-+ or an OOPs occurs due to bad memory accesses, instead of just
-+ terminating the offending process (and potentially allowing
-+ a subsequent exploit from the same user), we will take one of two
-+ actions:
-+ If the user was root, we will panic the system
-+ If the user was non-root, we will log the attempt, terminate
-+ all processes owned by the user, then prevent them from creating
-+ any new processes until the system is restarted
-+ This deters repeated kernel exploitation/bruteforcing attempts
-+ and is useful for later forensics.
-+
-+endmenu
-+menu "Role Based Access Control Options"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_RBAC_DEBUG
-+ bool
-+
-+config GRKERNSEC_NO_RBAC
-+ bool "Disable RBAC system"
-+ help
-+ If you say Y here, the /dev/grsec device will be removed from the kernel,
-+ preventing the RBAC system from being enabled. You should only say Y
-+ here if you have no intention of using the RBAC system, so as to prevent
-+ an attacker with root access from misusing the RBAC system to hide files
-+ and processes when loadable module support and /dev/[k]mem have been
-+ locked down.
-+
-+config GRKERNSEC_ACL_HIDEKERN
-+ bool "Hide kernel processes"
-+ help
-+ If you say Y here, all kernel threads will be hidden to all
-+ processes but those whose subject has the "view hidden processes"
-+ flag.
-+
-+config GRKERNSEC_ACL_MAXTRIES
-+ int "Maximum tries before password lockout"
-+ default 3
-+ help
-+ This option enforces the maximum number of times a user can attempt
-+ to authorize themselves with the grsecurity RBAC system before being
-+ denied the ability to attempt authorization again for a specified time.
-+ The lower the number, the harder it will be to brute-force a password.
-+
-+config GRKERNSEC_ACL_TIMEOUT
-+ int "Time to wait after max password tries, in seconds"
-+ default 30
-+ help
-+ This option specifies the time the user must wait after attempting to
-+ authorize to the RBAC system with the maximum number of invalid
-+ passwords. The higher the number, the harder it will be to brute-force
-+ a password.
-+
-+endmenu
-+menu "Filesystem Protections"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_PROC
-+ bool "Proc restrictions"
-+ help
-+ If you say Y here, the permissions of the /proc filesystem
-+ will be altered to enhance system security and privacy. You MUST
-+ choose either a user only restriction or a user and group restriction.
-+ Depending upon the option you choose, you can either restrict users to
-+ see only the processes they themselves run, or choose a group that can
-+ view all processes and files normally restricted to root if you choose
-+ the "restrict to user only" option. NOTE: If you're running identd as
-+ a non-root user, you will have to run it as the group you specify here.
-+
-+config GRKERNSEC_PROC_USER
-+ bool "Restrict /proc to user only"
-+ depends on GRKERNSEC_PROC
-+ help
-+ If you say Y here, non-root users will only be able to view their own
-+ processes, and restricts them from viewing network-related information,
-+ and viewing kernel symbol and module information.
-+
-+config GRKERNSEC_PROC_USERGROUP
-+ bool "Allow special group"
-+ depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
-+ help
-+ If you say Y here, you will be able to select a group that will be
-+ able to view all processes and network-related information. If you've
-+ enabled GRKERNSEC_HIDESYM, kernel and symbol information may still
-+ remain hidden. This option is useful if you want to run identd as
-+ a non-root user.
-+
-+config GRKERNSEC_PROC_GID
-+ int "GID for special group"
-+ depends on GRKERNSEC_PROC_USERGROUP
-+ default 1001
-+
-+config GRKERNSEC_PROC_ADD
-+ bool "Additional restrictions"
-+ depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
-+ help
-+ If you say Y here, additional restrictions will be placed on
-+ /proc that keep normal users from viewing device information and
-+ slabinfo information that could be useful for exploits.
-+
-+config GRKERNSEC_LINK
-+ bool "Linking restrictions"
-+ help
-+ If you say Y here, /tmp race exploits will be prevented, since users
-+ will no longer be able to follow symlinks owned by other users in
-+ world-writable +t directories (e.g. /tmp), unless the owner of the
-+ symlink is the owner of the directory. users will also not be
-+ able to hardlink to files they do not own. If the sysctl option is
-+ enabled, a sysctl option with name "linking_restrictions" is created.
-+
-+config GRKERNSEC_FIFO
-+ bool "FIFO restrictions"
-+ help
-+ If you say Y here, users will not be able to write to FIFOs they don't
-+ own in world-writable +t directories (e.g. /tmp), unless the owner of
-+ the FIFO is the same owner of the directory it's held in. If the sysctl
-+ option is enabled, a sysctl option with name "fifo_restrictions" is
-+ created.
-+
-+config GRKERNSEC_SYSFS_RESTRICT
-+ bool "Sysfs/debugfs restriction"
-+ depends on SYSFS
-+ help
-+ If you say Y here, sysfs (the pseudo-filesystem mounted at /sys) and
-+ any filesystem normally mounted under it (e.g. debugfs) will only
-+ be accessible by root. These filesystems generally provide access
-+ to hardware and debug information that isn't appropriate for unprivileged
-+ users of the system. Sysfs and debugfs have also become a large source
-+ of new vulnerabilities, ranging from infoleaks to local compromise.
-+ There has been very little oversight with an eye toward security involved
-+ in adding new exporters of information to these filesystems, so their
-+ use is discouraged.
-+ This option is equivalent to a chmod 0700 of the mount paths.
-+
-+config GRKERNSEC_ROFS
-+ bool "Runtime read-only mount protection"
-+ help
-+ If you say Y here, a sysctl option with name "romount_protect" will
-+ be created. By setting this option to 1 at runtime, filesystems
-+ will be protected in the following ways:
-+ * No new writable mounts will be allowed
-+ * Existing read-only mounts won't be able to be remounted read/write
-+ * Write operations will be denied on all block devices
-+ This option acts independently of grsec_lock: once it is set to 1,
-+ it cannot be turned off. Therefore, please be mindful of the resulting
-+ behavior if this option is enabled in an init script on a read-only
-+ filesystem. This feature is mainly intended for secure embedded systems.
-+
-+config GRKERNSEC_CHROOT
-+ bool "Chroot jail restrictions"
-+ help
-+ If you say Y here, you will be able to choose several options that will
-+ make breaking out of a chrooted jail much more difficult. If you
-+ encounter no software incompatibilities with the following options, it
-+ is recommended that you enable each one.
-+
-+config GRKERNSEC_CHROOT_MOUNT
-+ bool "Deny mounts"
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, processes inside a chroot will not be able to
-+ mount or remount filesystems. If the sysctl option is enabled, a
-+ sysctl option with name "chroot_deny_mount" is created.
-+
-+config GRKERNSEC_CHROOT_DOUBLE
-+ bool "Deny double-chroots"
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, processes inside a chroot will not be able to chroot
-+ again outside the chroot. This is a widely used method of breaking
-+ out of a chroot jail and should not be allowed. If the sysctl
-+ option is enabled, a sysctl option with name
-+ "chroot_deny_chroot" is created.
-+
-+config GRKERNSEC_CHROOT_PIVOT
-+ bool "Deny pivot_root in chroot"
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, processes inside a chroot will not be able to use
-+ a function called pivot_root() that was introduced in Linux 2.3.41. It
-+ works similar to chroot in that it changes the root filesystem. This
-+ function could be misused in a chrooted process to attempt to break out
-+ of the chroot, and therefore should not be allowed. If the sysctl
-+ option is enabled, a sysctl option with name "chroot_deny_pivot" is
-+ created.
-+
-+config GRKERNSEC_CHROOT_CHDIR
-+ bool "Enforce chdir(\"/\") on all chroots"
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, the current working directory of all newly-chrooted
-+ applications will be set to the the root directory of the chroot.
-+ The man page on chroot(2) states:
-+ Note that this call does not change the current working
-+ directory, so that `.' can be outside the tree rooted at
-+ `/'. In particular, the super-user can escape from a
-+ `chroot jail' by doing `mkdir foo; chroot foo; cd ..'.
-+
-+ It is recommended that you say Y here, since it's not known to break
-+ any software. If the sysctl option is enabled, a sysctl option with
-+ name "chroot_enforce_chdir" is created.
-+
-+config GRKERNSEC_CHROOT_CHMOD
-+ bool "Deny (f)chmod +s"
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, processes inside a chroot will not be able to chmod
-+ or fchmod files to make them have suid or sgid bits. This protects
-+ against another published method of breaking a chroot. If the sysctl
-+ option is enabled, a sysctl option with name "chroot_deny_chmod" is
-+ created.
-+
-+config GRKERNSEC_CHROOT_FCHDIR
-+ bool "Deny fchdir out of chroot"
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, a well-known method of breaking chroots by fchdir'ing
-+ to a file descriptor of the chrooting process that points to a directory
-+ outside the filesystem will be stopped. If the sysctl option
-+ is enabled, a sysctl option with name "chroot_deny_fchdir" is created.
-+
-+config GRKERNSEC_CHROOT_MKNOD
-+ bool "Deny mknod"
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, processes inside a chroot will not be allowed to
-+ mknod. The problem with using mknod inside a chroot is that it
-+ would allow an attacker to create a device entry that is the same
-+ as one on the physical root of your system, which could range from
-+ anything from the console device to a device for your harddrive (which
-+ they could then use to wipe the drive or steal data). It is recommended
-+ that you say Y here, unless you run into software incompatibilities.
-+ If the sysctl option is enabled, a sysctl option with name
-+ "chroot_deny_mknod" is created.
-+
-+config GRKERNSEC_CHROOT_SHMAT
-+ bool "Deny shmat() out of chroot"
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, processes inside a chroot will not be able to attach
-+ to shared memory segments that were created outside of the chroot jail.
-+ It is recommended that you say Y here. If the sysctl option is enabled,
-+ a sysctl option with name "chroot_deny_shmat" is created.
-+
-+config GRKERNSEC_CHROOT_UNIX
-+ bool "Deny access to abstract AF_UNIX sockets out of chroot"
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, processes inside a chroot will not be able to
-+ connect to abstract (meaning not belonging to a filesystem) Unix
-+ domain sockets that were bound outside of a chroot. It is recommended
-+ that you say Y here. If the sysctl option is enabled, a sysctl option
-+ with name "chroot_deny_unix" is created.
-+
-+config GRKERNSEC_CHROOT_FINDTASK
-+ bool "Protect outside processes"
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, processes inside a chroot will not be able to
-+ kill, send signals with fcntl, ptrace, capget, getpgid, setpgid,
-+ getsid, or view any process outside of the chroot. If the sysctl
-+ option is enabled, a sysctl option with name "chroot_findtask" is
-+ created.
-+
-+config GRKERNSEC_CHROOT_NICE
-+ bool "Restrict priority changes"
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, processes inside a chroot will not be able to raise
-+ the priority of processes in the chroot, or alter the priority of
-+ processes outside the chroot. This provides more security than simply
-+ removing CAP_SYS_NICE from the process' capability set. If the
-+ sysctl option is enabled, a sysctl option with name "chroot_restrict_nice"
-+ is created.
-+
-+config GRKERNSEC_CHROOT_SYSCTL
-+ bool "Deny sysctl writes"
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, an attacker in a chroot will not be able to
-+ write to sysctl entries, either by sysctl(2) or through a /proc
-+ interface. It is strongly recommended that you say Y here. If the
-+ sysctl option is enabled, a sysctl option with name
-+ "chroot_deny_sysctl" is created.
-+
-+config GRKERNSEC_CHROOT_CAPS
-+ bool "Capability restrictions"
-+ depends on GRKERNSEC_CHROOT
-+ help
-+ If you say Y here, the capabilities on all root processes within a
-+ chroot jail will be lowered to stop module insertion, raw i/o,
-+ system and net admin tasks, rebooting the system, modifying immutable
-+ files, modifying IPC owned by another, and changing the system time.
-+ This is left an option because it can break some apps. Disable this
-+ if your chrooted apps are having problems performing those kinds of
-+ tasks. If the sysctl option is enabled, a sysctl option with
-+ name "chroot_caps" is created.
-+
-+endmenu
-+menu "Kernel Auditing"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_AUDIT_GROUP
-+ bool "Single group for auditing"
-+ help
-+ If you say Y here, the exec, chdir, and (un)mount logging features
-+ will only operate on a group you specify. This option is recommended
-+ if you only want to watch certain users instead of having a large
-+ amount of logs from the entire system. If the sysctl option is enabled,
-+ a sysctl option with name "audit_group" is created.
-+
-+config GRKERNSEC_AUDIT_GID
-+ int "GID for auditing"
-+ depends on GRKERNSEC_AUDIT_GROUP
-+ default 1007
-+
-+config GRKERNSEC_EXECLOG
-+ bool "Exec logging"
-+ help
-+ If you say Y here, all execve() calls will be logged (since the
-+ other exec*() calls are frontends to execve(), all execution
-+ will be logged). Useful for shell-servers that like to keep track
-+ of their users. If the sysctl option is enabled, a sysctl option with
-+ name "exec_logging" is created.
-+ WARNING: This option when enabled will produce a LOT of logs, especially
-+ on an active system.
-+
-+config GRKERNSEC_RESLOG
-+ bool "Resource logging"
-+ help
-+ If you say Y here, all attempts to overstep resource limits will
-+ be logged with the resource name, the requested size, and the current
-+ limit. It is highly recommended that you say Y here. If the sysctl
-+ option is enabled, a sysctl option with name "resource_logging" is
-+ created. If the RBAC system is enabled, the sysctl value is ignored.
-+
-+config GRKERNSEC_CHROOT_EXECLOG
-+ bool "Log execs within chroot"
-+ help
-+ If you say Y here, all executions inside a chroot jail will be logged
-+ to syslog. This can cause a large amount of logs if certain
-+ applications (eg. djb's daemontools) are installed on the system, and
-+ is therefore left as an option. If the sysctl option is enabled, a
-+ sysctl option with name "chroot_execlog" is created.
-+
-+config GRKERNSEC_AUDIT_PTRACE
-+ bool "Ptrace logging"
-+ help
-+ If you say Y here, all attempts to attach to a process via ptrace
-+ will be logged. If the sysctl option is enabled, a sysctl option
-+ with name "audit_ptrace" is created.
-+
-+config GRKERNSEC_AUDIT_CHDIR
-+ bool "Chdir logging"
-+ help
-+ If you say Y here, all chdir() calls will be logged. If the sysctl
-+ option is enabled, a sysctl option with name "audit_chdir" is created.
-+
-+config GRKERNSEC_AUDIT_MOUNT
-+ bool "(Un)Mount logging"
-+ help
-+ If you say Y here, all mounts and unmounts will be logged. If the
-+ sysctl option is enabled, a sysctl option with name "audit_mount" is
-+ created.
-+
-+config GRKERNSEC_SIGNAL
-+ bool "Signal logging"
-+ help
-+ If you say Y here, certain important signals will be logged, such as
-+ SIGSEGV, which will as a result inform you of when a error in a program
-+ occurred, which in some cases could mean a possible exploit attempt.
-+ If the sysctl option is enabled, a sysctl option with name
-+ "signal_logging" is created.
-+
-+config GRKERNSEC_FORKFAIL
-+ bool "Fork failure logging"
-+ help
-+ If you say Y here, all failed fork() attempts will be logged.
-+ This could suggest a fork bomb, or someone attempting to overstep
-+ their process limit. If the sysctl option is enabled, a sysctl option
-+ with name "forkfail_logging" is created.
-+
-+config GRKERNSEC_TIME
-+ bool "Time change logging"
-+ help
-+ If you say Y here, any changes of the system clock will be logged.
-+ If the sysctl option is enabled, a sysctl option with name
-+ "timechange_logging" is created.
-+
-+config GRKERNSEC_PROC_IPADDR
-+ bool "/proc/<pid>/ipaddr support"
-+ help
-+ If you say Y here, a new entry will be added to each /proc/<pid>
-+ directory that contains the IP address of the person using the task.
-+ The IP is carried across local TCP and AF_UNIX stream sockets.
-+ This information can be useful for IDS/IPSes to perform remote response
-+ to a local attack. The entry is readable by only the owner of the
-+ process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
-+ the RBAC system), and thus does not create privacy concerns.
-+
-+config GRKERNSEC_RWXMAP_LOG
-+ bool 'Denied RWX mmap/mprotect logging'
-+ depends on PAX_MPROTECT && !PAX_EMUPLT && !PAX_EMUSIGRT
-+ help
-+ If you say Y here, calls to mmap() and mprotect() with explicit
-+ usage of PROT_WRITE and PROT_EXEC together will be logged when
-+ denied by the PAX_MPROTECT feature. If the sysctl option is
-+ enabled, a sysctl option with name "rwxmap_logging" is created.
-+
-+config GRKERNSEC_AUDIT_TEXTREL
-+ bool 'ELF text relocations logging (READ HELP)'
-+ depends on PAX_MPROTECT
-+ help
-+ If you say Y here, text relocations will be logged with the filename
-+ of the offending library or binary. The purpose of the feature is
-+ to help Linux distribution developers get rid of libraries and
-+ binaries that need text relocations which hinder the future progress
-+ of PaX. Only Linux distribution developers should say Y here, and
-+ never on a production machine, as this option creates an information
-+ leak that could aid an attacker in defeating the randomization of
-+ a single memory region. If the sysctl option is enabled, a sysctl
-+ option with name "audit_textrel" is created.
-+
-+endmenu
-+
-+menu "Executable Protections"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_DMESG
-+ bool "Dmesg(8) restriction"
-+ help
-+ If you say Y here, non-root users will not be able to use dmesg(8)
-+ to view up to the last 4kb of messages in the kernel's log buffer.
-+ The kernel's log buffer often contains kernel addresses and other
-+ identifying information useful to an attacker in fingerprinting a
-+ system for a targeted exploit.
-+ If the sysctl option is enabled, a sysctl option with name "dmesg" is
-+ created.
-+
-+config GRKERNSEC_HARDEN_PTRACE
-+ bool "Deter ptrace-based process snooping"
-+ help
-+ If you say Y here, TTY sniffers and other malicious monitoring
-+ programs implemented through ptrace will be defeated. If you
-+ have been using the RBAC system, this option has already been
-+ enabled for several years for all users, with the ability to make
-+ fine-grained exceptions.
-+
-+ This option only affects the ability of non-root users to ptrace
-+ processes that are not a descendent of the ptracing process.
-+ This means that strace ./binary and gdb ./binary will still work,
-+ but attaching to arbitrary processes will not. If the sysctl
-+ option is enabled, a sysctl option with name "harden_ptrace" is
-+ created.
-+
-+config GRKERNSEC_TPE
-+ bool "Trusted Path Execution (TPE)"
-+ help
-+ If you say Y here, you will be able to choose a gid to add to the
-+ supplementary groups of users you want to mark as "untrusted."
-+ These users will not be able to execute any files that are not in
-+ root-owned directories writable only by root. If the sysctl option
-+ is enabled, a sysctl option with name "tpe" is created.
-+
-+config GRKERNSEC_TPE_ALL
-+ bool "Partially restrict all non-root users"
-+ depends on GRKERNSEC_TPE
-+ help
-+ If you say Y here, all non-root users will be covered under
-+ a weaker TPE restriction. This is separate from, and in addition to,
-+ the main TPE options that you have selected elsewhere. Thus, if a
-+ "trusted" GID is chosen, this restriction applies to even that GID.
-+ Under this restriction, all non-root users will only be allowed to
-+ execute files in directories they own that are not group or
-+ world-writable, or in directories owned by root and writable only by
-+ root. If the sysctl option is enabled, a sysctl option with name
-+ "tpe_restrict_all" is created.
-+
-+config GRKERNSEC_TPE_INVERT
-+ bool "Invert GID option"
-+ depends on GRKERNSEC_TPE
-+ help
-+ If you say Y here, the group you specify in the TPE configuration will
-+ decide what group TPE restrictions will be *disabled* for. This
-+ option is useful if you want TPE restrictions to be applied to most
-+ users on the system. If the sysctl option is enabled, a sysctl option
-+ with name "tpe_invert" is created. Unlike other sysctl options, this
-+ entry will default to on for backward-compatibility.
-+
-+config GRKERNSEC_TPE_GID
-+ int "GID for untrusted users"
-+ depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
-+ default 1005
-+ help
-+ Setting this GID determines what group TPE restrictions will be
-+ *enabled* for. If the sysctl option is enabled, a sysctl option
-+ with name "tpe_gid" is created.
-+
-+config GRKERNSEC_TPE_GID
-+ int "GID for trusted users"
-+ depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
-+ default 1005
-+ help
-+ Setting this GID determines what group TPE restrictions will be
-+ *disabled* for. If the sysctl option is enabled, a sysctl option
-+ with name "tpe_gid" is created.
-+
-+endmenu
-+menu "Network Protections"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_RANDNET
-+ bool "Larger entropy pools"
-+ help
-+ If you say Y here, the entropy pools used for many features of Linux
-+ and grsecurity will be doubled in size. Since several grsecurity
-+ features use additional randomness, it is recommended that you say Y
-+ here. Saying Y here has a similar effect as modifying
-+ /proc/sys/kernel/random/poolsize.
-+
-+config GRKERNSEC_BLACKHOLE
-+ bool "TCP/UDP blackhole and LAST_ACK DoS prevention"
-+ depends on NET
-+ help
-+ If you say Y here, neither TCP resets nor ICMP
-+ destination-unreachable packets will be sent in response to packets
-+ sent to ports for which no associated listening process exists.
-+ This feature supports both IPV4 and IPV6 and exempts the
-+ loopback interface from blackholing. Enabling this feature
-+ makes a host more resilient to DoS attacks and reduces network
-+ visibility against scanners.
-+
-+ The blackhole feature as-implemented is equivalent to the FreeBSD
-+ blackhole feature, as it prevents RST responses to all packets, not
-+ just SYNs. Under most application behavior this causes no
-+ problems, but applications (like haproxy) may not close certain
-+ connections in a way that cleanly terminates them on the remote
-+ end, leaving the remote host in LAST_ACK state. Because of this
-+ side-effect and to prevent intentional LAST_ACK DoSes, this
-+ feature also adds automatic mitigation against such attacks.
-+ The mitigation drastically reduces the amount of time a socket
-+ can spend in LAST_ACK state. If you're using haproxy and not
-+ all servers it connects to have this option enabled, consider
-+ disabling this feature on the haproxy host.
-+
-+ If the sysctl option is enabled, two sysctl options with names
-+ "ip_blackhole" and "lastack_retries" will be created.
-+ While "ip_blackhole" takes the standard zero/non-zero on/off
-+ toggle, "lastack_retries" uses the same kinds of values as
-+ "tcp_retries1" and "tcp_retries2". The default value of 4
-+ prevents a socket from lasting more than 45 seconds in LAST_ACK
-+ state.
-+
-+config GRKERNSEC_SOCKET
-+ bool "Socket restrictions"
-+ depends on NET
-+ help
-+ If you say Y here, you will be able to choose from several options.
-+ If you assign a GID on your system and add it to the supplementary
-+ groups of users you want to restrict socket access to, this patch
-+ will perform up to three things, based on the option(s) you choose.
-+
-+config GRKERNSEC_SOCKET_ALL
-+ bool "Deny any sockets to group"
-+ depends on GRKERNSEC_SOCKET
-+ help
-+ If you say Y here, you will be able to choose a GID of whose users will
-+ be unable to connect to other hosts from your machine or run server
-+ applications from your machine. If the sysctl option is enabled, a
-+ sysctl option with name "socket_all" is created.
-+
-+config GRKERNSEC_SOCKET_ALL_GID
-+ int "GID to deny all sockets for"
-+ depends on GRKERNSEC_SOCKET_ALL
-+ default 1004
-+ help
-+ Here you can choose the GID to disable socket access for. Remember to
-+ add the users you want socket access disabled for to the GID
-+ specified here. If the sysctl option is enabled, a sysctl option
-+ with name "socket_all_gid" is created.
-+
-+config GRKERNSEC_SOCKET_CLIENT
-+ bool "Deny client sockets to group"
-+ depends on GRKERNSEC_SOCKET
-+ help
-+ If you say Y here, you will be able to choose a GID of whose users will
-+ be unable to connect to other hosts from your machine, but will be
-+ able to run servers. If this option is enabled, all users in the group
-+ you specify will have to use passive mode when initiating ftp transfers
-+ from the shell on your machine. If the sysctl option is enabled, a
-+ sysctl option with name "socket_client" is created.
-+
-+config GRKERNSEC_SOCKET_CLIENT_GID
-+ int "GID to deny client sockets for"
-+ depends on GRKERNSEC_SOCKET_CLIENT
-+ default 1003
-+ help
-+ Here you can choose the GID to disable client socket access for.
-+ Remember to add the users you want client socket access disabled for to
-+ the GID specified here. If the sysctl option is enabled, a sysctl
-+ option with name "socket_client_gid" is created.
-+
-+config GRKERNSEC_SOCKET_SERVER
-+ bool "Deny server sockets to group"
-+ depends on GRKERNSEC_SOCKET
-+ help
-+ If you say Y here, you will be able to choose a GID of whose users will
-+ be unable to run server applications from your machine. If the sysctl
-+ option is enabled, a sysctl option with name "socket_server" is created.
-+
-+config GRKERNSEC_SOCKET_SERVER_GID
-+ int "GID to deny server sockets for"
-+ depends on GRKERNSEC_SOCKET_SERVER
-+ default 1002
-+ help
-+ Here you can choose the GID to disable server socket access for.
-+ Remember to add the users you want server socket access disabled for to
-+ the GID specified here. If the sysctl option is enabled, a sysctl
-+ option with name "socket_server_gid" is created.
-+
-+endmenu
-+menu "Sysctl support"
-+depends on GRKERNSEC && SYSCTL
-+
-+config GRKERNSEC_SYSCTL
-+ bool "Sysctl support"
-+ help
-+ If you say Y here, you will be able to change the options that
-+ grsecurity runs with at bootup, without having to recompile your
-+ kernel. You can echo values to files in /proc/sys/kernel/grsecurity
-+ to enable (1) or disable (0) various features. All the sysctl entries
-+ are mutable until the "grsec_lock" entry is set to a non-zero value.
-+ All features enabled in the kernel configuration are disabled at boot
-+ if you do not say Y to the "Turn on features by default" option.
-+ All options should be set at startup, and the grsec_lock entry should
-+ be set to a non-zero value after all the options are set.
-+ *THIS IS EXTREMELY IMPORTANT*
-+
-+config GRKERNSEC_SYSCTL_DISTRO
-+ bool "Extra sysctl support for distro makers (READ HELP)"
-+ depends on GRKERNSEC_SYSCTL && GRKERNSEC_IO
-+ help
-+ If you say Y here, additional sysctl options will be created
-+ for features that affect processes running as root. Therefore,
-+ it is critical when using this option that the grsec_lock entry be
-+ enabled after boot. Only distros with prebuilt kernel packages
-+ with this option enabled that can ensure grsec_lock is enabled
-+ after boot should use this option.
-+ *Failure to set grsec_lock after boot makes all grsec features
-+ this option covers useless*
-+
-+ Currently this option creates the following sysctl entries:
-+ "Disable Privileged I/O": "disable_priv_io"
-+
-+config GRKERNSEC_SYSCTL_ON
-+ bool "Turn on features by default"
-+ depends on GRKERNSEC_SYSCTL
-+ help
-+ If you say Y here, instead of having all features enabled in the
-+ kernel configuration disabled at boot time, the features will be
-+ enabled at boot time. It is recommended you say Y here unless
-+ there is some reason you would want all sysctl-tunable features to
-+ be disabled by default. As mentioned elsewhere, it is important
-+ to enable the grsec_lock entry once you have finished modifying
-+ the sysctl entries.
-+
-+endmenu
-+menu "Logging Options"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_FLOODTIME
-+ int "Seconds in between log messages (minimum)"
-+ default 10
-+ help
-+ This option allows you to enforce the number of seconds between
-+ grsecurity log messages. The default should be suitable for most
-+ people, however, if you choose to change it, choose a value small enough
-+ to allow informative logs to be produced, but large enough to
-+ prevent flooding.
-+
-+config GRKERNSEC_FLOODBURST
-+ int "Number of messages in a burst (maximum)"
-+ default 4
-+ help
-+ This option allows you to choose the maximum number of messages allowed
-+ within the flood time interval you chose in a separate option. The
-+ default should be suitable for most people, however if you find that
-+ many of your logs are being interpreted as flooding, you may want to
-+ raise this value.
-+
-+endmenu
-+
-+endmenu
-diff -urNp linux-2.6.32.45/grsecurity/Makefile linux-2.6.32.45/grsecurity/Makefile
---- linux-2.6.32.45/grsecurity/Makefile 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/grsecurity/Makefile 2011-08-21 18:54:34.000000000 -0400
-@@ -0,0 +1,34 @@
-+# grsecurity's ACL system was originally written in 2001 by Michael Dalton
-+# during 2001-2009 it has been completely redesigned by Brad Spengler
-+# into an RBAC system
-+#
-+# All code in this directory and various hooks inserted throughout the kernel
-+# are copyright Brad Spengler - Open Source Security, Inc., and released
-+# under the GPL v2 or higher
-+
-+obj-y = grsec_chdir.o grsec_chroot.o grsec_exec.o grsec_fifo.o grsec_fork.o \
-+ grsec_mount.o grsec_sig.o grsec_sysctl.o \
-+ grsec_time.o grsec_tpe.o grsec_link.o grsec_pax.o grsec_ptrace.o
-+
-+obj-$(CONFIG_GRKERNSEC) += grsec_init.o grsum.o gracl.o gracl_segv.o \
-+ gracl_cap.o gracl_alloc.o gracl_shm.o grsec_mem.o gracl_fs.o \
-+ gracl_learn.o grsec_log.o
-+obj-$(CONFIG_GRKERNSEC_RESLOG) += gracl_res.o
-+
-+ifdef CONFIG_NET
-+obj-y += grsec_sock.o
-+obj-$(CONFIG_GRKERNSEC) += gracl_ip.o
-+endif
-+
-+ifndef CONFIG_GRKERNSEC
-+obj-y += grsec_disabled.o
-+endif
-+
-+ifdef CONFIG_GRKERNSEC_HIDESYM
-+extra-y := grsec_hidesym.o
-+$(obj)/grsec_hidesym.o:
-+ @-chmod -f 500 /boot
-+ @-chmod -f 500 /lib/modules
-+ @-chmod -f 700 .
-+ @echo ' grsec: protected kernel image paths'
-+endif
-diff -urNp linux-2.6.32.45/include/acpi/acpi_bus.h linux-2.6.32.45/include/acpi/acpi_bus.h
---- linux-2.6.32.45/include/acpi/acpi_bus.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/acpi/acpi_bus.h 2011-08-05 20:33:55.000000000 -0400
-@@ -107,7 +107,7 @@ struct acpi_device_ops {
- acpi_op_bind bind;
- acpi_op_unbind unbind;
- acpi_op_notify notify;
--};
-+} __no_const;
-
- #define ACPI_DRIVER_ALL_NOTIFY_EVENTS 0x1 /* system AND device events */
-
-diff -urNp linux-2.6.32.45/include/acpi/acpi_drivers.h linux-2.6.32.45/include/acpi/acpi_drivers.h
---- linux-2.6.32.45/include/acpi/acpi_drivers.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/acpi/acpi_drivers.h 2011-04-17 15:56:46.000000000 -0400
-@@ -119,8 +119,8 @@ int acpi_processor_set_thermal_limit(acp
- Dock Station
- -------------------------------------------------------------------------- */
- struct acpi_dock_ops {
-- acpi_notify_handler handler;
-- acpi_notify_handler uevent;
-+ const acpi_notify_handler handler;
-+ const acpi_notify_handler uevent;
- };
-
- #if defined(CONFIG_ACPI_DOCK) || defined(CONFIG_ACPI_DOCK_MODULE)
-@@ -128,7 +128,7 @@ extern int is_dock_device(acpi_handle ha
- extern int register_dock_notifier(struct notifier_block *nb);
- extern void unregister_dock_notifier(struct notifier_block *nb);
- extern int register_hotplug_dock_device(acpi_handle handle,
-- struct acpi_dock_ops *ops,
-+ const struct acpi_dock_ops *ops,
- void *context);
- extern void unregister_hotplug_dock_device(acpi_handle handle);
- #else
-@@ -144,7 +144,7 @@ static inline void unregister_dock_notif
- {
- }
- static inline int register_hotplug_dock_device(acpi_handle handle,
-- struct acpi_dock_ops *ops,
-+ const struct acpi_dock_ops *ops,
- void *context)
- {
- return -ENODEV;
-diff -urNp linux-2.6.32.45/include/asm-generic/atomic-long.h linux-2.6.32.45/include/asm-generic/atomic-long.h
---- linux-2.6.32.45/include/asm-generic/atomic-long.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/asm-generic/atomic-long.h 2011-07-13 22:21:25.000000000 -0400
-@@ -22,6 +22,12 @@
-
- typedef atomic64_t atomic_long_t;
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+typedef atomic64_unchecked_t atomic_long_unchecked_t;
-+#else
-+typedef atomic64_t atomic_long_unchecked_t;
-+#endif
-+
- #define ATOMIC_LONG_INIT(i) ATOMIC64_INIT(i)
-
- static inline long atomic_long_read(atomic_long_t *l)
-@@ -31,6 +37,15 @@ static inline long atomic_long_read(atom
- return (long)atomic64_read(v);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
-+{
-+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
-+
-+ return (long)atomic64_read_unchecked(v);
-+}
-+#endif
-+
- static inline void atomic_long_set(atomic_long_t *l, long i)
- {
- atomic64_t *v = (atomic64_t *)l;
-@@ -38,6 +53,15 @@ static inline void atomic_long_set(atomi
- atomic64_set(v, i);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
-+{
-+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
-+
-+ atomic64_set_unchecked(v, i);
-+}
-+#endif
-+
- static inline void atomic_long_inc(atomic_long_t *l)
- {
- atomic64_t *v = (atomic64_t *)l;
-@@ -45,6 +69,15 @@ static inline void atomic_long_inc(atomi
- atomic64_inc(v);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
-+{
-+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
-+
-+ atomic64_inc_unchecked(v);
-+}
-+#endif
-+
- static inline void atomic_long_dec(atomic_long_t *l)
- {
- atomic64_t *v = (atomic64_t *)l;
-@@ -52,6 +85,15 @@ static inline void atomic_long_dec(atomi
- atomic64_dec(v);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
-+{
-+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
-+
-+ atomic64_dec_unchecked(v);
-+}
-+#endif
-+
- static inline void atomic_long_add(long i, atomic_long_t *l)
- {
- atomic64_t *v = (atomic64_t *)l;
-@@ -59,6 +101,15 @@ static inline void atomic_long_add(long
- atomic64_add(i, v);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
-+{
-+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
-+
-+ atomic64_add_unchecked(i, v);
-+}
-+#endif
-+
- static inline void atomic_long_sub(long i, atomic_long_t *l)
- {
- atomic64_t *v = (atomic64_t *)l;
-@@ -115,6 +166,15 @@ static inline long atomic_long_inc_retur
- return (long)atomic64_inc_return(v);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
-+{
-+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
-+
-+ return (long)atomic64_inc_return_unchecked(v);
-+}
-+#endif
-+
- static inline long atomic_long_dec_return(atomic_long_t *l)
- {
- atomic64_t *v = (atomic64_t *)l;
-@@ -140,6 +200,12 @@ static inline long atomic_long_add_unles
-
- typedef atomic_t atomic_long_t;
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+typedef atomic_unchecked_t atomic_long_unchecked_t;
-+#else
-+typedef atomic_t atomic_long_unchecked_t;
-+#endif
-+
- #define ATOMIC_LONG_INIT(i) ATOMIC_INIT(i)
- static inline long atomic_long_read(atomic_long_t *l)
- {
-@@ -148,6 +214,15 @@ static inline long atomic_long_read(atom
- return (long)atomic_read(v);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
-+{
-+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
-+
-+ return (long)atomic_read_unchecked(v);
-+}
-+#endif
-+
- static inline void atomic_long_set(atomic_long_t *l, long i)
- {
- atomic_t *v = (atomic_t *)l;
-@@ -155,6 +230,15 @@ static inline void atomic_long_set(atomi
- atomic_set(v, i);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
-+{
-+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
-+
-+ atomic_set_unchecked(v, i);
-+}
-+#endif
-+
- static inline void atomic_long_inc(atomic_long_t *l)
- {
- atomic_t *v = (atomic_t *)l;
-@@ -162,6 +246,15 @@ static inline void atomic_long_inc(atomi
- atomic_inc(v);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
-+{
-+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
-+
-+ atomic_inc_unchecked(v);
-+}
-+#endif
-+
- static inline void atomic_long_dec(atomic_long_t *l)
- {
- atomic_t *v = (atomic_t *)l;
-@@ -169,6 +262,15 @@ static inline void atomic_long_dec(atomi
- atomic_dec(v);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
-+{
-+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
-+
-+ atomic_dec_unchecked(v);
-+}
-+#endif
-+
- static inline void atomic_long_add(long i, atomic_long_t *l)
- {
- atomic_t *v = (atomic_t *)l;
-@@ -176,6 +278,15 @@ static inline void atomic_long_add(long
- atomic_add(i, v);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
-+{
-+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
-+
-+ atomic_add_unchecked(i, v);
-+}
-+#endif
-+
- static inline void atomic_long_sub(long i, atomic_long_t *l)
- {
- atomic_t *v = (atomic_t *)l;
-@@ -232,6 +343,15 @@ static inline long atomic_long_inc_retur
- return (long)atomic_inc_return(v);
- }
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
-+{
-+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
-+
-+ return (long)atomic_inc_return_unchecked(v);
-+}
-+#endif
-+
- static inline long atomic_long_dec_return(atomic_long_t *l)
- {
- atomic_t *v = (atomic_t *)l;
-@@ -255,4 +375,47 @@ static inline long atomic_long_add_unles
-
- #endif /* BITS_PER_LONG == 64 */
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void pax_refcount_needs_these_functions(void)
-+{
-+ atomic_read_unchecked((atomic_unchecked_t *)NULL);
-+ atomic_set_unchecked((atomic_unchecked_t *)NULL, 0);
-+ atomic_add_unchecked(0, (atomic_unchecked_t *)NULL);
-+ atomic_sub_unchecked(0, (atomic_unchecked_t *)NULL);
-+ atomic_inc_unchecked((atomic_unchecked_t *)NULL);
-+ (void)atomic_inc_and_test_unchecked((atomic_unchecked_t *)NULL);
-+ atomic_inc_return_unchecked((atomic_unchecked_t *)NULL);
-+ atomic_add_return_unchecked(0, (atomic_unchecked_t *)NULL);
-+ atomic_dec_unchecked((atomic_unchecked_t *)NULL);
-+ atomic_cmpxchg_unchecked((atomic_unchecked_t *)NULL, 0, 0);
-+ (void)atomic_xchg_unchecked((atomic_unchecked_t *)NULL, 0);
-+
-+ atomic_long_read_unchecked((atomic_long_unchecked_t *)NULL);
-+ atomic_long_set_unchecked((atomic_long_unchecked_t *)NULL, 0);
-+ atomic_long_add_unchecked(0, (atomic_long_unchecked_t *)NULL);
-+ atomic_long_inc_unchecked((atomic_long_unchecked_t *)NULL);
-+ atomic_long_inc_return_unchecked((atomic_long_unchecked_t *)NULL);
-+ atomic_long_dec_unchecked((atomic_long_unchecked_t *)NULL);
-+}
-+#else
-+#define atomic_read_unchecked(v) atomic_read(v)
-+#define atomic_set_unchecked(v, i) atomic_set((v), (i))
-+#define atomic_add_unchecked(i, v) atomic_add((i), (v))
-+#define atomic_sub_unchecked(i, v) atomic_sub((i), (v))
-+#define atomic_inc_unchecked(v) atomic_inc(v)
-+#define atomic_inc_and_test_unchecked(v) atomic_inc_and_test(v)
-+#define atomic_inc_return_unchecked(v) atomic_inc_return(v)
-+#define atomic_add_return_unchecked(i, v) atomic_add_return((i), (v))
-+#define atomic_dec_unchecked(v) atomic_dec(v)
-+#define atomic_cmpxchg_unchecked(v, o, n) atomic_cmpxchg((v), (o), (n))
-+#define atomic_xchg_unchecked(v, i) atomic_xchg((v), (i))
-+
-+#define atomic_long_read_unchecked(v) atomic_long_read(v)
-+#define atomic_long_set_unchecked(v, i) atomic_long_set((v), (i))
-+#define atomic_long_add_unchecked(i, v) atomic_long_add((i), (v))
-+#define atomic_long_inc_unchecked(v) atomic_long_inc(v)
-+#define atomic_long_inc_return_unchecked(v) atomic_long_inc_return(v)
-+#define atomic_long_dec_unchecked(v) atomic_long_dec(v)
-+#endif
-+
- #endif /* _ASM_GENERIC_ATOMIC_LONG_H */
-diff -urNp linux-2.6.32.45/include/asm-generic/bug.h linux-2.6.32.45/include/asm-generic/bug.h
---- linux-2.6.32.45/include/asm-generic/bug.h 2011-07-13 17:23:04.000000000 -0400
-+++ linux-2.6.32.45/include/asm-generic/bug.h 2011-08-21 17:56:07.000000000 -0400
-@@ -105,11 +105,11 @@ extern void warn_slowpath_null(const cha
-
- #else /* !CONFIG_BUG */
- #ifndef HAVE_ARCH_BUG
--#define BUG() do {} while(0)
-+#define BUG() do { for (;;) ; } while(0)
- #endif
-
- #ifndef HAVE_ARCH_BUG_ON
--#define BUG_ON(condition) do { if (condition) ; } while(0)
-+#define BUG_ON(condition) do { if (condition) for (;;) ; } while(0)
- #endif
-
- #ifndef HAVE_ARCH_WARN_ON
-diff -urNp linux-2.6.32.45/include/asm-generic/cache.h linux-2.6.32.45/include/asm-generic/cache.h
---- linux-2.6.32.45/include/asm-generic/cache.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/asm-generic/cache.h 2011-07-06 19:53:33.000000000 -0400
-@@ -6,7 +6,7 @@
- * cache lines need to provide their own cache.h.
- */
-
--#define L1_CACHE_SHIFT 5
--#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
-+#define L1_CACHE_SHIFT 5UL
-+#define L1_CACHE_BYTES (1UL << L1_CACHE_SHIFT)
-
- #endif /* __ASM_GENERIC_CACHE_H */
-diff -urNp linux-2.6.32.45/include/asm-generic/dma-mapping-common.h linux-2.6.32.45/include/asm-generic/dma-mapping-common.h
---- linux-2.6.32.45/include/asm-generic/dma-mapping-common.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/asm-generic/dma-mapping-common.h 2011-04-17 15:56:46.000000000 -0400
-@@ -11,7 +11,7 @@ static inline dma_addr_t dma_map_single_
- enum dma_data_direction dir,
- struct dma_attrs *attrs)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
- dma_addr_t addr;
-
- kmemcheck_mark_initialized(ptr, size);
-@@ -30,7 +30,7 @@ static inline void dma_unmap_single_attr
- enum dma_data_direction dir,
- struct dma_attrs *attrs)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- BUG_ON(!valid_dma_direction(dir));
- if (ops->unmap_page)
-@@ -42,7 +42,7 @@ static inline int dma_map_sg_attrs(struc
- int nents, enum dma_data_direction dir,
- struct dma_attrs *attrs)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
- int i, ents;
- struct scatterlist *s;
-
-@@ -59,7 +59,7 @@ static inline void dma_unmap_sg_attrs(st
- int nents, enum dma_data_direction dir,
- struct dma_attrs *attrs)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- BUG_ON(!valid_dma_direction(dir));
- debug_dma_unmap_sg(dev, sg, nents, dir);
-@@ -71,7 +71,7 @@ static inline dma_addr_t dma_map_page(st
- size_t offset, size_t size,
- enum dma_data_direction dir)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
- dma_addr_t addr;
-
- kmemcheck_mark_initialized(page_address(page) + offset, size);
-@@ -85,7 +85,7 @@ static inline dma_addr_t dma_map_page(st
- static inline void dma_unmap_page(struct device *dev, dma_addr_t addr,
- size_t size, enum dma_data_direction dir)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- BUG_ON(!valid_dma_direction(dir));
- if (ops->unmap_page)
-@@ -97,7 +97,7 @@ static inline void dma_sync_single_for_c
- size_t size,
- enum dma_data_direction dir)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- BUG_ON(!valid_dma_direction(dir));
- if (ops->sync_single_for_cpu)
-@@ -109,7 +109,7 @@ static inline void dma_sync_single_for_d
- dma_addr_t addr, size_t size,
- enum dma_data_direction dir)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- BUG_ON(!valid_dma_direction(dir));
- if (ops->sync_single_for_device)
-@@ -123,7 +123,7 @@ static inline void dma_sync_single_range
- size_t size,
- enum dma_data_direction dir)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- BUG_ON(!valid_dma_direction(dir));
- if (ops->sync_single_range_for_cpu) {
-@@ -140,7 +140,7 @@ static inline void dma_sync_single_range
- size_t size,
- enum dma_data_direction dir)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- BUG_ON(!valid_dma_direction(dir));
- if (ops->sync_single_range_for_device) {
-@@ -155,7 +155,7 @@ static inline void
- dma_sync_sg_for_cpu(struct device *dev, struct scatterlist *sg,
- int nelems, enum dma_data_direction dir)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- BUG_ON(!valid_dma_direction(dir));
- if (ops->sync_sg_for_cpu)
-@@ -167,7 +167,7 @@ static inline void
- dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg,
- int nelems, enum dma_data_direction dir)
- {
-- struct dma_map_ops *ops = get_dma_ops(dev);
-+ const struct dma_map_ops *ops = get_dma_ops(dev);
-
- BUG_ON(!valid_dma_direction(dir));
- if (ops->sync_sg_for_device)
-diff -urNp linux-2.6.32.45/include/asm-generic/emergency-restart.h linux-2.6.32.45/include/asm-generic/emergency-restart.h
---- linux-2.6.32.45/include/asm-generic/emergency-restart.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/asm-generic/emergency-restart.h 2011-08-21 19:17:17.000000000 -0400
-@@ -1,7 +1,7 @@
- #ifndef _ASM_GENERIC_EMERGENCY_RESTART_H
- #define _ASM_GENERIC_EMERGENCY_RESTART_H
-
--static inline void machine_emergency_restart(void)
-+static inline __noreturn void machine_emergency_restart(void)
- {
- machine_restart(NULL);
- }
-diff -urNp linux-2.6.32.45/include/asm-generic/futex.h linux-2.6.32.45/include/asm-generic/futex.h
---- linux-2.6.32.45/include/asm-generic/futex.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/asm-generic/futex.h 2011-04-17 15:56:46.000000000 -0400
-@@ -6,7 +6,7 @@
- #include <asm/errno.h>
-
- static inline int
--futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
-+futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
- {
- int op = (encoded_op >> 28) & 7;
- int cmp = (encoded_op >> 24) & 15;
-@@ -48,7 +48,7 @@ futex_atomic_op_inuser (int encoded_op,
- }
-
- static inline int
--futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval, int newval)
-+futex_atomic_cmpxchg_inatomic(u32 __user *uaddr, int oldval, int newval)
- {
- return -ENOSYS;
- }
-diff -urNp linux-2.6.32.45/include/asm-generic/int-l64.h linux-2.6.32.45/include/asm-generic/int-l64.h
---- linux-2.6.32.45/include/asm-generic/int-l64.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/asm-generic/int-l64.h 2011-04-17 15:56:46.000000000 -0400
-@@ -46,6 +46,8 @@ typedef unsigned int u32;
- typedef signed long s64;
- typedef unsigned long u64;
-
-+typedef unsigned int intoverflow_t __attribute__ ((mode(TI)));
-+
- #define S8_C(x) x
- #define U8_C(x) x ## U
- #define S16_C(x) x
-diff -urNp linux-2.6.32.45/include/asm-generic/int-ll64.h linux-2.6.32.45/include/asm-generic/int-ll64.h
---- linux-2.6.32.45/include/asm-generic/int-ll64.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/asm-generic/int-ll64.h 2011-04-17 15:56:46.000000000 -0400
-@@ -51,6 +51,8 @@ typedef unsigned int u32;
- typedef signed long long s64;
- typedef unsigned long long u64;
-
-+typedef unsigned long long intoverflow_t;
-+
- #define S8_C(x) x
- #define U8_C(x) x ## U
- #define S16_C(x) x
-diff -urNp linux-2.6.32.45/include/asm-generic/kmap_types.h linux-2.6.32.45/include/asm-generic/kmap_types.h
---- linux-2.6.32.45/include/asm-generic/kmap_types.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/asm-generic/kmap_types.h 2011-04-17 15:56:46.000000000 -0400
-@@ -28,7 +28,8 @@ KMAP_D(15) KM_UML_USERCOPY,
- KMAP_D(16) KM_IRQ_PTE,
- KMAP_D(17) KM_NMI,
- KMAP_D(18) KM_NMI_PTE,
--KMAP_D(19) KM_TYPE_NR
-+KMAP_D(19) KM_CLEARPAGE,
-+KMAP_D(20) KM_TYPE_NR
- };
-
- #undef KMAP_D
-diff -urNp linux-2.6.32.45/include/asm-generic/pgtable.h linux-2.6.32.45/include/asm-generic/pgtable.h
---- linux-2.6.32.45/include/asm-generic/pgtable.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/asm-generic/pgtable.h 2011-04-17 15:56:46.000000000 -0400
-@@ -344,6 +344,14 @@ extern void untrack_pfn_vma(struct vm_ar
- unsigned long size);
- #endif
-
-+#ifndef __HAVE_ARCH_PAX_OPEN_KERNEL
-+static inline unsigned long pax_open_kernel(void) { return 0; }
-+#endif
-+
-+#ifndef __HAVE_ARCH_PAX_CLOSE_KERNEL
-+static inline unsigned long pax_close_kernel(void) { return 0; }
-+#endif
-+
- #endif /* !__ASSEMBLY__ */
-
- #endif /* _ASM_GENERIC_PGTABLE_H */
-diff -urNp linux-2.6.32.45/include/asm-generic/pgtable-nopmd.h linux-2.6.32.45/include/asm-generic/pgtable-nopmd.h
---- linux-2.6.32.45/include/asm-generic/pgtable-nopmd.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/asm-generic/pgtable-nopmd.h 2011-04-17 15:56:46.000000000 -0400
-@@ -1,14 +1,19 @@
- #ifndef _PGTABLE_NOPMD_H
- #define _PGTABLE_NOPMD_H
-
--#ifndef __ASSEMBLY__
--
- #include <asm-generic/pgtable-nopud.h>
-
--struct mm_struct;
--
- #define __PAGETABLE_PMD_FOLDED
-
-+#define PMD_SHIFT PUD_SHIFT
-+#define PTRS_PER_PMD 1
-+#define PMD_SIZE (_AC(1,UL) << PMD_SHIFT)
-+#define PMD_MASK (~(PMD_SIZE-1))
-+
-+#ifndef __ASSEMBLY__
-+
-+struct mm_struct;
-+
- /*
- * Having the pmd type consist of a pud gets the size right, and allows
- * us to conceptually access the pud entry that this pmd is folded into
-@@ -16,11 +21,6 @@ struct mm_struct;
- */
- typedef struct { pud_t pud; } pmd_t;
-
--#define PMD_SHIFT PUD_SHIFT
--#define PTRS_PER_PMD 1
--#define PMD_SIZE (1UL << PMD_SHIFT)
--#define PMD_MASK (~(PMD_SIZE-1))
--
- /*
- * The "pud_xxx()" functions here are trivial for a folded two-level
- * setup: the pmd is never bad, and a pmd always exists (as it's folded
-diff -urNp linux-2.6.32.45/include/asm-generic/pgtable-nopud.h linux-2.6.32.45/include/asm-generic/pgtable-nopud.h
---- linux-2.6.32.45/include/asm-generic/pgtable-nopud.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/asm-generic/pgtable-nopud.h 2011-04-17 15:56:46.000000000 -0400
-@@ -1,10 +1,15 @@
- #ifndef _PGTABLE_NOPUD_H
- #define _PGTABLE_NOPUD_H
-
--#ifndef __ASSEMBLY__
--
- #define __PAGETABLE_PUD_FOLDED
-
-+#define PUD_SHIFT PGDIR_SHIFT
-+#define PTRS_PER_PUD 1
-+#define PUD_SIZE (_AC(1,UL) << PUD_SHIFT)
-+#define PUD_MASK (~(PUD_SIZE-1))
-+
-+#ifndef __ASSEMBLY__
-+
- /*
- * Having the pud type consist of a pgd gets the size right, and allows
- * us to conceptually access the pgd entry that this pud is folded into
-@@ -12,11 +17,6 @@
- */
- typedef struct { pgd_t pgd; } pud_t;
-
--#define PUD_SHIFT PGDIR_SHIFT
--#define PTRS_PER_PUD 1
--#define PUD_SIZE (1UL << PUD_SHIFT)
--#define PUD_MASK (~(PUD_SIZE-1))
--
- /*
- * The "pgd_xxx()" functions here are trivial for a folded two-level
- * setup: the pud is never bad, and a pud always exists (as it's folded
-diff -urNp linux-2.6.32.45/include/asm-generic/vmlinux.lds.h linux-2.6.32.45/include/asm-generic/vmlinux.lds.h
---- linux-2.6.32.45/include/asm-generic/vmlinux.lds.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/asm-generic/vmlinux.lds.h 2011-04-17 15:56:46.000000000 -0400
-@@ -199,6 +199,7 @@
- .rodata : AT(ADDR(.rodata) - LOAD_OFFSET) { \
- VMLINUX_SYMBOL(__start_rodata) = .; \
- *(.rodata) *(.rodata.*) \
-+ *(.data.read_only) \
- *(__vermagic) /* Kernel version magic */ \
- *(__markers_strings) /* Markers: strings */ \
- *(__tracepoints_strings)/* Tracepoints: strings */ \
-@@ -656,22 +657,24 @@
- * section in the linker script will go there too. @phdr should have
- * a leading colon.
- *
-- * Note that this macros defines __per_cpu_load as an absolute symbol.
-+ * Note that this macros defines per_cpu_load as an absolute symbol.
- * If there is no need to put the percpu section at a predetermined
- * address, use PERCPU().
- */
- #define PERCPU_VADDR(vaddr, phdr) \
-- VMLINUX_SYMBOL(__per_cpu_load) = .; \
-- .data.percpu vaddr : AT(VMLINUX_SYMBOL(__per_cpu_load) \
-+ per_cpu_load = .; \
-+ .data.percpu vaddr : AT(VMLINUX_SYMBOL(per_cpu_load) \
- - LOAD_OFFSET) { \
-+ VMLINUX_SYMBOL(__per_cpu_load) = . + per_cpu_load; \
- VMLINUX_SYMBOL(__per_cpu_start) = .; \
- *(.data.percpu.first) \
-- *(.data.percpu.page_aligned) \
- *(.data.percpu) \
-+ . = ALIGN(PAGE_SIZE); \
-+ *(.data.percpu.page_aligned) \
- *(.data.percpu.shared_aligned) \
- VMLINUX_SYMBOL(__per_cpu_end) = .; \
- } phdr \
-- . = VMLINUX_SYMBOL(__per_cpu_load) + SIZEOF(.data.percpu);
-+ . = VMLINUX_SYMBOL(per_cpu_load) + SIZEOF(.data.percpu);
-
- /**
- * PERCPU - define output section for percpu area, simple version
-diff -urNp linux-2.6.32.45/include/drm/drm_crtc_helper.h linux-2.6.32.45/include/drm/drm_crtc_helper.h
---- linux-2.6.32.45/include/drm/drm_crtc_helper.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/drm/drm_crtc_helper.h 2011-08-05 20:33:55.000000000 -0400
-@@ -64,7 +64,7 @@ struct drm_crtc_helper_funcs {
-
- /* reload the current crtc LUT */
- void (*load_lut)(struct drm_crtc *crtc);
--};
-+} __no_const;
-
- struct drm_encoder_helper_funcs {
- void (*dpms)(struct drm_encoder *encoder, int mode);
-@@ -85,7 +85,7 @@ struct drm_encoder_helper_funcs {
- struct drm_connector *connector);
- /* disable encoder when not in use - more explicit than dpms off */
- void (*disable)(struct drm_encoder *encoder);
--};
-+} __no_const;
-
- struct drm_connector_helper_funcs {
- int (*get_modes)(struct drm_connector *connector);
-diff -urNp linux-2.6.32.45/include/drm/drmP.h linux-2.6.32.45/include/drm/drmP.h
---- linux-2.6.32.45/include/drm/drmP.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/drm/drmP.h 2011-04-17 15:56:46.000000000 -0400
-@@ -71,6 +71,7 @@
- #include <linux/workqueue.h>
- #include <linux/poll.h>
- #include <asm/pgalloc.h>
-+#include <asm/local.h>
- #include "drm.h"
-
- #include <linux/idr.h>
-@@ -814,7 +815,7 @@ struct drm_driver {
- void (*vgaarb_irq)(struct drm_device *dev, bool state);
-
- /* Driver private ops for this object */
-- struct vm_operations_struct *gem_vm_ops;
-+ const struct vm_operations_struct *gem_vm_ops;
-
- int major;
- int minor;
-@@ -917,7 +918,7 @@ struct drm_device {
-
- /** \name Usage Counters */
- /*@{ */
-- int open_count; /**< Outstanding files open */
-+ local_t open_count; /**< Outstanding files open */
- atomic_t ioctl_count; /**< Outstanding IOCTLs pending */
- atomic_t vma_count; /**< Outstanding vma areas open */
- int buf_use; /**< Buffers in use -- cannot alloc */
-@@ -928,7 +929,7 @@ struct drm_device {
- /*@{ */
- unsigned long counters;
- enum drm_stat_type types[15];
-- atomic_t counts[15];
-+ atomic_unchecked_t counts[15];
- /*@} */
-
- struct list_head filelist;
-@@ -1016,7 +1017,7 @@ struct drm_device {
- struct pci_controller *hose;
- #endif
- struct drm_sg_mem *sg; /**< Scatter gather memory */
-- unsigned int num_crtcs; /**< Number of CRTCs on this device */
-+ unsigned int num_crtcs; /**< Number of CRTCs on this device */
- void *dev_private; /**< device private data */
- void *mm_private;
- struct address_space *dev_mapping;
-@@ -1042,11 +1043,11 @@ struct drm_device {
- spinlock_t object_name_lock;
- struct idr object_name_idr;
- atomic_t object_count;
-- atomic_t object_memory;
-+ atomic_unchecked_t object_memory;
- atomic_t pin_count;
-- atomic_t pin_memory;
-+ atomic_unchecked_t pin_memory;
- atomic_t gtt_count;
-- atomic_t gtt_memory;
-+ atomic_unchecked_t gtt_memory;
- uint32_t gtt_total;
- uint32_t invalidate_domains; /* domains pending invalidation */
- uint32_t flush_domains; /* domains pending flush */
-diff -urNp linux-2.6.32.45/include/drm/ttm/ttm_memory.h linux-2.6.32.45/include/drm/ttm/ttm_memory.h
---- linux-2.6.32.45/include/drm/ttm/ttm_memory.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/drm/ttm/ttm_memory.h 2011-08-05 20:33:55.000000000 -0400
-@@ -47,7 +47,7 @@
-
- struct ttm_mem_shrink {
- int (*do_shrink) (struct ttm_mem_shrink *);
--};
-+} __no_const;
-
- /**
- * struct ttm_mem_global - Global memory accounting structure.
-diff -urNp linux-2.6.32.45/include/linux/a.out.h linux-2.6.32.45/include/linux/a.out.h
---- linux-2.6.32.45/include/linux/a.out.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/a.out.h 2011-04-17 15:56:46.000000000 -0400
-@@ -39,6 +39,14 @@ enum machine_type {
- M_MIPS2 = 152 /* MIPS R6000/R4000 binary */
- };
-
-+/* Constants for the N_FLAGS field */
-+#define F_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
-+#define F_PAX_EMUTRAMP 2 /* Emulate trampolines */
-+#define F_PAX_MPROTECT 4 /* Restrict mprotect() */
-+#define F_PAX_RANDMMAP 8 /* Randomize mmap() base */
-+/*#define F_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
-+#define F_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
-+
- #if !defined (N_MAGIC)
- #define N_MAGIC(exec) ((exec).a_info & 0xffff)
- #endif
-diff -urNp linux-2.6.32.45/include/linux/atmdev.h linux-2.6.32.45/include/linux/atmdev.h
---- linux-2.6.32.45/include/linux/atmdev.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/atmdev.h 2011-04-17 15:56:46.000000000 -0400
-@@ -237,7 +237,7 @@ struct compat_atm_iobuf {
- #endif
-
- struct k_atm_aal_stats {
--#define __HANDLE_ITEM(i) atomic_t i
-+#define __HANDLE_ITEM(i) atomic_unchecked_t i
- __AAL_STAT_ITEMS
- #undef __HANDLE_ITEM
- };
-diff -urNp linux-2.6.32.45/include/linux/backlight.h linux-2.6.32.45/include/linux/backlight.h
---- linux-2.6.32.45/include/linux/backlight.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/backlight.h 2011-04-17 15:56:46.000000000 -0400
-@@ -36,18 +36,18 @@ struct backlight_device;
- struct fb_info;
-
- struct backlight_ops {
-- unsigned int options;
-+ const unsigned int options;
-
- #define BL_CORE_SUSPENDRESUME (1 << 0)
-
- /* Notify the backlight driver some property has changed */
-- int (*update_status)(struct backlight_device *);
-+ int (* const update_status)(struct backlight_device *);
- /* Return the current backlight brightness (accounting for power,
- fb_blank etc.) */
-- int (*get_brightness)(struct backlight_device *);
-+ int (* const get_brightness)(struct backlight_device *);
- /* Check if given framebuffer device is the one bound to this backlight;
- return 0 if not, !=0 if it is. If NULL, backlight always matches the fb. */
-- int (*check_fb)(struct fb_info *);
-+ int (* const check_fb)(struct fb_info *);
- };
-
- /* This structure defines all the properties of a backlight */
-@@ -86,7 +86,7 @@ struct backlight_device {
- registered this device has been unloaded, and if class_get_devdata()
- points to something in the body of that driver, it is also invalid. */
- struct mutex ops_lock;
-- struct backlight_ops *ops;
-+ const struct backlight_ops *ops;
-
- /* The framebuffer notifier block */
- struct notifier_block fb_notif;
-@@ -103,7 +103,7 @@ static inline void backlight_update_stat
- }
-
- extern struct backlight_device *backlight_device_register(const char *name,
-- struct device *dev, void *devdata, struct backlight_ops *ops);
-+ struct device *dev, void *devdata, const struct backlight_ops *ops);
- extern void backlight_device_unregister(struct backlight_device *bd);
- extern void backlight_force_update(struct backlight_device *bd,
- enum backlight_update_reason reason);
-diff -urNp linux-2.6.32.45/include/linux/binfmts.h linux-2.6.32.45/include/linux/binfmts.h
---- linux-2.6.32.45/include/linux/binfmts.h 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.45/include/linux/binfmts.h 2011-04-17 15:56:46.000000000 -0400
-@@ -83,6 +83,7 @@ struct linux_binfmt {
- int (*load_binary)(struct linux_binprm *, struct pt_regs * regs);
- int (*load_shlib)(struct file *);
- int (*core_dump)(long signr, struct pt_regs *regs, struct file *file, unsigned long limit);
-+ void (*handle_mprotect)(struct vm_area_struct *vma, unsigned long newflags);
- unsigned long min_coredump; /* minimal dump size */
- int hasvdso;
- };
-diff -urNp linux-2.6.32.45/include/linux/blkdev.h linux-2.6.32.45/include/linux/blkdev.h
---- linux-2.6.32.45/include/linux/blkdev.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/blkdev.h 2011-04-17 15:56:46.000000000 -0400
-@@ -1265,19 +1265,19 @@ static inline int blk_integrity_rq(struc
- #endif /* CONFIG_BLK_DEV_INTEGRITY */
-
- struct block_device_operations {
-- int (*open) (struct block_device *, fmode_t);
-- int (*release) (struct gendisk *, fmode_t);
-- int (*locked_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
-- int (*ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
-- int (*compat_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
-- int (*direct_access) (struct block_device *, sector_t,
-+ int (* const open) (struct block_device *, fmode_t);
-+ int (* const release) (struct gendisk *, fmode_t);
-+ int (* const locked_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
-+ int (* const ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
-+ int (* const compat_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
-+ int (* const direct_access) (struct block_device *, sector_t,
- void **, unsigned long *);
-- int (*media_changed) (struct gendisk *);
-- unsigned long long (*set_capacity) (struct gendisk *,
-+ int (* const media_changed) (struct gendisk *);
-+ unsigned long long (* const set_capacity) (struct gendisk *,
- unsigned long long);
-- int (*revalidate_disk) (struct gendisk *);
-- int (*getgeo)(struct block_device *, struct hd_geometry *);
-- struct module *owner;
-+ int (* const revalidate_disk) (struct gendisk *);
-+ int (*const getgeo)(struct block_device *, struct hd_geometry *);
-+ struct module * const owner;
- };
-
- extern int __blkdev_driver_ioctl(struct block_device *, fmode_t, unsigned int,
-diff -urNp linux-2.6.32.45/include/linux/blktrace_api.h linux-2.6.32.45/include/linux/blktrace_api.h
---- linux-2.6.32.45/include/linux/blktrace_api.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/blktrace_api.h 2011-05-04 17:56:28.000000000 -0400
-@@ -160,7 +160,7 @@ struct blk_trace {
- struct dentry *dir;
- struct dentry *dropped_file;
- struct dentry *msg_file;
-- atomic_t dropped;
-+ atomic_unchecked_t dropped;
- };
-
- extern int blk_trace_ioctl(struct block_device *, unsigned, char __user *);
-diff -urNp linux-2.6.32.45/include/linux/byteorder/little_endian.h linux-2.6.32.45/include/linux/byteorder/little_endian.h
---- linux-2.6.32.45/include/linux/byteorder/little_endian.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/byteorder/little_endian.h 2011-04-17 15:56:46.000000000 -0400
-@@ -42,51 +42,51 @@
-
- static inline __le64 __cpu_to_le64p(const __u64 *p)
- {
-- return (__force __le64)*p;
-+ return (__force const __le64)*p;
- }
- static inline __u64 __le64_to_cpup(const __le64 *p)
- {
-- return (__force __u64)*p;
-+ return (__force const __u64)*p;
- }
- static inline __le32 __cpu_to_le32p(const __u32 *p)
- {
-- return (__force __le32)*p;
-+ return (__force const __le32)*p;
- }
- static inline __u32 __le32_to_cpup(const __le32 *p)
- {
-- return (__force __u32)*p;
-+ return (__force const __u32)*p;
- }
- static inline __le16 __cpu_to_le16p(const __u16 *p)
- {
-- return (__force __le16)*p;
-+ return (__force const __le16)*p;
- }
- static inline __u16 __le16_to_cpup(const __le16 *p)
- {
-- return (__force __u16)*p;
-+ return (__force const __u16)*p;
- }
- static inline __be64 __cpu_to_be64p(const __u64 *p)
- {
-- return (__force __be64)__swab64p(p);
-+ return (__force const __be64)__swab64p(p);
- }
- static inline __u64 __be64_to_cpup(const __be64 *p)
- {
-- return __swab64p((__u64 *)p);
-+ return __swab64p((const __u64 *)p);
- }
- static inline __be32 __cpu_to_be32p(const __u32 *p)
- {
-- return (__force __be32)__swab32p(p);
-+ return (__force const __be32)__swab32p(p);
- }
- static inline __u32 __be32_to_cpup(const __be32 *p)
- {
-- return __swab32p((__u32 *)p);
-+ return __swab32p((const __u32 *)p);
- }
- static inline __be16 __cpu_to_be16p(const __u16 *p)
- {
-- return (__force __be16)__swab16p(p);
-+ return (__force const __be16)__swab16p(p);
- }
- static inline __u16 __be16_to_cpup(const __be16 *p)
- {
-- return __swab16p((__u16 *)p);
-+ return __swab16p((const __u16 *)p);
- }
- #define __cpu_to_le64s(x) do { (void)(x); } while (0)
- #define __le64_to_cpus(x) do { (void)(x); } while (0)
-diff -urNp linux-2.6.32.45/include/linux/cache.h linux-2.6.32.45/include/linux/cache.h
---- linux-2.6.32.45/include/linux/cache.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/cache.h 2011-04-17 15:56:46.000000000 -0400
-@@ -16,6 +16,10 @@
- #define __read_mostly
- #endif
-
-+#ifndef __read_only
-+#define __read_only __read_mostly
-+#endif
-+
- #ifndef ____cacheline_aligned
- #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
- #endif
-diff -urNp linux-2.6.32.45/include/linux/capability.h linux-2.6.32.45/include/linux/capability.h
---- linux-2.6.32.45/include/linux/capability.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/capability.h 2011-04-17 15:56:46.000000000 -0400
-@@ -563,6 +563,7 @@ extern const kernel_cap_t __cap_init_eff
- (security_real_capable_noaudit((t), (cap)) == 0)
-
- extern int capable(int cap);
-+int capable_nolog(int cap);
-
- /* audit system wants to get cap info from files as well */
- struct dentry;
-diff -urNp linux-2.6.32.45/include/linux/compiler-gcc4.h linux-2.6.32.45/include/linux/compiler-gcc4.h
---- linux-2.6.32.45/include/linux/compiler-gcc4.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/compiler-gcc4.h 2011-08-05 20:33:55.000000000 -0400
-@@ -36,4 +36,13 @@
- the kernel context */
- #define __cold __attribute__((__cold__))
-
-+#define __alloc_size(...) __attribute((alloc_size(__VA_ARGS__)))
-+#define __bos(ptr, arg) __builtin_object_size((ptr), (arg))
-+#define __bos0(ptr) __bos((ptr), 0)
-+#define __bos1(ptr) __bos((ptr), 1)
-+
-+#if __GNUC_MINOR__ >= 5
-+#define __no_const __attribute__((no_const))
-+#endif
-+
- #endif
-diff -urNp linux-2.6.32.45/include/linux/compiler.h linux-2.6.32.45/include/linux/compiler.h
---- linux-2.6.32.45/include/linux/compiler.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/compiler.h 2011-08-05 20:33:55.000000000 -0400
-@@ -247,6 +247,10 @@ void ftrace_likely_update(struct ftrace_
- # define __attribute_const__ /* unimplemented */
- #endif
-
-+#ifndef __no_const
-+# define __no_const
-+#endif
-+
- /*
- * Tell gcc if a function is cold. The compiler will assume any path
- * directly leading to the call is unlikely.
-@@ -256,6 +260,22 @@ void ftrace_likely_update(struct ftrace_
- #define __cold
- #endif
-
-+#ifndef __alloc_size
-+#define __alloc_size(...)
-+#endif
-+
-+#ifndef __bos
-+#define __bos(ptr, arg)
-+#endif
-+
-+#ifndef __bos0
-+#define __bos0(ptr)
-+#endif
-+
-+#ifndef __bos1
-+#define __bos1(ptr)
-+#endif
-+
- /* Simple shorthand for a section definition */
- #ifndef __section
- # define __section(S) __attribute__ ((__section__(#S)))
-@@ -278,6 +298,7 @@ void ftrace_likely_update(struct ftrace_
- * use is to mediate communication between process-level code and irq/NMI
- * handlers, all running on the same CPU.
- */
--#define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x))
-+#define ACCESS_ONCE(x) (*(volatile const typeof(x) *)&(x))
-+#define ACCESS_ONCE_RW(x) (*(volatile typeof(x) *)&(x))
-
- #endif /* __LINUX_COMPILER_H */
-diff -urNp linux-2.6.32.45/include/linux/crypto.h linux-2.6.32.45/include/linux/crypto.h
---- linux-2.6.32.45/include/linux/crypto.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/crypto.h 2011-08-05 20:33:55.000000000 -0400
-@@ -394,7 +394,7 @@ struct cipher_tfm {
- const u8 *key, unsigned int keylen);
- void (*cit_encrypt_one)(struct crypto_tfm *tfm, u8 *dst, const u8 *src);
- void (*cit_decrypt_one)(struct crypto_tfm *tfm, u8 *dst, const u8 *src);
--};
-+} __no_const;
-
- struct hash_tfm {
- int (*init)(struct hash_desc *desc);
-@@ -415,13 +415,13 @@ struct compress_tfm {
- int (*cot_decompress)(struct crypto_tfm *tfm,
- const u8 *src, unsigned int slen,
- u8 *dst, unsigned int *dlen);
--};
-+} __no_const;
-
- struct rng_tfm {
- int (*rng_gen_random)(struct crypto_rng *tfm, u8 *rdata,
- unsigned int dlen);
- int (*rng_reset)(struct crypto_rng *tfm, u8 *seed, unsigned int slen);
--};
-+} __no_const;
-
- #define crt_ablkcipher crt_u.ablkcipher
- #define crt_aead crt_u.aead
-diff -urNp linux-2.6.32.45/include/linux/dcache.h linux-2.6.32.45/include/linux/dcache.h
---- linux-2.6.32.45/include/linux/dcache.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/dcache.h 2011-04-23 13:34:46.000000000 -0400
-@@ -119,6 +119,8 @@ struct dentry {
- unsigned char d_iname[DNAME_INLINE_LEN_MIN]; /* small names */
- };
-
-+#define DNAME_INLINE_LEN (sizeof(struct dentry)-offsetof(struct dentry,d_iname))
-+
- /*
- * dentry->d_lock spinlock nesting subclasses:
- *
-diff -urNp linux-2.6.32.45/include/linux/decompress/mm.h linux-2.6.32.45/include/linux/decompress/mm.h
---- linux-2.6.32.45/include/linux/decompress/mm.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/decompress/mm.h 2011-04-17 15:56:46.000000000 -0400
-@@ -78,7 +78,7 @@ static void free(void *where)
- * warnings when not needed (indeed large_malloc / large_free are not
- * needed by inflate */
-
--#define malloc(a) kmalloc(a, GFP_KERNEL)
-+#define malloc(a) kmalloc((a), GFP_KERNEL)
- #define free(a) kfree(a)
-
- #define large_malloc(a) vmalloc(a)
-diff -urNp linux-2.6.32.45/include/linux/dma-mapping.h linux-2.6.32.45/include/linux/dma-mapping.h
---- linux-2.6.32.45/include/linux/dma-mapping.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/dma-mapping.h 2011-04-17 15:56:46.000000000 -0400
-@@ -16,50 +16,50 @@ enum dma_data_direction {
- };
-
- struct dma_map_ops {
-- void* (*alloc_coherent)(struct device *dev, size_t size,
-+ void* (* const alloc_coherent)(struct device *dev, size_t size,
- dma_addr_t *dma_handle, gfp_t gfp);
-- void (*free_coherent)(struct device *dev, size_t size,
-+ void (* const free_coherent)(struct device *dev, size_t size,
- void *vaddr, dma_addr_t dma_handle);
-- dma_addr_t (*map_page)(struct device *dev, struct page *page,
-+ dma_addr_t (* const map_page)(struct device *dev, struct page *page,
- unsigned long offset, size_t size,
- enum dma_data_direction dir,
- struct dma_attrs *attrs);
-- void (*unmap_page)(struct device *dev, dma_addr_t dma_handle,
-+ void (* const unmap_page)(struct device *dev, dma_addr_t dma_handle,
- size_t size, enum dma_data_direction dir,
- struct dma_attrs *attrs);
-- int (*map_sg)(struct device *dev, struct scatterlist *sg,
-+ int (* const map_sg)(struct device *dev, struct scatterlist *sg,
- int nents, enum dma_data_direction dir,
- struct dma_attrs *attrs);
-- void (*unmap_sg)(struct device *dev,
-+ void (* const unmap_sg)(struct device *dev,
- struct scatterlist *sg, int nents,
- enum dma_data_direction dir,
- struct dma_attrs *attrs);
-- void (*sync_single_for_cpu)(struct device *dev,
-+ void (* const sync_single_for_cpu)(struct device *dev,
- dma_addr_t dma_handle, size_t size,
- enum dma_data_direction dir);
-- void (*sync_single_for_device)(struct device *dev,
-+ void (* const sync_single_for_device)(struct device *dev,
- dma_addr_t dma_handle, size_t size,
- enum dma_data_direction dir);
-- void (*sync_single_range_for_cpu)(struct device *dev,
-+ void (* const sync_single_range_for_cpu)(struct device *dev,
- dma_addr_t dma_handle,
- unsigned long offset,
- size_t size,
- enum dma_data_direction dir);
-- void (*sync_single_range_for_device)(struct device *dev,
-+ void (* const sync_single_range_for_device)(struct device *dev,
- dma_addr_t dma_handle,
- unsigned long offset,
- size_t size,
- enum dma_data_direction dir);
-- void (*sync_sg_for_cpu)(struct device *dev,
-+ void (* const sync_sg_for_cpu)(struct device *dev,
- struct scatterlist *sg, int nents,
- enum dma_data_direction dir);
-- void (*sync_sg_for_device)(struct device *dev,
-+ void (* const sync_sg_for_device)(struct device *dev,
- struct scatterlist *sg, int nents,
- enum dma_data_direction dir);
-- int (*mapping_error)(struct device *dev, dma_addr_t dma_addr);
-- int (*dma_supported)(struct device *dev, u64 mask);
-+ int (* const mapping_error)(struct device *dev, dma_addr_t dma_addr);
-+ int (* const dma_supported)(struct device *dev, u64 mask);
- int (*set_dma_mask)(struct device *dev, u64 mask);
-- int is_phys;
-+ const int is_phys;
- };
-
- #define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
-diff -urNp linux-2.6.32.45/include/linux/dst.h linux-2.6.32.45/include/linux/dst.h
---- linux-2.6.32.45/include/linux/dst.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/dst.h 2011-04-17 15:56:46.000000000 -0400
-@@ -380,7 +380,7 @@ struct dst_node
- struct thread_pool *pool;
-
- /* Transaction IDs live here */
-- atomic_long_t gen;
-+ atomic_long_unchecked_t gen;
-
- /*
- * How frequently and how many times transaction
-diff -urNp linux-2.6.32.45/include/linux/elf.h linux-2.6.32.45/include/linux/elf.h
---- linux-2.6.32.45/include/linux/elf.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/elf.h 2011-04-17 15:56:46.000000000 -0400
-@@ -49,6 +49,17 @@ typedef __s64 Elf64_Sxword;
- #define PT_GNU_EH_FRAME 0x6474e550
-
- #define PT_GNU_STACK (PT_LOOS + 0x474e551)
-+#define PT_GNU_RELRO (PT_LOOS + 0x474e552)
-+
-+#define PT_PAX_FLAGS (PT_LOOS + 0x5041580)
-+
-+/* Constants for the e_flags field */
-+#define EF_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
-+#define EF_PAX_EMUTRAMP 2 /* Emulate trampolines */
-+#define EF_PAX_MPROTECT 4 /* Restrict mprotect() */
-+#define EF_PAX_RANDMMAP 8 /* Randomize mmap() base */
-+/*#define EF_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
-+#define EF_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
-
- /* These constants define the different elf file types */
- #define ET_NONE 0
-@@ -84,6 +95,8 @@ typedef __s64 Elf64_Sxword;
- #define DT_DEBUG 21
- #define DT_TEXTREL 22
- #define DT_JMPREL 23
-+#define DT_FLAGS 30
-+ #define DF_TEXTREL 0x00000004
- #define DT_ENCODING 32
- #define OLD_DT_LOOS 0x60000000
- #define DT_LOOS 0x6000000d
-@@ -230,6 +243,19 @@ typedef struct elf64_hdr {
- #define PF_W 0x2
- #define PF_X 0x1
-
-+#define PF_PAGEEXEC (1U << 4) /* Enable PAGEEXEC */
-+#define PF_NOPAGEEXEC (1U << 5) /* Disable PAGEEXEC */
-+#define PF_SEGMEXEC (1U << 6) /* Enable SEGMEXEC */
-+#define PF_NOSEGMEXEC (1U << 7) /* Disable SEGMEXEC */
-+#define PF_MPROTECT (1U << 8) /* Enable MPROTECT */
-+#define PF_NOMPROTECT (1U << 9) /* Disable MPROTECT */
-+/*#define PF_RANDEXEC (1U << 10)*/ /* Enable RANDEXEC */
-+/*#define PF_NORANDEXEC (1U << 11)*/ /* Disable RANDEXEC */
-+#define PF_EMUTRAMP (1U << 12) /* Enable EMUTRAMP */
-+#define PF_NOEMUTRAMP (1U << 13) /* Disable EMUTRAMP */
-+#define PF_RANDMMAP (1U << 14) /* Enable RANDMMAP */
-+#define PF_NORANDMMAP (1U << 15) /* Disable RANDMMAP */
-+
- typedef struct elf32_phdr{
- Elf32_Word p_type;
- Elf32_Off p_offset;
-@@ -322,6 +348,8 @@ typedef struct elf64_shdr {
- #define EI_OSABI 7
- #define EI_PAD 8
-
-+#define EI_PAX 14
-+
- #define ELFMAG0 0x7f /* EI_MAG */
- #define ELFMAG1 'E'
- #define ELFMAG2 'L'
-@@ -386,6 +414,7 @@ extern Elf32_Dyn _DYNAMIC [];
- #define elf_phdr elf32_phdr
- #define elf_note elf32_note
- #define elf_addr_t Elf32_Off
-+#define elf_dyn Elf32_Dyn
-
- #else
-
-@@ -394,6 +423,7 @@ extern Elf64_Dyn _DYNAMIC [];
- #define elf_phdr elf64_phdr
- #define elf_note elf64_note
- #define elf_addr_t Elf64_Off
-+#define elf_dyn Elf64_Dyn
-
- #endif
-
-diff -urNp linux-2.6.32.45/include/linux/fscache-cache.h linux-2.6.32.45/include/linux/fscache-cache.h
---- linux-2.6.32.45/include/linux/fscache-cache.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/fscache-cache.h 2011-05-04 17:56:28.000000000 -0400
-@@ -116,7 +116,7 @@ struct fscache_operation {
- #endif
- };
-
--extern atomic_t fscache_op_debug_id;
-+extern atomic_unchecked_t fscache_op_debug_id;
- extern const struct slow_work_ops fscache_op_slow_work_ops;
-
- extern void fscache_enqueue_operation(struct fscache_operation *);
-@@ -134,7 +134,7 @@ static inline void fscache_operation_ini
- fscache_operation_release_t release)
- {
- atomic_set(&op->usage, 1);
-- op->debug_id = atomic_inc_return(&fscache_op_debug_id);
-+ op->debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
- op->release = release;
- INIT_LIST_HEAD(&op->pend_link);
- fscache_set_op_state(op, "Init");
-diff -urNp linux-2.6.32.45/include/linux/fs.h linux-2.6.32.45/include/linux/fs.h
---- linux-2.6.32.45/include/linux/fs.h 2011-07-13 17:23:04.000000000 -0400
-+++ linux-2.6.32.45/include/linux/fs.h 2011-08-05 20:33:55.000000000 -0400
-@@ -90,6 +90,11 @@ struct inodes_stat_t {
- /* Expect random access pattern */
- #define FMODE_RANDOM ((__force fmode_t)4096)
-
-+/* Hack for grsec so as not to require read permission simply to execute
-+ * a binary
-+ */
-+#define FMODE_GREXEC ((__force fmode_t)0x2000000)
-+
- /*
- * The below are the various read and write types that we support. Some of
- * them include behavioral modifiers that send information down to the
-@@ -568,41 +573,41 @@ typedef int (*read_actor_t)(read_descrip
- unsigned long, unsigned long);
-
- struct address_space_operations {
-- int (*writepage)(struct page *page, struct writeback_control *wbc);
-- int (*readpage)(struct file *, struct page *);
-- void (*sync_page)(struct page *);
-+ int (* const writepage)(struct page *page, struct writeback_control *wbc);
-+ int (* const readpage)(struct file *, struct page *);
-+ void (* const sync_page)(struct page *);
-
- /* Write back some dirty pages from this mapping. */
-- int (*writepages)(struct address_space *, struct writeback_control *);
-+ int (* const writepages)(struct address_space *, struct writeback_control *);
-
- /* Set a page dirty. Return true if this dirtied it */
-- int (*set_page_dirty)(struct page *page);
-+ int (* const set_page_dirty)(struct page *page);
-
-- int (*readpages)(struct file *filp, struct address_space *mapping,
-+ int (* const readpages)(struct file *filp, struct address_space *mapping,
- struct list_head *pages, unsigned nr_pages);
-
-- int (*write_begin)(struct file *, struct address_space *mapping,
-+ int (* const write_begin)(struct file *, struct address_space *mapping,
- loff_t pos, unsigned len, unsigned flags,
- struct page **pagep, void **fsdata);
-- int (*write_end)(struct file *, struct address_space *mapping,
-+ int (* const write_end)(struct file *, struct address_space *mapping,
- loff_t pos, unsigned len, unsigned copied,
- struct page *page, void *fsdata);
-
- /* Unfortunately this kludge is needed for FIBMAP. Don't use it */
-- sector_t (*bmap)(struct address_space *, sector_t);
-- void (*invalidatepage) (struct page *, unsigned long);
-- int (*releasepage) (struct page *, gfp_t);
-- ssize_t (*direct_IO)(int, struct kiocb *, const struct iovec *iov,
-+ sector_t (* const bmap)(struct address_space *, sector_t);
-+ void (* const invalidatepage) (struct page *, unsigned long);
-+ int (* const releasepage) (struct page *, gfp_t);
-+ ssize_t (* const direct_IO)(int, struct kiocb *, const struct iovec *iov,
- loff_t offset, unsigned long nr_segs);
-- int (*get_xip_mem)(struct address_space *, pgoff_t, int,
-+ int (* const get_xip_mem)(struct address_space *, pgoff_t, int,
- void **, unsigned long *);
- /* migrate the contents of a page to the specified target */
-- int (*migratepage) (struct address_space *,
-+ int (* const migratepage) (struct address_space *,
- struct page *, struct page *);
-- int (*launder_page) (struct page *);
-- int (*is_partially_uptodate) (struct page *, read_descriptor_t *,
-+ int (* const launder_page) (struct page *);
-+ int (* const is_partially_uptodate) (struct page *, read_descriptor_t *,
- unsigned long);
-- int (*error_remove_page)(struct address_space *, struct page *);
-+ int (* const error_remove_page)(struct address_space *, struct page *);
- };
-
- /*
-@@ -1031,19 +1036,19 @@ static inline int file_check_writeable(s
- typedef struct files_struct *fl_owner_t;
-
- struct file_lock_operations {
-- void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
-- void (*fl_release_private)(struct file_lock *);
-+ void (* const fl_copy_lock)(struct file_lock *, struct file_lock *);
-+ void (* const fl_release_private)(struct file_lock *);
- };
-
- struct lock_manager_operations {
-- int (*fl_compare_owner)(struct file_lock *, struct file_lock *);
-- void (*fl_notify)(struct file_lock *); /* unblock callback */
-- int (*fl_grant)(struct file_lock *, struct file_lock *, int);
-- void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
-- void (*fl_release_private)(struct file_lock *);
-- void (*fl_break)(struct file_lock *);
-- int (*fl_mylease)(struct file_lock *, struct file_lock *);
-- int (*fl_change)(struct file_lock **, int);
-+ int (* const fl_compare_owner)(struct file_lock *, struct file_lock *);
-+ void (* const fl_notify)(struct file_lock *); /* unblock callback */
-+ int (* const fl_grant)(struct file_lock *, struct file_lock *, int);
-+ void (* const fl_copy_lock)(struct file_lock *, struct file_lock *);
-+ void (* const fl_release_private)(struct file_lock *);
-+ void (* const fl_break)(struct file_lock *);
-+ int (* const fl_mylease)(struct file_lock *, struct file_lock *);
-+ int (* const fl_change)(struct file_lock **, int);
- };
-
- struct lock_manager {
-@@ -1442,7 +1447,7 @@ struct fiemap_extent_info {
- unsigned int fi_flags; /* Flags as passed from user */
- unsigned int fi_extents_mapped; /* Number of mapped extents */
- unsigned int fi_extents_max; /* Size of fiemap_extent array */
-- struct fiemap_extent *fi_extents_start; /* Start of fiemap_extent
-+ struct fiemap_extent __user *fi_extents_start; /* Start of fiemap_extent
- * array */
- };
- int fiemap_fill_next_extent(struct fiemap_extent_info *info, u64 logical,
-@@ -1486,7 +1491,7 @@ struct block_device_operations;
- * can be called without the big kernel lock held in all filesystems.
- */
- struct file_operations {
-- struct module *owner;
-+ struct module * const owner;
- loff_t (*llseek) (struct file *, loff_t, int);
- ssize_t (*read) (struct file *, char __user *, size_t, loff_t *);
- ssize_t (*write) (struct file *, const char __user *, size_t, loff_t *);
-@@ -1559,30 +1564,30 @@ extern ssize_t vfs_writev(struct file *,
- unsigned long, loff_t *);
-
- struct super_operations {
-- struct inode *(*alloc_inode)(struct super_block *sb);
-- void (*destroy_inode)(struct inode *);
-+ struct inode *(* const alloc_inode)(struct super_block *sb);
-+ void (* const destroy_inode)(struct inode *);
-
-- void (*dirty_inode) (struct inode *);
-- int (*write_inode) (struct inode *, int);
-- void (*drop_inode) (struct inode *);
-- void (*delete_inode) (struct inode *);
-- void (*put_super) (struct super_block *);
-- void (*write_super) (struct super_block *);
-- int (*sync_fs)(struct super_block *sb, int wait);
-- int (*freeze_fs) (struct super_block *);
-- int (*unfreeze_fs) (struct super_block *);
-- int (*statfs) (struct dentry *, struct kstatfs *);
-- int (*remount_fs) (struct super_block *, int *, char *);
-- void (*clear_inode) (struct inode *);
-- void (*umount_begin) (struct super_block *);
-+ void (* const dirty_inode) (struct inode *);
-+ int (* const write_inode) (struct inode *, int);
-+ void (* const drop_inode) (struct inode *);
-+ void (* const delete_inode) (struct inode *);
-+ void (* const put_super) (struct super_block *);
-+ void (* const write_super) (struct super_block *);
-+ int (* const sync_fs)(struct super_block *sb, int wait);
-+ int (* const freeze_fs) (struct super_block *);
-+ int (* const unfreeze_fs) (struct super_block *);
-+ int (* const statfs) (struct dentry *, struct kstatfs *);
-+ int (* const remount_fs) (struct super_block *, int *, char *);
-+ void (* const clear_inode) (struct inode *);
-+ void (* const umount_begin) (struct super_block *);
-
-- int (*show_options)(struct seq_file *, struct vfsmount *);
-- int (*show_stats)(struct seq_file *, struct vfsmount *);
-+ int (* const show_options)(struct seq_file *, struct vfsmount *);
-+ int (* const show_stats)(struct seq_file *, struct vfsmount *);
- #ifdef CONFIG_QUOTA
-- ssize_t (*quota_read)(struct super_block *, int, char *, size_t, loff_t);
-- ssize_t (*quota_write)(struct super_block *, int, const char *, size_t, loff_t);
-+ ssize_t (* const quota_read)(struct super_block *, int, char *, size_t, loff_t);
-+ ssize_t (* const quota_write)(struct super_block *, int, const char *, size_t, loff_t);
- #endif
-- int (*bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
-+ int (* const bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
- };
-
- /*
-diff -urNp linux-2.6.32.45/include/linux/fs_struct.h linux-2.6.32.45/include/linux/fs_struct.h
---- linux-2.6.32.45/include/linux/fs_struct.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/fs_struct.h 2011-04-17 15:56:46.000000000 -0400
-@@ -4,7 +4,7 @@
- #include <linux/path.h>
-
- struct fs_struct {
-- int users;
-+ atomic_t users;
- rwlock_t lock;
- int umask;
- int in_exec;
-diff -urNp linux-2.6.32.45/include/linux/ftrace_event.h linux-2.6.32.45/include/linux/ftrace_event.h
---- linux-2.6.32.45/include/linux/ftrace_event.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/ftrace_event.h 2011-05-04 17:56:28.000000000 -0400
-@@ -163,7 +163,7 @@ extern int trace_define_field(struct ftr
- int filter_type);
- extern int trace_define_common_fields(struct ftrace_event_call *call);
-
--#define is_signed_type(type) (((type)(-1)) < 0)
-+#define is_signed_type(type) (((type)(-1)) < (type)1)
-
- int trace_set_clr_event(const char *system, const char *event, int set);
-
-diff -urNp linux-2.6.32.45/include/linux/genhd.h linux-2.6.32.45/include/linux/genhd.h
---- linux-2.6.32.45/include/linux/genhd.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/genhd.h 2011-04-17 15:56:46.000000000 -0400
-@@ -161,7 +161,7 @@ struct gendisk {
-
- struct timer_rand_state *random;
-
-- atomic_t sync_io; /* RAID */
-+ atomic_unchecked_t sync_io; /* RAID */
- struct work_struct async_notify;
- #ifdef CONFIG_BLK_DEV_INTEGRITY
- struct blk_integrity *integrity;
-diff -urNp linux-2.6.32.45/include/linux/gracl.h linux-2.6.32.45/include/linux/gracl.h
---- linux-2.6.32.45/include/linux/gracl.h 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/include/linux/gracl.h 2011-04-17 15:56:46.000000000 -0400
-@@ -0,0 +1,317 @@
-+#ifndef GR_ACL_H
-+#define GR_ACL_H
-+
-+#include <linux/grdefs.h>
-+#include <linux/resource.h>
-+#include <linux/capability.h>
-+#include <linux/dcache.h>
-+#include <asm/resource.h>
-+
-+/* Major status information */
-+
-+#define GR_VERSION "grsecurity 2.2.2"
-+#define GRSECURITY_VERSION 0x2202
-+
-+enum {
-+ GR_SHUTDOWN = 0,
-+ GR_ENABLE = 1,
-+ GR_SPROLE = 2,
-+ GR_RELOAD = 3,
-+ GR_SEGVMOD = 4,
-+ GR_STATUS = 5,
-+ GR_UNSPROLE = 6,
-+ GR_PASSSET = 7,
-+ GR_SPROLEPAM = 8,
-+};
-+
-+/* Password setup definitions
-+ * kernel/grhash.c */
-+enum {
-+ GR_PW_LEN = 128,
-+ GR_SALT_LEN = 16,
-+ GR_SHA_LEN = 32,
-+};
-+
-+enum {
-+ GR_SPROLE_LEN = 64,
-+};
-+
-+enum {
-+ GR_NO_GLOB = 0,
-+ GR_REG_GLOB,
-+ GR_CREATE_GLOB
-+};
-+
-+#define GR_NLIMITS 32
-+
-+/* Begin Data Structures */
-+
-+struct sprole_pw {
-+ unsigned char *rolename;
-+ unsigned char salt[GR_SALT_LEN];
-+ unsigned char sum[GR_SHA_LEN]; /* 256-bit SHA hash of the password */
-+};
-+
-+struct name_entry {
-+ __u32 key;
-+ ino_t inode;
-+ dev_t device;
-+ char *name;
-+ __u16 len;
-+ __u8 deleted;
-+ struct name_entry *prev;
-+ struct name_entry *next;
-+};
-+
-+struct inodev_entry {
-+ struct name_entry *nentry;
-+ struct inodev_entry *prev;
-+ struct inodev_entry *next;
-+};
-+
-+struct acl_role_db {
-+ struct acl_role_label **r_hash;
-+ __u32 r_size;
-+};
-+
-+struct inodev_db {
-+ struct inodev_entry **i_hash;
-+ __u32 i_size;
-+};
-+
-+struct name_db {
-+ struct name_entry **n_hash;
-+ __u32 n_size;
-+};
-+
-+struct crash_uid {
-+ uid_t uid;
-+ unsigned long expires;
-+};
-+
-+struct gr_hash_struct {
-+ void **table;
-+ void **nametable;
-+ void *first;
-+ __u32 table_size;
-+ __u32 used_size;
-+ int type;
-+};
-+
-+/* Userspace Grsecurity ACL data structures */
-+
-+struct acl_subject_label {
-+ char *filename;
-+ ino_t inode;
-+ dev_t device;
-+ __u32 mode;
-+ kernel_cap_t cap_mask;
-+ kernel_cap_t cap_lower;
-+ kernel_cap_t cap_invert_audit;
-+
-+ struct rlimit res[GR_NLIMITS];
-+ __u32 resmask;
-+
-+ __u8 user_trans_type;
-+ __u8 group_trans_type;
-+ uid_t *user_transitions;
-+ gid_t *group_transitions;
-+ __u16 user_trans_num;
-+ __u16 group_trans_num;
-+
-+ __u32 sock_families[2];
-+ __u32 ip_proto[8];
-+ __u32 ip_type;
-+ struct acl_ip_label **ips;
-+ __u32 ip_num;
-+ __u32 inaddr_any_override;
-+
-+ __u32 crashes;
-+ unsigned long expires;
-+
-+ struct acl_subject_label *parent_subject;
-+ struct gr_hash_struct *hash;
-+ struct acl_subject_label *prev;
-+ struct acl_subject_label *next;
-+
-+ struct acl_object_label **obj_hash;
-+ __u32 obj_hash_size;
-+ __u16 pax_flags;
-+};
-+
-+struct role_allowed_ip {
-+ __u32 addr;
-+ __u32 netmask;
-+
-+ struct role_allowed_ip *prev;
-+ struct role_allowed_ip *next;
-+};
-+
-+struct role_transition {
-+ char *rolename;
-+
-+ struct role_transition *prev;
-+ struct role_transition *next;
-+};
-+
-+struct acl_role_label {
-+ char *rolename;
-+ uid_t uidgid;
-+ __u16 roletype;
-+
-+ __u16 auth_attempts;
-+ unsigned long expires;
-+
-+ struct acl_subject_label *root_label;
-+ struct gr_hash_struct *hash;
-+
-+ struct acl_role_label *prev;
-+ struct acl_role_label *next;
-+
-+ struct role_transition *transitions;
-+ struct role_allowed_ip *allowed_ips;
-+ uid_t *domain_children;
-+ __u16 domain_child_num;
-+
-+ struct acl_subject_label **subj_hash;
-+ __u32 subj_hash_size;
-+};
-+
-+struct user_acl_role_db {
-+ struct acl_role_label **r_table;
-+ __u32 num_pointers; /* Number of allocations to track */
-+ __u32 num_roles; /* Number of roles */
-+ __u32 num_domain_children; /* Number of domain children */
-+ __u32 num_subjects; /* Number of subjects */
-+ __u32 num_objects; /* Number of objects */
-+};
-+
-+struct acl_object_label {
-+ char *filename;
-+ ino_t inode;
-+ dev_t device;
-+ __u32 mode;
-+
-+ struct acl_subject_label *nested;
-+ struct acl_object_label *globbed;
-+
-+ /* next two structures not used */
-+
-+ struct acl_object_label *prev;
-+ struct acl_object_label *next;
-+};
-+
-+struct acl_ip_label {
-+ char *iface;
-+ __u32 addr;
-+ __u32 netmask;
-+ __u16 low, high;
-+ __u8 mode;
-+ __u32 type;
-+ __u32 proto[8];
-+
-+ /* next two structures not used */
-+
-+ struct acl_ip_label *prev;
-+ struct acl_ip_label *next;
-+};
-+
-+struct gr_arg {
-+ struct user_acl_role_db role_db;
-+ unsigned char pw[GR_PW_LEN];
-+ unsigned char salt[GR_SALT_LEN];
-+ unsigned char sum[GR_SHA_LEN];
-+ unsigned char sp_role[GR_SPROLE_LEN];
-+ struct sprole_pw *sprole_pws;
-+ dev_t segv_device;
-+ ino_t segv_inode;
-+ uid_t segv_uid;
-+ __u16 num_sprole_pws;
-+ __u16 mode;
-+};
-+
-+struct gr_arg_wrapper {
-+ struct gr_arg *arg;
-+ __u32 version;
-+ __u32 size;
-+};
-+
-+struct subject_map {
-+ struct acl_subject_label *user;
-+ struct acl_subject_label *kernel;
-+ struct subject_map *prev;
-+ struct subject_map *next;
-+};
-+
-+struct acl_subj_map_db {
-+ struct subject_map **s_hash;
-+ __u32 s_size;
-+};
-+
-+/* End Data Structures Section */
-+
-+/* Hash functions generated by empirical testing by Brad Spengler
-+ Makes good use of the low bits of the inode. Generally 0-1 times
-+ in loop for successful match. 0-3 for unsuccessful match.
-+ Shift/add algorithm with modulus of table size and an XOR*/
-+
-+static __inline__ unsigned int
-+rhash(const uid_t uid, const __u16 type, const unsigned int sz)
-+{
-+ return ((((uid + type) << (16 + type)) ^ uid) % sz);
-+}
-+
-+ static __inline__ unsigned int
-+shash(const struct acl_subject_label *userp, const unsigned int sz)
-+{
-+ return ((const unsigned long)userp % sz);
-+}
-+
-+static __inline__ unsigned int
-+fhash(const ino_t ino, const dev_t dev, const unsigned int sz)
-+{
-+ return (((ino + dev) ^ ((ino << 13) + (ino << 23) + (dev << 9))) % sz);
-+}
-+
-+static __inline__ unsigned int
-+nhash(const char *name, const __u16 len, const unsigned int sz)
-+{
-+ return full_name_hash((const unsigned char *)name, len) % sz;
-+}
-+
-+#define FOR_EACH_ROLE_START(role) \
-+ role = role_list; \
-+ while (role) {
-+
-+#define FOR_EACH_ROLE_END(role) \
-+ role = role->prev; \
-+ }
-+
-+#define FOR_EACH_SUBJECT_START(role,subj,iter) \
-+ subj = NULL; \
-+ iter = 0; \
-+ while (iter < role->subj_hash_size) { \
-+ if (subj == NULL) \
-+ subj = role->subj_hash[iter]; \
-+ if (subj == NULL) { \
-+ iter++; \
-+ continue; \
-+ }
-+
-+#define FOR_EACH_SUBJECT_END(subj,iter) \
-+ subj = subj->next; \
-+ if (subj == NULL) \
-+ iter++; \
-+ }
-+
-+
-+#define FOR_EACH_NESTED_SUBJECT_START(role,subj) \
-+ subj = role->hash->first; \
-+ while (subj != NULL) {
-+
-+#define FOR_EACH_NESTED_SUBJECT_END(subj) \
-+ subj = subj->next; \
-+ }
-+
-+#endif
-+
-diff -urNp linux-2.6.32.45/include/linux/gralloc.h linux-2.6.32.45/include/linux/gralloc.h
---- linux-2.6.32.45/include/linux/gralloc.h 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/include/linux/gralloc.h 2011-04-17 15:56:46.000000000 -0400
-@@ -0,0 +1,9 @@
-+#ifndef __GRALLOC_H
-+#define __GRALLOC_H
-+
-+void acl_free_all(void);
-+int acl_alloc_stack_init(unsigned long size);
-+void *acl_alloc(unsigned long len);
-+void *acl_alloc_num(unsigned long num, unsigned long len);
-+
-+#endif
-diff -urNp linux-2.6.32.45/include/linux/grdefs.h linux-2.6.32.45/include/linux/grdefs.h
---- linux-2.6.32.45/include/linux/grdefs.h 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/include/linux/grdefs.h 2011-06-11 16:20:26.000000000 -0400
-@@ -0,0 +1,140 @@
-+#ifndef GRDEFS_H
-+#define GRDEFS_H
-+
-+/* Begin grsecurity status declarations */
-+
-+enum {
-+ GR_READY = 0x01,
-+ GR_STATUS_INIT = 0x00 // disabled state
-+};
-+
-+/* Begin ACL declarations */
-+
-+/* Role flags */
-+
-+enum {
-+ GR_ROLE_USER = 0x0001,
-+ GR_ROLE_GROUP = 0x0002,
-+ GR_ROLE_DEFAULT = 0x0004,
-+ GR_ROLE_SPECIAL = 0x0008,
-+ GR_ROLE_AUTH = 0x0010,
-+ GR_ROLE_NOPW = 0x0020,
-+ GR_ROLE_GOD = 0x0040,
-+ GR_ROLE_LEARN = 0x0080,
-+ GR_ROLE_TPE = 0x0100,
-+ GR_ROLE_DOMAIN = 0x0200,
-+ GR_ROLE_PAM = 0x0400,
-+ GR_ROLE_PERSIST = 0x800
-+};
-+
-+/* ACL Subject and Object mode flags */
-+enum {
-+ GR_DELETED = 0x80000000
-+};
-+
-+/* ACL Object-only mode flags */
-+enum {
-+ GR_READ = 0x00000001,
-+ GR_APPEND = 0x00000002,
-+ GR_WRITE = 0x00000004,
-+ GR_EXEC = 0x00000008,
-+ GR_FIND = 0x00000010,
-+ GR_INHERIT = 0x00000020,
-+ GR_SETID = 0x00000040,
-+ GR_CREATE = 0x00000080,
-+ GR_DELETE = 0x00000100,
-+ GR_LINK = 0x00000200,
-+ GR_AUDIT_READ = 0x00000400,
-+ GR_AUDIT_APPEND = 0x00000800,
-+ GR_AUDIT_WRITE = 0x00001000,
-+ GR_AUDIT_EXEC = 0x00002000,
-+ GR_AUDIT_FIND = 0x00004000,
-+ GR_AUDIT_INHERIT= 0x00008000,
-+ GR_AUDIT_SETID = 0x00010000,
-+ GR_AUDIT_CREATE = 0x00020000,
-+ GR_AUDIT_DELETE = 0x00040000,
-+ GR_AUDIT_LINK = 0x00080000,
-+ GR_PTRACERD = 0x00100000,
-+ GR_NOPTRACE = 0x00200000,
-+ GR_SUPPRESS = 0x00400000,
-+ GR_NOLEARN = 0x00800000,
-+ GR_INIT_TRANSFER= 0x01000000
-+};
-+
-+#define GR_AUDITS (GR_AUDIT_READ | GR_AUDIT_WRITE | GR_AUDIT_APPEND | GR_AUDIT_EXEC | \
-+ GR_AUDIT_FIND | GR_AUDIT_INHERIT | GR_AUDIT_SETID | \
-+ GR_AUDIT_CREATE | GR_AUDIT_DELETE | GR_AUDIT_LINK)
-+
-+/* ACL subject-only mode flags */
-+enum {
-+ GR_KILL = 0x00000001,
-+ GR_VIEW = 0x00000002,
-+ GR_PROTECTED = 0x00000004,
-+ GR_LEARN = 0x00000008,
-+ GR_OVERRIDE = 0x00000010,
-+ /* just a placeholder, this mode is only used in userspace */
-+ GR_DUMMY = 0x00000020,
-+ GR_PROTSHM = 0x00000040,
-+ GR_KILLPROC = 0x00000080,
-+ GR_KILLIPPROC = 0x00000100,
-+ /* just a placeholder, this mode is only used in userspace */
-+ GR_NOTROJAN = 0x00000200,
-+ GR_PROTPROCFD = 0x00000400,
-+ GR_PROCACCT = 0x00000800,
-+ GR_RELAXPTRACE = 0x00001000,
-+ GR_NESTED = 0x00002000,
-+ GR_INHERITLEARN = 0x00004000,
-+ GR_PROCFIND = 0x00008000,
-+ GR_POVERRIDE = 0x00010000,
-+ GR_KERNELAUTH = 0x00020000,
-+ GR_ATSECURE = 0x00040000,
-+ GR_SHMEXEC = 0x00080000
-+};
-+
-+enum {
-+ GR_PAX_ENABLE_SEGMEXEC = 0x0001,
-+ GR_PAX_ENABLE_PAGEEXEC = 0x0002,
-+ GR_PAX_ENABLE_MPROTECT = 0x0004,
-+ GR_PAX_ENABLE_RANDMMAP = 0x0008,
-+ GR_PAX_ENABLE_EMUTRAMP = 0x0010,
-+ GR_PAX_DISABLE_SEGMEXEC = 0x0100,
-+ GR_PAX_DISABLE_PAGEEXEC = 0x0200,
-+ GR_PAX_DISABLE_MPROTECT = 0x0400,
-+ GR_PAX_DISABLE_RANDMMAP = 0x0800,
-+ GR_PAX_DISABLE_EMUTRAMP = 0x1000,
-+};
-+
-+enum {
-+ GR_ID_USER = 0x01,
-+ GR_ID_GROUP = 0x02,
-+};
-+
-+enum {
-+ GR_ID_ALLOW = 0x01,
-+ GR_ID_DENY = 0x02,
-+};
-+
-+#define GR_CRASH_RES 31
-+#define GR_UIDTABLE_MAX 500
-+
-+/* begin resource learning section */
-+enum {
-+ GR_RLIM_CPU_BUMP = 60,
-+ GR_RLIM_FSIZE_BUMP = 50000,
-+ GR_RLIM_DATA_BUMP = 10000,
-+ GR_RLIM_STACK_BUMP = 1000,
-+ GR_RLIM_CORE_BUMP = 10000,
-+ GR_RLIM_RSS_BUMP = 500000,
-+ GR_RLIM_NPROC_BUMP = 1,
-+ GR_RLIM_NOFILE_BUMP = 5,
-+ GR_RLIM_MEMLOCK_BUMP = 50000,
-+ GR_RLIM_AS_BUMP = 500000,
-+ GR_RLIM_LOCKS_BUMP = 2,
-+ GR_RLIM_SIGPENDING_BUMP = 5,
-+ GR_RLIM_MSGQUEUE_BUMP = 10000,
-+ GR_RLIM_NICE_BUMP = 1,
-+ GR_RLIM_RTPRIO_BUMP = 1,
-+ GR_RLIM_RTTIME_BUMP = 1000000
-+};
-+
-+#endif
-diff -urNp linux-2.6.32.45/include/linux/grinternal.h linux-2.6.32.45/include/linux/grinternal.h
---- linux-2.6.32.45/include/linux/grinternal.h 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/include/linux/grinternal.h 2011-08-11 19:58:37.000000000 -0400
-@@ -0,0 +1,217 @@
-+#ifndef __GRINTERNAL_H
-+#define __GRINTERNAL_H
-+
-+#ifdef CONFIG_GRKERNSEC
-+
-+#include <linux/fs.h>
-+#include <linux/mnt_namespace.h>
-+#include <linux/nsproxy.h>
-+#include <linux/gracl.h>
-+#include <linux/grdefs.h>
-+#include <linux/grmsg.h>
-+
-+void gr_add_learn_entry(const char *fmt, ...)
-+ __attribute__ ((format (printf, 1, 2)));
-+__u32 gr_search_file(const struct dentry *dentry, const __u32 mode,
-+ const struct vfsmount *mnt);
-+__u32 gr_check_create(const struct dentry *new_dentry,
-+ const struct dentry *parent,
-+ const struct vfsmount *mnt, const __u32 mode);
-+int gr_check_protected_task(const struct task_struct *task);
-+__u32 to_gr_audit(const __u32 reqmode);
-+int gr_set_acls(const int type);
-+int gr_apply_subject_to_task(struct task_struct *task);
-+int gr_acl_is_enabled(void);
-+char gr_roletype_to_char(void);
-+
-+void gr_handle_alertkill(struct task_struct *task);
-+char *gr_to_filename(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+char *gr_to_filename1(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+char *gr_to_filename2(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+char *gr_to_filename3(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+
-+extern int grsec_enable_harden_ptrace;
-+extern int grsec_enable_link;
-+extern int grsec_enable_fifo;
-+extern int grsec_enable_shm;
-+extern int grsec_enable_execlog;
-+extern int grsec_enable_signal;
-+extern int grsec_enable_audit_ptrace;
-+extern int grsec_enable_forkfail;
-+extern int grsec_enable_time;
-+extern int grsec_enable_rofs;
-+extern int grsec_enable_chroot_shmat;
-+extern int grsec_enable_chroot_mount;
-+extern int grsec_enable_chroot_double;
-+extern int grsec_enable_chroot_pivot;
-+extern int grsec_enable_chroot_chdir;
-+extern int grsec_enable_chroot_chmod;
-+extern int grsec_enable_chroot_mknod;
-+extern int grsec_enable_chroot_fchdir;
-+extern int grsec_enable_chroot_nice;
-+extern int grsec_enable_chroot_execlog;
-+extern int grsec_enable_chroot_caps;
-+extern int grsec_enable_chroot_sysctl;
-+extern int grsec_enable_chroot_unix;
-+extern int grsec_enable_tpe;
-+extern int grsec_tpe_gid;
-+extern int grsec_enable_tpe_all;
-+extern int grsec_enable_tpe_invert;
-+extern int grsec_enable_socket_all;
-+extern int grsec_socket_all_gid;
-+extern int grsec_enable_socket_client;
-+extern int grsec_socket_client_gid;
-+extern int grsec_enable_socket_server;
-+extern int grsec_socket_server_gid;
-+extern int grsec_audit_gid;
-+extern int grsec_enable_group;
-+extern int grsec_enable_audit_textrel;
-+extern int grsec_enable_log_rwxmaps;
-+extern int grsec_enable_mount;
-+extern int grsec_enable_chdir;
-+extern int grsec_resource_logging;
-+extern int grsec_enable_blackhole;
-+extern int grsec_lastack_retries;
-+extern int grsec_enable_brute;
-+extern int grsec_lock;
-+
-+extern spinlock_t grsec_alert_lock;
-+extern unsigned long grsec_alert_wtime;
-+extern unsigned long grsec_alert_fyet;
-+
-+extern spinlock_t grsec_audit_lock;
-+
-+extern rwlock_t grsec_exec_file_lock;
-+
-+#define gr_task_fullpath(tsk) ((tsk)->exec_file ? \
-+ gr_to_filename2((tsk)->exec_file->f_path.dentry, \
-+ (tsk)->exec_file->f_vfsmnt) : "/")
-+
-+#define gr_parent_task_fullpath(tsk) ((tsk)->real_parent->exec_file ? \
-+ gr_to_filename3((tsk)->real_parent->exec_file->f_path.dentry, \
-+ (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
-+
-+#define gr_task_fullpath0(tsk) ((tsk)->exec_file ? \
-+ gr_to_filename((tsk)->exec_file->f_path.dentry, \
-+ (tsk)->exec_file->f_vfsmnt) : "/")
-+
-+#define gr_parent_task_fullpath0(tsk) ((tsk)->real_parent->exec_file ? \
-+ gr_to_filename1((tsk)->real_parent->exec_file->f_path.dentry, \
-+ (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
-+
-+#define proc_is_chrooted(tsk_a) ((tsk_a)->gr_is_chrooted)
-+
-+#define have_same_root(tsk_a,tsk_b) ((tsk_a)->gr_chroot_dentry == (tsk_b)->gr_chroot_dentry)
-+
-+#define DEFAULTSECARGS(task, cred, pcred) gr_task_fullpath(task), (task)->comm, \
-+ (task)->pid, (cred)->uid, \
-+ (cred)->euid, (cred)->gid, (cred)->egid, \
-+ gr_parent_task_fullpath(task), \
-+ (task)->real_parent->comm, (task)->real_parent->pid, \
-+ (pcred)->uid, (pcred)->euid, \
-+ (pcred)->gid, (pcred)->egid
-+
-+#define GR_CHROOT_CAPS {{ \
-+ CAP_TO_MASK(CAP_LINUX_IMMUTABLE) | CAP_TO_MASK(CAP_NET_ADMIN) | \
-+ CAP_TO_MASK(CAP_SYS_MODULE) | CAP_TO_MASK(CAP_SYS_RAWIO) | \
-+ CAP_TO_MASK(CAP_SYS_PACCT) | CAP_TO_MASK(CAP_SYS_ADMIN) | \
-+ CAP_TO_MASK(CAP_SYS_BOOT) | CAP_TO_MASK(CAP_SYS_TIME) | \
-+ CAP_TO_MASK(CAP_NET_RAW) | CAP_TO_MASK(CAP_SYS_TTY_CONFIG) | \
-+ CAP_TO_MASK(CAP_IPC_OWNER) , 0 }}
-+
-+#define security_learn(normal_msg,args...) \
-+({ \
-+ read_lock(&grsec_exec_file_lock); \
-+ gr_add_learn_entry(normal_msg "\n", ## args); \
-+ read_unlock(&grsec_exec_file_lock); \
-+})
-+
-+enum {
-+ GR_DO_AUDIT,
-+ GR_DONT_AUDIT,
-+ GR_DONT_AUDIT_GOOD
-+};
-+
-+enum {
-+ GR_TTYSNIFF,
-+ GR_RBAC,
-+ GR_RBAC_STR,
-+ GR_STR_RBAC,
-+ GR_RBAC_MODE2,
-+ GR_RBAC_MODE3,
-+ GR_FILENAME,
-+ GR_SYSCTL_HIDDEN,
-+ GR_NOARGS,
-+ GR_ONE_INT,
-+ GR_ONE_INT_TWO_STR,
-+ GR_ONE_STR,
-+ GR_STR_INT,
-+ GR_TWO_STR_INT,
-+ GR_TWO_INT,
-+ GR_TWO_U64,
-+ GR_THREE_INT,
-+ GR_FIVE_INT_TWO_STR,
-+ GR_TWO_STR,
-+ GR_THREE_STR,
-+ GR_FOUR_STR,
-+ GR_STR_FILENAME,
-+ GR_FILENAME_STR,
-+ GR_FILENAME_TWO_INT,
-+ GR_FILENAME_TWO_INT_STR,
-+ GR_TEXTREL,
-+ GR_PTRACE,
-+ GR_RESOURCE,
-+ GR_CAP,
-+ GR_SIG,
-+ GR_SIG2,
-+ GR_CRASH1,
-+ GR_CRASH2,
-+ GR_PSACCT,
-+ GR_RWXMAP
-+};
-+
-+#define gr_log_hidden_sysctl(audit, msg, str) gr_log_varargs(audit, msg, GR_SYSCTL_HIDDEN, str)
-+#define gr_log_ttysniff(audit, msg, task) gr_log_varargs(audit, msg, GR_TTYSNIFF, task)
-+#define gr_log_fs_rbac_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_RBAC, dentry, mnt)
-+#define gr_log_fs_rbac_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_RBAC_STR, dentry, mnt, str)
-+#define gr_log_fs_str_rbac(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_RBAC, str, dentry, mnt)
-+#define gr_log_fs_rbac_mode2(audit, msg, dentry, mnt, str1, str2) gr_log_varargs(audit, msg, GR_RBAC_MODE2, dentry, mnt, str1, str2)
-+#define gr_log_fs_rbac_mode3(audit, msg, dentry, mnt, str1, str2, str3) gr_log_varargs(audit, msg, GR_RBAC_MODE3, dentry, mnt, str1, str2, str3)
-+#define gr_log_fs_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_FILENAME, dentry, mnt)
-+#define gr_log_noargs(audit, msg) gr_log_varargs(audit, msg, GR_NOARGS)
-+#define gr_log_int(audit, msg, num) gr_log_varargs(audit, msg, GR_ONE_INT, num)
-+#define gr_log_int_str2(audit, msg, num, str1, str2) gr_log_varargs(audit, msg, GR_ONE_INT_TWO_STR, num, str1, str2)
-+#define gr_log_str(audit, msg, str) gr_log_varargs(audit, msg, GR_ONE_STR, str)
-+#define gr_log_str_int(audit, msg, str, num) gr_log_varargs(audit, msg, GR_STR_INT, str, num)
-+#define gr_log_int_int(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_INT, num1, num2)
-+#define gr_log_two_u64(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_U64, num1, num2)
-+#define gr_log_int3(audit, msg, num1, num2, num3) gr_log_varargs(audit, msg, GR_THREE_INT, num1, num2, num3)
-+#define gr_log_int5_str2(audit, msg, num1, num2, str1, str2) gr_log_varargs(audit, msg, GR_FIVE_INT_TWO_STR, num1, num2, str1, str2)
-+#define gr_log_str_str(audit, msg, str1, str2) gr_log_varargs(audit, msg, GR_TWO_STR, str1, str2)
-+#define gr_log_str2_int(audit, msg, str1, str2, num) gr_log_varargs(audit, msg, GR_TWO_STR_INT, str1, str2, num)
-+#define gr_log_str3(audit, msg, str1, str2, str3) gr_log_varargs(audit, msg, GR_THREE_STR, str1, str2, str3)
-+#define gr_log_str4(audit, msg, str1, str2, str3, str4) gr_log_varargs(audit, msg, GR_FOUR_STR, str1, str2, str3, str4)
-+#define gr_log_str_fs(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_FILENAME, str, dentry, mnt)
-+#define gr_log_fs_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_FILENAME_STR, dentry, mnt, str)
-+#define gr_log_fs_int2(audit, msg, dentry, mnt, num1, num2) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT, dentry, mnt, num1, num2)
-+#define gr_log_fs_int2_str(audit, msg, dentry, mnt, num1, num2, str) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT_STR, dentry, mnt, num1, num2, str)
-+#define gr_log_textrel_ulong_ulong(audit, msg, file, ulong1, ulong2) gr_log_varargs(audit, msg, GR_TEXTREL, file, ulong1, ulong2)
-+#define gr_log_ptrace(audit, msg, task) gr_log_varargs(audit, msg, GR_PTRACE, task)
-+#define gr_log_res_ulong2_str(audit, msg, task, ulong1, str, ulong2) gr_log_varargs(audit, msg, GR_RESOURCE, task, ulong1, str, ulong2)
-+#define gr_log_cap(audit, msg, task, str) gr_log_varargs(audit, msg, GR_CAP, task, str)
-+#define gr_log_sig_addr(audit, msg, str, addr) gr_log_varargs(audit, msg, GR_SIG, str, addr)
-+#define gr_log_sig_task(audit, msg, task, num) gr_log_varargs(audit, msg, GR_SIG2, task, num)
-+#define gr_log_crash1(audit, msg, task, ulong) gr_log_varargs(audit, msg, GR_CRASH1, task, ulong)
-+#define gr_log_crash2(audit, msg, task, ulong1) gr_log_varargs(audit, msg, GR_CRASH2, task, ulong1)
-+#define gr_log_procacct(audit, msg, task, num1, num2, num3, num4, num5, num6, num7, num8, num9) gr_log_varargs(audit, msg, GR_PSACCT, task, num1, num2, num3, num4, num5, num6, num7, num8, num9)
-+#define gr_log_rwxmap(audit, msg, str) gr_log_varargs(audit, msg, GR_RWXMAP, str)
-+
-+void gr_log_varargs(int audit, const char *msg, int argtypes, ...);
-+
-+#endif
-+
-+#endif
-diff -urNp linux-2.6.32.45/include/linux/grmsg.h linux-2.6.32.45/include/linux/grmsg.h
---- linux-2.6.32.45/include/linux/grmsg.h 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/include/linux/grmsg.h 2011-04-17 15:56:46.000000000 -0400
-@@ -0,0 +1,108 @@
-+#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
-+#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
-+#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
-+#define GR_STOPMOD_MSG "denied modification of module state by "
-+#define GR_ROFS_BLOCKWRITE_MSG "denied write to block device %.950s by "
-+#define GR_ROFS_MOUNT_MSG "denied writable mount of %.950s by "
-+#define GR_IOPERM_MSG "denied use of ioperm() by "
-+#define GR_IOPL_MSG "denied use of iopl() by "
-+#define GR_SHMAT_ACL_MSG "denied attach of shared memory of UID %u, PID %d, ID %u by "
-+#define GR_UNIX_CHROOT_MSG "denied connect() to abstract AF_UNIX socket outside of chroot by "
-+#define GR_SHMAT_CHROOT_MSG "denied attach of shared memory outside of chroot by "
-+#define GR_MEM_READWRITE_MSG "denied access of range %Lx -> %Lx in /dev/mem by "
-+#define GR_SYMLINK_MSG "not following symlink %.950s owned by %d.%d by "
-+#define GR_LEARN_AUDIT_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%lu\t%lu\t%.4095s\t%lu\t%pI4"
-+#define GR_ID_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%c\t%d\t%d\t%d\t%pI4"
-+#define GR_HIDDEN_ACL_MSG "%s access to hidden file %.950s by "
-+#define GR_OPEN_ACL_MSG "%s open of %.950s for%s%s by "
-+#define GR_CREATE_ACL_MSG "%s create of %.950s for%s%s by "
-+#define GR_FIFO_MSG "denied writing FIFO %.950s of %d.%d by "
-+#define GR_MKNOD_CHROOT_MSG "denied mknod of %.950s from chroot by "
-+#define GR_MKNOD_ACL_MSG "%s mknod of %.950s by "
-+#define GR_UNIXCONNECT_ACL_MSG "%s connect() to the unix domain socket %.950s by "
-+#define GR_TTYSNIFF_ACL_MSG "terminal being sniffed by IP:%pI4 %.480s[%.16s:%d], parent %.480s[%.16s:%d] against "
-+#define GR_MKDIR_ACL_MSG "%s mkdir of %.950s by "
-+#define GR_RMDIR_ACL_MSG "%s rmdir of %.950s by "
-+#define GR_UNLINK_ACL_MSG "%s unlink of %.950s by "
-+#define GR_SYMLINK_ACL_MSG "%s symlink from %.480s to %.480s by "
-+#define GR_HARDLINK_MSG "denied hardlink of %.930s (owned by %d.%d) to %.30s for "
-+#define GR_LINK_ACL_MSG "%s link of %.480s to %.480s by "
-+#define GR_INHERIT_ACL_MSG "successful inherit of %.480s's ACL for %.480s by "
-+#define GR_RENAME_ACL_MSG "%s rename of %.480s to %.480s by "
-+#define GR_UNSAFESHARE_EXEC_ACL_MSG "denied exec with cloned fs of %.950s by "
-+#define GR_PTRACE_EXEC_ACL_MSG "denied ptrace of %.950s by "
-+#define GR_NPROC_MSG "denied overstep of process limit by "
-+#define GR_EXEC_ACL_MSG "%s execution of %.950s by "
-+#define GR_EXEC_TPE_MSG "denied untrusted exec of %.950s by "
-+#define GR_SEGVSTART_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning uid %u from login for %lu seconds"
-+#define GR_SEGVNOSUID_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning execution for %lu seconds"
-+#define GR_MOUNT_CHROOT_MSG "denied mount of %.256s as %.930s from chroot by "
-+#define GR_PIVOT_CHROOT_MSG "denied pivot_root from chroot by "
-+#define GR_TRUNCATE_ACL_MSG "%s truncate of %.950s by "
-+#define GR_ATIME_ACL_MSG "%s access time change of %.950s by "
-+#define GR_ACCESS_ACL_MSG "%s access of %.950s for%s%s%s by "
-+#define GR_CHROOT_CHROOT_MSG "denied double chroot to %.950s by "
-+#define GR_FCHMOD_ACL_MSG "%s fchmod of %.950s by "
-+#define GR_CHMOD_CHROOT_MSG "denied chmod +s of %.950s by "
-+#define GR_CHMOD_ACL_MSG "%s chmod of %.950s by "
-+#define GR_CHROOT_FCHDIR_MSG "denied fchdir outside of chroot to %.950s by "
-+#define GR_CHOWN_ACL_MSG "%s chown of %.950s by "
-+#define GR_SETXATTR_ACL_MSG "%s setting extended attributes of %.950s by "
-+#define GR_WRITLIB_ACL_MSG "denied load of writable library %.950s by "
-+#define GR_INITF_ACL_MSG "init_variables() failed %s by "
-+#define GR_DISABLED_ACL_MSG "Error loading %s, trying to run kernel with acls disabled. To disable acls at startup use <kernel image name> gracl=off from your boot loader"
-+#define GR_DEV_ACL_MSG "/dev/grsec: %d bytes sent %d required, being fed garbaged by "
-+#define GR_SHUTS_ACL_MSG "shutdown auth success for "
-+#define GR_SHUTF_ACL_MSG "shutdown auth failure for "
-+#define GR_SHUTI_ACL_MSG "ignoring shutdown for disabled RBAC system for "
-+#define GR_SEGVMODS_ACL_MSG "segvmod auth success for "
-+#define GR_SEGVMODF_ACL_MSG "segvmod auth failure for "
-+#define GR_SEGVMODI_ACL_MSG "ignoring segvmod for disabled RBAC system for "
-+#define GR_ENABLE_ACL_MSG "%s RBAC system loaded by "
-+#define GR_ENABLEF_ACL_MSG "unable to load %s for "
-+#define GR_RELOADI_ACL_MSG "ignoring reload request for disabled RBAC system"
-+#define GR_RELOAD_ACL_MSG "%s RBAC system reloaded by "
-+#define GR_RELOADF_ACL_MSG "failed reload of %s for "
-+#define GR_SPROLEI_ACL_MSG "ignoring change to special role for disabled RBAC system for "
-+#define GR_SPROLES_ACL_MSG "successful change to special role %s (id %d) by "
-+#define GR_SPROLEL_ACL_MSG "special role %s (id %d) exited by "
-+#define GR_SPROLEF_ACL_MSG "special role %s failure for "
-+#define GR_UNSPROLEI_ACL_MSG "ignoring unauth of special role for disabled RBAC system for "
-+#define GR_UNSPROLES_ACL_MSG "successful unauth of special role %s (id %d) by "
-+#define GR_INVMODE_ACL_MSG "invalid mode %d by "
-+#define GR_PRIORITY_CHROOT_MSG "denied priority change of process (%.16s:%d) by "
-+#define GR_FAILFORK_MSG "failed fork with errno %s by "
-+#define GR_NICE_CHROOT_MSG "denied priority change by "
-+#define GR_UNISIGLOG_MSG "%.32s occurred at %p in "
-+#define GR_DUALSIGLOG_MSG "signal %d sent to " DEFAULTSECMSG " by "
-+#define GR_SIG_ACL_MSG "denied send of signal %d to protected task " DEFAULTSECMSG " by "
-+#define GR_SYSCTL_MSG "denied modification of grsecurity sysctl value : %.32s by "
-+#define GR_SYSCTL_ACL_MSG "%s sysctl of %.950s for%s%s by "
-+#define GR_TIME_MSG "time set by "
-+#define GR_DEFACL_MSG "fatal: unable to find subject for (%.16s:%d), loaded by "
-+#define GR_MMAP_ACL_MSG "%s executable mmap of %.950s by "
-+#define GR_MPROTECT_ACL_MSG "%s executable mprotect of %.950s by "
-+#define GR_SOCK_MSG "denied socket(%.16s,%.16s,%.16s) by "
-+#define GR_SOCK_NOINET_MSG "denied socket(%.16s,%.16s,%d) by "
-+#define GR_BIND_MSG "denied bind() by "
-+#define GR_CONNECT_MSG "denied connect() by "
-+#define GR_BIND_ACL_MSG "denied bind() to %pI4 port %u sock type %.16s protocol %.16s by "
-+#define GR_CONNECT_ACL_MSG "denied connect() to %pI4 port %u sock type %.16s protocol %.16s by "
-+#define GR_IP_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%pI4\t%u\t%u\t%u\t%u\t%pI4"
-+#define GR_EXEC_CHROOT_MSG "exec of %.980s within chroot by process "
-+#define GR_CAP_ACL_MSG "use of %s denied for "
-+#define GR_CAP_ACL_MSG2 "use of %s permitted for "
-+#define GR_USRCHANGE_ACL_MSG "change to uid %u denied for "
-+#define GR_GRPCHANGE_ACL_MSG "change to gid %u denied for "
-+#define GR_REMOUNT_AUDIT_MSG "remount of %.256s by "
-+#define GR_UNMOUNT_AUDIT_MSG "unmount of %.256s by "
-+#define GR_MOUNT_AUDIT_MSG "mount of %.256s to %.256s by "
-+#define GR_CHDIR_AUDIT_MSG "chdir to %.980s by "
-+#define GR_EXEC_AUDIT_MSG "exec of %.930s (%.128s) by "
-+#define GR_RESOURCE_MSG "denied resource overstep by requesting %lu for %.16s against limit %lu for "
-+#define GR_RWXMMAP_MSG "denied RWX mmap of %.950s by "
-+#define GR_RWXMPROTECT_MSG "denied RWX mprotect of %.950s by "
-+#define GR_TEXTREL_AUDIT_MSG "text relocation in %s, VMA:0x%08lx 0x%08lx by "
-+#define GR_VM86_MSG "denied use of vm86 by "
-+#define GR_PTRACE_AUDIT_MSG "process %.950s(%.16s:%d) attached to via ptrace by "
-+#define GR_INIT_TRANSFER_MSG "persistent special role transferred privilege to init by "
-diff -urNp linux-2.6.32.45/include/linux/grsecurity.h linux-2.6.32.45/include/linux/grsecurity.h
---- linux-2.6.32.45/include/linux/grsecurity.h 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/include/linux/grsecurity.h 2011-08-11 19:58:57.000000000 -0400
-@@ -0,0 +1,217 @@
-+#ifndef GR_SECURITY_H
-+#define GR_SECURITY_H
-+#include <linux/fs.h>
-+#include <linux/fs_struct.h>
-+#include <linux/binfmts.h>
-+#include <linux/gracl.h>
-+#include <linux/compat.h>
-+
-+/* notify of brain-dead configs */
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) && defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+#error "CONFIG_GRKERNSEC_PROC_USER and CONFIG_GRKERNSEC_PROC_USERGROUP cannot both be enabled."
-+#endif
-+#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_PAGEEXEC) && !defined(CONFIG_PAX_SEGMEXEC) && !defined(CONFIG_PAX_KERNEXEC)
-+#error "CONFIG_PAX_NOEXEC enabled, but PAGEEXEC, SEGMEXEC, and KERNEXEC are disabled."
-+#endif
-+#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
-+#error "CONFIG_PAX_NOEXEC enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
-+#endif
-+#if defined(CONFIG_PAX_ASLR) && (defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
-+#error "CONFIG_PAX_ASLR enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
-+#endif
-+#if defined(CONFIG_PAX_ASLR) && !defined(CONFIG_PAX_RANDKSTACK) && !defined(CONFIG_PAX_RANDUSTACK) && !defined(CONFIG_PAX_RANDMMAP)
-+#error "CONFIG_PAX_ASLR enabled, but RANDKSTACK, RANDUSTACK, and RANDMMAP are disabled."
-+#endif
-+#if defined(CONFIG_PAX) && !defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_ASLR)
-+#error "CONFIG_PAX enabled, but no PaX options are enabled."
-+#endif
-+
-+void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags);
-+void gr_handle_brute_check(void);
-+void gr_handle_kernel_exploit(void);
-+int gr_process_user_ban(void);
-+
-+char gr_roletype_to_char(void);
-+
-+int gr_acl_enable_at_secure(void);
-+
-+int gr_check_user_change(int real, int effective, int fs);
-+int gr_check_group_change(int real, int effective, int fs);
-+
-+void gr_del_task_from_ip_table(struct task_struct *p);
-+
-+int gr_pid_is_chrooted(struct task_struct *p);
-+int gr_handle_chroot_fowner(struct pid *pid, enum pid_type type);
-+int gr_handle_chroot_nice(void);
-+int gr_handle_chroot_sysctl(const int op);
-+int gr_handle_chroot_setpriority(struct task_struct *p,
-+ const int niceval);
-+int gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt);
-+int gr_handle_chroot_chroot(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+int gr_handle_chroot_caps(struct path *path);
-+void gr_handle_chroot_chdir(struct path *path);
-+int gr_handle_chroot_chmod(const struct dentry *dentry,
-+ const struct vfsmount *mnt, const int mode);
-+int gr_handle_chroot_mknod(const struct dentry *dentry,
-+ const struct vfsmount *mnt, const int mode);
-+int gr_handle_chroot_mount(const struct dentry *dentry,
-+ const struct vfsmount *mnt,
-+ const char *dev_name);
-+int gr_handle_chroot_pivot(void);
-+int gr_handle_chroot_unix(const pid_t pid);
-+
-+int gr_handle_rawio(const struct inode *inode);
-+
-+void gr_handle_ioperm(void);
-+void gr_handle_iopl(void);
-+
-+int gr_tpe_allow(const struct file *file);
-+
-+void gr_set_chroot_entries(struct task_struct *task, struct path *path);
-+void gr_clear_chroot_entries(struct task_struct *task);
-+
-+void gr_log_forkfail(const int retval);
-+void gr_log_timechange(void);
-+void gr_log_signal(const int sig, const void *addr, const struct task_struct *t);
-+void gr_log_chdir(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+void gr_log_chroot_exec(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+void gr_handle_exec_args(struct linux_binprm *bprm, const char __user *const __user *argv);
-+#ifdef CONFIG_COMPAT
-+void gr_handle_exec_args_compat(struct linux_binprm *bprm, compat_uptr_t __user *argv);
-+#endif
-+void gr_log_remount(const char *devname, const int retval);
-+void gr_log_unmount(const char *devname, const int retval);
-+void gr_log_mount(const char *from, const char *to, const int retval);
-+void gr_log_textrel(struct vm_area_struct *vma);
-+void gr_log_rwxmmap(struct file *file);
-+void gr_log_rwxmprotect(struct file *file);
-+
-+int gr_handle_follow_link(const struct inode *parent,
-+ const struct inode *inode,
-+ const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+int gr_handle_fifo(const struct dentry *dentry,
-+ const struct vfsmount *mnt,
-+ const struct dentry *dir, const int flag,
-+ const int acc_mode);
-+int gr_handle_hardlink(const struct dentry *dentry,
-+ const struct vfsmount *mnt,
-+ struct inode *inode,
-+ const int mode, const char *to);
-+
-+int gr_is_capable(const int cap);
-+int gr_is_capable_nolog(const int cap);
-+void gr_learn_resource(const struct task_struct *task, const int limit,
-+ const unsigned long wanted, const int gt);
-+void gr_copy_label(struct task_struct *tsk);
-+void gr_handle_crash(struct task_struct *task, const int sig);
-+int gr_handle_signal(const struct task_struct *p, const int sig);
-+int gr_check_crash_uid(const uid_t uid);
-+int gr_check_protected_task(const struct task_struct *task);
-+int gr_check_protected_task_fowner(struct pid *pid, enum pid_type type);
-+int gr_acl_handle_mmap(const struct file *file,
-+ const unsigned long prot);
-+int gr_acl_handle_mprotect(const struct file *file,
-+ const unsigned long prot);
-+int gr_check_hidden_task(const struct task_struct *tsk);
-+__u32 gr_acl_handle_truncate(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+__u32 gr_acl_handle_utime(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+__u32 gr_acl_handle_access(const struct dentry *dentry,
-+ const struct vfsmount *mnt, const int fmode);
-+__u32 gr_acl_handle_fchmod(const struct dentry *dentry,
-+ const struct vfsmount *mnt, mode_t mode);
-+__u32 gr_acl_handle_chmod(const struct dentry *dentry,
-+ const struct vfsmount *mnt, mode_t mode);
-+__u32 gr_acl_handle_chown(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+__u32 gr_acl_handle_setxattr(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+int gr_handle_ptrace(struct task_struct *task, const long request);
-+int gr_handle_proc_ptrace(struct task_struct *task);
-+__u32 gr_acl_handle_execve(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+int gr_check_crash_exec(const struct file *filp);
-+int gr_acl_is_enabled(void);
-+void gr_set_kernel_label(struct task_struct *task);
-+void gr_set_role_label(struct task_struct *task, const uid_t uid,
-+ const gid_t gid);
-+int gr_set_proc_label(const struct dentry *dentry,
-+ const struct vfsmount *mnt,
-+ const int unsafe_share);
-+__u32 gr_acl_handle_hidden_file(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+__u32 gr_acl_handle_open(const struct dentry *dentry,
-+ const struct vfsmount *mnt, const int fmode);
-+__u32 gr_acl_handle_creat(const struct dentry *dentry,
-+ const struct dentry *p_dentry,
-+ const struct vfsmount *p_mnt, const int fmode,
-+ const int imode);
-+void gr_handle_create(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+__u32 gr_acl_handle_mknod(const struct dentry *new_dentry,
-+ const struct dentry *parent_dentry,
-+ const struct vfsmount *parent_mnt,
-+ const int mode);
-+__u32 gr_acl_handle_mkdir(const struct dentry *new_dentry,
-+ const struct dentry *parent_dentry,
-+ const struct vfsmount *parent_mnt);
-+__u32 gr_acl_handle_rmdir(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+void gr_handle_delete(const ino_t ino, const dev_t dev);
-+__u32 gr_acl_handle_unlink(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+__u32 gr_acl_handle_symlink(const struct dentry *new_dentry,
-+ const struct dentry *parent_dentry,
-+ const struct vfsmount *parent_mnt,
-+ const char *from);
-+__u32 gr_acl_handle_link(const struct dentry *new_dentry,
-+ const struct dentry *parent_dentry,
-+ const struct vfsmount *parent_mnt,
-+ const struct dentry *old_dentry,
-+ const struct vfsmount *old_mnt, const char *to);
-+int gr_acl_handle_rename(struct dentry *new_dentry,
-+ struct dentry *parent_dentry,
-+ const struct vfsmount *parent_mnt,
-+ struct dentry *old_dentry,
-+ struct inode *old_parent_inode,
-+ struct vfsmount *old_mnt, const char *newname);
-+void gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
-+ struct dentry *old_dentry,
-+ struct dentry *new_dentry,
-+ struct vfsmount *mnt, const __u8 replace);
-+__u32 gr_check_link(const struct dentry *new_dentry,
-+ const struct dentry *parent_dentry,
-+ const struct vfsmount *parent_mnt,
-+ const struct dentry *old_dentry,
-+ const struct vfsmount *old_mnt);
-+int gr_acl_handle_filldir(const struct file *file, const char *name,
-+ const unsigned int namelen, const ino_t ino);
-+
-+__u32 gr_acl_handle_unix(const struct dentry *dentry,
-+ const struct vfsmount *mnt);
-+void gr_acl_handle_exit(void);
-+void gr_acl_handle_psacct(struct task_struct *task, const long code);
-+int gr_acl_handle_procpidmem(const struct task_struct *task);
-+int gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags);
-+int gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode);
-+void gr_audit_ptrace(struct task_struct *task);
-+dev_t gr_get_dev_from_dentry(struct dentry *dentry);
-+
-+#ifdef CONFIG_GRKERNSEC
-+void task_grsec_rbac(struct seq_file *m, struct task_struct *p);
-+void gr_handle_vm86(void);
-+void gr_handle_mem_readwrite(u64 from, u64 to);
-+
-+extern int grsec_enable_dmesg;
-+extern int grsec_disable_privio;
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
-+extern int grsec_enable_chroot_findtask;
-+#endif
-+#endif
-+
-+#endif
-diff -urNp linux-2.6.32.45/include/linux/hdpu_features.h linux-2.6.32.45/include/linux/hdpu_features.h
---- linux-2.6.32.45/include/linux/hdpu_features.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/hdpu_features.h 2011-04-17 15:56:46.000000000 -0400
-@@ -3,7 +3,7 @@
- struct cpustate_t {
- spinlock_t lock;
- int excl;
-- int open_count;
-+ atomic_t open_count;
- unsigned char cached_val;
- int inited;
- unsigned long *set_addr;
-diff -urNp linux-2.6.32.45/include/linux/highmem.h linux-2.6.32.45/include/linux/highmem.h
---- linux-2.6.32.45/include/linux/highmem.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/highmem.h 2011-04-17 15:56:46.000000000 -0400
-@@ -137,6 +137,18 @@ static inline void clear_highpage(struct
- kunmap_atomic(kaddr, KM_USER0);
- }
-
-+static inline void sanitize_highpage(struct page *page)
-+{
-+ void *kaddr;
-+ unsigned long flags;
-+
-+ local_irq_save(flags);
-+ kaddr = kmap_atomic(page, KM_CLEARPAGE);
-+ clear_page(kaddr);
-+ kunmap_atomic(kaddr, KM_CLEARPAGE);
-+ local_irq_restore(flags);
-+}
-+
- static inline void zero_user_segments(struct page *page,
- unsigned start1, unsigned end1,
- unsigned start2, unsigned end2)
-diff -urNp linux-2.6.32.45/include/linux/i2o.h linux-2.6.32.45/include/linux/i2o.h
---- linux-2.6.32.45/include/linux/i2o.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/i2o.h 2011-05-04 17:56:28.000000000 -0400
-@@ -564,7 +564,7 @@ struct i2o_controller {
- struct i2o_device *exec; /* Executive */
- #if BITS_PER_LONG == 64
- spinlock_t context_list_lock; /* lock for context_list */
-- atomic_t context_list_counter; /* needed for unique contexts */
-+ atomic_unchecked_t context_list_counter; /* needed for unique contexts */
- struct list_head context_list; /* list of context id's
- and pointers */
- #endif
-diff -urNp linux-2.6.32.45/include/linux/init_task.h linux-2.6.32.45/include/linux/init_task.h
---- linux-2.6.32.45/include/linux/init_task.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/init_task.h 2011-05-18 20:44:59.000000000 -0400
-@@ -83,6 +83,12 @@ extern struct group_info init_groups;
- #define INIT_IDS
- #endif
-
-+#ifdef CONFIG_X86
-+#define INIT_TASK_THREAD_INFO .tinfo = INIT_THREAD_INFO,
-+#else
-+#define INIT_TASK_THREAD_INFO
-+#endif
-+
- #ifdef CONFIG_SECURITY_FILE_CAPABILITIES
- /*
- * Because of the reduced scope of CAP_SETPCAP when filesystem
-@@ -156,6 +162,7 @@ extern struct cred init_cred;
- __MUTEX_INITIALIZER(tsk.cred_guard_mutex), \
- .comm = "swapper", \
- .thread = INIT_THREAD, \
-+ INIT_TASK_THREAD_INFO \
- .fs = &init_fs, \
- .files = &init_files, \
- .signal = &init_signals, \
-diff -urNp linux-2.6.32.45/include/linux/intel-iommu.h linux-2.6.32.45/include/linux/intel-iommu.h
---- linux-2.6.32.45/include/linux/intel-iommu.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/intel-iommu.h 2011-08-05 20:33:55.000000000 -0400
-@@ -296,7 +296,7 @@ struct iommu_flush {
- u8 fm, u64 type);
- void (*flush_iotlb)(struct intel_iommu *iommu, u16 did, u64 addr,
- unsigned int size_order, u64 type);
--};
-+} __no_const;
-
- enum {
- SR_DMAR_FECTL_REG,
-diff -urNp linux-2.6.32.45/include/linux/interrupt.h linux-2.6.32.45/include/linux/interrupt.h
---- linux-2.6.32.45/include/linux/interrupt.h 2011-06-25 12:55:35.000000000 -0400
-+++ linux-2.6.32.45/include/linux/interrupt.h 2011-06-25 12:56:37.000000000 -0400
-@@ -363,7 +363,7 @@ enum
- /* map softirq index to softirq name. update 'softirq_to_name' in
- * kernel/softirq.c when adding a new softirq.
- */
--extern char *softirq_to_name[NR_SOFTIRQS];
-+extern const char * const softirq_to_name[NR_SOFTIRQS];
-
- /* softirq mask and active fields moved to irq_cpustat_t in
- * asm/hardirq.h to get better cache usage. KAO
-@@ -371,12 +371,12 @@ extern char *softirq_to_name[NR_SOFTIRQS
-
- struct softirq_action
- {
-- void (*action)(struct softirq_action *);
-+ void (*action)(void);
- };
-
- asmlinkage void do_softirq(void);
- asmlinkage void __do_softirq(void);
--extern void open_softirq(int nr, void (*action)(struct softirq_action *));
-+extern void open_softirq(int nr, void (*action)(void));
- extern void softirq_init(void);
- #define __raise_softirq_irqoff(nr) do { or_softirq_pending(1UL << (nr)); } while (0)
- extern void raise_softirq_irqoff(unsigned int nr);
-diff -urNp linux-2.6.32.45/include/linux/irq.h linux-2.6.32.45/include/linux/irq.h
---- linux-2.6.32.45/include/linux/irq.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/irq.h 2011-04-17 15:56:46.000000000 -0400
-@@ -438,12 +438,12 @@ extern int set_irq_msi(unsigned int irq,
- static inline bool alloc_desc_masks(struct irq_desc *desc, int node,
- bool boot)
- {
-+#ifdef CONFIG_CPUMASK_OFFSTACK
- gfp_t gfp = GFP_ATOMIC;
-
- if (boot)
- gfp = GFP_NOWAIT;
-
--#ifdef CONFIG_CPUMASK_OFFSTACK
- if (!alloc_cpumask_var_node(&desc->affinity, gfp, node))
- return false;
-
-diff -urNp linux-2.6.32.45/include/linux/kallsyms.h linux-2.6.32.45/include/linux/kallsyms.h
---- linux-2.6.32.45/include/linux/kallsyms.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/kallsyms.h 2011-04-17 15:56:46.000000000 -0400
-@@ -15,7 +15,8 @@
-
- struct module;
-
--#ifdef CONFIG_KALLSYMS
-+#if !defined(__INCLUDED_BY_HIDESYM) || !defined(CONFIG_KALLSYMS)
-+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
- /* Lookup the address for a symbol. Returns 0 if not found. */
- unsigned long kallsyms_lookup_name(const char *name);
-
-@@ -92,6 +93,15 @@ static inline int lookup_symbol_attrs(un
- /* Stupid that this does nothing, but I didn't create this mess. */
- #define __print_symbol(fmt, addr)
- #endif /*CONFIG_KALLSYMS*/
-+#else /* when included by kallsyms.c, vsnprintf.c, or
-+ arch/x86/kernel/dumpstack.c, with HIDESYM enabled */
-+extern void __print_symbol(const char *fmt, unsigned long address);
-+extern int sprint_symbol(char *buffer, unsigned long address);
-+const char *kallsyms_lookup(unsigned long addr,
-+ unsigned long *symbolsize,
-+ unsigned long *offset,
-+ char **modname, char *namebuf);
-+#endif
-
- /* This macro allows us to keep printk typechecking */
- static void __check_printsym_format(const char *fmt, ...)
-diff -urNp linux-2.6.32.45/include/linux/kgdb.h linux-2.6.32.45/include/linux/kgdb.h
---- linux-2.6.32.45/include/linux/kgdb.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/kgdb.h 2011-08-05 20:33:55.000000000 -0400
-@@ -74,8 +74,8 @@ void kgdb_breakpoint(void);
-
- extern int kgdb_connected;
-
--extern atomic_t kgdb_setting_breakpoint;
--extern atomic_t kgdb_cpu_doing_single_step;
-+extern atomic_unchecked_t kgdb_setting_breakpoint;
-+extern atomic_unchecked_t kgdb_cpu_doing_single_step;
-
- extern struct task_struct *kgdb_usethread;
- extern struct task_struct *kgdb_contthread;
-@@ -226,8 +226,8 @@ extern int kgdb_arch_remove_breakpoint(u
- * hardware debug registers.
- */
- struct kgdb_arch {
-- unsigned char gdb_bpt_instr[BREAK_INSTR_SIZE];
-- unsigned long flags;
-+ const unsigned char gdb_bpt_instr[BREAK_INSTR_SIZE];
-+ const unsigned long flags;
-
- int (*set_breakpoint)(unsigned long, char *);
- int (*remove_breakpoint)(unsigned long, char *);
-@@ -251,20 +251,20 @@ struct kgdb_arch {
- */
- struct kgdb_io {
- const char *name;
-- int (*read_char) (void);
-- void (*write_char) (u8);
-- void (*flush) (void);
-- int (*init) (void);
-- void (*pre_exception) (void);
-- void (*post_exception) (void);
-+ int (* const read_char) (void);
-+ void (* const write_char) (u8);
-+ void (* const flush) (void);
-+ int (* const init) (void);
-+ void (* const pre_exception) (void);
-+ void (* const post_exception) (void);
- };
-
--extern struct kgdb_arch arch_kgdb_ops;
-+extern const struct kgdb_arch arch_kgdb_ops;
-
- extern unsigned long __weak kgdb_arch_pc(int exception, struct pt_regs *regs);
-
--extern int kgdb_register_io_module(struct kgdb_io *local_kgdb_io_ops);
--extern void kgdb_unregister_io_module(struct kgdb_io *local_kgdb_io_ops);
-+extern int kgdb_register_io_module(const struct kgdb_io *local_kgdb_io_ops);
-+extern void kgdb_unregister_io_module(const struct kgdb_io *local_kgdb_io_ops);
-
- extern int kgdb_hex2long(char **ptr, unsigned long *long_val);
- extern int kgdb_mem2hex(char *mem, char *buf, int count);
-diff -urNp linux-2.6.32.45/include/linux/kmod.h linux-2.6.32.45/include/linux/kmod.h
---- linux-2.6.32.45/include/linux/kmod.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/kmod.h 2011-04-17 15:56:46.000000000 -0400
-@@ -31,6 +31,8 @@
- * usually useless though. */
- extern int __request_module(bool wait, const char *name, ...) \
- __attribute__((format(printf, 2, 3)));
-+extern int ___request_module(bool wait, char *param_name, const char *name, ...) \
-+ __attribute__((format(printf, 3, 4)));
- #define request_module(mod...) __request_module(true, mod)
- #define request_module_nowait(mod...) __request_module(false, mod)
- #define try_then_request_module(x, mod...) \
-diff -urNp linux-2.6.32.45/include/linux/kobject.h linux-2.6.32.45/include/linux/kobject.h
---- linux-2.6.32.45/include/linux/kobject.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/kobject.h 2011-04-17 15:56:46.000000000 -0400
-@@ -106,7 +106,7 @@ extern char *kobject_get_path(struct kob
-
- struct kobj_type {
- void (*release)(struct kobject *kobj);
-- struct sysfs_ops *sysfs_ops;
-+ const struct sysfs_ops *sysfs_ops;
- struct attribute **default_attrs;
- };
-
-@@ -118,9 +118,9 @@ struct kobj_uevent_env {
- };
-
- struct kset_uevent_ops {
-- int (*filter)(struct kset *kset, struct kobject *kobj);
-- const char *(*name)(struct kset *kset, struct kobject *kobj);
-- int (*uevent)(struct kset *kset, struct kobject *kobj,
-+ int (* const filter)(struct kset *kset, struct kobject *kobj);
-+ const char *(* const name)(struct kset *kset, struct kobject *kobj);
-+ int (* const uevent)(struct kset *kset, struct kobject *kobj,
- struct kobj_uevent_env *env);
- };
-
-@@ -132,7 +132,7 @@ struct kobj_attribute {
- const char *buf, size_t count);
- };
-
--extern struct sysfs_ops kobj_sysfs_ops;
-+extern const struct sysfs_ops kobj_sysfs_ops;
-
- /**
- * struct kset - a set of kobjects of a specific type, belonging to a specific subsystem.
-@@ -155,14 +155,14 @@ struct kset {
- struct list_head list;
- spinlock_t list_lock;
- struct kobject kobj;
-- struct kset_uevent_ops *uevent_ops;
-+ const struct kset_uevent_ops *uevent_ops;
- };
-
- extern void kset_init(struct kset *kset);
- extern int __must_check kset_register(struct kset *kset);
- extern void kset_unregister(struct kset *kset);
- extern struct kset * __must_check kset_create_and_add(const char *name,
-- struct kset_uevent_ops *u,
-+ const struct kset_uevent_ops *u,
- struct kobject *parent_kobj);
-
- static inline struct kset *to_kset(struct kobject *kobj)
-diff -urNp linux-2.6.32.45/include/linux/kvm_host.h linux-2.6.32.45/include/linux/kvm_host.h
---- linux-2.6.32.45/include/linux/kvm_host.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/kvm_host.h 2011-04-17 15:56:46.000000000 -0400
-@@ -210,7 +210,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vc
- void vcpu_load(struct kvm_vcpu *vcpu);
- void vcpu_put(struct kvm_vcpu *vcpu);
-
--int kvm_init(void *opaque, unsigned int vcpu_size,
-+int kvm_init(const void *opaque, unsigned int vcpu_size,
- struct module *module);
- void kvm_exit(void);
-
-@@ -316,7 +316,7 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(
- struct kvm_guest_debug *dbg);
- int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run);
-
--int kvm_arch_init(void *opaque);
-+int kvm_arch_init(const void *opaque);
- void kvm_arch_exit(void);
-
- int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
-diff -urNp linux-2.6.32.45/include/linux/libata.h linux-2.6.32.45/include/linux/libata.h
---- linux-2.6.32.45/include/linux/libata.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/libata.h 2011-08-05 20:33:55.000000000 -0400
-@@ -525,11 +525,11 @@ struct ata_ioports {
-
- struct ata_host {
- spinlock_t lock;
-- struct device *dev;
-+ struct device *dev;
- void __iomem * const *iomap;
- unsigned int n_ports;
- void *private_data;
-- struct ata_port_operations *ops;
-+ const struct ata_port_operations *ops;
- unsigned long flags;
- #ifdef CONFIG_ATA_ACPI
- acpi_handle acpi_handle;
-@@ -710,7 +710,7 @@ struct ata_link {
-
- struct ata_port {
- struct Scsi_Host *scsi_host; /* our co-allocated scsi host */
-- struct ata_port_operations *ops;
-+ const struct ata_port_operations *ops;
- spinlock_t *lock;
- /* Flags owned by the EH context. Only EH should touch these once the
- port is active */
-@@ -883,7 +883,7 @@ struct ata_port_operations {
- * ->inherits must be the last field and all the preceding
- * fields must be pointers.
- */
-- const struct ata_port_operations *inherits;
-+ const struct ata_port_operations * const inherits;
- };
-
- struct ata_port_info {
-@@ -892,7 +892,7 @@ struct ata_port_info {
- unsigned long pio_mask;
- unsigned long mwdma_mask;
- unsigned long udma_mask;
-- struct ata_port_operations *port_ops;
-+ const struct ata_port_operations *port_ops;
- void *private_data;
- };
-
-@@ -916,7 +916,7 @@ extern const unsigned long sata_deb_timi
- extern const unsigned long sata_deb_timing_hotplug[];
- extern const unsigned long sata_deb_timing_long[];
-
--extern struct ata_port_operations ata_dummy_port_ops;
-+extern const struct ata_port_operations ata_dummy_port_ops;
- extern const struct ata_port_info ata_dummy_port_info;
-
- static inline const unsigned long *
-@@ -962,7 +962,7 @@ extern int ata_host_activate(struct ata_
- struct scsi_host_template *sht);
- extern void ata_host_detach(struct ata_host *host);
- extern void ata_host_init(struct ata_host *, struct device *,
-- unsigned long, struct ata_port_operations *);
-+ unsigned long, const struct ata_port_operations *);
- extern int ata_scsi_detect(struct scsi_host_template *sht);
- extern int ata_scsi_ioctl(struct scsi_device *dev, int cmd, void __user *arg);
- extern int ata_scsi_queuecmd(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *));
-diff -urNp linux-2.6.32.45/include/linux/lockd/bind.h linux-2.6.32.45/include/linux/lockd/bind.h
---- linux-2.6.32.45/include/linux/lockd/bind.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/lockd/bind.h 2011-04-17 15:56:46.000000000 -0400
-@@ -23,13 +23,13 @@ struct svc_rqst;
- * This is the set of functions for lockd->nfsd communication
- */
- struct nlmsvc_binding {
-- __be32 (*fopen)(struct svc_rqst *,
-+ __be32 (* const fopen)(struct svc_rqst *,
- struct nfs_fh *,
- struct file **);
-- void (*fclose)(struct file *);
-+ void (* const fclose)(struct file *);
- };
-
--extern struct nlmsvc_binding * nlmsvc_ops;
-+extern const struct nlmsvc_binding * nlmsvc_ops;
-
- /*
- * Similar to nfs_client_initdata, but without the NFS-specific
-diff -urNp linux-2.6.32.45/include/linux/mca.h linux-2.6.32.45/include/linux/mca.h
---- linux-2.6.32.45/include/linux/mca.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/mca.h 2011-08-05 20:33:55.000000000 -0400
-@@ -80,7 +80,7 @@ struct mca_bus_accessor_functions {
- int region);
- void * (*mca_transform_memory)(struct mca_device *,
- void *memory);
--};
-+} __no_const;
-
- struct mca_bus {
- u64 default_dma_mask;
-diff -urNp linux-2.6.32.45/include/linux/memory.h linux-2.6.32.45/include/linux/memory.h
---- linux-2.6.32.45/include/linux/memory.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/memory.h 2011-08-05 20:33:55.000000000 -0400
-@@ -108,7 +108,7 @@ struct memory_accessor {
- size_t count);
- ssize_t (*write)(struct memory_accessor *, const char *buf,
- off_t offset, size_t count);
--};
-+} __no_const;
-
- /*
- * Kernel text modification mutex, used for code patching. Users of this lock
-diff -urNp linux-2.6.32.45/include/linux/mm.h linux-2.6.32.45/include/linux/mm.h
---- linux-2.6.32.45/include/linux/mm.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/mm.h 2011-04-17 15:56:46.000000000 -0400
-@@ -106,7 +106,14 @@ extern unsigned int kobjsize(const void
-
- #define VM_CAN_NONLINEAR 0x08000000 /* Has ->fault & does nonlinear pages */
- #define VM_MIXEDMAP 0x10000000 /* Can contain "struct page" and pure PFN pages */
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
-+#define VM_SAO 0x00000000 /* Strong Access Ordering (powerpc) */
-+#define VM_PAGEEXEC 0x20000000 /* vma->vm_page_prot needs special handling */
-+#else
- #define VM_SAO 0x20000000 /* Strong Access Ordering (powerpc) */
-+#endif
-+
- #define VM_PFN_AT_MMAP 0x40000000 /* PFNMAP vma that is fully mapped at mmap time */
- #define VM_MERGEABLE 0x80000000 /* KSM may merge identical pages */
-
-@@ -841,12 +848,6 @@ int set_page_dirty(struct page *page);
- int set_page_dirty_lock(struct page *page);
- int clear_page_dirty_for_io(struct page *page);
-
--/* Is the vma a continuation of the stack vma above it? */
--static inline int vma_stack_continue(struct vm_area_struct *vma, unsigned long addr)
--{
-- return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN);
--}
--
- extern unsigned long move_page_tables(struct vm_area_struct *vma,
- unsigned long old_addr, struct vm_area_struct *new_vma,
- unsigned long new_addr, unsigned long len);
-@@ -890,6 +891,8 @@ struct shrinker {
- extern void register_shrinker(struct shrinker *);
- extern void unregister_shrinker(struct shrinker *);
-
-+pgprot_t vm_get_page_prot(unsigned long vm_flags);
-+
- int vma_wants_writenotify(struct vm_area_struct *vma);
-
- extern pte_t *get_locked_pte(struct mm_struct *mm, unsigned long addr, spinlock_t **ptl);
-@@ -1162,6 +1165,7 @@ out:
- }
-
- extern int do_munmap(struct mm_struct *, unsigned long, size_t);
-+extern int __do_munmap(struct mm_struct *, unsigned long, size_t);
-
- extern unsigned long do_brk(unsigned long, unsigned long);
-
-@@ -1218,6 +1222,10 @@ extern struct vm_area_struct * find_vma(
- extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
- struct vm_area_struct **pprev);
-
-+extern struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma);
-+extern void pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma);
-+extern void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl);
-+
- /* Look up the first VMA which intersects the interval start_addr..end_addr-1,
- NULL if none. Assume start_addr < end_addr. */
- static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr)
-@@ -1234,7 +1242,6 @@ static inline unsigned long vma_pages(st
- return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
- }
-
--pgprot_t vm_get_page_prot(unsigned long vm_flags);
- struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr);
- int remap_pfn_range(struct vm_area_struct *, unsigned long addr,
- unsigned long pfn, unsigned long size, pgprot_t);
-@@ -1332,7 +1339,13 @@ extern void memory_failure(unsigned long
- extern int __memory_failure(unsigned long pfn, int trapno, int ref);
- extern int sysctl_memory_failure_early_kill;
- extern int sysctl_memory_failure_recovery;
--extern atomic_long_t mce_bad_pages;
-+extern atomic_long_unchecked_t mce_bad_pages;
-+
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+extern void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot);
-+#else
-+static inline void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot) {}
-+#endif
-
- #endif /* __KERNEL__ */
- #endif /* _LINUX_MM_H */
-diff -urNp linux-2.6.32.45/include/linux/mm_types.h linux-2.6.32.45/include/linux/mm_types.h
---- linux-2.6.32.45/include/linux/mm_types.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/mm_types.h 2011-04-17 15:56:46.000000000 -0400
-@@ -186,6 +186,8 @@ struct vm_area_struct {
- #ifdef CONFIG_NUMA
- struct mempolicy *vm_policy; /* NUMA policy for the VMA */
- #endif
-+
-+ struct vm_area_struct *vm_mirror;/* PaX: mirror vma or NULL */
- };
-
- struct core_thread {
-@@ -287,6 +289,24 @@ struct mm_struct {
- #ifdef CONFIG_MMU_NOTIFIER
- struct mmu_notifier_mm *mmu_notifier_mm;
- #endif
-+
-+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) || defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+ unsigned long pax_flags;
-+#endif
-+
-+#ifdef CONFIG_PAX_DLRESOLVE
-+ unsigned long call_dl_resolve;
-+#endif
-+
-+#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
-+ unsigned long call_syscall;
-+#endif
-+
-+#ifdef CONFIG_PAX_ASLR
-+ unsigned long delta_mmap; /* randomized offset */
-+ unsigned long delta_stack; /* randomized offset */
-+#endif
-+
- };
-
- /* Future-safe accessor for struct mm_struct's cpu_vm_mask. */
-diff -urNp linux-2.6.32.45/include/linux/mmu_notifier.h linux-2.6.32.45/include/linux/mmu_notifier.h
---- linux-2.6.32.45/include/linux/mmu_notifier.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/mmu_notifier.h 2011-04-17 15:56:46.000000000 -0400
-@@ -235,12 +235,12 @@ static inline void mmu_notifier_mm_destr
- */
- #define ptep_clear_flush_notify(__vma, __address, __ptep) \
- ({ \
-- pte_t __pte; \
-+ pte_t ___pte; \
- struct vm_area_struct *___vma = __vma; \
- unsigned long ___address = __address; \
-- __pte = ptep_clear_flush(___vma, ___address, __ptep); \
-+ ___pte = ptep_clear_flush(___vma, ___address, __ptep); \
- mmu_notifier_invalidate_page(___vma->vm_mm, ___address); \
-- __pte; \
-+ ___pte; \
- })
-
- #define ptep_clear_flush_young_notify(__vma, __address, __ptep) \
-diff -urNp linux-2.6.32.45/include/linux/mmzone.h linux-2.6.32.45/include/linux/mmzone.h
---- linux-2.6.32.45/include/linux/mmzone.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/mmzone.h 2011-04-17 15:56:46.000000000 -0400
-@@ -350,7 +350,7 @@ struct zone {
- unsigned long flags; /* zone flags, see below */
-
- /* Zone statistics */
-- atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
-+ atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
-
- /*
- * prev_priority holds the scanning priority for this zone. It is
-diff -urNp linux-2.6.32.45/include/linux/mod_devicetable.h linux-2.6.32.45/include/linux/mod_devicetable.h
---- linux-2.6.32.45/include/linux/mod_devicetable.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/mod_devicetable.h 2011-04-17 15:56:46.000000000 -0400
-@@ -12,7 +12,7 @@
- typedef unsigned long kernel_ulong_t;
- #endif
-
--#define PCI_ANY_ID (~0)
-+#define PCI_ANY_ID ((__u16)~0)
-
- struct pci_device_id {
- __u32 vendor, device; /* Vendor and device ID or PCI_ANY_ID*/
-@@ -131,7 +131,7 @@ struct usb_device_id {
- #define USB_DEVICE_ID_MATCH_INT_SUBCLASS 0x0100
- #define USB_DEVICE_ID_MATCH_INT_PROTOCOL 0x0200
-
--#define HID_ANY_ID (~0)
-+#define HID_ANY_ID (~0U)
-
- struct hid_device_id {
- __u16 bus;
-diff -urNp linux-2.6.32.45/include/linux/module.h linux-2.6.32.45/include/linux/module.h
---- linux-2.6.32.45/include/linux/module.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/module.h 2011-08-05 20:33:55.000000000 -0400
-@@ -16,6 +16,7 @@
- #include <linux/kobject.h>
- #include <linux/moduleparam.h>
- #include <linux/tracepoint.h>
-+#include <linux/fs.h>
-
- #include <asm/local.h>
- #include <asm/module.h>
-@@ -287,16 +288,16 @@ struct module
- int (*init)(void);
-
- /* If this is non-NULL, vfree after init() returns */
-- void *module_init;
-+ void *module_init_rx, *module_init_rw;
-
- /* Here is the actual code + data, vfree'd on unload. */
-- void *module_core;
-+ void *module_core_rx, *module_core_rw;
-
- /* Here are the sizes of the init and core sections */
-- unsigned int init_size, core_size;
-+ unsigned int init_size_rw, core_size_rw;
-
- /* The size of the executable code in each section. */
-- unsigned int init_text_size, core_text_size;
-+ unsigned int init_size_rx, core_size_rx;
-
- /* Arch-specific module values */
- struct mod_arch_specific arch;
-@@ -345,6 +346,10 @@ struct module
- #ifdef CONFIG_EVENT_TRACING
- struct ftrace_event_call *trace_events;
- unsigned int num_trace_events;
-+ struct file_operations trace_id;
-+ struct file_operations trace_enable;
-+ struct file_operations trace_format;
-+ struct file_operations trace_filter;
- #endif
- #ifdef CONFIG_FTRACE_MCOUNT_RECORD
- unsigned long *ftrace_callsites;
-@@ -393,16 +398,46 @@ struct module *__module_address(unsigned
- bool is_module_address(unsigned long addr);
- bool is_module_text_address(unsigned long addr);
-
-+static inline int within_module_range(unsigned long addr, void *start, unsigned long size)
-+{
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ if (ktla_ktva(addr) >= (unsigned long)start &&
-+ ktla_ktva(addr) < (unsigned long)start + size)
-+ return 1;
-+#endif
-+
-+ return ((void *)addr >= start && (void *)addr < start + size);
-+}
-+
-+static inline int within_module_core_rx(unsigned long addr, struct module *mod)
-+{
-+ return within_module_range(addr, mod->module_core_rx, mod->core_size_rx);
-+}
-+
-+static inline int within_module_core_rw(unsigned long addr, struct module *mod)
-+{
-+ return within_module_range(addr, mod->module_core_rw, mod->core_size_rw);
-+}
-+
-+static inline int within_module_init_rx(unsigned long addr, struct module *mod)
-+{
-+ return within_module_range(addr, mod->module_init_rx, mod->init_size_rx);
-+}
-+
-+static inline int within_module_init_rw(unsigned long addr, struct module *mod)
-+{
-+ return within_module_range(addr, mod->module_init_rw, mod->init_size_rw);
-+}
-+
- static inline int within_module_core(unsigned long addr, struct module *mod)
- {
-- return (unsigned long)mod->module_core <= addr &&
-- addr < (unsigned long)mod->module_core + mod->core_size;
-+ return within_module_core_rx(addr, mod) || within_module_core_rw(addr, mod);
- }
-
- static inline int within_module_init(unsigned long addr, struct module *mod)
- {
-- return (unsigned long)mod->module_init <= addr &&
-- addr < (unsigned long)mod->module_init + mod->init_size;
-+ return within_module_init_rx(addr, mod) || within_module_init_rw(addr, mod);
- }
-
- /* Search for module by name: must hold module_mutex. */
-diff -urNp linux-2.6.32.45/include/linux/moduleloader.h linux-2.6.32.45/include/linux/moduleloader.h
---- linux-2.6.32.45/include/linux/moduleloader.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/moduleloader.h 2011-04-17 15:56:46.000000000 -0400
-@@ -20,9 +20,21 @@ unsigned int arch_mod_section_prepend(st
- sections. Returns NULL on failure. */
- void *module_alloc(unsigned long size);
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+void *module_alloc_exec(unsigned long size);
-+#else
-+#define module_alloc_exec(x) module_alloc(x)
-+#endif
-+
- /* Free memory returned from module_alloc. */
- void module_free(struct module *mod, void *module_region);
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+void module_free_exec(struct module *mod, void *module_region);
-+#else
-+#define module_free_exec(x, y) module_free((x), (y))
-+#endif
-+
- /* Apply the given relocation to the (simplified) ELF. Return -error
- or 0. */
- int apply_relocate(Elf_Shdr *sechdrs,
-diff -urNp linux-2.6.32.45/include/linux/moduleparam.h linux-2.6.32.45/include/linux/moduleparam.h
---- linux-2.6.32.45/include/linux/moduleparam.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/moduleparam.h 2011-04-17 15:56:46.000000000 -0400
-@@ -132,7 +132,7 @@ struct kparam_array
-
- /* Actually copy string: maxlen param is usually sizeof(string). */
- #define module_param_string(name, string, len, perm) \
-- static const struct kparam_string __param_string_##name \
-+ static const struct kparam_string __param_string_##name __used \
- = { len, string }; \
- __module_param_call(MODULE_PARAM_PREFIX, name, \
- param_set_copystring, param_get_string, \
-@@ -211,7 +211,7 @@ extern int param_get_invbool(char *buffe
-
- /* Comma-separated array: *nump is set to number they actually specified. */
- #define module_param_array_named(name, array, type, nump, perm) \
-- static const struct kparam_array __param_arr_##name \
-+ static const struct kparam_array __param_arr_##name __used \
- = { ARRAY_SIZE(array), nump, param_set_##type, param_get_##type,\
- sizeof(array[0]), array }; \
- __module_param_call(MODULE_PARAM_PREFIX, name, \
-diff -urNp linux-2.6.32.45/include/linux/mutex.h linux-2.6.32.45/include/linux/mutex.h
---- linux-2.6.32.45/include/linux/mutex.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/mutex.h 2011-04-17 15:56:46.000000000 -0400
-@@ -51,7 +51,7 @@ struct mutex {
- spinlock_t wait_lock;
- struct list_head wait_list;
- #if defined(CONFIG_DEBUG_MUTEXES) || defined(CONFIG_SMP)
-- struct thread_info *owner;
-+ struct task_struct *owner;
- #endif
- #ifdef CONFIG_DEBUG_MUTEXES
- const char *name;
-diff -urNp linux-2.6.32.45/include/linux/namei.h linux-2.6.32.45/include/linux/namei.h
---- linux-2.6.32.45/include/linux/namei.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/namei.h 2011-04-17 15:56:46.000000000 -0400
-@@ -22,7 +22,7 @@ struct nameidata {
- unsigned int flags;
- int last_type;
- unsigned depth;
-- char *saved_names[MAX_NESTED_LINKS + 1];
-+ const char *saved_names[MAX_NESTED_LINKS + 1];
-
- /* Intent data */
- union {
-@@ -84,12 +84,12 @@ extern int follow_up(struct path *);
- extern struct dentry *lock_rename(struct dentry *, struct dentry *);
- extern void unlock_rename(struct dentry *, struct dentry *);
-
--static inline void nd_set_link(struct nameidata *nd, char *path)
-+static inline void nd_set_link(struct nameidata *nd, const char *path)
- {
- nd->saved_names[nd->depth] = path;
- }
-
--static inline char *nd_get_link(struct nameidata *nd)
-+static inline const char *nd_get_link(const struct nameidata *nd)
- {
- return nd->saved_names[nd->depth];
- }
-diff -urNp linux-2.6.32.45/include/linux/netfilter/xt_gradm.h linux-2.6.32.45/include/linux/netfilter/xt_gradm.h
---- linux-2.6.32.45/include/linux/netfilter/xt_gradm.h 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/include/linux/netfilter/xt_gradm.h 2011-04-17 15:56:46.000000000 -0400
-@@ -0,0 +1,9 @@
-+#ifndef _LINUX_NETFILTER_XT_GRADM_H
-+#define _LINUX_NETFILTER_XT_GRADM_H 1
-+
-+struct xt_gradm_mtinfo {
-+ __u16 flags;
-+ __u16 invflags;
-+};
-+
-+#endif
-diff -urNp linux-2.6.32.45/include/linux/nodemask.h linux-2.6.32.45/include/linux/nodemask.h
---- linux-2.6.32.45/include/linux/nodemask.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/nodemask.h 2011-04-17 15:56:46.000000000 -0400
-@@ -464,11 +464,11 @@ static inline int num_node_state(enum no
-
- #define any_online_node(mask) \
- ({ \
-- int node; \
-- for_each_node_mask(node, (mask)) \
-- if (node_online(node)) \
-+ int __node; \
-+ for_each_node_mask(__node, (mask)) \
-+ if (node_online(__node)) \
- break; \
-- node; \
-+ __node; \
- })
-
- #define num_online_nodes() num_node_state(N_ONLINE)
-diff -urNp linux-2.6.32.45/include/linux/oprofile.h linux-2.6.32.45/include/linux/oprofile.h
---- linux-2.6.32.45/include/linux/oprofile.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/oprofile.h 2011-04-17 15:56:46.000000000 -0400
-@@ -129,9 +129,9 @@ int oprofilefs_create_ulong(struct super
- int oprofilefs_create_ro_ulong(struct super_block * sb, struct dentry * root,
- char const * name, ulong * val);
-
--/** Create a file for read-only access to an atomic_t. */
-+/** Create a file for read-only access to an atomic_unchecked_t. */
- int oprofilefs_create_ro_atomic(struct super_block * sb, struct dentry * root,
-- char const * name, atomic_t * val);
-+ char const * name, atomic_unchecked_t * val);
-
- /** create a directory */
- struct dentry * oprofilefs_mkdir(struct super_block * sb, struct dentry * root,
-diff -urNp linux-2.6.32.45/include/linux/pagemap.h linux-2.6.32.45/include/linux/pagemap.h
---- linux-2.6.32.45/include/linux/pagemap.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/pagemap.h 2011-08-17 19:36:28.000000000 -0400
-@@ -425,6 +425,7 @@ static inline int fault_in_pages_readabl
- if (((unsigned long)uaddr & PAGE_MASK) !=
- ((unsigned long)end & PAGE_MASK))
- ret = __get_user(c, end);
-+ (void)c;
- }
- return ret;
- }
-diff -urNp linux-2.6.32.45/include/linux/perf_event.h linux-2.6.32.45/include/linux/perf_event.h
---- linux-2.6.32.45/include/linux/perf_event.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/perf_event.h 2011-05-04 17:56:28.000000000 -0400
-@@ -476,7 +476,7 @@ struct hw_perf_event {
- struct hrtimer hrtimer;
- };
- };
-- atomic64_t prev_count;
-+ atomic64_unchecked_t prev_count;
- u64 sample_period;
- u64 last_period;
- atomic64_t period_left;
-@@ -557,7 +557,7 @@ struct perf_event {
- const struct pmu *pmu;
-
- enum perf_event_active_state state;
-- atomic64_t count;
-+ atomic64_unchecked_t count;
-
- /*
- * These are the total time in nanoseconds that the event
-@@ -595,8 +595,8 @@ struct perf_event {
- * These accumulate total time (in nanoseconds) that children
- * events have been enabled and running, respectively.
- */
-- atomic64_t child_total_time_enabled;
-- atomic64_t child_total_time_running;
-+ atomic64_unchecked_t child_total_time_enabled;
-+ atomic64_unchecked_t child_total_time_running;
-
- /*
- * Protect attach/detach and child_list:
-diff -urNp linux-2.6.32.45/include/linux/pipe_fs_i.h linux-2.6.32.45/include/linux/pipe_fs_i.h
---- linux-2.6.32.45/include/linux/pipe_fs_i.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/pipe_fs_i.h 2011-04-17 15:56:46.000000000 -0400
-@@ -46,9 +46,9 @@ struct pipe_inode_info {
- wait_queue_head_t wait;
- unsigned int nrbufs, curbuf;
- struct page *tmp_page;
-- unsigned int readers;
-- unsigned int writers;
-- unsigned int waiting_writers;
-+ atomic_t readers;
-+ atomic_t writers;
-+ atomic_t waiting_writers;
- unsigned int r_counter;
- unsigned int w_counter;
- struct fasync_struct *fasync_readers;
-diff -urNp linux-2.6.32.45/include/linux/poison.h linux-2.6.32.45/include/linux/poison.h
---- linux-2.6.32.45/include/linux/poison.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/poison.h 2011-04-17 15:56:46.000000000 -0400
-@@ -19,8 +19,8 @@
- * under normal circumstances, used to verify that nobody uses
- * non-initialized list entries.
- */
--#define LIST_POISON1 ((void *) 0x00100100 + POISON_POINTER_DELTA)
--#define LIST_POISON2 ((void *) 0x00200200 + POISON_POINTER_DELTA)
-+#define LIST_POISON1 ((void *) (long)0xFFFFFF01)
-+#define LIST_POISON2 ((void *) (long)0xFFFFFF02)
-
- /********** include/linux/timer.h **********/
- /*
-diff -urNp linux-2.6.32.45/include/linux/posix-timers.h linux-2.6.32.45/include/linux/posix-timers.h
---- linux-2.6.32.45/include/linux/posix-timers.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/posix-timers.h 2011-08-05 20:33:55.000000000 -0400
-@@ -67,7 +67,7 @@ struct k_itimer {
- };
-
- struct k_clock {
-- int res; /* in nanoseconds */
-+ const int res; /* in nanoseconds */
- int (*clock_getres) (const clockid_t which_clock, struct timespec *tp);
- int (*clock_set) (const clockid_t which_clock, struct timespec * tp);
- int (*clock_get) (const clockid_t which_clock, struct timespec * tp);
-diff -urNp linux-2.6.32.45/include/linux/preempt.h linux-2.6.32.45/include/linux/preempt.h
---- linux-2.6.32.45/include/linux/preempt.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/preempt.h 2011-08-05 20:33:55.000000000 -0400
-@@ -110,7 +110,7 @@ struct preempt_ops {
- void (*sched_in)(struct preempt_notifier *notifier, int cpu);
- void (*sched_out)(struct preempt_notifier *notifier,
- struct task_struct *next);
--};
-+} __no_const;
-
- /**
- * preempt_notifier - key for installing preemption notifiers
-diff -urNp linux-2.6.32.45/include/linux/proc_fs.h linux-2.6.32.45/include/linux/proc_fs.h
---- linux-2.6.32.45/include/linux/proc_fs.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/proc_fs.h 2011-08-05 20:33:55.000000000 -0400
-@@ -155,6 +155,19 @@ static inline struct proc_dir_entry *pro
- return proc_create_data(name, mode, parent, proc_fops, NULL);
- }
-
-+static inline struct proc_dir_entry *proc_create_grsec(const char *name, mode_t mode,
-+ struct proc_dir_entry *parent, const struct file_operations *proc_fops)
-+{
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+ return proc_create_data(name, S_IRUSR, parent, proc_fops, NULL);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ return proc_create_data(name, S_IRUSR | S_IRGRP, parent, proc_fops, NULL);
-+#else
-+ return proc_create_data(name, mode, parent, proc_fops, NULL);
-+#endif
-+}
-+
-+
- static inline struct proc_dir_entry *create_proc_read_entry(const char *name,
- mode_t mode, struct proc_dir_entry *base,
- read_proc_t *read_proc, void * data)
-@@ -256,7 +269,7 @@ union proc_op {
- int (*proc_show)(struct seq_file *m,
- struct pid_namespace *ns, struct pid *pid,
- struct task_struct *task);
--};
-+} __no_const;
-
- struct ctl_table_header;
- struct ctl_table;
-diff -urNp linux-2.6.32.45/include/linux/ptrace.h linux-2.6.32.45/include/linux/ptrace.h
---- linux-2.6.32.45/include/linux/ptrace.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/ptrace.h 2011-04-17 15:56:46.000000000 -0400
-@@ -96,10 +96,10 @@ extern void __ptrace_unlink(struct task_
- extern void exit_ptrace(struct task_struct *tracer);
- #define PTRACE_MODE_READ 1
- #define PTRACE_MODE_ATTACH 2
--/* Returns 0 on success, -errno on denial. */
--extern int __ptrace_may_access(struct task_struct *task, unsigned int mode);
- /* Returns true on success, false on denial. */
- extern bool ptrace_may_access(struct task_struct *task, unsigned int mode);
-+/* Returns true on success, false on denial. */
-+extern bool ptrace_may_access_log(struct task_struct *task, unsigned int mode);
-
- static inline int ptrace_reparented(struct task_struct *child)
- {
-diff -urNp linux-2.6.32.45/include/linux/random.h linux-2.6.32.45/include/linux/random.h
---- linux-2.6.32.45/include/linux/random.h 2011-08-16 20:37:25.000000000 -0400
-+++ linux-2.6.32.45/include/linux/random.h 2011-08-07 19:48:09.000000000 -0400
-@@ -63,6 +63,11 @@ unsigned long randomize_range(unsigned l
- u32 random32(void);
- void srandom32(u32 seed);
-
-+static inline unsigned long pax_get_random_long(void)
-+{
-+ return random32() + (sizeof(long) > 4 ? (unsigned long)random32() << 32 : 0);
-+}
-+
- #endif /* __KERNEL___ */
-
- #endif /* _LINUX_RANDOM_H */
-diff -urNp linux-2.6.32.45/include/linux/reboot.h linux-2.6.32.45/include/linux/reboot.h
---- linux-2.6.32.45/include/linux/reboot.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/reboot.h 2011-05-22 23:02:06.000000000 -0400
-@@ -47,9 +47,9 @@ extern int unregister_reboot_notifier(st
- * Architecture-specific implementations of sys_reboot commands.
- */
-
--extern void machine_restart(char *cmd);
--extern void machine_halt(void);
--extern void machine_power_off(void);
-+extern void machine_restart(char *cmd) __noreturn;
-+extern void machine_halt(void) __noreturn;
-+extern void machine_power_off(void) __noreturn;
-
- extern void machine_shutdown(void);
- struct pt_regs;
-@@ -60,9 +60,9 @@ extern void machine_crash_shutdown(struc
- */
-
- extern void kernel_restart_prepare(char *cmd);
--extern void kernel_restart(char *cmd);
--extern void kernel_halt(void);
--extern void kernel_power_off(void);
-+extern void kernel_restart(char *cmd) __noreturn;
-+extern void kernel_halt(void) __noreturn;
-+extern void kernel_power_off(void) __noreturn;
-
- void ctrl_alt_del(void);
-
-@@ -75,7 +75,7 @@ extern int orderly_poweroff(bool force);
- * Emergency restart, callable from an interrupt handler.
- */
-
--extern void emergency_restart(void);
-+extern void emergency_restart(void) __noreturn;
- #include <asm/emergency-restart.h>
-
- #endif
-diff -urNp linux-2.6.32.45/include/linux/reiserfs_fs.h linux-2.6.32.45/include/linux/reiserfs_fs.h
---- linux-2.6.32.45/include/linux/reiserfs_fs.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/reiserfs_fs.h 2011-04-17 15:56:46.000000000 -0400
-@@ -1326,7 +1326,7 @@ static inline loff_t max_reiserfs_offset
- #define REISERFS_USER_MEM 1 /* reiserfs user memory mode */
-
- #define fs_generation(s) (REISERFS_SB(s)->s_generation_counter)
--#define get_generation(s) atomic_read (&fs_generation(s))
-+#define get_generation(s) atomic_read_unchecked (&fs_generation(s))
- #define FILESYSTEM_CHANGED_TB(tb) (get_generation((tb)->tb_sb) != (tb)->fs_gen)
- #define __fs_changed(gen,s) (gen != get_generation (s))
- #define fs_changed(gen,s) ({cond_resched(); __fs_changed(gen, s);})
-@@ -1534,24 +1534,24 @@ static inline struct super_block *sb_fro
- */
-
- struct item_operations {
-- int (*bytes_number) (struct item_head * ih, int block_size);
-- void (*decrement_key) (struct cpu_key *);
-- int (*is_left_mergeable) (struct reiserfs_key * ih,
-+ int (* const bytes_number) (struct item_head * ih, int block_size);
-+ void (* const decrement_key) (struct cpu_key *);
-+ int (* const is_left_mergeable) (struct reiserfs_key * ih,
- unsigned long bsize);
-- void (*print_item) (struct item_head *, char *item);
-- void (*check_item) (struct item_head *, char *item);
-+ void (* const print_item) (struct item_head *, char *item);
-+ void (* const check_item) (struct item_head *, char *item);
-
-- int (*create_vi) (struct virtual_node * vn, struct virtual_item * vi,
-+ int (* const create_vi) (struct virtual_node * vn, struct virtual_item * vi,
- int is_affected, int insert_size);
-- int (*check_left) (struct virtual_item * vi, int free,
-+ int (* const check_left) (struct virtual_item * vi, int free,
- int start_skip, int end_skip);
-- int (*check_right) (struct virtual_item * vi, int free);
-- int (*part_size) (struct virtual_item * vi, int from, int to);
-- int (*unit_num) (struct virtual_item * vi);
-- void (*print_vi) (struct virtual_item * vi);
-+ int (* const check_right) (struct virtual_item * vi, int free);
-+ int (* const part_size) (struct virtual_item * vi, int from, int to);
-+ int (* const unit_num) (struct virtual_item * vi);
-+ void (* const print_vi) (struct virtual_item * vi);
- };
-
--extern struct item_operations *item_ops[TYPE_ANY + 1];
-+extern const struct item_operations * const item_ops[TYPE_ANY + 1];
-
- #define op_bytes_number(ih,bsize) item_ops[le_ih_k_type (ih)]->bytes_number (ih, bsize)
- #define op_is_left_mergeable(key,bsize) item_ops[le_key_k_type (le_key_version (key), key)]->is_left_mergeable (key, bsize)
-diff -urNp linux-2.6.32.45/include/linux/reiserfs_fs_sb.h linux-2.6.32.45/include/linux/reiserfs_fs_sb.h
---- linux-2.6.32.45/include/linux/reiserfs_fs_sb.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/reiserfs_fs_sb.h 2011-04-17 15:56:46.000000000 -0400
-@@ -377,7 +377,7 @@ struct reiserfs_sb_info {
- /* Comment? -Hans */
- wait_queue_head_t s_wait;
- /* To be obsoleted soon by per buffer seals.. -Hans */
-- atomic_t s_generation_counter; // increased by one every time the
-+ atomic_unchecked_t s_generation_counter; // increased by one every time the
- // tree gets re-balanced
- unsigned long s_properties; /* File system properties. Currently holds
- on-disk FS format */
-diff -urNp linux-2.6.32.45/include/linux/relay.h linux-2.6.32.45/include/linux/relay.h
---- linux-2.6.32.45/include/linux/relay.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/relay.h 2011-08-05 20:33:55.000000000 -0400
-@@ -159,7 +159,7 @@ struct rchan_callbacks
- * The callback should return 0 if successful, negative if not.
- */
- int (*remove_buf_file)(struct dentry *dentry);
--};
-+} __no_const;
-
- /*
- * CONFIG_RELAY kernel API, kernel/relay.c
-diff -urNp linux-2.6.32.45/include/linux/sched.h linux-2.6.32.45/include/linux/sched.h
---- linux-2.6.32.45/include/linux/sched.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/sched.h 2011-08-11 19:48:55.000000000 -0400
-@@ -101,6 +101,7 @@ struct bio;
- struct fs_struct;
- struct bts_context;
- struct perf_event_context;
-+struct linux_binprm;
-
- /*
- * List of flags we want to share for kernel threads,
-@@ -350,7 +351,7 @@ extern signed long schedule_timeout_kill
- extern signed long schedule_timeout_uninterruptible(signed long timeout);
- asmlinkage void __schedule(void);
- asmlinkage void schedule(void);
--extern int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner);
-+extern int mutex_spin_on_owner(struct mutex *lock, struct task_struct *owner);
-
- struct nsproxy;
- struct user_namespace;
-@@ -371,9 +372,12 @@ struct user_namespace;
- #define DEFAULT_MAX_MAP_COUNT (USHORT_MAX - MAPCOUNT_ELF_CORE_MARGIN)
-
- extern int sysctl_max_map_count;
-+extern unsigned long sysctl_heap_stack_gap;
-
- #include <linux/aio.h>
-
-+extern bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len);
-+extern unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len);
- extern unsigned long
- arch_get_unmapped_area(struct file *, unsigned long, unsigned long,
- unsigned long, unsigned long);
-@@ -666,6 +670,16 @@ struct signal_struct {
- struct tty_audit_buf *tty_audit_buf;
- #endif
-
-+#ifdef CONFIG_GRKERNSEC
-+ u32 curr_ip;
-+ u32 saved_ip;
-+ u32 gr_saddr;
-+ u32 gr_daddr;
-+ u16 gr_sport;
-+ u16 gr_dport;
-+ u8 used_accept:1;
-+#endif
-+
- int oom_adj; /* OOM kill score adjustment (bit shift) */
- };
-
-@@ -723,6 +737,11 @@ struct user_struct {
- struct key *session_keyring; /* UID's default session keyring */
- #endif
-
-+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
-+ unsigned int banned;
-+ unsigned long ban_expires;
-+#endif
-+
- /* Hash table maintenance information */
- struct hlist_node uidhash_node;
- uid_t uid;
-@@ -1328,8 +1347,8 @@ struct task_struct {
- struct list_head thread_group;
-
- struct completion *vfork_done; /* for vfork() */
-- int __user *set_child_tid; /* CLONE_CHILD_SETTID */
-- int __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
-+ pid_t __user *set_child_tid; /* CLONE_CHILD_SETTID */
-+ pid_t __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
-
- cputime_t utime, stime, utimescaled, stimescaled;
- cputime_t gtime;
-@@ -1343,16 +1362,6 @@ struct task_struct {
- struct task_cputime cputime_expires;
- struct list_head cpu_timers[3];
-
--/* process credentials */
-- const struct cred *real_cred; /* objective and real subjective task
-- * credentials (COW) */
-- const struct cred *cred; /* effective (overridable) subjective task
-- * credentials (COW) */
-- struct mutex cred_guard_mutex; /* guard against foreign influences on
-- * credential calculations
-- * (notably. ptrace) */
-- struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
--
- char comm[TASK_COMM_LEN]; /* executable name excluding path
- - access with [gs]et_task_comm (which lock
- it with task_lock())
-@@ -1369,6 +1378,10 @@ struct task_struct {
- #endif
- /* CPU-specific state of this task */
- struct thread_struct thread;
-+/* thread_info moved to task_struct */
-+#ifdef CONFIG_X86
-+ struct thread_info tinfo;
-+#endif
- /* filesystem information */
- struct fs_struct *fs;
- /* open file information */
-@@ -1436,6 +1449,15 @@ struct task_struct {
- int hardirq_context;
- int softirq_context;
- #endif
-+
-+/* process credentials */
-+ const struct cred *real_cred; /* objective and real subjective task
-+ * credentials (COW) */
-+ struct mutex cred_guard_mutex; /* guard against foreign influences on
-+ * credential calculations
-+ * (notably. ptrace) */
-+ struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
-+
- #ifdef CONFIG_LOCKDEP
- # define MAX_LOCK_DEPTH 48UL
- u64 curr_chain_key;
-@@ -1456,6 +1478,9 @@ struct task_struct {
-
- struct backing_dev_info *backing_dev_info;
-
-+ const struct cred *cred; /* effective (overridable) subjective task
-+ * credentials (COW) */
-+
- struct io_context *io_context;
-
- unsigned long ptrace_message;
-@@ -1519,6 +1544,21 @@ struct task_struct {
- unsigned long default_timer_slack_ns;
-
- struct list_head *scm_work_list;
-+
-+#ifdef CONFIG_GRKERNSEC
-+ /* grsecurity */
-+ struct dentry *gr_chroot_dentry;
-+ struct acl_subject_label *acl;
-+ struct acl_role_label *role;
-+ struct file *exec_file;
-+ u16 acl_role_id;
-+ /* is this the task that authenticated to the special role */
-+ u8 acl_sp_role;
-+ u8 is_writable;
-+ u8 brute;
-+ u8 gr_is_chrooted;
-+#endif
-+
- #ifdef CONFIG_FUNCTION_GRAPH_TRACER
- /* Index of current stored adress in ret_stack */
- int curr_ret_stack;
-@@ -1542,6 +1582,57 @@ struct task_struct {
- #endif /* CONFIG_TRACING */
- };
-
-+#define MF_PAX_PAGEEXEC 0x01000000 /* Paging based non-executable pages */
-+#define MF_PAX_EMUTRAMP 0x02000000 /* Emulate trampolines */
-+#define MF_PAX_MPROTECT 0x04000000 /* Restrict mprotect() */
-+#define MF_PAX_RANDMMAP 0x08000000 /* Randomize mmap() base */
-+/*#define MF_PAX_RANDEXEC 0x10000000*/ /* Randomize ET_EXEC base */
-+#define MF_PAX_SEGMEXEC 0x20000000 /* Segmentation based non-executable pages */
-+
-+#ifdef CONFIG_PAX_SOFTMODE
-+extern int pax_softmode;
-+#endif
-+
-+extern int pax_check_flags(unsigned long *);
-+
-+/* if tsk != current then task_lock must be held on it */
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+static inline unsigned long pax_get_flags(struct task_struct *tsk)
-+{
-+ if (likely(tsk->mm))
-+ return tsk->mm->pax_flags;
-+ else
-+ return 0UL;
-+}
-+
-+/* if tsk != current then task_lock must be held on it */
-+static inline long pax_set_flags(struct task_struct *tsk, unsigned long flags)
-+{
-+ if (likely(tsk->mm)) {
-+ tsk->mm->pax_flags = flags;
-+ return 0;
-+ }
-+ return -EINVAL;
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
-+extern void pax_set_initial_flags(struct linux_binprm *bprm);
-+#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
-+extern void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
-+#endif
-+
-+extern void pax_report_fault(struct pt_regs *regs, void *pc, void *sp);
-+extern void pax_report_insns(void *pc, void *sp);
-+extern void pax_report_refcount_overflow(struct pt_regs *regs);
-+extern NORET_TYPE void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type) ATTRIB_NORET;
-+
-+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
-+extern void pax_track_stack(void);
-+#else
-+static inline void pax_track_stack(void) {}
-+#endif
-+
- /* Future-safe accessor for struct task_struct's cpus_allowed. */
- #define tsk_cpumask(tsk) (&(tsk)->cpus_allowed)
-
-@@ -1740,7 +1831,7 @@ extern void thread_group_times(struct ta
- #define PF_DUMPCORE 0x00000200 /* dumped core */
- #define PF_SIGNALED 0x00000400 /* killed by a signal */
- #define PF_MEMALLOC 0x00000800 /* Allocating memory */
--#define PF_FLUSHER 0x00001000 /* responsible for disk writeback */
-+#define PF_NPROC_EXCEEDED 0x00001000 /* set_user noticed that RLIMIT_NPROC was exceeded */
- #define PF_USED_MATH 0x00002000 /* if unset the fpu must be initialized before use */
- #define PF_FREEZING 0x00004000 /* freeze in progress. do not account to load */
- #define PF_NOFREEZE 0x00008000 /* this thread should not be frozen */
-@@ -1978,7 +2069,9 @@ void yield(void);
- extern struct exec_domain default_exec_domain;
-
- union thread_union {
-+#ifndef CONFIG_X86
- struct thread_info thread_info;
-+#endif
- unsigned long stack[THREAD_SIZE/sizeof(long)];
- };
-
-@@ -2011,6 +2104,7 @@ extern struct pid_namespace init_pid_ns;
- */
-
- extern struct task_struct *find_task_by_vpid(pid_t nr);
-+extern struct task_struct *find_task_by_vpid_unrestricted(pid_t nr);
- extern struct task_struct *find_task_by_pid_ns(pid_t nr,
- struct pid_namespace *ns);
-
-@@ -2155,7 +2249,7 @@ extern void __cleanup_sighand(struct sig
- extern void exit_itimers(struct signal_struct *);
- extern void flush_itimer_signals(void);
-
--extern NORET_TYPE void do_group_exit(int);
-+extern NORET_TYPE void do_group_exit(int) ATTRIB_NORET;
-
- extern void daemonize(const char *, ...);
- extern int allow_signal(int);
-@@ -2284,13 +2378,17 @@ static inline unsigned long *end_of_stac
-
- #endif
-
--static inline int object_is_on_stack(void *obj)
-+static inline int object_starts_on_stack(void *obj)
- {
-- void *stack = task_stack_page(current);
-+ const void *stack = task_stack_page(current);
-
- return (obj >= stack) && (obj < (stack + THREAD_SIZE));
- }
-
-+#ifdef CONFIG_PAX_USERCOPY
-+extern int object_is_on_stack(const void *obj, unsigned long len);
-+#endif
-+
- extern void thread_info_cache_init(void);
-
- #ifdef CONFIG_DEBUG_STACK_USAGE
-diff -urNp linux-2.6.32.45/include/linux/screen_info.h linux-2.6.32.45/include/linux/screen_info.h
---- linux-2.6.32.45/include/linux/screen_info.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/screen_info.h 2011-04-17 15:56:46.000000000 -0400
-@@ -42,7 +42,8 @@ struct screen_info {
- __u16 pages; /* 0x32 */
- __u16 vesa_attributes; /* 0x34 */
- __u32 capabilities; /* 0x36 */
-- __u8 _reserved[6]; /* 0x3a */
-+ __u16 vesapm_size; /* 0x3a */
-+ __u8 _reserved[4]; /* 0x3c */
- } __attribute__((packed));
-
- #define VIDEO_TYPE_MDA 0x10 /* Monochrome Text Display */
-diff -urNp linux-2.6.32.45/include/linux/security.h linux-2.6.32.45/include/linux/security.h
---- linux-2.6.32.45/include/linux/security.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/security.h 2011-04-17 15:56:46.000000000 -0400
-@@ -34,6 +34,7 @@
- #include <linux/key.h>
- #include <linux/xfrm.h>
- #include <linux/gfp.h>
-+#include <linux/grsecurity.h>
- #include <net/flow.h>
-
- /* Maximum number of letters for an LSM name string */
-diff -urNp linux-2.6.32.45/include/linux/shm.h linux-2.6.32.45/include/linux/shm.h
---- linux-2.6.32.45/include/linux/shm.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/shm.h 2011-04-17 15:56:46.000000000 -0400
-@@ -95,6 +95,10 @@ struct shmid_kernel /* private to the ke
- pid_t shm_cprid;
- pid_t shm_lprid;
- struct user_struct *mlock_user;
-+#ifdef CONFIG_GRKERNSEC
-+ time_t shm_createtime;
-+ pid_t shm_lapid;
-+#endif
- };
-
- /* shm_mode upper byte flags */
-diff -urNp linux-2.6.32.45/include/linux/skbuff.h linux-2.6.32.45/include/linux/skbuff.h
---- linux-2.6.32.45/include/linux/skbuff.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/skbuff.h 2011-08-21 15:27:56.000000000 -0400
-@@ -14,6 +14,7 @@
- #ifndef _LINUX_SKBUFF_H
- #define _LINUX_SKBUFF_H
-
-+#include <linux/const.h>
- #include <linux/kernel.h>
- #include <linux/kmemcheck.h>
- #include <linux/compiler.h>
-@@ -544,7 +545,7 @@ static inline union skb_shared_tx *skb_t
- */
- static inline int skb_queue_empty(const struct sk_buff_head *list)
- {
-- return list->next == (struct sk_buff *)list;
-+ return list->next == (const struct sk_buff *)list;
- }
-
- /**
-@@ -557,7 +558,7 @@ static inline int skb_queue_empty(const
- static inline bool skb_queue_is_last(const struct sk_buff_head *list,
- const struct sk_buff *skb)
- {
-- return (skb->next == (struct sk_buff *) list);
-+ return (skb->next == (const struct sk_buff *) list);
- }
-
- /**
-@@ -570,7 +571,7 @@ static inline bool skb_queue_is_last(con
- static inline bool skb_queue_is_first(const struct sk_buff_head *list,
- const struct sk_buff *skb)
- {
-- return (skb->prev == (struct sk_buff *) list);
-+ return (skb->prev == (const struct sk_buff *) list);
- }
-
- /**
-@@ -1367,7 +1368,7 @@ static inline int skb_network_offset(con
- * headroom, you should not reduce this.
- */
- #ifndef NET_SKB_PAD
--#define NET_SKB_PAD 32
-+#define NET_SKB_PAD (_AC(32,UL))
- #endif
-
- extern int ___pskb_trim(struct sk_buff *skb, unsigned int len);
-diff -urNp linux-2.6.32.45/include/linux/slab_def.h linux-2.6.32.45/include/linux/slab_def.h
---- linux-2.6.32.45/include/linux/slab_def.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/slab_def.h 2011-05-04 17:56:28.000000000 -0400
-@@ -69,10 +69,10 @@ struct kmem_cache {
- unsigned long node_allocs;
- unsigned long node_frees;
- unsigned long node_overflow;
-- atomic_t allochit;
-- atomic_t allocmiss;
-- atomic_t freehit;
-- atomic_t freemiss;
-+ atomic_unchecked_t allochit;
-+ atomic_unchecked_t allocmiss;
-+ atomic_unchecked_t freehit;
-+ atomic_unchecked_t freemiss;
-
- /*
- * If debugging is enabled, then the allocator can add additional
-diff -urNp linux-2.6.32.45/include/linux/slab.h linux-2.6.32.45/include/linux/slab.h
---- linux-2.6.32.45/include/linux/slab.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/slab.h 2011-04-17 15:56:46.000000000 -0400
-@@ -11,12 +11,20 @@
-
- #include <linux/gfp.h>
- #include <linux/types.h>
-+#include <linux/err.h>
-
- /*
- * Flags to pass to kmem_cache_create().
- * The ones marked DEBUG are only valid if CONFIG_SLAB_DEBUG is set.
- */
- #define SLAB_DEBUG_FREE 0x00000100UL /* DEBUG: Perform (expensive) checks on free */
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+#define SLAB_USERCOPY 0x00000200UL /* PaX: Allow copying objs to/from userland */
-+#else
-+#define SLAB_USERCOPY 0x00000000UL
-+#endif
-+
- #define SLAB_RED_ZONE 0x00000400UL /* DEBUG: Red zone objs in a cache */
- #define SLAB_POISON 0x00000800UL /* DEBUG: Poison objects */
- #define SLAB_HWCACHE_ALIGN 0x00002000UL /* Align objs on cache lines */
-@@ -82,10 +90,13 @@
- * ZERO_SIZE_PTR can be passed to kfree though in the same way that NULL can.
- * Both make kfree a no-op.
- */
--#define ZERO_SIZE_PTR ((void *)16)
-+#define ZERO_SIZE_PTR \
-+({ \
-+ BUILD_BUG_ON(!(MAX_ERRNO & ~PAGE_MASK));\
-+ (void *)(-MAX_ERRNO-1L); \
-+})
-
--#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) <= \
-- (unsigned long)ZERO_SIZE_PTR)
-+#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) - 1 >= (unsigned long)ZERO_SIZE_PTR - 1)
-
- /*
- * struct kmem_cache related prototypes
-@@ -138,6 +149,7 @@ void * __must_check krealloc(const void
- void kfree(const void *);
- void kzfree(const void *);
- size_t ksize(const void *);
-+void check_object_size(const void *ptr, unsigned long n, bool to);
-
- /*
- * Allocator specific definitions. These are mainly used to establish optimized
-@@ -328,4 +340,37 @@ static inline void *kzalloc_node(size_t
-
- void __init kmem_cache_init_late(void);
-
-+#define kmalloc(x, y) \
-+({ \
-+ void *___retval; \
-+ intoverflow_t ___x = (intoverflow_t)x; \
-+ if (WARN(___x > ULONG_MAX, "kmalloc size overflow\n"))\
-+ ___retval = NULL; \
-+ else \
-+ ___retval = kmalloc((size_t)___x, (y)); \
-+ ___retval; \
-+})
-+
-+#define kmalloc_node(x, y, z) \
-+({ \
-+ void *___retval; \
-+ intoverflow_t ___x = (intoverflow_t)x; \
-+ if (WARN(___x > ULONG_MAX, "kmalloc_node size overflow\n"))\
-+ ___retval = NULL; \
-+ else \
-+ ___retval = kmalloc_node((size_t)___x, (y), (z));\
-+ ___retval; \
-+})
-+
-+#define kzalloc(x, y) \
-+({ \
-+ void *___retval; \
-+ intoverflow_t ___x = (intoverflow_t)x; \
-+ if (WARN(___x > ULONG_MAX, "kzalloc size overflow\n"))\
-+ ___retval = NULL; \
-+ else \
-+ ___retval = kzalloc((size_t)___x, (y)); \
-+ ___retval; \
-+})
-+
- #endif /* _LINUX_SLAB_H */
-diff -urNp linux-2.6.32.45/include/linux/slub_def.h linux-2.6.32.45/include/linux/slub_def.h
---- linux-2.6.32.45/include/linux/slub_def.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/slub_def.h 2011-08-05 20:33:55.000000000 -0400
-@@ -86,7 +86,7 @@ struct kmem_cache {
- struct kmem_cache_order_objects max;
- struct kmem_cache_order_objects min;
- gfp_t allocflags; /* gfp flags to use on each alloc */
-- int refcount; /* Refcount for slab cache destroy */
-+ atomic_t refcount; /* Refcount for slab cache destroy */
- void (*ctor)(void *);
- int inuse; /* Offset to metadata */
- int align; /* Alignment */
-@@ -215,7 +215,7 @@ static __always_inline struct kmem_cache
- #endif
-
- void *kmem_cache_alloc(struct kmem_cache *, gfp_t);
--void *__kmalloc(size_t size, gfp_t flags);
-+void *__kmalloc(size_t size, gfp_t flags) __alloc_size(1);
-
- #ifdef CONFIG_KMEMTRACE
- extern void *kmem_cache_alloc_notrace(struct kmem_cache *s, gfp_t gfpflags);
-diff -urNp linux-2.6.32.45/include/linux/sonet.h linux-2.6.32.45/include/linux/sonet.h
---- linux-2.6.32.45/include/linux/sonet.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/sonet.h 2011-04-17 15:56:46.000000000 -0400
-@@ -61,7 +61,7 @@ struct sonet_stats {
- #include <asm/atomic.h>
-
- struct k_sonet_stats {
--#define __HANDLE_ITEM(i) atomic_t i
-+#define __HANDLE_ITEM(i) atomic_unchecked_t i
- __SONET_ITEMS
- #undef __HANDLE_ITEM
- };
-diff -urNp linux-2.6.32.45/include/linux/sunrpc/cache.h linux-2.6.32.45/include/linux/sunrpc/cache.h
---- linux-2.6.32.45/include/linux/sunrpc/cache.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/sunrpc/cache.h 2011-08-05 20:33:55.000000000 -0400
-@@ -125,7 +125,7 @@ struct cache_detail {
- */
- struct cache_req {
- struct cache_deferred_req *(*defer)(struct cache_req *req);
--};
-+} __no_const;
- /* this must be embedded in a deferred_request that is being
- * delayed awaiting cache-fill
- */
-diff -urNp linux-2.6.32.45/include/linux/sunrpc/clnt.h linux-2.6.32.45/include/linux/sunrpc/clnt.h
---- linux-2.6.32.45/include/linux/sunrpc/clnt.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/sunrpc/clnt.h 2011-04-17 15:56:46.000000000 -0400
-@@ -167,9 +167,9 @@ static inline unsigned short rpc_get_por
- {
- switch (sap->sa_family) {
- case AF_INET:
-- return ntohs(((struct sockaddr_in *)sap)->sin_port);
-+ return ntohs(((const struct sockaddr_in *)sap)->sin_port);
- case AF_INET6:
-- return ntohs(((struct sockaddr_in6 *)sap)->sin6_port);
-+ return ntohs(((const struct sockaddr_in6 *)sap)->sin6_port);
- }
- return 0;
- }
-@@ -202,7 +202,7 @@ static inline bool __rpc_cmp_addr4(const
- static inline bool __rpc_copy_addr4(struct sockaddr *dst,
- const struct sockaddr *src)
- {
-- const struct sockaddr_in *ssin = (struct sockaddr_in *) src;
-+ const struct sockaddr_in *ssin = (const struct sockaddr_in *) src;
- struct sockaddr_in *dsin = (struct sockaddr_in *) dst;
-
- dsin->sin_family = ssin->sin_family;
-@@ -299,7 +299,7 @@ static inline u32 rpc_get_scope_id(const
- if (sa->sa_family != AF_INET6)
- return 0;
-
-- return ((struct sockaddr_in6 *) sa)->sin6_scope_id;
-+ return ((const struct sockaddr_in6 *) sa)->sin6_scope_id;
- }
-
- #endif /* __KERNEL__ */
-diff -urNp linux-2.6.32.45/include/linux/sunrpc/svc_rdma.h linux-2.6.32.45/include/linux/sunrpc/svc_rdma.h
---- linux-2.6.32.45/include/linux/sunrpc/svc_rdma.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/sunrpc/svc_rdma.h 2011-05-04 17:56:28.000000000 -0400
-@@ -53,15 +53,15 @@ extern unsigned int svcrdma_ord;
- extern unsigned int svcrdma_max_requests;
- extern unsigned int svcrdma_max_req_size;
-
--extern atomic_t rdma_stat_recv;
--extern atomic_t rdma_stat_read;
--extern atomic_t rdma_stat_write;
--extern atomic_t rdma_stat_sq_starve;
--extern atomic_t rdma_stat_rq_starve;
--extern atomic_t rdma_stat_rq_poll;
--extern atomic_t rdma_stat_rq_prod;
--extern atomic_t rdma_stat_sq_poll;
--extern atomic_t rdma_stat_sq_prod;
-+extern atomic_unchecked_t rdma_stat_recv;
-+extern atomic_unchecked_t rdma_stat_read;
-+extern atomic_unchecked_t rdma_stat_write;
-+extern atomic_unchecked_t rdma_stat_sq_starve;
-+extern atomic_unchecked_t rdma_stat_rq_starve;
-+extern atomic_unchecked_t rdma_stat_rq_poll;
-+extern atomic_unchecked_t rdma_stat_rq_prod;
-+extern atomic_unchecked_t rdma_stat_sq_poll;
-+extern atomic_unchecked_t rdma_stat_sq_prod;
-
- #define RPCRDMA_VERSION 1
-
-diff -urNp linux-2.6.32.45/include/linux/suspend.h linux-2.6.32.45/include/linux/suspend.h
---- linux-2.6.32.45/include/linux/suspend.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/suspend.h 2011-04-17 15:56:46.000000000 -0400
-@@ -104,15 +104,15 @@ typedef int __bitwise suspend_state_t;
- * which require special recovery actions in that situation.
- */
- struct platform_suspend_ops {
-- int (*valid)(suspend_state_t state);
-- int (*begin)(suspend_state_t state);
-- int (*prepare)(void);
-- int (*prepare_late)(void);
-- int (*enter)(suspend_state_t state);
-- void (*wake)(void);
-- void (*finish)(void);
-- void (*end)(void);
-- void (*recover)(void);
-+ int (* const valid)(suspend_state_t state);
-+ int (* const begin)(suspend_state_t state);
-+ int (* const prepare)(void);
-+ int (* const prepare_late)(void);
-+ int (* const enter)(suspend_state_t state);
-+ void (* const wake)(void);
-+ void (* const finish)(void);
-+ void (* const end)(void);
-+ void (* const recover)(void);
- };
-
- #ifdef CONFIG_SUSPEND
-@@ -120,7 +120,7 @@ struct platform_suspend_ops {
- * suspend_set_ops - set platform dependent suspend operations
- * @ops: The new suspend operations to set.
- */
--extern void suspend_set_ops(struct platform_suspend_ops *ops);
-+extern void suspend_set_ops(const struct platform_suspend_ops *ops);
- extern int suspend_valid_only_mem(suspend_state_t state);
-
- /**
-@@ -145,7 +145,7 @@ extern int pm_suspend(suspend_state_t st
- #else /* !CONFIG_SUSPEND */
- #define suspend_valid_only_mem NULL
-
--static inline void suspend_set_ops(struct platform_suspend_ops *ops) {}
-+static inline void suspend_set_ops(const struct platform_suspend_ops *ops) {}
- static inline int pm_suspend(suspend_state_t state) { return -ENOSYS; }
- #endif /* !CONFIG_SUSPEND */
-
-@@ -215,16 +215,16 @@ extern void mark_free_pages(struct zone
- * platforms which require special recovery actions in that situation.
- */
- struct platform_hibernation_ops {
-- int (*begin)(void);
-- void (*end)(void);
-- int (*pre_snapshot)(void);
-- void (*finish)(void);
-- int (*prepare)(void);
-- int (*enter)(void);
-- void (*leave)(void);
-- int (*pre_restore)(void);
-- void (*restore_cleanup)(void);
-- void (*recover)(void);
-+ int (* const begin)(void);
-+ void (* const end)(void);
-+ int (* const pre_snapshot)(void);
-+ void (* const finish)(void);
-+ int (* const prepare)(void);
-+ int (* const enter)(void);
-+ void (* const leave)(void);
-+ int (* const pre_restore)(void);
-+ void (* const restore_cleanup)(void);
-+ void (* const recover)(void);
- };
-
- #ifdef CONFIG_HIBERNATION
-@@ -243,7 +243,7 @@ extern void swsusp_set_page_free(struct
- extern void swsusp_unset_page_free(struct page *);
- extern unsigned long get_safe_page(gfp_t gfp_mask);
-
--extern void hibernation_set_ops(struct platform_hibernation_ops *ops);
-+extern void hibernation_set_ops(const struct platform_hibernation_ops *ops);
- extern int hibernate(void);
- extern bool system_entering_hibernation(void);
- #else /* CONFIG_HIBERNATION */
-@@ -251,7 +251,7 @@ static inline int swsusp_page_is_forbidd
- static inline void swsusp_set_page_free(struct page *p) {}
- static inline void swsusp_unset_page_free(struct page *p) {}
-
--static inline void hibernation_set_ops(struct platform_hibernation_ops *ops) {}
-+static inline void hibernation_set_ops(const struct platform_hibernation_ops *ops) {}
- static inline int hibernate(void) { return -ENOSYS; }
- static inline bool system_entering_hibernation(void) { return false; }
- #endif /* CONFIG_HIBERNATION */
-diff -urNp linux-2.6.32.45/include/linux/sysctl.h linux-2.6.32.45/include/linux/sysctl.h
---- linux-2.6.32.45/include/linux/sysctl.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/sysctl.h 2011-04-17 15:56:46.000000000 -0400
-@@ -164,7 +164,11 @@ enum
- KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
- };
-
--
-+#ifdef CONFIG_PAX_SOFTMODE
-+enum {
-+ PAX_SOFTMODE=1 /* PaX: disable/enable soft mode */
-+};
-+#endif
-
- /* CTL_VM names: */
- enum
-@@ -982,6 +986,8 @@ typedef int proc_handler (struct ctl_tab
-
- extern int proc_dostring(struct ctl_table *, int,
- void __user *, size_t *, loff_t *);
-+extern int proc_dostring_modpriv(struct ctl_table *, int,
-+ void __user *, size_t *, loff_t *);
- extern int proc_dointvec(struct ctl_table *, int,
- void __user *, size_t *, loff_t *);
- extern int proc_dointvec_minmax(struct ctl_table *, int,
-@@ -1003,6 +1009,7 @@ extern int do_sysctl (int __user *name,
-
- extern ctl_handler sysctl_data;
- extern ctl_handler sysctl_string;
-+extern ctl_handler sysctl_string_modpriv;
- extern ctl_handler sysctl_intvec;
- extern ctl_handler sysctl_jiffies;
- extern ctl_handler sysctl_ms_jiffies;
-diff -urNp linux-2.6.32.45/include/linux/sysfs.h linux-2.6.32.45/include/linux/sysfs.h
---- linux-2.6.32.45/include/linux/sysfs.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/sysfs.h 2011-04-17 15:56:46.000000000 -0400
-@@ -75,8 +75,8 @@ struct bin_attribute {
- };
-
- struct sysfs_ops {
-- ssize_t (*show)(struct kobject *, struct attribute *,char *);
-- ssize_t (*store)(struct kobject *,struct attribute *,const char *, size_t);
-+ ssize_t (* const show)(struct kobject *, struct attribute *,char *);
-+ ssize_t (* const store)(struct kobject *,struct attribute *,const char *, size_t);
- };
-
- struct sysfs_dirent;
-diff -urNp linux-2.6.32.45/include/linux/thread_info.h linux-2.6.32.45/include/linux/thread_info.h
---- linux-2.6.32.45/include/linux/thread_info.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/thread_info.h 2011-04-17 15:56:46.000000000 -0400
-@@ -23,7 +23,7 @@ struct restart_block {
- };
- /* For futex_wait and futex_wait_requeue_pi */
- struct {
-- u32 *uaddr;
-+ u32 __user *uaddr;
- u32 val;
- u32 flags;
- u32 bitset;
-diff -urNp linux-2.6.32.45/include/linux/tty.h linux-2.6.32.45/include/linux/tty.h
---- linux-2.6.32.45/include/linux/tty.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/tty.h 2011-08-05 20:33:55.000000000 -0400
-@@ -493,7 +493,6 @@ extern void tty_ldisc_begin(void);
- /* This last one is just for the tty layer internals and shouldn't be used elsewhere */
- extern void tty_ldisc_enable(struct tty_struct *tty);
-
--
- /* n_tty.c */
- extern struct tty_ldisc_ops tty_ldisc_N_TTY;
-
-diff -urNp linux-2.6.32.45/include/linux/tty_ldisc.h linux-2.6.32.45/include/linux/tty_ldisc.h
---- linux-2.6.32.45/include/linux/tty_ldisc.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/tty_ldisc.h 2011-04-17 15:56:46.000000000 -0400
-@@ -139,7 +139,7 @@ struct tty_ldisc_ops {
-
- struct module *owner;
-
-- int refcount;
-+ atomic_t refcount;
- };
-
- struct tty_ldisc {
-diff -urNp linux-2.6.32.45/include/linux/types.h linux-2.6.32.45/include/linux/types.h
---- linux-2.6.32.45/include/linux/types.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/types.h 2011-04-17 15:56:46.000000000 -0400
-@@ -191,10 +191,26 @@ typedef struct {
- volatile int counter;
- } atomic_t;
-
-+#ifdef CONFIG_PAX_REFCOUNT
-+typedef struct {
-+ volatile int counter;
-+} atomic_unchecked_t;
-+#else
-+typedef atomic_t atomic_unchecked_t;
-+#endif
-+
- #ifdef CONFIG_64BIT
- typedef struct {
- volatile long counter;
- } atomic64_t;
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+typedef struct {
-+ volatile long counter;
-+} atomic64_unchecked_t;
-+#else
-+typedef atomic64_t atomic64_unchecked_t;
-+#endif
- #endif
-
- struct ustat {
-diff -urNp linux-2.6.32.45/include/linux/uaccess.h linux-2.6.32.45/include/linux/uaccess.h
---- linux-2.6.32.45/include/linux/uaccess.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/uaccess.h 2011-04-17 15:56:46.000000000 -0400
-@@ -76,11 +76,11 @@ static inline unsigned long __copy_from_
- long ret; \
- mm_segment_t old_fs = get_fs(); \
- \
-- set_fs(KERNEL_DS); \
- pagefault_disable(); \
-+ set_fs(KERNEL_DS); \
- ret = __copy_from_user_inatomic(&(retval), (__force typeof(retval) __user *)(addr), sizeof(retval)); \
-- pagefault_enable(); \
- set_fs(old_fs); \
-+ pagefault_enable(); \
- ret; \
- })
-
-@@ -93,7 +93,7 @@ static inline unsigned long __copy_from_
- * Safely read from address @src to the buffer at @dst. If a kernel fault
- * happens, handle that and return -EFAULT.
- */
--extern long probe_kernel_read(void *dst, void *src, size_t size);
-+extern long probe_kernel_read(void *dst, const void *src, size_t size);
-
- /*
- * probe_kernel_write(): safely attempt to write to a location
-@@ -104,6 +104,6 @@ extern long probe_kernel_read(void *dst,
- * Safely write to address @dst from the buffer at @src. If a kernel fault
- * happens, handle that and return -EFAULT.
- */
--extern long probe_kernel_write(void *dst, void *src, size_t size);
-+extern long probe_kernel_write(void *dst, const void *src, size_t size);
-
- #endif /* __LINUX_UACCESS_H__ */
-diff -urNp linux-2.6.32.45/include/linux/unaligned/access_ok.h linux-2.6.32.45/include/linux/unaligned/access_ok.h
---- linux-2.6.32.45/include/linux/unaligned/access_ok.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/unaligned/access_ok.h 2011-04-17 15:56:46.000000000 -0400
-@@ -6,32 +6,32 @@
-
- static inline u16 get_unaligned_le16(const void *p)
- {
-- return le16_to_cpup((__le16 *)p);
-+ return le16_to_cpup((const __le16 *)p);
- }
-
- static inline u32 get_unaligned_le32(const void *p)
- {
-- return le32_to_cpup((__le32 *)p);
-+ return le32_to_cpup((const __le32 *)p);
- }
-
- static inline u64 get_unaligned_le64(const void *p)
- {
-- return le64_to_cpup((__le64 *)p);
-+ return le64_to_cpup((const __le64 *)p);
- }
-
- static inline u16 get_unaligned_be16(const void *p)
- {
-- return be16_to_cpup((__be16 *)p);
-+ return be16_to_cpup((const __be16 *)p);
- }
-
- static inline u32 get_unaligned_be32(const void *p)
- {
-- return be32_to_cpup((__be32 *)p);
-+ return be32_to_cpup((const __be32 *)p);
- }
-
- static inline u64 get_unaligned_be64(const void *p)
- {
-- return be64_to_cpup((__be64 *)p);
-+ return be64_to_cpup((const __be64 *)p);
- }
-
- static inline void put_unaligned_le16(u16 val, void *p)
-diff -urNp linux-2.6.32.45/include/linux/vmalloc.h linux-2.6.32.45/include/linux/vmalloc.h
---- linux-2.6.32.45/include/linux/vmalloc.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/vmalloc.h 2011-04-17 15:56:46.000000000 -0400
-@@ -13,6 +13,11 @@ struct vm_area_struct; /* vma defining
- #define VM_MAP 0x00000004 /* vmap()ed pages */
- #define VM_USERMAP 0x00000008 /* suitable for remap_vmalloc_range */
- #define VM_VPAGES 0x00000010 /* buffer for pages was vmalloc'ed */
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
-+#define VM_KERNEXEC 0x00000020 /* allocate from executable kernel memory range */
-+#endif
-+
- /* bits [20..32] reserved for arch specific ioremap internals */
-
- /*
-@@ -123,4 +128,81 @@ struct vm_struct **pcpu_get_vm_areas(con
-
- void pcpu_free_vm_areas(struct vm_struct **vms, int nr_vms);
-
-+#define vmalloc(x) \
-+({ \
-+ void *___retval; \
-+ intoverflow_t ___x = (intoverflow_t)x; \
-+ if (WARN(___x > ULONG_MAX, "vmalloc size overflow\n")) \
-+ ___retval = NULL; \
-+ else \
-+ ___retval = vmalloc((unsigned long)___x); \
-+ ___retval; \
-+})
-+
-+#define __vmalloc(x, y, z) \
-+({ \
-+ void *___retval; \
-+ intoverflow_t ___x = (intoverflow_t)x; \
-+ if (WARN(___x > ULONG_MAX, "__vmalloc size overflow\n"))\
-+ ___retval = NULL; \
-+ else \
-+ ___retval = __vmalloc((unsigned long)___x, (y), (z));\
-+ ___retval; \
-+})
-+
-+#define vmalloc_user(x) \
-+({ \
-+ void *___retval; \
-+ intoverflow_t ___x = (intoverflow_t)x; \
-+ if (WARN(___x > ULONG_MAX, "vmalloc_user size overflow\n"))\
-+ ___retval = NULL; \
-+ else \
-+ ___retval = vmalloc_user((unsigned long)___x); \
-+ ___retval; \
-+})
-+
-+#define vmalloc_exec(x) \
-+({ \
-+ void *___retval; \
-+ intoverflow_t ___x = (intoverflow_t)x; \
-+ if (WARN(___x > ULONG_MAX, "vmalloc_exec size overflow\n"))\
-+ ___retval = NULL; \
-+ else \
-+ ___retval = vmalloc_exec((unsigned long)___x); \
-+ ___retval; \
-+})
-+
-+#define vmalloc_node(x, y) \
-+({ \
-+ void *___retval; \
-+ intoverflow_t ___x = (intoverflow_t)x; \
-+ if (WARN(___x > ULONG_MAX, "vmalloc_node size overflow\n"))\
-+ ___retval = NULL; \
-+ else \
-+ ___retval = vmalloc_node((unsigned long)___x, (y));\
-+ ___retval; \
-+})
-+
-+#define vmalloc_32(x) \
-+({ \
-+ void *___retval; \
-+ intoverflow_t ___x = (intoverflow_t)x; \
-+ if (WARN(___x > ULONG_MAX, "vmalloc_32 size overflow\n"))\
-+ ___retval = NULL; \
-+ else \
-+ ___retval = vmalloc_32((unsigned long)___x); \
-+ ___retval; \
-+})
-+
-+#define vmalloc_32_user(x) \
-+({ \
-+ void *___retval; \
-+ intoverflow_t ___x = (intoverflow_t)x; \
-+ if (WARN(___x > ULONG_MAX, "vmalloc_32_user size overflow\n"))\
-+ ___retval = NULL; \
-+ else \
-+ ___retval = vmalloc_32_user((unsigned long)___x);\
-+ ___retval; \
-+})
-+
- #endif /* _LINUX_VMALLOC_H */
-diff -urNp linux-2.6.32.45/include/linux/vmstat.h linux-2.6.32.45/include/linux/vmstat.h
---- linux-2.6.32.45/include/linux/vmstat.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/linux/vmstat.h 2011-04-17 15:56:46.000000000 -0400
-@@ -136,18 +136,18 @@ static inline void vm_events_fold_cpu(in
- /*
- * Zone based page accounting with per cpu differentials.
- */
--extern atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
-+extern atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
-
- static inline void zone_page_state_add(long x, struct zone *zone,
- enum zone_stat_item item)
- {
-- atomic_long_add(x, &zone->vm_stat[item]);
-- atomic_long_add(x, &vm_stat[item]);
-+ atomic_long_add_unchecked(x, &zone->vm_stat[item]);
-+ atomic_long_add_unchecked(x, &vm_stat[item]);
- }
-
- static inline unsigned long global_page_state(enum zone_stat_item item)
- {
-- long x = atomic_long_read(&vm_stat[item]);
-+ long x = atomic_long_read_unchecked(&vm_stat[item]);
- #ifdef CONFIG_SMP
- if (x < 0)
- x = 0;
-@@ -158,7 +158,7 @@ static inline unsigned long global_page_
- static inline unsigned long zone_page_state(struct zone *zone,
- enum zone_stat_item item)
- {
-- long x = atomic_long_read(&zone->vm_stat[item]);
-+ long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
- #ifdef CONFIG_SMP
- if (x < 0)
- x = 0;
-@@ -175,7 +175,7 @@ static inline unsigned long zone_page_st
- static inline unsigned long zone_page_state_snapshot(struct zone *zone,
- enum zone_stat_item item)
- {
-- long x = atomic_long_read(&zone->vm_stat[item]);
-+ long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
-
- #ifdef CONFIG_SMP
- int cpu;
-@@ -264,8 +264,8 @@ static inline void __mod_zone_page_state
-
- static inline void __inc_zone_state(struct zone *zone, enum zone_stat_item item)
- {
-- atomic_long_inc(&zone->vm_stat[item]);
-- atomic_long_inc(&vm_stat[item]);
-+ atomic_long_inc_unchecked(&zone->vm_stat[item]);
-+ atomic_long_inc_unchecked(&vm_stat[item]);
- }
-
- static inline void __inc_zone_page_state(struct page *page,
-@@ -276,8 +276,8 @@ static inline void __inc_zone_page_state
-
- static inline void __dec_zone_state(struct zone *zone, enum zone_stat_item item)
- {
-- atomic_long_dec(&zone->vm_stat[item]);
-- atomic_long_dec(&vm_stat[item]);
-+ atomic_long_dec_unchecked(&zone->vm_stat[item]);
-+ atomic_long_dec_unchecked(&vm_stat[item]);
- }
-
- static inline void __dec_zone_page_state(struct page *page,
-diff -urNp linux-2.6.32.45/include/media/v4l2-dev.h linux-2.6.32.45/include/media/v4l2-dev.h
---- linux-2.6.32.45/include/media/v4l2-dev.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/media/v4l2-dev.h 2011-08-05 20:33:55.000000000 -0400
-@@ -34,7 +34,7 @@ struct v4l2_device;
- #define V4L2_FL_UNREGISTERED (0)
-
- struct v4l2_file_operations {
-- struct module *owner;
-+ struct module * const owner;
- ssize_t (*read) (struct file *, char __user *, size_t, loff_t *);
- ssize_t (*write) (struct file *, const char __user *, size_t, loff_t *);
- unsigned int (*poll) (struct file *, struct poll_table_struct *);
-diff -urNp linux-2.6.32.45/include/media/v4l2-device.h linux-2.6.32.45/include/media/v4l2-device.h
---- linux-2.6.32.45/include/media/v4l2-device.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/media/v4l2-device.h 2011-05-04 17:56:28.000000000 -0400
-@@ -71,7 +71,7 @@ int __must_check v4l2_device_register(st
- this function returns 0. If the name ends with a digit (e.g. cx18),
- then the name will be set to cx18-0 since cx180 looks really odd. */
- int v4l2_device_set_name(struct v4l2_device *v4l2_dev, const char *basename,
-- atomic_t *instance);
-+ atomic_unchecked_t *instance);
-
- /* Set v4l2_dev->dev to NULL. Call when the USB parent disconnects.
- Since the parent disappears this ensures that v4l2_dev doesn't have an
-diff -urNp linux-2.6.32.45/include/net/flow.h linux-2.6.32.45/include/net/flow.h
---- linux-2.6.32.45/include/net/flow.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/net/flow.h 2011-05-04 17:56:28.000000000 -0400
-@@ -92,7 +92,7 @@ typedef int (*flow_resolve_t)(struct net
- extern void *flow_cache_lookup(struct net *net, struct flowi *key, u16 family,
- u8 dir, flow_resolve_t resolver);
- extern void flow_cache_flush(void);
--extern atomic_t flow_cache_genid;
-+extern atomic_unchecked_t flow_cache_genid;
-
- static inline int flow_cache_uli_match(struct flowi *fl1, struct flowi *fl2)
- {
-diff -urNp linux-2.6.32.45/include/net/inetpeer.h linux-2.6.32.45/include/net/inetpeer.h
---- linux-2.6.32.45/include/net/inetpeer.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/net/inetpeer.h 2011-04-17 15:56:46.000000000 -0400
-@@ -24,7 +24,7 @@ struct inet_peer
- __u32 dtime; /* the time of last use of not
- * referenced entries */
- atomic_t refcnt;
-- atomic_t rid; /* Frag reception counter */
-+ atomic_unchecked_t rid; /* Frag reception counter */
- __u32 tcp_ts;
- unsigned long tcp_ts_stamp;
- };
-diff -urNp linux-2.6.32.45/include/net/ip_vs.h linux-2.6.32.45/include/net/ip_vs.h
---- linux-2.6.32.45/include/net/ip_vs.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/net/ip_vs.h 2011-05-04 17:56:28.000000000 -0400
-@@ -365,7 +365,7 @@ struct ip_vs_conn {
- struct ip_vs_conn *control; /* Master control connection */
- atomic_t n_control; /* Number of controlled ones */
- struct ip_vs_dest *dest; /* real server */
-- atomic_t in_pkts; /* incoming packet counter */
-+ atomic_unchecked_t in_pkts; /* incoming packet counter */
-
- /* packet transmitter for different forwarding methods. If it
- mangles the packet, it must return NF_DROP or better NF_STOLEN,
-@@ -466,7 +466,7 @@ struct ip_vs_dest {
- union nf_inet_addr addr; /* IP address of the server */
- __be16 port; /* port number of the server */
- volatile unsigned flags; /* dest status flags */
-- atomic_t conn_flags; /* flags to copy to conn */
-+ atomic_unchecked_t conn_flags; /* flags to copy to conn */
- atomic_t weight; /* server weight */
-
- atomic_t refcnt; /* reference counter */
-diff -urNp linux-2.6.32.45/include/net/irda/ircomm_core.h linux-2.6.32.45/include/net/irda/ircomm_core.h
---- linux-2.6.32.45/include/net/irda/ircomm_core.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/net/irda/ircomm_core.h 2011-08-05 20:33:55.000000000 -0400
-@@ -51,7 +51,7 @@ typedef struct {
- int (*connect_response)(struct ircomm_cb *, struct sk_buff *);
- int (*disconnect_request)(struct ircomm_cb *, struct sk_buff *,
- struct ircomm_info *);
--} call_t;
-+} __no_const call_t;
-
- struct ircomm_cb {
- irda_queue_t queue;
-diff -urNp linux-2.6.32.45/include/net/irda/ircomm_tty.h linux-2.6.32.45/include/net/irda/ircomm_tty.h
---- linux-2.6.32.45/include/net/irda/ircomm_tty.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/net/irda/ircomm_tty.h 2011-04-17 15:56:46.000000000 -0400
-@@ -35,6 +35,7 @@
- #include <linux/termios.h>
- #include <linux/timer.h>
- #include <linux/tty.h> /* struct tty_struct */
-+#include <asm/local.h>
-
- #include <net/irda/irias_object.h>
- #include <net/irda/ircomm_core.h>
-@@ -105,8 +106,8 @@ struct ircomm_tty_cb {
- unsigned short close_delay;
- unsigned short closing_wait; /* time to wait before closing */
-
-- int open_count;
-- int blocked_open; /* # of blocked opens */
-+ local_t open_count;
-+ local_t blocked_open; /* # of blocked opens */
-
- /* Protect concurent access to :
- * o self->open_count
-diff -urNp linux-2.6.32.45/include/net/iucv/af_iucv.h linux-2.6.32.45/include/net/iucv/af_iucv.h
---- linux-2.6.32.45/include/net/iucv/af_iucv.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/net/iucv/af_iucv.h 2011-05-04 17:56:28.000000000 -0400
-@@ -87,7 +87,7 @@ struct iucv_sock {
- struct iucv_sock_list {
- struct hlist_head head;
- rwlock_t lock;
-- atomic_t autobind_name;
-+ atomic_unchecked_t autobind_name;
- };
-
- unsigned int iucv_sock_poll(struct file *file, struct socket *sock,
-diff -urNp linux-2.6.32.45/include/net/lapb.h linux-2.6.32.45/include/net/lapb.h
---- linux-2.6.32.45/include/net/lapb.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/net/lapb.h 2011-08-05 20:33:55.000000000 -0400
-@@ -95,7 +95,7 @@ struct lapb_cb {
- struct sk_buff_head write_queue;
- struct sk_buff_head ack_queue;
- unsigned char window;
-- struct lapb_register_struct callbacks;
-+ struct lapb_register_struct *callbacks;
-
- /* FRMR control information */
- struct lapb_frame frmr_data;
-diff -urNp linux-2.6.32.45/include/net/neighbour.h linux-2.6.32.45/include/net/neighbour.h
---- linux-2.6.32.45/include/net/neighbour.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/net/neighbour.h 2011-04-17 15:56:46.000000000 -0400
-@@ -125,12 +125,12 @@ struct neighbour
- struct neigh_ops
- {
- int family;
-- void (*solicit)(struct neighbour *, struct sk_buff*);
-- void (*error_report)(struct neighbour *, struct sk_buff*);
-- int (*output)(struct sk_buff*);
-- int (*connected_output)(struct sk_buff*);
-- int (*hh_output)(struct sk_buff*);
-- int (*queue_xmit)(struct sk_buff*);
-+ void (* const solicit)(struct neighbour *, struct sk_buff*);
-+ void (* const error_report)(struct neighbour *, struct sk_buff*);
-+ int (* const output)(struct sk_buff*);
-+ int (* const connected_output)(struct sk_buff*);
-+ int (* const hh_output)(struct sk_buff*);
-+ int (* const queue_xmit)(struct sk_buff*);
- };
-
- struct pneigh_entry
-diff -urNp linux-2.6.32.45/include/net/netlink.h linux-2.6.32.45/include/net/netlink.h
---- linux-2.6.32.45/include/net/netlink.h 2011-07-13 17:23:04.000000000 -0400
-+++ linux-2.6.32.45/include/net/netlink.h 2011-08-21 18:08:11.000000000 -0400
-@@ -335,7 +335,7 @@ static inline int nlmsg_ok(const struct
- {
- return (remaining >= (int) sizeof(struct nlmsghdr) &&
- nlh->nlmsg_len >= sizeof(struct nlmsghdr) &&
-- nlh->nlmsg_len <= remaining);
-+ nlh->nlmsg_len <= (unsigned int)remaining);
- }
-
- /**
-@@ -558,7 +558,7 @@ static inline void *nlmsg_get_pos(struct
- static inline void nlmsg_trim(struct sk_buff *skb, const void *mark)
- {
- if (mark)
-- skb_trim(skb, (unsigned char *) mark - skb->data);
-+ skb_trim(skb, (const unsigned char *) mark - skb->data);
- }
-
- /**
-diff -urNp linux-2.6.32.45/include/net/netns/ipv4.h linux-2.6.32.45/include/net/netns/ipv4.h
---- linux-2.6.32.45/include/net/netns/ipv4.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/net/netns/ipv4.h 2011-05-04 17:56:28.000000000 -0400
-@@ -54,7 +54,7 @@ struct netns_ipv4 {
- int current_rt_cache_rebuild_count;
-
- struct timer_list rt_secret_timer;
-- atomic_t rt_genid;
-+ atomic_unchecked_t rt_genid;
-
- #ifdef CONFIG_IP_MROUTE
- struct sock *mroute_sk;
-diff -urNp linux-2.6.32.45/include/net/sctp/sctp.h linux-2.6.32.45/include/net/sctp/sctp.h
---- linux-2.6.32.45/include/net/sctp/sctp.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/net/sctp/sctp.h 2011-04-17 15:56:46.000000000 -0400
-@@ -305,8 +305,8 @@ extern int sctp_debug_flag;
-
- #else /* SCTP_DEBUG */
-
--#define SCTP_DEBUG_PRINTK(whatever...)
--#define SCTP_DEBUG_PRINTK_IPADDR(whatever...)
-+#define SCTP_DEBUG_PRINTK(whatever...) do {} while (0)
-+#define SCTP_DEBUG_PRINTK_IPADDR(whatever...) do {} while (0)
- #define SCTP_ENABLE_DEBUG
- #define SCTP_DISABLE_DEBUG
- #define SCTP_ASSERT(expr, str, func)
-diff -urNp linux-2.6.32.45/include/net/secure_seq.h linux-2.6.32.45/include/net/secure_seq.h
---- linux-2.6.32.45/include/net/secure_seq.h 2011-08-16 20:37:25.000000000 -0400
-+++ linux-2.6.32.45/include/net/secure_seq.h 2011-08-07 19:48:09.000000000 -0400
-@@ -7,14 +7,14 @@ extern __u32 secure_ip_id(__be32 daddr);
- extern __u32 secure_ipv6_id(const __be32 daddr[4]);
- extern u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport);
- extern u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
-- __be16 dport);
-+ __be16 dport);
- extern __u32 secure_tcp_sequence_number(__be32 saddr, __be32 daddr,
- __be16 sport, __be16 dport);
- extern __u32 secure_tcpv6_sequence_number(__be32 *saddr, __be32 *daddr,
-- __be16 sport, __be16 dport);
-+ __be16 sport, __be16 dport);
- extern u64 secure_dccp_sequence_number(__be32 saddr, __be32 daddr,
-- __be16 sport, __be16 dport);
-+ __be16 sport, __be16 dport);
- extern u64 secure_dccpv6_sequence_number(__be32 *saddr, __be32 *daddr,
-- __be16 sport, __be16 dport);
-+ __be16 sport, __be16 dport);
-
- #endif /* _NET_SECURE_SEQ */
-diff -urNp linux-2.6.32.45/include/net/sock.h linux-2.6.32.45/include/net/sock.h
---- linux-2.6.32.45/include/net/sock.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/net/sock.h 2011-08-21 17:24:37.000000000 -0400
-@@ -272,7 +272,7 @@ struct sock {
- rwlock_t sk_callback_lock;
- int sk_err,
- sk_err_soft;
-- atomic_t sk_drops;
-+ atomic_unchecked_t sk_drops;
- unsigned short sk_ack_backlog;
- unsigned short sk_max_ack_backlog;
- __u32 sk_priority;
-@@ -737,7 +737,7 @@ static inline void sk_refcnt_debug_relea
- extern void sock_prot_inuse_add(struct net *net, struct proto *prot, int inc);
- extern int sock_prot_inuse_get(struct net *net, struct proto *proto);
- #else
--static void inline sock_prot_inuse_add(struct net *net, struct proto *prot,
-+static inline void sock_prot_inuse_add(struct net *net, struct proto *prot,
- int inc)
- {
- }
-diff -urNp linux-2.6.32.45/include/net/tcp.h linux-2.6.32.45/include/net/tcp.h
---- linux-2.6.32.45/include/net/tcp.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/net/tcp.h 2011-04-17 15:56:46.000000000 -0400
-@@ -1444,6 +1444,7 @@ enum tcp_seq_states {
- struct tcp_seq_afinfo {
- char *name;
- sa_family_t family;
-+ /* cannot be const */
- struct file_operations seq_fops;
- struct seq_operations seq_ops;
- };
-diff -urNp linux-2.6.32.45/include/net/udp.h linux-2.6.32.45/include/net/udp.h
---- linux-2.6.32.45/include/net/udp.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/net/udp.h 2011-04-17 15:56:46.000000000 -0400
-@@ -187,6 +187,7 @@ struct udp_seq_afinfo {
- char *name;
- sa_family_t family;
- struct udp_table *udp_table;
-+ /* cannot be const */
- struct file_operations seq_fops;
- struct seq_operations seq_ops;
- };
-diff -urNp linux-2.6.32.45/include/rdma/iw_cm.h linux-2.6.32.45/include/rdma/iw_cm.h
---- linux-2.6.32.45/include/rdma/iw_cm.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/rdma/iw_cm.h 2011-08-05 20:33:55.000000000 -0400
-@@ -129,7 +129,7 @@ struct iw_cm_verbs {
- int backlog);
-
- int (*destroy_listen)(struct iw_cm_id *cm_id);
--};
-+} __no_const;
-
- /**
- * iw_create_cm_id - Create an IW CM identifier.
-diff -urNp linux-2.6.32.45/include/scsi/scsi_device.h linux-2.6.32.45/include/scsi/scsi_device.h
---- linux-2.6.32.45/include/scsi/scsi_device.h 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.45/include/scsi/scsi_device.h 2011-05-04 17:56:28.000000000 -0400
-@@ -156,9 +156,9 @@ struct scsi_device {
- unsigned int max_device_blocked; /* what device_blocked counts down from */
- #define SCSI_DEFAULT_DEVICE_BLOCKED 3
-
-- atomic_t iorequest_cnt;
-- atomic_t iodone_cnt;
-- atomic_t ioerr_cnt;
-+ atomic_unchecked_t iorequest_cnt;
-+ atomic_unchecked_t iodone_cnt;
-+ atomic_unchecked_t ioerr_cnt;
-
- struct device sdev_gendev,
- sdev_dev;
-diff -urNp linux-2.6.32.45/include/scsi/scsi_transport_fc.h linux-2.6.32.45/include/scsi/scsi_transport_fc.h
---- linux-2.6.32.45/include/scsi/scsi_transport_fc.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/scsi/scsi_transport_fc.h 2011-08-05 20:33:55.000000000 -0400
-@@ -663,9 +663,9 @@ struct fc_function_template {
- int (*bsg_timeout)(struct fc_bsg_job *);
-
- /* allocation lengths for host-specific data */
-- u32 dd_fcrport_size;
-- u32 dd_fcvport_size;
-- u32 dd_bsg_size;
-+ const u32 dd_fcrport_size;
-+ const u32 dd_fcvport_size;
-+ const u32 dd_bsg_size;
-
- /*
- * The driver sets these to tell the transport class it
-@@ -675,39 +675,39 @@ struct fc_function_template {
- */
-
- /* remote port fixed attributes */
-- unsigned long show_rport_maxframe_size:1;
-- unsigned long show_rport_supported_classes:1;
-- unsigned long show_rport_dev_loss_tmo:1;
-+ const unsigned long show_rport_maxframe_size:1;
-+ const unsigned long show_rport_supported_classes:1;
-+ const unsigned long show_rport_dev_loss_tmo:1;
-
- /*
- * target dynamic attributes
- * These should all be "1" if the driver uses the remote port
- * add/delete functions (so attributes reflect rport values).
- */
-- unsigned long show_starget_node_name:1;
-- unsigned long show_starget_port_name:1;
-- unsigned long show_starget_port_id:1;
-+ const unsigned long show_starget_node_name:1;
-+ const unsigned long show_starget_port_name:1;
-+ const unsigned long show_starget_port_id:1;
-
- /* host fixed attributes */
-- unsigned long show_host_node_name:1;
-- unsigned long show_host_port_name:1;
-- unsigned long show_host_permanent_port_name:1;
-- unsigned long show_host_supported_classes:1;
-- unsigned long show_host_supported_fc4s:1;
-- unsigned long show_host_supported_speeds:1;
-- unsigned long show_host_maxframe_size:1;
-- unsigned long show_host_serial_number:1;
-+ const unsigned long show_host_node_name:1;
-+ const unsigned long show_host_port_name:1;
-+ const unsigned long show_host_permanent_port_name:1;
-+ const unsigned long show_host_supported_classes:1;
-+ const unsigned long show_host_supported_fc4s:1;
-+ const unsigned long show_host_supported_speeds:1;
-+ const unsigned long show_host_maxframe_size:1;
-+ const unsigned long show_host_serial_number:1;
- /* host dynamic attributes */
-- unsigned long show_host_port_id:1;
-- unsigned long show_host_port_type:1;
-- unsigned long show_host_port_state:1;
-- unsigned long show_host_active_fc4s:1;
-- unsigned long show_host_speed:1;
-- unsigned long show_host_fabric_name:1;
-- unsigned long show_host_symbolic_name:1;
-- unsigned long show_host_system_hostname:1;
-+ const unsigned long show_host_port_id:1;
-+ const unsigned long show_host_port_type:1;
-+ const unsigned long show_host_port_state:1;
-+ const unsigned long show_host_active_fc4s:1;
-+ const unsigned long show_host_speed:1;
-+ const unsigned long show_host_fabric_name:1;
-+ const unsigned long show_host_symbolic_name:1;
-+ const unsigned long show_host_system_hostname:1;
-
-- unsigned long disable_target_scan:1;
-+ const unsigned long disable_target_scan:1;
- };
-
-
-diff -urNp linux-2.6.32.45/include/sound/ac97_codec.h linux-2.6.32.45/include/sound/ac97_codec.h
---- linux-2.6.32.45/include/sound/ac97_codec.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/sound/ac97_codec.h 2011-04-17 15:56:46.000000000 -0400
-@@ -419,15 +419,15 @@
- struct snd_ac97;
-
- struct snd_ac97_build_ops {
-- int (*build_3d) (struct snd_ac97 *ac97);
-- int (*build_specific) (struct snd_ac97 *ac97);
-- int (*build_spdif) (struct snd_ac97 *ac97);
-- int (*build_post_spdif) (struct snd_ac97 *ac97);
-+ int (* const build_3d) (struct snd_ac97 *ac97);
-+ int (* const build_specific) (struct snd_ac97 *ac97);
-+ int (* const build_spdif) (struct snd_ac97 *ac97);
-+ int (* const build_post_spdif) (struct snd_ac97 *ac97);
- #ifdef CONFIG_PM
-- void (*suspend) (struct snd_ac97 *ac97);
-- void (*resume) (struct snd_ac97 *ac97);
-+ void (* const suspend) (struct snd_ac97 *ac97);
-+ void (* const resume) (struct snd_ac97 *ac97);
- #endif
-- void (*update_jacks) (struct snd_ac97 *ac97); /* for jack-sharing */
-+ void (* const update_jacks) (struct snd_ac97 *ac97); /* for jack-sharing */
- };
-
- struct snd_ac97_bus_ops {
-@@ -477,7 +477,7 @@ struct snd_ac97_template {
-
- struct snd_ac97 {
- /* -- lowlevel (hardware) driver specific -- */
-- struct snd_ac97_build_ops * build_ops;
-+ const struct snd_ac97_build_ops * build_ops;
- void *private_data;
- void (*private_free) (struct snd_ac97 *ac97);
- /* --- */
-diff -urNp linux-2.6.32.45/include/sound/ak4xxx-adda.h linux-2.6.32.45/include/sound/ak4xxx-adda.h
---- linux-2.6.32.45/include/sound/ak4xxx-adda.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/sound/ak4xxx-adda.h 2011-08-05 20:33:55.000000000 -0400
-@@ -35,7 +35,7 @@ struct snd_ak4xxx_ops {
- void (*write)(struct snd_akm4xxx *ak, int chip, unsigned char reg,
- unsigned char val);
- void (*set_rate_val)(struct snd_akm4xxx *ak, unsigned int rate);
--};
-+} __no_const;
-
- #define AK4XXX_IMAGE_SIZE (AK4XXX_MAX_CHIPS * 16) /* 64 bytes */
-
-diff -urNp linux-2.6.32.45/include/sound/hwdep.h linux-2.6.32.45/include/sound/hwdep.h
---- linux-2.6.32.45/include/sound/hwdep.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/sound/hwdep.h 2011-08-05 20:33:55.000000000 -0400
-@@ -49,7 +49,7 @@ struct snd_hwdep_ops {
- struct snd_hwdep_dsp_status *status);
- int (*dsp_load)(struct snd_hwdep *hw,
- struct snd_hwdep_dsp_image *image);
--};
-+} __no_const;
-
- struct snd_hwdep {
- struct snd_card *card;
-diff -urNp linux-2.6.32.45/include/sound/info.h linux-2.6.32.45/include/sound/info.h
---- linux-2.6.32.45/include/sound/info.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/sound/info.h 2011-08-05 20:33:55.000000000 -0400
-@@ -44,7 +44,7 @@ struct snd_info_entry_text {
- struct snd_info_buffer *buffer);
- void (*write)(struct snd_info_entry *entry,
- struct snd_info_buffer *buffer);
--};
-+} __no_const;
-
- struct snd_info_entry_ops {
- int (*open)(struct snd_info_entry *entry,
-diff -urNp linux-2.6.32.45/include/sound/sb16_csp.h linux-2.6.32.45/include/sound/sb16_csp.h
---- linux-2.6.32.45/include/sound/sb16_csp.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/sound/sb16_csp.h 2011-08-05 20:33:55.000000000 -0400
-@@ -139,7 +139,7 @@ struct snd_sb_csp_ops {
- int (*csp_start) (struct snd_sb_csp * p, int sample_width, int channels);
- int (*csp_stop) (struct snd_sb_csp * p);
- int (*csp_qsound_transfer) (struct snd_sb_csp * p);
--};
-+} __no_const;
-
- /*
- * CSP private data
-diff -urNp linux-2.6.32.45/include/sound/ymfpci.h linux-2.6.32.45/include/sound/ymfpci.h
---- linux-2.6.32.45/include/sound/ymfpci.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/sound/ymfpci.h 2011-05-04 17:56:28.000000000 -0400
-@@ -358,7 +358,7 @@ struct snd_ymfpci {
- spinlock_t reg_lock;
- spinlock_t voice_lock;
- wait_queue_head_t interrupt_sleep;
-- atomic_t interrupt_sleep_count;
-+ atomic_unchecked_t interrupt_sleep_count;
- struct snd_info_entry *proc_entry;
- const struct firmware *dsp_microcode;
- const struct firmware *controller_microcode;
-diff -urNp linux-2.6.32.45/include/trace/events/irq.h linux-2.6.32.45/include/trace/events/irq.h
---- linux-2.6.32.45/include/trace/events/irq.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/trace/events/irq.h 2011-04-17 15:56:46.000000000 -0400
-@@ -34,7 +34,7 @@
- */
- TRACE_EVENT(irq_handler_entry,
-
-- TP_PROTO(int irq, struct irqaction *action),
-+ TP_PROTO(int irq, const struct irqaction *action),
-
- TP_ARGS(irq, action),
-
-@@ -64,7 +64,7 @@ TRACE_EVENT(irq_handler_entry,
- */
- TRACE_EVENT(irq_handler_exit,
-
-- TP_PROTO(int irq, struct irqaction *action, int ret),
-+ TP_PROTO(int irq, const struct irqaction *action, int ret),
-
- TP_ARGS(irq, action, ret),
-
-@@ -95,7 +95,7 @@ TRACE_EVENT(irq_handler_exit,
- */
- TRACE_EVENT(softirq_entry,
-
-- TP_PROTO(struct softirq_action *h, struct softirq_action *vec),
-+ TP_PROTO(const struct softirq_action *h, const struct softirq_action *vec),
-
- TP_ARGS(h, vec),
-
-@@ -124,7 +124,7 @@ TRACE_EVENT(softirq_entry,
- */
- TRACE_EVENT(softirq_exit,
-
-- TP_PROTO(struct softirq_action *h, struct softirq_action *vec),
-+ TP_PROTO(const struct softirq_action *h, const struct softirq_action *vec),
-
- TP_ARGS(h, vec),
-
-diff -urNp linux-2.6.32.45/include/video/uvesafb.h linux-2.6.32.45/include/video/uvesafb.h
---- linux-2.6.32.45/include/video/uvesafb.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/include/video/uvesafb.h 2011-04-17 15:56:46.000000000 -0400
-@@ -177,6 +177,7 @@ struct uvesafb_par {
- u8 ypan; /* 0 - nothing, 1 - ypan, 2 - ywrap */
- u8 pmi_setpal; /* PMI for palette changes */
- u16 *pmi_base; /* protected mode interface location */
-+ u8 *pmi_code; /* protected mode code location */
- void *pmi_start;
- void *pmi_pal;
- u8 *vbe_state_orig; /*
-diff -urNp linux-2.6.32.45/init/do_mounts.c linux-2.6.32.45/init/do_mounts.c
---- linux-2.6.32.45/init/do_mounts.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/init/do_mounts.c 2011-04-17 15:56:46.000000000 -0400
-@@ -216,11 +216,11 @@ static void __init get_fs_names(char *pa
-
- static int __init do_mount_root(char *name, char *fs, int flags, void *data)
- {
-- int err = sys_mount(name, "/root", fs, flags, data);
-+ int err = sys_mount((__force char __user *)name, (__force char __user *)"/root", (__force char __user *)fs, flags, (__force void __user *)data);
- if (err)
- return err;
-
-- sys_chdir("/root");
-+ sys_chdir((__force const char __user *)"/root");
- ROOT_DEV = current->fs->pwd.mnt->mnt_sb->s_dev;
- printk("VFS: Mounted root (%s filesystem)%s on device %u:%u.\n",
- current->fs->pwd.mnt->mnt_sb->s_type->name,
-@@ -311,18 +311,18 @@ void __init change_floppy(char *fmt, ...
- va_start(args, fmt);
- vsprintf(buf, fmt, args);
- va_end(args);
-- fd = sys_open("/dev/root", O_RDWR | O_NDELAY, 0);
-+ fd = sys_open((char __user *)"/dev/root", O_RDWR | O_NDELAY, 0);
- if (fd >= 0) {
- sys_ioctl(fd, FDEJECT, 0);
- sys_close(fd);
- }
- printk(KERN_NOTICE "VFS: Insert %s and press ENTER\n", buf);
-- fd = sys_open("/dev/console", O_RDWR, 0);
-+ fd = sys_open((char __user *)"/dev/console", O_RDWR, 0);
- if (fd >= 0) {
- sys_ioctl(fd, TCGETS, (long)&termios);
- termios.c_lflag &= ~ICANON;
- sys_ioctl(fd, TCSETSF, (long)&termios);
-- sys_read(fd, &c, 1);
-+ sys_read(fd, (char __user *)&c, 1);
- termios.c_lflag |= ICANON;
- sys_ioctl(fd, TCSETSF, (long)&termios);
- sys_close(fd);
-@@ -416,6 +416,6 @@ void __init prepare_namespace(void)
- mount_root();
- out:
- devtmpfs_mount("dev");
-- sys_mount(".", "/", NULL, MS_MOVE, NULL);
-- sys_chroot(".");
-+ sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
-+ sys_chroot((__force char __user *)".");
- }
-diff -urNp linux-2.6.32.45/init/do_mounts.h linux-2.6.32.45/init/do_mounts.h
---- linux-2.6.32.45/init/do_mounts.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/init/do_mounts.h 2011-04-17 15:56:46.000000000 -0400
-@@ -15,15 +15,15 @@ extern int root_mountflags;
-
- static inline int create_dev(char *name, dev_t dev)
- {
-- sys_unlink(name);
-- return sys_mknod(name, S_IFBLK|0600, new_encode_dev(dev));
-+ sys_unlink((__force char __user *)name);
-+ return sys_mknod((__force char __user *)name, S_IFBLK|0600, new_encode_dev(dev));
- }
-
- #if BITS_PER_LONG == 32
- static inline u32 bstat(char *name)
- {
- struct stat64 stat;
-- if (sys_stat64(name, &stat) != 0)
-+ if (sys_stat64((__force char __user *)name, (__force struct stat64 __user *)&stat) != 0)
- return 0;
- if (!S_ISBLK(stat.st_mode))
- return 0;
-diff -urNp linux-2.6.32.45/init/do_mounts_initrd.c linux-2.6.32.45/init/do_mounts_initrd.c
---- linux-2.6.32.45/init/do_mounts_initrd.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/init/do_mounts_initrd.c 2011-04-17 15:56:46.000000000 -0400
-@@ -32,7 +32,7 @@ static int __init do_linuxrc(void * shel
- sys_close(old_fd);sys_close(root_fd);
- sys_close(0);sys_close(1);sys_close(2);
- sys_setsid();
-- (void) sys_open("/dev/console",O_RDWR,0);
-+ (void) sys_open((__force const char __user *)"/dev/console",O_RDWR,0);
- (void) sys_dup(0);
- (void) sys_dup(0);
- return kernel_execve(shell, argv, envp_init);
-@@ -47,13 +47,13 @@ static void __init handle_initrd(void)
- create_dev("/dev/root.old", Root_RAM0);
- /* mount initrd on rootfs' /root */
- mount_block_root("/dev/root.old", root_mountflags & ~MS_RDONLY);
-- sys_mkdir("/old", 0700);
-- root_fd = sys_open("/", 0, 0);
-- old_fd = sys_open("/old", 0, 0);
-+ sys_mkdir((__force const char __user *)"/old", 0700);
-+ root_fd = sys_open((__force const char __user *)"/", 0, 0);
-+ old_fd = sys_open((__force const char __user *)"/old", 0, 0);
- /* move initrd over / and chdir/chroot in initrd root */
-- sys_chdir("/root");
-- sys_mount(".", "/", NULL, MS_MOVE, NULL);
-- sys_chroot(".");
-+ sys_chdir((__force const char __user *)"/root");
-+ sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
-+ sys_chroot((__force const char __user *)".");
-
- /*
- * In case that a resume from disk is carried out by linuxrc or one of
-@@ -70,15 +70,15 @@ static void __init handle_initrd(void)
-
- /* move initrd to rootfs' /old */
- sys_fchdir(old_fd);
-- sys_mount("/", ".", NULL, MS_MOVE, NULL);
-+ sys_mount((__force char __user *)"/", (__force char __user *)".", NULL, MS_MOVE, NULL);
- /* switch root and cwd back to / of rootfs */
- sys_fchdir(root_fd);
-- sys_chroot(".");
-+ sys_chroot((__force const char __user *)".");
- sys_close(old_fd);
- sys_close(root_fd);
-
- if (new_decode_dev(real_root_dev) == Root_RAM0) {
-- sys_chdir("/old");
-+ sys_chdir((__force const char __user *)"/old");
- return;
- }
-
-@@ -86,17 +86,17 @@ static void __init handle_initrd(void)
- mount_root();
-
- printk(KERN_NOTICE "Trying to move old root to /initrd ... ");
-- error = sys_mount("/old", "/root/initrd", NULL, MS_MOVE, NULL);
-+ error = sys_mount((__force char __user *)"/old", (__force char __user *)"/root/initrd", NULL, MS_MOVE, NULL);
- if (!error)
- printk("okay\n");
- else {
-- int fd = sys_open("/dev/root.old", O_RDWR, 0);
-+ int fd = sys_open((__force const char __user *)"/dev/root.old", O_RDWR, 0);
- if (error == -ENOENT)
- printk("/initrd does not exist. Ignored.\n");
- else
- printk("failed\n");
- printk(KERN_NOTICE "Unmounting old root\n");
-- sys_umount("/old", MNT_DETACH);
-+ sys_umount((__force char __user *)"/old", MNT_DETACH);
- printk(KERN_NOTICE "Trying to free ramdisk memory ... ");
- if (fd < 0) {
- error = fd;
-@@ -119,11 +119,11 @@ int __init initrd_load(void)
- * mounted in the normal path.
- */
- if (rd_load_image("/initrd.image") && ROOT_DEV != Root_RAM0) {
-- sys_unlink("/initrd.image");
-+ sys_unlink((__force const char __user *)"/initrd.image");
- handle_initrd();
- return 1;
- }
- }
-- sys_unlink("/initrd.image");
-+ sys_unlink((__force const char __user *)"/initrd.image");
- return 0;
- }
-diff -urNp linux-2.6.32.45/init/do_mounts_md.c linux-2.6.32.45/init/do_mounts_md.c
---- linux-2.6.32.45/init/do_mounts_md.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/init/do_mounts_md.c 2011-04-17 15:56:46.000000000 -0400
-@@ -170,7 +170,7 @@ static void __init md_setup_drive(void)
- partitioned ? "_d" : "", minor,
- md_setup_args[ent].device_names);
-
-- fd = sys_open(name, 0, 0);
-+ fd = sys_open((__force char __user *)name, 0, 0);
- if (fd < 0) {
- printk(KERN_ERR "md: open failed - cannot start "
- "array %s\n", name);
-@@ -233,7 +233,7 @@ static void __init md_setup_drive(void)
- * array without it
- */
- sys_close(fd);
-- fd = sys_open(name, 0, 0);
-+ fd = sys_open((__force char __user *)name, 0, 0);
- sys_ioctl(fd, BLKRRPART, 0);
- }
- sys_close(fd);
-@@ -283,7 +283,7 @@ static void __init autodetect_raid(void)
-
- wait_for_device_probe();
-
-- fd = sys_open("/dev/md0", 0, 0);
-+ fd = sys_open((__force char __user *)"/dev/md0", 0, 0);
- if (fd >= 0) {
- sys_ioctl(fd, RAID_AUTORUN, raid_autopart);
- sys_close(fd);
-diff -urNp linux-2.6.32.45/init/initramfs.c linux-2.6.32.45/init/initramfs.c
---- linux-2.6.32.45/init/initramfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/init/initramfs.c 2011-04-17 15:56:46.000000000 -0400
-@@ -74,7 +74,7 @@ static void __init free_hash(void)
- }
- }
-
--static long __init do_utime(char __user *filename, time_t mtime)
-+static long __init do_utime(__force char __user *filename, time_t mtime)
- {
- struct timespec t[2];
-
-@@ -109,7 +109,7 @@ static void __init dir_utime(void)
- struct dir_entry *de, *tmp;
- list_for_each_entry_safe(de, tmp, &dir_list, list) {
- list_del(&de->list);
-- do_utime(de->name, de->mtime);
-+ do_utime((__force char __user *)de->name, de->mtime);
- kfree(de->name);
- kfree(de);
- }
-@@ -271,7 +271,7 @@ static int __init maybe_link(void)
- if (nlink >= 2) {
- char *old = find_link(major, minor, ino, mode, collected);
- if (old)
-- return (sys_link(old, collected) < 0) ? -1 : 1;
-+ return (sys_link((__force char __user *)old, (__force char __user *)collected) < 0) ? -1 : 1;
- }
- return 0;
- }
-@@ -280,11 +280,11 @@ static void __init clean_path(char *path
- {
- struct stat st;
-
-- if (!sys_newlstat(path, &st) && (st.st_mode^mode) & S_IFMT) {
-+ if (!sys_newlstat((__force char __user *)path, (__force struct stat __user *)&st) && (st.st_mode^mode) & S_IFMT) {
- if (S_ISDIR(st.st_mode))
-- sys_rmdir(path);
-+ sys_rmdir((__force char __user *)path);
- else
-- sys_unlink(path);
-+ sys_unlink((__force char __user *)path);
- }
- }
-
-@@ -305,7 +305,7 @@ static int __init do_name(void)
- int openflags = O_WRONLY|O_CREAT;
- if (ml != 1)
- openflags |= O_TRUNC;
-- wfd = sys_open(collected, openflags, mode);
-+ wfd = sys_open((__force char __user *)collected, openflags, mode);
-
- if (wfd >= 0) {
- sys_fchown(wfd, uid, gid);
-@@ -317,17 +317,17 @@ static int __init do_name(void)
- }
- }
- } else if (S_ISDIR(mode)) {
-- sys_mkdir(collected, mode);
-- sys_chown(collected, uid, gid);
-- sys_chmod(collected, mode);
-+ sys_mkdir((__force char __user *)collected, mode);
-+ sys_chown((__force char __user *)collected, uid, gid);
-+ sys_chmod((__force char __user *)collected, mode);
- dir_add(collected, mtime);
- } else if (S_ISBLK(mode) || S_ISCHR(mode) ||
- S_ISFIFO(mode) || S_ISSOCK(mode)) {
- if (maybe_link() == 0) {
-- sys_mknod(collected, mode, rdev);
-- sys_chown(collected, uid, gid);
-- sys_chmod(collected, mode);
-- do_utime(collected, mtime);
-+ sys_mknod((__force char __user *)collected, mode, rdev);
-+ sys_chown((__force char __user *)collected, uid, gid);
-+ sys_chmod((__force char __user *)collected, mode);
-+ do_utime((__force char __user *)collected, mtime);
- }
- }
- return 0;
-@@ -336,15 +336,15 @@ static int __init do_name(void)
- static int __init do_copy(void)
- {
- if (count >= body_len) {
-- sys_write(wfd, victim, body_len);
-+ sys_write(wfd, (__force char __user *)victim, body_len);
- sys_close(wfd);
-- do_utime(vcollected, mtime);
-+ do_utime((__force char __user *)vcollected, mtime);
- kfree(vcollected);
- eat(body_len);
- state = SkipIt;
- return 0;
- } else {
-- sys_write(wfd, victim, count);
-+ sys_write(wfd, (__force char __user *)victim, count);
- body_len -= count;
- eat(count);
- return 1;
-@@ -355,9 +355,9 @@ static int __init do_symlink(void)
- {
- collected[N_ALIGN(name_len) + body_len] = '\0';
- clean_path(collected, 0);
-- sys_symlink(collected + N_ALIGN(name_len), collected);
-- sys_lchown(collected, uid, gid);
-- do_utime(collected, mtime);
-+ sys_symlink((__force char __user *)collected + N_ALIGN(name_len), (__force char __user *)collected);
-+ sys_lchown((__force char __user *)collected, uid, gid);
-+ do_utime((__force char __user *)collected, mtime);
- state = SkipIt;
- next_state = Reset;
- return 0;
-diff -urNp linux-2.6.32.45/init/Kconfig linux-2.6.32.45/init/Kconfig
---- linux-2.6.32.45/init/Kconfig 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.45/init/Kconfig 2011-05-10 22:12:34.000000000 -0400
-@@ -1004,7 +1004,7 @@ config SLUB_DEBUG
-
- config COMPAT_BRK
- bool "Disable heap randomization"
-- default y
-+ default n
- help
- Randomizing heap placement makes heap exploits harder, but it
- also breaks ancient binaries (including anything libc5 based).
-diff -urNp linux-2.6.32.45/init/main.c linux-2.6.32.45/init/main.c
---- linux-2.6.32.45/init/main.c 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.45/init/main.c 2011-08-05 20:33:55.000000000 -0400
-@@ -97,6 +97,7 @@ static inline void mark_rodata_ro(void)
- #ifdef CONFIG_TC
- extern void tc_init(void);
- #endif
-+extern void grsecurity_init(void);
-
- enum system_states system_state __read_mostly;
- EXPORT_SYMBOL(system_state);
-@@ -183,6 +184,49 @@ static int __init set_reset_devices(char
-
- __setup("reset_devices", set_reset_devices);
-
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+extern char pax_enter_kernel_user[];
-+extern char pax_exit_kernel_user[];
-+extern pgdval_t clone_pgd_mask;
-+#endif
-+
-+#if defined(CONFIG_X86) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+static int __init setup_pax_nouderef(char *str)
-+{
-+#ifdef CONFIG_X86_32
-+ unsigned int cpu;
-+ struct desc_struct *gdt;
-+
-+ for (cpu = 0; cpu < NR_CPUS; cpu++) {
-+ gdt = get_cpu_gdt_table(cpu);
-+ gdt[GDT_ENTRY_KERNEL_DS].type = 3;
-+ gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
-+ gdt[GDT_ENTRY_DEFAULT_USER_CS].limit = 0xf;
-+ gdt[GDT_ENTRY_DEFAULT_USER_DS].limit = 0xf;
-+ }
-+ asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
-+#else
-+ memcpy(pax_enter_kernel_user, (unsigned char []){0xc3}, 1);
-+ memcpy(pax_exit_kernel_user, (unsigned char []){0xc3}, 1);
-+ clone_pgd_mask = ~(pgdval_t)0UL;
-+#endif
-+
-+ return 0;
-+}
-+early_param("pax_nouderef", setup_pax_nouderef);
-+#endif
-+
-+#ifdef CONFIG_PAX_SOFTMODE
-+int pax_softmode;
-+
-+static int __init setup_pax_softmode(char *str)
-+{
-+ get_option(&str, &pax_softmode);
-+ return 1;
-+}
-+__setup("pax_softmode=", setup_pax_softmode);
-+#endif
-+
- static char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
- char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
- static const char *panic_later, *panic_param;
-@@ -705,52 +749,53 @@ int initcall_debug;
- core_param(initcall_debug, initcall_debug, bool, 0644);
-
- static char msgbuf[64];
--static struct boot_trace_call call;
--static struct boot_trace_ret ret;
-+static struct boot_trace_call trace_call;
-+static struct boot_trace_ret trace_ret;
-
- int do_one_initcall(initcall_t fn)
- {
- int count = preempt_count();
- ktime_t calltime, delta, rettime;
-+ const char *msg1 = "", *msg2 = "";
-
- if (initcall_debug) {
-- call.caller = task_pid_nr(current);
-- printk("calling %pF @ %i\n", fn, call.caller);
-+ trace_call.caller = task_pid_nr(current);
-+ printk("calling %pF @ %i\n", fn, trace_call.caller);
- calltime = ktime_get();
-- trace_boot_call(&call, fn);
-+ trace_boot_call(&trace_call, fn);
- enable_boot_trace();
- }
-
-- ret.result = fn();
-+ trace_ret.result = fn();
-
- if (initcall_debug) {
- disable_boot_trace();
- rettime = ktime_get();
- delta = ktime_sub(rettime, calltime);
-- ret.duration = (unsigned long long) ktime_to_ns(delta) >> 10;
-- trace_boot_ret(&ret, fn);
-+ trace_ret.duration = (unsigned long long) ktime_to_ns(delta) >> 10;
-+ trace_boot_ret(&trace_ret, fn);
- printk("initcall %pF returned %d after %Ld usecs\n", fn,
-- ret.result, ret.duration);
-+ trace_ret.result, trace_ret.duration);
- }
-
- msgbuf[0] = 0;
-
-- if (ret.result && ret.result != -ENODEV && initcall_debug)
-- sprintf(msgbuf, "error code %d ", ret.result);
-+ if (trace_ret.result && trace_ret.result != -ENODEV && initcall_debug)
-+ sprintf(msgbuf, "error code %d ", trace_ret.result);
-
- if (preempt_count() != count) {
-- strlcat(msgbuf, "preemption imbalance ", sizeof(msgbuf));
-+ msg1 = " preemption imbalance";
- preempt_count() = count;
- }
- if (irqs_disabled()) {
-- strlcat(msgbuf, "disabled interrupts ", sizeof(msgbuf));
-+ msg2 = " disabled interrupts";
- local_irq_enable();
- }
-- if (msgbuf[0]) {
-- printk("initcall %pF returned with %s\n", fn, msgbuf);
-+ if (msgbuf[0] || *msg1 || *msg2) {
-+ printk("initcall %pF returned with %s%s%s\n", fn, msgbuf, msg1, msg2);
- }
-
-- return ret.result;
-+ return trace_ret.result;
- }
-
-
-@@ -893,11 +938,13 @@ static int __init kernel_init(void * unu
- if (!ramdisk_execute_command)
- ramdisk_execute_command = "/init";
-
-- if (sys_access((const char __user *) ramdisk_execute_command, 0) != 0) {
-+ if (sys_access((__force const char __user *) ramdisk_execute_command, 0) != 0) {
- ramdisk_execute_command = NULL;
- prepare_namespace();
- }
-
-+ grsecurity_init();
-+
- /*
- * Ok, we have completed the initial bootup, and
- * we're essentially up and running. Get rid of the
-diff -urNp linux-2.6.32.45/init/noinitramfs.c linux-2.6.32.45/init/noinitramfs.c
---- linux-2.6.32.45/init/noinitramfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/init/noinitramfs.c 2011-04-17 15:56:46.000000000 -0400
-@@ -29,7 +29,7 @@ static int __init default_rootfs(void)
- {
- int err;
-
-- err = sys_mkdir("/dev", 0755);
-+ err = sys_mkdir((const char __user *)"/dev", 0755);
- if (err < 0)
- goto out;
-
-@@ -39,7 +39,7 @@ static int __init default_rootfs(void)
- if (err < 0)
- goto out;
-
-- err = sys_mkdir("/root", 0700);
-+ err = sys_mkdir((const char __user *)"/root", 0700);
- if (err < 0)
- goto out;
-
-diff -urNp linux-2.6.32.45/ipc/mqueue.c linux-2.6.32.45/ipc/mqueue.c
---- linux-2.6.32.45/ipc/mqueue.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/ipc/mqueue.c 2011-04-17 15:56:46.000000000 -0400
-@@ -150,6 +150,7 @@ static struct inode *mqueue_get_inode(st
- mq_bytes = (mq_msg_tblsz +
- (info->attr.mq_maxmsg * info->attr.mq_msgsize));
-
-+ gr_learn_resource(current, RLIMIT_MSGQUEUE, u->mq_bytes + mq_bytes, 1);
- spin_lock(&mq_lock);
- if (u->mq_bytes + mq_bytes < u->mq_bytes ||
- u->mq_bytes + mq_bytes >
-diff -urNp linux-2.6.32.45/ipc/msg.c linux-2.6.32.45/ipc/msg.c
---- linux-2.6.32.45/ipc/msg.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/ipc/msg.c 2011-08-05 20:33:55.000000000 -0400
-@@ -310,18 +310,19 @@ static inline int msg_security(struct ke
- return security_msg_queue_associate(msq, msgflg);
- }
-
-+static struct ipc_ops msg_ops = {
-+ .getnew = newque,
-+ .associate = msg_security,
-+ .more_checks = NULL
-+};
-+
- SYSCALL_DEFINE2(msgget, key_t, key, int, msgflg)
- {
- struct ipc_namespace *ns;
-- struct ipc_ops msg_ops;
- struct ipc_params msg_params;
-
- ns = current->nsproxy->ipc_ns;
-
-- msg_ops.getnew = newque;
-- msg_ops.associate = msg_security;
-- msg_ops.more_checks = NULL;
--
- msg_params.key = key;
- msg_params.flg = msgflg;
-
-diff -urNp linux-2.6.32.45/ipc/sem.c linux-2.6.32.45/ipc/sem.c
---- linux-2.6.32.45/ipc/sem.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/ipc/sem.c 2011-08-05 20:33:55.000000000 -0400
-@@ -309,10 +309,15 @@ static inline int sem_more_checks(struct
- return 0;
- }
-
-+static struct ipc_ops sem_ops = {
-+ .getnew = newary,
-+ .associate = sem_security,
-+ .more_checks = sem_more_checks
-+};
-+
- SYSCALL_DEFINE3(semget, key_t, key, int, nsems, int, semflg)
- {
- struct ipc_namespace *ns;
-- struct ipc_ops sem_ops;
- struct ipc_params sem_params;
-
- ns = current->nsproxy->ipc_ns;
-@@ -320,10 +325,6 @@ SYSCALL_DEFINE3(semget, key_t, key, int,
- if (nsems < 0 || nsems > ns->sc_semmsl)
- return -EINVAL;
-
-- sem_ops.getnew = newary;
-- sem_ops.associate = sem_security;
-- sem_ops.more_checks = sem_more_checks;
--
- sem_params.key = key;
- sem_params.flg = semflg;
- sem_params.u.nsems = nsems;
-@@ -671,6 +672,8 @@ static int semctl_main(struct ipc_namesp
- ushort* sem_io = fast_sem_io;
- int nsems;
-
-+ pax_track_stack();
-+
- sma = sem_lock_check(ns, semid);
- if (IS_ERR(sma))
- return PTR_ERR(sma);
-@@ -1071,6 +1074,8 @@ SYSCALL_DEFINE4(semtimedop, int, semid,
- unsigned long jiffies_left = 0;
- struct ipc_namespace *ns;
-
-+ pax_track_stack();
-+
- ns = current->nsproxy->ipc_ns;
-
- if (nsops < 1 || semid < 0)
-diff -urNp linux-2.6.32.45/ipc/shm.c linux-2.6.32.45/ipc/shm.c
---- linux-2.6.32.45/ipc/shm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/ipc/shm.c 2011-08-05 20:33:55.000000000 -0400
-@@ -70,6 +70,14 @@ static void shm_destroy (struct ipc_name
- static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
- #endif
-
-+#ifdef CONFIG_GRKERNSEC
-+extern int gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
-+ const time_t shm_createtime, const uid_t cuid,
-+ const int shmid);
-+extern int gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
-+ const time_t shm_createtime);
-+#endif
-+
- void shm_init_ns(struct ipc_namespace *ns)
- {
- ns->shm_ctlmax = SHMMAX;
-@@ -396,6 +404,14 @@ static int newseg(struct ipc_namespace *
- shp->shm_lprid = 0;
- shp->shm_atim = shp->shm_dtim = 0;
- shp->shm_ctim = get_seconds();
-+#ifdef CONFIG_GRKERNSEC
-+ {
-+ struct timespec timeval;
-+ do_posix_clock_monotonic_gettime(&timeval);
-+
-+ shp->shm_createtime = timeval.tv_sec;
-+ }
-+#endif
- shp->shm_segsz = size;
- shp->shm_nattch = 0;
- shp->shm_file = file;
-@@ -446,18 +462,19 @@ static inline int shm_more_checks(struct
- return 0;
- }
-
-+static struct ipc_ops shm_ops = {
-+ .getnew = newseg,
-+ .associate = shm_security,
-+ .more_checks = shm_more_checks
-+};
-+
- SYSCALL_DEFINE3(shmget, key_t, key, size_t, size, int, shmflg)
- {
- struct ipc_namespace *ns;
-- struct ipc_ops shm_ops;
- struct ipc_params shm_params;
-
- ns = current->nsproxy->ipc_ns;
-
-- shm_ops.getnew = newseg;
-- shm_ops.associate = shm_security;
-- shm_ops.more_checks = shm_more_checks;
--
- shm_params.key = key;
- shm_params.flg = shmflg;
- shm_params.u.size = size;
-@@ -880,9 +897,21 @@ long do_shmat(int shmid, char __user *sh
- if (err)
- goto out_unlock;
-
-+#ifdef CONFIG_GRKERNSEC
-+ if (!gr_handle_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime,
-+ shp->shm_perm.cuid, shmid) ||
-+ !gr_chroot_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime)) {
-+ err = -EACCES;
-+ goto out_unlock;
-+ }
-+#endif
-+
- path.dentry = dget(shp->shm_file->f_path.dentry);
- path.mnt = shp->shm_file->f_path.mnt;
- shp->shm_nattch++;
-+#ifdef CONFIG_GRKERNSEC
-+ shp->shm_lapid = current->pid;
-+#endif
- size = i_size_read(path.dentry->d_inode);
- shm_unlock(shp);
-
-diff -urNp linux-2.6.32.45/kernel/acct.c linux-2.6.32.45/kernel/acct.c
---- linux-2.6.32.45/kernel/acct.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/acct.c 2011-04-17 15:56:46.000000000 -0400
-@@ -579,7 +579,7 @@ static void do_acct_process(struct bsd_a
- */
- flim = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
- current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY;
-- file->f_op->write(file, (char *)&ac,
-+ file->f_op->write(file, (__force char __user *)&ac,
- sizeof(acct_t), &file->f_pos);
- current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
- set_fs(fs);
-diff -urNp linux-2.6.32.45/kernel/audit.c linux-2.6.32.45/kernel/audit.c
---- linux-2.6.32.45/kernel/audit.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/audit.c 2011-05-04 17:56:28.000000000 -0400
-@@ -110,7 +110,7 @@ u32 audit_sig_sid = 0;
- 3) suppressed due to audit_rate_limit
- 4) suppressed due to audit_backlog_limit
- */
--static atomic_t audit_lost = ATOMIC_INIT(0);
-+static atomic_unchecked_t audit_lost = ATOMIC_INIT(0);
-
- /* The netlink socket. */
- static struct sock *audit_sock;
-@@ -232,7 +232,7 @@ void audit_log_lost(const char *message)
- unsigned long now;
- int print;
-
-- atomic_inc(&audit_lost);
-+ atomic_inc_unchecked(&audit_lost);
-
- print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit);
-
-@@ -251,7 +251,7 @@ void audit_log_lost(const char *message)
- printk(KERN_WARNING
- "audit: audit_lost=%d audit_rate_limit=%d "
- "audit_backlog_limit=%d\n",
-- atomic_read(&audit_lost),
-+ atomic_read_unchecked(&audit_lost),
- audit_rate_limit,
- audit_backlog_limit);
- audit_panic(message);
-@@ -691,7 +691,7 @@ static int audit_receive_msg(struct sk_b
- status_set.pid = audit_pid;
- status_set.rate_limit = audit_rate_limit;
- status_set.backlog_limit = audit_backlog_limit;
-- status_set.lost = atomic_read(&audit_lost);
-+ status_set.lost = atomic_read_unchecked(&audit_lost);
- status_set.backlog = skb_queue_len(&audit_skb_queue);
- audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_GET, 0, 0,
- &status_set, sizeof(status_set));
-@@ -891,8 +891,10 @@ static int audit_receive_msg(struct sk_b
- spin_unlock_irq(&tsk->sighand->siglock);
- }
- read_unlock(&tasklist_lock);
-- audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_TTY_GET, 0, 0,
-- &s, sizeof(s));
-+
-+ if (!err)
-+ audit_send_reply(NETLINK_CB(skb).pid, seq,
-+ AUDIT_TTY_GET, 0, 0, &s, sizeof(s));
- break;
- }
- case AUDIT_TTY_SET: {
-diff -urNp linux-2.6.32.45/kernel/auditsc.c linux-2.6.32.45/kernel/auditsc.c
---- linux-2.6.32.45/kernel/auditsc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/auditsc.c 2011-05-04 17:56:28.000000000 -0400
-@@ -2113,7 +2113,7 @@ int auditsc_get_stamp(struct audit_conte
- }
-
- /* global counter which is incremented every time something logs in */
--static atomic_t session_id = ATOMIC_INIT(0);
-+static atomic_unchecked_t session_id = ATOMIC_INIT(0);
-
- /**
- * audit_set_loginuid - set a task's audit_context loginuid
-@@ -2126,7 +2126,7 @@ static atomic_t session_id = ATOMIC_INIT
- */
- int audit_set_loginuid(struct task_struct *task, uid_t loginuid)
- {
-- unsigned int sessionid = atomic_inc_return(&session_id);
-+ unsigned int sessionid = atomic_inc_return_unchecked(&session_id);
- struct audit_context *context = task->audit_context;
-
- if (context && context->in_syscall) {
-diff -urNp linux-2.6.32.45/kernel/capability.c linux-2.6.32.45/kernel/capability.c
---- linux-2.6.32.45/kernel/capability.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/capability.c 2011-04-17 15:56:46.000000000 -0400
-@@ -305,10 +305,26 @@ int capable(int cap)
- BUG();
- }
-
-- if (security_capable(cap) == 0) {
-+ if (security_capable(cap) == 0 && gr_is_capable(cap)) {
- current->flags |= PF_SUPERPRIV;
- return 1;
- }
- return 0;
- }
-+
-+int capable_nolog(int cap)
-+{
-+ if (unlikely(!cap_valid(cap))) {
-+ printk(KERN_CRIT "capable() called with invalid cap=%u\n", cap);
-+ BUG();
-+ }
-+
-+ if (security_capable(cap) == 0 && gr_is_capable_nolog(cap)) {
-+ current->flags |= PF_SUPERPRIV;
-+ return 1;
-+ }
-+ return 0;
-+}
-+
- EXPORT_SYMBOL(capable);
-+EXPORT_SYMBOL(capable_nolog);
-diff -urNp linux-2.6.32.45/kernel/cgroup.c linux-2.6.32.45/kernel/cgroup.c
---- linux-2.6.32.45/kernel/cgroup.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/cgroup.c 2011-05-16 21:46:57.000000000 -0400
-@@ -536,6 +536,8 @@ static struct css_set *find_css_set(
- struct hlist_head *hhead;
- struct cg_cgroup_link *link;
-
-+ pax_track_stack();
-+
- /* First see if we already have a cgroup group that matches
- * the desired set */
- read_lock(&css_set_lock);
-diff -urNp linux-2.6.32.45/kernel/configs.c linux-2.6.32.45/kernel/configs.c
---- linux-2.6.32.45/kernel/configs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/configs.c 2011-04-17 15:56:46.000000000 -0400
-@@ -73,8 +73,19 @@ static int __init ikconfig_init(void)
- struct proc_dir_entry *entry;
-
- /* create the current config file */
-+#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_HIDESYM)
-+ entry = proc_create("config.gz", S_IFREG | S_IRUSR, NULL,
-+ &ikconfig_file_ops);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ entry = proc_create("config.gz", S_IFREG | S_IRUSR | S_IRGRP, NULL,
-+ &ikconfig_file_ops);
-+#endif
-+#else
- entry = proc_create("config.gz", S_IFREG | S_IRUGO, NULL,
- &ikconfig_file_ops);
-+#endif
-+
- if (!entry)
- return -ENOMEM;
-
-diff -urNp linux-2.6.32.45/kernel/cpu.c linux-2.6.32.45/kernel/cpu.c
---- linux-2.6.32.45/kernel/cpu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/cpu.c 2011-04-17 15:56:46.000000000 -0400
-@@ -19,7 +19,7 @@
- /* Serializes the updates to cpu_online_mask, cpu_present_mask */
- static DEFINE_MUTEX(cpu_add_remove_lock);
-
--static __cpuinitdata RAW_NOTIFIER_HEAD(cpu_chain);
-+static RAW_NOTIFIER_HEAD(cpu_chain);
-
- /* If set, cpu_up and cpu_down will return -EBUSY and do nothing.
- * Should always be manipulated under cpu_add_remove_lock
-diff -urNp linux-2.6.32.45/kernel/cred.c linux-2.6.32.45/kernel/cred.c
---- linux-2.6.32.45/kernel/cred.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/cred.c 2011-08-11 19:49:38.000000000 -0400
-@@ -160,6 +160,8 @@ static void put_cred_rcu(struct rcu_head
- */
- void __put_cred(struct cred *cred)
- {
-+ pax_track_stack();
-+
- kdebug("__put_cred(%p{%d,%d})", cred,
- atomic_read(&cred->usage),
- read_cred_subscribers(cred));
-@@ -184,6 +186,8 @@ void exit_creds(struct task_struct *tsk)
- {
- struct cred *cred;
-
-+ pax_track_stack();
-+
- kdebug("exit_creds(%u,%p,%p,{%d,%d})", tsk->pid, tsk->real_cred, tsk->cred,
- atomic_read(&tsk->cred->usage),
- read_cred_subscribers(tsk->cred));
-@@ -222,6 +226,8 @@ const struct cred *get_task_cred(struct
- {
- const struct cred *cred;
-
-+ pax_track_stack();
-+
- rcu_read_lock();
-
- do {
-@@ -241,6 +247,8 @@ struct cred *cred_alloc_blank(void)
- {
- struct cred *new;
-
-+ pax_track_stack();
-+
- new = kmem_cache_zalloc(cred_jar, GFP_KERNEL);
- if (!new)
- return NULL;
-@@ -289,6 +297,8 @@ struct cred *prepare_creds(void)
- const struct cred *old;
- struct cred *new;
-
-+ pax_track_stack();
-+
- validate_process_creds();
-
- new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
-@@ -335,6 +345,8 @@ struct cred *prepare_exec_creds(void)
- struct thread_group_cred *tgcred = NULL;
- struct cred *new;
-
-+ pax_track_stack();
-+
- #ifdef CONFIG_KEYS
- tgcred = kmalloc(sizeof(*tgcred), GFP_KERNEL);
- if (!tgcred)
-@@ -441,6 +453,8 @@ int copy_creds(struct task_struct *p, un
- struct cred *new;
- int ret;
-
-+ pax_track_stack();
-+
- mutex_init(&p->cred_guard_mutex);
-
- if (
-@@ -528,6 +542,8 @@ int commit_creds(struct cred *new)
- struct task_struct *task = current;
- const struct cred *old = task->real_cred;
-
-+ pax_track_stack();
-+
- kdebug("commit_creds(%p{%d,%d})", new,
- atomic_read(&new->usage),
- read_cred_subscribers(new));
-@@ -544,6 +560,8 @@ int commit_creds(struct cred *new)
-
- get_cred(new); /* we will require a ref for the subj creds too */
-
-+ gr_set_role_label(task, new->uid, new->gid);
-+
- /* dumpability changes */
- if (old->euid != new->euid ||
- old->egid != new->egid ||
-@@ -563,10 +581,8 @@ int commit_creds(struct cred *new)
- key_fsgid_changed(task);
-
- /* do it
-- * - What if a process setreuid()'s and this brings the
-- * new uid over his NPROC rlimit? We can check this now
-- * cheaply with the new uid cache, so if it matters
-- * we should be checking for it. -DaveM
-+ * RLIMIT_NPROC limits on user->processes have already been checked
-+ * in set_user().
- */
- alter_cred_subscribers(new, 2);
- if (new->user != old->user)
-@@ -606,6 +622,8 @@ EXPORT_SYMBOL(commit_creds);
- */
- void abort_creds(struct cred *new)
- {
-+ pax_track_stack();
-+
- kdebug("abort_creds(%p{%d,%d})", new,
- atomic_read(&new->usage),
- read_cred_subscribers(new));
-@@ -629,6 +647,8 @@ const struct cred *override_creds(const
- {
- const struct cred *old = current->cred;
-
-+ pax_track_stack();
-+
- kdebug("override_creds(%p{%d,%d})", new,
- atomic_read(&new->usage),
- read_cred_subscribers(new));
-@@ -658,6 +678,8 @@ void revert_creds(const struct cred *old
- {
- const struct cred *override = current->cred;
-
-+ pax_track_stack();
-+
- kdebug("revert_creds(%p{%d,%d})", old,
- atomic_read(&old->usage),
- read_cred_subscribers(old));
-@@ -704,6 +726,8 @@ struct cred *prepare_kernel_cred(struct
- const struct cred *old;
- struct cred *new;
-
-+ pax_track_stack();
-+
- new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
- if (!new)
- return NULL;
-@@ -758,6 +782,8 @@ EXPORT_SYMBOL(prepare_kernel_cred);
- */
- int set_security_override(struct cred *new, u32 secid)
- {
-+ pax_track_stack();
-+
- return security_kernel_act_as(new, secid);
- }
- EXPORT_SYMBOL(set_security_override);
-@@ -777,6 +803,8 @@ int set_security_override_from_ctx(struc
- u32 secid;
- int ret;
-
-+ pax_track_stack();
-+
- ret = security_secctx_to_secid(secctx, strlen(secctx), &secid);
- if (ret < 0)
- return ret;
-diff -urNp linux-2.6.32.45/kernel/exit.c linux-2.6.32.45/kernel/exit.c
---- linux-2.6.32.45/kernel/exit.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/exit.c 2011-08-17 19:19:50.000000000 -0400
-@@ -55,6 +55,10 @@
- #include <asm/pgtable.h>
- #include <asm/mmu_context.h>
-
-+#ifdef CONFIG_GRKERNSEC
-+extern rwlock_t grsec_exec_file_lock;
-+#endif
-+
- static void exit_mm(struct task_struct * tsk);
-
- static void __unhash_process(struct task_struct *p)
-@@ -174,6 +178,10 @@ void release_task(struct task_struct * p
- struct task_struct *leader;
- int zap_leader;
- repeat:
-+#ifdef CONFIG_NET
-+ gr_del_task_from_ip_table(p);
-+#endif
-+
- tracehook_prepare_release_task(p);
- /* don't need to get the RCU readlock here - the process is dead and
- * can't be modifying its own credentials */
-@@ -341,11 +349,22 @@ static void reparent_to_kthreadd(void)
- {
- write_lock_irq(&tasklist_lock);
-
-+#ifdef CONFIG_GRKERNSEC
-+ write_lock(&grsec_exec_file_lock);
-+ if (current->exec_file) {
-+ fput(current->exec_file);
-+ current->exec_file = NULL;
-+ }
-+ write_unlock(&grsec_exec_file_lock);
-+#endif
-+
- ptrace_unlink(current);
- /* Reparent to init */
- current->real_parent = current->parent = kthreadd_task;
- list_move_tail(¤t->sibling, ¤t->real_parent->children);
-
-+ gr_set_kernel_label(current);
-+
- /* Set the exit signal to SIGCHLD so we signal init on exit */
- current->exit_signal = SIGCHLD;
-
-@@ -397,7 +416,7 @@ int allow_signal(int sig)
- * know it'll be handled, so that they don't get converted to
- * SIGKILL or just silently dropped.
- */
-- current->sighand->action[(sig)-1].sa.sa_handler = (void __user *)2;
-+ current->sighand->action[(sig)-1].sa.sa_handler = (__force void __user *)2;
- recalc_sigpending();
- spin_unlock_irq(¤t->sighand->siglock);
- return 0;
-@@ -433,6 +452,17 @@ void daemonize(const char *name, ...)
- vsnprintf(current->comm, sizeof(current->comm), name, args);
- va_end(args);
-
-+#ifdef CONFIG_GRKERNSEC
-+ write_lock(&grsec_exec_file_lock);
-+ if (current->exec_file) {
-+ fput(current->exec_file);
-+ current->exec_file = NULL;
-+ }
-+ write_unlock(&grsec_exec_file_lock);
-+#endif
-+
-+ gr_set_kernel_label(current);
-+
- /*
- * If we were started as result of loading a module, close all of the
- * user space pages. We don't need them, and if we didn't close them
-@@ -897,17 +927,17 @@ NORET_TYPE void do_exit(long code)
- struct task_struct *tsk = current;
- int group_dead;
-
-- profile_task_exit(tsk);
--
-- WARN_ON(atomic_read(&tsk->fs_excl));
--
-+ /*
-+ * Check this first since set_fs() below depends on
-+ * current_thread_info(), which we better not access when we're in
-+ * interrupt context. Other than that, we want to do the set_fs()
-+ * as early as possible.
-+ */
- if (unlikely(in_interrupt()))
- panic("Aiee, killing interrupt handler!");
-- if (unlikely(!tsk->pid))
-- panic("Attempted to kill the idle task!");
-
- /*
-- * If do_exit is called because this processes oopsed, it's possible
-+ * If do_exit is called because this processes Oops'ed, it's possible
- * that get_fs() was left as KERNEL_DS, so reset it to USER_DS before
- * continuing. Amongst other possible reasons, this is to prevent
- * mm_release()->clear_child_tid() from writing to a user-controlled
-@@ -915,6 +945,13 @@ NORET_TYPE void do_exit(long code)
- */
- set_fs(USER_DS);
-
-+ profile_task_exit(tsk);
-+
-+ WARN_ON(atomic_read(&tsk->fs_excl));
-+
-+ if (unlikely(!tsk->pid))
-+ panic("Attempted to kill the idle task!");
-+
- tracehook_report_exit(&code);
-
- validate_creds_for_do_exit(tsk);
-@@ -973,6 +1010,9 @@ NORET_TYPE void do_exit(long code)
- tsk->exit_code = code;
- taskstats_exit(tsk, group_dead);
-
-+ gr_acl_handle_psacct(tsk, code);
-+ gr_acl_handle_exit();
-+
- exit_mm(tsk);
-
- if (group_dead)
-@@ -1188,7 +1228,7 @@ static int wait_task_zombie(struct wait_
-
- if (unlikely(wo->wo_flags & WNOWAIT)) {
- int exit_code = p->exit_code;
-- int why, status;
-+ int why;
-
- get_task_struct(p);
- read_unlock(&tasklist_lock);
-diff -urNp linux-2.6.32.45/kernel/fork.c linux-2.6.32.45/kernel/fork.c
---- linux-2.6.32.45/kernel/fork.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/fork.c 2011-08-11 19:50:07.000000000 -0400
-@@ -253,7 +253,7 @@ static struct task_struct *dup_task_stru
- *stackend = STACK_END_MAGIC; /* for overflow detection */
-
- #ifdef CONFIG_CC_STACKPROTECTOR
-- tsk->stack_canary = get_random_int();
-+ tsk->stack_canary = pax_get_random_long();
- #endif
-
- /* One for us, one for whoever does the "release_task()" (usually parent) */
-@@ -293,8 +293,8 @@ static int dup_mmap(struct mm_struct *mm
- mm->locked_vm = 0;
- mm->mmap = NULL;
- mm->mmap_cache = NULL;
-- mm->free_area_cache = oldmm->mmap_base;
-- mm->cached_hole_size = ~0UL;
-+ mm->free_area_cache = oldmm->free_area_cache;
-+ mm->cached_hole_size = oldmm->cached_hole_size;
- mm->map_count = 0;
- cpumask_clear(mm_cpumask(mm));
- mm->mm_rb = RB_ROOT;
-@@ -335,6 +335,7 @@ static int dup_mmap(struct mm_struct *mm
- tmp->vm_flags &= ~VM_LOCKED;
- tmp->vm_mm = mm;
- tmp->vm_next = tmp->vm_prev = NULL;
-+ tmp->vm_mirror = NULL;
- anon_vma_link(tmp);
- file = tmp->vm_file;
- if (file) {
-@@ -384,6 +385,31 @@ static int dup_mmap(struct mm_struct *mm
- if (retval)
- goto out;
- }
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (oldmm->pax_flags & MF_PAX_SEGMEXEC) {
-+ struct vm_area_struct *mpnt_m;
-+
-+ for (mpnt = oldmm->mmap, mpnt_m = mm->mmap; mpnt; mpnt = mpnt->vm_next, mpnt_m = mpnt_m->vm_next) {
-+ BUG_ON(!mpnt_m || mpnt_m->vm_mirror || mpnt->vm_mm != oldmm || mpnt_m->vm_mm != mm);
-+
-+ if (!mpnt->vm_mirror)
-+ continue;
-+
-+ if (mpnt->vm_end <= SEGMEXEC_TASK_SIZE) {
-+ BUG_ON(mpnt->vm_mirror->vm_mirror != mpnt);
-+ mpnt->vm_mirror = mpnt_m;
-+ } else {
-+ BUG_ON(mpnt->vm_mirror->vm_mirror == mpnt || mpnt->vm_mirror->vm_mirror->vm_mm != mm);
-+ mpnt_m->vm_mirror = mpnt->vm_mirror->vm_mirror;
-+ mpnt_m->vm_mirror->vm_mirror = mpnt_m;
-+ mpnt->vm_mirror->vm_mirror = mpnt;
-+ }
-+ }
-+ BUG_ON(mpnt_m);
-+ }
-+#endif
-+
- /* a new mm has just been created */
- arch_dup_mmap(oldmm, mm);
- retval = 0;
-@@ -734,13 +760,14 @@ static int copy_fs(unsigned long clone_f
- write_unlock(&fs->lock);
- return -EAGAIN;
- }
-- fs->users++;
-+ atomic_inc(&fs->users);
- write_unlock(&fs->lock);
- return 0;
- }
- tsk->fs = copy_fs_struct(fs);
- if (!tsk->fs)
- return -ENOMEM;
-+ gr_set_chroot_entries(tsk, &tsk->fs->root);
- return 0;
- }
-
-@@ -1033,12 +1060,16 @@ static struct task_struct *copy_process(
- DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
- #endif
- retval = -EAGAIN;
-+
-+ gr_learn_resource(p, RLIMIT_NPROC, atomic_read(&p->real_cred->user->processes), 0);
-+
- if (atomic_read(&p->real_cred->user->processes) >=
- p->signal->rlim[RLIMIT_NPROC].rlim_cur) {
-- if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
-- p->real_cred->user != INIT_USER)
-+ if (p->real_cred->user != INIT_USER &&
-+ !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN))
- goto bad_fork_free;
- }
-+ current->flags &= ~PF_NPROC_EXCEEDED;
-
- retval = copy_creds(p, clone_flags);
- if (retval < 0)
-@@ -1183,6 +1214,8 @@ static struct task_struct *copy_process(
- goto bad_fork_free_pid;
- }
-
-+ gr_copy_label(p);
-+
- p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
- /*
- * Clear TID on mm_release()?
-@@ -1333,6 +1366,8 @@ bad_fork_cleanup_count:
- bad_fork_free:
- free_task(p);
- fork_out:
-+ gr_log_forkfail(retval);
-+
- return ERR_PTR(retval);
- }
-
-@@ -1426,6 +1461,8 @@ long do_fork(unsigned long clone_flags,
- if (clone_flags & CLONE_PARENT_SETTID)
- put_user(nr, parent_tidptr);
-
-+ gr_handle_brute_check();
-+
- if (clone_flags & CLONE_VFORK) {
- p->vfork_done = &vfork;
- init_completion(&vfork);
-@@ -1558,7 +1595,7 @@ static int unshare_fs(unsigned long unsh
- return 0;
-
- /* don't need lock here; in the worst case we'll do useless copy */
-- if (fs->users == 1)
-+ if (atomic_read(&fs->users) == 1)
- return 0;
-
- *new_fsp = copy_fs_struct(fs);
-@@ -1681,7 +1718,8 @@ SYSCALL_DEFINE1(unshare, unsigned long,
- fs = current->fs;
- write_lock(&fs->lock);
- current->fs = new_fs;
-- if (--fs->users)
-+ gr_set_chroot_entries(current, ¤t->fs->root);
-+ if (atomic_dec_return(&fs->users))
- new_fs = NULL;
- else
- new_fs = fs;
-diff -urNp linux-2.6.32.45/kernel/futex.c linux-2.6.32.45/kernel/futex.c
---- linux-2.6.32.45/kernel/futex.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/futex.c 2011-05-16 21:46:57.000000000 -0400
-@@ -54,6 +54,7 @@
- #include <linux/mount.h>
- #include <linux/pagemap.h>
- #include <linux/syscalls.h>
-+#include <linux/ptrace.h>
- #include <linux/signal.h>
- #include <linux/module.h>
- #include <linux/magic.h>
-@@ -221,6 +222,11 @@ get_futex_key(u32 __user *uaddr, int fsh
- struct page *page;
- int err;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && address >= SEGMEXEC_TASK_SIZE)
-+ return -EFAULT;
-+#endif
-+
- /*
- * The futex address must be "naturally" aligned.
- */
-@@ -1789,6 +1795,8 @@ static int futex_wait(u32 __user *uaddr,
- struct futex_q q;
- int ret;
-
-+ pax_track_stack();
-+
- if (!bitset)
- return -EINVAL;
-
-@@ -1841,7 +1849,7 @@ retry:
-
- restart = ¤t_thread_info()->restart_block;
- restart->fn = futex_wait_restart;
-- restart->futex.uaddr = (u32 *)uaddr;
-+ restart->futex.uaddr = uaddr;
- restart->futex.val = val;
- restart->futex.time = abs_time->tv64;
- restart->futex.bitset = bitset;
-@@ -2203,6 +2211,8 @@ static int futex_wait_requeue_pi(u32 __u
- struct futex_q q;
- int res, ret;
-
-+ pax_track_stack();
-+
- if (!bitset)
- return -EINVAL;
-
-@@ -2377,7 +2387,9 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
- {
- struct robust_list_head __user *head;
- unsigned long ret;
-+#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
- const struct cred *cred = current_cred(), *pcred;
-+#endif
-
- if (!futex_cmpxchg_enabled)
- return -ENOSYS;
-@@ -2393,11 +2405,16 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
- if (!p)
- goto err_unlock;
- ret = -EPERM;
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ if (!ptrace_may_access(p, PTRACE_MODE_READ))
-+ goto err_unlock;
-+#else
- pcred = __task_cred(p);
- if (cred->euid != pcred->euid &&
- cred->euid != pcred->uid &&
- !capable(CAP_SYS_PTRACE))
- goto err_unlock;
-+#endif
- head = p->robust_list;
- rcu_read_unlock();
- }
-@@ -2459,7 +2476,7 @@ retry:
- */
- static inline int fetch_robust_entry(struct robust_list __user **entry,
- struct robust_list __user * __user *head,
-- int *pi)
-+ unsigned int *pi)
- {
- unsigned long uentry;
-
-@@ -2640,6 +2657,7 @@ static int __init futex_init(void)
- {
- u32 curval;
- int i;
-+ mm_segment_t oldfs;
-
- /*
- * This will fail and we want it. Some arch implementations do
-@@ -2651,7 +2669,10 @@ static int __init futex_init(void)
- * implementation, the non functional ones will return
- * -ENOSYS.
- */
-+ oldfs = get_fs();
-+ set_fs(USER_DS);
- curval = cmpxchg_futex_value_locked(NULL, 0, 0);
-+ set_fs(oldfs);
- if (curval == -EFAULT)
- futex_cmpxchg_enabled = 1;
-
-diff -urNp linux-2.6.32.45/kernel/futex_compat.c linux-2.6.32.45/kernel/futex_compat.c
---- linux-2.6.32.45/kernel/futex_compat.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/futex_compat.c 2011-04-17 15:56:46.000000000 -0400
-@@ -10,6 +10,7 @@
- #include <linux/compat.h>
- #include <linux/nsproxy.h>
- #include <linux/futex.h>
-+#include <linux/ptrace.h>
-
- #include <asm/uaccess.h>
-
-@@ -135,7 +136,10 @@ compat_sys_get_robust_list(int pid, comp
- {
- struct compat_robust_list_head __user *head;
- unsigned long ret;
-- const struct cred *cred = current_cred(), *pcred;
-+#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ const struct cred *cred = current_cred();
-+ const struct cred *pcred;
-+#endif
-
- if (!futex_cmpxchg_enabled)
- return -ENOSYS;
-@@ -151,11 +155,16 @@ compat_sys_get_robust_list(int pid, comp
- if (!p)
- goto err_unlock;
- ret = -EPERM;
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ if (!ptrace_may_access(p, PTRACE_MODE_READ))
-+ goto err_unlock;
-+#else
- pcred = __task_cred(p);
- if (cred->euid != pcred->euid &&
- cred->euid != pcred->uid &&
- !capable(CAP_SYS_PTRACE))
- goto err_unlock;
-+#endif
- head = p->compat_robust_list;
- read_unlock(&tasklist_lock);
- }
-diff -urNp linux-2.6.32.45/kernel/gcov/base.c linux-2.6.32.45/kernel/gcov/base.c
---- linux-2.6.32.45/kernel/gcov/base.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/gcov/base.c 2011-04-17 15:56:46.000000000 -0400
-@@ -102,11 +102,6 @@ void gcov_enable_events(void)
- }
-
- #ifdef CONFIG_MODULES
--static inline int within(void *addr, void *start, unsigned long size)
--{
-- return ((addr >= start) && (addr < start + size));
--}
--
- /* Update list and generate events when modules are unloaded. */
- static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
- void *data)
-@@ -121,7 +116,7 @@ static int gcov_module_notifier(struct n
- prev = NULL;
- /* Remove entries located in module from linked list. */
- for (info = gcov_info_head; info; info = info->next) {
-- if (within(info, mod->module_core, mod->core_size)) {
-+ if (within_module_core_rw((unsigned long)info, mod)) {
- if (prev)
- prev->next = info->next;
- else
-diff -urNp linux-2.6.32.45/kernel/hrtimer.c linux-2.6.32.45/kernel/hrtimer.c
---- linux-2.6.32.45/kernel/hrtimer.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/hrtimer.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1391,7 +1391,7 @@ void hrtimer_peek_ahead_timers(void)
- local_irq_restore(flags);
- }
-
--static void run_hrtimer_softirq(struct softirq_action *h)
-+static void run_hrtimer_softirq(void)
- {
- hrtimer_peek_ahead_timers();
- }
-diff -urNp linux-2.6.32.45/kernel/kallsyms.c linux-2.6.32.45/kernel/kallsyms.c
---- linux-2.6.32.45/kernel/kallsyms.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/kallsyms.c 2011-04-17 15:56:46.000000000 -0400
-@@ -11,6 +11,9 @@
- * Changed the compression method from stem compression to "table lookup"
- * compression (see scripts/kallsyms.c for a more complete description)
- */
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+#define __INCLUDED_BY_HIDESYM 1
-+#endif
- #include <linux/kallsyms.h>
- #include <linux/module.h>
- #include <linux/init.h>
-@@ -51,12 +54,33 @@ extern const unsigned long kallsyms_mark
-
- static inline int is_kernel_inittext(unsigned long addr)
- {
-+ if (system_state != SYSTEM_BOOTING)
-+ return 0;
-+
- if (addr >= (unsigned long)_sinittext
- && addr <= (unsigned long)_einittext)
- return 1;
- return 0;
- }
-
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+#ifdef CONFIG_MODULES
-+static inline int is_module_text(unsigned long addr)
-+{
-+ if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END)
-+ return 1;
-+
-+ addr = ktla_ktva(addr);
-+ return (unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END;
-+}
-+#else
-+static inline int is_module_text(unsigned long addr)
-+{
-+ return 0;
-+}
-+#endif
-+#endif
-+
- static inline int is_kernel_text(unsigned long addr)
- {
- if ((addr >= (unsigned long)_stext && addr <= (unsigned long)_etext) ||
-@@ -67,13 +91,28 @@ static inline int is_kernel_text(unsigne
-
- static inline int is_kernel(unsigned long addr)
- {
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ if (is_kernel_text(addr) || is_kernel_inittext(addr))
-+ return 1;
-+
-+ if (ktla_ktva((unsigned long)_text) <= addr && addr < (unsigned long)_end)
-+#else
- if (addr >= (unsigned long)_stext && addr <= (unsigned long)_end)
-+#endif
-+
- return 1;
- return in_gate_area_no_task(addr);
- }
-
- static int is_ksym_addr(unsigned long addr)
- {
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ if (is_module_text(addr))
-+ return 0;
-+#endif
-+
- if (all_var)
- return is_kernel(addr);
-
-@@ -413,7 +452,6 @@ static unsigned long get_ksymbol_core(st
-
- static void reset_iter(struct kallsym_iter *iter, loff_t new_pos)
- {
-- iter->name[0] = '\0';
- iter->nameoff = get_symbol_offset(new_pos);
- iter->pos = new_pos;
- }
-@@ -461,6 +499,11 @@ static int s_show(struct seq_file *m, vo
- {
- struct kallsym_iter *iter = m->private;
-
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ if (current_uid())
-+ return 0;
-+#endif
-+
- /* Some debugging symbols have no name. Ignore them. */
- if (!iter->name[0])
- return 0;
-@@ -501,7 +544,7 @@ static int kallsyms_open(struct inode *i
- struct kallsym_iter *iter;
- int ret;
-
-- iter = kmalloc(sizeof(*iter), GFP_KERNEL);
-+ iter = kzalloc(sizeof(*iter), GFP_KERNEL);
- if (!iter)
- return -ENOMEM;
- reset_iter(iter, 0);
-diff -urNp linux-2.6.32.45/kernel/kgdb.c linux-2.6.32.45/kernel/kgdb.c
---- linux-2.6.32.45/kernel/kgdb.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.45/kernel/kgdb.c 2011-05-04 17:56:20.000000000 -0400
-@@ -86,7 +86,7 @@ static int kgdb_io_module_registered;
- /* Guard for recursive entry */
- static int exception_level;
-
--static struct kgdb_io *kgdb_io_ops;
-+static const struct kgdb_io *kgdb_io_ops;
- static DEFINE_SPINLOCK(kgdb_registration_lock);
-
- /* kgdb console driver is loaded */
-@@ -123,7 +123,7 @@ atomic_t kgdb_active = ATOMIC_INIT(-1)
- */
- static atomic_t passive_cpu_wait[NR_CPUS];
- static atomic_t cpu_in_kgdb[NR_CPUS];
--atomic_t kgdb_setting_breakpoint;
-+atomic_unchecked_t kgdb_setting_breakpoint;
-
- struct task_struct *kgdb_usethread;
- struct task_struct *kgdb_contthread;
-@@ -140,7 +140,7 @@ static unsigned long gdb_regs[(NUMREGBY
- sizeof(unsigned long)];
-
- /* to keep track of the CPU which is doing the single stepping*/
--atomic_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
-+atomic_unchecked_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
-
- /*
- * If you are debugging a problem where roundup (the collection of
-@@ -815,7 +815,7 @@ static int kgdb_io_ready(int print_wait)
- return 0;
- if (kgdb_connected)
- return 1;
-- if (atomic_read(&kgdb_setting_breakpoint))
-+ if (atomic_read_unchecked(&kgdb_setting_breakpoint))
- return 1;
- if (print_wait)
- printk(KERN_CRIT "KGDB: Waiting for remote debugger\n");
-@@ -1426,8 +1426,8 @@ acquirelock:
- * instance of the exception handler wanted to come into the
- * debugger on a different CPU via a single step
- */
-- if (atomic_read(&kgdb_cpu_doing_single_step) != -1 &&
-- atomic_read(&kgdb_cpu_doing_single_step) != cpu) {
-+ if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1 &&
-+ atomic_read_unchecked(&kgdb_cpu_doing_single_step) != cpu) {
-
- atomic_set(&kgdb_active, -1);
- touch_softlockup_watchdog();
-@@ -1634,7 +1634,7 @@ static void kgdb_initial_breakpoint(void
- *
- * Register it with the KGDB core.
- */
--int kgdb_register_io_module(struct kgdb_io *new_kgdb_io_ops)
-+int kgdb_register_io_module(const struct kgdb_io *new_kgdb_io_ops)
- {
- int err;
-
-@@ -1679,7 +1679,7 @@ EXPORT_SYMBOL_GPL(kgdb_register_io_modul
- *
- * Unregister it with the KGDB core.
- */
--void kgdb_unregister_io_module(struct kgdb_io *old_kgdb_io_ops)
-+void kgdb_unregister_io_module(const struct kgdb_io *old_kgdb_io_ops)
- {
- BUG_ON(kgdb_connected);
-
-@@ -1712,11 +1712,11 @@ EXPORT_SYMBOL_GPL(kgdb_unregister_io_mod
- */
- void kgdb_breakpoint(void)
- {
-- atomic_set(&kgdb_setting_breakpoint, 1);
-+ atomic_set_unchecked(&kgdb_setting_breakpoint, 1);
- wmb(); /* Sync point before breakpoint */
- arch_kgdb_breakpoint();
- wmb(); /* Sync point after breakpoint */
-- atomic_set(&kgdb_setting_breakpoint, 0);
-+ atomic_set_unchecked(&kgdb_setting_breakpoint, 0);
- }
- EXPORT_SYMBOL_GPL(kgdb_breakpoint);
-
-diff -urNp linux-2.6.32.45/kernel/kmod.c linux-2.6.32.45/kernel/kmod.c
---- linux-2.6.32.45/kernel/kmod.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/kmod.c 2011-04-17 15:56:46.000000000 -0400
-@@ -65,13 +65,12 @@ char modprobe_path[KMOD_PATH_LEN] = "/sb
- * If module auto-loading support is disabled then this function
- * becomes a no-operation.
- */
--int __request_module(bool wait, const char *fmt, ...)
-+static int ____request_module(bool wait, char *module_param, const char *fmt, va_list ap)
- {
-- va_list args;
- char module_name[MODULE_NAME_LEN];
- unsigned int max_modprobes;
- int ret;
-- char *argv[] = { modprobe_path, "-q", "--", module_name, NULL };
-+ char *argv[] = { modprobe_path, "-q", "--", module_name, module_param, NULL };
- static char *envp[] = { "HOME=/",
- "TERM=linux",
- "PATH=/sbin:/usr/sbin:/bin:/usr/bin",
-@@ -84,12 +83,24 @@ int __request_module(bool wait, const ch
- if (ret)
- return ret;
-
-- va_start(args, fmt);
-- ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
-- va_end(args);
-+ ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, ap);
- if (ret >= MODULE_NAME_LEN)
- return -ENAMETOOLONG;
-
-+#ifdef CONFIG_GRKERNSEC_MODHARDEN
-+ if (!current_uid()) {
-+ /* hack to workaround consolekit/udisks stupidity */
-+ read_lock(&tasklist_lock);
-+ if (!strcmp(current->comm, "mount") &&
-+ current->real_parent && !strncmp(current->real_parent->comm, "udisk", 5)) {
-+ read_unlock(&tasklist_lock);
-+ printk(KERN_ALERT "grsec: denied attempt to auto-load fs module %.64s by udisks\n", module_name);
-+ return -EPERM;
-+ }
-+ read_unlock(&tasklist_lock);
-+ }
-+#endif
-+
- /* If modprobe needs a service that is in a module, we get a recursive
- * loop. Limit the number of running kmod threads to max_threads/2 or
- * MAX_KMOD_CONCURRENT, whichever is the smaller. A cleaner method
-@@ -121,6 +132,48 @@ int __request_module(bool wait, const ch
- atomic_dec(&kmod_concurrent);
- return ret;
- }
-+
-+int ___request_module(bool wait, char *module_param, const char *fmt, ...)
-+{
-+ va_list args;
-+ int ret;
-+
-+ va_start(args, fmt);
-+ ret = ____request_module(wait, module_param, fmt, args);
-+ va_end(args);
-+
-+ return ret;
-+}
-+
-+int __request_module(bool wait, const char *fmt, ...)
-+{
-+ va_list args;
-+ int ret;
-+
-+#ifdef CONFIG_GRKERNSEC_MODHARDEN
-+ if (current_uid()) {
-+ char module_param[MODULE_NAME_LEN];
-+
-+ memset(module_param, 0, sizeof(module_param));
-+
-+ snprintf(module_param, sizeof(module_param) - 1, "grsec_modharden_normal%u_", current_uid());
-+
-+ va_start(args, fmt);
-+ ret = ____request_module(wait, module_param, fmt, args);
-+ va_end(args);
-+
-+ return ret;
-+ }
-+#endif
-+
-+ va_start(args, fmt);
-+ ret = ____request_module(wait, NULL, fmt, args);
-+ va_end(args);
-+
-+ return ret;
-+}
-+
-+
- EXPORT_SYMBOL(__request_module);
- #endif /* CONFIG_MODULES */
-
-diff -urNp linux-2.6.32.45/kernel/kprobes.c linux-2.6.32.45/kernel/kprobes.c
---- linux-2.6.32.45/kernel/kprobes.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/kprobes.c 2011-04-17 15:56:46.000000000 -0400
-@@ -183,7 +183,7 @@ static kprobe_opcode_t __kprobes *__get_
- * kernel image and loaded module images reside. This is required
- * so x86_64 can correctly handle the %rip-relative fixups.
- */
-- kip->insns = module_alloc(PAGE_SIZE);
-+ kip->insns = module_alloc_exec(PAGE_SIZE);
- if (!kip->insns) {
- kfree(kip);
- return NULL;
-@@ -220,7 +220,7 @@ static int __kprobes collect_one_slot(st
- */
- if (!list_is_singular(&kprobe_insn_pages)) {
- list_del(&kip->list);
-- module_free(NULL, kip->insns);
-+ module_free_exec(NULL, kip->insns);
- kfree(kip);
- }
- return 1;
-@@ -1189,7 +1189,7 @@ static int __init init_kprobes(void)
- {
- int i, err = 0;
- unsigned long offset = 0, size = 0;
-- char *modname, namebuf[128];
-+ char *modname, namebuf[KSYM_NAME_LEN];
- const char *symbol_name;
- void *addr;
- struct kprobe_blackpoint *kb;
-@@ -1304,7 +1304,7 @@ static int __kprobes show_kprobe_addr(st
- const char *sym = NULL;
- unsigned int i = *(loff_t *) v;
- unsigned long offset = 0;
-- char *modname, namebuf[128];
-+ char *modname, namebuf[KSYM_NAME_LEN];
-
- head = &kprobe_table[i];
- preempt_disable();
-diff -urNp linux-2.6.32.45/kernel/lockdep.c linux-2.6.32.45/kernel/lockdep.c
---- linux-2.6.32.45/kernel/lockdep.c 2011-06-25 12:55:35.000000000 -0400
-+++ linux-2.6.32.45/kernel/lockdep.c 2011-06-25 12:56:37.000000000 -0400
-@@ -421,20 +421,20 @@ static struct stack_trace lockdep_init_t
- /*
- * Various lockdep statistics:
- */
--atomic_t chain_lookup_hits;
--atomic_t chain_lookup_misses;
--atomic_t hardirqs_on_events;
--atomic_t hardirqs_off_events;
--atomic_t redundant_hardirqs_on;
--atomic_t redundant_hardirqs_off;
--atomic_t softirqs_on_events;
--atomic_t softirqs_off_events;
--atomic_t redundant_softirqs_on;
--atomic_t redundant_softirqs_off;
--atomic_t nr_unused_locks;
--atomic_t nr_cyclic_checks;
--atomic_t nr_find_usage_forwards_checks;
--atomic_t nr_find_usage_backwards_checks;
-+atomic_unchecked_t chain_lookup_hits;
-+atomic_unchecked_t chain_lookup_misses;
-+atomic_unchecked_t hardirqs_on_events;
-+atomic_unchecked_t hardirqs_off_events;
-+atomic_unchecked_t redundant_hardirqs_on;
-+atomic_unchecked_t redundant_hardirqs_off;
-+atomic_unchecked_t softirqs_on_events;
-+atomic_unchecked_t softirqs_off_events;
-+atomic_unchecked_t redundant_softirqs_on;
-+atomic_unchecked_t redundant_softirqs_off;
-+atomic_unchecked_t nr_unused_locks;
-+atomic_unchecked_t nr_cyclic_checks;
-+atomic_unchecked_t nr_find_usage_forwards_checks;
-+atomic_unchecked_t nr_find_usage_backwards_checks;
- #endif
-
- /*
-@@ -577,6 +577,10 @@ static int static_obj(void *obj)
- int i;
- #endif
-
-+#ifdef CONFIG_PAX_KERNEXEC
-+ start = ktla_ktva(start);
-+#endif
-+
- /*
- * static variable?
- */
-@@ -592,8 +596,7 @@ static int static_obj(void *obj)
- */
- for_each_possible_cpu(i) {
- start = (unsigned long) &__per_cpu_start + per_cpu_offset(i);
-- end = (unsigned long) &__per_cpu_start + PERCPU_ENOUGH_ROOM
-- + per_cpu_offset(i);
-+ end = start + PERCPU_ENOUGH_ROOM;
-
- if ((addr >= start) && (addr < end))
- return 1;
-@@ -710,6 +713,7 @@ register_lock_class(struct lockdep_map *
- if (!static_obj(lock->key)) {
- debug_locks_off();
- printk("INFO: trying to register non-static key.\n");
-+ printk("lock:%pS key:%pS.\n", lock, lock->key);
- printk("the code is fine but needs lockdep annotation.\n");
- printk("turning off the locking correctness validator.\n");
- dump_stack();
-@@ -2751,7 +2755,7 @@ static int __lock_acquire(struct lockdep
- if (!class)
- return 0;
- }
-- debug_atomic_inc((atomic_t *)&class->ops);
-+ debug_atomic_inc((atomic_unchecked_t *)&class->ops);
- if (very_verbose(class)) {
- printk("\nacquire class [%p] %s", class->key, class->name);
- if (class->name_version > 1)
-diff -urNp linux-2.6.32.45/kernel/lockdep_internals.h linux-2.6.32.45/kernel/lockdep_internals.h
---- linux-2.6.32.45/kernel/lockdep_internals.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/lockdep_internals.h 2011-04-17 15:56:46.000000000 -0400
-@@ -113,26 +113,26 @@ lockdep_count_backward_deps(struct lock_
- /*
- * Various lockdep statistics:
- */
--extern atomic_t chain_lookup_hits;
--extern atomic_t chain_lookup_misses;
--extern atomic_t hardirqs_on_events;
--extern atomic_t hardirqs_off_events;
--extern atomic_t redundant_hardirqs_on;
--extern atomic_t redundant_hardirqs_off;
--extern atomic_t softirqs_on_events;
--extern atomic_t softirqs_off_events;
--extern atomic_t redundant_softirqs_on;
--extern atomic_t redundant_softirqs_off;
--extern atomic_t nr_unused_locks;
--extern atomic_t nr_cyclic_checks;
--extern atomic_t nr_cyclic_check_recursions;
--extern atomic_t nr_find_usage_forwards_checks;
--extern atomic_t nr_find_usage_forwards_recursions;
--extern atomic_t nr_find_usage_backwards_checks;
--extern atomic_t nr_find_usage_backwards_recursions;
--# define debug_atomic_inc(ptr) atomic_inc(ptr)
--# define debug_atomic_dec(ptr) atomic_dec(ptr)
--# define debug_atomic_read(ptr) atomic_read(ptr)
-+extern atomic_unchecked_t chain_lookup_hits;
-+extern atomic_unchecked_t chain_lookup_misses;
-+extern atomic_unchecked_t hardirqs_on_events;
-+extern atomic_unchecked_t hardirqs_off_events;
-+extern atomic_unchecked_t redundant_hardirqs_on;
-+extern atomic_unchecked_t redundant_hardirqs_off;
-+extern atomic_unchecked_t softirqs_on_events;
-+extern atomic_unchecked_t softirqs_off_events;
-+extern atomic_unchecked_t redundant_softirqs_on;
-+extern atomic_unchecked_t redundant_softirqs_off;
-+extern atomic_unchecked_t nr_unused_locks;
-+extern atomic_unchecked_t nr_cyclic_checks;
-+extern atomic_unchecked_t nr_cyclic_check_recursions;
-+extern atomic_unchecked_t nr_find_usage_forwards_checks;
-+extern atomic_unchecked_t nr_find_usage_forwards_recursions;
-+extern atomic_unchecked_t nr_find_usage_backwards_checks;
-+extern atomic_unchecked_t nr_find_usage_backwards_recursions;
-+# define debug_atomic_inc(ptr) atomic_inc_unchecked(ptr)
-+# define debug_atomic_dec(ptr) atomic_dec_unchecked(ptr)
-+# define debug_atomic_read(ptr) atomic_read_unchecked(ptr)
- #else
- # define debug_atomic_inc(ptr) do { } while (0)
- # define debug_atomic_dec(ptr) do { } while (0)
-diff -urNp linux-2.6.32.45/kernel/lockdep_proc.c linux-2.6.32.45/kernel/lockdep_proc.c
---- linux-2.6.32.45/kernel/lockdep_proc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/lockdep_proc.c 2011-04-17 15:56:46.000000000 -0400
-@@ -39,7 +39,7 @@ static void l_stop(struct seq_file *m, v
-
- static void print_name(struct seq_file *m, struct lock_class *class)
- {
-- char str[128];
-+ char str[KSYM_NAME_LEN];
- const char *name = class->name;
-
- if (!name) {
-diff -urNp linux-2.6.32.45/kernel/module.c linux-2.6.32.45/kernel/module.c
---- linux-2.6.32.45/kernel/module.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/module.c 2011-04-29 18:52:40.000000000 -0400
-@@ -55,6 +55,7 @@
- #include <linux/async.h>
- #include <linux/percpu.h>
- #include <linux/kmemleak.h>
-+#include <linux/grsecurity.h>
-
- #define CREATE_TRACE_POINTS
- #include <trace/events/module.h>
-@@ -89,7 +90,8 @@ static DECLARE_WAIT_QUEUE_HEAD(module_wq
- static BLOCKING_NOTIFIER_HEAD(module_notify_list);
-
- /* Bounds of module allocation, for speeding __module_address */
--static unsigned long module_addr_min = -1UL, module_addr_max = 0;
-+static unsigned long module_addr_min_rw = -1UL, module_addr_max_rw = 0;
-+static unsigned long module_addr_min_rx = -1UL, module_addr_max_rx = 0;
-
- int register_module_notifier(struct notifier_block * nb)
- {
-@@ -245,7 +247,7 @@ bool each_symbol(bool (*fn)(const struct
- return true;
-
- list_for_each_entry_rcu(mod, &modules, list) {
-- struct symsearch arr[] = {
-+ struct symsearch modarr[] = {
- { mod->syms, mod->syms + mod->num_syms, mod->crcs,
- NOT_GPL_ONLY, false },
- { mod->gpl_syms, mod->gpl_syms + mod->num_gpl_syms,
-@@ -267,7 +269,7 @@ bool each_symbol(bool (*fn)(const struct
- #endif
- };
-
-- if (each_symbol_in_section(arr, ARRAY_SIZE(arr), mod, fn, data))
-+ if (each_symbol_in_section(modarr, ARRAY_SIZE(modarr), mod, fn, data))
- return true;
- }
- return false;
-@@ -442,7 +444,7 @@ static void *percpu_modalloc(unsigned lo
- void *ptr;
- int cpu;
-
-- if (align > PAGE_SIZE) {
-+ if (align-1 >= PAGE_SIZE) {
- printk(KERN_WARNING "%s: per-cpu alignment %li > %li\n",
- name, align, PAGE_SIZE);
- align = PAGE_SIZE;
-@@ -1158,7 +1160,7 @@ static const struct kernel_symbol *resol
- * /sys/module/foo/sections stuff
- * J. Corbet <corbet@lwn.net>
- */
--#if defined(CONFIG_KALLSYMS) && defined(CONFIG_SYSFS)
-+#if defined(CONFIG_KALLSYMS) && defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
-
- static inline bool sect_empty(const Elf_Shdr *sect)
- {
-@@ -1545,7 +1547,8 @@ static void free_module(struct module *m
- destroy_params(mod->kp, mod->num_kp);
-
- /* This may be NULL, but that's OK */
-- module_free(mod, mod->module_init);
-+ module_free(mod, mod->module_init_rw);
-+ module_free_exec(mod, mod->module_init_rx);
- kfree(mod->args);
- if (mod->percpu)
- percpu_modfree(mod->percpu);
-@@ -1554,10 +1557,12 @@ static void free_module(struct module *m
- percpu_modfree(mod->refptr);
- #endif
- /* Free lock-classes: */
-- lockdep_free_key_range(mod->module_core, mod->core_size);
-+ lockdep_free_key_range(mod->module_core_rx, mod->core_size_rx);
-+ lockdep_free_key_range(mod->module_core_rw, mod->core_size_rw);
-
- /* Finally, free the core (containing the module structure) */
-- module_free(mod, mod->module_core);
-+ module_free_exec(mod, mod->module_core_rx);
-+ module_free(mod, mod->module_core_rw);
-
- #ifdef CONFIG_MPU
- update_protections(current->mm);
-@@ -1628,8 +1633,32 @@ static int simplify_symbols(Elf_Shdr *se
- unsigned int i, n = sechdrs[symindex].sh_size / sizeof(Elf_Sym);
- int ret = 0;
- const struct kernel_symbol *ksym;
-+#ifdef CONFIG_GRKERNSEC_MODHARDEN
-+ int is_fs_load = 0;
-+ int register_filesystem_found = 0;
-+ char *p;
-+
-+ p = strstr(mod->args, "grsec_modharden_fs");
-+
-+ if (p) {
-+ char *endptr = p + strlen("grsec_modharden_fs");
-+ /* copy \0 as well */
-+ memmove(p, endptr, strlen(mod->args) - (unsigned int)(endptr - mod->args) + 1);
-+ is_fs_load = 1;
-+ }
-+#endif
-+
-
- for (i = 1; i < n; i++) {
-+#ifdef CONFIG_GRKERNSEC_MODHARDEN
-+ const char *name = strtab + sym[i].st_name;
-+
-+ /* it's a real shame this will never get ripped and copied
-+ upstream! ;(
-+ */
-+ if (is_fs_load && !strcmp(name, "register_filesystem"))
-+ register_filesystem_found = 1;
-+#endif
- switch (sym[i].st_shndx) {
- case SHN_COMMON:
- /* We compiled with -fno-common. These are not
-@@ -1651,7 +1680,9 @@ static int simplify_symbols(Elf_Shdr *se
- strtab + sym[i].st_name, mod);
- /* Ok if resolved. */
- if (ksym) {
-+ pax_open_kernel();
- sym[i].st_value = ksym->value;
-+ pax_close_kernel();
- break;
- }
-
-@@ -1670,11 +1701,20 @@ static int simplify_symbols(Elf_Shdr *se
- secbase = (unsigned long)mod->percpu;
- else
- secbase = sechdrs[sym[i].st_shndx].sh_addr;
-+ pax_open_kernel();
- sym[i].st_value += secbase;
-+ pax_close_kernel();
- break;
- }
- }
-
-+#ifdef CONFIG_GRKERNSEC_MODHARDEN
-+ if (is_fs_load && !register_filesystem_found) {
-+ printk(KERN_ALERT "grsec: Denied attempt to load non-fs module %.64s through mount\n", mod->name);
-+ ret = -EPERM;
-+ }
-+#endif
-+
- return ret;
- }
-
-@@ -1731,11 +1771,12 @@ static void layout_sections(struct modul
- || s->sh_entsize != ~0UL
- || strstarts(secstrings + s->sh_name, ".init"))
- continue;
-- s->sh_entsize = get_offset(mod, &mod->core_size, s, i);
-+ if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
-+ s->sh_entsize = get_offset(mod, &mod->core_size_rw, s, i);
-+ else
-+ s->sh_entsize = get_offset(mod, &mod->core_size_rx, s, i);
- DEBUGP("\t%s\n", secstrings + s->sh_name);
- }
-- if (m == 0)
-- mod->core_text_size = mod->core_size;
- }
-
- DEBUGP("Init section allocation order:\n");
-@@ -1748,12 +1789,13 @@ static void layout_sections(struct modul
- || s->sh_entsize != ~0UL
- || !strstarts(secstrings + s->sh_name, ".init"))
- continue;
-- s->sh_entsize = (get_offset(mod, &mod->init_size, s, i)
-- | INIT_OFFSET_MASK);
-+ if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
-+ s->sh_entsize = get_offset(mod, &mod->init_size_rw, s, i);
-+ else
-+ s->sh_entsize = get_offset(mod, &mod->init_size_rx, s, i);
-+ s->sh_entsize |= INIT_OFFSET_MASK;
- DEBUGP("\t%s\n", secstrings + s->sh_name);
- }
-- if (m == 0)
-- mod->init_text_size = mod->init_size;
- }
- }
-
-@@ -1857,9 +1899,8 @@ static int is_exported(const char *name,
-
- /* As per nm */
- static char elf_type(const Elf_Sym *sym,
-- Elf_Shdr *sechdrs,
-- const char *secstrings,
-- struct module *mod)
-+ const Elf_Shdr *sechdrs,
-+ const char *secstrings)
- {
- if (ELF_ST_BIND(sym->st_info) == STB_WEAK) {
- if (ELF_ST_TYPE(sym->st_info) == STT_OBJECT)
-@@ -1934,7 +1975,7 @@ static unsigned long layout_symtab(struc
-
- /* Put symbol section at end of init part of module. */
- symsect->sh_flags |= SHF_ALLOC;
-- symsect->sh_entsize = get_offset(mod, &mod->init_size, symsect,
-+ symsect->sh_entsize = get_offset(mod, &mod->init_size_rx, symsect,
- symindex) | INIT_OFFSET_MASK;
- DEBUGP("\t%s\n", secstrings + symsect->sh_name);
-
-@@ -1951,19 +1992,19 @@ static unsigned long layout_symtab(struc
- }
-
- /* Append room for core symbols at end of core part. */
-- symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1);
-- mod->core_size = symoffs + ndst * sizeof(Elf_Sym);
-+ symoffs = ALIGN(mod->core_size_rx, symsect->sh_addralign ?: 1);
-+ mod->core_size_rx = symoffs + ndst * sizeof(Elf_Sym);
-
- /* Put string table section at end of init part of module. */
- strsect->sh_flags |= SHF_ALLOC;
-- strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect,
-+ strsect->sh_entsize = get_offset(mod, &mod->init_size_rx, strsect,
- strindex) | INIT_OFFSET_MASK;
- DEBUGP("\t%s\n", secstrings + strsect->sh_name);
-
- /* Append room for core symbols' strings at end of core part. */
-- *pstroffs = mod->core_size;
-+ *pstroffs = mod->core_size_rx;
- __set_bit(0, strmap);
-- mod->core_size += bitmap_weight(strmap, strsect->sh_size);
-+ mod->core_size_rx += bitmap_weight(strmap, strsect->sh_size);
-
- return symoffs;
- }
-@@ -1987,12 +2028,14 @@ static void add_kallsyms(struct module *
- mod->num_symtab = sechdrs[symindex].sh_size / sizeof(Elf_Sym);
- mod->strtab = (void *)sechdrs[strindex].sh_addr;
-
-+ pax_open_kernel();
-+
- /* Set types up while we still have access to sections. */
- for (i = 0; i < mod->num_symtab; i++)
- mod->symtab[i].st_info
-- = elf_type(&mod->symtab[i], sechdrs, secstrings, mod);
-+ = elf_type(&mod->symtab[i], sechdrs, secstrings);
-
-- mod->core_symtab = dst = mod->module_core + symoffs;
-+ mod->core_symtab = dst = mod->module_core_rx + symoffs;
- src = mod->symtab;
- *dst = *src;
- for (ndst = i = 1; i < mod->num_symtab; ++i, ++src) {
-@@ -2004,10 +2047,12 @@ static void add_kallsyms(struct module *
- }
- mod->core_num_syms = ndst;
-
-- mod->core_strtab = s = mod->module_core + stroffs;
-+ mod->core_strtab = s = mod->module_core_rx + stroffs;
- for (*s = 0, i = 1; i < sechdrs[strindex].sh_size; ++i)
- if (test_bit(i, strmap))
- *++s = mod->strtab[i];
-+
-+ pax_close_kernel();
- }
- #else
- static inline unsigned long layout_symtab(struct module *mod,
-@@ -2044,16 +2089,30 @@ static void dynamic_debug_setup(struct _
- #endif
- }
-
--static void *module_alloc_update_bounds(unsigned long size)
-+static void *module_alloc_update_bounds_rw(unsigned long size)
- {
- void *ret = module_alloc(size);
-
- if (ret) {
- /* Update module bounds. */
-- if ((unsigned long)ret < module_addr_min)
-- module_addr_min = (unsigned long)ret;
-- if ((unsigned long)ret + size > module_addr_max)
-- module_addr_max = (unsigned long)ret + size;
-+ if ((unsigned long)ret < module_addr_min_rw)
-+ module_addr_min_rw = (unsigned long)ret;
-+ if ((unsigned long)ret + size > module_addr_max_rw)
-+ module_addr_max_rw = (unsigned long)ret + size;
-+ }
-+ return ret;
-+}
-+
-+static void *module_alloc_update_bounds_rx(unsigned long size)
-+{
-+ void *ret = module_alloc_exec(size);
-+
-+ if (ret) {
-+ /* Update module bounds. */
-+ if ((unsigned long)ret < module_addr_min_rx)
-+ module_addr_min_rx = (unsigned long)ret;
-+ if ((unsigned long)ret + size > module_addr_max_rx)
-+ module_addr_max_rx = (unsigned long)ret + size;
- }
- return ret;
- }
-@@ -2065,8 +2124,8 @@ static void kmemleak_load_module(struct
- unsigned int i;
-
- /* only scan the sections containing data */
-- kmemleak_scan_area(mod->module_core, (unsigned long)mod -
-- (unsigned long)mod->module_core,
-+ kmemleak_scan_area(mod->module_core_rw, (unsigned long)mod -
-+ (unsigned long)mod->module_core_rw,
- sizeof(struct module), GFP_KERNEL);
-
- for (i = 1; i < hdr->e_shnum; i++) {
-@@ -2076,8 +2135,8 @@ static void kmemleak_load_module(struct
- && strncmp(secstrings + sechdrs[i].sh_name, ".bss", 4) != 0)
- continue;
-
-- kmemleak_scan_area(mod->module_core, sechdrs[i].sh_addr -
-- (unsigned long)mod->module_core,
-+ kmemleak_scan_area(mod->module_core_rw, sechdrs[i].sh_addr -
-+ (unsigned long)mod->module_core_rw,
- sechdrs[i].sh_size, GFP_KERNEL);
- }
- }
-@@ -2263,7 +2322,7 @@ static noinline struct module *load_modu
- secstrings, &stroffs, strmap);
-
- /* Do the allocs. */
-- ptr = module_alloc_update_bounds(mod->core_size);
-+ ptr = module_alloc_update_bounds_rw(mod->core_size_rw);
- /*
- * The pointer to this block is stored in the module structure
- * which is inside the block. Just mark it as not being a
-@@ -2274,23 +2333,47 @@ static noinline struct module *load_modu
- err = -ENOMEM;
- goto free_percpu;
- }
-- memset(ptr, 0, mod->core_size);
-- mod->module_core = ptr;
-+ memset(ptr, 0, mod->core_size_rw);
-+ mod->module_core_rw = ptr;
-
-- ptr = module_alloc_update_bounds(mod->init_size);
-+ ptr = module_alloc_update_bounds_rw(mod->init_size_rw);
- /*
- * The pointer to this block is stored in the module structure
- * which is inside the block. This block doesn't need to be
- * scanned as it contains data and code that will be freed
- * after the module is initialized.
- */
-- kmemleak_ignore(ptr);
-- if (!ptr && mod->init_size) {
-+ kmemleak_not_leak(ptr);
-+ if (!ptr && mod->init_size_rw) {
-+ err = -ENOMEM;
-+ goto free_core_rw;
-+ }
-+ memset(ptr, 0, mod->init_size_rw);
-+ mod->module_init_rw = ptr;
-+
-+ ptr = module_alloc_update_bounds_rx(mod->core_size_rx);
-+ kmemleak_not_leak(ptr);
-+ if (!ptr) {
- err = -ENOMEM;
-- goto free_core;
-+ goto free_init_rw;
- }
-- memset(ptr, 0, mod->init_size);
-- mod->module_init = ptr;
-+
-+ pax_open_kernel();
-+ memset(ptr, 0, mod->core_size_rx);
-+ pax_close_kernel();
-+ mod->module_core_rx = ptr;
-+
-+ ptr = module_alloc_update_bounds_rx(mod->init_size_rx);
-+ kmemleak_not_leak(ptr);
-+ if (!ptr && mod->init_size_rx) {
-+ err = -ENOMEM;
-+ goto free_core_rx;
-+ }
-+
-+ pax_open_kernel();
-+ memset(ptr, 0, mod->init_size_rx);
-+ pax_close_kernel();
-+ mod->module_init_rx = ptr;
-
- /* Transfer each section which specifies SHF_ALLOC */
- DEBUGP("final section addresses:\n");
-@@ -2300,17 +2383,45 @@ static noinline struct module *load_modu
- if (!(sechdrs[i].sh_flags & SHF_ALLOC))
- continue;
-
-- if (sechdrs[i].sh_entsize & INIT_OFFSET_MASK)
-- dest = mod->module_init
-- + (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
-- else
-- dest = mod->module_core + sechdrs[i].sh_entsize;
-+ if (sechdrs[i].sh_entsize & INIT_OFFSET_MASK) {
-+ if ((sechdrs[i].sh_flags & SHF_WRITE) || !(sechdrs[i].sh_flags & SHF_ALLOC))
-+ dest = mod->module_init_rw
-+ + (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
-+ else
-+ dest = mod->module_init_rx
-+ + (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
-+ } else {
-+ if ((sechdrs[i].sh_flags & SHF_WRITE) || !(sechdrs[i].sh_flags & SHF_ALLOC))
-+ dest = mod->module_core_rw + sechdrs[i].sh_entsize;
-+ else
-+ dest = mod->module_core_rx + sechdrs[i].sh_entsize;
-+ }
-+
-+ if (sechdrs[i].sh_type != SHT_NOBITS) {
-
-- if (sechdrs[i].sh_type != SHT_NOBITS)
-- memcpy(dest, (void *)sechdrs[i].sh_addr,
-- sechdrs[i].sh_size);
-+#ifdef CONFIG_PAX_KERNEXEC
-+#ifdef CONFIG_X86_64
-+ if ((sechdrs[i].sh_flags & SHF_WRITE) && (sechdrs[i].sh_flags & SHF_EXECINSTR))
-+ set_memory_x((unsigned long)dest, (sechdrs[i].sh_size + PAGE_SIZE) >> PAGE_SHIFT);
-+#endif
-+ if (!(sechdrs[i].sh_flags & SHF_WRITE) && (sechdrs[i].sh_flags & SHF_ALLOC)) {
-+ pax_open_kernel();
-+ memcpy(dest, (void *)sechdrs[i].sh_addr, sechdrs[i].sh_size);
-+ pax_close_kernel();
-+ } else
-+#endif
-+
-+ memcpy(dest, (void *)sechdrs[i].sh_addr, sechdrs[i].sh_size);
-+ }
- /* Update sh_addr to point to copy in image. */
-- sechdrs[i].sh_addr = (unsigned long)dest;
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+ if (sechdrs[i].sh_flags & SHF_EXECINSTR)
-+ sechdrs[i].sh_addr = ktva_ktla((unsigned long)dest);
-+ else
-+#endif
-+
-+ sechdrs[i].sh_addr = (unsigned long)dest;
- DEBUGP("\t0x%lx %s\n", sechdrs[i].sh_addr, secstrings + sechdrs[i].sh_name);
- }
- /* Module has been moved. */
-@@ -2322,7 +2433,7 @@ static noinline struct module *load_modu
- mod->name);
- if (!mod->refptr) {
- err = -ENOMEM;
-- goto free_init;
-+ goto free_init_rx;
- }
- #endif
- /* Now we've moved module, initialize linked lists, etc. */
-@@ -2351,6 +2462,31 @@ static noinline struct module *load_modu
- /* Set up MODINFO_ATTR fields */
- setup_modinfo(mod, sechdrs, infoindex);
-
-+ mod->args = args;
-+
-+#ifdef CONFIG_GRKERNSEC_MODHARDEN
-+ {
-+ char *p, *p2;
-+
-+ if (strstr(mod->args, "grsec_modharden_netdev")) {
-+ printk(KERN_ALERT "grsec: denied auto-loading kernel module for a network device with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%.64s instead.", mod->name);
-+ err = -EPERM;
-+ goto cleanup;
-+ } else if ((p = strstr(mod->args, "grsec_modharden_normal"))) {
-+ p += strlen("grsec_modharden_normal");
-+ p2 = strstr(p, "_");
-+ if (p2) {
-+ *p2 = '\0';
-+ printk(KERN_ALERT "grsec: denied kernel module auto-load of %.64s by uid %.9s\n", mod->name, p);
-+ *p2 = '_';
-+ }
-+ err = -EPERM;
-+ goto cleanup;
-+ }
-+ }
-+#endif
-+
-+
- /* Fix up syms, so that st_value is a pointer to location. */
- err = simplify_symbols(sechdrs, symindex, strtab, versindex, pcpuindex,
- mod);
-@@ -2431,8 +2567,8 @@ static noinline struct module *load_modu
-
- /* Now do relocations. */
- for (i = 1; i < hdr->e_shnum; i++) {
-- const char *strtab = (char *)sechdrs[strindex].sh_addr;
- unsigned int info = sechdrs[i].sh_info;
-+ strtab = (char *)sechdrs[strindex].sh_addr;
-
- /* Not a valid relocation section? */
- if (info >= hdr->e_shnum)
-@@ -2493,16 +2629,15 @@ static noinline struct module *load_modu
- * Do it before processing of module parameters, so the module
- * can provide parameter accessor functions of its own.
- */
-- if (mod->module_init)
-- flush_icache_range((unsigned long)mod->module_init,
-- (unsigned long)mod->module_init
-- + mod->init_size);
-- flush_icache_range((unsigned long)mod->module_core,
-- (unsigned long)mod->module_core + mod->core_size);
-+ if (mod->module_init_rx)
-+ flush_icache_range((unsigned long)mod->module_init_rx,
-+ (unsigned long)mod->module_init_rx
-+ + mod->init_size_rx);
-+ flush_icache_range((unsigned long)mod->module_core_rx,
-+ (unsigned long)mod->module_core_rx + mod->core_size_rx);
-
- set_fs(old_fs);
-
-- mod->args = args;
- if (section_addr(hdr, sechdrs, secstrings, "__obsparm"))
- printk(KERN_WARNING "%s: Ignoring obsolete parameters\n",
- mod->name);
-@@ -2546,12 +2681,16 @@ static noinline struct module *load_modu
- free_unload:
- module_unload_free(mod);
- #if defined(CONFIG_MODULE_UNLOAD) && defined(CONFIG_SMP)
-+ free_init_rx:
- percpu_modfree(mod->refptr);
-- free_init:
- #endif
-- module_free(mod, mod->module_init);
-- free_core:
-- module_free(mod, mod->module_core);
-+ module_free_exec(mod, mod->module_init_rx);
-+ free_core_rx:
-+ module_free_exec(mod, mod->module_core_rx);
-+ free_init_rw:
-+ module_free(mod, mod->module_init_rw);
-+ free_core_rw:
-+ module_free(mod, mod->module_core_rw);
- /* mod will be freed with core. Don't access it beyond this line! */
- free_percpu:
- if (percpu)
-@@ -2653,10 +2792,12 @@ SYSCALL_DEFINE3(init_module, void __user
- mod->symtab = mod->core_symtab;
- mod->strtab = mod->core_strtab;
- #endif
-- module_free(mod, mod->module_init);
-- mod->module_init = NULL;
-- mod->init_size = 0;
-- mod->init_text_size = 0;
-+ module_free(mod, mod->module_init_rw);
-+ module_free_exec(mod, mod->module_init_rx);
-+ mod->module_init_rw = NULL;
-+ mod->module_init_rx = NULL;
-+ mod->init_size_rw = 0;
-+ mod->init_size_rx = 0;
- mutex_unlock(&module_mutex);
-
- return 0;
-@@ -2687,10 +2828,16 @@ static const char *get_ksymbol(struct mo
- unsigned long nextval;
-
- /* At worse, next value is at end of module */
-- if (within_module_init(addr, mod))
-- nextval = (unsigned long)mod->module_init+mod->init_text_size;
-+ if (within_module_init_rx(addr, mod))
-+ nextval = (unsigned long)mod->module_init_rx+mod->init_size_rx;
-+ else if (within_module_init_rw(addr, mod))
-+ nextval = (unsigned long)mod->module_init_rw+mod->init_size_rw;
-+ else if (within_module_core_rx(addr, mod))
-+ nextval = (unsigned long)mod->module_core_rx+mod->core_size_rx;
-+ else if (within_module_core_rw(addr, mod))
-+ nextval = (unsigned long)mod->module_core_rw+mod->core_size_rw;
- else
-- nextval = (unsigned long)mod->module_core+mod->core_text_size;
-+ return NULL;
-
- /* Scan for closest preceeding symbol, and next symbol. (ELF
- starts real symbols at 1). */
-@@ -2936,7 +3083,7 @@ static int m_show(struct seq_file *m, vo
- char buf[8];
-
- seq_printf(m, "%s %u",
-- mod->name, mod->init_size + mod->core_size);
-+ mod->name, mod->init_size_rx + mod->init_size_rw + mod->core_size_rx + mod->core_size_rw);
- print_unload_info(m, mod);
-
- /* Informative for users. */
-@@ -2945,7 +3092,7 @@ static int m_show(struct seq_file *m, vo
- mod->state == MODULE_STATE_COMING ? "Loading":
- "Live");
- /* Used by oprofile and other similar tools. */
-- seq_printf(m, " 0x%p", mod->module_core);
-+ seq_printf(m, " 0x%p 0x%p", mod->module_core_rx, mod->module_core_rw);
-
- /* Taints info */
- if (mod->taints)
-@@ -2981,7 +3128,17 @@ static const struct file_operations proc
-
- static int __init proc_modules_init(void)
- {
-+#ifndef CONFIG_GRKERNSEC_HIDESYM
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+ proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ proc_create("modules", S_IRUSR | S_IRGRP, NULL, &proc_modules_operations);
-+#else
- proc_create("modules", 0, NULL, &proc_modules_operations);
-+#endif
-+#else
-+ proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
-+#endif
- return 0;
- }
- module_init(proc_modules_init);
-@@ -3040,12 +3197,12 @@ struct module *__module_address(unsigned
- {
- struct module *mod;
-
-- if (addr < module_addr_min || addr > module_addr_max)
-+ if ((addr < module_addr_min_rx || addr > module_addr_max_rx) &&
-+ (addr < module_addr_min_rw || addr > module_addr_max_rw))
- return NULL;
-
- list_for_each_entry_rcu(mod, &modules, list)
-- if (within_module_core(addr, mod)
-- || within_module_init(addr, mod))
-+ if (within_module_init(addr, mod) || within_module_core(addr, mod))
- return mod;
- return NULL;
- }
-@@ -3079,11 +3236,20 @@ bool is_module_text_address(unsigned lon
- */
- struct module *__module_text_address(unsigned long addr)
- {
-- struct module *mod = __module_address(addr);
-+ struct module *mod;
-+
-+#ifdef CONFIG_X86_32
-+ addr = ktla_ktva(addr);
-+#endif
-+
-+ if (addr < module_addr_min_rx || addr > module_addr_max_rx)
-+ return NULL;
-+
-+ mod = __module_address(addr);
-+
- if (mod) {
- /* Make sure it's within the text section. */
-- if (!within(addr, mod->module_init, mod->init_text_size)
-- && !within(addr, mod->module_core, mod->core_text_size))
-+ if (!within_module_init_rx(addr, mod) && !within_module_core_rx(addr, mod))
- mod = NULL;
- }
- return mod;
-diff -urNp linux-2.6.32.45/kernel/mutex.c linux-2.6.32.45/kernel/mutex.c
---- linux-2.6.32.45/kernel/mutex.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/mutex.c 2011-04-17 15:56:46.000000000 -0400
-@@ -169,7 +169,7 @@ __mutex_lock_common(struct mutex *lock,
- */
-
- for (;;) {
-- struct thread_info *owner;
-+ struct task_struct *owner;
-
- /*
- * If we own the BKL, then don't spin. The owner of
-@@ -214,7 +214,7 @@ __mutex_lock_common(struct mutex *lock,
- spin_lock_mutex(&lock->wait_lock, flags);
-
- debug_mutex_lock_common(lock, &waiter);
-- debug_mutex_add_waiter(lock, &waiter, task_thread_info(task));
-+ debug_mutex_add_waiter(lock, &waiter, task);
-
- /* add waiting tasks to the end of the waitqueue (FIFO): */
- list_add_tail(&waiter.list, &lock->wait_list);
-@@ -243,8 +243,7 @@ __mutex_lock_common(struct mutex *lock,
- * TASK_UNINTERRUPTIBLE case.)
- */
- if (unlikely(signal_pending_state(state, task))) {
-- mutex_remove_waiter(lock, &waiter,
-- task_thread_info(task));
-+ mutex_remove_waiter(lock, &waiter, task);
- mutex_release(&lock->dep_map, 1, ip);
- spin_unlock_mutex(&lock->wait_lock, flags);
-
-@@ -265,7 +264,7 @@ __mutex_lock_common(struct mutex *lock,
- done:
- lock_acquired(&lock->dep_map, ip);
- /* got the lock - rejoice! */
-- mutex_remove_waiter(lock, &waiter, current_thread_info());
-+ mutex_remove_waiter(lock, &waiter, task);
- mutex_set_owner(lock);
-
- /* set it to 0 if there are no waiters left: */
-diff -urNp linux-2.6.32.45/kernel/mutex-debug.c linux-2.6.32.45/kernel/mutex-debug.c
---- linux-2.6.32.45/kernel/mutex-debug.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/mutex-debug.c 2011-04-17 15:56:46.000000000 -0400
-@@ -49,21 +49,21 @@ void debug_mutex_free_waiter(struct mute
- }
-
- void debug_mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter,
-- struct thread_info *ti)
-+ struct task_struct *task)
- {
- SMP_DEBUG_LOCKS_WARN_ON(!spin_is_locked(&lock->wait_lock));
-
- /* Mark the current thread as blocked on the lock: */
-- ti->task->blocked_on = waiter;
-+ task->blocked_on = waiter;
- }
-
- void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
-- struct thread_info *ti)
-+ struct task_struct *task)
- {
- DEBUG_LOCKS_WARN_ON(list_empty(&waiter->list));
-- DEBUG_LOCKS_WARN_ON(waiter->task != ti->task);
-- DEBUG_LOCKS_WARN_ON(ti->task->blocked_on != waiter);
-- ti->task->blocked_on = NULL;
-+ DEBUG_LOCKS_WARN_ON(waiter->task != task);
-+ DEBUG_LOCKS_WARN_ON(task->blocked_on != waiter);
-+ task->blocked_on = NULL;
-
- list_del_init(&waiter->list);
- waiter->task = NULL;
-@@ -75,7 +75,7 @@ void debug_mutex_unlock(struct mutex *lo
- return;
-
- DEBUG_LOCKS_WARN_ON(lock->magic != lock);
-- DEBUG_LOCKS_WARN_ON(lock->owner != current_thread_info());
-+ DEBUG_LOCKS_WARN_ON(lock->owner != current);
- DEBUG_LOCKS_WARN_ON(!lock->wait_list.prev && !lock->wait_list.next);
- mutex_clear_owner(lock);
- }
-diff -urNp linux-2.6.32.45/kernel/mutex-debug.h linux-2.6.32.45/kernel/mutex-debug.h
---- linux-2.6.32.45/kernel/mutex-debug.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/mutex-debug.h 2011-04-17 15:56:46.000000000 -0400
-@@ -20,16 +20,16 @@ extern void debug_mutex_wake_waiter(stru
- extern void debug_mutex_free_waiter(struct mutex_waiter *waiter);
- extern void debug_mutex_add_waiter(struct mutex *lock,
- struct mutex_waiter *waiter,
-- struct thread_info *ti);
-+ struct task_struct *task);
- extern void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
-- struct thread_info *ti);
-+ struct task_struct *task);
- extern void debug_mutex_unlock(struct mutex *lock);
- extern void debug_mutex_init(struct mutex *lock, const char *name,
- struct lock_class_key *key);
-
- static inline void mutex_set_owner(struct mutex *lock)
- {
-- lock->owner = current_thread_info();
-+ lock->owner = current;
- }
-
- static inline void mutex_clear_owner(struct mutex *lock)
-diff -urNp linux-2.6.32.45/kernel/mutex.h linux-2.6.32.45/kernel/mutex.h
---- linux-2.6.32.45/kernel/mutex.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/mutex.h 2011-04-17 15:56:46.000000000 -0400
-@@ -19,7 +19,7 @@
- #ifdef CONFIG_SMP
- static inline void mutex_set_owner(struct mutex *lock)
- {
-- lock->owner = current_thread_info();
-+ lock->owner = current;
- }
-
- static inline void mutex_clear_owner(struct mutex *lock)
-diff -urNp linux-2.6.32.45/kernel/panic.c linux-2.6.32.45/kernel/panic.c
---- linux-2.6.32.45/kernel/panic.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/panic.c 2011-04-17 15:56:46.000000000 -0400
-@@ -352,7 +352,7 @@ static void warn_slowpath_common(const c
- const char *board;
-
- printk(KERN_WARNING "------------[ cut here ]------------\n");
-- printk(KERN_WARNING "WARNING: at %s:%d %pS()\n", file, line, caller);
-+ printk(KERN_WARNING "WARNING: at %s:%d %pA()\n", file, line, caller);
- board = dmi_get_system_info(DMI_PRODUCT_NAME);
- if (board)
- printk(KERN_WARNING "Hardware name: %s\n", board);
-@@ -392,7 +392,8 @@ EXPORT_SYMBOL(warn_slowpath_null);
- */
- void __stack_chk_fail(void)
- {
-- panic("stack-protector: Kernel stack is corrupted in: %p\n",
-+ dump_stack();
-+ panic("stack-protector: Kernel stack is corrupted in: %pA\n",
- __builtin_return_address(0));
- }
- EXPORT_SYMBOL(__stack_chk_fail);
-diff -urNp linux-2.6.32.45/kernel/params.c linux-2.6.32.45/kernel/params.c
---- linux-2.6.32.45/kernel/params.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/params.c 2011-04-17 15:56:46.000000000 -0400
-@@ -725,7 +725,7 @@ static ssize_t module_attr_store(struct
- return ret;
- }
-
--static struct sysfs_ops module_sysfs_ops = {
-+static const struct sysfs_ops module_sysfs_ops = {
- .show = module_attr_show,
- .store = module_attr_store,
- };
-@@ -739,7 +739,7 @@ static int uevent_filter(struct kset *ks
- return 0;
- }
-
--static struct kset_uevent_ops module_uevent_ops = {
-+static const struct kset_uevent_ops module_uevent_ops = {
- .filter = uevent_filter,
- };
-
-diff -urNp linux-2.6.32.45/kernel/perf_event.c linux-2.6.32.45/kernel/perf_event.c
---- linux-2.6.32.45/kernel/perf_event.c 2011-08-09 18:35:30.000000000 -0400
-+++ linux-2.6.32.45/kernel/perf_event.c 2011-08-09 18:34:01.000000000 -0400
-@@ -77,7 +77,7 @@ int sysctl_perf_event_mlock __read_mostl
- */
- int sysctl_perf_event_sample_rate __read_mostly = 100000;
-
--static atomic64_t perf_event_id;
-+static atomic64_unchecked_t perf_event_id;
-
- /*
- * Lock for (sysadmin-configurable) event reservations:
-@@ -1094,9 +1094,9 @@ static void __perf_event_sync_stat(struc
- * In order to keep per-task stats reliable we need to flip the event
- * values when we flip the contexts.
- */
-- value = atomic64_read(&next_event->count);
-- value = atomic64_xchg(&event->count, value);
-- atomic64_set(&next_event->count, value);
-+ value = atomic64_read_unchecked(&next_event->count);
-+ value = atomic64_xchg_unchecked(&event->count, value);
-+ atomic64_set_unchecked(&next_event->count, value);
-
- swap(event->total_time_enabled, next_event->total_time_enabled);
- swap(event->total_time_running, next_event->total_time_running);
-@@ -1552,7 +1552,7 @@ static u64 perf_event_read(struct perf_e
- update_event_times(event);
- }
-
-- return atomic64_read(&event->count);
-+ return atomic64_read_unchecked(&event->count);
- }
-
- /*
-@@ -1790,11 +1790,11 @@ static int perf_event_read_group(struct
- values[n++] = 1 + leader->nr_siblings;
- if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
- values[n++] = leader->total_time_enabled +
-- atomic64_read(&leader->child_total_time_enabled);
-+ atomic64_read_unchecked(&leader->child_total_time_enabled);
- }
- if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
- values[n++] = leader->total_time_running +
-- atomic64_read(&leader->child_total_time_running);
-+ atomic64_read_unchecked(&leader->child_total_time_running);
- }
-
- size = n * sizeof(u64);
-@@ -1829,11 +1829,11 @@ static int perf_event_read_one(struct pe
- values[n++] = perf_event_read_value(event);
- if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
- values[n++] = event->total_time_enabled +
-- atomic64_read(&event->child_total_time_enabled);
-+ atomic64_read_unchecked(&event->child_total_time_enabled);
- }
- if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
- values[n++] = event->total_time_running +
-- atomic64_read(&event->child_total_time_running);
-+ atomic64_read_unchecked(&event->child_total_time_running);
- }
- if (read_format & PERF_FORMAT_ID)
- values[n++] = primary_event_id(event);
-@@ -1903,7 +1903,7 @@ static unsigned int perf_poll(struct fil
- static void perf_event_reset(struct perf_event *event)
- {
- (void)perf_event_read(event);
-- atomic64_set(&event->count, 0);
-+ atomic64_set_unchecked(&event->count, 0);
- perf_event_update_userpage(event);
- }
-
-@@ -2079,15 +2079,15 @@ void perf_event_update_userpage(struct p
- ++userpg->lock;
- barrier();
- userpg->index = perf_event_index(event);
-- userpg->offset = atomic64_read(&event->count);
-+ userpg->offset = atomic64_read_unchecked(&event->count);
- if (event->state == PERF_EVENT_STATE_ACTIVE)
-- userpg->offset -= atomic64_read(&event->hw.prev_count);
-+ userpg->offset -= atomic64_read_unchecked(&event->hw.prev_count);
-
- userpg->time_enabled = event->total_time_enabled +
-- atomic64_read(&event->child_total_time_enabled);
-+ atomic64_read_unchecked(&event->child_total_time_enabled);
-
- userpg->time_running = event->total_time_running +
-- atomic64_read(&event->child_total_time_running);
-+ atomic64_read_unchecked(&event->child_total_time_running);
-
- barrier();
- ++userpg->lock;
-@@ -2903,14 +2903,14 @@ static void perf_output_read_one(struct
- u64 values[4];
- int n = 0;
-
-- values[n++] = atomic64_read(&event->count);
-+ values[n++] = atomic64_read_unchecked(&event->count);
- if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
- values[n++] = event->total_time_enabled +
-- atomic64_read(&event->child_total_time_enabled);
-+ atomic64_read_unchecked(&event->child_total_time_enabled);
- }
- if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
- values[n++] = event->total_time_running +
-- atomic64_read(&event->child_total_time_running);
-+ atomic64_read_unchecked(&event->child_total_time_running);
- }
- if (read_format & PERF_FORMAT_ID)
- values[n++] = primary_event_id(event);
-@@ -2940,7 +2940,7 @@ static void perf_output_read_group(struc
- if (leader != event)
- leader->pmu->read(leader);
-
-- values[n++] = atomic64_read(&leader->count);
-+ values[n++] = atomic64_read_unchecked(&leader->count);
- if (read_format & PERF_FORMAT_ID)
- values[n++] = primary_event_id(leader);
-
-@@ -2952,7 +2952,7 @@ static void perf_output_read_group(struc
- if (sub != event)
- sub->pmu->read(sub);
-
-- values[n++] = atomic64_read(&sub->count);
-+ values[n++] = atomic64_read_unchecked(&sub->count);
- if (read_format & PERF_FORMAT_ID)
- values[n++] = primary_event_id(sub);
-
-@@ -3783,7 +3783,7 @@ static void perf_swevent_add(struct perf
- {
- struct hw_perf_event *hwc = &event->hw;
-
-- atomic64_add(nr, &event->count);
-+ atomic64_add_unchecked(nr, &event->count);
-
- if (!hwc->sample_period)
- return;
-@@ -4040,9 +4040,9 @@ static void cpu_clock_perf_event_update(
- u64 now;
-
- now = cpu_clock(cpu);
-- prev = atomic64_read(&event->hw.prev_count);
-- atomic64_set(&event->hw.prev_count, now);
-- atomic64_add(now - prev, &event->count);
-+ prev = atomic64_read_unchecked(&event->hw.prev_count);
-+ atomic64_set_unchecked(&event->hw.prev_count, now);
-+ atomic64_add_unchecked(now - prev, &event->count);
- }
-
- static int cpu_clock_perf_event_enable(struct perf_event *event)
-@@ -4050,7 +4050,7 @@ static int cpu_clock_perf_event_enable(s
- struct hw_perf_event *hwc = &event->hw;
- int cpu = raw_smp_processor_id();
-
-- atomic64_set(&hwc->prev_count, cpu_clock(cpu));
-+ atomic64_set_unchecked(&hwc->prev_count, cpu_clock(cpu));
- perf_swevent_start_hrtimer(event);
-
- return 0;
-@@ -4082,9 +4082,9 @@ static void task_clock_perf_event_update
- u64 prev;
- s64 delta;
-
-- prev = atomic64_xchg(&event->hw.prev_count, now);
-+ prev = atomic64_xchg_unchecked(&event->hw.prev_count, now);
- delta = now - prev;
-- atomic64_add(delta, &event->count);
-+ atomic64_add_unchecked(delta, &event->count);
- }
-
- static int task_clock_perf_event_enable(struct perf_event *event)
-@@ -4094,7 +4094,7 @@ static int task_clock_perf_event_enable(
-
- now = event->ctx->time;
-
-- atomic64_set(&hwc->prev_count, now);
-+ atomic64_set_unchecked(&hwc->prev_count, now);
-
- perf_swevent_start_hrtimer(event);
-
-@@ -4289,7 +4289,7 @@ perf_event_alloc(struct perf_event_attr
- event->parent = parent_event;
-
- event->ns = get_pid_ns(current->nsproxy->pid_ns);
-- event->id = atomic64_inc_return(&perf_event_id);
-+ event->id = atomic64_inc_return_unchecked(&perf_event_id);
-
- event->state = PERF_EVENT_STATE_INACTIVE;
-
-@@ -4720,15 +4720,15 @@ static void sync_child_event(struct perf
- if (child_event->attr.inherit_stat)
- perf_event_read_event(child_event, child);
-
-- child_val = atomic64_read(&child_event->count);
-+ child_val = atomic64_read_unchecked(&child_event->count);
-
- /*
- * Add back the child's count to the parent's count:
- */
-- atomic64_add(child_val, &parent_event->count);
-- atomic64_add(child_event->total_time_enabled,
-+ atomic64_add_unchecked(child_val, &parent_event->count);
-+ atomic64_add_unchecked(child_event->total_time_enabled,
- &parent_event->child_total_time_enabled);
-- atomic64_add(child_event->total_time_running,
-+ atomic64_add_unchecked(child_event->total_time_running,
- &parent_event->child_total_time_running);
-
- /*
-diff -urNp linux-2.6.32.45/kernel/pid.c linux-2.6.32.45/kernel/pid.c
---- linux-2.6.32.45/kernel/pid.c 2011-04-22 19:16:29.000000000 -0400
-+++ linux-2.6.32.45/kernel/pid.c 2011-08-21 19:11:29.000000000 -0400
-@@ -33,6 +33,7 @@
- #include <linux/rculist.h>
- #include <linux/bootmem.h>
- #include <linux/hash.h>
-+#include <linux/security.h>
- #include <linux/pid_namespace.h>
- #include <linux/init_task.h>
- #include <linux/syscalls.h>
-@@ -45,7 +46,7 @@ struct pid init_struct_pid = INIT_STRUCT
-
- int pid_max = PID_MAX_DEFAULT;
-
--#define RESERVED_PIDS 300
-+#define RESERVED_PIDS 500
-
- int pid_max_min = RESERVED_PIDS + 1;
- int pid_max_max = PID_MAX_LIMIT;
-@@ -383,7 +384,14 @@ EXPORT_SYMBOL(pid_task);
- */
- struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
- {
-- return pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
-+ struct task_struct *task;
-+
-+ task = pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
-+
-+ if (gr_pid_is_chrooted(task))
-+ return NULL;
-+
-+ return task;
- }
-
- struct task_struct *find_task_by_vpid(pid_t vnr)
-@@ -391,6 +399,11 @@ struct task_struct *find_task_by_vpid(pi
- return find_task_by_pid_ns(vnr, current->nsproxy->pid_ns);
- }
-
-+struct task_struct *find_task_by_vpid_unrestricted(pid_t vnr)
-+{
-+ return pid_task(find_pid_ns(vnr, current->nsproxy->pid_ns), PIDTYPE_PID);
-+}
-+
- struct pid *get_task_pid(struct task_struct *task, enum pid_type type)
- {
- struct pid *pid;
-diff -urNp linux-2.6.32.45/kernel/posix-cpu-timers.c linux-2.6.32.45/kernel/posix-cpu-timers.c
---- linux-2.6.32.45/kernel/posix-cpu-timers.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/posix-cpu-timers.c 2011-08-06 09:33:44.000000000 -0400
-@@ -6,6 +6,7 @@
- #include <linux/posix-timers.h>
- #include <linux/errno.h>
- #include <linux/math64.h>
-+#include <linux/security.h>
- #include <asm/uaccess.h>
- #include <linux/kernel_stat.h>
- #include <trace/events/timer.h>
-@@ -1697,7 +1698,7 @@ static long thread_cpu_nsleep_restart(st
-
- static __init int init_posix_cpu_timers(void)
- {
-- struct k_clock process = {
-+ static struct k_clock process = {
- .clock_getres = process_cpu_clock_getres,
- .clock_get = process_cpu_clock_get,
- .clock_set = do_posix_clock_nosettime,
-@@ -1705,7 +1706,7 @@ static __init int init_posix_cpu_timers(
- .nsleep = process_cpu_nsleep,
- .nsleep_restart = process_cpu_nsleep_restart,
- };
-- struct k_clock thread = {
-+ static struct k_clock thread = {
- .clock_getres = thread_cpu_clock_getres,
- .clock_get = thread_cpu_clock_get,
- .clock_set = do_posix_clock_nosettime,
-diff -urNp linux-2.6.32.45/kernel/posix-timers.c linux-2.6.32.45/kernel/posix-timers.c
---- linux-2.6.32.45/kernel/posix-timers.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/posix-timers.c 2011-08-06 09:34:14.000000000 -0400
-@@ -42,6 +42,7 @@
- #include <linux/compiler.h>
- #include <linux/idr.h>
- #include <linux/posix-timers.h>
-+#include <linux/grsecurity.h>
- #include <linux/syscalls.h>
- #include <linux/wait.h>
- #include <linux/workqueue.h>
-@@ -131,7 +132,7 @@ static DEFINE_SPINLOCK(idr_lock);
- * which we beg off on and pass to do_sys_settimeofday().
- */
-
--static struct k_clock posix_clocks[MAX_CLOCKS];
-+static struct k_clock *posix_clocks[MAX_CLOCKS];
-
- /*
- * These ones are defined below.
-@@ -157,8 +158,8 @@ static inline void unlock_timer(struct k
- */
- #define CLOCK_DISPATCH(clock, call, arglist) \
- ((clock) < 0 ? posix_cpu_##call arglist : \
-- (posix_clocks[clock].call != NULL \
-- ? (*posix_clocks[clock].call) arglist : common_##call arglist))
-+ (posix_clocks[clock]->call != NULL \
-+ ? (*posix_clocks[clock]->call) arglist : common_##call arglist))
-
- /*
- * Default clock hook functions when the struct k_clock passed
-@@ -172,7 +173,7 @@ static inline int common_clock_getres(co
- struct timespec *tp)
- {
- tp->tv_sec = 0;
-- tp->tv_nsec = posix_clocks[which_clock].res;
-+ tp->tv_nsec = posix_clocks[which_clock]->res;
- return 0;
- }
-
-@@ -217,9 +218,11 @@ static inline int invalid_clockid(const
- return 0;
- if ((unsigned) which_clock >= MAX_CLOCKS)
- return 1;
-- if (posix_clocks[which_clock].clock_getres != NULL)
-+ if (!posix_clocks[which_clock])
- return 0;
-- if (posix_clocks[which_clock].res != 0)
-+ if (posix_clocks[which_clock]->clock_getres != NULL)
-+ return 0;
-+ if (posix_clocks[which_clock]->res != 0)
- return 0;
- return 1;
- }
-@@ -266,29 +269,29 @@ int posix_get_coarse_res(const clockid_t
- */
- static __init int init_posix_timers(void)
- {
-- struct k_clock clock_realtime = {
-+ static struct k_clock clock_realtime = {
- .clock_getres = hrtimer_get_res,
- };
-- struct k_clock clock_monotonic = {
-+ static struct k_clock clock_monotonic = {
- .clock_getres = hrtimer_get_res,
- .clock_get = posix_ktime_get_ts,
- .clock_set = do_posix_clock_nosettime,
- };
-- struct k_clock clock_monotonic_raw = {
-+ static struct k_clock clock_monotonic_raw = {
- .clock_getres = hrtimer_get_res,
- .clock_get = posix_get_monotonic_raw,
- .clock_set = do_posix_clock_nosettime,
- .timer_create = no_timer_create,
- .nsleep = no_nsleep,
- };
-- struct k_clock clock_realtime_coarse = {
-+ static struct k_clock clock_realtime_coarse = {
- .clock_getres = posix_get_coarse_res,
- .clock_get = posix_get_realtime_coarse,
- .clock_set = do_posix_clock_nosettime,
- .timer_create = no_timer_create,
- .nsleep = no_nsleep,
- };
-- struct k_clock clock_monotonic_coarse = {
-+ static struct k_clock clock_monotonic_coarse = {
- .clock_getres = posix_get_coarse_res,
- .clock_get = posix_get_monotonic_coarse,
- .clock_set = do_posix_clock_nosettime,
-@@ -296,6 +299,8 @@ static __init int init_posix_timers(void
- .nsleep = no_nsleep,
- };
-
-+ pax_track_stack();
-+
- register_posix_clock(CLOCK_REALTIME, &clock_realtime);
- register_posix_clock(CLOCK_MONOTONIC, &clock_monotonic);
- register_posix_clock(CLOCK_MONOTONIC_RAW, &clock_monotonic_raw);
-@@ -484,7 +489,7 @@ void register_posix_clock(const clockid_
- return;
- }
-
-- posix_clocks[clock_id] = *new_clock;
-+ posix_clocks[clock_id] = new_clock;
- }
- EXPORT_SYMBOL_GPL(register_posix_clock);
-
-@@ -948,6 +953,13 @@ SYSCALL_DEFINE2(clock_settime, const clo
- if (copy_from_user(&new_tp, tp, sizeof (*tp)))
- return -EFAULT;
-
-+ /* only the CLOCK_REALTIME clock can be set, all other clocks
-+ have their clock_set fptr set to a nosettime dummy function
-+ CLOCK_REALTIME has a NULL clock_set fptr which causes it to
-+ call common_clock_set, which calls do_sys_settimeofday, which
-+ we hook
-+ */
-+
- return CLOCK_DISPATCH(which_clock, clock_set, (which_clock, &new_tp));
- }
-
-diff -urNp linux-2.6.32.45/kernel/power/hibernate.c linux-2.6.32.45/kernel/power/hibernate.c
---- linux-2.6.32.45/kernel/power/hibernate.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/power/hibernate.c 2011-04-17 15:56:46.000000000 -0400
-@@ -48,14 +48,14 @@ enum {
-
- static int hibernation_mode = HIBERNATION_SHUTDOWN;
-
--static struct platform_hibernation_ops *hibernation_ops;
-+static const struct platform_hibernation_ops *hibernation_ops;
-
- /**
- * hibernation_set_ops - set the global hibernate operations
- * @ops: the hibernation operations to use in subsequent hibernation transitions
- */
-
--void hibernation_set_ops(struct platform_hibernation_ops *ops)
-+void hibernation_set_ops(const struct platform_hibernation_ops *ops)
- {
- if (ops && !(ops->begin && ops->end && ops->pre_snapshot
- && ops->prepare && ops->finish && ops->enter && ops->pre_restore
-diff -urNp linux-2.6.32.45/kernel/power/poweroff.c linux-2.6.32.45/kernel/power/poweroff.c
---- linux-2.6.32.45/kernel/power/poweroff.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/power/poweroff.c 2011-04-17 15:56:46.000000000 -0400
-@@ -37,7 +37,7 @@ static struct sysrq_key_op sysrq_powerof
- .enable_mask = SYSRQ_ENABLE_BOOT,
- };
-
--static int pm_sysrq_init(void)
-+static int __init pm_sysrq_init(void)
- {
- register_sysrq_key('o', &sysrq_poweroff_op);
- return 0;
-diff -urNp linux-2.6.32.45/kernel/power/process.c linux-2.6.32.45/kernel/power/process.c
---- linux-2.6.32.45/kernel/power/process.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/power/process.c 2011-04-17 15:56:46.000000000 -0400
-@@ -37,12 +37,15 @@ static int try_to_freeze_tasks(bool sig_
- struct timeval start, end;
- u64 elapsed_csecs64;
- unsigned int elapsed_csecs;
-+ bool timedout = false;
-
- do_gettimeofday(&start);
-
- end_time = jiffies + TIMEOUT;
- do {
- todo = 0;
-+ if (time_after(jiffies, end_time))
-+ timedout = true;
- read_lock(&tasklist_lock);
- do_each_thread(g, p) {
- if (frozen(p) || !freezeable(p))
-@@ -57,15 +60,17 @@ static int try_to_freeze_tasks(bool sig_
- * It is "frozen enough". If the task does wake
- * up, it will immediately call try_to_freeze.
- */
-- if (!task_is_stopped_or_traced(p) &&
-- !freezer_should_skip(p))
-+ if (!task_is_stopped_or_traced(p) && !freezer_should_skip(p)) {
- todo++;
-+ if (timedout) {
-+ printk(KERN_ERR "Task refusing to freeze:\n");
-+ sched_show_task(p);
-+ }
-+ }
- } while_each_thread(g, p);
- read_unlock(&tasklist_lock);
- yield(); /* Yield is okay here */
-- if (time_after(jiffies, end_time))
-- break;
-- } while (todo);
-+ } while (todo && !timedout);
-
- do_gettimeofday(&end);
- elapsed_csecs64 = timeval_to_ns(&end) - timeval_to_ns(&start);
-diff -urNp linux-2.6.32.45/kernel/power/suspend.c linux-2.6.32.45/kernel/power/suspend.c
---- linux-2.6.32.45/kernel/power/suspend.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/power/suspend.c 2011-04-17 15:56:46.000000000 -0400
-@@ -23,13 +23,13 @@ const char *const pm_states[PM_SUSPEND_M
- [PM_SUSPEND_MEM] = "mem",
- };
-
--static struct platform_suspend_ops *suspend_ops;
-+static const struct platform_suspend_ops *suspend_ops;
-
- /**
- * suspend_set_ops - Set the global suspend method table.
- * @ops: Pointer to ops structure.
- */
--void suspend_set_ops(struct platform_suspend_ops *ops)
-+void suspend_set_ops(const struct platform_suspend_ops *ops)
- {
- mutex_lock(&pm_mutex);
- suspend_ops = ops;
-diff -urNp linux-2.6.32.45/kernel/printk.c linux-2.6.32.45/kernel/printk.c
---- linux-2.6.32.45/kernel/printk.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/printk.c 2011-04-17 15:56:46.000000000 -0400
-@@ -278,6 +278,11 @@ int do_syslog(int type, char __user *buf
- char c;
- int error = 0;
-
-+#ifdef CONFIG_GRKERNSEC_DMESG
-+ if (grsec_enable_dmesg && !capable(CAP_SYS_ADMIN))
-+ return -EPERM;
-+#endif
-+
- error = security_syslog(type);
- if (error)
- return error;
-diff -urNp linux-2.6.32.45/kernel/profile.c linux-2.6.32.45/kernel/profile.c
---- linux-2.6.32.45/kernel/profile.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/profile.c 2011-05-04 17:56:28.000000000 -0400
-@@ -39,7 +39,7 @@ struct profile_hit {
- /* Oprofile timer tick hook */
- static int (*timer_hook)(struct pt_regs *) __read_mostly;
-
--static atomic_t *prof_buffer;
-+static atomic_unchecked_t *prof_buffer;
- static unsigned long prof_len, prof_shift;
-
- int prof_on __read_mostly;
-@@ -283,7 +283,7 @@ static void profile_flip_buffers(void)
- hits[i].pc = 0;
- continue;
- }
-- atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
-+ atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
- hits[i].hits = hits[i].pc = 0;
- }
- }
-@@ -346,9 +346,9 @@ void profile_hits(int type, void *__pc,
- * Add the current hit(s) and flush the write-queue out
- * to the global buffer:
- */
-- atomic_add(nr_hits, &prof_buffer[pc]);
-+ atomic_add_unchecked(nr_hits, &prof_buffer[pc]);
- for (i = 0; i < NR_PROFILE_HIT; ++i) {
-- atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
-+ atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
- hits[i].pc = hits[i].hits = 0;
- }
- out:
-@@ -426,7 +426,7 @@ void profile_hits(int type, void *__pc,
- if (prof_on != type || !prof_buffer)
- return;
- pc = ((unsigned long)__pc - (unsigned long)_stext) >> prof_shift;
-- atomic_add(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
-+ atomic_add_unchecked(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
- }
- #endif /* !CONFIG_SMP */
- EXPORT_SYMBOL_GPL(profile_hits);
-@@ -517,7 +517,7 @@ read_profile(struct file *file, char __u
- return -EFAULT;
- buf++; p++; count--; read++;
- }
-- pnt = (char *)prof_buffer + p - sizeof(atomic_t);
-+ pnt = (char *)prof_buffer + p - sizeof(atomic_unchecked_t);
- if (copy_to_user(buf, (void *)pnt, count))
- return -EFAULT;
- read += count;
-@@ -548,7 +548,7 @@ static ssize_t write_profile(struct file
- }
- #endif
- profile_discard_flip_buffers();
-- memset(prof_buffer, 0, prof_len * sizeof(atomic_t));
-+ memset(prof_buffer, 0, prof_len * sizeof(atomic_unchecked_t));
- return count;
- }
-
-diff -urNp linux-2.6.32.45/kernel/ptrace.c linux-2.6.32.45/kernel/ptrace.c
---- linux-2.6.32.45/kernel/ptrace.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/ptrace.c 2011-05-22 23:02:06.000000000 -0400
-@@ -117,7 +117,8 @@ int ptrace_check_attach(struct task_stru
- return ret;
- }
-
--int __ptrace_may_access(struct task_struct *task, unsigned int mode)
-+static int __ptrace_may_access(struct task_struct *task, unsigned int mode,
-+ unsigned int log)
- {
- const struct cred *cred = current_cred(), *tcred;
-
-@@ -141,7 +142,9 @@ int __ptrace_may_access(struct task_stru
- cred->gid != tcred->egid ||
- cred->gid != tcred->sgid ||
- cred->gid != tcred->gid) &&
-- !capable(CAP_SYS_PTRACE)) {
-+ ((!log && !capable_nolog(CAP_SYS_PTRACE)) ||
-+ (log && !capable(CAP_SYS_PTRACE)))
-+ ) {
- rcu_read_unlock();
- return -EPERM;
- }
-@@ -149,7 +152,9 @@ int __ptrace_may_access(struct task_stru
- smp_rmb();
- if (task->mm)
- dumpable = get_dumpable(task->mm);
-- if (!dumpable && !capable(CAP_SYS_PTRACE))
-+ if (!dumpable &&
-+ ((!log && !capable_nolog(CAP_SYS_PTRACE)) ||
-+ (log && !capable(CAP_SYS_PTRACE))))
- return -EPERM;
-
- return security_ptrace_access_check(task, mode);
-@@ -159,7 +164,16 @@ bool ptrace_may_access(struct task_struc
- {
- int err;
- task_lock(task);
-- err = __ptrace_may_access(task, mode);
-+ err = __ptrace_may_access(task, mode, 0);
-+ task_unlock(task);
-+ return !err;
-+}
-+
-+bool ptrace_may_access_log(struct task_struct *task, unsigned int mode)
-+{
-+ int err;
-+ task_lock(task);
-+ err = __ptrace_may_access(task, mode, 1);
- task_unlock(task);
- return !err;
- }
-@@ -186,7 +200,7 @@ int ptrace_attach(struct task_struct *ta
- goto out;
-
- task_lock(task);
-- retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH);
-+ retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH, 1);
- task_unlock(task);
- if (retval)
- goto unlock_creds;
-@@ -199,7 +213,7 @@ int ptrace_attach(struct task_struct *ta
- goto unlock_tasklist;
-
- task->ptrace = PT_PTRACED;
-- if (capable(CAP_SYS_PTRACE))
-+ if (capable_nolog(CAP_SYS_PTRACE))
- task->ptrace |= PT_PTRACE_CAP;
-
- __ptrace_link(task, current);
-@@ -351,6 +365,8 @@ int ptrace_readdata(struct task_struct *
- {
- int copied = 0;
-
-+ pax_track_stack();
-+
- while (len > 0) {
- char buf[128];
- int this_len, retval;
-@@ -376,6 +392,8 @@ int ptrace_writedata(struct task_struct
- {
- int copied = 0;
-
-+ pax_track_stack();
-+
- while (len > 0) {
- char buf[128];
- int this_len, retval;
-@@ -517,6 +535,8 @@ int ptrace_request(struct task_struct *c
- int ret = -EIO;
- siginfo_t siginfo;
-
-+ pax_track_stack();
-+
- switch (request) {
- case PTRACE_PEEKTEXT:
- case PTRACE_PEEKDATA:
-@@ -532,18 +552,18 @@ int ptrace_request(struct task_struct *c
- ret = ptrace_setoptions(child, data);
- break;
- case PTRACE_GETEVENTMSG:
-- ret = put_user(child->ptrace_message, (unsigned long __user *) data);
-+ ret = put_user(child->ptrace_message, (__force unsigned long __user *) data);
- break;
-
- case PTRACE_GETSIGINFO:
- ret = ptrace_getsiginfo(child, &siginfo);
- if (!ret)
-- ret = copy_siginfo_to_user((siginfo_t __user *) data,
-+ ret = copy_siginfo_to_user((__force siginfo_t __user *) data,
- &siginfo);
- break;
-
- case PTRACE_SETSIGINFO:
-- if (copy_from_user(&siginfo, (siginfo_t __user *) data,
-+ if (copy_from_user(&siginfo, (__force siginfo_t __user *) data,
- sizeof siginfo))
- ret = -EFAULT;
- else
-@@ -621,14 +641,21 @@ SYSCALL_DEFINE4(ptrace, long, request, l
- goto out;
- }
-
-+ if (gr_handle_ptrace(child, request)) {
-+ ret = -EPERM;
-+ goto out_put_task_struct;
-+ }
-+
- if (request == PTRACE_ATTACH) {
- ret = ptrace_attach(child);
- /*
- * Some architectures need to do book-keeping after
- * a ptrace attach.
- */
-- if (!ret)
-+ if (!ret) {
- arch_ptrace_attach(child);
-+ gr_audit_ptrace(child);
-+ }
- goto out_put_task_struct;
- }
-
-@@ -653,7 +680,7 @@ int generic_ptrace_peekdata(struct task_
- copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
- if (copied != sizeof(tmp))
- return -EIO;
-- return put_user(tmp, (unsigned long __user *)data);
-+ return put_user(tmp, (__force unsigned long __user *)data);
- }
-
- int generic_ptrace_pokedata(struct task_struct *tsk, long addr, long data)
-@@ -675,6 +702,8 @@ int compat_ptrace_request(struct task_st
- siginfo_t siginfo;
- int ret;
-
-+ pax_track_stack();
-+
- switch (request) {
- case PTRACE_PEEKTEXT:
- case PTRACE_PEEKDATA:
-@@ -740,14 +769,21 @@ asmlinkage long compat_sys_ptrace(compat
- goto out;
- }
-
-+ if (gr_handle_ptrace(child, request)) {
-+ ret = -EPERM;
-+ goto out_put_task_struct;
-+ }
-+
- if (request == PTRACE_ATTACH) {
- ret = ptrace_attach(child);
- /*
- * Some architectures need to do book-keeping after
- * a ptrace attach.
- */
-- if (!ret)
-+ if (!ret) {
- arch_ptrace_attach(child);
-+ gr_audit_ptrace(child);
-+ }
- goto out_put_task_struct;
- }
-
-diff -urNp linux-2.6.32.45/kernel/rcutorture.c linux-2.6.32.45/kernel/rcutorture.c
---- linux-2.6.32.45/kernel/rcutorture.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/rcutorture.c 2011-05-04 17:56:28.000000000 -0400
-@@ -118,12 +118,12 @@ static DEFINE_PER_CPU(long [RCU_TORTURE_
- { 0 };
- static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_batch) =
- { 0 };
--static atomic_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
--static atomic_t n_rcu_torture_alloc;
--static atomic_t n_rcu_torture_alloc_fail;
--static atomic_t n_rcu_torture_free;
--static atomic_t n_rcu_torture_mberror;
--static atomic_t n_rcu_torture_error;
-+static atomic_unchecked_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
-+static atomic_unchecked_t n_rcu_torture_alloc;
-+static atomic_unchecked_t n_rcu_torture_alloc_fail;
-+static atomic_unchecked_t n_rcu_torture_free;
-+static atomic_unchecked_t n_rcu_torture_mberror;
-+static atomic_unchecked_t n_rcu_torture_error;
- static long n_rcu_torture_timers;
- static struct list_head rcu_torture_removed;
- static cpumask_var_t shuffle_tmp_mask;
-@@ -187,11 +187,11 @@ rcu_torture_alloc(void)
-
- spin_lock_bh(&rcu_torture_lock);
- if (list_empty(&rcu_torture_freelist)) {
-- atomic_inc(&n_rcu_torture_alloc_fail);
-+ atomic_inc_unchecked(&n_rcu_torture_alloc_fail);
- spin_unlock_bh(&rcu_torture_lock);
- return NULL;
- }
-- atomic_inc(&n_rcu_torture_alloc);
-+ atomic_inc_unchecked(&n_rcu_torture_alloc);
- p = rcu_torture_freelist.next;
- list_del_init(p);
- spin_unlock_bh(&rcu_torture_lock);
-@@ -204,7 +204,7 @@ rcu_torture_alloc(void)
- static void
- rcu_torture_free(struct rcu_torture *p)
- {
-- atomic_inc(&n_rcu_torture_free);
-+ atomic_inc_unchecked(&n_rcu_torture_free);
- spin_lock_bh(&rcu_torture_lock);
- list_add_tail(&p->rtort_free, &rcu_torture_freelist);
- spin_unlock_bh(&rcu_torture_lock);
-@@ -319,7 +319,7 @@ rcu_torture_cb(struct rcu_head *p)
- i = rp->rtort_pipe_count;
- if (i > RCU_TORTURE_PIPE_LEN)
- i = RCU_TORTURE_PIPE_LEN;
-- atomic_inc(&rcu_torture_wcount[i]);
-+ atomic_inc_unchecked(&rcu_torture_wcount[i]);
- if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
- rp->rtort_mbtest = 0;
- rcu_torture_free(rp);
-@@ -359,7 +359,7 @@ static void rcu_sync_torture_deferred_fr
- i = rp->rtort_pipe_count;
- if (i > RCU_TORTURE_PIPE_LEN)
- i = RCU_TORTURE_PIPE_LEN;
-- atomic_inc(&rcu_torture_wcount[i]);
-+ atomic_inc_unchecked(&rcu_torture_wcount[i]);
- if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
- rp->rtort_mbtest = 0;
- list_del(&rp->rtort_free);
-@@ -653,7 +653,7 @@ rcu_torture_writer(void *arg)
- i = old_rp->rtort_pipe_count;
- if (i > RCU_TORTURE_PIPE_LEN)
- i = RCU_TORTURE_PIPE_LEN;
-- atomic_inc(&rcu_torture_wcount[i]);
-+ atomic_inc_unchecked(&rcu_torture_wcount[i]);
- old_rp->rtort_pipe_count++;
- cur_ops->deferred_free(old_rp);
- }
-@@ -718,7 +718,7 @@ static void rcu_torture_timer(unsigned l
- return;
- }
- if (p->rtort_mbtest == 0)
-- atomic_inc(&n_rcu_torture_mberror);
-+ atomic_inc_unchecked(&n_rcu_torture_mberror);
- spin_lock(&rand_lock);
- cur_ops->read_delay(&rand);
- n_rcu_torture_timers++;
-@@ -776,7 +776,7 @@ rcu_torture_reader(void *arg)
- continue;
- }
- if (p->rtort_mbtest == 0)
-- atomic_inc(&n_rcu_torture_mberror);
-+ atomic_inc_unchecked(&n_rcu_torture_mberror);
- cur_ops->read_delay(&rand);
- preempt_disable();
- pipe_count = p->rtort_pipe_count;
-@@ -834,17 +834,17 @@ rcu_torture_printk(char *page)
- rcu_torture_current,
- rcu_torture_current_version,
- list_empty(&rcu_torture_freelist),
-- atomic_read(&n_rcu_torture_alloc),
-- atomic_read(&n_rcu_torture_alloc_fail),
-- atomic_read(&n_rcu_torture_free),
-- atomic_read(&n_rcu_torture_mberror),
-+ atomic_read_unchecked(&n_rcu_torture_alloc),
-+ atomic_read_unchecked(&n_rcu_torture_alloc_fail),
-+ atomic_read_unchecked(&n_rcu_torture_free),
-+ atomic_read_unchecked(&n_rcu_torture_mberror),
- n_rcu_torture_timers);
-- if (atomic_read(&n_rcu_torture_mberror) != 0)
-+ if (atomic_read_unchecked(&n_rcu_torture_mberror) != 0)
- cnt += sprintf(&page[cnt], " !!!");
- cnt += sprintf(&page[cnt], "\n%s%s ", torture_type, TORTURE_FLAG);
- if (i > 1) {
- cnt += sprintf(&page[cnt], "!!! ");
-- atomic_inc(&n_rcu_torture_error);
-+ atomic_inc_unchecked(&n_rcu_torture_error);
- WARN_ON_ONCE(1);
- }
- cnt += sprintf(&page[cnt], "Reader Pipe: ");
-@@ -858,7 +858,7 @@ rcu_torture_printk(char *page)
- cnt += sprintf(&page[cnt], "Free-Block Circulation: ");
- for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
- cnt += sprintf(&page[cnt], " %d",
-- atomic_read(&rcu_torture_wcount[i]));
-+ atomic_read_unchecked(&rcu_torture_wcount[i]));
- }
- cnt += sprintf(&page[cnt], "\n");
- if (cur_ops->stats)
-@@ -1084,7 +1084,7 @@ rcu_torture_cleanup(void)
-
- if (cur_ops->cleanup)
- cur_ops->cleanup();
-- if (atomic_read(&n_rcu_torture_error))
-+ if (atomic_read_unchecked(&n_rcu_torture_error))
- rcu_torture_print_module_parms("End of test: FAILURE");
- else
- rcu_torture_print_module_parms("End of test: SUCCESS");
-@@ -1138,13 +1138,13 @@ rcu_torture_init(void)
-
- rcu_torture_current = NULL;
- rcu_torture_current_version = 0;
-- atomic_set(&n_rcu_torture_alloc, 0);
-- atomic_set(&n_rcu_torture_alloc_fail, 0);
-- atomic_set(&n_rcu_torture_free, 0);
-- atomic_set(&n_rcu_torture_mberror, 0);
-- atomic_set(&n_rcu_torture_error, 0);
-+ atomic_set_unchecked(&n_rcu_torture_alloc, 0);
-+ atomic_set_unchecked(&n_rcu_torture_alloc_fail, 0);
-+ atomic_set_unchecked(&n_rcu_torture_free, 0);
-+ atomic_set_unchecked(&n_rcu_torture_mberror, 0);
-+ atomic_set_unchecked(&n_rcu_torture_error, 0);
- for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++)
-- atomic_set(&rcu_torture_wcount[i], 0);
-+ atomic_set_unchecked(&rcu_torture_wcount[i], 0);
- for_each_possible_cpu(cpu) {
- for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
- per_cpu(rcu_torture_count, cpu)[i] = 0;
-diff -urNp linux-2.6.32.45/kernel/rcutree.c linux-2.6.32.45/kernel/rcutree.c
---- linux-2.6.32.45/kernel/rcutree.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/rcutree.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1303,7 +1303,7 @@ __rcu_process_callbacks(struct rcu_state
- /*
- * Do softirq processing for the current CPU.
- */
--static void rcu_process_callbacks(struct softirq_action *unused)
-+static void rcu_process_callbacks(void)
- {
- /*
- * Memory references from any prior RCU read-side critical sections
-diff -urNp linux-2.6.32.45/kernel/rcutree_plugin.h linux-2.6.32.45/kernel/rcutree_plugin.h
---- linux-2.6.32.45/kernel/rcutree_plugin.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/rcutree_plugin.h 2011-04-17 15:56:46.000000000 -0400
-@@ -145,7 +145,7 @@ static void rcu_preempt_note_context_swi
- */
- void __rcu_read_lock(void)
- {
-- ACCESS_ONCE(current->rcu_read_lock_nesting)++;
-+ ACCESS_ONCE_RW(current->rcu_read_lock_nesting)++;
- barrier(); /* needed if we ever invoke rcu_read_lock in rcutree.c */
- }
- EXPORT_SYMBOL_GPL(__rcu_read_lock);
-@@ -251,7 +251,7 @@ void __rcu_read_unlock(void)
- struct task_struct *t = current;
-
- barrier(); /* needed if we ever invoke rcu_read_unlock in rcutree.c */
-- if (--ACCESS_ONCE(t->rcu_read_lock_nesting) == 0 &&
-+ if (--ACCESS_ONCE_RW(t->rcu_read_lock_nesting) == 0 &&
- unlikely(ACCESS_ONCE(t->rcu_read_unlock_special)))
- rcu_read_unlock_special(t);
- }
-diff -urNp linux-2.6.32.45/kernel/relay.c linux-2.6.32.45/kernel/relay.c
---- linux-2.6.32.45/kernel/relay.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/relay.c 2011-05-16 21:46:57.000000000 -0400
-@@ -1222,7 +1222,7 @@ static int subbuf_splice_actor(struct fi
- unsigned int flags,
- int *nonpad_ret)
- {
-- unsigned int pidx, poff, total_len, subbuf_pages, nr_pages, ret;
-+ unsigned int pidx, poff, total_len, subbuf_pages, nr_pages;
- struct rchan_buf *rbuf = in->private_data;
- unsigned int subbuf_size = rbuf->chan->subbuf_size;
- uint64_t pos = (uint64_t) *ppos;
-@@ -1241,6 +1241,9 @@ static int subbuf_splice_actor(struct fi
- .ops = &relay_pipe_buf_ops,
- .spd_release = relay_page_release,
- };
-+ ssize_t ret;
-+
-+ pax_track_stack();
-
- if (rbuf->subbufs_produced == rbuf->subbufs_consumed)
- return 0;
-diff -urNp linux-2.6.32.45/kernel/resource.c linux-2.6.32.45/kernel/resource.c
---- linux-2.6.32.45/kernel/resource.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/resource.c 2011-04-17 15:56:46.000000000 -0400
-@@ -132,8 +132,18 @@ static const struct file_operations proc
-
- static int __init ioresources_init(void)
- {
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+ proc_create("ioports", S_IRUSR, NULL, &proc_ioports_operations);
-+ proc_create("iomem", S_IRUSR, NULL, &proc_iomem_operations);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+ proc_create("ioports", S_IRUSR | S_IRGRP, NULL, &proc_ioports_operations);
-+ proc_create("iomem", S_IRUSR | S_IRGRP, NULL, &proc_iomem_operations);
-+#endif
-+#else
- proc_create("ioports", 0, NULL, &proc_ioports_operations);
- proc_create("iomem", 0, NULL, &proc_iomem_operations);
-+#endif
- return 0;
- }
- __initcall(ioresources_init);
-diff -urNp linux-2.6.32.45/kernel/rtmutex.c linux-2.6.32.45/kernel/rtmutex.c
---- linux-2.6.32.45/kernel/rtmutex.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/rtmutex.c 2011-04-17 15:56:46.000000000 -0400
-@@ -511,7 +511,7 @@ static void wakeup_next_waiter(struct rt
- */
- spin_lock_irqsave(&pendowner->pi_lock, flags);
-
-- WARN_ON(!pendowner->pi_blocked_on);
-+ BUG_ON(!pendowner->pi_blocked_on);
- WARN_ON(pendowner->pi_blocked_on != waiter);
- WARN_ON(pendowner->pi_blocked_on->lock != lock);
-
-diff -urNp linux-2.6.32.45/kernel/rtmutex-tester.c linux-2.6.32.45/kernel/rtmutex-tester.c
---- linux-2.6.32.45/kernel/rtmutex-tester.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/rtmutex-tester.c 2011-05-04 17:56:28.000000000 -0400
-@@ -21,7 +21,7 @@
- #define MAX_RT_TEST_MUTEXES 8
-
- static spinlock_t rttest_lock;
--static atomic_t rttest_event;
-+static atomic_unchecked_t rttest_event;
-
- struct test_thread_data {
- int opcode;
-@@ -64,7 +64,7 @@ static int handle_op(struct test_thread_
-
- case RTTEST_LOCKCONT:
- td->mutexes[td->opdata] = 1;
-- td->event = atomic_add_return(1, &rttest_event);
-+ td->event = atomic_add_return_unchecked(1, &rttest_event);
- return 0;
-
- case RTTEST_RESET:
-@@ -82,7 +82,7 @@ static int handle_op(struct test_thread_
- return 0;
-
- case RTTEST_RESETEVENT:
-- atomic_set(&rttest_event, 0);
-+ atomic_set_unchecked(&rttest_event, 0);
- return 0;
-
- default:
-@@ -99,9 +99,9 @@ static int handle_op(struct test_thread_
- return ret;
-
- td->mutexes[id] = 1;
-- td->event = atomic_add_return(1, &rttest_event);
-+ td->event = atomic_add_return_unchecked(1, &rttest_event);
- rt_mutex_lock(&mutexes[id]);
-- td->event = atomic_add_return(1, &rttest_event);
-+ td->event = atomic_add_return_unchecked(1, &rttest_event);
- td->mutexes[id] = 4;
- return 0;
-
-@@ -112,9 +112,9 @@ static int handle_op(struct test_thread_
- return ret;
-
- td->mutexes[id] = 1;
-- td->event = atomic_add_return(1, &rttest_event);
-+ td->event = atomic_add_return_unchecked(1, &rttest_event);
- ret = rt_mutex_lock_interruptible(&mutexes[id], 0);
-- td->event = atomic_add_return(1, &rttest_event);
-+ td->event = atomic_add_return_unchecked(1, &rttest_event);
- td->mutexes[id] = ret ? 0 : 4;
- return ret ? -EINTR : 0;
-
-@@ -123,9 +123,9 @@ static int handle_op(struct test_thread_
- if (id < 0 || id >= MAX_RT_TEST_MUTEXES || td->mutexes[id] != 4)
- return ret;
-
-- td->event = atomic_add_return(1, &rttest_event);
-+ td->event = atomic_add_return_unchecked(1, &rttest_event);
- rt_mutex_unlock(&mutexes[id]);
-- td->event = atomic_add_return(1, &rttest_event);
-+ td->event = atomic_add_return_unchecked(1, &rttest_event);
- td->mutexes[id] = 0;
- return 0;
-
-@@ -187,7 +187,7 @@ void schedule_rt_mutex_test(struct rt_mu
- break;
-
- td->mutexes[dat] = 2;
-- td->event = atomic_add_return(1, &rttest_event);
-+ td->event = atomic_add_return_unchecked(1, &rttest_event);
- break;
-
- case RTTEST_LOCKBKL:
-@@ -208,7 +208,7 @@ void schedule_rt_mutex_test(struct rt_mu
- return;
-
- td->mutexes[dat] = 3;
-- td->event = atomic_add_return(1, &rttest_event);
-+ td->event = atomic_add_return_unchecked(1, &rttest_event);
- break;
-
- case RTTEST_LOCKNOWAIT:
-@@ -220,7 +220,7 @@ void schedule_rt_mutex_test(struct rt_mu
- return;
-
- td->mutexes[dat] = 1;
-- td->event = atomic_add_return(1, &rttest_event);
-+ td->event = atomic_add_return_unchecked(1, &rttest_event);
- return;
-
- case RTTEST_LOCKBKL:
-diff -urNp linux-2.6.32.45/kernel/sched.c linux-2.6.32.45/kernel/sched.c
---- linux-2.6.32.45/kernel/sched.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/sched.c 2011-08-21 19:29:25.000000000 -0400
-@@ -2764,9 +2764,10 @@ void wake_up_new_task(struct task_struct
- {
- unsigned long flags;
- struct rq *rq;
-- int cpu = get_cpu();
-
- #ifdef CONFIG_SMP
-+ int cpu = get_cpu();
-+
- rq = task_rq_lock(p, &flags);
- p->state = TASK_WAKING;
-
-@@ -5043,7 +5044,7 @@ out:
- * In CONFIG_NO_HZ case, the idle load balance owner will do the
- * rebalancing for all the cpus for whom scheduler ticks are stopped.
- */
--static void run_rebalance_domains(struct softirq_action *h)
-+static void run_rebalance_domains(void)
- {
- int this_cpu = smp_processor_id();
- struct rq *this_rq = cpu_rq(this_cpu);
-@@ -5700,6 +5701,8 @@ asmlinkage void __sched schedule(void)
- struct rq *rq;
- int cpu;
-
-+ pax_track_stack();
-+
- need_resched:
- preempt_disable();
- cpu = smp_processor_id();
-@@ -5770,7 +5773,7 @@ EXPORT_SYMBOL(schedule);
- * Look out! "owner" is an entirely speculative pointer
- * access and not reliable.
- */
--int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner)
-+int mutex_spin_on_owner(struct mutex *lock, struct task_struct *owner)
- {
- unsigned int cpu;
- struct rq *rq;
-@@ -5784,10 +5787,10 @@ int mutex_spin_on_owner(struct mutex *lo
- * DEBUG_PAGEALLOC could have unmapped it if
- * the mutex owner just released it and exited.
- */
-- if (probe_kernel_address(&owner->cpu, cpu))
-+ if (probe_kernel_address(&task_thread_info(owner)->cpu, cpu))
- return 0;
- #else
-- cpu = owner->cpu;
-+ cpu = task_thread_info(owner)->cpu;
- #endif
-
- /*
-@@ -5816,7 +5819,7 @@ int mutex_spin_on_owner(struct mutex *lo
- /*
- * Is that owner really running on that cpu?
- */
-- if (task_thread_info(rq->curr) != owner || need_resched())
-+ if (rq->curr != owner || need_resched())
- return 0;
-
- cpu_relax();
-@@ -6359,6 +6362,8 @@ int can_nice(const struct task_struct *p
- /* convert nice value [19,-20] to rlimit style value [1,40] */
- int nice_rlim = 20 - nice;
-
-+ gr_learn_resource(p, RLIMIT_NICE, nice_rlim, 1);
-+
- return (nice_rlim <= p->signal->rlim[RLIMIT_NICE].rlim_cur ||
- capable(CAP_SYS_NICE));
- }
-@@ -6392,7 +6397,8 @@ SYSCALL_DEFINE1(nice, int, increment)
- if (nice > 19)
- nice = 19;
-
-- if (increment < 0 && !can_nice(current, nice))
-+ if (increment < 0 && (!can_nice(current, nice) ||
-+ gr_handle_chroot_nice()))
- return -EPERM;
-
- retval = security_task_setnice(current, nice);
-@@ -8774,7 +8780,7 @@ static void init_sched_groups_power(int
- long power;
- int weight;
-
-- WARN_ON(!sd || !sd->groups);
-+ BUG_ON(!sd || !sd->groups);
-
- if (cpu != group_first_cpu(sd->groups))
- return;
-diff -urNp linux-2.6.32.45/kernel/signal.c linux-2.6.32.45/kernel/signal.c
---- linux-2.6.32.45/kernel/signal.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.45/kernel/signal.c 2011-08-16 21:15:58.000000000 -0400
-@@ -41,12 +41,12 @@
-
- static struct kmem_cache *sigqueue_cachep;
-
--static void __user *sig_handler(struct task_struct *t, int sig)
-+static __sighandler_t sig_handler(struct task_struct *t, int sig)
- {
- return t->sighand->action[sig - 1].sa.sa_handler;
- }
-
--static int sig_handler_ignored(void __user *handler, int sig)
-+static int sig_handler_ignored(__sighandler_t handler, int sig)
- {
- /* Is it explicitly or implicitly ignored? */
- return handler == SIG_IGN ||
-@@ -56,7 +56,7 @@ static int sig_handler_ignored(void __us
- static int sig_task_ignored(struct task_struct *t, int sig,
- int from_ancestor_ns)
- {
-- void __user *handler;
-+ __sighandler_t handler;
-
- handler = sig_handler(t, sig);
-
-@@ -207,6 +207,9 @@ static struct sigqueue *__sigqueue_alloc
- */
- user = get_uid(__task_cred(t)->user);
- atomic_inc(&user->sigpending);
-+
-+ if (!override_rlimit)
-+ gr_learn_resource(t, RLIMIT_SIGPENDING, atomic_read(&user->sigpending), 1);
- if (override_rlimit ||
- atomic_read(&user->sigpending) <=
- t->signal->rlim[RLIMIT_SIGPENDING].rlim_cur)
-@@ -327,7 +330,7 @@ flush_signal_handlers(struct task_struct
-
- int unhandled_signal(struct task_struct *tsk, int sig)
- {
-- void __user *handler = tsk->sighand->action[sig-1].sa.sa_handler;
-+ __sighandler_t handler = tsk->sighand->action[sig-1].sa.sa_handler;
- if (is_global_init(tsk))
- return 1;
- if (handler != SIG_IGN && handler != SIG_DFL)
-@@ -627,6 +630,13 @@ static int check_kill_permission(int sig
- }
- }
-
-+ /* allow glibc communication via tgkill to other threads in our
-+ thread group */
-+ if ((info == SEND_SIG_NOINFO || info->si_code != SI_TKILL ||
-+ sig != (SIGRTMIN+1) || task_tgid_vnr(t) != info->si_pid)
-+ && gr_handle_signal(t, sig))
-+ return -EPERM;
-+
- return security_task_kill(t, info, sig, 0);
- }
-
-@@ -968,7 +978,7 @@ __group_send_sig_info(int sig, struct si
- return send_signal(sig, info, p, 1);
- }
-
--static int
-+int
- specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t)
- {
- return send_signal(sig, info, t, 0);
-@@ -1005,6 +1015,7 @@ force_sig_info(int sig, struct siginfo *
- unsigned long int flags;
- int ret, blocked, ignored;
- struct k_sigaction *action;
-+ int is_unhandled = 0;
-
- spin_lock_irqsave(&t->sighand->siglock, flags);
- action = &t->sighand->action[sig-1];
-@@ -1019,9 +1030,18 @@ force_sig_info(int sig, struct siginfo *
- }
- if (action->sa.sa_handler == SIG_DFL)
- t->signal->flags &= ~SIGNAL_UNKILLABLE;
-+ if (action->sa.sa_handler == SIG_IGN || action->sa.sa_handler == SIG_DFL)
-+ is_unhandled = 1;
- ret = specific_send_sig_info(sig, info, t);
- spin_unlock_irqrestore(&t->sighand->siglock, flags);
-
-+ /* only deal with unhandled signals, java etc trigger SIGSEGV during
-+ normal operation */
-+ if (is_unhandled) {
-+ gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, t);
-+ gr_handle_crash(t, sig);
-+ }
-+
- return ret;
- }
-
-@@ -1081,8 +1101,11 @@ int group_send_sig_info(int sig, struct
- {
- int ret = check_kill_permission(sig, info, p);
-
-- if (!ret && sig)
-+ if (!ret && sig) {
- ret = do_send_sig_info(sig, info, p, true);
-+ if (!ret)
-+ gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, p);
-+ }
-
- return ret;
- }
-@@ -1644,6 +1667,8 @@ void ptrace_notify(int exit_code)
- {
- siginfo_t info;
-
-+ pax_track_stack();
-+
- BUG_ON((exit_code & (0x7f | ~0xffff)) != SIGTRAP);
-
- memset(&info, 0, sizeof info);
-@@ -2275,7 +2300,15 @@ do_send_specific(pid_t tgid, pid_t pid,
- int error = -ESRCH;
-
- rcu_read_lock();
-- p = find_task_by_vpid(pid);
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
-+ /* allow glibc communication via tgkill to other threads in our
-+ thread group */
-+ if (grsec_enable_chroot_findtask && info->si_code == SI_TKILL &&
-+ sig == (SIGRTMIN+1) && tgid == info->si_pid)
-+ p = find_task_by_vpid_unrestricted(pid);
-+ else
-+#endif
-+ p = find_task_by_vpid(pid);
- if (p && (tgid <= 0 || task_tgid_vnr(p) == tgid)) {
- error = check_kill_permission(sig, info, p);
- /*
-diff -urNp linux-2.6.32.45/kernel/smp.c linux-2.6.32.45/kernel/smp.c
---- linux-2.6.32.45/kernel/smp.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/smp.c 2011-04-17 15:56:46.000000000 -0400
-@@ -522,22 +522,22 @@ int smp_call_function(void (*func)(void
- }
- EXPORT_SYMBOL(smp_call_function);
-
--void ipi_call_lock(void)
-+void ipi_call_lock(void) __acquires(call_function.lock)
- {
- spin_lock(&call_function.lock);
- }
-
--void ipi_call_unlock(void)
-+void ipi_call_unlock(void) __releases(call_function.lock)
- {
- spin_unlock(&call_function.lock);
- }
-
--void ipi_call_lock_irq(void)
-+void ipi_call_lock_irq(void) __acquires(call_function.lock)
- {
- spin_lock_irq(&call_function.lock);
- }
-
--void ipi_call_unlock_irq(void)
-+void ipi_call_unlock_irq(void) __releases(call_function.lock)
- {
- spin_unlock_irq(&call_function.lock);
- }
-diff -urNp linux-2.6.32.45/kernel/softirq.c linux-2.6.32.45/kernel/softirq.c
---- linux-2.6.32.45/kernel/softirq.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/softirq.c 2011-08-05 20:33:55.000000000 -0400
-@@ -56,7 +56,7 @@ static struct softirq_action softirq_vec
-
- static DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
-
--char *softirq_to_name[NR_SOFTIRQS] = {
-+const char * const softirq_to_name[NR_SOFTIRQS] = {
- "HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL",
- "TASKLET", "SCHED", "HRTIMER", "RCU"
- };
-@@ -206,7 +206,7 @@ EXPORT_SYMBOL(local_bh_enable_ip);
-
- asmlinkage void __do_softirq(void)
- {
-- struct softirq_action *h;
-+ const struct softirq_action *h;
- __u32 pending;
- int max_restart = MAX_SOFTIRQ_RESTART;
- int cpu;
-@@ -233,7 +233,7 @@ restart:
- kstat_incr_softirqs_this_cpu(h - softirq_vec);
-
- trace_softirq_entry(h, softirq_vec);
-- h->action(h);
-+ h->action();
- trace_softirq_exit(h, softirq_vec);
- if (unlikely(prev_count != preempt_count())) {
- printk(KERN_ERR "huh, entered softirq %td %s %p"
-@@ -363,9 +363,11 @@ void raise_softirq(unsigned int nr)
- local_irq_restore(flags);
- }
-
--void open_softirq(int nr, void (*action)(struct softirq_action *))
-+void open_softirq(int nr, void (*action)(void))
- {
-- softirq_vec[nr].action = action;
-+ pax_open_kernel();
-+ *(void **)&softirq_vec[nr].action = action;
-+ pax_close_kernel();
- }
-
- /*
-@@ -419,7 +421,7 @@ void __tasklet_hi_schedule_first(struct
-
- EXPORT_SYMBOL(__tasklet_hi_schedule_first);
-
--static void tasklet_action(struct softirq_action *a)
-+static void tasklet_action(void)
- {
- struct tasklet_struct *list;
-
-@@ -454,7 +456,7 @@ static void tasklet_action(struct softir
- }
- }
-
--static void tasklet_hi_action(struct softirq_action *a)
-+static void tasklet_hi_action(void)
- {
- struct tasklet_struct *list;
-
-diff -urNp linux-2.6.32.45/kernel/sys.c linux-2.6.32.45/kernel/sys.c
---- linux-2.6.32.45/kernel/sys.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/sys.c 2011-08-11 19:51:54.000000000 -0400
-@@ -133,6 +133,12 @@ static int set_one_prio(struct task_stru
- error = -EACCES;
- goto out;
- }
-+
-+ if (gr_handle_chroot_setpriority(p, niceval)) {
-+ error = -EACCES;
-+ goto out;
-+ }
-+
- no_nice = security_task_setnice(p, niceval);
- if (no_nice) {
- error = no_nice;
-@@ -190,10 +196,10 @@ SYSCALL_DEFINE3(setpriority, int, which,
- !(user = find_user(who)))
- goto out_unlock; /* No processes for this user */
-
-- do_each_thread(g, p)
-+ do_each_thread(g, p) {
- if (__task_cred(p)->uid == who)
- error = set_one_prio(p, niceval, error);
-- while_each_thread(g, p);
-+ } while_each_thread(g, p);
- if (who != cred->uid)
- free_uid(user); /* For find_user() */
- break;
-@@ -253,13 +259,13 @@ SYSCALL_DEFINE2(getpriority, int, which,
- !(user = find_user(who)))
- goto out_unlock; /* No processes for this user */
-
-- do_each_thread(g, p)
-+ do_each_thread(g, p) {
- if (__task_cred(p)->uid == who) {
- niceval = 20 - task_nice(p);
- if (niceval > retval)
- retval = niceval;
- }
-- while_each_thread(g, p);
-+ } while_each_thread(g, p);
- if (who != cred->uid)
- free_uid(user); /* for find_user() */
- break;
-@@ -509,6 +515,9 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, g
- goto error;
- }
-
-+ if (gr_check_group_change(new->gid, new->egid, -1))
-+ goto error;
-+
- if (rgid != (gid_t) -1 ||
- (egid != (gid_t) -1 && egid != old->gid))
- new->sgid = new->egid;
-@@ -542,6 +551,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
- goto error;
-
- retval = -EPERM;
-+
-+ if (gr_check_group_change(gid, gid, gid))
-+ goto error;
-+
- if (capable(CAP_SETGID))
- new->gid = new->egid = new->sgid = new->fsgid = gid;
- else if (gid == old->gid || gid == old->sgid)
-@@ -567,12 +580,19 @@ static int set_user(struct cred *new)
- if (!new_user)
- return -EAGAIN;
-
-+ /*
-+ * We don't fail in case of NPROC limit excess here because too many
-+ * poorly written programs don't check set*uid() return code, assuming
-+ * it never fails if called by root. We may still enforce NPROC limit
-+ * for programs doing set*uid()+execve() by harmlessly deferring the
-+ * failure to the execve() stage.
-+ */
- if (atomic_read(&new_user->processes) >=
- current->signal->rlim[RLIMIT_NPROC].rlim_cur &&
-- new_user != INIT_USER) {
-- free_uid(new_user);
-- return -EAGAIN;
-- }
-+ new_user != INIT_USER)
-+ current->flags |= PF_NPROC_EXCEEDED;
-+ else
-+ current->flags &= ~PF_NPROC_EXCEEDED;
-
- free_uid(new->user);
- new->user = new_user;
-@@ -627,6 +647,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, u
- goto error;
- }
-
-+ if (gr_check_user_change(new->uid, new->euid, -1))
-+ goto error;
-+
- if (new->uid != old->uid) {
- retval = set_user(new);
- if (retval < 0)
-@@ -675,6 +698,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
- goto error;
-
- retval = -EPERM;
-+
-+ if (gr_check_crash_uid(uid))
-+ goto error;
-+ if (gr_check_user_change(uid, uid, uid))
-+ goto error;
-+
- if (capable(CAP_SETUID)) {
- new->suid = new->uid = uid;
- if (uid != old->uid) {
-@@ -732,6 +761,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid,
- goto error;
- }
-
-+ if (gr_check_user_change(ruid, euid, -1))
-+ goto error;
-+
- if (ruid != (uid_t) -1) {
- new->uid = ruid;
- if (ruid != old->uid) {
-@@ -800,6 +832,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid,
- goto error;
- }
-
-+ if (gr_check_group_change(rgid, egid, -1))
-+ goto error;
-+
- if (rgid != (gid_t) -1)
- new->gid = rgid;
- if (egid != (gid_t) -1)
-@@ -849,6 +884,9 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
- if (security_task_setuid(uid, (uid_t)-1, (uid_t)-1, LSM_SETID_FS) < 0)
- goto error;
-
-+ if (gr_check_user_change(-1, -1, uid))
-+ goto error;
-+
- if (uid == old->uid || uid == old->euid ||
- uid == old->suid || uid == old->fsuid ||
- capable(CAP_SETUID)) {
-@@ -889,6 +927,9 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
- if (gid == old->gid || gid == old->egid ||
- gid == old->sgid || gid == old->fsgid ||
- capable(CAP_SETGID)) {
-+ if (gr_check_group_change(-1, -1, gid))
-+ goto error;
-+
- if (gid != old_fsgid) {
- new->fsgid = gid;
- goto change_okay;
-@@ -1454,7 +1495,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsi
- error = get_dumpable(me->mm);
- break;
- case PR_SET_DUMPABLE:
-- if (arg2 < 0 || arg2 > 1) {
-+ if (arg2 > 1) {
- error = -EINVAL;
- break;
- }
-diff -urNp linux-2.6.32.45/kernel/sysctl.c linux-2.6.32.45/kernel/sysctl.c
---- linux-2.6.32.45/kernel/sysctl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/sysctl.c 2011-04-17 15:56:46.000000000 -0400
-@@ -63,6 +63,13 @@
- static int deprecated_sysctl_warning(struct __sysctl_args *args);
-
- #if defined(CONFIG_SYSCTL)
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+extern __u32 gr_handle_sysctl(const ctl_table *table, const int op);
-+extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
-+ const int op);
-+extern int gr_handle_chroot_sysctl(const int op);
-
- /* External variables not in a header file. */
- extern int C_A_D;
-@@ -168,6 +175,7 @@ static int proc_do_cad_pid(struct ctl_ta
- static int proc_taint(struct ctl_table *table, int write,
- void __user *buffer, size_t *lenp, loff_t *ppos);
- #endif
-+extern ctl_table grsecurity_table[];
-
- static struct ctl_table root_table[];
- static struct ctl_table_root sysctl_table_root;
-@@ -200,6 +208,21 @@ extern struct ctl_table epoll_table[];
- int sysctl_legacy_va_layout;
- #endif
-
-+#ifdef CONFIG_PAX_SOFTMODE
-+static ctl_table pax_table[] = {
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "softmode",
-+ .data = &pax_softmode,
-+ .maxlen = sizeof(unsigned int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+
-+ { .ctl_name = 0 }
-+};
-+#endif
-+
- extern int prove_locking;
- extern int lock_stat;
-
-@@ -251,6 +274,24 @@ static int max_wakeup_granularity_ns = N
- #endif
-
- static struct ctl_table kern_table[] = {
-+#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "grsecurity",
-+ .mode = 0500,
-+ .child = grsecurity_table,
-+ },
-+#endif
-+
-+#ifdef CONFIG_PAX_SOFTMODE
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "pax",
-+ .mode = 0500,
-+ .child = pax_table,
-+ },
-+#endif
-+
- {
- .ctl_name = CTL_UNNUMBERED,
- .procname = "sched_child_runs_first",
-@@ -567,8 +608,8 @@ static struct ctl_table kern_table[] = {
- .data = &modprobe_path,
- .maxlen = KMOD_PATH_LEN,
- .mode = 0644,
-- .proc_handler = &proc_dostring,
-- .strategy = &sysctl_string,
-+ .proc_handler = &proc_dostring_modpriv,
-+ .strategy = &sysctl_string_modpriv,
- },
- {
- .ctl_name = CTL_UNNUMBERED,
-@@ -1247,6 +1288,13 @@ static struct ctl_table vm_table[] = {
- .mode = 0644,
- .proc_handler = &proc_dointvec
- },
-+ {
-+ .procname = "heap_stack_gap",
-+ .data = &sysctl_heap_stack_gap,
-+ .maxlen = sizeof(sysctl_heap_stack_gap),
-+ .mode = 0644,
-+ .proc_handler = proc_doulongvec_minmax,
-+ },
- #else
- {
- .ctl_name = CTL_UNNUMBERED,
-@@ -1803,6 +1851,8 @@ static int do_sysctl_strategy(struct ctl
- return 0;
- }
-
-+static int sysctl_perm_nochk(struct ctl_table_root *root, struct ctl_table *table, int op);
-+
- static int parse_table(int __user *name, int nlen,
- void __user *oldval, size_t __user *oldlenp,
- void __user *newval, size_t newlen,
-@@ -1821,7 +1871,7 @@ repeat:
- if (n == table->ctl_name) {
- int error;
- if (table->child) {
-- if (sysctl_perm(root, table, MAY_EXEC))
-+ if (sysctl_perm_nochk(root, table, MAY_EXEC))
- return -EPERM;
- name++;
- nlen--;
-@@ -1906,6 +1956,33 @@ int sysctl_perm(struct ctl_table_root *r
- int error;
- int mode;
-
-+ if (table->parent != NULL && table->parent->procname != NULL &&
-+ table->procname != NULL &&
-+ gr_handle_sysctl_mod(table->parent->procname, table->procname, op))
-+ return -EACCES;
-+ if (gr_handle_chroot_sysctl(op))
-+ return -EACCES;
-+ error = gr_handle_sysctl(table, op);
-+ if (error)
-+ return error;
-+
-+ error = security_sysctl(table, op & (MAY_READ | MAY_WRITE | MAY_EXEC));
-+ if (error)
-+ return error;
-+
-+ if (root->permissions)
-+ mode = root->permissions(root, current->nsproxy, table);
-+ else
-+ mode = table->mode;
-+
-+ return test_perm(mode, op);
-+}
-+
-+int sysctl_perm_nochk(struct ctl_table_root *root, struct ctl_table *table, int op)
-+{
-+ int error;
-+ int mode;
-+
- error = security_sysctl(table, op & (MAY_READ | MAY_WRITE | MAY_EXEC));
- if (error)
- return error;
-@@ -2335,6 +2412,16 @@ int proc_dostring(struct ctl_table *tabl
- buffer, lenp, ppos);
- }
-
-+int proc_dostring_modpriv(struct ctl_table *table, int write,
-+ void __user *buffer, size_t *lenp, loff_t *ppos)
-+{
-+ if (write && !capable(CAP_SYS_MODULE))
-+ return -EPERM;
-+
-+ return _proc_do_string(table->data, table->maxlen, write,
-+ buffer, lenp, ppos);
-+}
-+
-
- static int do_proc_dointvec_conv(int *negp, unsigned long *lvalp,
- int *valp,
-@@ -2609,7 +2696,7 @@ static int __do_proc_doulongvec_minmax(v
- vleft = table->maxlen / sizeof(unsigned long);
- left = *lenp;
-
-- for (; left && vleft--; i++, min++, max++, first=0) {
-+ for (; left && vleft--; i++, first=0) {
- if (write) {
- while (left) {
- char c;
-@@ -2910,6 +2997,12 @@ int proc_dostring(struct ctl_table *tabl
- return -ENOSYS;
- }
-
-+int proc_dostring_modpriv(struct ctl_table *table, int write,
-+ void __user *buffer, size_t *lenp, loff_t *ppos)
-+{
-+ return -ENOSYS;
-+}
-+
- int proc_dointvec(struct ctl_table *table, int write,
- void __user *buffer, size_t *lenp, loff_t *ppos)
- {
-@@ -3038,6 +3131,16 @@ int sysctl_string(struct ctl_table *tabl
- return 1;
- }
-
-+int sysctl_string_modpriv(struct ctl_table *table,
-+ void __user *oldval, size_t __user *oldlenp,
-+ void __user *newval, size_t newlen)
-+{
-+ if (newval && newlen && !capable(CAP_SYS_MODULE))
-+ return -EPERM;
-+
-+ return sysctl_string(table, oldval, oldlenp, newval, newlen);
-+}
-+
- /*
- * This function makes sure that all of the integers in the vector
- * are between the minimum and maximum values given in the arrays
-@@ -3182,6 +3285,13 @@ int sysctl_string(struct ctl_table *tabl
- return -ENOSYS;
- }
-
-+int sysctl_string_modpriv(struct ctl_table *table,
-+ void __user *oldval, size_t __user *oldlenp,
-+ void __user *newval, size_t newlen)
-+{
-+ return -ENOSYS;
-+}
-+
- int sysctl_intvec(struct ctl_table *table,
- void __user *oldval, size_t __user *oldlenp,
- void __user *newval, size_t newlen)
-@@ -3246,6 +3356,7 @@ EXPORT_SYMBOL(proc_dointvec_minmax);
- EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
- EXPORT_SYMBOL(proc_dointvec_ms_jiffies);
- EXPORT_SYMBOL(proc_dostring);
-+EXPORT_SYMBOL(proc_dostring_modpriv);
- EXPORT_SYMBOL(proc_doulongvec_minmax);
- EXPORT_SYMBOL(proc_doulongvec_ms_jiffies_minmax);
- EXPORT_SYMBOL(register_sysctl_table);
-@@ -3254,5 +3365,6 @@ EXPORT_SYMBOL(sysctl_intvec);
- EXPORT_SYMBOL(sysctl_jiffies);
- EXPORT_SYMBOL(sysctl_ms_jiffies);
- EXPORT_SYMBOL(sysctl_string);
-+EXPORT_SYMBOL(sysctl_string_modpriv);
- EXPORT_SYMBOL(sysctl_data);
- EXPORT_SYMBOL(unregister_sysctl_table);
-diff -urNp linux-2.6.32.45/kernel/sysctl_check.c linux-2.6.32.45/kernel/sysctl_check.c
---- linux-2.6.32.45/kernel/sysctl_check.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/sysctl_check.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1489,10 +1489,12 @@ int sysctl_check_table(struct nsproxy *n
- } else {
- if ((table->strategy == sysctl_data) ||
- (table->strategy == sysctl_string) ||
-+ (table->strategy == sysctl_string_modpriv) ||
- (table->strategy == sysctl_intvec) ||
- (table->strategy == sysctl_jiffies) ||
- (table->strategy == sysctl_ms_jiffies) ||
- (table->proc_handler == proc_dostring) ||
-+ (table->proc_handler == proc_dostring_modpriv) ||
- (table->proc_handler == proc_dointvec) ||
- (table->proc_handler == proc_dointvec_minmax) ||
- (table->proc_handler == proc_dointvec_jiffies) ||
-diff -urNp linux-2.6.32.45/kernel/taskstats.c linux-2.6.32.45/kernel/taskstats.c
---- linux-2.6.32.45/kernel/taskstats.c 2011-07-13 17:23:04.000000000 -0400
-+++ linux-2.6.32.45/kernel/taskstats.c 2011-07-13 17:23:19.000000000 -0400
-@@ -26,9 +26,12 @@
- #include <linux/cgroup.h>
- #include <linux/fs.h>
- #include <linux/file.h>
-+#include <linux/grsecurity.h>
- #include <net/genetlink.h>
- #include <asm/atomic.h>
-
-+extern int gr_is_taskstats_denied(int pid);
-+
- /*
- * Maximum length of a cpumask that can be specified in
- * the TASKSTATS_CMD_ATTR_REGISTER/DEREGISTER_CPUMASK attribute
-@@ -442,6 +445,9 @@ static int taskstats_user_cmd(struct sk_
- size_t size;
- cpumask_var_t mask;
-
-+ if (gr_is_taskstats_denied(current->pid))
-+ return -EACCES;
-+
- if (!alloc_cpumask_var(&mask, GFP_KERNEL))
- return -ENOMEM;
-
-diff -urNp linux-2.6.32.45/kernel/time/tick-broadcast.c linux-2.6.32.45/kernel/time/tick-broadcast.c
---- linux-2.6.32.45/kernel/time/tick-broadcast.c 2011-05-23 16:56:59.000000000 -0400
-+++ linux-2.6.32.45/kernel/time/tick-broadcast.c 2011-05-23 16:57:13.000000000 -0400
-@@ -116,7 +116,7 @@ int tick_device_uses_broadcast(struct cl
- * then clear the broadcast bit.
- */
- if (!(dev->features & CLOCK_EVT_FEAT_C3STOP)) {
-- int cpu = smp_processor_id();
-+ cpu = smp_processor_id();
-
- cpumask_clear_cpu(cpu, tick_get_broadcast_mask());
- tick_broadcast_clear_oneshot(cpu);
-diff -urNp linux-2.6.32.45/kernel/time/timekeeping.c linux-2.6.32.45/kernel/time/timekeeping.c
---- linux-2.6.32.45/kernel/time/timekeeping.c 2011-06-25 12:55:35.000000000 -0400
-+++ linux-2.6.32.45/kernel/time/timekeeping.c 2011-06-25 12:56:37.000000000 -0400
-@@ -14,6 +14,7 @@
- #include <linux/init.h>
- #include <linux/mm.h>
- #include <linux/sched.h>
-+#include <linux/grsecurity.h>
- #include <linux/sysdev.h>
- #include <linux/clocksource.h>
- #include <linux/jiffies.h>
-@@ -180,7 +181,7 @@ void update_xtime_cache(u64 nsec)
- */
- struct timespec ts = xtime;
- timespec_add_ns(&ts, nsec);
-- ACCESS_ONCE(xtime_cache) = ts;
-+ ACCESS_ONCE_RW(xtime_cache) = ts;
- }
-
- /* must hold xtime_lock */
-@@ -333,6 +334,8 @@ int do_settimeofday(struct timespec *tv)
- if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC)
- return -EINVAL;
-
-+ gr_log_timechange();
-+
- write_seqlock_irqsave(&xtime_lock, flags);
-
- timekeeping_forward_now();
-diff -urNp linux-2.6.32.45/kernel/time/timer_list.c linux-2.6.32.45/kernel/time/timer_list.c
---- linux-2.6.32.45/kernel/time/timer_list.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/time/timer_list.c 2011-04-17 15:56:46.000000000 -0400
-@@ -38,12 +38,16 @@ DECLARE_PER_CPU(struct hrtimer_cpu_base,
-
- static void print_name_offset(struct seq_file *m, void *sym)
- {
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ SEQ_printf(m, "<%p>", NULL);
-+#else
- char symname[KSYM_NAME_LEN];
-
- if (lookup_symbol_name((unsigned long)sym, symname) < 0)
- SEQ_printf(m, "<%p>", sym);
- else
- SEQ_printf(m, "%s", symname);
-+#endif
- }
-
- static void
-@@ -112,7 +116,11 @@ next_one:
- static void
- print_base(struct seq_file *m, struct hrtimer_clock_base *base, u64 now)
- {
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ SEQ_printf(m, " .base: %p\n", NULL);
-+#else
- SEQ_printf(m, " .base: %p\n", base);
-+#endif
- SEQ_printf(m, " .index: %d\n",
- base->index);
- SEQ_printf(m, " .resolution: %Lu nsecs\n",
-@@ -289,7 +297,11 @@ static int __init init_timer_list_procfs
- {
- struct proc_dir_entry *pe;
-
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+ pe = proc_create("timer_list", 0400, NULL, &timer_list_fops);
-+#else
- pe = proc_create("timer_list", 0444, NULL, &timer_list_fops);
-+#endif
- if (!pe)
- return -ENOMEM;
- return 0;
-diff -urNp linux-2.6.32.45/kernel/time/timer_stats.c linux-2.6.32.45/kernel/time/timer_stats.c
---- linux-2.6.32.45/kernel/time/timer_stats.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/time/timer_stats.c 2011-05-04 17:56:28.000000000 -0400
-@@ -116,7 +116,7 @@ static ktime_t time_start, time_stop;
- static unsigned long nr_entries;
- static struct entry entries[MAX_ENTRIES];
-
--static atomic_t overflow_count;
-+static atomic_unchecked_t overflow_count;
-
- /*
- * The entries are in a hash-table, for fast lookup:
-@@ -140,7 +140,7 @@ static void reset_entries(void)
- nr_entries = 0;
- memset(entries, 0, sizeof(entries));
- memset(tstat_hash_table, 0, sizeof(tstat_hash_table));
-- atomic_set(&overflow_count, 0);
-+ atomic_set_unchecked(&overflow_count, 0);
- }
-
- static struct entry *alloc_entry(void)
-@@ -261,7 +261,7 @@ void timer_stats_update_stats(void *time
- if (likely(entry))
- entry->count++;
- else
-- atomic_inc(&overflow_count);
-+ atomic_inc_unchecked(&overflow_count);
-
- out_unlock:
- spin_unlock_irqrestore(lock, flags);
-@@ -269,12 +269,16 @@ void timer_stats_update_stats(void *time
-
- static void print_name_offset(struct seq_file *m, unsigned long addr)
- {
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ seq_printf(m, "<%p>", NULL);
-+#else
- char symname[KSYM_NAME_LEN];
-
- if (lookup_symbol_name(addr, symname) < 0)
- seq_printf(m, "<%p>", (void *)addr);
- else
- seq_printf(m, "%s", symname);
-+#endif
- }
-
- static int tstats_show(struct seq_file *m, void *v)
-@@ -300,9 +304,9 @@ static int tstats_show(struct seq_file *
-
- seq_puts(m, "Timer Stats Version: v0.2\n");
- seq_printf(m, "Sample period: %ld.%03ld s\n", period.tv_sec, ms);
-- if (atomic_read(&overflow_count))
-+ if (atomic_read_unchecked(&overflow_count))
- seq_printf(m, "Overflow: %d entries\n",
-- atomic_read(&overflow_count));
-+ atomic_read_unchecked(&overflow_count));
-
- for (i = 0; i < nr_entries; i++) {
- entry = entries + i;
-@@ -415,7 +419,11 @@ static int __init init_tstats_procfs(voi
- {
- struct proc_dir_entry *pe;
-
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+ pe = proc_create("timer_stats", 0600, NULL, &tstats_fops);
-+#else
- pe = proc_create("timer_stats", 0644, NULL, &tstats_fops);
-+#endif
- if (!pe)
- return -ENOMEM;
- return 0;
-diff -urNp linux-2.6.32.45/kernel/time.c linux-2.6.32.45/kernel/time.c
---- linux-2.6.32.45/kernel/time.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/time.c 2011-04-17 15:56:46.000000000 -0400
-@@ -165,6 +165,11 @@ int do_sys_settimeofday(struct timespec
- return error;
-
- if (tz) {
-+ /* we log in do_settimeofday called below, so don't log twice
-+ */
-+ if (!tv)
-+ gr_log_timechange();
-+
- /* SMP safe, global irq locking makes it work. */
- sys_tz = *tz;
- update_vsyscall_tz();
-@@ -240,7 +245,7 @@ EXPORT_SYMBOL(current_fs_time);
- * Avoid unnecessary multiplications/divisions in the
- * two most common HZ cases:
- */
--unsigned int inline jiffies_to_msecs(const unsigned long j)
-+inline unsigned int jiffies_to_msecs(const unsigned long j)
- {
- #if HZ <= MSEC_PER_SEC && !(MSEC_PER_SEC % HZ)
- return (MSEC_PER_SEC / HZ) * j;
-@@ -256,7 +261,7 @@ unsigned int inline jiffies_to_msecs(con
- }
- EXPORT_SYMBOL(jiffies_to_msecs);
-
--unsigned int inline jiffies_to_usecs(const unsigned long j)
-+inline unsigned int jiffies_to_usecs(const unsigned long j)
- {
- #if HZ <= USEC_PER_SEC && !(USEC_PER_SEC % HZ)
- return (USEC_PER_SEC / HZ) * j;
-diff -urNp linux-2.6.32.45/kernel/timer.c linux-2.6.32.45/kernel/timer.c
---- linux-2.6.32.45/kernel/timer.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/timer.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1213,7 +1213,7 @@ void update_process_times(int user_tick)
- /*
- * This function runs timers and the timer-tq in bottom half context.
- */
--static void run_timer_softirq(struct softirq_action *h)
-+static void run_timer_softirq(void)
- {
- struct tvec_base *base = __get_cpu_var(tvec_bases);
-
-diff -urNp linux-2.6.32.45/kernel/trace/blktrace.c linux-2.6.32.45/kernel/trace/blktrace.c
---- linux-2.6.32.45/kernel/trace/blktrace.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/trace/blktrace.c 2011-05-04 17:56:28.000000000 -0400
-@@ -313,7 +313,7 @@ static ssize_t blk_dropped_read(struct f
- struct blk_trace *bt = filp->private_data;
- char buf[16];
-
-- snprintf(buf, sizeof(buf), "%u\n", atomic_read(&bt->dropped));
-+ snprintf(buf, sizeof(buf), "%u\n", atomic_read_unchecked(&bt->dropped));
-
- return simple_read_from_buffer(buffer, count, ppos, buf, strlen(buf));
- }
-@@ -376,7 +376,7 @@ static int blk_subbuf_start_callback(str
- return 1;
-
- bt = buf->chan->private_data;
-- atomic_inc(&bt->dropped);
-+ atomic_inc_unchecked(&bt->dropped);
- return 0;
- }
-
-@@ -477,7 +477,7 @@ int do_blk_trace_setup(struct request_qu
-
- bt->dir = dir;
- bt->dev = dev;
-- atomic_set(&bt->dropped, 0);
-+ atomic_set_unchecked(&bt->dropped, 0);
-
- ret = -EIO;
- bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt,
-diff -urNp linux-2.6.32.45/kernel/trace/ftrace.c linux-2.6.32.45/kernel/trace/ftrace.c
---- linux-2.6.32.45/kernel/trace/ftrace.c 2011-06-25 12:55:35.000000000 -0400
-+++ linux-2.6.32.45/kernel/trace/ftrace.c 2011-06-25 12:56:37.000000000 -0400
-@@ -1100,13 +1100,18 @@ ftrace_code_disable(struct module *mod,
-
- ip = rec->ip;
-
-+ ret = ftrace_arch_code_modify_prepare();
-+ FTRACE_WARN_ON(ret);
-+ if (ret)
-+ return 0;
-+
- ret = ftrace_make_nop(mod, rec, MCOUNT_ADDR);
-+ FTRACE_WARN_ON(ftrace_arch_code_modify_post_process());
- if (ret) {
- ftrace_bug(ret, ip);
- rec->flags |= FTRACE_FL_FAILED;
-- return 0;
- }
-- return 1;
-+ return ret ? 0 : 1;
- }
-
- /*
-diff -urNp linux-2.6.32.45/kernel/trace/ring_buffer.c linux-2.6.32.45/kernel/trace/ring_buffer.c
---- linux-2.6.32.45/kernel/trace/ring_buffer.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/trace/ring_buffer.c 2011-04-17 15:56:46.000000000 -0400
-@@ -606,7 +606,7 @@ static struct list_head *rb_list_head(st
- * the reader page). But if the next page is a header page,
- * its flags will be non zero.
- */
--static int inline
-+static inline int
- rb_is_head_page(struct ring_buffer_per_cpu *cpu_buffer,
- struct buffer_page *page, struct list_head *list)
- {
-diff -urNp linux-2.6.32.45/kernel/trace/trace.c linux-2.6.32.45/kernel/trace/trace.c
---- linux-2.6.32.45/kernel/trace/trace.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/trace/trace.c 2011-05-16 21:46:57.000000000 -0400
-@@ -3193,6 +3193,8 @@ static ssize_t tracing_splice_read_pipe(
- size_t rem;
- unsigned int i;
-
-+ pax_track_stack();
-+
- /* copy the tracer to avoid using a global lock all around */
- mutex_lock(&trace_types_lock);
- if (unlikely(old_tracer != current_trace && current_trace)) {
-@@ -3659,6 +3661,8 @@ tracing_buffers_splice_read(struct file
- int entries, size, i;
- size_t ret;
-
-+ pax_track_stack();
-+
- if (*ppos & (PAGE_SIZE - 1)) {
- WARN_ONCE(1, "Ftrace: previous read must page-align\n");
- return -EINVAL;
-@@ -3816,10 +3820,9 @@ static const struct file_operations trac
- };
- #endif
-
--static struct dentry *d_tracer;
--
- struct dentry *tracing_init_dentry(void)
- {
-+ static struct dentry *d_tracer;
- static int once;
-
- if (d_tracer)
-@@ -3839,10 +3842,9 @@ struct dentry *tracing_init_dentry(void)
- return d_tracer;
- }
-
--static struct dentry *d_percpu;
--
- struct dentry *tracing_dentry_percpu(void)
- {
-+ static struct dentry *d_percpu;
- static int once;
- struct dentry *d_tracer;
-
-diff -urNp linux-2.6.32.45/kernel/trace/trace_events.c linux-2.6.32.45/kernel/trace/trace_events.c
---- linux-2.6.32.45/kernel/trace/trace_events.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/trace/trace_events.c 2011-08-05 20:33:55.000000000 -0400
-@@ -951,13 +951,10 @@ static LIST_HEAD(ftrace_module_file_list
- * Modules must own their file_operations to keep up with
- * reference counting.
- */
-+
- struct ftrace_module_file_ops {
- struct list_head list;
- struct module *mod;
-- struct file_operations id;
-- struct file_operations enable;
-- struct file_operations format;
-- struct file_operations filter;
- };
-
- static void remove_subsystem_dir(const char *name)
-@@ -1004,17 +1001,12 @@ trace_create_file_ops(struct module *mod
-
- file_ops->mod = mod;
-
-- file_ops->id = ftrace_event_id_fops;
-- file_ops->id.owner = mod;
--
-- file_ops->enable = ftrace_enable_fops;
-- file_ops->enable.owner = mod;
--
-- file_ops->filter = ftrace_event_filter_fops;
-- file_ops->filter.owner = mod;
--
-- file_ops->format = ftrace_event_format_fops;
-- file_ops->format.owner = mod;
-+ pax_open_kernel();
-+ *(void **)&mod->trace_id.owner = mod;
-+ *(void **)&mod->trace_enable.owner = mod;
-+ *(void **)&mod->trace_filter.owner = mod;
-+ *(void **)&mod->trace_format.owner = mod;
-+ pax_close_kernel();
-
- list_add(&file_ops->list, &ftrace_module_file_list);
-
-@@ -1063,8 +1055,8 @@ static void trace_module_add_events(stru
- call->mod = mod;
- list_add(&call->list, &ftrace_events);
- event_create_dir(call, d_events,
-- &file_ops->id, &file_ops->enable,
-- &file_ops->filter, &file_ops->format);
-+ &mod->trace_id, &mod->trace_enable,
-+ &mod->trace_filter, &mod->trace_format);
- }
- }
-
-diff -urNp linux-2.6.32.45/kernel/trace/trace_mmiotrace.c linux-2.6.32.45/kernel/trace/trace_mmiotrace.c
---- linux-2.6.32.45/kernel/trace/trace_mmiotrace.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/trace/trace_mmiotrace.c 2011-05-04 17:56:28.000000000 -0400
-@@ -23,7 +23,7 @@ struct header_iter {
- static struct trace_array *mmio_trace_array;
- static bool overrun_detected;
- static unsigned long prev_overruns;
--static atomic_t dropped_count;
-+static atomic_unchecked_t dropped_count;
-
- static void mmio_reset_data(struct trace_array *tr)
- {
-@@ -126,7 +126,7 @@ static void mmio_close(struct trace_iter
-
- static unsigned long count_overruns(struct trace_iterator *iter)
- {
-- unsigned long cnt = atomic_xchg(&dropped_count, 0);
-+ unsigned long cnt = atomic_xchg_unchecked(&dropped_count, 0);
- unsigned long over = ring_buffer_overruns(iter->tr->buffer);
-
- if (over > prev_overruns)
-@@ -316,7 +316,7 @@ static void __trace_mmiotrace_rw(struct
- event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_RW,
- sizeof(*entry), 0, pc);
- if (!event) {
-- atomic_inc(&dropped_count);
-+ atomic_inc_unchecked(&dropped_count);
- return;
- }
- entry = ring_buffer_event_data(event);
-@@ -346,7 +346,7 @@ static void __trace_mmiotrace_map(struct
- event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_MAP,
- sizeof(*entry), 0, pc);
- if (!event) {
-- atomic_inc(&dropped_count);
-+ atomic_inc_unchecked(&dropped_count);
- return;
- }
- entry = ring_buffer_event_data(event);
-diff -urNp linux-2.6.32.45/kernel/trace/trace_output.c linux-2.6.32.45/kernel/trace/trace_output.c
---- linux-2.6.32.45/kernel/trace/trace_output.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/trace/trace_output.c 2011-04-17 15:56:46.000000000 -0400
-@@ -237,7 +237,7 @@ int trace_seq_path(struct trace_seq *s,
- return 0;
- p = d_path(path, s->buffer + s->len, PAGE_SIZE - s->len);
- if (!IS_ERR(p)) {
-- p = mangle_path(s->buffer + s->len, p, "\n");
-+ p = mangle_path(s->buffer + s->len, p, "\n\\");
- if (p) {
- s->len = p - s->buffer;
- return 1;
-diff -urNp linux-2.6.32.45/kernel/trace/trace_stack.c linux-2.6.32.45/kernel/trace/trace_stack.c
---- linux-2.6.32.45/kernel/trace/trace_stack.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/trace/trace_stack.c 2011-04-17 15:56:46.000000000 -0400
-@@ -50,7 +50,7 @@ static inline void check_stack(void)
- return;
-
- /* we do not handle interrupt stacks yet */
-- if (!object_is_on_stack(&this_size))
-+ if (!object_starts_on_stack(&this_size))
- return;
-
- local_irq_save(flags);
-diff -urNp linux-2.6.32.45/kernel/trace/trace_workqueue.c linux-2.6.32.45/kernel/trace/trace_workqueue.c
---- linux-2.6.32.45/kernel/trace/trace_workqueue.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/trace/trace_workqueue.c 2011-04-17 15:56:46.000000000 -0400
-@@ -21,7 +21,7 @@ struct cpu_workqueue_stats {
- int cpu;
- pid_t pid;
- /* Can be inserted from interrupt or user context, need to be atomic */
-- atomic_t inserted;
-+ atomic_unchecked_t inserted;
- /*
- * Don't need to be atomic, works are serialized in a single workqueue thread
- * on a single CPU.
-@@ -58,7 +58,7 @@ probe_workqueue_insertion(struct task_st
- spin_lock_irqsave(&workqueue_cpu_stat(cpu)->lock, flags);
- list_for_each_entry(node, &workqueue_cpu_stat(cpu)->list, list) {
- if (node->pid == wq_thread->pid) {
-- atomic_inc(&node->inserted);
-+ atomic_inc_unchecked(&node->inserted);
- goto found;
- }
- }
-@@ -205,7 +205,7 @@ static int workqueue_stat_show(struct se
- tsk = get_pid_task(pid, PIDTYPE_PID);
- if (tsk) {
- seq_printf(s, "%3d %6d %6u %s\n", cws->cpu,
-- atomic_read(&cws->inserted), cws->executed,
-+ atomic_read_unchecked(&cws->inserted), cws->executed,
- tsk->comm);
- put_task_struct(tsk);
- }
-diff -urNp linux-2.6.32.45/kernel/user.c linux-2.6.32.45/kernel/user.c
---- linux-2.6.32.45/kernel/user.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/kernel/user.c 2011-04-17 15:56:46.000000000 -0400
-@@ -159,6 +159,7 @@ struct user_struct *alloc_uid(struct use
- spin_lock_irq(&uidhash_lock);
- up = uid_hash_find(uid, hashent);
- if (up) {
-+ put_user_ns(ns);
- key_put(new->uid_keyring);
- key_put(new->session_keyring);
- kmem_cache_free(uid_cachep, new);
-diff -urNp linux-2.6.32.45/lib/bug.c linux-2.6.32.45/lib/bug.c
---- linux-2.6.32.45/lib/bug.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/lib/bug.c 2011-04-17 15:56:46.000000000 -0400
-@@ -135,6 +135,8 @@ enum bug_trap_type report_bug(unsigned l
- return BUG_TRAP_TYPE_NONE;
-
- bug = find_bug(bugaddr);
-+ if (!bug)
-+ return BUG_TRAP_TYPE_NONE;
-
- printk(KERN_EMERG "------------[ cut here ]------------\n");
-
-diff -urNp linux-2.6.32.45/lib/debugobjects.c linux-2.6.32.45/lib/debugobjects.c
---- linux-2.6.32.45/lib/debugobjects.c 2011-07-13 17:23:04.000000000 -0400
-+++ linux-2.6.32.45/lib/debugobjects.c 2011-07-13 17:23:19.000000000 -0400
-@@ -277,7 +277,7 @@ static void debug_object_is_on_stack(voi
- if (limit > 4)
- return;
-
-- is_on_stack = object_is_on_stack(addr);
-+ is_on_stack = object_starts_on_stack(addr);
- if (is_on_stack == onstack)
- return;
-
-diff -urNp linux-2.6.32.45/lib/dma-debug.c linux-2.6.32.45/lib/dma-debug.c
---- linux-2.6.32.45/lib/dma-debug.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/lib/dma-debug.c 2011-04-17 15:56:46.000000000 -0400
-@@ -861,7 +861,7 @@ out:
-
- static void check_for_stack(struct device *dev, void *addr)
- {
-- if (object_is_on_stack(addr))
-+ if (object_starts_on_stack(addr))
- err_printk(dev, NULL, "DMA-API: device driver maps memory from"
- "stack [addr=%p]\n", addr);
- }
-diff -urNp linux-2.6.32.45/lib/idr.c linux-2.6.32.45/lib/idr.c
---- linux-2.6.32.45/lib/idr.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/lib/idr.c 2011-04-17 15:56:46.000000000 -0400
-@@ -156,7 +156,7 @@ static int sub_alloc(struct idr *idp, in
- id = (id | ((1 << (IDR_BITS * l)) - 1)) + 1;
-
- /* if already at the top layer, we need to grow */
-- if (id >= 1 << (idp->layers * IDR_BITS)) {
-+ if (id >= (1 << (idp->layers * IDR_BITS))) {
- *starting_id = id;
- return IDR_NEED_TO_GROW;
- }
-diff -urNp linux-2.6.32.45/lib/inflate.c linux-2.6.32.45/lib/inflate.c
---- linux-2.6.32.45/lib/inflate.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/lib/inflate.c 2011-04-17 15:56:46.000000000 -0400
-@@ -266,7 +266,7 @@ static void free(void *where)
- malloc_ptr = free_mem_ptr;
- }
- #else
--#define malloc(a) kmalloc(a, GFP_KERNEL)
-+#define malloc(a) kmalloc((a), GFP_KERNEL)
- #define free(a) kfree(a)
- #endif
-
-diff -urNp linux-2.6.32.45/lib/Kconfig.debug linux-2.6.32.45/lib/Kconfig.debug
---- linux-2.6.32.45/lib/Kconfig.debug 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/lib/Kconfig.debug 2011-04-17 15:56:46.000000000 -0400
-@@ -905,7 +905,7 @@ config LATENCYTOP
- select STACKTRACE
- select SCHEDSTATS
- select SCHED_DEBUG
-- depends on HAVE_LATENCYTOP_SUPPORT
-+ depends on HAVE_LATENCYTOP_SUPPORT && !GRKERNSEC_HIDESYM
- help
- Enable this option if you want to use the LatencyTOP tool
- to find out which userspace is blocking on what kernel operations.
-diff -urNp linux-2.6.32.45/lib/kobject.c linux-2.6.32.45/lib/kobject.c
---- linux-2.6.32.45/lib/kobject.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/lib/kobject.c 2011-04-17 15:56:46.000000000 -0400
-@@ -700,7 +700,7 @@ static ssize_t kobj_attr_store(struct ko
- return ret;
- }
-
--struct sysfs_ops kobj_sysfs_ops = {
-+const struct sysfs_ops kobj_sysfs_ops = {
- .show = kobj_attr_show,
- .store = kobj_attr_store,
- };
-@@ -789,7 +789,7 @@ static struct kobj_type kset_ktype = {
- * If the kset was not able to be created, NULL will be returned.
- */
- static struct kset *kset_create(const char *name,
-- struct kset_uevent_ops *uevent_ops,
-+ const struct kset_uevent_ops *uevent_ops,
- struct kobject *parent_kobj)
- {
- struct kset *kset;
-@@ -832,7 +832,7 @@ static struct kset *kset_create(const ch
- * If the kset was not able to be created, NULL will be returned.
- */
- struct kset *kset_create_and_add(const char *name,
-- struct kset_uevent_ops *uevent_ops,
-+ const struct kset_uevent_ops *uevent_ops,
- struct kobject *parent_kobj)
- {
- struct kset *kset;
-diff -urNp linux-2.6.32.45/lib/kobject_uevent.c linux-2.6.32.45/lib/kobject_uevent.c
---- linux-2.6.32.45/lib/kobject_uevent.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/lib/kobject_uevent.c 2011-04-17 15:56:46.000000000 -0400
-@@ -95,7 +95,7 @@ int kobject_uevent_env(struct kobject *k
- const char *subsystem;
- struct kobject *top_kobj;
- struct kset *kset;
-- struct kset_uevent_ops *uevent_ops;
-+ const struct kset_uevent_ops *uevent_ops;
- u64 seq;
- int i = 0;
- int retval = 0;
-diff -urNp linux-2.6.32.45/lib/kref.c linux-2.6.32.45/lib/kref.c
---- linux-2.6.32.45/lib/kref.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/lib/kref.c 2011-04-17 15:56:46.000000000 -0400
-@@ -61,7 +61,7 @@ void kref_get(struct kref *kref)
- */
- int kref_put(struct kref *kref, void (*release)(struct kref *kref))
- {
-- WARN_ON(release == NULL);
-+ BUG_ON(release == NULL);
- WARN_ON(release == (void (*)(struct kref *))kfree);
-
- if (atomic_dec_and_test(&kref->refcount)) {
-diff -urNp linux-2.6.32.45/lib/parser.c linux-2.6.32.45/lib/parser.c
---- linux-2.6.32.45/lib/parser.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/lib/parser.c 2011-04-17 15:56:46.000000000 -0400
-@@ -126,7 +126,7 @@ static int match_number(substring_t *s,
- char *buf;
- int ret;
-
-- buf = kmalloc(s->to - s->from + 1, GFP_KERNEL);
-+ buf = kmalloc((s->to - s->from) + 1, GFP_KERNEL);
- if (!buf)
- return -ENOMEM;
- memcpy(buf, s->from, s->to - s->from);
-diff -urNp linux-2.6.32.45/lib/radix-tree.c linux-2.6.32.45/lib/radix-tree.c
---- linux-2.6.32.45/lib/radix-tree.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/lib/radix-tree.c 2011-04-17 15:56:46.000000000 -0400
-@@ -81,7 +81,7 @@ struct radix_tree_preload {
- int nr;
- struct radix_tree_node *nodes[RADIX_TREE_MAX_PATH];
- };
--static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads) = { 0, };
-+static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads);
-
- static inline gfp_t root_gfp_mask(struct radix_tree_root *root)
- {
-diff -urNp linux-2.6.32.45/lib/random32.c linux-2.6.32.45/lib/random32.c
---- linux-2.6.32.45/lib/random32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/lib/random32.c 2011-04-17 15:56:46.000000000 -0400
-@@ -61,7 +61,7 @@ static u32 __random32(struct rnd_state *
- */
- static inline u32 __seed(u32 x, u32 m)
- {
-- return (x < m) ? x + m : x;
-+ return (x <= m) ? x + m + 1 : x;
- }
-
- /**
-diff -urNp linux-2.6.32.45/lib/vsprintf.c linux-2.6.32.45/lib/vsprintf.c
---- linux-2.6.32.45/lib/vsprintf.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/lib/vsprintf.c 2011-04-17 15:56:46.000000000 -0400
-@@ -16,6 +16,9 @@
- * - scnprintf and vscnprintf
- */
-
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+#define __INCLUDED_BY_HIDESYM 1
-+#endif
- #include <stdarg.h>
- #include <linux/module.h>
- #include <linux/types.h>
-@@ -546,12 +549,12 @@ static char *number(char *buf, char *end
- return buf;
- }
-
--static char *string(char *buf, char *end, char *s, struct printf_spec spec)
-+static char *string(char *buf, char *end, const char *s, struct printf_spec spec)
- {
- int len, i;
-
- if ((unsigned long)s < PAGE_SIZE)
-- s = "<NULL>";
-+ s = "(null)";
-
- len = strnlen(s, spec.precision);
-
-@@ -581,7 +584,7 @@ static char *symbol_string(char *buf, ch
- unsigned long value = (unsigned long) ptr;
- #ifdef CONFIG_KALLSYMS
- char sym[KSYM_SYMBOL_LEN];
-- if (ext != 'f' && ext != 's')
-+ if (ext != 'f' && ext != 's' && ext != 'a')
- sprint_symbol(sym, value);
- else
- kallsyms_lookup(value, NULL, NULL, NULL, sym);
-@@ -801,6 +804,8 @@ static char *ip4_addr_string(char *buf,
- * - 'f' For simple symbolic function names without offset
- * - 'S' For symbolic direct pointers with offset
- * - 's' For symbolic direct pointers without offset
-+ * - 'A' For symbolic direct pointers with offset approved for use with GRKERNSEC_HIDESYM
-+ * - 'a' For symbolic direct pointers without offset approved for use with GRKERNSEC_HIDESYM
- * - 'R' For a struct resource pointer, it prints the range of
- * addresses (not the name nor the flags)
- * - 'M' For a 6-byte MAC address, it prints the address in the
-@@ -822,7 +827,7 @@ static char *pointer(const char *fmt, ch
- struct printf_spec spec)
- {
- if (!ptr)
-- return string(buf, end, "(null)", spec);
-+ return string(buf, end, "(nil)", spec);
-
- switch (*fmt) {
- case 'F':
-@@ -831,6 +836,14 @@ static char *pointer(const char *fmt, ch
- case 's':
- /* Fallthrough */
- case 'S':
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ break;
-+#else
-+ return symbol_string(buf, end, ptr, spec, *fmt);
-+#endif
-+ case 'a':
-+ /* Fallthrough */
-+ case 'A':
- return symbol_string(buf, end, ptr, spec, *fmt);
- case 'R':
- return resource_string(buf, end, ptr, spec);
-@@ -1445,7 +1458,7 @@ do { \
- size_t len;
- if ((unsigned long)save_str > (unsigned long)-PAGE_SIZE
- || (unsigned long)save_str < PAGE_SIZE)
-- save_str = "<NULL>";
-+ save_str = "(null)";
- len = strlen(save_str);
- if (str + len + 1 < end)
- memcpy(str, save_str, len + 1);
-@@ -1555,11 +1568,11 @@ int bstr_printf(char *buf, size_t size,
- typeof(type) value; \
- if (sizeof(type) == 8) { \
- args = PTR_ALIGN(args, sizeof(u32)); \
-- *(u32 *)&value = *(u32 *)args; \
-- *((u32 *)&value + 1) = *(u32 *)(args + 4); \
-+ *(u32 *)&value = *(const u32 *)args; \
-+ *((u32 *)&value + 1) = *(const u32 *)(args + 4); \
- } else { \
- args = PTR_ALIGN(args, sizeof(type)); \
-- value = *(typeof(type) *)args; \
-+ value = *(const typeof(type) *)args; \
- } \
- args += sizeof(type); \
- value; \
-@@ -1622,7 +1635,7 @@ int bstr_printf(char *buf, size_t size,
- const char *str_arg = args;
- size_t len = strlen(str_arg);
- args += len + 1;
-- str = string(str, end, (char *)str_arg, spec);
-+ str = string(str, end, str_arg, spec);
- break;
- }
-
-diff -urNp linux-2.6.32.45/localversion-grsec linux-2.6.32.45/localversion-grsec
---- linux-2.6.32.45/localversion-grsec 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/localversion-grsec 2011-04-17 15:56:46.000000000 -0400
-@@ -0,0 +1 @@
-+-grsec
-diff -urNp linux-2.6.32.45/Makefile linux-2.6.32.45/Makefile
---- linux-2.6.32.45/Makefile 2011-08-16 20:37:25.000000000 -0400
-+++ linux-2.6.32.45/Makefile 2011-08-21 19:35:55.000000000 -0400
-@@ -221,8 +221,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH"
-
- HOSTCC = gcc
- HOSTCXX = g++
--HOSTCFLAGS = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
--HOSTCXXFLAGS = -O2
-+HOSTCFLAGS = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -Wno-unused-parameter -Wno-missing-field-initializers -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
-+HOSTCFLAGS += $(call cc-option, -Wno-empty-body)
-+HOSTCXXFLAGS = -O2 -fno-delete-null-pointer-checks
-
- # Decide whether to build built-in, modular, or both.
- # Normally, just do built-in.
-@@ -342,10 +343,12 @@ LINUXINCLUDE := -Iinclude \
- KBUILD_CPPFLAGS := -D__KERNEL__
-
- KBUILD_CFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
-+ -W -Wno-unused-parameter -Wno-missing-field-initializers \
- -fno-strict-aliasing -fno-common \
- -Werror-implicit-function-declaration \
- -Wno-format-security \
- -fno-delete-null-pointer-checks
-+KBUILD_CFLAGS += $(call cc-option, -Wno-empty-body)
- KBUILD_AFLAGS := -D__ASSEMBLY__
-
- # Read KERNELRELEASE from include/config/kernel.release (if it exists)
-@@ -376,8 +379,8 @@ export RCS_TAR_IGNORE := --exclude SCCS
- # Rules shared between *config targets and build targets
-
- # Basic helpers built in scripts/
--PHONY += scripts_basic
--scripts_basic:
-+PHONY += scripts_basic gcc-plugins
-+scripts_basic: gcc-plugins
- $(Q)$(MAKE) $(build)=scripts/basic
-
- # To avoid any implicit rule to kick in, define an empty command.
-@@ -403,7 +406,7 @@ endif
- # of make so .config is not included in this case either (for *config).
-
- no-dot-config-targets := clean mrproper distclean \
-- cscope TAGS tags help %docs check% \
-+ cscope gtags TAGS tags help %docs check% \
- include/linux/version.h headers_% \
- kernelrelease kernelversion
-
-@@ -526,6 +529,25 @@ else
- KBUILD_CFLAGS += -O2
- endif
-
-+ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-plugin.sh $(HOSTCC)), y)
-+CONSTIFY_PLUGIN := -fplugin=$(objtree)/tools/gcc/constify_plugin.so
-+ifdef CONFIG_PAX_MEMORY_STACKLEAK
-+STACKLEAK_PLUGIN := -fplugin=$(objtree)/tools/gcc/stackleak_plugin.so -fplugin-arg-stackleak_plugin-track-lowest-sp=100
-+endif
-+KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN)
-+export CONSTIFY_PLUGIN STACKLEAK_PLUGIN
-+gcc-plugins:
-+ $(Q)$(MAKE) $(build)=tools/gcc
-+else
-+gcc-plugins:
-+ifeq ($(call cc-ifversion, -ge, 0405, y), y)
-+ $(error Your gcc installation does not support plugins. If the necessary headers for plugin support are missing, they should be installed. On Debian, apt-get install gcc-<ver>-plugin-dev.))
-+else
-+ $(Q)echo "warning, your gcc version does not support plugins, you should upgrade it to gcc 4.5 at least"
-+endif
-+ $(Q)echo "PAX_MEMORY_STACKLEAK and constification will be less secure"
-+endif
-+
- include $(srctree)/arch/$(SRCARCH)/Makefile
-
- ifneq ($(CONFIG_FRAME_WARN),0)
-@@ -644,7 +666,7 @@ export mod_strip_cmd
-
-
- ifeq ($(KBUILD_EXTMOD),)
--core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
-+core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
-
- vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
- $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
-@@ -970,7 +992,7 @@ ifneq ($(KBUILD_SRC),)
- endif
-
- # prepare2 creates a makefile if using a separate output directory
--prepare2: prepare3 outputmakefile
-+prepare2: prepare3 outputmakefile gcc-plugins
-
- prepare1: prepare2 include/linux/version.h include/linux/utsrelease.h \
- include/asm include/config/auto.conf
-@@ -1198,7 +1220,7 @@ MRPROPER_FILES += .config .config.old in
- include/linux/autoconf.h include/linux/version.h \
- include/linux/utsrelease.h \
- include/linux/bounds.h include/asm*/asm-offsets.h \
-- Module.symvers Module.markers tags TAGS cscope*
-+ Module.symvers Module.markers tags TAGS cscope* GPATH GTAGS GRTAGS GSYMS
-
- # clean - Delete most, but leave enough to build external modules
- #
-@@ -1289,6 +1311,7 @@ help:
- @echo ' modules_prepare - Set up for building external modules'
- @echo ' tags/TAGS - Generate tags file for editors'
- @echo ' cscope - Generate cscope index'
-+ @echo ' gtags - Generate GNU GLOBAL index'
- @echo ' kernelrelease - Output the release version string'
- @echo ' kernelversion - Output the version stored in Makefile'
- @echo ' headers_install - Install sanitised kernel headers to INSTALL_HDR_PATH'; \
-@@ -1421,7 +1444,7 @@ clean: $(clean-dirs)
- $(call cmd,rmdirs)
- $(call cmd,rmfiles)
- @find $(KBUILD_EXTMOD) $(RCS_FIND_IGNORE) \
-- \( -name '*.[oas]' -o -name '*.ko' -o -name '.*.cmd' \
-+ \( -name '*.[oas]' -o -name '*.[ks]o' -o -name '.*.cmd' \
- -o -name '.*.d' -o -name '.*.tmp' -o -name '*.mod.c' \
- -o -name '*.gcno' \) -type f -print | xargs rm -f
-
-@@ -1445,7 +1468,7 @@ endif # KBUILD_EXTMOD
- quiet_cmd_tags = GEN $@
- cmd_tags = $(CONFIG_SHELL) $(srctree)/scripts/tags.sh $@
-
--tags TAGS cscope: FORCE
-+tags TAGS cscope gtags: FORCE
- $(call cmd,tags)
-
- # Scripts to check various things for consistency
-diff -urNp linux-2.6.32.45/mm/backing-dev.c linux-2.6.32.45/mm/backing-dev.c
---- linux-2.6.32.45/mm/backing-dev.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/mm/backing-dev.c 2011-08-11 19:48:17.000000000 -0400
-@@ -272,7 +272,7 @@ static void bdi_task_init(struct backing
- list_add_tail_rcu(&wb->list, &bdi->wb_list);
- spin_unlock(&bdi->wb_lock);
-
-- tsk->flags |= PF_FLUSHER | PF_SWAPWRITE;
-+ tsk->flags |= PF_SWAPWRITE;
- set_freezable();
-
- /*
-@@ -484,7 +484,7 @@ static void bdi_add_to_pending(struct rc
- * Add the default flusher task that gets created for any bdi
- * that has dirty data pending writeout
- */
--void static bdi_add_default_flusher_task(struct backing_dev_info *bdi)
-+static void bdi_add_default_flusher_task(struct backing_dev_info *bdi)
- {
- if (!bdi_cap_writeback_dirty(bdi))
- return;
-diff -urNp linux-2.6.32.45/mm/filemap.c linux-2.6.32.45/mm/filemap.c
---- linux-2.6.32.45/mm/filemap.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/mm/filemap.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1631,7 +1631,7 @@ int generic_file_mmap(struct file * file
- struct address_space *mapping = file->f_mapping;
-
- if (!mapping->a_ops->readpage)
-- return -ENOEXEC;
-+ return -ENODEV;
- file_accessed(file);
- vma->vm_ops = &generic_file_vm_ops;
- vma->vm_flags |= VM_CAN_NONLINEAR;
-@@ -2027,6 +2027,7 @@ inline int generic_write_checks(struct f
- *pos = i_size_read(inode);
-
- if (limit != RLIM_INFINITY) {
-+ gr_learn_resource(current, RLIMIT_FSIZE,*pos, 0);
- if (*pos >= limit) {
- send_sig(SIGXFSZ, current, 0);
- return -EFBIG;
-diff -urNp linux-2.6.32.45/mm/fremap.c linux-2.6.32.45/mm/fremap.c
---- linux-2.6.32.45/mm/fremap.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/mm/fremap.c 2011-04-17 15:56:46.000000000 -0400
-@@ -153,6 +153,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
- retry:
- vma = find_vma(mm, start);
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (vma && (mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_MAYEXEC))
-+ goto out;
-+#endif
-+
- /*
- * Make sure the vma is shared, that it supports prefaulting,
- * and that the remapped range is valid and fully within
-@@ -221,7 +226,7 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
- /*
- * drop PG_Mlocked flag for over-mapped range
- */
-- unsigned int saved_flags = vma->vm_flags;
-+ unsigned long saved_flags = vma->vm_flags;
- munlock_vma_pages_range(vma, start, start + size);
- vma->vm_flags = saved_flags;
- }
-diff -urNp linux-2.6.32.45/mm/highmem.c linux-2.6.32.45/mm/highmem.c
---- linux-2.6.32.45/mm/highmem.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/mm/highmem.c 2011-04-17 15:56:46.000000000 -0400
-@@ -116,9 +116,10 @@ static void flush_all_zero_pkmaps(void)
- * So no dangers, even with speculative execution.
- */
- page = pte_page(pkmap_page_table[i]);
-+ pax_open_kernel();
- pte_clear(&init_mm, (unsigned long)page_address(page),
- &pkmap_page_table[i]);
--
-+ pax_close_kernel();
- set_page_address(page, NULL);
- need_flush = 1;
- }
-@@ -177,9 +178,11 @@ start:
- }
- }
- vaddr = PKMAP_ADDR(last_pkmap_nr);
-+
-+ pax_open_kernel();
- set_pte_at(&init_mm, vaddr,
- &(pkmap_page_table[last_pkmap_nr]), mk_pte(page, kmap_prot));
--
-+ pax_close_kernel();
- pkmap_count[last_pkmap_nr] = 1;
- set_page_address(page, (void *)vaddr);
-
-diff -urNp linux-2.6.32.45/mm/hugetlb.c linux-2.6.32.45/mm/hugetlb.c
---- linux-2.6.32.45/mm/hugetlb.c 2011-07-13 17:23:04.000000000 -0400
-+++ linux-2.6.32.45/mm/hugetlb.c 2011-07-13 17:23:19.000000000 -0400
-@@ -1933,6 +1933,26 @@ static int unmap_ref_private(struct mm_s
- return 1;
- }
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+static void pax_mirror_huge_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m)
-+{
-+ struct mm_struct *mm = vma->vm_mm;
-+ struct vm_area_struct *vma_m;
-+ unsigned long address_m;
-+ pte_t *ptep_m;
-+
-+ vma_m = pax_find_mirror_vma(vma);
-+ if (!vma_m)
-+ return;
-+
-+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
-+ address_m = address + SEGMEXEC_TASK_SIZE;
-+ ptep_m = huge_pte_offset(mm, address_m & HPAGE_MASK);
-+ get_page(page_m);
-+ set_huge_pte_at(mm, address_m, ptep_m, make_huge_pte(vma_m, page_m, 0));
-+}
-+#endif
-+
- static int hugetlb_cow(struct mm_struct *mm, struct vm_area_struct *vma,
- unsigned long address, pte_t *ptep, pte_t pte,
- struct page *pagecache_page)
-@@ -2004,6 +2024,11 @@ retry_avoidcopy:
- huge_ptep_clear_flush(vma, address, ptep);
- set_huge_pte_at(mm, address, ptep,
- make_huge_pte(vma, new_page, 1));
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ pax_mirror_huge_pte(vma, address, new_page);
-+#endif
-+
- /* Make the old page be freed below */
- new_page = old_page;
- }
-@@ -2135,6 +2160,10 @@ retry:
- && (vma->vm_flags & VM_SHARED)));
- set_huge_pte_at(mm, address, ptep, new_pte);
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ pax_mirror_huge_pte(vma, address, page);
-+#endif
-+
- if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) {
- /* Optimization, do the COW without a second fault */
- ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page);
-@@ -2163,6 +2192,28 @@ int hugetlb_fault(struct mm_struct *mm,
- static DEFINE_MUTEX(hugetlb_instantiation_mutex);
- struct hstate *h = hstate_vma(vma);
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m;
-+
-+ vma_m = pax_find_mirror_vma(vma);
-+ if (vma_m) {
-+ unsigned long address_m;
-+
-+ if (vma->vm_start > vma_m->vm_start) {
-+ address_m = address;
-+ address -= SEGMEXEC_TASK_SIZE;
-+ vma = vma_m;
-+ h = hstate_vma(vma);
-+ } else
-+ address_m = address + SEGMEXEC_TASK_SIZE;
-+
-+ if (!huge_pte_alloc(mm, address_m, huge_page_size(h)))
-+ return VM_FAULT_OOM;
-+ address_m &= HPAGE_MASK;
-+ unmap_hugepage_range(vma, address_m, address_m + HPAGE_SIZE, NULL);
-+ }
-+#endif
-+
- ptep = huge_pte_alloc(mm, address, huge_page_size(h));
- if (!ptep)
- return VM_FAULT_OOM;
-diff -urNp linux-2.6.32.45/mm/internal.h linux-2.6.32.45/mm/internal.h
---- linux-2.6.32.45/mm/internal.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/mm/internal.h 2011-07-09 09:13:08.000000000 -0400
-@@ -49,6 +49,7 @@ extern void putback_lru_page(struct page
- * in mm/page_alloc.c
- */
- extern void __free_pages_bootmem(struct page *page, unsigned int order);
-+extern void free_compound_page(struct page *page);
- extern void prep_compound_page(struct page *page, unsigned long order);
-
-
-diff -urNp linux-2.6.32.45/mm/Kconfig linux-2.6.32.45/mm/Kconfig
---- linux-2.6.32.45/mm/Kconfig 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/mm/Kconfig 2011-04-17 15:56:46.000000000 -0400
-@@ -228,7 +228,7 @@ config KSM
- config DEFAULT_MMAP_MIN_ADDR
- int "Low address space to protect from user allocation"
- depends on MMU
-- default 4096
-+ default 65536
- help
- This is the portion of low virtual memory which should be protected
- from userspace allocation. Keeping a user from writing to low pages
-diff -urNp linux-2.6.32.45/mm/kmemleak.c linux-2.6.32.45/mm/kmemleak.c
---- linux-2.6.32.45/mm/kmemleak.c 2011-06-25 12:55:35.000000000 -0400
-+++ linux-2.6.32.45/mm/kmemleak.c 2011-06-25 12:56:37.000000000 -0400
-@@ -358,7 +358,7 @@ static void print_unreferenced(struct se
-
- for (i = 0; i < object->trace_len; i++) {
- void *ptr = (void *)object->trace[i];
-- seq_printf(seq, " [<%p>] %pS\n", ptr, ptr);
-+ seq_printf(seq, " [<%p>] %pA\n", ptr, ptr);
- }
- }
-
-diff -urNp linux-2.6.32.45/mm/maccess.c linux-2.6.32.45/mm/maccess.c
---- linux-2.6.32.45/mm/maccess.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/mm/maccess.c 2011-04-17 15:56:46.000000000 -0400
-@@ -14,7 +14,7 @@
- * Safely read from address @src to the buffer at @dst. If a kernel fault
- * happens, handle that and return -EFAULT.
- */
--long probe_kernel_read(void *dst, void *src, size_t size)
-+long probe_kernel_read(void *dst, const void *src, size_t size)
- {
- long ret;
- mm_segment_t old_fs = get_fs();
-@@ -39,7 +39,7 @@ EXPORT_SYMBOL_GPL(probe_kernel_read);
- * Safely write to address @dst from the buffer at @src. If a kernel fault
- * happens, handle that and return -EFAULT.
- */
--long notrace __weak probe_kernel_write(void *dst, void *src, size_t size)
-+long notrace __weak probe_kernel_write(void *dst, const void *src, size_t size)
- {
- long ret;
- mm_segment_t old_fs = get_fs();
-diff -urNp linux-2.6.32.45/mm/madvise.c linux-2.6.32.45/mm/madvise.c
---- linux-2.6.32.45/mm/madvise.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/mm/madvise.c 2011-04-17 15:56:46.000000000 -0400
-@@ -44,6 +44,10 @@ static long madvise_behavior(struct vm_a
- pgoff_t pgoff;
- unsigned long new_flags = vma->vm_flags;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m;
-+#endif
-+
- switch (behavior) {
- case MADV_NORMAL:
- new_flags = new_flags & ~VM_RAND_READ & ~VM_SEQ_READ;
-@@ -103,6 +107,13 @@ success:
- /*
- * vm_flags is protected by the mmap_sem held in write mode.
- */
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ vma_m = pax_find_mirror_vma(vma);
-+ if (vma_m)
-+ vma_m->vm_flags = new_flags & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT);
-+#endif
-+
- vma->vm_flags = new_flags;
-
- out:
-@@ -161,6 +172,11 @@ static long madvise_dontneed(struct vm_a
- struct vm_area_struct ** prev,
- unsigned long start, unsigned long end)
- {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m;
-+#endif
-+
- *prev = vma;
- if (vma->vm_flags & (VM_LOCKED|VM_HUGETLB|VM_PFNMAP))
- return -EINVAL;
-@@ -173,6 +189,21 @@ static long madvise_dontneed(struct vm_a
- zap_page_range(vma, start, end - start, &details);
- } else
- zap_page_range(vma, start, end - start, NULL);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ vma_m = pax_find_mirror_vma(vma);
-+ if (vma_m) {
-+ if (unlikely(vma->vm_flags & VM_NONLINEAR)) {
-+ struct zap_details details = {
-+ .nonlinear_vma = vma_m,
-+ .last_index = ULONG_MAX,
-+ };
-+ zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, &details);
-+ } else
-+ zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, NULL);
-+ }
-+#endif
-+
- return 0;
- }
-
-@@ -359,6 +390,16 @@ SYSCALL_DEFINE3(madvise, unsigned long,
- if (end < start)
- goto out;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
-+ if (end > SEGMEXEC_TASK_SIZE)
-+ goto out;
-+ } else
-+#endif
-+
-+ if (end > TASK_SIZE)
-+ goto out;
-+
- error = 0;
- if (end == start)
- goto out;
-diff -urNp linux-2.6.32.45/mm/memory.c linux-2.6.32.45/mm/memory.c
---- linux-2.6.32.45/mm/memory.c 2011-07-13 17:23:04.000000000 -0400
-+++ linux-2.6.32.45/mm/memory.c 2011-07-13 17:23:23.000000000 -0400
-@@ -187,8 +187,12 @@ static inline void free_pmd_range(struct
- return;
-
- pmd = pmd_offset(pud, start);
-+
-+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_PER_CPU_PGD)
- pud_clear(pud);
- pmd_free_tlb(tlb, pmd, start);
-+#endif
-+
- }
-
- static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
-@@ -219,9 +223,12 @@ static inline void free_pud_range(struct
- if (end - 1 > ceiling - 1)
- return;
-
-+#if !defined(CONFIG_X86_64) || !defined(CONFIG_PAX_PER_CPU_PGD)
- pud = pud_offset(pgd, start);
- pgd_clear(pgd);
- pud_free_tlb(tlb, pud, start);
-+#endif
-+
- }
-
- /*
-@@ -1251,10 +1258,10 @@ int __get_user_pages(struct task_struct
- (VM_MAYREAD | VM_MAYWRITE) : (VM_READ | VM_WRITE);
- i = 0;
-
-- do {
-+ while (nr_pages) {
- struct vm_area_struct *vma;
-
-- vma = find_extend_vma(mm, start);
-+ vma = find_vma(mm, start);
- if (!vma && in_gate_area(tsk, start)) {
- unsigned long pg = start & PAGE_MASK;
- struct vm_area_struct *gate_vma = get_gate_vma(tsk);
-@@ -1306,7 +1313,7 @@ int __get_user_pages(struct task_struct
- continue;
- }
-
-- if (!vma ||
-+ if (!vma || start < vma->vm_start ||
- (vma->vm_flags & (VM_IO | VM_PFNMAP)) ||
- !(vm_flags & vma->vm_flags))
- return i ? : -EFAULT;
-@@ -1381,7 +1388,7 @@ int __get_user_pages(struct task_struct
- start += PAGE_SIZE;
- nr_pages--;
- } while (nr_pages && start < vma->vm_end);
-- } while (nr_pages);
-+ }
- return i;
- }
-
-@@ -1526,6 +1533,10 @@ static int insert_page(struct vm_area_st
- page_add_file_rmap(page);
- set_pte_at(mm, addr, pte, mk_pte(page, prot));
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ pax_mirror_file_pte(vma, addr, page, ptl);
-+#endif
-+
- retval = 0;
- pte_unmap_unlock(pte, ptl);
- return retval;
-@@ -1560,10 +1571,22 @@ out:
- int vm_insert_page(struct vm_area_struct *vma, unsigned long addr,
- struct page *page)
- {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m;
-+#endif
-+
- if (addr < vma->vm_start || addr >= vma->vm_end)
- return -EFAULT;
- if (!page_count(page))
- return -EINVAL;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ vma_m = pax_find_mirror_vma(vma);
-+ if (vma_m)
-+ vma_m->vm_flags |= VM_INSERTPAGE;
-+#endif
-+
- vma->vm_flags |= VM_INSERTPAGE;
- return insert_page(vma, addr, page, vma->vm_page_prot);
- }
-@@ -1649,6 +1672,7 @@ int vm_insert_mixed(struct vm_area_struc
- unsigned long pfn)
- {
- BUG_ON(!(vma->vm_flags & VM_MIXEDMAP));
-+ BUG_ON(vma->vm_mirror);
-
- if (addr < vma->vm_start || addr >= vma->vm_end)
- return -EFAULT;
-@@ -1977,6 +2001,186 @@ static inline void cow_user_page(struct
- copy_user_highpage(dst, src, va, vma);
- }
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+static void pax_unmap_mirror_pte(struct vm_area_struct *vma, unsigned long address, pmd_t *pmd)
-+{
-+ struct mm_struct *mm = vma->vm_mm;
-+ spinlock_t *ptl;
-+ pte_t *pte, entry;
-+
-+ pte = pte_offset_map_lock(mm, pmd, address, &ptl);
-+ entry = *pte;
-+ if (!pte_present(entry)) {
-+ if (!pte_none(entry)) {
-+ BUG_ON(pte_file(entry));
-+ free_swap_and_cache(pte_to_swp_entry(entry));
-+ pte_clear_not_present_full(mm, address, pte, 0);
-+ }
-+ } else {
-+ struct page *page;
-+
-+ flush_cache_page(vma, address, pte_pfn(entry));
-+ entry = ptep_clear_flush(vma, address, pte);
-+ BUG_ON(pte_dirty(entry));
-+ page = vm_normal_page(vma, address, entry);
-+ if (page) {
-+ update_hiwater_rss(mm);
-+ if (PageAnon(page))
-+ dec_mm_counter(mm, anon_rss);
-+ else
-+ dec_mm_counter(mm, file_rss);
-+ page_remove_rmap(page);
-+ page_cache_release(page);
-+ }
-+ }
-+ pte_unmap_unlock(pte, ptl);
-+}
-+
-+/* PaX: if vma is mirrored, synchronize the mirror's PTE
-+ *
-+ * the ptl of the lower mapped page is held on entry and is not released on exit
-+ * or inside to ensure atomic changes to the PTE states (swapout, mremap, munmap, etc)
-+ */
-+static void pax_mirror_anon_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
-+{
-+ struct mm_struct *mm = vma->vm_mm;
-+ unsigned long address_m;
-+ spinlock_t *ptl_m;
-+ struct vm_area_struct *vma_m;
-+ pmd_t *pmd_m;
-+ pte_t *pte_m, entry_m;
-+
-+ BUG_ON(!page_m || !PageAnon(page_m));
-+
-+ vma_m = pax_find_mirror_vma(vma);
-+ if (!vma_m)
-+ return;
-+
-+ BUG_ON(!PageLocked(page_m));
-+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
-+ address_m = address + SEGMEXEC_TASK_SIZE;
-+ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
-+ pte_m = pte_offset_map_nested(pmd_m, address_m);
-+ ptl_m = pte_lockptr(mm, pmd_m);
-+ if (ptl != ptl_m) {
-+ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
-+ if (!pte_none(*pte_m))
-+ goto out;
-+ }
-+
-+ entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
-+ page_cache_get(page_m);
-+ page_add_anon_rmap(page_m, vma_m, address_m);
-+ inc_mm_counter(mm, anon_rss);
-+ set_pte_at(mm, address_m, pte_m, entry_m);
-+ update_mmu_cache(vma_m, address_m, entry_m);
-+out:
-+ if (ptl != ptl_m)
-+ spin_unlock(ptl_m);
-+ pte_unmap_nested(pte_m);
-+ unlock_page(page_m);
-+}
-+
-+void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
-+{
-+ struct mm_struct *mm = vma->vm_mm;
-+ unsigned long address_m;
-+ spinlock_t *ptl_m;
-+ struct vm_area_struct *vma_m;
-+ pmd_t *pmd_m;
-+ pte_t *pte_m, entry_m;
-+
-+ BUG_ON(!page_m || PageAnon(page_m));
-+
-+ vma_m = pax_find_mirror_vma(vma);
-+ if (!vma_m)
-+ return;
-+
-+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
-+ address_m = address + SEGMEXEC_TASK_SIZE;
-+ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
-+ pte_m = pte_offset_map_nested(pmd_m, address_m);
-+ ptl_m = pte_lockptr(mm, pmd_m);
-+ if (ptl != ptl_m) {
-+ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
-+ if (!pte_none(*pte_m))
-+ goto out;
-+ }
-+
-+ entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
-+ page_cache_get(page_m);
-+ page_add_file_rmap(page_m);
-+ inc_mm_counter(mm, file_rss);
-+ set_pte_at(mm, address_m, pte_m, entry_m);
-+ update_mmu_cache(vma_m, address_m, entry_m);
-+out:
-+ if (ptl != ptl_m)
-+ spin_unlock(ptl_m);
-+ pte_unmap_nested(pte_m);
-+}
-+
-+static void pax_mirror_pfn_pte(struct vm_area_struct *vma, unsigned long address, unsigned long pfn_m, spinlock_t *ptl)
-+{
-+ struct mm_struct *mm = vma->vm_mm;
-+ unsigned long address_m;
-+ spinlock_t *ptl_m;
-+ struct vm_area_struct *vma_m;
-+ pmd_t *pmd_m;
-+ pte_t *pte_m, entry_m;
-+
-+ vma_m = pax_find_mirror_vma(vma);
-+ if (!vma_m)
-+ return;
-+
-+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
-+ address_m = address + SEGMEXEC_TASK_SIZE;
-+ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
-+ pte_m = pte_offset_map_nested(pmd_m, address_m);
-+ ptl_m = pte_lockptr(mm, pmd_m);
-+ if (ptl != ptl_m) {
-+ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
-+ if (!pte_none(*pte_m))
-+ goto out;
-+ }
-+
-+ entry_m = pfn_pte(pfn_m, vma_m->vm_page_prot);
-+ set_pte_at(mm, address_m, pte_m, entry_m);
-+out:
-+ if (ptl != ptl_m)
-+ spin_unlock(ptl_m);
-+ pte_unmap_nested(pte_m);
-+}
-+
-+static void pax_mirror_pte(struct vm_area_struct *vma, unsigned long address, pte_t *pte, pmd_t *pmd, spinlock_t *ptl)
-+{
-+ struct page *page_m;
-+ pte_t entry;
-+
-+ if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC))
-+ goto out;
-+
-+ entry = *pte;
-+ page_m = vm_normal_page(vma, address, entry);
-+ if (!page_m)
-+ pax_mirror_pfn_pte(vma, address, pte_pfn(entry), ptl);
-+ else if (PageAnon(page_m)) {
-+ if (pax_find_mirror_vma(vma)) {
-+ pte_unmap_unlock(pte, ptl);
-+ lock_page(page_m);
-+ pte = pte_offset_map_lock(vma->vm_mm, pmd, address, &ptl);
-+ if (pte_same(entry, *pte))
-+ pax_mirror_anon_pte(vma, address, page_m, ptl);
-+ else
-+ unlock_page(page_m);
-+ }
-+ } else
-+ pax_mirror_file_pte(vma, address, page_m, ptl);
-+
-+out:
-+ pte_unmap_unlock(pte, ptl);
-+}
-+#endif
-+
- /*
- * This routine handles present pages, when users try to write
- * to a shared page. It is done by copying the page to a new address
-@@ -2156,6 +2360,12 @@ gotten:
- */
- page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
- if (likely(pte_same(*page_table, orig_pte))) {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (pax_find_mirror_vma(vma))
-+ BUG_ON(!trylock_page(new_page));
-+#endif
-+
- if (old_page) {
- if (!PageAnon(old_page)) {
- dec_mm_counter(mm, file_rss);
-@@ -2207,6 +2417,10 @@ gotten:
- page_remove_rmap(old_page);
- }
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ pax_mirror_anon_pte(vma, address, new_page, ptl);
-+#endif
-+
- /* Free the old page.. */
- new_page = old_page;
- ret |= VM_FAULT_WRITE;
-@@ -2606,6 +2820,11 @@ static int do_swap_page(struct mm_struct
- swap_free(entry);
- if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
- try_to_free_swap(page);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((flags & FAULT_FLAG_WRITE) || !pax_find_mirror_vma(vma))
-+#endif
-+
- unlock_page(page);
-
- if (flags & FAULT_FLAG_WRITE) {
-@@ -2617,6 +2836,11 @@ static int do_swap_page(struct mm_struct
-
- /* No need to invalidate - it was non-present before */
- update_mmu_cache(vma, address, pte);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ pax_mirror_anon_pte(vma, address, page, ptl);
-+#endif
-+
- unlock:
- pte_unmap_unlock(page_table, ptl);
- out:
-@@ -2632,40 +2856,6 @@ out_release:
- }
-
- /*
-- * This is like a special single-page "expand_{down|up}wards()",
-- * except we must first make sure that 'address{-|+}PAGE_SIZE'
-- * doesn't hit another vma.
-- */
--static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address)
--{
-- address &= PAGE_MASK;
-- if ((vma->vm_flags & VM_GROWSDOWN) && address == vma->vm_start) {
-- struct vm_area_struct *prev = vma->vm_prev;
--
-- /*
-- * Is there a mapping abutting this one below?
-- *
-- * That's only ok if it's the same stack mapping
-- * that has gotten split..
-- */
-- if (prev && prev->vm_end == address)
-- return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
--
-- expand_stack(vma, address - PAGE_SIZE);
-- }
-- if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
-- struct vm_area_struct *next = vma->vm_next;
--
-- /* As VM_GROWSDOWN but s/below/above/ */
-- if (next && next->vm_start == address + PAGE_SIZE)
-- return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
--
-- expand_upwards(vma, address + PAGE_SIZE);
-- }
-- return 0;
--}
--
--/*
- * We enter with non-exclusive mmap_sem (to exclude vma changes,
- * but allow concurrent faults), and pte mapped but not yet locked.
- * We return with mmap_sem still held, but pte unmapped and unlocked.
-@@ -2674,27 +2864,23 @@ static int do_anonymous_page(struct mm_s
- unsigned long address, pte_t *page_table, pmd_t *pmd,
- unsigned int flags)
- {
-- struct page *page;
-+ struct page *page = NULL;
- spinlock_t *ptl;
- pte_t entry;
-
-- pte_unmap(page_table);
--
-- /* Check if we need to add a guard page to the stack */
-- if (check_stack_guard_page(vma, address) < 0)
-- return VM_FAULT_SIGBUS;
--
-- /* Use the zero-page for reads */
- if (!(flags & FAULT_FLAG_WRITE)) {
- entry = pte_mkspecial(pfn_pte(my_zero_pfn(address),
- vma->vm_page_prot));
-- page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
-+ ptl = pte_lockptr(mm, pmd);
-+ spin_lock(ptl);
- if (!pte_none(*page_table))
- goto unlock;
- goto setpte;
- }
-
- /* Allocate our own private page. */
-+ pte_unmap(page_table);
-+
- if (unlikely(anon_vma_prepare(vma)))
- goto oom;
- page = alloc_zeroed_user_highpage_movable(vma, address);
-@@ -2713,6 +2899,11 @@ static int do_anonymous_page(struct mm_s
- if (!pte_none(*page_table))
- goto release;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (pax_find_mirror_vma(vma))
-+ BUG_ON(!trylock_page(page));
-+#endif
-+
- inc_mm_counter(mm, anon_rss);
- page_add_new_anon_rmap(page, vma, address);
- setpte:
-@@ -2720,6 +2911,12 @@ setpte:
-
- /* No need to invalidate - it was non-present before */
- update_mmu_cache(vma, address, entry);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (page)
-+ pax_mirror_anon_pte(vma, address, page, ptl);
-+#endif
-+
- unlock:
- pte_unmap_unlock(page_table, ptl);
- return 0;
-@@ -2862,6 +3059,12 @@ static int __do_fault(struct mm_struct *
- */
- /* Only go through if we didn't race with anybody else... */
- if (likely(pte_same(*page_table, orig_pte))) {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (anon && pax_find_mirror_vma(vma))
-+ BUG_ON(!trylock_page(page));
-+#endif
-+
- flush_icache_page(vma, page);
- entry = mk_pte(page, vma->vm_page_prot);
- if (flags & FAULT_FLAG_WRITE)
-@@ -2881,6 +3084,14 @@ static int __do_fault(struct mm_struct *
-
- /* no need to invalidate: a not-present page won't be cached */
- update_mmu_cache(vma, address, entry);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (anon)
-+ pax_mirror_anon_pte(vma, address, page, ptl);
-+ else
-+ pax_mirror_file_pte(vma, address, page, ptl);
-+#endif
-+
- } else {
- if (charged)
- mem_cgroup_uncharge_page(page);
-@@ -3028,6 +3239,12 @@ static inline int handle_pte_fault(struc
- if (flags & FAULT_FLAG_WRITE)
- flush_tlb_page(vma, address);
- }
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ pax_mirror_pte(vma, address, pte, pmd, ptl);
-+ return 0;
-+#endif
-+
- unlock:
- pte_unmap_unlock(pte, ptl);
- return 0;
-@@ -3044,6 +3261,10 @@ int handle_mm_fault(struct mm_struct *mm
- pmd_t *pmd;
- pte_t *pte;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m;
-+#endif
-+
- __set_current_state(TASK_RUNNING);
-
- count_vm_event(PGFAULT);
-@@ -3051,6 +3272,34 @@ int handle_mm_fault(struct mm_struct *mm
- if (unlikely(is_vm_hugetlb_page(vma)))
- return hugetlb_fault(mm, vma, address, flags);
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ vma_m = pax_find_mirror_vma(vma);
-+ if (vma_m) {
-+ unsigned long address_m;
-+ pgd_t *pgd_m;
-+ pud_t *pud_m;
-+ pmd_t *pmd_m;
-+
-+ if (vma->vm_start > vma_m->vm_start) {
-+ address_m = address;
-+ address -= SEGMEXEC_TASK_SIZE;
-+ vma = vma_m;
-+ } else
-+ address_m = address + SEGMEXEC_TASK_SIZE;
-+
-+ pgd_m = pgd_offset(mm, address_m);
-+ pud_m = pud_alloc(mm, pgd_m, address_m);
-+ if (!pud_m)
-+ return VM_FAULT_OOM;
-+ pmd_m = pmd_alloc(mm, pud_m, address_m);
-+ if (!pmd_m)
-+ return VM_FAULT_OOM;
-+ if (!pmd_present(*pmd_m) && __pte_alloc(mm, pmd_m, address_m))
-+ return VM_FAULT_OOM;
-+ pax_unmap_mirror_pte(vma_m, address_m, pmd_m);
-+ }
-+#endif
-+
- pgd = pgd_offset(mm, address);
- pud = pud_alloc(mm, pgd, address);
- if (!pud)
-@@ -3148,7 +3397,7 @@ static int __init gate_vma_init(void)
- gate_vma.vm_start = FIXADDR_USER_START;
- gate_vma.vm_end = FIXADDR_USER_END;
- gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
-- gate_vma.vm_page_prot = __P101;
-+ gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
- /*
- * Make sure the vDSO gets into every core dump.
- * Dumping its contents makes post-mortem fully interpretable later
-diff -urNp linux-2.6.32.45/mm/memory-failure.c linux-2.6.32.45/mm/memory-failure.c
---- linux-2.6.32.45/mm/memory-failure.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/mm/memory-failure.c 2011-04-17 15:56:46.000000000 -0400
-@@ -46,7 +46,7 @@ int sysctl_memory_failure_early_kill __r
-
- int sysctl_memory_failure_recovery __read_mostly = 1;
-
--atomic_long_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
-+atomic_long_unchecked_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
-
- /*
- * Send all the processes who have the page mapped an ``action optional''
-@@ -745,7 +745,7 @@ int __memory_failure(unsigned long pfn,
- return 0;
- }
-
-- atomic_long_add(1, &mce_bad_pages);
-+ atomic_long_add_unchecked(1, &mce_bad_pages);
-
- /*
- * We need/can do nothing about count=0 pages.
-diff -urNp linux-2.6.32.45/mm/mempolicy.c linux-2.6.32.45/mm/mempolicy.c
---- linux-2.6.32.45/mm/mempolicy.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/mm/mempolicy.c 2011-04-17 15:56:46.000000000 -0400
-@@ -573,6 +573,10 @@ static int mbind_range(struct vm_area_st
- struct vm_area_struct *next;
- int err;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m;
-+#endif
-+
- err = 0;
- for (; vma && vma->vm_start < end; vma = next) {
- next = vma->vm_next;
-@@ -584,6 +588,16 @@ static int mbind_range(struct vm_area_st
- err = policy_vma(vma, new);
- if (err)
- break;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ vma_m = pax_find_mirror_vma(vma);
-+ if (vma_m) {
-+ err = policy_vma(vma_m, new);
-+ if (err)
-+ break;
-+ }
-+#endif
-+
- }
- return err;
- }
-@@ -1002,6 +1016,17 @@ static long do_mbind(unsigned long start
-
- if (end < start)
- return -EINVAL;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC) {
-+ if (end > SEGMEXEC_TASK_SIZE)
-+ return -EINVAL;
-+ } else
-+#endif
-+
-+ if (end > TASK_SIZE)
-+ return -EINVAL;
-+
- if (end == start)
- return 0;
-
-@@ -1207,6 +1232,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
- if (!mm)
- return -EINVAL;
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ if (mm != current->mm &&
-+ (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
-+ err = -EPERM;
-+ goto out;
-+ }
-+#endif
-+
- /*
- * Check if this process has the right to modify the specified
- * process. The right exists if the process has administrative
-@@ -1216,8 +1249,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
- rcu_read_lock();
- tcred = __task_cred(task);
- if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
-- cred->uid != tcred->suid && cred->uid != tcred->uid &&
-- !capable(CAP_SYS_NICE)) {
-+ cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
- rcu_read_unlock();
- err = -EPERM;
- goto out;
-@@ -2396,7 +2428,7 @@ int show_numa_map(struct seq_file *m, vo
-
- if (file) {
- seq_printf(m, " file=");
-- seq_path(m, &file->f_path, "\n\t= ");
-+ seq_path(m, &file->f_path, "\n\t\\= ");
- } else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
- seq_printf(m, " heap");
- } else if (vma->vm_start <= mm->start_stack &&
-diff -urNp linux-2.6.32.45/mm/migrate.c linux-2.6.32.45/mm/migrate.c
---- linux-2.6.32.45/mm/migrate.c 2011-07-13 17:23:04.000000000 -0400
-+++ linux-2.6.32.45/mm/migrate.c 2011-07-13 17:23:23.000000000 -0400
-@@ -916,6 +916,8 @@ static int do_pages_move(struct mm_struc
- unsigned long chunk_start;
- int err;
-
-+ pax_track_stack();
-+
- task_nodes = cpuset_mems_allowed(task);
-
- err = -ENOMEM;
-@@ -1106,6 +1108,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid,
- if (!mm)
- return -EINVAL;
-
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+ if (mm != current->mm &&
-+ (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
-+ err = -EPERM;
-+ goto out;
-+ }
-+#endif
-+
- /*
- * Check if this process has the right to modify the specified
- * process. The right exists if the process has administrative
-@@ -1115,8 +1125,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid,
- rcu_read_lock();
- tcred = __task_cred(task);
- if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
-- cred->uid != tcred->suid && cred->uid != tcred->uid &&
-- !capable(CAP_SYS_NICE)) {
-+ cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
- rcu_read_unlock();
- err = -EPERM;
- goto out;
-diff -urNp linux-2.6.32.45/mm/mlock.c linux-2.6.32.45/mm/mlock.c
---- linux-2.6.32.45/mm/mlock.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/mm/mlock.c 2011-04-17 15:56:46.000000000 -0400
-@@ -13,6 +13,7 @@
- #include <linux/pagemap.h>
- #include <linux/mempolicy.h>
- #include <linux/syscalls.h>
-+#include <linux/security.h>
- #include <linux/sched.h>
- #include <linux/module.h>
- #include <linux/rmap.h>
-@@ -138,13 +139,6 @@ void munlock_vma_page(struct page *page)
- }
- }
-
--static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
--{
-- return (vma->vm_flags & VM_GROWSDOWN) &&
-- (vma->vm_start == addr) &&
-- !vma_stack_continue(vma->vm_prev, addr);
--}
--
- /**
- * __mlock_vma_pages_range() - mlock a range of pages in the vma.
- * @vma: target vma
-@@ -177,12 +171,6 @@ static long __mlock_vma_pages_range(stru
- if (vma->vm_flags & VM_WRITE)
- gup_flags |= FOLL_WRITE;
-
-- /* We don't try to access the guard page of a stack vma */
-- if (stack_guard_page(vma, start)) {
-- addr += PAGE_SIZE;
-- nr_pages--;
-- }
--
- while (nr_pages > 0) {
- int i;
-
-@@ -440,7 +428,7 @@ static int do_mlock(unsigned long start,
- {
- unsigned long nstart, end, tmp;
- struct vm_area_struct * vma, * prev;
-- int error;
-+ int error = -EINVAL;
-
- len = PAGE_ALIGN(len);
- end = start + len;
-@@ -448,6 +436,9 @@ static int do_mlock(unsigned long start,
- return -EINVAL;
- if (end == start)
- return 0;
-+ if (end > TASK_SIZE)
-+ return -EINVAL;
-+
- vma = find_vma_prev(current->mm, start, &prev);
- if (!vma || vma->vm_start > start)
- return -ENOMEM;
-@@ -458,6 +449,11 @@ static int do_mlock(unsigned long start,
- for (nstart = start ; ; ) {
- unsigned int newflags;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
-+ break;
-+#endif
-+
- /* Here we know that vma->vm_start <= nstart < vma->vm_end. */
-
- newflags = vma->vm_flags | VM_LOCKED;
-@@ -507,6 +503,7 @@ SYSCALL_DEFINE2(mlock, unsigned long, st
- lock_limit >>= PAGE_SHIFT;
-
- /* check against resource limits */
-+ gr_learn_resource(current, RLIMIT_MEMLOCK, (current->mm->locked_vm << PAGE_SHIFT) + len, 1);
- if ((locked <= lock_limit) || capable(CAP_IPC_LOCK))
- error = do_mlock(start, len, 1);
- up_write(¤t->mm->mmap_sem);
-@@ -528,17 +525,23 @@ SYSCALL_DEFINE2(munlock, unsigned long,
- static int do_mlockall(int flags)
- {
- struct vm_area_struct * vma, * prev = NULL;
-- unsigned int def_flags = 0;
-
- if (flags & MCL_FUTURE)
-- def_flags = VM_LOCKED;
-- current->mm->def_flags = def_flags;
-+ current->mm->def_flags |= VM_LOCKED;
-+ else
-+ current->mm->def_flags &= ~VM_LOCKED;
- if (flags == MCL_FUTURE)
- goto out;
-
- for (vma = current->mm->mmap; vma ; vma = prev->vm_next) {
-- unsigned int newflags;
-+ unsigned long newflags;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
-+ break;
-+#endif
-
-+ BUG_ON(vma->vm_end > TASK_SIZE);
- newflags = vma->vm_flags | VM_LOCKED;
- if (!(flags & MCL_CURRENT))
- newflags &= ~VM_LOCKED;
-@@ -570,6 +573,7 @@ SYSCALL_DEFINE1(mlockall, int, flags)
- lock_limit >>= PAGE_SHIFT;
-
- ret = -ENOMEM;
-+ gr_learn_resource(current, RLIMIT_MEMLOCK, current->mm->total_vm << PAGE_SHIFT, 1);
- if (!(flags & MCL_CURRENT) || (current->mm->total_vm <= lock_limit) ||
- capable(CAP_IPC_LOCK))
- ret = do_mlockall(flags);
-diff -urNp linux-2.6.32.45/mm/mmap.c linux-2.6.32.45/mm/mmap.c
---- linux-2.6.32.45/mm/mmap.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/mm/mmap.c 2011-04-17 15:56:46.000000000 -0400
-@@ -45,6 +45,16 @@
- #define arch_rebalance_pgtables(addr, len) (addr)
- #endif
-
-+static inline void verify_mm_writelocked(struct mm_struct *mm)
-+{
-+#if defined(CONFIG_DEBUG_VM) || defined(CONFIG_PAX)
-+ if (unlikely(down_read_trylock(&mm->mmap_sem))) {
-+ up_read(&mm->mmap_sem);
-+ BUG();
-+ }
-+#endif
-+}
-+
- static void unmap_region(struct mm_struct *mm,
- struct vm_area_struct *vma, struct vm_area_struct *prev,
- unsigned long start, unsigned long end);
-@@ -70,22 +80,32 @@ static void unmap_region(struct mm_struc
- * x: (no) no x: (no) yes x: (no) yes x: (yes) yes
- *
- */
--pgprot_t protection_map[16] = {
-+pgprot_t protection_map[16] __read_only = {
- __P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111,
- __S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111
- };
-
- pgprot_t vm_get_page_prot(unsigned long vm_flags)
- {
-- return __pgprot(pgprot_val(protection_map[vm_flags &
-+ pgprot_t prot = __pgprot(pgprot_val(protection_map[vm_flags &
- (VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |
- pgprot_val(arch_vm_get_page_prot(vm_flags)));
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
-+ if (!nx_enabled &&
-+ (vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC &&
-+ (vm_flags & (VM_READ | VM_WRITE)))
-+ prot = __pgprot(pte_val(pte_exprotect(__pte(pgprot_val(prot)))));
-+#endif
-+
-+ return prot;
- }
- EXPORT_SYMBOL(vm_get_page_prot);
-
- int sysctl_overcommit_memory = OVERCOMMIT_GUESS; /* heuristic overcommit */
- int sysctl_overcommit_ratio = 50; /* default is 50% */
- int sysctl_max_map_count __read_mostly = DEFAULT_MAX_MAP_COUNT;
-+unsigned long sysctl_heap_stack_gap __read_mostly = 64*1024;
- struct percpu_counter vm_committed_as;
-
- /*
-@@ -231,6 +251,7 @@ static struct vm_area_struct *remove_vma
- struct vm_area_struct *next = vma->vm_next;
-
- might_sleep();
-+ BUG_ON(vma->vm_mirror);
- if (vma->vm_ops && vma->vm_ops->close)
- vma->vm_ops->close(vma);
- if (vma->vm_file) {
-@@ -267,6 +288,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
- * not page aligned -Ram Gupta
- */
- rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
-+ gr_learn_resource(current, RLIMIT_DATA, (brk - mm->start_brk) + (mm->end_data - mm->start_data), 1);
- if (rlim < RLIM_INFINITY && (brk - mm->start_brk) +
- (mm->end_data - mm->start_data) > rlim)
- goto out;
-@@ -704,6 +726,12 @@ static int
- can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
- struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
- {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_start == SEGMEXEC_TASK_SIZE)
-+ return 0;
-+#endif
-+
- if (is_mergeable_vma(vma, file, vm_flags) &&
- is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
- if (vma->vm_pgoff == vm_pgoff)
-@@ -723,6 +751,12 @@ static int
- can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
- struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
- {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end == SEGMEXEC_TASK_SIZE)
-+ return 0;
-+#endif
-+
- if (is_mergeable_vma(vma, file, vm_flags) &&
- is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
- pgoff_t vm_pglen;
-@@ -765,12 +799,19 @@ can_vma_merge_after(struct vm_area_struc
- struct vm_area_struct *vma_merge(struct mm_struct *mm,
- struct vm_area_struct *prev, unsigned long addr,
- unsigned long end, unsigned long vm_flags,
-- struct anon_vma *anon_vma, struct file *file,
-+ struct anon_vma *anon_vma, struct file *file,
- pgoff_t pgoff, struct mempolicy *policy)
- {
- pgoff_t pglen = (end - addr) >> PAGE_SHIFT;
- struct vm_area_struct *area, *next;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE, end_m = end + SEGMEXEC_TASK_SIZE;
-+ struct vm_area_struct *area_m = NULL, *next_m = NULL, *prev_m = NULL;
-+
-+ BUG_ON((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE < end);
-+#endif
-+
- /*
- * We later require that vma->vm_flags == vm_flags,
- * so this tests vma->vm_flags & VM_SPECIAL, too.
-@@ -786,6 +827,15 @@ struct vm_area_struct *vma_merge(struct
- if (next && next->vm_end == end) /* cases 6, 7, 8 */
- next = next->vm_next;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (prev)
-+ prev_m = pax_find_mirror_vma(prev);
-+ if (area)
-+ area_m = pax_find_mirror_vma(area);
-+ if (next)
-+ next_m = pax_find_mirror_vma(next);
-+#endif
-+
- /*
- * Can it merge with the predecessor?
- */
-@@ -805,9 +855,24 @@ struct vm_area_struct *vma_merge(struct
- /* cases 1, 6 */
- vma_adjust(prev, prev->vm_start,
- next->vm_end, prev->vm_pgoff, NULL);
-- } else /* cases 2, 5, 7 */
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (prev_m)
-+ vma_adjust(prev_m, prev_m->vm_start,
-+ next_m->vm_end, prev_m->vm_pgoff, NULL);
-+#endif
-+
-+ } else { /* cases 2, 5, 7 */
- vma_adjust(prev, prev->vm_start,
- end, prev->vm_pgoff, NULL);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (prev_m)
-+ vma_adjust(prev_m, prev_m->vm_start,
-+ end_m, prev_m->vm_pgoff, NULL);
-+#endif
-+
-+ }
- return prev;
- }
-
-@@ -818,12 +883,27 @@ struct vm_area_struct *vma_merge(struct
- mpol_equal(policy, vma_policy(next)) &&
- can_vma_merge_before(next, vm_flags,
- anon_vma, file, pgoff+pglen)) {
-- if (prev && addr < prev->vm_end) /* case 4 */
-+ if (prev && addr < prev->vm_end) { /* case 4 */
- vma_adjust(prev, prev->vm_start,
- addr, prev->vm_pgoff, NULL);
-- else /* cases 3, 8 */
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (prev_m)
-+ vma_adjust(prev_m, prev_m->vm_start,
-+ addr_m, prev_m->vm_pgoff, NULL);
-+#endif
-+
-+ } else { /* cases 3, 8 */
- vma_adjust(area, addr, next->vm_end,
- next->vm_pgoff - pglen, NULL);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (area_m)
-+ vma_adjust(area_m, addr_m, next_m->vm_end,
-+ next_m->vm_pgoff - pglen, NULL);
-+#endif
-+
-+ }
- return area;
- }
-
-@@ -898,14 +978,11 @@ none:
- void vm_stat_account(struct mm_struct *mm, unsigned long flags,
- struct file *file, long pages)
- {
-- const unsigned long stack_flags
-- = VM_STACK_FLAGS & (VM_GROWSUP|VM_GROWSDOWN);
--
- if (file) {
- mm->shared_vm += pages;
- if ((flags & (VM_EXEC|VM_WRITE)) == VM_EXEC)
- mm->exec_vm += pages;
-- } else if (flags & stack_flags)
-+ } else if (flags & (VM_GROWSUP|VM_GROWSDOWN))
- mm->stack_vm += pages;
- if (flags & (VM_RESERVED|VM_IO))
- mm->reserved_vm += pages;
-@@ -932,7 +1009,7 @@ unsigned long do_mmap_pgoff(struct file
- * (the exception is when the underlying filesystem is noexec
- * mounted, in which case we dont add PROT_EXEC.)
- */
-- if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
-+ if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
- if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC)))
- prot |= PROT_EXEC;
-
-@@ -958,7 +1035,7 @@ unsigned long do_mmap_pgoff(struct file
- /* Obtain the address to map to. we verify (or select) it and ensure
- * that it represents a valid section of the address space.
- */
-- addr = get_unmapped_area(file, addr, len, pgoff, flags);
-+ addr = get_unmapped_area(file, addr, len, pgoff, flags | ((prot & PROT_EXEC) ? MAP_EXECUTABLE : 0));
- if (addr & ~PAGE_MASK)
- return addr;
-
-@@ -969,6 +1046,36 @@ unsigned long do_mmap_pgoff(struct file
- vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |
- mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
-
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (mm->pax_flags & MF_PAX_MPROTECT) {
-+#ifndef CONFIG_PAX_MPROTECT_COMPAT
-+ if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC)) {
-+ gr_log_rwxmmap(file);
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+ vm_flags &= ~VM_EXEC;
-+#else
-+ return -EPERM;
-+#endif
-+
-+ }
-+
-+ if (!(vm_flags & VM_EXEC))
-+ vm_flags &= ~VM_MAYEXEC;
-+#else
-+ if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
-+ vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
-+#endif
-+ else
-+ vm_flags &= ~VM_MAYWRITE;
-+ }
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
-+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && file)
-+ vm_flags &= ~VM_PAGEEXEC;
-+#endif
-+
- if (flags & MAP_LOCKED)
- if (!can_do_mlock())
- return -EPERM;
-@@ -980,6 +1087,7 @@ unsigned long do_mmap_pgoff(struct file
- locked += mm->locked_vm;
- lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
- lock_limit >>= PAGE_SHIFT;
-+ gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
- if (locked > lock_limit && !capable(CAP_IPC_LOCK))
- return -EAGAIN;
- }
-@@ -1053,6 +1161,9 @@ unsigned long do_mmap_pgoff(struct file
- if (error)
- return error;
-
-+ if (!gr_acl_handle_mmap(file, prot))
-+ return -EACCES;
-+
- return mmap_region(file, addr, len, flags, vm_flags, pgoff);
- }
- EXPORT_SYMBOL(do_mmap_pgoff);
-@@ -1065,10 +1176,10 @@ EXPORT_SYMBOL(do_mmap_pgoff);
- */
- int vma_wants_writenotify(struct vm_area_struct *vma)
- {
-- unsigned int vm_flags = vma->vm_flags;
-+ unsigned long vm_flags = vma->vm_flags;
-
- /* If it was private or non-writable, the write bit is already clear */
-- if ((vm_flags & (VM_WRITE|VM_SHARED)) != ((VM_WRITE|VM_SHARED)))
-+ if ((vm_flags & (VM_WRITE|VM_SHARED)) != (VM_WRITE|VM_SHARED))
- return 0;
-
- /* The backer wishes to know when pages are first written to? */
-@@ -1117,14 +1228,24 @@ unsigned long mmap_region(struct file *f
- unsigned long charged = 0;
- struct inode *inode = file ? file->f_path.dentry->d_inode : NULL;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m = NULL;
-+#endif
-+
-+ /*
-+ * mm->mmap_sem is required to protect against another thread
-+ * changing the mappings in case we sleep.
-+ */
-+ verify_mm_writelocked(mm);
-+
- /* Clear old maps */
- error = -ENOMEM;
--munmap_back:
- vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
- if (vma && vma->vm_start < addr + len) {
- if (do_munmap(mm, addr, len))
- return -ENOMEM;
-- goto munmap_back;
-+ vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
-+ BUG_ON(vma && vma->vm_start < addr + len);
- }
-
- /* Check against address space limit. */
-@@ -1173,6 +1294,16 @@ munmap_back:
- goto unacct_error;
- }
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vm_flags & VM_EXEC)) {
-+ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
-+ if (!vma_m) {
-+ error = -ENOMEM;
-+ goto free_vma;
-+ }
-+ }
-+#endif
-+
- vma->vm_mm = mm;
- vma->vm_start = addr;
- vma->vm_end = addr + len;
-@@ -1195,6 +1326,19 @@ munmap_back:
- error = file->f_op->mmap(file, vma);
- if (error)
- goto unmap_and_free_vma;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (vma_m && (vm_flags & VM_EXECUTABLE))
-+ added_exe_file_vma(mm);
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
-+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && !(vma->vm_flags & VM_SPECIAL)) {
-+ vma->vm_flags |= VM_PAGEEXEC;
-+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
-+ }
-+#endif
-+
- if (vm_flags & VM_EXECUTABLE)
- added_exe_file_vma(mm);
-
-@@ -1218,6 +1362,11 @@ munmap_back:
- vma_link(mm, vma, prev, rb_link, rb_parent);
- file = vma->vm_file;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (vma_m)
-+ pax_mirror_vma(vma_m, vma);
-+#endif
-+
- /* Once vma denies write, undo our temporary denial count */
- if (correct_wcount)
- atomic_inc(&inode->i_writecount);
-@@ -1226,6 +1375,7 @@ out:
-
- mm->total_vm += len >> PAGE_SHIFT;
- vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
-+ track_exec_limit(mm, addr, addr + len, vm_flags);
- if (vm_flags & VM_LOCKED) {
- /*
- * makes pages present; downgrades, drops, reacquires mmap_sem
-@@ -1248,6 +1398,12 @@ unmap_and_free_vma:
- unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
- charged = 0;
- free_vma:
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (vma_m)
-+ kmem_cache_free(vm_area_cachep, vma_m);
-+#endif
-+
- kmem_cache_free(vm_area_cachep, vma);
- unacct_error:
- if (charged)
-@@ -1255,6 +1411,44 @@ unacct_error:
- return error;
- }
-
-+bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len)
-+{
-+ if (!vma) {
-+#ifdef CONFIG_STACK_GROWSUP
-+ if (addr > sysctl_heap_stack_gap)
-+ vma = find_vma(current->mm, addr - sysctl_heap_stack_gap);
-+ else
-+ vma = find_vma(current->mm, 0);
-+ if (vma && (vma->vm_flags & VM_GROWSUP))
-+ return false;
-+#endif
-+ return true;
-+ }
-+
-+ if (addr + len > vma->vm_start)
-+ return false;
-+
-+ if (vma->vm_flags & VM_GROWSDOWN)
-+ return sysctl_heap_stack_gap <= vma->vm_start - addr - len;
-+#ifdef CONFIG_STACK_GROWSUP
-+ else if (vma->vm_prev && (vma->vm_prev->vm_flags & VM_GROWSUP))
-+ return addr - vma->vm_prev->vm_end <= sysctl_heap_stack_gap;
-+#endif
-+
-+ return true;
-+}
-+
-+unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len)
-+{
-+ if (vma->vm_start < len)
-+ return -ENOMEM;
-+ if (!(vma->vm_flags & VM_GROWSDOWN))
-+ return vma->vm_start - len;
-+ if (sysctl_heap_stack_gap <= vma->vm_start - len)
-+ return vma->vm_start - len - sysctl_heap_stack_gap;
-+ return -ENOMEM;
-+}
-+
- /* Get an address range which is currently unmapped.
- * For shmat() with addr=0.
- *
-@@ -1281,18 +1475,23 @@ arch_get_unmapped_area(struct file *filp
- if (flags & MAP_FIXED)
- return addr;
-
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- if (addr) {
- addr = PAGE_ALIGN(addr);
-- vma = find_vma(mm, addr);
-- if (TASK_SIZE - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-- return addr;
-+ if (TASK_SIZE - len >= addr) {
-+ vma = find_vma(mm, addr);
-+ if (check_heap_stack_gap(vma, addr, len))
-+ return addr;
-+ }
- }
- if (len > mm->cached_hole_size) {
-- start_addr = addr = mm->free_area_cache;
-+ start_addr = addr = mm->free_area_cache;
- } else {
-- start_addr = addr = TASK_UNMAPPED_BASE;
-- mm->cached_hole_size = 0;
-+ start_addr = addr = mm->mmap_base;
-+ mm->cached_hole_size = 0;
- }
-
- full_search:
-@@ -1303,34 +1502,40 @@ full_search:
- * Start a new search - just in case we missed
- * some holes.
- */
-- if (start_addr != TASK_UNMAPPED_BASE) {
-- addr = TASK_UNMAPPED_BASE;
-- start_addr = addr;
-+ if (start_addr != mm->mmap_base) {
-+ start_addr = addr = mm->mmap_base;
- mm->cached_hole_size = 0;
- goto full_search;
- }
- return -ENOMEM;
- }
-- if (!vma || addr + len <= vma->vm_start) {
-- /*
-- * Remember the place where we stopped the search:
-- */
-- mm->free_area_cache = addr + len;
-- return addr;
-- }
-+ if (check_heap_stack_gap(vma, addr, len))
-+ break;
- if (addr + mm->cached_hole_size < vma->vm_start)
- mm->cached_hole_size = vma->vm_start - addr;
- addr = vma->vm_end;
- }
-+
-+ /*
-+ * Remember the place where we stopped the search:
-+ */
-+ mm->free_area_cache = addr + len;
-+ return addr;
- }
- #endif
-
- void arch_unmap_area(struct mm_struct *mm, unsigned long addr)
- {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
-+ return;
-+#endif
-+
- /*
- * Is this a new hole at the lowest possible address?
- */
-- if (addr >= TASK_UNMAPPED_BASE && addr < mm->free_area_cache) {
-+ if (addr >= mm->mmap_base && addr < mm->free_area_cache) {
- mm->free_area_cache = addr;
- mm->cached_hole_size = ~0UL;
- }
-@@ -1348,7 +1553,7 @@ arch_get_unmapped_area_topdown(struct fi
- {
- struct vm_area_struct *vma;
- struct mm_struct *mm = current->mm;
-- unsigned long addr = addr0;
-+ unsigned long base = mm->mmap_base, addr = addr0;
-
- /* requested length too big for entire address space */
- if (len > TASK_SIZE)
-@@ -1357,13 +1562,18 @@ arch_get_unmapped_area_topdown(struct fi
- if (flags & MAP_FIXED)
- return addr;
-
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- /* requesting a specific address */
- if (addr) {
- addr = PAGE_ALIGN(addr);
-- vma = find_vma(mm, addr);
-- if (TASK_SIZE - len >= addr &&
-- (!vma || addr + len <= vma->vm_start))
-- return addr;
-+ if (TASK_SIZE - len >= addr) {
-+ vma = find_vma(mm, addr);
-+ if (check_heap_stack_gap(vma, addr, len))
-+ return addr;
-+ }
- }
-
- /* check if free_area_cache is useful for us */
-@@ -1378,7 +1588,7 @@ arch_get_unmapped_area_topdown(struct fi
- /* make sure it can fit in the remaining address space */
- if (addr > len) {
- vma = find_vma(mm, addr-len);
-- if (!vma || addr <= vma->vm_start)
-+ if (check_heap_stack_gap(vma, addr - len, len))
- /* remember the address as a hint for next time */
- return (mm->free_area_cache = addr-len);
- }
-@@ -1395,7 +1605,7 @@ arch_get_unmapped_area_topdown(struct fi
- * return with success:
- */
- vma = find_vma(mm, addr);
-- if (!vma || addr+len <= vma->vm_start)
-+ if (check_heap_stack_gap(vma, addr, len))
- /* remember the address as a hint for next time */
- return (mm->free_area_cache = addr);
-
-@@ -1404,8 +1614,8 @@ arch_get_unmapped_area_topdown(struct fi
- mm->cached_hole_size = vma->vm_start - addr;
-
- /* try just below the current vma->vm_start */
-- addr = vma->vm_start-len;
-- } while (len < vma->vm_start);
-+ addr = skip_heap_stack_gap(vma, len);
-+ } while (!IS_ERR_VALUE(addr));
-
- bottomup:
- /*
-@@ -1414,13 +1624,21 @@ bottomup:
- * can happen with large stack limits and large mmap()
- * allocations.
- */
-+ mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base += mm->delta_mmap;
-+#endif
-+
-+ mm->free_area_cache = mm->mmap_base;
- mm->cached_hole_size = ~0UL;
-- mm->free_area_cache = TASK_UNMAPPED_BASE;
- addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
- /*
- * Restore the topdown base:
- */
-- mm->free_area_cache = mm->mmap_base;
-+ mm->mmap_base = base;
-+ mm->free_area_cache = base;
- mm->cached_hole_size = ~0UL;
-
- return addr;
-@@ -1429,6 +1647,12 @@ bottomup:
-
- void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
- {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
-+ return;
-+#endif
-+
- /*
- * Is this a new hole at the highest possible address?
- */
-@@ -1436,8 +1660,10 @@ void arch_unmap_area_topdown(struct mm_s
- mm->free_area_cache = addr;
-
- /* dont allow allocations above current base */
-- if (mm->free_area_cache > mm->mmap_base)
-+ if (mm->free_area_cache > mm->mmap_base) {
- mm->free_area_cache = mm->mmap_base;
-+ mm->cached_hole_size = ~0UL;
-+ }
- }
-
- unsigned long
-@@ -1545,6 +1771,27 @@ out:
- return prev ? prev->vm_next : vma;
- }
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma)
-+{
-+ struct vm_area_struct *vma_m;
-+
-+ BUG_ON(!vma || vma->vm_start >= vma->vm_end);
-+ if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC)) {
-+ BUG_ON(vma->vm_mirror);
-+ return NULL;
-+ }
-+ BUG_ON(vma->vm_start < SEGMEXEC_TASK_SIZE && SEGMEXEC_TASK_SIZE < vma->vm_end);
-+ vma_m = vma->vm_mirror;
-+ BUG_ON(!vma_m || vma_m->vm_mirror != vma);
-+ BUG_ON(vma->vm_file != vma_m->vm_file);
-+ BUG_ON(vma->vm_end - vma->vm_start != vma_m->vm_end - vma_m->vm_start);
-+ BUG_ON(vma->vm_pgoff != vma_m->vm_pgoff || vma->anon_vma != vma_m->anon_vma);
-+ BUG_ON((vma->vm_flags ^ vma_m->vm_flags) & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED | VM_RESERVED));
-+ return vma_m;
-+}
-+#endif
-+
- /*
- * Verify that the stack growth is acceptable and
- * update accounting. This is shared with both the
-@@ -1561,6 +1808,7 @@ static int acct_stack_growth(struct vm_a
- return -ENOMEM;
-
- /* Stack limit test */
-+ gr_learn_resource(current, RLIMIT_STACK, size, 1);
- if (size > rlim[RLIMIT_STACK].rlim_cur)
- return -ENOMEM;
-
-@@ -1570,6 +1818,7 @@ static int acct_stack_growth(struct vm_a
- unsigned long limit;
- locked = mm->locked_vm + grow;
- limit = rlim[RLIMIT_MEMLOCK].rlim_cur >> PAGE_SHIFT;
-+ gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
- if (locked > limit && !capable(CAP_IPC_LOCK))
- return -ENOMEM;
- }
-@@ -1600,37 +1849,48 @@ static int acct_stack_growth(struct vm_a
- * PA-RISC uses this for its stack; IA64 for its Register Backing Store.
- * vma is the last one with address > vma->vm_end. Have to extend vma.
- */
-+#ifndef CONFIG_IA64
-+static
-+#endif
- int expand_upwards(struct vm_area_struct *vma, unsigned long address)
- {
- int error;
-+ bool locknext;
-
- if (!(vma->vm_flags & VM_GROWSUP))
- return -EFAULT;
-
-+ /* Also guard against wrapping around to address 0. */
-+ if (address < PAGE_ALIGN(address+1))
-+ address = PAGE_ALIGN(address+1);
-+ else
-+ return -ENOMEM;
-+
- /*
- * We must make sure the anon_vma is allocated
- * so that the anon_vma locking is not a noop.
- */
- if (unlikely(anon_vma_prepare(vma)))
- return -ENOMEM;
-+ locknext = vma->vm_next && (vma->vm_next->vm_flags & VM_GROWSDOWN);
-+ if (locknext && anon_vma_prepare(vma->vm_next))
-+ return -ENOMEM;
- anon_vma_lock(vma);
-+ if (locknext)
-+ anon_vma_lock(vma->vm_next);
-
- /*
- * vma->vm_start/vm_end cannot change under us because the caller
- * is required to hold the mmap_sem in read mode. We need the
-- * anon_vma lock to serialize against concurrent expand_stacks.
-- * Also guard against wrapping around to address 0.
-+ * anon_vma locks to serialize against concurrent expand_stacks
-+ * and expand_upwards.
- */
-- if (address < PAGE_ALIGN(address+4))
-- address = PAGE_ALIGN(address+4);
-- else {
-- anon_vma_unlock(vma);
-- return -ENOMEM;
-- }
- error = 0;
-
- /* Somebody else might have raced and expanded it already */
-- if (address > vma->vm_end) {
-+ if (vma->vm_next && (vma->vm_next->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && vma->vm_next->vm_start - address < sysctl_heap_stack_gap)
-+ error = -ENOMEM;
-+ else if (address > vma->vm_end && (!locknext || vma->vm_next->vm_start >= address)) {
- unsigned long size, grow;
-
- size = address - vma->vm_start;
-@@ -1640,6 +1900,8 @@ int expand_upwards(struct vm_area_struct
- if (!error)
- vma->vm_end = address;
- }
-+ if (locknext)
-+ anon_vma_unlock(vma->vm_next);
- anon_vma_unlock(vma);
- return error;
- }
-@@ -1652,6 +1914,8 @@ static int expand_downwards(struct vm_ar
- unsigned long address)
- {
- int error;
-+ bool lockprev = false;
-+ struct vm_area_struct *prev;
-
- /*
- * We must make sure the anon_vma is allocated
-@@ -1665,6 +1929,15 @@ static int expand_downwards(struct vm_ar
- if (error)
- return error;
-
-+ prev = vma->vm_prev;
-+#if defined(CONFIG_STACK_GROWSUP) || defined(CONFIG_IA64)
-+ lockprev = prev && (prev->vm_flags & VM_GROWSUP);
-+#endif
-+ if (lockprev && anon_vma_prepare(prev))
-+ return -ENOMEM;
-+ if (lockprev)
-+ anon_vma_lock(prev);
-+
- anon_vma_lock(vma);
-
- /*
-@@ -1674,9 +1947,17 @@ static int expand_downwards(struct vm_ar
- */
-
- /* Somebody else might have raced and expanded it already */
-- if (address < vma->vm_start) {
-+ if (prev && (prev->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && address - prev->vm_end < sysctl_heap_stack_gap)
-+ error = -ENOMEM;
-+ else if (address < vma->vm_start && (!lockprev || prev->vm_end <= address)) {
- unsigned long size, grow;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m;
-+
-+ vma_m = pax_find_mirror_vma(vma);
-+#endif
-+
- size = vma->vm_end - address;
- grow = (vma->vm_start - address) >> PAGE_SHIFT;
-
-@@ -1684,9 +1965,20 @@ static int expand_downwards(struct vm_ar
- if (!error) {
- vma->vm_start = address;
- vma->vm_pgoff -= grow;
-+ track_exec_limit(vma->vm_mm, vma->vm_start, vma->vm_end, vma->vm_flags);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (vma_m) {
-+ vma_m->vm_start -= grow << PAGE_SHIFT;
-+ vma_m->vm_pgoff -= grow;
-+ }
-+#endif
-+
- }
- }
- anon_vma_unlock(vma);
-+ if (lockprev)
-+ anon_vma_unlock(prev);
- return error;
- }
-
-@@ -1762,6 +2054,13 @@ static void remove_vma_list(struct mm_st
- do {
- long nrpages = vma_pages(vma);
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE)) {
-+ vma = remove_vma(vma);
-+ continue;
-+ }
-+#endif
-+
- mm->total_vm -= nrpages;
- vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
- vma = remove_vma(vma);
-@@ -1807,6 +2106,16 @@ detach_vmas_to_be_unmapped(struct mm_str
- insertion_point = (prev ? &prev->vm_next : &mm->mmap);
- vma->vm_prev = NULL;
- do {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (vma->vm_mirror) {
-+ BUG_ON(!vma->vm_mirror->vm_mirror || vma->vm_mirror->vm_mirror != vma);
-+ vma->vm_mirror->vm_mirror = NULL;
-+ vma->vm_mirror->vm_flags &= ~VM_EXEC;
-+ vma->vm_mirror = NULL;
-+ }
-+#endif
-+
- rb_erase(&vma->vm_rb, &mm->mm_rb);
- mm->map_count--;
- tail_vma = vma;
-@@ -1834,10 +2143,25 @@ int split_vma(struct mm_struct * mm, str
- struct mempolicy *pol;
- struct vm_area_struct *new;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m, *new_m = NULL;
-+ unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE;
-+#endif
-+
- if (is_vm_hugetlb_page(vma) && (addr &
- ~(huge_page_mask(hstate_vma(vma)))))
- return -EINVAL;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ vma_m = pax_find_mirror_vma(vma);
-+
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC) {
-+ BUG_ON(vma->vm_end > SEGMEXEC_TASK_SIZE);
-+ if (mm->map_count >= sysctl_max_map_count-1)
-+ return -ENOMEM;
-+ } else
-+#endif
-+
- if (mm->map_count >= sysctl_max_map_count)
- return -ENOMEM;
-
-@@ -1845,6 +2169,16 @@ int split_vma(struct mm_struct * mm, str
- if (!new)
- return -ENOMEM;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (vma_m) {
-+ new_m = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
-+ if (!new_m) {
-+ kmem_cache_free(vm_area_cachep, new);
-+ return -ENOMEM;
-+ }
-+ }
-+#endif
-+
- /* most fields are the same, copy all, and then fixup */
- *new = *vma;
-
-@@ -1855,8 +2189,29 @@ int split_vma(struct mm_struct * mm, str
- new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
- }
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (vma_m) {
-+ *new_m = *vma_m;
-+ new_m->vm_mirror = new;
-+ new->vm_mirror = new_m;
-+
-+ if (new_below)
-+ new_m->vm_end = addr_m;
-+ else {
-+ new_m->vm_start = addr_m;
-+ new_m->vm_pgoff += ((addr_m - vma_m->vm_start) >> PAGE_SHIFT);
-+ }
-+ }
-+#endif
-+
- pol = mpol_dup(vma_policy(vma));
- if (IS_ERR(pol)) {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (new_m)
-+ kmem_cache_free(vm_area_cachep, new_m);
-+#endif
-+
- kmem_cache_free(vm_area_cachep, new);
- return PTR_ERR(pol);
- }
-@@ -1877,6 +2232,28 @@ int split_vma(struct mm_struct * mm, str
- else
- vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (vma_m) {
-+ mpol_get(pol);
-+ vma_set_policy(new_m, pol);
-+
-+ if (new_m->vm_file) {
-+ get_file(new_m->vm_file);
-+ if (vma_m->vm_flags & VM_EXECUTABLE)
-+ added_exe_file_vma(mm);
-+ }
-+
-+ if (new_m->vm_ops && new_m->vm_ops->open)
-+ new_m->vm_ops->open(new_m);
-+
-+ if (new_below)
-+ vma_adjust(vma_m, addr_m, vma_m->vm_end, vma_m->vm_pgoff +
-+ ((addr_m - new_m->vm_start) >> PAGE_SHIFT), new_m);
-+ else
-+ vma_adjust(vma_m, vma_m->vm_start, addr_m, vma_m->vm_pgoff, new_m);
-+ }
-+#endif
-+
- return 0;
- }
-
-@@ -1885,11 +2262,30 @@ int split_vma(struct mm_struct * mm, str
- * work. This now handles partial unmappings.
- * Jeremy Fitzhardinge <jeremy@goop.org>
- */
-+#ifdef CONFIG_PAX_SEGMEXEC
-+int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
-+{
-+ int ret = __do_munmap(mm, start, len);
-+ if (ret || !(mm->pax_flags & MF_PAX_SEGMEXEC))
-+ return ret;
-+
-+ return __do_munmap(mm, start + SEGMEXEC_TASK_SIZE, len);
-+}
-+
-+int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
-+#else
- int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
-+#endif
- {
- unsigned long end;
- struct vm_area_struct *vma, *prev, *last;
-
-+ /*
-+ * mm->mmap_sem is required to protect against another thread
-+ * changing the mappings in case we sleep.
-+ */
-+ verify_mm_writelocked(mm);
-+
- if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
- return -EINVAL;
-
-@@ -1953,6 +2349,8 @@ int do_munmap(struct mm_struct *mm, unsi
- /* Fix up all other VM information */
- remove_vma_list(mm, vma);
-
-+ track_exec_limit(mm, start, end, 0UL);
-+
- return 0;
- }
-
-@@ -1965,22 +2363,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, a
-
- profile_munmap(addr);
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) &&
-+ (len > SEGMEXEC_TASK_SIZE || addr > SEGMEXEC_TASK_SIZE-len))
-+ return -EINVAL;
-+#endif
-+
- down_write(&mm->mmap_sem);
- ret = do_munmap(mm, addr, len);
- up_write(&mm->mmap_sem);
- return ret;
- }
-
--static inline void verify_mm_writelocked(struct mm_struct *mm)
--{
--#ifdef CONFIG_DEBUG_VM
-- if (unlikely(down_read_trylock(&mm->mmap_sem))) {
-- WARN_ON(1);
-- up_read(&mm->mmap_sem);
-- }
--#endif
--}
--
- /*
- * this is really a simplified "do_mmap". it only handles
- * anonymous maps. eventually we may be able to do some
-@@ -1994,6 +2388,7 @@ unsigned long do_brk(unsigned long addr,
- struct rb_node ** rb_link, * rb_parent;
- pgoff_t pgoff = addr >> PAGE_SHIFT;
- int error;
-+ unsigned long charged;
-
- len = PAGE_ALIGN(len);
- if (!len)
-@@ -2005,16 +2400,30 @@ unsigned long do_brk(unsigned long addr,
-
- flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
-
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+ if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+ flags &= ~VM_EXEC;
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (mm->pax_flags & MF_PAX_MPROTECT)
-+ flags &= ~VM_MAYEXEC;
-+#endif
-+
-+ }
-+#endif
-+
- error = get_unmapped_area(NULL, addr, len, 0, MAP_FIXED);
- if (error & ~PAGE_MASK)
- return error;
-
-+ charged = len >> PAGE_SHIFT;
-+
- /*
- * mlock MCL_FUTURE?
- */
- if (mm->def_flags & VM_LOCKED) {
- unsigned long locked, lock_limit;
-- locked = len >> PAGE_SHIFT;
-+ locked = charged;
- locked += mm->locked_vm;
- lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
- lock_limit >>= PAGE_SHIFT;
-@@ -2031,22 +2440,22 @@ unsigned long do_brk(unsigned long addr,
- /*
- * Clear old maps. this also does some error checking for us
- */
-- munmap_back:
- vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
- if (vma && vma->vm_start < addr + len) {
- if (do_munmap(mm, addr, len))
- return -ENOMEM;
-- goto munmap_back;
-+ vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
-+ BUG_ON(vma && vma->vm_start < addr + len);
- }
-
- /* Check against address space limits *after* clearing old maps... */
-- if (!may_expand_vm(mm, len >> PAGE_SHIFT))
-+ if (!may_expand_vm(mm, charged))
- return -ENOMEM;
-
- if (mm->map_count > sysctl_max_map_count)
- return -ENOMEM;
-
-- if (security_vm_enough_memory(len >> PAGE_SHIFT))
-+ if (security_vm_enough_memory(charged))
- return -ENOMEM;
-
- /* Can we just expand an old private anonymous mapping? */
-@@ -2060,7 +2469,7 @@ unsigned long do_brk(unsigned long addr,
- */
- vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
- if (!vma) {
-- vm_unacct_memory(len >> PAGE_SHIFT);
-+ vm_unacct_memory(charged);
- return -ENOMEM;
- }
-
-@@ -2072,11 +2481,12 @@ unsigned long do_brk(unsigned long addr,
- vma->vm_page_prot = vm_get_page_prot(flags);
- vma_link(mm, vma, prev, rb_link, rb_parent);
- out:
-- mm->total_vm += len >> PAGE_SHIFT;
-+ mm->total_vm += charged;
- if (flags & VM_LOCKED) {
- if (!mlock_vma_pages_range(vma, addr, addr + len))
-- mm->locked_vm += (len >> PAGE_SHIFT);
-+ mm->locked_vm += charged;
- }
-+ track_exec_limit(mm, addr, addr + len, flags);
- return addr;
- }
-
-@@ -2123,8 +2533,10 @@ void exit_mmap(struct mm_struct *mm)
- * Walk the list again, actually closing and freeing it,
- * with preemption enabled, without holding any MM locks.
- */
-- while (vma)
-+ while (vma) {
-+ vma->vm_mirror = NULL;
- vma = remove_vma(vma);
-+ }
-
- BUG_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT);
- }
-@@ -2138,6 +2550,10 @@ int insert_vm_struct(struct mm_struct *
- struct vm_area_struct * __vma, * prev;
- struct rb_node ** rb_link, * rb_parent;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m = NULL;
-+#endif
-+
- /*
- * The vm_pgoff of a purely anonymous vma should be irrelevant
- * until its first write fault, when page's anon_vma and index
-@@ -2160,7 +2576,22 @@ int insert_vm_struct(struct mm_struct *
- if ((vma->vm_flags & VM_ACCOUNT) &&
- security_vm_enough_memory_mm(mm, vma_pages(vma)))
- return -ENOMEM;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_EXEC)) {
-+ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
-+ if (!vma_m)
-+ return -ENOMEM;
-+ }
-+#endif
-+
- vma_link(mm, vma, prev, rb_link, rb_parent);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (vma_m)
-+ pax_mirror_vma(vma_m, vma);
-+#endif
-+
- return 0;
- }
-
-@@ -2178,6 +2609,8 @@ struct vm_area_struct *copy_vma(struct v
- struct rb_node **rb_link, *rb_parent;
- struct mempolicy *pol;
-
-+ BUG_ON(vma->vm_mirror);
-+
- /*
- * If anonymous vma has not yet been faulted, update new pgoff
- * to match new location, to increase its chance of merging.
-@@ -2221,6 +2654,35 @@ struct vm_area_struct *copy_vma(struct v
- return new_vma;
- }
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+void pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma)
-+{
-+ struct vm_area_struct *prev_m;
-+ struct rb_node **rb_link_m, *rb_parent_m;
-+ struct mempolicy *pol_m;
-+
-+ BUG_ON(!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC));
-+ BUG_ON(vma->vm_mirror || vma_m->vm_mirror);
-+ BUG_ON(!mpol_equal(vma_policy(vma), vma_policy(vma_m)));
-+ *vma_m = *vma;
-+ pol_m = vma_policy(vma_m);
-+ mpol_get(pol_m);
-+ vma_set_policy(vma_m, pol_m);
-+ vma_m->vm_start += SEGMEXEC_TASK_SIZE;
-+ vma_m->vm_end += SEGMEXEC_TASK_SIZE;
-+ vma_m->vm_flags &= ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED);
-+ vma_m->vm_page_prot = vm_get_page_prot(vma_m->vm_flags);
-+ if (vma_m->vm_file)
-+ get_file(vma_m->vm_file);
-+ if (vma_m->vm_ops && vma_m->vm_ops->open)
-+ vma_m->vm_ops->open(vma_m);
-+ find_vma_prepare(vma->vm_mm, vma_m->vm_start, &prev_m, &rb_link_m, &rb_parent_m);
-+ vma_link(vma->vm_mm, vma_m, prev_m, rb_link_m, rb_parent_m);
-+ vma_m->vm_mirror = vma;
-+ vma->vm_mirror = vma_m;
-+}
-+#endif
-+
- /*
- * Return true if the calling process may expand its vm space by the passed
- * number of pages
-@@ -2231,7 +2693,7 @@ int may_expand_vm(struct mm_struct *mm,
- unsigned long lim;
-
- lim = current->signal->rlim[RLIMIT_AS].rlim_cur >> PAGE_SHIFT;
--
-+ gr_learn_resource(current, RLIMIT_AS, (cur + npages) << PAGE_SHIFT, 1);
- if (cur + npages > lim)
- return 0;
- return 1;
-@@ -2301,6 +2763,22 @@ int install_special_mapping(struct mm_st
- vma->vm_start = addr;
- vma->vm_end = addr + len;
-
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (mm->pax_flags & MF_PAX_MPROTECT) {
-+#ifndef CONFIG_PAX_MPROTECT_COMPAT
-+ if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC))
-+ return -EPERM;
-+ if (!(vm_flags & VM_EXEC))
-+ vm_flags &= ~VM_MAYEXEC;
-+#else
-+ if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
-+ vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
-+#endif
-+ else
-+ vm_flags &= ~VM_MAYWRITE;
-+ }
-+#endif
-+
- vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND;
- vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
-
-diff -urNp linux-2.6.32.45/mm/mprotect.c linux-2.6.32.45/mm/mprotect.c
---- linux-2.6.32.45/mm/mprotect.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/mm/mprotect.c 2011-04-17 15:56:46.000000000 -0400
-@@ -24,10 +24,16 @@
- #include <linux/mmu_notifier.h>
- #include <linux/migrate.h>
- #include <linux/perf_event.h>
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+#include <linux/elf.h>
-+#endif
-+
- #include <asm/uaccess.h>
- #include <asm/pgtable.h>
- #include <asm/cacheflush.h>
- #include <asm/tlbflush.h>
-+#include <asm/mmu_context.h>
-
- #ifndef pgprot_modify
- static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
-@@ -132,6 +138,48 @@ static void change_protection(struct vm_
- flush_tlb_range(vma, start, end);
- }
-
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+/* called while holding the mmap semaphor for writing except stack expansion */
-+void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot)
-+{
-+ unsigned long oldlimit, newlimit = 0UL;
-+
-+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || nx_enabled)
-+ return;
-+
-+ spin_lock(&mm->page_table_lock);
-+ oldlimit = mm->context.user_cs_limit;
-+ if ((prot & VM_EXEC) && oldlimit < end)
-+ /* USER_CS limit moved up */
-+ newlimit = end;
-+ else if (!(prot & VM_EXEC) && start < oldlimit && oldlimit <= end)
-+ /* USER_CS limit moved down */
-+ newlimit = start;
-+
-+ if (newlimit) {
-+ mm->context.user_cs_limit = newlimit;
-+
-+#ifdef CONFIG_SMP
-+ wmb();
-+ cpus_clear(mm->context.cpu_user_cs_mask);
-+ cpu_set(smp_processor_id(), mm->context.cpu_user_cs_mask);
-+#endif
-+
-+ set_user_cs(mm->context.user_cs_base, mm->context.user_cs_limit, smp_processor_id());
-+ }
-+ spin_unlock(&mm->page_table_lock);
-+ if (newlimit == end) {
-+ struct vm_area_struct *vma = find_vma(mm, oldlimit);
-+
-+ for (; vma && vma->vm_start < end; vma = vma->vm_next)
-+ if (is_vm_hugetlb_page(vma))
-+ hugetlb_change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot);
-+ else
-+ change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot, vma_wants_writenotify(vma));
-+ }
-+}
-+#endif
-+
- int
- mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
- unsigned long start, unsigned long end, unsigned long newflags)
-@@ -144,11 +192,29 @@ mprotect_fixup(struct vm_area_struct *vm
- int error;
- int dirty_accountable = 0;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m = NULL;
-+ unsigned long start_m, end_m;
-+
-+ start_m = start + SEGMEXEC_TASK_SIZE;
-+ end_m = end + SEGMEXEC_TASK_SIZE;
-+#endif
-+
- if (newflags == oldflags) {
- *pprev = vma;
- return 0;
- }
-
-+ if (newflags & (VM_READ | VM_WRITE | VM_EXEC)) {
-+ struct vm_area_struct *prev = vma->vm_prev, *next = vma->vm_next;
-+
-+ if (next && (next->vm_flags & VM_GROWSDOWN) && sysctl_heap_stack_gap > next->vm_start - end)
-+ return -ENOMEM;
-+
-+ if (prev && (prev->vm_flags & VM_GROWSUP) && sysctl_heap_stack_gap > start - prev->vm_end)
-+ return -ENOMEM;
-+ }
-+
- /*
- * If we make a private mapping writable we increase our commit;
- * but (without finer accounting) cannot reduce our commit if we
-@@ -165,6 +231,38 @@ mprotect_fixup(struct vm_area_struct *vm
- }
- }
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && ((oldflags ^ newflags) & VM_EXEC)) {
-+ if (start != vma->vm_start) {
-+ error = split_vma(mm, vma, start, 1);
-+ if (error)
-+ goto fail;
-+ BUG_ON(!*pprev || (*pprev)->vm_next == vma);
-+ *pprev = (*pprev)->vm_next;
-+ }
-+
-+ if (end != vma->vm_end) {
-+ error = split_vma(mm, vma, end, 0);
-+ if (error)
-+ goto fail;
-+ }
-+
-+ if (pax_find_mirror_vma(vma)) {
-+ error = __do_munmap(mm, start_m, end_m - start_m);
-+ if (error)
-+ goto fail;
-+ } else {
-+ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
-+ if (!vma_m) {
-+ error = -ENOMEM;
-+ goto fail;
-+ }
-+ vma->vm_flags = newflags;
-+ pax_mirror_vma(vma_m, vma);
-+ }
-+ }
-+#endif
-+
- /*
- * First try to merge with previous and/or next vma.
- */
-@@ -195,9 +293,21 @@ success:
- * vm_flags and vm_page_prot are protected by the mmap_sem
- * held in write mode.
- */
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (newflags & VM_EXEC) && ((vma->vm_flags ^ newflags) & VM_READ))
-+ pax_find_mirror_vma(vma)->vm_flags ^= VM_READ;
-+#endif
-+
- vma->vm_flags = newflags;
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (mm->binfmt && mm->binfmt->handle_mprotect)
-+ mm->binfmt->handle_mprotect(vma, newflags);
-+#endif
-+
- vma->vm_page_prot = pgprot_modify(vma->vm_page_prot,
-- vm_get_page_prot(newflags));
-+ vm_get_page_prot(vma->vm_flags));
-
- if (vma_wants_writenotify(vma)) {
- vma->vm_page_prot = vm_get_page_prot(newflags & ~VM_SHARED);
-@@ -239,6 +349,17 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
- end = start + len;
- if (end <= start)
- return -ENOMEM;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
-+ if (end > SEGMEXEC_TASK_SIZE)
-+ return -EINVAL;
-+ } else
-+#endif
-+
-+ if (end > TASK_SIZE)
-+ return -EINVAL;
-+
- if (!arch_validate_prot(prot))
- return -EINVAL;
-
-@@ -246,7 +367,7 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
- /*
- * Does the application expect PROT_READ to imply PROT_EXEC:
- */
-- if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
-+ if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
- prot |= PROT_EXEC;
-
- vm_flags = calc_vm_prot_bits(prot);
-@@ -278,6 +399,11 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
- if (start > vma->vm_start)
- prev = vma;
-
-+#ifdef CONFIG_PAX_MPROTECT
-+ if (current->mm->binfmt && current->mm->binfmt->handle_mprotect)
-+ current->mm->binfmt->handle_mprotect(vma, vm_flags);
-+#endif
-+
- for (nstart = start ; ; ) {
- unsigned long newflags;
-
-@@ -287,6 +413,14 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
-
- /* newflags >> 4 shift VM_MAY% in place of VM_% */
- if ((newflags & ~(newflags >> 4)) & (VM_READ | VM_WRITE | VM_EXEC)) {
-+ if (prot & (PROT_WRITE | PROT_EXEC))
-+ gr_log_rwxmprotect(vma->vm_file);
-+
-+ error = -EACCES;
-+ goto out;
-+ }
-+
-+ if (!gr_acl_handle_mprotect(vma->vm_file, prot)) {
- error = -EACCES;
- goto out;
- }
-@@ -301,6 +435,9 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
- error = mprotect_fixup(vma, &prev, nstart, tmp, newflags);
- if (error)
- goto out;
-+
-+ track_exec_limit(current->mm, nstart, tmp, vm_flags);
-+
- nstart = tmp;
-
- if (nstart < prev->vm_end)
-diff -urNp linux-2.6.32.45/mm/mremap.c linux-2.6.32.45/mm/mremap.c
---- linux-2.6.32.45/mm/mremap.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.45/mm/mremap.c 2011-04-17 17:03:58.000000000 -0400
-@@ -112,6 +112,12 @@ static void move_ptes(struct vm_area_str
- continue;
- pte = ptep_clear_flush(vma, old_addr, old_pte);
- pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
-+
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+ if (!nx_enabled && (new_vma->vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC)
-+ pte = pte_exprotect(pte);
-+#endif
-+
- set_pte_at(mm, new_addr, new_pte, pte);
- }
-
-@@ -271,6 +277,11 @@ static struct vm_area_struct *vma_to_res
- if (is_vm_hugetlb_page(vma))
- goto Einval;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (pax_find_mirror_vma(vma))
-+ goto Einval;
-+#endif
-+
- /* We can't remap across vm area boundaries */
- if (old_len > vma->vm_end - addr)
- goto Efault;
-@@ -327,20 +338,25 @@ static unsigned long mremap_to(unsigned
- unsigned long ret = -EINVAL;
- unsigned long charged = 0;
- unsigned long map_flags;
-+ unsigned long pax_task_size = TASK_SIZE;
-
- if (new_addr & ~PAGE_MASK)
- goto out;
-
-- if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len)
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+ pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+ pax_task_size -= PAGE_SIZE;
-+
-+ if (new_len > TASK_SIZE || new_addr > pax_task_size - new_len)
- goto out;
-
- /* Check if the location we're moving into overlaps the
- * old location at all, and fail if it does.
- */
-- if ((new_addr <= addr) && (new_addr+new_len) > addr)
-- goto out;
--
-- if ((addr <= new_addr) && (addr+old_len) > new_addr)
-+ if (addr + old_len > new_addr && new_addr + new_len > addr)
- goto out;
-
- ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
-@@ -412,6 +428,7 @@ unsigned long do_mremap(unsigned long ad
- struct vm_area_struct *vma;
- unsigned long ret = -EINVAL;
- unsigned long charged = 0;
-+ unsigned long pax_task_size = TASK_SIZE;
-
- if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
- goto out;
-@@ -430,6 +447,17 @@ unsigned long do_mremap(unsigned long ad
- if (!new_len)
- goto out;
-
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+ pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+ pax_task_size -= PAGE_SIZE;
-+
-+ if (new_len > pax_task_size || addr > pax_task_size-new_len ||
-+ old_len > pax_task_size || addr > pax_task_size-old_len)
-+ goto out;
-+
- if (flags & MREMAP_FIXED) {
- if (flags & MREMAP_MAYMOVE)
- ret = mremap_to(addr, old_len, new_addr, new_len);
-@@ -476,6 +504,7 @@ unsigned long do_mremap(unsigned long ad
- addr + new_len);
- }
- ret = addr;
-+ track_exec_limit(vma->vm_mm, vma->vm_start, addr + new_len, vma->vm_flags);
- goto out;
- }
- }
-@@ -502,7 +531,13 @@ unsigned long do_mremap(unsigned long ad
- ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
- if (ret)
- goto out;
-+
-+ map_flags = vma->vm_flags;
- ret = move_vma(vma, addr, old_len, new_len, new_addr);
-+ if (!(ret & ~PAGE_MASK)) {
-+ track_exec_limit(current->mm, addr, addr + old_len, 0UL);
-+ track_exec_limit(current->mm, new_addr, new_addr + new_len, map_flags);
-+ }
- }
- out:
- if (ret & ~PAGE_MASK)
-diff -urNp linux-2.6.32.45/mm/nommu.c linux-2.6.32.45/mm/nommu.c
---- linux-2.6.32.45/mm/nommu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/mm/nommu.c 2011-04-17 15:56:46.000000000 -0400
-@@ -67,7 +67,6 @@ int sysctl_overcommit_memory = OVERCOMMI
- int sysctl_overcommit_ratio = 50; /* default is 50% */
- int sysctl_max_map_count = DEFAULT_MAX_MAP_COUNT;
- int sysctl_nr_trim_pages = CONFIG_NOMMU_INITIAL_TRIM_EXCESS;
--int heap_stack_gap = 0;
-
- atomic_long_t mmap_pages_allocated;
-
-@@ -761,15 +760,6 @@ struct vm_area_struct *find_vma(struct m
- EXPORT_SYMBOL(find_vma);
-
- /*
-- * find a VMA
-- * - we don't extend stack VMAs under NOMMU conditions
-- */
--struct vm_area_struct *find_extend_vma(struct mm_struct *mm, unsigned long addr)
--{
-- return find_vma(mm, addr);
--}
--
--/*
- * expand a stack to a given address
- * - not supported under NOMMU conditions
- */
-diff -urNp linux-2.6.32.45/mm/page_alloc.c linux-2.6.32.45/mm/page_alloc.c
---- linux-2.6.32.45/mm/page_alloc.c 2011-06-25 12:55:35.000000000 -0400
-+++ linux-2.6.32.45/mm/page_alloc.c 2011-07-09 09:13:08.000000000 -0400
-@@ -289,7 +289,7 @@ out:
- * This usage means that zero-order pages may not be compound.
- */
-
--static void free_compound_page(struct page *page)
-+void free_compound_page(struct page *page)
- {
- __free_pages_ok(page, compound_order(page));
- }
-@@ -587,6 +587,10 @@ static void __free_pages_ok(struct page
- int bad = 0;
- int wasMlocked = __TestClearPageMlocked(page);
-
-+#ifdef CONFIG_PAX_MEMORY_SANITIZE
-+ unsigned long index = 1UL << order;
-+#endif
-+
- kmemcheck_free_shadow(page, order);
-
- for (i = 0 ; i < (1 << order) ; ++i)
-@@ -599,6 +603,12 @@ static void __free_pages_ok(struct page
- debug_check_no_obj_freed(page_address(page),
- PAGE_SIZE << order);
- }
-+
-+#ifdef CONFIG_PAX_MEMORY_SANITIZE
-+ for (; index; --index)
-+ sanitize_highpage(page + index - 1);
-+#endif
-+
- arch_free_page(page, order);
- kernel_map_pages(page, 1 << order, 0);
-
-@@ -702,8 +712,10 @@ static int prep_new_page(struct page *pa
- arch_alloc_page(page, order);
- kernel_map_pages(page, 1 << order, 1);
-
-+#ifndef CONFIG_PAX_MEMORY_SANITIZE
- if (gfp_flags & __GFP_ZERO)
- prep_zero_page(page, order, gfp_flags);
-+#endif
-
- if (order && (gfp_flags & __GFP_COMP))
- prep_compound_page(page, order);
-@@ -1097,6 +1109,11 @@ static void free_hot_cold_page(struct pa
- debug_check_no_locks_freed(page_address(page), PAGE_SIZE);
- debug_check_no_obj_freed(page_address(page), PAGE_SIZE);
- }
-+
-+#ifdef CONFIG_PAX_MEMORY_SANITIZE
-+ sanitize_highpage(page);
-+#endif
-+
- arch_free_page(page, 0);
- kernel_map_pages(page, 1, 0);
-
-@@ -2179,6 +2196,8 @@ void show_free_areas(void)
- int cpu;
- struct zone *zone;
-
-+ pax_track_stack();
-+
- for_each_populated_zone(zone) {
- show_node(zone);
- printk("%s per-cpu:\n", zone->name);
-@@ -3736,7 +3755,7 @@ static void __init setup_usemap(struct p
- zone->pageblock_flags = alloc_bootmem_node(pgdat, usemapsize);
- }
- #else
--static void inline setup_usemap(struct pglist_data *pgdat,
-+static inline void setup_usemap(struct pglist_data *pgdat,
- struct zone *zone, unsigned long zonesize) {}
- #endif /* CONFIG_SPARSEMEM */
-
-diff -urNp linux-2.6.32.45/mm/percpu.c linux-2.6.32.45/mm/percpu.c
---- linux-2.6.32.45/mm/percpu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/mm/percpu.c 2011-04-17 15:56:46.000000000 -0400
-@@ -115,7 +115,7 @@ static unsigned int pcpu_first_unit_cpu
- static unsigned int pcpu_last_unit_cpu __read_mostly;
-
- /* the address of the first chunk which starts with the kernel static area */
--void *pcpu_base_addr __read_mostly;
-+void *pcpu_base_addr __read_only;
- EXPORT_SYMBOL_GPL(pcpu_base_addr);
-
- static const int *pcpu_unit_map __read_mostly; /* cpu -> unit */
-diff -urNp linux-2.6.32.45/mm/rmap.c linux-2.6.32.45/mm/rmap.c
---- linux-2.6.32.45/mm/rmap.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/mm/rmap.c 2011-04-17 15:56:46.000000000 -0400
-@@ -121,6 +121,17 @@ int anon_vma_prepare(struct vm_area_stru
- /* page_table_lock to protect against threads */
- spin_lock(&mm->page_table_lock);
- if (likely(!vma->anon_vma)) {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ struct vm_area_struct *vma_m = pax_find_mirror_vma(vma);
-+
-+ if (vma_m) {
-+ BUG_ON(vma_m->anon_vma);
-+ vma_m->anon_vma = anon_vma;
-+ list_add_tail(&vma_m->anon_vma_node, &anon_vma->head);
-+ }
-+#endif
-+
- vma->anon_vma = anon_vma;
- list_add_tail(&vma->anon_vma_node, &anon_vma->head);
- allocated = NULL;
-diff -urNp linux-2.6.32.45/mm/shmem.c linux-2.6.32.45/mm/shmem.c
---- linux-2.6.32.45/mm/shmem.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/mm/shmem.c 2011-05-18 20:09:37.000000000 -0400
-@@ -31,7 +31,7 @@
- #include <linux/swap.h>
- #include <linux/ima.h>
-
--static struct vfsmount *shm_mnt;
-+struct vfsmount *shm_mnt;
-
- #ifdef CONFIG_SHMEM
- /*
-@@ -1061,6 +1061,8 @@ static int shmem_writepage(struct page *
- goto unlock;
- }
- entry = shmem_swp_entry(info, index, NULL);
-+ if (!entry)
-+ goto unlock;
- if (entry->val) {
- /*
- * The more uptodate page coming down from a stacked
-@@ -1144,6 +1146,8 @@ static struct page *shmem_swapin(swp_ent
- struct vm_area_struct pvma;
- struct page *page;
-
-+ pax_track_stack();
-+
- spol = mpol_cond_copy(&mpol,
- mpol_shared_policy_lookup(&info->policy, idx));
-
-@@ -1962,7 +1966,7 @@ static int shmem_symlink(struct inode *d
-
- info = SHMEM_I(inode);
- inode->i_size = len-1;
-- if (len <= (char *)inode - (char *)info) {
-+ if (len <= (char *)inode - (char *)info && len <= 64) {
- /* do it inline */
- memcpy(info, symname, len);
- inode->i_op = &shmem_symlink_inline_operations;
-@@ -2310,8 +2314,7 @@ int shmem_fill_super(struct super_block
- int err = -ENOMEM;
-
- /* Round up to L1_CACHE_BYTES to resist false sharing */
-- sbinfo = kzalloc(max((int)sizeof(struct shmem_sb_info),
-- L1_CACHE_BYTES), GFP_KERNEL);
-+ sbinfo = kzalloc(max(sizeof(struct shmem_sb_info), L1_CACHE_BYTES), GFP_KERNEL);
- if (!sbinfo)
- return -ENOMEM;
-
-diff -urNp linux-2.6.32.45/mm/slab.c linux-2.6.32.45/mm/slab.c
---- linux-2.6.32.45/mm/slab.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/mm/slab.c 2011-05-04 17:56:20.000000000 -0400
-@@ -174,7 +174,7 @@
-
- /* Legal flag mask for kmem_cache_create(). */
- #if DEBUG
--# define CREATE_MASK (SLAB_RED_ZONE | \
-+# define CREATE_MASK (SLAB_USERCOPY | SLAB_RED_ZONE | \
- SLAB_POISON | SLAB_HWCACHE_ALIGN | \
- SLAB_CACHE_DMA | \
- SLAB_STORE_USER | \
-@@ -182,7 +182,7 @@
- SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
- SLAB_DEBUG_OBJECTS | SLAB_NOLEAKTRACE | SLAB_NOTRACK)
- #else
--# define CREATE_MASK (SLAB_HWCACHE_ALIGN | \
-+# define CREATE_MASK (SLAB_USERCOPY | SLAB_HWCACHE_ALIGN | \
- SLAB_CACHE_DMA | \
- SLAB_RECLAIM_ACCOUNT | SLAB_PANIC | \
- SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
-@@ -308,7 +308,7 @@ struct kmem_list3 {
- * Need this for bootstrapping a per node allocator.
- */
- #define NUM_INIT_LISTS (3 * MAX_NUMNODES)
--struct kmem_list3 __initdata initkmem_list3[NUM_INIT_LISTS];
-+struct kmem_list3 initkmem_list3[NUM_INIT_LISTS];
- #define CACHE_CACHE 0
- #define SIZE_AC MAX_NUMNODES
- #define SIZE_L3 (2 * MAX_NUMNODES)
-@@ -409,10 +409,10 @@ static void kmem_list3_init(struct kmem_
- if ((x)->max_freeable < i) \
- (x)->max_freeable = i; \
- } while (0)
--#define STATS_INC_ALLOCHIT(x) atomic_inc(&(x)->allochit)
--#define STATS_INC_ALLOCMISS(x) atomic_inc(&(x)->allocmiss)
--#define STATS_INC_FREEHIT(x) atomic_inc(&(x)->freehit)
--#define STATS_INC_FREEMISS(x) atomic_inc(&(x)->freemiss)
-+#define STATS_INC_ALLOCHIT(x) atomic_inc_unchecked(&(x)->allochit)
-+#define STATS_INC_ALLOCMISS(x) atomic_inc_unchecked(&(x)->allocmiss)
-+#define STATS_INC_FREEHIT(x) atomic_inc_unchecked(&(x)->freehit)
-+#define STATS_INC_FREEMISS(x) atomic_inc_unchecked(&(x)->freemiss)
- #else
- #define STATS_INC_ACTIVE(x) do { } while (0)
- #define STATS_DEC_ACTIVE(x) do { } while (0)
-@@ -558,7 +558,7 @@ static inline void *index_to_obj(struct
- * reciprocal_divide(offset, cache->reciprocal_buffer_size)
- */
- static inline unsigned int obj_to_index(const struct kmem_cache *cache,
-- const struct slab *slab, void *obj)
-+ const struct slab *slab, const void *obj)
- {
- u32 offset = (obj - slab->s_mem);
- return reciprocal_divide(offset, cache->reciprocal_buffer_size);
-@@ -1453,7 +1453,7 @@ void __init kmem_cache_init(void)
- sizes[INDEX_AC].cs_cachep = kmem_cache_create(names[INDEX_AC].name,
- sizes[INDEX_AC].cs_size,
- ARCH_KMALLOC_MINALIGN,
-- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
-+ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
- NULL);
-
- if (INDEX_AC != INDEX_L3) {
-@@ -1461,7 +1461,7 @@ void __init kmem_cache_init(void)
- kmem_cache_create(names[INDEX_L3].name,
- sizes[INDEX_L3].cs_size,
- ARCH_KMALLOC_MINALIGN,
-- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
-+ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
- NULL);
- }
-
-@@ -1479,7 +1479,7 @@ void __init kmem_cache_init(void)
- sizes->cs_cachep = kmem_cache_create(names->name,
- sizes->cs_size,
- ARCH_KMALLOC_MINALIGN,
-- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
-+ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
- NULL);
- }
- #ifdef CONFIG_ZONE_DMA
-@@ -4211,10 +4211,10 @@ static int s_show(struct seq_file *m, vo
- }
- /* cpu stats */
- {
-- unsigned long allochit = atomic_read(&cachep->allochit);
-- unsigned long allocmiss = atomic_read(&cachep->allocmiss);
-- unsigned long freehit = atomic_read(&cachep->freehit);
-- unsigned long freemiss = atomic_read(&cachep->freemiss);
-+ unsigned long allochit = atomic_read_unchecked(&cachep->allochit);
-+ unsigned long allocmiss = atomic_read_unchecked(&cachep->allocmiss);
-+ unsigned long freehit = atomic_read_unchecked(&cachep->freehit);
-+ unsigned long freemiss = atomic_read_unchecked(&cachep->freemiss);
-
- seq_printf(m, " : cpustat %6lu %6lu %6lu %6lu",
- allochit, allocmiss, freehit, freemiss);
-@@ -4471,15 +4471,66 @@ static const struct file_operations proc
-
- static int __init slab_proc_init(void)
- {
-- proc_create("slabinfo",S_IWUSR|S_IRUGO,NULL,&proc_slabinfo_operations);
-+ mode_t gr_mode = S_IRUGO;
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+ gr_mode = S_IRUSR;
-+#endif
-+
-+ proc_create("slabinfo",S_IWUSR|gr_mode,NULL,&proc_slabinfo_operations);
- #ifdef CONFIG_DEBUG_SLAB_LEAK
-- proc_create("slab_allocators", 0, NULL, &proc_slabstats_operations);
-+ proc_create("slab_allocators", gr_mode, NULL, &proc_slabstats_operations);
- #endif
- return 0;
- }
- module_init(slab_proc_init);
- #endif
-
-+void check_object_size(const void *ptr, unsigned long n, bool to)
-+{
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+ struct page *page;
-+ struct kmem_cache *cachep = NULL;
-+ struct slab *slabp;
-+ unsigned int objnr;
-+ unsigned long offset;
-+
-+ if (!n)
-+ return;
-+
-+ if (ZERO_OR_NULL_PTR(ptr))
-+ goto report;
-+
-+ if (!virt_addr_valid(ptr))
-+ return;
-+
-+ page = virt_to_head_page(ptr);
-+
-+ if (!PageSlab(page)) {
-+ if (object_is_on_stack(ptr, n) == -1)
-+ goto report;
-+ return;
-+ }
-+
-+ cachep = page_get_cache(page);
-+ if (!(cachep->flags & SLAB_USERCOPY))
-+ goto report;
-+
-+ slabp = page_get_slab(page);
-+ objnr = obj_to_index(cachep, slabp, ptr);
-+ BUG_ON(objnr >= cachep->num);
-+ offset = ptr - index_to_obj(cachep, slabp, objnr) - obj_offset(cachep);
-+ if (offset <= obj_size(cachep) && n <= obj_size(cachep) - offset)
-+ return;
-+
-+report:
-+ pax_report_usercopy(ptr, n, to, cachep ? cachep->name : NULL);
-+#endif
-+
-+}
-+EXPORT_SYMBOL(check_object_size);
-+
- /**
- * ksize - get the actual amount of memory allocated for a given object
- * @objp: Pointer to the object
-diff -urNp linux-2.6.32.45/mm/slob.c linux-2.6.32.45/mm/slob.c
---- linux-2.6.32.45/mm/slob.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/mm/slob.c 2011-07-06 19:53:33.000000000 -0400
-@@ -29,7 +29,7 @@
- * If kmalloc is asked for objects of PAGE_SIZE or larger, it calls
- * alloc_pages() directly, allocating compound pages so the page order
- * does not have to be separately tracked, and also stores the exact
-- * allocation size in page->private so that it can be used to accurately
-+ * allocation size in slob_page->size so that it can be used to accurately
- * provide ksize(). These objects are detected in kfree() because slob_page()
- * is false for them.
- *
-@@ -58,6 +58,7 @@
- */
-
- #include <linux/kernel.h>
-+#include <linux/sched.h>
- #include <linux/slab.h>
- #include <linux/mm.h>
- #include <linux/swap.h> /* struct reclaim_state */
-@@ -100,7 +101,8 @@ struct slob_page {
- unsigned long flags; /* mandatory */
- atomic_t _count; /* mandatory */
- slobidx_t units; /* free units left in page */
-- unsigned long pad[2];
-+ unsigned long pad[1];
-+ unsigned long size; /* size when >=PAGE_SIZE */
- slob_t *free; /* first free slob_t in page */
- struct list_head list; /* linked list of free pages */
- };
-@@ -133,7 +135,7 @@ static LIST_HEAD(free_slob_large);
- */
- static inline int is_slob_page(struct slob_page *sp)
- {
-- return PageSlab((struct page *)sp);
-+ return PageSlab((struct page *)sp) && !sp->size;
- }
-
- static inline void set_slob_page(struct slob_page *sp)
-@@ -148,7 +150,7 @@ static inline void clear_slob_page(struc
-
- static inline struct slob_page *slob_page(const void *addr)
- {
-- return (struct slob_page *)virt_to_page(addr);
-+ return (struct slob_page *)virt_to_head_page(addr);
- }
-
- /*
-@@ -208,7 +210,7 @@ static void set_slob(slob_t *s, slobidx_
- /*
- * Return the size of a slob block.
- */
--static slobidx_t slob_units(slob_t *s)
-+static slobidx_t slob_units(const slob_t *s)
- {
- if (s->units > 0)
- return s->units;
-@@ -218,7 +220,7 @@ static slobidx_t slob_units(slob_t *s)
- /*
- * Return the next free slob block pointer after this one.
- */
--static slob_t *slob_next(slob_t *s)
-+static slob_t *slob_next(const slob_t *s)
- {
- slob_t *base = (slob_t *)((unsigned long)s & PAGE_MASK);
- slobidx_t next;
-@@ -233,7 +235,7 @@ static slob_t *slob_next(slob_t *s)
- /*
- * Returns true if s is the last free block in its page.
- */
--static int slob_last(slob_t *s)
-+static int slob_last(const slob_t *s)
- {
- return !((unsigned long)slob_next(s) & ~PAGE_MASK);
- }
-@@ -252,6 +254,7 @@ static void *slob_new_pages(gfp_t gfp, i
- if (!page)
- return NULL;
-
-+ set_slob_page(page);
- return page_address(page);
- }
-
-@@ -368,11 +371,11 @@ static void *slob_alloc(size_t size, gfp
- if (!b)
- return NULL;
- sp = slob_page(b);
-- set_slob_page(sp);
-
- spin_lock_irqsave(&slob_lock, flags);
- sp->units = SLOB_UNITS(PAGE_SIZE);
- sp->free = b;
-+ sp->size = 0;
- INIT_LIST_HEAD(&sp->list);
- set_slob(b, SLOB_UNITS(PAGE_SIZE), b + SLOB_UNITS(PAGE_SIZE));
- set_slob_page_free(sp, slob_list);
-@@ -475,10 +478,9 @@ out:
- #define ARCH_SLAB_MINALIGN __alignof__(unsigned long)
- #endif
-
--void *__kmalloc_node(size_t size, gfp_t gfp, int node)
-+static void *__kmalloc_node_align(size_t size, gfp_t gfp, int node, int align)
- {
-- unsigned int *m;
-- int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
-+ slob_t *m;
- void *ret;
-
- lockdep_trace_alloc(gfp);
-@@ -491,7 +493,10 @@ void *__kmalloc_node(size_t size, gfp_t
-
- if (!m)
- return NULL;
-- *m = size;
-+ BUILD_BUG_ON(ARCH_KMALLOC_MINALIGN < 2 * SLOB_UNIT);
-+ BUILD_BUG_ON(ARCH_SLAB_MINALIGN < 2 * SLOB_UNIT);
-+ m[0].units = size;
-+ m[1].units = align;
- ret = (void *)m + align;
-
- trace_kmalloc_node(_RET_IP_, ret,
-@@ -501,16 +506,25 @@ void *__kmalloc_node(size_t size, gfp_t
-
- ret = slob_new_pages(gfp | __GFP_COMP, get_order(size), node);
- if (ret) {
-- struct page *page;
-- page = virt_to_page(ret);
-- page->private = size;
-+ struct slob_page *sp;
-+ sp = slob_page(ret);
-+ sp->size = size;
- }
-
- trace_kmalloc_node(_RET_IP_, ret,
- size, PAGE_SIZE << order, gfp, node);
- }
-
-- kmemleak_alloc(ret, size, 1, gfp);
-+ return ret;
-+}
-+
-+void *__kmalloc_node(size_t size, gfp_t gfp, int node)
-+{
-+ int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
-+ void *ret = __kmalloc_node_align(size, gfp, node, align);
-+
-+ if (!ZERO_OR_NULL_PTR(ret))
-+ kmemleak_alloc(ret, size, 1, gfp);
- return ret;
- }
- EXPORT_SYMBOL(__kmalloc_node);
-@@ -528,13 +542,88 @@ void kfree(const void *block)
- sp = slob_page(block);
- if (is_slob_page(sp)) {
- int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
-- unsigned int *m = (unsigned int *)(block - align);
-- slob_free(m, *m + align);
-- } else
-+ slob_t *m = (slob_t *)(block - align);
-+ slob_free(m, m[0].units + align);
-+ } else {
-+ clear_slob_page(sp);
-+ free_slob_page(sp);
-+ sp->size = 0;
- put_page(&sp->page);
-+ }
- }
- EXPORT_SYMBOL(kfree);
-
-+void check_object_size(const void *ptr, unsigned long n, bool to)
-+{
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+ struct slob_page *sp;
-+ const slob_t *free;
-+ const void *base;
-+ unsigned long flags;
-+
-+ if (!n)
-+ return;
-+
-+ if (ZERO_OR_NULL_PTR(ptr))
-+ goto report;
-+
-+ if (!virt_addr_valid(ptr))
-+ return;
-+
-+ sp = slob_page(ptr);
-+ if (!PageSlab((struct page*)sp)) {
-+ if (object_is_on_stack(ptr, n) == -1)
-+ goto report;
-+ return;
-+ }
-+
-+ if (sp->size) {
-+ base = page_address(&sp->page);
-+ if (base <= ptr && n <= sp->size - (ptr - base))
-+ return;
-+ goto report;
-+ }
-+
-+ /* some tricky double walking to find the chunk */
-+ spin_lock_irqsave(&slob_lock, flags);
-+ base = (void *)((unsigned long)ptr & PAGE_MASK);
-+ free = sp->free;
-+
-+ while (!slob_last(free) && (void *)free <= ptr) {
-+ base = free + slob_units(free);
-+ free = slob_next(free);
-+ }
-+
-+ while (base < (void *)free) {
-+ slobidx_t m = ((slob_t *)base)[0].units, align = ((slob_t *)base)[1].units;
-+ int size = SLOB_UNIT * SLOB_UNITS(m + align);
-+ int offset;
-+
-+ if (ptr < base + align)
-+ break;
-+
-+ offset = ptr - base - align;
-+ if (offset >= m) {
-+ base += size;
-+ continue;
-+ }
-+
-+ if (n > m - offset)
-+ break;
-+
-+ spin_unlock_irqrestore(&slob_lock, flags);
-+ return;
-+ }
-+
-+ spin_unlock_irqrestore(&slob_lock, flags);
-+report:
-+ pax_report_usercopy(ptr, n, to, NULL);
-+#endif
-+
-+}
-+EXPORT_SYMBOL(check_object_size);
-+
- /* can't use ksize for kmem_cache_alloc memory, only kmalloc */
- size_t ksize(const void *block)
- {
-@@ -547,10 +636,10 @@ size_t ksize(const void *block)
- sp = slob_page(block);
- if (is_slob_page(sp)) {
- int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
-- unsigned int *m = (unsigned int *)(block - align);
-- return SLOB_UNITS(*m) * SLOB_UNIT;
-+ slob_t *m = (slob_t *)(block - align);
-+ return SLOB_UNITS(m[0].units) * SLOB_UNIT;
- } else
-- return sp->page.private;
-+ return sp->size;
- }
- EXPORT_SYMBOL(ksize);
-
-@@ -566,8 +655,13 @@ struct kmem_cache *kmem_cache_create(con
- {
- struct kmem_cache *c;
-
-+#ifdef CONFIG_PAX_USERCOPY
-+ c = __kmalloc_node_align(sizeof(struct kmem_cache),
-+ GFP_KERNEL, -1, ARCH_KMALLOC_MINALIGN);
-+#else
- c = slob_alloc(sizeof(struct kmem_cache),
- GFP_KERNEL, ARCH_KMALLOC_MINALIGN, -1);
-+#endif
-
- if (c) {
- c->name = name;
-@@ -605,17 +699,25 @@ void *kmem_cache_alloc_node(struct kmem_
- {
- void *b;
-
-+#ifdef CONFIG_PAX_USERCOPY
-+ b = __kmalloc_node_align(c->size, flags, node, c->align);
-+#else
- if (c->size < PAGE_SIZE) {
- b = slob_alloc(c->size, flags, c->align, node);
- trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
- SLOB_UNITS(c->size) * SLOB_UNIT,
- flags, node);
- } else {
-+ struct slob_page *sp;
-+
- b = slob_new_pages(flags, get_order(c->size), node);
-+ sp = slob_page(b);
-+ sp->size = c->size;
- trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
- PAGE_SIZE << get_order(c->size),
- flags, node);
- }
-+#endif
-
- if (c->ctor)
- c->ctor(b);
-@@ -627,10 +729,16 @@ EXPORT_SYMBOL(kmem_cache_alloc_node);
-
- static void __kmem_cache_free(void *b, int size)
- {
-- if (size < PAGE_SIZE)
-+ struct slob_page *sp = slob_page(b);
-+
-+ if (is_slob_page(sp))
- slob_free(b, size);
-- else
-+ else {
-+ clear_slob_page(sp);
-+ free_slob_page(sp);
-+ sp->size = 0;
- slob_free_pages(b, get_order(size));
-+ }
- }
-
- static void kmem_rcu_free(struct rcu_head *head)
-@@ -643,18 +751,32 @@ static void kmem_rcu_free(struct rcu_hea
-
- void kmem_cache_free(struct kmem_cache *c, void *b)
- {
-+ int size = c->size;
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+ if (size + c->align < PAGE_SIZE) {
-+ size += c->align;
-+ b -= c->align;
-+ }
-+#endif
-+
- kmemleak_free_recursive(b, c->flags);
- if (unlikely(c->flags & SLAB_DESTROY_BY_RCU)) {
- struct slob_rcu *slob_rcu;
-- slob_rcu = b + (c->size - sizeof(struct slob_rcu));
-+ slob_rcu = b + (size - sizeof(struct slob_rcu));
- INIT_RCU_HEAD(&slob_rcu->head);
-- slob_rcu->size = c->size;
-+ slob_rcu->size = size;
- call_rcu(&slob_rcu->head, kmem_rcu_free);
- } else {
-- __kmem_cache_free(b, c->size);
-+ __kmem_cache_free(b, size);
- }
-
-+#ifdef CONFIG_PAX_USERCOPY
-+ trace_kfree(_RET_IP_, b);
-+#else
- trace_kmem_cache_free(_RET_IP_, b);
-+#endif
-+
- }
- EXPORT_SYMBOL(kmem_cache_free);
-
-diff -urNp linux-2.6.32.45/mm/slub.c linux-2.6.32.45/mm/slub.c
---- linux-2.6.32.45/mm/slub.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/mm/slub.c 2011-04-17 15:56:46.000000000 -0400
-@@ -410,7 +410,7 @@ static void print_track(const char *s, s
- if (!t->addr)
- return;
-
-- printk(KERN_ERR "INFO: %s in %pS age=%lu cpu=%u pid=%d\n",
-+ printk(KERN_ERR "INFO: %s in %pA age=%lu cpu=%u pid=%d\n",
- s, (void *)t->addr, jiffies - t->when, t->cpu, t->pid);
- }
-
-@@ -1893,6 +1893,8 @@ void kmem_cache_free(struct kmem_cache *
-
- page = virt_to_head_page(x);
-
-+ BUG_ON(!PageSlab(page));
-+
- slab_free(s, page, x, _RET_IP_);
-
- trace_kmem_cache_free(_RET_IP_, x);
-@@ -1937,7 +1939,7 @@ static int slub_min_objects;
- * Merge control. If this is set then no merging of slab caches will occur.
- * (Could be removed. This was introduced to pacify the merge skeptics.)
- */
--static int slub_nomerge;
-+static int slub_nomerge = 1;
-
- /*
- * Calculate the order of allocation given an slab object size.
-@@ -2493,7 +2495,7 @@ static int kmem_cache_open(struct kmem_c
- * list to avoid pounding the page allocator excessively.
- */
- set_min_partial(s, ilog2(s->size));
-- s->refcount = 1;
-+ atomic_set(&s->refcount, 1);
- #ifdef CONFIG_NUMA
- s->remote_node_defrag_ratio = 1000;
- #endif
-@@ -2630,8 +2632,7 @@ static inline int kmem_cache_close(struc
- void kmem_cache_destroy(struct kmem_cache *s)
- {
- down_write(&slub_lock);
-- s->refcount--;
-- if (!s->refcount) {
-+ if (atomic_dec_and_test(&s->refcount)) {
- list_del(&s->list);
- up_write(&slub_lock);
- if (kmem_cache_close(s)) {
-@@ -2691,12 +2692,10 @@ static int __init setup_slub_nomerge(cha
- __setup("slub_nomerge", setup_slub_nomerge);
-
- static struct kmem_cache *create_kmalloc_cache(struct kmem_cache *s,
-- const char *name, int size, gfp_t gfp_flags)
-+ const char *name, int size, gfp_t gfp_flags, unsigned int flags)
- {
-- unsigned int flags = 0;
--
- if (gfp_flags & SLUB_DMA)
-- flags = SLAB_CACHE_DMA;
-+ flags |= SLAB_CACHE_DMA;
-
- /*
- * This function is called with IRQs disabled during early-boot on
-@@ -2915,6 +2914,46 @@ void *__kmalloc_node(size_t size, gfp_t
- EXPORT_SYMBOL(__kmalloc_node);
- #endif
-
-+void check_object_size(const void *ptr, unsigned long n, bool to)
-+{
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+ struct page *page;
-+ struct kmem_cache *s = NULL;
-+ unsigned long offset;
-+
-+ if (!n)
-+ return;
-+
-+ if (ZERO_OR_NULL_PTR(ptr))
-+ goto report;
-+
-+ if (!virt_addr_valid(ptr))
-+ return;
-+
-+ page = get_object_page(ptr);
-+
-+ if (!page) {
-+ if (object_is_on_stack(ptr, n) == -1)
-+ goto report;
-+ return;
-+ }
-+
-+ s = page->slab;
-+ if (!(s->flags & SLAB_USERCOPY))
-+ goto report;
-+
-+ offset = (ptr - page_address(page)) % s->size;
-+ if (offset <= s->objsize && n <= s->objsize - offset)
-+ return;
-+
-+report:
-+ pax_report_usercopy(ptr, n, to, s ? s->name : NULL);
-+#endif
-+
-+}
-+EXPORT_SYMBOL(check_object_size);
-+
- size_t ksize(const void *object)
- {
- struct page *page;
-@@ -3185,8 +3224,8 @@ void __init kmem_cache_init(void)
- * kmem_cache_open for slab_state == DOWN.
- */
- create_kmalloc_cache(&kmalloc_caches[0], "kmem_cache_node",
-- sizeof(struct kmem_cache_node), GFP_NOWAIT);
-- kmalloc_caches[0].refcount = -1;
-+ sizeof(struct kmem_cache_node), GFP_NOWAIT, 0);
-+ atomic_set(&kmalloc_caches[0].refcount, -1);
- caches++;
-
- hotplug_memory_notifier(slab_memory_callback, SLAB_CALLBACK_PRI);
-@@ -3198,18 +3237,18 @@ void __init kmem_cache_init(void)
- /* Caches that are not of the two-to-the-power-of size */
- if (KMALLOC_MIN_SIZE <= 32) {
- create_kmalloc_cache(&kmalloc_caches[1],
-- "kmalloc-96", 96, GFP_NOWAIT);
-+ "kmalloc-96", 96, GFP_NOWAIT, SLAB_USERCOPY);
- caches++;
- }
- if (KMALLOC_MIN_SIZE <= 64) {
- create_kmalloc_cache(&kmalloc_caches[2],
-- "kmalloc-192", 192, GFP_NOWAIT);
-+ "kmalloc-192", 192, GFP_NOWAIT, SLAB_USERCOPY);
- caches++;
- }
-
- for (i = KMALLOC_SHIFT_LOW; i < SLUB_PAGE_SHIFT; i++) {
- create_kmalloc_cache(&kmalloc_caches[i],
-- "kmalloc", 1 << i, GFP_NOWAIT);
-+ "kmalloc", 1 << i, GFP_NOWAIT, SLAB_USERCOPY);
- caches++;
- }
-
-@@ -3293,7 +3332,7 @@ static int slab_unmergeable(struct kmem_
- /*
- * We may have set a slab to be unmergeable during bootstrap.
- */
-- if (s->refcount < 0)
-+ if (atomic_read(&s->refcount) < 0)
- return 1;
-
- return 0;
-@@ -3353,7 +3392,7 @@ struct kmem_cache *kmem_cache_create(con
- if (s) {
- int cpu;
-
-- s->refcount++;
-+ atomic_inc(&s->refcount);
- /*
- * Adjust the object sizes so that we clear
- * the complete object on kzalloc.
-@@ -3372,7 +3411,7 @@ struct kmem_cache *kmem_cache_create(con
-
- if (sysfs_slab_alias(s, name)) {
- down_write(&slub_lock);
-- s->refcount--;
-+ atomic_dec(&s->refcount);
- up_write(&slub_lock);
- goto err;
- }
-@@ -4101,7 +4140,7 @@ SLAB_ATTR_RO(ctor);
-
- static ssize_t aliases_show(struct kmem_cache *s, char *buf)
- {
-- return sprintf(buf, "%d\n", s->refcount - 1);
-+ return sprintf(buf, "%d\n", atomic_read(&s->refcount) - 1);
- }
- SLAB_ATTR_RO(aliases);
-
-@@ -4503,7 +4542,7 @@ static void kmem_cache_release(struct ko
- kfree(s);
- }
-
--static struct sysfs_ops slab_sysfs_ops = {
-+static const struct sysfs_ops slab_sysfs_ops = {
- .show = slab_attr_show,
- .store = slab_attr_store,
- };
-@@ -4522,7 +4561,7 @@ static int uevent_filter(struct kset *ks
- return 0;
- }
-
--static struct kset_uevent_ops slab_uevent_ops = {
-+static const struct kset_uevent_ops slab_uevent_ops = {
- .filter = uevent_filter,
- };
-
-@@ -4785,7 +4824,13 @@ static const struct file_operations proc
-
- static int __init slab_proc_init(void)
- {
-- proc_create("slabinfo", S_IRUGO, NULL, &proc_slabinfo_operations);
-+ mode_t gr_mode = S_IRUGO;
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+ gr_mode = S_IRUSR;
-+#endif
-+
-+ proc_create("slabinfo", gr_mode, NULL, &proc_slabinfo_operations);
- return 0;
- }
- module_init(slab_proc_init);
-diff -urNp linux-2.6.32.45/mm/swap.c linux-2.6.32.45/mm/swap.c
---- linux-2.6.32.45/mm/swap.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/mm/swap.c 2011-07-09 09:15:19.000000000 -0400
-@@ -30,6 +30,7 @@
- #include <linux/notifier.h>
- #include <linux/backing-dev.h>
- #include <linux/memcontrol.h>
-+#include <linux/hugetlb.h>
-
- #include "internal.h"
-
-@@ -65,6 +66,8 @@ static void put_compound_page(struct pag
- compound_page_dtor *dtor;
-
- dtor = get_compound_page_dtor(page);
-+ if (!PageHuge(page))
-+ BUG_ON(dtor != free_compound_page);
- (*dtor)(page);
- }
- }
-diff -urNp linux-2.6.32.45/mm/util.c linux-2.6.32.45/mm/util.c
---- linux-2.6.32.45/mm/util.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/mm/util.c 2011-04-17 15:56:46.000000000 -0400
-@@ -228,6 +228,12 @@ EXPORT_SYMBOL(strndup_user);
- void arch_pick_mmap_layout(struct mm_struct *mm)
- {
- mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- mm->get_unmapped_area = arch_get_unmapped_area;
- mm->unmap_area = arch_unmap_area;
- }
-diff -urNp linux-2.6.32.45/mm/vmalloc.c linux-2.6.32.45/mm/vmalloc.c
---- linux-2.6.32.45/mm/vmalloc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/mm/vmalloc.c 2011-04-17 15:56:46.000000000 -0400
-@@ -40,8 +40,19 @@ static void vunmap_pte_range(pmd_t *pmd,
-
- pte = pte_offset_kernel(pmd, addr);
- do {
-- pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
-- WARN_ON(!pte_none(ptent) && !pte_present(ptent));
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr < (unsigned long)MODULES_EXEC_END) {
-+ BUG_ON(!pte_exec(*pte));
-+ set_pte_at(&init_mm, addr, pte, pfn_pte(__pa(addr) >> PAGE_SHIFT, PAGE_KERNEL_EXEC));
-+ continue;
-+ }
-+#endif
-+
-+ {
-+ pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
-+ WARN_ON(!pte_none(ptent) && !pte_present(ptent));
-+ }
- } while (pte++, addr += PAGE_SIZE, addr != end);
- }
-
-@@ -92,6 +103,7 @@ static int vmap_pte_range(pmd_t *pmd, un
- unsigned long end, pgprot_t prot, struct page **pages, int *nr)
- {
- pte_t *pte;
-+ int ret = -ENOMEM;
-
- /*
- * nr is a running index into the array which helps higher level
-@@ -101,17 +113,32 @@ static int vmap_pte_range(pmd_t *pmd, un
- pte = pte_alloc_kernel(pmd, addr);
- if (!pte)
- return -ENOMEM;
-+
-+ pax_open_kernel();
- do {
- struct page *page = pages[*nr];
-
-- if (WARN_ON(!pte_none(*pte)))
-- return -EBUSY;
-- if (WARN_ON(!page))
-- return -ENOMEM;
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ if (!(pgprot_val(prot) & _PAGE_NX))
-+ BUG_ON(!pte_exec(*pte) || pte_pfn(*pte) != __pa(addr) >> PAGE_SHIFT);
-+ else
-+#endif
-+
-+ if (WARN_ON(!pte_none(*pte))) {
-+ ret = -EBUSY;
-+ goto out;
-+ }
-+ if (WARN_ON(!page)) {
-+ ret = -ENOMEM;
-+ goto out;
-+ }
- set_pte_at(&init_mm, addr, pte, mk_pte(page, prot));
- (*nr)++;
- } while (pte++, addr += PAGE_SIZE, addr != end);
-- return 0;
-+ ret = 0;
-+out:
-+ pax_close_kernel();
-+ return ret;
- }
-
- static int vmap_pmd_range(pud_t *pud, unsigned long addr,
-@@ -192,11 +219,20 @@ int is_vmalloc_or_module_addr(const void
- * and fall back on vmalloc() if that fails. Others
- * just put it in the vmalloc space.
- */
--#if defined(CONFIG_MODULES) && defined(MODULES_VADDR)
-+#ifdef CONFIG_MODULES
-+#ifdef MODULES_VADDR
- unsigned long addr = (unsigned long)x;
- if (addr >= MODULES_VADDR && addr < MODULES_END)
- return 1;
- #endif
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+ if (x >= (const void *)MODULES_EXEC_VADDR && x < (const void *)MODULES_EXEC_END)
-+ return 1;
-+#endif
-+
-+#endif
-+
- return is_vmalloc_addr(x);
- }
-
-@@ -217,8 +253,14 @@ struct page *vmalloc_to_page(const void
-
- if (!pgd_none(*pgd)) {
- pud_t *pud = pud_offset(pgd, addr);
-+#ifdef CONFIG_X86
-+ if (!pud_large(*pud))
-+#endif
- if (!pud_none(*pud)) {
- pmd_t *pmd = pmd_offset(pud, addr);
-+#ifdef CONFIG_X86
-+ if (!pmd_large(*pmd))
-+#endif
- if (!pmd_none(*pmd)) {
- pte_t *ptep, pte;
-
-@@ -292,13 +334,13 @@ static void __insert_vmap_area(struct vm
- struct rb_node *tmp;
-
- while (*p) {
-- struct vmap_area *tmp;
-+ struct vmap_area *varea;
-
- parent = *p;
-- tmp = rb_entry(parent, struct vmap_area, rb_node);
-- if (va->va_start < tmp->va_end)
-+ varea = rb_entry(parent, struct vmap_area, rb_node);
-+ if (va->va_start < varea->va_end)
- p = &(*p)->rb_left;
-- else if (va->va_end > tmp->va_start)
-+ else if (va->va_end > varea->va_start)
- p = &(*p)->rb_right;
- else
- BUG();
-@@ -1232,6 +1274,16 @@ static struct vm_struct *__get_vm_area_n
- struct vm_struct *area;
-
- BUG_ON(in_interrupt());
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
-+ if (flags & VM_KERNEXEC) {
-+ if (start != VMALLOC_START || end != VMALLOC_END)
-+ return NULL;
-+ start = (unsigned long)MODULES_EXEC_VADDR;
-+ end = (unsigned long)MODULES_EXEC_END;
-+ }
-+#endif
-+
- if (flags & VM_IOREMAP) {
- int bit = fls(size);
-
-@@ -1457,6 +1509,11 @@ void *vmap(struct page **pages, unsigned
- if (count > totalram_pages)
- return NULL;
-
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
-+ if (!(pgprot_val(prot) & _PAGE_NX))
-+ flags |= VM_KERNEXEC;
-+#endif
-+
- area = get_vm_area_caller((count << PAGE_SHIFT), flags,
- __builtin_return_address(0));
- if (!area)
-@@ -1567,6 +1624,13 @@ static void *__vmalloc_node(unsigned lon
- if (!size || (size >> PAGE_SHIFT) > totalram_pages)
- return NULL;
-
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
-+ if (!(pgprot_val(prot) & _PAGE_NX))
-+ area = __get_vm_area_node(size, align, VM_ALLOC | VM_KERNEXEC, VMALLOC_START, VMALLOC_END,
-+ node, gfp_mask, caller);
-+ else
-+#endif
-+
- area = __get_vm_area_node(size, align, VM_ALLOC, VMALLOC_START,
- VMALLOC_END, node, gfp_mask, caller);
-
-@@ -1585,6 +1649,7 @@ static void *__vmalloc_node(unsigned lon
- return addr;
- }
-
-+#undef __vmalloc
- void *__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot)
- {
- return __vmalloc_node(size, 1, gfp_mask, prot, -1,
-@@ -1601,6 +1666,7 @@ EXPORT_SYMBOL(__vmalloc);
- * For tight control over page level allocator and protection flags
- * use __vmalloc() instead.
- */
-+#undef vmalloc
- void *vmalloc(unsigned long size)
- {
- return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
-@@ -1615,6 +1681,7 @@ EXPORT_SYMBOL(vmalloc);
- * The resulting memory area is zeroed so it can be mapped to userspace
- * without leaking data.
- */
-+#undef vmalloc_user
- void *vmalloc_user(unsigned long size)
- {
- struct vm_struct *area;
-@@ -1642,6 +1709,7 @@ EXPORT_SYMBOL(vmalloc_user);
- * For tight control over page level allocator and protection flags
- * use __vmalloc() instead.
- */
-+#undef vmalloc_node
- void *vmalloc_node(unsigned long size, int node)
- {
- return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
-@@ -1664,10 +1732,10 @@ EXPORT_SYMBOL(vmalloc_node);
- * For tight control over page level allocator and protection flags
- * use __vmalloc() instead.
- */
--
-+#undef vmalloc_exec
- void *vmalloc_exec(unsigned long size)
- {
-- return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
-+ return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, PAGE_KERNEL_EXEC,
- -1, __builtin_return_address(0));
- }
-
-@@ -1686,6 +1754,7 @@ void *vmalloc_exec(unsigned long size)
- * Allocate enough 32bit PA addressable pages to cover @size from the
- * page level allocator and map them into contiguous kernel virtual space.
- */
-+#undef vmalloc_32
- void *vmalloc_32(unsigned long size)
- {
- return __vmalloc_node(size, 1, GFP_VMALLOC32, PAGE_KERNEL,
-@@ -1700,6 +1769,7 @@ EXPORT_SYMBOL(vmalloc_32);
- * The resulting memory area is 32bit addressable and zeroed so it can be
- * mapped to userspace without leaking data.
- */
-+#undef vmalloc_32_user
- void *vmalloc_32_user(unsigned long size)
- {
- struct vm_struct *area;
-@@ -1964,6 +2034,8 @@ int remap_vmalloc_range(struct vm_area_s
- unsigned long uaddr = vma->vm_start;
- unsigned long usize = vma->vm_end - vma->vm_start;
-
-+ BUG_ON(vma->vm_mirror);
-+
- if ((PAGE_SIZE-1) & (unsigned long)addr)
- return -EINVAL;
-
-diff -urNp linux-2.6.32.45/mm/vmstat.c linux-2.6.32.45/mm/vmstat.c
---- linux-2.6.32.45/mm/vmstat.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/mm/vmstat.c 2011-04-17 15:56:46.000000000 -0400
-@@ -74,7 +74,7 @@ void vm_events_fold_cpu(int cpu)
- *
- * vm_stat contains the global counters
- */
--atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
-+atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
- EXPORT_SYMBOL(vm_stat);
-
- #ifdef CONFIG_SMP
-@@ -324,7 +324,7 @@ void refresh_cpu_vm_stats(int cpu)
- v = p->vm_stat_diff[i];
- p->vm_stat_diff[i] = 0;
- local_irq_restore(flags);
-- atomic_long_add(v, &zone->vm_stat[i]);
-+ atomic_long_add_unchecked(v, &zone->vm_stat[i]);
- global_diff[i] += v;
- #ifdef CONFIG_NUMA
- /* 3 seconds idle till flush */
-@@ -362,7 +362,7 @@ void refresh_cpu_vm_stats(int cpu)
-
- for (i = 0; i < NR_VM_ZONE_STAT_ITEMS; i++)
- if (global_diff[i])
-- atomic_long_add(global_diff[i], &vm_stat[i]);
-+ atomic_long_add_unchecked(global_diff[i], &vm_stat[i]);
- }
-
- #endif
-@@ -953,10 +953,20 @@ static int __init setup_vmstat(void)
- start_cpu_timer(cpu);
- #endif
- #ifdef CONFIG_PROC_FS
-- proc_create("buddyinfo", S_IRUGO, NULL, &fragmentation_file_operations);
-- proc_create("pagetypeinfo", S_IRUGO, NULL, &pagetypeinfo_file_ops);
-- proc_create("vmstat", S_IRUGO, NULL, &proc_vmstat_file_operations);
-- proc_create("zoneinfo", S_IRUGO, NULL, &proc_zoneinfo_file_operations);
-+ {
-+ mode_t gr_mode = S_IRUGO;
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+ gr_mode = S_IRUSR;
-+#endif
-+ proc_create("buddyinfo", gr_mode, NULL, &fragmentation_file_operations);
-+ proc_create("pagetypeinfo", gr_mode, NULL, &pagetypeinfo_file_ops);
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+ proc_create("vmstat", gr_mode | S_IRGRP, NULL, &proc_vmstat_file_operations);
-+#else
-+ proc_create("vmstat", gr_mode, NULL, &proc_vmstat_file_operations);
-+#endif
-+ proc_create("zoneinfo", gr_mode, NULL, &proc_zoneinfo_file_operations);
-+ }
- #endif
- return 0;
- }
-diff -urNp linux-2.6.32.45/net/8021q/vlan.c linux-2.6.32.45/net/8021q/vlan.c
---- linux-2.6.32.45/net/8021q/vlan.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/8021q/vlan.c 2011-04-17 15:56:46.000000000 -0400
-@@ -622,8 +622,7 @@ static int vlan_ioctl_handler(struct net
- err = -EPERM;
- if (!capable(CAP_NET_ADMIN))
- break;
-- if ((args.u.name_type >= 0) &&
-- (args.u.name_type < VLAN_NAME_TYPE_HIGHEST)) {
-+ if (args.u.name_type < VLAN_NAME_TYPE_HIGHEST) {
- struct vlan_net *vn;
-
- vn = net_generic(net, vlan_net_id);
-diff -urNp linux-2.6.32.45/net/atm/atm_misc.c linux-2.6.32.45/net/atm/atm_misc.c
---- linux-2.6.32.45/net/atm/atm_misc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/atm/atm_misc.c 2011-04-17 15:56:46.000000000 -0400
-@@ -19,7 +19,7 @@ int atm_charge(struct atm_vcc *vcc,int t
- if (atomic_read(&sk_atm(vcc)->sk_rmem_alloc) <= sk_atm(vcc)->sk_rcvbuf)
- return 1;
- atm_return(vcc,truesize);
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- return 0;
- }
-
-@@ -41,7 +41,7 @@ struct sk_buff *atm_alloc_charge(struct
- }
- }
- atm_return(vcc,guess);
-- atomic_inc(&vcc->stats->rx_drop);
-+ atomic_inc_unchecked(&vcc->stats->rx_drop);
- return NULL;
- }
-
-@@ -88,7 +88,7 @@ int atm_pcr_goal(const struct atm_trafpr
-
- void sonet_copy_stats(struct k_sonet_stats *from,struct sonet_stats *to)
- {
--#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
-+#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
- __SONET_ITEMS
- #undef __HANDLE_ITEM
- }
-@@ -96,7 +96,7 @@ void sonet_copy_stats(struct k_sonet_sta
-
- void sonet_subtract_stats(struct k_sonet_stats *from,struct sonet_stats *to)
- {
--#define __HANDLE_ITEM(i) atomic_sub(to->i,&from->i)
-+#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i,&from->i)
- __SONET_ITEMS
- #undef __HANDLE_ITEM
- }
-diff -urNp linux-2.6.32.45/net/atm/lec.h linux-2.6.32.45/net/atm/lec.h
---- linux-2.6.32.45/net/atm/lec.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/atm/lec.h 2011-08-05 20:33:55.000000000 -0400
-@@ -48,7 +48,7 @@ struct lane2_ops {
- const u8 *tlvs, u32 sizeoftlvs);
- void (*associate_indicator) (struct net_device *dev, const u8 *mac_addr,
- const u8 *tlvs, u32 sizeoftlvs);
--};
-+} __no_const;
-
- /*
- * ATM LAN Emulation supports both LLC & Dix Ethernet EtherType
-diff -urNp linux-2.6.32.45/net/atm/mpc.c linux-2.6.32.45/net/atm/mpc.c
---- linux-2.6.32.45/net/atm/mpc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/atm/mpc.c 2011-08-05 20:33:55.000000000 -0400
-@@ -291,8 +291,8 @@ static void start_mpc(struct mpoa_client
- printk("mpoa: (%s) start_mpc not starting\n", dev->name);
- else {
- mpc->old_ops = dev->netdev_ops;
-- mpc->new_ops = *mpc->old_ops;
-- mpc->new_ops.ndo_start_xmit = mpc_send_packet;
-+ memcpy((void *)&mpc->new_ops, mpc->old_ops, sizeof(mpc->new_ops));
-+ *(void **)&mpc->new_ops.ndo_start_xmit = mpc_send_packet;
- dev->netdev_ops = &mpc->new_ops;
- }
- }
-diff -urNp linux-2.6.32.45/net/atm/mpoa_caches.c linux-2.6.32.45/net/atm/mpoa_caches.c
---- linux-2.6.32.45/net/atm/mpoa_caches.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/atm/mpoa_caches.c 2011-05-16 21:46:57.000000000 -0400
-@@ -498,6 +498,8 @@ static void clear_expired(struct mpoa_cl
- struct timeval now;
- struct k_message msg;
-
-+ pax_track_stack();
-+
- do_gettimeofday(&now);
-
- write_lock_irq(&client->egress_lock);
-diff -urNp linux-2.6.32.45/net/atm/proc.c linux-2.6.32.45/net/atm/proc.c
---- linux-2.6.32.45/net/atm/proc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/atm/proc.c 2011-04-17 15:56:46.000000000 -0400
-@@ -43,9 +43,9 @@ static void add_stats(struct seq_file *s
- const struct k_atm_aal_stats *stats)
- {
- seq_printf(seq, "%s ( %d %d %d %d %d )", aal,
-- atomic_read(&stats->tx),atomic_read(&stats->tx_err),
-- atomic_read(&stats->rx),atomic_read(&stats->rx_err),
-- atomic_read(&stats->rx_drop));
-+ atomic_read_unchecked(&stats->tx),atomic_read_unchecked(&stats->tx_err),
-+ atomic_read_unchecked(&stats->rx),atomic_read_unchecked(&stats->rx_err),
-+ atomic_read_unchecked(&stats->rx_drop));
- }
-
- static void atm_dev_info(struct seq_file *seq, const struct atm_dev *dev)
-@@ -188,7 +188,12 @@ static void vcc_info(struct seq_file *se
- {
- struct sock *sk = sk_atm(vcc);
-
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ seq_printf(seq, "%p ", NULL);
-+#else
- seq_printf(seq, "%p ", vcc);
-+#endif
-+
- if (!vcc->dev)
- seq_printf(seq, "Unassigned ");
- else
-@@ -214,7 +219,11 @@ static void svc_info(struct seq_file *se
- {
- if (!vcc->dev)
- seq_printf(seq, sizeof(void *) == 4 ?
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ "N/A@%p%10s" : "N/A@%p%2s", NULL, "");
-+#else
- "N/A@%p%10s" : "N/A@%p%2s", vcc, "");
-+#endif
- else
- seq_printf(seq, "%3d %3d %5d ",
- vcc->dev->number, vcc->vpi, vcc->vci);
-diff -urNp linux-2.6.32.45/net/atm/resources.c linux-2.6.32.45/net/atm/resources.c
---- linux-2.6.32.45/net/atm/resources.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/atm/resources.c 2011-04-17 15:56:46.000000000 -0400
-@@ -161,7 +161,7 @@ void atm_dev_deregister(struct atm_dev *
- static void copy_aal_stats(struct k_atm_aal_stats *from,
- struct atm_aal_stats *to)
- {
--#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
-+#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
- __AAL_STAT_ITEMS
- #undef __HANDLE_ITEM
- }
-@@ -170,7 +170,7 @@ static void copy_aal_stats(struct k_atm_
- static void subtract_aal_stats(struct k_atm_aal_stats *from,
- struct atm_aal_stats *to)
- {
--#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
-+#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i, &from->i)
- __AAL_STAT_ITEMS
- #undef __HANDLE_ITEM
- }
-diff -urNp linux-2.6.32.45/net/bluetooth/l2cap.c linux-2.6.32.45/net/bluetooth/l2cap.c
---- linux-2.6.32.45/net/bluetooth/l2cap.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/bluetooth/l2cap.c 2011-06-25 14:36:21.000000000 -0400
-@@ -1885,7 +1885,7 @@ static int l2cap_sock_getsockopt_old(str
- err = -ENOTCONN;
- break;
- }
--
-+ memset(&cinfo, 0, sizeof(cinfo));
- cinfo.hci_handle = l2cap_pi(sk)->conn->hcon->handle;
- memcpy(cinfo.dev_class, l2cap_pi(sk)->conn->hcon->dev_class, 3);
-
-@@ -2719,7 +2719,7 @@ static inline int l2cap_config_req(struc
-
- /* Reject if config buffer is too small. */
- len = cmd_len - sizeof(*req);
-- if (l2cap_pi(sk)->conf_len + len > sizeof(l2cap_pi(sk)->conf_req)) {
-+ if (len < 0 || l2cap_pi(sk)->conf_len + len > sizeof(l2cap_pi(sk)->conf_req)) {
- l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
- l2cap_build_conf_rsp(sk, rsp,
- L2CAP_CONF_REJECT, flags), rsp);
-diff -urNp linux-2.6.32.45/net/bluetooth/rfcomm/sock.c linux-2.6.32.45/net/bluetooth/rfcomm/sock.c
---- linux-2.6.32.45/net/bluetooth/rfcomm/sock.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/bluetooth/rfcomm/sock.c 2011-06-12 06:35:00.000000000 -0400
-@@ -878,6 +878,7 @@ static int rfcomm_sock_getsockopt_old(st
-
- l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
-
-+ memset(&cinfo, 0, sizeof(cinfo));
- cinfo.hci_handle = l2cap_pi(l2cap_sk)->conn->hcon->handle;
- memcpy(cinfo.dev_class, l2cap_pi(l2cap_sk)->conn->hcon->dev_class, 3);
-
-diff -urNp linux-2.6.32.45/net/bridge/br_private.h linux-2.6.32.45/net/bridge/br_private.h
---- linux-2.6.32.45/net/bridge/br_private.h 2011-08-09 18:35:30.000000000 -0400
-+++ linux-2.6.32.45/net/bridge/br_private.h 2011-08-09 18:34:01.000000000 -0400
-@@ -255,7 +255,7 @@ extern void br_ifinfo_notify(int event,
-
- #ifdef CONFIG_SYSFS
- /* br_sysfs_if.c */
--extern struct sysfs_ops brport_sysfs_ops;
-+extern const struct sysfs_ops brport_sysfs_ops;
- extern int br_sysfs_addif(struct net_bridge_port *p);
-
- /* br_sysfs_br.c */
-diff -urNp linux-2.6.32.45/net/bridge/br_stp_if.c linux-2.6.32.45/net/bridge/br_stp_if.c
---- linux-2.6.32.45/net/bridge/br_stp_if.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/bridge/br_stp_if.c 2011-04-17 15:56:46.000000000 -0400
-@@ -146,7 +146,7 @@ static void br_stp_stop(struct net_bridg
- char *envp[] = { NULL };
-
- if (br->stp_enabled == BR_USER_STP) {
-- r = call_usermodehelper(BR_STP_PROG, argv, envp, 1);
-+ r = call_usermodehelper(BR_STP_PROG, argv, envp, UMH_WAIT_PROC);
- printk(KERN_INFO "%s: userspace STP stopped, return code %d\n",
- br->dev->name, r);
-
-diff -urNp linux-2.6.32.45/net/bridge/br_sysfs_if.c linux-2.6.32.45/net/bridge/br_sysfs_if.c
---- linux-2.6.32.45/net/bridge/br_sysfs_if.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/bridge/br_sysfs_if.c 2011-04-17 15:56:46.000000000 -0400
-@@ -220,7 +220,7 @@ static ssize_t brport_store(struct kobje
- return ret;
- }
-
--struct sysfs_ops brport_sysfs_ops = {
-+const struct sysfs_ops brport_sysfs_ops = {
- .show = brport_show,
- .store = brport_store,
- };
-diff -urNp linux-2.6.32.45/net/bridge/netfilter/ebtables.c linux-2.6.32.45/net/bridge/netfilter/ebtables.c
---- linux-2.6.32.45/net/bridge/netfilter/ebtables.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.45/net/bridge/netfilter/ebtables.c 2011-05-16 21:46:57.000000000 -0400
-@@ -1337,6 +1337,8 @@ static int copy_everything_to_user(struc
- unsigned int entries_size, nentries;
- char *entries;
-
-+ pax_track_stack();
-+
- if (cmd == EBT_SO_GET_ENTRIES) {
- entries_size = t->private->entries_size;
- nentries = t->private->nentries;
-diff -urNp linux-2.6.32.45/net/can/bcm.c linux-2.6.32.45/net/can/bcm.c
---- linux-2.6.32.45/net/can/bcm.c 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.45/net/can/bcm.c 2011-05-10 22:12:34.000000000 -0400
-@@ -164,9 +164,15 @@ static int bcm_proc_show(struct seq_file
- struct bcm_sock *bo = bcm_sk(sk);
- struct bcm_op *op;
-
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ seq_printf(m, ">>> socket %p", NULL);
-+ seq_printf(m, " / sk %p", NULL);
-+ seq_printf(m, " / bo %p", NULL);
-+#else
- seq_printf(m, ">>> socket %p", sk->sk_socket);
- seq_printf(m, " / sk %p", sk);
- seq_printf(m, " / bo %p", bo);
-+#endif
- seq_printf(m, " / dropped %lu", bo->dropped_usr_msgs);
- seq_printf(m, " / bound %s", bcm_proc_getifname(ifname, bo->ifindex));
- seq_printf(m, " <<<\n");
-diff -urNp linux-2.6.32.45/net/core/dev.c linux-2.6.32.45/net/core/dev.c
---- linux-2.6.32.45/net/core/dev.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.45/net/core/dev.c 2011-08-05 20:33:55.000000000 -0400
-@@ -1047,10 +1047,14 @@ void dev_load(struct net *net, const cha
- if (no_module && capable(CAP_NET_ADMIN))
- no_module = request_module("netdev-%s", name);
- if (no_module && capable(CAP_SYS_MODULE)) {
-+#ifdef CONFIG_GRKERNSEC_MODHARDEN
-+ ___request_module(true, "grsec_modharden_netdev", "%s", name);
-+#else
- if (!request_module("%s", name))
- pr_err("Loading kernel module for a network device "
- "with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%s "
- "instead\n", name);
-+#endif
- }
- }
- EXPORT_SYMBOL(dev_load);
-@@ -1654,7 +1658,7 @@ static inline int illegal_highdma(struct
-
- struct dev_gso_cb {
- void (*destructor)(struct sk_buff *skb);
--};
-+} __no_const;
-
- #define DEV_GSO_CB(skb) ((struct dev_gso_cb *)(skb)->cb)
-
-@@ -2063,7 +2067,7 @@ int netif_rx_ni(struct sk_buff *skb)
- }
- EXPORT_SYMBOL(netif_rx_ni);
-
--static void net_tx_action(struct softirq_action *h)
-+static void net_tx_action(void)
- {
- struct softnet_data *sd = &__get_cpu_var(softnet_data);
-
-@@ -2826,7 +2830,7 @@ void netif_napi_del(struct napi_struct *
- EXPORT_SYMBOL(netif_napi_del);
-
-
--static void net_rx_action(struct softirq_action *h)
-+static void net_rx_action(void)
- {
- struct list_head *list = &__get_cpu_var(softnet_data).poll_list;
- unsigned long time_limit = jiffies + 2;
-diff -urNp linux-2.6.32.45/net/core/flow.c linux-2.6.32.45/net/core/flow.c
---- linux-2.6.32.45/net/core/flow.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/core/flow.c 2011-05-04 17:56:20.000000000 -0400
-@@ -35,11 +35,11 @@ struct flow_cache_entry {
- atomic_t *object_ref;
- };
-
--atomic_t flow_cache_genid = ATOMIC_INIT(0);
-+atomic_unchecked_t flow_cache_genid = ATOMIC_INIT(0);
-
- static u32 flow_hash_shift;
- #define flow_hash_size (1 << flow_hash_shift)
--static DEFINE_PER_CPU(struct flow_cache_entry **, flow_tables) = { NULL };
-+static DEFINE_PER_CPU(struct flow_cache_entry **, flow_tables);
-
- #define flow_table(cpu) (per_cpu(flow_tables, cpu))
-
-@@ -52,7 +52,7 @@ struct flow_percpu_info {
- u32 hash_rnd;
- int count;
- };
--static DEFINE_PER_CPU(struct flow_percpu_info, flow_hash_info) = { 0 };
-+static DEFINE_PER_CPU(struct flow_percpu_info, flow_hash_info);
-
- #define flow_hash_rnd_recalc(cpu) \
- (per_cpu(flow_hash_info, cpu).hash_rnd_recalc)
-@@ -69,7 +69,7 @@ struct flow_flush_info {
- atomic_t cpuleft;
- struct completion completion;
- };
--static DEFINE_PER_CPU(struct tasklet_struct, flow_flush_tasklets) = { NULL };
-+static DEFINE_PER_CPU(struct tasklet_struct, flow_flush_tasklets);
-
- #define flow_flush_tasklet(cpu) (&per_cpu(flow_flush_tasklets, cpu))
-
-@@ -190,7 +190,7 @@ void *flow_cache_lookup(struct net *net,
- if (fle->family == family &&
- fle->dir == dir &&
- flow_key_compare(key, &fle->key) == 0) {
-- if (fle->genid == atomic_read(&flow_cache_genid)) {
-+ if (fle->genid == atomic_read_unchecked(&flow_cache_genid)) {
- void *ret = fle->object;
-
- if (ret)
-@@ -228,7 +228,7 @@ nocache:
- err = resolver(net, key, family, dir, &obj, &obj_ref);
-
- if (fle && !err) {
-- fle->genid = atomic_read(&flow_cache_genid);
-+ fle->genid = atomic_read_unchecked(&flow_cache_genid);
-
- if (fle->object)
- atomic_dec(fle->object_ref);
-@@ -258,7 +258,7 @@ static void flow_cache_flush_tasklet(uns
-
- fle = flow_table(cpu)[i];
- for (; fle; fle = fle->next) {
-- unsigned genid = atomic_read(&flow_cache_genid);
-+ unsigned genid = atomic_read_unchecked(&flow_cache_genid);
-
- if (!fle->object || fle->genid == genid)
- continue;
-diff -urNp linux-2.6.32.45/net/core/rtnetlink.c linux-2.6.32.45/net/core/rtnetlink.c
---- linux-2.6.32.45/net/core/rtnetlink.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/core/rtnetlink.c 2011-08-05 20:33:55.000000000 -0400
-@@ -57,7 +57,7 @@ struct rtnl_link
- {
- rtnl_doit_func doit;
- rtnl_dumpit_func dumpit;
--};
-+} __no_const;
-
- static DEFINE_MUTEX(rtnl_mutex);
-
-diff -urNp linux-2.6.32.45/net/core/secure_seq.c linux-2.6.32.45/net/core/secure_seq.c
---- linux-2.6.32.45/net/core/secure_seq.c 2011-08-16 20:37:25.000000000 -0400
-+++ linux-2.6.32.45/net/core/secure_seq.c 2011-08-07 19:48:09.000000000 -0400
-@@ -57,7 +57,7 @@ __u32 secure_tcpv6_sequence_number(__be3
- EXPORT_SYMBOL(secure_tcpv6_sequence_number);
-
- u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
-- __be16 dport)
-+ __be16 dport)
- {
- u32 secret[MD5_MESSAGE_BYTES / 4];
- u32 hash[MD5_DIGEST_WORDS];
-@@ -71,7 +71,6 @@ u32 secure_ipv6_port_ephemeral(const __b
- secret[i] = net_secret[i];
-
- md5_transform(hash, secret);
--
- return hash[0];
- }
- #endif
-diff -urNp linux-2.6.32.45/net/core/skbuff.c linux-2.6.32.45/net/core/skbuff.c
---- linux-2.6.32.45/net/core/skbuff.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/core/skbuff.c 2011-05-16 21:46:57.000000000 -0400
-@@ -1544,6 +1544,8 @@ int skb_splice_bits(struct sk_buff *skb,
- struct sk_buff *frag_iter;
- struct sock *sk = skb->sk;
-
-+ pax_track_stack();
-+
- /*
- * __skb_splice_bits() only fails if the output has no room left,
- * so no point in going over the frag_list for the error case.
-diff -urNp linux-2.6.32.45/net/core/sock.c linux-2.6.32.45/net/core/sock.c
---- linux-2.6.32.45/net/core/sock.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/core/sock.c 2011-05-04 17:56:20.000000000 -0400
-@@ -864,11 +864,15 @@ int sock_getsockopt(struct socket *sock,
- break;
-
- case SO_PEERCRED:
-+ {
-+ struct ucred peercred;
- if (len > sizeof(sk->sk_peercred))
- len = sizeof(sk->sk_peercred);
-- if (copy_to_user(optval, &sk->sk_peercred, len))
-+ peercred = sk->sk_peercred;
-+ if (copy_to_user(optval, &peercred, len))
- return -EFAULT;
- goto lenout;
-+ }
-
- case SO_PEERNAME:
- {
-@@ -1892,7 +1896,7 @@ void sock_init_data(struct socket *sock,
- */
- smp_wmb();
- atomic_set(&sk->sk_refcnt, 1);
-- atomic_set(&sk->sk_drops, 0);
-+ atomic_set_unchecked(&sk->sk_drops, 0);
- }
- EXPORT_SYMBOL(sock_init_data);
-
-diff -urNp linux-2.6.32.45/net/decnet/sysctl_net_decnet.c linux-2.6.32.45/net/decnet/sysctl_net_decnet.c
---- linux-2.6.32.45/net/decnet/sysctl_net_decnet.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/decnet/sysctl_net_decnet.c 2011-04-17 15:56:46.000000000 -0400
-@@ -206,7 +206,7 @@ static int dn_node_address_handler(ctl_t
-
- if (len > *lenp) len = *lenp;
-
-- if (copy_to_user(buffer, addr, len))
-+ if (len > sizeof addr || copy_to_user(buffer, addr, len))
- return -EFAULT;
-
- *lenp = len;
-@@ -327,7 +327,7 @@ static int dn_def_dev_handler(ctl_table
-
- if (len > *lenp) len = *lenp;
-
-- if (copy_to_user(buffer, devname, len))
-+ if (len > sizeof devname || copy_to_user(buffer, devname, len))
- return -EFAULT;
-
- *lenp = len;
-diff -urNp linux-2.6.32.45/net/econet/Kconfig linux-2.6.32.45/net/econet/Kconfig
---- linux-2.6.32.45/net/econet/Kconfig 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/econet/Kconfig 2011-04-17 15:56:46.000000000 -0400
-@@ -4,7 +4,7 @@
-
- config ECONET
- tristate "Acorn Econet/AUN protocols (EXPERIMENTAL)"
-- depends on EXPERIMENTAL && INET
-+ depends on EXPERIMENTAL && INET && BROKEN
- ---help---
- Econet is a fairly old and slow networking protocol mainly used by
- Acorn computers to access file and print servers. It uses native
-diff -urNp linux-2.6.32.45/net/ieee802154/dgram.c linux-2.6.32.45/net/ieee802154/dgram.c
---- linux-2.6.32.45/net/ieee802154/dgram.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/ieee802154/dgram.c 2011-05-04 17:56:28.000000000 -0400
-@@ -318,7 +318,7 @@ out:
- static int dgram_rcv_skb(struct sock *sk, struct sk_buff *skb)
- {
- if (sock_queue_rcv_skb(sk, skb) < 0) {
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- kfree_skb(skb);
- return NET_RX_DROP;
- }
-diff -urNp linux-2.6.32.45/net/ieee802154/raw.c linux-2.6.32.45/net/ieee802154/raw.c
---- linux-2.6.32.45/net/ieee802154/raw.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/ieee802154/raw.c 2011-05-04 17:56:28.000000000 -0400
-@@ -206,7 +206,7 @@ out:
- static int raw_rcv_skb(struct sock *sk, struct sk_buff *skb)
- {
- if (sock_queue_rcv_skb(sk, skb) < 0) {
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- kfree_skb(skb);
- return NET_RX_DROP;
- }
-diff -urNp linux-2.6.32.45/net/ipv4/inet_diag.c linux-2.6.32.45/net/ipv4/inet_diag.c
---- linux-2.6.32.45/net/ipv4/inet_diag.c 2011-07-13 17:23:04.000000000 -0400
-+++ linux-2.6.32.45/net/ipv4/inet_diag.c 2011-06-20 19:31:13.000000000 -0400
-@@ -113,8 +113,13 @@ static int inet_csk_diag_fill(struct soc
- r->idiag_retrans = 0;
-
- r->id.idiag_if = sk->sk_bound_dev_if;
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ r->id.idiag_cookie[0] = 0;
-+ r->id.idiag_cookie[1] = 0;
-+#else
- r->id.idiag_cookie[0] = (u32)(unsigned long)sk;
- r->id.idiag_cookie[1] = (u32)(((unsigned long)sk >> 31) >> 1);
-+#endif
-
- r->id.idiag_sport = inet->sport;
- r->id.idiag_dport = inet->dport;
-@@ -200,8 +205,15 @@ static int inet_twsk_diag_fill(struct in
- r->idiag_family = tw->tw_family;
- r->idiag_retrans = 0;
- r->id.idiag_if = tw->tw_bound_dev_if;
-+
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ r->id.idiag_cookie[0] = 0;
-+ r->id.idiag_cookie[1] = 0;
-+#else
- r->id.idiag_cookie[0] = (u32)(unsigned long)tw;
- r->id.idiag_cookie[1] = (u32)(((unsigned long)tw >> 31) >> 1);
-+#endif
-+
- r->id.idiag_sport = tw->tw_sport;
- r->id.idiag_dport = tw->tw_dport;
- r->id.idiag_src[0] = tw->tw_rcv_saddr;
-@@ -284,12 +296,14 @@ static int inet_diag_get_exact(struct sk
- if (sk == NULL)
- goto unlock;
-
-+#ifndef CONFIG_GRKERNSEC_HIDESYM
- err = -ESTALE;
- if ((req->id.idiag_cookie[0] != INET_DIAG_NOCOOKIE ||
- req->id.idiag_cookie[1] != INET_DIAG_NOCOOKIE) &&
- ((u32)(unsigned long)sk != req->id.idiag_cookie[0] ||
- (u32)((((unsigned long)sk) >> 31) >> 1) != req->id.idiag_cookie[1]))
- goto out;
-+#endif
-
- err = -ENOMEM;
- rep = alloc_skb(NLMSG_SPACE((sizeof(struct inet_diag_msg) +
-@@ -579,8 +593,14 @@ static int inet_diag_fill_req(struct sk_
- r->idiag_retrans = req->retrans;
-
- r->id.idiag_if = sk->sk_bound_dev_if;
-+
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ r->id.idiag_cookie[0] = 0;
-+ r->id.idiag_cookie[1] = 0;
-+#else
- r->id.idiag_cookie[0] = (u32)(unsigned long)req;
- r->id.idiag_cookie[1] = (u32)(((unsigned long)req >> 31) >> 1);
-+#endif
-
- tmo = req->expires - jiffies;
- if (tmo < 0)
-diff -urNp linux-2.6.32.45/net/ipv4/inet_hashtables.c linux-2.6.32.45/net/ipv4/inet_hashtables.c
---- linux-2.6.32.45/net/ipv4/inet_hashtables.c 2011-08-16 20:37:25.000000000 -0400
-+++ linux-2.6.32.45/net/ipv4/inet_hashtables.c 2011-08-16 20:42:30.000000000 -0400
-@@ -18,12 +18,15 @@
- #include <linux/sched.h>
- #include <linux/slab.h>
- #include <linux/wait.h>
-+#include <linux/security.h>
-
- #include <net/inet_connection_sock.h>
- #include <net/inet_hashtables.h>
- #include <net/secure_seq.h>
- #include <net/ip.h>
-
-+extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
-+
- /*
- * Allocate and initialize a new local port bind bucket.
- * The bindhash mutex for snum's hash chain must be held here.
-@@ -491,6 +494,8 @@ ok:
- }
- spin_unlock(&head->lock);
-
-+ gr_update_task_in_ip_table(current, inet_sk(sk));
-+
- if (tw) {
- inet_twsk_deschedule(tw, death_row);
- inet_twsk_put(tw);
-diff -urNp linux-2.6.32.45/net/ipv4/inetpeer.c linux-2.6.32.45/net/ipv4/inetpeer.c
---- linux-2.6.32.45/net/ipv4/inetpeer.c 2011-08-16 20:37:25.000000000 -0400
-+++ linux-2.6.32.45/net/ipv4/inetpeer.c 2011-08-07 19:48:09.000000000 -0400
-@@ -367,6 +367,8 @@ struct inet_peer *inet_getpeer(__be32 da
- struct inet_peer *p, *n;
- struct inet_peer **stack[PEER_MAXDEPTH], ***stackptr;
-
-+ pax_track_stack();
-+
- /* Look up for the address quickly. */
- read_lock_bh(&peer_pool_lock);
- p = lookup(daddr, NULL);
-@@ -390,7 +392,7 @@ struct inet_peer *inet_getpeer(__be32 da
- return NULL;
- n->v4daddr = daddr;
- atomic_set(&n->refcnt, 1);
-- atomic_set(&n->rid, 0);
-+ atomic_set_unchecked(&n->rid, 0);
- n->ip_id_count = secure_ip_id(daddr);
- n->tcp_ts_stamp = 0;
-
-diff -urNp linux-2.6.32.45/net/ipv4/ip_fragment.c linux-2.6.32.45/net/ipv4/ip_fragment.c
---- linux-2.6.32.45/net/ipv4/ip_fragment.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/ipv4/ip_fragment.c 2011-04-17 15:56:46.000000000 -0400
-@@ -255,7 +255,7 @@ static inline int ip_frag_too_far(struct
- return 0;
-
- start = qp->rid;
-- end = atomic_inc_return(&peer->rid);
-+ end = atomic_inc_return_unchecked(&peer->rid);
- qp->rid = end;
-
- rc = qp->q.fragments && (end - start) > max;
-diff -urNp linux-2.6.32.45/net/ipv4/ip_sockglue.c linux-2.6.32.45/net/ipv4/ip_sockglue.c
---- linux-2.6.32.45/net/ipv4/ip_sockglue.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/ipv4/ip_sockglue.c 2011-05-16 21:46:57.000000000 -0400
-@@ -1015,6 +1015,8 @@ static int do_ip_getsockopt(struct sock
- int val;
- int len;
-
-+ pax_track_stack();
-+
- if (level != SOL_IP)
- return -EOPNOTSUPP;
-
-diff -urNp linux-2.6.32.45/net/ipv4/netfilter/arp_tables.c linux-2.6.32.45/net/ipv4/netfilter/arp_tables.c
---- linux-2.6.32.45/net/ipv4/netfilter/arp_tables.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.45/net/ipv4/netfilter/arp_tables.c 2011-04-17 17:04:18.000000000 -0400
-@@ -934,6 +934,7 @@ static int get_info(struct net *net, voi
- private = &tmp;
- }
- #endif
-+ memset(&info, 0, sizeof(info));
- info.valid_hooks = t->valid_hooks;
- memcpy(info.hook_entry, private->hook_entry,
- sizeof(info.hook_entry));
-diff -urNp linux-2.6.32.45/net/ipv4/netfilter/ip_queue.c linux-2.6.32.45/net/ipv4/netfilter/ip_queue.c
---- linux-2.6.32.45/net/ipv4/netfilter/ip_queue.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/ipv4/netfilter/ip_queue.c 2011-08-21 18:42:53.000000000 -0400
-@@ -286,6 +286,9 @@ ipq_mangle_ipv4(ipq_verdict_msg_t *v, st
-
- if (v->data_len < sizeof(*user_iph))
- return 0;
-+ if (v->data_len > 65535)
-+ return -EMSGSIZE;
-+
- diff = v->data_len - e->skb->len;
- if (diff < 0) {
- if (pskb_trim(e->skb, v->data_len))
-@@ -409,7 +412,8 @@ ipq_dev_drop(int ifindex)
- static inline void
- __ipq_rcv_skb(struct sk_buff *skb)
- {
-- int status, type, pid, flags, nlmsglen, skblen;
-+ int status, type, pid, flags;
-+ unsigned int nlmsglen, skblen;
- struct nlmsghdr *nlh;
-
- skblen = skb->len;
-diff -urNp linux-2.6.32.45/net/ipv4/netfilter/ip_tables.c linux-2.6.32.45/net/ipv4/netfilter/ip_tables.c
---- linux-2.6.32.45/net/ipv4/netfilter/ip_tables.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.45/net/ipv4/netfilter/ip_tables.c 2011-04-17 17:04:18.000000000 -0400
-@@ -1141,6 +1141,7 @@ static int get_info(struct net *net, voi
- private = &tmp;
- }
- #endif
-+ memset(&info, 0, sizeof(info));
- info.valid_hooks = t->valid_hooks;
- memcpy(info.hook_entry, private->hook_entry,
- sizeof(info.hook_entry));
-diff -urNp linux-2.6.32.45/net/ipv4/netfilter/nf_nat_snmp_basic.c linux-2.6.32.45/net/ipv4/netfilter/nf_nat_snmp_basic.c
---- linux-2.6.32.45/net/ipv4/netfilter/nf_nat_snmp_basic.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/ipv4/netfilter/nf_nat_snmp_basic.c 2011-04-17 15:56:46.000000000 -0400
-@@ -397,7 +397,7 @@ static unsigned char asn1_octets_decode(
-
- *len = 0;
-
-- *octets = kmalloc(eoc - ctx->pointer, GFP_ATOMIC);
-+ *octets = kmalloc((eoc - ctx->pointer), GFP_ATOMIC);
- if (*octets == NULL) {
- if (net_ratelimit())
- printk("OOM in bsalg (%d)\n", __LINE__);
-diff -urNp linux-2.6.32.45/net/ipv4/raw.c linux-2.6.32.45/net/ipv4/raw.c
---- linux-2.6.32.45/net/ipv4/raw.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/ipv4/raw.c 2011-08-14 11:46:51.000000000 -0400
-@@ -292,7 +292,7 @@ static int raw_rcv_skb(struct sock * sk,
- /* Charge it to the socket. */
-
- if (sock_queue_rcv_skb(sk, skb) < 0) {
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- kfree_skb(skb);
- return NET_RX_DROP;
- }
-@@ -303,7 +303,7 @@ static int raw_rcv_skb(struct sock * sk,
- int raw_rcv(struct sock *sk, struct sk_buff *skb)
- {
- if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb)) {
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- kfree_skb(skb);
- return NET_RX_DROP;
- }
-@@ -724,16 +724,23 @@ static int raw_init(struct sock *sk)
-
- static int raw_seticmpfilter(struct sock *sk, char __user *optval, int optlen)
- {
-+ struct icmp_filter filter;
-+
-+ if (optlen < 0)
-+ return -EINVAL;
- if (optlen > sizeof(struct icmp_filter))
- optlen = sizeof(struct icmp_filter);
-- if (copy_from_user(&raw_sk(sk)->filter, optval, optlen))
-+ if (copy_from_user(&filter, optval, optlen))
- return -EFAULT;
-+ raw_sk(sk)->filter = filter;
-+
- return 0;
- }
-
- static int raw_geticmpfilter(struct sock *sk, char __user *optval, int __user *optlen)
- {
- int len, ret = -EFAULT;
-+ struct icmp_filter filter;
-
- if (get_user(len, optlen))
- goto out;
-@@ -743,8 +750,9 @@ static int raw_geticmpfilter(struct sock
- if (len > sizeof(struct icmp_filter))
- len = sizeof(struct icmp_filter);
- ret = -EFAULT;
-- if (put_user(len, optlen) ||
-- copy_to_user(optval, &raw_sk(sk)->filter, len))
-+ filter = raw_sk(sk)->filter;
-+ if (put_user(len, optlen) || len > sizeof filter ||
-+ copy_to_user(optval, &filter, len))
- goto out;
- ret = 0;
- out: return ret;
-@@ -954,7 +962,13 @@ static void raw_sock_seq_show(struct seq
- sk_wmem_alloc_get(sp),
- sk_rmem_alloc_get(sp),
- 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
-- atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
-+ atomic_read(&sp->sk_refcnt),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
-+ sp,
-+#endif
-+ atomic_read_unchecked(&sp->sk_drops));
- }
-
- static int raw_seq_show(struct seq_file *seq, void *v)
-diff -urNp linux-2.6.32.45/net/ipv4/route.c linux-2.6.32.45/net/ipv4/route.c
---- linux-2.6.32.45/net/ipv4/route.c 2011-08-16 20:37:25.000000000 -0400
-+++ linux-2.6.32.45/net/ipv4/route.c 2011-08-07 19:48:09.000000000 -0400
-@@ -269,7 +269,7 @@ static inline unsigned int rt_hash(__be3
-
- static inline int rt_genid(struct net *net)
- {
-- return atomic_read(&net->ipv4.rt_genid);
-+ return atomic_read_unchecked(&net->ipv4.rt_genid);
- }
-
- #ifdef CONFIG_PROC_FS
-@@ -889,7 +889,7 @@ static void rt_cache_invalidate(struct n
- unsigned char shuffle;
-
- get_random_bytes(&shuffle, sizeof(shuffle));
-- atomic_add(shuffle + 1U, &net->ipv4.rt_genid);
-+ atomic_add_unchecked(shuffle + 1U, &net->ipv4.rt_genid);
- }
-
- /*
-@@ -3357,7 +3357,7 @@ static __net_initdata struct pernet_oper
-
- static __net_init int rt_secret_timer_init(struct net *net)
- {
-- atomic_set(&net->ipv4.rt_genid,
-+ atomic_set_unchecked(&net->ipv4.rt_genid,
- (int) ((num_physpages ^ (num_physpages>>8)) ^
- (jiffies ^ (jiffies >> 7))));
-
-diff -urNp linux-2.6.32.45/net/ipv4/tcp.c linux-2.6.32.45/net/ipv4/tcp.c
---- linux-2.6.32.45/net/ipv4/tcp.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/ipv4/tcp.c 2011-05-16 21:46:57.000000000 -0400
-@@ -2085,6 +2085,8 @@ static int do_tcp_setsockopt(struct sock
- int val;
- int err = 0;
-
-+ pax_track_stack();
-+
- /* This is a string value all the others are int's */
- if (optname == TCP_CONGESTION) {
- char name[TCP_CA_NAME_MAX];
-@@ -2355,6 +2357,8 @@ static int do_tcp_getsockopt(struct sock
- struct tcp_sock *tp = tcp_sk(sk);
- int val, len;
-
-+ pax_track_stack();
-+
- if (get_user(len, optlen))
- return -EFAULT;
-
-diff -urNp linux-2.6.32.45/net/ipv4/tcp_ipv4.c linux-2.6.32.45/net/ipv4/tcp_ipv4.c
---- linux-2.6.32.45/net/ipv4/tcp_ipv4.c 2011-08-16 20:37:25.000000000 -0400
-+++ linux-2.6.32.45/net/ipv4/tcp_ipv4.c 2011-08-07 19:48:09.000000000 -0400
-@@ -85,6 +85,9 @@
- int sysctl_tcp_tw_reuse __read_mostly;
- int sysctl_tcp_low_latency __read_mostly;
-
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+extern int grsec_enable_blackhole;
-+#endif
-
- #ifdef CONFIG_TCP_MD5SIG
- static struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk,
-@@ -1543,6 +1546,9 @@ int tcp_v4_do_rcv(struct sock *sk, struc
- return 0;
-
- reset:
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ if (!grsec_enable_blackhole)
-+#endif
- tcp_v4_send_reset(rsk, skb);
- discard:
- kfree_skb(skb);
-@@ -1604,12 +1610,20 @@ int tcp_v4_rcv(struct sk_buff *skb)
- TCP_SKB_CB(skb)->sacked = 0;
-
- sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
-- if (!sk)
-+ if (!sk) {
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ ret = 1;
-+#endif
- goto no_tcp_socket;
-+ }
-
- process:
-- if (sk->sk_state == TCP_TIME_WAIT)
-+ if (sk->sk_state == TCP_TIME_WAIT) {
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ ret = 2;
-+#endif
- goto do_time_wait;
-+ }
-
- if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
- goto discard_and_relse;
-@@ -1651,6 +1665,10 @@ no_tcp_socket:
- bad_packet:
- TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
- } else {
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ if (!grsec_enable_blackhole || (ret == 1 &&
-+ (skb->dev->flags & IFF_LOOPBACK)))
-+#endif
- tcp_v4_send_reset(NULL, skb);
- }
-
-@@ -2195,14 +2213,14 @@ int tcp_proc_register(struct net *net, s
- int rc = 0;
- struct proc_dir_entry *p;
-
-- afinfo->seq_fops.open = tcp_seq_open;
-- afinfo->seq_fops.read = seq_read;
-- afinfo->seq_fops.llseek = seq_lseek;
-- afinfo->seq_fops.release = seq_release_net;
--
-- afinfo->seq_ops.start = tcp_seq_start;
-- afinfo->seq_ops.next = tcp_seq_next;
-- afinfo->seq_ops.stop = tcp_seq_stop;
-+ *(void **)&afinfo->seq_fops.open = tcp_seq_open;
-+ *(void **)&afinfo->seq_fops.read = seq_read;
-+ *(void **)&afinfo->seq_fops.llseek = seq_lseek;
-+ *(void **)&afinfo->seq_fops.release = seq_release_net;
-+
-+ *(void **)&afinfo->seq_ops.start = tcp_seq_start;
-+ *(void **)&afinfo->seq_ops.next = tcp_seq_next;
-+ *(void **)&afinfo->seq_ops.stop = tcp_seq_stop;
-
- p = proc_create_data(afinfo->name, S_IRUGO, net->proc_net,
- &afinfo->seq_fops, afinfo);
-@@ -2238,7 +2256,11 @@ static void get_openreq4(struct sock *sk
- 0, /* non standard timer */
- 0, /* open_requests have no inode */
- atomic_read(&sk->sk_refcnt),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
- req,
-+#endif
- len);
- }
-
-@@ -2280,7 +2302,12 @@ static void get_tcp4_sock(struct sock *s
- sock_i_uid(sk),
- icsk->icsk_probes_out,
- sock_i_ino(sk),
-- atomic_read(&sk->sk_refcnt), sk,
-+ atomic_read(&sk->sk_refcnt),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
-+ sk,
-+#endif
- jiffies_to_clock_t(icsk->icsk_rto),
- jiffies_to_clock_t(icsk->icsk_ack.ato),
- (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
-@@ -2308,7 +2335,13 @@ static void get_timewait4_sock(struct in
- " %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p%n",
- i, src, srcp, dest, destp, tw->tw_substate, 0, 0,
- 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
-- atomic_read(&tw->tw_refcnt), tw, len);
-+ atomic_read(&tw->tw_refcnt),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
-+ tw,
-+#endif
-+ len);
- }
-
- #define TMPSZ 150
-diff -urNp linux-2.6.32.45/net/ipv4/tcp_minisocks.c linux-2.6.32.45/net/ipv4/tcp_minisocks.c
---- linux-2.6.32.45/net/ipv4/tcp_minisocks.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/ipv4/tcp_minisocks.c 2011-04-17 15:56:46.000000000 -0400
-@@ -26,6 +26,10 @@
- #include <net/inet_common.h>
- #include <net/xfrm.h>
-
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+extern int grsec_enable_blackhole;
-+#endif
-+
- #ifdef CONFIG_SYSCTL
- #define SYNC_INIT 0 /* let the user enable it */
- #else
-@@ -672,6 +676,10 @@ listen_overflow:
-
- embryonic_reset:
- NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
-+
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ if (!grsec_enable_blackhole)
-+#endif
- if (!(flg & TCP_FLAG_RST))
- req->rsk_ops->send_reset(sk, skb);
-
-diff -urNp linux-2.6.32.45/net/ipv4/tcp_output.c linux-2.6.32.45/net/ipv4/tcp_output.c
---- linux-2.6.32.45/net/ipv4/tcp_output.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/ipv4/tcp_output.c 2011-05-16 21:46:57.000000000 -0400
-@@ -2234,6 +2234,8 @@ struct sk_buff *tcp_make_synack(struct s
- __u8 *md5_hash_location;
- int mss;
-
-+ pax_track_stack();
-+
- skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15, 1, GFP_ATOMIC);
- if (skb == NULL)
- return NULL;
-diff -urNp linux-2.6.32.45/net/ipv4/tcp_probe.c linux-2.6.32.45/net/ipv4/tcp_probe.c
---- linux-2.6.32.45/net/ipv4/tcp_probe.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/ipv4/tcp_probe.c 2011-04-17 15:56:46.000000000 -0400
-@@ -200,7 +200,7 @@ static ssize_t tcpprobe_read(struct file
- if (cnt + width >= len)
- break;
-
-- if (copy_to_user(buf + cnt, tbuf, width))
-+ if (width > sizeof tbuf || copy_to_user(buf + cnt, tbuf, width))
- return -EFAULT;
- cnt += width;
- }
-diff -urNp linux-2.6.32.45/net/ipv4/tcp_timer.c linux-2.6.32.45/net/ipv4/tcp_timer.c
---- linux-2.6.32.45/net/ipv4/tcp_timer.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/ipv4/tcp_timer.c 2011-04-17 15:56:46.000000000 -0400
-@@ -21,6 +21,10 @@
- #include <linux/module.h>
- #include <net/tcp.h>
-
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+extern int grsec_lastack_retries;
-+#endif
-+
- int sysctl_tcp_syn_retries __read_mostly = TCP_SYN_RETRIES;
- int sysctl_tcp_synack_retries __read_mostly = TCP_SYNACK_RETRIES;
- int sysctl_tcp_keepalive_time __read_mostly = TCP_KEEPALIVE_TIME;
-@@ -164,6 +168,13 @@ static int tcp_write_timeout(struct sock
- }
- }
-
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ if ((sk->sk_state == TCP_LAST_ACK) &&
-+ (grsec_lastack_retries > 0) &&
-+ (grsec_lastack_retries < retry_until))
-+ retry_until = grsec_lastack_retries;
-+#endif
-+
- if (retransmits_timed_out(sk, retry_until)) {
- /* Has it gone just too far? */
- tcp_write_err(sk);
-diff -urNp linux-2.6.32.45/net/ipv4/udp.c linux-2.6.32.45/net/ipv4/udp.c
---- linux-2.6.32.45/net/ipv4/udp.c 2011-07-13 17:23:04.000000000 -0400
-+++ linux-2.6.32.45/net/ipv4/udp.c 2011-08-05 20:33:55.000000000 -0400
-@@ -86,6 +86,7 @@
- #include <linux/types.h>
- #include <linux/fcntl.h>
- #include <linux/module.h>
-+#include <linux/security.h>
- #include <linux/socket.h>
- #include <linux/sockios.h>
- #include <linux/igmp.h>
-@@ -106,6 +107,10 @@
- #include <net/xfrm.h>
- #include "udp_impl.h"
-
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+extern int grsec_enable_blackhole;
-+#endif
-+
- struct udp_table udp_table;
- EXPORT_SYMBOL(udp_table);
-
-@@ -371,6 +376,9 @@ found:
- return s;
- }
-
-+extern int gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb);
-+extern int gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr);
-+
- /*
- * This routine is called by the ICMP module when it gets some
- * sort of error condition. If err < 0 then the socket should
-@@ -639,9 +647,18 @@ int udp_sendmsg(struct kiocb *iocb, stru
- dport = usin->sin_port;
- if (dport == 0)
- return -EINVAL;
-+
-+ err = gr_search_udp_sendmsg(sk, usin);
-+ if (err)
-+ return err;
- } else {
- if (sk->sk_state != TCP_ESTABLISHED)
- return -EDESTADDRREQ;
-+
-+ err = gr_search_udp_sendmsg(sk, NULL);
-+ if (err)
-+ return err;
-+
- daddr = inet->daddr;
- dport = inet->dport;
- /* Open fast path for connected socket.
-@@ -945,6 +962,10 @@ try_again:
- if (!skb)
- goto out;
-
-+ err = gr_search_udp_recvmsg(sk, skb);
-+ if (err)
-+ goto out_free;
-+
- ulen = skb->len - sizeof(struct udphdr);
- copied = len;
- if (copied > ulen)
-@@ -1068,7 +1089,7 @@ static int __udp_queue_rcv_skb(struct so
- if (rc == -ENOMEM) {
- UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
- is_udplite);
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- }
- goto drop;
- }
-@@ -1338,6 +1359,9 @@ int __udp4_lib_rcv(struct sk_buff *skb,
- goto csum_error;
-
- UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
-+#endif
- icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
-
- /*
-@@ -1719,14 +1743,14 @@ int udp_proc_register(struct net *net, s
- struct proc_dir_entry *p;
- int rc = 0;
-
-- afinfo->seq_fops.open = udp_seq_open;
-- afinfo->seq_fops.read = seq_read;
-- afinfo->seq_fops.llseek = seq_lseek;
-- afinfo->seq_fops.release = seq_release_net;
--
-- afinfo->seq_ops.start = udp_seq_start;
-- afinfo->seq_ops.next = udp_seq_next;
-- afinfo->seq_ops.stop = udp_seq_stop;
-+ *(void **)&afinfo->seq_fops.open = udp_seq_open;
-+ *(void **)&afinfo->seq_fops.read = seq_read;
-+ *(void **)&afinfo->seq_fops.llseek = seq_lseek;
-+ *(void **)&afinfo->seq_fops.release = seq_release_net;
-+
-+ *(void **)&afinfo->seq_ops.start = udp_seq_start;
-+ *(void **)&afinfo->seq_ops.next = udp_seq_next;
-+ *(void **)&afinfo->seq_ops.stop = udp_seq_stop;
-
- p = proc_create_data(afinfo->name, S_IRUGO, net->proc_net,
- &afinfo->seq_fops, afinfo);
-@@ -1758,8 +1782,13 @@ static void udp4_format_sock(struct sock
- sk_wmem_alloc_get(sp),
- sk_rmem_alloc_get(sp),
- 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
-- atomic_read(&sp->sk_refcnt), sp,
-- atomic_read(&sp->sk_drops), len);
-+ atomic_read(&sp->sk_refcnt),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
-+ sp,
-+#endif
-+ atomic_read_unchecked(&sp->sk_drops), len);
- }
-
- int udp4_seq_show(struct seq_file *seq, void *v)
-diff -urNp linux-2.6.32.45/net/ipv6/inet6_connection_sock.c linux-2.6.32.45/net/ipv6/inet6_connection_sock.c
---- linux-2.6.32.45/net/ipv6/inet6_connection_sock.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/ipv6/inet6_connection_sock.c 2011-05-04 17:56:28.000000000 -0400
-@@ -152,7 +152,7 @@ void __inet6_csk_dst_store(struct sock *
- #ifdef CONFIG_XFRM
- {
- struct rt6_info *rt = (struct rt6_info *)dst;
-- rt->rt6i_flow_cache_genid = atomic_read(&flow_cache_genid);
-+ rt->rt6i_flow_cache_genid = atomic_read_unchecked(&flow_cache_genid);
- }
- #endif
- }
-@@ -167,7 +167,7 @@ struct dst_entry *__inet6_csk_dst_check(
- #ifdef CONFIG_XFRM
- if (dst) {
- struct rt6_info *rt = (struct rt6_info *)dst;
-- if (rt->rt6i_flow_cache_genid != atomic_read(&flow_cache_genid)) {
-+ if (rt->rt6i_flow_cache_genid != atomic_read_unchecked(&flow_cache_genid)) {
- sk->sk_dst_cache = NULL;
- dst_release(dst);
- dst = NULL;
-diff -urNp linux-2.6.32.45/net/ipv6/inet6_hashtables.c linux-2.6.32.45/net/ipv6/inet6_hashtables.c
---- linux-2.6.32.45/net/ipv6/inet6_hashtables.c 2011-08-16 20:37:25.000000000 -0400
-+++ linux-2.6.32.45/net/ipv6/inet6_hashtables.c 2011-08-07 19:48:09.000000000 -0400
-@@ -119,7 +119,7 @@ out:
- }
- EXPORT_SYMBOL(__inet6_lookup_established);
-
--static int inline compute_score(struct sock *sk, struct net *net,
-+static inline int compute_score(struct sock *sk, struct net *net,
- const unsigned short hnum,
- const struct in6_addr *daddr,
- const int dif)
-diff -urNp linux-2.6.32.45/net/ipv6/ipv6_sockglue.c linux-2.6.32.45/net/ipv6/ipv6_sockglue.c
---- linux-2.6.32.45/net/ipv6/ipv6_sockglue.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/ipv6/ipv6_sockglue.c 2011-05-16 21:46:57.000000000 -0400
-@@ -130,6 +130,8 @@ static int do_ipv6_setsockopt(struct soc
- int val, valbool;
- int retv = -ENOPROTOOPT;
-
-+ pax_track_stack();
-+
- if (optval == NULL)
- val=0;
- else {
-@@ -881,6 +883,8 @@ static int do_ipv6_getsockopt(struct soc
- int len;
- int val;
-
-+ pax_track_stack();
-+
- if (ip6_mroute_opt(optname))
- return ip6_mroute_getsockopt(sk, optname, optval, optlen);
-
-diff -urNp linux-2.6.32.45/net/ipv6/netfilter/ip6_queue.c linux-2.6.32.45/net/ipv6/netfilter/ip6_queue.c
---- linux-2.6.32.45/net/ipv6/netfilter/ip6_queue.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/ipv6/netfilter/ip6_queue.c 2011-08-21 18:43:32.000000000 -0400
-@@ -287,6 +287,9 @@ ipq_mangle_ipv6(ipq_verdict_msg_t *v, st
-
- if (v->data_len < sizeof(*user_iph))
- return 0;
-+ if (v->data_len > 65535)
-+ return -EMSGSIZE;
-+
- diff = v->data_len - e->skb->len;
- if (diff < 0) {
- if (pskb_trim(e->skb, v->data_len))
-@@ -411,7 +414,8 @@ ipq_dev_drop(int ifindex)
- static inline void
- __ipq_rcv_skb(struct sk_buff *skb)
- {
-- int status, type, pid, flags, nlmsglen, skblen;
-+ int status, type, pid, flags;
-+ unsigned int nlmsglen, skblen;
- struct nlmsghdr *nlh;
-
- skblen = skb->len;
-diff -urNp linux-2.6.32.45/net/ipv6/netfilter/ip6_tables.c linux-2.6.32.45/net/ipv6/netfilter/ip6_tables.c
---- linux-2.6.32.45/net/ipv6/netfilter/ip6_tables.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.45/net/ipv6/netfilter/ip6_tables.c 2011-04-17 17:04:18.000000000 -0400
-@@ -1173,6 +1173,7 @@ static int get_info(struct net *net, voi
- private = &tmp;
- }
- #endif
-+ memset(&info, 0, sizeof(info));
- info.valid_hooks = t->valid_hooks;
- memcpy(info.hook_entry, private->hook_entry,
- sizeof(info.hook_entry));
-diff -urNp linux-2.6.32.45/net/ipv6/raw.c linux-2.6.32.45/net/ipv6/raw.c
---- linux-2.6.32.45/net/ipv6/raw.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/ipv6/raw.c 2011-08-14 11:48:20.000000000 -0400
-@@ -375,14 +375,14 @@ static inline int rawv6_rcv_skb(struct s
- {
- if ((raw6_sk(sk)->checksum || sk->sk_filter) &&
- skb_checksum_complete(skb)) {
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- kfree_skb(skb);
- return NET_RX_DROP;
- }
-
- /* Charge it to the socket. */
- if (sock_queue_rcv_skb(sk,skb)<0) {
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- kfree_skb(skb);
- return NET_RX_DROP;
- }
-@@ -403,7 +403,7 @@ int rawv6_rcv(struct sock *sk, struct sk
- struct raw6_sock *rp = raw6_sk(sk);
-
- if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) {
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- kfree_skb(skb);
- return NET_RX_DROP;
- }
-@@ -427,7 +427,7 @@ int rawv6_rcv(struct sock *sk, struct sk
-
- if (inet->hdrincl) {
- if (skb_checksum_complete(skb)) {
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- kfree_skb(skb);
- return NET_RX_DROP;
- }
-@@ -518,7 +518,7 @@ csum_copy_err:
- as some normal condition.
- */
- err = (flags&MSG_DONTWAIT) ? -EAGAIN : -EHOSTUNREACH;
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- goto out;
- }
-
-@@ -600,7 +600,7 @@ out:
- return err;
- }
-
--static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
-+static int rawv6_send_hdrinc(struct sock *sk, void *from, unsigned int length,
- struct flowi *fl, struct rt6_info *rt,
- unsigned int flags)
- {
-@@ -738,6 +738,8 @@ static int rawv6_sendmsg(struct kiocb *i
- u16 proto;
- int err;
-
-+ pax_track_stack();
-+
- /* Rough check on arithmetic overflow,
- better check is made in ip6_append_data().
- */
-@@ -916,12 +918,17 @@ do_confirm:
- static int rawv6_seticmpfilter(struct sock *sk, int level, int optname,
- char __user *optval, int optlen)
- {
-+ struct icmp6_filter filter;
-+
- switch (optname) {
- case ICMPV6_FILTER:
-+ if (optlen < 0)
-+ return -EINVAL;
- if (optlen > sizeof(struct icmp6_filter))
- optlen = sizeof(struct icmp6_filter);
-- if (copy_from_user(&raw6_sk(sk)->filter, optval, optlen))
-+ if (copy_from_user(&filter, optval, optlen))
- return -EFAULT;
-+ raw6_sk(sk)->filter = filter;
- return 0;
- default:
- return -ENOPROTOOPT;
-@@ -934,6 +941,7 @@ static int rawv6_geticmpfilter(struct so
- char __user *optval, int __user *optlen)
- {
- int len;
-+ struct icmp6_filter filter;
-
- switch (optname) {
- case ICMPV6_FILTER:
-@@ -945,7 +953,8 @@ static int rawv6_geticmpfilter(struct so
- len = sizeof(struct icmp6_filter);
- if (put_user(len, optlen))
- return -EFAULT;
-- if (copy_to_user(optval, &raw6_sk(sk)->filter, len))
-+ filter = raw6_sk(sk)->filter;
-+ if (len > sizeof filter || copy_to_user(optval, &filter, len))
- return -EFAULT;
- return 0;
- default:
-@@ -1241,7 +1250,13 @@ static void raw6_sock_seq_show(struct se
- 0, 0L, 0,
- sock_i_uid(sp), 0,
- sock_i_ino(sp),
-- atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
-+ atomic_read(&sp->sk_refcnt),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
-+ sp,
-+#endif
-+ atomic_read_unchecked(&sp->sk_drops));
- }
-
- static int raw6_seq_show(struct seq_file *seq, void *v)
-diff -urNp linux-2.6.32.45/net/ipv6/tcp_ipv6.c linux-2.6.32.45/net/ipv6/tcp_ipv6.c
---- linux-2.6.32.45/net/ipv6/tcp_ipv6.c 2011-08-16 20:37:25.000000000 -0400
-+++ linux-2.6.32.45/net/ipv6/tcp_ipv6.c 2011-08-07 19:48:09.000000000 -0400
-@@ -89,6 +89,10 @@ static struct tcp_md5sig_key *tcp_v6_md5
- }
- #endif
-
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+extern int grsec_enable_blackhole;
-+#endif
-+
- static void tcp_v6_hash(struct sock *sk)
- {
- if (sk->sk_state != TCP_CLOSE) {
-@@ -1579,6 +1583,9 @@ static int tcp_v6_do_rcv(struct sock *sk
- return 0;
-
- reset:
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ if (!grsec_enable_blackhole)
-+#endif
- tcp_v6_send_reset(sk, skb);
- discard:
- if (opt_skb)
-@@ -1656,12 +1663,20 @@ static int tcp_v6_rcv(struct sk_buff *sk
- TCP_SKB_CB(skb)->sacked = 0;
-
- sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
-- if (!sk)
-+ if (!sk) {
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ ret = 1;
-+#endif
- goto no_tcp_socket;
-+ }
-
- process:
-- if (sk->sk_state == TCP_TIME_WAIT)
-+ if (sk->sk_state == TCP_TIME_WAIT) {
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ ret = 2;
-+#endif
- goto do_time_wait;
-+ }
-
- if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
- goto discard_and_relse;
-@@ -1701,6 +1716,10 @@ no_tcp_socket:
- bad_packet:
- TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
- } else {
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ if (!grsec_enable_blackhole || (ret == 1 &&
-+ (skb->dev->flags & IFF_LOOPBACK)))
-+#endif
- tcp_v6_send_reset(NULL, skb);
- }
-
-@@ -1916,7 +1935,13 @@ static void get_openreq6(struct seq_file
- uid,
- 0, /* non standard timer */
- 0, /* open_requests have no inode */
-- 0, req);
-+ 0,
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL
-+#else
-+ req
-+#endif
-+ );
- }
-
- static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
-@@ -1966,7 +1991,12 @@ static void get_tcp6_sock(struct seq_fil
- sock_i_uid(sp),
- icsk->icsk_probes_out,
- sock_i_ino(sp),
-- atomic_read(&sp->sk_refcnt), sp,
-+ atomic_read(&sp->sk_refcnt),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
-+ sp,
-+#endif
- jiffies_to_clock_t(icsk->icsk_rto),
- jiffies_to_clock_t(icsk->icsk_ack.ato),
- (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
-@@ -2001,7 +2031,13 @@ static void get_timewait6_sock(struct se
- dest->s6_addr32[2], dest->s6_addr32[3], destp,
- tw->tw_substate, 0, 0,
- 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
-- atomic_read(&tw->tw_refcnt), tw);
-+ atomic_read(&tw->tw_refcnt),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL
-+#else
-+ tw
-+#endif
-+ );
- }
-
- static int tcp6_seq_show(struct seq_file *seq, void *v)
-diff -urNp linux-2.6.32.45/net/ipv6/udp.c linux-2.6.32.45/net/ipv6/udp.c
---- linux-2.6.32.45/net/ipv6/udp.c 2011-07-13 17:23:04.000000000 -0400
-+++ linux-2.6.32.45/net/ipv6/udp.c 2011-07-13 17:23:27.000000000 -0400
-@@ -49,6 +49,10 @@
- #include <linux/seq_file.h>
- #include "udp_impl.h"
-
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+extern int grsec_enable_blackhole;
-+#endif
-+
- int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
- {
- const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr;
-@@ -391,7 +395,7 @@ int udpv6_queue_rcv_skb(struct sock * sk
- if (rc == -ENOMEM) {
- UDP6_INC_STATS_BH(sock_net(sk),
- UDP_MIB_RCVBUFERRORS, is_udplite);
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- }
- goto drop;
- }
-@@ -590,6 +594,9 @@ int __udp6_lib_rcv(struct sk_buff *skb,
- UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
- proto == IPPROTO_UDPLITE);
-
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+ if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
-+#endif
- icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0, dev);
-
- kfree_skb(skb);
-@@ -1209,8 +1216,13 @@ static void udp6_sock_seq_show(struct se
- 0, 0L, 0,
- sock_i_uid(sp), 0,
- sock_i_ino(sp),
-- atomic_read(&sp->sk_refcnt), sp,
-- atomic_read(&sp->sk_drops));
-+ atomic_read(&sp->sk_refcnt),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
-+ sp,
-+#endif
-+ atomic_read_unchecked(&sp->sk_drops));
- }
-
- int udp6_seq_show(struct seq_file *seq, void *v)
-diff -urNp linux-2.6.32.45/net/irda/ircomm/ircomm_tty.c linux-2.6.32.45/net/irda/ircomm/ircomm_tty.c
---- linux-2.6.32.45/net/irda/ircomm/ircomm_tty.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/irda/ircomm/ircomm_tty.c 2011-04-17 15:56:46.000000000 -0400
-@@ -280,16 +280,16 @@ static int ircomm_tty_block_til_ready(st
- add_wait_queue(&self->open_wait, &wait);
-
- IRDA_DEBUG(2, "%s(%d):block_til_ready before block on %s open_count=%d\n",
-- __FILE__,__LINE__, tty->driver->name, self->open_count );
-+ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
-
- /* As far as I can see, we protect open_count - Jean II */
- spin_lock_irqsave(&self->spinlock, flags);
- if (!tty_hung_up_p(filp)) {
- extra_count = 1;
-- self->open_count--;
-+ local_dec(&self->open_count);
- }
- spin_unlock_irqrestore(&self->spinlock, flags);
-- self->blocked_open++;
-+ local_inc(&self->blocked_open);
-
- while (1) {
- if (tty->termios->c_cflag & CBAUD) {
-@@ -329,7 +329,7 @@ static int ircomm_tty_block_til_ready(st
- }
-
- IRDA_DEBUG(1, "%s(%d):block_til_ready blocking on %s open_count=%d\n",
-- __FILE__,__LINE__, tty->driver->name, self->open_count );
-+ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
-
- schedule();
- }
-@@ -340,13 +340,13 @@ static int ircomm_tty_block_til_ready(st
- if (extra_count) {
- /* ++ is not atomic, so this should be protected - Jean II */
- spin_lock_irqsave(&self->spinlock, flags);
-- self->open_count++;
-+ local_inc(&self->open_count);
- spin_unlock_irqrestore(&self->spinlock, flags);
- }
-- self->blocked_open--;
-+ local_dec(&self->blocked_open);
-
- IRDA_DEBUG(1, "%s(%d):block_til_ready after blocking on %s open_count=%d\n",
-- __FILE__,__LINE__, tty->driver->name, self->open_count);
-+ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count));
-
- if (!retval)
- self->flags |= ASYNC_NORMAL_ACTIVE;
-@@ -415,14 +415,14 @@ static int ircomm_tty_open(struct tty_st
- }
- /* ++ is not atomic, so this should be protected - Jean II */
- spin_lock_irqsave(&self->spinlock, flags);
-- self->open_count++;
-+ local_inc(&self->open_count);
-
- tty->driver_data = self;
- self->tty = tty;
- spin_unlock_irqrestore(&self->spinlock, flags);
-
- IRDA_DEBUG(1, "%s(), %s%d, count = %d\n", __func__ , tty->driver->name,
-- self->line, self->open_count);
-+ self->line, local_read(&self->open_count));
-
- /* Not really used by us, but lets do it anyway */
- self->tty->low_latency = (self->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
-@@ -511,7 +511,7 @@ static void ircomm_tty_close(struct tty_
- return;
- }
-
-- if ((tty->count == 1) && (self->open_count != 1)) {
-+ if ((tty->count == 1) && (local_read(&self->open_count) != 1)) {
- /*
- * Uh, oh. tty->count is 1, which means that the tty
- * structure will be freed. state->count should always
-@@ -521,16 +521,16 @@ static void ircomm_tty_close(struct tty_
- */
- IRDA_DEBUG(0, "%s(), bad serial port count; "
- "tty->count is 1, state->count is %d\n", __func__ ,
-- self->open_count);
-- self->open_count = 1;
-+ local_read(&self->open_count));
-+ local_set(&self->open_count, 1);
- }
-
-- if (--self->open_count < 0) {
-+ if (local_dec_return(&self->open_count) < 0) {
- IRDA_ERROR("%s(), bad serial port count for ttys%d: %d\n",
-- __func__, self->line, self->open_count);
-- self->open_count = 0;
-+ __func__, self->line, local_read(&self->open_count));
-+ local_set(&self->open_count, 0);
- }
-- if (self->open_count) {
-+ if (local_read(&self->open_count)) {
- spin_unlock_irqrestore(&self->spinlock, flags);
-
- IRDA_DEBUG(0, "%s(), open count > 0\n", __func__ );
-@@ -562,7 +562,7 @@ static void ircomm_tty_close(struct tty_
- tty->closing = 0;
- self->tty = NULL;
-
-- if (self->blocked_open) {
-+ if (local_read(&self->blocked_open)) {
- if (self->close_delay)
- schedule_timeout_interruptible(self->close_delay);
- wake_up_interruptible(&self->open_wait);
-@@ -1017,7 +1017,7 @@ static void ircomm_tty_hangup(struct tty
- spin_lock_irqsave(&self->spinlock, flags);
- self->flags &= ~ASYNC_NORMAL_ACTIVE;
- self->tty = NULL;
-- self->open_count = 0;
-+ local_set(&self->open_count, 0);
- spin_unlock_irqrestore(&self->spinlock, flags);
-
- wake_up_interruptible(&self->open_wait);
-@@ -1369,7 +1369,7 @@ static void ircomm_tty_line_info(struct
- seq_putc(m, '\n');
-
- seq_printf(m, "Role: %s\n", self->client ? "client" : "server");
-- seq_printf(m, "Open count: %d\n", self->open_count);
-+ seq_printf(m, "Open count: %d\n", local_read(&self->open_count));
- seq_printf(m, "Max data size: %d\n", self->max_data_size);
- seq_printf(m, "Max header size: %d\n", self->max_header_size);
-
-diff -urNp linux-2.6.32.45/net/iucv/af_iucv.c linux-2.6.32.45/net/iucv/af_iucv.c
---- linux-2.6.32.45/net/iucv/af_iucv.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/iucv/af_iucv.c 2011-05-04 17:56:28.000000000 -0400
-@@ -651,10 +651,10 @@ static int iucv_sock_autobind(struct soc
-
- write_lock_bh(&iucv_sk_list.lock);
-
-- sprintf(name, "%08x", atomic_inc_return(&iucv_sk_list.autobind_name));
-+ sprintf(name, "%08x", atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
- while (__iucv_get_sock_by_name(name)) {
- sprintf(name, "%08x",
-- atomic_inc_return(&iucv_sk_list.autobind_name));
-+ atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
- }
-
- write_unlock_bh(&iucv_sk_list.lock);
-diff -urNp linux-2.6.32.45/net/key/af_key.c linux-2.6.32.45/net/key/af_key.c
---- linux-2.6.32.45/net/key/af_key.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/key/af_key.c 2011-05-16 21:46:57.000000000 -0400
-@@ -2489,6 +2489,8 @@ static int pfkey_migrate(struct sock *sk
- struct xfrm_migrate m[XFRM_MAX_DEPTH];
- struct xfrm_kmaddress k;
-
-+ pax_track_stack();
-+
- if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC - 1],
- ext_hdrs[SADB_EXT_ADDRESS_DST - 1]) ||
- !ext_hdrs[SADB_X_EXT_POLICY - 1]) {
-@@ -3660,7 +3662,11 @@ static int pfkey_seq_show(struct seq_fil
- seq_printf(f ,"sk RefCnt Rmem Wmem User Inode\n");
- else
- seq_printf(f ,"%p %-6d %-6u %-6u %-6u %-6lu\n",
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
- s,
-+#endif
- atomic_read(&s->sk_refcnt),
- sk_rmem_alloc_get(s),
- sk_wmem_alloc_get(s),
-diff -urNp linux-2.6.32.45/net/lapb/lapb_iface.c linux-2.6.32.45/net/lapb/lapb_iface.c
---- linux-2.6.32.45/net/lapb/lapb_iface.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/lapb/lapb_iface.c 2011-08-05 20:33:55.000000000 -0400
-@@ -157,7 +157,7 @@ int lapb_register(struct net_device *dev
- goto out;
-
- lapb->dev = dev;
-- lapb->callbacks = *callbacks;
-+ lapb->callbacks = callbacks;
-
- __lapb_insert_cb(lapb);
-
-@@ -379,32 +379,32 @@ int lapb_data_received(struct net_device
-
- void lapb_connect_confirmation(struct lapb_cb *lapb, int reason)
- {
-- if (lapb->callbacks.connect_confirmation)
-- lapb->callbacks.connect_confirmation(lapb->dev, reason);
-+ if (lapb->callbacks->connect_confirmation)
-+ lapb->callbacks->connect_confirmation(lapb->dev, reason);
- }
-
- void lapb_connect_indication(struct lapb_cb *lapb, int reason)
- {
-- if (lapb->callbacks.connect_indication)
-- lapb->callbacks.connect_indication(lapb->dev, reason);
-+ if (lapb->callbacks->connect_indication)
-+ lapb->callbacks->connect_indication(lapb->dev, reason);
- }
-
- void lapb_disconnect_confirmation(struct lapb_cb *lapb, int reason)
- {
-- if (lapb->callbacks.disconnect_confirmation)
-- lapb->callbacks.disconnect_confirmation(lapb->dev, reason);
-+ if (lapb->callbacks->disconnect_confirmation)
-+ lapb->callbacks->disconnect_confirmation(lapb->dev, reason);
- }
-
- void lapb_disconnect_indication(struct lapb_cb *lapb, int reason)
- {
-- if (lapb->callbacks.disconnect_indication)
-- lapb->callbacks.disconnect_indication(lapb->dev, reason);
-+ if (lapb->callbacks->disconnect_indication)
-+ lapb->callbacks->disconnect_indication(lapb->dev, reason);
- }
-
- int lapb_data_indication(struct lapb_cb *lapb, struct sk_buff *skb)
- {
-- if (lapb->callbacks.data_indication)
-- return lapb->callbacks.data_indication(lapb->dev, skb);
-+ if (lapb->callbacks->data_indication)
-+ return lapb->callbacks->data_indication(lapb->dev, skb);
-
- kfree_skb(skb);
- return NET_RX_SUCCESS; /* For now; must be != NET_RX_DROP */
-@@ -414,8 +414,8 @@ int lapb_data_transmit(struct lapb_cb *l
- {
- int used = 0;
-
-- if (lapb->callbacks.data_transmit) {
-- lapb->callbacks.data_transmit(lapb->dev, skb);
-+ if (lapb->callbacks->data_transmit) {
-+ lapb->callbacks->data_transmit(lapb->dev, skb);
- used = 1;
- }
-
-diff -urNp linux-2.6.32.45/net/mac80211/cfg.c linux-2.6.32.45/net/mac80211/cfg.c
---- linux-2.6.32.45/net/mac80211/cfg.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/mac80211/cfg.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1369,7 +1369,7 @@ static int ieee80211_set_bitrate_mask(st
- return err;
- }
-
--struct cfg80211_ops mac80211_config_ops = {
-+const struct cfg80211_ops mac80211_config_ops = {
- .add_virtual_intf = ieee80211_add_iface,
- .del_virtual_intf = ieee80211_del_iface,
- .change_virtual_intf = ieee80211_change_iface,
-diff -urNp linux-2.6.32.45/net/mac80211/cfg.h linux-2.6.32.45/net/mac80211/cfg.h
---- linux-2.6.32.45/net/mac80211/cfg.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/mac80211/cfg.h 2011-04-17 15:56:46.000000000 -0400
-@@ -4,6 +4,6 @@
- #ifndef __CFG_H
- #define __CFG_H
-
--extern struct cfg80211_ops mac80211_config_ops;
-+extern const struct cfg80211_ops mac80211_config_ops;
-
- #endif /* __CFG_H */
-diff -urNp linux-2.6.32.45/net/mac80211/debugfs_key.c linux-2.6.32.45/net/mac80211/debugfs_key.c
---- linux-2.6.32.45/net/mac80211/debugfs_key.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/mac80211/debugfs_key.c 2011-04-17 15:56:46.000000000 -0400
-@@ -211,9 +211,13 @@ static ssize_t key_key_read(struct file
- size_t count, loff_t *ppos)
- {
- struct ieee80211_key *key = file->private_data;
-- int i, res, bufsize = 2 * key->conf.keylen + 2;
-+ int i, bufsize = 2 * key->conf.keylen + 2;
- char *buf = kmalloc(bufsize, GFP_KERNEL);
- char *p = buf;
-+ ssize_t res;
-+
-+ if (buf == NULL)
-+ return -ENOMEM;
-
- for (i = 0; i < key->conf.keylen; i++)
- p += scnprintf(p, bufsize + buf - p, "%02x", key->conf.key[i]);
-diff -urNp linux-2.6.32.45/net/mac80211/debugfs_sta.c linux-2.6.32.45/net/mac80211/debugfs_sta.c
---- linux-2.6.32.45/net/mac80211/debugfs_sta.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/mac80211/debugfs_sta.c 2011-05-16 21:46:57.000000000 -0400
-@@ -124,6 +124,8 @@ static ssize_t sta_agg_status_read(struc
- int i;
- struct sta_info *sta = file->private_data;
-
-+ pax_track_stack();
-+
- spin_lock_bh(&sta->lock);
- p += scnprintf(p, sizeof(buf)+buf-p, "next dialog_token is %#02x\n",
- sta->ampdu_mlme.dialog_token_allocator + 1);
-diff -urNp linux-2.6.32.45/net/mac80211/ieee80211_i.h linux-2.6.32.45/net/mac80211/ieee80211_i.h
---- linux-2.6.32.45/net/mac80211/ieee80211_i.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/mac80211/ieee80211_i.h 2011-04-17 15:56:46.000000000 -0400
-@@ -25,6 +25,7 @@
- #include <linux/etherdevice.h>
- #include <net/cfg80211.h>
- #include <net/mac80211.h>
-+#include <asm/local.h>
- #include "key.h"
- #include "sta_info.h"
-
-@@ -635,7 +636,7 @@ struct ieee80211_local {
- /* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
- spinlock_t queue_stop_reason_lock;
-
-- int open_count;
-+ local_t open_count;
- int monitors, cooked_mntrs;
- /* number of interfaces with corresponding FIF_ flags */
- int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll;
-diff -urNp linux-2.6.32.45/net/mac80211/iface.c linux-2.6.32.45/net/mac80211/iface.c
---- linux-2.6.32.45/net/mac80211/iface.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/mac80211/iface.c 2011-04-17 15:56:46.000000000 -0400
-@@ -166,7 +166,7 @@ static int ieee80211_open(struct net_dev
- break;
- }
-
-- if (local->open_count == 0) {
-+ if (local_read(&local->open_count) == 0) {
- res = drv_start(local);
- if (res)
- goto err_del_bss;
-@@ -196,7 +196,7 @@ static int ieee80211_open(struct net_dev
- * Validate the MAC address for this device.
- */
- if (!is_valid_ether_addr(dev->dev_addr)) {
-- if (!local->open_count)
-+ if (!local_read(&local->open_count))
- drv_stop(local);
- return -EADDRNOTAVAIL;
- }
-@@ -292,7 +292,7 @@ static int ieee80211_open(struct net_dev
-
- hw_reconf_flags |= __ieee80211_recalc_idle(local);
-
-- local->open_count++;
-+ local_inc(&local->open_count);
- if (hw_reconf_flags) {
- ieee80211_hw_config(local, hw_reconf_flags);
- /*
-@@ -320,7 +320,7 @@ static int ieee80211_open(struct net_dev
- err_del_interface:
- drv_remove_interface(local, &conf);
- err_stop:
-- if (!local->open_count)
-+ if (!local_read(&local->open_count))
- drv_stop(local);
- err_del_bss:
- sdata->bss = NULL;
-@@ -420,7 +420,7 @@ static int ieee80211_stop(struct net_dev
- WARN_ON(!list_empty(&sdata->u.ap.vlans));
- }
-
-- local->open_count--;
-+ local_dec(&local->open_count);
-
- switch (sdata->vif.type) {
- case NL80211_IFTYPE_AP_VLAN:
-@@ -526,7 +526,7 @@ static int ieee80211_stop(struct net_dev
-
- ieee80211_recalc_ps(local, -1);
-
-- if (local->open_count == 0) {
-+ if (local_read(&local->open_count) == 0) {
- ieee80211_clear_tx_pending(local);
- ieee80211_stop_device(local);
-
-diff -urNp linux-2.6.32.45/net/mac80211/main.c linux-2.6.32.45/net/mac80211/main.c
---- linux-2.6.32.45/net/mac80211/main.c 2011-05-10 22:12:02.000000000 -0400
-+++ linux-2.6.32.45/net/mac80211/main.c 2011-05-10 22:12:34.000000000 -0400
-@@ -145,7 +145,7 @@ int ieee80211_hw_config(struct ieee80211
- local->hw.conf.power_level = power;
- }
-
-- if (changed && local->open_count) {
-+ if (changed && local_read(&local->open_count)) {
- ret = drv_config(local, changed);
- /*
- * Goal:
-diff -urNp linux-2.6.32.45/net/mac80211/mlme.c linux-2.6.32.45/net/mac80211/mlme.c
---- linux-2.6.32.45/net/mac80211/mlme.c 2011-08-09 18:35:30.000000000 -0400
-+++ linux-2.6.32.45/net/mac80211/mlme.c 2011-08-09 18:34:01.000000000 -0400
-@@ -1438,6 +1438,8 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee
- bool have_higher_than_11mbit = false, newsta = false;
- u16 ap_ht_cap_flags;
-
-+ pax_track_stack();
-+
- /*
- * AssocResp and ReassocResp have identical structure, so process both
- * of them in this function.
-diff -urNp linux-2.6.32.45/net/mac80211/pm.c linux-2.6.32.45/net/mac80211/pm.c
---- linux-2.6.32.45/net/mac80211/pm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/mac80211/pm.c 2011-04-17 15:56:46.000000000 -0400
-@@ -107,7 +107,7 @@ int __ieee80211_suspend(struct ieee80211
- }
-
- /* stop hardware - this must stop RX */
-- if (local->open_count)
-+ if (local_read(&local->open_count))
- ieee80211_stop_device(local);
-
- local->suspended = true;
-diff -urNp linux-2.6.32.45/net/mac80211/rate.c linux-2.6.32.45/net/mac80211/rate.c
---- linux-2.6.32.45/net/mac80211/rate.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/mac80211/rate.c 2011-04-17 15:56:46.000000000 -0400
-@@ -287,7 +287,7 @@ int ieee80211_init_rate_ctrl_alg(struct
- struct rate_control_ref *ref, *old;
-
- ASSERT_RTNL();
-- if (local->open_count)
-+ if (local_read(&local->open_count))
- return -EBUSY;
-
- ref = rate_control_alloc(name, local);
-diff -urNp linux-2.6.32.45/net/mac80211/tx.c linux-2.6.32.45/net/mac80211/tx.c
---- linux-2.6.32.45/net/mac80211/tx.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/mac80211/tx.c 2011-04-17 15:56:46.000000000 -0400
-@@ -173,7 +173,7 @@ static __le16 ieee80211_duration(struct
- return cpu_to_le16(dur);
- }
-
--static int inline is_ieee80211_device(struct ieee80211_local *local,
-+static inline int is_ieee80211_device(struct ieee80211_local *local,
- struct net_device *dev)
- {
- return local == wdev_priv(dev->ieee80211_ptr);
-diff -urNp linux-2.6.32.45/net/mac80211/util.c linux-2.6.32.45/net/mac80211/util.c
---- linux-2.6.32.45/net/mac80211/util.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/mac80211/util.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1042,7 +1042,7 @@ int ieee80211_reconfig(struct ieee80211_
- local->resuming = true;
-
- /* restart hardware */
-- if (local->open_count) {
-+ if (local_read(&local->open_count)) {
- /*
- * Upon resume hardware can sometimes be goofy due to
- * various platform / driver / bus issues, so restarting
-diff -urNp linux-2.6.32.45/net/netfilter/ipvs/ip_vs_app.c linux-2.6.32.45/net/netfilter/ipvs/ip_vs_app.c
---- linux-2.6.32.45/net/netfilter/ipvs/ip_vs_app.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/netfilter/ipvs/ip_vs_app.c 2011-05-17 19:26:34.000000000 -0400
-@@ -564,7 +564,7 @@ static const struct file_operations ip_v
- .open = ip_vs_app_open,
- .read = seq_read,
- .llseek = seq_lseek,
-- .release = seq_release,
-+ .release = seq_release_net,
- };
- #endif
-
-diff -urNp linux-2.6.32.45/net/netfilter/ipvs/ip_vs_conn.c linux-2.6.32.45/net/netfilter/ipvs/ip_vs_conn.c
---- linux-2.6.32.45/net/netfilter/ipvs/ip_vs_conn.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/netfilter/ipvs/ip_vs_conn.c 2011-05-17 19:26:34.000000000 -0400
-@@ -453,10 +453,10 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, s
- /* if the connection is not template and is created
- * by sync, preserve the activity flag.
- */
-- cp->flags |= atomic_read(&dest->conn_flags) &
-+ cp->flags |= atomic_read_unchecked(&dest->conn_flags) &
- (~IP_VS_CONN_F_INACTIVE);
- else
-- cp->flags |= atomic_read(&dest->conn_flags);
-+ cp->flags |= atomic_read_unchecked(&dest->conn_flags);
- cp->dest = dest;
-
- IP_VS_DBG_BUF(7, "Bind-dest %s c:%s:%d v:%s:%d "
-@@ -723,7 +723,7 @@ ip_vs_conn_new(int af, int proto, const
- atomic_set(&cp->refcnt, 1);
-
- atomic_set(&cp->n_control, 0);
-- atomic_set(&cp->in_pkts, 0);
-+ atomic_set_unchecked(&cp->in_pkts, 0);
-
- atomic_inc(&ip_vs_conn_count);
- if (flags & IP_VS_CONN_F_NO_CPORT)
-@@ -871,7 +871,7 @@ static const struct file_operations ip_v
- .open = ip_vs_conn_open,
- .read = seq_read,
- .llseek = seq_lseek,
-- .release = seq_release,
-+ .release = seq_release_net,
- };
-
- static const char *ip_vs_origin_name(unsigned flags)
-@@ -934,7 +934,7 @@ static const struct file_operations ip_v
- .open = ip_vs_conn_sync_open,
- .read = seq_read,
- .llseek = seq_lseek,
-- .release = seq_release,
-+ .release = seq_release_net,
- };
-
- #endif
-@@ -961,7 +961,7 @@ static inline int todrop_entry(struct ip
-
- /* Don't drop the entry if its number of incoming packets is not
- located in [0, 8] */
-- i = atomic_read(&cp->in_pkts);
-+ i = atomic_read_unchecked(&cp->in_pkts);
- if (i > 8 || i < 0) return 0;
-
- if (!todrop_rate[i]) return 0;
-diff -urNp linux-2.6.32.45/net/netfilter/ipvs/ip_vs_core.c linux-2.6.32.45/net/netfilter/ipvs/ip_vs_core.c
---- linux-2.6.32.45/net/netfilter/ipvs/ip_vs_core.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/netfilter/ipvs/ip_vs_core.c 2011-05-04 17:56:28.000000000 -0400
-@@ -485,7 +485,7 @@ int ip_vs_leave(struct ip_vs_service *sv
- ret = cp->packet_xmit(skb, cp, pp);
- /* do not touch skb anymore */
-
-- atomic_inc(&cp->in_pkts);
-+ atomic_inc_unchecked(&cp->in_pkts);
- ip_vs_conn_put(cp);
- return ret;
- }
-@@ -1357,7 +1357,7 @@ ip_vs_in(unsigned int hooknum, struct sk
- * Sync connection if it is about to close to
- * encorage the standby servers to update the connections timeout
- */
-- pkts = atomic_add_return(1, &cp->in_pkts);
-+ pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
- if (af == AF_INET &&
- (ip_vs_sync_state & IP_VS_STATE_MASTER) &&
- (((cp->protocol != IPPROTO_TCP ||
-diff -urNp linux-2.6.32.45/net/netfilter/ipvs/ip_vs_ctl.c linux-2.6.32.45/net/netfilter/ipvs/ip_vs_ctl.c
---- linux-2.6.32.45/net/netfilter/ipvs/ip_vs_ctl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/netfilter/ipvs/ip_vs_ctl.c 2011-05-17 19:26:34.000000000 -0400
-@@ -792,7 +792,7 @@ __ip_vs_update_dest(struct ip_vs_service
- ip_vs_rs_hash(dest);
- write_unlock_bh(&__ip_vs_rs_lock);
- }
-- atomic_set(&dest->conn_flags, conn_flags);
-+ atomic_set_unchecked(&dest->conn_flags, conn_flags);
-
- /* bind the service */
- if (!dest->svc) {
-@@ -1888,7 +1888,7 @@ static int ip_vs_info_seq_show(struct se
- " %-7s %-6d %-10d %-10d\n",
- &dest->addr.in6,
- ntohs(dest->port),
-- ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
-+ ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
- atomic_read(&dest->weight),
- atomic_read(&dest->activeconns),
- atomic_read(&dest->inactconns));
-@@ -1899,7 +1899,7 @@ static int ip_vs_info_seq_show(struct se
- "%-7s %-6d %-10d %-10d\n",
- ntohl(dest->addr.ip),
- ntohs(dest->port),
-- ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
-+ ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
- atomic_read(&dest->weight),
- atomic_read(&dest->activeconns),
- atomic_read(&dest->inactconns));
-@@ -1927,7 +1927,7 @@ static const struct file_operations ip_v
- .open = ip_vs_info_open,
- .read = seq_read,
- .llseek = seq_lseek,
-- .release = seq_release_private,
-+ .release = seq_release_net,
- };
-
- #endif
-@@ -1976,7 +1976,7 @@ static const struct file_operations ip_v
- .open = ip_vs_stats_seq_open,
- .read = seq_read,
- .llseek = seq_lseek,
-- .release = single_release,
-+ .release = single_release_net,
- };
-
- #endif
-@@ -2292,7 +2292,7 @@ __ip_vs_get_dest_entries(const struct ip
-
- entry.addr = dest->addr.ip;
- entry.port = dest->port;
-- entry.conn_flags = atomic_read(&dest->conn_flags);
-+ entry.conn_flags = atomic_read_unchecked(&dest->conn_flags);
- entry.weight = atomic_read(&dest->weight);
- entry.u_threshold = dest->u_threshold;
- entry.l_threshold = dest->l_threshold;
-@@ -2353,6 +2353,8 @@ do_ip_vs_get_ctl(struct sock *sk, int cm
- unsigned char arg[128];
- int ret = 0;
-
-+ pax_track_stack();
-+
- if (!capable(CAP_NET_ADMIN))
- return -EPERM;
-
-@@ -2802,7 +2804,7 @@ static int ip_vs_genl_fill_dest(struct s
- NLA_PUT_U16(skb, IPVS_DEST_ATTR_PORT, dest->port);
-
- NLA_PUT_U32(skb, IPVS_DEST_ATTR_FWD_METHOD,
-- atomic_read(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
-+ atomic_read_unchecked(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
- NLA_PUT_U32(skb, IPVS_DEST_ATTR_WEIGHT, atomic_read(&dest->weight));
- NLA_PUT_U32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold);
- NLA_PUT_U32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold);
-diff -urNp linux-2.6.32.45/net/netfilter/ipvs/ip_vs_sync.c linux-2.6.32.45/net/netfilter/ipvs/ip_vs_sync.c
---- linux-2.6.32.45/net/netfilter/ipvs/ip_vs_sync.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/netfilter/ipvs/ip_vs_sync.c 2011-05-04 17:56:28.000000000 -0400
-@@ -438,7 +438,7 @@ static void ip_vs_process_message(const
-
- if (opt)
- memcpy(&cp->in_seq, opt, sizeof(*opt));
-- atomic_set(&cp->in_pkts, sysctl_ip_vs_sync_threshold[0]);
-+ atomic_set_unchecked(&cp->in_pkts, sysctl_ip_vs_sync_threshold[0]);
- cp->state = state;
- cp->old_state = cp->state;
- /*
-diff -urNp linux-2.6.32.45/net/netfilter/ipvs/ip_vs_xmit.c linux-2.6.32.45/net/netfilter/ipvs/ip_vs_xmit.c
---- linux-2.6.32.45/net/netfilter/ipvs/ip_vs_xmit.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/netfilter/ipvs/ip_vs_xmit.c 2011-05-04 17:56:28.000000000 -0400
-@@ -875,7 +875,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, str
- else
- rc = NF_ACCEPT;
- /* do not touch skb anymore */
-- atomic_inc(&cp->in_pkts);
-+ atomic_inc_unchecked(&cp->in_pkts);
- goto out;
- }
-
-@@ -949,7 +949,7 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb,
- else
- rc = NF_ACCEPT;
- /* do not touch skb anymore */
-- atomic_inc(&cp->in_pkts);
-+ atomic_inc_unchecked(&cp->in_pkts);
- goto out;
- }
-
-diff -urNp linux-2.6.32.45/net/netfilter/Kconfig linux-2.6.32.45/net/netfilter/Kconfig
---- linux-2.6.32.45/net/netfilter/Kconfig 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/netfilter/Kconfig 2011-04-17 15:56:46.000000000 -0400
-@@ -635,6 +635,16 @@ config NETFILTER_XT_MATCH_ESP
-
- To compile it as a module, choose M here. If unsure, say N.
-
-+config NETFILTER_XT_MATCH_GRADM
-+ tristate '"gradm" match support'
-+ depends on NETFILTER_XTABLES && NETFILTER_ADVANCED
-+ depends on GRKERNSEC && !GRKERNSEC_NO_RBAC
-+ ---help---
-+ The gradm match allows to match on grsecurity RBAC being enabled.
-+ It is useful when iptables rules are applied early on bootup to
-+ prevent connections to the machine (except from a trusted host)
-+ while the RBAC system is disabled.
-+
- config NETFILTER_XT_MATCH_HASHLIMIT
- tristate '"hashlimit" match support'
- depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
-diff -urNp linux-2.6.32.45/net/netfilter/Makefile linux-2.6.32.45/net/netfilter/Makefile
---- linux-2.6.32.45/net/netfilter/Makefile 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/netfilter/Makefile 2011-04-17 15:56:46.000000000 -0400
-@@ -68,6 +68,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_CONNTRAC
- obj-$(CONFIG_NETFILTER_XT_MATCH_DCCP) += xt_dccp.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_DSCP) += xt_dscp.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) += xt_esp.o
-+obj-$(CONFIG_NETFILTER_XT_MATCH_GRADM) += xt_gradm.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o
-diff -urNp linux-2.6.32.45/net/netfilter/nf_conntrack_netlink.c linux-2.6.32.45/net/netfilter/nf_conntrack_netlink.c
---- linux-2.6.32.45/net/netfilter/nf_conntrack_netlink.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/netfilter/nf_conntrack_netlink.c 2011-04-17 15:56:46.000000000 -0400
-@@ -706,7 +706,7 @@ ctnetlink_parse_tuple_proto(struct nlatt
- static int
- ctnetlink_parse_tuple(const struct nlattr * const cda[],
- struct nf_conntrack_tuple *tuple,
-- enum ctattr_tuple type, u_int8_t l3num)
-+ enum ctattr_type type, u_int8_t l3num)
- {
- struct nlattr *tb[CTA_TUPLE_MAX+1];
- int err;
-diff -urNp linux-2.6.32.45/net/netfilter/nfnetlink_log.c linux-2.6.32.45/net/netfilter/nfnetlink_log.c
---- linux-2.6.32.45/net/netfilter/nfnetlink_log.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/netfilter/nfnetlink_log.c 2011-05-04 17:56:28.000000000 -0400
-@@ -68,7 +68,7 @@ struct nfulnl_instance {
- };
-
- static DEFINE_RWLOCK(instances_lock);
--static atomic_t global_seq;
-+static atomic_unchecked_t global_seq;
-
- #define INSTANCE_BUCKETS 16
- static struct hlist_head instance_table[INSTANCE_BUCKETS];
-@@ -493,7 +493,7 @@ __build_packet_message(struct nfulnl_ins
- /* global sequence number */
- if (inst->flags & NFULNL_CFG_F_SEQ_GLOBAL)
- NLA_PUT_BE32(inst->skb, NFULA_SEQ_GLOBAL,
-- htonl(atomic_inc_return(&global_seq)));
-+ htonl(atomic_inc_return_unchecked(&global_seq)));
-
- if (data_len) {
- struct nlattr *nla;
-diff -urNp linux-2.6.32.45/net/netfilter/xt_gradm.c linux-2.6.32.45/net/netfilter/xt_gradm.c
---- linux-2.6.32.45/net/netfilter/xt_gradm.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/net/netfilter/xt_gradm.c 2011-04-17 15:56:46.000000000 -0400
-@@ -0,0 +1,51 @@
-+/*
-+ * gradm match for netfilter
-+ * Copyright © Zbigniew Krzystolik, 2010
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License; either version
-+ * 2 or 3 as published by the Free Software Foundation.
-+ */
-+#include <linux/module.h>
-+#include <linux/moduleparam.h>
-+#include <linux/skbuff.h>
-+#include <linux/netfilter/x_tables.h>
-+#include <linux/grsecurity.h>
-+#include <linux/netfilter/xt_gradm.h>
-+
-+static bool
-+gradm_mt(const struct sk_buff *skb, const struct xt_match_param *par)
-+{
-+ const struct xt_gradm_mtinfo *info = par->matchinfo;
-+ bool retval = false;
-+ if (gr_acl_is_enabled())
-+ retval = true;
-+ return retval ^ info->invflags;
-+}
-+
-+static struct xt_match gradm_mt_reg __read_mostly = {
-+ .name = "gradm",
-+ .revision = 0,
-+ .family = NFPROTO_UNSPEC,
-+ .match = gradm_mt,
-+ .matchsize = XT_ALIGN(sizeof(struct xt_gradm_mtinfo)),
-+ .me = THIS_MODULE,
-+};
-+
-+static int __init gradm_mt_init(void)
-+{
-+ return xt_register_match(&gradm_mt_reg);
-+}
-+
-+static void __exit gradm_mt_exit(void)
-+{
-+ xt_unregister_match(&gradm_mt_reg);
-+}
-+
-+module_init(gradm_mt_init);
-+module_exit(gradm_mt_exit);
-+MODULE_AUTHOR("Zbigniew Krzystolik <zbyniu@destrukcja.pl>");
-+MODULE_DESCRIPTION("Xtables: Grsecurity RBAC match");
-+MODULE_LICENSE("GPL");
-+MODULE_ALIAS("ipt_gradm");
-+MODULE_ALIAS("ip6t_gradm");
-diff -urNp linux-2.6.32.45/net/netlink/af_netlink.c linux-2.6.32.45/net/netlink/af_netlink.c
---- linux-2.6.32.45/net/netlink/af_netlink.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/netlink/af_netlink.c 2011-05-04 17:56:28.000000000 -0400
-@@ -733,7 +733,7 @@ static void netlink_overrun(struct sock
- sk->sk_error_report(sk);
- }
- }
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- }
-
- static struct sock *netlink_getsockbypid(struct sock *ssk, u32 pid)
-@@ -1964,15 +1964,23 @@ static int netlink_seq_show(struct seq_f
- struct netlink_sock *nlk = nlk_sk(s);
-
- seq_printf(seq, "%p %-3d %-6d %08x %-8d %-8d %p %-8d %-8d\n",
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
- s,
-+#endif
- s->sk_protocol,
- nlk->pid,
- nlk->groups ? (u32)nlk->groups[0] : 0,
- sk_rmem_alloc_get(s),
- sk_wmem_alloc_get(s),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
- nlk->cb,
-+#endif
- atomic_read(&s->sk_refcnt),
-- atomic_read(&s->sk_drops)
-+ atomic_read_unchecked(&s->sk_drops)
- );
-
- }
-diff -urNp linux-2.6.32.45/net/netrom/af_netrom.c linux-2.6.32.45/net/netrom/af_netrom.c
---- linux-2.6.32.45/net/netrom/af_netrom.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/netrom/af_netrom.c 2011-04-17 15:56:46.000000000 -0400
-@@ -838,6 +838,7 @@ static int nr_getname(struct socket *soc
- struct sock *sk = sock->sk;
- struct nr_sock *nr = nr_sk(sk);
-
-+ memset(sax, 0, sizeof(*sax));
- lock_sock(sk);
- if (peer != 0) {
- if (sk->sk_state != TCP_ESTABLISHED) {
-@@ -852,7 +853,6 @@ static int nr_getname(struct socket *soc
- *uaddr_len = sizeof(struct full_sockaddr_ax25);
- } else {
- sax->fsa_ax25.sax25_family = AF_NETROM;
-- sax->fsa_ax25.sax25_ndigis = 0;
- sax->fsa_ax25.sax25_call = nr->source_addr;
- *uaddr_len = sizeof(struct sockaddr_ax25);
- }
-diff -urNp linux-2.6.32.45/net/packet/af_packet.c linux-2.6.32.45/net/packet/af_packet.c
---- linux-2.6.32.45/net/packet/af_packet.c 2011-07-13 17:23:04.000000000 -0400
-+++ linux-2.6.32.45/net/packet/af_packet.c 2011-07-13 17:23:27.000000000 -0400
-@@ -2429,7 +2429,11 @@ static int packet_seq_show(struct seq_fi
-
- seq_printf(seq,
- "%p %-6d %-4d %04x %-5d %1d %-6u %-6u %-6lu\n",
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
- s,
-+#endif
- atomic_read(&s->sk_refcnt),
- s->sk_type,
- ntohs(po->num),
-diff -urNp linux-2.6.32.45/net/phonet/af_phonet.c linux-2.6.32.45/net/phonet/af_phonet.c
---- linux-2.6.32.45/net/phonet/af_phonet.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/phonet/af_phonet.c 2011-04-17 15:56:46.000000000 -0400
-@@ -41,7 +41,7 @@ static struct phonet_protocol *phonet_pr
- {
- struct phonet_protocol *pp;
-
-- if (protocol >= PHONET_NPROTO)
-+ if (protocol < 0 || protocol >= PHONET_NPROTO)
- return NULL;
-
- spin_lock(&proto_tab_lock);
-@@ -402,7 +402,7 @@ int __init_or_module phonet_proto_regist
- {
- int err = 0;
-
-- if (protocol >= PHONET_NPROTO)
-+ if (protocol < 0 || protocol >= PHONET_NPROTO)
- return -EINVAL;
-
- err = proto_register(pp->prot, 1);
-diff -urNp linux-2.6.32.45/net/phonet/datagram.c linux-2.6.32.45/net/phonet/datagram.c
---- linux-2.6.32.45/net/phonet/datagram.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/phonet/datagram.c 2011-05-04 17:56:28.000000000 -0400
-@@ -162,7 +162,7 @@ static int pn_backlog_rcv(struct sock *s
- if (err < 0) {
- kfree_skb(skb);
- if (err == -ENOMEM)
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- }
- return err ? NET_RX_DROP : NET_RX_SUCCESS;
- }
-diff -urNp linux-2.6.32.45/net/phonet/pep.c linux-2.6.32.45/net/phonet/pep.c
---- linux-2.6.32.45/net/phonet/pep.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/phonet/pep.c 2011-05-04 17:56:28.000000000 -0400
-@@ -348,7 +348,7 @@ static int pipe_do_rcv(struct sock *sk,
-
- case PNS_PEP_CTRL_REQ:
- if (skb_queue_len(&pn->ctrlreq_queue) >= PNPIPE_CTRLREQ_MAX) {
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- break;
- }
- __skb_pull(skb, 4);
-@@ -362,12 +362,12 @@ static int pipe_do_rcv(struct sock *sk,
- if (!err)
- return 0;
- if (err == -ENOMEM)
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- break;
- }
-
- if (pn->rx_credits == 0) {
-- atomic_inc(&sk->sk_drops);
-+ atomic_inc_unchecked(&sk->sk_drops);
- err = -ENOBUFS;
- break;
- }
-diff -urNp linux-2.6.32.45/net/phonet/socket.c linux-2.6.32.45/net/phonet/socket.c
---- linux-2.6.32.45/net/phonet/socket.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/phonet/socket.c 2011-05-04 17:57:07.000000000 -0400
-@@ -482,8 +482,13 @@ static int pn_sock_seq_show(struct seq_f
- sk->sk_state,
- sk_wmem_alloc_get(sk), sk_rmem_alloc_get(sk),
- sock_i_uid(sk), sock_i_ino(sk),
-- atomic_read(&sk->sk_refcnt), sk,
-- atomic_read(&sk->sk_drops), &len);
-+ atomic_read(&sk->sk_refcnt),
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
-+ sk,
-+#endif
-+ atomic_read_unchecked(&sk->sk_drops), &len);
- }
- seq_printf(seq, "%*s\n", 127 - len, "");
- return 0;
-diff -urNp linux-2.6.32.45/net/rds/cong.c linux-2.6.32.45/net/rds/cong.c
---- linux-2.6.32.45/net/rds/cong.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/rds/cong.c 2011-05-04 17:56:28.000000000 -0400
-@@ -77,7 +77,7 @@
- * finds that the saved generation number is smaller than the global generation
- * number, it wakes up the process.
- */
--static atomic_t rds_cong_generation = ATOMIC_INIT(0);
-+static atomic_unchecked_t rds_cong_generation = ATOMIC_INIT(0);
-
- /*
- * Congestion monitoring
-@@ -232,7 +232,7 @@ void rds_cong_map_updated(struct rds_con
- rdsdebug("waking map %p for %pI4\n",
- map, &map->m_addr);
- rds_stats_inc(s_cong_update_received);
-- atomic_inc(&rds_cong_generation);
-+ atomic_inc_unchecked(&rds_cong_generation);
- if (waitqueue_active(&map->m_waitq))
- wake_up(&map->m_waitq);
- if (waitqueue_active(&rds_poll_waitq))
-@@ -258,7 +258,7 @@ EXPORT_SYMBOL_GPL(rds_cong_map_updated);
-
- int rds_cong_updated_since(unsigned long *recent)
- {
-- unsigned long gen = atomic_read(&rds_cong_generation);
-+ unsigned long gen = atomic_read_unchecked(&rds_cong_generation);
-
- if (likely(*recent == gen))
- return 0;
-diff -urNp linux-2.6.32.45/net/rds/iw_rdma.c linux-2.6.32.45/net/rds/iw_rdma.c
---- linux-2.6.32.45/net/rds/iw_rdma.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/rds/iw_rdma.c 2011-05-16 21:46:57.000000000 -0400
-@@ -181,6 +181,8 @@ int rds_iw_update_cm_id(struct rds_iw_de
- struct rdma_cm_id *pcm_id;
- int rc;
-
-+ pax_track_stack();
-+
- src_addr = (struct sockaddr_in *)&cm_id->route.addr.src_addr;
- dst_addr = (struct sockaddr_in *)&cm_id->route.addr.dst_addr;
-
-diff -urNp linux-2.6.32.45/net/rds/Kconfig linux-2.6.32.45/net/rds/Kconfig
---- linux-2.6.32.45/net/rds/Kconfig 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/rds/Kconfig 2011-04-17 15:56:46.000000000 -0400
-@@ -1,7 +1,7 @@
-
- config RDS
- tristate "The RDS Protocol (EXPERIMENTAL)"
-- depends on INET && EXPERIMENTAL
-+ depends on INET && EXPERIMENTAL && BROKEN
- ---help---
- The RDS (Reliable Datagram Sockets) protocol provides reliable,
- sequenced delivery of datagrams over Infiniband, iWARP,
-diff -urNp linux-2.6.32.45/net/rxrpc/af_rxrpc.c linux-2.6.32.45/net/rxrpc/af_rxrpc.c
---- linux-2.6.32.45/net/rxrpc/af_rxrpc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/rxrpc/af_rxrpc.c 2011-05-04 17:56:28.000000000 -0400
-@@ -38,7 +38,7 @@ static const struct proto_ops rxrpc_rpc_
- __be32 rxrpc_epoch;
-
- /* current debugging ID */
--atomic_t rxrpc_debug_id;
-+atomic_unchecked_t rxrpc_debug_id;
-
- /* count of skbs currently in use */
- atomic_t rxrpc_n_skbs;
-diff -urNp linux-2.6.32.45/net/rxrpc/ar-ack.c linux-2.6.32.45/net/rxrpc/ar-ack.c
---- linux-2.6.32.45/net/rxrpc/ar-ack.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/rxrpc/ar-ack.c 2011-05-16 21:46:57.000000000 -0400
-@@ -174,7 +174,7 @@ static void rxrpc_resend(struct rxrpc_ca
-
- _enter("{%d,%d,%d,%d},",
- call->acks_hard, call->acks_unacked,
-- atomic_read(&call->sequence),
-+ atomic_read_unchecked(&call->sequence),
- CIRC_CNT(call->acks_head, call->acks_tail, call->acks_winsz));
-
- stop = 0;
-@@ -198,7 +198,7 @@ static void rxrpc_resend(struct rxrpc_ca
-
- /* each Tx packet has a new serial number */
- sp->hdr.serial =
-- htonl(atomic_inc_return(&call->conn->serial));
-+ htonl(atomic_inc_return_unchecked(&call->conn->serial));
-
- hdr = (struct rxrpc_header *) txb->head;
- hdr->serial = sp->hdr.serial;
-@@ -401,7 +401,7 @@ static void rxrpc_rotate_tx_window(struc
- */
- static void rxrpc_clear_tx_window(struct rxrpc_call *call)
- {
-- rxrpc_rotate_tx_window(call, atomic_read(&call->sequence));
-+ rxrpc_rotate_tx_window(call, atomic_read_unchecked(&call->sequence));
- }
-
- /*
-@@ -627,7 +627,7 @@ process_further:
-
- latest = ntohl(sp->hdr.serial);
- hard = ntohl(ack.firstPacket);
-- tx = atomic_read(&call->sequence);
-+ tx = atomic_read_unchecked(&call->sequence);
-
- _proto("Rx ACK %%%u { m=%hu f=#%u p=#%u s=%%%u r=%s n=%u }",
- latest,
-@@ -840,6 +840,8 @@ void rxrpc_process_call(struct work_stru
- u32 abort_code = RX_PROTOCOL_ERROR;
- u8 *acks = NULL;
-
-+ pax_track_stack();
-+
- //printk("\n--------------------\n");
- _enter("{%d,%s,%lx} [%lu]",
- call->debug_id, rxrpc_call_states[call->state], call->events,
-@@ -1159,7 +1161,7 @@ void rxrpc_process_call(struct work_stru
- goto maybe_reschedule;
-
- send_ACK_with_skew:
-- ack.maxSkew = htons(atomic_read(&call->conn->hi_serial) -
-+ ack.maxSkew = htons(atomic_read_unchecked(&call->conn->hi_serial) -
- ntohl(ack.serial));
- send_ACK:
- mtu = call->conn->trans->peer->if_mtu;
-@@ -1171,7 +1173,7 @@ send_ACK:
- ackinfo.rxMTU = htonl(5692);
- ackinfo.jumbo_max = htonl(4);
-
-- hdr.serial = htonl(atomic_inc_return(&call->conn->serial));
-+ hdr.serial = htonl(atomic_inc_return_unchecked(&call->conn->serial));
- _proto("Tx ACK %%%u { m=%hu f=#%u p=#%u s=%%%u r=%s n=%u }",
- ntohl(hdr.serial),
- ntohs(ack.maxSkew),
-@@ -1189,7 +1191,7 @@ send_ACK:
- send_message:
- _debug("send message");
-
-- hdr.serial = htonl(atomic_inc_return(&call->conn->serial));
-+ hdr.serial = htonl(atomic_inc_return_unchecked(&call->conn->serial));
- _proto("Tx %s %%%u", rxrpc_pkts[hdr.type], ntohl(hdr.serial));
- send_message_2:
-
-diff -urNp linux-2.6.32.45/net/rxrpc/ar-call.c linux-2.6.32.45/net/rxrpc/ar-call.c
---- linux-2.6.32.45/net/rxrpc/ar-call.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/rxrpc/ar-call.c 2011-05-04 17:56:28.000000000 -0400
-@@ -82,7 +82,7 @@ static struct rxrpc_call *rxrpc_alloc_ca
- spin_lock_init(&call->lock);
- rwlock_init(&call->state_lock);
- atomic_set(&call->usage, 1);
-- call->debug_id = atomic_inc_return(&rxrpc_debug_id);
-+ call->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
- call->state = RXRPC_CALL_CLIENT_SEND_REQUEST;
-
- memset(&call->sock_node, 0xed, sizeof(call->sock_node));
-diff -urNp linux-2.6.32.45/net/rxrpc/ar-connection.c linux-2.6.32.45/net/rxrpc/ar-connection.c
---- linux-2.6.32.45/net/rxrpc/ar-connection.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/rxrpc/ar-connection.c 2011-05-04 17:56:28.000000000 -0400
-@@ -205,7 +205,7 @@ static struct rxrpc_connection *rxrpc_al
- rwlock_init(&conn->lock);
- spin_lock_init(&conn->state_lock);
- atomic_set(&conn->usage, 1);
-- conn->debug_id = atomic_inc_return(&rxrpc_debug_id);
-+ conn->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
- conn->avail_calls = RXRPC_MAXCALLS;
- conn->size_align = 4;
- conn->header_size = sizeof(struct rxrpc_header);
-diff -urNp linux-2.6.32.45/net/rxrpc/ar-connevent.c linux-2.6.32.45/net/rxrpc/ar-connevent.c
---- linux-2.6.32.45/net/rxrpc/ar-connevent.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/rxrpc/ar-connevent.c 2011-05-04 17:56:28.000000000 -0400
-@@ -109,7 +109,7 @@ static int rxrpc_abort_connection(struct
-
- len = iov[0].iov_len + iov[1].iov_len;
-
-- hdr.serial = htonl(atomic_inc_return(&conn->serial));
-+ hdr.serial = htonl(atomic_inc_return_unchecked(&conn->serial));
- _proto("Tx CONN ABORT %%%u { %d }", ntohl(hdr.serial), abort_code);
-
- ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 2, len);
-diff -urNp linux-2.6.32.45/net/rxrpc/ar-input.c linux-2.6.32.45/net/rxrpc/ar-input.c
---- linux-2.6.32.45/net/rxrpc/ar-input.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/rxrpc/ar-input.c 2011-05-04 17:56:28.000000000 -0400
-@@ -339,9 +339,9 @@ void rxrpc_fast_process_packet(struct rx
- /* track the latest serial number on this connection for ACK packet
- * information */
- serial = ntohl(sp->hdr.serial);
-- hi_serial = atomic_read(&call->conn->hi_serial);
-+ hi_serial = atomic_read_unchecked(&call->conn->hi_serial);
- while (serial > hi_serial)
-- hi_serial = atomic_cmpxchg(&call->conn->hi_serial, hi_serial,
-+ hi_serial = atomic_cmpxchg_unchecked(&call->conn->hi_serial, hi_serial,
- serial);
-
- /* request ACK generation for any ACK or DATA packet that requests
-diff -urNp linux-2.6.32.45/net/rxrpc/ar-internal.h linux-2.6.32.45/net/rxrpc/ar-internal.h
---- linux-2.6.32.45/net/rxrpc/ar-internal.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/rxrpc/ar-internal.h 2011-05-04 17:56:28.000000000 -0400
-@@ -272,8 +272,8 @@ struct rxrpc_connection {
- int error; /* error code for local abort */
- int debug_id; /* debug ID for printks */
- unsigned call_counter; /* call ID counter */
-- atomic_t serial; /* packet serial number counter */
-- atomic_t hi_serial; /* highest serial number received */
-+ atomic_unchecked_t serial; /* packet serial number counter */
-+ atomic_unchecked_t hi_serial; /* highest serial number received */
- u8 avail_calls; /* number of calls available */
- u8 size_align; /* data size alignment (for security) */
- u8 header_size; /* rxrpc + security header size */
-@@ -346,7 +346,7 @@ struct rxrpc_call {
- spinlock_t lock;
- rwlock_t state_lock; /* lock for state transition */
- atomic_t usage;
-- atomic_t sequence; /* Tx data packet sequence counter */
-+ atomic_unchecked_t sequence; /* Tx data packet sequence counter */
- u32 abort_code; /* local/remote abort code */
- enum { /* current state of call */
- RXRPC_CALL_CLIENT_SEND_REQUEST, /* - client sending request phase */
-@@ -420,7 +420,7 @@ static inline void rxrpc_abort_call(stru
- */
- extern atomic_t rxrpc_n_skbs;
- extern __be32 rxrpc_epoch;
--extern atomic_t rxrpc_debug_id;
-+extern atomic_unchecked_t rxrpc_debug_id;
- extern struct workqueue_struct *rxrpc_workqueue;
-
- /*
-diff -urNp linux-2.6.32.45/net/rxrpc/ar-key.c linux-2.6.32.45/net/rxrpc/ar-key.c
---- linux-2.6.32.45/net/rxrpc/ar-key.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/rxrpc/ar-key.c 2011-04-17 15:56:46.000000000 -0400
-@@ -88,11 +88,11 @@ static int rxrpc_instantiate_xdr_rxkad(s
- return ret;
-
- plen -= sizeof(*token);
-- token = kmalloc(sizeof(*token), GFP_KERNEL);
-+ token = kzalloc(sizeof(*token), GFP_KERNEL);
- if (!token)
- return -ENOMEM;
-
-- token->kad = kmalloc(plen, GFP_KERNEL);
-+ token->kad = kzalloc(plen, GFP_KERNEL);
- if (!token->kad) {
- kfree(token);
- return -ENOMEM;
-@@ -730,10 +730,10 @@ static int rxrpc_instantiate(struct key
- goto error;
-
- ret = -ENOMEM;
-- token = kmalloc(sizeof(*token), GFP_KERNEL);
-+ token = kzalloc(sizeof(*token), GFP_KERNEL);
- if (!token)
- goto error;
-- token->kad = kmalloc(plen, GFP_KERNEL);
-+ token->kad = kzalloc(plen, GFP_KERNEL);
- if (!token->kad)
- goto error_free;
-
-diff -urNp linux-2.6.32.45/net/rxrpc/ar-local.c linux-2.6.32.45/net/rxrpc/ar-local.c
---- linux-2.6.32.45/net/rxrpc/ar-local.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/rxrpc/ar-local.c 2011-05-04 17:56:28.000000000 -0400
-@@ -44,7 +44,7 @@ struct rxrpc_local *rxrpc_alloc_local(st
- spin_lock_init(&local->lock);
- rwlock_init(&local->services_lock);
- atomic_set(&local->usage, 1);
-- local->debug_id = atomic_inc_return(&rxrpc_debug_id);
-+ local->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
- memcpy(&local->srx, srx, sizeof(*srx));
- }
-
-diff -urNp linux-2.6.32.45/net/rxrpc/ar-output.c linux-2.6.32.45/net/rxrpc/ar-output.c
---- linux-2.6.32.45/net/rxrpc/ar-output.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/rxrpc/ar-output.c 2011-05-04 17:56:28.000000000 -0400
-@@ -680,9 +680,9 @@ static int rxrpc_send_data(struct kiocb
- sp->hdr.cid = call->cid;
- sp->hdr.callNumber = call->call_id;
- sp->hdr.seq =
-- htonl(atomic_inc_return(&call->sequence));
-+ htonl(atomic_inc_return_unchecked(&call->sequence));
- sp->hdr.serial =
-- htonl(atomic_inc_return(&conn->serial));
-+ htonl(atomic_inc_return_unchecked(&conn->serial));
- sp->hdr.type = RXRPC_PACKET_TYPE_DATA;
- sp->hdr.userStatus = 0;
- sp->hdr.securityIndex = conn->security_ix;
-diff -urNp linux-2.6.32.45/net/rxrpc/ar-peer.c linux-2.6.32.45/net/rxrpc/ar-peer.c
---- linux-2.6.32.45/net/rxrpc/ar-peer.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/rxrpc/ar-peer.c 2011-05-04 17:56:28.000000000 -0400
-@@ -86,7 +86,7 @@ static struct rxrpc_peer *rxrpc_alloc_pe
- INIT_LIST_HEAD(&peer->error_targets);
- spin_lock_init(&peer->lock);
- atomic_set(&peer->usage, 1);
-- peer->debug_id = atomic_inc_return(&rxrpc_debug_id);
-+ peer->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
- memcpy(&peer->srx, srx, sizeof(*srx));
-
- rxrpc_assess_MTU_size(peer);
-diff -urNp linux-2.6.32.45/net/rxrpc/ar-proc.c linux-2.6.32.45/net/rxrpc/ar-proc.c
---- linux-2.6.32.45/net/rxrpc/ar-proc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/rxrpc/ar-proc.c 2011-05-04 17:56:28.000000000 -0400
-@@ -164,8 +164,8 @@ static int rxrpc_connection_seq_show(str
- atomic_read(&conn->usage),
- rxrpc_conn_states[conn->state],
- key_serial(conn->key),
-- atomic_read(&conn->serial),
-- atomic_read(&conn->hi_serial));
-+ atomic_read_unchecked(&conn->serial),
-+ atomic_read_unchecked(&conn->hi_serial));
-
- return 0;
- }
-diff -urNp linux-2.6.32.45/net/rxrpc/ar-transport.c linux-2.6.32.45/net/rxrpc/ar-transport.c
---- linux-2.6.32.45/net/rxrpc/ar-transport.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/rxrpc/ar-transport.c 2011-05-04 17:56:28.000000000 -0400
-@@ -46,7 +46,7 @@ static struct rxrpc_transport *rxrpc_all
- spin_lock_init(&trans->client_lock);
- rwlock_init(&trans->conn_lock);
- atomic_set(&trans->usage, 1);
-- trans->debug_id = atomic_inc_return(&rxrpc_debug_id);
-+ trans->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
-
- if (peer->srx.transport.family == AF_INET) {
- switch (peer->srx.transport_type) {
-diff -urNp linux-2.6.32.45/net/rxrpc/rxkad.c linux-2.6.32.45/net/rxrpc/rxkad.c
---- linux-2.6.32.45/net/rxrpc/rxkad.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/rxrpc/rxkad.c 2011-05-16 21:46:57.000000000 -0400
-@@ -210,6 +210,8 @@ static int rxkad_secure_packet_encrypt(c
- u16 check;
- int nsg;
-
-+ pax_track_stack();
-+
- sp = rxrpc_skb(skb);
-
- _enter("");
-@@ -337,6 +339,8 @@ static int rxkad_verify_packet_auth(cons
- u16 check;
- int nsg;
-
-+ pax_track_stack();
-+
- _enter("");
-
- sp = rxrpc_skb(skb);
-@@ -609,7 +613,7 @@ static int rxkad_issue_challenge(struct
-
- len = iov[0].iov_len + iov[1].iov_len;
-
-- hdr.serial = htonl(atomic_inc_return(&conn->serial));
-+ hdr.serial = htonl(atomic_inc_return_unchecked(&conn->serial));
- _proto("Tx CHALLENGE %%%u", ntohl(hdr.serial));
-
- ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 2, len);
-@@ -659,7 +663,7 @@ static int rxkad_send_response(struct rx
-
- len = iov[0].iov_len + iov[1].iov_len + iov[2].iov_len;
-
-- hdr->serial = htonl(atomic_inc_return(&conn->serial));
-+ hdr->serial = htonl(atomic_inc_return_unchecked(&conn->serial));
- _proto("Tx RESPONSE %%%u", ntohl(hdr->serial));
-
- ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 3, len);
-diff -urNp linux-2.6.32.45/net/sctp/proc.c linux-2.6.32.45/net/sctp/proc.c
---- linux-2.6.32.45/net/sctp/proc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/sctp/proc.c 2011-04-17 15:56:46.000000000 -0400
-@@ -213,7 +213,12 @@ static int sctp_eps_seq_show(struct seq_
- sctp_for_each_hentry(epb, node, &head->chain) {
- ep = sctp_ep(epb);
- sk = epb->sk;
-- seq_printf(seq, "%8p %8p %-3d %-3d %-4d %-5d %5d %5lu ", ep, sk,
-+ seq_printf(seq, "%8p %8p %-3d %-3d %-4d %-5d %5d %5lu ",
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL, NULL,
-+#else
-+ ep, sk,
-+#endif
- sctp_sk(sk)->type, sk->sk_state, hash,
- epb->bind_addr.port,
- sock_i_uid(sk), sock_i_ino(sk));
-@@ -320,7 +325,12 @@ static int sctp_assocs_seq_show(struct s
- seq_printf(seq,
- "%8p %8p %-3d %-3d %-2d %-4d "
- "%4d %8d %8d %7d %5lu %-5d %5d ",
-- assoc, sk, sctp_sk(sk)->type, sk->sk_state,
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL, NULL,
-+#else
-+ assoc, sk,
-+#endif
-+ sctp_sk(sk)->type, sk->sk_state,
- assoc->state, hash,
- assoc->assoc_id,
- assoc->sndbuf_used,
-diff -urNp linux-2.6.32.45/net/sctp/socket.c linux-2.6.32.45/net/sctp/socket.c
---- linux-2.6.32.45/net/sctp/socket.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/sctp/socket.c 2011-04-23 12:56:11.000000000 -0400
-@@ -5802,7 +5802,6 @@ pp_found:
- */
- int reuse = sk->sk_reuse;
- struct sock *sk2;
-- struct hlist_node *node;
-
- SCTP_DEBUG_PRINTK("sctp_get_port() found a possible match\n");
- if (pp->fastreuse && sk->sk_reuse &&
-diff -urNp linux-2.6.32.45/net/socket.c linux-2.6.32.45/net/socket.c
---- linux-2.6.32.45/net/socket.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/socket.c 2011-05-16 21:46:57.000000000 -0400
-@@ -87,6 +87,7 @@
- #include <linux/wireless.h>
- #include <linux/nsproxy.h>
- #include <linux/magic.h>
-+#include <linux/in.h>
-
- #include <asm/uaccess.h>
- #include <asm/unistd.h>
-@@ -97,6 +98,21 @@
- #include <net/sock.h>
- #include <linux/netfilter.h>
-
-+extern void gr_attach_curr_ip(const struct sock *sk);
-+extern int gr_handle_sock_all(const int family, const int type,
-+ const int protocol);
-+extern int gr_handle_sock_server(const struct sockaddr *sck);
-+extern int gr_handle_sock_server_other(const struct sock *sck);
-+extern int gr_handle_sock_client(const struct sockaddr *sck);
-+extern int gr_search_connect(struct socket * sock,
-+ struct sockaddr_in * addr);
-+extern int gr_search_bind(struct socket * sock,
-+ struct sockaddr_in * addr);
-+extern int gr_search_listen(struct socket * sock);
-+extern int gr_search_accept(struct socket * sock);
-+extern int gr_search_socket(const int domain, const int type,
-+ const int protocol);
-+
- static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
- static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
- unsigned long nr_segs, loff_t pos);
-@@ -298,7 +314,7 @@ static int sockfs_get_sb(struct file_sys
- mnt);
- }
-
--static struct vfsmount *sock_mnt __read_mostly;
-+struct vfsmount *sock_mnt __read_mostly;
-
- static struct file_system_type sock_fs_type = {
- .name = "sockfs",
-@@ -1154,6 +1170,8 @@ static int __sock_create(struct net *net
- return -EAFNOSUPPORT;
- if (type < 0 || type >= SOCK_MAX)
- return -EINVAL;
-+ if (protocol < 0)
-+ return -EINVAL;
-
- /* Compatibility.
-
-@@ -1283,6 +1301,16 @@ SYSCALL_DEFINE3(socket, int, family, int
- if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
- flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
-
-+ if(!gr_search_socket(family, type, protocol)) {
-+ retval = -EACCES;
-+ goto out;
-+ }
-+
-+ if (gr_handle_sock_all(family, type, protocol)) {
-+ retval = -EACCES;
-+ goto out;
-+ }
-+
- retval = sock_create(family, type, protocol, &sock);
- if (retval < 0)
- goto out;
-@@ -1415,6 +1443,14 @@ SYSCALL_DEFINE3(bind, int, fd, struct so
- if (sock) {
- err = move_addr_to_kernel(umyaddr, addrlen, (struct sockaddr *)&address);
- if (err >= 0) {
-+ if (gr_handle_sock_server((struct sockaddr *)&address)) {
-+ err = -EACCES;
-+ goto error;
-+ }
-+ err = gr_search_bind(sock, (struct sockaddr_in *)&address);
-+ if (err)
-+ goto error;
-+
- err = security_socket_bind(sock,
- (struct sockaddr *)&address,
- addrlen);
-@@ -1423,6 +1459,7 @@ SYSCALL_DEFINE3(bind, int, fd, struct so
- (struct sockaddr *)
- &address, addrlen);
- }
-+error:
- fput_light(sock->file, fput_needed);
- }
- return err;
-@@ -1446,10 +1483,20 @@ SYSCALL_DEFINE2(listen, int, fd, int, ba
- if ((unsigned)backlog > somaxconn)
- backlog = somaxconn;
-
-+ if (gr_handle_sock_server_other(sock->sk)) {
-+ err = -EPERM;
-+ goto error;
-+ }
-+
-+ err = gr_search_listen(sock);
-+ if (err)
-+ goto error;
-+
- err = security_socket_listen(sock, backlog);
- if (!err)
- err = sock->ops->listen(sock, backlog);
-
-+error:
- fput_light(sock->file, fput_needed);
- }
- return err;
-@@ -1492,6 +1539,18 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
- newsock->type = sock->type;
- newsock->ops = sock->ops;
-
-+ if (gr_handle_sock_server_other(sock->sk)) {
-+ err = -EPERM;
-+ sock_release(newsock);
-+ goto out_put;
-+ }
-+
-+ err = gr_search_accept(sock);
-+ if (err) {
-+ sock_release(newsock);
-+ goto out_put;
-+ }
-+
- /*
- * We don't need try_module_get here, as the listening socket (sock)
- * has the protocol module (sock->ops->owner) held.
-@@ -1534,6 +1593,8 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
- fd_install(newfd, newfile);
- err = newfd;
-
-+ gr_attach_curr_ip(newsock->sk);
-+
- out_put:
- fput_light(sock->file, fput_needed);
- out:
-@@ -1571,6 +1632,7 @@ SYSCALL_DEFINE3(connect, int, fd, struct
- int, addrlen)
- {
- struct socket *sock;
-+ struct sockaddr *sck;
- struct sockaddr_storage address;
- int err, fput_needed;
-
-@@ -1581,6 +1643,17 @@ SYSCALL_DEFINE3(connect, int, fd, struct
- if (err < 0)
- goto out_put;
-
-+ sck = (struct sockaddr *)&address;
-+
-+ if (gr_handle_sock_client(sck)) {
-+ err = -EACCES;
-+ goto out_put;
-+ }
-+
-+ err = gr_search_connect(sock, (struct sockaddr_in *)sck);
-+ if (err)
-+ goto out_put;
-+
- err =
- security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
- if (err)
-@@ -1882,6 +1955,8 @@ SYSCALL_DEFINE3(sendmsg, int, fd, struct
- int err, ctl_len, iov_size, total_len;
- int fput_needed;
-
-+ pax_track_stack();
-+
- err = -EFAULT;
- if (MSG_CMSG_COMPAT & flags) {
- if (get_compat_msghdr(&msg_sys, msg_compat))
-diff -urNp linux-2.6.32.45/net/sunrpc/sched.c linux-2.6.32.45/net/sunrpc/sched.c
---- linux-2.6.32.45/net/sunrpc/sched.c 2011-08-09 18:35:30.000000000 -0400
-+++ linux-2.6.32.45/net/sunrpc/sched.c 2011-08-09 18:34:01.000000000 -0400
-@@ -234,10 +234,10 @@ static int rpc_wait_bit_killable(void *w
- #ifdef RPC_DEBUG
- static void rpc_task_set_debuginfo(struct rpc_task *task)
- {
-- static atomic_t rpc_pid;
-+ static atomic_unchecked_t rpc_pid;
-
- task->tk_magic = RPC_TASK_MAGIC_ID;
-- task->tk_pid = atomic_inc_return(&rpc_pid);
-+ task->tk_pid = atomic_inc_return_unchecked(&rpc_pid);
- }
- #else
- static inline void rpc_task_set_debuginfo(struct rpc_task *task)
-diff -urNp linux-2.6.32.45/net/sunrpc/xprtrdma/svc_rdma.c linux-2.6.32.45/net/sunrpc/xprtrdma/svc_rdma.c
---- linux-2.6.32.45/net/sunrpc/xprtrdma/svc_rdma.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/sunrpc/xprtrdma/svc_rdma.c 2011-05-04 17:56:20.000000000 -0400
-@@ -59,15 +59,15 @@ unsigned int svcrdma_max_req_size = RPCR
- static unsigned int min_max_inline = 4096;
- static unsigned int max_max_inline = 65536;
-
--atomic_t rdma_stat_recv;
--atomic_t rdma_stat_read;
--atomic_t rdma_stat_write;
--atomic_t rdma_stat_sq_starve;
--atomic_t rdma_stat_rq_starve;
--atomic_t rdma_stat_rq_poll;
--atomic_t rdma_stat_rq_prod;
--atomic_t rdma_stat_sq_poll;
--atomic_t rdma_stat_sq_prod;
-+atomic_unchecked_t rdma_stat_recv;
-+atomic_unchecked_t rdma_stat_read;
-+atomic_unchecked_t rdma_stat_write;
-+atomic_unchecked_t rdma_stat_sq_starve;
-+atomic_unchecked_t rdma_stat_rq_starve;
-+atomic_unchecked_t rdma_stat_rq_poll;
-+atomic_unchecked_t rdma_stat_rq_prod;
-+atomic_unchecked_t rdma_stat_sq_poll;
-+atomic_unchecked_t rdma_stat_sq_prod;
-
- /* Temporary NFS request map and context caches */
- struct kmem_cache *svc_rdma_map_cachep;
-@@ -105,7 +105,7 @@ static int read_reset_stat(ctl_table *ta
- len -= *ppos;
- if (len > *lenp)
- len = *lenp;
-- if (len && copy_to_user(buffer, str_buf, len))
-+ if (len > sizeof str_buf || (len && copy_to_user(buffer, str_buf, len)))
- return -EFAULT;
- *lenp = len;
- *ppos += len;
-@@ -149,63 +149,63 @@ static ctl_table svcrdma_parm_table[] =
- {
- .procname = "rdma_stat_read",
- .data = &rdma_stat_read,
-- .maxlen = sizeof(atomic_t),
-+ .maxlen = sizeof(atomic_unchecked_t),
- .mode = 0644,
- .proc_handler = &read_reset_stat,
- },
- {
- .procname = "rdma_stat_recv",
- .data = &rdma_stat_recv,
-- .maxlen = sizeof(atomic_t),
-+ .maxlen = sizeof(atomic_unchecked_t),
- .mode = 0644,
- .proc_handler = &read_reset_stat,
- },
- {
- .procname = "rdma_stat_write",
- .data = &rdma_stat_write,
-- .maxlen = sizeof(atomic_t),
-+ .maxlen = sizeof(atomic_unchecked_t),
- .mode = 0644,
- .proc_handler = &read_reset_stat,
- },
- {
- .procname = "rdma_stat_sq_starve",
- .data = &rdma_stat_sq_starve,
-- .maxlen = sizeof(atomic_t),
-+ .maxlen = sizeof(atomic_unchecked_t),
- .mode = 0644,
- .proc_handler = &read_reset_stat,
- },
- {
- .procname = "rdma_stat_rq_starve",
- .data = &rdma_stat_rq_starve,
-- .maxlen = sizeof(atomic_t),
-+ .maxlen = sizeof(atomic_unchecked_t),
- .mode = 0644,
- .proc_handler = &read_reset_stat,
- },
- {
- .procname = "rdma_stat_rq_poll",
- .data = &rdma_stat_rq_poll,
-- .maxlen = sizeof(atomic_t),
-+ .maxlen = sizeof(atomic_unchecked_t),
- .mode = 0644,
- .proc_handler = &read_reset_stat,
- },
- {
- .procname = "rdma_stat_rq_prod",
- .data = &rdma_stat_rq_prod,
-- .maxlen = sizeof(atomic_t),
-+ .maxlen = sizeof(atomic_unchecked_t),
- .mode = 0644,
- .proc_handler = &read_reset_stat,
- },
- {
- .procname = "rdma_stat_sq_poll",
- .data = &rdma_stat_sq_poll,
-- .maxlen = sizeof(atomic_t),
-+ .maxlen = sizeof(atomic_unchecked_t),
- .mode = 0644,
- .proc_handler = &read_reset_stat,
- },
- {
- .procname = "rdma_stat_sq_prod",
- .data = &rdma_stat_sq_prod,
-- .maxlen = sizeof(atomic_t),
-+ .maxlen = sizeof(atomic_unchecked_t),
- .mode = 0644,
- .proc_handler = &read_reset_stat,
- },
-diff -urNp linux-2.6.32.45/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c linux-2.6.32.45/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
---- linux-2.6.32.45/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c 2011-05-04 17:56:28.000000000 -0400
-@@ -495,7 +495,7 @@ next_sge:
- svc_rdma_put_context(ctxt, 0);
- goto out;
- }
-- atomic_inc(&rdma_stat_read);
-+ atomic_inc_unchecked(&rdma_stat_read);
-
- if (read_wr.num_sge < chl_map->ch[ch_no].count) {
- chl_map->ch[ch_no].count -= read_wr.num_sge;
-@@ -606,7 +606,7 @@ int svc_rdma_recvfrom(struct svc_rqst *r
- dto_q);
- list_del_init(&ctxt->dto_q);
- } else {
-- atomic_inc(&rdma_stat_rq_starve);
-+ atomic_inc_unchecked(&rdma_stat_rq_starve);
- clear_bit(XPT_DATA, &xprt->xpt_flags);
- ctxt = NULL;
- }
-@@ -626,7 +626,7 @@ int svc_rdma_recvfrom(struct svc_rqst *r
- dprintk("svcrdma: processing ctxt=%p on xprt=%p, rqstp=%p, status=%d\n",
- ctxt, rdma_xprt, rqstp, ctxt->wc_status);
- BUG_ON(ctxt->wc_status != IB_WC_SUCCESS);
-- atomic_inc(&rdma_stat_recv);
-+ atomic_inc_unchecked(&rdma_stat_recv);
-
- /* Build up the XDR from the receive buffers. */
- rdma_build_arg_xdr(rqstp, ctxt, ctxt->byte_len);
-diff -urNp linux-2.6.32.45/net/sunrpc/xprtrdma/svc_rdma_sendto.c linux-2.6.32.45/net/sunrpc/xprtrdma/svc_rdma_sendto.c
---- linux-2.6.32.45/net/sunrpc/xprtrdma/svc_rdma_sendto.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/sunrpc/xprtrdma/svc_rdma_sendto.c 2011-05-04 17:56:28.000000000 -0400
-@@ -328,7 +328,7 @@ static int send_write(struct svcxprt_rdm
- write_wr.wr.rdma.remote_addr = to;
-
- /* Post It */
-- atomic_inc(&rdma_stat_write);
-+ atomic_inc_unchecked(&rdma_stat_write);
- if (svc_rdma_send(xprt, &write_wr))
- goto err;
- return 0;
-diff -urNp linux-2.6.32.45/net/sunrpc/xprtrdma/svc_rdma_transport.c linux-2.6.32.45/net/sunrpc/xprtrdma/svc_rdma_transport.c
---- linux-2.6.32.45/net/sunrpc/xprtrdma/svc_rdma_transport.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/sunrpc/xprtrdma/svc_rdma_transport.c 2011-05-04 17:56:28.000000000 -0400
-@@ -292,7 +292,7 @@ static void rq_cq_reap(struct svcxprt_rd
- return;
-
- ib_req_notify_cq(xprt->sc_rq_cq, IB_CQ_NEXT_COMP);
-- atomic_inc(&rdma_stat_rq_poll);
-+ atomic_inc_unchecked(&rdma_stat_rq_poll);
-
- while ((ret = ib_poll_cq(xprt->sc_rq_cq, 1, &wc)) > 0) {
- ctxt = (struct svc_rdma_op_ctxt *)(unsigned long)wc.wr_id;
-@@ -314,7 +314,7 @@ static void rq_cq_reap(struct svcxprt_rd
- }
-
- if (ctxt)
-- atomic_inc(&rdma_stat_rq_prod);
-+ atomic_inc_unchecked(&rdma_stat_rq_prod);
-
- set_bit(XPT_DATA, &xprt->sc_xprt.xpt_flags);
- /*
-@@ -386,7 +386,7 @@ static void sq_cq_reap(struct svcxprt_rd
- return;
-
- ib_req_notify_cq(xprt->sc_sq_cq, IB_CQ_NEXT_COMP);
-- atomic_inc(&rdma_stat_sq_poll);
-+ atomic_inc_unchecked(&rdma_stat_sq_poll);
- while ((ret = ib_poll_cq(cq, 1, &wc)) > 0) {
- if (wc.status != IB_WC_SUCCESS)
- /* Close the transport */
-@@ -404,7 +404,7 @@ static void sq_cq_reap(struct svcxprt_rd
- }
-
- if (ctxt)
-- atomic_inc(&rdma_stat_sq_prod);
-+ atomic_inc_unchecked(&rdma_stat_sq_prod);
- }
-
- static void sq_comp_handler(struct ib_cq *cq, void *cq_context)
-@@ -1260,7 +1260,7 @@ int svc_rdma_send(struct svcxprt_rdma *x
- spin_lock_bh(&xprt->sc_lock);
- if (xprt->sc_sq_depth < atomic_read(&xprt->sc_sq_count) + wr_count) {
- spin_unlock_bh(&xprt->sc_lock);
-- atomic_inc(&rdma_stat_sq_starve);
-+ atomic_inc_unchecked(&rdma_stat_sq_starve);
-
- /* See if we can opportunistically reap SQ WR to make room */
- sq_cq_reap(xprt);
-diff -urNp linux-2.6.32.45/net/sysctl_net.c linux-2.6.32.45/net/sysctl_net.c
---- linux-2.6.32.45/net/sysctl_net.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/sysctl_net.c 2011-04-17 15:56:46.000000000 -0400
-@@ -46,7 +46,7 @@ static int net_ctl_permissions(struct ct
- struct ctl_table *table)
- {
- /* Allow network administrator to have same access as root. */
-- if (capable(CAP_NET_ADMIN)) {
-+ if (capable_nolog(CAP_NET_ADMIN)) {
- int mode = (table->mode >> 6) & 7;
- return (mode << 6) | (mode << 3) | mode;
- }
-diff -urNp linux-2.6.32.45/net/unix/af_unix.c linux-2.6.32.45/net/unix/af_unix.c
---- linux-2.6.32.45/net/unix/af_unix.c 2011-05-10 22:12:02.000000000 -0400
-+++ linux-2.6.32.45/net/unix/af_unix.c 2011-07-18 18:17:33.000000000 -0400
-@@ -745,6 +745,12 @@ static struct sock *unix_find_other(stru
- err = -ECONNREFUSED;
- if (!S_ISSOCK(inode->i_mode))
- goto put_fail;
-+
-+ if (!gr_acl_handle_unix(path.dentry, path.mnt)) {
-+ err = -EACCES;
-+ goto put_fail;
-+ }
-+
- u = unix_find_socket_byinode(net, inode);
- if (!u)
- goto put_fail;
-@@ -765,6 +771,13 @@ static struct sock *unix_find_other(stru
- if (u) {
- struct dentry *dentry;
- dentry = unix_sk(u)->dentry;
-+
-+ if (!gr_handle_chroot_unix(u->sk_peercred.pid)) {
-+ err = -EPERM;
-+ sock_put(u);
-+ goto fail;
-+ }
-+
- if (dentry)
- touch_atime(unix_sk(u)->mnt, dentry);
- } else
-@@ -850,11 +863,18 @@ static int unix_bind(struct socket *sock
- err = security_path_mknod(&nd.path, dentry, mode, 0);
- if (err)
- goto out_mknod_drop_write;
-+ if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
-+ err = -EACCES;
-+ goto out_mknod_drop_write;
-+ }
- err = vfs_mknod(nd.path.dentry->d_inode, dentry, mode, 0);
- out_mknod_drop_write:
- mnt_drop_write(nd.path.mnt);
- if (err)
- goto out_mknod_dput;
-+
-+ gr_handle_create(dentry, nd.path.mnt);
-+
- mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
- dput(nd.path.dentry);
- nd.path.dentry = dentry;
-@@ -2211,7 +2231,11 @@ static int unix_seq_show(struct seq_file
- unix_state_lock(s);
-
- seq_printf(seq, "%p: %08X %08X %08X %04X %02X %5lu",
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+ NULL,
-+#else
- s,
-+#endif
- atomic_read(&s->sk_refcnt),
- 0,
- s->sk_state == TCP_LISTEN ? __SO_ACCEPTCON : 0,
-diff -urNp linux-2.6.32.45/net/wireless/core.c linux-2.6.32.45/net/wireless/core.c
---- linux-2.6.32.45/net/wireless/core.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/wireless/core.c 2011-08-05 20:33:55.000000000 -0400
-@@ -367,7 +367,7 @@ struct wiphy *wiphy_new(const struct cfg
-
- wiphy_net_set(&rdev->wiphy, &init_net);
-
-- rdev->rfkill_ops.set_block = cfg80211_rfkill_set_block;
-+ *(void **)&rdev->rfkill_ops.set_block = cfg80211_rfkill_set_block;
- rdev->rfkill = rfkill_alloc(dev_name(&rdev->wiphy.dev),
- &rdev->wiphy.dev, RFKILL_TYPE_WLAN,
- &rdev->rfkill_ops, rdev);
-@@ -505,7 +505,7 @@ void wiphy_rfkill_start_polling(struct w
-
- if (!rdev->ops->rfkill_poll)
- return;
-- rdev->rfkill_ops.poll = cfg80211_rfkill_poll;
-+ *(void **)&rdev->rfkill_ops.poll = cfg80211_rfkill_poll;
- rfkill_resume_polling(rdev->rfkill);
- }
- EXPORT_SYMBOL(wiphy_rfkill_start_polling);
-diff -urNp linux-2.6.32.45/net/wireless/wext.c linux-2.6.32.45/net/wireless/wext.c
---- linux-2.6.32.45/net/wireless/wext.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/wireless/wext.c 2011-04-17 15:56:46.000000000 -0400
-@@ -816,8 +816,7 @@ static int ioctl_standard_iw_point(struc
- */
-
- /* Support for very large requests */
-- if ((descr->flags & IW_DESCR_FLAG_NOMAX) &&
-- (user_length > descr->max_tokens)) {
-+ if (user_length > descr->max_tokens) {
- /* Allow userspace to GET more than max so
- * we can support any size GET requests.
- * There is still a limit : -ENOMEM.
-@@ -854,22 +853,6 @@ static int ioctl_standard_iw_point(struc
- }
- }
-
-- if (IW_IS_GET(cmd) && !(descr->flags & IW_DESCR_FLAG_NOMAX)) {
-- /*
-- * If this is a GET, but not NOMAX, it means that the extra
-- * data is not bounded by userspace, but by max_tokens. Thus
-- * set the length to max_tokens. This matches the extra data
-- * allocation.
-- * The driver should fill it with the number of tokens it
-- * provided, and it may check iwp->length rather than having
-- * knowledge of max_tokens. If the driver doesn't change the
-- * iwp->length, this ioctl just copies back max_token tokens
-- * filled with zeroes. Hopefully the driver isn't claiming
-- * them to be valid data.
-- */
-- iwp->length = descr->max_tokens;
-- }
--
- err = handler(dev, info, (union iwreq_data *) iwp, extra);
-
- iwp->length += essid_compat;
-diff -urNp linux-2.6.32.45/net/xfrm/xfrm_policy.c linux-2.6.32.45/net/xfrm/xfrm_policy.c
---- linux-2.6.32.45/net/xfrm/xfrm_policy.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/xfrm/xfrm_policy.c 2011-05-04 17:56:20.000000000 -0400
-@@ -586,7 +586,7 @@ int xfrm_policy_insert(int dir, struct x
- hlist_add_head(&policy->bydst, chain);
- xfrm_pol_hold(policy);
- net->xfrm.policy_count[dir]++;
-- atomic_inc(&flow_cache_genid);
-+ atomic_inc_unchecked(&flow_cache_genid);
- if (delpol)
- __xfrm_policy_unlink(delpol, dir);
- policy->index = delpol ? delpol->index : xfrm_gen_index(net, dir);
-@@ -669,7 +669,7 @@ struct xfrm_policy *xfrm_policy_bysel_ct
- write_unlock_bh(&xfrm_policy_lock);
-
- if (ret && delete) {
-- atomic_inc(&flow_cache_genid);
-+ atomic_inc_unchecked(&flow_cache_genid);
- xfrm_policy_kill(ret);
- }
- return ret;
-@@ -710,7 +710,7 @@ struct xfrm_policy *xfrm_policy_byid(str
- write_unlock_bh(&xfrm_policy_lock);
-
- if (ret && delete) {
-- atomic_inc(&flow_cache_genid);
-+ atomic_inc_unchecked(&flow_cache_genid);
- xfrm_policy_kill(ret);
- }
- return ret;
-@@ -824,7 +824,7 @@ int xfrm_policy_flush(struct net *net, u
- }
-
- }
-- atomic_inc(&flow_cache_genid);
-+ atomic_inc_unchecked(&flow_cache_genid);
- out:
- write_unlock_bh(&xfrm_policy_lock);
- return err;
-@@ -1088,7 +1088,7 @@ int xfrm_policy_delete(struct xfrm_polic
- write_unlock_bh(&xfrm_policy_lock);
- if (pol) {
- if (dir < XFRM_POLICY_MAX)
-- atomic_inc(&flow_cache_genid);
-+ atomic_inc_unchecked(&flow_cache_genid);
- xfrm_policy_kill(pol);
- return 0;
- }
-@@ -1477,7 +1477,7 @@ free_dst:
- goto out;
- }
-
--static int inline
-+static inline int
- xfrm_dst_alloc_copy(void **target, void *src, int size)
- {
- if (!*target) {
-@@ -1489,7 +1489,7 @@ xfrm_dst_alloc_copy(void **target, void
- return 0;
- }
-
--static int inline
-+static inline int
- xfrm_dst_update_parent(struct dst_entry *dst, struct xfrm_selector *sel)
- {
- #ifdef CONFIG_XFRM_SUB_POLICY
-@@ -1501,7 +1501,7 @@ xfrm_dst_update_parent(struct dst_entry
- #endif
- }
-
--static int inline
-+static inline int
- xfrm_dst_update_origin(struct dst_entry *dst, struct flowi *fl)
- {
- #ifdef CONFIG_XFRM_SUB_POLICY
-@@ -1537,7 +1537,7 @@ int __xfrm_lookup(struct net *net, struc
- u8 dir = policy_to_flow_dir(XFRM_POLICY_OUT);
-
- restart:
-- genid = atomic_read(&flow_cache_genid);
-+ genid = atomic_read_unchecked(&flow_cache_genid);
- policy = NULL;
- for (pi = 0; pi < ARRAY_SIZE(pols); pi++)
- pols[pi] = NULL;
-@@ -1680,7 +1680,7 @@ restart:
- goto error;
- }
- if (nx == -EAGAIN ||
-- genid != atomic_read(&flow_cache_genid)) {
-+ genid != atomic_read_unchecked(&flow_cache_genid)) {
- xfrm_pols_put(pols, npols);
- goto restart;
- }
-diff -urNp linux-2.6.32.45/net/xfrm/xfrm_user.c linux-2.6.32.45/net/xfrm/xfrm_user.c
---- linux-2.6.32.45/net/xfrm/xfrm_user.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/net/xfrm/xfrm_user.c 2011-05-16 21:46:57.000000000 -0400
-@@ -1169,6 +1169,8 @@ static int copy_to_user_tmpl(struct xfrm
- struct xfrm_user_tmpl vec[XFRM_MAX_DEPTH];
- int i;
-
-+ pax_track_stack();
-+
- if (xp->xfrm_nr == 0)
- return 0;
-
-@@ -1784,6 +1786,8 @@ static int xfrm_do_migrate(struct sk_buf
- int err;
- int n = 0;
-
-+ pax_track_stack();
-+
- if (attrs[XFRMA_MIGRATE] == NULL)
- return -EINVAL;
-
-diff -urNp linux-2.6.32.45/samples/kobject/kset-example.c linux-2.6.32.45/samples/kobject/kset-example.c
---- linux-2.6.32.45/samples/kobject/kset-example.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/samples/kobject/kset-example.c 2011-04-17 15:56:46.000000000 -0400
-@@ -87,7 +87,7 @@ static ssize_t foo_attr_store(struct kob
- }
-
- /* Our custom sysfs_ops that we will associate with our ktype later on */
--static struct sysfs_ops foo_sysfs_ops = {
-+static const struct sysfs_ops foo_sysfs_ops = {
- .show = foo_attr_show,
- .store = foo_attr_store,
- };
-diff -urNp linux-2.6.32.45/scripts/basic/fixdep.c linux-2.6.32.45/scripts/basic/fixdep.c
---- linux-2.6.32.45/scripts/basic/fixdep.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/scripts/basic/fixdep.c 2011-04-17 15:56:46.000000000 -0400
-@@ -222,9 +222,9 @@ static void use_config(char *m, int slen
-
- static void parse_config_file(char *map, size_t len)
- {
-- int *end = (int *) (map + len);
-+ unsigned int *end = (unsigned int *) (map + len);
- /* start at +1, so that p can never be < map */
-- int *m = (int *) map + 1;
-+ unsigned int *m = (unsigned int *) map + 1;
- char *p, *q;
-
- for (; m < end; m++) {
-@@ -371,7 +371,7 @@ static void print_deps(void)
- static void traps(void)
- {
- static char test[] __attribute__((aligned(sizeof(int)))) = "CONF";
-- int *p = (int *)test;
-+ unsigned int *p = (unsigned int *)test;
-
- if (*p != INT_CONF) {
- fprintf(stderr, "fixdep: sizeof(int) != 4 or wrong endianess? %#x\n",
-diff -urNp linux-2.6.32.45/scripts/gcc-plugin.sh linux-2.6.32.45/scripts/gcc-plugin.sh
---- linux-2.6.32.45/scripts/gcc-plugin.sh 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/scripts/gcc-plugin.sh 2011-08-05 20:33:55.000000000 -0400
-@@ -0,0 +1,3 @@
-+#!/bin/sh
-+
-+echo "#include \"gcc-plugin.h\"" | $* -x c - -c -o /dev/null -I`$* -print-file-name=plugin`/include>/dev/null 2>&1 && echo "y"
-diff -urNp linux-2.6.32.45/scripts/Makefile.build linux-2.6.32.45/scripts/Makefile.build
---- linux-2.6.32.45/scripts/Makefile.build 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/scripts/Makefile.build 2011-06-04 20:46:51.000000000 -0400
-@@ -59,7 +59,7 @@ endif
- endif
-
- # Do not include host rules unless needed
--ifneq ($(hostprogs-y)$(hostprogs-m),)
-+ifneq ($(hostprogs-y)$(hostprogs-m)$(hostlibs-y)$(hostlibs-m),)
- include scripts/Makefile.host
- endif
-
-diff -urNp linux-2.6.32.45/scripts/Makefile.clean linux-2.6.32.45/scripts/Makefile.clean
---- linux-2.6.32.45/scripts/Makefile.clean 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/scripts/Makefile.clean 2011-06-04 20:47:19.000000000 -0400
-@@ -43,7 +43,8 @@ subdir-ymn := $(addprefix $(obj)/,$(subd
- __clean-files := $(extra-y) $(always) \
- $(targets) $(clean-files) \
- $(host-progs) \
-- $(hostprogs-y) $(hostprogs-m) $(hostprogs-)
-+ $(hostprogs-y) $(hostprogs-m) $(hostprogs-) \
-+ $(hostlibs-y) $(hostlibs-m) $(hostlibs-)
-
- # as clean-files is given relative to the current directory, this adds
- # a $(obj) prefix, except for absolute paths
-diff -urNp linux-2.6.32.45/scripts/Makefile.host linux-2.6.32.45/scripts/Makefile.host
---- linux-2.6.32.45/scripts/Makefile.host 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/scripts/Makefile.host 2011-06-04 20:48:22.000000000 -0400
-@@ -31,6 +31,7 @@
- # Note: Shared libraries consisting of C++ files are not supported
-
- __hostprogs := $(sort $(hostprogs-y) $(hostprogs-m))
-+__hostlibs := $(sort $(hostlibs-y) $(hostlibs-m))
-
- # C code
- # Executables compiled from a single .c file
-@@ -54,6 +55,7 @@ host-cxxobjs := $(sort $(foreach m,$(hos
- # Shared libaries (only .c supported)
- # Shared libraries (.so) - all .so files referenced in "xxx-objs"
- host-cshlib := $(sort $(filter %.so, $(host-cobjs)))
-+host-cshlib += $(sort $(filter %.so, $(__hostlibs)))
- # Remove .so files from "xxx-objs"
- host-cobjs := $(filter-out %.so,$(host-cobjs))
-
-diff -urNp linux-2.6.32.45/scripts/mod/file2alias.c linux-2.6.32.45/scripts/mod/file2alias.c
---- linux-2.6.32.45/scripts/mod/file2alias.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/scripts/mod/file2alias.c 2011-04-17 15:56:46.000000000 -0400
-@@ -72,7 +72,7 @@ static void device_id_check(const char *
- unsigned long size, unsigned long id_size,
- void *symval)
- {
-- int i;
-+ unsigned int i;
-
- if (size % id_size || size < id_size) {
- if (cross_build != 0)
-@@ -102,7 +102,7 @@ static void device_id_check(const char *
- /* USB is special because the bcdDevice can be matched against a numeric range */
- /* Looks like "usb:vNpNdNdcNdscNdpNicNiscNipN" */
- static void do_usb_entry(struct usb_device_id *id,
-- unsigned int bcdDevice_initial, int bcdDevice_initial_digits,
-+ unsigned int bcdDevice_initial, unsigned int bcdDevice_initial_digits,
- unsigned char range_lo, unsigned char range_hi,
- struct module *mod)
- {
-@@ -368,7 +368,7 @@ static void do_pnp_device_entry(void *sy
- for (i = 0; i < count; i++) {
- const char *id = (char *)devs[i].id;
- char acpi_id[sizeof(devs[0].id)];
-- int j;
-+ unsigned int j;
-
- buf_printf(&mod->dev_table_buf,
- "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
-@@ -398,7 +398,7 @@ static void do_pnp_card_entries(void *sy
-
- for (j = 0; j < PNP_MAX_DEVICES; j++) {
- const char *id = (char *)card->devs[j].id;
-- int i2, j2;
-+ unsigned int i2, j2;
- int dup = 0;
-
- if (!id[0])
-@@ -424,7 +424,7 @@ static void do_pnp_card_entries(void *sy
- /* add an individual alias for every device entry */
- if (!dup) {
- char acpi_id[sizeof(card->devs[0].id)];
-- int k;
-+ unsigned int k;
-
- buf_printf(&mod->dev_table_buf,
- "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
-@@ -699,7 +699,7 @@ static void dmi_ascii_filter(char *d, co
- static int do_dmi_entry(const char *filename, struct dmi_system_id *id,
- char *alias)
- {
-- int i, j;
-+ unsigned int i, j;
-
- sprintf(alias, "dmi*");
-
-diff -urNp linux-2.6.32.45/scripts/mod/modpost.c linux-2.6.32.45/scripts/mod/modpost.c
---- linux-2.6.32.45/scripts/mod/modpost.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/scripts/mod/modpost.c 2011-07-06 19:53:33.000000000 -0400
-@@ -835,6 +835,7 @@ enum mismatch {
- INIT_TO_EXIT,
- EXIT_TO_INIT,
- EXPORT_TO_INIT_EXIT,
-+ DATA_TO_TEXT
- };
-
- struct sectioncheck {
-@@ -920,6 +921,12 @@ const struct sectioncheck sectioncheck[]
- .fromsec = { "__ksymtab*", NULL },
- .tosec = { INIT_SECTIONS, EXIT_SECTIONS, NULL },
- .mismatch = EXPORT_TO_INIT_EXIT
-+},
-+/* Do not reference code from writable data */
-+{
-+ .fromsec = { DATA_SECTIONS, NULL },
-+ .tosec = { TEXT_SECTIONS, NULL },
-+ .mismatch = DATA_TO_TEXT
- }
- };
-
-@@ -1024,10 +1031,10 @@ static Elf_Sym *find_elf_symbol(struct e
- continue;
- if (ELF_ST_TYPE(sym->st_info) == STT_SECTION)
- continue;
-- if (sym->st_value == addr)
-- return sym;
- /* Find a symbol nearby - addr are maybe negative */
- d = sym->st_value - addr;
-+ if (d == 0)
-+ return sym;
- if (d < 0)
- d = addr - sym->st_value;
- if (d < distance) {
-@@ -1268,6 +1275,14 @@ static void report_sec_mismatch(const ch
- "Fix this by removing the %sannotation of %s "
- "or drop the export.\n",
- tosym, sec2annotation(tosec), sec2annotation(tosec), tosym);
-+ case DATA_TO_TEXT:
-+/*
-+ fprintf(stderr,
-+ "The variable %s references\n"
-+ "the %s %s%s%s\n",
-+ fromsym, to, sec2annotation(tosec), tosym, to_p);
-+*/
-+ break;
- case NO_MISMATCH:
- /* To get warnings on missing members */
- break;
-@@ -1495,7 +1510,7 @@ static void section_rel(const char *modn
- static void check_sec_ref(struct module *mod, const char *modname,
- struct elf_info *elf)
- {
-- int i;
-+ unsigned int i;
- Elf_Shdr *sechdrs = elf->sechdrs;
-
- /* Walk through all sections */
-@@ -1651,7 +1666,7 @@ void __attribute__((format(printf, 2, 3)
- va_end(ap);
- }
-
--void buf_write(struct buffer *buf, const char *s, int len)
-+void buf_write(struct buffer *buf, const char *s, unsigned int len)
- {
- if (buf->size - buf->pos < len) {
- buf->size += len + SZ;
-@@ -1863,7 +1878,7 @@ static void write_if_changed(struct buff
- if (fstat(fileno(file), &st) < 0)
- goto close_write;
-
-- if (st.st_size != b->pos)
-+ if (st.st_size != (off_t)b->pos)
- goto close_write;
-
- tmp = NOFAIL(malloc(b->pos));
-diff -urNp linux-2.6.32.45/scripts/mod/modpost.h linux-2.6.32.45/scripts/mod/modpost.h
---- linux-2.6.32.45/scripts/mod/modpost.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/scripts/mod/modpost.h 2011-04-17 15:56:46.000000000 -0400
-@@ -92,15 +92,15 @@ void *do_nofail(void *ptr, const char *e
-
- struct buffer {
- char *p;
-- int pos;
-- int size;
-+ unsigned int pos;
-+ unsigned int size;
- };
-
- void __attribute__((format(printf, 2, 3)))
- buf_printf(struct buffer *buf, const char *fmt, ...);
-
- void
--buf_write(struct buffer *buf, const char *s, int len);
-+buf_write(struct buffer *buf, const char *s, unsigned int len);
-
- struct module {
- struct module *next;
-diff -urNp linux-2.6.32.45/scripts/mod/sumversion.c linux-2.6.32.45/scripts/mod/sumversion.c
---- linux-2.6.32.45/scripts/mod/sumversion.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/scripts/mod/sumversion.c 2011-04-17 15:56:46.000000000 -0400
-@@ -455,7 +455,7 @@ static void write_version(const char *fi
- goto out;
- }
-
-- if (write(fd, sum, strlen(sum)+1) != strlen(sum)+1) {
-+ if (write(fd, sum, strlen(sum)+1) != (ssize_t)strlen(sum)+1) {
- warn("writing sum in %s failed: %s\n",
- filename, strerror(errno));
- goto out;
-diff -urNp linux-2.6.32.45/scripts/package/mkspec linux-2.6.32.45/scripts/package/mkspec
---- linux-2.6.32.45/scripts/package/mkspec 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/scripts/package/mkspec 2011-07-19 18:19:12.000000000 -0400
-@@ -70,7 +70,7 @@ echo 'mkdir -p $RPM_BUILD_ROOT/boot $RPM
- echo 'mkdir -p $RPM_BUILD_ROOT/lib/firmware'
- echo "%endif"
-
--echo 'INSTALL_MOD_PATH=$RPM_BUILD_ROOT make %{_smp_mflags} KBUILD_SRC= modules_install'
-+echo 'INSTALL_MOD_PATH=$RPM_BUILD_ROOT make %{?_smp_mflags} KBUILD_SRC= modules_install'
- echo "%ifarch ia64"
- echo 'cp $KBUILD_IMAGE $RPM_BUILD_ROOT'"/boot/efi/vmlinuz-$KERNELRELEASE"
- echo 'ln -s '"efi/vmlinuz-$KERNELRELEASE" '$RPM_BUILD_ROOT'"/boot/"
-diff -urNp linux-2.6.32.45/scripts/pnmtologo.c linux-2.6.32.45/scripts/pnmtologo.c
---- linux-2.6.32.45/scripts/pnmtologo.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/scripts/pnmtologo.c 2011-04-17 15:56:46.000000000 -0400
-@@ -237,14 +237,14 @@ static void write_header(void)
- fprintf(out, " * Linux logo %s\n", logoname);
- fputs(" */\n\n", out);
- fputs("#include <linux/linux_logo.h>\n\n", out);
-- fprintf(out, "static unsigned char %s_data[] __initdata = {\n",
-+ fprintf(out, "static unsigned char %s_data[] = {\n",
- logoname);
- }
-
- static void write_footer(void)
- {
- fputs("\n};\n\n", out);
-- fprintf(out, "const struct linux_logo %s __initconst = {\n", logoname);
-+ fprintf(out, "const struct linux_logo %s = {\n", logoname);
- fprintf(out, "\t.type\t\t= %s,\n", logo_types[logo_type]);
- fprintf(out, "\t.width\t\t= %d,\n", logo_width);
- fprintf(out, "\t.height\t\t= %d,\n", logo_height);
-@@ -374,7 +374,7 @@ static void write_logo_clut224(void)
- fputs("\n};\n\n", out);
-
- /* write logo clut */
-- fprintf(out, "static unsigned char %s_clut[] __initdata = {\n",
-+ fprintf(out, "static unsigned char %s_clut[] = {\n",
- logoname);
- write_hex_cnt = 0;
- for (i = 0; i < logo_clutsize; i++) {
-diff -urNp linux-2.6.32.45/scripts/tags.sh linux-2.6.32.45/scripts/tags.sh
---- linux-2.6.32.45/scripts/tags.sh 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/scripts/tags.sh 2011-06-07 18:06:04.000000000 -0400
-@@ -93,6 +93,11 @@ docscope()
- cscope -b -f cscope.out
- }
-
-+dogtags()
-+{
-+ all_sources | gtags -f -
-+}
-+
- exuberant()
- {
- all_sources | xargs $1 -a \
-@@ -164,6 +169,10 @@ case "$1" in
- docscope
- ;;
-
-+ "gtags")
-+ dogtags
-+ ;;
-+
- "tags")
- rm -f tags
- xtags ctags
-diff -urNp linux-2.6.32.45/security/capability.c linux-2.6.32.45/security/capability.c
---- linux-2.6.32.45/security/capability.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/security/capability.c 2011-04-17 15:56:46.000000000 -0400
-@@ -890,7 +890,7 @@ static void cap_audit_rule_free(void *ls
- }
- #endif /* CONFIG_AUDIT */
-
--struct security_operations default_security_ops = {
-+struct security_operations default_security_ops __read_only = {
- .name = "default",
- };
-
-diff -urNp linux-2.6.32.45/security/commoncap.c linux-2.6.32.45/security/commoncap.c
---- linux-2.6.32.45/security/commoncap.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/security/commoncap.c 2011-08-17 19:22:13.000000000 -0400
-@@ -27,7 +27,7 @@
- #include <linux/sched.h>
- #include <linux/prctl.h>
- #include <linux/securebits.h>
--
-+#include <net/sock.h>
- /*
- * If a non-root user executes a setuid-root binary in
- * !secure(SECURE_NOROOT) mode, then we raise capabilities.
-@@ -50,9 +50,18 @@ static void warn_setuid_and_fcaps_mixed(
- }
- }
-
-+#ifdef CONFIG_NET
-+extern kernel_cap_t gr_cap_rtnetlink(struct sock *sk);
-+#endif
-+
- int cap_netlink_send(struct sock *sk, struct sk_buff *skb)
- {
-+#ifdef CONFIG_NET
-+ NETLINK_CB(skb).eff_cap = gr_cap_rtnetlink(sk);
-+#else
- NETLINK_CB(skb).eff_cap = current_cap();
-+#endif
-+
- return 0;
- }
-
-@@ -582,6 +591,9 @@ int cap_bprm_secureexec(struct linux_bin
- {
- const struct cred *cred = current_cred();
-
-+ if (gr_acl_enable_at_secure())
-+ return 1;
-+
- if (cred->uid != 0) {
- if (bprm->cap_effective)
- return 1;
-diff -urNp linux-2.6.32.45/security/integrity/ima/ima_api.c linux-2.6.32.45/security/integrity/ima/ima_api.c
---- linux-2.6.32.45/security/integrity/ima/ima_api.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/security/integrity/ima/ima_api.c 2011-04-17 15:56:46.000000000 -0400
-@@ -74,7 +74,7 @@ void ima_add_violation(struct inode *ino
- int result;
-
- /* can overflow, only indicator */
-- atomic_long_inc(&ima_htable.violations);
-+ atomic_long_inc_unchecked(&ima_htable.violations);
-
- entry = kmalloc(sizeof(*entry), GFP_KERNEL);
- if (!entry) {
-diff -urNp linux-2.6.32.45/security/integrity/ima/ima_fs.c linux-2.6.32.45/security/integrity/ima/ima_fs.c
---- linux-2.6.32.45/security/integrity/ima/ima_fs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/security/integrity/ima/ima_fs.c 2011-04-17 15:56:46.000000000 -0400
-@@ -27,12 +27,12 @@
- static int valid_policy = 1;
- #define TMPBUFLEN 12
- static ssize_t ima_show_htable_value(char __user *buf, size_t count,
-- loff_t *ppos, atomic_long_t *val)
-+ loff_t *ppos, atomic_long_unchecked_t *val)
- {
- char tmpbuf[TMPBUFLEN];
- ssize_t len;
-
-- len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read(val));
-+ len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read_unchecked(val));
- return simple_read_from_buffer(buf, count, ppos, tmpbuf, len);
- }
-
-diff -urNp linux-2.6.32.45/security/integrity/ima/ima.h linux-2.6.32.45/security/integrity/ima/ima.h
---- linux-2.6.32.45/security/integrity/ima/ima.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/security/integrity/ima/ima.h 2011-04-17 15:56:46.000000000 -0400
-@@ -84,8 +84,8 @@ void ima_add_violation(struct inode *ino
- extern spinlock_t ima_queue_lock;
-
- struct ima_h_table {
-- atomic_long_t len; /* number of stored measurements in the list */
-- atomic_long_t violations;
-+ atomic_long_unchecked_t len; /* number of stored measurements in the list */
-+ atomic_long_unchecked_t violations;
- struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE];
- };
- extern struct ima_h_table ima_htable;
-diff -urNp linux-2.6.32.45/security/integrity/ima/ima_queue.c linux-2.6.32.45/security/integrity/ima/ima_queue.c
---- linux-2.6.32.45/security/integrity/ima/ima_queue.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/security/integrity/ima/ima_queue.c 2011-04-17 15:56:46.000000000 -0400
-@@ -78,7 +78,7 @@ static int ima_add_digest_entry(struct i
- INIT_LIST_HEAD(&qe->later);
- list_add_tail_rcu(&qe->later, &ima_measurements);
-
-- atomic_long_inc(&ima_htable.len);
-+ atomic_long_inc_unchecked(&ima_htable.len);
- key = ima_hash_key(entry->digest);
- hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]);
- return 0;
-diff -urNp linux-2.6.32.45/security/Kconfig linux-2.6.32.45/security/Kconfig
---- linux-2.6.32.45/security/Kconfig 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/security/Kconfig 2011-07-06 19:58:11.000000000 -0400
-@@ -4,6 +4,555 @@
-
- menu "Security options"
-
-+source grsecurity/Kconfig
-+
-+menu "PaX"
-+
-+ config ARCH_TRACK_EXEC_LIMIT
-+ bool
-+
-+ config PAX_PER_CPU_PGD
-+ bool
-+
-+ config TASK_SIZE_MAX_SHIFT
-+ int
-+ depends on X86_64
-+ default 47 if !PAX_PER_CPU_PGD
-+ default 42 if PAX_PER_CPU_PGD
-+
-+ config PAX_ENABLE_PAE
-+ bool
-+ default y if (X86_32 && (MPENTIUM4 || MK8 || MPSC || MCORE2 || MATOM))
-+
-+config PAX
-+ bool "Enable various PaX features"
-+ depends on GRKERNSEC && (ALPHA || ARM || AVR32 || IA64 || MIPS || PARISC || PPC || SPARC || X86)
-+ help
-+ This allows you to enable various PaX features. PaX adds
-+ intrusion prevention mechanisms to the kernel that reduce
-+ the risks posed by exploitable memory corruption bugs.
-+
-+menu "PaX Control"
-+ depends on PAX
-+
-+config PAX_SOFTMODE
-+ bool 'Support soft mode'
-+ select PAX_PT_PAX_FLAGS
-+ help
-+ Enabling this option will allow you to run PaX in soft mode, that
-+ is, PaX features will not be enforced by default, only on executables
-+ marked explicitly. You must also enable PT_PAX_FLAGS support as it
-+ is the only way to mark executables for soft mode use.
-+
-+ Soft mode can be activated by using the "pax_softmode=1" kernel command
-+ line option on boot. Furthermore you can control various PaX features
-+ at runtime via the entries in /proc/sys/kernel/pax.
-+
-+config PAX_EI_PAX
-+ bool 'Use legacy ELF header marking'
-+ help
-+ Enabling this option will allow you to control PaX features on
-+ a per executable basis via the 'chpax' utility available at
-+ http://pax.grsecurity.net/. The control flags will be read from
-+ an otherwise reserved part of the ELF header. This marking has
-+ numerous drawbacks (no support for soft-mode, toolchain does not
-+ know about the non-standard use of the ELF header) therefore it
-+ has been deprecated in favour of PT_PAX_FLAGS support.
-+
-+ Note that if you enable PT_PAX_FLAGS marking support as well,
-+ the PT_PAX_FLAG marks will override the legacy EI_PAX marks.
-+
-+config PAX_PT_PAX_FLAGS
-+ bool 'Use ELF program header marking'
-+ help
-+ Enabling this option will allow you to control PaX features on
-+ a per executable basis via the 'paxctl' utility available at
-+ http://pax.grsecurity.net/. The control flags will be read from
-+ a PaX specific ELF program header (PT_PAX_FLAGS). This marking
-+ has the benefits of supporting both soft mode and being fully
-+ integrated into the toolchain (the binutils patch is available
-+ from http://pax.grsecurity.net).
-+
-+ If your toolchain does not support PT_PAX_FLAGS markings,
-+ you can create one in most cases with 'paxctl -C'.
-+
-+ Note that if you enable the legacy EI_PAX marking support as well,
-+ the EI_PAX marks will be overridden by the PT_PAX_FLAGS marks.
-+
-+choice
-+ prompt 'MAC system integration'
-+ default PAX_HAVE_ACL_FLAGS
-+ help
-+ Mandatory Access Control systems have the option of controlling
-+ PaX flags on a per executable basis, choose the method supported
-+ by your particular system.
-+
-+ - "none": if your MAC system does not interact with PaX,
-+ - "direct": if your MAC system defines pax_set_initial_flags() itself,
-+ - "hook": if your MAC system uses the pax_set_initial_flags_func callback.
-+
-+ NOTE: this option is for developers/integrators only.
-+
-+ config PAX_NO_ACL_FLAGS
-+ bool 'none'
-+
-+ config PAX_HAVE_ACL_FLAGS
-+ bool 'direct'
-+
-+ config PAX_HOOK_ACL_FLAGS
-+ bool 'hook'
-+endchoice
-+
-+endmenu
-+
-+menu "Non-executable pages"
-+ depends on PAX
-+
-+config PAX_NOEXEC
-+ bool "Enforce non-executable pages"
-+ depends on (PAX_EI_PAX || PAX_PT_PAX_FLAGS || PAX_HAVE_ACL_FLAGS || PAX_HOOK_ACL_FLAGS) && (ALPHA || (ARM && (CPU_V6 || CPU_V7)) || IA64 || MIPS || PARISC || PPC || S390 || SPARC || X86)
-+ help
-+ By design some architectures do not allow for protecting memory
-+ pages against execution or even if they do, Linux does not make
-+ use of this feature. In practice this means that if a page is
-+ readable (such as the stack or heap) it is also executable.
-+
-+ There is a well known exploit technique that makes use of this
-+ fact and a common programming mistake where an attacker can
-+ introduce code of his choice somewhere in the attacked program's
-+ memory (typically the stack or the heap) and then execute it.
-+
-+ If the attacked program was running with different (typically
-+ higher) privileges than that of the attacker, then he can elevate
-+ his own privilege level (e.g. get a root shell, write to files for
-+ which he does not have write access to, etc).
-+
-+ Enabling this option will let you choose from various features
-+ that prevent the injection and execution of 'foreign' code in
-+ a program.
-+
-+ This will also break programs that rely on the old behaviour and
-+ expect that dynamically allocated memory via the malloc() family
-+ of functions is executable (which it is not). Notable examples
-+ are the XFree86 4.x server, the java runtime and wine.
-+
-+config PAX_PAGEEXEC
-+ bool "Paging based non-executable pages"
-+ depends on PAX_NOEXEC && (!X86_32 || M586 || M586TSC || M586MMX || M686 || MPENTIUMII || MPENTIUMIII || MPENTIUMM || MCORE2 || MATOM || MPENTIUM4 || MPSC || MK7 || MK8 || MWINCHIPC6 || MWINCHIP2 || MWINCHIP3D || MVIAC3_2 || MVIAC7)
-+ select S390_SWITCH_AMODE if S390
-+ select S390_EXEC_PROTECT if S390
-+ select ARCH_TRACK_EXEC_LIMIT if X86_32
-+ help
-+ This implementation is based on the paging feature of the CPU.
-+ On i386 without hardware non-executable bit support there is a
-+ variable but usually low performance impact, however on Intel's
-+ P4 core based CPUs it is very high so you should not enable this
-+ for kernels meant to be used on such CPUs.
-+
-+ On alpha, avr32, ia64, parisc, sparc, sparc64, x86_64 and i386
-+ with hardware non-executable bit support there is no performance
-+ impact, on ppc the impact is negligible.
-+
-+ Note that several architectures require various emulations due to
-+ badly designed userland ABIs, this will cause a performance impact
-+ but will disappear as soon as userland is fixed. For example, ppc
-+ userland MUST have been built with secure-plt by a recent toolchain.
-+
-+config PAX_SEGMEXEC
-+ bool "Segmentation based non-executable pages"
-+ depends on PAX_NOEXEC && X86_32
-+ help
-+ This implementation is based on the segmentation feature of the
-+ CPU and has a very small performance impact, however applications
-+ will be limited to a 1.5 GB address space instead of the normal
-+ 3 GB.
-+
-+config PAX_EMUTRAMP
-+ bool "Emulate trampolines" if (PAX_PAGEEXEC || PAX_SEGMEXEC) && (PARISC || X86)
-+ default y if PARISC
-+ help
-+ There are some programs and libraries that for one reason or
-+ another attempt to execute special small code snippets from
-+ non-executable memory pages. Most notable examples are the
-+ signal handler return code generated by the kernel itself and
-+ the GCC trampolines.
-+
-+ If you enabled CONFIG_PAX_PAGEEXEC or CONFIG_PAX_SEGMEXEC then
-+ such programs will no longer work under your kernel.
-+
-+ As a remedy you can say Y here and use the 'chpax' or 'paxctl'
-+ utilities to enable trampoline emulation for the affected programs
-+ yet still have the protection provided by the non-executable pages.
-+
-+ On parisc you MUST enable this option and EMUSIGRT as well, otherwise
-+ your system will not even boot.
-+
-+ Alternatively you can say N here and use the 'chpax' or 'paxctl'
-+ utilities to disable CONFIG_PAX_PAGEEXEC and CONFIG_PAX_SEGMEXEC
-+ for the affected files.
-+
-+ NOTE: enabling this feature *may* open up a loophole in the
-+ protection provided by non-executable pages that an attacker
-+ could abuse. Therefore the best solution is to not have any
-+ files on your system that would require this option. This can
-+ be achieved by not using libc5 (which relies on the kernel
-+ signal handler return code) and not using or rewriting programs
-+ that make use of the nested function implementation of GCC.
-+ Skilled users can just fix GCC itself so that it implements
-+ nested function calls in a way that does not interfere with PaX.
-+
-+config PAX_EMUSIGRT
-+ bool "Automatically emulate sigreturn trampolines"
-+ depends on PAX_EMUTRAMP && PARISC
-+ default y
-+ help
-+ Enabling this option will have the kernel automatically detect
-+ and emulate signal return trampolines executing on the stack
-+ that would otherwise lead to task termination.
-+
-+ This solution is intended as a temporary one for users with
-+ legacy versions of libc (libc5, glibc 2.0, uClibc before 0.9.17,
-+ Modula-3 runtime, etc) or executables linked to such, basically
-+ everything that does not specify its own SA_RESTORER function in
-+ normal executable memory like glibc 2.1+ does.
-+
-+ On parisc you MUST enable this option, otherwise your system will
-+ not even boot.
-+
-+ NOTE: this feature cannot be disabled on a per executable basis
-+ and since it *does* open up a loophole in the protection provided
-+ by non-executable pages, the best solution is to not have any
-+ files on your system that would require this option.
-+
-+config PAX_MPROTECT
-+ bool "Restrict mprotect()"
-+ depends on (PAX_PAGEEXEC || PAX_SEGMEXEC)
-+ help
-+ Enabling this option will prevent programs from
-+ - changing the executable status of memory pages that were
-+ not originally created as executable,
-+ - making read-only executable pages writable again,
-+ - creating executable pages from anonymous memory,
-+ - making read-only-after-relocations (RELRO) data pages writable again.
-+
-+ You should say Y here to complete the protection provided by
-+ the enforcement of non-executable pages.
-+
-+ NOTE: you can use the 'chpax' or 'paxctl' utilities to control
-+ this feature on a per file basis.
-+
-+config PAX_MPROTECT_COMPAT
-+ bool "Use legacy/compat protection demoting (read help)"
-+ depends on PAX_MPROTECT
-+ default n
-+ help
-+ The current implementation of PAX_MPROTECT denies RWX allocations/mprotects
-+ by sending the proper error code to the application. For some broken
-+ userland, this can cause problems with Python or other applications. The
-+ current implementation however allows for applications like clamav to
-+ detect if JIT compilation/execution is allowed and to fall back gracefully
-+ to an interpreter-based mode if it does not. While we encourage everyone
-+ to use the current implementation as-is and push upstream to fix broken
-+ userland (note that the RWX logging option can assist with this), in some
-+ environments this may not be possible. Having to disable MPROTECT
-+ completely on certain binaries reduces the security benefit of PaX,
-+ so this option is provided for those environments to revert to the old
-+ behavior.
-+
-+config PAX_ELFRELOCS
-+ bool "Allow ELF text relocations (read help)"
-+ depends on PAX_MPROTECT
-+ default n
-+ help
-+ Non-executable pages and mprotect() restrictions are effective
-+ in preventing the introduction of new executable code into an
-+ attacked task's address space. There remain only two venues
-+ for this kind of attack: if the attacker can execute already
-+ existing code in the attacked task then he can either have it
-+ create and mmap() a file containing his code or have it mmap()
-+ an already existing ELF library that does not have position
-+ independent code in it and use mprotect() on it to make it
-+ writable and copy his code there. While protecting against
-+ the former approach is beyond PaX, the latter can be prevented
-+ by having only PIC ELF libraries on one's system (which do not
-+ need to relocate their code). If you are sure this is your case,
-+ as is the case with all modern Linux distributions, then leave
-+ this option disabled. You should say 'n' here.
-+
-+config PAX_ETEXECRELOCS
-+ bool "Allow ELF ET_EXEC text relocations"
-+ depends on PAX_MPROTECT && (ALPHA || IA64 || PARISC)
-+ select PAX_ELFRELOCS
-+ default y
-+ help
-+ On some architectures there are incorrectly created applications
-+ that require text relocations and would not work without enabling
-+ this option. If you are an alpha, ia64 or parisc user, you should
-+ enable this option and disable it once you have made sure that
-+ none of your applications need it.
-+
-+config PAX_EMUPLT
-+ bool "Automatically emulate ELF PLT"
-+ depends on PAX_MPROTECT && (ALPHA || PARISC || SPARC)
-+ default y
-+ help
-+ Enabling this option will have the kernel automatically detect
-+ and emulate the Procedure Linkage Table entries in ELF files.
-+ On some architectures such entries are in writable memory, and
-+ become non-executable leading to task termination. Therefore
-+ it is mandatory that you enable this option on alpha, parisc,
-+ sparc and sparc64, otherwise your system would not even boot.
-+
-+ NOTE: this feature *does* open up a loophole in the protection
-+ provided by the non-executable pages, therefore the proper
-+ solution is to modify the toolchain to produce a PLT that does
-+ not need to be writable.
-+
-+config PAX_DLRESOLVE
-+ bool 'Emulate old glibc resolver stub'
-+ depends on PAX_EMUPLT && SPARC
-+ default n
-+ help
-+ This option is needed if userland has an old glibc (before 2.4)
-+ that puts a 'save' instruction into the runtime generated resolver
-+ stub that needs special emulation.
-+
-+config PAX_KERNEXEC
-+ bool "Enforce non-executable kernel pages"
-+ depends on PAX_NOEXEC && (PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN
-+ select PAX_PER_CPU_PGD if X86_64 || (X86_32 && X86_PAE)
-+ help
-+ This is the kernel land equivalent of PAGEEXEC and MPROTECT,
-+ that is, enabling this option will make it harder to inject
-+ and execute 'foreign' code in kernel memory itself.
-+
-+ Note that on x86_64 kernels there is a known regression when
-+ this feature and KVM/VMX are both enabled in the host kernel.
-+
-+config PAX_KERNEXEC_MODULE_TEXT
-+ int "Minimum amount of memory reserved for module code"
-+ default "4"
-+ depends on PAX_KERNEXEC && X86_32 && MODULES
-+ help
-+ Due to implementation details the kernel must reserve a fixed
-+ amount of memory for module code at compile time that cannot be
-+ changed at runtime. Here you can specify the minimum amount
-+ in MB that will be reserved. Due to the same implementation
-+ details this size will always be rounded up to the next 2/4 MB
-+ boundary (depends on PAE) so the actually available memory for
-+ module code will usually be more than this minimum.
-+
-+ The default 4 MB should be enough for most users but if you have
-+ an excessive number of modules (e.g., most distribution configs
-+ compile many drivers as modules) or use huge modules such as
-+ nvidia's kernel driver, you will need to adjust this amount.
-+ A good rule of thumb is to look at your currently loaded kernel
-+ modules and add up their sizes.
-+
-+endmenu
-+
-+menu "Address Space Layout Randomization"
-+ depends on PAX
-+
-+config PAX_ASLR
-+ bool "Address Space Layout Randomization"
-+ depends on PAX_EI_PAX || PAX_PT_PAX_FLAGS || PAX_HAVE_ACL_FLAGS || PAX_HOOK_ACL_FLAGS
-+ help
-+ Many if not most exploit techniques rely on the knowledge of
-+ certain addresses in the attacked program. The following options
-+ will allow the kernel to apply a certain amount of randomization
-+ to specific parts of the program thereby forcing an attacker to
-+ guess them in most cases. Any failed guess will most likely crash
-+ the attacked program which allows the kernel to detect such attempts
-+ and react on them. PaX itself provides no reaction mechanisms,
-+ instead it is strongly encouraged that you make use of Nergal's
-+ segvguard (ftp://ftp.pl.openwall.com/misc/segvguard/) or grsecurity's
-+ (http://www.grsecurity.net/) built-in crash detection features or
-+ develop one yourself.
-+
-+ By saying Y here you can choose to randomize the following areas:
-+ - top of the task's kernel stack
-+ - top of the task's userland stack
-+ - base address for mmap() requests that do not specify one
-+ (this includes all libraries)
-+ - base address of the main executable
-+
-+ It is strongly recommended to say Y here as address space layout
-+ randomization has negligible impact on performance yet it provides
-+ a very effective protection.
-+
-+ NOTE: you can use the 'chpax' or 'paxctl' utilities to control
-+ this feature on a per file basis.
-+
-+config PAX_RANDKSTACK
-+ bool "Randomize kernel stack base"
-+ depends on PAX_ASLR && X86_TSC && X86
-+ help
-+ By saying Y here the kernel will randomize every task's kernel
-+ stack on every system call. This will not only force an attacker
-+ to guess it but also prevent him from making use of possible
-+ leaked information about it.
-+
-+ Since the kernel stack is a rather scarce resource, randomization
-+ may cause unexpected stack overflows, therefore you should very
-+ carefully test your system. Note that once enabled in the kernel
-+ configuration, this feature cannot be disabled on a per file basis.
-+
-+config PAX_RANDUSTACK
-+ bool "Randomize user stack base"
-+ depends on PAX_ASLR
-+ help
-+ By saying Y here the kernel will randomize every task's userland
-+ stack. The randomization is done in two steps where the second
-+ one may apply a big amount of shift to the top of the stack and
-+ cause problems for programs that want to use lots of memory (more
-+ than 2.5 GB if SEGMEXEC is not active, or 1.25 GB when it is).
-+ For this reason the second step can be controlled by 'chpax' or
-+ 'paxctl' on a per file basis.
-+
-+config PAX_RANDMMAP
-+ bool "Randomize mmap() base"
-+ depends on PAX_ASLR
-+ help
-+ By saying Y here the kernel will use a randomized base address for
-+ mmap() requests that do not specify one themselves. As a result
-+ all dynamically loaded libraries will appear at random addresses
-+ and therefore be harder to exploit by a technique where an attacker
-+ attempts to execute library code for his purposes (e.g. spawn a
-+ shell from an exploited program that is running at an elevated
-+ privilege level).
-+
-+ Furthermore, if a program is relinked as a dynamic ELF file, its
-+ base address will be randomized as well, completing the full
-+ randomization of the address space layout. Attacking such programs
-+ becomes a guess game. You can find an example of doing this at
-+ http://pax.grsecurity.net/et_dyn.tar.gz and practical samples at
-+ http://www.grsecurity.net/grsec-gcc-specs.tar.gz .
-+
-+ NOTE: you can use the 'chpax' or 'paxctl' utilities to control this
-+ feature on a per file basis.
-+
-+endmenu
-+
-+menu "Miscellaneous hardening features"
-+
-+config PAX_MEMORY_SANITIZE
-+ bool "Sanitize all freed memory"
-+ help
-+ By saying Y here the kernel will erase memory pages as soon as they
-+ are freed. This in turn reduces the lifetime of data stored in the
-+ pages, making it less likely that sensitive information such as
-+ passwords, cryptographic secrets, etc stay in memory for too long.
-+
-+ This is especially useful for programs whose runtime is short, long
-+ lived processes and the kernel itself benefit from this as long as
-+ they operate on whole memory pages and ensure timely freeing of pages
-+ that may hold sensitive information.
-+
-+ The tradeoff is performance impact, on a single CPU system kernel
-+ compilation sees a 3% slowdown, other systems and workloads may vary
-+ and you are advised to test this feature on your expected workload
-+ before deploying it.
-+
-+ Note that this feature does not protect data stored in live pages,
-+ e.g., process memory swapped to disk may stay there for a long time.
-+
-+config PAX_MEMORY_STACKLEAK
-+ bool "Sanitize kernel stack"
-+ depends on X86
-+ help
-+ By saying Y here the kernel will erase the kernel stack before it
-+ returns from a system call. This in turn reduces the information
-+ that a kernel stack leak bug can reveal.
-+
-+ Note that such a bug can still leak information that was put on
-+ the stack by the current system call (the one eventually triggering
-+ the bug) but traces of earlier system calls on the kernel stack
-+ cannot leak anymore.
-+
-+ The tradeoff is performance impact, on a single CPU system kernel
-+ compilation sees a 1% slowdown, other systems and workloads may vary
-+ and you are advised to test this feature on your expected workload
-+ before deploying it.
-+
-+ Note: full support for this feature requires gcc with plugin support
-+ so make sure your compiler is at least gcc 4.5.0 (cross compilation
-+ is not supported). Using older gcc versions means that functions
-+ with large enough stack frames may leave uninitialized memory behind
-+ that may be exposed to a later syscall leaking the stack.
-+
-+config PAX_MEMORY_UDEREF
-+ bool "Prevent invalid userland pointer dereference"
-+ depends on X86 && !UML_X86 && !XEN
-+ select PAX_PER_CPU_PGD if X86_64
-+ help
-+ By saying Y here the kernel will be prevented from dereferencing
-+ userland pointers in contexts where the kernel expects only kernel
-+ pointers. This is both a useful runtime debugging feature and a
-+ security measure that prevents exploiting a class of kernel bugs.
-+
-+ The tradeoff is that some virtualization solutions may experience
-+ a huge slowdown and therefore you should not enable this feature
-+ for kernels meant to run in such environments. Whether a given VM
-+ solution is affected or not is best determined by simply trying it
-+ out, the performance impact will be obvious right on boot as this
-+ mechanism engages from very early on. A good rule of thumb is that
-+ VMs running on CPUs without hardware virtualization support (i.e.,
-+ the majority of IA-32 CPUs) will likely experience the slowdown.
-+
-+config PAX_REFCOUNT
-+ bool "Prevent various kernel object reference counter overflows"
-+ depends on GRKERNSEC && (X86 || SPARC64)
-+ help
-+ By saying Y here the kernel will detect and prevent overflowing
-+ various (but not all) kinds of object reference counters. Such
-+ overflows can normally occur due to bugs only and are often, if
-+ not always, exploitable.
-+
-+ The tradeoff is that data structures protected by an overflowed
-+ refcount will never be freed and therefore will leak memory. Note
-+ that this leak also happens even without this protection but in
-+ that case the overflow can eventually trigger the freeing of the
-+ data structure while it is still being used elsewhere, resulting
-+ in the exploitable situation that this feature prevents.
-+
-+ Since this has a negligible performance impact, you should enable
-+ this feature.
-+
-+config PAX_USERCOPY
-+ bool "Harden heap object copies between kernel and userland"
-+ depends on X86 || PPC || SPARC || ARM
-+ depends on GRKERNSEC && (SLAB || SLUB || SLOB)
-+ help
-+ By saying Y here the kernel will enforce the size of heap objects
-+ when they are copied in either direction between the kernel and
-+ userland, even if only a part of the heap object is copied.
-+
-+ Specifically, this checking prevents information leaking from the
-+ kernel heap during kernel to userland copies (if the kernel heap
-+ object is otherwise fully initialized) and prevents kernel heap
-+ overflows during userland to kernel copies.
-+
-+ Note that the current implementation provides the strictest bounds
-+ checks for the SLUB allocator.
-+
-+ Enabling this option also enables per-slab cache protection against
-+ data in a given cache being copied into/out of via userland
-+ accessors. Though the whitelist of regions will be reduced over
-+ time, it notably protects important data structures like task structs.
-+
-+
-+ If frame pointers are enabled on x86, this option will also
-+ restrict copies into and out of the kernel stack to local variables
-+ within a single frame.
-+
-+ Since this has a negligible performance impact, you should enable
-+ this feature.
-+
-+endmenu
-+
-+endmenu
-+
- config KEYS
- bool "Enable access key retention support"
- help
-@@ -146,7 +695,7 @@ config INTEL_TXT
- config LSM_MMAP_MIN_ADDR
- int "Low address space for LSM to protect from user allocation"
- depends on SECURITY && SECURITY_SELINUX
-- default 65536
-+ default 32768
- help
- This is the portion of low virtual memory which should be protected
- from userspace allocation. Keeping a user from writing to low pages
-diff -urNp linux-2.6.32.45/security/keys/keyring.c linux-2.6.32.45/security/keys/keyring.c
---- linux-2.6.32.45/security/keys/keyring.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/security/keys/keyring.c 2011-04-18 22:03:00.000000000 -0400
-@@ -214,15 +214,15 @@ static long keyring_read(const struct ke
- ret = -EFAULT;
-
- for (loop = 0; loop < klist->nkeys; loop++) {
-+ key_serial_t serial;
- key = klist->keys[loop];
-+ serial = key->serial;
-
- tmp = sizeof(key_serial_t);
- if (tmp > buflen)
- tmp = buflen;
-
-- if (copy_to_user(buffer,
-- &key->serial,
-- tmp) != 0)
-+ if (copy_to_user(buffer, &serial, tmp))
- goto error;
-
- buflen -= tmp;
-diff -urNp linux-2.6.32.45/security/min_addr.c linux-2.6.32.45/security/min_addr.c
---- linux-2.6.32.45/security/min_addr.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/security/min_addr.c 2011-04-17 15:56:46.000000000 -0400
-@@ -14,6 +14,7 @@ unsigned long dac_mmap_min_addr = CONFIG
- */
- static void update_mmap_min_addr(void)
- {
-+#ifndef SPARC
- #ifdef CONFIG_LSM_MMAP_MIN_ADDR
- if (dac_mmap_min_addr > CONFIG_LSM_MMAP_MIN_ADDR)
- mmap_min_addr = dac_mmap_min_addr;
-@@ -22,6 +23,7 @@ static void update_mmap_min_addr(void)
- #else
- mmap_min_addr = dac_mmap_min_addr;
- #endif
-+#endif
- }
-
- /*
-diff -urNp linux-2.6.32.45/security/root_plug.c linux-2.6.32.45/security/root_plug.c
---- linux-2.6.32.45/security/root_plug.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/security/root_plug.c 2011-04-17 15:56:46.000000000 -0400
-@@ -70,7 +70,7 @@ static int rootplug_bprm_check_security
- return 0;
- }
-
--static struct security_operations rootplug_security_ops = {
-+static struct security_operations rootplug_security_ops __read_only = {
- .bprm_check_security = rootplug_bprm_check_security,
- };
-
-diff -urNp linux-2.6.32.45/security/security.c linux-2.6.32.45/security/security.c
---- linux-2.6.32.45/security/security.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/security/security.c 2011-04-17 15:56:46.000000000 -0400
-@@ -24,7 +24,7 @@ static __initdata char chosen_lsm[SECURI
- extern struct security_operations default_security_ops;
- extern void security_fixup_ops(struct security_operations *ops);
-
--struct security_operations *security_ops; /* Initialized to NULL */
-+struct security_operations *security_ops __read_only; /* Initialized to NULL */
-
- static inline int verify(struct security_operations *ops)
- {
-@@ -106,7 +106,7 @@ int __init security_module_enable(struct
- * If there is already a security module registered with the kernel,
- * an error will be returned. Otherwise %0 is returned on success.
- */
--int register_security(struct security_operations *ops)
-+int __init register_security(struct security_operations *ops)
- {
- if (verify(ops)) {
- printk(KERN_DEBUG "%s could not verify "
-diff -urNp linux-2.6.32.45/security/selinux/hooks.c linux-2.6.32.45/security/selinux/hooks.c
---- linux-2.6.32.45/security/selinux/hooks.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/security/selinux/hooks.c 2011-04-17 15:56:46.000000000 -0400
-@@ -131,7 +131,7 @@ int selinux_enabled = 1;
- * Minimal support for a secondary security module,
- * just to allow the use of the capability module.
- */
--static struct security_operations *secondary_ops;
-+static struct security_operations *secondary_ops __read_only;
-
- /* Lists of inode and superblock security structures initialized
- before the policy was loaded. */
-@@ -5457,7 +5457,7 @@ static int selinux_key_getsecurity(struc
-
- #endif
-
--static struct security_operations selinux_ops = {
-+static struct security_operations selinux_ops __read_only = {
- .name = "selinux",
-
- .ptrace_access_check = selinux_ptrace_access_check,
-@@ -5841,7 +5841,9 @@ int selinux_disable(void)
- avc_disable();
-
- /* Reset security_ops to the secondary module, dummy or capability. */
-+ pax_open_kernel();
- security_ops = secondary_ops;
-+ pax_close_kernel();
-
- /* Unregister netfilter hooks. */
- selinux_nf_ip_exit();
-diff -urNp linux-2.6.32.45/security/selinux/include/xfrm.h linux-2.6.32.45/security/selinux/include/xfrm.h
---- linux-2.6.32.45/security/selinux/include/xfrm.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/security/selinux/include/xfrm.h 2011-05-18 20:09:37.000000000 -0400
-@@ -48,7 +48,7 @@ int selinux_xfrm_decode_session(struct s
-
- static inline void selinux_xfrm_notify_policyload(void)
- {
-- atomic_inc(&flow_cache_genid);
-+ atomic_inc_unchecked(&flow_cache_genid);
- }
- #else
- static inline int selinux_xfrm_enabled(void)
-diff -urNp linux-2.6.32.45/security/selinux/ss/services.c linux-2.6.32.45/security/selinux/ss/services.c
---- linux-2.6.32.45/security/selinux/ss/services.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/security/selinux/ss/services.c 2011-05-16 21:46:57.000000000 -0400
-@@ -1715,6 +1715,8 @@ int security_load_policy(void *data, siz
- int rc = 0;
- struct policy_file file = { data, len }, *fp = &file;
-
-+ pax_track_stack();
-+
- if (!ss_initialized) {
- avtab_cache_init();
- if (policydb_read(&policydb, fp)) {
-diff -urNp linux-2.6.32.45/security/smack/smack_lsm.c linux-2.6.32.45/security/smack/smack_lsm.c
---- linux-2.6.32.45/security/smack/smack_lsm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/security/smack/smack_lsm.c 2011-04-17 15:56:46.000000000 -0400
-@@ -3073,7 +3073,7 @@ static int smack_inode_getsecctx(struct
- return 0;
- }
-
--struct security_operations smack_ops = {
-+struct security_operations smack_ops __read_only = {
- .name = "smack",
-
- .ptrace_access_check = smack_ptrace_access_check,
-diff -urNp linux-2.6.32.45/security/tomoyo/tomoyo.c linux-2.6.32.45/security/tomoyo/tomoyo.c
---- linux-2.6.32.45/security/tomoyo/tomoyo.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/security/tomoyo/tomoyo.c 2011-04-17 15:56:46.000000000 -0400
-@@ -275,7 +275,7 @@ static int tomoyo_dentry_open(struct fil
- * tomoyo_security_ops is a "struct security_operations" which is used for
- * registering TOMOYO.
- */
--static struct security_operations tomoyo_security_ops = {
-+static struct security_operations tomoyo_security_ops __read_only = {
- .name = "tomoyo",
- .cred_alloc_blank = tomoyo_cred_alloc_blank,
- .cred_prepare = tomoyo_cred_prepare,
-diff -urNp linux-2.6.32.45/sound/aoa/codecs/onyx.c linux-2.6.32.45/sound/aoa/codecs/onyx.c
---- linux-2.6.32.45/sound/aoa/codecs/onyx.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/sound/aoa/codecs/onyx.c 2011-04-17 15:56:46.000000000 -0400
-@@ -53,7 +53,7 @@ struct onyx {
- spdif_locked:1,
- analog_locked:1,
- original_mute:2;
-- int open_count;
-+ local_t open_count;
- struct codec_info *codec_info;
-
- /* mutex serializes concurrent access to the device
-@@ -752,7 +752,7 @@ static int onyx_open(struct codec_info_i
- struct onyx *onyx = cii->codec_data;
-
- mutex_lock(&onyx->mutex);
-- onyx->open_count++;
-+ local_inc(&onyx->open_count);
- mutex_unlock(&onyx->mutex);
-
- return 0;
-@@ -764,8 +764,7 @@ static int onyx_close(struct codec_info_
- struct onyx *onyx = cii->codec_data;
-
- mutex_lock(&onyx->mutex);
-- onyx->open_count--;
-- if (!onyx->open_count)
-+ if (local_dec_and_test(&onyx->open_count))
- onyx->spdif_locked = onyx->analog_locked = 0;
- mutex_unlock(&onyx->mutex);
-
-diff -urNp linux-2.6.32.45/sound/aoa/codecs/onyx.h linux-2.6.32.45/sound/aoa/codecs/onyx.h
---- linux-2.6.32.45/sound/aoa/codecs/onyx.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/sound/aoa/codecs/onyx.h 2011-04-17 15:56:46.000000000 -0400
-@@ -11,6 +11,7 @@
- #include <linux/i2c.h>
- #include <asm/pmac_low_i2c.h>
- #include <asm/prom.h>
-+#include <asm/local.h>
-
- /* PCM3052 register definitions */
-
-diff -urNp linux-2.6.32.45/sound/core/seq/seq_device.c linux-2.6.32.45/sound/core/seq/seq_device.c
---- linux-2.6.32.45/sound/core/seq/seq_device.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/sound/core/seq/seq_device.c 2011-08-05 20:33:55.000000000 -0400
-@@ -63,7 +63,7 @@ struct ops_list {
- int argsize; /* argument size */
-
- /* operators */
-- struct snd_seq_dev_ops ops;
-+ struct snd_seq_dev_ops *ops;
-
- /* registred devices */
- struct list_head dev_list; /* list of devices */
-@@ -332,7 +332,7 @@ int snd_seq_device_register_driver(char
-
- mutex_lock(&ops->reg_mutex);
- /* copy driver operators */
-- ops->ops = *entry;
-+ ops->ops = entry;
- ops->driver |= DRIVER_LOADED;
- ops->argsize = argsize;
-
-@@ -462,7 +462,7 @@ static int init_device(struct snd_seq_de
- dev->name, ops->id, ops->argsize, dev->argsize);
- return -EINVAL;
- }
-- if (ops->ops.init_device(dev) >= 0) {
-+ if (ops->ops->init_device(dev) >= 0) {
- dev->status = SNDRV_SEQ_DEVICE_REGISTERED;
- ops->num_init_devices++;
- } else {
-@@ -489,7 +489,7 @@ static int free_device(struct snd_seq_de
- dev->name, ops->id, ops->argsize, dev->argsize);
- return -EINVAL;
- }
-- if ((result = ops->ops.free_device(dev)) >= 0 || result == -ENXIO) {
-+ if ((result = ops->ops->free_device(dev)) >= 0 || result == -ENXIO) {
- dev->status = SNDRV_SEQ_DEVICE_FREE;
- dev->driver_data = NULL;
- ops->num_init_devices--;
-diff -urNp linux-2.6.32.45/sound/drivers/mts64.c linux-2.6.32.45/sound/drivers/mts64.c
---- linux-2.6.32.45/sound/drivers/mts64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/sound/drivers/mts64.c 2011-04-17 15:56:46.000000000 -0400
-@@ -27,6 +27,7 @@
- #include <sound/initval.h>
- #include <sound/rawmidi.h>
- #include <sound/control.h>
-+#include <asm/local.h>
-
- #define CARD_NAME "Miditerminal 4140"
- #define DRIVER_NAME "MTS64"
-@@ -65,7 +66,7 @@ struct mts64 {
- struct pardevice *pardev;
- int pardev_claimed;
-
-- int open_count;
-+ local_t open_count;
- int current_midi_output_port;
- int current_midi_input_port;
- u8 mode[MTS64_NUM_INPUT_PORTS];
-@@ -695,7 +696,7 @@ static int snd_mts64_rawmidi_open(struct
- {
- struct mts64 *mts = substream->rmidi->private_data;
-
-- if (mts->open_count == 0) {
-+ if (local_read(&mts->open_count) == 0) {
- /* We don't need a spinlock here, because this is just called
- if the device has not been opened before.
- So there aren't any IRQs from the device */
-@@ -703,7 +704,7 @@ static int snd_mts64_rawmidi_open(struct
-
- msleep(50);
- }
-- ++(mts->open_count);
-+ local_inc(&mts->open_count);
-
- return 0;
- }
-@@ -713,8 +714,7 @@ static int snd_mts64_rawmidi_close(struc
- struct mts64 *mts = substream->rmidi->private_data;
- unsigned long flags;
-
-- --(mts->open_count);
-- if (mts->open_count == 0) {
-+ if (local_dec_return(&mts->open_count) == 0) {
- /* We need the spinlock_irqsave here because we can still
- have IRQs at this point */
- spin_lock_irqsave(&mts->lock, flags);
-@@ -723,8 +723,8 @@ static int snd_mts64_rawmidi_close(struc
-
- msleep(500);
-
-- } else if (mts->open_count < 0)
-- mts->open_count = 0;
-+ } else if (local_read(&mts->open_count) < 0)
-+ local_set(&mts->open_count, 0);
-
- return 0;
- }
-diff -urNp linux-2.6.32.45/sound/drivers/opl4/opl4_lib.c linux-2.6.32.45/sound/drivers/opl4/opl4_lib.c
---- linux-2.6.32.45/sound/drivers/opl4/opl4_lib.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/sound/drivers/opl4/opl4_lib.c 2011-08-05 20:33:55.000000000 -0400
-@@ -27,7 +27,7 @@ MODULE_AUTHOR("Clemens Ladisch <clemens@
- MODULE_DESCRIPTION("OPL4 driver");
- MODULE_LICENSE("GPL");
-
--static void inline snd_opl4_wait(struct snd_opl4 *opl4)
-+static inline void snd_opl4_wait(struct snd_opl4 *opl4)
- {
- int timeout = 10;
- while ((inb(opl4->fm_port) & OPL4_STATUS_BUSY) && --timeout > 0)
-diff -urNp linux-2.6.32.45/sound/drivers/portman2x4.c linux-2.6.32.45/sound/drivers/portman2x4.c
---- linux-2.6.32.45/sound/drivers/portman2x4.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/sound/drivers/portman2x4.c 2011-04-17 15:56:46.000000000 -0400
-@@ -46,6 +46,7 @@
- #include <sound/initval.h>
- #include <sound/rawmidi.h>
- #include <sound/control.h>
-+#include <asm/local.h>
-
- #define CARD_NAME "Portman 2x4"
- #define DRIVER_NAME "portman"
-@@ -83,7 +84,7 @@ struct portman {
- struct pardevice *pardev;
- int pardev_claimed;
-
-- int open_count;
-+ local_t open_count;
- int mode[PORTMAN_NUM_INPUT_PORTS];
- struct snd_rawmidi_substream *midi_input[PORTMAN_NUM_INPUT_PORTS];
- };
-diff -urNp linux-2.6.32.45/sound/isa/cmi8330.c linux-2.6.32.45/sound/isa/cmi8330.c
---- linux-2.6.32.45/sound/isa/cmi8330.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/sound/isa/cmi8330.c 2011-08-05 20:33:55.000000000 -0400
-@@ -455,16 +455,16 @@ static int __devinit snd_cmi8330_pcm(str
-
- /* SB16 */
- ops = snd_sb16dsp_get_pcm_ops(CMI_SB_STREAM);
-- chip->streams[CMI_SB_STREAM].ops = *ops;
-+ memcpy((void *)&chip->streams[CMI_SB_STREAM].ops, ops, sizeof(*ops));
- chip->streams[CMI_SB_STREAM].open = ops->open;
-- chip->streams[CMI_SB_STREAM].ops.open = cmi_open_callbacks[CMI_SB_STREAM];
-+ *(void **)&chip->streams[CMI_SB_STREAM].ops.open = cmi_open_callbacks[CMI_SB_STREAM];
- chip->streams[CMI_SB_STREAM].private_data = chip->sb;
-
- /* AD1848 */
- ops = snd_wss_get_pcm_ops(CMI_AD_STREAM);
-- chip->streams[CMI_AD_STREAM].ops = *ops;
-+ memcpy((void *)&chip->streams[CMI_AD_STREAM].ops, ops, sizeof(*ops));
- chip->streams[CMI_AD_STREAM].open = ops->open;
-- chip->streams[CMI_AD_STREAM].ops.open = cmi_open_callbacks[CMI_AD_STREAM];
-+ *(void **)&chip->streams[CMI_AD_STREAM].ops.open = cmi_open_callbacks[CMI_AD_STREAM];
- chip->streams[CMI_AD_STREAM].private_data = chip->wss;
-
- snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_PLAYBACK, &chip->streams[SNDRV_PCM_STREAM_PLAYBACK].ops);
-diff -urNp linux-2.6.32.45/sound/oss/sb_audio.c linux-2.6.32.45/sound/oss/sb_audio.c
---- linux-2.6.32.45/sound/oss/sb_audio.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/sound/oss/sb_audio.c 2011-04-17 15:56:46.000000000 -0400
-@@ -901,7 +901,7 @@ sb16_copy_from_user(int dev,
- buf16 = (signed short *)(localbuf + localoffs);
- while (c)
- {
-- locallen = (c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
-+ locallen = ((unsigned)c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
- if (copy_from_user(lbuf8,
- userbuf+useroffs + p,
- locallen))
-diff -urNp linux-2.6.32.45/sound/oss/swarm_cs4297a.c linux-2.6.32.45/sound/oss/swarm_cs4297a.c
---- linux-2.6.32.45/sound/oss/swarm_cs4297a.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/sound/oss/swarm_cs4297a.c 2011-04-17 15:56:46.000000000 -0400
-@@ -2577,7 +2577,6 @@ static int __init cs4297a_init(void)
- {
- struct cs4297a_state *s;
- u32 pwr, id;
-- mm_segment_t fs;
- int rval;
- #ifndef CONFIG_BCM_CS4297A_CSWARM
- u64 cfg;
-@@ -2667,22 +2666,23 @@ static int __init cs4297a_init(void)
- if (!rval) {
- char *sb1250_duart_present;
-
-+#if 0
-+ mm_segment_t fs;
- fs = get_fs();
- set_fs(KERNEL_DS);
--#if 0
- val = SOUND_MASK_LINE;
- mixer_ioctl(s, SOUND_MIXER_WRITE_RECSRC, (unsigned long) &val);
- for (i = 0; i < ARRAY_SIZE(initvol); i++) {
- val = initvol[i].vol;
- mixer_ioctl(s, initvol[i].mixch, (unsigned long) &val);
- }
-+ set_fs(fs);
- // cs4297a_write_ac97(s, 0x18, 0x0808);
- #else
- // cs4297a_write_ac97(s, 0x5e, 0x180);
- cs4297a_write_ac97(s, 0x02, 0x0808);
- cs4297a_write_ac97(s, 0x18, 0x0808);
- #endif
-- set_fs(fs);
-
- list_add(&s->list, &cs4297a_devs);
-
-diff -urNp linux-2.6.32.45/sound/pci/ac97/ac97_codec.c linux-2.6.32.45/sound/pci/ac97/ac97_codec.c
---- linux-2.6.32.45/sound/pci/ac97/ac97_codec.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/sound/pci/ac97/ac97_codec.c 2011-04-17 15:56:46.000000000 -0400
-@@ -1952,7 +1952,7 @@ static int snd_ac97_dev_disconnect(struc
- }
-
- /* build_ops to do nothing */
--static struct snd_ac97_build_ops null_build_ops;
-+static const struct snd_ac97_build_ops null_build_ops;
-
- #ifdef CONFIG_SND_AC97_POWER_SAVE
- static void do_update_power(struct work_struct *work)
-diff -urNp linux-2.6.32.45/sound/pci/ac97/ac97_patch.c linux-2.6.32.45/sound/pci/ac97/ac97_patch.c
---- linux-2.6.32.45/sound/pci/ac97/ac97_patch.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/sound/pci/ac97/ac97_patch.c 2011-04-23 12:56:12.000000000 -0400
-@@ -371,7 +371,7 @@ static int patch_yamaha_ymf743_build_spd
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_yamaha_ymf743_ops = {
-+static const struct snd_ac97_build_ops patch_yamaha_ymf743_ops = {
- .build_spdif = patch_yamaha_ymf743_build_spdif,
- .build_3d = patch_yamaha_ymf7x3_3d,
- };
-@@ -455,7 +455,7 @@ static int patch_yamaha_ymf753_post_spdi
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_yamaha_ymf753_ops = {
-+static const struct snd_ac97_build_ops patch_yamaha_ymf753_ops = {
- .build_3d = patch_yamaha_ymf7x3_3d,
- .build_post_spdif = patch_yamaha_ymf753_post_spdif
- };
-@@ -502,7 +502,7 @@ static int patch_wolfson_wm9703_specific
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_wolfson_wm9703_ops = {
-+static const struct snd_ac97_build_ops patch_wolfson_wm9703_ops = {
- .build_specific = patch_wolfson_wm9703_specific,
- };
-
-@@ -533,7 +533,7 @@ static int patch_wolfson_wm9704_specific
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_wolfson_wm9704_ops = {
-+static const struct snd_ac97_build_ops patch_wolfson_wm9704_ops = {
- .build_specific = patch_wolfson_wm9704_specific,
- };
-
-@@ -555,7 +555,7 @@ static int patch_wolfson_wm9705_specific
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_wolfson_wm9705_ops = {
-+static const struct snd_ac97_build_ops patch_wolfson_wm9705_ops = {
- .build_specific = patch_wolfson_wm9705_specific,
- };
-
-@@ -692,7 +692,7 @@ static int patch_wolfson_wm9711_specific
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_wolfson_wm9711_ops = {
-+static const struct snd_ac97_build_ops patch_wolfson_wm9711_ops = {
- .build_specific = patch_wolfson_wm9711_specific,
- };
-
-@@ -886,7 +886,7 @@ static void patch_wolfson_wm9713_resume
- }
- #endif
-
--static struct snd_ac97_build_ops patch_wolfson_wm9713_ops = {
-+static const struct snd_ac97_build_ops patch_wolfson_wm9713_ops = {
- .build_specific = patch_wolfson_wm9713_specific,
- .build_3d = patch_wolfson_wm9713_3d,
- #ifdef CONFIG_PM
-@@ -991,7 +991,7 @@ static int patch_sigmatel_stac97xx_speci
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_sigmatel_stac9700_ops = {
-+static const struct snd_ac97_build_ops patch_sigmatel_stac9700_ops = {
- .build_3d = patch_sigmatel_stac9700_3d,
- .build_specific = patch_sigmatel_stac97xx_specific
- };
-@@ -1038,7 +1038,7 @@ static int patch_sigmatel_stac9708_speci
- return patch_sigmatel_stac97xx_specific(ac97);
- }
-
--static struct snd_ac97_build_ops patch_sigmatel_stac9708_ops = {
-+static const struct snd_ac97_build_ops patch_sigmatel_stac9708_ops = {
- .build_3d = patch_sigmatel_stac9708_3d,
- .build_specific = patch_sigmatel_stac9708_specific
- };
-@@ -1267,7 +1267,7 @@ static int patch_sigmatel_stac9758_speci
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_sigmatel_stac9758_ops = {
-+static const struct snd_ac97_build_ops patch_sigmatel_stac9758_ops = {
- .build_3d = patch_sigmatel_stac9700_3d,
- .build_specific = patch_sigmatel_stac9758_specific
- };
-@@ -1342,7 +1342,7 @@ static int patch_cirrus_build_spdif(stru
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_cirrus_ops = {
-+static const struct snd_ac97_build_ops patch_cirrus_ops = {
- .build_spdif = patch_cirrus_build_spdif
- };
-
-@@ -1399,7 +1399,7 @@ static int patch_conexant_build_spdif(st
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_conexant_ops = {
-+static const struct snd_ac97_build_ops patch_conexant_ops = {
- .build_spdif = patch_conexant_build_spdif
- };
-
-@@ -1575,7 +1575,7 @@ static void patch_ad1881_chained(struct
- }
- }
-
--static struct snd_ac97_build_ops patch_ad1881_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1881_build_ops = {
- #ifdef CONFIG_PM
- .resume = ad18xx_resume
- #endif
-@@ -1662,7 +1662,7 @@ static int patch_ad1885_specific(struct
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_ad1885_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1885_build_ops = {
- .build_specific = &patch_ad1885_specific,
- #ifdef CONFIG_PM
- .resume = ad18xx_resume
-@@ -1689,7 +1689,7 @@ static int patch_ad1886_specific(struct
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_ad1886_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1886_build_ops = {
- .build_specific = &patch_ad1886_specific,
- #ifdef CONFIG_PM
- .resume = ad18xx_resume
-@@ -1896,7 +1896,7 @@ static int patch_ad1981a_specific(struct
- ARRAY_SIZE(snd_ac97_ad1981x_jack_sense));
- }
-
--static struct snd_ac97_build_ops patch_ad1981a_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1981a_build_ops = {
- .build_post_spdif = patch_ad198x_post_spdif,
- .build_specific = patch_ad1981a_specific,
- #ifdef CONFIG_PM
-@@ -1951,7 +1951,7 @@ static int patch_ad1981b_specific(struct
- ARRAY_SIZE(snd_ac97_ad1981x_jack_sense));
- }
-
--static struct snd_ac97_build_ops patch_ad1981b_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1981b_build_ops = {
- .build_post_spdif = patch_ad198x_post_spdif,
- .build_specific = patch_ad1981b_specific,
- #ifdef CONFIG_PM
-@@ -2090,7 +2090,7 @@ static int patch_ad1888_specific(struct
- return patch_build_controls(ac97, snd_ac97_ad1888_controls, ARRAY_SIZE(snd_ac97_ad1888_controls));
- }
-
--static struct snd_ac97_build_ops patch_ad1888_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1888_build_ops = {
- .build_post_spdif = patch_ad198x_post_spdif,
- .build_specific = patch_ad1888_specific,
- #ifdef CONFIG_PM
-@@ -2139,7 +2139,7 @@ static int patch_ad1980_specific(struct
- return patch_build_controls(ac97, &snd_ac97_ad198x_2cmic, 1);
- }
-
--static struct snd_ac97_build_ops patch_ad1980_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1980_build_ops = {
- .build_post_spdif = patch_ad198x_post_spdif,
- .build_specific = patch_ad1980_specific,
- #ifdef CONFIG_PM
-@@ -2254,7 +2254,7 @@ static int patch_ad1985_specific(struct
- ARRAY_SIZE(snd_ac97_ad1985_controls));
- }
-
--static struct snd_ac97_build_ops patch_ad1985_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1985_build_ops = {
- .build_post_spdif = patch_ad198x_post_spdif,
- .build_specific = patch_ad1985_specific,
- #ifdef CONFIG_PM
-@@ -2546,7 +2546,7 @@ static int patch_ad1986_specific(struct
- ARRAY_SIZE(snd_ac97_ad1985_controls));
- }
-
--static struct snd_ac97_build_ops patch_ad1986_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1986_build_ops = {
- .build_post_spdif = patch_ad198x_post_spdif,
- .build_specific = patch_ad1986_specific,
- #ifdef CONFIG_PM
-@@ -2651,7 +2651,7 @@ static int patch_alc650_specific(struct
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_alc650_ops = {
-+static const struct snd_ac97_build_ops patch_alc650_ops = {
- .build_specific = patch_alc650_specific,
- .update_jacks = alc650_update_jacks
- };
-@@ -2803,7 +2803,7 @@ static int patch_alc655_specific(struct
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_alc655_ops = {
-+static const struct snd_ac97_build_ops patch_alc655_ops = {
- .build_specific = patch_alc655_specific,
- .update_jacks = alc655_update_jacks
- };
-@@ -2915,7 +2915,7 @@ static int patch_alc850_specific(struct
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_alc850_ops = {
-+static const struct snd_ac97_build_ops patch_alc850_ops = {
- .build_specific = patch_alc850_specific,
- .update_jacks = alc850_update_jacks
- };
-@@ -2977,7 +2977,7 @@ static int patch_cm9738_specific(struct
- return patch_build_controls(ac97, snd_ac97_cm9738_controls, ARRAY_SIZE(snd_ac97_cm9738_controls));
- }
-
--static struct snd_ac97_build_ops patch_cm9738_ops = {
-+static const struct snd_ac97_build_ops patch_cm9738_ops = {
- .build_specific = patch_cm9738_specific,
- .update_jacks = cm9738_update_jacks
- };
-@@ -3068,7 +3068,7 @@ static int patch_cm9739_post_spdif(struc
- return patch_build_controls(ac97, snd_ac97_cm9739_controls_spdif, ARRAY_SIZE(snd_ac97_cm9739_controls_spdif));
- }
-
--static struct snd_ac97_build_ops patch_cm9739_ops = {
-+static const struct snd_ac97_build_ops patch_cm9739_ops = {
- .build_specific = patch_cm9739_specific,
- .build_post_spdif = patch_cm9739_post_spdif,
- .update_jacks = cm9739_update_jacks
-@@ -3242,7 +3242,7 @@ static int patch_cm9761_specific(struct
- return patch_build_controls(ac97, snd_ac97_cm9761_controls, ARRAY_SIZE(snd_ac97_cm9761_controls));
- }
-
--static struct snd_ac97_build_ops patch_cm9761_ops = {
-+static const struct snd_ac97_build_ops patch_cm9761_ops = {
- .build_specific = patch_cm9761_specific,
- .build_post_spdif = patch_cm9761_post_spdif,
- .update_jacks = cm9761_update_jacks
-@@ -3338,7 +3338,7 @@ static int patch_cm9780_specific(struct
- return patch_build_controls(ac97, cm9780_controls, ARRAY_SIZE(cm9780_controls));
- }
-
--static struct snd_ac97_build_ops patch_cm9780_ops = {
-+static const struct snd_ac97_build_ops patch_cm9780_ops = {
- .build_specific = patch_cm9780_specific,
- .build_post_spdif = patch_cm9761_post_spdif /* identical with CM9761 */
- };
-@@ -3458,7 +3458,7 @@ static int patch_vt1616_specific(struct
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_vt1616_ops = {
-+static const struct snd_ac97_build_ops patch_vt1616_ops = {
- .build_specific = patch_vt1616_specific
- };
-
-@@ -3812,7 +3812,7 @@ static int patch_it2646_specific(struct
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_it2646_ops = {
-+static const struct snd_ac97_build_ops patch_it2646_ops = {
- .build_specific = patch_it2646_specific,
- .update_jacks = it2646_update_jacks
- };
-@@ -3846,7 +3846,7 @@ static int patch_si3036_specific(struct
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_si3036_ops = {
-+static const struct snd_ac97_build_ops patch_si3036_ops = {
- .build_specific = patch_si3036_specific,
- };
-
-@@ -3913,7 +3913,7 @@ static int patch_ucb1400_specific(struct
- return 0;
- }
-
--static struct snd_ac97_build_ops patch_ucb1400_ops = {
-+static const struct snd_ac97_build_ops patch_ucb1400_ops = {
- .build_specific = patch_ucb1400_specific,
- };
-
-diff -urNp linux-2.6.32.45/sound/pci/hda/hda_codec.h linux-2.6.32.45/sound/pci/hda/hda_codec.h
---- linux-2.6.32.45/sound/pci/hda/hda_codec.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/sound/pci/hda/hda_codec.h 2011-08-05 20:33:55.000000000 -0400
-@@ -580,7 +580,7 @@ struct hda_bus_ops {
- /* notify power-up/down from codec to controller */
- void (*pm_notify)(struct hda_bus *bus);
- #endif
--};
-+} __no_const;
-
- /* template to pass to the bus constructor */
- struct hda_bus_template {
-@@ -705,7 +705,7 @@ struct hda_pcm_ops {
- struct snd_pcm_substream *substream);
- int (*cleanup)(struct hda_pcm_stream *info, struct hda_codec *codec,
- struct snd_pcm_substream *substream);
--};
-+} __no_const;
-
- /* PCM information for each substream */
- struct hda_pcm_stream {
-diff -urNp linux-2.6.32.45/sound/pci/hda/hda_generic.c linux-2.6.32.45/sound/pci/hda/hda_generic.c
---- linux-2.6.32.45/sound/pci/hda/hda_generic.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/sound/pci/hda/hda_generic.c 2011-08-05 20:33:55.000000000 -0400
-@@ -1097,7 +1097,7 @@ int snd_hda_parse_generic_codec(struct h
- (err = parse_output(codec)) < 0)
- goto error;
-
-- codec->patch_ops = generic_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &generic_patch_ops, sizeof(generic_patch_ops));
-
- return 0;
-
-diff -urNp linux-2.6.32.45/sound/pci/hda/patch_analog.c linux-2.6.32.45/sound/pci/hda/patch_analog.c
---- linux-2.6.32.45/sound/pci/hda/patch_analog.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/sound/pci/hda/patch_analog.c 2011-08-05 20:33:55.000000000 -0400
-@@ -1069,7 +1069,7 @@ static int patch_ad1986a(struct hda_code
- #endif
- spec->vmaster_nid = 0x1b;
-
-- codec->patch_ops = ad198x_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &ad198x_patch_ops, sizeof(ad198x_patch_ops));
-
- /* override some parameters */
- board_config = snd_hda_check_board_config(codec, AD1986A_MODELS,
-@@ -1120,8 +1120,8 @@ static int patch_ad1986a(struct hda_code
- if (!is_jack_available(codec, 0x25))
- spec->multiout.dig_out_nid = 0;
- spec->input_mux = &ad1986a_automic_capture_source;
-- codec->patch_ops.unsol_event = ad1986a_automic_unsol_event;
-- codec->patch_ops.init = ad1986a_automic_init;
-+ *(void **)&codec->patch_ops.unsol_event = ad1986a_automic_unsol_event;
-+ *(void **)&codec->patch_ops.init = ad1986a_automic_init;
- break;
- case AD1986A_SAMSUNG_P50:
- spec->num_mixers = 2;
-@@ -1137,8 +1137,8 @@ static int patch_ad1986a(struct hda_code
- if (!is_jack_available(codec, 0x25))
- spec->multiout.dig_out_nid = 0;
- spec->input_mux = &ad1986a_automic_capture_source;
-- codec->patch_ops.unsol_event = ad1986a_samsung_p50_unsol_event;
-- codec->patch_ops.init = ad1986a_samsung_p50_init;
-+ *(void **)&codec->patch_ops.unsol_event = ad1986a_samsung_p50_unsol_event;
-+ *(void **)&codec->patch_ops.init = ad1986a_samsung_p50_init;
- break;
- case AD1986A_LAPTOP_AUTOMUTE:
- spec->num_mixers = 3;
-@@ -1154,8 +1154,8 @@ static int patch_ad1986a(struct hda_code
- if (!is_jack_available(codec, 0x25))
- spec->multiout.dig_out_nid = 0;
- spec->input_mux = &ad1986a_laptop_eapd_capture_source;
-- codec->patch_ops.unsol_event = ad1986a_hp_unsol_event;
-- codec->patch_ops.init = ad1986a_hp_init;
-+ *(void **)&codec->patch_ops.unsol_event = ad1986a_hp_unsol_event;
-+ *(void **)&codec->patch_ops.init = ad1986a_hp_init;
- /* Lenovo N100 seems to report the reversed bit
- * for HP jack-sensing
- */
-@@ -1363,7 +1363,7 @@ static int patch_ad1983(struct hda_codec
- #endif
- spec->vmaster_nid = 0x05;
-
-- codec->patch_ops = ad198x_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &ad198x_patch_ops, sizeof(ad198x_patch_ops));
-
- return 0;
- }
-@@ -1769,7 +1769,7 @@ static int patch_ad1981(struct hda_codec
- #endif
- spec->vmaster_nid = 0x05;
-
-- codec->patch_ops = ad198x_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &ad198x_patch_ops, sizeof(ad198x_patch_ops));
-
- /* override some parameters */
- board_config = snd_hda_check_board_config(codec, AD1981_MODELS,
-@@ -1783,8 +1783,8 @@ static int patch_ad1981(struct hda_codec
- spec->multiout.dig_out_nid = 0;
- spec->input_mux = &ad1981_hp_capture_source;
-
-- codec->patch_ops.init = ad1981_hp_init;
-- codec->patch_ops.unsol_event = ad1981_hp_unsol_event;
-+ *(void **)&codec->patch_ops.init = ad1981_hp_init;
-+ *(void **)&codec->patch_ops.unsol_event = ad1981_hp_unsol_event;
- break;
- case AD1981_THINKPAD:
- spec->mixers[0] = ad1981_thinkpad_mixers;
-@@ -1805,8 +1805,8 @@ static int patch_ad1981(struct hda_codec
- spec->init_verbs[1] = ad1981_toshiba_init_verbs;
- spec->multiout.dig_out_nid = 0;
- spec->input_mux = &ad1981_hp_capture_source;
-- codec->patch_ops.init = ad1981_hp_init;
-- codec->patch_ops.unsol_event = ad1981_hp_unsol_event;
-+ *(void **)&codec->patch_ops.init = ad1981_hp_init;
-+ *(void **)&codec->patch_ops.unsol_event = ad1981_hp_unsol_event;
- break;
- }
- return 0;
-@@ -3096,14 +3096,14 @@ static int patch_ad1988(struct hda_codec
- if (spec->dig_in_nid && codec->vendor_id < 0x11d4989a)
- spec->mixers[spec->num_mixers++] = ad1988_spdif_in_mixers;
-
-- codec->patch_ops = ad198x_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &ad198x_patch_ops, sizeof(ad198x_patch_ops));
- switch (board_config) {
- case AD1988_AUTO:
-- codec->patch_ops.init = ad1988_auto_init;
-+ *(void **)&codec->patch_ops.init = ad1988_auto_init;
- break;
- case AD1988_LAPTOP:
- case AD1988_LAPTOP_DIG:
-- codec->patch_ops.unsol_event = ad1988_laptop_unsol_event;
-+ *(void **)&codec->patch_ops.unsol_event = ad1988_laptop_unsol_event;
- break;
- }
- #ifdef CONFIG_SND_HDA_POWER_SAVE
-@@ -3321,7 +3321,7 @@ static int patch_ad1884(struct hda_codec
- /* we need to cover all playback volumes */
- spec->slave_vols = ad1884_slave_vols;
-
-- codec->patch_ops = ad198x_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &ad198x_patch_ops, sizeof(ad198x_patch_ops));
-
- return 0;
- }
-@@ -3529,7 +3529,7 @@ static int patch_ad1984(struct hda_codec
- case AD1984_BASIC:
- /* additional digital mics */
- spec->mixers[spec->num_mixers++] = ad1984_dmic_mixers;
-- codec->patch_ops.build_pcms = ad1984_build_pcms;
-+ *(void **)&codec->patch_ops.build_pcms = ad1984_build_pcms;
- break;
- case AD1984_THINKPAD:
- spec->multiout.dig_out_nid = AD1884_SPDIF_OUT;
-@@ -4229,7 +4229,7 @@ static int patch_ad1884a(struct hda_code
- #ifdef CONFIG_SND_HDA_POWER_SAVE
- spec->loopback.amplist = ad1884a_loopbacks;
- #endif
-- codec->patch_ops = ad198x_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &ad198x_patch_ops, sizeof(ad198x_patch_ops));
-
- /* override some parameters */
- board_config = snd_hda_check_board_config(codec, AD1884A_MODELS,
-@@ -4240,8 +4240,8 @@ static int patch_ad1884a(struct hda_code
- spec->mixers[0] = ad1884a_laptop_mixers;
- spec->init_verbs[spec->num_init_verbs++] = ad1884a_laptop_verbs;
- spec->multiout.dig_out_nid = 0;
-- codec->patch_ops.unsol_event = ad1884a_laptop_unsol_event;
-- codec->patch_ops.init = ad1884a_laptop_init;
-+ *(void **)&codec->patch_ops.unsol_event = ad1884a_laptop_unsol_event;
-+ *(void **)&codec->patch_ops.init = ad1884a_laptop_init;
- /* set the upper-limit for mixer amp to 0dB for avoiding the
- * possible damage by overloading
- */
-@@ -4255,8 +4255,8 @@ static int patch_ad1884a(struct hda_code
- spec->mixers[0] = ad1884a_mobile_mixers;
- spec->init_verbs[0] = ad1884a_mobile_verbs;
- spec->multiout.dig_out_nid = 0;
-- codec->patch_ops.unsol_event = ad1884a_hp_unsol_event;
-- codec->patch_ops.init = ad1884a_hp_init;
-+ *(void **)&codec->patch_ops.unsol_event = ad1884a_hp_unsol_event;
-+ *(void **)&codec->patch_ops.init = ad1884a_hp_init;
- /* set the upper-limit for mixer amp to 0dB for avoiding the
- * possible damage by overloading
- */
-@@ -4272,15 +4272,15 @@ static int patch_ad1884a(struct hda_code
- ad1984a_thinkpad_verbs;
- spec->multiout.dig_out_nid = 0;
- spec->input_mux = &ad1984a_thinkpad_capture_source;
-- codec->patch_ops.unsol_event = ad1984a_thinkpad_unsol_event;
-- codec->patch_ops.init = ad1984a_thinkpad_init;
-+ *(void **)&codec->patch_ops.unsol_event = ad1984a_thinkpad_unsol_event;
-+ *(void **)&codec->patch_ops.init = ad1984a_thinkpad_init;
- break;
- case AD1984A_TOUCHSMART:
- spec->mixers[0] = ad1984a_touchsmart_mixers;
- spec->init_verbs[0] = ad1984a_touchsmart_verbs;
- spec->multiout.dig_out_nid = 0;
-- codec->patch_ops.unsol_event = ad1984a_touchsmart_unsol_event;
-- codec->patch_ops.init = ad1984a_touchsmart_init;
-+ *(void **)&codec->patch_ops.unsol_event = ad1984a_touchsmart_unsol_event;
-+ *(void **)&codec->patch_ops.init = ad1984a_touchsmart_init;
- /* set the upper-limit for mixer amp to 0dB for avoiding the
- * possible damage by overloading
- */
-@@ -4607,7 +4607,7 @@ static int patch_ad1882(struct hda_codec
- #endif
- spec->vmaster_nid = 0x04;
-
-- codec->patch_ops = ad198x_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &ad198x_patch_ops, sizeof(ad198x_patch_ops));
-
- /* override some parameters */
- board_config = snd_hda_check_board_config(codec, AD1882_MODELS,
-diff -urNp linux-2.6.32.45/sound/pci/hda/patch_atihdmi.c linux-2.6.32.45/sound/pci/hda/patch_atihdmi.c
---- linux-2.6.32.45/sound/pci/hda/patch_atihdmi.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/sound/pci/hda/patch_atihdmi.c 2011-08-05 20:33:55.000000000 -0400
-@@ -177,7 +177,7 @@ static int patch_atihdmi(struct hda_code
- */
- spec->multiout.dig_out_nid = CVT_NID;
-
-- codec->patch_ops = atihdmi_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &atihdmi_patch_ops, sizeof(atihdmi_patch_ops));
-
- return 0;
- }
-diff -urNp linux-2.6.32.45/sound/pci/hda/patch_ca0110.c linux-2.6.32.45/sound/pci/hda/patch_ca0110.c
---- linux-2.6.32.45/sound/pci/hda/patch_ca0110.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/sound/pci/hda/patch_ca0110.c 2011-08-05 20:33:55.000000000 -0400
-@@ -525,7 +525,7 @@ static int patch_ca0110(struct hda_codec
- if (err < 0)
- goto error;
-
-- codec->patch_ops = ca0110_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &ca0110_patch_ops, sizeof(ca0110_patch_ops));
-
- return 0;
-
-diff -urNp linux-2.6.32.45/sound/pci/hda/patch_cirrus.c linux-2.6.32.45/sound/pci/hda/patch_cirrus.c
---- linux-2.6.32.45/sound/pci/hda/patch_cirrus.c 2011-05-10 22:12:02.000000000 -0400
-+++ linux-2.6.32.45/sound/pci/hda/patch_cirrus.c 2011-08-05 20:33:55.000000000 -0400
-@@ -1191,7 +1191,7 @@ static int patch_cs420x(struct hda_codec
- if (err < 0)
- goto error;
-
-- codec->patch_ops = cs_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &cs_patch_ops, sizeof(cs_patch_ops));
-
- return 0;
-
-diff -urNp linux-2.6.32.45/sound/pci/hda/patch_cmedia.c linux-2.6.32.45/sound/pci/hda/patch_cmedia.c
---- linux-2.6.32.45/sound/pci/hda/patch_cmedia.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/sound/pci/hda/patch_cmedia.c 2011-08-05 20:33:55.000000000 -0400
-@@ -728,7 +728,7 @@ static int patch_cmi9880(struct hda_code
-
- spec->adc_nids = cmi9880_adc_nids;
-
-- codec->patch_ops = cmi9880_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &cmi9880_patch_ops, sizeof(cmi9880_patch_ops));
-
- return 0;
- }
-diff -urNp linux-2.6.32.45/sound/pci/hda/patch_conexant.c linux-2.6.32.45/sound/pci/hda/patch_conexant.c
---- linux-2.6.32.45/sound/pci/hda/patch_conexant.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/sound/pci/hda/patch_conexant.c 2011-08-05 20:33:55.000000000 -0400
-@@ -1119,55 +1119,55 @@ static int patch_cxt5045(struct hda_code
- spec->channel_mode = cxt5045_modes,
-
-
-- codec->patch_ops = conexant_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &conexant_patch_ops, sizeof(conexant_patch_ops));
-
- board_config = snd_hda_check_board_config(codec, CXT5045_MODELS,
- cxt5045_models,
- cxt5045_cfg_tbl);
- switch (board_config) {
- case CXT5045_LAPTOP_HPSENSE:
-- codec->patch_ops.unsol_event = cxt5045_hp_unsol_event;
-+ *(void **)&codec->patch_ops.unsol_event = cxt5045_hp_unsol_event;
- spec->input_mux = &cxt5045_capture_source;
- spec->num_init_verbs = 2;
- spec->init_verbs[1] = cxt5045_hp_sense_init_verbs;
- spec->mixers[0] = cxt5045_mixers;
-- codec->patch_ops.init = cxt5045_init;
-+ *(void **)&codec->patch_ops.init = cxt5045_init;
- break;
- case CXT5045_LAPTOP_MICSENSE:
-- codec->patch_ops.unsol_event = cxt5045_hp_unsol_event;
-+ *(void **)&codec->patch_ops.unsol_event = cxt5045_hp_unsol_event;
- spec->input_mux = &cxt5045_capture_source;
- spec->num_init_verbs = 2;
- spec->init_verbs[1] = cxt5045_mic_sense_init_verbs;
- spec->mixers[0] = cxt5045_mixers;
-- codec->patch_ops.init = cxt5045_init;
-+ *(void **)&codec->patch_ops.init = cxt5045_init;
- break;
- default:
- case CXT5045_LAPTOP_HPMICSENSE:
-- codec->patch_ops.unsol_event = cxt5045_hp_unsol_event;
-+ *(void **)&codec->patch_ops.unsol_event = cxt5045_hp_unsol_event;
- spec->input_mux = &cxt5045_capture_source;
- spec->num_init_verbs = 3;
- spec->init_verbs[1] = cxt5045_hp_sense_init_verbs;
- spec->init_verbs[2] = cxt5045_mic_sense_init_verbs;
- spec->mixers[0] = cxt5045_mixers;
-- codec->patch_ops.init = cxt5045_init;
-+ *(void **)&codec->patch_ops.init = cxt5045_init;
- break;
- case CXT5045_BENQ:
-- codec->patch_ops.unsol_event = cxt5045_hp_unsol_event;
-+ *(void **)&codec->patch_ops.unsol_event = cxt5045_hp_unsol_event;
- spec->input_mux = &cxt5045_capture_source_benq;
- spec->num_init_verbs = 1;
- spec->init_verbs[0] = cxt5045_benq_init_verbs;
- spec->mixers[0] = cxt5045_mixers;
- spec->mixers[1] = cxt5045_benq_mixers;
- spec->num_mixers = 2;
-- codec->patch_ops.init = cxt5045_init;
-+ *(void **)&codec->patch_ops.init = cxt5045_init;
- break;
- case CXT5045_LAPTOP_HP530:
-- codec->patch_ops.unsol_event = cxt5045_hp_unsol_event;
-+ *(void **)&codec->patch_ops.unsol_event = cxt5045_hp_unsol_event;
- spec->input_mux = &cxt5045_capture_source_hp530;
- spec->num_init_verbs = 2;
- spec->init_verbs[1] = cxt5045_hp_sense_init_verbs;
- spec->mixers[0] = cxt5045_mixers_hp530;
-- codec->patch_ops.init = cxt5045_init;
-+ *(void **)&codec->patch_ops.init = cxt5045_init;
- break;
- #ifdef CONFIG_SND_DEBUG
- case CXT5045_TEST:
-@@ -1556,7 +1556,7 @@ static int patch_cxt5047(struct hda_code
- spec->num_channel_mode = ARRAY_SIZE(cxt5047_modes),
- spec->channel_mode = cxt5047_modes,
-
-- codec->patch_ops = conexant_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &conexant_patch_ops, sizeof(conexant_patch_ops));
-
- board_config = snd_hda_check_board_config(codec, CXT5047_MODELS,
- cxt5047_models,
-@@ -1565,13 +1565,13 @@ static int patch_cxt5047(struct hda_code
- case CXT5047_LAPTOP:
- spec->num_mixers = 2;
- spec->mixers[1] = cxt5047_hp_spk_mixers;
-- codec->patch_ops.unsol_event = cxt5047_hp_unsol_event;
-+ *(void **)&codec->patch_ops.unsol_event = cxt5047_hp_unsol_event;
- break;
- case CXT5047_LAPTOP_HP:
- spec->num_mixers = 2;
- spec->mixers[1] = cxt5047_hp_only_mixers;
-- codec->patch_ops.unsol_event = cxt5047_hp_unsol_event;
-- codec->patch_ops.init = cxt5047_hp_init;
-+ *(void **)&codec->patch_ops.unsol_event = cxt5047_hp_unsol_event;
-+ *(void **)&codec->patch_ops.init = cxt5047_hp_init;
- break;
- case CXT5047_LAPTOP_EAPD:
- spec->input_mux = &cxt5047_toshiba_capture_source;
-@@ -1579,14 +1579,14 @@ static int patch_cxt5047(struct hda_code
- spec->mixers[1] = cxt5047_hp_spk_mixers;
- spec->num_init_verbs = 2;
- spec->init_verbs[1] = cxt5047_toshiba_init_verbs;
-- codec->patch_ops.unsol_event = cxt5047_hp_unsol_event;
-+ *(void **)&codec->patch_ops.unsol_event = cxt5047_hp_unsol_event;
- break;
- #ifdef CONFIG_SND_DEBUG
- case CXT5047_TEST:
- spec->input_mux = &cxt5047_test_capture_source;
- spec->mixers[0] = cxt5047_test_mixer;
- spec->init_verbs[0] = cxt5047_test_init_verbs;
-- codec->patch_ops.unsol_event = cxt5047_hp_unsol_event;
-+ *(void **)&codec->patch_ops.unsol_event = cxt5047_hp_unsol_event;
- #endif
- }
- spec->vmaster_nid = 0x13;
-@@ -1904,8 +1904,8 @@ static int patch_cxt5051(struct hda_code
- codec->spec = spec;
- codec->pin_amp_workaround = 1;
-
-- codec->patch_ops = conexant_patch_ops;
-- codec->patch_ops.init = cxt5051_init;
-+ memcpy((void *)&codec->patch_ops, &conexant_patch_ops, sizeof(conexant_patch_ops));
-+ *(void **)&codec->patch_ops.init = cxt5051_init;
-
- spec->multiout.max_channels = 2;
- spec->multiout.num_dacs = ARRAY_SIZE(cxt5051_dac_nids);
-@@ -1923,7 +1923,7 @@ static int patch_cxt5051(struct hda_code
- spec->cur_adc = 0;
- spec->cur_adc_idx = 0;
-
-- codec->patch_ops.unsol_event = cxt5051_hp_unsol_event;
-+ *(void **)&codec->patch_ops.unsol_event = cxt5051_hp_unsol_event;
-
- board_config = snd_hda_check_board_config(codec, CXT5051_MODELS,
- cxt5051_models,
-@@ -2372,8 +2372,8 @@ static int patch_cxt5066(struct hda_code
- return -ENOMEM;
- codec->spec = spec;
-
-- codec->patch_ops = conexant_patch_ops;
-- codec->patch_ops.init = cxt5066_init;
-+ memcpy((void *)&codec->patch_ops, &conexant_patch_ops, sizeof(conexant_patch_ops));
-+ *(void **)&codec->patch_ops.init = cxt5066_init;
-
- spec->dell_automute = 0;
- spec->multiout.max_channels = 2;
-@@ -2413,7 +2413,7 @@ static int patch_cxt5066(struct hda_code
- spec->dell_automute = 1;
- break;
- case CXT5066_OLPC_XO_1_5:
-- codec->patch_ops.unsol_event = cxt5066_unsol_event;
-+ *(void **)&codec->patch_ops.unsol_event = cxt5066_unsol_event;
- spec->init_verbs[0] = cxt5066_init_verbs_olpc;
- spec->mixers[spec->num_mixers++] = cxt5066_mixer_master_olpc;
- spec->mixers[spec->num_mixers++] = cxt5066_mixers;
-diff -urNp linux-2.6.32.45/sound/pci/hda/patch_intelhdmi.c linux-2.6.32.45/sound/pci/hda/patch_intelhdmi.c
---- linux-2.6.32.45/sound/pci/hda/patch_intelhdmi.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/sound/pci/hda/patch_intelhdmi.c 2011-08-05 20:33:55.000000000 -0400
-@@ -511,10 +511,10 @@ static void hdmi_non_intrinsic_event(str
- cp_ready);
-
- /* TODO */
-- if (cp_state)
-- ;
-- if (cp_ready)
-- ;
-+ if (cp_state) {
-+ }
-+ if (cp_ready) {
-+ }
- }
-
-
-@@ -656,7 +656,7 @@ static int do_patch_intel_hdmi(struct hd
- spec->multiout.dig_out_nid = cvt_nid;
-
- codec->spec = spec;
-- codec->patch_ops = intel_hdmi_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &intel_hdmi_patch_ops, sizeof(intel_hdmi_patch_ops));
-
- snd_hda_eld_proc_new(codec, &spec->sink_eld);
-
-diff -urNp linux-2.6.32.45/sound/pci/hda/patch_nvhdmi.c linux-2.6.32.45/sound/pci/hda/patch_nvhdmi.c
---- linux-2.6.32.45/sound/pci/hda/patch_nvhdmi.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/sound/pci/hda/patch_nvhdmi.c 2011-08-05 20:33:55.000000000 -0400
-@@ -367,7 +367,7 @@ static int patch_nvhdmi_8ch(struct hda_c
- spec->multiout.max_channels = 8;
- spec->multiout.dig_out_nid = Nv_Master_Convert_nid;
-
-- codec->patch_ops = nvhdmi_patch_ops_8ch;
-+ memcpy((void *)&codec->patch_ops, &nvhdmi_patch_ops_8ch, sizeof(nvhdmi_patch_ops_8ch));
-
- return 0;
- }
-@@ -386,7 +386,7 @@ static int patch_nvhdmi_2ch(struct hda_c
- spec->multiout.max_channels = 2;
- spec->multiout.dig_out_nid = Nv_Master_Convert_nid;
-
-- codec->patch_ops = nvhdmi_patch_ops_2ch;
-+ memcpy((void *)&codec->patch_ops, &nvhdmi_patch_ops_2ch, sizeof(nvhdmi_patch_ops_2ch));
-
- return 0;
- }
-diff -urNp linux-2.6.32.45/sound/pci/hda/patch_realtek.c linux-2.6.32.45/sound/pci/hda/patch_realtek.c
---- linux-2.6.32.45/sound/pci/hda/patch_realtek.c 2011-06-25 12:55:35.000000000 -0400
-+++ linux-2.6.32.45/sound/pci/hda/patch_realtek.c 2011-08-05 20:33:55.000000000 -0400
-@@ -4856,7 +4856,7 @@ static int patch_alc880(struct hda_codec
-
- spec->vmaster_nid = 0x0c;
-
-- codec->patch_ops = alc_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &alc_patch_ops, sizeof(alc_patch_ops));
- if (board_config == ALC880_AUTO)
- spec->init_hook = alc880_auto_init;
- #ifdef CONFIG_SND_HDA_POWER_SAVE
-@@ -6479,7 +6479,7 @@ static int patch_alc260(struct hda_codec
-
- spec->vmaster_nid = 0x08;
-
-- codec->patch_ops = alc_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &alc_patch_ops, sizeof(alc_patch_ops));
- if (board_config == ALC260_AUTO)
- spec->init_hook = alc260_auto_init;
- #ifdef CONFIG_SND_HDA_POWER_SAVE
-@@ -9997,7 +9997,7 @@ static int patch_alc882(struct hda_codec
-
- spec->vmaster_nid = 0x0c;
-
-- codec->patch_ops = alc_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &alc_patch_ops, sizeof(alc_patch_ops));
- if (board_config == ALC882_AUTO)
- spec->init_hook = alc882_auto_init;
- #ifdef CONFIG_SND_HDA_POWER_SAVE
-@@ -11871,7 +11871,7 @@ static int patch_alc262(struct hda_codec
-
- spec->vmaster_nid = 0x0c;
-
-- codec->patch_ops = alc_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &alc_patch_ops, sizeof(alc_patch_ops));
- if (board_config == ALC262_AUTO)
- spec->init_hook = alc262_auto_init;
- #ifdef CONFIG_SND_HDA_POWER_SAVE
-@@ -12950,7 +12950,7 @@ static int patch_alc268(struct hda_codec
-
- spec->vmaster_nid = 0x02;
-
-- codec->patch_ops = alc_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &alc_patch_ops, sizeof(alc_patch_ops));
- if (board_config == ALC268_AUTO)
- spec->init_hook = alc268_auto_init;
-
-@@ -13636,7 +13636,7 @@ static int patch_alc269(struct hda_codec
-
- spec->vmaster_nid = 0x02;
-
-- codec->patch_ops = alc_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &alc_patch_ops, sizeof(alc_patch_ops));
- if (board_config == ALC269_AUTO)
- spec->init_hook = alc269_auto_init;
- #ifdef CONFIG_SND_HDA_POWER_SAVE
-@@ -14741,7 +14741,7 @@ static int patch_alc861(struct hda_codec
-
- spec->vmaster_nid = 0x03;
-
-- codec->patch_ops = alc_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &alc_patch_ops, sizeof(alc_patch_ops));
- if (board_config == ALC861_AUTO)
- spec->init_hook = alc861_auto_init;
- #ifdef CONFIG_SND_HDA_POWER_SAVE
-@@ -15727,7 +15727,7 @@ static int patch_alc861vd(struct hda_cod
-
- spec->vmaster_nid = 0x02;
-
-- codec->patch_ops = alc_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &alc_patch_ops, sizeof(alc_patch_ops));
-
- if (board_config == ALC861VD_AUTO)
- spec->init_hook = alc861vd_auto_init;
-@@ -17652,7 +17652,7 @@ static int patch_alc662(struct hda_codec
-
- spec->vmaster_nid = 0x02;
-
-- codec->patch_ops = alc_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &alc_patch_ops, sizeof(alc_patch_ops));
- if (board_config == ALC662_AUTO)
- spec->init_hook = alc662_auto_init;
- #ifdef CONFIG_SND_HDA_POWER_SAVE
-diff -urNp linux-2.6.32.45/sound/pci/hda/patch_si3054.c linux-2.6.32.45/sound/pci/hda/patch_si3054.c
---- linux-2.6.32.45/sound/pci/hda/patch_si3054.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/sound/pci/hda/patch_si3054.c 2011-08-05 20:33:55.000000000 -0400
-@@ -275,7 +275,7 @@ static int patch_si3054(struct hda_codec
- if (spec == NULL)
- return -ENOMEM;
- codec->spec = spec;
-- codec->patch_ops = si3054_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &si3054_patch_ops, sizeof(si3054_patch_ops));
- return 0;
- }
-
-diff -urNp linux-2.6.32.45/sound/pci/hda/patch_sigmatel.c linux-2.6.32.45/sound/pci/hda/patch_sigmatel.c
---- linux-2.6.32.45/sound/pci/hda/patch_sigmatel.c 2011-06-25 12:55:35.000000000 -0400
-+++ linux-2.6.32.45/sound/pci/hda/patch_sigmatel.c 2011-08-05 20:33:55.000000000 -0400
-@@ -4899,7 +4899,7 @@ static int patch_stac9200(struct hda_cod
- if (spec->board_config == STAC_9200_PANASONIC)
- spec->hp_detect = 0;
-
-- codec->patch_ops = stac92xx_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &stac92xx_patch_ops, sizeof(stac92xx_patch_ops));
-
- return 0;
- }
-@@ -4981,7 +4981,7 @@ static int patch_stac925x(struct hda_cod
- return err;
- }
-
-- codec->patch_ops = stac92xx_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &stac92xx_patch_ops, sizeof(stac92xx_patch_ops));
-
- return 0;
- }
-@@ -5125,7 +5125,7 @@ again:
- if (spec->board_config == STAC_92HD73XX_NO_JD)
- spec->hp_detect = 0;
-
-- codec->patch_ops = stac92xx_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &stac92xx_patch_ops, sizeof(stac92xx_patch_ops));
-
- codec->proc_widget_hook = stac92hd7x_proc_hook;
-
-@@ -5220,7 +5220,7 @@ again:
- snd_hda_codec_write_cache(codec, nid, 0,
- AC_VERB_SET_CONNECT_SEL, num_dacs);
-
-- codec->patch_ops = stac92xx_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &stac92xx_patch_ops, sizeof(stac92xx_patch_ops));
-
- codec->proc_widget_hook = stac92hd_proc_hook;
-
-@@ -5294,7 +5294,7 @@ static int patch_stac92hd71bxx(struct hd
- return -ENOMEM;
-
- codec->spec = spec;
-- codec->patch_ops = stac92xx_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &stac92xx_patch_ops, sizeof(stac92xx_patch_ops));
- spec->num_pins = STAC92HD71BXX_NUM_PINS;
- switch (codec->vendor_id) {
- case 0x111d76b6:
-@@ -5515,7 +5515,7 @@ again:
- spec->gpio_dir |= spec->gpio_led;
- spec->gpio_data |= spec->gpio_led;
- /* register check_power_status callback. */
-- codec->patch_ops.check_power_status =
-+ *(void **)&codec->patch_ops.check_power_status =
- stac92xx_hp_check_power_status;
- }
- #endif
-@@ -5634,7 +5634,7 @@ static int patch_stac922x(struct hda_cod
- return err;
- }
-
-- codec->patch_ops = stac92xx_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &stac92xx_patch_ops, sizeof(stac92xx_patch_ops));
-
- /* Fix Mux capture level; max to 2 */
- snd_hda_override_amp_caps(codec, 0x12, HDA_OUTPUT,
-@@ -5757,7 +5757,7 @@ static int patch_stac927x(struct hda_cod
- return err;
- }
-
-- codec->patch_ops = stac92xx_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &stac92xx_patch_ops, sizeof(stac92xx_patch_ops));
-
- codec->proc_widget_hook = stac927x_proc_hook;
-
-@@ -5880,7 +5880,7 @@ static int patch_stac9205(struct hda_cod
- return err;
- }
-
-- codec->patch_ops = stac92xx_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &stac92xx_patch_ops, sizeof(stac92xx_patch_ops));
-
- codec->proc_widget_hook = stac9205_proc_hook;
-
-@@ -5974,7 +5974,7 @@ static int patch_stac9872(struct hda_cod
- return -EINVAL;
- }
- spec->input_mux = &spec->private_imux;
-- codec->patch_ops = stac92xx_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &stac92xx_patch_ops, sizeof(stac92xx_patch_ops));
- return 0;
- }
-
-diff -urNp linux-2.6.32.45/sound/pci/hda/patch_via.c linux-2.6.32.45/sound/pci/hda/patch_via.c
---- linux-2.6.32.45/sound/pci/hda/patch_via.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/sound/pci/hda/patch_via.c 2011-08-05 20:33:55.000000000 -0400
-@@ -1399,9 +1399,9 @@ static int patch_vt1708(struct hda_codec
- spec->num_mixers++;
- }
-
-- codec->patch_ops = via_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &via_patch_ops, sizeof(via_patch_ops));
-
-- codec->patch_ops.init = via_auto_init;
-+ *(void **)&codec->patch_ops.init = via_auto_init;
- #ifdef CONFIG_SND_HDA_POWER_SAVE
- spec->loopback.amplist = vt1708_loopbacks;
- #endif
-@@ -1870,10 +1870,10 @@ static int patch_vt1709_10ch(struct hda_
- spec->num_mixers++;
- }
-
-- codec->patch_ops = via_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &via_patch_ops, sizeof(via_patch_ops));
-
-- codec->patch_ops.init = via_auto_init;
-- codec->patch_ops.unsol_event = via_unsol_event;
-+ *(void **)&codec->patch_ops.init = via_auto_init;
-+ *(void **)&codec->patch_ops.unsol_event = via_unsol_event;
- #ifdef CONFIG_SND_HDA_POWER_SAVE
- spec->loopback.amplist = vt1709_loopbacks;
- #endif
-@@ -1964,10 +1964,10 @@ static int patch_vt1709_6ch(struct hda_c
- spec->num_mixers++;
- }
-
-- codec->patch_ops = via_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &via_patch_ops, sizeof(via_patch_ops));
-
-- codec->patch_ops.init = via_auto_init;
-- codec->patch_ops.unsol_event = via_unsol_event;
-+ *(void **)&codec->patch_ops.init = via_auto_init;
-+ *(void **)&codec->patch_ops.unsol_event = via_unsol_event;
- #ifdef CONFIG_SND_HDA_POWER_SAVE
- spec->loopback.amplist = vt1709_loopbacks;
- #endif
-@@ -2418,10 +2418,10 @@ static int patch_vt1708B_8ch(struct hda_
- spec->num_mixers++;
- }
-
-- codec->patch_ops = via_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &via_patch_ops, sizeof(via_patch_ops));
-
-- codec->patch_ops.init = via_auto_init;
-- codec->patch_ops.unsol_event = via_unsol_event;
-+ *(void **)&codec->patch_ops.init = via_auto_init;
-+ *(void **)&codec->patch_ops.unsol_event = via_unsol_event;
- #ifdef CONFIG_SND_HDA_POWER_SAVE
- spec->loopback.amplist = vt1708B_loopbacks;
- #endif
-@@ -2470,10 +2470,10 @@ static int patch_vt1708B_4ch(struct hda_
- spec->num_mixers++;
- }
-
-- codec->patch_ops = via_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &via_patch_ops, sizeof(via_patch_ops));
-
-- codec->patch_ops.init = via_auto_init;
-- codec->patch_ops.unsol_event = via_unsol_event;
-+ *(void **)&codec->patch_ops.init = via_auto_init;
-+ *(void **)&codec->patch_ops.unsol_event = via_unsol_event;
- #ifdef CONFIG_SND_HDA_POWER_SAVE
- spec->loopback.amplist = vt1708B_loopbacks;
- #endif
-@@ -2905,10 +2905,10 @@ static int patch_vt1708S(struct hda_code
- spec->num_mixers++;
- }
-
-- codec->patch_ops = via_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &via_patch_ops, sizeof(via_patch_ops));
-
-- codec->patch_ops.init = via_auto_init;
-- codec->patch_ops.unsol_event = via_unsol_event;
-+ *(void **)&codec->patch_ops.init = via_auto_init;
-+ *(void **)&codec->patch_ops.unsol_event = via_unsol_event;
- #ifdef CONFIG_SND_HDA_POWER_SAVE
- spec->loopback.amplist = vt1708S_loopbacks;
- #endif
-@@ -3223,10 +3223,10 @@ static int patch_vt1702(struct hda_codec
- spec->num_mixers++;
- }
-
-- codec->patch_ops = via_patch_ops;
-+ memcpy((void *)&codec->patch_ops, &via_patch_ops, sizeof(via_patch_ops));
-
-- codec->patch_ops.init = via_auto_init;
-- codec->patch_ops.unsol_event = via_unsol_event;
-+ *(void **)&codec->patch_ops.init = via_auto_init;
-+ *(void **)&codec->patch_ops.unsol_event = via_unsol_event;
- #ifdef CONFIG_SND_HDA_POWER_SAVE
- spec->loopback.amplist = vt1702_loopbacks;
- #endif
-diff -urNp linux-2.6.32.45/sound/pci/ice1712/ice1712.h linux-2.6.32.45/sound/pci/ice1712/ice1712.h
---- linux-2.6.32.45/sound/pci/ice1712/ice1712.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/sound/pci/ice1712/ice1712.h 2011-08-05 20:33:55.000000000 -0400
-@@ -269,7 +269,7 @@ struct snd_ak4xxx_private {
- unsigned int mask_flags; /* total mask bits */
- struct snd_akm4xxx_ops {
- void (*set_rate_val)(struct snd_akm4xxx *ak, unsigned int rate);
-- } ops;
-+ } __no_const ops;
- };
-
- struct snd_ice1712_spdif {
-@@ -285,7 +285,7 @@ struct snd_ice1712_spdif {
- int (*default_put)(struct snd_ice1712 *, struct snd_ctl_elem_value *ucontrol);
- void (*stream_get)(struct snd_ice1712 *, struct snd_ctl_elem_value *ucontrol);
- int (*stream_put)(struct snd_ice1712 *, struct snd_ctl_elem_value *ucontrol);
-- } ops;
-+ } __no_const ops;
- };
-
-
-diff -urNp linux-2.6.32.45/sound/pci/intel8x0m.c linux-2.6.32.45/sound/pci/intel8x0m.c
---- linux-2.6.32.45/sound/pci/intel8x0m.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/sound/pci/intel8x0m.c 2011-04-23 12:56:12.000000000 -0400
-@@ -1264,7 +1264,7 @@ static struct shortname_table {
- { 0x5455, "ALi M5455" },
- { 0x746d, "AMD AMD8111" },
- #endif
-- { 0 },
-+ { 0, },
- };
-
- static int __devinit snd_intel8x0m_probe(struct pci_dev *pci,
-diff -urNp linux-2.6.32.45/sound/pci/ymfpci/ymfpci_main.c linux-2.6.32.45/sound/pci/ymfpci/ymfpci_main.c
---- linux-2.6.32.45/sound/pci/ymfpci/ymfpci_main.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/sound/pci/ymfpci/ymfpci_main.c 2011-05-04 17:56:28.000000000 -0400
-@@ -202,8 +202,8 @@ static void snd_ymfpci_hw_stop(struct sn
- if ((snd_ymfpci_readl(chip, YDSXGR_STATUS) & 2) == 0)
- break;
- }
-- if (atomic_read(&chip->interrupt_sleep_count)) {
-- atomic_set(&chip->interrupt_sleep_count, 0);
-+ if (atomic_read_unchecked(&chip->interrupt_sleep_count)) {
-+ atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
- wake_up(&chip->interrupt_sleep);
- }
- __end:
-@@ -787,7 +787,7 @@ static void snd_ymfpci_irq_wait(struct s
- continue;
- init_waitqueue_entry(&wait, current);
- add_wait_queue(&chip->interrupt_sleep, &wait);
-- atomic_inc(&chip->interrupt_sleep_count);
-+ atomic_inc_unchecked(&chip->interrupt_sleep_count);
- schedule_timeout_uninterruptible(msecs_to_jiffies(50));
- remove_wait_queue(&chip->interrupt_sleep, &wait);
- }
-@@ -825,8 +825,8 @@ static irqreturn_t snd_ymfpci_interrupt(
- snd_ymfpci_writel(chip, YDSXGR_MODE, mode);
- spin_unlock(&chip->reg_lock);
-
-- if (atomic_read(&chip->interrupt_sleep_count)) {
-- atomic_set(&chip->interrupt_sleep_count, 0);
-+ if (atomic_read_unchecked(&chip->interrupt_sleep_count)) {
-+ atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
- wake_up(&chip->interrupt_sleep);
- }
- }
-@@ -2369,7 +2369,7 @@ int __devinit snd_ymfpci_create(struct s
- spin_lock_init(&chip->reg_lock);
- spin_lock_init(&chip->voice_lock);
- init_waitqueue_head(&chip->interrupt_sleep);
-- atomic_set(&chip->interrupt_sleep_count, 0);
-+ atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
- chip->card = card;
- chip->pci = pci;
- chip->irq = -1;
-diff -urNp linux-2.6.32.45/sound/soc/soc-core.c linux-2.6.32.45/sound/soc/soc-core.c
---- linux-2.6.32.45/sound/soc/soc-core.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/sound/soc/soc-core.c 2011-08-05 20:33:55.000000000 -0400
-@@ -1107,13 +1107,13 @@ static int soc_new_pcm(struct snd_soc_de
-
- dai_link->pcm = pcm;
- pcm->private_data = rtd;
-- soc_pcm_ops.mmap = platform->pcm_ops->mmap;
-- soc_pcm_ops.pointer = platform->pcm_ops->pointer;
-- soc_pcm_ops.ioctl = platform->pcm_ops->ioctl;
-- soc_pcm_ops.copy = platform->pcm_ops->copy;
-- soc_pcm_ops.silence = platform->pcm_ops->silence;
-- soc_pcm_ops.ack = platform->pcm_ops->ack;
-- soc_pcm_ops.page = platform->pcm_ops->page;
-+ *(void **)&soc_pcm_ops.mmap = platform->pcm_ops->mmap;
-+ *(void **)&soc_pcm_ops.pointer = platform->pcm_ops->pointer;
-+ *(void **)&soc_pcm_ops.ioctl = platform->pcm_ops->ioctl;
-+ *(void **)&soc_pcm_ops.copy = platform->pcm_ops->copy;
-+ *(void **)&soc_pcm_ops.silence = platform->pcm_ops->silence;
-+ *(void **)&soc_pcm_ops.ack = platform->pcm_ops->ack;
-+ *(void **)&soc_pcm_ops.page = platform->pcm_ops->page;
-
- if (playback)
- snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_PLAYBACK, &soc_pcm_ops);
-diff -urNp linux-2.6.32.45/sound/usb/usbaudio.c linux-2.6.32.45/sound/usb/usbaudio.c
---- linux-2.6.32.45/sound/usb/usbaudio.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/sound/usb/usbaudio.c 2011-08-05 20:33:55.000000000 -0400
-@@ -963,12 +963,12 @@ static int snd_usb_pcm_playback_trigger(
- switch (cmd) {
- case SNDRV_PCM_TRIGGER_START:
- case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
-- subs->ops.prepare = prepare_playback_urb;
-+ *(void **)&subs->ops.prepare = prepare_playback_urb;
- return 0;
- case SNDRV_PCM_TRIGGER_STOP:
- return deactivate_urbs(subs, 0, 0);
- case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
-- subs->ops.prepare = prepare_nodata_playback_urb;
-+ *(void **)&subs->ops.prepare = prepare_nodata_playback_urb;
- return 0;
- default:
- return -EINVAL;
-@@ -985,15 +985,15 @@ static int snd_usb_pcm_capture_trigger(s
-
- switch (cmd) {
- case SNDRV_PCM_TRIGGER_START:
-- subs->ops.retire = retire_capture_urb;
-+ *(void **)&subs->ops.retire = retire_capture_urb;
- return start_urbs(subs, substream->runtime);
- case SNDRV_PCM_TRIGGER_STOP:
- return deactivate_urbs(subs, 0, 0);
- case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
-- subs->ops.retire = retire_paused_capture_urb;
-+ *(void **)&subs->ops.retire = retire_paused_capture_urb;
- return 0;
- case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
-- subs->ops.retire = retire_capture_urb;
-+ *(void **)&subs->ops.retire = retire_capture_urb;
- return 0;
- default:
- return -EINVAL;
-@@ -1542,7 +1542,7 @@ static int snd_usb_pcm_prepare(struct sn
- /* for playback, submit the URBs now; otherwise, the first hwptr_done
- * updates for all URBs would happen at the same time when starting */
- if (subs->direction == SNDRV_PCM_STREAM_PLAYBACK) {
-- subs->ops.prepare = prepare_nodata_playback_urb;
-+ *(void **)&subs->ops.prepare = prepare_nodata_playback_urb;
- return start_urbs(subs, runtime);
- } else
- return 0;
-@@ -2228,14 +2228,14 @@ static void init_substream(struct snd_us
- subs->direction = stream;
- subs->dev = as->chip->dev;
- if (snd_usb_get_speed(subs->dev) == USB_SPEED_FULL) {
-- subs->ops = audio_urb_ops[stream];
-+ memcpy((void *)&subs->ops, &audio_urb_ops[stream], sizeof(subs->ops));
- } else {
-- subs->ops = audio_urb_ops_high_speed[stream];
-+ memcpy((void *)&subs->ops, &audio_urb_ops_high_speed[stream], sizeof(subs->ops));
- switch (as->chip->usb_id) {
- case USB_ID(0x041e, 0x3f02): /* E-Mu 0202 USB */
- case USB_ID(0x041e, 0x3f04): /* E-Mu 0404 USB */
- case USB_ID(0x041e, 0x3f0a): /* E-Mu Tracker Pre */
-- subs->ops.retire_sync = retire_playback_sync_urb_hs_emu;
-+ *(void **)&subs->ops.retire_sync = retire_playback_sync_urb_hs_emu;
- break;
- }
- }
-diff -urNp linux-2.6.32.45/tools/gcc/constify_plugin.c linux-2.6.32.45/tools/gcc/constify_plugin.c
---- linux-2.6.32.45/tools/gcc/constify_plugin.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/tools/gcc/constify_plugin.c 2011-08-11 19:12:51.000000000 -0400
-@@ -0,0 +1,189 @@
-+/*
-+ * Copyright 2011 by Emese Revfy <re.emese@gmail.com>
-+ * Licensed under the GPL v2, or (at your option) v3
-+ *
-+ * This gcc plugin constifies all structures which contain only function pointers and const fields.
-+ *
-+ * Usage:
-+ * $ gcc -I`gcc -print-file-name=plugin`/include -fPIC -shared -O2 -o constify_plugin.so constify_plugin.c
-+ * $ gcc -fplugin=constify_plugin.so test.c -O2
-+ */
-+
-+#include "gcc-plugin.h"
-+#include "config.h"
-+#include "system.h"
-+#include "coretypes.h"
-+#include "tree.h"
-+#include "tree-pass.h"
-+#include "intl.h"
-+#include "plugin-version.h"
-+#include "tm.h"
-+#include "toplev.h"
-+#include "function.h"
-+#include "tree-flow.h"
-+#include "plugin.h"
-+
-+int plugin_is_GPL_compatible;
-+
-+static struct plugin_info const_plugin_info = {
-+ .version = "20110721",
-+ .help = "no-constify\tturn off constification\n",
-+};
-+
-+static bool walk_struct(tree node);
-+
-+static void deconstify_node(tree node)
-+{
-+ tree field;
-+
-+ for (field = TYPE_FIELDS(node); field; field = TREE_CHAIN(field)) {
-+ enum tree_code code = TREE_CODE(TREE_TYPE(field));
-+ if (code == RECORD_TYPE || code == UNION_TYPE)
-+ deconstify_node(TREE_TYPE(field));
-+ TREE_READONLY(field) = 0;
-+ TREE_READONLY(TREE_TYPE(field)) = 0;
-+ }
-+}
-+
-+static tree handle_no_const_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
-+{
-+ if (TREE_CODE(*node) == FUNCTION_DECL) {
-+ error("%qE attribute does not apply to functions", name);
-+ *no_add_attrs = true;
-+ return NULL_TREE;
-+ }
-+
-+ if (DECL_P(*node) && lookup_attribute("no_const", TYPE_ATTRIBUTES(TREE_TYPE(*node)))) {
-+ error("%qE attribute is already applied to the type" , name);
-+ *no_add_attrs = true;
-+ return NULL_TREE;
-+ }
-+
-+ if (TREE_CODE(*node) == TYPE_DECL && !TREE_READONLY(TREE_TYPE(*node))) {
-+ error("%qE attribute used on type that is not constified" , name);
-+ *no_add_attrs = true;
-+ return NULL_TREE;
-+ }
-+
-+ if (TREE_CODE(*node) == TYPE_DECL) {
-+ tree chain = TREE_CHAIN(TREE_TYPE(*node));
-+ TREE_TYPE(*node) = copy_node(TREE_TYPE(*node));
-+ TREE_CHAIN(TREE_TYPE(*node)) = copy_list(chain);
-+ TREE_READONLY(TREE_TYPE(*node)) = 0;
-+ deconstify_node(TREE_TYPE(*node));
-+ return NULL_TREE;
-+ }
-+
-+ return NULL_TREE;
-+}
-+
-+static struct attribute_spec no_const_attr = {
-+ .name = "no_const",
-+ .min_length = 0,
-+ .max_length = 0,
-+ .decl_required = false,
-+ .type_required = false,
-+ .function_type_required = false,
-+ .handler = handle_no_const_attribute
-+};
-+
-+static void register_attributes(void *event_data, void *data)
-+{
-+ register_attribute(&no_const_attr);
-+}
-+
-+/*
-+static void printnode(char *prefix, tree node)
-+{
-+ enum tree_code code;
-+ enum tree_code_class tclass;
-+
-+ tclass = TREE_CODE_CLASS(TREE_CODE (node));
-+
-+ code = TREE_CODE(node);
-+ fprintf(stderr, "\n%s node: %p, code: %d type: %s\n", prefix, node, code, tree_code_name[(int)code]);
-+ if (DECL_CONTEXT(node) != NULL_TREE && TYPE_NAME(DECL_CONTEXT(node)) != NULL_TREE)
-+ fprintf(stderr, "struct name: %s\n", IDENTIFIER_POINTER(TYPE_NAME(DECL_CONTEXT(node))));
-+ if (tclass == tcc_declaration && DECL_NAME(node) != NULL_TREE)
-+ fprintf(stderr, "field name: %s\n", IDENTIFIER_POINTER(DECL_NAME(node)));
-+}
-+*/
-+
-+static void constify_node(tree node)
-+{
-+ TREE_READONLY(node) = 1;
-+}
-+
-+static bool is_fptr(tree field)
-+{
-+ tree ptr = TREE_TYPE(field);
-+
-+ if (TREE_CODE(ptr) != POINTER_TYPE)
-+ return false;
-+
-+ return TREE_CODE(TREE_TYPE(ptr)) == FUNCTION_TYPE;
-+}
-+
-+static bool walk_struct(tree node)
-+{
-+ tree field;
-+
-+ for (field = TYPE_FIELDS(node); field; field = TREE_CHAIN(field)) {
-+ enum tree_code code = TREE_CODE(TREE_TYPE(field));
-+ if (code == RECORD_TYPE || code == UNION_TYPE) {
-+ if (!(walk_struct(TREE_TYPE(field))))
-+ return false;
-+ } else if (is_fptr(field) == false && !TREE_READONLY(field))
-+ return false;
-+ }
-+ return true;
-+}
-+
-+static void finish_type(void *event_data, void *data)
-+{
-+ tree node = (tree)event_data;
-+
-+ if (node == NULL_TREE)
-+ return;
-+
-+ if (lookup_attribute("no_const", TYPE_ATTRIBUTES(node)))
-+ return;
-+
-+ if (TREE_READONLY(node))
-+ return;
-+
-+ if (TYPE_FIELDS(node) == NULL_TREE)
-+ return;
-+
-+ if (walk_struct(node))
-+ constify_node(node);
-+}
-+
-+int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
-+{
-+ const char * const plugin_name = plugin_info->base_name;
-+ const int argc = plugin_info->argc;
-+ const struct plugin_argument * const argv = plugin_info->argv;
-+ int i;
-+ bool constify = true;
-+
-+ if (!plugin_default_version_check(version, &gcc_version)) {
-+ error(G_("incompatible gcc/plugin versions"));
-+ return 1;
-+ }
-+
-+ for (i = 0; i < argc; ++i) {
-+ if (!(strcmp(argv[i].key, "no-constify"))) {
-+ constify = false;
-+ continue;
-+ }
-+ error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
-+ }
-+
-+ register_callback(plugin_name, PLUGIN_INFO, NULL, &const_plugin_info);
-+ if (constify)
-+ register_callback(plugin_name, PLUGIN_FINISH_TYPE, finish_type, NULL);
-+ register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
-+
-+ return 0;
-+}
-Binary files linux-2.6.32.45/tools/gcc/constify_plugin.so and linux-2.6.32.45/tools/gcc/constify_plugin.so differ
-diff -urNp linux-2.6.32.45/tools/gcc/Makefile linux-2.6.32.45/tools/gcc/Makefile
---- linux-2.6.32.45/tools/gcc/Makefile 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/tools/gcc/Makefile 2011-08-05 20:33:55.000000000 -0400
-@@ -0,0 +1,12 @@
-+#CC := gcc
-+#PLUGIN_SOURCE_FILES := pax_plugin.c
-+#PLUGIN_OBJECT_FILES := $(patsubst %.c,%.o,$(PLUGIN_SOURCE_FILES))
-+GCCPLUGINS_DIR := $(shell $(HOSTCC) -print-file-name=plugin)
-+#CFLAGS += -I$(GCCPLUGINS_DIR)/include -fPIC -O2 -Wall -W
-+
-+HOST_EXTRACFLAGS += -I$(GCCPLUGINS_DIR)/include
-+
-+hostlibs-y := stackleak_plugin.so constify_plugin.so
-+always := $(hostlibs-y)
-+stackleak_plugin-objs := stackleak_plugin.o
-+constify_plugin-objs := constify_plugin.o
-Binary files linux-2.6.32.45/tools/gcc/pax_plugin.so and linux-2.6.32.45/tools/gcc/pax_plugin.so differ
-diff -urNp linux-2.6.32.45/tools/gcc/stackleak_plugin.c linux-2.6.32.45/tools/gcc/stackleak_plugin.c
---- linux-2.6.32.45/tools/gcc/stackleak_plugin.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.45/tools/gcc/stackleak_plugin.c 2011-08-05 20:33:55.000000000 -0400
-@@ -0,0 +1,243 @@
-+/*
-+ * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
-+ * Licensed under the GPL v2
-+ *
-+ * Note: the choice of the license means that the compilation process is
-+ * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
-+ * but for the kernel it doesn't matter since it doesn't link against
-+ * any of the gcc libraries
-+ *
-+ * gcc plugin to help implement various PaX features
-+ *
-+ * - track lowest stack pointer
-+ *
-+ * TODO:
-+ * - initialize all local variables
-+ *
-+ * BUGS:
-+ * - cloned functions are instrumented twice
-+ */
-+#include "gcc-plugin.h"
-+#include "plugin-version.h"
-+#include "config.h"
-+#include "system.h"
-+#include "coretypes.h"
-+#include "tm.h"
-+#include "toplev.h"
-+#include "basic-block.h"
-+#include "gimple.h"
-+//#include "expr.h" where are you...
-+#include "diagnostic.h"
-+#include "rtl.h"
-+#include "emit-rtl.h"
-+#include "function.h"
-+#include "tree.h"
-+#include "tree-pass.h"
-+#include "intl.h"
-+
-+int plugin_is_GPL_compatible;
-+
-+static int track_frame_size = -1;
-+static const char track_function[] = "pax_track_stack";
-+static bool init_locals;
-+
-+static struct plugin_info stackleak_plugin_info = {
-+ .version = "201106030000",
-+ .help = "track-lowest-sp=nn\ttrack sp in functions whose frame size is at least nn bytes\n"
-+// "initialize-locals\t\tforcibly initialize all stack frames\n"
-+};
-+
-+static bool gate_stackleak_track_stack(void);
-+static unsigned int execute_stackleak_tree_instrument(void);
-+static unsigned int execute_stackleak_final(void);
-+
-+static struct gimple_opt_pass stackleak_tree_instrument_pass = {
-+ .pass = {
-+ .type = GIMPLE_PASS,
-+ .name = "stackleak_tree_instrument",
-+ .gate = gate_stackleak_track_stack,
-+ .execute = execute_stackleak_tree_instrument,
-+ .sub = NULL,
-+ .next = NULL,
-+ .static_pass_number = 0,
-+ .tv_id = TV_NONE,
-+ .properties_required = PROP_gimple_leh | PROP_cfg,
-+ .properties_provided = 0,
-+ .properties_destroyed = 0,
-+ .todo_flags_start = 0, //TODO_verify_ssa | TODO_verify_flow | TODO_verify_stmts,
-+ .todo_flags_finish = TODO_verify_stmts // | TODO_dump_func
-+ }
-+};
-+
-+static struct rtl_opt_pass stackleak_final_rtl_opt_pass = {
-+ .pass = {
-+ .type = RTL_PASS,
-+ .name = "stackleak_final",
-+ .gate = gate_stackleak_track_stack,
-+ .execute = execute_stackleak_final,
-+ .sub = NULL,
-+ .next = NULL,
-+ .static_pass_number = 0,
-+ .tv_id = TV_NONE,
-+ .properties_required = 0,
-+ .properties_provided = 0,
-+ .properties_destroyed = 0,
-+ .todo_flags_start = 0,
-+ .todo_flags_finish = 0
-+ }
-+};
-+
-+static bool gate_stackleak_track_stack(void)
-+{
-+ return track_frame_size >= 0;
-+}
-+
-+static void stackleak_add_instrumentation(gimple_stmt_iterator *gsi, bool before)
-+{
-+ gimple call;
-+ tree decl, type;
-+
-+ // insert call to void pax_track_stack(void)
-+ type = build_function_type_list(void_type_node, NULL_TREE);
-+ decl = build_fn_decl(track_function, type);
-+ DECL_ASSEMBLER_NAME(decl); // for LTO
-+ call = gimple_build_call(decl, 0);
-+ if (before)
-+ gsi_insert_before(gsi, call, GSI_CONTINUE_LINKING);
-+ else
-+ gsi_insert_after(gsi, call, GSI_CONTINUE_LINKING);
-+}
-+
-+static unsigned int execute_stackleak_tree_instrument(void)
-+{
-+ basic_block bb;
-+ gimple_stmt_iterator gsi;
-+
-+ // 1. loop through BBs and GIMPLE statements
-+ FOR_EACH_BB(bb) {
-+ for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
-+ // gimple match: align 8 built-in BUILT_IN_NORMAL:BUILT_IN_ALLOCA attributes <tree_list 0xb7576450>
-+ tree decl;
-+ gimple stmt = gsi_stmt(gsi);
-+
-+ if (!is_gimple_call(stmt))
-+ continue;
-+ decl = gimple_call_fndecl(stmt);
-+ if (!decl)
-+ continue;
-+ if (TREE_CODE(decl) != FUNCTION_DECL)
-+ continue;
-+ if (!DECL_BUILT_IN(decl))
-+ continue;
-+ if (DECL_BUILT_IN_CLASS(decl) != BUILT_IN_NORMAL)
-+ continue;
-+ if (DECL_FUNCTION_CODE(decl) != BUILT_IN_ALLOCA)
-+ continue;
-+
-+ // 2. insert track call after each __builtin_alloca call
-+ stackleak_add_instrumentation(&gsi, false);
-+// print_node(stderr, "pax", decl, 4);
-+ }
-+ }
-+
-+ // 3. insert track call at the beginning
-+ bb = ENTRY_BLOCK_PTR_FOR_FUNCTION(cfun)->next_bb;
-+ gsi = gsi_start_bb(bb);
-+ stackleak_add_instrumentation(&gsi, true);
-+
-+ return 0;
-+}
-+
-+static unsigned int execute_stackleak_final(void)
-+{
-+ rtx insn;
-+
-+ if (cfun->calls_alloca)
-+ return 0;
-+
-+ // 1. find pax_track_stack calls
-+ for (insn = get_insns(); insn; insn = NEXT_INSN(insn)) {
-+ // rtl match: (call_insn 8 7 9 3 (call (mem (symbol_ref ("pax_track_stack") [flags 0x41] <function_decl 0xb7470e80 pax_track_stack>) [0 S1 A8]) (4)) -1 (nil) (nil))
-+ rtx body;
-+
-+ if (!CALL_P(insn))
-+ continue;
-+ body = PATTERN(insn);
-+ if (GET_CODE(body) != CALL)
-+ continue;
-+ body = XEXP(body, 0);
-+ if (GET_CODE(body) != MEM)
-+ continue;
-+ body = XEXP(body, 0);
-+ if (GET_CODE(body) != SYMBOL_REF)
-+ continue;
-+ if (strcmp(XSTR(body, 0), track_function))
-+ continue;
-+// warning(0, "track_frame_size: %d %ld %d", cfun->calls_alloca, get_frame_size(), track_frame_size);
-+ // 2. delete call if function frame is not big enough
-+ if (get_frame_size() >= track_frame_size)
-+ continue;
-+ delete_insn_and_edges(insn);
-+ }
-+
-+// print_simple_rtl(stderr, get_insns());
-+// print_rtl(stderr, get_insns());
-+// warning(0, "track_frame_size: %d %ld %d", cfun->calls_alloca, get_frame_size(), track_frame_size);
-+
-+ return 0;
-+}
-+
-+int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
-+{
-+ const char * const plugin_name = plugin_info->base_name;
-+ const int argc = plugin_info->argc;
-+ const struct plugin_argument * const argv = plugin_info->argv;
-+ int i;
-+ struct register_pass_info stackleak_tree_instrument_pass_info = {
-+ .pass = &stackleak_tree_instrument_pass.pass,
-+// .reference_pass_name = "tree_profile",
-+ .reference_pass_name = "optimized",
-+ .ref_pass_instance_number = 0,
-+ .pos_op = PASS_POS_INSERT_AFTER
-+ };
-+ struct register_pass_info stackleak_final_pass_info = {
-+ .pass = &stackleak_final_rtl_opt_pass.pass,
-+ .reference_pass_name = "final",
-+ .ref_pass_instance_number = 0,
-+ .pos_op = PASS_POS_INSERT_BEFORE
-+ };
-+
-+ if (!plugin_default_version_check(version, &gcc_version)) {
-+ error(G_("incompatible gcc/plugin versions"));
-+ return 1;
-+ }
-+
-+ register_callback(plugin_name, PLUGIN_INFO, NULL, &stackleak_plugin_info);
-+
-+ for (i = 0; i < argc; ++i) {
-+ if (!strcmp(argv[i].key, "track-lowest-sp")) {
-+ if (!argv[i].value) {
-+ error(G_("no value supplied for option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
-+ continue;
-+ }
-+ track_frame_size = atoi(argv[i].value);
-+ if (argv[i].value[0] < '0' || argv[i].value[0] > '9' || track_frame_size < 0)
-+ error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
-+ continue;
-+ }
-+ if (!strcmp(argv[i].key, "initialize-locals")) {
-+ if (argv[i].value) {
-+ error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
-+ continue;
-+ }
-+ init_locals = true;
-+ continue;
-+ }
-+ error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
-+ }
-+
-+ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &stackleak_tree_instrument_pass_info);
-+ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &stackleak_final_pass_info);
-+
-+ return 0;
-+}
-Binary files linux-2.6.32.45/tools/gcc/stackleak_plugin.so and linux-2.6.32.45/tools/gcc/stackleak_plugin.so differ
-diff -urNp linux-2.6.32.45/usr/gen_init_cpio.c linux-2.6.32.45/usr/gen_init_cpio.c
---- linux-2.6.32.45/usr/gen_init_cpio.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/usr/gen_init_cpio.c 2011-04-17 15:56:46.000000000 -0400
-@@ -299,7 +299,7 @@ static int cpio_mkfile(const char *name,
- int retval;
- int rc = -1;
- int namesize;
-- int i;
-+ unsigned int i;
-
- mode |= S_IFREG;
-
-@@ -383,9 +383,10 @@ static char *cpio_replace_env(char *new_
- *env_var = *expanded = '\0';
- strncat(env_var, start + 2, end - start - 2);
- strncat(expanded, new_location, start - new_location);
-- strncat(expanded, getenv(env_var), PATH_MAX);
-- strncat(expanded, end + 1, PATH_MAX);
-+ strncat(expanded, getenv(env_var), PATH_MAX - strlen(expanded));
-+ strncat(expanded, end + 1, PATH_MAX - strlen(expanded));
- strncpy(new_location, expanded, PATH_MAX);
-+ new_location[PATH_MAX] = 0;
- } else
- break;
- }
-diff -urNp linux-2.6.32.45/virt/kvm/kvm_main.c linux-2.6.32.45/virt/kvm/kvm_main.c
---- linux-2.6.32.45/virt/kvm/kvm_main.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.45/virt/kvm/kvm_main.c 2011-08-05 20:33:55.000000000 -0400
-@@ -2494,7 +2494,7 @@ asmlinkage void kvm_handle_fault_on_rebo
- if (kvm_rebooting)
- /* spin while reset goes on */
- while (true)
-- ;
-+ cpu_relax();
- /* Fault while not rebooting. We want the trace. */
- BUG();
- }
-@@ -2714,7 +2714,7 @@ static void kvm_sched_out(struct preempt
- kvm_arch_vcpu_put(vcpu);
- }
-
--int kvm_init(void *opaque, unsigned int vcpu_size,
-+int kvm_init(const void *opaque, unsigned int vcpu_size,
- struct module *module)
- {
- int r;
-@@ -2767,15 +2767,17 @@ int kvm_init(void *opaque, unsigned int
- /* A kmem cache lets us meet the alignment requirements of fx_save. */
- kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size,
- __alignof__(struct kvm_vcpu),
-- 0, NULL);
-+ SLAB_USERCOPY, NULL);
- if (!kvm_vcpu_cache) {
- r = -ENOMEM;
- goto out_free_5;
- }
-
-- kvm_chardev_ops.owner = module;
-- kvm_vm_fops.owner = module;
-- kvm_vcpu_fops.owner = module;
-+ pax_open_kernel();
-+ *(void **)&kvm_chardev_ops.owner = module;
-+ *(void **)&kvm_vm_fops.owner = module;
-+ *(void **)&kvm_vcpu_fops.owner = module;
-+ pax_close_kernel();
-
- r = misc_register(&kvm_dev);
- if (r) {
diff --git a/2.6.32/grsecurity-2.2.2-2.6.32.45-201108232250.patch b/2.6.32/4420_grsecurity-2.2.2-2.6.32.45-201108232250.patch
similarity index 100%
rename from 2.6.32/grsecurity-2.2.2-2.6.32.45-201108232250.patch
rename to 2.6.32/4420_grsecurity-2.2.2-2.6.32.45-201108232250.patch
^ permalink raw reply related [flat|nested] 13+ messages in thread* [gentoo-commits] proj/hardened-patchset:master commit in: 2.6.32/
@ 2011-08-12 20:25 Anthony G. Basile
0 siblings, 0 replies; 13+ messages in thread
From: Anthony G. Basile @ 2011-08-12 20:25 UTC (permalink / raw
To: gentoo-commits
commit: f787d5c7cdd8dc64088acdf5477d87b290b26fbc
Author: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Fri Aug 12 20:25:45 2011 +0000
Commit: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Fri Aug 12 20:25:45 2011 +0000
URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-patchset.git;a=commit;h=f787d5c7
Add missing patch to incr to 2.6.32.44
---
2.6.32/0000_README | 4 +
2.6.32/1043_linux-2.6.32.44.patch | 1455 +++++++++++++++++++++++++++++++++++++
2 files changed, 1459 insertions(+), 0 deletions(-)
diff --git a/2.6.32/0000_README b/2.6.32/0000_README
index 97013da..5e4d4d1 100644
--- a/2.6.32/0000_README
+++ b/2.6.32/0000_README
@@ -3,6 +3,10 @@ README
Individual Patch Descriptions:
-----------------------------------------------------------------------------
+Patch: 1043_linux-2.6.32.44.patch
+From: http://www.kernel.org
+Desc: Linux 2.6.39.44
+
Patch: 4420_grsecurity-2.2.2-2.6.32.44-201108111959.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/2.6.32/1043_linux-2.6.32.44.patch b/2.6.32/1043_linux-2.6.32.44.patch
new file mode 100644
index 0000000..c71b835
--- /dev/null
+++ b/2.6.32/1043_linux-2.6.32.44.patch
@@ -0,0 +1,1455 @@
+diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
+index 62619f2..a94e49c 100644
+--- a/arch/alpha/kernel/osf_sys.c
++++ b/arch/alpha/kernel/osf_sys.c
+@@ -431,7 +431,7 @@ SYSCALL_DEFINE2(osf_getdomainname, char __user *, name, int, namelen)
+ return -EFAULT;
+
+ len = namelen;
+- if (namelen > 32)
++ if (len > 32)
+ len = 32;
+
+ down_read(&uts_sem);
+@@ -618,7 +618,7 @@ SYSCALL_DEFINE3(osf_sysinfo, int, command, char __user *, buf, long, count)
+ down_read(&uts_sem);
+ res = sysinfo_table[offset];
+ len = strlen(res)+1;
+- if (len > count)
++ if ((unsigned long)len > (unsigned long)count)
+ len = count;
+ if (copy_to_user(buf, res, len))
+ err = -EFAULT;
+@@ -673,7 +673,7 @@ SYSCALL_DEFINE5(osf_getsysinfo, unsigned long, op, void __user *, buffer,
+ return 1;
+
+ case GSI_GET_HWRPB:
+- if (nbytes < sizeof(*hwrpb))
++ if (nbytes > sizeof(*hwrpb))
+ return -EINVAL;
+ if (copy_to_user(buffer, hwrpb, nbytes) != 0)
+ return -EFAULT;
+@@ -1035,6 +1035,7 @@ SYSCALL_DEFINE4(osf_wait4, pid_t, pid, int __user *, ustatus, int, options,
+ {
+ struct rusage r;
+ long ret, err;
++ unsigned int status = 0;
+ mm_segment_t old_fs;
+
+ if (!ur)
+@@ -1043,13 +1044,15 @@ SYSCALL_DEFINE4(osf_wait4, pid_t, pid, int __user *, ustatus, int, options,
+ old_fs = get_fs();
+
+ set_fs (KERNEL_DS);
+- ret = sys_wait4(pid, ustatus, options, (struct rusage __user *) &r);
++ ret = sys_wait4(pid, (unsigned int __user *) &status, options,
++ (struct rusage __user *) &r);
+ set_fs (old_fs);
+
+ if (!access_ok(VERIFY_WRITE, ur, sizeof(*ur)))
+ return -EFAULT;
+
+ err = 0;
++ err |= put_user(status, ustatus);
+ err |= __put_user(r.ru_utime.tv_sec, &ur->ru_utime.tv_sec);
+ err |= __put_user(r.ru_utime.tv_usec, &ur->ru_utime.tv_usec);
+ err |= __put_user(r.ru_stime.tv_sec, &ur->ru_stime.tv_sec);
+diff --git a/arch/arm/mach-davinci/board-dm365-evm.c b/arch/arm/mach-davinci/board-dm365-evm.c
+index 52dd804..8904495 100644
+--- a/arch/arm/mach-davinci/board-dm365-evm.c
++++ b/arch/arm/mach-davinci/board-dm365-evm.c
+@@ -413,7 +413,7 @@ fail:
+ */
+ if (have_imager()) {
+ label = "HD imager";
+- mux |= 1;
++ mux |= 2;
+
+ /* externally mux MMC1/ENET/AIC33 to imager */
+ mux |= BIT(6) | BIT(5) | BIT(3);
+@@ -434,7 +434,7 @@ fail:
+ resets &= ~BIT(1);
+
+ if (have_tvp7002()) {
+- mux |= 2;
++ mux |= 1;
+ resets &= ~BIT(2);
+ label = "tvp7002 HD";
+ } else {
+diff --git a/arch/arm/mach-pxa/cm-x300.c b/arch/arm/mach-pxa/cm-x300.c
+index 102916f..b6bfe7e 100644
+--- a/arch/arm/mach-pxa/cm-x300.c
++++ b/arch/arm/mach-pxa/cm-x300.c
+@@ -143,10 +143,10 @@ static mfp_cfg_t cm_x300_mfp_cfg[] __initdata = {
+ GPIO99_GPIO, /* Ethernet IRQ */
+
+ /* RTC GPIOs */
+- GPIO95_GPIO, /* RTC CS */
+- GPIO96_GPIO, /* RTC WR */
+- GPIO97_GPIO, /* RTC RD */
+- GPIO98_GPIO, /* RTC IO */
++ GPIO95_GPIO | MFP_LPM_DRIVE_HIGH, /* RTC CS */
++ GPIO96_GPIO | MFP_LPM_DRIVE_HIGH, /* RTC WR */
++ GPIO97_GPIO | MFP_LPM_DRIVE_HIGH, /* RTC RD */
++ GPIO98_GPIO, /* RTC IO */
+
+ /* Standard I2C */
+ GPIO21_I2C_SCL,
+diff --git a/arch/powerpc/kernel/crash.c b/arch/powerpc/kernel/crash.c
+index 5009198..d374974 100644
+--- a/arch/powerpc/kernel/crash.c
++++ b/arch/powerpc/kernel/crash.c
+@@ -176,12 +176,8 @@ static void crash_kexec_wait_realmode(int cpu)
+
+ while (paca[i].kexec_state < KEXEC_STATE_REAL_MODE) {
+ barrier();
+- if (!cpu_possible(i)) {
++ if (!cpu_possible(i) || !cpu_online(i) || (msecs <= 0))
+ break;
+- }
+- if (!cpu_online(i)) {
+- break;
+- }
+ msecs--;
+ mdelay(1);
+ }
+diff --git a/arch/powerpc/platforms/pseries/hvconsole.c b/arch/powerpc/platforms/pseries/hvconsole.c
+index 3f6a89b..041e87c 100644
+--- a/arch/powerpc/platforms/pseries/hvconsole.c
++++ b/arch/powerpc/platforms/pseries/hvconsole.c
+@@ -73,7 +73,7 @@ int hvc_put_chars(uint32_t vtermno, const char *buf, int count)
+ if (ret == H_SUCCESS)
+ return count;
+ if (ret == H_BUSY)
+- return 0;
++ return -EAGAIN;
+ return -EIO;
+ }
+
+diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c
+index 69cab24..987ef29 100644
+--- a/arch/x86/kernel/hpet.c
++++ b/arch/x86/kernel/hpet.c
+@@ -27,6 +27,9 @@
+ #define HPET_DEV_FSB_CAP 0x1000
+ #define HPET_DEV_PERI_CAP 0x2000
+
++#define HPET_MIN_CYCLES 128
++#define HPET_MIN_PROG_DELTA (HPET_MIN_CYCLES + (HPET_MIN_CYCLES >> 1))
++
+ #define EVT_TO_HPET_DEV(evt) container_of(evt, struct hpet_dev, evt)
+
+ /*
+@@ -298,8 +301,9 @@ static void hpet_legacy_clockevent_register(void)
+ /* Calculate the min / max delta */
+ hpet_clockevent.max_delta_ns = clockevent_delta2ns(0x7FFFFFFF,
+ &hpet_clockevent);
+- /* 5 usec minimum reprogramming delta. */
+- hpet_clockevent.min_delta_ns = 5000;
++ /* Setup minimum reprogramming delta. */
++ hpet_clockevent.min_delta_ns = clockevent_delta2ns(HPET_MIN_PROG_DELTA,
++ &hpet_clockevent);
+
+ /*
+ * Start hpet with the boot cpu mask and make it
+@@ -379,36 +383,37 @@ static int hpet_next_event(unsigned long delta,
+ struct clock_event_device *evt, int timer)
+ {
+ u32 cnt;
++ s32 res;
+
+ cnt = hpet_readl(HPET_COUNTER);
+ cnt += (u32) delta;
+ hpet_writel(cnt, HPET_Tn_CMP(timer));
+
+ /*
+- * We need to read back the CMP register on certain HPET
+- * implementations (ATI chipsets) which seem to delay the
+- * transfer of the compare register into the internal compare
+- * logic. With small deltas this might actually be too late as
+- * the counter could already be higher than the compare value
+- * at that point and we would wait for the next hpet interrupt
+- * forever. We found out that reading the CMP register back
+- * forces the transfer so we can rely on the comparison with
+- * the counter register below. If the read back from the
+- * compare register does not match the value we programmed
+- * then we might have a real hardware problem. We can not do
+- * much about it here, but at least alert the user/admin with
+- * a prominent warning.
+- * An erratum on some chipsets (ICH9,..), results in comparator read
+- * immediately following a write returning old value. Workaround
+- * for this is to read this value second time, when first
+- * read returns old value.
++ * HPETs are a complete disaster. The compare register is
++ * based on a equal comparison and neither provides a less
++ * than or equal functionality (which would require to take
++ * the wraparound into account) nor a simple count down event
++ * mode. Further the write to the comparator register is
++ * delayed internally up to two HPET clock cycles in certain
++ * chipsets (ATI, ICH9,10). Some newer AMD chipsets have even
++ * longer delays. We worked around that by reading back the
++ * compare register, but that required another workaround for
++ * ICH9,10 chips where the first readout after write can
++ * return the old stale value. We already had a minimum
++ * programming delta of 5us enforced, but a NMI or SMI hitting
++ * between the counter readout and the comparator write can
++ * move us behind that point easily. Now instead of reading
++ * the compare register back several times, we make the ETIME
++ * decision based on the following: Return ETIME if the
++ * counter value after the write is less than HPET_MIN_CYCLES
++ * away from the event or if the counter is already ahead of
++ * the event. The minimum programming delta for the generic
++ * clockevents code is set to 1.5 * HPET_MIN_CYCLES.
+ */
+- if (unlikely((u32)hpet_readl(HPET_Tn_CMP(timer)) != cnt)) {
+- WARN_ONCE((u32)hpet_readl(HPET_Tn_CMP(timer)) != cnt,
+- KERN_WARNING "hpet: compare register read back failed.\n");
+- }
++ res = (s32)(cnt - (u32)hpet_readl(HPET_COUNTER));
+
+- return (s32)((u32)hpet_readl(HPET_COUNTER) - cnt) >= 0 ? -ETIME : 0;
++ return res < HPET_MIN_CYCLES ? -ETIME : 0;
+ }
+
+ static void hpet_legacy_set_mode(enum clock_event_mode mode,
+diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
+index 200fcde..cf98100 100644
+--- a/arch/x86/kernel/reboot.c
++++ b/arch/x86/kernel/reboot.c
+@@ -469,6 +469,14 @@ static struct dmi_system_id __initdata pci_reboot_dmi_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "iMac9,1"),
+ },
+ },
++ { /* Handle problems with rebooting on the Latitude E5420. */
++ .callback = set_pci_reboot,
++ .ident = "Dell Latitude E5420",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Latitude E5420"),
++ },
++ },
+ { }
+ };
+
+diff --git a/arch/x86/kernel/relocate_kernel_32.S b/arch/x86/kernel/relocate_kernel_32.S
+index 4123553..36818f8 100644
+--- a/arch/x86/kernel/relocate_kernel_32.S
++++ b/arch/x86/kernel/relocate_kernel_32.S
+@@ -97,6 +97,8 @@ relocate_kernel:
+ ret
+
+ identity_mapped:
++ /* set return address to 0 if not preserving context */
++ pushl $0
+ /* store the start address on the stack */
+ pushl %edx
+
+diff --git a/arch/x86/kernel/relocate_kernel_64.S b/arch/x86/kernel/relocate_kernel_64.S
+index 4de8f5b..7a6f3b3 100644
+--- a/arch/x86/kernel/relocate_kernel_64.S
++++ b/arch/x86/kernel/relocate_kernel_64.S
+@@ -100,6 +100,8 @@ relocate_kernel:
+ ret
+
+ identity_mapped:
++ /* set return address to 0 if not preserving context */
++ pushq $0
+ /* store the start address on the stack */
+ pushq %rdx
+
+diff --git a/arch/xtensa/kernel/ptrace.c b/arch/xtensa/kernel/ptrace.c
+index 9486882..885ebe7 100644
+--- a/arch/xtensa/kernel/ptrace.c
++++ b/arch/xtensa/kernel/ptrace.c
+@@ -136,6 +136,9 @@ int ptrace_setxregs(struct task_struct *child, void __user *uregs)
+ elf_xtregs_t *xtregs = uregs;
+ int ret = 0;
+
++ if (!access_ok(VERIFY_READ, uregs, sizeof(elf_xtregs_t)))
++ return -EFAULT;
++
+ #if XTENSA_HAVE_COPROCESSORS
+ /* Flush all coprocessors before we overwrite them. */
+ coprocessor_flush_all(ti);
+diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
+index fa9bed0..e5bdb9b 100644
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -2707,10 +2707,11 @@ int ata_eh_reset(struct ata_link *link, int classify,
+ }
+
+ /*
+- * Some controllers can't be frozen very well and may set
+- * spuruious error conditions during reset. Clear accumulated
+- * error information. As reset is the final recovery action,
+- * nothing is lost by doing this.
++ * Some controllers can't be frozen very well and may set spurious
++ * error conditions during reset. Clear accumulated error
++ * information and re-thaw the port if frozen. As reset is the
++ * final recovery action and we cross check link onlineness against
++ * device classification later, no hotplug event is lost by this.
+ */
+ spin_lock_irqsave(link->ap->lock, flags);
+ memset(&link->eh_info, 0, sizeof(link->eh_info));
+@@ -2719,6 +2720,9 @@ int ata_eh_reset(struct ata_link *link, int classify,
+ ap->pflags &= ~ATA_PFLAG_EH_PENDING;
+ spin_unlock_irqrestore(link->ap->lock, flags);
+
++ if (ap->pflags & ATA_PFLAG_FROZEN)
++ ata_eh_thaw_port(ap);
++
+ /*
+ * Make sure onlineness and classification result correspond.
+ * Hotplug could have happened during reset and some
+diff --git a/drivers/block/cciss.h b/drivers/block/cciss.h
+index 5ae1b1c..04d6bf8 100644
+--- a/drivers/block/cciss.h
++++ b/drivers/block/cciss.h
+@@ -165,7 +165,7 @@ static void SA5_submit_command( ctlr_info_t *h, CommandList_struct *c)
+ printk("Sending %x - down to controller\n", c->busaddr );
+ #endif /* CCISS_DEBUG */
+ writel(c->busaddr, h->vaddr + SA5_REQUEST_PORT_OFFSET);
+- readl(h->vaddr + SA5_REQUEST_PORT_OFFSET);
++ readl(h->vaddr + SA5_SCRATCHPAD_OFFSET);
+ h->commands_outstanding++;
+ if ( h->commands_outstanding > h->max_outstanding)
+ h->max_outstanding = h->commands_outstanding;
+diff --git a/drivers/hwmon/max1111.c b/drivers/hwmon/max1111.c
+index 9ac4972..5b6001b 100644
+--- a/drivers/hwmon/max1111.c
++++ b/drivers/hwmon/max1111.c
+@@ -39,6 +39,8 @@ struct max1111_data {
+ struct spi_transfer xfer[2];
+ uint8_t *tx_buf;
+ uint8_t *rx_buf;
++ struct mutex drvdata_lock;
++ /* protect msg, xfer and buffers from multiple access */
+ };
+
+ static int max1111_read(struct device *dev, int channel)
+@@ -47,6 +49,9 @@ static int max1111_read(struct device *dev, int channel)
+ uint8_t v1, v2;
+ int err;
+
++ /* writing to drvdata struct is not thread safe, wait on mutex */
++ mutex_lock(&data->drvdata_lock);
++
+ data->tx_buf[0] = (channel << MAX1111_CTRL_SEL_SH) |
+ MAX1111_CTRL_PD0 | MAX1111_CTRL_PD1 |
+ MAX1111_CTRL_SGL | MAX1111_CTRL_UNI | MAX1111_CTRL_STR;
+@@ -54,12 +59,15 @@ static int max1111_read(struct device *dev, int channel)
+ err = spi_sync(data->spi, &data->msg);
+ if (err < 0) {
+ dev_err(dev, "spi_sync failed with %d\n", err);
++ mutex_unlock(&data->drvdata_lock);
+ return err;
+ }
+
+ v1 = data->rx_buf[0];
+ v2 = data->rx_buf[1];
+
++ mutex_unlock(&data->drvdata_lock);
++
+ if ((v1 & 0xc0) || (v2 & 0x3f))
+ return -EINVAL;
+
+@@ -175,6 +183,8 @@ static int __devinit max1111_probe(struct spi_device *spi)
+ if (err)
+ goto err_free_data;
+
++ mutex_init(&data->drvdata_lock);
++
+ data->spi = spi;
+ spi_set_drvdata(spi, data);
+
+@@ -212,6 +222,7 @@ static int __devexit max1111_remove(struct spi_device *spi)
+
+ hwmon_device_unregister(data->hwmon_dev);
+ sysfs_remove_group(&spi->dev.kobj, &max1111_attr_group);
++ mutex_destroy(&data->drvdata_lock);
+ kfree(data->rx_buf);
+ kfree(data->tx_buf);
+ kfree(data);
+diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
+index fcf717c..b03cd39 100644
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -778,6 +778,11 @@ static int parse_features(struct arg_set *as, struct multipath *m)
+ if (!argc)
+ return 0;
+
++ if (argc > as->argc) {
++ ti->error = "not enough arguments for features";
++ return -EINVAL;
++ }
++
+ do {
+ param_name = shift(as);
+ argc--;
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index d186687..c988ac2 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -36,6 +36,8 @@ static const char *_name = DM_NAME;
+ static unsigned int major = 0;
+ static unsigned int _major = 0;
+
++static DEFINE_IDR(_minor_idr);
++
+ static DEFINE_SPINLOCK(_minor_lock);
+ /*
+ * For bio-based dm.
+@@ -315,6 +317,12 @@ static void __exit dm_exit(void)
+
+ while (i--)
+ _exits[i]();
++
++ /*
++ * Should be empty by this point.
++ */
++ idr_remove_all(&_minor_idr);
++ idr_destroy(&_minor_idr);
+ }
+
+ /*
+@@ -1663,8 +1671,6 @@ static int dm_any_congested(void *congested_data, int bdi_bits)
+ /*-----------------------------------------------------------------
+ * An IDR is used to keep track of allocated minor numbers.
+ *---------------------------------------------------------------*/
+-static DEFINE_IDR(_minor_idr);
+-
+ static void free_minor(int minor)
+ {
+ spin_lock(&_minor_lock);
+diff --git a/drivers/media/radio/si4713-i2c.c b/drivers/media/radio/si4713-i2c.c
+index 6a0028e..93653c6 100644
+--- a/drivers/media/radio/si4713-i2c.c
++++ b/drivers/media/radio/si4713-i2c.c
+@@ -1003,7 +1003,7 @@ static int si4713_write_econtrol_string(struct si4713_device *sdev,
+ char ps_name[MAX_RDS_PS_NAME + 1];
+
+ len = control->size - 1;
+- if (len > MAX_RDS_PS_NAME) {
++ if (len < 0 || len > MAX_RDS_PS_NAME) {
+ rval = -ERANGE;
+ goto exit;
+ }
+@@ -1025,7 +1025,7 @@ static int si4713_write_econtrol_string(struct si4713_device *sdev,
+ char radio_text[MAX_RDS_RADIO_TEXT + 1];
+
+ len = control->size - 1;
+- if (len > MAX_RDS_RADIO_TEXT) {
++ if (len < 0 || len > MAX_RDS_RADIO_TEXT) {
+ rval = -ERANGE;
+ goto exit;
+ }
+diff --git a/drivers/media/video/bt8xx/bttv-driver.c b/drivers/media/video/bt8xx/bttv-driver.c
+index d258ed7..f0e9c75 100644
+--- a/drivers/media/video/bt8xx/bttv-driver.c
++++ b/drivers/media/video/bt8xx/bttv-driver.c
+@@ -3532,7 +3532,7 @@ static int radio_s_tuner(struct file *file, void *priv,
+ if (0 != t->index)
+ return -EINVAL;
+
+- bttv_call_all(btv, tuner, g_tuner, t);
++ bttv_call_all(btv, tuner, s_tuner, t);
+ return 0;
+ }
+
+diff --git a/drivers/media/video/pvrusb2/pvrusb2-hdw.c b/drivers/media/video/pvrusb2/pvrusb2-hdw.c
+index 13639b3..5891e30 100644
+--- a/drivers/media/video/pvrusb2/pvrusb2-hdw.c
++++ b/drivers/media/video/pvrusb2/pvrusb2-hdw.c
+@@ -2979,6 +2979,8 @@ static void pvr2_subdev_update(struct pvr2_hdw *hdw)
+ if (hdw->input_dirty || hdw->audiomode_dirty || hdw->force_dirty) {
+ struct v4l2_tuner vt;
+ memset(&vt, 0, sizeof(vt));
++ vt.type = (hdw->input_val == PVR2_CVAL_INPUT_RADIO) ?
++ V4L2_TUNER_RADIO : V4L2_TUNER_ANALOG_TV;
+ vt.audmode = hdw->audiomode_val;
+ v4l2_device_call_all(&hdw->v4l2_dev, 0, tuner, s_tuner, &vt);
+ }
+@@ -5064,6 +5066,8 @@ void pvr2_hdw_status_poll(struct pvr2_hdw *hdw)
+ {
+ struct v4l2_tuner *vtp = &hdw->tuner_signal_info;
+ memset(vtp, 0, sizeof(*vtp));
++ vtp->type = (hdw->input_val == PVR2_CVAL_INPUT_RADIO) ?
++ V4L2_TUNER_RADIO : V4L2_TUNER_ANALOG_TV;
+ hdw->tuner_signal_stale = 0;
+ /* Note: There apparently is no replacement for VIDIOC_CROPCAP
+ using v4l2-subdev - therefore we can't support that AT ALL right
+diff --git a/drivers/media/video/v4l2-ioctl.c b/drivers/media/video/v4l2-ioctl.c
+index 30cc334..265bfb5 100644
+--- a/drivers/media/video/v4l2-ioctl.c
++++ b/drivers/media/video/v4l2-ioctl.c
+@@ -1600,6 +1600,8 @@ static long __video_do_ioctl(struct file *file,
+ if (!ops->vidioc_g_tuner)
+ break;
+
++ p->type = (vfd->vfl_type == VFL_TYPE_RADIO) ?
++ V4L2_TUNER_RADIO : V4L2_TUNER_ANALOG_TV;
+ ret = ops->vidioc_g_tuner(file, fh, p);
+ if (!ret)
+ dbgarg(cmd, "index=%d, name=%s, type=%d, "
+@@ -1618,6 +1620,8 @@ static long __video_do_ioctl(struct file *file,
+
+ if (!ops->vidioc_s_tuner)
+ break;
++ p->type = (vfd->vfl_type == VFL_TYPE_RADIO) ?
++ V4L2_TUNER_RADIO : V4L2_TUNER_ANALOG_TV;
+ dbgarg(cmd, "index=%d, name=%s, type=%d, "
+ "capability=0x%x, rangelow=%d, "
+ "rangehigh=%d, signal=%d, afc=%d, "
+@@ -1636,6 +1640,8 @@ static long __video_do_ioctl(struct file *file,
+ if (!ops->vidioc_g_frequency)
+ break;
+
++ p->type = (vfd->vfl_type == VFL_TYPE_RADIO) ?
++ V4L2_TUNER_RADIO : V4L2_TUNER_ANALOG_TV;
+ ret = ops->vidioc_g_frequency(file, fh, p);
+ if (!ret)
+ dbgarg(cmd, "tuner=%d, type=%d, frequency=%d\n",
+diff --git a/drivers/net/jme.c b/drivers/net/jme.c
+index a893f45..0fbca76 100644
+--- a/drivers/net/jme.c
++++ b/drivers/net/jme.c
+@@ -681,20 +681,28 @@ jme_make_new_rx_buf(struct jme_adapter *jme, int i)
+ struct jme_ring *rxring = &(jme->rxring[0]);
+ struct jme_buffer_info *rxbi = rxring->bufinf + i;
+ struct sk_buff *skb;
++ dma_addr_t mapping;
+
+ skb = netdev_alloc_skb(jme->dev,
+ jme->dev->mtu + RX_EXTRA_LEN);
+ if (unlikely(!skb))
+ return -ENOMEM;
+
++ mapping = pci_map_page(jme->pdev, virt_to_page(skb->data),
++ offset_in_page(skb->data), skb_tailroom(skb),
++ PCI_DMA_FROMDEVICE);
++ if (unlikely(pci_dma_mapping_error(jme->pdev, mapping))) {
++ dev_kfree_skb(skb);
++ return -ENOMEM;
++ }
++
++ if (likely(rxbi->mapping))
++ pci_unmap_page(jme->pdev, rxbi->mapping,
++ rxbi->len, PCI_DMA_FROMDEVICE);
++
+ rxbi->skb = skb;
+ rxbi->len = skb_tailroom(skb);
+- rxbi->mapping = pci_map_page(jme->pdev,
+- virt_to_page(skb->data),
+- offset_in_page(skb->data),
+- rxbi->len,
+- PCI_DMA_FROMDEVICE);
+-
++ rxbi->mapping = mapping;
+ return 0;
+ }
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 0d3326d..6f8352c 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -1507,7 +1507,7 @@ void pci_enable_ari(struct pci_dev *dev)
+ {
+ int pos;
+ u32 cap;
+- u16 ctrl;
++ u16 flags, ctrl;
+ struct pci_dev *bridge;
+
+ if (!dev->is_pcie || dev->devfn)
+@@ -1525,6 +1525,11 @@ void pci_enable_ari(struct pci_dev *dev)
+ if (!pos)
+ return;
+
++ /* ARI is a PCIe v2 feature */
++ pci_read_config_word(bridge, pos + PCI_EXP_FLAGS, &flags);
++ if ((flags & PCI_EXP_FLAGS_VERS) < 2)
++ return;
++
+ pci_read_config_dword(bridge, pos + PCI_EXP_DEVCAP2, &cap);
+ if (!(cap & PCI_EXP_DEVCAP2_ARI))
+ return;
+diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
+index 33cf988..4f43306 100644
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -840,6 +840,9 @@ static struct domain_device *sas_ex_discover_expander(
+
+ res = sas_discover_expander(child);
+ if (res) {
++ spin_lock_irq(&parent->port->dev_list_lock);
++ list_del(&child->dev_list_node);
++ spin_unlock_irq(&parent->port->dev_list_lock);
+ kfree(child);
+ return NULL;
+ }
+diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
+index 483370f..9ab8c86 100644
+--- a/drivers/scsi/pmcraid.c
++++ b/drivers/scsi/pmcraid.c
+@@ -3557,6 +3557,9 @@ static long pmcraid_ioctl_passthrough(
+ pmcraid_err("couldn't build passthrough ioadls\n");
+ goto out_free_buffer;
+ }
++ } else if (request_size < 0) {
++ rc = -EINVAL;
++ goto out_free_buffer;
+ }
+
+ /* If data is being written into the device, copy the data from user
+diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
+index 802e91c..ae0ae2d 100644
+--- a/drivers/scsi/scsi_devinfo.c
++++ b/drivers/scsi/scsi_devinfo.c
+@@ -196,6 +196,7 @@ static struct {
+ {"IBM", "ProFibre 4000R", "*", BLIST_SPARSELUN | BLIST_LARGELUN},
+ {"IBM", "2105", NULL, BLIST_RETRY_HWERROR},
+ {"iomega", "jaz 1GB", "J.86", BLIST_NOTQ | BLIST_NOLUN},
++ {"IOMEGA", "ZIP", NULL, BLIST_NOTQ | BLIST_NOLUN},
+ {"IOMEGA", "Io20S *F", NULL, BLIST_KEY},
+ {"INSITE", "Floptical F*8I", NULL, BLIST_KEY},
+ {"INSITE", "I325VM", NULL, BLIST_KEY},
+@@ -242,6 +243,7 @@ static struct {
+ {"Tornado-", "F4", "*", BLIST_NOREPORTLUN},
+ {"TOSHIBA", "CDROM", NULL, BLIST_ISROM},
+ {"TOSHIBA", "CD-ROM", NULL, BLIST_ISROM},
++ {"Traxdata", "CDR4120", NULL, BLIST_NOLUN}, /* locks up */
+ {"USB2.0", "SMARTMEDIA/XD", NULL, BLIST_FORCELUN | BLIST_INQUIRY_36},
+ {"WangDAT", "Model 2600", "01.7", BLIST_SELECT_NO_ATN},
+ {"WangDAT", "Model 3200", "02.2", BLIST_SELECT_NO_ATN},
+diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
+index 3b082dd..340124d 100644
+--- a/drivers/scsi/ses.c
++++ b/drivers/scsi/ses.c
+@@ -157,6 +157,10 @@ static unsigned char *ses_get_page2_descriptor(struct enclosure_device *edev,
+ return NULL;
+ }
+
++/* For device slot and array device slot elements, byte 3 bit 6
++ * is "fault sensed" while byte 3 bit 5 is "fault reqstd". As this
++ * code stands these bits are shifted 4 positions right so in
++ * sysfs they will appear as bits 2 and 1 respectively. Strange. */
+ static void ses_get_fault(struct enclosure_device *edev,
+ struct enclosure_component *ecomp)
+ {
+@@ -178,7 +182,7 @@ static int ses_set_fault(struct enclosure_device *edev,
+ /* zero is disabled */
+ break;
+ case ENCLOSURE_SETTING_ENABLED:
+- desc[2] = 0x02;
++ desc[3] = 0x20;
+ break;
+ default:
+ /* SES doesn't do the SGPIO blink settings */
+diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
+index aaad76e..80a1071 100644
+--- a/drivers/staging/comedi/comedi_fops.c
++++ b/drivers/staging/comedi/comedi_fops.c
+@@ -367,8 +367,8 @@ static int do_devinfo_ioctl(struct comedi_device *dev,
+ /* fill devinfo structure */
+ devinfo.version_code = COMEDI_VERSION_CODE;
+ devinfo.n_subdevs = dev->n_subdevices;
+- memcpy(devinfo.driver_name, dev->driver->driver_name, COMEDI_NAMELEN);
+- memcpy(devinfo.board_name, dev->board_name, COMEDI_NAMELEN);
++ strlcpy(devinfo.driver_name, dev->driver->driver_name, COMEDI_NAMELEN);
++ strlcpy(devinfo.board_name, dev->board_name, COMEDI_NAMELEN);
+
+ if (read_subdev)
+ devinfo.read_subdevice = read_subdev - dev->subdevices;
+diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c
+index 5e09664..7adb671 100644
+--- a/drivers/usb/gadget/dummy_hcd.c
++++ b/drivers/usb/gadget/dummy_hcd.c
+@@ -1886,6 +1886,7 @@ static int dummy_hcd_probe(struct platform_device *pdev)
+ if (!hcd)
+ return -ENOMEM;
+ the_controller = hcd_to_dummy (hcd);
++ hcd->has_tt = 1;
+
+ retval = usb_add_hcd(hcd, 0, 0);
+ if (retval != 0) {
+diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
+index 6ac3976..1bcf6ee 100644
+--- a/drivers/usb/host/ehci-hub.c
++++ b/drivers/usb/host/ehci-hub.c
+@@ -758,10 +758,11 @@ static int ehci_hub_control (
+ * power switching; they're allowed to just limit the
+ * current. khubd will turn the power back on.
+ */
+- if (HCS_PPC (ehci->hcs_params)){
++ if ((temp & PORT_OC) && HCS_PPC(ehci->hcs_params)) {
+ ehci_writel(ehci,
+ temp & ~(PORT_RWC_BITS | PORT_POWER),
+ status_reg);
++ temp = ehci_readl(ehci, status_reg);
+ }
+ }
+
+diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
+index f51345f..0ee5b4b 100644
+--- a/drivers/usb/host/ehci-q.c
++++ b/drivers/usb/host/ehci-q.c
+@@ -103,7 +103,7 @@ qh_update (struct ehci_hcd *ehci, struct ehci_qh *qh, struct ehci_qtd *qtd)
+ if (!(hw->hw_info1 & cpu_to_hc32(ehci, 1 << 14))) {
+ unsigned is_out, epnum;
+
+- is_out = !(qtd->hw_token & cpu_to_hc32(ehci, 1 << 8));
++ is_out = qh->is_out;
+ epnum = (hc32_to_cpup(ehci, &hw->hw_info1) >> 8) & 0x0f;
+ if (unlikely (!usb_gettoggle (qh->dev, epnum, is_out))) {
+ hw->hw_token &= ~cpu_to_hc32(ehci, QTD_TOGGLE);
+@@ -923,6 +923,7 @@ done:
+ hw = qh->hw;
+ hw->hw_info1 = cpu_to_hc32(ehci, info1);
+ hw->hw_info2 = cpu_to_hc32(ehci, info2);
++ qh->is_out = !is_input;
+ usb_settoggle (urb->dev, usb_pipeendpoint (urb->pipe), !is_input, 1);
+ qh_refresh (ehci, qh);
+ return qh;
+diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
+index ac321ef..5b3ca74 100644
+--- a/drivers/usb/host/ehci.h
++++ b/drivers/usb/host/ehci.h
+@@ -366,6 +366,7 @@ struct ehci_qh {
+ #define NO_FRAME ((unsigned short)~0) /* pick new start */
+
+ struct usb_device *dev; /* access to TT */
++ unsigned is_out:1; /* bulk or intr OUT */
+ unsigned clearing_tt:1; /* Clear-TT-Buf in progress */
+ };
+
+diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
+index 464ed97..bcf7a88 100644
+--- a/drivers/usb/host/pci-quirks.c
++++ b/drivers/usb/host/pci-quirks.c
+@@ -34,6 +34,8 @@
+ #define OHCI_INTRSTATUS 0x0c
+ #define OHCI_INTRENABLE 0x10
+ #define OHCI_INTRDISABLE 0x14
++#define OHCI_FMINTERVAL 0x34
++#define OHCI_HCR (1 << 0) /* host controller reset */
+ #define OHCI_OCR (1 << 3) /* ownership change request */
+ #define OHCI_CTRL_RWC (1 << 9) /* remote wakeup connected */
+ #define OHCI_CTRL_IR (1 << 8) /* interrupt routing */
+@@ -204,6 +206,32 @@ static void __devinit quirk_usb_handoff_ohci(struct pci_dev *pdev)
+
+ /* reset controller, preserving RWC (and possibly IR) */
+ writel(control & OHCI_CTRL_MASK, base + OHCI_CONTROL);
++ readl(base + OHCI_CONTROL);
++
++ /* Some NVIDIA controllers stop working if kept in RESET for too long */
++ if (pdev->vendor == PCI_VENDOR_ID_NVIDIA) {
++ u32 fminterval;
++ int cnt;
++
++ /* drive reset for at least 50 ms (7.1.7.5) */
++ msleep(50);
++
++ /* software reset of the controller, preserving HcFmInterval */
++ fminterval = readl(base + OHCI_FMINTERVAL);
++ writel(OHCI_HCR, base + OHCI_CMDSTATUS);
++
++ /* reset requires max 10 us delay */
++ for (cnt = 30; cnt > 0; --cnt) { /* ... allow extra time */
++ if ((readl(base + OHCI_CMDSTATUS) & OHCI_HCR) == 0)
++ break;
++ udelay(1);
++ }
++ writel(fminterval, base + OHCI_FMINTERVAL);
++
++ /* Now we're in the SUSPEND state with all devices reset
++ * and wakeups and interrupts disabled
++ */
++ }
+
+ /*
+ * disable interrupts
+diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
+index 24212be..b9afd6a 100644
+--- a/drivers/usb/musb/musb_core.c
++++ b/drivers/usb/musb/musb_core.c
+@@ -1634,6 +1634,7 @@ void musb_dma_completion(struct musb *musb, u8 epnum, u8 transmit)
+ }
+ }
+ }
++ musb_writeb(musb_base, MUSB_INDEX, musb->context.index);
+ }
+
+ #else
+diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
+index b336017..4a18fd2 100644
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -100,6 +100,8 @@ static struct usb_device_id id_table [] = {
+ { USB_DEVICE(ZEAGLE_VENDOR_ID, ZEAGLE_N2ITION3_PRODUCT_ID) },
+ { USB_DEVICE(SONY_VENDOR_ID, SONY_QN3USB_PRODUCT_ID) },
+ { USB_DEVICE(SANWA_VENDOR_ID, SANWA_PRODUCT_ID) },
++ { USB_DEVICE(ADLINK_VENDOR_ID, ADLINK_ND6530_PRODUCT_ID) },
++ { USB_DEVICE(WINCHIPHEAD_VENDOR_ID, WINCHIPHEAD_USBSER_PRODUCT_ID) },
+ { } /* Terminating entry */
+ };
+
+diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
+index 4d043e4..ca0d237 100644
+--- a/drivers/usb/serial/pl2303.h
++++ b/drivers/usb/serial/pl2303.h
+@@ -5,7 +5,7 @@
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+- *
++ *
+ */
+
+ #define BENQ_VENDOR_ID 0x04a5
+@@ -140,3 +140,11 @@
+ /* Sanwa KB-USB2 multimeter cable (ID: 11ad:0001) */
+ #define SANWA_VENDOR_ID 0x11ad
+ #define SANWA_PRODUCT_ID 0x0001
++
++/* ADLINK ND-6530 RS232,RS485 and RS422 adapter */
++#define ADLINK_VENDOR_ID 0x0b63
++#define ADLINK_ND6530_PRODUCT_ID 0x6530
++
++/* WinChipHead USB->RS 232 adapter */
++#define WINCHIPHEAD_VENDOR_ID 0x4348
++#define WINCHIPHEAD_USBSER_PRODUCT_ID 0x5523
+diff --git a/fs/block_dev.c b/fs/block_dev.c
+index 16cea86..e65efa2 100644
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -1203,7 +1203,6 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
+ if (!bdev->bd_part)
+ goto out_clear;
+
+- ret = 0;
+ if (disk->fops->open) {
+ ret = disk->fops->open(bdev, mode);
+ if (ret == -ERESTARTSYS) {
+@@ -1219,18 +1218,9 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
+ mutex_unlock(&bdev->bd_mutex);
+ goto restart;
+ }
++ if (ret)
++ goto out_clear;
+ }
+- /*
+- * If the device is invalidated, rescan partition
+- * if open succeeded or failed with -ENOMEDIUM.
+- * The latter is necessary to prevent ghost
+- * partitions on a removed medium.
+- */
+- if (bdev->bd_invalidated && (!ret || ret == -ENOMEDIUM))
+- rescan_partitions(disk, bdev);
+- if (ret)
+- goto out_clear;
+-
+ if (!bdev->bd_openers) {
+ bd_set_size(bdev,(loff_t)get_capacity(disk)<<9);
+ bdi = blk_get_backing_dev_info(bdev);
+@@ -1238,6 +1228,8 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
+ bdi = &default_backing_dev_info;
+ bdev->bd_inode->i_data.backing_dev_info = bdi;
+ }
++ if (bdev->bd_invalidated)
++ rescan_partitions(disk, bdev);
+ } else {
+ struct block_device *whole;
+ whole = bdget_disk(disk, 0);
+@@ -1264,14 +1256,13 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
+ put_disk(disk);
+ disk = NULL;
+ if (bdev->bd_contains == bdev) {
+- ret = 0;
+- if (bdev->bd_disk->fops->open)
++ if (bdev->bd_disk->fops->open) {
+ ret = bdev->bd_disk->fops->open(bdev, mode);
+- /* the same as first opener case, read comment there */
+- if (bdev->bd_invalidated && (!ret || ret == -ENOMEDIUM))
++ if (ret)
++ goto out_unlock_bdev;
++ }
++ if (bdev->bd_invalidated)
+ rescan_partitions(bdev->bd_disk, bdev);
+- if (ret)
+- goto out_unlock_bdev;
+ }
+ }
+ bdev->bd_openers++;
+diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
+index c4dbc63..e29581e 100644
+--- a/fs/cifs/cifsglob.h
++++ b/fs/cifs/cifsglob.h
+@@ -33,7 +33,7 @@
+ #define MAX_SHARE_SIZE 64 /* used to be 20, this should still be enough */
+ #define MAX_USERNAME_SIZE 32 /* 32 is to allow for 15 char names + null
+ termination then *2 for unicode versions */
+-#define MAX_PASSWORD_SIZE 16
++#define MAX_PASSWORD_SIZE 512 /* max for windows seems to be 256 wide chars */
+
+ #define CIFS_MIN_RCV_POOL 4
+
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 6234417..b6bb82e 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -1588,17 +1588,29 @@ out_err:
+ }
+
+ static struct cifsSesInfo *
+-cifs_find_smb_ses(struct TCP_Server_Info *server, char *username)
++cifs_find_smb_ses(struct TCP_Server_Info *server, struct smb_vol *vol)
+ {
+- struct list_head *tmp;
+ struct cifsSesInfo *ses;
+
+ write_lock(&cifs_tcp_ses_lock);
+- list_for_each(tmp, &server->smb_ses_list) {
+- ses = list_entry(tmp, struct cifsSesInfo, smb_ses_list);
+- if (strncmp(ses->userName, username, MAX_USERNAME_SIZE))
+- continue;
+-
++ list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {
++ switch (server->secType) {
++ case Kerberos:
++ if (vol->linux_uid != ses->linux_uid)
++ continue;
++ break;
++ default:
++ /* anything else takes username/password */
++ if (strncmp(ses->userName, vol->username,
++ MAX_USERNAME_SIZE))
++ continue;
++ if (strlen(vol->username) != 0 &&
++ ses->password != NULL &&
++ strncmp(ses->password,
++ vol->password ? vol->password : "",
++ MAX_PASSWORD_SIZE))
++ continue;
++ }
+ ++ses->ses_count;
+ write_unlock(&cifs_tcp_ses_lock);
+ return ses;
+@@ -2362,7 +2374,7 @@ try_mount_again:
+ goto out;
+ }
+
+- pSesInfo = cifs_find_smb_ses(srvTcp, volume_info->username);
++ pSesInfo = cifs_find_smb_ses(srvTcp, volume_info);
+ if (pSesInfo) {
+ cFYI(1, ("Existing smb sess found (status=%d)",
+ pSesInfo->status));
+diff --git a/fs/ext3/xattr.c b/fs/ext3/xattr.c
+index 387d92d..d7add4c 100644
+--- a/fs/ext3/xattr.c
++++ b/fs/ext3/xattr.c
+@@ -800,8 +800,16 @@ inserted:
+ /* We need to allocate a new block */
+ ext3_fsblk_t goal = ext3_group_first_block_no(sb,
+ EXT3_I(inode)->i_block_group);
+- ext3_fsblk_t block = ext3_new_block(handle, inode,
+- goal, &error);
++ ext3_fsblk_t block;
++
++ /*
++ * Protect us agaist concurrent allocations to the
++ * same inode from ext3_..._writepage(). Reservation
++ * code does not expect racing allocations.
++ */
++ mutex_lock(&EXT3_I(inode)->truncate_mutex);
++ block = ext3_new_block(handle, inode, goal, &error);
++ mutex_unlock(&EXT3_I(inode)->truncate_mutex);
+ if (error)
+ goto cleanup;
+ ea_idebug(inode, "creating block %d", block);
+diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
+index e81b2bf..7ee8ebc 100644
+--- a/fs/nfs/nfs4xdr.c
++++ b/fs/nfs/nfs4xdr.c
+@@ -88,7 +88,7 @@ static int nfs4_stat_to_errno(int);
+ #define encode_getfh_maxsz (op_encode_hdr_maxsz)
+ #define decode_getfh_maxsz (op_decode_hdr_maxsz + 1 + \
+ ((3+NFS4_FHSIZE) >> 2))
+-#define nfs4_fattr_bitmap_maxsz 3
++#define nfs4_fattr_bitmap_maxsz 4
+ #define encode_getattr_maxsz (op_encode_hdr_maxsz + nfs4_fattr_bitmap_maxsz)
+ #define nfs4_name_maxsz (1 + ((3 + NFS4_MAXNAMLEN) >> 2))
+ #define nfs4_path_maxsz (1 + ((3 + NFS4_MAXPATHLEN) >> 2))
+diff --git a/fs/proc/base.c b/fs/proc/base.c
+index 3d09a10..7b5819c 100644
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -2454,6 +2454,9 @@ static int do_io_accounting(struct task_struct *task, char *buffer, int whole)
+ struct task_io_accounting acct = task->ioac;
+ unsigned long flags;
+
++ if (!ptrace_may_access(task, PTRACE_MODE_READ))
++ return -EACCES;
++
+ if (whole && lock_task_sighand(task, &flags)) {
+ struct task_struct *t = task;
+
+@@ -2575,7 +2578,7 @@ static const struct pid_entry tgid_base_stuff[] = {
+ REG("coredump_filter", S_IRUGO|S_IWUSR, proc_coredump_filter_operations),
+ #endif
+ #ifdef CONFIG_TASK_IO_ACCOUNTING
+- INF("io", S_IRUGO, proc_tgid_io_accounting),
++ INF("io", S_IRUSR, proc_tgid_io_accounting),
+ #endif
+ };
+
+@@ -2910,7 +2913,7 @@ static const struct pid_entry tid_base_stuff[] = {
+ REG("make-it-fail", S_IRUGO|S_IWUSR, proc_fault_inject_operations),
+ #endif
+ #ifdef CONFIG_TASK_IO_ACCOUNTING
+- INF("io", S_IRUGO, proc_tid_io_accounting),
++ INF("io", S_IRUSR, proc_tid_io_accounting),
+ #endif
+ };
+
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index c27a182..9d7e8f7 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -1164,9 +1164,12 @@ static inline int skb_gro_header_hard(struct sk_buff *skb, unsigned int hlen)
+ static inline void *skb_gro_header_slow(struct sk_buff *skb, unsigned int hlen,
+ unsigned int offset)
+ {
++ if (!pskb_may_pull(skb, hlen))
++ return NULL;
++
+ NAPI_GRO_CB(skb)->frag0 = NULL;
+ NAPI_GRO_CB(skb)->frag0_len = 0;
+- return pskb_may_pull(skb, hlen) ? skb->data + offset : NULL;
++ return skb->data + offset;
+ }
+
+ static inline void *skb_gro_mac_header(struct sk_buff *skb)
+diff --git a/kernel/perf_event.c b/kernel/perf_event.c
+index fc5ab8e..37ebc14 100644
+--- a/kernel/perf_event.c
++++ b/kernel/perf_event.c
+@@ -3694,12 +3694,8 @@ static int __perf_event_overflow(struct perf_event *event, int nmi,
+ if (events && atomic_dec_and_test(&event->event_limit)) {
+ ret = 1;
+ event->pending_kill = POLL_HUP;
+- if (nmi) {
+- event->pending_disable = 1;
+- perf_pending_queue(&event->pending,
+- perf_pending_event);
+- } else
+- perf_event_disable(event);
++ event->pending_disable = 1;
++ perf_pending_queue(&event->pending, perf_pending_event);
+ }
+
+ perf_event_output(event, nmi, data, regs);
+diff --git a/net/atm/br2684.c b/net/atm/br2684.c
+index 26a646d..c9230c3 100644
+--- a/net/atm/br2684.c
++++ b/net/atm/br2684.c
+@@ -554,6 +554,12 @@ static const struct net_device_ops br2684_netdev_ops = {
+ .ndo_validate_addr = eth_validate_addr,
+ };
+
++static const struct net_device_ops br2684_netdev_ops_routed = {
++ .ndo_start_xmit = br2684_start_xmit,
++ .ndo_set_mac_address = br2684_mac_addr,
++ .ndo_change_mtu = eth_change_mtu
++};
++
+ static void br2684_setup(struct net_device *netdev)
+ {
+ struct br2684_dev *brdev = BRPRIV(netdev);
+@@ -569,11 +575,10 @@ static void br2684_setup(struct net_device *netdev)
+ static void br2684_setup_routed(struct net_device *netdev)
+ {
+ struct br2684_dev *brdev = BRPRIV(netdev);
+- brdev->net_dev = netdev;
+
++ brdev->net_dev = netdev;
+ netdev->hard_header_len = 0;
+-
+- netdev->netdev_ops = &br2684_netdev_ops;
++ netdev->netdev_ops = &br2684_netdev_ops_routed;
+ netdev->addr_len = 0;
+ netdev->mtu = 1500;
+ netdev->type = ARPHRD_PPP;
+diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
+index 2114e45..8567d47 100644
+--- a/net/bridge/br_private.h
++++ b/net/bridge/br_private.h
+@@ -75,6 +75,7 @@ struct net_bridge_port
+ bridge_id designated_bridge;
+ u32 path_cost;
+ u32 designated_cost;
++ unsigned long designated_age;
+
+ struct timer_list forward_delay_timer;
+ struct timer_list hold_timer;
+diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c
+index fd3f8d6..c7d6bfc 100644
+--- a/net/bridge/br_stp.c
++++ b/net/bridge/br_stp.c
+@@ -165,8 +165,7 @@ void br_transmit_config(struct net_bridge_port *p)
+ else {
+ struct net_bridge_port *root
+ = br_get_port(br, br->root_port);
+- bpdu.message_age = br->max_age
+- - (root->message_age_timer.expires - jiffies)
++ bpdu.message_age = (jiffies - root->designated_age)
+ + MESSAGE_AGE_INCR;
+ }
+ bpdu.max_age = br->max_age;
+@@ -190,6 +189,7 @@ static inline void br_record_config_information(struct net_bridge_port *p,
+ p->designated_cost = bpdu->root_path_cost;
+ p->designated_bridge = bpdu->bridge_id;
+ p->designated_port = bpdu->port_id;
++ p->designated_age = jiffies + bpdu->message_age;
+
+ mod_timer(&p->message_age_timer, jiffies
+ + (p->br->max_age - bpdu->message_age));
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index cfab9e4..f614584 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -1665,14 +1665,15 @@ static int __init ipgre_init(void)
+
+ printk(KERN_INFO "GRE over IPv4 tunneling driver\n");
+
+- if (inet_add_protocol(&ipgre_protocol, IPPROTO_GRE) < 0) {
+- printk(KERN_INFO "ipgre init: can't add protocol\n");
+- return -EAGAIN;
+- }
+-
+ err = register_pernet_gen_device(&ipgre_net_id, &ipgre_net_ops);
+ if (err < 0)
+- goto gen_device_failed;
++ return err;
++
++ err = inet_add_protocol(&ipgre_protocol, IPPROTO_GRE);
++ if (err < 0) {
++ printk(KERN_INFO "ipgre init: can't add protocol\n");
++ goto add_proto_failed;
++ }
+
+ err = rtnl_link_register(&ipgre_link_ops);
+ if (err < 0)
+@@ -1688,9 +1689,9 @@ out:
+ tap_ops_failed:
+ rtnl_link_unregister(&ipgre_link_ops);
+ rtnl_link_failed:
+- unregister_pernet_gen_device(ipgre_net_id, &ipgre_net_ops);
+-gen_device_failed:
+ inet_del_protocol(&ipgre_protocol, IPPROTO_GRE);
++add_proto_failed:
++ unregister_pernet_gen_device(ipgre_net_id, &ipgre_net_ops);
+ goto out;
+ }
+
+@@ -1698,9 +1699,9 @@ static void __exit ipgre_fini(void)
+ {
+ rtnl_link_unregister(&ipgre_tap_ops);
+ rtnl_link_unregister(&ipgre_link_ops);
+- unregister_pernet_gen_device(ipgre_net_id, &ipgre_net_ops);
+ if (inet_del_protocol(&ipgre_protocol, IPPROTO_GRE) < 0)
+ printk(KERN_INFO "ipgre close: can't remove protocol\n");
++ unregister_pernet_gen_device(ipgre_net_id, &ipgre_net_ops);
+ }
+
+ module_init(ipgre_init);
+diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
+index f37df1a..860b5c5 100644
+--- a/net/ipv4/ipip.c
++++ b/net/ipv4/ipip.c
+@@ -830,15 +830,14 @@ static int __init ipip_init(void)
+
+ printk(banner);
+
+- if (xfrm4_tunnel_register(&ipip_handler, AF_INET)) {
++ err = register_pernet_gen_device(&ipip_net_id, &ipip_net_ops);
++ if (err < 0)
++ return err;
++ err = xfrm4_tunnel_register(&ipip_handler, AF_INET);
++ if (err < 0) {
++ unregister_pernet_device(&ipip_net_ops);
+ printk(KERN_INFO "ipip init: can't register tunnel\n");
+- return -EAGAIN;
+ }
+-
+- err = register_pernet_gen_device(&ipip_net_id, &ipip_net_ops);
+- if (err)
+- xfrm4_tunnel_deregister(&ipip_handler, AF_INET);
+-
+ return err;
+ }
+
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index 9a95c82..7fb3e02 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -1466,27 +1466,29 @@ static int __init ip6_tunnel_init(void)
+ {
+ int err;
+
+- if (xfrm6_tunnel_register(&ip4ip6_handler, AF_INET)) {
++ err = register_pernet_device(&ip6_tnl_net_ops);
++ if (err < 0)
++ goto out_pernet;
++
++ err = xfrm6_tunnel_register(&ip4ip6_handler, AF_INET);
++ if (err < 0) {
+ printk(KERN_ERR "ip6_tunnel init: can't register ip4ip6\n");
+- err = -EAGAIN;
+- goto out;
++ goto out_ip4ip6;
+ }
+
+- if (xfrm6_tunnel_register(&ip6ip6_handler, AF_INET6)) {
++ err = xfrm6_tunnel_register(&ip6ip6_handler, AF_INET6);
++ if (err < 0) {
+ printk(KERN_ERR "ip6_tunnel init: can't register ip6ip6\n");
+- err = -EAGAIN;
+- goto unreg_ip4ip6;
++ goto out_ip6ip6;
+ }
+
+- err = register_pernet_gen_device(&ip6_tnl_net_id, &ip6_tnl_net_ops);
+- if (err < 0)
+- goto err_pernet;
+ return 0;
+-err_pernet:
+- xfrm6_tunnel_deregister(&ip6ip6_handler, AF_INET6);
+-unreg_ip4ip6:
++
++out_ip6ip6:
+ xfrm6_tunnel_deregister(&ip4ip6_handler, AF_INET);
+-out:
++out_ip4ip6:
++ unregister_pernet_device(&ip6_tnl_net_ops);
++out_pernet:
+ return err;
+ }
+
+diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
+index de2ffef..b128c07 100644
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -1086,15 +1086,14 @@ static int __init sit_init(void)
+
+ printk(KERN_INFO "IPv6 over IPv4 tunneling driver\n");
+
+- if (xfrm4_tunnel_register(&sit_handler, AF_INET6) < 0) {
+- printk(KERN_INFO "sit init: Can't add protocol\n");
+- return -EAGAIN;
+- }
+-
+ err = register_pernet_gen_device(&sit_net_id, &sit_net_ops);
+ if (err < 0)
+- xfrm4_tunnel_deregister(&sit_handler, AF_INET6);
+-
++ return err;
++ err = xfrm4_tunnel_register(&sit_handler, AF_INET6);
++ if (err < 0) {
++ unregister_pernet_device(&sit_net_ops);
++ printk(KERN_INFO "sit init: Can't add protocol\n");
++ }
+ return err;
+ }
+
+diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
+index 81a95c0..48bb1e3 100644
+--- a/net/ipv6/xfrm6_tunnel.c
++++ b/net/ipv6/xfrm6_tunnel.c
+@@ -344,32 +344,38 @@ static struct xfrm6_tunnel xfrm46_tunnel_handler = {
+
+ static int __init xfrm6_tunnel_init(void)
+ {
+- if (xfrm_register_type(&xfrm6_tunnel_type, AF_INET6) < 0)
++ int rv;
++
++ rv = xfrm6_tunnel_spi_init();
++ if (rv < 0)
+ goto err;
+- if (xfrm6_tunnel_register(&xfrm6_tunnel_handler, AF_INET6))
+- goto unreg;
+- if (xfrm6_tunnel_register(&xfrm46_tunnel_handler, AF_INET))
+- goto dereg6;
+- if (xfrm6_tunnel_spi_init() < 0)
+- goto dereg46;
++ rv = xfrm_register_type(&xfrm6_tunnel_type, AF_INET6);
++ if (rv < 0)
++ goto out_type;
++ rv = xfrm6_tunnel_register(&xfrm6_tunnel_handler, AF_INET6);
++ if (rv < 0)
++ goto out_xfrm6;
++ rv = xfrm6_tunnel_register(&xfrm46_tunnel_handler, AF_INET);
++ if (rv < 0)
++ goto out_xfrm46;
+ return 0;
+
+-dereg46:
+- xfrm6_tunnel_deregister(&xfrm46_tunnel_handler, AF_INET);
+-dereg6:
++out_xfrm46:
+ xfrm6_tunnel_deregister(&xfrm6_tunnel_handler, AF_INET6);
+-unreg:
++out_xfrm6:
+ xfrm_unregister_type(&xfrm6_tunnel_type, AF_INET6);
++out_type:
++ xfrm6_tunnel_spi_fini();
+ err:
+- return -EAGAIN;
++ return rv;
+ }
+
+ static void __exit xfrm6_tunnel_fini(void)
+ {
+- xfrm6_tunnel_spi_fini();
+ xfrm6_tunnel_deregister(&xfrm46_tunnel_handler, AF_INET);
+ xfrm6_tunnel_deregister(&xfrm6_tunnel_handler, AF_INET6);
+ xfrm_unregister_type(&xfrm6_tunnel_type, AF_INET6);
++ xfrm6_tunnel_spi_fini();
+ }
+
+ module_init(xfrm6_tunnel_init);
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index 5bea319..e67eea7 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -2308,6 +2308,9 @@ void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
+ {
+ struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+
++ if (!ifmgd->associated)
++ return;
++
+ if (test_and_clear_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running))
+ add_timer(&ifmgd->timer);
+ if (test_and_clear_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running))
+diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c
+index 830faf4..4418bb4 100644
+--- a/net/sunrpc/rpcb_clnt.c
++++ b/net/sunrpc/rpcb_clnt.c
+@@ -533,7 +533,7 @@ void rpcb_getport_async(struct rpc_task *task)
+ u32 bind_version;
+ struct rpc_xprt *xprt;
+ struct rpc_clnt *rpcb_clnt;
+- static struct rpcbind_args *map;
++ struct rpcbind_args *map;
+ struct rpc_task *child;
+ struct sockaddr_storage addr;
+ struct sockaddr *sap = (struct sockaddr *)&addr;
+diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
+index 9191b2f..570da30 100644
+--- a/net/sunrpc/sched.c
++++ b/net/sunrpc/sched.c
+@@ -613,30 +613,25 @@ static void __rpc_execute(struct rpc_task *task)
+ BUG_ON(RPC_IS_QUEUED(task));
+
+ for (;;) {
++ void (*do_action)(struct rpc_task *);
+
+ /*
+- * Execute any pending callback.
++ * Execute any pending callback first.
+ */
+- if (task->tk_callback) {
+- void (*save_callback)(struct rpc_task *);
+-
+- /*
+- * We set tk_callback to NULL before calling it,
+- * in case it sets the tk_callback field itself:
+- */
+- save_callback = task->tk_callback;
+- task->tk_callback = NULL;
+- save_callback(task);
+- } else {
++ do_action = task->tk_callback;
++ task->tk_callback = NULL;
++ if (do_action == NULL) {
+ /*
+ * Perform the next FSM step.
+- * tk_action may be NULL when the task has been killed
+- * by someone else.
++ * tk_action may be NULL if the task has been killed.
++ * In particular, note that rpc_killall_tasks may
++ * do this at any time, so beware when dereferencing.
+ */
+- if (task->tk_action == NULL)
++ do_action = task->tk_action;
++ if (do_action == NULL)
+ break;
+- task->tk_action(task);
+ }
++ do_action(task);
+
+ /*
+ * Lockless check for whether task is sleeping or not.
+diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
+index df760ad..cc1fb36 100644
+--- a/net/sunrpc/svc_xprt.c
++++ b/net/sunrpc/svc_xprt.c
+@@ -896,12 +896,13 @@ void svc_delete_xprt(struct svc_xprt *xprt)
+ if (!test_and_set_bit(XPT_DETACHED, &xprt->xpt_flags))
+ list_del_init(&xprt->xpt_list);
+ /*
+- * We used to delete the transport from whichever list
+- * it's sk_xprt.xpt_ready node was on, but we don't actually
+- * need to. This is because the only time we're called
+- * while still attached to a queue, the queue itself
+- * is about to be destroyed (in svc_destroy).
++ * The only time we're called while xpt_ready is still on a list
++ * is while the list itself is about to be destroyed (in
++ * svc_destroy). BUT svc_xprt_enqueue could still be attempting
++ * to add new entries to the sp_sockets list, so we can't leave
++ * a freed xprt on it.
+ */
++ list_del_init(&xprt->xpt_ready);
+ if (test_bit(XPT_TEMP, &xprt->xpt_flags))
+ serv->sv_tmpcnt--;
+
+diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c
+index 08bfed5..038232d 100644
+--- a/sound/core/pcm_compat.c
++++ b/sound/core/pcm_compat.c
+@@ -341,7 +341,7 @@ static int snd_pcm_ioctl_xfern_compat(struct snd_pcm_substream *substream,
+ kfree(bufs);
+ return -EFAULT;
+ }
+- bufs[ch] = compat_ptr(ptr);
++ bufs[i] = compat_ptr(ptr);
+ bufptr++;
+ }
+ if (dir == SNDRV_PCM_STREAM_PLAYBACK)
+diff --git a/sound/soc/blackfin/bf5xx-i2s-pcm.c b/sound/soc/blackfin/bf5xx-i2s-pcm.c
+index 62fbb84..77dae16 100644
+--- a/sound/soc/blackfin/bf5xx-i2s-pcm.c
++++ b/sound/soc/blackfin/bf5xx-i2s-pcm.c
+@@ -139,11 +139,20 @@ static snd_pcm_uframes_t bf5xx_pcm_pointer(struct snd_pcm_substream *substream)
+ pr_debug("%s enter\n", __func__);
+ if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
+ diff = sport_curr_offset_tx(sport);
+- frames = bytes_to_frames(substream->runtime, diff);
+ } else {
+ diff = sport_curr_offset_rx(sport);
+- frames = bytes_to_frames(substream->runtime, diff);
+ }
++
++ /*
++ * TX at least can report one frame beyond the end of the
++ * buffer if we hit the wraparound case - clamp to within the
++ * buffer as the ALSA APIs require.
++ */
++ if (diff == snd_pcm_lib_buffer_bytes(substream))
++ diff = 0;
++
++ frames = bytes_to_frames(substream->runtime, diff);
++
+ return frames;
+ }
+
^ permalink raw reply related [flat|nested] 13+ messages in thread* [gentoo-commits] proj/hardened-patchset:master commit in: 2.6.32/
@ 2011-08-12 20:06 Anthony G. Basile
0 siblings, 0 replies; 13+ messages in thread
From: Anthony G. Basile @ 2011-08-12 20:06 UTC (permalink / raw
To: gentoo-commits
commit: aff46239f291e666c90c669e47b283c14bddef94
Author: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Fri Aug 12 20:05:10 2011 +0000
Commit: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Fri Aug 12 20:05:10 2011 +0000
URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-patchset.git;a=commit;h=aff46239
Grsec/PaX 2.2.2-2.6.32.44-201108111959
---
2.6.32/0000_README | 2 +-
..._grsecurity-2.2.2-2.6.32.44-201108111959.patch} |10103 ++++++++++----------
2.6.32/4425_grsec-pax-without-grsec.patch | 6 +-
2.6.32/4430_grsec-kconfig-default-gids.patch | 14 +-
2.6.32/4435_grsec-kconfig-gentoo.patch | 2 +-
2.6.32/4437-grsec-kconfig-proc-user.patch | 4 +-
2.6.32/4440_selinux-avc_audit-log-curr_ip.patch | 2 +-
7 files changed, 5087 insertions(+), 5046 deletions(-)
diff --git a/2.6.32/0000_README b/2.6.32/0000_README
index 8ba09fe..97013da 100644
--- a/2.6.32/0000_README
+++ b/2.6.32/0000_README
@@ -3,7 +3,7 @@ README
Individual Patch Descriptions:
-----------------------------------------------------------------------------
-Patch: 4420_grsecurity-2.2.2-2.6.32.43-201108071948.patch
+Patch: 4420_grsecurity-2.2.2-2.6.32.44-201108111959.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/2.6.32/4420_grsecurity-2.2.2-2.6.32.43-201108071948.patch b/2.6.32/4420_grsecurity-2.2.2-2.6.32.44-201108111959.patch
similarity index 87%
rename from 2.6.32/4420_grsecurity-2.2.2-2.6.32.43-201108071948.patch
rename to 2.6.32/4420_grsecurity-2.2.2-2.6.32.44-201108111959.patch
index 04d1ce4..39c74d4 100644
--- a/2.6.32/4420_grsecurity-2.2.2-2.6.32.43-201108071948.patch
+++ b/2.6.32/4420_grsecurity-2.2.2-2.6.32.44-201108111959.patch
@@ -1,6 +1,6 @@
-diff -urNp linux-2.6.32.43/arch/alpha/include/asm/elf.h linux-2.6.32.43/arch/alpha/include/asm/elf.h
---- linux-2.6.32.43/arch/alpha/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/alpha/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/alpha/include/asm/elf.h linux-2.6.32.44/arch/alpha/include/asm/elf.h
+--- linux-2.6.32.44/arch/alpha/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/alpha/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
@@ -91,6 +91,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
#define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x1000000)
@@ -15,9 +15,9 @@ diff -urNp linux-2.6.32.43/arch/alpha/include/asm/elf.h linux-2.6.32.43/arch/alp
/* $0 is set by ld.so to a pointer to a function which might be
registered using atexit. This provides a mean for the dynamic
linker to call DT_FINI functions for shared libraries that have
-diff -urNp linux-2.6.32.43/arch/alpha/include/asm/pgtable.h linux-2.6.32.43/arch/alpha/include/asm/pgtable.h
---- linux-2.6.32.43/arch/alpha/include/asm/pgtable.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/alpha/include/asm/pgtable.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/alpha/include/asm/pgtable.h linux-2.6.32.44/arch/alpha/include/asm/pgtable.h
+--- linux-2.6.32.44/arch/alpha/include/asm/pgtable.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/alpha/include/asm/pgtable.h 2011-04-17 15:56:45.000000000 -0400
@@ -101,6 +101,17 @@ struct vm_area_struct;
#define PAGE_SHARED __pgprot(_PAGE_VALID | __ACCESS_BITS)
#define PAGE_COPY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
@@ -36,9 +36,9 @@ diff -urNp linux-2.6.32.43/arch/alpha/include/asm/pgtable.h linux-2.6.32.43/arch
#define PAGE_KERNEL __pgprot(_PAGE_VALID | _PAGE_ASM | _PAGE_KRE | _PAGE_KWE)
#define _PAGE_NORMAL(x) __pgprot(_PAGE_VALID | __ACCESS_BITS | (x))
-diff -urNp linux-2.6.32.43/arch/alpha/kernel/module.c linux-2.6.32.43/arch/alpha/kernel/module.c
---- linux-2.6.32.43/arch/alpha/kernel/module.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/alpha/kernel/module.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/alpha/kernel/module.c linux-2.6.32.44/arch/alpha/kernel/module.c
+--- linux-2.6.32.44/arch/alpha/kernel/module.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/alpha/kernel/module.c 2011-04-17 15:56:45.000000000 -0400
@@ -182,7 +182,7 @@ apply_relocate_add(Elf64_Shdr *sechdrs,
/* The small sections were sorted to the end of the segment.
@@ -48,62 +48,10 @@ diff -urNp linux-2.6.32.43/arch/alpha/kernel/module.c linux-2.6.32.43/arch/alpha
got = sechdrs[me->arch.gotsecindex].sh_addr;
for (i = 0; i < n; i++) {
-diff -urNp linux-2.6.32.43/arch/alpha/kernel/osf_sys.c linux-2.6.32.43/arch/alpha/kernel/osf_sys.c
---- linux-2.6.32.43/arch/alpha/kernel/osf_sys.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/alpha/kernel/osf_sys.c 2011-06-13 17:19:47.000000000 -0400
-@@ -431,7 +431,7 @@ SYSCALL_DEFINE2(osf_getdomainname, char
- return -EFAULT;
-
- len = namelen;
-- if (namelen > 32)
-+ if (len > 32)
- len = 32;
-
- down_read(&uts_sem);
-@@ -618,7 +618,7 @@ SYSCALL_DEFINE3(osf_sysinfo, int, comman
- down_read(&uts_sem);
- res = sysinfo_table[offset];
- len = strlen(res)+1;
-- if (len > count)
-+ if ((unsigned long)len > (unsigned long)count)
- len = count;
- if (copy_to_user(buf, res, len))
- err = -EFAULT;
-@@ -673,7 +673,7 @@ SYSCALL_DEFINE5(osf_getsysinfo, unsigned
- return 1;
-
- case GSI_GET_HWRPB:
-- if (nbytes < sizeof(*hwrpb))
-+ if (nbytes > sizeof(*hwrpb))
- return -EINVAL;
- if (copy_to_user(buffer, hwrpb, nbytes) != 0)
- return -EFAULT;
-@@ -1035,6 +1035,7 @@ SYSCALL_DEFINE4(osf_wait4, pid_t, pid, i
- {
- struct rusage r;
- long ret, err;
-+ unsigned int status = 0;
- mm_segment_t old_fs;
-
- if (!ur)
-@@ -1043,13 +1044,15 @@ SYSCALL_DEFINE4(osf_wait4, pid_t, pid, i
- old_fs = get_fs();
-
- set_fs (KERNEL_DS);
-- ret = sys_wait4(pid, ustatus, options, (struct rusage __user *) &r);
-+ ret = sys_wait4(pid, (unsigned int __user *) &status, options,
-+ (struct rusage __user *) &r);
- set_fs (old_fs);
-
- if (!access_ok(VERIFY_WRITE, ur, sizeof(*ur)))
- return -EFAULT;
-
- err = 0;
-+ err |= put_user(status, ustatus);
- err |= __put_user(r.ru_utime.tv_sec, &ur->ru_utime.tv_sec);
- err |= __put_user(r.ru_utime.tv_usec, &ur->ru_utime.tv_usec);
- err |= __put_user(r.ru_stime.tv_sec, &ur->ru_stime.tv_sec);
-@@ -1169,7 +1172,7 @@ arch_get_unmapped_area_1(unsigned long a
+diff -urNp linux-2.6.32.44/arch/alpha/kernel/osf_sys.c linux-2.6.32.44/arch/alpha/kernel/osf_sys.c
+--- linux-2.6.32.44/arch/alpha/kernel/osf_sys.c 2011-08-09 18:35:28.000000000 -0400
++++ linux-2.6.32.44/arch/alpha/kernel/osf_sys.c 2011-06-13 17:19:47.000000000 -0400
+@@ -1172,7 +1172,7 @@ arch_get_unmapped_area_1(unsigned long a
/* At this point: (!vma || addr < vma->vm_end). */
if (limit - len < addr)
return -ENOMEM;
@@ -112,7 +60,7 @@ diff -urNp linux-2.6.32.43/arch/alpha/kernel/osf_sys.c linux-2.6.32.43/arch/alph
return addr;
addr = vma->vm_end;
vma = vma->vm_next;
-@@ -1205,6 +1208,10 @@ arch_get_unmapped_area(struct file *filp
+@@ -1208,6 +1208,10 @@ arch_get_unmapped_area(struct file *filp
merely specific addresses, but regions of memory -- perhaps
this feature should be incorporated into all ports? */
@@ -123,7 +71,7 @@ diff -urNp linux-2.6.32.43/arch/alpha/kernel/osf_sys.c linux-2.6.32.43/arch/alph
if (addr) {
addr = arch_get_unmapped_area_1 (PAGE_ALIGN(addr), len, limit);
if (addr != (unsigned long) -ENOMEM)
-@@ -1212,8 +1219,8 @@ arch_get_unmapped_area(struct file *filp
+@@ -1215,8 +1219,8 @@ arch_get_unmapped_area(struct file *filp
}
/* Next, try allocating at TASK_UNMAPPED_BASE. */
@@ -134,9 +82,9 @@ diff -urNp linux-2.6.32.43/arch/alpha/kernel/osf_sys.c linux-2.6.32.43/arch/alph
if (addr != (unsigned long) -ENOMEM)
return addr;
-diff -urNp linux-2.6.32.43/arch/alpha/mm/fault.c linux-2.6.32.43/arch/alpha/mm/fault.c
---- linux-2.6.32.43/arch/alpha/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/alpha/mm/fault.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/alpha/mm/fault.c linux-2.6.32.44/arch/alpha/mm/fault.c
+--- linux-2.6.32.44/arch/alpha/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/alpha/mm/fault.c 2011-04-17 15:56:45.000000000 -0400
@@ -54,6 +54,124 @@ __load_new_mm_context(struct mm_struct *
__reload_thread(pcb);
}
@@ -293,9 +241,9 @@ diff -urNp linux-2.6.32.43/arch/alpha/mm/fault.c linux-2.6.32.43/arch/alpha/mm/f
} else if (!cause) {
/* Allow reads even for write-only mappings */
if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
-diff -urNp linux-2.6.32.43/arch/arm/include/asm/elf.h linux-2.6.32.43/arch/arm/include/asm/elf.h
---- linux-2.6.32.43/arch/arm/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/arm/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/arm/include/asm/elf.h linux-2.6.32.44/arch/arm/include/asm/elf.h
+--- linux-2.6.32.44/arch/arm/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/arm/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
@@ -109,7 +109,14 @@ int dump_task_regs(struct task_struct *t
the loader. We need to make sure that it is out of the way of the program
that it will "exec", and that there is sufficient room for the brk. */
@@ -312,9 +260,9 @@ diff -urNp linux-2.6.32.43/arch/arm/include/asm/elf.h linux-2.6.32.43/arch/arm/i
/* When the program starts, a1 contains a pointer to a function to be
registered with atexit, as per the SVR4 ABI. A value of 0 means we
-diff -urNp linux-2.6.32.43/arch/arm/include/asm/kmap_types.h linux-2.6.32.43/arch/arm/include/asm/kmap_types.h
---- linux-2.6.32.43/arch/arm/include/asm/kmap_types.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/arm/include/asm/kmap_types.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/arm/include/asm/kmap_types.h linux-2.6.32.44/arch/arm/include/asm/kmap_types.h
+--- linux-2.6.32.44/arch/arm/include/asm/kmap_types.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/arm/include/asm/kmap_types.h 2011-04-17 15:56:45.000000000 -0400
@@ -19,6 +19,7 @@ enum km_type {
KM_SOFTIRQ0,
KM_SOFTIRQ1,
@@ -323,9 +271,9 @@ diff -urNp linux-2.6.32.43/arch/arm/include/asm/kmap_types.h linux-2.6.32.43/arc
KM_TYPE_NR
};
-diff -urNp linux-2.6.32.43/arch/arm/include/asm/uaccess.h linux-2.6.32.43/arch/arm/include/asm/uaccess.h
---- linux-2.6.32.43/arch/arm/include/asm/uaccess.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/arm/include/asm/uaccess.h 2011-06-29 21:02:24.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/arm/include/asm/uaccess.h linux-2.6.32.44/arch/arm/include/asm/uaccess.h
+--- linux-2.6.32.44/arch/arm/include/asm/uaccess.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/arm/include/asm/uaccess.h 2011-06-29 21:02:24.000000000 -0400
@@ -22,6 +22,8 @@
#define VERIFY_READ 0
#define VERIFY_WRITE 1
@@ -381,9 +329,9 @@ diff -urNp linux-2.6.32.43/arch/arm/include/asm/uaccess.h linux-2.6.32.43/arch/a
if (access_ok(VERIFY_WRITE, to, n))
n = __copy_to_user(to, from, n);
return n;
-diff -urNp linux-2.6.32.43/arch/arm/kernel/armksyms.c linux-2.6.32.43/arch/arm/kernel/armksyms.c
---- linux-2.6.32.43/arch/arm/kernel/armksyms.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/arm/kernel/armksyms.c 2011-07-06 19:51:50.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/arm/kernel/armksyms.c linux-2.6.32.44/arch/arm/kernel/armksyms.c
+--- linux-2.6.32.44/arch/arm/kernel/armksyms.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/arm/kernel/armksyms.c 2011-07-06 19:51:50.000000000 -0400
@@ -118,8 +118,8 @@ EXPORT_SYMBOL(__strncpy_from_user);
#ifdef CONFIG_MMU
EXPORT_SYMBOL(copy_page);
@@ -395,9 +343,9 @@ diff -urNp linux-2.6.32.43/arch/arm/kernel/armksyms.c linux-2.6.32.43/arch/arm/k
EXPORT_SYMBOL(__clear_user);
EXPORT_SYMBOL(__get_user_1);
-diff -urNp linux-2.6.32.43/arch/arm/kernel/kgdb.c linux-2.6.32.43/arch/arm/kernel/kgdb.c
---- linux-2.6.32.43/arch/arm/kernel/kgdb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/arm/kernel/kgdb.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/arm/kernel/kgdb.c linux-2.6.32.44/arch/arm/kernel/kgdb.c
+--- linux-2.6.32.44/arch/arm/kernel/kgdb.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/arm/kernel/kgdb.c 2011-04-17 15:56:45.000000000 -0400
@@ -190,7 +190,7 @@ void kgdb_arch_exit(void)
* and we handle the normal undef case within the do_undefinstr
* handler.
@@ -407,9 +355,9 @@ diff -urNp linux-2.6.32.43/arch/arm/kernel/kgdb.c linux-2.6.32.43/arch/arm/kerne
#ifndef __ARMEB__
.gdb_bpt_instr = {0xfe, 0xde, 0xff, 0xe7}
#else /* ! __ARMEB__ */
-diff -urNp linux-2.6.32.43/arch/arm/kernel/traps.c linux-2.6.32.43/arch/arm/kernel/traps.c
---- linux-2.6.32.43/arch/arm/kernel/traps.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/arm/kernel/traps.c 2011-06-13 21:31:18.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/arm/kernel/traps.c linux-2.6.32.44/arch/arm/kernel/traps.c
+--- linux-2.6.32.44/arch/arm/kernel/traps.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/arm/kernel/traps.c 2011-06-13 21:31:18.000000000 -0400
@@ -247,6 +247,8 @@ static void __die(const char *str, int e
DEFINE_SPINLOCK(die_lock);
@@ -428,9 +376,9 @@ diff -urNp linux-2.6.32.43/arch/arm/kernel/traps.c linux-2.6.32.43/arch/arm/kern
do_exit(SIGSEGV);
}
-diff -urNp linux-2.6.32.43/arch/arm/lib/copy_from_user.S linux-2.6.32.43/arch/arm/lib/copy_from_user.S
---- linux-2.6.32.43/arch/arm/lib/copy_from_user.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/arm/lib/copy_from_user.S 2011-06-29 20:48:38.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/arm/lib/copy_from_user.S linux-2.6.32.44/arch/arm/lib/copy_from_user.S
+--- linux-2.6.32.44/arch/arm/lib/copy_from_user.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/arm/lib/copy_from_user.S 2011-06-29 20:48:38.000000000 -0400
@@ -16,7 +16,7 @@
/*
* Prototype:
@@ -454,9 +402,9 @@ diff -urNp linux-2.6.32.43/arch/arm/lib/copy_from_user.S linux-2.6.32.43/arch/ar
.section .fixup,"ax"
.align 0
-diff -urNp linux-2.6.32.43/arch/arm/lib/copy_to_user.S linux-2.6.32.43/arch/arm/lib/copy_to_user.S
---- linux-2.6.32.43/arch/arm/lib/copy_to_user.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/arm/lib/copy_to_user.S 2011-06-29 20:46:49.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/arm/lib/copy_to_user.S linux-2.6.32.44/arch/arm/lib/copy_to_user.S
+--- linux-2.6.32.44/arch/arm/lib/copy_to_user.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/arm/lib/copy_to_user.S 2011-06-29 20:46:49.000000000 -0400
@@ -16,7 +16,7 @@
/*
* Prototype:
@@ -480,9 +428,9 @@ diff -urNp linux-2.6.32.43/arch/arm/lib/copy_to_user.S linux-2.6.32.43/arch/arm/
.section .fixup,"ax"
.align 0
-diff -urNp linux-2.6.32.43/arch/arm/lib/uaccess.S linux-2.6.32.43/arch/arm/lib/uaccess.S
---- linux-2.6.32.43/arch/arm/lib/uaccess.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/arm/lib/uaccess.S 2011-06-29 20:48:53.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/arm/lib/uaccess.S linux-2.6.32.44/arch/arm/lib/uaccess.S
+--- linux-2.6.32.44/arch/arm/lib/uaccess.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/arm/lib/uaccess.S 2011-06-29 20:48:53.000000000 -0400
@@ -19,7 +19,7 @@
#define PAGE_SHIFT 12
@@ -536,9 +484,9 @@ diff -urNp linux-2.6.32.43/arch/arm/lib/uaccess.S linux-2.6.32.43/arch/arm/lib/u
.section .fixup,"ax"
.align 0
-diff -urNp linux-2.6.32.43/arch/arm/lib/uaccess_with_memcpy.c linux-2.6.32.43/arch/arm/lib/uaccess_with_memcpy.c
---- linux-2.6.32.43/arch/arm/lib/uaccess_with_memcpy.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/arm/lib/uaccess_with_memcpy.c 2011-06-29 20:44:35.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/arm/lib/uaccess_with_memcpy.c linux-2.6.32.44/arch/arm/lib/uaccess_with_memcpy.c
+--- linux-2.6.32.44/arch/arm/lib/uaccess_with_memcpy.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/arm/lib/uaccess_with_memcpy.c 2011-06-29 20:44:35.000000000 -0400
@@ -97,7 +97,7 @@ out:
}
@@ -548,9 +496,9 @@ diff -urNp linux-2.6.32.43/arch/arm/lib/uaccess_with_memcpy.c linux-2.6.32.43/ar
{
/*
* This test is stubbed out of the main function above to keep
-diff -urNp linux-2.6.32.43/arch/arm/mach-at91/pm.c linux-2.6.32.43/arch/arm/mach-at91/pm.c
---- linux-2.6.32.43/arch/arm/mach-at91/pm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/arm/mach-at91/pm.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/arm/mach-at91/pm.c linux-2.6.32.44/arch/arm/mach-at91/pm.c
+--- linux-2.6.32.44/arch/arm/mach-at91/pm.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/arm/mach-at91/pm.c 2011-04-17 15:56:45.000000000 -0400
@@ -348,7 +348,7 @@ static void at91_pm_end(void)
}
@@ -560,9 +508,9 @@ diff -urNp linux-2.6.32.43/arch/arm/mach-at91/pm.c linux-2.6.32.43/arch/arm/mach
.valid = at91_pm_valid_state,
.begin = at91_pm_begin,
.enter = at91_pm_enter,
-diff -urNp linux-2.6.32.43/arch/arm/mach-omap1/pm.c linux-2.6.32.43/arch/arm/mach-omap1/pm.c
---- linux-2.6.32.43/arch/arm/mach-omap1/pm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/arm/mach-omap1/pm.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/arm/mach-omap1/pm.c linux-2.6.32.44/arch/arm/mach-omap1/pm.c
+--- linux-2.6.32.44/arch/arm/mach-omap1/pm.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/arm/mach-omap1/pm.c 2011-04-17 15:56:45.000000000 -0400
@@ -647,7 +647,7 @@ static struct irqaction omap_wakeup_irq
@@ -572,9 +520,9 @@ diff -urNp linux-2.6.32.43/arch/arm/mach-omap1/pm.c linux-2.6.32.43/arch/arm/mac
.prepare = omap_pm_prepare,
.enter = omap_pm_enter,
.finish = omap_pm_finish,
-diff -urNp linux-2.6.32.43/arch/arm/mach-omap2/pm24xx.c linux-2.6.32.43/arch/arm/mach-omap2/pm24xx.c
---- linux-2.6.32.43/arch/arm/mach-omap2/pm24xx.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/arm/mach-omap2/pm24xx.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/arm/mach-omap2/pm24xx.c linux-2.6.32.44/arch/arm/mach-omap2/pm24xx.c
+--- linux-2.6.32.44/arch/arm/mach-omap2/pm24xx.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/arm/mach-omap2/pm24xx.c 2011-04-17 15:56:45.000000000 -0400
@@ -326,7 +326,7 @@ static void omap2_pm_finish(void)
enable_hlt();
}
@@ -584,9 +532,9 @@ diff -urNp linux-2.6.32.43/arch/arm/mach-omap2/pm24xx.c linux-2.6.32.43/arch/arm
.prepare = omap2_pm_prepare,
.enter = omap2_pm_enter,
.finish = omap2_pm_finish,
-diff -urNp linux-2.6.32.43/arch/arm/mach-omap2/pm34xx.c linux-2.6.32.43/arch/arm/mach-omap2/pm34xx.c
---- linux-2.6.32.43/arch/arm/mach-omap2/pm34xx.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/arm/mach-omap2/pm34xx.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/arm/mach-omap2/pm34xx.c linux-2.6.32.44/arch/arm/mach-omap2/pm34xx.c
+--- linux-2.6.32.44/arch/arm/mach-omap2/pm34xx.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/arm/mach-omap2/pm34xx.c 2011-04-17 15:56:45.000000000 -0400
@@ -401,7 +401,7 @@ static void omap3_pm_end(void)
return;
}
@@ -596,9 +544,9 @@ diff -urNp linux-2.6.32.43/arch/arm/mach-omap2/pm34xx.c linux-2.6.32.43/arch/arm
.begin = omap3_pm_begin,
.end = omap3_pm_end,
.prepare = omap3_pm_prepare,
-diff -urNp linux-2.6.32.43/arch/arm/mach-pnx4008/pm.c linux-2.6.32.43/arch/arm/mach-pnx4008/pm.c
---- linux-2.6.32.43/arch/arm/mach-pnx4008/pm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/arm/mach-pnx4008/pm.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/arm/mach-pnx4008/pm.c linux-2.6.32.44/arch/arm/mach-pnx4008/pm.c
+--- linux-2.6.32.44/arch/arm/mach-pnx4008/pm.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/arm/mach-pnx4008/pm.c 2011-04-17 15:56:45.000000000 -0400
@@ -116,7 +116,7 @@ static int pnx4008_pm_valid(suspend_stat
(state == PM_SUSPEND_MEM);
}
@@ -608,9 +556,9 @@ diff -urNp linux-2.6.32.43/arch/arm/mach-pnx4008/pm.c linux-2.6.32.43/arch/arm/m
.enter = pnx4008_pm_enter,
.valid = pnx4008_pm_valid,
};
-diff -urNp linux-2.6.32.43/arch/arm/mach-pxa/pm.c linux-2.6.32.43/arch/arm/mach-pxa/pm.c
---- linux-2.6.32.43/arch/arm/mach-pxa/pm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/arm/mach-pxa/pm.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/arm/mach-pxa/pm.c linux-2.6.32.44/arch/arm/mach-pxa/pm.c
+--- linux-2.6.32.44/arch/arm/mach-pxa/pm.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/arm/mach-pxa/pm.c 2011-04-17 15:56:45.000000000 -0400
@@ -95,7 +95,7 @@ void pxa_pm_finish(void)
pxa_cpu_pm_fns->finish();
}
@@ -620,9 +568,9 @@ diff -urNp linux-2.6.32.43/arch/arm/mach-pxa/pm.c linux-2.6.32.43/arch/arm/mach-
.valid = pxa_pm_valid,
.enter = pxa_pm_enter,
.prepare = pxa_pm_prepare,
-diff -urNp linux-2.6.32.43/arch/arm/mach-pxa/sharpsl_pm.c linux-2.6.32.43/arch/arm/mach-pxa/sharpsl_pm.c
---- linux-2.6.32.43/arch/arm/mach-pxa/sharpsl_pm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/arm/mach-pxa/sharpsl_pm.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/arm/mach-pxa/sharpsl_pm.c linux-2.6.32.44/arch/arm/mach-pxa/sharpsl_pm.c
+--- linux-2.6.32.44/arch/arm/mach-pxa/sharpsl_pm.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/arm/mach-pxa/sharpsl_pm.c 2011-04-17 15:56:45.000000000 -0400
@@ -891,7 +891,7 @@ static void sharpsl_apm_get_power_status
}
@@ -632,9 +580,9 @@ diff -urNp linux-2.6.32.43/arch/arm/mach-pxa/sharpsl_pm.c linux-2.6.32.43/arch/a
.prepare = pxa_pm_prepare,
.finish = pxa_pm_finish,
.enter = corgi_pxa_pm_enter,
-diff -urNp linux-2.6.32.43/arch/arm/mach-sa1100/pm.c linux-2.6.32.43/arch/arm/mach-sa1100/pm.c
---- linux-2.6.32.43/arch/arm/mach-sa1100/pm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/arm/mach-sa1100/pm.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/arm/mach-sa1100/pm.c linux-2.6.32.44/arch/arm/mach-sa1100/pm.c
+--- linux-2.6.32.44/arch/arm/mach-sa1100/pm.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/arm/mach-sa1100/pm.c 2011-04-17 15:56:45.000000000 -0400
@@ -120,7 +120,7 @@ unsigned long sleep_phys_sp(void *sp)
return virt_to_phys(sp);
}
@@ -644,9 +592,9 @@ diff -urNp linux-2.6.32.43/arch/arm/mach-sa1100/pm.c linux-2.6.32.43/arch/arm/ma
.enter = sa11x0_pm_enter,
.valid = suspend_valid_only_mem,
};
-diff -urNp linux-2.6.32.43/arch/arm/mm/fault.c linux-2.6.32.43/arch/arm/mm/fault.c
---- linux-2.6.32.43/arch/arm/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/arm/mm/fault.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/arm/mm/fault.c linux-2.6.32.44/arch/arm/mm/fault.c
+--- linux-2.6.32.44/arch/arm/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/arm/mm/fault.c 2011-04-17 15:56:45.000000000 -0400
@@ -166,6 +166,13 @@ __do_user_fault(struct task_struct *tsk,
}
#endif
@@ -695,9 +643,9 @@ diff -urNp linux-2.6.32.43/arch/arm/mm/fault.c linux-2.6.32.43/arch/arm/mm/fault
/*
* First Level Translation Fault Handler
*
-diff -urNp linux-2.6.32.43/arch/arm/mm/mmap.c linux-2.6.32.43/arch/arm/mm/mmap.c
---- linux-2.6.32.43/arch/arm/mm/mmap.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/arm/mm/mmap.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/arm/mm/mmap.c linux-2.6.32.44/arch/arm/mm/mmap.c
+--- linux-2.6.32.44/arch/arm/mm/mmap.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/arm/mm/mmap.c 2011-04-17 15:56:45.000000000 -0400
@@ -63,6 +63,10 @@ arch_get_unmapped_area(struct file *filp
if (len > TASK_SIZE)
return -ENOMEM;
@@ -747,9 +695,9 @@ diff -urNp linux-2.6.32.43/arch/arm/mm/mmap.c linux-2.6.32.43/arch/arm/mm/mmap.c
/*
* Remember the place where we stopped the search:
*/
-diff -urNp linux-2.6.32.43/arch/arm/plat-s3c/pm.c linux-2.6.32.43/arch/arm/plat-s3c/pm.c
---- linux-2.6.32.43/arch/arm/plat-s3c/pm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/arm/plat-s3c/pm.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/arm/plat-s3c/pm.c linux-2.6.32.44/arch/arm/plat-s3c/pm.c
+--- linux-2.6.32.44/arch/arm/plat-s3c/pm.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/arm/plat-s3c/pm.c 2011-04-17 15:56:45.000000000 -0400
@@ -355,7 +355,7 @@ static void s3c_pm_finish(void)
s3c_pm_check_cleanup();
}
@@ -759,9 +707,9 @@ diff -urNp linux-2.6.32.43/arch/arm/plat-s3c/pm.c linux-2.6.32.43/arch/arm/plat-
.enter = s3c_pm_enter,
.prepare = s3c_pm_prepare,
.finish = s3c_pm_finish,
-diff -urNp linux-2.6.32.43/arch/avr32/include/asm/elf.h linux-2.6.32.43/arch/avr32/include/asm/elf.h
---- linux-2.6.32.43/arch/avr32/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/avr32/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/avr32/include/asm/elf.h linux-2.6.32.44/arch/avr32/include/asm/elf.h
+--- linux-2.6.32.44/arch/avr32/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/avr32/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
@@ -85,8 +85,14 @@ typedef struct user_fpu_struct elf_fpreg
the loader. We need to make sure that it is out of the way of the program
that it will "exec", and that there is sufficient room for the brk. */
@@ -778,9 +726,9 @@ diff -urNp linux-2.6.32.43/arch/avr32/include/asm/elf.h linux-2.6.32.43/arch/avr
/* This yields a mask that user programs can use to figure out what
instruction set this CPU supports. This could be done in user space,
-diff -urNp linux-2.6.32.43/arch/avr32/include/asm/kmap_types.h linux-2.6.32.43/arch/avr32/include/asm/kmap_types.h
---- linux-2.6.32.43/arch/avr32/include/asm/kmap_types.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/avr32/include/asm/kmap_types.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/avr32/include/asm/kmap_types.h linux-2.6.32.44/arch/avr32/include/asm/kmap_types.h
+--- linux-2.6.32.44/arch/avr32/include/asm/kmap_types.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/avr32/include/asm/kmap_types.h 2011-04-17 15:56:45.000000000 -0400
@@ -22,7 +22,8 @@ D(10) KM_IRQ0,
D(11) KM_IRQ1,
D(12) KM_SOFTIRQ0,
@@ -791,9 +739,9 @@ diff -urNp linux-2.6.32.43/arch/avr32/include/asm/kmap_types.h linux-2.6.32.43/a
};
#undef D
-diff -urNp linux-2.6.32.43/arch/avr32/mach-at32ap/pm.c linux-2.6.32.43/arch/avr32/mach-at32ap/pm.c
---- linux-2.6.32.43/arch/avr32/mach-at32ap/pm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/avr32/mach-at32ap/pm.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/avr32/mach-at32ap/pm.c linux-2.6.32.44/arch/avr32/mach-at32ap/pm.c
+--- linux-2.6.32.44/arch/avr32/mach-at32ap/pm.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/avr32/mach-at32ap/pm.c 2011-04-17 15:56:45.000000000 -0400
@@ -176,7 +176,7 @@ out:
return 0;
}
@@ -803,9 +751,9 @@ diff -urNp linux-2.6.32.43/arch/avr32/mach-at32ap/pm.c linux-2.6.32.43/arch/avr3
.valid = avr32_pm_valid_state,
.enter = avr32_pm_enter,
};
-diff -urNp linux-2.6.32.43/arch/avr32/mm/fault.c linux-2.6.32.43/arch/avr32/mm/fault.c
---- linux-2.6.32.43/arch/avr32/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/avr32/mm/fault.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/avr32/mm/fault.c linux-2.6.32.44/arch/avr32/mm/fault.c
+--- linux-2.6.32.44/arch/avr32/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/avr32/mm/fault.c 2011-04-17 15:56:45.000000000 -0400
@@ -41,6 +41,23 @@ static inline int notify_page_fault(stru
int exception_trace = 1;
@@ -847,9 +795,9 @@ diff -urNp linux-2.6.32.43/arch/avr32/mm/fault.c linux-2.6.32.43/arch/avr32/mm/f
if (exception_trace && printk_ratelimit())
printk("%s%s[%d]: segfault at %08lx pc %08lx "
"sp %08lx ecr %lu\n",
-diff -urNp linux-2.6.32.43/arch/blackfin/kernel/kgdb.c linux-2.6.32.43/arch/blackfin/kernel/kgdb.c
---- linux-2.6.32.43/arch/blackfin/kernel/kgdb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/blackfin/kernel/kgdb.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/blackfin/kernel/kgdb.c linux-2.6.32.44/arch/blackfin/kernel/kgdb.c
+--- linux-2.6.32.44/arch/blackfin/kernel/kgdb.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/blackfin/kernel/kgdb.c 2011-04-17 15:56:45.000000000 -0400
@@ -428,7 +428,7 @@ int kgdb_arch_handle_exception(int vecto
return -1; /* this means that we do not want to exit from the handler */
}
@@ -859,9 +807,9 @@ diff -urNp linux-2.6.32.43/arch/blackfin/kernel/kgdb.c linux-2.6.32.43/arch/blac
.gdb_bpt_instr = {0xa1},
#ifdef CONFIG_SMP
.flags = KGDB_HW_BREAKPOINT|KGDB_THR_PROC_SWAP,
-diff -urNp linux-2.6.32.43/arch/blackfin/mach-common/pm.c linux-2.6.32.43/arch/blackfin/mach-common/pm.c
---- linux-2.6.32.43/arch/blackfin/mach-common/pm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/blackfin/mach-common/pm.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/blackfin/mach-common/pm.c linux-2.6.32.44/arch/blackfin/mach-common/pm.c
+--- linux-2.6.32.44/arch/blackfin/mach-common/pm.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/blackfin/mach-common/pm.c 2011-04-17 15:56:45.000000000 -0400
@@ -255,7 +255,7 @@ static int bfin_pm_enter(suspend_state_t
return 0;
}
@@ -871,9 +819,9 @@ diff -urNp linux-2.6.32.43/arch/blackfin/mach-common/pm.c linux-2.6.32.43/arch/b
.enter = bfin_pm_enter,
.valid = bfin_pm_valid,
};
-diff -urNp linux-2.6.32.43/arch/frv/include/asm/kmap_types.h linux-2.6.32.43/arch/frv/include/asm/kmap_types.h
---- linux-2.6.32.43/arch/frv/include/asm/kmap_types.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/frv/include/asm/kmap_types.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/frv/include/asm/kmap_types.h linux-2.6.32.44/arch/frv/include/asm/kmap_types.h
+--- linux-2.6.32.44/arch/frv/include/asm/kmap_types.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/frv/include/asm/kmap_types.h 2011-04-17 15:56:45.000000000 -0400
@@ -23,6 +23,7 @@ enum km_type {
KM_IRQ1,
KM_SOFTIRQ0,
@@ -882,9 +830,9 @@ diff -urNp linux-2.6.32.43/arch/frv/include/asm/kmap_types.h linux-2.6.32.43/arc
KM_TYPE_NR
};
-diff -urNp linux-2.6.32.43/arch/frv/mm/elf-fdpic.c linux-2.6.32.43/arch/frv/mm/elf-fdpic.c
---- linux-2.6.32.43/arch/frv/mm/elf-fdpic.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/frv/mm/elf-fdpic.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/frv/mm/elf-fdpic.c linux-2.6.32.44/arch/frv/mm/elf-fdpic.c
+--- linux-2.6.32.44/arch/frv/mm/elf-fdpic.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/frv/mm/elf-fdpic.c 2011-04-17 15:56:45.000000000 -0400
@@ -73,8 +73,7 @@ unsigned long arch_get_unmapped_area(str
if (addr) {
addr = PAGE_ALIGN(addr);
@@ -913,9 +861,9 @@ diff -urNp linux-2.6.32.43/arch/frv/mm/elf-fdpic.c linux-2.6.32.43/arch/frv/mm/e
goto success;
addr = vma->vm_end;
}
-diff -urNp linux-2.6.32.43/arch/ia64/hp/common/hwsw_iommu.c linux-2.6.32.43/arch/ia64/hp/common/hwsw_iommu.c
---- linux-2.6.32.43/arch/ia64/hp/common/hwsw_iommu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/ia64/hp/common/hwsw_iommu.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/ia64/hp/common/hwsw_iommu.c linux-2.6.32.44/arch/ia64/hp/common/hwsw_iommu.c
+--- linux-2.6.32.44/arch/ia64/hp/common/hwsw_iommu.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/ia64/hp/common/hwsw_iommu.c 2011-04-17 15:56:45.000000000 -0400
@@ -17,7 +17,7 @@
#include <linux/swiotlb.h>
#include <asm/machvec.h>
@@ -934,9 +882,9 @@ diff -urNp linux-2.6.32.43/arch/ia64/hp/common/hwsw_iommu.c linux-2.6.32.43/arch
{
if (use_swiotlb(dev))
return &swiotlb_dma_ops;
-diff -urNp linux-2.6.32.43/arch/ia64/hp/common/sba_iommu.c linux-2.6.32.43/arch/ia64/hp/common/sba_iommu.c
---- linux-2.6.32.43/arch/ia64/hp/common/sba_iommu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/ia64/hp/common/sba_iommu.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/ia64/hp/common/sba_iommu.c linux-2.6.32.44/arch/ia64/hp/common/sba_iommu.c
+--- linux-2.6.32.44/arch/ia64/hp/common/sba_iommu.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/ia64/hp/common/sba_iommu.c 2011-04-17 15:56:45.000000000 -0400
@@ -2097,7 +2097,7 @@ static struct acpi_driver acpi_sba_ioc_d
},
};
@@ -955,9 +903,9 @@ diff -urNp linux-2.6.32.43/arch/ia64/hp/common/sba_iommu.c linux-2.6.32.43/arch/
.alloc_coherent = sba_alloc_coherent,
.free_coherent = sba_free_coherent,
.map_page = sba_map_page,
-diff -urNp linux-2.6.32.43/arch/ia64/ia32/binfmt_elf32.c linux-2.6.32.43/arch/ia64/ia32/binfmt_elf32.c
---- linux-2.6.32.43/arch/ia64/ia32/binfmt_elf32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/ia64/ia32/binfmt_elf32.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/ia64/ia32/binfmt_elf32.c linux-2.6.32.44/arch/ia64/ia32/binfmt_elf32.c
+--- linux-2.6.32.44/arch/ia64/ia32/binfmt_elf32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/ia64/ia32/binfmt_elf32.c 2011-04-17 15:56:45.000000000 -0400
@@ -45,6 +45,13 @@ randomize_stack_top(unsigned long stack_
#define elf_read_implies_exec(ex, have_pt_gnu_stack) (!(have_pt_gnu_stack))
@@ -972,9 +920,9 @@ diff -urNp linux-2.6.32.43/arch/ia64/ia32/binfmt_elf32.c linux-2.6.32.43/arch/ia
/* Ugly but avoids duplication */
#include "../../../fs/binfmt_elf.c"
-diff -urNp linux-2.6.32.43/arch/ia64/ia32/ia32priv.h linux-2.6.32.43/arch/ia64/ia32/ia32priv.h
---- linux-2.6.32.43/arch/ia64/ia32/ia32priv.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/ia64/ia32/ia32priv.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/ia64/ia32/ia32priv.h linux-2.6.32.44/arch/ia64/ia32/ia32priv.h
+--- linux-2.6.32.44/arch/ia64/ia32/ia32priv.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/ia64/ia32/ia32priv.h 2011-04-17 15:56:45.000000000 -0400
@@ -296,7 +296,14 @@ typedef struct compat_siginfo {
#define ELF_DATA ELFDATA2LSB
#define ELF_ARCH EM_386
@@ -991,9 +939,9 @@ diff -urNp linux-2.6.32.43/arch/ia64/ia32/ia32priv.h linux-2.6.32.43/arch/ia64/i
#define IA32_GATE_OFFSET IA32_PAGE_OFFSET
#define IA32_GATE_END IA32_PAGE_OFFSET + PAGE_SIZE
-diff -urNp linux-2.6.32.43/arch/ia64/include/asm/dma-mapping.h linux-2.6.32.43/arch/ia64/include/asm/dma-mapping.h
---- linux-2.6.32.43/arch/ia64/include/asm/dma-mapping.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/ia64/include/asm/dma-mapping.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/ia64/include/asm/dma-mapping.h linux-2.6.32.44/arch/ia64/include/asm/dma-mapping.h
+--- linux-2.6.32.44/arch/ia64/include/asm/dma-mapping.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/ia64/include/asm/dma-mapping.h 2011-04-17 15:56:45.000000000 -0400
@@ -12,7 +12,7 @@
#define ARCH_HAS_DMA_GET_REQUIRED_MASK
@@ -1037,9 +985,9 @@ diff -urNp linux-2.6.32.43/arch/ia64/include/asm/dma-mapping.h linux-2.6.32.43/a
return ops->dma_supported(dev, mask);
}
-diff -urNp linux-2.6.32.43/arch/ia64/include/asm/elf.h linux-2.6.32.43/arch/ia64/include/asm/elf.h
---- linux-2.6.32.43/arch/ia64/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/ia64/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/ia64/include/asm/elf.h linux-2.6.32.44/arch/ia64/include/asm/elf.h
+--- linux-2.6.32.44/arch/ia64/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/ia64/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
@@ -43,6 +43,13 @@
*/
#define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x800000000UL)
@@ -1054,9 +1002,9 @@ diff -urNp linux-2.6.32.43/arch/ia64/include/asm/elf.h linux-2.6.32.43/arch/ia64
#define PT_IA_64_UNWIND 0x70000001
/* IA-64 relocations: */
-diff -urNp linux-2.6.32.43/arch/ia64/include/asm/machvec.h linux-2.6.32.43/arch/ia64/include/asm/machvec.h
---- linux-2.6.32.43/arch/ia64/include/asm/machvec.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/ia64/include/asm/machvec.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/ia64/include/asm/machvec.h linux-2.6.32.44/arch/ia64/include/asm/machvec.h
+--- linux-2.6.32.44/arch/ia64/include/asm/machvec.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/ia64/include/asm/machvec.h 2011-04-17 15:56:45.000000000 -0400
@@ -45,7 +45,7 @@ typedef void ia64_mv_kernel_launch_event
/* DMA-mapping interface: */
typedef void ia64_mv_dma_init (void);
@@ -1075,9 +1023,9 @@ diff -urNp linux-2.6.32.43/arch/ia64/include/asm/machvec.h linux-2.6.32.43/arch/
/*
* Define default versions so we can extend machvec for new platforms without having
-diff -urNp linux-2.6.32.43/arch/ia64/include/asm/pgtable.h linux-2.6.32.43/arch/ia64/include/asm/pgtable.h
---- linux-2.6.32.43/arch/ia64/include/asm/pgtable.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/ia64/include/asm/pgtable.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/ia64/include/asm/pgtable.h linux-2.6.32.44/arch/ia64/include/asm/pgtable.h
+--- linux-2.6.32.44/arch/ia64/include/asm/pgtable.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/ia64/include/asm/pgtable.h 2011-04-17 15:56:45.000000000 -0400
@@ -12,7 +12,7 @@
* David Mosberger-Tang <davidm@hpl.hp.com>
*/
@@ -1105,9 +1053,9 @@ diff -urNp linux-2.6.32.43/arch/ia64/include/asm/pgtable.h linux-2.6.32.43/arch/
#define PAGE_GATE __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_X_RX)
#define PAGE_KERNEL __pgprot(__DIRTY_BITS | _PAGE_PL_0 | _PAGE_AR_RWX)
#define PAGE_KERNELRX __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_RX)
-diff -urNp linux-2.6.32.43/arch/ia64/include/asm/spinlock.h linux-2.6.32.43/arch/ia64/include/asm/spinlock.h
---- linux-2.6.32.43/arch/ia64/include/asm/spinlock.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/ia64/include/asm/spinlock.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/ia64/include/asm/spinlock.h linux-2.6.32.44/arch/ia64/include/asm/spinlock.h
+--- linux-2.6.32.44/arch/ia64/include/asm/spinlock.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/ia64/include/asm/spinlock.h 2011-04-17 15:56:45.000000000 -0400
@@ -72,7 +72,7 @@ static __always_inline void __ticket_spi
unsigned short *p = (unsigned short *)&lock->lock + 1, tmp;
@@ -1117,9 +1065,9 @@ diff -urNp linux-2.6.32.43/arch/ia64/include/asm/spinlock.h linux-2.6.32.43/arch
}
static __always_inline void __ticket_spin_unlock_wait(raw_spinlock_t *lock)
-diff -urNp linux-2.6.32.43/arch/ia64/include/asm/uaccess.h linux-2.6.32.43/arch/ia64/include/asm/uaccess.h
---- linux-2.6.32.43/arch/ia64/include/asm/uaccess.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/ia64/include/asm/uaccess.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/ia64/include/asm/uaccess.h linux-2.6.32.44/arch/ia64/include/asm/uaccess.h
+--- linux-2.6.32.44/arch/ia64/include/asm/uaccess.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/ia64/include/asm/uaccess.h 2011-04-17 15:56:45.000000000 -0400
@@ -257,7 +257,7 @@ __copy_from_user (void *to, const void _
const void *__cu_from = (from); \
long __cu_len = (n); \
@@ -1138,9 +1086,9 @@ diff -urNp linux-2.6.32.43/arch/ia64/include/asm/uaccess.h linux-2.6.32.43/arch/
__cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len); \
__cu_len; \
})
-diff -urNp linux-2.6.32.43/arch/ia64/kernel/dma-mapping.c linux-2.6.32.43/arch/ia64/kernel/dma-mapping.c
---- linux-2.6.32.43/arch/ia64/kernel/dma-mapping.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/ia64/kernel/dma-mapping.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/ia64/kernel/dma-mapping.c linux-2.6.32.44/arch/ia64/kernel/dma-mapping.c
+--- linux-2.6.32.44/arch/ia64/kernel/dma-mapping.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/ia64/kernel/dma-mapping.c 2011-04-17 15:56:45.000000000 -0400
@@ -3,7 +3,7 @@
/* Set this to 1 if there is a HW IOMMU in the system */
int iommu_detected __read_mostly;
@@ -1159,9 +1107,9 @@ diff -urNp linux-2.6.32.43/arch/ia64/kernel/dma-mapping.c linux-2.6.32.43/arch/i
{
return dma_ops;
}
-diff -urNp linux-2.6.32.43/arch/ia64/kernel/module.c linux-2.6.32.43/arch/ia64/kernel/module.c
---- linux-2.6.32.43/arch/ia64/kernel/module.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/ia64/kernel/module.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/ia64/kernel/module.c linux-2.6.32.44/arch/ia64/kernel/module.c
+--- linux-2.6.32.44/arch/ia64/kernel/module.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/ia64/kernel/module.c 2011-04-17 15:56:45.000000000 -0400
@@ -315,8 +315,7 @@ module_alloc (unsigned long size)
void
module_free (struct module *mod, void *module_region)
@@ -1250,9 +1198,9 @@ diff -urNp linux-2.6.32.43/arch/ia64/kernel/module.c linux-2.6.32.43/arch/ia64/k
mod->arch.gp = gp;
DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp);
}
-diff -urNp linux-2.6.32.43/arch/ia64/kernel/pci-dma.c linux-2.6.32.43/arch/ia64/kernel/pci-dma.c
---- linux-2.6.32.43/arch/ia64/kernel/pci-dma.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/ia64/kernel/pci-dma.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/ia64/kernel/pci-dma.c linux-2.6.32.44/arch/ia64/kernel/pci-dma.c
+--- linux-2.6.32.44/arch/ia64/kernel/pci-dma.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/ia64/kernel/pci-dma.c 2011-04-17 15:56:45.000000000 -0400
@@ -43,7 +43,7 @@ struct device fallback_dev = {
.dma_mask = &fallback_dev.coherent_dma_mask,
};
@@ -1304,9 +1252,9 @@ diff -urNp linux-2.6.32.43/arch/ia64/kernel/pci-dma.c linux-2.6.32.43/arch/ia64/
/*
* The order of these functions is important for
-diff -urNp linux-2.6.32.43/arch/ia64/kernel/pci-swiotlb.c linux-2.6.32.43/arch/ia64/kernel/pci-swiotlb.c
---- linux-2.6.32.43/arch/ia64/kernel/pci-swiotlb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/ia64/kernel/pci-swiotlb.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/ia64/kernel/pci-swiotlb.c linux-2.6.32.44/arch/ia64/kernel/pci-swiotlb.c
+--- linux-2.6.32.44/arch/ia64/kernel/pci-swiotlb.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/ia64/kernel/pci-swiotlb.c 2011-04-17 15:56:45.000000000 -0400
@@ -21,7 +21,7 @@ static void *ia64_swiotlb_alloc_coherent
return swiotlb_alloc_coherent(dev, size, dma_handle, gfp);
}
@@ -1316,9 +1264,9 @@ diff -urNp linux-2.6.32.43/arch/ia64/kernel/pci-swiotlb.c linux-2.6.32.43/arch/i
.alloc_coherent = ia64_swiotlb_alloc_coherent,
.free_coherent = swiotlb_free_coherent,
.map_page = swiotlb_map_page,
-diff -urNp linux-2.6.32.43/arch/ia64/kernel/sys_ia64.c linux-2.6.32.43/arch/ia64/kernel/sys_ia64.c
---- linux-2.6.32.43/arch/ia64/kernel/sys_ia64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/ia64/kernel/sys_ia64.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/ia64/kernel/sys_ia64.c linux-2.6.32.44/arch/ia64/kernel/sys_ia64.c
+--- linux-2.6.32.44/arch/ia64/kernel/sys_ia64.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/ia64/kernel/sys_ia64.c 2011-04-17 15:56:45.000000000 -0400
@@ -43,6 +43,13 @@ arch_get_unmapped_area (struct file *fil
if (REGION_NUMBER(addr) == RGN_HPAGE)
addr = 0;
@@ -1351,9 +1299,9 @@ diff -urNp linux-2.6.32.43/arch/ia64/kernel/sys_ia64.c linux-2.6.32.43/arch/ia64
/* Remember the address where we stopped this search: */
mm->free_area_cache = addr + len;
return addr;
-diff -urNp linux-2.6.32.43/arch/ia64/kernel/topology.c linux-2.6.32.43/arch/ia64/kernel/topology.c
---- linux-2.6.32.43/arch/ia64/kernel/topology.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/ia64/kernel/topology.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/ia64/kernel/topology.c linux-2.6.32.44/arch/ia64/kernel/topology.c
+--- linux-2.6.32.44/arch/ia64/kernel/topology.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/ia64/kernel/topology.c 2011-04-17 15:56:45.000000000 -0400
@@ -282,7 +282,7 @@ static ssize_t cache_show(struct kobject
return ret;
}
@@ -1363,9 +1311,9 @@ diff -urNp linux-2.6.32.43/arch/ia64/kernel/topology.c linux-2.6.32.43/arch/ia64
.show = cache_show
};
-diff -urNp linux-2.6.32.43/arch/ia64/kernel/vmlinux.lds.S linux-2.6.32.43/arch/ia64/kernel/vmlinux.lds.S
---- linux-2.6.32.43/arch/ia64/kernel/vmlinux.lds.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/ia64/kernel/vmlinux.lds.S 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/ia64/kernel/vmlinux.lds.S linux-2.6.32.44/arch/ia64/kernel/vmlinux.lds.S
+--- linux-2.6.32.44/arch/ia64/kernel/vmlinux.lds.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/ia64/kernel/vmlinux.lds.S 2011-04-17 15:56:45.000000000 -0400
@@ -190,7 +190,7 @@ SECTIONS
/* Per-cpu data: */
. = ALIGN(PERCPU_PAGE_SIZE);
@@ -1375,9 +1323,9 @@ diff -urNp linux-2.6.32.43/arch/ia64/kernel/vmlinux.lds.S linux-2.6.32.43/arch/i
. = __phys_per_cpu_start + PERCPU_PAGE_SIZE; /* ensure percpu data fits
* into percpu page size
*/
-diff -urNp linux-2.6.32.43/arch/ia64/mm/fault.c linux-2.6.32.43/arch/ia64/mm/fault.c
---- linux-2.6.32.43/arch/ia64/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/ia64/mm/fault.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/ia64/mm/fault.c linux-2.6.32.44/arch/ia64/mm/fault.c
+--- linux-2.6.32.44/arch/ia64/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/ia64/mm/fault.c 2011-04-17 15:56:45.000000000 -0400
@@ -72,6 +72,23 @@ mapped_kernel_page_is_present (unsigned
return pte_present(pte);
}
@@ -1427,9 +1375,9 @@ diff -urNp linux-2.6.32.43/arch/ia64/mm/fault.c linux-2.6.32.43/arch/ia64/mm/fau
survive:
/*
* If for any reason at all we couldn't handle the fault, make
-diff -urNp linux-2.6.32.43/arch/ia64/mm/hugetlbpage.c linux-2.6.32.43/arch/ia64/mm/hugetlbpage.c
---- linux-2.6.32.43/arch/ia64/mm/hugetlbpage.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/ia64/mm/hugetlbpage.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/ia64/mm/hugetlbpage.c linux-2.6.32.44/arch/ia64/mm/hugetlbpage.c
+--- linux-2.6.32.44/arch/ia64/mm/hugetlbpage.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/ia64/mm/hugetlbpage.c 2011-04-17 15:56:45.000000000 -0400
@@ -172,7 +172,7 @@ unsigned long hugetlb_get_unmapped_area(
/* At this point: (!vmm || addr < vmm->vm_end). */
if (REGION_OFFSET(addr) + len > RGN_MAP_LIMIT)
@@ -1439,9 +1387,9 @@ diff -urNp linux-2.6.32.43/arch/ia64/mm/hugetlbpage.c linux-2.6.32.43/arch/ia64/
return addr;
addr = ALIGN(vmm->vm_end, HPAGE_SIZE);
}
-diff -urNp linux-2.6.32.43/arch/ia64/mm/init.c linux-2.6.32.43/arch/ia64/mm/init.c
---- linux-2.6.32.43/arch/ia64/mm/init.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/ia64/mm/init.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/ia64/mm/init.c linux-2.6.32.44/arch/ia64/mm/init.c
+--- linux-2.6.32.44/arch/ia64/mm/init.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/ia64/mm/init.c 2011-04-17 15:56:45.000000000 -0400
@@ -122,6 +122,19 @@ ia64_init_addr_space (void)
vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
vma->vm_end = vma->vm_start + PAGE_SIZE;
@@ -1462,9 +1410,9 @@ diff -urNp linux-2.6.32.43/arch/ia64/mm/init.c linux-2.6.32.43/arch/ia64/mm/init
vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
down_write(¤t->mm->mmap_sem);
if (insert_vm_struct(current->mm, vma)) {
-diff -urNp linux-2.6.32.43/arch/ia64/sn/pci/pci_dma.c linux-2.6.32.43/arch/ia64/sn/pci/pci_dma.c
---- linux-2.6.32.43/arch/ia64/sn/pci/pci_dma.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/ia64/sn/pci/pci_dma.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/ia64/sn/pci/pci_dma.c linux-2.6.32.44/arch/ia64/sn/pci/pci_dma.c
+--- linux-2.6.32.44/arch/ia64/sn/pci/pci_dma.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/ia64/sn/pci/pci_dma.c 2011-04-17 15:56:45.000000000 -0400
@@ -464,7 +464,7 @@ int sn_pci_legacy_write(struct pci_bus *
return ret;
}
@@ -1474,9 +1422,9 @@ diff -urNp linux-2.6.32.43/arch/ia64/sn/pci/pci_dma.c linux-2.6.32.43/arch/ia64/
.alloc_coherent = sn_dma_alloc_coherent,
.free_coherent = sn_dma_free_coherent,
.map_page = sn_dma_map_page,
-diff -urNp linux-2.6.32.43/arch/m32r/lib/usercopy.c linux-2.6.32.43/arch/m32r/lib/usercopy.c
---- linux-2.6.32.43/arch/m32r/lib/usercopy.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/m32r/lib/usercopy.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/m32r/lib/usercopy.c linux-2.6.32.44/arch/m32r/lib/usercopy.c
+--- linux-2.6.32.44/arch/m32r/lib/usercopy.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/m32r/lib/usercopy.c 2011-04-17 15:56:45.000000000 -0400
@@ -14,6 +14,9 @@
unsigned long
__generic_copy_to_user(void __user *to, const void *from, unsigned long n)
@@ -1497,9 +1445,9 @@ diff -urNp linux-2.6.32.43/arch/m32r/lib/usercopy.c linux-2.6.32.43/arch/m32r/li
prefetchw(to);
if (access_ok(VERIFY_READ, from, n))
__copy_user_zeroing(to,from,n);
-diff -urNp linux-2.6.32.43/arch/mips/alchemy/devboards/pm.c linux-2.6.32.43/arch/mips/alchemy/devboards/pm.c
---- linux-2.6.32.43/arch/mips/alchemy/devboards/pm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/mips/alchemy/devboards/pm.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/mips/alchemy/devboards/pm.c linux-2.6.32.44/arch/mips/alchemy/devboards/pm.c
+--- linux-2.6.32.44/arch/mips/alchemy/devboards/pm.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/mips/alchemy/devboards/pm.c 2011-04-17 15:56:45.000000000 -0400
@@ -78,7 +78,7 @@ static void db1x_pm_end(void)
}
@@ -1509,9 +1457,9 @@ diff -urNp linux-2.6.32.43/arch/mips/alchemy/devboards/pm.c linux-2.6.32.43/arch
.valid = suspend_valid_only_mem,
.begin = db1x_pm_begin,
.enter = db1x_pm_enter,
-diff -urNp linux-2.6.32.43/arch/mips/include/asm/elf.h linux-2.6.32.43/arch/mips/include/asm/elf.h
---- linux-2.6.32.43/arch/mips/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/mips/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/mips/include/asm/elf.h linux-2.6.32.44/arch/mips/include/asm/elf.h
+--- linux-2.6.32.44/arch/mips/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/mips/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
@@ -368,4 +368,11 @@ extern int dump_task_fpu(struct task_str
#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
#endif
@@ -1524,9 +1472,9 @@ diff -urNp linux-2.6.32.43/arch/mips/include/asm/elf.h linux-2.6.32.43/arch/mips
+#endif
+
#endif /* _ASM_ELF_H */
-diff -urNp linux-2.6.32.43/arch/mips/include/asm/page.h linux-2.6.32.43/arch/mips/include/asm/page.h
---- linux-2.6.32.43/arch/mips/include/asm/page.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/mips/include/asm/page.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/mips/include/asm/page.h linux-2.6.32.44/arch/mips/include/asm/page.h
+--- linux-2.6.32.44/arch/mips/include/asm/page.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/mips/include/asm/page.h 2011-04-17 15:56:45.000000000 -0400
@@ -93,7 +93,7 @@ extern void copy_user_highpage(struct pa
#ifdef CONFIG_CPU_MIPS32
typedef struct { unsigned long pte_low, pte_high; } pte_t;
@@ -1536,9 +1484,9 @@ diff -urNp linux-2.6.32.43/arch/mips/include/asm/page.h linux-2.6.32.43/arch/mip
#else
typedef struct { unsigned long long pte; } pte_t;
#define pte_val(x) ((x).pte)
-diff -urNp linux-2.6.32.43/arch/mips/include/asm/system.h linux-2.6.32.43/arch/mips/include/asm/system.h
---- linux-2.6.32.43/arch/mips/include/asm/system.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/mips/include/asm/system.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/mips/include/asm/system.h linux-2.6.32.44/arch/mips/include/asm/system.h
+--- linux-2.6.32.44/arch/mips/include/asm/system.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/mips/include/asm/system.h 2011-04-17 15:56:45.000000000 -0400
@@ -230,6 +230,6 @@ extern void per_cpu_trap_init(void);
*/
#define __ARCH_WANT_UNLOCKED_CTXSW
@@ -1547,9 +1495,9 @@ diff -urNp linux-2.6.32.43/arch/mips/include/asm/system.h linux-2.6.32.43/arch/m
+#define arch_align_stack(x) ((x) & ~0xfUL)
#endif /* _ASM_SYSTEM_H */
-diff -urNp linux-2.6.32.43/arch/mips/kernel/binfmt_elfn32.c linux-2.6.32.43/arch/mips/kernel/binfmt_elfn32.c
---- linux-2.6.32.43/arch/mips/kernel/binfmt_elfn32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/mips/kernel/binfmt_elfn32.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/mips/kernel/binfmt_elfn32.c linux-2.6.32.44/arch/mips/kernel/binfmt_elfn32.c
+--- linux-2.6.32.44/arch/mips/kernel/binfmt_elfn32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/mips/kernel/binfmt_elfn32.c 2011-04-17 15:56:45.000000000 -0400
@@ -50,6 +50,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
#undef ELF_ET_DYN_BASE
#define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
@@ -1564,9 +1512,9 @@ diff -urNp linux-2.6.32.43/arch/mips/kernel/binfmt_elfn32.c linux-2.6.32.43/arch
#include <asm/processor.h>
#include <linux/module.h>
#include <linux/elfcore.h>
-diff -urNp linux-2.6.32.43/arch/mips/kernel/binfmt_elfo32.c linux-2.6.32.43/arch/mips/kernel/binfmt_elfo32.c
---- linux-2.6.32.43/arch/mips/kernel/binfmt_elfo32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/mips/kernel/binfmt_elfo32.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/mips/kernel/binfmt_elfo32.c linux-2.6.32.44/arch/mips/kernel/binfmt_elfo32.c
+--- linux-2.6.32.44/arch/mips/kernel/binfmt_elfo32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/mips/kernel/binfmt_elfo32.c 2011-04-17 15:56:45.000000000 -0400
@@ -52,6 +52,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
#undef ELF_ET_DYN_BASE
#define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
@@ -1581,9 +1529,9 @@ diff -urNp linux-2.6.32.43/arch/mips/kernel/binfmt_elfo32.c linux-2.6.32.43/arch
#include <asm/processor.h>
/*
-diff -urNp linux-2.6.32.43/arch/mips/kernel/kgdb.c linux-2.6.32.43/arch/mips/kernel/kgdb.c
---- linux-2.6.32.43/arch/mips/kernel/kgdb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/mips/kernel/kgdb.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/mips/kernel/kgdb.c linux-2.6.32.44/arch/mips/kernel/kgdb.c
+--- linux-2.6.32.44/arch/mips/kernel/kgdb.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/mips/kernel/kgdb.c 2011-04-17 15:56:45.000000000 -0400
@@ -245,6 +245,7 @@ int kgdb_arch_handle_exception(int vecto
return -1;
}
@@ -1592,9 +1540,9 @@ diff -urNp linux-2.6.32.43/arch/mips/kernel/kgdb.c linux-2.6.32.43/arch/mips/ker
struct kgdb_arch arch_kgdb_ops;
/*
-diff -urNp linux-2.6.32.43/arch/mips/kernel/process.c linux-2.6.32.43/arch/mips/kernel/process.c
---- linux-2.6.32.43/arch/mips/kernel/process.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/mips/kernel/process.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/mips/kernel/process.c linux-2.6.32.44/arch/mips/kernel/process.c
+--- linux-2.6.32.44/arch/mips/kernel/process.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/mips/kernel/process.c 2011-04-17 15:56:45.000000000 -0400
@@ -470,15 +470,3 @@ unsigned long get_wchan(struct task_stru
out:
return pc;
@@ -1611,9 +1559,9 @@ diff -urNp linux-2.6.32.43/arch/mips/kernel/process.c linux-2.6.32.43/arch/mips/
-
- return sp & ALMASK;
-}
-diff -urNp linux-2.6.32.43/arch/mips/kernel/syscall.c linux-2.6.32.43/arch/mips/kernel/syscall.c
---- linux-2.6.32.43/arch/mips/kernel/syscall.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/mips/kernel/syscall.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/mips/kernel/syscall.c linux-2.6.32.44/arch/mips/kernel/syscall.c
+--- linux-2.6.32.44/arch/mips/kernel/syscall.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/mips/kernel/syscall.c 2011-04-17 15:56:45.000000000 -0400
@@ -102,17 +102,21 @@ unsigned long arch_get_unmapped_area(str
do_color_align = 0;
if (filp || (flags & MAP_SHARED))
@@ -1648,9 +1596,9 @@ diff -urNp linux-2.6.32.43/arch/mips/kernel/syscall.c linux-2.6.32.43/arch/mips/
return addr;
addr = vmm->vm_end;
if (do_color_align)
-diff -urNp linux-2.6.32.43/arch/mips/mm/fault.c linux-2.6.32.43/arch/mips/mm/fault.c
---- linux-2.6.32.43/arch/mips/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/mips/mm/fault.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/mips/mm/fault.c linux-2.6.32.44/arch/mips/mm/fault.c
+--- linux-2.6.32.44/arch/mips/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/mips/mm/fault.c 2011-04-17 15:56:45.000000000 -0400
@@ -26,6 +26,23 @@
#include <asm/ptrace.h>
#include <asm/highmem.h> /* For VMALLOC_END */
@@ -1675,9 +1623,9 @@ diff -urNp linux-2.6.32.43/arch/mips/mm/fault.c linux-2.6.32.43/arch/mips/mm/fau
/*
* This routine handles page faults. It determines the address,
* and the problem, and then passes it off to one of the appropriate
-diff -urNp linux-2.6.32.43/arch/parisc/include/asm/elf.h linux-2.6.32.43/arch/parisc/include/asm/elf.h
---- linux-2.6.32.43/arch/parisc/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/parisc/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/parisc/include/asm/elf.h linux-2.6.32.44/arch/parisc/include/asm/elf.h
+--- linux-2.6.32.44/arch/parisc/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/parisc/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
@@ -343,6 +343,13 @@ struct pt_regs; /* forward declaration..
#define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x01000000)
@@ -1692,9 +1640,9 @@ diff -urNp linux-2.6.32.43/arch/parisc/include/asm/elf.h linux-2.6.32.43/arch/pa
/* This yields a mask that user programs can use to figure out what
instruction set this CPU supports. This could be done in user space,
but it's not easy, and we've already done it here. */
-diff -urNp linux-2.6.32.43/arch/parisc/include/asm/pgtable.h linux-2.6.32.43/arch/parisc/include/asm/pgtable.h
---- linux-2.6.32.43/arch/parisc/include/asm/pgtable.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/parisc/include/asm/pgtable.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/parisc/include/asm/pgtable.h linux-2.6.32.44/arch/parisc/include/asm/pgtable.h
+--- linux-2.6.32.44/arch/parisc/include/asm/pgtable.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/parisc/include/asm/pgtable.h 2011-04-17 15:56:45.000000000 -0400
@@ -207,6 +207,17 @@
#define PAGE_EXECREAD __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
#define PAGE_COPY PAGE_EXECREAD
@@ -1713,9 +1661,9 @@ diff -urNp linux-2.6.32.43/arch/parisc/include/asm/pgtable.h linux-2.6.32.43/arc
#define PAGE_KERNEL __pgprot(_PAGE_KERNEL)
#define PAGE_KERNEL_RO __pgprot(_PAGE_KERNEL & ~_PAGE_WRITE)
#define PAGE_KERNEL_UNC __pgprot(_PAGE_KERNEL | _PAGE_NO_CACHE)
-diff -urNp linux-2.6.32.43/arch/parisc/kernel/module.c linux-2.6.32.43/arch/parisc/kernel/module.c
---- linux-2.6.32.43/arch/parisc/kernel/module.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/parisc/kernel/module.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/parisc/kernel/module.c linux-2.6.32.44/arch/parisc/kernel/module.c
+--- linux-2.6.32.44/arch/parisc/kernel/module.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/parisc/kernel/module.c 2011-04-17 15:56:45.000000000 -0400
@@ -95,16 +95,38 @@
/* three functions to determine where in the module core
@@ -1816,9 +1764,9 @@ diff -urNp linux-2.6.32.43/arch/parisc/kernel/module.c linux-2.6.32.43/arch/pari
DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n",
me->arch.unwind_section, table, end, gp);
-diff -urNp linux-2.6.32.43/arch/parisc/kernel/sys_parisc.c linux-2.6.32.43/arch/parisc/kernel/sys_parisc.c
---- linux-2.6.32.43/arch/parisc/kernel/sys_parisc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/parisc/kernel/sys_parisc.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/parisc/kernel/sys_parisc.c linux-2.6.32.44/arch/parisc/kernel/sys_parisc.c
+--- linux-2.6.32.44/arch/parisc/kernel/sys_parisc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/parisc/kernel/sys_parisc.c 2011-04-17 15:56:45.000000000 -0400
@@ -43,7 +43,7 @@ static unsigned long get_unshared_area(u
/* At this point: (!vma || addr < vma->vm_end). */
if (TASK_SIZE - len < addr)
@@ -1846,9 +1794,9 @@ diff -urNp linux-2.6.32.43/arch/parisc/kernel/sys_parisc.c linux-2.6.32.43/arch/
if (filp) {
addr = get_shared_area(filp->f_mapping, addr, len, pgoff);
-diff -urNp linux-2.6.32.43/arch/parisc/kernel/traps.c linux-2.6.32.43/arch/parisc/kernel/traps.c
---- linux-2.6.32.43/arch/parisc/kernel/traps.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/parisc/kernel/traps.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/parisc/kernel/traps.c linux-2.6.32.44/arch/parisc/kernel/traps.c
+--- linux-2.6.32.44/arch/parisc/kernel/traps.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/parisc/kernel/traps.c 2011-04-17 15:56:45.000000000 -0400
@@ -733,9 +733,7 @@ void notrace handle_interruption(int cod
down_read(¤t->mm->mmap_sem);
@@ -1860,9 +1808,9 @@ diff -urNp linux-2.6.32.43/arch/parisc/kernel/traps.c linux-2.6.32.43/arch/paris
fault_address = regs->iaoq[0];
fault_space = regs->iasq[0];
-diff -urNp linux-2.6.32.43/arch/parisc/mm/fault.c linux-2.6.32.43/arch/parisc/mm/fault.c
---- linux-2.6.32.43/arch/parisc/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/parisc/mm/fault.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/parisc/mm/fault.c linux-2.6.32.44/arch/parisc/mm/fault.c
+--- linux-2.6.32.44/arch/parisc/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/parisc/mm/fault.c 2011-04-17 15:56:45.000000000 -0400
@@ -15,6 +15,7 @@
#include <linux/sched.h>
#include <linux/interrupt.h>
@@ -2032,9 +1980,9 @@ diff -urNp linux-2.6.32.43/arch/parisc/mm/fault.c linux-2.6.32.43/arch/parisc/mm
/*
* If for any reason at all we couldn't handle the fault, make
-diff -urNp linux-2.6.32.43/arch/powerpc/include/asm/device.h linux-2.6.32.43/arch/powerpc/include/asm/device.h
---- linux-2.6.32.43/arch/powerpc/include/asm/device.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/include/asm/device.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/include/asm/device.h linux-2.6.32.44/arch/powerpc/include/asm/device.h
+--- linux-2.6.32.44/arch/powerpc/include/asm/device.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/include/asm/device.h 2011-04-17 15:56:45.000000000 -0400
@@ -14,7 +14,7 @@ struct dev_archdata {
struct device_node *of_node;
@@ -2044,9 +1992,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/include/asm/device.h linux-2.6.32.43/arc
/*
* When an iommu is in use, dma_data is used as a ptr to the base of the
-diff -urNp linux-2.6.32.43/arch/powerpc/include/asm/dma-mapping.h linux-2.6.32.43/arch/powerpc/include/asm/dma-mapping.h
---- linux-2.6.32.43/arch/powerpc/include/asm/dma-mapping.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/include/asm/dma-mapping.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/include/asm/dma-mapping.h linux-2.6.32.44/arch/powerpc/include/asm/dma-mapping.h
+--- linux-2.6.32.44/arch/powerpc/include/asm/dma-mapping.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/include/asm/dma-mapping.h 2011-04-17 15:56:45.000000000 -0400
@@ -69,9 +69,9 @@ static inline unsigned long device_to_ma
#ifdef CONFIG_PPC64
extern struct dma_map_ops dma_iommu_ops;
@@ -2113,9 +2061,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/include/asm/dma-mapping.h linux-2.6.32.4
if (dma_ops->mapping_error)
return dma_ops->mapping_error(dev, dma_addr);
-diff -urNp linux-2.6.32.43/arch/powerpc/include/asm/elf.h linux-2.6.32.43/arch/powerpc/include/asm/elf.h
---- linux-2.6.32.43/arch/powerpc/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/include/asm/elf.h linux-2.6.32.44/arch/powerpc/include/asm/elf.h
+--- linux-2.6.32.44/arch/powerpc/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
@@ -179,8 +179,19 @@ typedef elf_fpreg_t elf_vsrreghalf_t32[E
the loader. We need to make sure that it is out of the way of the program
that it will "exec", and that there is sufficient room for the brk. */
@@ -2148,9 +2096,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/include/asm/elf.h linux-2.6.32.43/arch/p
#endif /* __KERNEL__ */
/*
-diff -urNp linux-2.6.32.43/arch/powerpc/include/asm/iommu.h linux-2.6.32.43/arch/powerpc/include/asm/iommu.h
---- linux-2.6.32.43/arch/powerpc/include/asm/iommu.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/include/asm/iommu.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/include/asm/iommu.h linux-2.6.32.44/arch/powerpc/include/asm/iommu.h
+--- linux-2.6.32.44/arch/powerpc/include/asm/iommu.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/include/asm/iommu.h 2011-04-17 15:56:45.000000000 -0400
@@ -116,6 +116,9 @@ extern void iommu_init_early_iSeries(voi
extern void iommu_init_early_dart(void);
extern void iommu_init_early_pasemi(void);
@@ -2161,9 +2109,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/include/asm/iommu.h linux-2.6.32.43/arch
#ifdef CONFIG_PCI
extern void pci_iommu_init(void);
extern void pci_direct_iommu_init(void);
-diff -urNp linux-2.6.32.43/arch/powerpc/include/asm/kmap_types.h linux-2.6.32.43/arch/powerpc/include/asm/kmap_types.h
---- linux-2.6.32.43/arch/powerpc/include/asm/kmap_types.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/include/asm/kmap_types.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/include/asm/kmap_types.h linux-2.6.32.44/arch/powerpc/include/asm/kmap_types.h
+--- linux-2.6.32.44/arch/powerpc/include/asm/kmap_types.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/include/asm/kmap_types.h 2011-04-17 15:56:45.000000000 -0400
@@ -26,6 +26,7 @@ enum km_type {
KM_SOFTIRQ1,
KM_PPC_SYNC_PAGE,
@@ -2172,9 +2120,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/include/asm/kmap_types.h linux-2.6.32.43
KM_TYPE_NR
};
-diff -urNp linux-2.6.32.43/arch/powerpc/include/asm/page_64.h linux-2.6.32.43/arch/powerpc/include/asm/page_64.h
---- linux-2.6.32.43/arch/powerpc/include/asm/page_64.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/include/asm/page_64.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/include/asm/page_64.h linux-2.6.32.44/arch/powerpc/include/asm/page_64.h
+--- linux-2.6.32.44/arch/powerpc/include/asm/page_64.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/include/asm/page_64.h 2011-04-17 15:56:45.000000000 -0400
@@ -180,15 +180,18 @@ do { \
* stack by default, so in the absense of a PT_GNU_STACK program header
* we turn execute permission off.
@@ -2196,9 +2144,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/include/asm/page_64.h linux-2.6.32.43/ar
#include <asm-generic/getorder.h>
-diff -urNp linux-2.6.32.43/arch/powerpc/include/asm/page.h linux-2.6.32.43/arch/powerpc/include/asm/page.h
---- linux-2.6.32.43/arch/powerpc/include/asm/page.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/include/asm/page.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/include/asm/page.h linux-2.6.32.44/arch/powerpc/include/asm/page.h
+--- linux-2.6.32.44/arch/powerpc/include/asm/page.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/include/asm/page.h 2011-04-17 15:56:45.000000000 -0400
@@ -116,8 +116,9 @@ extern phys_addr_t kernstart_addr;
* and needs to be executable. This means the whole heap ends
* up being executable.
@@ -2221,9 +2169,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/include/asm/page.h linux-2.6.32.43/arch/
#ifndef __ASSEMBLY__
#undef STRICT_MM_TYPECHECKS
-diff -urNp linux-2.6.32.43/arch/powerpc/include/asm/pci.h linux-2.6.32.43/arch/powerpc/include/asm/pci.h
---- linux-2.6.32.43/arch/powerpc/include/asm/pci.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/include/asm/pci.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/include/asm/pci.h linux-2.6.32.44/arch/powerpc/include/asm/pci.h
+--- linux-2.6.32.44/arch/powerpc/include/asm/pci.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/include/asm/pci.h 2011-04-17 15:56:45.000000000 -0400
@@ -65,8 +65,8 @@ static inline int pci_get_legacy_ide_irq
}
@@ -2235,9 +2183,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/include/asm/pci.h linux-2.6.32.43/arch/p
#else /* CONFIG_PCI */
#define set_pci_dma_ops(d)
#define get_pci_dma_ops() NULL
-diff -urNp linux-2.6.32.43/arch/powerpc/include/asm/pgtable.h linux-2.6.32.43/arch/powerpc/include/asm/pgtable.h
---- linux-2.6.32.43/arch/powerpc/include/asm/pgtable.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/include/asm/pgtable.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/include/asm/pgtable.h linux-2.6.32.44/arch/powerpc/include/asm/pgtable.h
+--- linux-2.6.32.44/arch/powerpc/include/asm/pgtable.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/include/asm/pgtable.h 2011-04-17 15:56:45.000000000 -0400
@@ -2,6 +2,7 @@
#define _ASM_POWERPC_PGTABLE_H
#ifdef __KERNEL__
@@ -2246,9 +2194,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/include/asm/pgtable.h linux-2.6.32.43/ar
#ifndef __ASSEMBLY__
#include <asm/processor.h> /* For TASK_SIZE */
#include <asm/mmu.h>
-diff -urNp linux-2.6.32.43/arch/powerpc/include/asm/pte-hash32.h linux-2.6.32.43/arch/powerpc/include/asm/pte-hash32.h
---- linux-2.6.32.43/arch/powerpc/include/asm/pte-hash32.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/include/asm/pte-hash32.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/include/asm/pte-hash32.h linux-2.6.32.44/arch/powerpc/include/asm/pte-hash32.h
+--- linux-2.6.32.44/arch/powerpc/include/asm/pte-hash32.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/include/asm/pte-hash32.h 2011-04-17 15:56:45.000000000 -0400
@@ -21,6 +21,7 @@
#define _PAGE_FILE 0x004 /* when !present: nonlinear file mapping */
#define _PAGE_USER 0x004 /* usermode access allowed */
@@ -2257,9 +2205,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/include/asm/pte-hash32.h linux-2.6.32.43
#define _PAGE_COHERENT 0x010 /* M: enforce memory coherence (SMP systems) */
#define _PAGE_NO_CACHE 0x020 /* I: cache inhibit */
#define _PAGE_WRITETHRU 0x040 /* W: cache write-through */
-diff -urNp linux-2.6.32.43/arch/powerpc/include/asm/reg.h linux-2.6.32.43/arch/powerpc/include/asm/reg.h
---- linux-2.6.32.43/arch/powerpc/include/asm/reg.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/include/asm/reg.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/include/asm/reg.h linux-2.6.32.44/arch/powerpc/include/asm/reg.h
+--- linux-2.6.32.44/arch/powerpc/include/asm/reg.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/include/asm/reg.h 2011-04-17 15:56:45.000000000 -0400
@@ -191,6 +191,7 @@
#define SPRN_DBCR 0x136 /* e300 Data Breakpoint Control Reg */
#define SPRN_DSISR 0x012 /* Data Storage Interrupt Status Register */
@@ -2268,9 +2216,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/include/asm/reg.h linux-2.6.32.43/arch/p
#define DSISR_PROTFAULT 0x08000000 /* protection fault */
#define DSISR_ISSTORE 0x02000000 /* access was a store */
#define DSISR_DABRMATCH 0x00400000 /* hit data breakpoint */
-diff -urNp linux-2.6.32.43/arch/powerpc/include/asm/swiotlb.h linux-2.6.32.43/arch/powerpc/include/asm/swiotlb.h
---- linux-2.6.32.43/arch/powerpc/include/asm/swiotlb.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/include/asm/swiotlb.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/include/asm/swiotlb.h linux-2.6.32.44/arch/powerpc/include/asm/swiotlb.h
+--- linux-2.6.32.44/arch/powerpc/include/asm/swiotlb.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/include/asm/swiotlb.h 2011-04-17 15:56:45.000000000 -0400
@@ -13,7 +13,7 @@
#include <linux/swiotlb.h>
@@ -2280,9 +2228,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/include/asm/swiotlb.h linux-2.6.32.43/ar
static inline void dma_mark_clean(void *addr, size_t size) {}
-diff -urNp linux-2.6.32.43/arch/powerpc/include/asm/system.h linux-2.6.32.43/arch/powerpc/include/asm/system.h
---- linux-2.6.32.43/arch/powerpc/include/asm/system.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/include/asm/system.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/include/asm/system.h linux-2.6.32.44/arch/powerpc/include/asm/system.h
+--- linux-2.6.32.44/arch/powerpc/include/asm/system.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/include/asm/system.h 2011-04-17 15:56:45.000000000 -0400
@@ -531,7 +531,7 @@ __cmpxchg_local(volatile void *ptr, unsi
#define cmpxchg64_local(ptr, o, n) __cmpxchg64_local_generic((ptr), (o), (n))
#endif
@@ -2292,9 +2240,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/include/asm/system.h linux-2.6.32.43/arc
/* Used in very early kernel initialization. */
extern unsigned long reloc_offset(void);
-diff -urNp linux-2.6.32.43/arch/powerpc/include/asm/uaccess.h linux-2.6.32.43/arch/powerpc/include/asm/uaccess.h
---- linux-2.6.32.43/arch/powerpc/include/asm/uaccess.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/include/asm/uaccess.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/include/asm/uaccess.h linux-2.6.32.44/arch/powerpc/include/asm/uaccess.h
+--- linux-2.6.32.44/arch/powerpc/include/asm/uaccess.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/include/asm/uaccess.h 2011-04-17 15:56:45.000000000 -0400
@@ -13,6 +13,8 @@
#define VERIFY_READ 0
#define VERIFY_WRITE 1
@@ -2472,9 +2420,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/include/asm/uaccess.h linux-2.6.32.43/ar
extern unsigned long __clear_user(void __user *addr, unsigned long size);
static inline unsigned long clear_user(void __user *addr, unsigned long size)
-diff -urNp linux-2.6.32.43/arch/powerpc/kernel/cacheinfo.c linux-2.6.32.43/arch/powerpc/kernel/cacheinfo.c
---- linux-2.6.32.43/arch/powerpc/kernel/cacheinfo.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/kernel/cacheinfo.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/kernel/cacheinfo.c linux-2.6.32.44/arch/powerpc/kernel/cacheinfo.c
+--- linux-2.6.32.44/arch/powerpc/kernel/cacheinfo.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/kernel/cacheinfo.c 2011-04-17 15:56:45.000000000 -0400
@@ -642,7 +642,7 @@ static struct kobj_attribute *cache_inde
&cache_assoc_attr,
};
@@ -2484,9 +2432,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/kernel/cacheinfo.c linux-2.6.32.43/arch/
.show = cache_index_show,
};
-diff -urNp linux-2.6.32.43/arch/powerpc/kernel/dma.c linux-2.6.32.43/arch/powerpc/kernel/dma.c
---- linux-2.6.32.43/arch/powerpc/kernel/dma.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/kernel/dma.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/kernel/dma.c linux-2.6.32.44/arch/powerpc/kernel/dma.c
+--- linux-2.6.32.44/arch/powerpc/kernel/dma.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/kernel/dma.c 2011-04-17 15:56:45.000000000 -0400
@@ -134,7 +134,7 @@ static inline void dma_direct_sync_singl
}
#endif
@@ -2496,9 +2444,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/kernel/dma.c linux-2.6.32.43/arch/powerp
.alloc_coherent = dma_direct_alloc_coherent,
.free_coherent = dma_direct_free_coherent,
.map_sg = dma_direct_map_sg,
-diff -urNp linux-2.6.32.43/arch/powerpc/kernel/dma-iommu.c linux-2.6.32.43/arch/powerpc/kernel/dma-iommu.c
---- linux-2.6.32.43/arch/powerpc/kernel/dma-iommu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/kernel/dma-iommu.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/kernel/dma-iommu.c linux-2.6.32.44/arch/powerpc/kernel/dma-iommu.c
+--- linux-2.6.32.44/arch/powerpc/kernel/dma-iommu.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/kernel/dma-iommu.c 2011-04-17 15:56:45.000000000 -0400
@@ -70,7 +70,7 @@ static void dma_iommu_unmap_sg(struct de
}
@@ -2508,9 +2456,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/kernel/dma-iommu.c linux-2.6.32.43/arch/
{
struct iommu_table *tbl = get_iommu_table_base(dev);
-diff -urNp linux-2.6.32.43/arch/powerpc/kernel/dma-swiotlb.c linux-2.6.32.43/arch/powerpc/kernel/dma-swiotlb.c
---- linux-2.6.32.43/arch/powerpc/kernel/dma-swiotlb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/kernel/dma-swiotlb.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/kernel/dma-swiotlb.c linux-2.6.32.44/arch/powerpc/kernel/dma-swiotlb.c
+--- linux-2.6.32.44/arch/powerpc/kernel/dma-swiotlb.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/kernel/dma-swiotlb.c 2011-04-17 15:56:45.000000000 -0400
@@ -31,7 +31,7 @@ unsigned int ppc_swiotlb_enable;
* map_page, and unmap_page on highmem, use normal dma_ops
* for everything else.
@@ -2520,9 +2468,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/kernel/dma-swiotlb.c linux-2.6.32.43/arc
.alloc_coherent = dma_direct_alloc_coherent,
.free_coherent = dma_direct_free_coherent,
.map_sg = swiotlb_map_sg_attrs,
-diff -urNp linux-2.6.32.43/arch/powerpc/kernel/exceptions-64e.S linux-2.6.32.43/arch/powerpc/kernel/exceptions-64e.S
---- linux-2.6.32.43/arch/powerpc/kernel/exceptions-64e.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/kernel/exceptions-64e.S 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/kernel/exceptions-64e.S linux-2.6.32.44/arch/powerpc/kernel/exceptions-64e.S
+--- linux-2.6.32.44/arch/powerpc/kernel/exceptions-64e.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/kernel/exceptions-64e.S 2011-04-17 15:56:45.000000000 -0400
@@ -455,6 +455,7 @@ storage_fault_common:
std r14,_DAR(r1)
std r15,_DSISR(r1)
@@ -2541,9 +2489,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/kernel/exceptions-64e.S linux-2.6.32.43/
addi r3,r1,STACK_FRAME_OVERHEAD
ld r4,_DAR(r1)
bl .bad_page_fault
-diff -urNp linux-2.6.32.43/arch/powerpc/kernel/exceptions-64s.S linux-2.6.32.43/arch/powerpc/kernel/exceptions-64s.S
---- linux-2.6.32.43/arch/powerpc/kernel/exceptions-64s.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/kernel/exceptions-64s.S 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/kernel/exceptions-64s.S linux-2.6.32.44/arch/powerpc/kernel/exceptions-64s.S
+--- linux-2.6.32.44/arch/powerpc/kernel/exceptions-64s.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/kernel/exceptions-64s.S 2011-04-17 15:56:45.000000000 -0400
@@ -818,10 +818,10 @@ handle_page_fault:
11: ld r4,_DAR(r1)
ld r5,_DSISR(r1)
@@ -2556,9 +2504,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/kernel/exceptions-64s.S linux-2.6.32.43/
mr r5,r3
addi r3,r1,STACK_FRAME_OVERHEAD
lwz r4,_DAR(r1)
-diff -urNp linux-2.6.32.43/arch/powerpc/kernel/ibmebus.c linux-2.6.32.43/arch/powerpc/kernel/ibmebus.c
---- linux-2.6.32.43/arch/powerpc/kernel/ibmebus.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/kernel/ibmebus.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/kernel/ibmebus.c linux-2.6.32.44/arch/powerpc/kernel/ibmebus.c
+--- linux-2.6.32.44/arch/powerpc/kernel/ibmebus.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/kernel/ibmebus.c 2011-04-17 15:56:45.000000000 -0400
@@ -127,7 +127,7 @@ static int ibmebus_dma_supported(struct
return 1;
}
@@ -2568,9 +2516,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/kernel/ibmebus.c linux-2.6.32.43/arch/po
.alloc_coherent = ibmebus_alloc_coherent,
.free_coherent = ibmebus_free_coherent,
.map_sg = ibmebus_map_sg,
-diff -urNp linux-2.6.32.43/arch/powerpc/kernel/kgdb.c linux-2.6.32.43/arch/powerpc/kernel/kgdb.c
---- linux-2.6.32.43/arch/powerpc/kernel/kgdb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/kernel/kgdb.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/kernel/kgdb.c linux-2.6.32.44/arch/powerpc/kernel/kgdb.c
+--- linux-2.6.32.44/arch/powerpc/kernel/kgdb.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/kernel/kgdb.c 2011-04-17 15:56:45.000000000 -0400
@@ -126,7 +126,7 @@ static int kgdb_handle_breakpoint(struct
if (kgdb_handle_exception(0, SIGTRAP, 0, regs) != 0)
return 0;
@@ -2589,9 +2537,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/kernel/kgdb.c linux-2.6.32.43/arch/power
.gdb_bpt_instr = {0x7d, 0x82, 0x10, 0x08},
};
-diff -urNp linux-2.6.32.43/arch/powerpc/kernel/module_32.c linux-2.6.32.43/arch/powerpc/kernel/module_32.c
---- linux-2.6.32.43/arch/powerpc/kernel/module_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/kernel/module_32.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/kernel/module_32.c linux-2.6.32.44/arch/powerpc/kernel/module_32.c
+--- linux-2.6.32.44/arch/powerpc/kernel/module_32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/kernel/module_32.c 2011-04-17 15:56:45.000000000 -0400
@@ -162,7 +162,7 @@ int module_frob_arch_sections(Elf32_Ehdr
me->arch.core_plt_section = i;
}
@@ -2621,9 +2569,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/kernel/module_32.c linux-2.6.32.43/arch/
/* Find this entry, or if that fails, the next avail. entry */
while (entry->jump[0]) {
-diff -urNp linux-2.6.32.43/arch/powerpc/kernel/module.c linux-2.6.32.43/arch/powerpc/kernel/module.c
---- linux-2.6.32.43/arch/powerpc/kernel/module.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/kernel/module.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/kernel/module.c linux-2.6.32.44/arch/powerpc/kernel/module.c
+--- linux-2.6.32.44/arch/powerpc/kernel/module.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/kernel/module.c 2011-04-17 15:56:45.000000000 -0400
@@ -31,11 +31,24 @@
LIST_HEAD(module_bug_list);
@@ -2663,9 +2611,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/kernel/module.c linux-2.6.32.43/arch/pow
static const Elf_Shdr *find_section(const Elf_Ehdr *hdr,
const Elf_Shdr *sechdrs,
const char *name)
-diff -urNp linux-2.6.32.43/arch/powerpc/kernel/pci-common.c linux-2.6.32.43/arch/powerpc/kernel/pci-common.c
---- linux-2.6.32.43/arch/powerpc/kernel/pci-common.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/kernel/pci-common.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/kernel/pci-common.c linux-2.6.32.44/arch/powerpc/kernel/pci-common.c
+--- linux-2.6.32.44/arch/powerpc/kernel/pci-common.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/kernel/pci-common.c 2011-04-17 15:56:45.000000000 -0400
@@ -50,14 +50,14 @@ resource_size_t isa_mem_base;
unsigned int ppc_pci_flags = 0;
@@ -2684,9 +2632,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/kernel/pci-common.c linux-2.6.32.43/arch
{
return pci_dma_ops;
}
-diff -urNp linux-2.6.32.43/arch/powerpc/kernel/process.c linux-2.6.32.43/arch/powerpc/kernel/process.c
---- linux-2.6.32.43/arch/powerpc/kernel/process.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/kernel/process.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/kernel/process.c linux-2.6.32.44/arch/powerpc/kernel/process.c
+--- linux-2.6.32.44/arch/powerpc/kernel/process.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/kernel/process.c 2011-04-17 15:56:45.000000000 -0400
@@ -539,8 +539,8 @@ void show_regs(struct pt_regs * regs)
* Lookup NIP late so we have the best change of getting the
* above info out without failing
@@ -2779,9 +2727,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/kernel/process.c linux-2.6.32.43/arch/po
-
- return ret;
-}
-diff -urNp linux-2.6.32.43/arch/powerpc/kernel/signal_32.c linux-2.6.32.43/arch/powerpc/kernel/signal_32.c
---- linux-2.6.32.43/arch/powerpc/kernel/signal_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/kernel/signal_32.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/kernel/signal_32.c linux-2.6.32.44/arch/powerpc/kernel/signal_32.c
+--- linux-2.6.32.44/arch/powerpc/kernel/signal_32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/kernel/signal_32.c 2011-04-17 15:56:45.000000000 -0400
@@ -857,7 +857,7 @@ int handle_rt_signal32(unsigned long sig
/* Save user registers on the stack */
frame = &rt_sf->uc.uc_mcontext;
@@ -2791,9 +2739,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/kernel/signal_32.c linux-2.6.32.43/arch/
if (save_user_regs(regs, frame, 0, 1))
goto badframe;
regs->link = current->mm->context.vdso_base + vdso32_rt_sigtramp;
-diff -urNp linux-2.6.32.43/arch/powerpc/kernel/signal_64.c linux-2.6.32.43/arch/powerpc/kernel/signal_64.c
---- linux-2.6.32.43/arch/powerpc/kernel/signal_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/kernel/signal_64.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/kernel/signal_64.c linux-2.6.32.44/arch/powerpc/kernel/signal_64.c
+--- linux-2.6.32.44/arch/powerpc/kernel/signal_64.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/kernel/signal_64.c 2011-04-17 15:56:45.000000000 -0400
@@ -429,7 +429,7 @@ int handle_rt_signal64(int signr, struct
current->thread.fpscr.val = 0;
@@ -2803,9 +2751,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/kernel/signal_64.c linux-2.6.32.43/arch/
regs->link = current->mm->context.vdso_base + vdso64_rt_sigtramp;
} else {
err |= setup_trampoline(__NR_rt_sigreturn, &frame->tramp[0]);
-diff -urNp linux-2.6.32.43/arch/powerpc/kernel/sys_ppc32.c linux-2.6.32.43/arch/powerpc/kernel/sys_ppc32.c
---- linux-2.6.32.43/arch/powerpc/kernel/sys_ppc32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/kernel/sys_ppc32.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/kernel/sys_ppc32.c linux-2.6.32.44/arch/powerpc/kernel/sys_ppc32.c
+--- linux-2.6.32.44/arch/powerpc/kernel/sys_ppc32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/kernel/sys_ppc32.c 2011-04-17 15:56:45.000000000 -0400
@@ -563,10 +563,10 @@ asmlinkage long compat_sys_sysctl(struct
if (oldlenp) {
if (!error) {
@@ -2819,9 +2767,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/kernel/sys_ppc32.c linux-2.6.32.43/arch/
}
return error;
}
-diff -urNp linux-2.6.32.43/arch/powerpc/kernel/traps.c linux-2.6.32.43/arch/powerpc/kernel/traps.c
---- linux-2.6.32.43/arch/powerpc/kernel/traps.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/kernel/traps.c 2011-06-13 21:33:37.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/kernel/traps.c linux-2.6.32.44/arch/powerpc/kernel/traps.c
+--- linux-2.6.32.44/arch/powerpc/kernel/traps.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/kernel/traps.c 2011-06-13 21:33:37.000000000 -0400
@@ -99,6 +99,8 @@ static void pmac_backlight_unblank(void)
static inline void pmac_backlight_unblank(void) { }
#endif
@@ -2840,9 +2788,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/kernel/traps.c linux-2.6.32.43/arch/powe
oops_exit();
do_exit(err);
-diff -urNp linux-2.6.32.43/arch/powerpc/kernel/vdso.c linux-2.6.32.43/arch/powerpc/kernel/vdso.c
---- linux-2.6.32.43/arch/powerpc/kernel/vdso.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/kernel/vdso.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/kernel/vdso.c linux-2.6.32.44/arch/powerpc/kernel/vdso.c
+--- linux-2.6.32.44/arch/powerpc/kernel/vdso.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/kernel/vdso.c 2011-04-17 15:56:45.000000000 -0400
@@ -36,6 +36,7 @@
#include <asm/firmware.h>
#include <asm/vdso.h>
@@ -2869,9 +2817,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/kernel/vdso.c linux-2.6.32.43/arch/power
if (IS_ERR_VALUE(vdso_base)) {
rc = vdso_base;
goto fail_mmapsem;
-diff -urNp linux-2.6.32.43/arch/powerpc/kernel/vio.c linux-2.6.32.43/arch/powerpc/kernel/vio.c
---- linux-2.6.32.43/arch/powerpc/kernel/vio.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/kernel/vio.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/kernel/vio.c linux-2.6.32.44/arch/powerpc/kernel/vio.c
+--- linux-2.6.32.44/arch/powerpc/kernel/vio.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/kernel/vio.c 2011-04-17 15:56:45.000000000 -0400
@@ -601,11 +601,12 @@ static void vio_dma_iommu_unmap_sg(struc
vio_cmo_dealloc(viodev, alloc_size);
}
@@ -2894,9 +2842,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/kernel/vio.c linux-2.6.32.43/arch/powerp
viodev->dev.archdata.dma_ops = &vio_dma_mapping_ops;
}
-diff -urNp linux-2.6.32.43/arch/powerpc/lib/usercopy_64.c linux-2.6.32.43/arch/powerpc/lib/usercopy_64.c
---- linux-2.6.32.43/arch/powerpc/lib/usercopy_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/lib/usercopy_64.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/lib/usercopy_64.c linux-2.6.32.44/arch/powerpc/lib/usercopy_64.c
+--- linux-2.6.32.44/arch/powerpc/lib/usercopy_64.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/lib/usercopy_64.c 2011-04-17 15:56:45.000000000 -0400
@@ -9,22 +9,6 @@
#include <linux/module.h>
#include <asm/uaccess.h>
@@ -2928,9 +2876,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/lib/usercopy_64.c linux-2.6.32.43/arch/p
-EXPORT_SYMBOL(copy_to_user);
EXPORT_SYMBOL(copy_in_user);
-diff -urNp linux-2.6.32.43/arch/powerpc/mm/fault.c linux-2.6.32.43/arch/powerpc/mm/fault.c
---- linux-2.6.32.43/arch/powerpc/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/mm/fault.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/mm/fault.c linux-2.6.32.44/arch/powerpc/mm/fault.c
+--- linux-2.6.32.44/arch/powerpc/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/mm/fault.c 2011-04-17 15:56:45.000000000 -0400
@@ -30,6 +30,10 @@
#include <linux/kprobes.h>
#include <linux/kdebug.h>
@@ -3035,9 +2983,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/mm/fault.c linux-2.6.32.43/arch/powerpc/
_exception(SIGSEGV, regs, code, address);
return 0;
}
-diff -urNp linux-2.6.32.43/arch/powerpc/mm/mmap_64.c linux-2.6.32.43/arch/powerpc/mm/mmap_64.c
---- linux-2.6.32.43/arch/powerpc/mm/mmap_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/mm/mmap_64.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/mm/mmap_64.c linux-2.6.32.44/arch/powerpc/mm/mmap_64.c
+--- linux-2.6.32.44/arch/powerpc/mm/mmap_64.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/mm/mmap_64.c 2011-04-17 15:56:45.000000000 -0400
@@ -99,10 +99,22 @@ void arch_pick_mmap_layout(struct mm_str
*/
if (mmap_is_legacy()) {
@@ -3061,9 +3009,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/mm/mmap_64.c linux-2.6.32.43/arch/powerp
mm->get_unmapped_area = arch_get_unmapped_area_topdown;
mm->unmap_area = arch_unmap_area_topdown;
}
-diff -urNp linux-2.6.32.43/arch/powerpc/mm/slice.c linux-2.6.32.43/arch/powerpc/mm/slice.c
---- linux-2.6.32.43/arch/powerpc/mm/slice.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/mm/slice.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/mm/slice.c linux-2.6.32.44/arch/powerpc/mm/slice.c
+--- linux-2.6.32.44/arch/powerpc/mm/slice.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/mm/slice.c 2011-04-17 15:56:45.000000000 -0400
@@ -98,7 +98,7 @@ static int slice_area_is_free(struct mm_
if ((mm->task_size - len) < addr)
return 0;
@@ -3130,9 +3078,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/mm/slice.c linux-2.6.32.43/arch/powerpc/
/* If hint, make sure it matches our alignment restrictions */
if (!fixed && addr) {
addr = _ALIGN_UP(addr, 1ul << pshift);
-diff -urNp linux-2.6.32.43/arch/powerpc/platforms/52xx/lite5200_pm.c linux-2.6.32.43/arch/powerpc/platforms/52xx/lite5200_pm.c
---- linux-2.6.32.43/arch/powerpc/platforms/52xx/lite5200_pm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/platforms/52xx/lite5200_pm.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/platforms/52xx/lite5200_pm.c linux-2.6.32.44/arch/powerpc/platforms/52xx/lite5200_pm.c
+--- linux-2.6.32.44/arch/powerpc/platforms/52xx/lite5200_pm.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/platforms/52xx/lite5200_pm.c 2011-04-17 15:56:45.000000000 -0400
@@ -235,7 +235,7 @@ static void lite5200_pm_end(void)
lite5200_pm_target_state = PM_SUSPEND_ON;
}
@@ -3142,9 +3090,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/platforms/52xx/lite5200_pm.c linux-2.6.3
.valid = lite5200_pm_valid,
.begin = lite5200_pm_begin,
.prepare = lite5200_pm_prepare,
-diff -urNp linux-2.6.32.43/arch/powerpc/platforms/52xx/mpc52xx_pm.c linux-2.6.32.43/arch/powerpc/platforms/52xx/mpc52xx_pm.c
---- linux-2.6.32.43/arch/powerpc/platforms/52xx/mpc52xx_pm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/platforms/52xx/mpc52xx_pm.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/platforms/52xx/mpc52xx_pm.c linux-2.6.32.44/arch/powerpc/platforms/52xx/mpc52xx_pm.c
+--- linux-2.6.32.44/arch/powerpc/platforms/52xx/mpc52xx_pm.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/platforms/52xx/mpc52xx_pm.c 2011-04-17 15:56:45.000000000 -0400
@@ -180,7 +180,7 @@ void mpc52xx_pm_finish(void)
iounmap(mbar);
}
@@ -3154,9 +3102,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/platforms/52xx/mpc52xx_pm.c linux-2.6.32
.valid = mpc52xx_pm_valid,
.prepare = mpc52xx_pm_prepare,
.enter = mpc52xx_pm_enter,
-diff -urNp linux-2.6.32.43/arch/powerpc/platforms/83xx/suspend.c linux-2.6.32.43/arch/powerpc/platforms/83xx/suspend.c
---- linux-2.6.32.43/arch/powerpc/platforms/83xx/suspend.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/platforms/83xx/suspend.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/platforms/83xx/suspend.c linux-2.6.32.44/arch/powerpc/platforms/83xx/suspend.c
+--- linux-2.6.32.44/arch/powerpc/platforms/83xx/suspend.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/platforms/83xx/suspend.c 2011-04-17 15:56:45.000000000 -0400
@@ -273,7 +273,7 @@ static int mpc83xx_is_pci_agent(void)
return ret;
}
@@ -3166,9 +3114,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/platforms/83xx/suspend.c linux-2.6.32.43
.valid = mpc83xx_suspend_valid,
.begin = mpc83xx_suspend_begin,
.enter = mpc83xx_suspend_enter,
-diff -urNp linux-2.6.32.43/arch/powerpc/platforms/cell/iommu.c linux-2.6.32.43/arch/powerpc/platforms/cell/iommu.c
---- linux-2.6.32.43/arch/powerpc/platforms/cell/iommu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/platforms/cell/iommu.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/platforms/cell/iommu.c linux-2.6.32.44/arch/powerpc/platforms/cell/iommu.c
+--- linux-2.6.32.44/arch/powerpc/platforms/cell/iommu.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/platforms/cell/iommu.c 2011-04-17 15:56:45.000000000 -0400
@@ -642,7 +642,7 @@ static int dma_fixed_dma_supported(struc
static int dma_set_mask_and_switch(struct device *dev, u64 dma_mask);
@@ -3178,9 +3126,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/platforms/cell/iommu.c linux-2.6.32.43/a
.alloc_coherent = dma_fixed_alloc_coherent,
.free_coherent = dma_fixed_free_coherent,
.map_sg = dma_fixed_map_sg,
-diff -urNp linux-2.6.32.43/arch/powerpc/platforms/ps3/system-bus.c linux-2.6.32.43/arch/powerpc/platforms/ps3/system-bus.c
---- linux-2.6.32.43/arch/powerpc/platforms/ps3/system-bus.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/platforms/ps3/system-bus.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/platforms/ps3/system-bus.c linux-2.6.32.44/arch/powerpc/platforms/ps3/system-bus.c
+--- linux-2.6.32.44/arch/powerpc/platforms/ps3/system-bus.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/platforms/ps3/system-bus.c 2011-04-17 15:56:45.000000000 -0400
@@ -694,7 +694,7 @@ static int ps3_dma_supported(struct devi
return mask >= DMA_BIT_MASK(32);
}
@@ -3199,9 +3147,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/platforms/ps3/system-bus.c linux-2.6.32.
.alloc_coherent = ps3_alloc_coherent,
.free_coherent = ps3_free_coherent,
.map_sg = ps3_ioc0_map_sg,
-diff -urNp linux-2.6.32.43/arch/powerpc/platforms/pseries/Kconfig linux-2.6.32.43/arch/powerpc/platforms/pseries/Kconfig
---- linux-2.6.32.43/arch/powerpc/platforms/pseries/Kconfig 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/powerpc/platforms/pseries/Kconfig 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/powerpc/platforms/pseries/Kconfig linux-2.6.32.44/arch/powerpc/platforms/pseries/Kconfig
+--- linux-2.6.32.44/arch/powerpc/platforms/pseries/Kconfig 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/powerpc/platforms/pseries/Kconfig 2011-04-17 15:56:45.000000000 -0400
@@ -2,6 +2,8 @@ config PPC_PSERIES
depends on PPC64 && PPC_BOOK3S
bool "IBM pSeries & new (POWER5-based) iSeries"
@@ -3211,9 +3159,9 @@ diff -urNp linux-2.6.32.43/arch/powerpc/platforms/pseries/Kconfig linux-2.6.32.4
select PPC_I8259
select PPC_RTAS
select RTAS_ERROR_LOGGING
-diff -urNp linux-2.6.32.43/arch/s390/include/asm/elf.h linux-2.6.32.43/arch/s390/include/asm/elf.h
---- linux-2.6.32.43/arch/s390/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/s390/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/s390/include/asm/elf.h linux-2.6.32.44/arch/s390/include/asm/elf.h
+--- linux-2.6.32.44/arch/s390/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/s390/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
@@ -164,6 +164,13 @@ extern unsigned int vdso_enabled;
that it will "exec", and that there is sufficient room for the brk. */
#define ELF_ET_DYN_BASE (STACK_TOP / 3 * 2)
@@ -3228,9 +3176,9 @@ diff -urNp linux-2.6.32.43/arch/s390/include/asm/elf.h linux-2.6.32.43/arch/s390
/* This yields a mask that user programs can use to figure out what
instruction set this CPU supports. */
-diff -urNp linux-2.6.32.43/arch/s390/include/asm/setup.h linux-2.6.32.43/arch/s390/include/asm/setup.h
---- linux-2.6.32.43/arch/s390/include/asm/setup.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/s390/include/asm/setup.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/s390/include/asm/setup.h linux-2.6.32.44/arch/s390/include/asm/setup.h
+--- linux-2.6.32.44/arch/s390/include/asm/setup.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/s390/include/asm/setup.h 2011-04-17 15:56:45.000000000 -0400
@@ -50,13 +50,13 @@ extern unsigned long memory_end;
void detect_memory_layout(struct mem_chunk chunk[]);
@@ -3247,9 +3195,9 @@ diff -urNp linux-2.6.32.43/arch/s390/include/asm/setup.h linux-2.6.32.43/arch/s3
#else
#define s390_noexec (0)
#endif
-diff -urNp linux-2.6.32.43/arch/s390/include/asm/uaccess.h linux-2.6.32.43/arch/s390/include/asm/uaccess.h
---- linux-2.6.32.43/arch/s390/include/asm/uaccess.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/s390/include/asm/uaccess.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/s390/include/asm/uaccess.h linux-2.6.32.44/arch/s390/include/asm/uaccess.h
+--- linux-2.6.32.44/arch/s390/include/asm/uaccess.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/s390/include/asm/uaccess.h 2011-04-17 15:56:45.000000000 -0400
@@ -232,6 +232,10 @@ static inline unsigned long __must_check
copy_to_user(void __user *to, const void *from, unsigned long n)
{
@@ -3282,9 +3230,9 @@ diff -urNp linux-2.6.32.43/arch/s390/include/asm/uaccess.h linux-2.6.32.43/arch/
if (access_ok(VERIFY_READ, from, n))
n = __copy_from_user(to, from, n);
else
-diff -urNp linux-2.6.32.43/arch/s390/Kconfig linux-2.6.32.43/arch/s390/Kconfig
---- linux-2.6.32.43/arch/s390/Kconfig 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/s390/Kconfig 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/s390/Kconfig linux-2.6.32.44/arch/s390/Kconfig
+--- linux-2.6.32.44/arch/s390/Kconfig 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/s390/Kconfig 2011-04-17 15:56:45.000000000 -0400
@@ -194,28 +194,26 @@ config AUDIT_ARCH
config S390_SWITCH_AMODE
@@ -3322,9 +3270,9 @@ diff -urNp linux-2.6.32.43/arch/s390/Kconfig linux-2.6.32.43/arch/s390/Kconfig
comment "Code generation options"
-diff -urNp linux-2.6.32.43/arch/s390/kernel/module.c linux-2.6.32.43/arch/s390/kernel/module.c
---- linux-2.6.32.43/arch/s390/kernel/module.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/s390/kernel/module.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/s390/kernel/module.c linux-2.6.32.44/arch/s390/kernel/module.c
+--- linux-2.6.32.44/arch/s390/kernel/module.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/s390/kernel/module.c 2011-04-17 15:56:45.000000000 -0400
@@ -166,11 +166,11 @@ module_frob_arch_sections(Elf_Ehdr *hdr,
/* Increase core size by size of got & plt and set start
@@ -3396,9 +3344,9 @@ diff -urNp linux-2.6.32.43/arch/s390/kernel/module.c linux-2.6.32.43/arch/s390/k
rela->r_addend - loc;
if (r_type == R_390_GOTPC)
*(unsigned int *) loc = val;
-diff -urNp linux-2.6.32.43/arch/s390/kernel/setup.c linux-2.6.32.43/arch/s390/kernel/setup.c
---- linux-2.6.32.43/arch/s390/kernel/setup.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/s390/kernel/setup.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/s390/kernel/setup.c linux-2.6.32.44/arch/s390/kernel/setup.c
+--- linux-2.6.32.44/arch/s390/kernel/setup.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/s390/kernel/setup.c 2011-04-17 15:56:45.000000000 -0400
@@ -306,9 +306,6 @@ static int __init early_parse_mem(char *
early_param("mem", early_parse_mem);
@@ -3452,9 +3400,9 @@ diff -urNp linux-2.6.32.43/arch/s390/kernel/setup.c linux-2.6.32.43/arch/s390/ke
static void setup_addressing_mode(void)
{
if (s390_noexec) {
-diff -urNp linux-2.6.32.43/arch/s390/mm/mmap.c linux-2.6.32.43/arch/s390/mm/mmap.c
---- linux-2.6.32.43/arch/s390/mm/mmap.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/s390/mm/mmap.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/s390/mm/mmap.c linux-2.6.32.44/arch/s390/mm/mmap.c
+--- linux-2.6.32.44/arch/s390/mm/mmap.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/s390/mm/mmap.c 2011-04-17 15:56:45.000000000 -0400
@@ -78,10 +78,22 @@ void arch_pick_mmap_layout(struct mm_str
*/
if (mmap_is_legacy()) {
@@ -3501,9 +3449,9 @@ diff -urNp linux-2.6.32.43/arch/s390/mm/mmap.c linux-2.6.32.43/arch/s390/mm/mmap
mm->get_unmapped_area = s390_get_unmapped_area_topdown;
mm->unmap_area = arch_unmap_area_topdown;
}
-diff -urNp linux-2.6.32.43/arch/score/include/asm/system.h linux-2.6.32.43/arch/score/include/asm/system.h
---- linux-2.6.32.43/arch/score/include/asm/system.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/score/include/asm/system.h 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/score/include/asm/system.h linux-2.6.32.44/arch/score/include/asm/system.h
+--- linux-2.6.32.44/arch/score/include/asm/system.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/score/include/asm/system.h 2011-04-17 15:56:45.000000000 -0400
@@ -17,7 +17,7 @@ do { \
#define finish_arch_switch(prev) do {} while (0)
@@ -3513,9 +3461,9 @@ diff -urNp linux-2.6.32.43/arch/score/include/asm/system.h linux-2.6.32.43/arch/
#define mb() barrier()
#define rmb() barrier()
-diff -urNp linux-2.6.32.43/arch/score/kernel/process.c linux-2.6.32.43/arch/score/kernel/process.c
---- linux-2.6.32.43/arch/score/kernel/process.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/score/kernel/process.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/score/kernel/process.c linux-2.6.32.44/arch/score/kernel/process.c
+--- linux-2.6.32.44/arch/score/kernel/process.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/score/kernel/process.c 2011-04-17 15:56:45.000000000 -0400
@@ -161,8 +161,3 @@ unsigned long get_wchan(struct task_stru
return task_pt_regs(task)->cp0_epc;
@@ -3525,9 +3473,9 @@ diff -urNp linux-2.6.32.43/arch/score/kernel/process.c linux-2.6.32.43/arch/scor
-{
- return sp;
-}
-diff -urNp linux-2.6.32.43/arch/sh/boards/mach-hp6xx/pm.c linux-2.6.32.43/arch/sh/boards/mach-hp6xx/pm.c
---- linux-2.6.32.43/arch/sh/boards/mach-hp6xx/pm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sh/boards/mach-hp6xx/pm.c 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sh/boards/mach-hp6xx/pm.c linux-2.6.32.44/arch/sh/boards/mach-hp6xx/pm.c
+--- linux-2.6.32.44/arch/sh/boards/mach-hp6xx/pm.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sh/boards/mach-hp6xx/pm.c 2011-04-17 15:56:45.000000000 -0400
@@ -143,7 +143,7 @@ static int hp6x0_pm_enter(suspend_state_
return 0;
}
@@ -3537,9 +3485,9 @@ diff -urNp linux-2.6.32.43/arch/sh/boards/mach-hp6xx/pm.c linux-2.6.32.43/arch/s
.enter = hp6x0_pm_enter,
.valid = suspend_valid_only_mem,
};
-diff -urNp linux-2.6.32.43/arch/sh/kernel/cpu/sh4/sq.c linux-2.6.32.43/arch/sh/kernel/cpu/sh4/sq.c
---- linux-2.6.32.43/arch/sh/kernel/cpu/sh4/sq.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sh/kernel/cpu/sh4/sq.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sh/kernel/cpu/sh4/sq.c linux-2.6.32.44/arch/sh/kernel/cpu/sh4/sq.c
+--- linux-2.6.32.44/arch/sh/kernel/cpu/sh4/sq.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sh/kernel/cpu/sh4/sq.c 2011-04-17 15:56:46.000000000 -0400
@@ -327,7 +327,7 @@ static struct attribute *sq_sysfs_attrs[
NULL,
};
@@ -3549,9 +3497,9 @@ diff -urNp linux-2.6.32.43/arch/sh/kernel/cpu/sh4/sq.c linux-2.6.32.43/arch/sh/k
.show = sq_sysfs_show,
.store = sq_sysfs_store,
};
-diff -urNp linux-2.6.32.43/arch/sh/kernel/cpu/shmobile/pm.c linux-2.6.32.43/arch/sh/kernel/cpu/shmobile/pm.c
---- linux-2.6.32.43/arch/sh/kernel/cpu/shmobile/pm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sh/kernel/cpu/shmobile/pm.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sh/kernel/cpu/shmobile/pm.c linux-2.6.32.44/arch/sh/kernel/cpu/shmobile/pm.c
+--- linux-2.6.32.44/arch/sh/kernel/cpu/shmobile/pm.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sh/kernel/cpu/shmobile/pm.c 2011-04-17 15:56:46.000000000 -0400
@@ -58,7 +58,7 @@ static int sh_pm_enter(suspend_state_t s
return 0;
}
@@ -3561,9 +3509,9 @@ diff -urNp linux-2.6.32.43/arch/sh/kernel/cpu/shmobile/pm.c linux-2.6.32.43/arch
.enter = sh_pm_enter,
.valid = suspend_valid_only_mem,
};
-diff -urNp linux-2.6.32.43/arch/sh/kernel/kgdb.c linux-2.6.32.43/arch/sh/kernel/kgdb.c
---- linux-2.6.32.43/arch/sh/kernel/kgdb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sh/kernel/kgdb.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sh/kernel/kgdb.c linux-2.6.32.44/arch/sh/kernel/kgdb.c
+--- linux-2.6.32.44/arch/sh/kernel/kgdb.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sh/kernel/kgdb.c 2011-04-17 15:56:46.000000000 -0400
@@ -271,7 +271,7 @@ void kgdb_arch_exit(void)
{
}
@@ -3573,9 +3521,9 @@ diff -urNp linux-2.6.32.43/arch/sh/kernel/kgdb.c linux-2.6.32.43/arch/sh/kernel/
/* Breakpoint instruction: trapa #0x3c */
#ifdef CONFIG_CPU_LITTLE_ENDIAN
.gdb_bpt_instr = { 0x3c, 0xc3 },
-diff -urNp linux-2.6.32.43/arch/sh/mm/mmap.c linux-2.6.32.43/arch/sh/mm/mmap.c
---- linux-2.6.32.43/arch/sh/mm/mmap.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sh/mm/mmap.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sh/mm/mmap.c linux-2.6.32.44/arch/sh/mm/mmap.c
+--- linux-2.6.32.44/arch/sh/mm/mmap.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sh/mm/mmap.c 2011-04-17 15:56:46.000000000 -0400
@@ -74,8 +74,7 @@ unsigned long arch_get_unmapped_area(str
addr = PAGE_ALIGN(addr);
@@ -3650,9 +3598,9 @@ diff -urNp linux-2.6.32.43/arch/sh/mm/mmap.c linux-2.6.32.43/arch/sh/mm/mmap.c
bottomup:
/*
-diff -urNp linux-2.6.32.43/arch/sparc/include/asm/atomic_64.h linux-2.6.32.43/arch/sparc/include/asm/atomic_64.h
---- linux-2.6.32.43/arch/sparc/include/asm/atomic_64.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/include/asm/atomic_64.h 2011-07-13 22:22:56.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/include/asm/atomic_64.h linux-2.6.32.44/arch/sparc/include/asm/atomic_64.h
+--- linux-2.6.32.44/arch/sparc/include/asm/atomic_64.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/include/asm/atomic_64.h 2011-07-13 22:22:56.000000000 -0400
@@ -14,18 +14,40 @@
#define ATOMIC64_INIT(i) { (i) }
@@ -3829,9 +3777,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/include/asm/atomic_64.h linux-2.6.32.43/ar
}
#define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
-diff -urNp linux-2.6.32.43/arch/sparc/include/asm/cache.h linux-2.6.32.43/arch/sparc/include/asm/cache.h
---- linux-2.6.32.43/arch/sparc/include/asm/cache.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/include/asm/cache.h 2011-07-06 19:53:33.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/include/asm/cache.h linux-2.6.32.44/arch/sparc/include/asm/cache.h
+--- linux-2.6.32.44/arch/sparc/include/asm/cache.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/include/asm/cache.h 2011-07-06 19:53:33.000000000 -0400
@@ -8,7 +8,7 @@
#define _SPARC_CACHE_H
@@ -3841,9 +3789,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/include/asm/cache.h linux-2.6.32.43/arch/s
#define L1_CACHE_ALIGN(x) ((((x)+(L1_CACHE_BYTES-1))&~(L1_CACHE_BYTES-1)))
#ifdef CONFIG_SPARC32
-diff -urNp linux-2.6.32.43/arch/sparc/include/asm/dma-mapping.h linux-2.6.32.43/arch/sparc/include/asm/dma-mapping.h
---- linux-2.6.32.43/arch/sparc/include/asm/dma-mapping.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/include/asm/dma-mapping.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/include/asm/dma-mapping.h linux-2.6.32.44/arch/sparc/include/asm/dma-mapping.h
+--- linux-2.6.32.44/arch/sparc/include/asm/dma-mapping.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/include/asm/dma-mapping.h 2011-04-17 15:56:46.000000000 -0400
@@ -14,10 +14,10 @@ extern int dma_set_mask(struct device *d
#define dma_free_noncoherent(d, s, v, h) dma_free_coherent(d, s, v, h)
#define dma_is_consistent(d, h) (1)
@@ -3875,9 +3823,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/include/asm/dma-mapping.h linux-2.6.32.43/
debug_dma_free_coherent(dev, size, cpu_addr, dma_handle);
ops->free_coherent(dev, size, cpu_addr, dma_handle);
-diff -urNp linux-2.6.32.43/arch/sparc/include/asm/elf_32.h linux-2.6.32.43/arch/sparc/include/asm/elf_32.h
---- linux-2.6.32.43/arch/sparc/include/asm/elf_32.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/include/asm/elf_32.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/include/asm/elf_32.h linux-2.6.32.44/arch/sparc/include/asm/elf_32.h
+--- linux-2.6.32.44/arch/sparc/include/asm/elf_32.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/include/asm/elf_32.h 2011-04-17 15:56:46.000000000 -0400
@@ -116,6 +116,13 @@ typedef struct {
#define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE)
@@ -3892,9 +3840,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/include/asm/elf_32.h linux-2.6.32.43/arch/
/* This yields a mask that user programs can use to figure out what
instruction set this cpu supports. This can NOT be done in userspace
on Sparc. */
-diff -urNp linux-2.6.32.43/arch/sparc/include/asm/elf_64.h linux-2.6.32.43/arch/sparc/include/asm/elf_64.h
---- linux-2.6.32.43/arch/sparc/include/asm/elf_64.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/include/asm/elf_64.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/include/asm/elf_64.h linux-2.6.32.44/arch/sparc/include/asm/elf_64.h
+--- linux-2.6.32.44/arch/sparc/include/asm/elf_64.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/include/asm/elf_64.h 2011-04-17 15:56:46.000000000 -0400
@@ -163,6 +163,12 @@ typedef struct {
#define ELF_ET_DYN_BASE 0x0000010000000000UL
#define COMPAT_ELF_ET_DYN_BASE 0x0000000070000000UL
@@ -3908,9 +3856,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/include/asm/elf_64.h linux-2.6.32.43/arch/
/* This yields a mask that user programs can use to figure out what
instruction set this cpu supports. */
-diff -urNp linux-2.6.32.43/arch/sparc/include/asm/pgtable_32.h linux-2.6.32.43/arch/sparc/include/asm/pgtable_32.h
---- linux-2.6.32.43/arch/sparc/include/asm/pgtable_32.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/include/asm/pgtable_32.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/include/asm/pgtable_32.h linux-2.6.32.44/arch/sparc/include/asm/pgtable_32.h
+--- linux-2.6.32.44/arch/sparc/include/asm/pgtable_32.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/include/asm/pgtable_32.h 2011-04-17 15:56:46.000000000 -0400
@@ -43,6 +43,13 @@ BTFIXUPDEF_SIMM13(user_ptrs_per_pgd)
BTFIXUPDEF_INT(page_none)
BTFIXUPDEF_INT(page_copy)
@@ -3942,9 +3890,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/include/asm/pgtable_32.h linux-2.6.32.43/a
extern unsigned long page_kernel;
#ifdef MODULE
-diff -urNp linux-2.6.32.43/arch/sparc/include/asm/pgtsrmmu.h linux-2.6.32.43/arch/sparc/include/asm/pgtsrmmu.h
---- linux-2.6.32.43/arch/sparc/include/asm/pgtsrmmu.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/include/asm/pgtsrmmu.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/include/asm/pgtsrmmu.h linux-2.6.32.44/arch/sparc/include/asm/pgtsrmmu.h
+--- linux-2.6.32.44/arch/sparc/include/asm/pgtsrmmu.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/include/asm/pgtsrmmu.h 2011-04-17 15:56:46.000000000 -0400
@@ -115,6 +115,13 @@
SRMMU_EXEC | SRMMU_REF)
#define SRMMU_PAGE_RDONLY __pgprot(SRMMU_VALID | SRMMU_CACHE | \
@@ -3959,9 +3907,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/include/asm/pgtsrmmu.h linux-2.6.32.43/arc
#define SRMMU_PAGE_KERNEL __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_PRIV | \
SRMMU_DIRTY | SRMMU_REF)
-diff -urNp linux-2.6.32.43/arch/sparc/include/asm/spinlock_64.h linux-2.6.32.43/arch/sparc/include/asm/spinlock_64.h
---- linux-2.6.32.43/arch/sparc/include/asm/spinlock_64.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/include/asm/spinlock_64.h 2011-05-04 17:56:20.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/include/asm/spinlock_64.h linux-2.6.32.44/arch/sparc/include/asm/spinlock_64.h
+--- linux-2.6.32.44/arch/sparc/include/asm/spinlock_64.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/include/asm/spinlock_64.h 2011-05-04 17:56:20.000000000 -0400
@@ -92,14 +92,19 @@ static inline void __raw_spin_lock_flags
/* Multi-reader locks, these are much saner than the 32-bit Sparc ones... */
@@ -4046,9 +3994,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/include/asm/spinlock_64.h linux-2.6.32.43/
{
__asm__ __volatile__(
" stw %%g0, [%0]"
-diff -urNp linux-2.6.32.43/arch/sparc/include/asm/thread_info_32.h linux-2.6.32.43/arch/sparc/include/asm/thread_info_32.h
---- linux-2.6.32.43/arch/sparc/include/asm/thread_info_32.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/include/asm/thread_info_32.h 2011-06-04 20:46:01.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/include/asm/thread_info_32.h linux-2.6.32.44/arch/sparc/include/asm/thread_info_32.h
+--- linux-2.6.32.44/arch/sparc/include/asm/thread_info_32.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/include/asm/thread_info_32.h 2011-06-04 20:46:01.000000000 -0400
@@ -50,6 +50,8 @@ struct thread_info {
unsigned long w_saved;
@@ -4058,9 +4006,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/include/asm/thread_info_32.h linux-2.6.32.
};
/*
-diff -urNp linux-2.6.32.43/arch/sparc/include/asm/thread_info_64.h linux-2.6.32.43/arch/sparc/include/asm/thread_info_64.h
---- linux-2.6.32.43/arch/sparc/include/asm/thread_info_64.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/include/asm/thread_info_64.h 2011-06-04 20:46:21.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/include/asm/thread_info_64.h linux-2.6.32.44/arch/sparc/include/asm/thread_info_64.h
+--- linux-2.6.32.44/arch/sparc/include/asm/thread_info_64.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/include/asm/thread_info_64.h 2011-06-04 20:46:21.000000000 -0400
@@ -68,6 +68,8 @@ struct thread_info {
struct pt_regs *kern_una_regs;
unsigned int kern_una_insn;
@@ -4070,9 +4018,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/include/asm/thread_info_64.h linux-2.6.32.
unsigned long fpregs[0] __attribute__ ((aligned(64)));
};
-diff -urNp linux-2.6.32.43/arch/sparc/include/asm/uaccess_32.h linux-2.6.32.43/arch/sparc/include/asm/uaccess_32.h
---- linux-2.6.32.43/arch/sparc/include/asm/uaccess_32.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/include/asm/uaccess_32.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/include/asm/uaccess_32.h linux-2.6.32.44/arch/sparc/include/asm/uaccess_32.h
+--- linux-2.6.32.44/arch/sparc/include/asm/uaccess_32.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/include/asm/uaccess_32.h 2011-04-17 15:56:46.000000000 -0400
@@ -249,27 +249,46 @@ extern unsigned long __copy_user(void __
static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
@@ -4124,9 +4072,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/include/asm/uaccess_32.h linux-2.6.32.43/a
return __copy_user((__force void __user *) to, from, n);
}
-diff -urNp linux-2.6.32.43/arch/sparc/include/asm/uaccess_64.h linux-2.6.32.43/arch/sparc/include/asm/uaccess_64.h
---- linux-2.6.32.43/arch/sparc/include/asm/uaccess_64.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/include/asm/uaccess_64.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/include/asm/uaccess_64.h linux-2.6.32.44/arch/sparc/include/asm/uaccess_64.h
+--- linux-2.6.32.44/arch/sparc/include/asm/uaccess_64.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/include/asm/uaccess_64.h 2011-04-17 15:56:46.000000000 -0400
@@ -9,6 +9,7 @@
#include <linux/compiler.h>
#include <linux/string.h>
@@ -4169,9 +4117,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/include/asm/uaccess_64.h linux-2.6.32.43/a
if (unlikely(ret))
ret = copy_to_user_fixup(to, from, size);
return ret;
-diff -urNp linux-2.6.32.43/arch/sparc/include/asm/uaccess.h linux-2.6.32.43/arch/sparc/include/asm/uaccess.h
---- linux-2.6.32.43/arch/sparc/include/asm/uaccess.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/include/asm/uaccess.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/include/asm/uaccess.h linux-2.6.32.44/arch/sparc/include/asm/uaccess.h
+--- linux-2.6.32.44/arch/sparc/include/asm/uaccess.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/include/asm/uaccess.h 2011-04-17 15:56:46.000000000 -0400
@@ -1,5 +1,13 @@
#ifndef ___ASM_SPARC_UACCESS_H
#define ___ASM_SPARC_UACCESS_H
@@ -4186,9 +4134,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/include/asm/uaccess.h linux-2.6.32.43/arch
#if defined(__sparc__) && defined(__arch64__)
#include <asm/uaccess_64.h>
#else
-diff -urNp linux-2.6.32.43/arch/sparc/kernel/iommu.c linux-2.6.32.43/arch/sparc/kernel/iommu.c
---- linux-2.6.32.43/arch/sparc/kernel/iommu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/kernel/iommu.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/kernel/iommu.c linux-2.6.32.44/arch/sparc/kernel/iommu.c
+--- linux-2.6.32.44/arch/sparc/kernel/iommu.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/kernel/iommu.c 2011-04-17 15:56:46.000000000 -0400
@@ -826,7 +826,7 @@ static void dma_4u_sync_sg_for_cpu(struc
spin_unlock_irqrestore(&iommu->lock, flags);
}
@@ -4207,9 +4155,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/kernel/iommu.c linux-2.6.32.43/arch/sparc/
EXPORT_SYMBOL(dma_ops);
extern int pci64_dma_supported(struct pci_dev *pdev, u64 device_mask);
-diff -urNp linux-2.6.32.43/arch/sparc/kernel/ioport.c linux-2.6.32.43/arch/sparc/kernel/ioport.c
---- linux-2.6.32.43/arch/sparc/kernel/ioport.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/kernel/ioport.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/kernel/ioport.c linux-2.6.32.44/arch/sparc/kernel/ioport.c
+--- linux-2.6.32.44/arch/sparc/kernel/ioport.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/kernel/ioport.c 2011-04-17 15:56:46.000000000 -0400
@@ -392,7 +392,7 @@ static void sbus_sync_sg_for_device(stru
BUG();
}
@@ -4237,9 +4185,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/kernel/ioport.c linux-2.6.32.43/arch/sparc
.alloc_coherent = pci32_alloc_coherent,
.free_coherent = pci32_free_coherent,
.map_page = pci32_map_page,
-diff -urNp linux-2.6.32.43/arch/sparc/kernel/kgdb_32.c linux-2.6.32.43/arch/sparc/kernel/kgdb_32.c
---- linux-2.6.32.43/arch/sparc/kernel/kgdb_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/kernel/kgdb_32.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/kernel/kgdb_32.c linux-2.6.32.44/arch/sparc/kernel/kgdb_32.c
+--- linux-2.6.32.44/arch/sparc/kernel/kgdb_32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/kernel/kgdb_32.c 2011-04-17 15:56:46.000000000 -0400
@@ -158,7 +158,7 @@ void kgdb_arch_exit(void)
{
}
@@ -4249,9 +4197,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/kernel/kgdb_32.c linux-2.6.32.43/arch/spar
/* Breakpoint instruction: ta 0x7d */
.gdb_bpt_instr = { 0x91, 0xd0, 0x20, 0x7d },
};
-diff -urNp linux-2.6.32.43/arch/sparc/kernel/kgdb_64.c linux-2.6.32.43/arch/sparc/kernel/kgdb_64.c
---- linux-2.6.32.43/arch/sparc/kernel/kgdb_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/kernel/kgdb_64.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/kernel/kgdb_64.c linux-2.6.32.44/arch/sparc/kernel/kgdb_64.c
+--- linux-2.6.32.44/arch/sparc/kernel/kgdb_64.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/kernel/kgdb_64.c 2011-04-17 15:56:46.000000000 -0400
@@ -180,7 +180,7 @@ void kgdb_arch_exit(void)
{
}
@@ -4261,9 +4209,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/kernel/kgdb_64.c linux-2.6.32.43/arch/spar
/* Breakpoint instruction: ta 0x72 */
.gdb_bpt_instr = { 0x91, 0xd0, 0x20, 0x72 },
};
-diff -urNp linux-2.6.32.43/arch/sparc/kernel/Makefile linux-2.6.32.43/arch/sparc/kernel/Makefile
---- linux-2.6.32.43/arch/sparc/kernel/Makefile 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/kernel/Makefile 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/kernel/Makefile linux-2.6.32.44/arch/sparc/kernel/Makefile
+--- linux-2.6.32.44/arch/sparc/kernel/Makefile 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/kernel/Makefile 2011-04-17 15:56:46.000000000 -0400
@@ -3,7 +3,7 @@
#
@@ -4273,9 +4221,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/kernel/Makefile linux-2.6.32.43/arch/sparc
extra-y := head_$(BITS).o
extra-y += init_task.o
-diff -urNp linux-2.6.32.43/arch/sparc/kernel/pci_sun4v.c linux-2.6.32.43/arch/sparc/kernel/pci_sun4v.c
---- linux-2.6.32.43/arch/sparc/kernel/pci_sun4v.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/kernel/pci_sun4v.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/kernel/pci_sun4v.c linux-2.6.32.44/arch/sparc/kernel/pci_sun4v.c
+--- linux-2.6.32.44/arch/sparc/kernel/pci_sun4v.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/kernel/pci_sun4v.c 2011-04-17 15:56:46.000000000 -0400
@@ -525,7 +525,7 @@ static void dma_4v_unmap_sg(struct devic
spin_unlock_irqrestore(&iommu->lock, flags);
}
@@ -4285,9 +4233,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/kernel/pci_sun4v.c linux-2.6.32.43/arch/sp
.alloc_coherent = dma_4v_alloc_coherent,
.free_coherent = dma_4v_free_coherent,
.map_page = dma_4v_map_page,
-diff -urNp linux-2.6.32.43/arch/sparc/kernel/process_32.c linux-2.6.32.43/arch/sparc/kernel/process_32.c
---- linux-2.6.32.43/arch/sparc/kernel/process_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/kernel/process_32.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/kernel/process_32.c linux-2.6.32.44/arch/sparc/kernel/process_32.c
+--- linux-2.6.32.44/arch/sparc/kernel/process_32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/kernel/process_32.c 2011-04-17 15:56:46.000000000 -0400
@@ -196,7 +196,7 @@ void __show_backtrace(unsigned long fp)
rw->ins[4], rw->ins[5],
rw->ins[6],
@@ -4323,9 +4271,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/kernel/process_32.c linux-2.6.32.43/arch/s
fp = rw->ins[6];
} while (++count < 16);
printk("\n");
-diff -urNp linux-2.6.32.43/arch/sparc/kernel/process_64.c linux-2.6.32.43/arch/sparc/kernel/process_64.c
---- linux-2.6.32.43/arch/sparc/kernel/process_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/kernel/process_64.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/kernel/process_64.c linux-2.6.32.44/arch/sparc/kernel/process_64.c
+--- linux-2.6.32.44/arch/sparc/kernel/process_64.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/kernel/process_64.c 2011-04-17 15:56:46.000000000 -0400
@@ -180,14 +180,14 @@ static void show_regwindow(struct pt_reg
printk("i4: %016lx i5: %016lx i6: %016lx i7: %016lx\n",
rwk->ins[4], rwk->ins[5], rwk->ins[6], rwk->ins[7]);
@@ -4361,9 +4309,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/kernel/process_64.c linux-2.6.32.43/arch/s
(void *) gp->tpc,
(void *) gp->o7,
(void *) gp->i7,
-diff -urNp linux-2.6.32.43/arch/sparc/kernel/sys_sparc_32.c linux-2.6.32.43/arch/sparc/kernel/sys_sparc_32.c
---- linux-2.6.32.43/arch/sparc/kernel/sys_sparc_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/kernel/sys_sparc_32.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/kernel/sys_sparc_32.c linux-2.6.32.44/arch/sparc/kernel/sys_sparc_32.c
+--- linux-2.6.32.44/arch/sparc/kernel/sys_sparc_32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/kernel/sys_sparc_32.c 2011-04-17 15:56:46.000000000 -0400
@@ -57,7 +57,7 @@ unsigned long arch_get_unmapped_area(str
if (ARCH_SUN4C && len > 0x20000000)
return -ENOMEM;
@@ -4382,9 +4330,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/kernel/sys_sparc_32.c linux-2.6.32.43/arch
return addr;
addr = vmm->vm_end;
if (flags & MAP_SHARED)
-diff -urNp linux-2.6.32.43/arch/sparc/kernel/sys_sparc_64.c linux-2.6.32.43/arch/sparc/kernel/sys_sparc_64.c
---- linux-2.6.32.43/arch/sparc/kernel/sys_sparc_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/kernel/sys_sparc_64.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/kernel/sys_sparc_64.c linux-2.6.32.44/arch/sparc/kernel/sys_sparc_64.c
+--- linux-2.6.32.44/arch/sparc/kernel/sys_sparc_64.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/kernel/sys_sparc_64.c 2011-04-17 15:56:46.000000000 -0400
@@ -125,7 +125,7 @@ unsigned long arch_get_unmapped_area(str
/* We do not accept a shared mapping if it would violate
* cache aliasing constraints.
@@ -4532,9 +4480,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/kernel/sys_sparc_64.c linux-2.6.32.43/arch
mm->get_unmapped_area = arch_get_unmapped_area_topdown;
mm->unmap_area = arch_unmap_area_topdown;
}
-diff -urNp linux-2.6.32.43/arch/sparc/kernel/traps_32.c linux-2.6.32.43/arch/sparc/kernel/traps_32.c
---- linux-2.6.32.43/arch/sparc/kernel/traps_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/kernel/traps_32.c 2011-06-13 21:25:39.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/kernel/traps_32.c linux-2.6.32.44/arch/sparc/kernel/traps_32.c
+--- linux-2.6.32.44/arch/sparc/kernel/traps_32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/kernel/traps_32.c 2011-06-13 21:25:39.000000000 -0400
@@ -44,6 +44,8 @@ static void instruction_dump(unsigned lo
#define __SAVE __asm__ __volatile__("save %sp, -0x40, %sp\n\t")
#define __RESTORE __asm__ __volatile__("restore %g0, %g0, %g0\n\t")
@@ -4564,9 +4512,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/kernel/traps_32.c linux-2.6.32.43/arch/spa
do_exit(SIGSEGV);
}
-diff -urNp linux-2.6.32.43/arch/sparc/kernel/traps_64.c linux-2.6.32.43/arch/sparc/kernel/traps_64.c
---- linux-2.6.32.43/arch/sparc/kernel/traps_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/kernel/traps_64.c 2011-06-13 21:24:11.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/kernel/traps_64.c linux-2.6.32.44/arch/sparc/kernel/traps_64.c
+--- linux-2.6.32.44/arch/sparc/kernel/traps_64.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/kernel/traps_64.c 2011-06-13 21:24:11.000000000 -0400
@@ -73,7 +73,7 @@ static void dump_tl1_traplog(struct tl1_
i + 1,
p->trapstack[i].tstate, p->trapstack[i].tpc,
@@ -4698,9 +4646,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/kernel/traps_64.c linux-2.6.32.43/arch/spa
do_exit(SIGSEGV);
}
EXPORT_SYMBOL(die_if_kernel);
-diff -urNp linux-2.6.32.43/arch/sparc/kernel/una_asm_64.S linux-2.6.32.43/arch/sparc/kernel/una_asm_64.S
---- linux-2.6.32.43/arch/sparc/kernel/una_asm_64.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/kernel/una_asm_64.S 2011-07-13 22:20:05.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/kernel/una_asm_64.S linux-2.6.32.44/arch/sparc/kernel/una_asm_64.S
+--- linux-2.6.32.44/arch/sparc/kernel/una_asm_64.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/kernel/una_asm_64.S 2011-07-13 22:20:05.000000000 -0400
@@ -127,7 +127,7 @@ do_int_load:
wr %o5, 0x0, %asi
retl
@@ -4710,9 +4658,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/kernel/una_asm_64.S linux-2.6.32.43/arch/s
.section __ex_table,"a"
.word 4b, __retl_efault
-diff -urNp linux-2.6.32.43/arch/sparc/kernel/unaligned_64.c linux-2.6.32.43/arch/sparc/kernel/unaligned_64.c
---- linux-2.6.32.43/arch/sparc/kernel/unaligned_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/kernel/unaligned_64.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/kernel/unaligned_64.c linux-2.6.32.44/arch/sparc/kernel/unaligned_64.c
+--- linux-2.6.32.44/arch/sparc/kernel/unaligned_64.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/kernel/unaligned_64.c 2011-04-17 15:56:46.000000000 -0400
@@ -288,7 +288,7 @@ static void log_unaligned(struct pt_regs
if (count < 5) {
last_time = jiffies;
@@ -4722,9 +4670,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/kernel/unaligned_64.c linux-2.6.32.43/arch
regs->tpc, (void *) regs->tpc);
}
}
-diff -urNp linux-2.6.32.43/arch/sparc/lib/atomic_64.S linux-2.6.32.43/arch/sparc/lib/atomic_64.S
---- linux-2.6.32.43/arch/sparc/lib/atomic_64.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/lib/atomic_64.S 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/lib/atomic_64.S linux-2.6.32.44/arch/sparc/lib/atomic_64.S
+--- linux-2.6.32.44/arch/sparc/lib/atomic_64.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/lib/atomic_64.S 2011-04-17 15:56:46.000000000 -0400
@@ -18,7 +18,12 @@
atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
BACKOFF_SETUP(%o2)
@@ -4959,9 +4907,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/lib/atomic_64.S linux-2.6.32.43/arch/sparc
casx [%o1], %g1, %g7
cmp %g1, %g7
bne,pn %xcc, 2f
-diff -urNp linux-2.6.32.43/arch/sparc/lib/ksyms.c linux-2.6.32.43/arch/sparc/lib/ksyms.c
---- linux-2.6.32.43/arch/sparc/lib/ksyms.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/lib/ksyms.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/lib/ksyms.c linux-2.6.32.44/arch/sparc/lib/ksyms.c
+--- linux-2.6.32.44/arch/sparc/lib/ksyms.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/lib/ksyms.c 2011-04-17 15:56:46.000000000 -0400
@@ -144,12 +144,17 @@ EXPORT_SYMBOL(__downgrade_write);
/* Atomic counter implementation. */
@@ -4980,9 +4928,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/lib/ksyms.c linux-2.6.32.43/arch/sparc/lib
EXPORT_SYMBOL(atomic64_sub_ret);
/* Atomic bit operations. */
-diff -urNp linux-2.6.32.43/arch/sparc/lib/Makefile linux-2.6.32.43/arch/sparc/lib/Makefile
---- linux-2.6.32.43/arch/sparc/lib/Makefile 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/lib/Makefile 2011-05-17 19:26:34.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/lib/Makefile linux-2.6.32.44/arch/sparc/lib/Makefile
+--- linux-2.6.32.44/arch/sparc/lib/Makefile 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/lib/Makefile 2011-05-17 19:26:34.000000000 -0400
@@ -2,7 +2,7 @@
#
@@ -4992,9 +4940,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/lib/Makefile linux-2.6.32.43/arch/sparc/li
lib-$(CONFIG_SPARC32) += mul.o rem.o sdiv.o udiv.o umul.o urem.o ashrdi3.o
lib-$(CONFIG_SPARC32) += memcpy.o memset.o
-diff -urNp linux-2.6.32.43/arch/sparc/lib/rwsem_64.S linux-2.6.32.43/arch/sparc/lib/rwsem_64.S
---- linux-2.6.32.43/arch/sparc/lib/rwsem_64.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/lib/rwsem_64.S 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/lib/rwsem_64.S linux-2.6.32.44/arch/sparc/lib/rwsem_64.S
+--- linux-2.6.32.44/arch/sparc/lib/rwsem_64.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/lib/rwsem_64.S 2011-04-17 15:56:46.000000000 -0400
@@ -11,7 +11,12 @@
.globl __down_read
__down_read:
@@ -5093,9 +5041,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/lib/rwsem_64.S linux-2.6.32.43/arch/sparc/
cas [%o0], %g3, %g7
cmp %g3, %g7
bne,pn %icc, 1b
-diff -urNp linux-2.6.32.43/arch/sparc/Makefile linux-2.6.32.43/arch/sparc/Makefile
---- linux-2.6.32.43/arch/sparc/Makefile 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/Makefile 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/Makefile linux-2.6.32.44/arch/sparc/Makefile
+--- linux-2.6.32.44/arch/sparc/Makefile 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/Makefile 2011-04-17 15:56:46.000000000 -0400
@@ -75,7 +75,7 @@ drivers-$(CONFIG_OPROFILE) += arch/sparc
# Export what is needed by arch/sparc/boot/Makefile
export VMLINUX_INIT VMLINUX_MAIN
@@ -5105,9 +5053,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/Makefile linux-2.6.32.43/arch/sparc/Makefi
VMLINUX_MAIN += $(patsubst %/, %/lib.a, $(libs-y)) $(libs-y)
VMLINUX_MAIN += $(drivers-y) $(net-y)
-diff -urNp linux-2.6.32.43/arch/sparc/mm/fault_32.c linux-2.6.32.43/arch/sparc/mm/fault_32.c
---- linux-2.6.32.43/arch/sparc/mm/fault_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/mm/fault_32.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/mm/fault_32.c linux-2.6.32.44/arch/sparc/mm/fault_32.c
+--- linux-2.6.32.44/arch/sparc/mm/fault_32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/mm/fault_32.c 2011-04-17 15:56:46.000000000 -0400
@@ -21,6 +21,9 @@
#include <linux/interrupt.h>
#include <linux/module.h>
@@ -5411,9 +5359,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/mm/fault_32.c linux-2.6.32.43/arch/sparc/m
/* Allow reads even for write-only mappings */
if(!(vma->vm_flags & (VM_READ | VM_EXEC)))
goto bad_area;
-diff -urNp linux-2.6.32.43/arch/sparc/mm/fault_64.c linux-2.6.32.43/arch/sparc/mm/fault_64.c
---- linux-2.6.32.43/arch/sparc/mm/fault_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/mm/fault_64.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/mm/fault_64.c linux-2.6.32.44/arch/sparc/mm/fault_64.c
+--- linux-2.6.32.44/arch/sparc/mm/fault_64.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/mm/fault_64.c 2011-04-17 15:56:46.000000000 -0400
@@ -20,6 +20,9 @@
#include <linux/kprobes.h>
#include <linux/kdebug.h>
@@ -5920,9 +5868,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/mm/fault_64.c linux-2.6.32.43/arch/sparc/m
/* Pure DTLB misses do not tell us whether the fault causing
* load/store/atomic was a write or not, it only says that there
* was no match. So in such a case we (carefully) read the
-diff -urNp linux-2.6.32.43/arch/sparc/mm/hugetlbpage.c linux-2.6.32.43/arch/sparc/mm/hugetlbpage.c
---- linux-2.6.32.43/arch/sparc/mm/hugetlbpage.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/mm/hugetlbpage.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/mm/hugetlbpage.c linux-2.6.32.44/arch/sparc/mm/hugetlbpage.c
+--- linux-2.6.32.44/arch/sparc/mm/hugetlbpage.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/mm/hugetlbpage.c 2011-04-17 15:56:46.000000000 -0400
@@ -69,7 +69,7 @@ full_search:
}
return -ENOMEM;
@@ -5982,9 +5930,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/mm/hugetlbpage.c linux-2.6.32.43/arch/spar
return addr;
}
if (mm->get_unmapped_area == arch_get_unmapped_area)
-diff -urNp linux-2.6.32.43/arch/sparc/mm/init_32.c linux-2.6.32.43/arch/sparc/mm/init_32.c
---- linux-2.6.32.43/arch/sparc/mm/init_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/mm/init_32.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/mm/init_32.c linux-2.6.32.44/arch/sparc/mm/init_32.c
+--- linux-2.6.32.44/arch/sparc/mm/init_32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/mm/init_32.c 2011-04-17 15:56:46.000000000 -0400
@@ -317,6 +317,9 @@ extern void device_scan(void);
pgprot_t PAGE_SHARED __read_mostly;
EXPORT_SYMBOL(PAGE_SHARED);
@@ -6019,9 +5967,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/mm/init_32.c linux-2.6.32.43/arch/sparc/mm
protection_map[12] = PAGE_READONLY;
protection_map[13] = PAGE_READONLY;
protection_map[14] = PAGE_SHARED;
-diff -urNp linux-2.6.32.43/arch/sparc/mm/Makefile linux-2.6.32.43/arch/sparc/mm/Makefile
---- linux-2.6.32.43/arch/sparc/mm/Makefile 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/mm/Makefile 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/mm/Makefile linux-2.6.32.44/arch/sparc/mm/Makefile
+--- linux-2.6.32.44/arch/sparc/mm/Makefile 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/mm/Makefile 2011-04-17 15:56:46.000000000 -0400
@@ -2,7 +2,7 @@
#
@@ -6031,9 +5979,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/mm/Makefile linux-2.6.32.43/arch/sparc/mm/
obj-$(CONFIG_SPARC64) += ultra.o tlb.o tsb.o
obj-y += fault_$(BITS).o
-diff -urNp linux-2.6.32.43/arch/sparc/mm/srmmu.c linux-2.6.32.43/arch/sparc/mm/srmmu.c
---- linux-2.6.32.43/arch/sparc/mm/srmmu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/sparc/mm/srmmu.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/sparc/mm/srmmu.c linux-2.6.32.44/arch/sparc/mm/srmmu.c
+--- linux-2.6.32.44/arch/sparc/mm/srmmu.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/sparc/mm/srmmu.c 2011-04-17 15:56:46.000000000 -0400
@@ -2200,6 +2200,13 @@ void __init ld_mmu_srmmu(void)
PAGE_SHARED = pgprot_val(SRMMU_PAGE_SHARED);
BTFIXUPSET_INT(page_copy, pgprot_val(SRMMU_PAGE_COPY));
@@ -6048,9 +5996,9 @@ diff -urNp linux-2.6.32.43/arch/sparc/mm/srmmu.c linux-2.6.32.43/arch/sparc/mm/s
BTFIXUPSET_INT(page_kernel, pgprot_val(SRMMU_PAGE_KERNEL));
page_kernel = pgprot_val(SRMMU_PAGE_KERNEL);
-diff -urNp linux-2.6.32.43/arch/um/include/asm/kmap_types.h linux-2.6.32.43/arch/um/include/asm/kmap_types.h
---- linux-2.6.32.43/arch/um/include/asm/kmap_types.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/um/include/asm/kmap_types.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/um/include/asm/kmap_types.h linux-2.6.32.44/arch/um/include/asm/kmap_types.h
+--- linux-2.6.32.44/arch/um/include/asm/kmap_types.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/um/include/asm/kmap_types.h 2011-04-17 15:56:46.000000000 -0400
@@ -23,6 +23,7 @@ enum km_type {
KM_IRQ1,
KM_SOFTIRQ0,
@@ -6059,9 +6007,9 @@ diff -urNp linux-2.6.32.43/arch/um/include/asm/kmap_types.h linux-2.6.32.43/arch
KM_TYPE_NR
};
-diff -urNp linux-2.6.32.43/arch/um/include/asm/page.h linux-2.6.32.43/arch/um/include/asm/page.h
---- linux-2.6.32.43/arch/um/include/asm/page.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/um/include/asm/page.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/um/include/asm/page.h linux-2.6.32.44/arch/um/include/asm/page.h
+--- linux-2.6.32.44/arch/um/include/asm/page.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/um/include/asm/page.h 2011-04-17 15:56:46.000000000 -0400
@@ -14,6 +14,9 @@
#define PAGE_SIZE (_AC(1, UL) << PAGE_SHIFT)
#define PAGE_MASK (~(PAGE_SIZE-1))
@@ -6072,9 +6020,9 @@ diff -urNp linux-2.6.32.43/arch/um/include/asm/page.h linux-2.6.32.43/arch/um/in
#ifndef __ASSEMBLY__
struct page;
-diff -urNp linux-2.6.32.43/arch/um/kernel/process.c linux-2.6.32.43/arch/um/kernel/process.c
---- linux-2.6.32.43/arch/um/kernel/process.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/um/kernel/process.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/um/kernel/process.c linux-2.6.32.44/arch/um/kernel/process.c
+--- linux-2.6.32.44/arch/um/kernel/process.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/um/kernel/process.c 2011-04-17 15:56:46.000000000 -0400
@@ -393,22 +393,6 @@ int singlestepping(void * t)
return 2;
}
@@ -6098,9 +6046,9 @@ diff -urNp linux-2.6.32.43/arch/um/kernel/process.c linux-2.6.32.43/arch/um/kern
unsigned long get_wchan(struct task_struct *p)
{
unsigned long stack_page, sp, ip;
-diff -urNp linux-2.6.32.43/arch/um/sys-i386/syscalls.c linux-2.6.32.43/arch/um/sys-i386/syscalls.c
---- linux-2.6.32.43/arch/um/sys-i386/syscalls.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/um/sys-i386/syscalls.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/um/sys-i386/syscalls.c linux-2.6.32.44/arch/um/sys-i386/syscalls.c
+--- linux-2.6.32.44/arch/um/sys-i386/syscalls.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/um/sys-i386/syscalls.c 2011-04-17 15:56:46.000000000 -0400
@@ -11,6 +11,21 @@
#include "asm/uaccess.h"
#include "asm/unistd.h"
@@ -6123,9 +6071,9 @@ diff -urNp linux-2.6.32.43/arch/um/sys-i386/syscalls.c linux-2.6.32.43/arch/um/s
/*
* Perform the select(nd, in, out, ex, tv) and mmap() system
* calls. Linux/i386 didn't use to be able to handle more than
-diff -urNp linux-2.6.32.43/arch/x86/boot/bitops.h linux-2.6.32.43/arch/x86/boot/bitops.h
---- linux-2.6.32.43/arch/x86/boot/bitops.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/boot/bitops.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/boot/bitops.h linux-2.6.32.44/arch/x86/boot/bitops.h
+--- linux-2.6.32.44/arch/x86/boot/bitops.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/boot/bitops.h 2011-04-17 15:56:46.000000000 -0400
@@ -26,7 +26,7 @@ static inline int variable_test_bit(int
u8 v;
const u32 *p = (const u32 *)addr;
@@ -6144,9 +6092,9 @@ diff -urNp linux-2.6.32.43/arch/x86/boot/bitops.h linux-2.6.32.43/arch/x86/boot/
}
#endif /* BOOT_BITOPS_H */
-diff -urNp linux-2.6.32.43/arch/x86/boot/boot.h linux-2.6.32.43/arch/x86/boot/boot.h
---- linux-2.6.32.43/arch/x86/boot/boot.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/boot/boot.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/boot/boot.h linux-2.6.32.44/arch/x86/boot/boot.h
+--- linux-2.6.32.44/arch/x86/boot/boot.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/boot/boot.h 2011-04-17 15:56:46.000000000 -0400
@@ -82,7 +82,7 @@ static inline void io_delay(void)
static inline u16 ds(void)
{
@@ -6165,9 +6113,9 @@ diff -urNp linux-2.6.32.43/arch/x86/boot/boot.h linux-2.6.32.43/arch/x86/boot/bo
: "=qm" (diff), "+D" (s1), "+S" (s2), "+c" (len));
return diff;
}
-diff -urNp linux-2.6.32.43/arch/x86/boot/compressed/head_32.S linux-2.6.32.43/arch/x86/boot/compressed/head_32.S
---- linux-2.6.32.43/arch/x86/boot/compressed/head_32.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/boot/compressed/head_32.S 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/boot/compressed/head_32.S linux-2.6.32.44/arch/x86/boot/compressed/head_32.S
+--- linux-2.6.32.44/arch/x86/boot/compressed/head_32.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/boot/compressed/head_32.S 2011-04-17 15:56:46.000000000 -0400
@@ -76,7 +76,7 @@ ENTRY(startup_32)
notl %eax
andl %eax, %ebx
@@ -6196,9 +6144,9 @@ diff -urNp linux-2.6.32.43/arch/x86/boot/compressed/head_32.S linux-2.6.32.43/ar
addl %ebx, -__PAGE_OFFSET(%ebx, %ecx)
jmp 1b
2:
-diff -urNp linux-2.6.32.43/arch/x86/boot/compressed/head_64.S linux-2.6.32.43/arch/x86/boot/compressed/head_64.S
---- linux-2.6.32.43/arch/x86/boot/compressed/head_64.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/boot/compressed/head_64.S 2011-07-01 18:53:00.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/boot/compressed/head_64.S linux-2.6.32.44/arch/x86/boot/compressed/head_64.S
+--- linux-2.6.32.44/arch/x86/boot/compressed/head_64.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/boot/compressed/head_64.S 2011-07-01 18:53:00.000000000 -0400
@@ -91,7 +91,7 @@ ENTRY(startup_32)
notl %eax
andl %eax, %ebx
@@ -6226,9 +6174,9 @@ diff -urNp linux-2.6.32.43/arch/x86/boot/compressed/head_64.S linux-2.6.32.43/ar
#endif
/* Target address to relocate to for decompression */
-diff -urNp linux-2.6.32.43/arch/x86/boot/compressed/Makefile linux-2.6.32.43/arch/x86/boot/compressed/Makefile
---- linux-2.6.32.43/arch/x86/boot/compressed/Makefile 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/boot/compressed/Makefile 2011-08-07 14:38:34.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/boot/compressed/Makefile linux-2.6.32.44/arch/x86/boot/compressed/Makefile
+--- linux-2.6.32.44/arch/x86/boot/compressed/Makefile 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/boot/compressed/Makefile 2011-08-07 14:38:34.000000000 -0400
@@ -13,6 +13,9 @@ cflags-$(CONFIG_X86_64) := -mcmodel=smal
KBUILD_CFLAGS += $(cflags-y)
KBUILD_CFLAGS += $(call cc-option,-ffreestanding)
@@ -6239,9 +6187,9 @@ diff -urNp linux-2.6.32.43/arch/x86/boot/compressed/Makefile linux-2.6.32.43/arc
KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
GCOV_PROFILE := n
-diff -urNp linux-2.6.32.43/arch/x86/boot/compressed/misc.c linux-2.6.32.43/arch/x86/boot/compressed/misc.c
---- linux-2.6.32.43/arch/x86/boot/compressed/misc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/boot/compressed/misc.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/boot/compressed/misc.c linux-2.6.32.44/arch/x86/boot/compressed/misc.c
+--- linux-2.6.32.44/arch/x86/boot/compressed/misc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/boot/compressed/misc.c 2011-04-17 15:56:46.000000000 -0400
@@ -288,7 +288,7 @@ static void parse_elf(void *output)
case PT_LOAD:
#ifdef CONFIG_RELOCATABLE
@@ -6260,9 +6208,9 @@ diff -urNp linux-2.6.32.43/arch/x86/boot/compressed/misc.c linux-2.6.32.43/arch/
error("Wrong destination address");
#endif
-diff -urNp linux-2.6.32.43/arch/x86/boot/compressed/mkpiggy.c linux-2.6.32.43/arch/x86/boot/compressed/mkpiggy.c
---- linux-2.6.32.43/arch/x86/boot/compressed/mkpiggy.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/boot/compressed/mkpiggy.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/boot/compressed/mkpiggy.c linux-2.6.32.44/arch/x86/boot/compressed/mkpiggy.c
+--- linux-2.6.32.44/arch/x86/boot/compressed/mkpiggy.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/boot/compressed/mkpiggy.c 2011-04-17 15:56:46.000000000 -0400
@@ -74,7 +74,7 @@ int main(int argc, char *argv[])
offs = (olen > ilen) ? olen - ilen : 0;
@@ -6272,9 +6220,9 @@ diff -urNp linux-2.6.32.43/arch/x86/boot/compressed/mkpiggy.c linux-2.6.32.43/ar
offs = (offs+4095) & ~4095; /* Round to a 4K boundary */
printf(".section \".rodata.compressed\",\"a\",@progbits\n");
-diff -urNp linux-2.6.32.43/arch/x86/boot/compressed/relocs.c linux-2.6.32.43/arch/x86/boot/compressed/relocs.c
---- linux-2.6.32.43/arch/x86/boot/compressed/relocs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/boot/compressed/relocs.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/boot/compressed/relocs.c linux-2.6.32.44/arch/x86/boot/compressed/relocs.c
+--- linux-2.6.32.44/arch/x86/boot/compressed/relocs.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/boot/compressed/relocs.c 2011-04-17 15:56:46.000000000 -0400
@@ -10,8 +10,11 @@
#define USE_BSD
#include <endian.h>
@@ -6475,9 +6423,9 @@ diff -urNp linux-2.6.32.43/arch/x86/boot/compressed/relocs.c linux-2.6.32.43/arc
read_shdrs(fp);
read_strtabs(fp);
read_symtabs(fp);
-diff -urNp linux-2.6.32.43/arch/x86/boot/cpucheck.c linux-2.6.32.43/arch/x86/boot/cpucheck.c
---- linux-2.6.32.43/arch/x86/boot/cpucheck.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/boot/cpucheck.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/boot/cpucheck.c linux-2.6.32.44/arch/x86/boot/cpucheck.c
+--- linux-2.6.32.44/arch/x86/boot/cpucheck.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/boot/cpucheck.c 2011-04-17 15:56:46.000000000 -0400
@@ -74,7 +74,7 @@ static int has_fpu(void)
u16 fcw = -1, fsw = -1;
u32 cr0;
@@ -6573,9 +6521,9 @@ diff -urNp linux-2.6.32.43/arch/x86/boot/cpucheck.c linux-2.6.32.43/arch/x86/boo
err = check_flags();
}
-diff -urNp linux-2.6.32.43/arch/x86/boot/header.S linux-2.6.32.43/arch/x86/boot/header.S
---- linux-2.6.32.43/arch/x86/boot/header.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/boot/header.S 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/boot/header.S linux-2.6.32.44/arch/x86/boot/header.S
+--- linux-2.6.32.44/arch/x86/boot/header.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/boot/header.S 2011-04-17 15:56:46.000000000 -0400
@@ -224,7 +224,7 @@ setup_data: .quad 0 # 64-bit physical
# single linked list of
# struct setup_data
@@ -6585,9 +6533,9 @@ diff -urNp linux-2.6.32.43/arch/x86/boot/header.S linux-2.6.32.43/arch/x86/boot/
#define ZO_INIT_SIZE (ZO__end - ZO_startup_32 + ZO_z_extract_offset)
#define VO_INIT_SIZE (VO__end - VO__text)
-diff -urNp linux-2.6.32.43/arch/x86/boot/Makefile linux-2.6.32.43/arch/x86/boot/Makefile
---- linux-2.6.32.43/arch/x86/boot/Makefile 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/boot/Makefile 2011-08-07 14:38:13.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/boot/Makefile linux-2.6.32.44/arch/x86/boot/Makefile
+--- linux-2.6.32.44/arch/x86/boot/Makefile 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/boot/Makefile 2011-08-07 14:38:13.000000000 -0400
@@ -69,6 +69,9 @@ KBUILD_CFLAGS := $(LINUXINCLUDE) -g -Os
$(call cc-option, -fno-stack-protector) \
$(call cc-option, -mpreferred-stack-boundary=2)
@@ -6598,9 +6546,9 @@ diff -urNp linux-2.6.32.43/arch/x86/boot/Makefile linux-2.6.32.43/arch/x86/boot/
KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
GCOV_PROFILE := n
-diff -urNp linux-2.6.32.43/arch/x86/boot/memory.c linux-2.6.32.43/arch/x86/boot/memory.c
---- linux-2.6.32.43/arch/x86/boot/memory.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/boot/memory.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/boot/memory.c linux-2.6.32.44/arch/x86/boot/memory.c
+--- linux-2.6.32.44/arch/x86/boot/memory.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/boot/memory.c 2011-04-17 15:56:46.000000000 -0400
@@ -19,7 +19,7 @@
static int detect_memory_e820(void)
@@ -6610,9 +6558,9 @@ diff -urNp linux-2.6.32.43/arch/x86/boot/memory.c linux-2.6.32.43/arch/x86/boot/
struct biosregs ireg, oreg;
struct e820entry *desc = boot_params.e820_map;
static struct e820entry buf; /* static so it is zeroed */
-diff -urNp linux-2.6.32.43/arch/x86/boot/video.c linux-2.6.32.43/arch/x86/boot/video.c
---- linux-2.6.32.43/arch/x86/boot/video.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/boot/video.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/boot/video.c linux-2.6.32.44/arch/x86/boot/video.c
+--- linux-2.6.32.44/arch/x86/boot/video.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/boot/video.c 2011-04-17 15:56:46.000000000 -0400
@@ -90,7 +90,7 @@ static void store_mode_params(void)
static unsigned int get_entry(void)
{
@@ -6622,9 +6570,9 @@ diff -urNp linux-2.6.32.43/arch/x86/boot/video.c linux-2.6.32.43/arch/x86/boot/v
int key;
unsigned int v;
-diff -urNp linux-2.6.32.43/arch/x86/boot/video-vesa.c linux-2.6.32.43/arch/x86/boot/video-vesa.c
---- linux-2.6.32.43/arch/x86/boot/video-vesa.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/boot/video-vesa.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/boot/video-vesa.c linux-2.6.32.44/arch/x86/boot/video-vesa.c
+--- linux-2.6.32.44/arch/x86/boot/video-vesa.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/boot/video-vesa.c 2011-04-17 15:56:46.000000000 -0400
@@ -200,6 +200,7 @@ static void vesa_store_pm_info(void)
boot_params.screen_info.vesapm_seg = oreg.es;
@@ -6633,9 +6581,9 @@ diff -urNp linux-2.6.32.43/arch/x86/boot/video-vesa.c linux-2.6.32.43/arch/x86/b
}
/*
-diff -urNp linux-2.6.32.43/arch/x86/ia32/ia32_aout.c linux-2.6.32.43/arch/x86/ia32/ia32_aout.c
---- linux-2.6.32.43/arch/x86/ia32/ia32_aout.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/ia32/ia32_aout.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/ia32/ia32_aout.c linux-2.6.32.44/arch/x86/ia32/ia32_aout.c
+--- linux-2.6.32.44/arch/x86/ia32/ia32_aout.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/ia32/ia32_aout.c 2011-04-17 15:56:46.000000000 -0400
@@ -169,6 +169,8 @@ static int aout_core_dump(long signr, st
unsigned long dump_start, dump_size;
struct user32 dump;
@@ -6658,9 +6606,9 @@ diff -urNp linux-2.6.32.43/arch/x86/ia32/ia32_aout.c linux-2.6.32.43/arch/x86/ia
end_coredump:
set_fs(fs);
return has_dumped;
-diff -urNp linux-2.6.32.43/arch/x86/ia32/ia32entry.S linux-2.6.32.43/arch/x86/ia32/ia32entry.S
---- linux-2.6.32.43/arch/x86/ia32/ia32entry.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/ia32/ia32entry.S 2011-06-04 20:29:52.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/ia32/ia32entry.S linux-2.6.32.44/arch/x86/ia32/ia32entry.S
+--- linux-2.6.32.44/arch/x86/ia32/ia32entry.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/ia32/ia32entry.S 2011-06-04 20:29:52.000000000 -0400
@@ -13,6 +13,7 @@
#include <asm/thread_info.h>
#include <asm/segment.h>
@@ -6836,9 +6784,9 @@ diff -urNp linux-2.6.32.43/arch/x86/ia32/ia32entry.S linux-2.6.32.43/arch/x86/ia
LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
RESTORE_REST
cmpq $(IA32_NR_syscalls-1),%rax
-diff -urNp linux-2.6.32.43/arch/x86/ia32/ia32_signal.c linux-2.6.32.43/arch/x86/ia32/ia32_signal.c
---- linux-2.6.32.43/arch/x86/ia32/ia32_signal.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/ia32/ia32_signal.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/ia32/ia32_signal.c linux-2.6.32.44/arch/x86/ia32/ia32_signal.c
+--- linux-2.6.32.44/arch/x86/ia32/ia32_signal.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/ia32/ia32_signal.c 2011-04-17 15:56:46.000000000 -0400
@@ -403,7 +403,7 @@ static void __user *get_sigframe(struct
sp -= frame_size;
/* Align the stack pointer according to the i386 ABI,
@@ -6888,9 +6836,9 @@ diff -urNp linux-2.6.32.43/arch/x86/ia32/ia32_signal.c linux-2.6.32.43/arch/x86/
} put_user_catch(err);
if (err)
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/alternative.h linux-2.6.32.43/arch/x86/include/asm/alternative.h
---- linux-2.6.32.43/arch/x86/include/asm/alternative.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/alternative.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/alternative.h linux-2.6.32.44/arch/x86/include/asm/alternative.h
+--- linux-2.6.32.44/arch/x86/include/asm/alternative.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/alternative.h 2011-04-17 15:56:46.000000000 -0400
@@ -85,7 +85,7 @@ static inline void alternatives_smp_swit
" .byte 662b-661b\n" /* sourcelen */ \
" .byte 664f-663f\n" /* replacementlen */ \
@@ -6900,9 +6848,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/alternative.h linux-2.6.32.43/ar
"663:\n\t" newinstr "\n664:\n" /* replacement */ \
".previous"
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/apm.h linux-2.6.32.43/arch/x86/include/asm/apm.h
---- linux-2.6.32.43/arch/x86/include/asm/apm.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/apm.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/apm.h linux-2.6.32.44/arch/x86/include/asm/apm.h
+--- linux-2.6.32.44/arch/x86/include/asm/apm.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/apm.h 2011-04-17 15:56:46.000000000 -0400
@@ -34,7 +34,7 @@ static inline void apm_bios_call_asm(u32
__asm__ __volatile__(APM_DO_ZERO_SEGS
"pushl %%edi\n\t"
@@ -6921,9 +6869,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/apm.h linux-2.6.32.43/arch/x86/i
"setc %%bl\n\t"
"popl %%ebp\n\t"
"popl %%edi\n\t"
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/atomic_32.h linux-2.6.32.43/arch/x86/include/asm/atomic_32.h
---- linux-2.6.32.43/arch/x86/include/asm/atomic_32.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/atomic_32.h 2011-05-04 17:56:20.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/atomic_32.h linux-2.6.32.44/arch/x86/include/asm/atomic_32.h
+--- linux-2.6.32.44/arch/x86/include/asm/atomic_32.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/atomic_32.h 2011-05-04 17:56:20.000000000 -0400
@@ -25,6 +25,17 @@ static inline int atomic_read(const atom
}
@@ -7437,9 +7385,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/atomic_32.h linux-2.6.32.43/arch
* atomic64_dec_and_test - decrement and test
* @ptr: pointer to type atomic64_t
*
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/atomic_64.h linux-2.6.32.43/arch/x86/include/asm/atomic_64.h
---- linux-2.6.32.43/arch/x86/include/asm/atomic_64.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/atomic_64.h 2011-05-04 18:35:31.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/atomic_64.h linux-2.6.32.44/arch/x86/include/asm/atomic_64.h
+--- linux-2.6.32.44/arch/x86/include/asm/atomic_64.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/atomic_64.h 2011-05-04 18:35:31.000000000 -0400
@@ -24,6 +24,17 @@ static inline int atomic_read(const atom
}
@@ -8104,9 +8052,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/atomic_64.h linux-2.6.32.43/arch
}
/**
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/bitops.h linux-2.6.32.43/arch/x86/include/asm/bitops.h
---- linux-2.6.32.43/arch/x86/include/asm/bitops.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/bitops.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/bitops.h linux-2.6.32.44/arch/x86/include/asm/bitops.h
+--- linux-2.6.32.44/arch/x86/include/asm/bitops.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/bitops.h 2011-04-17 15:56:46.000000000 -0400
@@ -38,7 +38,7 @@
* a mask operation on a byte.
*/
@@ -8116,9 +8064,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/bitops.h linux-2.6.32.43/arch/x8
#define CONST_MASK(nr) (1 << ((nr) & 7))
/**
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/boot.h linux-2.6.32.43/arch/x86/include/asm/boot.h
---- linux-2.6.32.43/arch/x86/include/asm/boot.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/boot.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/boot.h linux-2.6.32.44/arch/x86/include/asm/boot.h
+--- linux-2.6.32.44/arch/x86/include/asm/boot.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/boot.h 2011-04-17 15:56:46.000000000 -0400
@@ -11,10 +11,15 @@
#include <asm/pgtable_types.h>
@@ -8136,9 +8084,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/boot.h linux-2.6.32.43/arch/x86/
/* Minimum kernel alignment, as a power of two */
#ifdef CONFIG_X86_64
#define MIN_KERNEL_ALIGN_LG2 PMD_SHIFT
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/cacheflush.h linux-2.6.32.43/arch/x86/include/asm/cacheflush.h
---- linux-2.6.32.43/arch/x86/include/asm/cacheflush.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/cacheflush.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/cacheflush.h linux-2.6.32.44/arch/x86/include/asm/cacheflush.h
+--- linux-2.6.32.44/arch/x86/include/asm/cacheflush.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/cacheflush.h 2011-04-17 15:56:46.000000000 -0400
@@ -60,7 +60,7 @@ PAGEFLAG(WC, WC)
static inline unsigned long get_page_memtype(struct page *pg)
{
@@ -8157,9 +8105,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/cacheflush.h linux-2.6.32.43/arc
ClearPageUncached(pg);
ClearPageWC(pg);
break;
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/cache.h linux-2.6.32.43/arch/x86/include/asm/cache.h
---- linux-2.6.32.43/arch/x86/include/asm/cache.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/cache.h 2011-07-06 19:53:33.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/cache.h linux-2.6.32.44/arch/x86/include/asm/cache.h
+--- linux-2.6.32.44/arch/x86/include/asm/cache.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/cache.h 2011-07-06 19:53:33.000000000 -0400
@@ -5,9 +5,10 @@
/* L1 cache line size */
@@ -8172,9 +8120,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/cache.h linux-2.6.32.43/arch/x86
#ifdef CONFIG_X86_VSMP
/* vSMP Internode cacheline shift */
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/checksum_32.h linux-2.6.32.43/arch/x86/include/asm/checksum_32.h
---- linux-2.6.32.43/arch/x86/include/asm/checksum_32.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/checksum_32.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/checksum_32.h linux-2.6.32.44/arch/x86/include/asm/checksum_32.h
+--- linux-2.6.32.44/arch/x86/include/asm/checksum_32.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/checksum_32.h 2011-04-17 15:56:46.000000000 -0400
@@ -31,6 +31,14 @@ asmlinkage __wsum csum_partial_copy_gene
int len, __wsum sum,
int *src_err_ptr, int *dst_err_ptr);
@@ -8208,9 +8156,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/checksum_32.h linux-2.6.32.43/ar
len, sum, NULL, err_ptr);
if (len)
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/desc_defs.h linux-2.6.32.43/arch/x86/include/asm/desc_defs.h
---- linux-2.6.32.43/arch/x86/include/asm/desc_defs.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/desc_defs.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/desc_defs.h linux-2.6.32.44/arch/x86/include/asm/desc_defs.h
+--- linux-2.6.32.44/arch/x86/include/asm/desc_defs.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/desc_defs.h 2011-04-17 15:56:46.000000000 -0400
@@ -31,6 +31,12 @@ struct desc_struct {
unsigned base1: 8, type: 4, s: 1, dpl: 2, p: 1;
unsigned limit: 4, avl: 1, l: 1, d: 1, g: 1, base2: 8;
@@ -8224,9 +8172,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/desc_defs.h linux-2.6.32.43/arch
};
} __attribute__((packed));
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/desc.h linux-2.6.32.43/arch/x86/include/asm/desc.h
---- linux-2.6.32.43/arch/x86/include/asm/desc.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/desc.h 2011-04-23 12:56:10.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/desc.h linux-2.6.32.44/arch/x86/include/asm/desc.h
+--- linux-2.6.32.44/arch/x86/include/asm/desc.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/desc.h 2011-04-23 12:56:10.000000000 -0400
@@ -4,6 +4,7 @@
#include <asm/desc_defs.h>
#include <asm/ldt.h>
@@ -8407,9 +8355,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/desc.h linux-2.6.32.43/arch/x86/
+#endif
+
#endif /* _ASM_X86_DESC_H */
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/device.h linux-2.6.32.43/arch/x86/include/asm/device.h
---- linux-2.6.32.43/arch/x86/include/asm/device.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/device.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/device.h linux-2.6.32.44/arch/x86/include/asm/device.h
+--- linux-2.6.32.44/arch/x86/include/asm/device.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/device.h 2011-04-17 15:56:46.000000000 -0400
@@ -6,7 +6,7 @@ struct dev_archdata {
void *acpi_handle;
#endif
@@ -8419,9 +8367,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/device.h linux-2.6.32.43/arch/x8
#endif
#ifdef CONFIG_DMAR
void *iommu; /* hook for IOMMU specific extension */
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/dma-mapping.h linux-2.6.32.43/arch/x86/include/asm/dma-mapping.h
---- linux-2.6.32.43/arch/x86/include/asm/dma-mapping.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/dma-mapping.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/dma-mapping.h linux-2.6.32.44/arch/x86/include/asm/dma-mapping.h
+--- linux-2.6.32.44/arch/x86/include/asm/dma-mapping.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/dma-mapping.h 2011-04-17 15:56:46.000000000 -0400
@@ -25,9 +25,9 @@ extern int iommu_merge;
extern struct device x86_dma_fallback_dev;
extern int panic_on_overflow;
@@ -8461,9 +8409,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/dma-mapping.h linux-2.6.32.43/ar
WARN_ON(irqs_disabled()); /* for portability */
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/e820.h linux-2.6.32.43/arch/x86/include/asm/e820.h
---- linux-2.6.32.43/arch/x86/include/asm/e820.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/e820.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/e820.h linux-2.6.32.44/arch/x86/include/asm/e820.h
+--- linux-2.6.32.44/arch/x86/include/asm/e820.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/e820.h 2011-04-17 15:56:46.000000000 -0400
@@ -133,7 +133,7 @@ extern char *default_machine_specific_me
#define ISA_END_ADDRESS 0x100000
#define is_ISA_range(s, e) ((s) >= ISA_START_ADDRESS && (e) < ISA_END_ADDRESS)
@@ -8473,9 +8421,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/e820.h linux-2.6.32.43/arch/x86/
#define BIOS_END 0x00100000
#ifdef __KERNEL__
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/elf.h linux-2.6.32.43/arch/x86/include/asm/elf.h
---- linux-2.6.32.43/arch/x86/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/elf.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/elf.h linux-2.6.32.44/arch/x86/include/asm/elf.h
+--- linux-2.6.32.44/arch/x86/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/elf.h 2011-04-17 15:56:46.000000000 -0400
@@ -257,7 +257,25 @@ extern int force_personality32;
the loader. We need to make sure that it is out of the way of the program
that it will "exec", and that there is sufficient room for the brk. */
@@ -8529,9 +8477,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/elf.h linux-2.6.32.43/arch/x86/i
-#define arch_randomize_brk arch_randomize_brk
-
#endif /* _ASM_X86_ELF_H */
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/emergency-restart.h linux-2.6.32.43/arch/x86/include/asm/emergency-restart.h
---- linux-2.6.32.43/arch/x86/include/asm/emergency-restart.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/emergency-restart.h 2011-05-22 23:02:06.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/emergency-restart.h linux-2.6.32.44/arch/x86/include/asm/emergency-restart.h
+--- linux-2.6.32.44/arch/x86/include/asm/emergency-restart.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/emergency-restart.h 2011-05-22 23:02:06.000000000 -0400
@@ -15,6 +15,6 @@ enum reboot_type {
extern enum reboot_type reboot_type;
@@ -8540,9 +8488,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/emergency-restart.h linux-2.6.32
+extern void machine_emergency_restart(void) __noreturn;
#endif /* _ASM_X86_EMERGENCY_RESTART_H */
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/futex.h linux-2.6.32.43/arch/x86/include/asm/futex.h
---- linux-2.6.32.43/arch/x86/include/asm/futex.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/futex.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/futex.h linux-2.6.32.44/arch/x86/include/asm/futex.h
+--- linux-2.6.32.44/arch/x86/include/asm/futex.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/futex.h 2011-04-17 15:56:46.000000000 -0400
@@ -12,16 +12,18 @@
#include <asm/system.h>
@@ -8618,9 +8566,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/futex.h linux-2.6.32.43/arch/x86
: "i" (-EFAULT), "r" (newval), "0" (oldval)
: "memory"
);
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/hw_irq.h linux-2.6.32.43/arch/x86/include/asm/hw_irq.h
---- linux-2.6.32.43/arch/x86/include/asm/hw_irq.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/hw_irq.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/hw_irq.h linux-2.6.32.44/arch/x86/include/asm/hw_irq.h
+--- linux-2.6.32.44/arch/x86/include/asm/hw_irq.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/hw_irq.h 2011-05-04 17:56:28.000000000 -0400
@@ -92,8 +92,8 @@ extern void setup_ioapic_dest(void);
extern void enable_IO_APIC(void);
@@ -8632,9 +8580,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/hw_irq.h linux-2.6.32.43/arch/x8
/* EISA */
extern void eisa_set_level_irq(unsigned int irq);
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/i387.h linux-2.6.32.43/arch/x86/include/asm/i387.h
---- linux-2.6.32.43/arch/x86/include/asm/i387.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/i387.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/i387.h linux-2.6.32.44/arch/x86/include/asm/i387.h
+--- linux-2.6.32.44/arch/x86/include/asm/i387.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/i387.h 2011-04-17 15:56:46.000000000 -0400
@@ -60,6 +60,11 @@ static inline int fxrstor_checking(struc
{
int err;
@@ -8684,9 +8632,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/i387.h linux-2.6.32.43/arch/x86/
else
clts();
}
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/io_32.h linux-2.6.32.43/arch/x86/include/asm/io_32.h
---- linux-2.6.32.43/arch/x86/include/asm/io_32.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/io_32.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/io_32.h linux-2.6.32.44/arch/x86/include/asm/io_32.h
+--- linux-2.6.32.44/arch/x86/include/asm/io_32.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/io_32.h 2011-04-17 15:56:46.000000000 -0400
@@ -3,6 +3,7 @@
#include <linux/string.h>
@@ -8713,9 +8661,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/io_32.h linux-2.6.32.43/arch/x86
#include <asm-generic/iomap.h>
#include <linux/vmalloc.h>
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/io_64.h linux-2.6.32.43/arch/x86/include/asm/io_64.h
---- linux-2.6.32.43/arch/x86/include/asm/io_64.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/io_64.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/io_64.h linux-2.6.32.44/arch/x86/include/asm/io_64.h
+--- linux-2.6.32.44/arch/x86/include/asm/io_64.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/io_64.h 2011-04-17 15:56:46.000000000 -0400
@@ -140,6 +140,17 @@ __OUTS(l)
#include <linux/vmalloc.h>
@@ -8734,9 +8682,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/io_64.h linux-2.6.32.43/arch/x86
#include <asm-generic/iomap.h>
void __memcpy_fromio(void *, unsigned long, unsigned);
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/iommu.h linux-2.6.32.43/arch/x86/include/asm/iommu.h
---- linux-2.6.32.43/arch/x86/include/asm/iommu.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/iommu.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/iommu.h linux-2.6.32.44/arch/x86/include/asm/iommu.h
+--- linux-2.6.32.44/arch/x86/include/asm/iommu.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/iommu.h 2011-04-17 15:56:46.000000000 -0400
@@ -3,7 +3,7 @@
extern void pci_iommu_shutdown(void);
@@ -8746,9 +8694,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/iommu.h linux-2.6.32.43/arch/x86
extern int force_iommu, no_iommu;
extern int iommu_detected;
extern int iommu_pass_through;
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/irqflags.h linux-2.6.32.43/arch/x86/include/asm/irqflags.h
---- linux-2.6.32.43/arch/x86/include/asm/irqflags.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/irqflags.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/irqflags.h linux-2.6.32.44/arch/x86/include/asm/irqflags.h
+--- linux-2.6.32.44/arch/x86/include/asm/irqflags.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/irqflags.h 2011-04-17 15:56:46.000000000 -0400
@@ -142,6 +142,11 @@ static inline unsigned long __raw_local_
sti; \
sysexit
@@ -8761,9 +8709,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/irqflags.h linux-2.6.32.43/arch/
#else
#define INTERRUPT_RETURN iret
#define ENABLE_INTERRUPTS_SYSEXIT sti; sysexit
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/kprobes.h linux-2.6.32.43/arch/x86/include/asm/kprobes.h
---- linux-2.6.32.43/arch/x86/include/asm/kprobes.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/kprobes.h 2011-04-23 12:56:12.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/kprobes.h linux-2.6.32.44/arch/x86/include/asm/kprobes.h
+--- linux-2.6.32.44/arch/x86/include/asm/kprobes.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/kprobes.h 2011-04-23 12:56:12.000000000 -0400
@@ -34,13 +34,8 @@ typedef u8 kprobe_opcode_t;
#define BREAKPOINT_INSTRUCTION 0xcc
#define RELATIVEJUMP_INSTRUCTION 0xe9
@@ -8780,9 +8728,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/kprobes.h linux-2.6.32.43/arch/x
#define flush_insn_slot(p) do { } while (0)
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/kvm_host.h linux-2.6.32.43/arch/x86/include/asm/kvm_host.h
---- linux-2.6.32.43/arch/x86/include/asm/kvm_host.h 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/kvm_host.h 2011-05-10 22:12:26.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/kvm_host.h linux-2.6.32.44/arch/x86/include/asm/kvm_host.h
+--- linux-2.6.32.44/arch/x86/include/asm/kvm_host.h 2011-05-10 22:12:01.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/kvm_host.h 2011-05-10 22:12:26.000000000 -0400
@@ -536,7 +536,7 @@ struct kvm_x86_ops {
const struct trace_print_flags *exit_reasons_str;
};
@@ -8792,9 +8740,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/kvm_host.h linux-2.6.32.43/arch/
int kvm_mmu_module_init(void);
void kvm_mmu_module_exit(void);
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/local.h linux-2.6.32.43/arch/x86/include/asm/local.h
---- linux-2.6.32.43/arch/x86/include/asm/local.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/local.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/local.h linux-2.6.32.44/arch/x86/include/asm/local.h
+--- linux-2.6.32.44/arch/x86/include/asm/local.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/local.h 2011-04-17 15:56:46.000000000 -0400
@@ -18,26 +18,58 @@ typedef struct {
static inline void local_inc(local_t *l)
@@ -8947,9 +8895,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/local.h linux-2.6.32.43/arch/x86
: "+r" (i), "+m" (l->a.counter)
: : "memory");
return i + __i;
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/microcode.h linux-2.6.32.43/arch/x86/include/asm/microcode.h
---- linux-2.6.32.43/arch/x86/include/asm/microcode.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/microcode.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/microcode.h linux-2.6.32.44/arch/x86/include/asm/microcode.h
+--- linux-2.6.32.44/arch/x86/include/asm/microcode.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/microcode.h 2011-04-17 15:56:46.000000000 -0400
@@ -12,13 +12,13 @@ struct device;
enum ucode_state { UCODE_ERROR, UCODE_OK, UCODE_NFOUND };
@@ -8990,9 +8938,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/microcode.h linux-2.6.32.43/arch
{
return NULL;
}
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/mman.h linux-2.6.32.43/arch/x86/include/asm/mman.h
---- linux-2.6.32.43/arch/x86/include/asm/mman.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/mman.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/mman.h linux-2.6.32.44/arch/x86/include/asm/mman.h
+--- linux-2.6.32.44/arch/x86/include/asm/mman.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/mman.h 2011-04-17 15:56:46.000000000 -0400
@@ -5,4 +5,14 @@
#include <asm-generic/mman.h>
@@ -9008,9 +8956,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/mman.h linux-2.6.32.43/arch/x86/
+#endif
+
#endif /* _ASM_X86_MMAN_H */
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/mmu_context.h linux-2.6.32.43/arch/x86/include/asm/mmu_context.h
---- linux-2.6.32.43/arch/x86/include/asm/mmu_context.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/mmu_context.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/mmu_context.h linux-2.6.32.44/arch/x86/include/asm/mmu_context.h
+--- linux-2.6.32.44/arch/x86/include/asm/mmu_context.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/mmu_context.h 2011-04-17 15:56:46.000000000 -0400
@@ -24,6 +24,21 @@ void destroy_context(struct mm_struct *m
static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
@@ -9134,9 +9082,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/mmu_context.h linux-2.6.32.43/ar
}
#define activate_mm(prev, next) \
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/mmu.h linux-2.6.32.43/arch/x86/include/asm/mmu.h
---- linux-2.6.32.43/arch/x86/include/asm/mmu.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/mmu.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/mmu.h linux-2.6.32.44/arch/x86/include/asm/mmu.h
+--- linux-2.6.32.44/arch/x86/include/asm/mmu.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/mmu.h 2011-04-17 15:56:46.000000000 -0400
@@ -9,10 +9,23 @@
* we put the segment information here.
*/
@@ -9163,9 +9111,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/mmu.h linux-2.6.32.43/arch/x86/i
} mm_context_t;
#ifdef CONFIG_SMP
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/module.h linux-2.6.32.43/arch/x86/include/asm/module.h
---- linux-2.6.32.43/arch/x86/include/asm/module.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/module.h 2011-04-23 13:18:57.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/module.h linux-2.6.32.44/arch/x86/include/asm/module.h
+--- linux-2.6.32.44/arch/x86/include/asm/module.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/module.h 2011-04-23 13:18:57.000000000 -0400
@@ -5,6 +5,7 @@
#ifdef CONFIG_X86_64
@@ -9218,9 +9166,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/module.h linux-2.6.32.43/arch/x8
+#define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_STACKSIZE MODULE_GRSEC MODULE_PAX_KERNEXEC MODULE_PAX_UDEREF MODULE_PAX_REFCOUNT
+
#endif /* _ASM_X86_MODULE_H */
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/page_64_types.h linux-2.6.32.43/arch/x86/include/asm/page_64_types.h
---- linux-2.6.32.43/arch/x86/include/asm/page_64_types.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/page_64_types.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/page_64_types.h linux-2.6.32.44/arch/x86/include/asm/page_64_types.h
+--- linux-2.6.32.44/arch/x86/include/asm/page_64_types.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/page_64_types.h 2011-04-17 15:56:46.000000000 -0400
@@ -56,7 +56,7 @@ void copy_page(void *to, void *from);
/* duplicated to the one in bootmem.h */
@@ -9230,9 +9178,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/page_64_types.h linux-2.6.32.43/
extern unsigned long __phys_addr(unsigned long);
#define __phys_reloc_hide(x) (x)
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/paravirt.h linux-2.6.32.43/arch/x86/include/asm/paravirt.h
---- linux-2.6.32.43/arch/x86/include/asm/paravirt.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/paravirt.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/paravirt.h linux-2.6.32.44/arch/x86/include/asm/paravirt.h
+--- linux-2.6.32.44/arch/x86/include/asm/paravirt.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/paravirt.h 2011-04-17 15:56:46.000000000 -0400
@@ -729,6 +729,21 @@ static inline void __set_fixmap(unsigned
pv_mmu_ops.set_fixmap(idx, phys, flags);
}
@@ -9286,9 +9234,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/paravirt.h linux-2.6.32.43/arch/
#endif /* CONFIG_X86_32 */
#endif /* __ASSEMBLY__ */
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/paravirt_types.h linux-2.6.32.43/arch/x86/include/asm/paravirt_types.h
---- linux-2.6.32.43/arch/x86/include/asm/paravirt_types.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/paravirt_types.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/paravirt_types.h linux-2.6.32.44/arch/x86/include/asm/paravirt_types.h
+--- linux-2.6.32.44/arch/x86/include/asm/paravirt_types.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/paravirt_types.h 2011-08-05 20:33:55.000000000 -0400
@@ -78,19 +78,19 @@ struct pv_init_ops {
*/
unsigned (*patch)(u8 type, u16 clobber, void *insnbuf,
@@ -9352,9 +9300,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/paravirt_types.h linux-2.6.32.43
/* This contains all the paravirt structures: we get a convenient
* number for each function using the offset which we use to indicate
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/pci_x86.h linux-2.6.32.43/arch/x86/include/asm/pci_x86.h
---- linux-2.6.32.43/arch/x86/include/asm/pci_x86.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/pci_x86.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/pci_x86.h linux-2.6.32.44/arch/x86/include/asm/pci_x86.h
+--- linux-2.6.32.44/arch/x86/include/asm/pci_x86.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/pci_x86.h 2011-04-17 15:56:46.000000000 -0400
@@ -89,16 +89,16 @@ extern int (*pcibios_enable_irq)(struct
extern void (*pcibios_disable_irq)(struct pci_dev *dev);
@@ -9377,9 +9325,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/pci_x86.h linux-2.6.32.43/arch/x
extern bool port_cf9_safe;
/* arch_initcall level */
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/pgalloc.h linux-2.6.32.43/arch/x86/include/asm/pgalloc.h
---- linux-2.6.32.43/arch/x86/include/asm/pgalloc.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/pgalloc.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/pgalloc.h linux-2.6.32.44/arch/x86/include/asm/pgalloc.h
+--- linux-2.6.32.44/arch/x86/include/asm/pgalloc.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/pgalloc.h 2011-04-17 15:56:46.000000000 -0400
@@ -63,6 +63,13 @@ static inline void pmd_populate_kernel(s
pmd_t *pmd, pte_t *pte)
{
@@ -9394,9 +9342,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/pgalloc.h linux-2.6.32.43/arch/x
set_pmd(pmd, __pmd(__pa(pte) | _PAGE_TABLE));
}
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/pgtable-2level.h linux-2.6.32.43/arch/x86/include/asm/pgtable-2level.h
---- linux-2.6.32.43/arch/x86/include/asm/pgtable-2level.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/pgtable-2level.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/pgtable-2level.h linux-2.6.32.44/arch/x86/include/asm/pgtable-2level.h
+--- linux-2.6.32.44/arch/x86/include/asm/pgtable-2level.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/pgtable-2level.h 2011-04-17 15:56:46.000000000 -0400
@@ -18,7 +18,9 @@ static inline void native_set_pte(pte_t
static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
@@ -9407,9 +9355,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/pgtable-2level.h linux-2.6.32.43
}
static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/pgtable_32.h linux-2.6.32.43/arch/x86/include/asm/pgtable_32.h
---- linux-2.6.32.43/arch/x86/include/asm/pgtable_32.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/pgtable_32.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/pgtable_32.h linux-2.6.32.44/arch/x86/include/asm/pgtable_32.h
+--- linux-2.6.32.44/arch/x86/include/asm/pgtable_32.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/pgtable_32.h 2011-04-17 15:56:46.000000000 -0400
@@ -26,9 +26,6 @@
struct mm_struct;
struct vm_area_struct;
@@ -9453,9 +9401,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/pgtable_32.h linux-2.6.32.43/arc
/*
* kern_addr_valid() is (1) for FLATMEM and (0) for
* SPARSEMEM and DISCONTIGMEM
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/pgtable_32_types.h linux-2.6.32.43/arch/x86/include/asm/pgtable_32_types.h
---- linux-2.6.32.43/arch/x86/include/asm/pgtable_32_types.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/pgtable_32_types.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/pgtable_32_types.h linux-2.6.32.44/arch/x86/include/asm/pgtable_32_types.h
+--- linux-2.6.32.44/arch/x86/include/asm/pgtable_32_types.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/pgtable_32_types.h 2011-04-17 15:56:46.000000000 -0400
@@ -8,7 +8,7 @@
*/
#ifdef CONFIG_X86_PAE
@@ -9485,9 +9433,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/pgtable_32_types.h linux-2.6.32.
#define MODULES_VADDR VMALLOC_START
#define MODULES_END VMALLOC_END
#define MODULES_LEN (MODULES_VADDR - MODULES_END)
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/pgtable-3level.h linux-2.6.32.43/arch/x86/include/asm/pgtable-3level.h
---- linux-2.6.32.43/arch/x86/include/asm/pgtable-3level.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/pgtable-3level.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/pgtable-3level.h linux-2.6.32.44/arch/x86/include/asm/pgtable-3level.h
+--- linux-2.6.32.44/arch/x86/include/asm/pgtable-3level.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/pgtable-3level.h 2011-04-17 15:56:46.000000000 -0400
@@ -38,12 +38,16 @@ static inline void native_set_pte_atomic
static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
@@ -9505,9 +9453,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/pgtable-3level.h linux-2.6.32.43
}
/*
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/pgtable_64.h linux-2.6.32.43/arch/x86/include/asm/pgtable_64.h
---- linux-2.6.32.43/arch/x86/include/asm/pgtable_64.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/pgtable_64.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/pgtable_64.h linux-2.6.32.44/arch/x86/include/asm/pgtable_64.h
+--- linux-2.6.32.44/arch/x86/include/asm/pgtable_64.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/pgtable_64.h 2011-04-17 15:56:46.000000000 -0400
@@ -16,10 +16,13 @@
extern pud_t level3_kernel_pgt[512];
@@ -9544,9 +9492,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/pgtable_64.h linux-2.6.32.43/arc
}
static inline void native_pgd_clear(pgd_t *pgd)
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/pgtable_64_types.h linux-2.6.32.43/arch/x86/include/asm/pgtable_64_types.h
---- linux-2.6.32.43/arch/x86/include/asm/pgtable_64_types.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/pgtable_64_types.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/pgtable_64_types.h linux-2.6.32.44/arch/x86/include/asm/pgtable_64_types.h
+--- linux-2.6.32.44/arch/x86/include/asm/pgtable_64_types.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/pgtable_64_types.h 2011-04-17 15:56:46.000000000 -0400
@@ -59,5 +59,10 @@ typedef struct { pteval_t pte; } pte_t;
#define MODULES_VADDR _AC(0xffffffffa0000000, UL)
#define MODULES_END _AC(0xffffffffff000000, UL)
@@ -9558,9 +9506,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/pgtable_64_types.h linux-2.6.32.
+#define ktva_ktla(addr) (addr)
#endif /* _ASM_X86_PGTABLE_64_DEFS_H */
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/pgtable.h linux-2.6.32.43/arch/x86/include/asm/pgtable.h
---- linux-2.6.32.43/arch/x86/include/asm/pgtable.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/pgtable.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/pgtable.h linux-2.6.32.44/arch/x86/include/asm/pgtable.h
+--- linux-2.6.32.44/arch/x86/include/asm/pgtable.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/pgtable.h 2011-04-17 15:56:46.000000000 -0400
@@ -74,12 +74,51 @@ extern struct list_head pgd_list;
#define arch_end_context_switch(prev) do {} while(0)
@@ -9730,9 +9678,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/pgtable.h linux-2.6.32.43/arch/x
#include <asm-generic/pgtable.h>
#endif /* __ASSEMBLY__ */
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/pgtable_types.h linux-2.6.32.43/arch/x86/include/asm/pgtable_types.h
---- linux-2.6.32.43/arch/x86/include/asm/pgtable_types.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/pgtable_types.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/pgtable_types.h linux-2.6.32.44/arch/x86/include/asm/pgtable_types.h
+--- linux-2.6.32.44/arch/x86/include/asm/pgtable_types.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/pgtable_types.h 2011-04-17 15:56:46.000000000 -0400
@@ -16,12 +16,11 @@
#define _PAGE_BIT_PSE 7 /* 4 MB (or 2MB) page */
#define _PAGE_BIT_PAT 7 /* on 4KB pages */
@@ -9853,9 +9801,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/pgtable_types.h linux-2.6.32.43/
#define pgprot_writecombine pgprot_writecombine
extern pgprot_t pgprot_writecombine(pgprot_t prot);
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/processor.h linux-2.6.32.43/arch/x86/include/asm/processor.h
---- linux-2.6.32.43/arch/x86/include/asm/processor.h 2011-04-22 19:16:29.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/processor.h 2011-05-11 18:25:15.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/processor.h linux-2.6.32.44/arch/x86/include/asm/processor.h
+--- linux-2.6.32.44/arch/x86/include/asm/processor.h 2011-04-22 19:16:29.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/processor.h 2011-05-11 18:25:15.000000000 -0400
@@ -272,7 +272,7 @@ struct tss_struct {
} ____cacheline_aligned;
@@ -9958,9 +9906,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/processor.h linux-2.6.32.43/arch
#define KSTK_EIP(task) (task_pt_regs(task)->ip)
/* Get/set a process' ability to use the timestamp counter instruction */
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/ptrace.h linux-2.6.32.43/arch/x86/include/asm/ptrace.h
---- linux-2.6.32.43/arch/x86/include/asm/ptrace.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/ptrace.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/ptrace.h linux-2.6.32.44/arch/x86/include/asm/ptrace.h
+--- linux-2.6.32.44/arch/x86/include/asm/ptrace.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/ptrace.h 2011-04-17 15:56:46.000000000 -0400
@@ -151,28 +151,29 @@ static inline unsigned long regs_return_
}
@@ -9997,9 +9945,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/ptrace.h linux-2.6.32.43/arch/x8
#endif
}
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/reboot.h linux-2.6.32.43/arch/x86/include/asm/reboot.h
---- linux-2.6.32.43/arch/x86/include/asm/reboot.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/reboot.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/reboot.h linux-2.6.32.44/arch/x86/include/asm/reboot.h
+--- linux-2.6.32.44/arch/x86/include/asm/reboot.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/reboot.h 2011-08-05 20:33:55.000000000 -0400
@@ -6,19 +6,19 @@
struct pt_regs;
@@ -10026,9 +9974,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/reboot.h linux-2.6.32.43/arch/x8
typedef void (*nmi_shootdown_cb)(int, struct die_args*);
void nmi_shootdown_cpus(nmi_shootdown_cb callback);
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/rwsem.h linux-2.6.32.43/arch/x86/include/asm/rwsem.h
---- linux-2.6.32.43/arch/x86/include/asm/rwsem.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/rwsem.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/rwsem.h linux-2.6.32.44/arch/x86/include/asm/rwsem.h
+--- linux-2.6.32.44/arch/x86/include/asm/rwsem.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/rwsem.h 2011-04-17 15:56:46.000000000 -0400
@@ -118,6 +118,14 @@ static inline void __down_read(struct rw
{
asm volatile("# beginning down_read\n\t"
@@ -10153,9 +10101,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/rwsem.h linux-2.6.32.43/arch/x86
: "+r" (tmp), "+m" (sem->count)
: : "memory");
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/segment.h linux-2.6.32.43/arch/x86/include/asm/segment.h
---- linux-2.6.32.43/arch/x86/include/asm/segment.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/segment.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/segment.h linux-2.6.32.44/arch/x86/include/asm/segment.h
+--- linux-2.6.32.44/arch/x86/include/asm/segment.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/segment.h 2011-04-17 15:56:46.000000000 -0400
@@ -62,8 +62,8 @@
* 26 - ESPFIX small SS
* 27 - per-cpu [ offset to per-cpu data area ]
@@ -10224,9 +10172,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/segment.h linux-2.6.32.43/arch/x
#define __KERNEL_DS (GDT_ENTRY_KERNEL_DS * 8)
#define __USER_DS (GDT_ENTRY_DEFAULT_USER_DS* 8 + 3)
#define __USER_CS (GDT_ENTRY_DEFAULT_USER_CS* 8 + 3)
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/smp.h linux-2.6.32.43/arch/x86/include/asm/smp.h
---- linux-2.6.32.43/arch/x86/include/asm/smp.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/smp.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/smp.h linux-2.6.32.44/arch/x86/include/asm/smp.h
+--- linux-2.6.32.44/arch/x86/include/asm/smp.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/smp.h 2011-08-05 20:33:55.000000000 -0400
@@ -24,7 +24,7 @@ extern unsigned int num_processors;
DECLARE_PER_CPU(cpumask_var_t, cpu_sibling_map);
DECLARE_PER_CPU(cpumask_var_t, cpu_core_map);
@@ -10274,9 +10222,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/smp.h linux-2.6.32.43/arch/x86/i
#define safe_smp_processor_id() smp_processor_id()
#endif
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/spinlock.h linux-2.6.32.43/arch/x86/include/asm/spinlock.h
---- linux-2.6.32.43/arch/x86/include/asm/spinlock.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/spinlock.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/spinlock.h linux-2.6.32.44/arch/x86/include/asm/spinlock.h
+--- linux-2.6.32.44/arch/x86/include/asm/spinlock.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/spinlock.h 2011-04-17 15:56:46.000000000 -0400
@@ -249,6 +249,14 @@ static inline int __raw_write_can_lock(r
static inline void __raw_read_lock(raw_rwlock_t *rw)
{
@@ -10339,9 +10287,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/spinlock.h linux-2.6.32.43/arch/
: "+m" (rw->lock) : "i" (RW_LOCK_BIAS) : "memory");
}
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/stackprotector.h linux-2.6.32.43/arch/x86/include/asm/stackprotector.h
---- linux-2.6.32.43/arch/x86/include/asm/stackprotector.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/stackprotector.h 2011-07-06 19:53:33.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/stackprotector.h linux-2.6.32.44/arch/x86/include/asm/stackprotector.h
+--- linux-2.6.32.44/arch/x86/include/asm/stackprotector.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/stackprotector.h 2011-07-06 19:53:33.000000000 -0400
@@ -48,7 +48,7 @@
* head_32 for boot CPU and setup_per_cpu_areas() for others.
*/
@@ -10360,9 +10308,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/stackprotector.h linux-2.6.32.43
asm volatile ("mov %0, %%gs" : : "r" (0));
#endif
}
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/system.h linux-2.6.32.43/arch/x86/include/asm/system.h
---- linux-2.6.32.43/arch/x86/include/asm/system.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/system.h 2011-05-22 23:02:03.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/system.h linux-2.6.32.44/arch/x86/include/asm/system.h
+--- linux-2.6.32.44/arch/x86/include/asm/system.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/system.h 2011-05-22 23:02:03.000000000 -0400
@@ -132,7 +132,7 @@ do { \
"thread_return:\n\t" \
"movq "__percpu_arg([current_task])",%%rsi\n\t" \
@@ -10405,9 +10353,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/system.h linux-2.6.32.43/arch/x8
/*
* Force strict CPU ordering.
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/thread_info.h linux-2.6.32.43/arch/x86/include/asm/thread_info.h
---- linux-2.6.32.43/arch/x86/include/asm/thread_info.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/thread_info.h 2011-05-17 19:26:34.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/thread_info.h linux-2.6.32.44/arch/x86/include/asm/thread_info.h
+--- linux-2.6.32.44/arch/x86/include/asm/thread_info.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/thread_info.h 2011-05-17 19:26:34.000000000 -0400
@@ -10,6 +10,7 @@
#include <linux/compiler.h>
#include <asm/page.h>
@@ -10555,9 +10503,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/thread_info.h linux-2.6.32.43/ar
+
#endif
#endif /* _ASM_X86_THREAD_INFO_H */
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/uaccess_32.h linux-2.6.32.43/arch/x86/include/asm/uaccess_32.h
---- linux-2.6.32.43/arch/x86/include/asm/uaccess_32.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/uaccess_32.h 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/uaccess_32.h linux-2.6.32.44/arch/x86/include/asm/uaccess_32.h
+--- linux-2.6.32.44/arch/x86/include/asm/uaccess_32.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/uaccess_32.h 2011-05-16 21:46:57.000000000 -0400
@@ -44,6 +44,11 @@ unsigned long __must_check __copy_from_u
static __always_inline unsigned long __must_check
__copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
@@ -10698,9 +10646,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/uaccess_32.h linux-2.6.32.43/arc
long __must_check strncpy_from_user(char *dst, const char __user *src,
long count);
long __must_check __strncpy_from_user(char *dst,
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/uaccess_64.h linux-2.6.32.43/arch/x86/include/asm/uaccess_64.h
---- linux-2.6.32.43/arch/x86/include/asm/uaccess_64.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/uaccess_64.h 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/uaccess_64.h linux-2.6.32.44/arch/x86/include/asm/uaccess_64.h
+--- linux-2.6.32.44/arch/x86/include/asm/uaccess_64.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/uaccess_64.h 2011-05-16 21:46:57.000000000 -0400
@@ -9,6 +9,9 @@
#include <linux/prefetch.h>
#include <linux/lockdep.h>
@@ -11078,9 +11026,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/uaccess_64.h linux-2.6.32.43/arc
copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest);
#endif /* _ASM_X86_UACCESS_64_H */
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/uaccess.h linux-2.6.32.43/arch/x86/include/asm/uaccess.h
---- linux-2.6.32.43/arch/x86/include/asm/uaccess.h 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/uaccess.h 2011-06-25 12:56:37.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/uaccess.h linux-2.6.32.44/arch/x86/include/asm/uaccess.h
+--- linux-2.6.32.44/arch/x86/include/asm/uaccess.h 2011-06-25 12:55:34.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/uaccess.h 2011-06-25 12:56:37.000000000 -0400
@@ -8,12 +8,15 @@
#include <linux/thread_info.h>
#include <linux/prefetch.h>
@@ -11299,9 +11247,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/uaccess.h linux-2.6.32.43/arch/x
#ifdef CONFIG_X86_32
# include "uaccess_32.h"
#else
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/vgtod.h linux-2.6.32.43/arch/x86/include/asm/vgtod.h
---- linux-2.6.32.43/arch/x86/include/asm/vgtod.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/vgtod.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/vgtod.h linux-2.6.32.44/arch/x86/include/asm/vgtod.h
+--- linux-2.6.32.44/arch/x86/include/asm/vgtod.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/vgtod.h 2011-04-17 15:56:46.000000000 -0400
@@ -14,6 +14,7 @@ struct vsyscall_gtod_data {
int sysctl_enabled;
struct timezone sys_tz;
@@ -11310,9 +11258,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/vgtod.h linux-2.6.32.43/arch/x86
cycle_t (*vread)(void);
cycle_t cycle_last;
cycle_t mask;
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/vmi.h linux-2.6.32.43/arch/x86/include/asm/vmi.h
---- linux-2.6.32.43/arch/x86/include/asm/vmi.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/vmi.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/vmi.h linux-2.6.32.44/arch/x86/include/asm/vmi.h
+--- linux-2.6.32.44/arch/x86/include/asm/vmi.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/vmi.h 2011-04-17 15:56:46.000000000 -0400
@@ -191,6 +191,7 @@ struct vrom_header {
u8 reserved[96]; /* Reserved for headers */
char vmi_init[8]; /* VMI_Init jump point */
@@ -11321,9 +11269,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/vmi.h linux-2.6.32.43/arch/x86/i
} __attribute__((packed));
struct pnp_header {
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/vmi_time.h linux-2.6.32.43/arch/x86/include/asm/vmi_time.h
---- linux-2.6.32.43/arch/x86/include/asm/vmi_time.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/vmi_time.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/vmi_time.h linux-2.6.32.44/arch/x86/include/asm/vmi_time.h
+--- linux-2.6.32.44/arch/x86/include/asm/vmi_time.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/vmi_time.h 2011-08-05 20:33:55.000000000 -0400
@@ -43,7 +43,7 @@ extern struct vmi_timer_ops {
int (*wallclock_updated)(void);
void (*set_alarm)(u32 flags, u64 expiry, u64 period);
@@ -11333,9 +11281,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/vmi_time.h linux-2.6.32.43/arch/
/* Prototypes */
extern void __init vmi_time_init(void);
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/vsyscall.h linux-2.6.32.43/arch/x86/include/asm/vsyscall.h
---- linux-2.6.32.43/arch/x86/include/asm/vsyscall.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/vsyscall.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/vsyscall.h linux-2.6.32.44/arch/x86/include/asm/vsyscall.h
+--- linux-2.6.32.44/arch/x86/include/asm/vsyscall.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/vsyscall.h 2011-04-17 15:56:46.000000000 -0400
@@ -15,9 +15,10 @@ enum vsyscall_num {
#ifdef __KERNEL__
@@ -11366,9 +11314,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/vsyscall.h linux-2.6.32.43/arch/
#endif /* __KERNEL__ */
#endif /* _ASM_X86_VSYSCALL_H */
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/x86_init.h linux-2.6.32.43/arch/x86/include/asm/x86_init.h
---- linux-2.6.32.43/arch/x86/include/asm/x86_init.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/x86_init.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/x86_init.h linux-2.6.32.44/arch/x86/include/asm/x86_init.h
+--- linux-2.6.32.44/arch/x86/include/asm/x86_init.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/x86_init.h 2011-08-05 20:33:55.000000000 -0400
@@ -28,7 +28,7 @@ struct x86_init_mpparse {
void (*mpc_oem_bus_info)(struct mpc_bus *m, char *name);
void (*find_smp_config)(unsigned int reserve);
@@ -11450,9 +11398,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/x86_init.h linux-2.6.32.43/arch/
extern struct x86_init_ops x86_init;
extern struct x86_cpuinit_ops x86_cpuinit;
-diff -urNp linux-2.6.32.43/arch/x86/include/asm/xsave.h linux-2.6.32.43/arch/x86/include/asm/xsave.h
---- linux-2.6.32.43/arch/x86/include/asm/xsave.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/include/asm/xsave.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/include/asm/xsave.h linux-2.6.32.44/arch/x86/include/asm/xsave.h
+--- linux-2.6.32.44/arch/x86/include/asm/xsave.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/include/asm/xsave.h 2011-04-17 15:56:46.000000000 -0400
@@ -56,6 +56,12 @@ static inline int xrstor_checking(struct
static inline int xsave_user(struct xsave_struct __user *buf)
{
@@ -11478,9 +11426,9 @@ diff -urNp linux-2.6.32.43/arch/x86/include/asm/xsave.h linux-2.6.32.43/arch/x86
__asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x2f\n"
"2:\n"
".section .fixup,\"ax\"\n"
-diff -urNp linux-2.6.32.43/arch/x86/Kconfig linux-2.6.32.43/arch/x86/Kconfig
---- linux-2.6.32.43/arch/x86/Kconfig 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/Kconfig 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/Kconfig linux-2.6.32.44/arch/x86/Kconfig
+--- linux-2.6.32.44/arch/x86/Kconfig 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/Kconfig 2011-04-17 15:56:46.000000000 -0400
@@ -223,7 +223,7 @@ config X86_TRAMPOLINE
config X86_32_LAZY_GS
@@ -11562,9 +11510,9 @@ diff -urNp linux-2.6.32.43/arch/x86/Kconfig linux-2.6.32.43/arch/x86/Kconfig
---help---
Map the 32-bit VDSO to the predictable old-style address too.
---help---
-diff -urNp linux-2.6.32.43/arch/x86/Kconfig.cpu linux-2.6.32.43/arch/x86/Kconfig.cpu
---- linux-2.6.32.43/arch/x86/Kconfig.cpu 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/Kconfig.cpu 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/Kconfig.cpu linux-2.6.32.44/arch/x86/Kconfig.cpu
+--- linux-2.6.32.44/arch/x86/Kconfig.cpu 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/Kconfig.cpu 2011-04-17 15:56:46.000000000 -0400
@@ -340,7 +340,7 @@ config X86_PPRO_FENCE
config X86_F00F_BUG
@@ -11592,9 +11540,9 @@ diff -urNp linux-2.6.32.43/arch/x86/Kconfig.cpu linux-2.6.32.43/arch/x86/Kconfig
config X86_MINIMUM_CPU_FAMILY
int
-diff -urNp linux-2.6.32.43/arch/x86/Kconfig.debug linux-2.6.32.43/arch/x86/Kconfig.debug
---- linux-2.6.32.43/arch/x86/Kconfig.debug 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/Kconfig.debug 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/Kconfig.debug linux-2.6.32.44/arch/x86/Kconfig.debug
+--- linux-2.6.32.44/arch/x86/Kconfig.debug 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/Kconfig.debug 2011-04-17 15:56:46.000000000 -0400
@@ -99,7 +99,7 @@ config X86_PTDUMP
config DEBUG_RODATA
bool "Write protect kernel read-only data structures"
@@ -11604,9 +11552,9 @@ diff -urNp linux-2.6.32.43/arch/x86/Kconfig.debug linux-2.6.32.43/arch/x86/Kconf
---help---
Mark the kernel read-only data as write-protected in the pagetables,
in order to catch accidental (and incorrect) writes to such const
-diff -urNp linux-2.6.32.43/arch/x86/kernel/acpi/realmode/Makefile linux-2.6.32.43/arch/x86/kernel/acpi/realmode/Makefile
---- linux-2.6.32.43/arch/x86/kernel/acpi/realmode/Makefile 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/acpi/realmode/Makefile 2011-08-07 14:38:58.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/acpi/realmode/Makefile linux-2.6.32.44/arch/x86/kernel/acpi/realmode/Makefile
+--- linux-2.6.32.44/arch/x86/kernel/acpi/realmode/Makefile 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/acpi/realmode/Makefile 2011-08-07 14:38:58.000000000 -0400
@@ -41,6 +41,9 @@ KBUILD_CFLAGS := $(LINUXINCLUDE) -g -Os
$(call cc-option, -fno-stack-protector) \
$(call cc-option, -mpreferred-stack-boundary=2)
@@ -11617,9 +11565,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/acpi/realmode/Makefile linux-2.6.32.4
KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
GCOV_PROFILE := n
-diff -urNp linux-2.6.32.43/arch/x86/kernel/acpi/realmode/wakeup.S linux-2.6.32.43/arch/x86/kernel/acpi/realmode/wakeup.S
---- linux-2.6.32.43/arch/x86/kernel/acpi/realmode/wakeup.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/acpi/realmode/wakeup.S 2011-07-01 18:53:40.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/acpi/realmode/wakeup.S linux-2.6.32.44/arch/x86/kernel/acpi/realmode/wakeup.S
+--- linux-2.6.32.44/arch/x86/kernel/acpi/realmode/wakeup.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/acpi/realmode/wakeup.S 2011-07-01 18:53:40.000000000 -0400
@@ -91,6 +91,9 @@ _start:
/* Do any other stuff... */
@@ -11647,9 +11595,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/acpi/realmode/wakeup.S linux-2.6.32.4
#else
pushw $0
pushw trampoline_segment
-diff -urNp linux-2.6.32.43/arch/x86/kernel/acpi/sleep.c linux-2.6.32.43/arch/x86/kernel/acpi/sleep.c
---- linux-2.6.32.43/arch/x86/kernel/acpi/sleep.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/acpi/sleep.c 2011-07-01 19:01:34.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/acpi/sleep.c linux-2.6.32.44/arch/x86/kernel/acpi/sleep.c
+--- linux-2.6.32.44/arch/x86/kernel/acpi/sleep.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/acpi/sleep.c 2011-07-01 19:01:34.000000000 -0400
@@ -11,11 +11,12 @@
#include <linux/cpumask.h>
#include <asm/segment.h>
@@ -11696,9 +11644,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/acpi/sleep.c linux-2.6.32.43/arch/x86
}
-diff -urNp linux-2.6.32.43/arch/x86/kernel/acpi/wakeup_32.S linux-2.6.32.43/arch/x86/kernel/acpi/wakeup_32.S
---- linux-2.6.32.43/arch/x86/kernel/acpi/wakeup_32.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/acpi/wakeup_32.S 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/acpi/wakeup_32.S linux-2.6.32.44/arch/x86/kernel/acpi/wakeup_32.S
+--- linux-2.6.32.44/arch/x86/kernel/acpi/wakeup_32.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/acpi/wakeup_32.S 2011-04-17 15:56:46.000000000 -0400
@@ -30,13 +30,11 @@ wakeup_pmode_return:
# and restore the stack ... but you need gdt for this to work
movl saved_context_esp, %esp
@@ -11715,9 +11663,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/acpi/wakeup_32.S linux-2.6.32.43/arch
bogus_magic:
jmp bogus_magic
-diff -urNp linux-2.6.32.43/arch/x86/kernel/alternative.c linux-2.6.32.43/arch/x86/kernel/alternative.c
---- linux-2.6.32.43/arch/x86/kernel/alternative.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/alternative.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/alternative.c linux-2.6.32.44/arch/x86/kernel/alternative.c
+--- linux-2.6.32.44/arch/x86/kernel/alternative.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/alternative.c 2011-04-17 15:56:46.000000000 -0400
@@ -407,7 +407,7 @@ void __init_or_module apply_paravirt(str
BUG_ON(p->len > MAX_PATCH_LEN);
@@ -11800,9 +11748,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/alternative.c linux-2.6.32.43/arch/x8
+ BUG_ON((vaddr)[i] != ((const unsigned char *)opcode)[i]);
return addr;
}
-diff -urNp linux-2.6.32.43/arch/x86/kernel/amd_iommu.c linux-2.6.32.43/arch/x86/kernel/amd_iommu.c
---- linux-2.6.32.43/arch/x86/kernel/amd_iommu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/amd_iommu.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/amd_iommu.c linux-2.6.32.44/arch/x86/kernel/amd_iommu.c
+--- linux-2.6.32.44/arch/x86/kernel/amd_iommu.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/amd_iommu.c 2011-04-17 15:56:46.000000000 -0400
@@ -2076,7 +2076,7 @@ static void prealloc_protection_domains(
}
}
@@ -11812,9 +11760,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/amd_iommu.c linux-2.6.32.43/arch/x86/
.alloc_coherent = alloc_coherent,
.free_coherent = free_coherent,
.map_page = map_page,
-diff -urNp linux-2.6.32.43/arch/x86/kernel/apic/apic.c linux-2.6.32.43/arch/x86/kernel/apic/apic.c
---- linux-2.6.32.43/arch/x86/kernel/apic/apic.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/apic/apic.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/apic/apic.c linux-2.6.32.44/arch/x86/kernel/apic/apic.c
+--- linux-2.6.32.44/arch/x86/kernel/apic/apic.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/apic/apic.c 2011-05-16 21:46:57.000000000 -0400
@@ -1794,7 +1794,7 @@ void smp_error_interrupt(struct pt_regs
apic_write(APIC_ESR, 0);
v1 = apic_read(APIC_ESR);
@@ -11833,9 +11781,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/apic/apic.c linux-2.6.32.43/arch/x86/
bios_cpu_apicid = early_per_cpu_ptr(x86_bios_cpu_apicid);
bitmap_zero(clustermap, NUM_APIC_CLUSTERS);
-diff -urNp linux-2.6.32.43/arch/x86/kernel/apic/io_apic.c linux-2.6.32.43/arch/x86/kernel/apic/io_apic.c
---- linux-2.6.32.43/arch/x86/kernel/apic/io_apic.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/apic/io_apic.c 2011-05-04 17:56:20.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/apic/io_apic.c linux-2.6.32.44/arch/x86/kernel/apic/io_apic.c
+--- linux-2.6.32.44/arch/x86/kernel/apic/io_apic.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/apic/io_apic.c 2011-05-04 17:56:20.000000000 -0400
@@ -716,7 +716,7 @@ struct IO_APIC_route_entry **alloc_ioapi
ioapic_entries = kzalloc(sizeof(*ioapic_entries) * nr_ioapics,
GFP_ATOMIC);
@@ -11890,9 +11838,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/apic/io_apic.c linux-2.6.32.43/arch/x
spin_lock(&ioapic_lock);
__mask_and_edge_IO_APIC_irq(cfg);
__unmask_and_level_IO_APIC_irq(cfg);
-diff -urNp linux-2.6.32.43/arch/x86/kernel/apm_32.c linux-2.6.32.43/arch/x86/kernel/apm_32.c
---- linux-2.6.32.43/arch/x86/kernel/apm_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/apm_32.c 2011-04-23 12:56:10.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/apm_32.c linux-2.6.32.44/arch/x86/kernel/apm_32.c
+--- linux-2.6.32.44/arch/x86/kernel/apm_32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/apm_32.c 2011-04-23 12:56:10.000000000 -0400
@@ -410,7 +410,7 @@ static DEFINE_SPINLOCK(user_list_lock);
* This is for buggy BIOS's that refer to (real mode) segment 0x40
* even though they are called in protected mode.
@@ -11973,9 +11921,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/apm_32.c linux-2.6.32.43/arch/x86/ker
proc_create("apm", 0, NULL, &apm_file_ops);
-diff -urNp linux-2.6.32.43/arch/x86/kernel/asm-offsets_32.c linux-2.6.32.43/arch/x86/kernel/asm-offsets_32.c
---- linux-2.6.32.43/arch/x86/kernel/asm-offsets_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/asm-offsets_32.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/asm-offsets_32.c linux-2.6.32.44/arch/x86/kernel/asm-offsets_32.c
+--- linux-2.6.32.44/arch/x86/kernel/asm-offsets_32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/asm-offsets_32.c 2011-05-16 21:46:57.000000000 -0400
@@ -51,7 +51,6 @@ void foo(void)
OFFSET(CPUINFO_x86_vendor_id, cpuinfo_x86, x86_vendor_id);
BLANK();
@@ -12013,9 +11961,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/asm-offsets_32.c linux-2.6.32.43/arch
#endif
#ifdef CONFIG_XEN
-diff -urNp linux-2.6.32.43/arch/x86/kernel/asm-offsets_64.c linux-2.6.32.43/arch/x86/kernel/asm-offsets_64.c
---- linux-2.6.32.43/arch/x86/kernel/asm-offsets_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/asm-offsets_64.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/asm-offsets_64.c linux-2.6.32.44/arch/x86/kernel/asm-offsets_64.c
+--- linux-2.6.32.44/arch/x86/kernel/asm-offsets_64.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/asm-offsets_64.c 2011-05-16 21:46:57.000000000 -0400
@@ -44,6 +44,8 @@ int main(void)
ENTRY(addr_limit);
ENTRY(preempt_count);
@@ -12060,9 +12008,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/asm-offsets_64.c linux-2.6.32.43/arch
#ifdef CONFIG_XEN
BLANK();
OFFSET(XEN_vcpu_info_mask, vcpu_info, evtchn_upcall_mask);
-diff -urNp linux-2.6.32.43/arch/x86/kernel/cpu/amd.c linux-2.6.32.43/arch/x86/kernel/cpu/amd.c
---- linux-2.6.32.43/arch/x86/kernel/cpu/amd.c 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/cpu/amd.c 2011-06-25 12:56:37.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/cpu/amd.c linux-2.6.32.44/arch/x86/kernel/cpu/amd.c
+--- linux-2.6.32.44/arch/x86/kernel/cpu/amd.c 2011-06-25 12:55:34.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/cpu/amd.c 2011-06-25 12:56:37.000000000 -0400
@@ -602,7 +602,7 @@ static unsigned int __cpuinit amd_size_c
unsigned int size)
{
@@ -12072,9 +12020,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/cpu/amd.c linux-2.6.32.43/arch/x86/ke
/* Duron Rev A0 */
if (c->x86_model == 3 && c->x86_mask == 0)
size = 64;
-diff -urNp linux-2.6.32.43/arch/x86/kernel/cpu/common.c linux-2.6.32.43/arch/x86/kernel/cpu/common.c
---- linux-2.6.32.43/arch/x86/kernel/cpu/common.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/cpu/common.c 2011-05-11 18:25:15.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/cpu/common.c linux-2.6.32.44/arch/x86/kernel/cpu/common.c
+--- linux-2.6.32.44/arch/x86/kernel/cpu/common.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/cpu/common.c 2011-05-11 18:25:15.000000000 -0400
@@ -83,60 +83,6 @@ static const struct cpu_dev __cpuinitcon
static const struct cpu_dev *this_cpu __cpuinitdata = &default_cpu;
@@ -12219,9 +12167,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/cpu/common.c linux-2.6.32.43/arch/x86
struct thread_struct *thread = &curr->thread;
if (cpumask_test_and_set_cpu(cpu, cpu_initialized_mask)) {
-diff -urNp linux-2.6.32.43/arch/x86/kernel/cpu/intel.c linux-2.6.32.43/arch/x86/kernel/cpu/intel.c
---- linux-2.6.32.43/arch/x86/kernel/cpu/intel.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/cpu/intel.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/cpu/intel.c linux-2.6.32.44/arch/x86/kernel/cpu/intel.c
+--- linux-2.6.32.44/arch/x86/kernel/cpu/intel.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/cpu/intel.c 2011-04-17 15:56:46.000000000 -0400
@@ -162,7 +162,7 @@ static void __cpuinit trap_init_f00f_bug
* Update the IDT descriptor and reload the IDT so that
* it uses the read-only mapped virtual address.
@@ -12231,9 +12179,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/cpu/intel.c linux-2.6.32.43/arch/x86/
load_idt(&idt_descr);
}
#endif
-diff -urNp linux-2.6.32.43/arch/x86/kernel/cpu/intel_cacheinfo.c linux-2.6.32.43/arch/x86/kernel/cpu/intel_cacheinfo.c
---- linux-2.6.32.43/arch/x86/kernel/cpu/intel_cacheinfo.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/cpu/intel_cacheinfo.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/cpu/intel_cacheinfo.c linux-2.6.32.44/arch/x86/kernel/cpu/intel_cacheinfo.c
+--- linux-2.6.32.44/arch/x86/kernel/cpu/intel_cacheinfo.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/cpu/intel_cacheinfo.c 2011-04-17 15:56:46.000000000 -0400
@@ -921,7 +921,7 @@ static ssize_t store(struct kobject *kob
return ret;
}
@@ -12243,9 +12191,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/cpu/intel_cacheinfo.c linux-2.6.32.43
.show = show,
.store = store,
};
-diff -urNp linux-2.6.32.43/arch/x86/kernel/cpu/Makefile linux-2.6.32.43/arch/x86/kernel/cpu/Makefile
---- linux-2.6.32.43/arch/x86/kernel/cpu/Makefile 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/cpu/Makefile 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/cpu/Makefile linux-2.6.32.44/arch/x86/kernel/cpu/Makefile
+--- linux-2.6.32.44/arch/x86/kernel/cpu/Makefile 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/cpu/Makefile 2011-04-17 15:56:46.000000000 -0400
@@ -7,10 +7,6 @@ ifdef CONFIG_FUNCTION_TRACER
CFLAGS_REMOVE_common.o = -pg
endif
@@ -12257,9 +12205,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/cpu/Makefile linux-2.6.32.43/arch/x86
obj-y := intel_cacheinfo.o addon_cpuid_features.o
obj-y += proc.o capflags.o powerflags.o common.o
obj-y += vmware.o hypervisor.o sched.o
-diff -urNp linux-2.6.32.43/arch/x86/kernel/cpu/mcheck/mce_amd.c linux-2.6.32.43/arch/x86/kernel/cpu/mcheck/mce_amd.c
---- linux-2.6.32.43/arch/x86/kernel/cpu/mcheck/mce_amd.c 2011-05-23 16:56:59.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/cpu/mcheck/mce_amd.c 2011-05-23 16:57:13.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/cpu/mcheck/mce_amd.c linux-2.6.32.44/arch/x86/kernel/cpu/mcheck/mce_amd.c
+--- linux-2.6.32.44/arch/x86/kernel/cpu/mcheck/mce_amd.c 2011-05-23 16:56:59.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/cpu/mcheck/mce_amd.c 2011-05-23 16:57:13.000000000 -0400
@@ -385,7 +385,7 @@ static ssize_t store(struct kobject *kob
return ret;
}
@@ -12269,9 +12217,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/cpu/mcheck/mce_amd.c linux-2.6.32.43/
.show = show,
.store = store,
};
-diff -urNp linux-2.6.32.43/arch/x86/kernel/cpu/mcheck/mce.c linux-2.6.32.43/arch/x86/kernel/cpu/mcheck/mce.c
---- linux-2.6.32.43/arch/x86/kernel/cpu/mcheck/mce.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/cpu/mcheck/mce.c 2011-05-04 17:56:20.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/cpu/mcheck/mce.c linux-2.6.32.44/arch/x86/kernel/cpu/mcheck/mce.c
+--- linux-2.6.32.44/arch/x86/kernel/cpu/mcheck/mce.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/cpu/mcheck/mce.c 2011-05-04 17:56:20.000000000 -0400
@@ -43,6 +43,7 @@
#include <asm/ipi.h>
#include <asm/mce.h>
@@ -12373,9 +12321,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/cpu/mcheck/mce.c linux-2.6.32.43/arch
atomic_set(&mce_executing, 0);
atomic_set(&mce_callin, 0);
atomic_set(&global_nwo, 0);
-diff -urNp linux-2.6.32.43/arch/x86/kernel/cpu/mcheck/mce-inject.c linux-2.6.32.43/arch/x86/kernel/cpu/mcheck/mce-inject.c
---- linux-2.6.32.43/arch/x86/kernel/cpu/mcheck/mce-inject.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/cpu/mcheck/mce-inject.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/cpu/mcheck/mce-inject.c linux-2.6.32.44/arch/x86/kernel/cpu/mcheck/mce-inject.c
+--- linux-2.6.32.44/arch/x86/kernel/cpu/mcheck/mce-inject.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/cpu/mcheck/mce-inject.c 2011-08-05 20:33:55.000000000 -0400
@@ -211,7 +211,9 @@ static ssize_t mce_write(struct file *fi
static int inject_init(void)
{
@@ -12387,9 +12335,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/cpu/mcheck/mce-inject.c linux-2.6.32.
register_die_notifier(&mce_raise_nb);
return 0;
}
-diff -urNp linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/amd.c linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/amd.c
---- linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/amd.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/amd.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/cpu/mtrr/amd.c linux-2.6.32.44/arch/x86/kernel/cpu/mtrr/amd.c
+--- linux-2.6.32.44/arch/x86/kernel/cpu/mtrr/amd.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/cpu/mtrr/amd.c 2011-04-17 15:56:46.000000000 -0400
@@ -108,7 +108,7 @@ amd_validate_add_page(unsigned long base
return 0;
}
@@ -12399,9 +12347,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/amd.c linux-2.6.32.43/arch/x
.vendor = X86_VENDOR_AMD,
.set = amd_set_mtrr,
.get = amd_get_mtrr,
-diff -urNp linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/centaur.c linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/centaur.c
---- linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/centaur.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/centaur.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/cpu/mtrr/centaur.c linux-2.6.32.44/arch/x86/kernel/cpu/mtrr/centaur.c
+--- linux-2.6.32.44/arch/x86/kernel/cpu/mtrr/centaur.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/cpu/mtrr/centaur.c 2011-04-17 15:56:46.000000000 -0400
@@ -110,7 +110,7 @@ centaur_validate_add_page(unsigned long
return 0;
}
@@ -12411,9 +12359,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/centaur.c linux-2.6.32.43/ar
.vendor = X86_VENDOR_CENTAUR,
.set = centaur_set_mcr,
.get = centaur_get_mcr,
-diff -urNp linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/cyrix.c linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/cyrix.c
---- linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/cyrix.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/cyrix.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/cpu/mtrr/cyrix.c linux-2.6.32.44/arch/x86/kernel/cpu/mtrr/cyrix.c
+--- linux-2.6.32.44/arch/x86/kernel/cpu/mtrr/cyrix.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/cpu/mtrr/cyrix.c 2011-04-17 15:56:46.000000000 -0400
@@ -265,7 +265,7 @@ static void cyrix_set_all(void)
post_set();
}
@@ -12423,9 +12371,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/cyrix.c linux-2.6.32.43/arch
.vendor = X86_VENDOR_CYRIX,
.set_all = cyrix_set_all,
.set = cyrix_set_arr,
-diff -urNp linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/generic.c linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/generic.c
---- linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/generic.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/generic.c 2011-04-23 12:56:10.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/cpu/mtrr/generic.c linux-2.6.32.44/arch/x86/kernel/cpu/mtrr/generic.c
+--- linux-2.6.32.44/arch/x86/kernel/cpu/mtrr/generic.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/cpu/mtrr/generic.c 2011-04-23 12:56:10.000000000 -0400
@@ -752,7 +752,7 @@ int positive_have_wrcomb(void)
/*
* Generic structure...
@@ -12435,9 +12383,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/generic.c linux-2.6.32.43/ar
.use_intel_if = 1,
.set_all = generic_set_all,
.get = generic_get_mtrr,
-diff -urNp linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/main.c linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/main.c
---- linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/main.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/main.c 2011-04-17 17:03:05.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/cpu/mtrr/main.c linux-2.6.32.44/arch/x86/kernel/cpu/mtrr/main.c
+--- linux-2.6.32.44/arch/x86/kernel/cpu/mtrr/main.c 2011-04-17 17:00:52.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/cpu/mtrr/main.c 2011-04-17 17:03:05.000000000 -0400
@@ -60,14 +60,14 @@ static DEFINE_MUTEX(mtrr_mutex);
u64 size_or_mask, size_and_mask;
static bool mtrr_aps_delayed_init;
@@ -12456,9 +12404,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/main.c linux-2.6.32.43/arch/
{
if (ops->vendor && ops->vendor < X86_VENDOR_NUM)
mtrr_ops[ops->vendor] = ops;
-diff -urNp linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/mtrr.h linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/mtrr.h
---- linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/mtrr.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/mtrr.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/cpu/mtrr/mtrr.h linux-2.6.32.44/arch/x86/kernel/cpu/mtrr/mtrr.h
+--- linux-2.6.32.44/arch/x86/kernel/cpu/mtrr/mtrr.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/cpu/mtrr/mtrr.h 2011-04-17 15:56:46.000000000 -0400
@@ -12,19 +12,19 @@
extern unsigned int mtrr_usage_table[MTRR_MAX_VAR_RANGES];
@@ -12509,9 +12457,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/mtrr.h linux-2.6.32.43/arch/
#define is_cpu(vnd) (mtrr_if && mtrr_if->vendor == X86_VENDOR_##vnd)
#define use_intel() (mtrr_if && mtrr_if->use_intel_if == 1)
-diff -urNp linux-2.6.32.43/arch/x86/kernel/cpu/perfctr-watchdog.c linux-2.6.32.43/arch/x86/kernel/cpu/perfctr-watchdog.c
---- linux-2.6.32.43/arch/x86/kernel/cpu/perfctr-watchdog.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/cpu/perfctr-watchdog.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/cpu/perfctr-watchdog.c linux-2.6.32.44/arch/x86/kernel/cpu/perfctr-watchdog.c
+--- linux-2.6.32.44/arch/x86/kernel/cpu/perfctr-watchdog.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/cpu/perfctr-watchdog.c 2011-04-17 15:56:46.000000000 -0400
@@ -30,11 +30,11 @@ struct nmi_watchdog_ctlblk {
/* Interface defining a CPU specific perfctr watchdog */
@@ -12545,9 +12493,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/cpu/perfctr-watchdog.c linux-2.6.32.4
static struct wd_ops intel_arch_wd_ops __read_mostly = {
.reserve = single_msr_reserve,
.unreserve = single_msr_unreserve,
-diff -urNp linux-2.6.32.43/arch/x86/kernel/cpu/perf_event.c linux-2.6.32.43/arch/x86/kernel/cpu/perf_event.c
---- linux-2.6.32.43/arch/x86/kernel/cpu/perf_event.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/cpu/perf_event.c 2011-05-04 17:56:20.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/cpu/perf_event.c linux-2.6.32.44/arch/x86/kernel/cpu/perf_event.c
+--- linux-2.6.32.44/arch/x86/kernel/cpu/perf_event.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/cpu/perf_event.c 2011-05-04 17:56:20.000000000 -0400
@@ -723,10 +723,10 @@ x86_perf_event_update(struct perf_event
* count to the generic event atomically:
*/
@@ -12588,9 +12536,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/cpu/perf_event.c linux-2.6.32.43/arch
}
}
-diff -urNp linux-2.6.32.43/arch/x86/kernel/crash.c linux-2.6.32.43/arch/x86/kernel/crash.c
---- linux-2.6.32.43/arch/x86/kernel/crash.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/crash.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/crash.c linux-2.6.32.44/arch/x86/kernel/crash.c
+--- linux-2.6.32.44/arch/x86/kernel/crash.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/crash.c 2011-04-17 15:56:46.000000000 -0400
@@ -41,7 +41,7 @@ static void kdump_nmi_callback(int cpu,
regs = args->regs;
@@ -12600,9 +12548,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/crash.c linux-2.6.32.43/arch/x86/kern
crash_fixup_ss_esp(&fixed_regs, regs);
regs = &fixed_regs;
}
-diff -urNp linux-2.6.32.43/arch/x86/kernel/doublefault_32.c linux-2.6.32.43/arch/x86/kernel/doublefault_32.c
---- linux-2.6.32.43/arch/x86/kernel/doublefault_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/doublefault_32.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/doublefault_32.c linux-2.6.32.44/arch/x86/kernel/doublefault_32.c
+--- linux-2.6.32.44/arch/x86/kernel/doublefault_32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/doublefault_32.c 2011-04-17 15:56:46.000000000 -0400
@@ -11,7 +11,7 @@
#define DOUBLEFAULT_STACKSIZE (1024)
@@ -12634,9 +12582,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/doublefault_32.c linux-2.6.32.43/arch
.fs = __KERNEL_PERCPU,
.__cr3 = __pa_nodebug(swapper_pg_dir),
-diff -urNp linux-2.6.32.43/arch/x86/kernel/dumpstack_32.c linux-2.6.32.43/arch/x86/kernel/dumpstack_32.c
---- linux-2.6.32.43/arch/x86/kernel/dumpstack_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/dumpstack_32.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/dumpstack_32.c linux-2.6.32.44/arch/x86/kernel/dumpstack_32.c
+--- linux-2.6.32.44/arch/x86/kernel/dumpstack_32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/dumpstack_32.c 2011-04-17 15:56:46.000000000 -0400
@@ -53,16 +53,12 @@ void dump_trace(struct task_struct *task
#endif
@@ -12702,9 +12650,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/dumpstack_32.c linux-2.6.32.43/arch/x
if (ip < PAGE_OFFSET)
return 0;
if (probe_kernel_address((unsigned short *)ip, ud2))
-diff -urNp linux-2.6.32.43/arch/x86/kernel/dumpstack_64.c linux-2.6.32.43/arch/x86/kernel/dumpstack_64.c
---- linux-2.6.32.43/arch/x86/kernel/dumpstack_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/dumpstack_64.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/dumpstack_64.c linux-2.6.32.44/arch/x86/kernel/dumpstack_64.c
+--- linux-2.6.32.44/arch/x86/kernel/dumpstack_64.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/dumpstack_64.c 2011-04-17 15:56:46.000000000 -0400
@@ -116,8 +116,8 @@ void dump_trace(struct task_struct *task
unsigned long *irq_stack_end =
(unsigned long *)per_cpu(irq_stack_ptr, cpu);
@@ -12755,9 +12703,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/dumpstack_64.c linux-2.6.32.43/arch/x
put_cpu();
}
EXPORT_SYMBOL(dump_trace);
-diff -urNp linux-2.6.32.43/arch/x86/kernel/dumpstack.c linux-2.6.32.43/arch/x86/kernel/dumpstack.c
---- linux-2.6.32.43/arch/x86/kernel/dumpstack.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/dumpstack.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/dumpstack.c linux-2.6.32.44/arch/x86/kernel/dumpstack.c
+--- linux-2.6.32.44/arch/x86/kernel/dumpstack.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/dumpstack.c 2011-04-17 15:56:46.000000000 -0400
@@ -2,6 +2,9 @@
* Copyright (C) 1991, 1992 Linus Torvalds
* Copyright (C) 2000, 2001, 2002 Andi Kleen, SuSE Labs
@@ -12874,9 +12822,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/dumpstack.c linux-2.6.32.43/arch/x86/
report_bug(regs->ip, regs);
if (__die(str, regs, err))
-diff -urNp linux-2.6.32.43/arch/x86/kernel/dumpstack.h linux-2.6.32.43/arch/x86/kernel/dumpstack.h
---- linux-2.6.32.43/arch/x86/kernel/dumpstack.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/dumpstack.h 2011-04-23 13:25:26.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/dumpstack.h linux-2.6.32.44/arch/x86/kernel/dumpstack.h
+--- linux-2.6.32.44/arch/x86/kernel/dumpstack.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/dumpstack.h 2011-04-23 13:25:26.000000000 -0400
@@ -15,7 +15,7 @@
#endif
@@ -12886,9 +12834,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/dumpstack.h linux-2.6.32.43/arch/x86/
unsigned long *stack, unsigned long bp,
const struct stacktrace_ops *ops, void *data,
unsigned long *end, int *graph);
-diff -urNp linux-2.6.32.43/arch/x86/kernel/e820.c linux-2.6.32.43/arch/x86/kernel/e820.c
---- linux-2.6.32.43/arch/x86/kernel/e820.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/e820.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/e820.c linux-2.6.32.44/arch/x86/kernel/e820.c
+--- linux-2.6.32.44/arch/x86/kernel/e820.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/e820.c 2011-04-17 15:56:46.000000000 -0400
@@ -733,7 +733,7 @@ struct early_res {
};
static struct early_res early_res[MAX_EARLY_RES] __initdata = {
@@ -12898,9 +12846,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/e820.c linux-2.6.32.43/arch/x86/kerne
};
static int __init find_overlapped_early(u64 start, u64 end)
-diff -urNp linux-2.6.32.43/arch/x86/kernel/early_printk.c linux-2.6.32.43/arch/x86/kernel/early_printk.c
---- linux-2.6.32.43/arch/x86/kernel/early_printk.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/early_printk.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/early_printk.c linux-2.6.32.44/arch/x86/kernel/early_printk.c
+--- linux-2.6.32.44/arch/x86/kernel/early_printk.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/early_printk.c 2011-05-16 21:46:57.000000000 -0400
@@ -7,6 +7,7 @@
#include <linux/pci_regs.h>
#include <linux/pci_ids.h>
@@ -12918,9 +12866,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/early_printk.c linux-2.6.32.43/arch/x
va_start(ap, fmt);
n = vscnprintf(buf, sizeof(buf), fmt, ap);
early_console->write(early_console, buf, n);
-diff -urNp linux-2.6.32.43/arch/x86/kernel/efi_32.c linux-2.6.32.43/arch/x86/kernel/efi_32.c
---- linux-2.6.32.43/arch/x86/kernel/efi_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/efi_32.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/efi_32.c linux-2.6.32.44/arch/x86/kernel/efi_32.c
+--- linux-2.6.32.44/arch/x86/kernel/efi_32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/efi_32.c 2011-04-17 15:56:46.000000000 -0400
@@ -38,70 +38,38 @@
*/
@@ -13001,9 +12949,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/efi_32.c linux-2.6.32.43/arch/x86/ker
/*
* After the lock is released, the original page table is restored.
-diff -urNp linux-2.6.32.43/arch/x86/kernel/efi_stub_32.S linux-2.6.32.43/arch/x86/kernel/efi_stub_32.S
---- linux-2.6.32.43/arch/x86/kernel/efi_stub_32.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/efi_stub_32.S 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/efi_stub_32.S linux-2.6.32.44/arch/x86/kernel/efi_stub_32.S
+--- linux-2.6.32.44/arch/x86/kernel/efi_stub_32.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/efi_stub_32.S 2011-04-17 15:56:46.000000000 -0400
@@ -6,6 +6,7 @@
*/
@@ -13102,9 +13050,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/efi_stub_32.S linux-2.6.32.43/arch/x8
saved_return_addr:
.long 0
efi_rt_function_ptr:
-diff -urNp linux-2.6.32.43/arch/x86/kernel/entry_32.S linux-2.6.32.43/arch/x86/kernel/entry_32.S
---- linux-2.6.32.43/arch/x86/kernel/entry_32.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/entry_32.S 2011-05-22 23:02:03.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/entry_32.S linux-2.6.32.44/arch/x86/kernel/entry_32.S
+--- linux-2.6.32.44/arch/x86/kernel/entry_32.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/entry_32.S 2011-05-22 23:02:03.000000000 -0400
@@ -185,13 +185,146 @@
/*CFI_REL_OFFSET gs, PT_GS*/
.endm
@@ -13575,9 +13523,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/entry_32.S linux-2.6.32.43/arch/x86/k
RESTORE_REGS
lss 12+4(%esp), %esp # back to espfix stack
CFI_ADJUST_CFA_OFFSET -24
-diff -urNp linux-2.6.32.43/arch/x86/kernel/entry_64.S linux-2.6.32.43/arch/x86/kernel/entry_64.S
---- linux-2.6.32.43/arch/x86/kernel/entry_64.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/entry_64.S 2011-06-04 20:30:53.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/entry_64.S linux-2.6.32.44/arch/x86/kernel/entry_64.S
+--- linux-2.6.32.44/arch/x86/kernel/entry_64.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/entry_64.S 2011-06-04 20:30:53.000000000 -0400
@@ -53,6 +53,7 @@
#include <asm/paravirt.h>
#include <asm/ftrace.h>
@@ -14140,9 +14088,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/entry_64.S linux-2.6.32.43/arch/x86/k
RESTORE_ALL 8
jmp irq_return
nmi_userspace:
-diff -urNp linux-2.6.32.43/arch/x86/kernel/ftrace.c linux-2.6.32.43/arch/x86/kernel/ftrace.c
---- linux-2.6.32.43/arch/x86/kernel/ftrace.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/ftrace.c 2011-05-04 17:56:20.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/ftrace.c linux-2.6.32.44/arch/x86/kernel/ftrace.c
+--- linux-2.6.32.44/arch/x86/kernel/ftrace.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/ftrace.c 2011-05-04 17:56:20.000000000 -0400
@@ -103,7 +103,7 @@ static void *mod_code_ip; /* holds the
static void *mod_code_newcode; /* holds the text to write to the IP */
@@ -14228,9 +14176,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/ftrace.c linux-2.6.32.43/arch/x86/ker
if (probe_kernel_read(code, (void *)ip, MCOUNT_INSN_SIZE))
return -EFAULT;
-diff -urNp linux-2.6.32.43/arch/x86/kernel/head32.c linux-2.6.32.43/arch/x86/kernel/head32.c
---- linux-2.6.32.43/arch/x86/kernel/head32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/head32.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/head32.c linux-2.6.32.44/arch/x86/kernel/head32.c
+--- linux-2.6.32.44/arch/x86/kernel/head32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/head32.c 2011-04-17 15:56:46.000000000 -0400
@@ -16,6 +16,7 @@
#include <asm/apic.h>
#include <asm/io_apic.h>
@@ -14248,9 +14196,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/head32.c linux-2.6.32.43/arch/x86/ker
#ifdef CONFIG_BLK_DEV_INITRD
/* Reserve INITRD */
-diff -urNp linux-2.6.32.43/arch/x86/kernel/head_32.S linux-2.6.32.43/arch/x86/kernel/head_32.S
---- linux-2.6.32.43/arch/x86/kernel/head_32.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/head_32.S 2011-07-06 19:53:33.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/head_32.S linux-2.6.32.44/arch/x86/kernel/head_32.S
+--- linux-2.6.32.44/arch/x86/kernel/head_32.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/head_32.S 2011-07-06 19:53:33.000000000 -0400
@@ -19,10 +19,17 @@
#include <asm/setup.h>
#include <asm/processor-flags.h>
@@ -14772,9 +14720,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/head_32.S linux-2.6.32.43/arch/x86/ke
+ /* Be sure this is zeroed to avoid false validations in Xen */
+ .fill PAGE_SIZE_asm - GDT_SIZE,1,0
+ .endr
-diff -urNp linux-2.6.32.43/arch/x86/kernel/head_64.S linux-2.6.32.43/arch/x86/kernel/head_64.S
---- linux-2.6.32.43/arch/x86/kernel/head_64.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/head_64.S 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/head_64.S linux-2.6.32.44/arch/x86/kernel/head_64.S
+--- linux-2.6.32.44/arch/x86/kernel/head_64.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/head_64.S 2011-04-17 15:56:46.000000000 -0400
@@ -19,6 +19,7 @@
#include <asm/cache.h>
#include <asm/processor-flags.h>
@@ -15045,9 +14993,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/head_64.S linux-2.6.32.43/arch/x86/ke
__PAGE_ALIGNED_BSS
.align PAGE_SIZE
-diff -urNp linux-2.6.32.43/arch/x86/kernel/i386_ksyms_32.c linux-2.6.32.43/arch/x86/kernel/i386_ksyms_32.c
---- linux-2.6.32.43/arch/x86/kernel/i386_ksyms_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/i386_ksyms_32.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/i386_ksyms_32.c linux-2.6.32.44/arch/x86/kernel/i386_ksyms_32.c
+--- linux-2.6.32.44/arch/x86/kernel/i386_ksyms_32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/i386_ksyms_32.c 2011-04-17 15:56:46.000000000 -0400
@@ -20,8 +20,12 @@ extern void cmpxchg8b_emu(void);
EXPORT_SYMBOL(cmpxchg8b_emu);
#endif
@@ -15069,9 +15017,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/i386_ksyms_32.c linux-2.6.32.43/arch/
+#ifdef CONFIG_PAX_KERNEXEC
+EXPORT_SYMBOL(__LOAD_PHYSICAL_ADDR);
+#endif
-diff -urNp linux-2.6.32.43/arch/x86/kernel/i8259.c linux-2.6.32.43/arch/x86/kernel/i8259.c
---- linux-2.6.32.43/arch/x86/kernel/i8259.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/i8259.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/i8259.c linux-2.6.32.44/arch/x86/kernel/i8259.c
+--- linux-2.6.32.44/arch/x86/kernel/i8259.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/i8259.c 2011-05-04 17:56:28.000000000 -0400
@@ -208,7 +208,7 @@ spurious_8259A_irq:
"spurious 8259A interrupt: IRQ%d.\n", irq);
spurious_irq_mask |= irqmask;
@@ -15081,9 +15029,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/i8259.c linux-2.6.32.43/arch/x86/kern
/*
* Theoretically we do not have to handle this IRQ,
* but in Linux this does not cause problems and is
-diff -urNp linux-2.6.32.43/arch/x86/kernel/init_task.c linux-2.6.32.43/arch/x86/kernel/init_task.c
---- linux-2.6.32.43/arch/x86/kernel/init_task.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/init_task.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/init_task.c linux-2.6.32.44/arch/x86/kernel/init_task.c
+--- linux-2.6.32.44/arch/x86/kernel/init_task.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/init_task.c 2011-04-17 15:56:46.000000000 -0400
@@ -20,8 +20,7 @@ static struct sighand_struct init_sighan
* way process stacks are handled. This is done by having a special
* "init_task" linker map entry..
@@ -15102,9 +15050,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/init_task.c linux-2.6.32.43/arch/x86/
-
+struct tss_struct init_tss[NR_CPUS] ____cacheline_internodealigned_in_smp = { [0 ... NR_CPUS-1] = INIT_TSS };
+EXPORT_SYMBOL(init_tss);
-diff -urNp linux-2.6.32.43/arch/x86/kernel/ioport.c linux-2.6.32.43/arch/x86/kernel/ioport.c
---- linux-2.6.32.43/arch/x86/kernel/ioport.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/ioport.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/ioport.c linux-2.6.32.44/arch/x86/kernel/ioport.c
+--- linux-2.6.32.44/arch/x86/kernel/ioport.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/ioport.c 2011-04-17 15:56:46.000000000 -0400
@@ -6,6 +6,7 @@
#include <linux/sched.h>
#include <linux/kernel.h>
@@ -15148,9 +15096,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/ioport.c linux-2.6.32.43/arch/x86/ker
if (!capable(CAP_SYS_RAWIO))
return -EPERM;
}
-diff -urNp linux-2.6.32.43/arch/x86/kernel/irq_32.c linux-2.6.32.43/arch/x86/kernel/irq_32.c
---- linux-2.6.32.43/arch/x86/kernel/irq_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/irq_32.c 2011-07-06 19:53:33.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/irq_32.c linux-2.6.32.44/arch/x86/kernel/irq_32.c
+--- linux-2.6.32.44/arch/x86/kernel/irq_32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/irq_32.c 2011-07-06 19:53:33.000000000 -0400
@@ -35,7 +35,7 @@ static int check_stack_overflow(void)
__asm__ __volatile__("andl %%esp,%0" :
"=r" (sp) : "0" (THREAD_SIZE - 1));
@@ -15291,9 +15239,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/irq_32.c linux-2.6.32.43/arch/x86/ker
/*
* Shouldnt happen, we returned above if in_interrupt():
*/
-diff -urNp linux-2.6.32.43/arch/x86/kernel/irq.c linux-2.6.32.43/arch/x86/kernel/irq.c
---- linux-2.6.32.43/arch/x86/kernel/irq.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/irq.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/irq.c linux-2.6.32.44/arch/x86/kernel/irq.c
+--- linux-2.6.32.44/arch/x86/kernel/irq.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/irq.c 2011-05-04 17:56:28.000000000 -0400
@@ -15,7 +15,7 @@
#include <asm/mce.h>
#include <asm/hw_irq.h>
@@ -15328,9 +15276,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/irq.c linux-2.6.32.43/arch/x86/kernel
#endif
return sum;
}
-diff -urNp linux-2.6.32.43/arch/x86/kernel/kgdb.c linux-2.6.32.43/arch/x86/kernel/kgdb.c
---- linux-2.6.32.43/arch/x86/kernel/kgdb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/kgdb.c 2011-05-04 17:56:20.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/kgdb.c linux-2.6.32.44/arch/x86/kernel/kgdb.c
+--- linux-2.6.32.44/arch/x86/kernel/kgdb.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/kgdb.c 2011-05-04 17:56:20.000000000 -0400
@@ -390,13 +390,13 @@ int kgdb_arch_handle_exception(int e_vec
/* clear the trace bit */
@@ -15365,9 +15313,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/kgdb.c linux-2.6.32.43/arch/x86/kerne
/* Breakpoint instruction: */
.gdb_bpt_instr = { 0xcc },
.flags = KGDB_HW_BREAKPOINT,
-diff -urNp linux-2.6.32.43/arch/x86/kernel/kprobes.c linux-2.6.32.43/arch/x86/kernel/kprobes.c
---- linux-2.6.32.43/arch/x86/kernel/kprobes.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/kprobes.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/kprobes.c linux-2.6.32.44/arch/x86/kernel/kprobes.c
+--- linux-2.6.32.44/arch/x86/kernel/kprobes.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/kprobes.c 2011-04-17 15:56:46.000000000 -0400
@@ -166,9 +166,13 @@ static void __kprobes set_jmp_op(void *f
char op;
s32 raddr;
@@ -15469,9 +15417,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/kprobes.c linux-2.6.32.43/arch/x86/ke
return ret;
switch (val) {
-diff -urNp linux-2.6.32.43/arch/x86/kernel/ldt.c linux-2.6.32.43/arch/x86/kernel/ldt.c
---- linux-2.6.32.43/arch/x86/kernel/ldt.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/ldt.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/ldt.c linux-2.6.32.44/arch/x86/kernel/ldt.c
+--- linux-2.6.32.44/arch/x86/kernel/ldt.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/ldt.c 2011-04-17 15:56:46.000000000 -0400
@@ -66,13 +66,13 @@ static int alloc_ldt(mm_context_t *pc, i
if (reload) {
#ifdef CONFIG_SMP
@@ -15536,9 +15484,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/ldt.c linux-2.6.32.43/arch/x86/kernel
fill_ldt(&ldt, &ldt_info);
if (oldmode)
ldt.avl = 0;
-diff -urNp linux-2.6.32.43/arch/x86/kernel/machine_kexec_32.c linux-2.6.32.43/arch/x86/kernel/machine_kexec_32.c
---- linux-2.6.32.43/arch/x86/kernel/machine_kexec_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/machine_kexec_32.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/machine_kexec_32.c linux-2.6.32.44/arch/x86/kernel/machine_kexec_32.c
+--- linux-2.6.32.44/arch/x86/kernel/machine_kexec_32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/machine_kexec_32.c 2011-04-17 15:56:46.000000000 -0400
@@ -26,7 +26,7 @@
#include <asm/system.h>
#include <asm/cacheflush.h>
@@ -15566,9 +15514,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/machine_kexec_32.c linux-2.6.32.43/ar
relocate_kernel_ptr = control_page;
page_list[PA_CONTROL_PAGE] = __pa(control_page);
-diff -urNp linux-2.6.32.43/arch/x86/kernel/microcode_amd.c linux-2.6.32.43/arch/x86/kernel/microcode_amd.c
---- linux-2.6.32.43/arch/x86/kernel/microcode_amd.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/microcode_amd.c 2011-04-17 17:03:05.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/microcode_amd.c linux-2.6.32.44/arch/x86/kernel/microcode_amd.c
+--- linux-2.6.32.44/arch/x86/kernel/microcode_amd.c 2011-04-17 17:00:52.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/microcode_amd.c 2011-04-17 17:03:05.000000000 -0400
@@ -364,7 +364,7 @@ static void microcode_fini_cpu_amd(int c
uci->mc = NULL;
}
@@ -15587,9 +15535,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/microcode_amd.c linux-2.6.32.43/arch/
{
return µcode_amd_ops;
}
-diff -urNp linux-2.6.32.43/arch/x86/kernel/microcode_core.c linux-2.6.32.43/arch/x86/kernel/microcode_core.c
---- linux-2.6.32.43/arch/x86/kernel/microcode_core.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/microcode_core.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/microcode_core.c linux-2.6.32.44/arch/x86/kernel/microcode_core.c
+--- linux-2.6.32.44/arch/x86/kernel/microcode_core.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/microcode_core.c 2011-04-17 15:56:46.000000000 -0400
@@ -90,7 +90,7 @@ MODULE_LICENSE("GPL");
#define MICROCODE_VERSION "2.00"
@@ -15599,9 +15547,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/microcode_core.c linux-2.6.32.43/arch
/*
* Synchronization.
-diff -urNp linux-2.6.32.43/arch/x86/kernel/microcode_intel.c linux-2.6.32.43/arch/x86/kernel/microcode_intel.c
---- linux-2.6.32.43/arch/x86/kernel/microcode_intel.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/microcode_intel.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/microcode_intel.c linux-2.6.32.44/arch/x86/kernel/microcode_intel.c
+--- linux-2.6.32.44/arch/x86/kernel/microcode_intel.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/microcode_intel.c 2011-04-17 15:56:46.000000000 -0400
@@ -443,13 +443,13 @@ static enum ucode_state request_microcod
static int get_ucode_user(void *to, const void *from, size_t n)
@@ -15636,9 +15584,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/microcode_intel.c linux-2.6.32.43/arc
{
return µcode_intel_ops;
}
-diff -urNp linux-2.6.32.43/arch/x86/kernel/module.c linux-2.6.32.43/arch/x86/kernel/module.c
---- linux-2.6.32.43/arch/x86/kernel/module.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/module.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/module.c linux-2.6.32.44/arch/x86/kernel/module.c
+--- linux-2.6.32.44/arch/x86/kernel/module.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/module.c 2011-04-17 15:56:46.000000000 -0400
@@ -34,7 +34,7 @@
#define DEBUGP(fmt...)
#endif
@@ -15779,9 +15727,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/module.c linux-2.6.32.43/arch/x86/ker
#if 0
if ((s64)val != *(s32 *)loc)
goto overflow;
-diff -urNp linux-2.6.32.43/arch/x86/kernel/paravirt.c linux-2.6.32.43/arch/x86/kernel/paravirt.c
---- linux-2.6.32.43/arch/x86/kernel/paravirt.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/paravirt.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/paravirt.c linux-2.6.32.44/arch/x86/kernel/paravirt.c
+--- linux-2.6.32.44/arch/x86/kernel/paravirt.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/paravirt.c 2011-08-05 20:33:55.000000000 -0400
@@ -53,6 +53,9 @@ u64 _paravirt_ident_64(u64 x)
{
return x;
@@ -15921,9 +15869,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/paravirt.c linux-2.6.32.43/arch/x86/k
};
EXPORT_SYMBOL_GPL(pv_time_ops);
-diff -urNp linux-2.6.32.43/arch/x86/kernel/paravirt-spinlocks.c linux-2.6.32.43/arch/x86/kernel/paravirt-spinlocks.c
---- linux-2.6.32.43/arch/x86/kernel/paravirt-spinlocks.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/paravirt-spinlocks.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/paravirt-spinlocks.c linux-2.6.32.44/arch/x86/kernel/paravirt-spinlocks.c
+--- linux-2.6.32.44/arch/x86/kernel/paravirt-spinlocks.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/paravirt-spinlocks.c 2011-04-17 15:56:46.000000000 -0400
@@ -13,7 +13,7 @@ default_spin_lock_flags(raw_spinlock_t *
__raw_spin_lock(lock);
}
@@ -15933,9 +15881,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/paravirt-spinlocks.c linux-2.6.32.43/
#ifdef CONFIG_SMP
.spin_is_locked = __ticket_spin_is_locked,
.spin_is_contended = __ticket_spin_is_contended,
-diff -urNp linux-2.6.32.43/arch/x86/kernel/pci-calgary_64.c linux-2.6.32.43/arch/x86/kernel/pci-calgary_64.c
---- linux-2.6.32.43/arch/x86/kernel/pci-calgary_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/pci-calgary_64.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/pci-calgary_64.c linux-2.6.32.44/arch/x86/kernel/pci-calgary_64.c
+--- linux-2.6.32.44/arch/x86/kernel/pci-calgary_64.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/pci-calgary_64.c 2011-04-17 15:56:46.000000000 -0400
@@ -477,7 +477,7 @@ static void calgary_free_coherent(struct
free_pages((unsigned long)vaddr, get_order(size));
}
@@ -15945,9 +15893,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/pci-calgary_64.c linux-2.6.32.43/arch
.alloc_coherent = calgary_alloc_coherent,
.free_coherent = calgary_free_coherent,
.map_sg = calgary_map_sg,
-diff -urNp linux-2.6.32.43/arch/x86/kernel/pci-dma.c linux-2.6.32.43/arch/x86/kernel/pci-dma.c
---- linux-2.6.32.43/arch/x86/kernel/pci-dma.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/pci-dma.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/pci-dma.c linux-2.6.32.44/arch/x86/kernel/pci-dma.c
+--- linux-2.6.32.44/arch/x86/kernel/pci-dma.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/pci-dma.c 2011-04-17 15:56:46.000000000 -0400
@@ -14,7 +14,7 @@
static int forbid_dac __read_mostly;
@@ -15966,9 +15914,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/pci-dma.c linux-2.6.32.43/arch/x86/ke
#ifdef CONFIG_PCI
if (mask > 0xffffffff && forbid_dac > 0) {
-diff -urNp linux-2.6.32.43/arch/x86/kernel/pci-gart_64.c linux-2.6.32.43/arch/x86/kernel/pci-gart_64.c
---- linux-2.6.32.43/arch/x86/kernel/pci-gart_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/pci-gart_64.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/pci-gart_64.c linux-2.6.32.44/arch/x86/kernel/pci-gart_64.c
+--- linux-2.6.32.44/arch/x86/kernel/pci-gart_64.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/pci-gart_64.c 2011-04-17 15:56:46.000000000 -0400
@@ -682,7 +682,7 @@ static __init int init_k8_gatt(struct ag
return -1;
}
@@ -15978,9 +15926,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/pci-gart_64.c linux-2.6.32.43/arch/x8
.map_sg = gart_map_sg,
.unmap_sg = gart_unmap_sg,
.map_page = gart_map_page,
-diff -urNp linux-2.6.32.43/arch/x86/kernel/pci-nommu.c linux-2.6.32.43/arch/x86/kernel/pci-nommu.c
---- linux-2.6.32.43/arch/x86/kernel/pci-nommu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/pci-nommu.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/pci-nommu.c linux-2.6.32.44/arch/x86/kernel/pci-nommu.c
+--- linux-2.6.32.44/arch/x86/kernel/pci-nommu.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/pci-nommu.c 2011-04-17 15:56:46.000000000 -0400
@@ -94,7 +94,7 @@ static void nommu_sync_sg_for_device(str
flush_write_buffers();
}
@@ -15990,9 +15938,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/pci-nommu.c linux-2.6.32.43/arch/x86/
.alloc_coherent = dma_generic_alloc_coherent,
.free_coherent = nommu_free_coherent,
.map_sg = nommu_map_sg,
-diff -urNp linux-2.6.32.43/arch/x86/kernel/pci-swiotlb.c linux-2.6.32.43/arch/x86/kernel/pci-swiotlb.c
---- linux-2.6.32.43/arch/x86/kernel/pci-swiotlb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/pci-swiotlb.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/pci-swiotlb.c linux-2.6.32.44/arch/x86/kernel/pci-swiotlb.c
+--- linux-2.6.32.44/arch/x86/kernel/pci-swiotlb.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/pci-swiotlb.c 2011-04-17 15:56:46.000000000 -0400
@@ -25,7 +25,7 @@ static void *x86_swiotlb_alloc_coherent(
return swiotlb_alloc_coherent(hwdev, size, dma_handle, flags);
}
@@ -16002,9 +15950,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/pci-swiotlb.c linux-2.6.32.43/arch/x8
.mapping_error = swiotlb_dma_mapping_error,
.alloc_coherent = x86_swiotlb_alloc_coherent,
.free_coherent = swiotlb_free_coherent,
-diff -urNp linux-2.6.32.43/arch/x86/kernel/process_32.c linux-2.6.32.43/arch/x86/kernel/process_32.c
---- linux-2.6.32.43/arch/x86/kernel/process_32.c 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/process_32.c 2011-06-25 12:56:37.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/process_32.c linux-2.6.32.44/arch/x86/kernel/process_32.c
+--- linux-2.6.32.44/arch/x86/kernel/process_32.c 2011-06-25 12:55:34.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/process_32.c 2011-06-25 12:56:37.000000000 -0400
@@ -67,6 +67,7 @@ asmlinkage void ret_from_fork(void) __as
unsigned long thread_saved_pc(struct task_struct *tsk)
{
@@ -16105,9 +16053,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/process_32.c linux-2.6.32.43/arch/x86
return 0;
}
-
-diff -urNp linux-2.6.32.43/arch/x86/kernel/process_64.c linux-2.6.32.43/arch/x86/kernel/process_64.c
---- linux-2.6.32.43/arch/x86/kernel/process_64.c 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/process_64.c 2011-06-25 12:56:37.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/process_64.c linux-2.6.32.44/arch/x86/kernel/process_64.c
+--- linux-2.6.32.44/arch/x86/kernel/process_64.c 2011-06-25 12:55:34.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/process_64.c 2011-06-25 12:56:37.000000000 -0400
@@ -91,7 +91,7 @@ static void __exit_idle(void)
void exit_idle(void)
{
@@ -16181,9 +16129,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/process_64.c linux-2.6.32.43/arch/x86
return 0;
ip = *(u64 *)(fp+8);
if (!in_sched_functions(ip))
-diff -urNp linux-2.6.32.43/arch/x86/kernel/process.c linux-2.6.32.43/arch/x86/kernel/process.c
---- linux-2.6.32.43/arch/x86/kernel/process.c 2011-04-22 19:16:29.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/process.c 2011-05-22 23:02:03.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/process.c linux-2.6.32.44/arch/x86/kernel/process.c
+--- linux-2.6.32.44/arch/x86/kernel/process.c 2011-04-22 19:16:29.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/process.c 2011-05-22 23:02:03.000000000 -0400
@@ -51,16 +51,33 @@ void free_thread_xstate(struct task_stru
void free_thread_info(struct thread_info *ti)
@@ -16295,9 +16243,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/process.c linux-2.6.32.43/arch/x86/ke
}
+#endif
-diff -urNp linux-2.6.32.43/arch/x86/kernel/ptrace.c linux-2.6.32.43/arch/x86/kernel/ptrace.c
---- linux-2.6.32.43/arch/x86/kernel/ptrace.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/ptrace.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/ptrace.c linux-2.6.32.44/arch/x86/kernel/ptrace.c
+--- linux-2.6.32.44/arch/x86/kernel/ptrace.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/ptrace.c 2011-04-17 15:56:46.000000000 -0400
@@ -925,7 +925,7 @@ static const struct user_regset_view use
long arch_ptrace(struct task_struct *child, long request, long addr, long data)
{
@@ -16384,9 +16332,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/ptrace.c linux-2.6.32.43/arch/x86/ker
{
if (unlikely(current->audit_context))
audit_syscall_exit(AUDITSC_RESULT(regs->ax), regs->ax);
-diff -urNp linux-2.6.32.43/arch/x86/kernel/reboot.c linux-2.6.32.43/arch/x86/kernel/reboot.c
---- linux-2.6.32.43/arch/x86/kernel/reboot.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/reboot.c 2011-05-22 23:02:03.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/reboot.c linux-2.6.32.44/arch/x86/kernel/reboot.c
+--- linux-2.6.32.44/arch/x86/kernel/reboot.c 2011-08-09 18:35:28.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/reboot.c 2011-08-09 18:33:59.000000000 -0400
@@ -33,7 +33,7 @@ void (*pm_power_off)(void);
EXPORT_SYMBOL(pm_power_off);
@@ -16462,7 +16410,7 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/reboot.c linux-2.6.32.43/arch/x86/ker
}
#ifdef CONFIG_APM_MODULE
EXPORT_SYMBOL(machine_real_restart);
-@@ -536,7 +536,7 @@ void __attribute__((weak)) mach_reboot_f
+@@ -544,7 +544,7 @@ void __attribute__((weak)) mach_reboot_f
{
}
@@ -16471,7 +16419,7 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/reboot.c linux-2.6.32.43/arch/x86/ker
{
int i;
-@@ -651,13 +651,13 @@ void native_machine_shutdown(void)
+@@ -659,13 +659,13 @@ void native_machine_shutdown(void)
#endif
}
@@ -16487,7 +16435,7 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/reboot.c linux-2.6.32.43/arch/x86/ker
{
printk("machine restart\n");
-@@ -666,7 +666,7 @@ static void native_machine_restart(char
+@@ -674,7 +674,7 @@ static void native_machine_restart(char
__machine_emergency_restart(0);
}
@@ -16496,7 +16444,7 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/reboot.c linux-2.6.32.43/arch/x86/ker
{
/* stop other cpus and apics */
machine_shutdown();
-@@ -677,7 +677,7 @@ static void native_machine_halt(void)
+@@ -685,7 +685,7 @@ static void native_machine_halt(void)
stop_this_cpu(NULL);
}
@@ -16505,7 +16453,7 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/reboot.c linux-2.6.32.43/arch/x86/ker
{
if (pm_power_off) {
if (!reboot_force)
-@@ -686,6 +686,7 @@ static void native_machine_power_off(voi
+@@ -694,6 +694,7 @@ static void native_machine_power_off(voi
}
/* a fallback in case there is no PM info available */
tboot_shutdown(TB_SHUTDOWN_HALT);
@@ -16513,9 +16461,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/reboot.c linux-2.6.32.43/arch/x86/ker
}
struct machine_ops machine_ops = {
-diff -urNp linux-2.6.32.43/arch/x86/kernel/setup.c linux-2.6.32.43/arch/x86/kernel/setup.c
---- linux-2.6.32.43/arch/x86/kernel/setup.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/setup.c 2011-04-17 17:03:05.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/setup.c linux-2.6.32.44/arch/x86/kernel/setup.c
+--- linux-2.6.32.44/arch/x86/kernel/setup.c 2011-04-17 17:00:52.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/setup.c 2011-04-17 17:03:05.000000000 -0400
@@ -783,14 +783,14 @@ void __init setup_arch(char **cmdline_p)
if (!boot_params.hdr.root_flags)
@@ -16536,9 +16484,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/setup.c linux-2.6.32.43/arch/x86/kern
data_resource.end = virt_to_phys(_edata)-1;
bss_resource.start = virt_to_phys(&__bss_start);
bss_resource.end = virt_to_phys(&__bss_stop)-1;
-diff -urNp linux-2.6.32.43/arch/x86/kernel/setup_percpu.c linux-2.6.32.43/arch/x86/kernel/setup_percpu.c
---- linux-2.6.32.43/arch/x86/kernel/setup_percpu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/setup_percpu.c 2011-06-04 20:36:29.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/setup_percpu.c linux-2.6.32.44/arch/x86/kernel/setup_percpu.c
+--- linux-2.6.32.44/arch/x86/kernel/setup_percpu.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/setup_percpu.c 2011-06-04 20:36:29.000000000 -0400
@@ -25,19 +25,17 @@
# define DBG(x...)
#endif
@@ -16602,9 +16550,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/setup_percpu.c linux-2.6.32.43/arch/x
/*
* Up to this point, the boot CPU has been using .data.init
* area. Reload any changed state for the boot CPU.
-diff -urNp linux-2.6.32.43/arch/x86/kernel/signal.c linux-2.6.32.43/arch/x86/kernel/signal.c
---- linux-2.6.32.43/arch/x86/kernel/signal.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/signal.c 2011-05-22 23:02:03.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/signal.c linux-2.6.32.44/arch/x86/kernel/signal.c
+--- linux-2.6.32.44/arch/x86/kernel/signal.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/signal.c 2011-05-22 23:02:03.000000000 -0400
@@ -197,7 +197,7 @@ static unsigned long align_sigframe(unsi
* Align the stack pointer according to the i386 ABI,
* i.e. so that on function entry ((sp + 4) & 15) == 0.
@@ -16688,9 +16636,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/signal.c linux-2.6.32.43/arch/x86/ker
return;
if (current_thread_info()->status & TS_RESTORE_SIGMASK)
-diff -urNp linux-2.6.32.43/arch/x86/kernel/smpboot.c linux-2.6.32.43/arch/x86/kernel/smpboot.c
---- linux-2.6.32.43/arch/x86/kernel/smpboot.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/smpboot.c 2011-07-01 19:10:03.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/smpboot.c linux-2.6.32.44/arch/x86/kernel/smpboot.c
+--- linux-2.6.32.44/arch/x86/kernel/smpboot.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/smpboot.c 2011-07-01 19:10:03.000000000 -0400
@@ -94,14 +94,14 @@ static DEFINE_PER_CPU(struct task_struct
*/
static DEFINE_MUTEX(x86_cpu_hotplug_driver_mutex);
@@ -16760,9 +16708,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/smpboot.c linux-2.6.32.43/arch/x86/ke
err = do_boot_cpu(apicid, cpu);
if (err) {
-diff -urNp linux-2.6.32.43/arch/x86/kernel/step.c linux-2.6.32.43/arch/x86/kernel/step.c
---- linux-2.6.32.43/arch/x86/kernel/step.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/step.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/step.c linux-2.6.32.44/arch/x86/kernel/step.c
+--- linux-2.6.32.44/arch/x86/kernel/step.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/step.c 2011-04-17 15:56:46.000000000 -0400
@@ -27,10 +27,10 @@ unsigned long convert_ip_to_linear(struc
struct desc_struct *desc;
unsigned long base;
@@ -16805,17 +16753,17 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/step.c linux-2.6.32.43/arch/x86/kerne
/* 32-bit mode: register increment */
return 0;
/* 64-bit mode: REX prefix */
-diff -urNp linux-2.6.32.43/arch/x86/kernel/syscall_table_32.S linux-2.6.32.43/arch/x86/kernel/syscall_table_32.S
---- linux-2.6.32.43/arch/x86/kernel/syscall_table_32.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/syscall_table_32.S 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/syscall_table_32.S linux-2.6.32.44/arch/x86/kernel/syscall_table_32.S
+--- linux-2.6.32.44/arch/x86/kernel/syscall_table_32.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/syscall_table_32.S 2011-04-17 15:56:46.000000000 -0400
@@ -1,3 +1,4 @@
+.section .rodata,"a",@progbits
ENTRY(sys_call_table)
.long sys_restart_syscall /* 0 - old "setup()" system call, used for restarting */
.long sys_exit
-diff -urNp linux-2.6.32.43/arch/x86/kernel/sys_i386_32.c linux-2.6.32.43/arch/x86/kernel/sys_i386_32.c
---- linux-2.6.32.43/arch/x86/kernel/sys_i386_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/sys_i386_32.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/sys_i386_32.c linux-2.6.32.44/arch/x86/kernel/sys_i386_32.c
+--- linux-2.6.32.44/arch/x86/kernel/sys_i386_32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/sys_i386_32.c 2011-04-17 15:56:46.000000000 -0400
@@ -24,6 +24,21 @@
#include <asm/syscalls.h>
@@ -17087,9 +17035,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/sys_i386_32.c linux-2.6.32.43/arch/x8
- : "0" (__NR_execve), "ri" (filename), "c" (argv), "d" (envp) : "memory");
- return __res;
-}
-diff -urNp linux-2.6.32.43/arch/x86/kernel/sys_x86_64.c linux-2.6.32.43/arch/x86/kernel/sys_x86_64.c
---- linux-2.6.32.43/arch/x86/kernel/sys_x86_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/sys_x86_64.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/sys_x86_64.c linux-2.6.32.44/arch/x86/kernel/sys_x86_64.c
+--- linux-2.6.32.44/arch/x86/kernel/sys_x86_64.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/sys_x86_64.c 2011-04-17 15:56:46.000000000 -0400
@@ -32,8 +32,8 @@ out:
return error;
}
@@ -17227,9 +17175,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/sys_x86_64.c linux-2.6.32.43/arch/x86
mm->cached_hole_size = ~0UL;
return addr;
-diff -urNp linux-2.6.32.43/arch/x86/kernel/tboot.c linux-2.6.32.43/arch/x86/kernel/tboot.c
---- linux-2.6.32.43/arch/x86/kernel/tboot.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/tboot.c 2011-05-22 23:02:03.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/tboot.c linux-2.6.32.44/arch/x86/kernel/tboot.c
+--- linux-2.6.32.44/arch/x86/kernel/tboot.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/tboot.c 2011-05-22 23:02:03.000000000 -0400
@@ -216,7 +216,7 @@ static int tboot_setup_sleep(void)
void tboot_shutdown(u32 shutdown_type)
@@ -17278,9 +17226,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/tboot.c linux-2.6.32.43/arch/x86/kern
register_hotcpu_notifier(&tboot_cpu_notifier);
return 0;
}
-diff -urNp linux-2.6.32.43/arch/x86/kernel/time.c linux-2.6.32.43/arch/x86/kernel/time.c
---- linux-2.6.32.43/arch/x86/kernel/time.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/time.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/time.c linux-2.6.32.44/arch/x86/kernel/time.c
+--- linux-2.6.32.44/arch/x86/kernel/time.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/time.c 2011-04-17 15:56:46.000000000 -0400
@@ -26,17 +26,13 @@
int timer_ack;
#endif
@@ -17319,9 +17267,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/time.c linux-2.6.32.43/arch/x86/kerne
}
return pc;
}
-diff -urNp linux-2.6.32.43/arch/x86/kernel/tls.c linux-2.6.32.43/arch/x86/kernel/tls.c
---- linux-2.6.32.43/arch/x86/kernel/tls.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/tls.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/tls.c linux-2.6.32.44/arch/x86/kernel/tls.c
+--- linux-2.6.32.44/arch/x86/kernel/tls.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/tls.c 2011-04-17 15:56:46.000000000 -0400
@@ -85,6 +85,11 @@ int do_set_thread_area(struct task_struc
if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
return -EINVAL;
@@ -17334,9 +17282,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/tls.c linux-2.6.32.43/arch/x86/kernel
set_tls_desc(p, idx, &info, 1);
return 0;
-diff -urNp linux-2.6.32.43/arch/x86/kernel/trampoline_32.S linux-2.6.32.43/arch/x86/kernel/trampoline_32.S
---- linux-2.6.32.43/arch/x86/kernel/trampoline_32.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/trampoline_32.S 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/trampoline_32.S linux-2.6.32.44/arch/x86/kernel/trampoline_32.S
+--- linux-2.6.32.44/arch/x86/kernel/trampoline_32.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/trampoline_32.S 2011-04-17 15:56:46.000000000 -0400
@@ -32,6 +32,12 @@
#include <asm/segment.h>
#include <asm/page_types.h>
@@ -17359,9 +17307,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/trampoline_32.S linux-2.6.32.43/arch/
# These need to be in the same 64K segment as the above;
# hence we don't use the boot_gdt_descr defined in head.S
-diff -urNp linux-2.6.32.43/arch/x86/kernel/trampoline_64.S linux-2.6.32.43/arch/x86/kernel/trampoline_64.S
---- linux-2.6.32.43/arch/x86/kernel/trampoline_64.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/trampoline_64.S 2011-07-01 18:53:26.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/trampoline_64.S linux-2.6.32.44/arch/x86/kernel/trampoline_64.S
+--- linux-2.6.32.44/arch/x86/kernel/trampoline_64.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/trampoline_64.S 2011-07-01 18:53:26.000000000 -0400
@@ -91,7 +91,7 @@ startup_32:
movl $__KERNEL_DS, %eax # Initialize the %ds segment register
movl %eax, %ds
@@ -17389,9 +17337,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/trampoline_64.S linux-2.6.32.43/arch/
.long tgdt - r_base
.short 0
.quad 0x00cf9b000000ffff # __KERNEL32_CS
-diff -urNp linux-2.6.32.43/arch/x86/kernel/traps.c linux-2.6.32.43/arch/x86/kernel/traps.c
---- linux-2.6.32.43/arch/x86/kernel/traps.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/traps.c 2011-07-06 19:53:33.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/traps.c linux-2.6.32.44/arch/x86/kernel/traps.c
+--- linux-2.6.32.44/arch/x86/kernel/traps.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/traps.c 2011-07-06 19:53:33.000000000 -0400
@@ -69,12 +69,6 @@ asmlinkage int system_call(void);
/* Do we ignore FPU interrupts ? */
@@ -17578,9 +17526,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/traps.c linux-2.6.32.43/arch/x86/kern
if (!tsk_used_math(tsk)) {
local_irq_enable();
-diff -urNp linux-2.6.32.43/arch/x86/kernel/verify_cpu_64.S linux-2.6.32.43/arch/x86/kernel/verify_cpu_64.S
---- linux-2.6.32.43/arch/x86/kernel/verify_cpu_64.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/verify_cpu_64.S 1969-12-31 19:00:00.000000000 -0500
+diff -urNp linux-2.6.32.44/arch/x86/kernel/verify_cpu_64.S linux-2.6.32.44/arch/x86/kernel/verify_cpu_64.S
+--- linux-2.6.32.44/arch/x86/kernel/verify_cpu_64.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/verify_cpu_64.S 1969-12-31 19:00:00.000000000 -0500
@@ -1,105 +0,0 @@
-/*
- *
@@ -17687,9 +17635,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/verify_cpu_64.S linux-2.6.32.43/arch/
- popfl # Restore caller passed flags
- xorl %eax, %eax
- ret
-diff -urNp linux-2.6.32.43/arch/x86/kernel/verify_cpu.S linux-2.6.32.43/arch/x86/kernel/verify_cpu.S
---- linux-2.6.32.43/arch/x86/kernel/verify_cpu.S 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/arch/x86/kernel/verify_cpu.S 2011-07-01 18:28:42.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/verify_cpu.S linux-2.6.32.44/arch/x86/kernel/verify_cpu.S
+--- linux-2.6.32.44/arch/x86/kernel/verify_cpu.S 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/arch/x86/kernel/verify_cpu.S 2011-07-01 18:28:42.000000000 -0400
@@ -0,0 +1,140 @@
+/*
+ *
@@ -17831,9 +17779,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/verify_cpu.S linux-2.6.32.43/arch/x86
+ popfl # Restore caller passed flags
+ xorl %eax, %eax
+ ret
-diff -urNp linux-2.6.32.43/arch/x86/kernel/vm86_32.c linux-2.6.32.43/arch/x86/kernel/vm86_32.c
---- linux-2.6.32.43/arch/x86/kernel/vm86_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/vm86_32.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/vm86_32.c linux-2.6.32.44/arch/x86/kernel/vm86_32.c
+--- linux-2.6.32.44/arch/x86/kernel/vm86_32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/vm86_32.c 2011-04-17 15:56:46.000000000 -0400
@@ -41,6 +41,7 @@
#include <linux/ptrace.h>
#include <linux/audit.h>
@@ -17898,9 +17846,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/vm86_32.c linux-2.6.32.43/arch/x86/ke
if (get_user(segoffs, intr_ptr))
goto cannot_handle;
if ((segoffs >> 16) == BIOSSEG)
-diff -urNp linux-2.6.32.43/arch/x86/kernel/vmi_32.c linux-2.6.32.43/arch/x86/kernel/vmi_32.c
---- linux-2.6.32.43/arch/x86/kernel/vmi_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/vmi_32.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/vmi_32.c linux-2.6.32.44/arch/x86/kernel/vmi_32.c
+--- linux-2.6.32.44/arch/x86/kernel/vmi_32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/vmi_32.c 2011-08-05 20:33:55.000000000 -0400
@@ -44,12 +44,17 @@ typedef u32 __attribute__((regparm(1)))
typedef u64 __attribute__((regparm(2))) (VROMLONGFUNC)(int);
@@ -18063,9 +18011,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/vmi_32.c linux-2.6.32.43/arch/x86/ker
return;
local_irq_save(flags);
-diff -urNp linux-2.6.32.43/arch/x86/kernel/vmlinux.lds.S linux-2.6.32.43/arch/x86/kernel/vmlinux.lds.S
---- linux-2.6.32.43/arch/x86/kernel/vmlinux.lds.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/vmlinux.lds.S 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/vmlinux.lds.S linux-2.6.32.44/arch/x86/kernel/vmlinux.lds.S
+--- linux-2.6.32.44/arch/x86/kernel/vmlinux.lds.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/vmlinux.lds.S 2011-04-17 15:56:46.000000000 -0400
@@ -26,6 +26,13 @@
#include <asm/page_types.h>
#include <asm/cache.h>
@@ -18358,9 +18306,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/vmlinux.lds.S linux-2.6.32.43/arch/x8
"kernel image bigger than KERNEL_IMAGE_SIZE");
#ifdef CONFIG_SMP
-diff -urNp linux-2.6.32.43/arch/x86/kernel/vsyscall_64.c linux-2.6.32.43/arch/x86/kernel/vsyscall_64.c
---- linux-2.6.32.43/arch/x86/kernel/vsyscall_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/vsyscall_64.c 2011-04-23 12:56:10.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/vsyscall_64.c linux-2.6.32.44/arch/x86/kernel/vsyscall_64.c
+--- linux-2.6.32.44/arch/x86/kernel/vsyscall_64.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/vsyscall_64.c 2011-04-23 12:56:10.000000000 -0400
@@ -80,6 +80,7 @@ void update_vsyscall(struct timespec *wa
write_seqlock_irqsave(&vsyscall_gtod_data.lock, flags);
@@ -18378,9 +18326,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/vsyscall_64.c linux-2.6.32.43/arch/x8
p = tcache->blob[1];
} else if (__vgetcpu_mode == VGETCPU_RDTSCP) {
/* Load per CPU data from RDTSCP */
-diff -urNp linux-2.6.32.43/arch/x86/kernel/x8664_ksyms_64.c linux-2.6.32.43/arch/x86/kernel/x8664_ksyms_64.c
---- linux-2.6.32.43/arch/x86/kernel/x8664_ksyms_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/x8664_ksyms_64.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/x8664_ksyms_64.c linux-2.6.32.44/arch/x86/kernel/x8664_ksyms_64.c
+--- linux-2.6.32.44/arch/x86/kernel/x8664_ksyms_64.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/x8664_ksyms_64.c 2011-04-17 15:56:46.000000000 -0400
@@ -30,8 +30,6 @@ EXPORT_SYMBOL(__put_user_8);
EXPORT_SYMBOL(copy_user_generic);
@@ -18390,9 +18338,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/x8664_ksyms_64.c linux-2.6.32.43/arch
EXPORT_SYMBOL(__copy_from_user_inatomic);
EXPORT_SYMBOL(copy_page);
-diff -urNp linux-2.6.32.43/arch/x86/kernel/xsave.c linux-2.6.32.43/arch/x86/kernel/xsave.c
---- linux-2.6.32.43/arch/x86/kernel/xsave.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kernel/xsave.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kernel/xsave.c linux-2.6.32.44/arch/x86/kernel/xsave.c
+--- linux-2.6.32.44/arch/x86/kernel/xsave.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kernel/xsave.c 2011-04-17 15:56:46.000000000 -0400
@@ -54,7 +54,7 @@ int check_for_xstate(struct i387_fxsave_
fx_sw_user->xstate_size > fx_sw_user->extended_size)
return -1;
@@ -18420,9 +18368,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kernel/xsave.c linux-2.6.32.43/arch/x86/kern
buf);
if (unlikely(err)) {
/*
-diff -urNp linux-2.6.32.43/arch/x86/kvm/emulate.c linux-2.6.32.43/arch/x86/kvm/emulate.c
---- linux-2.6.32.43/arch/x86/kvm/emulate.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kvm/emulate.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kvm/emulate.c linux-2.6.32.44/arch/x86/kvm/emulate.c
+--- linux-2.6.32.44/arch/x86/kvm/emulate.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kvm/emulate.c 2011-04-17 15:56:46.000000000 -0400
@@ -81,8 +81,8 @@
#define Src2CL (1<<29)
#define Src2ImmByte (2<<29)
@@ -18459,9 +18407,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kvm/emulate.c linux-2.6.32.43/arch/x86/kvm/e
switch ((_dst).bytes) { \
case 1: \
____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b"); \
-diff -urNp linux-2.6.32.43/arch/x86/kvm/lapic.c linux-2.6.32.43/arch/x86/kvm/lapic.c
---- linux-2.6.32.43/arch/x86/kvm/lapic.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kvm/lapic.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kvm/lapic.c linux-2.6.32.44/arch/x86/kvm/lapic.c
+--- linux-2.6.32.44/arch/x86/kvm/lapic.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kvm/lapic.c 2011-04-17 15:56:46.000000000 -0400
@@ -52,7 +52,7 @@
#define APIC_BUS_CYCLE_NS 1
@@ -18471,9 +18419,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kvm/lapic.c linux-2.6.32.43/arch/x86/kvm/lap
#define APIC_LVT_NUM 6
/* 14 is the version for Xeon and Pentium 8.4.8*/
-diff -urNp linux-2.6.32.43/arch/x86/kvm/paging_tmpl.h linux-2.6.32.43/arch/x86/kvm/paging_tmpl.h
---- linux-2.6.32.43/arch/x86/kvm/paging_tmpl.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kvm/paging_tmpl.h 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kvm/paging_tmpl.h linux-2.6.32.44/arch/x86/kvm/paging_tmpl.h
+--- linux-2.6.32.44/arch/x86/kvm/paging_tmpl.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kvm/paging_tmpl.h 2011-05-16 21:46:57.000000000 -0400
@@ -416,6 +416,8 @@ static int FNAME(page_fault)(struct kvm_
int level = PT_PAGE_TABLE_LEVEL;
unsigned long mmu_seq;
@@ -18483,9 +18431,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kvm/paging_tmpl.h linux-2.6.32.43/arch/x86/k
pgprintk("%s: addr %lx err %x\n", __func__, addr, error_code);
kvm_mmu_audit(vcpu, "pre page fault");
-diff -urNp linux-2.6.32.43/arch/x86/kvm/svm.c linux-2.6.32.43/arch/x86/kvm/svm.c
---- linux-2.6.32.43/arch/x86/kvm/svm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kvm/svm.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kvm/svm.c linux-2.6.32.44/arch/x86/kvm/svm.c
+--- linux-2.6.32.44/arch/x86/kvm/svm.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kvm/svm.c 2011-08-05 20:33:55.000000000 -0400
@@ -2485,7 +2485,11 @@ static void reload_tss(struct kvm_vcpu *
int cpu = raw_smp_processor_id();
@@ -18507,9 +18455,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kvm/svm.c linux-2.6.32.43/arch/x86/kvm/svm.c
.cpu_has_kvm_support = has_svm,
.disabled_by_bios = is_disabled,
.hardware_setup = svm_hardware_setup,
-diff -urNp linux-2.6.32.43/arch/x86/kvm/vmx.c linux-2.6.32.43/arch/x86/kvm/vmx.c
---- linux-2.6.32.43/arch/x86/kvm/vmx.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kvm/vmx.c 2011-05-04 17:56:20.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kvm/vmx.c linux-2.6.32.44/arch/x86/kvm/vmx.c
+--- linux-2.6.32.44/arch/x86/kvm/vmx.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kvm/vmx.c 2011-05-04 17:56:20.000000000 -0400
@@ -570,7 +570,11 @@ static void reload_tss(void)
kvm_get_gdt(&gdt);
@@ -18600,9 +18548,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kvm/vmx.c linux-2.6.32.43/arch/x86/kvm/vmx.c
.cpu_has_kvm_support = cpu_has_kvm_support,
.disabled_by_bios = vmx_disabled_by_bios,
.hardware_setup = hardware_setup,
-diff -urNp linux-2.6.32.43/arch/x86/kvm/x86.c linux-2.6.32.43/arch/x86/kvm/x86.c
---- linux-2.6.32.43/arch/x86/kvm/x86.c 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/kvm/x86.c 2011-05-10 22:12:26.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/kvm/x86.c linux-2.6.32.44/arch/x86/kvm/x86.c
+--- linux-2.6.32.44/arch/x86/kvm/x86.c 2011-05-10 22:12:01.000000000 -0400
++++ linux-2.6.32.44/arch/x86/kvm/x86.c 2011-05-10 22:12:26.000000000 -0400
@@ -82,7 +82,7 @@ static void update_cr8_intercept(struct
static int kvm_dev_ioctl_get_supported_cpuid(struct kvm_cpuid2 *cpuid,
struct kvm_cpuid_entry2 __user *entries);
@@ -18682,9 +18630,9 @@ diff -urNp linux-2.6.32.43/arch/x86/kvm/x86.c linux-2.6.32.43/arch/x86/kvm/x86.c
if (kvm_x86_ops) {
printk(KERN_ERR "kvm: already loaded the other module\n");
-diff -urNp linux-2.6.32.43/arch/x86/lguest/boot.c linux-2.6.32.43/arch/x86/lguest/boot.c
---- linux-2.6.32.43/arch/x86/lguest/boot.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/lguest/boot.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/lguest/boot.c linux-2.6.32.44/arch/x86/lguest/boot.c
+--- linux-2.6.32.44/arch/x86/lguest/boot.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/lguest/boot.c 2011-08-05 20:33:55.000000000 -0400
@@ -1172,9 +1172,10 @@ static __init int early_put_chars(u32 vt
* Rebooting also tells the Host we're finished, but the RESTART flag tells the
* Launcher to reboot us.
@@ -18697,9 +18645,9 @@ diff -urNp linux-2.6.32.43/arch/x86/lguest/boot.c linux-2.6.32.43/arch/x86/lgues
}
/*G:050
-diff -urNp linux-2.6.32.43/arch/x86/lib/atomic64_32.c linux-2.6.32.43/arch/x86/lib/atomic64_32.c
---- linux-2.6.32.43/arch/x86/lib/atomic64_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/lib/atomic64_32.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/lib/atomic64_32.c linux-2.6.32.44/arch/x86/lib/atomic64_32.c
+--- linux-2.6.32.44/arch/x86/lib/atomic64_32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/lib/atomic64_32.c 2011-05-04 17:56:28.000000000 -0400
@@ -25,6 +25,12 @@ u64 atomic64_cmpxchg(atomic64_t *ptr, u6
}
EXPORT_SYMBOL(atomic64_cmpxchg);
@@ -18922,9 +18870,9 @@ diff -urNp linux-2.6.32.43/arch/x86/lib/atomic64_32.c linux-2.6.32.43/arch/x86/l
* atomic64_dec_and_test - decrement and test
* @ptr: pointer to type atomic64_t
*
-diff -urNp linux-2.6.32.43/arch/x86/lib/checksum_32.S linux-2.6.32.43/arch/x86/lib/checksum_32.S
---- linux-2.6.32.43/arch/x86/lib/checksum_32.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/lib/checksum_32.S 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/lib/checksum_32.S linux-2.6.32.44/arch/x86/lib/checksum_32.S
+--- linux-2.6.32.44/arch/x86/lib/checksum_32.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/lib/checksum_32.S 2011-04-17 15:56:46.000000000 -0400
@@ -28,7 +28,8 @@
#include <linux/linkage.h>
#include <asm/dwarf2.h>
@@ -19185,9 +19133,9 @@ diff -urNp linux-2.6.32.43/arch/x86/lib/checksum_32.S linux-2.6.32.43/arch/x86/l
#undef ROUND
#undef ROUND1
-diff -urNp linux-2.6.32.43/arch/x86/lib/clear_page_64.S linux-2.6.32.43/arch/x86/lib/clear_page_64.S
---- linux-2.6.32.43/arch/x86/lib/clear_page_64.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/lib/clear_page_64.S 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/lib/clear_page_64.S linux-2.6.32.44/arch/x86/lib/clear_page_64.S
+--- linux-2.6.32.44/arch/x86/lib/clear_page_64.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/lib/clear_page_64.S 2011-04-17 15:56:46.000000000 -0400
@@ -43,7 +43,7 @@ ENDPROC(clear_page)
#include <asm/cpufeature.h>
@@ -19197,9 +19145,9 @@ diff -urNp linux-2.6.32.43/arch/x86/lib/clear_page_64.S linux-2.6.32.43/arch/x86
1: .byte 0xeb /* jmp <disp8> */
.byte (clear_page_c - clear_page) - (2f - 1b) /* offset */
2:
-diff -urNp linux-2.6.32.43/arch/x86/lib/copy_page_64.S linux-2.6.32.43/arch/x86/lib/copy_page_64.S
---- linux-2.6.32.43/arch/x86/lib/copy_page_64.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/lib/copy_page_64.S 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/lib/copy_page_64.S linux-2.6.32.44/arch/x86/lib/copy_page_64.S
+--- linux-2.6.32.44/arch/x86/lib/copy_page_64.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/lib/copy_page_64.S 2011-04-17 15:56:46.000000000 -0400
@@ -104,7 +104,7 @@ ENDPROC(copy_page)
#include <asm/cpufeature.h>
@@ -19209,9 +19157,9 @@ diff -urNp linux-2.6.32.43/arch/x86/lib/copy_page_64.S linux-2.6.32.43/arch/x86/
1: .byte 0xeb /* jmp <disp8> */
.byte (copy_page_c - copy_page) - (2f - 1b) /* offset */
2:
-diff -urNp linux-2.6.32.43/arch/x86/lib/copy_user_64.S linux-2.6.32.43/arch/x86/lib/copy_user_64.S
---- linux-2.6.32.43/arch/x86/lib/copy_user_64.S 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/lib/copy_user_64.S 2011-06-25 12:56:37.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/lib/copy_user_64.S linux-2.6.32.44/arch/x86/lib/copy_user_64.S
+--- linux-2.6.32.44/arch/x86/lib/copy_user_64.S 2011-06-25 12:55:34.000000000 -0400
++++ linux-2.6.32.44/arch/x86/lib/copy_user_64.S 2011-06-25 12:56:37.000000000 -0400
@@ -15,13 +15,14 @@
#include <asm/asm-offsets.h>
#include <asm/thread_info.h>
@@ -19280,9 +19228,9 @@ diff -urNp linux-2.6.32.43/arch/x86/lib/copy_user_64.S linux-2.6.32.43/arch/x86/
movl %edx,%ecx
xorl %eax,%eax
rep
-diff -urNp linux-2.6.32.43/arch/x86/lib/copy_user_nocache_64.S linux-2.6.32.43/arch/x86/lib/copy_user_nocache_64.S
---- linux-2.6.32.43/arch/x86/lib/copy_user_nocache_64.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/lib/copy_user_nocache_64.S 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/lib/copy_user_nocache_64.S linux-2.6.32.44/arch/x86/lib/copy_user_nocache_64.S
+--- linux-2.6.32.44/arch/x86/lib/copy_user_nocache_64.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/lib/copy_user_nocache_64.S 2011-04-17 15:56:46.000000000 -0400
@@ -14,6 +14,7 @@
#include <asm/current.h>
#include <asm/asm-offsets.h>
@@ -19307,9 +19255,9 @@ diff -urNp linux-2.6.32.43/arch/x86/lib/copy_user_nocache_64.S linux-2.6.32.43/a
cmpl $8,%edx
jb 20f /* less then 8 bytes, go to byte copy loop */
ALIGN_DESTINATION
-diff -urNp linux-2.6.32.43/arch/x86/lib/csum-wrappers_64.c linux-2.6.32.43/arch/x86/lib/csum-wrappers_64.c
---- linux-2.6.32.43/arch/x86/lib/csum-wrappers_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/lib/csum-wrappers_64.c 2011-05-04 17:56:20.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/lib/csum-wrappers_64.c linux-2.6.32.44/arch/x86/lib/csum-wrappers_64.c
+--- linux-2.6.32.44/arch/x86/lib/csum-wrappers_64.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/lib/csum-wrappers_64.c 2011-05-04 17:56:20.000000000 -0400
@@ -52,6 +52,12 @@ csum_partial_copy_from_user(const void _
len -= 2;
}
@@ -19336,9 +19284,9 @@ diff -urNp linux-2.6.32.43/arch/x86/lib/csum-wrappers_64.c linux-2.6.32.43/arch/
return csum_partial_copy_generic(src, (void __force *)dst,
len, isum, NULL, errp);
}
-diff -urNp linux-2.6.32.43/arch/x86/lib/getuser.S linux-2.6.32.43/arch/x86/lib/getuser.S
---- linux-2.6.32.43/arch/x86/lib/getuser.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/lib/getuser.S 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/lib/getuser.S linux-2.6.32.44/arch/x86/lib/getuser.S
+--- linux-2.6.32.44/arch/x86/lib/getuser.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/lib/getuser.S 2011-04-17 15:56:46.000000000 -0400
@@ -33,14 +33,35 @@
#include <asm/asm-offsets.h>
#include <asm/thread_info.h>
@@ -19444,9 +19392,9 @@ diff -urNp linux-2.6.32.43/arch/x86/lib/getuser.S linux-2.6.32.43/arch/x86/lib/g
4: movq -7(%_ASM_AX),%_ASM_DX
xor %eax,%eax
ret
-diff -urNp linux-2.6.32.43/arch/x86/lib/memcpy_64.S linux-2.6.32.43/arch/x86/lib/memcpy_64.S
---- linux-2.6.32.43/arch/x86/lib/memcpy_64.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/lib/memcpy_64.S 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/lib/memcpy_64.S linux-2.6.32.44/arch/x86/lib/memcpy_64.S
+--- linux-2.6.32.44/arch/x86/lib/memcpy_64.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/lib/memcpy_64.S 2011-04-17 15:56:46.000000000 -0400
@@ -128,7 +128,7 @@ ENDPROC(__memcpy)
* It is also a lot simpler. Use this when possible:
*/
@@ -19456,9 +19404,9 @@ diff -urNp linux-2.6.32.43/arch/x86/lib/memcpy_64.S linux-2.6.32.43/arch/x86/lib
1: .byte 0xeb /* jmp <disp8> */
.byte (memcpy_c - memcpy) - (2f - 1b) /* offset */
2:
-diff -urNp linux-2.6.32.43/arch/x86/lib/memset_64.S linux-2.6.32.43/arch/x86/lib/memset_64.S
---- linux-2.6.32.43/arch/x86/lib/memset_64.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/lib/memset_64.S 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/lib/memset_64.S linux-2.6.32.44/arch/x86/lib/memset_64.S
+--- linux-2.6.32.44/arch/x86/lib/memset_64.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/lib/memset_64.S 2011-04-17 15:56:46.000000000 -0400
@@ -118,7 +118,7 @@ ENDPROC(__memset)
#include <asm/cpufeature.h>
@@ -19468,9 +19416,9 @@ diff -urNp linux-2.6.32.43/arch/x86/lib/memset_64.S linux-2.6.32.43/arch/x86/lib
1: .byte 0xeb /* jmp <disp8> */
.byte (memset_c - memset) - (2f - 1b) /* offset */
2:
-diff -urNp linux-2.6.32.43/arch/x86/lib/mmx_32.c linux-2.6.32.43/arch/x86/lib/mmx_32.c
---- linux-2.6.32.43/arch/x86/lib/mmx_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/lib/mmx_32.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/lib/mmx_32.c linux-2.6.32.44/arch/x86/lib/mmx_32.c
+--- linux-2.6.32.44/arch/x86/lib/mmx_32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/lib/mmx_32.c 2011-04-17 15:56:46.000000000 -0400
@@ -29,6 +29,7 @@ void *_mmx_memcpy(void *to, const void *
{
void *p;
@@ -19786,9 +19734,9 @@ diff -urNp linux-2.6.32.43/arch/x86/lib/mmx_32.c linux-2.6.32.43/arch/x86/lib/mm
from += 64;
to += 64;
-diff -urNp linux-2.6.32.43/arch/x86/lib/putuser.S linux-2.6.32.43/arch/x86/lib/putuser.S
---- linux-2.6.32.43/arch/x86/lib/putuser.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/lib/putuser.S 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/lib/putuser.S linux-2.6.32.44/arch/x86/lib/putuser.S
+--- linux-2.6.32.44/arch/x86/lib/putuser.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/lib/putuser.S 2011-04-17 15:56:46.000000000 -0400
@@ -15,7 +15,8 @@
#include <asm/thread_info.h>
#include <asm/errno.h>
@@ -19926,9 +19874,9 @@ diff -urNp linux-2.6.32.43/arch/x86/lib/putuser.S linux-2.6.32.43/arch/x86/lib/p
#endif
xor %eax,%eax
EXIT
-diff -urNp linux-2.6.32.43/arch/x86/lib/usercopy_32.c linux-2.6.32.43/arch/x86/lib/usercopy_32.c
---- linux-2.6.32.43/arch/x86/lib/usercopy_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/lib/usercopy_32.c 2011-04-23 21:12:28.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/lib/usercopy_32.c linux-2.6.32.44/arch/x86/lib/usercopy_32.c
+--- linux-2.6.32.44/arch/x86/lib/usercopy_32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/lib/usercopy_32.c 2011-04-23 21:12:28.000000000 -0400
@@ -43,7 +43,7 @@ do { \
__asm__ __volatile__( \
" testl %1,%1\n" \
@@ -20534,9 +20482,9 @@ diff -urNp linux-2.6.32.43/arch/x86/lib/usercopy_32.c linux-2.6.32.43/arch/x86/l
-EXPORT_SYMBOL(copy_from_user);
+EXPORT_SYMBOL(set_fs);
+#endif
-diff -urNp linux-2.6.32.43/arch/x86/lib/usercopy_64.c linux-2.6.32.43/arch/x86/lib/usercopy_64.c
---- linux-2.6.32.43/arch/x86/lib/usercopy_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/lib/usercopy_64.c 2011-05-04 17:56:20.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/lib/usercopy_64.c linux-2.6.32.44/arch/x86/lib/usercopy_64.c
+--- linux-2.6.32.44/arch/x86/lib/usercopy_64.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/lib/usercopy_64.c 2011-05-04 17:56:20.000000000 -0400
@@ -42,6 +42,12 @@ long
__strncpy_from_user(char *dst, const char __user *src, long count)
{
@@ -20585,9 +20533,9 @@ diff -urNp linux-2.6.32.43/arch/x86/lib/usercopy_64.c linux-2.6.32.43/arch/x86/l
}
EXPORT_SYMBOL(copy_in_user);
-diff -urNp linux-2.6.32.43/arch/x86/Makefile linux-2.6.32.43/arch/x86/Makefile
---- linux-2.6.32.43/arch/x86/Makefile 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/Makefile 2011-07-19 18:16:02.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/Makefile linux-2.6.32.44/arch/x86/Makefile
+--- linux-2.6.32.44/arch/x86/Makefile 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/Makefile 2011-07-19 18:16:02.000000000 -0400
@@ -44,6 +44,7 @@ ifeq ($(CONFIG_X86_32),y)
else
BITS := 64
@@ -20609,9 +20557,9 @@ diff -urNp linux-2.6.32.43/arch/x86/Makefile linux-2.6.32.43/arch/x86/Makefile
+
+archprepare:
+ $(if $(LDFLAGS_BUILD_ID),,$(error $(OLD_LD)))
-diff -urNp linux-2.6.32.43/arch/x86/mm/extable.c linux-2.6.32.43/arch/x86/mm/extable.c
---- linux-2.6.32.43/arch/x86/mm/extable.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/mm/extable.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/mm/extable.c linux-2.6.32.44/arch/x86/mm/extable.c
+--- linux-2.6.32.44/arch/x86/mm/extable.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/mm/extable.c 2011-04-17 15:56:46.000000000 -0400
@@ -1,14 +1,71 @@
#include <linux/module.h>
#include <linux/spinlock.h>
@@ -20685,9 +20633,9 @@ diff -urNp linux-2.6.32.43/arch/x86/mm/extable.c linux-2.6.32.43/arch/x86/mm/ext
extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp;
extern u32 pnp_bios_is_utter_crap;
pnp_bios_is_utter_crap = 1;
-diff -urNp linux-2.6.32.43/arch/x86/mm/fault.c linux-2.6.32.43/arch/x86/mm/fault.c
---- linux-2.6.32.43/arch/x86/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/mm/fault.c 2011-06-06 17:35:16.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/mm/fault.c linux-2.6.32.44/arch/x86/mm/fault.c
+--- linux-2.6.32.44/arch/x86/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/mm/fault.c 2011-06-06 17:35:16.000000000 -0400
@@ -11,10 +11,19 @@
#include <linux/kprobes.h> /* __kprobes, ... */
#include <linux/mmiotrace.h> /* kmmio_handler, ... */
@@ -21372,9 +21320,9 @@ diff -urNp linux-2.6.32.43/arch/x86/mm/fault.c linux-2.6.32.43/arch/x86/mm/fault
+
+ return ret ? -EFAULT : 0;
+}
-diff -urNp linux-2.6.32.43/arch/x86/mm/gup.c linux-2.6.32.43/arch/x86/mm/gup.c
---- linux-2.6.32.43/arch/x86/mm/gup.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/mm/gup.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/mm/gup.c linux-2.6.32.44/arch/x86/mm/gup.c
+--- linux-2.6.32.44/arch/x86/mm/gup.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/mm/gup.c 2011-04-17 15:56:46.000000000 -0400
@@ -237,7 +237,7 @@ int __get_user_pages_fast(unsigned long
addr = start;
len = (unsigned long) nr_pages << PAGE_SHIFT;
@@ -21384,9 +21332,9 @@ diff -urNp linux-2.6.32.43/arch/x86/mm/gup.c linux-2.6.32.43/arch/x86/mm/gup.c
(void __user *)start, len)))
return 0;
-diff -urNp linux-2.6.32.43/arch/x86/mm/highmem_32.c linux-2.6.32.43/arch/x86/mm/highmem_32.c
---- linux-2.6.32.43/arch/x86/mm/highmem_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/mm/highmem_32.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/mm/highmem_32.c linux-2.6.32.44/arch/x86/mm/highmem_32.c
+--- linux-2.6.32.44/arch/x86/mm/highmem_32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/mm/highmem_32.c 2011-04-17 15:56:46.000000000 -0400
@@ -43,7 +43,10 @@ void *kmap_atomic_prot(struct page *page
idx = type + KM_TYPE_NR*smp_processor_id();
vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
@@ -21398,9 +21346,9 @@ diff -urNp linux-2.6.32.43/arch/x86/mm/highmem_32.c linux-2.6.32.43/arch/x86/mm/
return (void *)vaddr;
}
-diff -urNp linux-2.6.32.43/arch/x86/mm/hugetlbpage.c linux-2.6.32.43/arch/x86/mm/hugetlbpage.c
---- linux-2.6.32.43/arch/x86/mm/hugetlbpage.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/mm/hugetlbpage.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/mm/hugetlbpage.c linux-2.6.32.44/arch/x86/mm/hugetlbpage.c
+--- linux-2.6.32.44/arch/x86/mm/hugetlbpage.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/mm/hugetlbpage.c 2011-04-17 15:56:46.000000000 -0400
@@ -267,13 +267,20 @@ static unsigned long hugetlb_get_unmappe
struct hstate *h = hstate_file(file);
struct mm_struct *mm = current->mm;
@@ -21608,9 +21556,9 @@ diff -urNp linux-2.6.32.43/arch/x86/mm/hugetlbpage.c linux-2.6.32.43/arch/x86/mm
return addr;
}
if (mm->get_unmapped_area == arch_get_unmapped_area)
-diff -urNp linux-2.6.32.43/arch/x86/mm/init_32.c linux-2.6.32.43/arch/x86/mm/init_32.c
---- linux-2.6.32.43/arch/x86/mm/init_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/mm/init_32.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/mm/init_32.c linux-2.6.32.44/arch/x86/mm/init_32.c
+--- linux-2.6.32.44/arch/x86/mm/init_32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/mm/init_32.c 2011-04-17 15:56:46.000000000 -0400
@@ -72,36 +72,6 @@ static __init void *alloc_low_page(void)
}
@@ -21914,9 +21862,9 @@ diff -urNp linux-2.6.32.43/arch/x86/mm/init_32.c linux-2.6.32.43/arch/x86/mm/ini
set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT);
printk(KERN_INFO "Write protecting the kernel text: %luk\n",
size >> 10);
-diff -urNp linux-2.6.32.43/arch/x86/mm/init_64.c linux-2.6.32.43/arch/x86/mm/init_64.c
---- linux-2.6.32.43/arch/x86/mm/init_64.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/mm/init_64.c 2011-04-17 17:03:05.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/mm/init_64.c linux-2.6.32.44/arch/x86/mm/init_64.c
+--- linux-2.6.32.44/arch/x86/mm/init_64.c 2011-04-17 17:00:52.000000000 -0400
++++ linux-2.6.32.44/arch/x86/mm/init_64.c 2011-04-17 17:03:05.000000000 -0400
@@ -164,7 +164,9 @@ void set_pte_vaddr_pud(pud_t *pud_page,
pmd = fill_pmd(pud, vaddr);
pte = fill_pte(pmd, vaddr);
@@ -21977,9 +21925,9 @@ diff -urNp linux-2.6.32.43/arch/x86/mm/init_64.c linux-2.6.32.43/arch/x86/mm/ini
return "[vdso]";
if (vma == &gate_vma)
return "[vsyscall]";
-diff -urNp linux-2.6.32.43/arch/x86/mm/init.c linux-2.6.32.43/arch/x86/mm/init.c
---- linux-2.6.32.43/arch/x86/mm/init.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/mm/init.c 2011-06-07 19:06:09.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/mm/init.c linux-2.6.32.44/arch/x86/mm/init.c
+--- linux-2.6.32.44/arch/x86/mm/init.c 2011-04-17 17:00:52.000000000 -0400
++++ linux-2.6.32.44/arch/x86/mm/init.c 2011-06-07 19:06:09.000000000 -0400
@@ -69,11 +69,7 @@ static void __init find_early_table_spac
* cause a hotspot and fill up ZONE_DMA. The page tables
* need roughly 0.5KB per GB.
@@ -22117,9 +22065,9 @@ diff -urNp linux-2.6.32.43/arch/x86/mm/init.c linux-2.6.32.43/arch/x86/mm/init.c
free_init_pages("unused kernel memory",
(unsigned long)(&__init_begin),
(unsigned long)(&__init_end));
-diff -urNp linux-2.6.32.43/arch/x86/mm/iomap_32.c linux-2.6.32.43/arch/x86/mm/iomap_32.c
---- linux-2.6.32.43/arch/x86/mm/iomap_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/mm/iomap_32.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/mm/iomap_32.c linux-2.6.32.44/arch/x86/mm/iomap_32.c
+--- linux-2.6.32.44/arch/x86/mm/iomap_32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/mm/iomap_32.c 2011-04-17 15:56:46.000000000 -0400
@@ -65,7 +65,11 @@ void *kmap_atomic_prot_pfn(unsigned long
debug_kmap_atomic(type);
idx = type + KM_TYPE_NR * smp_processor_id();
@@ -22132,9 +22080,9 @@ diff -urNp linux-2.6.32.43/arch/x86/mm/iomap_32.c linux-2.6.32.43/arch/x86/mm/io
arch_flush_lazy_mmu_mode();
return (void *)vaddr;
-diff -urNp linux-2.6.32.43/arch/x86/mm/ioremap.c linux-2.6.32.43/arch/x86/mm/ioremap.c
---- linux-2.6.32.43/arch/x86/mm/ioremap.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/mm/ioremap.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/mm/ioremap.c linux-2.6.32.44/arch/x86/mm/ioremap.c
+--- linux-2.6.32.44/arch/x86/mm/ioremap.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/mm/ioremap.c 2011-04-17 15:56:46.000000000 -0400
@@ -41,8 +41,8 @@ int page_is_ram(unsigned long pagenr)
* Second special case: Some BIOSen report the PC BIOS
* area (640->1Mb) as ram even though it is not.
@@ -22181,9 +22129,9 @@ diff -urNp linux-2.6.32.43/arch/x86/mm/ioremap.c linux-2.6.32.43/arch/x86/mm/ior
/*
* The boot-ioremap range spans multiple pmds, for which
-diff -urNp linux-2.6.32.43/arch/x86/mm/kmemcheck/kmemcheck.c linux-2.6.32.43/arch/x86/mm/kmemcheck/kmemcheck.c
---- linux-2.6.32.43/arch/x86/mm/kmemcheck/kmemcheck.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/mm/kmemcheck/kmemcheck.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/mm/kmemcheck/kmemcheck.c linux-2.6.32.44/arch/x86/mm/kmemcheck/kmemcheck.c
+--- linux-2.6.32.44/arch/x86/mm/kmemcheck/kmemcheck.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/mm/kmemcheck/kmemcheck.c 2011-04-17 15:56:46.000000000 -0400
@@ -622,9 +622,9 @@ bool kmemcheck_fault(struct pt_regs *reg
* memory (e.g. tracked pages)? For now, we need this to avoid
* invoking kmemcheck for PnP BIOS calls.
@@ -22196,9 +22144,9 @@ diff -urNp linux-2.6.32.43/arch/x86/mm/kmemcheck/kmemcheck.c linux-2.6.32.43/arc
return false;
pte = kmemcheck_pte_lookup(address);
-diff -urNp linux-2.6.32.43/arch/x86/mm/mmap.c linux-2.6.32.43/arch/x86/mm/mmap.c
---- linux-2.6.32.43/arch/x86/mm/mmap.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/mm/mmap.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/mm/mmap.c linux-2.6.32.44/arch/x86/mm/mmap.c
+--- linux-2.6.32.44/arch/x86/mm/mmap.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/mm/mmap.c 2011-04-17 15:56:46.000000000 -0400
@@ -49,7 +49,7 @@ static unsigned int stack_maxrandom_size
* Leave an at least ~128 MB hole with possible stack randomization.
*/
@@ -22280,9 +22228,9 @@ diff -urNp linux-2.6.32.43/arch/x86/mm/mmap.c linux-2.6.32.43/arch/x86/mm/mmap.c
mm->get_unmapped_area = arch_get_unmapped_area_topdown;
mm->unmap_area = arch_unmap_area_topdown;
}
-diff -urNp linux-2.6.32.43/arch/x86/mm/mmio-mod.c linux-2.6.32.43/arch/x86/mm/mmio-mod.c
---- linux-2.6.32.43/arch/x86/mm/mmio-mod.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/mm/mmio-mod.c 2011-07-06 19:53:33.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/mm/mmio-mod.c linux-2.6.32.44/arch/x86/mm/mmio-mod.c
+--- linux-2.6.32.44/arch/x86/mm/mmio-mod.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/mm/mmio-mod.c 2011-07-06 19:53:33.000000000 -0400
@@ -193,7 +193,7 @@ static void pre(struct kmmio_probe *p, s
break;
default:
@@ -22310,9 +22258,9 @@ diff -urNp linux-2.6.32.43/arch/x86/mm/mmio-mod.c linux-2.6.32.43/arch/x86/mm/mm
};
map.map_id = trace->id;
-diff -urNp linux-2.6.32.43/arch/x86/mm/numa_32.c linux-2.6.32.43/arch/x86/mm/numa_32.c
---- linux-2.6.32.43/arch/x86/mm/numa_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/mm/numa_32.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/mm/numa_32.c linux-2.6.32.44/arch/x86/mm/numa_32.c
+--- linux-2.6.32.44/arch/x86/mm/numa_32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/mm/numa_32.c 2011-04-17 15:56:46.000000000 -0400
@@ -98,7 +98,6 @@ unsigned long node_memmap_size_bytes(int
}
#endif
@@ -22321,9 +22269,9 @@ diff -urNp linux-2.6.32.43/arch/x86/mm/numa_32.c linux-2.6.32.43/arch/x86/mm/num
extern unsigned long highend_pfn, highstart_pfn;
#define LARGE_PAGE_BYTES (PTRS_PER_PTE * PAGE_SIZE)
-diff -urNp linux-2.6.32.43/arch/x86/mm/pageattr.c linux-2.6.32.43/arch/x86/mm/pageattr.c
---- linux-2.6.32.43/arch/x86/mm/pageattr.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/mm/pageattr.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/mm/pageattr.c linux-2.6.32.44/arch/x86/mm/pageattr.c
+--- linux-2.6.32.44/arch/x86/mm/pageattr.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/mm/pageattr.c 2011-04-17 15:56:46.000000000 -0400
@@ -261,16 +261,17 @@ static inline pgprot_t static_protection
* PCI BIOS based config access (CONFIG_PCI_GOBIOS) support.
*/
@@ -22400,9 +22348,9 @@ diff -urNp linux-2.6.32.43/arch/x86/mm/pageattr.c linux-2.6.32.43/arch/x86/mm/pa
}
static int
-diff -urNp linux-2.6.32.43/arch/x86/mm/pageattr-test.c linux-2.6.32.43/arch/x86/mm/pageattr-test.c
---- linux-2.6.32.43/arch/x86/mm/pageattr-test.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/mm/pageattr-test.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/mm/pageattr-test.c linux-2.6.32.44/arch/x86/mm/pageattr-test.c
+--- linux-2.6.32.44/arch/x86/mm/pageattr-test.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/mm/pageattr-test.c 2011-04-17 15:56:46.000000000 -0400
@@ -36,7 +36,7 @@ enum {
static int pte_testbit(pte_t pte)
@@ -22412,9 +22360,9 @@ diff -urNp linux-2.6.32.43/arch/x86/mm/pageattr-test.c linux-2.6.32.43/arch/x86/
}
struct split_state {
-diff -urNp linux-2.6.32.43/arch/x86/mm/pat.c linux-2.6.32.43/arch/x86/mm/pat.c
---- linux-2.6.32.43/arch/x86/mm/pat.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/mm/pat.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/mm/pat.c linux-2.6.32.44/arch/x86/mm/pat.c
+--- linux-2.6.32.44/arch/x86/mm/pat.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/mm/pat.c 2011-04-17 15:56:46.000000000 -0400
@@ -258,7 +258,7 @@ chk_conflict(struct memtype *new, struct
conflict:
@@ -22462,9 +22410,9 @@ diff -urNp linux-2.6.32.43/arch/x86/mm/pat.c linux-2.6.32.43/arch/x86/mm/pat.c
cattr_name(want_flags),
(unsigned long long)paddr,
(unsigned long long)(paddr + size),
-diff -urNp linux-2.6.32.43/arch/x86/mm/pf_in.c linux-2.6.32.43/arch/x86/mm/pf_in.c
---- linux-2.6.32.43/arch/x86/mm/pf_in.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/mm/pf_in.c 2011-07-06 19:53:33.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/mm/pf_in.c linux-2.6.32.44/arch/x86/mm/pf_in.c
+--- linux-2.6.32.44/arch/x86/mm/pf_in.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/mm/pf_in.c 2011-07-06 19:53:33.000000000 -0400
@@ -148,7 +148,7 @@ enum reason_type get_ins_type(unsigned l
int i;
enum reason_type rv = OTHERS;
@@ -22510,9 +22458,9 @@ diff -urNp linux-2.6.32.43/arch/x86/mm/pf_in.c linux-2.6.32.43/arch/x86/mm/pf_in
p += skip_prefix(p, &prf);
p += get_opcode(p, &opcode);
for (i = 0; i < ARRAY_SIZE(imm_wop); i++)
-diff -urNp linux-2.6.32.43/arch/x86/mm/pgtable_32.c linux-2.6.32.43/arch/x86/mm/pgtable_32.c
---- linux-2.6.32.43/arch/x86/mm/pgtable_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/mm/pgtable_32.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/mm/pgtable_32.c linux-2.6.32.44/arch/x86/mm/pgtable_32.c
+--- linux-2.6.32.44/arch/x86/mm/pgtable_32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/mm/pgtable_32.c 2011-04-17 15:56:46.000000000 -0400
@@ -49,10 +49,13 @@ void set_pte_vaddr(unsigned long vaddr,
return;
}
@@ -22527,9 +22475,9 @@ diff -urNp linux-2.6.32.43/arch/x86/mm/pgtable_32.c linux-2.6.32.43/arch/x86/mm/
/*
* It's enough to flush this one mapping.
-diff -urNp linux-2.6.32.43/arch/x86/mm/pgtable.c linux-2.6.32.43/arch/x86/mm/pgtable.c
---- linux-2.6.32.43/arch/x86/mm/pgtable.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/mm/pgtable.c 2011-05-11 18:25:15.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/mm/pgtable.c linux-2.6.32.44/arch/x86/mm/pgtable.c
+--- linux-2.6.32.44/arch/x86/mm/pgtable.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/mm/pgtable.c 2011-05-11 18:25:15.000000000 -0400
@@ -83,9 +83,52 @@ static inline void pgd_list_del(pgd_t *p
list_del(&page->lru);
}
@@ -22776,9 +22724,9 @@ diff -urNp linux-2.6.32.43/arch/x86/mm/pgtable.c linux-2.6.32.43/arch/x86/mm/pgt
pgd_dtor(pgd);
paravirt_pgd_free(mm, pgd);
free_page((unsigned long)pgd);
-diff -urNp linux-2.6.32.43/arch/x86/mm/setup_nx.c linux-2.6.32.43/arch/x86/mm/setup_nx.c
---- linux-2.6.32.43/arch/x86/mm/setup_nx.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/mm/setup_nx.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/mm/setup_nx.c linux-2.6.32.44/arch/x86/mm/setup_nx.c
+--- linux-2.6.32.44/arch/x86/mm/setup_nx.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/mm/setup_nx.c 2011-04-17 15:56:46.000000000 -0400
@@ -4,11 +4,10 @@
#include <asm/pgtable.h>
@@ -22844,9 +22792,9 @@ diff -urNp linux-2.6.32.43/arch/x86/mm/setup_nx.c linux-2.6.32.43/arch/x86/mm/se
__supported_pte_mask &= ~_PAGE_NX;
}
#endif
-diff -urNp linux-2.6.32.43/arch/x86/mm/tlb.c linux-2.6.32.43/arch/x86/mm/tlb.c
---- linux-2.6.32.43/arch/x86/mm/tlb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/mm/tlb.c 2011-04-23 12:56:10.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/mm/tlb.c linux-2.6.32.44/arch/x86/mm/tlb.c
+--- linux-2.6.32.44/arch/x86/mm/tlb.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/mm/tlb.c 2011-04-23 12:56:10.000000000 -0400
@@ -61,7 +61,11 @@ void leave_mm(int cpu)
BUG();
cpumask_clear_cpu(cpu,
@@ -22859,9 +22807,9 @@ diff -urNp linux-2.6.32.43/arch/x86/mm/tlb.c linux-2.6.32.43/arch/x86/mm/tlb.c
}
EXPORT_SYMBOL_GPL(leave_mm);
-diff -urNp linux-2.6.32.43/arch/x86/oprofile/backtrace.c linux-2.6.32.43/arch/x86/oprofile/backtrace.c
---- linux-2.6.32.43/arch/x86/oprofile/backtrace.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/oprofile/backtrace.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/oprofile/backtrace.c linux-2.6.32.44/arch/x86/oprofile/backtrace.c
+--- linux-2.6.32.44/arch/x86/oprofile/backtrace.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/oprofile/backtrace.c 2011-04-17 15:56:46.000000000 -0400
@@ -57,7 +57,7 @@ static struct frame_head *dump_user_back
struct frame_head bufhead[2];
@@ -22880,9 +22828,9 @@ diff -urNp linux-2.6.32.43/arch/x86/oprofile/backtrace.c linux-2.6.32.43/arch/x8
unsigned long stack = kernel_stack_pointer(regs);
if (depth)
dump_trace(NULL, regs, (unsigned long *)stack, 0,
-diff -urNp linux-2.6.32.43/arch/x86/oprofile/op_model_p4.c linux-2.6.32.43/arch/x86/oprofile/op_model_p4.c
---- linux-2.6.32.43/arch/x86/oprofile/op_model_p4.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/oprofile/op_model_p4.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/oprofile/op_model_p4.c linux-2.6.32.44/arch/x86/oprofile/op_model_p4.c
+--- linux-2.6.32.44/arch/x86/oprofile/op_model_p4.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/oprofile/op_model_p4.c 2011-04-17 15:56:46.000000000 -0400
@@ -50,7 +50,7 @@ static inline void setup_num_counters(vo
#endif
}
@@ -22892,9 +22840,9 @@ diff -urNp linux-2.6.32.43/arch/x86/oprofile/op_model_p4.c linux-2.6.32.43/arch/
{
#ifdef CONFIG_SMP
return smp_num_siblings == 2 ? 2 : 1;
-diff -urNp linux-2.6.32.43/arch/x86/pci/common.c linux-2.6.32.43/arch/x86/pci/common.c
---- linux-2.6.32.43/arch/x86/pci/common.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/pci/common.c 2011-04-23 12:56:10.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/pci/common.c linux-2.6.32.44/arch/x86/pci/common.c
+--- linux-2.6.32.44/arch/x86/pci/common.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/pci/common.c 2011-04-23 12:56:10.000000000 -0400
@@ -31,8 +31,8 @@ int noioapicreroute = 1;
int pcibios_last_bus = -1;
unsigned long pirq_table_addr;
@@ -22906,9 +22854,9 @@ diff -urNp linux-2.6.32.43/arch/x86/pci/common.c linux-2.6.32.43/arch/x86/pci/co
int raw_pci_read(unsigned int domain, unsigned int bus, unsigned int devfn,
int reg, int len, u32 *val)
-diff -urNp linux-2.6.32.43/arch/x86/pci/direct.c linux-2.6.32.43/arch/x86/pci/direct.c
---- linux-2.6.32.43/arch/x86/pci/direct.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/pci/direct.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/pci/direct.c linux-2.6.32.44/arch/x86/pci/direct.c
+--- linux-2.6.32.44/arch/x86/pci/direct.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/pci/direct.c 2011-04-17 15:56:46.000000000 -0400
@@ -79,7 +79,7 @@ static int pci_conf1_write(unsigned int
#undef PCI_CONF1_ADDRESS
@@ -22936,9 +22884,9 @@ diff -urNp linux-2.6.32.43/arch/x86/pci/direct.c linux-2.6.32.43/arch/x86/pci/di
{
u32 x = 0;
int year, devfn;
-diff -urNp linux-2.6.32.43/arch/x86/pci/mmconfig_32.c linux-2.6.32.43/arch/x86/pci/mmconfig_32.c
---- linux-2.6.32.43/arch/x86/pci/mmconfig_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/pci/mmconfig_32.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/pci/mmconfig_32.c linux-2.6.32.44/arch/x86/pci/mmconfig_32.c
+--- linux-2.6.32.44/arch/x86/pci/mmconfig_32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/pci/mmconfig_32.c 2011-04-17 15:56:46.000000000 -0400
@@ -125,7 +125,7 @@ static int pci_mmcfg_write(unsigned int
return 0;
}
@@ -22948,9 +22896,9 @@ diff -urNp linux-2.6.32.43/arch/x86/pci/mmconfig_32.c linux-2.6.32.43/arch/x86/p
.read = pci_mmcfg_read,
.write = pci_mmcfg_write,
};
-diff -urNp linux-2.6.32.43/arch/x86/pci/mmconfig_64.c linux-2.6.32.43/arch/x86/pci/mmconfig_64.c
---- linux-2.6.32.43/arch/x86/pci/mmconfig_64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/pci/mmconfig_64.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/pci/mmconfig_64.c linux-2.6.32.44/arch/x86/pci/mmconfig_64.c
+--- linux-2.6.32.44/arch/x86/pci/mmconfig_64.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/pci/mmconfig_64.c 2011-04-17 15:56:46.000000000 -0400
@@ -104,7 +104,7 @@ static int pci_mmcfg_write(unsigned int
return 0;
}
@@ -22960,9 +22908,9 @@ diff -urNp linux-2.6.32.43/arch/x86/pci/mmconfig_64.c linux-2.6.32.43/arch/x86/p
.read = pci_mmcfg_read,
.write = pci_mmcfg_write,
};
-diff -urNp linux-2.6.32.43/arch/x86/pci/numaq_32.c linux-2.6.32.43/arch/x86/pci/numaq_32.c
---- linux-2.6.32.43/arch/x86/pci/numaq_32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/pci/numaq_32.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/pci/numaq_32.c linux-2.6.32.44/arch/x86/pci/numaq_32.c
+--- linux-2.6.32.44/arch/x86/pci/numaq_32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/pci/numaq_32.c 2011-04-17 15:56:46.000000000 -0400
@@ -112,7 +112,7 @@ static int pci_conf1_mq_write(unsigned i
#undef PCI_CONF1_MQ_ADDRESS
@@ -22972,9 +22920,9 @@ diff -urNp linux-2.6.32.43/arch/x86/pci/numaq_32.c linux-2.6.32.43/arch/x86/pci/
.read = pci_conf1_mq_read,
.write = pci_conf1_mq_write
};
-diff -urNp linux-2.6.32.43/arch/x86/pci/olpc.c linux-2.6.32.43/arch/x86/pci/olpc.c
---- linux-2.6.32.43/arch/x86/pci/olpc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/pci/olpc.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/pci/olpc.c linux-2.6.32.44/arch/x86/pci/olpc.c
+--- linux-2.6.32.44/arch/x86/pci/olpc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/pci/olpc.c 2011-04-17 15:56:46.000000000 -0400
@@ -297,7 +297,7 @@ static int pci_olpc_write(unsigned int s
return 0;
}
@@ -22984,9 +22932,9 @@ diff -urNp linux-2.6.32.43/arch/x86/pci/olpc.c linux-2.6.32.43/arch/x86/pci/olpc
.read = pci_olpc_read,
.write = pci_olpc_write,
};
-diff -urNp linux-2.6.32.43/arch/x86/pci/pcbios.c linux-2.6.32.43/arch/x86/pci/pcbios.c
---- linux-2.6.32.43/arch/x86/pci/pcbios.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/pci/pcbios.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/pci/pcbios.c linux-2.6.32.44/arch/x86/pci/pcbios.c
+--- linux-2.6.32.44/arch/x86/pci/pcbios.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/pci/pcbios.c 2011-04-17 15:56:46.000000000 -0400
@@ -56,50 +56,93 @@ union bios32 {
static struct {
unsigned long address;
@@ -23309,9 +23257,9 @@ diff -urNp linux-2.6.32.43/arch/x86/pci/pcbios.c linux-2.6.32.43/arch/x86/pci/pc
return !(ret & 0xff00);
}
EXPORT_SYMBOL(pcibios_set_irq_routing);
-diff -urNp linux-2.6.32.43/arch/x86/power/cpu.c linux-2.6.32.43/arch/x86/power/cpu.c
---- linux-2.6.32.43/arch/x86/power/cpu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/power/cpu.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/power/cpu.c linux-2.6.32.44/arch/x86/power/cpu.c
+--- linux-2.6.32.44/arch/x86/power/cpu.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/power/cpu.c 2011-04-17 15:56:46.000000000 -0400
@@ -129,7 +129,7 @@ static void do_fpu_end(void)
static void fix_processor_context(void)
{
@@ -23331,9 +23279,9 @@ diff -urNp linux-2.6.32.43/arch/x86/power/cpu.c linux-2.6.32.43/arch/x86/power/c
syscall_init(); /* This sets MSR_*STAR and related */
#endif
-diff -urNp linux-2.6.32.43/arch/x86/vdso/Makefile linux-2.6.32.43/arch/x86/vdso/Makefile
---- linux-2.6.32.43/arch/x86/vdso/Makefile 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/vdso/Makefile 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/vdso/Makefile linux-2.6.32.44/arch/x86/vdso/Makefile
+--- linux-2.6.32.44/arch/x86/vdso/Makefile 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/vdso/Makefile 2011-04-17 15:56:46.000000000 -0400
@@ -122,7 +122,7 @@ quiet_cmd_vdso = VDSO $@
$(VDSO_LDFLAGS) $(VDSO_LDFLAGS_$(filter %.lds,$(^F))) \
-Wl,-T,$(filter %.lds,$^) $(filter %.o,$^)
@@ -23343,9 +23291,9 @@ diff -urNp linux-2.6.32.43/arch/x86/vdso/Makefile linux-2.6.32.43/arch/x86/vdso/
GCOV_PROFILE := n
#
-diff -urNp linux-2.6.32.43/arch/x86/vdso/vclock_gettime.c linux-2.6.32.43/arch/x86/vdso/vclock_gettime.c
---- linux-2.6.32.43/arch/x86/vdso/vclock_gettime.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/vdso/vclock_gettime.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/vdso/vclock_gettime.c linux-2.6.32.44/arch/x86/vdso/vclock_gettime.c
+--- linux-2.6.32.44/arch/x86/vdso/vclock_gettime.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/vdso/vclock_gettime.c 2011-04-17 15:56:46.000000000 -0400
@@ -22,24 +22,48 @@
#include <asm/hpet.h>
#include <asm/unistd.h>
@@ -23444,9 +23392,9 @@ diff -urNp linux-2.6.32.43/arch/x86/vdso/vclock_gettime.c linux-2.6.32.43/arch/x
}
int gettimeofday(struct timeval *, struct timezone *)
__attribute__((weak, alias("__vdso_gettimeofday")));
-diff -urNp linux-2.6.32.43/arch/x86/vdso/vdso32-setup.c linux-2.6.32.43/arch/x86/vdso/vdso32-setup.c
---- linux-2.6.32.43/arch/x86/vdso/vdso32-setup.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/vdso/vdso32-setup.c 2011-04-23 12:56:10.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/vdso/vdso32-setup.c linux-2.6.32.44/arch/x86/vdso/vdso32-setup.c
+--- linux-2.6.32.44/arch/x86/vdso/vdso32-setup.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/vdso/vdso32-setup.c 2011-04-23 12:56:10.000000000 -0400
@@ -25,6 +25,7 @@
#include <asm/tlbflush.h>
#include <asm/vdso.h>
@@ -23529,9 +23477,9 @@ diff -urNp linux-2.6.32.43/arch/x86/vdso/vdso32-setup.c linux-2.6.32.43/arch/x86
return &gate_vma;
return NULL;
}
-diff -urNp linux-2.6.32.43/arch/x86/vdso/vdso.lds.S linux-2.6.32.43/arch/x86/vdso/vdso.lds.S
---- linux-2.6.32.43/arch/x86/vdso/vdso.lds.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/vdso/vdso.lds.S 2011-06-06 17:35:35.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/vdso/vdso.lds.S linux-2.6.32.44/arch/x86/vdso/vdso.lds.S
+--- linux-2.6.32.44/arch/x86/vdso/vdso.lds.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/vdso/vdso.lds.S 2011-06-06 17:35:35.000000000 -0400
@@ -35,3 +35,9 @@ VDSO64_PRELINK = VDSO_PRELINK;
#define VEXTERN(x) VDSO64_ ## x = vdso_ ## x;
#include "vextern.h"
@@ -23542,9 +23490,9 @@ diff -urNp linux-2.6.32.43/arch/x86/vdso/vdso.lds.S linux-2.6.32.43/arch/x86/vds
+VEXTERN(fallback_time)
+VEXTERN(getcpu)
+#undef VEXTERN
-diff -urNp linux-2.6.32.43/arch/x86/vdso/vextern.h linux-2.6.32.43/arch/x86/vdso/vextern.h
---- linux-2.6.32.43/arch/x86/vdso/vextern.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/vdso/vextern.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/vdso/vextern.h linux-2.6.32.44/arch/x86/vdso/vextern.h
+--- linux-2.6.32.44/arch/x86/vdso/vextern.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/vdso/vextern.h 2011-04-17 15:56:46.000000000 -0400
@@ -11,6 +11,5 @@
put into vextern.h and be referenced as a pointer with vdso prefix.
The main kernel later fills in the values. */
@@ -23552,9 +23500,9 @@ diff -urNp linux-2.6.32.43/arch/x86/vdso/vextern.h linux-2.6.32.43/arch/x86/vdso
-VEXTERN(jiffies)
VEXTERN(vgetcpu_mode)
VEXTERN(vsyscall_gtod_data)
-diff -urNp linux-2.6.32.43/arch/x86/vdso/vma.c linux-2.6.32.43/arch/x86/vdso/vma.c
---- linux-2.6.32.43/arch/x86/vdso/vma.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/vdso/vma.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/vdso/vma.c linux-2.6.32.44/arch/x86/vdso/vma.c
+--- linux-2.6.32.44/arch/x86/vdso/vma.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/vdso/vma.c 2011-04-17 15:56:46.000000000 -0400
@@ -57,7 +57,7 @@ static int __init init_vdso_vars(void)
if (!vbase)
goto oom;
@@ -23601,9 +23549,9 @@ diff -urNp linux-2.6.32.43/arch/x86/vdso/vma.c linux-2.6.32.43/arch/x86/vdso/vma
- return 0;
-}
-__setup("vdso=", vdso_setup);
-diff -urNp linux-2.6.32.43/arch/x86/xen/enlighten.c linux-2.6.32.43/arch/x86/xen/enlighten.c
---- linux-2.6.32.43/arch/x86/xen/enlighten.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/xen/enlighten.c 2011-05-22 23:02:03.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/xen/enlighten.c linux-2.6.32.44/arch/x86/xen/enlighten.c
+--- linux-2.6.32.44/arch/x86/xen/enlighten.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/xen/enlighten.c 2011-05-22 23:02:03.000000000 -0400
@@ -71,8 +71,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
struct shared_info xen_dummy_shared_info;
@@ -23689,9 +23637,9 @@ diff -urNp linux-2.6.32.43/arch/x86/xen/enlighten.c linux-2.6.32.43/arch/x86/xen
xen_smp_init();
pgd = (pgd_t *)xen_start_info->pt_base;
-diff -urNp linux-2.6.32.43/arch/x86/xen/mmu.c linux-2.6.32.43/arch/x86/xen/mmu.c
---- linux-2.6.32.43/arch/x86/xen/mmu.c 2011-07-13 17:23:04.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/xen/mmu.c 2011-07-13 17:23:18.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/xen/mmu.c linux-2.6.32.44/arch/x86/xen/mmu.c
+--- linux-2.6.32.44/arch/x86/xen/mmu.c 2011-07-13 17:23:04.000000000 -0400
++++ linux-2.6.32.44/arch/x86/xen/mmu.c 2011-07-13 17:23:18.000000000 -0400
@@ -1719,6 +1719,8 @@ __init pgd_t *xen_setup_kernel_pagetable
convert_pfn_mfn(init_level4_pgt);
convert_pfn_mfn(level3_ident_pgt);
@@ -23712,9 +23660,9 @@ diff -urNp linux-2.6.32.43/arch/x86/xen/mmu.c linux-2.6.32.43/arch/x86/xen/mmu.c
set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
-diff -urNp linux-2.6.32.43/arch/x86/xen/smp.c linux-2.6.32.43/arch/x86/xen/smp.c
---- linux-2.6.32.43/arch/x86/xen/smp.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/xen/smp.c 2011-05-11 18:25:15.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/xen/smp.c linux-2.6.32.44/arch/x86/xen/smp.c
+--- linux-2.6.32.44/arch/x86/xen/smp.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/xen/smp.c 2011-05-11 18:25:15.000000000 -0400
@@ -167,11 +167,6 @@ static void __init xen_smp_prepare_boot_
{
BUG_ON(smp_processor_id() != 0);
@@ -23759,9 +23707,9 @@ diff -urNp linux-2.6.32.43/arch/x86/xen/smp.c linux-2.6.32.43/arch/x86/xen/smp.c
#endif
xen_setup_runstate_info(cpu);
xen_setup_timer(cpu);
-diff -urNp linux-2.6.32.43/arch/x86/xen/xen-asm_32.S linux-2.6.32.43/arch/x86/xen/xen-asm_32.S
---- linux-2.6.32.43/arch/x86/xen/xen-asm_32.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/xen/xen-asm_32.S 2011-04-22 19:13:13.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/xen/xen-asm_32.S linux-2.6.32.44/arch/x86/xen/xen-asm_32.S
+--- linux-2.6.32.44/arch/x86/xen/xen-asm_32.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/xen/xen-asm_32.S 2011-04-22 19:13:13.000000000 -0400
@@ -83,14 +83,14 @@ ENTRY(xen_iret)
ESP_OFFSET=4 # bytes pushed onto stack
@@ -23783,9 +23731,9 @@ diff -urNp linux-2.6.32.43/arch/x86/xen/xen-asm_32.S linux-2.6.32.43/arch/x86/xe
#else
movl per_cpu__xen_vcpu, %eax
#endif
-diff -urNp linux-2.6.32.43/arch/x86/xen/xen-head.S linux-2.6.32.43/arch/x86/xen/xen-head.S
---- linux-2.6.32.43/arch/x86/xen/xen-head.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/xen/xen-head.S 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/xen/xen-head.S linux-2.6.32.44/arch/x86/xen/xen-head.S
+--- linux-2.6.32.44/arch/x86/xen/xen-head.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/xen/xen-head.S 2011-04-17 15:56:46.000000000 -0400
@@ -19,6 +19,17 @@ ENTRY(startup_xen)
#ifdef CONFIG_X86_32
mov %esi,xen_start_info
@@ -23804,9 +23752,9 @@ diff -urNp linux-2.6.32.43/arch/x86/xen/xen-head.S linux-2.6.32.43/arch/x86/xen/
#else
mov %rsi,xen_start_info
mov $init_thread_union+THREAD_SIZE,%rsp
-diff -urNp linux-2.6.32.43/arch/x86/xen/xen-ops.h linux-2.6.32.43/arch/x86/xen/xen-ops.h
---- linux-2.6.32.43/arch/x86/xen/xen-ops.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/arch/x86/xen/xen-ops.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/arch/x86/xen/xen-ops.h linux-2.6.32.44/arch/x86/xen/xen-ops.h
+--- linux-2.6.32.44/arch/x86/xen/xen-ops.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/arch/x86/xen/xen-ops.h 2011-04-17 15:56:46.000000000 -0400
@@ -10,8 +10,6 @@
extern const char xen_hypervisor_callback[];
extern const char xen_failsafe_callback[];
@@ -23816,9 +23764,9 @@ diff -urNp linux-2.6.32.43/arch/x86/xen/xen-ops.h linux-2.6.32.43/arch/x86/xen/x
struct trap_info;
void xen_copy_trap_info(struct trap_info *traps);
-diff -urNp linux-2.6.32.43/block/blk-integrity.c linux-2.6.32.43/block/blk-integrity.c
---- linux-2.6.32.43/block/blk-integrity.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/block/blk-integrity.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/block/blk-integrity.c linux-2.6.32.44/block/blk-integrity.c
+--- linux-2.6.32.44/block/blk-integrity.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/block/blk-integrity.c 2011-04-17 15:56:46.000000000 -0400
@@ -278,7 +278,7 @@ static struct attribute *integrity_attrs
NULL,
};
@@ -23828,9 +23776,9 @@ diff -urNp linux-2.6.32.43/block/blk-integrity.c linux-2.6.32.43/block/blk-integ
.show = &integrity_attr_show,
.store = &integrity_attr_store,
};
-diff -urNp linux-2.6.32.43/block/blk-iopoll.c linux-2.6.32.43/block/blk-iopoll.c
---- linux-2.6.32.43/block/blk-iopoll.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/block/blk-iopoll.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/block/blk-iopoll.c linux-2.6.32.44/block/blk-iopoll.c
+--- linux-2.6.32.44/block/blk-iopoll.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/block/blk-iopoll.c 2011-04-17 15:56:46.000000000 -0400
@@ -77,7 +77,7 @@ void blk_iopoll_complete(struct blk_iopo
}
EXPORT_SYMBOL(blk_iopoll_complete);
@@ -23840,9 +23788,9 @@ diff -urNp linux-2.6.32.43/block/blk-iopoll.c linux-2.6.32.43/block/blk-iopoll.c
{
struct list_head *list = &__get_cpu_var(blk_cpu_iopoll);
int rearm = 0, budget = blk_iopoll_budget;
-diff -urNp linux-2.6.32.43/block/blk-map.c linux-2.6.32.43/block/blk-map.c
---- linux-2.6.32.43/block/blk-map.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/block/blk-map.c 2011-04-18 16:57:33.000000000 -0400
+diff -urNp linux-2.6.32.44/block/blk-map.c linux-2.6.32.44/block/blk-map.c
+--- linux-2.6.32.44/block/blk-map.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/block/blk-map.c 2011-04-18 16:57:33.000000000 -0400
@@ -54,7 +54,7 @@ static int __blk_rq_map_user(struct requ
* direct dma. else, set up kernel bounce buffers
*/
@@ -23877,9 +23825,9 @@ diff -urNp linux-2.6.32.43/block/blk-map.c linux-2.6.32.43/block/blk-map.c
if (do_copy)
bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
else
-diff -urNp linux-2.6.32.43/block/blk-softirq.c linux-2.6.32.43/block/blk-softirq.c
---- linux-2.6.32.43/block/blk-softirq.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/block/blk-softirq.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/block/blk-softirq.c linux-2.6.32.44/block/blk-softirq.c
+--- linux-2.6.32.44/block/blk-softirq.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/block/blk-softirq.c 2011-04-17 15:56:46.000000000 -0400
@@ -17,7 +17,7 @@ static DEFINE_PER_CPU(struct list_head,
* Softirq action handler - move entries to local list and loop over them
* while passing them to the queue registered handler.
@@ -23889,9 +23837,9 @@ diff -urNp linux-2.6.32.43/block/blk-softirq.c linux-2.6.32.43/block/blk-softirq
{
struct list_head *cpu_list, local_list;
-diff -urNp linux-2.6.32.43/block/blk-sysfs.c linux-2.6.32.43/block/blk-sysfs.c
---- linux-2.6.32.43/block/blk-sysfs.c 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.43/block/blk-sysfs.c 2011-05-10 22:12:26.000000000 -0400
+diff -urNp linux-2.6.32.44/block/blk-sysfs.c linux-2.6.32.44/block/blk-sysfs.c
+--- linux-2.6.32.44/block/blk-sysfs.c 2011-05-10 22:12:01.000000000 -0400
++++ linux-2.6.32.44/block/blk-sysfs.c 2011-05-10 22:12:26.000000000 -0400
@@ -414,7 +414,7 @@ static void blk_release_queue(struct kob
kmem_cache_free(blk_requestq_cachep, q);
}
@@ -23901,9 +23849,9 @@ diff -urNp linux-2.6.32.43/block/blk-sysfs.c linux-2.6.32.43/block/blk-sysfs.c
.show = queue_attr_show,
.store = queue_attr_store,
};
-diff -urNp linux-2.6.32.43/block/bsg.c linux-2.6.32.43/block/bsg.c
---- linux-2.6.32.43/block/bsg.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/block/bsg.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/block/bsg.c linux-2.6.32.44/block/bsg.c
+--- linux-2.6.32.44/block/bsg.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/block/bsg.c 2011-04-17 15:56:46.000000000 -0400
@@ -175,16 +175,24 @@ static int blk_fill_sgv4_hdr_rq(struct r
struct sg_io_v4 *hdr, struct bsg_device *bd,
fmode_t has_write_perm)
@@ -23931,9 +23879,9 @@ diff -urNp linux-2.6.32.43/block/bsg.c linux-2.6.32.43/block/bsg.c
if (hdr->subprotocol == BSG_SUB_PROTOCOL_SCSI_CMD) {
if (blk_verify_command(rq->cmd, has_write_perm))
return -EPERM;
-diff -urNp linux-2.6.32.43/block/elevator.c linux-2.6.32.43/block/elevator.c
---- linux-2.6.32.43/block/elevator.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/block/elevator.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/block/elevator.c linux-2.6.32.44/block/elevator.c
+--- linux-2.6.32.44/block/elevator.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/block/elevator.c 2011-04-17 15:56:46.000000000 -0400
@@ -889,7 +889,7 @@ elv_attr_store(struct kobject *kobj, str
return error;
}
@@ -23943,9 +23891,9 @@ diff -urNp linux-2.6.32.43/block/elevator.c linux-2.6.32.43/block/elevator.c
.show = elv_attr_show,
.store = elv_attr_store,
};
-diff -urNp linux-2.6.32.43/block/scsi_ioctl.c linux-2.6.32.43/block/scsi_ioctl.c
---- linux-2.6.32.43/block/scsi_ioctl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/block/scsi_ioctl.c 2011-04-23 13:28:22.000000000 -0400
+diff -urNp linux-2.6.32.44/block/scsi_ioctl.c linux-2.6.32.44/block/scsi_ioctl.c
+--- linux-2.6.32.44/block/scsi_ioctl.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/block/scsi_ioctl.c 2011-04-23 13:28:22.000000000 -0400
@@ -220,8 +220,20 @@ EXPORT_SYMBOL(blk_verify_command);
static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
struct sg_io_hdr *hdr, fmode_t mode)
@@ -23997,9 +23945,9 @@ diff -urNp linux-2.6.32.43/block/scsi_ioctl.c linux-2.6.32.43/block/scsi_ioctl.c
if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len))
goto error;
-diff -urNp linux-2.6.32.43/crypto/cryptd.c linux-2.6.32.43/crypto/cryptd.c
---- linux-2.6.32.43/crypto/cryptd.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/crypto/cryptd.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/crypto/cryptd.c linux-2.6.32.44/crypto/cryptd.c
+--- linux-2.6.32.44/crypto/cryptd.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/crypto/cryptd.c 2011-08-05 20:33:55.000000000 -0400
@@ -214,7 +214,7 @@ static int cryptd_blkcipher_enqueue(stru
struct cryptd_queue *queue;
@@ -24009,9 +23957,9 @@ diff -urNp linux-2.6.32.43/crypto/cryptd.c linux-2.6.32.43/crypto/cryptd.c
req->base.complete = complete;
return cryptd_enqueue_request(queue, &req->base);
-diff -urNp linux-2.6.32.43/crypto/gf128mul.c linux-2.6.32.43/crypto/gf128mul.c
---- linux-2.6.32.43/crypto/gf128mul.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/crypto/gf128mul.c 2011-07-06 19:53:33.000000000 -0400
+diff -urNp linux-2.6.32.44/crypto/gf128mul.c linux-2.6.32.44/crypto/gf128mul.c
+--- linux-2.6.32.44/crypto/gf128mul.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/crypto/gf128mul.c 2011-07-06 19:53:33.000000000 -0400
@@ -182,7 +182,7 @@ void gf128mul_lle(be128 *r, const be128
for (i = 0; i < 7; ++i)
gf128mul_x_lle(&p[i + 1], &p[i]);
@@ -24030,9 +23978,9 @@ diff -urNp linux-2.6.32.43/crypto/gf128mul.c linux-2.6.32.43/crypto/gf128mul.c
for (i = 0;;) {
u8 ch = ((u8 *)b)[i];
-diff -urNp linux-2.6.32.43/crypto/md5.c linux-2.6.32.43/crypto/md5.c
---- linux-2.6.32.43/crypto/md5.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/crypto/md5.c 2011-08-07 19:48:09.000000000 -0400
+diff -urNp linux-2.6.32.44/crypto/md5.c linux-2.6.32.44/crypto/md5.c
+--- linux-2.6.32.44/crypto/md5.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/crypto/md5.c 2011-08-07 19:48:09.000000000 -0400
@@ -20,6 +20,7 @@
#include <linux/module.h>
#include <linux/string.h>
@@ -24145,9 +24093,9 @@ diff -urNp linux-2.6.32.43/crypto/md5.c linux-2.6.32.43/crypto/md5.c
/* XXX: this stuff can be optimized */
static inline void le32_to_cpu_array(u32 *buf, unsigned int words)
{
-diff -urNp linux-2.6.32.43/crypto/serpent.c linux-2.6.32.43/crypto/serpent.c
---- linux-2.6.32.43/crypto/serpent.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/crypto/serpent.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/crypto/serpent.c linux-2.6.32.44/crypto/serpent.c
+--- linux-2.6.32.44/crypto/serpent.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/crypto/serpent.c 2011-05-16 21:46:57.000000000 -0400
@@ -224,6 +224,8 @@ static int serpent_setkey(struct crypto_
u32 r0,r1,r2,r3,r4;
int i;
@@ -24157,9 +24105,9 @@ diff -urNp linux-2.6.32.43/crypto/serpent.c linux-2.6.32.43/crypto/serpent.c
/* Copy key, add padding */
for (i = 0; i < keylen; ++i)
-diff -urNp linux-2.6.32.43/Documentation/dontdiff linux-2.6.32.43/Documentation/dontdiff
---- linux-2.6.32.43/Documentation/dontdiff 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/Documentation/dontdiff 2011-05-18 20:09:36.000000000 -0400
+diff -urNp linux-2.6.32.44/Documentation/dontdiff linux-2.6.32.44/Documentation/dontdiff
+--- linux-2.6.32.44/Documentation/dontdiff 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/Documentation/dontdiff 2011-05-18 20:09:36.000000000 -0400
@@ -1,13 +1,16 @@
*.a
*.aux
@@ -24288,9 +24236,9 @@ diff -urNp linux-2.6.32.43/Documentation/dontdiff linux-2.6.32.43/Documentation/
zImage*
zconf.hash.c
+zoffset.h
-diff -urNp linux-2.6.32.43/Documentation/kernel-parameters.txt linux-2.6.32.43/Documentation/kernel-parameters.txt
---- linux-2.6.32.43/Documentation/kernel-parameters.txt 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/Documentation/kernel-parameters.txt 2011-04-17 15:56:45.000000000 -0400
+diff -urNp linux-2.6.32.44/Documentation/kernel-parameters.txt linux-2.6.32.44/Documentation/kernel-parameters.txt
+--- linux-2.6.32.44/Documentation/kernel-parameters.txt 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/Documentation/kernel-parameters.txt 2011-04-17 15:56:45.000000000 -0400
@@ -1837,6 +1837,13 @@ and is between 256 and 4096 characters.
the specified number of seconds. This is to be used if
your oopses keep scrolling off the screen.
@@ -24305,9 +24253,9 @@ diff -urNp linux-2.6.32.43/Documentation/kernel-parameters.txt linux-2.6.32.43/D
pcbit= [HW,ISDN]
pcd. [PARIDE]
-diff -urNp linux-2.6.32.43/drivers/acpi/acpi_pad.c linux-2.6.32.43/drivers/acpi/acpi_pad.c
---- linux-2.6.32.43/drivers/acpi/acpi_pad.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/acpi/acpi_pad.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/acpi/acpi_pad.c linux-2.6.32.44/drivers/acpi/acpi_pad.c
+--- linux-2.6.32.44/drivers/acpi/acpi_pad.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/acpi/acpi_pad.c 2011-04-17 15:56:46.000000000 -0400
@@ -30,7 +30,7 @@
#include <acpi/acpi_bus.h>
#include <acpi/acpi_drivers.h>
@@ -24317,9 +24265,9 @@ diff -urNp linux-2.6.32.43/drivers/acpi/acpi_pad.c linux-2.6.32.43/drivers/acpi/
#define ACPI_PROCESSOR_AGGREGATOR_DEVICE_NAME "Processor Aggregator"
#define ACPI_PROCESSOR_AGGREGATOR_NOTIFY 0x80
static DEFINE_MUTEX(isolated_cpus_lock);
-diff -urNp linux-2.6.32.43/drivers/acpi/battery.c linux-2.6.32.43/drivers/acpi/battery.c
---- linux-2.6.32.43/drivers/acpi/battery.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/acpi/battery.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/acpi/battery.c linux-2.6.32.44/drivers/acpi/battery.c
+--- linux-2.6.32.44/drivers/acpi/battery.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/acpi/battery.c 2011-04-17 15:56:46.000000000 -0400
@@ -763,7 +763,7 @@ DECLARE_FILE_FUNCTIONS(alarm);
}
@@ -24329,9 +24277,9 @@ diff -urNp linux-2.6.32.43/drivers/acpi/battery.c linux-2.6.32.43/drivers/acpi/b
mode_t mode;
const char *name;
} acpi_battery_file[] = {
-diff -urNp linux-2.6.32.43/drivers/acpi/dock.c linux-2.6.32.43/drivers/acpi/dock.c
---- linux-2.6.32.43/drivers/acpi/dock.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/acpi/dock.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/acpi/dock.c linux-2.6.32.44/drivers/acpi/dock.c
+--- linux-2.6.32.44/drivers/acpi/dock.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/acpi/dock.c 2011-04-17 15:56:46.000000000 -0400
@@ -77,7 +77,7 @@ struct dock_dependent_device {
struct list_head list;
struct list_head hotplug_list;
@@ -24350,9 +24298,9 @@ diff -urNp linux-2.6.32.43/drivers/acpi/dock.c linux-2.6.32.43/drivers/acpi/dock
void *context)
{
struct dock_dependent_device *dd;
-diff -urNp linux-2.6.32.43/drivers/acpi/osl.c linux-2.6.32.43/drivers/acpi/osl.c
---- linux-2.6.32.43/drivers/acpi/osl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/acpi/osl.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/acpi/osl.c linux-2.6.32.44/drivers/acpi/osl.c
+--- linux-2.6.32.44/drivers/acpi/osl.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/acpi/osl.c 2011-04-17 15:56:46.000000000 -0400
@@ -523,6 +523,8 @@ acpi_os_read_memory(acpi_physical_addres
void __iomem *virt_addr;
@@ -24371,9 +24319,9 @@ diff -urNp linux-2.6.32.43/drivers/acpi/osl.c linux-2.6.32.43/drivers/acpi/osl.c
switch (width) {
case 8:
-diff -urNp linux-2.6.32.43/drivers/acpi/power_meter.c linux-2.6.32.43/drivers/acpi/power_meter.c
---- linux-2.6.32.43/drivers/acpi/power_meter.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/acpi/power_meter.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/acpi/power_meter.c linux-2.6.32.44/drivers/acpi/power_meter.c
+--- linux-2.6.32.44/drivers/acpi/power_meter.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/acpi/power_meter.c 2011-04-17 15:56:46.000000000 -0400
@@ -315,8 +315,6 @@ static ssize_t set_trip(struct device *d
return res;
@@ -24383,9 +24331,9 @@ diff -urNp linux-2.6.32.43/drivers/acpi/power_meter.c linux-2.6.32.43/drivers/ac
mutex_lock(&resource->lock);
resource->trip[attr->index - 7] = temp;
-diff -urNp linux-2.6.32.43/drivers/acpi/proc.c linux-2.6.32.43/drivers/acpi/proc.c
---- linux-2.6.32.43/drivers/acpi/proc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/acpi/proc.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/acpi/proc.c linux-2.6.32.44/drivers/acpi/proc.c
+--- linux-2.6.32.44/drivers/acpi/proc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/acpi/proc.c 2011-04-17 15:56:46.000000000 -0400
@@ -391,20 +391,15 @@ acpi_system_write_wakeup_device(struct f
size_t count, loff_t * ppos)
{
@@ -24421,9 +24369,9 @@ diff -urNp linux-2.6.32.43/drivers/acpi/proc.c linux-2.6.32.43/drivers/acpi/proc
dev->wakeup.state.enabled =
dev->wakeup.state.enabled ? 0 : 1;
found_dev = dev;
-diff -urNp linux-2.6.32.43/drivers/acpi/processor_core.c linux-2.6.32.43/drivers/acpi/processor_core.c
---- linux-2.6.32.43/drivers/acpi/processor_core.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/acpi/processor_core.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/acpi/processor_core.c linux-2.6.32.44/drivers/acpi/processor_core.c
+--- linux-2.6.32.44/drivers/acpi/processor_core.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/acpi/processor_core.c 2011-04-17 15:56:46.000000000 -0400
@@ -790,7 +790,7 @@ static int __cpuinit acpi_processor_add(
return 0;
}
@@ -24433,9 +24381,9 @@ diff -urNp linux-2.6.32.43/drivers/acpi/processor_core.c linux-2.6.32.43/drivers
/*
* Buggy BIOS check
-diff -urNp linux-2.6.32.43/drivers/acpi/sbshc.c linux-2.6.32.43/drivers/acpi/sbshc.c
---- linux-2.6.32.43/drivers/acpi/sbshc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/acpi/sbshc.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/acpi/sbshc.c linux-2.6.32.44/drivers/acpi/sbshc.c
+--- linux-2.6.32.44/drivers/acpi/sbshc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/acpi/sbshc.c 2011-04-17 15:56:46.000000000 -0400
@@ -17,7 +17,7 @@
#define PREFIX "ACPI: "
@@ -24445,9 +24393,9 @@ diff -urNp linux-2.6.32.43/drivers/acpi/sbshc.c linux-2.6.32.43/drivers/acpi/sbs
#define ACPI_SMB_HC_DEVICE_NAME "ACPI SMBus HC"
struct acpi_smb_hc {
-diff -urNp linux-2.6.32.43/drivers/acpi/sleep.c linux-2.6.32.43/drivers/acpi/sleep.c
---- linux-2.6.32.43/drivers/acpi/sleep.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/acpi/sleep.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/acpi/sleep.c linux-2.6.32.44/drivers/acpi/sleep.c
+--- linux-2.6.32.44/drivers/acpi/sleep.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/acpi/sleep.c 2011-04-17 15:56:46.000000000 -0400
@@ -283,7 +283,7 @@ static int acpi_suspend_state_valid(susp
}
}
@@ -24484,9 +24432,9 @@ diff -urNp linux-2.6.32.43/drivers/acpi/sleep.c linux-2.6.32.43/drivers/acpi/sle
.begin = acpi_hibernation_begin_old,
.end = acpi_pm_end,
.pre_snapshot = acpi_hibernation_pre_snapshot_old,
-diff -urNp linux-2.6.32.43/drivers/acpi/video.c linux-2.6.32.43/drivers/acpi/video.c
---- linux-2.6.32.43/drivers/acpi/video.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/acpi/video.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/acpi/video.c linux-2.6.32.44/drivers/acpi/video.c
+--- linux-2.6.32.44/drivers/acpi/video.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/acpi/video.c 2011-04-17 15:56:46.000000000 -0400
@@ -359,7 +359,7 @@ static int acpi_video_set_brightness(str
vd->brightness->levels[request_level]);
}
@@ -24496,9 +24444,9 @@ diff -urNp linux-2.6.32.43/drivers/acpi/video.c linux-2.6.32.43/drivers/acpi/vid
.get_brightness = acpi_video_get_brightness,
.update_status = acpi_video_set_brightness,
};
-diff -urNp linux-2.6.32.43/drivers/ata/ahci.c linux-2.6.32.43/drivers/ata/ahci.c
---- linux-2.6.32.43/drivers/ata/ahci.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/ahci.c 2011-04-23 12:56:10.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/ahci.c linux-2.6.32.44/drivers/ata/ahci.c
+--- linux-2.6.32.44/drivers/ata/ahci.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/ahci.c 2011-04-23 12:56:10.000000000 -0400
@@ -387,7 +387,7 @@ static struct scsi_host_template ahci_sh
.sdev_attrs = ahci_sdev_attrs,
};
@@ -24529,9 +24477,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/ahci.c linux-2.6.32.43/drivers/ata/ahci.c
.inherits = &ahci_ops,
.softreset = ahci_sb600_softreset,
.pmp_softreset = ahci_sb600_softreset,
-diff -urNp linux-2.6.32.43/drivers/ata/ata_generic.c linux-2.6.32.43/drivers/ata/ata_generic.c
---- linux-2.6.32.43/drivers/ata/ata_generic.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/ata_generic.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/ata_generic.c linux-2.6.32.44/drivers/ata/ata_generic.c
+--- linux-2.6.32.44/drivers/ata/ata_generic.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/ata_generic.c 2011-04-17 15:56:46.000000000 -0400
@@ -104,7 +104,7 @@ static struct scsi_host_template generic
ATA_BMDMA_SHT(DRV_NAME),
};
@@ -24541,9 +24489,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/ata_generic.c linux-2.6.32.43/drivers/ata
.inherits = &ata_bmdma_port_ops,
.cable_detect = ata_cable_unknown,
.set_mode = generic_set_mode,
-diff -urNp linux-2.6.32.43/drivers/ata/ata_piix.c linux-2.6.32.43/drivers/ata/ata_piix.c
---- linux-2.6.32.43/drivers/ata/ata_piix.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/ata_piix.c 2011-04-23 12:56:10.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/ata_piix.c linux-2.6.32.44/drivers/ata/ata_piix.c
+--- linux-2.6.32.44/drivers/ata/ata_piix.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/ata_piix.c 2011-04-23 12:56:10.000000000 -0400
@@ -318,7 +318,7 @@ static struct scsi_host_template piix_sh
ATA_BMDMA_SHT(DRV_NAME),
};
@@ -24580,9 +24528,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/ata_piix.c linux-2.6.32.43/drivers/ata/at
.inherits = &piix_sata_ops,
.hardreset = sata_std_hardreset,
.scr_read = piix_sidpr_scr_read,
-diff -urNp linux-2.6.32.43/drivers/ata/libata-acpi.c linux-2.6.32.43/drivers/ata/libata-acpi.c
---- linux-2.6.32.43/drivers/ata/libata-acpi.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/libata-acpi.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/libata-acpi.c linux-2.6.32.44/drivers/ata/libata-acpi.c
+--- linux-2.6.32.44/drivers/ata/libata-acpi.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/libata-acpi.c 2011-04-17 15:56:46.000000000 -0400
@@ -223,12 +223,12 @@ static void ata_acpi_dev_uevent(acpi_han
ata_acpi_uevent(dev->link->ap, dev, event);
}
@@ -24598,9 +24546,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/libata-acpi.c linux-2.6.32.43/drivers/ata
.handler = ata_acpi_ap_notify_dock,
.uevent = ata_acpi_ap_uevent,
};
-diff -urNp linux-2.6.32.43/drivers/ata/libata-core.c linux-2.6.32.43/drivers/ata/libata-core.c
---- linux-2.6.32.43/drivers/ata/libata-core.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/libata-core.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/libata-core.c linux-2.6.32.44/drivers/ata/libata-core.c
+--- linux-2.6.32.44/drivers/ata/libata-core.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/libata-core.c 2011-08-05 20:33:55.000000000 -0400
@@ -4954,7 +4954,7 @@ void ata_qc_free(struct ata_queued_cmd *
struct ata_port *ap;
unsigned int tag;
@@ -24665,9 +24613,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/libata-core.c linux-2.6.32.43/drivers/ata
.qc_prep = ata_noop_qc_prep,
.qc_issue = ata_dummy_qc_issue,
.error_handler = ata_dummy_error_handler,
-diff -urNp linux-2.6.32.43/drivers/ata/libata-eh.c linux-2.6.32.43/drivers/ata/libata-eh.c
---- linux-2.6.32.43/drivers/ata/libata-eh.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/libata-eh.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/libata-eh.c linux-2.6.32.44/drivers/ata/libata-eh.c
+--- linux-2.6.32.44/drivers/ata/libata-eh.c 2011-08-09 18:35:28.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/libata-eh.c 2011-08-09 18:33:59.000000000 -0400
@@ -2423,6 +2423,8 @@ void ata_eh_report(struct ata_port *ap)
{
struct ata_link *link;
@@ -24677,7 +24625,7 @@ diff -urNp linux-2.6.32.43/drivers/ata/libata-eh.c linux-2.6.32.43/drivers/ata/l
ata_for_each_link(link, ap, HOST_FIRST)
ata_eh_link_report(link);
}
-@@ -3590,7 +3592,7 @@ void ata_do_eh(struct ata_port *ap, ata_
+@@ -3594,7 +3596,7 @@ void ata_do_eh(struct ata_port *ap, ata_
*/
void ata_std_error_handler(struct ata_port *ap)
{
@@ -24686,9 +24634,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/libata-eh.c linux-2.6.32.43/drivers/ata/l
ata_reset_fn_t hardreset = ops->hardreset;
/* ignore built-in hardreset if SCR access is not available */
-diff -urNp linux-2.6.32.43/drivers/ata/libata-pmp.c linux-2.6.32.43/drivers/ata/libata-pmp.c
---- linux-2.6.32.43/drivers/ata/libata-pmp.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/libata-pmp.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/libata-pmp.c linux-2.6.32.44/drivers/ata/libata-pmp.c
+--- linux-2.6.32.44/drivers/ata/libata-pmp.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/libata-pmp.c 2011-04-17 15:56:46.000000000 -0400
@@ -841,7 +841,7 @@ static int sata_pmp_handle_link_fail(str
*/
static int sata_pmp_eh_recover(struct ata_port *ap)
@@ -24698,9 +24646,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/libata-pmp.c linux-2.6.32.43/drivers/ata/
int pmp_tries, link_tries[SATA_PMP_MAX_PORTS];
struct ata_link *pmp_link = &ap->link;
struct ata_device *pmp_dev = pmp_link->device;
-diff -urNp linux-2.6.32.43/drivers/ata/pata_acpi.c linux-2.6.32.43/drivers/ata/pata_acpi.c
---- linux-2.6.32.43/drivers/ata/pata_acpi.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_acpi.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_acpi.c linux-2.6.32.44/drivers/ata/pata_acpi.c
+--- linux-2.6.32.44/drivers/ata/pata_acpi.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_acpi.c 2011-04-17 15:56:46.000000000 -0400
@@ -215,7 +215,7 @@ static struct scsi_host_template pacpi_s
ATA_BMDMA_SHT(DRV_NAME),
};
@@ -24710,9 +24658,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_acpi.c linux-2.6.32.43/drivers/ata/p
.inherits = &ata_bmdma_port_ops,
.qc_issue = pacpi_qc_issue,
.cable_detect = pacpi_cable_detect,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_ali.c linux-2.6.32.43/drivers/ata/pata_ali.c
---- linux-2.6.32.43/drivers/ata/pata_ali.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_ali.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_ali.c linux-2.6.32.44/drivers/ata/pata_ali.c
+--- linux-2.6.32.44/drivers/ata/pata_ali.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_ali.c 2011-04-17 15:56:46.000000000 -0400
@@ -365,7 +365,7 @@ static struct scsi_host_template ali_sht
* Port operations for PIO only ALi
*/
@@ -24758,9 +24706,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_ali.c linux-2.6.32.43/drivers/ata/pa
.inherits = &ali_dma_base_ops,
.check_atapi_dma = ali_check_atapi_dma,
.dev_config = ali_warn_atapi_dma,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_amd.c linux-2.6.32.43/drivers/ata/pata_amd.c
---- linux-2.6.32.43/drivers/ata/pata_amd.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_amd.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_amd.c linux-2.6.32.44/drivers/ata/pata_amd.c
+--- linux-2.6.32.44/drivers/ata/pata_amd.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_amd.c 2011-04-17 15:56:46.000000000 -0400
@@ -397,28 +397,28 @@ static const struct ata_port_operations
.prereset = amd_pre_reset,
};
@@ -24810,9 +24758,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_amd.c linux-2.6.32.43/drivers/ata/pa
.inherits = &nv_base_port_ops,
.set_piomode = nv133_set_piomode,
.set_dmamode = nv133_set_dmamode,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_artop.c linux-2.6.32.43/drivers/ata/pata_artop.c
---- linux-2.6.32.43/drivers/ata/pata_artop.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_artop.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_artop.c linux-2.6.32.44/drivers/ata/pata_artop.c
+--- linux-2.6.32.44/drivers/ata/pata_artop.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_artop.c 2011-04-17 15:56:46.000000000 -0400
@@ -311,7 +311,7 @@ static struct scsi_host_template artop_s
ATA_BMDMA_SHT(DRV_NAME),
};
@@ -24831,9 +24779,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_artop.c linux-2.6.32.43/drivers/ata/
.inherits = &ata_bmdma_port_ops,
.cable_detect = artop6260_cable_detect,
.set_piomode = artop6260_set_piomode,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_at32.c linux-2.6.32.43/drivers/ata/pata_at32.c
---- linux-2.6.32.43/drivers/ata/pata_at32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_at32.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_at32.c linux-2.6.32.44/drivers/ata/pata_at32.c
+--- linux-2.6.32.44/drivers/ata/pata_at32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_at32.c 2011-04-17 15:56:46.000000000 -0400
@@ -172,7 +172,7 @@ static struct scsi_host_template at32_sh
ATA_PIO_SHT(DRV_NAME),
};
@@ -24843,9 +24791,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_at32.c linux-2.6.32.43/drivers/ata/p
.inherits = &ata_sff_port_ops,
.cable_detect = ata_cable_40wire,
.set_piomode = pata_at32_set_piomode,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_at91.c linux-2.6.32.43/drivers/ata/pata_at91.c
---- linux-2.6.32.43/drivers/ata/pata_at91.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_at91.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_at91.c linux-2.6.32.44/drivers/ata/pata_at91.c
+--- linux-2.6.32.44/drivers/ata/pata_at91.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_at91.c 2011-04-17 15:56:46.000000000 -0400
@@ -195,7 +195,7 @@ static struct scsi_host_template pata_at
ATA_PIO_SHT(DRV_NAME),
};
@@ -24855,9 +24803,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_at91.c linux-2.6.32.43/drivers/ata/p
.inherits = &ata_sff_port_ops,
.sff_data_xfer = pata_at91_data_xfer_noirq,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_atiixp.c linux-2.6.32.43/drivers/ata/pata_atiixp.c
---- linux-2.6.32.43/drivers/ata/pata_atiixp.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_atiixp.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_atiixp.c linux-2.6.32.44/drivers/ata/pata_atiixp.c
+--- linux-2.6.32.44/drivers/ata/pata_atiixp.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_atiixp.c 2011-04-17 15:56:46.000000000 -0400
@@ -205,7 +205,7 @@ static struct scsi_host_template atiixp_
.sg_tablesize = LIBATA_DUMB_MAX_PRD,
};
@@ -24867,9 +24815,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_atiixp.c linux-2.6.32.43/drivers/ata
.inherits = &ata_bmdma_port_ops,
.qc_prep = ata_sff_dumb_qc_prep,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_atp867x.c linux-2.6.32.43/drivers/ata/pata_atp867x.c
---- linux-2.6.32.43/drivers/ata/pata_atp867x.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_atp867x.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_atp867x.c linux-2.6.32.44/drivers/ata/pata_atp867x.c
+--- linux-2.6.32.44/drivers/ata/pata_atp867x.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_atp867x.c 2011-04-17 15:56:46.000000000 -0400
@@ -274,7 +274,7 @@ static struct scsi_host_template atp867x
ATA_BMDMA_SHT(DRV_NAME),
};
@@ -24879,9 +24827,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_atp867x.c linux-2.6.32.43/drivers/at
.inherits = &ata_bmdma_port_ops,
.cable_detect = atp867x_cable_detect,
.set_piomode = atp867x_set_piomode,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_bf54x.c linux-2.6.32.43/drivers/ata/pata_bf54x.c
---- linux-2.6.32.43/drivers/ata/pata_bf54x.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_bf54x.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_bf54x.c linux-2.6.32.44/drivers/ata/pata_bf54x.c
+--- linux-2.6.32.44/drivers/ata/pata_bf54x.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_bf54x.c 2011-04-17 15:56:46.000000000 -0400
@@ -1464,7 +1464,7 @@ static struct scsi_host_template bfin_sh
.dma_boundary = ATA_DMA_BOUNDARY,
};
@@ -24891,9 +24839,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_bf54x.c linux-2.6.32.43/drivers/ata/
.inherits = &ata_sff_port_ops,
.set_piomode = bfin_set_piomode,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_cmd640.c linux-2.6.32.43/drivers/ata/pata_cmd640.c
---- linux-2.6.32.43/drivers/ata/pata_cmd640.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_cmd640.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_cmd640.c linux-2.6.32.44/drivers/ata/pata_cmd640.c
+--- linux-2.6.32.44/drivers/ata/pata_cmd640.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_cmd640.c 2011-04-17 15:56:46.000000000 -0400
@@ -168,7 +168,7 @@ static struct scsi_host_template cmd640_
ATA_BMDMA_SHT(DRV_NAME),
};
@@ -24903,9 +24851,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_cmd640.c linux-2.6.32.43/drivers/ata
.inherits = &ata_bmdma_port_ops,
/* In theory xfer_noirq is not needed once we kill the prefetcher */
.sff_data_xfer = ata_sff_data_xfer_noirq,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_cmd64x.c linux-2.6.32.43/drivers/ata/pata_cmd64x.c
---- linux-2.6.32.43/drivers/ata/pata_cmd64x.c 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_cmd64x.c 2011-06-25 12:56:37.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_cmd64x.c linux-2.6.32.44/drivers/ata/pata_cmd64x.c
+--- linux-2.6.32.44/drivers/ata/pata_cmd64x.c 2011-06-25 12:55:34.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_cmd64x.c 2011-06-25 12:56:37.000000000 -0400
@@ -271,18 +271,18 @@ static const struct ata_port_operations
.set_dmamode = cmd64x_set_dmamode,
};
@@ -24928,9 +24876,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_cmd64x.c linux-2.6.32.43/drivers/ata
.inherits = &cmd64x_base_ops,
.bmdma_stop = cmd648_bmdma_stop,
.cable_detect = cmd648_cable_detect,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_cs5520.c linux-2.6.32.43/drivers/ata/pata_cs5520.c
---- linux-2.6.32.43/drivers/ata/pata_cs5520.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_cs5520.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_cs5520.c linux-2.6.32.44/drivers/ata/pata_cs5520.c
+--- linux-2.6.32.44/drivers/ata/pata_cs5520.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_cs5520.c 2011-04-17 15:56:46.000000000 -0400
@@ -144,7 +144,7 @@ static struct scsi_host_template cs5520_
.sg_tablesize = LIBATA_DUMB_MAX_PRD,
};
@@ -24940,9 +24888,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_cs5520.c linux-2.6.32.43/drivers/ata
.inherits = &ata_bmdma_port_ops,
.qc_prep = ata_sff_dumb_qc_prep,
.cable_detect = ata_cable_40wire,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_cs5530.c linux-2.6.32.43/drivers/ata/pata_cs5530.c
---- linux-2.6.32.43/drivers/ata/pata_cs5530.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_cs5530.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_cs5530.c linux-2.6.32.44/drivers/ata/pata_cs5530.c
+--- linux-2.6.32.44/drivers/ata/pata_cs5530.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_cs5530.c 2011-04-17 15:56:46.000000000 -0400
@@ -164,7 +164,7 @@ static struct scsi_host_template cs5530_
.sg_tablesize = LIBATA_DUMB_MAX_PRD,
};
@@ -24952,9 +24900,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_cs5530.c linux-2.6.32.43/drivers/ata
.inherits = &ata_bmdma_port_ops,
.qc_prep = ata_sff_dumb_qc_prep,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_cs5535.c linux-2.6.32.43/drivers/ata/pata_cs5535.c
---- linux-2.6.32.43/drivers/ata/pata_cs5535.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_cs5535.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_cs5535.c linux-2.6.32.44/drivers/ata/pata_cs5535.c
+--- linux-2.6.32.44/drivers/ata/pata_cs5535.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_cs5535.c 2011-04-17 15:56:46.000000000 -0400
@@ -160,7 +160,7 @@ static struct scsi_host_template cs5535_
ATA_BMDMA_SHT(DRV_NAME),
};
@@ -24964,9 +24912,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_cs5535.c linux-2.6.32.43/drivers/ata
.inherits = &ata_bmdma_port_ops,
.cable_detect = cs5535_cable_detect,
.set_piomode = cs5535_set_piomode,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_cs5536.c linux-2.6.32.43/drivers/ata/pata_cs5536.c
---- linux-2.6.32.43/drivers/ata/pata_cs5536.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_cs5536.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_cs5536.c linux-2.6.32.44/drivers/ata/pata_cs5536.c
+--- linux-2.6.32.44/drivers/ata/pata_cs5536.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_cs5536.c 2011-04-17 15:56:46.000000000 -0400
@@ -223,7 +223,7 @@ static struct scsi_host_template cs5536_
ATA_BMDMA_SHT(DRV_NAME),
};
@@ -24976,9 +24924,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_cs5536.c linux-2.6.32.43/drivers/ata
.inherits = &ata_bmdma_port_ops,
.cable_detect = cs5536_cable_detect,
.set_piomode = cs5536_set_piomode,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_cypress.c linux-2.6.32.43/drivers/ata/pata_cypress.c
---- linux-2.6.32.43/drivers/ata/pata_cypress.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_cypress.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_cypress.c linux-2.6.32.44/drivers/ata/pata_cypress.c
+--- linux-2.6.32.44/drivers/ata/pata_cypress.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_cypress.c 2011-04-17 15:56:46.000000000 -0400
@@ -113,7 +113,7 @@ static struct scsi_host_template cy82c69
ATA_BMDMA_SHT(DRV_NAME),
};
@@ -24988,9 +24936,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_cypress.c linux-2.6.32.43/drivers/at
.inherits = &ata_bmdma_port_ops,
.cable_detect = ata_cable_40wire,
.set_piomode = cy82c693_set_piomode,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_efar.c linux-2.6.32.43/drivers/ata/pata_efar.c
---- linux-2.6.32.43/drivers/ata/pata_efar.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_efar.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_efar.c linux-2.6.32.44/drivers/ata/pata_efar.c
+--- linux-2.6.32.44/drivers/ata/pata_efar.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_efar.c 2011-04-17 15:56:46.000000000 -0400
@@ -222,7 +222,7 @@ static struct scsi_host_template efar_sh
ATA_BMDMA_SHT(DRV_NAME),
};
@@ -25000,9 +24948,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_efar.c linux-2.6.32.43/drivers/ata/p
.inherits = &ata_bmdma_port_ops,
.cable_detect = efar_cable_detect,
.set_piomode = efar_set_piomode,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_hpt366.c linux-2.6.32.43/drivers/ata/pata_hpt366.c
---- linux-2.6.32.43/drivers/ata/pata_hpt366.c 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_hpt366.c 2011-06-25 12:56:37.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_hpt366.c linux-2.6.32.44/drivers/ata/pata_hpt366.c
+--- linux-2.6.32.44/drivers/ata/pata_hpt366.c 2011-06-25 12:55:34.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_hpt366.c 2011-06-25 12:56:37.000000000 -0400
@@ -282,7 +282,7 @@ static struct scsi_host_template hpt36x_
* Configuration for HPT366/68
*/
@@ -25012,9 +24960,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_hpt366.c linux-2.6.32.43/drivers/ata
.inherits = &ata_bmdma_port_ops,
.cable_detect = hpt36x_cable_detect,
.mode_filter = hpt366_filter,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_hpt37x.c linux-2.6.32.43/drivers/ata/pata_hpt37x.c
---- linux-2.6.32.43/drivers/ata/pata_hpt37x.c 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_hpt37x.c 2011-06-25 12:56:37.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_hpt37x.c linux-2.6.32.44/drivers/ata/pata_hpt37x.c
+--- linux-2.6.32.44/drivers/ata/pata_hpt37x.c 2011-06-25 12:55:34.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_hpt37x.c 2011-06-25 12:56:37.000000000 -0400
@@ -576,7 +576,7 @@ static struct scsi_host_template hpt37x_
* Configuration for HPT370
*/
@@ -25051,9 +24999,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_hpt37x.c linux-2.6.32.43/drivers/ata
.inherits = &hpt372_port_ops,
.prereset = hpt374_fn1_pre_reset,
};
-diff -urNp linux-2.6.32.43/drivers/ata/pata_hpt3x2n.c linux-2.6.32.43/drivers/ata/pata_hpt3x2n.c
---- linux-2.6.32.43/drivers/ata/pata_hpt3x2n.c 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_hpt3x2n.c 2011-06-25 12:56:37.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_hpt3x2n.c linux-2.6.32.44/drivers/ata/pata_hpt3x2n.c
+--- linux-2.6.32.44/drivers/ata/pata_hpt3x2n.c 2011-06-25 12:55:34.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_hpt3x2n.c 2011-06-25 12:56:37.000000000 -0400
@@ -337,7 +337,7 @@ static struct scsi_host_template hpt3x2n
* Configuration for HPT3x2n.
*/
@@ -25063,9 +25011,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_hpt3x2n.c linux-2.6.32.43/drivers/at
.inherits = &ata_bmdma_port_ops,
.bmdma_stop = hpt3x2n_bmdma_stop,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_hpt3x3.c linux-2.6.32.43/drivers/ata/pata_hpt3x3.c
---- linux-2.6.32.43/drivers/ata/pata_hpt3x3.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_hpt3x3.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_hpt3x3.c linux-2.6.32.44/drivers/ata/pata_hpt3x3.c
+--- linux-2.6.32.44/drivers/ata/pata_hpt3x3.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_hpt3x3.c 2011-04-17 15:56:46.000000000 -0400
@@ -141,7 +141,7 @@ static struct scsi_host_template hpt3x3_
ATA_BMDMA_SHT(DRV_NAME),
};
@@ -25075,9 +25023,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_hpt3x3.c linux-2.6.32.43/drivers/ata
.inherits = &ata_bmdma_port_ops,
.cable_detect = ata_cable_40wire,
.set_piomode = hpt3x3_set_piomode,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_icside.c linux-2.6.32.43/drivers/ata/pata_icside.c
---- linux-2.6.32.43/drivers/ata/pata_icside.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_icside.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_icside.c linux-2.6.32.44/drivers/ata/pata_icside.c
+--- linux-2.6.32.44/drivers/ata/pata_icside.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_icside.c 2011-04-17 15:56:46.000000000 -0400
@@ -319,7 +319,7 @@ static void pata_icside_postreset(struct
}
}
@@ -25087,9 +25035,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_icside.c linux-2.6.32.43/drivers/ata
.inherits = &ata_sff_port_ops,
/* no need to build any PRD tables for DMA */
.qc_prep = ata_noop_qc_prep,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_isapnp.c linux-2.6.32.43/drivers/ata/pata_isapnp.c
---- linux-2.6.32.43/drivers/ata/pata_isapnp.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_isapnp.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_isapnp.c linux-2.6.32.44/drivers/ata/pata_isapnp.c
+--- linux-2.6.32.44/drivers/ata/pata_isapnp.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_isapnp.c 2011-04-17 15:56:46.000000000 -0400
@@ -23,12 +23,12 @@ static struct scsi_host_template isapnp_
ATA_PIO_SHT(DRV_NAME),
};
@@ -25105,9 +25053,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_isapnp.c linux-2.6.32.43/drivers/ata
.inherits = &ata_sff_port_ops,
.cable_detect = ata_cable_40wire,
/* No altstatus so we don't want to use the lost interrupt poll */
-diff -urNp linux-2.6.32.43/drivers/ata/pata_it8213.c linux-2.6.32.43/drivers/ata/pata_it8213.c
---- linux-2.6.32.43/drivers/ata/pata_it8213.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_it8213.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_it8213.c linux-2.6.32.44/drivers/ata/pata_it8213.c
+--- linux-2.6.32.44/drivers/ata/pata_it8213.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_it8213.c 2011-04-17 15:56:46.000000000 -0400
@@ -234,7 +234,7 @@ static struct scsi_host_template it8213_
};
@@ -25117,9 +25065,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_it8213.c linux-2.6.32.43/drivers/ata
.inherits = &ata_bmdma_port_ops,
.cable_detect = it8213_cable_detect,
.set_piomode = it8213_set_piomode,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_it821x.c linux-2.6.32.43/drivers/ata/pata_it821x.c
---- linux-2.6.32.43/drivers/ata/pata_it821x.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_it821x.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_it821x.c linux-2.6.32.44/drivers/ata/pata_it821x.c
+--- linux-2.6.32.44/drivers/ata/pata_it821x.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_it821x.c 2011-04-17 15:56:46.000000000 -0400
@@ -800,7 +800,7 @@ static struct scsi_host_template it821x_
ATA_BMDMA_SHT(DRV_NAME),
};
@@ -25147,9 +25095,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_it821x.c linux-2.6.32.43/drivers/ata
.inherits = &ata_bmdma_port_ops,
.check_atapi_dma= it821x_check_atapi_dma,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_ixp4xx_cf.c linux-2.6.32.43/drivers/ata/pata_ixp4xx_cf.c
---- linux-2.6.32.43/drivers/ata/pata_ixp4xx_cf.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_ixp4xx_cf.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_ixp4xx_cf.c linux-2.6.32.44/drivers/ata/pata_ixp4xx_cf.c
+--- linux-2.6.32.44/drivers/ata/pata_ixp4xx_cf.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_ixp4xx_cf.c 2011-04-17 15:56:46.000000000 -0400
@@ -89,7 +89,7 @@ static struct scsi_host_template ixp4xx_
ATA_PIO_SHT(DRV_NAME),
};
@@ -25159,9 +25107,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_ixp4xx_cf.c linux-2.6.32.43/drivers/
.inherits = &ata_sff_port_ops,
.sff_data_xfer = ixp4xx_mmio_data_xfer,
.cable_detect = ata_cable_40wire,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_jmicron.c linux-2.6.32.43/drivers/ata/pata_jmicron.c
---- linux-2.6.32.43/drivers/ata/pata_jmicron.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_jmicron.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_jmicron.c linux-2.6.32.44/drivers/ata/pata_jmicron.c
+--- linux-2.6.32.44/drivers/ata/pata_jmicron.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_jmicron.c 2011-04-17 15:56:46.000000000 -0400
@@ -111,7 +111,7 @@ static struct scsi_host_template jmicron
ATA_BMDMA_SHT(DRV_NAME),
};
@@ -25171,9 +25119,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_jmicron.c linux-2.6.32.43/drivers/at
.inherits = &ata_bmdma_port_ops,
.prereset = jmicron_pre_reset,
};
-diff -urNp linux-2.6.32.43/drivers/ata/pata_legacy.c linux-2.6.32.43/drivers/ata/pata_legacy.c
---- linux-2.6.32.43/drivers/ata/pata_legacy.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_legacy.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_legacy.c linux-2.6.32.44/drivers/ata/pata_legacy.c
+--- linux-2.6.32.44/drivers/ata/pata_legacy.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_legacy.c 2011-04-17 15:56:46.000000000 -0400
@@ -106,7 +106,7 @@ struct legacy_probe {
struct legacy_controller {
@@ -25285,9 +25233,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_legacy.c linux-2.6.32.43/drivers/ata
struct legacy_data *ld = &legacy_data[probe->slot];
struct ata_host *host = NULL;
struct ata_port *ap;
-diff -urNp linux-2.6.32.43/drivers/ata/pata_marvell.c linux-2.6.32.43/drivers/ata/pata_marvell.c
---- linux-2.6.32.43/drivers/ata/pata_marvell.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_marvell.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_marvell.c linux-2.6.32.44/drivers/ata/pata_marvell.c
+--- linux-2.6.32.44/drivers/ata/pata_marvell.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_marvell.c 2011-04-17 15:56:46.000000000 -0400
@@ -100,7 +100,7 @@ static struct scsi_host_template marvell
ATA_BMDMA_SHT(DRV_NAME),
};
@@ -25297,9 +25245,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_marvell.c linux-2.6.32.43/drivers/at
.inherits = &ata_bmdma_port_ops,
.cable_detect = marvell_cable_detect,
.prereset = marvell_pre_reset,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_mpc52xx.c linux-2.6.32.43/drivers/ata/pata_mpc52xx.c
---- linux-2.6.32.43/drivers/ata/pata_mpc52xx.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_mpc52xx.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_mpc52xx.c linux-2.6.32.44/drivers/ata/pata_mpc52xx.c
+--- linux-2.6.32.44/drivers/ata/pata_mpc52xx.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_mpc52xx.c 2011-04-17 15:56:46.000000000 -0400
@@ -609,7 +609,7 @@ static struct scsi_host_template mpc52xx
ATA_PIO_SHT(DRV_NAME),
};
@@ -25309,9 +25257,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_mpc52xx.c linux-2.6.32.43/drivers/at
.inherits = &ata_bmdma_port_ops,
.sff_dev_select = mpc52xx_ata_dev_select,
.set_piomode = mpc52xx_ata_set_piomode,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_mpiix.c linux-2.6.32.43/drivers/ata/pata_mpiix.c
---- linux-2.6.32.43/drivers/ata/pata_mpiix.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_mpiix.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_mpiix.c linux-2.6.32.44/drivers/ata/pata_mpiix.c
+--- linux-2.6.32.44/drivers/ata/pata_mpiix.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_mpiix.c 2011-04-17 15:56:46.000000000 -0400
@@ -140,7 +140,7 @@ static struct scsi_host_template mpiix_s
ATA_PIO_SHT(DRV_NAME),
};
@@ -25321,9 +25269,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_mpiix.c linux-2.6.32.43/drivers/ata/
.inherits = &ata_sff_port_ops,
.qc_issue = mpiix_qc_issue,
.cable_detect = ata_cable_40wire,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_netcell.c linux-2.6.32.43/drivers/ata/pata_netcell.c
---- linux-2.6.32.43/drivers/ata/pata_netcell.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_netcell.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_netcell.c linux-2.6.32.44/drivers/ata/pata_netcell.c
+--- linux-2.6.32.44/drivers/ata/pata_netcell.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_netcell.c 2011-04-17 15:56:46.000000000 -0400
@@ -34,7 +34,7 @@ static struct scsi_host_template netcell
ATA_BMDMA_SHT(DRV_NAME),
};
@@ -25333,9 +25281,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_netcell.c linux-2.6.32.43/drivers/at
.inherits = &ata_bmdma_port_ops,
.cable_detect = ata_cable_80wire,
.read_id = netcell_read_id,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_ninja32.c linux-2.6.32.43/drivers/ata/pata_ninja32.c
---- linux-2.6.32.43/drivers/ata/pata_ninja32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_ninja32.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_ninja32.c linux-2.6.32.44/drivers/ata/pata_ninja32.c
+--- linux-2.6.32.44/drivers/ata/pata_ninja32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_ninja32.c 2011-04-17 15:56:46.000000000 -0400
@@ -81,7 +81,7 @@ static struct scsi_host_template ninja32
ATA_BMDMA_SHT(DRV_NAME),
};
@@ -25345,9 +25293,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_ninja32.c linux-2.6.32.43/drivers/at
.inherits = &ata_bmdma_port_ops,
.sff_dev_select = ninja32_dev_select,
.cable_detect = ata_cable_40wire,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_ns87410.c linux-2.6.32.43/drivers/ata/pata_ns87410.c
---- linux-2.6.32.43/drivers/ata/pata_ns87410.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_ns87410.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_ns87410.c linux-2.6.32.44/drivers/ata/pata_ns87410.c
+--- linux-2.6.32.44/drivers/ata/pata_ns87410.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_ns87410.c 2011-04-17 15:56:46.000000000 -0400
@@ -132,7 +132,7 @@ static struct scsi_host_template ns87410
ATA_PIO_SHT(DRV_NAME),
};
@@ -25357,9 +25305,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_ns87410.c linux-2.6.32.43/drivers/at
.inherits = &ata_sff_port_ops,
.qc_issue = ns87410_qc_issue,
.cable_detect = ata_cable_40wire,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_ns87415.c linux-2.6.32.43/drivers/ata/pata_ns87415.c
---- linux-2.6.32.43/drivers/ata/pata_ns87415.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_ns87415.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_ns87415.c linux-2.6.32.44/drivers/ata/pata_ns87415.c
+--- linux-2.6.32.44/drivers/ata/pata_ns87415.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_ns87415.c 2011-04-17 15:56:46.000000000 -0400
@@ -299,7 +299,7 @@ static u8 ns87560_bmdma_status(struct at
}
#endif /* 87560 SuperIO Support */
@@ -25378,9 +25326,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_ns87415.c linux-2.6.32.43/drivers/at
.inherits = &ns87415_pata_ops,
.sff_tf_read = ns87560_tf_read,
.sff_check_status = ns87560_check_status,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_octeon_cf.c linux-2.6.32.43/drivers/ata/pata_octeon_cf.c
---- linux-2.6.32.43/drivers/ata/pata_octeon_cf.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_octeon_cf.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_octeon_cf.c linux-2.6.32.44/drivers/ata/pata_octeon_cf.c
+--- linux-2.6.32.44/drivers/ata/pata_octeon_cf.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_octeon_cf.c 2011-04-17 15:56:46.000000000 -0400
@@ -801,6 +801,7 @@ static unsigned int octeon_cf_qc_issue(s
return 0;
}
@@ -25389,9 +25337,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_octeon_cf.c linux-2.6.32.43/drivers/
static struct ata_port_operations octeon_cf_ops = {
.inherits = &ata_sff_port_ops,
.check_atapi_dma = octeon_cf_check_atapi_dma,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_oldpiix.c linux-2.6.32.43/drivers/ata/pata_oldpiix.c
---- linux-2.6.32.43/drivers/ata/pata_oldpiix.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_oldpiix.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_oldpiix.c linux-2.6.32.44/drivers/ata/pata_oldpiix.c
+--- linux-2.6.32.44/drivers/ata/pata_oldpiix.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_oldpiix.c 2011-04-17 15:56:46.000000000 -0400
@@ -208,7 +208,7 @@ static struct scsi_host_template oldpiix
ATA_BMDMA_SHT(DRV_NAME),
};
@@ -25401,9 +25349,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_oldpiix.c linux-2.6.32.43/drivers/at
.inherits = &ata_bmdma_port_ops,
.qc_issue = oldpiix_qc_issue,
.cable_detect = ata_cable_40wire,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_opti.c linux-2.6.32.43/drivers/ata/pata_opti.c
---- linux-2.6.32.43/drivers/ata/pata_opti.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_opti.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_opti.c linux-2.6.32.44/drivers/ata/pata_opti.c
+--- linux-2.6.32.44/drivers/ata/pata_opti.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_opti.c 2011-04-17 15:56:46.000000000 -0400
@@ -152,7 +152,7 @@ static struct scsi_host_template opti_sh
ATA_PIO_SHT(DRV_NAME),
};
@@ -25413,9 +25361,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_opti.c linux-2.6.32.43/drivers/ata/p
.inherits = &ata_sff_port_ops,
.cable_detect = ata_cable_40wire,
.set_piomode = opti_set_piomode,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_optidma.c linux-2.6.32.43/drivers/ata/pata_optidma.c
---- linux-2.6.32.43/drivers/ata/pata_optidma.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_optidma.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_optidma.c linux-2.6.32.44/drivers/ata/pata_optidma.c
+--- linux-2.6.32.44/drivers/ata/pata_optidma.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_optidma.c 2011-04-17 15:56:46.000000000 -0400
@@ -337,7 +337,7 @@ static struct scsi_host_template optidma
ATA_BMDMA_SHT(DRV_NAME),
};
@@ -25434,9 +25382,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_optidma.c linux-2.6.32.43/drivers/at
.inherits = &optidma_port_ops,
.set_piomode = optiplus_set_pio_mode,
.set_dmamode = optiplus_set_dma_mode,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_palmld.c linux-2.6.32.43/drivers/ata/pata_palmld.c
---- linux-2.6.32.43/drivers/ata/pata_palmld.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_palmld.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_palmld.c linux-2.6.32.44/drivers/ata/pata_palmld.c
+--- linux-2.6.32.44/drivers/ata/pata_palmld.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_palmld.c 2011-04-17 15:56:46.000000000 -0400
@@ -37,7 +37,7 @@ static struct scsi_host_template palmld_
ATA_PIO_SHT(DRV_NAME),
};
@@ -25446,9 +25394,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_palmld.c linux-2.6.32.43/drivers/ata
.inherits = &ata_sff_port_ops,
.sff_data_xfer = ata_sff_data_xfer_noirq,
.cable_detect = ata_cable_40wire,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_pcmcia.c linux-2.6.32.43/drivers/ata/pata_pcmcia.c
---- linux-2.6.32.43/drivers/ata/pata_pcmcia.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_pcmcia.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_pcmcia.c linux-2.6.32.44/drivers/ata/pata_pcmcia.c
+--- linux-2.6.32.44/drivers/ata/pata_pcmcia.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_pcmcia.c 2011-04-17 15:56:46.000000000 -0400
@@ -162,14 +162,14 @@ static struct scsi_host_template pcmcia_
ATA_PIO_SHT(DRV_NAME),
};
@@ -25475,9 +25423,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_pcmcia.c linux-2.6.32.43/drivers/ata
info = kzalloc(sizeof(*info), GFP_KERNEL);
if (info == NULL)
-diff -urNp linux-2.6.32.43/drivers/ata/pata_pdc2027x.c linux-2.6.32.43/drivers/ata/pata_pdc2027x.c
---- linux-2.6.32.43/drivers/ata/pata_pdc2027x.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_pdc2027x.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_pdc2027x.c linux-2.6.32.44/drivers/ata/pata_pdc2027x.c
+--- linux-2.6.32.44/drivers/ata/pata_pdc2027x.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_pdc2027x.c 2011-04-17 15:56:46.000000000 -0400
@@ -132,14 +132,14 @@ static struct scsi_host_template pdc2027
ATA_BMDMA_SHT(DRV_NAME),
};
@@ -25495,9 +25443,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_pdc2027x.c linux-2.6.32.43/drivers/a
.inherits = &pdc2027x_pata100_ops,
.mode_filter = pdc2027x_mode_filter,
.set_piomode = pdc2027x_set_piomode,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_pdc202xx_old.c linux-2.6.32.43/drivers/ata/pata_pdc202xx_old.c
---- linux-2.6.32.43/drivers/ata/pata_pdc202xx_old.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_pdc202xx_old.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_pdc202xx_old.c linux-2.6.32.44/drivers/ata/pata_pdc202xx_old.c
+--- linux-2.6.32.44/drivers/ata/pata_pdc202xx_old.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_pdc202xx_old.c 2011-04-17 15:56:46.000000000 -0400
@@ -274,7 +274,7 @@ static struct scsi_host_template pdc202x
ATA_BMDMA_SHT(DRV_NAME),
};
@@ -25516,9 +25464,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_pdc202xx_old.c linux-2.6.32.43/drive
.inherits = &pdc2024x_port_ops,
.check_atapi_dma = pdc2026x_check_atapi_dma,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_platform.c linux-2.6.32.43/drivers/ata/pata_platform.c
---- linux-2.6.32.43/drivers/ata/pata_platform.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_platform.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_platform.c linux-2.6.32.44/drivers/ata/pata_platform.c
+--- linux-2.6.32.44/drivers/ata/pata_platform.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_platform.c 2011-04-17 15:56:46.000000000 -0400
@@ -48,7 +48,7 @@ static struct scsi_host_template pata_pl
ATA_PIO_SHT(DRV_NAME),
};
@@ -25528,9 +25476,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_platform.c linux-2.6.32.43/drivers/a
.inherits = &ata_sff_port_ops,
.sff_data_xfer = ata_sff_data_xfer_noirq,
.cable_detect = ata_cable_unknown,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_qdi.c linux-2.6.32.43/drivers/ata/pata_qdi.c
---- linux-2.6.32.43/drivers/ata/pata_qdi.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_qdi.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_qdi.c linux-2.6.32.44/drivers/ata/pata_qdi.c
+--- linux-2.6.32.44/drivers/ata/pata_qdi.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_qdi.c 2011-04-17 15:56:46.000000000 -0400
@@ -157,7 +157,7 @@ static struct scsi_host_template qdi_sht
ATA_PIO_SHT(DRV_NAME),
};
@@ -25549,9 +25497,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_qdi.c linux-2.6.32.43/drivers/ata/pa
.inherits = &qdi6500_port_ops,
.set_piomode = qdi6580_set_piomode,
};
-diff -urNp linux-2.6.32.43/drivers/ata/pata_radisys.c linux-2.6.32.43/drivers/ata/pata_radisys.c
---- linux-2.6.32.43/drivers/ata/pata_radisys.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_radisys.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_radisys.c linux-2.6.32.44/drivers/ata/pata_radisys.c
+--- linux-2.6.32.44/drivers/ata/pata_radisys.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_radisys.c 2011-04-17 15:56:46.000000000 -0400
@@ -187,7 +187,7 @@ static struct scsi_host_template radisys
ATA_BMDMA_SHT(DRV_NAME),
};
@@ -25561,9 +25509,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_radisys.c linux-2.6.32.43/drivers/at
.inherits = &ata_bmdma_port_ops,
.qc_issue = radisys_qc_issue,
.cable_detect = ata_cable_unknown,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_rb532_cf.c linux-2.6.32.43/drivers/ata/pata_rb532_cf.c
---- linux-2.6.32.43/drivers/ata/pata_rb532_cf.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_rb532_cf.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_rb532_cf.c linux-2.6.32.44/drivers/ata/pata_rb532_cf.c
+--- linux-2.6.32.44/drivers/ata/pata_rb532_cf.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_rb532_cf.c 2011-04-17 15:56:46.000000000 -0400
@@ -68,7 +68,7 @@ static irqreturn_t rb532_pata_irq_handle
return IRQ_HANDLED;
}
@@ -25573,9 +25521,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_rb532_cf.c linux-2.6.32.43/drivers/a
.inherits = &ata_sff_port_ops,
.sff_data_xfer = ata_sff_data_xfer32,
};
-diff -urNp linux-2.6.32.43/drivers/ata/pata_rdc.c linux-2.6.32.43/drivers/ata/pata_rdc.c
---- linux-2.6.32.43/drivers/ata/pata_rdc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_rdc.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_rdc.c linux-2.6.32.44/drivers/ata/pata_rdc.c
+--- linux-2.6.32.44/drivers/ata/pata_rdc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_rdc.c 2011-04-17 15:56:46.000000000 -0400
@@ -272,7 +272,7 @@ static void rdc_set_dmamode(struct ata_p
pci_write_config_byte(dev, 0x48, udma_enable);
}
@@ -25585,9 +25533,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_rdc.c linux-2.6.32.43/drivers/ata/pa
.inherits = &ata_bmdma32_port_ops,
.cable_detect = rdc_pata_cable_detect,
.set_piomode = rdc_set_piomode,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_rz1000.c linux-2.6.32.43/drivers/ata/pata_rz1000.c
---- linux-2.6.32.43/drivers/ata/pata_rz1000.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_rz1000.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_rz1000.c linux-2.6.32.44/drivers/ata/pata_rz1000.c
+--- linux-2.6.32.44/drivers/ata/pata_rz1000.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_rz1000.c 2011-04-17 15:56:46.000000000 -0400
@@ -54,7 +54,7 @@ static struct scsi_host_template rz1000_
ATA_PIO_SHT(DRV_NAME),
};
@@ -25597,9 +25545,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_rz1000.c linux-2.6.32.43/drivers/ata
.inherits = &ata_sff_port_ops,
.cable_detect = ata_cable_40wire,
.set_mode = rz1000_set_mode,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_sc1200.c linux-2.6.32.43/drivers/ata/pata_sc1200.c
---- linux-2.6.32.43/drivers/ata/pata_sc1200.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_sc1200.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_sc1200.c linux-2.6.32.44/drivers/ata/pata_sc1200.c
+--- linux-2.6.32.44/drivers/ata/pata_sc1200.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_sc1200.c 2011-04-17 15:56:46.000000000 -0400
@@ -207,7 +207,7 @@ static struct scsi_host_template sc1200_
.sg_tablesize = LIBATA_DUMB_MAX_PRD,
};
@@ -25609,9 +25557,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_sc1200.c linux-2.6.32.43/drivers/ata
.inherits = &ata_bmdma_port_ops,
.qc_prep = ata_sff_dumb_qc_prep,
.qc_issue = sc1200_qc_issue,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_scc.c linux-2.6.32.43/drivers/ata/pata_scc.c
---- linux-2.6.32.43/drivers/ata/pata_scc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_scc.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_scc.c linux-2.6.32.44/drivers/ata/pata_scc.c
+--- linux-2.6.32.44/drivers/ata/pata_scc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_scc.c 2011-04-17 15:56:46.000000000 -0400
@@ -965,7 +965,7 @@ static struct scsi_host_template scc_sht
ATA_BMDMA_SHT(DRV_NAME),
};
@@ -25621,9 +25569,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_scc.c linux-2.6.32.43/drivers/ata/pa
.inherits = &ata_bmdma_port_ops,
.set_piomode = scc_set_piomode,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_sch.c linux-2.6.32.43/drivers/ata/pata_sch.c
---- linux-2.6.32.43/drivers/ata/pata_sch.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_sch.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_sch.c linux-2.6.32.44/drivers/ata/pata_sch.c
+--- linux-2.6.32.44/drivers/ata/pata_sch.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_sch.c 2011-04-17 15:56:46.000000000 -0400
@@ -75,7 +75,7 @@ static struct scsi_host_template sch_sht
ATA_BMDMA_SHT(DRV_NAME),
};
@@ -25633,9 +25581,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_sch.c linux-2.6.32.43/drivers/ata/pa
.inherits = &ata_bmdma_port_ops,
.cable_detect = ata_cable_unknown,
.set_piomode = sch_set_piomode,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_serverworks.c linux-2.6.32.43/drivers/ata/pata_serverworks.c
---- linux-2.6.32.43/drivers/ata/pata_serverworks.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_serverworks.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_serverworks.c linux-2.6.32.44/drivers/ata/pata_serverworks.c
+--- linux-2.6.32.44/drivers/ata/pata_serverworks.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_serverworks.c 2011-04-17 15:56:46.000000000 -0400
@@ -299,7 +299,7 @@ static struct scsi_host_template serverw
ATA_BMDMA_SHT(DRV_NAME),
};
@@ -25654,9 +25602,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_serverworks.c linux-2.6.32.43/driver
.inherits = &serverworks_osb4_port_ops,
.mode_filter = serverworks_csb_filter,
};
-diff -urNp linux-2.6.32.43/drivers/ata/pata_sil680.c linux-2.6.32.43/drivers/ata/pata_sil680.c
---- linux-2.6.32.43/drivers/ata/pata_sil680.c 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_sil680.c 2011-06-25 12:56:37.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_sil680.c linux-2.6.32.44/drivers/ata/pata_sil680.c
+--- linux-2.6.32.44/drivers/ata/pata_sil680.c 2011-06-25 12:55:34.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_sil680.c 2011-06-25 12:56:37.000000000 -0400
@@ -194,7 +194,7 @@ static struct scsi_host_template sil680_
ATA_BMDMA_SHT(DRV_NAME),
};
@@ -25666,9 +25614,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_sil680.c linux-2.6.32.43/drivers/ata
.inherits = &ata_bmdma32_port_ops,
.cable_detect = sil680_cable_detect,
.set_piomode = sil680_set_piomode,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_sis.c linux-2.6.32.43/drivers/ata/pata_sis.c
---- linux-2.6.32.43/drivers/ata/pata_sis.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_sis.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_sis.c linux-2.6.32.44/drivers/ata/pata_sis.c
+--- linux-2.6.32.44/drivers/ata/pata_sis.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_sis.c 2011-04-17 15:56:46.000000000 -0400
@@ -503,47 +503,47 @@ static struct scsi_host_template sis_sht
ATA_BMDMA_SHT(DRV_NAME),
};
@@ -25724,9 +25672,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_sis.c linux-2.6.32.43/drivers/ata/pa
.inherits = &sis_base_ops,
.set_piomode = sis_old_set_piomode,
.set_dmamode = sis_old_set_dmamode,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_sl82c105.c linux-2.6.32.43/drivers/ata/pata_sl82c105.c
---- linux-2.6.32.43/drivers/ata/pata_sl82c105.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_sl82c105.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_sl82c105.c linux-2.6.32.44/drivers/ata/pata_sl82c105.c
+--- linux-2.6.32.44/drivers/ata/pata_sl82c105.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_sl82c105.c 2011-04-17 15:56:46.000000000 -0400
@@ -231,7 +231,7 @@ static struct scsi_host_template sl82c10
ATA_BMDMA_SHT(DRV_NAME),
};
@@ -25736,9 +25684,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_sl82c105.c linux-2.6.32.43/drivers/a
.inherits = &ata_bmdma_port_ops,
.qc_defer = sl82c105_qc_defer,
.bmdma_start = sl82c105_bmdma_start,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_triflex.c linux-2.6.32.43/drivers/ata/pata_triflex.c
---- linux-2.6.32.43/drivers/ata/pata_triflex.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_triflex.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_triflex.c linux-2.6.32.44/drivers/ata/pata_triflex.c
+--- linux-2.6.32.44/drivers/ata/pata_triflex.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_triflex.c 2011-04-17 15:56:46.000000000 -0400
@@ -178,7 +178,7 @@ static struct scsi_host_template triflex
ATA_BMDMA_SHT(DRV_NAME),
};
@@ -25748,9 +25696,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_triflex.c linux-2.6.32.43/drivers/at
.inherits = &ata_bmdma_port_ops,
.bmdma_start = triflex_bmdma_start,
.bmdma_stop = triflex_bmdma_stop,
-diff -urNp linux-2.6.32.43/drivers/ata/pata_via.c linux-2.6.32.43/drivers/ata/pata_via.c
---- linux-2.6.32.43/drivers/ata/pata_via.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_via.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_via.c linux-2.6.32.44/drivers/ata/pata_via.c
+--- linux-2.6.32.44/drivers/ata/pata_via.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_via.c 2011-04-17 15:56:46.000000000 -0400
@@ -419,7 +419,7 @@ static struct scsi_host_template via_sht
ATA_BMDMA_SHT(DRV_NAME),
};
@@ -25769,9 +25717,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_via.c linux-2.6.32.43/drivers/ata/pa
.inherits = &via_port_ops,
.sff_data_xfer = ata_sff_data_xfer_noirq,
};
-diff -urNp linux-2.6.32.43/drivers/ata/pata_winbond.c linux-2.6.32.43/drivers/ata/pata_winbond.c
---- linux-2.6.32.43/drivers/ata/pata_winbond.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pata_winbond.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pata_winbond.c linux-2.6.32.44/drivers/ata/pata_winbond.c
+--- linux-2.6.32.44/drivers/ata/pata_winbond.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pata_winbond.c 2011-04-17 15:56:46.000000000 -0400
@@ -125,7 +125,7 @@ static struct scsi_host_template winbond
ATA_PIO_SHT(DRV_NAME),
};
@@ -25781,9 +25729,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pata_winbond.c linux-2.6.32.43/drivers/at
.inherits = &ata_sff_port_ops,
.sff_data_xfer = winbond_data_xfer,
.cable_detect = ata_cable_40wire,
-diff -urNp linux-2.6.32.43/drivers/ata/pdc_adma.c linux-2.6.32.43/drivers/ata/pdc_adma.c
---- linux-2.6.32.43/drivers/ata/pdc_adma.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/pdc_adma.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/pdc_adma.c linux-2.6.32.44/drivers/ata/pdc_adma.c
+--- linux-2.6.32.44/drivers/ata/pdc_adma.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/pdc_adma.c 2011-04-17 15:56:46.000000000 -0400
@@ -145,7 +145,7 @@ static struct scsi_host_template adma_at
.dma_boundary = ADMA_DMA_BOUNDARY,
};
@@ -25793,9 +25741,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/pdc_adma.c linux-2.6.32.43/drivers/ata/pd
.inherits = &ata_sff_port_ops,
.lost_interrupt = ATA_OP_NULL,
-diff -urNp linux-2.6.32.43/drivers/ata/sata_fsl.c linux-2.6.32.43/drivers/ata/sata_fsl.c
---- linux-2.6.32.43/drivers/ata/sata_fsl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/sata_fsl.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/sata_fsl.c linux-2.6.32.44/drivers/ata/sata_fsl.c
+--- linux-2.6.32.44/drivers/ata/sata_fsl.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/sata_fsl.c 2011-04-17 15:56:46.000000000 -0400
@@ -1258,7 +1258,7 @@ static struct scsi_host_template sata_fs
.dma_boundary = ATA_DMA_BOUNDARY,
};
@@ -25805,9 +25753,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/sata_fsl.c linux-2.6.32.43/drivers/ata/sa
.inherits = &sata_pmp_port_ops,
.qc_defer = ata_std_qc_defer,
-diff -urNp linux-2.6.32.43/drivers/ata/sata_inic162x.c linux-2.6.32.43/drivers/ata/sata_inic162x.c
---- linux-2.6.32.43/drivers/ata/sata_inic162x.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/sata_inic162x.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/sata_inic162x.c linux-2.6.32.44/drivers/ata/sata_inic162x.c
+--- linux-2.6.32.44/drivers/ata/sata_inic162x.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/sata_inic162x.c 2011-04-17 15:56:46.000000000 -0400
@@ -721,7 +721,7 @@ static int inic_port_start(struct ata_po
return 0;
}
@@ -25817,9 +25765,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/sata_inic162x.c linux-2.6.32.43/drivers/a
.inherits = &sata_port_ops,
.check_atapi_dma = inic_check_atapi_dma,
-diff -urNp linux-2.6.32.43/drivers/ata/sata_mv.c linux-2.6.32.43/drivers/ata/sata_mv.c
---- linux-2.6.32.43/drivers/ata/sata_mv.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/sata_mv.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/sata_mv.c linux-2.6.32.44/drivers/ata/sata_mv.c
+--- linux-2.6.32.44/drivers/ata/sata_mv.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/sata_mv.c 2011-04-17 15:56:46.000000000 -0400
@@ -656,7 +656,7 @@ static struct scsi_host_template mv6_sht
.dma_boundary = MV_DMA_BOUNDARY,
};
@@ -25847,9 +25795,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/sata_mv.c linux-2.6.32.43/drivers/ata/sat
.inherits = &mv6_ops,
.dev_config = ATA_OP_NULL,
.qc_prep = mv_qc_prep_iie,
-diff -urNp linux-2.6.32.43/drivers/ata/sata_nv.c linux-2.6.32.43/drivers/ata/sata_nv.c
---- linux-2.6.32.43/drivers/ata/sata_nv.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/sata_nv.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/sata_nv.c linux-2.6.32.44/drivers/ata/sata_nv.c
+--- linux-2.6.32.44/drivers/ata/sata_nv.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/sata_nv.c 2011-04-17 15:56:46.000000000 -0400
@@ -464,7 +464,7 @@ static struct scsi_host_template nv_swnc
* cases. Define nv_hardreset() which only kicks in for post-boot
* probing and use it for all variants.
@@ -25892,9 +25840,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/sata_nv.c linux-2.6.32.43/drivers/ata/sat
.inherits = &nv_generic_ops,
.qc_defer = ata_std_qc_defer,
-diff -urNp linux-2.6.32.43/drivers/ata/sata_promise.c linux-2.6.32.43/drivers/ata/sata_promise.c
---- linux-2.6.32.43/drivers/ata/sata_promise.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/sata_promise.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/sata_promise.c linux-2.6.32.44/drivers/ata/sata_promise.c
+--- linux-2.6.32.44/drivers/ata/sata_promise.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/sata_promise.c 2011-04-17 15:56:46.000000000 -0400
@@ -195,7 +195,7 @@ static const struct ata_port_operations
.error_handler = pdc_error_handler,
};
@@ -25921,9 +25869,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/sata_promise.c linux-2.6.32.43/drivers/at
.inherits = &pdc_common_ops,
.cable_detect = pdc_pata_cable_detect,
.freeze = pdc_freeze,
-diff -urNp linux-2.6.32.43/drivers/ata/sata_qstor.c linux-2.6.32.43/drivers/ata/sata_qstor.c
---- linux-2.6.32.43/drivers/ata/sata_qstor.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/sata_qstor.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/sata_qstor.c linux-2.6.32.44/drivers/ata/sata_qstor.c
+--- linux-2.6.32.44/drivers/ata/sata_qstor.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/sata_qstor.c 2011-04-17 15:56:46.000000000 -0400
@@ -132,7 +132,7 @@ static struct scsi_host_template qs_ata_
.dma_boundary = QS_DMA_BOUNDARY,
};
@@ -25933,9 +25881,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/sata_qstor.c linux-2.6.32.43/drivers/ata/
.inherits = &ata_sff_port_ops,
.check_atapi_dma = qs_check_atapi_dma,
-diff -urNp linux-2.6.32.43/drivers/ata/sata_sil24.c linux-2.6.32.43/drivers/ata/sata_sil24.c
---- linux-2.6.32.43/drivers/ata/sata_sil24.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/sata_sil24.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/sata_sil24.c linux-2.6.32.44/drivers/ata/sata_sil24.c
+--- linux-2.6.32.44/drivers/ata/sata_sil24.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/sata_sil24.c 2011-04-17 15:56:46.000000000 -0400
@@ -388,7 +388,7 @@ static struct scsi_host_template sil24_s
.dma_boundary = ATA_DMA_BOUNDARY,
};
@@ -25945,9 +25893,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/sata_sil24.c linux-2.6.32.43/drivers/ata/
.inherits = &sata_pmp_port_ops,
.qc_defer = sil24_qc_defer,
-diff -urNp linux-2.6.32.43/drivers/ata/sata_sil.c linux-2.6.32.43/drivers/ata/sata_sil.c
---- linux-2.6.32.43/drivers/ata/sata_sil.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/sata_sil.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/sata_sil.c linux-2.6.32.44/drivers/ata/sata_sil.c
+--- linux-2.6.32.44/drivers/ata/sata_sil.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/sata_sil.c 2011-04-17 15:56:46.000000000 -0400
@@ -182,7 +182,7 @@ static struct scsi_host_template sil_sht
.sg_tablesize = ATA_MAX_PRD
};
@@ -25957,9 +25905,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/sata_sil.c linux-2.6.32.43/drivers/ata/sa
.inherits = &ata_bmdma32_port_ops,
.dev_config = sil_dev_config,
.set_mode = sil_set_mode,
-diff -urNp linux-2.6.32.43/drivers/ata/sata_sis.c linux-2.6.32.43/drivers/ata/sata_sis.c
---- linux-2.6.32.43/drivers/ata/sata_sis.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/sata_sis.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/sata_sis.c linux-2.6.32.44/drivers/ata/sata_sis.c
+--- linux-2.6.32.44/drivers/ata/sata_sis.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/sata_sis.c 2011-04-17 15:56:46.000000000 -0400
@@ -89,7 +89,7 @@ static struct scsi_host_template sis_sht
ATA_BMDMA_SHT(DRV_NAME),
};
@@ -25969,9 +25917,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/sata_sis.c linux-2.6.32.43/drivers/ata/sa
.inherits = &ata_bmdma_port_ops,
.scr_read = sis_scr_read,
.scr_write = sis_scr_write,
-diff -urNp linux-2.6.32.43/drivers/ata/sata_svw.c linux-2.6.32.43/drivers/ata/sata_svw.c
---- linux-2.6.32.43/drivers/ata/sata_svw.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/sata_svw.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/sata_svw.c linux-2.6.32.44/drivers/ata/sata_svw.c
+--- linux-2.6.32.44/drivers/ata/sata_svw.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/sata_svw.c 2011-04-17 15:56:46.000000000 -0400
@@ -344,7 +344,7 @@ static struct scsi_host_template k2_sata
};
@@ -25981,9 +25929,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/sata_svw.c linux-2.6.32.43/drivers/ata/sa
.inherits = &ata_bmdma_port_ops,
.sff_tf_load = k2_sata_tf_load,
.sff_tf_read = k2_sata_tf_read,
-diff -urNp linux-2.6.32.43/drivers/ata/sata_sx4.c linux-2.6.32.43/drivers/ata/sata_sx4.c
---- linux-2.6.32.43/drivers/ata/sata_sx4.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/sata_sx4.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/sata_sx4.c linux-2.6.32.44/drivers/ata/sata_sx4.c
+--- linux-2.6.32.44/drivers/ata/sata_sx4.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/sata_sx4.c 2011-04-17 15:56:46.000000000 -0400
@@ -248,7 +248,7 @@ static struct scsi_host_template pdc_sat
};
@@ -25993,9 +25941,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/sata_sx4.c linux-2.6.32.43/drivers/ata/sa
.inherits = &ata_sff_port_ops,
.check_atapi_dma = pdc_check_atapi_dma,
-diff -urNp linux-2.6.32.43/drivers/ata/sata_uli.c linux-2.6.32.43/drivers/ata/sata_uli.c
---- linux-2.6.32.43/drivers/ata/sata_uli.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/sata_uli.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/sata_uli.c linux-2.6.32.44/drivers/ata/sata_uli.c
+--- linux-2.6.32.44/drivers/ata/sata_uli.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/sata_uli.c 2011-04-17 15:56:46.000000000 -0400
@@ -79,7 +79,7 @@ static struct scsi_host_template uli_sht
ATA_BMDMA_SHT(DRV_NAME),
};
@@ -26005,9 +25953,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/sata_uli.c linux-2.6.32.43/drivers/ata/sa
.inherits = &ata_bmdma_port_ops,
.scr_read = uli_scr_read,
.scr_write = uli_scr_write,
-diff -urNp linux-2.6.32.43/drivers/ata/sata_via.c linux-2.6.32.43/drivers/ata/sata_via.c
---- linux-2.6.32.43/drivers/ata/sata_via.c 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/sata_via.c 2011-05-10 22:15:08.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/sata_via.c linux-2.6.32.44/drivers/ata/sata_via.c
+--- linux-2.6.32.44/drivers/ata/sata_via.c 2011-05-10 22:12:01.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/sata_via.c 2011-05-10 22:15:08.000000000 -0400
@@ -115,32 +115,32 @@ static struct scsi_host_template svia_sh
ATA_BMDMA_SHT(DRV_NAME),
};
@@ -26046,9 +25994,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/sata_via.c linux-2.6.32.43/drivers/ata/sa
.inherits = &svia_base_ops,
.hardreset = sata_std_hardreset,
.scr_read = vt8251_scr_read,
-diff -urNp linux-2.6.32.43/drivers/ata/sata_vsc.c linux-2.6.32.43/drivers/ata/sata_vsc.c
---- linux-2.6.32.43/drivers/ata/sata_vsc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ata/sata_vsc.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ata/sata_vsc.c linux-2.6.32.44/drivers/ata/sata_vsc.c
+--- linux-2.6.32.44/drivers/ata/sata_vsc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ata/sata_vsc.c 2011-04-17 15:56:46.000000000 -0400
@@ -306,7 +306,7 @@ static struct scsi_host_template vsc_sat
};
@@ -26058,9 +26006,9 @@ diff -urNp linux-2.6.32.43/drivers/ata/sata_vsc.c linux-2.6.32.43/drivers/ata/sa
.inherits = &ata_bmdma_port_ops,
/* The IRQ handling is not quite standard SFF behaviour so we
cannot use the default lost interrupt handler */
-diff -urNp linux-2.6.32.43/drivers/atm/adummy.c linux-2.6.32.43/drivers/atm/adummy.c
---- linux-2.6.32.43/drivers/atm/adummy.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/atm/adummy.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/atm/adummy.c linux-2.6.32.44/drivers/atm/adummy.c
+--- linux-2.6.32.44/drivers/atm/adummy.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/atm/adummy.c 2011-04-17 15:56:46.000000000 -0400
@@ -77,7 +77,7 @@ adummy_send(struct atm_vcc *vcc, struct
vcc->pop(vcc, skb);
else
@@ -26070,9 +26018,9 @@ diff -urNp linux-2.6.32.43/drivers/atm/adummy.c linux-2.6.32.43/drivers/atm/adum
return 0;
}
-diff -urNp linux-2.6.32.43/drivers/atm/ambassador.c linux-2.6.32.43/drivers/atm/ambassador.c
---- linux-2.6.32.43/drivers/atm/ambassador.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/atm/ambassador.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/atm/ambassador.c linux-2.6.32.44/drivers/atm/ambassador.c
+--- linux-2.6.32.44/drivers/atm/ambassador.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/atm/ambassador.c 2011-04-17 15:56:46.000000000 -0400
@@ -453,7 +453,7 @@ static void tx_complete (amb_dev * dev,
PRINTD (DBG_FLOW|DBG_TX, "tx_complete %p %p", dev, tx);
@@ -26109,9 +26057,9 @@ diff -urNp linux-2.6.32.43/drivers/atm/ambassador.c linux-2.6.32.43/drivers/atm/
return -ENOMEM; // ?
}
-diff -urNp linux-2.6.32.43/drivers/atm/atmtcp.c linux-2.6.32.43/drivers/atm/atmtcp.c
---- linux-2.6.32.43/drivers/atm/atmtcp.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/atm/atmtcp.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/atm/atmtcp.c linux-2.6.32.44/drivers/atm/atmtcp.c
+--- linux-2.6.32.44/drivers/atm/atmtcp.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/atm/atmtcp.c 2011-04-17 15:56:46.000000000 -0400
@@ -206,7 +206,7 @@ static int atmtcp_v_send(struct atm_vcc
if (vcc->pop) vcc->pop(vcc,skb);
else dev_kfree_skb(skb);
@@ -26161,9 +26109,9 @@ diff -urNp linux-2.6.32.43/drivers/atm/atmtcp.c linux-2.6.32.43/drivers/atm/atmt
done:
if (vcc->pop) vcc->pop(vcc,skb);
else dev_kfree_skb(skb);
-diff -urNp linux-2.6.32.43/drivers/atm/eni.c linux-2.6.32.43/drivers/atm/eni.c
---- linux-2.6.32.43/drivers/atm/eni.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/atm/eni.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/atm/eni.c linux-2.6.32.44/drivers/atm/eni.c
+--- linux-2.6.32.44/drivers/atm/eni.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/atm/eni.c 2011-04-17 15:56:46.000000000 -0400
@@ -525,7 +525,7 @@ static int rx_aal0(struct atm_vcc *vcc)
DPRINTK(DEV_LABEL "(itf %d): trashing empty cell\n",
vcc->dev->number);
@@ -26209,9 +26157,9 @@ diff -urNp linux-2.6.32.43/drivers/atm/eni.c linux-2.6.32.43/drivers/atm/eni.c
wake_up(&eni_dev->tx_wait);
dma_complete++;
}
-diff -urNp linux-2.6.32.43/drivers/atm/firestream.c linux-2.6.32.43/drivers/atm/firestream.c
---- linux-2.6.32.43/drivers/atm/firestream.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/atm/firestream.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/atm/firestream.c linux-2.6.32.44/drivers/atm/firestream.c
+--- linux-2.6.32.44/drivers/atm/firestream.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/atm/firestream.c 2011-04-17 15:56:46.000000000 -0400
@@ -748,7 +748,7 @@ static void process_txdone_queue (struct
}
}
@@ -26245,9 +26193,9 @@ diff -urNp linux-2.6.32.43/drivers/atm/firestream.c linux-2.6.32.43/drivers/atm/
break;
default: /* Hmm. Haven't written the code to handle the others yet... -- REW */
printk (KERN_WARNING "Don't know what to do with RX status %x: %s.\n",
-diff -urNp linux-2.6.32.43/drivers/atm/fore200e.c linux-2.6.32.43/drivers/atm/fore200e.c
---- linux-2.6.32.43/drivers/atm/fore200e.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/atm/fore200e.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/atm/fore200e.c linux-2.6.32.44/drivers/atm/fore200e.c
+--- linux-2.6.32.44/drivers/atm/fore200e.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/atm/fore200e.c 2011-04-17 15:56:46.000000000 -0400
@@ -931,9 +931,9 @@ fore200e_tx_irq(struct fore200e* fore200
#endif
/* check error condition */
@@ -26304,9 +26252,9 @@ diff -urNp linux-2.6.32.43/drivers/atm/fore200e.c linux-2.6.32.43/drivers/atm/fo
fore200e->tx_sat++;
DPRINTK(2, "tx queue of device %s is saturated, PDU dropped - heartbeat is %08x\n",
-diff -urNp linux-2.6.32.43/drivers/atm/he.c linux-2.6.32.43/drivers/atm/he.c
---- linux-2.6.32.43/drivers/atm/he.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/atm/he.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/atm/he.c linux-2.6.32.44/drivers/atm/he.c
+--- linux-2.6.32.44/drivers/atm/he.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/atm/he.c 2011-04-17 15:56:46.000000000 -0400
@@ -1769,7 +1769,7 @@ he_service_rbrq(struct he_dev *he_dev, i
if (RBRQ_HBUF_ERR(he_dev->rbrq_head)) {
@@ -26388,9 +26336,9 @@ diff -urNp linux-2.6.32.43/drivers/atm/he.c linux-2.6.32.43/drivers/atm/he.c
return 0;
}
-diff -urNp linux-2.6.32.43/drivers/atm/horizon.c linux-2.6.32.43/drivers/atm/horizon.c
---- linux-2.6.32.43/drivers/atm/horizon.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/atm/horizon.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/atm/horizon.c linux-2.6.32.44/drivers/atm/horizon.c
+--- linux-2.6.32.44/drivers/atm/horizon.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/atm/horizon.c 2011-04-17 15:56:46.000000000 -0400
@@ -1033,7 +1033,7 @@ static void rx_schedule (hrz_dev * dev,
{
struct atm_vcc * vcc = ATM_SKB(skb)->vcc;
@@ -26409,9 +26357,9 @@ diff -urNp linux-2.6.32.43/drivers/atm/horizon.c linux-2.6.32.43/drivers/atm/hor
// free the skb
hrz_kfree_skb (skb);
-diff -urNp linux-2.6.32.43/drivers/atm/idt77252.c linux-2.6.32.43/drivers/atm/idt77252.c
---- linux-2.6.32.43/drivers/atm/idt77252.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/atm/idt77252.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/atm/idt77252.c linux-2.6.32.44/drivers/atm/idt77252.c
+--- linux-2.6.32.44/drivers/atm/idt77252.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/atm/idt77252.c 2011-04-17 15:56:46.000000000 -0400
@@ -810,7 +810,7 @@ drain_scq(struct idt77252_dev *card, str
else
dev_kfree_skb(skb);
@@ -26566,9 +26514,9 @@ diff -urNp linux-2.6.32.43/drivers/atm/idt77252.c linux-2.6.32.43/drivers/atm/id
return -ENOMEM;
}
atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
-diff -urNp linux-2.6.32.43/drivers/atm/iphase.c linux-2.6.32.43/drivers/atm/iphase.c
---- linux-2.6.32.43/drivers/atm/iphase.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/atm/iphase.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/atm/iphase.c linux-2.6.32.44/drivers/atm/iphase.c
+--- linux-2.6.32.44/drivers/atm/iphase.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/atm/iphase.c 2011-04-17 15:56:46.000000000 -0400
@@ -1123,7 +1123,7 @@ static int rx_pkt(struct atm_dev *dev)
status = (u_short) (buf_desc_ptr->desc_mode);
if (status & (RX_CER | RX_PTE | RX_OFL))
@@ -26665,9 +26613,9 @@ diff -urNp linux-2.6.32.43/drivers/atm/iphase.c linux-2.6.32.43/drivers/atm/ipha
if (iavcc->vc_desc_cnt > 10) {
vcc->tx_quota = vcc->tx_quota * 3 / 4;
printk("Tx1: vcc->tx_quota = %d \n", (u32)vcc->tx_quota );
-diff -urNp linux-2.6.32.43/drivers/atm/lanai.c linux-2.6.32.43/drivers/atm/lanai.c
---- linux-2.6.32.43/drivers/atm/lanai.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/atm/lanai.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/atm/lanai.c linux-2.6.32.44/drivers/atm/lanai.c
+--- linux-2.6.32.44/drivers/atm/lanai.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/atm/lanai.c 2011-04-17 15:56:46.000000000 -0400
@@ -1305,7 +1305,7 @@ static void lanai_send_one_aal5(struct l
vcc_tx_add_aal5_trailer(lvcc, skb->len, 0, 0);
lanai_endtx(lanai, lvcc);
@@ -26722,9 +26670,9 @@ diff -urNp linux-2.6.32.43/drivers/atm/lanai.c linux-2.6.32.43/drivers/atm/lanai
lvcc->stats.x.aal5.service_rxcrc++;
lvcc->rx.buf.ptr = &lvcc->rx.buf.start[SERVICE_GET_END(s) * 4];
cardvcc_write(lvcc, SERVICE_GET_END(s), vcc_rxreadptr);
-diff -urNp linux-2.6.32.43/drivers/atm/nicstar.c linux-2.6.32.43/drivers/atm/nicstar.c
---- linux-2.6.32.43/drivers/atm/nicstar.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/atm/nicstar.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/atm/nicstar.c linux-2.6.32.44/drivers/atm/nicstar.c
+--- linux-2.6.32.44/drivers/atm/nicstar.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/atm/nicstar.c 2011-04-17 15:56:46.000000000 -0400
@@ -1723,7 +1723,7 @@ static int ns_send(struct atm_vcc *vcc,
if ((vc = (vc_map *) vcc->dev_data) == NULL)
{
@@ -26927,9 +26875,9 @@ diff -urNp linux-2.6.32.43/drivers/atm/nicstar.c linux-2.6.32.43/drivers/atm/nic
}
}
-diff -urNp linux-2.6.32.43/drivers/atm/solos-pci.c linux-2.6.32.43/drivers/atm/solos-pci.c
---- linux-2.6.32.43/drivers/atm/solos-pci.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.43/drivers/atm/solos-pci.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/atm/solos-pci.c linux-2.6.32.44/drivers/atm/solos-pci.c
+--- linux-2.6.32.44/drivers/atm/solos-pci.c 2011-04-17 17:00:52.000000000 -0400
++++ linux-2.6.32.44/drivers/atm/solos-pci.c 2011-05-16 21:46:57.000000000 -0400
@@ -708,7 +708,7 @@ void solos_bh(unsigned long card_arg)
}
atm_charge(vcc, skb->truesize);
@@ -26957,9 +26905,9 @@ diff -urNp linux-2.6.32.43/drivers/atm/solos-pci.c linux-2.6.32.43/drivers/atm/s
solos_pop(vcc, oldskb);
} else
dev_kfree_skb_irq(oldskb);
-diff -urNp linux-2.6.32.43/drivers/atm/suni.c linux-2.6.32.43/drivers/atm/suni.c
---- linux-2.6.32.43/drivers/atm/suni.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/atm/suni.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/atm/suni.c linux-2.6.32.44/drivers/atm/suni.c
+--- linux-2.6.32.44/drivers/atm/suni.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/atm/suni.c 2011-04-17 15:56:46.000000000 -0400
@@ -49,8 +49,8 @@ static DEFINE_SPINLOCK(sunis_lock);
@@ -26971,9 +26919,9 @@ diff -urNp linux-2.6.32.43/drivers/atm/suni.c linux-2.6.32.43/drivers/atm/suni.c
static void suni_hz(unsigned long from_timer)
-diff -urNp linux-2.6.32.43/drivers/atm/uPD98402.c linux-2.6.32.43/drivers/atm/uPD98402.c
---- linux-2.6.32.43/drivers/atm/uPD98402.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/atm/uPD98402.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/atm/uPD98402.c linux-2.6.32.44/drivers/atm/uPD98402.c
+--- linux-2.6.32.44/drivers/atm/uPD98402.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/atm/uPD98402.c 2011-04-17 15:56:46.000000000 -0400
@@ -41,7 +41,7 @@ static int fetch_stats(struct atm_dev *d
struct sonet_stats tmp;
int error = 0;
@@ -27018,9 +26966,9 @@ diff -urNp linux-2.6.32.43/drivers/atm/uPD98402.c linux-2.6.32.43/drivers/atm/uP
return 0;
}
-diff -urNp linux-2.6.32.43/drivers/atm/zatm.c linux-2.6.32.43/drivers/atm/zatm.c
---- linux-2.6.32.43/drivers/atm/zatm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/atm/zatm.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/atm/zatm.c linux-2.6.32.44/drivers/atm/zatm.c
+--- linux-2.6.32.44/drivers/atm/zatm.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/atm/zatm.c 2011-04-17 15:56:46.000000000 -0400
@@ -458,7 +458,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
}
if (!size) {
@@ -27048,9 +26996,9 @@ diff -urNp linux-2.6.32.43/drivers/atm/zatm.c linux-2.6.32.43/drivers/atm/zatm.c
wake_up(&zatm_vcc->tx_wait);
}
-diff -urNp linux-2.6.32.43/drivers/base/bus.c linux-2.6.32.43/drivers/base/bus.c
---- linux-2.6.32.43/drivers/base/bus.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/base/bus.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/base/bus.c linux-2.6.32.44/drivers/base/bus.c
+--- linux-2.6.32.44/drivers/base/bus.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/base/bus.c 2011-04-17 15:56:46.000000000 -0400
@@ -70,7 +70,7 @@ static ssize_t drv_attr_store(struct kob
return ret;
}
@@ -27078,9 +27026,9 @@ diff -urNp linux-2.6.32.43/drivers/base/bus.c linux-2.6.32.43/drivers/base/bus.c
.filter = bus_uevent_filter,
};
-diff -urNp linux-2.6.32.43/drivers/base/class.c linux-2.6.32.43/drivers/base/class.c
---- linux-2.6.32.43/drivers/base/class.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/base/class.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/base/class.c linux-2.6.32.44/drivers/base/class.c
+--- linux-2.6.32.44/drivers/base/class.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/base/class.c 2011-04-17 15:56:46.000000000 -0400
@@ -63,7 +63,7 @@ static void class_release(struct kobject
kfree(cp);
}
@@ -27090,9 +27038,9 @@ diff -urNp linux-2.6.32.43/drivers/base/class.c linux-2.6.32.43/drivers/base/cla
.show = class_attr_show,
.store = class_attr_store,
};
-diff -urNp linux-2.6.32.43/drivers/base/core.c linux-2.6.32.43/drivers/base/core.c
---- linux-2.6.32.43/drivers/base/core.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/base/core.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/base/core.c linux-2.6.32.44/drivers/base/core.c
+--- linux-2.6.32.44/drivers/base/core.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/base/core.c 2011-04-17 15:56:46.000000000 -0400
@@ -100,7 +100,7 @@ static ssize_t dev_attr_store(struct kob
return ret;
}
@@ -27111,9 +27059,9 @@ diff -urNp linux-2.6.32.43/drivers/base/core.c linux-2.6.32.43/drivers/base/core
.filter = dev_uevent_filter,
.name = dev_uevent_name,
.uevent = dev_uevent,
-diff -urNp linux-2.6.32.43/drivers/base/memory.c linux-2.6.32.43/drivers/base/memory.c
---- linux-2.6.32.43/drivers/base/memory.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/base/memory.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/base/memory.c linux-2.6.32.44/drivers/base/memory.c
+--- linux-2.6.32.44/drivers/base/memory.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/base/memory.c 2011-04-17 15:56:46.000000000 -0400
@@ -44,7 +44,7 @@ static int memory_uevent(struct kset *ks
return retval;
}
@@ -27123,9 +27071,9 @@ diff -urNp linux-2.6.32.43/drivers/base/memory.c linux-2.6.32.43/drivers/base/me
.name = memory_uevent_name,
.uevent = memory_uevent,
};
-diff -urNp linux-2.6.32.43/drivers/base/sys.c linux-2.6.32.43/drivers/base/sys.c
---- linux-2.6.32.43/drivers/base/sys.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/base/sys.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/base/sys.c linux-2.6.32.44/drivers/base/sys.c
+--- linux-2.6.32.44/drivers/base/sys.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/base/sys.c 2011-04-17 15:56:46.000000000 -0400
@@ -54,7 +54,7 @@ sysdev_store(struct kobject *kobj, struc
return -EIO;
}
@@ -27144,9 +27092,9 @@ diff -urNp linux-2.6.32.43/drivers/base/sys.c linux-2.6.32.43/drivers/base/sys.c
.show = sysdev_class_show,
.store = sysdev_class_store,
};
-diff -urNp linux-2.6.32.43/drivers/block/cciss.c linux-2.6.32.43/drivers/block/cciss.c
---- linux-2.6.32.43/drivers/block/cciss.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/block/cciss.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/block/cciss.c linux-2.6.32.44/drivers/block/cciss.c
+--- linux-2.6.32.44/drivers/block/cciss.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/block/cciss.c 2011-08-05 20:33:55.000000000 -0400
@@ -1011,6 +1011,8 @@ static int cciss_ioctl32_passthru(struct
int err;
u32 cp;
@@ -27256,9 +27204,9 @@ diff -urNp linux-2.6.32.43/drivers/block/cciss.c linux-2.6.32.43/drivers/block/c
/* Get the firmware version */
inq_buff = kzalloc(sizeof(InquiryData_struct), GFP_KERNEL);
-diff -urNp linux-2.6.32.43/drivers/block/cciss.h linux-2.6.32.43/drivers/block/cciss.h
---- linux-2.6.32.43/drivers/block/cciss.h 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.43/drivers/block/cciss.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/block/cciss.h linux-2.6.32.44/drivers/block/cciss.h
+--- linux-2.6.32.44/drivers/block/cciss.h 2011-08-09 18:35:28.000000000 -0400
++++ linux-2.6.32.44/drivers/block/cciss.h 2011-08-09 18:33:59.000000000 -0400
@@ -90,7 +90,7 @@ struct ctlr_info
// information about each logical volume
drive_info_struct *drv[CISS_MAX_LUN];
@@ -27268,9 +27216,9 @@ diff -urNp linux-2.6.32.43/drivers/block/cciss.h linux-2.6.32.43/drivers/block/c
/* queue and queue Info */
struct hlist_head reqQ;
-diff -urNp linux-2.6.32.43/drivers/block/cpqarray.c linux-2.6.32.43/drivers/block/cpqarray.c
---- linux-2.6.32.43/drivers/block/cpqarray.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/block/cpqarray.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/block/cpqarray.c linux-2.6.32.44/drivers/block/cpqarray.c
+--- linux-2.6.32.44/drivers/block/cpqarray.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/block/cpqarray.c 2011-08-05 20:33:55.000000000 -0400
@@ -402,7 +402,7 @@ static int __init cpqarray_register_ctlr
if (register_blkdev(COMPAQ_SMART2_MAJOR+i, hba[i]->devname)) {
goto Enomem4;
@@ -27396,9 +27344,9 @@ diff -urNp linux-2.6.32.43/drivers/block/cpqarray.c linux-2.6.32.43/drivers/bloc
if (done == 0) {
udelay(10); /* a short fixed delay */
} else
-diff -urNp linux-2.6.32.43/drivers/block/cpqarray.h linux-2.6.32.43/drivers/block/cpqarray.h
---- linux-2.6.32.43/drivers/block/cpqarray.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/block/cpqarray.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/block/cpqarray.h linux-2.6.32.44/drivers/block/cpqarray.h
+--- linux-2.6.32.44/drivers/block/cpqarray.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/block/cpqarray.h 2011-08-05 20:33:55.000000000 -0400
@@ -99,7 +99,7 @@ struct ctlr_info {
drv_info_t drv[NWD];
struct proc_dir_entry *proc;
@@ -27408,9 +27356,9 @@ diff -urNp linux-2.6.32.43/drivers/block/cpqarray.h linux-2.6.32.43/drivers/bloc
cmdlist_t *reqQ;
cmdlist_t *cmpQ;
-diff -urNp linux-2.6.32.43/drivers/block/DAC960.c linux-2.6.32.43/drivers/block/DAC960.c
---- linux-2.6.32.43/drivers/block/DAC960.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/block/DAC960.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/block/DAC960.c linux-2.6.32.44/drivers/block/DAC960.c
+--- linux-2.6.32.44/drivers/block/DAC960.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/block/DAC960.c 2011-05-16 21:46:57.000000000 -0400
@@ -1973,6 +1973,8 @@ static bool DAC960_V1_ReadDeviceConfigur
unsigned long flags;
int Channel, TargetID;
@@ -27420,9 +27368,9 @@ diff -urNp linux-2.6.32.43/drivers/block/DAC960.c linux-2.6.32.43/drivers/block/
if (!init_dma_loaf(Controller->PCIDevice, &local_dma,
DAC960_V1_MaxChannels*(sizeof(DAC960_V1_DCDB_T) +
sizeof(DAC960_SCSI_Inquiry_T) +
-diff -urNp linux-2.6.32.43/drivers/block/nbd.c linux-2.6.32.43/drivers/block/nbd.c
---- linux-2.6.32.43/drivers/block/nbd.c 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.43/drivers/block/nbd.c 2011-06-25 12:56:37.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/block/nbd.c linux-2.6.32.44/drivers/block/nbd.c
+--- linux-2.6.32.44/drivers/block/nbd.c 2011-06-25 12:55:34.000000000 -0400
++++ linux-2.6.32.44/drivers/block/nbd.c 2011-06-25 12:56:37.000000000 -0400
@@ -155,6 +155,8 @@ static int sock_xmit(struct nbd_device *
struct kvec iov;
sigset_t blocked, oldset;
@@ -27441,9 +27389,9 @@ diff -urNp linux-2.6.32.43/drivers/block/nbd.c linux-2.6.32.43/drivers/block/nbd
switch (cmd) {
case NBD_DISCONNECT: {
struct request sreq;
-diff -urNp linux-2.6.32.43/drivers/block/pktcdvd.c linux-2.6.32.43/drivers/block/pktcdvd.c
---- linux-2.6.32.43/drivers/block/pktcdvd.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/block/pktcdvd.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/block/pktcdvd.c linux-2.6.32.44/drivers/block/pktcdvd.c
+--- linux-2.6.32.44/drivers/block/pktcdvd.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/block/pktcdvd.c 2011-04-17 15:56:46.000000000 -0400
@@ -284,7 +284,7 @@ static ssize_t kobj_pkt_store(struct kob
return len;
}
@@ -27453,9 +27401,9 @@ diff -urNp linux-2.6.32.43/drivers/block/pktcdvd.c linux-2.6.32.43/drivers/block
.show = kobj_pkt_show,
.store = kobj_pkt_store
};
-diff -urNp linux-2.6.32.43/drivers/char/agp/frontend.c linux-2.6.32.43/drivers/char/agp/frontend.c
---- linux-2.6.32.43/drivers/char/agp/frontend.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/char/agp/frontend.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/char/agp/frontend.c linux-2.6.32.44/drivers/char/agp/frontend.c
+--- linux-2.6.32.44/drivers/char/agp/frontend.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/char/agp/frontend.c 2011-04-17 15:56:46.000000000 -0400
@@ -824,7 +824,7 @@ static int agpioc_reserve_wrap(struct ag
if (copy_from_user(&reserve, arg, sizeof(struct agp_region)))
return -EFAULT;
@@ -27465,9 +27413,9 @@ diff -urNp linux-2.6.32.43/drivers/char/agp/frontend.c linux-2.6.32.43/drivers/c
return -EFAULT;
client = agp_find_client_by_pid(reserve.pid);
-diff -urNp linux-2.6.32.43/drivers/char/briq_panel.c linux-2.6.32.43/drivers/char/briq_panel.c
---- linux-2.6.32.43/drivers/char/briq_panel.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/char/briq_panel.c 2011-04-18 19:48:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/char/briq_panel.c linux-2.6.32.44/drivers/char/briq_panel.c
+--- linux-2.6.32.44/drivers/char/briq_panel.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/char/briq_panel.c 2011-04-18 19:48:57.000000000 -0400
@@ -10,6 +10,7 @@
#include <linux/types.h>
#include <linux/errno.h>
@@ -27509,9 +27457,9 @@ diff -urNp linux-2.6.32.43/drivers/char/briq_panel.c linux-2.6.32.43/drivers/cha
return len;
}
-diff -urNp linux-2.6.32.43/drivers/char/genrtc.c linux-2.6.32.43/drivers/char/genrtc.c
---- linux-2.6.32.43/drivers/char/genrtc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/char/genrtc.c 2011-04-18 19:45:42.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/char/genrtc.c linux-2.6.32.44/drivers/char/genrtc.c
+--- linux-2.6.32.44/drivers/char/genrtc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/char/genrtc.c 2011-04-18 19:45:42.000000000 -0400
@@ -272,6 +272,7 @@ static int gen_rtc_ioctl(struct inode *i
switch (cmd) {
@@ -27520,9 +27468,9 @@ diff -urNp linux-2.6.32.43/drivers/char/genrtc.c linux-2.6.32.43/drivers/char/ge
if (get_rtc_pll(&pll))
return -EINVAL;
else
-diff -urNp linux-2.6.32.43/drivers/char/hpet.c linux-2.6.32.43/drivers/char/hpet.c
---- linux-2.6.32.43/drivers/char/hpet.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/char/hpet.c 2011-04-23 12:56:11.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/char/hpet.c linux-2.6.32.44/drivers/char/hpet.c
+--- linux-2.6.32.44/drivers/char/hpet.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/char/hpet.c 2011-04-23 12:56:11.000000000 -0400
@@ -430,7 +430,7 @@ static int hpet_release(struct inode *in
return 0;
}
@@ -27555,9 +27503,9 @@ diff -urNp linux-2.6.32.43/drivers/char/hpet.c linux-2.6.32.43/drivers/char/hpet
info.hi_flags =
readq(&timer->hpet_config) & Tn_PER_INT_CAP_MASK;
info.hi_hpet = hpetp->hp_which;
-diff -urNp linux-2.6.32.43/drivers/char/hvc_beat.c linux-2.6.32.43/drivers/char/hvc_beat.c
---- linux-2.6.32.43/drivers/char/hvc_beat.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/char/hvc_beat.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/char/hvc_beat.c linux-2.6.32.44/drivers/char/hvc_beat.c
+--- linux-2.6.32.44/drivers/char/hvc_beat.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/char/hvc_beat.c 2011-04-17 15:56:46.000000000 -0400
@@ -84,7 +84,7 @@ static int hvc_beat_put_chars(uint32_t v
return cnt;
}
@@ -27567,9 +27515,9 @@ diff -urNp linux-2.6.32.43/drivers/char/hvc_beat.c linux-2.6.32.43/drivers/char/
.get_chars = hvc_beat_get_chars,
.put_chars = hvc_beat_put_chars,
};
-diff -urNp linux-2.6.32.43/drivers/char/hvc_console.c linux-2.6.32.43/drivers/char/hvc_console.c
---- linux-2.6.32.43/drivers/char/hvc_console.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/char/hvc_console.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/char/hvc_console.c linux-2.6.32.44/drivers/char/hvc_console.c
+--- linux-2.6.32.44/drivers/char/hvc_console.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/char/hvc_console.c 2011-04-17 15:56:46.000000000 -0400
@@ -125,7 +125,7 @@ static struct hvc_struct *hvc_get_by_ind
* console interfaces but can still be used as a tty device. This has to be
* static because kmalloc will not work during early console init.
@@ -27597,9 +27545,9 @@ diff -urNp linux-2.6.32.43/drivers/char/hvc_console.c linux-2.6.32.43/drivers/ch
{
struct hvc_struct *hp;
int i;
-diff -urNp linux-2.6.32.43/drivers/char/hvc_console.h linux-2.6.32.43/drivers/char/hvc_console.h
---- linux-2.6.32.43/drivers/char/hvc_console.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/char/hvc_console.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/char/hvc_console.h linux-2.6.32.44/drivers/char/hvc_console.h
+--- linux-2.6.32.44/drivers/char/hvc_console.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/char/hvc_console.h 2011-04-17 15:56:46.000000000 -0400
@@ -55,7 +55,7 @@ struct hvc_struct {
int outbuf_size;
int n_outbuf;
@@ -27623,9 +27571,9 @@ diff -urNp linux-2.6.32.43/drivers/char/hvc_console.h linux-2.6.32.43/drivers/ch
/* remove a vterm from hvc tty operation (module_exit or hotplug remove) */
extern int hvc_remove(struct hvc_struct *hp);
-diff -urNp linux-2.6.32.43/drivers/char/hvc_iseries.c linux-2.6.32.43/drivers/char/hvc_iseries.c
---- linux-2.6.32.43/drivers/char/hvc_iseries.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/char/hvc_iseries.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/char/hvc_iseries.c linux-2.6.32.44/drivers/char/hvc_iseries.c
+--- linux-2.6.32.44/drivers/char/hvc_iseries.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/char/hvc_iseries.c 2011-04-17 15:56:46.000000000 -0400
@@ -197,7 +197,7 @@ done:
return sent;
}
@@ -27635,9 +27583,9 @@ diff -urNp linux-2.6.32.43/drivers/char/hvc_iseries.c linux-2.6.32.43/drivers/ch
.get_chars = get_chars,
.put_chars = put_chars,
.notifier_add = notifier_add_irq,
-diff -urNp linux-2.6.32.43/drivers/char/hvc_iucv.c linux-2.6.32.43/drivers/char/hvc_iucv.c
---- linux-2.6.32.43/drivers/char/hvc_iucv.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/char/hvc_iucv.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/char/hvc_iucv.c linux-2.6.32.44/drivers/char/hvc_iucv.c
+--- linux-2.6.32.44/drivers/char/hvc_iucv.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/char/hvc_iucv.c 2011-04-17 15:56:46.000000000 -0400
@@ -924,7 +924,7 @@ static int hvc_iucv_pm_restore_thaw(stru
@@ -27647,9 +27595,9 @@ diff -urNp linux-2.6.32.43/drivers/char/hvc_iucv.c linux-2.6.32.43/drivers/char/
.get_chars = hvc_iucv_get_chars,
.put_chars = hvc_iucv_put_chars,
.notifier_add = hvc_iucv_notifier_add,
-diff -urNp linux-2.6.32.43/drivers/char/hvc_rtas.c linux-2.6.32.43/drivers/char/hvc_rtas.c
---- linux-2.6.32.43/drivers/char/hvc_rtas.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/char/hvc_rtas.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/char/hvc_rtas.c linux-2.6.32.44/drivers/char/hvc_rtas.c
+--- linux-2.6.32.44/drivers/char/hvc_rtas.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/char/hvc_rtas.c 2011-04-17 15:56:46.000000000 -0400
@@ -71,7 +71,7 @@ static int hvc_rtas_read_console(uint32_
return i;
}
@@ -27659,9 +27607,9 @@ diff -urNp linux-2.6.32.43/drivers/char/hvc_rtas.c linux-2.6.32.43/drivers/char/
.get_chars = hvc_rtas_read_console,
.put_chars = hvc_rtas_write_console,
};
-diff -urNp linux-2.6.32.43/drivers/char/hvcs.c linux-2.6.32.43/drivers/char/hvcs.c
---- linux-2.6.32.43/drivers/char/hvcs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/char/hvcs.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/char/hvcs.c linux-2.6.32.44/drivers/char/hvcs.c
+--- linux-2.6.32.44/drivers/char/hvcs.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/char/hvcs.c 2011-04-17 15:56:46.000000000 -0400
@@ -82,6 +82,7 @@
#include <asm/hvcserver.h>
#include <asm/uaccess.h>
@@ -27764,9 +27712,9 @@ diff -urNp linux-2.6.32.43/drivers/char/hvcs.c linux-2.6.32.43/drivers/char/hvcs
return 0;
return HVCS_BUFF_LEN - hvcsd->chars_in_buffer;
-diff -urNp linux-2.6.32.43/drivers/char/hvc_udbg.c linux-2.6.32.43/drivers/char/hvc_udbg.c
---- linux-2.6.32.43/drivers/char/hvc_udbg.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/char/hvc_udbg.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/char/hvc_udbg.c linux-2.6.32.44/drivers/char/hvc_udbg.c
+--- linux-2.6.32.44/drivers/char/hvc_udbg.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/char/hvc_udbg.c 2011-04-17 15:56:46.000000000 -0400
@@ -58,7 +58,7 @@ static int hvc_udbg_get(uint32_t vtermno
return i;
}
@@ -27776,9 +27724,9 @@ diff -urNp linux-2.6.32.43/drivers/char/hvc_udbg.c linux-2.6.32.43/drivers/char/
.get_chars = hvc_udbg_get,
.put_chars = hvc_udbg_put,
};
-diff -urNp linux-2.6.32.43/drivers/char/hvc_vio.c linux-2.6.32.43/drivers/char/hvc_vio.c
---- linux-2.6.32.43/drivers/char/hvc_vio.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/char/hvc_vio.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/char/hvc_vio.c linux-2.6.32.44/drivers/char/hvc_vio.c
+--- linux-2.6.32.44/drivers/char/hvc_vio.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/char/hvc_vio.c 2011-04-17 15:56:46.000000000 -0400
@@ -77,7 +77,7 @@ static int filtered_get_chars(uint32_t v
return got;
}
@@ -27788,9 +27736,9 @@ diff -urNp linux-2.6.32.43/drivers/char/hvc_vio.c linux-2.6.32.43/drivers/char/h
.get_chars = filtered_get_chars,
.put_chars = hvc_put_chars,
.notifier_add = notifier_add_irq,
-diff -urNp linux-2.6.32.43/drivers/char/hvc_xen.c linux-2.6.32.43/drivers/char/hvc_xen.c
---- linux-2.6.32.43/drivers/char/hvc_xen.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/char/hvc_xen.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/char/hvc_xen.c linux-2.6.32.44/drivers/char/hvc_xen.c
+--- linux-2.6.32.44/drivers/char/hvc_xen.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/char/hvc_xen.c 2011-04-17 15:56:46.000000000 -0400
@@ -120,7 +120,7 @@ static int read_console(uint32_t vtermno
return recv;
}
@@ -27800,9 +27748,9 @@ diff -urNp linux-2.6.32.43/drivers/char/hvc_xen.c linux-2.6.32.43/drivers/char/h
.get_chars = read_console,
.put_chars = write_console,
.notifier_add = notifier_add_irq,
-diff -urNp linux-2.6.32.43/drivers/char/ipmi/ipmi_msghandler.c linux-2.6.32.43/drivers/char/ipmi/ipmi_msghandler.c
---- linux-2.6.32.43/drivers/char/ipmi/ipmi_msghandler.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/char/ipmi/ipmi_msghandler.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/char/ipmi/ipmi_msghandler.c linux-2.6.32.44/drivers/char/ipmi/ipmi_msghandler.c
+--- linux-2.6.32.44/drivers/char/ipmi/ipmi_msghandler.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/char/ipmi/ipmi_msghandler.c 2011-05-16 21:46:57.000000000 -0400
@@ -414,7 +414,7 @@ struct ipmi_smi {
struct proc_dir_entry *proc_dir;
char proc_dir_name[10];
@@ -27842,9 +27790,9 @@ diff -urNp linux-2.6.32.43/drivers/char/ipmi/ipmi_msghandler.c linux-2.6.32.43/d
si = (struct ipmi_system_interface_addr *) &addr;
si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
si->channel = IPMI_BMC_CHANNEL;
-diff -urNp linux-2.6.32.43/drivers/char/ipmi/ipmi_si_intf.c linux-2.6.32.43/drivers/char/ipmi/ipmi_si_intf.c
---- linux-2.6.32.43/drivers/char/ipmi/ipmi_si_intf.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/char/ipmi/ipmi_si_intf.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/char/ipmi/ipmi_si_intf.c linux-2.6.32.44/drivers/char/ipmi/ipmi_si_intf.c
+--- linux-2.6.32.44/drivers/char/ipmi/ipmi_si_intf.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/char/ipmi/ipmi_si_intf.c 2011-04-17 15:56:46.000000000 -0400
@@ -277,7 +277,7 @@ struct smi_info {
unsigned char slave_addr;
@@ -27875,9 +27823,9 @@ diff -urNp linux-2.6.32.43/drivers/char/ipmi/ipmi_si_intf.c linux-2.6.32.43/driv
new_smi->interrupt_disabled = 0;
atomic_set(&new_smi->stop_operation, 0);
-diff -urNp linux-2.6.32.43/drivers/char/istallion.c linux-2.6.32.43/drivers/char/istallion.c
---- linux-2.6.32.43/drivers/char/istallion.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/char/istallion.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/char/istallion.c linux-2.6.32.44/drivers/char/istallion.c
+--- linux-2.6.32.44/drivers/char/istallion.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/char/istallion.c 2011-05-16 21:46:57.000000000 -0400
@@ -187,7 +187,6 @@ static struct ktermios stli_deftermios
* re-used for each stats call.
*/
@@ -27912,9 +27860,9 @@ diff -urNp linux-2.6.32.43/drivers/char/istallion.c linux-2.6.32.43/drivers/char
if (copy_from_user(&stli_dummybrd, arg, sizeof(struct stlibrd)))
return -EFAULT;
if (stli_dummybrd.brdnr >= STL_MAXBRDS)
-diff -urNp linux-2.6.32.43/drivers/char/Kconfig linux-2.6.32.43/drivers/char/Kconfig
---- linux-2.6.32.43/drivers/char/Kconfig 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/char/Kconfig 2011-04-18 19:20:15.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/char/Kconfig linux-2.6.32.44/drivers/char/Kconfig
+--- linux-2.6.32.44/drivers/char/Kconfig 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/char/Kconfig 2011-04-18 19:20:15.000000000 -0400
@@ -90,7 +90,8 @@ config VT_HW_CONSOLE_BINDING
config DEVKMEM
@@ -27933,9 +27881,9 @@ diff -urNp linux-2.6.32.43/drivers/char/Kconfig linux-2.6.32.43/drivers/char/Kco
default y
source "drivers/s390/char/Kconfig"
-diff -urNp linux-2.6.32.43/drivers/char/keyboard.c linux-2.6.32.43/drivers/char/keyboard.c
---- linux-2.6.32.43/drivers/char/keyboard.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/char/keyboard.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/char/keyboard.c linux-2.6.32.44/drivers/char/keyboard.c
+--- linux-2.6.32.44/drivers/char/keyboard.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/char/keyboard.c 2011-04-17 15:56:46.000000000 -0400
@@ -635,6 +635,16 @@ static void k_spec(struct vc_data *vc, u
kbd->kbdmode == VC_MEDIUMRAW) &&
value != KVAL(K_SAK))
@@ -27962,9 +27910,9 @@ diff -urNp linux-2.6.32.43/drivers/char/keyboard.c linux-2.6.32.43/drivers/char/
};
MODULE_DEVICE_TABLE(input, kbd_ids);
-diff -urNp linux-2.6.32.43/drivers/char/mem.c linux-2.6.32.43/drivers/char/mem.c
---- linux-2.6.32.43/drivers/char/mem.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/char/mem.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/char/mem.c linux-2.6.32.44/drivers/char/mem.c
+--- linux-2.6.32.44/drivers/char/mem.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/char/mem.c 2011-04-17 15:56:46.000000000 -0400
@@ -18,6 +18,7 @@
#include <linux/raw.h>
#include <linux/tty.h>
@@ -28106,9 +28054,9 @@ diff -urNp linux-2.6.32.43/drivers/char/mem.c linux-2.6.32.43/drivers/char/mem.c
};
static int memory_open(struct inode *inode, struct file *filp)
-diff -urNp linux-2.6.32.43/drivers/char/pcmcia/ipwireless/tty.c linux-2.6.32.43/drivers/char/pcmcia/ipwireless/tty.c
---- linux-2.6.32.43/drivers/char/pcmcia/ipwireless/tty.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/char/pcmcia/ipwireless/tty.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/char/pcmcia/ipwireless/tty.c linux-2.6.32.44/drivers/char/pcmcia/ipwireless/tty.c
+--- linux-2.6.32.44/drivers/char/pcmcia/ipwireless/tty.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/char/pcmcia/ipwireless/tty.c 2011-04-17 15:56:46.000000000 -0400
@@ -29,6 +29,7 @@
#include <linux/tty_driver.h>
#include <linux/tty_flip.h>
@@ -28231,9 +28179,9 @@ diff -urNp linux-2.6.32.43/drivers/char/pcmcia/ipwireless/tty.c linux-2.6.32.43/
do_ipw_close(ttyj);
ipwireless_disassociate_network_ttys(network,
ttyj->channel_idx);
-diff -urNp linux-2.6.32.43/drivers/char/pty.c linux-2.6.32.43/drivers/char/pty.c
---- linux-2.6.32.43/drivers/char/pty.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/char/pty.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/char/pty.c linux-2.6.32.44/drivers/char/pty.c
+--- linux-2.6.32.44/drivers/char/pty.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/char/pty.c 2011-08-05 20:33:55.000000000 -0400
@@ -736,8 +736,10 @@ static void __init unix98_pty_init(void)
register_sysctl_table(pty_root_table);
@@ -28246,9 +28194,9 @@ diff -urNp linux-2.6.32.43/drivers/char/pty.c linux-2.6.32.43/drivers/char/pty.c
cdev_init(&ptmx_cdev, &ptmx_fops);
if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
-diff -urNp linux-2.6.32.43/drivers/char/random.c linux-2.6.32.43/drivers/char/random.c
---- linux-2.6.32.43/drivers/char/random.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/char/random.c 2011-08-07 19:48:09.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/char/random.c linux-2.6.32.44/drivers/char/random.c
+--- linux-2.6.32.44/drivers/char/random.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/char/random.c 2011-08-07 19:48:09.000000000 -0400
@@ -254,8 +254,13 @@
/*
* Configuration information
@@ -28647,9 +28595,9 @@ diff -urNp linux-2.6.32.43/drivers/char/random.c linux-2.6.32.43/drivers/char/ra
put_cpu_var(get_random_int_hash);
return ret;
-diff -urNp linux-2.6.32.43/drivers/char/rocket.c linux-2.6.32.43/drivers/char/rocket.c
---- linux-2.6.32.43/drivers/char/rocket.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/char/rocket.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/char/rocket.c linux-2.6.32.44/drivers/char/rocket.c
+--- linux-2.6.32.44/drivers/char/rocket.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/char/rocket.c 2011-05-16 21:46:57.000000000 -0400
@@ -1266,6 +1266,8 @@ static int get_ports(struct r_port *info
struct rocket_ports tmp;
int board;
@@ -28659,9 +28607,9 @@ diff -urNp linux-2.6.32.43/drivers/char/rocket.c linux-2.6.32.43/drivers/char/ro
if (!retports)
return -EFAULT;
memset(&tmp, 0, sizeof (tmp));
-diff -urNp linux-2.6.32.43/drivers/char/sonypi.c linux-2.6.32.43/drivers/char/sonypi.c
---- linux-2.6.32.43/drivers/char/sonypi.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/char/sonypi.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/char/sonypi.c linux-2.6.32.44/drivers/char/sonypi.c
+--- linux-2.6.32.44/drivers/char/sonypi.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/char/sonypi.c 2011-04-17 15:56:46.000000000 -0400
@@ -55,6 +55,7 @@
#include <asm/uaccess.h>
#include <asm/io.h>
@@ -28700,9 +28648,9 @@ diff -urNp linux-2.6.32.43/drivers/char/sonypi.c linux-2.6.32.43/drivers/char/so
mutex_unlock(&sonypi_device.lock);
unlock_kernel();
return 0;
-diff -urNp linux-2.6.32.43/drivers/char/stallion.c linux-2.6.32.43/drivers/char/stallion.c
---- linux-2.6.32.43/drivers/char/stallion.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/char/stallion.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/char/stallion.c linux-2.6.32.44/drivers/char/stallion.c
+--- linux-2.6.32.44/drivers/char/stallion.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/char/stallion.c 2011-05-16 21:46:57.000000000 -0400
@@ -2448,6 +2448,8 @@ static int stl_getportstruct(struct stlp
struct stlport stl_dummyport;
struct stlport *portp;
@@ -28712,9 +28660,9 @@ diff -urNp linux-2.6.32.43/drivers/char/stallion.c linux-2.6.32.43/drivers/char/
if (copy_from_user(&stl_dummyport, arg, sizeof(struct stlport)))
return -EFAULT;
portp = stl_getport(stl_dummyport.brdnr, stl_dummyport.panelnr,
-diff -urNp linux-2.6.32.43/drivers/char/tpm/tpm_bios.c linux-2.6.32.43/drivers/char/tpm/tpm_bios.c
---- linux-2.6.32.43/drivers/char/tpm/tpm_bios.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/char/tpm/tpm_bios.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/char/tpm/tpm_bios.c linux-2.6.32.44/drivers/char/tpm/tpm_bios.c
+--- linux-2.6.32.44/drivers/char/tpm/tpm_bios.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/char/tpm/tpm_bios.c 2011-04-17 15:56:46.000000000 -0400
@@ -172,7 +172,7 @@ static void *tpm_bios_measurements_start
event = addr;
@@ -28755,9 +28703,9 @@ diff -urNp linux-2.6.32.43/drivers/char/tpm/tpm_bios.c linux-2.6.32.43/drivers/c
memcpy(log->bios_event_log, virt, len);
-diff -urNp linux-2.6.32.43/drivers/char/tpm/tpm.c linux-2.6.32.43/drivers/char/tpm/tpm.c
---- linux-2.6.32.43/drivers/char/tpm/tpm.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.43/drivers/char/tpm/tpm.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/char/tpm/tpm.c linux-2.6.32.44/drivers/char/tpm/tpm.c
+--- linux-2.6.32.44/drivers/char/tpm/tpm.c 2011-04-17 17:00:52.000000000 -0400
++++ linux-2.6.32.44/drivers/char/tpm/tpm.c 2011-05-16 21:46:57.000000000 -0400
@@ -402,7 +402,7 @@ static ssize_t tpm_transmit(struct tpm_c
chip->vendor.req_complete_val)
goto out_recv;
@@ -28776,9 +28724,9 @@ diff -urNp linux-2.6.32.43/drivers/char/tpm/tpm.c linux-2.6.32.43/drivers/char/t
tpm_cmd.header.in = tpm_readpubek_header;
err = transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE,
"attempting to read the PUBEK");
-diff -urNp linux-2.6.32.43/drivers/char/tty_io.c linux-2.6.32.43/drivers/char/tty_io.c
---- linux-2.6.32.43/drivers/char/tty_io.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/char/tty_io.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/char/tty_io.c linux-2.6.32.44/drivers/char/tty_io.c
+--- linux-2.6.32.44/drivers/char/tty_io.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/char/tty_io.c 2011-08-05 20:33:55.000000000 -0400
@@ -2582,8 +2582,10 @@ long tty_ioctl(struct file *file, unsign
return retval;
}
@@ -28809,9 +28757,9 @@ diff -urNp linux-2.6.32.43/drivers/char/tty_io.c linux-2.6.32.43/drivers/char/tt
}
/*
-diff -urNp linux-2.6.32.43/drivers/char/tty_ldisc.c linux-2.6.32.43/drivers/char/tty_ldisc.c
---- linux-2.6.32.43/drivers/char/tty_ldisc.c 2011-07-13 17:23:04.000000000 -0400
-+++ linux-2.6.32.43/drivers/char/tty_ldisc.c 2011-07-13 17:23:18.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/char/tty_ldisc.c linux-2.6.32.44/drivers/char/tty_ldisc.c
+--- linux-2.6.32.44/drivers/char/tty_ldisc.c 2011-07-13 17:23:04.000000000 -0400
++++ linux-2.6.32.44/drivers/char/tty_ldisc.c 2011-07-13 17:23:18.000000000 -0400
@@ -74,7 +74,7 @@ static void put_ldisc(struct tty_ldisc *
if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) {
struct tty_ldisc_ops *ldo = ld->ops;
@@ -28857,9 +28805,9 @@ diff -urNp linux-2.6.32.43/drivers/char/tty_ldisc.c linux-2.6.32.43/drivers/char
module_put(ldops->owner);
spin_unlock_irqrestore(&tty_ldisc_lock, flags);
}
-diff -urNp linux-2.6.32.43/drivers/char/virtio_console.c linux-2.6.32.43/drivers/char/virtio_console.c
---- linux-2.6.32.43/drivers/char/virtio_console.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/char/virtio_console.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/char/virtio_console.c linux-2.6.32.44/drivers/char/virtio_console.c
+--- linux-2.6.32.44/drivers/char/virtio_console.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/char/virtio_console.c 2011-08-05 20:33:55.000000000 -0400
@@ -133,7 +133,9 @@ static int get_chars(u32 vtermno, char *
* virtqueue, so we let the drivers do some boutique early-output thing. */
int __init virtio_cons_early_init(int (*put_chars)(u32, const char *, int))
@@ -28890,9 +28838,9 @@ diff -urNp linux-2.6.32.43/drivers/char/virtio_console.c linux-2.6.32.43/drivers
/* The first argument of hvc_alloc() is the virtual console number, so
* we use zero. The second argument is the parameter for the
-diff -urNp linux-2.6.32.43/drivers/char/vt.c linux-2.6.32.43/drivers/char/vt.c
---- linux-2.6.32.43/drivers/char/vt.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/char/vt.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/char/vt.c linux-2.6.32.44/drivers/char/vt.c
+--- linux-2.6.32.44/drivers/char/vt.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/char/vt.c 2011-04-17 15:56:46.000000000 -0400
@@ -243,7 +243,7 @@ EXPORT_SYMBOL_GPL(unregister_vt_notifier
static void notify_write(struct vc_data *vc, unsigned int unicode)
@@ -28902,9 +28850,9 @@ diff -urNp linux-2.6.32.43/drivers/char/vt.c linux-2.6.32.43/drivers/char/vt.c
atomic_notifier_call_chain(&vt_notifier_list, VT_WRITE, ¶m);
}
-diff -urNp linux-2.6.32.43/drivers/char/vt_ioctl.c linux-2.6.32.43/drivers/char/vt_ioctl.c
---- linux-2.6.32.43/drivers/char/vt_ioctl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/char/vt_ioctl.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/char/vt_ioctl.c linux-2.6.32.44/drivers/char/vt_ioctl.c
+--- linux-2.6.32.44/drivers/char/vt_ioctl.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/char/vt_ioctl.c 2011-04-17 15:56:46.000000000 -0400
@@ -210,9 +210,6 @@ do_kdsk_ioctl(int cmd, struct kbentry __
if (copy_from_user(&tmp, user_kbe, sizeof(struct kbentry)))
return -EFAULT;
@@ -28948,9 +28896,9 @@ diff -urNp linux-2.6.32.43/drivers/char/vt_ioctl.c linux-2.6.32.43/drivers/char/
if (!perm) {
ret = -EPERM;
goto reterr;
-diff -urNp linux-2.6.32.43/drivers/cpufreq/cpufreq.c linux-2.6.32.43/drivers/cpufreq/cpufreq.c
---- linux-2.6.32.43/drivers/cpufreq/cpufreq.c 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.43/drivers/cpufreq/cpufreq.c 2011-06-25 12:56:37.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/cpufreq/cpufreq.c linux-2.6.32.44/drivers/cpufreq/cpufreq.c
+--- linux-2.6.32.44/drivers/cpufreq/cpufreq.c 2011-06-25 12:55:34.000000000 -0400
++++ linux-2.6.32.44/drivers/cpufreq/cpufreq.c 2011-06-25 12:56:37.000000000 -0400
@@ -750,7 +750,7 @@ static void cpufreq_sysfs_release(struct
complete(&policy->kobj_unregister);
}
@@ -28960,9 +28908,9 @@ diff -urNp linux-2.6.32.43/drivers/cpufreq/cpufreq.c linux-2.6.32.43/drivers/cpu
.show = show,
.store = store,
};
-diff -urNp linux-2.6.32.43/drivers/cpuidle/sysfs.c linux-2.6.32.43/drivers/cpuidle/sysfs.c
---- linux-2.6.32.43/drivers/cpuidle/sysfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/cpuidle/sysfs.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/cpuidle/sysfs.c linux-2.6.32.44/drivers/cpuidle/sysfs.c
+--- linux-2.6.32.44/drivers/cpuidle/sysfs.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/cpuidle/sysfs.c 2011-04-17 15:56:46.000000000 -0400
@@ -191,7 +191,7 @@ static ssize_t cpuidle_store(struct kobj
return ret;
}
@@ -28990,9 +28938,9 @@ diff -urNp linux-2.6.32.43/drivers/cpuidle/sysfs.c linux-2.6.32.43/drivers/cpuid
{
kobject_put(&device->kobjs[i]->kobj);
wait_for_completion(&device->kobjs[i]->kobj_unregister);
-diff -urNp linux-2.6.32.43/drivers/crypto/hifn_795x.c linux-2.6.32.43/drivers/crypto/hifn_795x.c
---- linux-2.6.32.43/drivers/crypto/hifn_795x.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/crypto/hifn_795x.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/crypto/hifn_795x.c linux-2.6.32.44/drivers/crypto/hifn_795x.c
+--- linux-2.6.32.44/drivers/crypto/hifn_795x.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/crypto/hifn_795x.c 2011-05-16 21:46:57.000000000 -0400
@@ -1655,6 +1655,8 @@ static int hifn_test(struct hifn_device
0xCA, 0x34, 0x2B, 0x2E};
struct scatterlist sg;
@@ -29002,9 +28950,9 @@ diff -urNp linux-2.6.32.43/drivers/crypto/hifn_795x.c linux-2.6.32.43/drivers/cr
memset(src, 0, sizeof(src));
memset(ctx.key, 0, sizeof(ctx.key));
-diff -urNp linux-2.6.32.43/drivers/crypto/padlock-aes.c linux-2.6.32.43/drivers/crypto/padlock-aes.c
---- linux-2.6.32.43/drivers/crypto/padlock-aes.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/crypto/padlock-aes.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/crypto/padlock-aes.c linux-2.6.32.44/drivers/crypto/padlock-aes.c
+--- linux-2.6.32.44/drivers/crypto/padlock-aes.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/crypto/padlock-aes.c 2011-05-16 21:46:57.000000000 -0400
@@ -108,6 +108,8 @@ static int aes_set_key(struct crypto_tfm
struct crypto_aes_ctx gen_aes;
int cpu;
@@ -29014,9 +28962,9 @@ diff -urNp linux-2.6.32.43/drivers/crypto/padlock-aes.c linux-2.6.32.43/drivers/
if (key_len % 8) {
*flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
return -EINVAL;
-diff -urNp linux-2.6.32.43/drivers/dma/ioat/dma.c linux-2.6.32.43/drivers/dma/ioat/dma.c
---- linux-2.6.32.43/drivers/dma/ioat/dma.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/dma/ioat/dma.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/dma/ioat/dma.c linux-2.6.32.44/drivers/dma/ioat/dma.c
+--- linux-2.6.32.44/drivers/dma/ioat/dma.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/dma/ioat/dma.c 2011-04-17 15:56:46.000000000 -0400
@@ -1146,7 +1146,7 @@ ioat_attr_show(struct kobject *kobj, str
return entry->show(&chan->common, page);
}
@@ -29026,9 +28974,9 @@ diff -urNp linux-2.6.32.43/drivers/dma/ioat/dma.c linux-2.6.32.43/drivers/dma/io
.show = ioat_attr_show,
};
-diff -urNp linux-2.6.32.43/drivers/dma/ioat/dma.h linux-2.6.32.43/drivers/dma/ioat/dma.h
---- linux-2.6.32.43/drivers/dma/ioat/dma.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/dma/ioat/dma.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/dma/ioat/dma.h linux-2.6.32.44/drivers/dma/ioat/dma.h
+--- linux-2.6.32.44/drivers/dma/ioat/dma.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/dma/ioat/dma.h 2011-04-17 15:56:46.000000000 -0400
@@ -347,7 +347,7 @@ bool ioat_cleanup_preamble(struct ioat_c
unsigned long *phys_complete);
void ioat_kobject_add(struct ioatdma_device *device, struct kobj_type *type);
@@ -29038,9 +28986,9 @@ diff -urNp linux-2.6.32.43/drivers/dma/ioat/dma.h linux-2.6.32.43/drivers/dma/io
extern struct ioat_sysfs_entry ioat_version_attr;
extern struct ioat_sysfs_entry ioat_cap_attr;
#endif /* IOATDMA_H */
-diff -urNp linux-2.6.32.43/drivers/edac/edac_device_sysfs.c linux-2.6.32.43/drivers/edac/edac_device_sysfs.c
---- linux-2.6.32.43/drivers/edac/edac_device_sysfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/edac/edac_device_sysfs.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/edac/edac_device_sysfs.c linux-2.6.32.44/drivers/edac/edac_device_sysfs.c
+--- linux-2.6.32.44/drivers/edac/edac_device_sysfs.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/edac/edac_device_sysfs.c 2011-04-17 15:56:46.000000000 -0400
@@ -137,7 +137,7 @@ static ssize_t edac_dev_ctl_info_store(s
}
@@ -29068,9 +29016,9 @@ diff -urNp linux-2.6.32.43/drivers/edac/edac_device_sysfs.c linux-2.6.32.43/driv
.show = edac_dev_block_show,
.store = edac_dev_block_store
};
-diff -urNp linux-2.6.32.43/drivers/edac/edac_mc_sysfs.c linux-2.6.32.43/drivers/edac/edac_mc_sysfs.c
---- linux-2.6.32.43/drivers/edac/edac_mc_sysfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/edac/edac_mc_sysfs.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/edac/edac_mc_sysfs.c linux-2.6.32.44/drivers/edac/edac_mc_sysfs.c
+--- linux-2.6.32.44/drivers/edac/edac_mc_sysfs.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/edac/edac_mc_sysfs.c 2011-04-17 15:56:46.000000000 -0400
@@ -245,7 +245,7 @@ static ssize_t csrowdev_store(struct kob
return -EIO;
}
@@ -29089,9 +29037,9 @@ diff -urNp linux-2.6.32.43/drivers/edac/edac_mc_sysfs.c linux-2.6.32.43/drivers/
.show = mcidev_show,
.store = mcidev_store
};
-diff -urNp linux-2.6.32.43/drivers/edac/edac_pci_sysfs.c linux-2.6.32.43/drivers/edac/edac_pci_sysfs.c
---- linux-2.6.32.43/drivers/edac/edac_pci_sysfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/edac/edac_pci_sysfs.c 2011-05-04 17:56:20.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/edac/edac_pci_sysfs.c linux-2.6.32.44/drivers/edac/edac_pci_sysfs.c
+--- linux-2.6.32.44/drivers/edac/edac_pci_sysfs.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/edac/edac_pci_sysfs.c 2011-05-04 17:56:20.000000000 -0400
@@ -25,8 +25,8 @@ static int edac_pci_log_pe = 1; /* log
static int edac_pci_log_npe = 1; /* log PCI non-parity error errors */
static int edac_pci_poll_msec = 1000; /* one second workq period */
@@ -29193,9 +29141,9 @@ diff -urNp linux-2.6.32.43/drivers/edac/edac_pci_sysfs.c linux-2.6.32.43/drivers
panic("EDAC: PCI Parity Error");
}
}
-diff -urNp linux-2.6.32.43/drivers/firewire/core-card.c linux-2.6.32.43/drivers/firewire/core-card.c
---- linux-2.6.32.43/drivers/firewire/core-card.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/firewire/core-card.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/firewire/core-card.c linux-2.6.32.44/drivers/firewire/core-card.c
+--- linux-2.6.32.44/drivers/firewire/core-card.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/firewire/core-card.c 2011-08-05 20:33:55.000000000 -0400
@@ -569,8 +569,10 @@ void fw_core_remove_card(struct fw_card
mutex_unlock(&card_mutex);
@@ -29209,9 +29157,9 @@ diff -urNp linux-2.6.32.43/drivers/firewire/core-card.c linux-2.6.32.43/drivers/
card->driver = &dummy_driver;
fw_destroy_nodes(card);
-diff -urNp linux-2.6.32.43/drivers/firewire/core-cdev.c linux-2.6.32.43/drivers/firewire/core-cdev.c
---- linux-2.6.32.43/drivers/firewire/core-cdev.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/firewire/core-cdev.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/firewire/core-cdev.c linux-2.6.32.44/drivers/firewire/core-cdev.c
+--- linux-2.6.32.44/drivers/firewire/core-cdev.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/firewire/core-cdev.c 2011-04-17 15:56:46.000000000 -0400
@@ -1141,8 +1141,7 @@ static int init_iso_resource(struct clie
int ret;
@@ -29222,9 +29170,9 @@ diff -urNp linux-2.6.32.43/drivers/firewire/core-cdev.c linux-2.6.32.43/drivers/
return -EINVAL;
r = kmalloc(sizeof(*r), GFP_KERNEL);
-diff -urNp linux-2.6.32.43/drivers/firewire/core-transaction.c linux-2.6.32.43/drivers/firewire/core-transaction.c
---- linux-2.6.32.43/drivers/firewire/core-transaction.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/firewire/core-transaction.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/firewire/core-transaction.c linux-2.6.32.44/drivers/firewire/core-transaction.c
+--- linux-2.6.32.44/drivers/firewire/core-transaction.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/firewire/core-transaction.c 2011-05-16 21:46:57.000000000 -0400
@@ -36,6 +36,7 @@
#include <linux/string.h>
#include <linux/timer.h>
@@ -29242,9 +29190,9 @@ diff -urNp linux-2.6.32.43/drivers/firewire/core-transaction.c linux-2.6.32.43/d
init_completion(&d.done);
d.payload = payload;
fw_send_request(card, &t, tcode, destination_id, generation, speed,
-diff -urNp linux-2.6.32.43/drivers/firmware/dmi_scan.c linux-2.6.32.43/drivers/firmware/dmi_scan.c
---- linux-2.6.32.43/drivers/firmware/dmi_scan.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/firmware/dmi_scan.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/firmware/dmi_scan.c linux-2.6.32.44/drivers/firmware/dmi_scan.c
+--- linux-2.6.32.44/drivers/firmware/dmi_scan.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/firmware/dmi_scan.c 2011-04-17 15:56:46.000000000 -0400
@@ -391,11 +391,6 @@ void __init dmi_scan_machine(void)
}
}
@@ -29257,9 +29205,9 @@ diff -urNp linux-2.6.32.43/drivers/firmware/dmi_scan.c linux-2.6.32.43/drivers/f
p = dmi_ioremap(0xF0000, 0x10000);
if (p == NULL)
goto error;
-diff -urNp linux-2.6.32.43/drivers/firmware/edd.c linux-2.6.32.43/drivers/firmware/edd.c
---- linux-2.6.32.43/drivers/firmware/edd.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/firmware/edd.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/firmware/edd.c linux-2.6.32.44/drivers/firmware/edd.c
+--- linux-2.6.32.44/drivers/firmware/edd.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/firmware/edd.c 2011-04-17 15:56:46.000000000 -0400
@@ -122,7 +122,7 @@ edd_attr_show(struct kobject * kobj, str
return ret;
}
@@ -29269,9 +29217,9 @@ diff -urNp linux-2.6.32.43/drivers/firmware/edd.c linux-2.6.32.43/drivers/firmwa
.show = edd_attr_show,
};
-diff -urNp linux-2.6.32.43/drivers/firmware/efivars.c linux-2.6.32.43/drivers/firmware/efivars.c
---- linux-2.6.32.43/drivers/firmware/efivars.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/firmware/efivars.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/firmware/efivars.c linux-2.6.32.44/drivers/firmware/efivars.c
+--- linux-2.6.32.44/drivers/firmware/efivars.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/firmware/efivars.c 2011-04-17 15:56:46.000000000 -0400
@@ -362,7 +362,7 @@ static ssize_t efivar_attr_store(struct
return ret;
}
@@ -29281,9 +29229,9 @@ diff -urNp linux-2.6.32.43/drivers/firmware/efivars.c linux-2.6.32.43/drivers/fi
.show = efivar_attr_show,
.store = efivar_attr_store,
};
-diff -urNp linux-2.6.32.43/drivers/firmware/iscsi_ibft.c linux-2.6.32.43/drivers/firmware/iscsi_ibft.c
---- linux-2.6.32.43/drivers/firmware/iscsi_ibft.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/firmware/iscsi_ibft.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/firmware/iscsi_ibft.c linux-2.6.32.44/drivers/firmware/iscsi_ibft.c
+--- linux-2.6.32.44/drivers/firmware/iscsi_ibft.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/firmware/iscsi_ibft.c 2011-04-17 15:56:46.000000000 -0400
@@ -525,7 +525,7 @@ static ssize_t ibft_show_attribute(struc
return ret;
}
@@ -29293,9 +29241,9 @@ diff -urNp linux-2.6.32.43/drivers/firmware/iscsi_ibft.c linux-2.6.32.43/drivers
.show = ibft_show_attribute,
};
-diff -urNp linux-2.6.32.43/drivers/firmware/memmap.c linux-2.6.32.43/drivers/firmware/memmap.c
---- linux-2.6.32.43/drivers/firmware/memmap.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/firmware/memmap.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/firmware/memmap.c linux-2.6.32.44/drivers/firmware/memmap.c
+--- linux-2.6.32.44/drivers/firmware/memmap.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/firmware/memmap.c 2011-04-17 15:56:46.000000000 -0400
@@ -74,7 +74,7 @@ static struct attribute *def_attrs[] = {
NULL
};
@@ -29305,9 +29253,9 @@ diff -urNp linux-2.6.32.43/drivers/firmware/memmap.c linux-2.6.32.43/drivers/fir
.show = memmap_attr_show,
};
-diff -urNp linux-2.6.32.43/drivers/gpio/vr41xx_giu.c linux-2.6.32.43/drivers/gpio/vr41xx_giu.c
---- linux-2.6.32.43/drivers/gpio/vr41xx_giu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpio/vr41xx_giu.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpio/vr41xx_giu.c linux-2.6.32.44/drivers/gpio/vr41xx_giu.c
+--- linux-2.6.32.44/drivers/gpio/vr41xx_giu.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpio/vr41xx_giu.c 2011-05-04 17:56:28.000000000 -0400
@@ -204,7 +204,7 @@ static int giu_get_irq(unsigned int irq)
printk(KERN_ERR "spurious GIU interrupt: %04x(%04x),%04x(%04x)\n",
maskl, pendl, maskh, pendh);
@@ -29317,9 +29265,9 @@ diff -urNp linux-2.6.32.43/drivers/gpio/vr41xx_giu.c linux-2.6.32.43/drivers/gpi
return -EINVAL;
}
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/drm_crtc_helper.c linux-2.6.32.43/drivers/gpu/drm/drm_crtc_helper.c
---- linux-2.6.32.43/drivers/gpu/drm/drm_crtc_helper.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/drm_crtc_helper.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/drm_crtc_helper.c linux-2.6.32.44/drivers/gpu/drm/drm_crtc_helper.c
+--- linux-2.6.32.44/drivers/gpu/drm/drm_crtc_helper.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/drm_crtc_helper.c 2011-05-16 21:46:57.000000000 -0400
@@ -573,7 +573,7 @@ static bool drm_encoder_crtc_ok(struct d
struct drm_crtc *tmp;
int crtc_mask = 1;
@@ -29338,9 +29286,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/drm_crtc_helper.c linux-2.6.32.43/dri
crtc->enabled = drm_helper_crtc_in_use(crtc);
if (!crtc->enabled)
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/drm_drv.c linux-2.6.32.43/drivers/gpu/drm/drm_drv.c
---- linux-2.6.32.43/drivers/gpu/drm/drm_drv.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/drm_drv.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/drm_drv.c linux-2.6.32.44/drivers/gpu/drm/drm_drv.c
+--- linux-2.6.32.44/drivers/gpu/drm/drm_drv.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/drm_drv.c 2011-04-17 15:56:46.000000000 -0400
@@ -417,7 +417,7 @@ int drm_ioctl(struct inode *inode, struc
char *kdata = NULL;
@@ -29350,9 +29298,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/drm_drv.c linux-2.6.32.43/drivers/gpu
++file_priv->ioctl_count;
DRM_DEBUG("pid=%d, cmd=0x%02x, nr=0x%02x, dev 0x%lx, auth=%d\n",
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/drm_fops.c linux-2.6.32.43/drivers/gpu/drm/drm_fops.c
---- linux-2.6.32.43/drivers/gpu/drm/drm_fops.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/drm_fops.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/drm_fops.c linux-2.6.32.44/drivers/gpu/drm/drm_fops.c
+--- linux-2.6.32.44/drivers/gpu/drm/drm_fops.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/drm_fops.c 2011-04-17 15:56:46.000000000 -0400
@@ -66,7 +66,7 @@ static int drm_setup(struct drm_device *
}
@@ -29404,9 +29352,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/drm_fops.c linux-2.6.32.43/drivers/gp
if (atomic_read(&dev->ioctl_count)) {
DRM_ERROR("Device busy: %d\n",
atomic_read(&dev->ioctl_count));
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/drm_gem.c linux-2.6.32.43/drivers/gpu/drm/drm_gem.c
---- linux-2.6.32.43/drivers/gpu/drm/drm_gem.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/drm_gem.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/drm_gem.c linux-2.6.32.44/drivers/gpu/drm/drm_gem.c
+--- linux-2.6.32.44/drivers/gpu/drm/drm_gem.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/drm_gem.c 2011-04-17 15:56:46.000000000 -0400
@@ -83,11 +83,11 @@ drm_gem_init(struct drm_device *dev)
spin_lock_init(&dev->object_name_lock);
idr_init(&dev->object_name_idr);
@@ -29440,9 +29388,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/drm_gem.c linux-2.6.32.43/drivers/gpu
kfree(obj);
}
EXPORT_SYMBOL(drm_gem_object_free);
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/drm_info.c linux-2.6.32.43/drivers/gpu/drm/drm_info.c
---- linux-2.6.32.43/drivers/gpu/drm/drm_info.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/drm_info.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/drm_info.c linux-2.6.32.44/drivers/gpu/drm/drm_info.c
+--- linux-2.6.32.44/drivers/gpu/drm/drm_info.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/drm_info.c 2011-04-17 15:56:46.000000000 -0400
@@ -75,10 +75,14 @@ int drm_vm_info(struct seq_file *m, void
struct drm_local_map *map;
struct drm_map_list *r_list;
@@ -29522,9 +29470,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/drm_info.c linux-2.6.32.43/drivers/gp
#if defined(__i386__)
pgprot = pgprot_val(vma->vm_page_prot);
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/drm_ioctl.c linux-2.6.32.43/drivers/gpu/drm/drm_ioctl.c
---- linux-2.6.32.43/drivers/gpu/drm/drm_ioctl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/drm_ioctl.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/drm_ioctl.c linux-2.6.32.44/drivers/gpu/drm/drm_ioctl.c
+--- linux-2.6.32.44/drivers/gpu/drm/drm_ioctl.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/drm_ioctl.c 2011-04-17 15:56:46.000000000 -0400
@@ -283,7 +283,7 @@ int drm_getstats(struct drm_device *dev,
stats->data[i].value =
(file_priv->master->lock.hw_lock ? file_priv->master->lock.hw_lock->lock : 0);
@@ -29534,9 +29482,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/drm_ioctl.c linux-2.6.32.43/drivers/g
stats->data[i].type = dev->types[i];
}
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/drm_lock.c linux-2.6.32.43/drivers/gpu/drm/drm_lock.c
---- linux-2.6.32.43/drivers/gpu/drm/drm_lock.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/drm_lock.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/drm_lock.c linux-2.6.32.44/drivers/gpu/drm/drm_lock.c
+--- linux-2.6.32.44/drivers/gpu/drm/drm_lock.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/drm_lock.c 2011-04-17 15:56:46.000000000 -0400
@@ -87,7 +87,7 @@ int drm_lock(struct drm_device *dev, voi
if (drm_lock_take(&master->lock, lock->context)) {
master->lock.file_priv = file_priv;
@@ -29555,9 +29503,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/drm_lock.c linux-2.6.32.43/drivers/gp
/* kernel_context_switch isn't used by any of the x86 drm
* modules but is required by the Sparc driver.
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/i810/i810_dma.c linux-2.6.32.43/drivers/gpu/drm/i810/i810_dma.c
---- linux-2.6.32.43/drivers/gpu/drm/i810/i810_dma.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/i810/i810_dma.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/i810/i810_dma.c linux-2.6.32.44/drivers/gpu/drm/i810/i810_dma.c
+--- linux-2.6.32.44/drivers/gpu/drm/i810/i810_dma.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/i810/i810_dma.c 2011-04-17 15:56:46.000000000 -0400
@@ -952,8 +952,8 @@ static int i810_dma_vertex(struct drm_de
dma->buflist[vertex->idx],
vertex->discard, vertex->used);
@@ -29580,9 +29528,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/i810/i810_dma.c linux-2.6.32.43/drive
sarea_priv->last_enqueue = dev_priv->counter - 1;
sarea_priv->last_dispatch = (int)hw_status[5];
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/i810/i810_drv.h linux-2.6.32.43/drivers/gpu/drm/i810/i810_drv.h
---- linux-2.6.32.43/drivers/gpu/drm/i810/i810_drv.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/i810/i810_drv.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/i810/i810_drv.h linux-2.6.32.44/drivers/gpu/drm/i810/i810_drv.h
+--- linux-2.6.32.44/drivers/gpu/drm/i810/i810_drv.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/i810/i810_drv.h 2011-05-04 17:56:28.000000000 -0400
@@ -108,8 +108,8 @@ typedef struct drm_i810_private {
int page_flipping;
@@ -29594,9 +29542,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/i810/i810_drv.h linux-2.6.32.43/drive
int front_offset;
} drm_i810_private_t;
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/i830/i830_drv.h linux-2.6.32.43/drivers/gpu/drm/i830/i830_drv.h
---- linux-2.6.32.43/drivers/gpu/drm/i830/i830_drv.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/i830/i830_drv.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/i830/i830_drv.h linux-2.6.32.44/drivers/gpu/drm/i830/i830_drv.h
+--- linux-2.6.32.44/drivers/gpu/drm/i830/i830_drv.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/i830/i830_drv.h 2011-05-04 17:56:28.000000000 -0400
@@ -115,8 +115,8 @@ typedef struct drm_i830_private {
int page_flipping;
@@ -29608,9 +29556,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/i830/i830_drv.h linux-2.6.32.43/drive
int use_mi_batchbuffer_start;
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/i830/i830_irq.c linux-2.6.32.43/drivers/gpu/drm/i830/i830_irq.c
---- linux-2.6.32.43/drivers/gpu/drm/i830/i830_irq.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/i830/i830_irq.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/i830/i830_irq.c linux-2.6.32.44/drivers/gpu/drm/i830/i830_irq.c
+--- linux-2.6.32.44/drivers/gpu/drm/i830/i830_irq.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/i830/i830_irq.c 2011-05-04 17:56:28.000000000 -0400
@@ -47,7 +47,7 @@ irqreturn_t i830_driver_irq_handler(DRM_
I830_WRITE16(I830REG_INT_IDENTITY_R, temp);
@@ -29666,9 +29614,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/i830/i830_irq.c linux-2.6.32.43/drive
init_waitqueue_head(&dev_priv->irq_queue);
}
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/i915/dvo_ch7017.c linux-2.6.32.43/drivers/gpu/drm/i915/dvo_ch7017.c
---- linux-2.6.32.43/drivers/gpu/drm/i915/dvo_ch7017.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/i915/dvo_ch7017.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/i915/dvo_ch7017.c linux-2.6.32.44/drivers/gpu/drm/i915/dvo_ch7017.c
+--- linux-2.6.32.44/drivers/gpu/drm/i915/dvo_ch7017.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/i915/dvo_ch7017.c 2011-04-17 15:56:46.000000000 -0400
@@ -443,7 +443,7 @@ static void ch7017_destroy(struct intel_
}
}
@@ -29678,9 +29626,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/i915/dvo_ch7017.c linux-2.6.32.43/dri
.init = ch7017_init,
.detect = ch7017_detect,
.mode_valid = ch7017_mode_valid,
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/i915/dvo_ch7xxx.c linux-2.6.32.43/drivers/gpu/drm/i915/dvo_ch7xxx.c
---- linux-2.6.32.43/drivers/gpu/drm/i915/dvo_ch7xxx.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/i915/dvo_ch7xxx.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/i915/dvo_ch7xxx.c linux-2.6.32.44/drivers/gpu/drm/i915/dvo_ch7xxx.c
+--- linux-2.6.32.44/drivers/gpu/drm/i915/dvo_ch7xxx.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/i915/dvo_ch7xxx.c 2011-04-17 15:56:46.000000000 -0400
@@ -356,7 +356,7 @@ static void ch7xxx_destroy(struct intel_
}
}
@@ -29690,9 +29638,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/i915/dvo_ch7xxx.c linux-2.6.32.43/dri
.init = ch7xxx_init,
.detect = ch7xxx_detect,
.mode_valid = ch7xxx_mode_valid,
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/i915/dvo.h linux-2.6.32.43/drivers/gpu/drm/i915/dvo.h
---- linux-2.6.32.43/drivers/gpu/drm/i915/dvo.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/i915/dvo.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/i915/dvo.h linux-2.6.32.44/drivers/gpu/drm/i915/dvo.h
+--- linux-2.6.32.44/drivers/gpu/drm/i915/dvo.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/i915/dvo.h 2011-04-17 15:56:46.000000000 -0400
@@ -135,23 +135,23 @@ struct intel_dvo_dev_ops {
*
* \return singly-linked list of modes or NULL if no modes found.
@@ -29725,9 +29673,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/i915/dvo.h linux-2.6.32.43/drivers/gp
+extern const struct intel_dvo_dev_ops ch7017_ops;
#endif /* _INTEL_DVO_H */
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/i915/dvo_ivch.c linux-2.6.32.43/drivers/gpu/drm/i915/dvo_ivch.c
---- linux-2.6.32.43/drivers/gpu/drm/i915/dvo_ivch.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/i915/dvo_ivch.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/i915/dvo_ivch.c linux-2.6.32.44/drivers/gpu/drm/i915/dvo_ivch.c
+--- linux-2.6.32.44/drivers/gpu/drm/i915/dvo_ivch.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/i915/dvo_ivch.c 2011-04-17 15:56:46.000000000 -0400
@@ -430,7 +430,7 @@ static void ivch_destroy(struct intel_dv
}
}
@@ -29737,9 +29685,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/i915/dvo_ivch.c linux-2.6.32.43/drive
.init = ivch_init,
.dpms = ivch_dpms,
.save = ivch_save,
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/i915/dvo_sil164.c linux-2.6.32.43/drivers/gpu/drm/i915/dvo_sil164.c
---- linux-2.6.32.43/drivers/gpu/drm/i915/dvo_sil164.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/i915/dvo_sil164.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/i915/dvo_sil164.c linux-2.6.32.44/drivers/gpu/drm/i915/dvo_sil164.c
+--- linux-2.6.32.44/drivers/gpu/drm/i915/dvo_sil164.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/i915/dvo_sil164.c 2011-04-17 15:56:46.000000000 -0400
@@ -290,7 +290,7 @@ static void sil164_destroy(struct intel_
}
}
@@ -29749,9 +29697,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/i915/dvo_sil164.c linux-2.6.32.43/dri
.init = sil164_init,
.detect = sil164_detect,
.mode_valid = sil164_mode_valid,
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/i915/dvo_tfp410.c linux-2.6.32.43/drivers/gpu/drm/i915/dvo_tfp410.c
---- linux-2.6.32.43/drivers/gpu/drm/i915/dvo_tfp410.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/i915/dvo_tfp410.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/i915/dvo_tfp410.c linux-2.6.32.44/drivers/gpu/drm/i915/dvo_tfp410.c
+--- linux-2.6.32.44/drivers/gpu/drm/i915/dvo_tfp410.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/i915/dvo_tfp410.c 2011-04-17 15:56:46.000000000 -0400
@@ -323,7 +323,7 @@ static void tfp410_destroy(struct intel_
}
}
@@ -29761,9 +29709,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/i915/dvo_tfp410.c linux-2.6.32.43/dri
.init = tfp410_init,
.detect = tfp410_detect,
.mode_valid = tfp410_mode_valid,
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/i915/i915_debugfs.c linux-2.6.32.43/drivers/gpu/drm/i915/i915_debugfs.c
---- linux-2.6.32.43/drivers/gpu/drm/i915/i915_debugfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/i915/i915_debugfs.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/i915/i915_debugfs.c linux-2.6.32.44/drivers/gpu/drm/i915/i915_debugfs.c
+--- linux-2.6.32.44/drivers/gpu/drm/i915/i915_debugfs.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/i915/i915_debugfs.c 2011-05-04 17:56:28.000000000 -0400
@@ -192,7 +192,7 @@ static int i915_interrupt_info(struct se
I915_READ(GTIMR));
}
@@ -29773,9 +29721,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/i915/i915_debugfs.c linux-2.6.32.43/d
if (dev_priv->hw_status_page != NULL) {
seq_printf(m, "Current sequence: %d\n",
i915_get_gem_seqno(dev));
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/i915/i915_drv.c linux-2.6.32.43/drivers/gpu/drm/i915/i915_drv.c
---- linux-2.6.32.43/drivers/gpu/drm/i915/i915_drv.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/i915/i915_drv.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/i915/i915_drv.c linux-2.6.32.44/drivers/gpu/drm/i915/i915_drv.c
+--- linux-2.6.32.44/drivers/gpu/drm/i915/i915_drv.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/i915/i915_drv.c 2011-04-17 15:56:46.000000000 -0400
@@ -285,7 +285,7 @@ i915_pci_resume(struct pci_dev *pdev)
return i915_resume(dev);
}
@@ -29785,9 +29733,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/i915/i915_drv.c linux-2.6.32.43/drive
.fault = i915_gem_fault,
.open = drm_gem_vm_open,
.close = drm_gem_vm_close,
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/i915/i915_drv.h linux-2.6.32.43/drivers/gpu/drm/i915/i915_drv.h
---- linux-2.6.32.43/drivers/gpu/drm/i915/i915_drv.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/i915/i915_drv.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/i915/i915_drv.h linux-2.6.32.44/drivers/gpu/drm/i915/i915_drv.h
+--- linux-2.6.32.44/drivers/gpu/drm/i915/i915_drv.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/i915/i915_drv.h 2011-08-05 20:33:55.000000000 -0400
@@ -168,7 +168,7 @@ struct drm_i915_display_funcs {
/* display clock increase/decrease */
/* pll clock increase/decrease */
@@ -29806,9 +29754,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/i915/i915_drv.h linux-2.6.32.43/drive
/** Protects user_irq_refcount and irq_mask_reg */
spinlock_t user_irq_lock;
/** Refcount for i915_user_irq_get() versus i915_user_irq_put(). */
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/i915/i915_gem.c linux-2.6.32.43/drivers/gpu/drm/i915/i915_gem.c
---- linux-2.6.32.43/drivers/gpu/drm/i915/i915_gem.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/i915/i915_gem.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/i915/i915_gem.c linux-2.6.32.44/drivers/gpu/drm/i915/i915_gem.c
+--- linux-2.6.32.44/drivers/gpu/drm/i915/i915_gem.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/i915/i915_gem.c 2011-04-17 15:56:46.000000000 -0400
@@ -102,7 +102,7 @@ i915_gem_get_aperture_ioctl(struct drm_d
args->aper_size = dev->gtt_total;
@@ -29891,9 +29839,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/i915/i915_gem.c linux-2.6.32.43/drive
}
i915_verify_inactive(dev, __FILE__, __LINE__);
}
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/i915/i915_irq.c linux-2.6.32.43/drivers/gpu/drm/i915/i915_irq.c
---- linux-2.6.32.43/drivers/gpu/drm/i915/i915_irq.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/i915/i915_irq.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/i915/i915_irq.c linux-2.6.32.44/drivers/gpu/drm/i915/i915_irq.c
+--- linux-2.6.32.44/drivers/gpu/drm/i915/i915_irq.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/i915/i915_irq.c 2011-05-04 17:56:28.000000000 -0400
@@ -528,7 +528,7 @@ irqreturn_t i915_driver_irq_handler(DRM_
int irq_received;
int ret = IRQ_NONE;
@@ -29912,9 +29860,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/i915/i915_irq.c linux-2.6.32.43/drive
INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
INIT_WORK(&dev_priv->error_work, i915_error_work_func);
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/i915/intel_sdvo.c linux-2.6.32.43/drivers/gpu/drm/i915/intel_sdvo.c
---- linux-2.6.32.43/drivers/gpu/drm/i915/intel_sdvo.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/i915/intel_sdvo.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/i915/intel_sdvo.c linux-2.6.32.44/drivers/gpu/drm/i915/intel_sdvo.c
+--- linux-2.6.32.44/drivers/gpu/drm/i915/intel_sdvo.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/i915/intel_sdvo.c 2011-08-05 20:33:55.000000000 -0400
@@ -2795,7 +2795,9 @@ bool intel_sdvo_init(struct drm_device *
sdvo_priv->slave_addr = intel_sdvo_get_slave_addr(dev, output_device);
@@ -29926,9 +29874,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/i915/intel_sdvo.c linux-2.6.32.43/dri
/* Read the regs to test if we can talk to the device */
for (i = 0; i < 0x40; i++) {
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/mga/mga_drv.h linux-2.6.32.43/drivers/gpu/drm/mga/mga_drv.h
---- linux-2.6.32.43/drivers/gpu/drm/mga/mga_drv.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/mga/mga_drv.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/mga/mga_drv.h linux-2.6.32.44/drivers/gpu/drm/mga/mga_drv.h
+--- linux-2.6.32.44/drivers/gpu/drm/mga/mga_drv.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/mga/mga_drv.h 2011-05-04 17:56:28.000000000 -0400
@@ -120,9 +120,9 @@ typedef struct drm_mga_private {
u32 clear_cmd;
u32 maccess;
@@ -29941,9 +29889,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/mga/mga_drv.h linux-2.6.32.43/drivers
u32 next_fence_to_post;
unsigned int fb_cpp;
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/mga/mga_irq.c linux-2.6.32.43/drivers/gpu/drm/mga/mga_irq.c
---- linux-2.6.32.43/drivers/gpu/drm/mga/mga_irq.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/mga/mga_irq.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/mga/mga_irq.c linux-2.6.32.44/drivers/gpu/drm/mga/mga_irq.c
+--- linux-2.6.32.44/drivers/gpu/drm/mga/mga_irq.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/mga/mga_irq.c 2011-05-04 17:56:28.000000000 -0400
@@ -44,7 +44,7 @@ u32 mga_get_vblank_counter(struct drm_de
if (crtc != 0)
return 0;
@@ -29980,9 +29928,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/mga/mga_irq.c linux-2.6.32.43/drivers
- *sequence) <= (1 << 23)));
*sequence = cur_fence;
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/r128/r128_cce.c linux-2.6.32.43/drivers/gpu/drm/r128/r128_cce.c
---- linux-2.6.32.43/drivers/gpu/drm/r128/r128_cce.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/r128/r128_cce.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/r128/r128_cce.c linux-2.6.32.44/drivers/gpu/drm/r128/r128_cce.c
+--- linux-2.6.32.44/drivers/gpu/drm/r128/r128_cce.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/r128/r128_cce.c 2011-05-04 17:56:28.000000000 -0400
@@ -377,7 +377,7 @@ static int r128_do_init_cce(struct drm_d
/* GH: Simple idle check.
@@ -29992,9 +29940,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/r128/r128_cce.c linux-2.6.32.43/drive
/* We don't support anything other than bus-mastering ring mode,
* but the ring can be in either AGP or PCI space for the ring
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/r128/r128_drv.h linux-2.6.32.43/drivers/gpu/drm/r128/r128_drv.h
---- linux-2.6.32.43/drivers/gpu/drm/r128/r128_drv.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/r128/r128_drv.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/r128/r128_drv.h linux-2.6.32.44/drivers/gpu/drm/r128/r128_drv.h
+--- linux-2.6.32.44/drivers/gpu/drm/r128/r128_drv.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/r128/r128_drv.h 2011-05-04 17:56:28.000000000 -0400
@@ -90,14 +90,14 @@ typedef struct drm_r128_private {
int is_pci;
unsigned long cce_buffers_offset;
@@ -30012,9 +29960,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/r128/r128_drv.h linux-2.6.32.43/drive
u32 color_fmt;
unsigned int front_offset;
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/r128/r128_irq.c linux-2.6.32.43/drivers/gpu/drm/r128/r128_irq.c
---- linux-2.6.32.43/drivers/gpu/drm/r128/r128_irq.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/r128/r128_irq.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/r128/r128_irq.c linux-2.6.32.44/drivers/gpu/drm/r128/r128_irq.c
+--- linux-2.6.32.44/drivers/gpu/drm/r128/r128_irq.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/r128/r128_irq.c 2011-05-04 17:56:28.000000000 -0400
@@ -42,7 +42,7 @@ u32 r128_get_vblank_counter(struct drm_d
if (crtc != 0)
return 0;
@@ -30033,9 +29981,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/r128/r128_irq.c linux-2.6.32.43/drive
drm_handle_vblank(dev, 0);
return IRQ_HANDLED;
}
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/r128/r128_state.c linux-2.6.32.43/drivers/gpu/drm/r128/r128_state.c
---- linux-2.6.32.43/drivers/gpu/drm/r128/r128_state.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/r128/r128_state.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/r128/r128_state.c linux-2.6.32.44/drivers/gpu/drm/r128/r128_state.c
+--- linux-2.6.32.44/drivers/gpu/drm/r128/r128_state.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/r128/r128_state.c 2011-05-04 17:56:28.000000000 -0400
@@ -323,10 +323,10 @@ static void r128_clear_box(drm_r128_priv
static void r128_cce_performance_boxes(drm_r128_private_t * dev_priv)
@@ -30049,9 +29997,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/r128/r128_state.c linux-2.6.32.43/dri
}
}
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/radeon/atom.c linux-2.6.32.43/drivers/gpu/drm/radeon/atom.c
---- linux-2.6.32.43/drivers/gpu/drm/radeon/atom.c 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/radeon/atom.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/radeon/atom.c linux-2.6.32.44/drivers/gpu/drm/radeon/atom.c
+--- linux-2.6.32.44/drivers/gpu/drm/radeon/atom.c 2011-05-10 22:12:01.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/radeon/atom.c 2011-05-16 21:46:57.000000000 -0400
@@ -1115,6 +1115,8 @@ struct atom_context *atom_parse(struct c
char name[512];
int i;
@@ -30061,9 +30009,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/radeon/atom.c linux-2.6.32.43/drivers
ctx->card = card;
ctx->bios = bios;
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/radeon/mkregtable.c linux-2.6.32.43/drivers/gpu/drm/radeon/mkregtable.c
---- linux-2.6.32.43/drivers/gpu/drm/radeon/mkregtable.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/radeon/mkregtable.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/radeon/mkregtable.c linux-2.6.32.44/drivers/gpu/drm/radeon/mkregtable.c
+--- linux-2.6.32.44/drivers/gpu/drm/radeon/mkregtable.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/radeon/mkregtable.c 2011-04-17 15:56:46.000000000 -0400
@@ -637,14 +637,14 @@ static int parser_auth(struct table *t,
regex_t mask_rex;
regmatch_t match[4];
@@ -30081,9 +30029,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/radeon/mkregtable.c linux-2.6.32.43/d
if (regcomp
(&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_atombios.c linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_atombios.c
---- linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_atombios.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_atombios.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/radeon/radeon_atombios.c linux-2.6.32.44/drivers/gpu/drm/radeon/radeon_atombios.c
+--- linux-2.6.32.44/drivers/gpu/drm/radeon/radeon_atombios.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/radeon/radeon_atombios.c 2011-05-16 21:46:57.000000000 -0400
@@ -275,6 +275,8 @@ bool radeon_get_atom_connector_info_from
bool linkb;
struct radeon_i2c_bus_rec ddc_bus;
@@ -30117,9 +30065,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_atombios.c linux-2.6.32
atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset);
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_display.c linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_display.c
---- linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_display.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_display.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/radeon/radeon_display.c linux-2.6.32.44/drivers/gpu/drm/radeon/radeon_display.c
+--- linux-2.6.32.44/drivers/gpu/drm/radeon/radeon_display.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/radeon/radeon_display.c 2011-04-17 15:56:46.000000000 -0400
@@ -482,7 +482,7 @@ void radeon_compute_pll(struct radeon_pl
if (flags & RADEON_PLL_PREFER_CLOSEST_LOWER) {
@@ -30129,9 +30077,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_display.c linux-2.6.32.
} else
error = abs(current_freq - freq);
vco_diff = abs(vco - best_vco);
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_drv.h linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_drv.h
---- linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_drv.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_drv.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/radeon/radeon_drv.h linux-2.6.32.44/drivers/gpu/drm/radeon/radeon_drv.h
+--- linux-2.6.32.44/drivers/gpu/drm/radeon/radeon_drv.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/radeon/radeon_drv.h 2011-05-04 17:56:28.000000000 -0400
@@ -253,7 +253,7 @@ typedef struct drm_radeon_private {
/* SW interrupt */
@@ -30141,9 +30089,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_drv.h linux-2.6.32.43/d
int vblank_crtc;
uint32_t irq_enable_reg;
uint32_t r500_disp_irq_reg;
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_fence.c linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_fence.c
---- linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_fence.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_fence.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/radeon/radeon_fence.c linux-2.6.32.44/drivers/gpu/drm/radeon/radeon_fence.c
+--- linux-2.6.32.44/drivers/gpu/drm/radeon/radeon_fence.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/radeon/radeon_fence.c 2011-05-04 17:56:28.000000000 -0400
@@ -47,7 +47,7 @@ int radeon_fence_emit(struct radeon_devi
write_unlock_irqrestore(&rdev->fence_drv.lock, irq_flags);
return 0;
@@ -30162,9 +30110,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_fence.c linux-2.6.32.43
INIT_LIST_HEAD(&rdev->fence_drv.created);
INIT_LIST_HEAD(&rdev->fence_drv.emited);
INIT_LIST_HEAD(&rdev->fence_drv.signaled);
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/radeon/radeon.h linux-2.6.32.43/drivers/gpu/drm/radeon/radeon.h
---- linux-2.6.32.43/drivers/gpu/drm/radeon/radeon.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/radeon/radeon.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/radeon/radeon.h linux-2.6.32.44/drivers/gpu/drm/radeon/radeon.h
+--- linux-2.6.32.44/drivers/gpu/drm/radeon/radeon.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/radeon/radeon.h 2011-08-05 20:33:55.000000000 -0400
@@ -149,7 +149,7 @@ int radeon_pm_init(struct radeon_device
*/
struct radeon_fence_driver {
@@ -30183,9 +30131,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/radeon/radeon.h linux-2.6.32.43/drive
/*
* Asic structures
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_ioc32.c linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_ioc32.c
---- linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_ioc32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_ioc32.c 2011-04-23 13:57:24.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/radeon/radeon_ioc32.c linux-2.6.32.44/drivers/gpu/drm/radeon/radeon_ioc32.c
+--- linux-2.6.32.44/drivers/gpu/drm/radeon/radeon_ioc32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/radeon/radeon_ioc32.c 2011-04-23 13:57:24.000000000 -0400
@@ -368,7 +368,7 @@ static int compat_radeon_cp_setparam(str
request = compat_alloc_user_space(sizeof(*request));
if (!access_ok(VERIFY_WRITE, request, sizeof(*request))
@@ -30195,9 +30143,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_ioc32.c linux-2.6.32.43
&request->value))
return -EFAULT;
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_irq.c linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_irq.c
---- linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_irq.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_irq.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/radeon/radeon_irq.c linux-2.6.32.44/drivers/gpu/drm/radeon/radeon_irq.c
+--- linux-2.6.32.44/drivers/gpu/drm/radeon/radeon_irq.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/radeon/radeon_irq.c 2011-05-04 17:56:28.000000000 -0400
@@ -225,8 +225,8 @@ static int radeon_emit_irq(struct drm_de
unsigned int ret;
RING_LOCALS;
@@ -30218,9 +30166,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_irq.c linux-2.6.32.43/d
DRM_INIT_WAITQUEUE(&dev_priv->swi_queue);
dev->max_vblank_count = 0x001fffff;
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_state.c linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_state.c
---- linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_state.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_state.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/radeon/radeon_state.c linux-2.6.32.44/drivers/gpu/drm/radeon/radeon_state.c
+--- linux-2.6.32.44/drivers/gpu/drm/radeon/radeon_state.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/radeon/radeon_state.c 2011-04-17 15:56:46.000000000 -0400
@@ -3021,7 +3021,7 @@ static int radeon_cp_getparam(struct drm
{
drm_radeon_private_t *dev_priv = dev->dev_private;
@@ -30230,9 +30178,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_state.c linux-2.6.32.43
DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_ttm.c linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_ttm.c
---- linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_ttm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_ttm.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/radeon/radeon_ttm.c linux-2.6.32.44/drivers/gpu/drm/radeon/radeon_ttm.c
+--- linux-2.6.32.44/drivers/gpu/drm/radeon/radeon_ttm.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/radeon/radeon_ttm.c 2011-04-17 15:56:46.000000000 -0400
@@ -535,27 +535,10 @@ void radeon_ttm_fini(struct radeon_devic
DRM_INFO("radeon: ttm finalized\n");
}
@@ -30284,9 +30232,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_ttm.c linux-2.6.32.43/d
}
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/radeon/rs690.c linux-2.6.32.43/drivers/gpu/drm/radeon/rs690.c
---- linux-2.6.32.43/drivers/gpu/drm/radeon/rs690.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/radeon/rs690.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/radeon/rs690.c linux-2.6.32.44/drivers/gpu/drm/radeon/rs690.c
+--- linux-2.6.32.44/drivers/gpu/drm/radeon/rs690.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/radeon/rs690.c 2011-04-17 15:56:46.000000000 -0400
@@ -302,9 +302,11 @@ void rs690_crtc_bandwidth_compute(struct
if (rdev->pm.max_bandwidth.full > rdev->pm.sideport_bandwidth.full &&
rdev->pm.sideport_bandwidth.full)
@@ -30300,9 +30248,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/radeon/rs690.c linux-2.6.32.43/driver
} else {
if (rdev->pm.max_bandwidth.full > rdev->pm.k8_bandwidth.full &&
rdev->pm.k8_bandwidth.full)
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/ttm/ttm_bo.c linux-2.6.32.43/drivers/gpu/drm/ttm/ttm_bo.c
---- linux-2.6.32.43/drivers/gpu/drm/ttm/ttm_bo.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/ttm/ttm_bo.c 2011-04-23 12:56:11.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/ttm/ttm_bo.c linux-2.6.32.44/drivers/gpu/drm/ttm/ttm_bo.c
+--- linux-2.6.32.44/drivers/gpu/drm/ttm/ttm_bo.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/ttm/ttm_bo.c 2011-04-23 12:56:11.000000000 -0400
@@ -67,7 +67,7 @@ static struct attribute *ttm_bo_global_a
NULL
};
@@ -30312,9 +30260,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/ttm/ttm_bo.c linux-2.6.32.43/drivers/
.show = &ttm_bo_global_show
};
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/ttm/ttm_bo_vm.c linux-2.6.32.43/drivers/gpu/drm/ttm/ttm_bo_vm.c
---- linux-2.6.32.43/drivers/gpu/drm/ttm/ttm_bo_vm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/ttm/ttm_bo_vm.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/ttm/ttm_bo_vm.c linux-2.6.32.44/drivers/gpu/drm/ttm/ttm_bo_vm.c
+--- linux-2.6.32.44/drivers/gpu/drm/ttm/ttm_bo_vm.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/ttm/ttm_bo_vm.c 2011-04-17 15:56:46.000000000 -0400
@@ -73,7 +73,7 @@ static int ttm_bo_vm_fault(struct vm_are
{
struct ttm_buffer_object *bo = (struct ttm_buffer_object *)
@@ -30335,9 +30283,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/ttm/ttm_bo_vm.c linux-2.6.32.43/drive
/*
* Work around locking order reversal in fault / nopfn
* between mmap_sem and bo_reserve: Perform a trylock operation
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/ttm/ttm_global.c linux-2.6.32.43/drivers/gpu/drm/ttm/ttm_global.c
---- linux-2.6.32.43/drivers/gpu/drm/ttm/ttm_global.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/ttm/ttm_global.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/ttm/ttm_global.c linux-2.6.32.44/drivers/gpu/drm/ttm/ttm_global.c
+--- linux-2.6.32.44/drivers/gpu/drm/ttm/ttm_global.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/ttm/ttm_global.c 2011-04-17 15:56:46.000000000 -0400
@@ -36,7 +36,7 @@
struct ttm_global_item {
struct mutex mutex;
@@ -30395,9 +30343,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/ttm/ttm_global.c linux-2.6.32.43/driv
ref->release(ref);
item->object = NULL;
}
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/ttm/ttm_memory.c linux-2.6.32.43/drivers/gpu/drm/ttm/ttm_memory.c
---- linux-2.6.32.43/drivers/gpu/drm/ttm/ttm_memory.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/ttm/ttm_memory.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/ttm/ttm_memory.c linux-2.6.32.44/drivers/gpu/drm/ttm/ttm_memory.c
+--- linux-2.6.32.44/drivers/gpu/drm/ttm/ttm_memory.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/ttm/ttm_memory.c 2011-04-17 15:56:46.000000000 -0400
@@ -152,7 +152,7 @@ static struct attribute *ttm_mem_zone_at
NULL
};
@@ -30407,9 +30355,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/ttm/ttm_memory.c linux-2.6.32.43/driv
.show = &ttm_mem_zone_show,
.store = &ttm_mem_zone_store
};
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/via/via_drv.h linux-2.6.32.43/drivers/gpu/drm/via/via_drv.h
---- linux-2.6.32.43/drivers/gpu/drm/via/via_drv.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/via/via_drv.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/via/via_drv.h linux-2.6.32.44/drivers/gpu/drm/via/via_drv.h
+--- linux-2.6.32.44/drivers/gpu/drm/via/via_drv.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/via/via_drv.h 2011-05-04 17:56:28.000000000 -0400
@@ -51,7 +51,7 @@ typedef struct drm_via_ring_buffer {
typedef uint32_t maskarray_t[5];
@@ -30428,9 +30376,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/via/via_drv.h linux-2.6.32.43/drivers
drm_via_state_t hc_state;
char pci_buf[VIA_PCI_BUF_SIZE];
const uint32_t *fire_offsets[VIA_FIRE_BUF_SIZE];
-diff -urNp linux-2.6.32.43/drivers/gpu/drm/via/via_irq.c linux-2.6.32.43/drivers/gpu/drm/via/via_irq.c
---- linux-2.6.32.43/drivers/gpu/drm/via/via_irq.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/gpu/drm/via/via_irq.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/gpu/drm/via/via_irq.c linux-2.6.32.44/drivers/gpu/drm/via/via_irq.c
+--- linux-2.6.32.44/drivers/gpu/drm/via/via_irq.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/gpu/drm/via/via_irq.c 2011-05-04 17:56:28.000000000 -0400
@@ -102,7 +102,7 @@ u32 via_get_vblank_counter(struct drm_de
if (crtc != 0)
return 0;
@@ -30501,9 +30449,9 @@ diff -urNp linux-2.6.32.43/drivers/gpu/drm/via/via_irq.c linux-2.6.32.43/drivers
irqwait->request.type &= ~_DRM_VBLANK_RELATIVE;
case VIA_IRQ_ABSOLUTE:
break;
-diff -urNp linux-2.6.32.43/drivers/hid/hid-core.c linux-2.6.32.43/drivers/hid/hid-core.c
---- linux-2.6.32.43/drivers/hid/hid-core.c 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.43/drivers/hid/hid-core.c 2011-05-10 22:12:32.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/hid/hid-core.c linux-2.6.32.44/drivers/hid/hid-core.c
+--- linux-2.6.32.44/drivers/hid/hid-core.c 2011-05-10 22:12:01.000000000 -0400
++++ linux-2.6.32.44/drivers/hid/hid-core.c 2011-05-10 22:12:32.000000000 -0400
@@ -1752,7 +1752,7 @@ static bool hid_ignore(struct hid_device
int hid_add_device(struct hid_device *hdev)
@@ -30522,9 +30470,9 @@ diff -urNp linux-2.6.32.43/drivers/hid/hid-core.c linux-2.6.32.43/drivers/hid/hi
ret = device_add(&hdev->dev);
if (!ret)
-diff -urNp linux-2.6.32.43/drivers/hid/usbhid/hiddev.c linux-2.6.32.43/drivers/hid/usbhid/hiddev.c
---- linux-2.6.32.43/drivers/hid/usbhid/hiddev.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/hid/usbhid/hiddev.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/hid/usbhid/hiddev.c linux-2.6.32.44/drivers/hid/usbhid/hiddev.c
+--- linux-2.6.32.44/drivers/hid/usbhid/hiddev.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/hid/usbhid/hiddev.c 2011-04-17 15:56:46.000000000 -0400
@@ -617,7 +617,7 @@ static long hiddev_ioctl(struct file *fi
return put_user(HID_VERSION, (int __user *)arg);
@@ -30534,9 +30482,9 @@ diff -urNp linux-2.6.32.43/drivers/hid/usbhid/hiddev.c linux-2.6.32.43/drivers/h
return -EINVAL;
for (i = 0; i < hid->maxcollection; i++)
-diff -urNp linux-2.6.32.43/drivers/hwmon/lis3lv02d.c linux-2.6.32.43/drivers/hwmon/lis3lv02d.c
---- linux-2.6.32.43/drivers/hwmon/lis3lv02d.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/hwmon/lis3lv02d.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/hwmon/lis3lv02d.c linux-2.6.32.44/drivers/hwmon/lis3lv02d.c
+--- linux-2.6.32.44/drivers/hwmon/lis3lv02d.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/hwmon/lis3lv02d.c 2011-05-04 17:56:28.000000000 -0400
@@ -146,7 +146,7 @@ static irqreturn_t lis302dl_interrupt(in
* the lid is closed. This leads to interrupts as soon as a little move
* is done.
@@ -30573,9 +30521,9 @@ diff -urNp linux-2.6.32.43/drivers/hwmon/lis3lv02d.c linux-2.6.32.43/drivers/hwm
return POLLIN | POLLRDNORM;
return 0;
}
-diff -urNp linux-2.6.32.43/drivers/hwmon/lis3lv02d.h linux-2.6.32.43/drivers/hwmon/lis3lv02d.h
---- linux-2.6.32.43/drivers/hwmon/lis3lv02d.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/hwmon/lis3lv02d.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/hwmon/lis3lv02d.h linux-2.6.32.44/drivers/hwmon/lis3lv02d.h
+--- linux-2.6.32.44/drivers/hwmon/lis3lv02d.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/hwmon/lis3lv02d.h 2011-05-04 17:56:28.000000000 -0400
@@ -201,7 +201,7 @@ struct lis3lv02d {
struct input_polled_dev *idev; /* input device */
@@ -30585,9 +30533,9 @@ diff -urNp linux-2.6.32.43/drivers/hwmon/lis3lv02d.h linux-2.6.32.43/drivers/hwm
int xcalib; /* calibrated null value for x */
int ycalib; /* calibrated null value for y */
int zcalib; /* calibrated null value for z */
-diff -urNp linux-2.6.32.43/drivers/hwmon/sht15.c linux-2.6.32.43/drivers/hwmon/sht15.c
---- linux-2.6.32.43/drivers/hwmon/sht15.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/hwmon/sht15.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/hwmon/sht15.c linux-2.6.32.44/drivers/hwmon/sht15.c
+--- linux-2.6.32.44/drivers/hwmon/sht15.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/hwmon/sht15.c 2011-05-04 17:56:28.000000000 -0400
@@ -112,7 +112,7 @@ struct sht15_data {
int supply_uV;
int supply_uV_valid;
@@ -30636,9 +30584,9 @@ diff -urNp linux-2.6.32.43/drivers/hwmon/sht15.c linux-2.6.32.43/drivers/hwmon/s
return;
}
/* Read the data back from the device */
-diff -urNp linux-2.6.32.43/drivers/hwmon/w83791d.c linux-2.6.32.43/drivers/hwmon/w83791d.c
---- linux-2.6.32.43/drivers/hwmon/w83791d.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/hwmon/w83791d.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/hwmon/w83791d.c linux-2.6.32.44/drivers/hwmon/w83791d.c
+--- linux-2.6.32.44/drivers/hwmon/w83791d.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/hwmon/w83791d.c 2011-04-17 15:56:46.000000000 -0400
@@ -330,8 +330,8 @@ static int w83791d_detect(struct i2c_cli
struct i2c_board_info *info);
static int w83791d_remove(struct i2c_client *client);
@@ -30650,9 +30598,9 @@ diff -urNp linux-2.6.32.43/drivers/hwmon/w83791d.c linux-2.6.32.43/drivers/hwmon
static struct w83791d_data *w83791d_update_device(struct device *dev);
#ifdef DEBUG
-diff -urNp linux-2.6.32.43/drivers/i2c/busses/i2c-amd756-s4882.c linux-2.6.32.43/drivers/i2c/busses/i2c-amd756-s4882.c
---- linux-2.6.32.43/drivers/i2c/busses/i2c-amd756-s4882.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/i2c/busses/i2c-amd756-s4882.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/i2c/busses/i2c-amd756-s4882.c linux-2.6.32.44/drivers/i2c/busses/i2c-amd756-s4882.c
+--- linux-2.6.32.44/drivers/i2c/busses/i2c-amd756-s4882.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/i2c/busses/i2c-amd756-s4882.c 2011-08-05 20:33:55.000000000 -0400
@@ -189,23 +189,23 @@ static int __init amd756_s4882_init(void
}
@@ -30685,9 +30633,9 @@ diff -urNp linux-2.6.32.43/drivers/i2c/busses/i2c-amd756-s4882.c linux-2.6.32.43
/* Register virtual adapters */
for (i = 0; i < 5; i++) {
-diff -urNp linux-2.6.32.43/drivers/i2c/busses/i2c-nforce2-s4985.c linux-2.6.32.43/drivers/i2c/busses/i2c-nforce2-s4985.c
---- linux-2.6.32.43/drivers/i2c/busses/i2c-nforce2-s4985.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/i2c/busses/i2c-nforce2-s4985.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/i2c/busses/i2c-nforce2-s4985.c linux-2.6.32.44/drivers/i2c/busses/i2c-nforce2-s4985.c
+--- linux-2.6.32.44/drivers/i2c/busses/i2c-nforce2-s4985.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/i2c/busses/i2c-nforce2-s4985.c 2011-08-05 20:33:55.000000000 -0400
@@ -184,23 +184,23 @@ static int __init nforce2_s4985_init(voi
}
@@ -30719,9 +30667,9 @@ diff -urNp linux-2.6.32.43/drivers/i2c/busses/i2c-nforce2-s4985.c linux-2.6.32.4
/* Register virtual adapters */
for (i = 0; i < 5; i++) {
-diff -urNp linux-2.6.32.43/drivers/ide/ide-cd.c linux-2.6.32.43/drivers/ide/ide-cd.c
---- linux-2.6.32.43/drivers/ide/ide-cd.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ide/ide-cd.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ide/ide-cd.c linux-2.6.32.44/drivers/ide/ide-cd.c
+--- linux-2.6.32.44/drivers/ide/ide-cd.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ide/ide-cd.c 2011-04-17 15:56:46.000000000 -0400
@@ -774,7 +774,7 @@ static void cdrom_do_block_pc(ide_drive_
alignment = queue_dma_alignment(q) | q->dma_pad_mask;
if ((unsigned long)buf & alignment
@@ -30731,9 +30679,9 @@ diff -urNp linux-2.6.32.43/drivers/ide/ide-cd.c linux-2.6.32.43/drivers/ide/ide-
drive->dma = 0;
}
}
-diff -urNp linux-2.6.32.43/drivers/ide/ide-floppy.c linux-2.6.32.43/drivers/ide/ide-floppy.c
---- linux-2.6.32.43/drivers/ide/ide-floppy.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ide/ide-floppy.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ide/ide-floppy.c linux-2.6.32.44/drivers/ide/ide-floppy.c
+--- linux-2.6.32.44/drivers/ide/ide-floppy.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ide/ide-floppy.c 2011-05-16 21:46:57.000000000 -0400
@@ -373,6 +373,8 @@ static int ide_floppy_get_capacity(ide_d
u8 pc_buf[256], header_len, desc_cnt;
int i, rc = 1, blocks, length;
@@ -30743,9 +30691,9 @@ diff -urNp linux-2.6.32.43/drivers/ide/ide-floppy.c linux-2.6.32.43/drivers/ide/
ide_debug_log(IDE_DBG_FUNC, "enter");
drive->bios_cyl = 0;
-diff -urNp linux-2.6.32.43/drivers/ide/setup-pci.c linux-2.6.32.43/drivers/ide/setup-pci.c
---- linux-2.6.32.43/drivers/ide/setup-pci.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ide/setup-pci.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ide/setup-pci.c linux-2.6.32.44/drivers/ide/setup-pci.c
+--- linux-2.6.32.44/drivers/ide/setup-pci.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ide/setup-pci.c 2011-05-16 21:46:57.000000000 -0400
@@ -542,6 +542,8 @@ int ide_pci_init_two(struct pci_dev *dev
int ret, i, n_ports = dev2 ? 4 : 2;
struct ide_hw hw[4], *hws[] = { NULL, NULL, NULL, NULL };
@@ -30755,9 +30703,9 @@ diff -urNp linux-2.6.32.43/drivers/ide/setup-pci.c linux-2.6.32.43/drivers/ide/s
for (i = 0; i < n_ports / 2; i++) {
ret = ide_setup_pci_controller(pdev[i], d, !i);
if (ret < 0)
-diff -urNp linux-2.6.32.43/drivers/ieee1394/dv1394.c linux-2.6.32.43/drivers/ieee1394/dv1394.c
---- linux-2.6.32.43/drivers/ieee1394/dv1394.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ieee1394/dv1394.c 2011-04-23 12:56:11.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ieee1394/dv1394.c linux-2.6.32.44/drivers/ieee1394/dv1394.c
+--- linux-2.6.32.44/drivers/ieee1394/dv1394.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ieee1394/dv1394.c 2011-04-23 12:56:11.000000000 -0400
@@ -739,7 +739,7 @@ static void frame_prepare(struct video_c
based upon DIF section and sequence
*/
@@ -30767,9 +30715,9 @@ diff -urNp linux-2.6.32.43/drivers/ieee1394/dv1394.c linux-2.6.32.43/drivers/iee
frame_put_packet (struct frame *f, struct packet *p)
{
int section_type = p->data[0] >> 5; /* section type is in bits 5 - 7 */
-diff -urNp linux-2.6.32.43/drivers/ieee1394/hosts.c linux-2.6.32.43/drivers/ieee1394/hosts.c
---- linux-2.6.32.43/drivers/ieee1394/hosts.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ieee1394/hosts.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ieee1394/hosts.c linux-2.6.32.44/drivers/ieee1394/hosts.c
+--- linux-2.6.32.44/drivers/ieee1394/hosts.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ieee1394/hosts.c 2011-04-17 15:56:46.000000000 -0400
@@ -78,6 +78,7 @@ static int dummy_isoctl(struct hpsb_iso
}
@@ -30778,9 +30726,9 @@ diff -urNp linux-2.6.32.43/drivers/ieee1394/hosts.c linux-2.6.32.43/drivers/ieee
.transmit_packet = dummy_transmit_packet,
.devctl = dummy_devctl,
.isoctl = dummy_isoctl
-diff -urNp linux-2.6.32.43/drivers/ieee1394/init_ohci1394_dma.c linux-2.6.32.43/drivers/ieee1394/init_ohci1394_dma.c
---- linux-2.6.32.43/drivers/ieee1394/init_ohci1394_dma.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ieee1394/init_ohci1394_dma.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ieee1394/init_ohci1394_dma.c linux-2.6.32.44/drivers/ieee1394/init_ohci1394_dma.c
+--- linux-2.6.32.44/drivers/ieee1394/init_ohci1394_dma.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ieee1394/init_ohci1394_dma.c 2011-04-17 15:56:46.000000000 -0400
@@ -257,7 +257,7 @@ void __init init_ohci1394_dma_on_all_con
for (func = 0; func < 8; func++) {
u32 class = read_pci_config(num,slot,func,
@@ -30790,9 +30738,9 @@ diff -urNp linux-2.6.32.43/drivers/ieee1394/init_ohci1394_dma.c linux-2.6.32.43/
continue; /* No device at this func */
if (class>>8 != PCI_CLASS_SERIAL_FIREWIRE_OHCI)
-diff -urNp linux-2.6.32.43/drivers/ieee1394/ohci1394.c linux-2.6.32.43/drivers/ieee1394/ohci1394.c
---- linux-2.6.32.43/drivers/ieee1394/ohci1394.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ieee1394/ohci1394.c 2011-04-23 12:56:11.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ieee1394/ohci1394.c linux-2.6.32.44/drivers/ieee1394/ohci1394.c
+--- linux-2.6.32.44/drivers/ieee1394/ohci1394.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ieee1394/ohci1394.c 2011-04-23 12:56:11.000000000 -0400
@@ -147,9 +147,9 @@ printk(level "%s: " fmt "\n" , OHCI1394_
printk(level "%s: fw-host%d: " fmt "\n" , OHCI1394_DRIVER_NAME, ohci->host->id , ## args)
@@ -30805,9 +30753,9 @@ diff -urNp linux-2.6.32.43/drivers/ieee1394/ohci1394.c linux-2.6.32.43/drivers/i
static void dma_trm_tasklet(unsigned long data);
static void dma_trm_reset(struct dma_trm_ctx *d);
-diff -urNp linux-2.6.32.43/drivers/ieee1394/sbp2.c linux-2.6.32.43/drivers/ieee1394/sbp2.c
---- linux-2.6.32.43/drivers/ieee1394/sbp2.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ieee1394/sbp2.c 2011-04-23 12:56:11.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ieee1394/sbp2.c linux-2.6.32.44/drivers/ieee1394/sbp2.c
+--- linux-2.6.32.44/drivers/ieee1394/sbp2.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ieee1394/sbp2.c 2011-04-23 12:56:11.000000000 -0400
@@ -2111,7 +2111,7 @@ MODULE_DESCRIPTION("IEEE-1394 SBP-2 prot
MODULE_SUPPORTED_DEVICE(SBP2_DEVICE_NAME);
MODULE_LICENSE("GPL");
@@ -30817,9 +30765,9 @@ diff -urNp linux-2.6.32.43/drivers/ieee1394/sbp2.c linux-2.6.32.43/drivers/ieee1
{
int ret;
-diff -urNp linux-2.6.32.43/drivers/infiniband/core/cm.c linux-2.6.32.43/drivers/infiniband/core/cm.c
---- linux-2.6.32.43/drivers/infiniband/core/cm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/infiniband/core/cm.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/infiniband/core/cm.c linux-2.6.32.44/drivers/infiniband/core/cm.c
+--- linux-2.6.32.44/drivers/infiniband/core/cm.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/infiniband/core/cm.c 2011-04-17 15:56:46.000000000 -0400
@@ -112,7 +112,7 @@ static char const counter_group_names[CM
struct cm_counter_group {
@@ -30963,9 +30911,9 @@ diff -urNp linux-2.6.32.43/drivers/infiniband/core/cm.c linux-2.6.32.43/drivers/
.show = cm_show_counter
};
-diff -urNp linux-2.6.32.43/drivers/infiniband/core/fmr_pool.c linux-2.6.32.43/drivers/infiniband/core/fmr_pool.c
---- linux-2.6.32.43/drivers/infiniband/core/fmr_pool.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/infiniband/core/fmr_pool.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/infiniband/core/fmr_pool.c linux-2.6.32.44/drivers/infiniband/core/fmr_pool.c
+--- linux-2.6.32.44/drivers/infiniband/core/fmr_pool.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/infiniband/core/fmr_pool.c 2011-05-04 17:56:28.000000000 -0400
@@ -97,8 +97,8 @@ struct ib_fmr_pool {
struct task_struct *thread;
@@ -31033,9 +30981,9 @@ diff -urNp linux-2.6.32.43/drivers/infiniband/core/fmr_pool.c linux-2.6.32.43/dr
wake_up_process(pool->thread);
}
}
-diff -urNp linux-2.6.32.43/drivers/infiniband/core/sysfs.c linux-2.6.32.43/drivers/infiniband/core/sysfs.c
---- linux-2.6.32.43/drivers/infiniband/core/sysfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/infiniband/core/sysfs.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/infiniband/core/sysfs.c linux-2.6.32.44/drivers/infiniband/core/sysfs.c
+--- linux-2.6.32.44/drivers/infiniband/core/sysfs.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/infiniband/core/sysfs.c 2011-04-17 15:56:46.000000000 -0400
@@ -79,7 +79,7 @@ static ssize_t port_attr_show(struct kob
return port_attr->show(p, port_attr, buf);
}
@@ -31045,9 +30993,9 @@ diff -urNp linux-2.6.32.43/drivers/infiniband/core/sysfs.c linux-2.6.32.43/drive
.show = port_attr_show
};
-diff -urNp linux-2.6.32.43/drivers/infiniband/core/uverbs_marshall.c linux-2.6.32.43/drivers/infiniband/core/uverbs_marshall.c
---- linux-2.6.32.43/drivers/infiniband/core/uverbs_marshall.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/infiniband/core/uverbs_marshall.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/infiniband/core/uverbs_marshall.c linux-2.6.32.44/drivers/infiniband/core/uverbs_marshall.c
+--- linux-2.6.32.44/drivers/infiniband/core/uverbs_marshall.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/infiniband/core/uverbs_marshall.c 2011-04-17 15:56:46.000000000 -0400
@@ -40,18 +40,21 @@ void ib_copy_ah_attr_to_user(struct ib_u
dst->grh.sgid_index = src->grh.sgid_index;
dst->grh.hop_limit = src->grh.hop_limit;
@@ -31078,9 +31026,9 @@ diff -urNp linux-2.6.32.43/drivers/infiniband/core/uverbs_marshall.c linux-2.6.3
}
EXPORT_SYMBOL(ib_copy_qp_attr_to_user);
-diff -urNp linux-2.6.32.43/drivers/infiniband/hw/ipath/ipath_fs.c linux-2.6.32.43/drivers/infiniband/hw/ipath/ipath_fs.c
---- linux-2.6.32.43/drivers/infiniband/hw/ipath/ipath_fs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/infiniband/hw/ipath/ipath_fs.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/infiniband/hw/ipath/ipath_fs.c linux-2.6.32.44/drivers/infiniband/hw/ipath/ipath_fs.c
+--- linux-2.6.32.44/drivers/infiniband/hw/ipath/ipath_fs.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/infiniband/hw/ipath/ipath_fs.c 2011-05-16 21:46:57.000000000 -0400
@@ -110,6 +110,8 @@ static ssize_t atomic_counters_read(stru
struct infinipath_counters counters;
struct ipath_devdata *dd;
@@ -31090,9 +31038,9 @@ diff -urNp linux-2.6.32.43/drivers/infiniband/hw/ipath/ipath_fs.c linux-2.6.32.4
dd = file->f_path.dentry->d_inode->i_private;
dd->ipath_f_read_counters(dd, &counters);
-diff -urNp linux-2.6.32.43/drivers/infiniband/hw/nes/nes.c linux-2.6.32.43/drivers/infiniband/hw/nes/nes.c
---- linux-2.6.32.43/drivers/infiniband/hw/nes/nes.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/infiniband/hw/nes/nes.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/infiniband/hw/nes/nes.c linux-2.6.32.44/drivers/infiniband/hw/nes/nes.c
+--- linux-2.6.32.44/drivers/infiniband/hw/nes/nes.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/infiniband/hw/nes/nes.c 2011-05-04 17:56:28.000000000 -0400
@@ -102,7 +102,7 @@ MODULE_PARM_DESC(limit_maxrdreqsz, "Limi
LIST_HEAD(nes_adapter_list);
static LIST_HEAD(nes_dev_list);
@@ -31111,9 +31059,9 @@ diff -urNp linux-2.6.32.43/drivers/infiniband/hw/nes/nes.c linux-2.6.32.43/drive
/* Free the control structures */
-diff -urNp linux-2.6.32.43/drivers/infiniband/hw/nes/nes_cm.c linux-2.6.32.43/drivers/infiniband/hw/nes/nes_cm.c
---- linux-2.6.32.43/drivers/infiniband/hw/nes/nes_cm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/infiniband/hw/nes/nes_cm.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/infiniband/hw/nes/nes_cm.c linux-2.6.32.44/drivers/infiniband/hw/nes/nes_cm.c
+--- linux-2.6.32.44/drivers/infiniband/hw/nes/nes_cm.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/infiniband/hw/nes/nes_cm.c 2011-05-04 17:56:28.000000000 -0400
@@ -69,11 +69,11 @@ u32 cm_packets_received;
u32 cm_listens_created;
u32 cm_listens_destroyed;
@@ -31287,9 +31235,9 @@ diff -urNp linux-2.6.32.43/drivers/infiniband/hw/nes/nes_cm.c linux-2.6.32.43/dr
nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
cm_node, cm_id, jiffies);
-diff -urNp linux-2.6.32.43/drivers/infiniband/hw/nes/nes.h linux-2.6.32.43/drivers/infiniband/hw/nes/nes.h
---- linux-2.6.32.43/drivers/infiniband/hw/nes/nes.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/infiniband/hw/nes/nes.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/infiniband/hw/nes/nes.h linux-2.6.32.44/drivers/infiniband/hw/nes/nes.h
+--- linux-2.6.32.44/drivers/infiniband/hw/nes/nes.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/infiniband/hw/nes/nes.h 2011-05-04 17:56:28.000000000 -0400
@@ -174,17 +174,17 @@ extern unsigned int nes_debug_level;
extern unsigned int wqm_quanta;
extern struct list_head nes_adapter_list;
@@ -31336,9 +31284,9 @@ diff -urNp linux-2.6.32.43/drivers/infiniband/hw/nes/nes.h linux-2.6.32.43/drive
extern u32 int_mod_timer_init;
extern u32 int_mod_cq_depth_256;
-diff -urNp linux-2.6.32.43/drivers/infiniband/hw/nes/nes_nic.c linux-2.6.32.43/drivers/infiniband/hw/nes/nes_nic.c
---- linux-2.6.32.43/drivers/infiniband/hw/nes/nes_nic.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/infiniband/hw/nes/nes_nic.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/infiniband/hw/nes/nes_nic.c linux-2.6.32.44/drivers/infiniband/hw/nes/nes_nic.c
+--- linux-2.6.32.44/drivers/infiniband/hw/nes/nes_nic.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/infiniband/hw/nes/nes_nic.c 2011-05-04 17:56:28.000000000 -0400
@@ -1210,17 +1210,17 @@ static void nes_netdev_get_ethtool_stats
target_stat_values[++index] = mh_detected;
target_stat_values[++index] = mh_pauses_sent;
@@ -31385,9 +31333,9 @@ diff -urNp linux-2.6.32.43/drivers/infiniband/hw/nes/nes_nic.c linux-2.6.32.43/d
target_stat_values[++index] = int_mod_timer_init;
target_stat_values[++index] = int_mod_cq_depth_1;
target_stat_values[++index] = int_mod_cq_depth_4;
-diff -urNp linux-2.6.32.43/drivers/infiniband/hw/nes/nes_verbs.c linux-2.6.32.43/drivers/infiniband/hw/nes/nes_verbs.c
---- linux-2.6.32.43/drivers/infiniband/hw/nes/nes_verbs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/infiniband/hw/nes/nes_verbs.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/infiniband/hw/nes/nes_verbs.c linux-2.6.32.44/drivers/infiniband/hw/nes/nes_verbs.c
+--- linux-2.6.32.44/drivers/infiniband/hw/nes/nes_verbs.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/infiniband/hw/nes/nes_verbs.c 2011-05-04 17:56:28.000000000 -0400
@@ -45,9 +45,9 @@
#include <rdma/ib_umem.h>
@@ -31419,9 +31367,9 @@ diff -urNp linux-2.6.32.43/drivers/infiniband/hw/nes/nes_verbs.c linux-2.6.32.43
nesqp->destroyed = 1;
/* Blow away the connection if it exists. */
-diff -urNp linux-2.6.32.43/drivers/input/gameport/gameport.c linux-2.6.32.43/drivers/input/gameport/gameport.c
---- linux-2.6.32.43/drivers/input/gameport/gameport.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/input/gameport/gameport.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/input/gameport/gameport.c linux-2.6.32.44/drivers/input/gameport/gameport.c
+--- linux-2.6.32.44/drivers/input/gameport/gameport.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/input/gameport/gameport.c 2011-05-04 17:56:28.000000000 -0400
@@ -515,13 +515,13 @@ EXPORT_SYMBOL(gameport_set_phys);
*/
static void gameport_init_port(struct gameport *gameport)
@@ -31438,9 +31386,9 @@ diff -urNp linux-2.6.32.43/drivers/input/gameport/gameport.c linux-2.6.32.43/dri
gameport->dev.bus = &gameport_bus;
gameport->dev.release = gameport_release_port;
if (gameport->parent)
-diff -urNp linux-2.6.32.43/drivers/input/input.c linux-2.6.32.43/drivers/input/input.c
---- linux-2.6.32.43/drivers/input/input.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/input/input.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/input/input.c linux-2.6.32.44/drivers/input/input.c
+--- linux-2.6.32.44/drivers/input/input.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/input/input.c 2011-05-04 17:56:28.000000000 -0400
@@ -1558,7 +1558,7 @@ EXPORT_SYMBOL(input_set_capability);
*/
int input_register_device(struct input_dev *dev)
@@ -31459,9 +31407,9 @@ diff -urNp linux-2.6.32.43/drivers/input/input.c linux-2.6.32.43/drivers/input/i
error = device_add(&dev->dev);
if (error)
-diff -urNp linux-2.6.32.43/drivers/input/joystick/sidewinder.c linux-2.6.32.43/drivers/input/joystick/sidewinder.c
---- linux-2.6.32.43/drivers/input/joystick/sidewinder.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/input/joystick/sidewinder.c 2011-05-18 20:09:36.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/input/joystick/sidewinder.c linux-2.6.32.44/drivers/input/joystick/sidewinder.c
+--- linux-2.6.32.44/drivers/input/joystick/sidewinder.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/input/joystick/sidewinder.c 2011-05-18 20:09:36.000000000 -0400
@@ -30,6 +30,7 @@
#include <linux/kernel.h>
#include <linux/module.h>
@@ -31479,9 +31427,9 @@ diff -urNp linux-2.6.32.43/drivers/input/joystick/sidewinder.c linux-2.6.32.43/d
i = sw_read_packet(sw->gameport, buf, sw->length, 0);
if (sw->type == SW_ID_3DP && sw->length == 66 && i != 66) { /* Broken packet, try to fix */
-diff -urNp linux-2.6.32.43/drivers/input/joystick/xpad.c linux-2.6.32.43/drivers/input/joystick/xpad.c
---- linux-2.6.32.43/drivers/input/joystick/xpad.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/input/joystick/xpad.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/input/joystick/xpad.c linux-2.6.32.44/drivers/input/joystick/xpad.c
+--- linux-2.6.32.44/drivers/input/joystick/xpad.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/input/joystick/xpad.c 2011-05-04 17:56:28.000000000 -0400
@@ -621,7 +621,7 @@ static void xpad_led_set(struct led_clas
static int xpad_led_probe(struct usb_xpad *xpad)
@@ -31500,9 +31448,9 @@ diff -urNp linux-2.6.32.43/drivers/input/joystick/xpad.c linux-2.6.32.43/drivers
snprintf(led->name, sizeof(led->name), "xpad%ld", led_no);
led->xpad = xpad;
-diff -urNp linux-2.6.32.43/drivers/input/serio/serio.c linux-2.6.32.43/drivers/input/serio/serio.c
---- linux-2.6.32.43/drivers/input/serio/serio.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/input/serio/serio.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/input/serio/serio.c linux-2.6.32.44/drivers/input/serio/serio.c
+--- linux-2.6.32.44/drivers/input/serio/serio.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/input/serio/serio.c 2011-05-04 17:56:28.000000000 -0400
@@ -527,7 +527,7 @@ static void serio_release_port(struct de
*/
static void serio_init_port(struct serio *serio)
@@ -31521,9 +31469,9 @@ diff -urNp linux-2.6.32.43/drivers/input/serio/serio.c linux-2.6.32.43/drivers/i
serio->dev.bus = &serio_bus;
serio->dev.release = serio_release_port;
if (serio->parent) {
-diff -urNp linux-2.6.32.43/drivers/isdn/gigaset/common.c linux-2.6.32.43/drivers/isdn/gigaset/common.c
---- linux-2.6.32.43/drivers/isdn/gigaset/common.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/isdn/gigaset/common.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/isdn/gigaset/common.c linux-2.6.32.44/drivers/isdn/gigaset/common.c
+--- linux-2.6.32.44/drivers/isdn/gigaset/common.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/isdn/gigaset/common.c 2011-04-17 15:56:46.000000000 -0400
@@ -712,7 +712,7 @@ struct cardstate *gigaset_initcs(struct
cs->commands_pending = 0;
cs->cur_at_seq = 0;
@@ -31533,9 +31481,9 @@ diff -urNp linux-2.6.32.43/drivers/isdn/gigaset/common.c linux-2.6.32.43/drivers
cs->dev = NULL;
cs->tty = NULL;
cs->tty_dev = NULL;
-diff -urNp linux-2.6.32.43/drivers/isdn/gigaset/gigaset.h linux-2.6.32.43/drivers/isdn/gigaset/gigaset.h
---- linux-2.6.32.43/drivers/isdn/gigaset/gigaset.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/isdn/gigaset/gigaset.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/isdn/gigaset/gigaset.h linux-2.6.32.44/drivers/isdn/gigaset/gigaset.h
+--- linux-2.6.32.44/drivers/isdn/gigaset/gigaset.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/isdn/gigaset/gigaset.h 2011-04-17 15:56:46.000000000 -0400
@@ -34,6 +34,7 @@
#include <linux/tty_driver.h>
#include <linux/list.h>
@@ -31553,9 +31501,9 @@ diff -urNp linux-2.6.32.43/drivers/isdn/gigaset/gigaset.h linux-2.6.32.43/driver
struct tty_struct *tty;
struct tasklet_struct if_wake_tasklet;
unsigned control_state;
-diff -urNp linux-2.6.32.43/drivers/isdn/gigaset/interface.c linux-2.6.32.43/drivers/isdn/gigaset/interface.c
---- linux-2.6.32.43/drivers/isdn/gigaset/interface.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/isdn/gigaset/interface.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/isdn/gigaset/interface.c linux-2.6.32.44/drivers/isdn/gigaset/interface.c
+--- linux-2.6.32.44/drivers/isdn/gigaset/interface.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/isdn/gigaset/interface.c 2011-04-17 15:56:46.000000000 -0400
@@ -165,9 +165,7 @@ static int if_open(struct tty_struct *tt
return -ERESTARTSYS; // FIXME -EINTR?
tty->driver_data = cs;
@@ -31643,9 +31591,9 @@ diff -urNp linux-2.6.32.43/drivers/isdn/gigaset/interface.c linux-2.6.32.43/driv
dev_warn(cs->dev, "%s: device not opened\n", __func__);
goto out;
}
-diff -urNp linux-2.6.32.43/drivers/isdn/hardware/avm/b1.c linux-2.6.32.43/drivers/isdn/hardware/avm/b1.c
---- linux-2.6.32.43/drivers/isdn/hardware/avm/b1.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/isdn/hardware/avm/b1.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/isdn/hardware/avm/b1.c linux-2.6.32.44/drivers/isdn/hardware/avm/b1.c
+--- linux-2.6.32.44/drivers/isdn/hardware/avm/b1.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/isdn/hardware/avm/b1.c 2011-04-17 15:56:46.000000000 -0400
@@ -173,7 +173,7 @@ int b1_load_t4file(avmcard *card, capilo
}
if (left) {
@@ -31664,9 +31612,9 @@ diff -urNp linux-2.6.32.43/drivers/isdn/hardware/avm/b1.c linux-2.6.32.43/driver
return -EFAULT;
} else {
memcpy(buf, dp, left);
-diff -urNp linux-2.6.32.43/drivers/isdn/hardware/eicon/capidtmf.c linux-2.6.32.43/drivers/isdn/hardware/eicon/capidtmf.c
---- linux-2.6.32.43/drivers/isdn/hardware/eicon/capidtmf.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/isdn/hardware/eicon/capidtmf.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/isdn/hardware/eicon/capidtmf.c linux-2.6.32.44/drivers/isdn/hardware/eicon/capidtmf.c
+--- linux-2.6.32.44/drivers/isdn/hardware/eicon/capidtmf.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/isdn/hardware/eicon/capidtmf.c 2011-05-16 21:46:57.000000000 -0400
@@ -498,6 +498,7 @@ void capidtmf_recv_block (t_capidtmf_sta
byte goertzel_result_buffer[CAPIDTMF_RECV_TOTAL_FREQUENCY_COUNT];
short windowed_sample_buffer[CAPIDTMF_RECV_WINDOWED_SAMPLES];
@@ -31675,9 +31623,9 @@ diff -urNp linux-2.6.32.43/drivers/isdn/hardware/eicon/capidtmf.c linux-2.6.32.4
if (p_state->recv.state & CAPIDTMF_RECV_STATE_DTMF_ACTIVE)
{
-diff -urNp linux-2.6.32.43/drivers/isdn/hardware/eicon/capifunc.c linux-2.6.32.43/drivers/isdn/hardware/eicon/capifunc.c
---- linux-2.6.32.43/drivers/isdn/hardware/eicon/capifunc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/isdn/hardware/eicon/capifunc.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/isdn/hardware/eicon/capifunc.c linux-2.6.32.44/drivers/isdn/hardware/eicon/capifunc.c
+--- linux-2.6.32.44/drivers/isdn/hardware/eicon/capifunc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/isdn/hardware/eicon/capifunc.c 2011-05-16 21:46:57.000000000 -0400
@@ -1055,6 +1055,8 @@ static int divacapi_connect_didd(void)
IDI_SYNC_REQ req;
DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
@@ -31687,9 +31635,9 @@ diff -urNp linux-2.6.32.43/drivers/isdn/hardware/eicon/capifunc.c linux-2.6.32.4
DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
for (x = 0; x < MAX_DESCRIPTORS; x++) {
-diff -urNp linux-2.6.32.43/drivers/isdn/hardware/eicon/diddfunc.c linux-2.6.32.43/drivers/isdn/hardware/eicon/diddfunc.c
---- linux-2.6.32.43/drivers/isdn/hardware/eicon/diddfunc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/isdn/hardware/eicon/diddfunc.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/isdn/hardware/eicon/diddfunc.c linux-2.6.32.44/drivers/isdn/hardware/eicon/diddfunc.c
+--- linux-2.6.32.44/drivers/isdn/hardware/eicon/diddfunc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/isdn/hardware/eicon/diddfunc.c 2011-05-16 21:46:57.000000000 -0400
@@ -54,6 +54,8 @@ static int DIVA_INIT_FUNCTION connect_di
IDI_SYNC_REQ req;
DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
@@ -31699,9 +31647,9 @@ diff -urNp linux-2.6.32.43/drivers/isdn/hardware/eicon/diddfunc.c linux-2.6.32.4
DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
for (x = 0; x < MAX_DESCRIPTORS; x++) {
-diff -urNp linux-2.6.32.43/drivers/isdn/hardware/eicon/divasfunc.c linux-2.6.32.43/drivers/isdn/hardware/eicon/divasfunc.c
---- linux-2.6.32.43/drivers/isdn/hardware/eicon/divasfunc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/isdn/hardware/eicon/divasfunc.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/isdn/hardware/eicon/divasfunc.c linux-2.6.32.44/drivers/isdn/hardware/eicon/divasfunc.c
+--- linux-2.6.32.44/drivers/isdn/hardware/eicon/divasfunc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/isdn/hardware/eicon/divasfunc.c 2011-05-16 21:46:57.000000000 -0400
@@ -161,6 +161,8 @@ static int DIVA_INIT_FUNCTION connect_di
IDI_SYNC_REQ req;
DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
@@ -31711,9 +31659,9 @@ diff -urNp linux-2.6.32.43/drivers/isdn/hardware/eicon/divasfunc.c linux-2.6.32.
DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
for (x = 0; x < MAX_DESCRIPTORS; x++) {
-diff -urNp linux-2.6.32.43/drivers/isdn/hardware/eicon/divasync.h linux-2.6.32.43/drivers/isdn/hardware/eicon/divasync.h
---- linux-2.6.32.43/drivers/isdn/hardware/eicon/divasync.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/isdn/hardware/eicon/divasync.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/isdn/hardware/eicon/divasync.h linux-2.6.32.44/drivers/isdn/hardware/eicon/divasync.h
+--- linux-2.6.32.44/drivers/isdn/hardware/eicon/divasync.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/isdn/hardware/eicon/divasync.h 2011-08-05 20:33:55.000000000 -0400
@@ -146,7 +146,7 @@ typedef struct _diva_didd_add_adapter {
} diva_didd_add_adapter_t;
typedef struct _diva_didd_remove_adapter {
@@ -31723,9 +31671,9 @@ diff -urNp linux-2.6.32.43/drivers/isdn/hardware/eicon/divasync.h linux-2.6.32.4
typedef struct _diva_didd_read_adapter_array {
void * buffer;
dword length;
-diff -urNp linux-2.6.32.43/drivers/isdn/hardware/eicon/idifunc.c linux-2.6.32.43/drivers/isdn/hardware/eicon/idifunc.c
---- linux-2.6.32.43/drivers/isdn/hardware/eicon/idifunc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/isdn/hardware/eicon/idifunc.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/isdn/hardware/eicon/idifunc.c linux-2.6.32.44/drivers/isdn/hardware/eicon/idifunc.c
+--- linux-2.6.32.44/drivers/isdn/hardware/eicon/idifunc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/isdn/hardware/eicon/idifunc.c 2011-05-16 21:46:57.000000000 -0400
@@ -188,6 +188,8 @@ static int DIVA_INIT_FUNCTION connect_di
IDI_SYNC_REQ req;
DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
@@ -31735,9 +31683,9 @@ diff -urNp linux-2.6.32.43/drivers/isdn/hardware/eicon/idifunc.c linux-2.6.32.43
DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
for (x = 0; x < MAX_DESCRIPTORS; x++) {
-diff -urNp linux-2.6.32.43/drivers/isdn/hardware/eicon/message.c linux-2.6.32.43/drivers/isdn/hardware/eicon/message.c
---- linux-2.6.32.43/drivers/isdn/hardware/eicon/message.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/isdn/hardware/eicon/message.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/isdn/hardware/eicon/message.c linux-2.6.32.44/drivers/isdn/hardware/eicon/message.c
+--- linux-2.6.32.44/drivers/isdn/hardware/eicon/message.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/isdn/hardware/eicon/message.c 2011-05-16 21:46:57.000000000 -0400
@@ -4889,6 +4889,8 @@ static void sig_ind(PLCI *plci)
dword d;
word w;
@@ -31774,9 +31722,9 @@ diff -urNp linux-2.6.32.43/drivers/isdn/hardware/eicon/message.c linux-2.6.32.43
set_group_ind_mask (plci); /* all APPLs within this inc. call are allowed to dial in */
if(!a->group_optimization_enabled)
-diff -urNp linux-2.6.32.43/drivers/isdn/hardware/eicon/mntfunc.c linux-2.6.32.43/drivers/isdn/hardware/eicon/mntfunc.c
---- linux-2.6.32.43/drivers/isdn/hardware/eicon/mntfunc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/isdn/hardware/eicon/mntfunc.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/isdn/hardware/eicon/mntfunc.c linux-2.6.32.44/drivers/isdn/hardware/eicon/mntfunc.c
+--- linux-2.6.32.44/drivers/isdn/hardware/eicon/mntfunc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/isdn/hardware/eicon/mntfunc.c 2011-05-16 21:46:57.000000000 -0400
@@ -79,6 +79,8 @@ static int DIVA_INIT_FUNCTION connect_di
IDI_SYNC_REQ req;
DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
@@ -31786,9 +31734,9 @@ diff -urNp linux-2.6.32.43/drivers/isdn/hardware/eicon/mntfunc.c linux-2.6.32.43
DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
for (x = 0; x < MAX_DESCRIPTORS; x++) {
-diff -urNp linux-2.6.32.43/drivers/isdn/hardware/eicon/xdi_adapter.h linux-2.6.32.43/drivers/isdn/hardware/eicon/xdi_adapter.h
---- linux-2.6.32.43/drivers/isdn/hardware/eicon/xdi_adapter.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/isdn/hardware/eicon/xdi_adapter.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/isdn/hardware/eicon/xdi_adapter.h linux-2.6.32.44/drivers/isdn/hardware/eicon/xdi_adapter.h
+--- linux-2.6.32.44/drivers/isdn/hardware/eicon/xdi_adapter.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/isdn/hardware/eicon/xdi_adapter.h 2011-08-05 20:33:55.000000000 -0400
@@ -44,7 +44,7 @@ typedef struct _xdi_mbox_t {
typedef struct _diva_os_idi_adapter_interface {
diva_init_card_proc_t cleanup_adapter_proc;
@@ -31798,9 +31746,9 @@ diff -urNp linux-2.6.32.43/drivers/isdn/hardware/eicon/xdi_adapter.h linux-2.6.3
typedef struct _diva_os_xdi_adapter {
struct list_head link;
-diff -urNp linux-2.6.32.43/drivers/isdn/i4l/isdn_common.c linux-2.6.32.43/drivers/isdn/i4l/isdn_common.c
---- linux-2.6.32.43/drivers/isdn/i4l/isdn_common.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/isdn/i4l/isdn_common.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/isdn/i4l/isdn_common.c linux-2.6.32.44/drivers/isdn/i4l/isdn_common.c
+--- linux-2.6.32.44/drivers/isdn/i4l/isdn_common.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/isdn/i4l/isdn_common.c 2011-05-16 21:46:57.000000000 -0400
@@ -1290,6 +1290,8 @@ isdn_ioctl(struct inode *inode, struct f
} iocpar;
void __user *argp = (void __user *)arg;
@@ -31810,9 +31758,9 @@ diff -urNp linux-2.6.32.43/drivers/isdn/i4l/isdn_common.c linux-2.6.32.43/driver
#define name iocpar.name
#define bname iocpar.bname
#define iocts iocpar.iocts
-diff -urNp linux-2.6.32.43/drivers/isdn/icn/icn.c linux-2.6.32.43/drivers/isdn/icn/icn.c
---- linux-2.6.32.43/drivers/isdn/icn/icn.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/isdn/icn/icn.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/isdn/icn/icn.c linux-2.6.32.44/drivers/isdn/icn/icn.c
+--- linux-2.6.32.44/drivers/isdn/icn/icn.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/isdn/icn/icn.c 2011-04-17 15:56:46.000000000 -0400
@@ -1044,7 +1044,7 @@ icn_writecmd(const u_char * buf, int len
if (count > len)
count = len;
@@ -31822,9 +31770,9 @@ diff -urNp linux-2.6.32.43/drivers/isdn/icn/icn.c linux-2.6.32.43/drivers/isdn/i
return -EFAULT;
} else
memcpy(msg, buf, count);
-diff -urNp linux-2.6.32.43/drivers/isdn/mISDN/socket.c linux-2.6.32.43/drivers/isdn/mISDN/socket.c
---- linux-2.6.32.43/drivers/isdn/mISDN/socket.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/isdn/mISDN/socket.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/isdn/mISDN/socket.c linux-2.6.32.44/drivers/isdn/mISDN/socket.c
+--- linux-2.6.32.44/drivers/isdn/mISDN/socket.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/isdn/mISDN/socket.c 2011-04-17 15:56:46.000000000 -0400
@@ -391,6 +391,7 @@ data_sock_ioctl(struct socket *sock, uns
if (dev) {
struct mISDN_devinfo di;
@@ -31841,9 +31789,9 @@ diff -urNp linux-2.6.32.43/drivers/isdn/mISDN/socket.c linux-2.6.32.43/drivers/i
di.id = dev->id;
di.Dprotocols = dev->Dprotocols;
di.Bprotocols = dev->Bprotocols | get_all_Bprotocols();
-diff -urNp linux-2.6.32.43/drivers/isdn/sc/interrupt.c linux-2.6.32.43/drivers/isdn/sc/interrupt.c
---- linux-2.6.32.43/drivers/isdn/sc/interrupt.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/isdn/sc/interrupt.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/isdn/sc/interrupt.c linux-2.6.32.44/drivers/isdn/sc/interrupt.c
+--- linux-2.6.32.44/drivers/isdn/sc/interrupt.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/isdn/sc/interrupt.c 2011-04-17 15:56:46.000000000 -0400
@@ -112,11 +112,19 @@ irqreturn_t interrupt_handler(int dummy,
}
else if(callid>=0x0000 && callid<=0x7FFF)
@@ -31878,9 +31826,9 @@ diff -urNp linux-2.6.32.43/drivers/isdn/sc/interrupt.c linux-2.6.32.43/drivers/i
continue;
}
-diff -urNp linux-2.6.32.43/drivers/lguest/core.c linux-2.6.32.43/drivers/lguest/core.c
---- linux-2.6.32.43/drivers/lguest/core.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/lguest/core.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/lguest/core.c linux-2.6.32.44/drivers/lguest/core.c
+--- linux-2.6.32.44/drivers/lguest/core.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/lguest/core.c 2011-04-17 15:56:46.000000000 -0400
@@ -91,9 +91,17 @@ static __init int map_switcher(void)
* it's worked so far. The end address needs +1 because __get_vm_area
* allocates an extra guard page, so we need space for that.
@@ -31908,9 +31856,9 @@ diff -urNp linux-2.6.32.43/drivers/lguest/core.c linux-2.6.32.43/drivers/lguest/
end_switcher_text - start_switcher_text);
printk(KERN_INFO "lguest: mapped switcher at %p\n",
-diff -urNp linux-2.6.32.43/drivers/lguest/x86/core.c linux-2.6.32.43/drivers/lguest/x86/core.c
---- linux-2.6.32.43/drivers/lguest/x86/core.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/lguest/x86/core.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/lguest/x86/core.c linux-2.6.32.44/drivers/lguest/x86/core.c
+--- linux-2.6.32.44/drivers/lguest/x86/core.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/lguest/x86/core.c 2011-04-17 15:56:46.000000000 -0400
@@ -59,7 +59,7 @@ static struct {
/* Offset from where switcher.S was compiled to where we've copied it */
static unsigned long switcher_offset(void)
@@ -31952,9 +31900,9 @@ diff -urNp linux-2.6.32.43/drivers/lguest/x86/core.c linux-2.6.32.43/drivers/lgu
lguest_entry.segment = LGUEST_CS;
/*
-diff -urNp linux-2.6.32.43/drivers/lguest/x86/switcher_32.S linux-2.6.32.43/drivers/lguest/x86/switcher_32.S
---- linux-2.6.32.43/drivers/lguest/x86/switcher_32.S 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/lguest/x86/switcher_32.S 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/lguest/x86/switcher_32.S linux-2.6.32.44/drivers/lguest/x86/switcher_32.S
+--- linux-2.6.32.44/drivers/lguest/x86/switcher_32.S 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/lguest/x86/switcher_32.S 2011-04-17 15:56:46.000000000 -0400
@@ -87,6 +87,7 @@
#include <asm/page.h>
#include <asm/segment.h>
@@ -32013,9 +31961,9 @@ diff -urNp linux-2.6.32.43/drivers/lguest/x86/switcher_32.S linux-2.6.32.43/driv
// Every interrupt can come to us here
// But we must truly tell each apart.
-diff -urNp linux-2.6.32.43/drivers/macintosh/via-pmu-backlight.c linux-2.6.32.43/drivers/macintosh/via-pmu-backlight.c
---- linux-2.6.32.43/drivers/macintosh/via-pmu-backlight.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/macintosh/via-pmu-backlight.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/macintosh/via-pmu-backlight.c linux-2.6.32.44/drivers/macintosh/via-pmu-backlight.c
+--- linux-2.6.32.44/drivers/macintosh/via-pmu-backlight.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/macintosh/via-pmu-backlight.c 2011-04-17 15:56:46.000000000 -0400
@@ -15,7 +15,7 @@
#define MAX_PMU_LEVEL 0xFF
@@ -32034,9 +31982,9 @@ diff -urNp linux-2.6.32.43/drivers/macintosh/via-pmu-backlight.c linux-2.6.32.43
.get_brightness = pmu_backlight_get_brightness,
.update_status = pmu_backlight_update_status,
-diff -urNp linux-2.6.32.43/drivers/macintosh/via-pmu.c linux-2.6.32.43/drivers/macintosh/via-pmu.c
---- linux-2.6.32.43/drivers/macintosh/via-pmu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/macintosh/via-pmu.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/macintosh/via-pmu.c linux-2.6.32.44/drivers/macintosh/via-pmu.c
+--- linux-2.6.32.44/drivers/macintosh/via-pmu.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/macintosh/via-pmu.c 2011-04-17 15:56:46.000000000 -0400
@@ -2232,7 +2232,7 @@ static int pmu_sleep_valid(suspend_state
&& (pmac_call_feature(PMAC_FTR_SLEEP_STATE, NULL, 0, -1) >= 0);
}
@@ -32046,10 +31994,10 @@ diff -urNp linux-2.6.32.43/drivers/macintosh/via-pmu.c linux-2.6.32.43/drivers/m
.enter = powerbook_sleep,
.valid = pmu_sleep_valid,
};
-diff -urNp linux-2.6.32.43/drivers/md/dm.c linux-2.6.32.43/drivers/md/dm.c
---- linux-2.6.32.43/drivers/md/dm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/md/dm.c 2011-05-04 17:56:28.000000000 -0400
-@@ -163,9 +163,9 @@ struct mapped_device {
+diff -urNp linux-2.6.32.44/drivers/md/dm.c linux-2.6.32.44/drivers/md/dm.c
+--- linux-2.6.32.44/drivers/md/dm.c 2011-08-09 18:35:29.000000000 -0400
++++ linux-2.6.32.44/drivers/md/dm.c 2011-08-09 18:33:59.000000000 -0400
+@@ -165,9 +165,9 @@ struct mapped_device {
/*
* Event handling.
*/
@@ -32061,7 +32009,7 @@ diff -urNp linux-2.6.32.43/drivers/md/dm.c linux-2.6.32.43/drivers/md/dm.c
struct list_head uevent_list;
spinlock_t uevent_lock; /* Protect access to uevent_list */
-@@ -1770,8 +1770,8 @@ static struct mapped_device *alloc_dev(i
+@@ -1776,8 +1776,8 @@ static struct mapped_device *alloc_dev(i
rwlock_init(&md->map_lock);
atomic_set(&md->holders, 1);
atomic_set(&md->open_count, 0);
@@ -32072,7 +32020,7 @@ diff -urNp linux-2.6.32.43/drivers/md/dm.c linux-2.6.32.43/drivers/md/dm.c
INIT_LIST_HEAD(&md->uevent_list);
spin_lock_init(&md->uevent_lock);
-@@ -1921,7 +1921,7 @@ static void event_callback(void *context
+@@ -1927,7 +1927,7 @@ static void event_callback(void *context
dm_send_uevents(&uevents, &disk_to_dev(md->disk)->kobj);
@@ -32081,7 +32029,7 @@ diff -urNp linux-2.6.32.43/drivers/md/dm.c linux-2.6.32.43/drivers/md/dm.c
wake_up(&md->eventq);
}
-@@ -2556,18 +2556,18 @@ void dm_kobject_uevent(struct mapped_dev
+@@ -2562,18 +2562,18 @@ void dm_kobject_uevent(struct mapped_dev
uint32_t dm_next_uevent_seq(struct mapped_device *md)
{
@@ -32103,9 +32051,9 @@ diff -urNp linux-2.6.32.43/drivers/md/dm.c linux-2.6.32.43/drivers/md/dm.c
}
void dm_uevent_add(struct mapped_device *md, struct list_head *elist)
-diff -urNp linux-2.6.32.43/drivers/md/dm-ioctl.c linux-2.6.32.43/drivers/md/dm-ioctl.c
---- linux-2.6.32.43/drivers/md/dm-ioctl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/md/dm-ioctl.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/md/dm-ioctl.c linux-2.6.32.44/drivers/md/dm-ioctl.c
+--- linux-2.6.32.44/drivers/md/dm-ioctl.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/md/dm-ioctl.c 2011-04-17 15:56:46.000000000 -0400
@@ -1437,7 +1437,7 @@ static int validate_params(uint cmd, str
cmd == DM_LIST_VERSIONS_CMD)
return 0;
@@ -32115,9 +32063,9 @@ diff -urNp linux-2.6.32.43/drivers/md/dm-ioctl.c linux-2.6.32.43/drivers/md/dm-i
if (!*param->name) {
DMWARN("name not supplied when creating device");
return -EINVAL;
-diff -urNp linux-2.6.32.43/drivers/md/dm-raid1.c linux-2.6.32.43/drivers/md/dm-raid1.c
---- linux-2.6.32.43/drivers/md/dm-raid1.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/md/dm-raid1.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/md/dm-raid1.c linux-2.6.32.44/drivers/md/dm-raid1.c
+--- linux-2.6.32.44/drivers/md/dm-raid1.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/md/dm-raid1.c 2011-05-04 17:56:28.000000000 -0400
@@ -41,7 +41,7 @@ enum dm_raid1_error {
struct mirror {
@@ -32190,9 +32138,9 @@ diff -urNp linux-2.6.32.43/drivers/md/dm-raid1.c linux-2.6.32.43/drivers/md/dm-r
return 'A';
return (test_bit(DM_RAID1_WRITE_ERROR, &(m->error_type))) ? 'D' :
-diff -urNp linux-2.6.32.43/drivers/md/dm-stripe.c linux-2.6.32.43/drivers/md/dm-stripe.c
---- linux-2.6.32.43/drivers/md/dm-stripe.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/md/dm-stripe.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/md/dm-stripe.c linux-2.6.32.44/drivers/md/dm-stripe.c
+--- linux-2.6.32.44/drivers/md/dm-stripe.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/md/dm-stripe.c 2011-05-04 17:56:28.000000000 -0400
@@ -20,7 +20,7 @@ struct stripe {
struct dm_dev *dev;
sector_t physical_start;
@@ -32231,9 +32179,9 @@ diff -urNp linux-2.6.32.43/drivers/md/dm-stripe.c linux-2.6.32.43/drivers/md/dm-
DM_IO_ERROR_THRESHOLD)
queue_work(kstriped, &sc->kstriped_ws);
}
-diff -urNp linux-2.6.32.43/drivers/md/dm-sysfs.c linux-2.6.32.43/drivers/md/dm-sysfs.c
---- linux-2.6.32.43/drivers/md/dm-sysfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/md/dm-sysfs.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/md/dm-sysfs.c linux-2.6.32.44/drivers/md/dm-sysfs.c
+--- linux-2.6.32.44/drivers/md/dm-sysfs.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/md/dm-sysfs.c 2011-04-17 15:56:46.000000000 -0400
@@ -75,7 +75,7 @@ static struct attribute *dm_attrs[] = {
NULL,
};
@@ -32243,9 +32191,9 @@ diff -urNp linux-2.6.32.43/drivers/md/dm-sysfs.c linux-2.6.32.43/drivers/md/dm-s
.show = dm_attr_show,
};
-diff -urNp linux-2.6.32.43/drivers/md/dm-table.c linux-2.6.32.43/drivers/md/dm-table.c
---- linux-2.6.32.43/drivers/md/dm-table.c 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.43/drivers/md/dm-table.c 2011-06-25 12:56:37.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/md/dm-table.c linux-2.6.32.44/drivers/md/dm-table.c
+--- linux-2.6.32.44/drivers/md/dm-table.c 2011-06-25 12:55:34.000000000 -0400
++++ linux-2.6.32.44/drivers/md/dm-table.c 2011-06-25 12:56:37.000000000 -0400
@@ -376,7 +376,7 @@ static int device_area_is_invalid(struct
if (!dev_size)
return 0;
@@ -32255,9 +32203,9 @@ diff -urNp linux-2.6.32.43/drivers/md/dm-table.c linux-2.6.32.43/drivers/md/dm-t
DMWARN("%s: %s too small for target: "
"start=%llu, len=%llu, dev_size=%llu",
dm_device_name(ti->table->md), bdevname(bdev, b),
-diff -urNp linux-2.6.32.43/drivers/md/md.c linux-2.6.32.43/drivers/md/md.c
---- linux-2.6.32.43/drivers/md/md.c 2011-07-13 17:23:04.000000000 -0400
-+++ linux-2.6.32.43/drivers/md/md.c 2011-07-13 17:23:18.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/md/md.c linux-2.6.32.44/drivers/md/md.c
+--- linux-2.6.32.44/drivers/md/md.c 2011-07-13 17:23:04.000000000 -0400
++++ linux-2.6.32.44/drivers/md/md.c 2011-07-13 17:23:18.000000000 -0400
@@ -153,10 +153,10 @@ static int start_readonly;
* start build, activate spare
*/
@@ -32400,9 +32348,9 @@ diff -urNp linux-2.6.32.43/drivers/md/md.c linux-2.6.32.43/drivers/md/md.c
/* sync IO will cause sync_io to increase before the disk_stats
* as sync_io is counted when a request starts, and
* disk_stats is counted when it completes.
-diff -urNp linux-2.6.32.43/drivers/md/md.h linux-2.6.32.43/drivers/md/md.h
---- linux-2.6.32.43/drivers/md/md.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/md/md.h 2011-05-04 17:56:20.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/md/md.h linux-2.6.32.44/drivers/md/md.h
+--- linux-2.6.32.44/drivers/md/md.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/md/md.h 2011-05-04 17:56:20.000000000 -0400
@@ -94,10 +94,10 @@ struct mdk_rdev_s
* only maintained for arrays that
* support hot removal
@@ -32425,9 +32373,9 @@ diff -urNp linux-2.6.32.43/drivers/md/md.h linux-2.6.32.43/drivers/md/md.h
}
struct mdk_personality
-diff -urNp linux-2.6.32.43/drivers/md/raid10.c linux-2.6.32.43/drivers/md/raid10.c
---- linux-2.6.32.43/drivers/md/raid10.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/md/raid10.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/md/raid10.c linux-2.6.32.44/drivers/md/raid10.c
+--- linux-2.6.32.44/drivers/md/raid10.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/md/raid10.c 2011-05-04 17:56:28.000000000 -0400
@@ -1255,7 +1255,7 @@ static void end_sync_read(struct bio *bi
if (test_bit(BIO_UPTODATE, &bio->bi_flags))
set_bit(R10BIO_Uptodate, &r10_bio->state);
@@ -32446,9 +32394,9 @@ diff -urNp linux-2.6.32.43/drivers/md/raid10.c linux-2.6.32.43/drivers/md/raid10
if (sync_page_io(rdev->bdev,
r10_bio->devs[sl].addr +
sect + rdev->data_offset,
-diff -urNp linux-2.6.32.43/drivers/md/raid1.c linux-2.6.32.43/drivers/md/raid1.c
---- linux-2.6.32.43/drivers/md/raid1.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/md/raid1.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/md/raid1.c linux-2.6.32.44/drivers/md/raid1.c
+--- linux-2.6.32.44/drivers/md/raid1.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/md/raid1.c 2011-05-04 17:56:28.000000000 -0400
@@ -1415,7 +1415,7 @@ static void sync_request_write(mddev_t *
if (r1_bio->bios[d]->bi_end_io != end_sync_read)
continue;
@@ -32467,9 +32415,9 @@ diff -urNp linux-2.6.32.43/drivers/md/raid1.c linux-2.6.32.43/drivers/md/raid1.c
printk(KERN_INFO
"raid1:%s: read error corrected "
"(%d sectors at %llu on %s)\n",
-diff -urNp linux-2.6.32.43/drivers/md/raid5.c linux-2.6.32.43/drivers/md/raid5.c
---- linux-2.6.32.43/drivers/md/raid5.c 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.43/drivers/md/raid5.c 2011-06-25 12:58:39.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/md/raid5.c linux-2.6.32.44/drivers/md/raid5.c
+--- linux-2.6.32.44/drivers/md/raid5.c 2011-06-25 12:55:34.000000000 -0400
++++ linux-2.6.32.44/drivers/md/raid5.c 2011-06-25 12:58:39.000000000 -0400
@@ -482,7 +482,7 @@ static void ops_run_io(struct stripe_hea
bi->bi_next = NULL;
if ((rw & WRITE) &&
@@ -32515,9 +32463,9 @@ diff -urNp linux-2.6.32.43/drivers/md/raid5.c linux-2.6.32.43/drivers/md/raid5.c
chunk_offset = sector_div(new_sector, sectors_per_chunk);
stripe = new_sector;
-diff -urNp linux-2.6.32.43/drivers/media/common/saa7146_fops.c linux-2.6.32.43/drivers/media/common/saa7146_fops.c
---- linux-2.6.32.43/drivers/media/common/saa7146_fops.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/media/common/saa7146_fops.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/media/common/saa7146_fops.c linux-2.6.32.44/drivers/media/common/saa7146_fops.c
+--- linux-2.6.32.44/drivers/media/common/saa7146_fops.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/media/common/saa7146_fops.c 2011-08-05 20:33:55.000000000 -0400
@@ -458,7 +458,7 @@ int saa7146_vv_init(struct saa7146_dev*
ERR(("out of memory. aborting.\n"));
return -ENOMEM;
@@ -32527,9 +32475,9 @@ diff -urNp linux-2.6.32.43/drivers/media/common/saa7146_fops.c linux-2.6.32.43/d
ext_vv->core_ops = &saa7146_video_ioctl_ops;
DEB_EE(("dev:%p\n",dev));
-diff -urNp linux-2.6.32.43/drivers/media/common/saa7146_hlp.c linux-2.6.32.43/drivers/media/common/saa7146_hlp.c
---- linux-2.6.32.43/drivers/media/common/saa7146_hlp.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/media/common/saa7146_hlp.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/media/common/saa7146_hlp.c linux-2.6.32.44/drivers/media/common/saa7146_hlp.c
+--- linux-2.6.32.44/drivers/media/common/saa7146_hlp.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/media/common/saa7146_hlp.c 2011-05-16 21:46:57.000000000 -0400
@@ -353,6 +353,8 @@ static void calculate_clipping_registers
int x[32], y[32], w[32], h[32];
@@ -32539,9 +32487,9 @@ diff -urNp linux-2.6.32.43/drivers/media/common/saa7146_hlp.c linux-2.6.32.43/dr
/* clear out memory */
memset(&line_list[0], 0x00, sizeof(u32)*32);
memset(&pixel_list[0], 0x00, sizeof(u32)*32);
-diff -urNp linux-2.6.32.43/drivers/media/dvb/dvb-core/dvb_ca_en50221.c linux-2.6.32.43/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
---- linux-2.6.32.43/drivers/media/dvb/dvb-core/dvb_ca_en50221.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/media/dvb/dvb-core/dvb_ca_en50221.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/media/dvb/dvb-core/dvb_ca_en50221.c linux-2.6.32.44/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
+--- linux-2.6.32.44/drivers/media/dvb/dvb-core/dvb_ca_en50221.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/media/dvb/dvb-core/dvb_ca_en50221.c 2011-05-16 21:46:57.000000000 -0400
@@ -590,6 +590,8 @@ static int dvb_ca_en50221_read_data(stru
u8 buf[HOST_LINK_BUF_SIZE];
int i;
@@ -32560,9 +32508,9 @@ diff -urNp linux-2.6.32.43/drivers/media/dvb/dvb-core/dvb_ca_en50221.c linux-2.6
dprintk("%s\n", __func__);
/* Incoming packet has a 2 byte header. hdr[0] = slot_id, hdr[1] = connection_id */
-diff -urNp linux-2.6.32.43/drivers/media/dvb/dvb-core/dvb_demux.h linux-2.6.32.43/drivers/media/dvb/dvb-core/dvb_demux.h
---- linux-2.6.32.43/drivers/media/dvb/dvb-core/dvb_demux.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/media/dvb/dvb-core/dvb_demux.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/media/dvb/dvb-core/dvb_demux.h linux-2.6.32.44/drivers/media/dvb/dvb-core/dvb_demux.h
+--- linux-2.6.32.44/drivers/media/dvb/dvb-core/dvb_demux.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/media/dvb/dvb-core/dvb_demux.h 2011-08-05 20:33:55.000000000 -0400
@@ -71,7 +71,7 @@ struct dvb_demux_feed {
union {
dmx_ts_cb ts;
@@ -32572,9 +32520,9 @@ diff -urNp linux-2.6.32.43/drivers/media/dvb/dvb-core/dvb_demux.h linux-2.6.32.4
struct dvb_demux *demux;
void *priv;
-diff -urNp linux-2.6.32.43/drivers/media/dvb/dvb-core/dvbdev.c linux-2.6.32.43/drivers/media/dvb/dvb-core/dvbdev.c
---- linux-2.6.32.43/drivers/media/dvb/dvb-core/dvbdev.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/media/dvb/dvb-core/dvbdev.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/media/dvb/dvb-core/dvbdev.c linux-2.6.32.44/drivers/media/dvb/dvb-core/dvbdev.c
+--- linux-2.6.32.44/drivers/media/dvb/dvb-core/dvbdev.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/media/dvb/dvb-core/dvbdev.c 2011-08-05 20:33:55.000000000 -0400
@@ -228,8 +228,8 @@ int dvb_register_device(struct dvb_adapt
dvbdev->fops = dvbdevfops;
init_waitqueue_head (&dvbdev->wait_queue);
@@ -32586,9 +32534,9 @@ diff -urNp linux-2.6.32.43/drivers/media/dvb/dvb-core/dvbdev.c linux-2.6.32.43/d
list_add_tail (&dvbdev->list_head, &adap->device_list);
-diff -urNp linux-2.6.32.43/drivers/media/dvb/dvb-usb/cxusb.c linux-2.6.32.43/drivers/media/dvb/dvb-usb/cxusb.c
---- linux-2.6.32.43/drivers/media/dvb/dvb-usb/cxusb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/media/dvb/dvb-usb/cxusb.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/media/dvb/dvb-usb/cxusb.c linux-2.6.32.44/drivers/media/dvb/dvb-usb/cxusb.c
+--- linux-2.6.32.44/drivers/media/dvb/dvb-usb/cxusb.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/media/dvb/dvb-usb/cxusb.c 2011-08-05 20:33:55.000000000 -0400
@@ -1040,7 +1040,7 @@ static struct dib0070_config dib7070p_di
struct dib0700_adapter_state {
int (*set_param_save) (struct dvb_frontend *,
@@ -32598,9 +32546,9 @@ diff -urNp linux-2.6.32.43/drivers/media/dvb/dvb-usb/cxusb.c linux-2.6.32.43/dri
static int dib7070_set_param_override(struct dvb_frontend *fe,
struct dvb_frontend_parameters *fep)
-diff -urNp linux-2.6.32.43/drivers/media/dvb/dvb-usb/dib0700_core.c linux-2.6.32.43/drivers/media/dvb/dvb-usb/dib0700_core.c
---- linux-2.6.32.43/drivers/media/dvb/dvb-usb/dib0700_core.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/media/dvb/dvb-usb/dib0700_core.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/media/dvb/dvb-usb/dib0700_core.c linux-2.6.32.44/drivers/media/dvb/dvb-usb/dib0700_core.c
+--- linux-2.6.32.44/drivers/media/dvb/dvb-usb/dib0700_core.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/media/dvb/dvb-usb/dib0700_core.c 2011-05-16 21:46:57.000000000 -0400
@@ -332,6 +332,8 @@ int dib0700_download_firmware(struct usb
u8 buf[260];
@@ -32610,9 +32558,9 @@ diff -urNp linux-2.6.32.43/drivers/media/dvb/dvb-usb/dib0700_core.c linux-2.6.32
while ((ret = dvb_usb_get_hexline(fw, &hx, &pos)) > 0) {
deb_fwdata("writing to address 0x%08x (buffer: 0x%02x %02x)\n",hx.addr, hx.len, hx.chk);
-diff -urNp linux-2.6.32.43/drivers/media/dvb/dvb-usb/dib0700_devices.c linux-2.6.32.43/drivers/media/dvb/dvb-usb/dib0700_devices.c
---- linux-2.6.32.43/drivers/media/dvb/dvb-usb/dib0700_devices.c 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.43/drivers/media/dvb/dvb-usb/dib0700_devices.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/media/dvb/dvb-usb/dib0700_devices.c linux-2.6.32.44/drivers/media/dvb/dvb-usb/dib0700_devices.c
+--- linux-2.6.32.44/drivers/media/dvb/dvb-usb/dib0700_devices.c 2011-05-10 22:12:01.000000000 -0400
++++ linux-2.6.32.44/drivers/media/dvb/dvb-usb/dib0700_devices.c 2011-08-05 20:33:55.000000000 -0400
@@ -28,7 +28,7 @@ MODULE_PARM_DESC(force_lna_activation, "
struct dib0700_adapter_state {
@@ -32622,9 +32570,9 @@ diff -urNp linux-2.6.32.43/drivers/media/dvb/dvb-usb/dib0700_devices.c linux-2.6
/* Hauppauge Nova-T 500 (aka Bristol)
* has a LNA on GPIO0 which is enabled by setting 1 */
-diff -urNp linux-2.6.32.43/drivers/media/dvb/frontends/dib3000.h linux-2.6.32.43/drivers/media/dvb/frontends/dib3000.h
---- linux-2.6.32.43/drivers/media/dvb/frontends/dib3000.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/media/dvb/frontends/dib3000.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/media/dvb/frontends/dib3000.h linux-2.6.32.44/drivers/media/dvb/frontends/dib3000.h
+--- linux-2.6.32.44/drivers/media/dvb/frontends/dib3000.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/media/dvb/frontends/dib3000.h 2011-08-05 20:33:55.000000000 -0400
@@ -39,7 +39,7 @@ struct dib_fe_xfer_ops
int (*fifo_ctrl)(struct dvb_frontend *fe, int onoff);
int (*pid_ctrl)(struct dvb_frontend *fe, int index, int pid, int onoff);
@@ -32634,9 +32582,9 @@ diff -urNp linux-2.6.32.43/drivers/media/dvb/frontends/dib3000.h linux-2.6.32.43
#if defined(CONFIG_DVB_DIB3000MB) || (defined(CONFIG_DVB_DIB3000MB_MODULE) && defined(MODULE))
extern struct dvb_frontend* dib3000mb_attach(const struct dib3000_config* config,
-diff -urNp linux-2.6.32.43/drivers/media/dvb/frontends/or51211.c linux-2.6.32.43/drivers/media/dvb/frontends/or51211.c
---- linux-2.6.32.43/drivers/media/dvb/frontends/or51211.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/media/dvb/frontends/or51211.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/media/dvb/frontends/or51211.c linux-2.6.32.44/drivers/media/dvb/frontends/or51211.c
+--- linux-2.6.32.44/drivers/media/dvb/frontends/or51211.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/media/dvb/frontends/or51211.c 2011-05-16 21:46:57.000000000 -0400
@@ -113,6 +113,8 @@ static int or51211_load_firmware (struct
u8 tudata[585];
int i;
@@ -32646,9 +32594,9 @@ diff -urNp linux-2.6.32.43/drivers/media/dvb/frontends/or51211.c linux-2.6.32.43
dprintk("Firmware is %zd bytes\n",fw->size);
/* Get eprom data */
-diff -urNp linux-2.6.32.43/drivers/media/dvb/ttpci/av7110_v4l.c linux-2.6.32.43/drivers/media/dvb/ttpci/av7110_v4l.c
---- linux-2.6.32.43/drivers/media/dvb/ttpci/av7110_v4l.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/media/dvb/ttpci/av7110_v4l.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/media/dvb/ttpci/av7110_v4l.c linux-2.6.32.44/drivers/media/dvb/ttpci/av7110_v4l.c
+--- linux-2.6.32.44/drivers/media/dvb/ttpci/av7110_v4l.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/media/dvb/ttpci/av7110_v4l.c 2011-08-05 20:33:55.000000000 -0400
@@ -796,18 +796,18 @@ int av7110_init_v4l(struct av7110 *av711
ERR(("cannot init capture device. skipping.\n"));
return -ENODEV;
@@ -32680,9 +32628,9 @@ diff -urNp linux-2.6.32.43/drivers/media/dvb/ttpci/av7110_v4l.c linux-2.6.32.43/
if (saa7146_register_device(&av7110->v4l_dev, dev, "av7110", VFL_TYPE_GRABBER)) {
ERR(("cannot register capture device. skipping.\n"));
-diff -urNp linux-2.6.32.43/drivers/media/dvb/ttpci/budget-av.c linux-2.6.32.43/drivers/media/dvb/ttpci/budget-av.c
---- linux-2.6.32.43/drivers/media/dvb/ttpci/budget-av.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/media/dvb/ttpci/budget-av.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/media/dvb/ttpci/budget-av.c linux-2.6.32.44/drivers/media/dvb/ttpci/budget-av.c
+--- linux-2.6.32.44/drivers/media/dvb/ttpci/budget-av.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/media/dvb/ttpci/budget-av.c 2011-08-05 20:33:55.000000000 -0400
@@ -1477,9 +1477,9 @@ static int budget_av_attach(struct saa71
ERR(("cannot init vv subsystem.\n"));
return err;
@@ -32696,9 +32644,9 @@ diff -urNp linux-2.6.32.43/drivers/media/dvb/ttpci/budget-av.c linux-2.6.32.43/d
if ((err = saa7146_register_device(&budget_av->vd, dev, "knc1", VFL_TYPE_GRABBER))) {
/* fixme: proper cleanup here */
-diff -urNp linux-2.6.32.43/drivers/media/radio/radio-cadet.c linux-2.6.32.43/drivers/media/radio/radio-cadet.c
---- linux-2.6.32.43/drivers/media/radio/radio-cadet.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/media/radio/radio-cadet.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/media/radio/radio-cadet.c linux-2.6.32.44/drivers/media/radio/radio-cadet.c
+--- linux-2.6.32.44/drivers/media/radio/radio-cadet.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/media/radio/radio-cadet.c 2011-04-17 15:56:46.000000000 -0400
@@ -347,7 +347,7 @@ static ssize_t cadet_read(struct file *f
while (i < count && dev->rdsin != dev->rdsout)
readbuf[i++] = dev->rdsbuf[dev->rdsout++];
@@ -32708,9 +32656,9 @@ diff -urNp linux-2.6.32.43/drivers/media/radio/radio-cadet.c linux-2.6.32.43/dri
return -EFAULT;
return i;
}
-diff -urNp linux-2.6.32.43/drivers/media/video/cx18/cx18-driver.c linux-2.6.32.43/drivers/media/video/cx18/cx18-driver.c
---- linux-2.6.32.43/drivers/media/video/cx18/cx18-driver.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/media/video/cx18/cx18-driver.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/media/video/cx18/cx18-driver.c linux-2.6.32.44/drivers/media/video/cx18/cx18-driver.c
+--- linux-2.6.32.44/drivers/media/video/cx18/cx18-driver.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/media/video/cx18/cx18-driver.c 2011-05-16 21:46:57.000000000 -0400
@@ -56,7 +56,7 @@ static struct pci_device_id cx18_pci_tbl
MODULE_DEVICE_TABLE(pci, cx18_pci_tbl);
@@ -32738,9 +32686,9 @@ diff -urNp linux-2.6.32.43/drivers/media/video/cx18/cx18-driver.c linux-2.6.32.4
if (i >= CX18_MAX_CARDS) {
printk(KERN_ERR "cx18: cannot manage card %d, driver has a "
"limit of 0 - %d\n", i, CX18_MAX_CARDS - 1);
-diff -urNp linux-2.6.32.43/drivers/media/video/hexium_gemini.c linux-2.6.32.43/drivers/media/video/hexium_gemini.c
---- linux-2.6.32.43/drivers/media/video/hexium_gemini.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/media/video/hexium_gemini.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/media/video/hexium_gemini.c linux-2.6.32.44/drivers/media/video/hexium_gemini.c
+--- linux-2.6.32.44/drivers/media/video/hexium_gemini.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/media/video/hexium_gemini.c 2011-08-05 20:33:55.000000000 -0400
@@ -394,12 +394,12 @@ static int hexium_attach(struct saa7146_
hexium->cur_input = 0;
@@ -32760,9 +32708,9 @@ diff -urNp linux-2.6.32.43/drivers/media/video/hexium_gemini.c linux-2.6.32.43/d
if (0 != saa7146_register_device(&hexium->video_dev, dev, "hexium gemini", VFL_TYPE_GRABBER)) {
printk("hexium_gemini: cannot register capture v4l2 device. skipping.\n");
return -1;
-diff -urNp linux-2.6.32.43/drivers/media/video/hexium_orion.c linux-2.6.32.43/drivers/media/video/hexium_orion.c
---- linux-2.6.32.43/drivers/media/video/hexium_orion.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/media/video/hexium_orion.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/media/video/hexium_orion.c linux-2.6.32.44/drivers/media/video/hexium_orion.c
+--- linux-2.6.32.44/drivers/media/video/hexium_orion.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/media/video/hexium_orion.c 2011-08-05 20:33:55.000000000 -0400
@@ -369,9 +369,9 @@ static int hexium_attach(struct saa7146_
DEB_EE((".\n"));
@@ -32776,9 +32724,9 @@ diff -urNp linux-2.6.32.43/drivers/media/video/hexium_orion.c linux-2.6.32.43/dr
if (0 != saa7146_register_device(&hexium->video_dev, dev, "hexium orion", VFL_TYPE_GRABBER)) {
printk("hexium_orion: cannot register capture v4l2 device. skipping.\n");
return -1;
-diff -urNp linux-2.6.32.43/drivers/media/video/ivtv/ivtv-driver.c linux-2.6.32.43/drivers/media/video/ivtv/ivtv-driver.c
---- linux-2.6.32.43/drivers/media/video/ivtv/ivtv-driver.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/media/video/ivtv/ivtv-driver.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/media/video/ivtv/ivtv-driver.c linux-2.6.32.44/drivers/media/video/ivtv/ivtv-driver.c
+--- linux-2.6.32.44/drivers/media/video/ivtv/ivtv-driver.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/media/video/ivtv/ivtv-driver.c 2011-05-04 17:56:28.000000000 -0400
@@ -79,7 +79,7 @@ static struct pci_device_id ivtv_pci_tbl
MODULE_DEVICE_TABLE(pci,ivtv_pci_tbl);
@@ -32788,9 +32736,9 @@ diff -urNp linux-2.6.32.43/drivers/media/video/ivtv/ivtv-driver.c linux-2.6.32.4
/* Parameter declarations */
static int cardtype[IVTV_MAX_CARDS];
-diff -urNp linux-2.6.32.43/drivers/media/video/mxb.c linux-2.6.32.43/drivers/media/video/mxb.c
---- linux-2.6.32.43/drivers/media/video/mxb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/media/video/mxb.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/media/video/mxb.c linux-2.6.32.44/drivers/media/video/mxb.c
+--- linux-2.6.32.44/drivers/media/video/mxb.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/media/video/mxb.c 2011-08-05 20:33:55.000000000 -0400
@@ -703,23 +703,23 @@ static int mxb_attach(struct saa7146_dev
already did this in "mxb_vl42_probe" */
@@ -32830,9 +32778,9 @@ diff -urNp linux-2.6.32.43/drivers/media/video/mxb.c linux-2.6.32.43/drivers/med
if (saa7146_register_device(&mxb->video_dev, dev, "mxb", VFL_TYPE_GRABBER)) {
ERR(("cannot register capture v4l2 device. skipping.\n"));
return -1;
-diff -urNp linux-2.6.32.43/drivers/media/video/omap24xxcam.c linux-2.6.32.43/drivers/media/video/omap24xxcam.c
---- linux-2.6.32.43/drivers/media/video/omap24xxcam.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/media/video/omap24xxcam.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/media/video/omap24xxcam.c linux-2.6.32.44/drivers/media/video/omap24xxcam.c
+--- linux-2.6.32.44/drivers/media/video/omap24xxcam.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/media/video/omap24xxcam.c 2011-05-04 17:56:28.000000000 -0400
@@ -401,7 +401,7 @@ static void omap24xxcam_vbq_complete(str
spin_unlock_irqrestore(&cam->core_enable_disable_lock, flags);
@@ -32842,9 +32790,9 @@ diff -urNp linux-2.6.32.43/drivers/media/video/omap24xxcam.c linux-2.6.32.43/dri
if (csr & csr_error) {
vb->state = VIDEOBUF_ERROR;
if (!atomic_read(&fh->cam->in_reset)) {
-diff -urNp linux-2.6.32.43/drivers/media/video/omap24xxcam.h linux-2.6.32.43/drivers/media/video/omap24xxcam.h
---- linux-2.6.32.43/drivers/media/video/omap24xxcam.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/media/video/omap24xxcam.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/media/video/omap24xxcam.h linux-2.6.32.44/drivers/media/video/omap24xxcam.h
+--- linux-2.6.32.44/drivers/media/video/omap24xxcam.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/media/video/omap24xxcam.h 2011-05-04 17:56:28.000000000 -0400
@@ -533,7 +533,7 @@ struct omap24xxcam_fh {
spinlock_t vbq_lock; /* spinlock for the videobuf queue */
struct videobuf_queue vbq;
@@ -32854,9 +32802,9 @@ diff -urNp linux-2.6.32.43/drivers/media/video/omap24xxcam.h linux-2.6.32.43/dri
/* accessing cam here doesn't need serialisation: it's constant */
struct omap24xxcam_device *cam;
};
-diff -urNp linux-2.6.32.43/drivers/media/video/pvrusb2/pvrusb2-eeprom.c linux-2.6.32.43/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
---- linux-2.6.32.43/drivers/media/video/pvrusb2/pvrusb2-eeprom.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/media/video/pvrusb2/pvrusb2-eeprom.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/media/video/pvrusb2/pvrusb2-eeprom.c linux-2.6.32.44/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
+--- linux-2.6.32.44/drivers/media/video/pvrusb2/pvrusb2-eeprom.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/media/video/pvrusb2/pvrusb2-eeprom.c 2011-05-16 21:46:57.000000000 -0400
@@ -119,6 +119,8 @@ int pvr2_eeprom_analyze(struct pvr2_hdw
u8 *eeprom;
struct tveeprom tvdata;
@@ -32866,9 +32814,9 @@ diff -urNp linux-2.6.32.43/drivers/media/video/pvrusb2/pvrusb2-eeprom.c linux-2.
memset(&tvdata,0,sizeof(tvdata));
eeprom = pvr2_eeprom_fetch(hdw);
-diff -urNp linux-2.6.32.43/drivers/media/video/saa7134/saa6752hs.c linux-2.6.32.43/drivers/media/video/saa7134/saa6752hs.c
---- linux-2.6.32.43/drivers/media/video/saa7134/saa6752hs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/media/video/saa7134/saa6752hs.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/media/video/saa7134/saa6752hs.c linux-2.6.32.44/drivers/media/video/saa7134/saa6752hs.c
+--- linux-2.6.32.44/drivers/media/video/saa7134/saa6752hs.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/media/video/saa7134/saa6752hs.c 2011-05-16 21:46:57.000000000 -0400
@@ -683,6 +683,8 @@ static int saa6752hs_init(struct v4l2_su
unsigned char localPAT[256];
unsigned char localPMT[256];
@@ -32878,9 +32826,9 @@ diff -urNp linux-2.6.32.43/drivers/media/video/saa7134/saa6752hs.c linux-2.6.32.
/* Set video format - must be done first as it resets other settings */
set_reg8(client, 0x41, h->video_format);
-diff -urNp linux-2.6.32.43/drivers/media/video/saa7164/saa7164-cmd.c linux-2.6.32.43/drivers/media/video/saa7164/saa7164-cmd.c
---- linux-2.6.32.43/drivers/media/video/saa7164/saa7164-cmd.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/media/video/saa7164/saa7164-cmd.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/media/video/saa7164/saa7164-cmd.c linux-2.6.32.44/drivers/media/video/saa7164/saa7164-cmd.c
+--- linux-2.6.32.44/drivers/media/video/saa7164/saa7164-cmd.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/media/video/saa7164/saa7164-cmd.c 2011-05-16 21:46:57.000000000 -0400
@@ -87,6 +87,8 @@ int saa7164_irq_dequeue(struct saa7164_d
wait_queue_head_t *q = 0;
dprintk(DBGLVL_CMD, "%s()\n", __func__);
@@ -32899,9 +32847,9 @@ diff -urNp linux-2.6.32.43/drivers/media/video/saa7164/saa7164-cmd.c linux-2.6.3
while (loop) {
tmComResInfo_t tRsp = { 0, 0, 0, 0, 0, 0 };
-diff -urNp linux-2.6.32.43/drivers/media/video/usbvideo/ibmcam.c linux-2.6.32.43/drivers/media/video/usbvideo/ibmcam.c
---- linux-2.6.32.43/drivers/media/video/usbvideo/ibmcam.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/media/video/usbvideo/ibmcam.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/media/video/usbvideo/ibmcam.c linux-2.6.32.44/drivers/media/video/usbvideo/ibmcam.c
+--- linux-2.6.32.44/drivers/media/video/usbvideo/ibmcam.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/media/video/usbvideo/ibmcam.c 2011-08-05 20:33:55.000000000 -0400
@@ -3947,15 +3947,15 @@ static struct usb_device_id id_table[] =
static int __init ibmcam_init(void)
{
@@ -32927,9 +32875,9 @@ diff -urNp linux-2.6.32.43/drivers/media/video/usbvideo/ibmcam.c linux-2.6.32.43
return usbvideo_register(
&cams,
MAX_IBMCAM,
-diff -urNp linux-2.6.32.43/drivers/media/video/usbvideo/konicawc.c linux-2.6.32.43/drivers/media/video/usbvideo/konicawc.c
---- linux-2.6.32.43/drivers/media/video/usbvideo/konicawc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/media/video/usbvideo/konicawc.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/media/video/usbvideo/konicawc.c linux-2.6.32.44/drivers/media/video/usbvideo/konicawc.c
+--- linux-2.6.32.44/drivers/media/video/usbvideo/konicawc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/media/video/usbvideo/konicawc.c 2011-08-05 20:33:55.000000000 -0400
@@ -225,7 +225,7 @@ static void konicawc_register_input(stru
int error;
@@ -32966,9 +32914,9 @@ diff -urNp linux-2.6.32.43/drivers/media/video/usbvideo/konicawc.c linux-2.6.32.
return usbvideo_register(
&cams,
MAX_CAMERAS,
-diff -urNp linux-2.6.32.43/drivers/media/video/usbvideo/quickcam_messenger.c linux-2.6.32.43/drivers/media/video/usbvideo/quickcam_messenger.c
---- linux-2.6.32.43/drivers/media/video/usbvideo/quickcam_messenger.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/media/video/usbvideo/quickcam_messenger.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/media/video/usbvideo/quickcam_messenger.c linux-2.6.32.44/drivers/media/video/usbvideo/quickcam_messenger.c
+--- linux-2.6.32.44/drivers/media/video/usbvideo/quickcam_messenger.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/media/video/usbvideo/quickcam_messenger.c 2011-04-17 15:56:46.000000000 -0400
@@ -89,7 +89,7 @@ static void qcm_register_input(struct qc
int error;
@@ -32978,9 +32926,9 @@ diff -urNp linux-2.6.32.43/drivers/media/video/usbvideo/quickcam_messenger.c lin
cam->input = input_dev = input_allocate_device();
if (!input_dev) {
-diff -urNp linux-2.6.32.43/drivers/media/video/usbvideo/ultracam.c linux-2.6.32.43/drivers/media/video/usbvideo/ultracam.c
---- linux-2.6.32.43/drivers/media/video/usbvideo/ultracam.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/media/video/usbvideo/ultracam.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/media/video/usbvideo/ultracam.c linux-2.6.32.44/drivers/media/video/usbvideo/ultracam.c
+--- linux-2.6.32.44/drivers/media/video/usbvideo/ultracam.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/media/video/usbvideo/ultracam.c 2011-08-05 20:33:55.000000000 -0400
@@ -655,14 +655,14 @@ static int __init ultracam_init(void)
{
struct usbvideo_cb cbTbl;
@@ -33004,9 +32952,9 @@ diff -urNp linux-2.6.32.43/drivers/media/video/usbvideo/ultracam.c linux-2.6.32.
return usbvideo_register(
&cams,
MAX_CAMERAS,
-diff -urNp linux-2.6.32.43/drivers/media/video/usbvideo/usbvideo.c linux-2.6.32.43/drivers/media/video/usbvideo/usbvideo.c
---- linux-2.6.32.43/drivers/media/video/usbvideo/usbvideo.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/media/video/usbvideo/usbvideo.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/media/video/usbvideo/usbvideo.c linux-2.6.32.44/drivers/media/video/usbvideo/usbvideo.c
+--- linux-2.6.32.44/drivers/media/video/usbvideo/usbvideo.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/media/video/usbvideo/usbvideo.c 2011-08-05 20:33:55.000000000 -0400
@@ -697,15 +697,15 @@ int usbvideo_register(
__func__, cams, base_size, num_cams);
@@ -33028,9 +32976,9 @@ diff -urNp linux-2.6.32.43/drivers/media/video/usbvideo/usbvideo.c linux-2.6.32.
cams->num_cameras = num_cams;
cams->cam = (struct uvd *) &cams[1];
-diff -urNp linux-2.6.32.43/drivers/media/video/usbvision/usbvision-core.c linux-2.6.32.43/drivers/media/video/usbvision/usbvision-core.c
---- linux-2.6.32.43/drivers/media/video/usbvision/usbvision-core.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/media/video/usbvision/usbvision-core.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/media/video/usbvision/usbvision-core.c linux-2.6.32.44/drivers/media/video/usbvision/usbvision-core.c
+--- linux-2.6.32.44/drivers/media/video/usbvision/usbvision-core.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/media/video/usbvision/usbvision-core.c 2011-05-16 21:46:57.000000000 -0400
@@ -820,6 +820,8 @@ static enum ParseState usbvision_parse_c
unsigned char rv, gv, bv;
static unsigned char *Y, *U, *V;
@@ -33040,9 +32988,9 @@ diff -urNp linux-2.6.32.43/drivers/media/video/usbvision/usbvision-core.c linux-
frame = usbvision->curFrame;
imageSize = frame->frmwidth * frame->frmheight;
if ( (frame->v4l2_format.format == V4L2_PIX_FMT_YUV422P) ||
-diff -urNp linux-2.6.32.43/drivers/media/video/v4l2-device.c linux-2.6.32.43/drivers/media/video/v4l2-device.c
---- linux-2.6.32.43/drivers/media/video/v4l2-device.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/media/video/v4l2-device.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/media/video/v4l2-device.c linux-2.6.32.44/drivers/media/video/v4l2-device.c
+--- linux-2.6.32.44/drivers/media/video/v4l2-device.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/media/video/v4l2-device.c 2011-05-04 17:56:28.000000000 -0400
@@ -50,9 +50,9 @@ int v4l2_device_register(struct device *
EXPORT_SYMBOL_GPL(v4l2_device_register);
@@ -33055,9 +33003,9 @@ diff -urNp linux-2.6.32.43/drivers/media/video/v4l2-device.c linux-2.6.32.43/dri
int len = strlen(basename);
if (basename[len - 1] >= '0' && basename[len - 1] <= '9')
-diff -urNp linux-2.6.32.43/drivers/media/video/videobuf-dma-sg.c linux-2.6.32.43/drivers/media/video/videobuf-dma-sg.c
---- linux-2.6.32.43/drivers/media/video/videobuf-dma-sg.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/media/video/videobuf-dma-sg.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/media/video/videobuf-dma-sg.c linux-2.6.32.44/drivers/media/video/videobuf-dma-sg.c
+--- linux-2.6.32.44/drivers/media/video/videobuf-dma-sg.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/media/video/videobuf-dma-sg.c 2011-05-16 21:46:57.000000000 -0400
@@ -693,6 +693,8 @@ void *videobuf_sg_alloc(size_t size)
{
struct videobuf_queue q;
@@ -33067,9 +33015,9 @@ diff -urNp linux-2.6.32.43/drivers/media/video/videobuf-dma-sg.c linux-2.6.32.43
/* Required to make generic handler to call __videobuf_alloc */
q.int_ops = &sg_ops;
-diff -urNp linux-2.6.32.43/drivers/message/fusion/mptbase.c linux-2.6.32.43/drivers/message/fusion/mptbase.c
---- linux-2.6.32.43/drivers/message/fusion/mptbase.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/message/fusion/mptbase.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/message/fusion/mptbase.c linux-2.6.32.44/drivers/message/fusion/mptbase.c
+--- linux-2.6.32.44/drivers/message/fusion/mptbase.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/message/fusion/mptbase.c 2011-04-17 15:56:46.000000000 -0400
@@ -6709,8 +6709,14 @@ procmpt_iocinfo_read(char *buf, char **s
len += sprintf(buf+len, " MaxChainDepth = 0x%02x frames\n", ioc->facts.MaxChainDepth);
len += sprintf(buf+len, " MinBlockSize = 0x%02x bytes\n", 4*ioc->facts.BlockSize);
@@ -33085,9 +33033,9 @@ diff -urNp linux-2.6.32.43/drivers/message/fusion/mptbase.c linux-2.6.32.43/driv
/*
* Rounding UP to nearest 4-kB boundary here...
*/
-diff -urNp linux-2.6.32.43/drivers/message/fusion/mptsas.c linux-2.6.32.43/drivers/message/fusion/mptsas.c
---- linux-2.6.32.43/drivers/message/fusion/mptsas.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/message/fusion/mptsas.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/message/fusion/mptsas.c linux-2.6.32.44/drivers/message/fusion/mptsas.c
+--- linux-2.6.32.44/drivers/message/fusion/mptsas.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/message/fusion/mptsas.c 2011-04-17 15:56:46.000000000 -0400
@@ -436,6 +436,23 @@ mptsas_is_end_device(struct mptsas_devin
return 0;
}
@@ -33136,9 +33084,9 @@ diff -urNp linux-2.6.32.43/drivers/message/fusion/mptsas.c linux-2.6.32.43/drive
static inline struct sas_port *
mptsas_get_port(struct mptsas_phyinfo *phy_info)
{
-diff -urNp linux-2.6.32.43/drivers/message/fusion/mptscsih.c linux-2.6.32.43/drivers/message/fusion/mptscsih.c
---- linux-2.6.32.43/drivers/message/fusion/mptscsih.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/message/fusion/mptscsih.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/message/fusion/mptscsih.c linux-2.6.32.44/drivers/message/fusion/mptscsih.c
+--- linux-2.6.32.44/drivers/message/fusion/mptscsih.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/message/fusion/mptscsih.c 2011-04-17 15:56:46.000000000 -0400
@@ -1248,15 +1248,16 @@ mptscsih_info(struct Scsi_Host *SChost)
h = shost_priv(SChost);
@@ -33164,9 +33112,9 @@ diff -urNp linux-2.6.32.43/drivers/message/fusion/mptscsih.c linux-2.6.32.43/dri
return h->info_kbuf;
}
-diff -urNp linux-2.6.32.43/drivers/message/i2o/i2o_config.c linux-2.6.32.43/drivers/message/i2o/i2o_config.c
---- linux-2.6.32.43/drivers/message/i2o/i2o_config.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/message/i2o/i2o_config.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/message/i2o/i2o_config.c linux-2.6.32.44/drivers/message/i2o/i2o_config.c
+--- linux-2.6.32.44/drivers/message/i2o/i2o_config.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/message/i2o/i2o_config.c 2011-05-16 21:46:57.000000000 -0400
@@ -787,6 +787,8 @@ static int i2o_cfg_passthru(unsigned lon
struct i2o_message *msg;
unsigned int iop;
@@ -33176,9 +33124,9 @@ diff -urNp linux-2.6.32.43/drivers/message/i2o/i2o_config.c linux-2.6.32.43/driv
if (get_user(iop, &cmd->iop) || get_user(user_msg, &cmd->msg))
return -EFAULT;
-diff -urNp linux-2.6.32.43/drivers/message/i2o/i2o_proc.c linux-2.6.32.43/drivers/message/i2o/i2o_proc.c
---- linux-2.6.32.43/drivers/message/i2o/i2o_proc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/message/i2o/i2o_proc.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/message/i2o/i2o_proc.c linux-2.6.32.44/drivers/message/i2o/i2o_proc.c
+--- linux-2.6.32.44/drivers/message/i2o/i2o_proc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/message/i2o/i2o_proc.c 2011-04-17 15:56:46.000000000 -0400
@@ -259,13 +259,6 @@ static char *scsi_devices[] = {
"Array Controller Device"
};
@@ -33265,9 +33213,9 @@ diff -urNp linux-2.6.32.43/drivers/message/i2o/i2o_proc.c linux-2.6.32.43/driver
return 0;
}
-diff -urNp linux-2.6.32.43/drivers/message/i2o/iop.c linux-2.6.32.43/drivers/message/i2o/iop.c
---- linux-2.6.32.43/drivers/message/i2o/iop.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/message/i2o/iop.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/message/i2o/iop.c linux-2.6.32.44/drivers/message/i2o/iop.c
+--- linux-2.6.32.44/drivers/message/i2o/iop.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/message/i2o/iop.c 2011-05-04 17:56:28.000000000 -0400
@@ -110,10 +110,10 @@ u32 i2o_cntxt_list_add(struct i2o_contro
spin_lock_irqsave(&c->context_list_lock, flags);
@@ -33291,9 +33239,9 @@ diff -urNp linux-2.6.32.43/drivers/message/i2o/iop.c linux-2.6.32.43/drivers/mes
INIT_LIST_HEAD(&c->context_list);
#endif
-diff -urNp linux-2.6.32.43/drivers/mfd/wm8350-i2c.c linux-2.6.32.43/drivers/mfd/wm8350-i2c.c
---- linux-2.6.32.43/drivers/mfd/wm8350-i2c.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/mfd/wm8350-i2c.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/mfd/wm8350-i2c.c linux-2.6.32.44/drivers/mfd/wm8350-i2c.c
+--- linux-2.6.32.44/drivers/mfd/wm8350-i2c.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/mfd/wm8350-i2c.c 2011-05-16 21:46:57.000000000 -0400
@@ -43,6 +43,8 @@ static int wm8350_i2c_write_device(struc
u8 msg[(WM8350_MAX_REGISTER << 1) + 1];
int ret;
@@ -33303,9 +33251,9 @@ diff -urNp linux-2.6.32.43/drivers/mfd/wm8350-i2c.c linux-2.6.32.43/drivers/mfd/
if (bytes > ((WM8350_MAX_REGISTER << 1) + 1))
return -EINVAL;
-diff -urNp linux-2.6.32.43/drivers/misc/kgdbts.c linux-2.6.32.43/drivers/misc/kgdbts.c
---- linux-2.6.32.43/drivers/misc/kgdbts.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/misc/kgdbts.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/misc/kgdbts.c linux-2.6.32.44/drivers/misc/kgdbts.c
+--- linux-2.6.32.44/drivers/misc/kgdbts.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/misc/kgdbts.c 2011-04-17 15:56:46.000000000 -0400
@@ -118,7 +118,7 @@
} while (0)
#define MAX_CONFIG_LEN 40
@@ -33324,9 +33272,9 @@ diff -urNp linux-2.6.32.43/drivers/misc/kgdbts.c linux-2.6.32.43/drivers/misc/kg
.name = "kgdbts",
.read_char = kgdbts_get_char,
.write_char = kgdbts_put_char,
-diff -urNp linux-2.6.32.43/drivers/misc/sgi-gru/gruhandles.c linux-2.6.32.43/drivers/misc/sgi-gru/gruhandles.c
---- linux-2.6.32.43/drivers/misc/sgi-gru/gruhandles.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/misc/sgi-gru/gruhandles.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/misc/sgi-gru/gruhandles.c linux-2.6.32.44/drivers/misc/sgi-gru/gruhandles.c
+--- linux-2.6.32.44/drivers/misc/sgi-gru/gruhandles.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/misc/sgi-gru/gruhandles.c 2011-04-17 15:56:46.000000000 -0400
@@ -39,8 +39,8 @@ struct mcs_op_statistic mcs_op_statistic
static void update_mcs_stats(enum mcs_op op, unsigned long clks)
@@ -33338,9 +33286,9 @@ diff -urNp linux-2.6.32.43/drivers/misc/sgi-gru/gruhandles.c linux-2.6.32.43/dri
if (mcs_op_statistics[op].max < clks)
mcs_op_statistics[op].max = clks;
}
-diff -urNp linux-2.6.32.43/drivers/misc/sgi-gru/gruprocfs.c linux-2.6.32.43/drivers/misc/sgi-gru/gruprocfs.c
---- linux-2.6.32.43/drivers/misc/sgi-gru/gruprocfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/misc/sgi-gru/gruprocfs.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/misc/sgi-gru/gruprocfs.c linux-2.6.32.44/drivers/misc/sgi-gru/gruprocfs.c
+--- linux-2.6.32.44/drivers/misc/sgi-gru/gruprocfs.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/misc/sgi-gru/gruprocfs.c 2011-04-17 15:56:46.000000000 -0400
@@ -32,9 +32,9 @@
#define printstat(s, f) printstat_val(s, &gru_stats.f, #f)
@@ -33364,9 +33312,9 @@ diff -urNp linux-2.6.32.43/drivers/misc/sgi-gru/gruprocfs.c linux-2.6.32.43/driv
max = mcs_op_statistics[op].max;
seq_printf(s, "%-20s%12ld%12ld%12ld\n", id[op], count,
count ? total / count : 0, max);
-diff -urNp linux-2.6.32.43/drivers/misc/sgi-gru/grutables.h linux-2.6.32.43/drivers/misc/sgi-gru/grutables.h
---- linux-2.6.32.43/drivers/misc/sgi-gru/grutables.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/misc/sgi-gru/grutables.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/misc/sgi-gru/grutables.h linux-2.6.32.44/drivers/misc/sgi-gru/grutables.h
+--- linux-2.6.32.44/drivers/misc/sgi-gru/grutables.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/misc/sgi-gru/grutables.h 2011-04-17 15:56:46.000000000 -0400
@@ -167,84 +167,84 @@ extern unsigned int gru_max_gids;
* GRU statistics.
*/
@@ -33550,9 +33498,9 @@ diff -urNp linux-2.6.32.43/drivers/misc/sgi-gru/grutables.h linux-2.6.32.43/driv
} while (0)
#ifdef CONFIG_SGI_GRU_DEBUG
-diff -urNp linux-2.6.32.43/drivers/misc/sgi-xp/xpc.h linux-2.6.32.43/drivers/misc/sgi-xp/xpc.h
---- linux-2.6.32.43/drivers/misc/sgi-xp/xpc.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/misc/sgi-xp/xpc.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/misc/sgi-xp/xpc.h linux-2.6.32.44/drivers/misc/sgi-xp/xpc.h
+--- linux-2.6.32.44/drivers/misc/sgi-xp/xpc.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/misc/sgi-xp/xpc.h 2011-08-05 20:33:55.000000000 -0400
@@ -876,7 +876,7 @@ extern struct xpc_registration xpc_regis
/* found in xpc_main.c */
extern struct device *xpc_part;
@@ -33562,9 +33510,9 @@ diff -urNp linux-2.6.32.43/drivers/misc/sgi-xp/xpc.h linux-2.6.32.43/drivers/mis
extern int xpc_disengage_timelimit;
extern int xpc_disengage_timedout;
extern int xpc_activate_IRQ_rcvd;
-diff -urNp linux-2.6.32.43/drivers/misc/sgi-xp/xpc_main.c linux-2.6.32.43/drivers/misc/sgi-xp/xpc_main.c
---- linux-2.6.32.43/drivers/misc/sgi-xp/xpc_main.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/misc/sgi-xp/xpc_main.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/misc/sgi-xp/xpc_main.c linux-2.6.32.44/drivers/misc/sgi-xp/xpc_main.c
+--- linux-2.6.32.44/drivers/misc/sgi-xp/xpc_main.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/misc/sgi-xp/xpc_main.c 2011-08-05 20:33:55.000000000 -0400
@@ -169,7 +169,7 @@ static struct notifier_block xpc_die_not
.notifier_call = xpc_system_die,
};
@@ -33574,9 +33522,9 @@ diff -urNp linux-2.6.32.43/drivers/misc/sgi-xp/xpc_main.c linux-2.6.32.43/driver
/*
* Timer function to enforce the timelimit on the partition disengage.
-diff -urNp linux-2.6.32.43/drivers/misc/sgi-xp/xpc_sn2.c linux-2.6.32.43/drivers/misc/sgi-xp/xpc_sn2.c
---- linux-2.6.32.43/drivers/misc/sgi-xp/xpc_sn2.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/misc/sgi-xp/xpc_sn2.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/misc/sgi-xp/xpc_sn2.c linux-2.6.32.44/drivers/misc/sgi-xp/xpc_sn2.c
+--- linux-2.6.32.44/drivers/misc/sgi-xp/xpc_sn2.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/misc/sgi-xp/xpc_sn2.c 2011-08-05 20:33:55.000000000 -0400
@@ -2350,7 +2350,7 @@ xpc_received_payload_sn2(struct xpc_chan
xpc_acknowledge_msgs_sn2(ch, get, msg->flags);
}
@@ -33597,9 +33545,9 @@ diff -urNp linux-2.6.32.43/drivers/misc/sgi-xp/xpc_sn2.c linux-2.6.32.43/drivers
if (offsetof(struct xpc_msg_sn2, payload) > XPC_MSG_HDR_MAX_SIZE) {
dev_err(xpc_part, "header portion of struct xpc_msg_sn2 is "
-diff -urNp linux-2.6.32.43/drivers/misc/sgi-xp/xpc_uv.c linux-2.6.32.43/drivers/misc/sgi-xp/xpc_uv.c
---- linux-2.6.32.43/drivers/misc/sgi-xp/xpc_uv.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/misc/sgi-xp/xpc_uv.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/misc/sgi-xp/xpc_uv.c linux-2.6.32.44/drivers/misc/sgi-xp/xpc_uv.c
+--- linux-2.6.32.44/drivers/misc/sgi-xp/xpc_uv.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/misc/sgi-xp/xpc_uv.c 2011-08-05 20:33:55.000000000 -0400
@@ -1669,7 +1669,7 @@ xpc_received_payload_uv(struct xpc_chann
XPC_DEACTIVATE_PARTITION(&xpc_partitions[ch->partid], ret);
}
@@ -33620,9 +33568,9 @@ diff -urNp linux-2.6.32.43/drivers/misc/sgi-xp/xpc_uv.c linux-2.6.32.43/drivers/
if (sizeof(struct xpc_notify_mq_msghdr_uv) > XPC_MSG_HDR_MAX_SIZE) {
dev_err(xpc_part, "xpc_notify_mq_msghdr_uv is larger than %d\n",
-diff -urNp linux-2.6.32.43/drivers/misc/sgi-xp/xp.h linux-2.6.32.43/drivers/misc/sgi-xp/xp.h
---- linux-2.6.32.43/drivers/misc/sgi-xp/xp.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/misc/sgi-xp/xp.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/misc/sgi-xp/xp.h linux-2.6.32.44/drivers/misc/sgi-xp/xp.h
+--- linux-2.6.32.44/drivers/misc/sgi-xp/xp.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/misc/sgi-xp/xp.h 2011-08-05 20:33:55.000000000 -0400
@@ -289,7 +289,7 @@ struct xpc_interface {
xpc_notify_func, void *);
void (*received) (short, int, void *);
@@ -33632,9 +33580,9 @@ diff -urNp linux-2.6.32.43/drivers/misc/sgi-xp/xp.h linux-2.6.32.43/drivers/misc
extern struct xpc_interface xpc_interface;
-diff -urNp linux-2.6.32.43/drivers/mtd/chips/cfi_cmdset_0001.c linux-2.6.32.43/drivers/mtd/chips/cfi_cmdset_0001.c
---- linux-2.6.32.43/drivers/mtd/chips/cfi_cmdset_0001.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/mtd/chips/cfi_cmdset_0001.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/mtd/chips/cfi_cmdset_0001.c linux-2.6.32.44/drivers/mtd/chips/cfi_cmdset_0001.c
+--- linux-2.6.32.44/drivers/mtd/chips/cfi_cmdset_0001.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/mtd/chips/cfi_cmdset_0001.c 2011-05-16 21:46:57.000000000 -0400
@@ -743,6 +743,8 @@ static int chip_ready (struct map_info *
struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
unsigned long timeo = jiffies + HZ;
@@ -33662,9 +33610,9 @@ diff -urNp linux-2.6.32.43/drivers/mtd/chips/cfi_cmdset_0001.c linux-2.6.32.43/d
adr += chip->start;
retry:
-diff -urNp linux-2.6.32.43/drivers/mtd/chips/cfi_cmdset_0020.c linux-2.6.32.43/drivers/mtd/chips/cfi_cmdset_0020.c
---- linux-2.6.32.43/drivers/mtd/chips/cfi_cmdset_0020.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/mtd/chips/cfi_cmdset_0020.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/mtd/chips/cfi_cmdset_0020.c linux-2.6.32.44/drivers/mtd/chips/cfi_cmdset_0020.c
+--- linux-2.6.32.44/drivers/mtd/chips/cfi_cmdset_0020.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/mtd/chips/cfi_cmdset_0020.c 2011-05-16 21:46:57.000000000 -0400
@@ -255,6 +255,8 @@ static inline int do_read_onechip(struct
unsigned long cmd_addr;
struct cfi_private *cfi = map->fldrv_priv;
@@ -33710,9 +33658,9 @@ diff -urNp linux-2.6.32.43/drivers/mtd/chips/cfi_cmdset_0020.c linux-2.6.32.43/d
adr += chip->start;
/* Let's determine this according to the interleave only once */
-diff -urNp linux-2.6.32.43/drivers/mtd/devices/doc2000.c linux-2.6.32.43/drivers/mtd/devices/doc2000.c
---- linux-2.6.32.43/drivers/mtd/devices/doc2000.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/mtd/devices/doc2000.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/mtd/devices/doc2000.c linux-2.6.32.44/drivers/mtd/devices/doc2000.c
+--- linux-2.6.32.44/drivers/mtd/devices/doc2000.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/mtd/devices/doc2000.c 2011-04-17 15:56:46.000000000 -0400
@@ -776,7 +776,7 @@ static int doc_write(struct mtd_info *mt
/* The ECC will not be calculated correctly if less than 512 is written */
@@ -33722,9 +33670,9 @@ diff -urNp linux-2.6.32.43/drivers/mtd/devices/doc2000.c linux-2.6.32.43/drivers
printk(KERN_WARNING
"ECC needs a full sector write (adr: %lx size %lx)\n",
(long) to, (long) len);
-diff -urNp linux-2.6.32.43/drivers/mtd/devices/doc2001.c linux-2.6.32.43/drivers/mtd/devices/doc2001.c
---- linux-2.6.32.43/drivers/mtd/devices/doc2001.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/mtd/devices/doc2001.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/mtd/devices/doc2001.c linux-2.6.32.44/drivers/mtd/devices/doc2001.c
+--- linux-2.6.32.44/drivers/mtd/devices/doc2001.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/mtd/devices/doc2001.c 2011-04-17 15:56:46.000000000 -0400
@@ -393,7 +393,7 @@ static int doc_read (struct mtd_info *mt
struct Nand *mychip = &this->chips[from >> (this->chipshift)];
@@ -33734,9 +33682,9 @@ diff -urNp linux-2.6.32.43/drivers/mtd/devices/doc2001.c linux-2.6.32.43/drivers
return -EINVAL;
/* Don't allow a single read to cross a 512-byte block boundary */
-diff -urNp linux-2.6.32.43/drivers/mtd/ftl.c linux-2.6.32.43/drivers/mtd/ftl.c
---- linux-2.6.32.43/drivers/mtd/ftl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/mtd/ftl.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/mtd/ftl.c linux-2.6.32.44/drivers/mtd/ftl.c
+--- linux-2.6.32.44/drivers/mtd/ftl.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/mtd/ftl.c 2011-05-16 21:46:57.000000000 -0400
@@ -474,6 +474,8 @@ static int copy_erase_unit(partition_t *
loff_t offset;
uint16_t srcunitswap = cpu_to_le16(srcunit);
@@ -33746,9 +33694,9 @@ diff -urNp linux-2.6.32.43/drivers/mtd/ftl.c linux-2.6.32.43/drivers/mtd/ftl.c
eun = &part->EUNInfo[srcunit];
xfer = &part->XferInfo[xferunit];
DEBUG(2, "ftl_cs: copying block 0x%x to 0x%x\n",
-diff -urNp linux-2.6.32.43/drivers/mtd/inftlcore.c linux-2.6.32.43/drivers/mtd/inftlcore.c
---- linux-2.6.32.43/drivers/mtd/inftlcore.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/mtd/inftlcore.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/mtd/inftlcore.c linux-2.6.32.44/drivers/mtd/inftlcore.c
+--- linux-2.6.32.44/drivers/mtd/inftlcore.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/mtd/inftlcore.c 2011-05-16 21:46:57.000000000 -0400
@@ -260,6 +260,8 @@ static u16 INFTL_foldchain(struct INFTLr
struct inftl_oob oob;
size_t retlen;
@@ -33758,9 +33706,9 @@ diff -urNp linux-2.6.32.43/drivers/mtd/inftlcore.c linux-2.6.32.43/drivers/mtd/i
DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_foldchain(inftl=%p,thisVUC=%d,"
"pending=%d)\n", inftl, thisVUC, pendingblock);
-diff -urNp linux-2.6.32.43/drivers/mtd/inftlmount.c linux-2.6.32.43/drivers/mtd/inftlmount.c
---- linux-2.6.32.43/drivers/mtd/inftlmount.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/mtd/inftlmount.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/mtd/inftlmount.c linux-2.6.32.44/drivers/mtd/inftlmount.c
+--- linux-2.6.32.44/drivers/mtd/inftlmount.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/mtd/inftlmount.c 2011-05-16 21:46:57.000000000 -0400
@@ -54,6 +54,8 @@ static int find_boot_record(struct INFTL
struct INFTLPartition *ip;
size_t retlen;
@@ -33770,9 +33718,9 @@ diff -urNp linux-2.6.32.43/drivers/mtd/inftlmount.c linux-2.6.32.43/drivers/mtd/
DEBUG(MTD_DEBUG_LEVEL3, "INFTL: find_boot_record(inftl=%p)\n", inftl);
/*
-diff -urNp linux-2.6.32.43/drivers/mtd/lpddr/qinfo_probe.c linux-2.6.32.43/drivers/mtd/lpddr/qinfo_probe.c
---- linux-2.6.32.43/drivers/mtd/lpddr/qinfo_probe.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/mtd/lpddr/qinfo_probe.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/mtd/lpddr/qinfo_probe.c linux-2.6.32.44/drivers/mtd/lpddr/qinfo_probe.c
+--- linux-2.6.32.44/drivers/mtd/lpddr/qinfo_probe.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/mtd/lpddr/qinfo_probe.c 2011-05-16 21:46:57.000000000 -0400
@@ -106,6 +106,8 @@ static int lpddr_pfow_present(struct map
{
map_word pfow_val[4];
@@ -33782,9 +33730,9 @@ diff -urNp linux-2.6.32.43/drivers/mtd/lpddr/qinfo_probe.c linux-2.6.32.43/drive
/* Check identification string */
pfow_val[0] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_P);
pfow_val[1] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_F);
-diff -urNp linux-2.6.32.43/drivers/mtd/mtdchar.c linux-2.6.32.43/drivers/mtd/mtdchar.c
---- linux-2.6.32.43/drivers/mtd/mtdchar.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/mtd/mtdchar.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/mtd/mtdchar.c linux-2.6.32.44/drivers/mtd/mtdchar.c
+--- linux-2.6.32.44/drivers/mtd/mtdchar.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/mtd/mtdchar.c 2011-05-16 21:46:57.000000000 -0400
@@ -460,6 +460,8 @@ static int mtd_ioctl(struct inode *inode
u_long size;
struct mtd_info_user info;
@@ -33794,9 +33742,9 @@ diff -urNp linux-2.6.32.43/drivers/mtd/mtdchar.c linux-2.6.32.43/drivers/mtd/mtd
DEBUG(MTD_DEBUG_LEVEL0, "MTD_ioctl\n");
size = (cmd & IOCSIZE_MASK) >> IOCSIZE_SHIFT;
-diff -urNp linux-2.6.32.43/drivers/mtd/nftlcore.c linux-2.6.32.43/drivers/mtd/nftlcore.c
---- linux-2.6.32.43/drivers/mtd/nftlcore.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/mtd/nftlcore.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/mtd/nftlcore.c linux-2.6.32.44/drivers/mtd/nftlcore.c
+--- linux-2.6.32.44/drivers/mtd/nftlcore.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/mtd/nftlcore.c 2011-05-16 21:46:57.000000000 -0400
@@ -254,6 +254,8 @@ static u16 NFTL_foldchain (struct NFTLre
int inplace = 1;
size_t retlen;
@@ -33806,9 +33754,9 @@ diff -urNp linux-2.6.32.43/drivers/mtd/nftlcore.c linux-2.6.32.43/drivers/mtd/nf
memset(BlockMap, 0xff, sizeof(BlockMap));
memset(BlockFreeFound, 0, sizeof(BlockFreeFound));
-diff -urNp linux-2.6.32.43/drivers/mtd/nftlmount.c linux-2.6.32.43/drivers/mtd/nftlmount.c
---- linux-2.6.32.43/drivers/mtd/nftlmount.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/mtd/nftlmount.c 2011-05-18 20:09:37.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/mtd/nftlmount.c linux-2.6.32.44/drivers/mtd/nftlmount.c
+--- linux-2.6.32.44/drivers/mtd/nftlmount.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/mtd/nftlmount.c 2011-05-18 20:09:37.000000000 -0400
@@ -23,6 +23,7 @@
#include <asm/errno.h>
#include <linux/delay.h>
@@ -33826,9 +33774,9 @@ diff -urNp linux-2.6.32.43/drivers/mtd/nftlmount.c linux-2.6.32.43/drivers/mtd/n
/* Assume logical EraseSize == physical erasesize for starting the scan.
We'll sort it out later if we find a MediaHeader which says otherwise */
/* Actually, we won't. The new DiskOnChip driver has already scanned
-diff -urNp linux-2.6.32.43/drivers/mtd/ubi/build.c linux-2.6.32.43/drivers/mtd/ubi/build.c
---- linux-2.6.32.43/drivers/mtd/ubi/build.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/mtd/ubi/build.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/mtd/ubi/build.c linux-2.6.32.44/drivers/mtd/ubi/build.c
+--- linux-2.6.32.44/drivers/mtd/ubi/build.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/mtd/ubi/build.c 2011-04-17 15:56:46.000000000 -0400
@@ -1255,7 +1255,7 @@ module_exit(ubi_exit);
static int __init bytes_str_to_int(const char *str)
{
@@ -33868,9 +33816,9 @@ diff -urNp linux-2.6.32.43/drivers/mtd/ubi/build.c linux-2.6.32.43/drivers/mtd/u
}
/**
-diff -urNp linux-2.6.32.43/drivers/net/bnx2.c linux-2.6.32.43/drivers/net/bnx2.c
---- linux-2.6.32.43/drivers/net/bnx2.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/bnx2.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/bnx2.c linux-2.6.32.44/drivers/net/bnx2.c
+--- linux-2.6.32.44/drivers/net/bnx2.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/bnx2.c 2011-05-16 21:46:57.000000000 -0400
@@ -5809,6 +5809,8 @@ bnx2_test_nvram(struct bnx2 *bp)
int rc = 0;
u32 magic, csum;
@@ -33880,9 +33828,9 @@ diff -urNp linux-2.6.32.43/drivers/net/bnx2.c linux-2.6.32.43/drivers/net/bnx2.c
if ((rc = bnx2_nvram_read(bp, 0, data, 4)) != 0)
goto test_nvram_done;
-diff -urNp linux-2.6.32.43/drivers/net/cxgb3/l2t.h linux-2.6.32.43/drivers/net/cxgb3/l2t.h
---- linux-2.6.32.43/drivers/net/cxgb3/l2t.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/cxgb3/l2t.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/cxgb3/l2t.h linux-2.6.32.44/drivers/net/cxgb3/l2t.h
+--- linux-2.6.32.44/drivers/net/cxgb3/l2t.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/cxgb3/l2t.h 2011-08-05 20:33:55.000000000 -0400
@@ -86,7 +86,7 @@ typedef void (*arp_failure_handler_func)
*/
struct l2t_skb_cb {
@@ -33892,9 +33840,9 @@ diff -urNp linux-2.6.32.43/drivers/net/cxgb3/l2t.h linux-2.6.32.43/drivers/net/c
#define L2T_SKB_CB(skb) ((struct l2t_skb_cb *)(skb)->cb)
-diff -urNp linux-2.6.32.43/drivers/net/cxgb3/t3_hw.c linux-2.6.32.43/drivers/net/cxgb3/t3_hw.c
---- linux-2.6.32.43/drivers/net/cxgb3/t3_hw.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/cxgb3/t3_hw.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/cxgb3/t3_hw.c linux-2.6.32.44/drivers/net/cxgb3/t3_hw.c
+--- linux-2.6.32.44/drivers/net/cxgb3/t3_hw.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/cxgb3/t3_hw.c 2011-05-16 21:46:57.000000000 -0400
@@ -699,6 +699,8 @@ static int get_vpd_params(struct adapter
int i, addr, ret;
struct t3_vpd vpd;
@@ -33904,9 +33852,9 @@ diff -urNp linux-2.6.32.43/drivers/net/cxgb3/t3_hw.c linux-2.6.32.43/drivers/net
/*
* Card information is normally at VPD_BASE but some early cards had
* it at 0.
-diff -urNp linux-2.6.32.43/drivers/net/e1000e/82571.c linux-2.6.32.43/drivers/net/e1000e/82571.c
---- linux-2.6.32.43/drivers/net/e1000e/82571.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/e1000e/82571.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/e1000e/82571.c linux-2.6.32.44/drivers/net/e1000e/82571.c
+--- linux-2.6.32.44/drivers/net/e1000e/82571.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/e1000e/82571.c 2011-08-05 20:33:55.000000000 -0400
@@ -245,22 +245,22 @@ static s32 e1000_init_mac_params_82571(s
/* check for link */
switch (hw->phy.media_type) {
@@ -34001,9 +33949,9 @@ diff -urNp linux-2.6.32.43/drivers/net/e1000e/82571.c linux-2.6.32.43/drivers/ne
.acquire_nvm = e1000_acquire_nvm_82571,
.read_nvm = e1000e_read_nvm_eerd,
.release_nvm = e1000_release_nvm_82571,
-diff -urNp linux-2.6.32.43/drivers/net/e1000e/e1000.h linux-2.6.32.43/drivers/net/e1000e/e1000.h
---- linux-2.6.32.43/drivers/net/e1000e/e1000.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/e1000e/e1000.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/e1000e/e1000.h linux-2.6.32.44/drivers/net/e1000e/e1000.h
+--- linux-2.6.32.44/drivers/net/e1000e/e1000.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/e1000e/e1000.h 2011-04-17 15:56:46.000000000 -0400
@@ -375,9 +375,9 @@ struct e1000_info {
u32 pba;
u32 max_hw_frame_size;
@@ -34017,9 +33965,9 @@ diff -urNp linux-2.6.32.43/drivers/net/e1000e/e1000.h linux-2.6.32.43/drivers/ne
};
/* hardware capability, feature, and workaround flags */
-diff -urNp linux-2.6.32.43/drivers/net/e1000e/es2lan.c linux-2.6.32.43/drivers/net/e1000e/es2lan.c
---- linux-2.6.32.43/drivers/net/e1000e/es2lan.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/e1000e/es2lan.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/e1000e/es2lan.c linux-2.6.32.44/drivers/net/e1000e/es2lan.c
+--- linux-2.6.32.44/drivers/net/e1000e/es2lan.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/e1000e/es2lan.c 2011-08-05 20:33:55.000000000 -0400
@@ -229,16 +229,16 @@ static s32 e1000_init_mac_params_80003es
/* check for link */
switch (hw->phy.media_type) {
@@ -34070,9 +34018,9 @@ diff -urNp linux-2.6.32.43/drivers/net/e1000e/es2lan.c linux-2.6.32.43/drivers/n
.acquire_nvm = e1000_acquire_nvm_80003es2lan,
.read_nvm = e1000e_read_nvm_eerd,
.release_nvm = e1000_release_nvm_80003es2lan,
-diff -urNp linux-2.6.32.43/drivers/net/e1000e/hw.h linux-2.6.32.43/drivers/net/e1000e/hw.h
---- linux-2.6.32.43/drivers/net/e1000e/hw.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/e1000e/hw.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/e1000e/hw.h linux-2.6.32.44/drivers/net/e1000e/hw.h
+--- linux-2.6.32.44/drivers/net/e1000e/hw.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/e1000e/hw.h 2011-04-17 15:56:46.000000000 -0400
@@ -756,34 +756,34 @@ struct e1000_mac_operations {
/* Function pointers for the PHY. */
@@ -34132,9 +34080,9 @@ diff -urNp linux-2.6.32.43/drivers/net/e1000e/hw.h linux-2.6.32.43/drivers/net/e
};
struct e1000_mac_info {
-diff -urNp linux-2.6.32.43/drivers/net/e1000e/ich8lan.c linux-2.6.32.43/drivers/net/e1000e/ich8lan.c
---- linux-2.6.32.43/drivers/net/e1000e/ich8lan.c 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/e1000e/ich8lan.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/e1000e/ich8lan.c linux-2.6.32.44/drivers/net/e1000e/ich8lan.c
+--- linux-2.6.32.44/drivers/net/e1000e/ich8lan.c 2011-05-10 22:12:01.000000000 -0400
++++ linux-2.6.32.44/drivers/net/e1000e/ich8lan.c 2011-08-05 20:33:55.000000000 -0400
@@ -265,13 +265,13 @@ static s32 e1000_init_phy_params_pchlan(
phy->addr = 1;
phy->reset_delay_us = 100;
@@ -34280,9 +34228,9 @@ diff -urNp linux-2.6.32.43/drivers/net/e1000e/ich8lan.c linux-2.6.32.43/drivers/
.acquire_nvm = e1000_acquire_nvm_ich8lan,
.read_nvm = e1000_read_nvm_ich8lan,
.release_nvm = e1000_release_nvm_ich8lan,
-diff -urNp linux-2.6.32.43/drivers/net/e1000e/netdev.c linux-2.6.32.43/drivers/net/e1000e/netdev.c
---- linux-2.6.32.43/drivers/net/e1000e/netdev.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/e1000e/netdev.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/e1000e/netdev.c linux-2.6.32.44/drivers/net/e1000e/netdev.c
+--- linux-2.6.32.44/drivers/net/e1000e/netdev.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/e1000e/netdev.c 2011-08-05 20:33:55.000000000 -0400
@@ -5071,9 +5071,9 @@ static int __devinit e1000_probe(struct
err = -EIO;
@@ -34296,9 +34244,9 @@ diff -urNp linux-2.6.32.43/drivers/net/e1000e/netdev.c linux-2.6.32.43/drivers/n
err = ei->get_variants(adapter);
if (err)
-diff -urNp linux-2.6.32.43/drivers/net/hamradio/6pack.c linux-2.6.32.43/drivers/net/hamradio/6pack.c
---- linux-2.6.32.43/drivers/net/hamradio/6pack.c 2011-07-13 17:23:04.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/hamradio/6pack.c 2011-07-13 17:23:18.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/hamradio/6pack.c linux-2.6.32.44/drivers/net/hamradio/6pack.c
+--- linux-2.6.32.44/drivers/net/hamradio/6pack.c 2011-07-13 17:23:04.000000000 -0400
++++ linux-2.6.32.44/drivers/net/hamradio/6pack.c 2011-07-13 17:23:18.000000000 -0400
@@ -461,6 +461,8 @@ static void sixpack_receive_buf(struct t
unsigned char buf[512];
int count1;
@@ -34308,9 +34256,9 @@ diff -urNp linux-2.6.32.43/drivers/net/hamradio/6pack.c linux-2.6.32.43/drivers/
if (!count)
return;
-diff -urNp linux-2.6.32.43/drivers/net/ibmveth.c linux-2.6.32.43/drivers/net/ibmveth.c
---- linux-2.6.32.43/drivers/net/ibmveth.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/ibmveth.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/ibmveth.c linux-2.6.32.44/drivers/net/ibmveth.c
+--- linux-2.6.32.44/drivers/net/ibmveth.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/ibmveth.c 2011-04-17 15:56:46.000000000 -0400
@@ -1577,7 +1577,7 @@ static struct attribute * veth_pool_attr
NULL,
};
@@ -34320,9 +34268,9 @@ diff -urNp linux-2.6.32.43/drivers/net/ibmveth.c linux-2.6.32.43/drivers/net/ibm
.show = veth_pool_show,
.store = veth_pool_store,
};
-diff -urNp linux-2.6.32.43/drivers/net/igb/e1000_82575.c linux-2.6.32.43/drivers/net/igb/e1000_82575.c
---- linux-2.6.32.43/drivers/net/igb/e1000_82575.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/igb/e1000_82575.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/igb/e1000_82575.c linux-2.6.32.44/drivers/net/igb/e1000_82575.c
+--- linux-2.6.32.44/drivers/net/igb/e1000_82575.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/igb/e1000_82575.c 2011-08-05 20:33:55.000000000 -0400
@@ -135,7 +135,7 @@ static s32 igb_get_invariants_82575(stru
? true : false;
@@ -34403,9 +34351,9 @@ diff -urNp linux-2.6.32.43/drivers/net/igb/e1000_82575.c linux-2.6.32.43/drivers
.acquire = igb_acquire_nvm_82575,
.read = igb_read_nvm_eerd,
.release = igb_release_nvm_82575,
-diff -urNp linux-2.6.32.43/drivers/net/igb/e1000_hw.h linux-2.6.32.43/drivers/net/igb/e1000_hw.h
---- linux-2.6.32.43/drivers/net/igb/e1000_hw.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/igb/e1000_hw.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/igb/e1000_hw.h linux-2.6.32.44/drivers/net/igb/e1000_hw.h
+--- linux-2.6.32.44/drivers/net/igb/e1000_hw.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/igb/e1000_hw.h 2011-04-17 15:56:46.000000000 -0400
@@ -305,17 +305,17 @@ struct e1000_phy_operations {
};
@@ -34431,9 +34379,9 @@ diff -urNp linux-2.6.32.43/drivers/net/igb/e1000_hw.h linux-2.6.32.43/drivers/ne
};
extern const struct e1000_info e1000_82575_info;
-diff -urNp linux-2.6.32.43/drivers/net/igb/e1000_mbx.c linux-2.6.32.43/drivers/net/igb/e1000_mbx.c
---- linux-2.6.32.43/drivers/net/igb/e1000_mbx.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/igb/e1000_mbx.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/igb/e1000_mbx.c linux-2.6.32.44/drivers/net/igb/e1000_mbx.c
+--- linux-2.6.32.44/drivers/net/igb/e1000_mbx.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/igb/e1000_mbx.c 2011-08-05 20:33:55.000000000 -0400
@@ -414,13 +414,13 @@ s32 igb_init_mbx_params_pf(struct e1000_
mbx->size = E1000_VFMAILBOX_SIZE;
@@ -34455,9 +34403,9 @@ diff -urNp linux-2.6.32.43/drivers/net/igb/e1000_mbx.c linux-2.6.32.43/drivers/n
mbx->stats.msgs_tx = 0;
mbx->stats.msgs_rx = 0;
-diff -urNp linux-2.6.32.43/drivers/net/igb/igb_main.c linux-2.6.32.43/drivers/net/igb/igb_main.c
---- linux-2.6.32.43/drivers/net/igb/igb_main.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/igb/igb_main.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/igb/igb_main.c linux-2.6.32.44/drivers/net/igb/igb_main.c
+--- linux-2.6.32.44/drivers/net/igb/igb_main.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/igb/igb_main.c 2011-08-05 20:33:55.000000000 -0400
@@ -1295,9 +1295,9 @@ static int __devinit igb_probe(struct pc
/* setup the private structure */
hw->back = adapter;
@@ -34471,9 +34419,9 @@ diff -urNp linux-2.6.32.43/drivers/net/igb/igb_main.c linux-2.6.32.43/drivers/ne
/* Initialize skew-specific constants */
err = ei->get_invariants(hw);
if (err)
-diff -urNp linux-2.6.32.43/drivers/net/igbvf/mbx.c linux-2.6.32.43/drivers/net/igbvf/mbx.c
---- linux-2.6.32.43/drivers/net/igbvf/mbx.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/igbvf/mbx.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/igbvf/mbx.c linux-2.6.32.44/drivers/net/igbvf/mbx.c
+--- linux-2.6.32.44/drivers/net/igbvf/mbx.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/igbvf/mbx.c 2011-08-05 20:33:55.000000000 -0400
@@ -331,13 +331,13 @@ s32 e1000_init_mbx_params_vf(struct e100
mbx->size = E1000_VFMAILBOX_SIZE;
@@ -34495,9 +34443,9 @@ diff -urNp linux-2.6.32.43/drivers/net/igbvf/mbx.c linux-2.6.32.43/drivers/net/i
mbx->stats.msgs_tx = 0;
mbx->stats.msgs_rx = 0;
-diff -urNp linux-2.6.32.43/drivers/net/igbvf/vf.c linux-2.6.32.43/drivers/net/igbvf/vf.c
---- linux-2.6.32.43/drivers/net/igbvf/vf.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/igbvf/vf.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/igbvf/vf.c linux-2.6.32.44/drivers/net/igbvf/vf.c
+--- linux-2.6.32.44/drivers/net/igbvf/vf.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/igbvf/vf.c 2011-08-05 20:33:55.000000000 -0400
@@ -55,21 +55,21 @@ static s32 e1000_init_mac_params_vf(stru
/* Function pointers */
@@ -34539,9 +34487,9 @@ diff -urNp linux-2.6.32.43/drivers/net/igbvf/vf.c linux-2.6.32.43/drivers/net/ig
}
/**
-diff -urNp linux-2.6.32.43/drivers/net/iseries_veth.c linux-2.6.32.43/drivers/net/iseries_veth.c
---- linux-2.6.32.43/drivers/net/iseries_veth.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/iseries_veth.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/iseries_veth.c linux-2.6.32.44/drivers/net/iseries_veth.c
+--- linux-2.6.32.44/drivers/net/iseries_veth.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/iseries_veth.c 2011-04-17 15:56:46.000000000 -0400
@@ -384,7 +384,7 @@ static struct attribute *veth_cnx_defaul
NULL
};
@@ -34560,9 +34508,9 @@ diff -urNp linux-2.6.32.43/drivers/net/iseries_veth.c linux-2.6.32.43/drivers/ne
.show = veth_port_attribute_show
};
-diff -urNp linux-2.6.32.43/drivers/net/ixgb/ixgb_main.c linux-2.6.32.43/drivers/net/ixgb/ixgb_main.c
---- linux-2.6.32.43/drivers/net/ixgb/ixgb_main.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/ixgb/ixgb_main.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/ixgb/ixgb_main.c linux-2.6.32.44/drivers/net/ixgb/ixgb_main.c
+--- linux-2.6.32.44/drivers/net/ixgb/ixgb_main.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/ixgb/ixgb_main.c 2011-05-16 21:46:57.000000000 -0400
@@ -1052,6 +1052,8 @@ ixgb_set_multi(struct net_device *netdev
u32 rctl;
int i;
@@ -34572,9 +34520,9 @@ diff -urNp linux-2.6.32.43/drivers/net/ixgb/ixgb_main.c linux-2.6.32.43/drivers/
/* Check for Promiscuous and All Multicast modes */
rctl = IXGB_READ_REG(hw, RCTL);
-diff -urNp linux-2.6.32.43/drivers/net/ixgb/ixgb_param.c linux-2.6.32.43/drivers/net/ixgb/ixgb_param.c
---- linux-2.6.32.43/drivers/net/ixgb/ixgb_param.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/ixgb/ixgb_param.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/ixgb/ixgb_param.c linux-2.6.32.44/drivers/net/ixgb/ixgb_param.c
+--- linux-2.6.32.44/drivers/net/ixgb/ixgb_param.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/ixgb/ixgb_param.c 2011-05-16 21:46:57.000000000 -0400
@@ -260,6 +260,9 @@ void __devinit
ixgb_check_options(struct ixgb_adapter *adapter)
{
@@ -34585,9 +34533,9 @@ diff -urNp linux-2.6.32.43/drivers/net/ixgb/ixgb_param.c linux-2.6.32.43/drivers
if (bd >= IXGB_MAX_NIC) {
printk(KERN_NOTICE
"Warning: no configuration for board #%i\n", bd);
-diff -urNp linux-2.6.32.43/drivers/net/ixgbe/ixgbe_82598.c linux-2.6.32.43/drivers/net/ixgbe/ixgbe_82598.c
---- linux-2.6.32.43/drivers/net/ixgbe/ixgbe_82598.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/ixgbe/ixgbe_82598.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/ixgbe/ixgbe_82598.c linux-2.6.32.44/drivers/net/ixgbe/ixgbe_82598.c
+--- linux-2.6.32.44/drivers/net/ixgbe/ixgbe_82598.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/ixgbe/ixgbe_82598.c 2011-08-05 20:33:55.000000000 -0400
@@ -154,19 +154,19 @@ static s32 ixgbe_init_phy_ops_82598(stru
/* Overwrite the link function pointers if copper PHY */
@@ -34613,9 +34561,9 @@ diff -urNp linux-2.6.32.43/drivers/net/ixgbe/ixgbe_82598.c linux-2.6.32.43/drive
/* Call SFP+ identify routine to get the SFP+ module type */
ret_val = phy->ops.identify_sfp(hw);
-diff -urNp linux-2.6.32.43/drivers/net/ixgbe/ixgbe_82599.c linux-2.6.32.43/drivers/net/ixgbe/ixgbe_82599.c
---- linux-2.6.32.43/drivers/net/ixgbe/ixgbe_82599.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/ixgbe/ixgbe_82599.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/ixgbe/ixgbe_82599.c linux-2.6.32.44/drivers/net/ixgbe/ixgbe_82599.c
+--- linux-2.6.32.44/drivers/net/ixgbe/ixgbe_82599.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/ixgbe/ixgbe_82599.c 2011-08-05 20:33:55.000000000 -0400
@@ -62,9 +62,9 @@ static void ixgbe_init_mac_link_ops_8259
struct ixgbe_mac_info *mac = &hw->mac;
if (hw->phy.multispeed_fiber) {
@@ -34658,9 +34606,9 @@ diff -urNp linux-2.6.32.43/drivers/net/ixgbe/ixgbe_82599.c linux-2.6.32.43/drive
&ixgbe_get_phy_firmware_version_tnx;
break;
default:
-diff -urNp linux-2.6.32.43/drivers/net/ixgbe/ixgbe_main.c linux-2.6.32.43/drivers/net/ixgbe/ixgbe_main.c
---- linux-2.6.32.43/drivers/net/ixgbe/ixgbe_main.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/ixgbe/ixgbe_main.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/ixgbe/ixgbe_main.c linux-2.6.32.44/drivers/net/ixgbe/ixgbe_main.c
+--- linux-2.6.32.44/drivers/net/ixgbe/ixgbe_main.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/ixgbe/ixgbe_main.c 2011-08-05 20:33:55.000000000 -0400
@@ -5638,18 +5638,18 @@ static int __devinit ixgbe_probe(struct
adapter->bd_number = cards_found;
@@ -34684,9 +34632,9 @@ diff -urNp linux-2.6.32.43/drivers/net/ixgbe/ixgbe_main.c linux-2.6.32.43/driver
hw->phy.sfp_type = ixgbe_sfp_type_unknown;
/* ixgbe_identify_phy_generic will set prtad and mmds properly */
hw->phy.mdio.prtad = MDIO_PRTAD_NONE;
-diff -urNp linux-2.6.32.43/drivers/net/mlx4/main.c linux-2.6.32.43/drivers/net/mlx4/main.c
---- linux-2.6.32.43/drivers/net/mlx4/main.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/mlx4/main.c 2011-05-18 20:09:37.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/mlx4/main.c linux-2.6.32.44/drivers/net/mlx4/main.c
+--- linux-2.6.32.44/drivers/net/mlx4/main.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/mlx4/main.c 2011-05-18 20:09:37.000000000 -0400
@@ -38,6 +38,7 @@
#include <linux/errno.h>
#include <linux/pci.h>
@@ -34704,9 +34652,9 @@ diff -urNp linux-2.6.32.43/drivers/net/mlx4/main.c linux-2.6.32.43/drivers/net/m
err = mlx4_QUERY_FW(dev);
if (err) {
if (err == -EACCES)
-diff -urNp linux-2.6.32.43/drivers/net/niu.c linux-2.6.32.43/drivers/net/niu.c
---- linux-2.6.32.43/drivers/net/niu.c 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/niu.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/niu.c linux-2.6.32.44/drivers/net/niu.c
+--- linux-2.6.32.44/drivers/net/niu.c 2011-05-10 22:12:01.000000000 -0400
++++ linux-2.6.32.44/drivers/net/niu.c 2011-05-16 21:46:57.000000000 -0400
@@ -9128,6 +9128,8 @@ static void __devinit niu_try_msix(struc
int i, num_irqs, err;
u8 first_ldg;
@@ -34716,9 +34664,9 @@ diff -urNp linux-2.6.32.43/drivers/net/niu.c linux-2.6.32.43/drivers/net/niu.c
first_ldg = (NIU_NUM_LDG / parent->num_ports) * np->port;
for (i = 0; i < (NIU_NUM_LDG / parent->num_ports); i++)
ldg_num_map[i] = first_ldg + i;
-diff -urNp linux-2.6.32.43/drivers/net/pcnet32.c linux-2.6.32.43/drivers/net/pcnet32.c
---- linux-2.6.32.43/drivers/net/pcnet32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/pcnet32.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/pcnet32.c linux-2.6.32.44/drivers/net/pcnet32.c
+--- linux-2.6.32.44/drivers/net/pcnet32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/pcnet32.c 2011-08-05 20:33:55.000000000 -0400
@@ -79,7 +79,7 @@ static int cards_found;
/*
* VLB I/O addresses
@@ -35355,9 +35303,9 @@ diff -urNp linux-2.6.32.43/drivers/net/pcnet32.c linux-2.6.32.43/drivers/net/pcn
}
} else {
if (netif_msg_link(lp))
-diff -urNp linux-2.6.32.43/drivers/net/tg3.h linux-2.6.32.43/drivers/net/tg3.h
---- linux-2.6.32.43/drivers/net/tg3.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/tg3.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/tg3.h linux-2.6.32.44/drivers/net/tg3.h
+--- linux-2.6.32.44/drivers/net/tg3.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/tg3.h 2011-04-17 15:56:46.000000000 -0400
@@ -95,6 +95,7 @@
#define CHIPREV_ID_5750_A0 0x4000
#define CHIPREV_ID_5750_A1 0x4001
@@ -35366,9 +35314,9 @@ diff -urNp linux-2.6.32.43/drivers/net/tg3.h linux-2.6.32.43/drivers/net/tg3.h
#define CHIPREV_ID_5750_C2 0x4202
#define CHIPREV_ID_5752_A0_HW 0x5000
#define CHIPREV_ID_5752_A0 0x6000
-diff -urNp linux-2.6.32.43/drivers/net/tokenring/abyss.c linux-2.6.32.43/drivers/net/tokenring/abyss.c
---- linux-2.6.32.43/drivers/net/tokenring/abyss.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/tokenring/abyss.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/tokenring/abyss.c linux-2.6.32.44/drivers/net/tokenring/abyss.c
+--- linux-2.6.32.44/drivers/net/tokenring/abyss.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/tokenring/abyss.c 2011-08-05 20:33:55.000000000 -0400
@@ -451,10 +451,12 @@ static struct pci_driver abyss_driver =
static int __init abyss_init (void)
@@ -35385,9 +35333,9 @@ diff -urNp linux-2.6.32.43/drivers/net/tokenring/abyss.c linux-2.6.32.43/drivers
return pci_register_driver(&abyss_driver);
}
-diff -urNp linux-2.6.32.43/drivers/net/tokenring/madgemc.c linux-2.6.32.43/drivers/net/tokenring/madgemc.c
---- linux-2.6.32.43/drivers/net/tokenring/madgemc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/tokenring/madgemc.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/tokenring/madgemc.c linux-2.6.32.44/drivers/net/tokenring/madgemc.c
+--- linux-2.6.32.44/drivers/net/tokenring/madgemc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/tokenring/madgemc.c 2011-08-05 20:33:55.000000000 -0400
@@ -755,9 +755,11 @@ static struct mca_driver madgemc_driver
static int __init madgemc_init (void)
@@ -35403,9 +35351,9 @@ diff -urNp linux-2.6.32.43/drivers/net/tokenring/madgemc.c linux-2.6.32.43/drive
return mca_register_driver (&madgemc_driver);
}
-diff -urNp linux-2.6.32.43/drivers/net/tokenring/proteon.c linux-2.6.32.43/drivers/net/tokenring/proteon.c
---- linux-2.6.32.43/drivers/net/tokenring/proteon.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/tokenring/proteon.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/tokenring/proteon.c linux-2.6.32.44/drivers/net/tokenring/proteon.c
+--- linux-2.6.32.44/drivers/net/tokenring/proteon.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/tokenring/proteon.c 2011-08-05 20:33:55.000000000 -0400
@@ -353,9 +353,11 @@ static int __init proteon_init(void)
struct platform_device *pdev;
int i, num = 0, err = 0;
@@ -35421,9 +35369,9 @@ diff -urNp linux-2.6.32.43/drivers/net/tokenring/proteon.c linux-2.6.32.43/drive
err = platform_driver_register(&proteon_driver);
if (err)
-diff -urNp linux-2.6.32.43/drivers/net/tokenring/skisa.c linux-2.6.32.43/drivers/net/tokenring/skisa.c
---- linux-2.6.32.43/drivers/net/tokenring/skisa.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/tokenring/skisa.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/tokenring/skisa.c linux-2.6.32.44/drivers/net/tokenring/skisa.c
+--- linux-2.6.32.44/drivers/net/tokenring/skisa.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/tokenring/skisa.c 2011-08-05 20:33:55.000000000 -0400
@@ -363,9 +363,11 @@ static int __init sk_isa_init(void)
struct platform_device *pdev;
int i, num = 0, err = 0;
@@ -35439,9 +35387,9 @@ diff -urNp linux-2.6.32.43/drivers/net/tokenring/skisa.c linux-2.6.32.43/drivers
err = platform_driver_register(&sk_isa_driver);
if (err)
-diff -urNp linux-2.6.32.43/drivers/net/tulip/de2104x.c linux-2.6.32.43/drivers/net/tulip/de2104x.c
---- linux-2.6.32.43/drivers/net/tulip/de2104x.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/tulip/de2104x.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/tulip/de2104x.c linux-2.6.32.44/drivers/net/tulip/de2104x.c
+--- linux-2.6.32.44/drivers/net/tulip/de2104x.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/tulip/de2104x.c 2011-05-16 21:46:57.000000000 -0400
@@ -1785,6 +1785,8 @@ static void __devinit de21041_get_srom_i
struct de_srom_info_leaf *il;
void *bufp;
@@ -35451,9 +35399,9 @@ diff -urNp linux-2.6.32.43/drivers/net/tulip/de2104x.c linux-2.6.32.43/drivers/n
/* download entire eeprom */
for (i = 0; i < DE_EEPROM_WORDS; i++)
((__le16 *)ee_data)[i] =
-diff -urNp linux-2.6.32.43/drivers/net/tulip/de4x5.c linux-2.6.32.43/drivers/net/tulip/de4x5.c
---- linux-2.6.32.43/drivers/net/tulip/de4x5.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/tulip/de4x5.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/tulip/de4x5.c linux-2.6.32.44/drivers/net/tulip/de4x5.c
+--- linux-2.6.32.44/drivers/net/tulip/de4x5.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/tulip/de4x5.c 2011-04-17 15:56:46.000000000 -0400
@@ -5472,7 +5472,7 @@ de4x5_ioctl(struct net_device *dev, stru
for (i=0; i<ETH_ALEN; i++) {
tmp.addr[i] = dev->dev_addr[i];
@@ -35472,9 +35420,9 @@ diff -urNp linux-2.6.32.43/drivers/net/tulip/de4x5.c linux-2.6.32.43/drivers/net
return -EFAULT;
break;
}
-diff -urNp linux-2.6.32.43/drivers/net/usb/hso.c linux-2.6.32.43/drivers/net/usb/hso.c
---- linux-2.6.32.43/drivers/net/usb/hso.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/usb/hso.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/usb/hso.c linux-2.6.32.44/drivers/net/usb/hso.c
+--- linux-2.6.32.44/drivers/net/usb/hso.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/usb/hso.c 2011-04-17 15:56:46.000000000 -0400
@@ -71,7 +71,7 @@
#include <asm/byteorder.h>
#include <linux/serial_core.h>
@@ -35562,9 +35510,9 @@ diff -urNp linux-2.6.32.43/drivers/net/usb/hso.c linux-2.6.32.43/drivers/net/usb
result =
hso_start_serial_device(serial_table[i], GFP_NOIO);
hso_kick_transmit(dev2ser(serial_table[i]));
-diff -urNp linux-2.6.32.43/drivers/net/vxge/vxge-config.h linux-2.6.32.43/drivers/net/vxge/vxge-config.h
---- linux-2.6.32.43/drivers/net/vxge/vxge-config.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/vxge/vxge-config.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/vxge/vxge-config.h linux-2.6.32.44/drivers/net/vxge/vxge-config.h
+--- linux-2.6.32.44/drivers/net/vxge/vxge-config.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/vxge/vxge-config.h 2011-08-05 20:33:55.000000000 -0400
@@ -474,7 +474,7 @@ struct vxge_hw_uld_cbs {
void (*link_down)(struct __vxge_hw_device *devh);
void (*crit_err)(struct __vxge_hw_device *devh,
@@ -35574,9 +35522,9 @@ diff -urNp linux-2.6.32.43/drivers/net/vxge/vxge-config.h linux-2.6.32.43/driver
/*
* struct __vxge_hw_blockpool_entry - Block private data structure
-diff -urNp linux-2.6.32.43/drivers/net/vxge/vxge-main.c linux-2.6.32.43/drivers/net/vxge/vxge-main.c
---- linux-2.6.32.43/drivers/net/vxge/vxge-main.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/vxge/vxge-main.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/vxge/vxge-main.c linux-2.6.32.44/drivers/net/vxge/vxge-main.c
+--- linux-2.6.32.44/drivers/net/vxge/vxge-main.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/vxge/vxge-main.c 2011-05-16 21:46:57.000000000 -0400
@@ -93,6 +93,8 @@ static inline void VXGE_COMPLETE_VPATH_T
struct sk_buff *completed[NR_SKB_COMPLETED];
int more;
@@ -35595,9 +35543,9 @@ diff -urNp linux-2.6.32.43/drivers/net/vxge/vxge-main.c linux-2.6.32.43/drivers/
/*
* Filling
* - itable with bucket numbers
-diff -urNp linux-2.6.32.43/drivers/net/vxge/vxge-traffic.h linux-2.6.32.43/drivers/net/vxge/vxge-traffic.h
---- linux-2.6.32.43/drivers/net/vxge/vxge-traffic.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/vxge/vxge-traffic.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/vxge/vxge-traffic.h linux-2.6.32.44/drivers/net/vxge/vxge-traffic.h
+--- linux-2.6.32.44/drivers/net/vxge/vxge-traffic.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/vxge/vxge-traffic.h 2011-08-05 20:33:55.000000000 -0400
@@ -2123,7 +2123,7 @@ struct vxge_hw_mempool_cbs {
struct vxge_hw_mempool_dma *dma_object,
u32 index,
@@ -35607,9 +35555,9 @@ diff -urNp linux-2.6.32.43/drivers/net/vxge/vxge-traffic.h linux-2.6.32.43/drive
void
__vxge_hw_mempool_destroy(
-diff -urNp linux-2.6.32.43/drivers/net/wan/cycx_x25.c linux-2.6.32.43/drivers/net/wan/cycx_x25.c
---- linux-2.6.32.43/drivers/net/wan/cycx_x25.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/wan/cycx_x25.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/wan/cycx_x25.c linux-2.6.32.44/drivers/net/wan/cycx_x25.c
+--- linux-2.6.32.44/drivers/net/wan/cycx_x25.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/wan/cycx_x25.c 2011-05-16 21:46:57.000000000 -0400
@@ -1017,6 +1017,8 @@ static void hex_dump(char *msg, unsigned
unsigned char hex[1024],
* phex = hex;
@@ -35619,9 +35567,9 @@ diff -urNp linux-2.6.32.43/drivers/net/wan/cycx_x25.c linux-2.6.32.43/drivers/ne
if (len >= (sizeof(hex) / 2))
len = (sizeof(hex) / 2) - 1;
-diff -urNp linux-2.6.32.43/drivers/net/wan/hdlc_x25.c linux-2.6.32.43/drivers/net/wan/hdlc_x25.c
---- linux-2.6.32.43/drivers/net/wan/hdlc_x25.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/wan/hdlc_x25.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/wan/hdlc_x25.c linux-2.6.32.44/drivers/net/wan/hdlc_x25.c
+--- linux-2.6.32.44/drivers/net/wan/hdlc_x25.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/wan/hdlc_x25.c 2011-08-05 20:33:55.000000000 -0400
@@ -136,16 +136,16 @@ static netdev_tx_t x25_xmit(struct sk_bu
static int x25_open(struct net_device *dev)
@@ -35647,9 +35595,9 @@ diff -urNp linux-2.6.32.43/drivers/net/wan/hdlc_x25.c linux-2.6.32.43/drivers/ne
result = lapb_register(dev, &cb);
if (result != LAPB_OK)
return result;
-diff -urNp linux-2.6.32.43/drivers/net/wimax/i2400m/usb-fw.c linux-2.6.32.43/drivers/net/wimax/i2400m/usb-fw.c
---- linux-2.6.32.43/drivers/net/wimax/i2400m/usb-fw.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/wimax/i2400m/usb-fw.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/wimax/i2400m/usb-fw.c linux-2.6.32.44/drivers/net/wimax/i2400m/usb-fw.c
+--- linux-2.6.32.44/drivers/net/wimax/i2400m/usb-fw.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/wimax/i2400m/usb-fw.c 2011-05-16 21:46:57.000000000 -0400
@@ -263,6 +263,8 @@ ssize_t i2400mu_bus_bm_wait_for_ack(stru
int do_autopm = 1;
DECLARE_COMPLETION_ONSTACK(notif_completion);
@@ -35659,9 +35607,9 @@ diff -urNp linux-2.6.32.43/drivers/net/wimax/i2400m/usb-fw.c linux-2.6.32.43/dri
d_fnstart(8, dev, "(i2400m %p ack %p size %zu)\n",
i2400m, ack, ack_size);
BUG_ON(_ack == i2400m->bm_ack_buf);
-diff -urNp linux-2.6.32.43/drivers/net/wireless/airo.c linux-2.6.32.43/drivers/net/wireless/airo.c
---- linux-2.6.32.43/drivers/net/wireless/airo.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/wireless/airo.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/wireless/airo.c linux-2.6.32.44/drivers/net/wireless/airo.c
+--- linux-2.6.32.44/drivers/net/wireless/airo.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/wireless/airo.c 2011-05-16 21:46:57.000000000 -0400
@@ -3003,6 +3003,8 @@ static void airo_process_scan_results (s
BSSListElement * loop_net;
BSSListElement * tmp_net;
@@ -35716,9 +35664,9 @@ diff -urNp linux-2.6.32.43/drivers/net/wireless/airo.c linux-2.6.32.43/drivers/n
/* Get stats out of the card */
clear_bit(JOB_WSTATS, &local->jobs);
if (local->power.event) {
-diff -urNp linux-2.6.32.43/drivers/net/wireless/ath/ath5k/debug.c linux-2.6.32.43/drivers/net/wireless/ath/ath5k/debug.c
---- linux-2.6.32.43/drivers/net/wireless/ath/ath5k/debug.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/wireless/ath/ath5k/debug.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/wireless/ath/ath5k/debug.c linux-2.6.32.44/drivers/net/wireless/ath/ath5k/debug.c
+--- linux-2.6.32.44/drivers/net/wireless/ath/ath5k/debug.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/wireless/ath/ath5k/debug.c 2011-05-16 21:46:57.000000000 -0400
@@ -205,6 +205,8 @@ static ssize_t read_file_beacon(struct f
unsigned int v;
u64 tsf;
@@ -35737,9 +35685,9 @@ diff -urNp linux-2.6.32.43/drivers/net/wireless/ath/ath5k/debug.c linux-2.6.32.4
len += snprintf(buf+len, sizeof(buf)-len,
"DEBUG LEVEL: 0x%08x\n\n", sc->debug.level);
-diff -urNp linux-2.6.32.43/drivers/net/wireless/ath/ath9k/debug.c linux-2.6.32.43/drivers/net/wireless/ath/ath9k/debug.c
---- linux-2.6.32.43/drivers/net/wireless/ath/ath9k/debug.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/wireless/ath/ath9k/debug.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/wireless/ath/ath9k/debug.c linux-2.6.32.44/drivers/net/wireless/ath/ath9k/debug.c
+--- linux-2.6.32.44/drivers/net/wireless/ath/ath9k/debug.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/wireless/ath/ath9k/debug.c 2011-05-16 21:46:57.000000000 -0400
@@ -220,6 +220,8 @@ static ssize_t read_file_interrupt(struc
char buf[512];
unsigned int len = 0;
@@ -35758,9 +35706,9 @@ diff -urNp linux-2.6.32.43/drivers/net/wireless/ath/ath9k/debug.c linux-2.6.32.4
len += snprintf(buf + len, sizeof(buf) - len,
"primary: %s (%s chan=%d ht=%d)\n",
wiphy_name(sc->pri_wiphy->hw->wiphy),
-diff -urNp linux-2.6.32.43/drivers/net/wireless/b43/debugfs.c linux-2.6.32.43/drivers/net/wireless/b43/debugfs.c
---- linux-2.6.32.43/drivers/net/wireless/b43/debugfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/wireless/b43/debugfs.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/wireless/b43/debugfs.c linux-2.6.32.44/drivers/net/wireless/b43/debugfs.c
+--- linux-2.6.32.44/drivers/net/wireless/b43/debugfs.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/wireless/b43/debugfs.c 2011-04-17 15:56:46.000000000 -0400
@@ -43,7 +43,7 @@ static struct dentry *rootdir;
struct b43_debugfs_fops {
ssize_t (*read)(struct b43_wldev *dev, char *buf, size_t bufsize);
@@ -35770,9 +35718,9 @@ diff -urNp linux-2.6.32.43/drivers/net/wireless/b43/debugfs.c linux-2.6.32.43/dr
/* Offset of struct b43_dfs_file in struct b43_dfsentry */
size_t file_struct_offset;
};
-diff -urNp linux-2.6.32.43/drivers/net/wireless/b43legacy/debugfs.c linux-2.6.32.43/drivers/net/wireless/b43legacy/debugfs.c
---- linux-2.6.32.43/drivers/net/wireless/b43legacy/debugfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/wireless/b43legacy/debugfs.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/wireless/b43legacy/debugfs.c linux-2.6.32.44/drivers/net/wireless/b43legacy/debugfs.c
+--- linux-2.6.32.44/drivers/net/wireless/b43legacy/debugfs.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/wireless/b43legacy/debugfs.c 2011-04-17 15:56:46.000000000 -0400
@@ -44,7 +44,7 @@ static struct dentry *rootdir;
struct b43legacy_debugfs_fops {
ssize_t (*read)(struct b43legacy_wldev *dev, char *buf, size_t bufsize);
@@ -35782,9 +35730,9 @@ diff -urNp linux-2.6.32.43/drivers/net/wireless/b43legacy/debugfs.c linux-2.6.32
/* Offset of struct b43legacy_dfs_file in struct b43legacy_dfsentry */
size_t file_struct_offset;
/* Take wl->irq_lock before calling read/write? */
-diff -urNp linux-2.6.32.43/drivers/net/wireless/ipw2x00/ipw2100.c linux-2.6.32.43/drivers/net/wireless/ipw2x00/ipw2100.c
---- linux-2.6.32.43/drivers/net/wireless/ipw2x00/ipw2100.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/wireless/ipw2x00/ipw2100.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/wireless/ipw2x00/ipw2100.c linux-2.6.32.44/drivers/net/wireless/ipw2x00/ipw2100.c
+--- linux-2.6.32.44/drivers/net/wireless/ipw2x00/ipw2100.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/wireless/ipw2x00/ipw2100.c 2011-05-16 21:46:57.000000000 -0400
@@ -2014,6 +2014,8 @@ static int ipw2100_set_essid(struct ipw2
int err;
DECLARE_SSID_BUF(ssid);
@@ -35803,9 +35751,9 @@ diff -urNp linux-2.6.32.43/drivers/net/wireless/ipw2x00/ipw2100.c linux-2.6.32.4
IPW_DEBUG_HC("WEP_KEY_INFO: index = %d, len = %d/%d\n",
idx, keylen, len);
-diff -urNp linux-2.6.32.43/drivers/net/wireless/ipw2x00/libipw_rx.c linux-2.6.32.43/drivers/net/wireless/ipw2x00/libipw_rx.c
---- linux-2.6.32.43/drivers/net/wireless/ipw2x00/libipw_rx.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/wireless/ipw2x00/libipw_rx.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/wireless/ipw2x00/libipw_rx.c linux-2.6.32.44/drivers/net/wireless/ipw2x00/libipw_rx.c
+--- linux-2.6.32.44/drivers/net/wireless/ipw2x00/libipw_rx.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/wireless/ipw2x00/libipw_rx.c 2011-05-16 21:46:57.000000000 -0400
@@ -1566,6 +1566,8 @@ static void libipw_process_probe_respons
unsigned long flags;
DECLARE_SSID_BUF(ssid);
@@ -35815,9 +35763,9 @@ diff -urNp linux-2.6.32.43/drivers/net/wireless/ipw2x00/libipw_rx.c linux-2.6.32
LIBIPW_DEBUG_SCAN("'%s' (%pM"
"): %c%c%c%c %c%c%c%c-%c%c%c%c %c%c%c%c\n",
print_ssid(ssid, info_element->data, info_element->len),
-diff -urNp linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-1000.c linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-1000.c
---- linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-1000.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-1000.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-1000.c linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-1000.c
+--- linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-1000.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-1000.c 2011-04-17 15:56:46.000000000 -0400
@@ -137,7 +137,7 @@ static struct iwl_lib_ops iwl1000_lib =
},
};
@@ -35827,9 +35775,9 @@ diff -urNp linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-1000.c linux-2.6.32.
.ucode = &iwl5000_ucode,
.lib = &iwl1000_lib,
.hcmd = &iwl5000_hcmd,
-diff -urNp linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl3945-base.c linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl3945-base.c
---- linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl3945-base.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl3945-base.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl3945-base.c linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl3945-base.c
+--- linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl3945-base.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl3945-base.c 2011-08-05 20:33:55.000000000 -0400
@@ -3927,7 +3927,9 @@ static int iwl3945_pci_probe(struct pci_
*/
if (iwl3945_mod_params.disable_hw_scan) {
@@ -35841,9 +35789,9 @@ diff -urNp linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl3945-base.c linux-2.6
}
-diff -urNp linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-3945.c linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-3945.c
---- linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-3945.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-3945.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-3945.c linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-3945.c
+--- linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-3945.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-3945.c 2011-04-17 15:56:46.000000000 -0400
@@ -2874,7 +2874,7 @@ static struct iwl_hcmd_utils_ops iwl3945
.build_addsta_hcmd = iwl3945_build_addsta_hcmd,
};
@@ -35853,9 +35801,9 @@ diff -urNp linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-3945.c linux-2.6.32.
.ucode = &iwl3945_ucode,
.lib = &iwl3945_lib,
.hcmd = &iwl3945_hcmd,
-diff -urNp linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-4965.c linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-4965.c
---- linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-4965.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-4965.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-4965.c linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-4965.c
+--- linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-4965.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-4965.c 2011-04-17 15:56:46.000000000 -0400
@@ -2345,7 +2345,7 @@ static struct iwl_lib_ops iwl4965_lib =
},
};
@@ -35865,9 +35813,9 @@ diff -urNp linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-4965.c linux-2.6.32.
.ucode = &iwl4965_ucode,
.lib = &iwl4965_lib,
.hcmd = &iwl4965_hcmd,
-diff -urNp linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-5000.c linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-5000.c
---- linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-5000.c 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-5000.c 2011-06-25 12:56:37.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-5000.c linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-5000.c
+--- linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-5000.c 2011-06-25 12:55:34.000000000 -0400
++++ linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-5000.c 2011-06-25 12:56:37.000000000 -0400
@@ -1633,14 +1633,14 @@ static struct iwl_lib_ops iwl5150_lib =
},
};
@@ -35885,9 +35833,9 @@ diff -urNp linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-5000.c linux-2.6.32.
.ucode = &iwl5000_ucode,
.lib = &iwl5150_lib,
.hcmd = &iwl5000_hcmd,
-diff -urNp linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-6000.c linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-6000.c
---- linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-6000.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-6000.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-6000.c linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-6000.c
+--- linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-6000.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-6000.c 2011-04-17 15:56:46.000000000 -0400
@@ -146,7 +146,7 @@ static struct iwl_hcmd_utils_ops iwl6000
.calc_rssi = iwl5000_calc_rssi,
};
@@ -35897,9 +35845,9 @@ diff -urNp linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-6000.c linux-2.6.32.
.ucode = &iwl5000_ucode,
.lib = &iwl6000_lib,
.hcmd = &iwl5000_hcmd,
-diff -urNp linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-agn.c linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-agn.c
---- linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-agn.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-agn.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-agn.c linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-agn.c
+--- linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-agn.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-agn.c 2011-08-05 20:33:55.000000000 -0400
@@ -2911,7 +2911,9 @@ static int iwl_pci_probe(struct pci_dev
if (iwl_debug_level & IWL_DL_INFO)
dev_printk(KERN_DEBUG, &(pdev->dev),
@@ -35911,9 +35859,9 @@ diff -urNp linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-agn.c linux-2.6.32.4
}
hw = iwl_alloc_all(cfg, &iwl_hw_ops);
-diff -urNp linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-agn-rs.c linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
---- linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-agn-rs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-agn-rs.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-agn-rs.c linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+--- linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-agn-rs.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-agn-rs.c 2011-05-16 21:46:57.000000000 -0400
@@ -857,6 +857,8 @@ static void rs_tx_status(void *priv_r, s
u8 active_index = 0;
s32 tpt = 0;
@@ -35932,9 +35880,9 @@ diff -urNp linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-agn-rs.c linux-2.6.3
/* Override starting rate (index 0) if needed for debug purposes */
rs_dbgfs_set_mcs(lq_sta, &new_rate, index);
-diff -urNp linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-debugfs.c linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-debugfs.c
---- linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-debugfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-debugfs.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-debugfs.c linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-debugfs.c
+--- linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-debugfs.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-debugfs.c 2011-05-16 21:46:57.000000000 -0400
@@ -524,6 +524,8 @@ static ssize_t iwl_dbgfs_status_read(str
int pos = 0;
const size_t bufsz = sizeof(buf);
@@ -35953,9 +35901,9 @@ diff -urNp linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-debugfs.c linux-2.6.
for (i = 0; i < AC_NUM; i++) {
pos += scnprintf(buf + pos, bufsz - pos,
"\tcw_min\tcw_max\taifsn\ttxop\n");
-diff -urNp linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-debug.h linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-debug.h
---- linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-debug.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-debug.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-debug.h linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-debug.h
+--- linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-debug.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-debug.h 2011-04-17 15:56:46.000000000 -0400
@@ -118,8 +118,8 @@ void iwl_dbgfs_unregister(struct iwl_pri
#endif
@@ -35967,9 +35915,9 @@ diff -urNp linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-debug.h linux-2.6.32
static inline void iwl_print_hex_dump(struct iwl_priv *priv, int level,
void *p, u32 len)
{}
-diff -urNp linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-dev.h linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-dev.h
---- linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-dev.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-dev.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-dev.h linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-dev.h
+--- linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-dev.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/wireless/iwlwifi/iwl-dev.h 2011-04-17 15:56:46.000000000 -0400
@@ -68,7 +68,7 @@ struct iwl_tx_queue;
/* shared structures from iwl-5000.c */
@@ -35979,9 +35927,9 @@ diff -urNp linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-dev.h linux-2.6.32.4
extern struct iwl_ucode_ops iwl5000_ucode;
extern struct iwl_lib_ops iwl5000_lib;
extern struct iwl_hcmd_ops iwl5000_hcmd;
-diff -urNp linux-2.6.32.43/drivers/net/wireless/iwmc3200wifi/debugfs.c linux-2.6.32.43/drivers/net/wireless/iwmc3200wifi/debugfs.c
---- linux-2.6.32.43/drivers/net/wireless/iwmc3200wifi/debugfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/wireless/iwmc3200wifi/debugfs.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/wireless/iwmc3200wifi/debugfs.c linux-2.6.32.44/drivers/net/wireless/iwmc3200wifi/debugfs.c
+--- linux-2.6.32.44/drivers/net/wireless/iwmc3200wifi/debugfs.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/wireless/iwmc3200wifi/debugfs.c 2011-05-16 21:46:57.000000000 -0400
@@ -299,6 +299,8 @@ static ssize_t iwm_debugfs_fw_err_read(s
int buf_len = 512;
size_t len = 0;
@@ -35991,9 +35939,9 @@ diff -urNp linux-2.6.32.43/drivers/net/wireless/iwmc3200wifi/debugfs.c linux-2.6
if (*ppos != 0)
return 0;
if (count < sizeof(buf))
-diff -urNp linux-2.6.32.43/drivers/net/wireless/libertas/debugfs.c linux-2.6.32.43/drivers/net/wireless/libertas/debugfs.c
---- linux-2.6.32.43/drivers/net/wireless/libertas/debugfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/wireless/libertas/debugfs.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/wireless/libertas/debugfs.c linux-2.6.32.44/drivers/net/wireless/libertas/debugfs.c
+--- linux-2.6.32.44/drivers/net/wireless/libertas/debugfs.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/wireless/libertas/debugfs.c 2011-04-17 15:56:46.000000000 -0400
@@ -708,7 +708,7 @@ out_unlock:
struct lbs_debugfs_files {
const char *name;
@@ -36003,9 +35951,9 @@ diff -urNp linux-2.6.32.43/drivers/net/wireless/libertas/debugfs.c linux-2.6.32.
};
static const struct lbs_debugfs_files debugfs_files[] = {
-diff -urNp linux-2.6.32.43/drivers/net/wireless/rndis_wlan.c linux-2.6.32.43/drivers/net/wireless/rndis_wlan.c
---- linux-2.6.32.43/drivers/net/wireless/rndis_wlan.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/net/wireless/rndis_wlan.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/net/wireless/rndis_wlan.c linux-2.6.32.44/drivers/net/wireless/rndis_wlan.c
+--- linux-2.6.32.44/drivers/net/wireless/rndis_wlan.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/net/wireless/rndis_wlan.c 2011-04-17 15:56:46.000000000 -0400
@@ -1176,7 +1176,7 @@ static int set_rts_threshold(struct usbn
devdbg(usbdev, "set_rts_threshold %i", rts_threshold);
@@ -36015,9 +35963,9 @@ diff -urNp linux-2.6.32.43/drivers/net/wireless/rndis_wlan.c linux-2.6.32.43/dri
rts_threshold = 2347;
tmp = cpu_to_le32(rts_threshold);
-diff -urNp linux-2.6.32.43/drivers/oprofile/buffer_sync.c linux-2.6.32.43/drivers/oprofile/buffer_sync.c
---- linux-2.6.32.43/drivers/oprofile/buffer_sync.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/oprofile/buffer_sync.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/oprofile/buffer_sync.c linux-2.6.32.44/drivers/oprofile/buffer_sync.c
+--- linux-2.6.32.44/drivers/oprofile/buffer_sync.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/oprofile/buffer_sync.c 2011-04-17 15:56:46.000000000 -0400
@@ -341,7 +341,7 @@ static void add_data(struct op_entry *en
if (cookie == NO_COOKIE)
offset = pc;
@@ -36053,9 +36001,9 @@ diff -urNp linux-2.6.32.43/drivers/oprofile/buffer_sync.c linux-2.6.32.43/driver
}
}
release_mm(mm);
-diff -urNp linux-2.6.32.43/drivers/oprofile/event_buffer.c linux-2.6.32.43/drivers/oprofile/event_buffer.c
---- linux-2.6.32.43/drivers/oprofile/event_buffer.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/oprofile/event_buffer.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/oprofile/event_buffer.c linux-2.6.32.44/drivers/oprofile/event_buffer.c
+--- linux-2.6.32.44/drivers/oprofile/event_buffer.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/oprofile/event_buffer.c 2011-04-17 15:56:46.000000000 -0400
@@ -53,7 +53,7 @@ void add_event_entry(unsigned long value
}
@@ -36065,9 +36013,9 @@ diff -urNp linux-2.6.32.43/drivers/oprofile/event_buffer.c linux-2.6.32.43/drive
return;
}
-diff -urNp linux-2.6.32.43/drivers/oprofile/oprof.c linux-2.6.32.43/drivers/oprofile/oprof.c
---- linux-2.6.32.43/drivers/oprofile/oprof.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/oprofile/oprof.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/oprofile/oprof.c linux-2.6.32.44/drivers/oprofile/oprof.c
+--- linux-2.6.32.44/drivers/oprofile/oprof.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/oprofile/oprof.c 2011-04-17 15:56:46.000000000 -0400
@@ -110,7 +110,7 @@ static void switch_worker(struct work_st
if (oprofile_ops.switch_events())
return;
@@ -36077,9 +36025,9 @@ diff -urNp linux-2.6.32.43/drivers/oprofile/oprof.c linux-2.6.32.43/drivers/opro
start_switch_worker();
}
-diff -urNp linux-2.6.32.43/drivers/oprofile/oprofilefs.c linux-2.6.32.43/drivers/oprofile/oprofilefs.c
---- linux-2.6.32.43/drivers/oprofile/oprofilefs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/oprofile/oprofilefs.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/oprofile/oprofilefs.c linux-2.6.32.44/drivers/oprofile/oprofilefs.c
+--- linux-2.6.32.44/drivers/oprofile/oprofilefs.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/oprofile/oprofilefs.c 2011-04-17 15:56:46.000000000 -0400
@@ -187,7 +187,7 @@ static const struct file_operations atom
@@ -36089,9 +36037,9 @@ diff -urNp linux-2.6.32.43/drivers/oprofile/oprofilefs.c linux-2.6.32.43/drivers
{
struct dentry *d = __oprofilefs_create_file(sb, root, name,
&atomic_ro_fops, 0444);
-diff -urNp linux-2.6.32.43/drivers/oprofile/oprofile_stats.c linux-2.6.32.43/drivers/oprofile/oprofile_stats.c
---- linux-2.6.32.43/drivers/oprofile/oprofile_stats.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/oprofile/oprofile_stats.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/oprofile/oprofile_stats.c linux-2.6.32.44/drivers/oprofile/oprofile_stats.c
+--- linux-2.6.32.44/drivers/oprofile/oprofile_stats.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/oprofile/oprofile_stats.c 2011-04-17 15:56:46.000000000 -0400
@@ -30,11 +30,11 @@ void oprofile_reset_stats(void)
cpu_buf->sample_invalid_eip = 0;
}
@@ -36109,9 +36057,9 @@ diff -urNp linux-2.6.32.43/drivers/oprofile/oprofile_stats.c linux-2.6.32.43/dri
}
-diff -urNp linux-2.6.32.43/drivers/oprofile/oprofile_stats.h linux-2.6.32.43/drivers/oprofile/oprofile_stats.h
---- linux-2.6.32.43/drivers/oprofile/oprofile_stats.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/oprofile/oprofile_stats.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/oprofile/oprofile_stats.h linux-2.6.32.44/drivers/oprofile/oprofile_stats.h
+--- linux-2.6.32.44/drivers/oprofile/oprofile_stats.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/oprofile/oprofile_stats.h 2011-04-17 15:56:46.000000000 -0400
@@ -13,11 +13,11 @@
#include <asm/atomic.h>
@@ -36129,9 +36077,9 @@ diff -urNp linux-2.6.32.43/drivers/oprofile/oprofile_stats.h linux-2.6.32.43/dri
};
extern struct oprofile_stat_struct oprofile_stats;
-diff -urNp linux-2.6.32.43/drivers/parisc/pdc_stable.c linux-2.6.32.43/drivers/parisc/pdc_stable.c
---- linux-2.6.32.43/drivers/parisc/pdc_stable.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/parisc/pdc_stable.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/parisc/pdc_stable.c linux-2.6.32.44/drivers/parisc/pdc_stable.c
+--- linux-2.6.32.44/drivers/parisc/pdc_stable.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/parisc/pdc_stable.c 2011-04-17 15:56:46.000000000 -0400
@@ -481,7 +481,7 @@ pdcspath_attr_store(struct kobject *kobj
return ret;
}
@@ -36141,9 +36089,9 @@ diff -urNp linux-2.6.32.43/drivers/parisc/pdc_stable.c linux-2.6.32.43/drivers/p
.show = pdcspath_attr_show,
.store = pdcspath_attr_store,
};
-diff -urNp linux-2.6.32.43/drivers/parport/procfs.c linux-2.6.32.43/drivers/parport/procfs.c
---- linux-2.6.32.43/drivers/parport/procfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/parport/procfs.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/parport/procfs.c linux-2.6.32.44/drivers/parport/procfs.c
+--- linux-2.6.32.44/drivers/parport/procfs.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/parport/procfs.c 2011-04-17 15:56:46.000000000 -0400
@@ -64,7 +64,7 @@ static int do_active_device(ctl_table *t
*ppos += len;
@@ -36162,9 +36110,9 @@ diff -urNp linux-2.6.32.43/drivers/parport/procfs.c linux-2.6.32.43/drivers/parp
}
#endif /* IEEE1284.3 support. */
-diff -urNp linux-2.6.32.43/drivers/pci/hotplug/acpiphp_glue.c linux-2.6.32.43/drivers/pci/hotplug/acpiphp_glue.c
---- linux-2.6.32.43/drivers/pci/hotplug/acpiphp_glue.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/pci/hotplug/acpiphp_glue.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/pci/hotplug/acpiphp_glue.c linux-2.6.32.44/drivers/pci/hotplug/acpiphp_glue.c
+--- linux-2.6.32.44/drivers/pci/hotplug/acpiphp_glue.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/pci/hotplug/acpiphp_glue.c 2011-04-17 15:56:46.000000000 -0400
@@ -111,7 +111,7 @@ static int post_dock_fixups(struct notif
}
@@ -36174,9 +36122,9 @@ diff -urNp linux-2.6.32.43/drivers/pci/hotplug/acpiphp_glue.c linux-2.6.32.43/dr
.handler = handle_hotplug_event_func,
};
-diff -urNp linux-2.6.32.43/drivers/pci/hotplug/cpci_hotplug.h linux-2.6.32.43/drivers/pci/hotplug/cpci_hotplug.h
---- linux-2.6.32.43/drivers/pci/hotplug/cpci_hotplug.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/pci/hotplug/cpci_hotplug.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/pci/hotplug/cpci_hotplug.h linux-2.6.32.44/drivers/pci/hotplug/cpci_hotplug.h
+--- linux-2.6.32.44/drivers/pci/hotplug/cpci_hotplug.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/pci/hotplug/cpci_hotplug.h 2011-08-05 20:33:55.000000000 -0400
@@ -59,7 +59,7 @@ struct cpci_hp_controller_ops {
int (*hardware_test) (struct slot* slot, u32 value);
u8 (*get_power) (struct slot* slot);
@@ -36186,9 +36134,9 @@ diff -urNp linux-2.6.32.43/drivers/pci/hotplug/cpci_hotplug.h linux-2.6.32.43/dr
struct cpci_hp_controller {
unsigned int irq;
-diff -urNp linux-2.6.32.43/drivers/pci/hotplug/cpqphp_nvram.c linux-2.6.32.43/drivers/pci/hotplug/cpqphp_nvram.c
---- linux-2.6.32.43/drivers/pci/hotplug/cpqphp_nvram.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/pci/hotplug/cpqphp_nvram.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/pci/hotplug/cpqphp_nvram.c linux-2.6.32.44/drivers/pci/hotplug/cpqphp_nvram.c
+--- linux-2.6.32.44/drivers/pci/hotplug/cpqphp_nvram.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/pci/hotplug/cpqphp_nvram.c 2011-04-17 15:56:46.000000000 -0400
@@ -428,9 +428,13 @@ static u32 store_HRT (void __iomem *rom_
void compaq_nvram_init (void __iomem *rom_start)
@@ -36203,9 +36151,9 @@ diff -urNp linux-2.6.32.43/drivers/pci/hotplug/cpqphp_nvram.c linux-2.6.32.43/dr
dbg("int15 entry = %p\n", compaq_int15_entry_point);
/* initialize our int15 lock */
-diff -urNp linux-2.6.32.43/drivers/pci/hotplug/fakephp.c linux-2.6.32.43/drivers/pci/hotplug/fakephp.c
---- linux-2.6.32.43/drivers/pci/hotplug/fakephp.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/pci/hotplug/fakephp.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/pci/hotplug/fakephp.c linux-2.6.32.44/drivers/pci/hotplug/fakephp.c
+--- linux-2.6.32.44/drivers/pci/hotplug/fakephp.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/pci/hotplug/fakephp.c 2011-04-17 15:56:46.000000000 -0400
@@ -73,7 +73,7 @@ static void legacy_release(struct kobjec
}
@@ -36215,9 +36163,9 @@ diff -urNp linux-2.6.32.43/drivers/pci/hotplug/fakephp.c linux-2.6.32.43/drivers
.store = legacy_store, .show = legacy_show
},
.release = &legacy_release,
-diff -urNp linux-2.6.32.43/drivers/pci/intel-iommu.c linux-2.6.32.43/drivers/pci/intel-iommu.c
---- linux-2.6.32.43/drivers/pci/intel-iommu.c 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.43/drivers/pci/intel-iommu.c 2011-05-10 22:12:33.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/pci/intel-iommu.c linux-2.6.32.44/drivers/pci/intel-iommu.c
+--- linux-2.6.32.44/drivers/pci/intel-iommu.c 2011-05-10 22:12:01.000000000 -0400
++++ linux-2.6.32.44/drivers/pci/intel-iommu.c 2011-05-10 22:12:33.000000000 -0400
@@ -2643,7 +2643,7 @@ error:
return 0;
}
@@ -36287,9 +36235,9 @@ diff -urNp linux-2.6.32.43/drivers/pci/intel-iommu.c linux-2.6.32.43/drivers/pci
.alloc_coherent = intel_alloc_coherent,
.free_coherent = intel_free_coherent,
.map_sg = intel_map_sg,
-diff -urNp linux-2.6.32.43/drivers/pci/pcie/aspm.c linux-2.6.32.43/drivers/pci/pcie/aspm.c
---- linux-2.6.32.43/drivers/pci/pcie/aspm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/pci/pcie/aspm.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/pci/pcie/aspm.c linux-2.6.32.44/drivers/pci/pcie/aspm.c
+--- linux-2.6.32.44/drivers/pci/pcie/aspm.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/pci/pcie/aspm.c 2011-04-17 15:56:46.000000000 -0400
@@ -27,9 +27,9 @@
#define MODULE_PARAM_PREFIX "pcie_aspm."
@@ -36303,9 +36251,9 @@ diff -urNp linux-2.6.32.43/drivers/pci/pcie/aspm.c linux-2.6.32.43/drivers/pci/p
#define ASPM_STATE_L0S (ASPM_STATE_L0S_UP | ASPM_STATE_L0S_DW)
#define ASPM_STATE_ALL (ASPM_STATE_L0S | ASPM_STATE_L1)
-diff -urNp linux-2.6.32.43/drivers/pci/probe.c linux-2.6.32.43/drivers/pci/probe.c
---- linux-2.6.32.43/drivers/pci/probe.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/pci/probe.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/pci/probe.c linux-2.6.32.44/drivers/pci/probe.c
+--- linux-2.6.32.44/drivers/pci/probe.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/pci/probe.c 2011-04-17 15:56:46.000000000 -0400
@@ -62,14 +62,14 @@ static ssize_t pci_bus_show_cpuaffinity(
return ret;
}
@@ -36323,9 +36271,9 @@ diff -urNp linux-2.6.32.43/drivers/pci/probe.c linux-2.6.32.43/drivers/pci/probe
struct device_attribute *attr,
char *buf)
{
-diff -urNp linux-2.6.32.43/drivers/pci/proc.c linux-2.6.32.43/drivers/pci/proc.c
---- linux-2.6.32.43/drivers/pci/proc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/pci/proc.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/pci/proc.c linux-2.6.32.44/drivers/pci/proc.c
+--- linux-2.6.32.44/drivers/pci/proc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/pci/proc.c 2011-04-17 15:56:46.000000000 -0400
@@ -480,7 +480,16 @@ static const struct file_operations proc
static int __init pci_proc_init(void)
{
@@ -36343,9 +36291,9 @@ diff -urNp linux-2.6.32.43/drivers/pci/proc.c linux-2.6.32.43/drivers/pci/proc.c
proc_create("devices", 0, proc_bus_pci_dir,
&proc_bus_pci_dev_operations);
proc_initialized = 1;
-diff -urNp linux-2.6.32.43/drivers/pci/slot.c linux-2.6.32.43/drivers/pci/slot.c
---- linux-2.6.32.43/drivers/pci/slot.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/pci/slot.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/pci/slot.c linux-2.6.32.44/drivers/pci/slot.c
+--- linux-2.6.32.44/drivers/pci/slot.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/pci/slot.c 2011-04-17 15:56:46.000000000 -0400
@@ -29,7 +29,7 @@ static ssize_t pci_slot_attr_store(struc
return attribute->store ? attribute->store(slot, buf, len) : -EIO;
}
@@ -36355,9 +36303,9 @@ diff -urNp linux-2.6.32.43/drivers/pci/slot.c linux-2.6.32.43/drivers/pci/slot.c
.show = pci_slot_attr_show,
.store = pci_slot_attr_store,
};
-diff -urNp linux-2.6.32.43/drivers/pcmcia/pcmcia_ioctl.c linux-2.6.32.43/drivers/pcmcia/pcmcia_ioctl.c
---- linux-2.6.32.43/drivers/pcmcia/pcmcia_ioctl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/pcmcia/pcmcia_ioctl.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/pcmcia/pcmcia_ioctl.c linux-2.6.32.44/drivers/pcmcia/pcmcia_ioctl.c
+--- linux-2.6.32.44/drivers/pcmcia/pcmcia_ioctl.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/pcmcia/pcmcia_ioctl.c 2011-04-17 15:56:46.000000000 -0400
@@ -819,7 +819,7 @@ static int ds_ioctl(struct inode * inode
return -EFAULT;
}
@@ -36367,9 +36315,9 @@ diff -urNp linux-2.6.32.43/drivers/pcmcia/pcmcia_ioctl.c linux-2.6.32.43/drivers
if (!buf)
return -ENOMEM;
-diff -urNp linux-2.6.32.43/drivers/platform/x86/acer-wmi.c linux-2.6.32.43/drivers/platform/x86/acer-wmi.c
---- linux-2.6.32.43/drivers/platform/x86/acer-wmi.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/platform/x86/acer-wmi.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/platform/x86/acer-wmi.c linux-2.6.32.44/drivers/platform/x86/acer-wmi.c
+--- linux-2.6.32.44/drivers/platform/x86/acer-wmi.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/platform/x86/acer-wmi.c 2011-04-17 15:56:46.000000000 -0400
@@ -918,7 +918,7 @@ static int update_bl_status(struct backl
return 0;
}
@@ -36379,9 +36327,9 @@ diff -urNp linux-2.6.32.43/drivers/platform/x86/acer-wmi.c linux-2.6.32.43/drive
.get_brightness = read_brightness,
.update_status = update_bl_status,
};
-diff -urNp linux-2.6.32.43/drivers/platform/x86/asus_acpi.c linux-2.6.32.43/drivers/platform/x86/asus_acpi.c
---- linux-2.6.32.43/drivers/platform/x86/asus_acpi.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/platform/x86/asus_acpi.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/platform/x86/asus_acpi.c linux-2.6.32.44/drivers/platform/x86/asus_acpi.c
+--- linux-2.6.32.44/drivers/platform/x86/asus_acpi.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/platform/x86/asus_acpi.c 2011-04-17 15:56:46.000000000 -0400
@@ -1396,7 +1396,7 @@ static int asus_hotk_remove(struct acpi_
return 0;
}
@@ -36391,9 +36339,9 @@ diff -urNp linux-2.6.32.43/drivers/platform/x86/asus_acpi.c linux-2.6.32.43/driv
.get_brightness = read_brightness,
.update_status = set_brightness_status,
};
-diff -urNp linux-2.6.32.43/drivers/platform/x86/asus-laptop.c linux-2.6.32.43/drivers/platform/x86/asus-laptop.c
---- linux-2.6.32.43/drivers/platform/x86/asus-laptop.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/platform/x86/asus-laptop.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/platform/x86/asus-laptop.c linux-2.6.32.44/drivers/platform/x86/asus-laptop.c
+--- linux-2.6.32.44/drivers/platform/x86/asus-laptop.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/platform/x86/asus-laptop.c 2011-04-17 15:56:46.000000000 -0400
@@ -250,7 +250,7 @@ static struct backlight_device *asus_bac
*/
static int read_brightness(struct backlight_device *bd);
@@ -36403,9 +36351,9 @@ diff -urNp linux-2.6.32.43/drivers/platform/x86/asus-laptop.c linux-2.6.32.43/dr
.get_brightness = read_brightness,
.update_status = update_bl_status,
};
-diff -urNp linux-2.6.32.43/drivers/platform/x86/compal-laptop.c linux-2.6.32.43/drivers/platform/x86/compal-laptop.c
---- linux-2.6.32.43/drivers/platform/x86/compal-laptop.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/platform/x86/compal-laptop.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/platform/x86/compal-laptop.c linux-2.6.32.44/drivers/platform/x86/compal-laptop.c
+--- linux-2.6.32.44/drivers/platform/x86/compal-laptop.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/platform/x86/compal-laptop.c 2011-04-17 15:56:46.000000000 -0400
@@ -163,7 +163,7 @@ static int bl_update_status(struct backl
return set_lcd_level(b->props.brightness);
}
@@ -36415,9 +36363,9 @@ diff -urNp linux-2.6.32.43/drivers/platform/x86/compal-laptop.c linux-2.6.32.43/
.get_brightness = bl_get_brightness,
.update_status = bl_update_status,
};
-diff -urNp linux-2.6.32.43/drivers/platform/x86/dell-laptop.c linux-2.6.32.43/drivers/platform/x86/dell-laptop.c
---- linux-2.6.32.43/drivers/platform/x86/dell-laptop.c 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.43/drivers/platform/x86/dell-laptop.c 2011-05-10 22:12:33.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/platform/x86/dell-laptop.c linux-2.6.32.44/drivers/platform/x86/dell-laptop.c
+--- linux-2.6.32.44/drivers/platform/x86/dell-laptop.c 2011-05-10 22:12:01.000000000 -0400
++++ linux-2.6.32.44/drivers/platform/x86/dell-laptop.c 2011-05-10 22:12:33.000000000 -0400
@@ -318,7 +318,7 @@ static int dell_get_intensity(struct bac
return buffer.output[1];
}
@@ -36427,9 +36375,9 @@ diff -urNp linux-2.6.32.43/drivers/platform/x86/dell-laptop.c linux-2.6.32.43/dr
.get_brightness = dell_get_intensity,
.update_status = dell_send_intensity,
};
-diff -urNp linux-2.6.32.43/drivers/platform/x86/eeepc-laptop.c linux-2.6.32.43/drivers/platform/x86/eeepc-laptop.c
---- linux-2.6.32.43/drivers/platform/x86/eeepc-laptop.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/platform/x86/eeepc-laptop.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/platform/x86/eeepc-laptop.c linux-2.6.32.44/drivers/platform/x86/eeepc-laptop.c
+--- linux-2.6.32.44/drivers/platform/x86/eeepc-laptop.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/platform/x86/eeepc-laptop.c 2011-04-17 15:56:46.000000000 -0400
@@ -245,7 +245,7 @@ static struct device *eeepc_hwmon_device
*/
static int read_brightness(struct backlight_device *bd);
@@ -36439,9 +36387,9 @@ diff -urNp linux-2.6.32.43/drivers/platform/x86/eeepc-laptop.c linux-2.6.32.43/d
.get_brightness = read_brightness,
.update_status = update_bl_status,
};
-diff -urNp linux-2.6.32.43/drivers/platform/x86/fujitsu-laptop.c linux-2.6.32.43/drivers/platform/x86/fujitsu-laptop.c
---- linux-2.6.32.43/drivers/platform/x86/fujitsu-laptop.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/platform/x86/fujitsu-laptop.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/platform/x86/fujitsu-laptop.c linux-2.6.32.44/drivers/platform/x86/fujitsu-laptop.c
+--- linux-2.6.32.44/drivers/platform/x86/fujitsu-laptop.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/platform/x86/fujitsu-laptop.c 2011-04-17 15:56:46.000000000 -0400
@@ -436,7 +436,7 @@ static int bl_update_status(struct backl
return ret;
}
@@ -36451,9 +36399,9 @@ diff -urNp linux-2.6.32.43/drivers/platform/x86/fujitsu-laptop.c linux-2.6.32.43
.get_brightness = bl_get_brightness,
.update_status = bl_update_status,
};
-diff -urNp linux-2.6.32.43/drivers/platform/x86/msi-laptop.c linux-2.6.32.43/drivers/platform/x86/msi-laptop.c
---- linux-2.6.32.43/drivers/platform/x86/msi-laptop.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/platform/x86/msi-laptop.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/platform/x86/msi-laptop.c linux-2.6.32.44/drivers/platform/x86/msi-laptop.c
+--- linux-2.6.32.44/drivers/platform/x86/msi-laptop.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/platform/x86/msi-laptop.c 2011-04-17 15:56:46.000000000 -0400
@@ -161,7 +161,7 @@ static int bl_update_status(struct backl
return set_lcd_level(b->props.brightness);
}
@@ -36463,9 +36411,9 @@ diff -urNp linux-2.6.32.43/drivers/platform/x86/msi-laptop.c linux-2.6.32.43/dri
.get_brightness = bl_get_brightness,
.update_status = bl_update_status,
};
-diff -urNp linux-2.6.32.43/drivers/platform/x86/panasonic-laptop.c linux-2.6.32.43/drivers/platform/x86/panasonic-laptop.c
---- linux-2.6.32.43/drivers/platform/x86/panasonic-laptop.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/platform/x86/panasonic-laptop.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/platform/x86/panasonic-laptop.c linux-2.6.32.44/drivers/platform/x86/panasonic-laptop.c
+--- linux-2.6.32.44/drivers/platform/x86/panasonic-laptop.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/platform/x86/panasonic-laptop.c 2011-04-17 15:56:46.000000000 -0400
@@ -352,7 +352,7 @@ static int bl_set_status(struct backligh
return acpi_pcc_write_sset(pcc, SINF_DC_CUR_BRIGHT, bright);
}
@@ -36475,9 +36423,9 @@ diff -urNp linux-2.6.32.43/drivers/platform/x86/panasonic-laptop.c linux-2.6.32.
.get_brightness = bl_get,
.update_status = bl_set_status,
};
-diff -urNp linux-2.6.32.43/drivers/platform/x86/sony-laptop.c linux-2.6.32.43/drivers/platform/x86/sony-laptop.c
---- linux-2.6.32.43/drivers/platform/x86/sony-laptop.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/platform/x86/sony-laptop.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/platform/x86/sony-laptop.c linux-2.6.32.44/drivers/platform/x86/sony-laptop.c
+--- linux-2.6.32.44/drivers/platform/x86/sony-laptop.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/platform/x86/sony-laptop.c 2011-04-17 15:56:46.000000000 -0400
@@ -850,7 +850,7 @@ static int sony_backlight_get_brightness
}
@@ -36487,9 +36435,9 @@ diff -urNp linux-2.6.32.43/drivers/platform/x86/sony-laptop.c linux-2.6.32.43/dr
.update_status = sony_backlight_update_status,
.get_brightness = sony_backlight_get_brightness,
};
-diff -urNp linux-2.6.32.43/drivers/platform/x86/thinkpad_acpi.c linux-2.6.32.43/drivers/platform/x86/thinkpad_acpi.c
---- linux-2.6.32.43/drivers/platform/x86/thinkpad_acpi.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/platform/x86/thinkpad_acpi.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/platform/x86/thinkpad_acpi.c linux-2.6.32.44/drivers/platform/x86/thinkpad_acpi.c
+--- linux-2.6.32.44/drivers/platform/x86/thinkpad_acpi.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/platform/x86/thinkpad_acpi.c 2011-08-05 20:33:55.000000000 -0400
@@ -2137,7 +2137,7 @@ static int hotkey_mask_get(void)
return 0;
}
@@ -36508,9 +36456,9 @@ diff -urNp linux-2.6.32.43/drivers/platform/x86/thinkpad_acpi.c linux-2.6.32.43/
.get_brightness = brightness_get,
.update_status = brightness_update_status,
};
-diff -urNp linux-2.6.32.43/drivers/platform/x86/toshiba_acpi.c linux-2.6.32.43/drivers/platform/x86/toshiba_acpi.c
---- linux-2.6.32.43/drivers/platform/x86/toshiba_acpi.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/platform/x86/toshiba_acpi.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/platform/x86/toshiba_acpi.c linux-2.6.32.44/drivers/platform/x86/toshiba_acpi.c
+--- linux-2.6.32.44/drivers/platform/x86/toshiba_acpi.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/platform/x86/toshiba_acpi.c 2011-04-17 15:56:46.000000000 -0400
@@ -671,7 +671,7 @@ static acpi_status remove_device(void)
return AE_OK;
}
@@ -36520,9 +36468,9 @@ diff -urNp linux-2.6.32.43/drivers/platform/x86/toshiba_acpi.c linux-2.6.32.43/d
.get_brightness = get_lcd,
.update_status = set_lcd_status,
};
-diff -urNp linux-2.6.32.43/drivers/pnp/pnpbios/bioscalls.c linux-2.6.32.43/drivers/pnp/pnpbios/bioscalls.c
---- linux-2.6.32.43/drivers/pnp/pnpbios/bioscalls.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/pnp/pnpbios/bioscalls.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/pnp/pnpbios/bioscalls.c linux-2.6.32.44/drivers/pnp/pnpbios/bioscalls.c
+--- linux-2.6.32.44/drivers/pnp/pnpbios/bioscalls.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/pnp/pnpbios/bioscalls.c 2011-04-17 15:56:46.000000000 -0400
@@ -60,7 +60,7 @@ do { \
set_desc_limit(&gdt[(selname) >> 3], (size) - 1); \
} while(0)
@@ -36579,9 +36527,9 @@ diff -urNp linux-2.6.32.43/drivers/pnp/pnpbios/bioscalls.c linux-2.6.32.43/drive
+
+ pax_close_kernel();
}
-diff -urNp linux-2.6.32.43/drivers/pnp/resource.c linux-2.6.32.43/drivers/pnp/resource.c
---- linux-2.6.32.43/drivers/pnp/resource.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/pnp/resource.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/pnp/resource.c linux-2.6.32.44/drivers/pnp/resource.c
+--- linux-2.6.32.44/drivers/pnp/resource.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/pnp/resource.c 2011-04-17 15:56:46.000000000 -0400
@@ -355,7 +355,7 @@ int pnp_check_irq(struct pnp_dev *dev, s
return 1;
@@ -36600,9 +36548,9 @@ diff -urNp linux-2.6.32.43/drivers/pnp/resource.c linux-2.6.32.43/drivers/pnp/re
return 0;
/* check if the resource is reserved */
-diff -urNp linux-2.6.32.43/drivers/power/bq27x00_battery.c linux-2.6.32.43/drivers/power/bq27x00_battery.c
---- linux-2.6.32.43/drivers/power/bq27x00_battery.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/power/bq27x00_battery.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/power/bq27x00_battery.c linux-2.6.32.44/drivers/power/bq27x00_battery.c
+--- linux-2.6.32.44/drivers/power/bq27x00_battery.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/power/bq27x00_battery.c 2011-08-05 20:33:55.000000000 -0400
@@ -44,7 +44,7 @@ struct bq27x00_device_info;
struct bq27x00_access_methods {
int (*read)(u8 reg, int *rt_value, int b_single,
@@ -36612,9 +36560,9 @@ diff -urNp linux-2.6.32.43/drivers/power/bq27x00_battery.c linux-2.6.32.43/drive
struct bq27x00_device_info {
struct device *dev;
-diff -urNp linux-2.6.32.43/drivers/rtc/rtc-dev.c linux-2.6.32.43/drivers/rtc/rtc-dev.c
---- linux-2.6.32.43/drivers/rtc/rtc-dev.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/rtc/rtc-dev.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/rtc/rtc-dev.c linux-2.6.32.44/drivers/rtc/rtc-dev.c
+--- linux-2.6.32.44/drivers/rtc/rtc-dev.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/rtc/rtc-dev.c 2011-04-17 15:56:46.000000000 -0400
@@ -14,6 +14,7 @@
#include <linux/module.h>
#include <linux/rtc.h>
@@ -36632,9 +36580,9 @@ diff -urNp linux-2.6.32.43/drivers/rtc/rtc-dev.c linux-2.6.32.43/drivers/rtc/rtc
return rtc_set_time(rtc, &tm);
case RTC_PIE_ON:
-diff -urNp linux-2.6.32.43/drivers/s390/cio/qdio_perf.c linux-2.6.32.43/drivers/s390/cio/qdio_perf.c
---- linux-2.6.32.43/drivers/s390/cio/qdio_perf.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/s390/cio/qdio_perf.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/s390/cio/qdio_perf.c linux-2.6.32.44/drivers/s390/cio/qdio_perf.c
+--- linux-2.6.32.44/drivers/s390/cio/qdio_perf.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/s390/cio/qdio_perf.c 2011-04-17 15:56:46.000000000 -0400
@@ -31,51 +31,51 @@ static struct proc_dir_entry *qdio_perf_
static int qdio_perf_proc_show(struct seq_file *m, void *v)
{
@@ -36710,9 +36658,9 @@ diff -urNp linux-2.6.32.43/drivers/s390/cio/qdio_perf.c linux-2.6.32.43/drivers/
seq_printf(m, "\n");
return 0;
}
-diff -urNp linux-2.6.32.43/drivers/s390/cio/qdio_perf.h linux-2.6.32.43/drivers/s390/cio/qdio_perf.h
---- linux-2.6.32.43/drivers/s390/cio/qdio_perf.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/s390/cio/qdio_perf.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/s390/cio/qdio_perf.h linux-2.6.32.44/drivers/s390/cio/qdio_perf.h
+--- linux-2.6.32.44/drivers/s390/cio/qdio_perf.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/s390/cio/qdio_perf.h 2011-04-17 15:56:46.000000000 -0400
@@ -13,46 +13,46 @@
struct qdio_perf_stats {
@@ -36785,9 +36733,9 @@ diff -urNp linux-2.6.32.43/drivers/s390/cio/qdio_perf.h linux-2.6.32.43/drivers/
}
int qdio_setup_perf_stats(void);
-diff -urNp linux-2.6.32.43/drivers/scsi/aacraid/aacraid.h linux-2.6.32.43/drivers/scsi/aacraid/aacraid.h
---- linux-2.6.32.43/drivers/scsi/aacraid/aacraid.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/aacraid/aacraid.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/aacraid/aacraid.h linux-2.6.32.44/drivers/scsi/aacraid/aacraid.h
+--- linux-2.6.32.44/drivers/scsi/aacraid/aacraid.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/aacraid/aacraid.h 2011-08-05 20:33:55.000000000 -0400
@@ -471,7 +471,7 @@ struct adapter_ops
int (*adapter_scsi)(struct fib * fib, struct scsi_cmnd * cmd);
/* Administrative operations */
@@ -36797,9 +36745,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/aacraid/aacraid.h linux-2.6.32.43/driver
/*
* Define which interrupt handler needs to be installed
-diff -urNp linux-2.6.32.43/drivers/scsi/aacraid/commctrl.c linux-2.6.32.43/drivers/scsi/aacraid/commctrl.c
---- linux-2.6.32.43/drivers/scsi/aacraid/commctrl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/aacraid/commctrl.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/aacraid/commctrl.c linux-2.6.32.44/drivers/scsi/aacraid/commctrl.c
+--- linux-2.6.32.44/drivers/scsi/aacraid/commctrl.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/aacraid/commctrl.c 2011-05-16 21:46:57.000000000 -0400
@@ -481,6 +481,7 @@ static int aac_send_raw_srb(struct aac_d
u32 actual_fibsize64, actual_fibsize = 0;
int i;
@@ -36808,9 +36756,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/aacraid/commctrl.c linux-2.6.32.43/drive
if (dev->in_reset) {
dprintk((KERN_DEBUG"aacraid: send raw srb -EBUSY\n"));
-diff -urNp linux-2.6.32.43/drivers/scsi/aic94xx/aic94xx_init.c linux-2.6.32.43/drivers/scsi/aic94xx/aic94xx_init.c
---- linux-2.6.32.43/drivers/scsi/aic94xx/aic94xx_init.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/aic94xx/aic94xx_init.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/aic94xx/aic94xx_init.c linux-2.6.32.44/drivers/scsi/aic94xx/aic94xx_init.c
+--- linux-2.6.32.44/drivers/scsi/aic94xx/aic94xx_init.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/aic94xx/aic94xx_init.c 2011-04-17 15:56:46.000000000 -0400
@@ -485,7 +485,7 @@ static ssize_t asd_show_update_bios(stru
flash_error_table[i].reason);
}
@@ -36820,9 +36768,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/aic94xx/aic94xx_init.c linux-2.6.32.43/d
asd_show_update_bios, asd_store_update_bios);
static int asd_create_dev_attrs(struct asd_ha_struct *asd_ha)
-diff -urNp linux-2.6.32.43/drivers/scsi/bfa/bfa_iocfc.h linux-2.6.32.43/drivers/scsi/bfa/bfa_iocfc.h
---- linux-2.6.32.43/drivers/scsi/bfa/bfa_iocfc.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/bfa/bfa_iocfc.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/bfa/bfa_iocfc.h linux-2.6.32.44/drivers/scsi/bfa/bfa_iocfc.h
+--- linux-2.6.32.44/drivers/scsi/bfa/bfa_iocfc.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/bfa/bfa_iocfc.h 2011-08-05 20:33:55.000000000 -0400
@@ -61,7 +61,7 @@ struct bfa_hwif_s {
void (*hw_isr_mode_set)(struct bfa_s *bfa, bfa_boolean_t msix);
void (*hw_msix_getvecs)(struct bfa_s *bfa, u32 *vecmap,
@@ -36832,9 +36780,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/bfa/bfa_iocfc.h linux-2.6.32.43/drivers/
typedef void (*bfa_cb_iocfc_t) (void *cbarg, enum bfa_status status);
struct bfa_iocfc_s {
-diff -urNp linux-2.6.32.43/drivers/scsi/bfa/bfa_ioc.h linux-2.6.32.43/drivers/scsi/bfa/bfa_ioc.h
---- linux-2.6.32.43/drivers/scsi/bfa/bfa_ioc.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/bfa/bfa_ioc.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/bfa/bfa_ioc.h linux-2.6.32.44/drivers/scsi/bfa/bfa_ioc.h
+--- linux-2.6.32.44/drivers/scsi/bfa/bfa_ioc.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/bfa/bfa_ioc.h 2011-08-05 20:33:55.000000000 -0400
@@ -127,7 +127,7 @@ struct bfa_ioc_cbfn_s {
bfa_ioc_disable_cbfn_t disable_cbfn;
bfa_ioc_hbfail_cbfn_t hbfail_cbfn;
@@ -36844,9 +36792,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/bfa/bfa_ioc.h linux-2.6.32.43/drivers/sc
/**
* Heartbeat failure notification queue element.
-diff -urNp linux-2.6.32.43/drivers/scsi/BusLogic.c linux-2.6.32.43/drivers/scsi/BusLogic.c
---- linux-2.6.32.43/drivers/scsi/BusLogic.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/BusLogic.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/BusLogic.c linux-2.6.32.44/drivers/scsi/BusLogic.c
+--- linux-2.6.32.44/drivers/scsi/BusLogic.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/BusLogic.c 2011-05-16 21:46:57.000000000 -0400
@@ -961,6 +961,8 @@ static int __init BusLogic_InitializeFla
static void __init BusLogic_InitializeProbeInfoList(struct BusLogic_HostAdapter
*PrototypeHostAdapter)
@@ -36856,9 +36804,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/BusLogic.c linux-2.6.32.43/drivers/scsi/
/*
If a PCI BIOS is present, interrogate it for MultiMaster and FlashPoint
Host Adapters; otherwise, default to the standard ISA MultiMaster probe.
-diff -urNp linux-2.6.32.43/drivers/scsi/dpt_i2o.c linux-2.6.32.43/drivers/scsi/dpt_i2o.c
---- linux-2.6.32.43/drivers/scsi/dpt_i2o.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/dpt_i2o.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/dpt_i2o.c linux-2.6.32.44/drivers/scsi/dpt_i2o.c
+--- linux-2.6.32.44/drivers/scsi/dpt_i2o.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/dpt_i2o.c 2011-05-16 21:46:57.000000000 -0400
@@ -1804,6 +1804,8 @@ static int adpt_i2o_passthru(adpt_hba* p
dma_addr_t addr;
ulong flags = 0;
@@ -36877,9 +36825,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/dpt_i2o.c linux-2.6.32.43/drivers/scsi/d
memset(msg, 0 , sizeof(msg));
len = scsi_bufflen(cmd);
direction = 0x00000000;
-diff -urNp linux-2.6.32.43/drivers/scsi/eata.c linux-2.6.32.43/drivers/scsi/eata.c
---- linux-2.6.32.43/drivers/scsi/eata.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/eata.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/eata.c linux-2.6.32.44/drivers/scsi/eata.c
+--- linux-2.6.32.44/drivers/scsi/eata.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/eata.c 2011-05-16 21:46:57.000000000 -0400
@@ -1087,6 +1087,8 @@ static int port_detect(unsigned long por
struct hostdata *ha;
char name[16];
@@ -36889,9 +36837,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/eata.c linux-2.6.32.43/drivers/scsi/eata
sprintf(name, "%s%d", driver_name, j);
if (!request_region(port_base, REGION_SIZE, driver_name)) {
-diff -urNp linux-2.6.32.43/drivers/scsi/fcoe/libfcoe.c linux-2.6.32.43/drivers/scsi/fcoe/libfcoe.c
---- linux-2.6.32.43/drivers/scsi/fcoe/libfcoe.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/fcoe/libfcoe.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/fcoe/libfcoe.c linux-2.6.32.44/drivers/scsi/fcoe/libfcoe.c
+--- linux-2.6.32.44/drivers/scsi/fcoe/libfcoe.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/fcoe/libfcoe.c 2011-05-16 21:46:57.000000000 -0400
@@ -809,6 +809,8 @@ static void fcoe_ctlr_recv_els(struct fc
size_t rlen;
size_t dlen;
@@ -36901,9 +36849,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/fcoe/libfcoe.c linux-2.6.32.43/drivers/s
fiph = (struct fip_header *)skb->data;
sub = fiph->fip_subcode;
if (sub != FIP_SC_REQ && sub != FIP_SC_REP)
-diff -urNp linux-2.6.32.43/drivers/scsi/fnic/fnic_main.c linux-2.6.32.43/drivers/scsi/fnic/fnic_main.c
---- linux-2.6.32.43/drivers/scsi/fnic/fnic_main.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/fnic/fnic_main.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/fnic/fnic_main.c linux-2.6.32.44/drivers/scsi/fnic/fnic_main.c
+--- linux-2.6.32.44/drivers/scsi/fnic/fnic_main.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/fnic/fnic_main.c 2011-08-05 20:33:55.000000000 -0400
@@ -669,7 +669,7 @@ static int __devinit fnic_probe(struct p
/* Start local port initiatialization */
@@ -36913,9 +36861,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/fnic/fnic_main.c linux-2.6.32.43/drivers
lp->max_retry_count = fnic->config.flogi_retries;
lp->max_rport_retry_count = fnic->config.plogi_retries;
-diff -urNp linux-2.6.32.43/drivers/scsi/gdth.c linux-2.6.32.43/drivers/scsi/gdth.c
---- linux-2.6.32.43/drivers/scsi/gdth.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/gdth.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/gdth.c linux-2.6.32.44/drivers/scsi/gdth.c
+--- linux-2.6.32.44/drivers/scsi/gdth.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/gdth.c 2011-05-16 21:46:57.000000000 -0400
@@ -4102,6 +4102,8 @@ static int ioc_lockdrv(void __user *arg)
ulong flags;
gdth_ha_str *ha;
@@ -36953,9 +36901,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/gdth.c linux-2.6.32.43/drivers/scsi/gdth
memset(cmnd, 0xff, MAX_COMMAND_SIZE);
TRACE2(("gdth_flush() hanum %d\n", ha->hanum));
-diff -urNp linux-2.6.32.43/drivers/scsi/gdth_proc.c linux-2.6.32.43/drivers/scsi/gdth_proc.c
---- linux-2.6.32.43/drivers/scsi/gdth_proc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/gdth_proc.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/gdth_proc.c linux-2.6.32.44/drivers/scsi/gdth_proc.c
+--- linux-2.6.32.44/drivers/scsi/gdth_proc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/gdth_proc.c 2011-05-16 21:46:57.000000000 -0400
@@ -46,6 +46,9 @@ static int gdth_set_asc_info(struct Scsi
ulong64 paddr;
@@ -36975,9 +36923,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/gdth_proc.c linux-2.6.32.43/drivers/scsi
gdtcmd = kmalloc(sizeof(*gdtcmd), GFP_KERNEL);
estr = kmalloc(sizeof(*estr), GFP_KERNEL);
if (!gdtcmd || !estr)
-diff -urNp linux-2.6.32.43/drivers/scsi/hosts.c linux-2.6.32.43/drivers/scsi/hosts.c
---- linux-2.6.32.43/drivers/scsi/hosts.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/hosts.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/hosts.c linux-2.6.32.44/drivers/scsi/hosts.c
+--- linux-2.6.32.44/drivers/scsi/hosts.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/hosts.c 2011-05-04 17:56:28.000000000 -0400
@@ -40,7 +40,7 @@
#include "scsi_logging.h"
@@ -36996,9 +36944,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/hosts.c linux-2.6.32.43/drivers/scsi/hos
shost->dma_channel = 0xff;
/* These three are default values which can be overridden */
-diff -urNp linux-2.6.32.43/drivers/scsi/ipr.c linux-2.6.32.43/drivers/scsi/ipr.c
---- linux-2.6.32.43/drivers/scsi/ipr.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/ipr.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/ipr.c linux-2.6.32.44/drivers/scsi/ipr.c
+--- linux-2.6.32.44/drivers/scsi/ipr.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/ipr.c 2011-04-17 15:56:46.000000000 -0400
@@ -5286,7 +5286,7 @@ static bool ipr_qc_fill_rtf(struct ata_q
return true;
}
@@ -37008,9 +36956,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/ipr.c linux-2.6.32.43/drivers/scsi/ipr.c
.phy_reset = ipr_ata_phy_reset,
.hardreset = ipr_sata_reset,
.post_internal_cmd = ipr_ata_post_internal,
-diff -urNp linux-2.6.32.43/drivers/scsi/ips.h linux-2.6.32.43/drivers/scsi/ips.h
---- linux-2.6.32.43/drivers/scsi/ips.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/ips.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/ips.h linux-2.6.32.44/drivers/scsi/ips.h
+--- linux-2.6.32.44/drivers/scsi/ips.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/ips.h 2011-08-05 20:33:55.000000000 -0400
@@ -1027,7 +1027,7 @@ typedef struct {
int (*intr)(struct ips_ha *);
void (*enableint)(struct ips_ha *);
@@ -37020,9 +36968,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/ips.h linux-2.6.32.43/drivers/scsi/ips.h
typedef struct ips_ha {
uint8_t ha_id[IPS_MAX_CHANNELS+1];
-diff -urNp linux-2.6.32.43/drivers/scsi/libfc/fc_disc.c linux-2.6.32.43/drivers/scsi/libfc/fc_disc.c
---- linux-2.6.32.43/drivers/scsi/libfc/fc_disc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/libfc/fc_disc.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/libfc/fc_disc.c linux-2.6.32.44/drivers/scsi/libfc/fc_disc.c
+--- linux-2.6.32.44/drivers/scsi/libfc/fc_disc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/libfc/fc_disc.c 2011-08-05 20:33:55.000000000 -0400
@@ -715,16 +715,16 @@ int fc_disc_init(struct fc_lport *lport)
struct fc_disc *disc;
@@ -37044,9 +36992,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/libfc/fc_disc.c linux-2.6.32.43/drivers/
disc = &lport->disc;
INIT_DELAYED_WORK(&disc->disc_work, fc_disc_timeout);
-diff -urNp linux-2.6.32.43/drivers/scsi/libfc/fc_elsct.c linux-2.6.32.43/drivers/scsi/libfc/fc_elsct.c
---- linux-2.6.32.43/drivers/scsi/libfc/fc_elsct.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/libfc/fc_elsct.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/libfc/fc_elsct.c linux-2.6.32.44/drivers/scsi/libfc/fc_elsct.c
+--- linux-2.6.32.44/drivers/scsi/libfc/fc_elsct.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/libfc/fc_elsct.c 2011-08-05 20:33:55.000000000 -0400
@@ -67,7 +67,7 @@ static struct fc_seq *fc_elsct_send(stru
int fc_elsct_init(struct fc_lport *lport)
{
@@ -37056,9 +37004,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/libfc/fc_elsct.c linux-2.6.32.43/drivers
return 0;
}
-diff -urNp linux-2.6.32.43/drivers/scsi/libfc/fc_exch.c linux-2.6.32.43/drivers/scsi/libfc/fc_exch.c
---- linux-2.6.32.43/drivers/scsi/libfc/fc_exch.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/libfc/fc_exch.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/libfc/fc_exch.c linux-2.6.32.44/drivers/scsi/libfc/fc_exch.c
+--- linux-2.6.32.44/drivers/scsi/libfc/fc_exch.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/libfc/fc_exch.c 2011-08-05 20:33:55.000000000 -0400
@@ -86,12 +86,12 @@ struct fc_exch_mgr {
* all together if not used XXX
*/
@@ -37213,9 +37161,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/libfc/fc_exch.c linux-2.6.32.43/drivers/
/*
* Initialize fc_cpu_mask and fc_cpu_order. The
-diff -urNp linux-2.6.32.43/drivers/scsi/libfc/fc_fcp.c linux-2.6.32.43/drivers/scsi/libfc/fc_fcp.c
---- linux-2.6.32.43/drivers/scsi/libfc/fc_fcp.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/libfc/fc_fcp.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/libfc/fc_fcp.c linux-2.6.32.44/drivers/scsi/libfc/fc_fcp.c
+--- linux-2.6.32.44/drivers/scsi/libfc/fc_fcp.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/libfc/fc_fcp.c 2011-08-05 20:33:55.000000000 -0400
@@ -2105,13 +2105,13 @@ int fc_fcp_init(struct fc_lport *lp)
struct fc_fcp_internal *si;
@@ -37233,9 +37181,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/libfc/fc_fcp.c linux-2.6.32.43/drivers/s
si = kzalloc(sizeof(struct fc_fcp_internal), GFP_KERNEL);
if (!si)
-diff -urNp linux-2.6.32.43/drivers/scsi/libfc/fc_lport.c linux-2.6.32.43/drivers/scsi/libfc/fc_lport.c
---- linux-2.6.32.43/drivers/scsi/libfc/fc_lport.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/libfc/fc_lport.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/libfc/fc_lport.c linux-2.6.32.44/drivers/scsi/libfc/fc_lport.c
+--- linux-2.6.32.44/drivers/scsi/libfc/fc_lport.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/libfc/fc_lport.c 2011-08-05 20:33:55.000000000 -0400
@@ -569,7 +569,7 @@ int fc_lport_destroy(struct fc_lport *lp
mutex_lock(&lport->lp_mutex);
lport->state = LPORT_ST_DISABLED;
@@ -37258,9 +37206,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/libfc/fc_lport.c linux-2.6.32.43/drivers
fc_host_port_type(lport->host) = FC_PORTTYPE_NPORT;
fc_host_node_name(lport->host) = lport->wwnn;
-diff -urNp linux-2.6.32.43/drivers/scsi/libfc/fc_rport.c linux-2.6.32.43/drivers/scsi/libfc/fc_rport.c
---- linux-2.6.32.43/drivers/scsi/libfc/fc_rport.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/libfc/fc_rport.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/libfc/fc_rport.c linux-2.6.32.44/drivers/scsi/libfc/fc_rport.c
+--- linux-2.6.32.44/drivers/scsi/libfc/fc_rport.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/libfc/fc_rport.c 2011-08-05 20:33:55.000000000 -0400
@@ -1566,25 +1566,25 @@ static void fc_rport_flush_queue(void)
int fc_rport_init(struct fc_lport *lport)
{
@@ -37294,9 +37242,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/libfc/fc_rport.c linux-2.6.32.43/drivers
return 0;
}
-diff -urNp linux-2.6.32.43/drivers/scsi/libsas/sas_ata.c linux-2.6.32.43/drivers/scsi/libsas/sas_ata.c
---- linux-2.6.32.43/drivers/scsi/libsas/sas_ata.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/libsas/sas_ata.c 2011-04-23 12:56:11.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/libsas/sas_ata.c linux-2.6.32.44/drivers/scsi/libsas/sas_ata.c
+--- linux-2.6.32.44/drivers/scsi/libsas/sas_ata.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/libsas/sas_ata.c 2011-04-23 12:56:11.000000000 -0400
@@ -343,7 +343,7 @@ static int sas_ata_scr_read(struct ata_l
}
}
@@ -37306,9 +37254,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/libsas/sas_ata.c linux-2.6.32.43/drivers
.phy_reset = sas_ata_phy_reset,
.post_internal_cmd = sas_ata_post_internal,
.qc_defer = ata_std_qc_defer,
-diff -urNp linux-2.6.32.43/drivers/scsi/lpfc/lpfc_debugfs.c linux-2.6.32.43/drivers/scsi/lpfc/lpfc_debugfs.c
---- linux-2.6.32.43/drivers/scsi/lpfc/lpfc_debugfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/lpfc/lpfc_debugfs.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/lpfc/lpfc_debugfs.c linux-2.6.32.44/drivers/scsi/lpfc/lpfc_debugfs.c
+--- linux-2.6.32.44/drivers/scsi/lpfc/lpfc_debugfs.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/lpfc/lpfc_debugfs.c 2011-05-16 21:46:57.000000000 -0400
@@ -124,7 +124,7 @@ struct lpfc_debug {
int len;
};
@@ -37397,9 +37345,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/lpfc/lpfc_debugfs.c linux-2.6.32.43/driv
snprintf(name, sizeof(name), "discovery_trace");
vport->debug_disc_trc =
-diff -urNp linux-2.6.32.43/drivers/scsi/lpfc/lpfc.h linux-2.6.32.43/drivers/scsi/lpfc/lpfc.h
---- linux-2.6.32.43/drivers/scsi/lpfc/lpfc.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/lpfc/lpfc.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/lpfc/lpfc.h linux-2.6.32.44/drivers/scsi/lpfc/lpfc.h
+--- linux-2.6.32.44/drivers/scsi/lpfc/lpfc.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/lpfc/lpfc.h 2011-05-04 17:56:28.000000000 -0400
@@ -400,7 +400,7 @@ struct lpfc_vport {
struct dentry *debug_nodelist;
struct dentry *vport_debugfs_root;
@@ -37429,9 +37377,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/lpfc/lpfc.h linux-2.6.32.43/drivers/scsi
#endif
/* Used for deferred freeing of ELS data buffers */
-diff -urNp linux-2.6.32.43/drivers/scsi/lpfc/lpfc_init.c linux-2.6.32.43/drivers/scsi/lpfc/lpfc_init.c
---- linux-2.6.32.43/drivers/scsi/lpfc/lpfc_init.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/lpfc/lpfc_init.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/lpfc/lpfc_init.c linux-2.6.32.44/drivers/scsi/lpfc/lpfc_init.c
+--- linux-2.6.32.44/drivers/scsi/lpfc/lpfc_init.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/lpfc/lpfc_init.c 2011-08-05 20:33:55.000000000 -0400
@@ -8021,8 +8021,10 @@ lpfc_init(void)
printk(LPFC_COPYRIGHT "\n");
@@ -37445,9 +37393,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/lpfc/lpfc_init.c linux-2.6.32.43/drivers
}
lpfc_transport_template =
fc_attach_transport(&lpfc_transport_functions);
-diff -urNp linux-2.6.32.43/drivers/scsi/lpfc/lpfc_scsi.c linux-2.6.32.43/drivers/scsi/lpfc/lpfc_scsi.c
---- linux-2.6.32.43/drivers/scsi/lpfc/lpfc_scsi.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/lpfc/lpfc_scsi.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/lpfc/lpfc_scsi.c linux-2.6.32.44/drivers/scsi/lpfc/lpfc_scsi.c
+--- linux-2.6.32.44/drivers/scsi/lpfc/lpfc_scsi.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/lpfc/lpfc_scsi.c 2011-05-04 17:56:28.000000000 -0400
@@ -259,7 +259,7 @@ lpfc_rampdown_queue_depth(struct lpfc_hb
uint32_t evt_posted;
@@ -37499,9 +37447,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/lpfc/lpfc_scsi.c linux-2.6.32.43/drivers
}
/**
-diff -urNp linux-2.6.32.43/drivers/scsi/megaraid/megaraid_mbox.c linux-2.6.32.43/drivers/scsi/megaraid/megaraid_mbox.c
---- linux-2.6.32.43/drivers/scsi/megaraid/megaraid_mbox.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/megaraid/megaraid_mbox.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/megaraid/megaraid_mbox.c linux-2.6.32.44/drivers/scsi/megaraid/megaraid_mbox.c
+--- linux-2.6.32.44/drivers/scsi/megaraid/megaraid_mbox.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/megaraid/megaraid_mbox.c 2011-05-16 21:46:57.000000000 -0400
@@ -3503,6 +3503,8 @@ megaraid_cmm_register(adapter_t *adapter
int rval;
int i;
@@ -37511,9 +37459,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/megaraid/megaraid_mbox.c linux-2.6.32.43
// Allocate memory for the base list of scb for management module.
adapter->uscb_list = kcalloc(MBOX_MAX_USER_CMDS, sizeof(scb_t), GFP_KERNEL);
-diff -urNp linux-2.6.32.43/drivers/scsi/osd/osd_initiator.c linux-2.6.32.43/drivers/scsi/osd/osd_initiator.c
---- linux-2.6.32.43/drivers/scsi/osd/osd_initiator.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/osd/osd_initiator.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/osd/osd_initiator.c linux-2.6.32.44/drivers/scsi/osd/osd_initiator.c
+--- linux-2.6.32.44/drivers/scsi/osd/osd_initiator.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/osd/osd_initiator.c 2011-05-16 21:46:57.000000000 -0400
@@ -94,6 +94,8 @@ static int _osd_print_system_info(struct
int nelem = ARRAY_SIZE(get_attrs), a = 0;
int ret;
@@ -37523,9 +37471,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/osd/osd_initiator.c linux-2.6.32.43/driv
or = osd_start_request(od, GFP_KERNEL);
if (!or)
return -ENOMEM;
-diff -urNp linux-2.6.32.43/drivers/scsi/pmcraid.c linux-2.6.32.43/drivers/scsi/pmcraid.c
---- linux-2.6.32.43/drivers/scsi/pmcraid.c 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/pmcraid.c 2011-05-10 22:12:33.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/pmcraid.c linux-2.6.32.44/drivers/scsi/pmcraid.c
+--- linux-2.6.32.44/drivers/scsi/pmcraid.c 2011-08-09 18:35:29.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/pmcraid.c 2011-08-09 18:33:59.000000000 -0400
@@ -189,8 +189,8 @@ static int pmcraid_slave_alloc(struct sc
res->scsi_dev = scsi_dev;
scsi_dev->hostdata = res;
@@ -37549,7 +37497,7 @@ diff -urNp linux-2.6.32.43/drivers/scsi/pmcraid.c linux-2.6.32.43/drivers/scsi/p
if (!RES_IS_GSCSI(res->cfg_entry) &&
masked_ioasc != PMCRAID_IOASC_HW_DEVICE_BUS_STATUS_ERROR) {
-@@ -4113,7 +4113,7 @@ static void pmcraid_worker_function(stru
+@@ -4116,7 +4116,7 @@ static void pmcraid_worker_function(stru
pinstance = container_of(workp, struct pmcraid_instance, worker_q);
/* add resources only after host is added into system */
@@ -37558,7 +37506,7 @@ diff -urNp linux-2.6.32.43/drivers/scsi/pmcraid.c linux-2.6.32.43/drivers/scsi/p
return;
spin_lock_irqsave(&pinstance->resource_lock, lock_flags);
-@@ -4847,7 +4847,7 @@ static int __devinit pmcraid_init_instan
+@@ -4850,7 +4850,7 @@ static int __devinit pmcraid_init_instan
init_waitqueue_head(&pinstance->reset_wait_q);
atomic_set(&pinstance->outstanding_cmds, 0);
@@ -37567,7 +37515,7 @@ diff -urNp linux-2.6.32.43/drivers/scsi/pmcraid.c linux-2.6.32.43/drivers/scsi/p
INIT_LIST_HEAD(&pinstance->free_res_q);
INIT_LIST_HEAD(&pinstance->used_res_q);
-@@ -5499,7 +5499,7 @@ static int __devinit pmcraid_probe(
+@@ -5502,7 +5502,7 @@ static int __devinit pmcraid_probe(
/* Schedule worker thread to handle CCN and take care of adding and
* removing devices to OS
*/
@@ -37576,9 +37524,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/pmcraid.c linux-2.6.32.43/drivers/scsi/p
schedule_work(&pinstance->worker_q);
return rc;
-diff -urNp linux-2.6.32.43/drivers/scsi/pmcraid.h linux-2.6.32.43/drivers/scsi/pmcraid.h
---- linux-2.6.32.43/drivers/scsi/pmcraid.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/pmcraid.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/pmcraid.h linux-2.6.32.44/drivers/scsi/pmcraid.h
+--- linux-2.6.32.44/drivers/scsi/pmcraid.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/pmcraid.h 2011-05-04 17:56:28.000000000 -0400
@@ -690,7 +690,7 @@ struct pmcraid_instance {
atomic_t outstanding_cmds;
@@ -37599,9 +37547,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/pmcraid.h linux-2.6.32.43/drivers/scsi/p
/* To indicate add/delete/modify during CCN */
u8 change_detected;
-diff -urNp linux-2.6.32.43/drivers/scsi/qla2xxx/qla_def.h linux-2.6.32.43/drivers/scsi/qla2xxx/qla_def.h
---- linux-2.6.32.43/drivers/scsi/qla2xxx/qla_def.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/qla2xxx/qla_def.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/qla2xxx/qla_def.h linux-2.6.32.44/drivers/scsi/qla2xxx/qla_def.h
+--- linux-2.6.32.44/drivers/scsi/qla2xxx/qla_def.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/qla2xxx/qla_def.h 2011-08-05 20:33:55.000000000 -0400
@@ -2089,7 +2089,7 @@ struct isp_operations {
int (*get_flash_version) (struct scsi_qla_host *, void *);
@@ -37611,9 +37559,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/qla2xxx/qla_def.h linux-2.6.32.43/driver
/* MSI-X Support *************************************************************/
-diff -urNp linux-2.6.32.43/drivers/scsi/qla4xxx/ql4_def.h linux-2.6.32.43/drivers/scsi/qla4xxx/ql4_def.h
---- linux-2.6.32.43/drivers/scsi/qla4xxx/ql4_def.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/qla4xxx/ql4_def.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/qla4xxx/ql4_def.h linux-2.6.32.44/drivers/scsi/qla4xxx/ql4_def.h
+--- linux-2.6.32.44/drivers/scsi/qla4xxx/ql4_def.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/qla4xxx/ql4_def.h 2011-05-04 17:56:28.000000000 -0400
@@ -240,7 +240,7 @@ struct ddb_entry {
atomic_t retry_relogin_timer; /* Min Time between relogins
* (4000 only) */
@@ -37623,9 +37571,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/qla4xxx/ql4_def.h linux-2.6.32.43/driver
* retried */
uint16_t port;
-diff -urNp linux-2.6.32.43/drivers/scsi/qla4xxx/ql4_init.c linux-2.6.32.43/drivers/scsi/qla4xxx/ql4_init.c
---- linux-2.6.32.43/drivers/scsi/qla4xxx/ql4_init.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/qla4xxx/ql4_init.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/qla4xxx/ql4_init.c linux-2.6.32.44/drivers/scsi/qla4xxx/ql4_init.c
+--- linux-2.6.32.44/drivers/scsi/qla4xxx/ql4_init.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/qla4xxx/ql4_init.c 2011-05-04 17:56:28.000000000 -0400
@@ -482,7 +482,7 @@ static struct ddb_entry * qla4xxx_alloc_
atomic_set(&ddb_entry->port_down_timer, ha->port_down_retry_count);
atomic_set(&ddb_entry->retry_relogin_timer, INVALID_ENTRY);
@@ -37644,9 +37592,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/qla4xxx/ql4_init.c linux-2.6.32.43/drive
atomic_set(&ddb_entry->relogin_timer, 0);
clear_bit(DF_RELOGIN, &ddb_entry->flags);
clear_bit(DF_NO_RELOGIN, &ddb_entry->flags);
-diff -urNp linux-2.6.32.43/drivers/scsi/qla4xxx/ql4_os.c linux-2.6.32.43/drivers/scsi/qla4xxx/ql4_os.c
---- linux-2.6.32.43/drivers/scsi/qla4xxx/ql4_os.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/qla4xxx/ql4_os.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/qla4xxx/ql4_os.c linux-2.6.32.44/drivers/scsi/qla4xxx/ql4_os.c
+--- linux-2.6.32.44/drivers/scsi/qla4xxx/ql4_os.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/qla4xxx/ql4_os.c 2011-05-04 17:56:28.000000000 -0400
@@ -641,13 +641,13 @@ static void qla4xxx_timer(struct scsi_ql
ddb_entry->fw_ddb_device_state ==
DDB_DS_SESSION_FAILED) {
@@ -37663,9 +37611,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/qla4xxx/ql4_os.c linux-2.6.32.43/drivers
relogin_retry_count))
);
start_dpc++;
-diff -urNp linux-2.6.32.43/drivers/scsi/scsi.c linux-2.6.32.43/drivers/scsi/scsi.c
---- linux-2.6.32.43/drivers/scsi/scsi.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/scsi.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/scsi.c linux-2.6.32.44/drivers/scsi/scsi.c
+--- linux-2.6.32.44/drivers/scsi/scsi.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/scsi.c 2011-05-04 17:56:28.000000000 -0400
@@ -652,7 +652,7 @@ int scsi_dispatch_cmd(struct scsi_cmnd *
unsigned long timeout;
int rtn = 0;
@@ -37675,9 +37623,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/scsi.c linux-2.6.32.43/drivers/scsi/scsi
/* check if the device is still usable */
if (unlikely(cmd->device->sdev_state == SDEV_DEL)) {
-diff -urNp linux-2.6.32.43/drivers/scsi/scsi_debug.c linux-2.6.32.43/drivers/scsi/scsi_debug.c
---- linux-2.6.32.43/drivers/scsi/scsi_debug.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/scsi_debug.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/scsi_debug.c linux-2.6.32.44/drivers/scsi/scsi_debug.c
+--- linux-2.6.32.44/drivers/scsi/scsi_debug.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/scsi_debug.c 2011-05-16 21:46:57.000000000 -0400
@@ -1395,6 +1395,8 @@ static int resp_mode_select(struct scsi_
unsigned char arr[SDEBUG_MAX_MSELECT_SZ];
unsigned char *cmd = (unsigned char *)scp->cmnd;
@@ -37696,9 +37644,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/scsi_debug.c linux-2.6.32.43/drivers/scs
if ((errsts = check_readiness(scp, 1, devip)))
return errsts;
memset(arr, 0, sizeof(arr));
-diff -urNp linux-2.6.32.43/drivers/scsi/scsi_lib.c linux-2.6.32.43/drivers/scsi/scsi_lib.c
---- linux-2.6.32.43/drivers/scsi/scsi_lib.c 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/scsi_lib.c 2011-05-10 22:12:33.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/scsi_lib.c linux-2.6.32.44/drivers/scsi/scsi_lib.c
+--- linux-2.6.32.44/drivers/scsi/scsi_lib.c 2011-05-10 22:12:01.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/scsi_lib.c 2011-05-10 22:12:33.000000000 -0400
@@ -1384,7 +1384,7 @@ static void scsi_kill_request(struct req
scsi_init_cmd_errh(cmd);
@@ -37720,9 +37668,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/scsi_lib.c linux-2.6.32.43/drivers/scsi/
disposition = scsi_decide_disposition(cmd);
if (disposition != SUCCESS &&
-diff -urNp linux-2.6.32.43/drivers/scsi/scsi_sysfs.c linux-2.6.32.43/drivers/scsi/scsi_sysfs.c
---- linux-2.6.32.43/drivers/scsi/scsi_sysfs.c 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/scsi_sysfs.c 2011-06-25 12:56:37.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/scsi_sysfs.c linux-2.6.32.44/drivers/scsi/scsi_sysfs.c
+--- linux-2.6.32.44/drivers/scsi/scsi_sysfs.c 2011-06-25 12:55:34.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/scsi_sysfs.c 2011-06-25 12:56:37.000000000 -0400
@@ -662,7 +662,7 @@ show_iostat_##field(struct device *dev,
char *buf) \
{ \
@@ -37732,9 +37680,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/scsi_sysfs.c linux-2.6.32.43/drivers/scs
return snprintf(buf, 20, "0x%llx\n", count); \
} \
static DEVICE_ATTR(field, S_IRUGO, show_iostat_##field, NULL)
-diff -urNp linux-2.6.32.43/drivers/scsi/scsi_transport_fc.c linux-2.6.32.43/drivers/scsi/scsi_transport_fc.c
---- linux-2.6.32.43/drivers/scsi/scsi_transport_fc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/scsi_transport_fc.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/scsi_transport_fc.c linux-2.6.32.44/drivers/scsi/scsi_transport_fc.c
+--- linux-2.6.32.44/drivers/scsi/scsi_transport_fc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/scsi_transport_fc.c 2011-05-04 17:56:28.000000000 -0400
@@ -480,7 +480,7 @@ MODULE_PARM_DESC(dev_loss_tmo,
* Netlink Infrastructure
*/
@@ -37762,9 +37710,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/scsi_transport_fc.c linux-2.6.32.43/driv
error = transport_class_register(&fc_host_class);
if (error)
-diff -urNp linux-2.6.32.43/drivers/scsi/scsi_transport_iscsi.c linux-2.6.32.43/drivers/scsi/scsi_transport_iscsi.c
---- linux-2.6.32.43/drivers/scsi/scsi_transport_iscsi.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/scsi_transport_iscsi.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/scsi_transport_iscsi.c linux-2.6.32.44/drivers/scsi/scsi_transport_iscsi.c
+--- linux-2.6.32.44/drivers/scsi/scsi_transport_iscsi.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/scsi_transport_iscsi.c 2011-05-04 17:56:28.000000000 -0400
@@ -81,7 +81,7 @@ struct iscsi_internal {
struct device_attribute *session_attrs[ISCSI_SESSION_ATTRS + 1];
};
@@ -37792,9 +37740,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/scsi_transport_iscsi.c linux-2.6.32.43/d
err = class_register(&iscsi_transport_class);
if (err)
-diff -urNp linux-2.6.32.43/drivers/scsi/scsi_transport_srp.c linux-2.6.32.43/drivers/scsi/scsi_transport_srp.c
---- linux-2.6.32.43/drivers/scsi/scsi_transport_srp.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/scsi_transport_srp.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/scsi_transport_srp.c linux-2.6.32.44/drivers/scsi/scsi_transport_srp.c
+--- linux-2.6.32.44/drivers/scsi/scsi_transport_srp.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/scsi_transport_srp.c 2011-05-04 17:56:28.000000000 -0400
@@ -33,7 +33,7 @@
#include "scsi_transport_srp_internal.h"
@@ -37822,9 +37770,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/scsi_transport_srp.c linux-2.6.32.43/dri
dev_set_name(&rport->dev, "port-%d:%d", shost->host_no, id);
transport_setup_device(&rport->dev);
-diff -urNp linux-2.6.32.43/drivers/scsi/sg.c linux-2.6.32.43/drivers/scsi/sg.c
---- linux-2.6.32.43/drivers/scsi/sg.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/sg.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/sg.c linux-2.6.32.44/drivers/scsi/sg.c
+--- linux-2.6.32.44/drivers/scsi/sg.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/sg.c 2011-04-17 15:56:46.000000000 -0400
@@ -2292,7 +2292,7 @@ struct sg_proc_leaf {
const struct file_operations * fops;
};
@@ -37843,9 +37791,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/sg.c linux-2.6.32.43/drivers/scsi/sg.c
sg_proc_sgp = proc_mkdir(sg_proc_sg_dirname, NULL);
if (!sg_proc_sgp)
-diff -urNp linux-2.6.32.43/drivers/scsi/sym53c8xx_2/sym_glue.c linux-2.6.32.43/drivers/scsi/sym53c8xx_2/sym_glue.c
---- linux-2.6.32.43/drivers/scsi/sym53c8xx_2/sym_glue.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/scsi/sym53c8xx_2/sym_glue.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/scsi/sym53c8xx_2/sym_glue.c linux-2.6.32.44/drivers/scsi/sym53c8xx_2/sym_glue.c
+--- linux-2.6.32.44/drivers/scsi/sym53c8xx_2/sym_glue.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/scsi/sym53c8xx_2/sym_glue.c 2011-05-16 21:46:57.000000000 -0400
@@ -1754,6 +1754,8 @@ static int __devinit sym2_probe(struct p
int do_iounmap = 0;
int do_disable_device = 1;
@@ -37855,9 +37803,9 @@ diff -urNp linux-2.6.32.43/drivers/scsi/sym53c8xx_2/sym_glue.c linux-2.6.32.43/d
memset(&sym_dev, 0, sizeof(sym_dev));
memset(&nvram, 0, sizeof(nvram));
sym_dev.pdev = pdev;
-diff -urNp linux-2.6.32.43/drivers/serial/kgdboc.c linux-2.6.32.43/drivers/serial/kgdboc.c
---- linux-2.6.32.43/drivers/serial/kgdboc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/serial/kgdboc.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/serial/kgdboc.c linux-2.6.32.44/drivers/serial/kgdboc.c
+--- linux-2.6.32.44/drivers/serial/kgdboc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/serial/kgdboc.c 2011-04-17 15:56:46.000000000 -0400
@@ -18,7 +18,7 @@
#define MAX_CONFIG_LEN 40
@@ -37876,9 +37824,9 @@ diff -urNp linux-2.6.32.43/drivers/serial/kgdboc.c linux-2.6.32.43/drivers/seria
.name = "kgdboc",
.read_char = kgdboc_get_char,
.write_char = kgdboc_put_char,
-diff -urNp linux-2.6.32.43/drivers/spi/spi.c linux-2.6.32.43/drivers/spi/spi.c
---- linux-2.6.32.43/drivers/spi/spi.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/spi/spi.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/spi/spi.c linux-2.6.32.44/drivers/spi/spi.c
+--- linux-2.6.32.44/drivers/spi/spi.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/spi/spi.c 2011-05-04 17:56:28.000000000 -0400
@@ -774,7 +774,7 @@ int spi_sync(struct spi_device *spi, str
EXPORT_SYMBOL_GPL(spi_sync);
@@ -37888,9 +37836,9 @@ diff -urNp linux-2.6.32.43/drivers/spi/spi.c linux-2.6.32.43/drivers/spi/spi.c
static u8 *buf;
-diff -urNp linux-2.6.32.43/drivers/ssb/driver_gige.c linux-2.6.32.43/drivers/ssb/driver_gige.c
---- linux-2.6.32.43/drivers/ssb/driver_gige.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/ssb/driver_gige.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/ssb/driver_gige.c linux-2.6.32.44/drivers/ssb/driver_gige.c
+--- linux-2.6.32.44/drivers/ssb/driver_gige.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/ssb/driver_gige.c 2011-08-05 20:33:55.000000000 -0400
@@ -180,8 +180,8 @@ static int ssb_gige_probe(struct ssb_dev
dev->pci_controller.io_resource = &dev->io_resource;
dev->pci_controller.mem_resource = &dev->mem_resource;
@@ -37902,9 +37850,9 @@ diff -urNp linux-2.6.32.43/drivers/ssb/driver_gige.c linux-2.6.32.43/drivers/ssb
dev->io_resource.name = SSB_GIGE_IO_RES_NAME;
dev->io_resource.start = 0x800;
-diff -urNp linux-2.6.32.43/drivers/staging/android/binder.c linux-2.6.32.43/drivers/staging/android/binder.c
---- linux-2.6.32.43/drivers/staging/android/binder.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/android/binder.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/android/binder.c linux-2.6.32.44/drivers/staging/android/binder.c
+--- linux-2.6.32.44/drivers/staging/android/binder.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/android/binder.c 2011-04-17 15:56:46.000000000 -0400
@@ -2756,7 +2756,7 @@ static void binder_vma_close(struct vm_a
binder_defer_work(proc, BINDER_DEFERRED_PUT_FILES);
}
@@ -37914,9 +37862,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/android/binder.c linux-2.6.32.43/driv
.open = binder_vma_open,
.close = binder_vma_close,
};
-diff -urNp linux-2.6.32.43/drivers/staging/b3dfg/b3dfg.c linux-2.6.32.43/drivers/staging/b3dfg/b3dfg.c
---- linux-2.6.32.43/drivers/staging/b3dfg/b3dfg.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/b3dfg/b3dfg.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/b3dfg/b3dfg.c linux-2.6.32.44/drivers/staging/b3dfg/b3dfg.c
+--- linux-2.6.32.44/drivers/staging/b3dfg/b3dfg.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/b3dfg/b3dfg.c 2011-04-17 15:56:46.000000000 -0400
@@ -455,7 +455,7 @@ static int b3dfg_vma_fault(struct vm_are
return VM_FAULT_NOPAGE;
}
@@ -37935,9 +37883,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/b3dfg/b3dfg.c linux-2.6.32.43/drivers
.owner = THIS_MODULE,
.open = b3dfg_open,
.release = b3dfg_release,
-diff -urNp linux-2.6.32.43/drivers/staging/comedi/comedi_fops.c linux-2.6.32.43/drivers/staging/comedi/comedi_fops.c
---- linux-2.6.32.43/drivers/staging/comedi/comedi_fops.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/comedi/comedi_fops.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/comedi/comedi_fops.c linux-2.6.32.44/drivers/staging/comedi/comedi_fops.c
+--- linux-2.6.32.44/drivers/staging/comedi/comedi_fops.c 2011-08-09 18:35:29.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/comedi/comedi_fops.c 2011-08-09 18:34:00.000000000 -0400
@@ -1389,7 +1389,7 @@ void comedi_unmap(struct vm_area_struct
mutex_unlock(&dev->mutex);
}
@@ -37947,9 +37895,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/comedi/comedi_fops.c linux-2.6.32.43/
.close = comedi_unmap,
};
-diff -urNp linux-2.6.32.43/drivers/staging/dream/qdsp5/adsp_driver.c linux-2.6.32.43/drivers/staging/dream/qdsp5/adsp_driver.c
---- linux-2.6.32.43/drivers/staging/dream/qdsp5/adsp_driver.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/dream/qdsp5/adsp_driver.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/dream/qdsp5/adsp_driver.c linux-2.6.32.44/drivers/staging/dream/qdsp5/adsp_driver.c
+--- linux-2.6.32.44/drivers/staging/dream/qdsp5/adsp_driver.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/dream/qdsp5/adsp_driver.c 2011-04-17 15:56:46.000000000 -0400
@@ -576,7 +576,7 @@ static struct adsp_device *inode_to_devi
static dev_t adsp_devno;
static struct class *adsp_class;
@@ -37959,9 +37907,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/dream/qdsp5/adsp_driver.c linux-2.6.3
.owner = THIS_MODULE,
.open = adsp_open,
.unlocked_ioctl = adsp_ioctl,
-diff -urNp linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_aac.c linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_aac.c
---- linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_aac.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_aac.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/dream/qdsp5/audio_aac.c linux-2.6.32.44/drivers/staging/dream/qdsp5/audio_aac.c
+--- linux-2.6.32.44/drivers/staging/dream/qdsp5/audio_aac.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/dream/qdsp5/audio_aac.c 2011-04-17 15:56:46.000000000 -0400
@@ -1022,7 +1022,7 @@ done:
return rc;
}
@@ -37971,9 +37919,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_aac.c linux-2.6.32.
.owner = THIS_MODULE,
.open = audio_open,
.release = audio_release,
-diff -urNp linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_amrnb.c linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_amrnb.c
---- linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_amrnb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_amrnb.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/dream/qdsp5/audio_amrnb.c linux-2.6.32.44/drivers/staging/dream/qdsp5/audio_amrnb.c
+--- linux-2.6.32.44/drivers/staging/dream/qdsp5/audio_amrnb.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/dream/qdsp5/audio_amrnb.c 2011-04-17 15:56:46.000000000 -0400
@@ -833,7 +833,7 @@ done:
return rc;
}
@@ -37983,9 +37931,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_amrnb.c linux-2.6.3
.owner = THIS_MODULE,
.open = audamrnb_open,
.release = audamrnb_release,
-diff -urNp linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_evrc.c linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_evrc.c
---- linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_evrc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_evrc.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/dream/qdsp5/audio_evrc.c linux-2.6.32.44/drivers/staging/dream/qdsp5/audio_evrc.c
+--- linux-2.6.32.44/drivers/staging/dream/qdsp5/audio_evrc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/dream/qdsp5/audio_evrc.c 2011-04-17 15:56:46.000000000 -0400
@@ -805,7 +805,7 @@ dma_fail:
return rc;
}
@@ -37995,9 +37943,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_evrc.c linux-2.6.32
.owner = THIS_MODULE,
.open = audevrc_open,
.release = audevrc_release,
-diff -urNp linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_in.c linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_in.c
---- linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_in.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_in.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/dream/qdsp5/audio_in.c linux-2.6.32.44/drivers/staging/dream/qdsp5/audio_in.c
+--- linux-2.6.32.44/drivers/staging/dream/qdsp5/audio_in.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/dream/qdsp5/audio_in.c 2011-04-17 15:56:46.000000000 -0400
@@ -913,7 +913,7 @@ static int audpre_open(struct inode *ino
return 0;
}
@@ -38016,9 +37964,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_in.c linux-2.6.32.4
.owner = THIS_MODULE,
.open = audpre_open,
.unlocked_ioctl = audpre_ioctl,
-diff -urNp linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_mp3.c linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_mp3.c
---- linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_mp3.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_mp3.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/dream/qdsp5/audio_mp3.c linux-2.6.32.44/drivers/staging/dream/qdsp5/audio_mp3.c
+--- linux-2.6.32.44/drivers/staging/dream/qdsp5/audio_mp3.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/dream/qdsp5/audio_mp3.c 2011-04-17 15:56:46.000000000 -0400
@@ -941,7 +941,7 @@ done:
return rc;
}
@@ -38028,9 +37976,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_mp3.c linux-2.6.32.
.owner = THIS_MODULE,
.open = audio_open,
.release = audio_release,
-diff -urNp linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_out.c linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_out.c
---- linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_out.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_out.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/dream/qdsp5/audio_out.c linux-2.6.32.44/drivers/staging/dream/qdsp5/audio_out.c
+--- linux-2.6.32.44/drivers/staging/dream/qdsp5/audio_out.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/dream/qdsp5/audio_out.c 2011-04-17 15:56:46.000000000 -0400
@@ -810,7 +810,7 @@ static int audpp_open(struct inode *inod
return 0;
}
@@ -38049,9 +37997,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_out.c linux-2.6.32.
.owner = THIS_MODULE,
.open = audpp_open,
.unlocked_ioctl = audpp_ioctl,
-diff -urNp linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_qcelp.c linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_qcelp.c
---- linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_qcelp.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_qcelp.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/dream/qdsp5/audio_qcelp.c linux-2.6.32.44/drivers/staging/dream/qdsp5/audio_qcelp.c
+--- linux-2.6.32.44/drivers/staging/dream/qdsp5/audio_qcelp.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/dream/qdsp5/audio_qcelp.c 2011-04-17 15:56:46.000000000 -0400
@@ -816,7 +816,7 @@ err:
return rc;
}
@@ -38061,9 +38009,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_qcelp.c linux-2.6.3
.owner = THIS_MODULE,
.open = audqcelp_open,
.release = audqcelp_release,
-diff -urNp linux-2.6.32.43/drivers/staging/dream/qdsp5/snd.c linux-2.6.32.43/drivers/staging/dream/qdsp5/snd.c
---- linux-2.6.32.43/drivers/staging/dream/qdsp5/snd.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/dream/qdsp5/snd.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/dream/qdsp5/snd.c linux-2.6.32.44/drivers/staging/dream/qdsp5/snd.c
+--- linux-2.6.32.44/drivers/staging/dream/qdsp5/snd.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/dream/qdsp5/snd.c 2011-04-17 15:56:46.000000000 -0400
@@ -242,7 +242,7 @@ err:
return rc;
}
@@ -38073,9 +38021,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/dream/qdsp5/snd.c linux-2.6.32.43/dri
.owner = THIS_MODULE,
.open = snd_open,
.release = snd_release,
-diff -urNp linux-2.6.32.43/drivers/staging/dream/smd/smd_qmi.c linux-2.6.32.43/drivers/staging/dream/smd/smd_qmi.c
---- linux-2.6.32.43/drivers/staging/dream/smd/smd_qmi.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/dream/smd/smd_qmi.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/dream/smd/smd_qmi.c linux-2.6.32.44/drivers/staging/dream/smd/smd_qmi.c
+--- linux-2.6.32.44/drivers/staging/dream/smd/smd_qmi.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/dream/smd/smd_qmi.c 2011-04-17 15:56:46.000000000 -0400
@@ -793,7 +793,7 @@ static int qmi_release(struct inode *ip,
return 0;
}
@@ -38085,9 +38033,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/dream/smd/smd_qmi.c linux-2.6.32.43/d
.owner = THIS_MODULE,
.read = qmi_read,
.write = qmi_write,
-diff -urNp linux-2.6.32.43/drivers/staging/dream/smd/smd_rpcrouter_device.c linux-2.6.32.43/drivers/staging/dream/smd/smd_rpcrouter_device.c
---- linux-2.6.32.43/drivers/staging/dream/smd/smd_rpcrouter_device.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/dream/smd/smd_rpcrouter_device.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/dream/smd/smd_rpcrouter_device.c linux-2.6.32.44/drivers/staging/dream/smd/smd_rpcrouter_device.c
+--- linux-2.6.32.44/drivers/staging/dream/smd/smd_rpcrouter_device.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/dream/smd/smd_rpcrouter_device.c 2011-04-17 15:56:46.000000000 -0400
@@ -214,7 +214,7 @@ static long rpcrouter_ioctl(struct file
return rc;
}
@@ -38106,9 +38054,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/dream/smd/smd_rpcrouter_device.c linu
.owner = THIS_MODULE,
.open = rpcrouter_open,
.release = rpcrouter_release,
-diff -urNp linux-2.6.32.43/drivers/staging/dst/dcore.c linux-2.6.32.43/drivers/staging/dst/dcore.c
---- linux-2.6.32.43/drivers/staging/dst/dcore.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/dst/dcore.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/dst/dcore.c linux-2.6.32.44/drivers/staging/dst/dcore.c
+--- linux-2.6.32.44/drivers/staging/dst/dcore.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/dst/dcore.c 2011-04-17 15:56:46.000000000 -0400
@@ -149,7 +149,7 @@ static int dst_bdev_release(struct gendi
return 0;
}
@@ -38127,9 +38075,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/dst/dcore.c linux-2.6.32.43/drivers/s
snprintf(n->name, sizeof(n->name), "%s", ctl->name);
err = dst_node_sysfs_init(n);
-diff -urNp linux-2.6.32.43/drivers/staging/dst/trans.c linux-2.6.32.43/drivers/staging/dst/trans.c
---- linux-2.6.32.43/drivers/staging/dst/trans.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/dst/trans.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/dst/trans.c linux-2.6.32.44/drivers/staging/dst/trans.c
+--- linux-2.6.32.44/drivers/staging/dst/trans.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/dst/trans.c 2011-04-17 15:56:46.000000000 -0400
@@ -169,7 +169,7 @@ int dst_process_bio(struct dst_node *n,
t->error = 0;
t->retries = 0;
@@ -38139,9 +38087,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/dst/trans.c linux-2.6.32.43/drivers/s
t->enc = bio_data_dir(bio);
dst_bio_to_cmd(bio, &t->cmd, DST_IO, t->gen);
-diff -urNp linux-2.6.32.43/drivers/staging/et131x/et1310_tx.c linux-2.6.32.43/drivers/staging/et131x/et1310_tx.c
---- linux-2.6.32.43/drivers/staging/et131x/et1310_tx.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/et131x/et1310_tx.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/et131x/et1310_tx.c linux-2.6.32.44/drivers/staging/et131x/et1310_tx.c
+--- linux-2.6.32.44/drivers/staging/et131x/et1310_tx.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/et131x/et1310_tx.c 2011-05-04 17:56:28.000000000 -0400
@@ -710,11 +710,11 @@ inline void et131x_free_send_packet(stru
struct net_device_stats *stats = &etdev->net_stats;
@@ -38157,9 +38105,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/et131x/et1310_tx.c linux-2.6.32.43/dr
if (pMpTcb->Packet) {
stats->tx_bytes += pMpTcb->Packet->len;
-diff -urNp linux-2.6.32.43/drivers/staging/et131x/et131x_adapter.h linux-2.6.32.43/drivers/staging/et131x/et131x_adapter.h
---- linux-2.6.32.43/drivers/staging/et131x/et131x_adapter.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/et131x/et131x_adapter.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/et131x/et131x_adapter.h linux-2.6.32.44/drivers/staging/et131x/et131x_adapter.h
+--- linux-2.6.32.44/drivers/staging/et131x/et131x_adapter.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/et131x/et131x_adapter.h 2011-05-04 17:56:28.000000000 -0400
@@ -145,11 +145,11 @@ typedef struct _ce_stats_t {
* operations
*/
@@ -38175,9 +38123,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/et131x/et131x_adapter.h linux-2.6.32.
u32 norcvbuf; /* # Rx packets discarded */
u32 noxmtbuf; /* # Tx packets discarded */
-diff -urNp linux-2.6.32.43/drivers/staging/go7007/go7007-v4l2.c linux-2.6.32.43/drivers/staging/go7007/go7007-v4l2.c
---- linux-2.6.32.43/drivers/staging/go7007/go7007-v4l2.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/go7007/go7007-v4l2.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/go7007/go7007-v4l2.c linux-2.6.32.44/drivers/staging/go7007/go7007-v4l2.c
+--- linux-2.6.32.44/drivers/staging/go7007/go7007-v4l2.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/go7007/go7007-v4l2.c 2011-04-17 15:56:46.000000000 -0400
@@ -1700,7 +1700,7 @@ static int go7007_vm_fault(struct vm_are
return 0;
}
@@ -38187,9 +38135,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/go7007/go7007-v4l2.c linux-2.6.32.43/
.open = go7007_vm_open,
.close = go7007_vm_close,
.fault = go7007_vm_fault,
-diff -urNp linux-2.6.32.43/drivers/staging/hv/blkvsc_drv.c linux-2.6.32.43/drivers/staging/hv/blkvsc_drv.c
---- linux-2.6.32.43/drivers/staging/hv/blkvsc_drv.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/hv/blkvsc_drv.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/hv/blkvsc_drv.c linux-2.6.32.44/drivers/staging/hv/blkvsc_drv.c
+--- linux-2.6.32.44/drivers/staging/hv/blkvsc_drv.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/hv/blkvsc_drv.c 2011-04-17 15:56:46.000000000 -0400
@@ -153,7 +153,7 @@ static int blkvsc_ringbuffer_size = BLKV
/* The one and only one */
static struct blkvsc_driver_context g_blkvsc_drv;
@@ -38199,9 +38147,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/hv/blkvsc_drv.c linux-2.6.32.43/drive
.owner = THIS_MODULE,
.open = blkvsc_open,
.release = blkvsc_release,
-diff -urNp linux-2.6.32.43/drivers/staging/hv/Channel.c linux-2.6.32.43/drivers/staging/hv/Channel.c
---- linux-2.6.32.43/drivers/staging/hv/Channel.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/hv/Channel.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/hv/Channel.c linux-2.6.32.44/drivers/staging/hv/Channel.c
+--- linux-2.6.32.44/drivers/staging/hv/Channel.c 2011-04-17 17:00:52.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/hv/Channel.c 2011-05-04 17:56:28.000000000 -0400
@@ -464,8 +464,8 @@ int VmbusChannelEstablishGpadl(struct vm
DPRINT_ENTER(VMBUS);
@@ -38213,9 +38161,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/hv/Channel.c linux-2.6.32.43/drivers/
VmbusChannelCreateGpadlHeader(Kbuffer, Size, &msgInfo, &msgCount);
ASSERT(msgInfo != NULL);
-diff -urNp linux-2.6.32.43/drivers/staging/hv/Hv.c linux-2.6.32.43/drivers/staging/hv/Hv.c
---- linux-2.6.32.43/drivers/staging/hv/Hv.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/hv/Hv.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/hv/Hv.c linux-2.6.32.44/drivers/staging/hv/Hv.c
+--- linux-2.6.32.44/drivers/staging/hv/Hv.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/hv/Hv.c 2011-04-17 15:56:46.000000000 -0400
@@ -161,7 +161,7 @@ static u64 HvDoHypercall(u64 Control, vo
u64 outputAddress = (Output) ? virt_to_phys(Output) : 0;
u32 outputAddressHi = outputAddress >> 32;
@@ -38225,9 +38173,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/hv/Hv.c linux-2.6.32.43/drivers/stagi
DPRINT_DBG(VMBUS, "Hypercall <control %llx input %p output %p>",
Control, Input, Output);
-diff -urNp linux-2.6.32.43/drivers/staging/hv/vmbus_drv.c linux-2.6.32.43/drivers/staging/hv/vmbus_drv.c
---- linux-2.6.32.43/drivers/staging/hv/vmbus_drv.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/hv/vmbus_drv.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/hv/vmbus_drv.c linux-2.6.32.44/drivers/staging/hv/vmbus_drv.c
+--- linux-2.6.32.44/drivers/staging/hv/vmbus_drv.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/hv/vmbus_drv.c 2011-05-04 17:56:28.000000000 -0400
@@ -532,7 +532,7 @@ static int vmbus_child_device_register(s
to_device_context(root_device_obj);
struct device_context *child_device_ctx =
@@ -38246,9 +38194,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/hv/vmbus_drv.c linux-2.6.32.43/driver
/* The new device belongs to this bus */
child_device_ctx->device.bus = &g_vmbus_drv.bus; /* device->dev.bus; */
-diff -urNp linux-2.6.32.43/drivers/staging/hv/VmbusPrivate.h linux-2.6.32.43/drivers/staging/hv/VmbusPrivate.h
---- linux-2.6.32.43/drivers/staging/hv/VmbusPrivate.h 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/hv/VmbusPrivate.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/hv/VmbusPrivate.h linux-2.6.32.44/drivers/staging/hv/VmbusPrivate.h
+--- linux-2.6.32.44/drivers/staging/hv/VmbusPrivate.h 2011-04-17 17:00:52.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/hv/VmbusPrivate.h 2011-05-04 17:56:28.000000000 -0400
@@ -59,7 +59,7 @@ enum VMBUS_CONNECT_STATE {
struct VMBUS_CONNECTION {
enum VMBUS_CONNECT_STATE ConnectState;
@@ -38258,9 +38206,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/hv/VmbusPrivate.h linux-2.6.32.43/dri
/*
* Represents channel interrupts. Each bit position represents a
-diff -urNp linux-2.6.32.43/drivers/staging/octeon/ethernet.c linux-2.6.32.43/drivers/staging/octeon/ethernet.c
---- linux-2.6.32.43/drivers/staging/octeon/ethernet.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/octeon/ethernet.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/octeon/ethernet.c linux-2.6.32.44/drivers/staging/octeon/ethernet.c
+--- linux-2.6.32.44/drivers/staging/octeon/ethernet.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/octeon/ethernet.c 2011-05-04 17:56:28.000000000 -0400
@@ -294,11 +294,11 @@ static struct net_device_stats *cvm_oct_
* since the RX tasklet also increments it.
*/
@@ -38277,9 +38225,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/octeon/ethernet.c linux-2.6.32.43/dri
#endif
}
-diff -urNp linux-2.6.32.43/drivers/staging/octeon/ethernet-rx.c linux-2.6.32.43/drivers/staging/octeon/ethernet-rx.c
---- linux-2.6.32.43/drivers/staging/octeon/ethernet-rx.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/octeon/ethernet-rx.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/octeon/ethernet-rx.c linux-2.6.32.44/drivers/staging/octeon/ethernet-rx.c
+--- linux-2.6.32.44/drivers/staging/octeon/ethernet-rx.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/octeon/ethernet-rx.c 2011-05-04 17:56:28.000000000 -0400
@@ -406,11 +406,11 @@ void cvm_oct_tasklet_rx(unsigned long un
/* Increment RX stats for virtual ports */
if (work->ipprt >= CVMX_PIP_NUM_INPUT_PORTS) {
@@ -38308,9 +38256,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/octeon/ethernet-rx.c linux-2.6.32.43/
#endif
dev_kfree_skb_irq(skb);
}
-diff -urNp linux-2.6.32.43/drivers/staging/panel/panel.c linux-2.6.32.43/drivers/staging/panel/panel.c
---- linux-2.6.32.43/drivers/staging/panel/panel.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/panel/panel.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/panel/panel.c linux-2.6.32.44/drivers/staging/panel/panel.c
+--- linux-2.6.32.44/drivers/staging/panel/panel.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/panel/panel.c 2011-04-17 15:56:46.000000000 -0400
@@ -1305,7 +1305,7 @@ static int lcd_release(struct inode *ino
return 0;
}
@@ -38329,9 +38277,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/panel/panel.c linux-2.6.32.43/drivers
.read = keypad_read, /* read */
.open = keypad_open, /* open */
.release = keypad_release, /* close */
-diff -urNp linux-2.6.32.43/drivers/staging/phison/phison.c linux-2.6.32.43/drivers/staging/phison/phison.c
---- linux-2.6.32.43/drivers/staging/phison/phison.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/phison/phison.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/phison/phison.c linux-2.6.32.44/drivers/staging/phison/phison.c
+--- linux-2.6.32.44/drivers/staging/phison/phison.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/phison/phison.c 2011-04-17 15:56:46.000000000 -0400
@@ -43,7 +43,7 @@ static struct scsi_host_template phison_
ATA_BMDMA_SHT(DRV_NAME),
};
@@ -38341,9 +38289,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/phison/phison.c linux-2.6.32.43/drive
.inherits = &ata_bmdma_port_ops,
.prereset = phison_pre_reset,
};
-diff -urNp linux-2.6.32.43/drivers/staging/poch/poch.c linux-2.6.32.43/drivers/staging/poch/poch.c
---- linux-2.6.32.43/drivers/staging/poch/poch.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/poch/poch.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/poch/poch.c linux-2.6.32.44/drivers/staging/poch/poch.c
+--- linux-2.6.32.44/drivers/staging/poch/poch.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/poch/poch.c 2011-04-17 15:56:46.000000000 -0400
@@ -1057,7 +1057,7 @@ static int poch_ioctl(struct inode *inod
return 0;
}
@@ -38353,9 +38301,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/poch/poch.c linux-2.6.32.43/drivers/s
.owner = THIS_MODULE,
.open = poch_open,
.release = poch_release,
-diff -urNp linux-2.6.32.43/drivers/staging/pohmelfs/inode.c linux-2.6.32.43/drivers/staging/pohmelfs/inode.c
---- linux-2.6.32.43/drivers/staging/pohmelfs/inode.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/pohmelfs/inode.c 2011-05-04 17:56:20.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/pohmelfs/inode.c linux-2.6.32.44/drivers/staging/pohmelfs/inode.c
+--- linux-2.6.32.44/drivers/staging/pohmelfs/inode.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/pohmelfs/inode.c 2011-05-04 17:56:20.000000000 -0400
@@ -1850,7 +1850,7 @@ static int pohmelfs_fill_super(struct su
mutex_init(&psb->mcache_lock);
psb->mcache_root = RB_ROOT;
@@ -38374,9 +38322,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/pohmelfs/inode.c linux-2.6.32.43/driv
atomic_long_set(&psb->total_inodes, 0);
mutex_init(&psb->state_lock);
-diff -urNp linux-2.6.32.43/drivers/staging/pohmelfs/mcache.c linux-2.6.32.43/drivers/staging/pohmelfs/mcache.c
---- linux-2.6.32.43/drivers/staging/pohmelfs/mcache.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/pohmelfs/mcache.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/pohmelfs/mcache.c linux-2.6.32.44/drivers/staging/pohmelfs/mcache.c
+--- linux-2.6.32.44/drivers/staging/pohmelfs/mcache.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/pohmelfs/mcache.c 2011-04-17 15:56:46.000000000 -0400
@@ -121,7 +121,7 @@ struct pohmelfs_mcache *pohmelfs_mcache_
m->data = data;
m->start = start;
@@ -38386,9 +38334,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/pohmelfs/mcache.c linux-2.6.32.43/dri
mutex_lock(&psb->mcache_lock);
err = pohmelfs_mcache_insert(psb, m);
-diff -urNp linux-2.6.32.43/drivers/staging/pohmelfs/netfs.h linux-2.6.32.43/drivers/staging/pohmelfs/netfs.h
---- linux-2.6.32.43/drivers/staging/pohmelfs/netfs.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/pohmelfs/netfs.h 2011-05-04 17:56:20.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/pohmelfs/netfs.h linux-2.6.32.44/drivers/staging/pohmelfs/netfs.h
+--- linux-2.6.32.44/drivers/staging/pohmelfs/netfs.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/pohmelfs/netfs.h 2011-05-04 17:56:20.000000000 -0400
@@ -570,14 +570,14 @@ struct pohmelfs_config;
struct pohmelfs_sb {
struct rb_root mcache_root;
@@ -38406,9 +38354,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/pohmelfs/netfs.h linux-2.6.32.43/driv
unsigned int crypto_attached_size;
unsigned int crypto_align_size;
-diff -urNp linux-2.6.32.43/drivers/staging/pohmelfs/trans.c linux-2.6.32.43/drivers/staging/pohmelfs/trans.c
---- linux-2.6.32.43/drivers/staging/pohmelfs/trans.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/pohmelfs/trans.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/pohmelfs/trans.c linux-2.6.32.44/drivers/staging/pohmelfs/trans.c
+--- linux-2.6.32.44/drivers/staging/pohmelfs/trans.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/pohmelfs/trans.c 2011-05-04 17:56:28.000000000 -0400
@@ -492,7 +492,7 @@ int netfs_trans_finish(struct netfs_tran
int err;
struct netfs_cmd *cmd = t->iovec.iov_base;
@@ -38418,9 +38366,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/pohmelfs/trans.c linux-2.6.32.43/driv
cmd->size = t->iovec.iov_len - sizeof(struct netfs_cmd) +
t->attached_size + t->attached_pages * sizeof(struct netfs_cmd);
-diff -urNp linux-2.6.32.43/drivers/staging/sep/sep_driver.c linux-2.6.32.43/drivers/staging/sep/sep_driver.c
---- linux-2.6.32.43/drivers/staging/sep/sep_driver.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/sep/sep_driver.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/sep/sep_driver.c linux-2.6.32.44/drivers/staging/sep/sep_driver.c
+--- linux-2.6.32.44/drivers/staging/sep/sep_driver.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/sep/sep_driver.c 2011-04-17 15:56:46.000000000 -0400
@@ -2603,7 +2603,7 @@ static struct pci_driver sep_pci_driver
static dev_t sep_devno;
@@ -38430,9 +38378,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/sep/sep_driver.c linux-2.6.32.43/driv
.owner = THIS_MODULE,
.ioctl = sep_ioctl,
.poll = sep_poll,
-diff -urNp linux-2.6.32.43/drivers/staging/usbip/vhci.h linux-2.6.32.43/drivers/staging/usbip/vhci.h
---- linux-2.6.32.43/drivers/staging/usbip/vhci.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/usbip/vhci.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/usbip/vhci.h linux-2.6.32.44/drivers/staging/usbip/vhci.h
+--- linux-2.6.32.44/drivers/staging/usbip/vhci.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/usbip/vhci.h 2011-05-04 17:56:28.000000000 -0400
@@ -92,7 +92,7 @@ struct vhci_hcd {
unsigned resuming:1;
unsigned long re_timeout;
@@ -38442,9 +38390,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/usbip/vhci.h linux-2.6.32.43/drivers/
/*
* NOTE:
-diff -urNp linux-2.6.32.43/drivers/staging/usbip/vhci_hcd.c linux-2.6.32.43/drivers/staging/usbip/vhci_hcd.c
---- linux-2.6.32.43/drivers/staging/usbip/vhci_hcd.c 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/usbip/vhci_hcd.c 2011-05-10 22:12:33.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/usbip/vhci_hcd.c linux-2.6.32.44/drivers/staging/usbip/vhci_hcd.c
+--- linux-2.6.32.44/drivers/staging/usbip/vhci_hcd.c 2011-05-10 22:12:01.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/usbip/vhci_hcd.c 2011-05-10 22:12:33.000000000 -0400
@@ -534,7 +534,7 @@ static void vhci_tx_urb(struct urb *urb)
return;
}
@@ -38472,9 +38420,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/usbip/vhci_hcd.c linux-2.6.32.43/driv
spin_lock_init(&vhci->lock);
-diff -urNp linux-2.6.32.43/drivers/staging/usbip/vhci_rx.c linux-2.6.32.43/drivers/staging/usbip/vhci_rx.c
---- linux-2.6.32.43/drivers/staging/usbip/vhci_rx.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/usbip/vhci_rx.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/usbip/vhci_rx.c linux-2.6.32.44/drivers/staging/usbip/vhci_rx.c
+--- linux-2.6.32.44/drivers/staging/usbip/vhci_rx.c 2011-04-17 17:00:52.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/usbip/vhci_rx.c 2011-05-04 17:56:28.000000000 -0400
@@ -78,7 +78,7 @@ static void vhci_recv_ret_submit(struct
usbip_uerr("cannot find a urb of seqnum %u\n",
pdu->base.seqnum);
@@ -38484,9 +38432,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/usbip/vhci_rx.c linux-2.6.32.43/drive
usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
return;
}
-diff -urNp linux-2.6.32.43/drivers/staging/vme/devices/vme_user.c linux-2.6.32.43/drivers/staging/vme/devices/vme_user.c
---- linux-2.6.32.43/drivers/staging/vme/devices/vme_user.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/staging/vme/devices/vme_user.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/staging/vme/devices/vme_user.c linux-2.6.32.44/drivers/staging/vme/devices/vme_user.c
+--- linux-2.6.32.44/drivers/staging/vme/devices/vme_user.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/staging/vme/devices/vme_user.c 2011-04-17 15:56:46.000000000 -0400
@@ -136,7 +136,7 @@ static int vme_user_ioctl(struct inode *
static int __init vme_user_probe(struct device *, int, int);
static int __exit vme_user_remove(struct device *, int, int);
@@ -38496,9 +38444,9 @@ diff -urNp linux-2.6.32.43/drivers/staging/vme/devices/vme_user.c linux-2.6.32.4
.open = vme_user_open,
.release = vme_user_release,
.read = vme_user_read,
-diff -urNp linux-2.6.32.43/drivers/telephony/ixj.c linux-2.6.32.43/drivers/telephony/ixj.c
---- linux-2.6.32.43/drivers/telephony/ixj.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/telephony/ixj.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/telephony/ixj.c linux-2.6.32.44/drivers/telephony/ixj.c
+--- linux-2.6.32.44/drivers/telephony/ixj.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/telephony/ixj.c 2011-05-16 21:46:57.000000000 -0400
@@ -4976,6 +4976,8 @@ static int ixj_daa_cid_read(IXJ *j)
bool mContinue;
char *pIn, *pOut;
@@ -38508,9 +38456,9 @@ diff -urNp linux-2.6.32.43/drivers/telephony/ixj.c linux-2.6.32.43/drivers/telep
if (!SCI_Prepare(j))
return 0;
-diff -urNp linux-2.6.32.43/drivers/uio/uio.c linux-2.6.32.43/drivers/uio/uio.c
---- linux-2.6.32.43/drivers/uio/uio.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/uio/uio.c 2011-05-04 17:56:20.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/uio/uio.c linux-2.6.32.44/drivers/uio/uio.c
+--- linux-2.6.32.44/drivers/uio/uio.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/uio/uio.c 2011-05-04 17:56:20.000000000 -0400
@@ -23,6 +23,7 @@
#include <linux/string.h>
#include <linux/kobject.h>
@@ -38620,9 +38568,9 @@ diff -urNp linux-2.6.32.43/drivers/uio/uio.c linux-2.6.32.43/drivers/uio/uio.c
ret = uio_get_minor(idev);
if (ret)
-diff -urNp linux-2.6.32.43/drivers/usb/atm/usbatm.c linux-2.6.32.43/drivers/usb/atm/usbatm.c
---- linux-2.6.32.43/drivers/usb/atm/usbatm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/usb/atm/usbatm.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/usb/atm/usbatm.c linux-2.6.32.44/drivers/usb/atm/usbatm.c
+--- linux-2.6.32.44/drivers/usb/atm/usbatm.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/usb/atm/usbatm.c 2011-04-17 15:56:46.000000000 -0400
@@ -333,7 +333,7 @@ static void usbatm_extract_one_cell(stru
if (printk_ratelimit())
atm_warn(instance, "%s: OAM not supported (vpi %d, vci %d)!\n",
@@ -38702,9 +38650,9 @@ diff -urNp linux-2.6.32.43/drivers/usb/atm/usbatm.c linux-2.6.32.43/drivers/usb/
if (!left--) {
if (instance->disconnected)
-diff -urNp linux-2.6.32.43/drivers/usb/class/cdc-wdm.c linux-2.6.32.43/drivers/usb/class/cdc-wdm.c
---- linux-2.6.32.43/drivers/usb/class/cdc-wdm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/usb/class/cdc-wdm.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/usb/class/cdc-wdm.c linux-2.6.32.44/drivers/usb/class/cdc-wdm.c
+--- linux-2.6.32.44/drivers/usb/class/cdc-wdm.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/usb/class/cdc-wdm.c 2011-04-17 15:56:46.000000000 -0400
@@ -314,7 +314,7 @@ static ssize_t wdm_write
if (r < 0)
goto outnp;
@@ -38714,9 +38662,9 @@ diff -urNp linux-2.6.32.43/drivers/usb/class/cdc-wdm.c linux-2.6.32.43/drivers/u
r = wait_event_interruptible(desc->wait, !test_bit(WDM_IN_USE,
&desc->flags));
else
-diff -urNp linux-2.6.32.43/drivers/usb/core/hcd.c linux-2.6.32.43/drivers/usb/core/hcd.c
---- linux-2.6.32.43/drivers/usb/core/hcd.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/usb/core/hcd.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/usb/core/hcd.c linux-2.6.32.44/drivers/usb/core/hcd.c
+--- linux-2.6.32.44/drivers/usb/core/hcd.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/usb/core/hcd.c 2011-04-17 15:56:46.000000000 -0400
@@ -2216,7 +2216,7 @@ EXPORT_SYMBOL_GPL(usb_hcd_platform_shutd
#if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
@@ -38735,9 +38683,9 @@ diff -urNp linux-2.6.32.43/drivers/usb/core/hcd.c linux-2.6.32.43/drivers/usb/co
{
if (mon_ops)
-diff -urNp linux-2.6.32.43/drivers/usb/core/hcd.h linux-2.6.32.43/drivers/usb/core/hcd.h
---- linux-2.6.32.43/drivers/usb/core/hcd.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/usb/core/hcd.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/usb/core/hcd.h linux-2.6.32.44/drivers/usb/core/hcd.h
+--- linux-2.6.32.44/drivers/usb/core/hcd.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/usb/core/hcd.h 2011-04-17 15:56:46.000000000 -0400
@@ -486,13 +486,13 @@ static inline void usbfs_cleanup(void) {
#if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
@@ -38765,9 +38713,9 @@ diff -urNp linux-2.6.32.43/drivers/usb/core/hcd.h linux-2.6.32.43/drivers/usb/co
void usb_mon_deregister(void);
#else
-diff -urNp linux-2.6.32.43/drivers/usb/core/message.c linux-2.6.32.43/drivers/usb/core/message.c
---- linux-2.6.32.43/drivers/usb/core/message.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/usb/core/message.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/usb/core/message.c linux-2.6.32.44/drivers/usb/core/message.c
+--- linux-2.6.32.44/drivers/usb/core/message.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/usb/core/message.c 2011-04-17 15:56:46.000000000 -0400
@@ -914,8 +914,8 @@ char *usb_cache_string(struct usb_device
buf = kmalloc(MAX_USB_STRING_SIZE, GFP_NOIO);
if (buf) {
@@ -38779,9 +38727,9 @@ diff -urNp linux-2.6.32.43/drivers/usb/core/message.c linux-2.6.32.43/drivers/us
if (!smallbuf)
return buf;
memcpy(smallbuf, buf, len);
-diff -urNp linux-2.6.32.43/drivers/usb/misc/appledisplay.c linux-2.6.32.43/drivers/usb/misc/appledisplay.c
---- linux-2.6.32.43/drivers/usb/misc/appledisplay.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/usb/misc/appledisplay.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/usb/misc/appledisplay.c linux-2.6.32.44/drivers/usb/misc/appledisplay.c
+--- linux-2.6.32.44/drivers/usb/misc/appledisplay.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/usb/misc/appledisplay.c 2011-04-17 15:56:46.000000000 -0400
@@ -178,7 +178,7 @@ static int appledisplay_bl_get_brightnes
return pdata->msgdata[1];
}
@@ -38791,9 +38739,9 @@ diff -urNp linux-2.6.32.43/drivers/usb/misc/appledisplay.c linux-2.6.32.43/drive
.get_brightness = appledisplay_bl_get_brightness,
.update_status = appledisplay_bl_update_status,
};
-diff -urNp linux-2.6.32.43/drivers/usb/mon/mon_main.c linux-2.6.32.43/drivers/usb/mon/mon_main.c
---- linux-2.6.32.43/drivers/usb/mon/mon_main.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/usb/mon/mon_main.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/usb/mon/mon_main.c linux-2.6.32.44/drivers/usb/mon/mon_main.c
+--- linux-2.6.32.44/drivers/usb/mon/mon_main.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/usb/mon/mon_main.c 2011-04-17 15:56:46.000000000 -0400
@@ -238,7 +238,7 @@ static struct notifier_block mon_nb = {
/*
* Ops
@@ -38803,9 +38751,9 @@ diff -urNp linux-2.6.32.43/drivers/usb/mon/mon_main.c linux-2.6.32.43/drivers/us
.urb_submit = mon_submit,
.urb_submit_error = mon_submit_error,
.urb_complete = mon_complete,
-diff -urNp linux-2.6.32.43/drivers/usb/wusbcore/wa-hc.h linux-2.6.32.43/drivers/usb/wusbcore/wa-hc.h
---- linux-2.6.32.43/drivers/usb/wusbcore/wa-hc.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/usb/wusbcore/wa-hc.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/usb/wusbcore/wa-hc.h linux-2.6.32.44/drivers/usb/wusbcore/wa-hc.h
+--- linux-2.6.32.44/drivers/usb/wusbcore/wa-hc.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/usb/wusbcore/wa-hc.h 2011-05-04 17:56:28.000000000 -0400
@@ -192,7 +192,7 @@ struct wahc {
struct list_head xfer_delayed_list;
spinlock_t xfer_list_lock;
@@ -38824,9 +38772,9 @@ diff -urNp linux-2.6.32.43/drivers/usb/wusbcore/wa-hc.h linux-2.6.32.43/drivers/
}
/**
-diff -urNp linux-2.6.32.43/drivers/usb/wusbcore/wa-xfer.c linux-2.6.32.43/drivers/usb/wusbcore/wa-xfer.c
---- linux-2.6.32.43/drivers/usb/wusbcore/wa-xfer.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/usb/wusbcore/wa-xfer.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/usb/wusbcore/wa-xfer.c linux-2.6.32.44/drivers/usb/wusbcore/wa-xfer.c
+--- linux-2.6.32.44/drivers/usb/wusbcore/wa-xfer.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/usb/wusbcore/wa-xfer.c 2011-05-04 17:56:28.000000000 -0400
@@ -293,7 +293,7 @@ out:
*/
static void wa_xfer_id_init(struct wa_xfer *xfer)
@@ -38836,9 +38784,9 @@ diff -urNp linux-2.6.32.43/drivers/usb/wusbcore/wa-xfer.c linux-2.6.32.43/driver
}
/*
-diff -urNp linux-2.6.32.43/drivers/uwb/wlp/messages.c linux-2.6.32.43/drivers/uwb/wlp/messages.c
---- linux-2.6.32.43/drivers/uwb/wlp/messages.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/uwb/wlp/messages.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/uwb/wlp/messages.c linux-2.6.32.44/drivers/uwb/wlp/messages.c
+--- linux-2.6.32.44/drivers/uwb/wlp/messages.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/uwb/wlp/messages.c 2011-04-17 15:56:46.000000000 -0400
@@ -903,7 +903,7 @@ int wlp_parse_f0(struct wlp *wlp, struct
size_t len = skb->len;
size_t used;
@@ -38848,9 +38796,9 @@ diff -urNp linux-2.6.32.43/drivers/uwb/wlp/messages.c linux-2.6.32.43/drivers/uw
enum wlp_assc_error assc_err;
char enonce_buf[WLP_WSS_NONCE_STRSIZE];
char rnonce_buf[WLP_WSS_NONCE_STRSIZE];
-diff -urNp linux-2.6.32.43/drivers/uwb/wlp/sysfs.c linux-2.6.32.43/drivers/uwb/wlp/sysfs.c
---- linux-2.6.32.43/drivers/uwb/wlp/sysfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/uwb/wlp/sysfs.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/uwb/wlp/sysfs.c linux-2.6.32.44/drivers/uwb/wlp/sysfs.c
+--- linux-2.6.32.44/drivers/uwb/wlp/sysfs.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/uwb/wlp/sysfs.c 2011-04-17 15:56:46.000000000 -0400
@@ -615,8 +615,7 @@ ssize_t wlp_wss_attr_store(struct kobjec
return ret;
}
@@ -38861,9 +38809,9 @@ diff -urNp linux-2.6.32.43/drivers/uwb/wlp/sysfs.c linux-2.6.32.43/drivers/uwb/w
.show = wlp_wss_attr_show,
.store = wlp_wss_attr_store,
};
-diff -urNp linux-2.6.32.43/drivers/video/atmel_lcdfb.c linux-2.6.32.43/drivers/video/atmel_lcdfb.c
---- linux-2.6.32.43/drivers/video/atmel_lcdfb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/video/atmel_lcdfb.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/video/atmel_lcdfb.c linux-2.6.32.44/drivers/video/atmel_lcdfb.c
+--- linux-2.6.32.44/drivers/video/atmel_lcdfb.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/video/atmel_lcdfb.c 2011-04-17 15:56:46.000000000 -0400
@@ -110,7 +110,7 @@ static int atmel_bl_get_brightness(struc
return lcdc_readl(sinfo, ATMEL_LCDC_CONTRAST_VAL);
}
@@ -38873,9 +38821,9 @@ diff -urNp linux-2.6.32.43/drivers/video/atmel_lcdfb.c linux-2.6.32.43/drivers/v
.update_status = atmel_bl_update_status,
.get_brightness = atmel_bl_get_brightness,
};
-diff -urNp linux-2.6.32.43/drivers/video/aty/aty128fb.c linux-2.6.32.43/drivers/video/aty/aty128fb.c
---- linux-2.6.32.43/drivers/video/aty/aty128fb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/video/aty/aty128fb.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/video/aty/aty128fb.c linux-2.6.32.44/drivers/video/aty/aty128fb.c
+--- linux-2.6.32.44/drivers/video/aty/aty128fb.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/video/aty/aty128fb.c 2011-04-17 15:56:46.000000000 -0400
@@ -1787,7 +1787,7 @@ static int aty128_bl_get_brightness(stru
return bd->props.brightness;
}
@@ -38885,9 +38833,9 @@ diff -urNp linux-2.6.32.43/drivers/video/aty/aty128fb.c linux-2.6.32.43/drivers/
.get_brightness = aty128_bl_get_brightness,
.update_status = aty128_bl_update_status,
};
-diff -urNp linux-2.6.32.43/drivers/video/aty/atyfb_base.c linux-2.6.32.43/drivers/video/aty/atyfb_base.c
---- linux-2.6.32.43/drivers/video/aty/atyfb_base.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/video/aty/atyfb_base.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/video/aty/atyfb_base.c linux-2.6.32.44/drivers/video/aty/atyfb_base.c
+--- linux-2.6.32.44/drivers/video/aty/atyfb_base.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/video/aty/atyfb_base.c 2011-04-17 15:56:46.000000000 -0400
@@ -2225,7 +2225,7 @@ static int aty_bl_get_brightness(struct
return bd->props.brightness;
}
@@ -38897,9 +38845,9 @@ diff -urNp linux-2.6.32.43/drivers/video/aty/atyfb_base.c linux-2.6.32.43/driver
.get_brightness = aty_bl_get_brightness,
.update_status = aty_bl_update_status,
};
-diff -urNp linux-2.6.32.43/drivers/video/aty/radeon_backlight.c linux-2.6.32.43/drivers/video/aty/radeon_backlight.c
---- linux-2.6.32.43/drivers/video/aty/radeon_backlight.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/video/aty/radeon_backlight.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/video/aty/radeon_backlight.c linux-2.6.32.44/drivers/video/aty/radeon_backlight.c
+--- linux-2.6.32.44/drivers/video/aty/radeon_backlight.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/video/aty/radeon_backlight.c 2011-04-17 15:56:46.000000000 -0400
@@ -127,7 +127,7 @@ static int radeon_bl_get_brightness(stru
return bd->props.brightness;
}
@@ -38909,9 +38857,9 @@ diff -urNp linux-2.6.32.43/drivers/video/aty/radeon_backlight.c linux-2.6.32.43/
.get_brightness = radeon_bl_get_brightness,
.update_status = radeon_bl_update_status,
};
-diff -urNp linux-2.6.32.43/drivers/video/backlight/adp5520_bl.c linux-2.6.32.43/drivers/video/backlight/adp5520_bl.c
---- linux-2.6.32.43/drivers/video/backlight/adp5520_bl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/video/backlight/adp5520_bl.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/video/backlight/adp5520_bl.c linux-2.6.32.44/drivers/video/backlight/adp5520_bl.c
+--- linux-2.6.32.44/drivers/video/backlight/adp5520_bl.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/video/backlight/adp5520_bl.c 2011-04-17 15:56:46.000000000 -0400
@@ -84,7 +84,7 @@ static int adp5520_bl_get_brightness(str
return error ? data->current_brightness : reg_val;
}
@@ -38921,9 +38869,9 @@ diff -urNp linux-2.6.32.43/drivers/video/backlight/adp5520_bl.c linux-2.6.32.43/
.update_status = adp5520_bl_update_status,
.get_brightness = adp5520_bl_get_brightness,
};
-diff -urNp linux-2.6.32.43/drivers/video/backlight/adx_bl.c linux-2.6.32.43/drivers/video/backlight/adx_bl.c
---- linux-2.6.32.43/drivers/video/backlight/adx_bl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/video/backlight/adx_bl.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/video/backlight/adx_bl.c linux-2.6.32.44/drivers/video/backlight/adx_bl.c
+--- linux-2.6.32.44/drivers/video/backlight/adx_bl.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/video/backlight/adx_bl.c 2011-04-17 15:56:46.000000000 -0400
@@ -61,7 +61,7 @@ static int adx_backlight_check_fb(struct
return 1;
}
@@ -38933,9 +38881,9 @@ diff -urNp linux-2.6.32.43/drivers/video/backlight/adx_bl.c linux-2.6.32.43/driv
.options = 0,
.update_status = adx_backlight_update_status,
.get_brightness = adx_backlight_get_brightness,
-diff -urNp linux-2.6.32.43/drivers/video/backlight/atmel-pwm-bl.c linux-2.6.32.43/drivers/video/backlight/atmel-pwm-bl.c
---- linux-2.6.32.43/drivers/video/backlight/atmel-pwm-bl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/video/backlight/atmel-pwm-bl.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/video/backlight/atmel-pwm-bl.c linux-2.6.32.44/drivers/video/backlight/atmel-pwm-bl.c
+--- linux-2.6.32.44/drivers/video/backlight/atmel-pwm-bl.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/video/backlight/atmel-pwm-bl.c 2011-04-17 15:56:46.000000000 -0400
@@ -113,7 +113,7 @@ static int atmel_pwm_bl_init_pwm(struct
return pwm_channel_enable(&pwmbl->pwmc);
}
@@ -38945,9 +38893,9 @@ diff -urNp linux-2.6.32.43/drivers/video/backlight/atmel-pwm-bl.c linux-2.6.32.4
.get_brightness = atmel_pwm_bl_get_intensity,
.update_status = atmel_pwm_bl_set_intensity,
};
-diff -urNp linux-2.6.32.43/drivers/video/backlight/backlight.c linux-2.6.32.43/drivers/video/backlight/backlight.c
---- linux-2.6.32.43/drivers/video/backlight/backlight.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/video/backlight/backlight.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/video/backlight/backlight.c linux-2.6.32.44/drivers/video/backlight/backlight.c
+--- linux-2.6.32.44/drivers/video/backlight/backlight.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/video/backlight/backlight.c 2011-04-17 15:56:46.000000000 -0400
@@ -269,7 +269,7 @@ EXPORT_SYMBOL(backlight_force_update);
* ERR_PTR() or a pointer to the newly allocated device.
*/
@@ -38957,9 +38905,9 @@ diff -urNp linux-2.6.32.43/drivers/video/backlight/backlight.c linux-2.6.32.43/d
{
struct backlight_device *new_bd;
int rc;
-diff -urNp linux-2.6.32.43/drivers/video/backlight/corgi_lcd.c linux-2.6.32.43/drivers/video/backlight/corgi_lcd.c
---- linux-2.6.32.43/drivers/video/backlight/corgi_lcd.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/video/backlight/corgi_lcd.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/video/backlight/corgi_lcd.c linux-2.6.32.44/drivers/video/backlight/corgi_lcd.c
+--- linux-2.6.32.44/drivers/video/backlight/corgi_lcd.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/video/backlight/corgi_lcd.c 2011-04-17 15:56:46.000000000 -0400
@@ -451,7 +451,7 @@ void corgi_lcd_limit_intensity(int limit
}
EXPORT_SYMBOL(corgi_lcd_limit_intensity);
@@ -38969,9 +38917,9 @@ diff -urNp linux-2.6.32.43/drivers/video/backlight/corgi_lcd.c linux-2.6.32.43/d
.get_brightness = corgi_bl_get_intensity,
.update_status = corgi_bl_update_status,
};
-diff -urNp linux-2.6.32.43/drivers/video/backlight/cr_bllcd.c linux-2.6.32.43/drivers/video/backlight/cr_bllcd.c
---- linux-2.6.32.43/drivers/video/backlight/cr_bllcd.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/video/backlight/cr_bllcd.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/video/backlight/cr_bllcd.c linux-2.6.32.44/drivers/video/backlight/cr_bllcd.c
+--- linux-2.6.32.44/drivers/video/backlight/cr_bllcd.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/video/backlight/cr_bllcd.c 2011-04-17 15:56:46.000000000 -0400
@@ -108,7 +108,7 @@ static int cr_backlight_get_intensity(st
return intensity;
}
@@ -38981,9 +38929,9 @@ diff -urNp linux-2.6.32.43/drivers/video/backlight/cr_bllcd.c linux-2.6.32.43/dr
.get_brightness = cr_backlight_get_intensity,
.update_status = cr_backlight_set_intensity,
};
-diff -urNp linux-2.6.32.43/drivers/video/backlight/da903x_bl.c linux-2.6.32.43/drivers/video/backlight/da903x_bl.c
---- linux-2.6.32.43/drivers/video/backlight/da903x_bl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/video/backlight/da903x_bl.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/video/backlight/da903x_bl.c linux-2.6.32.44/drivers/video/backlight/da903x_bl.c
+--- linux-2.6.32.44/drivers/video/backlight/da903x_bl.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/video/backlight/da903x_bl.c 2011-04-17 15:56:46.000000000 -0400
@@ -94,7 +94,7 @@ static int da903x_backlight_get_brightne
return data->current_brightness;
}
@@ -38993,9 +38941,9 @@ diff -urNp linux-2.6.32.43/drivers/video/backlight/da903x_bl.c linux-2.6.32.43/d
.update_status = da903x_backlight_update_status,
.get_brightness = da903x_backlight_get_brightness,
};
-diff -urNp linux-2.6.32.43/drivers/video/backlight/generic_bl.c linux-2.6.32.43/drivers/video/backlight/generic_bl.c
---- linux-2.6.32.43/drivers/video/backlight/generic_bl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/video/backlight/generic_bl.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/video/backlight/generic_bl.c linux-2.6.32.44/drivers/video/backlight/generic_bl.c
+--- linux-2.6.32.44/drivers/video/backlight/generic_bl.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/video/backlight/generic_bl.c 2011-04-17 15:56:46.000000000 -0400
@@ -70,7 +70,7 @@ void corgibl_limit_intensity(int limit)
}
EXPORT_SYMBOL(corgibl_limit_intensity);
@@ -39005,9 +38953,9 @@ diff -urNp linux-2.6.32.43/drivers/video/backlight/generic_bl.c linux-2.6.32.43/
.options = BL_CORE_SUSPENDRESUME,
.get_brightness = genericbl_get_intensity,
.update_status = genericbl_send_intensity,
-diff -urNp linux-2.6.32.43/drivers/video/backlight/hp680_bl.c linux-2.6.32.43/drivers/video/backlight/hp680_bl.c
---- linux-2.6.32.43/drivers/video/backlight/hp680_bl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/video/backlight/hp680_bl.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/video/backlight/hp680_bl.c linux-2.6.32.44/drivers/video/backlight/hp680_bl.c
+--- linux-2.6.32.44/drivers/video/backlight/hp680_bl.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/video/backlight/hp680_bl.c 2011-04-17 15:56:46.000000000 -0400
@@ -98,7 +98,7 @@ static int hp680bl_get_intensity(struct
return current_intensity;
}
@@ -39017,9 +38965,9 @@ diff -urNp linux-2.6.32.43/drivers/video/backlight/hp680_bl.c linux-2.6.32.43/dr
.get_brightness = hp680bl_get_intensity,
.update_status = hp680bl_set_intensity,
};
-diff -urNp linux-2.6.32.43/drivers/video/backlight/jornada720_bl.c linux-2.6.32.43/drivers/video/backlight/jornada720_bl.c
---- linux-2.6.32.43/drivers/video/backlight/jornada720_bl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/video/backlight/jornada720_bl.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/video/backlight/jornada720_bl.c linux-2.6.32.44/drivers/video/backlight/jornada720_bl.c
+--- linux-2.6.32.44/drivers/video/backlight/jornada720_bl.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/video/backlight/jornada720_bl.c 2011-04-17 15:56:46.000000000 -0400
@@ -93,7 +93,7 @@ out:
return ret;
}
@@ -39029,9 +38977,9 @@ diff -urNp linux-2.6.32.43/drivers/video/backlight/jornada720_bl.c linux-2.6.32.
.get_brightness = jornada_bl_get_brightness,
.update_status = jornada_bl_update_status,
.options = BL_CORE_SUSPENDRESUME,
-diff -urNp linux-2.6.32.43/drivers/video/backlight/kb3886_bl.c linux-2.6.32.43/drivers/video/backlight/kb3886_bl.c
---- linux-2.6.32.43/drivers/video/backlight/kb3886_bl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/video/backlight/kb3886_bl.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/video/backlight/kb3886_bl.c linux-2.6.32.44/drivers/video/backlight/kb3886_bl.c
+--- linux-2.6.32.44/drivers/video/backlight/kb3886_bl.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/video/backlight/kb3886_bl.c 2011-04-17 15:56:46.000000000 -0400
@@ -134,7 +134,7 @@ static int kb3886bl_get_intensity(struct
return kb3886bl_intensity;
}
@@ -39041,9 +38989,9 @@ diff -urNp linux-2.6.32.43/drivers/video/backlight/kb3886_bl.c linux-2.6.32.43/d
.get_brightness = kb3886bl_get_intensity,
.update_status = kb3886bl_send_intensity,
};
-diff -urNp linux-2.6.32.43/drivers/video/backlight/locomolcd.c linux-2.6.32.43/drivers/video/backlight/locomolcd.c
---- linux-2.6.32.43/drivers/video/backlight/locomolcd.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/video/backlight/locomolcd.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/video/backlight/locomolcd.c linux-2.6.32.44/drivers/video/backlight/locomolcd.c
+--- linux-2.6.32.44/drivers/video/backlight/locomolcd.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/video/backlight/locomolcd.c 2011-04-17 15:56:46.000000000 -0400
@@ -141,7 +141,7 @@ static int locomolcd_get_intensity(struc
return current_intensity;
}
@@ -39053,9 +39001,9 @@ diff -urNp linux-2.6.32.43/drivers/video/backlight/locomolcd.c linux-2.6.32.43/d
.get_brightness = locomolcd_get_intensity,
.update_status = locomolcd_set_intensity,
};
-diff -urNp linux-2.6.32.43/drivers/video/backlight/mbp_nvidia_bl.c linux-2.6.32.43/drivers/video/backlight/mbp_nvidia_bl.c
---- linux-2.6.32.43/drivers/video/backlight/mbp_nvidia_bl.c 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.43/drivers/video/backlight/mbp_nvidia_bl.c 2011-05-10 22:12:33.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/video/backlight/mbp_nvidia_bl.c linux-2.6.32.44/drivers/video/backlight/mbp_nvidia_bl.c
+--- linux-2.6.32.44/drivers/video/backlight/mbp_nvidia_bl.c 2011-05-10 22:12:01.000000000 -0400
++++ linux-2.6.32.44/drivers/video/backlight/mbp_nvidia_bl.c 2011-05-10 22:12:33.000000000 -0400
@@ -33,7 +33,7 @@ struct dmi_match_data {
unsigned long iostart;
unsigned long iolen;
@@ -39065,9 +39013,9 @@ diff -urNp linux-2.6.32.43/drivers/video/backlight/mbp_nvidia_bl.c linux-2.6.32.
};
/* Module parameters. */
-diff -urNp linux-2.6.32.43/drivers/video/backlight/omap1_bl.c linux-2.6.32.43/drivers/video/backlight/omap1_bl.c
---- linux-2.6.32.43/drivers/video/backlight/omap1_bl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/video/backlight/omap1_bl.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/video/backlight/omap1_bl.c linux-2.6.32.44/drivers/video/backlight/omap1_bl.c
+--- linux-2.6.32.44/drivers/video/backlight/omap1_bl.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/video/backlight/omap1_bl.c 2011-04-17 15:56:46.000000000 -0400
@@ -125,7 +125,7 @@ static int omapbl_get_intensity(struct b
return bl->current_intensity;
}
@@ -39077,9 +39025,9 @@ diff -urNp linux-2.6.32.43/drivers/video/backlight/omap1_bl.c linux-2.6.32.43/dr
.get_brightness = omapbl_get_intensity,
.update_status = omapbl_update_status,
};
-diff -urNp linux-2.6.32.43/drivers/video/backlight/progear_bl.c linux-2.6.32.43/drivers/video/backlight/progear_bl.c
---- linux-2.6.32.43/drivers/video/backlight/progear_bl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/video/backlight/progear_bl.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/video/backlight/progear_bl.c linux-2.6.32.44/drivers/video/backlight/progear_bl.c
+--- linux-2.6.32.44/drivers/video/backlight/progear_bl.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/video/backlight/progear_bl.c 2011-04-17 15:56:46.000000000 -0400
@@ -54,7 +54,7 @@ static int progearbl_get_intensity(struc
return intensity - HW_LEVEL_MIN;
}
@@ -39089,9 +39037,9 @@ diff -urNp linux-2.6.32.43/drivers/video/backlight/progear_bl.c linux-2.6.32.43/
.get_brightness = progearbl_get_intensity,
.update_status = progearbl_set_intensity,
};
-diff -urNp linux-2.6.32.43/drivers/video/backlight/pwm_bl.c linux-2.6.32.43/drivers/video/backlight/pwm_bl.c
---- linux-2.6.32.43/drivers/video/backlight/pwm_bl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/video/backlight/pwm_bl.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/video/backlight/pwm_bl.c linux-2.6.32.44/drivers/video/backlight/pwm_bl.c
+--- linux-2.6.32.44/drivers/video/backlight/pwm_bl.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/video/backlight/pwm_bl.c 2011-04-17 15:56:46.000000000 -0400
@@ -56,7 +56,7 @@ static int pwm_backlight_get_brightness(
return bl->props.brightness;
}
@@ -39101,9 +39049,9 @@ diff -urNp linux-2.6.32.43/drivers/video/backlight/pwm_bl.c linux-2.6.32.43/driv
.update_status = pwm_backlight_update_status,
.get_brightness = pwm_backlight_get_brightness,
};
-diff -urNp linux-2.6.32.43/drivers/video/backlight/tosa_bl.c linux-2.6.32.43/drivers/video/backlight/tosa_bl.c
---- linux-2.6.32.43/drivers/video/backlight/tosa_bl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/video/backlight/tosa_bl.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/video/backlight/tosa_bl.c linux-2.6.32.44/drivers/video/backlight/tosa_bl.c
+--- linux-2.6.32.44/drivers/video/backlight/tosa_bl.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/video/backlight/tosa_bl.c 2011-04-17 15:56:46.000000000 -0400
@@ -72,7 +72,7 @@ static int tosa_bl_get_brightness(struct
return props->brightness;
}
@@ -39113,9 +39061,9 @@ diff -urNp linux-2.6.32.43/drivers/video/backlight/tosa_bl.c linux-2.6.32.43/dri
.get_brightness = tosa_bl_get_brightness,
.update_status = tosa_bl_update_status,
};
-diff -urNp linux-2.6.32.43/drivers/video/backlight/wm831x_bl.c linux-2.6.32.43/drivers/video/backlight/wm831x_bl.c
---- linux-2.6.32.43/drivers/video/backlight/wm831x_bl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/video/backlight/wm831x_bl.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/video/backlight/wm831x_bl.c linux-2.6.32.44/drivers/video/backlight/wm831x_bl.c
+--- linux-2.6.32.44/drivers/video/backlight/wm831x_bl.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/video/backlight/wm831x_bl.c 2011-04-17 15:56:46.000000000 -0400
@@ -112,7 +112,7 @@ static int wm831x_backlight_get_brightne
return data->current_brightness;
}
@@ -39125,9 +39073,9 @@ diff -urNp linux-2.6.32.43/drivers/video/backlight/wm831x_bl.c linux-2.6.32.43/d
.options = BL_CORE_SUSPENDRESUME,
.update_status = wm831x_backlight_update_status,
.get_brightness = wm831x_backlight_get_brightness,
-diff -urNp linux-2.6.32.43/drivers/video/bf54x-lq043fb.c linux-2.6.32.43/drivers/video/bf54x-lq043fb.c
---- linux-2.6.32.43/drivers/video/bf54x-lq043fb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/video/bf54x-lq043fb.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/video/bf54x-lq043fb.c linux-2.6.32.44/drivers/video/bf54x-lq043fb.c
+--- linux-2.6.32.44/drivers/video/bf54x-lq043fb.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/video/bf54x-lq043fb.c 2011-04-17 15:56:46.000000000 -0400
@@ -463,7 +463,7 @@ static int bl_get_brightness(struct back
return 0;
}
@@ -39137,9 +39085,9 @@ diff -urNp linux-2.6.32.43/drivers/video/bf54x-lq043fb.c linux-2.6.32.43/drivers
.get_brightness = bl_get_brightness,
};
-diff -urNp linux-2.6.32.43/drivers/video/bfin-t350mcqb-fb.c linux-2.6.32.43/drivers/video/bfin-t350mcqb-fb.c
---- linux-2.6.32.43/drivers/video/bfin-t350mcqb-fb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/video/bfin-t350mcqb-fb.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/video/bfin-t350mcqb-fb.c linux-2.6.32.44/drivers/video/bfin-t350mcqb-fb.c
+--- linux-2.6.32.44/drivers/video/bfin-t350mcqb-fb.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/video/bfin-t350mcqb-fb.c 2011-04-17 15:56:46.000000000 -0400
@@ -381,7 +381,7 @@ static int bl_get_brightness(struct back
return 0;
}
@@ -39149,9 +39097,9 @@ diff -urNp linux-2.6.32.43/drivers/video/bfin-t350mcqb-fb.c linux-2.6.32.43/driv
.get_brightness = bl_get_brightness,
};
-diff -urNp linux-2.6.32.43/drivers/video/fbcmap.c linux-2.6.32.43/drivers/video/fbcmap.c
---- linux-2.6.32.43/drivers/video/fbcmap.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/video/fbcmap.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/video/fbcmap.c linux-2.6.32.44/drivers/video/fbcmap.c
+--- linux-2.6.32.44/drivers/video/fbcmap.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/video/fbcmap.c 2011-04-17 15:56:46.000000000 -0400
@@ -266,8 +266,7 @@ int fb_set_user_cmap(struct fb_cmap_user
rc = -ENODEV;
goto out;
@@ -39162,9 +39110,9 @@ diff -urNp linux-2.6.32.43/drivers/video/fbcmap.c linux-2.6.32.43/drivers/video/
rc = -EINVAL;
goto out1;
}
-diff -urNp linux-2.6.32.43/drivers/video/fbmem.c linux-2.6.32.43/drivers/video/fbmem.c
---- linux-2.6.32.43/drivers/video/fbmem.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/video/fbmem.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/video/fbmem.c linux-2.6.32.44/drivers/video/fbmem.c
+--- linux-2.6.32.44/drivers/video/fbmem.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/video/fbmem.c 2011-05-16 21:46:57.000000000 -0400
@@ -403,7 +403,7 @@ static void fb_do_show_logo(struct fb_in
image->dx += image->width + 8;
}
@@ -39210,9 +39158,9 @@ diff -urNp linux-2.6.32.43/drivers/video/fbmem.c linux-2.6.32.43/drivers/video/f
return -EINVAL;
if (!registered_fb[con2fb.framebuffer])
request_module("fb%d", con2fb.framebuffer);
-diff -urNp linux-2.6.32.43/drivers/video/i810/i810_accel.c linux-2.6.32.43/drivers/video/i810/i810_accel.c
---- linux-2.6.32.43/drivers/video/i810/i810_accel.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/video/i810/i810_accel.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/video/i810/i810_accel.c linux-2.6.32.44/drivers/video/i810/i810_accel.c
+--- linux-2.6.32.44/drivers/video/i810/i810_accel.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/video/i810/i810_accel.c 2011-04-17 15:56:46.000000000 -0400
@@ -73,6 +73,7 @@ static inline int wait_for_space(struct
}
}
@@ -39221,9 +39169,9 @@ diff -urNp linux-2.6.32.43/drivers/video/i810/i810_accel.c linux-2.6.32.43/drive
i810_report_error(mmio);
par->dev_flags |= LOCKUP;
info->pixmap.scan_align = 1;
-diff -urNp linux-2.6.32.43/drivers/video/nvidia/nv_backlight.c linux-2.6.32.43/drivers/video/nvidia/nv_backlight.c
---- linux-2.6.32.43/drivers/video/nvidia/nv_backlight.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/video/nvidia/nv_backlight.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/video/nvidia/nv_backlight.c linux-2.6.32.44/drivers/video/nvidia/nv_backlight.c
+--- linux-2.6.32.44/drivers/video/nvidia/nv_backlight.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/video/nvidia/nv_backlight.c 2011-04-17 15:56:46.000000000 -0400
@@ -87,7 +87,7 @@ static int nvidia_bl_get_brightness(stru
return bd->props.brightness;
}
@@ -39233,9 +39181,9 @@ diff -urNp linux-2.6.32.43/drivers/video/nvidia/nv_backlight.c linux-2.6.32.43/d
.get_brightness = nvidia_bl_get_brightness,
.update_status = nvidia_bl_update_status,
};
-diff -urNp linux-2.6.32.43/drivers/video/riva/fbdev.c linux-2.6.32.43/drivers/video/riva/fbdev.c
---- linux-2.6.32.43/drivers/video/riva/fbdev.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/video/riva/fbdev.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/video/riva/fbdev.c linux-2.6.32.44/drivers/video/riva/fbdev.c
+--- linux-2.6.32.44/drivers/video/riva/fbdev.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/video/riva/fbdev.c 2011-04-17 15:56:46.000000000 -0400
@@ -331,7 +331,7 @@ static int riva_bl_get_brightness(struct
return bd->props.brightness;
}
@@ -39245,9 +39193,9 @@ diff -urNp linux-2.6.32.43/drivers/video/riva/fbdev.c linux-2.6.32.43/drivers/vi
.get_brightness = riva_bl_get_brightness,
.update_status = riva_bl_update_status,
};
-diff -urNp linux-2.6.32.43/drivers/video/uvesafb.c linux-2.6.32.43/drivers/video/uvesafb.c
---- linux-2.6.32.43/drivers/video/uvesafb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/video/uvesafb.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/video/uvesafb.c linux-2.6.32.44/drivers/video/uvesafb.c
+--- linux-2.6.32.44/drivers/video/uvesafb.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/video/uvesafb.c 2011-04-17 15:56:46.000000000 -0400
@@ -18,6 +18,7 @@
#include <linux/fb.h>
#include <linux/io.h>
@@ -39323,9 +39271,9 @@ diff -urNp linux-2.6.32.43/drivers/video/uvesafb.c linux-2.6.32.43/drivers/video
}
framebuffer_release(info);
-diff -urNp linux-2.6.32.43/drivers/video/vesafb.c linux-2.6.32.43/drivers/video/vesafb.c
---- linux-2.6.32.43/drivers/video/vesafb.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/video/vesafb.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/video/vesafb.c linux-2.6.32.44/drivers/video/vesafb.c
+--- linux-2.6.32.44/drivers/video/vesafb.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/video/vesafb.c 2011-08-05 20:33:55.000000000 -0400
@@ -9,6 +9,7 @@
*/
@@ -39428,9 +39376,9 @@ diff -urNp linux-2.6.32.43/drivers/video/vesafb.c linux-2.6.32.43/drivers/video/
if (info->screen_base)
iounmap(info->screen_base);
framebuffer_release(info);
-diff -urNp linux-2.6.32.43/drivers/xen/sys-hypervisor.c linux-2.6.32.43/drivers/xen/sys-hypervisor.c
---- linux-2.6.32.43/drivers/xen/sys-hypervisor.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/drivers/xen/sys-hypervisor.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/drivers/xen/sys-hypervisor.c linux-2.6.32.44/drivers/xen/sys-hypervisor.c
+--- linux-2.6.32.44/drivers/xen/sys-hypervisor.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/drivers/xen/sys-hypervisor.c 2011-04-17 15:56:46.000000000 -0400
@@ -425,7 +425,7 @@ static ssize_t hyp_sysfs_store(struct ko
return 0;
}
@@ -39440,9 +39388,9 @@ diff -urNp linux-2.6.32.43/drivers/xen/sys-hypervisor.c linux-2.6.32.43/drivers/
.show = hyp_sysfs_show,
.store = hyp_sysfs_store,
};
-diff -urNp linux-2.6.32.43/fs/9p/vfs_inode.c linux-2.6.32.43/fs/9p/vfs_inode.c
---- linux-2.6.32.43/fs/9p/vfs_inode.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/9p/vfs_inode.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/9p/vfs_inode.c linux-2.6.32.44/fs/9p/vfs_inode.c
+--- linux-2.6.32.44/fs/9p/vfs_inode.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/9p/vfs_inode.c 2011-04-17 15:56:46.000000000 -0400
@@ -1079,7 +1079,7 @@ static void *v9fs_vfs_follow_link(struct
static void
v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
@@ -39452,9 +39400,9 @@ diff -urNp linux-2.6.32.43/fs/9p/vfs_inode.c linux-2.6.32.43/fs/9p/vfs_inode.c
P9_DPRINTK(P9_DEBUG_VFS, " %s %s\n", dentry->d_name.name,
IS_ERR(s) ? "<error>" : s);
-diff -urNp linux-2.6.32.43/fs/aio.c linux-2.6.32.43/fs/aio.c
---- linux-2.6.32.43/fs/aio.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/aio.c 2011-06-04 20:40:21.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/aio.c linux-2.6.32.44/fs/aio.c
+--- linux-2.6.32.44/fs/aio.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/aio.c 2011-06-04 20:40:21.000000000 -0400
@@ -115,7 +115,7 @@ static int aio_setup_ring(struct kioctx
size += sizeof(struct io_event) * nr_events;
nr_pages = (size + PAGE_SIZE-1) >> PAGE_SHIFT;
@@ -39493,9 +39441,9 @@ diff -urNp linux-2.6.32.43/fs/aio.c linux-2.6.32.43/fs/aio.c
kiocb->ki_nr_segs = kiocb->ki_nbytes;
kiocb->ki_cur_seg = 0;
/* ki_nbytes/left now reflect bytes instead of segs */
-diff -urNp linux-2.6.32.43/fs/attr.c linux-2.6.32.43/fs/attr.c
---- linux-2.6.32.43/fs/attr.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/attr.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/attr.c linux-2.6.32.44/fs/attr.c
+--- linux-2.6.32.44/fs/attr.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/attr.c 2011-04-17 15:56:46.000000000 -0400
@@ -83,6 +83,7 @@ int inode_newsize_ok(const struct inode
unsigned long limit;
@@ -39504,9 +39452,9 @@ diff -urNp linux-2.6.32.43/fs/attr.c linux-2.6.32.43/fs/attr.c
if (limit != RLIM_INFINITY && offset > limit)
goto out_sig;
if (offset > inode->i_sb->s_maxbytes)
-diff -urNp linux-2.6.32.43/fs/autofs/root.c linux-2.6.32.43/fs/autofs/root.c
---- linux-2.6.32.43/fs/autofs/root.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/autofs/root.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/autofs/root.c linux-2.6.32.44/fs/autofs/root.c
+--- linux-2.6.32.44/fs/autofs/root.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/autofs/root.c 2011-04-17 15:56:46.000000000 -0400
@@ -299,7 +299,8 @@ static int autofs_root_symlink(struct in
set_bit(n,sbi->symlink_bitmap);
sl = &sbi->symlink[n];
@@ -39517,9 +39465,9 @@ diff -urNp linux-2.6.32.43/fs/autofs/root.c linux-2.6.32.43/fs/autofs/root.c
if (!sl->data) {
clear_bit(n,sbi->symlink_bitmap);
unlock_kernel();
-diff -urNp linux-2.6.32.43/fs/autofs4/symlink.c linux-2.6.32.43/fs/autofs4/symlink.c
---- linux-2.6.32.43/fs/autofs4/symlink.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/autofs4/symlink.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/autofs4/symlink.c linux-2.6.32.44/fs/autofs4/symlink.c
+--- linux-2.6.32.44/fs/autofs4/symlink.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/autofs4/symlink.c 2011-04-17 15:56:46.000000000 -0400
@@ -15,7 +15,7 @@
static void *autofs4_follow_link(struct dentry *dentry, struct nameidata *nd)
{
@@ -39529,9 +39477,9 @@ diff -urNp linux-2.6.32.43/fs/autofs4/symlink.c linux-2.6.32.43/fs/autofs4/symli
return NULL;
}
-diff -urNp linux-2.6.32.43/fs/befs/linuxvfs.c linux-2.6.32.43/fs/befs/linuxvfs.c
---- linux-2.6.32.43/fs/befs/linuxvfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/befs/linuxvfs.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/befs/linuxvfs.c linux-2.6.32.44/fs/befs/linuxvfs.c
+--- linux-2.6.32.44/fs/befs/linuxvfs.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/befs/linuxvfs.c 2011-04-17 15:56:46.000000000 -0400
@@ -493,7 +493,7 @@ static void befs_put_link(struct dentry
{
befs_inode_info *befs_ino = BEFS_I(dentry->d_inode);
@@ -39541,9 +39489,9 @@ diff -urNp linux-2.6.32.43/fs/befs/linuxvfs.c linux-2.6.32.43/fs/befs/linuxvfs.c
if (!IS_ERR(link))
kfree(link);
}
-diff -urNp linux-2.6.32.43/fs/binfmt_aout.c linux-2.6.32.43/fs/binfmt_aout.c
---- linux-2.6.32.43/fs/binfmt_aout.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/binfmt_aout.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/binfmt_aout.c linux-2.6.32.44/fs/binfmt_aout.c
+--- linux-2.6.32.44/fs/binfmt_aout.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/binfmt_aout.c 2011-04-17 15:56:46.000000000 -0400
@@ -16,6 +16,7 @@
#include <linux/string.h>
#include <linux/fs.h>
@@ -39631,9 +39579,9 @@ diff -urNp linux-2.6.32.43/fs/binfmt_aout.c linux-2.6.32.43/fs/binfmt_aout.c
MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE,
fd_offset + ex.a_text);
up_write(¤t->mm->mmap_sem);
-diff -urNp linux-2.6.32.43/fs/binfmt_elf.c linux-2.6.32.43/fs/binfmt_elf.c
---- linux-2.6.32.43/fs/binfmt_elf.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/binfmt_elf.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/binfmt_elf.c linux-2.6.32.44/fs/binfmt_elf.c
+--- linux-2.6.32.44/fs/binfmt_elf.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/binfmt_elf.c 2011-05-16 21:46:57.000000000 -0400
@@ -50,6 +50,10 @@ static int elf_core_dump(long signr, str
#define elf_core_dump NULL
#endif
@@ -40307,9 +40255,9 @@ diff -urNp linux-2.6.32.43/fs/binfmt_elf.c linux-2.6.32.43/fs/binfmt_elf.c
static int __init init_elf_binfmt(void)
{
return register_binfmt(&elf_format);
-diff -urNp linux-2.6.32.43/fs/binfmt_flat.c linux-2.6.32.43/fs/binfmt_flat.c
---- linux-2.6.32.43/fs/binfmt_flat.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/binfmt_flat.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/binfmt_flat.c linux-2.6.32.44/fs/binfmt_flat.c
+--- linux-2.6.32.44/fs/binfmt_flat.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/binfmt_flat.c 2011-04-17 15:56:46.000000000 -0400
@@ -564,7 +564,9 @@ static int load_flat_file(struct linux_b
realdatastart = (unsigned long) -ENOMEM;
printk("Unable to allocate RAM for process data, errno %d\n",
@@ -40342,9 +40290,9 @@ diff -urNp linux-2.6.32.43/fs/binfmt_flat.c linux-2.6.32.43/fs/binfmt_flat.c
ret = result;
goto err;
}
-diff -urNp linux-2.6.32.43/fs/bio.c linux-2.6.32.43/fs/bio.c
---- linux-2.6.32.43/fs/bio.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/bio.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/bio.c linux-2.6.32.44/fs/bio.c
+--- linux-2.6.32.44/fs/bio.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/bio.c 2011-04-17 15:56:46.000000000 -0400
@@ -78,7 +78,7 @@ static struct kmem_cache *bio_find_or_cr
i = 0;
@@ -40363,9 +40311,9 @@ diff -urNp linux-2.6.32.43/fs/bio.c linux-2.6.32.43/fs/bio.c
__bio_for_each_segment(bvec, bio, i, 0) {
char *addr = page_address(bvec->bv_page);
-diff -urNp linux-2.6.32.43/fs/block_dev.c linux-2.6.32.43/fs/block_dev.c
---- linux-2.6.32.43/fs/block_dev.c 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.43/fs/block_dev.c 2011-06-25 12:56:37.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/block_dev.c linux-2.6.32.44/fs/block_dev.c
+--- linux-2.6.32.44/fs/block_dev.c 2011-08-09 18:35:29.000000000 -0400
++++ linux-2.6.32.44/fs/block_dev.c 2011-08-09 18:34:00.000000000 -0400
@@ -664,7 +664,7 @@ int bd_claim(struct block_device *bdev,
else if (bdev->bd_contains == bdev)
res = 0; /* is a whole device which isn't held */
@@ -40375,9 +40323,9 @@ diff -urNp linux-2.6.32.43/fs/block_dev.c linux-2.6.32.43/fs/block_dev.c
res = 0; /* is a partition of a device that is being partitioned */
else if (bdev->bd_contains->bd_holder != NULL)
res = -EBUSY; /* is a partition of a held device */
-diff -urNp linux-2.6.32.43/fs/btrfs/ctree.c linux-2.6.32.43/fs/btrfs/ctree.c
---- linux-2.6.32.43/fs/btrfs/ctree.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/btrfs/ctree.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/btrfs/ctree.c linux-2.6.32.44/fs/btrfs/ctree.c
+--- linux-2.6.32.44/fs/btrfs/ctree.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/btrfs/ctree.c 2011-04-17 15:56:46.000000000 -0400
@@ -461,9 +461,12 @@ static noinline int __btrfs_cow_block(st
free_extent_buffer(buf);
add_root_to_dirty_list(root);
@@ -40402,9 +40350,9 @@ diff -urNp linux-2.6.32.43/fs/btrfs/ctree.c linux-2.6.32.43/fs/btrfs/ctree.c
btrfs_cpu_key_to_disk(&disk_key, cpu_key);
ret = fixup_low_keys(trans, root, path, &disk_key, 1);
}
-diff -urNp linux-2.6.32.43/fs/btrfs/disk-io.c linux-2.6.32.43/fs/btrfs/disk-io.c
---- linux-2.6.32.43/fs/btrfs/disk-io.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.43/fs/btrfs/disk-io.c 2011-04-17 17:03:11.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/btrfs/disk-io.c linux-2.6.32.44/fs/btrfs/disk-io.c
+--- linux-2.6.32.44/fs/btrfs/disk-io.c 2011-04-17 17:00:52.000000000 -0400
++++ linux-2.6.32.44/fs/btrfs/disk-io.c 2011-04-17 17:03:11.000000000 -0400
@@ -39,7 +39,7 @@
#include "tree-log.h"
#include "free-space-cache.h"
@@ -40423,9 +40371,9 @@ diff -urNp linux-2.6.32.43/fs/btrfs/disk-io.c linux-2.6.32.43/fs/btrfs/disk-io.c
.write_cache_pages_lock_hook = btree_lock_page_hook,
.readpage_end_io_hook = btree_readpage_end_io_hook,
.submit_bio_hook = btree_submit_bio_hook,
-diff -urNp linux-2.6.32.43/fs/btrfs/extent_io.h linux-2.6.32.43/fs/btrfs/extent_io.h
---- linux-2.6.32.43/fs/btrfs/extent_io.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/btrfs/extent_io.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/btrfs/extent_io.h linux-2.6.32.44/fs/btrfs/extent_io.h
+--- linux-2.6.32.44/fs/btrfs/extent_io.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/btrfs/extent_io.h 2011-04-17 15:56:46.000000000 -0400
@@ -49,36 +49,36 @@ typedef int (extent_submit_bio_hook_t)(s
struct bio *bio, int mirror_num,
unsigned long bio_flags);
@@ -40486,9 +40434,9 @@ diff -urNp linux-2.6.32.43/fs/btrfs/extent_io.h linux-2.6.32.43/fs/btrfs/extent_
};
struct extent_state {
-diff -urNp linux-2.6.32.43/fs/btrfs/extent-tree.c linux-2.6.32.43/fs/btrfs/extent-tree.c
---- linux-2.6.32.43/fs/btrfs/extent-tree.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/btrfs/extent-tree.c 2011-06-12 06:39:08.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/btrfs/extent-tree.c linux-2.6.32.44/fs/btrfs/extent-tree.c
+--- linux-2.6.32.44/fs/btrfs/extent-tree.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/btrfs/extent-tree.c 2011-06-12 06:39:08.000000000 -0400
@@ -7141,6 +7141,10 @@ static noinline int relocate_one_extent(
u64 group_start = group->key.objectid;
new_extents = kmalloc(sizeof(*new_extents),
@@ -40500,9 +40448,9 @@ diff -urNp linux-2.6.32.43/fs/btrfs/extent-tree.c linux-2.6.32.43/fs/btrfs/exten
nr_extents = 1;
ret = get_new_locations(reloc_inode,
extent_key,
-diff -urNp linux-2.6.32.43/fs/btrfs/free-space-cache.c linux-2.6.32.43/fs/btrfs/free-space-cache.c
---- linux-2.6.32.43/fs/btrfs/free-space-cache.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/btrfs/free-space-cache.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/btrfs/free-space-cache.c linux-2.6.32.44/fs/btrfs/free-space-cache.c
+--- linux-2.6.32.44/fs/btrfs/free-space-cache.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/btrfs/free-space-cache.c 2011-04-17 15:56:46.000000000 -0400
@@ -1074,8 +1074,6 @@ u64 btrfs_alloc_from_cluster(struct btrf
while(1) {
@@ -40521,9 +40469,9 @@ diff -urNp linux-2.6.32.43/fs/btrfs/free-space-cache.c linux-2.6.32.43/fs/btrfs/
if (entry->bitmap && entry->bytes > bytes + empty_size) {
ret = btrfs_bitmap_cluster(block_group, entry, cluster,
-diff -urNp linux-2.6.32.43/fs/btrfs/inode.c linux-2.6.32.43/fs/btrfs/inode.c
---- linux-2.6.32.43/fs/btrfs/inode.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/btrfs/inode.c 2011-06-12 06:39:58.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/btrfs/inode.c linux-2.6.32.44/fs/btrfs/inode.c
+--- linux-2.6.32.44/fs/btrfs/inode.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/btrfs/inode.c 2011-06-12 06:39:58.000000000 -0400
@@ -63,7 +63,7 @@ static const struct inode_operations btr
static const struct address_space_operations btrfs_aops;
static const struct address_space_operations btrfs_symlink_aops;
@@ -40583,9 +40531,9 @@ diff -urNp linux-2.6.32.43/fs/btrfs/inode.c linux-2.6.32.43/fs/btrfs/inode.c
.fill_delalloc = run_delalloc_range,
.submit_bio_hook = btrfs_submit_bio_hook,
.merge_bio_hook = btrfs_merge_bio_hook,
-diff -urNp linux-2.6.32.43/fs/btrfs/relocation.c linux-2.6.32.43/fs/btrfs/relocation.c
---- linux-2.6.32.43/fs/btrfs/relocation.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/btrfs/relocation.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/btrfs/relocation.c linux-2.6.32.44/fs/btrfs/relocation.c
+--- linux-2.6.32.44/fs/btrfs/relocation.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/btrfs/relocation.c 2011-04-17 15:56:46.000000000 -0400
@@ -884,7 +884,7 @@ static int __update_reloc_root(struct bt
}
spin_unlock(&rc->reloc_root_tree.lock);
@@ -40595,9 +40543,9 @@ diff -urNp linux-2.6.32.43/fs/btrfs/relocation.c linux-2.6.32.43/fs/btrfs/reloca
if (!del) {
spin_lock(&rc->reloc_root_tree.lock);
-diff -urNp linux-2.6.32.43/fs/btrfs/sysfs.c linux-2.6.32.43/fs/btrfs/sysfs.c
---- linux-2.6.32.43/fs/btrfs/sysfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/btrfs/sysfs.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/btrfs/sysfs.c linux-2.6.32.44/fs/btrfs/sysfs.c
+--- linux-2.6.32.44/fs/btrfs/sysfs.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/btrfs/sysfs.c 2011-04-17 15:56:46.000000000 -0400
@@ -164,12 +164,12 @@ static void btrfs_root_release(struct ko
complete(&root->kobj_unregister);
}
@@ -40613,9 +40561,9 @@ diff -urNp linux-2.6.32.43/fs/btrfs/sysfs.c linux-2.6.32.43/fs/btrfs/sysfs.c
.show = btrfs_root_attr_show,
.store = btrfs_root_attr_store,
};
-diff -urNp linux-2.6.32.43/fs/buffer.c linux-2.6.32.43/fs/buffer.c
---- linux-2.6.32.43/fs/buffer.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/buffer.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/buffer.c linux-2.6.32.44/fs/buffer.c
+--- linux-2.6.32.44/fs/buffer.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/buffer.c 2011-04-17 15:56:46.000000000 -0400
@@ -25,6 +25,7 @@
#include <linux/percpu.h>
#include <linux/slab.h>
@@ -40624,9 +40572,9 @@ diff -urNp linux-2.6.32.43/fs/buffer.c linux-2.6.32.43/fs/buffer.c
#include <linux/blkdev.h>
#include <linux/file.h>
#include <linux/quotaops.h>
-diff -urNp linux-2.6.32.43/fs/cachefiles/bind.c linux-2.6.32.43/fs/cachefiles/bind.c
---- linux-2.6.32.43/fs/cachefiles/bind.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/cachefiles/bind.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/cachefiles/bind.c linux-2.6.32.44/fs/cachefiles/bind.c
+--- linux-2.6.32.44/fs/cachefiles/bind.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/cachefiles/bind.c 2011-04-17 15:56:46.000000000 -0400
@@ -39,13 +39,11 @@ int cachefiles_daemon_bind(struct cachef
args);
@@ -40643,9 +40591,9 @@ diff -urNp linux-2.6.32.43/fs/cachefiles/bind.c linux-2.6.32.43/fs/cachefiles/bi
cache->bcull_percent < cache->brun_percent &&
cache->brun_percent < 100);
-diff -urNp linux-2.6.32.43/fs/cachefiles/daemon.c linux-2.6.32.43/fs/cachefiles/daemon.c
---- linux-2.6.32.43/fs/cachefiles/daemon.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/cachefiles/daemon.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/cachefiles/daemon.c linux-2.6.32.44/fs/cachefiles/daemon.c
+--- linux-2.6.32.44/fs/cachefiles/daemon.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/cachefiles/daemon.c 2011-04-17 15:56:46.000000000 -0400
@@ -220,7 +220,7 @@ static ssize_t cachefiles_daemon_write(s
if (test_bit(CACHEFILES_DEAD, &cache->flags))
return -EIO;
@@ -40673,9 +40621,9 @@ diff -urNp linux-2.6.32.43/fs/cachefiles/daemon.c linux-2.6.32.43/fs/cachefiles/
return cachefiles_daemon_range_error(cache, args);
cache->bstop_percent = bstop;
-diff -urNp linux-2.6.32.43/fs/cachefiles/internal.h linux-2.6.32.43/fs/cachefiles/internal.h
---- linux-2.6.32.43/fs/cachefiles/internal.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/cachefiles/internal.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/cachefiles/internal.h linux-2.6.32.44/fs/cachefiles/internal.h
+--- linux-2.6.32.44/fs/cachefiles/internal.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/cachefiles/internal.h 2011-05-04 17:56:28.000000000 -0400
@@ -56,7 +56,7 @@ struct cachefiles_cache {
wait_queue_head_t daemon_pollwq; /* poll waitqueue for daemon */
struct rb_root active_nodes; /* active nodes (can't be culled) */
@@ -40710,9 +40658,9 @@ diff -urNp linux-2.6.32.43/fs/cachefiles/internal.h linux-2.6.32.43/fs/cachefile
}
#else
-diff -urNp linux-2.6.32.43/fs/cachefiles/namei.c linux-2.6.32.43/fs/cachefiles/namei.c
---- linux-2.6.32.43/fs/cachefiles/namei.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/cachefiles/namei.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/cachefiles/namei.c linux-2.6.32.44/fs/cachefiles/namei.c
+--- linux-2.6.32.44/fs/cachefiles/namei.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/cachefiles/namei.c 2011-05-04 17:56:28.000000000 -0400
@@ -250,7 +250,7 @@ try_again:
/* first step is to make up a grave dentry in the graveyard */
sprintf(nbuffer, "%08x%08x",
@@ -40722,9 +40670,9 @@ diff -urNp linux-2.6.32.43/fs/cachefiles/namei.c linux-2.6.32.43/fs/cachefiles/n
/* do the multiway lock magic */
trap = lock_rename(cache->graveyard, dir);
-diff -urNp linux-2.6.32.43/fs/cachefiles/proc.c linux-2.6.32.43/fs/cachefiles/proc.c
---- linux-2.6.32.43/fs/cachefiles/proc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/cachefiles/proc.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/cachefiles/proc.c linux-2.6.32.44/fs/cachefiles/proc.c
+--- linux-2.6.32.44/fs/cachefiles/proc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/cachefiles/proc.c 2011-05-04 17:56:28.000000000 -0400
@@ -14,9 +14,9 @@
#include <linux/seq_file.h>
#include "internal.h"
@@ -40751,9 +40699,9 @@ diff -urNp linux-2.6.32.43/fs/cachefiles/proc.c linux-2.6.32.43/fs/cachefiles/pr
if (x == 0 && y == 0 && z == 0)
return 0;
-diff -urNp linux-2.6.32.43/fs/cachefiles/rdwr.c linux-2.6.32.43/fs/cachefiles/rdwr.c
---- linux-2.6.32.43/fs/cachefiles/rdwr.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/cachefiles/rdwr.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/cachefiles/rdwr.c linux-2.6.32.44/fs/cachefiles/rdwr.c
+--- linux-2.6.32.44/fs/cachefiles/rdwr.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/cachefiles/rdwr.c 2011-04-17 15:56:46.000000000 -0400
@@ -946,7 +946,7 @@ int cachefiles_write_page(struct fscache
old_fs = get_fs();
set_fs(KERNEL_DS);
@@ -40763,9 +40711,9 @@ diff -urNp linux-2.6.32.43/fs/cachefiles/rdwr.c linux-2.6.32.43/fs/cachefiles/rd
set_fs(old_fs);
kunmap(page);
if (ret != len)
-diff -urNp linux-2.6.32.43/fs/cifs/cifs_debug.c linux-2.6.32.43/fs/cifs/cifs_debug.c
---- linux-2.6.32.43/fs/cifs/cifs_debug.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/cifs/cifs_debug.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/cifs/cifs_debug.c linux-2.6.32.44/fs/cifs/cifs_debug.c
+--- linux-2.6.32.44/fs/cifs/cifs_debug.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/cifs/cifs_debug.c 2011-05-04 17:56:28.000000000 -0400
@@ -256,25 +256,25 @@ static ssize_t cifs_stats_proc_write(str
tcon = list_entry(tmp3,
struct cifsTconInfo,
@@ -40873,9 +40821,9 @@ diff -urNp linux-2.6.32.43/fs/cifs/cifs_debug.c linux-2.6.32.43/fs/cifs/cifs_deb
}
}
}
-diff -urNp linux-2.6.32.43/fs/cifs/cifsglob.h linux-2.6.32.43/fs/cifs/cifsglob.h
---- linux-2.6.32.43/fs/cifs/cifsglob.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/cifs/cifsglob.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/cifs/cifsglob.h linux-2.6.32.44/fs/cifs/cifsglob.h
+--- linux-2.6.32.44/fs/cifs/cifsglob.h 2011-08-09 18:35:29.000000000 -0400
++++ linux-2.6.32.44/fs/cifs/cifsglob.h 2011-08-09 18:34:00.000000000 -0400
@@ -252,28 +252,28 @@ struct cifsTconInfo {
__u16 Flags; /* optional support bits */
enum statusEnum tidStatus;
@@ -40936,9 +40884,9 @@ diff -urNp linux-2.6.32.43/fs/cifs/cifsglob.h linux-2.6.32.43/fs/cifs/cifsglob.h
static inline void cifs_stats_bytes_written(struct cifsTconInfo *tcon,
unsigned int bytes)
-diff -urNp linux-2.6.32.43/fs/cifs/link.c linux-2.6.32.43/fs/cifs/link.c
---- linux-2.6.32.43/fs/cifs/link.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/cifs/link.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/cifs/link.c linux-2.6.32.44/fs/cifs/link.c
+--- linux-2.6.32.44/fs/cifs/link.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/cifs/link.c 2011-04-17 15:56:46.000000000 -0400
@@ -215,7 +215,7 @@ cifs_symlink(struct inode *inode, struct
void cifs_put_link(struct dentry *direntry, struct nameidata *nd, void *cookie)
@@ -40948,9 +40896,9 @@ diff -urNp linux-2.6.32.43/fs/cifs/link.c linux-2.6.32.43/fs/cifs/link.c
if (!IS_ERR(p))
kfree(p);
}
-diff -urNp linux-2.6.32.43/fs/coda/cache.c linux-2.6.32.43/fs/coda/cache.c
---- linux-2.6.32.43/fs/coda/cache.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/coda/cache.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/coda/cache.c linux-2.6.32.44/fs/coda/cache.c
+--- linux-2.6.32.44/fs/coda/cache.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/coda/cache.c 2011-05-04 17:56:28.000000000 -0400
@@ -24,14 +24,14 @@
#include <linux/coda_fs_i.h>
#include <linux/coda_cache.h>
@@ -40993,9 +40941,9 @@ diff -urNp linux-2.6.32.43/fs/coda/cache.c linux-2.6.32.43/fs/coda/cache.c
return hit;
}
-diff -urNp linux-2.6.32.43/fs/compat_binfmt_elf.c linux-2.6.32.43/fs/compat_binfmt_elf.c
---- linux-2.6.32.43/fs/compat_binfmt_elf.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/compat_binfmt_elf.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/compat_binfmt_elf.c linux-2.6.32.44/fs/compat_binfmt_elf.c
+--- linux-2.6.32.44/fs/compat_binfmt_elf.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/compat_binfmt_elf.c 2011-04-17 15:56:46.000000000 -0400
@@ -29,10 +29,12 @@
#undef elfhdr
#undef elf_phdr
@@ -41009,9 +40957,9 @@ diff -urNp linux-2.6.32.43/fs/compat_binfmt_elf.c linux-2.6.32.43/fs/compat_binf
#define elf_addr_t Elf32_Addr
/*
-diff -urNp linux-2.6.32.43/fs/compat.c linux-2.6.32.43/fs/compat.c
---- linux-2.6.32.43/fs/compat.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.43/fs/compat.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/compat.c linux-2.6.32.44/fs/compat.c
+--- linux-2.6.32.44/fs/compat.c 2011-04-17 17:00:52.000000000 -0400
++++ linux-2.6.32.44/fs/compat.c 2011-08-11 19:56:56.000000000 -0400
@@ -830,6 +830,7 @@ struct compat_old_linux_dirent {
struct compat_readdir_callback {
@@ -41102,7 +41050,7 @@ diff -urNp linux-2.6.32.43/fs/compat.c linux-2.6.32.43/fs/compat.c
goto out;
if (!file->f_op)
goto out;
-@@ -1463,6 +1481,11 @@ int compat_do_execve(char * filename,
+@@ -1463,11 +1481,35 @@ int compat_do_execve(char * filename,
compat_uptr_t __user *envp,
struct pt_regs * regs)
{
@@ -41114,7 +41062,31 @@ diff -urNp linux-2.6.32.43/fs/compat.c linux-2.6.32.43/fs/compat.c
struct linux_binprm *bprm;
struct file *file;
struct files_struct *displaced;
-@@ -1499,6 +1522,19 @@ int compat_do_execve(char * filename,
+ bool clear_in_exec;
+ int retval;
++ const struct cred *cred = current_cred();
++
++ /*
++ * We move the actual failure in case of RLIMIT_NPROC excess from
++ * set*uid() to execve() because too many poorly written programs
++ * don't check setuid() return code. Here we additionally recheck
++ * whether NPROC limit is still exceeded.
++ */
++ gr_learn_resource(current, RLIMIT_NPROC, atomic_read(¤t->cred->user->processes), 1);
++
++ if ((current->flags & PF_NPROC_EXCEEDED) &&
++ atomic_read(&cred->user->processes) > current->signal->rlim[RLIMIT_NPROC].rlim_cur) {
++ retval = -EAGAIN;
++ goto out_ret;
++ }
++
++ /* We're below the limit (still or again), so we don't want to make
++ * further execve() calls fail. */
++ current->flags &= ~PF_NPROC_EXCEEDED;
+
+ retval = unshare_files(&displaced);
+ if (retval)
+@@ -1499,6 +1541,15 @@ int compat_do_execve(char * filename,
bprm->filename = filename;
bprm->interp = filename;
@@ -41123,10 +41095,6 @@ diff -urNp linux-2.6.32.43/fs/compat.c linux-2.6.32.43/fs/compat.c
+ goto out_file;
+ }
+
-+ gr_learn_resource(current, RLIMIT_NPROC, atomic_read(¤t->cred->user->processes), 1);
-+ retval = -EAGAIN;
-+ if (gr_handle_nproc())
-+ goto out_file;
+ retval = -EACCES;
+ if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt))
+ goto out_file;
@@ -41134,7 +41102,7 @@ diff -urNp linux-2.6.32.43/fs/compat.c linux-2.6.32.43/fs/compat.c
retval = bprm_mm_init(bprm);
if (retval)
goto out_file;
-@@ -1528,9 +1564,40 @@ int compat_do_execve(char * filename,
+@@ -1528,9 +1579,40 @@ int compat_do_execve(char * filename,
if (retval < 0)
goto out;
@@ -41176,7 +41144,7 @@ diff -urNp linux-2.6.32.43/fs/compat.c linux-2.6.32.43/fs/compat.c
/* execve succeeded */
current->fs->in_exec = 0;
-@@ -1541,6 +1608,14 @@ int compat_do_execve(char * filename,
+@@ -1541,6 +1623,14 @@ int compat_do_execve(char * filename,
put_files_struct(displaced);
return retval;
@@ -41191,7 +41159,7 @@ diff -urNp linux-2.6.32.43/fs/compat.c linux-2.6.32.43/fs/compat.c
out:
if (bprm->mm) {
acct_arg_size(bprm, 0);
-@@ -1711,6 +1786,8 @@ int compat_core_sys_select(int n, compat
+@@ -1711,6 +1801,8 @@ int compat_core_sys_select(int n, compat
struct fdtable *fdt;
long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
@@ -41200,9 +41168,9 @@ diff -urNp linux-2.6.32.43/fs/compat.c linux-2.6.32.43/fs/compat.c
if (n < 0)
goto out_nofds;
-diff -urNp linux-2.6.32.43/fs/compat_ioctl.c linux-2.6.32.43/fs/compat_ioctl.c
---- linux-2.6.32.43/fs/compat_ioctl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/compat_ioctl.c 2011-04-23 12:56:11.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/compat_ioctl.c linux-2.6.32.44/fs/compat_ioctl.c
+--- linux-2.6.32.44/fs/compat_ioctl.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/compat_ioctl.c 2011-04-23 12:56:11.000000000 -0400
@@ -234,6 +234,8 @@ static int do_video_set_spu_palette(unsi
up = (struct compat_video_spu_palette __user *) arg;
err = get_user(palp, &up->palette);
@@ -41212,9 +41180,9 @@ diff -urNp linux-2.6.32.43/fs/compat_ioctl.c linux-2.6.32.43/fs/compat_ioctl.c
up_native = compat_alloc_user_space(sizeof(struct video_spu_palette));
err = put_user(compat_ptr(palp), &up_native->palette);
-diff -urNp linux-2.6.32.43/fs/configfs/dir.c linux-2.6.32.43/fs/configfs/dir.c
---- linux-2.6.32.43/fs/configfs/dir.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/configfs/dir.c 2011-05-11 18:25:15.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/configfs/dir.c linux-2.6.32.44/fs/configfs/dir.c
+--- linux-2.6.32.44/fs/configfs/dir.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/configfs/dir.c 2011-05-11 18:25:15.000000000 -0400
@@ -1572,7 +1572,8 @@ static int configfs_readdir(struct file
}
for (p=q->next; p!= &parent_sd->s_children; p=p->next) {
@@ -41239,9 +41207,9 @@ diff -urNp linux-2.6.32.43/fs/configfs/dir.c linux-2.6.32.43/fs/configfs/dir.c
if (next->s_dentry)
ino = next->s_dentry->d_inode->i_ino;
else
-diff -urNp linux-2.6.32.43/fs/dcache.c linux-2.6.32.43/fs/dcache.c
---- linux-2.6.32.43/fs/dcache.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/dcache.c 2011-04-23 13:32:21.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/dcache.c linux-2.6.32.44/fs/dcache.c
+--- linux-2.6.32.44/fs/dcache.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/dcache.c 2011-04-23 13:32:21.000000000 -0400
@@ -45,8 +45,6 @@ EXPORT_SYMBOL(dcache_lock);
static struct kmem_cache *dentry_cache __read_mostly;
@@ -41260,9 +41228,9 @@ diff -urNp linux-2.6.32.43/fs/dcache.c linux-2.6.32.43/fs/dcache.c
dcache_init();
inode_init();
-diff -urNp linux-2.6.32.43/fs/dlm/lockspace.c linux-2.6.32.43/fs/dlm/lockspace.c
---- linux-2.6.32.43/fs/dlm/lockspace.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/dlm/lockspace.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/dlm/lockspace.c linux-2.6.32.44/fs/dlm/lockspace.c
+--- linux-2.6.32.44/fs/dlm/lockspace.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/dlm/lockspace.c 2011-04-17 15:56:46.000000000 -0400
@@ -148,7 +148,7 @@ static void lockspace_kobj_release(struc
kfree(ls);
}
@@ -41272,9 +41240,9 @@ diff -urNp linux-2.6.32.43/fs/dlm/lockspace.c linux-2.6.32.43/fs/dlm/lockspace.c
.show = dlm_attr_show,
.store = dlm_attr_store,
};
-diff -urNp linux-2.6.32.43/fs/ecryptfs/inode.c linux-2.6.32.43/fs/ecryptfs/inode.c
---- linux-2.6.32.43/fs/ecryptfs/inode.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/ecryptfs/inode.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/ecryptfs/inode.c linux-2.6.32.44/fs/ecryptfs/inode.c
+--- linux-2.6.32.44/fs/ecryptfs/inode.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/ecryptfs/inode.c 2011-04-17 15:56:46.000000000 -0400
@@ -660,7 +660,7 @@ static int ecryptfs_readlink_lower(struc
old_fs = get_fs();
set_fs(get_ds());
@@ -41293,9 +41261,9 @@ diff -urNp linux-2.6.32.43/fs/ecryptfs/inode.c linux-2.6.32.43/fs/ecryptfs/inode
set_fs(old_fs);
if (rc < 0)
goto out_free;
-diff -urNp linux-2.6.32.43/fs/exec.c linux-2.6.32.43/fs/exec.c
---- linux-2.6.32.43/fs/exec.c 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.43/fs/exec.c 2011-07-06 19:53:33.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/exec.c linux-2.6.32.44/fs/exec.c
+--- linux-2.6.32.44/fs/exec.c 2011-06-25 12:55:34.000000000 -0400
++++ linux-2.6.32.44/fs/exec.c 2011-08-11 19:56:19.000000000 -0400
@@ -56,12 +56,24 @@
#include <linux/fsnotify.h>
#include <linux/fs_struct.h>
@@ -41492,7 +41460,7 @@ diff -urNp linux-2.6.32.43/fs/exec.c linux-2.6.32.43/fs/exec.c
bprm->unsafe |= LSM_UNSAFE_SHARE;
} else {
res = -EAGAIN;
-@@ -1347,6 +1376,11 @@ int do_execve(char * filename,
+@@ -1347,11 +1376,35 @@ int do_execve(char * filename,
char __user *__user *envp,
struct pt_regs * regs)
{
@@ -41504,7 +41472,31 @@ diff -urNp linux-2.6.32.43/fs/exec.c linux-2.6.32.43/fs/exec.c
struct linux_binprm *bprm;
struct file *file;
struct files_struct *displaced;
-@@ -1383,6 +1417,23 @@ int do_execve(char * filename,
+ bool clear_in_exec;
+ int retval;
++ const struct cred *cred = current_cred();
++
++ /*
++ * We move the actual failure in case of RLIMIT_NPROC excess from
++ * set*uid() to execve() because too many poorly written programs
++ * don't check setuid() return code. Here we additionally recheck
++ * whether NPROC limit is still exceeded.
++ */
++ gr_learn_resource(current, RLIMIT_NPROC, atomic_read(¤t->cred->user->processes), 1);
++
++ if ((current->flags & PF_NPROC_EXCEEDED) &&
++ atomic_read(&cred->user->processes) > current->signal->rlim[RLIMIT_NPROC].rlim_cur) {
++ retval = -EAGAIN;
++ goto out_ret;
++ }
++
++ /* We're below the limit (still or again), so we don't want to make
++ * further execve() calls fail. */
++ current->flags &= ~PF_NPROC_EXCEEDED;
+
+ retval = unshare_files(&displaced);
+ if (retval)
+@@ -1383,6 +1436,16 @@ int do_execve(char * filename,
bprm->filename = filename;
bprm->interp = filename;
@@ -41513,13 +41505,6 @@ diff -urNp linux-2.6.32.43/fs/exec.c linux-2.6.32.43/fs/exec.c
+ goto out_file;
+ }
+
-+ gr_learn_resource(current, RLIMIT_NPROC, atomic_read(¤t->cred->user->processes), 1);
-+
-+ if (gr_handle_nproc()) {
-+ retval = -EAGAIN;
-+ goto out_file;
-+ }
-+
+ if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt)) {
+ retval = -EACCES;
+ goto out_file;
@@ -41528,7 +41513,7 @@ diff -urNp linux-2.6.32.43/fs/exec.c linux-2.6.32.43/fs/exec.c
retval = bprm_mm_init(bprm);
if (retval)
goto out_file;
-@@ -1412,10 +1463,41 @@ int do_execve(char * filename,
+@@ -1412,10 +1475,41 @@ int do_execve(char * filename,
if (retval < 0)
goto out;
@@ -41571,7 +41556,7 @@ diff -urNp linux-2.6.32.43/fs/exec.c linux-2.6.32.43/fs/exec.c
/* execve succeeded */
current->fs->in_exec = 0;
-@@ -1426,6 +1508,14 @@ int do_execve(char * filename,
+@@ -1426,6 +1520,14 @@ int do_execve(char * filename,
put_files_struct(displaced);
return retval;
@@ -41586,7 +41571,7 @@ diff -urNp linux-2.6.32.43/fs/exec.c linux-2.6.32.43/fs/exec.c
out:
if (bprm->mm) {
acct_arg_size(bprm, 0);
-@@ -1591,6 +1681,220 @@ out:
+@@ -1591,6 +1693,220 @@ out:
return ispipe;
}
@@ -41807,7 +41792,7 @@ diff -urNp linux-2.6.32.43/fs/exec.c linux-2.6.32.43/fs/exec.c
static int zap_process(struct task_struct *start)
{
struct task_struct *t;
-@@ -1793,17 +2097,17 @@ static void wait_for_dump_helpers(struct
+@@ -1793,17 +2109,17 @@ static void wait_for_dump_helpers(struct
pipe = file->f_path.dentry->d_inode->i_pipe;
pipe_lock(pipe);
@@ -41830,7 +41815,7 @@ diff -urNp linux-2.6.32.43/fs/exec.c linux-2.6.32.43/fs/exec.c
pipe_unlock(pipe);
}
-@@ -1826,10 +2130,13 @@ void do_coredump(long signr, int exit_co
+@@ -1826,10 +2142,13 @@ void do_coredump(long signr, int exit_co
char **helper_argv = NULL;
int helper_argc = 0;
int dump_count = 0;
@@ -41845,7 +41830,7 @@ diff -urNp linux-2.6.32.43/fs/exec.c linux-2.6.32.43/fs/exec.c
binfmt = mm->binfmt;
if (!binfmt || !binfmt->core_dump)
goto fail;
-@@ -1874,6 +2181,8 @@ void do_coredump(long signr, int exit_co
+@@ -1874,6 +2193,8 @@ void do_coredump(long signr, int exit_co
*/
clear_thread_flag(TIF_SIGPENDING);
@@ -41854,7 +41839,7 @@ diff -urNp linux-2.6.32.43/fs/exec.c linux-2.6.32.43/fs/exec.c
/*
* lock_kernel() because format_corename() is controlled by sysctl, which
* uses lock_kernel()
-@@ -1908,7 +2217,7 @@ void do_coredump(long signr, int exit_co
+@@ -1908,7 +2229,7 @@ void do_coredump(long signr, int exit_co
goto fail_unlock;
}
@@ -41863,7 +41848,7 @@ diff -urNp linux-2.6.32.43/fs/exec.c linux-2.6.32.43/fs/exec.c
if (core_pipe_limit && (core_pipe_limit < dump_count)) {
printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
task_tgid_vnr(current), current->comm);
-@@ -1972,7 +2281,7 @@ close_fail:
+@@ -1972,7 +2293,7 @@ close_fail:
filp_close(file, NULL);
fail_dropcount:
if (dump_count)
@@ -41872,9 +41857,9 @@ diff -urNp linux-2.6.32.43/fs/exec.c linux-2.6.32.43/fs/exec.c
fail_unlock:
if (helper_argv)
argv_free(helper_argv);
-diff -urNp linux-2.6.32.43/fs/ext2/balloc.c linux-2.6.32.43/fs/ext2/balloc.c
---- linux-2.6.32.43/fs/ext2/balloc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/ext2/balloc.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/ext2/balloc.c linux-2.6.32.44/fs/ext2/balloc.c
+--- linux-2.6.32.44/fs/ext2/balloc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/ext2/balloc.c 2011-04-17 15:56:46.000000000 -0400
@@ -1192,7 +1192,7 @@ static int ext2_has_free_blocks(struct e
free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
@@ -41884,9 +41869,9 @@ diff -urNp linux-2.6.32.43/fs/ext2/balloc.c linux-2.6.32.43/fs/ext2/balloc.c
sbi->s_resuid != current_fsuid() &&
(sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
return 0;
-diff -urNp linux-2.6.32.43/fs/ext3/balloc.c linux-2.6.32.43/fs/ext3/balloc.c
---- linux-2.6.32.43/fs/ext3/balloc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/ext3/balloc.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/ext3/balloc.c linux-2.6.32.44/fs/ext3/balloc.c
+--- linux-2.6.32.44/fs/ext3/balloc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/ext3/balloc.c 2011-04-17 15:56:46.000000000 -0400
@@ -1421,7 +1421,7 @@ static int ext3_has_free_blocks(struct e
free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
@@ -41896,9 +41881,9 @@ diff -urNp linux-2.6.32.43/fs/ext3/balloc.c linux-2.6.32.43/fs/ext3/balloc.c
sbi->s_resuid != current_fsuid() &&
(sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
return 0;
-diff -urNp linux-2.6.32.43/fs/ext4/balloc.c linux-2.6.32.43/fs/ext4/balloc.c
---- linux-2.6.32.43/fs/ext4/balloc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/ext4/balloc.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/ext4/balloc.c linux-2.6.32.44/fs/ext4/balloc.c
+--- linux-2.6.32.44/fs/ext4/balloc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/ext4/balloc.c 2011-04-17 15:56:46.000000000 -0400
@@ -570,7 +570,7 @@ int ext4_has_free_blocks(struct ext4_sb_
/* Hm, nope. Are (enough) root reserved blocks available? */
if (sbi->s_resuid == current_fsuid() ||
@@ -41908,9 +41893,9 @@ diff -urNp linux-2.6.32.43/fs/ext4/balloc.c linux-2.6.32.43/fs/ext4/balloc.c
if (free_blocks >= (nblocks + dirty_blocks))
return 1;
}
-diff -urNp linux-2.6.32.43/fs/ext4/ext4.h linux-2.6.32.43/fs/ext4/ext4.h
---- linux-2.6.32.43/fs/ext4/ext4.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/ext4/ext4.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/ext4/ext4.h linux-2.6.32.44/fs/ext4/ext4.h
+--- linux-2.6.32.44/fs/ext4/ext4.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/ext4/ext4.h 2011-04-17 15:56:46.000000000 -0400
@@ -1078,19 +1078,19 @@ struct ext4_sb_info {
/* stats for buddy allocator */
@@ -41941,9 +41926,9 @@ diff -urNp linux-2.6.32.43/fs/ext4/ext4.h linux-2.6.32.43/fs/ext4/ext4.h
atomic_t s_lock_busy;
/* locality groups */
-diff -urNp linux-2.6.32.43/fs/ext4/mballoc.c linux-2.6.32.43/fs/ext4/mballoc.c
---- linux-2.6.32.43/fs/ext4/mballoc.c 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.43/fs/ext4/mballoc.c 2011-06-25 12:56:37.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/ext4/mballoc.c linux-2.6.32.44/fs/ext4/mballoc.c
+--- linux-2.6.32.44/fs/ext4/mballoc.c 2011-06-25 12:55:34.000000000 -0400
++++ linux-2.6.32.44/fs/ext4/mballoc.c 2011-06-25 12:56:37.000000000 -0400
@@ -1755,7 +1755,7 @@ void ext4_mb_simple_scan_group(struct ex
BUG_ON(ac->ac_b_ex.fe_len != ac->ac_g_ex.fe_len);
@@ -42066,9 +42051,9 @@ diff -urNp linux-2.6.32.43/fs/ext4/mballoc.c linux-2.6.32.43/fs/ext4/mballoc.c
if (ac) {
ac->ac_sb = sb;
-diff -urNp linux-2.6.32.43/fs/ext4/super.c linux-2.6.32.43/fs/ext4/super.c
---- linux-2.6.32.43/fs/ext4/super.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/ext4/super.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/ext4/super.c linux-2.6.32.44/fs/ext4/super.c
+--- linux-2.6.32.44/fs/ext4/super.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/ext4/super.c 2011-04-17 15:56:46.000000000 -0400
@@ -2287,7 +2287,7 @@ static void ext4_sb_release(struct kobje
}
@@ -42078,9 +42063,9 @@ diff -urNp linux-2.6.32.43/fs/ext4/super.c linux-2.6.32.43/fs/ext4/super.c
.show = ext4_attr_show,
.store = ext4_attr_store,
};
-diff -urNp linux-2.6.32.43/fs/fcntl.c linux-2.6.32.43/fs/fcntl.c
---- linux-2.6.32.43/fs/fcntl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/fcntl.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/fcntl.c linux-2.6.32.44/fs/fcntl.c
+--- linux-2.6.32.44/fs/fcntl.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/fcntl.c 2011-04-17 15:56:46.000000000 -0400
@@ -223,6 +223,11 @@ int __f_setown(struct file *filp, struct
if (err)
return err;
@@ -42101,9 +42086,9 @@ diff -urNp linux-2.6.32.43/fs/fcntl.c linux-2.6.32.43/fs/fcntl.c
if (arg >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
break;
err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
-diff -urNp linux-2.6.32.43/fs/fifo.c linux-2.6.32.43/fs/fifo.c
---- linux-2.6.32.43/fs/fifo.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/fifo.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/fifo.c linux-2.6.32.44/fs/fifo.c
+--- linux-2.6.32.44/fs/fifo.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/fifo.c 2011-04-17 15:56:46.000000000 -0400
@@ -59,10 +59,10 @@ static int fifo_open(struct inode *inode
*/
filp->f_op = &read_pipefifo_fops;
@@ -42174,9 +42159,9 @@ diff -urNp linux-2.6.32.43/fs/fifo.c linux-2.6.32.43/fs/fifo.c
free_pipe_info(inode);
err_nocleanup:
-diff -urNp linux-2.6.32.43/fs/file.c linux-2.6.32.43/fs/file.c
---- linux-2.6.32.43/fs/file.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/file.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/file.c linux-2.6.32.44/fs/file.c
+--- linux-2.6.32.44/fs/file.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/file.c 2011-04-17 15:56:46.000000000 -0400
@@ -14,6 +14,7 @@
#include <linux/slab.h>
#include <linux/vmalloc.h>
@@ -42194,9 +42179,9 @@ diff -urNp linux-2.6.32.43/fs/file.c linux-2.6.32.43/fs/file.c
if (nr >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
return -EMFILE;
-diff -urNp linux-2.6.32.43/fs/filesystems.c linux-2.6.32.43/fs/filesystems.c
---- linux-2.6.32.43/fs/filesystems.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/filesystems.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/filesystems.c linux-2.6.32.44/fs/filesystems.c
+--- linux-2.6.32.44/fs/filesystems.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/filesystems.c 2011-04-17 15:56:46.000000000 -0400
@@ -272,7 +272,12 @@ struct file_system_type *get_fs_type(con
int len = dot ? dot - name : strlen(name);
@@ -42210,9 +42195,9 @@ diff -urNp linux-2.6.32.43/fs/filesystems.c linux-2.6.32.43/fs/filesystems.c
fs = __get_fs_type(name, len);
if (dot && fs && !(fs->fs_flags & FS_HAS_SUBTYPE)) {
-diff -urNp linux-2.6.32.43/fs/fscache/cookie.c linux-2.6.32.43/fs/fscache/cookie.c
---- linux-2.6.32.43/fs/fscache/cookie.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/fscache/cookie.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/fscache/cookie.c linux-2.6.32.44/fs/fscache/cookie.c
+--- linux-2.6.32.44/fs/fscache/cookie.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/fscache/cookie.c 2011-05-04 17:56:28.000000000 -0400
@@ -68,11 +68,11 @@ struct fscache_cookie *__fscache_acquire
parent ? (char *) parent->def->name : "<no-parent>",
def->name, netfs_data);
@@ -42331,9 +42316,9 @@ diff -urNp linux-2.6.32.43/fs/fscache/cookie.c linux-2.6.32.43/fs/fscache/cookie
wait_on_bit(&cookie->flags, FSCACHE_COOKIE_CREATING,
fscache_wait_bit, TASK_UNINTERRUPTIBLE);
}
-diff -urNp linux-2.6.32.43/fs/fscache/internal.h linux-2.6.32.43/fs/fscache/internal.h
---- linux-2.6.32.43/fs/fscache/internal.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/fscache/internal.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/fscache/internal.h linux-2.6.32.44/fs/fscache/internal.h
+--- linux-2.6.32.44/fs/fscache/internal.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/fscache/internal.h 2011-05-04 17:56:28.000000000 -0400
@@ -136,94 +136,94 @@ extern void fscache_proc_cleanup(void);
extern atomic_t fscache_n_ops_processed[FSCACHE_MAX_THREADS];
extern atomic_t fscache_n_objs_processed[FSCACHE_MAX_THREADS];
@@ -42537,9 +42522,9 @@ diff -urNp linux-2.6.32.43/fs/fscache/internal.h linux-2.6.32.43/fs/fscache/inte
#define fscache_stat_d(stat) do {} while (0)
#endif
-diff -urNp linux-2.6.32.43/fs/fscache/object.c linux-2.6.32.43/fs/fscache/object.c
---- linux-2.6.32.43/fs/fscache/object.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/fscache/object.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/fscache/object.c linux-2.6.32.44/fs/fscache/object.c
+--- linux-2.6.32.44/fs/fscache/object.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/fscache/object.c 2011-05-04 17:56:28.000000000 -0400
@@ -144,7 +144,7 @@ static void fscache_object_state_machine
/* update the object metadata on disk */
case FSCACHE_OBJECT_UPDATING:
@@ -42651,9 +42636,9 @@ diff -urNp linux-2.6.32.43/fs/fscache/object.c linux-2.6.32.43/fs/fscache/object
break;
default:
-diff -urNp linux-2.6.32.43/fs/fscache/operation.c linux-2.6.32.43/fs/fscache/operation.c
---- linux-2.6.32.43/fs/fscache/operation.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/fscache/operation.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/fscache/operation.c linux-2.6.32.44/fs/fscache/operation.c
+--- linux-2.6.32.44/fs/fscache/operation.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/fscache/operation.c 2011-05-04 17:56:28.000000000 -0400
@@ -16,7 +16,7 @@
#include <linux/seq_file.h>
#include "internal.h"
@@ -42769,9 +42754,9 @@ diff -urNp linux-2.6.32.43/fs/fscache/operation.c linux-2.6.32.43/fs/fscache/ope
ASSERTCMP(atomic_read(&op->usage), ==, 0);
-diff -urNp linux-2.6.32.43/fs/fscache/page.c linux-2.6.32.43/fs/fscache/page.c
---- linux-2.6.32.43/fs/fscache/page.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/fscache/page.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/fscache/page.c linux-2.6.32.44/fs/fscache/page.c
+--- linux-2.6.32.44/fs/fscache/page.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/fscache/page.c 2011-05-04 17:56:28.000000000 -0400
@@ -59,7 +59,7 @@ bool __fscache_maybe_release_page(struct
val = radix_tree_lookup(&cookie->stores, page->index);
if (!val) {
@@ -43155,9 +43140,9 @@ diff -urNp linux-2.6.32.43/fs/fscache/page.c linux-2.6.32.43/fs/fscache/page.c
#endif
for (loop = 0; loop < pagevec->nr; loop++) {
-diff -urNp linux-2.6.32.43/fs/fscache/stats.c linux-2.6.32.43/fs/fscache/stats.c
---- linux-2.6.32.43/fs/fscache/stats.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/fscache/stats.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/fscache/stats.c linux-2.6.32.44/fs/fscache/stats.c
+--- linux-2.6.32.44/fs/fscache/stats.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/fscache/stats.c 2011-05-04 17:56:28.000000000 -0400
@@ -18,95 +18,95 @@
/*
* operation counters
@@ -43533,9 +43518,9 @@ diff -urNp linux-2.6.32.43/fs/fscache/stats.c linux-2.6.32.43/fs/fscache/stats.c
seq_printf(m, "CacheOp: alo=%d luo=%d luc=%d gro=%d\n",
atomic_read(&fscache_n_cop_alloc_object),
-diff -urNp linux-2.6.32.43/fs/fs_struct.c linux-2.6.32.43/fs/fs_struct.c
---- linux-2.6.32.43/fs/fs_struct.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/fs_struct.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/fs_struct.c linux-2.6.32.44/fs/fs_struct.c
+--- linux-2.6.32.44/fs/fs_struct.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/fs_struct.c 2011-04-17 15:56:46.000000000 -0400
@@ -4,6 +4,7 @@
#include <linux/path.h>
#include <linux/slab.h>
@@ -43615,9 +43600,9 @@ diff -urNp linux-2.6.32.43/fs/fs_struct.c linux-2.6.32.43/fs/fs_struct.c
write_unlock(&fs->lock);
task_unlock(current);
-diff -urNp linux-2.6.32.43/fs/fuse/cuse.c linux-2.6.32.43/fs/fuse/cuse.c
---- linux-2.6.32.43/fs/fuse/cuse.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/fuse/cuse.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/fuse/cuse.c linux-2.6.32.44/fs/fuse/cuse.c
+--- linux-2.6.32.44/fs/fuse/cuse.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/fuse/cuse.c 2011-08-05 20:33:55.000000000 -0400
@@ -576,10 +576,12 @@ static int __init cuse_init(void)
INIT_LIST_HEAD(&cuse_conntbl[i]);
@@ -43635,9 +43620,9 @@ diff -urNp linux-2.6.32.43/fs/fuse/cuse.c linux-2.6.32.43/fs/fuse/cuse.c
cuse_class = class_create(THIS_MODULE, "cuse");
if (IS_ERR(cuse_class))
-diff -urNp linux-2.6.32.43/fs/fuse/dev.c linux-2.6.32.43/fs/fuse/dev.c
---- linux-2.6.32.43/fs/fuse/dev.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/fuse/dev.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/fuse/dev.c linux-2.6.32.44/fs/fuse/dev.c
+--- linux-2.6.32.44/fs/fuse/dev.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/fuse/dev.c 2011-08-05 20:33:55.000000000 -0400
@@ -885,7 +885,7 @@ static int fuse_notify_inval_entry(struc
{
struct fuse_notify_inval_entry_out outarg;
@@ -43681,9 +43666,9 @@ diff -urNp linux-2.6.32.43/fs/fuse/dev.c linux-2.6.32.43/fs/fuse/dev.c
return err;
}
-diff -urNp linux-2.6.32.43/fs/fuse/dir.c linux-2.6.32.43/fs/fuse/dir.c
---- linux-2.6.32.43/fs/fuse/dir.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/fuse/dir.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/fuse/dir.c linux-2.6.32.44/fs/fuse/dir.c
+--- linux-2.6.32.44/fs/fuse/dir.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/fuse/dir.c 2011-04-17 15:56:46.000000000 -0400
@@ -1127,7 +1127,7 @@ static char *read_link(struct dentry *de
return link;
}
@@ -43693,9 +43678,9 @@ diff -urNp linux-2.6.32.43/fs/fuse/dir.c linux-2.6.32.43/fs/fuse/dir.c
{
if (!IS_ERR(link))
free_page((unsigned long) link);
-diff -urNp linux-2.6.32.43/fs/gfs2/ops_inode.c linux-2.6.32.43/fs/gfs2/ops_inode.c
---- linux-2.6.32.43/fs/gfs2/ops_inode.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/gfs2/ops_inode.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/gfs2/ops_inode.c linux-2.6.32.44/fs/gfs2/ops_inode.c
+--- linux-2.6.32.44/fs/gfs2/ops_inode.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/gfs2/ops_inode.c 2011-05-16 21:46:57.000000000 -0400
@@ -752,6 +752,8 @@ static int gfs2_rename(struct inode *odi
unsigned int x;
int error;
@@ -43705,9 +43690,9 @@ diff -urNp linux-2.6.32.43/fs/gfs2/ops_inode.c linux-2.6.32.43/fs/gfs2/ops_inode
if (ndentry->d_inode) {
nip = GFS2_I(ndentry->d_inode);
if (ip == nip)
-diff -urNp linux-2.6.32.43/fs/gfs2/sys.c linux-2.6.32.43/fs/gfs2/sys.c
---- linux-2.6.32.43/fs/gfs2/sys.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/gfs2/sys.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/gfs2/sys.c linux-2.6.32.44/fs/gfs2/sys.c
+--- linux-2.6.32.44/fs/gfs2/sys.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/gfs2/sys.c 2011-04-17 15:56:46.000000000 -0400
@@ -49,7 +49,7 @@ static ssize_t gfs2_attr_store(struct ko
return a->store ? a->store(sdp, buf, len) : len;
}
@@ -43726,9 +43711,9 @@ diff -urNp linux-2.6.32.43/fs/gfs2/sys.c linux-2.6.32.43/fs/gfs2/sys.c
.uevent = gfs2_uevent,
};
-diff -urNp linux-2.6.32.43/fs/hfsplus/catalog.c linux-2.6.32.43/fs/hfsplus/catalog.c
---- linux-2.6.32.43/fs/hfsplus/catalog.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/hfsplus/catalog.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/hfsplus/catalog.c linux-2.6.32.44/fs/hfsplus/catalog.c
+--- linux-2.6.32.44/fs/hfsplus/catalog.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/hfsplus/catalog.c 2011-05-16 21:46:57.000000000 -0400
@@ -157,6 +157,8 @@ int hfsplus_find_cat(struct super_block
int err;
u16 type;
@@ -43756,9 +43741,9 @@ diff -urNp linux-2.6.32.43/fs/hfsplus/catalog.c linux-2.6.32.43/fs/hfsplus/catal
dprint(DBG_CAT_MOD, "rename_cat: %u - %lu,%s - %lu,%s\n", cnid, src_dir->i_ino, src_name->name,
dst_dir->i_ino, dst_name->name);
sb = src_dir->i_sb;
-diff -urNp linux-2.6.32.43/fs/hfsplus/dir.c linux-2.6.32.43/fs/hfsplus/dir.c
---- linux-2.6.32.43/fs/hfsplus/dir.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/hfsplus/dir.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/hfsplus/dir.c linux-2.6.32.44/fs/hfsplus/dir.c
+--- linux-2.6.32.44/fs/hfsplus/dir.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/hfsplus/dir.c 2011-05-16 21:46:57.000000000 -0400
@@ -121,6 +121,8 @@ static int hfsplus_readdir(struct file *
struct hfsplus_readdir_data *rd;
u16 type;
@@ -43768,9 +43753,9 @@ diff -urNp linux-2.6.32.43/fs/hfsplus/dir.c linux-2.6.32.43/fs/hfsplus/dir.c
if (filp->f_pos >= inode->i_size)
return 0;
-diff -urNp linux-2.6.32.43/fs/hfsplus/inode.c linux-2.6.32.43/fs/hfsplus/inode.c
---- linux-2.6.32.43/fs/hfsplus/inode.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/hfsplus/inode.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/hfsplus/inode.c linux-2.6.32.44/fs/hfsplus/inode.c
+--- linux-2.6.32.44/fs/hfsplus/inode.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/hfsplus/inode.c 2011-05-16 21:46:57.000000000 -0400
@@ -399,6 +399,8 @@ int hfsplus_cat_read_inode(struct inode
int res = 0;
u16 type;
@@ -43789,9 +43774,9 @@ diff -urNp linux-2.6.32.43/fs/hfsplus/inode.c linux-2.6.32.43/fs/hfsplus/inode.c
if (HFSPLUS_IS_RSRC(inode))
main_inode = HFSPLUS_I(inode).rsrc_inode;
-diff -urNp linux-2.6.32.43/fs/hfsplus/ioctl.c linux-2.6.32.43/fs/hfsplus/ioctl.c
---- linux-2.6.32.43/fs/hfsplus/ioctl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/hfsplus/ioctl.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/hfsplus/ioctl.c linux-2.6.32.44/fs/hfsplus/ioctl.c
+--- linux-2.6.32.44/fs/hfsplus/ioctl.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/hfsplus/ioctl.c 2011-05-16 21:46:57.000000000 -0400
@@ -101,6 +101,8 @@ int hfsplus_setxattr(struct dentry *dent
struct hfsplus_cat_file *file;
int res;
@@ -43810,9 +43795,9 @@ diff -urNp linux-2.6.32.43/fs/hfsplus/ioctl.c linux-2.6.32.43/fs/hfsplus/ioctl.c
if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
return -EOPNOTSUPP;
-diff -urNp linux-2.6.32.43/fs/hfsplus/super.c linux-2.6.32.43/fs/hfsplus/super.c
---- linux-2.6.32.43/fs/hfsplus/super.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/hfsplus/super.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/hfsplus/super.c linux-2.6.32.44/fs/hfsplus/super.c
+--- linux-2.6.32.44/fs/hfsplus/super.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/hfsplus/super.c 2011-05-16 21:46:57.000000000 -0400
@@ -312,6 +312,8 @@ static int hfsplus_fill_super(struct sup
struct nls_table *nls = NULL;
int err = -EINVAL;
@@ -43822,9 +43807,9 @@ diff -urNp linux-2.6.32.43/fs/hfsplus/super.c linux-2.6.32.43/fs/hfsplus/super.c
sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
if (!sbi)
return -ENOMEM;
-diff -urNp linux-2.6.32.43/fs/hugetlbfs/inode.c linux-2.6.32.43/fs/hugetlbfs/inode.c
---- linux-2.6.32.43/fs/hugetlbfs/inode.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/hugetlbfs/inode.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/hugetlbfs/inode.c linux-2.6.32.44/fs/hugetlbfs/inode.c
+--- linux-2.6.32.44/fs/hugetlbfs/inode.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/hugetlbfs/inode.c 2011-04-17 15:56:46.000000000 -0400
@@ -909,7 +909,7 @@ static struct file_system_type hugetlbfs
.kill_sb = kill_litter_super,
};
@@ -43834,9 +43819,9 @@ diff -urNp linux-2.6.32.43/fs/hugetlbfs/inode.c linux-2.6.32.43/fs/hugetlbfs/ino
static int can_do_hugetlb_shm(void)
{
-diff -urNp linux-2.6.32.43/fs/ioctl.c linux-2.6.32.43/fs/ioctl.c
---- linux-2.6.32.43/fs/ioctl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/ioctl.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/ioctl.c linux-2.6.32.44/fs/ioctl.c
+--- linux-2.6.32.44/fs/ioctl.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/ioctl.c 2011-04-17 15:56:46.000000000 -0400
@@ -97,7 +97,7 @@ int fiemap_fill_next_extent(struct fiema
u64 phys, u64 len, u32 flags)
{
@@ -43864,9 +43849,9 @@ diff -urNp linux-2.6.32.43/fs/ioctl.c linux-2.6.32.43/fs/ioctl.c
error = -EFAULT;
return error;
-diff -urNp linux-2.6.32.43/fs/jbd/checkpoint.c linux-2.6.32.43/fs/jbd/checkpoint.c
---- linux-2.6.32.43/fs/jbd/checkpoint.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/jbd/checkpoint.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/jbd/checkpoint.c linux-2.6.32.44/fs/jbd/checkpoint.c
+--- linux-2.6.32.44/fs/jbd/checkpoint.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/jbd/checkpoint.c 2011-05-16 21:46:57.000000000 -0400
@@ -348,6 +348,8 @@ int log_do_checkpoint(journal_t *journal
tid_t this_tid;
int result;
@@ -43876,9 +43861,9 @@ diff -urNp linux-2.6.32.43/fs/jbd/checkpoint.c linux-2.6.32.43/fs/jbd/checkpoint
jbd_debug(1, "Start checkpoint\n");
/*
-diff -urNp linux-2.6.32.43/fs/jffs2/compr_rtime.c linux-2.6.32.43/fs/jffs2/compr_rtime.c
---- linux-2.6.32.43/fs/jffs2/compr_rtime.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/jffs2/compr_rtime.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/jffs2/compr_rtime.c linux-2.6.32.44/fs/jffs2/compr_rtime.c
+--- linux-2.6.32.44/fs/jffs2/compr_rtime.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/jffs2/compr_rtime.c 2011-05-16 21:46:57.000000000 -0400
@@ -37,6 +37,8 @@ static int jffs2_rtime_compress(unsigned
int outpos = 0;
int pos=0;
@@ -43897,9 +43882,9 @@ diff -urNp linux-2.6.32.43/fs/jffs2/compr_rtime.c linux-2.6.32.43/fs/jffs2/compr
memset(positions,0,sizeof(positions));
while (outpos<destlen) {
-diff -urNp linux-2.6.32.43/fs/jffs2/compr_rubin.c linux-2.6.32.43/fs/jffs2/compr_rubin.c
---- linux-2.6.32.43/fs/jffs2/compr_rubin.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/jffs2/compr_rubin.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/jffs2/compr_rubin.c linux-2.6.32.44/fs/jffs2/compr_rubin.c
+--- linux-2.6.32.44/fs/jffs2/compr_rubin.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/jffs2/compr_rubin.c 2011-05-16 21:46:57.000000000 -0400
@@ -314,6 +314,8 @@ static int jffs2_dynrubin_compress(unsig
int ret;
uint32_t mysrclen, mydstlen;
@@ -43909,9 +43894,9 @@ diff -urNp linux-2.6.32.43/fs/jffs2/compr_rubin.c linux-2.6.32.43/fs/jffs2/compr
mysrclen = *sourcelen;
mydstlen = *dstlen - 8;
-diff -urNp linux-2.6.32.43/fs/jffs2/erase.c linux-2.6.32.43/fs/jffs2/erase.c
---- linux-2.6.32.43/fs/jffs2/erase.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/jffs2/erase.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/jffs2/erase.c linux-2.6.32.44/fs/jffs2/erase.c
+--- linux-2.6.32.44/fs/jffs2/erase.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/jffs2/erase.c 2011-04-17 15:56:46.000000000 -0400
@@ -434,7 +434,8 @@ static void jffs2_mark_erased_block(stru
struct jffs2_unknown_node marker = {
.magic = cpu_to_je16(JFFS2_MAGIC_BITMASK),
@@ -43922,9 +43907,9 @@ diff -urNp linux-2.6.32.43/fs/jffs2/erase.c linux-2.6.32.43/fs/jffs2/erase.c
};
jffs2_prealloc_raw_node_refs(c, jeb, 1);
-diff -urNp linux-2.6.32.43/fs/jffs2/wbuf.c linux-2.6.32.43/fs/jffs2/wbuf.c
---- linux-2.6.32.43/fs/jffs2/wbuf.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/jffs2/wbuf.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/jffs2/wbuf.c linux-2.6.32.44/fs/jffs2/wbuf.c
+--- linux-2.6.32.44/fs/jffs2/wbuf.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/jffs2/wbuf.c 2011-04-17 15:56:46.000000000 -0400
@@ -1012,7 +1012,8 @@ static const struct jffs2_unknown_node o
{
.magic = constant_cpu_to_je16(JFFS2_MAGIC_BITMASK),
@@ -43935,9 +43920,9 @@ diff -urNp linux-2.6.32.43/fs/jffs2/wbuf.c linux-2.6.32.43/fs/jffs2/wbuf.c
};
/*
-diff -urNp linux-2.6.32.43/fs/jffs2/xattr.c linux-2.6.32.43/fs/jffs2/xattr.c
---- linux-2.6.32.43/fs/jffs2/xattr.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/jffs2/xattr.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/jffs2/xattr.c linux-2.6.32.44/fs/jffs2/xattr.c
+--- linux-2.6.32.44/fs/jffs2/xattr.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/jffs2/xattr.c 2011-05-16 21:46:57.000000000 -0400
@@ -773,6 +773,8 @@ void jffs2_build_xattr_subsystem(struct
BUG_ON(!(c->flags & JFFS2_SB_FLAG_BUILDING));
@@ -43947,9 +43932,9 @@ diff -urNp linux-2.6.32.43/fs/jffs2/xattr.c linux-2.6.32.43/fs/jffs2/xattr.c
/* Phase.1 : Merge same xref */
for (i=0; i < XREF_TMPHASH_SIZE; i++)
xref_tmphash[i] = NULL;
-diff -urNp linux-2.6.32.43/fs/jfs/super.c linux-2.6.32.43/fs/jfs/super.c
---- linux-2.6.32.43/fs/jfs/super.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/jfs/super.c 2011-06-07 18:06:04.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/jfs/super.c linux-2.6.32.44/fs/jfs/super.c
+--- linux-2.6.32.44/fs/jfs/super.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/jfs/super.c 2011-06-07 18:06:04.000000000 -0400
@@ -793,7 +793,7 @@ static int __init init_jfs_fs(void)
jfs_inode_cachep =
@@ -43959,9 +43944,9 @@ diff -urNp linux-2.6.32.43/fs/jfs/super.c linux-2.6.32.43/fs/jfs/super.c
init_once);
if (jfs_inode_cachep == NULL)
return -ENOMEM;
-diff -urNp linux-2.6.32.43/fs/Kconfig.binfmt linux-2.6.32.43/fs/Kconfig.binfmt
---- linux-2.6.32.43/fs/Kconfig.binfmt 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/Kconfig.binfmt 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/Kconfig.binfmt linux-2.6.32.44/fs/Kconfig.binfmt
+--- linux-2.6.32.44/fs/Kconfig.binfmt 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/Kconfig.binfmt 2011-04-17 15:56:46.000000000 -0400
@@ -86,7 +86,7 @@ config HAVE_AOUT
config BINFMT_AOUT
@@ -43971,9 +43956,9 @@ diff -urNp linux-2.6.32.43/fs/Kconfig.binfmt linux-2.6.32.43/fs/Kconfig.binfmt
---help---
A.out (Assembler.OUTput) is a set of formats for libraries and
executables used in the earliest versions of UNIX. Linux used
-diff -urNp linux-2.6.32.43/fs/libfs.c linux-2.6.32.43/fs/libfs.c
---- linux-2.6.32.43/fs/libfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/libfs.c 2011-05-11 18:25:15.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/libfs.c linux-2.6.32.44/fs/libfs.c
+--- linux-2.6.32.44/fs/libfs.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/libfs.c 2011-05-11 18:25:15.000000000 -0400
@@ -157,12 +157,20 @@ int dcache_readdir(struct file * filp, v
for (p=q->next; p != &dentry->d_subdirs; p=p->next) {
@@ -43996,9 +43981,9 @@ diff -urNp linux-2.6.32.43/fs/libfs.c linux-2.6.32.43/fs/libfs.c
next->d_name.len, filp->f_pos,
next->d_inode->i_ino,
dt_type(next->d_inode)) < 0)
-diff -urNp linux-2.6.32.43/fs/lockd/clntproc.c linux-2.6.32.43/fs/lockd/clntproc.c
---- linux-2.6.32.43/fs/lockd/clntproc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/lockd/clntproc.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/lockd/clntproc.c linux-2.6.32.44/fs/lockd/clntproc.c
+--- linux-2.6.32.44/fs/lockd/clntproc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/lockd/clntproc.c 2011-05-16 21:46:57.000000000 -0400
@@ -36,11 +36,11 @@ static const struct rpc_call_ops nlmclnt
/*
* Cookie counter for NLM requests
@@ -44022,9 +44007,9 @@ diff -urNp linux-2.6.32.43/fs/lockd/clntproc.c linux-2.6.32.43/fs/lockd/clntproc
req = &reqst;
memset(req, 0, sizeof(*req));
locks_init_lock(&req->a_args.lock.fl);
-diff -urNp linux-2.6.32.43/fs/lockd/svc.c linux-2.6.32.43/fs/lockd/svc.c
---- linux-2.6.32.43/fs/lockd/svc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/lockd/svc.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/lockd/svc.c linux-2.6.32.44/fs/lockd/svc.c
+--- linux-2.6.32.44/fs/lockd/svc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/lockd/svc.c 2011-04-17 15:56:46.000000000 -0400
@@ -43,7 +43,7 @@
static struct svc_program nlmsvc_program;
@@ -44034,9 +44019,9 @@ diff -urNp linux-2.6.32.43/fs/lockd/svc.c linux-2.6.32.43/fs/lockd/svc.c
EXPORT_SYMBOL_GPL(nlmsvc_ops);
static DEFINE_MUTEX(nlmsvc_mutex);
-diff -urNp linux-2.6.32.43/fs/locks.c linux-2.6.32.43/fs/locks.c
---- linux-2.6.32.43/fs/locks.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/locks.c 2011-07-06 19:47:11.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/locks.c linux-2.6.32.44/fs/locks.c
+--- linux-2.6.32.44/fs/locks.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/locks.c 2011-07-06 19:47:11.000000000 -0400
@@ -145,10 +145,28 @@ static LIST_HEAD(blocked_list);
static struct kmem_cache *filelock_cache __read_mostly;
@@ -44107,9 +44092,9 @@ diff -urNp linux-2.6.32.43/fs/locks.c linux-2.6.32.43/fs/locks.c
}
lock_kernel();
-diff -urNp linux-2.6.32.43/fs/mbcache.c linux-2.6.32.43/fs/mbcache.c
---- linux-2.6.32.43/fs/mbcache.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/mbcache.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/mbcache.c linux-2.6.32.44/fs/mbcache.c
+--- linux-2.6.32.44/fs/mbcache.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/mbcache.c 2011-08-05 20:33:55.000000000 -0400
@@ -266,9 +266,9 @@ mb_cache_create(const char *name, struct
if (!cache)
goto fail;
@@ -44122,9 +44107,9 @@ diff -urNp linux-2.6.32.43/fs/mbcache.c linux-2.6.32.43/fs/mbcache.c
atomic_set(&cache->c_entry_count, 0);
cache->c_bucket_bits = bucket_bits;
#ifdef MB_CACHE_INDEXES_COUNT
-diff -urNp linux-2.6.32.43/fs/namei.c linux-2.6.32.43/fs/namei.c
---- linux-2.6.32.43/fs/namei.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/namei.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/namei.c linux-2.6.32.44/fs/namei.c
+--- linux-2.6.32.44/fs/namei.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/namei.c 2011-05-16 21:46:57.000000000 -0400
@@ -224,14 +224,6 @@ int generic_permission(struct inode *ino
return ret;
@@ -44560,9 +44545,9 @@ diff -urNp linux-2.6.32.43/fs/namei.c linux-2.6.32.43/fs/namei.c
len = -EFAULT;
out:
return len;
-diff -urNp linux-2.6.32.43/fs/namespace.c linux-2.6.32.43/fs/namespace.c
---- linux-2.6.32.43/fs/namespace.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/namespace.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/namespace.c linux-2.6.32.44/fs/namespace.c
+--- linux-2.6.32.44/fs/namespace.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/namespace.c 2011-04-17 15:56:46.000000000 -0400
@@ -1083,6 +1083,9 @@ static int do_umount(struct vfsmount *mn
if (!(sb->s_flags & MS_RDONLY))
retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
@@ -44623,9 +44608,9 @@ diff -urNp linux-2.6.32.43/fs/namespace.c linux-2.6.32.43/fs/namespace.c
read_lock(¤t->fs->lock);
root = current->fs->root;
path_get(¤t->fs->root);
-diff -urNp linux-2.6.32.43/fs/ncpfs/dir.c linux-2.6.32.43/fs/ncpfs/dir.c
---- linux-2.6.32.43/fs/ncpfs/dir.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/ncpfs/dir.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/ncpfs/dir.c linux-2.6.32.44/fs/ncpfs/dir.c
+--- linux-2.6.32.44/fs/ncpfs/dir.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/ncpfs/dir.c 2011-05-16 21:46:57.000000000 -0400
@@ -275,6 +275,8 @@ __ncp_lookup_validate(struct dentry *den
int res, val = 0, len;
__u8 __name[NCP_MAXPATHLEN + 1];
@@ -44685,9 +44670,9 @@ diff -urNp linux-2.6.32.43/fs/ncpfs/dir.c linux-2.6.32.43/fs/ncpfs/dir.c
DPRINTK("ncp_rename: %s/%s to %s/%s\n",
old_dentry->d_parent->d_name.name, old_dentry->d_name.name,
new_dentry->d_parent->d_name.name, new_dentry->d_name.name);
-diff -urNp linux-2.6.32.43/fs/ncpfs/inode.c linux-2.6.32.43/fs/ncpfs/inode.c
---- linux-2.6.32.43/fs/ncpfs/inode.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/ncpfs/inode.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/ncpfs/inode.c linux-2.6.32.44/fs/ncpfs/inode.c
+--- linux-2.6.32.44/fs/ncpfs/inode.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/ncpfs/inode.c 2011-05-16 21:46:57.000000000 -0400
@@ -445,6 +445,8 @@ static int ncp_fill_super(struct super_b
#endif
struct ncp_entry_info finfo;
@@ -44697,9 +44682,9 @@ diff -urNp linux-2.6.32.43/fs/ncpfs/inode.c linux-2.6.32.43/fs/ncpfs/inode.c
data.wdog_pid = NULL;
server = kzalloc(sizeof(struct ncp_server), GFP_KERNEL);
if (!server)
-diff -urNp linux-2.6.32.43/fs/nfs/inode.c linux-2.6.32.43/fs/nfs/inode.c
---- linux-2.6.32.43/fs/nfs/inode.c 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.43/fs/nfs/inode.c 2011-07-06 19:53:33.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/nfs/inode.c linux-2.6.32.44/fs/nfs/inode.c
+--- linux-2.6.32.44/fs/nfs/inode.c 2011-05-10 22:12:01.000000000 -0400
++++ linux-2.6.32.44/fs/nfs/inode.c 2011-07-06 19:53:33.000000000 -0400
@@ -156,7 +156,7 @@ static void nfs_zap_caches_locked(struct
nfsi->attrtimeo = NFS_MINATTRTIMEO(inode);
nfsi->attrtimeo_timestamp = jiffies;
@@ -44729,9 +44714,9 @@ diff -urNp linux-2.6.32.43/fs/nfs/inode.c linux-2.6.32.43/fs/nfs/inode.c
}
void nfs_fattr_init(struct nfs_fattr *fattr)
-diff -urNp linux-2.6.32.43/fs/nfsd/lockd.c linux-2.6.32.43/fs/nfsd/lockd.c
---- linux-2.6.32.43/fs/nfsd/lockd.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.43/fs/nfsd/lockd.c 2011-04-17 17:03:15.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/nfsd/lockd.c linux-2.6.32.44/fs/nfsd/lockd.c
+--- linux-2.6.32.44/fs/nfsd/lockd.c 2011-04-17 17:00:52.000000000 -0400
++++ linux-2.6.32.44/fs/nfsd/lockd.c 2011-04-17 17:03:15.000000000 -0400
@@ -66,7 +66,7 @@ nlm_fclose(struct file *filp)
fput(filp);
}
@@ -44741,9 +44726,9 @@ diff -urNp linux-2.6.32.43/fs/nfsd/lockd.c linux-2.6.32.43/fs/nfsd/lockd.c
.fopen = nlm_fopen, /* open file for locking */
.fclose = nlm_fclose, /* close file */
};
-diff -urNp linux-2.6.32.43/fs/nfsd/nfs4state.c linux-2.6.32.43/fs/nfsd/nfs4state.c
---- linux-2.6.32.43/fs/nfsd/nfs4state.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/nfsd/nfs4state.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/nfsd/nfs4state.c linux-2.6.32.44/fs/nfsd/nfs4state.c
+--- linux-2.6.32.44/fs/nfsd/nfs4state.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/nfsd/nfs4state.c 2011-05-16 21:46:57.000000000 -0400
@@ -3457,6 +3457,8 @@ nfsd4_lock(struct svc_rqst *rqstp, struc
unsigned int cmd;
int err;
@@ -44753,9 +44738,9 @@ diff -urNp linux-2.6.32.43/fs/nfsd/nfs4state.c linux-2.6.32.43/fs/nfsd/nfs4state
dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n",
(long long) lock->lk_offset,
(long long) lock->lk_length);
-diff -urNp linux-2.6.32.43/fs/nfsd/nfs4xdr.c linux-2.6.32.43/fs/nfsd/nfs4xdr.c
---- linux-2.6.32.43/fs/nfsd/nfs4xdr.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/nfsd/nfs4xdr.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/nfsd/nfs4xdr.c linux-2.6.32.44/fs/nfsd/nfs4xdr.c
+--- linux-2.6.32.44/fs/nfsd/nfs4xdr.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/nfsd/nfs4xdr.c 2011-05-16 21:46:57.000000000 -0400
@@ -1751,6 +1751,8 @@ nfsd4_encode_fattr(struct svc_fh *fhp, s
struct nfsd4_compoundres *resp = rqstp->rq_resp;
u32 minorversion = resp->cstate.minorversion;
@@ -44765,9 +44750,9 @@ diff -urNp linux-2.6.32.43/fs/nfsd/nfs4xdr.c linux-2.6.32.43/fs/nfsd/nfs4xdr.c
BUG_ON(bmval1 & NFSD_WRITEONLY_ATTRS_WORD1);
BUG_ON(bmval0 & ~nfsd_suppattrs0(minorversion));
BUG_ON(bmval1 & ~nfsd_suppattrs1(minorversion));
-diff -urNp linux-2.6.32.43/fs/nfsd/vfs.c linux-2.6.32.43/fs/nfsd/vfs.c
---- linux-2.6.32.43/fs/nfsd/vfs.c 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.43/fs/nfsd/vfs.c 2011-05-10 22:12:33.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/nfsd/vfs.c linux-2.6.32.44/fs/nfsd/vfs.c
+--- linux-2.6.32.44/fs/nfsd/vfs.c 2011-05-10 22:12:01.000000000 -0400
++++ linux-2.6.32.44/fs/nfsd/vfs.c 2011-05-10 22:12:33.000000000 -0400
@@ -937,7 +937,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, st
} else {
oldfs = get_fs();
@@ -44795,9 +44780,9 @@ diff -urNp linux-2.6.32.43/fs/nfsd/vfs.c linux-2.6.32.43/fs/nfsd/vfs.c
set_fs(oldfs);
if (host_err < 0)
-diff -urNp linux-2.6.32.43/fs/nilfs2/ioctl.c linux-2.6.32.43/fs/nilfs2/ioctl.c
---- linux-2.6.32.43/fs/nilfs2/ioctl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/nilfs2/ioctl.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/nilfs2/ioctl.c linux-2.6.32.44/fs/nilfs2/ioctl.c
+--- linux-2.6.32.44/fs/nilfs2/ioctl.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/nilfs2/ioctl.c 2011-05-04 17:56:28.000000000 -0400
@@ -480,7 +480,7 @@ static int nilfs_ioctl_clean_segments(st
unsigned int cmd, void __user *argp)
{
@@ -44807,9 +44792,9 @@ diff -urNp linux-2.6.32.43/fs/nilfs2/ioctl.c linux-2.6.32.43/fs/nilfs2/ioctl.c
sizeof(struct nilfs_vdesc),
sizeof(struct nilfs_period),
sizeof(__u64),
-diff -urNp linux-2.6.32.43/fs/notify/dnotify/dnotify.c linux-2.6.32.43/fs/notify/dnotify/dnotify.c
---- linux-2.6.32.43/fs/notify/dnotify/dnotify.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/notify/dnotify/dnotify.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/notify/dnotify/dnotify.c linux-2.6.32.44/fs/notify/dnotify/dnotify.c
+--- linux-2.6.32.44/fs/notify/dnotify/dnotify.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/notify/dnotify/dnotify.c 2011-04-17 15:56:46.000000000 -0400
@@ -173,7 +173,7 @@ static void dnotify_free_mark(struct fsn
kmem_cache_free(dnotify_mark_entry_cache, dnentry);
}
@@ -44819,9 +44804,9 @@ diff -urNp linux-2.6.32.43/fs/notify/dnotify/dnotify.c linux-2.6.32.43/fs/notify
.handle_event = dnotify_handle_event,
.should_send_event = dnotify_should_send_event,
.free_group_priv = NULL,
-diff -urNp linux-2.6.32.43/fs/notify/notification.c linux-2.6.32.43/fs/notify/notification.c
---- linux-2.6.32.43/fs/notify/notification.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/notify/notification.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/notify/notification.c linux-2.6.32.44/fs/notify/notification.c
+--- linux-2.6.32.44/fs/notify/notification.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/notify/notification.c 2011-05-04 17:56:28.000000000 -0400
@@ -57,7 +57,7 @@ static struct kmem_cache *fsnotify_event
* get set to 0 so it will never get 'freed'
*/
@@ -44840,9 +44825,9 @@ diff -urNp linux-2.6.32.43/fs/notify/notification.c linux-2.6.32.43/fs/notify/no
}
EXPORT_SYMBOL_GPL(fsnotify_get_cookie);
-diff -urNp linux-2.6.32.43/fs/ntfs/dir.c linux-2.6.32.43/fs/ntfs/dir.c
---- linux-2.6.32.43/fs/ntfs/dir.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/ntfs/dir.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/ntfs/dir.c linux-2.6.32.44/fs/ntfs/dir.c
+--- linux-2.6.32.44/fs/ntfs/dir.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/ntfs/dir.c 2011-04-17 15:56:46.000000000 -0400
@@ -1328,7 +1328,7 @@ find_next_index_buffer:
ia = (INDEX_ALLOCATION*)(kaddr + (ia_pos & ~PAGE_CACHE_MASK &
~(s64)(ndir->itype.index.block_size - 1)));
@@ -44852,9 +44837,9 @@ diff -urNp linux-2.6.32.43/fs/ntfs/dir.c linux-2.6.32.43/fs/ntfs/dir.c
ntfs_error(sb, "Out of bounds check failed. Corrupt directory "
"inode 0x%lx or driver bug.", vdir->i_ino);
goto err_out;
-diff -urNp linux-2.6.32.43/fs/ntfs/file.c linux-2.6.32.43/fs/ntfs/file.c
---- linux-2.6.32.43/fs/ntfs/file.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/ntfs/file.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/ntfs/file.c linux-2.6.32.44/fs/ntfs/file.c
+--- linux-2.6.32.44/fs/ntfs/file.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/ntfs/file.c 2011-04-17 15:56:46.000000000 -0400
@@ -2243,6 +2243,6 @@ const struct inode_operations ntfs_file_
#endif /* NTFS_RW */
};
@@ -44864,9 +44849,9 @@ diff -urNp linux-2.6.32.43/fs/ntfs/file.c linux-2.6.32.43/fs/ntfs/file.c
-const struct inode_operations ntfs_empty_inode_ops = {};
+const struct inode_operations ntfs_empty_inode_ops __read_only;
-diff -urNp linux-2.6.32.43/fs/ocfs2/cluster/masklog.c linux-2.6.32.43/fs/ocfs2/cluster/masklog.c
---- linux-2.6.32.43/fs/ocfs2/cluster/masklog.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/ocfs2/cluster/masklog.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/ocfs2/cluster/masklog.c linux-2.6.32.44/fs/ocfs2/cluster/masklog.c
+--- linux-2.6.32.44/fs/ocfs2/cluster/masklog.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/ocfs2/cluster/masklog.c 2011-04-17 15:56:46.000000000 -0400
@@ -135,7 +135,7 @@ static ssize_t mlog_store(struct kobject
return mlog_mask_store(mlog_attr->mask, buf, count);
}
@@ -44876,9 +44861,9 @@ diff -urNp linux-2.6.32.43/fs/ocfs2/cluster/masklog.c linux-2.6.32.43/fs/ocfs2/c
.show = mlog_show,
.store = mlog_store,
};
-diff -urNp linux-2.6.32.43/fs/ocfs2/localalloc.c linux-2.6.32.43/fs/ocfs2/localalloc.c
---- linux-2.6.32.43/fs/ocfs2/localalloc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/ocfs2/localalloc.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/ocfs2/localalloc.c linux-2.6.32.44/fs/ocfs2/localalloc.c
+--- linux-2.6.32.44/fs/ocfs2/localalloc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/ocfs2/localalloc.c 2011-04-17 15:56:46.000000000 -0400
@@ -1188,7 +1188,7 @@ static int ocfs2_local_alloc_slide_windo
goto bail;
}
@@ -44888,9 +44873,9 @@ diff -urNp linux-2.6.32.43/fs/ocfs2/localalloc.c linux-2.6.32.43/fs/ocfs2/locala
status = 0;
bail:
-diff -urNp linux-2.6.32.43/fs/ocfs2/namei.c linux-2.6.32.43/fs/ocfs2/namei.c
---- linux-2.6.32.43/fs/ocfs2/namei.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/ocfs2/namei.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/ocfs2/namei.c linux-2.6.32.44/fs/ocfs2/namei.c
+--- linux-2.6.32.44/fs/ocfs2/namei.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/ocfs2/namei.c 2011-05-16 21:46:57.000000000 -0400
@@ -1043,6 +1043,8 @@ static int ocfs2_rename(struct inode *ol
struct ocfs2_dir_lookup_result orphan_insert = { NULL, };
struct ocfs2_dir_lookup_result target_insert = { NULL, };
@@ -44900,9 +44885,9 @@ diff -urNp linux-2.6.32.43/fs/ocfs2/namei.c linux-2.6.32.43/fs/ocfs2/namei.c
/* At some point it might be nice to break this function up a
* bit. */
-diff -urNp linux-2.6.32.43/fs/ocfs2/ocfs2.h linux-2.6.32.43/fs/ocfs2/ocfs2.h
---- linux-2.6.32.43/fs/ocfs2/ocfs2.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/ocfs2/ocfs2.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/ocfs2/ocfs2.h linux-2.6.32.44/fs/ocfs2/ocfs2.h
+--- linux-2.6.32.44/fs/ocfs2/ocfs2.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/ocfs2/ocfs2.h 2011-04-17 15:56:46.000000000 -0400
@@ -217,11 +217,11 @@ enum ocfs2_vol_state
struct ocfs2_alloc_stats
@@ -44920,9 +44905,9 @@ diff -urNp linux-2.6.32.43/fs/ocfs2/ocfs2.h linux-2.6.32.43/fs/ocfs2/ocfs2.h
};
enum ocfs2_local_alloc_state
-diff -urNp linux-2.6.32.43/fs/ocfs2/suballoc.c linux-2.6.32.43/fs/ocfs2/suballoc.c
---- linux-2.6.32.43/fs/ocfs2/suballoc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/ocfs2/suballoc.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/ocfs2/suballoc.c linux-2.6.32.44/fs/ocfs2/suballoc.c
+--- linux-2.6.32.44/fs/ocfs2/suballoc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/ocfs2/suballoc.c 2011-04-17 15:56:46.000000000 -0400
@@ -623,7 +623,7 @@ static int ocfs2_reserve_suballoc_bits(s
mlog_errno(status);
goto bail;
@@ -44968,9 +44953,9 @@ diff -urNp linux-2.6.32.43/fs/ocfs2/suballoc.c linux-2.6.32.43/fs/ocfs2/suballoc
}
}
if (status < 0) {
-diff -urNp linux-2.6.32.43/fs/ocfs2/super.c linux-2.6.32.43/fs/ocfs2/super.c
---- linux-2.6.32.43/fs/ocfs2/super.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/ocfs2/super.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/ocfs2/super.c linux-2.6.32.44/fs/ocfs2/super.c
+--- linux-2.6.32.44/fs/ocfs2/super.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/ocfs2/super.c 2011-04-17 15:56:46.000000000 -0400
@@ -284,11 +284,11 @@ static int ocfs2_osb_dump(struct ocfs2_s
"%10s => GlobalAllocs: %d LocalAllocs: %d "
"SubAllocs: %d LAWinMoves: %d SAExtends: %d\n",
@@ -45005,9 +44990,9 @@ diff -urNp linux-2.6.32.43/fs/ocfs2/super.c linux-2.6.32.43/fs/ocfs2/super.c
/* Copy the blockcheck stats from the superblock probe */
osb->osb_ecc_stats = *stats;
-diff -urNp linux-2.6.32.43/fs/open.c linux-2.6.32.43/fs/open.c
---- linux-2.6.32.43/fs/open.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/open.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/open.c linux-2.6.32.44/fs/open.c
+--- linux-2.6.32.44/fs/open.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/open.c 2011-04-17 15:56:46.000000000 -0400
@@ -275,6 +275,10 @@ static long do_sys_truncate(const char _
error = locks_verify_truncate(inode, NULL, length);
if (!error)
@@ -45192,9 +45177,9 @@ diff -urNp linux-2.6.32.43/fs/open.c linux-2.6.32.43/fs/open.c
if (IS_ERR(f)) {
put_unused_fd(fd);
fd = PTR_ERR(f);
-diff -urNp linux-2.6.32.43/fs/partitions/ldm.c linux-2.6.32.43/fs/partitions/ldm.c
---- linux-2.6.32.43/fs/partitions/ldm.c 2011-06-25 12:55:34.000000000 -0400
-+++ linux-2.6.32.43/fs/partitions/ldm.c 2011-06-25 12:56:37.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/partitions/ldm.c linux-2.6.32.44/fs/partitions/ldm.c
+--- linux-2.6.32.44/fs/partitions/ldm.c 2011-06-25 12:55:34.000000000 -0400
++++ linux-2.6.32.44/fs/partitions/ldm.c 2011-06-25 12:56:37.000000000 -0400
@@ -1311,6 +1311,7 @@ static bool ldm_frag_add (const u8 *data
ldm_error ("A VBLK claims to have %d parts.", num);
return false;
@@ -45212,9 +45197,9 @@ diff -urNp linux-2.6.32.43/fs/partitions/ldm.c linux-2.6.32.43/fs/partitions/ldm
if (!f) {
ldm_crit ("Out of memory.");
return false;
-diff -urNp linux-2.6.32.43/fs/partitions/mac.c linux-2.6.32.43/fs/partitions/mac.c
---- linux-2.6.32.43/fs/partitions/mac.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/partitions/mac.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/partitions/mac.c linux-2.6.32.44/fs/partitions/mac.c
+--- linux-2.6.32.44/fs/partitions/mac.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/partitions/mac.c 2011-04-17 15:56:46.000000000 -0400
@@ -59,11 +59,11 @@ int mac_partition(struct parsed_partitio
return 0; /* not a MacOS disk */
}
@@ -45228,9 +45213,9 @@ diff -urNp linux-2.6.32.43/fs/partitions/mac.c linux-2.6.32.43/fs/partitions/mac
for (slot = 1; slot <= blocks_in_map; ++slot) {
int pos = slot * secsize;
put_dev_sector(sect);
-diff -urNp linux-2.6.32.43/fs/pipe.c linux-2.6.32.43/fs/pipe.c
---- linux-2.6.32.43/fs/pipe.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/pipe.c 2011-04-23 13:37:17.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/pipe.c linux-2.6.32.44/fs/pipe.c
+--- linux-2.6.32.44/fs/pipe.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/pipe.c 2011-04-23 13:37:17.000000000 -0400
@@ -401,9 +401,9 @@ redo:
}
if (bufs) /* More to do? */
@@ -45354,9 +45339,9 @@ diff -urNp linux-2.6.32.43/fs/pipe.c linux-2.6.32.43/fs/pipe.c
inode->i_fop = &rdwr_pipefifo_fops;
/*
-diff -urNp linux-2.6.32.43/fs/proc/array.c linux-2.6.32.43/fs/proc/array.c
---- linux-2.6.32.43/fs/proc/array.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/proc/array.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/proc/array.c linux-2.6.32.44/fs/proc/array.c
+--- linux-2.6.32.44/fs/proc/array.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/proc/array.c 2011-05-16 21:46:57.000000000 -0400
@@ -60,6 +60,7 @@
#include <linux/tty.h>
#include <linux/string.h>
@@ -45480,9 +45465,9 @@ diff -urNp linux-2.6.32.43/fs/proc/array.c linux-2.6.32.43/fs/proc/array.c
+ return sprintf(buffer, "%pI4\n", &curr_ip);
+}
+#endif
-diff -urNp linux-2.6.32.43/fs/proc/base.c linux-2.6.32.43/fs/proc/base.c
---- linux-2.6.32.43/fs/proc/base.c 2011-04-22 19:16:29.000000000 -0400
-+++ linux-2.6.32.43/fs/proc/base.c 2011-06-04 21:20:50.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/proc/base.c linux-2.6.32.44/fs/proc/base.c
+--- linux-2.6.32.44/fs/proc/base.c 2011-08-09 18:35:30.000000000 -0400
++++ linux-2.6.32.44/fs/proc/base.c 2011-08-09 18:34:33.000000000 -0400
@@ -102,6 +102,22 @@ struct pid_entry {
union proc_op op;
};
@@ -45793,7 +45778,7 @@ diff -urNp linux-2.6.32.43/fs/proc/base.c linux-2.6.32.43/fs/proc/base.c
if (!IS_ERR(s))
__putname(s);
}
-@@ -2519,7 +2634,7 @@ static const struct pid_entry tgid_base_
+@@ -2522,7 +2637,7 @@ static const struct pid_entry tgid_base_
#ifdef CONFIG_SCHED_DEBUG
REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations),
#endif
@@ -45802,7 +45787,7 @@ diff -urNp linux-2.6.32.43/fs/proc/base.c linux-2.6.32.43/fs/proc/base.c
INF("syscall", S_IRUSR, proc_pid_syscall),
#endif
INF("cmdline", S_IRUGO, proc_pid_cmdline),
-@@ -2544,10 +2659,10 @@ static const struct pid_entry tgid_base_
+@@ -2547,10 +2662,10 @@ static const struct pid_entry tgid_base_
#ifdef CONFIG_SECURITY
DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
#endif
@@ -45815,9 +45800,9 @@ diff -urNp linux-2.6.32.43/fs/proc/base.c linux-2.6.32.43/fs/proc/base.c
ONE("stack", S_IRUSR, proc_pid_stack),
#endif
#ifdef CONFIG_SCHEDSTATS
-@@ -2577,6 +2692,9 @@ static const struct pid_entry tgid_base_
+@@ -2580,6 +2695,9 @@ static const struct pid_entry tgid_base_
#ifdef CONFIG_TASK_IO_ACCOUNTING
- INF("io", S_IRUGO, proc_tgid_io_accounting),
+ INF("io", S_IRUSR, proc_tgid_io_accounting),
#endif
+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
+ INF("ipaddr", S_IRUSR, proc_pid_ipaddr),
@@ -45825,7 +45810,7 @@ diff -urNp linux-2.6.32.43/fs/proc/base.c linux-2.6.32.43/fs/proc/base.c
};
static int proc_tgid_base_readdir(struct file * filp,
-@@ -2701,7 +2819,14 @@ static struct dentry *proc_pid_instantia
+@@ -2704,7 +2822,14 @@ static struct dentry *proc_pid_instantia
if (!inode)
goto out;
@@ -45840,7 +45825,7 @@ diff -urNp linux-2.6.32.43/fs/proc/base.c linux-2.6.32.43/fs/proc/base.c
inode->i_op = &proc_tgid_base_inode_operations;
inode->i_fop = &proc_tgid_base_operations;
inode->i_flags|=S_IMMUTABLE;
-@@ -2743,7 +2868,11 @@ struct dentry *proc_pid_lookup(struct in
+@@ -2746,7 +2871,11 @@ struct dentry *proc_pid_lookup(struct in
if (!task)
goto out;
@@ -45852,7 +45837,7 @@ diff -urNp linux-2.6.32.43/fs/proc/base.c linux-2.6.32.43/fs/proc/base.c
put_task_struct(task);
out:
return result;
-@@ -2808,6 +2937,11 @@ int proc_pid_readdir(struct file * filp,
+@@ -2811,6 +2940,11 @@ int proc_pid_readdir(struct file * filp,
{
unsigned int nr;
struct task_struct *reaper;
@@ -45864,7 +45849,7 @@ diff -urNp linux-2.6.32.43/fs/proc/base.c linux-2.6.32.43/fs/proc/base.c
struct tgid_iter iter;
struct pid_namespace *ns;
-@@ -2831,8 +2965,27 @@ int proc_pid_readdir(struct file * filp,
+@@ -2834,8 +2968,27 @@ int proc_pid_readdir(struct file * filp,
for (iter = next_tgid(ns, iter);
iter.task;
iter.tgid += 1, iter = next_tgid(ns, iter)) {
@@ -45893,7 +45878,7 @@ diff -urNp linux-2.6.32.43/fs/proc/base.c linux-2.6.32.43/fs/proc/base.c
put_task_struct(iter.task);
goto out;
}
-@@ -2858,7 +3011,7 @@ static const struct pid_entry tid_base_s
+@@ -2861,7 +3014,7 @@ static const struct pid_entry tid_base_s
#ifdef CONFIG_SCHED_DEBUG
REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations),
#endif
@@ -45902,7 +45887,7 @@ diff -urNp linux-2.6.32.43/fs/proc/base.c linux-2.6.32.43/fs/proc/base.c
INF("syscall", S_IRUSR, proc_pid_syscall),
#endif
INF("cmdline", S_IRUGO, proc_pid_cmdline),
-@@ -2882,10 +3035,10 @@ static const struct pid_entry tid_base_s
+@@ -2885,10 +3038,10 @@ static const struct pid_entry tid_base_s
#ifdef CONFIG_SECURITY
DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
#endif
@@ -45915,9 +45900,9 @@ diff -urNp linux-2.6.32.43/fs/proc/base.c linux-2.6.32.43/fs/proc/base.c
ONE("stack", S_IRUSR, proc_pid_stack),
#endif
#ifdef CONFIG_SCHEDSTATS
-diff -urNp linux-2.6.32.43/fs/proc/cmdline.c linux-2.6.32.43/fs/proc/cmdline.c
---- linux-2.6.32.43/fs/proc/cmdline.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/proc/cmdline.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/proc/cmdline.c linux-2.6.32.44/fs/proc/cmdline.c
+--- linux-2.6.32.44/fs/proc/cmdline.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/proc/cmdline.c 2011-04-17 15:56:46.000000000 -0400
@@ -23,7 +23,11 @@ static const struct file_operations cmdl
static int __init proc_cmdline_init(void)
@@ -45930,9 +45915,9 @@ diff -urNp linux-2.6.32.43/fs/proc/cmdline.c linux-2.6.32.43/fs/proc/cmdline.c
return 0;
}
module_init(proc_cmdline_init);
-diff -urNp linux-2.6.32.43/fs/proc/devices.c linux-2.6.32.43/fs/proc/devices.c
---- linux-2.6.32.43/fs/proc/devices.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/proc/devices.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/proc/devices.c linux-2.6.32.44/fs/proc/devices.c
+--- linux-2.6.32.44/fs/proc/devices.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/proc/devices.c 2011-04-17 15:56:46.000000000 -0400
@@ -64,7 +64,11 @@ static const struct file_operations proc
static int __init proc_devices_init(void)
@@ -45945,9 +45930,9 @@ diff -urNp linux-2.6.32.43/fs/proc/devices.c linux-2.6.32.43/fs/proc/devices.c
return 0;
}
module_init(proc_devices_init);
-diff -urNp linux-2.6.32.43/fs/proc/inode.c linux-2.6.32.43/fs/proc/inode.c
---- linux-2.6.32.43/fs/proc/inode.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/proc/inode.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/proc/inode.c linux-2.6.32.44/fs/proc/inode.c
+--- linux-2.6.32.44/fs/proc/inode.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/proc/inode.c 2011-04-17 15:56:46.000000000 -0400
@@ -457,7 +457,11 @@ struct inode *proc_get_inode(struct supe
if (de->mode) {
inode->i_mode = de->mode;
@@ -45960,9 +45945,9 @@ diff -urNp linux-2.6.32.43/fs/proc/inode.c linux-2.6.32.43/fs/proc/inode.c
}
if (de->size)
inode->i_size = de->size;
-diff -urNp linux-2.6.32.43/fs/proc/internal.h linux-2.6.32.43/fs/proc/internal.h
---- linux-2.6.32.43/fs/proc/internal.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/proc/internal.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/proc/internal.h linux-2.6.32.44/fs/proc/internal.h
+--- linux-2.6.32.44/fs/proc/internal.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/proc/internal.h 2011-04-17 15:56:46.000000000 -0400
@@ -51,6 +51,9 @@ extern int proc_pid_status(struct seq_fi
struct pid *pid, struct task_struct *task);
extern int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
@@ -45973,9 +45958,9 @@ diff -urNp linux-2.6.32.43/fs/proc/internal.h linux-2.6.32.43/fs/proc/internal.h
extern loff_t mem_lseek(struct file *file, loff_t offset, int orig);
extern const struct file_operations proc_maps_operations;
-diff -urNp linux-2.6.32.43/fs/proc/Kconfig linux-2.6.32.43/fs/proc/Kconfig
---- linux-2.6.32.43/fs/proc/Kconfig 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/proc/Kconfig 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/proc/Kconfig linux-2.6.32.44/fs/proc/Kconfig
+--- linux-2.6.32.44/fs/proc/Kconfig 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/proc/Kconfig 2011-04-17 15:56:46.000000000 -0400
@@ -30,12 +30,12 @@ config PROC_FS
config PROC_KCORE
@@ -46003,9 +45988,9 @@ diff -urNp linux-2.6.32.43/fs/proc/Kconfig linux-2.6.32.43/fs/proc/Kconfig
bool "Enable /proc page monitoring" if EMBEDDED
help
Various /proc files exist to monitor process memory utilization:
-diff -urNp linux-2.6.32.43/fs/proc/kcore.c linux-2.6.32.43/fs/proc/kcore.c
---- linux-2.6.32.43/fs/proc/kcore.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/proc/kcore.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/proc/kcore.c linux-2.6.32.44/fs/proc/kcore.c
+--- linux-2.6.32.44/fs/proc/kcore.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/proc/kcore.c 2011-05-16 21:46:57.000000000 -0400
@@ -320,6 +320,8 @@ static void elf_kcore_store_hdr(char *bu
off_t offset = 0;
struct kcore_list *m;
@@ -46073,9 +46058,9 @@ diff -urNp linux-2.6.32.43/fs/proc/kcore.c linux-2.6.32.43/fs/proc/kcore.c
if (!capable(CAP_SYS_RAWIO))
return -EPERM;
if (kcore_need_update)
-diff -urNp linux-2.6.32.43/fs/proc/meminfo.c linux-2.6.32.43/fs/proc/meminfo.c
---- linux-2.6.32.43/fs/proc/meminfo.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/proc/meminfo.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/proc/meminfo.c linux-2.6.32.44/fs/proc/meminfo.c
+--- linux-2.6.32.44/fs/proc/meminfo.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/proc/meminfo.c 2011-05-16 21:46:57.000000000 -0400
@@ -29,6 +29,8 @@ static int meminfo_proc_show(struct seq_
unsigned long pages[NR_LRU_LISTS];
int lru;
@@ -46094,9 +46079,9 @@ diff -urNp linux-2.6.32.43/fs/proc/meminfo.c linux-2.6.32.43/fs/proc/meminfo.c
#endif
);
-diff -urNp linux-2.6.32.43/fs/proc/nommu.c linux-2.6.32.43/fs/proc/nommu.c
---- linux-2.6.32.43/fs/proc/nommu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/proc/nommu.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/proc/nommu.c linux-2.6.32.44/fs/proc/nommu.c
+--- linux-2.6.32.44/fs/proc/nommu.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/proc/nommu.c 2011-04-17 15:56:46.000000000 -0400
@@ -67,7 +67,7 @@ static int nommu_region_show(struct seq_
if (len < 1)
len = 1;
@@ -46106,9 +46091,9 @@ diff -urNp linux-2.6.32.43/fs/proc/nommu.c linux-2.6.32.43/fs/proc/nommu.c
}
seq_putc(m, '\n');
-diff -urNp linux-2.6.32.43/fs/proc/proc_net.c linux-2.6.32.43/fs/proc/proc_net.c
---- linux-2.6.32.43/fs/proc/proc_net.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/proc/proc_net.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/proc/proc_net.c linux-2.6.32.44/fs/proc/proc_net.c
+--- linux-2.6.32.44/fs/proc/proc_net.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/proc/proc_net.c 2011-04-17 15:56:46.000000000 -0400
@@ -104,6 +104,17 @@ static struct net *get_proc_task_net(str
struct task_struct *task;
struct nsproxy *ns;
@@ -46127,9 +46112,9 @@ diff -urNp linux-2.6.32.43/fs/proc/proc_net.c linux-2.6.32.43/fs/proc/proc_net.c
rcu_read_lock();
task = pid_task(proc_pid(dir), PIDTYPE_PID);
-diff -urNp linux-2.6.32.43/fs/proc/proc_sysctl.c linux-2.6.32.43/fs/proc/proc_sysctl.c
---- linux-2.6.32.43/fs/proc/proc_sysctl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/proc/proc_sysctl.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/proc/proc_sysctl.c linux-2.6.32.44/fs/proc/proc_sysctl.c
+--- linux-2.6.32.44/fs/proc/proc_sysctl.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/proc/proc_sysctl.c 2011-04-17 15:56:46.000000000 -0400
@@ -7,6 +7,8 @@
#include <linux/security.h>
#include "internal.h"
@@ -46169,9 +46154,9 @@ diff -urNp linux-2.6.32.43/fs/proc/proc_sysctl.c linux-2.6.32.43/fs/proc/proc_sy
generic_fillattr(inode, stat);
if (table)
stat->mode = (stat->mode & S_IFMT) | table->mode;
-diff -urNp linux-2.6.32.43/fs/proc/root.c linux-2.6.32.43/fs/proc/root.c
---- linux-2.6.32.43/fs/proc/root.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/proc/root.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/proc/root.c linux-2.6.32.44/fs/proc/root.c
+--- linux-2.6.32.44/fs/proc/root.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/proc/root.c 2011-04-17 15:56:46.000000000 -0400
@@ -134,7 +134,15 @@ void __init proc_root_init(void)
#ifdef CONFIG_PROC_DEVICETREE
proc_device_tree_init();
@@ -46188,9 +46173,9 @@ diff -urNp linux-2.6.32.43/fs/proc/root.c linux-2.6.32.43/fs/proc/root.c
proc_sys_init();
}
-diff -urNp linux-2.6.32.43/fs/proc/task_mmu.c linux-2.6.32.43/fs/proc/task_mmu.c
---- linux-2.6.32.43/fs/proc/task_mmu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/proc/task_mmu.c 2011-04-23 13:38:09.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/proc/task_mmu.c linux-2.6.32.44/fs/proc/task_mmu.c
+--- linux-2.6.32.44/fs/proc/task_mmu.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/proc/task_mmu.c 2011-04-23 13:38:09.000000000 -0400
@@ -46,15 +46,26 @@ void task_mem(struct seq_file *m, struct
"VmStk:\t%8lu kB\n"
"VmExe:\t%8lu kB\n"
@@ -46336,9 +46321,9 @@ diff -urNp linux-2.6.32.43/fs/proc/task_mmu.c linux-2.6.32.43/fs/proc/task_mmu.c
mss.resident >> 10,
(unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
mss.shared_clean >> 10,
-diff -urNp linux-2.6.32.43/fs/proc/task_nommu.c linux-2.6.32.43/fs/proc/task_nommu.c
---- linux-2.6.32.43/fs/proc/task_nommu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/proc/task_nommu.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/proc/task_nommu.c linux-2.6.32.44/fs/proc/task_nommu.c
+--- linux-2.6.32.44/fs/proc/task_nommu.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/proc/task_nommu.c 2011-04-17 15:56:46.000000000 -0400
@@ -50,7 +50,7 @@ void task_mem(struct seq_file *m, struct
else
bytes += kobjsize(mm);
@@ -46357,9 +46342,9 @@ diff -urNp linux-2.6.32.43/fs/proc/task_nommu.c linux-2.6.32.43/fs/proc/task_nom
}
seq_putc(m, '\n');
-diff -urNp linux-2.6.32.43/fs/readdir.c linux-2.6.32.43/fs/readdir.c
---- linux-2.6.32.43/fs/readdir.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/readdir.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/readdir.c linux-2.6.32.44/fs/readdir.c
+--- linux-2.6.32.44/fs/readdir.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/readdir.c 2011-04-17 15:56:46.000000000 -0400
@@ -16,6 +16,7 @@
#include <linux/security.h>
#include <linux/syscalls.h>
@@ -46449,9 +46434,9 @@ diff -urNp linux-2.6.32.43/fs/readdir.c linux-2.6.32.43/fs/readdir.c
buf.count = count;
buf.error = 0;
-diff -urNp linux-2.6.32.43/fs/reiserfs/dir.c linux-2.6.32.43/fs/reiserfs/dir.c
---- linux-2.6.32.43/fs/reiserfs/dir.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/reiserfs/dir.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/reiserfs/dir.c linux-2.6.32.44/fs/reiserfs/dir.c
+--- linux-2.6.32.44/fs/reiserfs/dir.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/reiserfs/dir.c 2011-05-16 21:46:57.000000000 -0400
@@ -66,6 +66,8 @@ int reiserfs_readdir_dentry(struct dentr
struct reiserfs_dir_entry de;
int ret = 0;
@@ -46461,9 +46446,9 @@ diff -urNp linux-2.6.32.43/fs/reiserfs/dir.c linux-2.6.32.43/fs/reiserfs/dir.c
reiserfs_write_lock(inode->i_sb);
reiserfs_check_lock_depth(inode->i_sb, "readdir");
-diff -urNp linux-2.6.32.43/fs/reiserfs/do_balan.c linux-2.6.32.43/fs/reiserfs/do_balan.c
---- linux-2.6.32.43/fs/reiserfs/do_balan.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/reiserfs/do_balan.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/reiserfs/do_balan.c linux-2.6.32.44/fs/reiserfs/do_balan.c
+--- linux-2.6.32.44/fs/reiserfs/do_balan.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/reiserfs/do_balan.c 2011-04-17 15:56:46.000000000 -0400
@@ -2058,7 +2058,7 @@ void do_balance(struct tree_balance *tb,
return;
}
@@ -46473,9 +46458,9 @@ diff -urNp linux-2.6.32.43/fs/reiserfs/do_balan.c linux-2.6.32.43/fs/reiserfs/do
do_balance_starts(tb);
/* balance leaf returns 0 except if combining L R and S into
-diff -urNp linux-2.6.32.43/fs/reiserfs/item_ops.c linux-2.6.32.43/fs/reiserfs/item_ops.c
---- linux-2.6.32.43/fs/reiserfs/item_ops.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/reiserfs/item_ops.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/reiserfs/item_ops.c linux-2.6.32.44/fs/reiserfs/item_ops.c
+--- linux-2.6.32.44/fs/reiserfs/item_ops.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/reiserfs/item_ops.c 2011-04-17 15:56:46.000000000 -0400
@@ -102,7 +102,7 @@ static void sd_print_vi(struct virtual_i
vi->vi_index, vi->vi_type, vi->vi_ih);
}
@@ -46530,9 +46515,9 @@ diff -urNp linux-2.6.32.43/fs/reiserfs/item_ops.c linux-2.6.32.43/fs/reiserfs/it
&stat_data_ops,
&indirect_ops,
&direct_ops,
-diff -urNp linux-2.6.32.43/fs/reiserfs/journal.c linux-2.6.32.43/fs/reiserfs/journal.c
---- linux-2.6.32.43/fs/reiserfs/journal.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/reiserfs/journal.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/reiserfs/journal.c linux-2.6.32.44/fs/reiserfs/journal.c
+--- linux-2.6.32.44/fs/reiserfs/journal.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/reiserfs/journal.c 2011-05-16 21:46:57.000000000 -0400
@@ -2329,6 +2329,8 @@ static struct buffer_head *reiserfs_brea
struct buffer_head *bh;
int i, j;
@@ -46542,9 +46527,9 @@ diff -urNp linux-2.6.32.43/fs/reiserfs/journal.c linux-2.6.32.43/fs/reiserfs/jou
bh = __getblk(dev, block, bufsize);
if (buffer_uptodate(bh))
return (bh);
-diff -urNp linux-2.6.32.43/fs/reiserfs/namei.c linux-2.6.32.43/fs/reiserfs/namei.c
---- linux-2.6.32.43/fs/reiserfs/namei.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/reiserfs/namei.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/reiserfs/namei.c linux-2.6.32.44/fs/reiserfs/namei.c
+--- linux-2.6.32.44/fs/reiserfs/namei.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/reiserfs/namei.c 2011-05-16 21:46:57.000000000 -0400
@@ -1214,6 +1214,8 @@ static int reiserfs_rename(struct inode
unsigned long savelink = 1;
struct timespec ctime;
@@ -46554,9 +46539,9 @@ diff -urNp linux-2.6.32.43/fs/reiserfs/namei.c linux-2.6.32.43/fs/reiserfs/namei
/* three balancings: (1) old name removal, (2) new name insertion
and (3) maybe "save" link insertion
stat data updates: (1) old directory,
-diff -urNp linux-2.6.32.43/fs/reiserfs/procfs.c linux-2.6.32.43/fs/reiserfs/procfs.c
---- linux-2.6.32.43/fs/reiserfs/procfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/reiserfs/procfs.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/reiserfs/procfs.c linux-2.6.32.44/fs/reiserfs/procfs.c
+--- linux-2.6.32.44/fs/reiserfs/procfs.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/reiserfs/procfs.c 2011-05-16 21:46:57.000000000 -0400
@@ -123,7 +123,7 @@ static int show_super(struct seq_file *m
"SMALL_TAILS " : "NO_TAILS ",
replay_only(sb) ? "REPLAY_ONLY " : "",
@@ -46575,9 +46560,9 @@ diff -urNp linux-2.6.32.43/fs/reiserfs/procfs.c linux-2.6.32.43/fs/reiserfs/proc
seq_printf(m, /* on-disk fields */
"jp_journal_1st_block: \t%i\n"
"jp_journal_dev: \t%s[%x]\n"
-diff -urNp linux-2.6.32.43/fs/reiserfs/stree.c linux-2.6.32.43/fs/reiserfs/stree.c
---- linux-2.6.32.43/fs/reiserfs/stree.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/reiserfs/stree.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/reiserfs/stree.c linux-2.6.32.44/fs/reiserfs/stree.c
+--- linux-2.6.32.44/fs/reiserfs/stree.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/reiserfs/stree.c 2011-05-16 21:46:57.000000000 -0400
@@ -1159,6 +1159,8 @@ int reiserfs_delete_item(struct reiserfs
int iter = 0;
#endif
@@ -46623,9 +46608,9 @@ diff -urNp linux-2.6.32.43/fs/reiserfs/stree.c linux-2.6.32.43/fs/reiserfs/stree
BUG_ON(!th->t_trans_id);
if (inode) { /* Do we count quotas for item? */
-diff -urNp linux-2.6.32.43/fs/reiserfs/super.c linux-2.6.32.43/fs/reiserfs/super.c
---- linux-2.6.32.43/fs/reiserfs/super.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/reiserfs/super.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/reiserfs/super.c linux-2.6.32.44/fs/reiserfs/super.c
+--- linux-2.6.32.44/fs/reiserfs/super.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/reiserfs/super.c 2011-05-16 21:46:57.000000000 -0400
@@ -912,6 +912,8 @@ static int reiserfs_parse_options(struct
{.option_name = NULL}
};
@@ -46635,9 +46620,9 @@ diff -urNp linux-2.6.32.43/fs/reiserfs/super.c linux-2.6.32.43/fs/reiserfs/super
*blocks = 0;
if (!options || !*options)
/* use default configuration: create tails, journaling on, no
-diff -urNp linux-2.6.32.43/fs/select.c linux-2.6.32.43/fs/select.c
---- linux-2.6.32.43/fs/select.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/select.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/select.c linux-2.6.32.44/fs/select.c
+--- linux-2.6.32.44/fs/select.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/select.c 2011-05-16 21:46:57.000000000 -0400
@@ -20,6 +20,7 @@
#include <linux/module.h>
#include <linux/slab.h>
@@ -46674,9 +46659,9 @@ diff -urNp linux-2.6.32.43/fs/select.c linux-2.6.32.43/fs/select.c
if (nfds > current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
return -EINVAL;
-diff -urNp linux-2.6.32.43/fs/seq_file.c linux-2.6.32.43/fs/seq_file.c
---- linux-2.6.32.43/fs/seq_file.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/seq_file.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/seq_file.c linux-2.6.32.44/fs/seq_file.c
+--- linux-2.6.32.44/fs/seq_file.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/seq_file.c 2011-08-05 20:33:55.000000000 -0400
@@ -76,7 +76,8 @@ static int traverse(struct seq_file *m,
return 0;
}
@@ -46732,9 +46717,9 @@ diff -urNp linux-2.6.32.43/fs/seq_file.c linux-2.6.32.43/fs/seq_file.c
res = seq_open(file, op);
if (!res)
((struct seq_file *)file->private_data)->private = data;
-diff -urNp linux-2.6.32.43/fs/smbfs/proc.c linux-2.6.32.43/fs/smbfs/proc.c
---- linux-2.6.32.43/fs/smbfs/proc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/smbfs/proc.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/smbfs/proc.c linux-2.6.32.44/fs/smbfs/proc.c
+--- linux-2.6.32.44/fs/smbfs/proc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/smbfs/proc.c 2011-08-05 20:33:55.000000000 -0400
@@ -266,9 +266,9 @@ int smb_setcodepage(struct smb_sb_info *
out:
@@ -46768,9 +46753,9 @@ diff -urNp linux-2.6.32.43/fs/smbfs/proc.c linux-2.6.32.43/fs/smbfs/proc.c
}
/* < LANMAN2 */
-diff -urNp linux-2.6.32.43/fs/smbfs/symlink.c linux-2.6.32.43/fs/smbfs/symlink.c
---- linux-2.6.32.43/fs/smbfs/symlink.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/smbfs/symlink.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/smbfs/symlink.c linux-2.6.32.44/fs/smbfs/symlink.c
+--- linux-2.6.32.44/fs/smbfs/symlink.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/smbfs/symlink.c 2011-04-17 15:56:46.000000000 -0400
@@ -55,7 +55,7 @@ static void *smb_follow_link(struct dent
static void smb_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
@@ -46780,9 +46765,9 @@ diff -urNp linux-2.6.32.43/fs/smbfs/symlink.c linux-2.6.32.43/fs/smbfs/symlink.c
if (!IS_ERR(s))
__putname(s);
}
-diff -urNp linux-2.6.32.43/fs/splice.c linux-2.6.32.43/fs/splice.c
---- linux-2.6.32.43/fs/splice.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/splice.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/splice.c linux-2.6.32.44/fs/splice.c
+--- linux-2.6.32.44/fs/splice.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/splice.c 2011-05-16 21:46:57.000000000 -0400
@@ -185,7 +185,7 @@ ssize_t splice_to_pipe(struct pipe_inode
pipe_lock(pipe);
@@ -46948,9 +46933,9 @@ diff -urNp linux-2.6.32.43/fs/splice.c linux-2.6.32.43/fs/splice.c
ret = -EAGAIN;
pipe_unlock(ipipe);
-diff -urNp linux-2.6.32.43/fs/sysfs/file.c linux-2.6.32.43/fs/sysfs/file.c
---- linux-2.6.32.43/fs/sysfs/file.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/sysfs/file.c 2011-05-04 17:56:20.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/sysfs/file.c linux-2.6.32.44/fs/sysfs/file.c
+--- linux-2.6.32.44/fs/sysfs/file.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/sysfs/file.c 2011-05-04 17:56:20.000000000 -0400
@@ -44,7 +44,7 @@ static DEFINE_SPINLOCK(sysfs_open_dirent
struct sysfs_open_dirent {
@@ -47032,9 +47017,9 @@ diff -urNp linux-2.6.32.43/fs/sysfs/file.c linux-2.6.32.43/fs/sysfs/file.c
wake_up_interruptible(&od->poll);
}
-diff -urNp linux-2.6.32.43/fs/sysfs/mount.c linux-2.6.32.43/fs/sysfs/mount.c
---- linux-2.6.32.43/fs/sysfs/mount.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/sysfs/mount.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/sysfs/mount.c linux-2.6.32.44/fs/sysfs/mount.c
+--- linux-2.6.32.44/fs/sysfs/mount.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/sysfs/mount.c 2011-04-17 15:56:46.000000000 -0400
@@ -36,7 +36,11 @@ struct sysfs_dirent sysfs_root = {
.s_name = "",
.s_count = ATOMIC_INIT(1),
@@ -47047,9 +47032,9 @@ diff -urNp linux-2.6.32.43/fs/sysfs/mount.c linux-2.6.32.43/fs/sysfs/mount.c
.s_ino = 1,
};
-diff -urNp linux-2.6.32.43/fs/sysfs/symlink.c linux-2.6.32.43/fs/sysfs/symlink.c
---- linux-2.6.32.43/fs/sysfs/symlink.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/sysfs/symlink.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/sysfs/symlink.c linux-2.6.32.44/fs/sysfs/symlink.c
+--- linux-2.6.32.44/fs/sysfs/symlink.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/sysfs/symlink.c 2011-04-17 15:56:46.000000000 -0400
@@ -204,7 +204,7 @@ static void *sysfs_follow_link(struct de
static void sysfs_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
@@ -47059,9 +47044,9 @@ diff -urNp linux-2.6.32.43/fs/sysfs/symlink.c linux-2.6.32.43/fs/sysfs/symlink.c
if (!IS_ERR(page))
free_page((unsigned long)page);
}
-diff -urNp linux-2.6.32.43/fs/udf/balloc.c linux-2.6.32.43/fs/udf/balloc.c
---- linux-2.6.32.43/fs/udf/balloc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/udf/balloc.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/udf/balloc.c linux-2.6.32.44/fs/udf/balloc.c
+--- linux-2.6.32.44/fs/udf/balloc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/udf/balloc.c 2011-04-17 15:56:46.000000000 -0400
@@ -172,9 +172,7 @@ static void udf_bitmap_free_blocks(struc
mutex_lock(&sbi->s_alloc_mutex);
@@ -47084,9 +47069,9 @@ diff -urNp linux-2.6.32.43/fs/udf/balloc.c linux-2.6.32.43/fs/udf/balloc.c
udf_debug("%d < %d || %d + %d > %d\n",
bloc.logicalBlockNum, 0, bloc.logicalBlockNum, count,
partmap->s_partition_len);
-diff -urNp linux-2.6.32.43/fs/udf/inode.c linux-2.6.32.43/fs/udf/inode.c
---- linux-2.6.32.43/fs/udf/inode.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/udf/inode.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/udf/inode.c linux-2.6.32.44/fs/udf/inode.c
+--- linux-2.6.32.44/fs/udf/inode.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/udf/inode.c 2011-05-16 21:46:57.000000000 -0400
@@ -484,6 +484,8 @@ static struct buffer_head *inode_getblk(
int goal = 0, pgoal = iinfo->i_location.logicalBlockNum;
int lastblock = 0;
@@ -47096,9 +47081,9 @@ diff -urNp linux-2.6.32.43/fs/udf/inode.c linux-2.6.32.43/fs/udf/inode.c
prev_epos.offset = udf_file_entry_alloc_offset(inode);
prev_epos.block = iinfo->i_location;
prev_epos.bh = NULL;
-diff -urNp linux-2.6.32.43/fs/udf/misc.c linux-2.6.32.43/fs/udf/misc.c
---- linux-2.6.32.43/fs/udf/misc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/udf/misc.c 2011-04-23 12:56:11.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/udf/misc.c linux-2.6.32.44/fs/udf/misc.c
+--- linux-2.6.32.44/fs/udf/misc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/udf/misc.c 2011-04-23 12:56:11.000000000 -0400
@@ -286,7 +286,7 @@ void udf_new_tag(char *data, uint16_t id
u8 udf_tag_checksum(const struct tag *t)
@@ -47108,9 +47093,9 @@ diff -urNp linux-2.6.32.43/fs/udf/misc.c linux-2.6.32.43/fs/udf/misc.c
u8 checksum = 0;
int i;
for (i = 0; i < sizeof(struct tag); ++i)
-diff -urNp linux-2.6.32.43/fs/utimes.c linux-2.6.32.43/fs/utimes.c
---- linux-2.6.32.43/fs/utimes.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/utimes.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/utimes.c linux-2.6.32.44/fs/utimes.c
+--- linux-2.6.32.44/fs/utimes.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/utimes.c 2011-04-17 15:56:46.000000000 -0400
@@ -1,6 +1,7 @@
#include <linux/compiler.h>
#include <linux/file.h>
@@ -47132,9 +47117,9 @@ diff -urNp linux-2.6.32.43/fs/utimes.c linux-2.6.32.43/fs/utimes.c
mutex_lock(&inode->i_mutex);
error = notify_change(path->dentry, &newattrs);
mutex_unlock(&inode->i_mutex);
-diff -urNp linux-2.6.32.43/fs/xattr_acl.c linux-2.6.32.43/fs/xattr_acl.c
---- linux-2.6.32.43/fs/xattr_acl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/xattr_acl.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/xattr_acl.c linux-2.6.32.44/fs/xattr_acl.c
+--- linux-2.6.32.44/fs/xattr_acl.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/xattr_acl.c 2011-04-17 15:56:46.000000000 -0400
@@ -17,8 +17,8 @@
struct posix_acl *
posix_acl_from_xattr(const void *value, size_t size)
@@ -47146,9 +47131,9 @@ diff -urNp linux-2.6.32.43/fs/xattr_acl.c linux-2.6.32.43/fs/xattr_acl.c
int count;
struct posix_acl *acl;
struct posix_acl_entry *acl_e;
-diff -urNp linux-2.6.32.43/fs/xattr.c linux-2.6.32.43/fs/xattr.c
---- linux-2.6.32.43/fs/xattr.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/xattr.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/xattr.c linux-2.6.32.44/fs/xattr.c
+--- linux-2.6.32.44/fs/xattr.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/xattr.c 2011-04-17 15:56:46.000000000 -0400
@@ -247,7 +247,7 @@ EXPORT_SYMBOL_GPL(vfs_removexattr);
* Extended attribute SET operations
*/
@@ -47211,9 +47196,9 @@ diff -urNp linux-2.6.32.43/fs/xattr.c linux-2.6.32.43/fs/xattr.c
mnt_drop_write(f->f_path.mnt);
}
fput(f);
-diff -urNp linux-2.6.32.43/fs/xfs/linux-2.6/xfs_ioctl32.c linux-2.6.32.43/fs/xfs/linux-2.6/xfs_ioctl32.c
---- linux-2.6.32.43/fs/xfs/linux-2.6/xfs_ioctl32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/xfs/linux-2.6/xfs_ioctl32.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/xfs/linux-2.6/xfs_ioctl32.c linux-2.6.32.44/fs/xfs/linux-2.6/xfs_ioctl32.c
+--- linux-2.6.32.44/fs/xfs/linux-2.6/xfs_ioctl32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/xfs/linux-2.6/xfs_ioctl32.c 2011-04-17 15:56:46.000000000 -0400
@@ -75,6 +75,7 @@ xfs_compat_ioc_fsgeometry_v1(
xfs_fsop_geom_t fsgeo;
int error;
@@ -47222,9 +47207,9 @@ diff -urNp linux-2.6.32.43/fs/xfs/linux-2.6/xfs_ioctl32.c linux-2.6.32.43/fs/xfs
error = xfs_fs_geometry(mp, &fsgeo, 3);
if (error)
return -error;
-diff -urNp linux-2.6.32.43/fs/xfs/linux-2.6/xfs_ioctl.c linux-2.6.32.43/fs/xfs/linux-2.6/xfs_ioctl.c
---- linux-2.6.32.43/fs/xfs/linux-2.6/xfs_ioctl.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.43/fs/xfs/linux-2.6/xfs_ioctl.c 2011-04-17 20:07:09.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/xfs/linux-2.6/xfs_ioctl.c linux-2.6.32.44/fs/xfs/linux-2.6/xfs_ioctl.c
+--- linux-2.6.32.44/fs/xfs/linux-2.6/xfs_ioctl.c 2011-04-17 17:00:52.000000000 -0400
++++ linux-2.6.32.44/fs/xfs/linux-2.6/xfs_ioctl.c 2011-04-17 20:07:09.000000000 -0400
@@ -134,7 +134,7 @@ xfs_find_handle(
}
@@ -47252,9 +47237,9 @@ diff -urNp linux-2.6.32.43/fs/xfs/linux-2.6/xfs_ioctl.c linux-2.6.32.43/fs/xfs/l
int error;
error = xfs_fs_geometry(mp, &fsgeo, 3);
-diff -urNp linux-2.6.32.43/fs/xfs/linux-2.6/xfs_iops.c linux-2.6.32.43/fs/xfs/linux-2.6/xfs_iops.c
---- linux-2.6.32.43/fs/xfs/linux-2.6/xfs_iops.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/xfs/linux-2.6/xfs_iops.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/xfs/linux-2.6/xfs_iops.c linux-2.6.32.44/fs/xfs/linux-2.6/xfs_iops.c
+--- linux-2.6.32.44/fs/xfs/linux-2.6/xfs_iops.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/xfs/linux-2.6/xfs_iops.c 2011-04-17 15:56:46.000000000 -0400
@@ -468,7 +468,7 @@ xfs_vn_put_link(
struct nameidata *nd,
void *p)
@@ -47264,9 +47249,9 @@ diff -urNp linux-2.6.32.43/fs/xfs/linux-2.6/xfs_iops.c linux-2.6.32.43/fs/xfs/li
if (!IS_ERR(s))
kfree(s);
-diff -urNp linux-2.6.32.43/fs/xfs/xfs_bmap.c linux-2.6.32.43/fs/xfs/xfs_bmap.c
---- linux-2.6.32.43/fs/xfs/xfs_bmap.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/xfs/xfs_bmap.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/xfs/xfs_bmap.c linux-2.6.32.44/fs/xfs/xfs_bmap.c
+--- linux-2.6.32.44/fs/xfs/xfs_bmap.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/xfs/xfs_bmap.c 2011-04-17 15:56:46.000000000 -0400
@@ -360,7 +360,7 @@ xfs_bmap_validate_ret(
int nmap,
int ret_nmap);
@@ -47276,9 +47261,9 @@ diff -urNp linux-2.6.32.43/fs/xfs/xfs_bmap.c linux-2.6.32.43/fs/xfs/xfs_bmap.c
#endif /* DEBUG */
#if defined(XFS_RW_TRACE)
-diff -urNp linux-2.6.32.43/fs/xfs/xfs_dir2_sf.c linux-2.6.32.43/fs/xfs/xfs_dir2_sf.c
---- linux-2.6.32.43/fs/xfs/xfs_dir2_sf.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/fs/xfs/xfs_dir2_sf.c 2011-04-18 22:07:30.000000000 -0400
+diff -urNp linux-2.6.32.44/fs/xfs/xfs_dir2_sf.c linux-2.6.32.44/fs/xfs/xfs_dir2_sf.c
+--- linux-2.6.32.44/fs/xfs/xfs_dir2_sf.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/fs/xfs/xfs_dir2_sf.c 2011-04-18 22:07:30.000000000 -0400
@@ -779,7 +779,15 @@ xfs_dir2_sf_getdents(
}
@@ -47296,9 +47281,9 @@ diff -urNp linux-2.6.32.43/fs/xfs/xfs_dir2_sf.c linux-2.6.32.43/fs/xfs/xfs_dir2_
off & 0x7fffffff, ino, DT_UNKNOWN)) {
*offset = off & 0x7fffffff;
return 0;
-diff -urNp linux-2.6.32.43/grsecurity/gracl_alloc.c linux-2.6.32.43/grsecurity/gracl_alloc.c
---- linux-2.6.32.43/grsecurity/gracl_alloc.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/grsecurity/gracl_alloc.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/grsecurity/gracl_alloc.c linux-2.6.32.44/grsecurity/gracl_alloc.c
+--- linux-2.6.32.44/grsecurity/gracl_alloc.c 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/grsecurity/gracl_alloc.c 2011-04-17 15:56:46.000000000 -0400
@@ -0,0 +1,105 @@
+#include <linux/kernel.h>
+#include <linux/mm.h>
@@ -47405,9 +47390,9 @@ diff -urNp linux-2.6.32.43/grsecurity/gracl_alloc.c linux-2.6.32.43/grsecurity/g
+ else
+ return 1;
+}
-diff -urNp linux-2.6.32.43/grsecurity/gracl.c linux-2.6.32.43/grsecurity/gracl.c
---- linux-2.6.32.43/grsecurity/gracl.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/grsecurity/gracl.c 2011-07-14 20:02:48.000000000 -0400
+diff -urNp linux-2.6.32.44/grsecurity/gracl.c linux-2.6.32.44/grsecurity/gracl.c
+--- linux-2.6.32.44/grsecurity/gracl.c 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/grsecurity/gracl.c 2011-07-14 20:02:48.000000000 -0400
@@ -0,0 +1,4082 @@
+#include <linux/kernel.h>
+#include <linux/module.h>
@@ -51491,9 +51476,9 @@ diff -urNp linux-2.6.32.43/grsecurity/gracl.c linux-2.6.32.43/grsecurity/gracl.c
+EXPORT_SYMBOL(gr_check_group_change);
+#endif
+
-diff -urNp linux-2.6.32.43/grsecurity/gracl_cap.c linux-2.6.32.43/grsecurity/gracl_cap.c
---- linux-2.6.32.43/grsecurity/gracl_cap.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/grsecurity/gracl_cap.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/grsecurity/gracl_cap.c linux-2.6.32.44/grsecurity/gracl_cap.c
+--- linux-2.6.32.44/grsecurity/gracl_cap.c 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/grsecurity/gracl_cap.c 2011-04-17 15:56:46.000000000 -0400
@@ -0,0 +1,138 @@
+#include <linux/kernel.h>
+#include <linux/module.h>
@@ -51633,9 +51618,9 @@ diff -urNp linux-2.6.32.43/grsecurity/gracl_cap.c linux-2.6.32.43/grsecurity/gra
+ return 0;
+}
+
-diff -urNp linux-2.6.32.43/grsecurity/gracl_fs.c linux-2.6.32.43/grsecurity/gracl_fs.c
---- linux-2.6.32.43/grsecurity/gracl_fs.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/grsecurity/gracl_fs.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/grsecurity/gracl_fs.c linux-2.6.32.44/grsecurity/gracl_fs.c
+--- linux-2.6.32.44/grsecurity/gracl_fs.c 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/grsecurity/gracl_fs.c 2011-04-17 15:56:46.000000000 -0400
@@ -0,0 +1,431 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
@@ -52068,9 +52053,9 @@ diff -urNp linux-2.6.32.43/grsecurity/gracl_fs.c linux-2.6.32.43/grsecurity/grac
+
+ return 0;
+}
-diff -urNp linux-2.6.32.43/grsecurity/gracl_ip.c linux-2.6.32.43/grsecurity/gracl_ip.c
---- linux-2.6.32.43/grsecurity/gracl_ip.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/grsecurity/gracl_ip.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/grsecurity/gracl_ip.c linux-2.6.32.44/grsecurity/gracl_ip.c
+--- linux-2.6.32.44/grsecurity/gracl_ip.c 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/grsecurity/gracl_ip.c 2011-04-17 15:56:46.000000000 -0400
@@ -0,0 +1,382 @@
+#include <linux/kernel.h>
+#include <asm/uaccess.h>
@@ -52454,9 +52439,9 @@ diff -urNp linux-2.6.32.43/grsecurity/gracl_ip.c linux-2.6.32.43/grsecurity/grac
+
+ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
+}
-diff -urNp linux-2.6.32.43/grsecurity/gracl_learn.c linux-2.6.32.43/grsecurity/gracl_learn.c
---- linux-2.6.32.43/grsecurity/gracl_learn.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/grsecurity/gracl_learn.c 2011-07-14 21:02:03.000000000 -0400
+diff -urNp linux-2.6.32.44/grsecurity/gracl_learn.c linux-2.6.32.44/grsecurity/gracl_learn.c
+--- linux-2.6.32.44/grsecurity/gracl_learn.c 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/grsecurity/gracl_learn.c 2011-07-14 21:02:03.000000000 -0400
@@ -0,0 +1,208 @@
+#include <linux/kernel.h>
+#include <linux/mm.h>
@@ -52666,9 +52651,9 @@ diff -urNp linux-2.6.32.43/grsecurity/gracl_learn.c linux-2.6.32.43/grsecurity/g
+ .release = close_learn,
+ .poll = poll_learn,
+};
-diff -urNp linux-2.6.32.43/grsecurity/gracl_res.c linux-2.6.32.43/grsecurity/gracl_res.c
---- linux-2.6.32.43/grsecurity/gracl_res.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/grsecurity/gracl_res.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/grsecurity/gracl_res.c linux-2.6.32.44/grsecurity/gracl_res.c
+--- linux-2.6.32.44/grsecurity/gracl_res.c 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/grsecurity/gracl_res.c 2011-04-17 15:56:46.000000000 -0400
@@ -0,0 +1,67 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
@@ -52737,9 +52722,9 @@ diff -urNp linux-2.6.32.43/grsecurity/gracl_res.c linux-2.6.32.43/grsecurity/gra
+ rcu_read_unlock();
+ return;
+}
-diff -urNp linux-2.6.32.43/grsecurity/gracl_segv.c linux-2.6.32.43/grsecurity/gracl_segv.c
---- linux-2.6.32.43/grsecurity/gracl_segv.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/grsecurity/gracl_segv.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/grsecurity/gracl_segv.c linux-2.6.32.44/grsecurity/gracl_segv.c
+--- linux-2.6.32.44/grsecurity/gracl_segv.c 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/grsecurity/gracl_segv.c 2011-04-17 15:56:46.000000000 -0400
@@ -0,0 +1,284 @@
+#include <linux/kernel.h>
+#include <linux/mm.h>
@@ -53025,9 +53010,9 @@ diff -urNp linux-2.6.32.43/grsecurity/gracl_segv.c linux-2.6.32.43/grsecurity/gr
+
+ return;
+}
-diff -urNp linux-2.6.32.43/grsecurity/gracl_shm.c linux-2.6.32.43/grsecurity/gracl_shm.c
---- linux-2.6.32.43/grsecurity/gracl_shm.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/grsecurity/gracl_shm.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/grsecurity/gracl_shm.c linux-2.6.32.44/grsecurity/gracl_shm.c
+--- linux-2.6.32.44/grsecurity/gracl_shm.c 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/grsecurity/gracl_shm.c 2011-04-17 15:56:46.000000000 -0400
@@ -0,0 +1,40 @@
+#include <linux/kernel.h>
+#include <linux/mm.h>
@@ -53069,9 +53054,9 @@ diff -urNp linux-2.6.32.43/grsecurity/gracl_shm.c linux-2.6.32.43/grsecurity/gra
+
+ return 1;
+}
-diff -urNp linux-2.6.32.43/grsecurity/grsec_chdir.c linux-2.6.32.43/grsecurity/grsec_chdir.c
---- linux-2.6.32.43/grsecurity/grsec_chdir.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/grsecurity/grsec_chdir.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/grsecurity/grsec_chdir.c linux-2.6.32.44/grsecurity/grsec_chdir.c
+--- linux-2.6.32.44/grsecurity/grsec_chdir.c 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/grsecurity/grsec_chdir.c 2011-04-17 15:56:46.000000000 -0400
@@ -0,0 +1,19 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
@@ -53092,9 +53077,9 @@ diff -urNp linux-2.6.32.43/grsecurity/grsec_chdir.c linux-2.6.32.43/grsecurity/g
+#endif
+ return;
+}
-diff -urNp linux-2.6.32.43/grsecurity/grsec_chroot.c linux-2.6.32.43/grsecurity/grsec_chroot.c
---- linux-2.6.32.43/grsecurity/grsec_chroot.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/grsecurity/grsec_chroot.c 2011-07-18 17:14:10.000000000 -0400
+diff -urNp linux-2.6.32.44/grsecurity/grsec_chroot.c linux-2.6.32.44/grsecurity/grsec_chroot.c
+--- linux-2.6.32.44/grsecurity/grsec_chroot.c 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/grsecurity/grsec_chroot.c 2011-07-18 17:14:10.000000000 -0400
@@ -0,0 +1,384 @@
+#include <linux/kernel.h>
+#include <linux/module.h>
@@ -53480,9 +53465,9 @@ diff -urNp linux-2.6.32.43/grsecurity/grsec_chroot.c linux-2.6.32.43/grsecurity/
+#ifdef CONFIG_SECURITY
+EXPORT_SYMBOL(gr_handle_chroot_caps);
+#endif
-diff -urNp linux-2.6.32.43/grsecurity/grsec_disabled.c linux-2.6.32.43/grsecurity/grsec_disabled.c
---- linux-2.6.32.43/grsecurity/grsec_disabled.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/grsecurity/grsec_disabled.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/grsecurity/grsec_disabled.c linux-2.6.32.44/grsecurity/grsec_disabled.c
+--- linux-2.6.32.44/grsecurity/grsec_disabled.c 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/grsecurity/grsec_disabled.c 2011-04-17 15:56:46.000000000 -0400
@@ -0,0 +1,447 @@
+#include <linux/kernel.h>
+#include <linux/module.h>
@@ -53931,10 +53916,10 @@ diff -urNp linux-2.6.32.43/grsecurity/grsec_disabled.c linux-2.6.32.43/grsecurit
+EXPORT_SYMBOL(gr_check_user_change);
+EXPORT_SYMBOL(gr_check_group_change);
+#endif
-diff -urNp linux-2.6.32.43/grsecurity/grsec_exec.c linux-2.6.32.43/grsecurity/grsec_exec.c
---- linux-2.6.32.43/grsecurity/grsec_exec.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/grsecurity/grsec_exec.c 2011-04-17 15:56:46.000000000 -0400
-@@ -0,0 +1,148 @@
+diff -urNp linux-2.6.32.44/grsecurity/grsec_exec.c linux-2.6.32.44/grsecurity/grsec_exec.c
+--- linux-2.6.32.44/grsecurity/grsec_exec.c 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/grsecurity/grsec_exec.c 2011-08-11 19:57:19.000000000 -0400
+@@ -0,0 +1,132 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/file.h>
@@ -53954,22 +53939,6 @@ diff -urNp linux-2.6.32.43/grsecurity/grsec_exec.c linux-2.6.32.43/grsecurity/gr
+static DEFINE_MUTEX(gr_exec_arg_mutex);
+#endif
+
-+int
-+gr_handle_nproc(void)
-+{
-+#ifdef CONFIG_GRKERNSEC_EXECVE
-+ const struct cred *cred = current_cred();
-+ if (grsec_enable_execve && cred->user &&
-+ (atomic_read(&cred->user->processes) >
-+ current->signal->rlim[RLIMIT_NPROC].rlim_cur) &&
-+ !capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE)) {
-+ gr_log_noargs(GR_DONT_AUDIT, GR_NPROC_MSG);
-+ return -EAGAIN;
-+ }
-+#endif
-+ return 0;
-+}
-+
+void
+gr_handle_exec_args(struct linux_binprm *bprm, const char __user *const __user *argv)
+{
@@ -54083,9 +54052,9 @@ diff -urNp linux-2.6.32.43/grsecurity/grsec_exec.c linux-2.6.32.43/grsecurity/gr
+ return;
+}
+#endif
-diff -urNp linux-2.6.32.43/grsecurity/grsec_fifo.c linux-2.6.32.43/grsecurity/grsec_fifo.c
---- linux-2.6.32.43/grsecurity/grsec_fifo.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/grsecurity/grsec_fifo.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/grsecurity/grsec_fifo.c linux-2.6.32.44/grsecurity/grsec_fifo.c
+--- linux-2.6.32.44/grsecurity/grsec_fifo.c 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/grsecurity/grsec_fifo.c 2011-04-17 15:56:46.000000000 -0400
@@ -0,0 +1,24 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
@@ -54111,9 +54080,9 @@ diff -urNp linux-2.6.32.43/grsecurity/grsec_fifo.c linux-2.6.32.43/grsecurity/gr
+#endif
+ return 0;
+}
-diff -urNp linux-2.6.32.43/grsecurity/grsec_fork.c linux-2.6.32.43/grsecurity/grsec_fork.c
---- linux-2.6.32.43/grsecurity/grsec_fork.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/grsecurity/grsec_fork.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/grsecurity/grsec_fork.c linux-2.6.32.44/grsecurity/grsec_fork.c
+--- linux-2.6.32.44/grsecurity/grsec_fork.c 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/grsecurity/grsec_fork.c 2011-04-17 15:56:46.000000000 -0400
@@ -0,0 +1,23 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
@@ -54138,10 +54107,10 @@ diff -urNp linux-2.6.32.43/grsecurity/grsec_fork.c linux-2.6.32.43/grsecurity/gr
+#endif
+ return;
+}
-diff -urNp linux-2.6.32.43/grsecurity/grsec_init.c linux-2.6.32.43/grsecurity/grsec_init.c
---- linux-2.6.32.43/grsecurity/grsec_init.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/grsecurity/grsec_init.c 2011-06-29 19:35:26.000000000 -0400
-@@ -0,0 +1,274 @@
+diff -urNp linux-2.6.32.44/grsecurity/grsec_init.c linux-2.6.32.44/grsecurity/grsec_init.c
+--- linux-2.6.32.44/grsecurity/grsec_init.c 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/grsecurity/grsec_init.c 2011-08-11 19:57:42.000000000 -0400
+@@ -0,0 +1,270 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/mm.h>
@@ -54157,7 +54126,6 @@ diff -urNp linux-2.6.32.43/grsecurity/grsec_init.c linux-2.6.32.43/grsecurity/gr
+int grsec_enable_dmesg;
+int grsec_enable_harden_ptrace;
+int grsec_enable_fifo;
-+int grsec_enable_execve;
+int grsec_enable_execlog;
+int grsec_enable_signal;
+int grsec_enable_forkfail;
@@ -54330,9 +54298,6 @@ diff -urNp linux-2.6.32.43/grsecurity/grsec_init.c linux-2.6.32.43/grsecurity/gr
+#ifdef CONFIG_GRKERNSEC_FIFO
+ grsec_enable_fifo = 1;
+#endif
-+#ifdef CONFIG_GRKERNSEC_EXECVE
-+ grsec_enable_execve = 1;
-+#endif
+#ifdef CONFIG_GRKERNSEC_EXECLOG
+ grsec_enable_execlog = 1;
+#endif
@@ -54416,9 +54381,9 @@ diff -urNp linux-2.6.32.43/grsecurity/grsec_init.c linux-2.6.32.43/grsecurity/gr
+
+ return;
+}
-diff -urNp linux-2.6.32.43/grsecurity/grsec_link.c linux-2.6.32.43/grsecurity/grsec_link.c
---- linux-2.6.32.43/grsecurity/grsec_link.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/grsecurity/grsec_link.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/grsecurity/grsec_link.c linux-2.6.32.44/grsecurity/grsec_link.c
+--- linux-2.6.32.44/grsecurity/grsec_link.c 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/grsecurity/grsec_link.c 2011-04-17 15:56:46.000000000 -0400
@@ -0,0 +1,43 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
@@ -54463,9 +54428,9 @@ diff -urNp linux-2.6.32.43/grsecurity/grsec_link.c linux-2.6.32.43/grsecurity/gr
+#endif
+ return 0;
+}
-diff -urNp linux-2.6.32.43/grsecurity/grsec_log.c linux-2.6.32.43/grsecurity/grsec_log.c
---- linux-2.6.32.43/grsecurity/grsec_log.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/grsecurity/grsec_log.c 2011-05-10 21:58:49.000000000 -0400
+diff -urNp linux-2.6.32.44/grsecurity/grsec_log.c linux-2.6.32.44/grsecurity/grsec_log.c
+--- linux-2.6.32.44/grsecurity/grsec_log.c 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/grsecurity/grsec_log.c 2011-05-10 21:58:49.000000000 -0400
@@ -0,0 +1,310 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
@@ -54777,9 +54742,9 @@ diff -urNp linux-2.6.32.43/grsecurity/grsec_log.c linux-2.6.32.43/grsecurity/grs
+ gr_log_end(audit);
+ END_LOCKS(audit);
+}
-diff -urNp linux-2.6.32.43/grsecurity/grsec_mem.c linux-2.6.32.43/grsecurity/grsec_mem.c
---- linux-2.6.32.43/grsecurity/grsec_mem.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/grsecurity/grsec_mem.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/grsecurity/grsec_mem.c linux-2.6.32.44/grsecurity/grsec_mem.c
+--- linux-2.6.32.44/grsecurity/grsec_mem.c 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/grsecurity/grsec_mem.c 2011-04-17 15:56:46.000000000 -0400
@@ -0,0 +1,33 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
@@ -54814,9 +54779,9 @@ diff -urNp linux-2.6.32.43/grsecurity/grsec_mem.c linux-2.6.32.43/grsecurity/grs
+ gr_log_noargs(GR_DONT_AUDIT, GR_VM86_MSG);
+ return;
+}
-diff -urNp linux-2.6.32.43/grsecurity/grsec_mount.c linux-2.6.32.43/grsecurity/grsec_mount.c
---- linux-2.6.32.43/grsecurity/grsec_mount.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/grsecurity/grsec_mount.c 2011-06-20 19:47:03.000000000 -0400
+diff -urNp linux-2.6.32.44/grsecurity/grsec_mount.c linux-2.6.32.44/grsecurity/grsec_mount.c
+--- linux-2.6.32.44/grsecurity/grsec_mount.c 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/grsecurity/grsec_mount.c 2011-06-20 19:47:03.000000000 -0400
@@ -0,0 +1,62 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
@@ -54880,9 +54845,9 @@ diff -urNp linux-2.6.32.43/grsecurity/grsec_mount.c linux-2.6.32.43/grsecurity/g
+#endif
+ return 0;
+}
-diff -urNp linux-2.6.32.43/grsecurity/grsec_pax.c linux-2.6.32.43/grsecurity/grsec_pax.c
---- linux-2.6.32.43/grsecurity/grsec_pax.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/grsecurity/grsec_pax.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/grsecurity/grsec_pax.c linux-2.6.32.44/grsecurity/grsec_pax.c
+--- linux-2.6.32.44/grsecurity/grsec_pax.c 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/grsecurity/grsec_pax.c 2011-04-17 15:56:46.000000000 -0400
@@ -0,0 +1,36 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
@@ -54920,9 +54885,9 @@ diff -urNp linux-2.6.32.43/grsecurity/grsec_pax.c linux-2.6.32.43/grsecurity/grs
+#endif
+ return;
+}
-diff -urNp linux-2.6.32.43/grsecurity/grsec_ptrace.c linux-2.6.32.43/grsecurity/grsec_ptrace.c
---- linux-2.6.32.43/grsecurity/grsec_ptrace.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/grsecurity/grsec_ptrace.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/grsecurity/grsec_ptrace.c linux-2.6.32.44/grsecurity/grsec_ptrace.c
+--- linux-2.6.32.44/grsecurity/grsec_ptrace.c 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/grsecurity/grsec_ptrace.c 2011-04-17 15:56:46.000000000 -0400
@@ -0,0 +1,14 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
@@ -54938,9 +54903,9 @@ diff -urNp linux-2.6.32.43/grsecurity/grsec_ptrace.c linux-2.6.32.43/grsecurity/
+#endif
+ return;
+}
-diff -urNp linux-2.6.32.43/grsecurity/grsec_sig.c linux-2.6.32.43/grsecurity/grsec_sig.c
---- linux-2.6.32.43/grsecurity/grsec_sig.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/grsecurity/grsec_sig.c 2011-06-29 19:40:31.000000000 -0400
+diff -urNp linux-2.6.32.44/grsecurity/grsec_sig.c linux-2.6.32.44/grsecurity/grsec_sig.c
+--- linux-2.6.32.44/grsecurity/grsec_sig.c 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/grsecurity/grsec_sig.c 2011-06-29 19:40:31.000000000 -0400
@@ -0,0 +1,205 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
@@ -55147,9 +55112,9 @@ diff -urNp linux-2.6.32.43/grsecurity/grsec_sig.c linux-2.6.32.43/grsecurity/grs
+#endif
+ return 0;
+}
-diff -urNp linux-2.6.32.43/grsecurity/grsec_sock.c linux-2.6.32.43/grsecurity/grsec_sock.c
---- linux-2.6.32.43/grsecurity/grsec_sock.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/grsecurity/grsec_sock.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/grsecurity/grsec_sock.c linux-2.6.32.44/grsecurity/grsec_sock.c
+--- linux-2.6.32.44/grsecurity/grsec_sock.c 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/grsecurity/grsec_sock.c 2011-04-17 15:56:46.000000000 -0400
@@ -0,0 +1,275 @@
+#include <linux/kernel.h>
+#include <linux/module.h>
@@ -55426,10 +55391,10 @@ diff -urNp linux-2.6.32.43/grsecurity/grsec_sock.c linux-2.6.32.43/grsecurity/gr
+ return current_cap();
+#endif
+}
-diff -urNp linux-2.6.32.43/grsecurity/grsec_sysctl.c linux-2.6.32.43/grsecurity/grsec_sysctl.c
---- linux-2.6.32.43/grsecurity/grsec_sysctl.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/grsecurity/grsec_sysctl.c 2011-06-29 19:37:19.000000000 -0400
-@@ -0,0 +1,489 @@
+diff -urNp linux-2.6.32.44/grsecurity/grsec_sysctl.c linux-2.6.32.44/grsecurity/grsec_sysctl.c
+--- linux-2.6.32.44/grsecurity/grsec_sysctl.c 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/grsecurity/grsec_sysctl.c 2011-08-11 19:57:54.000000000 -0400
+@@ -0,0 +1,479 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/sysctl.h>
@@ -55497,16 +55462,6 @@ diff -urNp linux-2.6.32.43/grsecurity/grsec_sysctl.c linux-2.6.32.43/grsecurity/
+ .proc_handler = &proc_dointvec,
+ },
+#endif
-+#ifdef CONFIG_GRKERNSEC_EXECVE
-+ {
-+ .ctl_name = CTL_UNNUMBERED,
-+ .procname = "execve_limiting",
-+ .data = &grsec_enable_execve,
-+ .maxlen = sizeof(int),
-+ .mode = 0600,
-+ .proc_handler = &proc_dointvec,
-+ },
-+#endif
+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
+ {
+ .ctl_name = CTL_UNNUMBERED,
@@ -55919,9 +55874,9 @@ diff -urNp linux-2.6.32.43/grsecurity/grsec_sysctl.c linux-2.6.32.43/grsecurity/
+ { .ctl_name = 0 }
+};
+#endif
-diff -urNp linux-2.6.32.43/grsecurity/grsec_time.c linux-2.6.32.43/grsecurity/grsec_time.c
---- linux-2.6.32.43/grsecurity/grsec_time.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/grsecurity/grsec_time.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/grsecurity/grsec_time.c linux-2.6.32.44/grsecurity/grsec_time.c
+--- linux-2.6.32.44/grsecurity/grsec_time.c 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/grsecurity/grsec_time.c 2011-04-17 15:56:46.000000000 -0400
@@ -0,0 +1,16 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
@@ -55939,9 +55894,9 @@ diff -urNp linux-2.6.32.43/grsecurity/grsec_time.c linux-2.6.32.43/grsecurity/gr
+}
+
+EXPORT_SYMBOL(gr_log_timechange);
-diff -urNp linux-2.6.32.43/grsecurity/grsec_tpe.c linux-2.6.32.43/grsecurity/grsec_tpe.c
---- linux-2.6.32.43/grsecurity/grsec_tpe.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/grsecurity/grsec_tpe.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/grsecurity/grsec_tpe.c linux-2.6.32.44/grsecurity/grsec_tpe.c
+--- linux-2.6.32.44/grsecurity/grsec_tpe.c 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/grsecurity/grsec_tpe.c 2011-04-17 15:56:46.000000000 -0400
@@ -0,0 +1,39 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
@@ -55982,9 +55937,9 @@ diff -urNp linux-2.6.32.43/grsecurity/grsec_tpe.c linux-2.6.32.43/grsecurity/grs
+#endif
+ return 1;
+}
-diff -urNp linux-2.6.32.43/grsecurity/grsum.c linux-2.6.32.43/grsecurity/grsum.c
---- linux-2.6.32.43/grsecurity/grsum.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/grsecurity/grsum.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/grsecurity/grsum.c linux-2.6.32.44/grsecurity/grsum.c
+--- linux-2.6.32.44/grsecurity/grsum.c 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/grsecurity/grsum.c 2011-04-17 15:56:46.000000000 -0400
@@ -0,0 +1,61 @@
+#include <linux/err.h>
+#include <linux/kernel.h>
@@ -56047,10 +56002,10 @@ diff -urNp linux-2.6.32.43/grsecurity/grsum.c linux-2.6.32.43/grsecurity/grsum.c
+
+ return retval;
+}
-diff -urNp linux-2.6.32.43/grsecurity/Kconfig linux-2.6.32.43/grsecurity/Kconfig
---- linux-2.6.32.43/grsecurity/Kconfig 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/grsecurity/Kconfig 2011-07-06 19:57:57.000000000 -0400
-@@ -0,0 +1,1047 @@
+diff -urNp linux-2.6.32.44/grsecurity/Kconfig linux-2.6.32.44/grsecurity/Kconfig
+--- linux-2.6.32.44/grsecurity/Kconfig 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/grsecurity/Kconfig 2011-08-11 19:58:19.000000000 -0400
+@@ -0,0 +1,1035 @@
+#
+# grecurity configuration
+#
@@ -56077,7 +56032,6 @@ diff -urNp linux-2.6.32.43/grsecurity/Kconfig linux-2.6.32.43/grsecurity/Kconfig
+ bool "Low"
+ select GRKERNSEC_LINK
+ select GRKERNSEC_FIFO
-+ select GRKERNSEC_EXECVE
+ select GRKERNSEC_RANDNET
+ select GRKERNSEC_DMESG
+ select GRKERNSEC_CHROOT
@@ -56094,7 +56048,6 @@ diff -urNp linux-2.6.32.43/grsecurity/Kconfig linux-2.6.32.43/grsecurity/Kconfig
+
+ - Linking restrictions
+ - FIFO restrictions
-+ - Enforcing RLIMIT_NPROC on execve
+ - Restricted dmesg
+ - Enforced chdir("/") on chroot
+ - Runtime module disabling
@@ -56110,7 +56063,6 @@ diff -urNp linux-2.6.32.43/grsecurity/Kconfig linux-2.6.32.43/grsecurity/Kconfig
+ select GRKERNSEC_CHROOT_SYSCTL
+ select GRKERNSEC_LINK
+ select GRKERNSEC_FIFO
-+ select GRKERNSEC_EXECVE
+ select GRKERNSEC_DMESG
+ select GRKERNSEC_RANDNET
+ select GRKERNSEC_FORKFAIL
@@ -56160,7 +56112,6 @@ diff -urNp linux-2.6.32.43/grsecurity/Kconfig linux-2.6.32.43/grsecurity/Kconfig
+ bool "High"
+ select GRKERNSEC_LINK
+ select GRKERNSEC_FIFO
-+ select GRKERNSEC_EXECVE
+ select GRKERNSEC_DMESG
+ select GRKERNSEC_FORKFAIL
+ select GRKERNSEC_TIME
@@ -56827,14 +56778,6 @@ diff -urNp linux-2.6.32.43/grsecurity/Kconfig linux-2.6.32.43/grsecurity/Kconfig
+menu "Executable Protections"
+depends on GRKERNSEC
+
-+config GRKERNSEC_EXECVE
-+ bool "Enforce RLIMIT_NPROC on execs"
-+ help
-+ If you say Y here, users with a resource limit on processes will
-+ have the value checked during execve() calls. The current system
-+ only checks the system limit during fork() calls. If the sysctl option
-+ is enabled, a sysctl option with name "execve_limiting" is created.
-+
+config GRKERNSEC_DMESG
+ bool "Dmesg(8) restriction"
+ help
@@ -57098,9 +57041,9 @@ diff -urNp linux-2.6.32.43/grsecurity/Kconfig linux-2.6.32.43/grsecurity/Kconfig
+endmenu
+
+endmenu
-diff -urNp linux-2.6.32.43/grsecurity/Makefile linux-2.6.32.43/grsecurity/Makefile
---- linux-2.6.32.43/grsecurity/Makefile 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/grsecurity/Makefile 2011-05-24 20:27:46.000000000 -0400
+diff -urNp linux-2.6.32.44/grsecurity/Makefile linux-2.6.32.44/grsecurity/Makefile
+--- linux-2.6.32.44/grsecurity/Makefile 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/grsecurity/Makefile 2011-05-24 20:27:46.000000000 -0400
@@ -0,0 +1,33 @@
+# grsecurity's ACL system was originally written in 2001 by Michael Dalton
+# during 2001-2009 it has been completely redesigned by Brad Spengler
@@ -57135,9 +57078,9 @@ diff -urNp linux-2.6.32.43/grsecurity/Makefile linux-2.6.32.43/grsecurity/Makefi
+ @-chmod -f 700 .
+ @echo ' grsec: protected kernel image paths'
+endif
-diff -urNp linux-2.6.32.43/include/acpi/acpi_bus.h linux-2.6.32.43/include/acpi/acpi_bus.h
---- linux-2.6.32.43/include/acpi/acpi_bus.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/acpi/acpi_bus.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/include/acpi/acpi_bus.h linux-2.6.32.44/include/acpi/acpi_bus.h
+--- linux-2.6.32.44/include/acpi/acpi_bus.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/acpi/acpi_bus.h 2011-08-05 20:33:55.000000000 -0400
@@ -107,7 +107,7 @@ struct acpi_device_ops {
acpi_op_bind bind;
acpi_op_unbind unbind;
@@ -57147,9 +57090,9 @@ diff -urNp linux-2.6.32.43/include/acpi/acpi_bus.h linux-2.6.32.43/include/acpi/
#define ACPI_DRIVER_ALL_NOTIFY_EVENTS 0x1 /* system AND device events */
-diff -urNp linux-2.6.32.43/include/acpi/acpi_drivers.h linux-2.6.32.43/include/acpi/acpi_drivers.h
---- linux-2.6.32.43/include/acpi/acpi_drivers.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/acpi/acpi_drivers.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/acpi/acpi_drivers.h linux-2.6.32.44/include/acpi/acpi_drivers.h
+--- linux-2.6.32.44/include/acpi/acpi_drivers.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/acpi/acpi_drivers.h 2011-04-17 15:56:46.000000000 -0400
@@ -119,8 +119,8 @@ int acpi_processor_set_thermal_limit(acp
Dock Station
-------------------------------------------------------------------------- */
@@ -57179,9 +57122,9 @@ diff -urNp linux-2.6.32.43/include/acpi/acpi_drivers.h linux-2.6.32.43/include/a
void *context)
{
return -ENODEV;
-diff -urNp linux-2.6.32.43/include/asm-generic/atomic-long.h linux-2.6.32.43/include/asm-generic/atomic-long.h
---- linux-2.6.32.43/include/asm-generic/atomic-long.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/asm-generic/atomic-long.h 2011-07-13 22:21:25.000000000 -0400
+diff -urNp linux-2.6.32.44/include/asm-generic/atomic-long.h linux-2.6.32.44/include/asm-generic/atomic-long.h
+--- linux-2.6.32.44/include/asm-generic/atomic-long.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/asm-generic/atomic-long.h 2011-07-13 22:21:25.000000000 -0400
@@ -22,6 +22,12 @@
typedef atomic64_t atomic_long_t;
@@ -57448,9 +57391,9 @@ diff -urNp linux-2.6.32.43/include/asm-generic/atomic-long.h linux-2.6.32.43/inc
+#endif
+
#endif /* _ASM_GENERIC_ATOMIC_LONG_H */
-diff -urNp linux-2.6.32.43/include/asm-generic/cache.h linux-2.6.32.43/include/asm-generic/cache.h
---- linux-2.6.32.43/include/asm-generic/cache.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/asm-generic/cache.h 2011-07-06 19:53:33.000000000 -0400
+diff -urNp linux-2.6.32.44/include/asm-generic/cache.h linux-2.6.32.44/include/asm-generic/cache.h
+--- linux-2.6.32.44/include/asm-generic/cache.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/asm-generic/cache.h 2011-07-06 19:53:33.000000000 -0400
@@ -6,7 +6,7 @@
* cache lines need to provide their own cache.h.
*/
@@ -57461,9 +57404,9 @@ diff -urNp linux-2.6.32.43/include/asm-generic/cache.h linux-2.6.32.43/include/a
+#define L1_CACHE_BYTES (1UL << L1_CACHE_SHIFT)
#endif /* __ASM_GENERIC_CACHE_H */
-diff -urNp linux-2.6.32.43/include/asm-generic/dma-mapping-common.h linux-2.6.32.43/include/asm-generic/dma-mapping-common.h
---- linux-2.6.32.43/include/asm-generic/dma-mapping-common.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/asm-generic/dma-mapping-common.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/asm-generic/dma-mapping-common.h linux-2.6.32.44/include/asm-generic/dma-mapping-common.h
+--- linux-2.6.32.44/include/asm-generic/dma-mapping-common.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/asm-generic/dma-mapping-common.h 2011-04-17 15:56:46.000000000 -0400
@@ -11,7 +11,7 @@ static inline dma_addr_t dma_map_single_
enum dma_data_direction dir,
struct dma_attrs *attrs)
@@ -57572,9 +57515,9 @@ diff -urNp linux-2.6.32.43/include/asm-generic/dma-mapping-common.h linux-2.6.32
BUG_ON(!valid_dma_direction(dir));
if (ops->sync_sg_for_device)
-diff -urNp linux-2.6.32.43/include/asm-generic/futex.h linux-2.6.32.43/include/asm-generic/futex.h
---- linux-2.6.32.43/include/asm-generic/futex.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/asm-generic/futex.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/asm-generic/futex.h linux-2.6.32.44/include/asm-generic/futex.h
+--- linux-2.6.32.44/include/asm-generic/futex.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/asm-generic/futex.h 2011-04-17 15:56:46.000000000 -0400
@@ -6,7 +6,7 @@
#include <asm/errno.h>
@@ -57593,9 +57536,9 @@ diff -urNp linux-2.6.32.43/include/asm-generic/futex.h linux-2.6.32.43/include/a
{
return -ENOSYS;
}
-diff -urNp linux-2.6.32.43/include/asm-generic/int-l64.h linux-2.6.32.43/include/asm-generic/int-l64.h
---- linux-2.6.32.43/include/asm-generic/int-l64.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/asm-generic/int-l64.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/asm-generic/int-l64.h linux-2.6.32.44/include/asm-generic/int-l64.h
+--- linux-2.6.32.44/include/asm-generic/int-l64.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/asm-generic/int-l64.h 2011-04-17 15:56:46.000000000 -0400
@@ -46,6 +46,8 @@ typedef unsigned int u32;
typedef signed long s64;
typedef unsigned long u64;
@@ -57605,9 +57548,9 @@ diff -urNp linux-2.6.32.43/include/asm-generic/int-l64.h linux-2.6.32.43/include
#define S8_C(x) x
#define U8_C(x) x ## U
#define S16_C(x) x
-diff -urNp linux-2.6.32.43/include/asm-generic/int-ll64.h linux-2.6.32.43/include/asm-generic/int-ll64.h
---- linux-2.6.32.43/include/asm-generic/int-ll64.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/asm-generic/int-ll64.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/asm-generic/int-ll64.h linux-2.6.32.44/include/asm-generic/int-ll64.h
+--- linux-2.6.32.44/include/asm-generic/int-ll64.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/asm-generic/int-ll64.h 2011-04-17 15:56:46.000000000 -0400
@@ -51,6 +51,8 @@ typedef unsigned int u32;
typedef signed long long s64;
typedef unsigned long long u64;
@@ -57617,9 +57560,9 @@ diff -urNp linux-2.6.32.43/include/asm-generic/int-ll64.h linux-2.6.32.43/includ
#define S8_C(x) x
#define U8_C(x) x ## U
#define S16_C(x) x
-diff -urNp linux-2.6.32.43/include/asm-generic/kmap_types.h linux-2.6.32.43/include/asm-generic/kmap_types.h
---- linux-2.6.32.43/include/asm-generic/kmap_types.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/asm-generic/kmap_types.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/asm-generic/kmap_types.h linux-2.6.32.44/include/asm-generic/kmap_types.h
+--- linux-2.6.32.44/include/asm-generic/kmap_types.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/asm-generic/kmap_types.h 2011-04-17 15:56:46.000000000 -0400
@@ -28,7 +28,8 @@ KMAP_D(15) KM_UML_USERCOPY,
KMAP_D(16) KM_IRQ_PTE,
KMAP_D(17) KM_NMI,
@@ -57630,9 +57573,9 @@ diff -urNp linux-2.6.32.43/include/asm-generic/kmap_types.h linux-2.6.32.43/incl
};
#undef KMAP_D
-diff -urNp linux-2.6.32.43/include/asm-generic/pgtable.h linux-2.6.32.43/include/asm-generic/pgtable.h
---- linux-2.6.32.43/include/asm-generic/pgtable.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/asm-generic/pgtable.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/asm-generic/pgtable.h linux-2.6.32.44/include/asm-generic/pgtable.h
+--- linux-2.6.32.44/include/asm-generic/pgtable.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/asm-generic/pgtable.h 2011-04-17 15:56:46.000000000 -0400
@@ -344,6 +344,14 @@ extern void untrack_pfn_vma(struct vm_ar
unsigned long size);
#endif
@@ -57648,9 +57591,9 @@ diff -urNp linux-2.6.32.43/include/asm-generic/pgtable.h linux-2.6.32.43/include
#endif /* !__ASSEMBLY__ */
#endif /* _ASM_GENERIC_PGTABLE_H */
-diff -urNp linux-2.6.32.43/include/asm-generic/pgtable-nopmd.h linux-2.6.32.43/include/asm-generic/pgtable-nopmd.h
---- linux-2.6.32.43/include/asm-generic/pgtable-nopmd.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/asm-generic/pgtable-nopmd.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/asm-generic/pgtable-nopmd.h linux-2.6.32.44/include/asm-generic/pgtable-nopmd.h
+--- linux-2.6.32.44/include/asm-generic/pgtable-nopmd.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/asm-generic/pgtable-nopmd.h 2011-04-17 15:56:46.000000000 -0400
@@ -1,14 +1,19 @@
#ifndef _PGTABLE_NOPMD_H
#define _PGTABLE_NOPMD_H
@@ -57687,9 +57630,9 @@ diff -urNp linux-2.6.32.43/include/asm-generic/pgtable-nopmd.h linux-2.6.32.43/i
/*
* The "pud_xxx()" functions here are trivial for a folded two-level
* setup: the pmd is never bad, and a pmd always exists (as it's folded
-diff -urNp linux-2.6.32.43/include/asm-generic/pgtable-nopud.h linux-2.6.32.43/include/asm-generic/pgtable-nopud.h
---- linux-2.6.32.43/include/asm-generic/pgtable-nopud.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/asm-generic/pgtable-nopud.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/asm-generic/pgtable-nopud.h linux-2.6.32.44/include/asm-generic/pgtable-nopud.h
+--- linux-2.6.32.44/include/asm-generic/pgtable-nopud.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/asm-generic/pgtable-nopud.h 2011-04-17 15:56:46.000000000 -0400
@@ -1,10 +1,15 @@
#ifndef _PGTABLE_NOPUD_H
#define _PGTABLE_NOPUD_H
@@ -57720,9 +57663,9 @@ diff -urNp linux-2.6.32.43/include/asm-generic/pgtable-nopud.h linux-2.6.32.43/i
/*
* The "pgd_xxx()" functions here are trivial for a folded two-level
* setup: the pud is never bad, and a pud always exists (as it's folded
-diff -urNp linux-2.6.32.43/include/asm-generic/vmlinux.lds.h linux-2.6.32.43/include/asm-generic/vmlinux.lds.h
---- linux-2.6.32.43/include/asm-generic/vmlinux.lds.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/asm-generic/vmlinux.lds.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/asm-generic/vmlinux.lds.h linux-2.6.32.44/include/asm-generic/vmlinux.lds.h
+--- linux-2.6.32.44/include/asm-generic/vmlinux.lds.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/asm-generic/vmlinux.lds.h 2011-04-17 15:56:46.000000000 -0400
@@ -199,6 +199,7 @@
.rodata : AT(ADDR(.rodata) - LOAD_OFFSET) { \
VMLINUX_SYMBOL(__start_rodata) = .; \
@@ -57761,9 +57704,9 @@ diff -urNp linux-2.6.32.43/include/asm-generic/vmlinux.lds.h linux-2.6.32.43/inc
/**
* PERCPU - define output section for percpu area, simple version
-diff -urNp linux-2.6.32.43/include/drm/drm_crtc_helper.h linux-2.6.32.43/include/drm/drm_crtc_helper.h
---- linux-2.6.32.43/include/drm/drm_crtc_helper.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/drm/drm_crtc_helper.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/include/drm/drm_crtc_helper.h linux-2.6.32.44/include/drm/drm_crtc_helper.h
+--- linux-2.6.32.44/include/drm/drm_crtc_helper.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/drm/drm_crtc_helper.h 2011-08-05 20:33:55.000000000 -0400
@@ -64,7 +64,7 @@ struct drm_crtc_helper_funcs {
/* reload the current crtc LUT */
@@ -57782,9 +57725,9 @@ diff -urNp linux-2.6.32.43/include/drm/drm_crtc_helper.h linux-2.6.32.43/include
struct drm_connector_helper_funcs {
int (*get_modes)(struct drm_connector *connector);
-diff -urNp linux-2.6.32.43/include/drm/drmP.h linux-2.6.32.43/include/drm/drmP.h
---- linux-2.6.32.43/include/drm/drmP.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/drm/drmP.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/drm/drmP.h linux-2.6.32.44/include/drm/drmP.h
+--- linux-2.6.32.44/include/drm/drmP.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/drm/drmP.h 2011-04-17 15:56:46.000000000 -0400
@@ -71,6 +71,7 @@
#include <linux/workqueue.h>
#include <linux/poll.h>
@@ -57844,9 +57787,9 @@ diff -urNp linux-2.6.32.43/include/drm/drmP.h linux-2.6.32.43/include/drm/drmP.h
uint32_t gtt_total;
uint32_t invalidate_domains; /* domains pending invalidation */
uint32_t flush_domains; /* domains pending flush */
-diff -urNp linux-2.6.32.43/include/drm/ttm/ttm_memory.h linux-2.6.32.43/include/drm/ttm/ttm_memory.h
---- linux-2.6.32.43/include/drm/ttm/ttm_memory.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/drm/ttm/ttm_memory.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/include/drm/ttm/ttm_memory.h linux-2.6.32.44/include/drm/ttm/ttm_memory.h
+--- linux-2.6.32.44/include/drm/ttm/ttm_memory.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/drm/ttm/ttm_memory.h 2011-08-05 20:33:55.000000000 -0400
@@ -47,7 +47,7 @@
struct ttm_mem_shrink {
@@ -57856,9 +57799,9 @@ diff -urNp linux-2.6.32.43/include/drm/ttm/ttm_memory.h linux-2.6.32.43/include/
/**
* struct ttm_mem_global - Global memory accounting structure.
-diff -urNp linux-2.6.32.43/include/linux/a.out.h linux-2.6.32.43/include/linux/a.out.h
---- linux-2.6.32.43/include/linux/a.out.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/a.out.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/a.out.h linux-2.6.32.44/include/linux/a.out.h
+--- linux-2.6.32.44/include/linux/a.out.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/a.out.h 2011-04-17 15:56:46.000000000 -0400
@@ -39,6 +39,14 @@ enum machine_type {
M_MIPS2 = 152 /* MIPS R6000/R4000 binary */
};
@@ -57874,9 +57817,9 @@ diff -urNp linux-2.6.32.43/include/linux/a.out.h linux-2.6.32.43/include/linux/a
#if !defined (N_MAGIC)
#define N_MAGIC(exec) ((exec).a_info & 0xffff)
#endif
-diff -urNp linux-2.6.32.43/include/linux/atmdev.h linux-2.6.32.43/include/linux/atmdev.h
---- linux-2.6.32.43/include/linux/atmdev.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/atmdev.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/atmdev.h linux-2.6.32.44/include/linux/atmdev.h
+--- linux-2.6.32.44/include/linux/atmdev.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/atmdev.h 2011-04-17 15:56:46.000000000 -0400
@@ -237,7 +237,7 @@ struct compat_atm_iobuf {
#endif
@@ -57886,9 +57829,9 @@ diff -urNp linux-2.6.32.43/include/linux/atmdev.h linux-2.6.32.43/include/linux/
__AAL_STAT_ITEMS
#undef __HANDLE_ITEM
};
-diff -urNp linux-2.6.32.43/include/linux/backlight.h linux-2.6.32.43/include/linux/backlight.h
---- linux-2.6.32.43/include/linux/backlight.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/backlight.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/backlight.h linux-2.6.32.44/include/linux/backlight.h
+--- linux-2.6.32.44/include/linux/backlight.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/backlight.h 2011-04-17 15:56:46.000000000 -0400
@@ -36,18 +36,18 @@ struct backlight_device;
struct fb_info;
@@ -57930,9 +57873,9 @@ diff -urNp linux-2.6.32.43/include/linux/backlight.h linux-2.6.32.43/include/lin
extern void backlight_device_unregister(struct backlight_device *bd);
extern void backlight_force_update(struct backlight_device *bd,
enum backlight_update_reason reason);
-diff -urNp linux-2.6.32.43/include/linux/binfmts.h linux-2.6.32.43/include/linux/binfmts.h
---- linux-2.6.32.43/include/linux/binfmts.h 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.43/include/linux/binfmts.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/binfmts.h linux-2.6.32.44/include/linux/binfmts.h
+--- linux-2.6.32.44/include/linux/binfmts.h 2011-04-17 17:00:52.000000000 -0400
++++ linux-2.6.32.44/include/linux/binfmts.h 2011-04-17 15:56:46.000000000 -0400
@@ -83,6 +83,7 @@ struct linux_binfmt {
int (*load_binary)(struct linux_binprm *, struct pt_regs * regs);
int (*load_shlib)(struct file *);
@@ -57941,9 +57884,9 @@ diff -urNp linux-2.6.32.43/include/linux/binfmts.h linux-2.6.32.43/include/linux
unsigned long min_coredump; /* minimal dump size */
int hasvdso;
};
-diff -urNp linux-2.6.32.43/include/linux/blkdev.h linux-2.6.32.43/include/linux/blkdev.h
---- linux-2.6.32.43/include/linux/blkdev.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/blkdev.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/blkdev.h linux-2.6.32.44/include/linux/blkdev.h
+--- linux-2.6.32.44/include/linux/blkdev.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/blkdev.h 2011-04-17 15:56:46.000000000 -0400
@@ -1265,19 +1265,19 @@ static inline int blk_integrity_rq(struc
#endif /* CONFIG_BLK_DEV_INTEGRITY */
@@ -57975,9 +57918,9 @@ diff -urNp linux-2.6.32.43/include/linux/blkdev.h linux-2.6.32.43/include/linux/
};
extern int __blkdev_driver_ioctl(struct block_device *, fmode_t, unsigned int,
-diff -urNp linux-2.6.32.43/include/linux/blktrace_api.h linux-2.6.32.43/include/linux/blktrace_api.h
---- linux-2.6.32.43/include/linux/blktrace_api.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/blktrace_api.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/blktrace_api.h linux-2.6.32.44/include/linux/blktrace_api.h
+--- linux-2.6.32.44/include/linux/blktrace_api.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/blktrace_api.h 2011-05-04 17:56:28.000000000 -0400
@@ -160,7 +160,7 @@ struct blk_trace {
struct dentry *dir;
struct dentry *dropped_file;
@@ -57987,9 +57930,9 @@ diff -urNp linux-2.6.32.43/include/linux/blktrace_api.h linux-2.6.32.43/include/
};
extern int blk_trace_ioctl(struct block_device *, unsigned, char __user *);
-diff -urNp linux-2.6.32.43/include/linux/byteorder/little_endian.h linux-2.6.32.43/include/linux/byteorder/little_endian.h
---- linux-2.6.32.43/include/linux/byteorder/little_endian.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/byteorder/little_endian.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/byteorder/little_endian.h linux-2.6.32.44/include/linux/byteorder/little_endian.h
+--- linux-2.6.32.44/include/linux/byteorder/little_endian.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/byteorder/little_endian.h 2011-04-17 15:56:46.000000000 -0400
@@ -42,51 +42,51 @@
static inline __le64 __cpu_to_le64p(const __u64 *p)
@@ -58054,9 +57997,9 @@ diff -urNp linux-2.6.32.43/include/linux/byteorder/little_endian.h linux-2.6.32.
}
#define __cpu_to_le64s(x) do { (void)(x); } while (0)
#define __le64_to_cpus(x) do { (void)(x); } while (0)
-diff -urNp linux-2.6.32.43/include/linux/cache.h linux-2.6.32.43/include/linux/cache.h
---- linux-2.6.32.43/include/linux/cache.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/cache.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/cache.h linux-2.6.32.44/include/linux/cache.h
+--- linux-2.6.32.44/include/linux/cache.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/cache.h 2011-04-17 15:56:46.000000000 -0400
@@ -16,6 +16,10 @@
#define __read_mostly
#endif
@@ -58068,9 +58011,9 @@ diff -urNp linux-2.6.32.43/include/linux/cache.h linux-2.6.32.43/include/linux/c
#ifndef ____cacheline_aligned
#define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
#endif
-diff -urNp linux-2.6.32.43/include/linux/capability.h linux-2.6.32.43/include/linux/capability.h
---- linux-2.6.32.43/include/linux/capability.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/capability.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/capability.h linux-2.6.32.44/include/linux/capability.h
+--- linux-2.6.32.44/include/linux/capability.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/capability.h 2011-04-17 15:56:46.000000000 -0400
@@ -563,6 +563,7 @@ extern const kernel_cap_t __cap_init_eff
(security_real_capable_noaudit((t), (cap)) == 0)
@@ -58079,9 +58022,9 @@ diff -urNp linux-2.6.32.43/include/linux/capability.h linux-2.6.32.43/include/li
/* audit system wants to get cap info from files as well */
struct dentry;
-diff -urNp linux-2.6.32.43/include/linux/compiler-gcc4.h linux-2.6.32.43/include/linux/compiler-gcc4.h
---- linux-2.6.32.43/include/linux/compiler-gcc4.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/compiler-gcc4.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/compiler-gcc4.h linux-2.6.32.44/include/linux/compiler-gcc4.h
+--- linux-2.6.32.44/include/linux/compiler-gcc4.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/compiler-gcc4.h 2011-08-05 20:33:55.000000000 -0400
@@ -36,4 +36,13 @@
the kernel context */
#define __cold __attribute__((__cold__))
@@ -58096,9 +58039,9 @@ diff -urNp linux-2.6.32.43/include/linux/compiler-gcc4.h linux-2.6.32.43/include
+#endif
+
#endif
-diff -urNp linux-2.6.32.43/include/linux/compiler.h linux-2.6.32.43/include/linux/compiler.h
---- linux-2.6.32.43/include/linux/compiler.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/compiler.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/compiler.h linux-2.6.32.44/include/linux/compiler.h
+--- linux-2.6.32.44/include/linux/compiler.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/compiler.h 2011-08-05 20:33:55.000000000 -0400
@@ -247,6 +247,10 @@ void ftrace_likely_update(struct ftrace_
# define __attribute_const__ /* unimplemented */
#endif
@@ -58142,9 +58085,9 @@ diff -urNp linux-2.6.32.43/include/linux/compiler.h linux-2.6.32.43/include/linu
+#define ACCESS_ONCE_RW(x) (*(volatile typeof(x) *)&(x))
#endif /* __LINUX_COMPILER_H */
-diff -urNp linux-2.6.32.43/include/linux/crypto.h linux-2.6.32.43/include/linux/crypto.h
---- linux-2.6.32.43/include/linux/crypto.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/crypto.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/crypto.h linux-2.6.32.44/include/linux/crypto.h
+--- linux-2.6.32.44/include/linux/crypto.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/crypto.h 2011-08-05 20:33:55.000000000 -0400
@@ -394,7 +394,7 @@ struct cipher_tfm {
const u8 *key, unsigned int keylen);
void (*cit_encrypt_one)(struct crypto_tfm *tfm, u8 *dst, const u8 *src);
@@ -58170,9 +58113,9 @@ diff -urNp linux-2.6.32.43/include/linux/crypto.h linux-2.6.32.43/include/linux/
#define crt_ablkcipher crt_u.ablkcipher
#define crt_aead crt_u.aead
-diff -urNp linux-2.6.32.43/include/linux/cryptohash.h linux-2.6.32.43/include/linux/cryptohash.h
---- linux-2.6.32.43/include/linux/cryptohash.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/cryptohash.h 2011-08-07 19:48:09.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/cryptohash.h linux-2.6.32.44/include/linux/cryptohash.h
+--- linux-2.6.32.44/include/linux/cryptohash.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/cryptohash.h 2011-08-07 19:48:09.000000000 -0400
@@ -7,6 +7,11 @@
void sha_init(__u32 *buf);
void sha_transform(__u32 *digest, const char *data, __u32 *W);
@@ -58185,9 +58128,9 @@ diff -urNp linux-2.6.32.43/include/linux/cryptohash.h linux-2.6.32.43/include/li
__u32 half_md4_transform(__u32 buf[4], __u32 const in[8]);
#endif
-diff -urNp linux-2.6.32.43/include/linux/dcache.h linux-2.6.32.43/include/linux/dcache.h
---- linux-2.6.32.43/include/linux/dcache.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/dcache.h 2011-04-23 13:34:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/dcache.h linux-2.6.32.44/include/linux/dcache.h
+--- linux-2.6.32.44/include/linux/dcache.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/dcache.h 2011-04-23 13:34:46.000000000 -0400
@@ -119,6 +119,8 @@ struct dentry {
unsigned char d_iname[DNAME_INLINE_LEN_MIN]; /* small names */
};
@@ -58197,9 +58140,9 @@ diff -urNp linux-2.6.32.43/include/linux/dcache.h linux-2.6.32.43/include/linux/
/*
* dentry->d_lock spinlock nesting subclasses:
*
-diff -urNp linux-2.6.32.43/include/linux/decompress/mm.h linux-2.6.32.43/include/linux/decompress/mm.h
---- linux-2.6.32.43/include/linux/decompress/mm.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/decompress/mm.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/decompress/mm.h linux-2.6.32.44/include/linux/decompress/mm.h
+--- linux-2.6.32.44/include/linux/decompress/mm.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/decompress/mm.h 2011-04-17 15:56:46.000000000 -0400
@@ -78,7 +78,7 @@ static void free(void *where)
* warnings when not needed (indeed large_malloc / large_free are not
* needed by inflate */
@@ -58209,9 +58152,9 @@ diff -urNp linux-2.6.32.43/include/linux/decompress/mm.h linux-2.6.32.43/include
#define free(a) kfree(a)
#define large_malloc(a) vmalloc(a)
-diff -urNp linux-2.6.32.43/include/linux/dma-mapping.h linux-2.6.32.43/include/linux/dma-mapping.h
---- linux-2.6.32.43/include/linux/dma-mapping.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/dma-mapping.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/dma-mapping.h linux-2.6.32.44/include/linux/dma-mapping.h
+--- linux-2.6.32.44/include/linux/dma-mapping.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/dma-mapping.h 2011-04-17 15:56:46.000000000 -0400
@@ -16,50 +16,50 @@ enum dma_data_direction {
};
@@ -58278,9 +58221,9 @@ diff -urNp linux-2.6.32.43/include/linux/dma-mapping.h linux-2.6.32.43/include/l
};
#define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
-diff -urNp linux-2.6.32.43/include/linux/dst.h linux-2.6.32.43/include/linux/dst.h
---- linux-2.6.32.43/include/linux/dst.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/dst.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/dst.h linux-2.6.32.44/include/linux/dst.h
+--- linux-2.6.32.44/include/linux/dst.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/dst.h 2011-04-17 15:56:46.000000000 -0400
@@ -380,7 +380,7 @@ struct dst_node
struct thread_pool *pool;
@@ -58290,9 +58233,9 @@ diff -urNp linux-2.6.32.43/include/linux/dst.h linux-2.6.32.43/include/linux/dst
/*
* How frequently and how many times transaction
-diff -urNp linux-2.6.32.43/include/linux/elf.h linux-2.6.32.43/include/linux/elf.h
---- linux-2.6.32.43/include/linux/elf.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/elf.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/elf.h linux-2.6.32.44/include/linux/elf.h
+--- linux-2.6.32.44/include/linux/elf.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/elf.h 2011-04-17 15:56:46.000000000 -0400
@@ -49,6 +49,17 @@ typedef __s64 Elf64_Sxword;
#define PT_GNU_EH_FRAME 0x6474e550
@@ -58365,9 +58308,9 @@ diff -urNp linux-2.6.32.43/include/linux/elf.h linux-2.6.32.43/include/linux/elf
#endif
-diff -urNp linux-2.6.32.43/include/linux/fscache-cache.h linux-2.6.32.43/include/linux/fscache-cache.h
---- linux-2.6.32.43/include/linux/fscache-cache.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/fscache-cache.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/fscache-cache.h linux-2.6.32.44/include/linux/fscache-cache.h
+--- linux-2.6.32.44/include/linux/fscache-cache.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/fscache-cache.h 2011-05-04 17:56:28.000000000 -0400
@@ -116,7 +116,7 @@ struct fscache_operation {
#endif
};
@@ -58386,9 +58329,9 @@ diff -urNp linux-2.6.32.43/include/linux/fscache-cache.h linux-2.6.32.43/include
op->release = release;
INIT_LIST_HEAD(&op->pend_link);
fscache_set_op_state(op, "Init");
-diff -urNp linux-2.6.32.43/include/linux/fs.h linux-2.6.32.43/include/linux/fs.h
---- linux-2.6.32.43/include/linux/fs.h 2011-07-13 17:23:04.000000000 -0400
-+++ linux-2.6.32.43/include/linux/fs.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/fs.h linux-2.6.32.44/include/linux/fs.h
+--- linux-2.6.32.44/include/linux/fs.h 2011-07-13 17:23:04.000000000 -0400
++++ linux-2.6.32.44/include/linux/fs.h 2011-08-05 20:33:55.000000000 -0400
@@ -90,6 +90,11 @@ struct inodes_stat_t {
/* Expect random access pattern */
#define FMODE_RANDOM ((__force fmode_t)4096)
@@ -58559,9 +58502,9 @@ diff -urNp linux-2.6.32.43/include/linux/fs.h linux-2.6.32.43/include/linux/fs.h
};
/*
-diff -urNp linux-2.6.32.43/include/linux/fs_struct.h linux-2.6.32.43/include/linux/fs_struct.h
---- linux-2.6.32.43/include/linux/fs_struct.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/fs_struct.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/fs_struct.h linux-2.6.32.44/include/linux/fs_struct.h
+--- linux-2.6.32.44/include/linux/fs_struct.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/fs_struct.h 2011-04-17 15:56:46.000000000 -0400
@@ -4,7 +4,7 @@
#include <linux/path.h>
@@ -58571,9 +58514,9 @@ diff -urNp linux-2.6.32.43/include/linux/fs_struct.h linux-2.6.32.43/include/lin
rwlock_t lock;
int umask;
int in_exec;
-diff -urNp linux-2.6.32.43/include/linux/ftrace_event.h linux-2.6.32.43/include/linux/ftrace_event.h
---- linux-2.6.32.43/include/linux/ftrace_event.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/ftrace_event.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/ftrace_event.h linux-2.6.32.44/include/linux/ftrace_event.h
+--- linux-2.6.32.44/include/linux/ftrace_event.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/ftrace_event.h 2011-05-04 17:56:28.000000000 -0400
@@ -163,7 +163,7 @@ extern int trace_define_field(struct ftr
int filter_type);
extern int trace_define_common_fields(struct ftrace_event_call *call);
@@ -58583,9 +58526,9 @@ diff -urNp linux-2.6.32.43/include/linux/ftrace_event.h linux-2.6.32.43/include/
int trace_set_clr_event(const char *system, const char *event, int set);
-diff -urNp linux-2.6.32.43/include/linux/genhd.h linux-2.6.32.43/include/linux/genhd.h
---- linux-2.6.32.43/include/linux/genhd.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/genhd.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/genhd.h linux-2.6.32.44/include/linux/genhd.h
+--- linux-2.6.32.44/include/linux/genhd.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/genhd.h 2011-04-17 15:56:46.000000000 -0400
@@ -161,7 +161,7 @@ struct gendisk {
struct timer_rand_state *random;
@@ -58595,9 +58538,9 @@ diff -urNp linux-2.6.32.43/include/linux/genhd.h linux-2.6.32.43/include/linux/g
struct work_struct async_notify;
#ifdef CONFIG_BLK_DEV_INTEGRITY
struct blk_integrity *integrity;
-diff -urNp linux-2.6.32.43/include/linux/gracl.h linux-2.6.32.43/include/linux/gracl.h
---- linux-2.6.32.43/include/linux/gracl.h 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/include/linux/gracl.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/gracl.h linux-2.6.32.44/include/linux/gracl.h
+--- linux-2.6.32.44/include/linux/gracl.h 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/include/linux/gracl.h 2011-04-17 15:56:46.000000000 -0400
@@ -0,0 +1,317 @@
+#ifndef GR_ACL_H
+#define GR_ACL_H
@@ -58916,9 +58859,9 @@ diff -urNp linux-2.6.32.43/include/linux/gracl.h linux-2.6.32.43/include/linux/g
+
+#endif
+
-diff -urNp linux-2.6.32.43/include/linux/gralloc.h linux-2.6.32.43/include/linux/gralloc.h
---- linux-2.6.32.43/include/linux/gralloc.h 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/include/linux/gralloc.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/gralloc.h linux-2.6.32.44/include/linux/gralloc.h
+--- linux-2.6.32.44/include/linux/gralloc.h 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/include/linux/gralloc.h 2011-04-17 15:56:46.000000000 -0400
@@ -0,0 +1,9 @@
+#ifndef __GRALLOC_H
+#define __GRALLOC_H
@@ -58929,9 +58872,9 @@ diff -urNp linux-2.6.32.43/include/linux/gralloc.h linux-2.6.32.43/include/linux
+void *acl_alloc_num(unsigned long num, unsigned long len);
+
+#endif
-diff -urNp linux-2.6.32.43/include/linux/grdefs.h linux-2.6.32.43/include/linux/grdefs.h
---- linux-2.6.32.43/include/linux/grdefs.h 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/include/linux/grdefs.h 2011-06-11 16:20:26.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/grdefs.h linux-2.6.32.44/include/linux/grdefs.h
+--- linux-2.6.32.44/include/linux/grdefs.h 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/include/linux/grdefs.h 2011-06-11 16:20:26.000000000 -0400
@@ -0,0 +1,140 @@
+#ifndef GRDEFS_H
+#define GRDEFS_H
@@ -59073,10 +59016,10 @@ diff -urNp linux-2.6.32.43/include/linux/grdefs.h linux-2.6.32.43/include/linux/
+};
+
+#endif
-diff -urNp linux-2.6.32.43/include/linux/grinternal.h linux-2.6.32.43/include/linux/grinternal.h
---- linux-2.6.32.43/include/linux/grinternal.h 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/include/linux/grinternal.h 2011-07-14 20:35:29.000000000 -0400
-@@ -0,0 +1,218 @@
+diff -urNp linux-2.6.32.44/include/linux/grinternal.h linux-2.6.32.44/include/linux/grinternal.h
+--- linux-2.6.32.44/include/linux/grinternal.h 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/include/linux/grinternal.h 2011-08-11 19:58:37.000000000 -0400
+@@ -0,0 +1,217 @@
+#ifndef __GRINTERNAL_H
+#define __GRINTERNAL_H
+
@@ -59116,7 +59059,6 @@ diff -urNp linux-2.6.32.43/include/linux/grinternal.h linux-2.6.32.43/include/li
+extern int grsec_enable_harden_ptrace;
+extern int grsec_enable_link;
+extern int grsec_enable_fifo;
-+extern int grsec_enable_execve;
+extern int grsec_enable_shm;
+extern int grsec_enable_execlog;
+extern int grsec_enable_signal;
@@ -59295,9 +59237,9 @@ diff -urNp linux-2.6.32.43/include/linux/grinternal.h linux-2.6.32.43/include/li
+#endif
+
+#endif
-diff -urNp linux-2.6.32.43/include/linux/grmsg.h linux-2.6.32.43/include/linux/grmsg.h
---- linux-2.6.32.43/include/linux/grmsg.h 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/include/linux/grmsg.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/grmsg.h linux-2.6.32.44/include/linux/grmsg.h
+--- linux-2.6.32.44/include/linux/grmsg.h 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/include/linux/grmsg.h 2011-04-17 15:56:46.000000000 -0400
@@ -0,0 +1,108 @@
+#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
+#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
@@ -59407,10 +59349,10 @@ diff -urNp linux-2.6.32.43/include/linux/grmsg.h linux-2.6.32.43/include/linux/g
+#define GR_VM86_MSG "denied use of vm86 by "
+#define GR_PTRACE_AUDIT_MSG "process %.950s(%.16s:%d) attached to via ptrace by "
+#define GR_INIT_TRANSFER_MSG "persistent special role transferred privilege to init by "
-diff -urNp linux-2.6.32.43/include/linux/grsecurity.h linux-2.6.32.43/include/linux/grsecurity.h
---- linux-2.6.32.43/include/linux/grsecurity.h 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/include/linux/grsecurity.h 2011-08-05 19:53:46.000000000 -0400
-@@ -0,0 +1,218 @@
+diff -urNp linux-2.6.32.44/include/linux/grsecurity.h linux-2.6.32.44/include/linux/grsecurity.h
+--- linux-2.6.32.44/include/linux/grsecurity.h 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/include/linux/grsecurity.h 2011-08-11 19:58:57.000000000 -0400
+@@ -0,0 +1,217 @@
+#ifndef GR_SECURITY_H
+#define GR_SECURITY_H
+#include <linux/fs.h>
@@ -59475,7 +59417,6 @@ diff -urNp linux-2.6.32.43/include/linux/grsecurity.h linux-2.6.32.43/include/li
+int gr_handle_chroot_unix(const pid_t pid);
+
+int gr_handle_rawio(const struct inode *inode);
-+int gr_handle_nproc(void);
+
+void gr_handle_ioperm(void);
+void gr_handle_iopl(void);
@@ -59629,9 +59570,9 @@ diff -urNp linux-2.6.32.43/include/linux/grsecurity.h linux-2.6.32.43/include/li
+#endif
+
+#endif
-diff -urNp linux-2.6.32.43/include/linux/hdpu_features.h linux-2.6.32.43/include/linux/hdpu_features.h
---- linux-2.6.32.43/include/linux/hdpu_features.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/hdpu_features.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/hdpu_features.h linux-2.6.32.44/include/linux/hdpu_features.h
+--- linux-2.6.32.44/include/linux/hdpu_features.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/hdpu_features.h 2011-04-17 15:56:46.000000000 -0400
@@ -3,7 +3,7 @@
struct cpustate_t {
spinlock_t lock;
@@ -59641,9 +59582,9 @@ diff -urNp linux-2.6.32.43/include/linux/hdpu_features.h linux-2.6.32.43/include
unsigned char cached_val;
int inited;
unsigned long *set_addr;
-diff -urNp linux-2.6.32.43/include/linux/highmem.h linux-2.6.32.43/include/linux/highmem.h
---- linux-2.6.32.43/include/linux/highmem.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/highmem.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/highmem.h linux-2.6.32.44/include/linux/highmem.h
+--- linux-2.6.32.44/include/linux/highmem.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/highmem.h 2011-04-17 15:56:46.000000000 -0400
@@ -137,6 +137,18 @@ static inline void clear_highpage(struct
kunmap_atomic(kaddr, KM_USER0);
}
@@ -59663,9 +59604,9 @@ diff -urNp linux-2.6.32.43/include/linux/highmem.h linux-2.6.32.43/include/linux
static inline void zero_user_segments(struct page *page,
unsigned start1, unsigned end1,
unsigned start2, unsigned end2)
-diff -urNp linux-2.6.32.43/include/linux/i2o.h linux-2.6.32.43/include/linux/i2o.h
---- linux-2.6.32.43/include/linux/i2o.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/i2o.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/i2o.h linux-2.6.32.44/include/linux/i2o.h
+--- linux-2.6.32.44/include/linux/i2o.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/i2o.h 2011-05-04 17:56:28.000000000 -0400
@@ -564,7 +564,7 @@ struct i2o_controller {
struct i2o_device *exec; /* Executive */
#if BITS_PER_LONG == 64
@@ -59675,9 +59616,9 @@ diff -urNp linux-2.6.32.43/include/linux/i2o.h linux-2.6.32.43/include/linux/i2o
struct list_head context_list; /* list of context id's
and pointers */
#endif
-diff -urNp linux-2.6.32.43/include/linux/init_task.h linux-2.6.32.43/include/linux/init_task.h
---- linux-2.6.32.43/include/linux/init_task.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/init_task.h 2011-05-18 20:44:59.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/init_task.h linux-2.6.32.44/include/linux/init_task.h
+--- linux-2.6.32.44/include/linux/init_task.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/init_task.h 2011-05-18 20:44:59.000000000 -0400
@@ -83,6 +83,12 @@ extern struct group_info init_groups;
#define INIT_IDS
#endif
@@ -59699,9 +59640,9 @@ diff -urNp linux-2.6.32.43/include/linux/init_task.h linux-2.6.32.43/include/lin
.fs = &init_fs, \
.files = &init_files, \
.signal = &init_signals, \
-diff -urNp linux-2.6.32.43/include/linux/intel-iommu.h linux-2.6.32.43/include/linux/intel-iommu.h
---- linux-2.6.32.43/include/linux/intel-iommu.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/intel-iommu.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/intel-iommu.h linux-2.6.32.44/include/linux/intel-iommu.h
+--- linux-2.6.32.44/include/linux/intel-iommu.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/intel-iommu.h 2011-08-05 20:33:55.000000000 -0400
@@ -296,7 +296,7 @@ struct iommu_flush {
u8 fm, u64 type);
void (*flush_iotlb)(struct intel_iommu *iommu, u16 did, u64 addr,
@@ -59711,9 +59652,9 @@ diff -urNp linux-2.6.32.43/include/linux/intel-iommu.h linux-2.6.32.43/include/l
enum {
SR_DMAR_FECTL_REG,
-diff -urNp linux-2.6.32.43/include/linux/interrupt.h linux-2.6.32.43/include/linux/interrupt.h
---- linux-2.6.32.43/include/linux/interrupt.h 2011-06-25 12:55:35.000000000 -0400
-+++ linux-2.6.32.43/include/linux/interrupt.h 2011-06-25 12:56:37.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/interrupt.h linux-2.6.32.44/include/linux/interrupt.h
+--- linux-2.6.32.44/include/linux/interrupt.h 2011-06-25 12:55:35.000000000 -0400
++++ linux-2.6.32.44/include/linux/interrupt.h 2011-06-25 12:56:37.000000000 -0400
@@ -363,7 +363,7 @@ enum
/* map softirq index to softirq name. update 'softirq_to_name' in
* kernel/softirq.c when adding a new softirq.
@@ -59738,9 +59679,9 @@ diff -urNp linux-2.6.32.43/include/linux/interrupt.h linux-2.6.32.43/include/lin
extern void softirq_init(void);
#define __raise_softirq_irqoff(nr) do { or_softirq_pending(1UL << (nr)); } while (0)
extern void raise_softirq_irqoff(unsigned int nr);
-diff -urNp linux-2.6.32.43/include/linux/irq.h linux-2.6.32.43/include/linux/irq.h
---- linux-2.6.32.43/include/linux/irq.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/irq.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/irq.h linux-2.6.32.44/include/linux/irq.h
+--- linux-2.6.32.44/include/linux/irq.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/irq.h 2011-04-17 15:56:46.000000000 -0400
@@ -438,12 +438,12 @@ extern int set_irq_msi(unsigned int irq,
static inline bool alloc_desc_masks(struct irq_desc *desc, int node,
bool boot)
@@ -59755,9 +59696,9 @@ diff -urNp linux-2.6.32.43/include/linux/irq.h linux-2.6.32.43/include/linux/irq
if (!alloc_cpumask_var_node(&desc->affinity, gfp, node))
return false;
-diff -urNp linux-2.6.32.43/include/linux/kallsyms.h linux-2.6.32.43/include/linux/kallsyms.h
---- linux-2.6.32.43/include/linux/kallsyms.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/kallsyms.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/kallsyms.h linux-2.6.32.44/include/linux/kallsyms.h
+--- linux-2.6.32.44/include/linux/kallsyms.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/kallsyms.h 2011-04-17 15:56:46.000000000 -0400
@@ -15,7 +15,8 @@
struct module;
@@ -59784,9 +59725,9 @@ diff -urNp linux-2.6.32.43/include/linux/kallsyms.h linux-2.6.32.43/include/linu
/* This macro allows us to keep printk typechecking */
static void __check_printsym_format(const char *fmt, ...)
-diff -urNp linux-2.6.32.43/include/linux/kgdb.h linux-2.6.32.43/include/linux/kgdb.h
---- linux-2.6.32.43/include/linux/kgdb.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/kgdb.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/kgdb.h linux-2.6.32.44/include/linux/kgdb.h
+--- linux-2.6.32.44/include/linux/kgdb.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/kgdb.h 2011-08-05 20:33:55.000000000 -0400
@@ -74,8 +74,8 @@ void kgdb_breakpoint(void);
extern int kgdb_connected;
@@ -59839,9 +59780,9 @@ diff -urNp linux-2.6.32.43/include/linux/kgdb.h linux-2.6.32.43/include/linux/kg
extern int kgdb_hex2long(char **ptr, unsigned long *long_val);
extern int kgdb_mem2hex(char *mem, char *buf, int count);
-diff -urNp linux-2.6.32.43/include/linux/kmod.h linux-2.6.32.43/include/linux/kmod.h
---- linux-2.6.32.43/include/linux/kmod.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/kmod.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/kmod.h linux-2.6.32.44/include/linux/kmod.h
+--- linux-2.6.32.44/include/linux/kmod.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/kmod.h 2011-04-17 15:56:46.000000000 -0400
@@ -31,6 +31,8 @@
* usually useless though. */
extern int __request_module(bool wait, const char *name, ...) \
@@ -59851,9 +59792,9 @@ diff -urNp linux-2.6.32.43/include/linux/kmod.h linux-2.6.32.43/include/linux/km
#define request_module(mod...) __request_module(true, mod)
#define request_module_nowait(mod...) __request_module(false, mod)
#define try_then_request_module(x, mod...) \
-diff -urNp linux-2.6.32.43/include/linux/kobject.h linux-2.6.32.43/include/linux/kobject.h
---- linux-2.6.32.43/include/linux/kobject.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/kobject.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/kobject.h linux-2.6.32.44/include/linux/kobject.h
+--- linux-2.6.32.44/include/linux/kobject.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/kobject.h 2011-04-17 15:56:46.000000000 -0400
@@ -106,7 +106,7 @@ extern char *kobject_get_path(struct kob
struct kobj_type {
@@ -59902,9 +59843,9 @@ diff -urNp linux-2.6.32.43/include/linux/kobject.h linux-2.6.32.43/include/linux
struct kobject *parent_kobj);
static inline struct kset *to_kset(struct kobject *kobj)
-diff -urNp linux-2.6.32.43/include/linux/kvm_host.h linux-2.6.32.43/include/linux/kvm_host.h
---- linux-2.6.32.43/include/linux/kvm_host.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/kvm_host.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/kvm_host.h linux-2.6.32.44/include/linux/kvm_host.h
+--- linux-2.6.32.44/include/linux/kvm_host.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/kvm_host.h 2011-04-17 15:56:46.000000000 -0400
@@ -210,7 +210,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vc
void vcpu_load(struct kvm_vcpu *vcpu);
void vcpu_put(struct kvm_vcpu *vcpu);
@@ -59923,9 +59864,9 @@ diff -urNp linux-2.6.32.43/include/linux/kvm_host.h linux-2.6.32.43/include/linu
void kvm_arch_exit(void);
int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
-diff -urNp linux-2.6.32.43/include/linux/libata.h linux-2.6.32.43/include/linux/libata.h
---- linux-2.6.32.43/include/linux/libata.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/libata.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/libata.h linux-2.6.32.44/include/linux/libata.h
+--- linux-2.6.32.44/include/linux/libata.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/libata.h 2011-08-05 20:33:55.000000000 -0400
@@ -525,11 +525,11 @@ struct ata_ioports {
struct ata_host {
@@ -59985,9 +59926,9 @@ diff -urNp linux-2.6.32.43/include/linux/libata.h linux-2.6.32.43/include/linux/
extern int ata_scsi_detect(struct scsi_host_template *sht);
extern int ata_scsi_ioctl(struct scsi_device *dev, int cmd, void __user *arg);
extern int ata_scsi_queuecmd(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *));
-diff -urNp linux-2.6.32.43/include/linux/lockd/bind.h linux-2.6.32.43/include/linux/lockd/bind.h
---- linux-2.6.32.43/include/linux/lockd/bind.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/lockd/bind.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/lockd/bind.h linux-2.6.32.44/include/linux/lockd/bind.h
+--- linux-2.6.32.44/include/linux/lockd/bind.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/lockd/bind.h 2011-04-17 15:56:46.000000000 -0400
@@ -23,13 +23,13 @@ struct svc_rqst;
* This is the set of functions for lockd->nfsd communication
*/
@@ -60005,9 +59946,9 @@ diff -urNp linux-2.6.32.43/include/linux/lockd/bind.h linux-2.6.32.43/include/li
/*
* Similar to nfs_client_initdata, but without the NFS-specific
-diff -urNp linux-2.6.32.43/include/linux/mca.h linux-2.6.32.43/include/linux/mca.h
---- linux-2.6.32.43/include/linux/mca.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/mca.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/mca.h linux-2.6.32.44/include/linux/mca.h
+--- linux-2.6.32.44/include/linux/mca.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/mca.h 2011-08-05 20:33:55.000000000 -0400
@@ -80,7 +80,7 @@ struct mca_bus_accessor_functions {
int region);
void * (*mca_transform_memory)(struct mca_device *,
@@ -60017,9 +59958,9 @@ diff -urNp linux-2.6.32.43/include/linux/mca.h linux-2.6.32.43/include/linux/mca
struct mca_bus {
u64 default_dma_mask;
-diff -urNp linux-2.6.32.43/include/linux/memory.h linux-2.6.32.43/include/linux/memory.h
---- linux-2.6.32.43/include/linux/memory.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/memory.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/memory.h linux-2.6.32.44/include/linux/memory.h
+--- linux-2.6.32.44/include/linux/memory.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/memory.h 2011-08-05 20:33:55.000000000 -0400
@@ -108,7 +108,7 @@ struct memory_accessor {
size_t count);
ssize_t (*write)(struct memory_accessor *, const char *buf,
@@ -60029,9 +59970,9 @@ diff -urNp linux-2.6.32.43/include/linux/memory.h linux-2.6.32.43/include/linux/
/*
* Kernel text modification mutex, used for code patching. Users of this lock
-diff -urNp linux-2.6.32.43/include/linux/mm.h linux-2.6.32.43/include/linux/mm.h
---- linux-2.6.32.43/include/linux/mm.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/mm.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/mm.h linux-2.6.32.44/include/linux/mm.h
+--- linux-2.6.32.44/include/linux/mm.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/mm.h 2011-04-17 15:56:46.000000000 -0400
@@ -106,7 +106,14 @@ extern unsigned int kobjsize(const void
#define VM_CAN_NONLINEAR 0x08000000 /* Has ->fault & does nonlinear pages */
@@ -60111,9 +60052,9 @@ diff -urNp linux-2.6.32.43/include/linux/mm.h linux-2.6.32.43/include/linux/mm.h
#endif /* __KERNEL__ */
#endif /* _LINUX_MM_H */
-diff -urNp linux-2.6.32.43/include/linux/mm_types.h linux-2.6.32.43/include/linux/mm_types.h
---- linux-2.6.32.43/include/linux/mm_types.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/mm_types.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/mm_types.h linux-2.6.32.44/include/linux/mm_types.h
+--- linux-2.6.32.44/include/linux/mm_types.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/mm_types.h 2011-04-17 15:56:46.000000000 -0400
@@ -186,6 +186,8 @@ struct vm_area_struct {
#ifdef CONFIG_NUMA
struct mempolicy *vm_policy; /* NUMA policy for the VMA */
@@ -60148,9 +60089,9 @@ diff -urNp linux-2.6.32.43/include/linux/mm_types.h linux-2.6.32.43/include/linu
};
/* Future-safe accessor for struct mm_struct's cpu_vm_mask. */
-diff -urNp linux-2.6.32.43/include/linux/mmu_notifier.h linux-2.6.32.43/include/linux/mmu_notifier.h
---- linux-2.6.32.43/include/linux/mmu_notifier.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/mmu_notifier.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/mmu_notifier.h linux-2.6.32.44/include/linux/mmu_notifier.h
+--- linux-2.6.32.44/include/linux/mmu_notifier.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/mmu_notifier.h 2011-04-17 15:56:46.000000000 -0400
@@ -235,12 +235,12 @@ static inline void mmu_notifier_mm_destr
*/
#define ptep_clear_flush_notify(__vma, __address, __ptep) \
@@ -60167,9 +60108,9 @@ diff -urNp linux-2.6.32.43/include/linux/mmu_notifier.h linux-2.6.32.43/include/
})
#define ptep_clear_flush_young_notify(__vma, __address, __ptep) \
-diff -urNp linux-2.6.32.43/include/linux/mmzone.h linux-2.6.32.43/include/linux/mmzone.h
---- linux-2.6.32.43/include/linux/mmzone.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/mmzone.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/mmzone.h linux-2.6.32.44/include/linux/mmzone.h
+--- linux-2.6.32.44/include/linux/mmzone.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/mmzone.h 2011-04-17 15:56:46.000000000 -0400
@@ -350,7 +350,7 @@ struct zone {
unsigned long flags; /* zone flags, see below */
@@ -60179,9 +60120,9 @@ diff -urNp linux-2.6.32.43/include/linux/mmzone.h linux-2.6.32.43/include/linux/
/*
* prev_priority holds the scanning priority for this zone. It is
-diff -urNp linux-2.6.32.43/include/linux/mod_devicetable.h linux-2.6.32.43/include/linux/mod_devicetable.h
---- linux-2.6.32.43/include/linux/mod_devicetable.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/mod_devicetable.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/mod_devicetable.h linux-2.6.32.44/include/linux/mod_devicetable.h
+--- linux-2.6.32.44/include/linux/mod_devicetable.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/mod_devicetable.h 2011-04-17 15:56:46.000000000 -0400
@@ -12,7 +12,7 @@
typedef unsigned long kernel_ulong_t;
#endif
@@ -60200,9 +60141,9 @@ diff -urNp linux-2.6.32.43/include/linux/mod_devicetable.h linux-2.6.32.43/inclu
struct hid_device_id {
__u16 bus;
-diff -urNp linux-2.6.32.43/include/linux/module.h linux-2.6.32.43/include/linux/module.h
---- linux-2.6.32.43/include/linux/module.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/module.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/module.h linux-2.6.32.44/include/linux/module.h
+--- linux-2.6.32.44/include/linux/module.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/module.h 2011-08-05 20:33:55.000000000 -0400
@@ -16,6 +16,7 @@
#include <linux/kobject.h>
#include <linux/moduleparam.h>
@@ -60294,9 +60235,9 @@ diff -urNp linux-2.6.32.43/include/linux/module.h linux-2.6.32.43/include/linux/
}
/* Search for module by name: must hold module_mutex. */
-diff -urNp linux-2.6.32.43/include/linux/moduleloader.h linux-2.6.32.43/include/linux/moduleloader.h
---- linux-2.6.32.43/include/linux/moduleloader.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/moduleloader.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/moduleloader.h linux-2.6.32.44/include/linux/moduleloader.h
+--- linux-2.6.32.44/include/linux/moduleloader.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/moduleloader.h 2011-04-17 15:56:46.000000000 -0400
@@ -20,9 +20,21 @@ unsigned int arch_mod_section_prepend(st
sections. Returns NULL on failure. */
void *module_alloc(unsigned long size);
@@ -60319,9 +60260,9 @@ diff -urNp linux-2.6.32.43/include/linux/moduleloader.h linux-2.6.32.43/include/
/* Apply the given relocation to the (simplified) ELF. Return -error
or 0. */
int apply_relocate(Elf_Shdr *sechdrs,
-diff -urNp linux-2.6.32.43/include/linux/moduleparam.h linux-2.6.32.43/include/linux/moduleparam.h
---- linux-2.6.32.43/include/linux/moduleparam.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/moduleparam.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/moduleparam.h linux-2.6.32.44/include/linux/moduleparam.h
+--- linux-2.6.32.44/include/linux/moduleparam.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/moduleparam.h 2011-04-17 15:56:46.000000000 -0400
@@ -132,7 +132,7 @@ struct kparam_array
/* Actually copy string: maxlen param is usually sizeof(string). */
@@ -60340,9 +60281,9 @@ diff -urNp linux-2.6.32.43/include/linux/moduleparam.h linux-2.6.32.43/include/l
= { ARRAY_SIZE(array), nump, param_set_##type, param_get_##type,\
sizeof(array[0]), array }; \
__module_param_call(MODULE_PARAM_PREFIX, name, \
-diff -urNp linux-2.6.32.43/include/linux/mutex.h linux-2.6.32.43/include/linux/mutex.h
---- linux-2.6.32.43/include/linux/mutex.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/mutex.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/mutex.h linux-2.6.32.44/include/linux/mutex.h
+--- linux-2.6.32.44/include/linux/mutex.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/mutex.h 2011-04-17 15:56:46.000000000 -0400
@@ -51,7 +51,7 @@ struct mutex {
spinlock_t wait_lock;
struct list_head wait_list;
@@ -60352,9 +60293,9 @@ diff -urNp linux-2.6.32.43/include/linux/mutex.h linux-2.6.32.43/include/linux/m
#endif
#ifdef CONFIG_DEBUG_MUTEXES
const char *name;
-diff -urNp linux-2.6.32.43/include/linux/namei.h linux-2.6.32.43/include/linux/namei.h
---- linux-2.6.32.43/include/linux/namei.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/namei.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/namei.h linux-2.6.32.44/include/linux/namei.h
+--- linux-2.6.32.44/include/linux/namei.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/namei.h 2011-04-17 15:56:46.000000000 -0400
@@ -22,7 +22,7 @@ struct nameidata {
unsigned int flags;
int last_type;
@@ -60379,9 +60320,9 @@ diff -urNp linux-2.6.32.43/include/linux/namei.h linux-2.6.32.43/include/linux/n
{
return nd->saved_names[nd->depth];
}
-diff -urNp linux-2.6.32.43/include/linux/netfilter/xt_gradm.h linux-2.6.32.43/include/linux/netfilter/xt_gradm.h
---- linux-2.6.32.43/include/linux/netfilter/xt_gradm.h 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/include/linux/netfilter/xt_gradm.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/netfilter/xt_gradm.h linux-2.6.32.44/include/linux/netfilter/xt_gradm.h
+--- linux-2.6.32.44/include/linux/netfilter/xt_gradm.h 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/include/linux/netfilter/xt_gradm.h 2011-04-17 15:56:46.000000000 -0400
@@ -0,0 +1,9 @@
+#ifndef _LINUX_NETFILTER_XT_GRADM_H
+#define _LINUX_NETFILTER_XT_GRADM_H 1
@@ -60392,9 +60333,9 @@ diff -urNp linux-2.6.32.43/include/linux/netfilter/xt_gradm.h linux-2.6.32.43/in
+};
+
+#endif
-diff -urNp linux-2.6.32.43/include/linux/nodemask.h linux-2.6.32.43/include/linux/nodemask.h
---- linux-2.6.32.43/include/linux/nodemask.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/nodemask.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/nodemask.h linux-2.6.32.44/include/linux/nodemask.h
+--- linux-2.6.32.44/include/linux/nodemask.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/nodemask.h 2011-04-17 15:56:46.000000000 -0400
@@ -464,11 +464,11 @@ static inline int num_node_state(enum no
#define any_online_node(mask) \
@@ -60411,9 +60352,9 @@ diff -urNp linux-2.6.32.43/include/linux/nodemask.h linux-2.6.32.43/include/linu
})
#define num_online_nodes() num_node_state(N_ONLINE)
-diff -urNp linux-2.6.32.43/include/linux/oprofile.h linux-2.6.32.43/include/linux/oprofile.h
---- linux-2.6.32.43/include/linux/oprofile.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/oprofile.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/oprofile.h linux-2.6.32.44/include/linux/oprofile.h
+--- linux-2.6.32.44/include/linux/oprofile.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/oprofile.h 2011-04-17 15:56:46.000000000 -0400
@@ -129,9 +129,9 @@ int oprofilefs_create_ulong(struct super
int oprofilefs_create_ro_ulong(struct super_block * sb, struct dentry * root,
char const * name, ulong * val);
@@ -60426,9 +60367,9 @@ diff -urNp linux-2.6.32.43/include/linux/oprofile.h linux-2.6.32.43/include/linu
/** create a directory */
struct dentry * oprofilefs_mkdir(struct super_block * sb, struct dentry * root,
-diff -urNp linux-2.6.32.43/include/linux/perf_event.h linux-2.6.32.43/include/linux/perf_event.h
---- linux-2.6.32.43/include/linux/perf_event.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/perf_event.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/perf_event.h linux-2.6.32.44/include/linux/perf_event.h
+--- linux-2.6.32.44/include/linux/perf_event.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/perf_event.h 2011-05-04 17:56:28.000000000 -0400
@@ -476,7 +476,7 @@ struct hw_perf_event {
struct hrtimer hrtimer;
};
@@ -60458,9 +60399,9 @@ diff -urNp linux-2.6.32.43/include/linux/perf_event.h linux-2.6.32.43/include/li
/*
* Protect attach/detach and child_list:
-diff -urNp linux-2.6.32.43/include/linux/pipe_fs_i.h linux-2.6.32.43/include/linux/pipe_fs_i.h
---- linux-2.6.32.43/include/linux/pipe_fs_i.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/pipe_fs_i.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/pipe_fs_i.h linux-2.6.32.44/include/linux/pipe_fs_i.h
+--- linux-2.6.32.44/include/linux/pipe_fs_i.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/pipe_fs_i.h 2011-04-17 15:56:46.000000000 -0400
@@ -46,9 +46,9 @@ struct pipe_inode_info {
wait_queue_head_t wait;
unsigned int nrbufs, curbuf;
@@ -60474,9 +60415,9 @@ diff -urNp linux-2.6.32.43/include/linux/pipe_fs_i.h linux-2.6.32.43/include/lin
unsigned int r_counter;
unsigned int w_counter;
struct fasync_struct *fasync_readers;
-diff -urNp linux-2.6.32.43/include/linux/poison.h linux-2.6.32.43/include/linux/poison.h
---- linux-2.6.32.43/include/linux/poison.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/poison.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/poison.h linux-2.6.32.44/include/linux/poison.h
+--- linux-2.6.32.44/include/linux/poison.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/poison.h 2011-04-17 15:56:46.000000000 -0400
@@ -19,8 +19,8 @@
* under normal circumstances, used to verify that nobody uses
* non-initialized list entries.
@@ -60488,9 +60429,9 @@ diff -urNp linux-2.6.32.43/include/linux/poison.h linux-2.6.32.43/include/linux/
/********** include/linux/timer.h **********/
/*
-diff -urNp linux-2.6.32.43/include/linux/posix-timers.h linux-2.6.32.43/include/linux/posix-timers.h
---- linux-2.6.32.43/include/linux/posix-timers.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/posix-timers.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/posix-timers.h linux-2.6.32.44/include/linux/posix-timers.h
+--- linux-2.6.32.44/include/linux/posix-timers.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/posix-timers.h 2011-08-05 20:33:55.000000000 -0400
@@ -67,7 +67,7 @@ struct k_itimer {
};
@@ -60500,9 +60441,9 @@ diff -urNp linux-2.6.32.43/include/linux/posix-timers.h linux-2.6.32.43/include/
int (*clock_getres) (const clockid_t which_clock, struct timespec *tp);
int (*clock_set) (const clockid_t which_clock, struct timespec * tp);
int (*clock_get) (const clockid_t which_clock, struct timespec * tp);
-diff -urNp linux-2.6.32.43/include/linux/preempt.h linux-2.6.32.43/include/linux/preempt.h
---- linux-2.6.32.43/include/linux/preempt.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/preempt.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/preempt.h linux-2.6.32.44/include/linux/preempt.h
+--- linux-2.6.32.44/include/linux/preempt.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/preempt.h 2011-08-05 20:33:55.000000000 -0400
@@ -110,7 +110,7 @@ struct preempt_ops {
void (*sched_in)(struct preempt_notifier *notifier, int cpu);
void (*sched_out)(struct preempt_notifier *notifier,
@@ -60512,9 +60453,9 @@ diff -urNp linux-2.6.32.43/include/linux/preempt.h linux-2.6.32.43/include/linux
/**
* preempt_notifier - key for installing preemption notifiers
-diff -urNp linux-2.6.32.43/include/linux/proc_fs.h linux-2.6.32.43/include/linux/proc_fs.h
---- linux-2.6.32.43/include/linux/proc_fs.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/proc_fs.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/proc_fs.h linux-2.6.32.44/include/linux/proc_fs.h
+--- linux-2.6.32.44/include/linux/proc_fs.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/proc_fs.h 2011-08-05 20:33:55.000000000 -0400
@@ -155,6 +155,19 @@ static inline struct proc_dir_entry *pro
return proc_create_data(name, mode, parent, proc_fops, NULL);
}
@@ -60544,9 +60485,9 @@ diff -urNp linux-2.6.32.43/include/linux/proc_fs.h linux-2.6.32.43/include/linux
struct ctl_table_header;
struct ctl_table;
-diff -urNp linux-2.6.32.43/include/linux/ptrace.h linux-2.6.32.43/include/linux/ptrace.h
---- linux-2.6.32.43/include/linux/ptrace.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/ptrace.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/ptrace.h linux-2.6.32.44/include/linux/ptrace.h
+--- linux-2.6.32.44/include/linux/ptrace.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/ptrace.h 2011-04-17 15:56:46.000000000 -0400
@@ -96,10 +96,10 @@ extern void __ptrace_unlink(struct task_
extern void exit_ptrace(struct task_struct *tracer);
#define PTRACE_MODE_READ 1
@@ -60560,9 +60501,9 @@ diff -urNp linux-2.6.32.43/include/linux/ptrace.h linux-2.6.32.43/include/linux/
static inline int ptrace_reparented(struct task_struct *child)
{
-diff -urNp linux-2.6.32.43/include/linux/random.h linux-2.6.32.43/include/linux/random.h
---- linux-2.6.32.43/include/linux/random.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/random.h 2011-08-07 19:48:09.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/random.h linux-2.6.32.44/include/linux/random.h
+--- linux-2.6.32.44/include/linux/random.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/random.h 2011-08-07 19:48:09.000000000 -0400
@@ -53,17 +53,6 @@ extern void add_interrupt_randomness(int
extern void get_random_bytes(void *buf, int nbytes);
void generate_random_uuid(unsigned char uuid_out[16]);
@@ -60593,9 +60534,9 @@ diff -urNp linux-2.6.32.43/include/linux/random.h linux-2.6.32.43/include/linux/
#endif /* __KERNEL___ */
#endif /* _LINUX_RANDOM_H */
-diff -urNp linux-2.6.32.43/include/linux/reboot.h linux-2.6.32.43/include/linux/reboot.h
---- linux-2.6.32.43/include/linux/reboot.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/reboot.h 2011-05-22 23:02:06.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/reboot.h linux-2.6.32.44/include/linux/reboot.h
+--- linux-2.6.32.44/include/linux/reboot.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/reboot.h 2011-05-22 23:02:06.000000000 -0400
@@ -47,9 +47,9 @@ extern int unregister_reboot_notifier(st
* Architecture-specific implementations of sys_reboot commands.
*/
@@ -60631,9 +60572,9 @@ diff -urNp linux-2.6.32.43/include/linux/reboot.h linux-2.6.32.43/include/linux/
#include <asm/emergency-restart.h>
#endif
-diff -urNp linux-2.6.32.43/include/linux/reiserfs_fs.h linux-2.6.32.43/include/linux/reiserfs_fs.h
---- linux-2.6.32.43/include/linux/reiserfs_fs.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/reiserfs_fs.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/reiserfs_fs.h linux-2.6.32.44/include/linux/reiserfs_fs.h
+--- linux-2.6.32.44/include/linux/reiserfs_fs.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/reiserfs_fs.h 2011-04-17 15:56:46.000000000 -0400
@@ -1326,7 +1326,7 @@ static inline loff_t max_reiserfs_offset
#define REISERFS_USER_MEM 1 /* reiserfs user memory mode */
@@ -60680,9 +60621,9 @@ diff -urNp linux-2.6.32.43/include/linux/reiserfs_fs.h linux-2.6.32.43/include/l
#define op_bytes_number(ih,bsize) item_ops[le_ih_k_type (ih)]->bytes_number (ih, bsize)
#define op_is_left_mergeable(key,bsize) item_ops[le_key_k_type (le_key_version (key), key)]->is_left_mergeable (key, bsize)
-diff -urNp linux-2.6.32.43/include/linux/reiserfs_fs_sb.h linux-2.6.32.43/include/linux/reiserfs_fs_sb.h
---- linux-2.6.32.43/include/linux/reiserfs_fs_sb.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/reiserfs_fs_sb.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/reiserfs_fs_sb.h linux-2.6.32.44/include/linux/reiserfs_fs_sb.h
+--- linux-2.6.32.44/include/linux/reiserfs_fs_sb.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/reiserfs_fs_sb.h 2011-04-17 15:56:46.000000000 -0400
@@ -377,7 +377,7 @@ struct reiserfs_sb_info {
/* Comment? -Hans */
wait_queue_head_t s_wait;
@@ -60692,9 +60633,9 @@ diff -urNp linux-2.6.32.43/include/linux/reiserfs_fs_sb.h linux-2.6.32.43/includ
// tree gets re-balanced
unsigned long s_properties; /* File system properties. Currently holds
on-disk FS format */
-diff -urNp linux-2.6.32.43/include/linux/relay.h linux-2.6.32.43/include/linux/relay.h
---- linux-2.6.32.43/include/linux/relay.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/relay.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/relay.h linux-2.6.32.44/include/linux/relay.h
+--- linux-2.6.32.44/include/linux/relay.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/relay.h 2011-08-05 20:33:55.000000000 -0400
@@ -159,7 +159,7 @@ struct rchan_callbacks
* The callback should return 0 if successful, negative if not.
*/
@@ -60704,9 +60645,9 @@ diff -urNp linux-2.6.32.43/include/linux/relay.h linux-2.6.32.43/include/linux/r
/*
* CONFIG_RELAY kernel API, kernel/relay.c
-diff -urNp linux-2.6.32.43/include/linux/sched.h linux-2.6.32.43/include/linux/sched.h
---- linux-2.6.32.43/include/linux/sched.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/sched.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/sched.h linux-2.6.32.44/include/linux/sched.h
+--- linux-2.6.32.44/include/linux/sched.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/sched.h 2011-08-11 19:48:55.000000000 -0400
@@ -101,6 +101,7 @@ struct bio;
struct fs_struct;
struct bts_context;
@@ -60911,6 +60852,15 @@ diff -urNp linux-2.6.32.43/include/linux/sched.h linux-2.6.32.43/include/linux/s
/* Future-safe accessor for struct task_struct's cpus_allowed. */
#define tsk_cpumask(tsk) (&(tsk)->cpus_allowed)
+@@ -1740,7 +1831,7 @@ extern void thread_group_times(struct ta
+ #define PF_DUMPCORE 0x00000200 /* dumped core */
+ #define PF_SIGNALED 0x00000400 /* killed by a signal */
+ #define PF_MEMALLOC 0x00000800 /* Allocating memory */
+-#define PF_FLUSHER 0x00001000 /* responsible for disk writeback */
++#define PF_NPROC_EXCEEDED 0x00001000 /* set_user noticed that RLIMIT_NPROC was exceeded */
+ #define PF_USED_MATH 0x00002000 /* if unset the fpu must be initialized before use */
+ #define PF_FREEZING 0x00004000 /* freeze in progress. do not account to load */
+ #define PF_NOFREEZE 0x00008000 /* this thread should not be frozen */
@@ -1978,7 +2069,9 @@ void yield(void);
extern struct exec_domain default_exec_domain;
@@ -60958,9 +60908,9 @@ diff -urNp linux-2.6.32.43/include/linux/sched.h linux-2.6.32.43/include/linux/s
extern void thread_info_cache_init(void);
#ifdef CONFIG_DEBUG_STACK_USAGE
-diff -urNp linux-2.6.32.43/include/linux/screen_info.h linux-2.6.32.43/include/linux/screen_info.h
---- linux-2.6.32.43/include/linux/screen_info.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/screen_info.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/screen_info.h linux-2.6.32.44/include/linux/screen_info.h
+--- linux-2.6.32.44/include/linux/screen_info.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/screen_info.h 2011-04-17 15:56:46.000000000 -0400
@@ -42,7 +42,8 @@ struct screen_info {
__u16 pages; /* 0x32 */
__u16 vesa_attributes; /* 0x34 */
@@ -60971,9 +60921,9 @@ diff -urNp linux-2.6.32.43/include/linux/screen_info.h linux-2.6.32.43/include/l
} __attribute__((packed));
#define VIDEO_TYPE_MDA 0x10 /* Monochrome Text Display */
-diff -urNp linux-2.6.32.43/include/linux/security.h linux-2.6.32.43/include/linux/security.h
---- linux-2.6.32.43/include/linux/security.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/security.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/security.h linux-2.6.32.44/include/linux/security.h
+--- linux-2.6.32.44/include/linux/security.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/security.h 2011-04-17 15:56:46.000000000 -0400
@@ -34,6 +34,7 @@
#include <linux/key.h>
#include <linux/xfrm.h>
@@ -60982,9 +60932,9 @@ diff -urNp linux-2.6.32.43/include/linux/security.h linux-2.6.32.43/include/linu
#include <net/flow.h>
/* Maximum number of letters for an LSM name string */
-diff -urNp linux-2.6.32.43/include/linux/shm.h linux-2.6.32.43/include/linux/shm.h
---- linux-2.6.32.43/include/linux/shm.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/shm.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/shm.h linux-2.6.32.44/include/linux/shm.h
+--- linux-2.6.32.44/include/linux/shm.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/shm.h 2011-04-17 15:56:46.000000000 -0400
@@ -95,6 +95,10 @@ struct shmid_kernel /* private to the ke
pid_t shm_cprid;
pid_t shm_lprid;
@@ -60996,9 +60946,9 @@ diff -urNp linux-2.6.32.43/include/linux/shm.h linux-2.6.32.43/include/linux/shm
};
/* shm_mode upper byte flags */
-diff -urNp linux-2.6.32.43/include/linux/skbuff.h linux-2.6.32.43/include/linux/skbuff.h
---- linux-2.6.32.43/include/linux/skbuff.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/skbuff.h 2011-07-06 19:53:33.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/skbuff.h linux-2.6.32.44/include/linux/skbuff.h
+--- linux-2.6.32.44/include/linux/skbuff.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/skbuff.h 2011-07-06 19:53:33.000000000 -0400
@@ -544,7 +544,7 @@ static inline union skb_shared_tx *skb_t
*/
static inline int skb_queue_empty(const struct sk_buff_head *list)
@@ -61035,9 +60985,9 @@ diff -urNp linux-2.6.32.43/include/linux/skbuff.h linux-2.6.32.43/include/linux/
#endif
extern int ___pskb_trim(struct sk_buff *skb, unsigned int len);
-diff -urNp linux-2.6.32.43/include/linux/slab_def.h linux-2.6.32.43/include/linux/slab_def.h
---- linux-2.6.32.43/include/linux/slab_def.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/slab_def.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/slab_def.h linux-2.6.32.44/include/linux/slab_def.h
+--- linux-2.6.32.44/include/linux/slab_def.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/slab_def.h 2011-05-04 17:56:28.000000000 -0400
@@ -69,10 +69,10 @@ struct kmem_cache {
unsigned long node_allocs;
unsigned long node_frees;
@@ -61053,9 +61003,9 @@ diff -urNp linux-2.6.32.43/include/linux/slab_def.h linux-2.6.32.43/include/linu
/*
* If debugging is enabled, then the allocator can add additional
-diff -urNp linux-2.6.32.43/include/linux/slab.h linux-2.6.32.43/include/linux/slab.h
---- linux-2.6.32.43/include/linux/slab.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/slab.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/slab.h linux-2.6.32.44/include/linux/slab.h
+--- linux-2.6.32.44/include/linux/slab.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/slab.h 2011-04-17 15:56:46.000000000 -0400
@@ -11,12 +11,20 @@
#include <linux/gfp.h>
@@ -61140,9 +61090,9 @@ diff -urNp linux-2.6.32.43/include/linux/slab.h linux-2.6.32.43/include/linux/sl
+})
+
#endif /* _LINUX_SLAB_H */
-diff -urNp linux-2.6.32.43/include/linux/slub_def.h linux-2.6.32.43/include/linux/slub_def.h
---- linux-2.6.32.43/include/linux/slub_def.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/slub_def.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/slub_def.h linux-2.6.32.44/include/linux/slub_def.h
+--- linux-2.6.32.44/include/linux/slub_def.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/slub_def.h 2011-08-05 20:33:55.000000000 -0400
@@ -86,7 +86,7 @@ struct kmem_cache {
struct kmem_cache_order_objects max;
struct kmem_cache_order_objects min;
@@ -61161,9 +61111,9 @@ diff -urNp linux-2.6.32.43/include/linux/slub_def.h linux-2.6.32.43/include/linu
#ifdef CONFIG_KMEMTRACE
extern void *kmem_cache_alloc_notrace(struct kmem_cache *s, gfp_t gfpflags);
-diff -urNp linux-2.6.32.43/include/linux/sonet.h linux-2.6.32.43/include/linux/sonet.h
---- linux-2.6.32.43/include/linux/sonet.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/sonet.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/sonet.h linux-2.6.32.44/include/linux/sonet.h
+--- linux-2.6.32.44/include/linux/sonet.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/sonet.h 2011-04-17 15:56:46.000000000 -0400
@@ -61,7 +61,7 @@ struct sonet_stats {
#include <asm/atomic.h>
@@ -61173,9 +61123,9 @@ diff -urNp linux-2.6.32.43/include/linux/sonet.h linux-2.6.32.43/include/linux/s
__SONET_ITEMS
#undef __HANDLE_ITEM
};
-diff -urNp linux-2.6.32.43/include/linux/sunrpc/cache.h linux-2.6.32.43/include/linux/sunrpc/cache.h
---- linux-2.6.32.43/include/linux/sunrpc/cache.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/sunrpc/cache.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/sunrpc/cache.h linux-2.6.32.44/include/linux/sunrpc/cache.h
+--- linux-2.6.32.44/include/linux/sunrpc/cache.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/sunrpc/cache.h 2011-08-05 20:33:55.000000000 -0400
@@ -125,7 +125,7 @@ struct cache_detail {
*/
struct cache_req {
@@ -61185,9 +61135,9 @@ diff -urNp linux-2.6.32.43/include/linux/sunrpc/cache.h linux-2.6.32.43/include/
/* this must be embedded in a deferred_request that is being
* delayed awaiting cache-fill
*/
-diff -urNp linux-2.6.32.43/include/linux/sunrpc/clnt.h linux-2.6.32.43/include/linux/sunrpc/clnt.h
---- linux-2.6.32.43/include/linux/sunrpc/clnt.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/sunrpc/clnt.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/sunrpc/clnt.h linux-2.6.32.44/include/linux/sunrpc/clnt.h
+--- linux-2.6.32.44/include/linux/sunrpc/clnt.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/sunrpc/clnt.h 2011-04-17 15:56:46.000000000 -0400
@@ -167,9 +167,9 @@ static inline unsigned short rpc_get_por
{
switch (sap->sa_family) {
@@ -61218,9 +61168,9 @@ diff -urNp linux-2.6.32.43/include/linux/sunrpc/clnt.h linux-2.6.32.43/include/l
}
#endif /* __KERNEL__ */
-diff -urNp linux-2.6.32.43/include/linux/sunrpc/svc_rdma.h linux-2.6.32.43/include/linux/sunrpc/svc_rdma.h
---- linux-2.6.32.43/include/linux/sunrpc/svc_rdma.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/sunrpc/svc_rdma.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/sunrpc/svc_rdma.h linux-2.6.32.44/include/linux/sunrpc/svc_rdma.h
+--- linux-2.6.32.44/include/linux/sunrpc/svc_rdma.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/sunrpc/svc_rdma.h 2011-05-04 17:56:28.000000000 -0400
@@ -53,15 +53,15 @@ extern unsigned int svcrdma_ord;
extern unsigned int svcrdma_max_requests;
extern unsigned int svcrdma_max_req_size;
@@ -61246,9 +61196,9 @@ diff -urNp linux-2.6.32.43/include/linux/sunrpc/svc_rdma.h linux-2.6.32.43/inclu
#define RPCRDMA_VERSION 1
-diff -urNp linux-2.6.32.43/include/linux/suspend.h linux-2.6.32.43/include/linux/suspend.h
---- linux-2.6.32.43/include/linux/suspend.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/suspend.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/suspend.h linux-2.6.32.44/include/linux/suspend.h
+--- linux-2.6.32.44/include/linux/suspend.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/suspend.h 2011-04-17 15:56:46.000000000 -0400
@@ -104,15 +104,15 @@ typedef int __bitwise suspend_state_t;
* which require special recovery actions in that situation.
*/
@@ -61337,9 +61287,9 @@ diff -urNp linux-2.6.32.43/include/linux/suspend.h linux-2.6.32.43/include/linux
static inline int hibernate(void) { return -ENOSYS; }
static inline bool system_entering_hibernation(void) { return false; }
#endif /* CONFIG_HIBERNATION */
-diff -urNp linux-2.6.32.43/include/linux/sysctl.h linux-2.6.32.43/include/linux/sysctl.h
---- linux-2.6.32.43/include/linux/sysctl.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/sysctl.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/sysctl.h linux-2.6.32.44/include/linux/sysctl.h
+--- linux-2.6.32.44/include/linux/sysctl.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/sysctl.h 2011-04-17 15:56:46.000000000 -0400
@@ -164,7 +164,11 @@ enum
KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
};
@@ -61370,9 +61320,9 @@ diff -urNp linux-2.6.32.43/include/linux/sysctl.h linux-2.6.32.43/include/linux/
extern ctl_handler sysctl_intvec;
extern ctl_handler sysctl_jiffies;
extern ctl_handler sysctl_ms_jiffies;
-diff -urNp linux-2.6.32.43/include/linux/sysfs.h linux-2.6.32.43/include/linux/sysfs.h
---- linux-2.6.32.43/include/linux/sysfs.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/sysfs.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/sysfs.h linux-2.6.32.44/include/linux/sysfs.h
+--- linux-2.6.32.44/include/linux/sysfs.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/sysfs.h 2011-04-17 15:56:46.000000000 -0400
@@ -75,8 +75,8 @@ struct bin_attribute {
};
@@ -61384,9 +61334,9 @@ diff -urNp linux-2.6.32.43/include/linux/sysfs.h linux-2.6.32.43/include/linux/s
};
struct sysfs_dirent;
-diff -urNp linux-2.6.32.43/include/linux/thread_info.h linux-2.6.32.43/include/linux/thread_info.h
---- linux-2.6.32.43/include/linux/thread_info.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/thread_info.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/thread_info.h linux-2.6.32.44/include/linux/thread_info.h
+--- linux-2.6.32.44/include/linux/thread_info.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/thread_info.h 2011-04-17 15:56:46.000000000 -0400
@@ -23,7 +23,7 @@ struct restart_block {
};
/* For futex_wait and futex_wait_requeue_pi */
@@ -61396,9 +61346,9 @@ diff -urNp linux-2.6.32.43/include/linux/thread_info.h linux-2.6.32.43/include/l
u32 val;
u32 flags;
u32 bitset;
-diff -urNp linux-2.6.32.43/include/linux/tty.h linux-2.6.32.43/include/linux/tty.h
---- linux-2.6.32.43/include/linux/tty.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/tty.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/tty.h linux-2.6.32.44/include/linux/tty.h
+--- linux-2.6.32.44/include/linux/tty.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/tty.h 2011-08-05 20:33:55.000000000 -0400
@@ -493,7 +493,6 @@ extern void tty_ldisc_begin(void);
/* This last one is just for the tty layer internals and shouldn't be used elsewhere */
extern void tty_ldisc_enable(struct tty_struct *tty);
@@ -61407,9 +61357,9 @@ diff -urNp linux-2.6.32.43/include/linux/tty.h linux-2.6.32.43/include/linux/tty
/* n_tty.c */
extern struct tty_ldisc_ops tty_ldisc_N_TTY;
-diff -urNp linux-2.6.32.43/include/linux/tty_ldisc.h linux-2.6.32.43/include/linux/tty_ldisc.h
---- linux-2.6.32.43/include/linux/tty_ldisc.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/tty_ldisc.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/tty_ldisc.h linux-2.6.32.44/include/linux/tty_ldisc.h
+--- linux-2.6.32.44/include/linux/tty_ldisc.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/tty_ldisc.h 2011-04-17 15:56:46.000000000 -0400
@@ -139,7 +139,7 @@ struct tty_ldisc_ops {
struct module *owner;
@@ -61419,9 +61369,9 @@ diff -urNp linux-2.6.32.43/include/linux/tty_ldisc.h linux-2.6.32.43/include/lin
};
struct tty_ldisc {
-diff -urNp linux-2.6.32.43/include/linux/types.h linux-2.6.32.43/include/linux/types.h
---- linux-2.6.32.43/include/linux/types.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/types.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/types.h linux-2.6.32.44/include/linux/types.h
+--- linux-2.6.32.44/include/linux/types.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/types.h 2011-04-17 15:56:46.000000000 -0400
@@ -191,10 +191,26 @@ typedef struct {
volatile int counter;
} atomic_t;
@@ -61449,9 +61399,9 @@ diff -urNp linux-2.6.32.43/include/linux/types.h linux-2.6.32.43/include/linux/t
#endif
struct ustat {
-diff -urNp linux-2.6.32.43/include/linux/uaccess.h linux-2.6.32.43/include/linux/uaccess.h
---- linux-2.6.32.43/include/linux/uaccess.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/uaccess.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/uaccess.h linux-2.6.32.44/include/linux/uaccess.h
+--- linux-2.6.32.44/include/linux/uaccess.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/uaccess.h 2011-04-17 15:56:46.000000000 -0400
@@ -76,11 +76,11 @@ static inline unsigned long __copy_from_
long ret; \
mm_segment_t old_fs = get_fs(); \
@@ -61483,9 +61433,9 @@ diff -urNp linux-2.6.32.43/include/linux/uaccess.h linux-2.6.32.43/include/linux
+extern long probe_kernel_write(void *dst, const void *src, size_t size);
#endif /* __LINUX_UACCESS_H__ */
-diff -urNp linux-2.6.32.43/include/linux/unaligned/access_ok.h linux-2.6.32.43/include/linux/unaligned/access_ok.h
---- linux-2.6.32.43/include/linux/unaligned/access_ok.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/unaligned/access_ok.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/unaligned/access_ok.h linux-2.6.32.44/include/linux/unaligned/access_ok.h
+--- linux-2.6.32.44/include/linux/unaligned/access_ok.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/unaligned/access_ok.h 2011-04-17 15:56:46.000000000 -0400
@@ -6,32 +6,32 @@
static inline u16 get_unaligned_le16(const void *p)
@@ -61525,9 +61475,9 @@ diff -urNp linux-2.6.32.43/include/linux/unaligned/access_ok.h linux-2.6.32.43/i
}
static inline void put_unaligned_le16(u16 val, void *p)
-diff -urNp linux-2.6.32.43/include/linux/vmalloc.h linux-2.6.32.43/include/linux/vmalloc.h
---- linux-2.6.32.43/include/linux/vmalloc.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/vmalloc.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/vmalloc.h linux-2.6.32.44/include/linux/vmalloc.h
+--- linux-2.6.32.44/include/linux/vmalloc.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/vmalloc.h 2011-04-17 15:56:46.000000000 -0400
@@ -13,6 +13,11 @@ struct vm_area_struct; /* vma defining
#define VM_MAP 0x00000004 /* vmap()ed pages */
#define VM_USERMAP 0x00000008 /* suitable for remap_vmalloc_range */
@@ -61622,9 +61572,9 @@ diff -urNp linux-2.6.32.43/include/linux/vmalloc.h linux-2.6.32.43/include/linux
+})
+
#endif /* _LINUX_VMALLOC_H */
-diff -urNp linux-2.6.32.43/include/linux/vmstat.h linux-2.6.32.43/include/linux/vmstat.h
---- linux-2.6.32.43/include/linux/vmstat.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/linux/vmstat.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/linux/vmstat.h linux-2.6.32.44/include/linux/vmstat.h
+--- linux-2.6.32.44/include/linux/vmstat.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/linux/vmstat.h 2011-04-17 15:56:46.000000000 -0400
@@ -136,18 +136,18 @@ static inline void vm_events_fold_cpu(in
/*
* Zone based page accounting with per cpu differentials.
@@ -61688,9 +61638,9 @@ diff -urNp linux-2.6.32.43/include/linux/vmstat.h linux-2.6.32.43/include/linux/
}
static inline void __dec_zone_page_state(struct page *page,
-diff -urNp linux-2.6.32.43/include/media/v4l2-dev.h linux-2.6.32.43/include/media/v4l2-dev.h
---- linux-2.6.32.43/include/media/v4l2-dev.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/media/v4l2-dev.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/include/media/v4l2-dev.h linux-2.6.32.44/include/media/v4l2-dev.h
+--- linux-2.6.32.44/include/media/v4l2-dev.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/media/v4l2-dev.h 2011-08-05 20:33:55.000000000 -0400
@@ -34,7 +34,7 @@ struct v4l2_device;
#define V4L2_FL_UNREGISTERED (0)
@@ -61700,9 +61650,9 @@ diff -urNp linux-2.6.32.43/include/media/v4l2-dev.h linux-2.6.32.43/include/medi
ssize_t (*read) (struct file *, char __user *, size_t, loff_t *);
ssize_t (*write) (struct file *, const char __user *, size_t, loff_t *);
unsigned int (*poll) (struct file *, struct poll_table_struct *);
-diff -urNp linux-2.6.32.43/include/media/v4l2-device.h linux-2.6.32.43/include/media/v4l2-device.h
---- linux-2.6.32.43/include/media/v4l2-device.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/media/v4l2-device.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/include/media/v4l2-device.h linux-2.6.32.44/include/media/v4l2-device.h
+--- linux-2.6.32.44/include/media/v4l2-device.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/media/v4l2-device.h 2011-05-04 17:56:28.000000000 -0400
@@ -71,7 +71,7 @@ int __must_check v4l2_device_register(st
this function returns 0. If the name ends with a digit (e.g. cx18),
then the name will be set to cx18-0 since cx180 looks really odd. */
@@ -61712,9 +61662,9 @@ diff -urNp linux-2.6.32.43/include/media/v4l2-device.h linux-2.6.32.43/include/m
/* Set v4l2_dev->dev to NULL. Call when the USB parent disconnects.
Since the parent disappears this ensures that v4l2_dev doesn't have an
-diff -urNp linux-2.6.32.43/include/net/flow.h linux-2.6.32.43/include/net/flow.h
---- linux-2.6.32.43/include/net/flow.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/net/flow.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/include/net/flow.h linux-2.6.32.44/include/net/flow.h
+--- linux-2.6.32.44/include/net/flow.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/net/flow.h 2011-05-04 17:56:28.000000000 -0400
@@ -92,7 +92,7 @@ typedef int (*flow_resolve_t)(struct net
extern void *flow_cache_lookup(struct net *net, struct flowi *key, u16 family,
u8 dir, flow_resolve_t resolver);
@@ -61724,9 +61674,9 @@ diff -urNp linux-2.6.32.43/include/net/flow.h linux-2.6.32.43/include/net/flow.h
static inline int flow_cache_uli_match(struct flowi *fl1, struct flowi *fl2)
{
-diff -urNp linux-2.6.32.43/include/net/inetpeer.h linux-2.6.32.43/include/net/inetpeer.h
---- linux-2.6.32.43/include/net/inetpeer.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/net/inetpeer.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/net/inetpeer.h linux-2.6.32.44/include/net/inetpeer.h
+--- linux-2.6.32.44/include/net/inetpeer.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/net/inetpeer.h 2011-04-17 15:56:46.000000000 -0400
@@ -24,7 +24,7 @@ struct inet_peer
__u32 dtime; /* the time of last use of not
* referenced entries */
@@ -61736,9 +61686,9 @@ diff -urNp linux-2.6.32.43/include/net/inetpeer.h linux-2.6.32.43/include/net/in
__u32 tcp_ts;
unsigned long tcp_ts_stamp;
};
-diff -urNp linux-2.6.32.43/include/net/ip_vs.h linux-2.6.32.43/include/net/ip_vs.h
---- linux-2.6.32.43/include/net/ip_vs.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/net/ip_vs.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/include/net/ip_vs.h linux-2.6.32.44/include/net/ip_vs.h
+--- linux-2.6.32.44/include/net/ip_vs.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/net/ip_vs.h 2011-05-04 17:56:28.000000000 -0400
@@ -365,7 +365,7 @@ struct ip_vs_conn {
struct ip_vs_conn *control; /* Master control connection */
atomic_t n_control; /* Number of controlled ones */
@@ -61757,9 +61707,9 @@ diff -urNp linux-2.6.32.43/include/net/ip_vs.h linux-2.6.32.43/include/net/ip_vs
atomic_t weight; /* server weight */
atomic_t refcnt; /* reference counter */
-diff -urNp linux-2.6.32.43/include/net/irda/ircomm_core.h linux-2.6.32.43/include/net/irda/ircomm_core.h
---- linux-2.6.32.43/include/net/irda/ircomm_core.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/net/irda/ircomm_core.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/include/net/irda/ircomm_core.h linux-2.6.32.44/include/net/irda/ircomm_core.h
+--- linux-2.6.32.44/include/net/irda/ircomm_core.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/net/irda/ircomm_core.h 2011-08-05 20:33:55.000000000 -0400
@@ -51,7 +51,7 @@ typedef struct {
int (*connect_response)(struct ircomm_cb *, struct sk_buff *);
int (*disconnect_request)(struct ircomm_cb *, struct sk_buff *,
@@ -61769,9 +61719,9 @@ diff -urNp linux-2.6.32.43/include/net/irda/ircomm_core.h linux-2.6.32.43/includ
struct ircomm_cb {
irda_queue_t queue;
-diff -urNp linux-2.6.32.43/include/net/irda/ircomm_tty.h linux-2.6.32.43/include/net/irda/ircomm_tty.h
---- linux-2.6.32.43/include/net/irda/ircomm_tty.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/net/irda/ircomm_tty.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/net/irda/ircomm_tty.h linux-2.6.32.44/include/net/irda/ircomm_tty.h
+--- linux-2.6.32.44/include/net/irda/ircomm_tty.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/net/irda/ircomm_tty.h 2011-04-17 15:56:46.000000000 -0400
@@ -35,6 +35,7 @@
#include <linux/termios.h>
#include <linux/timer.h>
@@ -61791,9 +61741,9 @@ diff -urNp linux-2.6.32.43/include/net/irda/ircomm_tty.h linux-2.6.32.43/include
/* Protect concurent access to :
* o self->open_count
-diff -urNp linux-2.6.32.43/include/net/iucv/af_iucv.h linux-2.6.32.43/include/net/iucv/af_iucv.h
---- linux-2.6.32.43/include/net/iucv/af_iucv.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/net/iucv/af_iucv.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/include/net/iucv/af_iucv.h linux-2.6.32.44/include/net/iucv/af_iucv.h
+--- linux-2.6.32.44/include/net/iucv/af_iucv.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/net/iucv/af_iucv.h 2011-05-04 17:56:28.000000000 -0400
@@ -87,7 +87,7 @@ struct iucv_sock {
struct iucv_sock_list {
struct hlist_head head;
@@ -61803,9 +61753,9 @@ diff -urNp linux-2.6.32.43/include/net/iucv/af_iucv.h linux-2.6.32.43/include/ne
};
unsigned int iucv_sock_poll(struct file *file, struct socket *sock,
-diff -urNp linux-2.6.32.43/include/net/lapb.h linux-2.6.32.43/include/net/lapb.h
---- linux-2.6.32.43/include/net/lapb.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/net/lapb.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/include/net/lapb.h linux-2.6.32.44/include/net/lapb.h
+--- linux-2.6.32.44/include/net/lapb.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/net/lapb.h 2011-08-05 20:33:55.000000000 -0400
@@ -95,7 +95,7 @@ struct lapb_cb {
struct sk_buff_head write_queue;
struct sk_buff_head ack_queue;
@@ -61815,9 +61765,9 @@ diff -urNp linux-2.6.32.43/include/net/lapb.h linux-2.6.32.43/include/net/lapb.h
/* FRMR control information */
struct lapb_frame frmr_data;
-diff -urNp linux-2.6.32.43/include/net/neighbour.h linux-2.6.32.43/include/net/neighbour.h
---- linux-2.6.32.43/include/net/neighbour.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/net/neighbour.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/net/neighbour.h linux-2.6.32.44/include/net/neighbour.h
+--- linux-2.6.32.44/include/net/neighbour.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/net/neighbour.h 2011-04-17 15:56:46.000000000 -0400
@@ -125,12 +125,12 @@ struct neighbour
struct neigh_ops
{
@@ -61837,9 +61787,9 @@ diff -urNp linux-2.6.32.43/include/net/neighbour.h linux-2.6.32.43/include/net/n
};
struct pneigh_entry
-diff -urNp linux-2.6.32.43/include/net/netlink.h linux-2.6.32.43/include/net/netlink.h
---- linux-2.6.32.43/include/net/netlink.h 2011-07-13 17:23:04.000000000 -0400
-+++ linux-2.6.32.43/include/net/netlink.h 2011-07-13 17:23:19.000000000 -0400
+diff -urNp linux-2.6.32.44/include/net/netlink.h linux-2.6.32.44/include/net/netlink.h
+--- linux-2.6.32.44/include/net/netlink.h 2011-07-13 17:23:04.000000000 -0400
++++ linux-2.6.32.44/include/net/netlink.h 2011-07-13 17:23:19.000000000 -0400
@@ -558,7 +558,7 @@ static inline void *nlmsg_get_pos(struct
static inline void nlmsg_trim(struct sk_buff *skb, const void *mark)
{
@@ -61849,9 +61799,9 @@ diff -urNp linux-2.6.32.43/include/net/netlink.h linux-2.6.32.43/include/net/net
}
/**
-diff -urNp linux-2.6.32.43/include/net/netns/ipv4.h linux-2.6.32.43/include/net/netns/ipv4.h
---- linux-2.6.32.43/include/net/netns/ipv4.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/net/netns/ipv4.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/include/net/netns/ipv4.h linux-2.6.32.44/include/net/netns/ipv4.h
+--- linux-2.6.32.44/include/net/netns/ipv4.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/net/netns/ipv4.h 2011-05-04 17:56:28.000000000 -0400
@@ -54,7 +54,7 @@ struct netns_ipv4 {
int current_rt_cache_rebuild_count;
@@ -61861,9 +61811,9 @@ diff -urNp linux-2.6.32.43/include/net/netns/ipv4.h linux-2.6.32.43/include/net/
#ifdef CONFIG_IP_MROUTE
struct sock *mroute_sk;
-diff -urNp linux-2.6.32.43/include/net/sctp/sctp.h linux-2.6.32.43/include/net/sctp/sctp.h
---- linux-2.6.32.43/include/net/sctp/sctp.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/net/sctp/sctp.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/net/sctp/sctp.h linux-2.6.32.44/include/net/sctp/sctp.h
+--- linux-2.6.32.44/include/net/sctp/sctp.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/net/sctp/sctp.h 2011-04-17 15:56:46.000000000 -0400
@@ -305,8 +305,8 @@ extern int sctp_debug_flag;
#else /* SCTP_DEBUG */
@@ -61875,9 +61825,9 @@ diff -urNp linux-2.6.32.43/include/net/sctp/sctp.h linux-2.6.32.43/include/net/s
#define SCTP_ENABLE_DEBUG
#define SCTP_DISABLE_DEBUG
#define SCTP_ASSERT(expr, str, func)
-diff -urNp linux-2.6.32.43/include/net/secure_seq.h linux-2.6.32.43/include/net/secure_seq.h
---- linux-2.6.32.43/include/net/secure_seq.h 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/include/net/secure_seq.h 2011-08-07 19:48:09.000000000 -0400
+diff -urNp linux-2.6.32.44/include/net/secure_seq.h linux-2.6.32.44/include/net/secure_seq.h
+--- linux-2.6.32.44/include/net/secure_seq.h 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/include/net/secure_seq.h 2011-08-07 19:48:09.000000000 -0400
@@ -0,0 +1,20 @@
+#ifndef _NET_SECURE_SEQ
+#define _NET_SECURE_SEQ
@@ -61899,9 +61849,9 @@ diff -urNp linux-2.6.32.43/include/net/secure_seq.h linux-2.6.32.43/include/net/
+ __be16 sport, __be16 dport);
+
+#endif /* _NET_SECURE_SEQ */
-diff -urNp linux-2.6.32.43/include/net/sock.h linux-2.6.32.43/include/net/sock.h
---- linux-2.6.32.43/include/net/sock.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/net/sock.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/include/net/sock.h linux-2.6.32.44/include/net/sock.h
+--- linux-2.6.32.44/include/net/sock.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/net/sock.h 2011-05-04 17:56:28.000000000 -0400
@@ -272,7 +272,7 @@ struct sock {
rwlock_t sk_callback_lock;
int sk_err,
@@ -61911,9 +61861,9 @@ diff -urNp linux-2.6.32.43/include/net/sock.h linux-2.6.32.43/include/net/sock.h
unsigned short sk_ack_backlog;
unsigned short sk_max_ack_backlog;
__u32 sk_priority;
-diff -urNp linux-2.6.32.43/include/net/tcp.h linux-2.6.32.43/include/net/tcp.h
---- linux-2.6.32.43/include/net/tcp.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/net/tcp.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/net/tcp.h linux-2.6.32.44/include/net/tcp.h
+--- linux-2.6.32.44/include/net/tcp.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/net/tcp.h 2011-04-17 15:56:46.000000000 -0400
@@ -1444,6 +1444,7 @@ enum tcp_seq_states {
struct tcp_seq_afinfo {
char *name;
@@ -61922,9 +61872,9 @@ diff -urNp linux-2.6.32.43/include/net/tcp.h linux-2.6.32.43/include/net/tcp.h
struct file_operations seq_fops;
struct seq_operations seq_ops;
};
-diff -urNp linux-2.6.32.43/include/net/udp.h linux-2.6.32.43/include/net/udp.h
---- linux-2.6.32.43/include/net/udp.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/net/udp.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/net/udp.h linux-2.6.32.44/include/net/udp.h
+--- linux-2.6.32.44/include/net/udp.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/net/udp.h 2011-04-17 15:56:46.000000000 -0400
@@ -187,6 +187,7 @@ struct udp_seq_afinfo {
char *name;
sa_family_t family;
@@ -61933,9 +61883,9 @@ diff -urNp linux-2.6.32.43/include/net/udp.h linux-2.6.32.43/include/net/udp.h
struct file_operations seq_fops;
struct seq_operations seq_ops;
};
-diff -urNp linux-2.6.32.43/include/rdma/iw_cm.h linux-2.6.32.43/include/rdma/iw_cm.h
---- linux-2.6.32.43/include/rdma/iw_cm.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/rdma/iw_cm.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/include/rdma/iw_cm.h linux-2.6.32.44/include/rdma/iw_cm.h
+--- linux-2.6.32.44/include/rdma/iw_cm.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/rdma/iw_cm.h 2011-08-05 20:33:55.000000000 -0400
@@ -129,7 +129,7 @@ struct iw_cm_verbs {
int backlog);
@@ -61945,9 +61895,9 @@ diff -urNp linux-2.6.32.43/include/rdma/iw_cm.h linux-2.6.32.43/include/rdma/iw_
/**
* iw_create_cm_id - Create an IW CM identifier.
-diff -urNp linux-2.6.32.43/include/scsi/scsi_device.h linux-2.6.32.43/include/scsi/scsi_device.h
---- linux-2.6.32.43/include/scsi/scsi_device.h 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.43/include/scsi/scsi_device.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/include/scsi/scsi_device.h linux-2.6.32.44/include/scsi/scsi_device.h
+--- linux-2.6.32.44/include/scsi/scsi_device.h 2011-04-17 17:00:52.000000000 -0400
++++ linux-2.6.32.44/include/scsi/scsi_device.h 2011-05-04 17:56:28.000000000 -0400
@@ -156,9 +156,9 @@ struct scsi_device {
unsigned int max_device_blocked; /* what device_blocked counts down from */
#define SCSI_DEFAULT_DEVICE_BLOCKED 3
@@ -61961,9 +61911,9 @@ diff -urNp linux-2.6.32.43/include/scsi/scsi_device.h linux-2.6.32.43/include/sc
struct device sdev_gendev,
sdev_dev;
-diff -urNp linux-2.6.32.43/include/scsi/scsi_transport_fc.h linux-2.6.32.43/include/scsi/scsi_transport_fc.h
---- linux-2.6.32.43/include/scsi/scsi_transport_fc.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/scsi/scsi_transport_fc.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/include/scsi/scsi_transport_fc.h linux-2.6.32.44/include/scsi/scsi_transport_fc.h
+--- linux-2.6.32.44/include/scsi/scsi_transport_fc.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/scsi/scsi_transport_fc.h 2011-08-05 20:33:55.000000000 -0400
@@ -663,9 +663,9 @@ struct fc_function_template {
int (*bsg_timeout)(struct fc_bsg_job *);
@@ -62040,9 +61990,9 @@ diff -urNp linux-2.6.32.43/include/scsi/scsi_transport_fc.h linux-2.6.32.43/incl
};
-diff -urNp linux-2.6.32.43/include/sound/ac97_codec.h linux-2.6.32.43/include/sound/ac97_codec.h
---- linux-2.6.32.43/include/sound/ac97_codec.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/sound/ac97_codec.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/sound/ac97_codec.h linux-2.6.32.44/include/sound/ac97_codec.h
+--- linux-2.6.32.44/include/sound/ac97_codec.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/sound/ac97_codec.h 2011-04-17 15:56:46.000000000 -0400
@@ -419,15 +419,15 @@
struct snd_ac97;
@@ -62075,9 +62025,9 @@ diff -urNp linux-2.6.32.43/include/sound/ac97_codec.h linux-2.6.32.43/include/so
void *private_data;
void (*private_free) (struct snd_ac97 *ac97);
/* --- */
-diff -urNp linux-2.6.32.43/include/sound/ak4xxx-adda.h linux-2.6.32.43/include/sound/ak4xxx-adda.h
---- linux-2.6.32.43/include/sound/ak4xxx-adda.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/sound/ak4xxx-adda.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/include/sound/ak4xxx-adda.h linux-2.6.32.44/include/sound/ak4xxx-adda.h
+--- linux-2.6.32.44/include/sound/ak4xxx-adda.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/sound/ak4xxx-adda.h 2011-08-05 20:33:55.000000000 -0400
@@ -35,7 +35,7 @@ struct snd_ak4xxx_ops {
void (*write)(struct snd_akm4xxx *ak, int chip, unsigned char reg,
unsigned char val);
@@ -62087,9 +62037,9 @@ diff -urNp linux-2.6.32.43/include/sound/ak4xxx-adda.h linux-2.6.32.43/include/s
#define AK4XXX_IMAGE_SIZE (AK4XXX_MAX_CHIPS * 16) /* 64 bytes */
-diff -urNp linux-2.6.32.43/include/sound/hwdep.h linux-2.6.32.43/include/sound/hwdep.h
---- linux-2.6.32.43/include/sound/hwdep.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/sound/hwdep.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/include/sound/hwdep.h linux-2.6.32.44/include/sound/hwdep.h
+--- linux-2.6.32.44/include/sound/hwdep.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/sound/hwdep.h 2011-08-05 20:33:55.000000000 -0400
@@ -49,7 +49,7 @@ struct snd_hwdep_ops {
struct snd_hwdep_dsp_status *status);
int (*dsp_load)(struct snd_hwdep *hw,
@@ -62099,9 +62049,9 @@ diff -urNp linux-2.6.32.43/include/sound/hwdep.h linux-2.6.32.43/include/sound/h
struct snd_hwdep {
struct snd_card *card;
-diff -urNp linux-2.6.32.43/include/sound/info.h linux-2.6.32.43/include/sound/info.h
---- linux-2.6.32.43/include/sound/info.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/sound/info.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/include/sound/info.h linux-2.6.32.44/include/sound/info.h
+--- linux-2.6.32.44/include/sound/info.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/sound/info.h 2011-08-05 20:33:55.000000000 -0400
@@ -44,7 +44,7 @@ struct snd_info_entry_text {
struct snd_info_buffer *buffer);
void (*write)(struct snd_info_entry *entry,
@@ -62111,9 +62061,9 @@ diff -urNp linux-2.6.32.43/include/sound/info.h linux-2.6.32.43/include/sound/in
struct snd_info_entry_ops {
int (*open)(struct snd_info_entry *entry,
-diff -urNp linux-2.6.32.43/include/sound/sb16_csp.h linux-2.6.32.43/include/sound/sb16_csp.h
---- linux-2.6.32.43/include/sound/sb16_csp.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/sound/sb16_csp.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/include/sound/sb16_csp.h linux-2.6.32.44/include/sound/sb16_csp.h
+--- linux-2.6.32.44/include/sound/sb16_csp.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/sound/sb16_csp.h 2011-08-05 20:33:55.000000000 -0400
@@ -139,7 +139,7 @@ struct snd_sb_csp_ops {
int (*csp_start) (struct snd_sb_csp * p, int sample_width, int channels);
int (*csp_stop) (struct snd_sb_csp * p);
@@ -62123,9 +62073,9 @@ diff -urNp linux-2.6.32.43/include/sound/sb16_csp.h linux-2.6.32.43/include/soun
/*
* CSP private data
-diff -urNp linux-2.6.32.43/include/sound/ymfpci.h linux-2.6.32.43/include/sound/ymfpci.h
---- linux-2.6.32.43/include/sound/ymfpci.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/sound/ymfpci.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/include/sound/ymfpci.h linux-2.6.32.44/include/sound/ymfpci.h
+--- linux-2.6.32.44/include/sound/ymfpci.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/sound/ymfpci.h 2011-05-04 17:56:28.000000000 -0400
@@ -358,7 +358,7 @@ struct snd_ymfpci {
spinlock_t reg_lock;
spinlock_t voice_lock;
@@ -62135,9 +62085,9 @@ diff -urNp linux-2.6.32.43/include/sound/ymfpci.h linux-2.6.32.43/include/sound/
struct snd_info_entry *proc_entry;
const struct firmware *dsp_microcode;
const struct firmware *controller_microcode;
-diff -urNp linux-2.6.32.43/include/trace/events/irq.h linux-2.6.32.43/include/trace/events/irq.h
---- linux-2.6.32.43/include/trace/events/irq.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/trace/events/irq.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/trace/events/irq.h linux-2.6.32.44/include/trace/events/irq.h
+--- linux-2.6.32.44/include/trace/events/irq.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/trace/events/irq.h 2011-04-17 15:56:46.000000000 -0400
@@ -34,7 +34,7 @@
*/
TRACE_EVENT(irq_handler_entry,
@@ -62174,9 +62124,9 @@ diff -urNp linux-2.6.32.43/include/trace/events/irq.h linux-2.6.32.43/include/tr
TP_ARGS(h, vec),
-diff -urNp linux-2.6.32.43/include/video/uvesafb.h linux-2.6.32.43/include/video/uvesafb.h
---- linux-2.6.32.43/include/video/uvesafb.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/include/video/uvesafb.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/include/video/uvesafb.h linux-2.6.32.44/include/video/uvesafb.h
+--- linux-2.6.32.44/include/video/uvesafb.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/include/video/uvesafb.h 2011-04-17 15:56:46.000000000 -0400
@@ -177,6 +177,7 @@ struct uvesafb_par {
u8 ypan; /* 0 - nothing, 1 - ypan, 2 - ywrap */
u8 pmi_setpal; /* PMI for palette changes */
@@ -62185,9 +62135,9 @@ diff -urNp linux-2.6.32.43/include/video/uvesafb.h linux-2.6.32.43/include/video
void *pmi_start;
void *pmi_pal;
u8 *vbe_state_orig; /*
-diff -urNp linux-2.6.32.43/init/do_mounts.c linux-2.6.32.43/init/do_mounts.c
---- linux-2.6.32.43/init/do_mounts.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/init/do_mounts.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/init/do_mounts.c linux-2.6.32.44/init/do_mounts.c
+--- linux-2.6.32.44/init/do_mounts.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/init/do_mounts.c 2011-04-17 15:56:46.000000000 -0400
@@ -216,11 +216,11 @@ static void __init get_fs_names(char *pa
static int __init do_mount_root(char *name, char *fs, int flags, void *data)
@@ -62233,9 +62183,9 @@ diff -urNp linux-2.6.32.43/init/do_mounts.c linux-2.6.32.43/init/do_mounts.c
+ sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
+ sys_chroot((__force char __user *)".");
}
-diff -urNp linux-2.6.32.43/init/do_mounts.h linux-2.6.32.43/init/do_mounts.h
---- linux-2.6.32.43/init/do_mounts.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/init/do_mounts.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/init/do_mounts.h linux-2.6.32.44/init/do_mounts.h
+--- linux-2.6.32.44/init/do_mounts.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/init/do_mounts.h 2011-04-17 15:56:46.000000000 -0400
@@ -15,15 +15,15 @@ extern int root_mountflags;
static inline int create_dev(char *name, dev_t dev)
@@ -62255,9 +62205,9 @@ diff -urNp linux-2.6.32.43/init/do_mounts.h linux-2.6.32.43/init/do_mounts.h
return 0;
if (!S_ISBLK(stat.st_mode))
return 0;
-diff -urNp linux-2.6.32.43/init/do_mounts_initrd.c linux-2.6.32.43/init/do_mounts_initrd.c
---- linux-2.6.32.43/init/do_mounts_initrd.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/init/do_mounts_initrd.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/init/do_mounts_initrd.c linux-2.6.32.44/init/do_mounts_initrd.c
+--- linux-2.6.32.44/init/do_mounts_initrd.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/init/do_mounts_initrd.c 2011-04-17 15:56:46.000000000 -0400
@@ -32,7 +32,7 @@ static int __init do_linuxrc(void * shel
sys_close(old_fd);sys_close(root_fd);
sys_close(0);sys_close(1);sys_close(2);
@@ -62341,9 +62291,9 @@ diff -urNp linux-2.6.32.43/init/do_mounts_initrd.c linux-2.6.32.43/init/do_mount
+ sys_unlink((__force const char __user *)"/initrd.image");
return 0;
}
-diff -urNp linux-2.6.32.43/init/do_mounts_md.c linux-2.6.32.43/init/do_mounts_md.c
---- linux-2.6.32.43/init/do_mounts_md.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/init/do_mounts_md.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/init/do_mounts_md.c linux-2.6.32.44/init/do_mounts_md.c
+--- linux-2.6.32.44/init/do_mounts_md.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/init/do_mounts_md.c 2011-04-17 15:56:46.000000000 -0400
@@ -170,7 +170,7 @@ static void __init md_setup_drive(void)
partitioned ? "_d" : "", minor,
md_setup_args[ent].device_names);
@@ -62371,9 +62321,9 @@ diff -urNp linux-2.6.32.43/init/do_mounts_md.c linux-2.6.32.43/init/do_mounts_md
if (fd >= 0) {
sys_ioctl(fd, RAID_AUTORUN, raid_autopart);
sys_close(fd);
-diff -urNp linux-2.6.32.43/init/initramfs.c linux-2.6.32.43/init/initramfs.c
---- linux-2.6.32.43/init/initramfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/init/initramfs.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/init/initramfs.c linux-2.6.32.44/init/initramfs.c
+--- linux-2.6.32.44/init/initramfs.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/init/initramfs.c 2011-04-17 15:56:46.000000000 -0400
@@ -74,7 +74,7 @@ static void __init free_hash(void)
}
}
@@ -62482,9 +62432,9 @@ diff -urNp linux-2.6.32.43/init/initramfs.c linux-2.6.32.43/init/initramfs.c
state = SkipIt;
next_state = Reset;
return 0;
-diff -urNp linux-2.6.32.43/init/Kconfig linux-2.6.32.43/init/Kconfig
---- linux-2.6.32.43/init/Kconfig 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.43/init/Kconfig 2011-05-10 22:12:34.000000000 -0400
+diff -urNp linux-2.6.32.44/init/Kconfig linux-2.6.32.44/init/Kconfig
+--- linux-2.6.32.44/init/Kconfig 2011-05-10 22:12:01.000000000 -0400
++++ linux-2.6.32.44/init/Kconfig 2011-05-10 22:12:34.000000000 -0400
@@ -1004,7 +1004,7 @@ config SLUB_DEBUG
config COMPAT_BRK
@@ -62494,9 +62444,9 @@ diff -urNp linux-2.6.32.43/init/Kconfig linux-2.6.32.43/init/Kconfig
help
Randomizing heap placement makes heap exploits harder, but it
also breaks ancient binaries (including anything libc5 based).
-diff -urNp linux-2.6.32.43/init/main.c linux-2.6.32.43/init/main.c
---- linux-2.6.32.43/init/main.c 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.43/init/main.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/init/main.c linux-2.6.32.44/init/main.c
+--- linux-2.6.32.44/init/main.c 2011-05-10 22:12:01.000000000 -0400
++++ linux-2.6.32.44/init/main.c 2011-08-05 20:33:55.000000000 -0400
@@ -97,6 +97,7 @@ static inline void mark_rodata_ro(void)
#ifdef CONFIG_TC
extern void tc_init(void);
@@ -62640,9 +62590,9 @@ diff -urNp linux-2.6.32.43/init/main.c linux-2.6.32.43/init/main.c
/*
* Ok, we have completed the initial bootup, and
* we're essentially up and running. Get rid of the
-diff -urNp linux-2.6.32.43/init/noinitramfs.c linux-2.6.32.43/init/noinitramfs.c
---- linux-2.6.32.43/init/noinitramfs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/init/noinitramfs.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/init/noinitramfs.c linux-2.6.32.44/init/noinitramfs.c
+--- linux-2.6.32.44/init/noinitramfs.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/init/noinitramfs.c 2011-04-17 15:56:46.000000000 -0400
@@ -29,7 +29,7 @@ static int __init default_rootfs(void)
{
int err;
@@ -62661,9 +62611,9 @@ diff -urNp linux-2.6.32.43/init/noinitramfs.c linux-2.6.32.43/init/noinitramfs.c
if (err < 0)
goto out;
-diff -urNp linux-2.6.32.43/ipc/mqueue.c linux-2.6.32.43/ipc/mqueue.c
---- linux-2.6.32.43/ipc/mqueue.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/ipc/mqueue.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/ipc/mqueue.c linux-2.6.32.44/ipc/mqueue.c
+--- linux-2.6.32.44/ipc/mqueue.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/ipc/mqueue.c 2011-04-17 15:56:46.000000000 -0400
@@ -150,6 +150,7 @@ static struct inode *mqueue_get_inode(st
mq_bytes = (mq_msg_tblsz +
(info->attr.mq_maxmsg * info->attr.mq_msgsize));
@@ -62672,9 +62622,9 @@ diff -urNp linux-2.6.32.43/ipc/mqueue.c linux-2.6.32.43/ipc/mqueue.c
spin_lock(&mq_lock);
if (u->mq_bytes + mq_bytes < u->mq_bytes ||
u->mq_bytes + mq_bytes >
-diff -urNp linux-2.6.32.43/ipc/msg.c linux-2.6.32.43/ipc/msg.c
---- linux-2.6.32.43/ipc/msg.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/ipc/msg.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/ipc/msg.c linux-2.6.32.44/ipc/msg.c
+--- linux-2.6.32.44/ipc/msg.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/ipc/msg.c 2011-08-05 20:33:55.000000000 -0400
@@ -310,18 +310,19 @@ static inline int msg_security(struct ke
return security_msg_queue_associate(msq, msgflg);
}
@@ -62700,9 +62650,9 @@ diff -urNp linux-2.6.32.43/ipc/msg.c linux-2.6.32.43/ipc/msg.c
msg_params.key = key;
msg_params.flg = msgflg;
-diff -urNp linux-2.6.32.43/ipc/sem.c linux-2.6.32.43/ipc/sem.c
---- linux-2.6.32.43/ipc/sem.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/ipc/sem.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/ipc/sem.c linux-2.6.32.44/ipc/sem.c
+--- linux-2.6.32.44/ipc/sem.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/ipc/sem.c 2011-08-05 20:33:55.000000000 -0400
@@ -309,10 +309,15 @@ static inline int sem_more_checks(struct
return 0;
}
@@ -62749,9 +62699,9 @@ diff -urNp linux-2.6.32.43/ipc/sem.c linux-2.6.32.43/ipc/sem.c
ns = current->nsproxy->ipc_ns;
if (nsops < 1 || semid < 0)
-diff -urNp linux-2.6.32.43/ipc/shm.c linux-2.6.32.43/ipc/shm.c
---- linux-2.6.32.43/ipc/shm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/ipc/shm.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/ipc/shm.c linux-2.6.32.44/ipc/shm.c
+--- linux-2.6.32.44/ipc/shm.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/ipc/shm.c 2011-08-05 20:33:55.000000000 -0400
@@ -70,6 +70,14 @@ static void shm_destroy (struct ipc_name
static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
#endif
@@ -62829,9 +62779,9 @@ diff -urNp linux-2.6.32.43/ipc/shm.c linux-2.6.32.43/ipc/shm.c
size = i_size_read(path.dentry->d_inode);
shm_unlock(shp);
-diff -urNp linux-2.6.32.43/kernel/acct.c linux-2.6.32.43/kernel/acct.c
---- linux-2.6.32.43/kernel/acct.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/acct.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/acct.c linux-2.6.32.44/kernel/acct.c
+--- linux-2.6.32.44/kernel/acct.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/acct.c 2011-04-17 15:56:46.000000000 -0400
@@ -579,7 +579,7 @@ static void do_acct_process(struct bsd_a
*/
flim = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
@@ -62841,9 +62791,9 @@ diff -urNp linux-2.6.32.43/kernel/acct.c linux-2.6.32.43/kernel/acct.c
sizeof(acct_t), &file->f_pos);
current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
set_fs(fs);
-diff -urNp linux-2.6.32.43/kernel/audit.c linux-2.6.32.43/kernel/audit.c
---- linux-2.6.32.43/kernel/audit.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/audit.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/audit.c linux-2.6.32.44/kernel/audit.c
+--- linux-2.6.32.44/kernel/audit.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/audit.c 2011-05-04 17:56:28.000000000 -0400
@@ -110,7 +110,7 @@ u32 audit_sig_sid = 0;
3) suppressed due to audit_rate_limit
4) suppressed due to audit_backlog_limit
@@ -62893,9 +62843,9 @@ diff -urNp linux-2.6.32.43/kernel/audit.c linux-2.6.32.43/kernel/audit.c
break;
}
case AUDIT_TTY_SET: {
-diff -urNp linux-2.6.32.43/kernel/auditsc.c linux-2.6.32.43/kernel/auditsc.c
---- linux-2.6.32.43/kernel/auditsc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/auditsc.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/auditsc.c linux-2.6.32.44/kernel/auditsc.c
+--- linux-2.6.32.44/kernel/auditsc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/auditsc.c 2011-05-04 17:56:28.000000000 -0400
@@ -2113,7 +2113,7 @@ int auditsc_get_stamp(struct audit_conte
}
@@ -62914,9 +62864,9 @@ diff -urNp linux-2.6.32.43/kernel/auditsc.c linux-2.6.32.43/kernel/auditsc.c
struct audit_context *context = task->audit_context;
if (context && context->in_syscall) {
-diff -urNp linux-2.6.32.43/kernel/capability.c linux-2.6.32.43/kernel/capability.c
---- linux-2.6.32.43/kernel/capability.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/capability.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/capability.c linux-2.6.32.44/kernel/capability.c
+--- linux-2.6.32.44/kernel/capability.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/capability.c 2011-04-17 15:56:46.000000000 -0400
@@ -305,10 +305,26 @@ int capable(int cap)
BUG();
}
@@ -62945,9 +62895,9 @@ diff -urNp linux-2.6.32.43/kernel/capability.c linux-2.6.32.43/kernel/capability
+
EXPORT_SYMBOL(capable);
+EXPORT_SYMBOL(capable_nolog);
-diff -urNp linux-2.6.32.43/kernel/cgroup.c linux-2.6.32.43/kernel/cgroup.c
---- linux-2.6.32.43/kernel/cgroup.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/cgroup.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/cgroup.c linux-2.6.32.44/kernel/cgroup.c
+--- linux-2.6.32.44/kernel/cgroup.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/cgroup.c 2011-05-16 21:46:57.000000000 -0400
@@ -536,6 +536,8 @@ static struct css_set *find_css_set(
struct hlist_head *hhead;
struct cg_cgroup_link *link;
@@ -62957,9 +62907,9 @@ diff -urNp linux-2.6.32.43/kernel/cgroup.c linux-2.6.32.43/kernel/cgroup.c
/* First see if we already have a cgroup group that matches
* the desired set */
read_lock(&css_set_lock);
-diff -urNp linux-2.6.32.43/kernel/configs.c linux-2.6.32.43/kernel/configs.c
---- linux-2.6.32.43/kernel/configs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/configs.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/configs.c linux-2.6.32.44/kernel/configs.c
+--- linux-2.6.32.44/kernel/configs.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/configs.c 2011-04-17 15:56:46.000000000 -0400
@@ -73,8 +73,19 @@ static int __init ikconfig_init(void)
struct proc_dir_entry *entry;
@@ -62980,9 +62930,9 @@ diff -urNp linux-2.6.32.43/kernel/configs.c linux-2.6.32.43/kernel/configs.c
if (!entry)
return -ENOMEM;
-diff -urNp linux-2.6.32.43/kernel/cpu.c linux-2.6.32.43/kernel/cpu.c
---- linux-2.6.32.43/kernel/cpu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/cpu.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/cpu.c linux-2.6.32.44/kernel/cpu.c
+--- linux-2.6.32.44/kernel/cpu.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/cpu.c 2011-04-17 15:56:46.000000000 -0400
@@ -19,7 +19,7 @@
/* Serializes the updates to cpu_online_mask, cpu_present_mask */
static DEFINE_MUTEX(cpu_add_remove_lock);
@@ -62992,9 +62942,9 @@ diff -urNp linux-2.6.32.43/kernel/cpu.c linux-2.6.32.43/kernel/cpu.c
/* If set, cpu_up and cpu_down will return -EBUSY and do nothing.
* Should always be manipulated under cpu_add_remove_lock
-diff -urNp linux-2.6.32.43/kernel/cred.c linux-2.6.32.43/kernel/cred.c
---- linux-2.6.32.43/kernel/cred.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/cred.c 2011-05-17 19:26:34.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/cred.c linux-2.6.32.44/kernel/cred.c
+--- linux-2.6.32.44/kernel/cred.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/cred.c 2011-08-11 19:49:38.000000000 -0400
@@ -160,6 +160,8 @@ static void put_cred_rcu(struct rcu_head
*/
void __put_cred(struct cred *cred)
@@ -63076,7 +63026,20 @@ diff -urNp linux-2.6.32.43/kernel/cred.c linux-2.6.32.43/kernel/cred.c
/* dumpability changes */
if (old->euid != new->euid ||
old->egid != new->egid ||
-@@ -606,6 +624,8 @@ EXPORT_SYMBOL(commit_creds);
+@@ -563,10 +581,8 @@ int commit_creds(struct cred *new)
+ key_fsgid_changed(task);
+
+ /* do it
+- * - What if a process setreuid()'s and this brings the
+- * new uid over his NPROC rlimit? We can check this now
+- * cheaply with the new uid cache, so if it matters
+- * we should be checking for it. -DaveM
++ * RLIMIT_NPROC limits on user->processes have already been checked
++ * in set_user().
+ */
+ alter_cred_subscribers(new, 2);
+ if (new->user != old->user)
+@@ -606,6 +622,8 @@ EXPORT_SYMBOL(commit_creds);
*/
void abort_creds(struct cred *new)
{
@@ -63085,7 +63048,7 @@ diff -urNp linux-2.6.32.43/kernel/cred.c linux-2.6.32.43/kernel/cred.c
kdebug("abort_creds(%p{%d,%d})", new,
atomic_read(&new->usage),
read_cred_subscribers(new));
-@@ -629,6 +649,8 @@ const struct cred *override_creds(const
+@@ -629,6 +647,8 @@ const struct cred *override_creds(const
{
const struct cred *old = current->cred;
@@ -63094,7 +63057,7 @@ diff -urNp linux-2.6.32.43/kernel/cred.c linux-2.6.32.43/kernel/cred.c
kdebug("override_creds(%p{%d,%d})", new,
atomic_read(&new->usage),
read_cred_subscribers(new));
-@@ -658,6 +680,8 @@ void revert_creds(const struct cred *old
+@@ -658,6 +678,8 @@ void revert_creds(const struct cred *old
{
const struct cred *override = current->cred;
@@ -63103,7 +63066,7 @@ diff -urNp linux-2.6.32.43/kernel/cred.c linux-2.6.32.43/kernel/cred.c
kdebug("revert_creds(%p{%d,%d})", old,
atomic_read(&old->usage),
read_cred_subscribers(old));
-@@ -704,6 +728,8 @@ struct cred *prepare_kernel_cred(struct
+@@ -704,6 +726,8 @@ struct cred *prepare_kernel_cred(struct
const struct cred *old;
struct cred *new;
@@ -63112,7 +63075,7 @@ diff -urNp linux-2.6.32.43/kernel/cred.c linux-2.6.32.43/kernel/cred.c
new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
if (!new)
return NULL;
-@@ -758,6 +784,8 @@ EXPORT_SYMBOL(prepare_kernel_cred);
+@@ -758,6 +782,8 @@ EXPORT_SYMBOL(prepare_kernel_cred);
*/
int set_security_override(struct cred *new, u32 secid)
{
@@ -63121,7 +63084,7 @@ diff -urNp linux-2.6.32.43/kernel/cred.c linux-2.6.32.43/kernel/cred.c
return security_kernel_act_as(new, secid);
}
EXPORT_SYMBOL(set_security_override);
-@@ -777,6 +805,8 @@ int set_security_override_from_ctx(struc
+@@ -777,6 +803,8 @@ int set_security_override_from_ctx(struc
u32 secid;
int ret;
@@ -63130,9 +63093,9 @@ diff -urNp linux-2.6.32.43/kernel/cred.c linux-2.6.32.43/kernel/cred.c
ret = security_secctx_to_secid(secctx, strlen(secctx), &secid);
if (ret < 0)
return ret;
-diff -urNp linux-2.6.32.43/kernel/exit.c linux-2.6.32.43/kernel/exit.c
---- linux-2.6.32.43/kernel/exit.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/exit.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/exit.c linux-2.6.32.44/kernel/exit.c
+--- linux-2.6.32.44/kernel/exit.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/exit.c 2011-04-17 15:56:46.000000000 -0400
@@ -55,6 +55,10 @@
#include <asm/pgtable.h>
#include <asm/mmu_context.h>
@@ -63261,9 +63224,9 @@ diff -urNp linux-2.6.32.43/kernel/exit.c linux-2.6.32.43/kernel/exit.c
get_task_struct(p);
read_unlock(&tasklist_lock);
-diff -urNp linux-2.6.32.43/kernel/fork.c linux-2.6.32.43/kernel/fork.c
---- linux-2.6.32.43/kernel/fork.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/fork.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/fork.c linux-2.6.32.44/kernel/fork.c
+--- linux-2.6.32.44/kernel/fork.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/fork.c 2011-08-11 19:50:07.000000000 -0400
@@ -253,7 +253,7 @@ static struct task_struct *dup_task_stru
*stackend = STACK_END_MAGIC; /* for overflow detection */
@@ -63340,7 +63303,7 @@ diff -urNp linux-2.6.32.43/kernel/fork.c linux-2.6.32.43/kernel/fork.c
return 0;
}
-@@ -1033,10 +1060,13 @@ static struct task_struct *copy_process(
+@@ -1033,12 +1060,16 @@ static struct task_struct *copy_process(
DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
#endif
retval = -EAGAIN;
@@ -63355,8 +63318,11 @@ diff -urNp linux-2.6.32.43/kernel/fork.c linux-2.6.32.43/kernel/fork.c
+ !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN))
goto bad_fork_free;
}
++ current->flags &= ~PF_NPROC_EXCEEDED;
-@@ -1183,6 +1213,8 @@ static struct task_struct *copy_process(
+ retval = copy_creds(p, clone_flags);
+ if (retval < 0)
+@@ -1183,6 +1214,8 @@ static struct task_struct *copy_process(
goto bad_fork_free_pid;
}
@@ -63365,7 +63331,7 @@ diff -urNp linux-2.6.32.43/kernel/fork.c linux-2.6.32.43/kernel/fork.c
p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
/*
* Clear TID on mm_release()?
-@@ -1333,6 +1365,8 @@ bad_fork_cleanup_count:
+@@ -1333,6 +1366,8 @@ bad_fork_cleanup_count:
bad_fork_free:
free_task(p);
fork_out:
@@ -63374,7 +63340,7 @@ diff -urNp linux-2.6.32.43/kernel/fork.c linux-2.6.32.43/kernel/fork.c
return ERR_PTR(retval);
}
-@@ -1426,6 +1460,8 @@ long do_fork(unsigned long clone_flags,
+@@ -1426,6 +1461,8 @@ long do_fork(unsigned long clone_flags,
if (clone_flags & CLONE_PARENT_SETTID)
put_user(nr, parent_tidptr);
@@ -63383,7 +63349,7 @@ diff -urNp linux-2.6.32.43/kernel/fork.c linux-2.6.32.43/kernel/fork.c
if (clone_flags & CLONE_VFORK) {
p->vfork_done = &vfork;
init_completion(&vfork);
-@@ -1558,7 +1594,7 @@ static int unshare_fs(unsigned long unsh
+@@ -1558,7 +1595,7 @@ static int unshare_fs(unsigned long unsh
return 0;
/* don't need lock here; in the worst case we'll do useless copy */
@@ -63392,7 +63358,7 @@ diff -urNp linux-2.6.32.43/kernel/fork.c linux-2.6.32.43/kernel/fork.c
return 0;
*new_fsp = copy_fs_struct(fs);
-@@ -1681,7 +1717,8 @@ SYSCALL_DEFINE1(unshare, unsigned long,
+@@ -1681,7 +1718,8 @@ SYSCALL_DEFINE1(unshare, unsigned long,
fs = current->fs;
write_lock(&fs->lock);
current->fs = new_fs;
@@ -63402,9 +63368,9 @@ diff -urNp linux-2.6.32.43/kernel/fork.c linux-2.6.32.43/kernel/fork.c
new_fs = NULL;
else
new_fs = fs;
-diff -urNp linux-2.6.32.43/kernel/futex.c linux-2.6.32.43/kernel/futex.c
---- linux-2.6.32.43/kernel/futex.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/futex.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/futex.c linux-2.6.32.44/kernel/futex.c
+--- linux-2.6.32.44/kernel/futex.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/futex.c 2011-05-16 21:46:57.000000000 -0400
@@ -54,6 +54,7 @@
#include <linux/mount.h>
#include <linux/pagemap.h>
@@ -63507,9 +63473,9 @@ diff -urNp linux-2.6.32.43/kernel/futex.c linux-2.6.32.43/kernel/futex.c
if (curval == -EFAULT)
futex_cmpxchg_enabled = 1;
-diff -urNp linux-2.6.32.43/kernel/futex_compat.c linux-2.6.32.43/kernel/futex_compat.c
---- linux-2.6.32.43/kernel/futex_compat.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/futex_compat.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/futex_compat.c linux-2.6.32.44/kernel/futex_compat.c
+--- linux-2.6.32.44/kernel/futex_compat.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/futex_compat.c 2011-04-17 15:56:46.000000000 -0400
@@ -10,6 +10,7 @@
#include <linux/compat.h>
#include <linux/nsproxy.h>
@@ -63547,9 +63513,9 @@ diff -urNp linux-2.6.32.43/kernel/futex_compat.c linux-2.6.32.43/kernel/futex_co
head = p->compat_robust_list;
read_unlock(&tasklist_lock);
}
-diff -urNp linux-2.6.32.43/kernel/gcov/base.c linux-2.6.32.43/kernel/gcov/base.c
---- linux-2.6.32.43/kernel/gcov/base.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/gcov/base.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/gcov/base.c linux-2.6.32.44/kernel/gcov/base.c
+--- linux-2.6.32.44/kernel/gcov/base.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/gcov/base.c 2011-04-17 15:56:46.000000000 -0400
@@ -102,11 +102,6 @@ void gcov_enable_events(void)
}
@@ -63571,9 +63537,9 @@ diff -urNp linux-2.6.32.43/kernel/gcov/base.c linux-2.6.32.43/kernel/gcov/base.c
if (prev)
prev->next = info->next;
else
-diff -urNp linux-2.6.32.43/kernel/hrtimer.c linux-2.6.32.43/kernel/hrtimer.c
---- linux-2.6.32.43/kernel/hrtimer.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/hrtimer.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/hrtimer.c linux-2.6.32.44/kernel/hrtimer.c
+--- linux-2.6.32.44/kernel/hrtimer.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/hrtimer.c 2011-04-17 15:56:46.000000000 -0400
@@ -1391,7 +1391,7 @@ void hrtimer_peek_ahead_timers(void)
local_irq_restore(flags);
}
@@ -63583,9 +63549,9 @@ diff -urNp linux-2.6.32.43/kernel/hrtimer.c linux-2.6.32.43/kernel/hrtimer.c
{
hrtimer_peek_ahead_timers();
}
-diff -urNp linux-2.6.32.43/kernel/kallsyms.c linux-2.6.32.43/kernel/kallsyms.c
---- linux-2.6.32.43/kernel/kallsyms.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/kallsyms.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/kallsyms.c linux-2.6.32.44/kernel/kallsyms.c
+--- linux-2.6.32.44/kernel/kallsyms.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/kallsyms.c 2011-04-17 15:56:46.000000000 -0400
@@ -11,6 +11,9 @@
* Changed the compression method from stem compression to "table lookup"
* compression (see scripts/kallsyms.c for a more complete description)
@@ -63688,9 +63654,9 @@ diff -urNp linux-2.6.32.43/kernel/kallsyms.c linux-2.6.32.43/kernel/kallsyms.c
if (!iter)
return -ENOMEM;
reset_iter(iter, 0);
-diff -urNp linux-2.6.32.43/kernel/kgdb.c linux-2.6.32.43/kernel/kgdb.c
---- linux-2.6.32.43/kernel/kgdb.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.43/kernel/kgdb.c 2011-05-04 17:56:20.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/kgdb.c linux-2.6.32.44/kernel/kgdb.c
+--- linux-2.6.32.44/kernel/kgdb.c 2011-04-17 17:00:52.000000000 -0400
++++ linux-2.6.32.44/kernel/kgdb.c 2011-05-04 17:56:20.000000000 -0400
@@ -86,7 +86,7 @@ static int kgdb_io_module_registered;
/* Guard for recursive entry */
static int exception_level;
@@ -63770,9 +63736,9 @@ diff -urNp linux-2.6.32.43/kernel/kgdb.c linux-2.6.32.43/kernel/kgdb.c
}
EXPORT_SYMBOL_GPL(kgdb_breakpoint);
-diff -urNp linux-2.6.32.43/kernel/kmod.c linux-2.6.32.43/kernel/kmod.c
---- linux-2.6.32.43/kernel/kmod.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/kmod.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/kmod.c linux-2.6.32.44/kernel/kmod.c
+--- linux-2.6.32.44/kernel/kmod.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/kmod.c 2011-04-17 15:56:46.000000000 -0400
@@ -65,13 +65,12 @@ char modprobe_path[KMOD_PATH_LEN] = "/sb
* If module auto-loading support is disabled then this function
* becomes a no-operation.
@@ -63866,9 +63832,9 @@ diff -urNp linux-2.6.32.43/kernel/kmod.c linux-2.6.32.43/kernel/kmod.c
EXPORT_SYMBOL(__request_module);
#endif /* CONFIG_MODULES */
-diff -urNp linux-2.6.32.43/kernel/kprobes.c linux-2.6.32.43/kernel/kprobes.c
---- linux-2.6.32.43/kernel/kprobes.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/kprobes.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/kprobes.c linux-2.6.32.44/kernel/kprobes.c
+--- linux-2.6.32.44/kernel/kprobes.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/kprobes.c 2011-04-17 15:56:46.000000000 -0400
@@ -183,7 +183,7 @@ static kprobe_opcode_t __kprobes *__get_
* kernel image and loaded module images reside. This is required
* so x86_64 can correctly handle the %rip-relative fixups.
@@ -63905,9 +63871,9 @@ diff -urNp linux-2.6.32.43/kernel/kprobes.c linux-2.6.32.43/kernel/kprobes.c
head = &kprobe_table[i];
preempt_disable();
-diff -urNp linux-2.6.32.43/kernel/lockdep.c linux-2.6.32.43/kernel/lockdep.c
---- linux-2.6.32.43/kernel/lockdep.c 2011-06-25 12:55:35.000000000 -0400
-+++ linux-2.6.32.43/kernel/lockdep.c 2011-06-25 12:56:37.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/lockdep.c linux-2.6.32.44/kernel/lockdep.c
+--- linux-2.6.32.44/kernel/lockdep.c 2011-06-25 12:55:35.000000000 -0400
++++ linux-2.6.32.44/kernel/lockdep.c 2011-06-25 12:56:37.000000000 -0400
@@ -421,20 +421,20 @@ static struct stack_trace lockdep_init_t
/*
* Various lockdep statistics:
@@ -63981,9 +63947,9 @@ diff -urNp linux-2.6.32.43/kernel/lockdep.c linux-2.6.32.43/kernel/lockdep.c
if (very_verbose(class)) {
printk("\nacquire class [%p] %s", class->key, class->name);
if (class->name_version > 1)
-diff -urNp linux-2.6.32.43/kernel/lockdep_internals.h linux-2.6.32.43/kernel/lockdep_internals.h
---- linux-2.6.32.43/kernel/lockdep_internals.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/lockdep_internals.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/lockdep_internals.h linux-2.6.32.44/kernel/lockdep_internals.h
+--- linux-2.6.32.44/kernel/lockdep_internals.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/lockdep_internals.h 2011-04-17 15:56:46.000000000 -0400
@@ -113,26 +113,26 @@ lockdep_count_backward_deps(struct lock_
/*
* Various lockdep statistics:
@@ -64031,9 +63997,9 @@ diff -urNp linux-2.6.32.43/kernel/lockdep_internals.h linux-2.6.32.43/kernel/loc
#else
# define debug_atomic_inc(ptr) do { } while (0)
# define debug_atomic_dec(ptr) do { } while (0)
-diff -urNp linux-2.6.32.43/kernel/lockdep_proc.c linux-2.6.32.43/kernel/lockdep_proc.c
---- linux-2.6.32.43/kernel/lockdep_proc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/lockdep_proc.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/lockdep_proc.c linux-2.6.32.44/kernel/lockdep_proc.c
+--- linux-2.6.32.44/kernel/lockdep_proc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/lockdep_proc.c 2011-04-17 15:56:46.000000000 -0400
@@ -39,7 +39,7 @@ static void l_stop(struct seq_file *m, v
static void print_name(struct seq_file *m, struct lock_class *class)
@@ -64043,9 +64009,9 @@ diff -urNp linux-2.6.32.43/kernel/lockdep_proc.c linux-2.6.32.43/kernel/lockdep_
const char *name = class->name;
if (!name) {
-diff -urNp linux-2.6.32.43/kernel/module.c linux-2.6.32.43/kernel/module.c
---- linux-2.6.32.43/kernel/module.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/module.c 2011-04-29 18:52:40.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/module.c linux-2.6.32.44/kernel/module.c
+--- linux-2.6.32.44/kernel/module.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/module.c 2011-04-29 18:52:40.000000000 -0400
@@ -55,6 +55,7 @@
#include <linux/async.h>
#include <linux/percpu.h>
@@ -64686,9 +64652,9 @@ diff -urNp linux-2.6.32.43/kernel/module.c linux-2.6.32.43/kernel/module.c
mod = NULL;
}
return mod;
-diff -urNp linux-2.6.32.43/kernel/mutex.c linux-2.6.32.43/kernel/mutex.c
---- linux-2.6.32.43/kernel/mutex.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/mutex.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/mutex.c linux-2.6.32.44/kernel/mutex.c
+--- linux-2.6.32.44/kernel/mutex.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/mutex.c 2011-04-17 15:56:46.000000000 -0400
@@ -169,7 +169,7 @@ __mutex_lock_common(struct mutex *lock,
*/
@@ -64726,9 +64692,9 @@ diff -urNp linux-2.6.32.43/kernel/mutex.c linux-2.6.32.43/kernel/mutex.c
mutex_set_owner(lock);
/* set it to 0 if there are no waiters left: */
-diff -urNp linux-2.6.32.43/kernel/mutex-debug.c linux-2.6.32.43/kernel/mutex-debug.c
---- linux-2.6.32.43/kernel/mutex-debug.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/mutex-debug.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/mutex-debug.c linux-2.6.32.44/kernel/mutex-debug.c
+--- linux-2.6.32.44/kernel/mutex-debug.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/mutex-debug.c 2011-04-17 15:56:46.000000000 -0400
@@ -49,21 +49,21 @@ void debug_mutex_free_waiter(struct mute
}
@@ -64766,9 +64732,9 @@ diff -urNp linux-2.6.32.43/kernel/mutex-debug.c linux-2.6.32.43/kernel/mutex-deb
DEBUG_LOCKS_WARN_ON(!lock->wait_list.prev && !lock->wait_list.next);
mutex_clear_owner(lock);
}
-diff -urNp linux-2.6.32.43/kernel/mutex-debug.h linux-2.6.32.43/kernel/mutex-debug.h
---- linux-2.6.32.43/kernel/mutex-debug.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/mutex-debug.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/mutex-debug.h linux-2.6.32.44/kernel/mutex-debug.h
+--- linux-2.6.32.44/kernel/mutex-debug.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/mutex-debug.h 2011-04-17 15:56:46.000000000 -0400
@@ -20,16 +20,16 @@ extern void debug_mutex_wake_waiter(stru
extern void debug_mutex_free_waiter(struct mutex_waiter *waiter);
extern void debug_mutex_add_waiter(struct mutex *lock,
@@ -64789,9 +64755,9 @@ diff -urNp linux-2.6.32.43/kernel/mutex-debug.h linux-2.6.32.43/kernel/mutex-deb
}
static inline void mutex_clear_owner(struct mutex *lock)
-diff -urNp linux-2.6.32.43/kernel/mutex.h linux-2.6.32.43/kernel/mutex.h
---- linux-2.6.32.43/kernel/mutex.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/mutex.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/mutex.h linux-2.6.32.44/kernel/mutex.h
+--- linux-2.6.32.44/kernel/mutex.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/mutex.h 2011-04-17 15:56:46.000000000 -0400
@@ -19,7 +19,7 @@
#ifdef CONFIG_SMP
static inline void mutex_set_owner(struct mutex *lock)
@@ -64801,9 +64767,9 @@ diff -urNp linux-2.6.32.43/kernel/mutex.h linux-2.6.32.43/kernel/mutex.h
}
static inline void mutex_clear_owner(struct mutex *lock)
-diff -urNp linux-2.6.32.43/kernel/panic.c linux-2.6.32.43/kernel/panic.c
---- linux-2.6.32.43/kernel/panic.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/panic.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/panic.c linux-2.6.32.44/kernel/panic.c
+--- linux-2.6.32.44/kernel/panic.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/panic.c 2011-04-17 15:56:46.000000000 -0400
@@ -352,7 +352,7 @@ static void warn_slowpath_common(const c
const char *board;
@@ -64823,9 +64789,9 @@ diff -urNp linux-2.6.32.43/kernel/panic.c linux-2.6.32.43/kernel/panic.c
__builtin_return_address(0));
}
EXPORT_SYMBOL(__stack_chk_fail);
-diff -urNp linux-2.6.32.43/kernel/params.c linux-2.6.32.43/kernel/params.c
---- linux-2.6.32.43/kernel/params.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/params.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/params.c linux-2.6.32.44/kernel/params.c
+--- linux-2.6.32.44/kernel/params.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/params.c 2011-04-17 15:56:46.000000000 -0400
@@ -725,7 +725,7 @@ static ssize_t module_attr_store(struct
return ret;
}
@@ -64844,9 +64810,9 @@ diff -urNp linux-2.6.32.43/kernel/params.c linux-2.6.32.43/kernel/params.c
.filter = uevent_filter,
};
-diff -urNp linux-2.6.32.43/kernel/perf_event.c linux-2.6.32.43/kernel/perf_event.c
---- linux-2.6.32.43/kernel/perf_event.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.43/kernel/perf_event.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/perf_event.c linux-2.6.32.44/kernel/perf_event.c
+--- linux-2.6.32.44/kernel/perf_event.c 2011-08-09 18:35:30.000000000 -0400
++++ linux-2.6.32.44/kernel/perf_event.c 2011-08-09 18:34:01.000000000 -0400
@@ -77,7 +77,7 @@ int sysctl_perf_event_mlock __read_mostl
*/
int sysctl_perf_event_sample_rate __read_mostly = 100000;
@@ -64971,7 +64937,7 @@ diff -urNp linux-2.6.32.43/kernel/perf_event.c linux-2.6.32.43/kernel/perf_event
if (read_format & PERF_FORMAT_ID)
values[n++] = primary_event_id(sub);
-@@ -3787,7 +3787,7 @@ static void perf_swevent_add(struct perf
+@@ -3783,7 +3783,7 @@ static void perf_swevent_add(struct perf
{
struct hw_perf_event *hwc = &event->hw;
@@ -64980,7 +64946,7 @@ diff -urNp linux-2.6.32.43/kernel/perf_event.c linux-2.6.32.43/kernel/perf_event
if (!hwc->sample_period)
return;
-@@ -4044,9 +4044,9 @@ static void cpu_clock_perf_event_update(
+@@ -4040,9 +4040,9 @@ static void cpu_clock_perf_event_update(
u64 now;
now = cpu_clock(cpu);
@@ -64993,7 +64959,7 @@ diff -urNp linux-2.6.32.43/kernel/perf_event.c linux-2.6.32.43/kernel/perf_event
}
static int cpu_clock_perf_event_enable(struct perf_event *event)
-@@ -4054,7 +4054,7 @@ static int cpu_clock_perf_event_enable(s
+@@ -4050,7 +4050,7 @@ static int cpu_clock_perf_event_enable(s
struct hw_perf_event *hwc = &event->hw;
int cpu = raw_smp_processor_id();
@@ -65002,7 +64968,7 @@ diff -urNp linux-2.6.32.43/kernel/perf_event.c linux-2.6.32.43/kernel/perf_event
perf_swevent_start_hrtimer(event);
return 0;
-@@ -4086,9 +4086,9 @@ static void task_clock_perf_event_update
+@@ -4082,9 +4082,9 @@ static void task_clock_perf_event_update
u64 prev;
s64 delta;
@@ -65014,7 +64980,7 @@ diff -urNp linux-2.6.32.43/kernel/perf_event.c linux-2.6.32.43/kernel/perf_event
}
static int task_clock_perf_event_enable(struct perf_event *event)
-@@ -4098,7 +4098,7 @@ static int task_clock_perf_event_enable(
+@@ -4094,7 +4094,7 @@ static int task_clock_perf_event_enable(
now = event->ctx->time;
@@ -65023,7 +64989,7 @@ diff -urNp linux-2.6.32.43/kernel/perf_event.c linux-2.6.32.43/kernel/perf_event
perf_swevent_start_hrtimer(event);
-@@ -4293,7 +4293,7 @@ perf_event_alloc(struct perf_event_attr
+@@ -4289,7 +4289,7 @@ perf_event_alloc(struct perf_event_attr
event->parent = parent_event;
event->ns = get_pid_ns(current->nsproxy->pid_ns);
@@ -65032,7 +64998,7 @@ diff -urNp linux-2.6.32.43/kernel/perf_event.c linux-2.6.32.43/kernel/perf_event
event->state = PERF_EVENT_STATE_INACTIVE;
-@@ -4724,15 +4724,15 @@ static void sync_child_event(struct perf
+@@ -4720,15 +4720,15 @@ static void sync_child_event(struct perf
if (child_event->attr.inherit_stat)
perf_event_read_event(child_event, child);
@@ -65052,9 +65018,9 @@ diff -urNp linux-2.6.32.43/kernel/perf_event.c linux-2.6.32.43/kernel/perf_event
&parent_event->child_total_time_running);
/*
-diff -urNp linux-2.6.32.43/kernel/pid.c linux-2.6.32.43/kernel/pid.c
---- linux-2.6.32.43/kernel/pid.c 2011-04-22 19:16:29.000000000 -0400
-+++ linux-2.6.32.43/kernel/pid.c 2011-07-14 19:15:33.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/pid.c linux-2.6.32.44/kernel/pid.c
+--- linux-2.6.32.44/kernel/pid.c 2011-04-22 19:16:29.000000000 -0400
++++ linux-2.6.32.44/kernel/pid.c 2011-07-14 19:15:33.000000000 -0400
@@ -33,6 +33,7 @@
#include <linux/rculist.h>
#include <linux/bootmem.h>
@@ -65102,9 +65068,9 @@ diff -urNp linux-2.6.32.43/kernel/pid.c linux-2.6.32.43/kernel/pid.c
struct pid *get_task_pid(struct task_struct *task, enum pid_type type)
{
struct pid *pid;
-diff -urNp linux-2.6.32.43/kernel/posix-cpu-timers.c linux-2.6.32.43/kernel/posix-cpu-timers.c
---- linux-2.6.32.43/kernel/posix-cpu-timers.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/posix-cpu-timers.c 2011-08-06 09:33:44.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/posix-cpu-timers.c linux-2.6.32.44/kernel/posix-cpu-timers.c
+--- linux-2.6.32.44/kernel/posix-cpu-timers.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/posix-cpu-timers.c 2011-08-06 09:33:44.000000000 -0400
@@ -6,6 +6,7 @@
#include <linux/posix-timers.h>
#include <linux/errno.h>
@@ -65131,9 +65097,9 @@ diff -urNp linux-2.6.32.43/kernel/posix-cpu-timers.c linux-2.6.32.43/kernel/posi
.clock_getres = thread_cpu_clock_getres,
.clock_get = thread_cpu_clock_get,
.clock_set = do_posix_clock_nosettime,
-diff -urNp linux-2.6.32.43/kernel/posix-timers.c linux-2.6.32.43/kernel/posix-timers.c
---- linux-2.6.32.43/kernel/posix-timers.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/posix-timers.c 2011-08-06 09:34:14.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/posix-timers.c linux-2.6.32.44/kernel/posix-timers.c
+--- linux-2.6.32.44/kernel/posix-timers.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/posix-timers.c 2011-08-06 09:34:14.000000000 -0400
@@ -42,6 +42,7 @@
#include <linux/compiler.h>
#include <linux/idr.h>
@@ -65252,9 +65218,9 @@ diff -urNp linux-2.6.32.43/kernel/posix-timers.c linux-2.6.32.43/kernel/posix-ti
return CLOCK_DISPATCH(which_clock, clock_set, (which_clock, &new_tp));
}
-diff -urNp linux-2.6.32.43/kernel/power/hibernate.c linux-2.6.32.43/kernel/power/hibernate.c
---- linux-2.6.32.43/kernel/power/hibernate.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/power/hibernate.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/power/hibernate.c linux-2.6.32.44/kernel/power/hibernate.c
+--- linux-2.6.32.44/kernel/power/hibernate.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/power/hibernate.c 2011-04-17 15:56:46.000000000 -0400
@@ -48,14 +48,14 @@ enum {
static int hibernation_mode = HIBERNATION_SHUTDOWN;
@@ -65272,9 +65238,9 @@ diff -urNp linux-2.6.32.43/kernel/power/hibernate.c linux-2.6.32.43/kernel/power
{
if (ops && !(ops->begin && ops->end && ops->pre_snapshot
&& ops->prepare && ops->finish && ops->enter && ops->pre_restore
-diff -urNp linux-2.6.32.43/kernel/power/poweroff.c linux-2.6.32.43/kernel/power/poweroff.c
---- linux-2.6.32.43/kernel/power/poweroff.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/power/poweroff.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/power/poweroff.c linux-2.6.32.44/kernel/power/poweroff.c
+--- linux-2.6.32.44/kernel/power/poweroff.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/power/poweroff.c 2011-04-17 15:56:46.000000000 -0400
@@ -37,7 +37,7 @@ static struct sysrq_key_op sysrq_powerof
.enable_mask = SYSRQ_ENABLE_BOOT,
};
@@ -65284,9 +65250,9 @@ diff -urNp linux-2.6.32.43/kernel/power/poweroff.c linux-2.6.32.43/kernel/power/
{
register_sysrq_key('o', &sysrq_poweroff_op);
return 0;
-diff -urNp linux-2.6.32.43/kernel/power/process.c linux-2.6.32.43/kernel/power/process.c
---- linux-2.6.32.43/kernel/power/process.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/power/process.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/power/process.c linux-2.6.32.44/kernel/power/process.c
+--- linux-2.6.32.44/kernel/power/process.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/power/process.c 2011-04-17 15:56:46.000000000 -0400
@@ -37,12 +37,15 @@ static int try_to_freeze_tasks(bool sig_
struct timeval start, end;
u64 elapsed_csecs64;
@@ -65326,9 +65292,9 @@ diff -urNp linux-2.6.32.43/kernel/power/process.c linux-2.6.32.43/kernel/power/p
do_gettimeofday(&end);
elapsed_csecs64 = timeval_to_ns(&end) - timeval_to_ns(&start);
-diff -urNp linux-2.6.32.43/kernel/power/suspend.c linux-2.6.32.43/kernel/power/suspend.c
---- linux-2.6.32.43/kernel/power/suspend.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/power/suspend.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/power/suspend.c linux-2.6.32.44/kernel/power/suspend.c
+--- linux-2.6.32.44/kernel/power/suspend.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/power/suspend.c 2011-04-17 15:56:46.000000000 -0400
@@ -23,13 +23,13 @@ const char *const pm_states[PM_SUSPEND_M
[PM_SUSPEND_MEM] = "mem",
};
@@ -65345,9 +65311,9 @@ diff -urNp linux-2.6.32.43/kernel/power/suspend.c linux-2.6.32.43/kernel/power/s
{
mutex_lock(&pm_mutex);
suspend_ops = ops;
-diff -urNp linux-2.6.32.43/kernel/printk.c linux-2.6.32.43/kernel/printk.c
---- linux-2.6.32.43/kernel/printk.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/printk.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/printk.c linux-2.6.32.44/kernel/printk.c
+--- linux-2.6.32.44/kernel/printk.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/printk.c 2011-04-17 15:56:46.000000000 -0400
@@ -278,6 +278,11 @@ int do_syslog(int type, char __user *buf
char c;
int error = 0;
@@ -65360,9 +65326,9 @@ diff -urNp linux-2.6.32.43/kernel/printk.c linux-2.6.32.43/kernel/printk.c
error = security_syslog(type);
if (error)
return error;
-diff -urNp linux-2.6.32.43/kernel/profile.c linux-2.6.32.43/kernel/profile.c
---- linux-2.6.32.43/kernel/profile.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/profile.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/profile.c linux-2.6.32.44/kernel/profile.c
+--- linux-2.6.32.44/kernel/profile.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/profile.c 2011-05-04 17:56:28.000000000 -0400
@@ -39,7 +39,7 @@ struct profile_hit {
/* Oprofile timer tick hook */
static int (*timer_hook)(struct pt_regs *) __read_mostly;
@@ -65420,9 +65386,9 @@ diff -urNp linux-2.6.32.43/kernel/profile.c linux-2.6.32.43/kernel/profile.c
return count;
}
-diff -urNp linux-2.6.32.43/kernel/ptrace.c linux-2.6.32.43/kernel/ptrace.c
---- linux-2.6.32.43/kernel/ptrace.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/ptrace.c 2011-05-22 23:02:06.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/ptrace.c linux-2.6.32.44/kernel/ptrace.c
+--- linux-2.6.32.44/kernel/ptrace.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/ptrace.c 2011-05-22 23:02:06.000000000 -0400
@@ -117,7 +117,8 @@ int ptrace_check_attach(struct task_stru
return ret;
}
@@ -65604,9 +65570,9 @@ diff -urNp linux-2.6.32.43/kernel/ptrace.c linux-2.6.32.43/kernel/ptrace.c
goto out_put_task_struct;
}
-diff -urNp linux-2.6.32.43/kernel/rcutorture.c linux-2.6.32.43/kernel/rcutorture.c
---- linux-2.6.32.43/kernel/rcutorture.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/rcutorture.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/rcutorture.c linux-2.6.32.44/kernel/rcutorture.c
+--- linux-2.6.32.44/kernel/rcutorture.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/rcutorture.c 2011-05-04 17:56:28.000000000 -0400
@@ -118,12 +118,12 @@ static DEFINE_PER_CPU(long [RCU_TORTURE_
{ 0 };
static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_batch) =
@@ -65756,9 +65722,9 @@ diff -urNp linux-2.6.32.43/kernel/rcutorture.c linux-2.6.32.43/kernel/rcutorture
for_each_possible_cpu(cpu) {
for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
per_cpu(rcu_torture_count, cpu)[i] = 0;
-diff -urNp linux-2.6.32.43/kernel/rcutree.c linux-2.6.32.43/kernel/rcutree.c
---- linux-2.6.32.43/kernel/rcutree.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/rcutree.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/rcutree.c linux-2.6.32.44/kernel/rcutree.c
+--- linux-2.6.32.44/kernel/rcutree.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/rcutree.c 2011-04-17 15:56:46.000000000 -0400
@@ -1303,7 +1303,7 @@ __rcu_process_callbacks(struct rcu_state
/*
* Do softirq processing for the current CPU.
@@ -65768,9 +65734,9 @@ diff -urNp linux-2.6.32.43/kernel/rcutree.c linux-2.6.32.43/kernel/rcutree.c
{
/*
* Memory references from any prior RCU read-side critical sections
-diff -urNp linux-2.6.32.43/kernel/rcutree_plugin.h linux-2.6.32.43/kernel/rcutree_plugin.h
---- linux-2.6.32.43/kernel/rcutree_plugin.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/rcutree_plugin.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/rcutree_plugin.h linux-2.6.32.44/kernel/rcutree_plugin.h
+--- linux-2.6.32.44/kernel/rcutree_plugin.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/rcutree_plugin.h 2011-04-17 15:56:46.000000000 -0400
@@ -145,7 +145,7 @@ static void rcu_preempt_note_context_swi
*/
void __rcu_read_lock(void)
@@ -65789,9 +65755,9 @@ diff -urNp linux-2.6.32.43/kernel/rcutree_plugin.h linux-2.6.32.43/kernel/rcutre
unlikely(ACCESS_ONCE(t->rcu_read_unlock_special)))
rcu_read_unlock_special(t);
}
-diff -urNp linux-2.6.32.43/kernel/relay.c linux-2.6.32.43/kernel/relay.c
---- linux-2.6.32.43/kernel/relay.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/relay.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/relay.c linux-2.6.32.44/kernel/relay.c
+--- linux-2.6.32.44/kernel/relay.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/relay.c 2011-05-16 21:46:57.000000000 -0400
@@ -1222,7 +1222,7 @@ static int subbuf_splice_actor(struct fi
unsigned int flags,
int *nonpad_ret)
@@ -65811,9 +65777,9 @@ diff -urNp linux-2.6.32.43/kernel/relay.c linux-2.6.32.43/kernel/relay.c
if (rbuf->subbufs_produced == rbuf->subbufs_consumed)
return 0;
-diff -urNp linux-2.6.32.43/kernel/resource.c linux-2.6.32.43/kernel/resource.c
---- linux-2.6.32.43/kernel/resource.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/resource.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/resource.c linux-2.6.32.44/kernel/resource.c
+--- linux-2.6.32.44/kernel/resource.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/resource.c 2011-04-17 15:56:46.000000000 -0400
@@ -132,8 +132,18 @@ static const struct file_operations proc
static int __init ioresources_init(void)
@@ -65833,9 +65799,9 @@ diff -urNp linux-2.6.32.43/kernel/resource.c linux-2.6.32.43/kernel/resource.c
return 0;
}
__initcall(ioresources_init);
-diff -urNp linux-2.6.32.43/kernel/rtmutex.c linux-2.6.32.43/kernel/rtmutex.c
---- linux-2.6.32.43/kernel/rtmutex.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/rtmutex.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/rtmutex.c linux-2.6.32.44/kernel/rtmutex.c
+--- linux-2.6.32.44/kernel/rtmutex.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/rtmutex.c 2011-04-17 15:56:46.000000000 -0400
@@ -511,7 +511,7 @@ static void wakeup_next_waiter(struct rt
*/
spin_lock_irqsave(&pendowner->pi_lock, flags);
@@ -65845,9 +65811,9 @@ diff -urNp linux-2.6.32.43/kernel/rtmutex.c linux-2.6.32.43/kernel/rtmutex.c
WARN_ON(pendowner->pi_blocked_on != waiter);
WARN_ON(pendowner->pi_blocked_on->lock != lock);
-diff -urNp linux-2.6.32.43/kernel/rtmutex-tester.c linux-2.6.32.43/kernel/rtmutex-tester.c
---- linux-2.6.32.43/kernel/rtmutex-tester.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/rtmutex-tester.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/rtmutex-tester.c linux-2.6.32.44/kernel/rtmutex-tester.c
+--- linux-2.6.32.44/kernel/rtmutex-tester.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/rtmutex-tester.c 2011-05-04 17:56:28.000000000 -0400
@@ -21,7 +21,7 @@
#define MAX_RT_TEST_MUTEXES 8
@@ -65938,9 +65904,9 @@ diff -urNp linux-2.6.32.43/kernel/rtmutex-tester.c linux-2.6.32.43/kernel/rtmute
return;
case RTTEST_LOCKBKL:
-diff -urNp linux-2.6.32.43/kernel/sched.c linux-2.6.32.43/kernel/sched.c
---- linux-2.6.32.43/kernel/sched.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/sched.c 2011-05-22 23:02:06.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/sched.c linux-2.6.32.44/kernel/sched.c
+--- linux-2.6.32.44/kernel/sched.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/sched.c 2011-05-22 23:02:06.000000000 -0400
@@ -5043,7 +5043,7 @@ out:
* In CONFIG_NO_HZ case, the idle load balance owner will do the
* rebalancing for all the cpus for whom scheduler ticks are stopped.
@@ -66018,9 +65984,9 @@ diff -urNp linux-2.6.32.43/kernel/sched.c linux-2.6.32.43/kernel/sched.c
if (cpu != group_first_cpu(sd->groups))
return;
-diff -urNp linux-2.6.32.43/kernel/signal.c linux-2.6.32.43/kernel/signal.c
---- linux-2.6.32.43/kernel/signal.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.43/kernel/signal.c 2011-07-14 20:33:33.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/signal.c linux-2.6.32.44/kernel/signal.c
+--- linux-2.6.32.44/kernel/signal.c 2011-04-17 17:00:52.000000000 -0400
++++ linux-2.6.32.44/kernel/signal.c 2011-07-14 20:33:33.000000000 -0400
@@ -41,12 +41,12 @@
static struct kmem_cache *sigqueue_cachep;
@@ -66152,9 +66118,9 @@ diff -urNp linux-2.6.32.43/kernel/signal.c linux-2.6.32.43/kernel/signal.c
if (p && (tgid <= 0 || task_tgid_vnr(p) == tgid)) {
error = check_kill_permission(sig, info, p);
/*
-diff -urNp linux-2.6.32.43/kernel/smp.c linux-2.6.32.43/kernel/smp.c
---- linux-2.6.32.43/kernel/smp.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/smp.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/smp.c linux-2.6.32.44/kernel/smp.c
+--- linux-2.6.32.44/kernel/smp.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/smp.c 2011-04-17 15:56:46.000000000 -0400
@@ -522,22 +522,22 @@ int smp_call_function(void (*func)(void
}
EXPORT_SYMBOL(smp_call_function);
@@ -66182,9 +66148,9 @@ diff -urNp linux-2.6.32.43/kernel/smp.c linux-2.6.32.43/kernel/smp.c
{
spin_unlock_irq(&call_function.lock);
}
-diff -urNp linux-2.6.32.43/kernel/softirq.c linux-2.6.32.43/kernel/softirq.c
---- linux-2.6.32.43/kernel/softirq.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/softirq.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/softirq.c linux-2.6.32.44/kernel/softirq.c
+--- linux-2.6.32.44/kernel/softirq.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/softirq.c 2011-08-05 20:33:55.000000000 -0400
@@ -56,7 +56,7 @@ static struct softirq_action softirq_vec
static DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
@@ -66244,9 +66210,9 @@ diff -urNp linux-2.6.32.43/kernel/softirq.c linux-2.6.32.43/kernel/softirq.c
{
struct tasklet_struct *list;
-diff -urNp linux-2.6.32.43/kernel/sys.c linux-2.6.32.43/kernel/sys.c
---- linux-2.6.32.43/kernel/sys.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/sys.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/sys.c linux-2.6.32.44/kernel/sys.c
+--- linux-2.6.32.44/kernel/sys.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/sys.c 2011-08-11 19:51:54.000000000 -0400
@@ -133,6 +133,12 @@ static int set_one_prio(struct task_stru
error = -EACCES;
goto out;
@@ -66310,7 +66276,31 @@ diff -urNp linux-2.6.32.43/kernel/sys.c linux-2.6.32.43/kernel/sys.c
if (capable(CAP_SETGID))
new->gid = new->egid = new->sgid = new->fsgid = gid;
else if (gid == old->gid || gid == old->sgid)
-@@ -627,6 +640,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, u
+@@ -567,12 +580,19 @@ static int set_user(struct cred *new)
+ if (!new_user)
+ return -EAGAIN;
+
++ /*
++ * We don't fail in case of NPROC limit excess here because too many
++ * poorly written programs don't check set*uid() return code, assuming
++ * it never fails if called by root. We may still enforce NPROC limit
++ * for programs doing set*uid()+execve() by harmlessly deferring the
++ * failure to the execve() stage.
++ */
+ if (atomic_read(&new_user->processes) >=
+ current->signal->rlim[RLIMIT_NPROC].rlim_cur &&
+- new_user != INIT_USER) {
+- free_uid(new_user);
+- return -EAGAIN;
+- }
++ new_user != INIT_USER)
++ current->flags |= PF_NPROC_EXCEEDED;
++ else
++ current->flags &= ~PF_NPROC_EXCEEDED;
+
+ free_uid(new->user);
+ new->user = new_user;
+@@ -627,6 +647,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, u
goto error;
}
@@ -66320,7 +66310,7 @@ diff -urNp linux-2.6.32.43/kernel/sys.c linux-2.6.32.43/kernel/sys.c
if (new->uid != old->uid) {
retval = set_user(new);
if (retval < 0)
-@@ -675,6 +691,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
+@@ -675,6 +698,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
goto error;
retval = -EPERM;
@@ -66333,7 +66323,7 @@ diff -urNp linux-2.6.32.43/kernel/sys.c linux-2.6.32.43/kernel/sys.c
if (capable(CAP_SETUID)) {
new->suid = new->uid = uid;
if (uid != old->uid) {
-@@ -732,6 +754,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid,
+@@ -732,6 +761,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid,
goto error;
}
@@ -66343,7 +66333,7 @@ diff -urNp linux-2.6.32.43/kernel/sys.c linux-2.6.32.43/kernel/sys.c
if (ruid != (uid_t) -1) {
new->uid = ruid;
if (ruid != old->uid) {
-@@ -800,6 +825,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid,
+@@ -800,6 +832,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid,
goto error;
}
@@ -66353,7 +66343,7 @@ diff -urNp linux-2.6.32.43/kernel/sys.c linux-2.6.32.43/kernel/sys.c
if (rgid != (gid_t) -1)
new->gid = rgid;
if (egid != (gid_t) -1)
-@@ -849,6 +877,9 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
+@@ -849,6 +884,9 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
if (security_task_setuid(uid, (uid_t)-1, (uid_t)-1, LSM_SETID_FS) < 0)
goto error;
@@ -66363,7 +66353,7 @@ diff -urNp linux-2.6.32.43/kernel/sys.c linux-2.6.32.43/kernel/sys.c
if (uid == old->uid || uid == old->euid ||
uid == old->suid || uid == old->fsuid ||
capable(CAP_SETUID)) {
-@@ -889,6 +920,9 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
+@@ -889,6 +927,9 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
if (gid == old->gid || gid == old->egid ||
gid == old->sgid || gid == old->fsgid ||
capable(CAP_SETGID)) {
@@ -66373,7 +66363,7 @@ diff -urNp linux-2.6.32.43/kernel/sys.c linux-2.6.32.43/kernel/sys.c
if (gid != old_fsgid) {
new->fsgid = gid;
goto change_okay;
-@@ -1454,7 +1488,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsi
+@@ -1454,7 +1495,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsi
error = get_dumpable(me->mm);
break;
case PR_SET_DUMPABLE:
@@ -66382,9 +66372,9 @@ diff -urNp linux-2.6.32.43/kernel/sys.c linux-2.6.32.43/kernel/sys.c
error = -EINVAL;
break;
}
-diff -urNp linux-2.6.32.43/kernel/sysctl.c linux-2.6.32.43/kernel/sysctl.c
---- linux-2.6.32.43/kernel/sysctl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/sysctl.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/sysctl.c linux-2.6.32.44/kernel/sysctl.c
+--- linux-2.6.32.44/kernel/sysctl.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/sysctl.c 2011-04-17 15:56:46.000000000 -0400
@@ -63,6 +63,13 @@
static int deprecated_sysctl_warning(struct __sysctl_args *args);
@@ -66616,9 +66606,9 @@ diff -urNp linux-2.6.32.43/kernel/sysctl.c linux-2.6.32.43/kernel/sysctl.c
+EXPORT_SYMBOL(sysctl_string_modpriv);
EXPORT_SYMBOL(sysctl_data);
EXPORT_SYMBOL(unregister_sysctl_table);
-diff -urNp linux-2.6.32.43/kernel/sysctl_check.c linux-2.6.32.43/kernel/sysctl_check.c
---- linux-2.6.32.43/kernel/sysctl_check.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/sysctl_check.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/sysctl_check.c linux-2.6.32.44/kernel/sysctl_check.c
+--- linux-2.6.32.44/kernel/sysctl_check.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/sysctl_check.c 2011-04-17 15:56:46.000000000 -0400
@@ -1489,10 +1489,12 @@ int sysctl_check_table(struct nsproxy *n
} else {
if ((table->strategy == sysctl_data) ||
@@ -66632,9 +66622,9 @@ diff -urNp linux-2.6.32.43/kernel/sysctl_check.c linux-2.6.32.43/kernel/sysctl_c
(table->proc_handler == proc_dointvec) ||
(table->proc_handler == proc_dointvec_minmax) ||
(table->proc_handler == proc_dointvec_jiffies) ||
-diff -urNp linux-2.6.32.43/kernel/taskstats.c linux-2.6.32.43/kernel/taskstats.c
---- linux-2.6.32.43/kernel/taskstats.c 2011-07-13 17:23:04.000000000 -0400
-+++ linux-2.6.32.43/kernel/taskstats.c 2011-07-13 17:23:19.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/taskstats.c linux-2.6.32.44/kernel/taskstats.c
+--- linux-2.6.32.44/kernel/taskstats.c 2011-07-13 17:23:04.000000000 -0400
++++ linux-2.6.32.44/kernel/taskstats.c 2011-07-13 17:23:19.000000000 -0400
@@ -26,9 +26,12 @@
#include <linux/cgroup.h>
#include <linux/fs.h>
@@ -66658,9 +66648,9 @@ diff -urNp linux-2.6.32.43/kernel/taskstats.c linux-2.6.32.43/kernel/taskstats.c
if (!alloc_cpumask_var(&mask, GFP_KERNEL))
return -ENOMEM;
-diff -urNp linux-2.6.32.43/kernel/time/tick-broadcast.c linux-2.6.32.43/kernel/time/tick-broadcast.c
---- linux-2.6.32.43/kernel/time/tick-broadcast.c 2011-05-23 16:56:59.000000000 -0400
-+++ linux-2.6.32.43/kernel/time/tick-broadcast.c 2011-05-23 16:57:13.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/time/tick-broadcast.c linux-2.6.32.44/kernel/time/tick-broadcast.c
+--- linux-2.6.32.44/kernel/time/tick-broadcast.c 2011-05-23 16:56:59.000000000 -0400
++++ linux-2.6.32.44/kernel/time/tick-broadcast.c 2011-05-23 16:57:13.000000000 -0400
@@ -116,7 +116,7 @@ int tick_device_uses_broadcast(struct cl
* then clear the broadcast bit.
*/
@@ -66670,9 +66660,9 @@ diff -urNp linux-2.6.32.43/kernel/time/tick-broadcast.c linux-2.6.32.43/kernel/t
cpumask_clear_cpu(cpu, tick_get_broadcast_mask());
tick_broadcast_clear_oneshot(cpu);
-diff -urNp linux-2.6.32.43/kernel/time/timekeeping.c linux-2.6.32.43/kernel/time/timekeeping.c
---- linux-2.6.32.43/kernel/time/timekeeping.c 2011-06-25 12:55:35.000000000 -0400
-+++ linux-2.6.32.43/kernel/time/timekeeping.c 2011-06-25 12:56:37.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/time/timekeeping.c linux-2.6.32.44/kernel/time/timekeeping.c
+--- linux-2.6.32.44/kernel/time/timekeeping.c 2011-06-25 12:55:35.000000000 -0400
++++ linux-2.6.32.44/kernel/time/timekeeping.c 2011-06-25 12:56:37.000000000 -0400
@@ -14,6 +14,7 @@
#include <linux/init.h>
#include <linux/mm.h>
@@ -66699,9 +66689,9 @@ diff -urNp linux-2.6.32.43/kernel/time/timekeeping.c linux-2.6.32.43/kernel/time
write_seqlock_irqsave(&xtime_lock, flags);
timekeeping_forward_now();
-diff -urNp linux-2.6.32.43/kernel/time/timer_list.c linux-2.6.32.43/kernel/time/timer_list.c
---- linux-2.6.32.43/kernel/time/timer_list.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/time/timer_list.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/time/timer_list.c linux-2.6.32.44/kernel/time/timer_list.c
+--- linux-2.6.32.44/kernel/time/timer_list.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/time/timer_list.c 2011-04-17 15:56:46.000000000 -0400
@@ -38,12 +38,16 @@ DECLARE_PER_CPU(struct hrtimer_cpu_base,
static void print_name_offset(struct seq_file *m, void *sym)
@@ -66743,9 +66733,9 @@ diff -urNp linux-2.6.32.43/kernel/time/timer_list.c linux-2.6.32.43/kernel/time/
if (!pe)
return -ENOMEM;
return 0;
-diff -urNp linux-2.6.32.43/kernel/time/timer_stats.c linux-2.6.32.43/kernel/time/timer_stats.c
---- linux-2.6.32.43/kernel/time/timer_stats.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/time/timer_stats.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/time/timer_stats.c linux-2.6.32.44/kernel/time/timer_stats.c
+--- linux-2.6.32.44/kernel/time/timer_stats.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/time/timer_stats.c 2011-05-04 17:56:28.000000000 -0400
@@ -116,7 +116,7 @@ static ktime_t time_start, time_stop;
static unsigned long nr_entries;
static struct entry entries[MAX_ENTRIES];
@@ -66814,9 +66804,9 @@ diff -urNp linux-2.6.32.43/kernel/time/timer_stats.c linux-2.6.32.43/kernel/time
if (!pe)
return -ENOMEM;
return 0;
-diff -urNp linux-2.6.32.43/kernel/time.c linux-2.6.32.43/kernel/time.c
---- linux-2.6.32.43/kernel/time.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/time.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/time.c linux-2.6.32.44/kernel/time.c
+--- linux-2.6.32.44/kernel/time.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/time.c 2011-04-17 15:56:46.000000000 -0400
@@ -165,6 +165,11 @@ int do_sys_settimeofday(struct timespec
return error;
@@ -66847,9 +66837,9 @@ diff -urNp linux-2.6.32.43/kernel/time.c linux-2.6.32.43/kernel/time.c
{
#if HZ <= USEC_PER_SEC && !(USEC_PER_SEC % HZ)
return (USEC_PER_SEC / HZ) * j;
-diff -urNp linux-2.6.32.43/kernel/timer.c linux-2.6.32.43/kernel/timer.c
---- linux-2.6.32.43/kernel/timer.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/timer.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/timer.c linux-2.6.32.44/kernel/timer.c
+--- linux-2.6.32.44/kernel/timer.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/timer.c 2011-04-17 15:56:46.000000000 -0400
@@ -1213,7 +1213,7 @@ void update_process_times(int user_tick)
/*
* This function runs timers and the timer-tq in bottom half context.
@@ -66859,9 +66849,9 @@ diff -urNp linux-2.6.32.43/kernel/timer.c linux-2.6.32.43/kernel/timer.c
{
struct tvec_base *base = __get_cpu_var(tvec_bases);
-diff -urNp linux-2.6.32.43/kernel/trace/blktrace.c linux-2.6.32.43/kernel/trace/blktrace.c
---- linux-2.6.32.43/kernel/trace/blktrace.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/trace/blktrace.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/trace/blktrace.c linux-2.6.32.44/kernel/trace/blktrace.c
+--- linux-2.6.32.44/kernel/trace/blktrace.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/trace/blktrace.c 2011-05-04 17:56:28.000000000 -0400
@@ -313,7 +313,7 @@ static ssize_t blk_dropped_read(struct f
struct blk_trace *bt = filp->private_data;
char buf[16];
@@ -66889,9 +66879,9 @@ diff -urNp linux-2.6.32.43/kernel/trace/blktrace.c linux-2.6.32.43/kernel/trace/
ret = -EIO;
bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt,
-diff -urNp linux-2.6.32.43/kernel/trace/ftrace.c linux-2.6.32.43/kernel/trace/ftrace.c
---- linux-2.6.32.43/kernel/trace/ftrace.c 2011-06-25 12:55:35.000000000 -0400
-+++ linux-2.6.32.43/kernel/trace/ftrace.c 2011-06-25 12:56:37.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/trace/ftrace.c linux-2.6.32.44/kernel/trace/ftrace.c
+--- linux-2.6.32.44/kernel/trace/ftrace.c 2011-06-25 12:55:35.000000000 -0400
++++ linux-2.6.32.44/kernel/trace/ftrace.c 2011-06-25 12:56:37.000000000 -0400
@@ -1100,13 +1100,18 @@ ftrace_code_disable(struct module *mod,
ip = rec->ip;
@@ -66913,9 +66903,9 @@ diff -urNp linux-2.6.32.43/kernel/trace/ftrace.c linux-2.6.32.43/kernel/trace/ft
}
/*
-diff -urNp linux-2.6.32.43/kernel/trace/ring_buffer.c linux-2.6.32.43/kernel/trace/ring_buffer.c
---- linux-2.6.32.43/kernel/trace/ring_buffer.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/trace/ring_buffer.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/trace/ring_buffer.c linux-2.6.32.44/kernel/trace/ring_buffer.c
+--- linux-2.6.32.44/kernel/trace/ring_buffer.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/trace/ring_buffer.c 2011-04-17 15:56:46.000000000 -0400
@@ -606,7 +606,7 @@ static struct list_head *rb_list_head(st
* the reader page). But if the next page is a header page,
* its flags will be non zero.
@@ -66925,9 +66915,9 @@ diff -urNp linux-2.6.32.43/kernel/trace/ring_buffer.c linux-2.6.32.43/kernel/tra
rb_is_head_page(struct ring_buffer_per_cpu *cpu_buffer,
struct buffer_page *page, struct list_head *list)
{
-diff -urNp linux-2.6.32.43/kernel/trace/trace.c linux-2.6.32.43/kernel/trace/trace.c
---- linux-2.6.32.43/kernel/trace/trace.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/trace/trace.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/trace/trace.c linux-2.6.32.44/kernel/trace/trace.c
+--- linux-2.6.32.44/kernel/trace/trace.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/trace/trace.c 2011-05-16 21:46:57.000000000 -0400
@@ -3193,6 +3193,8 @@ static ssize_t tracing_splice_read_pipe(
size_t rem;
unsigned int i;
@@ -66970,9 +66960,9 @@ diff -urNp linux-2.6.32.43/kernel/trace/trace.c linux-2.6.32.43/kernel/trace/tra
static int once;
struct dentry *d_tracer;
-diff -urNp linux-2.6.32.43/kernel/trace/trace_events.c linux-2.6.32.43/kernel/trace/trace_events.c
---- linux-2.6.32.43/kernel/trace/trace_events.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/trace/trace_events.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/trace/trace_events.c linux-2.6.32.44/kernel/trace/trace_events.c
+--- linux-2.6.32.44/kernel/trace/trace_events.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/trace/trace_events.c 2011-08-05 20:33:55.000000000 -0400
@@ -951,13 +951,10 @@ static LIST_HEAD(ftrace_module_file_list
* Modules must own their file_operations to keep up with
* reference counting.
@@ -67023,9 +67013,9 @@ diff -urNp linux-2.6.32.43/kernel/trace/trace_events.c linux-2.6.32.43/kernel/tr
}
}
-diff -urNp linux-2.6.32.43/kernel/trace/trace_mmiotrace.c linux-2.6.32.43/kernel/trace/trace_mmiotrace.c
---- linux-2.6.32.43/kernel/trace/trace_mmiotrace.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/trace/trace_mmiotrace.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/trace/trace_mmiotrace.c linux-2.6.32.44/kernel/trace/trace_mmiotrace.c
+--- linux-2.6.32.44/kernel/trace/trace_mmiotrace.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/trace/trace_mmiotrace.c 2011-05-04 17:56:28.000000000 -0400
@@ -23,7 +23,7 @@ struct header_iter {
static struct trace_array *mmio_trace_array;
static bool overrun_detected;
@@ -67062,9 +67052,9 @@ diff -urNp linux-2.6.32.43/kernel/trace/trace_mmiotrace.c linux-2.6.32.43/kernel
return;
}
entry = ring_buffer_event_data(event);
-diff -urNp linux-2.6.32.43/kernel/trace/trace_output.c linux-2.6.32.43/kernel/trace/trace_output.c
---- linux-2.6.32.43/kernel/trace/trace_output.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/trace/trace_output.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/trace/trace_output.c linux-2.6.32.44/kernel/trace/trace_output.c
+--- linux-2.6.32.44/kernel/trace/trace_output.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/trace/trace_output.c 2011-04-17 15:56:46.000000000 -0400
@@ -237,7 +237,7 @@ int trace_seq_path(struct trace_seq *s,
return 0;
p = d_path(path, s->buffer + s->len, PAGE_SIZE - s->len);
@@ -67074,9 +67064,9 @@ diff -urNp linux-2.6.32.43/kernel/trace/trace_output.c linux-2.6.32.43/kernel/tr
if (p) {
s->len = p - s->buffer;
return 1;
-diff -urNp linux-2.6.32.43/kernel/trace/trace_stack.c linux-2.6.32.43/kernel/trace/trace_stack.c
---- linux-2.6.32.43/kernel/trace/trace_stack.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/trace/trace_stack.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/trace/trace_stack.c linux-2.6.32.44/kernel/trace/trace_stack.c
+--- linux-2.6.32.44/kernel/trace/trace_stack.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/trace/trace_stack.c 2011-04-17 15:56:46.000000000 -0400
@@ -50,7 +50,7 @@ static inline void check_stack(void)
return;
@@ -67086,9 +67076,9 @@ diff -urNp linux-2.6.32.43/kernel/trace/trace_stack.c linux-2.6.32.43/kernel/tra
return;
local_irq_save(flags);
-diff -urNp linux-2.6.32.43/kernel/trace/trace_workqueue.c linux-2.6.32.43/kernel/trace/trace_workqueue.c
---- linux-2.6.32.43/kernel/trace/trace_workqueue.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/trace/trace_workqueue.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/trace/trace_workqueue.c linux-2.6.32.44/kernel/trace/trace_workqueue.c
+--- linux-2.6.32.44/kernel/trace/trace_workqueue.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/trace/trace_workqueue.c 2011-04-17 15:56:46.000000000 -0400
@@ -21,7 +21,7 @@ struct cpu_workqueue_stats {
int cpu;
pid_t pid;
@@ -67116,9 +67106,9 @@ diff -urNp linux-2.6.32.43/kernel/trace/trace_workqueue.c linux-2.6.32.43/kernel
tsk->comm);
put_task_struct(tsk);
}
-diff -urNp linux-2.6.32.43/kernel/user.c linux-2.6.32.43/kernel/user.c
---- linux-2.6.32.43/kernel/user.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/kernel/user.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/kernel/user.c linux-2.6.32.44/kernel/user.c
+--- linux-2.6.32.44/kernel/user.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/kernel/user.c 2011-04-17 15:56:46.000000000 -0400
@@ -159,6 +159,7 @@ struct user_struct *alloc_uid(struct use
spin_lock_irq(&uidhash_lock);
up = uid_hash_find(uid, hashent);
@@ -67127,9 +67117,9 @@ diff -urNp linux-2.6.32.43/kernel/user.c linux-2.6.32.43/kernel/user.c
key_put(new->uid_keyring);
key_put(new->session_keyring);
kmem_cache_free(uid_cachep, new);
-diff -urNp linux-2.6.32.43/lib/bug.c linux-2.6.32.43/lib/bug.c
---- linux-2.6.32.43/lib/bug.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/lib/bug.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/lib/bug.c linux-2.6.32.44/lib/bug.c
+--- linux-2.6.32.44/lib/bug.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/lib/bug.c 2011-04-17 15:56:46.000000000 -0400
@@ -135,6 +135,8 @@ enum bug_trap_type report_bug(unsigned l
return BUG_TRAP_TYPE_NONE;
@@ -67139,9 +67129,9 @@ diff -urNp linux-2.6.32.43/lib/bug.c linux-2.6.32.43/lib/bug.c
printk(KERN_EMERG "------------[ cut here ]------------\n");
-diff -urNp linux-2.6.32.43/lib/debugobjects.c linux-2.6.32.43/lib/debugobjects.c
---- linux-2.6.32.43/lib/debugobjects.c 2011-07-13 17:23:04.000000000 -0400
-+++ linux-2.6.32.43/lib/debugobjects.c 2011-07-13 17:23:19.000000000 -0400
+diff -urNp linux-2.6.32.44/lib/debugobjects.c linux-2.6.32.44/lib/debugobjects.c
+--- linux-2.6.32.44/lib/debugobjects.c 2011-07-13 17:23:04.000000000 -0400
++++ linux-2.6.32.44/lib/debugobjects.c 2011-07-13 17:23:19.000000000 -0400
@@ -277,7 +277,7 @@ static void debug_object_is_on_stack(voi
if (limit > 4)
return;
@@ -67151,9 +67141,9 @@ diff -urNp linux-2.6.32.43/lib/debugobjects.c linux-2.6.32.43/lib/debugobjects.c
if (is_on_stack == onstack)
return;
-diff -urNp linux-2.6.32.43/lib/dma-debug.c linux-2.6.32.43/lib/dma-debug.c
---- linux-2.6.32.43/lib/dma-debug.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/lib/dma-debug.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/lib/dma-debug.c linux-2.6.32.44/lib/dma-debug.c
+--- linux-2.6.32.44/lib/dma-debug.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/lib/dma-debug.c 2011-04-17 15:56:46.000000000 -0400
@@ -861,7 +861,7 @@ out:
static void check_for_stack(struct device *dev, void *addr)
@@ -67163,9 +67153,9 @@ diff -urNp linux-2.6.32.43/lib/dma-debug.c linux-2.6.32.43/lib/dma-debug.c
err_printk(dev, NULL, "DMA-API: device driver maps memory from"
"stack [addr=%p]\n", addr);
}
-diff -urNp linux-2.6.32.43/lib/idr.c linux-2.6.32.43/lib/idr.c
---- linux-2.6.32.43/lib/idr.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/lib/idr.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/lib/idr.c linux-2.6.32.44/lib/idr.c
+--- linux-2.6.32.44/lib/idr.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/lib/idr.c 2011-04-17 15:56:46.000000000 -0400
@@ -156,7 +156,7 @@ static int sub_alloc(struct idr *idp, in
id = (id | ((1 << (IDR_BITS * l)) - 1)) + 1;
@@ -67175,9 +67165,9 @@ diff -urNp linux-2.6.32.43/lib/idr.c linux-2.6.32.43/lib/idr.c
*starting_id = id;
return IDR_NEED_TO_GROW;
}
-diff -urNp linux-2.6.32.43/lib/inflate.c linux-2.6.32.43/lib/inflate.c
---- linux-2.6.32.43/lib/inflate.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/lib/inflate.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/lib/inflate.c linux-2.6.32.44/lib/inflate.c
+--- linux-2.6.32.44/lib/inflate.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/lib/inflate.c 2011-04-17 15:56:46.000000000 -0400
@@ -266,7 +266,7 @@ static void free(void *where)
malloc_ptr = free_mem_ptr;
}
@@ -67187,9 +67177,9 @@ diff -urNp linux-2.6.32.43/lib/inflate.c linux-2.6.32.43/lib/inflate.c
#define free(a) kfree(a)
#endif
-diff -urNp linux-2.6.32.43/lib/Kconfig.debug linux-2.6.32.43/lib/Kconfig.debug
---- linux-2.6.32.43/lib/Kconfig.debug 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/lib/Kconfig.debug 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/lib/Kconfig.debug linux-2.6.32.44/lib/Kconfig.debug
+--- linux-2.6.32.44/lib/Kconfig.debug 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/lib/Kconfig.debug 2011-04-17 15:56:46.000000000 -0400
@@ -905,7 +905,7 @@ config LATENCYTOP
select STACKTRACE
select SCHEDSTATS
@@ -67199,9 +67189,9 @@ diff -urNp linux-2.6.32.43/lib/Kconfig.debug linux-2.6.32.43/lib/Kconfig.debug
help
Enable this option if you want to use the LatencyTOP tool
to find out which userspace is blocking on what kernel operations.
-diff -urNp linux-2.6.32.43/lib/kobject.c linux-2.6.32.43/lib/kobject.c
---- linux-2.6.32.43/lib/kobject.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/lib/kobject.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/lib/kobject.c linux-2.6.32.44/lib/kobject.c
+--- linux-2.6.32.44/lib/kobject.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/lib/kobject.c 2011-04-17 15:56:46.000000000 -0400
@@ -700,7 +700,7 @@ static ssize_t kobj_attr_store(struct ko
return ret;
}
@@ -67229,9 +67219,9 @@ diff -urNp linux-2.6.32.43/lib/kobject.c linux-2.6.32.43/lib/kobject.c
struct kobject *parent_kobj)
{
struct kset *kset;
-diff -urNp linux-2.6.32.43/lib/kobject_uevent.c linux-2.6.32.43/lib/kobject_uevent.c
---- linux-2.6.32.43/lib/kobject_uevent.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/lib/kobject_uevent.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/lib/kobject_uevent.c linux-2.6.32.44/lib/kobject_uevent.c
+--- linux-2.6.32.44/lib/kobject_uevent.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/lib/kobject_uevent.c 2011-04-17 15:56:46.000000000 -0400
@@ -95,7 +95,7 @@ int kobject_uevent_env(struct kobject *k
const char *subsystem;
struct kobject *top_kobj;
@@ -67241,9 +67231,9 @@ diff -urNp linux-2.6.32.43/lib/kobject_uevent.c linux-2.6.32.43/lib/kobject_ueve
u64 seq;
int i = 0;
int retval = 0;
-diff -urNp linux-2.6.32.43/lib/kref.c linux-2.6.32.43/lib/kref.c
---- linux-2.6.32.43/lib/kref.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/lib/kref.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/lib/kref.c linux-2.6.32.44/lib/kref.c
+--- linux-2.6.32.44/lib/kref.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/lib/kref.c 2011-04-17 15:56:46.000000000 -0400
@@ -61,7 +61,7 @@ void kref_get(struct kref *kref)
*/
int kref_put(struct kref *kref, void (*release)(struct kref *kref))
@@ -67253,9 +67243,9 @@ diff -urNp linux-2.6.32.43/lib/kref.c linux-2.6.32.43/lib/kref.c
WARN_ON(release == (void (*)(struct kref *))kfree);
if (atomic_dec_and_test(&kref->refcount)) {
-diff -urNp linux-2.6.32.43/lib/Makefile linux-2.6.32.43/lib/Makefile
---- linux-2.6.32.43/lib/Makefile 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/lib/Makefile 2011-08-07 19:48:09.000000000 -0400
+diff -urNp linux-2.6.32.44/lib/Makefile linux-2.6.32.44/lib/Makefile
+--- linux-2.6.32.44/lib/Makefile 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/lib/Makefile 2011-08-07 19:48:09.000000000 -0400
@@ -10,7 +10,7 @@ endif
lib-y := ctype.o string.o vsprintf.o cmdline.o \
rbtree.o radix-tree.o dump_stack.o \
@@ -67265,9 +67255,9 @@ diff -urNp linux-2.6.32.43/lib/Makefile linux-2.6.32.43/lib/Makefile
proportions.o prio_heap.o ratelimit.o show_mem.o \
is_single_threaded.o plist.o decompress.o flex_array.o
-diff -urNp linux-2.6.32.43/lib/md5.c linux-2.6.32.43/lib/md5.c
---- linux-2.6.32.43/lib/md5.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/lib/md5.c 2011-08-07 19:48:09.000000000 -0400
+diff -urNp linux-2.6.32.44/lib/md5.c linux-2.6.32.44/lib/md5.c
+--- linux-2.6.32.44/lib/md5.c 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/lib/md5.c 2011-08-07 19:48:09.000000000 -0400
@@ -0,0 +1,95 @@
+#include <linux/kernel.h>
+#include <linux/module.h>
@@ -67364,9 +67354,9 @@ diff -urNp linux-2.6.32.43/lib/md5.c linux-2.6.32.43/lib/md5.c
+ hash[3] += d;
+}
+EXPORT_SYMBOL(md5_transform);
-diff -urNp linux-2.6.32.43/lib/parser.c linux-2.6.32.43/lib/parser.c
---- linux-2.6.32.43/lib/parser.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/lib/parser.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/lib/parser.c linux-2.6.32.44/lib/parser.c
+--- linux-2.6.32.44/lib/parser.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/lib/parser.c 2011-04-17 15:56:46.000000000 -0400
@@ -126,7 +126,7 @@ static int match_number(substring_t *s,
char *buf;
int ret;
@@ -67376,9 +67366,9 @@ diff -urNp linux-2.6.32.43/lib/parser.c linux-2.6.32.43/lib/parser.c
if (!buf)
return -ENOMEM;
memcpy(buf, s->from, s->to - s->from);
-diff -urNp linux-2.6.32.43/lib/radix-tree.c linux-2.6.32.43/lib/radix-tree.c
---- linux-2.6.32.43/lib/radix-tree.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/lib/radix-tree.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/lib/radix-tree.c linux-2.6.32.44/lib/radix-tree.c
+--- linux-2.6.32.44/lib/radix-tree.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/lib/radix-tree.c 2011-04-17 15:56:46.000000000 -0400
@@ -81,7 +81,7 @@ struct radix_tree_preload {
int nr;
struct radix_tree_node *nodes[RADIX_TREE_MAX_PATH];
@@ -67388,9 +67378,9 @@ diff -urNp linux-2.6.32.43/lib/radix-tree.c linux-2.6.32.43/lib/radix-tree.c
static inline gfp_t root_gfp_mask(struct radix_tree_root *root)
{
-diff -urNp linux-2.6.32.43/lib/random32.c linux-2.6.32.43/lib/random32.c
---- linux-2.6.32.43/lib/random32.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/lib/random32.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/lib/random32.c linux-2.6.32.44/lib/random32.c
+--- linux-2.6.32.44/lib/random32.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/lib/random32.c 2011-04-17 15:56:46.000000000 -0400
@@ -61,7 +61,7 @@ static u32 __random32(struct rnd_state *
*/
static inline u32 __seed(u32 x, u32 m)
@@ -67400,9 +67390,9 @@ diff -urNp linux-2.6.32.43/lib/random32.c linux-2.6.32.43/lib/random32.c
}
/**
-diff -urNp linux-2.6.32.43/lib/vsprintf.c linux-2.6.32.43/lib/vsprintf.c
---- linux-2.6.32.43/lib/vsprintf.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/lib/vsprintf.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/lib/vsprintf.c linux-2.6.32.44/lib/vsprintf.c
+--- linux-2.6.32.44/lib/vsprintf.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/lib/vsprintf.c 2011-04-17 15:56:46.000000000 -0400
@@ -16,6 +16,9 @@
* - scnprintf and vscnprintf
*/
@@ -67503,14 +67493,14 @@ diff -urNp linux-2.6.32.43/lib/vsprintf.c linux-2.6.32.43/lib/vsprintf.c
break;
}
-diff -urNp linux-2.6.32.43/localversion-grsec linux-2.6.32.43/localversion-grsec
---- linux-2.6.32.43/localversion-grsec 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/localversion-grsec 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/localversion-grsec linux-2.6.32.44/localversion-grsec
+--- linux-2.6.32.44/localversion-grsec 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/localversion-grsec 2011-04-17 15:56:46.000000000 -0400
@@ -0,0 +1 @@
+-grsec
-diff -urNp linux-2.6.32.43/Makefile linux-2.6.32.43/Makefile
---- linux-2.6.32.43/Makefile 2011-07-13 17:23:04.000000000 -0400
-+++ linux-2.6.32.43/Makefile 2011-08-07 14:32:43.000000000 -0400
+diff -urNp linux-2.6.32.44/Makefile linux-2.6.32.44/Makefile
+--- linux-2.6.32.44/Makefile 2011-08-09 18:35:28.000000000 -0400
++++ linux-2.6.32.44/Makefile 2011-08-09 18:33:56.000000000 -0400
@@ -221,8 +221,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH"
HOSTCC = gcc
@@ -67635,9 +67625,18 @@ diff -urNp linux-2.6.32.43/Makefile linux-2.6.32.43/Makefile
$(call cmd,tags)
# Scripts to check various things for consistency
-diff -urNp linux-2.6.32.43/mm/backing-dev.c linux-2.6.32.43/mm/backing-dev.c
---- linux-2.6.32.43/mm/backing-dev.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/mm/backing-dev.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/mm/backing-dev.c linux-2.6.32.44/mm/backing-dev.c
+--- linux-2.6.32.44/mm/backing-dev.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/mm/backing-dev.c 2011-08-11 19:48:17.000000000 -0400
+@@ -272,7 +272,7 @@ static void bdi_task_init(struct backing
+ list_add_tail_rcu(&wb->list, &bdi->wb_list);
+ spin_unlock(&bdi->wb_lock);
+
+- tsk->flags |= PF_FLUSHER | PF_SWAPWRITE;
++ tsk->flags |= PF_SWAPWRITE;
+ set_freezable();
+
+ /*
@@ -484,7 +484,7 @@ static void bdi_add_to_pending(struct rc
* Add the default flusher task that gets created for any bdi
* that has dirty data pending writeout
@@ -67647,9 +67646,9 @@ diff -urNp linux-2.6.32.43/mm/backing-dev.c linux-2.6.32.43/mm/backing-dev.c
{
if (!bdi_cap_writeback_dirty(bdi))
return;
-diff -urNp linux-2.6.32.43/mm/filemap.c linux-2.6.32.43/mm/filemap.c
---- linux-2.6.32.43/mm/filemap.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/mm/filemap.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/mm/filemap.c linux-2.6.32.44/mm/filemap.c
+--- linux-2.6.32.44/mm/filemap.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/mm/filemap.c 2011-04-17 15:56:46.000000000 -0400
@@ -1631,7 +1631,7 @@ int generic_file_mmap(struct file * file
struct address_space *mapping = file->f_mapping;
@@ -67667,9 +67666,9 @@ diff -urNp linux-2.6.32.43/mm/filemap.c linux-2.6.32.43/mm/filemap.c
if (*pos >= limit) {
send_sig(SIGXFSZ, current, 0);
return -EFBIG;
-diff -urNp linux-2.6.32.43/mm/fremap.c linux-2.6.32.43/mm/fremap.c
---- linux-2.6.32.43/mm/fremap.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/mm/fremap.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/mm/fremap.c linux-2.6.32.44/mm/fremap.c
+--- linux-2.6.32.44/mm/fremap.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/mm/fremap.c 2011-04-17 15:56:46.000000000 -0400
@@ -153,6 +153,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
retry:
vma = find_vma(mm, start);
@@ -67691,9 +67690,9 @@ diff -urNp linux-2.6.32.43/mm/fremap.c linux-2.6.32.43/mm/fremap.c
munlock_vma_pages_range(vma, start, start + size);
vma->vm_flags = saved_flags;
}
-diff -urNp linux-2.6.32.43/mm/highmem.c linux-2.6.32.43/mm/highmem.c
---- linux-2.6.32.43/mm/highmem.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/mm/highmem.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/mm/highmem.c linux-2.6.32.44/mm/highmem.c
+--- linux-2.6.32.44/mm/highmem.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/mm/highmem.c 2011-04-17 15:56:46.000000000 -0400
@@ -116,9 +116,10 @@ static void flush_all_zero_pkmaps(void)
* So no dangers, even with speculative execution.
*/
@@ -67719,9 +67718,9 @@ diff -urNp linux-2.6.32.43/mm/highmem.c linux-2.6.32.43/mm/highmem.c
pkmap_count[last_pkmap_nr] = 1;
set_page_address(page, (void *)vaddr);
-diff -urNp linux-2.6.32.43/mm/hugetlb.c linux-2.6.32.43/mm/hugetlb.c
---- linux-2.6.32.43/mm/hugetlb.c 2011-07-13 17:23:04.000000000 -0400
-+++ linux-2.6.32.43/mm/hugetlb.c 2011-07-13 17:23:19.000000000 -0400
+diff -urNp linux-2.6.32.44/mm/hugetlb.c linux-2.6.32.44/mm/hugetlb.c
+--- linux-2.6.32.44/mm/hugetlb.c 2011-07-13 17:23:04.000000000 -0400
++++ linux-2.6.32.44/mm/hugetlb.c 2011-07-13 17:23:19.000000000 -0400
@@ -1933,6 +1933,26 @@ static int unmap_ref_private(struct mm_s
return 1;
}
@@ -67801,9 +67800,9 @@ diff -urNp linux-2.6.32.43/mm/hugetlb.c linux-2.6.32.43/mm/hugetlb.c
ptep = huge_pte_alloc(mm, address, huge_page_size(h));
if (!ptep)
return VM_FAULT_OOM;
-diff -urNp linux-2.6.32.43/mm/internal.h linux-2.6.32.43/mm/internal.h
---- linux-2.6.32.43/mm/internal.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/mm/internal.h 2011-07-09 09:13:08.000000000 -0400
+diff -urNp linux-2.6.32.44/mm/internal.h linux-2.6.32.44/mm/internal.h
+--- linux-2.6.32.44/mm/internal.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/mm/internal.h 2011-07-09 09:13:08.000000000 -0400
@@ -49,6 +49,7 @@ extern void putback_lru_page(struct page
* in mm/page_alloc.c
*/
@@ -67812,9 +67811,9 @@ diff -urNp linux-2.6.32.43/mm/internal.h linux-2.6.32.43/mm/internal.h
extern void prep_compound_page(struct page *page, unsigned long order);
-diff -urNp linux-2.6.32.43/mm/Kconfig linux-2.6.32.43/mm/Kconfig
---- linux-2.6.32.43/mm/Kconfig 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/mm/Kconfig 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/mm/Kconfig linux-2.6.32.44/mm/Kconfig
+--- linux-2.6.32.44/mm/Kconfig 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/mm/Kconfig 2011-04-17 15:56:46.000000000 -0400
@@ -228,7 +228,7 @@ config KSM
config DEFAULT_MMAP_MIN_ADDR
int "Low address space to protect from user allocation"
@@ -67824,9 +67823,9 @@ diff -urNp linux-2.6.32.43/mm/Kconfig linux-2.6.32.43/mm/Kconfig
help
This is the portion of low virtual memory which should be protected
from userspace allocation. Keeping a user from writing to low pages
-diff -urNp linux-2.6.32.43/mm/kmemleak.c linux-2.6.32.43/mm/kmemleak.c
---- linux-2.6.32.43/mm/kmemleak.c 2011-06-25 12:55:35.000000000 -0400
-+++ linux-2.6.32.43/mm/kmemleak.c 2011-06-25 12:56:37.000000000 -0400
+diff -urNp linux-2.6.32.44/mm/kmemleak.c linux-2.6.32.44/mm/kmemleak.c
+--- linux-2.6.32.44/mm/kmemleak.c 2011-06-25 12:55:35.000000000 -0400
++++ linux-2.6.32.44/mm/kmemleak.c 2011-06-25 12:56:37.000000000 -0400
@@ -358,7 +358,7 @@ static void print_unreferenced(struct se
for (i = 0; i < object->trace_len; i++) {
@@ -67836,9 +67835,9 @@ diff -urNp linux-2.6.32.43/mm/kmemleak.c linux-2.6.32.43/mm/kmemleak.c
}
}
-diff -urNp linux-2.6.32.43/mm/maccess.c linux-2.6.32.43/mm/maccess.c
---- linux-2.6.32.43/mm/maccess.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/mm/maccess.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/mm/maccess.c linux-2.6.32.44/mm/maccess.c
+--- linux-2.6.32.44/mm/maccess.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/mm/maccess.c 2011-04-17 15:56:46.000000000 -0400
@@ -14,7 +14,7 @@
* Safely read from address @src to the buffer at @dst. If a kernel fault
* happens, handle that and return -EFAULT.
@@ -67857,9 +67856,9 @@ diff -urNp linux-2.6.32.43/mm/maccess.c linux-2.6.32.43/mm/maccess.c
{
long ret;
mm_segment_t old_fs = get_fs();
-diff -urNp linux-2.6.32.43/mm/madvise.c linux-2.6.32.43/mm/madvise.c
---- linux-2.6.32.43/mm/madvise.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/mm/madvise.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/mm/madvise.c linux-2.6.32.44/mm/madvise.c
+--- linux-2.6.32.44/mm/madvise.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/mm/madvise.c 2011-04-17 15:56:46.000000000 -0400
@@ -44,6 +44,10 @@ static long madvise_behavior(struct vm_a
pgoff_t pgoff;
unsigned long new_flags = vma->vm_flags;
@@ -67936,9 +67935,9 @@ diff -urNp linux-2.6.32.43/mm/madvise.c linux-2.6.32.43/mm/madvise.c
error = 0;
if (end == start)
goto out;
-diff -urNp linux-2.6.32.43/mm/memory.c linux-2.6.32.43/mm/memory.c
---- linux-2.6.32.43/mm/memory.c 2011-07-13 17:23:04.000000000 -0400
-+++ linux-2.6.32.43/mm/memory.c 2011-07-13 17:23:23.000000000 -0400
+diff -urNp linux-2.6.32.44/mm/memory.c linux-2.6.32.44/mm/memory.c
+--- linux-2.6.32.44/mm/memory.c 2011-07-13 17:23:04.000000000 -0400
++++ linux-2.6.32.44/mm/memory.c 2011-07-13 17:23:23.000000000 -0400
@@ -187,8 +187,12 @@ static inline void free_pmd_range(struct
return;
@@ -68468,9 +68467,9 @@ diff -urNp linux-2.6.32.43/mm/memory.c linux-2.6.32.43/mm/memory.c
/*
* Make sure the vDSO gets into every core dump.
* Dumping its contents makes post-mortem fully interpretable later
-diff -urNp linux-2.6.32.43/mm/memory-failure.c linux-2.6.32.43/mm/memory-failure.c
---- linux-2.6.32.43/mm/memory-failure.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/mm/memory-failure.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/mm/memory-failure.c linux-2.6.32.44/mm/memory-failure.c
+--- linux-2.6.32.44/mm/memory-failure.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/mm/memory-failure.c 2011-04-17 15:56:46.000000000 -0400
@@ -46,7 +46,7 @@ int sysctl_memory_failure_early_kill __r
int sysctl_memory_failure_recovery __read_mostly = 1;
@@ -68489,9 +68488,9 @@ diff -urNp linux-2.6.32.43/mm/memory-failure.c linux-2.6.32.43/mm/memory-failure
/*
* We need/can do nothing about count=0 pages.
-diff -urNp linux-2.6.32.43/mm/mempolicy.c linux-2.6.32.43/mm/mempolicy.c
---- linux-2.6.32.43/mm/mempolicy.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/mm/mempolicy.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/mm/mempolicy.c linux-2.6.32.44/mm/mempolicy.c
+--- linux-2.6.32.44/mm/mempolicy.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/mm/mempolicy.c 2011-04-17 15:56:46.000000000 -0400
@@ -573,6 +573,10 @@ static int mbind_range(struct vm_area_st
struct vm_area_struct *next;
int err;
@@ -68572,9 +68571,9 @@ diff -urNp linux-2.6.32.43/mm/mempolicy.c linux-2.6.32.43/mm/mempolicy.c
} else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
seq_printf(m, " heap");
} else if (vma->vm_start <= mm->start_stack &&
-diff -urNp linux-2.6.32.43/mm/migrate.c linux-2.6.32.43/mm/migrate.c
---- linux-2.6.32.43/mm/migrate.c 2011-07-13 17:23:04.000000000 -0400
-+++ linux-2.6.32.43/mm/migrate.c 2011-07-13 17:23:23.000000000 -0400
+diff -urNp linux-2.6.32.44/mm/migrate.c linux-2.6.32.44/mm/migrate.c
+--- linux-2.6.32.44/mm/migrate.c 2011-07-13 17:23:04.000000000 -0400
++++ linux-2.6.32.44/mm/migrate.c 2011-07-13 17:23:23.000000000 -0400
@@ -916,6 +916,8 @@ static int do_pages_move(struct mm_struc
unsigned long chunk_start;
int err;
@@ -68609,9 +68608,9 @@ diff -urNp linux-2.6.32.43/mm/migrate.c linux-2.6.32.43/mm/migrate.c
rcu_read_unlock();
err = -EPERM;
goto out;
-diff -urNp linux-2.6.32.43/mm/mlock.c linux-2.6.32.43/mm/mlock.c
---- linux-2.6.32.43/mm/mlock.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/mm/mlock.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/mm/mlock.c linux-2.6.32.44/mm/mlock.c
+--- linux-2.6.32.44/mm/mlock.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/mm/mlock.c 2011-04-17 15:56:46.000000000 -0400
@@ -13,6 +13,7 @@
#include <linux/pagemap.h>
#include <linux/mempolicy.h>
@@ -68722,9 +68721,9 @@ diff -urNp linux-2.6.32.43/mm/mlock.c linux-2.6.32.43/mm/mlock.c
if (!(flags & MCL_CURRENT) || (current->mm->total_vm <= lock_limit) ||
capable(CAP_IPC_LOCK))
ret = do_mlockall(flags);
-diff -urNp linux-2.6.32.43/mm/mmap.c linux-2.6.32.43/mm/mmap.c
---- linux-2.6.32.43/mm/mmap.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/mm/mmap.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/mm/mmap.c linux-2.6.32.44/mm/mmap.c
+--- linux-2.6.32.44/mm/mmap.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/mm/mmap.c 2011-04-17 15:56:46.000000000 -0400
@@ -45,6 +45,16 @@
#define arch_rebalance_pgtables(addr, len) (addr)
#endif
@@ -69941,9 +69940,9 @@ diff -urNp linux-2.6.32.43/mm/mmap.c linux-2.6.32.43/mm/mmap.c
vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND;
vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
-diff -urNp linux-2.6.32.43/mm/mprotect.c linux-2.6.32.43/mm/mprotect.c
---- linux-2.6.32.43/mm/mprotect.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/mm/mprotect.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/mm/mprotect.c linux-2.6.32.44/mm/mprotect.c
+--- linux-2.6.32.44/mm/mprotect.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/mm/mprotect.c 2011-04-17 15:56:46.000000000 -0400
@@ -24,10 +24,16 @@
#include <linux/mmu_notifier.h>
#include <linux/migrate.h>
@@ -70166,9 +70165,9 @@ diff -urNp linux-2.6.32.43/mm/mprotect.c linux-2.6.32.43/mm/mprotect.c
nstart = tmp;
if (nstart < prev->vm_end)
-diff -urNp linux-2.6.32.43/mm/mremap.c linux-2.6.32.43/mm/mremap.c
---- linux-2.6.32.43/mm/mremap.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.43/mm/mremap.c 2011-04-17 17:03:58.000000000 -0400
+diff -urNp linux-2.6.32.44/mm/mremap.c linux-2.6.32.44/mm/mremap.c
+--- linux-2.6.32.44/mm/mremap.c 2011-04-17 17:00:52.000000000 -0400
++++ linux-2.6.32.44/mm/mremap.c 2011-04-17 17:03:58.000000000 -0400
@@ -112,6 +112,12 @@ static void move_ptes(struct vm_area_str
continue;
pte = ptep_clear_flush(vma, old_addr, old_pte);
@@ -70273,9 +70272,9 @@ diff -urNp linux-2.6.32.43/mm/mremap.c linux-2.6.32.43/mm/mremap.c
}
out:
if (ret & ~PAGE_MASK)
-diff -urNp linux-2.6.32.43/mm/nommu.c linux-2.6.32.43/mm/nommu.c
---- linux-2.6.32.43/mm/nommu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/mm/nommu.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/mm/nommu.c linux-2.6.32.44/mm/nommu.c
+--- linux-2.6.32.44/mm/nommu.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/mm/nommu.c 2011-04-17 15:56:46.000000000 -0400
@@ -67,7 +67,6 @@ int sysctl_overcommit_memory = OVERCOMMI
int sysctl_overcommit_ratio = 50; /* default is 50% */
int sysctl_max_map_count = DEFAULT_MAX_MAP_COUNT;
@@ -70300,9 +70299,9 @@ diff -urNp linux-2.6.32.43/mm/nommu.c linux-2.6.32.43/mm/nommu.c
* expand a stack to a given address
* - not supported under NOMMU conditions
*/
-diff -urNp linux-2.6.32.43/mm/page_alloc.c linux-2.6.32.43/mm/page_alloc.c
---- linux-2.6.32.43/mm/page_alloc.c 2011-06-25 12:55:35.000000000 -0400
-+++ linux-2.6.32.43/mm/page_alloc.c 2011-07-09 09:13:08.000000000 -0400
+diff -urNp linux-2.6.32.44/mm/page_alloc.c linux-2.6.32.44/mm/page_alloc.c
+--- linux-2.6.32.44/mm/page_alloc.c 2011-06-25 12:55:35.000000000 -0400
++++ linux-2.6.32.44/mm/page_alloc.c 2011-07-09 09:13:08.000000000 -0400
@@ -289,7 +289,7 @@ out:
* This usage means that zero-order pages may not be compound.
*/
@@ -70377,9 +70376,9 @@ diff -urNp linux-2.6.32.43/mm/page_alloc.c linux-2.6.32.43/mm/page_alloc.c
struct zone *zone, unsigned long zonesize) {}
#endif /* CONFIG_SPARSEMEM */
-diff -urNp linux-2.6.32.43/mm/percpu.c linux-2.6.32.43/mm/percpu.c
---- linux-2.6.32.43/mm/percpu.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/mm/percpu.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/mm/percpu.c linux-2.6.32.44/mm/percpu.c
+--- linux-2.6.32.44/mm/percpu.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/mm/percpu.c 2011-04-17 15:56:46.000000000 -0400
@@ -115,7 +115,7 @@ static unsigned int pcpu_first_unit_cpu
static unsigned int pcpu_last_unit_cpu __read_mostly;
@@ -70389,9 +70388,9 @@ diff -urNp linux-2.6.32.43/mm/percpu.c linux-2.6.32.43/mm/percpu.c
EXPORT_SYMBOL_GPL(pcpu_base_addr);
static const int *pcpu_unit_map __read_mostly; /* cpu -> unit */
-diff -urNp linux-2.6.32.43/mm/rmap.c linux-2.6.32.43/mm/rmap.c
---- linux-2.6.32.43/mm/rmap.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/mm/rmap.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/mm/rmap.c linux-2.6.32.44/mm/rmap.c
+--- linux-2.6.32.44/mm/rmap.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/mm/rmap.c 2011-04-17 15:56:46.000000000 -0400
@@ -121,6 +121,17 @@ int anon_vma_prepare(struct vm_area_stru
/* page_table_lock to protect against threads */
spin_lock(&mm->page_table_lock);
@@ -70410,9 +70409,9 @@ diff -urNp linux-2.6.32.43/mm/rmap.c linux-2.6.32.43/mm/rmap.c
vma->anon_vma = anon_vma;
list_add_tail(&vma->anon_vma_node, &anon_vma->head);
allocated = NULL;
-diff -urNp linux-2.6.32.43/mm/shmem.c linux-2.6.32.43/mm/shmem.c
---- linux-2.6.32.43/mm/shmem.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/mm/shmem.c 2011-05-18 20:09:37.000000000 -0400
+diff -urNp linux-2.6.32.44/mm/shmem.c linux-2.6.32.44/mm/shmem.c
+--- linux-2.6.32.44/mm/shmem.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/mm/shmem.c 2011-05-18 20:09:37.000000000 -0400
@@ -31,7 +31,7 @@
#include <linux/swap.h>
#include <linux/ima.h>
@@ -70459,9 +70458,9 @@ diff -urNp linux-2.6.32.43/mm/shmem.c linux-2.6.32.43/mm/shmem.c
if (!sbinfo)
return -ENOMEM;
-diff -urNp linux-2.6.32.43/mm/slab.c linux-2.6.32.43/mm/slab.c
---- linux-2.6.32.43/mm/slab.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/mm/slab.c 2011-05-04 17:56:20.000000000 -0400
+diff -urNp linux-2.6.32.44/mm/slab.c linux-2.6.32.44/mm/slab.c
+--- linux-2.6.32.44/mm/slab.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/mm/slab.c 2011-05-04 17:56:20.000000000 -0400
@@ -174,7 +174,7 @@
/* Legal flag mask for kmem_cache_create(). */
@@ -70624,9 +70623,9 @@ diff -urNp linux-2.6.32.43/mm/slab.c linux-2.6.32.43/mm/slab.c
/**
* ksize - get the actual amount of memory allocated for a given object
* @objp: Pointer to the object
-diff -urNp linux-2.6.32.43/mm/slob.c linux-2.6.32.43/mm/slob.c
---- linux-2.6.32.43/mm/slob.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/mm/slob.c 2011-07-06 19:53:33.000000000 -0400
+diff -urNp linux-2.6.32.44/mm/slob.c linux-2.6.32.44/mm/slob.c
+--- linux-2.6.32.44/mm/slob.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/mm/slob.c 2011-07-06 19:53:33.000000000 -0400
@@ -29,7 +29,7 @@
* If kmalloc is asked for objects of PAGE_SIZE or larger, it calls
* alloc_pages() directly, allocating compound pages so the page order
@@ -70976,9 +70975,9 @@ diff -urNp linux-2.6.32.43/mm/slob.c linux-2.6.32.43/mm/slob.c
}
EXPORT_SYMBOL(kmem_cache_free);
-diff -urNp linux-2.6.32.43/mm/slub.c linux-2.6.32.43/mm/slub.c
---- linux-2.6.32.43/mm/slub.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/mm/slub.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/mm/slub.c linux-2.6.32.44/mm/slub.c
+--- linux-2.6.32.44/mm/slub.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/mm/slub.c 2011-04-17 15:56:46.000000000 -0400
@@ -410,7 +410,7 @@ static void print_track(const char *s, s
if (!t->addr)
return;
@@ -71189,9 +71188,9 @@ diff -urNp linux-2.6.32.43/mm/slub.c linux-2.6.32.43/mm/slub.c
return 0;
}
module_init(slab_proc_init);
-diff -urNp linux-2.6.32.43/mm/swap.c linux-2.6.32.43/mm/swap.c
---- linux-2.6.32.43/mm/swap.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/mm/swap.c 2011-07-09 09:15:19.000000000 -0400
+diff -urNp linux-2.6.32.44/mm/swap.c linux-2.6.32.44/mm/swap.c
+--- linux-2.6.32.44/mm/swap.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/mm/swap.c 2011-07-09 09:15:19.000000000 -0400
@@ -30,6 +30,7 @@
#include <linux/notifier.h>
#include <linux/backing-dev.h>
@@ -71209,9 +71208,9 @@ diff -urNp linux-2.6.32.43/mm/swap.c linux-2.6.32.43/mm/swap.c
(*dtor)(page);
}
}
-diff -urNp linux-2.6.32.43/mm/util.c linux-2.6.32.43/mm/util.c
---- linux-2.6.32.43/mm/util.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/mm/util.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/mm/util.c linux-2.6.32.44/mm/util.c
+--- linux-2.6.32.44/mm/util.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/mm/util.c 2011-04-17 15:56:46.000000000 -0400
@@ -228,6 +228,12 @@ EXPORT_SYMBOL(strndup_user);
void arch_pick_mmap_layout(struct mm_struct *mm)
{
@@ -71225,9 +71224,9 @@ diff -urNp linux-2.6.32.43/mm/util.c linux-2.6.32.43/mm/util.c
mm->get_unmapped_area = arch_get_unmapped_area;
mm->unmap_area = arch_unmap_area;
}
-diff -urNp linux-2.6.32.43/mm/vmalloc.c linux-2.6.32.43/mm/vmalloc.c
---- linux-2.6.32.43/mm/vmalloc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/mm/vmalloc.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/mm/vmalloc.c linux-2.6.32.44/mm/vmalloc.c
+--- linux-2.6.32.44/mm/vmalloc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/mm/vmalloc.c 2011-04-17 15:56:46.000000000 -0400
@@ -40,8 +40,19 @@ static void vunmap_pte_range(pmd_t *pmd,
pte = pte_offset_kernel(pmd, addr);
@@ -71464,9 +71463,9 @@ diff -urNp linux-2.6.32.43/mm/vmalloc.c linux-2.6.32.43/mm/vmalloc.c
if ((PAGE_SIZE-1) & (unsigned long)addr)
return -EINVAL;
-diff -urNp linux-2.6.32.43/mm/vmstat.c linux-2.6.32.43/mm/vmstat.c
---- linux-2.6.32.43/mm/vmstat.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/mm/vmstat.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/mm/vmstat.c linux-2.6.32.44/mm/vmstat.c
+--- linux-2.6.32.44/mm/vmstat.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/mm/vmstat.c 2011-04-17 15:56:46.000000000 -0400
@@ -74,7 +74,7 @@ void vm_events_fold_cpu(int cpu)
*
* vm_stat contains the global counters
@@ -71519,9 +71518,9 @@ diff -urNp linux-2.6.32.43/mm/vmstat.c linux-2.6.32.43/mm/vmstat.c
#endif
return 0;
}
-diff -urNp linux-2.6.32.43/net/8021q/vlan.c linux-2.6.32.43/net/8021q/vlan.c
---- linux-2.6.32.43/net/8021q/vlan.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/8021q/vlan.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/net/8021q/vlan.c linux-2.6.32.44/net/8021q/vlan.c
+--- linux-2.6.32.44/net/8021q/vlan.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/8021q/vlan.c 2011-04-17 15:56:46.000000000 -0400
@@ -622,8 +622,7 @@ static int vlan_ioctl_handler(struct net
err = -EPERM;
if (!capable(CAP_NET_ADMIN))
@@ -71532,9 +71531,9 @@ diff -urNp linux-2.6.32.43/net/8021q/vlan.c linux-2.6.32.43/net/8021q/vlan.c
struct vlan_net *vn;
vn = net_generic(net, vlan_net_id);
-diff -urNp linux-2.6.32.43/net/atm/atm_misc.c linux-2.6.32.43/net/atm/atm_misc.c
---- linux-2.6.32.43/net/atm/atm_misc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/atm/atm_misc.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/net/atm/atm_misc.c linux-2.6.32.44/net/atm/atm_misc.c
+--- linux-2.6.32.44/net/atm/atm_misc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/atm/atm_misc.c 2011-04-17 15:56:46.000000000 -0400
@@ -19,7 +19,7 @@ int atm_charge(struct atm_vcc *vcc,int t
if (atomic_read(&sk_atm(vcc)->sk_rmem_alloc) <= sk_atm(vcc)->sk_rcvbuf)
return 1;
@@ -71571,9 +71570,9 @@ diff -urNp linux-2.6.32.43/net/atm/atm_misc.c linux-2.6.32.43/net/atm/atm_misc.c
__SONET_ITEMS
#undef __HANDLE_ITEM
}
-diff -urNp linux-2.6.32.43/net/atm/lec.h linux-2.6.32.43/net/atm/lec.h
---- linux-2.6.32.43/net/atm/lec.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/atm/lec.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/net/atm/lec.h linux-2.6.32.44/net/atm/lec.h
+--- linux-2.6.32.44/net/atm/lec.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/atm/lec.h 2011-08-05 20:33:55.000000000 -0400
@@ -48,7 +48,7 @@ struct lane2_ops {
const u8 *tlvs, u32 sizeoftlvs);
void (*associate_indicator) (struct net_device *dev, const u8 *mac_addr,
@@ -71583,9 +71582,9 @@ diff -urNp linux-2.6.32.43/net/atm/lec.h linux-2.6.32.43/net/atm/lec.h
/*
* ATM LAN Emulation supports both LLC & Dix Ethernet EtherType
-diff -urNp linux-2.6.32.43/net/atm/mpc.c linux-2.6.32.43/net/atm/mpc.c
---- linux-2.6.32.43/net/atm/mpc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/atm/mpc.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/net/atm/mpc.c linux-2.6.32.44/net/atm/mpc.c
+--- linux-2.6.32.44/net/atm/mpc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/atm/mpc.c 2011-08-05 20:33:55.000000000 -0400
@@ -291,8 +291,8 @@ static void start_mpc(struct mpoa_client
printk("mpoa: (%s) start_mpc not starting\n", dev->name);
else {
@@ -71597,9 +71596,9 @@ diff -urNp linux-2.6.32.43/net/atm/mpc.c linux-2.6.32.43/net/atm/mpc.c
dev->netdev_ops = &mpc->new_ops;
}
}
-diff -urNp linux-2.6.32.43/net/atm/mpoa_caches.c linux-2.6.32.43/net/atm/mpoa_caches.c
---- linux-2.6.32.43/net/atm/mpoa_caches.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/atm/mpoa_caches.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/net/atm/mpoa_caches.c linux-2.6.32.44/net/atm/mpoa_caches.c
+--- linux-2.6.32.44/net/atm/mpoa_caches.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/atm/mpoa_caches.c 2011-05-16 21:46:57.000000000 -0400
@@ -498,6 +498,8 @@ static void clear_expired(struct mpoa_cl
struct timeval now;
struct k_message msg;
@@ -71609,9 +71608,9 @@ diff -urNp linux-2.6.32.43/net/atm/mpoa_caches.c linux-2.6.32.43/net/atm/mpoa_ca
do_gettimeofday(&now);
write_lock_irq(&client->egress_lock);
-diff -urNp linux-2.6.32.43/net/atm/proc.c linux-2.6.32.43/net/atm/proc.c
---- linux-2.6.32.43/net/atm/proc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/atm/proc.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/net/atm/proc.c linux-2.6.32.44/net/atm/proc.c
+--- linux-2.6.32.44/net/atm/proc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/atm/proc.c 2011-04-17 15:56:46.000000000 -0400
@@ -43,9 +43,9 @@ static void add_stats(struct seq_file *s
const struct k_atm_aal_stats *stats)
{
@@ -71650,9 +71649,9 @@ diff -urNp linux-2.6.32.43/net/atm/proc.c linux-2.6.32.43/net/atm/proc.c
else
seq_printf(seq, "%3d %3d %5d ",
vcc->dev->number, vcc->vpi, vcc->vci);
-diff -urNp linux-2.6.32.43/net/atm/resources.c linux-2.6.32.43/net/atm/resources.c
---- linux-2.6.32.43/net/atm/resources.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/atm/resources.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/net/atm/resources.c linux-2.6.32.44/net/atm/resources.c
+--- linux-2.6.32.44/net/atm/resources.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/atm/resources.c 2011-04-17 15:56:46.000000000 -0400
@@ -161,7 +161,7 @@ void atm_dev_deregister(struct atm_dev *
static void copy_aal_stats(struct k_atm_aal_stats *from,
struct atm_aal_stats *to)
@@ -71671,9 +71670,9 @@ diff -urNp linux-2.6.32.43/net/atm/resources.c linux-2.6.32.43/net/atm/resources
__AAL_STAT_ITEMS
#undef __HANDLE_ITEM
}
-diff -urNp linux-2.6.32.43/net/bluetooth/l2cap.c linux-2.6.32.43/net/bluetooth/l2cap.c
---- linux-2.6.32.43/net/bluetooth/l2cap.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/bluetooth/l2cap.c 2011-06-25 14:36:21.000000000 -0400
+diff -urNp linux-2.6.32.44/net/bluetooth/l2cap.c linux-2.6.32.44/net/bluetooth/l2cap.c
+--- linux-2.6.32.44/net/bluetooth/l2cap.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/bluetooth/l2cap.c 2011-06-25 14:36:21.000000000 -0400
@@ -1885,7 +1885,7 @@ static int l2cap_sock_getsockopt_old(str
err = -ENOTCONN;
break;
@@ -71692,9 +71691,9 @@ diff -urNp linux-2.6.32.43/net/bluetooth/l2cap.c linux-2.6.32.43/net/bluetooth/l
l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
l2cap_build_conf_rsp(sk, rsp,
L2CAP_CONF_REJECT, flags), rsp);
-diff -urNp linux-2.6.32.43/net/bluetooth/rfcomm/sock.c linux-2.6.32.43/net/bluetooth/rfcomm/sock.c
---- linux-2.6.32.43/net/bluetooth/rfcomm/sock.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/bluetooth/rfcomm/sock.c 2011-06-12 06:35:00.000000000 -0400
+diff -urNp linux-2.6.32.44/net/bluetooth/rfcomm/sock.c linux-2.6.32.44/net/bluetooth/rfcomm/sock.c
+--- linux-2.6.32.44/net/bluetooth/rfcomm/sock.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/bluetooth/rfcomm/sock.c 2011-06-12 06:35:00.000000000 -0400
@@ -878,6 +878,7 @@ static int rfcomm_sock_getsockopt_old(st
l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
@@ -71703,10 +71702,10 @@ diff -urNp linux-2.6.32.43/net/bluetooth/rfcomm/sock.c linux-2.6.32.43/net/bluet
cinfo.hci_handle = l2cap_pi(l2cap_sk)->conn->hcon->handle;
memcpy(cinfo.dev_class, l2cap_pi(l2cap_sk)->conn->hcon->dev_class, 3);
-diff -urNp linux-2.6.32.43/net/bridge/br_private.h linux-2.6.32.43/net/bridge/br_private.h
---- linux-2.6.32.43/net/bridge/br_private.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/bridge/br_private.h 2011-04-17 15:56:46.000000000 -0400
-@@ -254,7 +254,7 @@ extern void br_ifinfo_notify(int event,
+diff -urNp linux-2.6.32.44/net/bridge/br_private.h linux-2.6.32.44/net/bridge/br_private.h
+--- linux-2.6.32.44/net/bridge/br_private.h 2011-08-09 18:35:30.000000000 -0400
++++ linux-2.6.32.44/net/bridge/br_private.h 2011-08-09 18:34:01.000000000 -0400
+@@ -255,7 +255,7 @@ extern void br_ifinfo_notify(int event,
#ifdef CONFIG_SYSFS
/* br_sysfs_if.c */
@@ -71715,9 +71714,9 @@ diff -urNp linux-2.6.32.43/net/bridge/br_private.h linux-2.6.32.43/net/bridge/br
extern int br_sysfs_addif(struct net_bridge_port *p);
/* br_sysfs_br.c */
-diff -urNp linux-2.6.32.43/net/bridge/br_stp_if.c linux-2.6.32.43/net/bridge/br_stp_if.c
---- linux-2.6.32.43/net/bridge/br_stp_if.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/bridge/br_stp_if.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/net/bridge/br_stp_if.c linux-2.6.32.44/net/bridge/br_stp_if.c
+--- linux-2.6.32.44/net/bridge/br_stp_if.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/bridge/br_stp_if.c 2011-04-17 15:56:46.000000000 -0400
@@ -146,7 +146,7 @@ static void br_stp_stop(struct net_bridg
char *envp[] = { NULL };
@@ -71727,9 +71726,9 @@ diff -urNp linux-2.6.32.43/net/bridge/br_stp_if.c linux-2.6.32.43/net/bridge/br_
printk(KERN_INFO "%s: userspace STP stopped, return code %d\n",
br->dev->name, r);
-diff -urNp linux-2.6.32.43/net/bridge/br_sysfs_if.c linux-2.6.32.43/net/bridge/br_sysfs_if.c
---- linux-2.6.32.43/net/bridge/br_sysfs_if.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/bridge/br_sysfs_if.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/net/bridge/br_sysfs_if.c linux-2.6.32.44/net/bridge/br_sysfs_if.c
+--- linux-2.6.32.44/net/bridge/br_sysfs_if.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/bridge/br_sysfs_if.c 2011-04-17 15:56:46.000000000 -0400
@@ -220,7 +220,7 @@ static ssize_t brport_store(struct kobje
return ret;
}
@@ -71739,9 +71738,9 @@ diff -urNp linux-2.6.32.43/net/bridge/br_sysfs_if.c linux-2.6.32.43/net/bridge/b
.show = brport_show,
.store = brport_store,
};
-diff -urNp linux-2.6.32.43/net/bridge/netfilter/ebtables.c linux-2.6.32.43/net/bridge/netfilter/ebtables.c
---- linux-2.6.32.43/net/bridge/netfilter/ebtables.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.43/net/bridge/netfilter/ebtables.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/net/bridge/netfilter/ebtables.c linux-2.6.32.44/net/bridge/netfilter/ebtables.c
+--- linux-2.6.32.44/net/bridge/netfilter/ebtables.c 2011-04-17 17:00:52.000000000 -0400
++++ linux-2.6.32.44/net/bridge/netfilter/ebtables.c 2011-05-16 21:46:57.000000000 -0400
@@ -1337,6 +1337,8 @@ static int copy_everything_to_user(struc
unsigned int entries_size, nentries;
char *entries;
@@ -71751,9 +71750,9 @@ diff -urNp linux-2.6.32.43/net/bridge/netfilter/ebtables.c linux-2.6.32.43/net/b
if (cmd == EBT_SO_GET_ENTRIES) {
entries_size = t->private->entries_size;
nentries = t->private->nentries;
-diff -urNp linux-2.6.32.43/net/can/bcm.c linux-2.6.32.43/net/can/bcm.c
---- linux-2.6.32.43/net/can/bcm.c 2011-05-10 22:12:01.000000000 -0400
-+++ linux-2.6.32.43/net/can/bcm.c 2011-05-10 22:12:34.000000000 -0400
+diff -urNp linux-2.6.32.44/net/can/bcm.c linux-2.6.32.44/net/can/bcm.c
+--- linux-2.6.32.44/net/can/bcm.c 2011-05-10 22:12:01.000000000 -0400
++++ linux-2.6.32.44/net/can/bcm.c 2011-05-10 22:12:34.000000000 -0400
@@ -164,9 +164,15 @@ static int bcm_proc_show(struct seq_file
struct bcm_sock *bo = bcm_sk(sk);
struct bcm_op *op;
@@ -71770,9 +71769,9 @@ diff -urNp linux-2.6.32.43/net/can/bcm.c linux-2.6.32.43/net/can/bcm.c
seq_printf(m, " / dropped %lu", bo->dropped_usr_msgs);
seq_printf(m, " / bound %s", bcm_proc_getifname(ifname, bo->ifindex));
seq_printf(m, " <<<\n");
-diff -urNp linux-2.6.32.43/net/core/dev.c linux-2.6.32.43/net/core/dev.c
---- linux-2.6.32.43/net/core/dev.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.43/net/core/dev.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/net/core/dev.c linux-2.6.32.44/net/core/dev.c
+--- linux-2.6.32.44/net/core/dev.c 2011-04-17 17:00:52.000000000 -0400
++++ linux-2.6.32.44/net/core/dev.c 2011-08-05 20:33:55.000000000 -0400
@@ -1047,10 +1047,14 @@ void dev_load(struct net *net, const cha
if (no_module && capable(CAP_NET_ADMIN))
no_module = request_module("netdev-%s", name);
@@ -71815,9 +71814,9 @@ diff -urNp linux-2.6.32.43/net/core/dev.c linux-2.6.32.43/net/core/dev.c
{
struct list_head *list = &__get_cpu_var(softnet_data).poll_list;
unsigned long time_limit = jiffies + 2;
-diff -urNp linux-2.6.32.43/net/core/flow.c linux-2.6.32.43/net/core/flow.c
---- linux-2.6.32.43/net/core/flow.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/core/flow.c 2011-05-04 17:56:20.000000000 -0400
+diff -urNp linux-2.6.32.44/net/core/flow.c linux-2.6.32.44/net/core/flow.c
+--- linux-2.6.32.44/net/core/flow.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/core/flow.c 2011-05-04 17:56:20.000000000 -0400
@@ -35,11 +35,11 @@ struct flow_cache_entry {
atomic_t *object_ref;
};
@@ -71877,9 +71876,9 @@ diff -urNp linux-2.6.32.43/net/core/flow.c linux-2.6.32.43/net/core/flow.c
if (!fle->object || fle->genid == genid)
continue;
-diff -urNp linux-2.6.32.43/net/core/Makefile linux-2.6.32.43/net/core/Makefile
---- linux-2.6.32.43/net/core/Makefile 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/core/Makefile 2011-08-07 19:48:09.000000000 -0400
+diff -urNp linux-2.6.32.44/net/core/Makefile linux-2.6.32.44/net/core/Makefile
+--- linux-2.6.32.44/net/core/Makefile 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/core/Makefile 2011-08-07 19:48:09.000000000 -0400
@@ -3,7 +3,7 @@
#
@@ -71889,9 +71888,9 @@ diff -urNp linux-2.6.32.43/net/core/Makefile linux-2.6.32.43/net/core/Makefile
obj-$(CONFIG_SYSCTL) += sysctl_net_core.o
obj-$(CONFIG_HAS_DMA) += skb_dma_map.o
-diff -urNp linux-2.6.32.43/net/core/rtnetlink.c linux-2.6.32.43/net/core/rtnetlink.c
---- linux-2.6.32.43/net/core/rtnetlink.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/core/rtnetlink.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/net/core/rtnetlink.c linux-2.6.32.44/net/core/rtnetlink.c
+--- linux-2.6.32.44/net/core/rtnetlink.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/core/rtnetlink.c 2011-08-05 20:33:55.000000000 -0400
@@ -57,7 +57,7 @@ struct rtnl_link
{
rtnl_doit_func doit;
@@ -71901,9 +71900,9 @@ diff -urNp linux-2.6.32.43/net/core/rtnetlink.c linux-2.6.32.43/net/core/rtnetli
static DEFINE_MUTEX(rtnl_mutex);
-diff -urNp linux-2.6.32.43/net/core/secure_seq.c linux-2.6.32.43/net/core/secure_seq.c
---- linux-2.6.32.43/net/core/secure_seq.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/net/core/secure_seq.c 2011-08-07 19:48:09.000000000 -0400
+diff -urNp linux-2.6.32.44/net/core/secure_seq.c linux-2.6.32.44/net/core/secure_seq.c
+--- linux-2.6.32.44/net/core/secure_seq.c 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/net/core/secure_seq.c 2011-08-07 19:48:09.000000000 -0400
@@ -0,0 +1,183 @@
+#include <linux/kernel.h>
+#include <linux/init.h>
@@ -72088,9 +72087,9 @@ diff -urNp linux-2.6.32.43/net/core/secure_seq.c linux-2.6.32.43/net/core/secure
+EXPORT_SYMBOL(secure_dccpv6_sequence_number);
+#endif
+#endif
-diff -urNp linux-2.6.32.43/net/core/skbuff.c linux-2.6.32.43/net/core/skbuff.c
---- linux-2.6.32.43/net/core/skbuff.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/core/skbuff.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/net/core/skbuff.c linux-2.6.32.44/net/core/skbuff.c
+--- linux-2.6.32.44/net/core/skbuff.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/core/skbuff.c 2011-05-16 21:46:57.000000000 -0400
@@ -1544,6 +1544,8 @@ int skb_splice_bits(struct sk_buff *skb,
struct sk_buff *frag_iter;
struct sock *sk = skb->sk;
@@ -72100,9 +72099,9 @@ diff -urNp linux-2.6.32.43/net/core/skbuff.c linux-2.6.32.43/net/core/skbuff.c
/*
* __skb_splice_bits() only fails if the output has no room left,
* so no point in going over the frag_list for the error case.
-diff -urNp linux-2.6.32.43/net/core/sock.c linux-2.6.32.43/net/core/sock.c
---- linux-2.6.32.43/net/core/sock.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/core/sock.c 2011-05-04 17:56:20.000000000 -0400
+diff -urNp linux-2.6.32.44/net/core/sock.c linux-2.6.32.44/net/core/sock.c
+--- linux-2.6.32.44/net/core/sock.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/core/sock.c 2011-05-04 17:56:20.000000000 -0400
@@ -864,11 +864,15 @@ int sock_getsockopt(struct socket *sock,
break;
@@ -72129,9 +72128,9 @@ diff -urNp linux-2.6.32.43/net/core/sock.c linux-2.6.32.43/net/core/sock.c
}
EXPORT_SYMBOL(sock_init_data);
-diff -urNp linux-2.6.32.43/net/dccp/ipv4.c linux-2.6.32.43/net/dccp/ipv4.c
---- linux-2.6.32.43/net/dccp/ipv4.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/dccp/ipv4.c 2011-08-07 19:48:09.000000000 -0400
+diff -urNp linux-2.6.32.44/net/dccp/ipv4.c linux-2.6.32.44/net/dccp/ipv4.c
+--- linux-2.6.32.44/net/dccp/ipv4.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/dccp/ipv4.c 2011-08-07 19:48:09.000000000 -0400
@@ -25,6 +25,7 @@
#include <net/timewait_sock.h>
#include <net/tcp_states.h>
@@ -72140,9 +72139,9 @@ diff -urNp linux-2.6.32.43/net/dccp/ipv4.c linux-2.6.32.43/net/dccp/ipv4.c
#include "ackvec.h"
#include "ccid.h"
-diff -urNp linux-2.6.32.43/net/dccp/ipv6.c linux-2.6.32.43/net/dccp/ipv6.c
---- linux-2.6.32.43/net/dccp/ipv6.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/dccp/ipv6.c 2011-08-07 19:48:09.000000000 -0400
+diff -urNp linux-2.6.32.44/net/dccp/ipv6.c linux-2.6.32.44/net/dccp/ipv6.c
+--- linux-2.6.32.44/net/dccp/ipv6.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/dccp/ipv6.c 2011-08-07 19:48:09.000000000 -0400
@@ -28,6 +28,7 @@
#include <net/transp_v6.h>
#include <net/ip6_checksum.h>
@@ -72166,9 +72165,9 @@ diff -urNp linux-2.6.32.43/net/dccp/ipv6.c linux-2.6.32.43/net/dccp/ipv6.c
{
return secure_dccpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
ipv6_hdr(skb)->saddr.s6_addr32,
-diff -urNp linux-2.6.32.43/net/decnet/sysctl_net_decnet.c linux-2.6.32.43/net/decnet/sysctl_net_decnet.c
---- linux-2.6.32.43/net/decnet/sysctl_net_decnet.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/decnet/sysctl_net_decnet.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/net/decnet/sysctl_net_decnet.c linux-2.6.32.44/net/decnet/sysctl_net_decnet.c
+--- linux-2.6.32.44/net/decnet/sysctl_net_decnet.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/decnet/sysctl_net_decnet.c 2011-04-17 15:56:46.000000000 -0400
@@ -206,7 +206,7 @@ static int dn_node_address_handler(ctl_t
if (len > *lenp) len = *lenp;
@@ -72187,9 +72186,9 @@ diff -urNp linux-2.6.32.43/net/decnet/sysctl_net_decnet.c linux-2.6.32.43/net/de
return -EFAULT;
*lenp = len;
-diff -urNp linux-2.6.32.43/net/econet/Kconfig linux-2.6.32.43/net/econet/Kconfig
---- linux-2.6.32.43/net/econet/Kconfig 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/econet/Kconfig 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/net/econet/Kconfig linux-2.6.32.44/net/econet/Kconfig
+--- linux-2.6.32.44/net/econet/Kconfig 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/econet/Kconfig 2011-04-17 15:56:46.000000000 -0400
@@ -4,7 +4,7 @@
config ECONET
@@ -72199,9 +72198,9 @@ diff -urNp linux-2.6.32.43/net/econet/Kconfig linux-2.6.32.43/net/econet/Kconfig
---help---
Econet is a fairly old and slow networking protocol mainly used by
Acorn computers to access file and print servers. It uses native
-diff -urNp linux-2.6.32.43/net/ieee802154/dgram.c linux-2.6.32.43/net/ieee802154/dgram.c
---- linux-2.6.32.43/net/ieee802154/dgram.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/ieee802154/dgram.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/net/ieee802154/dgram.c linux-2.6.32.44/net/ieee802154/dgram.c
+--- linux-2.6.32.44/net/ieee802154/dgram.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/ieee802154/dgram.c 2011-05-04 17:56:28.000000000 -0400
@@ -318,7 +318,7 @@ out:
static int dgram_rcv_skb(struct sock *sk, struct sk_buff *skb)
{
@@ -72211,9 +72210,9 @@ diff -urNp linux-2.6.32.43/net/ieee802154/dgram.c linux-2.6.32.43/net/ieee802154
kfree_skb(skb);
return NET_RX_DROP;
}
-diff -urNp linux-2.6.32.43/net/ieee802154/raw.c linux-2.6.32.43/net/ieee802154/raw.c
---- linux-2.6.32.43/net/ieee802154/raw.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/ieee802154/raw.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/net/ieee802154/raw.c linux-2.6.32.44/net/ieee802154/raw.c
+--- linux-2.6.32.44/net/ieee802154/raw.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/ieee802154/raw.c 2011-05-04 17:56:28.000000000 -0400
@@ -206,7 +206,7 @@ out:
static int raw_rcv_skb(struct sock *sk, struct sk_buff *skb)
{
@@ -72223,9 +72222,9 @@ diff -urNp linux-2.6.32.43/net/ieee802154/raw.c linux-2.6.32.43/net/ieee802154/r
kfree_skb(skb);
return NET_RX_DROP;
}
-diff -urNp linux-2.6.32.43/net/ipv4/inet_diag.c linux-2.6.32.43/net/ipv4/inet_diag.c
---- linux-2.6.32.43/net/ipv4/inet_diag.c 2011-07-13 17:23:04.000000000 -0400
-+++ linux-2.6.32.43/net/ipv4/inet_diag.c 2011-06-20 19:31:13.000000000 -0400
+diff -urNp linux-2.6.32.44/net/ipv4/inet_diag.c linux-2.6.32.44/net/ipv4/inet_diag.c
+--- linux-2.6.32.44/net/ipv4/inet_diag.c 2011-07-13 17:23:04.000000000 -0400
++++ linux-2.6.32.44/net/ipv4/inet_diag.c 2011-06-20 19:31:13.000000000 -0400
@@ -113,8 +113,13 @@ static int inet_csk_diag_fill(struct soc
r->idiag_retrans = 0;
@@ -72286,9 +72285,9 @@ diff -urNp linux-2.6.32.43/net/ipv4/inet_diag.c linux-2.6.32.43/net/ipv4/inet_di
tmo = req->expires - jiffies;
if (tmo < 0)
-diff -urNp linux-2.6.32.43/net/ipv4/inet_hashtables.c linux-2.6.32.43/net/ipv4/inet_hashtables.c
---- linux-2.6.32.43/net/ipv4/inet_hashtables.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/ipv4/inet_hashtables.c 2011-08-07 19:48:09.000000000 -0400
+diff -urNp linux-2.6.32.44/net/ipv4/inet_hashtables.c linux-2.6.32.44/net/ipv4/inet_hashtables.c
+--- linux-2.6.32.44/net/ipv4/inet_hashtables.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/ipv4/inet_hashtables.c 2011-08-07 19:48:09.000000000 -0400
@@ -18,11 +18,15 @@
#include <linux/sched.h>
#include <linux/slab.h>
@@ -72314,9 +72313,9 @@ diff -urNp linux-2.6.32.43/net/ipv4/inet_hashtables.c linux-2.6.32.43/net/ipv4/i
if (tw) {
inet_twsk_deschedule(tw, death_row);
inet_twsk_put(tw);
-diff -urNp linux-2.6.32.43/net/ipv4/inetpeer.c linux-2.6.32.43/net/ipv4/inetpeer.c
---- linux-2.6.32.43/net/ipv4/inetpeer.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/ipv4/inetpeer.c 2011-08-07 19:48:09.000000000 -0400
+diff -urNp linux-2.6.32.44/net/ipv4/inetpeer.c linux-2.6.32.44/net/ipv4/inetpeer.c
+--- linux-2.6.32.44/net/ipv4/inetpeer.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/ipv4/inetpeer.c 2011-08-07 19:48:09.000000000 -0400
@@ -19,6 +19,7 @@
#include <linux/net.h>
#include <net/ip.h>
@@ -72343,9 +72342,9 @@ diff -urNp linux-2.6.32.43/net/ipv4/inetpeer.c linux-2.6.32.43/net/ipv4/inetpeer
n->ip_id_count = secure_ip_id(daddr);
n->tcp_ts_stamp = 0;
-diff -urNp linux-2.6.32.43/net/ipv4/ip_fragment.c linux-2.6.32.43/net/ipv4/ip_fragment.c
---- linux-2.6.32.43/net/ipv4/ip_fragment.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/ipv4/ip_fragment.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/net/ipv4/ip_fragment.c linux-2.6.32.44/net/ipv4/ip_fragment.c
+--- linux-2.6.32.44/net/ipv4/ip_fragment.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/ipv4/ip_fragment.c 2011-04-17 15:56:46.000000000 -0400
@@ -255,7 +255,7 @@ static inline int ip_frag_too_far(struct
return 0;
@@ -72355,9 +72354,9 @@ diff -urNp linux-2.6.32.43/net/ipv4/ip_fragment.c linux-2.6.32.43/net/ipv4/ip_fr
qp->rid = end;
rc = qp->q.fragments && (end - start) > max;
-diff -urNp linux-2.6.32.43/net/ipv4/ip_sockglue.c linux-2.6.32.43/net/ipv4/ip_sockglue.c
---- linux-2.6.32.43/net/ipv4/ip_sockglue.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/ipv4/ip_sockglue.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/net/ipv4/ip_sockglue.c linux-2.6.32.44/net/ipv4/ip_sockglue.c
+--- linux-2.6.32.44/net/ipv4/ip_sockglue.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/ipv4/ip_sockglue.c 2011-05-16 21:46:57.000000000 -0400
@@ -1015,6 +1015,8 @@ static int do_ip_getsockopt(struct sock
int val;
int len;
@@ -72367,9 +72366,9 @@ diff -urNp linux-2.6.32.43/net/ipv4/ip_sockglue.c linux-2.6.32.43/net/ipv4/ip_so
if (level != SOL_IP)
return -EOPNOTSUPP;
-diff -urNp linux-2.6.32.43/net/ipv4/netfilter/arp_tables.c linux-2.6.32.43/net/ipv4/netfilter/arp_tables.c
---- linux-2.6.32.43/net/ipv4/netfilter/arp_tables.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.43/net/ipv4/netfilter/arp_tables.c 2011-04-17 17:04:18.000000000 -0400
+diff -urNp linux-2.6.32.44/net/ipv4/netfilter/arp_tables.c linux-2.6.32.44/net/ipv4/netfilter/arp_tables.c
+--- linux-2.6.32.44/net/ipv4/netfilter/arp_tables.c 2011-04-17 17:00:52.000000000 -0400
++++ linux-2.6.32.44/net/ipv4/netfilter/arp_tables.c 2011-04-17 17:04:18.000000000 -0400
@@ -934,6 +934,7 @@ static int get_info(struct net *net, voi
private = &tmp;
}
@@ -72378,9 +72377,9 @@ diff -urNp linux-2.6.32.43/net/ipv4/netfilter/arp_tables.c linux-2.6.32.43/net/i
info.valid_hooks = t->valid_hooks;
memcpy(info.hook_entry, private->hook_entry,
sizeof(info.hook_entry));
-diff -urNp linux-2.6.32.43/net/ipv4/netfilter/ip_tables.c linux-2.6.32.43/net/ipv4/netfilter/ip_tables.c
---- linux-2.6.32.43/net/ipv4/netfilter/ip_tables.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.43/net/ipv4/netfilter/ip_tables.c 2011-04-17 17:04:18.000000000 -0400
+diff -urNp linux-2.6.32.44/net/ipv4/netfilter/ip_tables.c linux-2.6.32.44/net/ipv4/netfilter/ip_tables.c
+--- linux-2.6.32.44/net/ipv4/netfilter/ip_tables.c 2011-04-17 17:00:52.000000000 -0400
++++ linux-2.6.32.44/net/ipv4/netfilter/ip_tables.c 2011-04-17 17:04:18.000000000 -0400
@@ -1141,6 +1141,7 @@ static int get_info(struct net *net, voi
private = &tmp;
}
@@ -72389,9 +72388,9 @@ diff -urNp linux-2.6.32.43/net/ipv4/netfilter/ip_tables.c linux-2.6.32.43/net/ip
info.valid_hooks = t->valid_hooks;
memcpy(info.hook_entry, private->hook_entry,
sizeof(info.hook_entry));
-diff -urNp linux-2.6.32.43/net/ipv4/netfilter/nf_nat_proto_common.c linux-2.6.32.43/net/ipv4/netfilter/nf_nat_proto_common.c
---- linux-2.6.32.43/net/ipv4/netfilter/nf_nat_proto_common.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/ipv4/netfilter/nf_nat_proto_common.c 2011-08-07 19:48:09.000000000 -0400
+diff -urNp linux-2.6.32.44/net/ipv4/netfilter/nf_nat_proto_common.c linux-2.6.32.44/net/ipv4/netfilter/nf_nat_proto_common.c
+--- linux-2.6.32.44/net/ipv4/netfilter/nf_nat_proto_common.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/ipv4/netfilter/nf_nat_proto_common.c 2011-08-07 19:48:09.000000000 -0400
@@ -12,6 +12,7 @@
#include <linux/ip.h>
@@ -72400,9 +72399,9 @@ diff -urNp linux-2.6.32.43/net/ipv4/netfilter/nf_nat_proto_common.c linux-2.6.32
#include <net/netfilter/nf_nat.h>
#include <net/netfilter/nf_nat_core.h>
#include <net/netfilter/nf_nat_rule.h>
-diff -urNp linux-2.6.32.43/net/ipv4/netfilter/nf_nat_snmp_basic.c linux-2.6.32.43/net/ipv4/netfilter/nf_nat_snmp_basic.c
---- linux-2.6.32.43/net/ipv4/netfilter/nf_nat_snmp_basic.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/ipv4/netfilter/nf_nat_snmp_basic.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/net/ipv4/netfilter/nf_nat_snmp_basic.c linux-2.6.32.44/net/ipv4/netfilter/nf_nat_snmp_basic.c
+--- linux-2.6.32.44/net/ipv4/netfilter/nf_nat_snmp_basic.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/ipv4/netfilter/nf_nat_snmp_basic.c 2011-04-17 15:56:46.000000000 -0400
@@ -397,7 +397,7 @@ static unsigned char asn1_octets_decode(
*len = 0;
@@ -72412,9 +72411,9 @@ diff -urNp linux-2.6.32.43/net/ipv4/netfilter/nf_nat_snmp_basic.c linux-2.6.32.4
if (*octets == NULL) {
if (net_ratelimit())
printk("OOM in bsalg (%d)\n", __LINE__);
-diff -urNp linux-2.6.32.43/net/ipv4/raw.c linux-2.6.32.43/net/ipv4/raw.c
---- linux-2.6.32.43/net/ipv4/raw.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/ipv4/raw.c 2011-05-04 17:59:08.000000000 -0400
+diff -urNp linux-2.6.32.44/net/ipv4/raw.c linux-2.6.32.44/net/ipv4/raw.c
+--- linux-2.6.32.44/net/ipv4/raw.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/ipv4/raw.c 2011-05-04 17:59:08.000000000 -0400
@@ -292,7 +292,7 @@ static int raw_rcv_skb(struct sock * sk,
/* Charge it to the socket. */
@@ -72483,9 +72482,9 @@ diff -urNp linux-2.6.32.43/net/ipv4/raw.c linux-2.6.32.43/net/ipv4/raw.c
}
static int raw_seq_show(struct seq_file *seq, void *v)
-diff -urNp linux-2.6.32.43/net/ipv4/route.c linux-2.6.32.43/net/ipv4/route.c
---- linux-2.6.32.43/net/ipv4/route.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/ipv4/route.c 2011-08-07 19:48:09.000000000 -0400
+diff -urNp linux-2.6.32.44/net/ipv4/route.c linux-2.6.32.44/net/ipv4/route.c
+--- linux-2.6.32.44/net/ipv4/route.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/ipv4/route.c 2011-08-07 19:48:09.000000000 -0400
@@ -107,6 +107,7 @@
#ifdef CONFIG_SYSCTL
#include <linux/sysctl.h>
@@ -72521,9 +72520,9 @@ diff -urNp linux-2.6.32.43/net/ipv4/route.c linux-2.6.32.43/net/ipv4/route.c
(int) ((num_physpages ^ (num_physpages>>8)) ^
(jiffies ^ (jiffies >> 7))));
-diff -urNp linux-2.6.32.43/net/ipv4/tcp.c linux-2.6.32.43/net/ipv4/tcp.c
---- linux-2.6.32.43/net/ipv4/tcp.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/ipv4/tcp.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/net/ipv4/tcp.c linux-2.6.32.44/net/ipv4/tcp.c
+--- linux-2.6.32.44/net/ipv4/tcp.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/ipv4/tcp.c 2011-05-16 21:46:57.000000000 -0400
@@ -2085,6 +2085,8 @@ static int do_tcp_setsockopt(struct sock
int val;
int err = 0;
@@ -72542,9 +72541,9 @@ diff -urNp linux-2.6.32.43/net/ipv4/tcp.c linux-2.6.32.43/net/ipv4/tcp.c
if (get_user(len, optlen))
return -EFAULT;
-diff -urNp linux-2.6.32.43/net/ipv4/tcp_ipv4.c linux-2.6.32.43/net/ipv4/tcp_ipv4.c
---- linux-2.6.32.43/net/ipv4/tcp_ipv4.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/ipv4/tcp_ipv4.c 2011-08-07 19:48:09.000000000 -0400
+diff -urNp linux-2.6.32.44/net/ipv4/tcp_ipv4.c linux-2.6.32.44/net/ipv4/tcp_ipv4.c
+--- linux-2.6.32.44/net/ipv4/tcp_ipv4.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/ipv4/tcp_ipv4.c 2011-08-07 19:48:09.000000000 -0400
@@ -71,6 +71,7 @@
#include <net/timewait_sock.h>
#include <net/xfrm.h>
@@ -72671,9 +72670,9 @@ diff -urNp linux-2.6.32.43/net/ipv4/tcp_ipv4.c linux-2.6.32.43/net/ipv4/tcp_ipv4
}
#define TMPSZ 150
-diff -urNp linux-2.6.32.43/net/ipv4/tcp_minisocks.c linux-2.6.32.43/net/ipv4/tcp_minisocks.c
---- linux-2.6.32.43/net/ipv4/tcp_minisocks.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/ipv4/tcp_minisocks.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/net/ipv4/tcp_minisocks.c linux-2.6.32.44/net/ipv4/tcp_minisocks.c
+--- linux-2.6.32.44/net/ipv4/tcp_minisocks.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/ipv4/tcp_minisocks.c 2011-04-17 15:56:46.000000000 -0400
@@ -26,6 +26,10 @@
#include <net/inet_common.h>
#include <net/xfrm.h>
@@ -72696,9 +72695,9 @@ diff -urNp linux-2.6.32.43/net/ipv4/tcp_minisocks.c linux-2.6.32.43/net/ipv4/tcp
if (!(flg & TCP_FLAG_RST))
req->rsk_ops->send_reset(sk, skb);
-diff -urNp linux-2.6.32.43/net/ipv4/tcp_output.c linux-2.6.32.43/net/ipv4/tcp_output.c
---- linux-2.6.32.43/net/ipv4/tcp_output.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/ipv4/tcp_output.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/net/ipv4/tcp_output.c linux-2.6.32.44/net/ipv4/tcp_output.c
+--- linux-2.6.32.44/net/ipv4/tcp_output.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/ipv4/tcp_output.c 2011-05-16 21:46:57.000000000 -0400
@@ -2234,6 +2234,8 @@ struct sk_buff *tcp_make_synack(struct s
__u8 *md5_hash_location;
int mss;
@@ -72708,9 +72707,9 @@ diff -urNp linux-2.6.32.43/net/ipv4/tcp_output.c linux-2.6.32.43/net/ipv4/tcp_ou
skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15, 1, GFP_ATOMIC);
if (skb == NULL)
return NULL;
-diff -urNp linux-2.6.32.43/net/ipv4/tcp_probe.c linux-2.6.32.43/net/ipv4/tcp_probe.c
---- linux-2.6.32.43/net/ipv4/tcp_probe.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/ipv4/tcp_probe.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/net/ipv4/tcp_probe.c linux-2.6.32.44/net/ipv4/tcp_probe.c
+--- linux-2.6.32.44/net/ipv4/tcp_probe.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/ipv4/tcp_probe.c 2011-04-17 15:56:46.000000000 -0400
@@ -200,7 +200,7 @@ static ssize_t tcpprobe_read(struct file
if (cnt + width >= len)
break;
@@ -72720,9 +72719,9 @@ diff -urNp linux-2.6.32.43/net/ipv4/tcp_probe.c linux-2.6.32.43/net/ipv4/tcp_pro
return -EFAULT;
cnt += width;
}
-diff -urNp linux-2.6.32.43/net/ipv4/tcp_timer.c linux-2.6.32.43/net/ipv4/tcp_timer.c
---- linux-2.6.32.43/net/ipv4/tcp_timer.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/ipv4/tcp_timer.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/net/ipv4/tcp_timer.c linux-2.6.32.44/net/ipv4/tcp_timer.c
+--- linux-2.6.32.44/net/ipv4/tcp_timer.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/ipv4/tcp_timer.c 2011-04-17 15:56:46.000000000 -0400
@@ -21,6 +21,10 @@
#include <linux/module.h>
#include <net/tcp.h>
@@ -72748,9 +72747,9 @@ diff -urNp linux-2.6.32.43/net/ipv4/tcp_timer.c linux-2.6.32.43/net/ipv4/tcp_tim
if (retransmits_timed_out(sk, retry_until)) {
/* Has it gone just too far? */
tcp_write_err(sk);
-diff -urNp linux-2.6.32.43/net/ipv4/udp.c linux-2.6.32.43/net/ipv4/udp.c
---- linux-2.6.32.43/net/ipv4/udp.c 2011-07-13 17:23:04.000000000 -0400
-+++ linux-2.6.32.43/net/ipv4/udp.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/net/ipv4/udp.c linux-2.6.32.44/net/ipv4/udp.c
+--- linux-2.6.32.44/net/ipv4/udp.c 2011-07-13 17:23:04.000000000 -0400
++++ linux-2.6.32.44/net/ipv4/udp.c 2011-08-05 20:33:55.000000000 -0400
@@ -86,6 +86,7 @@
#include <linux/types.h>
#include <linux/fcntl.h>
@@ -72868,9 +72867,9 @@ diff -urNp linux-2.6.32.43/net/ipv4/udp.c linux-2.6.32.43/net/ipv4/udp.c
}
int udp4_seq_show(struct seq_file *seq, void *v)
-diff -urNp linux-2.6.32.43/net/ipv6/inet6_connection_sock.c linux-2.6.32.43/net/ipv6/inet6_connection_sock.c
---- linux-2.6.32.43/net/ipv6/inet6_connection_sock.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/ipv6/inet6_connection_sock.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/net/ipv6/inet6_connection_sock.c linux-2.6.32.44/net/ipv6/inet6_connection_sock.c
+--- linux-2.6.32.44/net/ipv6/inet6_connection_sock.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/ipv6/inet6_connection_sock.c 2011-05-04 17:56:28.000000000 -0400
@@ -152,7 +152,7 @@ void __inet6_csk_dst_store(struct sock *
#ifdef CONFIG_XFRM
{
@@ -72889,9 +72888,9 @@ diff -urNp linux-2.6.32.43/net/ipv6/inet6_connection_sock.c linux-2.6.32.43/net/
sk->sk_dst_cache = NULL;
dst_release(dst);
dst = NULL;
-diff -urNp linux-2.6.32.43/net/ipv6/inet6_hashtables.c linux-2.6.32.43/net/ipv6/inet6_hashtables.c
---- linux-2.6.32.43/net/ipv6/inet6_hashtables.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/ipv6/inet6_hashtables.c 2011-08-07 19:48:09.000000000 -0400
+diff -urNp linux-2.6.32.44/net/ipv6/inet6_hashtables.c linux-2.6.32.44/net/ipv6/inet6_hashtables.c
+--- linux-2.6.32.44/net/ipv6/inet6_hashtables.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/ipv6/inet6_hashtables.c 2011-08-07 19:48:09.000000000 -0400
@@ -20,6 +20,7 @@
#include <net/inet_connection_sock.h>
#include <net/inet_hashtables.h>
@@ -72909,9 +72908,9 @@ diff -urNp linux-2.6.32.43/net/ipv6/inet6_hashtables.c linux-2.6.32.43/net/ipv6/
const unsigned short hnum,
const struct in6_addr *daddr,
const int dif)
-diff -urNp linux-2.6.32.43/net/ipv6/ipv6_sockglue.c linux-2.6.32.43/net/ipv6/ipv6_sockglue.c
---- linux-2.6.32.43/net/ipv6/ipv6_sockglue.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/ipv6/ipv6_sockglue.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/net/ipv6/ipv6_sockglue.c linux-2.6.32.44/net/ipv6/ipv6_sockglue.c
+--- linux-2.6.32.44/net/ipv6/ipv6_sockglue.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/ipv6/ipv6_sockglue.c 2011-05-16 21:46:57.000000000 -0400
@@ -130,6 +130,8 @@ static int do_ipv6_setsockopt(struct soc
int val, valbool;
int retv = -ENOPROTOOPT;
@@ -72930,9 +72929,9 @@ diff -urNp linux-2.6.32.43/net/ipv6/ipv6_sockglue.c linux-2.6.32.43/net/ipv6/ipv
if (ip6_mroute_opt(optname))
return ip6_mroute_getsockopt(sk, optname, optval, optlen);
-diff -urNp linux-2.6.32.43/net/ipv6/netfilter/ip6_tables.c linux-2.6.32.43/net/ipv6/netfilter/ip6_tables.c
---- linux-2.6.32.43/net/ipv6/netfilter/ip6_tables.c 2011-04-17 17:00:52.000000000 -0400
-+++ linux-2.6.32.43/net/ipv6/netfilter/ip6_tables.c 2011-04-17 17:04:18.000000000 -0400
+diff -urNp linux-2.6.32.44/net/ipv6/netfilter/ip6_tables.c linux-2.6.32.44/net/ipv6/netfilter/ip6_tables.c
+--- linux-2.6.32.44/net/ipv6/netfilter/ip6_tables.c 2011-04-17 17:00:52.000000000 -0400
++++ linux-2.6.32.44/net/ipv6/netfilter/ip6_tables.c 2011-04-17 17:04:18.000000000 -0400
@@ -1173,6 +1173,7 @@ static int get_info(struct net *net, voi
private = &tmp;
}
@@ -72941,9 +72940,9 @@ diff -urNp linux-2.6.32.43/net/ipv6/netfilter/ip6_tables.c linux-2.6.32.43/net/i
info.valid_hooks = t->valid_hooks;
memcpy(info.hook_entry, private->hook_entry,
sizeof(info.hook_entry));
-diff -urNp linux-2.6.32.43/net/ipv6/raw.c linux-2.6.32.43/net/ipv6/raw.c
---- linux-2.6.32.43/net/ipv6/raw.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/ipv6/raw.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/net/ipv6/raw.c linux-2.6.32.44/net/ipv6/raw.c
+--- linux-2.6.32.44/net/ipv6/raw.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/ipv6/raw.c 2011-05-16 21:46:57.000000000 -0400
@@ -375,14 +375,14 @@ static inline int rawv6_rcv_skb(struct s
{
if ((raw6_sk(sk)->checksum || sk->sk_filter) &&
@@ -73058,9 +73057,9 @@ diff -urNp linux-2.6.32.43/net/ipv6/raw.c linux-2.6.32.43/net/ipv6/raw.c
}
static int raw6_seq_show(struct seq_file *seq, void *v)
-diff -urNp linux-2.6.32.43/net/ipv6/tcp_ipv6.c linux-2.6.32.43/net/ipv6/tcp_ipv6.c
---- linux-2.6.32.43/net/ipv6/tcp_ipv6.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/ipv6/tcp_ipv6.c 2011-08-07 19:48:09.000000000 -0400
+diff -urNp linux-2.6.32.44/net/ipv6/tcp_ipv6.c linux-2.6.32.44/net/ipv6/tcp_ipv6.c
+--- linux-2.6.32.44/net/ipv6/tcp_ipv6.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/ipv6/tcp_ipv6.c 2011-08-07 19:48:09.000000000 -0400
@@ -60,6 +60,7 @@
#include <net/timewait_sock.h>
#include <net/netdma.h>
@@ -73168,9 +73167,9 @@ diff -urNp linux-2.6.32.43/net/ipv6/tcp_ipv6.c linux-2.6.32.43/net/ipv6/tcp_ipv6
}
static int tcp6_seq_show(struct seq_file *seq, void *v)
-diff -urNp linux-2.6.32.43/net/ipv6/udp.c linux-2.6.32.43/net/ipv6/udp.c
---- linux-2.6.32.43/net/ipv6/udp.c 2011-07-13 17:23:04.000000000 -0400
-+++ linux-2.6.32.43/net/ipv6/udp.c 2011-07-13 17:23:27.000000000 -0400
+diff -urNp linux-2.6.32.44/net/ipv6/udp.c linux-2.6.32.44/net/ipv6/udp.c
+--- linux-2.6.32.44/net/ipv6/udp.c 2011-07-13 17:23:04.000000000 -0400
++++ linux-2.6.32.44/net/ipv6/udp.c 2011-07-13 17:23:27.000000000 -0400
@@ -49,6 +49,10 @@
#include <linux/seq_file.h>
#include "udp_impl.h"
@@ -73217,9 +73216,9 @@ diff -urNp linux-2.6.32.43/net/ipv6/udp.c linux-2.6.32.43/net/ipv6/udp.c
}
int udp6_seq_show(struct seq_file *seq, void *v)
-diff -urNp linux-2.6.32.43/net/irda/ircomm/ircomm_tty.c linux-2.6.32.43/net/irda/ircomm/ircomm_tty.c
---- linux-2.6.32.43/net/irda/ircomm/ircomm_tty.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/irda/ircomm/ircomm_tty.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/net/irda/ircomm/ircomm_tty.c linux-2.6.32.44/net/irda/ircomm/ircomm_tty.c
+--- linux-2.6.32.44/net/irda/ircomm/ircomm_tty.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/irda/ircomm/ircomm_tty.c 2011-04-17 15:56:46.000000000 -0400
@@ -280,16 +280,16 @@ static int ircomm_tty_block_til_ready(st
add_wait_queue(&self->open_wait, &wait);
@@ -73342,9 +73341,9 @@ diff -urNp linux-2.6.32.43/net/irda/ircomm/ircomm_tty.c linux-2.6.32.43/net/irda
seq_printf(m, "Max data size: %d\n", self->max_data_size);
seq_printf(m, "Max header size: %d\n", self->max_header_size);
-diff -urNp linux-2.6.32.43/net/iucv/af_iucv.c linux-2.6.32.43/net/iucv/af_iucv.c
---- linux-2.6.32.43/net/iucv/af_iucv.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/iucv/af_iucv.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/net/iucv/af_iucv.c linux-2.6.32.44/net/iucv/af_iucv.c
+--- linux-2.6.32.44/net/iucv/af_iucv.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/iucv/af_iucv.c 2011-05-04 17:56:28.000000000 -0400
@@ -651,10 +651,10 @@ static int iucv_sock_autobind(struct soc
write_lock_bh(&iucv_sk_list.lock);
@@ -73358,9 +73357,9 @@ diff -urNp linux-2.6.32.43/net/iucv/af_iucv.c linux-2.6.32.43/net/iucv/af_iucv.c
}
write_unlock_bh(&iucv_sk_list.lock);
-diff -urNp linux-2.6.32.43/net/key/af_key.c linux-2.6.32.43/net/key/af_key.c
---- linux-2.6.32.43/net/key/af_key.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/key/af_key.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/net/key/af_key.c linux-2.6.32.44/net/key/af_key.c
+--- linux-2.6.32.44/net/key/af_key.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/key/af_key.c 2011-05-16 21:46:57.000000000 -0400
@@ -2489,6 +2489,8 @@ static int pfkey_migrate(struct sock *sk
struct xfrm_migrate m[XFRM_MAX_DEPTH];
struct xfrm_kmaddress k;
@@ -73382,9 +73381,9 @@ diff -urNp linux-2.6.32.43/net/key/af_key.c linux-2.6.32.43/net/key/af_key.c
atomic_read(&s->sk_refcnt),
sk_rmem_alloc_get(s),
sk_wmem_alloc_get(s),
-diff -urNp linux-2.6.32.43/net/lapb/lapb_iface.c linux-2.6.32.43/net/lapb/lapb_iface.c
---- linux-2.6.32.43/net/lapb/lapb_iface.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/lapb/lapb_iface.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/net/lapb/lapb_iface.c linux-2.6.32.44/net/lapb/lapb_iface.c
+--- linux-2.6.32.44/net/lapb/lapb_iface.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/lapb/lapb_iface.c 2011-08-05 20:33:55.000000000 -0400
@@ -157,7 +157,7 @@ int lapb_register(struct net_device *dev
goto out;
@@ -73448,9 +73447,9 @@ diff -urNp linux-2.6.32.43/net/lapb/lapb_iface.c linux-2.6.32.43/net/lapb/lapb_i
used = 1;
}
-diff -urNp linux-2.6.32.43/net/mac80211/cfg.c linux-2.6.32.43/net/mac80211/cfg.c
---- linux-2.6.32.43/net/mac80211/cfg.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/mac80211/cfg.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/net/mac80211/cfg.c linux-2.6.32.44/net/mac80211/cfg.c
+--- linux-2.6.32.44/net/mac80211/cfg.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/mac80211/cfg.c 2011-04-17 15:56:46.000000000 -0400
@@ -1369,7 +1369,7 @@ static int ieee80211_set_bitrate_mask(st
return err;
}
@@ -73460,9 +73459,9 @@ diff -urNp linux-2.6.32.43/net/mac80211/cfg.c linux-2.6.32.43/net/mac80211/cfg.c
.add_virtual_intf = ieee80211_add_iface,
.del_virtual_intf = ieee80211_del_iface,
.change_virtual_intf = ieee80211_change_iface,
-diff -urNp linux-2.6.32.43/net/mac80211/cfg.h linux-2.6.32.43/net/mac80211/cfg.h
---- linux-2.6.32.43/net/mac80211/cfg.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/mac80211/cfg.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/net/mac80211/cfg.h linux-2.6.32.44/net/mac80211/cfg.h
+--- linux-2.6.32.44/net/mac80211/cfg.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/mac80211/cfg.h 2011-04-17 15:56:46.000000000 -0400
@@ -4,6 +4,6 @@
#ifndef __CFG_H
#define __CFG_H
@@ -73471,9 +73470,9 @@ diff -urNp linux-2.6.32.43/net/mac80211/cfg.h linux-2.6.32.43/net/mac80211/cfg.h
+extern const struct cfg80211_ops mac80211_config_ops;
#endif /* __CFG_H */
-diff -urNp linux-2.6.32.43/net/mac80211/debugfs_key.c linux-2.6.32.43/net/mac80211/debugfs_key.c
---- linux-2.6.32.43/net/mac80211/debugfs_key.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/mac80211/debugfs_key.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/net/mac80211/debugfs_key.c linux-2.6.32.44/net/mac80211/debugfs_key.c
+--- linux-2.6.32.44/net/mac80211/debugfs_key.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/mac80211/debugfs_key.c 2011-04-17 15:56:46.000000000 -0400
@@ -211,9 +211,13 @@ static ssize_t key_key_read(struct file
size_t count, loff_t *ppos)
{
@@ -73489,9 +73488,9 @@ diff -urNp linux-2.6.32.43/net/mac80211/debugfs_key.c linux-2.6.32.43/net/mac802
for (i = 0; i < key->conf.keylen; i++)
p += scnprintf(p, bufsize + buf - p, "%02x", key->conf.key[i]);
-diff -urNp linux-2.6.32.43/net/mac80211/debugfs_sta.c linux-2.6.32.43/net/mac80211/debugfs_sta.c
---- linux-2.6.32.43/net/mac80211/debugfs_sta.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/mac80211/debugfs_sta.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/net/mac80211/debugfs_sta.c linux-2.6.32.44/net/mac80211/debugfs_sta.c
+--- linux-2.6.32.44/net/mac80211/debugfs_sta.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/mac80211/debugfs_sta.c 2011-05-16 21:46:57.000000000 -0400
@@ -124,6 +124,8 @@ static ssize_t sta_agg_status_read(struc
int i;
struct sta_info *sta = file->private_data;
@@ -73501,9 +73500,9 @@ diff -urNp linux-2.6.32.43/net/mac80211/debugfs_sta.c linux-2.6.32.43/net/mac802
spin_lock_bh(&sta->lock);
p += scnprintf(p, sizeof(buf)+buf-p, "next dialog_token is %#02x\n",
sta->ampdu_mlme.dialog_token_allocator + 1);
-diff -urNp linux-2.6.32.43/net/mac80211/ieee80211_i.h linux-2.6.32.43/net/mac80211/ieee80211_i.h
---- linux-2.6.32.43/net/mac80211/ieee80211_i.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/mac80211/ieee80211_i.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/net/mac80211/ieee80211_i.h linux-2.6.32.44/net/mac80211/ieee80211_i.h
+--- linux-2.6.32.44/net/mac80211/ieee80211_i.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/mac80211/ieee80211_i.h 2011-04-17 15:56:46.000000000 -0400
@@ -25,6 +25,7 @@
#include <linux/etherdevice.h>
#include <net/cfg80211.h>
@@ -73521,9 +73520,9 @@ diff -urNp linux-2.6.32.43/net/mac80211/ieee80211_i.h linux-2.6.32.43/net/mac802
int monitors, cooked_mntrs;
/* number of interfaces with corresponding FIF_ flags */
int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll;
-diff -urNp linux-2.6.32.43/net/mac80211/iface.c linux-2.6.32.43/net/mac80211/iface.c
---- linux-2.6.32.43/net/mac80211/iface.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/mac80211/iface.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/net/mac80211/iface.c linux-2.6.32.44/net/mac80211/iface.c
+--- linux-2.6.32.44/net/mac80211/iface.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/mac80211/iface.c 2011-04-17 15:56:46.000000000 -0400
@@ -166,7 +166,7 @@ static int ieee80211_open(struct net_dev
break;
}
@@ -73578,9 +73577,9 @@ diff -urNp linux-2.6.32.43/net/mac80211/iface.c linux-2.6.32.43/net/mac80211/ifa
ieee80211_clear_tx_pending(local);
ieee80211_stop_device(local);
-diff -urNp linux-2.6.32.43/net/mac80211/main.c linux-2.6.32.43/net/mac80211/main.c
---- linux-2.6.32.43/net/mac80211/main.c 2011-05-10 22:12:02.000000000 -0400
-+++ linux-2.6.32.43/net/mac80211/main.c 2011-05-10 22:12:34.000000000 -0400
+diff -urNp linux-2.6.32.44/net/mac80211/main.c linux-2.6.32.44/net/mac80211/main.c
+--- linux-2.6.32.44/net/mac80211/main.c 2011-05-10 22:12:02.000000000 -0400
++++ linux-2.6.32.44/net/mac80211/main.c 2011-05-10 22:12:34.000000000 -0400
@@ -145,7 +145,7 @@ int ieee80211_hw_config(struct ieee80211
local->hw.conf.power_level = power;
}
@@ -73590,9 +73589,9 @@ diff -urNp linux-2.6.32.43/net/mac80211/main.c linux-2.6.32.43/net/mac80211/main
ret = drv_config(local, changed);
/*
* Goal:
-diff -urNp linux-2.6.32.43/net/mac80211/mlme.c linux-2.6.32.43/net/mac80211/mlme.c
---- linux-2.6.32.43/net/mac80211/mlme.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/mac80211/mlme.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/net/mac80211/mlme.c linux-2.6.32.44/net/mac80211/mlme.c
+--- linux-2.6.32.44/net/mac80211/mlme.c 2011-08-09 18:35:30.000000000 -0400
++++ linux-2.6.32.44/net/mac80211/mlme.c 2011-08-09 18:34:01.000000000 -0400
@@ -1438,6 +1438,8 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee
bool have_higher_than_11mbit = false, newsta = false;
u16 ap_ht_cap_flags;
@@ -73602,9 +73601,9 @@ diff -urNp linux-2.6.32.43/net/mac80211/mlme.c linux-2.6.32.43/net/mac80211/mlme
/*
* AssocResp and ReassocResp have identical structure, so process both
* of them in this function.
-diff -urNp linux-2.6.32.43/net/mac80211/pm.c linux-2.6.32.43/net/mac80211/pm.c
---- linux-2.6.32.43/net/mac80211/pm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/mac80211/pm.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/net/mac80211/pm.c linux-2.6.32.44/net/mac80211/pm.c
+--- linux-2.6.32.44/net/mac80211/pm.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/mac80211/pm.c 2011-04-17 15:56:46.000000000 -0400
@@ -107,7 +107,7 @@ int __ieee80211_suspend(struct ieee80211
}
@@ -73614,9 +73613,9 @@ diff -urNp linux-2.6.32.43/net/mac80211/pm.c linux-2.6.32.43/net/mac80211/pm.c
ieee80211_stop_device(local);
local->suspended = true;
-diff -urNp linux-2.6.32.43/net/mac80211/rate.c linux-2.6.32.43/net/mac80211/rate.c
---- linux-2.6.32.43/net/mac80211/rate.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/mac80211/rate.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/net/mac80211/rate.c linux-2.6.32.44/net/mac80211/rate.c
+--- linux-2.6.32.44/net/mac80211/rate.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/mac80211/rate.c 2011-04-17 15:56:46.000000000 -0400
@@ -287,7 +287,7 @@ int ieee80211_init_rate_ctrl_alg(struct
struct rate_control_ref *ref, *old;
@@ -73626,9 +73625,9 @@ diff -urNp linux-2.6.32.43/net/mac80211/rate.c linux-2.6.32.43/net/mac80211/rate
return -EBUSY;
ref = rate_control_alloc(name, local);
-diff -urNp linux-2.6.32.43/net/mac80211/tx.c linux-2.6.32.43/net/mac80211/tx.c
---- linux-2.6.32.43/net/mac80211/tx.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/mac80211/tx.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/net/mac80211/tx.c linux-2.6.32.44/net/mac80211/tx.c
+--- linux-2.6.32.44/net/mac80211/tx.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/mac80211/tx.c 2011-04-17 15:56:46.000000000 -0400
@@ -173,7 +173,7 @@ static __le16 ieee80211_duration(struct
return cpu_to_le16(dur);
}
@@ -73638,9 +73637,9 @@ diff -urNp linux-2.6.32.43/net/mac80211/tx.c linux-2.6.32.43/net/mac80211/tx.c
struct net_device *dev)
{
return local == wdev_priv(dev->ieee80211_ptr);
-diff -urNp linux-2.6.32.43/net/mac80211/util.c linux-2.6.32.43/net/mac80211/util.c
---- linux-2.6.32.43/net/mac80211/util.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/mac80211/util.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/net/mac80211/util.c linux-2.6.32.44/net/mac80211/util.c
+--- linux-2.6.32.44/net/mac80211/util.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/mac80211/util.c 2011-04-17 15:56:46.000000000 -0400
@@ -1042,7 +1042,7 @@ int ieee80211_reconfig(struct ieee80211_
local->resuming = true;
@@ -73650,9 +73649,9 @@ diff -urNp linux-2.6.32.43/net/mac80211/util.c linux-2.6.32.43/net/mac80211/util
/*
* Upon resume hardware can sometimes be goofy due to
* various platform / driver / bus issues, so restarting
-diff -urNp linux-2.6.32.43/net/netfilter/ipvs/ip_vs_app.c linux-2.6.32.43/net/netfilter/ipvs/ip_vs_app.c
---- linux-2.6.32.43/net/netfilter/ipvs/ip_vs_app.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/netfilter/ipvs/ip_vs_app.c 2011-05-17 19:26:34.000000000 -0400
+diff -urNp linux-2.6.32.44/net/netfilter/ipvs/ip_vs_app.c linux-2.6.32.44/net/netfilter/ipvs/ip_vs_app.c
+--- linux-2.6.32.44/net/netfilter/ipvs/ip_vs_app.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/netfilter/ipvs/ip_vs_app.c 2011-05-17 19:26:34.000000000 -0400
@@ -564,7 +564,7 @@ static const struct file_operations ip_v
.open = ip_vs_app_open,
.read = seq_read,
@@ -73662,9 +73661,9 @@ diff -urNp linux-2.6.32.43/net/netfilter/ipvs/ip_vs_app.c linux-2.6.32.43/net/ne
};
#endif
-diff -urNp linux-2.6.32.43/net/netfilter/ipvs/ip_vs_conn.c linux-2.6.32.43/net/netfilter/ipvs/ip_vs_conn.c
---- linux-2.6.32.43/net/netfilter/ipvs/ip_vs_conn.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/netfilter/ipvs/ip_vs_conn.c 2011-05-17 19:26:34.000000000 -0400
+diff -urNp linux-2.6.32.44/net/netfilter/ipvs/ip_vs_conn.c linux-2.6.32.44/net/netfilter/ipvs/ip_vs_conn.c
+--- linux-2.6.32.44/net/netfilter/ipvs/ip_vs_conn.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/netfilter/ipvs/ip_vs_conn.c 2011-05-17 19:26:34.000000000 -0400
@@ -453,10 +453,10 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, s
/* if the connection is not template and is created
* by sync, preserve the activity flag.
@@ -73714,9 +73713,9 @@ diff -urNp linux-2.6.32.43/net/netfilter/ipvs/ip_vs_conn.c linux-2.6.32.43/net/n
if (i > 8 || i < 0) return 0;
if (!todrop_rate[i]) return 0;
-diff -urNp linux-2.6.32.43/net/netfilter/ipvs/ip_vs_core.c linux-2.6.32.43/net/netfilter/ipvs/ip_vs_core.c
---- linux-2.6.32.43/net/netfilter/ipvs/ip_vs_core.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/netfilter/ipvs/ip_vs_core.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/net/netfilter/ipvs/ip_vs_core.c linux-2.6.32.44/net/netfilter/ipvs/ip_vs_core.c
+--- linux-2.6.32.44/net/netfilter/ipvs/ip_vs_core.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/netfilter/ipvs/ip_vs_core.c 2011-05-04 17:56:28.000000000 -0400
@@ -485,7 +485,7 @@ int ip_vs_leave(struct ip_vs_service *sv
ret = cp->packet_xmit(skb, cp, pp);
/* do not touch skb anymore */
@@ -73735,9 +73734,9 @@ diff -urNp linux-2.6.32.43/net/netfilter/ipvs/ip_vs_core.c linux-2.6.32.43/net/n
if (af == AF_INET &&
(ip_vs_sync_state & IP_VS_STATE_MASTER) &&
(((cp->protocol != IPPROTO_TCP ||
-diff -urNp linux-2.6.32.43/net/netfilter/ipvs/ip_vs_ctl.c linux-2.6.32.43/net/netfilter/ipvs/ip_vs_ctl.c
---- linux-2.6.32.43/net/netfilter/ipvs/ip_vs_ctl.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/netfilter/ipvs/ip_vs_ctl.c 2011-05-17 19:26:34.000000000 -0400
+diff -urNp linux-2.6.32.44/net/netfilter/ipvs/ip_vs_ctl.c linux-2.6.32.44/net/netfilter/ipvs/ip_vs_ctl.c
+--- linux-2.6.32.44/net/netfilter/ipvs/ip_vs_ctl.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/netfilter/ipvs/ip_vs_ctl.c 2011-05-17 19:26:34.000000000 -0400
@@ -792,7 +792,7 @@ __ip_vs_update_dest(struct ip_vs_service
ip_vs_rs_hash(dest);
write_unlock_bh(&__ip_vs_rs_lock);
@@ -73810,9 +73809,9 @@ diff -urNp linux-2.6.32.43/net/netfilter/ipvs/ip_vs_ctl.c linux-2.6.32.43/net/ne
NLA_PUT_U32(skb, IPVS_DEST_ATTR_WEIGHT, atomic_read(&dest->weight));
NLA_PUT_U32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold);
NLA_PUT_U32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold);
-diff -urNp linux-2.6.32.43/net/netfilter/ipvs/ip_vs_sync.c linux-2.6.32.43/net/netfilter/ipvs/ip_vs_sync.c
---- linux-2.6.32.43/net/netfilter/ipvs/ip_vs_sync.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/netfilter/ipvs/ip_vs_sync.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/net/netfilter/ipvs/ip_vs_sync.c linux-2.6.32.44/net/netfilter/ipvs/ip_vs_sync.c
+--- linux-2.6.32.44/net/netfilter/ipvs/ip_vs_sync.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/netfilter/ipvs/ip_vs_sync.c 2011-05-04 17:56:28.000000000 -0400
@@ -438,7 +438,7 @@ static void ip_vs_process_message(const
if (opt)
@@ -73822,9 +73821,9 @@ diff -urNp linux-2.6.32.43/net/netfilter/ipvs/ip_vs_sync.c linux-2.6.32.43/net/n
cp->state = state;
cp->old_state = cp->state;
/*
-diff -urNp linux-2.6.32.43/net/netfilter/ipvs/ip_vs_xmit.c linux-2.6.32.43/net/netfilter/ipvs/ip_vs_xmit.c
---- linux-2.6.32.43/net/netfilter/ipvs/ip_vs_xmit.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/netfilter/ipvs/ip_vs_xmit.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/net/netfilter/ipvs/ip_vs_xmit.c linux-2.6.32.44/net/netfilter/ipvs/ip_vs_xmit.c
+--- linux-2.6.32.44/net/netfilter/ipvs/ip_vs_xmit.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/netfilter/ipvs/ip_vs_xmit.c 2011-05-04 17:56:28.000000000 -0400
@@ -875,7 +875,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, str
else
rc = NF_ACCEPT;
@@ -73843,9 +73842,9 @@ diff -urNp linux-2.6.32.43/net/netfilter/ipvs/ip_vs_xmit.c linux-2.6.32.43/net/n
goto out;
}
-diff -urNp linux-2.6.32.43/net/netfilter/Kconfig linux-2.6.32.43/net/netfilter/Kconfig
---- linux-2.6.32.43/net/netfilter/Kconfig 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/netfilter/Kconfig 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/net/netfilter/Kconfig linux-2.6.32.44/net/netfilter/Kconfig
+--- linux-2.6.32.44/net/netfilter/Kconfig 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/netfilter/Kconfig 2011-04-17 15:56:46.000000000 -0400
@@ -635,6 +635,16 @@ config NETFILTER_XT_MATCH_ESP
To compile it as a module, choose M here. If unsure, say N.
@@ -73863,9 +73862,9 @@ diff -urNp linux-2.6.32.43/net/netfilter/Kconfig linux-2.6.32.43/net/netfilter/K
config NETFILTER_XT_MATCH_HASHLIMIT
tristate '"hashlimit" match support'
depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
-diff -urNp linux-2.6.32.43/net/netfilter/Makefile linux-2.6.32.43/net/netfilter/Makefile
---- linux-2.6.32.43/net/netfilter/Makefile 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/netfilter/Makefile 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/net/netfilter/Makefile linux-2.6.32.44/net/netfilter/Makefile
+--- linux-2.6.32.44/net/netfilter/Makefile 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/netfilter/Makefile 2011-04-17 15:56:46.000000000 -0400
@@ -68,6 +68,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_CONNTRAC
obj-$(CONFIG_NETFILTER_XT_MATCH_DCCP) += xt_dccp.o
obj-$(CONFIG_NETFILTER_XT_MATCH_DSCP) += xt_dscp.o
@@ -73874,9 +73873,9 @@ diff -urNp linux-2.6.32.43/net/netfilter/Makefile linux-2.6.32.43/net/netfilter/
obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o
-diff -urNp linux-2.6.32.43/net/netfilter/nf_conntrack_netlink.c linux-2.6.32.43/net/netfilter/nf_conntrack_netlink.c
---- linux-2.6.32.43/net/netfilter/nf_conntrack_netlink.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/netfilter/nf_conntrack_netlink.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/net/netfilter/nf_conntrack_netlink.c linux-2.6.32.44/net/netfilter/nf_conntrack_netlink.c
+--- linux-2.6.32.44/net/netfilter/nf_conntrack_netlink.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/netfilter/nf_conntrack_netlink.c 2011-04-17 15:56:46.000000000 -0400
@@ -706,7 +706,7 @@ ctnetlink_parse_tuple_proto(struct nlatt
static int
ctnetlink_parse_tuple(const struct nlattr * const cda[],
@@ -73886,9 +73885,9 @@ diff -urNp linux-2.6.32.43/net/netfilter/nf_conntrack_netlink.c linux-2.6.32.43/
{
struct nlattr *tb[CTA_TUPLE_MAX+1];
int err;
-diff -urNp linux-2.6.32.43/net/netfilter/nfnetlink_log.c linux-2.6.32.43/net/netfilter/nfnetlink_log.c
---- linux-2.6.32.43/net/netfilter/nfnetlink_log.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/netfilter/nfnetlink_log.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/net/netfilter/nfnetlink_log.c linux-2.6.32.44/net/netfilter/nfnetlink_log.c
+--- linux-2.6.32.44/net/netfilter/nfnetlink_log.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/netfilter/nfnetlink_log.c 2011-05-04 17:56:28.000000000 -0400
@@ -68,7 +68,7 @@ struct nfulnl_instance {
};
@@ -73907,9 +73906,9 @@ diff -urNp linux-2.6.32.43/net/netfilter/nfnetlink_log.c linux-2.6.32.43/net/net
if (data_len) {
struct nlattr *nla;
-diff -urNp linux-2.6.32.43/net/netfilter/xt_gradm.c linux-2.6.32.43/net/netfilter/xt_gradm.c
---- linux-2.6.32.43/net/netfilter/xt_gradm.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/net/netfilter/xt_gradm.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/net/netfilter/xt_gradm.c linux-2.6.32.44/net/netfilter/xt_gradm.c
+--- linux-2.6.32.44/net/netfilter/xt_gradm.c 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/net/netfilter/xt_gradm.c 2011-04-17 15:56:46.000000000 -0400
@@ -0,0 +1,51 @@
+/*
+ * gradm match for netfilter
@@ -73962,9 +73961,9 @@ diff -urNp linux-2.6.32.43/net/netfilter/xt_gradm.c linux-2.6.32.43/net/netfilte
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("ipt_gradm");
+MODULE_ALIAS("ip6t_gradm");
-diff -urNp linux-2.6.32.43/net/netlink/af_netlink.c linux-2.6.32.43/net/netlink/af_netlink.c
---- linux-2.6.32.43/net/netlink/af_netlink.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/netlink/af_netlink.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/net/netlink/af_netlink.c linux-2.6.32.44/net/netlink/af_netlink.c
+--- linux-2.6.32.44/net/netlink/af_netlink.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/netlink/af_netlink.c 2011-05-04 17:56:28.000000000 -0400
@@ -733,7 +733,7 @@ static void netlink_overrun(struct sock
sk->sk_error_report(sk);
}
@@ -73999,9 +73998,9 @@ diff -urNp linux-2.6.32.43/net/netlink/af_netlink.c linux-2.6.32.43/net/netlink/
);
}
-diff -urNp linux-2.6.32.43/net/netrom/af_netrom.c linux-2.6.32.43/net/netrom/af_netrom.c
---- linux-2.6.32.43/net/netrom/af_netrom.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/netrom/af_netrom.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/net/netrom/af_netrom.c linux-2.6.32.44/net/netrom/af_netrom.c
+--- linux-2.6.32.44/net/netrom/af_netrom.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/netrom/af_netrom.c 2011-04-17 15:56:46.000000000 -0400
@@ -838,6 +838,7 @@ static int nr_getname(struct socket *soc
struct sock *sk = sock->sk;
struct nr_sock *nr = nr_sk(sk);
@@ -74018,9 +74017,9 @@ diff -urNp linux-2.6.32.43/net/netrom/af_netrom.c linux-2.6.32.43/net/netrom/af_
sax->fsa_ax25.sax25_call = nr->source_addr;
*uaddr_len = sizeof(struct sockaddr_ax25);
}
-diff -urNp linux-2.6.32.43/net/packet/af_packet.c linux-2.6.32.43/net/packet/af_packet.c
---- linux-2.6.32.43/net/packet/af_packet.c 2011-07-13 17:23:04.000000000 -0400
-+++ linux-2.6.32.43/net/packet/af_packet.c 2011-07-13 17:23:27.000000000 -0400
+diff -urNp linux-2.6.32.44/net/packet/af_packet.c linux-2.6.32.44/net/packet/af_packet.c
+--- linux-2.6.32.44/net/packet/af_packet.c 2011-07-13 17:23:04.000000000 -0400
++++ linux-2.6.32.44/net/packet/af_packet.c 2011-07-13 17:23:27.000000000 -0400
@@ -2429,7 +2429,11 @@ static int packet_seq_show(struct seq_fi
seq_printf(seq,
@@ -74033,9 +74032,9 @@ diff -urNp linux-2.6.32.43/net/packet/af_packet.c linux-2.6.32.43/net/packet/af_
atomic_read(&s->sk_refcnt),
s->sk_type,
ntohs(po->num),
-diff -urNp linux-2.6.32.43/net/phonet/af_phonet.c linux-2.6.32.43/net/phonet/af_phonet.c
---- linux-2.6.32.43/net/phonet/af_phonet.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/phonet/af_phonet.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/net/phonet/af_phonet.c linux-2.6.32.44/net/phonet/af_phonet.c
+--- linux-2.6.32.44/net/phonet/af_phonet.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/phonet/af_phonet.c 2011-04-17 15:56:46.000000000 -0400
@@ -41,7 +41,7 @@ static struct phonet_protocol *phonet_pr
{
struct phonet_protocol *pp;
@@ -74054,9 +74053,9 @@ diff -urNp linux-2.6.32.43/net/phonet/af_phonet.c linux-2.6.32.43/net/phonet/af_
return -EINVAL;
err = proto_register(pp->prot, 1);
-diff -urNp linux-2.6.32.43/net/phonet/datagram.c linux-2.6.32.43/net/phonet/datagram.c
---- linux-2.6.32.43/net/phonet/datagram.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/phonet/datagram.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/net/phonet/datagram.c linux-2.6.32.44/net/phonet/datagram.c
+--- linux-2.6.32.44/net/phonet/datagram.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/phonet/datagram.c 2011-05-04 17:56:28.000000000 -0400
@@ -162,7 +162,7 @@ static int pn_backlog_rcv(struct sock *s
if (err < 0) {
kfree_skb(skb);
@@ -74066,9 +74065,9 @@ diff -urNp linux-2.6.32.43/net/phonet/datagram.c linux-2.6.32.43/net/phonet/data
}
return err ? NET_RX_DROP : NET_RX_SUCCESS;
}
-diff -urNp linux-2.6.32.43/net/phonet/pep.c linux-2.6.32.43/net/phonet/pep.c
---- linux-2.6.32.43/net/phonet/pep.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/phonet/pep.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/net/phonet/pep.c linux-2.6.32.44/net/phonet/pep.c
+--- linux-2.6.32.44/net/phonet/pep.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/phonet/pep.c 2011-05-04 17:56:28.000000000 -0400
@@ -348,7 +348,7 @@ static int pipe_do_rcv(struct sock *sk,
case PNS_PEP_CTRL_REQ:
@@ -74093,9 +74092,9 @@ diff -urNp linux-2.6.32.43/net/phonet/pep.c linux-2.6.32.43/net/phonet/pep.c
err = -ENOBUFS;
break;
}
-diff -urNp linux-2.6.32.43/net/phonet/socket.c linux-2.6.32.43/net/phonet/socket.c
---- linux-2.6.32.43/net/phonet/socket.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/phonet/socket.c 2011-05-04 17:57:07.000000000 -0400
+diff -urNp linux-2.6.32.44/net/phonet/socket.c linux-2.6.32.44/net/phonet/socket.c
+--- linux-2.6.32.44/net/phonet/socket.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/phonet/socket.c 2011-05-04 17:57:07.000000000 -0400
@@ -482,8 +482,13 @@ static int pn_sock_seq_show(struct seq_f
sk->sk_state,
sk_wmem_alloc_get(sk), sk_rmem_alloc_get(sk),
@@ -74112,9 +74111,9 @@ diff -urNp linux-2.6.32.43/net/phonet/socket.c linux-2.6.32.43/net/phonet/socket
}
seq_printf(seq, "%*s\n", 127 - len, "");
return 0;
-diff -urNp linux-2.6.32.43/net/rds/cong.c linux-2.6.32.43/net/rds/cong.c
---- linux-2.6.32.43/net/rds/cong.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/rds/cong.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/net/rds/cong.c linux-2.6.32.44/net/rds/cong.c
+--- linux-2.6.32.44/net/rds/cong.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/rds/cong.c 2011-05-04 17:56:28.000000000 -0400
@@ -77,7 +77,7 @@
* finds that the saved generation number is smaller than the global generation
* number, it wakes up the process.
@@ -74142,9 +74141,9 @@ diff -urNp linux-2.6.32.43/net/rds/cong.c linux-2.6.32.43/net/rds/cong.c
if (likely(*recent == gen))
return 0;
-diff -urNp linux-2.6.32.43/net/rds/iw_rdma.c linux-2.6.32.43/net/rds/iw_rdma.c
---- linux-2.6.32.43/net/rds/iw_rdma.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/rds/iw_rdma.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/net/rds/iw_rdma.c linux-2.6.32.44/net/rds/iw_rdma.c
+--- linux-2.6.32.44/net/rds/iw_rdma.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/rds/iw_rdma.c 2011-05-16 21:46:57.000000000 -0400
@@ -181,6 +181,8 @@ int rds_iw_update_cm_id(struct rds_iw_de
struct rdma_cm_id *pcm_id;
int rc;
@@ -74154,9 +74153,9 @@ diff -urNp linux-2.6.32.43/net/rds/iw_rdma.c linux-2.6.32.43/net/rds/iw_rdma.c
src_addr = (struct sockaddr_in *)&cm_id->route.addr.src_addr;
dst_addr = (struct sockaddr_in *)&cm_id->route.addr.dst_addr;
-diff -urNp linux-2.6.32.43/net/rds/Kconfig linux-2.6.32.43/net/rds/Kconfig
---- linux-2.6.32.43/net/rds/Kconfig 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/rds/Kconfig 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/net/rds/Kconfig linux-2.6.32.44/net/rds/Kconfig
+--- linux-2.6.32.44/net/rds/Kconfig 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/rds/Kconfig 2011-04-17 15:56:46.000000000 -0400
@@ -1,7 +1,7 @@
config RDS
@@ -74166,9 +74165,9 @@ diff -urNp linux-2.6.32.43/net/rds/Kconfig linux-2.6.32.43/net/rds/Kconfig
---help---
The RDS (Reliable Datagram Sockets) protocol provides reliable,
sequenced delivery of datagrams over Infiniband, iWARP,
-diff -urNp linux-2.6.32.43/net/rxrpc/af_rxrpc.c linux-2.6.32.43/net/rxrpc/af_rxrpc.c
---- linux-2.6.32.43/net/rxrpc/af_rxrpc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/rxrpc/af_rxrpc.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/net/rxrpc/af_rxrpc.c linux-2.6.32.44/net/rxrpc/af_rxrpc.c
+--- linux-2.6.32.44/net/rxrpc/af_rxrpc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/rxrpc/af_rxrpc.c 2011-05-04 17:56:28.000000000 -0400
@@ -38,7 +38,7 @@ static const struct proto_ops rxrpc_rpc_
__be32 rxrpc_epoch;
@@ -74178,9 +74177,9 @@ diff -urNp linux-2.6.32.43/net/rxrpc/af_rxrpc.c linux-2.6.32.43/net/rxrpc/af_rxr
/* count of skbs currently in use */
atomic_t rxrpc_n_skbs;
-diff -urNp linux-2.6.32.43/net/rxrpc/ar-ack.c linux-2.6.32.43/net/rxrpc/ar-ack.c
---- linux-2.6.32.43/net/rxrpc/ar-ack.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/rxrpc/ar-ack.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/net/rxrpc/ar-ack.c linux-2.6.32.44/net/rxrpc/ar-ack.c
+--- linux-2.6.32.44/net/rxrpc/ar-ack.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/rxrpc/ar-ack.c 2011-05-16 21:46:57.000000000 -0400
@@ -174,7 +174,7 @@ static void rxrpc_resend(struct rxrpc_ca
_enter("{%d,%d,%d,%d},",
@@ -74253,9 +74252,9 @@ diff -urNp linux-2.6.32.43/net/rxrpc/ar-ack.c linux-2.6.32.43/net/rxrpc/ar-ack.c
_proto("Tx %s %%%u", rxrpc_pkts[hdr.type], ntohl(hdr.serial));
send_message_2:
-diff -urNp linux-2.6.32.43/net/rxrpc/ar-call.c linux-2.6.32.43/net/rxrpc/ar-call.c
---- linux-2.6.32.43/net/rxrpc/ar-call.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/rxrpc/ar-call.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/net/rxrpc/ar-call.c linux-2.6.32.44/net/rxrpc/ar-call.c
+--- linux-2.6.32.44/net/rxrpc/ar-call.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/rxrpc/ar-call.c 2011-05-04 17:56:28.000000000 -0400
@@ -82,7 +82,7 @@ static struct rxrpc_call *rxrpc_alloc_ca
spin_lock_init(&call->lock);
rwlock_init(&call->state_lock);
@@ -74265,9 +74264,9 @@ diff -urNp linux-2.6.32.43/net/rxrpc/ar-call.c linux-2.6.32.43/net/rxrpc/ar-call
call->state = RXRPC_CALL_CLIENT_SEND_REQUEST;
memset(&call->sock_node, 0xed, sizeof(call->sock_node));
-diff -urNp linux-2.6.32.43/net/rxrpc/ar-connection.c linux-2.6.32.43/net/rxrpc/ar-connection.c
---- linux-2.6.32.43/net/rxrpc/ar-connection.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/rxrpc/ar-connection.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/net/rxrpc/ar-connection.c linux-2.6.32.44/net/rxrpc/ar-connection.c
+--- linux-2.6.32.44/net/rxrpc/ar-connection.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/rxrpc/ar-connection.c 2011-05-04 17:56:28.000000000 -0400
@@ -205,7 +205,7 @@ static struct rxrpc_connection *rxrpc_al
rwlock_init(&conn->lock);
spin_lock_init(&conn->state_lock);
@@ -74277,9 +74276,9 @@ diff -urNp linux-2.6.32.43/net/rxrpc/ar-connection.c linux-2.6.32.43/net/rxrpc/a
conn->avail_calls = RXRPC_MAXCALLS;
conn->size_align = 4;
conn->header_size = sizeof(struct rxrpc_header);
-diff -urNp linux-2.6.32.43/net/rxrpc/ar-connevent.c linux-2.6.32.43/net/rxrpc/ar-connevent.c
---- linux-2.6.32.43/net/rxrpc/ar-connevent.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/rxrpc/ar-connevent.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/net/rxrpc/ar-connevent.c linux-2.6.32.44/net/rxrpc/ar-connevent.c
+--- linux-2.6.32.44/net/rxrpc/ar-connevent.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/rxrpc/ar-connevent.c 2011-05-04 17:56:28.000000000 -0400
@@ -109,7 +109,7 @@ static int rxrpc_abort_connection(struct
len = iov[0].iov_len + iov[1].iov_len;
@@ -74289,9 +74288,9 @@ diff -urNp linux-2.6.32.43/net/rxrpc/ar-connevent.c linux-2.6.32.43/net/rxrpc/ar
_proto("Tx CONN ABORT %%%u { %d }", ntohl(hdr.serial), abort_code);
ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 2, len);
-diff -urNp linux-2.6.32.43/net/rxrpc/ar-input.c linux-2.6.32.43/net/rxrpc/ar-input.c
---- linux-2.6.32.43/net/rxrpc/ar-input.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/rxrpc/ar-input.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/net/rxrpc/ar-input.c linux-2.6.32.44/net/rxrpc/ar-input.c
+--- linux-2.6.32.44/net/rxrpc/ar-input.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/rxrpc/ar-input.c 2011-05-04 17:56:28.000000000 -0400
@@ -339,9 +339,9 @@ void rxrpc_fast_process_packet(struct rx
/* track the latest serial number on this connection for ACK packet
* information */
@@ -74304,9 +74303,9 @@ diff -urNp linux-2.6.32.43/net/rxrpc/ar-input.c linux-2.6.32.43/net/rxrpc/ar-inp
serial);
/* request ACK generation for any ACK or DATA packet that requests
-diff -urNp linux-2.6.32.43/net/rxrpc/ar-internal.h linux-2.6.32.43/net/rxrpc/ar-internal.h
---- linux-2.6.32.43/net/rxrpc/ar-internal.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/rxrpc/ar-internal.h 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/net/rxrpc/ar-internal.h linux-2.6.32.44/net/rxrpc/ar-internal.h
+--- linux-2.6.32.44/net/rxrpc/ar-internal.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/rxrpc/ar-internal.h 2011-05-04 17:56:28.000000000 -0400
@@ -272,8 +272,8 @@ struct rxrpc_connection {
int error; /* error code for local abort */
int debug_id; /* debug ID for printks */
@@ -74336,9 +74335,9 @@ diff -urNp linux-2.6.32.43/net/rxrpc/ar-internal.h linux-2.6.32.43/net/rxrpc/ar-
extern struct workqueue_struct *rxrpc_workqueue;
/*
-diff -urNp linux-2.6.32.43/net/rxrpc/ar-key.c linux-2.6.32.43/net/rxrpc/ar-key.c
---- linux-2.6.32.43/net/rxrpc/ar-key.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/rxrpc/ar-key.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/net/rxrpc/ar-key.c linux-2.6.32.44/net/rxrpc/ar-key.c
+--- linux-2.6.32.44/net/rxrpc/ar-key.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/rxrpc/ar-key.c 2011-04-17 15:56:46.000000000 -0400
@@ -88,11 +88,11 @@ static int rxrpc_instantiate_xdr_rxkad(s
return ret;
@@ -74366,9 +74365,9 @@ diff -urNp linux-2.6.32.43/net/rxrpc/ar-key.c linux-2.6.32.43/net/rxrpc/ar-key.c
if (!token->kad)
goto error_free;
-diff -urNp linux-2.6.32.43/net/rxrpc/ar-local.c linux-2.6.32.43/net/rxrpc/ar-local.c
---- linux-2.6.32.43/net/rxrpc/ar-local.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/rxrpc/ar-local.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/net/rxrpc/ar-local.c linux-2.6.32.44/net/rxrpc/ar-local.c
+--- linux-2.6.32.44/net/rxrpc/ar-local.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/rxrpc/ar-local.c 2011-05-04 17:56:28.000000000 -0400
@@ -44,7 +44,7 @@ struct rxrpc_local *rxrpc_alloc_local(st
spin_lock_init(&local->lock);
rwlock_init(&local->services_lock);
@@ -74378,9 +74377,9 @@ diff -urNp linux-2.6.32.43/net/rxrpc/ar-local.c linux-2.6.32.43/net/rxrpc/ar-loc
memcpy(&local->srx, srx, sizeof(*srx));
}
-diff -urNp linux-2.6.32.43/net/rxrpc/ar-output.c linux-2.6.32.43/net/rxrpc/ar-output.c
---- linux-2.6.32.43/net/rxrpc/ar-output.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/rxrpc/ar-output.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/net/rxrpc/ar-output.c linux-2.6.32.44/net/rxrpc/ar-output.c
+--- linux-2.6.32.44/net/rxrpc/ar-output.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/rxrpc/ar-output.c 2011-05-04 17:56:28.000000000 -0400
@@ -680,9 +680,9 @@ static int rxrpc_send_data(struct kiocb
sp->hdr.cid = call->cid;
sp->hdr.callNumber = call->call_id;
@@ -74393,9 +74392,9 @@ diff -urNp linux-2.6.32.43/net/rxrpc/ar-output.c linux-2.6.32.43/net/rxrpc/ar-ou
sp->hdr.type = RXRPC_PACKET_TYPE_DATA;
sp->hdr.userStatus = 0;
sp->hdr.securityIndex = conn->security_ix;
-diff -urNp linux-2.6.32.43/net/rxrpc/ar-peer.c linux-2.6.32.43/net/rxrpc/ar-peer.c
---- linux-2.6.32.43/net/rxrpc/ar-peer.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/rxrpc/ar-peer.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/net/rxrpc/ar-peer.c linux-2.6.32.44/net/rxrpc/ar-peer.c
+--- linux-2.6.32.44/net/rxrpc/ar-peer.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/rxrpc/ar-peer.c 2011-05-04 17:56:28.000000000 -0400
@@ -86,7 +86,7 @@ static struct rxrpc_peer *rxrpc_alloc_pe
INIT_LIST_HEAD(&peer->error_targets);
spin_lock_init(&peer->lock);
@@ -74405,9 +74404,9 @@ diff -urNp linux-2.6.32.43/net/rxrpc/ar-peer.c linux-2.6.32.43/net/rxrpc/ar-peer
memcpy(&peer->srx, srx, sizeof(*srx));
rxrpc_assess_MTU_size(peer);
-diff -urNp linux-2.6.32.43/net/rxrpc/ar-proc.c linux-2.6.32.43/net/rxrpc/ar-proc.c
---- linux-2.6.32.43/net/rxrpc/ar-proc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/rxrpc/ar-proc.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/net/rxrpc/ar-proc.c linux-2.6.32.44/net/rxrpc/ar-proc.c
+--- linux-2.6.32.44/net/rxrpc/ar-proc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/rxrpc/ar-proc.c 2011-05-04 17:56:28.000000000 -0400
@@ -164,8 +164,8 @@ static int rxrpc_connection_seq_show(str
atomic_read(&conn->usage),
rxrpc_conn_states[conn->state],
@@ -74419,9 +74418,9 @@ diff -urNp linux-2.6.32.43/net/rxrpc/ar-proc.c linux-2.6.32.43/net/rxrpc/ar-proc
return 0;
}
-diff -urNp linux-2.6.32.43/net/rxrpc/ar-transport.c linux-2.6.32.43/net/rxrpc/ar-transport.c
---- linux-2.6.32.43/net/rxrpc/ar-transport.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/rxrpc/ar-transport.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/net/rxrpc/ar-transport.c linux-2.6.32.44/net/rxrpc/ar-transport.c
+--- linux-2.6.32.44/net/rxrpc/ar-transport.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/rxrpc/ar-transport.c 2011-05-04 17:56:28.000000000 -0400
@@ -46,7 +46,7 @@ static struct rxrpc_transport *rxrpc_all
spin_lock_init(&trans->client_lock);
rwlock_init(&trans->conn_lock);
@@ -74431,9 +74430,9 @@ diff -urNp linux-2.6.32.43/net/rxrpc/ar-transport.c linux-2.6.32.43/net/rxrpc/ar
if (peer->srx.transport.family == AF_INET) {
switch (peer->srx.transport_type) {
-diff -urNp linux-2.6.32.43/net/rxrpc/rxkad.c linux-2.6.32.43/net/rxrpc/rxkad.c
---- linux-2.6.32.43/net/rxrpc/rxkad.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/rxrpc/rxkad.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/net/rxrpc/rxkad.c linux-2.6.32.44/net/rxrpc/rxkad.c
+--- linux-2.6.32.44/net/rxrpc/rxkad.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/rxrpc/rxkad.c 2011-05-16 21:46:57.000000000 -0400
@@ -210,6 +210,8 @@ static int rxkad_secure_packet_encrypt(c
u16 check;
int nsg;
@@ -74470,9 +74469,9 @@ diff -urNp linux-2.6.32.43/net/rxrpc/rxkad.c linux-2.6.32.43/net/rxrpc/rxkad.c
_proto("Tx RESPONSE %%%u", ntohl(hdr->serial));
ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 3, len);
-diff -urNp linux-2.6.32.43/net/sctp/proc.c linux-2.6.32.43/net/sctp/proc.c
---- linux-2.6.32.43/net/sctp/proc.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/sctp/proc.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/net/sctp/proc.c linux-2.6.32.44/net/sctp/proc.c
+--- linux-2.6.32.44/net/sctp/proc.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/sctp/proc.c 2011-04-17 15:56:46.000000000 -0400
@@ -213,7 +213,12 @@ static int sctp_eps_seq_show(struct seq_
sctp_for_each_hentry(epb, node, &head->chain) {
ep = sctp_ep(epb);
@@ -74501,9 +74500,9 @@ diff -urNp linux-2.6.32.43/net/sctp/proc.c linux-2.6.32.43/net/sctp/proc.c
assoc->state, hash,
assoc->assoc_id,
assoc->sndbuf_used,
-diff -urNp linux-2.6.32.43/net/sctp/socket.c linux-2.6.32.43/net/sctp/socket.c
---- linux-2.6.32.43/net/sctp/socket.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/sctp/socket.c 2011-04-23 12:56:11.000000000 -0400
+diff -urNp linux-2.6.32.44/net/sctp/socket.c linux-2.6.32.44/net/sctp/socket.c
+--- linux-2.6.32.44/net/sctp/socket.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/sctp/socket.c 2011-04-23 12:56:11.000000000 -0400
@@ -5802,7 +5802,6 @@ pp_found:
*/
int reuse = sk->sk_reuse;
@@ -74512,9 +74511,9 @@ diff -urNp linux-2.6.32.43/net/sctp/socket.c linux-2.6.32.43/net/sctp/socket.c
SCTP_DEBUG_PRINTK("sctp_get_port() found a possible match\n");
if (pp->fastreuse && sk->sk_reuse &&
-diff -urNp linux-2.6.32.43/net/socket.c linux-2.6.32.43/net/socket.c
---- linux-2.6.32.43/net/socket.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/socket.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/net/socket.c linux-2.6.32.44/net/socket.c
+--- linux-2.6.32.44/net/socket.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/socket.c 2011-05-16 21:46:57.000000000 -0400
@@ -87,6 +87,7 @@
#include <linux/wireless.h>
#include <linux/nsproxy.h>
@@ -74687,9 +74686,9 @@ diff -urNp linux-2.6.32.43/net/socket.c linux-2.6.32.43/net/socket.c
err = -EFAULT;
if (MSG_CMSG_COMPAT & flags) {
if (get_compat_msghdr(&msg_sys, msg_compat))
-diff -urNp linux-2.6.32.43/net/sunrpc/sched.c linux-2.6.32.43/net/sunrpc/sched.c
---- linux-2.6.32.43/net/sunrpc/sched.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/sunrpc/sched.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/net/sunrpc/sched.c linux-2.6.32.44/net/sunrpc/sched.c
+--- linux-2.6.32.44/net/sunrpc/sched.c 2011-08-09 18:35:30.000000000 -0400
++++ linux-2.6.32.44/net/sunrpc/sched.c 2011-08-09 18:34:01.000000000 -0400
@@ -234,10 +234,10 @@ static int rpc_wait_bit_killable(void *w
#ifdef RPC_DEBUG
static void rpc_task_set_debuginfo(struct rpc_task *task)
@@ -74703,9 +74702,9 @@ diff -urNp linux-2.6.32.43/net/sunrpc/sched.c linux-2.6.32.43/net/sunrpc/sched.c
}
#else
static inline void rpc_task_set_debuginfo(struct rpc_task *task)
-diff -urNp linux-2.6.32.43/net/sunrpc/xprtrdma/svc_rdma.c linux-2.6.32.43/net/sunrpc/xprtrdma/svc_rdma.c
---- linux-2.6.32.43/net/sunrpc/xprtrdma/svc_rdma.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/sunrpc/xprtrdma/svc_rdma.c 2011-05-04 17:56:20.000000000 -0400
+diff -urNp linux-2.6.32.44/net/sunrpc/xprtrdma/svc_rdma.c linux-2.6.32.44/net/sunrpc/xprtrdma/svc_rdma.c
+--- linux-2.6.32.44/net/sunrpc/xprtrdma/svc_rdma.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/sunrpc/xprtrdma/svc_rdma.c 2011-05-04 17:56:20.000000000 -0400
@@ -59,15 +59,15 @@ unsigned int svcrdma_max_req_size = RPCR
static unsigned int min_max_inline = 4096;
static unsigned int max_max_inline = 65536;
@@ -74813,9 +74812,9 @@ diff -urNp linux-2.6.32.43/net/sunrpc/xprtrdma/svc_rdma.c linux-2.6.32.43/net/su
.mode = 0644,
.proc_handler = &read_reset_stat,
},
-diff -urNp linux-2.6.32.43/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c linux-2.6.32.43/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
---- linux-2.6.32.43/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c linux-2.6.32.44/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+--- linux-2.6.32.44/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c 2011-05-04 17:56:28.000000000 -0400
@@ -495,7 +495,7 @@ next_sge:
svc_rdma_put_context(ctxt, 0);
goto out;
@@ -74843,9 +74842,9 @@ diff -urNp linux-2.6.32.43/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c linux-2.6.32.
/* Build up the XDR from the receive buffers. */
rdma_build_arg_xdr(rqstp, ctxt, ctxt->byte_len);
-diff -urNp linux-2.6.32.43/net/sunrpc/xprtrdma/svc_rdma_sendto.c linux-2.6.32.43/net/sunrpc/xprtrdma/svc_rdma_sendto.c
---- linux-2.6.32.43/net/sunrpc/xprtrdma/svc_rdma_sendto.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/sunrpc/xprtrdma/svc_rdma_sendto.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/net/sunrpc/xprtrdma/svc_rdma_sendto.c linux-2.6.32.44/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+--- linux-2.6.32.44/net/sunrpc/xprtrdma/svc_rdma_sendto.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/sunrpc/xprtrdma/svc_rdma_sendto.c 2011-05-04 17:56:28.000000000 -0400
@@ -328,7 +328,7 @@ static int send_write(struct svcxprt_rdm
write_wr.wr.rdma.remote_addr = to;
@@ -74855,9 +74854,9 @@ diff -urNp linux-2.6.32.43/net/sunrpc/xprtrdma/svc_rdma_sendto.c linux-2.6.32.43
if (svc_rdma_send(xprt, &write_wr))
goto err;
return 0;
-diff -urNp linux-2.6.32.43/net/sunrpc/xprtrdma/svc_rdma_transport.c linux-2.6.32.43/net/sunrpc/xprtrdma/svc_rdma_transport.c
---- linux-2.6.32.43/net/sunrpc/xprtrdma/svc_rdma_transport.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/sunrpc/xprtrdma/svc_rdma_transport.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/net/sunrpc/xprtrdma/svc_rdma_transport.c linux-2.6.32.44/net/sunrpc/xprtrdma/svc_rdma_transport.c
+--- linux-2.6.32.44/net/sunrpc/xprtrdma/svc_rdma_transport.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/sunrpc/xprtrdma/svc_rdma_transport.c 2011-05-04 17:56:28.000000000 -0400
@@ -292,7 +292,7 @@ static void rq_cq_reap(struct svcxprt_rd
return;
@@ -74903,9 +74902,9 @@ diff -urNp linux-2.6.32.43/net/sunrpc/xprtrdma/svc_rdma_transport.c linux-2.6.32
/* See if we can opportunistically reap SQ WR to make room */
sq_cq_reap(xprt);
-diff -urNp linux-2.6.32.43/net/sysctl_net.c linux-2.6.32.43/net/sysctl_net.c
---- linux-2.6.32.43/net/sysctl_net.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/sysctl_net.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/net/sysctl_net.c linux-2.6.32.44/net/sysctl_net.c
+--- linux-2.6.32.44/net/sysctl_net.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/sysctl_net.c 2011-04-17 15:56:46.000000000 -0400
@@ -46,7 +46,7 @@ static int net_ctl_permissions(struct ct
struct ctl_table *table)
{
@@ -74915,9 +74914,9 @@ diff -urNp linux-2.6.32.43/net/sysctl_net.c linux-2.6.32.43/net/sysctl_net.c
int mode = (table->mode >> 6) & 7;
return (mode << 6) | (mode << 3) | mode;
}
-diff -urNp linux-2.6.32.43/net/unix/af_unix.c linux-2.6.32.43/net/unix/af_unix.c
---- linux-2.6.32.43/net/unix/af_unix.c 2011-05-10 22:12:02.000000000 -0400
-+++ linux-2.6.32.43/net/unix/af_unix.c 2011-07-18 18:17:33.000000000 -0400
+diff -urNp linux-2.6.32.44/net/unix/af_unix.c linux-2.6.32.44/net/unix/af_unix.c
+--- linux-2.6.32.44/net/unix/af_unix.c 2011-05-10 22:12:02.000000000 -0400
++++ linux-2.6.32.44/net/unix/af_unix.c 2011-07-18 18:17:33.000000000 -0400
@@ -745,6 +745,12 @@ static struct sock *unix_find_other(stru
err = -ECONNREFUSED;
if (!S_ISSOCK(inode->i_mode))
@@ -74976,9 +74975,9 @@ diff -urNp linux-2.6.32.43/net/unix/af_unix.c linux-2.6.32.43/net/unix/af_unix.c
atomic_read(&s->sk_refcnt),
0,
s->sk_state == TCP_LISTEN ? __SO_ACCEPTCON : 0,
-diff -urNp linux-2.6.32.43/net/wireless/core.c linux-2.6.32.43/net/wireless/core.c
---- linux-2.6.32.43/net/wireless/core.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/wireless/core.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/net/wireless/core.c linux-2.6.32.44/net/wireless/core.c
+--- linux-2.6.32.44/net/wireless/core.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/wireless/core.c 2011-08-05 20:33:55.000000000 -0400
@@ -367,7 +367,7 @@ struct wiphy *wiphy_new(const struct cfg
wiphy_net_set(&rdev->wiphy, &init_net);
@@ -74997,9 +74996,9 @@ diff -urNp linux-2.6.32.43/net/wireless/core.c linux-2.6.32.43/net/wireless/core
rfkill_resume_polling(rdev->rfkill);
}
EXPORT_SYMBOL(wiphy_rfkill_start_polling);
-diff -urNp linux-2.6.32.43/net/wireless/wext.c linux-2.6.32.43/net/wireless/wext.c
---- linux-2.6.32.43/net/wireless/wext.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/wireless/wext.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/net/wireless/wext.c linux-2.6.32.44/net/wireless/wext.c
+--- linux-2.6.32.44/net/wireless/wext.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/wireless/wext.c 2011-04-17 15:56:46.000000000 -0400
@@ -816,8 +816,7 @@ static int ioctl_standard_iw_point(struc
*/
@@ -75033,9 +75032,9 @@ diff -urNp linux-2.6.32.43/net/wireless/wext.c linux-2.6.32.43/net/wireless/wext
err = handler(dev, info, (union iwreq_data *) iwp, extra);
iwp->length += essid_compat;
-diff -urNp linux-2.6.32.43/net/xfrm/xfrm_policy.c linux-2.6.32.43/net/xfrm/xfrm_policy.c
---- linux-2.6.32.43/net/xfrm/xfrm_policy.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/xfrm/xfrm_policy.c 2011-05-04 17:56:20.000000000 -0400
+diff -urNp linux-2.6.32.44/net/xfrm/xfrm_policy.c linux-2.6.32.44/net/xfrm/xfrm_policy.c
+--- linux-2.6.32.44/net/xfrm/xfrm_policy.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/xfrm/xfrm_policy.c 2011-05-04 17:56:20.000000000 -0400
@@ -586,7 +586,7 @@ int xfrm_policy_insert(int dir, struct x
hlist_add_head(&policy->bydst, chain);
xfrm_pol_hold(policy);
@@ -75126,9 +75125,9 @@ diff -urNp linux-2.6.32.43/net/xfrm/xfrm_policy.c linux-2.6.32.43/net/xfrm/xfrm_
xfrm_pols_put(pols, npols);
goto restart;
}
-diff -urNp linux-2.6.32.43/net/xfrm/xfrm_user.c linux-2.6.32.43/net/xfrm/xfrm_user.c
---- linux-2.6.32.43/net/xfrm/xfrm_user.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/net/xfrm/xfrm_user.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/net/xfrm/xfrm_user.c linux-2.6.32.44/net/xfrm/xfrm_user.c
+--- linux-2.6.32.44/net/xfrm/xfrm_user.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/net/xfrm/xfrm_user.c 2011-05-16 21:46:57.000000000 -0400
@@ -1169,6 +1169,8 @@ static int copy_to_user_tmpl(struct xfrm
struct xfrm_user_tmpl vec[XFRM_MAX_DEPTH];
int i;
@@ -75147,9 +75146,9 @@ diff -urNp linux-2.6.32.43/net/xfrm/xfrm_user.c linux-2.6.32.43/net/xfrm/xfrm_us
if (attrs[XFRMA_MIGRATE] == NULL)
return -EINVAL;
-diff -urNp linux-2.6.32.43/samples/kobject/kset-example.c linux-2.6.32.43/samples/kobject/kset-example.c
---- linux-2.6.32.43/samples/kobject/kset-example.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/samples/kobject/kset-example.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/samples/kobject/kset-example.c linux-2.6.32.44/samples/kobject/kset-example.c
+--- linux-2.6.32.44/samples/kobject/kset-example.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/samples/kobject/kset-example.c 2011-04-17 15:56:46.000000000 -0400
@@ -87,7 +87,7 @@ static ssize_t foo_attr_store(struct kob
}
@@ -75159,9 +75158,9 @@ diff -urNp linux-2.6.32.43/samples/kobject/kset-example.c linux-2.6.32.43/sample
.show = foo_attr_show,
.store = foo_attr_store,
};
-diff -urNp linux-2.6.32.43/scripts/basic/fixdep.c linux-2.6.32.43/scripts/basic/fixdep.c
---- linux-2.6.32.43/scripts/basic/fixdep.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/scripts/basic/fixdep.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/scripts/basic/fixdep.c linux-2.6.32.44/scripts/basic/fixdep.c
+--- linux-2.6.32.44/scripts/basic/fixdep.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/scripts/basic/fixdep.c 2011-04-17 15:56:46.000000000 -0400
@@ -222,9 +222,9 @@ static void use_config(char *m, int slen
static void parse_config_file(char *map, size_t len)
@@ -75183,16 +75182,16 @@ diff -urNp linux-2.6.32.43/scripts/basic/fixdep.c linux-2.6.32.43/scripts/basic/
if (*p != INT_CONF) {
fprintf(stderr, "fixdep: sizeof(int) != 4 or wrong endianess? %#x\n",
-diff -urNp linux-2.6.32.43/scripts/gcc-plugin.sh linux-2.6.32.43/scripts/gcc-plugin.sh
---- linux-2.6.32.43/scripts/gcc-plugin.sh 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/scripts/gcc-plugin.sh 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/scripts/gcc-plugin.sh linux-2.6.32.44/scripts/gcc-plugin.sh
+--- linux-2.6.32.44/scripts/gcc-plugin.sh 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/scripts/gcc-plugin.sh 2011-08-05 20:33:55.000000000 -0400
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+echo "#include \"gcc-plugin.h\"" | $* -x c - -c -o /dev/null -I`$* -print-file-name=plugin`/include>/dev/null 2>&1 && echo "y"
-diff -urNp linux-2.6.32.43/scripts/Makefile.build linux-2.6.32.43/scripts/Makefile.build
---- linux-2.6.32.43/scripts/Makefile.build 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/scripts/Makefile.build 2011-06-04 20:46:51.000000000 -0400
+diff -urNp linux-2.6.32.44/scripts/Makefile.build linux-2.6.32.44/scripts/Makefile.build
+--- linux-2.6.32.44/scripts/Makefile.build 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/scripts/Makefile.build 2011-06-04 20:46:51.000000000 -0400
@@ -59,7 +59,7 @@ endif
endif
@@ -75202,9 +75201,9 @@ diff -urNp linux-2.6.32.43/scripts/Makefile.build linux-2.6.32.43/scripts/Makefi
include scripts/Makefile.host
endif
-diff -urNp linux-2.6.32.43/scripts/Makefile.clean linux-2.6.32.43/scripts/Makefile.clean
---- linux-2.6.32.43/scripts/Makefile.clean 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/scripts/Makefile.clean 2011-06-04 20:47:19.000000000 -0400
+diff -urNp linux-2.6.32.44/scripts/Makefile.clean linux-2.6.32.44/scripts/Makefile.clean
+--- linux-2.6.32.44/scripts/Makefile.clean 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/scripts/Makefile.clean 2011-06-04 20:47:19.000000000 -0400
@@ -43,7 +43,8 @@ subdir-ymn := $(addprefix $(obj)/,$(subd
__clean-files := $(extra-y) $(always) \
$(targets) $(clean-files) \
@@ -75215,9 +75214,9 @@ diff -urNp linux-2.6.32.43/scripts/Makefile.clean linux-2.6.32.43/scripts/Makefi
# as clean-files is given relative to the current directory, this adds
# a $(obj) prefix, except for absolute paths
-diff -urNp linux-2.6.32.43/scripts/Makefile.host linux-2.6.32.43/scripts/Makefile.host
---- linux-2.6.32.43/scripts/Makefile.host 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/scripts/Makefile.host 2011-06-04 20:48:22.000000000 -0400
+diff -urNp linux-2.6.32.44/scripts/Makefile.host linux-2.6.32.44/scripts/Makefile.host
+--- linux-2.6.32.44/scripts/Makefile.host 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/scripts/Makefile.host 2011-06-04 20:48:22.000000000 -0400
@@ -31,6 +31,7 @@
# Note: Shared libraries consisting of C++ files are not supported
@@ -75234,9 +75233,9 @@ diff -urNp linux-2.6.32.43/scripts/Makefile.host linux-2.6.32.43/scripts/Makefil
# Remove .so files from "xxx-objs"
host-cobjs := $(filter-out %.so,$(host-cobjs))
-diff -urNp linux-2.6.32.43/scripts/mod/file2alias.c linux-2.6.32.43/scripts/mod/file2alias.c
---- linux-2.6.32.43/scripts/mod/file2alias.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/scripts/mod/file2alias.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/scripts/mod/file2alias.c linux-2.6.32.44/scripts/mod/file2alias.c
+--- linux-2.6.32.44/scripts/mod/file2alias.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/scripts/mod/file2alias.c 2011-04-17 15:56:46.000000000 -0400
@@ -72,7 +72,7 @@ static void device_id_check(const char *
unsigned long size, unsigned long id_size,
void *symval)
@@ -75291,9 +75290,9 @@ diff -urNp linux-2.6.32.43/scripts/mod/file2alias.c linux-2.6.32.43/scripts/mod/
sprintf(alias, "dmi*");
-diff -urNp linux-2.6.32.43/scripts/mod/modpost.c linux-2.6.32.43/scripts/mod/modpost.c
---- linux-2.6.32.43/scripts/mod/modpost.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/scripts/mod/modpost.c 2011-07-06 19:53:33.000000000 -0400
+diff -urNp linux-2.6.32.44/scripts/mod/modpost.c linux-2.6.32.44/scripts/mod/modpost.c
+--- linux-2.6.32.44/scripts/mod/modpost.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/scripts/mod/modpost.c 2011-07-06 19:53:33.000000000 -0400
@@ -835,6 +835,7 @@ enum mismatch {
INIT_TO_EXIT,
EXIT_TO_INIT,
@@ -75370,9 +75369,9 @@ diff -urNp linux-2.6.32.43/scripts/mod/modpost.c linux-2.6.32.43/scripts/mod/mod
goto close_write;
tmp = NOFAIL(malloc(b->pos));
-diff -urNp linux-2.6.32.43/scripts/mod/modpost.h linux-2.6.32.43/scripts/mod/modpost.h
---- linux-2.6.32.43/scripts/mod/modpost.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/scripts/mod/modpost.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/scripts/mod/modpost.h linux-2.6.32.44/scripts/mod/modpost.h
+--- linux-2.6.32.44/scripts/mod/modpost.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/scripts/mod/modpost.h 2011-04-17 15:56:46.000000000 -0400
@@ -92,15 +92,15 @@ void *do_nofail(void *ptr, const char *e
struct buffer {
@@ -75392,9 +75391,9 @@ diff -urNp linux-2.6.32.43/scripts/mod/modpost.h linux-2.6.32.43/scripts/mod/mod
struct module {
struct module *next;
-diff -urNp linux-2.6.32.43/scripts/mod/sumversion.c linux-2.6.32.43/scripts/mod/sumversion.c
---- linux-2.6.32.43/scripts/mod/sumversion.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/scripts/mod/sumversion.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/scripts/mod/sumversion.c linux-2.6.32.44/scripts/mod/sumversion.c
+--- linux-2.6.32.44/scripts/mod/sumversion.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/scripts/mod/sumversion.c 2011-04-17 15:56:46.000000000 -0400
@@ -455,7 +455,7 @@ static void write_version(const char *fi
goto out;
}
@@ -75404,9 +75403,9 @@ diff -urNp linux-2.6.32.43/scripts/mod/sumversion.c linux-2.6.32.43/scripts/mod/
warn("writing sum in %s failed: %s\n",
filename, strerror(errno));
goto out;
-diff -urNp linux-2.6.32.43/scripts/package/mkspec linux-2.6.32.43/scripts/package/mkspec
---- linux-2.6.32.43/scripts/package/mkspec 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/scripts/package/mkspec 2011-07-19 18:19:12.000000000 -0400
+diff -urNp linux-2.6.32.44/scripts/package/mkspec linux-2.6.32.44/scripts/package/mkspec
+--- linux-2.6.32.44/scripts/package/mkspec 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/scripts/package/mkspec 2011-07-19 18:19:12.000000000 -0400
@@ -70,7 +70,7 @@ echo 'mkdir -p $RPM_BUILD_ROOT/boot $RPM
echo 'mkdir -p $RPM_BUILD_ROOT/lib/firmware'
echo "%endif"
@@ -75416,9 +75415,9 @@ diff -urNp linux-2.6.32.43/scripts/package/mkspec linux-2.6.32.43/scripts/packag
echo "%ifarch ia64"
echo 'cp $KBUILD_IMAGE $RPM_BUILD_ROOT'"/boot/efi/vmlinuz-$KERNELRELEASE"
echo 'ln -s '"efi/vmlinuz-$KERNELRELEASE" '$RPM_BUILD_ROOT'"/boot/"
-diff -urNp linux-2.6.32.43/scripts/pnmtologo.c linux-2.6.32.43/scripts/pnmtologo.c
---- linux-2.6.32.43/scripts/pnmtologo.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/scripts/pnmtologo.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/scripts/pnmtologo.c linux-2.6.32.44/scripts/pnmtologo.c
+--- linux-2.6.32.44/scripts/pnmtologo.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/scripts/pnmtologo.c 2011-04-17 15:56:46.000000000 -0400
@@ -237,14 +237,14 @@ static void write_header(void)
fprintf(out, " * Linux logo %s\n", logoname);
fputs(" */\n\n", out);
@@ -75445,9 +75444,9 @@ diff -urNp linux-2.6.32.43/scripts/pnmtologo.c linux-2.6.32.43/scripts/pnmtologo
logoname);
write_hex_cnt = 0;
for (i = 0; i < logo_clutsize; i++) {
-diff -urNp linux-2.6.32.43/scripts/tags.sh linux-2.6.32.43/scripts/tags.sh
---- linux-2.6.32.43/scripts/tags.sh 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/scripts/tags.sh 2011-06-07 18:06:04.000000000 -0400
+diff -urNp linux-2.6.32.44/scripts/tags.sh linux-2.6.32.44/scripts/tags.sh
+--- linux-2.6.32.44/scripts/tags.sh 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/scripts/tags.sh 2011-06-07 18:06:04.000000000 -0400
@@ -93,6 +93,11 @@ docscope()
cscope -b -f cscope.out
}
@@ -75471,9 +75470,9 @@ diff -urNp linux-2.6.32.43/scripts/tags.sh linux-2.6.32.43/scripts/tags.sh
"tags")
rm -f tags
xtags ctags
-diff -urNp linux-2.6.32.43/security/capability.c linux-2.6.32.43/security/capability.c
---- linux-2.6.32.43/security/capability.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/security/capability.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/security/capability.c linux-2.6.32.44/security/capability.c
+--- linux-2.6.32.44/security/capability.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/security/capability.c 2011-04-17 15:56:46.000000000 -0400
@@ -890,7 +890,7 @@ static void cap_audit_rule_free(void *ls
}
#endif /* CONFIG_AUDIT */
@@ -75483,9 +75482,9 @@ diff -urNp linux-2.6.32.43/security/capability.c linux-2.6.32.43/security/capabi
.name = "default",
};
-diff -urNp linux-2.6.32.43/security/commoncap.c linux-2.6.32.43/security/commoncap.c
---- linux-2.6.32.43/security/commoncap.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/security/commoncap.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/security/commoncap.c linux-2.6.32.44/security/commoncap.c
+--- linux-2.6.32.44/security/commoncap.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/security/commoncap.c 2011-04-17 15:56:46.000000000 -0400
@@ -27,7 +27,7 @@
#include <linux/sched.h>
#include <linux/prctl.h>
@@ -75518,9 +75517,9 @@ diff -urNp linux-2.6.32.43/security/commoncap.c linux-2.6.32.43/security/commonc
if (cred->uid != 0) {
if (bprm->cap_effective)
return 1;
-diff -urNp linux-2.6.32.43/security/integrity/ima/ima_api.c linux-2.6.32.43/security/integrity/ima/ima_api.c
---- linux-2.6.32.43/security/integrity/ima/ima_api.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/security/integrity/ima/ima_api.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/security/integrity/ima/ima_api.c linux-2.6.32.44/security/integrity/ima/ima_api.c
+--- linux-2.6.32.44/security/integrity/ima/ima_api.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/security/integrity/ima/ima_api.c 2011-04-17 15:56:46.000000000 -0400
@@ -74,7 +74,7 @@ void ima_add_violation(struct inode *ino
int result;
@@ -75530,9 +75529,9 @@ diff -urNp linux-2.6.32.43/security/integrity/ima/ima_api.c linux-2.6.32.43/secu
entry = kmalloc(sizeof(*entry), GFP_KERNEL);
if (!entry) {
-diff -urNp linux-2.6.32.43/security/integrity/ima/ima_fs.c linux-2.6.32.43/security/integrity/ima/ima_fs.c
---- linux-2.6.32.43/security/integrity/ima/ima_fs.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/security/integrity/ima/ima_fs.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/security/integrity/ima/ima_fs.c linux-2.6.32.44/security/integrity/ima/ima_fs.c
+--- linux-2.6.32.44/security/integrity/ima/ima_fs.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/security/integrity/ima/ima_fs.c 2011-04-17 15:56:46.000000000 -0400
@@ -27,12 +27,12 @@
static int valid_policy = 1;
#define TMPBUFLEN 12
@@ -75548,9 +75547,9 @@ diff -urNp linux-2.6.32.43/security/integrity/ima/ima_fs.c linux-2.6.32.43/secur
return simple_read_from_buffer(buf, count, ppos, tmpbuf, len);
}
-diff -urNp linux-2.6.32.43/security/integrity/ima/ima.h linux-2.6.32.43/security/integrity/ima/ima.h
---- linux-2.6.32.43/security/integrity/ima/ima.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/security/integrity/ima/ima.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/security/integrity/ima/ima.h linux-2.6.32.44/security/integrity/ima/ima.h
+--- linux-2.6.32.44/security/integrity/ima/ima.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/security/integrity/ima/ima.h 2011-04-17 15:56:46.000000000 -0400
@@ -84,8 +84,8 @@ void ima_add_violation(struct inode *ino
extern spinlock_t ima_queue_lock;
@@ -75562,9 +75561,9 @@ diff -urNp linux-2.6.32.43/security/integrity/ima/ima.h linux-2.6.32.43/security
struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE];
};
extern struct ima_h_table ima_htable;
-diff -urNp linux-2.6.32.43/security/integrity/ima/ima_queue.c linux-2.6.32.43/security/integrity/ima/ima_queue.c
---- linux-2.6.32.43/security/integrity/ima/ima_queue.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/security/integrity/ima/ima_queue.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/security/integrity/ima/ima_queue.c linux-2.6.32.44/security/integrity/ima/ima_queue.c
+--- linux-2.6.32.44/security/integrity/ima/ima_queue.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/security/integrity/ima/ima_queue.c 2011-04-17 15:56:46.000000000 -0400
@@ -78,7 +78,7 @@ static int ima_add_digest_entry(struct i
INIT_LIST_HEAD(&qe->later);
list_add_tail_rcu(&qe->later, &ima_measurements);
@@ -75574,9 +75573,9 @@ diff -urNp linux-2.6.32.43/security/integrity/ima/ima_queue.c linux-2.6.32.43/se
key = ima_hash_key(entry->digest);
hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]);
return 0;
-diff -urNp linux-2.6.32.43/security/Kconfig linux-2.6.32.43/security/Kconfig
---- linux-2.6.32.43/security/Kconfig 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/security/Kconfig 2011-07-06 19:58:11.000000000 -0400
+diff -urNp linux-2.6.32.44/security/Kconfig linux-2.6.32.44/security/Kconfig
+--- linux-2.6.32.44/security/Kconfig 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/security/Kconfig 2011-07-06 19:58:11.000000000 -0400
@@ -4,6 +4,555 @@
menu "Security options"
@@ -76142,9 +76141,9 @@ diff -urNp linux-2.6.32.43/security/Kconfig linux-2.6.32.43/security/Kconfig
help
This is the portion of low virtual memory which should be protected
from userspace allocation. Keeping a user from writing to low pages
-diff -urNp linux-2.6.32.43/security/keys/keyring.c linux-2.6.32.43/security/keys/keyring.c
---- linux-2.6.32.43/security/keys/keyring.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/security/keys/keyring.c 2011-04-18 22:03:00.000000000 -0400
+diff -urNp linux-2.6.32.44/security/keys/keyring.c linux-2.6.32.44/security/keys/keyring.c
+--- linux-2.6.32.44/security/keys/keyring.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/security/keys/keyring.c 2011-04-18 22:03:00.000000000 -0400
@@ -214,15 +214,15 @@ static long keyring_read(const struct ke
ret = -EFAULT;
@@ -76164,9 +76163,9 @@ diff -urNp linux-2.6.32.43/security/keys/keyring.c linux-2.6.32.43/security/keys
goto error;
buflen -= tmp;
-diff -urNp linux-2.6.32.43/security/min_addr.c linux-2.6.32.43/security/min_addr.c
---- linux-2.6.32.43/security/min_addr.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/security/min_addr.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/security/min_addr.c linux-2.6.32.44/security/min_addr.c
+--- linux-2.6.32.44/security/min_addr.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/security/min_addr.c 2011-04-17 15:56:46.000000000 -0400
@@ -14,6 +14,7 @@ unsigned long dac_mmap_min_addr = CONFIG
*/
static void update_mmap_min_addr(void)
@@ -76183,9 +76182,9 @@ diff -urNp linux-2.6.32.43/security/min_addr.c linux-2.6.32.43/security/min_addr
}
/*
-diff -urNp linux-2.6.32.43/security/root_plug.c linux-2.6.32.43/security/root_plug.c
---- linux-2.6.32.43/security/root_plug.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/security/root_plug.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/security/root_plug.c linux-2.6.32.44/security/root_plug.c
+--- linux-2.6.32.44/security/root_plug.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/security/root_plug.c 2011-04-17 15:56:46.000000000 -0400
@@ -70,7 +70,7 @@ static int rootplug_bprm_check_security
return 0;
}
@@ -76195,9 +76194,9 @@ diff -urNp linux-2.6.32.43/security/root_plug.c linux-2.6.32.43/security/root_pl
.bprm_check_security = rootplug_bprm_check_security,
};
-diff -urNp linux-2.6.32.43/security/security.c linux-2.6.32.43/security/security.c
---- linux-2.6.32.43/security/security.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/security/security.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/security/security.c linux-2.6.32.44/security/security.c
+--- linux-2.6.32.44/security/security.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/security/security.c 2011-04-17 15:56:46.000000000 -0400
@@ -24,7 +24,7 @@ static __initdata char chosen_lsm[SECURI
extern struct security_operations default_security_ops;
extern void security_fixup_ops(struct security_operations *ops);
@@ -76216,9 +76215,9 @@ diff -urNp linux-2.6.32.43/security/security.c linux-2.6.32.43/security/security
{
if (verify(ops)) {
printk(KERN_DEBUG "%s could not verify "
-diff -urNp linux-2.6.32.43/security/selinux/hooks.c linux-2.6.32.43/security/selinux/hooks.c
---- linux-2.6.32.43/security/selinux/hooks.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/security/selinux/hooks.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/security/selinux/hooks.c linux-2.6.32.44/security/selinux/hooks.c
+--- linux-2.6.32.44/security/selinux/hooks.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/security/selinux/hooks.c 2011-04-17 15:56:46.000000000 -0400
@@ -131,7 +131,7 @@ int selinux_enabled = 1;
* Minimal support for a secondary security module,
* just to allow the use of the capability module.
@@ -76247,9 +76246,9 @@ diff -urNp linux-2.6.32.43/security/selinux/hooks.c linux-2.6.32.43/security/sel
/* Unregister netfilter hooks. */
selinux_nf_ip_exit();
-diff -urNp linux-2.6.32.43/security/selinux/include/xfrm.h linux-2.6.32.43/security/selinux/include/xfrm.h
---- linux-2.6.32.43/security/selinux/include/xfrm.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/security/selinux/include/xfrm.h 2011-05-18 20:09:37.000000000 -0400
+diff -urNp linux-2.6.32.44/security/selinux/include/xfrm.h linux-2.6.32.44/security/selinux/include/xfrm.h
+--- linux-2.6.32.44/security/selinux/include/xfrm.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/security/selinux/include/xfrm.h 2011-05-18 20:09:37.000000000 -0400
@@ -48,7 +48,7 @@ int selinux_xfrm_decode_session(struct s
static inline void selinux_xfrm_notify_policyload(void)
@@ -76259,9 +76258,9 @@ diff -urNp linux-2.6.32.43/security/selinux/include/xfrm.h linux-2.6.32.43/secur
}
#else
static inline int selinux_xfrm_enabled(void)
-diff -urNp linux-2.6.32.43/security/selinux/ss/services.c linux-2.6.32.43/security/selinux/ss/services.c
---- linux-2.6.32.43/security/selinux/ss/services.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/security/selinux/ss/services.c 2011-05-16 21:46:57.000000000 -0400
+diff -urNp linux-2.6.32.44/security/selinux/ss/services.c linux-2.6.32.44/security/selinux/ss/services.c
+--- linux-2.6.32.44/security/selinux/ss/services.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/security/selinux/ss/services.c 2011-05-16 21:46:57.000000000 -0400
@@ -1715,6 +1715,8 @@ int security_load_policy(void *data, siz
int rc = 0;
struct policy_file file = { data, len }, *fp = &file;
@@ -76271,9 +76270,9 @@ diff -urNp linux-2.6.32.43/security/selinux/ss/services.c linux-2.6.32.43/securi
if (!ss_initialized) {
avtab_cache_init();
if (policydb_read(&policydb, fp)) {
-diff -urNp linux-2.6.32.43/security/smack/smack_lsm.c linux-2.6.32.43/security/smack/smack_lsm.c
---- linux-2.6.32.43/security/smack/smack_lsm.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/security/smack/smack_lsm.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/security/smack/smack_lsm.c linux-2.6.32.44/security/smack/smack_lsm.c
+--- linux-2.6.32.44/security/smack/smack_lsm.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/security/smack/smack_lsm.c 2011-04-17 15:56:46.000000000 -0400
@@ -3073,7 +3073,7 @@ static int smack_inode_getsecctx(struct
return 0;
}
@@ -76283,9 +76282,9 @@ diff -urNp linux-2.6.32.43/security/smack/smack_lsm.c linux-2.6.32.43/security/s
.name = "smack",
.ptrace_access_check = smack_ptrace_access_check,
-diff -urNp linux-2.6.32.43/security/tomoyo/tomoyo.c linux-2.6.32.43/security/tomoyo/tomoyo.c
---- linux-2.6.32.43/security/tomoyo/tomoyo.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/security/tomoyo/tomoyo.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/security/tomoyo/tomoyo.c linux-2.6.32.44/security/tomoyo/tomoyo.c
+--- linux-2.6.32.44/security/tomoyo/tomoyo.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/security/tomoyo/tomoyo.c 2011-04-17 15:56:46.000000000 -0400
@@ -275,7 +275,7 @@ static int tomoyo_dentry_open(struct fil
* tomoyo_security_ops is a "struct security_operations" which is used for
* registering TOMOYO.
@@ -76295,9 +76294,9 @@ diff -urNp linux-2.6.32.43/security/tomoyo/tomoyo.c linux-2.6.32.43/security/tom
.name = "tomoyo",
.cred_alloc_blank = tomoyo_cred_alloc_blank,
.cred_prepare = tomoyo_cred_prepare,
-diff -urNp linux-2.6.32.43/sound/aoa/codecs/onyx.c linux-2.6.32.43/sound/aoa/codecs/onyx.c
---- linux-2.6.32.43/sound/aoa/codecs/onyx.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/sound/aoa/codecs/onyx.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/sound/aoa/codecs/onyx.c linux-2.6.32.44/sound/aoa/codecs/onyx.c
+--- linux-2.6.32.44/sound/aoa/codecs/onyx.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/sound/aoa/codecs/onyx.c 2011-04-17 15:56:46.000000000 -0400
@@ -53,7 +53,7 @@ struct onyx {
spdif_locked:1,
analog_locked:1,
@@ -76326,9 +76325,9 @@ diff -urNp linux-2.6.32.43/sound/aoa/codecs/onyx.c linux-2.6.32.43/sound/aoa/cod
onyx->spdif_locked = onyx->analog_locked = 0;
mutex_unlock(&onyx->mutex);
-diff -urNp linux-2.6.32.43/sound/aoa/codecs/onyx.h linux-2.6.32.43/sound/aoa/codecs/onyx.h
---- linux-2.6.32.43/sound/aoa/codecs/onyx.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/sound/aoa/codecs/onyx.h 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/sound/aoa/codecs/onyx.h linux-2.6.32.44/sound/aoa/codecs/onyx.h
+--- linux-2.6.32.44/sound/aoa/codecs/onyx.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/sound/aoa/codecs/onyx.h 2011-04-17 15:56:46.000000000 -0400
@@ -11,6 +11,7 @@
#include <linux/i2c.h>
#include <asm/pmac_low_i2c.h>
@@ -76337,9 +76336,9 @@ diff -urNp linux-2.6.32.43/sound/aoa/codecs/onyx.h linux-2.6.32.43/sound/aoa/cod
/* PCM3052 register definitions */
-diff -urNp linux-2.6.32.43/sound/core/seq/seq_device.c linux-2.6.32.43/sound/core/seq/seq_device.c
---- linux-2.6.32.43/sound/core/seq/seq_device.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/sound/core/seq/seq_device.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/sound/core/seq/seq_device.c linux-2.6.32.44/sound/core/seq/seq_device.c
+--- linux-2.6.32.44/sound/core/seq/seq_device.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/sound/core/seq/seq_device.c 2011-08-05 20:33:55.000000000 -0400
@@ -63,7 +63,7 @@ struct ops_list {
int argsize; /* argument size */
@@ -76376,9 +76375,9 @@ diff -urNp linux-2.6.32.43/sound/core/seq/seq_device.c linux-2.6.32.43/sound/cor
dev->status = SNDRV_SEQ_DEVICE_FREE;
dev->driver_data = NULL;
ops->num_init_devices--;
-diff -urNp linux-2.6.32.43/sound/drivers/mts64.c linux-2.6.32.43/sound/drivers/mts64.c
---- linux-2.6.32.43/sound/drivers/mts64.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/sound/drivers/mts64.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/sound/drivers/mts64.c linux-2.6.32.44/sound/drivers/mts64.c
+--- linux-2.6.32.44/sound/drivers/mts64.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/sound/drivers/mts64.c 2011-04-17 15:56:46.000000000 -0400
@@ -27,6 +27,7 @@
#include <sound/initval.h>
#include <sound/rawmidi.h>
@@ -76435,9 +76434,9 @@ diff -urNp linux-2.6.32.43/sound/drivers/mts64.c linux-2.6.32.43/sound/drivers/m
return 0;
}
-diff -urNp linux-2.6.32.43/sound/drivers/opl4/opl4_lib.c linux-2.6.32.43/sound/drivers/opl4/opl4_lib.c
---- linux-2.6.32.43/sound/drivers/opl4/opl4_lib.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/sound/drivers/opl4/opl4_lib.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/sound/drivers/opl4/opl4_lib.c linux-2.6.32.44/sound/drivers/opl4/opl4_lib.c
+--- linux-2.6.32.44/sound/drivers/opl4/opl4_lib.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/sound/drivers/opl4/opl4_lib.c 2011-08-05 20:33:55.000000000 -0400
@@ -27,7 +27,7 @@ MODULE_AUTHOR("Clemens Ladisch <clemens@
MODULE_DESCRIPTION("OPL4 driver");
MODULE_LICENSE("GPL");
@@ -76447,9 +76446,9 @@ diff -urNp linux-2.6.32.43/sound/drivers/opl4/opl4_lib.c linux-2.6.32.43/sound/d
{
int timeout = 10;
while ((inb(opl4->fm_port) & OPL4_STATUS_BUSY) && --timeout > 0)
-diff -urNp linux-2.6.32.43/sound/drivers/portman2x4.c linux-2.6.32.43/sound/drivers/portman2x4.c
---- linux-2.6.32.43/sound/drivers/portman2x4.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/sound/drivers/portman2x4.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/sound/drivers/portman2x4.c linux-2.6.32.44/sound/drivers/portman2x4.c
+--- linux-2.6.32.44/sound/drivers/portman2x4.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/sound/drivers/portman2x4.c 2011-04-17 15:56:46.000000000 -0400
@@ -46,6 +46,7 @@
#include <sound/initval.h>
#include <sound/rawmidi.h>
@@ -76467,9 +76466,9 @@ diff -urNp linux-2.6.32.43/sound/drivers/portman2x4.c linux-2.6.32.43/sound/driv
int mode[PORTMAN_NUM_INPUT_PORTS];
struct snd_rawmidi_substream *midi_input[PORTMAN_NUM_INPUT_PORTS];
};
-diff -urNp linux-2.6.32.43/sound/isa/cmi8330.c linux-2.6.32.43/sound/isa/cmi8330.c
---- linux-2.6.32.43/sound/isa/cmi8330.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/sound/isa/cmi8330.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/sound/isa/cmi8330.c linux-2.6.32.44/sound/isa/cmi8330.c
+--- linux-2.6.32.44/sound/isa/cmi8330.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/sound/isa/cmi8330.c 2011-08-05 20:33:55.000000000 -0400
@@ -455,16 +455,16 @@ static int __devinit snd_cmi8330_pcm(str
/* SB16 */
@@ -76491,9 +76490,9 @@ diff -urNp linux-2.6.32.43/sound/isa/cmi8330.c linux-2.6.32.43/sound/isa/cmi8330
chip->streams[CMI_AD_STREAM].private_data = chip->wss;
snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_PLAYBACK, &chip->streams[SNDRV_PCM_STREAM_PLAYBACK].ops);
-diff -urNp linux-2.6.32.43/sound/oss/sb_audio.c linux-2.6.32.43/sound/oss/sb_audio.c
---- linux-2.6.32.43/sound/oss/sb_audio.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/sound/oss/sb_audio.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/sound/oss/sb_audio.c linux-2.6.32.44/sound/oss/sb_audio.c
+--- linux-2.6.32.44/sound/oss/sb_audio.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/sound/oss/sb_audio.c 2011-04-17 15:56:46.000000000 -0400
@@ -901,7 +901,7 @@ sb16_copy_from_user(int dev,
buf16 = (signed short *)(localbuf + localoffs);
while (c)
@@ -76503,9 +76502,9 @@ diff -urNp linux-2.6.32.43/sound/oss/sb_audio.c linux-2.6.32.43/sound/oss/sb_aud
if (copy_from_user(lbuf8,
userbuf+useroffs + p,
locallen))
-diff -urNp linux-2.6.32.43/sound/oss/swarm_cs4297a.c linux-2.6.32.43/sound/oss/swarm_cs4297a.c
---- linux-2.6.32.43/sound/oss/swarm_cs4297a.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/sound/oss/swarm_cs4297a.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/sound/oss/swarm_cs4297a.c linux-2.6.32.44/sound/oss/swarm_cs4297a.c
+--- linux-2.6.32.44/sound/oss/swarm_cs4297a.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/sound/oss/swarm_cs4297a.c 2011-04-17 15:56:46.000000000 -0400
@@ -2577,7 +2577,6 @@ static int __init cs4297a_init(void)
{
struct cs4297a_state *s;
@@ -76540,9 +76539,9 @@ diff -urNp linux-2.6.32.43/sound/oss/swarm_cs4297a.c linux-2.6.32.43/sound/oss/s
list_add(&s->list, &cs4297a_devs);
-diff -urNp linux-2.6.32.43/sound/pci/ac97/ac97_codec.c linux-2.6.32.43/sound/pci/ac97/ac97_codec.c
---- linux-2.6.32.43/sound/pci/ac97/ac97_codec.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/sound/pci/ac97/ac97_codec.c 2011-04-17 15:56:46.000000000 -0400
+diff -urNp linux-2.6.32.44/sound/pci/ac97/ac97_codec.c linux-2.6.32.44/sound/pci/ac97/ac97_codec.c
+--- linux-2.6.32.44/sound/pci/ac97/ac97_codec.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/sound/pci/ac97/ac97_codec.c 2011-04-17 15:56:46.000000000 -0400
@@ -1952,7 +1952,7 @@ static int snd_ac97_dev_disconnect(struc
}
@@ -76552,9 +76551,9 @@ diff -urNp linux-2.6.32.43/sound/pci/ac97/ac97_codec.c linux-2.6.32.43/sound/pci
#ifdef CONFIG_SND_AC97_POWER_SAVE
static void do_update_power(struct work_struct *work)
-diff -urNp linux-2.6.32.43/sound/pci/ac97/ac97_patch.c linux-2.6.32.43/sound/pci/ac97/ac97_patch.c
---- linux-2.6.32.43/sound/pci/ac97/ac97_patch.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/sound/pci/ac97/ac97_patch.c 2011-04-23 12:56:12.000000000 -0400
+diff -urNp linux-2.6.32.44/sound/pci/ac97/ac97_patch.c linux-2.6.32.44/sound/pci/ac97/ac97_patch.c
+--- linux-2.6.32.44/sound/pci/ac97/ac97_patch.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/sound/pci/ac97/ac97_patch.c 2011-04-23 12:56:12.000000000 -0400
@@ -371,7 +371,7 @@ static int patch_yamaha_ymf743_build_spd
return 0;
}
@@ -76843,9 +76842,9 @@ diff -urNp linux-2.6.32.43/sound/pci/ac97/ac97_patch.c linux-2.6.32.43/sound/pci
.build_specific = patch_ucb1400_specific,
};
-diff -urNp linux-2.6.32.43/sound/pci/hda/hda_codec.h linux-2.6.32.43/sound/pci/hda/hda_codec.h
---- linux-2.6.32.43/sound/pci/hda/hda_codec.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/sound/pci/hda/hda_codec.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/sound/pci/hda/hda_codec.h linux-2.6.32.44/sound/pci/hda/hda_codec.h
+--- linux-2.6.32.44/sound/pci/hda/hda_codec.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/sound/pci/hda/hda_codec.h 2011-08-05 20:33:55.000000000 -0400
@@ -580,7 +580,7 @@ struct hda_bus_ops {
/* notify power-up/down from codec to controller */
void (*pm_notify)(struct hda_bus *bus);
@@ -76864,9 +76863,9 @@ diff -urNp linux-2.6.32.43/sound/pci/hda/hda_codec.h linux-2.6.32.43/sound/pci/h
/* PCM information for each substream */
struct hda_pcm_stream {
-diff -urNp linux-2.6.32.43/sound/pci/hda/hda_generic.c linux-2.6.32.43/sound/pci/hda/hda_generic.c
---- linux-2.6.32.43/sound/pci/hda/hda_generic.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/sound/pci/hda/hda_generic.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/sound/pci/hda/hda_generic.c linux-2.6.32.44/sound/pci/hda/hda_generic.c
+--- linux-2.6.32.44/sound/pci/hda/hda_generic.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/sound/pci/hda/hda_generic.c 2011-08-05 20:33:55.000000000 -0400
@@ -1097,7 +1097,7 @@ int snd_hda_parse_generic_codec(struct h
(err = parse_output(codec)) < 0)
goto error;
@@ -76876,9 +76875,9 @@ diff -urNp linux-2.6.32.43/sound/pci/hda/hda_generic.c linux-2.6.32.43/sound/pci
return 0;
-diff -urNp linux-2.6.32.43/sound/pci/hda/patch_analog.c linux-2.6.32.43/sound/pci/hda/patch_analog.c
---- linux-2.6.32.43/sound/pci/hda/patch_analog.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/sound/pci/hda/patch_analog.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/sound/pci/hda/patch_analog.c linux-2.6.32.44/sound/pci/hda/patch_analog.c
+--- linux-2.6.32.44/sound/pci/hda/patch_analog.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/sound/pci/hda/patch_analog.c 2011-08-05 20:33:55.000000000 -0400
@@ -1069,7 +1069,7 @@ static int patch_ad1986a(struct hda_code
#endif
spec->vmaster_nid = 0x1b;
@@ -77057,9 +77056,9 @@ diff -urNp linux-2.6.32.43/sound/pci/hda/patch_analog.c linux-2.6.32.43/sound/pc
/* override some parameters */
board_config = snd_hda_check_board_config(codec, AD1882_MODELS,
-diff -urNp linux-2.6.32.43/sound/pci/hda/patch_atihdmi.c linux-2.6.32.43/sound/pci/hda/patch_atihdmi.c
---- linux-2.6.32.43/sound/pci/hda/patch_atihdmi.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/sound/pci/hda/patch_atihdmi.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/sound/pci/hda/patch_atihdmi.c linux-2.6.32.44/sound/pci/hda/patch_atihdmi.c
+--- linux-2.6.32.44/sound/pci/hda/patch_atihdmi.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/sound/pci/hda/patch_atihdmi.c 2011-08-05 20:33:55.000000000 -0400
@@ -177,7 +177,7 @@ static int patch_atihdmi(struct hda_code
*/
spec->multiout.dig_out_nid = CVT_NID;
@@ -77069,9 +77068,9 @@ diff -urNp linux-2.6.32.43/sound/pci/hda/patch_atihdmi.c linux-2.6.32.43/sound/p
return 0;
}
-diff -urNp linux-2.6.32.43/sound/pci/hda/patch_ca0110.c linux-2.6.32.43/sound/pci/hda/patch_ca0110.c
---- linux-2.6.32.43/sound/pci/hda/patch_ca0110.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/sound/pci/hda/patch_ca0110.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/sound/pci/hda/patch_ca0110.c linux-2.6.32.44/sound/pci/hda/patch_ca0110.c
+--- linux-2.6.32.44/sound/pci/hda/patch_ca0110.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/sound/pci/hda/patch_ca0110.c 2011-08-05 20:33:55.000000000 -0400
@@ -525,7 +525,7 @@ static int patch_ca0110(struct hda_codec
if (err < 0)
goto error;
@@ -77081,9 +77080,9 @@ diff -urNp linux-2.6.32.43/sound/pci/hda/patch_ca0110.c linux-2.6.32.43/sound/pc
return 0;
-diff -urNp linux-2.6.32.43/sound/pci/hda/patch_cirrus.c linux-2.6.32.43/sound/pci/hda/patch_cirrus.c
---- linux-2.6.32.43/sound/pci/hda/patch_cirrus.c 2011-05-10 22:12:02.000000000 -0400
-+++ linux-2.6.32.43/sound/pci/hda/patch_cirrus.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/sound/pci/hda/patch_cirrus.c linux-2.6.32.44/sound/pci/hda/patch_cirrus.c
+--- linux-2.6.32.44/sound/pci/hda/patch_cirrus.c 2011-05-10 22:12:02.000000000 -0400
++++ linux-2.6.32.44/sound/pci/hda/patch_cirrus.c 2011-08-05 20:33:55.000000000 -0400
@@ -1191,7 +1191,7 @@ static int patch_cs420x(struct hda_codec
if (err < 0)
goto error;
@@ -77093,9 +77092,9 @@ diff -urNp linux-2.6.32.43/sound/pci/hda/patch_cirrus.c linux-2.6.32.43/sound/pc
return 0;
-diff -urNp linux-2.6.32.43/sound/pci/hda/patch_cmedia.c linux-2.6.32.43/sound/pci/hda/patch_cmedia.c
---- linux-2.6.32.43/sound/pci/hda/patch_cmedia.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/sound/pci/hda/patch_cmedia.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/sound/pci/hda/patch_cmedia.c linux-2.6.32.44/sound/pci/hda/patch_cmedia.c
+--- linux-2.6.32.44/sound/pci/hda/patch_cmedia.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/sound/pci/hda/patch_cmedia.c 2011-08-05 20:33:55.000000000 -0400
@@ -728,7 +728,7 @@ static int patch_cmi9880(struct hda_code
spec->adc_nids = cmi9880_adc_nids;
@@ -77105,9 +77104,9 @@ diff -urNp linux-2.6.32.43/sound/pci/hda/patch_cmedia.c linux-2.6.32.43/sound/pc
return 0;
}
-diff -urNp linux-2.6.32.43/sound/pci/hda/patch_conexant.c linux-2.6.32.43/sound/pci/hda/patch_conexant.c
---- linux-2.6.32.43/sound/pci/hda/patch_conexant.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/sound/pci/hda/patch_conexant.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/sound/pci/hda/patch_conexant.c linux-2.6.32.44/sound/pci/hda/patch_conexant.c
+--- linux-2.6.32.44/sound/pci/hda/patch_conexant.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/sound/pci/hda/patch_conexant.c 2011-08-05 20:33:55.000000000 -0400
@@ -1119,55 +1119,55 @@ static int patch_cxt5045(struct hda_code
spec->channel_mode = cxt5045_modes,
@@ -77258,9 +77257,9 @@ diff -urNp linux-2.6.32.43/sound/pci/hda/patch_conexant.c linux-2.6.32.43/sound/
spec->init_verbs[0] = cxt5066_init_verbs_olpc;
spec->mixers[spec->num_mixers++] = cxt5066_mixer_master_olpc;
spec->mixers[spec->num_mixers++] = cxt5066_mixers;
-diff -urNp linux-2.6.32.43/sound/pci/hda/patch_intelhdmi.c linux-2.6.32.43/sound/pci/hda/patch_intelhdmi.c
---- linux-2.6.32.43/sound/pci/hda/patch_intelhdmi.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/sound/pci/hda/patch_intelhdmi.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/sound/pci/hda/patch_intelhdmi.c linux-2.6.32.44/sound/pci/hda/patch_intelhdmi.c
+--- linux-2.6.32.44/sound/pci/hda/patch_intelhdmi.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/sound/pci/hda/patch_intelhdmi.c 2011-08-05 20:33:55.000000000 -0400
@@ -511,10 +511,10 @@ static void hdmi_non_intrinsic_event(str
cp_ready);
@@ -77285,9 +77284,9 @@ diff -urNp linux-2.6.32.43/sound/pci/hda/patch_intelhdmi.c linux-2.6.32.43/sound
snd_hda_eld_proc_new(codec, &spec->sink_eld);
-diff -urNp linux-2.6.32.43/sound/pci/hda/patch_nvhdmi.c linux-2.6.32.43/sound/pci/hda/patch_nvhdmi.c
---- linux-2.6.32.43/sound/pci/hda/patch_nvhdmi.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/sound/pci/hda/patch_nvhdmi.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/sound/pci/hda/patch_nvhdmi.c linux-2.6.32.44/sound/pci/hda/patch_nvhdmi.c
+--- linux-2.6.32.44/sound/pci/hda/patch_nvhdmi.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/sound/pci/hda/patch_nvhdmi.c 2011-08-05 20:33:55.000000000 -0400
@@ -367,7 +367,7 @@ static int patch_nvhdmi_8ch(struct hda_c
spec->multiout.max_channels = 8;
spec->multiout.dig_out_nid = Nv_Master_Convert_nid;
@@ -77306,9 +77305,9 @@ diff -urNp linux-2.6.32.43/sound/pci/hda/patch_nvhdmi.c linux-2.6.32.43/sound/pc
return 0;
}
-diff -urNp linux-2.6.32.43/sound/pci/hda/patch_realtek.c linux-2.6.32.43/sound/pci/hda/patch_realtek.c
---- linux-2.6.32.43/sound/pci/hda/patch_realtek.c 2011-06-25 12:55:35.000000000 -0400
-+++ linux-2.6.32.43/sound/pci/hda/patch_realtek.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/sound/pci/hda/patch_realtek.c linux-2.6.32.44/sound/pci/hda/patch_realtek.c
+--- linux-2.6.32.44/sound/pci/hda/patch_realtek.c 2011-06-25 12:55:35.000000000 -0400
++++ linux-2.6.32.44/sound/pci/hda/patch_realtek.c 2011-08-05 20:33:55.000000000 -0400
@@ -4856,7 +4856,7 @@ static int patch_alc880(struct hda_codec
spec->vmaster_nid = 0x0c;
@@ -77390,9 +77389,9 @@ diff -urNp linux-2.6.32.43/sound/pci/hda/patch_realtek.c linux-2.6.32.43/sound/p
if (board_config == ALC662_AUTO)
spec->init_hook = alc662_auto_init;
#ifdef CONFIG_SND_HDA_POWER_SAVE
-diff -urNp linux-2.6.32.43/sound/pci/hda/patch_si3054.c linux-2.6.32.43/sound/pci/hda/patch_si3054.c
---- linux-2.6.32.43/sound/pci/hda/patch_si3054.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/sound/pci/hda/patch_si3054.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/sound/pci/hda/patch_si3054.c linux-2.6.32.44/sound/pci/hda/patch_si3054.c
+--- linux-2.6.32.44/sound/pci/hda/patch_si3054.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/sound/pci/hda/patch_si3054.c 2011-08-05 20:33:55.000000000 -0400
@@ -275,7 +275,7 @@ static int patch_si3054(struct hda_codec
if (spec == NULL)
return -ENOMEM;
@@ -77402,9 +77401,9 @@ diff -urNp linux-2.6.32.43/sound/pci/hda/patch_si3054.c linux-2.6.32.43/sound/pc
return 0;
}
-diff -urNp linux-2.6.32.43/sound/pci/hda/patch_sigmatel.c linux-2.6.32.43/sound/pci/hda/patch_sigmatel.c
---- linux-2.6.32.43/sound/pci/hda/patch_sigmatel.c 2011-06-25 12:55:35.000000000 -0400
-+++ linux-2.6.32.43/sound/pci/hda/patch_sigmatel.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/sound/pci/hda/patch_sigmatel.c linux-2.6.32.44/sound/pci/hda/patch_sigmatel.c
+--- linux-2.6.32.44/sound/pci/hda/patch_sigmatel.c 2011-06-25 12:55:35.000000000 -0400
++++ linux-2.6.32.44/sound/pci/hda/patch_sigmatel.c 2011-08-05 20:33:55.000000000 -0400
@@ -4899,7 +4899,7 @@ static int patch_stac9200(struct hda_cod
if (spec->board_config == STAC_9200_PANASONIC)
spec->hp_detect = 0;
@@ -77495,9 +77494,9 @@ diff -urNp linux-2.6.32.43/sound/pci/hda/patch_sigmatel.c linux-2.6.32.43/sound/
return 0;
}
-diff -urNp linux-2.6.32.43/sound/pci/hda/patch_via.c linux-2.6.32.43/sound/pci/hda/patch_via.c
---- linux-2.6.32.43/sound/pci/hda/patch_via.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/sound/pci/hda/patch_via.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/sound/pci/hda/patch_via.c linux-2.6.32.44/sound/pci/hda/patch_via.c
+--- linux-2.6.32.44/sound/pci/hda/patch_via.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/sound/pci/hda/patch_via.c 2011-08-05 20:33:55.000000000 -0400
@@ -1399,9 +1399,9 @@ static int patch_vt1708(struct hda_codec
spec->num_mixers++;
}
@@ -77594,9 +77593,9 @@ diff -urNp linux-2.6.32.43/sound/pci/hda/patch_via.c linux-2.6.32.43/sound/pci/h
#ifdef CONFIG_SND_HDA_POWER_SAVE
spec->loopback.amplist = vt1702_loopbacks;
#endif
-diff -urNp linux-2.6.32.43/sound/pci/ice1712/ice1712.h linux-2.6.32.43/sound/pci/ice1712/ice1712.h
---- linux-2.6.32.43/sound/pci/ice1712/ice1712.h 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/sound/pci/ice1712/ice1712.h 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/sound/pci/ice1712/ice1712.h linux-2.6.32.44/sound/pci/ice1712/ice1712.h
+--- linux-2.6.32.44/sound/pci/ice1712/ice1712.h 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/sound/pci/ice1712/ice1712.h 2011-08-05 20:33:55.000000000 -0400
@@ -269,7 +269,7 @@ struct snd_ak4xxx_private {
unsigned int mask_flags; /* total mask bits */
struct snd_akm4xxx_ops {
@@ -77615,9 +77614,9 @@ diff -urNp linux-2.6.32.43/sound/pci/ice1712/ice1712.h linux-2.6.32.43/sound/pci
};
-diff -urNp linux-2.6.32.43/sound/pci/intel8x0m.c linux-2.6.32.43/sound/pci/intel8x0m.c
---- linux-2.6.32.43/sound/pci/intel8x0m.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/sound/pci/intel8x0m.c 2011-04-23 12:56:12.000000000 -0400
+diff -urNp linux-2.6.32.44/sound/pci/intel8x0m.c linux-2.6.32.44/sound/pci/intel8x0m.c
+--- linux-2.6.32.44/sound/pci/intel8x0m.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/sound/pci/intel8x0m.c 2011-04-23 12:56:12.000000000 -0400
@@ -1264,7 +1264,7 @@ static struct shortname_table {
{ 0x5455, "ALi M5455" },
{ 0x746d, "AMD AMD8111" },
@@ -77627,9 +77626,9 @@ diff -urNp linux-2.6.32.43/sound/pci/intel8x0m.c linux-2.6.32.43/sound/pci/intel
};
static int __devinit snd_intel8x0m_probe(struct pci_dev *pci,
-diff -urNp linux-2.6.32.43/sound/pci/ymfpci/ymfpci_main.c linux-2.6.32.43/sound/pci/ymfpci/ymfpci_main.c
---- linux-2.6.32.43/sound/pci/ymfpci/ymfpci_main.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/sound/pci/ymfpci/ymfpci_main.c 2011-05-04 17:56:28.000000000 -0400
+diff -urNp linux-2.6.32.44/sound/pci/ymfpci/ymfpci_main.c linux-2.6.32.44/sound/pci/ymfpci/ymfpci_main.c
+--- linux-2.6.32.44/sound/pci/ymfpci/ymfpci_main.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/sound/pci/ymfpci/ymfpci_main.c 2011-05-04 17:56:28.000000000 -0400
@@ -202,8 +202,8 @@ static void snd_ymfpci_hw_stop(struct sn
if ((snd_ymfpci_readl(chip, YDSXGR_STATUS) & 2) == 0)
break;
@@ -77670,9 +77669,9 @@ diff -urNp linux-2.6.32.43/sound/pci/ymfpci/ymfpci_main.c linux-2.6.32.43/sound/
chip->card = card;
chip->pci = pci;
chip->irq = -1;
-diff -urNp linux-2.6.32.43/sound/soc/soc-core.c linux-2.6.32.43/sound/soc/soc-core.c
---- linux-2.6.32.43/sound/soc/soc-core.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/sound/soc/soc-core.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/sound/soc/soc-core.c linux-2.6.32.44/sound/soc/soc-core.c
+--- linux-2.6.32.44/sound/soc/soc-core.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/sound/soc/soc-core.c 2011-08-05 20:33:55.000000000 -0400
@@ -1107,13 +1107,13 @@ static int soc_new_pcm(struct snd_soc_de
dai_link->pcm = pcm;
@@ -77694,9 +77693,9 @@ diff -urNp linux-2.6.32.43/sound/soc/soc-core.c linux-2.6.32.43/sound/soc/soc-co
if (playback)
snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_PLAYBACK, &soc_pcm_ops);
-diff -urNp linux-2.6.32.43/sound/usb/usbaudio.c linux-2.6.32.43/sound/usb/usbaudio.c
---- linux-2.6.32.43/sound/usb/usbaudio.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/sound/usb/usbaudio.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/sound/usb/usbaudio.c linux-2.6.32.44/sound/usb/usbaudio.c
+--- linux-2.6.32.44/sound/usb/usbaudio.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/sound/usb/usbaudio.c 2011-08-05 20:33:55.000000000 -0400
@@ -963,12 +963,12 @@ static int snd_usb_pcm_playback_trigger(
switch (cmd) {
case SNDRV_PCM_TRIGGER_START:
@@ -77758,10 +77757,10 @@ diff -urNp linux-2.6.32.43/sound/usb/usbaudio.c linux-2.6.32.43/sound/usb/usbaud
break;
}
}
-diff -urNp linux-2.6.32.43/tools/gcc/constify_plugin.c linux-2.6.32.43/tools/gcc/constify_plugin.c
---- linux-2.6.32.43/tools/gcc/constify_plugin.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/tools/gcc/constify_plugin.c 2011-08-05 20:33:55.000000000 -0400
-@@ -0,0 +1,147 @@
+diff -urNp linux-2.6.32.44/tools/gcc/constify_plugin.c linux-2.6.32.44/tools/gcc/constify_plugin.c
+--- linux-2.6.32.44/tools/gcc/constify_plugin.c 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/tools/gcc/constify_plugin.c 2011-08-11 19:12:51.000000000 -0400
+@@ -0,0 +1,189 @@
+/*
+ * Copyright 2011 by Emese Revfy <re.emese@gmail.com>
+ * Licensed under the GPL v2, or (at your option) v3
@@ -77769,8 +77768,8 @@ diff -urNp linux-2.6.32.43/tools/gcc/constify_plugin.c linux-2.6.32.43/tools/gcc
+ * This gcc plugin constifies all structures which contain only function pointers and const fields.
+ *
+ * Usage:
-+ * $ gcc -I`gcc -print-file-name=plugin`/include -fPIC -shared -O2 -o const_plugin.so const_plugin.c
-+ * $ gcc -fplugin=const_plugin.so test.c -O2
++ * $ gcc -I`gcc -print-file-name=plugin`/include -fPIC -shared -O2 -o constify_plugin.so constify_plugin.c
++ * $ gcc -fplugin=constify_plugin.so test.c -O2
+ */
+
+#include "gcc-plugin.h"
@@ -77790,12 +77789,54 @@ diff -urNp linux-2.6.32.43/tools/gcc/constify_plugin.c linux-2.6.32.43/tools/gcc
+int plugin_is_GPL_compatible;
+
+static struct plugin_info const_plugin_info = {
-+ .version = "20110706",
++ .version = "20110721",
+ .help = "no-constify\tturn off constification\n",
+};
+
++static bool walk_struct(tree node);
++
++static void deconstify_node(tree node)
++{
++ tree field;
++
++ for (field = TYPE_FIELDS(node); field; field = TREE_CHAIN(field)) {
++ enum tree_code code = TREE_CODE(TREE_TYPE(field));
++ if (code == RECORD_TYPE || code == UNION_TYPE)
++ deconstify_node(TREE_TYPE(field));
++ TREE_READONLY(field) = 0;
++ TREE_READONLY(TREE_TYPE(field)) = 0;
++ }
++}
++
+static tree handle_no_const_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
+{
++ if (TREE_CODE(*node) == FUNCTION_DECL) {
++ error("%qE attribute does not apply to functions", name);
++ *no_add_attrs = true;
++ return NULL_TREE;
++ }
++
++ if (DECL_P(*node) && lookup_attribute("no_const", TYPE_ATTRIBUTES(TREE_TYPE(*node)))) {
++ error("%qE attribute is already applied to the type" , name);
++ *no_add_attrs = true;
++ return NULL_TREE;
++ }
++
++ if (TREE_CODE(*node) == TYPE_DECL && !TREE_READONLY(TREE_TYPE(*node))) {
++ error("%qE attribute used on type that is not constified" , name);
++ *no_add_attrs = true;
++ return NULL_TREE;
++ }
++
++ if (TREE_CODE(*node) == TYPE_DECL) {
++ tree chain = TREE_CHAIN(TREE_TYPE(*node));
++ TREE_TYPE(*node) = copy_node(TREE_TYPE(*node));
++ TREE_CHAIN(TREE_TYPE(*node)) = copy_list(chain);
++ TREE_READONLY(TREE_TYPE(*node)) = 0;
++ deconstify_node(TREE_TYPE(*node));
++ return NULL_TREE;
++ }
++
+ return NULL_TREE;
+}
+
@@ -77852,7 +77893,7 @@ diff -urNp linux-2.6.32.43/tools/gcc/constify_plugin.c linux-2.6.32.43/tools/gcc
+
+ for (field = TYPE_FIELDS(node); field; field = TREE_CHAIN(field)) {
+ enum tree_code code = TREE_CODE(TREE_TYPE(field));
-+ if (code == RECORD_TYPE) {
++ if (code == RECORD_TYPE || code == UNION_TYPE) {
+ if (!(walk_struct(TREE_TYPE(field))))
+ return false;
+ } else if (is_fptr(field) == false && !TREE_READONLY(field))
@@ -77909,10 +77950,10 @@ diff -urNp linux-2.6.32.43/tools/gcc/constify_plugin.c linux-2.6.32.43/tools/gcc
+
+ return 0;
+}
-Binary files linux-2.6.32.43/tools/gcc/constify_plugin.so and linux-2.6.32.43/tools/gcc/constify_plugin.so differ
-diff -urNp linux-2.6.32.43/tools/gcc/Makefile linux-2.6.32.43/tools/gcc/Makefile
---- linux-2.6.32.43/tools/gcc/Makefile 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/tools/gcc/Makefile 2011-08-05 20:33:55.000000000 -0400
+Binary files linux-2.6.32.44/tools/gcc/constify_plugin.so and linux-2.6.32.44/tools/gcc/constify_plugin.so differ
+diff -urNp linux-2.6.32.44/tools/gcc/Makefile linux-2.6.32.44/tools/gcc/Makefile
+--- linux-2.6.32.44/tools/gcc/Makefile 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/tools/gcc/Makefile 2011-08-05 20:33:55.000000000 -0400
@@ -0,0 +1,12 @@
+#CC := gcc
+#PLUGIN_SOURCE_FILES := pax_plugin.c
@@ -77926,10 +77967,10 @@ diff -urNp linux-2.6.32.43/tools/gcc/Makefile linux-2.6.32.43/tools/gcc/Makefile
+always := $(hostlibs-y)
+stackleak_plugin-objs := stackleak_plugin.o
+constify_plugin-objs := constify_plugin.o
-Binary files linux-2.6.32.43/tools/gcc/pax_plugin.so and linux-2.6.32.43/tools/gcc/pax_plugin.so differ
-diff -urNp linux-2.6.32.43/tools/gcc/stackleak_plugin.c linux-2.6.32.43/tools/gcc/stackleak_plugin.c
---- linux-2.6.32.43/tools/gcc/stackleak_plugin.c 1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.43/tools/gcc/stackleak_plugin.c 2011-08-05 20:33:55.000000000 -0400
+Binary files linux-2.6.32.44/tools/gcc/pax_plugin.so and linux-2.6.32.44/tools/gcc/pax_plugin.so differ
+diff -urNp linux-2.6.32.44/tools/gcc/stackleak_plugin.c linux-2.6.32.44/tools/gcc/stackleak_plugin.c
+--- linux-2.6.32.44/tools/gcc/stackleak_plugin.c 1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.44/tools/gcc/stackleak_plugin.c 2011-08-05 20:33:55.000000000 -0400
@@ -0,0 +1,243 @@
+/*
+ * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
@@ -78174,10 +78215,10 @@ diff -urNp linux-2.6.32.43/tools/gcc/stackleak_plugin.c linux-2.6.32.43/tools/gc
+
+ return 0;
+}
-Binary files linux-2.6.32.43/tools/gcc/stackleak_plugin.so and linux-2.6.32.43/tools/gcc/stackleak_plugin.so differ
-diff -urNp linux-2.6.32.43/usr/gen_init_cpio.c linux-2.6.32.43/usr/gen_init_cpio.c
---- linux-2.6.32.43/usr/gen_init_cpio.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/usr/gen_init_cpio.c 2011-04-17 15:56:46.000000000 -0400
+Binary files linux-2.6.32.44/tools/gcc/stackleak_plugin.so and linux-2.6.32.44/tools/gcc/stackleak_plugin.so differ
+diff -urNp linux-2.6.32.44/usr/gen_init_cpio.c linux-2.6.32.44/usr/gen_init_cpio.c
+--- linux-2.6.32.44/usr/gen_init_cpio.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/usr/gen_init_cpio.c 2011-04-17 15:56:46.000000000 -0400
@@ -299,7 +299,7 @@ static int cpio_mkfile(const char *name,
int retval;
int rc = -1;
@@ -78200,9 +78241,9 @@ diff -urNp linux-2.6.32.43/usr/gen_init_cpio.c linux-2.6.32.43/usr/gen_init_cpio
} else
break;
}
-diff -urNp linux-2.6.32.43/virt/kvm/kvm_main.c linux-2.6.32.43/virt/kvm/kvm_main.c
---- linux-2.6.32.43/virt/kvm/kvm_main.c 2011-03-27 14:31:47.000000000 -0400
-+++ linux-2.6.32.43/virt/kvm/kvm_main.c 2011-08-05 20:33:55.000000000 -0400
+diff -urNp linux-2.6.32.44/virt/kvm/kvm_main.c linux-2.6.32.44/virt/kvm/kvm_main.c
+--- linux-2.6.32.44/virt/kvm/kvm_main.c 2011-03-27 14:31:47.000000000 -0400
++++ linux-2.6.32.44/virt/kvm/kvm_main.c 2011-08-05 20:33:55.000000000 -0400
@@ -2494,7 +2494,7 @@ asmlinkage void kvm_handle_fault_on_rebo
if (kvm_rebooting)
/* spin while reset goes on */
diff --git a/2.6.32/4425_grsec-pax-without-grsec.patch b/2.6.32/4425_grsec-pax-without-grsec.patch
index 48357e9..cc3b6ca 100644
--- a/2.6.32/4425_grsec-pax-without-grsec.patch
+++ b/2.6.32/4425_grsec-pax-without-grsec.patch
@@ -36,7 +36,7 @@ diff -Naur linux-2.6.32-hardened-r44.orig/arch/x86/mm/fault.c linux-2.6.32-harde
diff -Naur linux-2.6.32-hardened-r44.orig/fs/exec.c linux-2.6.32-hardened-r44/fs/exec.c
--- linux-2.6.32-hardened-r44.orig/fs/exec.c 2011-04-17 18:15:55.000000000 -0400
+++ linux-2.6.32-hardened-r44/fs/exec.c 2011-04-17 18:29:40.000000000 -0400
-@@ -1791,9 +1791,11 @@
+@@ -1803,9 +1803,11 @@
}
up_read(&mm->mmap_sem);
}
@@ -48,7 +48,7 @@ diff -Naur linux-2.6.32-hardened-r44.orig/fs/exec.c linux-2.6.32-hardened-r44/fs
printk(KERN_ERR "PAX: execution attempt in: %s, %08lx-%08lx %08lx\n", path_fault, start, end, offset);
printk(KERN_ERR "PAX: terminating task: %s(%s):%d, uid/euid: %u/%u, "
"PC: %p, SP: %p\n", path_exec, tsk->comm, task_pid_nr(tsk),
-@@ -1808,10 +1810,12 @@
+@@ -1820,10 +1822,12 @@
#ifdef CONFIG_PAX_REFCOUNT
void pax_report_refcount_overflow(struct pt_regs *regs)
{
@@ -61,7 +61,7 @@ diff -Naur linux-2.6.32-hardened-r44.orig/fs/exec.c linux-2.6.32-hardened-r44/fs
printk(KERN_ERR "PAX: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
current->comm, task_pid_nr(current), current_uid(), current_euid());
print_symbol(KERN_ERR "PAX: refcount overflow occured at: %s\n", instruction_pointer(regs));
-@@ -1871,10 +1875,12 @@
+@@ -1883,10 +1887,12 @@
NORET_TYPE void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type)
{
diff --git a/2.6.32/4430_grsec-kconfig-default-gids.patch b/2.6.32/4430_grsec-kconfig-default-gids.patch
index 498bea8..e77d871 100644
--- a/2.6.32/4430_grsec-kconfig-default-gids.patch
+++ b/2.6.32/4430_grsec-kconfig-default-gids.patch
@@ -12,7 +12,7 @@ from shooting themselves in the foot.
diff -Naur linux-2.6.32-hardened-r44.orig/grsecurity/Kconfig linux-2.6.32-hardened-r44/grsecurity/Kconfig
--- linux-2.6.32-hardened-r44.orig/grsecurity/Kconfig 2011-04-17 18:15:55.000000000 -0400
+++ linux-2.6.32-hardened-r44/grsecurity/Kconfig 2011-04-17 18:37:33.000000000 -0400
-@@ -436,7 +436,7 @@
+@@ -432,7 +432,7 @@
config GRKERNSEC_PROC_GID
int "GID for special group"
depends on GRKERNSEC_PROC_USERGROUP
@@ -21,7 +21,7 @@ diff -Naur linux-2.6.32-hardened-r44.orig/grsecurity/Kconfig linux-2.6.32-harden
config GRKERNSEC_PROC_ADD
bool "Additional restrictions"
-@@ -660,7 +660,7 @@
+@@ -656,7 +656,7 @@
config GRKERNSEC_AUDIT_GID
int "GID for auditing"
depends on GRKERNSEC_AUDIT_GROUP
@@ -30,7 +30,7 @@ diff -Naur linux-2.6.32-hardened-r44.orig/grsecurity/Kconfig linux-2.6.32-harden
config GRKERNSEC_EXECLOG
bool "Exec logging"
-@@ -846,7 +846,7 @@
+@@ -834,7 +834,7 @@
config GRKERNSEC_TPE_GID
int "GID for untrusted users"
depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
@@ -39,7 +39,7 @@ diff -Naur linux-2.6.32-hardened-r44.orig/grsecurity/Kconfig linux-2.6.32-harden
help
Setting this GID determines what group TPE restrictions will be
*enabled* for. If the sysctl option is enabled, a sysctl option
-@@ -855,7 +855,7 @@
+@@ -843,7 +843,7 @@
config GRKERNSEC_TPE_GID
int "GID for trusted users"
depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
@@ -48,7 +48,7 @@ diff -Naur linux-2.6.32-hardened-r44.orig/grsecurity/Kconfig linux-2.6.32-harden
help
Setting this GID determines what group TPE restrictions will be
*disabled* for. If the sysctl option is enabled, a sysctl option
-@@ -926,7 +926,7 @@
+@@ -914,7 +914,7 @@
config GRKERNSEC_SOCKET_ALL_GID
int "GID to deny all sockets for"
depends on GRKERNSEC_SOCKET_ALL
@@ -57,7 +57,7 @@ diff -Naur linux-2.6.32-hardened-r44.orig/grsecurity/Kconfig linux-2.6.32-harden
help
Here you can choose the GID to disable socket access for. Remember to
add the users you want socket access disabled for to the GID
-@@ -947,7 +947,7 @@
+@@ -935,7 +935,7 @@
config GRKERNSEC_SOCKET_CLIENT_GID
int "GID to deny client sockets for"
depends on GRKERNSEC_SOCKET_CLIENT
@@ -66,7 +66,7 @@ diff -Naur linux-2.6.32-hardened-r44.orig/grsecurity/Kconfig linux-2.6.32-harden
help
Here you can choose the GID to disable client socket access for.
Remember to add the users you want client socket access disabled for to
-@@ -965,7 +965,7 @@
+@@ -953,7 +953,7 @@
config GRKERNSEC_SOCKET_SERVER_GID
int "GID to deny server sockets for"
depends on GRKERNSEC_SOCKET_SERVER
diff --git a/2.6.32/4435_grsec-kconfig-gentoo.patch b/2.6.32/4435_grsec-kconfig-gentoo.patch
index f2b8a25..49720b1 100644
--- a/2.6.32/4435_grsec-kconfig-gentoo.patch
+++ b/2.6.32/4435_grsec-kconfig-gentoo.patch
@@ -27,7 +27,7 @@ diff -Naur linux-2.6.32-hardened-r44.orig/grsecurity/Kconfig linux-2.6.32-harden
config GRKERNSEC_LOW
bool "Low"
-@@ -195,6 +195,261 @@
+@@ -191,6 +191,261 @@
- Restricted sysfs/debugfs
- Active kernel exploit response
diff --git a/2.6.32/4437-grsec-kconfig-proc-user.patch b/2.6.32/4437-grsec-kconfig-proc-user.patch
index 58187fc..34d8596 100644
--- a/2.6.32/4437-grsec-kconfig-proc-user.patch
+++ b/2.6.32/4437-grsec-kconfig-proc-user.patch
@@ -6,7 +6,7 @@ in a different way to avoid bug #366019. This patch should eventually go upstre
diff -Naur linux-2.6.32-hardened-r54.orig//grsecurity/Kconfig linux-2.6.32-hardened-r54/grsecurity/Kconfig
--- a/grsecurity/Kconfig 2011-06-29 07:46:02.000000000 -0400
+++ b/grsecurity/Kconfig 2011-06-29 07:47:20.000000000 -0400
-@@ -672,7 +672,7 @@
+@@ -668,7 +668,7 @@
config GRKERNSEC_PROC_USER
bool "Restrict /proc to user only"
@@ -15,7 +15,7 @@ diff -Naur linux-2.6.32-hardened-r54.orig//grsecurity/Kconfig linux-2.6.32-harde
help
If you say Y here, non-root users will only be able to view their own
processes, and restricts them from viewing network-related information,
-@@ -680,7 +680,7 @@
+@@ -676,7 +676,7 @@
config GRKERNSEC_PROC_USERGROUP
bool "Allow special group"
diff --git a/2.6.32/4440_selinux-avc_audit-log-curr_ip.patch b/2.6.32/4440_selinux-avc_audit-log-curr_ip.patch
index ebb44f7..feb171c 100644
--- a/2.6.32/4440_selinux-avc_audit-log-curr_ip.patch
+++ b/2.6.32/4440_selinux-avc_audit-log-curr_ip.patch
@@ -28,7 +28,7 @@ Signed-off-by: Lorenzo Hernandez Garcia-Hierro <lorenzo@gnu.org>
diff -Naur linux-2.6.32-hardened-r44.orig/grsecurity/Kconfig linux-2.6.32-hardened-r44/grsecurity/Kconfig
--- linux-2.6.32-hardened-r44.orig/grsecurity/Kconfig 2011-04-17 18:47:02.000000000 -0400
+++ linux-2.6.32-hardened-r44/grsecurity/Kconfig 2011-04-17 18:51:15.000000000 -0400
-@@ -1277,6 +1277,27 @@
+@@ -1265,6 +1265,27 @@
menu "Logging Options"
depends on GRKERNSEC
^ permalink raw reply related [flat|nested] 13+ messages in thread* [gentoo-commits] proj/hardened-patchset:master commit in: 2.6.32/
@ 2011-04-20 3:11 Anthony G. Basile
0 siblings, 0 replies; 13+ messages in thread
From: Anthony G. Basile @ 2011-04-20 3:11 UTC (permalink / raw
To: gentoo-commits
commit: e36ba85c95a29fe9dbc77ad76dd69dfaa8b2e658
Author: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Wed Apr 20 03:09:12 2011 +0000
Commit: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Wed Apr 20 03:09:12 2011 +0000
URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-patchset.git;a=commit;h=e36ba85c
Added upstream patches to bridge to genpatches-2.6.32-36
---
2.6.32/0000_README | 8 +
2.6.32/1036_linux-2.6.32.37.patch | 2592 +++++++++++++++++++++++++++++
2.6.32/1037_linux-2.6.32.38.patch | 19 +
2.6.32/4425_grsec-pax-without-grsec.patch | 6 +-
4 files changed, 2622 insertions(+), 3 deletions(-)
diff --git a/2.6.32/0000_README b/2.6.32/0000_README
index 6bfec0c..70319a3 100644
--- a/2.6.32/0000_README
+++ b/2.6.32/0000_README
@@ -3,6 +3,14 @@ README
Individual Patch Descriptions:
-----------------------------------------------------------------------------
+Patch: 1036_linux-2.6.32.37.patch
+From: http://www.kernel.org
+Desc: Linux 2.6.32.37
+
+Patch: 1037_linux-2.6.32.38.patch
+From: http://www.kernel.org
+Desc: Linux 2.6.32.38
+
Patch: 4420_grsecurity-2.2.2-2.6.32.38-201104191737.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/2.6.32/1036_linux-2.6.32.37.patch b/2.6.32/1036_linux-2.6.32.37.patch
new file mode 100644
index 0000000..c2d8bf9
--- /dev/null
+++ b/2.6.32/1036_linux-2.6.32.37.patch
@@ -0,0 +1,2592 @@
+diff --git a/arch/powerpc/kernel/crash.c b/arch/powerpc/kernel/crash.c
+index fe02e71..5009198 100644
+--- a/arch/powerpc/kernel/crash.c
++++ b/arch/powerpc/kernel/crash.c
+@@ -163,6 +163,7 @@ static void crash_kexec_prepare_cpus(int cpu)
+ }
+
+ /* wait for all the CPUs to hit real mode but timeout if they don't come in */
++#ifdef CONFIG_PPC_STD_MMU_64
+ static void crash_kexec_wait_realmode(int cpu)
+ {
+ unsigned int msecs;
+@@ -187,6 +188,7 @@ static void crash_kexec_wait_realmode(int cpu)
+ }
+ mb();
+ }
++#endif
+
+ /*
+ * This function will be called by secondary cpus or by kexec cpu
+@@ -445,7 +447,9 @@ void default_machine_crash_shutdown(struct pt_regs *regs)
+ crash_kexec_prepare_cpus(crashing_cpu);
+ cpu_set(crashing_cpu, cpus_in_crash);
+ crash_kexec_stop_spus();
++#if defined(CONFIG_PPC_STD_MMU_64) && defined(CONFIG_SMP)
+ crash_kexec_wait_realmode(crashing_cpu);
++#endif
+ if (ppc_md.kexec_cpu_down)
+ ppc_md.kexec_cpu_down(1, 0);
+ }
+diff --git a/arch/x86/kernel/cpu/mtrr/main.c b/arch/x86/kernel/cpu/mtrr/main.c
+index 419e328..fd60f09 100644
+--- a/arch/x86/kernel/cpu/mtrr/main.c
++++ b/arch/x86/kernel/cpu/mtrr/main.c
+@@ -262,14 +262,24 @@ set_mtrr(unsigned int reg, unsigned long base, unsigned long size, mtrr_type typ
+
+ /*
+ * HACK!
+- * We use this same function to initialize the mtrrs on boot.
+- * The state of the boot cpu's mtrrs has been saved, and we want
+- * to replicate across all the APs.
+- * If we're doing that @reg is set to something special...
++ *
++ * We use this same function to initialize the mtrrs during boot,
++ * resume, runtime cpu online and on an explicit request to set a
++ * specific MTRR.
++ *
++ * During boot or suspend, the state of the boot cpu's mtrrs has been
++ * saved, and we want to replicate that across all the cpus that come
++ * online (either at the end of boot or resume or during a runtime cpu
++ * online). If we're doing that, @reg is set to something special and on
++ * this cpu we still do mtrr_if->set_all(). During boot/resume, this
++ * is unnecessary if at this point we are still on the cpu that started
++ * the boot/resume sequence. But there is no guarantee that we are still
++ * on the same cpu. So we do mtrr_if->set_all() on this cpu aswell to be
++ * sure that we are in sync with everyone else.
+ */
+ if (reg != ~0U)
+ mtrr_if->set(reg, base, size, type);
+- else if (!mtrr_aps_delayed_init)
++ else
+ mtrr_if->set_all();
+
+ /* Wait for the others */
+diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
+index 0b08160..0b06cd7 100644
+--- a/arch/x86/kernel/head64.c
++++ b/arch/x86/kernel/head64.c
+@@ -76,6 +76,9 @@ void __init x86_64_start_kernel(char * real_mode_data)
+ /* Make NULL pointers segfault */
+ zap_identity_mappings();
+
++ /* Cleanup the over mapped high alias */
++ cleanup_highmap();
++
+ for (i = 0; i < NUM_EXCEPTION_VECTORS; i++) {
+ #ifdef CONFIG_EARLY_PRINTK
+ set_intr_gate(i, &early_idt_handlers[i]);
+diff --git a/arch/x86/kernel/microcode_amd.c b/arch/x86/kernel/microcode_amd.c
+index f4c538b..1e47679 100644
+--- a/arch/x86/kernel/microcode_amd.c
++++ b/arch/x86/kernel/microcode_amd.c
+@@ -63,7 +63,6 @@ struct microcode_amd {
+ unsigned int mpb[0];
+ };
+
+-#define UCODE_MAX_SIZE 2048
+ #define UCODE_CONTAINER_SECTION_HDR 8
+ #define UCODE_CONTAINER_HEADER_SIZE 12
+
+@@ -109,12 +108,8 @@ static int get_matching_microcode(int cpu, void *mc, int rev)
+ return 0;
+ }
+
+- if (mc_header->processor_rev_id != equiv_cpu_id) {
+- printk(KERN_ERR "microcode: CPU%d: patch mismatch "
+- "(processor_rev_id: %x, equiv_cpu_id: %x)\n",
+- cpu, mc_header->processor_rev_id, equiv_cpu_id);
++ if (mc_header->processor_rev_id != equiv_cpu_id)
+ return 0;
+- }
+
+ /* ucode might be chipset specific -- currently we don't support this */
+ if (mc_header->nb_dev_id || mc_header->sb_dev_id) {
+@@ -129,6 +124,37 @@ static int get_matching_microcode(int cpu, void *mc, int rev)
+ return 1;
+ }
+
++static unsigned int verify_ucode_size(int cpu, const u8 *buf, unsigned int size)
++{
++ struct cpuinfo_x86 *c = &cpu_data(cpu);
++ unsigned int max_size, actual_size;
++
++#define F1XH_MPB_MAX_SIZE 2048
++#define F14H_MPB_MAX_SIZE 1824
++#define F15H_MPB_MAX_SIZE 4096
++
++ switch (c->x86) {
++ case 0x14:
++ max_size = F14H_MPB_MAX_SIZE;
++ break;
++ case 0x15:
++ max_size = F15H_MPB_MAX_SIZE;
++ break;
++ default:
++ max_size = F1XH_MPB_MAX_SIZE;
++ break;
++ }
++
++ actual_size = buf[4] + (buf[5] << 8);
++
++ if (actual_size > size || actual_size > max_size) {
++ pr_err("section size mismatch\n");
++ return 0;
++ }
++
++ return actual_size;
++}
++
+ static int apply_microcode_amd(int cpu)
+ {
+ u32 rev, dummy;
+@@ -168,11 +194,11 @@ static int get_ucode_data(void *to, const u8 *from, size_t n)
+ }
+
+ static void *
+-get_next_ucode(const u8 *buf, unsigned int size, unsigned int *mc_size)
++get_next_ucode(int cpu, const u8 *buf, unsigned int size, unsigned int *mc_size)
+ {
+- unsigned int total_size;
++ unsigned int actual_size = 0;
+ u8 section_hdr[UCODE_CONTAINER_SECTION_HDR];
+- void *mc;
++ void *mc = NULL;
+
+ if (get_ucode_data(section_hdr, buf, UCODE_CONTAINER_SECTION_HDR))
+ return NULL;
+@@ -183,26 +209,18 @@ get_next_ucode(const u8 *buf, unsigned int size, unsigned int *mc_size)
+ return NULL;
+ }
+
+- total_size = (unsigned long) (section_hdr[4] + (section_hdr[5] << 8));
+-
+- printk(KERN_DEBUG "microcode: size %u, total_size %u\n",
+- size, total_size);
++ actual_size = verify_ucode_size(cpu, buf, size);
++ if (!actual_size)
++ return NULL;
+
+- if (total_size > size || total_size > UCODE_MAX_SIZE) {
+- printk(KERN_ERR "microcode: error: size mismatch\n");
++ mc = vmalloc(actual_size);
++ if (!mc)
+ return NULL;
+- }
+
+- mc = vmalloc(UCODE_MAX_SIZE);
+- if (mc) {
+- memset(mc, 0, UCODE_MAX_SIZE);
+- if (get_ucode_data(mc, buf + UCODE_CONTAINER_SECTION_HDR,
+- total_size)) {
+- vfree(mc);
+- mc = NULL;
+- } else
+- *mc_size = total_size + UCODE_CONTAINER_SECTION_HDR;
+- }
++ memset(mc, 0, actual_size);
++ get_ucode_data(mc, buf + UCODE_CONTAINER_SECTION_HDR, actual_size);
++ *mc_size = actual_size + UCODE_CONTAINER_SECTION_HDR;
++
+ return mc;
+ }
+
+@@ -271,7 +289,7 @@ generic_load_microcode(int cpu, const u8 *data, size_t size)
+ unsigned int uninitialized_var(mc_size);
+ struct microcode_header_amd *mc_header;
+
+- mc = get_next_ucode(ucode_ptr, leftover, &mc_size);
++ mc = get_next_ucode(cpu, ucode_ptr, leftover, &mc_size);
+ if (!mc)
+ break;
+
+diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
+index 76358ee..5449a26 100644
+--- a/arch/x86/kernel/setup.c
++++ b/arch/x86/kernel/setup.c
+@@ -294,9 +294,6 @@ static void __init init_gbpages(void)
+ static inline void init_gbpages(void)
+ {
+ }
+-static void __init cleanup_highmap(void)
+-{
+-}
+ #endif
+
+ static void __init reserve_brk(void)
+@@ -924,8 +921,6 @@ void __init setup_arch(char **cmdline_p)
+
+ reserve_brk();
+
+- cleanup_highmap();
+-
+ init_gbpages();
+
+ /* max_pfn_mapped is updated here */
+diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
+index 6bce215..73ffd55 100644
+--- a/arch/x86/mm/init.c
++++ b/arch/x86/mm/init.c
+@@ -287,6 +287,25 @@ unsigned long __init_refok init_memory_mapping(unsigned long start,
+ load_cr3(swapper_pg_dir);
+ #endif
+
++#ifdef CONFIG_X86_64
++ if (!after_bootmem && !start) {
++ pud_t *pud;
++ pmd_t *pmd;
++
++ mmu_cr4_features = read_cr4();
++
++ /*
++ * _brk_end cannot change anymore, but it and _end may be
++ * located on different 2M pages. cleanup_highmap(), however,
++ * can only consider _end when it runs, so destroy any
++ * mappings beyond _brk_end here.
++ */
++ pud = pud_offset(pgd_offset_k(_brk_end), _brk_end);
++ pmd = pmd_offset(pud, _brk_end - 1);
++ while (++pmd <= pmd_offset(pud, (unsigned long)_end - 1))
++ pmd_clear(pmd);
++ }
++#endif
+ __flush_tlb_all();
+
+ if (!after_bootmem && e820_table_end > e820_table_start)
+diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
+index 1584023..7d095ad 100644
+--- a/arch/x86/mm/init_64.c
++++ b/arch/x86/mm/init_64.c
+@@ -49,7 +49,6 @@
+ #include <asm/numa.h>
+ #include <asm/cacheflush.h>
+ #include <asm/init.h>
+-#include <asm/setup.h>
+ #include <linux/bootmem.h>
+
+ static unsigned long dma_reserve __initdata;
+@@ -258,18 +257,18 @@ void __init init_extra_mapping_uc(unsigned long phys, unsigned long size)
+ * to the compile time generated pmds. This results in invalid pmds up
+ * to the point where we hit the physaddr 0 mapping.
+ *
+- * We limit the mappings to the region from _text to _brk_end. _brk_end
+- * is rounded up to the 2MB boundary. This catches the invalid pmds as
++ * We limit the mappings to the region from _text to _end. _end is
++ * rounded up to the 2MB boundary. This catches the invalid pmds as
+ * well, as they are located before _text:
+ */
+ void __init cleanup_highmap(void)
+ {
+ unsigned long vaddr = __START_KERNEL_map;
+- unsigned long vaddr_end = __START_KERNEL_map + (max_pfn_mapped << PAGE_SHIFT);
+- unsigned long end = roundup((unsigned long)_brk_end, PMD_SIZE) - 1;
++ unsigned long end = roundup((unsigned long)_end, PMD_SIZE) - 1;
+ pmd_t *pmd = level2_kernel_pgt;
++ pmd_t *last_pmd = pmd + PTRS_PER_PMD;
+
+- for (; vaddr + PMD_SIZE - 1 < vaddr_end; pmd++, vaddr += PMD_SIZE) {
++ for (; pmd < last_pmd; pmd++, vaddr += PMD_SIZE) {
+ if (pmd_none(*pmd))
+ continue;
+ if (vaddr < (unsigned long) _text || vaddr > end)
+diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
+index a73f102..84c93ff 100644
+--- a/drivers/atm/solos-pci.c
++++ b/drivers/atm/solos-pci.c
+@@ -688,7 +688,7 @@ void solos_bh(unsigned long card_arg)
+ size);
+ }
+ if (atmdebug) {
+- dev_info(&card->dev->dev, "Received: device %d\n", port);
++ dev_info(&card->dev->dev, "Received: port %d\n", port);
+ dev_info(&card->dev->dev, "size: %d VPI: %d VCI: %d\n",
+ size, le16_to_cpu(header->vpi),
+ le16_to_cpu(header->vci));
+@@ -1008,8 +1008,15 @@ static uint32_t fpga_tx(struct solos_card *card)
+
+ /* Clean up and free oldskb now it's gone */
+ if (atmdebug) {
++ struct pkt_hdr *header = (void *)oldskb->data;
++ int size = le16_to_cpu(header->size);
++
++ skb_pull(oldskb, sizeof(*header));
+ dev_info(&card->dev->dev, "Transmitted: port %d\n",
+ port);
++ dev_info(&card->dev->dev, "size: %d VPI: %d VCI: %d\n",
++ size, le16_to_cpu(header->vpi),
++ le16_to_cpu(header->vci));
+ print_buffer(oldskb);
+ }
+
+diff --git a/drivers/block/cciss.h b/drivers/block/cciss.h
+index 31524cf..5ae1b1c 100644
+--- a/drivers/block/cciss.h
++++ b/drivers/block/cciss.h
+@@ -165,6 +165,7 @@ static void SA5_submit_command( ctlr_info_t *h, CommandList_struct *c)
+ printk("Sending %x - down to controller\n", c->busaddr );
+ #endif /* CCISS_DEBUG */
+ writel(c->busaddr, h->vaddr + SA5_REQUEST_PORT_OFFSET);
++ readl(h->vaddr + SA5_REQUEST_PORT_OFFSET);
+ h->commands_outstanding++;
+ if ( h->commands_outstanding > h->max_outstanding)
+ h->max_outstanding = h->commands_outstanding;
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 0e9c564..c12d0fb 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -62,6 +62,9 @@ static struct usb_device_id btusb_table[] = {
+ /* Apple iMac11,1 */
+ { USB_DEVICE(0x05ac, 0x8215) },
+
++ /* Apple MacBookPro8,2 */
++ { USB_DEVICE(0x05ac, 0x821a) },
++
+ /* AVM BlueFRITZ! USB v2.0 */
+ { USB_DEVICE(0x057c, 0x3800) },
+
+diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
+index 8548ae7..edd7b7f 100644
+--- a/drivers/char/tpm/tpm.c
++++ b/drivers/char/tpm/tpm.c
+@@ -969,7 +969,7 @@ int tpm_open(struct inode *inode, struct file *file)
+ return -EBUSY;
+ }
+
+- chip->data_buffer = kmalloc(TPM_BUFSIZE * sizeof(u8), GFP_KERNEL);
++ chip->data_buffer = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
+ if (chip->data_buffer == NULL) {
+ clear_bit(0, &chip->is_open);
+ put_device(chip->dev);
+diff --git a/drivers/mfd/ab3100-core.c b/drivers/mfd/ab3100-core.c
+index 6134810..78e3e85 100644
+--- a/drivers/mfd/ab3100-core.c
++++ b/drivers/mfd/ab3100-core.c
+@@ -591,7 +591,7 @@ static void ab3100_setup_debugfs(struct ab3100 *ab3100)
+ ab3100_get_priv.ab3100 = ab3100;
+ ab3100_get_priv.mode = false;
+ ab3100_get_reg_file = debugfs_create_file("get_reg",
+- S_IWUGO, ab3100_dir, &ab3100_get_priv,
++ S_IWUSR, ab3100_dir, &ab3100_get_priv,
+ &ab3100_get_set_reg_fops);
+ if (!ab3100_get_reg_file) {
+ err = -ENOMEM;
+@@ -601,7 +601,7 @@ static void ab3100_setup_debugfs(struct ab3100 *ab3100)
+ ab3100_set_priv.ab3100 = ab3100;
+ ab3100_set_priv.mode = true;
+ ab3100_set_reg_file = debugfs_create_file("set_reg",
+- S_IWUGO, ab3100_dir, &ab3100_set_priv,
++ S_IWUSR, ab3100_dir, &ab3100_set_priv,
+ &ab3100_get_set_reg_fops);
+ if (!ab3100_set_reg_file) {
+ err = -ENOMEM;
+diff --git a/drivers/misc/ep93xx_pwm.c b/drivers/misc/ep93xx_pwm.c
+index ba46941..3f9a0ab 100644
+--- a/drivers/misc/ep93xx_pwm.c
++++ b/drivers/misc/ep93xx_pwm.c
+@@ -248,11 +248,11 @@ static ssize_t ep93xx_pwm_set_invert(struct device *dev,
+
+ static DEVICE_ATTR(min_freq, S_IRUGO, ep93xx_pwm_get_min_freq, NULL);
+ static DEVICE_ATTR(max_freq, S_IRUGO, ep93xx_pwm_get_max_freq, NULL);
+-static DEVICE_ATTR(freq, S_IWUGO | S_IRUGO,
++static DEVICE_ATTR(freq, S_IWUSR | S_IRUGO,
+ ep93xx_pwm_get_freq, ep93xx_pwm_set_freq);
+-static DEVICE_ATTR(duty_percent, S_IWUGO | S_IRUGO,
++static DEVICE_ATTR(duty_percent, S_IWUSR | S_IRUGO,
+ ep93xx_pwm_get_duty_percent, ep93xx_pwm_set_duty_percent);
+-static DEVICE_ATTR(invert, S_IWUGO | S_IRUGO,
++static DEVICE_ATTR(invert, S_IWUSR | S_IRUGO,
+ ep93xx_pwm_get_invert, ep93xx_pwm_set_invert);
+
+ static struct attribute *ep93xx_pwm_attrs[] = {
+diff --git a/drivers/net/myri10ge/myri10ge.c b/drivers/net/myri10ge/myri10ge.c
+index f362451..b8dc2d1 100644
+--- a/drivers/net/myri10ge/myri10ge.c
++++ b/drivers/net/myri10ge/myri10ge.c
+@@ -3640,6 +3640,7 @@ static void myri10ge_free_slices(struct myri10ge_priv *mgp)
+ dma_free_coherent(&pdev->dev, bytes,
+ ss->fw_stats, ss->fw_stats_bus);
+ ss->fw_stats = NULL;
++ netif_napi_del(&ss->napi);
+ }
+ }
+ kfree(mgp->ss);
+diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
+index 0c349ce..54e716a 100644
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -1918,6 +1918,8 @@ static int ath9k_start(struct ieee80211_hw *hw)
+ DPRINTF(sc, ATH_DBG_CONFIG, "Starting driver with "
+ "initial channel: %d MHz\n", curchan->center_freq);
+
++ ath9k_ps_wakeup(sc);
++
+ mutex_lock(&sc->mutex);
+
+ if (ath9k_wiphy_started(sc)) {
+@@ -2025,6 +2027,8 @@ static int ath9k_start(struct ieee80211_hw *hw)
+ mutex_unlock:
+ mutex_unlock(&sc->mutex);
+
++ ath9k_ps_restore(sc);
++
+ return r;
+ }
+
+diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
+index 571d475..8bf4bbd 100644
+--- a/drivers/net/wireless/b43/dma.c
++++ b/drivers/net/wireless/b43/dma.c
+@@ -1521,7 +1521,7 @@ static void dma_rx(struct b43_dmaring *ring, int *slot)
+ dmaaddr = meta->dmaaddr;
+ goto drop_recycle_buffer;
+ }
+- if (unlikely(len > ring->rx_buffersize)) {
++ if (unlikely(len + ring->frameoffset > ring->rx_buffersize)) {
+ /* The data did not fit into one descriptor buffer
+ * and is split over multiple buffers.
+ * This should never happen, as we try to allocate buffers
+diff --git a/drivers/net/wireless/b43/dma.h b/drivers/net/wireless/b43/dma.h
+index f0b0838..ceee7a3 100644
+--- a/drivers/net/wireless/b43/dma.h
++++ b/drivers/net/wireless/b43/dma.h
+@@ -163,7 +163,7 @@ struct b43_dmadesc_generic {
+ /* DMA engine tuning knobs */
+ #define B43_TXRING_SLOTS 256
+ #define B43_RXRING_SLOTS 64
+-#define B43_DMA0_RX_BUFFERSIZE IEEE80211_MAX_FRAME_LEN
++#define B43_DMA0_RX_BUFFERSIZE (B43_DMA0_RX_FRAMEOFFSET + IEEE80211_MAX_FRAME_LEN)
+
+
+ struct sk_buff;
+diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
+index 0a2bf5c..54c3a9d 100644
+--- a/drivers/net/wireless/p54/p54usb.c
++++ b/drivers/net/wireless/p54/p54usb.c
+@@ -54,6 +54,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
+ {USB_DEVICE(0x0846, 0x4210)}, /* Netgear WG121 the second ? */
+ {USB_DEVICE(0x0846, 0x4220)}, /* Netgear WG111 */
+ {USB_DEVICE(0x09aa, 0x1000)}, /* Spinnaker Proto board */
++ {USB_DEVICE(0x0bf8, 0x1007)}, /* Fujitsu E-5400 USB */
+ {USB_DEVICE(0x0cde, 0x0006)}, /* Medion 40900, Roper Europe */
+ {USB_DEVICE(0x0db0, 0x6826)}, /* MSI UB54G (MS-6826) */
+ {USB_DEVICE(0x107b, 0x55f2)}, /* Gateway WGU-210 (Gemtek) */
+@@ -66,6 +67,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
+ {USB_DEVICE(0x1915, 0x2235)}, /* Linksys WUSB54G Portable OEM */
+ {USB_DEVICE(0x2001, 0x3701)}, /* DLink DWL-G120 Spinnaker */
+ {USB_DEVICE(0x2001, 0x3703)}, /* DLink DWL-G122 */
++ {USB_DEVICE(0x2001, 0x3762)}, /* Conceptronic C54U */
+ {USB_DEVICE(0x5041, 0x2234)}, /* Linksys WUSB54G */
+ {USB_DEVICE(0x5041, 0x2235)}, /* Linksys WUSB54G Portable */
+
+diff --git a/drivers/rtc/rtc-ds1511.c b/drivers/rtc/rtc-ds1511.c
+index 0b6b773..21c2181 100644
+--- a/drivers/rtc/rtc-ds1511.c
++++ b/drivers/rtc/rtc-ds1511.c
+@@ -480,7 +480,7 @@ ds1511_nvram_write(struct kobject *kobj, struct bin_attribute *bin_attr,
+ static struct bin_attribute ds1511_nvram_attr = {
+ .attr = {
+ .name = "nvram",
+- .mode = S_IRUGO | S_IWUGO,
++ .mode = S_IRUGO | S_IWUSR,
+ },
+ .size = DS1511_RAM_MAX,
+ .read = ds1511_nvram_read,
+diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
+index 3c8a024..3b082dd 100644
+--- a/drivers/scsi/ses.c
++++ b/drivers/scsi/ses.c
+@@ -389,9 +389,9 @@ static void ses_enclosure_data_process(struct enclosure_device *edev,
+ len = (desc_ptr[2] << 8) + desc_ptr[3];
+ /* skip past overall descriptor */
+ desc_ptr += len + 4;
+- if (ses_dev->page10)
+- addl_desc_ptr = ses_dev->page10 + 8;
+ }
++ if (ses_dev->page10)
++ addl_desc_ptr = ses_dev->page10 + 8;
+ type_ptr = ses_dev->page1 + 12 + ses_dev->page1[11];
+ components = 0;
+ for (i = 0; i < types; i++, type_ptr += 4) {
+diff --git a/drivers/staging/hv/Channel.c b/drivers/staging/hv/Channel.c
+index 746370e..366dc95 100644
+--- a/drivers/staging/hv/Channel.c
++++ b/drivers/staging/hv/Channel.c
+@@ -75,14 +75,14 @@ static void VmbusChannelSetEvent(struct vmbus_channel *Channel)
+
+ if (Channel->OfferMsg.MonitorAllocated) {
+ /* Each u32 represents 32 channels */
+- set_bit(Channel->OfferMsg.ChildRelId & 31,
++ sync_set_bit(Channel->OfferMsg.ChildRelId & 31,
+ (unsigned long *) gVmbusConnection.SendInterruptPage +
+ (Channel->OfferMsg.ChildRelId >> 5));
+
+ monitorPage = gVmbusConnection.MonitorPages;
+ monitorPage++; /* Get the child to parent monitor page */
+
+- set_bit(Channel->MonitorBit,
++ sync_set_bit(Channel->MonitorBit,
+ (unsigned long *)&monitorPage->TriggerGroup
+ [Channel->MonitorGroup].Pending);
+
+@@ -102,7 +102,7 @@ static void VmbusChannelClearEvent(struct vmbus_channel *channel)
+
+ if (Channel->OfferMsg.MonitorAllocated) {
+ /* Each u32 represents 32 channels */
+- clear_bit(Channel->OfferMsg.ChildRelId & 31,
++ sync_clear_bit(Channel->OfferMsg.ChildRelId & 31,
+ (unsigned long *)gVmbusConnection.SendInterruptPage +
+ (Channel->OfferMsg.ChildRelId >> 5));
+
+@@ -110,7 +110,7 @@ static void VmbusChannelClearEvent(struct vmbus_channel *channel)
+ (struct hv_monitor_page *)gVmbusConnection.MonitorPages;
+ monitorPage++; /* Get the child to parent monitor page */
+
+- clear_bit(Channel->MonitorBit,
++ sync_clear_bit(Channel->MonitorBit,
+ (unsigned long *)&monitorPage->TriggerGroup
+ [Channel->MonitorGroup].Pending);
+ }
+diff --git a/drivers/staging/hv/Connection.c b/drivers/staging/hv/Connection.c
+index 43c2e68..c8d073a 100644
+--- a/drivers/staging/hv/Connection.c
++++ b/drivers/staging/hv/Connection.c
+@@ -284,7 +284,9 @@ void VmbusOnEvents(void)
+ for (dword = 0; dword < maxdword; dword++) {
+ if (recvInterruptPage[dword]) {
+ for (bit = 0; bit < 32; bit++) {
+- if (test_and_clear_bit(bit, (unsigned long *)&recvInterruptPage[dword])) {
++ if (sync_test_and_clear_bit(bit,
++ (unsigned long *)
++ &recvInterruptPage[dword])) {
+ relid = (dword << 5) + bit;
+ DPRINT_DBG(VMBUS, "event detected for relid - %d", relid);
+
+@@ -329,7 +331,7 @@ int VmbusSetEvent(u32 childRelId)
+ DPRINT_ENTER(VMBUS);
+
+ /* Each u32 represents 32 channels */
+- set_bit(childRelId & 31,
++ sync_set_bit(childRelId & 31,
+ (unsigned long *)gVmbusConnection.SendInterruptPage +
+ (childRelId >> 5));
+
+diff --git a/drivers/staging/hv/Vmbus.c b/drivers/staging/hv/Vmbus.c
+index 35a023e..2a4ba03 100644
+--- a/drivers/staging/hv/Vmbus.c
++++ b/drivers/staging/hv/Vmbus.c
+@@ -254,7 +254,7 @@ static int VmbusOnISR(struct hv_driver *drv)
+ event = (union hv_synic_event_flags *)page_addr + VMBUS_MESSAGE_SINT;
+
+ /* Since we are a child, we only need to check bit 0 */
+- if (test_and_clear_bit(0, (unsigned long *) &event->Flags32[0])) {
++ if (sync_test_and_clear_bit(0, (unsigned long *) &event->Flags32[0])) {
+ DPRINT_DBG(VMBUS, "received event %d", event->Flags32[0]);
+ ret |= 0x2;
+ }
+diff --git a/drivers/staging/hv/VmbusPrivate.h b/drivers/staging/hv/VmbusPrivate.h
+index 05ad2c9..5a37cce 100644
+--- a/drivers/staging/hv/VmbusPrivate.h
++++ b/drivers/staging/hv/VmbusPrivate.h
+@@ -32,6 +32,7 @@
+ #include "ChannelInterface.h"
+ #include "RingBuffer.h"
+ #include <linux/list.h>
++#include <asm/sync_bitops.h>
+
+
+ /*
+diff --git a/drivers/staging/hv/netvsc_drv.c b/drivers/staging/hv/netvsc_drv.c
+index a5101e3..44d8d6f 100644
+--- a/drivers/staging/hv/netvsc_drv.c
++++ b/drivers/staging/hv/netvsc_drv.c
+@@ -44,6 +44,7 @@ struct net_device_context {
+ /* point back to our device context */
+ struct device_context *device_ctx;
+ struct net_device_stats stats;
++ struct work_struct work;
+ };
+
+ struct netvsc_driver_context {
+@@ -284,6 +285,7 @@ static void netvsc_linkstatus_callback(struct hv_device *device_obj,
+ {
+ struct device_context *device_ctx = to_device_context(device_obj);
+ struct net_device *net = dev_get_drvdata(&device_ctx->device);
++ struct net_device_context *ndev_ctx;
+
+ DPRINT_ENTER(NETVSC_DRV);
+
+@@ -297,6 +299,8 @@ static void netvsc_linkstatus_callback(struct hv_device *device_obj,
+ netif_carrier_on(net);
+ netif_wake_queue(net);
+ netif_notify_peers(net);
++ ndev_ctx = netdev_priv(net);
++ schedule_work(&ndev_ctx->work);
+ } else {
+ netif_carrier_off(net);
+ netif_stop_queue(net);
+@@ -398,6 +402,25 @@ static const struct net_device_ops device_ops = {
+ .ndo_set_mac_address = eth_mac_addr,
+ };
+
++/*
++ * Send GARP packet to network peers after migrations.
++ * After Quick Migration, the network is not immediately operational in the
++ * current context when receiving RNDIS_STATUS_MEDIA_CONNECT event. So, add
++ * another netif_notify_peers() into a scheduled work, otherwise GARP packet
++ * will not be sent after quick migration, and cause network disconnection.
++ */
++static void netvsc_send_garp(struct work_struct *w)
++{
++ struct net_device_context *ndev_ctx;
++ struct net_device *net;
++
++ msleep(20);
++ ndev_ctx = container_of(w, struct net_device_context, work);
++ net = dev_get_drvdata(&ndev_ctx->device_ctx->device);
++ netif_notify_peers(net);
++}
++
++
+ static int netvsc_probe(struct device *device)
+ {
+ struct driver_context *driver_ctx =
+@@ -428,6 +451,7 @@ static int netvsc_probe(struct device *device)
+ net_device_ctx = netdev_priv(net);
+ net_device_ctx->device_ctx = device_ctx;
+ dev_set_drvdata(device, net);
++ INIT_WORK(&net_device_ctx->work, netvsc_send_garp);
+
+ /* Notify the netvsc driver of the new device */
+ ret = net_drv_obj->Base.OnDeviceAdd(device_obj, &device_info);
+diff --git a/drivers/staging/usbip/stub_rx.c b/drivers/staging/usbip/stub_rx.c
+index 815fb7c..a9cdc4c 100644
+--- a/drivers/staging/usbip/stub_rx.c
++++ b/drivers/staging/usbip/stub_rx.c
+@@ -168,33 +168,23 @@ static int tweak_set_configuration_cmd(struct urb *urb)
+
+ static int tweak_reset_device_cmd(struct urb *urb)
+ {
+- struct usb_ctrlrequest *req;
+- __u16 value;
+- __u16 index;
+- int ret;
+-
+- req = (struct usb_ctrlrequest *) urb->setup_packet;
+- value = le16_to_cpu(req->wValue);
+- index = le16_to_cpu(req->wIndex);
+-
+- usbip_uinfo("reset_device (port %d) to %s\n", index,
+- dev_name(&urb->dev->dev));
++ struct stub_priv *priv = (struct stub_priv *) urb->context;
++ struct stub_device *sdev = priv->sdev;
+
+- /* all interfaces should be owned by usbip driver, so just reset it. */
+- ret = usb_lock_device_for_reset(urb->dev, NULL);
+- if (ret < 0) {
+- dev_err(&urb->dev->dev, "lock for reset\n");
+- return ret;
+- }
+-
+- /* try to reset the device */
+- ret = usb_reset_device(urb->dev);
+- if (ret < 0)
+- dev_err(&urb->dev->dev, "device reset\n");
++ usbip_uinfo("reset_device %s\n", dev_name(&urb->dev->dev));
+
+- usb_unlock_device(urb->dev);
+-
+- return ret;
++ /*
++ * usb_lock_device_for_reset caused a deadlock: it causes the driver
++ * to unbind. In the shutdown the rx thread is signalled to shut down
++ * but this thread is pending in the usb_lock_device_for_reset.
++ *
++ * Instead queue the reset.
++ *
++ * Unfortunatly an existing usbip connection will be dropped due to
++ * driver unbinding.
++ */
++ usb_queue_reset_device(sdev->interface);
++ return 0;
+ }
+
+ /*
+diff --git a/drivers/staging/usbip/stub_tx.c b/drivers/staging/usbip/stub_tx.c
+index e2ab4f3..523d7ff 100644
+--- a/drivers/staging/usbip/stub_tx.c
++++ b/drivers/staging/usbip/stub_tx.c
+@@ -167,7 +167,6 @@ static int stub_send_ret_submit(struct stub_device *sdev)
+ struct stub_priv *priv, *tmp;
+
+ struct msghdr msg;
+- struct kvec iov[3];
+ size_t txsize;
+
+ size_t total_size = 0;
+@@ -177,28 +176,73 @@ static int stub_send_ret_submit(struct stub_device *sdev)
+ struct urb *urb = priv->urb;
+ struct usbip_header pdu_header;
+ void *iso_buffer = NULL;
++ struct kvec *iov = NULL;
++ int iovnum = 0;
+
+ txsize = 0;
+ memset(&pdu_header, 0, sizeof(pdu_header));
+ memset(&msg, 0, sizeof(msg));
+- memset(&iov, 0, sizeof(iov));
+
+- usbip_dbg_stub_tx("setup txdata urb %p\n", urb);
++ if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS)
++ iovnum = 2 + urb->number_of_packets;
++ else
++ iovnum = 2;
++
++ iov = kzalloc(iovnum * sizeof(struct kvec), GFP_KERNEL);
+
++ if (!iov) {
++ usbip_event_add(&sdev->ud, SDEV_EVENT_ERROR_MALLOC);
++ return -1;
++ }
++
++ iovnum = 0;
+
+ /* 1. setup usbip_header */
+ setup_ret_submit_pdu(&pdu_header, urb);
++ usbip_dbg_stub_tx("setup txdata seqnum: %d urb: %p\n",
++ pdu_header.base.seqnum, urb);
++ /*usbip_dump_header(pdu_header);*/
+ usbip_header_correct_endian(&pdu_header, 1);
+
+- iov[0].iov_base = &pdu_header;
+- iov[0].iov_len = sizeof(pdu_header);
++ iov[iovnum].iov_base = &pdu_header;
++ iov[iovnum].iov_len = sizeof(pdu_header);
++ iovnum++;
+ txsize += sizeof(pdu_header);
+
+ /* 2. setup transfer buffer */
+- if (usb_pipein(urb->pipe) && urb->actual_length > 0) {
+- iov[1].iov_base = urb->transfer_buffer;
+- iov[1].iov_len = urb->actual_length;
++ if (usb_pipein(urb->pipe) &&
++ usb_pipetype(urb->pipe) != PIPE_ISOCHRONOUS &&
++ urb->actual_length > 0) {
++ iov[iovnum].iov_base = urb->transfer_buffer;
++ iov[iovnum].iov_len = urb->actual_length;
++ iovnum++;
+ txsize += urb->actual_length;
++ } else if (usb_pipein(urb->pipe) &&
++ usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
++ /*
++ * For isochronous packets: actual length is the sum of
++ * the actual length of the individual, packets, but as
++ * the packet offsets are not changed there will be
++ * padding between the packets. To optimally use the
++ * bandwidth the padding is not transmitted.
++ */
++
++ int i;
++ for (i = 0; i < urb->number_of_packets; i++) {
++ iov[iovnum].iov_base = urb->transfer_buffer + urb->iso_frame_desc[i].offset;
++ iov[iovnum].iov_len = urb->iso_frame_desc[i].actual_length;
++ iovnum++;
++ txsize += urb->iso_frame_desc[i].actual_length;
++ }
++
++ if (txsize != sizeof(pdu_header) + urb->actual_length) {
++ dev_err(&sdev->interface->dev,
++ "actual length of urb (%d) does not match iso packet sizes (%d)\n",
++ urb->actual_length, txsize-sizeof(pdu_header));
++ kfree(iov);
++ usbip_event_add(&sdev->ud, SDEV_EVENT_ERROR_TCP);
++ return -1;
++ }
+ }
+
+ /* 3. setup iso_packet_descriptor */
+@@ -209,32 +253,34 @@ static int stub_send_ret_submit(struct stub_device *sdev)
+ if (!iso_buffer) {
+ usbip_event_add(&sdev->ud,
+ SDEV_EVENT_ERROR_MALLOC);
++ kfree(iov);
+ return -1;
+ }
+
+- iov[2].iov_base = iso_buffer;
+- iov[2].iov_len = len;
++ iov[iovnum].iov_base = iso_buffer;
++ iov[iovnum].iov_len = len;
+ txsize += len;
++ iovnum++;
+ }
+
+- ret = kernel_sendmsg(sdev->ud.tcp_socket, &msg, iov,
+- 3, txsize);
++ ret = kernel_sendmsg(sdev->ud.tcp_socket, &msg,
++ iov, iovnum, txsize);
+ if (ret != txsize) {
+ dev_err(&sdev->interface->dev,
+ "sendmsg failed!, retval %d for %zd\n",
+ ret, txsize);
++ kfree(iov);
+ kfree(iso_buffer);
+ usbip_event_add(&sdev->ud, SDEV_EVENT_ERROR_TCP);
+ return -1;
+ }
+
++ kfree(iov);
+ kfree(iso_buffer);
+- usbip_dbg_stub_tx("send txdata\n");
+
+ total_size += txsize;
+ }
+
+-
+ spin_lock_irqsave(&sdev->priv_lock, flags);
+
+ list_for_each_entry_safe(priv, tmp, &sdev->priv_free, list) {
+diff --git a/drivers/staging/usbip/usbip_common.c b/drivers/staging/usbip/usbip_common.c
+index ddb6f5f..719e0c1 100644
+--- a/drivers/staging/usbip/usbip_common.c
++++ b/drivers/staging/usbip/usbip_common.c
+@@ -361,10 +361,11 @@ void usbip_dump_header(struct usbip_header *pdu)
+ usbip_udbg("CMD_UNLINK: seq %u\n", pdu->u.cmd_unlink.seqnum);
+ break;
+ case USBIP_RET_SUBMIT:
+- usbip_udbg("RET_SUBMIT: st %d al %u sf %d ec %d\n",
++ usbip_udbg("RET_SUBMIT: st %d al %u sf %d #p %d ec %d\n",
+ pdu->u.ret_submit.status,
+ pdu->u.ret_submit.actual_length,
+ pdu->u.ret_submit.start_frame,
++ pdu->u.ret_submit.number_of_packets,
+ pdu->u.ret_submit.error_count);
+ case USBIP_RET_UNLINK:
+ usbip_udbg("RET_UNLINK: status %d\n", pdu->u.ret_unlink.status);
+@@ -686,6 +687,7 @@ static void usbip_pack_ret_submit(struct usbip_header *pdu, struct urb *urb,
+ rpdu->status = urb->status;
+ rpdu->actual_length = urb->actual_length;
+ rpdu->start_frame = urb->start_frame;
++ rpdu->number_of_packets = urb->number_of_packets;
+ rpdu->error_count = urb->error_count;
+ } else {
+ /* vhci_rx.c */
+@@ -693,6 +695,7 @@ static void usbip_pack_ret_submit(struct usbip_header *pdu, struct urb *urb,
+ urb->status = rpdu->status;
+ urb->actual_length = rpdu->actual_length;
+ urb->start_frame = rpdu->start_frame;
++ urb->number_of_packets = rpdu->number_of_packets;
+ urb->error_count = rpdu->error_count;
+ }
+ }
+@@ -761,11 +764,13 @@ static void correct_endian_ret_submit(struct usbip_header_ret_submit *pdu,
+ cpu_to_be32s(&pdu->status);
+ cpu_to_be32s(&pdu->actual_length);
+ cpu_to_be32s(&pdu->start_frame);
++ cpu_to_be32s(&pdu->number_of_packets);
+ cpu_to_be32s(&pdu->error_count);
+ } else {
+ be32_to_cpus(&pdu->status);
+ be32_to_cpus(&pdu->actual_length);
+ be32_to_cpus(&pdu->start_frame);
++ cpu_to_be32s(&pdu->number_of_packets);
+ be32_to_cpus(&pdu->error_count);
+ }
+ }
+@@ -891,6 +896,7 @@ int usbip_recv_iso(struct usbip_device *ud, struct urb *urb)
+ int size = np * sizeof(*iso);
+ int i;
+ int ret;
++ int total_length = 0;
+
+ if (!usb_pipeisoc(urb->pipe))
+ return 0;
+@@ -920,19 +926,75 @@ int usbip_recv_iso(struct usbip_device *ud, struct urb *urb)
+ return -EPIPE;
+ }
+
++
+ for (i = 0; i < np; i++) {
+ iso = buff + (i * sizeof(*iso));
+
+ usbip_iso_pakcet_correct_endian(iso, 0);
+ usbip_pack_iso(iso, &urb->iso_frame_desc[i], 0);
++ total_length += urb->iso_frame_desc[i].actual_length;
+ }
+
+ kfree(buff);
+
++ if (total_length != urb->actual_length) {
++ dev_err(&urb->dev->dev,
++ "total length of iso packets (%d) not equal to actual length of buffer (%d)\n",
++ total_length, urb->actual_length);
++
++ if (ud->side == USBIP_STUB)
++ usbip_event_add(ud, SDEV_EVENT_ERROR_TCP);
++ else
++ usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
++
++ return -EPIPE;
++ }
++
+ return ret;
+ }
+ EXPORT_SYMBOL_GPL(usbip_recv_iso);
+
++/*
++ * This functions restores the padding which was removed for optimizing
++ * the bandwidth during transfer over tcp/ip
++ *
++ * buffer and iso packets need to be stored and be in propeper endian in urb
++ * before calling this function
++ */
++int usbip_pad_iso(struct usbip_device *ud, struct urb *urb)
++{
++ int np = urb->number_of_packets;
++ int i;
++ int ret;
++ int actualoffset = urb->actual_length;
++
++ if (!usb_pipeisoc(urb->pipe))
++ return 0;
++
++ /* if no packets or length of data is 0, then nothing to unpack */
++ if (np == 0 || urb->actual_length == 0)
++ return 0;
++
++ /*
++ * if actual_length is transfer_buffer_length then no padding is
++ * present.
++ */
++ if (urb->actual_length == urb->transfer_buffer_length)
++ return 0;
++
++ /*
++ * loop over all packets from last to first (to prevent overwritting
++ * memory when padding) and move them into the proper place
++ */
++ for (i = np-1; i > 0; i--) {
++ actualoffset -= urb->iso_frame_desc[i].actual_length;
++ memmove(urb->transfer_buffer + urb->iso_frame_desc[i].offset,
++ urb->transfer_buffer + actualoffset,
++ urb->iso_frame_desc[i].actual_length);
++ }
++ return ret;
++}
++EXPORT_SYMBOL_GPL(usbip_pad_iso);
+
+ /* some members of urb must be substituted before. */
+ int usbip_recv_xbuff(struct usbip_device *ud, struct urb *urb)
+diff --git a/drivers/staging/usbip/usbip_common.h b/drivers/staging/usbip/usbip_common.h
+index 1ca3eab..5e16bc3 100644
+--- a/drivers/staging/usbip/usbip_common.h
++++ b/drivers/staging/usbip/usbip_common.h
+@@ -393,6 +393,8 @@ void usbip_header_correct_endian(struct usbip_header *pdu, int send);
+ int usbip_recv_xbuff(struct usbip_device *ud, struct urb *urb);
+ /* some members of urb must be substituted before. */
+ int usbip_recv_iso(struct usbip_device *ud, struct urb *urb);
++/* some members of urb must be substituted before. */
++int usbip_pad_iso(struct usbip_device *ud, struct urb *urb);
+ void *usbip_alloc_iso_desc_pdu(struct urb *urb, ssize_t *bufflen);
+
+
+diff --git a/drivers/staging/usbip/vhci_rx.c b/drivers/staging/usbip/vhci_rx.c
+index 2d989c4..8ed5206 100644
+--- a/drivers/staging/usbip/vhci_rx.c
++++ b/drivers/staging/usbip/vhci_rx.c
+@@ -97,6 +97,9 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev,
+ if (usbip_recv_iso(ud, urb) < 0)
+ return;
+
++ /* restore the padding in iso packets */
++ if (usbip_pad_iso(ud, urb) < 0)
++ return;
+
+ if (usbip_dbg_flag_vhci_rx)
+ usbip_dump_urb(urb);
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index 9f806dd..bb3c0f2 100644
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -1182,6 +1182,8 @@ struct btrfs_root {
+ #define BTRFS_INODE_DIRSYNC (1 << 10)
+
+
++#define BTRFS_INODE_ROOT_ITEM_INIT (1 << 31)
++
+ /* some macros to generate set/get funcs for the struct fields. This
+ * assumes there is a lefoo_to_cpu for every type, so lets make a simple
+ * one for u8:
+@@ -2183,6 +2185,8 @@ int btrfs_find_dead_roots(struct btrfs_root *root, u64 objectid);
+ int btrfs_find_orphan_roots(struct btrfs_root *tree_root);
+ int btrfs_set_root_node(struct btrfs_root_item *item,
+ struct extent_buffer *node);
++void btrfs_check_and_init_root_item(struct btrfs_root_item *item);
++
+ /* dir-item.c */
+ int btrfs_insert_dir_item(struct btrfs_trans_handle *trans,
+ struct btrfs_root *root, const char *name,
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index 2b59201..f447188 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -1145,8 +1145,10 @@ struct btrfs_root *btrfs_read_fs_root_no_radix(struct btrfs_root *tree_root,
+ root->commit_root = btrfs_root_node(root);
+ BUG_ON(!root->node);
+ out:
+- if (location->objectid != BTRFS_TREE_LOG_OBJECTID)
++ if (location->objectid != BTRFS_TREE_LOG_OBJECTID) {
+ root->ref_cows = 1;
++ btrfs_check_and_init_root_item(&root->root_item);
++ }
+
+ return root;
+ }
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 0bc5776..3359aff 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -285,6 +285,10 @@ static noinline int create_subvol(struct btrfs_root *root,
+ inode_item->nbytes = cpu_to_le64(root->leafsize);
+ inode_item->mode = cpu_to_le32(S_IFDIR | 0755);
+
++ root_item.flags = 0;
++ root_item.byte_limit = 0;
++ inode_item->flags = cpu_to_le64(BTRFS_INODE_ROOT_ITEM_INIT);
++
+ btrfs_set_root_bytenr(&root_item, leaf->start);
+ btrfs_set_root_generation(&root_item, trans->transid);
+ btrfs_set_root_level(&root_item, 0);
+diff --git a/fs/btrfs/root-tree.c b/fs/btrfs/root-tree.c
+index 67fa2d2..3174255 100644
+--- a/fs/btrfs/root-tree.c
++++ b/fs/btrfs/root-tree.c
+@@ -459,3 +459,21 @@ again:
+ btrfs_free_path(path);
+ return 0;
+ }
++
++/*
++ * Old btrfs forgets to init root_item->flags and root_item->byte_limit
++ * for subvolumes. To work around this problem, we steal a bit from
++ * root_item->inode_item->flags, and use it to indicate if those fields
++ * have been properly initialized.
++ */
++void btrfs_check_and_init_root_item(struct btrfs_root_item *root_item)
++{
++ u64 inode_flags = le64_to_cpu(root_item->inode.flags);
++
++ if (!(inode_flags & BTRFS_INODE_ROOT_ITEM_INIT)) {
++ inode_flags |= BTRFS_INODE_ROOT_ITEM_INIT;
++ root_item->inode.flags = cpu_to_le64(inode_flags);
++ root_item->flags = 0;
++ root_item->byte_limit = 0;
++ }
++}
+diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
+index b2acc79..b640fba 100644
+--- a/fs/btrfs/transaction.c
++++ b/fs/btrfs/transaction.c
+@@ -777,6 +777,7 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans,
+ record_root_in_trans(trans, root);
+ btrfs_set_root_last_snapshot(&root->root_item, trans->transid);
+ memcpy(new_root_item, &root->root_item, sizeof(*new_root_item));
++ btrfs_check_and_init_root_item(new_root_item);
+
+ key.objectid = objectid;
+ /* record when the snapshot was created in key.offset */
+diff --git a/fs/compat.c b/fs/compat.c
+index d576b55..d1e2411 100644
+--- a/fs/compat.c
++++ b/fs/compat.c
+@@ -1353,6 +1353,10 @@ static int compat_count(compat_uptr_t __user *argv, int max)
+ argv++;
+ if (i++ >= max)
+ return -E2BIG;
++
++ if (fatal_signal_pending(current))
++ return -ERESTARTNOHAND;
++ cond_resched();
+ }
+ }
+ return i;
+@@ -1394,6 +1398,12 @@ static int compat_copy_strings(int argc, compat_uptr_t __user *argv,
+ while (len > 0) {
+ int offset, bytes_to_copy;
+
++ if (fatal_signal_pending(current)) {
++ ret = -ERESTARTNOHAND;
++ goto out;
++ }
++ cond_resched();
++
+ offset = pos % PAGE_SIZE;
+ if (offset == 0)
+ offset = PAGE_SIZE;
+@@ -1410,18 +1420,8 @@ static int compat_copy_strings(int argc, compat_uptr_t __user *argv,
+ if (!kmapped_page || kpos != (pos & PAGE_MASK)) {
+ struct page *page;
+
+-#ifdef CONFIG_STACK_GROWSUP
+- ret = expand_stack_downwards(bprm->vma, pos);
+- if (ret < 0) {
+- /* We've exceed the stack rlimit. */
+- ret = -E2BIG;
+- goto out;
+- }
+-#endif
+- ret = get_user_pages(current, bprm->mm, pos,
+- 1, 1, 1, &page, NULL);
+- if (ret <= 0) {
+- /* We've exceed the stack rlimit. */
++ page = get_arg_page(bprm, pos, 1);
++ if (!page) {
+ ret = -E2BIG;
+ goto out;
+ }
+@@ -1542,8 +1542,10 @@ int compat_do_execve(char * filename,
+ return retval;
+
+ out:
+- if (bprm->mm)
++ if (bprm->mm) {
++ acct_arg_size(bprm, 0);
+ mmput(bprm->mm);
++ }
+
+ out_file:
+ if (bprm->file) {
+diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
+index a0a7847..aa2480a 100644
+--- a/fs/ecryptfs/keystore.c
++++ b/fs/ecryptfs/keystore.c
+@@ -1542,6 +1542,7 @@ int ecryptfs_keyring_auth_tok_for_sig(struct key **auth_tok_key,
+ printk(KERN_ERR "Could not find key with description: [%s]\n",
+ sig);
+ rc = process_request_key_err(PTR_ERR(*auth_tok_key));
++ (*auth_tok_key) = NULL;
+ goto out;
+ }
+ (*auth_tok) = ecryptfs_get_key_payload_data(*auth_tok_key);
+diff --git a/fs/ecryptfs/mmap.c b/fs/ecryptfs/mmap.c
+index df4ce99..8721a89 100644
+--- a/fs/ecryptfs/mmap.c
++++ b/fs/ecryptfs/mmap.c
+@@ -372,6 +372,11 @@ static int ecryptfs_write_begin(struct file *file,
+ && (pos != 0))
+ zero_user(page, 0, PAGE_CACHE_SIZE);
+ out:
++ if (unlikely(rc)) {
++ unlock_page(page);
++ page_cache_release(page);
++ *pagep = NULL;
++ }
+ return rc;
+ }
+
+diff --git a/fs/exec.c b/fs/exec.c
+index 68083fa..0cf881d 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -159,7 +159,22 @@ out:
+
+ #ifdef CONFIG_MMU
+
+-static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
++void acct_arg_size(struct linux_binprm *bprm, unsigned long pages)
++{
++ struct mm_struct *mm = current->mm;
++ long diff = (long)(pages - bprm->vma_pages);
++
++ if (!mm || !diff)
++ return;
++
++ bprm->vma_pages = pages;
++
++ down_write(&mm->mmap_sem);
++ mm->total_vm += diff;
++ up_write(&mm->mmap_sem);
++}
++
++struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
+ int write)
+ {
+ struct page *page;
+@@ -181,6 +196,8 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
+ unsigned long size = bprm->vma->vm_end - bprm->vma->vm_start;
+ struct rlimit *rlim;
+
++ acct_arg_size(bprm, size / PAGE_SIZE);
++
+ /*
+ * We've historically supported up to 32 pages (ARG_MAX)
+ * of argument strings even with small stacks
+@@ -274,7 +291,11 @@ static bool valid_arg_len(struct linux_binprm *bprm, long len)
+
+ #else
+
+-static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
++void acct_arg_size(struct linux_binprm *bprm, unsigned long pages)
++{
++}
++
++struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
+ int write)
+ {
+ struct page *page;
+@@ -981,6 +1002,7 @@ int flush_old_exec(struct linux_binprm * bprm)
+ /*
+ * Release all of the old mmap stuff
+ */
++ acct_arg_size(bprm, 0);
+ retval = exec_mmap(bprm->mm);
+ if (retval)
+ goto out;
+@@ -1408,8 +1430,10 @@ int do_execve(char * filename,
+ return retval;
+
+ out:
+- if (bprm->mm)
+- mmput (bprm->mm);
++ if (bprm->mm) {
++ acct_arg_size(bprm, 0);
++ mmput(bprm->mm);
++ }
+
+ out_file:
+ if (bprm->file) {
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 1b23f9d..8572c79 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -5458,13 +5458,12 @@ static int ext4_indirect_trans_blocks(struct inode *inode, int nrblocks,
+ /* if nrblocks are contiguous */
+ if (chunk) {
+ /*
+- * With N contiguous data blocks, it need at most
+- * N/EXT4_ADDR_PER_BLOCK(inode->i_sb) indirect blocks
+- * 2 dindirect blocks
+- * 1 tindirect block
++ * With N contiguous data blocks, we need at most
++ * N/EXT4_ADDR_PER_BLOCK(inode->i_sb) + 1 indirect blocks,
++ * 2 dindirect blocks, and 1 tindirect block
+ */
+- indirects = nrblocks / EXT4_ADDR_PER_BLOCK(inode->i_sb);
+- return indirects + 3;
++ return DIV_ROUND_UP(nrblocks,
++ EXT4_ADDR_PER_BLOCK(inode->i_sb)) + 4;
+ }
+ /*
+ * if nrblocks are not contiguous, worse case, each block touch
+diff --git a/fs/nfsd/lockd.c b/fs/nfsd/lockd.c
+index b2786a5..cc2f505 100644
+--- a/fs/nfsd/lockd.c
++++ b/fs/nfsd/lockd.c
+@@ -44,7 +44,6 @@ nlm_fopen(struct svc_rqst *rqstp, struct nfs_fh *f, struct file **filp)
+ exp_readlock();
+ nfserr = nfsd_open(rqstp, &fh, S_IFREG, NFSD_MAY_LOCK, filp);
+ fh_put(&fh);
+- rqstp->rq_client = NULL;
+ exp_readunlock();
+ /* We return nlm error codes as nlm doesn't know
+ * about nfsd, but nfsd does know about nlm..
+diff --git a/fs/nilfs2/file.c b/fs/nilfs2/file.c
+index 30292df..9ad0035 100644
+--- a/fs/nilfs2/file.c
++++ b/fs/nilfs2/file.c
+@@ -72,10 +72,9 @@ static int nilfs_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
+ /*
+ * check to see if the page is mapped already (no holes)
+ */
+- if (PageMappedToDisk(page)) {
+- unlock_page(page);
++ if (PageMappedToDisk(page))
+ goto mapped;
+- }
++
+ if (page_has_buffers(page)) {
+ struct buffer_head *bh, *head;
+ int fully_mapped = 1;
+@@ -90,7 +89,6 @@ static int nilfs_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
+
+ if (fully_mapped) {
+ SetPageMappedToDisk(page);
+- unlock_page(page);
+ goto mapped;
+ }
+ }
+@@ -105,16 +103,18 @@ static int nilfs_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
+ return VM_FAULT_SIGBUS;
+
+ ret = block_page_mkwrite(vma, vmf, nilfs_get_block);
+- if (unlikely(ret)) {
++ if (ret != VM_FAULT_LOCKED) {
+ nilfs_transaction_abort(inode->i_sb);
+ return ret;
+ }
++ nilfs_set_file_dirty(NILFS_SB(inode->i_sb), inode,
++ 1 << (PAGE_SHIFT - inode->i_blkbits));
+ nilfs_transaction_commit(inode->i_sb);
+
+ mapped:
+ SetPageChecked(page);
+ wait_on_page_writeback(page);
+- return 0;
++ return VM_FAULT_LOCKED;
+ }
+
+ static const struct vm_operations_struct nilfs_file_vm_ops = {
+diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
+index 5fc918c..35d256b 100644
+--- a/fs/ocfs2/aops.c
++++ b/fs/ocfs2/aops.c
+@@ -1091,6 +1091,12 @@ static int ocfs2_prepare_page_for_write(struct inode *inode, u64 *p_blkno,
+ ocfs2_figure_cluster_boundaries(OCFS2_SB(inode->i_sb), cpos,
+ &cluster_start, &cluster_end);
+
++ /* treat the write as new if the a hole/lseek spanned across
++ * the page boundary.
++ */
++ new = new | ((i_size_read(inode) <= page_offset(page)) &&
++ (page_offset(page) <= user_pos));
++
+ if (page == wc->w_target_page) {
+ map_from = user_pos & (PAGE_CACHE_SIZE - 1);
+ map_to = map_from + user_len;
+diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
+index 4fdb0eb..ce9a4f2 100644
+--- a/fs/quota/dquot.c
++++ b/fs/quota/dquot.c
+@@ -388,7 +388,7 @@ EXPORT_SYMBOL(dquot_acquire);
+ */
+ int dquot_commit(struct dquot *dquot)
+ {
+- int ret = 0, ret2 = 0;
++ int ret = 0;
+ struct quota_info *dqopt = sb_dqopt(dquot->dq_sb);
+
+ mutex_lock(&dqopt->dqio_mutex);
+@@ -400,15 +400,10 @@ int dquot_commit(struct dquot *dquot)
+ spin_unlock(&dq_list_lock);
+ /* Inactive dquot can be only if there was error during read/init
+ * => we have better not writing it */
+- if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) {
++ if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags))
+ ret = dqopt->ops[dquot->dq_type]->commit_dqblk(dquot);
+- if (info_dirty(&dqopt->info[dquot->dq_type])) {
+- ret2 = dqopt->ops[dquot->dq_type]->write_file_info(
+- dquot->dq_sb, dquot->dq_type);
+- }
+- if (ret >= 0)
+- ret = ret2;
+- }
++ else
++ ret = -EIO;
+ out_sem:
+ mutex_unlock(&dqopt->dqio_mutex);
+ return ret;
+diff --git a/fs/squashfs/dir.c b/fs/squashfs/dir.c
+index 566b0ea..16c1b4a 100644
+--- a/fs/squashfs/dir.c
++++ b/fs/squashfs/dir.c
+@@ -173,6 +173,11 @@ static int squashfs_readdir(struct file *file, void *dirent, filldir_t filldir)
+ length += sizeof(dirh);
+
+ dir_count = le32_to_cpu(dirh.count) + 1;
++
++ /* dir_count should never be larger than 256 */
++ if (dir_count > 256)
++ goto failed_read;
++
+ while (dir_count--) {
+ /*
+ * Read directory entry.
+@@ -184,6 +189,10 @@ static int squashfs_readdir(struct file *file, void *dirent, filldir_t filldir)
+
+ size = le16_to_cpu(dire->size) + 1;
+
++ /* size should never be larger than SQUASHFS_NAME_LEN */
++ if (size > SQUASHFS_NAME_LEN)
++ goto failed_read;
++
+ err = squashfs_read_metadata(inode->i_sb, dire->name,
+ &block, &offset, size);
+ if (err < 0)
+diff --git a/fs/squashfs/namei.c b/fs/squashfs/namei.c
+index 9e39865..ac52751 100644
+--- a/fs/squashfs/namei.c
++++ b/fs/squashfs/namei.c
+@@ -175,6 +175,11 @@ static struct dentry *squashfs_lookup(struct inode *dir, struct dentry *dentry,
+ length += sizeof(dirh);
+
+ dir_count = le32_to_cpu(dirh.count) + 1;
++
++ /* dir_count should never be larger than 256 */
++ if (dir_count > 256)
++ goto data_error;
++
+ while (dir_count--) {
+ /*
+ * Read directory entry.
+@@ -186,6 +191,10 @@ static struct dentry *squashfs_lookup(struct inode *dir, struct dentry *dentry,
+
+ size = le16_to_cpu(dire->size) + 1;
+
++ /* size should never be larger than SQUASHFS_NAME_LEN */
++ if (size > SQUASHFS_NAME_LEN)
++ goto data_error;
++
+ err = squashfs_read_metadata(dir->i_sb, dire->name,
+ &block, &offset, size);
+ if (err < 0)
+@@ -227,6 +236,9 @@ exit_lookup:
+ d_add(dentry, inode);
+ return ERR_PTR(0);
+
++data_error:
++ err = -EIO;
++
+ read_failure:
+ ERROR("Unable to read directory block [%llx:%x]\n",
+ squashfs_i(dir)->start + msblk->directory_table,
+diff --git a/fs/ubifs/commit.c b/fs/ubifs/commit.c
+index 4775af4..0d948f1 100644
+--- a/fs/ubifs/commit.c
++++ b/fs/ubifs/commit.c
+@@ -518,7 +518,7 @@ int dbg_check_old_index(struct ubifs_info *c, struct ubifs_zbranch *zroot)
+ size_t sz;
+
+ if (!(ubifs_chk_flags & UBIFS_CHK_OLD_IDX))
+- goto out;
++ return 0;
+
+ INIT_LIST_HEAD(&list);
+
+diff --git a/fs/ubifs/debug.c b/fs/ubifs/debug.c
+index dbc093a..ace4d8d 100644
+--- a/fs/ubifs/debug.c
++++ b/fs/ubifs/debug.c
+@@ -965,11 +965,39 @@ void dbg_dump_index(struct ubifs_info *c)
+ void dbg_save_space_info(struct ubifs_info *c)
+ {
+ struct ubifs_debug_info *d = c->dbg;
+-
+- ubifs_get_lp_stats(c, &d->saved_lst);
++ int freeable_cnt;
+
+ spin_lock(&c->space_lock);
++ memcpy(&d->saved_lst, &c->lst, sizeof(struct ubifs_lp_stats));
++
++ /*
++ * We use a dirty hack here and zero out @c->freeable_cnt, because it
++ * affects the free space calculations, and UBIFS might not know about
++ * all freeable eraseblocks. Indeed, we know about freeable eraseblocks
++ * only when we read their lprops, and we do this only lazily, upon the
++ * need. So at any given point of time @c->freeable_cnt might be not
++ * exactly accurate.
++ *
++ * Just one example about the issue we hit when we did not zero
++ * @c->freeable_cnt.
++ * 1. The file-system is mounted R/O, c->freeable_cnt is %0. We save the
++ * amount of free space in @d->saved_free
++ * 2. We re-mount R/W, which makes UBIFS to read the "lsave"
++ * information from flash, where we cache LEBs from various
++ * categories ('ubifs_remount_fs()' -> 'ubifs_lpt_init()'
++ * -> 'lpt_init_wr()' -> 'read_lsave()' -> 'ubifs_lpt_lookup()'
++ * -> 'ubifs_get_pnode()' -> 'update_cats()'
++ * -> 'ubifs_add_to_cat()').
++ * 3. Lsave contains a freeable eraseblock, and @c->freeable_cnt
++ * becomes %1.
++ * 4. We calculate the amount of free space when the re-mount is
++ * finished in 'dbg_check_space_info()' and it does not match
++ * @d->saved_free.
++ */
++ freeable_cnt = c->freeable_cnt;
++ c->freeable_cnt = 0;
+ d->saved_free = ubifs_get_free_space_nolock(c);
++ c->freeable_cnt = freeable_cnt;
+ spin_unlock(&c->space_lock);
+ }
+
+@@ -986,12 +1014,15 @@ int dbg_check_space_info(struct ubifs_info *c)
+ {
+ struct ubifs_debug_info *d = c->dbg;
+ struct ubifs_lp_stats lst;
+- long long avail, free;
++ long long free;
++ int freeable_cnt;
+
+ spin_lock(&c->space_lock);
+- avail = ubifs_calc_available(c, c->min_idx_lebs);
++ freeable_cnt = c->freeable_cnt;
++ c->freeable_cnt = 0;
++ free = ubifs_get_free_space_nolock(c);
++ c->freeable_cnt = freeable_cnt;
+ spin_unlock(&c->space_lock);
+- free = ubifs_get_free_space(c);
+
+ if (free != d->saved_free) {
+ ubifs_err("free space changed from %lld to %lld",
+diff --git a/fs/ubifs/lpt.c b/fs/ubifs/lpt.c
+index b2792e8..d0dfe7a 100644
+--- a/fs/ubifs/lpt.c
++++ b/fs/ubifs/lpt.c
+@@ -1269,10 +1269,9 @@ static int read_pnode(struct ubifs_info *c, struct ubifs_nnode *parent, int iip)
+ lnum = branch->lnum;
+ offs = branch->offs;
+ pnode = kzalloc(sizeof(struct ubifs_pnode), GFP_NOFS);
+- if (!pnode) {
+- err = -ENOMEM;
+- goto out;
+- }
++ if (!pnode)
++ return -ENOMEM;
++
+ if (lnum == 0) {
+ /*
+ * This pnode was not written which just means that the LEB
+diff --git a/fs/xfs/linux-2.6/xfs_ioctl.c b/fs/xfs/linux-2.6/xfs_ioctl.c
+index 61496c6..942362f 100644
+--- a/fs/xfs/linux-2.6/xfs_ioctl.c
++++ b/fs/xfs/linux-2.6/xfs_ioctl.c
+@@ -697,14 +697,19 @@ xfs_ioc_fsgeometry_v1(
+ xfs_mount_t *mp,
+ void __user *arg)
+ {
+- xfs_fsop_geom_v1_t fsgeo;
++ xfs_fsop_geom_t fsgeo;
+ int error;
+
+- error = xfs_fs_geometry(mp, (xfs_fsop_geom_t *)&fsgeo, 3);
++ error = xfs_fs_geometry(mp, &fsgeo, 3);
+ if (error)
+ return -error;
+
+- if (copy_to_user(arg, &fsgeo, sizeof(fsgeo)))
++ /*
++ * Caller should have passed an argument of type
++ * xfs_fsop_geom_v1_t. This is a proper subset of the
++ * xfs_fsop_geom_t that xfs_fs_geometry() fills in.
++ */
++ if (copy_to_user(arg, &fsgeo, sizeof(xfs_fsop_geom_v1_t)))
+ return -XFS_ERROR(EFAULT);
+ return 0;
+ }
+diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c
+index 6f83f58..785b2a2 100644
+--- a/fs/xfs/xfs_fsops.c
++++ b/fs/xfs/xfs_fsops.c
+@@ -56,6 +56,9 @@ xfs_fs_geometry(
+ xfs_fsop_geom_t *geo,
+ int new_version)
+ {
++
++ memset(geo, 0, sizeof(*geo));
++
+ geo->blocksize = mp->m_sb.sb_blocksize;
+ geo->rtextsize = mp->m_sb.sb_rextsize;
+ geo->agblocks = mp->m_sb.sb_agblocks;
+diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
+index 340f441..a3d802e 100644
+--- a/include/linux/binfmts.h
++++ b/include/linux/binfmts.h
+@@ -29,6 +29,7 @@ struct linux_binprm{
+ char buf[BINPRM_BUF_SIZE];
+ #ifdef CONFIG_MMU
+ struct vm_area_struct *vma;
++ unsigned long vma_pages;
+ #else
+ # define MAX_ARG_PAGES 32
+ struct page *page[MAX_ARG_PAGES];
+@@ -59,6 +60,10 @@ struct linux_binprm{
+ unsigned long loader, exec;
+ };
+
++extern void acct_arg_size(struct linux_binprm *bprm, unsigned long pages);
++extern struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
++ int write);
++
+ #define BINPRM_FLAGS_ENFORCE_NONDUMP_BIT 0
+ #define BINPRM_FLAGS_ENFORCE_NONDUMP (1 << BINPRM_FLAGS_ENFORCE_NONDUMP_BIT)
+
+diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
+index f097ae3..de8e180 100644
+--- a/include/scsi/scsi_device.h
++++ b/include/scsi/scsi_device.h
+@@ -446,7 +446,7 @@ static inline int scsi_device_qas(struct scsi_device *sdev)
+ }
+ static inline int scsi_device_enclosure(struct scsi_device *sdev)
+ {
+- return sdev->inquiry[6] & (1<<6);
++ return sdev->inquiry ? (sdev->inquiry[6] & (1<<6)) : 1;
+ }
+
+ static inline int scsi_device_protection(struct scsi_device *sdev)
+diff --git a/include/sound/soc-dapm.h b/include/sound/soc-dapm.h
+index c1410e3..511b623 100644
+--- a/include/sound/soc-dapm.h
++++ b/include/sound/soc-dapm.h
+@@ -46,25 +46,25 @@
+ /* platform domain */
+ #define SND_SOC_DAPM_INPUT(wname) \
+ { .id = snd_soc_dapm_input, .name = wname, .kcontrols = NULL, \
+- .num_kcontrols = 0}
++ .num_kcontrols = 0, .reg = SND_SOC_NOPM }
+ #define SND_SOC_DAPM_OUTPUT(wname) \
+ { .id = snd_soc_dapm_output, .name = wname, .kcontrols = NULL, \
+- .num_kcontrols = 0}
++ .num_kcontrols = 0, .reg = SND_SOC_NOPM }
+ #define SND_SOC_DAPM_MIC(wname, wevent) \
+ { .id = snd_soc_dapm_mic, .name = wname, .kcontrols = NULL, \
+- .num_kcontrols = 0, .event = wevent, \
++ .num_kcontrols = 0, .reg = SND_SOC_NOPM, .event = wevent, \
+ .event_flags = SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD}
+ #define SND_SOC_DAPM_HP(wname, wevent) \
+ { .id = snd_soc_dapm_hp, .name = wname, .kcontrols = NULL, \
+- .num_kcontrols = 0, .event = wevent, \
++ .num_kcontrols = 0, .reg = SND_SOC_NOPM, .event = wevent, \
+ .event_flags = SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD}
+ #define SND_SOC_DAPM_SPK(wname, wevent) \
+ { .id = snd_soc_dapm_spk, .name = wname, .kcontrols = NULL, \
+- .num_kcontrols = 0, .event = wevent, \
++ .num_kcontrols = 0, .reg = SND_SOC_NOPM, .event = wevent, \
+ .event_flags = SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD}
+ #define SND_SOC_DAPM_LINE(wname, wevent) \
+ { .id = snd_soc_dapm_line, .name = wname, .kcontrols = NULL, \
+- .num_kcontrols = 0, .event = wevent, \
++ .num_kcontrols = 0, .reg = SND_SOC_NOPM, .event = wevent, \
+ .event_flags = SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD}
+
+ /* path domain */
+@@ -129,11 +129,11 @@
+ /* events that are pre and post DAPM */
+ #define SND_SOC_DAPM_PRE(wname, wevent) \
+ { .id = snd_soc_dapm_pre, .name = wname, .kcontrols = NULL, \
+- .num_kcontrols = 0, .event = wevent, \
++ .num_kcontrols = 0, .reg = SND_SOC_NOPM, .event = wevent, \
+ .event_flags = SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_PRE_PMD}
+ #define SND_SOC_DAPM_POST(wname, wevent) \
+ { .id = snd_soc_dapm_post, .name = wname, .kcontrols = NULL, \
+- .num_kcontrols = 0, .event = wevent, \
++ .num_kcontrols = 0, .reg = SND_SOC_NOPM, .event = wevent, \
+ .event_flags = SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD}
+
+ /* stream domain */
+diff --git a/kernel/kgdb.c b/kernel/kgdb.c
+index 9147a31..53dae4b 100644
+--- a/kernel/kgdb.c
++++ b/kernel/kgdb.c
+@@ -1001,10 +1001,8 @@ static void gdb_cmd_query(struct kgdb_state *ks)
+ switch (remcom_in_buffer[1]) {
+ case 's':
+ case 'f':
+- if (memcmp(remcom_in_buffer + 2, "ThreadInfo", 10)) {
+- error_packet(remcom_out_buffer, -EINVAL);
++ if (memcmp(remcom_in_buffer + 2, "ThreadInfo", 10))
+ break;
+- }
+
+ i = 0;
+ remcom_out_buffer[0] = 'm';
+@@ -1045,10 +1043,9 @@ static void gdb_cmd_query(struct kgdb_state *ks)
+ pack_threadid(remcom_out_buffer + 2, thref);
+ break;
+ case 'T':
+- if (memcmp(remcom_in_buffer + 1, "ThreadExtraInfo,", 16)) {
+- error_packet(remcom_out_buffer, -EINVAL);
++ if (memcmp(remcom_in_buffer + 1, "ThreadExtraInfo,", 16))
+ break;
+- }
++
+ ks->threadid = 0;
+ ptr = remcom_in_buffer + 17;
+ kgdb_hex2long(&ptr, &ks->threadid);
+diff --git a/kernel/perf_event.c b/kernel/perf_event.c
+index 183d437..fc5ab8e 100644
+--- a/kernel/perf_event.c
++++ b/kernel/perf_event.c
+@@ -69,7 +69,8 @@ static inline bool perf_paranoid_kernel(void)
+ return sysctl_perf_event_paranoid > 1;
+ }
+
+-int sysctl_perf_event_mlock __read_mostly = 512; /* 'free' kb per user */
++/* Minimum for 128 pages + 1 for the user control page */
++int sysctl_perf_event_mlock __read_mostly = 516; /* 'free' kb per user */
+
+ /*
+ * max perf event sample rate
+diff --git a/kernel/signal.c b/kernel/signal.c
+index e26d423..2494827 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -2353,7 +2353,7 @@ SYSCALL_DEFINE3(rt_sigqueueinfo, pid_t, pid, int, sig,
+ /* Not even root can pretend to send signals from the kernel.
+ * Nor can they impersonate a kill()/tgkill(), which adds source info.
+ */
+- if (info.si_code != SI_QUEUE) {
++ if (info.si_code >= 0 || info.si_code == SI_TKILL) {
+ /* We used to allow any < 0 si_code */
+ WARN_ON_ONCE(info.si_code < 0);
+ return -EPERM;
+@@ -2373,7 +2373,7 @@ long do_rt_tgsigqueueinfo(pid_t tgid, pid_t pid, int sig, siginfo_t *info)
+ /* Not even root can pretend to send signals from the kernel.
+ * Nor can they impersonate a kill()/tgkill(), which adds source info.
+ */
+- if (info->si_code != SI_QUEUE) {
++ if (info->si_code >= 0 || info->si_code == SI_TKILL) {
+ /* We used to allow any < 0 si_code */
+ WARN_ON_ONCE(info->si_code < 0);
+ return -EPERM;
+diff --git a/mm/mremap.c b/mm/mremap.c
+index 166b824..3e98d79 100644
+--- a/mm/mremap.c
++++ b/mm/mremap.c
+@@ -275,9 +275,16 @@ static struct vm_area_struct *vma_to_resize(unsigned long addr,
+ if (old_len > vma->vm_end - addr)
+ goto Efault;
+
+- if (vma->vm_flags & (VM_DONTEXPAND | VM_PFNMAP)) {
+- if (new_len > old_len)
++ /* Need to be careful about a growing mapping */
++ if (new_len > old_len) {
++ unsigned long pgoff;
++
++ if (vma->vm_flags & (VM_DONTEXPAND | VM_PFNMAP))
+ goto Efault;
++ pgoff = (addr - vma->vm_start) >> PAGE_SHIFT;
++ pgoff += vma->vm_pgoff;
++ if (pgoff + (new_len >> PAGE_SHIFT) < pgoff)
++ goto Einval;
+ }
+
+ if (vma->vm_flags & VM_LOCKED) {
+diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
+index f454607..608a97b 100644
+--- a/net/ax25/af_ax25.c
++++ b/net/ax25/af_ax25.c
+@@ -1391,6 +1391,7 @@ static int ax25_getname(struct socket *sock, struct sockaddr *uaddr,
+ ax25_cb *ax25;
+ int err = 0;
+
++ memset(fsa, 0, sizeof(fsa));
+ lock_sock(sk);
+ ax25 = ax25_sk(sk);
+
+@@ -1402,7 +1403,6 @@ static int ax25_getname(struct socket *sock, struct sockaddr *uaddr,
+
+ fsa->fsa_ax25.sax25_family = AF_AX25;
+ fsa->fsa_ax25.sax25_call = ax25->dest_addr;
+- fsa->fsa_ax25.sax25_ndigis = 0;
+
+ if (ax25->digipeat != NULL) {
+ ndigi = ax25->digipeat->ndigi;
+diff --git a/net/bluetooth/bnep/sock.c b/net/bluetooth/bnep/sock.c
+index e857628..efc85dc 100644
+--- a/net/bluetooth/bnep/sock.c
++++ b/net/bluetooth/bnep/sock.c
+@@ -88,6 +88,7 @@ static int bnep_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long
+ sockfd_put(nsock);
+ return -EBADFD;
+ }
++ ca.device[sizeof(ca.device)-1] = 0;
+
+ err = bnep_add_connection(&ca, nsock);
+ if (!err) {
+diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
+index 5c0685e..e52443c 100644
+--- a/net/bluetooth/sco.c
++++ b/net/bluetooth/sco.c
+@@ -700,6 +700,7 @@ static int sco_sock_getsockopt_old(struct socket *sock, int optname, char __user
+ break;
+ }
+
++ memset(&cinfo, 0, sizeof(cinfo));
+ cinfo.hci_handle = sco_pi(sk)->conn->hcon->handle;
+ memcpy(cinfo.dev_class, sco_pi(sk)->conn->hcon->dev_class, 3);
+
+diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
+index 0b7f262..d73d47f 100644
+--- a/net/bridge/netfilter/ebtables.c
++++ b/net/bridge/netfilter/ebtables.c
+@@ -979,6 +979,8 @@ static int do_replace(struct net *net, void __user *user, unsigned int len)
+ if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
+ return -ENOMEM;
+
++ tmp.name[sizeof(tmp.name) - 1] = 0;
++
+ countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
+ newinfo = vmalloc(sizeof(*newinfo) + countersize);
+ if (!newinfo)
+diff --git a/net/can/bcm.c b/net/can/bcm.c
+index 4a192f7..029dcc2 100644
+--- a/net/can/bcm.c
++++ b/net/can/bcm.c
+@@ -124,7 +124,7 @@ struct bcm_sock {
+ struct list_head tx_ops;
+ unsigned long dropped_usr_msgs;
+ struct proc_dir_entry *bcm_proc_read;
+- char procname [20]; /* pointer printed in ASCII with \0 */
++ char procname [32]; /* inode number in decimal with \0 */
+ };
+
+ static inline struct bcm_sock *bcm_sk(const struct sock *sk)
+@@ -1519,7 +1519,7 @@ static int bcm_connect(struct socket *sock, struct sockaddr *uaddr, int len,
+
+ if (proc_dir) {
+ /* unique socket address as filename */
+- sprintf(bo->procname, "%p", sock);
++ sprintf(bo->procname, "%lu", sock_i_ino(sk));
+ bo->bcm_proc_read = proc_create_data(bo->procname, 0644,
+ proc_dir,
+ &bcm_proc_fops, sk);
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 49e3782..64eb849 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -2614,6 +2614,8 @@ void napi_reuse_skb(struct napi_struct *napi, struct sk_buff *skb)
+ {
+ __skb_pull(skb, skb_headlen(skb));
+ skb_reserve(skb, NET_IP_ALIGN - skb_headroom(skb));
++ skb->dev = napi->dev;
++ skb->iif = 0;
+
+ napi->skb = skb;
+ }
+diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c
+index 85672e7..2a3b4e7 100644
+--- a/net/econet/af_econet.c
++++ b/net/econet/af_econet.c
+@@ -428,10 +428,10 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
+ udpdest.sin_addr.s_addr = htonl(network | addr.station);
+ }
+
++ memset(&ah, 0, sizeof(ah));
+ ah.port = port;
+ ah.cb = cb & 0x7f;
+ ah.code = 2; /* magic */
+- ah.pad = 0;
+
+ /* tack our header on the front of the iovec */
+ size = sizeof(struct aunhdr);
+@@ -843,9 +843,13 @@ static void aun_incoming(struct sk_buff *skb, struct aunhdr *ah, size_t len)
+ {
+ struct iphdr *ip = ip_hdr(skb);
+ unsigned char stn = ntohl(ip->saddr) & 0xff;
++ struct dst_entry *dst = skb_dst(skb);
++ struct ec_device *edev = NULL;
+ struct sock *sk;
+ struct sk_buff *newskb;
+- struct ec_device *edev = skb->dev->ec_ptr;
++
++ if (dst)
++ edev = dst->dev->ec_ptr;
+
+ if (! edev)
+ goto bad;
+diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
+index a706a47..6fe360f 100644
+--- a/net/ipv4/inet_diag.c
++++ b/net/ipv4/inet_diag.c
+@@ -489,9 +489,11 @@ static int inet_csk_diag_dump(struct sock *sk,
+ {
+ struct inet_diag_req *r = NLMSG_DATA(cb->nlh);
+
+- if (cb->nlh->nlmsg_len > 4 + NLMSG_SPACE(sizeof(*r))) {
++ if (nlmsg_attrlen(cb->nlh, sizeof(*r))) {
+ struct inet_diag_entry entry;
+- struct rtattr *bc = (struct rtattr *)(r + 1);
++ const struct nlattr *bc = nlmsg_find_attr(cb->nlh,
++ sizeof(*r),
++ INET_DIAG_REQ_BYTECODE);
+ struct inet_sock *inet = inet_sk(sk);
+
+ entry.family = sk->sk_family;
+@@ -511,7 +513,7 @@ static int inet_csk_diag_dump(struct sock *sk,
+ entry.dport = ntohs(inet->dport);
+ entry.userlocks = sk->sk_userlocks;
+
+- if (!inet_diag_bc_run(RTA_DATA(bc), RTA_PAYLOAD(bc), &entry))
++ if (!inet_diag_bc_run(nla_data(bc), nla_len(bc), &entry))
+ return 0;
+ }
+
+@@ -526,9 +528,11 @@ static int inet_twsk_diag_dump(struct inet_timewait_sock *tw,
+ {
+ struct inet_diag_req *r = NLMSG_DATA(cb->nlh);
+
+- if (cb->nlh->nlmsg_len > 4 + NLMSG_SPACE(sizeof(*r))) {
++ if (nlmsg_attrlen(cb->nlh, sizeof(*r))) {
+ struct inet_diag_entry entry;
+- struct rtattr *bc = (struct rtattr *)(r + 1);
++ const struct nlattr *bc = nlmsg_find_attr(cb->nlh,
++ sizeof(*r),
++ INET_DIAG_REQ_BYTECODE);
+
+ entry.family = tw->tw_family;
+ #if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
+@@ -547,7 +551,7 @@ static int inet_twsk_diag_dump(struct inet_timewait_sock *tw,
+ entry.dport = ntohs(tw->tw_dport);
+ entry.userlocks = 0;
+
+- if (!inet_diag_bc_run(RTA_DATA(bc), RTA_PAYLOAD(bc), &entry))
++ if (!inet_diag_bc_run(nla_data(bc), nla_len(bc), &entry))
+ return 0;
+ }
+
+@@ -617,7 +621,7 @@ static int inet_diag_dump_reqs(struct sk_buff *skb, struct sock *sk,
+ struct inet_diag_req *r = NLMSG_DATA(cb->nlh);
+ struct inet_connection_sock *icsk = inet_csk(sk);
+ struct listen_sock *lopt;
+- struct rtattr *bc = NULL;
++ const struct nlattr *bc = NULL;
+ struct inet_sock *inet = inet_sk(sk);
+ int j, s_j;
+ int reqnum, s_reqnum;
+@@ -637,8 +641,9 @@ static int inet_diag_dump_reqs(struct sk_buff *skb, struct sock *sk,
+ if (!lopt || !lopt->qlen)
+ goto out;
+
+- if (cb->nlh->nlmsg_len > 4 + NLMSG_SPACE(sizeof(*r))) {
+- bc = (struct rtattr *)(r + 1);
++ if (nlmsg_attrlen(cb->nlh, sizeof(*r))) {
++ bc = nlmsg_find_attr(cb->nlh, sizeof(*r),
++ INET_DIAG_REQ_BYTECODE);
+ entry.sport = inet->num;
+ entry.userlocks = sk->sk_userlocks;
+ }
+@@ -671,8 +676,8 @@ static int inet_diag_dump_reqs(struct sk_buff *skb, struct sock *sk,
+ &ireq->rmt_addr;
+ entry.dport = ntohs(ireq->rmt_port);
+
+- if (!inet_diag_bc_run(RTA_DATA(bc),
+- RTA_PAYLOAD(bc), &entry))
++ if (!inet_diag_bc_run(nla_data(bc),
++ nla_len(bc), &entry))
+ continue;
+ }
+
+diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
+index 98442f3..c8b0cc3 100644
+--- a/net/ipv4/netfilter/arp_tables.c
++++ b/net/ipv4/netfilter/arp_tables.c
+@@ -1086,6 +1086,7 @@ static int do_replace(struct net *net, void __user *user, unsigned int len)
+ /* overflow check */
+ if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
+ return -ENOMEM;
++ tmp.name[sizeof(tmp.name)-1] = 0;
+
+ newinfo = xt_alloc_table_info(tmp.size);
+ if (!newinfo)
+@@ -1508,6 +1509,7 @@ static int compat_do_replace(struct net *net, void __user *user,
+ return -ENOMEM;
+ if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
+ return -ENOMEM;
++ tmp.name[sizeof(tmp.name)-1] = 0;
+
+ newinfo = xt_alloc_table_info(tmp.size);
+ if (!newinfo)
+@@ -1763,6 +1765,7 @@ static int do_arpt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len
+ ret = -EFAULT;
+ break;
+ }
++ rev.name[sizeof(rev.name)-1] = 0;
+
+ try_then_request_module(xt_find_revision(NFPROTO_ARP, rev.name,
+ rev.revision, 1, &ret),
+diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
+index 62aff31..0606db1 100644
+--- a/net/ipv4/netfilter/ip_tables.c
++++ b/net/ipv4/netfilter/ip_tables.c
+@@ -1290,6 +1290,7 @@ do_replace(struct net *net, void __user *user, unsigned int len)
+ /* overflow check */
+ if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
+ return -ENOMEM;
++ tmp.name[sizeof(tmp.name)-1] = 0;
+
+ newinfo = xt_alloc_table_info(tmp.size);
+ if (!newinfo)
+@@ -1820,6 +1821,7 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len)
+ return -ENOMEM;
+ if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
+ return -ENOMEM;
++ tmp.name[sizeof(tmp.name)-1] = 0;
+
+ newinfo = xt_alloc_table_info(tmp.size);
+ if (!newinfo)
+@@ -2044,6 +2046,7 @@ do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
+ ret = -EFAULT;
+ break;
+ }
++ rev.name[sizeof(rev.name)-1] = 0;
+
+ if (cmd == IPT_SO_GET_REVISION_TARGET)
+ target = 1;
+diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
+index 2e4f98b..edd8205 100644
+--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
++++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
+@@ -666,8 +666,11 @@ static ssize_t clusterip_proc_write(struct file *file, const char __user *input,
+ struct clusterip_config *c = pde->data;
+ unsigned long nodenum;
+
+- if (copy_from_user(buffer, input, PROC_WRITELEN))
++ if (size > PROC_WRITELEN)
++ return -EIO;
++ if (copy_from_user(buffer, input, size))
+ return -EFAULT;
++ buffer[size] = 0;
+
+ if (*buffer == '+') {
+ nodenum = simple_strtoul(buffer+1, NULL, 10);
+diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
+index 1de56fdf..78b5a36 100644
+--- a/net/ipv6/netfilter/ip6_tables.c
++++ b/net/ipv6/netfilter/ip6_tables.c
+@@ -1323,6 +1323,7 @@ do_replace(struct net *net, void __user *user, unsigned int len)
+ /* overflow check */
+ if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
+ return -ENOMEM;
++ tmp.name[sizeof(tmp.name)-1] = 0;
+
+ newinfo = xt_alloc_table_info(tmp.size);
+ if (!newinfo)
+@@ -1855,6 +1856,7 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len)
+ return -ENOMEM;
+ if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
+ return -ENOMEM;
++ tmp.name[sizeof(tmp.name)-1] = 0;
+
+ newinfo = xt_alloc_table_info(tmp.size);
+ if (!newinfo)
+@@ -2079,6 +2081,7 @@ do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
+ ret = -EFAULT;
+ break;
+ }
++ rev.name[sizeof(rev.name)-1] = 0;
+
+ if (cmd == IP6T_SO_GET_REVISION_TARGET)
+ target = 1;
+diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
+index b6cef980..476b24e 100644
+--- a/net/irda/af_irda.c
++++ b/net/irda/af_irda.c
+@@ -2164,6 +2164,14 @@ static int irda_getsockopt(struct socket *sock, int level, int optname,
+
+ switch (optname) {
+ case IRLMP_ENUMDEVICES:
++
++ /* Offset to first device entry */
++ offset = sizeof(struct irda_device_list) -
++ sizeof(struct irda_device_info);
++
++ if (len < offset)
++ return -EINVAL;
++
+ /* Ask lmp for the current discovery log */
+ discoveries = irlmp_get_discoveries(&list.len, self->mask.word,
+ self->nslots);
+@@ -2173,15 +2181,9 @@ static int irda_getsockopt(struct socket *sock, int level, int optname,
+ err = 0;
+
+ /* Write total list length back to client */
+- if (copy_to_user(optval, &list,
+- sizeof(struct irda_device_list) -
+- sizeof(struct irda_device_info)))
++ if (copy_to_user(optval, &list, offset))
+ err = -EFAULT;
+
+- /* Offset to first device entry */
+- offset = sizeof(struct irda_device_list) -
+- sizeof(struct irda_device_info);
+-
+ /* Copy the list itself - watch for overflow */
+ if(list.len > 2048)
+ {
+diff --git a/net/irda/iriap.c b/net/irda/iriap.c
+index f7d6150..35a338b 100644
+--- a/net/irda/iriap.c
++++ b/net/irda/iriap.c
+@@ -655,10 +655,16 @@ static void iriap_getvaluebyclass_indication(struct iriap_cb *self,
+ n = 1;
+
+ name_len = fp[n++];
++
++ IRDA_ASSERT(name_len < IAS_MAX_CLASSNAME + 1, return;);
++
+ memcpy(name, fp+n, name_len); n+=name_len;
+ name[name_len] = '\0';
+
+ attr_len = fp[n++];
++
++ IRDA_ASSERT(attr_len < IAS_MAX_ATTRIBNAME + 1, return;);
++
+ memcpy(attr, fp+n, attr_len); n+=attr_len;
+ attr[attr_len] = '\0';
+
+diff --git a/net/irda/irnet/irnet_ppp.c b/net/irda/irnet/irnet_ppp.c
+index 7dea882..38997cd 100644
+--- a/net/irda/irnet/irnet_ppp.c
++++ b/net/irda/irnet/irnet_ppp.c
+@@ -106,6 +106,9 @@ irnet_ctrl_write(irnet_socket * ap,
+ while(isspace(start[length - 1]))
+ length--;
+
++ DABORT(length < 5 || length > NICKNAME_MAX_LEN + 5,
++ -EINVAL, CTRL_ERROR, "Invalid nickname.\n");
++
+ /* Copy the name for later reuse */
+ memcpy(ap->rname, start + 5, length - 5);
+ ap->rname[length - 5] = '\0';
+diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
+index 594f231..7de0c24 100644
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -276,6 +276,7 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
+ memcpy(sta->sta.addr, addr, ETH_ALEN);
+ sta->local = local;
+ sta->sdata = sdata;
++ sta->last_rx = jiffies;
+
+ sta->rate_ctrl = rate_control_get(local->rate_ctrl);
+ sta->rate_ctrl_priv = rate_control_alloc_sta(sta->rate_ctrl,
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 41866eb..9d9b78e 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -1526,7 +1526,7 @@ static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr,
+ uaddr->sa_family = AF_PACKET;
+ dev = dev_get_by_index(sock_net(sk), pkt_sk(sk)->ifindex);
+ if (dev) {
+- strlcpy(uaddr->sa_data, dev->name, 15);
++ strncpy(uaddr->sa_data, dev->name, 14);
+ dev_put(dev);
+ } else
+ memset(uaddr->sa_data, 0, 14);
+@@ -1549,6 +1549,7 @@ static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
+ sll->sll_family = AF_PACKET;
+ sll->sll_ifindex = po->ifindex;
+ sll->sll_protocol = po->num;
++ sll->sll_pkttype = 0;
+ dev = dev_get_by_index(sock_net(sk), po->ifindex);
+ if (dev) {
+ sll->sll_hatype = dev->type;
+diff --git a/net/rds/rdma.c b/net/rds/rdma.c
+index 6b09b94..f7d8c08 100644
+--- a/net/rds/rdma.c
++++ b/net/rds/rdma.c
+@@ -473,6 +473,14 @@ static struct rds_rdma_op *rds_rdma_prepare(struct rds_sock *rs,
+
+ max_pages = max(nr, max_pages);
+ nr_pages += nr;
++
++ /*
++ * nr_pages for one entry is limited to (UINT_MAX>>PAGE_SHIFT)+1,
++ * so tot_pages cannot overflow without first going negative.
++ */
++ if ((int)nr_pages < 0)
++ ret = -EINVAL;
++ goto out;
+ }
+
+ pages = kcalloc(max_pages, sizeof(struct page *), GFP_KERNEL);
+diff --git a/net/rose/rose_subr.c b/net/rose/rose_subr.c
+index b05108f..07bca7d 100644
+--- a/net/rose/rose_subr.c
++++ b/net/rose/rose_subr.c
+@@ -289,10 +289,15 @@ static int rose_parse_national(unsigned char *p, struct rose_facilities_struct *
+ facilities->source_ndigis = 0;
+ facilities->dest_ndigis = 0;
+ for (pt = p + 2, lg = 0 ; lg < l ; pt += AX25_ADDR_LEN, lg += AX25_ADDR_LEN) {
+- if (pt[6] & AX25_HBIT)
++ if (pt[6] & AX25_HBIT) {
++ if (facilities->dest_ndigis >= ROSE_MAX_DIGIS)
++ return -1;
+ memcpy(&facilities->dest_digis[facilities->dest_ndigis++], pt, AX25_ADDR_LEN);
+- else
++ } else {
++ if (facilities->source_ndigis >= ROSE_MAX_DIGIS)
++ return -1;
+ memcpy(&facilities->source_digis[facilities->source_ndigis++], pt, AX25_ADDR_LEN);
++ }
+ }
+ }
+ p += l + 2;
+@@ -332,6 +337,11 @@ static int rose_parse_ccitt(unsigned char *p, struct rose_facilities_struct *fac
+
+ case 0xC0:
+ l = p[1];
++
++ /* Prevent overflows*/
++ if (l < 10 || l > 20)
++ return -1;
++
+ if (*p == FAC_CCITT_DEST_NSAP) {
+ memcpy(&facilities->source_addr, p + 7, ROSE_ADDR_LEN);
+ memcpy(callsign, p + 12, l - 10);
+@@ -372,12 +382,16 @@ int rose_parse_facilities(unsigned char *p,
+ switch (*p) {
+ case FAC_NATIONAL: /* National */
+ len = rose_parse_national(p + 1, facilities, facilities_len - 1);
++ if (len < 0)
++ return 0;
+ facilities_len -= len + 1;
+ p += len + 1;
+ break;
+
+ case FAC_CCITT: /* CCITT */
+ len = rose_parse_ccitt(p + 1, facilities, facilities_len - 1);
++ if (len < 0)
++ return 0;
+ facilities_len -= len + 1;
+ p += len + 1;
+ break;
+diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
+index c4cf362..feedee7 100644
+--- a/net/sctp/sm_make_chunk.c
++++ b/net/sctp/sm_make_chunk.c
+@@ -230,7 +230,8 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
+ sp = sctp_sk(asoc->base.sk);
+ num_types = sp->pf->supported_addrs(sp, types);
+
+- chunksize = sizeof(init) + addrs_len + SCTP_SAT_LEN(num_types);
++ chunksize = sizeof(init) + addrs_len;
++ chunksize += WORD_ROUND(SCTP_SAT_LEN(num_types));
+ chunksize += sizeof(ecap_param);
+
+ if (sctp_prsctp_enable)
+@@ -260,14 +261,14 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
+ /* Add HMACS parameter length if any were defined */
+ auth_hmacs = (sctp_paramhdr_t *)asoc->c.auth_hmacs;
+ if (auth_hmacs->length)
+- chunksize += ntohs(auth_hmacs->length);
++ chunksize += WORD_ROUND(ntohs(auth_hmacs->length));
+ else
+ auth_hmacs = NULL;
+
+ /* Add CHUNKS parameter length */
+ auth_chunks = (sctp_paramhdr_t *)asoc->c.auth_chunks;
+ if (auth_chunks->length)
+- chunksize += ntohs(auth_chunks->length);
++ chunksize += WORD_ROUND(ntohs(auth_chunks->length));
+ else
+ auth_chunks = NULL;
+
+@@ -277,7 +278,8 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
+
+ /* If we have any extensions to report, account for that */
+ if (num_ext)
+- chunksize += sizeof(sctp_supported_ext_param_t) + num_ext;
++ chunksize += WORD_ROUND(sizeof(sctp_supported_ext_param_t) +
++ num_ext);
+
+ /* RFC 2960 3.3.2 Initiation (INIT) (1)
+ *
+@@ -419,13 +421,13 @@ struct sctp_chunk *sctp_make_init_ack(const struct sctp_association *asoc,
+
+ auth_hmacs = (sctp_paramhdr_t *)asoc->c.auth_hmacs;
+ if (auth_hmacs->length)
+- chunksize += ntohs(auth_hmacs->length);
++ chunksize += WORD_ROUND(ntohs(auth_hmacs->length));
+ else
+ auth_hmacs = NULL;
+
+ auth_chunks = (sctp_paramhdr_t *)asoc->c.auth_chunks;
+ if (auth_chunks->length)
+- chunksize += ntohs(auth_chunks->length);
++ chunksize += WORD_ROUND(ntohs(auth_chunks->length));
+ else
+ auth_chunks = NULL;
+
+@@ -434,7 +436,8 @@ struct sctp_chunk *sctp_make_init_ack(const struct sctp_association *asoc,
+ }
+
+ if (num_ext)
+- chunksize += sizeof(sctp_supported_ext_param_t) + num_ext;
++ chunksize += WORD_ROUND(sizeof(sctp_supported_ext_param_t) +
++ num_ext);
+
+ /* Now allocate and fill out the chunk. */
+ retval = sctp_make_chunk(asoc, SCTP_CID_INIT_ACK, 0, chunksize);
+diff --git a/net/tipc/socket.c b/net/tipc/socket.c
+index e6d9abf..8ebf4975 100644
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -393,6 +393,7 @@ static int get_name(struct socket *sock, struct sockaddr *uaddr,
+ struct sockaddr_tipc *addr = (struct sockaddr_tipc *)uaddr;
+ struct tipc_sock *tsock = tipc_sk(sock->sk);
+
++ memset(addr, 0, sizeof(*addr));
+ if (peer) {
+ if ((sock->state != SS_CONNECTED) &&
+ ((peer != 2) || (sock->state != SS_DISCONNECTING)))
+diff --git a/sound/core/init.c b/sound/core/init.c
+index ec4a50c..82f350e 100644
+--- a/sound/core/init.c
++++ b/sound/core/init.c
+@@ -848,6 +848,7 @@ int snd_card_file_add(struct snd_card *card, struct file *file)
+ return -ENOMEM;
+ mfile->file = file;
+ mfile->disconnected_f_op = NULL;
++ INIT_LIST_HEAD(&mfile->shutdown_list);
+ spin_lock(&card->files_lock);
+ if (card->shutdown) {
+ spin_unlock(&card->files_lock);
+@@ -883,6 +884,9 @@ int snd_card_file_remove(struct snd_card *card, struct file *file)
+ list_for_each_entry(mfile, &card->files_list, list) {
+ if (mfile->file == file) {
+ list_del(&mfile->list);
++ spin_lock(&shutdown_lock);
++ list_del(&mfile->shutdown_list);
++ spin_unlock(&shutdown_lock);
+ if (mfile->disconnected_f_op)
+ fops_put(mfile->disconnected_f_op);
+ found = mfile;
+diff --git a/sound/oss/dev_table.h b/sound/oss/dev_table.h
+index b7617be..0199a31 100644
+--- a/sound/oss/dev_table.h
++++ b/sound/oss/dev_table.h
+@@ -271,7 +271,7 @@ struct synth_operations
+ void (*reset) (int dev);
+ void (*hw_control) (int dev, unsigned char *event);
+ int (*load_patch) (int dev, int format, const char __user *addr,
+- int offs, int count, int pmgr_flag);
++ int count, int pmgr_flag);
+ void (*aftertouch) (int dev, int voice, int pressure);
+ void (*controller) (int dev, int voice, int ctrl_num, int value);
+ void (*panning) (int dev, int voice, int value);
+diff --git a/sound/oss/midi_synth.c b/sound/oss/midi_synth.c
+index 9e45098..978423e 100644
+--- a/sound/oss/midi_synth.c
++++ b/sound/oss/midi_synth.c
+@@ -476,7 +476,7 @@ EXPORT_SYMBOL(midi_synth_hw_control);
+
+ int
+ midi_synth_load_patch(int dev, int format, const char __user *addr,
+- int offs, int count, int pmgr_flag)
++ int count, int pmgr_flag)
+ {
+ int orig_dev = synth_devs[dev]->midi_dev;
+
+@@ -491,39 +491,37 @@ midi_synth_load_patch(int dev, int format, const char __user *addr,
+ if (!prefix_cmd(orig_dev, 0xf0))
+ return 0;
+
++ /* Invalid patch format */
+ if (format != SYSEX_PATCH)
+- {
+-/* printk("MIDI Error: Invalid patch format (key) 0x%x\n", format);*/
+ return -EINVAL;
+- }
++
++ /* Patch header too short */
+ if (count < hdr_size)
+- {
+-/* printk("MIDI Error: Patch header too short\n");*/
+ return -EINVAL;
+- }
++
+ count -= hdr_size;
+
+ /*
+- * Copy the header from user space but ignore the first bytes which have
+- * been transferred already.
++ * Copy the header from user space
+ */
+
+- if(copy_from_user(&((char *) &sysex)[offs], &(addr)[offs], hdr_size - offs))
++ if (copy_from_user(&sysex, addr, hdr_size))
+ return -EFAULT;
+-
+- if (count < sysex.len)
+- {
+-/* printk(KERN_WARNING "MIDI Warning: Sysex record too short (%d<%d)\n", count, (int) sysex.len);*/
++
++ /* Sysex record too short */
++ if ((unsigned)count < (unsigned)sysex.len)
+ sysex.len = count;
+- }
+- left = sysex.len;
+- src_offs = 0;
++
++ left = sysex.len;
++ src_offs = 0;
+
+ for (i = 0; i < left && !signal_pending(current); i++)
+ {
+ unsigned char data;
+
+- get_user(*(unsigned char *) &data, (unsigned char __user *) &((addr)[hdr_size + i]));
++ if (get_user(data,
++ (unsigned char __user *)(addr + hdr_size + i)))
++ return -EFAULT;
+
+ eox_seen = (i > 0 && data & 0x80); /* End of sysex */
+
+diff --git a/sound/oss/midi_synth.h b/sound/oss/midi_synth.h
+index 6bc9d00..b64ddd6 100644
+--- a/sound/oss/midi_synth.h
++++ b/sound/oss/midi_synth.h
+@@ -8,7 +8,7 @@ int midi_synth_open (int dev, int mode);
+ void midi_synth_close (int dev);
+ void midi_synth_hw_control (int dev, unsigned char *event);
+ int midi_synth_load_patch (int dev, int format, const char __user * addr,
+- int offs, int count, int pmgr_flag);
++ int count, int pmgr_flag);
+ void midi_synth_panning (int dev, int channel, int pressure);
+ void midi_synth_aftertouch (int dev, int channel, int pressure);
+ void midi_synth_controller (int dev, int channel, int ctrl_num, int value);
+diff --git a/sound/oss/opl3.c b/sound/oss/opl3.c
+index 7781c13..4e912dd 100644
+--- a/sound/oss/opl3.c
++++ b/sound/oss/opl3.c
+@@ -819,7 +819,7 @@ static void opl3_hw_control(int dev, unsigned char *event)
+ }
+
+ static int opl3_load_patch(int dev, int format, const char __user *addr,
+- int offs, int count, int pmgr_flag)
++ int count, int pmgr_flag)
+ {
+ struct sbi_instrument ins;
+
+@@ -829,11 +829,7 @@ static int opl3_load_patch(int dev, int format, const char __user *addr,
+ return -EINVAL;
+ }
+
+- /*
+- * What the fuck is going on here? We leave junk in the beginning
+- * of ins and then check the field pretty close to that beginning?
+- */
+- if(copy_from_user(&((char *) &ins)[offs], addr + offs, sizeof(ins) - offs))
++ if (copy_from_user(&ins, addr, sizeof(ins)))
+ return -EFAULT;
+
+ if (ins.channel < 0 || ins.channel >= SBFM_MAXINSTR)
+@@ -848,6 +844,10 @@ static int opl3_load_patch(int dev, int format, const char __user *addr,
+
+ static void opl3_panning(int dev, int voice, int value)
+ {
++
++ if (voice < 0 || voice >= devc->nr_voice)
++ return;
++
+ devc->voc[voice].panning = value;
+ }
+
+@@ -1065,8 +1065,15 @@ static int opl3_alloc_voice(int dev, int chn, int note, struct voice_alloc_info
+
+ static void opl3_setup_voice(int dev, int voice, int chn)
+ {
+- struct channel_info *info =
+- &synth_devs[dev]->chn_info[chn];
++ struct channel_info *info;
++
++ if (voice < 0 || voice >= devc->nr_voice)
++ return;
++
++ if (chn < 0 || chn > 15)
++ return;
++
++ info = &synth_devs[dev]->chn_info[chn];
+
+ opl3_set_instr(dev, voice, info->pgm_num);
+
+diff --git a/sound/oss/sequencer.c b/sound/oss/sequencer.c
+index c798746..5cb171d 100644
+--- a/sound/oss/sequencer.c
++++ b/sound/oss/sequencer.c
+@@ -241,7 +241,7 @@ int sequencer_write(int dev, struct file *file, const char __user *buf, int coun
+ return -ENXIO;
+
+ fmt = (*(short *) &event_rec[0]) & 0xffff;
+- err = synth_devs[dev]->load_patch(dev, fmt, buf, p + 4, c, 0);
++ err = synth_devs[dev]->load_patch(dev, fmt, buf + p, c, 0);
+ if (err < 0)
+ return err;
+
+diff --git a/sound/pci/ens1370.c b/sound/pci/ens1370.c
+index 2b82c5c..fc948a7 100644
+--- a/sound/pci/ens1370.c
++++ b/sound/pci/ens1370.c
+@@ -229,6 +229,7 @@ MODULE_PARM_DESC(lineio, "Line In to Rear Out (0 = auto, 1 = force).");
+ #define ES_REG_1371_CODEC 0x14 /* W/R: Codec Read/Write register address */
+ #define ES_1371_CODEC_RDY (1<<31) /* codec ready */
+ #define ES_1371_CODEC_WIP (1<<30) /* codec register access in progress */
++#define EV_1938_CODEC_MAGIC (1<<26)
+ #define ES_1371_CODEC_PIRD (1<<23) /* codec read/write select register */
+ #define ES_1371_CODEC_WRITE(a,d) ((((a)&0x7f)<<16)|(((d)&0xffff)<<0))
+ #define ES_1371_CODEC_READS(a) ((((a)&0x7f)<<16)|ES_1371_CODEC_PIRD)
+@@ -603,12 +604,18 @@ static void snd_es1370_codec_write(struct snd_ak4531 *ak4531,
+
+ #ifdef CHIP1371
+
++static inline bool is_ev1938(struct ensoniq *ensoniq)
++{
++ return ensoniq->pci->device == 0x8938;
++}
++
+ static void snd_es1371_codec_write(struct snd_ac97 *ac97,
+ unsigned short reg, unsigned short val)
+ {
+ struct ensoniq *ensoniq = ac97->private_data;
+- unsigned int t, x;
++ unsigned int t, x, flag;
+
++ flag = is_ev1938(ensoniq) ? EV_1938_CODEC_MAGIC : 0;
+ mutex_lock(&ensoniq->src_mutex);
+ for (t = 0; t < POLL_COUNT; t++) {
+ if (!(inl(ES_REG(ensoniq, 1371_CODEC)) & ES_1371_CODEC_WIP)) {
+@@ -630,7 +637,8 @@ static void snd_es1371_codec_write(struct snd_ac97 *ac97,
+ 0x00010000)
+ break;
+ }
+- outl(ES_1371_CODEC_WRITE(reg, val), ES_REG(ensoniq, 1371_CODEC));
++ outl(ES_1371_CODEC_WRITE(reg, val) | flag,
++ ES_REG(ensoniq, 1371_CODEC));
+ /* restore SRC reg */
+ snd_es1371_wait_src_ready(ensoniq);
+ outl(x, ES_REG(ensoniq, 1371_SMPRATE));
+@@ -647,8 +655,9 @@ static unsigned short snd_es1371_codec_read(struct snd_ac97 *ac97,
+ unsigned short reg)
+ {
+ struct ensoniq *ensoniq = ac97->private_data;
+- unsigned int t, x, fail = 0;
++ unsigned int t, x, flag, fail = 0;
+
++ flag = is_ev1938(ensoniq) ? EV_1938_CODEC_MAGIC : 0;
+ __again:
+ mutex_lock(&ensoniq->src_mutex);
+ for (t = 0; t < POLL_COUNT; t++) {
+@@ -671,7 +680,8 @@ static unsigned short snd_es1371_codec_read(struct snd_ac97 *ac97,
+ 0x00010000)
+ break;
+ }
+- outl(ES_1371_CODEC_READS(reg), ES_REG(ensoniq, 1371_CODEC));
++ outl(ES_1371_CODEC_READS(reg) | flag,
++ ES_REG(ensoniq, 1371_CODEC));
+ /* restore SRC reg */
+ snd_es1371_wait_src_ready(ensoniq);
+ outl(x, ES_REG(ensoniq, 1371_SMPRATE));
+@@ -683,6 +693,11 @@ static unsigned short snd_es1371_codec_read(struct snd_ac97 *ac97,
+ /* now wait for the stinkin' data (RDY) */
+ for (t = 0; t < POLL_COUNT; t++) {
+ if ((x = inl(ES_REG(ensoniq, 1371_CODEC))) & ES_1371_CODEC_RDY) {
++ if (is_ev1938(ensoniq)) {
++ for (t = 0; t < 100; t++)
++ inl(ES_REG(ensoniq, CONTROL));
++ x = inl(ES_REG(ensoniq, 1371_CODEC));
++ }
+ mutex_unlock(&ensoniq->src_mutex);
+ return ES_1371_CODEC_READ(x);
+ }
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 34e7ec9..ed550e4 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -1153,7 +1153,7 @@ static void alc_auto_init_amp(struct hda_codec *codec, int type)
+ case 0x10ec0883:
+ case 0x10ec0885:
+ case 0x10ec0887:
+- case 0x10ec0889:
++ /*case 0x10ec0889:*/ /* this causes an SPDIF problem */
+ alc889_coef_init(codec);
+ break;
+ case 0x10ec0888:
diff --git a/2.6.32/1037_linux-2.6.32.38.patch b/2.6.32/1037_linux-2.6.32.38.patch
new file mode 100644
index 0000000..8dcf5ca
--- /dev/null
+++ b/2.6.32/1037_linux-2.6.32.38.patch
@@ -0,0 +1,19 @@
+diff --git a/net/rds/rdma.c b/net/rds/rdma.c
+index f7d8c08..6b09b94 100644
+--- a/net/rds/rdma.c
++++ b/net/rds/rdma.c
+@@ -473,14 +473,6 @@ static struct rds_rdma_op *rds_rdma_prepare(struct rds_sock *rs,
+
+ max_pages = max(nr, max_pages);
+ nr_pages += nr;
+-
+- /*
+- * nr_pages for one entry is limited to (UINT_MAX>>PAGE_SHIFT)+1,
+- * so tot_pages cannot overflow without first going negative.
+- */
+- if ((int)nr_pages < 0)
+- ret = -EINVAL;
+- goto out;
+ }
+
+ pages = kcalloc(max_pages, sizeof(struct page *), GFP_KERNEL);
diff --git a/2.6.32/4425_grsec-pax-without-grsec.patch b/2.6.32/4425_grsec-pax-without-grsec.patch
index baaabdb..c6e9159 100644
--- a/2.6.32/4425_grsec-pax-without-grsec.patch
+++ b/2.6.32/4425_grsec-pax-without-grsec.patch
@@ -36,7 +36,7 @@ diff -Naur linux-2.6.32-hardened-r44.orig/arch/x86/mm/fault.c linux-2.6.32-harde
diff -Naur linux-2.6.32-hardened-r44.orig/fs/exec.c linux-2.6.32-hardened-r44/fs/exec.c
--- linux-2.6.32-hardened-r44.orig/fs/exec.c 2011-04-17 18:15:55.000000000 -0400
+++ linux-2.6.32-hardened-r44/fs/exec.c 2011-04-17 18:29:40.000000000 -0400
-@@ -1792,9 +1792,11 @@
+@@ -1794,9 +1794,11 @@
}
up_read(&mm->mmap_sem);
}
@@ -48,7 +48,7 @@ diff -Naur linux-2.6.32-hardened-r44.orig/fs/exec.c linux-2.6.32-hardened-r44/fs
printk(KERN_ERR "PAX: execution attempt in: %s, %08lx-%08lx %08lx\n", path_fault, start, end, offset);
printk(KERN_ERR "PAX: terminating task: %s(%s):%d, uid/euid: %u/%u, "
"PC: %p, SP: %p\n", path_exec, tsk->comm, task_pid_nr(tsk),
-@@ -1809,10 +1811,12 @@
+@@ -1811,10 +1813,12 @@
#ifdef CONFIG_PAX_REFCOUNT
void pax_report_refcount_overflow(struct pt_regs *regs)
{
@@ -61,7 +61,7 @@ diff -Naur linux-2.6.32-hardened-r44.orig/fs/exec.c linux-2.6.32-hardened-r44/fs
printk(KERN_ERR "PAX: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
current->comm, task_pid_nr(current), current_uid(), current_euid());
print_symbol(KERN_ERR "PAX: refcount overflow occured at: %s\n", instruction_pointer(regs));
-@@ -1872,10 +1876,12 @@
+@@ -1874,10 +1878,12 @@
void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type)
{
^ permalink raw reply related [flat|nested] 13+ messages in thread
end of thread, other threads:[~2014-03-31 11:35 UTC | newest]
Thread overview: 13+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-12-27 2:29 [gentoo-commits] proj/hardened-patchset:master commit in: 2.6.32/ Anthony G. Basile
-- strict thread matches above, loose matches on Subject: below --
2014-03-31 11:35 Anthony G. Basile
2013-02-19 12:54 Anthony G. Basile
2013-02-11 0:23 Anthony G. Basile
2012-10-10 2:42 Anthony G. Basile
2012-10-10 1:23 Anthony G. Basile
2012-07-16 17:04 Anthony G. Basile
2012-05-28 12:57 Anthony G. Basile
2011-12-27 3:02 Anthony G. Basile
2011-08-24 19:00 Anthony G. Basile
2011-08-12 20:25 Anthony G. Basile
2011-08-12 20:06 Anthony G. Basile
2011-04-20 3:11 Anthony G. Basile
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox